joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100043f0
Capabilities:
Check mutex on windows
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x34
call sym.crypt_file::proc_sens::sensitive_processes::h0c16fb04f91dfaa3
lea eax, [0x10157691]
lea esi, [ebp - 0x24]
mov dword [ebp - 0x24], eax
lea eax, [ebp - 0x24]
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x24], 0xbcd06505
push dword [ebp - 0x24]
push eax
call sym.obfstr::xref::inner::hb95a1adddf751cef
add esp, 8
mov ecx, 0xff9f5324
xor ecx, dword [eax]
movzx eax, byte [eax + 4]
xor al, 0xf9
mov dword [ebp - 0x30], ecx
mov byte [ebp - 0x2c], al
lea eax, [ebp - 0x30]
lea ecx, [ebp - 0x40]
push 5
push eax
push ecx
call sym.__LT__RF_str_u20_as_u20_alloc..ffi..c_str..CString..new..SpecNewImpl_GT_::spec_new_impl::hc0fc42e4f437b0f1
add esp, 0xc
xor eax, eax
cmp eax, dword [ebp - 0x40]
jno 0x10004599
mov edi, dword [ebp - 0x3c]
mov esi, dword [ebp - 0x38]
push edi
push 0
push 0
call sub.kernel32.dll_CreateMutexA
call sub.kernel32.dll_GetLastError
cmp eax, 0xb7
jne 0x1000448a
mov byte [edi], 0
test esi, esi
je 0x10004482
push 1
push esi
push edi
call sym.___rust_dealloc
add esp, 0xc
add esp, 0x34
pop esi
pop edi
pop ebx
pop ebp
ret
mov dword [ebp - 0x10], edi
mov dword [ebp - 0x14], esi
call sym.crypt_file::ssn_solving::setup_ssn_solving::hedf7bc2bef9a6171
push 0x7d0
call sym.crypt_file::sleepModule::sleepModule::hb1f275cd910cb7fc
add esp, 4
mov eax, dword [0x1017b554]
movzx eax, byte [eax]
push 1
push 0x521d5
call sym.___rust_alloc
add esp, 8
test eax, eax
je 0x100045c6
mov esi, eax
push 0x521d5
push 0x101053d4
push eax
call sub.msvcrt.dll_memcpy
add esp, 0xc
xor eax, eax
nop dword [eax + eax]
mov ecx, eax
and ecx, 0x1f
movzx ecx, byte [ecx + 0x101575a9]
xor byte [esi + eax], cl
inc eax
cmp eax, 0x521d5
jne 0x100044e0
push 0
push 0
push 0x40000
call sub.kernel32.dll_HeapCreate
mov ebx, eax
push 0x521d5
push 8
push eax
call sub.kernel32.dll_HeapAlloc
mov edi, eax
call sub.kernel32.dll_GetLastError
test eax, eax
jne 0x10004573
mov dword [ebp - 0x28], edi
push 0xfa0
call sym.crypt_file::sleepModule::sleepModule::hb1f275cd910cb7fc
add esp, 4
lea eax, [ebp - 0x24]
push eax
call sym.crypt_file::amsi_care::setup_bypass::h97a37741ea25abdb
add esp, 4
mov eax, dword [ebp - 0x24]
mov ecx, eax
neg ecx
jo 0x10004554
jae 0x10004554
push 1
push eax
push dword [ebp - 0x20]
call sym.___rust_dealloc
add esp, 0xc
push 0x521d5
push esi
mov edi, dword [ebp - 0x28]
push edi
call sub.msvcrt.dll_memmove
add esp, 0xc
call edi
push dword [ebp - 0x28]
push 0
push ebx
call sub.kernel32.dll_HeapFree
push 1
push 0x521d5
push esi
call sym.___rust_dealloc
add esp, 0xc
mov edi, dword [ebp - 0x10]
mov esi, dword [ebp - 0x14]
mov byte [edi], 0
test esi, esi
jne 0x10004476
jmp 0x10004482
movsd xmm0, qword [ebp - 0x40]
movsd xmm1, qword [ebp - 0x38]
movsd qword [ebp - 0x1c], xmm1
movsd qword [ebp - 0x24], xmm0
push 0x101053c4
push 0x10105378
push esi
push 0
push 1
call sym.core::result::unwrap_failed::h534a40e08cfe968a
add esp, 0x14
jmp 0x100045d5
push 0x521d5
push 1
call sym.alloc::raw_vec::handle_error::he63c9115d026ec98
add esp, 8
ud2
Function at 0x10005b70
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x22c
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x10]
mov dword [ebp - 0x10], 0
push eax
push sym.crypt_file::get_own_dll_path::h3835b8cdf5f46e3e
push 4
call sub.kernel32.dll_GetModuleHandleExW
test eax, eax
je 0x10005c00
lea edi, [ebp - 0x238]
push 0x208
push 0
push edi
call sub.msvcrt.dll_memset
add esp, 0xc
push 0x104
push edi
push dword [ebp - 0x10]
call sub.kernel32.dll_GetModuleFileNameW
test eax, eax
je 0x10005c00
cmp eax, 0x105
jae 0x10005c29
lea ebx, [ebp - 0x30]
push eax
push edi
push ebx
call sym.__LT_std..ffi..os_str..OsString_u20_as_u20_std..os..windows..ffi..OsStringExt_GT_::from_wide::h63b25de594ca01f2
add esp, 0xc
lea eax, [ebp - 0x20]
push ebx
push eax
call sym.std::sys::os_str::wtf8::Buf::into_string::h0ed290c5a2271c2b
add esp, 8
mov ecx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x1c]
mov edx, ecx
neg edx
jno 0x10005c13
mov ecx, dword [ebp - 0x18]
mov edx, dword [ebp - 0x14]
mov dword [esi], eax
mov dword [esi + 8], edx
mov dword [esi + 4], ecx
jmp 0x10005c06
mov dword [esi], 0x80000000
mov eax, esi
add esp, 0x22c
pop esi
pop edi
pop ebx
pop ebp
ret
mov dword [esi], 0x80000000
jae 0x10005c06
push 1
push ecx
push eax
call sym.___rust_dealloc
add esp, 0xc
jmp 0x10005c06
push 0x1015789c
push 0x104
push eax
call sym.core::slice::index::slice_end_index_len_fail::h31017dc9c470f2c8
nop
nop
nop
nop
Function at 0x10008b40
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x28
mov eax, dword fs:[0x18]
mov edi, esp
lea ebx, [esp + 0x14]
mov eax, dword [eax + 0x30]
mov esi, dword [eax + 0xc]
add esi, 0xc
nop word cs:[eax + eax]
nop dword [eax + eax]
mov esi, dword [esi]
cmp dword [esi + 0x18], 0
je 0x10008c0f
mov eax, dword [esi + 0x30]
movzx ecx, word [esi + 0x2c]
mov dword [esp], eax
mov dword [esp + 4], ecx
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
push 0
push edi
push ebx
call sym.murmur3::murmur3_32::murmur3_32::h6a53eee93f283608
add esp, 0xc
cmp byte [esp + 0x14], 4
jne 0x10008c17
cmp dword [esp + 0x18], 0xaddfe535
jne 0x10008b70
mov esi, dword [esi + 0x18]
mov ecx, esp
mov edx, esi
push 0xa2b1807f
call sym.__ZN10crypt_file11ssn_solving25hells_halos_tartarus_gate17h9324d59eee4cb2b1E.llvm.5159645519991143696
add esp, 4
mov ecx, esp
mov edx, esi
push 0xced7e31f
call sym.__ZN10crypt_file11ssn_solving25hells_halos_tartarus_gate17h9324d59eee4cb2b1E.llvm.5159645519991143696
add esp, 4
mov ecx, esp
mov edx, esi
push 0x91c3ed4a
call sym.__ZN10crypt_file11ssn_solving25hells_halos_tartarus_gate17h9324d59eee4cb2b1E.llvm.5159645519991143696
add esp, 4
mov ecx, esp
mov edx, esi
push 0xb2036547
call sym.__ZN10crypt_file11ssn_solving25hells_halos_tartarus_gate17h9324d59eee4cb2b1E.llvm.5159645519991143696
add esp, 4
mov ecx, esp
mov edx, esi
push 0xa596d8ce
call sym.__ZN10crypt_file11ssn_solving25hells_halos_tartarus_gate17h9324d59eee4cb2b1E.llvm.5159645519991143696
add esp, 4
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
movsd xmm0, qword [esp + 0x14]
movsd qword [esp + 0x1c], xmm0
lea edi, [esp + 0x1c]
push 0x10157e44
push 0x10157d64
push edi
push 0
push 1
call sym.core::result::unwrap_failed::h534a40e08cfe968a
add esp, 0x14
ud2
Function at 0x10008c60
Capabilities:
Parse pe header
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x40
mov edi, edx
xor edx, edx
cmp word [edi], 0x5a4d
jne 0x10008d91
mov eax, dword [edi + 0x3c]
cmp dword [eax + edi], 0x4550
jne 0x10008d91
mov eax, dword [edi + eax + 0x78]
mov dword [esp + 4], ecx
mov esi, dword [eax + edi + 0x20]
mov edx, dword [eax + edi + 0x1c]
mov ecx, dword [eax + edi + 0x14]
mov ebx, dword [eax + edi + 0x18]
mov eax, dword [eax + edi + 0x24]
add eax, edi
add edx, edi
add esi, edi
mov dword [esp + 0x10], ecx
mov dword [esp + 0x14], ebx
mov dword [esp + 0xc], eax
xor eax, eax
mov dword [esp + 8], edx
nop
cmp eax, dword [esp + 0x14]
je 0x10008d8b
mov ebx, eax
mov eax, dword [esi + eax*4]
mov ecx, 0xffffffff
add eax, edi
nop word cs:[eax + eax]
cmp byte [eax + ecx + 1], 0
lea ecx, [ecx + 1]
jne 0x10008ce0
mov dword [esp + 0x20], eax
mov dword [esp + 0x24], ecx
mov dword [esp + 0x2c], 0
mov dword [esp + 0x28], 0
push 0
lea eax, [esp + 0x24]
push eax
lea eax, [esp + 0x20]
push eax
call sym.murmur3::murmur3_32::murmur3_32::h6a53eee93f283608
add esp, 0xc
cmp byte [esp + 0x18], 4
jne 0x10008d9b
mov ecx, dword [ebp + 8]
lea eax, [ebx + 1]
cmp dword [esp + 0x1c], ecx
jne 0x10008cc0
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 0x10]
movzx eax, word [eax + ebx*2]
cmp ecx, eax
jbe 0x10008dc4
mov ecx, dword [esp + 8]
mov edx, 0
mov eax, dword [ecx + eax*4]
mov ecx, dword [esp + 4]
cmp byte [eax + edi], 0x4c
jne 0x10008d91
add eax, edi
cmp byte [eax + 1], 0x8b
jne 0x10008d91
cmp byte [eax + 2], 0xd1
jne 0x10008d91
cmp byte [eax + 3], 0xb8
jne 0x10008d91
cmp byte [eax + 6], 0
jne 0x10008d91
cmp byte [eax + 7], 0
jne 0x10008d91
movzx edx, byte [eax + 4]
or dl, byte [eax + 5]
mov dword [ecx + 4], eax
movzx edx, dl
mov word [ecx + 8], dx
mov edx, 1
jmp 0x10008d91
mov ecx, dword [esp + 4]
xor edx, edx
mov dword [ecx], edx
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
movsd xmm0, qword [esp + 0x18]
movsd qword [esp + 0x34], xmm0
lea edi, [esp + 0x34]
push 0x10157e44
push 0x10157d64
push edi
push 0
push 1
call sym.core::result::unwrap_failed::h534a40e08cfe968a
add esp, 0x14
ud2
push 0x10157e54
push ecx
push eax
call sym.core::panicking::panic_bounds_check::hf1cd1614d6353f3c
mov esi, eax
push edi
call sym.__ZN4core3ptr42drop_in_place_LT_std..io..error..Error_GT_17h968060fe22cd8453E.llvm.5159645519991143696
add esp, 4
push esi
call sym.__Unwind_Resume
call sym.core::panicking::panic_in_cleanup::h828554743c41e7fc
nop
nop
nop
nop
nop
Function at 0x10011e50
Capabilities:
Connect to wmi namespace via wbemlocator

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x18
mov esi, edx
mov edi, ecx
mov dword [ebp - 0x18], 1
mov dword [ebp - 0x10], 0
mov dword [ebp - 0x14], 0
lea eax, [ebp - 0x10]
push eax
push 0x10158530
push 1
push 0
push 0x10158540
call sub.ole32.dll_CoCreateInstance
test eax, eax
js 0x10011eb8
mov ebx, dword [ebp - 0x10]
test ebx, ebx
je 0x10011ef9
cmp dword [esi], 0
je 0x10011ea2
push esi
call sym.__LT_windows_core..unknown..IUnknown_u20_as_u20_core..ops..drop..Drop_GT_::drop::h5cbf3c7278c22b07
add esp, 4
mov dword [esi], ebx
movsd xmm0, qword [esi + 8]
movsd xmm1, qword [esi]
movsd qword [edi + 8], xmm0
movsd qword [edi], xmm1
jmp 0x10011f04
lea ebx, [ebp - 0x14]
push eax
call sym.__ZN108__LT_windows_result..error..Error_u20_as_u20_core..convert..From_LT_windows_result..hresult..HRESULT_GT__GT_4from17ha98
add esp, 4
cmp dword [ebp - 0x18], 0
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x1c], edx
mov dword [ebp - 0x24], 1
je 0x10011edd
test edx, edx
jne 0x10011eed
jmp 0x10011ef9
push ebx
call sym.__LT_windows_core..unknown..IUnknown_u20_as_u20_core..ops..drop..Drop_GT_::drop::h5cbf3c7278c22b07
add esp, 4
mov edx, dword [ebp - 0x1c]
test edx, edx
je 0x10011ef9
lea eax, [ebp - 0x1c]
push eax
call sym.__LT_windows_result..com..ComPtr_u20_as_u20_core..ops..drop..Drop_GT_::drop::h9cbffdb6c4b299b4
add esp, 4
mov byte [edi + 0xc], 2
mov ecx, esi
call sym.core::ptr::drop_in_place_LT_sysinfo..windows..component..Connection_GT_::ha77343930d536374
add esp, 0x18
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x100121d0
Capabilities:
Reference wmi statements

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x24
cmp dword [edx + 4], 0
mov esi, edx
mov edi, ecx
je 0x10012273
mov dword [ebp - 0x10], edi
lea edi, [esi + 4]
push 0x10158562
call sub.oleaut32.dll_SysAllocString
mov ebx, eax
mov dword [ebp - 0x18], eax
push str.SELECT__FROM_MSAcpi_ThermalZoneTemperature
call sub.oleaut32.dll_SysAllocString
mov dword [ebp - 0x14], eax
lea edx, [ebp - 0x14]
lea eax, [ebp - 0x30]
lea ecx, [ebp - 0x18]
push 0
push 0x30
push edx
push ecx
push edi
push eax
call sym.windows::Win32::System::Wmi::IWbemServices::ExecQuery::hb971285f2c073282
add esp, 0x18
push ebx
call sub.oleaut32.dll_SysFreeString
push dword [ebp - 0x14]
call sub.oleaut32.dll_SysFreeString
mov eax, dword [ebp - 0x28]
movsd xmm0, qword [ebp - 0x30]
mov dword [ebp - 0x1c], eax
movsd qword [ebp - 0x24], xmm0
lea eax, [ebp - 0x14]
push eax
call sym.__LT_windows_core..strings..bstr..BSTR_u20_as_u20_core..ops..drop..Drop_GT_::drop::h1506c7fba2cf2d1a
add esp, 4
lea eax, [ebp - 0x18]
push eax
call sym.__LT_windows_core..strings..bstr..BSTR_u20_as_u20_core..ops..drop..Drop_GT_::drop::h1506c7fba2cf2d1a
add esp, 4
mov edi, dword [ebp - 0x10]
test byte [ebp - 0x24], 1
je 0x10012280
cmp dword [ebp - 0x1c], 0
je 0x10012273
lea eax, [ebp - 0x1c]
push eax
call sym.__LT_windows_result..com..ComPtr_u20_as_u20_core..ops..drop..Drop_GT_::drop::h9cbffdb6c4b299b4
add esp, 4
mov byte [edi + 0xc], 2
mov ecx, esi
call sym.core::ptr::drop_in_place_LT_sysinfo..windows..component..Connection_GT_::ha77343930d536374
jmp 0x100122ad
mov ebx, dword [ebp - 0x20]
cmp dword [esi + 8], 0
je 0x10012295
lea edi, [esi + 8]
push edi
call sym.__LT_windows_core..unknown..IUnknown_u20_as_u20_core..ops..drop..Drop_GT_::drop::h5cbf3c7278c22b07
add esp, 4
mov dword [esi + 8], ebx
mov eax, dword [ebp - 0x10]
movsd xmm0, qword [esi]
movsd xmm1, qword [esi + 8]
movsd qword [eax], xmm0
movsd qword [eax + 8], xmm1
add esp, 0x24
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x10014790
Capabilities:
Get memory capacity

Disassembly:
push ebp
mov ebp, esp
pop ebp
jmp sym.sysinfo::windows::system::SystemInner::refresh_memory_specifics::h182da9312f566f92
Function at 0x10018440
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x88
mov eax, dword [ebp + 8]
mov esi, dword [ebp + 0xc]
mov edi, dword [eax]
lea eax, [edi + 8]
push eax
call sym.std::sys::os_str::wtf8::Buf::as_mut_slice::h1c48b2ce9855202e
add esp, 4
mov dword [esp + 8], eax
lea eax, [edi + 0x18]
mov dword [esp + 0xc], edx
push eax
call sym.std::sys::os_str::wtf8::Buf::as_mut_slice::h1c48b2ce9855202e
add esp, 4
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], edx
mov ecx, 0x10158ea2
mov edx, str.noyesDisk___FS:___Type:___removable:___mounted_on_:__B
movsd xmm0, qword [edi]
movsd qword [esp + 0x80], xmm0
movzx eax, byte [edi + 0x54]
test eax, eax
cmovne edx, ecx
or eax, 2
mov dword [esp + 0x18], edx
mov dword [esp + 0x1c], eax
lea eax, [edi + 0x28]
push eax
call sym.std::sys::os_str::wtf8::Buf::as_mut_slice::h1c48b2ce9855202e
add esp, 4
mov dword [esp + 0x20], eax
mov dword [esp + 0x24], edx
movsd xmm0, qword [edi + 0x40]
movsd qword [esp + 0x60], xmm0
mov eax, dword [edi + 0x38]
mov ecx, dword [edi + 0x3c]
mov dword [esp + 0x68], 0x10158ed8
mov dword [esp + 0x6c], 8
mov dword [esp + 0x78], 0
mov dword [esp], eax
lea eax, [esp + 8]
mov dword [esp + 4], ecx
mov dword [esp + 0x28], eax
lea eax, [esp + 0x10]
mov dword [esp + 0x2c], sym.__LT__RF_T_u20_as_u20_core..fmt..Debug_GT_::fmt::hcd328294ee96d934
mov dword [esp + 0x30], eax
lea eax, [esp + 0x80]
mov dword [esp + 0x34], sym.__LT__RF_T_u20_as_u20_core..fmt..Debug_GT_::fmt::hcd328294ee96d934
mov dword [esp + 0x38], eax
lea eax, [esp + 0x18]
mov dword [esp + 0x3c], sym.__LT_sysinfo..common..disk..DiskKind_u20_as_u20_core..fmt..Debug_GT_::fmt::h9776a932f0b9d295
mov dword [esp + 0x40], eax
lea eax, [esp + 0x20]
mov dword [esp + 0x44], sym.__LT__RF_T_u20_as_u20_core..fmt..Display_GT_::fmt::h30ba4b7b8571ef3a
mov dword [esp + 0x48], eax
lea eax, [esp + 0x60]
mov dword [esp + 0x4c], sym.__LT__RF_T_u20_as_u20_core..fmt..Debug_GT_::fmt::h0d771c6831cd0041
mov dword [esp + 0x50], eax
mov eax, esp
mov dword [esp + 0x54], sym.core::fmt::num::imp::__LT_impl_u20_core..fmt..Display_u20_for_u20_u64_GT_::fmt::h49ddf71ce1ac72e2
mov dword [esp + 0x58], eax
lea eax, [esp + 0x28]
mov dword [esp + 0x5c], sym.core::fmt::num::imp::__LT_impl_u20_core..fmt..Display_u20_for_u20_u64_GT_::fmt::h49ddf71ce1ac72e2
mov dword [esp + 0x70], eax
lea eax, [esp + 0x68]
mov dword [esp + 0x74], 7
push eax
push dword [esi + 0x18]
push dword [esi + 0x14]
call sym.core::fmt::write::h6d9651045a265294
add esp, 0xc
lea esp, [ebp - 8]
pop esi
pop edi
pop ebp
ret
Function at 0x10019880
Capabilities:
Get disk size

Disassembly:
push ebp
mov ebp, esp
push esi
and esp, 0xfffffff8
sub esp, 0x18
mov esi, dword [ebp + 8]
mov eax, dword [esi + 0x38]
or eax, dword [esi + 0x3c]
je 0x100198ef
mov eax, esp
mov dword [esp + 4], 0
mov dword [esp], 0
push eax
push 0
push 0
push dword [esi + 0x4c]
call sub.kernel32.dll_GetDiskFreeSpaceExW
test eax, eax
je 0x100198c9
movsd xmm0, qword [esp]
mov al, 1
movsd qword [esi + 0x40], xmm0
lea esp, [ebp - 4]
pop esi
pop ebp
ret
call sym.windows_result::error::Error::from_win32::h82b0b4b9d87e3c47
test edx, edx
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], edx
mov dword [esp + 8], 1
je 0x100198ef
lea eax, [esp + 0x10]
push eax
call sym.__LT_windows_result..com..ComPtr_u20_as_u20_core..ops..drop..Drop_GT_::drop::h9cbffdb6c4b299b4
add esp, 4
xor eax, eax
lea esp, [ebp - 4]
pop esi
pop ebp
ret

Function at 0x100199d0
Capabilities:
Get disk size

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x18
mov ecx, dword [ebp + 8]
mov eax, dword [ecx + 8]
test eax, eax
je 0x10019a61
mov esi, dword [ecx + 4]
imul ebx, eax, 0x58
mov edi, esp
add esi, 0x38
jmp 0x10019a12
movsd xmm0, qword [esp]
movsd qword [esi + 8], xmm0
add esi, 0x58
add ebx, 0xffffffa8
je 0x10019a61
mov eax, dword [esi]
or eax, dword [esi + 4]
je 0x10019a0a
mov dword [esp + 4], 0
mov dword [esp], 0
push edi
push 0
push 0
push dword [esi + 0x14]
call sub.kernel32.dll_GetDiskFreeSpaceExW
test eax, eax
jne 0x10019a00
call sym.windows_result::error::Error::from_win32::h82b0b4b9d87e3c47
test edx, edx
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], edx
mov dword [esp + 8], 1
je 0x10019a0a
lea eax, [esp + 0x10]
push eax
call sym.__LT_windows_result..com..ComPtr_u20_as_u20_core..ops..drop..Drop_GT_::drop::h9cbffdb6c4b299b4
add esp, 4
jmp 0x10019a0a
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x10019a70
Capabilities:
Enumerate disk volumes

Disassembly:
push ebp
mov ebp, esp
pop ebp
jmp sym.sysinfo::windows::disk::DisksInner::refresh_list::h04fe05f50c1d1235

Function at 0x10019c20
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
pop ebp
jmp sym.sysinfo::windows::network::NetworksInner::refresh_list::hf9db28ed9c922844
Function at 0x10019f00
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x88
mov edi, dword [ebp + 8]
mov esi, dword [ebp + 0xc]
lea eax, [edi + 8]
push eax
call sym.std::sys::os_str::wtf8::Buf::as_mut_slice::h1c48b2ce9855202e
add esp, 4
mov dword [esp + 8], eax
lea eax, [edi + 0x18]
mov dword [esp + 0xc], edx
push eax
call sym.std::sys::os_str::wtf8::Buf::as_mut_slice::h1c48b2ce9855202e
add esp, 4
mov dword [esp + 0x10], eax
movzx eax, byte [edi + 0x54]
movsd xmm0, qword [edi]
mov dword [esp + 0x14], edx
mov ecx, 0x10158ea2
mov edx, str.noyesDisk___FS:___Type:___removable:___mounted_on_:__B
test eax, eax
movsd qword [esp + 0x80], xmm0
cmovne edx, ecx
or eax, 2
mov dword [esp + 0x18], edx
mov dword [esp + 0x1c], eax
lea eax, [edi + 0x28]
push eax
call sym.std::sys::os_str::wtf8::Buf::as_mut_slice::h1c48b2ce9855202e
add esp, 4
mov dword [esp + 0x20], eax
mov eax, dword [edi + 0x38]
movsd xmm0, qword [edi + 0x40]
mov ecx, dword [edi + 0x3c]
mov dword [esp + 0x68], 0x10158ed8
mov dword [esp + 0x6c], 8
mov dword [esp + 0x78], 0
mov dword [esp + 0x24], edx
mov dword [esp], eax
lea eax, [esp + 8]
movsd qword [esp + 0x60], xmm0
mov dword [esp + 4], ecx
mov dword [esp + 0x28], eax
lea eax, [esp + 0x10]
mov dword [esp + 0x2c], sym.__LT__RF_T_u20_as_u20_core..fmt..Debug_GT_::fmt::hcd328294ee96d934
mov dword [esp + 0x30], eax
lea eax, [esp + 0x80]
mov dword [esp + 0x34], sym.__LT__RF_T_u20_as_u20_core..fmt..Debug_GT_::fmt::hcd328294ee96d934
mov dword [esp + 0x38], eax
lea eax, [esp + 0x18]
mov dword [esp + 0x3c], sym.__LT_sysinfo..common..disk..DiskKind_u20_as_u20_core..fmt..Debug_GT_::fmt::h9776a932f0b9d295
mov dword [esp + 0x40], eax
lea eax, [esp + 0x20]
mov dword [esp + 0x44], sym.__LT__RF_T_u20_as_u20_core..fmt..Display_GT_::fmt::h30ba4b7b8571ef3a
mov dword [esp + 0x48], eax
lea eax, [esp + 0x60]
mov dword [esp + 0x4c], sym.__LT__RF_T_u20_as_u20_core..fmt..Debug_GT_::fmt::h0d771c6831cd0041
mov dword [esp + 0x50], eax
mov eax, esp
mov dword [esp + 0x54], sym.core::fmt::num::imp::__LT_impl_u20_core..fmt..Display_u20_for_u20_u64_GT_::fmt::h49ddf71ce1ac72e2
mov dword [esp + 0x58], eax
lea eax, [esp + 0x28]
mov dword [esp + 0x5c], sym.core::fmt::num::imp::__LT_impl_u20_core..fmt..Display_u20_for_u20_u64_GT_::fmt::h49ddf71ce1ac72e2
mov dword [esp + 0x70], eax
lea eax, [esp + 0x68]
mov dword [esp + 0x74], 7
push eax
push dword [esi + 0x18]
push dword [esi + 0x14]
call sym.core::fmt::write::h6d9651045a265294
add esp, 0xc
lea esp, [ebp - 8]
pop esi
pop edi
pop ebp
ret

Function at 0x1001d4b0
Capabilities:
Get logon sessions

Disassembly:
push ebp
mov ebp, esp
pop ebp
jmp sym.sysinfo::windows::users::get_users::he1b00deaca53c220

Function at 0x1001d570
Capabilities:
List user account groups

Disassembly:
push ebp
mov ebp, esp
pop ebp
jmp sym.sysinfo::windows::groups::get_groups::he1cd6dbe92a4d49d
Function at 0x1001d670
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push eax
xor ecx, ecx
call sym.__ZN3std4hash6random11RandomState3new4KEYS28__u7b__u7b_closure_u7d__u7d_17hee262fc86f865827E.llvm.14423005424087649017
test eax, eax
je 0x1001d6b8
mov ecx, eax
mov eax, dword [ebp + 8]
movsd xmm1, qword [0x101592b8]
movsd xmm2, qword [0x101592b0]
movdqu xmm0, xmmword [ecx]
movd edx, xmm0
add edx, 1
adc dword [ecx + 4], 0
mov dword [ecx], edx
movsd qword [eax + 8], xmm1
movsd qword [eax], xmm2
movdqu xmmword [eax + 0x10], xmm0
add esp, 4
pop ebp
ret
lea eax, [ebp - 1]
push 0x101591d8
push 0x10159248
push eax
push 0x46
push 0x10159140
call sym.core::result::unwrap_failed::h534a40e08cfe968a
nop word cs:[eax + eax]
nop dword [eax]
Function at 0x1001f060
Capabilities:
Get local ipv4 addresses

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x38
xor ebx, ebx
xor esi, esi
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0x14], 0x3c00
nop word [eax + eax]
push dword [ebp - 0x14]
push ebx
call sub.msvcrt.dll_realloc
add esp, 8
test eax, eax
je 0x1001f11a
mov edi, eax
lea eax, [ebp - 0x14]
push eax
push edi
push 0
push 0xe
push 0
call sub.iphlpapi.dll_GetAdaptersAddresses
test eax, eax
mov dword [ebp - 0x18], eax
je 0x1001f162
cmp esi, 1
ja 0x1001f0be
inc esi
cmp eax, 0x6f
mov ebx, edi
je 0x1001f080
lea eax, [ebp - 0x18]
mov dword [ebp - 0x44], 0x101593a0
mov dword [ebp - 0x40], 1
mov dword [ebp - 0x34], 0
mov dword [ebp - 0x20], eax
lea eax, [ebp - 0x20]
mov dword [ebp - 0x1c], sym.core::fmt::num::imp::__LT_impl_u20_core..fmt..Display_u20_for_u20_u32_GT_::fmt::h8917667e5366c09f
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0x38], 1
lea eax, [ebp - 0x44]
lea ecx, [ebp - 0x2c]
push eax
push ecx
call sym.alloc::fmt::format::format_inner::h615817f0e0a04e8e
add esp, 8
mov eax, dword [ebp - 0x24]
mov ecx, dword [ebp - 0x10]
movsd xmm0, qword [ebp - 0x2c]
mov dword [ecx + 8], eax
movsd qword [ecx], xmm0
push edi
call sub.msvcrt.dll_free
add esp, 4
jmp 0x1001f171
mov eax, dword [0x1017b554]
movzx eax, byte [eax]
push 1
push 0x32
call sym.___rust_alloc
add esp, 8
test eax, eax
je 0x1001f179
mov edi, eax
push 0x32
push 0x10159344
push eax
call sub.msvcrt.dll_memcpy
add esp, 0xc
push ebx
call sub.msvcrt.dll_free
add esp, 4
mov eax, dword [ebp - 0x10]
mov dword [eax], 0x32
mov dword [eax + 4], edi
mov dword [eax + 8], 0x32
jmp 0x1001f171
mov eax, dword [ebp - 0x10]
mov dword [eax + 4], edi
mov dword [eax + 8], edi
mov dword [eax], 0x80000000
add esp, 0x38
pop esi
pop edi
pop ebx
pop ebp
ret
push 0x32
push 1
call sym.alloc::raw_vec::handle_error::he63c9115d026ec98
add esp, 8
ud2