joyce8/EMBER2024-capa huggingface dataset:
Function at 0x41ce7d
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
je 0x41cf1a
push ebx
push esi
call fcn.0041ce46
xor ebx, ebx
sub eax, esi
push ebx
push ebx
push ebx
push ebx
sar eax, 1
push eax
push esi
push ebx
push ebx
mov dword [ebp - 8], eax
call fcn.0041cdda
add esp, 0x24
mov dword [ebp - 4], eax
test eax, eax
jne 0x41cec7
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x41cf19
push edi
push eax
call fcn.00417a1d
mov edi, eax
pop ecx
push ebx
test edi, edi
jne 0x41cee7
call fcn.00417a6b
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x41cf18
push ebx
push dword [ebp - 4]
push edi
push dword [ebp - 8]
push esi
push ebx
push ebx
call fcn.0041cdda
add esp, 0x20
test eax, eax
jne 0x41cf06
push edi
call fcn.00417a6b
jmp 0x41cf0e
push ebx
call fcn.00417a6b
mov ebx, edi
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, ebx
pop edi
pop ebx
pop esi
leave
ret
Function at 0x423705
Capabilities:
Clear file content

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x2c
push ebx
mov ebx, dword [ebp + 8]
lea ecx, [ebp - 0x2c]
push esi
push edi
push dword [ebp + 0x10]
mov edi, dword [ebp + 0x14]
push dword [ebp + 0xc]
push ebx
call fcn.00423681
mov eax, dword [ebp - 0x2c]
and eax, dword [ebp - 0x28]
cmp eax, 0xffffffff
je 0x423874
mov eax, dword [ebp - 0x24]
and eax, dword [ebp - 0x20]
cmp eax, 0xffffffff
je 0x423874
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 8], ecx
mov dword [ebp - 4], eax
test ecx, ecx
jl 0x423829
jg 0x423761
test eax, eax
je 0x42381f
push 1
push 0x1000
call fcn.00419103
mov esi, eax
pop ecx
pop ecx
test esi, esi
jne 0x423784
push 0xc
pop ebx
mov byte [edi + 0x1c], 1
mov dword [edi + 0x18], ebx
jmp 0x423816
push 0x8000
push ebx
call fcn.00416b3b
pop ecx
pop ecx
mov ecx, dword [ebp - 0x1c]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0x18]
test eax, eax
jl 0x4237ad
jg 0x4237a8
cmp ecx, 0x1000
jb 0x4237ad
mov ecx, 0x1000
push edi
push ecx
push esi
push ebx
call fcn.0041fc9c
add esp, 0x10
cmp eax, 0xffffffff
je 0x4237f2
mov ecx, dword [ebp - 4]
cdq
sub ecx, eax
mov eax, dword [ebp - 8]
mov dword [ebp - 4], ecx
sbb eax, edx
mov dword [ebp - 8], eax
test eax, eax
jg 0x4237a8
jl 0x4237d9
test ecx, ecx
jne 0x42379a
push dword [ebp - 0xc]
push ebx
call fcn.00416b3b
push esi
call fcn.00417a6b
add esp, 0xc
xor ebx, ebx
jmp 0x423882
cmp byte [edi + 0x24], 0
je 0x423809
cmp dword [edi + 0x20], 5
jne 0x423809
mov byte [edi + 0x1c], 1
mov dword [edi + 0x18], 0xd
cmp byte [edi + 0x1c], 0
je 0x423814
mov ebx, dword [edi + 0x18]
jmp 0x423816
xor ebx, ebx
push esi
call fcn.00417a6b
pop ecx
jmp 0x423882
test ecx, ecx
jg 0x4237eb
jl 0x423829
test eax, eax
jae 0x4237eb
push 0
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push ebx
call fcn.004200f6
and eax, edx
add esp, 0x10
cmp eax, 0xffffffff
jne 0x423849
cmp byte [edi + 0x1c], 0
je 0x4237eb
jmp 0x42387a
push ebx
call fcn.0041da9b
pop ecx
push eax
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
test eax, eax
jne 0x4237eb
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 0xd
mov byte [edi + 0x24], 1
mov dword [edi + 0x20], eax
pop ebx
mov byte [edi + 0x1c], 1
mov dword [edi + 0x18], ebx
jmp 0x423882
cmp byte [edi + 0x1c], 0
je 0x42387f
mov ebx, dword [edi + 0x18]
jmp 0x423882
push 0x16
pop ebx
push 0
push dword [ebp - 0x28]
push dword [ebp - 0x2c]
push dword [ebp - 0x14]
call fcn.004200f6
add esp, 0x10
mov eax, ebx
pop edi
pop esi
pop ebx
leave
ret
Function at 0x40fb5f
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x58
lea eax, [ebp - 0x18]
mov dword [ebp - 0x30], ecx
mov dword [ebp - 0x28], edx
mov dword [eax - 4], esp
or dword [eax + 8], 0xffffffff
mov dword [eax + 4], 0x5836d0
mov esi, dword fs:[0]
mov dword [eax], esi
mov dword fs:[0], eax
movzx eax, byte [edx + 4]
test eax, eax
mov dword [ebp - 0x2c], eax
je 0x40fba2
cmp eax, 1
jne 0x40fbab
xor eax, eax
jmp 0x40fbad
mov dword [ebp - 0x64], 0x80000000
jmp 0x40fbc1
mov al, 1
lea edx, [ebp - 0x35]
lea ecx, [ebp - 0x64]
mov dword [edx + 1], 0x2020201
mov byte [edx], al
call fcn.0040fd67
and dword [ebp - 0x10], 0
mov ecx, 0x100
call fcn.0040651b
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x20], edx
mov esi, dword [ebp - 0x30]
lea ecx, [ebp - 0x64]
lea eax, [esi + 0x15c]
push 0x2c
push ecx
push eax
call fcn.0058a110
add esp, 0xc
lea eax, [esi + 0x30]
push 0x126
push 0
push eax
call fcn.0058a690
add esp, 0xc
mov edi, dword [ebp - 0x28]
lea ecx, [esi + 0x1ec]
mov bl, byte [edi + 6]
call fcn.0040f094
mov ecx, dword [ebp - 0x24]
mov al, 1
and dword [esi + 0x2f8], 0
and dword [esi + 0x2f4], 0
and dword [esi + 0x300], 0
and dword [esi + 0x2fc], 0
and dword [esi + 4], 0
and dword [esi], 0
and dword [esi + 0xc], 0
and dword [esi + 8], 0
and dword [esi + 0x14], 0
and dword [esi + 0x10], 0
and dword [esi + 0x1c], 0
and dword [esi + 0x18], 0
mov dword [esi + 0x20], 0x80000000
and dword [esi + 0x2c], 0
mov byte [esi + 0x156], bl
mov byte [esi + 0x157], al
and dword [esi + 0x158], 0
mov dword [esi + 0x188], ecx
mov ecx, dword [ebp - 0x20]
mov dword [esi + 0x18c], ecx
mov dword [esi + 0x190], 0x100
and dword [esi + 0x194], 0
and word [esi + 0x198], 0
mov byte [esi + 0x19a], bl
mov byte [esi + 0x19c], bl
mov byte [esi + 0x19d], al
mov dword [esi + 0x1a0], edi
and dword [esi + 0x1a4], 0
push 4
pop eax
mov dword [esi + 0x1a8], eax
and dword [esi + 0x1ac], 0
and dword [esi + 0x1b0], 0
mov dword [esi + 0x1b4], 1
and dword [esi + 0x1b8], 0
and dword [esi + 0x1bc], 0
mov dword [esi + 0x1c0], eax
and dword [esi + 0x1c4], 0
and dword [esi + 0x1c8], 0
mov dword [esi + 0x1cc], eax
and dword [esi + 0x1d0], 0
and dword [esi + 0x1d4], 0
mov dword [esi + 0x1d8], eax
mov eax, dword [ebp - 0x2c]
mov ecx, dword [ebp - 0x18]
and dword [esi + 0x1dc], 0
and dword [esi + 0x1e0], 0
or dword [esi + 0x2ec], 0xffffffff
and dword [esi + 0x2f0], 0
mov byte [esi + 0x304], al
mov dword fs:[0], ecx
add esp, 0x58
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x412f68
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x110
mov esi, esp
mov dword [esi + 0xf8], ebp
lea eax, [esi + 0x100]
mov dword [eax - 4], esp
or dword [eax + 8], 0xffffffff
mov dword [eax + 4], 0x583740
mov edi, dword fs:[0]
mov dword [eax], edi
mov dword fs:[0], eax
call fcn.00412fa7
Function at 0x44c0f0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
push ebx
push edi
push esi
mov eax, edx
mov edx, dword [esp + 0x14]
mov ebp, dword [esp + 0x20]
xor esi, esi
lea edx, [eax + edx*2]
movzx ebx, byte [eax + 1]
cmp byte [eax], ch
lea eax, [eax + 2]
lea edi, [esi + ebx]
jne 0x44c140
cmp esi, edi
ja 0x44c1a8
cmp edi, dword [esp + 0x1c]
ja 0x44c1b6
add esi, dword [esp + 0x18]
nop word [eax + eax]
test ebx, ebx
je 0x44c142
dec ebx
cmp byte [esi], cl
lea esi, [esi + 1]
jne 0x44c130
jmp 0x44c19f
ja 0x44c148
cmp eax, edx
mov esi, edi
jne 0x44c103
mov edi, dword [esp + 0x24]
movzx ecx, cx
mov al, 1
add edi, ebp
nop word cs:[eax + eax]
nop dword [eax]
movzx edx, byte [ebp]
lea esi, [ebp + 1]
test dl, dl
js 0x44c180
mov ebp, esi
sub ecx, edx
jns 0x44c197
jmp 0x44c1a1
cmp esi, edi
je 0x44c1c6
movzx esi, byte [ebp + 1]
and edx, 0x7f
add ebp, 2
shl edx, 8
or edx, esi
sub ecx, edx
js 0x44c1a1
xor al, 1
cmp ebp, edi
jne 0x44c160
jmp 0x44c1a1
xor eax, eax
and al, 1
pop esi
pop edi
pop ebx
pop ebp
ret
mov ecx, esi
mov edx, edi
push 0x5aa6f0
call fcn.0059a460
mov edx, dword [esp + 0x1c]
mov ecx, edi
push 0x5aa6f0
call fcn.0059a240
mov ecx, str.called__Option::unwrap____on_a__None__value_rustc_07dca489ac2d933c78d3c5158e3f43beefeb02celibrary_alloc_srccollections_btree_navigate.rs
mov edx, 0x2b
push 0x5aa6e0
call fcn.0059a2a0
int3
Function at 0x451287
Capabilities:
Hash data with crc32

Disassembly:
push ebp
push ebx
push edi
push esi
push eax
mov eax, edx
mov edx, dword [esp + 0x18]
mov ebx, ecx
not ebx
cmp edx, 0x40
jb 0x4513ae
push 4
pop edi
sub edi, 1
jb 0x451296
cmp edx, 0xf
jbe 0x4513be
movzx ebp, byte [eax + 0xe]
movzx esi, byte [eax + 0xf]
mov ecx, ebx
mov dword [esp], edx
mov edx, 0xff
shr ecx, 0x18
mov ebp, dword [ebp*4 + 0x5aef68]
xor ebp, dword [esi*4 + 0x5aeb68]
movzx esi, byte [eax + 0xd]
xor ebp, dword [esi*4 + 0x5af368]
movzx esi, byte [eax + 0xc]
xor ebp, dword [esi*4 + 0x5af768]
movzx esi, byte [eax + 0xb]
xor ebp, dword [esi*4 + 0x5afb68]
movzx esi, byte [eax + 0xa]
xor ebp, dword [esi*4 + 0x5aff68]
movzx esi, byte [eax + 9]
xor ebp, dword [esi*4 + 0x5b0368]
movzx esi, byte [eax + 8]
xor ebp, dword [esi*4 + 0x5b0768]
movzx esi, byte [eax + 7]
xor ebp, dword [esi*4 + 0x5b0b68]
movzx esi, byte [eax + 6]
xor ebp, dword [esi*4 + 0x5b0f68]
movzx esi, byte [eax + 5]
xor ebp, dword [esi*4 + 0x5b1368]
movzx esi, byte [eax + 4]
xor ebp, dword [esi*4 + 0x5b1768]
movzx esi, byte [eax + 3]
xor ecx, esi
mov esi, ebx
xor ebp, dword [ecx*4 + 0x5b1b68]
movzx ecx, byte [eax + 2]
shr esi, 0x10
and esi, edx
xor esi, ecx
movzx ecx, byte [eax + 1]
xor ebp, dword [esi*4 + 0x5b1f68]
mov esi, ebx
and ebx, edx
shr esi, 8
and esi, edx
mov edx, dword [esp]
xor esi, ecx
movzx ecx, byte [eax]
xor ebp, dword [esi*4 + 0x5b2368]
xor ebx, ecx
mov ecx, eax
xor ebp, dword [ebx*4 + 0x5b2768]
push 0x5aeb58
call fcn.00451812
pop ecx
mov ebx, ebp
jmp 0x4512a2
mov cl, byte [eax]
inc eax
dec edx
xor cl, bl
shr ebx, 8
movzx esi, cl
xor ebx, dword [esi*4 + 0x5aeb68]
test edx, edx
jne 0x45139b
not ebx
mov eax, ebx
add esp, 4
pop esi
pop edi
pop ebx
pop ebp
ret
push 0xf
pop ecx
push 0x5aeb48
call fcn.0059a1e0
Function at 0x465c9b
Capabilities:
Get system information on windows

Disassembly:
push esi
sub esp, 0x24
mov esi, esp
xorps xmm0, xmm0
and dword [esi + 0x20], 0
movups xmmword [esi + 0x10], xmm0
movups xmmword [esi], xmm0
push esi
call sub.kernel32.dll_GetSystemInfo
mov eax, dword [esi + 0x1c]
add esp, 0x24
pop esi
ret
Function at 0x4727b7
Capabilities:
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x90
lea eax, [ebp - 0x18]
mov ebx, ecx
mov dword [eax - 4], esp
or dword [eax + 8], 0xffffffff
mov dword [eax + 4], 0x584620
mov ecx, dword fs:[0]
mov dword [eax], ecx
mov dword fs:[0], eax
call fcn.0047060d
cmp eax, 2
jb 0x4727ff
cmp dword [eax + 4], 0
mov esi, eax
je 0x4727ff
add esi, 4
jmp 0x472968
call fcn.0047060d
cmp eax, 1
je 0x472966
mov esi, eax
test eax, eax
jne 0x47284e
and dword [ebp - 0x10], 0
mov dword [ebp - 0x34], ebx
push 8
pop ecx
push 4
pop edx
call fcn.0046ada7
mov dword [eax], 0x673040
and dword [eax + 4], 0
mov esi, eax
mov eax, dword [0x673040]
test eax, eax
je 0x47297e
dec eax
mov ebx, dword [ebp - 0x34]
or dword [ebp - 0x10], 0xffffffff
push esi
push eax
call dword [sym.imp.kernel32.dll_TlsSetValue]
test ebx, ebx
je 0x472866
mov edi, dword [ebx]
and dword [ebx], 0
test edi, edi
jne 0x472958
xor ecx, ecx
call fcn.004705f1
lea ecx, [ebp - 0x9c]
xorps xmm0, xmm0
movups xmmword [ecx + 0x10], xmm0
movups xmmword [ecx], xmm0
call fcn.00472a91
test eax, eax
jne 0x472991
movdqu xmm1, xmmword [ebp - 0x9c]
movups xmm0, xmmword [ebp - 0x8c]
pshufd xmm3, xmm1, 0x55
pshufd xmm2, xmm1, 0xee
movdqu xmmword [ebp - 0x44], xmm1
pshufd xmm1, xmm1, 0xff
movups xmmword [ebp - 0x34], xmm0
movdqu xmmword [ebp - 0x74], xmm3
movdqu xmmword [ebp - 0x64], xmm2
movdqu xmmword [ebp - 0x54], xmm1
push 8
pop edx
mov ecx, 0x158
call fcn.0046ada7
mov edi, eax
xor eax, eax
inc eax
mov dword [edi], eax
mov dword [edi + 4], eax
lea eax, [edi + 8]
push 0x100
push 0
push eax
call fcn.0058a690
add esp, 0xc
movups xmm0, xmmword [ebp - 0x44]
movups xmm2, xmmword [ebp - 0x54]
movups xmm1, xmmword [ebp - 0x64]
mov dword [edi + 0x108], 0x40
mov eax, 0x10000
movss dword [edi + 0x110], xmm0
movss dword [edi + 0x11c], xmm2
movss dword [edi + 0x118], xmm1
movups xmm2, xmmword [ebp - 0x74]
movups xmm1, xmmword [ebp - 0x34]
movss dword [edi + 0x114], xmm2
movups xmmword [edi + 0x120], xmm1
xorps xmm1, xmm1
movups xmmword [edi + 0x130], xmm1
mov dword [edi + 0x140], eax
and dword [edi + 0x144], 0
mov dword [edi + 0x148], eax
and dword [edi + 0x14c], 0
and dword [edi + 0x150], 0
add esi, 4
mov ecx, dword [esi]
mov dword [esi], edi
call fcn.004705f1
jmp 0x472968
xor esi, esi
mov eax, dword [ebp - 0x18]
mov dword fs:[0], eax
mov eax, esi
add esp, 0x90
pop esi
pop edi
pop ebx
pop ebp
ret
or dword [ebp - 0x10], 0xffffffff
mov ecx, 0x673040
call fcn.0059d5e0
jmp 0x47283f
xor edx, edx
lea ecx, [ebp - 0x24]
lea esi, [ebp - 0x7c]
mov dword [ecx], eax
mov dword [esi], ecx
mov dword [ecx + 4], 0x5ceccc
lea ecx, [ebp - 0x9c]
inc edx
mov dword [esi + 4], 0x472a4f
mov dword [ecx], 0x5ceca4
mov dword [ecx + 4], edx
and dword [ecx + 0x10], 0
mov dword [ecx + 8], esi
mov dword [ecx + 0xc], edx
mov dword [ebp - 0x10], edx
mov edx, 0x5cecac
call fcn.0059a150
ud2
Function at 0x472a91
Capabilities:
Generate random numbers via rtlgenrandom
Generate random numbers via winapi

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 8
mov dword [esp], ecx
push 0x20
pop ebp
xor ebx, ebx
mov edi, dword [esp]
test bl, 1
jne 0x472afa
mov esi, ebp
lea eax, [edi + ebp]
mov dword [esp], eax
push 2
push ebp
push edi
push 0
call dword [sym.imp.bcrypt.dll_BCryptGenRandom]
xor ebp, ebp
mov bl, 1
cmp eax, 0xc0000000
mov dword [esp + 4], eax
jb 0x472aa0
push esi
push edi
call dword [sym.imp.advapi32.dll_SystemFunction036]
test al, al
jne 0x472aa0
mov esi, dword [esp + 4]
xor esi, 0x80000000
je 0x472afa
mov al, byte [0x673c84]
push 4
pop ecx
mov edx, ecx
call fcn.004051f0
test eax, eax
je 0x472b04
mov dword [eax], esi
jmp 0x472afc
xor eax, eax
add esp, 8
pop esi
pop edi
pop ebx
pop ebp
ret
push 4
pop ecx
mov edx, ecx
call fcn.00599e40

Function at 0x472b50
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xffffffc0
sub esp, 0x680
mov esi, esp
mov dword [esi + 0x658], ebp
lea eax, [esi + 0x660]
mov dword [eax - 4], esp
or dword [eax + 8], 0xffffffff
mov dword [eax + 4], 0x584630
mov edi, dword fs:[0]
mov dword [eax], edi
mov dword fs:[0], eax
call fcn.00472b8f
Function at 0x4820f7
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x60
mov esi, dword [edx + 4]
mov dword [esp + 8], ecx
mov ecx, dword [ebp + 0xc]
mov eax, dword [esi + 0x1c]
mov dword [esp + 0x10], esi
cmp ecx, eax
cmovb eax, ecx
mov ecx, dword [esi + 0x18]
add esi, 0x14
mov dword [esp + 0x14], esi
xor esi, esi
add ecx, 0xe
cmp eax, esi
je 0x48214f
cmp byte [ecx - 2], 0
mov edi, esi
je 0x482151
mov bl, byte [ecx - 1]
mov esi, dword [ebp + 8]
cmp bl, byte [esi + edi*2]
jne 0x482151
mov bl, byte [esi + edi*2 + 1]
lea esi, [edi + 1]
cmp byte [ecx], bl
lea ecx, [ecx + 0x10]
je 0x482128
jmp 0x482151
mov edi, eax
mov esi, dword [ebp + 0xc]
cmp edi, esi
jae 0x48225f
lea ebx, [esp + 0x18]
mov ecx, ebx
push edi
call fcn.00482ada
pop eax
mov edx, dword [ebx]
cmp edx, 0x2a
jne 0x48223c
mov ecx, dword [ebp + 8]
mov edx, esi
push 0x5d1c94
push edi
call fcn.004826b1
pop ecx
pop ecx
test edx, edx
je 0x482271
mov ebx, dword [esp + 0x10]
mov dword [esp + 0xc], edx
mov edx, dword [ebx + 0x1c]
mov esi, edx
sub esi, 1
jb 0x482283
mov ecx, dword [ebx + 0x18]
mov edi, eax
push 0x5d1cc4
push esi
call fcn.00482c4a
pop ecx
pop edx
cmp byte [eax + 0xc], 0
jne 0x482295
movzx eax, word [edi]
mov ecx, dword [ebx + 0x18]
mov edx, dword [ebx + 0x1c]
mov word [esp + 6], ax
push 0x5d1d20
push esi
call fcn.00482c4a
pop ecx
pop edx
movzx ecx, word [esp + 6]
mov edx, dword [esp + 0xc]
mov byte [eax + 0xc], 1
mov word [eax + 0xd], cx
mov ecx, edi
push 0x5d1d30
push 1
call fcn.004826b1
pop ecx
pop ecx
mov ebx, edx
mov edi, eax
lea esi, [esp + 0x18]
add ebx, edx
test ebx, ebx
je 0x48224e
movzx eax, word [edi]
mov ecx, dword [esp + 0x14]
and dword [esp + 0x18], 0
mov dword [esp + 0x1c], 4
and dword [esp + 0x20], 0
mov edx, esi
mov byte [esp + 0x24], 1
add edi, 2
mov word [esp + 0x25], ax
call fcn.00482c63
add ebx, 0xfffffffe
jmp 0x482206
mov eax, dword [esp + 8]
lea esi, [esp + 0x1c]
lea edi, [eax + 4]
push 0xf
pop ecx
rep movsd dword es:[edi], dword [esi]
jmp 0x482255
mov eax, dword [esp + 8]
push 0x2a
pop edx
mov dword [eax], edx
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
push 0x2b
pop edx
mov ecx, str.assertion_failed:_prefix_len___ranges.len__
push 0x5d1c84
call fcn.0059a2a0
push 0x24
pop edx
mov ecx, str.assertion_failed:__ranges.is_empty___f
push 0x5d1d64
call fcn.0059a2a0
push 0xf
pop edx
mov ecx, str.non_empty_nodes
push 0x5d1cb4
call fcn.0059a5e0
push 0x3c
pop edx
mov ecx, str.assertion_failed:_self.state.uncompiled_last_.last.is_none___f
push 0x5d1d10
call fcn.0059a2a0
Function at 0x484d2e
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0xcc
mov dword [ebp - 0x24], ecx
lea ecx, [ebp - 0x1c]
mov dword [ecx], esp
or dword [ecx + 0xc], 0xffffffff
push 4
pop eax
mov dword [ecx + 8], 0x584960
lea edi, [ecx + eax]
lea esi, [ebp - 0xd8]
mov edx, dword fs:[0]
mov dword [ecx + 4], edx
mov dword fs:[0], edi
and dword [ecx + 0xc], 0
lea ecx, [ebp - 0x98]
and dword [ebp - 0x44], 0
mov dword [ebp - 0x40], eax
and dword [ebp - 0x3c], 0
mov dword [ebp - 0x38], 0x2710
and word [ebp - 0x34], 0
and dword [ebp - 0x30], 0
mov dword [ebp - 0x2c], eax
and dword [ebp - 0x28], 0
and dword [esi + 0x38], 0
and dword [esi + 0x34], 0
and word [esi + 0x3c], 0
and dword [esi + 4], 0
and dword [esi + 0xc], 0
and dword [esi + 0x14], 0
mov dword [esi + 0x18], eax
and dword [esi + 0x1c], 0
and dword [esi + 0x20], 0
mov dword [esi + 0x24], eax
and dword [esi + 0x28], 0
and dword [esi + 0x2c], 0
mov dword [esi + 0x30], eax
mov byte [esi + 0x3e], 0xa
and dword [esi], 0
and dword [ebp - 0x48], 0
and dword [ecx], 0
mov dword [ecx + 4], eax
and dword [ecx + 8], 0
and dword [ecx + 0xc], 0
mov dword [ecx + 0x10], eax
and dword [ecx + 0x14], 0
and dword [ecx + 0x30], 0
and dword [ecx + 0x34], 0
mov dword [ecx + 0x38], eax
and dword [ecx + 0x3c], 0
and dword [ecx + 0x40], 0
and dword [ecx + 0x44], 0
mov dword [ecx + 0x48], 1
and dword [ecx + 0x4c], 0
and dword [ecx + 0x18], 0
mov dword [ecx + 0x1c], eax
and dword [ecx + 0x20], 0
and dword [ecx + 0x24], 0
mov dword [ecx + 0x28], eax
and dword [ecx + 0x2c], 0
add eax, esi
mov dword [ebp - 0x20], eax
call fcn.00482429
mov esi, dword [ebp - 0x24]
lea eax, [esi + 0x88]
push 0x50
lea ecx, [ebp - 0x98]
push ecx
push eax
call fcn.0058a110
add esp, 0xc
mov dword [esi + 0x14], 0xa020202
mov dword [esi + 0x10], 0x2020201
and dword [esi + 0x1c], 0
mov dword [esi + 0x18], 0xfa
mov dword [esi], 2
mov byte [esi + 8], 0
mov dword [esi + 0xa], 0x3020202
lea eax, [esi + 0x20]
push 0x40
lea ecx, [ebp - 0xd8]
push ecx
push eax
call fcn.0058a110
add esp, 0xc
lea eax, [esi + 0x60]
lea ecx, [ebp - 0x48]
push 0x24
push ecx
push eax
call fcn.0058a110
add esp, 0xc
mov eax, dword [ebp - 0x18]
and dword [esi + 0x84], 0
and dword [esi + 0xd8], 0
and dword [esi + 0xdc], 0
mov dword [esi + 0xe0], 4
and dword [esi + 0xe4], 0
mov dword [esi + 0xe8], 0x3e8
and word [esi + 0xec], 0
mov dword fs:[0], eax
add esp, 0xcc
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x485851
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x18
lea edi, [ebp - 0x18]
mov ebx, ecx
mov dword [edi - 4], esp
or dword [edi + 8], 0xffffffff
mov dword [edi + 4], 0x584980
mov eax, dword fs:[0]
mov dword [edi], eax
mov dword fs:[0], edi
mov esi, dword [ecx + 8]
mov edx, dword [ecx + 0xc]
mov ecx, esi
call fcn.004b0870
mov ecx, dword [ebx + 4]
mov edx, esi
call fcn.004281e3
mov ecx, dword [ebx + 0x18]
mov edx, dword [ebx + 0x1c]
mov dword [ebp - 0x20], ebx
mov dword [edi + 8], 1
mov dword [ebp - 0x24], ecx
call fcn.004b0896
mov esi, dword [ebp - 0x20]
mov edx, dword [ebp - 0x24]
mov ecx, dword [esi + 0x14]
call fcn.004b0d77
and dword [ebp - 0x10], 0
lea ecx, [esi + 0x20]
call fcn.004859d7
mov esi, dword [ebp - 0x20]
lea ecx, [esi + 0x30]
call fcn.00485a4a
mov ecx, dword [esi + 0x44]
mov edx, dword [esi + 0x48]
call fcn.0041b0e1
mov eax, dword [ebp - 0x18]
mov dword fs:[0], eax
add esp, 0x18
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x48763e
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x168
mov esi, esp
mov dword [esi + 0x150], ebp
lea eax, [esi + 0x158]
mov dword [esi + 4], ecx
mov dword [eax - 4], esp
or dword [eax + 8], 0xffffffff
mov dword [eax + 4], 0x5849d0
mov ecx, dword fs:[0]
mov dword [eax], ecx
mov dword fs:[0], eax
mov dword [esi + 0x58], 0x2020202
mov byte [esi + 0x54], 3
and dword [esi + 0xc], 0
and dword [esi + 8], 0
mov word [esi + 0x5c], 0x202
and dword [esi + 0x30], 0
push 2
pop ecx
and dword [eax + 8], 0
mov dword [esi + 0x38], ecx
mov dword [esi + 0x40], ecx
lea ecx, [esi + 0x60]
call fcn.00484d2e
lea eax, [esi + 8]
push 0x58
push eax
mov edi, dword [esi + 4]
push edi
call fcn.0058a110
add esp, 0xc
add edi, 0x58
push 0xf0
lea eax, [esi + 0x60]
push eax
push edi
call fcn.0058a110
add esp, 0xc
mov eax, dword [esi + 0x158]
mov dword fs:[0], eax
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x488096
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x178
mov esi, esp
mov dword [esi + 0x160], ebp
lea eax, [esi + 0x168]
mov dword [esi + 4], ecx
mov dword [esi], edx
mov dword [eax - 4], esp
or dword [eax + 8], 0xffffffff
mov dword [eax + 4], 0x584a30
mov ecx, dword fs:[0]
mov dword [eax], ecx
mov dword fs:[0], eax
and dword [esi + 0xc], 0
mov dword [esi + 0x10], 4
and dword [esi + 0x14], 0
and dword [eax + 8], 0
lea ecx, [esi + 0x68]
call fcn.00486293
lea ecx, [esi + 0x38]
lea edx, [esi + 0x68]
call fcn.004862dd
mov eax, dword [esi + 0x44]
mov edx, dword [esi + 0x38]
mov edi, dword [esi + 0x3c]
movsd xmm0, qword [0x6519d0]
movsd xmm1, qword [0x6519d8]
mov ecx, dword [esi + 0x40]
movsd qword [esi + 0x18], xmm0
movsd qword [esi + 0x20], xmm1
mov dword [esi + 0x28], edx
mov dword [esi + 0x2c], edi
mov dword [esi + 0x34], eax
mov eax, dword [esi]
mov dword [esi + 0x30], ecx
lea ecx, [esi + 0x4c]
mov eax, dword [eax + 0x278]
mov edx, dword [eax + 0x148]
mov dword [esi + 0x170], 1
mov dword [esi + 8], edx
call fcn.00485021
mov edx, dword [esi + 8]
lea ecx, [esi + 0x68]
mov dword [esi + 0x170], 2
call fcn.00485021
movsd xmm0, qword [esi + 0x5c]
lea edi, [esi + 0x128]
lea ebx, [esi + 0x98]
mov eax, dword [esi + 0x64]
movsd xmm1, qword [esi + 0x54]
movsd qword [edi + 0x10], xmm0
movsd xmm0, qword [esi + 0x4c]
mov dword [edi + 0x18], eax
movsd qword [edi + 8], xmm1
movsd xmm1, qword [ebx - 0x28]
mov eax, dword [ebx - 0x18]
movsd qword [edi], xmm0
movsd xmm0, qword [ebx - 0x30]
movsd qword [edi + 0x24], xmm1
mov dword [edi + 0x34], eax
movsd qword [edi + 0x1c], xmm0
movsd xmm0, qword [ebx - 0x20]
and dword [ebx + 0x44], 0
movsd qword [edi + 0x2c], xmm0
push 4
pop eax
mov dword [ebx + 0x48], eax
and dword [ebx + 0x4c], 0
and dword [ebx + 0x50], 0
mov dword [ebx + 0x54], eax
mov eax, dword [esi + 0x14]
movsd xmm0, qword [esi + 0xc]
movsd xmm2, qword [esi + 0x30]
movsd xmm1, qword [esi + 0x28]
and dword [ebx + 0x58], 0
mov dword [ebx + 0x64], eax
movsd qword [ebx + 0x5c], xmm0
movsd qword [ebx - 0x18], xmm2
movsd qword [ebx - 0x20], xmm1
movsd xmm2, qword [esi + 0x18]
movsd xmm1, qword [esi + 0x20]
movsd qword [ebx - 0x28], xmm1
movsd qword [ebx - 0x30], xmm2
push 0x38
push edi
push ebx
call fcn.0058a110
add esp, 0xc
and dword [ebx + 0x68], 0
push 4
pop eax
mov edx, dword [esi]
mov dword [ebx + 0x6c], eax
and dword [ebx + 0x70], 0
and dword [ebx + 0x74], 0
mov dword [ebx + 0x78], 1
and dword [ebx + 0x7c], 0
and dword [ebx - 0x10], 0
and dword [ebx + 0x38], 0
and dword [ebx + 0x3c], 0
and dword [ebx + 0x40], 0
and dword [ebx + 0x80], 0
lea ecx, [esi + 0x68]
mov dword [esi + 0x170], 3
mov dword [edi], edx
mov dword [edi + 4], ecx
lea ecx, [esi + 0x128]
call fcn.00488319
push 0xc0
lea eax, [esi + 0x68]
push eax
push dword [esi + 4]
call fcn.0058a110
add esp, 0xc
mov eax, dword [esi + 0x168]
mov dword fs:[0], eax
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret