joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1001af60
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebx
push edi
push esi
mov edi, dword [esp + 0x18]
mov eax, dword [edi + 4]
mov ebx, dword [edi + 8]
mov ecx, eax
sub ecx, ebx
jb 0x1001afd0
mov eax, dword [esp + 0x14]
cmp ecx, 0x7fffffff
mov edx, closesocket
mov esi, dword [esp + 0x10]
cmovb edx, ecx
mov ecx, dword [edi]
mov eax, dword [eax]
add ecx, ebx
push 0
push edx
push ecx
push dword [eax]
call dword [sym.imp.WS2_32.dll_recv]
cmp eax, 0xffffffff
je 0x1001afb2
add eax, ebx
mov dword [edi + 8], eax
mov ecx, dword [edi + 0xc]
cmp ecx, eax
cmova eax, ecx
mov dword [edi + 0xc], eax
jmp 0x1001afbf
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x274a
jne 0x1001afc8
mov byte [esi], 4
mov eax, esi
pop esi
pop edi
pop ebx
ret
mov byte [esi], 0
mov dword [esi + 4], eax
jmp 0x1001afc2
push 0x1007d78c
push eax
push ebx
call sym.kso.dll_core::slice::index::slice_start_index_len_fail::h148b5e412c56b9cc
int3

Function at 0x1001afe0
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebx
push edi
push esi
sub esp, 8
mov ecx, dword [esp + 0x1c]
mov esi, dword [esp + 0x18]
mov eax, dword [esp + 0x20]
mov edx, dword [esp + 0x24]
lea edi, [esp + 4]
mov ebx, esp
mov ecx, dword [ecx]
mov ecx, dword [ecx]
mov dword [esp], 0
mov dword [esp + 4], 0
push 0
push 0
push edi
push ebx
push edx
push eax
push ecx
call dword [sym.imp.WS2_32.dll_WSARecv]
test eax, eax
je 0x1001b038
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x274a
jne 0x1001b043
mov dword [esi + 4], 0
jmp 0x1001b03e
mov eax, dword [esp]
mov dword [esi + 4], eax
mov byte [esi], 4
jmp 0x1001b049
mov byte [esi], 0
mov dword [esi + 4], eax
mov eax, esi
add esp, 8
pop esi
pop edi
pop ebx
ret

Function at 0x1001b060
Capabilities:
Send data
Send data on socket

Disassembly:
push esi
mov ecx, dword [esp + 0xc]
mov eax, dword [esp + 0x14]
mov esi, dword [esp + 8]
mov edx, closesocket
mov ecx, dword [ecx]
cmp eax, 0x7fffffff
cmovb edx, eax
push 0
push edx
push dword [esp + 0x18]
push dword [ecx]
call dword [sym.imp.WS2_32.dll_send]
cmp eax, 0xffffffff
je 0x1001b09a
mov dword [esi + 4], eax
mov byte [esi], 4
mov eax, esi
pop esi
ret
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov byte [esi], 0
mov byte [esi + 3], 0
mov word [esi + 1], 0
mov dword [esi + 4], eax
mov eax, esi
pop esi
ret

Function at 0x1001b0c0
Capabilities:
Send data
Send data on socket

Disassembly:
push edi
push esi
push eax
mov ecx, dword [esp + 0x14]
mov esi, dword [esp + 0x10]
mov eax, dword [esp + 0x18]
mov edx, dword [esp + 0x1c]
mov edi, esp
mov ecx, dword [ecx]
mov ecx, dword [ecx]
mov dword [esp], 0
push 0
push 0
push 0
push edi
push edx
push eax
push ecx
call dword [sym.imp.WS2_32.dll_WSASend]
cmp eax, 0xffffffff
je 0x1001b100
mov eax, dword [esp]
mov dword [esi + 4], eax
mov byte [esi], 4
jmp 0x1001b10f
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov dword [esi + 4], eax
mov dword [esi], 0
mov eax, esi
add esp, 4
pop esi
pop edi
ret
Function at 0x1001b410
Capabilities:
Set socket configuration

Disassembly:
push esi
push eax
mov ecx, dword [esp + 0x10]
mov eax, dword [esp + 0x14]
mov esi, dword [esp + 0xc]
mov ecx, dword [ecx]
mov dword [esp], eax
mov eax, esp
push 4
push eax
push 4
push 0
push ecx
call dword [sym.imp.WS2_32.dll_setsockopt]
mov cl, 4
cmp eax, 0xffffffff
jne 0x1001b44f
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
xor ecx, ecx
mov byte [esi + 3], 0
mov word [esi + 1], 0
mov dword [esi + 4], eax
mov byte [esi], cl
mov eax, esi
add esp, 4
pop esi
ret

Function at 0x1001b4d0
Capabilities:
Set socket configuration

Disassembly:
push esi
push eax
mov eax, dword [esp + 0x10]
movzx ecx, byte [esp + 0x14]
mov esi, dword [esp + 0xc]
mov eax, dword [eax]
mov dword [esp], ecx
mov ecx, esp
push 4
push ecx
push 0x1b
push 0x29
push eax
call dword [sym.imp.WS2_32.dll_setsockopt]
mov cl, 4
cmp eax, 0xffffffff
jne 0x1001b510
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
xor ecx, ecx
mov byte [esi + 3], 0
mov word [esi + 1], 0
mov dword [esi + 4], eax
mov byte [esi], cl
mov eax, esi
add esp, 4
pop esi
ret

Function at 0x1001b600
Capabilities:
Set socket configuration

Disassembly:
push esi
push eax
mov eax, dword [esp + 0x10]
movzx ecx, byte [esp + 0x14]
mov esi, dword [esp + 0xc]
mov eax, dword [eax]
mov dword [esp], ecx
mov ecx, esp
push ecx
push 0x8004667e
push eax
call dword [sym.imp.WS2_32.dll_ioctlsocket]
cmp eax, 0xffffffff
je 0x1001b632
mov byte [esi], 4
mov eax, esi
add esp, 4
pop esi
ret
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov dword [esi + 4], eax
mov dword [esi], 0
mov eax, esi
add esp, 4
pop esi
ret

Function at 0x1001b8a0
Capabilities:
Set socket configuration

Disassembly:
push esi
push eax
mov eax, dword [esp + 0x10]
movzx ecx, byte [esp + 0x14]
mov esi, dword [esp + 0xc]
mov eax, dword [eax]
mov dword [esp], ecx
mov ecx, esp
push 4
push ecx
push 0x20
push 0xffff
push eax
call dword [sym.imp.WS2_32.dll_setsockopt]
mov cl, 4
cmp eax, 0xffffffff
jne 0x1001b8e3
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
xor ecx, ecx
mov byte [esi + 3], 0
mov word [esi + 1], 0
mov dword [esi + 4], eax
mov byte [esi], cl
mov eax, esi
add esp, 4
pop esi
ret

Function at 0x1001b960
Capabilities:
Set socket configuration

Disassembly:
push esi
push eax
mov eax, dword [esp + 0x10]
movzx ecx, byte [esp + 0x14]
mov esi, dword [esp + 0xc]
mov eax, dword [eax]
mov dword [esp], ecx
mov ecx, esp
push 4
push ecx
push 0xb
push 0
push eax
call dword [sym.imp.WS2_32.dll_setsockopt]
mov cl, 4
cmp eax, 0xffffffff
jne 0x1001b9a0
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
xor ecx, ecx
mov byte [esi + 3], 0
mov word [esi + 1], 0
mov dword [esi + 4], eax
mov byte [esi], cl
mov eax, esi
add esp, 4
pop esi
ret
Function at 0x1001ba10
Capabilities:
Set socket configuration

Disassembly:
push esi
push eax
mov ecx, dword [esp + 0x10]
mov eax, dword [esp + 0x14]
mov esi, dword [esp + 0xc]
mov ecx, dword [ecx]
mov dword [esp], eax
mov eax, esp
push 4
push eax
push 0xa
push 0
push ecx
call dword [sym.imp.WS2_32.dll_setsockopt]
mov cl, 4
cmp eax, 0xffffffff
jne 0x1001ba4f
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
xor ecx, ecx
mov byte [esi + 3], 0
mov word [esi + 1], 0
mov dword [esi + 4], eax
mov byte [esi], cl
mov eax, esi
add esp, 4
pop esi
ret

Function at 0x1001bad0
Capabilities:
Set socket configuration

Disassembly:
push esi
push eax
mov eax, dword [esp + 0x10]
movzx ecx, byte [esp + 0x14]
mov esi, dword [esp + 0xc]
mov eax, dword [eax]
mov dword [esp], ecx
mov ecx, esp
push 4
push ecx
push 0xb
push 0x29
push eax
call dword [sym.imp.WS2_32.dll_setsockopt]
mov cl, 4
cmp eax, 0xffffffff
jne 0x1001bb10
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
xor ecx, ecx
mov byte [esi + 3], 0
mov word [esi + 1], 0
mov dword [esi + 4], eax
mov byte [esi], cl
mov eax, esi
add esp, 4
pop esi
ret

Function at 0x1001bb80
Capabilities:
Set socket configuration

Disassembly:
push esi
sub esp, 8
mov ecx, dword [esp + 0x1c]
mov edx, dword [esp + 0x18]
mov eax, dword [esp + 0x14]
mov esi, dword [esp + 0x10]
mov edx, dword [edx]
mov ecx, dword [ecx]
mov eax, dword [eax]
mov dword [esp], edx
mov dword [esp + 4], ecx
mov ecx, esp
push 8
push ecx
push 0xc
push 0
push eax
call dword [sym.imp.WS2_32.dll_setsockopt]
mov cl, 4
cmp eax, 0xffffffff
jne 0x1001bbcd
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
xor ecx, ecx
mov byte [esi + 3], 0
mov word [esi + 1], 0
mov dword [esi + 4], eax
mov byte [esi], cl
mov eax, esi
add esp, 8
pop esi
ret

Function at 0x1001bbe0
Capabilities:
Set socket configuration

Disassembly:
push esi
sub esp, 0x14
mov ecx, dword [esp + 0x24]
mov edx, dword [esp + 0x20]
mov esi, dword [esp + 0x1c]
mov eax, dword [esp + 0x28]
movups xmm0, xmmword [ecx]
mov edx, dword [edx]
movups xmmword [esp], xmm0
mov dword [esp + 0x10], eax
mov eax, esp
push 0x14
push eax
push 0xc
push 0x29
push edx
call dword [sym.imp.WS2_32.dll_setsockopt]
mov cl, 4
cmp eax, 0xffffffff
jne 0x1001bc2d
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
xor ecx, ecx
mov byte [esi + 3], 0
mov word [esi + 1], 0
mov dword [esi + 4], eax
mov byte [esi], cl
mov eax, esi
add esp, 0x14
pop esi
ret

Function at 0x1001bc40
Capabilities:
Set socket configuration

Disassembly:
push esi
sub esp, 8
mov ecx, dword [esp + 0x1c]
mov edx, dword [esp + 0x18]
mov eax, dword [esp + 0x14]
mov esi, dword [esp + 0x10]
mov edx, dword [edx]
mov ecx, dword [ecx]
mov eax, dword [eax]
mov dword [esp], edx
mov dword [esp + 4], ecx
mov ecx, esp
push 8
push ecx
push 0xd
push 0
push eax
call dword [sym.imp.WS2_32.dll_setsockopt]
mov cl, 4
cmp eax, 0xffffffff
jne 0x1001bc8d
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
xor ecx, ecx
mov byte [esi + 3], 0
mov word [esi + 1], 0
mov dword [esi + 4], eax
mov byte [esi], cl
mov eax, esi
add esp, 8
pop esi
ret
Function at 0x1001bca0
Capabilities:
Set socket configuration

Disassembly:
push esi
sub esp, 0x14
mov ecx, dword [esp + 0x24]
mov edx, dword [esp + 0x20]
mov esi, dword [esp + 0x1c]
mov eax, dword [esp + 0x28]
movups xmm0, xmmword [ecx]
mov edx, dword [edx]
movups xmmword [esp], xmm0
mov dword [esp + 0x10], eax
mov eax, esp
push 0x14
push eax
push 0xd
push 0x29
push edx
call dword [sym.imp.WS2_32.dll_setsockopt]
mov cl, 4
cmp eax, 0xffffffff
jne 0x1001bced
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
xor ecx, ecx
mov byte [esi + 3], 0
mov word [esi + 1], 0
mov dword [esi + 4], eax
mov byte [esi], cl
mov eax, esi
add esp, 0x14
pop esi
ret

Function at 0x1001bd00
Capabilities:
Send data
Send data on socket

Disassembly:
push esi
mov eax, dword [esp + 0x14]
mov esi, dword [esp + 8]
mov ecx, dword [esp + 0xc]
mov edx, closesocket
cmp eax, 0x7fffffff
cmovb edx, eax
push 0
push edx
push dword [esp + 0x18]
push dword [ecx]
call dword [sym.imp.WS2_32.dll_send]
cmp eax, 0xffffffff
je 0x1001bd38
mov dword [esi + 4], eax
mov byte [esi], 4
mov eax, esi
pop esi
ret
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov byte [esi], 0
mov byte [esi + 3], 0
mov word [esi + 1], 0
mov dword [esi + 4], eax
mov eax, esi
pop esi
ret

Function at 0x1001bd60
Capabilities:
Receive data
Receive data on socket

Disassembly:
push esi
mov eax, dword [esp + 0x14]
mov esi, dword [esp + 8]
mov ecx, dword [esp + 0xc]
mov edx, closesocket
cmp eax, 0x7fffffff
cmovb edx, eax
push 0
push edx
push dword [esp + 0x18]
push dword [ecx]
call dword [sym.imp.WS2_32.dll_recv]
cmp eax, 0xffffffff
jne 0x1001bda0
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov ecx, eax
xor eax, eax
cmp ecx, 0x274a
jne 0x1001bdaa
mov dword [esi + 4], eax
mov byte [esi], 4
mov eax, esi
pop esi
ret
mov byte [esi], 0
mov dword [esi + 4], ecx
mov eax, esi
pop esi
ret

Function at 0x10020440
Capabilities:
Write file on windows

Disassembly:
push edi
push esi
sub esp, 0x20
mov ecx, dword [esp + 0x30]
mov esi, dword [esp + 0x2c]
mov eax, dword [esp + 0x34]
mov edx, dword [esp + 0x38]
xorps xmm0, xmm0
mov edi, esp
mov dword [esp], 0
movups xmmword [esp + 0xc], xmm0
mov dword [esp + 0x1c], edi
lea edi, [esp + 0xc]
mov ecx, dword [ecx]
push 0x1002fea0
push edi
push edx
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_WriteFileEx]
test eax, eax
je 0x100204ab
mov edi, dword [sym.imp.KERNEL32.dll_SleepEx]
nop dword [eax]
push 1
push 0xffffffffffffffff
call edi
cmp dword [esp], 0
je 0x10020490
mov eax, dword [esp + 4]
test eax, eax
je 0x100204b9
mov dword [esi + 4], eax
xor eax, eax
jmp 0x100204c2
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov byte [esi], 0
mov dword [esi + 4], eax
jmp 0x100204c4
mov eax, dword [esp + 8]
mov dword [esi + 4], eax
mov al, 4
mov byte [esi], al
mov eax, esi
add esp, 0x20
pop esi
pop edi
ret
Function at 0x100204d0
Capabilities:
Write file on windows

Disassembly:
push edi
push esi
sub esp, 0x20
mov ecx, dword [esp + 0x30]
mov esi, dword [esp + 0x2c]
mov eax, dword [esp + 0x34]
mov edx, dword [esp + 0x38]
xorps xmm0, xmm0
mov edi, esp
mov ecx, dword [ecx]
mov ecx, dword [ecx]
movups xmmword [esp + 0xc], xmm0
mov dword [esp + 0x1c], edi
mov dword [esp], 0
lea edi, [esp + 0xc]
push 0x1002fea0
push edi
push edx
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_WriteFileEx]
test eax, eax
je 0x1002053b
mov edi, dword [sym.imp.KERNEL32.dll_SleepEx]
nop dword [eax + eax]
push 1
push 0xffffffffffffffff
call edi
cmp dword [esp], 0
je 0x10020520
mov eax, dword [esp + 4]
test eax, eax
je 0x10020549
mov dword [esi + 4], eax
xor eax, eax
jmp 0x10020552
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov byte [esi], 0
mov dword [esi + 4], eax
jmp 0x10020554
mov eax, dword [esp + 8]
mov dword [esi + 4], eax
mov al, 4
mov byte [esi], al
mov eax, esi
add esp, 0x20
pop esi
pop edi
ret

Function at 0x10020580
Capabilities:
Read file on windows

Disassembly:
push edi
push esi
sub esp, 0x20
mov ecx, dword [esp + 0x30]
mov esi, dword [esp + 0x2c]
mov eax, dword [esp + 0x34]
mov edx, dword [esp + 0x38]
xorps xmm0, xmm0
mov edi, esp
mov dword [esp], 0
movups xmmword [esp + 0xc], xmm0
mov dword [esp + 0x1c], edi
lea edi, [esp + 0xc]
mov ecx, dword [ecx]
push 0x1002fea0
push edi
push edx
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_ReadFileEx]
test eax, eax
je 0x100205ef
mov edi, dword [sym.imp.KERNEL32.dll_SleepEx]
nop dword [eax]
push 1
push 0xffffffffffffffff
call edi
cmp dword [esp], 0
je 0x100205d0
mov edi, dword [esp + 4]
test edi, edi
jne 0x100205f7
mov edi, dword [esp + 8]
mov ecx, 4
jmp 0x10020610
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
mov ecx, edi
call fcn.10037aa0
xor ecx, ecx
cmp al, 0xb
jne 0x10020610
mov dword [esi + 4], 0
mov byte [esi], 4
jmp 0x10020615
mov dword [esi], ecx
mov dword [esi + 4], edi
mov eax, esi
add esp, 0x20
pop esi
pop edi
ret

Function at 0x10020fe0
Capabilities:
Terminate process

Disassembly:
push ebx
push edi
push esi
push eax
mov eax, dword [esp + 0x18]
mov esi, dword [esp + 0x14]
mov ebx, dword [eax + 0x18]
push 1
push ebx
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
test eax, eax
je 0x10021001
mov byte [esi], 4
jmp 0x10021045
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
cmp eax, 5
jne 0x1002103f
push 0
push ebx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x10021024
cmp eax, 0x102
je 0x10020ffc
jmp 0x10021039
mov eax, esp
mov dword [esp], 0
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
test eax, eax
jne 0x10020ffc
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov byte [esi], 0
mov dword [esi + 4], edi
mov eax, esi
add esp, 4
pop esi
pop edi
pop ebx
ret
Function at 0x10023ae0
Capabilities:
Read file on windows
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
mov eax, 0x1038
call fcn.1006eec0
mov dword [ebp - 0x1c], esp
mov dword [ebp - 0x10], 0xffffffff
mov dword [ebp - 0x14], 0x1003ca20
mov ebx, ecx
lea eax, [ebp - 0x18]
mov dword [ebp - 0x24], edx
lea esi, [ebp - 0x1044]
mov ecx, dword fs:[0]
mov dword [ebp - 0x18], ecx
mov dword fs:[0], eax
push 0x1000
push 0
push esi
call fcn.1006fdb0
add esp, 0xc
xorps xmm0, xmm0
lea eax, [ebp - 0x30]
mov dword [ebp - 0x30], 0
movups xmmword [ebp - 0x44], xmm0
mov dword [ebp - 0x34], eax
lea eax, [ebp - 0x44]
push 0x1002fea0
push eax
push 0x1000
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_ReadFileEx]
test eax, eax
je 0x10023c34
mov esi, dword [sym.imp.KERNEL32.dll_SleepEx]
mov dword [ebp - 0x20], ebx
push 1
push 0xffffffffffffffff
call esi
cmp dword [ebp - 0x30], 0
je 0x10023b6a
cmp dword [ebp - 0x2c], 0
jne 0x10023c45
mov edi, dword [ebp - 0x28]
test edi, edi
je 0x10023c45
cmp edi, 0x1000
ja 0x10023c7f
xor ebx, ebx
nop dword [eax]
mov eax, edi
sub eax, ebx
jb 0x10023c67
xorps xmm0, xmm0
lea edx, [ebp - 0x30]
lea ecx, [ebp + ebx - 0x1044]
mov dword [ebp - 0x30], 0
movups xmmword [ebp - 0x44], xmm0
mov dword [ebp - 0x34], edx
push 0x1002fea0
lea edx, [ebp - 0x44]
push edx
push eax
push ecx
push dword [ebp - 0x24]
call dword [sym.imp.KERNEL32.dll_WriteFileEx]
test eax, eax
je 0x10023c3c
nop dword [eax]
push 1
push 0xffffffffffffffff
call esi
cmp dword [ebp - 0x30], 0
je 0x10023be0
cmp dword [ebp - 0x2c], 0
jne 0x10023c42
add ebx, dword [ebp - 0x28]
cmp ebx, edi
jne 0x10023ba0
xorps xmm0, xmm0
lea eax, [ebp - 0x30]
mov dword [ebp - 0x30], 0
movups xmmword [ebp - 0x44], xmm0
mov dword [ebp - 0x34], eax
push 0x1002fea0
lea eax, [ebp - 0x44]
push eax
push 0x1000
lea eax, [ebp - 0x1044]
push eax
mov ebx, dword [ebp - 0x20]
push ebx
call dword [sym.imp.KERNEL32.dll_ReadFileEx]
test eax, eax
jne 0x10023b6a
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x10023c45
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, dword [ebp - 0x20]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push ebx
call esi
push dword [ebp - 0x24]
call esi
mov eax, dword [ebp - 0x18]
mov dword fs:[0], eax
add esp, 0x1038
pop esi
pop edi
pop ebx
pop ebp
ret
mov dword [ebp - 0x10], 0
push 0x10080e18
push edi
push ebx
call sym.kso.dll_core::slice::index::slice_index_order_fail::hcccd9689ed1eb632
add esp, 0xc
jmp 0x10023c99
mov dword [ebp - 0x10], 0
push 0x10080e18
push 0x1000
push edi
call sym.kso.dll_core::slice::index::slice_end_index_len_fail::h3099cda8f6e1d372
add esp, 0xc
ud2
Function at 0x10029690
Capabilities:
Create directory

Disassembly:
push ebx
push edi
push esi
sub esp, 0x24
mov esi, ecx
lea ecx, [esp + 0xc]
push dword [esp + 0x34]
call fcn.10038170
add esp, 4
mov ecx, dword [esp + 0xc]
mov edi, dword [esp + 0x10]
mov eax, dword [esp + 0x14]
cmp ecx, 0x80000000
je 0x100296eb
mov dword [esp + 0x18], ecx
mov dword [esp + 0x1c], edi
mov dword [esp + 0x20], eax
mov ecx, esp
lea edx, [esp + 0x18]
push 1
call fcn.1002e7e0
add esp, 4
mov ebx, dword [esp]
mov edi, dword [esp + 4]
cmp ebx, 0x80000000
jne 0x100296f7
mov eax, dword [esp + 8]
mov dword [esi + 4], eax
mov dword [esi], edi
add esp, 0x24
pop esi
pop edi
pop ebx
ret
push 0
push edi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
je 0x1002970d
mov byte [esi], 4
test ebx, ebx
jne 0x1002971d
jmp 0x100296f0
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov byte [esi], 0
mov dword [esi + 4], eax
test ebx, ebx
je 0x100296f0
add ebx, ebx
push 2
push ebx
push edi
call sym.kso.dll___rust_dealloc
add esp, 0x30
pop esi
pop edi
pop ebx
ret
Function at 0x10029bd0
Capabilities:
Delete file

Disassembly:
push ebx
push edi
push esi
sub esp, 0x24
mov esi, dword [esp + 0x34]
mov edx, dword [esp + 0x38]
lea ecx, [esp + 0xc]
push dword [esp + 0x3c]
call fcn.10038170
add esp, 4
mov ecx, dword [esp + 0xc]
mov edi, dword [esp + 0x10]
mov eax, dword [esp + 0x14]
cmp ecx, 0x80000000
je 0x10029c31
mov dword [esp + 0x18], ecx
mov dword [esp + 0x1c], edi
mov dword [esp + 0x20], eax
mov ecx, esp
lea edx, [esp + 0x18]
push 1
call fcn.1002e7e0
add esp, 4
mov ebx, dword [esp]
mov edi, dword [esp + 4]
cmp ebx, 0x80000000
jne 0x10029c3f
mov eax, dword [esp + 8]
mov dword [esi + 4], eax
mov dword [esi], edi
mov eax, esi
add esp, 0x24
pop esi
pop edi
pop ebx
ret
push edi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
je 0x10029c53
mov byte [esi], 4
test ebx, ebx
jne 0x10029c63
jmp 0x10029c36
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov byte [esi], 0
mov dword [esi + 4], eax
test ebx, ebx
je 0x10029c36
add ebx, ebx
push 2
push ebx
push edi
call sym.kso.dll___rust_dealloc
add esp, 0xc
jmp 0x10029c36
Function at 0x10029c80
Capabilities:
Move file

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x3c
mov dword [ebp - 0x1c], esp
mov dword [ebp - 0x10], 0xffffffff
mov dword [ebp - 0x14], 0x1003cc00
mov ebx, dword [ebp + 8]
mov edx, dword [ebp + 0xc]
mov eax, dword [ebp + 0x10]
lea ecx, [ebp - 0x18]
mov esi, dword fs:[0]
mov dword [ebp - 0x18], esi
mov dword fs:[0], ecx
lea ecx, [ebp - 0x3c]
push eax
call fcn.10038170
add esp, 4
mov ecx, dword [ebp - 0x3c]
mov edx, dword [ebp - 0x38]
mov eax, dword [ebp - 0x34]
cmp ecx, 0x80000000
je 0x10029cfd
mov dword [ebp - 0x48], ecx
mov dword [ebp - 0x44], edx
lea edx, [ebp - 0x48]
mov dword [ebp - 0x40], eax
lea ecx, [ebp - 0x30]
push 1
call fcn.1002e7e0
add esp, 4
mov eax, dword [ebp - 0x30]
mov edx, dword [ebp - 0x2c]
cmp eax, 0x80000000
jne 0x10029d15
mov eax, dword [ebp - 0x28]
mov dword [ebx + 4], eax
mov dword [ebx], edx
mov eax, dword [ebp - 0x18]
mov dword fs:[0], eax
mov eax, ebx
add esp, 0x3c
pop esi
pop edi
pop ebx
pop ebp
ret
mov esi, dword [ebp + 0x18]
mov dword [ebp - 0x20], edx
mov edx, dword [ebp + 0x14]
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x10], 0
lea ecx, [ebp - 0x3c]
push esi
call fcn.10038170
add esp, 4
mov ecx, dword [ebp - 0x3c]
mov esi, dword [ebp - 0x38]
mov eax, dword [ebp - 0x34]
cmp ecx, 0x80000000
jne 0x10029d4a
mov ebx, dword [ebp + 8]
jmp 0x10029d77
mov dword [ebp - 0x48], ecx
mov dword [ebp - 0x44], esi
mov dword [ebp - 0x40], eax
lea ecx, [ebp - 0x30]
lea edx, [ebp - 0x48]
push 1
call fcn.1002e7e0
add esp, 4
mov edi, dword [ebp - 0x30]
mov esi, dword [ebp - 0x2c]
mov ebx, dword [ebp + 8]
cmp edi, 0x80000000
jne 0x10029d9c
mov eax, dword [ebp - 0x28]
mov dword [ebx + 4], eax
mov dword [ebx], esi
mov eax, dword [ebp - 0x24]
test eax, eax
je 0x10029d02
add eax, eax
push 2
push eax
push dword [ebp - 0x20]
call sym.kso.dll___rust_dealloc
add esp, 0xc
jmp 0x10029d02
push 1
push esi
push dword [ebp - 0x20]
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
test eax, eax
je 0x10029db5
mov byte [ebx], 4
test edi, edi
jne 0x10029dc5
jmp 0x10029d7c
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov byte [ebx], 0
mov dword [ebx + 4], eax
test edi, edi
je 0x10029d7c
add edi, edi
push 2
push edi
push esi
call sym.kso.dll___rust_dealloc
add esp, 0xc
jmp 0x10029d7c
Function at 0x10029e10
Capabilities:
Delete directory

Disassembly:
push ebx
push edi
push esi
sub esp, 0x24
mov esi, dword [esp + 0x34]
mov edx, dword [esp + 0x38]
lea ecx, [esp + 0xc]
push dword [esp + 0x3c]
call fcn.10038170
add esp, 4
mov ecx, dword [esp + 0xc]
mov edi, dword [esp + 0x10]
mov eax, dword [esp + 0x14]
cmp ecx, 0x80000000
je 0x10029e71
mov dword [esp + 0x18], ecx
mov dword [esp + 0x1c], edi
mov dword [esp + 0x20], eax
mov ecx, esp
lea edx, [esp + 0x18]
push 1
call fcn.1002e7e0
add esp, 4
mov ebx, dword [esp]
mov edi, dword [esp + 4]
cmp ebx, 0x80000000
jne 0x10029e7f
mov eax, dword [esp + 8]
mov dword [esi + 4], eax
mov dword [esi], edi
mov eax, esi
add esp, 0x24
pop esi
pop edi
pop ebx
ret
push edi
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
test eax, eax
je 0x10029e93
mov byte [esi], 4
test ebx, ebx
jne 0x10029ea3
jmp 0x10029e76
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov byte [esi], 0
mov dword [esi + 4], eax
test ebx, ebx
je 0x10029e76
add ebx, ebx
push 2
push ebx
push edi
call sym.kso.dll___rust_dealloc
add esp, 0xc
jmp 0x10029e76

Function at 0x1002b5e0
Capabilities:
Set file attributes

Disassembly:
push ebx
push edi
push esi
sub esp, 0x24
mov esi, dword [esp + 0x34]
mov edx, dword [esp + 0x38]
lea ecx, [esp + 0xc]
push dword [esp + 0x3c]
call fcn.10038170
add esp, 4
mov ecx, dword [esp + 0xc]
mov edi, dword [esp + 0x10]
mov eax, dword [esp + 0x14]
cmp ecx, 0x80000000
je 0x1002b641
mov dword [esp + 0x18], ecx
mov dword [esp + 0x1c], edi
mov dword [esp + 0x20], eax
mov ecx, esp
lea edx, [esp + 0x18]
push 1
call fcn.1002e7e0
add esp, 4
mov ebx, dword [esp]
mov edi, dword [esp + 4]
cmp ebx, 0x80000000
jne 0x1002b64f
mov eax, dword [esp + 8]
mov dword [esi + 4], eax
mov dword [esi], edi
mov eax, esi
add esp, 0x24
pop esi
pop edi
pop ebx
ret
push dword [esp + 0x40]
push edi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
test eax, eax
je 0x1002b667
mov byte [esi], 4
test ebx, ebx
jne 0x1002b677
jmp 0x1002b646
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov byte [esi], 0
mov dword [esi + 4], eax
test ebx, ebx
je 0x1002b646
add ebx, ebx
push 2
push ebx
push edi
call sym.kso.dll___rust_dealloc
add esp, 0xc
jmp 0x1002b646