joyce8/EMBER2024-capa huggingface dataset:
Function at 0x514850
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x5149fd
sub esp, 0x58
mov eax, dword [esp + 0x5c]
mov ecx, dword [eax + 0xa0]
test ecx, ecx
je 0x5149e9
mov eax, dword [esp + 0x60]
mov dword [esp + 0x3c], eax
mov eax, dword [esp + 0x64]
mov dword [esp + 0x40], eax
mov eax, dword [esp + 0x68]
mov dword [esp + 0x44], eax
mov eax, dword [esp + 0x6c]
mov dword [esp + 0x30], eax
mov eax, dword [esp + 0x70]
mov dword [esp + 0x34], eax
mov eax, dword [esp + 0x74]
mov dword [esp + 0x38], eax
mov dword [esp + 0x48], 0
mov dword [esp + 0x4c], 0
mov dword [esp + 0x50], 0
mov dword [esp + 0x54], 0
lea eax, [0x5f7d60]
mov dword [esp], eax
lea ecx, [esp + 0x3c]
mov dword [esp + 4], ecx
call dbg.runtime.convT2Eslice
mov eax, dword [esp + 8]
mov ecx, dword [esp + 0xc]
mov dword [esp + 0x48], eax
mov dword [esp + 0x4c], ecx
lea eax, [0x5f7d60]
mov dword [esp], eax
lea eax, [esp + 0x30]
mov dword [esp + 4], eax
call dbg.runtime.convT2Eslice
mov eax, dword [esp + 8]
mov ecx, dword [esp + 0xc]
mov dword [esp + 0x50], eax
mov dword [esp + 0x54], ecx
lea eax, [0x64a410]
mov dword [esp], eax
mov dword [esp + 4], 0x14
lea eax, [esp + 0x48]
mov dword [esp + 8], eax
mov dword [esp + 0xc], 2
mov dword [esp + 0x10], 2
call dbg.fmt.Sprintf
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x18]
mov dword [esp], 0
mov dword [esp + 4], eax
mov dword [esp + 8], ecx
call dbg.runtime.stringtoslicebyte
mov eax, dword [esp + 0xc]
mov dword [esp + 0x24], eax
mov ecx, dword [esp + 0x10]
mov dword [esp + 0x1c], ecx
mov edx, dword [esp + 0x14]
mov dword [esp + 0x20], edx
lea ebx, [0x79b5b0]
mov dword [esp], ebx
call dbg.sync.(*Mutex).Lock
mov eax, dword [esp + 0x5c]
mov ecx, dword [eax + 0xa0]
mov eax, dword [eax + 0xa4]
mov ecx, dword [ecx + 0x14]
mov edx, dword [esp + 0x24]
mov dword [esp + 4], edx
mov edx, dword [esp + 0x1c]
mov dword [esp + 8], edx
mov edx, dword [esp + 0x20]
mov dword [esp + 0xc], edx
mov dword [esp], eax
call ecx
mov eax, dword [esp + 0x14]
mov dword [esp + 0x28], eax
mov ecx, dword [esp + 0x18]
mov dword [esp + 0x2c], ecx
lea edx, [0x79b5b0]
mov dword [esp], edx
call dbg.sync.(*Mutex).Unlock
mov eax, dword [esp + 0x28]
mov dword [esp + 0x78], eax
mov eax, dword [esp + 0x2c]
mov dword [esp + 0x7c], eax
add esp, 0x58
ret
mov dword [esp + 0x78], 0
mov dword [esp + 0x7c], 0
add esp, 0x58
ret
call dbg.runtime.morestack_noctxt
jmp dbg.crypto/tls.(*Config).writeKeyLog
Function at 0x5151b0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x5152bc
sub esp, 0x18
mov eax, dword [esp + 0x20]
cmp eax, 1
jl 0x51529d
lea ecx, [eax - 1]
cmp ecx, eax
jae 0x5152b5
mov edx, dword [esp + 0x1c]
movzx ebx, byte [eax + edx - 1]
movzx ebp, bl
mov esi, ecx
sub ecx, ebp
cmp eax, 0x100
jge 0x515291
mov edi, esi
mov dword [esp + 0xc], edi
mov byte [esp + 2], bl
mov dword [esp + 8], ebp
not ecx
sar ecx, 0x1f
mov dword [esp + 0x10], eax
xor eax, eax
mov dword [esp + 4], eax
mov eax, dword [esp + 0x10]
jmp 0x51524f
inc ecx
xchg ebp, ebx
not ebx
xchg ebp, ebx
sar ebp, 0x1f
movzx edi, byte [edx + edi]
and ebx, ebp
and edi, ebp
xor ebx, edi
not ebx
movzx ebp, byte [esp + 3]
and ebp, ebx
movzx ebx, byte [esp + 2]
mov edi, dword [esp + 0xc]
mov dword [esp + 4], ecx
mov ecx, ebp
mov ebp, dword [esp + 8]
mov byte [esp + 3], cl
mov ecx, dword [esp + 4]
cmp ecx, esi
jge 0x515265
sub ebp, ecx
sub edi, ecx
cmp edi, eax
jb 0x51521f
jmp 0x5152ae
movzx eax, bl
inc eax
mov dword [esp + 0x28], eax
movzx eax, byte [esp + 3]
mov ecx, eax
shl eax, 4
and ecx, eax
mov eax, ecx
shl ecx, 2
and ecx, eax
mov eax, ecx
shl ecx, 1
and ecx, eax
sar cl, 7
mov byte [esp + 0x2c], cl
add esp, 0x18
ret
mov edi, esi
mov esi, 0xff
jmp 0x5151fe
mov dword [esp + 0x28], 0
mov byte [esp + 0x2c], 0
add esp, 0x18
ret
call dbg.runtime.panicindex
ud2
call dbg.runtime.panicindex
ud2
call dbg.runtime.morestack_noctxt
jmp dbg.crypto/tls.extractPadding
Function at 0x533100
Capabilities:
Parse credit card information

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x5332bc
movzx eax, byte [esp + 4]
lea ecx, [eax - 0x41]
cmp cl, 0x19
ja 0x533129
mov byte [esp + 0xc], 0
ret
lea ecx, [eax - 0x61]
cmp cl, 0x19
jbe 0x533123
lea ecx, [eax - 0x30]
cmp cl, 9
jbe 0x533123
mov ecx, dword [esp + 8]
cmp ecx, 3
jne 0x5332ae
cmp al, 0x2c
ja 0x53328b
lea edx, [eax - 0x21]
cmp dl, 1
ja 0x53315d
mov byte [esp + 0xc], 0
ret
cmp al, 0x24
je 0x533157
lea edx, [eax - 0x26]
cmp dl, 6
jbe 0x533157
cmp al, 0x2f
ja 0x533251
cmp al, 0x26
ja 0x533229
cmp al, 0x24
jne 0x53321e
cmp ecx, 2
jg 0x5331d4
cmp ecx, 1
je 0x5331c9
cmp ecx, 2
jne 0x5331c3
cmp al, 0x2f
jne 0x5331a3
mov eax, 1
mov byte [esp + 0xc], al
ret
cmp al, 0x3b
jne 0x5331af
mov eax, 1
jmp 0x53319e
cmp al, 0x2c
jne 0x5331bb
mov eax, 1
jmp 0x53319e
cmp al, 0x3f
sete al
jmp 0x53319e
mov byte [esp + 0xc], 1
ret
cmp al, 0x3f
sete al
mov byte [esp + 0xc], al
ret
cmp ecx, 5
jne 0x533208
cmp al, 0x40
jne 0x5331e8
mov eax, 1
mov byte [esp + 0xc], al
ret
cmp al, 0x2f
jne 0x5331f4
mov eax, 1
jmp 0x5331e3
cmp al, 0x3f
jne 0x533200
mov eax, 1
jmp 0x5331e3
cmp al, 0x3a
sete al
jmp 0x5331e3
cmp ecx, 6
je 0x533218
cmp ecx, 7
jne 0x5331c3
mov byte [esp + 0xc], 0
ret
mov byte [esp + 0xc], 1
ret
cmp al, 0x26
je 0x533185
jmp 0x5331c3
lea edx, [eax - 0x2b]
cmp dl, 1
jbe 0x533185
lea edx, [eax - 0x2d]
cmp dl, 1
ja 0x533243
mov byte [esp + 0xc], 0
ret
cmp al, 0x2f
je 0x533185
jmp 0x5331c3
cmp al, 0x3d
ja 0x533270
lea edx, [eax - 0x3a]
cmp dl, 1
jbe 0x533185
cmp al, 0x3d
je 0x533185
jmp 0x5331c3
lea edx, [eax - 0x3f]
cmp dl, 1
jbe 0x533185
cmp al, 0x5f
je 0x53323d
cmp al, 0x7e
je 0x53323d
jmp 0x5331c3
lea edx, [eax - 0x3a]
cmp dl, 4
jbe 0x533157
cmp al, 0x5b
je 0x533157
cmp al, 0x5d
je 0x533157
jmp 0x53316a
cmp ecx, 4
je 0x533146
jmp 0x53316a
call dbg.runtime.morestack_noctxt
jmp dbg.net/url.shouldEscape
Function at 0x580570
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x580705
sub esp, 0x74
mov eax, dword [esp + 0x78]
test eax, eax
je 0x5806fe
mov ecx, dword [eax]
lea eax, [0x635da0]
mov dword [esp], eax
mov dword [esp + 4], ecx
sar ecx, 0x1f
mov dword [esp + 8], ecx
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 0
call dbg.runtime.makemap
mov eax, dword [esp + 0x14]
mov dword [esp + 0x40], eax
lea edi, [esp + 0x44]
xor eax, eax
call fcn.0044c044
lea eax, [0x635da0]
mov dword [esp], eax
mov ecx, dword [esp + 0x78]
mov dword [esp + 4], ecx
lea ecx, [esp + 0x44]
mov dword [esp + 8], ecx
call dbg.runtime.mapiterinit
jmp 0x5805ff
lea eax, [esp + 0x44]
mov dword [esp], eax
call dbg.runtime.mapiternext
mov eax, dword [esp + 0x44]
test eax, eax
je 0x5806f2
mov ecx, dword [esp + 0x48]
mov edx, dword [eax + 4]
mov dword [esp + 0x30], edx
mov ebx, dword [ecx + 8]
mov dword [esp + 0x2c], ebx
mov ebp, dword [ecx + 4]
mov dword [esp + 0x28], ebp
mov eax, dword [eax]
mov dword [esp + 0x3c], eax
mov ecx, dword [ecx]
mov dword [esp + 0x38], ecx
lea esi, [0x604c20]
mov dword [esp], esi
mov dword [esp + 4], ebp
mov dword [esp + 8], ebp
call dbg.runtime.makeslice
mov eax, dword [esp + 0xc]
mov dword [esp + 0x34], eax
mov ecx, dword [esp + 0x10]
mov dword [esp + 0x20], ecx
mov edx, dword [esp + 0x14]
mov dword [esp + 0x24], edx
lea ebx, [0x604c20]
mov dword [esp], ebx
mov dword [esp + 4], eax
mov dword [esp + 8], ecx
mov dword [esp + 0xc], edx
mov ebp, dword [esp + 0x38]
mov dword [esp + 0x10], ebp
mov ebp, dword [esp + 0x28]
mov dword [esp + 0x14], ebp
mov ebp, dword [esp + 0x2c]
mov dword [esp + 0x18], ebp
call dbg.runtime.typedslicecopy
lea eax, [0x635da0]
mov dword [esp], eax
mov ecx, dword [esp + 0x40]
mov dword [esp + 4], ecx
mov edx, dword [esp + 0x3c]
mov dword [esp + 8], edx
mov edx, dword [esp + 0x30]
mov dword [esp + 0xc], edx
call dbg.runtime.mapassign_faststr
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x20]
mov dword [eax + 4], ecx
mov ecx, dword [esp + 0x24]
mov dword [eax + 8], ecx
mov ecx, dword [0x79b700]
test ecx, ecx
jne 0x5806dd
mov ecx, dword [esp + 0x34]
mov dword [eax], ecx
jmp 0x5805f3
mov dword [esp], eax
mov eax, dword [esp + 0x34]
mov dword [esp + 4], eax
call dbg.runtime.writebarrierptr
jmp 0x5805f3
mov eax, dword [esp + 0x40]
mov dword [esp + 0x7c], eax
add esp, 0x74
ret
xor ecx, ecx
jmp 0x580597
call dbg.runtime.morestack_noctxt
jmp dbg.net/http.Header.clone
Function at 0x581110
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x5812a5
sub esp, 0x74
mov eax, dword [esp + 0x78]
test eax, eax
je 0x58129e
mov ecx, dword [eax]
lea eax, [0x635da0]
mov dword [esp], eax
mov dword [esp + 4], ecx
sar ecx, 0x1f
mov dword [esp + 8], ecx
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 0
call dbg.runtime.makemap
mov eax, dword [esp + 0x14]
mov dword [esp + 0x40], eax
lea edi, [esp + 0x44]
xor eax, eax
call fcn.0044c044
lea eax, [0x635da0]
mov dword [esp], eax
mov ecx, dword [esp + 0x78]
mov dword [esp + 4], ecx
lea ecx, [esp + 0x44]
mov dword [esp + 8], ecx
call dbg.runtime.mapiterinit
jmp 0x58119f
lea eax, [esp + 0x44]
mov dword [esp], eax
call dbg.runtime.mapiternext
mov eax, dword [esp + 0x44]
test eax, eax
je 0x581292
mov ecx, dword [esp + 0x48]
mov edx, dword [eax + 4]
mov dword [esp + 0x30], edx
mov ebx, dword [ecx + 8]
mov dword [esp + 0x2c], ebx
mov ebp, dword [ecx + 4]
mov dword [esp + 0x28], ebp
mov eax, dword [eax]
mov dword [esp + 0x3c], eax
mov ecx, dword [ecx]
mov dword [esp + 0x38], ecx
lea esi, [0x604c20]
mov dword [esp], esi
mov dword [esp + 4], ebp
mov dword [esp + 8], ebp
call dbg.runtime.makeslice
mov eax, dword [esp + 0xc]
mov dword [esp + 0x34], eax
mov ecx, dword [esp + 0x10]
mov dword [esp + 0x20], ecx
mov edx, dword [esp + 0x14]
mov dword [esp + 0x24], edx
lea ebx, [0x604c20]
mov dword [esp], ebx
mov dword [esp + 4], eax
mov dword [esp + 8], ecx
mov dword [esp + 0xc], edx
mov ebp, dword [esp + 0x38]
mov dword [esp + 0x10], ebp
mov ebp, dword [esp + 0x28]
mov dword [esp + 0x14], ebp
mov ebp, dword [esp + 0x2c]
mov dword [esp + 0x18], ebp
call dbg.runtime.typedslicecopy
lea eax, [0x635da0]
mov dword [esp], eax
mov ecx, dword [esp + 0x40]
mov dword [esp + 4], ecx
mov edx, dword [esp + 0x3c]
mov dword [esp + 8], edx
mov edx, dword [esp + 0x30]
mov dword [esp + 0xc], edx
call dbg.runtime.mapassign_faststr
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x20]
mov dword [eax + 4], ecx
mov ecx, dword [esp + 0x24]
mov dword [eax + 8], ecx
mov ecx, dword [0x79b700]
test ecx, ecx
jne 0x58127d
mov ecx, dword [esp + 0x34]
mov dword [eax], ecx
jmp 0x581193
mov dword [esp], eax
mov eax, dword [esp + 0x34]
mov dword [esp + 4], eax
call dbg.runtime.writebarrierptr
jmp 0x581193
mov eax, dword [esp + 0x40]
mov dword [esp + 0x7c], eax
add esp, 0x74
ret
xor ecx, ecx
jmp 0x581137
call dbg.runtime.morestack_noctxt
jmp dbg.net/http.cloneHeader
Function at 0x58a1d0
Capabilities:
Check for software breakpoints

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x58a23d
sub esp, 8
mov eax, dword [esp + 0xc]
movzx ecx, byte [eax + 0x14]
test cl, cl
je 0x58a223
mov eax, dword [eax + 0x40]
lea ecx, [eax - 0x64]
cmp ecx, 0x63
ja 0x58a206
xor eax, eax
mov byte [esp + 0x10], al
add esp, 8
ret
cmp eax, 0xcc
jne 0x58a211
xor eax, eax
jmp 0x58a1fe
cmp eax, 0x130
jne 0x58a21c
xor eax, eax
jmp 0x58a1fe
mov eax, 1
jmp 0x58a1fe
lea eax, [0x604c20]
mov dword [esp], eax
lea eax, [0x67afe0]
mov dword [esp + 4], eax
call dbg.runtime.gopanic
ud2
call dbg.runtime.morestack_noctxt
jmp dbg.net/http.(*response).bodyAllowed
Function at 0x58dae0
Capabilities:
Enumerate pe sections

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x58db80
sub esp, 0x10
mov eax, dword [esp + 0x14]
mov ecx, dword [eax + 8]
mov eax, dword [eax + 0xc]
test ecx, ecx
je 0x58db72
mov edx, dword [esp + 0x20]
mov ebx, dword [edx + 0x64]
mov ebp, dword [edx + 0x68]
cmp ebp, 1
jne 0x58db52
movzx ebx, byte [ebx]
cmp bl, 0x2a
jne 0x58db52
mov ebx, dword [edx]
mov ebp, dword [edx + 4]
cmp ebp, 7
jne 0x58db52
mov ebp, dword [ebx]
cmp ebp, 0x4954504f
jne 0x58db52
movzx ebp, word [ebx + 4]
cmp bp, 0x4e4f
jne 0x58db52
movzx ebx, byte [ebx + 6]
cmp bl, 0x53
jne 0x58db52
lea eax, [0x79b59c]
lea ecx, [0x758690]
mov ecx, dword [ecx + 0x14]
mov ebx, dword [esp + 0x18]
mov dword [esp + 4], ebx
mov ebx, dword [esp + 0x1c]
mov dword [esp + 8], ebx
mov dword [esp + 0xc], edx
mov dword [esp], eax
call ecx
add esp, 0x10
ret
mov eax, dword [0x783110]
lea ecx, [0x757e30]
jmp 0x58db07
call dbg.runtime.morestack_noctxt
jmp dbg.net/http.serverHandler.ServeHTTP
Function at 0x592600
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x59272e
sub esp, 0x28
mov eax, dword [esp + 0x2c]
cmp eax, 1
jl 0x592725
lea eax, [0x635da0]
mov dword [esp], eax
mov eax, dword [esp + 0x34]
mov dword [esp + 4], eax
lea ecx, [0x646c71]
mov dword [esp + 8], ecx
mov dword [esp + 0xc], 0xa
call dbg.runtime.mapaccess1_faststr
mov eax, dword [esp + 0x10]
mov ecx, dword [eax + 8]
mov dword [esp + 0x20], ecx
mov edx, dword [eax + 4]
mov dword [esp + 0x1c], edx
mov eax, dword [eax]
mov dword [esp + 0x24], eax
mov dword [esp], eax
mov dword [esp + 4], edx
mov dword [esp + 8], ecx
lea ebx, [0x645cfb]
mov dword [esp + 0xc], ebx
mov dword [esp + 0x10], 5
call dbg.vendor/golang_org/x/net/lex/httplex.HeaderValuesContainsToken
movzx eax, byte [esp + 0x14]
mov ecx, dword [esp + 0x2c]
cmp ecx, 1
jne 0x5926e7
mov ecx, dword [esp + 0x30]
test ecx, ecx
jne 0x5926e7
test al, al
je 0x5926af
mov eax, 1
mov byte [esp + 0x3c], al
add esp, 0x28
ret
mov eax, dword [esp + 0x24]
mov dword [esp], eax
mov eax, dword [esp + 0x1c]
mov dword [esp + 4], eax
mov eax, dword [esp + 0x20]
mov dword [esp + 8], eax
lea eax, [0x646f7d]
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], 0xa
call dbg.vendor/golang_org/x/net/lex/httplex.HeaderValuesContainsToken
movzx eax, byte [esp + 0x14]
xor eax, 1
jmp 0x5926a7
test al, al
je 0x5926f4
movzx ecx, byte [esp + 0x38]
test cl, cl
jne 0x5926fc
mov byte [esp + 0x3c], al
add esp, 0x28
ret
mov byte [esp + 0x1b], al
mov eax, dword [esp + 0x34]
mov dword [esp], eax
lea eax, [0x646c71]
mov dword [esp + 4], eax
mov dword [esp + 8], 0xa
call dbg.net/http.Header.Del
movzx eax, byte [esp + 0x1b]
jmp 0x5926f4
mov byte [esp + 0x3c], 1
add esp, 0x28
ret
call dbg.runtime.morestack_noctxt
jmp dbg.net/http.shouldClose
Function at 0x4011e0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 4
push ebx
push esi
push edi
jmp loc.004203ac

Function at 0x401750
Capabilities:
Parse pe header
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
jmp loc.00418ea7

Function at 0x401830
Capabilities:
Packed with generic packer
Parse pe header

Disassembly:
push ebx
push esi
push edi
mov eax, dword [esp + 0x10]
jmp loc.0041e57a

Function at 0x401d20
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebx
mov ebx, dword [esp + 8]
mov ecx, ebx
jmp loc.004200c6

Function at 0x402c90
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x800
push ebx
push esi
push edi
jmp loc.0042064b

Function at 0x4043a0
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x406540
push 0x404548
push dword fs:[0]
mov dword fs:[0], esp
sub esp, 0x50
push ebx
push esi
push edi
mov dword [ebp - 0x18], esp
push 0x2000000
call fcn.00404f10
pop ecx
mov dword [0x4072a0], eax
call fcn.004047e0
test eax, eax
jne 0x4043e7
push 1
call fcn.00404530
pop ecx
mov dword [ebp - 4], 0
jmp loc.0041bc88

Function at 0x4047b9
Capabilities:
Packed with generic packer

Disassembly:
push ebx
push ecx
mov ebx, 0x407278
mov ecx, dword [esp + 0xc]
mov dword [ebx + 8], ecx
jmp loc.0041942c

Function at 0x404d00
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10c
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
jmp loc.0042092b

Function at 0x404da0
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 4
push ebx
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStrings]
mov ebx, eax
test eax, eax
jne fcn.00404dbb
jmp loc.00418fbe

Function at 0x404e60
Capabilities:
Accept command line arguments

Disassembly:
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
jmp loc.00420513

Function at 0x41872c
Capabilities:
Packed with generic packer

Disassembly:
pushfd
pushal
push ebp
mov ebp, esp
push ebx
push edi
push 0x20
push 0x8001
push 8
push 0x2b4
push eax
push 0x40931c
push 0x409304
push 0x46ad20
push eax
mov edi, 0x4c3000
push edi
mov eax, edi
add esp, 0x30
leave
popal
popfd
mov esi, dword [esp + 0x10]
test ebx, ebx
jmp fcn.004058cc

Function at 0x41c71d
Capabilities:
Packed with generic packer

Disassembly:
pushfd
pushal
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4050a0
push 0x401cd0
push eax
push ebx
push edi
xor edx, edx
mov dl, ah
mov ecx, eax
and ecx, 0xff
shl ecx, 8
add ecx, edx
shr eax, 0x10
pop ecx
test eax, eax
add esp, 0x14
leave
popal
popfd
call fcn.004042a0
jmp loc.00403184
Function at 0x433000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43300c
nop
nop
nop
nop
pop eax
nop
add eax, 0x40a063
nop
sub eax, 0x40a009
nop
nop
nop
nop
nop
mov ebx, dword [eax]
nop
nop
nop
mov ecx, dword [eax + 4]
mov edx, dword [eax + 8]
nop
nop
nop
nop
nop
nop
nop
xor dword [ebx], edx
nop
nop
add ebx, 4
nop
nop
nop
cmp ebx, ecx
nop
nop
jl 0x433030
nop
nop
nop
nop
nop
nop
add eax, 0xc
nop
cmp dword [eax], 0
nop
nop
nop
nop
nop
nop
nop
jne 0x43301e
nop
popal
nop
nop
nop
nop
jmp 0x431219

Function at 0x438c97
Capabilities:
Encode data using xor

Disassembly:
sub esp, 4
mov dword [esp], 0x438a14
pop eax
sub esi, 1
add esi, 0x5f092577
call fcn.00438ce5
or esi, esi
or edx, edx
xor dword [ebx], eax
push 0xd1c66f23
pop esi
sub esi, 0x148fc35
inc ebx
mov esi, edx
cmp ebx, edi
jne fcn.00438c97
mov edx, 0xc9b6297a
add edx, 0xfeaf4631
sub esp, 4
mov dword [esp], 0x3e78e164
pop edx
ret
Function at 0x4104a0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
push ebx
push edi
push esi
mov eax, edx
mov edx, dword [esp + 0x14]
mov ebp, dword [esp + 0x20]
xor esi, esi
lea edx, [eax + edx*2]
movzx ebx, byte [eax + 1]
cmp byte [eax], ch
lea eax, [eax + 2]
lea edi, [esi + ebx]
jne 0x4104f0
cmp esi, edi
ja 0x410558
cmp edi, dword [esp + 0x1c]
ja 0x41056b
add esi, dword [esp + 0x18]
nop word [eax + eax]
test ebx, ebx
je 0x4104f2
dec ebx
cmp byte [esi], cl
lea esi, [esi + 1]
jne 0x4104e0
jmp 0x41054f
ja 0x4104f8
cmp eax, edx
mov esi, edi
jne 0x4104b3
mov edi, dword [esp + 0x24]
movzx ecx, cx
mov al, 1
add edi, ebp
nop word cs:[eax + eax]
nop dword [eax]
movzx edx, byte [ebp]
lea esi, [ebp + 1]
test dl, dl
js 0x410530
mov ebp, esi
sub ecx, edx
jns 0x410547
jmp 0x410551
cmp esi, edi
je 0x410580
movzx esi, byte [ebp + 1]
and edx, 0x7f
add ebp, 2
shl edx, 8
or edx, esi
sub ecx, edx
js 0x410551
xor al, 1
cmp ebp, edi
jne 0x410510
jmp 0x410551
xor eax, eax
and al, 1
pop esi
pop edi
pop ebx
pop ebp
ret
mov ecx, esi
mov edx, edi
push 0x44a640
call fcn.00446d80
add esp, 4
ud2
mov edx, dword [esp + 0x1c]
mov ecx, edi
push 0x44a640
call fcn.00446b70
add esp, 4
ud2
mov ecx, str.called__Option::unwrap____on_a__None__value_rustc_82e1608dfa6e0b5569232559e3d385fea5a93112librarycore_srcio_borrowed_buf.rs_rustc_82e1608dfa6e0b5569232559e3d385fea5a93112library_alloc_srccollections_btree_navigate.rs
mov edx, 0x2b
push 0x44a630
call fcn.00446be0
add esp, 4
ud2
Function at 0x411b0e
Capabilities:
Hash data with crc32

Disassembly:
push ebp
push ebx
push edi
push esi
push eax
mov eax, edx
mov edx, dword [esp + 0x18]
mov ebx, ecx
not ebx
cmp edx, 0x40
jb 0x411c35
push 4
pop edi
sub edi, 1
jb 0x411b1d
cmp edx, 0xf
jbe 0x411c45
movzx ebp, byte [eax + 0xe]
movzx esi, byte [eax + 0xf]
mov ecx, ebx
mov dword [esp], edx
mov edx, 0xff
shr ecx, 0x18
mov ebp, dword [ebp*4 + 0x44b434]
xor ebp, dword [esi*4 + 0x44b034]
movzx esi, byte [eax + 0xd]
xor ebp, dword [esi*4 + 0x44b834]
movzx esi, byte [eax + 0xc]
xor ebp, dword [esi*4 + 0x44bc34]
movzx esi, byte [eax + 0xb]
xor ebp, dword [esi*4 + 0x44c034]
movzx esi, byte [eax + 0xa]
xor ebp, dword [esi*4 + 0x44c434]
movzx esi, byte [eax + 9]
xor ebp, dword [esi*4 + 0x44c834]
movzx esi, byte [eax + 8]
xor ebp, dword [esi*4 + 0x44cc34]
movzx esi, byte [eax + 7]
xor ebp, dword [esi*4 + 0x44d034]
movzx esi, byte [eax + 6]
xor ebp, dword [esi*4 + 0x44d434]
movzx esi, byte [eax + 5]
xor ebp, dword [esi*4 + 0x44d834]
movzx esi, byte [eax + 4]
xor ebp, dword [esi*4 + 0x44dc34]
movzx esi, byte [eax + 3]
xor ecx, esi
mov esi, ebx
xor ebp, dword [ecx*4 + 0x44e034]
movzx ecx, byte [eax + 2]
shr esi, 0x10
and esi, edx
xor esi, ecx
movzx ecx, byte [eax + 1]
xor ebp, dword [esi*4 + 0x44e434]
mov esi, ebx
and ebx, edx
shr esi, 8
and esi, edx
mov edx, dword [esp]
xor esi, ecx
movzx ecx, byte [eax]
xor ebp, dword [esi*4 + 0x44e834]
xor ebx, ecx
mov ecx, eax
xor ebp, dword [ebx*4 + 0x44ec34]
push 0x44b024
call fcn.0041209c
pop ecx
mov ebx, ebp
jmp 0x411b29
mov cl, byte [eax]
inc eax
dec edx
xor cl, bl
shr ebx, 8
movzx esi, cl
xor ebx, dword [esi*4 + 0x44b034]
test edx, edx
jne 0x411c22
not ebx
mov eax, ebx
add esp, 4
pop esi
pop edi
pop ebx
pop ebp
ret
push 0xf
pop ecx
push 0x44b014
call fcn.00446b00
pop eax
ud2
Function at 0x41dd80
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push edi
push esi
mov eax, dword [0x45d04c]
test eax, eax
je 0x41de33
dec eax
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
cmp eax, 2
jb 0x41ddac
cmp dword [eax + 4], 0
mov edi, eax
je 0x41ddac
add edi, 8
jmp 0x41de2e
mov eax, dword [0x45d04c]
test eax, eax
je 0x41de42
dec eax
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
cmp eax, 1
je 0x41de2c
mov esi, eax
test eax, eax
jne 0x41de02
movzx eax, byte [0x45daa8]
mov ecx, 0xc
call fcn.0040c6b0
test eax, eax
je 0x41de5d
mov dword [eax], 0x45d04c
mov dword [eax + 4], 0
mov esi, eax
mov eax, dword [0x45d04c]
test eax, eax
je 0x41de51
dec eax
push esi
push eax
call dword [sym.imp.kernel32.dll_TlsSetValue]
mov ecx, dword [esi + 8]
cmp dword [esi + 4], 0
lea edi, [esi + 8]
mov dword [esi + 4], 1
mov dword [esi + 8], 0
je 0x41de2e
test ecx, ecx
je 0x41de2e
lock dec dword [ecx]
jne 0x41de2e
call fcn.0041da80
jmp 0x41de2e
xor edi, edi
mov eax, edi
pop esi
pop edi
ret
mov ecx, 0x45d04c
call fcn.00447650
jmp 0x41dd90
mov ecx, 0x45d04c
call fcn.00447650
jmp 0x41ddba
mov ecx, 0x45d04c
call fcn.00447650
jmp 0x41ddfa
mov ecx, 4
mov edx, 0xc
call fcn.00446940
ud2
Function at 0x41eaa0
Capabilities:
Write file on windows

Disassembly:
push edi
push esi
sub esp, 0x34
mov eax, dword [esp + 0x40]
mov esi, ecx
mov ecx, dword [esp + 0x44]
mov edi, edx
mov dword [esp + 8], 0
mov dword [esp + 4], 0x103
lea edx, [esp + 4]
push 0
push 0
push ecx
push eax
push edx
push 0
push 0
push 0
push edi
call dword [sym.imp.ntdll.dll_NtWriteFile]
cmp eax, 0x103
jne 0x41eaf4
push 0xffffffffffffffff
push edi
call dword [sym.imp.kernel32.dll_WaitForSingleObject]
mov eax, dword [esp + 4]
cmp eax, 0x103
je 0x41eb17
test eax, eax
js 0x41eb03
mov eax, dword [esp + 8]
mov dword [esi + 4], eax
mov al, 4
jmp 0x41eb0f
push eax
call dword [sym.imp.ntdll.dll_RtlNtStatusToDosError]
mov dword [esi + 4], eax
xor eax, eax
mov byte [esi], al
add esp, 0x34
pop esi
pop edi
ret
mov eax, esp
mov dword [esp + 0x1c], 0x453060
mov dword [esp + 0x20], 1
mov dword [esp + 0x2c], 0
mov dword [esp + 0xc], 0
mov byte [esp + 0x10], 0
lea ecx, [esp + 0xc]
lea edx, [esp + 0x14]
mov dword [esp + 0x24], eax
lea eax, [esp + 0x1c]
mov dword [esp + 0x28], 0
push eax
push ecx
push edx
call fcn.0041d590
add esp, 0xc
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x18]
call fcn.0041d6c0
mov ecx, 7
int 0x29
ud2