joyce8/EMBER2024-capa huggingface dataset:
Function at 0x437663
Capabilities:
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x14
mov eax, dword [ebp + 8]
cmp eax, dword [ebp + 0xc]
jb 0x437700
mov ebx, dword [edx + 0x18]
mov edi, edx
mov esi, ecx
xor ecx, ecx
mov edx, 0x4b56c4
add edi, 8
inc ebx
setne cl
call fcn.0043a998
mov ecx, edi
mov edx, ebx
call fcn.00435458
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x10], esi
cmp dword [eax], 0
je 0x4376ae
mov ebx, dword [eax + 8]
add ebx, 0x18
jmp 0x4376b1
mov ebx, dword [eax + 4]
mov eax, dword [ebp + 0x10]
mov edx, edi
mov esi, dword [eax]
mov ecx, dword [esi + 0x10]
call fcn.00437601
test al, al
je 0x4376ca
and dword [ebp - 0x20], 0
jmp 0x4376e2
mov ecx, dword [esi + 8]
mov edx, dword [esi + 0xc]
call fcn.00433561
lea ecx, [ebp - 0x20]
push edi
push ebx
push eax
push ecx
call dword [edx + 0x34]
add esp, 0x10
movsd xmm0, qword [ebp - 0x20]
mov eax, dword [ebp - 0x10]
movsd xmm1, qword [ebp - 0x18]
movsd qword [eax + 8], xmm1
movsd qword [eax], xmm0
add esp, 0x14
pop esi
pop edi
pop ebx
pop ebp
ret
push 0x1e
pop edx
mov ecx, 0x4b5694
push 0x4b56b4
call fcn.0040db80

Function at 0x437712
Capabilities:
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
sub esp, 0x18
mov esi, ecx
call fcn.00426b73
cmp eax, 2
jb 0x437731
cmp dword [eax + 4], 0
je 0x437731
add eax, 8
jmp 0x43779b
call fcn.00426b73
cmp eax, 1
je 0x437799
mov edi, eax
test eax, eax
jne 0x437769
push 0xc
pop ecx
push 4
pop edx
call fcn.00426ad8
mov dword [eax], 0x4ab014
and dword [eax + 4], 0
mov edi, eax
mov eax, dword [0x4ab014]
test eax, eax
je 0x4377a2
dec eax
push edi
push eax
call sub.kernel32.dll_TlsSetValue
test esi, esi
je 0x43777b
mov eax, dword [esi]
and dword [esi], 0
test eax, eax
je 0x43777b
mov ecx, dword [esi + 4]
jmp 0x43778a
xor ecx, ecx
inc ecx
lock xadd dword [0x4ab010], ecx
test ecx, ecx
je 0x4377ae
lea eax, [edi + 8]
mov dword [edi + 4], 1
mov dword [edi + 8], ecx
jmp 0x43779b
xor eax, eax
add esp, 0x18
pop esi
pop edi
pop ebp
ret
mov ecx, 0x4ab014
call fcn.004665d0
jmp 0x437762
lea ecx, [ebp - 0x20]
mov edx, 0x4b6834
mov dword [ecx], str.regex:_thread_ID_allocation_space_exhausted
mov dword [ecx + 4], 1
and dword [ecx + 0x10], 0
mov dword [ecx + 8], str.combase.dll
and dword [ecx + 0xc], 0
call fcn.0040cbc0
Function at 0x4423a0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x74
mov edi, ecx
mov ecx, edx
mov esi, edx
call fcn.0043c0d7
cmp eax, 0x78
je 0x4423d5
mov ecx, esi
call fcn.0043c0d7
cmp eax, 0x75
je 0x4423d5
mov ecx, esi
call fcn.0043c0d7
cmp eax, 0x55
jne 0x442477
mov ecx, esi
call fcn.0043c0d7
cmp eax, 0x75
mov dl, 2
sete cl
sub dl, cl
xor ecx, ecx
cmp eax, 0x78
movzx ebx, dl
cmove ebx, ecx
mov ecx, esi
call fcn.0043f241
test al, al
je 0x442417
mov ecx, esi
call fcn.0043c0d7
cmp eax, 0x7b
jne 0x442461
movzx eax, bl
mov ecx, edi
mov edx, esi
push eax
call fcn.00443071
jmp 0x44246e
mov ecx, dword [esi]
lea eax, [ebp - 0x24]
lea ebx, [ebp - 0x40]
mov edx, dword [ecx + 0x58]
mov dword [eax + 0x14], edx
mov edx, dword [esi + 4]
movsd xmm0, qword [ecx + 0x50]
movsd qword [eax + 0xc], xmm0
movsd xmm0, qword [ecx + 0x50]
movsd qword [eax], xmm0
mov ecx, dword [ecx + 0x58]
mov dword [ebx], 0xa
mov dword [eax + 8], ecx
lea ecx, [ebp - 0x80]
push ebx
push eax
push dword [esi + 8]
call fcn.00453a38
add esp, 0xc
push 0x10
pop ecx
lea esi, [ebp - 0x80]
rep movsd dword es:[edi], dword [esi]
jmp 0x44246f
movzx eax, bl
mov ecx, edi
mov edx, esi
push eax
call fcn.00443331
pop eax
add esp, 0x74
pop esi
pop edi
pop ebx
pop ebp
ret
push 0x50
pop edx
mov ecx, str.assertion_failed:_self.char____x__self.char____u__self.char____U
push 0x4b7060
call fcn.0040db80

Function at 0x44657c
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0xc
mov esi, edx
mov edx, ecx
imul eax, esi, 0x1c
shr esi, 1
add eax, ecx
mov ecx, esi
neg ecx
imul edi, ecx, 0x1c
mov ecx, esi
add edi, eax
push 0x4b8c08
push esi
call fcn.00448f08
pop ecx
pop ecx
mov dword [ebp - 0x14], edx
mov ebx, eax
mov edx, edi
mov ecx, esi
push 0x4b8c18
push esi
call fcn.00448f08
pop ecx
pop ecx
imul edi, esi, 0x1c
mov dword [ebp - 0x10], edx
xor edx, edx
mov dword [ebp - 0x18], esi
add edi, eax
cmp edx, dword [ebp - 0x18]
je 0x446602
cmp edx, dword [ebp - 0x14]
je 0x44660a
mov ecx, edx
not ecx
add ecx, dword [ebp - 0x18]
cmp ecx, dword [ebp - 0x10]
jae 0x446619
push 0xfffffffffffffff9
pop ecx
test ecx, ecx
je 0x4465f9
mov esi, dword [ebx + ecx*4 + 0x1c]
mov eax, dword [edi + ecx*4]
mov dword [ebx + ecx*4 + 0x1c], eax
mov dword [edi + ecx*4], esi
inc ecx
jmp 0x4465e4
inc edx
add ebx, 0x1c
add edi, 0xffffffe4
jmp 0x4465cb
add esp, 0xc
pop esi
pop edi
pop ebx
pop ebp
ret
mov ecx, dword [ebp - 0x14]
mov edx, ecx
push 0x4b8c28
call fcn.0040cf20
mov edx, dword [ebp - 0x10]
push 0x4b8c38
call fcn.0040cf20
Function at 0x456ba6
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x74
mov edi, ecx
mov ecx, edx
mov esi, edx
call fcn.00450bf9
cmp eax, 0x78
je 0x456bdb
mov ecx, esi
call fcn.00450bf9
cmp eax, 0x75
je 0x456bdb
mov ecx, esi
call fcn.00450bf9
cmp eax, 0x55
jne 0x456c7d
mov ecx, esi
call fcn.00450bf9
cmp eax, 0x75
mov dl, 2
sete cl
sub dl, cl
xor ecx, ecx
cmp eax, 0x78
movzx ebx, dl
cmove ebx, ecx
mov ecx, esi
call fcn.00453abe
test al, al
je 0x456c1d
mov ecx, esi
call fcn.00450bf9
cmp eax, 0x7b
jne 0x456c67
movzx eax, bl
mov ecx, edi
mov edx, esi
push eax
call fcn.0045774b
jmp 0x456c74
mov ecx, dword [esi]
lea eax, [ebp - 0x24]
lea ebx, [ebp - 0x40]
mov edx, dword [ecx + 0x58]
mov dword [eax + 0x14], edx
mov edx, dword [esi + 4]
movsd xmm0, qword [ecx + 0x50]
movsd qword [eax + 0xc], xmm0
movsd xmm0, qword [ecx + 0x50]
movsd qword [eax], xmm0
mov ecx, dword [ecx + 0x58]
mov dword [ebx], 0xa
mov dword [eax + 8], ecx
lea ecx, [ebp - 0x80]
push ebx
push eax
push dword [esi + 8]
call fcn.00453a38
add esp, 0xc
push 0x10
pop ecx
lea esi, [ebp - 0x80]
rep movsd dword es:[edi], dword [esi]
jmp 0x456c75
movzx eax, bl
mov ecx, edi
mov edx, esi
push eax
call fcn.00457a0b
pop eax
add esp, 0x74
pop esi
pop edi
pop ebx
pop ebp
ret
push 0x50
pop edx
mov ecx, str.assertion_failed:_self.char____x__self.char____u__self.char____U
push 0x4b9384
call fcn.0040db80
Function at 0x465123
Capabilities:
Enumerate process modules
Parse pe header
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [0x523144]
test eax, 0x7fffffff
jne 0x465136
mov al, 1
pop ebp
ret
pop ebp
jmp fcn.0046bd40

Function at 0x46515a
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push esi
mov eax, dword [ebp + 8]
mov ecx, dword [eax]
mov eax, dword [ecx]
and dword [ecx], 0
test eax, eax
je 0x4651b3
mov edx, dword [eax]
xor esi, esi
mov eax, dword [edx + 0xc]
mov ecx, dword [edx + 0x10]
and dword [edx + 4], 0
and dword [edx + 0xc], 0
and dword [edx + 0x14], 0
and dword [edx + 0x18], 0
and dword [edx + 0x1c], 0
cmp dword [edx], esi
mov dword [edx], 1
mov byte [edx + 8], 0
mov dword [edx + 0x10], 4
je 0x4651b0
test eax, eax
je 0x4651b0
shl eax, 2
push 4
pop edx
push eax
call fcn.00405990
pop eax
pop esi
pop ebp
ret
push 0x2b
pop edx
mov ecx, 0x5063db
push 0x502460
call fcn.0040db80
Function at 0x465a80
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
push eax
movzx eax, byte [0x5230fc]
test al, al
je 0x465c08
mov eax, dword [ebp + 0xc]
test eax, eax
je 0x465aa6
cmp eax, 3
jne 0x465c08
mov edi, dword [0x523100]
test edi, edi
je 0x465c08
mov dword [ebp - 0x10], 0
jmp 0x465ac7
mov edi, dword [edi + 8]
test edi, edi
je 0x465af6
mov esi, dword [edi]
mov ebx, dword [edi + 4]
test ebx, ebx
je 0x465c47
dec esi
push esi
call sub.kernel32.dll_TlsGetValue
test eax, eax
je 0x465ac0
push 0
push esi
mov esi, eax
call sub.kernel32.dll_TlsSetValue
push esi
call ebx
add esp, 4
mov al, 1
mov dword [ebp - 0x10], eax
jmp 0x465ac0
test byte [ebp - 0x10], 1
je 0x465c08
mov edi, dword [0x523100]
test edi, edi
je 0x465c08
mov dword [ebp - 0x10], 0
jmp 0x465b27
mov edi, dword [edi + 8]
test edi, edi
je 0x465b56
mov esi, dword [edi]
mov ebx, dword [edi + 4]
test ebx, ebx
je 0x465c47
dec esi
push esi
call sub.kernel32.dll_TlsGetValue
test eax, eax
je 0x465b20
push 0
push esi
mov esi, eax
call sub.kernel32.dll_TlsSetValue
push esi
call ebx
add esp, 4
mov al, 1
mov dword [ebp - 0x10], eax
jmp 0x465b20
test byte [ebp - 0x10], 1
je 0x465c08
mov edi, dword [0x523100]
test edi, edi
je 0x465c08
mov dword [ebp - 0x10], 0
jmp 0x465b87
mov edi, dword [edi + 8]
test edi, edi
je 0x465bb6
mov esi, dword [edi]
mov ebx, dword [edi + 4]
test ebx, ebx
je 0x465c47
dec esi
push esi
call sub.kernel32.dll_TlsGetValue
test eax, eax
je 0x465b80
push 0
push esi
mov esi, eax
call sub.kernel32.dll_TlsSetValue
push esi
call ebx
add esp, 4
mov al, 1
mov dword [ebp - 0x10], eax
jmp 0x465b80
test byte [ebp - 0x10], 1
je 0x465c08
mov edi, dword [0x523100]
test edi, edi
je 0x465c08
mov dword [ebp - 0x10], 0
jmp 0x465bd7
mov edi, dword [edi + 8]
test edi, edi
je 0x465c02
mov esi, dword [edi]
mov ebx, dword [edi + 4]
test ebx, ebx
je 0x465c47
dec esi
push esi
call sub.kernel32.dll_TlsGetValue
test eax, eax
je 0x465bd0
push 0
push esi
mov esi, eax
call sub.kernel32.dll_TlsSetValue
push esi
call ebx
add esp, 4
mov al, 1
mov dword [ebp - 0x10], eax
jmp 0x465bd0
test byte [ebp - 0x10], 1
jne 0x465c12
add esp, 4
pop esi
pop edi
pop ebx
pop ebp
ret 0xc
mov edi, dword [0x523100]
jmp 0x465c1d
mov edi, dword [edi + 8]
test edi, edi
je 0x465c08
mov esi, dword [edi]
mov ebx, dword [edi + 4]
test ebx, ebx
je 0x465c47
dec esi
push esi
call sub.kernel32.dll_TlsGetValue
test eax, eax
je 0x465c1a
push 0
push esi
mov esi, eax
call sub.kernel32.dll_TlsSetValue
push esi
call ebx
add esp, 4
jmp 0x465c1a
mov edx, 0x2b
mov ecx, 0x5063db
push 0x504758
call fcn.0040db80
add esp, 4
ud2
Function at 0x4665d0
Capabilities:
Allocate thread local storage

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x20
cmp dword [ecx + 4], 0
mov esi, ecx
je 0x466640
lea ebx, [esi + 0xc]
mov dword [ebp - 0x14], 0
lea eax, [ebp - 0x14]
push 0
push eax
push 0
push ebx
call sub.kernel32.dll_InitOnceBeginInitialize
cmp eax, 1
mov dword [ebp - 0x10], eax
jne 0x466676
cmp dword [ebp - 0x14], 0
je 0x46665d
call sub.kernel32.dll_TlsAlloc
cmp eax, 0xffffffff
je 0x466688
mov edi, eax
inc eax
mov dword [esi], eax
mov eax, dword [0x523100]
nop dword [eax + eax]
mov dword [esi + 8], eax
lock cmpxchg dword [0x523100], esi
jne 0x466620
mov byte [0x5230fc], 1
push 0
push 0
push ebx
call sub.kernel32.dll_InitOnceComplete
jmp 0x46666c
call sub.kernel32.dll_TlsAlloc
cmp eax, 0xffffffff
mov dword [ebp - 0x10], eax
je 0x4666c2
mov ecx, eax
xor eax, eax
inc ecx
lock cmpxchg dword [esi], ecx
jne 0x466661
mov edi, dword [ebp - 0x10]
jmp 0x46666c
mov edi, dword [esi]
jmp 0x46666b
mov edi, eax
push dword [ebp - 0x10]
call sub.kernel32.dll_TlsFree
dec edi
mov eax, edi
add esp, 0x20
pop esi
pop edi
pop ebx
pop ebp
ret
lea ecx, [ebp - 0x10]
lea edx, [ebp - 0x2c]
mov dword [ebp - 0x2c], 0
call fcn.00466af0
push 0
push 4
push ebx
call sub.kernel32.dll_InitOnceComplete
lea ecx, [ebp - 0x2c]
mov edx, 0x504724
mov dword [ebp - 0x2c], 0x5046ec
mov dword [ebp - 0x28], 1
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x24], str.combase.dll
mov dword [ebp - 0x20], 0
call fcn.0040cbc0
lea ecx, [ebp - 0x10]
lea edx, [ebp - 0x2c]
mov dword [ebp - 0x2c], 0x5046ec
mov dword [ebp - 0x28], 1
mov dword [ebp - 0x24], str.combase.dll
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x1c], 0
call fcn.00466b30

Function at 0x4669f0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
mov eax, dword [0x4ab078]
test eax, eax
je 0x466aa9
dec eax
push eax
call sub.kernel32.dll_TlsGetValue
cmp eax, 2
jb 0x466a1e
cmp dword [eax + 4], 0
mov edi, eax
je 0x466a1e
add edi, 8
jmp 0x466aa3
mov eax, dword [0x4ab078]
test eax, eax
je 0x466ab8
dec eax
push eax
call sub.kernel32.dll_TlsGetValue
cmp eax, 1
je 0x466aa1
mov esi, eax
test eax, eax
jne 0x466a77
movzx eax, byte [0x52314c]
mov ecx, 0xc
mov edx, 4
call fcn.00404a60
test eax, eax
je 0x466ad3
mov dword [eax], 0x4ab078
mov dword [eax + 4], 0
mov esi, eax
mov eax, dword [0x4ab078]
test eax, eax
je 0x466ac7
dec eax
push esi
push eax
call sub.kernel32.dll_TlsSetValue
mov ecx, dword [esi + 8]
cmp dword [esi + 4], 0
lea edi, [esi + 8]
mov dword [esi + 4], 1
mov dword [esi + 8], 0
je 0x466aa3
test ecx, ecx
je 0x466aa3
lock dec dword [ecx]
jne 0x466aa3
call fcn.00466590
jmp 0x466aa3
xor edi, edi
mov eax, edi
pop esi
pop edi
pop ebp
ret
mov ecx, 0x4ab078
call fcn.004665d0
jmp 0x466a03
mov ecx, 0x4ab078
call fcn.004665d0
jmp 0x466a2c
mov ecx, 0x4ab078
call fcn.004665d0
jmp 0x466a70
mov ecx, 4
mov edx, 0xc
call fcn.00404f40
nop word cs:[eax + eax]
nop dword [eax]
Function at 0x466fd0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push esi
mov eax, dword [0x4ab088]
test eax, eax
je 0x467055
dec eax
push eax
call sub.kernel32.dll_TlsGetValue
cmp eax, 2
jb 0x466ff1
cmp byte [eax + 4], 0
mov esi, eax
jne 0x467049
mov eax, dword [0x4ab088]
test eax, eax
je 0x467064
dec eax
push eax
call sub.kernel32.dll_TlsGetValue
cmp eax, 1
je 0x46704e
mov esi, eax
test eax, eax
jne 0x467043
movzx eax, byte [0x52314c]
mov ecx, 8
mov edx, 4
call fcn.00404a60
test eax, eax
je 0x46707c
mov dword [eax], 0x4ab088
mov byte [eax + 4], 0
mov esi, eax
mov eax, dword [0x4ab088]
test eax, eax
je 0x467070
dec eax
push esi
push eax
call sub.kernel32.dll_TlsSetValue
mov word [esi + 4], 1
add esi, 5
jmp 0x467050
xor esi, esi
mov eax, esi
pop esi
pop ebp
ret
mov ecx, 0x4ab088
call fcn.004665d0
jmp 0x466fde
mov ecx, 0x4ab088
call fcn.004665d0
jmp 0x466ffb
mov ecx, 0x4ab088
call fcn.004665d0
jmp 0x46703c
mov ecx, 4
mov edx, 8
call fcn.00404f40
nop dword [eax + eax]
Function at 0x467330
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x1c
mov eax, edx
call 0x467150
pop edx
mov dword [ebp - 0x20], edx
mov edx, dword [eax + 8]
test edx, edx
je 0x467247
mov dword [ebp - 0x18], ecx
lea ecx, [eax + 0xd]
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x14], ecx
xor ecx, ecx
jmp 0x467193
mov eax, dword [ebp - 0x10]
mov edx, dword [eax + 8]
cmp ecx, edx
jae 0x46724c
mov ebx, edx
mov byte [eax + 0xc], 1
sub ebx, ecx
jb 0x4672b6
mov eax, dword [eax + 4]
mov esi, ecx
add eax, ecx
mov edx, 0xfffffff5
lea ecx, [ebp - 0x28]
push dword [ebp - 0x14]
push ebx
push eax
call fcn.00467380
add esp, 0xc
movzx eax, byte [ebp - 0x28]
mov edi, dword [ebp - 0x24]
cmp al, 4
jne 0x4671f0
mov ecx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x28]
mov byte [ecx + 0xc], 0
movzx ecx, al
mov ecx, dword [ecx*4 + 0x46731c]
add ecx, dword [ebp - 0x20]
jmp ecx
test al, al
jne 0x4671c8
cmp edi, 6
jne 0x4671c8
mov eax, dword [ebp - 0x10]
mov edi, ebx
mov byte [eax + 0xc], 0
test edi, edi
je 0x467270
mov ecx, esi
add ecx, edi
jmp 0x467185
mov byte [ecx], 4
jmp 0x4672ae
mov eax, dword [ebp - 0x18]
test ecx, ecx
mov byte [eax], 4
je 0x4672ae
cmp edx, ecx
jb 0x4672d1
mov eax, dword [ebp - 0x10]
mov dword [eax + 8], 0
jmp 0x4672ae
mov eax, dword [ebp - 0x18]
mov byte [eax], 2
mov dword [eax + 4], 0x503280
mov ecx, esi
test esi, esi
je 0x4672ae
mov eax, dword [ebp - 0x10]
mov edx, dword [eax + 8]
mov edi, edx
sub edi, ecx
jb 0x4672c7
mov dword [eax + 8], 0
je 0x4672ae
mov esi, dword [ebp - 0x10]
mov eax, dword [esi + 4]
add ecx, eax
push edi
push ecx
push eax
call sub.msvcrt.dll_memmove
add esp, 0xc
mov dword [esi + 8], edi
add esp, 0x1c
pop esi
pop edi
pop ebx
pop ebp
ret
mov esi, ecx
push 0x5032b4
call fcn.0040cec0
add esp, 4
ud2
push 0x502abc
call fcn.0040d890
push 0x502abc
call fcn.0040d890
cmp dword [ebx + 4], 0
mov dword [ebp - 0x14], eax
je 0x4672ef
mov edx, dword [ebx + 8]
mov ecx, dword [ebp - 0x1c]
call fcn.00404ac0
mov ecx, edi
mov edx, 4
call fcn.00404ac0
jmp 0x467302
mov ecx, dword [ebp - 0x10]
mov edx, esi
call 0x467330
push dword [ebp - 0x14]
call fcn.004a1fc0
call fcn.00411280
nop dword [eax]
push ss
add dword [eax], eax
add byte [edi], bl
add byte [eax], al
add byte [ecx - 0x41000000], dl
add byte [eax], al
add byte [edx + 0x55000000], dh
mov ebp, esp
push edi
push esi
test edx, edx
je 0x467360
mov eax, dword [ecx + 8]
mov esi, ecx
mov edi, eax
sub edi, edx
jb 0x467364
mov dword [esi + 8], 0
je 0x467360
mov eax, dword [esi + 4]
add edx, eax
push edi
push edx
push eax
call sub.msvcrt.dll_memmove
add esp, 0xc
mov dword [esi + 8], edi
pop esi
pop edi
pop ebp
ret
mov ecx, edx
mov edx, eax
push 0x502abc
call fcn.0040d890
nop word cs:[eax + eax]
nop dword [eax]
Function at 0x467d00
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push esi
mov eax, dword [0x4ab068]
test eax, eax
je 0x467d99
dec eax
push eax
call sub.kernel32.dll_TlsGetValue
cmp eax, 2
jb 0x467d28
cmp dword [eax + 4], 0
je 0x467d28
add eax, 8
jmp 0x467d96
mov eax, dword [0x4ab068]
test eax, eax
je 0x467da8
dec eax
push eax
call sub.kernel32.dll_TlsGetValue
cmp eax, 1
je 0x467d94
mov esi, eax
test eax, eax
jne 0x467d7d
movzx eax, byte [0x52314c]
mov ecx, 0x10
mov edx, 4
call fcn.00404a60
test eax, eax
je 0x467dc3
mov dword [eax], 0x4ab068
mov dword [eax + 4], 0
mov esi, eax
mov eax, dword [0x4ab068]
test eax, eax
je 0x467db7
dec eax
push esi
push eax
call sub.kernel32.dll_TlsSetValue
lea eax, [esi + 8]
mov dword [esi + 4], 1
mov dword [esi + 8], 0
mov byte [esi + 0xc], 0
jmp 0x467d96
xor eax, eax
pop esi
pop ebp
ret
mov ecx, 0x4ab068
call fcn.004665d0
jmp 0x467d12
mov ecx, 0x4ab068
call fcn.004665d0
jmp 0x467d32
mov ecx, 0x4ab068
call fcn.004665d0
jmp 0x467d76
mov ecx, 4
mov edx, 0x10
call fcn.00404f40
nop word cs:[eax + eax]
nop dword [eax]
Function at 0x469b80
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x430
mov edi, 0x200
xor esi, esi
mov dword [ebp - 0x2c], 0
mov dword [ebp - 0x28], 2
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x24], 0
mov dword [ebp - 0x14], 2
mov dword [ebp - 0x20], 0
cmp edi, 0x201
jae 0x469c00
jmp 0x469be1
mov esi, dword [ebp - 0x10]
jbe 0x469c85
cmp edi, 0x201
jae 0x469c00
mov dword [ebp - 0x10], esi
mov dword [ebp - 0x1c], 0x200
lea ebx, [ebp - 0x43c]
mov esi, edi
jmp 0x469c31
mov eax, dword [ebp - 0x20]
sub edi, esi
sub eax, esi
cmp eax, edi
jae 0x469c22
mov edx, esi
lea ecx, [ebp - 0x2c]
push edi
call fcn.00468820
add esp, 4
mov esi, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x14], eax
mov ebx, dword [ebp - 0x14]
mov dword [ebp - 0x24], esi
mov dword [ebp - 0x20], esi
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0x10], esi
push 0
call sub.kernel32.dll_SetLastError
push ebx
push esi
call sub.kernel32.dll_GetCurrentDirectoryW
mov edi, eax
test eax, eax
jne 0x469c4e
call sub.kernel32.dll_GetLastError
test eax, eax
jne 0x469ccc
cmp edi, esi
jne 0x469bd0
call sub.kernel32.dll_GetLastError
cmp eax, 0x7a
jne 0x469cea
lea edi, [esi + esi]
test esi, esi
mov esi, dword [ebp - 0x10]
mov eax, 0xffffffff
cmovs edi, eax
cmp edi, 0x201
jb 0x469be1
jmp 0x469c00
mov edx, dword [ebp - 0x1c]
cmp edi, edx
ja 0x469d03
mov edx, ebx
lea ecx, [ebp - 0x3c]
push edi
call fcn.0046abd0
add esp, 4
movsd xmm0, qword [ebp - 0x3c]
mov eax, dword [ebp - 0x18]
movsd xmm1, qword [ebp - 0x34]
movsd qword [eax + 8], xmm1
movsd qword [eax], xmm0
test esi, esi
je 0x469cc1
mov ecx, dword [ebp - 0x14]
mov edx, 2
call fcn.00404ac0
add esp, 0x430
pop esi
pop edi
pop ebx
pop ebp
ret
call sub.kernel32.dll_GetLastError
mov ecx, dword [ebp - 0x18]
mov esi, dword [ebp - 0x10]
mov byte [ecx + 4], 0
mov dword [ecx + 8], eax
mov dword [ecx], 0x80000000
test esi, esi
jne 0x469cb4
jmp 0x469cc1
mov edx, 0x28
mov ecx, str.internal_error:_entered_unreachable_code_home_nydrani_.cargo_registry_src_index.crates.io_6f17d22bba15001f_regex_automata_0.1.10_src_dense.rs
push 0x50489c
call fcn.0040db80
add esp, 4
jmp 0x469d12
mov ecx, edi
push 0x50488c
call fcn.0040d890
add esp, 4
ud2
Function at 0x46bd40
Capabilities:
Enumerate process modules
Parse pe header
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push eax
call fcn.00467d00
test eax, eax
je 0x46bd58
cmp dword [eax], 0
sete al
add esp, 4
pop ebp
ret
lea eax, [ebp - 1]
mov ecx, str.cannot_access_a_Thread_Local_Storage_value_during_or_after_destruction_rustc_b6a8c762eed0ae0383658c38d65cb91bbd9800a1library_std_src_threadlocal.rs
mov edx, 0x46
push 0x5036e0
push 0x5028f0
push eax
call fcn.00410e30
nop word cs:[eax + eax]
nop
Function at 0x481a00
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x60
mov dword [esp], ecx
mov eax, dword [edx + 4]
mov ecx, dword [edx + 8]
mov ebx, dword [edx]
mov esi, edx
mov dword [esp + 0x3c], eax
call fcn.00418740
mov ecx, dword [esp + 0x3c]
mov edi, eax
mov eax, ebx
test edx, edx
mov dword [esp + 0xc], ebx
mov dword [esp + 0x10], ecx
mov dword [esp + 0x14], edi
mov dword [esp + 0x18], edx
mov dword [esp + 0x1c], esi
je 0x481b0a
mov ebx, edx
nop dword [eax + eax]
add edi, 0x10
dec ebx
cmp ebx, 0xffffffff
je 0x481b1e
lea eax, [edi - 0x10]
lea ecx, [esp + 0x20]
lea esi, [esp + 0x40]
lea edx, [esp + 0xc]
movsd xmm0, qword [eax]
movsd xmm1, qword [eax + 8]
mov eax, dword [esp + 0x1c]
movsd qword [esp + 0x48], xmm1
movsd qword [esp + 0x40], xmm0
mov eax, dword [eax + 0xc]
push esi
push dword [eax + 0x20]
call fcn.0047ae60
add esp, 8
mov eax, dword [esp + 0x20]
mov ecx, dword [esp + 0x24]
mov edx, eax
xor edx, 0x2e
or edx, ecx
je 0x481b4a
lea esi, [esp + 0x32]
mov edx, dword [esp + 0x28]
mov dword [esp + 0x14], edi
mov dword [esp + 0x18], ebx
mov esi, dword [esi]
mov dword [esp + 4], esi
lea esi, [esp + 0x32]
movzx esi, word [esi + 4]
mov word [esp + 8], si
movzx esi, word [esp + 0x30]
cmp si, word [ebp + 8]
mov esi, dword [esp + 0x2c]
jne 0x481a50
movzx edi, word [esp + 8]
mov ebx, dword [esp]
mov word [ebx + 0x16], di
mov edi, dword [esp + 4]
mov dword [ebx + 0x12], edi
mov dword [ebx + 4], ecx
movzx ecx, word [ebp + 8]
mov dword [ebx], eax
mov dword [ebx + 8], edx
mov dword [ebx + 0xc], esi
mov word [ebx + 0x10], cx
jmp 0x481b8b
cmp dword [esi + 0x14], 0
jne 0x481b38
sub eax, dword [esi]
mov dword [esi + 0x14], 1
mov dword [esi + 0x18], eax
jmp 0x481b38
mov eax, dword [esp + 0x1c]
cmp dword [eax + 0x14], 0
jne 0x481b38
mov ecx, dword [esp + 0xc]
sub ecx, dword [eax]
mov dword [eax + 0x14], 1
mov dword [eax + 0x18], ecx
mov eax, dword [esp]
mov dword [eax + 4], 0
mov dword [eax], 0x2e
jmp 0x481b8b
lea edx, [esp + 0x32]
mov ecx, dword [esp]
mov edi, dword [esp + 0x2c]
mov esi, dword [edx]
movzx eax, word [edx + 4]
movzx edx, word [esp + 0x30]
mov dword [esp + 4], esi
mov dword [ecx + 0x12], esi
mov esi, dword [esp + 0x28]
mov word [ecx + 0x16], ax
mov word [esp + 8], ax
mov dword [ecx + 0xc], edi
mov dword [ecx + 8], esi
mov word [ecx + 0x10], dx
mov dword [ecx + 4], 0
mov dword [ecx], 0x2f
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret