joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10013420
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
mov eax, 0x1014
call sym.__alloca
mov ecx, dword [ebp + 0xc]
lea edi, [ebp - 0x1020]
mov eax, dword [ecx]
mov ebx, dword [ecx + 4]
mov esi, dword [eax]
mov dword [ebp - 0x14], 0x800
push 0x1000
push 0
push edi
call sub.msvcrt.dll_memset
add esp, 0xc
lea eax, [ebp - 0x14]
push 0
push 0
push 0
push 0
push eax
push edi
push ebx
push esi
call sub.advapi32.dll_RegEnumKeyExW
cmp eax, 0x103
je 0x100134a2
test eax, eax
jne 0x100134ad
mov eax, dword [ebp - 0x14]
cmp eax, 0x801
jae 0x100134fa
lea ecx, [ebp - 0x20]
push eax
push edi
push ecx
call sym.alloc::string::String::from_utf16::hafbf8e8226bf84a8
add esp, 0xc
mov ecx, dword [ebp - 0x20]
cmp ecx, 0x80000000
jne 0x100134b6
mov eax, 9
xor edx, edx
jmp 0x100134cc
mov esi, dword [ebp + 8]
mov dword [esi], 0x80000001
jmp 0x100134ed
mov ecx, 0x80000000
xor edx, edx
jmp 0x100134cc
movzx eax, word [ebp - 0x1b]
movzx edx, byte [ebp - 0x1c]
mov word [ebp - 0x10], ax
movzx eax, byte [ebp - 0x19]
mov byte [ebp - 0xe], al
mov eax, dword [ebp - 0x18]
mov esi, dword [ebp + 8]
mov edi, dword [ebp + 0xc]
inc ebx
mov dword [edi + 4], ebx
mov dword [esi], ecx
mov byte [esi + 4], dl
movzx edi, word [ebp - 0x10]
movzx edx, byte [ebp - 0xe]
mov word [esi + 5], di
mov byte [esi + 7], dl
mov dword [esi + 8], eax
mov eax, esi
add esp, 0x1014
pop esi
pop edi
pop ebx
pop ebp
ret
push 0x1016d4dc
push 0x800
push eax
call sym.core::slice::index::slice_end_index_len_fail::hb7bcdcb5c84f7e98
nop word [eax + eax]
Function at 0x10015530
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
mov esi, dword [ebp + 0x10]
mov edx, dword [ebp + 0xc]
mov ecx, dword [ebp + 8]
movzx eax, byte [section..data]
cmp al, 1
je 0x1001556e
movzx eax, al
cmp eax, 0xff
je 0x1001555d
pop esi
pop edi
pop ebx
pop ebp
jmp sym.sha1::compress::soft::compress::h17c32f1a8dae23d1
mov edi, edx
mov ebx, ecx
call sym.sha1::compress::x86::shani_cpuid::init_get::init_inner::h8aeeb3ad392e6cca
mov ecx, ebx
mov edx, edi
test al, al
je 0x10015554
push esi
call sym.sha1::compress::x86::digest_blocks::h13648a5bab045f94
add esp, 4
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x10017440
Capabilities:
Encode data using xor
Hash data using murmur3

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
mov esi, dword [ebp + 0x10]
mov edx, dword [ebp + 0xc]
mov ecx, dword [ebp + 8]
movzx eax, byte [0x1011d00c]
cmp al, 1
je 0x1001747e
movzx eax, al
cmp eax, 0xff
je 0x1001746d
pop esi
pop edi
pop ebx
pop ebp
jmp sym.sha2::sha256::soft::compress::h0c4350b6a680ae09
mov edi, edx
mov ebx, ecx
call sym.sha2::sha256::x86::shani_cpuid::init_get::init_inner::hb893ba56aa2a3648
mov ecx, ebx
mov edx, edi
test al, al
je 0x10017464
push esi
call sym.sha2::sha256::x86::digest_blocks::h1c1c84cfc0559590
add esp, 4
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x10017490
Capabilities:
Encode data using base64
Hash data using sha512
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
mov esi, dword [ebp + 0x10]
mov edx, dword [ebp + 0xc]
mov ecx, dword [ebp + 8]
movzx eax, byte [0x1011d00d]
cmp al, 1
je 0x100174ce
movzx eax, al
cmp eax, 0xff
je 0x100174bd
pop esi
pop edi
pop ebx
pop ebp
jmp sym.sha2::sha512::soft::compress::ha64c8fa7cec6afff
mov edi, edx
mov ebx, ecx
call sym.sha2::sha512::x86::avx2_cpuid::init_get::init_inner::h284e3f88c37b050d
mov ecx, ebx
mov edx, edi
test al, al
je 0x100174b4
push esi
call sym.__ZN4sha26sha5123x8627sha512_compress_x86_64_avx217ha1144f3ff81ce650E.llvm.15436207685061760628
add esp, 4
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x10022c40
Capabilities:
Encode data using base64
Encode data using xor
Hash data using sha512
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
mov esi, dword [ebp + 0x10]
mov edx, dword [ebp + 0xc]
mov ecx, dword [ebp + 8]
movzx eax, byte [0x1011d00d]
cmp al, 1
je 0x10022c7e
movzx eax, al
cmp eax, 0xff
je 0x10022c6d
pop esi
pop edi
pop ebx
pop ebp
jmp sym.sha2::sha512::soft::compress::ha64c8fa7cec6afff
mov edi, edx
mov ebx, ecx
call sym.sha2::sha512::x86::avx2_cpuid::init_get::init_inner::h284e3f88c37b050d
mov ecx, ebx
mov edx, edi
test al, al
je 0x10022c64
push esi
call sym.__ZN4sha26sha5123x8627sha512_compress_x86_64_avx217ha1144f3ff81ce650E.llvm.15436207685061760628
add esp, 4
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x100248e0
Capabilities:
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
mov edi, dword [ebp + 8]
mov esi, dword [edi + 4]
push 1
push esi
call sub.kernel32.dll_TlsSetValue
mov eax, dword [edi]
dec dword [eax]
jne 0x1002490e
dec dword [eax + 4]
jne 0x1002490e
push 8
push 0x158
push eax
call sym.___rust_dealloc
add esp, 0xc
push 4
push 8
push edi
call sym.___rust_dealloc
add esp, 0xc
push 0
push esi
call sub.kernel32.dll_TlsSetValue
pop esi
pop edi
pop ebp
ret
Function at 0x100261d0
Capabilities:
Contain obfuscated stackstrings
Encode data using xor
Encrypt data using salsa20 or chacha

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
cmp dword [ebp + 0xc], 4
jne 0x100261e6
mov eax, dword [ebp + 8]
mov eax, dword [eax]
add esp, 0x18
pop ebp
ret
lea ecx, [ebp + 0xc]
lea edx, [ebp - 0x18]
mov dword [ebp - 0x18], 0
call sym.core::panicking::assert_failed::hd9868281c4c1f7f7
nop dword [eax + eax]
Function at 0x1002aaf0
Capabilities:
Generate random numbers via rtlgenrandom
Generate random numbers via winapi

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
mov ebx, dword [ebp + 0xc]
xor esi, esi
test ebx, ebx
je 0x1002ab2b
push 2
push ebx
push dword [ebp + 8]
push 0
call sub.bcrypt.dll_BCryptGenRandom
cmp eax, 0xc0000000
jb 0x1002ab2b
mov edi, eax
push ebx
push dword [ebp + 8]
call sub.advapi32.dll_SystemFunction036
and edi, 0x7fffffff
xor esi, esi
test al, al
cmove esi, edi
mov eax, esi
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x1002c090
Capabilities:
Get disk size

Disassembly:
push ebp
mov ebp, esp
push esi
and esp, 0xfffffff8
sub esp, 0x18
mov esi, dword [ebp + 8]
mov eax, dword [esi + 0x38]
or eax, dword [esi + 0x3c]
je 0x1002c0ff
mov eax, esp
mov dword [esp + 4], 0
mov dword [esp], 0
push eax
push 0
push 0
push dword [esi + 0x4c]
call sub.kernel32.dll_GetDiskFreeSpaceExW
test eax, eax
je 0x1002c0d9
movsd xmm0, qword [esp]
mov al, 1
movsd qword [esi + 0x40], xmm0
lea esp, [ebp - 4]
pop esi
pop ebp
ret
call sym.windows_result::error::Error::from_win32::h7d859e40b596e523
test edx, edx
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], edx
mov dword [esp + 8], 1
je 0x1002c0ff
lea eax, [esp + 0x10]
push eax
call sym.__LT_windows_result..com..ComPtr_u20_as_u20_core..ops..drop..Drop_GT_::drop::hcb2d3b1bb6a74ba7
add esp, 4
xor eax, eax
lea esp, [ebp - 4]
pop esi
pop ebp
ret

Function at 0x1002c1e0
Capabilities:
Get disk size

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x18
mov ecx, dword [ebp + 8]
mov eax, dword [ecx + 8]
test eax, eax
je 0x1002c271
mov esi, dword [ecx + 4]
imul ebx, eax, 0x58
mov edi, esp
add esi, 0x38
jmp 0x1002c222
movsd xmm0, qword [esp]
movsd qword [esi + 8], xmm0
add esi, 0x58
add ebx, 0xffffffa8
je 0x1002c271
mov eax, dword [esi]
or eax, dword [esi + 4]
je 0x1002c21a
mov dword [esp + 4], 0
mov dword [esp], 0
push edi
push 0
push 0
push dword [esi + 0x14]
call sub.kernel32.dll_GetDiskFreeSpaceExW
test eax, eax
jne 0x1002c210
call sym.windows_result::error::Error::from_win32::h7d859e40b596e523
test edx, edx
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], edx
mov dword [esp + 8], 1
je 0x1002c21a
lea eax, [esp + 0x10]
push eax
call sym.__LT_windows_result..com..ComPtr_u20_as_u20_core..ops..drop..Drop_GT_::drop::hcb2d3b1bb6a74ba7
add esp, 4
jmp 0x1002c21a
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x1002c280
Capabilities:
Enumerate disk volumes

Disassembly:
push ebp
mov ebp, esp
pop ebp
jmp sym.sysinfo::windows::disk::DisksInner::refresh_list::h9f2b870bb643ae65

Function at 0x1002c440
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
pop ebp
jmp sym.sysinfo::windows::network::NetworksInner::refresh_list::h25d4fe8767e361ef
Function at 0x1002eea0
Capabilities:
Get logon sessions

Disassembly:
push ebp
mov ebp, esp
pop ebp
jmp sym.sysinfo::windows::users::get_users::h9c2ad4a47f5311f3

Function at 0x10030ef0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 8
mov eax, dword [ebp + 8]
mov esi, dword [eax]
test esi, esi
je 0x10030fc1
dec esi
push esi
call sub.kernel32.dll_TlsGetValue
cmp eax, 1
ja 0x10030fb9
je 0x10030fb7
mov eax, dword [ebp + 0xc]
test eax, eax
je 0x10030f46
mov ecx, dword [eax + 4]
mov edi, dword [eax + 8]
cmp dword [eax], 0
mov dword [eax], 0
je 0x10030f46
mov eax, edi
mov ebx, edi
mov dword [ebp - 0x10], ecx
shr eax, 0x10
shr ebx, 0x18
mov dword [ebp - 0x14], eax
jmp 0x10030f56
mov dword [ebp - 0x14], 0
xor edi, edi
mov dword [ebp - 0x10], 0
mov eax, dword [0x101918ac]
movzx eax, byte [eax]
push 4
push 0xc
call sym.___rust_alloc
add esp, 8
test eax, eax
je 0x10030fdd
movzx edx, byte [ebp - 0x14]
movzx ecx, bl
shl ecx, 0x18
shl edx, 0x10
or edx, ecx
movzx ecx, di
or ecx, edx
mov edx, dword [ebp - 0x10]
mov dword [eax + 4], ecx
mov dword [eax], edx
mov dword [eax + 8], esi
push esi
mov ebx, eax
call sub.kernel32.dll_TlsGetValue
mov edi, eax
mov dword [ebp - 0x10], ebx
push ebx
push esi
call sub.kernel32.dll_TlsSetValue
test edi, edi
je 0x10030fb2
push 4
push 0xc
push edi
call sym.___rust_dealloc
add esp, 0xc
mov eax, dword [ebp - 0x10]
jmp 0x10030fb9
xor eax, eax
add esp, 8
pop esi
pop edi
pop ebx
pop ebp
ret
push eax
call sym.std::sys::thread_local::key::windows::LazyKey::init::h8219056d8c3ded71
add esp, 4
mov esi, eax
push esi
call sub.kernel32.dll_TlsGetValue
cmp eax, 1
jbe 0x10030f16
jmp 0x10030fb9
push 0xc
push 4
call sym.alloc::alloc::handle_alloc_error::h9a0385ddba01e206
nop word cs:[eax + eax]
Function at 0x10030ff0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x30
mov eax, dword [ebp + 8]
mov esi, dword [eax]
test esi, esi
je 0x100310b2
dec esi
push esi
call sub.kernel32.dll_TlsGetValue
cmp eax, 1
ja 0x100310aa
je 0x100310a8
mov eax, dword [ebp + 0xc]
test eax, eax
je 0x1003103e
mov ecx, dword [eax]
movups xmm0, xmmword [eax + 8]
mov dword [eax], 0
or ecx, dword [eax + 4]
mov dword [eax + 4], 0
jne 0x10031058
xorps xmm0, xmm0
lea eax, [esp + 0x10]
movaps xmmword [esp + 0x10], xmm0
push 0x10
push eax
call dword [sym.imp.bcryptprimitives.dll_ProcessPrng]
movaps xmm0, xmmword [esp + 0x10]
mov eax, dword [0x101918ac]
movaps xmmword [esp], xmm0
movzx eax, byte [eax]
push 8
push 0x18
call sym.___rust_alloc
add esp, 8
test eax, eax
je 0x100310ce
movaps xmm0, xmmword [esp]
movups xmmword [eax], xmm0
mov dword [eax + 0x10], esi
push esi
mov ebx, eax
call sub.kernel32.dll_TlsGetValue
mov edi, eax
mov dword [esp], ebx
push ebx
push esi
call sub.kernel32.dll_TlsSetValue
test edi, edi
je 0x100310a3
push 8
push 0x18
push edi
call sym.___rust_dealloc
add esp, 0xc
mov eax, dword [esp]
jmp 0x100310aa
xor eax, eax
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
push eax
call sym.std::sys::thread_local::key::windows::LazyKey::init::h8219056d8c3ded71
add esp, 4
mov esi, eax
push esi
call sub.kernel32.dll_TlsGetValue
cmp eax, 1
jbe 0x10031019
jmp 0x100310aa
push 0x18
push 8
call sym.alloc::alloc::handle_alloc_error::h9a0385ddba01e206
nop word [eax + eax]
Function at 0x100310e0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
push eax
mov eax, dword [ebp + 8]
mov esi, dword [eax]
test esi, esi
je 0x100311a8
dec esi
push esi
call sub.kernel32.dll_TlsGetValue
cmp eax, 1
ja 0x100311a0
je 0x1003119e
mov eax, dword [ebp + 0xc]
test eax, eax
je 0x1003111f
mov edi, dword [eax + 4]
cmp dword [eax], 0
mov dword [eax], 0
jne 0x1003112f
call sym.crossbeam_epoch::default::default_collector::h88a65e9db30144e3
push eax
call sym.crossbeam_epoch::collector::Collector::register::hf710bc3755abbc29
add esp, 4
mov edi, eax
mov eax, dword [0x101918ac]
movzx eax, byte [eax]
push 4
push 8
call sym.___rust_alloc
add esp, 8
test eax, eax
je 0x100311c4
mov dword [eax], edi
mov dword [eax + 4], esi
push esi
mov ebx, eax
call sub.kernel32.dll_TlsGetValue
mov edi, eax
mov dword [ebp - 0x10], ebx
push ebx
push esi
call sub.kernel32.dll_TlsSetValue
test edi, edi
je 0x10031199
mov eax, dword [edi]
mov ecx, dword [eax + 0x410]
lea edx, [ecx - 1]
mov dword [eax + 0x410], edx
cmp dword [eax + 0x40c], 0
jne 0x1003118c
cmp ecx, 1
jne 0x1003118c
push eax
call sym.crossbeam_epoch::internal::Local::finalize::h4cdf2512459a4cf4
add esp, 4
push 4
push 8
push edi
call sym.___rust_dealloc
add esp, 0xc
mov eax, dword [ebp - 0x10]
jmp 0x100311a0
xor eax, eax
add esp, 4
pop esi
pop edi
pop ebx
pop ebp
ret
push eax
call sym.std::sys::thread_local::key::windows::LazyKey::init::h8219056d8c3ded71
add esp, 4
mov esi, eax
push esi
call sub.kernel32.dll_TlsGetValue
cmp eax, 1
jbe 0x10031104
jmp 0x100311a0
push 8
push 4
call sym.alloc::alloc::handle_alloc_error::h9a0385ddba01e206
add esp, 8
ud2

Function at 0x10031220
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
push eax
mov eax, dword [ebp + 8]
mov esi, dword [eax]
test esi, esi
je 0x100312a9
dec esi
push esi
call sub.kernel32.dll_TlsGetValue
cmp eax, 1
ja 0x100312a1
je 0x10031256
mov eax, dword [ebp + 0xc]
test eax, eax
je 0x1003125a
mov edi, dword [eax]
mov dword [eax], 0
test edi, edi
je 0x1003125c
mov edi, dword [eax + 4]
jmp 0x1003125c
xor eax, eax
jmp 0x100312a1
xor edi, edi
mov eax, dword [0x101918ac]
movzx eax, byte [eax]
push 4
push 8
call sym.___rust_alloc
add esp, 8
test eax, eax
je 0x100312c5
mov dword [eax], edi
mov dword [eax + 4], esi
push esi
mov ebx, eax
call sub.kernel32.dll_TlsGetValue
mov edi, eax
mov dword [ebp - 0x10], ebx
push ebx
push esi
call sub.kernel32.dll_TlsSetValue
test edi, edi
je 0x1003129e
push 4
push 8
push edi
call sym.___rust_dealloc
add esp, 0xc
mov eax, dword [ebp - 0x10]
add esp, 4
pop esi
pop edi
pop ebx
pop ebp
ret
push eax
call sym.std::sys::thread_local::key::windows::LazyKey::init::h8219056d8c3ded71
add esp, 4
mov esi, eax
push esi
call sub.kernel32.dll_TlsGetValue
cmp eax, 1
jbe 0x1003123c
jmp 0x100312a1
push 8
push 4
call sym.alloc::alloc::handle_alloc_error::h9a0385ddba01e206
nop
Function at 0x10031df0
Capabilities:
Get disk size

Disassembly:
push ebp
mov ebp, esp
push esi
and esp, 0xfffffff8
sub esp, 0x18
mov esi, dword [ebp + 8]
mov eax, dword [esi + 0x38]
or eax, dword [esi + 0x3c]
je 0x10031e5f
mov eax, esp
mov dword [esp + 4], 0
mov dword [esp], 0
push eax
push 0
push 0
push dword [esi + 0x4c]
call sub.kernel32.dll_GetDiskFreeSpaceExW
test eax, eax
je 0x10031e39
movsd xmm0, qword [esp]
mov al, 1
movsd qword [esi + 0x40], xmm0
lea esp, [ebp - 4]
pop esi
pop ebp
ret
call sym.windows_result::error::Error::from_win32::h7d859e40b596e523
test edx, edx
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], edx
mov dword [esp + 8], 1
je 0x10031e5f
lea eax, [esp + 0x10]
push eax
call sym.__LT_windows_result..com..ComPtr_u20_as_u20_core..ops..drop..Drop_GT_::drop::hcb2d3b1bb6a74ba7
add esp, 4
xor eax, eax
lea esp, [ebp - 4]
pop esi
pop ebp
ret
Function at 0x100322e0
Capabilities:
Get disk size

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x20
mov esi, dword [ebp + 8]
mov eax, dword [ebp + 0xc]
lea ecx, [esp + 8]
mov dword [esp + 4], 0
mov dword [esp], 0
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov edx, esp
push ecx
push edx
push 0
push eax
call sub.kernel32.dll_GetDiskFreeSpaceExW
test eax, eax
je 0x10032348
mov eax, dword [esp]
mov ecx, dword [esp + 4]
mov edx, dword [esp + 8]
mov edi, dword [esp + 0xc]
mov dword [esi + 8], eax
mov dword [esi + 0xc], ecx
mov dword [esi + 0x10], edx
mov dword [esi + 0x14], edi
xor ecx, ecx
mov eax, 1
jmp 0x10032372
call sym.windows_result::error::Error::from_win32::h7d859e40b596e523
test edx, edx
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], edx
mov dword [esp + 0x14], 1
je 0x1003236e
lea eax, [esp + 0x1c]
push eax
call sym.__LT_windows_result..com..ComPtr_u20_as_u20_core..ops..drop..Drop_GT_::drop::hcb2d3b1bb6a74ba7
add esp, 4
xor eax, eax
xor ecx, ecx
mov dword [esi], eax
mov dword [esi + 4], ecx
mov eax, esi
lea esp, [ebp - 8]
pop esi
pop edi
pop ebp
ret
Function at 0x100323d0
Capabilities:
List groups for user account

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x34
mov eax, dword [ebp + 0xc]
mov ebx, dword [ebp + 8]
cmp byte [eax + 0x28], 0
je 0x10032441
cmp dword [eax + 0x18], 0x80000000
je 0x10032441
mov eax, dword [eax + 0x1c]
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x30], 0
lea ecx, [ebp - 0x30]
lea edx, [ebp - 0x20]
lea esi, [ebp - 0x1c]
push ecx
push edx
push 0xffffffffffffffff
push esi
push 1
push 0
push eax
push 0x1016f0d4
call sub.netapi32.dll_NetUserGetLocalGroups
test eax, eax
je 0x1003245a
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 4
mov dword [ebp - 0x10], 0
jmp 0x1003257e
mov dword [ebx], 0
mov dword [ebx + 4], 4
mov dword [ebx + 8], 0
jmp 0x1003259a
mov esi, dword [ebp - 0x20]
test esi, esi
je 0x10032493
mov edi, esi
shl edi, 4
cmp esi, 0x7ffffff
ja 0x100325a4
mov eax, dword [0x101918ac]
movzx eax, byte [eax]
push 4
push edi
call sym.___rust_alloc
add esp, 8
test eax, eax
jne 0x10032498
mov eax, 4
jmp 0x100325a6
mov eax, 4
mov ecx, dword [ebp - 0x1c]
mov dword [ebp - 0x18], esi
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x10], 0
test ecx, ecx
mov dword [ebp - 0x28], ecx
je 0x100324cd
mov ebx, dword [ebp - 0x20]
cmp ebx, esi
jbe 0x100324e1
lea eax, [ebp - 0x18]
push ebx
push 0
push eax
call sym.alloc::raw_vec::RawVec_LT_T_C_A_GT_::reserve::do_reserve_and_handle::hd906aec19e32fa05
add esp, 0xc
mov eax, dword [ebp - 0x14]
mov esi, dword [ebp - 0x10]
jmp 0x100324eb
mov eax, dword [ebp - 0x10]
movsd xmm0, qword [ebp - 0x18]
mov dword [ebx + 8], eax
movsd qword [ebx], xmm0
jmp 0x1003259a
xor esi, esi
test ebx, ebx
je 0x10032578
mov ecx, esi
xor edi, edi
shl ecx, 4
lea eax, [ecx + eax + 0xc]
mov dword [ebp - 0x24], eax
jmp 0x10032520
mov ebx, dword [ebp - 0x24]
inc esi
mov dword [ebx + edi*4 - 0xc], ecx
mov dword [ebx + edi*4 - 8], edx
mov dword [ebx + edi*4 - 4], eax
mov dword [ebx + edi*4], 0
mov ebx, dword [ebp - 0x2c]
add edi, 4
dec ebx
je 0x10032578
mov eax, dword [ebp - 0x28]
mov edx, 1
mov ecx, 0
mov dword [ebp - 0x2c], ebx
mov eax, dword [eax + edi]
mov dword [ebp - 0x34], eax
test eax, eax
mov eax, 0
je 0x10032500
lea eax, [ebp - 0x34]
push eax
lea eax, [ebp - 0x40]
push eax
call sym.windows_core::strings::pwstr::PWSTR::to_string::h02b7a03b6d9d64fb
add esp, 8
mov ecx, dword [ebp - 0x40]
mov eax, dword [ebp - 0x38]
mov edx, 0
mov ebx, 1
cmp ecx, 0x80000000
cmove eax, edx
mov edx, dword [ebp - 0x3c]
cmove edx, ebx
mov ebx, 0
cmove ecx, ebx
jmp 0x10032500
mov ebx, dword [ebp + 8]
mov dword [ebp - 0x10], esi
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x10]
movsd xmm0, qword [ebp - 0x18]
test eax, eax
mov dword [ebx + 8], ecx
movsd qword [ebx], xmm0
je 0x1003259a
push eax
call sub.netapi32.dll_NetApiBufferFree
mov eax, ebx
add esp, 0x34
pop esi
pop edi
pop ebx
pop ebp
ret
xor eax, eax
push edi
push eax
call sym.alloc::raw_vec::handle_error::hfb8b40974975e9a6
add esp, 8
ud2
Function at 0x10033950
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push esi
push eax
xor ecx, ecx
call sym.__ZN3std4hash6random11RandomState3new4KEYS28__u7b__u7b_closure_u7d__u7d_17h33bf36553137e78cE.llvm.12732621686502660774
test eax, eax
je 0x100339a5
mov ecx, eax
mov eax, dword [ebp + 8]
movsd xmm3, qword [0x1016f1b8]
movsd xmm2, qword [0x1016f1b0]
movdqu xmm0, xmmword [ecx]
movd esi, xmm0
pshufd xmm1, xmm0, 0x55
add esi, 1
movd edx, xmm1
adc edx, 0
mov dword [ecx], esi
mov dword [ecx + 4], edx
movsd qword [eax + 8], xmm3
movsd qword [eax], xmm2
movdqu xmmword [eax + 0x10], xmm0
add esp, 4
pop esi
pop ebp
ret
lea eax, [ebp - 5]
push 0x1016f178
push 0x1016f188
push eax
push 0x46
push 0x1016f0e0
call sym.core::result::unwrap_failed::h5441fa6e1130b119
nop
Function at 0x100354d0
Capabilities:
Get local ipv4 addresses

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x38
xor ebx, ebx
xor esi, esi
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0x14], 0x3c00
nop word [eax + eax]
push dword [ebp - 0x14]
push ebx
call sub.msvcrt.dll_realloc
add esp, 8
test eax, eax
je 0x1003558a
mov edi, eax
lea eax, [ebp - 0x14]
push eax
push edi
push 0
push 0xe
push 0
call sub.iphlpapi.dll_GetAdaptersAddresses
test eax, eax
mov dword [ebp - 0x18], eax
je 0x100355d2
cmp esi, 1
ja 0x1003552e
inc esi
cmp eax, 0x6f
mov ebx, edi
je 0x100354f0
lea eax, [ebp - 0x18]
mov dword [ebp - 0x44], 0x1016f2a0
mov dword [ebp - 0x40], 1
mov dword [ebp - 0x34], 0
mov dword [ebp - 0x20], eax
lea eax, [ebp - 0x20]
mov dword [ebp - 0x1c], sym.core::fmt::num::imp::__LT_impl_u20_core..fmt..Display_u20_for_u20_u32_GT_::fmt::hde7cfeaa5e335763
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0x38], 1
lea eax, [ebp - 0x44]
lea ecx, [ebp - 0x2c]
push eax
push ecx
call sym.alloc::fmt::format::format_inner::h50f5774af0e74e13
add esp, 8
mov eax, dword [ebp - 0x24]
mov ecx, dword [ebp - 0x10]
movsd xmm0, qword [ebp - 0x2c]
mov dword [ecx + 8], eax
movsd qword [ecx], xmm0
push edi
call sub.msvcrt.dll_free
add esp, 4
jmp 0x100355e1
mov eax, dword [0x101918ac]
movzx eax, byte [eax]
push 1
push 0x32
call sym.___rust_alloc
add esp, 8
test eax, eax
je 0x100355e9
mov edi, eax
push 0x32
push 0x1016f244
push eax
call sub.msvcrt.dll_memcpy
add esp, 0xc
push ebx
call sub.msvcrt.dll_free
add esp, 4
mov eax, dword [ebp - 0x10]
mov dword [eax], 0x32
mov dword [eax + 4], edi
mov dword [eax + 8], 0x32
jmp 0x100355e1
mov eax, dword [ebp - 0x10]
mov dword [eax + 4], edi
mov dword [eax + 8], edi
mov dword [eax], 0x80000000
add esp, 0x38
pop esi
pop edi
pop ebx
pop ebp
ret
push 0x32
push 1
call sym.alloc::raw_vec::handle_error::hfb8b40974975e9a6
add esp, 8
ud2
Function at 0x1003a900
Capabilities:
Connect to wmi namespace via wbemlocator

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x18
mov esi, edx
mov edi, ecx
mov dword [ebp - 0x24], 1
mov dword [ebp - 0x10], 0
mov dword [ebp - 0x20], 0
lea eax, [ebp - 0x10]
push eax
push 0x1016f6f8
push 1
push 0
push 0x1016f708
call sub.ole32.dll_CoCreateInstance
test eax, eax
js 0x1003a968
mov ebx, dword [ebp - 0x10]
test ebx, ebx
je 0x1003a998
cmp dword [esi], 0
je 0x1003a952
push esi
call sym.__LT_windows_core..unknown..IUnknown_u20_as_u20_core..ops..drop..Drop_GT_::drop::hb12115a0a737be14
add esp, 4
mov dword [esi], ebx
movsd xmm0, qword [esi + 8]
movsd xmm1, qword [esi]
movsd qword [edi + 8], xmm0
movsd qword [edi], xmm1
jmp 0x1003a9ca
lea ebx, [ebp - 0x20]
push eax
call sym.__ZN108__LT_windows_result..error..Error_u20_as_u20_core..convert..From_LT_windows_result..hresult..HRESULT_GT__GT_4from17h6b5
add esp, 4
cmp dword [ebp - 0x24], 0
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], edx
mov dword [ebp - 0x1c], 1
jne 0x1003a990
push ebx
call sym.__LT_windows_core..unknown..IUnknown_u20_as_u20_core..ops..drop..Drop_GT_::drop::hb12115a0a737be14
add esp, 4
cmp dword [ebp - 0x14], 0
jne 0x1003a9b3
jmp 0x1003a9bf
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x1c], 1
cmp dword [ebp - 0x14], 0
je 0x1003a9bf
lea eax, [ebp - 0x14]
push eax
call sym.__LT_windows_result..com..ComPtr_u20_as_u20_core..ops..drop..Drop_GT_::drop::hcb2d3b1bb6a74ba7
add esp, 4
mov byte [edi + 0xc], 2
mov ecx, esi
call sym.core::ptr::drop_in_place_LT_sysinfo..windows..component..Connection_GT_::hec2e1ca3a921b631
add esp, 0x18
pop esi
pop edi
pop ebx
pop ebp
ret