joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1001f1e0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 8
mov eax, dword [ebp + 8]
mov esi, dword [eax]
test esi, esi
je 0x1001f2aa
dec esi
push esi
call sub.kernel32.dll_TlsGetValue
cmp eax, 1
ja 0x1001f2a2
je 0x1001f2a0
mov eax, dword [ebp + 0xc]
test eax, eax
je 0x1001f233
mov edi, dword [eax + 4]
mov ebx, dword [eax + 8]
test byte [eax], 1
mov dword [eax], 0
je 0x1001f233
mov eax, ebx
shr eax, 0x10
mov dword [ebp - 0x10], eax
mov eax, ebx
shr eax, 0x18
jmp 0x1001f23e
mov dword [ebp - 0x10], 0
xor ebx, ebx
xor edi, edi
mov dword [ebp - 0x14], eax
mov eax, dword [0x1017b554]
movzx eax, byte [eax]
push 4
push 0xc
call sym.___rust_alloc
add esp, 8
test eax, eax
je 0x1001f2c6
movzx ecx, byte [ebp - 0x14]
movzx edx, byte [ebp - 0x10]
mov dword [eax], edi
shl ecx, 0x18
shl edx, 0x10
or edx, ecx
movzx ecx, bx
or ecx, edx
mov dword [eax + 4], ecx
mov dword [eax + 8], esi
push esi
mov ebx, eax
call sub.kernel32.dll_TlsGetValue
mov edi, eax
mov dword [ebp - 0x10], ebx
push ebx
push esi
call sub.kernel32.dll_TlsSetValue
test edi, edi
je 0x1001f29b
push 4
push 0xc
push edi
call sym.___rust_dealloc
add esp, 0xc
mov eax, dword [ebp - 0x10]
jmp 0x1001f2a2
xor eax, eax
add esp, 8
pop esi
pop edi
pop ebx
pop ebp
ret
push eax
call sym.std::sys::thread_local::key::windows::LazyKey::init::h0bd71fcfbfc5b9bd
add esp, 4
mov esi, eax
push esi
call sub.kernel32.dll_TlsGetValue
cmp eax, 1
jbe 0x1001f206
jmp 0x1001f2a2
push 0xc
push 4
call sym.alloc::alloc::handle_alloc_error::h3ca6a9ac69c8e3db
nop

Function at 0x1001f2d0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x30
mov eax, dword [ebp + 8]
mov esi, dword [eax]
test esi, esi
je 0x1001f390
dec esi
push esi
call sub.kernel32.dll_TlsGetValue
cmp eax, 1
ja 0x1001f388
je 0x1001f386
mov eax, dword [ebp + 0xc]
test eax, eax
je 0x1001f31c
movups xmm0, xmmword [eax + 8]
test byte [eax], 1
mov dword [eax + 4], 0
mov dword [eax], 0
jne 0x1001f336
xorps xmm0, xmm0
lea eax, [esp + 0x10]
movaps xmmword [esp + 0x10], xmm0
push 0x10
push eax
call dword [sym.imp.bcryptprimitives.dll_ProcessPrng]
movaps xmm0, xmmword [esp + 0x10]
mov eax, dword [0x1017b554]
movaps xmmword [esp], xmm0
movzx eax, byte [eax]
push 8
push 0x18
call sym.___rust_alloc
add esp, 8
test eax, eax
je 0x1001f3ac
movaps xmm0, xmmword [esp]
movups xmmword [eax], xmm0
mov dword [eax + 0x10], esi
push esi
mov ebx, eax
call sub.kernel32.dll_TlsGetValue
mov edi, eax
mov dword [esp], ebx
push ebx
push esi
call sub.kernel32.dll_TlsSetValue
test edi, edi
je 0x1001f381
push 8
push 0x18
push edi
call sym.___rust_dealloc
add esp, 0xc
mov eax, dword [esp]
jmp 0x1001f388
xor eax, eax
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
push eax
call sym.std::sys::thread_local::key::windows::LazyKey::init::h0bd71fcfbfc5b9bd
add esp, 4
mov esi, eax
push esi
call sub.kernel32.dll_TlsGetValue
cmp eax, 1
jbe 0x1001f2f9
jmp 0x1001f388
push 0x18
push 8
call sym.alloc::alloc::handle_alloc_error::h3ca6a9ac69c8e3db
nop word cs:[eax + eax]
nop
Function at 0x1001f3c0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
push eax
mov eax, dword [ebp + 8]
mov esi, dword [eax]
test esi, esi
je 0x1001f485
dec esi
push esi
call sub.kernel32.dll_TlsGetValue
cmp eax, 1
ja 0x1001f47d
je 0x1001f47b
mov eax, dword [ebp + 0xc]
test eax, eax
je 0x1001f3ff
mov edi, dword [eax + 4]
test byte [eax], 1
mov dword [eax], 0
jne 0x1001f40f
call sym.crossbeam_epoch::default::default_collector::h47c0013e95ba7b53
push eax
call sym.crossbeam_epoch::collector::Collector::register::h4e396c7835104434
add esp, 4
mov edi, eax
mov eax, dword [0x1017b554]
movzx eax, byte [eax]
push 4
push 8
call sym.___rust_alloc
add esp, 8
test eax, eax
je 0x1001f4a1
mov dword [eax], edi
mov dword [eax + 4], esi
push esi
mov ebx, eax
call sub.kernel32.dll_TlsGetValue
mov edi, eax
mov dword [ebp - 0x10], ebx
push ebx
push esi
call sub.kernel32.dll_TlsSetValue
test edi, edi
je 0x1001f476
mov eax, dword [edi]
mov ecx, dword [eax + 0x410]
lea edx, [ecx - 1]
xor ecx, 1
mov dword [eax + 0x410], edx
or ecx, dword [eax + 0x40c]
jne 0x1001f469
push eax
call sym.crossbeam_epoch::internal::Local::finalize::hb03cf478c23a69a0
add esp, 4
push 4
push 8
push edi
call sym.___rust_dealloc
add esp, 0xc
mov eax, dword [ebp - 0x10]
jmp 0x1001f47d
xor eax, eax
add esp, 4
pop esi
pop edi
pop ebx
pop ebp
ret
push eax
call sym.std::sys::thread_local::key::windows::LazyKey::init::h0bd71fcfbfc5b9bd
add esp, 4
mov esi, eax
push esi
call sub.kernel32.dll_TlsGetValue
cmp eax, 1
jbe 0x1001f3e4
jmp 0x1001f47d
push 8
push 4
call sym.alloc::alloc::handle_alloc_error::h3ca6a9ac69c8e3db
add esp, 8
ud2

Function at 0x1001f500
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
push eax
mov eax, dword [ebp + 8]
mov esi, dword [eax]
test esi, esi
je 0x1001f589
dec esi
push esi
call sub.kernel32.dll_TlsGetValue
cmp eax, 1
ja 0x1001f581
je 0x1001f536
mov eax, dword [ebp + 0xc]
test eax, eax
je 0x1001f53a
mov edi, dword [eax]
mov dword [eax], 0
test edi, edi
je 0x1001f53c
mov edi, dword [eax + 4]
jmp 0x1001f53c
xor eax, eax
jmp 0x1001f581
xor edi, edi
mov eax, dword [0x1017b554]
movzx eax, byte [eax]
push 4
push 8
call sym.___rust_alloc
add esp, 8
test eax, eax
je 0x1001f5a5
mov dword [eax], edi
mov dword [eax + 4], esi
push esi
mov ebx, eax
call sub.kernel32.dll_TlsGetValue
mov edi, eax
mov dword [ebp - 0x10], ebx
push ebx
push esi
call sub.kernel32.dll_TlsSetValue
test edi, edi
je 0x1001f57e
push 4
push 8
push edi
call sym.___rust_dealloc
add esp, 0xc
mov eax, dword [ebp - 0x10]
add esp, 4
pop esi
pop edi
pop ebx
pop ebp
ret
push eax
call sym.std::sys::thread_local::key::windows::LazyKey::init::h0bd71fcfbfc5b9bd
add esp, 4
mov esi, eax
push esi
call sub.kernel32.dll_TlsGetValue
cmp eax, 1
jbe 0x1001f51c
jmp 0x1001f581
push 8
push 4
call sym.alloc::alloc::handle_alloc_error::h3ca6a9ac69c8e3db
nop
Function at 0x1001f620
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
push esi
sub esp, 0x11c
mov eax, dword [ebp + 8]
mov eax, dword [eax]
mov esi, dword [eax]
mov dword [eax], 0
test esi, esi
je 0x1001f697
lea eax, [ebp - 0x11c]
push 0x118
push 0
push eax
call sub.msvcrt.dll_memset
add esp, 0xc
lea eax, [ebp - 0x120]
mov dword [ebp - 0x120], 0x11c
push eax
call sub.ntdll.dll_RtlGetVersion
test eax, eax
js 0x1001f686
mov ecx, dword [ebp - 0x11c]
mov al, 1
cmp ecx, 6
ja 0x1001f68c
jne 0x1001f68a
cmp dword [ebp - 0x118], 3
setae al
jmp 0x1001f68c
mov al, 1
jmp 0x1001f68c
xor eax, eax
mov byte [esi], al
add esp, 0x11c
pop esi
pop ebp
ret
push 0x10159440
call sym.core::option::unwrap_failed::h4002a2165d665d64
nop word cs:[eax + eax]
nop dword [eax + eax]

Function at 0x1001f800
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
push esi
sub esp, 0x11c
mov eax, dword [ebp + 8]
mov eax, dword [eax]
mov esi, dword [eax]
mov dword [eax], 0
test esi, esi
je 0x1001f877
lea eax, [ebp - 0x11c]
push 0x118
push 0
push eax
call sub.msvcrt.dll_memset
add esp, 0xc
lea eax, [ebp - 0x120]
mov dword [ebp - 0x120], 0x11c
push eax
call sub.ntdll.dll_RtlGetVersion
test eax, eax
js 0x1001f866
mov ecx, dword [ebp - 0x11c]
mov al, 1
cmp ecx, 6
ja 0x1001f86c
jne 0x1001f86a
cmp dword [ebp - 0x118], 3
setae al
jmp 0x1001f86c
mov al, 1
jmp 0x1001f86c
xor eax, eax
mov byte [esi], al
add esp, 0x11c
pop esi
pop ebp
ret
push 0x10159440
call sym.core::option::unwrap_failed::h4002a2165d665d64
nop word cs:[eax + eax]
nop dword [eax + eax]
Function at 0x1001ff50
Capabilities:
Get disk size

Disassembly:
push ebp
mov ebp, esp
push esi
and esp, 0xfffffff8
sub esp, 0x18
mov esi, dword [ebp + 8]
mov eax, dword [esi + 0x38]
or eax, dword [esi + 0x3c]
je 0x1001ffbf
mov eax, esp
mov dword [esp + 4], 0
mov dword [esp], 0
push eax
push 0
push 0
push dword [esi + 0x4c]
call sub.kernel32.dll_GetDiskFreeSpaceExW
test eax, eax
je 0x1001ff99
movsd xmm0, qword [esp]
mov al, 1
movsd qword [esi + 0x40], xmm0
lea esp, [ebp - 4]
pop esi
pop ebp
ret
call sym.windows_result::error::Error::from_win32::h82b0b4b9d87e3c47
test edx, edx
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], edx
mov dword [esp + 8], 1
je 0x1001ffbf
lea eax, [esp + 0x10]
push eax
call sym.__LT_windows_result..com..ComPtr_u20_as_u20_core..ops..drop..Drop_GT_::drop::h9cbffdb6c4b299b4
add esp, 4
xor eax, eax
lea esp, [ebp - 4]
pop esi
pop ebp
ret
Function at 0x10020440
Capabilities:
Get disk size

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x20
mov esi, dword [ebp + 8]
mov eax, dword [ebp + 0xc]
lea ecx, [esp + 8]
mov dword [esp + 4], 0
mov dword [esp], 0
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov edx, esp
push ecx
push edx
push 0
push eax
call sub.kernel32.dll_GetDiskFreeSpaceExW
test eax, eax
je 0x100204a8
mov eax, dword [esp]
mov ecx, dword [esp + 4]
mov edx, dword [esp + 8]
mov edi, dword [esp + 0xc]
mov dword [esi + 8], eax
mov dword [esi + 0xc], ecx
mov dword [esi + 0x10], edx
mov dword [esi + 0x14], edi
xor ecx, ecx
mov eax, 1
jmp 0x100204d2
call sym.windows_result::error::Error::from_win32::h82b0b4b9d87e3c47
test edx, edx
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], edx
mov dword [esp + 0x14], 1
je 0x100204ce
lea eax, [esp + 0x1c]
push eax
call sym.__LT_windows_result..com..ComPtr_u20_as_u20_core..ops..drop..Drop_GT_::drop::h9cbffdb6c4b299b4
add esp, 4
xor eax, eax
xor ecx, ecx
mov dword [esi], eax
mov dword [esi + 4], ecx
mov eax, esi
lea esp, [ebp - 8]
pop esi
pop edi
pop ebp
ret
Function at 0x10020530
Capabilities:
List groups for user account

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x34
mov eax, dword [ebp + 0xc]
xor ecx, ecx
mov ebx, dword [ebp + 8]
cmp ecx, dword [eax + 0x18]
jo 0x1002059f
cmp byte [eax + 0x28], 0
je 0x1002059f
mov eax, dword [eax + 0x1c]
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x30], 0
lea ecx, [ebp - 0x30]
lea edx, [ebp - 0x20]
lea esi, [ebp - 0x1c]
push ecx
push edx
push 0xffffffffffffffff
push esi
push 1
push 0
push eax
push 0x101594d8
call sub.netapi32.dll_NetUserGetLocalGroups
test eax, eax
je 0x100205b8
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 4
mov dword [ebp - 0x10], 0
jmp 0x100206ec
mov dword [ebx], 0
mov dword [ebx + 4], 4
mov dword [ebx + 8], 0
jmp 0x10020708
mov esi, dword [ebp - 0x20]
xor eax, eax
mov edi, esi
shl edi, 4
cmp esi, 0xfffffff
ja 0x100205f2
cmp edi, 0x7ffffffc
ja 0x100205f2
test edi, edi
je 0x100205fe
mov eax, dword [0x1017b554]
movzx eax, byte [eax]
push 4
push edi
call sym.___rust_alloc
add esp, 8
test eax, eax
jne 0x10020605
mov eax, 4
push edi
push eax
call sym.alloc::raw_vec::handle_error::he63c9115d026ec98
add esp, 8
ud2
mov eax, 4
xor esi, esi
mov ecx, dword [ebp - 0x1c]
mov dword [ebp - 0x18], esi
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x10], 0
test ecx, ecx
mov dword [ebp - 0x28], ecx
je 0x1002063e
mov ebx, dword [ebp - 0x20]
cmp esi, ebx
jae 0x10020652
lea eax, [ebp - 0x18]
push 0x10
push 4
push ebx
push 0
push eax
call sym.alloc::raw_vec::RawVecInner_LT_A_GT_::reserve::do_reserve_and_handle::h84a9ac707e9bac7a
add esp, 0x14
mov eax, dword [ebp - 0x14]
mov esi, dword [ebp - 0x10]
jmp 0x1002065c
mov eax, dword [ebp - 0x10]
movsd xmm0, qword [ebp - 0x18]
mov dword [ebx + 8], eax
movsd qword [ebx], xmm0
jmp 0x10020708
xor esi, esi
test ebx, ebx
je 0x100206e6
mov ecx, esi
xor edi, edi
shl ecx, 4
lea eax, [ecx + eax + 0xc]
mov dword [ebp - 0x24], eax
jmp 0x10020690
mov ebx, dword [ebp - 0x24]
inc esi
mov dword [ebx + edi*4 - 0xc], ecx
mov dword [ebx + edi*4 - 8], edx
mov dword [ebx + edi*4 - 4], eax
mov dword [ebx + edi*4], 0
mov ebx, dword [ebp - 0x2c]
add edi, 4
dec ebx
je 0x100206e6
mov eax, dword [ebp - 0x28]
mov edx, 1
mov ecx, 0
mov dword [ebp - 0x2c], ebx
mov eax, dword [eax + edi]
mov dword [ebp - 0x34], eax
test eax, eax
mov eax, 0
je 0x10020670
lea eax, [ebp - 0x34]
push eax
lea eax, [ebp - 0x40]
push eax
call sym.windows_core::strings::pwstr::PWSTR::to_string::hc98fbd9c8eb4e383
add esp, 8
mov ecx, dword [ebp - 0x40]
mov edx, 0
mov ebx, 1
mov eax, ecx
neg eax
mov eax, dword [ebp - 0x38]
cmovo eax, edx
mov edx, dword [ebp - 0x3c]
cmovo edx, ebx
mov ebx, 0
cmovo ecx, ebx
jmp 0x10020670
mov ebx, dword [ebp + 8]
mov dword [ebp - 0x10], esi
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x10]
movsd xmm0, qword [ebp - 0x18]
test eax, eax
mov dword [ebx + 8], ecx
movsd qword [ebx], xmm0
je 0x10020708
push eax
call sub.netapi32.dll_NetApiBufferFree
mov eax, ebx
add esp, 0x34
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x10026780
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x28
mov esi, ecx
lea eax, [ebp - 0x24]
push eax
push edx
call sub.shell32.dll_CommandLineToArgvW
test eax, eax
mov dword [ebp - 0x1c], eax
je 0x10026842
mov ebx, dword [ebp - 0x24]
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 4
mov dword [ebp - 0x20], esi
mov dword [ebp - 0x10], 0
test ebx, ebx
je 0x10026826
mov edi, dword [ebp - 0x1c]
shl ebx, 2
jmp 0x100267f9
mov eax, dword [ebp - 0x14]
movsd xmm0, qword [ebp - 0x34]
movsd xmm1, qword [ebp - 0x2c]
mov ecx, esi
add edi, 4
inc esi
shl ecx, 4
add ebx, 0xfffffffc
movsd qword [eax + ecx + 8], xmm1
movsd qword [eax + ecx], xmm0
mov dword [ebp - 0x10], esi
je 0x10026826
push edi
call sym.windows_core::strings::pwstr::PWSTR::as_wide::h84c12c18066dfb98
add esp, 4
push edx
push eax
lea eax, [ebp - 0x34]
push eax
call sym.__LT_std..ffi..os_str..OsString_u20_as_u20_std..os..windows..ffi..OsStringExt_GT_::from_wide::h63b25de594ca01f2
add esp, 0xc
mov esi, dword [ebp - 0x10]
cmp esi, dword [ebp - 0x18]
jne 0x100267d0
lea eax, [ebp - 0x18]
push eax
call sym.alloc::raw_vec::RawVec_LT_T_C_A_GT_::grow_one::h108cf7bcbf505b92
add esp, 4
jmp 0x100267d0
push dword [ebp - 0x1c]
call sub.kernel32.dll_LocalFree
movsd xmm0, qword [ebp - 0x18]
mov ecx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x10]
movsd qword [ecx], xmm0
mov dword [ecx + 8], eax
jmp 0x10026856
mov dword [esi], 0
mov dword [esi + 4], 4
mov dword [esi + 8], 0
add esp, 0x28
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x1002b2f0
Capabilities:
Get memory capacity

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x60
movzx ebx, byte [ebp + 0x10]
mov esi, dword [ebp + 8]
cmp byte [ebp + 0xc], 0
je 0x1002b370
xorps xmm0, xmm0
lea eax, [esp + 0x10]
movaps xmmword [esp + 0x10], xmm0
movaps xmmword [esp + 0x40], xmm0
movaps xmmword [esp + 0x30], xmm0
movaps xmmword [esp + 0x20], xmm0
mov dword [esp + 0x10], 0x40
push eax
call sub.kernel32.dll_GlobalMemoryStatusEx
test eax, eax
je 0x1002b341
movups xmm0, xmmword [esp + 0x18]
movups xmmword [esi + 0x40], xmm0
jmp 0x1002b370
call sym.windows_result::error::Error::from_win32::h82b0b4b9d87e3c47
movups xmm0, xmmword [esp + 0x18]
test edx, edx
mov dword [esp + 8], eax
mov dword [esp + 0xc], edx
mov dword [esp + 4], 1
movups xmmword [esi + 0x40], xmm0
je 0x1002b370
lea eax, [esp + 0xc]
push eax
call sym.__LT_windows_result..com..ComPtr_u20_as_u20_core..ops..drop..Drop_GT_::drop::h9cbffdb6c4b299b4
add esp, 4
test bl, bl
je 0x1002b3d9
xorps xmm0, xmm0
lea eax, [esp + 0x10]
movsd qword [esp + 0x40], xmm0
xorps xmm0, xmm0
movaps xmmword [esp + 0x30], xmm0
movaps xmmword [esp + 0x20], xmm0
movaps xmmword [esp + 0x10], xmm0
push 0x38
push eax
call sub.kernel32.dll_K32GetPerformanceInfo
test eax, eax
je 0x1002b3d9
mov edi, dword [esp + 0x20]
mov eax, dword [esp + 0x18]
mov ebx, dword [esp + 0x38]
xor ecx, ecx
mov edx, 0
sub eax, edi
sbb edx, edx
cmovb eax, ecx
mul ebx
mov dword [esi + 0x50], eax
mov eax, dword [esp + 0x14]
mov dword [esi + 0x54], edx
mov edx, 0
sub eax, edi
sbb edx, edx
cmovb eax, ecx
mul ebx
mov dword [esi + 0x5c], edx
mov dword [esi + 0x58], eax
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x1002c550
Capabilities:
Get hostname

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x20
mov dword [ebp - 0x14], 0
lea eax, [ebp - 0x14]
push eax
push 0
push 5
call sub.kernel32.dll_GetComputerNameExW
xor edi, edi
test eax, eax
mov eax, 0
jne 0x1002c588
call sym.windows_result::error::Error::from_win32::h82b0b4b9d87e3c47
mov dword [ebp - 0x1c], eax
mov eax, 1
mov dword [ebp - 0x18], edx
mov ebx, dword [ebp - 0x14]
mov dword [ebp - 0x20], eax
lea esi, [ebx + ebx]
test ebx, ebx
js 0x1002c6c8
cmp esi, 0x7ffffffe
ja 0x1002c6c8
test esi, esi
je 0x1002c5c3
push 2
push esi
call sym.___rust_alloc_zeroed
add esp, 8
test eax, eax
je 0x1002c6c3
mov edi, eax
mov dword [ebp - 0x10], ebx
jmp 0x1002c5cf
mov edi, 2
mov dword [ebp - 0x10], 0
lea eax, [ebp - 0x14]
push eax
push edi
push 5
call sub.kernel32.dll_GetComputerNameExW
test eax, eax
je 0x1002c626
xor eax, eax
test ebx, ebx
je 0x1002c5ff
nop word cs:[eax + eax]
nop
cmp word [edi + eax*2], 0
je 0x1002c5ff
inc eax
add esi, 0xfffffffe
jne 0x1002c5f0
mov eax, ebx
lea ecx, [ebp - 0x2c]
push eax
push edi
push ecx
mov ebx, dword [ebp - 0x10]
call sym.alloc::string::String::from_utf16::h962af4e330e52bed
add esp, 0xc
mov esi, dword [ebp + 8]
xor eax, eax
cmp eax, dword [ebp - 0x2c]
jno 0x1002c680
mov dword [esi], 0x80000000
test ebx, ebx
jne 0x1002c693
jmp 0x1002c6a1
mov ebx, dword [ebp - 0x10]
call sym.windows_result::error::Error::from_win32::h82b0b4b9d87e3c47
mov esi, dword [ebp + 8]
test edx, edx
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x24], edx
mov dword [ebp - 0x2c], 1
je 0x1002c64e
lea eax, [ebp - 0x24]
push eax
call sym.__LT_windows_result..com..ComPtr_u20_as_u20_core..ops..drop..Drop_GT_::drop::h9cbffdb6c4b299b4
add esp, 4
test ebx, ebx
je 0x1002c660
add ebx, ebx
push 2
push ebx
push edi
call sym.___rust_dealloc
add esp, 0xc
cmp dword [ebp - 0x20], 0
je 0x1002c678
cmp dword [ebp - 0x18], 0
je 0x1002c678
lea eax, [ebp - 0x18]
push eax
call sym.__LT_windows_result..com..ComPtr_u20_as_u20_core..ops..drop..Drop_GT_::drop::h9cbffdb6c4b299b4
add esp, 4
mov dword [esi], 0x80000000
jmp 0x1002c6b9
mov eax, dword [ebp - 0x24]
movsd xmm0, qword [ebp - 0x2c]
mov dword [esi + 8], eax
movsd qword [esi], xmm0
test ebx, ebx
je 0x1002c6a1
add ebx, ebx
push 2
push ebx
push edi
call sym.___rust_dealloc
add esp, 0xc
cmp dword [ebp - 0x20], 0
je 0x1002c6b9
cmp dword [ebp - 0x18], 0
je 0x1002c6b9
lea eax, [ebp - 0x18]
push eax
call sym.__LT_windows_result..com..ComPtr_u20_as_u20_core..ops..drop..Drop_GT_::drop::h9cbffdb6c4b299b4
add esp, 4
mov eax, esi
add esp, 0x20
pop esi
pop edi
pop ebx
pop ebp
ret
mov edi, 2
push esi
push edi
call sym.alloc::raw_vec::handle_error::he63c9115d026ec98
add esp, 8
ud2
Function at 0x1002ca30
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x24
mov esi, dword [ebp + 8]
call 0x1002ca41
pop edi
lea ebx, [ebp - 0x30]
push ebx
call sym.__ZN108__LT_windows..Win32..System..SystemInformation..NUMA_NODE_RELATIONSHIP_u20_as_u20_core..default..Default_GT_7default17h
add esp, 4
push ebx
call sub.kernel32.dll_GetSystemInfo
movzx eax, word [ebp - 0x30]
cmp eax, 0xe
ja 0x1002cc4f
add edi, dword [eax*4 + 0x1002cc8c]
jmp edi
mov dword [esi], 0x80000000
mov eax, esi
add esp, 0x24
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x1003b980
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
push esi
mov edx, dword [ebp + 0xc]
mov eax, dword [ebp + 8]
test byte [edx], 1
je 0x1003b9bc
mov ecx, dword [edx + 0x14]
movsd xmm0, qword [edx + 4]
movsd xmm1, qword [edx + 0xc]
mov esi, dword [edx + 0x18]
movzx edx, word [edx + 0x1c]
movsd qword [eax + 0x10], xmm1
movsd qword [eax + 8], xmm0
mov dword [eax + 0x18], esi
rol dx, 8
bswap ecx
mov si, 0x17
jmp 0x1003b9d9
mov ecx, dword [edx + 2]
movzx edx, word [edx + 6]
mov dword [eax + 0xc], 0
mov dword [eax + 8], 0
mov si, 2
rol dx, 8
mov word [eax], si
mov word [eax + 2], dx
mov dword [eax + 4], ecx
pop esi
pop ebp
ret
Function at 0x1004de80
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
mov esi, dword [ebp + 8]
mov eax, dword [esi]
mov edi, dword [esi + 0x40]
xor edi, eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push esi
call sym.crossbeam_deque::deque::Injector_LT_T_GT_::push::h74568a0313a9f1ee
add esp, 0xc
mfence
nop word cs:[eax + eax]
nop dword [eax + eax]
mov eax, dword [esi + 0xb8]
test eax, 0x10000
jne 0x1004dedc
mov ecx, eax
or ecx, 0x10000
lock cmpxchg dword [esi + 0xb8], ecx
jne 0x1004deb0
mov eax, ecx
and eax, 0xff
jne 0x1004dee7
pop esi
pop edi
pop ebp
ret
mov ecx, eax
mov eax, ecx
and eax, 0xff
je 0x1004ded8
cmp edi, 1
ja 0x1004def3
movzx ecx, ch
cmp ecx, eax
jne 0x1004ded8
add esi, 0xac
push 1
push esi
call sym.rayon_core::sleep::Sleep::wake_any_threads::h57caca7de924bfe9
add esp, 8
pop esi
pop edi
pop ebp
ret
Function at 0x10050a30
Capabilities:
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
mov edi, dword [ebp + 8]
mov esi, dword [edi + 4]
push 1
push esi
call sub.kernel32.dll_TlsSetValue
push 4
push 8
push edi
call sym.___rust_dealloc
add esp, 0xc
push 0
push esi
call sub.kernel32.dll_TlsSetValue
pop esi
pop edi
pop ebp
ret

Function at 0x10050a60
Capabilities:
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
mov edi, dword [ebp + 8]
mov esi, dword [edi + 8]
push 1
push esi
call sub.kernel32.dll_TlsSetValue
push 4
push 0xc
push edi
call sym.___rust_dealloc
add esp, 0xc
push 0
push esi
call sub.kernel32.dll_TlsSetValue
pop esi
pop edi
pop ebp
ret

Function at 0x10050a90
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
push eax
mov eax, dword [ebp + 8]
mov esi, dword [eax]
test esi, esi
je 0x10050b55
dec esi
push esi
call sub.kernel32.dll_TlsGetValue
cmp eax, 1
ja 0x10050b4d
je 0x10050b4b
mov eax, dword [ebp + 0xc]
test eax, eax
je 0x10050acf
mov edi, dword [eax + 4]
test byte [eax], 1
mov dword [eax], 0
jne 0x10050adf
call sym.crossbeam_epoch::default::default_collector::h47c0013e95ba7b53
push eax
call sym.crossbeam_epoch::collector::Collector::register::h4e396c7835104434
add esp, 4
mov edi, eax
mov eax, dword [0x1017b554]
movzx eax, byte [eax]
push 4
push 8
call sym.___rust_alloc
add esp, 8
test eax, eax
je 0x10050b71
mov dword [eax], edi
mov dword [eax + 4], esi
push esi
mov ebx, eax
call sub.kernel32.dll_TlsGetValue
mov edi, eax
mov dword [ebp - 0x10], ebx
push ebx
push esi
call sub.kernel32.dll_TlsSetValue
test edi, edi
je 0x10050b46
mov eax, dword [edi]
mov ecx, dword [eax + 0x410]
lea edx, [ecx - 1]
xor ecx, 1
mov dword [eax + 0x410], edx
or ecx, dword [eax + 0x40c]
jne 0x10050b39
push eax
call sym.crossbeam_epoch::internal::Local::finalize::hb03cf478c23a69a0
add esp, 4
push 4
push 8
push edi
call sym.___rust_dealloc
add esp, 0xc
mov eax, dword [ebp - 0x10]
jmp 0x10050b4d
xor eax, eax
add esp, 4
pop esi
pop edi
pop ebx
pop ebp
ret
push eax
call sym.std::sys::thread_local::key::windows::LazyKey::init::h0bd71fcfbfc5b9bd
add esp, 4
mov esi, eax
push esi
call sub.kernel32.dll_TlsGetValue
cmp eax, 1
jbe 0x10050ab4
jmp 0x10050b4d
push 8
push 4
call sym.alloc::alloc::handle_alloc_error::h3ca6a9ac69c8e3db
add esp, 8
ud2