joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1000c7e0
Capabilities:
Parse pe header
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x18
mov edi, edx
xor edx, edx
cmp word [edi], 0x5a4d
jne 0x1000c918
mov eax, dword [edi + 0x3c]
add eax, edi
jb 0x1000c936
cmp dword [eax], 0x4550
jne 0x1000c918
mov eax, dword [eax + 0x78]
add eax, edi
jb 0x1000c940
mov edx, dword [eax + 0x20]
add edx, edi
mov dword [ebp - 0x20], edx
jb 0x1000c94a
mov edx, dword [eax + 0x1c]
add edx, edi
jb 0x1000c954
mov dword [ebp - 0x18], edx
mov edx, dword [eax + 0x24]
mov dword [ebp - 0x10], ecx
add edx, edi
mov dword [ebp - 0x1c], edx
jb 0x1000c95e
mov ecx, dword [eax + 0x18]
mov eax, dword [eax + 0x14]
xor esi, esi
mov dword [ebp - 0x24], ecx
mov dword [ebp - 0x14], eax
jmp 0x1000c86f
sub edx, ecx
lea esi, [ebx + 1]
call sym.crypt_file::ssn_solving::murmurhash3_32::hd75ece57b12b8ea3
cmp eax, dword [ebp + 8]
je 0x1000c8b9
cmp esi, dword [ebp - 0x24]
je 0x1000c8b2
mov eax, dword [ebp - 0x20]
mov ebx, esi
mov ecx, dword [eax + esi*4]
add ecx, edi
jb 0x1000c92c
cmp byte [ecx], 0
mov edx, ecx
je 0x1000c860
xor eax, eax
mov edx, ecx
nop
add edx, 1
adc eax, 0
jb 0x1000c922
cmp byte [edx], 0
jne 0x1000c890
cmp edx, ecx
sbb eax, 0
jae 0x1000c860
push 0x10073f94
call sym.core::panicking::panic_const::panic_const_sub_overflow::h31f5191bdbee8bd5
mov ecx, dword [ebp - 0x10]
xor edx, edx
jmp 0x1000c918
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x14]
movzx eax, word [eax + ebx*2]
cmp ecx, eax
jbe 0x1000c968
mov ecx, dword [ebp - 0x18]
add edi, dword [ecx + eax*4]
mov ecx, dword [ebp - 0x10]
jb 0x1000c974
cmp byte [edi], 0x4c
mov edx, 0
jne 0x1000c918
cmp byte [edi + 1], 0x8b
jne 0x1000c918
cmp byte [edi + 2], 0xd1
jne 0x1000c918
cmp byte [edi + 3], 0xb8
jne 0x1000c918
cmp byte [edi + 6], 0
jne 0x1000c918
cmp byte [edi + 7], 0
jne 0x1000c918
movzx eax, byte [edi + 4]
mov edx, 1
or al, byte [edi + 5]
mov dword [ecx + 4], edi
movzx eax, al
mov word [ecx + 8], ax
mov dword [ecx], edx
add esp, 0x18
pop esi
pop edi
pop ebx
pop ebp
ret
push 0x10073fa4
call sym.core::panicking::panic_const::panic_const_add_overflow::hf3b41c4c75c49a6d
push 0x10073f64
call sym.core::panicking::panic_const::panic_const_add_overflow::hf3b41c4c75c49a6d
push 0x10073f14
call sym.core::panicking::panic_const::panic_const_add_overflow::hf3b41c4c75c49a6d
push 0x10073f24
call sym.core::panicking::panic_const::panic_const_add_overflow::hf3b41c4c75c49a6d
push 0x10073f34
call sym.core::panicking::panic_const::panic_const_add_overflow::hf3b41c4c75c49a6d
push 0x10073f44
call sym.core::panicking::panic_const::panic_const_add_overflow::hf3b41c4c75c49a6d
push 0x10073f54
call sym.core::panicking::panic_const::panic_const_add_overflow::hf3b41c4c75c49a6d
push 0x10073f74
push ecx
push eax
call sym.core::panicking::panic_bounds_check::hf1cd1614d6353f3c
push 0x10073f84
call sym.core::panicking::panic_const::panic_const_add_overflow::hf3b41c4c75c49a6d
nop
Function at 0x100112f0
Capabilities:
Generate random numbers via rtlgenrandom
Generate random numbers via winapi

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
mov ebx, dword [ebp + 0xc]
xor esi, esi
test ebx, ebx
je 0x1001132b
push 2
push ebx
push dword [ebp + 8]
push 0
call sub.bcrypt.dll_BCryptGenRandom
cmp eax, 0xc0000000
jb 0x1001132b
mov edi, eax
push ebx
push dword [ebp + 8]
call sub.advapi32.dll_SystemFunction036
and edi, 0x7fffffff
xor esi, esi
test al, al
cmove esi, edi
mov eax, esi
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x10014620
Capabilities:
Generate random numbers via rtlgenrandom
Generate random numbers via winapi

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x24
xorps xmm0, xmm0
mov edi, ecx
lea esi, [ebp - 0x30]
mov dword [ebp - 0x10], edx
movups xmmword [ebp - 0x20], xmm0
movups xmmword [ebp - 0x30], xmm0
push 2
push 0x20
push esi
push 0
call sub.bcrypt.dll_BCryptGenRandom
cmp eax, 0xc0000000
jb 0x1001465d
mov ebx, eax
push 0x20
push esi
call sub.advapi32.dll_SystemFunction036
test al, al
je 0x100146a8
movups xmm0, xmmword [ebp - 0x30]
movups xmm1, xmmword [ebp - 0x20]
mov eax, dword [edi + 0x30]
mov ecx, dword [edi + 0x34]
movups xmmword [edi], xmm0
xorps xmm0, xmm0
movups xmmword [edi + 0x10], xmm1
movsd qword [edi + 0x20], xmm0
movsd qword [edi + 0x28], xmm0
add eax, 0xffffff00
mov dword [edi + 0x40], 0
adc ecx, 0xffffffff
jo 0x100146fe
mov edx, dword [ebp - 0x10]
mov dword [edi + 0x3c], ecx
mov ecx, edi
mov dword [edi + 0x38], eax
call sym.__ZN84__LT_rand_chacha..chacha..ChaCha12Core_u20_as_u20_rand_core..block..BlockRngCore_GT_8generate17hf46067daa4b9b543E.llvm.1
add esp, 0x24
pop esi
pop edi
pop ebx
pop ebp
ret
mov eax, dword [0x100f2e44]
movzx eax, byte [eax]
sub esp, 0xc
mov dword [esp + 8], 4
mov dword [esp + 4], 0
call sym.std::sys::alloc::windows::process_heap_alloc::hc2bfe060f1f208f4
add esp, 0xc
test eax, eax
je 0x10014708
mov ecx, dword [0x100f2e2c]
and ebx, 0x7fffffff
mov dword [eax], ebx
push eax
push 0
push dword [ecx]
call sub.kernel32.dll_HeapFree
mov eax, dword [edi + 0x30]
mov ecx, dword [edi + 0x34]
add eax, 0xffffff00
mov dword [edi + 0x40], 0
adc ecx, 0xffffffff
jno 0x10014690
push 0x100ed7c4
call sym.core::panicking::panic_const::panic_const_sub_overflow::h31f5191bdbee8bd5
push 4
push 4
call sym.alloc::alloc::handle_alloc_error::h3ca6a9ac69c8e3db
nop word cs:[eax + eax]
nop dword [eax + eax]
Function at 0x10014e30
Capabilities:
Generate random numbers via rtlgenrandom
Generate random numbers via winapi

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
mov eax, dword [ebp + 0xc]
cmp eax, 0x3fffffff
ja 0x10014e7d
mov esi, dword [ebp + 0x14]
lea ecx, [eax*4]
cmp ecx, esi
cmovb esi, ecx
mov ecx, esi
add ecx, 4
jb 0x10014e87
dec ecx
mov edi, ecx
shr edi, 2
cmp edi, eax
ja 0x10014e91
and ecx, 0xfffffffc
cmp esi, ecx
ja 0x10014e9d
push esi
push dword [ebp + 8]
push dword [ebp + 0x10]
call sub.msvcrt.dll_memcpy
add esp, 0xc
mov eax, edi
mov edx, esi
pop esi
pop edi
pop ebp
ret
push 0x100eda40
call sym.core::panicking::panic_const::panic_const_mul_overflow::h70cc655524f1cd1d
push 0x100eda50
call sym.core::panicking::panic_const::panic_const_add_overflow::hf3b41c4c75c49a6d
push 0x100eda60
push eax
push edi
call sym.core::slice::index::slice_end_index_len_fail::h31017dc9c470f2c8
push 0x100eda70
push ecx
push esi
call sym.core::slice::index::slice_end_index_len_fail::h31017dc9c470f2c8
nop dword [eax]
Function at 0x10017170
Capabilities:
Get system information on windows
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x10
mov byte [ebp - 0x14], 4
mov eax, dword [0x100ff048]
cmp eax, 3
jne 0x1001719a
movzx ecx, byte [ebp - 0x14]
mov esi, dword [ebp - 0x10]
cmp ecx, 6
jne 0x100171cf
mov eax, esi
jmp 0x10017225
lea eax, [ebp - 0x14]
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x18]
mov dword [ebp - 0x1c], eax
lea eax, [ebp - 0x1c]
push 0x100edea8
push 0x100edca8
push eax
push 0
push 0x100ff048
call sym.std::sys::sync::once::futex::Once::call::h78fb92942b3cc1b1
add esp, 0x14
movzx ecx, byte [ebp - 0x14]
mov esi, dword [ebp - 0x10]
cmp ecx, 6
je 0x10017193
cmp dword [0x100ff044], 0
je 0x1001722d
mov eax, 0x100ff044
cmp ecx, 3
jne 0x10017225
mov ebx, dword [esi + 4]
mov edi, dword [esi]
mov eax, dword [ebx]
test eax, eax
je 0x100171f3
push edi
call eax
add esp, 4
cmp dword [ebx + 4], 0
je 0x10017211
cmp dword [ebx + 8], 9
jb 0x10017202
mov edi, dword [edi - 4]
mov eax, dword [0x100f2e2c]
push edi
push 0
push dword [eax]
call sub.kernel32.dll_HeapFree
mov eax, dword [0x100f2e2c]
push esi
push 0
push dword [eax]
call sub.kernel32.dll_HeapFree
mov eax, 0x100ff044
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret
movzx eax, byte [ebp - 0x11]
movzx edx, word [ebp - 0x13]
shl eax, 0x10
or edx, eax
lea eax, [ebp - 0x14]
shl edx, 8
or edx, ecx
mov dword [ebp - 0x14], edx
mov dword [ebp - 0x10], esi
push 0x100edee8
push 0x100edd40
push eax
push 0x30
push str.The_global_thread_pool_has_not_been_initialized._
call sym.core::result::unwrap_failed::h534a40e08cfe968a
nop
Function at 0x10019410
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push eax
xor ecx, ecx
call sym.__ZN10rayon_core8registry19WORKER_THREAD_STATE28__u7b__u7b_closure_u7d__u7d_17h0ff8e655c7f3bbb0E.llvm.6552185947209378814
test eax, eax
je 0x1001943e
mov eax, dword [eax]
test eax, eax
je 0x1001942c
add eax, 0x8c
jmp 0x10019431
call sym.rayon_core::registry::global_registry::hcc408598382e73f9
mov eax, dword [eax]
mov eax, dword [eax + 0x104]
add esp, 4
pop ebp
ret
lea eax, [ebp - 1]
push 0x100edf90
push 0x100edd50
push eax
push 0x46
push 0x100edef8
call sym.core::result::unwrap_failed::h534a40e08cfe968a
nop dword [eax + eax]

Function at 0x10019460
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
push eax
mov esi, dword [0x10071030]
mov edi, ecx
test esi, esi
je 0x100194fe
dec esi
push esi
call sub.kernel32.dll_TlsGetValue
cmp eax, 1
ja 0x100194f6
je 0x1001949a
test edi, edi
je 0x1001949e
mov ebx, dword [edi]
mov dword [edi], 0
test ebx, ebx
je 0x100194a0
mov ebx, dword [edi + 4]
jmp 0x100194a0
xor eax, eax
jmp 0x100194f6
xor ebx, ebx
mov eax, dword [0x100f2e44]
movzx eax, byte [eax]
sub esp, 0xc
mov dword [esp + 8], 8
mov dword [esp + 4], 0
call sym.std::sys::alloc::windows::process_heap_alloc::hc2bfe060f1f208f4
add esp, 0xc
test eax, eax
je 0x1001951e
mov dword [eax], ebx
mov dword [eax + 4], esi
push esi
mov ebx, eax
call sub.kernel32.dll_TlsGetValue
mov edi, eax
mov dword [ebp - 0x10], ebx
push ebx
push esi
call sub.kernel32.dll_TlsSetValue
test edi, edi
je 0x100194f3
mov eax, dword [0x100f2e2c]
push edi
push 0
push dword [eax]
call sub.kernel32.dll_HeapFree
mov eax, dword [ebp - 0x10]
add esp, 4
pop esi
pop edi
pop ebx
pop ebp
ret
push 0x10071030
call sym.std::sys::thread_local::key::windows::LazyKey::init::h0bd71fcfbfc5b9bd
add esp, 4
mov esi, eax
push esi
call sub.kernel32.dll_TlsGetValue
cmp eax, 1
jbe 0x10019483
jmp 0x100194f6
push 8
push 4
call sym.alloc::alloc::handle_alloc_error::h3ca6a9ac69c8e3db
nop word [eax + eax]
Function at 0x10041690
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
push esi
sub esp, 0x24
mov esi, dword [ebp + 8]
xorps xmm0, xmm0
lea eax, [ebp - 0x28]
mov dword [ebp - 8], 0
movups xmmword [ebp - 0x18], xmm0
movups xmmword [ebp - 0x28], xmm0
push eax
call sub.kernel32.dll_GetSystemInfo
mov eax, dword [ebp - 0x14]
test eax, eax
je 0x100416c4
mov dword [esi + 4], eax
mov byte [esi], 4
jmp 0x100416d4
mov eax, dword [0x100f12c0]
mov ecx, dword [0x100f12c4]
mov dword [esi + 4], ecx
mov dword [esi], eax
mov eax, esi
add esp, 0x24
pop esi
pop ebp
ret

Function at 0x100416e0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x428
mov esi, 0x200
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 2
mov dword [ebp - 0x10], 0
mov dword [ebp - 0x24], 0
mov dword [ebp - 0x1c], 2
cmp esi, 0x201
jae 0x10041740
jmp 0x1004172e
jbe 0x100417b8
cmp esi, 0x201
jae 0x10041740
mov dword [ebp - 0x20], 0x200
lea edi, [ebp - 0x434]
mov ebx, esi
jmp 0x1004176e
mov ebx, dword [ebp - 0x24]
sub esi, ebx
je 0x10041762
mov edx, ebx
lea ecx, [ebp - 0x18]
push 2
push 2
push esi
call sym.alloc::raw_vec::RawVecInner_LT_A_GT_::reserve::do_reserve_and_handle::h35901dc27c78f3f2
add esp, 0xc
mov ebx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x1c], eax
mov edi, dword [ebp - 0x1c]
mov dword [ebp - 0x10], ebx
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x24], ebx
push 0
call sub.kernel32.dll_SetLastError
push edi
push ebx
call sub.kernel32.dll_GetCurrentDirectoryW
mov esi, eax
test eax, eax
jne 0x1004178b
call sub.kernel32.dll_GetLastError
test eax, eax
jne 0x100417eb
cmp esi, ebx
jne 0x10041720
call sub.kernel32.dll_GetLastError
cmp eax, 0x7a
jne 0x10041824
lea esi, [ebx + ebx]
test ebx, ebx
mov eax, 0xffffffff
cmovs esi, eax
cmp esi, 0x201
jb 0x1004172e
jmp 0x10041740
mov eax, dword [ebp - 0x20]
cmp esi, eax
ja 0x1004183a
lea eax, [ebp - 0x34]
push esi
push edi
push eax
call sym.__LT_std..ffi..os_str..OsString_u20_as_u20_std..os..windows..ffi..OsStringExt_GT_::from_wide::h63b25de594ca01f2
add esp, 0xc
cmp dword [ebp - 0x18], 0
movsd xmm0, qword [ebp - 0x34]
mov eax, dword [ebp + 8]
movsd xmm1, qword [ebp - 0x2c]
movsd qword [eax + 8], xmm1
movsd qword [eax], xmm0
je 0x10041816
jmp 0x10041806
call sub.kernel32.dll_GetLastError
mov ecx, dword [ebp + 8]
cmp dword [ebp - 0x18], 0
mov byte [ecx + 4], 0
mov dword [ecx + 8], eax
mov dword [ecx], 0x80000000
je 0x10041816
push dword [ebp - 0x14]
push 0
push dword [0x100ff0c8]
call sub.kernel32.dll_HeapFree
mov eax, dword [ebp + 8]
add esp, 0x428
pop esi
pop edi
pop ebx
pop ebp
ret
push 0x100f1330
push 0x28
push str.internal_error:_entered_unreachable_codeD
call sym.core::panicking::panic::hf6244c8fb5815825
add esp, 0xc
jmp 0x10041849
push 0x100f1320
push eax
push esi
call sym.core::slice::index::slice_end_index_len_fail::h31017dc9c470f2c8
add esp, 0xc
ud2
Function at 0x100477e0
Capabilities:
Read file on windows
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
mov eax, 0x1024
call sym.__alloca
mov esi, edx
mov edi, ecx
lea ebx, [ebp - 0x1030]
push 0x1000
push 0
push ebx
call sub.msvcrt.dll_memset
add esp, 0xc
xorps xmm0, xmm0
lea eax, [ebp - 0x1c]
mov dword [ebp - 0x1c], 0
movups xmmword [ebp - 0x30], xmm0
mov dword [ebp - 0x20], eax
lea eax, [ebp - 0x30]
push sym.__ZN3std3sys3pal7windows4pipe8AnonPipe21alertable_io_internal8callback17hf7dee0df86c8513aE_12
push eax
push 0x1000
push ebx
mov dword [ebp - 0x10], edi
push edi
call sub.kernel32.dll_ReadFileEx
test eax, eax
je 0x10047905
push 1
push 0xffffffffffffffff
call sub.kernel32.dll_SleepEx
cmp dword [ebp - 0x1c], 1
jne 0x1004783e
cmp dword [ebp - 0x18], 0
jne 0x1004790c
mov ebx, dword [ebp - 0x14]
test ebx, ebx
je 0x1004790c
cmp ebx, 0x1000
ja 0x10047936
xor edi, edi
mov eax, ebx
sub eax, edi
jb 0x10047925
xorps xmm0, xmm0
lea edx, [ebp - 0x1c]
lea ecx, [ebp + edi - 0x1030]
mov dword [ebp - 0x1c], 0
movups xmmword [ebp - 0x30], xmm0
mov dword [ebp - 0x20], edx
push sym.__ZN3std3sys3pal7windows4pipe8AnonPipe21alertable_io_internal8callback17hf7dee0df86c8513aE_12
lea edx, [ebp - 0x30]
push edx
push eax
push ecx
push esi
call sub.kernel32.dll_WriteFileEx
test eax, eax
je 0x10047907
nop word [eax + eax]
push 1
push 0xffffffffffffffff
call sub.kernel32.dll_SleepEx
cmp dword [ebp - 0x1c], 1
jne 0x100478b0
cmp dword [ebp - 0x18], 0
jne 0x1004790c
add edi, dword [ebp - 0x14]
cmp edi, ebx
jne 0x10047870
xorps xmm0, xmm0
lea eax, [ebp - 0x1c]
mov dword [ebp - 0x1c], 0
movups xmmword [ebp - 0x30], xmm0
mov dword [ebp - 0x20], eax
push sym.__ZN3std3sys3pal7windows4pipe8AnonPipe21alertable_io_internal8callback17hf7dee0df86c8513aE_12
lea eax, [ebp - 0x30]
push eax
push 0x1000
lea eax, [ebp - 0x1030]
push eax
push dword [ebp - 0x10]
call sub.kernel32.dll_ReadFileEx
test eax, eax
jne 0x1004783e
jmp 0x10047907
call sub.kernel32.dll_GetLastError
push dword [ebp - 0x10]
call sub.kernel32.dll_CloseHandle
push esi
call sub.kernel32.dll_CloseHandle
add esp, 0x1024
pop esi
pop edi
pop ebx
pop ebp
ret
push 0x100f0ebc
push ebx
push edi
call sym.core::slice::index::slice_index_order_fail::hcb31333d79b0be37
add esp, 0xc
jmp 0x10047949
push 0x100f0ebc
push 0x1000
push ebx
call sym.core::slice::index::slice_end_index_len_fail::h31017dc9c470f2c8
add esp, 0xc
ud2
Function at 0x1004b170
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
sub esp, 0x34
mov eax, dword [ebp + 8]
mov esi, ecx
mov ecx, dword [ebp + 0xc]
mov edi, edx
mov dword [ebp - 0x10], 0
mov dword [ebp - 0x14], 0x103
lea edx, [ebp - 0x14]
push 0
push 0
push ecx
push eax
push edx
push 0
push 0
push 0
push edi
call sub.ntdll.dll_NtReadFile
cmp eax, 0x103
jne 0x1004b1b8
push 0xffffffffffffffff
push edi
call sub.kernel32.dll_WaitForSingleObject
mov eax, dword [ebp - 0x14]
cmp eax, 0xc0000011
jne 0x1004b1c8
mov dword [esi + 4], 0
jmp 0x1004b1d9
cmp eax, 0x103
je 0x1004b1f1
test eax, eax
js 0x1004b1e3
mov eax, dword [ebp - 0x10]
mov dword [esi + 4], eax
mov byte [esi], 4
add esp, 0x34
pop esi
pop edi
pop ebp
ret
push eax
call sub.ntdll.dll_RtlNtStatusToDosError
mov byte [esi], 0
mov dword [esi + 4], eax
jmp 0x1004b1dc
lea eax, [ebp - 0xc]
mov dword [ebp - 0x34], 0x100f0d04
mov dword [ebp - 0x30], 1
mov dword [ebp - 0x24], 0
mov dword [ebp - 0x1c], 0
mov byte [ebp - 0x18], 0
lea ecx, [ebp - 0x1c]
lea esi, [ebp - 0x3c]
mov dword [ebp - 0x2c], eax
lea eax, [ebp - 0x34]
mov dword [ebp - 0x28], 0
push eax
push ecx
push esi
call sym.__ZN3std2io5Write9write_fmt17h170a2f7748b08546E.llvm.10150728606014878797
add esp, 0xc
mov ecx, esi
call sym.__ZN4core3ptr81drop_in_place_LT_core..result..Result_LT__LP__RP__C_std..io..error..Error_GT__GT_17hb6cf10ccff73e133E.llvm.1015
mov ecx, 7
int 0x29
ud2
Function at 0x1004b670
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x30
mov ecx, dword [ebp + 0xc]
mov dword [ebp - 0x24], 0
mov dword [ebp - 0x20], 2
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x28], 2
mov dword [ebp - 0x18], 0
movzx eax, byte [ecx + 0xc]
mov byte [ecx + 0xc], 0
movzx esi, word [ecx + 8]
mov edi, dword [ecx]
mov byte [ebp - 0xd], al
mov eax, ecx
mov ecx, dword [ecx + 4]
mov dword [ebp - 0x2c], ecx
mov ebx, esi
test si, si
je 0x1004b6fb
jmp 0x1004b800
shl edx, 6
or edx, eax
mov eax, esi
mov ebx, edx
xor esi, esi
mov edi, ecx
cmp bx, 0x22
jne 0x1004b7ad
mov ecx, dword [ebp - 0x18]
xor cl, 1
mov dword [ebp - 0x18], ecx
mov ebx, esi
test si, si
jne 0x1004b800
cmp edi, dword [ebp - 0x2c]
je 0x1004b814
lea ecx, [edi + 1]
mov dword [eax], ecx
movzx ebx, byte [edi]
test bl, bl
jns 0x1004b6d9
lea ecx, [edi + 2]
mov esi, eax
mov edx, ebx
mov dword [eax], ecx
and edx, 0x1f
movzx eax, byte [edi + 1]
and eax, 0x3f
cmp bl, 0xdf
jbe 0x1004b6d0
lea ecx, [edi + 3]
shl eax, 6
mov dword [esi], ecx
movzx esi, byte [edi + 2]
and esi, 0x3f
or esi, eax
cmp bl, 0xf0
jb 0x1004b768
mov eax, dword [ebp + 0xc]
lea ecx, [edi + 4]
and edx, 7
shl esi, 6
shl edx, 0x12
mov dword [eax], ecx
movzx ebx, byte [edi + 3]
and ebx, 0x3f
or ebx, esi
or ebx, edx
cmp ebx, 0xffff
jbe 0x1004b6d9
jmp 0x1004b77e
mov eax, dword [ebp + 0xc]
shl edx, 0xc
or esi, edx
mov ebx, esi
cmp ebx, 0xffff
jbe 0x1004b6d9
mov edx, dword [ebp + 0xc]
lea eax, [ebx + 0xff0000]
and ebx, 0x3ff
mov edi, ecx
shr eax, 0xa
or ebx, 0xdc00
or eax, 0xd800
mov esi, ebx
mov word [edx + 8], bx
mov ebx, eax
mov eax, dword [ebp + 0xc]
jmp 0x1004b6dd
movzx eax, bx
cmp eax, 0x3b
jne 0x1004b7c0
test byte [ebp - 0x18], 1
mov al, 1
mov dword [ebp - 0x18], eax
je 0x1004b80d
mov eax, dword [ebp - 0x14]
cmp eax, dword [ebp - 0x24]
jne 0x1004b7d6
lea ecx, [ebp - 0x24]
call sym.alloc::raw_vec::RawVec_LT_T_C_A_GT_::grow_one::hb3bae065834a38fe
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x28]
mov word [ecx + eax*2], bx
inc eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp + 0xc]
mov ebx, esi
test si, si
je 0x1004b6fb
nop word cs:[eax + eax]
nop
xor esi, esi
mov word [eax + 8], 0
jmp 0x1004b6dd
mov eax, dword [ebp + 0xc]
mov byte [eax + 0xc], 1
mov ecx, dword [ebp - 0x14]
test ecx, ecx
setne al
or byte [ebp - 0xd], al
je 0x1004b84f
lea eax, [ebp - 0x3c]
push ecx
push dword [ebp - 0x20]
push eax
call sym.__LT_std..ffi..os_str..OsString_u20_as_u20_std..os..windows..ffi..OsStringExt_GT_::from_wide::h63b25de594ca01f2
add esp, 0xc
mov esi, dword [ebp + 8]
movsd xmm0, qword [ebp - 0x3c]
movsd xmm1, qword [ebp - 0x34]
movsd qword [esi + 8], xmm1
movsd qword [esi], xmm0
cmp dword [ebp - 0x24], 0
jne 0x1004b85e
jmp 0x1004b86e
mov esi, dword [ebp + 8]
mov dword [esi], 0x80000000
cmp dword [ebp - 0x24], 0
je 0x1004b86e
push dword [ebp - 0x20]
push 0
push dword [0x100ff0c8]
call sub.kernel32.dll_HeapFree
mov eax, esi
add esp, 0x30
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x1004c290
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x20
cmp dword [edx], 0
mov edi, edx
jne 0x1004c364
mov ebx, dword [edi + 0xc]
mov esi, ecx
mov edx, dword [ebx]
mov eax, dword [ebx + 8]
cmp edx, eax
je 0x1004c33c
mov ecx, dword [edi + 8]
sub edx, eax
add eax, dword [ebx + 4]
mov dword [ebp - 0x2c], 0
lea ebx, [ebp - 0x2c]
push ecx
push ebx
push edx
push eax
push dword [edi + 0x10]
call sub.kernel32.dll_ReadFile
test eax, eax
je 0x1004c2eb
mov eax, dword [ebp - 0x2c]
mov ecx, 2
test eax, eax
jne 0x1004c31f
mov word [esi], 4
jmp 0x1004c329
call sub.kernel32.dll_GetLastError
cmp eax, 0x3e5
je 0x1004c308
cmp eax, 0x6d
jne 0x1004c331
lea eax, [ebp - 0x14]
mov dword [ebp - 0x10], 1
jmp 0x1004c30b
lea eax, [ebp - 0x10]
mov dword [eax], 0
mov ecx, 1
mov eax, dword [ebp - 0x14]
test byte [ebp - 0x10], 1
jne 0x1004c2db
mov dword [edi], ecx
mov dword [edi + 4], eax
mov word [esi], 0x104
add esp, 0x20
pop esi
pop edi
pop ebx
pop ebp
ret
mov dword [esi], 0
mov dword [esi + 4], eax
jmp 0x1004c329
test edx, edx
mov ecx, 0x10
mov eax, 1
cmove eax, ecx
mov ecx, ebx
push 1
push 1
push eax
call sym.alloc::raw_vec::RawVecInner_LT_A_GT_::reserve::do_reserve_and_handle::h35901dc27c78f3f2
add esp, 0xc
mov edx, dword [ebx]
mov eax, dword [ebx + 8]
jmp 0x1004c2b6
lea edx, [ebp - 0x2c]
mov ecx, edi
mov dword [ebp - 0x2c], 0
call sym.core::panicking::assert_failed::hd5b2eaeabe3c22bb
nop word cs:[eax + eax]
nop
Function at 0x10050aa0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x28
mov esi, ecx
lea ecx, [ebp - 0x28]
push dword [ebp + 8]
call sym.__ZN3std3sys3pal7windows7to_u16s5inner17h36c7c454f9caa61aE.llvm.10150728606014878797
add esp, 4
mov ecx, dword [ebp - 0x28]
mov eax, dword [ebp - 0x24]
mov edi, dword [ebp - 0x20]
mov edx, ecx
neg edx
jo 0x10050aec
mov dword [ebp - 0x34], ecx
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x2c], edi
lea ecx, [ebp - 0x1c]
lea edx, [ebp - 0x34]
call sym.std::sys::pal::windows::args::from_wide_to_user_path::h8367ae1feee68ae3
mov edi, dword [ebp - 0x1c]
mov eax, edi
neg eax
jno 0x10050b40
movzx eax, byte [ebp - 0x18]
mov edi, dword [ebp - 0x14]
cmp al, 3
jne 0x10050b32
mov ebx, dword [edi + 4]
mov dword [ebp - 0x10], esi
mov esi, dword [edi]
mov eax, dword [ebx]
test eax, eax
je 0x10050b04
push esi
call eax
add esp, 4
cmp dword [ebx + 4], 0
je 0x10050b21
cmp dword [ebx + 8], 9
jb 0x10050b13
mov esi, dword [esi - 4]
push esi
push 0
push dword [0x100ff0c8]
call sub.kernel32.dll_HeapFree
push edi
push 0
push dword [0x100ff0c8]
call sub.kernel32.dll_HeapFree
mov esi, dword [ebp - 0x10]
mov dword [esi], 0x80000000
add esp, 0x28
pop esi
pop edi
pop ebx
pop ebp
ret
mov ebx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x10], eax
push ebx
call sub.kernel32.dll_GetFileAttributesW
cmp eax, 0xffffffff
je 0x10050b61
mov eax, dword [ebp - 0x10]
mov dword [esi], edi
mov dword [esi + 4], ebx
mov dword [esi + 8], eax
jmp 0x10050b38
test edi, edi
mov dword [esi], 0x80000000
je 0x10050b38
push ebx
push 0
push dword [0x100ff0c8]
call sub.kernel32.dll_HeapFree
jmp 0x10050b38