joyce8/EMBER2024-capa huggingface dataset:
Function at 0x410490
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x68
mov eax, dword [ecx]
mov esi, ecx
mov ecx, eax
xor ecx, 3
lock cmpxchg dword [esi], ecx
jne 0x4104a0
test al, 1
je 0x410558
test al, 2
jne 0x41056c
test al, 8
jne 0x4104d5
lea ecx, [esi + 0x18]
mov dword [esp + 0x20], 2
lea edx, [esp + 0x20]
call sym.tokio::runtime::task::core::Core_LT_T_C_S_GT_::set_stage::h49f30fc506914a9a
jmp 0x4104ef
test al, 0x10
je 0x4104ef
mov eax, dword [esi + 0x50]
test eax, eax
je 0x4105da
mov eax, dword [eax + 8]
push dword [esi + 0x54]
call eax
add esp, 4
mov eax, dword [esi + 0x58]
test eax, eax
je 0x41051d
mov ecx, dword [esi + 0x5c]
movsd xmm0, qword [esi + 0x20]
mov edx, dword [ecx + 8]
movsd qword [esp + 0x40], xmm0
mov ecx, dword [ecx + 0x14]
dec edx
and edx, 0xfffffff8
lea eax, [eax + edx + 8]
lea edx, [esp + 0x40]
push edx
push eax
call ecx
add esp, 8
mov dword [esp + 8], 1
mov eax, 0xffffffc0
lock xadd dword [esi], eax
shr eax, 6
cmp eax, dword [esp + 8]
jb 0x410580
jne 0x410550
mov ecx, esi
call sym.__ZN4core3ptr255drop_in_place_LT_tokio..runtime..task..core..Cell_LT_tokio..runtime..blocking..task..BlockingTask_LT_msi_insta
push dword [esi - 4]
push 0
push dword [0x5e1120]
call sub.kernel32.dll_HeapFree
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
mov ecx, str.assertion_failed:_prev.is_running__
mov edx, 0x23
push 0x5b5c74
call sym.core::panicking::panic::hf6244c8fb5815825
mov ecx, 0x5b5c84
mov edx, 0x25
push 0x5b5cac
call sym.core::panicking::panic::hf6244c8fb5815825
lea esi, [esp + 0xc]
lea edi, [esp + 8]
mov dword [esp + 0x4c], 0x5b5ccc
mov dword [esp + 0x50], 2
mov dword [esp + 0xc], eax
mov dword [esp + 0x5c], 0
mov dword [esp + 0x10], esi
lea esi, [esp + 0x10]
mov dword [esp + 0x14], sym.core::fmt::num::imp::__LT_impl_u20_core..fmt..Display_u20_for_u20_u32_GT_::fmt::h8917667e5366c09f
mov dword [esp + 0x18], edi
mov dword [esp + 0x1c], sym.core::fmt::num::imp::__LT_impl_u20_core..fmt..Display_u20_for_u20_u32_GT_::fmt::h8917667e5366c09f
mov dword [esp + 0x54], esi
mov dword [esp + 0x58], 2
lea ecx, [esp + 0x4c]
mov edx, 0x5b5cdc
call sym.core::panicking::panic_fmt::hced28cb7137b21e1
mov dword [esp + 0x20], str.waker_missing
mov dword [esp + 0x24], 1
mov dword [esp + 0x30], 0
mov dword [esp + 0x28], 4
mov dword [esp + 0x2c], 0
lea ecx, [esp + 0x20]
mov edx, 0x5b5940
call sym.core::panicking::panic_fmt::hced28cb7137b21e1
ud2
Function at 0x410700
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x50
mov ebx, dword [0x5750e4]
test ebx, ebx
je 0x4107f2
dec ebx
push ebx
call sub.kernel32.dll_TlsGetValue
cmp eax, 1
ja 0x41082d
je 0x4107ee
lea edi, [esp + 8]
mov ecx, 0xe
mov esi, 0x5b4648
rep movsd dword es:[edi], dword [esi]
mov dword [esp + 0x40], ebx
movzx eax, byte [0x5e1184]
xor ecx, ecx
mov edx, 0x40
call sym.std::sys::alloc::windows::process_heap_alloc::hc2bfe060f1f208f4
test eax, eax
je 0x410835
movsd xmm0, qword [esp + 0x40]
movsd qword [eax + 0x38], xmm0
movsd xmm0, qword [esp + 0x38]
movsd qword [eax + 0x30], xmm0
movsd xmm0, qword [esp + 0x30]
movsd qword [eax + 0x28], xmm0
movsd xmm0, qword [esp + 0x28]
movsd qword [eax + 0x20], xmm0
movsd xmm0, qword [esp + 0x20]
movsd qword [eax + 0x18], xmm0
movsd xmm0, qword [esp + 0x18]
movsd qword [eax + 0x10], xmm0
movsd xmm0, qword [esp + 8]
movsd xmm1, qword [esp + 0x10]
movsd qword [eax + 8], xmm1
movsd qword [eax], xmm0
push ebx
mov edi, eax
call sub.kernel32.dll_TlsGetValue
mov esi, eax
mov dword [esp + 4], edi
push edi
push ebx
call sub.kernel32.dll_TlsSetValue
test esi, esi
je 0x410829
mov eax, dword [esi + 4]
cmp eax, 2
je 0x41081b
mov ecx, esi
add ecx, 8
test eax, eax
je 0x41080f
mov eax, dword [ecx]
lock dec dword [eax]
jne 0x41081b
call sym.alloc::sync::Arc_LT_T_C_A_GT_::drop_slow::hcb30e323183ed86d
jmp 0x41081b
xor eax, eax
jmp 0x41082d
mov ecx, 0x5750e4
call sym.std::sys::thread_local::key::windows::LazyKey::init::h0bd71fcfbfc5b9bd
mov ebx, eax
push ebx
call sub.kernel32.dll_TlsGetValue
cmp eax, 1
jbe 0x41072a
jmp 0x41082d
mov eax, dword [ecx]
lock dec dword [eax]
jne 0x41081b
call sym.alloc::sync::Arc_LT_T_C_A_GT_::drop_slow::h44645f2858ed3049
push esi
push 0
push dword [0x5e1120]
call sub.kernel32.dll_HeapFree
mov eax, dword [esp + 4]
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
mov ecx, 8
mov edx, 0x40
call sym.alloc::alloc::handle_alloc_error::h3ca6a9ac69c8e3db
ud2
Function at 0x42c360
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
xor edx, edx
cmp ecx, 0x10eab
mov eax, ecx
setae dl
shl eax, 0xb
shl edx, 4
mov edi, dword [edx*4 + 0x579be4]
lea esi, [edx + 8]
shl edi, 0xb
cmp edi, eax
cmova esi, edx
mov edi, dword [esi*4 + 0x579bd4]
lea edx, [esi + 4]
shl edi, 0xb
cmp edi, eax
cmova edx, esi
mov edi, dword [edx*4 + 0x579bcc]
lea esi, [edx + 2]
shl edi, 0xb
cmp edi, eax
cmova esi, edx
mov edi, dword [esi*4 + 0x579bc8]
lea edx, [esi + 1]
shl edi, 0xb
cmp edi, eax
cmova edx, esi
mov edi, dword [edx*4 + 0x579bc8]
lea esi, [edx + 1]
shl edi, 0xb
cmp edi, eax
cmova esi, edx
xor edx, edx
mov edi, dword [esi*4 + 0x579bc4]
shl edi, 0xb
cmp edi, eax
sete dl
adc edx, esi
cmp edx, 0x20
ja 0x42c47c
mov eax, dword [edx*4 + 0x579bc4]
mov esi, 0x2d7
shr eax, 0x15
cmp edx, 0x20
je 0x42c411
mov esi, dword [edx*4 + 0x579bc8]
shr esi, 0x15
test edx, edx
je 0x42c45f
mov edi, 0x1fffff
and edi, dword [edx*4 + 0x579bc0]
mov edx, eax
not edx
add edx, esi
je 0x42c458
sub ecx, edi
cmp eax, 0x2d8
mov edx, 0x2d7
cmovae edx, eax
dec esi
xor edi, edi
nop word [eax + eax]
cmp edx, eax
je 0x42c46b
movzx ebx, byte [eax + 0x579c48]
add edi, ebx
cmp edi, ecx
ja 0x42c458
inc eax
cmp esi, eax
jne 0x42c440
mov eax, esi
and al, 1
pop esi
pop edi
pop ebx
pop ebp
ret
xor edi, edi
mov edx, eax
not edx
add edx, esi
jne 0x42c425
jmp 0x42c458
mov ecx, edx
mov edx, 0x2d7
push 0x579af4
call sym.core::panicking::panic_bounds_check::hf1cd1614d6353f3c
mov ecx, edx
mov edx, 0x21
push 0x579ae4
call sym.core::panicking::panic_bounds_check::hf1cd1614d6353f3c
nop dword [eax]
Function at 0x4629b0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x78
mov eax, dword [ecx]
mov esi, ecx
mov ecx, eax
xor ecx, 3
lock cmpxchg dword [esi], ecx
jne 0x4629c0
test al, 1
je 0x462a78
test al, 2
jne 0x462a8c
test al, 8
jne 0x4629f5
lea ecx, [esi + 0x18]
mov dword [esp + 0x40], 2
lea edx, [esp + 0x40]
call sym.tokio::runtime::task::core::Core_LT_T_C_S_GT_::set_stage::hee0fe449331efe8b
jmp 0x462a0f
test al, 0x10
je 0x462a0f
mov eax, dword [esi + 0x60]
test eax, eax
je 0x462afa
mov eax, dword [eax + 8]
push dword [esi + 0x64]
call eax
add esp, 4
mov eax, dword [esi + 0x68]
test eax, eax
je 0x462a3d
mov ecx, dword [esi + 0x6c]
movsd xmm0, qword [esi + 0x20]
mov edx, dword [ecx + 8]
movsd qword [esp + 0x20], xmm0
mov ecx, dword [ecx + 0x14]
dec edx
and edx, 0xfffffff8
lea eax, [eax + edx + 8]
lea edx, [esp + 0x20]
push edx
push eax
call ecx
add esp, 8
mov dword [esp + 8], 1
mov eax, 0xffffffc0
lock xadd dword [esi], eax
shr eax, 6
cmp eax, dword [esp + 8]
jb 0x462aa0
jne 0x462a70
mov ecx, esi
call sym.__ZN4core3ptr352drop_in_place_LT_tokio..runtime..task..core..Cell_LT_tokio..runtime..blocking..task..BlockingTask_LT__LT_hyper
push dword [esi - 4]
push 0
push dword [0x5e1120]
call sub.kernel32.dll_HeapFree
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
mov ecx, str.assertion_failed:_prev.is_running__
mov edx, 0x23
push 0x5b5c74
call sym.core::panicking::panic::hf6244c8fb5815825
mov ecx, 0x5b5c84
mov edx, 0x25
push 0x5b5cac
call sym.core::panicking::panic::hf6244c8fb5815825
lea esi, [esp + 0xc]
lea edi, [esp + 8]
mov dword [esp + 0x28], 0x5b5ccc
mov dword [esp + 0x2c], 2
mov dword [esp + 0xc], eax
mov dword [esp + 0x38], 0
mov dword [esp + 0x10], esi
lea esi, [esp + 0x10]
mov dword [esp + 0x14], sym.core::fmt::num::imp::__LT_impl_u20_core..fmt..Display_u20_for_u20_u32_GT_::fmt::h8917667e5366c09f
mov dword [esp + 0x18], edi
mov dword [esp + 0x1c], sym.core::fmt::num::imp::__LT_impl_u20_core..fmt..Display_u20_for_u20_u32_GT_::fmt::h8917667e5366c09f
mov dword [esp + 0x30], esi
mov dword [esp + 0x34], 2
lea ecx, [esp + 0x28]
mov edx, 0x5b5cdc
call sym.core::panicking::panic_fmt::hced28cb7137b21e1
mov dword [esp + 0x40], str.waker_missing
mov dword [esp + 0x44], 1
mov dword [esp + 0x50], 0
mov dword [esp + 0x48], 4
mov dword [esp + 0x4c], 0
lea ecx, [esp + 0x40]
mov edx, 0x5b5940
call sym.core::panicking::panic_fmt::hced28cb7137b21e1
ud2
Function at 0x462c90
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x50
mov ebx, dword [0x5750e4]
test ebx, ebx
je 0x462d82
dec ebx
push ebx
call sub.kernel32.dll_TlsGetValue
cmp eax, 1
ja 0x462dbd
je 0x462d7e
lea edi, [esp + 8]
mov ecx, 0xe
mov esi, 0x5b4648
rep movsd dword es:[edi], dword [esi]
mov dword [esp + 0x40], ebx
movzx eax, byte [0x5e1184]
xor ecx, ecx
mov edx, 0x40
call sym.std::sys::alloc::windows::process_heap_alloc::hc2bfe060f1f208f4
test eax, eax
je 0x462dc5
movsd xmm0, qword [esp + 0x40]
movsd qword [eax + 0x38], xmm0
movsd xmm0, qword [esp + 0x38]
movsd qword [eax + 0x30], xmm0
movsd xmm0, qword [esp + 0x30]
movsd qword [eax + 0x28], xmm0
movsd xmm0, qword [esp + 0x28]
movsd qword [eax + 0x20], xmm0
movsd xmm0, qword [esp + 0x20]
movsd qword [eax + 0x18], xmm0
movsd xmm0, qword [esp + 0x18]
movsd qword [eax + 0x10], xmm0
movsd xmm0, qword [esp + 8]
movsd xmm1, qword [esp + 0x10]
movsd qword [eax + 8], xmm1
movsd qword [eax], xmm0
push ebx
mov edi, eax
call sub.kernel32.dll_TlsGetValue
mov esi, eax
mov dword [esp + 4], edi
push edi
push ebx
call sub.kernel32.dll_TlsSetValue
test esi, esi
je 0x462db9
mov eax, dword [esi + 4]
cmp eax, 2
je 0x462dab
mov ecx, esi
add ecx, 8
test eax, eax
je 0x462d9f
mov eax, dword [ecx]
lock dec dword [eax]
jne 0x462dab
call sym.alloc::sync::Arc_LT_T_C_A_GT_::drop_slow::h4899c619a56d7e8c
jmp 0x462dab
xor eax, eax
jmp 0x462dbd
mov ecx, 0x5750e4
call sym.std::sys::thread_local::key::windows::LazyKey::init::h0bd71fcfbfc5b9bd
mov ebx, eax
push ebx
call sub.kernel32.dll_TlsGetValue
cmp eax, 1
jbe 0x462cba
jmp 0x462dbd
mov eax, dword [ecx]
lock dec dword [eax]
jne 0x462dab
call sym.alloc::sync::Arc_LT_T_C_A_GT_::drop_slow::h096a598667cceb77
push esi
push 0
push dword [0x5e1120]
call sub.kernel32.dll_HeapFree
mov eax, dword [esp + 4]
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
mov ecx, 8
mov edx, 0x40
call sym.alloc::alloc::handle_alloc_error::h3ca6a9ac69c8e3db
ud2
Function at 0x465120
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
mov eax, dword [ecx]
cmp eax, 0xff000000
jb 0x4651b7
mov esi, eax
mov edi, 0xfff
mov ebx, 0xffff
and esi, 0xffffff
cmp byte [edx + 0x2c], 0
cmovne ebx, edi
cmp ebx, esi
jae 0x46516b
cmp esi, 0x110000
jae 0x465183
mov edi, ecx
mov ecx, edx
mov ebx, edx
mov edx, esi
call sym.icu_collections::codepointtrie::cptrie::CodePointTrie_LT_T_GT_::small_index::h554c37f818c772f0
mov edx, ebx
mov ecx, edi
jmp 0x46518b
mov edi, esi
shr edi, 6
cmp edi, dword [edx + 8]
jae 0x465183
mov ebx, dword [edx + 4]
and eax, 0x3f
movzx edi, word [ebx + edi*2]
add eax, edi
jmp 0x46518b
mov eax, dword [edx + 0x14]
test eax, eax
je 0x4651bc
dec eax
lea edi, [eax*4]
add edi, dword [edx + 0x10]
cmp eax, dword [edx + 0x14]
cmovae edi, edx
mov eax, dword [edi]
xor edi, edi
mov edx, eax
shl eax, 0x18
and edx, 0xffffff00
cmp edx, 0xd800
cmove edi, eax
or edi, esi
mov dword [ecx], edi
pop esi
pop edi
pop ebx
pop ebp
ret
mov ecx, 0x5886e8
call sym.core::panicking::panic_const::panic_const_sub_overflow::h31f5191bdbee8bd5
nop word cs:[eax + eax]
Function at 0x470e20
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x24
mov edi, dword [ecx + 8]
xorps xmm0, xmm0
mov esi, ecx
lea ebx, [ebp - 0x30]
mov dword [ebp - 0x10], 0
movups xmmword [ebp - 0x20], xmm0
movups xmmword [ebp - 0x30], xmm0
push ebx
call sub.kernel32.dll_GetSystemInfo
mov eax, dword [ebp - 0x14]
cmp eax, 1
adc eax, 0
cmp edi, eax
je 0x470e96
xorps xmm0, xmm0
mov dword [ebp - 0x10], 0
movups xmmword [ebp - 0x20], xmm0
movups xmmword [ebp - 0x30], xmm0
push ebx
call sub.kernel32.dll_GetSystemInfo
mov ecx, dword [ebp - 0x14]
test ecx, ecx
je 0x470e9e
mov eax, edi
xor edx, edx
div ecx
mov eax, edx
neg eax
jo 0x470ea8
sub edi, edx
push edi
call sub.kernel32.dll_UnmapViewOfFile
test byte [esi], 1
je 0x470e96
push dword [esi + 4]
call sub.kernel32.dll_CloseHandle
add esp, 0x24
pop esi
pop edi
pop ebx
pop ebp
ret
mov ecx, 0x5a4e74
call sym.core::panicking::panic_const::panic_const_rem_by_zero::h15ea2b9d8a5170ce
mov ecx, 0x5a4e84
call sym.core::panicking::panic_const::panic_const_neg_overflow::h926dddbb4d573d1e
nop word cs:[eax + eax]
nop dword [eax]

Function at 0x476200
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x20
mov esi, dword [0x575048]
test esi, esi
je 0x4762a6
dec esi
push esi
call sub.kernel32.dll_TlsGetValue
cmp eax, 1
ja 0x47629e
je 0x47629c
lea ecx, [ebp - 0x2c]
call sym.parking_lot_core::parking_lot::ThreadData::new::h7e464c0a167e4313
movzx eax, byte [0x5e1184]
xor ecx, ecx
mov edx, 0x20
call sym.std::sys::alloc::windows::process_heap_alloc::hc2bfe060f1f208f4
test eax, eax
je 0x4762c3
mov ecx, dword [ebp - 0x14]
mov dword [eax + 0x18], ecx
movsd xmm0, qword [ebp - 0x1c]
movsd qword [eax + 0x10], xmm0
movsd xmm0, qword [ebp - 0x2c]
movsd xmm1, qword [ebp - 0x24]
movsd qword [eax + 8], xmm1
movsd qword [eax], xmm0
mov dword [eax + 0x1c], esi
push esi
mov ebx, eax
call sub.kernel32.dll_TlsGetValue
mov edi, eax
mov dword [ebp - 0x10], ebx
push ebx
push esi
call sub.kernel32.dll_TlsSetValue
test edi, edi
je 0x476297
lock dec dword [0x5e1074]
push edi
push 0
push dword [0x5e1120]
call sub.kernel32.dll_HeapFree
mov eax, dword [ebp - 0x10]
jmp 0x47629e
xor eax, eax
add esp, 0x20
pop esi
pop edi
pop ebx
pop ebp
ret
mov ecx, 0x575048
call sym.std::sys::thread_local::key::windows::LazyKey::init::h0bd71fcfbfc5b9bd
mov esi, eax
push esi
call sub.kernel32.dll_TlsGetValue
cmp eax, 1
jbe 0x476223
jmp 0x47629e
mov ecx, 4
mov edx, 0x20
call sym.alloc::alloc::handle_alloc_error::h3ca6a9ac69c8e3db
ud2
Function at 0x478630
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x1c
push str.api_ms_win_core_synch_l1_2_0.dll
call sub.kernel32.dll_GetModuleHandleA
test eax, eax
je 0x478674
mov esi, eax
push str.WaitOnAddress
push eax
call sub.kernel32.dll_GetProcAddress
test eax, eax
je 0x478674
mov edi, eax
push str.WakeByAddressSingle
push esi
call sub.kernel32.dll_GetProcAddress
test eax, eax
je 0x478674
mov ebx, eax
mov dword [ebp - 0x10], 0
jmp 0x4786da
push 0x5b7d30
call sub.kernel32.dll_GetModuleHandleA
test eax, eax
je 0x478733
mov esi, eax
push str.NtCreateKeyedEvent
push eax
call sub.kernel32.dll_GetProcAddress
test eax, eax
je 0x478733
mov ebx, eax
push str.NtReleaseKeyedEvent
push esi
call sub.kernel32.dll_GetProcAddress
test eax, eax
mov dword [ebp - 0x10], eax
je 0x478733
push str.NtWaitForKeyedEvent
push esi
call sub.kernel32.dll_GetProcAddress
test eax, eax
je 0x478733
mov edi, eax
lea eax, [ebp - 0x28]
push 0
push 0
push 0xc0000000
push eax
call ebx
test eax, eax
jne 0x478733
mov ebx, dword [ebp - 0x28]
movzx eax, byte [0x5e1184]
xor ecx, ecx
mov edx, 0xc
call sym.std::sys::alloc::windows::process_heap_alloc::hc2bfe060f1f208f4
test eax, eax
je 0x478763
mov esi, eax
mov eax, dword [ebp - 0x10]
mov dword [esi], eax
mov dword [esi + 4], edi
mov dword [esi + 8], ebx
xor eax, eax
lock cmpxchg dword [0x5e107c], esi
je 0x478729
cmp dword [esi], 0
mov edi, eax
je 0x478719
push dword [esi + 8]
call sub.kernel32.dll_CloseHandle
push esi
push 0
push dword [0x5e1120]
call sub.kernel32.dll_HeapFree
mov esi, edi
mov eax, esi
add esp, 0x1c
pop esi
pop edi
pop ebx
pop ebp
ret
mov dword [ebp - 0x28], str.parking_lot_requires_either_NT_Keyed_Events__WinXP__or_WaitOnAddress_WakeByAddress__Win8_
mov dword [ebp - 0x24], 1
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x20], 4
mov dword [ebp - 0x1c], 0
lea ecx, [ebp - 0x28]
mov edx, 0x5a5b58
call sym.core::panicking::panic_fmt::hced28cb7137b21e1
mov ecx, 4
mov edx, 0xc
call sym.alloc::alloc::handle_alloc_error::h3ca6a9ac69c8e3db
ud2
Function at 0x480070
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x60
mov ebx, edx
mov edx, dword [ebp + 8]
mov edi, ecx
call 0x480088
pop esi
lea ecx, [esp + 0x4c]
push 0xb
call sym.windows_registry::pcwstr::h41b7ca56c09a15c9
add esp, 4
mov ecx, dword [esp + 0x50]
mov dword [esp + 0x48], 0
mov dword [esp + 8], 0
lea edx, [esp + 8]
lea eax, [esp + 0x48]
push edx
push 0
push eax
push 0
mov dword [esp + 0x14], ecx
push ecx
push ebx
call sub.advapi32.dll_RegQueryValueExW
movzx ecx, ax
or ecx, 0x80070000
test eax, eax
cmovle ecx, eax
test ecx, ecx
je 0x4800fa
mov dword [edi + 4], ecx
mov dword [edi + 8], 0
mov dword [edi], 6
cmp dword [esp + 0x4c], 0
je 0x48067f
push dword [esp + 4]
jmp 0x480672
mov eax, dword [esp + 0x48]
mov dword [esp + 0xc], edi
dec eax
cmp eax, 0xa
ja 0x480240
add esi, dword [eax*4 + 0x480740]
jmp esi
mov eax, dword [esp + 0xc]
mov dword [eax + 4], 0x8007000d
mov dword [eax + 8], 0
mov dword [eax], 6
jmp 0x480667
cmp dword [esp + 0x4c], 0
je 0x48067f
push dword [esp + 0x50]
push 0
push dword [0x5e1120]
call sub.kernel32.dll_HeapFree
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x481b30
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x14
test byte [edx], 1
mov esi, edx
je 0x481b65
mov edx, dword [esi + 0x30]
lea eax, [esi + 8]
cmp dword [esi + 0x24], 0xffffffff
mov edi, dword [esi + 0x34]
mov ebx, dword [esi + 0x38]
mov esi, dword [esi + 0x3c]
mov dword [ebp - 0x14], edx
mov edx, eax
je 0x481c85
push 0
jmp 0x481c87
xor eax, eax
cmp byte [esi + 0xe], 0
jne 0x481cbb
mov eax, dword [esi + 0x34]
mov dword [ebp - 0x1c], ecx
mov ecx, dword [esi + 0x30]
mov ebx, dword [esi + 4]
mov dword [ebp - 0x20], esi
mov dword [ebp - 0x10], eax
movzx eax, byte [esi + 0xc]
mov dword [ebp - 0x18], ecx
jmp 0x481b99
movzx eax, byte [ebp - 0x14]
add ebx, edi
mov dword [esi + 4], ebx
mov edx, eax
xor al, 1
test ebx, ebx
je 0x481bc6
cmp ebx, dword [ebp - 0x10]
jae 0x481bc0
cmp byte [ecx + ebx], 0xbf
jg 0x481bc6
jmp 0x481cc5
jne 0x481cc5
cmp ebx, dword [ebp - 0x10]
je 0x481c97
mov byte [ebp - 0x14], al
movzx eax, byte [ecx + ebx]
test al, al
jns 0x481c30
movzx ecx, byte [ecx + ebx + 1]
mov edi, eax
and edi, 0x1f
and ecx, 0x3f
cmp al, 0xdf
jbe 0x481c21
mov esi, dword [ebp - 0x18]
shl ecx, 6
movzx esi, byte [esi + ebx + 2]
and esi, 0x3f
or esi, ecx
cmp al, 0xf0
jb 0x481c67
mov ecx, dword [ebp - 0x18]
shl esi, 6
and edi, 7
shl edi, 0x12
movzx eax, byte [ecx + ebx + 3]
and eax, 0x3f
or eax, esi
mov esi, dword [ebp - 0x20]
or eax, edi
test dl, 1
je 0x481c35
jmp 0x481c79
shl edi, 6
or edi, ecx
mov ecx, dword [ebp - 0x18]
mov eax, edi
nop dword [eax + eax]
test dl, 1
jne 0x481c79
mov edi, 1
cmp eax, 0x80
jb 0x481b90
mov edi, 2
cmp eax, 0x800
jb 0x481b90
cmp eax, 0x10000
mov edi, 4
sbb edi, 0
jmp 0x481b90
shl edi, 0xc
mov ecx, dword [ebp - 0x18]
or esi, edi
mov eax, esi
mov esi, dword [ebp - 0x20]
test dl, 1
je 0x481c35
movzx eax, byte [ebp - 0x14]
mov dword [ebp - 0x10], ebx
mov byte [esi + 0xc], al
jmp 0x481c9f
push 1
push esi
push ebx
push edi
push dword [ebp - 0x14]
call sym.core::str::pattern::TwoWaySearcher::next::he71e7040fef32dc5
add esp, 0x28
jmp 0x481cc0
test dl, 1
mov byte [esi + 0xc], al
je 0x481cb2
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x10]
mov dword [ecx + 4], eax
mov dword [ecx + 8], eax
mov eax, 1
jmp 0x481cbb
mov ecx, dword [ebp - 0x1c]
mov byte [esi + 0xe], 1
xor eax, eax
mov dword [ecx], eax
add esp, 0x14
pop esi
pop edi
pop ebx
pop ebp
ret
mov edx, dword [ebp - 0x10]
mov byte [esi + 0xc], al
push 0x5b11f0
push edx
push ebx
call sym.core::str::slice_error_fail::h3ba52b33a833cd0d
nop word [eax + eax]
Function at 0x486dd0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x50
mov ebx, dword [0x5750e4]
test ebx, ebx
je 0x486ec2
dec ebx
push ebx
call sub.kernel32.dll_TlsGetValue
cmp eax, 1
ja 0x486efd
je 0x486ebe
lea edi, [esp + 8]
mov ecx, 0xe
mov esi, 0x5b4648
rep movsd dword es:[edi], dword [esi]
mov dword [esp + 0x40], ebx
movzx eax, byte [0x5e1184]
xor ecx, ecx
mov edx, 0x40
call sym.std::sys::alloc::windows::process_heap_alloc::hc2bfe060f1f208f4
test eax, eax
je 0x486f05
movsd xmm0, qword [esp + 0x40]
movsd qword [eax + 0x38], xmm0
movsd xmm0, qword [esp + 0x38]
movsd qword [eax + 0x30], xmm0
movsd xmm0, qword [esp + 0x30]
movsd qword [eax + 0x28], xmm0
movsd xmm0, qword [esp + 0x28]
movsd qword [eax + 0x20], xmm0
movsd xmm0, qword [esp + 0x20]
movsd qword [eax + 0x18], xmm0
movsd xmm0, qword [esp + 0x18]
movsd qword [eax + 0x10], xmm0
movsd xmm0, qword [esp + 8]
movsd xmm1, qword [esp + 0x10]
movsd qword [eax + 8], xmm1
movsd qword [eax], xmm0
push ebx
mov edi, eax
call sub.kernel32.dll_TlsGetValue
mov esi, eax
mov dword [esp + 4], edi
push edi
push ebx
call sub.kernel32.dll_TlsSetValue
test esi, esi
je 0x486ef9
mov eax, dword [esi + 4]
cmp eax, 2
je 0x486eeb
mov ecx, esi
add ecx, 8
test eax, eax
je 0x486edf
mov eax, dword [ecx]
lock dec dword [eax]
jne 0x486eeb
call sym.alloc::sync::Arc_LT_T_C_A_GT_::drop_slow::h1b0b9edcc14a2df1
jmp 0x486eeb
xor eax, eax
jmp 0x486efd
mov ecx, 0x5750e4
call sym.std::sys::thread_local::key::windows::LazyKey::init::h0bd71fcfbfc5b9bd
mov ebx, eax
push ebx
call sub.kernel32.dll_TlsGetValue
cmp eax, 1
jbe 0x486dfa
jmp 0x486efd
mov eax, dword [ecx]
lock dec dword [eax]
jne 0x486eeb
call sym.alloc::sync::Arc_LT_T_C_A_GT_::drop_slow::h7f7f4ad7ed279958
push esi
push 0
push dword [0x5e1120]
call sub.kernel32.dll_HeapFree
mov eax, dword [esp + 4]
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
mov ecx, 8
mov edx, 0x40
call sym.alloc::alloc::handle_alloc_error::h3ca6a9ac69c8e3db
ud2

Function at 0x488d90
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
mov esi, dword [ebp + 8]
mov eax, 0xffffffc0
lock xadd dword [esi], eax
cmp eax, 0x3f
jbe 0x488dc9
and eax, 0xffffffc0
cmp eax, 0x40
jne 0x488dc5
mov ecx, esi
call sym.__ZN4core3ptr283drop_in_place_LT_tokio..runtime..task..core..Cell_LT_core..pin..Pin_LT_alloc..boxed..Box_LT_dyn_u20_core..futu
push dword [esi - 4]
push 0
push dword [0x5e1120]
call sub.kernel32.dll_HeapFree
pop esi
pop edi
pop ebp
ret
mov ecx, str.assertion_failed:_prev.ref_count_____1
mov edx, 0x27
push 0x5b5e24
call sym.core::panicking::panic::hf6244c8fb5815825
mov edi, eax
push dword [esi - 4]
push 0
push dword [0x5e1120]
call sub.kernel32.dll_HeapFree
push edi
call sym.__Unwind_Resume
nop word cs:[eax + eax]
nop
Function at 0x489ea0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
mov esi, dword [ebp + 8]
mov eax, 0xffffffc0
lock xadd dword [esi], eax
cmp eax, 0x3f
jbe 0x489ed9
and eax, 0xffffffc0
cmp eax, 0x40
jne 0x489ed5
mov ecx, esi
call sym.__ZN4core3ptr277drop_in_place_LT_tokio..runtime..task..core..Cell_LT_core..pin..Pin_LT_alloc..boxed..Box_LT_dyn_u20_core..futu
push dword [esi - 4]
push 0
push dword [0x5e1120]
call sub.kernel32.dll_HeapFree
pop esi
pop edi
pop ebp
ret
mov ecx, str.assertion_failed:_prev.ref_count_____1
mov edx, 0x27
push 0x5b5e24
call sym.core::panicking::panic::hf6244c8fb5815825
mov edi, eax
push dword [esi - 4]
push 0
push dword [0x5e1120]
call sub.kernel32.dll_HeapFree
push edi
call sym.__Unwind_Resume
nop word cs:[eax + eax]
nop