joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4040a0
Capabilities:
Allocate thread local storage

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
call dword [sym.imp.KERNEL32.DLL_TlsAlloc]
cmp eax, 0xffffffff
je 0x4040d6
mov dword [0x4451d0], eax
mov edx, 0x404080
mov dword [esp + 4], edx
mov dword [esp], eax
call fcn.0040cb80
test eax, eax
sete al
movzx eax, al
mov dword [0x43d0f0], eax
leave
ret
call dword [sym.imp.KERNEL32.DLL_GetLastError]
test eax, eax
sete al
movzx eax, al
mov dword [0x43d0f0], eax
leave
ret

Function at 0x4041c0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
lea eax, [ebp - 0xc]
sub esp, 0x68
mov dword [ebp - 0x20], eax
lea eax, [ebp - 0x40]
mov dword [ebp - 0xc], ebx
mov dword [ebp - 8], esi
mov dword [ebp - 4], edi
mov dword [ebp - 0x28], sym.WFBS_P_Cg7_PWyXJXA_1WXrXXFW9W7h
mov dword [ebp - 0x24], 0x43c6d4
mov dword [ebp - 0x1c], 0x404280
mov dword [ebp - 0x18], esp
mov dword [esp], eax
call fcn.0040d0f0
cmp dword [0x43d0f0], 0
mov dword [ebp - 0x44], 0x4451e0
je 0x404260
jl 0x4042a0
mov dword [ebp - 0x3c], 1
mov eax, dword [0x4451d0]
mov dword [ebp - 0x4c], eax
mov eax, dword [sym.imp.KERNEL32.DLL_GetLastError]
call eax
mov dword [ebp - 0x50], eax
mov eax, dword [ebp - 0x4c]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.DLL_TlsGetValue]
mov dword [ebp - 0x54], eax
mov eax, dword [ebp - 0x50]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.DLL_SetLastError]
mov eax, dword [ebp - 0x54]
sub esp, 4
test eax, eax
mov dword [ebp - 0x48], eax
je 0x404343
mov eax, dword [ebp - 0x48]
mov dword [ebp - 0x44], eax
lea esi, [esi]
lea eax, [ebp - 0x40]
mov dword [esp], eax
call fcn.0040d1d0
mov eax, dword [ebp - 0x44]
mov ebx, dword [ebp - 0xc]
mov esi, dword [ebp - 8]
mov edi, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
mov edx, dword [0x4457f0]
mov eax, 0xffffffff
test edx, edx
je 0x4042ba
mov eax, dword [0x43d0f4]
test eax, eax
je 0x4042fa
xor eax, eax
test eax, eax
jne 0x4042f0
mov edi, dword [0x43d0f0]
test edi, edi
js 0x4042f0
mov dword [ebp - 0x44], 0x4451e0
mov ebx, dword [0x43d0f0]
test ebx, ebx
je 0x404260
jmp 0x40420e
xor esi, esi
mov dword [0x43d0f0], esi
jmp 0x4042c8
mov dword [esp], 0x43d0f8
mov dword [ebp - 0x3c], 1
call sub.KERNEL32.DLL_InterlockedIncrement
sub esp, 4
test eax, eax
je 0x404381
mov eax, dword [0x43d0f4]
test eax, eax
jne 0x4042b8
mov dword [esp], 0
mov eax, dword [sym.imp.KERNEL32.DLL_Sleep]
mov dword [ebp - 0x3c], 1
call eax
sub esp, 4
mov eax, dword [0x43d0f4]
test eax, eax
je 0x40431d
jmp 0x4042b8
mov dword [esp], 8
call sub.msvcrt.dll_malloc
mov dword [ebp - 0x48], eax
test eax, eax
je 0x404375
mov dword [esp + 4], eax
mov eax, dword [0x4451d0]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.DLL_TlsSetValue]
sub esp, 8
xor edx, edx
test eax, eax
je 0x4043aa
test edx, edx
je 0x404395
mov dword [ebp - 0x3c], 1
call fcn.00403c20
call fcn.004040a0
mov eax, 1
mov dword [0x43d0f4], eax
jmp 0x4042b8
mov eax, dword [ebp - 0x48]
mov dword [eax], 0
mov dword [eax + 4], 0
jmp 0x404256
call dword [sym.imp.KERNEL32.DLL_GetLastError]
mov edx, eax
jmp 0x404371
Function at 0x4099f0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x1c
mov eax, dword [ebp + 8]
mov edi, dword [ebp + 0xc]
mov esi, dword [ebp + 0x10]
mov dword [ebp - 0x10], eax
lea esi, [esi]
lea edi, [edi]
mov eax, dword [ebp - 0x10]
mov dword [esp], eax
call fcn.004099d0
mov dword [esp], eax
mov dword [esp + 8], esi
mov dword [esp + 4], edi
call sub.msvcrt.dll__read
cmp eax, 0xffffffff
mov ebx, eax
jne 0x409a3c
call sub.msvcrt.dll__errno
cmp dword [eax], 4
je 0x409a10
add esp, 0x1c
mov eax, ebx
pop ebx
pop esi
pop edi
pop ebp
ret

Function at 0x40ca20
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov eax, 0x10
mov ebp, esp
push ebx
sub esp, 0x64
and esp, 0xfffffff0
call fcn.0040db40
call fcn.0040cc80
call sub.KERNEL32.DLL_GetCommandLineA
mov ebx, eax
lea eax, [ebp - 0x58]
mov dword [esp], eax
call sub.KERNEL32.DLL_GetStartupInfoA
sub esp, 4
test ebx, ebx
jne 0x40ca58
jmp 0x40caf6
inc ebx
movzx ecx, byte [ebx]
cmp cl, 0x20
sete al
cmp cl, 9
sete dl
or eax, edx
test al, 1
jne 0x40ca57
cmp cl, 0x22
je 0x40cab0
cmp cl, 0x20
setne al
xor edx, edx
cmp cl, 9
setne dl
test eax, edx
je 0x40cad0
lea esi, [esi]
lea edi, [edi]
test cl, cl
je 0x40cad0
inc ebx
movzx ecx, byte [ebx]
cmp cl, 0x20
setne al
xor edx, edx
cmp cl, 9
setne dl
test eax, edx
jne 0x40ca90
jmp 0x40cad0
inc ebx
movzx ecx, byte [ebx]
cmp cl, 0x22
setne al
xor edx, edx
test cl, cl
setne dl
test eax, edx
jne 0x40cab0
cmp cl, 0x22
je 0x40cb32
lea esi, [esi]
cmp cl, 0x20
sete al
cmp cl, 9
sete dl
jmp 0x40caf0
inc ebx
movzx ecx, byte [ebx]
cmp cl, 0x20
sete dl
cmp cl, 9
sete al
or eax, edx
test al, 1
jne 0x40cae0
mov dword [esp], 0
call sub.KERNEL32.DLL_GetModuleHandleA
sub esp, 4
test byte [ebp - 0x2c], 1
mov edx, 0xa
je 0x40cb14
movzx edx, word [ebp - 0x28]
mov dword [esp + 8], ebx
xor ebx, ebx
mov dword [esp + 4], ebx
mov dword [esp + 0xc], edx
mov dword [esp], eax
call sym.gWjX7_ZW_jWWHy
sub esp, 0x10
mov ebx, dword [ebp - 4]
leave
ret
inc ebx
movzx ecx, byte [ebx]
jmp 0x40cad0

Function at 0x40cfe0
Capabilities:
Allocate thread local storage

Disassembly:
push ebp
mov ebp, esp
push ebx
sub esp, 0x14
mov ebx, dword [0x445850]
call dword [sym.imp.KERNEL32.DLL_TlsAlloc]
cmp eax, 0xffffffff
je 0x40d020
mov dword [ebx + 0x2c], eax
xor eax, eax
mov dword [esp + 4], eax
mov eax, dword [ebx + 0x2c]
mov dword [esp], eax
call fcn.0040cb80
test eax, eax
sete al
movzx eax, al
mov dword [ebx + 0x30], eax
add esp, 0x14
pop ebx
pop ebp
ret
call dword [sym.imp.KERNEL32.DLL_GetLastError]
test eax, eax
sete al
movzx eax, al
mov dword [ebx + 0x30], eax
add esp, 0x14
pop ebx
pop ebp
ret
Function at 0x40a7a0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x28
mov eax, dword [ecx + 0x70]
mov esi, ecx
test eax, eax
je 0x40a7c6
cmp dword [esi + 0x74], 0
je 0x40a7c6
push eax
push 0
push dword [0x5920d8]
call sub.KERNEL32.dll_HeapFree
movzx eax, byte [esi + 0x40]
cmp eax, 6
je 0x40a81e
cmp eax, 3
jb 0x40a81e
je 0x40a808
cmp eax, 4
jne 0x40a86c
mov ebx, dword [esi + 0x4c]
mov eax, dword [esi + 0x48]
test ebx, ebx
mov dword [ebp - 0x10], eax
je 0x40a7fd
mov edi, dword [ebp - 0x10]
nop
mov ecx, edi
call fcn.004e5c20
add edi, 0x18
dec ebx
jne 0x40a7f0
cmp dword [esi + 0x44], 0
je 0x40a81e
push dword [ebp - 0x10]
jmp 0x40a811
cmp dword [esi + 0x44], 0
je 0x40a81e
push dword [esi + 0x48]
push 0
push dword [0x5920d8]
call sub.KERNEL32.dll_HeapFree
movzx eax, byte [esi + 0x58]
cmp eax, 6
je 0x40a919
cmp eax, 3
jb 0x40a919
je 0x40a89a
cmp eax, 4
jne 0x40a8b2
mov ebx, dword [esi + 0x64]
mov eax, dword [esi + 0x60]
test ebx, ebx
mov dword [ebp - 0x10], eax
je 0x40a85d
mov edi, dword [ebp - 0x10]
nop dword [eax + eax]
mov ecx, edi
call fcn.004e5c20
add edi, 0x18
dec ebx
jne 0x40a850
cmp dword [esi + 0x5c], 0
je 0x40a919
push dword [ebp - 0x10]
jmp 0x40a8a3
mov ecx, dword [esi + 0x44]
test ecx, ecx
je 0x40a8e0
mov edx, dword [esi + 0x48]
mov eax, dword [esi + 0x4c]
mov dword [ebp - 0x30], 0
mov dword [ebp - 0x2c], ecx
mov dword [ebp - 0x28], edx
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x1c], ecx
mov ecx, 1
mov dword [ebp - 0x18], edx
jmp 0x40a8e4
cmp dword [esi + 0x5c], 0
je 0x40a919
push dword [esi + 0x60]
push 0
push dword [0x5920d8]
call sub.KERNEL32.dll_HeapFree
jmp 0x40a919
mov ecx, dword [esi + 0x5c]
test ecx, ecx
je 0x40a904
mov edx, dword [esi + 0x60]
mov eax, dword [esi + 0x64]
mov dword [ebp - 0x30], 0
mov dword [ebp - 0x2c], ecx
mov dword [ebp - 0x28], edx
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x1c], ecx
mov ecx, 1
mov dword [ebp - 0x18], edx
jmp 0x40a908
xor ecx, ecx
xor eax, eax
mov dword [ebp - 0x34], ecx
mov dword [ebp - 0x24], ecx
lea ecx, [ebp - 0x34]
mov dword [ebp - 0x14], eax
call fcn.00559420
movzx eax, byte [esi + 0x58]
cmp eax, 6
jne 0x40a82b
jmp 0x40a919
xor ecx, ecx
xor eax, eax
mov dword [ebp - 0x34], ecx
mov dword [ebp - 0x24], ecx
lea ecx, [ebp - 0x34]
mov dword [ebp - 0x14], eax
call fcn.00559420
mov eax, dword [esi + 0x78]
cmp eax, 0x80000000
je 0x40a937
test eax, eax
je 0x40a937
push dword [esi + 0x7c]
push 0
push dword [0x5920d8]
call sub.KERNEL32.dll_HeapFree
cmp byte [esi + 0x3c], 2
je 0x40a98e
mov eax, dword [esi + 0x28]
test eax, eax
je 0x40a958
cmp dword [esi + 0x2c], 0
je 0x40a958
push eax
push 0
push dword [0x5920d8]
call sub.KERNEL32.dll_HeapFree
mov eax, dword [esi + 0x1c]
test eax, eax
je 0x40a973
cmp dword [esi + 0x20], 0
je 0x40a973
push eax
push 0
push dword [0x5920d8]
call sub.KERNEL32.dll_HeapFree
mov eax, dword [esi + 8]
test eax, eax
je 0x40a98e
cmp dword [esi + 0xc], 0
je 0x40a98e
push eax
push 0
push dword [0x5920d8]
call sub.KERNEL32.dll_HeapFree
add esp, 0x28
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x41ca70
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x1a0
lea esi, [edx + 0xc]
mov dword [esp + 0x90], ecx
call fcn.0041ca8e
Function at 0x440630
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x24
mov esi, dword [ebp + 8]
mov dword [ebp - 0x10], ecx
lea eax, [esi - 1]
cmp eax, edx
jae 0x4407ae
cmp esi, edx
jae 0x4407a6
mov ecx, dword [ebp - 0x10]
lea eax, [esi + esi*4]
mov dword [ebp - 0x20], edx
lea eax, [ecx + eax*4 - 0x14]
mov dword [ebp - 0x24], eax
jmp 0x440694
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x2c]
mov edx, dword [ebp - 0x14]
mov esi, dword [ebp - 0x1c]
mov dword [eax], ecx
mov dword [eax + 4], edx
mov edx, dword [ebp - 0x18]
mov dword [eax + 8], esi
mov dword [eax + 0xc], edi
mov dword [eax + 0x10], edx
mov edx, dword [ebp - 0x20]
mov esi, dword [ebp - 0x28]
add dword [ebp - 0x24], 0x14
inc esi
cmp esi, edx
je 0x4407a6
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x28], esi
lea esi, [esi + esi*4]
mov edi, dword [eax + esi*4 + 0xc]
lea ebx, [eax + esi*4]
cmp edi, dword [eax + esi*4 - 8]
jae 0x440760
mov eax, dword [ebx + 4]
mov ecx, dword [ebx + 8]
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x1c], ecx
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebx]
mov dword [ebp - 0x30], edi
lea eax, [eax + esi*4 - 0x14]
mov dword [ebp - 0x2c], ecx
mov ecx, dword [ebx + 0x10]
mov esi, dword [ebp - 0x24]
movsd xmm0, qword [eax]
movsd xmm1, qword [eax + 8]
mov dword [ebp - 0x18], ecx
movsd qword [ebx], xmm0
movsd qword [ebx + 8], xmm1
mov ecx, dword [eax + 0x10]
mov dword [ebx + 0x10], ecx
mov ebx, dword [ebp - 0x28]
dec ebx
jne 0x440726
jmp 0x440667
lea eax, [esi - 0x14]
dec ebx
mov ecx, dword [eax + 0x10]
test ebx, ebx
mov dword [esi + 0x10], ecx
movsd xmm0, qword [eax]
movsd xmm1, qword [eax + 8]
movsd qword [esi + 8], xmm1
movsd qword [esi], xmm0
mov esi, eax
je 0x440664
cmp edi, dword [esi - 8]
jb 0x440700
jne 0x440755
mov ecx, dword [ebp - 0x1c]
mov eax, dword [esi - 0xc]
mov edi, ecx
sub edi, eax
cmovb eax, ecx
push eax
push dword [esi - 0x10]
push dword [ebp - 0x14]
call sub.msvcrt.dll_memcmp
add esp, 0xc
test eax, eax
cmovne edi, eax
test edi, edi
mov edi, dword [ebp - 0x30]
js 0x440700
mov eax, esi
jmp 0x440667
jne 0x440684
mov eax, dword [ebx + 4]
mov ecx, dword [ebx + 8]
mov dword [ebp - 0x14], eax
mov eax, dword [ebx - 0xc]
mov edx, ecx
mov dword [ebp - 0x1c], ecx
sub edx, eax
cmovb eax, ecx
mov dword [ebp - 0x18], edx
push eax
push dword [ebx - 0x10]
push dword [ebp - 0x14]
call sub.msvcrt.dll_memcmp
mov edx, dword [ebp - 0x20]
add esp, 0xc
mov ecx, dword [ebp - 0x18]
test eax, eax
cmovne ecx, eax
test ecx, ecx
jns 0x440684
jmp 0x4406ba
add esp, 0x24
pop esi
pop edi
pop ebx
pop ebp
ret
mov ecx, str.assertion_failed:_offset___0__offset___len
mov edx, 0x2e
push 0x581060
call fcn.0046b100
nop word cs:[eax + eax]
nop dword [eax]
Function at 0x440f70
Capabilities:
Encode data using base64
Encode data using xor
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x14
mov eax, dword [ebp + 8]
lea esi, [eax - 1]
cmp esi, edx
jae 0x441020
cmp eax, edx
jae 0x441018
mov esi, 1
lea edi, [ecx + eax*8 - 8]
mov dword [ebp - 0x14], edx
mov dword [ebp - 0x10], ecx
sub esi, eax
jmp 0x440fc3
mov ecx, dword [ebp - 0x10]
mov edx, dword [ebp - 0x14]
lea edi, [ecx + eax*8 - 8]
mov esi, dword [ebp - 0x18]
mov dword [edi], ebx
mov dword [edi + 4], esi
mov esi, dword [ebp - 0x20]
mov edi, dword [ebp - 0x1c]
inc eax
dec esi
add edi, 8
cmp eax, edx
je 0x441018
mov ebx, dword [ecx + eax*8]
cmp ebx, dword [ecx + eax*8 - 8]
jae 0x440fba
mov edx, dword [ecx + eax*8 + 4]
movsd xmm0, qword [ecx + eax*8 - 8]
cmp eax, 1
mov dword [ebp - 0x1c], edi
mov dword [ebp - 0x20], esi
mov dword [ebp - 0x18], edx
movsd qword [ecx + eax*8], xmm0
je 0x440fa2
nop dword [eax]
cmp ebx, dword [edi - 8]
jae 0x441010
mov ecx, dword [edi - 8]
mov edx, dword [edi - 4]
inc esi
mov dword [edi + 4], edx
mov dword [edi], ecx
lea edi, [edi - 8]
jne 0x440ff0
mov ecx, dword [ebp - 0x10]
mov edx, dword [ebp - 0x14]
mov edi, ecx
jmp 0x440fac
mov edx, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x10]
jmp 0x440fac
add esp, 0x14
pop esi
pop edi
pop ebx
pop ebp
ret
mov ecx, str.assertion_failed:_offset___0__offset___len
mov edx, 0x2e
push 0x581060
call fcn.0046b100
nop word cs:[eax + eax]
nop
Function at 0x454a60
Capabilities:
Encrypt data using speck
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x18
mov eax, dword [ecx]
test eax, eax
mov dword [ebp - 0x10], eax
je 0x454a98
mov eax, dword [ecx + 0xc]
cmp eax, 5
jae 0x454b2f
mov edx, dword [ecx + 4]
mov dword [ebp - 0x14], ecx
mov edi, edx
sub edi, eax
jae 0x454aa1
mov eax, dword [ebp - 0x14]
mov dword [eax], 0
jmp 0x454b18
mov dword [ebp - 0x10], 0
jmp 0x454b18
mov ecx, eax
mov eax, dword [ebp - 0x14]
xor esi, esi
xor ebx, ebx
mov dword [ebp - 0x24], edi
mov dword [ebp - 0x18], edx
mov dword [ebp - 0x20], ecx
add eax, 8
mov dword [ebp - 0x1c], eax
nop dword [eax]
mov edi, ebx
mov ebx, dword [ebp - 0x24]
mov eax, esi
test al, 1
jne 0x454a8a
cmp edi, ebx
ja 0x454a8a
mov eax, edx
sub eax, edi
jb 0x454b23
cmp edi, ebx
setae bl
mov esi, ebx
mov ebx, edi
adc ebx, 0
cmp eax, ecx
jb 0x454ac0
mov eax, dword [ebp - 0x10]
add eax, edi
push ecx
push eax
push dword [ebp - 0x1c]
call sub.msvcrt.dll_memcmp
mov ecx, dword [ebp - 0x20]
mov edx, dword [ebp - 0x18]
add esp, 0xc
test eax, eax
jne 0x454ac0
add ecx, edi
mov eax, edx
sub eax, ecx
jb 0x454b40
add ecx, dword [ebp - 0x10]
mov esi, dword [ebp - 0x14]
mov edx, ecx
mov dword [esi], edx
mov dword [esi + 4], eax
mov edx, edi
mov eax, dword [ebp - 0x10]
add esp, 0x18
pop esi
pop edi
pop ebx
pop ebp
ret
mov ecx, edi
push 0x57b0b8
call fcn.00469960
mov ecx, eax
mov edx, 4
push 0x571918
call fcn.0046a750
push 0x5718a4
call fcn.00469960
nop word [eax + eax]
Function at 0x4701d0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
push eax
mov eax, dword [ebp + 8]
mov ebx, dword [ebp + 0x14]
xor esi, esi
lea eax, [edx + eax*2]
mov dword [ebp - 0x10], eax
movzx eax, byte [edx + 1]
cmp byte [edx], ch
lea edx, [edx + 2]
lea edi, [esi + eax]
jne 0x470220
cmp esi, edi
ja 0x47028b
cmp edi, dword [ebp + 0x10]
ja 0x470299
add esi, dword [ebp + 0xc]
nop word [eax + eax]
test eax, eax
je 0x470222
dec eax
cmp byte [esi], cl
lea esi, [esi + 1]
jne 0x470210
jmp 0x47027f
ja 0x470229
cmp edx, dword [ebp - 0x10]
mov esi, edi
jne 0x4701e5
mov edi, dword [ebp + 0x18]
movzx ecx, cx
mov al, 1
add edi, ebx
nop word cs:[eax + eax]
nop dword [eax]
movzx edx, byte [ebx]
lea esi, [ebx + 1]
test dl, dl
js 0x470260
mov ebx, esi
sub ecx, edx
jns 0x470277
jmp 0x470281
cmp esi, edi
je 0x4702a8
movzx esi, byte [ebx + 1]
and edx, 0x7f
add ebx, 2
shl edx, 8
or edx, esi
sub ecx, edx
js 0x470281
xor al, 1
cmp ebx, edi
jne 0x470240
jmp 0x470281
xor eax, eax
and al, 1
add esp, 4
pop esi
pop edi
pop ebx
pop ebp
ret
mov ecx, esi
mov edx, edi
push 0x5732f0
call fcn.0046e9f0
mov edx, dword [ebp + 0x10]
mov ecx, edi
push 0x5732f0
call fcn.0046a750
mov ecx, str.called__Option::unwrap____on_a__None__value_home_rafalh_.cargo_registry_src_index.crates.io_6f17d22bba15001f_serde_json_1.0.81_src_read.rs
mov edx, 0x2b
push 0x5732e0
call fcn.0046b100
nop dword [eax]

Function at 0x474b80
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0xc0
call fcn.00474b94
Function at 0x489b10
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
push eax
movzx eax, byte [0x5920dc]
test al, al
je 0x489c98
mov eax, dword [ebp + 0xc]
test eax, eax
je 0x489b36
cmp eax, 3
jne 0x489c98
mov edi, dword [0x5920e0]
test edi, edi
je 0x489c98
mov dword [ebp - 0x10], 0
jmp 0x489b57
mov edi, dword [edi + 8]
test edi, edi
je 0x489b86
mov esi, dword [edi]
mov ebx, dword [edi + 4]
test ebx, ebx
je 0x489cd7
dec esi
push esi
call sub.KERNEL32.dll_TlsGetValue
test eax, eax
je 0x489b50
push 0
push esi
mov esi, eax
call sub.KERNEL32.dll_TlsSetValue
push esi
call ebx
add esp, 4
mov al, 1
mov dword [ebp - 0x10], eax
jmp 0x489b50
test byte [ebp - 0x10], 1
je 0x489c98
mov edi, dword [0x5920e0]
test edi, edi
je 0x489c98
mov dword [ebp - 0x10], 0
jmp 0x489bb7
mov edi, dword [edi + 8]
test edi, edi
je 0x489be6
mov esi, dword [edi]
mov ebx, dword [edi + 4]
test ebx, ebx
je 0x489cd7
dec esi
push esi
call sub.KERNEL32.dll_TlsGetValue
test eax, eax
je 0x489bb0
push 0
push esi
mov esi, eax
call sub.KERNEL32.dll_TlsSetValue
push esi
call ebx
add esp, 4
mov al, 1
mov dword [ebp - 0x10], eax
jmp 0x489bb0
test byte [ebp - 0x10], 1
je 0x489c98
mov edi, dword [0x5920e0]
test edi, edi
je 0x489c98
mov dword [ebp - 0x10], 0
jmp 0x489c17
mov edi, dword [edi + 8]
test edi, edi
je 0x489c46
mov esi, dword [edi]
mov ebx, dword [edi + 4]
test ebx, ebx
je 0x489cd7
dec esi
push esi
call sub.KERNEL32.dll_TlsGetValue
test eax, eax
je 0x489c10
push 0
push esi
mov esi, eax
call sub.KERNEL32.dll_TlsSetValue
push esi
call ebx
add esp, 4
mov al, 1
mov dword [ebp - 0x10], eax
jmp 0x489c10
test byte [ebp - 0x10], 1
je 0x489c98
mov edi, dword [0x5920e0]
test edi, edi
je 0x489c98
mov dword [ebp - 0x10], 0
jmp 0x489c67
mov edi, dword [edi + 8]
test edi, edi
je 0x489c92
mov esi, dword [edi]
mov ebx, dword [edi + 4]
test ebx, ebx
je 0x489cd7
dec esi
push esi
call sub.KERNEL32.dll_TlsGetValue
test eax, eax
je 0x489c60
push 0
push esi
mov esi, eax
call sub.KERNEL32.dll_TlsSetValue
push esi
call ebx
add esp, 4
mov al, 1
mov dword [ebp - 0x10], eax
jmp 0x489c60
test byte [ebp - 0x10], 1
jne 0x489ca2
add esp, 4
pop esi
pop edi
pop ebx
pop ebp
ret 0xc
mov edi, dword [0x5920e0]
jmp 0x489cad
mov edi, dword [edi + 8]
test edi, edi
je 0x489c98
mov esi, dword [edi]
mov ebx, dword [edi + 4]
test ebx, ebx
je 0x489cd7
dec esi
push esi
call sub.KERNEL32.dll_TlsGetValue
test eax, eax
je 0x489caa
push 0
push esi
mov esi, eax
call sub.KERNEL32.dll_TlsSetValue
push esi
call ebx
add esp, 4
jmp 0x489caa
mov edx, 0x2b
mov ecx, str.called__Option::unwrap____on_a__None__value_home_rafalh_.cargo_registry_src_index.crates.io_6f17d22bba15001f_serde_json_1.0.81_src_read.rs
push 0x57e98c
call fcn.0046b100
add esp, 4
ud2
Function at 0x48a7c0
Capabilities:
Allocate thread local storage

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x20
cmp dword [ecx + 4], 0
mov esi, ecx
je 0x48a830
lea ebx, [esi + 0xc]
mov dword [ebp - 0x14], 0
lea eax, [ebp - 0x14]
push 0
push eax
push 0
push ebx
call sub.KERNEL32.dll_InitOnceBeginInitialize
cmp eax, 1
mov dword [ebp - 0x10], eax
jne 0x48a866
cmp dword [ebp - 0x14], 0
je 0x48a84d
call sub.KERNEL32.dll_TlsAlloc
cmp eax, 0xffffffff
je 0x48a878
mov edi, eax
inc eax
mov dword [esi], eax
mov eax, dword [0x5920e0]
nop dword [eax + eax]
mov dword [esi + 8], eax
lock cmpxchg dword [0x5920e0], esi
jne 0x48a810
mov byte [0x5920dc], 1
push 0
push 0
push ebx
call sub.KERNEL32.dll_InitOnceComplete
jmp 0x48a85c
call sub.KERNEL32.dll_TlsAlloc
cmp eax, 0xffffffff
mov dword [ebp - 0x10], eax
je 0x48a8b2
mov ecx, eax
xor eax, eax
inc ecx
lock cmpxchg dword [esi], ecx
jne 0x48a851
mov edi, dword [ebp - 0x10]
jmp 0x48a85c
mov edi, dword [esi]
jmp 0x48a85b
mov edi, eax
push dword [ebp - 0x10]
call sub.KERNEL32.dll_TlsFree
dec edi
mov eax, edi
add esp, 0x20
pop esi
pop edi
pop ebx
pop ebp
ret
lea ecx, [ebp - 0x10]
lea edx, [ebp - 0x2c]
mov dword [ebp - 0x2c], 0
call fcn.0048abf0
push 0
push 4
push ebx
call sub.KERNEL32.dll_InitOnceComplete
lea ecx, [ebp - 0x2c]
mov edx, 0x57e958
mov dword [ebp - 0x2c], 0x57e920
mov dword [ebp - 0x28], 1
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x24], str.PathTryFromIntErrornumber_of_bones_should_fit_in_i32vmesh_src_v3mc.rs
mov dword [ebp - 0x20], 0
call fcn.00469660
lea ecx, [ebp - 0x10]
lea edx, [ebp - 0x2c]
mov dword [ebp - 0x2c], 0x57e920
mov dword [ebp - 0x28], 1
mov dword [ebp - 0x24], str.PathTryFromIntErrornumber_of_bones_should_fit_in_i32vmesh_src_v3mc.rs
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x1c], 0
call fcn.0048ac30
Function at 0x48aad0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
mov eax, dword [0x56d178]
test eax, eax
je 0x48aafa
dec eax
push eax
call sub.KERNEL32.dll_TlsGetValue
cmp eax, 2
jb 0x48ab0f
cmp dword [eax + 4], 0
mov edi, eax
je 0x48ab0f
add edi, 8
jmp 0x48abc7
mov ecx, 0x56d178
call fcn.0048a7c0
push eax
call sub.KERNEL32.dll_TlsGetValue
cmp eax, 2
jae 0x48aaea
mov eax, dword [0x56d178]
test eax, eax
je 0x48abac
dec eax
push eax
call sub.KERNEL32.dll_TlsGetValue
cmp eax, 1
je 0x48abc5
mov esi, eax
test eax, eax
jne 0x48ab82
movzx eax, byte [0x592110]
mov eax, dword [0x5920d8]
test eax, eax
jne 0x48ab54
call sub.KERNEL32.dll_GetProcessHeap
test eax, eax
je 0x48abd9
mov dword [0x5920d8], eax
push 0xc
push 0
push eax
call sub.KERNEL32.dll_HeapAlloc
test eax, eax
je 0x48abd9
mov dword [eax], 0x56d178
mov dword [eax + 4], 0
mov esi, eax
mov eax, dword [0x56d178]
test eax, eax
je 0x48abcd
dec eax
push esi
push eax
call sub.KERNEL32.dll_TlsSetValue
mov ecx, dword [esi + 8]
cmp dword [esi + 4], 0
lea edi, [esi + 8]
mov dword [esi + 4], 1
mov dword [esi + 8], 0
je 0x48abc7
test ecx, ecx
je 0x48abc7
lock dec dword [ecx]
jne 0x48abc7
call fcn.0048a780
jmp 0x48abc7
mov ecx, 0x56d178
call fcn.0048a7c0
push eax
call sub.KERNEL32.dll_TlsGetValue
cmp eax, 1
jne 0x48ab2c
xor edi, edi
mov eax, edi
pop esi
pop edi
pop ebp
ret
mov ecx, 0x56d178
call fcn.0048a7c0
jmp 0x48ab7b
mov ecx, 4
mov edx, 0xc
call fcn.00429f60
nop dword [eax + eax]

Function at 0x48abf0
Capabilities:
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push esi
sub esp, 8
mov eax, edx
mov dword [ebp - 8], ecx
mov dword [ebp - 0xc], 0x57e908
lea esi, [ebp - 0xc]
lea edx, [ebp - 8]
xor ecx, ecx
push 0x57e968
push eax
push 0x57cd84
push esi
push 0x57cd84
call fcn.0046b170
nop word cs:[eax + eax]
nop dword [eax + eax]
Function at 0x48b440
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push esi
mov eax, dword [0x56d188]
test eax, eax
je 0x48b4e3
dec eax
push eax
call sub.KERNEL32.dll_TlsGetValue
cmp eax, 2
jb 0x48b465
cmp byte [eax + 4], 0
mov esi, eax
jne 0x48b4db
mov eax, dword [0x56d188]
test eax, eax
je 0x48b501
dec eax
push eax
call sub.KERNEL32.dll_TlsGetValue
cmp eax, 1
je 0x48b51a
mov esi, eax
test eax, eax
jne 0x48b4d5
movzx eax, byte [0x592110]
mov eax, dword [0x5920d8]
test eax, eax
jne 0x48b4aa
call sub.KERNEL32.dll_GetProcessHeap
test eax, eax
je 0x48b52d
mov dword [0x5920d8], eax
push 8
push 0
push eax
call sub.KERNEL32.dll_HeapAlloc
test eax, eax
je 0x48b52d
mov dword [eax], 0x56d188
mov byte [eax + 4], 0
mov esi, eax
mov eax, dword [0x56d188]
test eax, eax
je 0x48b521
dec eax
push esi
push eax
call sub.KERNEL32.dll_TlsSetValue
mov word [esi + 4], 1
add esi, 5
mov eax, esi
pop esi
pop ebp
ret
mov ecx, 0x56d188
call fcn.0048a7c0
push eax
call sub.KERNEL32.dll_TlsGetValue
cmp eax, 2
jae 0x48b45d
jmp 0x48b465
mov ecx, 0x56d188
call fcn.0048a7c0
push eax
call sub.KERNEL32.dll_TlsGetValue
cmp eax, 1
jne 0x48b482
xor esi, esi
mov eax, esi
pop esi
pop ebp
ret
mov ecx, 0x56d188
call fcn.0048a7c0
jmp 0x48b4ce
mov ecx, 4
mov edx, 8
call fcn.00429f60
nop dword [eax]