joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1003aca0
Capabilities:
Reference wmi statements

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x24
cmp dword [edx + 4], 0
mov esi, edx
mov edi, ecx
je 0x1003ad43
mov dword [ebp - 0x10], edi
lea edi, [esi + 4]
push 0x1016f72a
call sub.oleaut32.dll_SysAllocString
mov ebx, eax
mov dword [ebp - 0x18], eax
push str.SELECT__FROM_MSAcpi_ThermalZoneTemperature
call sub.oleaut32.dll_SysAllocString
mov dword [ebp - 0x14], eax
lea edx, [ebp - 0x14]
lea eax, [ebp - 0x30]
lea ecx, [ebp - 0x18]
push 0
push 0x30
push edx
push ecx
push edi
push eax
call sym.windows::Win32::System::Wmi::IWbemServices::ExecQuery::hcbf5c8ebb4f9056d
add esp, 0x18
push ebx
call sub.oleaut32.dll_SysFreeString
push dword [ebp - 0x14]
call sub.oleaut32.dll_SysFreeString
mov eax, dword [ebp - 0x28]
movsd xmm0, qword [ebp - 0x30]
mov dword [ebp - 0x1c], eax
movsd qword [ebp - 0x24], xmm0
lea eax, [ebp - 0x14]
push eax
call sym.__LT_windows_core..strings..bstr..BSTR_u20_as_u20_core..ops..drop..Drop_GT_::drop::h738f14423ace0bfb
add esp, 4
lea eax, [ebp - 0x18]
push eax
call sym.__LT_windows_core..strings..bstr..BSTR_u20_as_u20_core..ops..drop..Drop_GT_::drop::h738f14423ace0bfb
add esp, 4
mov edi, dword [ebp - 0x10]
cmp dword [ebp - 0x24], 0
je 0x1003ad50
cmp dword [ebp - 0x1c], 0
je 0x1003ad43
lea eax, [ebp - 0x1c]
push eax
call sym.__LT_windows_result..com..ComPtr_u20_as_u20_core..ops..drop..Drop_GT_::drop::hcb2d3b1bb6a74ba7
add esp, 4
mov byte [edi + 0xc], 2
mov ecx, esi
call sym.core::ptr::drop_in_place_LT_sysinfo..windows..component..Connection_GT_::hec2e1ca3a921b631
jmp 0x1003ad7d
mov ebx, dword [ebp - 0x20]
cmp dword [esi + 8], 0
je 0x1003ad65
lea edi, [esi + 8]
push edi
call sym.__LT_windows_core..unknown..IUnknown_u20_as_u20_core..ops..drop..Drop_GT_::drop::hb12115a0a737be14
add esp, 4
mov dword [esi + 8], ebx
mov eax, dword [ebp - 0x10]
movsd xmm0, qword [esi]
movsd xmm1, qword [esi + 8]
movsd qword [eax], xmm0
movsd qword [eax + 8], xmm1
add esp, 0x24
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x1003d400
Capabilities:
Get memory capacity

Disassembly:
push ebp
mov ebp, esp
pop ebp
jmp sym.sysinfo::windows::system::SystemInner::refresh_memory_specifics::h08a779c264028cd1
Function at 0x1004c590
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x28
mov esi, ecx
lea eax, [ebp - 0x24]
push eax
push edx
call sub.shell32.dll_CommandLineToArgvW
test eax, eax
mov dword [ebp - 0x1c], eax
je 0x1004c652
mov ebx, dword [ebp - 0x24]
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 4
mov dword [ebp - 0x20], esi
mov dword [ebp - 0x10], 0
test ebx, ebx
je 0x1004c636
mov edi, dword [ebp - 0x1c]
shl ebx, 2
jmp 0x1004c609
mov eax, dword [ebp - 0x14]
movsd xmm0, qword [ebp - 0x34]
movsd xmm1, qword [ebp - 0x2c]
mov ecx, esi
add edi, 4
inc esi
shl ecx, 4
add ebx, 0xfffffffc
movsd qword [eax + ecx + 8], xmm1
movsd qword [eax + ecx], xmm0
mov dword [ebp - 0x10], esi
je 0x1004c636
push edi
call sym.windows_core::strings::pwstr::PWSTR::as_wide::ha9a40bc52d7b05b1
add esp, 4
push edx
push eax
lea eax, [ebp - 0x34]
push eax
call sym.__LT_std..ffi..os_str..OsString_u20_as_u20_std..os..windows..ffi..OsStringExt_GT_::from_wide::hdc9efc66b333cddc
add esp, 0xc
mov esi, dword [ebp - 0x10]
cmp esi, dword [ebp - 0x18]
jne 0x1004c5e0
lea eax, [ebp - 0x18]
push eax
call sym.alloc::raw_vec::RawVec_LT_T_C_A_GT_::grow_one::h52b196eafe2b7f22
add esp, 4
jmp 0x1004c5e0
push dword [ebp - 0x1c]
call sub.kernel32.dll_LocalFree
movsd xmm0, qword [ebp - 0x18]
mov ecx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x10]
movsd qword [ecx], xmm0
mov dword [ecx + 8], eax
jmp 0x1004c666
mov dword [esi], 0
mov dword [esi + 4], 4
mov dword [esi + 8], 0
add esp, 0x28
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x1004d8e0
Capabilities:
Get memory capacity

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x60
movzx ebx, byte [ebp + 0x10]
mov esi, dword [ebp + 8]
cmp byte [ebp + 0xc], 0
je 0x1004d960
xorps xmm0, xmm0
lea eax, [esp + 0x10]
movaps xmmword [esp + 0x10], xmm0
movaps xmmword [esp + 0x40], xmm0
movaps xmmword [esp + 0x30], xmm0
movaps xmmword [esp + 0x20], xmm0
mov dword [esp + 0x10], 0x40
push eax
call sub.kernel32.dll_GlobalMemoryStatusEx
test eax, eax
je 0x1004d931
movups xmm0, xmmword [esp + 0x18]
movups xmmword [esi + 0x40], xmm0
jmp 0x1004d960
call sym.windows_result::error::Error::from_win32::h7d859e40b596e523
movups xmm0, xmmword [esp + 0x18]
test edx, edx
mov dword [esp + 8], eax
mov dword [esp + 0xc], edx
mov dword [esp + 4], 1
movups xmmword [esi + 0x40], xmm0
je 0x1004d960
lea eax, [esp + 0xc]
push eax
call sym.__LT_windows_result..com..ComPtr_u20_as_u20_core..ops..drop..Drop_GT_::drop::hcb2d3b1bb6a74ba7
add esp, 4
test bl, bl
je 0x1004d9c9
xorps xmm0, xmm0
lea eax, [esp + 0x10]
movsd qword [esp + 0x40], xmm0
xorps xmm0, xmm0
movaps xmmword [esp + 0x30], xmm0
movaps xmmword [esp + 0x20], xmm0
movaps xmmword [esp + 0x10], xmm0
push 0x38
push eax
call sub.kernel32.dll_K32GetPerformanceInfo
test eax, eax
je 0x1004d9c9
mov edi, dword [esp + 0x20]
mov eax, dword [esp + 0x18]
mov ebx, dword [esp + 0x38]
xor ecx, ecx
mov edx, 0
sub eax, edi
sbb edx, edx
cmovb eax, ecx
mul ebx
mov dword [esi + 0x50], eax
mov eax, dword [esp + 0x14]
mov dword [esi + 0x54], edx
mov edx, 0
sub eax, edi
sbb edx, edx
cmovb eax, ecx
mul ebx
mov dword [esi + 0x5c], edx
mov dword [esi + 0x58], eax
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x1004e9a0
Capabilities:
Get hostname

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x1c
mov dword [ebp - 0x10], 0
lea edi, [ebp - 0x10]
push edi
push 0
push 5
call sub.kernel32.dll_GetComputerNameExW
xor ecx, ecx
test eax, eax
jne 0x1004e9d3
call sym.windows_result::error::Error::from_win32::h7d859e40b596e523
mov ecx, 1
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], edx
mov ebx, dword [ebp - 0x10]
mov esi, dword [ebp + 8]
mov dword [ebp - 0x1c], ecx
test ebx, ebx
je 0x1004ea34
lea esi, [ebx + ebx]
cmp ebx, 0x3fffffff
ja 0x1004eb0d
push 2
push esi
call sym.___rust_alloc_zeroed
add esp, 8
test eax, eax
je 0x1004eb11
mov edi, eax
lea eax, [ebp - 0x10]
push eax
push edi
push 5
call sub.kernel32.dll_GetComputerNameExW
test eax, eax
je 0x1004eaa7
xor eax, eax
nop word [eax + eax]
cmp word [edi + eax*2], 0
je 0x1004ea2f
inc eax
add esi, 0xfffffffe
jne 0x1004ea20
mov eax, ebx
mov esi, dword [ebp + 8]
jmp 0x1004ea49
push edi
push 2
push 5
call sub.kernel32.dll_GetComputerNameExW
test eax, eax
je 0x1004eaac
xor eax, eax
mov edi, 2
lea ecx, [ebp - 0x28]
push eax
push edi
push ecx
call sym.alloc::string::String::from_utf16::hafbf8e8226bf84a8
add esp, 0xc
cmp dword [ebp - 0x28], 0x80000000
jne 0x1004ea6c
mov dword [esi], 0x80000000
test ebx, ebx
jne 0x1004ea7f
jmp 0x1004ea8d
mov eax, dword [ebp - 0x20]
movsd xmm0, qword [ebp - 0x28]
mov dword [esi + 8], eax
movsd qword [esi], xmm0
test ebx, ebx
je 0x1004ea8d
add ebx, ebx
push 2
push ebx
push edi
call sym.___rust_dealloc
add esp, 0xc
cmp dword [ebp - 0x1c], 0
je 0x1004eb03
cmp dword [ebp - 0x14], 0
je 0x1004eb03
lea eax, [ebp - 0x14]
push eax
call sym.__LT_windows_result..com..ComPtr_u20_as_u20_core..ops..drop..Drop_GT_::drop::hcb2d3b1bb6a74ba7
add esp, 4
jmp 0x1004eb03
mov esi, dword [ebp + 8]
jmp 0x1004eab1
mov edi, 2
call sym.windows_result::error::Error::from_win32::h7d859e40b596e523
test edx, edx
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x20], edx
mov dword [ebp - 0x28], 1
je 0x1004ead3
lea eax, [ebp - 0x20]
push eax
call sym.__LT_windows_result..com..ComPtr_u20_as_u20_core..ops..drop..Drop_GT_::drop::hcb2d3b1bb6a74ba7
add esp, 4
test ebx, ebx
je 0x1004eae5
add ebx, ebx
push 2
push ebx
push edi
call sym.___rust_dealloc
add esp, 0xc
cmp dword [ebp - 0x1c], 0
je 0x1004eafd
cmp dword [ebp - 0x14], 0
je 0x1004eafd
lea eax, [ebp - 0x14]
push eax
call sym.__LT_windows_result..com..ComPtr_u20_as_u20_core..ops..drop..Drop_GT_::drop::hcb2d3b1bb6a74ba7
add esp, 4
mov dword [esi], 0x80000000
mov eax, esi
add esp, 0x1c
pop esi
pop edi
pop ebx
pop ebp
ret
xor eax, eax
jmp 0x1004eb16
mov eax, 2
push esi
push eax
call sym.alloc::raw_vec::handle_error::hfb8b40974975e9a6
add esp, 8
ud2
Function at 0x1004ee70
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x24
mov esi, dword [ebp + 8]
call 0x1004ee81
pop edi
lea ebx, [ebp - 0x30]
push ebx
call sym.__ZN108__LT_windows..Win32..System..SystemInformation..NUMA_NODE_RELATIONSHIP_u20_as_u20_core..default..Default_GT_7default17h
add esp, 4
push ebx
call sub.kernel32.dll_GetSystemInfo
movzx eax, word [ebp - 0x30]
cmp eax, 0xe
ja 0x1004f08f
add edi, dword [eax*4 + 0x1004f0cc]
jmp edi
mov dword [esi], 0x80000000
mov eax, esi
add esp, 0x24
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x1005e020
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
push esi
mov edx, dword [ebp + 0xc]
mov eax, dword [ebp + 8]
cmp word [edx], 0
je 0x1005e05d
mov ecx, dword [edx + 0x14]
movsd xmm0, qword [edx + 4]
movsd xmm1, qword [edx + 0xc]
mov esi, dword [edx + 0x18]
movzx edx, word [edx + 0x1c]
movsd qword [eax + 0x10], xmm1
movsd qword [eax + 8], xmm0
mov dword [eax + 0x18], esi
rol dx, 8
bswap ecx
mov si, 0x17
jmp 0x1005e07a
mov ecx, dword [edx + 2]
movzx edx, word [edx + 6]
mov dword [eax + 0xc], 0
mov dword [eax + 8], 0
mov si, 2
rol dx, 8
mov word [eax], si
mov word [eax + 2], dx
mov dword [eax + 4], ecx
pop esi
pop ebp
ret

Function at 0x1006c740
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
mov esi, dword [ebp + 8]
mov eax, dword [esi]
mov edi, dword [esi + 0x40]
xor edi, eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push esi
call sym.crossbeam_deque::deque::Injector_LT_T_GT_::push::haa19e7e4bfa92c27
add esp, 0xc
mfence
nop word cs:[eax + eax]
nop dword [eax + eax]
mov eax, dword [esi + 0xb8]
test eax, 0x10000
jne 0x1006c79c
mov ecx, eax
or ecx, 0x10000
lock cmpxchg dword [esi + 0xb8], ecx
jne 0x1006c770
mov eax, ecx
and eax, 0xff
jne 0x1006c7a7
pop esi
pop edi
pop ebp
ret
mov ecx, eax
mov eax, ecx
and eax, 0xff
je 0x1006c798
cmp edi, 1
ja 0x1006c7b3
movzx ecx, ch
cmp ecx, eax
jne 0x1006c798
add esi, 0xac
push 1
push esi
call sym.rayon_core::sleep::Sleep::wake_any_threads::h99cf5de7cddfec55
add esp, 8
pop esi
pop edi
pop ebp
ret
Function at 0x1006e120
Capabilities:
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
mov edi, dword [ebp + 8]
mov esi, dword [edi + 4]
push 1
push esi
call sub.kernel32.dll_TlsSetValue
push 4
push 8
push edi
call sym.___rust_dealloc
add esp, 0xc
push 0
push esi
call sub.kernel32.dll_TlsSetValue
pop esi
pop edi
pop ebp
ret

Function at 0x1006e150
Capabilities:
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
mov edi, dword [ebp + 8]
mov esi, dword [edi + 8]
push 1
push esi
call sub.kernel32.dll_TlsSetValue
push 4
push 0xc
push edi
call sym.___rust_dealloc
add esp, 0xc
push 0
push esi
call sub.kernel32.dll_TlsSetValue
pop esi
pop edi
pop ebp
ret

Function at 0x1006e180
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
push eax
mov eax, dword [ebp + 8]
mov esi, dword [eax]
test esi, esi
je 0x1006e248
dec esi
push esi
call sub.kernel32.dll_TlsGetValue
cmp eax, 1
ja 0x1006e240
je 0x1006e23e
mov eax, dword [ebp + 0xc]
test eax, eax
je 0x1006e1bf
mov edi, dword [eax + 4]
cmp dword [eax], 0
mov dword [eax], 0
jne 0x1006e1cf
call sym.crossbeam_epoch::default::default_collector::h88a65e9db30144e3
push eax
call sym.crossbeam_epoch::collector::Collector::register::hf710bc3755abbc29
add esp, 4
mov edi, eax
mov eax, dword [0x101918ac]
movzx eax, byte [eax]
push 4
push 8
call sym.___rust_alloc
add esp, 8
test eax, eax
je 0x1006e264
mov dword [eax], edi
mov dword [eax + 4], esi
push esi
mov ebx, eax
call sub.kernel32.dll_TlsGetValue
mov edi, eax
mov dword [ebp - 0x10], ebx
push ebx
push esi
call sub.kernel32.dll_TlsSetValue
test edi, edi
je 0x1006e239
mov eax, dword [edi]
mov ecx, dword [eax + 0x410]
lea edx, [ecx - 1]
mov dword [eax + 0x410], edx
cmp dword [eax + 0x40c], 0
jne 0x1006e22c
cmp ecx, 1
jne 0x1006e22c
push eax
call sym.crossbeam_epoch::internal::Local::finalize::h4cdf2512459a4cf4
add esp, 4
push 4
push 8
push edi
call sym.___rust_dealloc
add esp, 0xc
mov eax, dword [ebp - 0x10]
jmp 0x1006e240
xor eax, eax
add esp, 4
pop esi
pop edi
pop ebx
pop ebp
ret
push eax
call sym.std::sys::thread_local::key::windows::LazyKey::init::h8219056d8c3ded71
add esp, 4
mov esi, eax
push esi
call sub.kernel32.dll_TlsGetValue
cmp eax, 1
jbe 0x1006e1a4
jmp 0x1006e240
push 8
push 4
call sym.alloc::alloc::handle_alloc_error::h9a0385ddba01e206
add esp, 8
ud2
Function at 0x1006e2c0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
push eax
mov eax, dword [ebp + 8]
mov esi, dword [eax]
test esi, esi
je 0x1006e349
dec esi
push esi
call sub.kernel32.dll_TlsGetValue
cmp eax, 1
ja 0x1006e341
je 0x1006e2f6
mov eax, dword [ebp + 0xc]
test eax, eax
je 0x1006e2fa
mov edi, dword [eax]
mov dword [eax], 0
test edi, edi
je 0x1006e2fc
mov edi, dword [eax + 4]
jmp 0x1006e2fc
xor eax, eax
jmp 0x1006e341
xor edi, edi
mov eax, dword [0x101918ac]
movzx eax, byte [eax]
push 4
push 8
call sym.___rust_alloc
add esp, 8
test eax, eax
je 0x1006e365
mov dword [eax], edi
mov dword [eax + 4], esi
push esi
mov ebx, eax
call sub.kernel32.dll_TlsGetValue
mov edi, eax
mov dword [ebp - 0x10], ebx
push ebx
push esi
call sub.kernel32.dll_TlsSetValue
test edi, edi
je 0x1006e33e
push 4
push 8
push edi
call sym.___rust_dealloc
add esp, 0xc
mov eax, dword [ebp - 0x10]
add esp, 4
pop esi
pop edi
pop ebx
pop ebp
ret
push eax
call sym.std::sys::thread_local::key::windows::LazyKey::init::h8219056d8c3ded71
add esp, 4
mov esi, eax
push esi
call sub.kernel32.dll_TlsGetValue
cmp eax, 1
jbe 0x1006e2dc
jmp 0x1006e341
push 8
push 4
call sym.alloc::alloc::handle_alloc_error::h9a0385ddba01e206
nop

Function at 0x100759c0
Capabilities:
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [ebp + 8]
mov ecx, eax
and ecx, 0x3c
mov dword [ebp - 4], ecx
jne 0x100759e1
push eax
push dword [ebp + 0xc]
call sym.crossbeam_epoch::guard::Guard::defer_unchecked::h55c501e4a4b9815c
add esp, 0x24
pop ebp
ret
mov dword [ebp - 0x1c], str.unaligned_pointer
mov dword [ebp - 0x18], 1
mov dword [ebp - 0x14], 4
mov dword [ebp - 0x10], 0
mov dword [ebp - 0xc], 0
lea eax, [ebp - 0x1c]
lea ecx, [ebp - 4]
push 0x1017513c
push eax
push 0x101750cc
push ecx
push 0
call sym.core::panicking::assert_failed::h607c771ae2516756
nop dword [eax]

Function at 0x10075ad0
Capabilities:
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
mov esi, dword [ebp + 8]
mov edi, dword [esi + 4]
push 1
push edi
call sub.kernel32.dll_TlsSetValue
mov eax, dword [esi]
mov ecx, dword [eax + 0x410]
lea edx, [ecx - 1]
mov dword [eax + 0x410], edx
cmp dword [eax + 0x40c], 0
jne 0x10075b0b
cmp ecx, 1
jne 0x10075b0b
push eax
call sym.crossbeam_epoch::internal::Local::finalize::h4cdf2512459a4cf4
add esp, 4
push 4
push 8
push esi
call sym.___rust_dealloc
add esp, 0xc
push 0
push edi
call sub.kernel32.dll_TlsSetValue
pop esi
pop edi
pop ebp
ret
Function at 0x1009ae80
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
push esi
sub esp, 0x24
mov esi, dword [ebp + 8]
xorps xmm0, xmm0
lea eax, [ebp - 0x28]
mov dword [ebp - 8], 0
movups xmmword [ebp - 0x18], xmm0
movups xmmword [ebp - 0x28], xmm0
push eax
call sub.kernel32.dll_GetSystemInfo
mov eax, dword [ebp - 0x14]
test eax, eax
je 0x1009aeb4
mov dword [esi + 4], eax
mov byte [esi], 4
jmp 0x1009aec4
mov eax, dword [0x10179430]
mov ecx, dword [0x10179434]
mov dword [esi + 4], ecx
mov dword [esi], eax
mov eax, esi
add esp, 0x24
pop esi
pop ebp
ret
Function at 0x1009c2f0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x428
mov esi, 0x200
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 2
mov dword [ebp - 0x10], 0
mov dword [ebp - 0x24], 0
mov dword [ebp - 0x1c], 2
cmp esi, 0x201
jae 0x1009c350
jmp 0x1009c33e
jbe 0x1009c3c0
cmp esi, 0x201
jae 0x1009c350
mov dword [ebp - 0x20], 0x200
lea edi, [ebp - 0x434]
mov ebx, esi
jmp 0x1009c37a
mov ebx, dword [ebp - 0x24]
sub esi, ebx
je 0x1009c36e
mov edx, ebx
lea ecx, [ebp - 0x18]
push esi
call sym.alloc::raw_vec::RawVec_LT_T_C_A_GT_::reserve::do_reserve_and_handle::h20e2001013f05adb
add esp, 4
mov ebx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x1c], eax
mov edi, dword [ebp - 0x1c]
mov dword [ebp - 0x10], ebx
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x24], ebx
push 0
call sub.kernel32.dll_SetLastError
push edi
push ebx
call sub.kernel32.dll_GetCurrentDirectoryW
mov esi, eax
test eax, eax
jne 0x1009c397
call sub.kernel32.dll_GetLastError
test eax, eax
jne 0x1009c410
cmp esi, ebx
jne 0x1009c330
call sub.kernel32.dll_GetLastError
cmp eax, 0x7a
jne 0x1009c42e
lea esi, [ebx + ebx]
test ebx, ebx
mov eax, 0xffffffff
cmovs esi, eax
cmp esi, 0x201
jb 0x1009c33e
jmp 0x1009c350
mov eax, dword [ebp - 0x20]
cmp esi, eax
ja 0x1009c444
lea eax, [ebp - 0x34]
push esi
push edi
push eax
call sym.__LT_std..ffi..os_str..OsString_u20_as_u20_std..os..windows..ffi..OsStringExt_GT_::from_wide::hdc9efc66b333cddc
add esp, 0xc
movsd xmm0, qword [ebp - 0x34]
mov eax, dword [ebp + 8]
movsd xmm1, qword [ebp - 0x2c]
movsd qword [eax + 8], xmm1
movsd qword [eax], xmm0
mov eax, dword [ebp - 0x18]
test eax, eax
je 0x1009c402
add eax, eax
push 2
push eax
push dword [ebp - 0x14]
call sym.___rust_dealloc
add esp, 0xc
mov eax, dword [ebp + 8]
add esp, 0x428
pop esi
pop edi
pop ebx
pop ebp
ret
call sub.kernel32.dll_GetLastError
mov ecx, dword [ebp + 8]
mov byte [ecx + 4], 0
mov dword [ecx + 8], eax
mov dword [ecx], 0x80000000
mov eax, dword [ebp - 0x18]
test eax, eax
jne 0x1009c3f2
jmp 0x1009c402
push 0x10179560
push 0x28
push 0x10175e60
call sym.core::panicking::panic::h2de0902fd6c3d9b1
add esp, 0xc
jmp 0x1009c453
push 0x10179550
push eax
push esi
call sym.core::slice::index::slice_end_index_len_fail::hb7bcdcb5c84f7e98
add esp, 0xc
ud2

Function at 0x1009c480
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
sub esp, 0x28
call sub.kernel32.dll_GetEnvironmentStringsW
test eax, eax
je 0x1009c49a
mov edx, eax
add esp, 0x28
pop esi
pop edi
pop ebp
ret
call sub.kernel32.dll_GetLastError
mov byte [ebp - 0x18], 0
mov dword [ebp - 0x14], eax
lea edi, [ebp - 0x18]
lea eax, [ebp - 0x10]
mov dword [ebp - 0x30], 0x10178e00
mov dword [ebp - 0x2c], 1
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x10], edi
mov dword [ebp - 0x28], eax
mov dword [ebp - 0xc], sym.__LT_std..io..error..Error_u20_as_u20_core..fmt..Display_GT_::fmt::hb3a737c4f0103051
mov dword [ebp - 0x24], 1
lea eax, [ebp - 0x30]
push 0x10178e08
push eax
call sym.core::panicking::panic_fmt::h653fda680bf9012e
add esp, 8
ud2
Function at 0x1009dfd0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
mov ebx, dword [ebp + 0x10]
test ebx, ebx
je 0x1009e113
js 0x1009e14e
mov eax, dword [0x101918ac]
movzx eax, byte [eax]
push 1
push ebx
call sym.___rust_alloc
add esp, 8
test eax, eax
je 0x1009e157
mov esi, eax
mov edi, eax
push ebx
push dword [ebp + 0xc]
push esi
call sub.msvcrt.dll_memcpy
add esp, 0xc
cmp ebx, 8
mov ecx, esi
jb 0x1009e11e
xor eax, eax
cmp ebx, 0x20
jb 0x1009e0b2
movdqa xmm0, xmmword [0x10175450]
movdqa xmm1, xmmword [0x10175460]
movdqa xmm2, xmmword [0x10175470]
mov eax, ebx
xor ecx, ecx
and eax, 0x7fffffe0
nop word [eax + eax]
movdqu xmm4, xmmword [edi + ecx]
movdqu xmm3, xmmword [edi + ecx + 0x10]
movdqa xmm5, xmm4
movdqa xmm6, xmm3
paddb xmm5, xmm0
paddb xmm6, xmm0
movdqa xmm7, xmm5
pminub xmm7, xmm1
pcmpeqb xmm7, xmm5
movdqa xmm5, xmm6
pminub xmm5, xmm1
pand xmm7, xmm2
pcmpeqb xmm5, xmm6
pxor xmm7, xmm4
pand xmm5, xmm2
movdqu xmmword [edi + ecx], xmm7
pxor xmm5, xmm3
movdqu xmmword [edi + ecx + 0x10], xmm5
add ecx, 0x20
cmp eax, ecx
jne 0x1009e050
cmp eax, ebx
je 0x1009e13a
test bl, 0x18
je 0x1009e11a
movdqa xmm0, xmmword [0x10175480]
movdqa xmm1, xmmword [0x10175490]
movdqa xmm2, xmmword [0x101754a0]
mov edx, ebx
and edx, 0x7ffffff8
lea ecx, [esi + edx]
nop word cs:[eax + eax]
nop
movq xmm3, qword [edi + eax]
movdqa xmm4, xmm3
paddb xmm4, xmm0
movdqa xmm5, xmm4
pmaxub xmm5, xmm1
pcmpeqb xmm5, xmm4
pandn xmm5, xmm2
pxor xmm5, xmm3
movq qword [edi + eax], xmm5
add eax, 8
cmp edx, eax
jne 0x1009e0e0
cmp edx, ebx
jne 0x1009e11e
jmp 0x1009e13a
mov edi, 1
jmp 0x1009e13a
add eax, esi
mov ecx, eax
add esi, ebx
movzx eax, byte [ecx]
mov edx, eax
add dl, 0x9f
cmp dl, 0x1a
setb dl
shl dl, 5
xor dl, al
mov byte [ecx], dl
inc ecx
cmp ecx, esi
jne 0x1009e120
mov eax, dword [ebp + 8]
mov dword [eax], ebx
mov dword [eax + 4], edi
mov dword [eax + 8], ebx
mov byte [eax + 0xc], 0
pop esi
pop edi
pop ebx
pop ebp
ret
xor eax, eax
push ebx
push eax
call sym.alloc::raw_vec::handle_error::hfb8b40974975e9a6
mov eax, 1
push ebx
push eax
call sym.alloc::raw_vec::handle_error::hfb8b40974975e9a6
nop word cs:[eax + eax]
nop dword [eax]
Function at 0x100a7c50
Capabilities:
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0xc
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 0x18]
xor esi, esi
mov edi, dword [eax]
cmp ecx, 0x3b9aca00
je 0x100a7cb2
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x14], edi
mov edi, dword [ebp + 0x10]
mov ebx, 0x3e8
mul ebx
mov esi, eax
mov eax, edi
seto byte [ebp - 0xd]
mul ebx
mov ebx, edx
mov edi, eax
add ebx, esi
mov esi, 0xffffffff
setb al
or al, byte [ebp - 0xd]
jne 0x100a7caf
mov edx, 0x431bde83
mov eax, ecx
mul edx
mov eax, edi
shr edx, 0x12
add eax, edx
mov eax, ebx
adc eax, 0
jae 0x100a7cf5
mov edi, dword [ebp - 0x14]
mov dword [ebp - 0x18], esi
lea eax, [ebp - 0x18]
push 4
push eax
push 0x1006
push 0xffff
push edi
call sub.ws2_32.dll_setsockopt
mov esi, dword [ebp + 8]
mov cl, 4
cmp eax, 0xffffffff
jne 0x100a7ce9
call sub.ws2_32.dll_WSAGetLastError
xor ecx, ecx
mov byte [esi + 3], 0
mov word [esi + 1], 0
mov dword [esi + 4], eax
mov byte [esi], cl
mov eax, esi
add esp, 0xc
pop esi
pop edi
pop ebx
pop ebp
ret
imul eax, edx, 0xf4240
sub ecx, eax
add edi, edx
adc ebx, 0
xor eax, eax
test ecx, ecx
mov edx, edi
setne al
add eax, edi
mov edi, dword [ebp - 0x14]
mov eax, ebx
adc eax, 0
jb 0x100a7cb2
xor eax, eax
test ecx, ecx
setne al
add edx, eax
adc ebx, 0
xor esi, esi
neg ebx
sbb esi, esi
or esi, edx
jne 0x100a7cb2
mov esi, dword [ebp + 8]
mov eax, dword [0x10178c88]
mov ecx, dword [0x10178c8c]
mov dword [esi + 4], ecx
mov dword [esi], eax
jmp 0x100a7ceb

Function at 0x100a7d50
Capabilities:
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0xc
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 0x18]
xor esi, esi
mov edi, dword [eax]
cmp ecx, 0x3b9aca00
je 0x100a7db2
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x14], edi
mov edi, dword [ebp + 0x10]
mov ebx, 0x3e8
mul ebx
mov esi, eax
mov eax, edi
seto byte [ebp - 0xd]
mul ebx
mov ebx, edx
mov edi, eax
add ebx, esi
mov esi, 0xffffffff
setb al
or al, byte [ebp - 0xd]
jne 0x100a7daf
mov edx, 0x431bde83
mov eax, ecx
mul edx
mov eax, edi
shr edx, 0x12
add eax, edx
mov eax, ebx
adc eax, 0
jae 0x100a7df5
mov edi, dword [ebp - 0x14]
mov dword [ebp - 0x18], esi
lea eax, [ebp - 0x18]
push 4
push eax
push 0x1005
push 0xffff
push edi
call sub.ws2_32.dll_setsockopt
mov esi, dword [ebp + 8]
mov cl, 4
cmp eax, 0xffffffff
jne 0x100a7de9
call sub.ws2_32.dll_WSAGetLastError
xor ecx, ecx
mov byte [esi + 3], 0
mov word [esi + 1], 0
mov dword [esi + 4], eax
mov byte [esi], cl
mov eax, esi
add esp, 0xc
pop esi
pop edi
pop ebx
pop ebp
ret
imul eax, edx, 0xf4240
sub ecx, eax
add edi, edx
adc ebx, 0
xor eax, eax
test ecx, ecx
mov edx, edi
setne al
add eax, edi
mov edi, dword [ebp - 0x14]
mov eax, ebx
adc eax, 0
jb 0x100a7db2
xor eax, eax
test ecx, ecx
setne al
add edx, eax
adc ebx, 0
xor esi, esi
neg ebx
sbb esi, esi
or esi, edx
jne 0x100a7db2
mov esi, dword [ebp + 8]
mov eax, dword [0x10178c88]
mov ecx, dword [0x10178c8c]
mov dword [esi + 4], ecx
mov dword [esi], eax
jmp 0x100a7deb