joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10051c80
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
mov eax, dword [0x100f2e44]
mov ebx, dword [ebp + 0x10]
movzx eax, byte [eax]
sub esp, 0xc
mov dword [esp + 8], 8
mov dword [esp + 4], 0
call sym.std::sys::alloc::windows::process_heap_alloc::hc2bfe060f1f208f4
add esp, 0xc
test eax, eax
je 0x10051d36
mov esi, eax
mov edi, dword [ebp + 8]
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 0x14]
mov dword [esi], ebx
mov dword [esi + 4], ecx
push 0
push 0x10000
push esi
push sym.__ZN3std3sys3pal7windows6thread6Thread3new12thread_start17hcccd95f55a7034f0E.llvm.10150728606014878797_4
push eax
push 0
call sub.kernel32.dll_CreateThread
test eax, eax
je 0x10051ce5
mov dword [edi + 4], eax
mov byte [edi], 4
jmp 0x10051d2f
mov ebx, dword [esi + 4]
mov edi, dword [esi]
mov eax, dword [ebx]
test eax, eax
je 0x10051cf6
push edi
call eax
add esp, 4
cmp dword [ebx + 4], 0
je 0x10051d13
cmp dword [ebx + 8], 9
jb 0x10051d05
mov edi, dword [edi - 4]
push edi
push 0
push dword [0x100ff0c8]
call sub.kernel32.dll_HeapFree
push esi
push 0
push dword [0x100ff0c8]
call sub.kernel32.dll_HeapFree
call sub.kernel32.dll_GetLastError
mov edi, dword [ebp + 8]
mov byte [edi], 0
mov dword [edi + 4], eax
mov eax, edi
pop esi
pop edi
pop ebx
pop ebp
ret
mov esi, ebx
mov ebx, dword [ebp + 0x14]
push 8
push 4
call sym.alloc::alloc::handle_alloc_error::h3ca6a9ac69c8e3db
add esp, 8
ud2
Function at 0x10054ec0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
push eax
mov eax, dword [ebp + 0xc]
cmp eax, 3
je 0x10054ed7
test eax, eax
jne 0x10055091
mov esi, dword [0x100ff0cc]
mov dword [ebp - 0x10], 0
nop word cs:[eax + eax]
nop
test esi, esi
je 0x10054f2a
mov ebx, dword [esi]
mov edi, dword [esi + 4]
test edi, edi
je 0x1005509b
mov esi, dword [esi + 8]
test ebx, ebx
je 0x10054ef0
dec ebx
push ebx
call sub.kernel32.dll_TlsGetValue
test eax, eax
je 0x10054ef0
push 0
push ebx
mov ebx, eax
call sub.kernel32.dll_TlsSetValue
push ebx
call edi
add esp, 4
mov al, 1
mov dword [ebp - 0x10], eax
jmp 0x10054ef0
test byte [ebp - 0x10], 1
je 0x10055091
mov esi, dword [0x100ff0cc]
mov dword [ebp - 0x10], 0
nop word cs:[eax + eax]
nop dword [eax + eax]
test esi, esi
je 0x10054f8a
mov ebx, dword [esi]
mov edi, dword [esi + 4]
test edi, edi
je 0x1005509b
mov esi, dword [esi + 8]
test ebx, ebx
je 0x10054f50
dec ebx
push ebx
call sub.kernel32.dll_TlsGetValue
test eax, eax
je 0x10054f50
push 0
push ebx
mov ebx, eax
call sub.kernel32.dll_TlsSetValue
push ebx
call edi
add esp, 4
mov al, 1
mov dword [ebp - 0x10], eax
jmp 0x10054f50
test byte [ebp - 0x10], 1
je 0x10055091
mov esi, dword [0x100ff0cc]
mov dword [ebp - 0x10], 0
nop word cs:[eax + eax]
nop dword [eax + eax]
test esi, esi
je 0x10054fea
mov ebx, dword [esi]
mov edi, dword [esi + 4]
test edi, edi
je 0x1005509b
mov esi, dword [esi + 8]
test ebx, ebx
je 0x10054fb0
dec ebx
push ebx
call sub.kernel32.dll_TlsGetValue
test eax, eax
je 0x10054fb0
push 0
push ebx
mov ebx, eax
call sub.kernel32.dll_TlsSetValue
push ebx
call edi
add esp, 4
mov al, 1
mov dword [ebp - 0x10], eax
jmp 0x10054fb0
test byte [ebp - 0x10], 1
je 0x10055091
mov esi, dword [0x100ff0cc]
mov dword [ebp - 0x10], 0
nop word cs:[eax + eax]
nop dword [eax + eax]
test esi, esi
je 0x10055046
mov ebx, dword [esi]
mov edi, dword [esi + 4]
test edi, edi
je 0x1005509b
mov esi, dword [esi + 8]
test ebx, ebx
je 0x10055010
dec ebx
push ebx
call sub.kernel32.dll_TlsGetValue
test eax, eax
je 0x10055010
push 0
push ebx
mov ebx, eax
call sub.kernel32.dll_TlsSetValue
push ebx
call edi
add esp, 4
mov al, 1
mov dword [ebp - 0x10], eax
jmp 0x10055010
test byte [ebp - 0x10], 1
je 0x10055091
mov edi, dword [0x100ff0cc]
nop word cs:[eax + eax]
nop dword [eax]
test edi, edi
je 0x10055091
mov esi, dword [edi]
mov ebx, dword [edi + 4]
test ebx, ebx
je 0x1005509b
mov edi, dword [edi + 8]
test esi, esi
je 0x10055060
dec esi
push esi
call sub.kernel32.dll_TlsGetValue
test eax, eax
je 0x10055060
push 0
push esi
mov esi, eax
call sub.kernel32.dll_TlsSetValue
push esi
call ebx
add esp, 4
jmp 0x10055060
add esp, 4
pop esi
pop edi
pop ebx
pop ebp
ret 0xc
push 0x100f1534
call sym.core::option::unwrap_failed::h4002a2165d665d64
add esp, 4
ud2
Function at 0x100550b0
Capabilities:
Allocate thread local storage

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x24
mov edi, dword [ebp + 8]
cmp dword [edi + 4], 0
je 0x1005512e
lea ebx, [edi + 0xc]
mov dword [ebp - 0x14], 0
lea eax, [ebp - 0x14]
push 0
push eax
push 0
push ebx
call sub.kernel32.dll_InitOnceBeginInitialize
cmp eax, 1
mov dword [ebp - 0x30], eax
jne 0x10055168
cmp dword [ebp - 0x14], 0
je 0x1005514f
call sub.kernel32.dll_TlsAlloc
cmp eax, 0xffffffff
je 0x10055185
mov esi, eax
mov eax, dword [entry1]
mov eax, dword [0x100ff0cc]
nop word cs:[eax + eax]
mov dword [edi + 8], eax
lock cmpxchg dword [0x100ff0cc], edi
jne 0x10055110
mov eax, esi
inc eax
mov dword [edi], eax
push 0
push 0
push ebx
call sub.kernel32.dll_InitOnceComplete
jmp 0x1005515e
call sub.kernel32.dll_TlsAlloc
cmp eax, 0xffffffff
mov dword [ebp - 0x10], eax
je 0x100551c0
mov ecx, eax
xor eax, eax
inc ecx
lock cmpxchg dword [edi], ecx
jne 0x10055153
mov esi, dword [ebp - 0x10]
jmp 0x1005515e
mov esi, dword [edi]
jmp 0x1005515d
mov esi, eax
push dword [ebp - 0x10]
call sub.kernel32.dll_TlsFree
dec esi
mov eax, esi
add esp, 0x24
pop esi
pop edi
pop ebx
pop ebp
ret
mov dword [ebp - 0x2c], 0
lea eax, [ebp - 0x2c]
lea ecx, [ebp - 0x30]
mov edx, 0x100f0e70
push 0x100f1510
push eax
call sym.core::panicking::assert_failed::h6a7846da8fea5b10
push 0
push 4
push ebx
call sub.kernel32.dll_InitOnceComplete
mov dword [ebp - 0x2c], 0x100f14d0
mov dword [ebp - 0x28], 1
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x24], 4
mov dword [ebp - 0x20], 0
lea eax, [ebp - 0x2c]
push 0x100f1500
push eax
call sym.core::panicking::panic_fmt::hced28cb7137b21e1
lea ecx, [ebp - 0x10]
lea edx, [ebp - 0x2c]
mov dword [ebp - 0x2c], 0x100f14d0
mov dword [ebp - 0x28], 1
mov dword [ebp - 0x24], 4
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x1c], 0
call sym.core::panicking::assert_failed::h28f16479b022faf2
nop
Function at 0x10055230
Capabilities:
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x48
mov eax, dword [ebp + 8]
xorps xmm0, xmm0
mov dword [ebp - 0x54], 0
mov dword [ebp - 0x4c], 0
mov dword [ebp - 0x48], 0
mov dword [ebp - 0x44], 7
mov dword [ebp - 0x10], ecx
movsd qword [ebp - 0x3a], xmm0
movsd qword [ebp - 0x40], xmm0
mov byte [ebp - 0x38], 1
lea edi, [ebp - 0x18]
lea esi, [ebp - 0x54]
mov ecx, edi
push esi
push eax
call sym.std::sys::pal::windows::fs::File::open::h2b59cc016f8293b2
add esp, 8
cmp byte [ebp - 0x18], 4
jne 0x10055289
mov ebx, dword [ebp - 0x14]
jmp 0x10055298
movzx eax, byte [ebp - 0x18]
mov ebx, dword [ebp - 0x14]
cmp al, 4
jne 0x10055322
xorps xmm0, xmm0
mov dword [ebp - 0x24], 0
movups xmmword [ebp - 0x34], xmm0
movups xmmword [ebp - 0x44], xmm0
movups xmmword [ebp - 0x54], xmm0
push esi
push ebx
call sub.kernel32.dll_GetFileInformationByHandle
test eax, eax
je 0x10055320
test byte [ebp - 0x53], 4
je 0x100552e0
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0
push 8
push edi
push 9
push ebx
call sub.kernel32.dll_GetFileInformationByHandleEx
test eax, eax
je 0x1005536d
cmp dword [ebp - 0x34], 0
jne 0x10055372
mov eax, dword [ebp - 0x30]
test ebx, ebx
mov dword [ebp - 0x1c], eax
je 0x10055389
mov dword [ebp - 0x54], 0
call sub.kernel32.dll_GetCurrentProcess
push 2
push 0
push 0
push esi
push eax
push ebx
push eax
call sub.kernel32.dll_DuplicateHandle
test eax, eax
je 0x100553e7
mov esi, dword [ebp - 0x54]
jmp 0x1005538b
jmp 0x1005536d
cmp al, 3
jne 0x10055362
mov esi, dword [ebx + 4]
mov edi, dword [ebx]
mov eax, dword [esi]
test eax, eax
je 0x10055337
push edi
call eax
add esp, 4
cmp dword [esi + 4], 0
je 0x10055354
cmp dword [esi + 8], 9
jb 0x10055346
mov edi, dword [edi - 4]
push edi
push 0
push dword [0x100ff0c8]
call sub.kernel32.dll_HeapFree
push ebx
push 0
push dword [0x100ff0c8]
call sub.kernel32.dll_HeapFree
mov eax, dword [ebp - 0x10]
mov dword [eax], 0
jmp 0x10055381
call sub.kernel32.dll_GetLastError
mov eax, dword [ebp - 0x10]
mov dword [eax], 0
push ebx
call sub.kernel32.dll_CloseHandle
add esp, 0x48
pop esi
pop edi
pop ebx
pop ebp
ret
xor esi, esi
push 0
push 0
push 0
push 2
push 0
push esi
call sub.kernel32.dll_CreateFileMappingA
test eax, eax
je 0x100553d6
push dword [ebp - 0x1c]
push 0
push 0
push 4
push eax
mov dword [ebp - 0x20], eax
call sub.kernel32.dll_MapViewOfFile
mov edi, eax
push dword [ebp - 0x20]
call sub.kernel32.dll_CloseHandle
test edi, edi
je 0x100553d6
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x1c]
mov dword [eax + 4], esi
mov dword [eax + 8], edi
mov dword [eax + 0xc], ecx
mov dword [eax], 1
jmp 0x100553f5
mov eax, dword [ebp - 0x10]
mov dword [eax], 0
push esi
call sub.kernel32.dll_CloseHandle
jmp 0x100553f5
call sub.kernel32.dll_GetLastError
mov eax, dword [ebp - 0x10]
mov dword [eax], 0
jmp 0x1005537b
Function at 0x1005a2e0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
push eax
mov esi, dword [0x10071060]
test esi, esi
je 0x1005a368
dec esi
push esi
call sub.kernel32.dll_TlsGetValue
cmp eax, 1
ja 0x1005a360
je 0x1005a35e
mov eax, dword [0x100f2e44]
movzx eax, byte [eax]
sub esp, 0xc
mov dword [esp + 8], 0xc
mov dword [esp + 4], 0
call sym.std::sys::alloc::windows::process_heap_alloc::hc2bfe060f1f208f4
add esp, 0xc
test eax, eax
je 0x1005a388
mov dword [eax], 0
mov byte [eax + 4], 0
mov dword [eax + 8], esi
push esi
mov ebx, eax
call sub.kernel32.dll_TlsGetValue
mov edi, eax
mov dword [ebp - 0x10], ebx
push ebx
push esi
call sub.kernel32.dll_TlsSetValue
test edi, edi
je 0x1005a359
push edi
push 0
push dword [0x100ff0c8]
call sub.kernel32.dll_HeapFree
mov eax, dword [ebp - 0x10]
jmp 0x1005a360
xor eax, eax
add esp, 4
pop esi
pop edi
pop ebx
pop ebp
ret
push 0x10071060
call sym.std::sys::thread_local::key::windows::LazyKey::init::h0bd71fcfbfc5b9bd
add esp, 4
mov esi, eax
push esi
call sub.kernel32.dll_TlsGetValue
cmp eax, 1
jbe 0x1005a2fd
jmp 0x1005a360
push 0xc
push 4
call sym.alloc::alloc::handle_alloc_error::h3ca6a9ac69c8e3db
nop word cs:[eax + eax]
nop dword [eax + eax]

Function at 0x1005a3a0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0xc
mov esi, dword [0x10071070]
mov edi, ecx
test esi, esi
je 0x1005a45b
dec esi
push esi
call sub.kernel32.dll_TlsGetValue
cmp eax, 1
ja 0x1005a453
je 0x1005a3e0
test edi, edi
je 0x1005a3e4
mov ebx, dword [edi]
mov dword [edi], 0
test ebx, ebx
je 0x1005a3e6
mov ebx, dword [edi + 4]
jmp 0x1005a3e6
xor eax, eax
jmp 0x1005a453
xor ebx, ebx
mov eax, dword [0x100f2e44]
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x14], esi
movzx eax, byte [eax]
sub esp, 0xc
mov dword [esp + 8], 8
mov dword [esp + 4], 0
call sym.std::sys::alloc::windows::process_heap_alloc::hc2bfe060f1f208f4
add esp, 0xc
test eax, eax
je 0x1005a47b
mov dword [eax], ebx
mov dword [eax + 4], esi
push esi
mov ebx, eax
call sub.kernel32.dll_TlsGetValue
mov edi, eax
mov dword [ebp - 0x10], ebx
push ebx
push esi
call sub.kernel32.dll_TlsSetValue
test edi, edi
je 0x1005a450
mov eax, dword [edi]
test eax, eax
je 0x1005a442
lock dec dword [eax]
jne 0x1005a442
mov ecx, edi
call sym.__ZN5alloc4sync16Arc_LT_T_C_A_GT_9drop_slow17h4ee1933e4e45c3f4E.llvm.10150728606014878797
push edi
push 0
push dword [0x100ff0c8]
call sub.kernel32.dll_HeapFree
mov eax, dword [ebp - 0x10]
add esp, 0xc
pop esi
pop edi
pop ebx
pop ebp
ret
push 0x10071070
call sym.std::sys::thread_local::key::windows::LazyKey::init::h0bd71fcfbfc5b9bd
add esp, 4
mov esi, eax
push esi
call sub.kernel32.dll_TlsGetValue
cmp eax, 1
jbe 0x1005a3c9
jmp 0x1005a453
push 8
push 4
call sym.alloc::alloc::handle_alloc_error::h3ca6a9ac69c8e3db
add esp, 8
ud2
Function at 0x1005a4b0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
push eax
mov esi, dword [0x10071090]
mov edi, ecx
test esi, esi
je 0x1005a56a
dec esi
push esi
call sub.kernel32.dll_TlsGetValue
cmp eax, 1
ja 0x1005a562
je 0x1005a502
test edi, edi
je 0x1005a506
mov eax, dword [edi]
xor ecx, ecx
mov ebx, 0
mov dword [edi], 0
or eax, dword [edi + 4]
mov dword [edi + 4], 0
je 0x1005a4fe
mov ecx, dword [edi + 0xc]
mov ebx, dword [edi + 8]
mov edi, ecx
jmp 0x1005a50a
xor eax, eax
jmp 0x1005a562
xor ebx, ebx
xor edi, edi
mov eax, dword [0x100f2e44]
movzx eax, byte [eax]
sub esp, 0xc
mov dword [esp + 8], 0x10
mov dword [esp + 4], 0
call sym.std::sys::alloc::windows::process_heap_alloc::hc2bfe060f1f208f4
add esp, 0xc
test eax, eax
je 0x1005a58a
mov dword [eax], ebx
mov dword [eax + 4], edi
mov dword [eax + 8], esi
push esi
mov ebx, eax
call sub.kernel32.dll_TlsGetValue
mov edi, eax
mov dword [ebp - 0x10], ebx
push ebx
push esi
call sub.kernel32.dll_TlsSetValue
test edi, edi
je 0x1005a55f
push edi
push 0
push dword [0x100ff0c8]
call sub.kernel32.dll_HeapFree
mov eax, dword [ebp - 0x10]
add esp, 4
pop esi
pop edi
pop ebx
pop ebp
ret
push 0x10071090
call sym.std::sys::thread_local::key::windows::LazyKey::init::h0bd71fcfbfc5b9bd
add esp, 4
mov esi, eax
push esi
call sub.kernel32.dll_TlsGetValue
cmp eax, 1
jbe 0x1005a4d7
jmp 0x1005a562
push 0x10
push 8
call sym.alloc::alloc::handle_alloc_error::h3ca6a9ac69c8e3db
nop word cs:[eax + eax]
nop dword [eax]
Function at 0x1005a5a0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0xc
mov esi, dword [0x100710a0]
mov edi, ecx
test esi, esi
je 0x1005a65b
dec esi
push esi
call sub.kernel32.dll_TlsGetValue
cmp eax, 1
ja 0x1005a653
je 0x1005a5e0
test edi, edi
je 0x1005a5e4
mov ebx, dword [edi]
mov dword [edi], 0
test ebx, ebx
je 0x1005a5e6
mov ebx, dword [edi + 4]
jmp 0x1005a5e6
xor eax, eax
jmp 0x1005a653
xor ebx, ebx
mov eax, dword [0x100f2e44]
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x14], esi
movzx eax, byte [eax]
sub esp, 0xc
mov dword [esp + 8], 8
mov dword [esp + 4], 0
call sym.std::sys::alloc::windows::process_heap_alloc::hc2bfe060f1f208f4
add esp, 0xc
test eax, eax
je 0x1005a67b
mov dword [eax], ebx
mov dword [eax + 4], esi
push esi
mov ebx, eax
call sub.kernel32.dll_TlsGetValue
mov edi, eax
mov dword [ebp - 0x10], ebx
push ebx
push esi
call sub.kernel32.dll_TlsSetValue
test edi, edi
je 0x1005a650
mov eax, dword [edi]
test eax, eax
je 0x1005a642
lock dec dword [eax]
jne 0x1005a642
mov ecx, edi
call sym.__ZN5alloc4sync16Arc_LT_T_C_A_GT_9drop_slow17h9736c14079add486E.llvm.10150728606014878797
push edi
push 0
push dword [0x100ff0c8]
call sub.kernel32.dll_HeapFree
mov eax, dword [ebp - 0x10]
add esp, 0xc
pop esi
pop edi
pop ebx
pop ebp
ret
push 0x100710a0
call sym.std::sys::thread_local::key::windows::LazyKey::init::h0bd71fcfbfc5b9bd
add esp, 4
mov esi, eax
push esi
call sub.kernel32.dll_TlsGetValue
cmp eax, 1
jbe 0x1005a5c9
jmp 0x1005a653
push 8
push 4
call sym.alloc::alloc::handle_alloc_error::h3ca6a9ac69c8e3db
add esp, 8
ud2

Function at 0x1005af20
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
push eax
mov eax, dword [0x100f2e20]
mov esi, dword [eax]
test esi, esi
je 0x1005afa6
dec esi
push esi
call sub.kernel32.dll_TlsGetValue
cmp eax, 1
ja 0x1005af9e
je 0x1005af9c
mov eax, dword [0x100f2e44]
movzx eax, byte [eax]
sub esp, 0xc
mov dword [esp + 8], 8
mov dword [esp + 4], 0
call sym.std::sys::alloc::windows::process_heap_alloc::hc2bfe060f1f208f4
add esp, 0xc
test eax, eax
je 0x1005afbe
mov dword [eax], 0
mov dword [eax + 4], esi
push esi
mov ebx, eax
call sub.kernel32.dll_TlsGetValue
mov edi, eax
mov dword [ebp - 0x10], ebx
push ebx
push esi
call sub.kernel32.dll_TlsSetValue
test edi, edi
je 0x1005af97
mov eax, dword [0x100f2e2c]
push edi
push 0
push dword [eax]
call sub.kernel32.dll_HeapFree
mov eax, dword [ebp - 0x10]
jmp 0x1005af9e
xor eax, eax
add esp, 4
pop esi
pop edi
pop ebx
pop ebp
ret
push eax
call sym.std::sys::thread_local::key::windows::LazyKey::init::h0bd71fcfbfc5b9bd
add esp, 4
mov esi, eax
push esi
call sub.kernel32.dll_TlsGetValue
cmp eax, 1
jbe 0x1005af3e
jmp 0x1005af9e
push 8
push 4
call sym.alloc::alloc::handle_alloc_error::h3ca6a9ac69c8e3db
nop word [eax + eax]
Function at 0x1005afd0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
push eax
mov eax, dword [0x100f2e24]
mov esi, dword [eax]
test esi, esi
je 0x1005b05d
dec esi
push esi
call sub.kernel32.dll_TlsGetValue
cmp eax, 1
ja 0x1005b055
je 0x1005b053
mov eax, dword [0x100f2e44]
movzx eax, byte [eax]
sub esp, 0xc
mov dword [esp + 8], 0xc
mov dword [esp + 4], 0
call sym.std::sys::alloc::windows::process_heap_alloc::hc2bfe060f1f208f4
add esp, 0xc
test eax, eax
je 0x1005b079
mov dword [eax + 4], 0
mov dword [eax], 0
mov dword [eax + 8], esi
push esi
mov ebx, eax
call sub.kernel32.dll_TlsGetValue
mov edi, eax
mov dword [ebp - 0x10], ebx
push ebx
push esi
call sub.kernel32.dll_TlsSetValue
test edi, edi
je 0x1005b04e
mov eax, dword [0x100f2e2c]
push edi
push 0
push dword [eax]
call sub.kernel32.dll_HeapFree
mov eax, dword [ebp - 0x10]
jmp 0x1005b055
xor eax, eax
add esp, 4
pop esi
pop edi
pop ebx
pop ebp
ret
push eax
call sym.std::sys::thread_local::key::windows::LazyKey::init::h0bd71fcfbfc5b9bd
add esp, 4
mov esi, eax
push esi
call sub.kernel32.dll_TlsGetValue
cmp eax, 1
jbe 0x1005afee
jmp 0x1005b055
push 0xc
push 4
call sym.alloc::alloc::handle_alloc_error::h3ca6a9ac69c8e3db
nop word cs:[eax + eax]
nop dword [eax]
Function at 0x1005ba30
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x30
mov eax, dword [0x100f2e30]
mov esi, dword [eax]
test esi, esi
je 0x1005bade
dec esi
push esi
call sub.kernel32.dll_TlsGetValue
cmp eax, 1
ja 0x1005bad6
je 0x1005bad4
xorps xmm0, xmm0
lea eax, [esp + 0x10]
movaps xmmword [esp + 0x10], xmm0
push 0x10
push eax
call dword [sym.imp.bcryptprimitives.dll_ProcessPrng]
movaps xmm0, xmmword [esp + 0x10]
mov eax, dword [0x100f2e44]
movaps xmmword [esp], xmm0
movzx eax, byte [eax]
sub esp, 0xc
mov dword [esp + 8], 0x18
mov dword [esp + 4], 0
call sym.std::sys::alloc::windows::process_heap_alloc::hc2bfe060f1f208f4
add esp, 0xc
test eax, eax
je 0x1005bafa
movaps xmm0, xmmword [esp]
movups xmmword [eax], xmm0
mov dword [eax + 0x10], esi
push esi
mov ebx, eax
call sub.kernel32.dll_TlsGetValue
mov edi, eax
mov dword [esp], ebx
push ebx
push esi
call sub.kernel32.dll_TlsSetValue
test edi, edi
je 0x1005bacf
mov eax, dword [0x100f2e2c]
push edi
push 0
push dword [eax]
call sub.kernel32.dll_HeapFree
mov eax, dword [esp]
jmp 0x1005bad6
xor eax, eax
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
push eax
call sym.std::sys::thread_local::key::windows::LazyKey::init::h0bd71fcfbfc5b9bd
add esp, 4
mov esi, eax
push esi
call sub.kernel32.dll_TlsGetValue
cmp eax, 1
jbe 0x1005ba57
jmp 0x1005bad6
push 0x18
push 8
call sym.alloc::alloc::handle_alloc_error::h3ca6a9ac69c8e3db
nop word cs:[eax + eax]
nop dword [eax]

Function at 0x1005bb10
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
push esi
sub esp, 0x11c
mov eax, dword [ebp + 8]
mov eax, dword [eax]
mov esi, dword [eax]
mov dword [eax], 0
test esi, esi
je 0x1005bb87
lea eax, [ebp - 0x11c]
push 0x118
push 0
push eax
call sub.msvcrt.dll_memset
add esp, 0xc
lea eax, [ebp - 0x120]
mov dword [ebp - 0x120], 0x11c
push eax
call sub.ntdll.dll_RtlGetVersion
test eax, eax
js 0x1005bb76
mov ecx, dword [ebp - 0x11c]
mov al, 1
cmp ecx, 6
ja 0x1005bb7c
jne 0x1005bb7a
cmp dword [ebp - 0x118], 3
setae al
jmp 0x1005bb7c
mov al, 1
jmp 0x1005bb7c
xor eax, eax
mov byte [esi], al
add esp, 0x11c
pop esi
pop ebp
ret
push 0x100f1ec0
call sym.core::option::unwrap_failed::h4002a2165d665d64
nop word cs:[eax + eax]
nop dword [eax + eax]

Function at 0x1005bde0
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
push esi
sub esp, 0x11c
mov eax, dword [ebp + 8]
mov eax, dword [eax]
mov esi, dword [eax]
mov dword [eax], 0
test esi, esi
je 0x1005be57
lea eax, [ebp - 0x11c]
push 0x118
push 0
push eax
call sub.msvcrt.dll_memset
add esp, 0xc
lea eax, [ebp - 0x120]
mov dword [ebp - 0x120], 0x11c
push eax
call sub.ntdll.dll_RtlGetVersion
test eax, eax
js 0x1005be46
mov ecx, dword [ebp - 0x11c]
mov al, 1
cmp ecx, 6
ja 0x1005be4c
jne 0x1005be4a
cmp dword [ebp - 0x118], 3
setae al
jmp 0x1005be4c
mov al, 1
jmp 0x1005be4c
xor eax, eax
mov byte [esi], al
add esp, 0x11c
pop esi
pop ebp
ret
push 0x100f1ec0
call sym.core::option::unwrap_failed::h4002a2165d665d64
nop word cs:[eax + eax]
nop dword [eax + eax]
Function at 0x1005fb60
Capabilities:
Get memory capacity

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x70
mov esi, dword [ebp + 8]
xorps xmm0, xmm0
lea edi, [esp + 0x20]
movaps xmmword [esp + 0x20], xmm0
movaps xmmword [esp + 0x50], xmm0
movaps xmmword [esp + 0x40], xmm0
movaps xmmword [esp + 0x30], xmm0
mov dword [esp + 0x20], 0x40
mov dword [esp], edi
call sub.kernel32.dll_GlobalMemoryStatusEx
sub esp, 4
test eax, eax
jne 0x1005fba6
call sub.kernel32.dll_GetLastError
movups xmm0, xmmword [esp + 0x28]
mov dword [esp], edi
mov dword [esp + 4], 0x38
movups xmmword [esi + 0x40], xmm0
xorps xmm0, xmm0
movsd qword [esp + 0x50], xmm0
xorps xmm0, xmm0
movaps xmmword [esp + 0x40], xmm0
movaps xmmword [esp + 0x30], xmm0
movaps xmmword [esp + 0x20], xmm0
call sub.kernel32.dll_K32GetPerformanceInfo
sub esp, 8
test eax, eax
je 0x1005fc1f
mov edi, dword [esp + 0x30]
mov eax, dword [esp + 0x28]
mov ecx, dword [esp + 0x48]
xor ebx, ebx
mov edx, 0
sub eax, edi
sbb edx, edx
cmovb eax, ebx
mul ecx
mov dword [esi + 0x50], eax
mov eax, dword [esp + 0x24]
mov dword [esi + 0x54], edx
mov edx, 0
sub eax, edi
lea edi, [esp + 0x20]
sbb edx, edx
cmovb eax, ebx
mul ecx
mov dword [esi + 0x5c], edx
mov dword [esi + 0x58], eax
mov ecx, esi
mov edx, 1
call sym.__ZN7sysinfo7windows6system11SystemInner21refresh_cpu_specifics17hd323725b8e3d177cE.llvm.14058084406345062012
mov byte [esp + 0x20], 1
mov dword [esp + 0x25], 0x2020202
mov dword [esp + 0x21], 0x2020101
mov dword [esp + 0x10], edi
mov dword [esp], esi
mov dword [esp + 0xc], 0
mov dword [esp + 4], 0
call sym.sysinfo::common::system::System::refresh_processes_specifics::h8ec17f0f37c9f82f
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x1005fc70
Capabilities:
Get memory capacity

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x50
movzx ebx, byte [ebp + 0x10]
mov esi, dword [ebp + 8]
cmp byte [ebp + 0xc], 0
je 0x1005fcc0
xorps xmm0, xmm0
mov eax, esp
movaps xmmword [esp], xmm0
movaps xmmword [esp + 0x30], xmm0
movaps xmmword [esp + 0x20], xmm0
movaps xmmword [esp + 0x10], xmm0
mov dword [esp], 0x40
push eax
call sub.kernel32.dll_GlobalMemoryStatusEx
test eax, eax
jne 0x1005fcb7
call sub.kernel32.dll_GetLastError
movups xmm0, xmmword [esp + 8]
movups xmmword [esi + 0x40], xmm0
test bl, bl
je 0x1005fd26
xorps xmm0, xmm0
mov eax, esp
movsd qword [esp + 0x30], xmm0
xorps xmm0, xmm0
movaps xmmword [esp + 0x20], xmm0
movaps xmmword [esp + 0x10], xmm0
movaps xmmword [esp], xmm0
push 0x38
push eax
call sub.kernel32.dll_K32GetPerformanceInfo
test eax, eax
je 0x1005fd26
mov edi, dword [esp + 0x10]
mov eax, dword [esp + 8]
mov ebx, dword [esp + 0x28]
xor ecx, ecx
mov edx, 0
sub eax, edi
sbb edx, edx
cmovb eax, ecx
mul ebx
mov dword [esi + 0x50], eax
mov eax, dword [esp + 4]
mov dword [esi + 0x54], edx
mov edx, 0
sub eax, edi
sbb edx, edx
cmovb eax, ecx
mul ebx
mov dword [esi + 0x5c], edx
mov dword [esi + 0x58], eax
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret