joyce8/EMBER2024-capa huggingface dataset:
Function at 0x423120
Capabilities:
Copy file

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x38
mov esi, esp
mov dword [esi + 0x20], ebp
mov dword [esi + 0x24], esp
mov dword [esi + 0x30], 0xffffffff
mov dword [esi + 0x2c], 0x42e0f0
mov edi, dword [ebp + 8]
mov edx, dword [ebp + 0xc]
mov ebx, dword [ebp + 0x10]
lea ecx, [esi + 0x28]
mov eax, dword fs:[0]
mov dword [esi + 0x28], eax
mov dword fs:[0], ecx
mov ecx, esi
push ebx
call fcn.0042bc00
add esp, 4
mov ecx, dword [esi]
mov edx, dword [esi + 4]
mov eax, dword [esi + 8]
test ecx, ecx
je 0x42322d
mov dword [esi], ecx
mov dword [esi + 4], edx
mov edx, esi
mov dword [esi + 8], eax
lea ecx, [esi + 0x14]
push 1
call fcn.00424a60
add esp, 4
mov eax, dword [esi + 0x14]
mov edx, dword [esi + 0x18]
test eax, eax
je 0x42322a
mov edi, dword [ebp + 0x18]
mov dword [esi + 0x10], edx
mov edx, dword [ebp + 0x14]
mov dword [esi + 0xc], eax
mov dword [esi + 0x30], 0
mov ecx, esi
push edi
call fcn.0042bc00
add esp, 4
mov ecx, dword [esi]
mov edi, dword [esi + 4]
mov eax, dword [esi + 8]
test ecx, ecx
je 0x42323e
mov dword [esi], ecx
mov dword [esi + 4], edi
mov dword [esi + 8], eax
lea ecx, [esi + 0x14]
mov edx, esi
push 1
call fcn.00424a60
add esp, 4
mov ebx, dword [esi + 0x14]
mov edi, dword [esi + 0x18]
test ebx, ebx
je 0x42323b
mov dword [esi + 4], 0
mov dword [esi], 0
push 0
push 0
mov eax, esi
push eax
push 0x4232d0
push ebx
push dword [esi + 0xc]
call dword [sym.imp.kernel32.dll_CopyFileExW]
test eax, eax
je 0x42324f
mov eax, dword [esi]
mov edx, dword [ebp + 8]
mov ecx, dword [esi + 4]
mov dword [edx + 8], eax
mov dword [edx + 0xc], ecx
mov dword [edx], 0
test edi, edi
jne 0x423269
jmp 0x423277
mov eax, dword [esi + 0x1c]
mov dword [edi + 4], edx
mov dword [edi + 8], eax
mov dword [edi], 1
jmp 0x423291
mov eax, dword [esi + 0x1c]
mov ecx, dword [ebp + 8]
mov dword [ecx + 4], edi
mov dword [ecx + 8], eax
mov dword [ecx], 1
jmp 0x423277
call dword [sym.imp.kernel32.dll_GetLastError]
mov ecx, dword [ebp + 8]
mov byte [ecx + 4], 0
mov dword [ecx + 8], eax
mov dword [ecx], 1
test edi, edi
je 0x423277
add edi, edi
push 2
push edi
push ebx
call fcn.00402ca0
add esp, 0xc
mov eax, dword [esi + 0x10]
mov edi, dword [ebp + 8]
test eax, eax
je 0x423291
add eax, eax
push 2
push eax
push dword [esi + 0xc]
call fcn.00402ca0
add esp, 0xc
mov eax, dword [esi + 0x28]
mov dword fs:[0], eax
mov eax, edi
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x4232f0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x40
mov esi, ecx
mov ecx, dword [ebp + 0xc]
cmp dword [ebp + 0x10], 0
mov edi, edx
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0x103
je 0x423334
mov eax, dword [ebp + 0x1c]
mov ebx, dword [ebp + 0x18]
lea edx, [esp + 0x20]
mov dword [esp + 0x20], ebx
mov dword [esp + 0x24], eax
xor eax, eax
mov ebx, 1
jmp 0x42333a
xor ebx, ebx
xor eax, eax
xor edx, edx
mov dword [esp + 0x1c], eax
lea eax, [esp + 8]
mov dword [esp + 0x18], ebx
push 0
push edx
push ecx
push dword [ebp + 8]
push eax
push 0
push 0
push 0
push edi
call dword [sym.imp.ntdll.dll_NtWriteFile]
cmp eax, 0x103
jne 0x423376
push 0xffffffffffffffff
push edi
call dword [sym.imp.kernel32.dll_WaitForSingleObject]
mov eax, dword [esp + 8]
cmp eax, 0x103
je 0x42339b
test eax, eax
js 0x423385
mov eax, dword [esp + 0xc]
mov dword [esi + 4], eax
mov al, 4
jmp 0x423391
push eax
call dword [sym.imp.ntdll.dll_RtlNtStatusToDosError]
mov dword [esi + 4], eax
xor eax, eax
mov byte [esi], al
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
lea eax, [esp + 4]
mov dword [esp + 0x18], 0x51db4c
mov dword [esp + 0x1c], 1
mov dword [esp + 0x28], 0
mov dword [esp + 0x10], 0
mov byte [esp + 0x14], 0
lea ecx, [esp + 0x10]
lea edx, [esp + 0x34]
mov dword [esp + 0x20], eax
lea eax, [esp + 0x18]
mov dword [esp + 0x24], 0
push eax
push ecx
push edx
call fcn.0041b440
add esp, 0xc
mov ecx, dword [esp + 0x34]
mov edx, dword [esp + 0x38]
call fcn.00414690
mov ecx, 7
int 0x29
ud2
Function at 0x4299a0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x24
mov esi, ecx
lea ecx, [esp + 0xc]
push dword [esp + 0x38]
call fcn.0042bc00
add esp, 4
mov edx, dword [esp + 0xc]
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x14]
test edx, edx
je 0x429a05
mov dword [esp + 0x18], edx
mov dword [esp + 0x20], ecx
mov ecx, esp
lea edx, [esp + 0x18]
mov dword [esp + 0x1c], eax
call fcn.004226a0
mov edi, dword [esp]
test edi, edi
je 0x429a14
mov ebx, dword [esp + 4]
mov ebp, dword [esp + 8]
push edi
call dword [sym.imp.kernel32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x429a29
mov dword [esi], edi
mov dword [esi + 4], ebx
mov dword [esi + 8], ebp
jmp 0x429a21
mov dword [esp + 4], eax
mov dword [esp + 8], ecx
mov dword [esp], 0
mov ecx, esp
call fcn.00414b00
mov dword [esi], 0
add esp, 0x24
pop esi
pop edi
pop ebx
pop ebp
ret
test ebx, ebx
mov dword [esi], 0
je 0x429a21
add ebx, ebx
push 2
push ebx
push edi
call fcn.00402ca0
add esp, 0x30
jmp 0x429a24

Function at 0x42a710
Capabilities:
Generate random numbers via rtlgenrandom

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x60
mov esi, esp
mov dword [esi + 0x48], ebp
mov dword [esi + 0x4c], esp
mov dword [esi + 0x58], 0xffffffff
mov dword [esi + 0x54], 0x42e1a0
mov edi, ecx
lea eax, [esi + 0x50]
xorps xmm0, xmm0
mov ecx, dword fs:[0]
mov dword [esi + 0x50], ecx
mov dword fs:[0], eax
movaps xmmword [esi + 0x10], xmm0
lea eax, [esi + 0x10]
push 0x10
push eax
call dword [sym.imp.advapi32.dll_SystemFunction036]
test al, al
je 0x42a78e
mov eax, dword [esi + 0x10]
mov ecx, dword [esi + 0x14]
mov edx, dword [esi + 0x18]
mov ebx, dword [esi + 0x1c]
mov dword [esi + 4], eax
mov eax, dword [esi + 0x50]
mov dword fs:[0], eax
mov dword [edi + 0xc], ebx
mov dword [edi + 8], edx
mov dword [edi + 4], ecx
mov eax, dword [esi + 4]
mov dword [edi], eax
mov eax, edi
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
call dword [sym.imp.kernel32.dll_GetLastError]
mov byte [esi + 8], 0
mov dword [esi + 0xc], eax
lea eax, [esi + 8]
mov dword [esi + 0x30], 0x51de98
mov dword [esi + 0x34], 1
mov dword [esi + 0x40], 0
mov dword [esi + 0x58], 0
mov dword [esi + 0x28], eax
lea eax, [esi + 0x28]
mov dword [esi + 0x2c], 0x419e10
mov dword [esi + 0x38], eax
mov dword [esi + 0x3c], 1
lea eax, [esi + 0x30]
push 0x51dec4
push eax
call fcn.00442850
add esp, 8
ud2
Function at 0x42af10
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x1c
mov dword [ebp - 0x1c], esp
mov dword [ebp - 0x10], 0xffffffff
mov dword [ebp - 0x14], 0x42e1c0
lea eax, [ebp - 0x18]
mov ebx, dword [ebp + 0x10]
mov ecx, dword fs:[0]
mov dword [ebp - 0x18], ecx
mov dword fs:[0], eax
movzx eax, byte [0x529189]
push 4
push 8
call fcn.00402c90
add esp, 8
test eax, eax
je 0x42aff2
mov edi, eax
mov esi, dword [ebp + 8]
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 0x14]
mov dword [edi], ebx
mov dword [edi + 4], ecx
push 0
push 0x10000
push edi
push 0x42b050
push eax
push 0
call dword [sym.imp.kernel32.dll_CreateThread]
test eax, eax
je 0x42af8d
mov dword [esi + 4], eax
mov byte [esi], 4
jmp 0x42afdf
mov eax, dword [edi]
mov ecx, dword [edi + 4]
mov dword [ebp - 0x28], edi
mov dword [ebp - 0x10], 1
mov dword [ebp - 0x20], eax
push eax
mov dword [ebp - 0x24], ecx
call dword [ecx]
add esp, 4
mov ecx, dword [ebp - 0x24]
mov esi, dword [ebp + 8]
mov eax, dword [ecx + 4]
test eax, eax
je 0x42afc4
push dword [ecx + 8]
push eax
push dword [ebp - 0x20]
call fcn.00402ca0
add esp, 0xc
push 4
push 8
push dword [ebp - 0x28]
call fcn.00402ca0
add esp, 0xc
call dword [sym.imp.kernel32.dll_GetLastError]
mov byte [esi], 0
mov dword [esi + 4], eax
mov eax, dword [ebp - 0x18]
mov dword fs:[0], eax
mov eax, esi
add esp, 0x1c
pop esi
pop edi
pop ebx
pop ebp
ret
mov dword [ebp - 0x10], 0
push 8
push 4
call fcn.00442780
add esp, 8
ud2
Function at 0x42d5a0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push edi
push esi
mov eax, dword [0x52907c]
mov esi, ecx
test eax, eax
je 0x42d5c6
dec eax
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
cmp eax, 2
jb 0x42d5df
cmp dword [eax + 4], 0
je 0x42d5df
add eax, 8
pop esi
pop edi
ret
push 0x52907c
call fcn.00442130
add esp, 4
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
cmp eax, 2
jae 0x42d5ba
mov eax, dword [0x52907c]
test eax, eax
je 0x42d676
dec eax
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
cmp eax, 1
je 0x42d693
mov edi, eax
test eax, eax
jne 0x42d63f
movzx eax, byte [0x529189]
push 4
push 0x10
call fcn.00402c90
add esp, 8
test eax, eax
je 0x42d6a7
mov dword [eax], 0x52907c
mov dword [eax + 4], 0
mov edi, eax
mov eax, dword [0x52907c]
test eax, eax
je 0x42d698
dec eax
push edi
push eax
call dword [sym.imp.kernel32.dll_TlsSetValue]
test esi, esi
je 0x42d65f
mov eax, dword [esi]
xor ecx, ecx
mov edx, 0
mov dword [esi], 0
cmp eax, 1
jne 0x42d663
mov ecx, dword [esi + 4]
mov edx, dword [esi + 8]
jmp 0x42d663
xor ecx, ecx
xor edx, edx
lea eax, [edi + 8]
mov dword [edi + 4], 1
mov dword [edi + 8], ecx
mov byte [edi + 0xc], dl
pop esi
pop edi
ret
push 0x52907c
call fcn.00442130
add esp, 4
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
cmp eax, 1
jne 0x42d5fd
xor eax, eax
pop esi
pop edi
ret
push 0x52907c
call fcn.00442130
add esp, 4
jmp 0x42d637
push 0x10
push 4
call fcn.00442780
add esp, 8
ud2
Function at 0x42d6c0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x1c
mov dword [ebp - 0x1c], esp
mov dword [ebp - 0x10], 0xffffffff
mov dword [ebp - 0x14], 0x42e290
mov esi, ecx
lea eax, [ebp - 0x18]
mov ecx, dword fs:[0]
mov dword [ebp - 0x18], ecx
mov dword fs:[0], eax
mov eax, dword [0x52908c]
test eax, eax
je 0x42d7d0
dec eax
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
cmp eax, 2
jb 0x42d715
cmp dword [eax + 4], 0
mov edi, eax
jne 0x42d7cb
mov eax, dword [0x52908c]
test eax, eax
je 0x42d7f2
dec eax
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
cmp eax, 1
je 0x42d80f
mov edi, eax
test eax, eax
jne 0x42d789
mov dword [ebp - 0x24], 0
mov dword [ebp - 0x28], 0x52908c
movzx eax, byte [0x529189]
push 4
push 0xc
call fcn.00402c90
add esp, 8
test eax, eax
je 0x42d836
mov edi, eax
mov eax, dword [ebp - 0x20]
movsd xmm0, qword [ebp - 0x28]
mov dword [edi + 8], eax
movsd qword [edi], xmm0
mov eax, dword [0x52908c]
test eax, eax
je 0x42d824
dec eax
push edi
push eax
call dword [sym.imp.kernel32.dll_TlsSetValue]
test esi, esi
je 0x42d79e
mov eax, dword [esi]
mov dword [esi], 0
test eax, eax
je 0x42d7a0
mov eax, dword [esi + 4]
jmp 0x42d7a0
xor eax, eax
mov edx, dword [edi + 4]
mov ecx, dword [edi + 8]
test edx, edx
mov dword [ebp - 0x28], edx
mov dword [ebp - 0x24], ecx
mov dword [edi + 4], 1
mov dword [edi + 8], eax
je 0x42d7cb
test ecx, ecx
je 0x42d7cb
lock dec dword [ecx]
jne 0x42d7cb
lea ecx, [ebp - 0x24]
call fcn.00417cf0
add edi, 8
jmp 0x42d811
push 0x52908c
call fcn.00442130
add esp, 4
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
cmp eax, 2
jae 0x42d709
jmp 0x42d715
push 0x52908c
call fcn.00442130
add esp, 4
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
cmp eax, 1
jne 0x42d733
xor edi, edi
mov eax, dword [ebp - 0x18]
mov dword fs:[0], eax
mov eax, edi
add esp, 0x1c
pop esi
pop edi
pop ebx
pop ebp
ret
push 0x52908c
call fcn.00442130
add esp, 4
jmp 0x42d781
mov dword [ebp - 0x10], 0
push 0xc
push 4
call fcn.00442780
add esp, 8
ud2
Function at 0x42d870
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push edi
push esi
mov eax, dword [0x52909c]
mov esi, ecx
test eax, eax
je 0x42d896
dec eax
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
cmp eax, 2
jb 0x42d8af
cmp byte [eax + 4], 0
je 0x42d8af
add eax, 5
pop esi
pop edi
ret
push 0x52909c
call fcn.00442130
add esp, 4
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
cmp eax, 2
jae 0x42d88a
mov eax, dword [0x52909c]
test eax, eax
je 0x42d922
dec eax
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
cmp eax, 1
je 0x42d93b
mov edi, eax
test eax, eax
jne 0x42d900
movzx eax, byte [0x529189]
push 4
push 8
call fcn.00402c90
add esp, 8
test eax, eax
je 0x42d94f
mov dword [eax], 0x52909c
mov byte [eax + 4], 0
mov edi, eax
mov eax, dword [0x52909c]
test eax, eax
je 0x42d940
dec eax
push edi
push eax
call dword [sym.imp.kernel32.dll_TlsSetValue]
xor ecx, ecx
test esi, esi
je 0x42d915
cmp byte [esi], 0
mov byte [esi], 0
movzx eax, byte [esi + 1]
cmove eax, ecx
mov ecx, eax
lea eax, [edi + 5]
mov byte [edi + 4], 1
mov byte [edi + 5], cl
pop esi
pop edi
ret
push 0x52909c
call fcn.00442130
add esp, 4
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
cmp eax, 1
jne 0x42d8c5
xor eax, eax
pop esi
pop edi
ret
push 0x52909c
call fcn.00442130
add esp, 4
jmp 0x42d8f8
push 8
push 4
call fcn.00442780
add esp, 8
ud2
Function at 0x42d960
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x1c
mov dword [ebp - 0x1c], esp
mov dword [ebp - 0x10], 0xffffffff
mov dword [ebp - 0x14], 0x42e2a0
mov esi, ecx
lea eax, [ebp - 0x18]
mov ecx, dword fs:[0]
mov dword [ebp - 0x18], ecx
mov dword fs:[0], eax
mov eax, dword [0x5290ac]
test eax, eax
je 0x42da70
dec eax
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
cmp eax, 2
jb 0x42d9b5
cmp dword [eax + 4], 0
mov edi, eax
jne 0x42da6b
mov eax, dword [0x5290ac]
test eax, eax
je 0x42da92
dec eax
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
cmp eax, 1
je 0x42daaf
mov edi, eax
test eax, eax
jne 0x42da29
mov dword [ebp - 0x24], 0
mov dword [ebp - 0x28], 0x5290ac
movzx eax, byte [0x529189]
push 4
push 0xc
call fcn.00402c90
add esp, 8
test eax, eax
je 0x42dad6
mov edi, eax
mov eax, dword [ebp - 0x20]
movsd xmm0, qword [ebp - 0x28]
mov dword [edi + 8], eax
movsd qword [edi], xmm0
mov eax, dword [0x5290ac]
test eax, eax
je 0x42dac4
dec eax
push edi
push eax
call dword [sym.imp.kernel32.dll_TlsSetValue]
test esi, esi
je 0x42da3e
mov eax, dword [esi]
mov dword [esi], 0
test eax, eax
je 0x42da40
mov eax, dword [esi + 4]
jmp 0x42da40
xor eax, eax
mov edx, dword [edi + 4]
mov ecx, dword [edi + 8]
test edx, edx
mov dword [ebp - 0x28], edx
mov dword [ebp - 0x24], ecx
mov dword [edi + 4], 1
mov dword [edi + 8], eax
je 0x42da6b
test ecx, ecx
je 0x42da6b
lock dec dword [ecx]
jne 0x42da6b
lea ecx, [ebp - 0x24]
call fcn.00417d30
add edi, 8
jmp 0x42dab1
push 0x5290ac
call fcn.00442130
add esp, 4
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
cmp eax, 2
jae 0x42d9a9
jmp 0x42d9b5
push 0x5290ac
call fcn.00442130
add esp, 4
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
cmp eax, 1
jne 0x42d9d3
xor edi, edi
mov eax, dword [ebp - 0x18]
mov dword fs:[0], eax
mov eax, edi
add esp, 0x1c
pop esi
pop edi
pop ebx
pop ebp
ret
push 0x5290ac
call fcn.00442130
add esp, 4
jmp 0x42da21
mov dword [ebp - 0x10], 0
push 0xc
push 4
call fcn.00442780
add esp, 8
ud2
Function at 0x42db10
Capabilities:
Generate random numbers via winapi
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push esi
and esp, 0xfffffff0
sub esp, 0x30
mov eax, dword [0x5290bc]
test eax, eax
je 0x42dc0f
dec eax
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
cmp eax, 2
jb 0x42db41
mov esi, eax
mov eax, dword [eax]
or eax, dword [esi + 4]
jne 0x42dc0a
mov eax, dword [0x5290bc]
test eax, eax
je 0x42dc31
dec eax
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
cmp eax, 1
je 0x42dc4e
mov esi, eax
test eax, eax
jne 0x42dbac
movzx eax, byte [0x529189]
push 8
push 0x20
call fcn.00402c90
add esp, 8
test eax, eax
je 0x42dc6a
mov dword [eax + 4], 0
mov dword [eax], 0
mov dword [eax + 0x18], 0x5290bc
mov esi, eax
mov eax, dword [0x5290bc]
test eax, eax
je 0x42dc58
dec eax
push esi
push eax
call dword [sym.imp.kernel32.dll_TlsSetValue]
mov eax, dword [ebp + 8]
test eax, eax
je 0x42dbcb
mov ecx, dword [eax]
movups xmm0, xmmword [eax + 8]
mov dword [eax + 4], 0
mov dword [eax], 0
cmp ecx, 1
je 0x42dbf9
xorps xmm0, xmm0
mov eax, esp
movaps xmmword [esp], xmm0
push 2
push 0x10
push eax
push 0
call dword [sym.imp.bcrypt.dll_BCryptGenRandom]
test eax, eax
js 0x42dbeb
movaps xmm0, xmmword [esp]
jmp 0x42dbf9
lea ecx, [esp + 0x10]
call fcn.0042a710
movups xmm0, xmmword [esp + 0x10]
mov dword [esi + 4], 0
mov dword [esi], 1
movups xmmword [esi + 8], xmm0
add esi, 8
jmp 0x42dc50
push 0x5290bc
call fcn.00442130
add esp, 4
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
cmp eax, 2
jae 0x42db34
jmp 0x42db41
push 0x5290bc
call fcn.00442130
add esp, 4
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
cmp eax, 1
jne 0x42db5f
xor esi, esi
mov eax, esi
lea esp, [ebp - 4]
pop esi
pop ebp
ret
push 0x5290bc
call fcn.00442130
add esp, 4
jmp 0x42dba4
push 0x20
push 8
call fcn.00442780
add esp, 8
ud2
Function at 0x4397a0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
push ebx
push edi
push esi
mov eax, dword [esp + 0x14]
test eax, eax
je 0x4397f8
mov esi, dword [esp + 0x18]
lea edi, [edx + eax*2]
xor ebx, ebx
movzx eax, byte [edx + 1]
cmp byte [edx], ch
lea edx, [edx + 2]
lea ebp, [ebx + eax]
jne 0x4397f0
cmp ebx, ebp
ja 0x439872
cmp ebp, dword [esp + 0x1c]
ja 0x439883
add ebx, esi
nop word [eax + eax]
test eax, eax
je 0x4397f2
dec eax
cmp byte [ebx], cl
lea ebx, [ebx + 1]
jne 0x4397e0
jmp 0x43984f
ja 0x4397f8
cmp edx, edi
mov ebx, ebp
jne 0x4397b5
mov edx, dword [esp + 0x24]
test edx, edx
je 0x439853
mov esi, dword [esp + 0x20]
movzx ecx, cx
mov al, 1
add edx, esi
nop dword [eax + eax]
movzx ebx, byte [esi]
lea edi, [esi + 1]
test bl, bl
js 0x439830
mov esi, edi
sub ecx, ebx
jns 0x439847
jmp 0x439855
cmp edi, edx
je 0x43985c
movzx edi, byte [esi + 1]
and ebx, 0x7f
add esi, 2
shl ebx, 8
or ebx, edi
sub ecx, ebx
js 0x439855
xor al, 1
cmp esi, edx
jne 0x439810
jmp 0x439855
xor eax, eax
jmp 0x439855
mov al, 1
and al, 1
pop esi
pop edi
pop ebx
pop ebp
ret
push 0x51fde0
push 0x2b
push str.called__Option::unwrap____on_a__None__valuefrom_str_radix_int:_must_lie_in_the_range___2__36_____found
call fcn.00442910
add esp, 0xc
ud2
push 0x51fdf0
push ebp
push ebx
call fcn.00442d10
add esp, 0xc
ud2
push 0x51fdf0
push dword [esp + 0x20]
push ebp
call fcn.00442ca0
add esp, 0xc
ud2

Function at 0x43b485
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.kernel32.dll_GetModuleHandleW]
test eax, eax
je 0x43b4c4
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x43b4c4
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x43b4c4
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x43b4c4
cmp dword [ecx + 0x74], 0xe
jbe 0x43b4c4
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret

Function at 0x43f440
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x43f46d
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x43f46d
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret
Function at 0x442130
Capabilities:
Allocate thread local storage

Disassembly:
push ebx
push edi
push esi
sub esp, 0x20
mov edi, dword [esp + 0x30]
cmp dword [edi + 4], 0
je 0x4421b1
lea ebx, [edi + 0xc]
mov dword [esp + 4], 0
lea eax, [esp + 4]
push 0
push eax
push 0
push ebx
call dword [sym.imp.kernel32.dll_InitOnceBeginInitialize]
cmp eax, 1
mov dword [esp], eax
jne 0x4421ec
cmp dword [esp + 4], 0
je 0x4421d3
call dword [sym.imp.kernel32.dll_TlsAlloc]
cmp eax, 0xffffffff
je 0x44220f
mov esi, eax
inc eax
mov dword [edi], eax
mov eax, dword [0x529224]
nop word [eax + eax]
mov dword [edi + 8], eax
lock cmpxchg dword [0x529224], edi
jne 0x442190
mov byte [0x529220], 1
push 0
push 0
push ebx
call dword [sym.imp.kernel32.dll_InitOnceComplete]
jmp 0x4421e3
call dword [sym.imp.kernel32.dll_TlsAlloc]
cmp eax, 0xffffffff
mov dword [esp], eax
je 0x442256
mov ecx, eax
xor eax, eax
inc ecx
lock cmpxchg dword [edi], ecx
jne 0x4421d7
mov esi, dword [esp]
jmp 0x4421e3
mov esi, dword [edi]
jmp 0x4421e2
mov esi, eax
push dword [esp]
call dword [sym.imp.kernel32.dll_TlsFree]
dec esi
mov eax, esi
add esp, 0x20
pop esi
pop edi
pop ebx
ret
mov dword [esp + 8], 0
lea eax, [esp + 8]
mov ecx, esp
mov edx, 0x51e1b8
push 0x51e218
push eax
call fcn.00441bd0
add esp, 8
ud2
push 0
push 4
push ebx
call dword [sym.imp.kernel32.dll_InitOnceComplete]
mov dword [esp + 8], 0x51e1d0
mov dword [esp + 0xc], 1
mov dword [esp + 0x18], 0
mov dword [esp + 0x10], str._rustc_79e9716c980570bfd1f666e3b16ac583f0168962librarycore_src_sliceiter.rs
mov dword [esp + 0x14], 0
lea eax, [esp + 8]
push 0x51e208
push eax
call fcn.00442850
add esp, 8
ud2
mov ecx, esp
lea edx, [esp + 8]
mov dword [esp + 8], 0x51e1d0
mov dword [esp + 0xc], 1
mov dword [esp + 0x10], str._rustc_79e9716c980570bfd1f666e3b16ac583f0168962librarycore_src_sliceiter.rs
mov dword [esp + 0x14], 0
mov dword [esp + 0x18], 0
call fcn.00441c10
ud2
Function at 0x442a30
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebx
push edi
push esi
sub esp, 0x68
movzx eax, byte [esp + 0x78]
mov esi, dword [esp + 0x84]
mov ebx, dword [esp + 0x7c]
mov ecx, dword [esp + 0x8c]
mov edx, dword [esp + 0x88]
mov edi, dword [esp + 0x80]
test eax, eax
mov dword [esp + 8], ebx
mov dword [esp + 0x10], esi
mov dword [esp + 0xc], edi
mov dword [esp + 0x14], edx
je 0x442a81
cmp eax, 1
jne 0x442af8
mov dword [esp], 0x51f81c
jmp 0x442a88
mov dword [esp], 0x51f81a
mov edx, 2
mov eax, dword [esp + 0x90]
cmp dword [ecx], 0
mov dword [esp + 4], edx
jne 0x442b14
mov ecx, esp
lea edx, [esp + 8]
lea esi, [esp + 0x10]
mov dword [esp + 0x38], 0x51f858
mov dword [esp + 0x3c], 3
mov dword [esp + 0x48], 0
mov dword [esp + 0x18], ecx
mov dword [esp + 0x1c], 0x43a6c0
mov dword [esp + 0x20], edx
lea edx, [esp + 0x18]
mov dword [esp + 0x24], 0x43a670
mov dword [esp + 0x28], esi
mov dword [esp + 0x2c], 0x43a670
mov dword [esp + 0x40], edx
mov dword [esp + 0x44], 3
jmp 0x442b9a
mov edx, 7
mov dword [esp], 0x51f81e
mov eax, dword [esp + 0x90]
cmp dword [ecx], 0
mov dword [esp + 4], edx
je 0x442a9d
movsd xmm0, qword [ecx + 0x10]
movsd xmm2, qword [ecx]
movsd xmm1, qword [ecx + 8]
mov edx, esp
lea esi, [esp + 0x50]
mov dword [esp + 0x38], 0x51f88c
mov dword [esp + 0x3c], 4
mov dword [esp + 0x48], 0
mov dword [esp + 0x18], edx
lea edx, [esp + 8]
mov dword [esp + 0x1c], 0x43a6c0
mov dword [esp + 0x20], esi
mov dword [esp + 0x24], 0x4371a0
lea esi, [esp + 0x10]
mov dword [esp + 0x28], edx
lea edx, [esp + 0x18]
mov dword [esp + 0x2c], 0x43a670
mov dword [esp + 0x30], esi
mov dword [esp + 0x34], 0x43a670
mov dword [esp + 0x40], edx
mov dword [esp + 0x44], 4
movsd qword [esp + 0x60], xmm0
movsd qword [esp + 0x58], xmm1
movsd qword [esp + 0x50], xmm2
lea ecx, [esp + 0x38]
push eax
push ecx
call fcn.00442850
add esp, 8
ud2

Function at 0xfead7c
Capabilities:
Encode data using xor

Disassembly:
jmp 0xfead86
pushal
call 0xfead8c
pop ebp
sub ebp, 0x10
sub ebp, 0xbead7c
jmp 0xfeada2
mov eax, 0xbead7c
add eax, ebp
add eax, 0x4c
mov ecx, 0x5f3
mov edx, 0x672ff6f0
xor byte [eax], dl
inc eax
dec ecx
jne 0xfeadb9
jmp 0xfeadcc
jnp 0xfeae0b
jnp 0xfeae49
int3
invalid
invalid
jge 0xfeaddf
aam 0xf4
xor bh, ah
invalid