joyce8/EMBER2024-capa huggingface dataset:
Function at 0x49c4aa
Capabilities:
Decrypt data via sspi

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x3c
mov edi, edx
mov esi, ecx
mov ecx, dword [edx + 0x58]
mov edx, dword [edx + 0x60]
push 0x541ca0
push dword [edi + 0x50]
call fcn.0049c430
pop ecx
pop ecx
test eax, eax
cmove edx, eax
mov ecx, esp
and dword [ecx + 0x2c], 0
mov dword [ecx], edx
mov dword [ecx + 4], 1
mov dword [ecx + 8], eax
xorps xmm0, xmm0
movups xmmword [ecx + 0xc], xmm0
lea eax, [esp + 0x30]
and dword [eax], 0
movups xmmword [ecx + 0x1c], xmm0
mov dword [eax + 4], 4
mov dword [eax + 8], ecx
lea ecx, [edi + 0x80]
push 0
push 0
push eax
push ecx
call dword [sym.imp.secur32.dll_DecryptMessage]
cmp eax, 0x80090318
je 0x49c5ce
test eax, eax
je 0x49c564
cmp eax, 0x90317
je 0x49c5c7
cmp eax, 0x90321
jne 0x49c5db
mov dword [edi + 0x20], 0x10000
mov byte [edi + 0x24], 0
xor eax, eax
cmp dword [esp + 0x28], 5
mov edx, dword [edi + 0x50]
jne 0x49c54f
mov eax, dword [esp + 0x24]
sub edx, eax
mov ecx, edi
call fcn.0049c45f
and dword [edi + 0xa0], 0
jmp 0x49c5ec
mov eax, dword [esp + 0x14]
mov ecx, dword [edi + 0x58]
mov edx, dword [edi + 0x60]
sub eax, ecx
mov ebp, dword [esp + 0xc]
add ebp, eax
lea ebx, [edi + 0x40]
and dword [edi + 0x48], 0
push ebp
push eax
call fcn.0049c604
pop ecx
pop ecx
mov ebp, edx
mov ecx, ebx
mov edx, eax
push ebp
call fcn.004ebac3
pop eax
and dword [edi + 0x3c], 0
and dword [edi + 0x38], 0
xor eax, eax
cmp dword [esp + 0x28], 5
mov edx, dword [edi + 0x50]
jne 0x49c5ab
mov eax, dword [esp + 0x24]
sub edx, eax
mov ecx, edi
call fcn.0049c45f
mov eax, dword [edi + 0x50]
xor ecx, ecx
or eax, dword [edi + 0x54]
sete cl
mov dword [edi + 0xa0], ecx
jmp 0x49c5ec
mov word [esi], 0x104
jmp 0x49c5f1
cmp dword [esp + 0x10], 4
jne 0x49c5e3
mov eax, dword [esp + 0xc]
jmp 0x49c5e6
mov dword [esi + 4], eax
and dword [esi], 0
jmp 0x49c5f1
xor eax, eax
inc eax
mov dword [edi + 0xa0], eax
mov word [esi], 4
add esp, 0x3c
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x49d635
Capabilities:
Decrypt data via sspi

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x3c
mov edi, edx
mov esi, ecx
mov ecx, dword [edx + 0x100]
mov edx, dword [edx + 0x108]
push 0x541ca0
push dword [edi + 0xf8]
call fcn.0049c430
pop ecx
pop ecx
test eax, eax
cmove edx, eax
mov ecx, esp
and dword [ecx + 0x2c], 0
mov dword [ecx], edx
mov dword [ecx + 4], 1
mov dword [ecx + 8], eax
xorps xmm0, xmm0
movups xmmword [ecx + 0xc], xmm0
lea eax, [esp + 0x30]
and dword [eax], 0
movups xmmword [ecx + 0x1c], xmm0
mov dword [eax + 4], 4
mov dword [eax + 8], ecx
lea ecx, [edi + 0x128]
push 0
push 0
push eax
push ecx
call dword [sym.imp.secur32.dll_DecryptMessage]
cmp eax, 0x80090318
je 0x49d786
test eax, eax
je 0x49d701
cmp eax, 0x90317
je 0x49d77f
cmp eax, 0x90321
jne 0x49d793
mov dword [edi + 0xc8], 0x10000
mov byte [edi + 0xcc], 0
xor eax, eax
cmp dword [esp + 0x28], 5
mov edx, dword [edi + 0xf8]
jne 0x49d6ec
mov eax, dword [esp + 0x24]
sub edx, eax
mov ecx, edi
call fcn.0049d5de
and dword [edi + 0x148], 0
jmp 0x49d7a4
mov eax, dword [esp + 0x14]
mov ecx, dword [edi + 0x100]
mov edx, dword [edi + 0x108]
sub eax, ecx
mov ebp, dword [esp + 0xc]
add ebp, eax
lea ebx, [edi + 0xe8]
and dword [edi + 0xf0], 0
push ebp
push eax
call fcn.0049c604
pop ecx
pop ecx
mov ebp, edx
mov ecx, ebx
mov edx, eax
push ebp
call fcn.004ebac3
pop eax
and dword [edi + 0xe4], 0
and dword [edi + 0xe0], 0
xor eax, eax
cmp dword [esp + 0x28], 5
mov edx, dword [edi + 0xf8]
jne 0x49d75d
mov eax, dword [esp + 0x24]
sub edx, eax
mov ecx, edi
call fcn.0049d5de
mov eax, dword [edi + 0xf8]
xor ecx, ecx
or eax, dword [edi + 0xfc]
sete cl
mov dword [edi + 0x148], ecx
jmp 0x49d7a4
mov word [esi], 0x104
jmp 0x49d7a9
cmp dword [esp + 0x10], 4
jne 0x49d79b
mov eax, dword [esp + 0xc]
jmp 0x49d79e
mov dword [esi + 4], eax
and dword [esi], 0
jmp 0x49d7a9
xor eax, eax
inc eax
mov dword [edi + 0x148], eax
mov word [esi], 4
add esp, 0x3c
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x4a8a25
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov ecx, dword [esp + 4]
cmp dword [ecx], 0xa
jne fcn.0049a6c0
ret
Function at 0x4adbd4
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x24
mov ebp, edx
mov dword [esp + 4], ecx
mov edx, dword [esp + 0x38]
lea edi, [esp + 0x18]
mov ecx, edi
push 0xb
call fcn.004adae9
pop eax
mov eax, esp
mov dword [eax], 0x800
lea eax, [esp + 8]
and dword [eax], 0
mov ecx, 0x800
call fcn.004ba184
mov ebx, eax
lea esi, [esp + 0xc]
mov dword [esi], eax
mov dword [esi + 4], edx
and dword [esi + 8], 0
mov edi, dword [edi]
mov eax, esp
push eax
push ebx
lea eax, [esp + 0x10]
push eax
push 0
push edi
push ebp
call dword [sym.imp.advapi32.dll_RegQueryValueExW]
cmp eax, 0xea
jne 0x4adc47
mov edx, dword [esp]
mov ecx, esi
call fcn.004ebaa9
mov ebx, dword [esp + 0xc]
jmp 0x4adc1d
test eax, eax
jne 0x4adc68
mov eax, dword [esp]
mov dword [esp + 0x14], eax
mov eax, dword [esp + 8]
cmp eax, 0xb
mov edx, dword [esp + 4]
jbe 0x4adc84
mov eax, 0xde
xor ecx, ecx
jmp 0x4adc6e
xor ecx, ecx
mov edx, dword [esp + 4]
mov dword [edx], ecx
mov dword [edx + 4], eax
mov byte [edx + 0xc], 0xc
mov edx, dword [esp + 0x10]
mov ecx, ebx
call fcn.0043e571
jmp 0x4adc98
mov ecx, dword [esp + 0x14]
mov dword [edx + 8], ecx
movsd xmm0, qword [esp + 0xc]
movsd qword [edx], xmm0
mov byte [edx + 0xc], al
mov edx, dword [esp + 0x1c]
mov ecx, edi
call fcn.0042b815
add esp, 0x24
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x4ba66d
Capabilities:
Get remote cert context via schannel

Disassembly:
push esi
push eax
mov esi, ecx
mov eax, esp
and dword [eax], 0
push eax
push 0x53
push edx
call dword [sym.imp.secur32.dll_QueryContextAttributesW]
test eax, eax
je 0x4ba68c
and dword [esi], 0
mov dword [esi + 4], eax
jmp 0x4ba695
mov eax, dword [esp]
mov dword [esi + 4], eax
mov byte [esi], 4
add esp, 4
pop esi
ret

Function at 0x4bacff
Capabilities:
Get client handle via schannel
Get outbound credentials handle via credssp

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x48
and dword [esp + 4], 0
mov esi, ecx
and dword [esp + 8], 0
xorps xmm0, xmm0
movups xmmword [esp + 0x38], xmm0
movups xmmword [esp + 0x2c], xmm0
movups xmmword [esp + 0x1c], xmm0
mov dword [esp + 0x10], 4
mov dword [esp + 0x40], 0x400010
mov eax, dword [edx + 0xc]
test eax, eax
je 0x4bad46
mov ecx, dword [edx + 0x14]
mov dword [esp + 0x28], ecx
mov dword [esp + 0x2c], eax
mov eax, dword [edx + 0x18]
test eax, eax
je 0x4bad6c
mov edi, dword [edx + 0x20]
xor ecx, ecx
test edi, edi
je 0x4bad68
xor ebx, ebx
movzx ebp, byte [eax + ebx]
or ecx, dword [ebp*4 + 0x571a5c]
inc ebx
cmp edi, ebx
jne 0x4bad58
mov dword [esp + 0x30], ecx
mov ebp, dword [edx + 8]
lea eax, [ebp*4]
test ebp, ebp
mov dword [esp], eax
je 0x4badb0
cmp ebp, 0x20000000
jae 0x4bae3a
mov edi, dword [edx]
push 4
pop ecx
mov edx, eax
call fcn.00404a80
test eax, eax
je 0x4bae41
mov ebx, eax
xor eax, eax
mov ecx, dword [edi + eax*4]
mov dword [ebx + eax*4], ecx
inc eax
cmp ebp, eax
jne 0x4bada1
mov eax, ebp
jmp 0x4badb5
xor eax, eax
push 4
pop ebx
lea ecx, [esp + 0x10]
mov dword [ecx + 4], eax
mov dword [ecx + 8], ebx
lea eax, [esp + 4]
push 0
push eax
push 0
push 0
push ecx
push 0
push 2
push str.Microsoft_Unified_Security_Protocol_Provider
push 0
call dword [sym.imp.secur32.dll_AcquireCredentialsHandleA]
test eax, eax
je 0x4bade8
mov dword [esi + 4], eax
and dword [esi], 0
jmp 0x4bae20
mov edi, dword [esp + 4]
mov eax, dword [esp + 8]
mov dword [esp + 0xc], eax
mov al, byte [0x57eac8]
push 0x10
pop ecx
push 4
pop edx
call fcn.00415570
test eax, eax
je 0x4bae49
xor ecx, ecx
inc ecx
mov dword [eax], ecx
mov dword [eax + 4], ecx
mov dword [eax + 8], edi
mov ecx, dword [esp + 0xc]
mov dword [eax + 0xc], ecx
mov dword [esi + 4], eax
mov byte [esi], 4
test ebp, ebp
je 0x4bae32
push 4
pop edx
mov ecx, ebx
push dword [esp]
call fcn.00404f8c
pop eax
add esp, 0x48
pop esi
pop edi
pop ebx
pop ebp
ret
call fcn.004156f0
ud2
push 4
pop ecx
mov edx, dword [esp]
jmp 0x4bae4f
push 4
pop ecx
push 0x10
pop edx
call fcn.00506930
ud2

Function at 0x4baf88
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x360
mov dword [esp + 0x11c], edx
mov dword [esp + 0x114], ecx
call fcn.004bafaa
Function at 0x4c537e
Capabilities:
Set socket configuration

Disassembly:
push esi
mov esi, ecx
lea eax, [esp + 0xc]
push 4
push eax
push dword [esp + 0x10]
push 0xffff
push edx
call dword [sym.imp.ws2_32.dll_setsockopt]
cmp eax, 0xffffffff
je 0x4c53a2
mov byte [esi], 4
jmp 0x4c53ad
call sub.kernel32.dll_GetLastError
mov dword [esi + 4], eax
and dword [esi], 0
pop esi
ret

Function at 0x4c5458
Capabilities:
Create udp socket

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x20
mov esi, ecx
mov ebp, dword [esp + 0x34]
cmp dl, 4
jne 0x4c54d4
mov eax, dword [0x57ea44]
cmp eax, 3
jne 0x4c55da
cmp word [ebp], 0
push 2
pop eax
push 0x17
pop ebx
cmove ebx, eax
sub esp, 0x18
movaps xmm0, xmmword [0x50ccc0]
movups xmmword [esp + 4], xmm0
mov dword [esp], ebx
mov dword [esp + 0x14], 0x81
call dword [sym.imp.ws2_32.dll_WSASocketW]
mov edi, eax
cmp eax, 0xffffffff
je 0x4c54ef
cmp word [ebp], 0
je 0x4c5557
movups xmm0, xmmword [ebp + 4]
lea ecx, [ebp + 0x14]
mov eax, dword [ebp + 0x18]
mov dword [esp], eax
add ebp, 0x1c
push 0x1c
pop eax
mov bx, 0x17
jmp 0x4c5567
mov eax, edx
shr eax, 8
mov word [esi + 1], ax
mov eax, edx
shr eax, 0x18
mov byte [esi + 3], al
mov byte [esi], dl
mov dword [esi + 4], ebp
jmp 0x4c55d2
call dword [sym.imp.ws2_32.dll_WSAGetLastError]
cmp eax, 0x2739
je 0x4c5507
cmp eax, 0x2726
jne 0x4c55c3
sub esp, 0x18
movaps xmm0, xmmword [0x50ccc0]
movups xmmword [esp + 4], xmm0
mov dword [esp], ebx
mov dword [esp + 0x14], 1
call dword [sym.imp.ws2_32.dll_WSASocketW]
cmp eax, 0xffffffff
je 0x4c55bd
mov edi, eax
push 0
push 1
push eax
call dword [sym.imp.kernel32.dll_SetHandleInformation]
test eax, eax
jne 0x4c54ad
call sub.kernel32.dll_GetLastError
mov ebx, eax
push edi
call dword [sym.imp.ws2_32.dll_closesocket]
mov eax, ebx
jmp 0x4c55c3
lea ecx, [ebp + 2]
add ebp, 6
push 0x10
pop eax
mov bx, 2
xorps xmm0, xmm0
movzx ebp, word [ebp]
rol bp, 8
mov ecx, dword [ecx]
lea edx, [esp + 4]
mov word [edx], bx
mov word [edx + 2], bp
mov dword [edx + 4], ecx
movups xmmword [edx + 8], xmm0
mov ecx, dword [esp]
mov dword [edx + 0x18], ecx
push eax
push edx
push edi
call dword [sym.imp.ws2_32.dll_bind]
cmp eax, 0xffffffff
je 0x4c559f
mov dword [esi + 4], edi
mov byte [esi], 4
jmp 0x4c55d2
call dword [sym.imp.ws2_32.dll_WSAGetLastError]
xor ecx, ecx
mov byte [esi], cl
mov byte [esi + 3], cl
and word [esi + 1], 0
mov dword [esi + 4], eax
push edi
call dword [sym.imp.ws2_32.dll_closesocket]
jmp 0x4c55d2
call dword [sym.imp.ws2_32.dll_WSAGetLastError]
and word [esi + 1], 0
xor ecx, ecx
mov byte [esi + 3], cl
mov byte [esi], cl
mov dword [esi + 4], eax
add esp, 0x20
pop esi
pop edi
pop ebx
pop ebp
ret
call fcn.0050ac30
jmp 0x4c5478
Function at 0x4c5690
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x14
mov dword [ebp - 0x1c], esp
mov dword [ebp - 0x10], 0xffffffff
mov dword [ebp - 0x14], 0x4f6a10
lea eax, [ebp - 0x18]
mov ecx, dword fs:[0]
mov dword [ebp - 0x18], ecx
mov dword fs:[0], eax
movzx eax, byte [0x57ea58]
test al, al
je 0x4c5861
mov eax, dword [ebp + 0xc]
test eax, eax
je 0x4c56dc
cmp eax, 3
jne 0x4c585a
mov ebx, dword [0x57ea5c]
test ebx, ebx
je 0x4c585a
mov dword [ebp - 0x20], 0
jmp 0x4c5707
mov ebx, dword [ebx + 8]
test ebx, ebx
je 0x4c5738
mov esi, dword [ebx]
mov edi, dword [ebx + 4]
test edi, edi
je 0x4c58ab
dec esi
push esi
call dword [sym.imp.kernel32.dll_TlsGetValue]
test eax, eax
je 0x4c5700
push 0
push esi
mov esi, eax
call dword [sym.imp.kernel32.dll_TlsSetValue]
push esi
call edi
add esp, 4
mov al, 1
mov dword [ebp - 0x20], eax
jmp 0x4c5700
test byte [ebp - 0x20], 1
je 0x4c585a
mov ebx, dword [0x57ea5c]
test ebx, ebx
je 0x4c585a
mov dword [ebp - 0x20], 0
jmp 0x4c5767
mov ebx, dword [ebx + 8]
test ebx, ebx
je 0x4c5798
mov esi, dword [ebx]
mov edi, dword [ebx + 4]
test edi, edi
je 0x4c58ab
dec esi
push esi
call dword [sym.imp.kernel32.dll_TlsGetValue]
test eax, eax
je 0x4c5760
push 0
push esi
mov esi, eax
call dword [sym.imp.kernel32.dll_TlsSetValue]
push esi
call edi
add esp, 4
mov al, 1
mov dword [ebp - 0x20], eax
jmp 0x4c5760
test byte [ebp - 0x20], 1
je 0x4c585a
mov ebx, dword [0x57ea5c]
test ebx, ebx
je 0x4c585a
mov dword [ebp - 0x20], 0
jmp 0x4c57c7
mov ebx, dword [ebx + 8]
test ebx, ebx
je 0x4c57f8
mov esi, dword [ebx]
mov edi, dword [ebx + 4]
test edi, edi
je 0x4c58ab
dec esi
push esi
call dword [sym.imp.kernel32.dll_TlsGetValue]
test eax, eax
je 0x4c57c0
push 0
push esi
mov esi, eax
call dword [sym.imp.kernel32.dll_TlsSetValue]
push esi
call edi
add esp, 4
mov al, 1
mov dword [ebp - 0x20], eax
jmp 0x4c57c0
test byte [ebp - 0x20], 1
je 0x4c585a
mov ebx, dword [0x57ea5c]
test ebx, ebx
je 0x4c585a
mov dword [ebp - 0x20], 0
jmp 0x4c5827
mov ebx, dword [ebx + 8]
test ebx, ebx
je 0x4c5854
mov esi, dword [ebx]
mov edi, dword [ebx + 4]
test edi, edi
je 0x4c58ab
dec esi
push esi
call dword [sym.imp.kernel32.dll_TlsGetValue]
test eax, eax
je 0x4c5820
push 0
push esi
mov esi, eax
call dword [sym.imp.kernel32.dll_TlsSetValue]
push esi
call edi
add esp, 4
mov al, 1
mov dword [ebp - 0x20], eax
jmp 0x4c5820
test byte [ebp - 0x20], 1
jne 0x4c5874
movzx eax, byte [0x57a080]
mov eax, dword [ebp - 0x18]
mov dword fs:[0], eax
add esp, 0x14
pop esi
pop edi
pop ebx
pop ebp
ret 0xc
mov ebx, dword [0x57ea5c]
jmp 0x4c587f
mov ebx, dword [ebx + 8]
test ebx, ebx
je 0x4c585a
mov esi, dword [ebx]
mov edi, dword [ebx + 4]
test edi, edi
je 0x4c58ab
dec esi
push esi
call dword [sym.imp.kernel32.dll_TlsGetValue]
test eax, eax
je 0x4c587c
push 0
push esi
mov esi, eax
call dword [sym.imp.kernel32.dll_TlsSetValue]
push esi
call edi
add esp, 4
jmp 0x4c587c
mov dword [ebp - 0x10], 0
mov ecx, str.called__Option::unwrap____on_a__None__valueNoneSome
mov edx, 0x2b
push 0x549df0
call fcn.00506cd0
add esp, 4
ud2
Function at 0x4c6600
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push edi
push esi
mov eax, dword [0x57e080]
test eax, eax
je 0x4c66b8
dec eax
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
cmp eax, 2
jb 0x4c662c
cmp dword [eax + 4], 0
mov edi, eax
je 0x4c662c
add edi, 8
jmp 0x4c66b3
mov eax, dword [0x57e080]
test eax, eax
je 0x4c66c7
dec eax
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
cmp eax, 1
je 0x4c66b1
mov esi, eax
test eax, eax
jne 0x4c6687
movzx eax, byte [0x57eac8]
mov ecx, 0xc
mov edx, 4
call fcn.00415570
test eax, eax
je 0x4c66e2
mov dword [eax], 0x57e080
mov dword [eax + 4], 0
mov esi, eax
mov eax, dword [0x57e080]
test eax, eax
je 0x4c66d6
dec eax
push esi
push eax
call dword [sym.imp.kernel32.dll_TlsSetValue]
mov ecx, dword [esi + 8]
cmp dword [esi + 4], 0
lea edi, [esi + 8]
mov dword [esi + 4], 1
mov dword [esi + 8], 0
je 0x4c66b3
test ecx, ecx
je 0x4c66b3
lock dec dword [ecx]
jne 0x4c66b3
call fcn.004c6180
jmp 0x4c66b3
xor edi, edi
mov eax, edi
pop esi
pop edi
ret
mov ecx, 0x57e080
call fcn.0050a660
jmp 0x4c6610
mov ecx, 0x57e080
call fcn.0050a660
jmp 0x4c663a
mov ecx, 0x57e080
call fcn.0050a660
jmp 0x4c667f
mov ecx, 4
mov edx, 0xc
call fcn.00506930
ud2

Function at 0x4c6c10
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push esi
mov eax, dword [0x57e090]
test eax, eax
je 0x4c6c94
dec eax
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
cmp eax, 2
jb 0x4c6c2f
cmp byte [eax + 4], 0
mov esi, eax
jne 0x4c6c89
mov eax, dword [0x57e090]
test eax, eax
je 0x4c6ca3
dec eax
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
cmp eax, 1
je 0x4c6c8e
mov esi, eax
test eax, eax
jne 0x4c6c83
movzx eax, byte [0x57eac8]
mov ecx, 8
mov edx, 4
call fcn.00415570
test eax, eax
je 0x4c6cbb
mov dword [eax], 0x57e090
mov byte [eax + 4], 0
mov esi, eax
mov eax, dword [0x57e090]
test eax, eax
je 0x4c6caf
dec eax
push esi
push eax
call dword [sym.imp.kernel32.dll_TlsSetValue]
mov word [esi + 4], 1
add esi, 5
jmp 0x4c6c90
xor esi, esi
mov eax, esi
pop esi
ret
mov ecx, 0x57e090
call fcn.0050a660
jmp 0x4c6c1b
mov ecx, 0x57e090
call fcn.0050a660
jmp 0x4c6c39
mov ecx, 0x57e090
call fcn.0050a660
jmp 0x4c6c7b
mov ecx, 4
mov edx, 8
call fcn.00506930
ud2
Function at 0x4c7940
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push esi
mov eax, dword [0x57e070]
test eax, eax
je 0x4c79d8
dec eax
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
cmp eax, 2
jb 0x4c7966
cmp dword [eax + 4], 0
je 0x4c7966
add eax, 8
pop esi
ret
mov eax, dword [0x57e070]
test eax, eax
je 0x4c79e7
dec eax
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
cmp eax, 1
je 0x4c79d4
mov esi, eax
test eax, eax
jne 0x4c79bd
movzx eax, byte [0x57eac8]
mov ecx, 0x10
mov edx, 4
call fcn.00415570
test eax, eax
je 0x4c7a02
mov dword [eax], 0x57e070
mov dword [eax + 4], 0
mov esi, eax
mov eax, dword [0x57e070]
test eax, eax
je 0x4c79f6
dec eax
push esi
push eax
call dword [sym.imp.kernel32.dll_TlsSetValue]
mov dword [esi + 4], 1
mov dword [esi + 8], 0
lea eax, [esi + 8]
mov byte [esi + 0xc], 0
pop esi
ret
xor eax, eax
pop esi
ret
mov ecx, 0x57e070
call fcn.0050a660
jmp 0x4c794f
mov ecx, 0x57e070
call fcn.0050a660
jmp 0x4c7970
mov ecx, 0x57e070
call fcn.0050a660
jmp 0x4c79b5
mov ecx, 4
mov edx, 0x10
call fcn.00506930
ud2

Function at 0x4c8910
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x40
mov esi, esp
mov dword [esi + 0x28], ebp
mov dword [esi + 0x2c], esp
mov dword [esi + 0x38], 0xffffffff
mov dword [esi + 0x34], 0x4f6ba0
lea eax, [esi + 0x30]
mov ecx, dword fs:[0]
mov dword [esi + 0x30], ecx
mov dword fs:[0], eax
lea eax, [esi + 8]
mov dword [esi + 0xc], 0
mov dword [esi + 8], 0
push eax
call dword [sym.imp.kernel32.dll_QueryPerformanceCounter]
test eax, eax
je 0x4c8a28
mov eax, dword [esi + 8]
mov ebx, dword [esi + 0xc]
mov dword [esi], eax
call fcn.004c8cb0
mov ecx, eax
or ecx, edx
je 0x4c8a0f
push edx
push eax
push ebx
push dword [esi]
mov edi, edx
mov dword [esi + 0x20], edx
mov dword [esi + 0x1c], eax
call fcn.004f7220
mov ecx, edi
mov edi, dword [esi + 0x1c]
mov dword [esi + 4], edx
mov dword [esi + 0x24], eax
imul ecx, eax
mul edi
add edx, ecx
mov ecx, edi
imul ecx, dword [esi + 4]
add ecx, edx
mov edx, dword [esi]
sub edx, eax
sbb ebx, ecx
mov eax, edx
imul ecx, ebx, 0x3b9aca00
mov ebx, 0x3b9aca00
mul ebx
add edx, ecx
push dword [esi + 0x20]
push edi
push edx
push eax
call fcn.004f7220
mov ebx, eax
mov eax, dword [esi + 0x24]
mov ecx, edx
mov edx, 0x3b9aca00
mul edx
mov edi, eax
imul eax, dword [esi + 4], 0x3b9aca00
add eax, edx
add edi, ebx
adc eax, ecx
push 0
push 0x3b9aca00
push eax
push edi
call fcn.004f7220
imul ecx, eax, 0xc4653600
add ecx, edi
mov edi, dword [esi + 0x30]
mov dword fs:[0], edi
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
mov ecx, str.attempt_to_divide_by_zero_rustc_90e321d82a0a9c3d0e3f180d4d17541b729072e0librarycore_src_slicemod.rs
mov edx, 0x19
push 0x548f88
call fcn.00506cd0
add esp, 4
ud2
call sub.kernel32.dll_GetLastError
mov dword [esi + 0x18], eax
mov dword [esi + 0x14], 0
mov dword [esi + 0x38], 0
lea eax, [esi + 0x14]
mov ecx, str.called__Result::unwrap____on_an__Err__value
mov edx, 0x2b
push 0x549eec
push 0x547ac4
push eax
call fcn.00506fb0
add esp, 0xc
ud2
Function at 0x4ce640
Capabilities:
Read file on windows

Disassembly:
push edi
push esi
sub esp, 0x34
mov eax, dword [esp + 0x40]
mov esi, ecx
mov ecx, dword [esp + 0x44]
mov edi, edx
mov dword [esp + 8], 0
mov dword [esp + 4], 0x103
lea edx, [esp + 4]
push 0
push 0
push ecx
push eax
push edx
push 0
push 0
push 0
push edi
call dword [sym.imp.ntdll.dll_NtReadFile]
cmp eax, 0x103
jne 0x4ce68d
push 0xffffffffffffffff
push edi
call dword [sym.imp.kernel32.dll_WaitForSingleObject]
mov eax, dword [esp + 4]
cmp eax, 0xc0000011
jne 0x4ce69d
mov dword [esi + 4], 0
jmp 0x4ce6af
cmp eax, 0x103
je 0x4ce6c7
test eax, eax
js 0x4ce6b8
mov eax, dword [esp + 8]
mov dword [esi + 4], eax
mov byte [esi], 4
add esp, 0x34
pop esi
pop edi
ret
push eax
call dword [sym.imp.ntdll.dll_RtlNtStatusToDosError]
mov byte [esi], 0
mov dword [esi + 4], eax
jmp 0x4ce6b2
mov eax, esp
mov dword [esp + 0x1c], 0x5496b0
mov dword [esp + 0x20], 1
mov dword [esp + 0x2c], 0
mov dword [esp + 0xc], 0
mov byte [esp + 0x10], 0
lea ecx, [esp + 0xc]
lea edx, [esp + 0x14]
mov dword [esp + 0x24], eax
lea eax, [esp + 0x1c]
mov dword [esp + 0x28], 0
push eax
push ecx
push edx
call fcn.004c5c90
add esp, 0xc
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x18]
call fcn.004c5dc0
mov ecx, 7
int 0x29
ud2

Function at 0x4d2280
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push edi
push esi
mov eax, dword [0x57e0a0]
test eax, eax
je 0x4d2338
dec eax
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
cmp eax, 2
jb 0x4d22ac
cmp dword [eax + 4], 0
mov edi, eax
je 0x4d22ac
add edi, 8
jmp 0x4d2333
mov eax, dword [0x57e0a0]
test eax, eax
je 0x4d2347
dec eax
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
cmp eax, 1
je 0x4d2331
mov esi, eax
test eax, eax
jne 0x4d2307
movzx eax, byte [0x57eac8]
mov ecx, 0xc
mov edx, 4
call fcn.00415570
test eax, eax
je 0x4d2362
mov dword [eax], 0x57e0a0
mov dword [eax + 4], 0
mov esi, eax
mov eax, dword [0x57e0a0]
test eax, eax
je 0x4d2356
dec eax
push esi
push eax
call dword [sym.imp.kernel32.dll_TlsSetValue]
mov ecx, dword [esi + 8]
cmp dword [esi + 4], 0
lea edi, [esi + 8]
mov dword [esi + 4], 1
mov dword [esi + 8], 0
je 0x4d2333
test ecx, ecx
je 0x4d2333
lock dec dword [ecx]
jne 0x4d2333
call fcn.004d2380
jmp 0x4d2333
xor edi, edi
mov eax, edi
pop esi
pop edi
ret
mov ecx, 0x57e0a0
call fcn.0050a660
jmp 0x4d2290
mov ecx, 0x57e0a0
call fcn.0050a660
jmp 0x4d22ba
mov ecx, 0x57e0a0
call fcn.0050a660
jmp 0x4d22ff
mov ecx, 4
mov edx, 0xc
call fcn.00506930
ud2
Function at 0x4d2d90
Capabilities:
Resolve dns

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x1a8
mov edi, dword [edx]
mov ebp, dword [edx + 4]
movzx ebx, word [edx + 8]
mov eax, dword [0x57ea44]
mov esi, ecx
cmp eax, 3
jne 0x4d2f1b
cmp ebp, 0x17f
ja 0x4d2f2c
lea eax, [esp + 0x28]
push ebp
push edi
mov edi, eax
push eax
call fcn.004f7e80
add esp, 0xc
lea eax, [ebp + 1]
cmp ebp, 6
mov byte [esp + ebp + 0x28], 0
ja 0x4d2df5
xor edx, edx
nop
cmp byte [esp + edx + 0x28], 0
je 0x4d2e8f
inc edx
cmp eax, edx
jne 0x4d2de0
jmp 0x4d2ee5
lea ecx, [esp + 0x2b]
and ecx, 0xfffffffc
sub ecx, edi
je 0x4d2e28
je 0x4d2e28
xor edx, edx
nop word cs:[eax + eax]
nop
cmp byte [esp + edx + 0x28], 0
je 0x4d2e8f
inc edx
cmp ecx, edx
jne 0x4d2e10
lea edx, [ebp - 7]
mov dword [esp], ebx
cmp ecx, edx
jbe 0x4d2e30
jmp 0x4d2e6b
mov dword [esp], ebx
lea edx, [ebp - 7]
xor ecx, ecx
movdqa xmm0, xmmword [0x50c660]
movdqa xmm1, xmmword [0x50c550]
movq xmm2, qword [esp + ecx + 0x28]
movdqa xmm3, xmm2
paddd xmm3, xmm0
pandn xmm2, xmm3
pand xmm2, xmm1
pextrd edi, xmm2, 1
movd ebx, xmm2
or ebx, edi
jne 0x4d2e6b
add ecx, 8
cmp ecx, edx
jbe 0x4d2e40
mov ebx, dword [esp]
sub eax, ecx
je 0x4d2ee5
lea edi, [esp + ecx + 0x28]
xor edx, edx
nop dword [eax + eax]
cmp byte [edi + edx], 0
je 0x4d2e8d
inc edx
cmp eax, edx
jne 0x4d2e80
jmp 0x4d2ee5
add edx, ecx
cmp edx, ebp
jne 0x4d2ee5
pxor xmm0, xmm0
lea eax, [esp + 4]
mov dword [esp + 4], 0
lea ecx, [esp + 8]
movdqu xmmword [esp + 8], xmm0
movdqu xmmword [esp + 0x18], xmm0
mov dword [esp + 0x10], 1
push eax
push ecx
push 0
lea eax, [esp + 0x34]
push eax
call dword [sym.imp.ws2_32.dll_getaddrinfo]
test eax, eax
je 0x4d2efe
call dword [sym.imp.ws2_32.dll_WSAGetLastError]
mov dword [esi + 8], eax
mov dword [esi + 4], 0
mov eax, 1
jmp 0x4d2f0e
mov eax, dword [0x548d20]
mov ecx, dword [0x548d24]
mov dword [esi + 8], ecx
mov dword [esi + 4], eax
mov dword [esi], 1
jmp 0x4d2f10
mov eax, dword [esp + 4]
mov dword [esi + 4], eax
mov dword [esi + 8], eax
xor eax, eax
mov word [esi + 0xc], bx
mov dword [esi], eax
add esp, 0x1a8
pop esi
pop edi
pop ebx
pop ebp
ret
call fcn.0050ac30
cmp ebp, 0x17f
jbe 0x4d2dbf
mov ecx, esi
mov edx, edi
push ebx
push ebp
call fcn.0050ac80
add esp, 0x1b0
jmp 0x4d2f16