joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10013c00
Capabilities:
Access peb ldr_data
Check for peb beingdebugged flag
Get kernel32 base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100337e8
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
mov eax, dword [0x10045014]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
mov dword [esi + 8], 0xffffffff
xor eax, eax
mov dword [esi + 4], 0xffffffff
mov dword [esi + 0xc], 0
mov dword [esi + 0x20], 0
mov dword [esi + 0x30], 0
mov dword [esi + 0x34], 7
mov word [esi + 0x20], ax
mov dword [esi + 0x10], eax
mov dword [esi + 0x14], 1
mov dword [esi + 0x38], eax
mov dword [esi + 0x3c], eax
mov dword [ebp - 4], eax
lea eax, [esi + 0x40]
mov dword [esi], vtable.TiXmlElement.0
mov dword [eax + 8], 0xffffffff
mov dword [eax + 4], 0xffffffff
mov dword [eax + 0xc], 0
mov dword [eax], vtable.TiXmlAttribute.0
mov dword [eax + 0x14], 0
mov dword [eax + 0x24], 0
mov dword [eax + 0x28], 7
mov dword [eax + 0x2c], 0
mov dword [eax + 0x3c], 0
mov dword [eax + 0x40], 7
mov dword [eax + 0x10], 0
mov dword [eax + 0x48], eax
mov dword [eax + 0x44], eax
mov eax, dword [ebp + 8]
mov byte [ebp - 4], 1
mov dword [esi + 0x1c], 0
mov dword [esi + 0x18], 0
lea ebx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x10013ce0
sub eax, ebx
lea ecx, [esi + 0x20]
sar eax, 1
push eax
push dword [ebp + 8]
call fcn.10002cf0
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x10014320
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100338d8
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x10045014]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
mov dword [esi + 8], 0xffffffff
xor eax, eax
mov dword [esi + 4], 0xffffffff
mov dword [esi + 0xc], 0
mov dword [esi + 0x20], 0
mov dword [esi + 0x30], 0
mov dword [esi + 0x34], 7
mov word [esi + 0x20], ax
mov dword [esi + 0x10], eax
mov dword [esi + 0x14], eax
mov dword [esi + 0x18], eax
mov dword [esi + 0x1c], eax
mov dword [esi + 0x38], eax
mov dword [esi + 0x3c], eax
mov dword [ebp - 4], eax
lea ecx, [esi + 0x48]
mov dword [esi], vtable.TiXmlDocument.0
mov dword [ecx], eax
mov dword [ecx + 0x10], eax
mov dword [ecx + 0x14], 7
mov word [ecx], ax
mov byte [ebp - 4], 1
mov dword [esi + 0x68], 0xffffffff
mov dword [esi + 0x64], 0xffffffff
push eax
push 0x1003ee7c
mov dword [esi + 0x60], 4
mov byte [esi + 0x6c], al
mov byte [esi + 0x40], al
mov dword [esi + 0x44], eax
call fcn.10002cf0
mov dword [esi + 0x68], 0
mov eax, esi
mov dword [esi + 0x64], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x10014da0
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10033a1c
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x10045014]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x10], edi
push 0x44
call fcn.1001937a
mov esi, eax
add esp, 4
mov dword [ebp - 0x14], esi
mov dword [ebp - 4], 0
xor eax, eax
mov dword [esi + 8], 0xffffffff
mov dword [esi + 4], 0xffffffff
mov dword [esi + 0xc], 0
mov dword [esi + 0x20], 0
mov dword [esi + 0x30], 0
mov dword [esi + 0x34], 7
mov word [esi + 0x20], ax
mov dword [esi + 0x10], eax
mov dword [esi + 0x14], 4
mov dword [esi + 0x18], eax
mov dword [esi + 0x1c], eax
mov dword [esi + 0x38], eax
mov dword [esi + 0x3c], eax
push eax
mov byte [ebp - 4], 1
lea ecx, [esi + 0x20]
push 0x1003ee7c
mov dword [esi], vtable.TiXmlText.0
call fcn.10002cf0
add edi, 0x20
mov byte [esi + 0x40], 0
mov dword [ebp - 4], 0xffffffff
cmp dword [edi + 0x14], 8
jb 0x10014e57
mov edi, dword [edi]
mov edx, edi
lea ecx, [edx + 2]
nop dword [eax]
mov ax, word [edx]
add edx, 2
test ax, ax
jne 0x10014e60
sub edx, ecx
lea ecx, [esi + 0x20]
sar edx, 1
push edx
push edi
call fcn.10002cf0
mov ecx, dword [ebp - 0x10]
mov eax, dword [ecx + 0xc]
mov dword [esi + 0xc], eax
mov al, byte [ecx + 0x40]
mov byte [esi + 0x40], al
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x10028e5c
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.10028cd2

Function at 0x1002bec9
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.1002bb46
Function at 0x401029
Capabilities:
Manipulate console buffer

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
mov eax, dword [0x423f20]
mov dword [ebp - 0x28], eax
mov eax, dword [0x423f24]
push esi
mov esi, dword [ebx]
push edi
mov edi, dword [ebx + 4]
xor ecx, ecx
mov dword [ebp - 0x24], eax
lea eax, [ebp - 8]
mov dword [ebp - 0x10], esi
mov dword [ebp - 8], ecx
call fcn.00401022
mov eax, dword [0x423f28]
add dword [ebp - 8], 0x23f
mov dword [ebp - 0x18], eax
mov eax, dword [0x423f2c]
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x14], 0x20
mov dword [ebp - 0xc], 2
add dword [ebp - 0xc], 3
mov eax, esi
shl eax, 4
add eax, dword [ebp - 0x18]
mov dword [ebp - 0x20], eax
mov eax, dword [0x2443ef4]
cmp eax, 0xfa9
jne 0x4010a0
mov dword [0x2443ef0], 0xedeb2e40
cmp eax, 0x3eb
jne 0x4010ad
mov dword [0x244397c], ecx
mov eax, dword [ebp - 0x10]
shr eax, 5
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
add eax, dword [ebp - 0x1c]
mov edx, dword [ebp - 8]
add edx, esi
xor eax, edx
xor eax, dword [ebp - 0x20]
cmp dword [0x2443ef4], 0x213
mov dword [0x2443eec], 0xf4ea3dee
mov dword [ebp - 4], eax
jne 0x4010ee
push ecx
push ecx
push ecx
push ecx
call dword [sym.imp.KERNEL32.dll_EnumCalendarInfoW]
mov eax, dword [ebp - 4]
xor ecx, ecx
sub edi, eax
cmp dword [0x2443ef4], 0xc
jne 0x401110
lea eax, [ebp - 0x2c]
push eax
push ecx
push ecx
push ecx
call dword [sym.imp.KERNEL32.dll_WriteConsoleInputW]
push 0
call dword [sym.imp.KERNEL32.dll_FindVolumeClose]
xor ecx, ecx
mov eax, edi
shr eax, 5
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0x24]
add dword [ebp - 4], eax
mov edx, dword [ebp - 8]
add dword [ebp - 8], 0x61c88647
mov eax, edi
shl eax, 4
add eax, dword [ebp - 0x28]
add edx, edi
xor eax, edx
xor eax, dword [ebp - 4]
sub esi, eax
dec dword [ebp - 0x14]
mov dword [ebp - 0x10], esi
jne 0x401074
mov dword [ebx + 4], edi
pop edi
mov dword [ebx], esi
pop esi
leave
ret

Function at 0x40114e
Capabilities:
Create pipe

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [0x2443ef4]
mov ecx, dword [0x2443980]
sub esp, 0xc00
push esi
shr eax, 3
xor esi, esi
cmp eax, esi
jbe 0x401209
push ebx
push edi
mov ebx, ecx
mov edi, eax
cmp dword [0x2443ef4], 0x959
jne 0x4011f8
push esi
push esi
call dword [sym.imp.KERNEL32.dll_CreateJobObjectA]
push esi
push esi
lea eax, [ebp - 0x400]
push eax
call dword [sym.imp.KERNEL32.dll_GetConsoleAliasesA]
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_EnumDateFormatsA]
push esi
push esi
push esi
push esi
push esi
push esi
push esi
push str.Mokigehate_xolega_viricuh_mazu_fiboy
call dword [sym.imp.KERNEL32.dll_CreateNamedPipeW]
push str.zewaxuwawazuwuyuvivi
push esi
call dword [sym.imp.KERNEL32.dll_FatalAppExitW]
push str.ozofowegad_dinomebaxedidox
push esi
call dword [sym.imp.KERNEL32.dll_SetFileShortNameW]
push esi
push esi
call dword [sym.imp.KERNEL32.dll_GetProcessShutdownParameters]
push esi
lea eax, [ebp - 0xc00]
push eax
push esi
push str.pajebipew
push esi
push esi
call dword [sym.imp.KERNEL32.dll_LCMapStringW]
push esi
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push esi
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
call fcn.00401029
add ebx, 8
dec edi
jne 0x401176
pop edi
pop ebx
pop esi
leave
ret
Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..text
nop
push 4
nop
nop
nop
pop edi
nop
nop
nop
nop
nop
nop
nop
nop
cmp eax, 0
nop
nop
je 0x430072
nop
nop
nop
mov ebx, 0x408ecc
mov ecx, ebx
nop
nop
nop
nop
nop
nop
nop
sub ecx, eax
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
push eax
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
nop
div edi
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
pop eax
nop
nop
nop
nop
nop
nop
mov esi, 0x38d41318
nop
nop
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
add eax, edi
nop
nop
nop
nop
loop 0x430060
mov eax, section..data
nop
nop
cmp eax, 0
nop
nop
nop
nop
je 0x4300d2
nop
nop
mov ebx, 0x42e1d0
nop
mov ecx, ebx
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
push eax
nop
nop
nop
nop
nop
nop
mov eax, ecx
div edi
nop
nop
nop
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
pop eax
mov esi, 0x3c5f763b
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
nop
nop
nop
add eax, edi
nop
nop
loop 0x4300c0
nop
nop
nop
popal
nop
nop
nop
nop
jmp 0x401219
Function at 0x100030a5
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
push ebp
mov ebp, esp
aeskeygenassist xmm0, xmmword [edx], 2
movdqa xmmword [ecx], xmm0
pop ebp
ret

Function at 0x10005396
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x14
cmp dword [edx], 0
mov dword [ebp - 0x14], ecx
je 0x100053cf
mov ecx, dword [edx + 0x30]
cmp dword [edx + 0x24], 0xffffffff
mov edi, dword [edx + 0x34]
mov ebx, dword [edx + 0x38]
mov esi, dword [edx + 0x3c]
lea eax, [edx + 8]
mov dword [ebp - 0x18], ecx
je 0x100054b9
mov ecx, dword [ebp - 0x14]
mov edx, eax
push 0
jmp 0x100054c0
mov al, byte [edx + 0xe]
mov ecx, dword [edx + 0x30]
mov esi, dword [edx + 0x34]
mov edi, dword [edx + 4]
mov ah, byte [edx + 0xc]
mov byte [ebp - 0xd], al
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0x20], ecx
xor ebx, ebx
cmp byte [ebp - 0xd], 0
jne 0x100054d8
mov al, ah
xor al, 1
test edi, edi
mov byte [edx + 0xc], al
je 0x10005413
cmp edi, esi
jae 0x1000540d
cmp byte [ecx + edi], 0xbf
jg 0x10005413
jmp 0x100054f5
jne 0x100054f5
cmp edi, esi
je 0x100054d0
mov byte [ebp - 0x18], ah
movzx eax, byte [ecx + edi]
test al, al
jns 0x1000547f
movzx ebx, byte [ecx + edi + 1]
mov esi, eax
and esi, 0x1f
and ebx, 0x3f
cmp al, 0xdf
jbe 0x10005464
movzx ecx, byte [ecx + edi + 2]
shl ebx, 6
and ecx, 0x3f
or ecx, ebx
cmp al, 0xf0
jb 0x10005470
mov ebx, dword [ebp - 0x20]
and esi, 7
shl ecx, 6
shl esi, 0x12
movzx eax, byte [ebx + edi + 3]
and eax, 0x3f
or eax, ecx
mov ecx, ebx
or eax, esi
jmp 0x1000546b
shl esi, 6
or esi, ebx
mov eax, esi
mov esi, dword [ebp - 0x1c]
jmp 0x1000547d
shl esi, 0xc
or ecx, esi
mov esi, dword [ebp - 0x1c]
mov eax, ecx
mov ecx, dword [ebp - 0x20]
xor ebx, ebx
cmp byte [ebp - 0x18], 0
jne 0x100054dd
cmp eax, 0x110000
je 0x100054d4
cmp eax, 0x80
mov ebx, 1
jb 0x100054ad
cmp eax, 0x800
push 2
pop ebx
jb 0x100054ad
cmp eax, 0x10000
push 4
pop ebx
sbb ebx, 0
add edi, ebx
mov ah, 1
mov dword [edx + 4], edi
jmp 0x100053e7
mov ecx, dword [ebp - 0x14]
mov edx, eax
push 1
push esi
push ebx
push edi
push dword [ebp - 0x18]
call sym.core::str::pattern::TwoWaySearcher::next::h7b5739d2d838289b
add esp, 0x28
jmp 0x100054f0
test ah, ah
jne 0x100054df
mov byte [edx + 0xe], 1
mov eax, dword [ebp - 0x14]
jmp 0x100054eb
mov esi, edi
mov eax, dword [ebp - 0x14]
xor ebx, ebx
inc ebx
mov dword [eax + 4], esi
mov dword [eax + 8], esi
mov dword [eax], ebx
add esp, 0x14
pop esi
pop edi
pop ebx
pop ebp
ret
mov edx, esi
push 0x101f6274
push esi
push edi
call dbg.slice_error_fail
Function at 0x1001bf90
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
mov eax, ecx
xor edx, edx
mov esi, 0x21
mov edi, 0x21
shl eax, 0xb
nop word [eax + eax]
shr esi, 1
add esi, edx
mov ebx, dword [esi*4 + 0x101771b0]
shl ebx, 0xb
cmp ebx, eax
je 0x1001bfd5
cmp ebx, eax
cmova edi, esi
lea esi, [esi + 1]
cmovb edx, esi
mov esi, edi
sub esi, edx
ja 0x1001bfb0
jmp 0x1001bfd8
inc esi
mov edx, esi
cmp edx, 0x20
ja 0x1001c060
mov eax, dword [edx*4 + 0x101771b0]
mov esi, 0x2d7
je 0x1001bfff
lea edi, [edx*4 + 0x101771b4]
test edi, edi
je 0x1001bfff
mov esi, dword [edi]
shr esi, 0x15
shr eax, 0x15
test edx, edx
je 0x1001c014
mov edi, 0x1fffff
and edi, dword [edx*4 + 0x101771ac]
jmp 0x1001c016
xor edi, edi
mov edx, eax
not edx
add edx, esi
je 0x1001c048
sub ecx, edi
cmp eax, 0x2d8
mov edx, 0x2d7
cmovae edx, eax
dec esi
xor edi, edi
cmp edx, eax
je 0x1001c04f
movzx ebx, byte [eax + 0x10177234]
add edi, ebx
cmp edi, ecx
ja 0x1001c048
inc eax
cmp esi, eax
jne 0x1001c030
mov eax, esi
and al, 1
pop esi
pop edi
pop ebx
pop ebp
ret
mov ecx, edx
mov edx, 0x2d7
push 0x10176b54
call dbg.panic_bounds_check
mov ecx, edx
mov edx, 0x21
push 0x10176b44
call dbg.panic_bounds_check
nop word cs:[eax + eax]
nop dword [eax + eax]

Function at 0x1001c080
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
push eax
mov eax, dword [ebp + 8]
mov ebx, dword [ebp + 0x14]
xor esi, esi
lea eax, [edx + eax*2]
mov dword [ebp - 0x10], eax
movzx eax, byte [edx + 1]
cmp byte [edx], ch
lea edx, [edx + 2]
lea edi, [esi + eax]
jne 0x1001c0d0
cmp esi, edi
ja 0x1001c13b
cmp edi, dword [ebp + 0x10]
ja 0x1001c149
add esi, dword [ebp + 0xc]
nop word [eax + eax]
test eax, eax
je 0x1001c0d2
dec eax
cmp byte [esi], cl
lea esi, [esi + 1]
jne 0x1001c0c0
jmp 0x1001c12f
ja 0x1001c0d9
cmp edx, dword [ebp - 0x10]
mov esi, edi
jne 0x1001c095
mov edi, dword [ebp + 0x18]
movzx ecx, cx
mov al, 1
add edi, ebx
nop word cs:[eax + eax]
nop dword [eax]
movzx edx, byte [ebx]
lea esi, [ebx + 1]
test dl, dl
js 0x1001c110
mov ebx, esi
sub ecx, edx
jns 0x1001c127
jmp 0x1001c131
cmp esi, edi
je 0x1001c158
movzx esi, byte [ebx + 1]
and edx, 0x7f
add ebx, 2
shl edx, 8
or edx, esi
sub ecx, edx
js 0x1001c131
xor al, 1
cmp ebx, edi
jne 0x1001c0f0
jmp 0x1001c131
xor eax, eax
and al, 1
add esp, 4
pop esi
pop edi
pop ebx
pop ebp
ret
mov ecx, esi
mov edx, edi
push 0x10176590
call dbg.slice_index_order_fail
mov edx, dword [ebp + 0x10]
mov ecx, edi
push 0x10176590
call dbg.slice_end_index_len_fail
mov ecx, 0x10176580
call dbg.unwrap_failed
nop word cs:[eax + eax]
nop dword [eax]
Function at 0x1001ebb6
Capabilities:
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 8
mov eax, edx
mov edx, dword [ebp + 8]
mov ebx, ecx
not ebx
cmp edx, 0x40
jb 0x1001ece8
push 4
pop ecx
sub ecx, 1
jb 0x1001ebc8
cmp edx, 0xf
jbe 0x1001ecf8
movzx esi, byte [eax + 0xe]
movzx edi, byte [eax + 0xf]
mov dword [ebp - 0x14], ecx
mov ecx, ebx
mov dword [ebp - 0x10], edx
mov edx, 0xff
shr ecx, 0x18
mov esi, dword [esi*4 + 0x1017a58c]
xor esi, dword [edi*4 + 0x1017a18c]
movzx edi, byte [eax + 0xd]
xor esi, dword [edi*4 + 0x1017a98c]
movzx edi, byte [eax + 0xc]
xor esi, dword [edi*4 + 0x1017ad8c]
movzx edi, byte [eax + 0xb]
xor esi, dword [edi*4 + 0x1017b18c]
movzx edi, byte [eax + 0xa]
xor esi, dword [edi*4 + 0x1017b58c]
movzx edi, byte [eax + 9]
xor esi, dword [edi*4 + 0x1017b98c]
movzx edi, byte [eax + 8]
xor esi, dword [edi*4 + 0x1017bd8c]
movzx edi, byte [eax + 7]
xor esi, dword [edi*4 + 0x1017c18c]
movzx edi, byte [eax + 6]
xor esi, dword [edi*4 + 0x1017c58c]
movzx edi, byte [eax + 5]
xor esi, dword [edi*4 + 0x1017c98c]
movzx edi, byte [eax + 4]
xor esi, dword [edi*4 + 0x1017cd8c]
movzx edi, byte [eax + 3]
xor ecx, edi
mov edi, ebx
xor esi, dword [ecx*4 + 0x1017d18c]
movzx ecx, byte [eax + 2]
shr edi, 0x10
and edi, edx
xor edi, ecx
movzx ecx, byte [eax + 1]
xor esi, dword [edi*4 + 0x1017d58c]
mov edi, ebx
and ebx, edx
shr edi, 8
and edi, edx
mov edx, dword [ebp - 0x10]
xor edi, ecx
movzx ecx, byte [eax]
xor esi, dword [edi*4 + 0x1017d98c]
xor ebx, ecx
mov ecx, eax
xor esi, dword [ebx*4 + 0x1017dd8c]
push 0x1017a17c
call fcn.1001f156
mov ecx, dword [ebp - 0x14]
add esp, 4
mov ebx, esi
jmp 0x1001ebd4
mov cl, byte [eax]
inc eax
dec edx
xor cl, bl
shr ebx, 8
movzx esi, cl
xor ebx, dword [esi*4 + 0x1017a18c]
test edx, edx
jne 0x1001ecd5
not ebx
mov eax, ebx
add esp, 8
pop esi
pop edi
pop ebx
pop ebp
ret
push 0xf
pop ecx
push 0x1017a16c
call dbg.panic_bounds_check
Function at 0x100305ce
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x90
mov esi, ecx
mov ecx, dword [0x1016f054]
mov dword [esp + 0x50], 2
mov dword [esp + 4], edx
mov dword [esp + 0x60], ecx
lea eax, [ecx + 0x1c]
mov edx, dword [ecx + 0x20]
mov dword [esp], eax
test edx, edx
je 0x1003061e
mov eax, dword [ecx + 0x1c]
mov edi, dword [ecx + 0x24]
mov ecx, dword [ecx + 0x28]
mov dword [esp + 0x38], edx
mov dword [esp + 0x3c], edi
mov dword [esp + 0x40], ecx
and dword [esp + 0x44], 0
jmp 0x10030620
xor eax, eax
lea edi, [esp + 0x34]
lea ebx, [esp + 0x78]
mov dword [edi], eax
mov ecx, ebx
mov edx, edi
push 0x101aea40
call sym.core::option::Option_LT_T_GT_::expect::had381833aed40e26
pop eax
lea eax, [esp + 4]
mov dword [edi], ebx
lea edx, [esp + 0x6c]
mov dword [edi + 4], eax
mov eax, dword [esp]
mov dword [edx], edi
mov dword [edi + 8], 0x101ae9e8
lea edi, [esp + 0x48]
mov dword [edx + 4], 1
mov ecx, edi
mov dword [edx + 8], eax
call sym.tracing::span::Span::record_all::hba197cb0fe71e10e
movsd xmm1, qword [edi + 8]
movsd xmm0, qword [edi]
movsd xmm2, qword [edi + 0x10]
movsd qword [esp + 0x10], xmm1
movsd xmm1, qword [edi + 0x18]
movsd qword [esp + 8], xmm0
movsd qword [esp + 0x18], xmm2
movsd qword [esp + 0x20], xmm1
cmp dword [esp + 0x10], 2
je 0x100306a6
lea ecx, [esp + 0x10]
lea edx, [esp + 8]
call sym.tracing_core::dispatcher::Dispatch::enter::h952e9fb5ca537f24
mov eax, dword [esi + 0x4c]
lea ecx, [esi + 0x14]
lea edi, [esp + 0x28]
mov dword [esp], ecx
add eax, dword [esp + 4]
mov dword [esi + 0x4c], eax
test eax, eax
jle 0x10030743
mov edx, dword [esp]
lea ecx, [esp + 0x48]
push dword [ebp + 8]
call sym.h2::proto::streams::store::Queue_LT_N_GT_::pop::ha37242e050a42f50
pop eax
cmp dword [esp + 0x48], 0
je 0x10030743
mov eax, dword [esp + 0x50]
movsd xmm0, qword [esp + 0x48]
mov ecx, edi
mov dword [esp + 0x30], eax
movsd qword [esp + 0x28], xmm0
call sym.__LT_h2..proto..streams..store..Ptr_u20_as_u20_core..ops..deref..Deref_GT_::deref::h675755193f95ec40
mov ecx, dword [eax + 0x10]
mov edx, dword [eax + 0x14]
call sym.h2::proto::streams::state::State::is_send_streaming::hab3431ed0f4b17bd
test al, al
jne 0x10030713
mov ecx, edi
call sym.__LT_h2..proto..streams..store..Ptr_u20_as_u20_core..ops..deref..Deref_GT_::deref::h675755193f95ec40
cmp dword [eax + 0xc8], 0
je 0x1003073b
mov ecx, edi
call sym.__LT_h2..proto..streams..store..Ptr_u20_as_u20_core..ops..deref..Deref_GT_::deref::h675755193f95ec40
xor ebx, ebx
cmp dword [eax + 0x20], 0x3b9aca00
mov ecx, esi
mov edx, edi
setne bl
call sym.h2::proto::streams::prioritize::Prioritize::try_assign_capacity::h71a5e7543efe4c06
mov ecx, dword [ebp + 0xc]
mov edx, edi
push ebx
call sym.h2::proto::streams::counts::Counts::transition_after::h8890c364a35b9536
pop eax
mov eax, dword [esi + 0x4c]
jmp 0x100306ba
lea esi, [esp + 8]
mov ecx, esi
call sym.core::ptr::drop_in_place_LT_tracing..span..Entered_GT_::h86e6b941706f6967
mov ecx, esi
call sym.core::ptr::drop_in_place_LT_tracing..span..Span_GT_::h31cd9a3e6297fff7
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x1004627d
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x30
mov al, byte [edx + 0x44]
mov esi, edx
mov ebx, ecx
add al, 0xfc
movzx ecx, al
cmp al, 3
push 3
pop eax
cmovb eax, ecx
movzx eax, al
lea ecx, [eax - 2]
cmp ecx, 2
jb 0x10046360
test eax, eax
jne 0x1004636a
cmp dword [esi], 0
mov edx, 0
je 0x100462c6
mov eax, dword [esi + 4]
mov edx, dword [eax]
and edx, 0xe
lea eax, [esi + 0x44]
mov ecx, esi
mov dword [esp + 4], eax
call sym.mio::sys::windows::selector::ReadyBinding::set_readiness::h2913cfed715a13f3
mov edi, dword [ebx]
lea eax, [esp + 0x24]
lea edx, [esp + 0x20]
lea ebx, [esp + 0x10]
and dword [eax], 0
and dword [edx], 0
and dword [ebx], 0
mov dword [eax + 4], str._rustc_9b00956e56009bab2aa15d7bff10916599e3d6d6librarycore_srccharmethods.rs__
lea ecx, [edi + 4]
push 0
push ecx
push edx
push ebx
push 1
push eax
push dword [edi]
call sub.ws2_32.dll_WSARecv
lea ebx, [esp + 0x14]
mov edx, eax
lea eax, [esp + 0x10]
mov ecx, ebx
push dword [eax]
call sym.miow::net::cvt::h92966806c1412852
pop eax
xor eax, eax
cmp dword [ebx], eax
je 0x10046340
movsd xmm0, qword [esp + 0x18]
mov ecx, dword [esp + 4]
movsd qword [esp + 8], xmm0
call sym.core::ptr::drop_in_place_LT_mio..sys..windows..tcp..State_LT__LP__RP__C__LP__RP__GT__GT_::he6813d835110437f
movsd xmm0, qword [esp + 8]
movsd qword [esi + 0x44], xmm0
jmp 0x10046360
mov ecx, dword [esp + 4]
mov dword [esp + 8], edi
mov edi, dword [esp + 0x18]
mov bl, byte [esi + 0x4c]
call sym.core::ptr::drop_in_place_LT_mio..sys..windows..tcp..State_LT__LP__RP__C__LP__RP__GT__GT_::he6813d835110437f
test edi, edi
je 0x10046372
test bl, bl
je 0x10046372
mov byte [esi + 0x44], 6
xor edx, edx
mov ecx, esi
inc edx
call sym.mio::sys::windows::tcp::StreamImp::add_readiness::h106f08e3e1e079ec
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
mov eax, dword [esp + 4]
mov ecx, dword [esp + 8]
mov byte [eax], 5
lock inc dword [ecx + 0x88]
jmp 0x1004636a
Function at 0x1004bb2c
Capabilities:
Generate random numbers via rtlgenrandom
Generate random numbers via winapi

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 8
mov dword [ebp - 0x10], ecx
push 0x20
pop ecx
xor ebx, ebx
mov edi, dword [ebp - 0x10]
test bl, 1
jne 0x1004bb95
mov esi, ecx
lea eax, [edi + ecx]
mov dword [ebp - 0x10], eax
push 2
push ecx
push edi
push 0
call sub.bcrypt.dll_BCryptGenRandom
xor ecx, ecx
mov bl, 1
cmp eax, 0xc0000000
mov dword [ebp - 0x14], eax
jb 0x1004bb3d
push esi
push edi
call sub.advapi32.dll_SystemFunction036
xor ecx, ecx
test al, al
jne 0x1004bb3d
mov esi, dword [ebp - 0x14]
and esi, 0x7fffffff
je 0x1004bb95
mov al, byte [0x10237124]
push 4
pop edx
xor ecx, ecx
call dbg.process_heap_alloc
test eax, eax
je 0x1004bb9f
mov dword [eax], esi
jmp 0x1004bb97
xor eax, eax
add esp, 8
pop esi
pop edi
pop ebx
pop ebp
ret
push 4
pop ecx
mov edx, ecx
call dbg.handle_alloc_error