joyce8/EMBER2024-capa huggingface dataset:
Function at 0x434751
Capabilities:
Get common file path

Disassembly:
push ebp
mov edx, dword [esp + 0xc]
mov ebp, esp
sub esp, 0x104
test edx, edx
push esi
push edi
je 0x4347ad
mov edi, dword [ebp + 8]
mov ecx, 0xffffffff
sub eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
shr ecx, 2
mov esi, edi
lea edi, [ebp - 0x104]
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
cmp byte [ebp + edx - 0x105], 0x5c
je 0x4347b4
mov esi, 0x42f4f0
lea edi, [ebp - 0x104]
mov ecx, 0xffffffff
sub eax, eax
repne scasb al, byte es:[edi]
dec edi
movsw word es:[edi], word [esi]
jmp 0x4347b4
mov byte [ebp - 0x104], 0
push dword [ebp + 8]
push 0
push 0x42f4f4
lea ecx, [ebp - 0x104]
push ecx
call dword [sym.imp.KERNEL32.DLL_GetTempFileNameA]
test eax, eax
mov eax, 0
je 0x4347e6
push 0x10
push 0x42f4f8
push dword [ebp + 8]
call fcn.00432aab
add esp, 0xc
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x4347ec
Capabilities:
Delete file
Get common file path
Query environment variable

Disassembly:
push ebp
mov eax, 0x4220
mov ebp, esp
call fcn.00434e70
push esi
push edi
mov esi, str.SHRINK35.LDR
push esi
call fcn.004346f3
add esp, 4
mov dword [0x42f4d0], eax
cmp eax, 0xffffffff
jne 0x43494c
mov byte [0x42f4e0], 0
push esi
call fcn.004346f3
add esp, 4
mov dword [0x42f4d0], eax
cmp eax, 0xffffffff
jne 0x43494c
mov edi, 0x104
lea eax, [ebp - 0x11c]
push edi
push eax
call dword [sym.imp.KERNEL32.DLL_GetWindowsDirectoryA]
push eax
lea ecx, [ebp - 0x11c]
push ecx
call fcn.00434751
add esp, 8
mov esi, eax
test esi, esi
jne 0x4348d4
push edi
lea eax, [ebp - 0x220]
push eax
lea edi, [ebp - 0x220]
push str.PATH
call dword [sym.imp.KERNEL32.DLL_GetEnvironmentVariableA]
mov al, byte [edi]
test al, al
je 0x4348c1
xor ecx, ecx
inc edi
mov byte [ebp - 0x11c], al
cmp al, cl
je 0x4348a3
cmp byte [ebp + ecx - 0x11c], 0x3b
je 0x4348a3
inc ecx
mov al, byte [edi]
inc edi
mov byte [ebp + ecx - 0x11c], al
test al, al
jne 0x43488a
push ecx
lea eax, [ebp - 0x11c]
mov byte [ebp + ecx - 0x11c], 0
push eax
call fcn.00434751
add esp, 8
mov esi, eax
test esi, esi
je 0x434877
test esi, esi
jne 0x4348d4
push 0xc
push 0x42f504
call fcn.004333af
add esp, 8
push 0x10d2
lea eax, [ebp - 0x4220]
push eax
push 0x42e3fc
call fcn.00432a8b
add esp, 0xc
test eax, eax
jne 0x4348fd
push 2
push 0
call fcn.004333af
add esp, 8
lea edi, [ebp - 0x41e0]
xor eax, eax
mov ecx, 0x10
rep stosd dword es:[edi], eax
push esi
mov eax, dword [0x42e3f8]
push eax
lea ecx, [ebp - 0x4220]
push ecx
call fcn.00432afe
add esp, 0xc
push esi
call fcn.00432a9e
add esp, 4
lea ecx, [ebp - 0x11c]
push ecx
call fcn.004346f3
add esp, 4
mov dword [0x42f4d0], eax
lea eax, [ebp - 0x11c]
push eax
call dword [sym.imp.KERNEL32.DLL_DeleteFileA]
cmp dword [0x42f4d0], 0xffffffff
jne 0x434961
push 0xc
push 0x42f508
jmp 0x434a0e
xor esi, esi
lea eax, [ebp - 8]
push esi
lea ecx, [ebp - 0x18]
push eax
push 0x10
push ecx
push esi
push esi
push 1
push dword [0x42f4d0]
call dword [sym.imp.KERNEL32.DLL_DeviceIoControl]
test eax, eax
je 0x434a07
cmp dword [ebp - 0x18], 0x332
jne 0x4349fe
mov eax, dword [ebp + 8]
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp + 0x10]
push esi
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], ecx
mov eax, dword [ebp + 0x14]
lea ecx, [ebp - 8]
push ecx
mov dword [ebp - 0x10], edx
push 4
lea edx, [ebp - 4]
push edx
mov dword [ebp - 0xc], eax
push 0x10
lea eax, [ebp - 0x18]
push eax
push 2
push dword [0x42f4d0]
call dword [sym.imp.KERNEL32.DLL_DeviceIoControl]
test eax, eax
je 0x4349d4
mov eax, dword [ebp - 4]
mov dword [0x42f4d4], eax
jmp 0x434a16
call dword [sym.imp.KERNEL32.DLL_GetLastError]
cmp eax, 0x76
je 0x4349ed
cmp eax, 0x77
je 0x4349ed
push 0xc
push 0x42f534
jmp 0x434a0e
push 0
call dword [sym.imp.KERNEL32.DLL_SetLastError]
push 1
push str.___please_restart_your_system_and_retry
jmp 0x434a0e
push 0xc
push 0x42f538
jmp 0x434a0e
push 0xc
push 0x42f53c
call fcn.004333af
add esp, 8
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x10001510
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
cmp ecx, eax
ja 0x10001520
mov eax, edx
mov edx, ecx
pop ebp
ret
mov edx, eax
push dword [ebp + 0xc]
call dbg.slice_end_index_len_fail

Function at 0x1000152a
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
cmp ecx, eax
ja 0x1000153a
mov eax, edx
mov edx, ecx
pop ebp
ret
mov edx, eax
push dword [ebp + 0xc]
call dbg.slice_end_index_len_fail
Function at 0x10006a81
Capabilities:
Get geographical location
Get hostname
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
pop ebp
jmp sym.legitdll::runs::ha7b78eeb6f6efced
Function at 0x1000ebda
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
push ebp
mov ebp, esp
aeskeygenassist xmm0, xmmword [edx], 2
movdqa xmmword [ecx], xmm0
pop ebp
ret
Function at 0x1001378e
Capabilities:
Copy file

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x30
mov edi, ecx
lea ebx, [esp + 8]
mov ecx, ebx
push dword [ebp + 8]
call dbg.inner
pop eax
mov ecx, dword [ebx]
mov esi, dword [ebx + 4]
mov eax, dword [ebx + 8]
cmp ecx, 0x80000000
je 0x100137e2
lea edx, [esp + 8]
mov dword [edx], ecx
mov dword [edx + 4], esi
mov dword [edx + 8], eax
lea esi, [esp + 0x20]
mov ecx, esi
call dbg.get_long_path
mov eax, dword [esi]
mov esi, dword [esi + 4]
cmp eax, 0x80000000
jne 0x100137f6
mov eax, dword [esp + 0x28]
mov dword [edi + 8], eax
mov dword [edi + 4], esi
mov dword [edi], 1
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
mov edx, dword [ebp + 0xc]
mov dword [esp + 4], eax
lea ecx, [esp + 8]
push dword [ebp + 0x10]
call dbg.inner
pop eax
mov ecx, dword [esp + 8]
mov ebx, dword [esp + 0xc]
mov eax, dword [esp + 0x10]
cmp ecx, 0x80000000
je 0x10013846
lea edx, [esp + 8]
mov dword [edx], ecx
mov dword [edx + 4], ebx
mov dword [edx + 8], eax
lea ecx, [esp + 0x20]
call dbg.get_long_path
mov eax, dword [esp + 0x20]
mov ebx, dword [esp + 0x24]
cmp eax, 0x80000000
jne 0x10013866
mov eax, dword [esp + 0x28]
mov dword [edi + 8], eax
mov dword [edi + 4], ebx
mov dword [edi], 1
mov edi, dword [esp + 4]
test edi, edi
je 0x100137ee
push 2
pop edx
mov ecx, esi
call sym.___rust_dealloc
jmp 0x100137ee
and dword [esp + 0xc], 0
and dword [esp + 8], 0
mov dword [esp + 0x1c], eax
push 0
push 0
lea eax, [esp + 0x10]
push eax
push dbg.callback
mov dword [esp + 0x28], ebx
push ebx
push esi
call sub.kernel32.dll_CopyFileExW
test eax, eax
je 0x100138c3
mov eax, dword [esp + 8]
mov ecx, dword [esp + 0xc]
mov dword [edi + 8], eax
mov dword [edi + 0xc], ecx
and dword [edi], 0
cmp dword [esp + 0x1c], 0
mov edi, dword [esp + 4]
je 0x100138b9
push 2
pop edx
mov ecx, dword [esp + 0x18]
call sym.___rust_dealloc
test edi, edi
je 0x100137ee
jmp 0x1001385a
call sub.kernel32.dll_GetLastError
mov byte [edi + 4], 0
mov dword [edi + 8], eax
mov dword [edi], 1
cmp dword [esp + 0x1c], 0
mov edi, dword [esp + 4]
je 0x10013856
push 2
pop edx
mov ecx, dword [esp + 0x18]
call sym.___rust_dealloc
jmp 0x10013856
Function at 0x100157db
Capabilities:
Encrypt data using dpapi

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x14
mov edi, edx
mov ebx, ecx
mov edx, dword [edx + 4]
lea esi, [ebp - 0x20]
lea eax, [ebp - 0x18]
mov ecx, dword [edi + 8]
and dword [esi], 0
and dword [esi + 4], 0
mov dword [ebp - 0x10], edx
mov dword [eax], ecx
mov dword [eax + 4], edx
push esi
push 0
push 0
push 0
push 0
push 0
push eax
call sub.crypt32.dll_CryptUnprotectData
mov eax, dword [esi]
mov ecx, dword [esi + 4]
mov edx, dword [ebp - 0x10]
mov dword [ebx], eax
mov dword [ebx + 4], ecx
mov ecx, dword [edi]
mov dword [ebx + 8], eax
call sym.__LT_alloc..raw_vec..RawVec_LT_T_C_A_GT__u20_as_u20_core..ops..drop..Drop_GT_::drop::h1e3cb15a61af7b6e
add esp, 0x14
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x1001efe0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
push eax
mov eax, dword [ebp + 8]
mov ebx, dword [ebp + 0x14]
xor esi, esi
lea eax, [edx + eax*2]
mov dword [ebp - 0x10], eax
movzx eax, byte [edx + 1]
cmp byte [edx], ch
lea edx, [edx + 2]
lea edi, [esi + eax]
jne 0x1001f030
cmp esi, edi
ja 0x1001f09b
cmp edi, dword [ebp + 0x10]
ja 0x1001f0a9
add esi, dword [ebp + 0xc]
nop word [eax + eax]
test eax, eax
je 0x1001f032
dec eax
cmp byte [esi], cl
lea esi, [esi + 1]
jne 0x1001f020
jmp 0x1001f08f
ja 0x1001f039
cmp edx, dword [ebp - 0x10]
mov esi, edi
jne 0x1001eff5
mov edi, dword [ebp + 0x18]
movzx ecx, cx
mov al, 1
add edi, ebx
nop word cs:[eax + eax]
nop dword [eax]
movzx edx, byte [ebx]
lea esi, [ebx + 1]
test dl, dl
js 0x1001f070
mov ebx, esi
sub ecx, edx
jns 0x1001f087
jmp 0x1001f091
cmp esi, edi
je 0x1001f0b8
movzx esi, byte [ebx + 1]
and edx, 0x7f
add ebx, 2
shl edx, 8
or edx, esi
sub ecx, edx
js 0x1001f091
xor al, 1
cmp ebx, edi
jne 0x1001f050
jmp 0x1001f091
xor eax, eax
and al, 1
add esp, 4
pop esi
pop edi
pop ebx
pop ebp
ret
mov ecx, esi
mov edx, edi
push 0x1016b37c
call dbg.slice_index_order_fail
mov edx, dword [ebp + 0x10]
mov ecx, edi
push 0x1016b37c
call dbg.slice_end_index_len_fail
mov ecx, str.called__Option::unwrap____on_a__None__value
mov edx, 0x2b
push 0x1016b36c
call dbg.panic
nop dword [eax]
Function at 0x10020dd0
Capabilities:
Decompress data using quicklz
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x14
mov esi, dword [ebp + 8]
mov edi, edx
mov ebx, ecx
mov eax, dword [esi + 4]
test eax, eax
je 0x10020dfd
push eax
push dword [esi]
push ebx
call dword [edi + 0xc]
add esp, 0xc
mov ecx, eax
mov al, 1
test cl, cl
jne 0x10020f62
mov eax, dword [esi + 0xc]
test eax, eax
je 0x10020f60
mov dword [ebp - 0x10], ebx
mov ebx, dword [esi + 8]
lea eax, [eax + eax*2]
mov dword [ebp - 0x1c], edi
lea eax, [ebx + eax*4]
mov dword [ebp - 0x20], eax
jmp 0x10020e43
push dword [ebx + 8]
push dword [ebx + 4]
push dword [ebp - 0x10]
call dword [edi + 0xc]
add esp, 0xc
test al, al
jne 0x10020f5c
add ebx, 0xc
cmp ebx, dword [ebp - 0x20]
je 0x10020f60
movzx eax, word [ebx]
test eax, eax
je 0x10020ea0
cmp eax, 1
jne 0x10020e20
movzx eax, word [ebx + 2]
mov byte [ebp - 0x14], 0
mov dword [ebp - 0x18], 0
movzx ecx, word [ebx]
test ecx, ecx
je 0x10020ef7
cmp ecx, 1
jne 0x10020efc
movzx edx, word [ebx + 2]
cmp edx, 0x3e8
jae 0x10020f0e
mov ecx, 1
cmp dx, 0xa
jb 0x10020f1f
cmp dx, 0x64
mov ecx, 3
jmp 0x10020f1c
mov esi, dword [ebx + 4]
cmp esi, 0x41
jb 0x10020ed1
mov edi, dword [edi + 0xc]
nop dword [eax + eax]
push 0x40
push str.0000000000000000000000000000000000000000000000000000000000000000
push dword [ebp - 0x10]
call edi
add esp, 0xc
test al, al
jne 0x10020f5c
add esi, 0xffffffc0
cmp esi, 0x40
ja 0x10020eb0
jmp 0x10020edc
test esi, esi
je 0x10020e37
mov edi, dword [edi + 0xc]
push esi
push str.0000000000000000000000000000000000000000000000000000000000000000
push dword [ebp - 0x10]
call edi
add esp, 0xc
mov edi, dword [ebp - 0x1c]
test al, al
je 0x10020e37
jmp 0x10020f5c
lea ecx, [ebx + 4]
jmp 0x10020eff
lea ecx, [ebx + 8]
mov ecx, dword [ecx]
cmp ecx, 6
jae 0x10020f6a
test ecx, ecx
jne 0x10020f1f
xor ecx, ecx
jmp 0x10020f52
movzx ecx, dx
cmp ecx, 0x2710
mov ecx, 5
sbb ecx, 0
mov edx, ecx
nop word cs:[eax + eax]
nop dword [eax + eax]
movzx esi, ax
imul esi, esi, 0xcccd
shr esi, 0x13
lea edi, [esi + esi]
lea edi, [edi + edi*4]
sub eax, edi
or al, 0x30
mov byte [ebp + edx - 0x19], al
dec edx
mov eax, esi
jne 0x10020f30
mov edi, dword [ebp - 0x1c]
push ecx
lea eax, [ebp - 0x18]
push eax
jmp 0x10020e26
mov al, 1
jmp 0x10020f62
xor eax, eax
add esp, 0x14
pop esi
pop edi
pop ebx
pop ebp
ret
mov edx, 5
push 0x1016af98
call dbg.slice_end_index_len_fail
nop dword [eax]
Function at 0x10022aab
Capabilities:
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 8
mov eax, edx
mov edx, dword [ebp + 8]
mov ebx, ecx
not ebx
cmp edx, 0x40
jb 0x10022bdd
push 4
pop ecx
sub ecx, 1
jb 0x10022abd
cmp edx, 0xf
jbe 0x10022bed
movzx esi, byte [eax + 0xe]
movzx edi, byte [eax + 0xf]
mov dword [ebp - 0x14], ecx
mov ecx, ebx
mov dword [ebp - 0x10], edx
mov edx, 0xff
shr ecx, 0x18
mov esi, dword [esi*4 + 0x1016edec]
xor esi, dword [edi*4 + 0x1016e9ec]
movzx edi, byte [eax + 0xd]
xor esi, dword [edi*4 + 0x1016f1ec]
movzx edi, byte [eax + 0xc]
xor esi, dword [edi*4 + 0x1016f5ec]
movzx edi, byte [eax + 0xb]
xor esi, dword [edi*4 + 0x1016f9ec]
movzx edi, byte [eax + 0xa]
xor esi, dword [edi*4 + 0x1016fdec]
movzx edi, byte [eax + 9]
xor esi, dword [edi*4 + 0x101701ec]
movzx edi, byte [eax + 8]
xor esi, dword [edi*4 + 0x101705ec]
movzx edi, byte [eax + 7]
xor esi, dword [edi*4 + 0x101709ec]
movzx edi, byte [eax + 6]
xor esi, dword [edi*4 + 0x10170dec]
movzx edi, byte [eax + 5]
xor esi, dword [edi*4 + 0x101711ec]
movzx edi, byte [eax + 4]
xor esi, dword [edi*4 + 0x101715ec]
movzx edi, byte [eax + 3]
xor ecx, edi
mov edi, ebx
xor esi, dword [ecx*4 + 0x101719ec]
movzx ecx, byte [eax + 2]
shr edi, 0x10
and edi, edx
xor edi, ecx
movzx ecx, byte [eax + 1]
xor esi, dword [edi*4 + 0x10171dec]
mov edi, ebx
and ebx, edx
shr edi, 8
and edi, edx
mov edx, dword [ebp - 0x10]
xor edi, ecx
movzx ecx, byte [eax]
xor esi, dword [edi*4 + 0x101721ec]
xor ebx, ecx
mov ecx, eax
xor esi, dword [ebx*4 + 0x101725ec]
push 0x1016e9dc
call sym.core::slice::index::__LT_impl_u20_core..ops..index..Index_LT_I_GT__u20_for_u20__u5b_T_u5d__GT_::index::h7b9aedf2d1882c5e
mov ecx, dword [ebp - 0x14]
add esp, 4
mov ebx, esi
jmp 0x10022ac9
mov cl, byte [eax]
inc eax
dec edx
xor cl, bl
shr ebx, 8
movzx esi, cl
xor ebx, dword [esi*4 + 0x1016e9ec]
test edx, edx
jne 0x10022bca
not ebx
mov eax, ebx
add esp, 8
pop esi
pop edi
pop ebx
pop ebp
ret
push 0xf
pop ecx
push 0x1016e9cc
call dbg.panic_bounds_check

Function at 0x100238f8
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
sub esp, 0x40c
mov eax, dword [ebp + 8]
mov eax, dword [eax]
mov edi, dword [eax]
and dword [eax], 0
test edi, edi
je 0x1002395f
lea ecx, [ebp - 0x414]
and dword [ecx + 0x408], 0
call sym.__LT_T_u20_as_u20_crossbeam_epoch..atomic..Pointable_GT_::init::hada4ab735cd70f8c
mov esi, eax
push 0x40
pop edx
mov ecx, 0x140
call sym.__ZN5alloc5alloc15exchange_malloc17hb61fce2610a36b72E.233
xor ecx, ecx
inc ecx
mov dword [eax], ecx
mov dword [eax + 4], ecx
mov dword [eax + 0x40], esi
mov dword [eax + 0x80], esi
and dword [eax + 0xc0], 0
and dword [eax + 0x100], 0
mov ecx, dword [edi]
mov dword [ecx], eax
add esp, 0x40c
pop esi
pop edi
pop ebp
ret
push 0x2b
pop edx
mov ecx, str.called__Option::unwrap____on_a__None__value
push 0x101c0984
call dbg.panic
Function at 0x1004968e
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x30
mov al, byte [edx + 0x44]
mov esi, edx
mov ebx, ecx
add al, 0xfc
movzx ecx, al
cmp al, 3
push 3
pop eax
cmovb eax, ecx
movzx eax, al
lea ecx, [eax - 2]
cmp ecx, 2
jb 0x10049771
test eax, eax
jne 0x1004977b
cmp dword [esi], 0
mov edx, 0
je 0x100496d7
mov eax, dword [esi + 4]
mov edx, dword [eax]
and edx, 0xe
lea eax, [esi + 0x44]
mov ecx, esi
mov dword [esp + 4], eax
call sym.mio::sys::windows::selector::ReadyBinding::set_readiness::hedd3f1156366d05c
mov edi, dword [ebx]
lea eax, [esp + 0x24]
lea edx, [esp + 0x20]
lea ebx, [esp + 0x10]
and dword [eax], 0
and dword [edx], 0
and dword [ebx], 0
mov dword [eax + 4], str._rustc_07dca489ac2d933c78d3c5158e3f43beefeb02celibrarycore_srccharmethods.rs_
lea ecx, [edi + 4]
push 0
push ecx
push edx
push ebx
push 1
push eax
push dword [edi]
call sub.ws2_32.dll_WSARecv
lea ebx, [esp + 0x14]
mov edx, eax
lea eax, [esp + 0x10]
mov ecx, ebx
push dword [eax]
call sym.miow::net::cvt::h2ae29aeb36858e3d
pop eax
xor eax, eax
cmp dword [ebx], eax
je 0x10049751
movsd xmm0, qword [esp + 0x18]
mov ecx, dword [esp + 4]
movsd qword [esp + 8], xmm0
call sym.core::ptr::drop_in_place_LT_mio..sys..windows..tcp..State_LT__LP__RP__C__LP__RP__GT__GT_::h4549fabdd0ace8b4
movsd xmm0, qword [esp + 8]
movsd qword [esi + 0x44], xmm0
jmp 0x10049771
mov ecx, dword [esp + 4]
mov dword [esp + 8], edi
mov edi, dword [esp + 0x18]
mov bl, byte [esi + 0x4c]
call sym.core::ptr::drop_in_place_LT_mio..sys..windows..tcp..State_LT__LP__RP__C__LP__RP__GT__GT_::h4549fabdd0ace8b4
test edi, edi
je 0x10049783
test bl, bl
je 0x10049783
mov byte [esi + 0x44], 6
xor edx, edx
mov ecx, esi
inc edx
call sym.mio::sys::windows::tcp::StreamImp::add_readiness::h204b373554df6489
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
mov eax, dword [esp + 4]
mov ecx, dword [esp + 8]
mov byte [eax], 5
lock inc dword [ecx + 0x8c]
jmp 0x1004977b
Function at 0x100499d4
Capabilities:
Send data
Send data on socket
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x40
mov eax, dword [ebp + 8]
mov eax, dword [eax + 4]
lea ecx, [eax - 4]
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x24], ecx
call sym.mio::sys::windows::tcp::StreamImp::inner::h14fba629ba0eb93b
mov ebx, dword [eax + 0x4c]
mov edi, dword [eax + 0x50]
mov esi, eax
mov dword [ebp - 0x2c], edi
mov dword [ebp - 0x30], ebx
and dword [eax + 0x50], 0
mov eax, ebx
add al, 0xfc
movzx ecx, al
cmp al, 3
push 3
pop eax
cmovb eax, ecx
lea ecx, [esi + 8]
mov dword [esi + 0x4c], 4
mov dword [ebp - 0x14], ecx
cmp al, 1
lea ecx, [esi + 0x4c]
jne 0x10049a62
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0xc]
test eax, eax
mov dword [ebp - 0x34], eax
jne 0x10049b19
mov ebx, edx
call sym.core::ptr::drop_in_place_LT_mio..sys..windows..tcp..State_LT__LP__RP__C__LP__RP__GT__GT_::h4549fabdd0ace8b4
mov ecx, dword [ebp - 0x14]
xor edx, edx
mov byte [esi + 0x4c], 6
inc edx
call sym.mio::sys::windows::tcp::StreamImp::add_readiness::h204b373554df6489
lea ecx, [ebp - 0x30]
call sym.core::ptr::drop_in_place_LT_mio..sys..windows..tcp..State_LT__LP__RP__C__LP__RP__GT__GT_::h4549fabdd0ace8b4
movzx edx, bl
mov ecx, esi
jmp 0x10049b04
mov dword [ebp - 0x20], esi
mov byte [ebp - 0xd], dl
mov esi, ecx
call sym.core::ptr::drop_in_place_LT_mio..sys..windows..tcp..State_LT__LP__RP__C__LP__RP__GT__GT_::h4549fabdd0ace8b4
mov dword [esi + 4], edi
mov dword [ebp - 0x1c], esi
mov dword [esi], ebx
mov esi, dword [ebp - 0x28]
lea ecx, [ebp - 0x30]
lea edx, [ebp - 0x4c]
mov eax, dword [esi - 4]
and dword [ecx], 0
and dword [edx], 0
push edx
push 0
push ecx
push esi
push eax
call sub.ws2_32.dll_WSAGetOverlappedResult
test eax, eax
je 0x10049ab4
push 0
push 0
push 0x7010
push 0xffff
mov eax, dword [ebp - 0x24]
push dword [eax]
call sub.ws2_32.dll_setsockopt
test eax, eax
je 0x10049ae6
call sub.kernel32.dll_GetLastError
mov edi, eax
mov ebx, eax
shr ebx, 8
shl edi, 0x18
shld ebx, edi, 8
shl edi, 8
push 3
pop edx
mov ecx, dword [ebp - 0x14]
call sym.mio::sys::windows::tcp::StreamImp::add_readiness::h204b373554df6489
mov esi, dword [ebp - 0x1c]
mov ecx, esi
call sym.core::ptr::drop_in_place_LT_mio..sys..windows..tcp..State_LT__LP__RP__C__LP__RP__GT__GT_::h4549fabdd0ace8b4
mov dword [esi + 4], ebx
mov dword [esi], edi
jmp 0x10049afd
push 2
pop edx
mov edi, dword [ebp - 0x14]
mov ecx, edi
call sym.mio::sys::windows::tcp::StreamImp::add_readiness::h204b373554df6489
lea ecx, [ebp - 0x18]
mov edx, edi
call sym.mio::sys::windows::tcp::StreamImp::schedule_read::h0ea98380b02639f3
movzx edx, byte [ebp - 0xd]
mov ecx, dword [ebp - 0x20]
call sym.__ZN4core3ptr108drop_in_place_LT_std..sync..mutex..MutexGuard_LT_core..option..Option_LT_mio..poll..Registration_GT__GT__GT_17
lea ecx, [ebp - 0x18]
call sym.__LT_mio..sys..windows..from_raw_arc..FromRawArc_LT_T_GT__u20_as_u20_core..ops..drop..Drop_GT_::drop::h6fcc1aaae15f9950
add esp, 0x40
pop esi
pop edi
pop ebx
pop ebp
ret
lea edx, [ebp - 0x4c]
lea ecx, [ebp - 0x34]
and dword [edx], 0
call sym.core::panicking::assert_failed::h2e8f7dfa70f35b70
Function at 0x10075fe9
Capabilities:
Decrypt data via sspi

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x14
mov ebx, dword [ecx + 0xf8]
sub ebx, edx
jb 0x10076030
mov esi, ecx
je 0x1007601b
mov eax, edx
lea edi, [ebp - 0x20]
lea edx, [esi + 0x100]
mov ecx, edi
push eax
call sym.alloc::vec::Vec_LT_T_C_A_GT_::drain::hd325e2b5b4836d6a
pop eax
mov ecx, edi
call sym.__LT_alloc..vec..drain..Drain_LT_T_C_A_GT__u20_as_u20_core..ops..drop..Drop_GT_::drop::hc83bf781135283bb
and dword [esi + 0xfc], 0
mov dword [esi + 0xf8], ebx
add esp, 0x14
pop esi
pop edi
pop ebx
pop ebp
ret
push 0x1f
pop edx
mov ecx, 0x101bca77
push 0x101bca98
call dbg.panic
Function at 0x10076042
Capabilities:
Decrypt data via sspi

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x44
mov esi, ecx
mov edi, edx
mov ecx, dword [edx + 0x104]
mov edx, dword [edx + 0x108]
push 0x101bcb18
push dword [edi + 0xf8]
call sym.__LT_alloc..vec..Vec_LT_T_C_A_GT__u20_as_u20_core..ops..index..IndexMut_LT_I_GT__GT_::index_mut::he96423e20647fda7
pop ecx
pop ecx
test eax, eax
lea ecx, [ebp - 0x44]
cmove edx, eax
and dword [ecx + 0x24], 0
and dword [ecx + 0x28], 0
and dword [ecx + 0x2c], 0
mov dword [ecx], edx
mov dword [ecx + 4], 1
mov dword [ecx + 8], eax
lea eax, [ebp - 0x50]
and dword [ecx + 0x10], 0
and dword [ecx + 0xc], 0
and dword [ecx + 0x18], 0
and dword [ecx + 0x14], 0
and dword [ecx + 0x20], 0
and dword [ecx + 0x1c], 0
and dword [eax], 0
mov dword [eax + 4], 4
mov dword [eax + 8], ecx
lea ecx, [edi + 0x140]
push 0
push 0
push eax
push ecx
call sub.secur32.dll_DecryptMessage
cmp eax, 0x80090318
je 0x100761b4
test eax, eax
je 0x10076122
cmp eax, 0x90317
je 0x100761ad
cmp eax, 0x90321
jne 0x100761bf
mov dword [edi + 0x128], 0x10000
mov byte [edi + 0x12c], 0
xor eax, eax
cmp dword [ebp - 0x1c], 5
mov edx, dword [edi + 0xf8]
jne 0x1007610d
mov eax, dword [ebp - 0x20]
sub edx, eax
mov ecx, edi
call sym.schannel::tls_stream::TlsStream_LT_S_GT_::consume_enc_in::h09700e9dc2d3d53b
and dword [edi + 0x16c], 0
jmp 0x100761d0
mov eax, dword [ebp - 0x30]
mov ecx, dword [edi + 0x104]
mov dword [ebp - 0x10], esi
mov esi, dword [ebp - 0x38]
mov edx, dword [edi + 0x108]
and dword [edi + 0xf0], 0
lea ebx, [edi + 0xe8]
mov dword [ebp - 0x14], ebx
sub eax, ecx
add esi, eax
push esi
push eax
call sym.__LT_alloc..vec..Vec_LT_T_C_A_GT__u20_as_u20_core..ops..index..Index_LT_I_GT__GT_::index::ha7a8d5df23ad27c5
pop ecx
pop ecx
mov ecx, dword [ebp - 0x14]
mov esi, edx
mov edx, eax
add esi, eax
push esi
call fcn.100e5b8b
pop eax
and dword [edi + 0xe4], 0
and dword [edi + 0xe0], 0
xor eax, eax
cmp dword [ebp - 0x1c], 5
mov edx, dword [edi + 0xf8]
jne 0x10076183
mov eax, dword [ebp - 0x20]
sub edx, eax
mov ecx, edi
call sym.schannel::tls_stream::TlsStream_LT_S_GT_::consume_enc_in::h09700e9dc2d3d53b
mov eax, dword [edi + 0xf8]
xor ecx, ecx
or eax, dword [edi + 0xfc]
mov eax, dword [ebp - 0x10]
sete cl
mov word [eax], 4
mov dword [edi + 0x16c], ecx
jmp 0x100761d5
mov word [esi], 0x104
jmp 0x100761d5
cmp dword [ebp - 0x34], 4
jne 0x100761c7
mov eax, dword [ebp - 0x38]
jmp 0x100761ca
and dword [esi], 0
mov dword [esi + 4], eax
jmp 0x100761d5
xor eax, eax
inc eax
mov dword [edi + 0x16c], eax
mov word [esi], 4
add esp, 0x44
pop esi
pop edi
pop ebx
pop ebp
ret