joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1002b980
Capabilities:
Copy file

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x48
mov esi, esp
mov dword [esi + 0x30], ebp
mov dword [esi + 0x34], esp
mov dword [esi + 0x40], 0xffffffff
mov dword [esi + 0x3c], 0x1003cca0
mov edi, dword [ebp + 8]
mov edx, dword [ebp + 0xc]
mov ebx, dword [ebp + 0x10]
lea ecx, [esi + 0x38]
mov eax, dword fs:[0]
mov dword [esi + 0x38], eax
mov dword fs:[0], ecx
lea ecx, [esi + 0x24]
push ebx
call fcn.10038170
add esp, 4
mov ecx, dword [esi + 0x24]
mov edx, dword [esi + 0x28]
mov eax, dword [esi + 0x2c]
cmp ecx, 0x80000000
je 0x1002ba04
mov dword [esi + 8], ecx
mov dword [esi + 0xc], edx
lea edx, [esi + 8]
mov dword [esi + 0x10], eax
lea ecx, [esi + 0x18]
push 1
call fcn.1002e7e0
add esp, 4
mov eax, dword [esi + 0x18]
mov edx, dword [esi + 0x1c]
cmp eax, 0x80000000
jne 0x1002ba23
mov eax, dword [esi + 0x20]
mov dword [edi + 8], eax
mov dword [edi + 4], edx
mov dword [edi], 1
mov eax, dword [esi + 0x38]
mov dword fs:[0], eax
mov eax, edi
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
mov edi, dword [ebp + 0x18]
mov dword [esi], edx
mov edx, dword [ebp + 0x14]
mov dword [esi + 4], eax
mov dword [esi + 0x40], 0
lea ecx, [esi + 0x24]
push edi
call fcn.10038170
add esp, 4
mov ecx, dword [esi + 0x24]
mov edi, dword [esi + 0x28]
mov eax, dword [esi + 0x2c]
cmp ecx, 0x80000000
je 0x1002ba7c
mov dword [esi + 8], ecx
mov dword [esi + 0xc], edi
mov dword [esi + 0x10], eax
lea ecx, [esi + 0x18]
lea edx, [esi + 8]
push 1
call fcn.1002e7e0
add esp, 4
mov ebx, dword [esi + 0x18]
mov edi, dword [esi + 0x1c]
cmp ebx, 0x80000000
jne 0x1002baad
mov eax, dword [esi + 0x20]
mov ecx, dword [ebp + 8]
mov dword [ecx + 8], eax
mov dword [ecx + 4], edi
mov dword [ecx], 1
mov eax, dword [esi + 4]
mov edi, dword [ebp + 8]
test eax, eax
je 0x1002ba10
add eax, eax
push 2
push eax
push dword [esi]
call sym.kso.dll___rust_dealloc
add esp, 0xc
jmp 0x1002ba10
mov dword [esi + 0xc], 0
mov dword [esi + 8], 0
push 0
push 0
lea eax, [esi + 8]
push eax
push 0x1002bb50
push edi
push dword [esi]
call dword [sym.imp.KERNEL32.dll_CopyFileExW]
test eax, eax
je 0x1002baf0
mov eax, dword [esi + 8]
mov edx, dword [ebp + 8]
mov ecx, dword [esi + 0xc]
mov dword [edx + 8], eax
mov dword [edx + 0xc], ecx
mov dword [edx], 0
test ebx, ebx
jne 0x1002bb0a
jmp 0x1002ba8b
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [ebp + 8]
mov byte [ecx + 4], 0
mov dword [ecx + 8], eax
mov dword [ecx], 1
test ebx, ebx
je 0x1002ba8b
add ebx, ebx
push 2
push ebx
push edi
call sym.kso.dll___rust_dealloc
add esp, 0xc
jmp 0x1002ba8b
Function at 0x1002c080
Capabilities:
Read file on windows

Disassembly:
push ebx
push edi
push esi
push eax
mov esi, dword [esp + 0x14]
mov edx, dword [esp + 0x24]
mov eax, dword [esp + 0x1c]
mov ecx, dword [esp + 0x20]
mov edi, dword [esp + 0x18]
mov dword [esp], 0
mov ebx, esp
push edx
push ebx
push ecx
push eax
push dword [edi]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x1002c0cb
mov eax, dword [esp]
mov dword [esi + 4], 1
mov dword [esi + 8], eax
xor eax, eax
mov dword [esi], eax
mov eax, esi
add esp, 4
pop esi
pop edi
pop ebx
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x6d
je 0x1002c0e6
cmp eax, 0x3e5
jne 0x1002c0f6
mov dword [esi + 4], 0
jmp 0x1002c0be
mov dword [esi + 4], 1
mov dword [esi + 8], 0
jmp 0x1002c0be
mov dword [esi + 4], 0
mov dword [esi + 8], eax
mov eax, 1
jmp 0x1002c0c0

Function at 0x1002c220
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x40
mov esi, ecx
mov ecx, dword [ebp + 0xc]
cmp dword [ebp + 0x10], 0
mov edi, edx
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0x103
je 0x1002c264
mov eax, dword [ebp + 0x1c]
mov ebx, dword [ebp + 0x18]
lea edx, [esp + 0x20]
mov dword [esp + 0x20], ebx
mov dword [esp + 0x24], eax
xor eax, eax
mov ebx, 1
jmp 0x1002c26a
xor ebx, ebx
xor eax, eax
xor edx, edx
mov dword [esp + 0x1c], eax
lea eax, [esp + 8]
mov dword [esp + 0x18], ebx
push 0
push edx
push ecx
push dword [ebp + 8]
push eax
push 0
push 0
push 0
push edi
call dword [sym.imp.ntdll.dll_NtReadFile]
cmp eax, 0x103
jne 0x1002c29f
push 0xffffffffffffffff
push edi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov eax, dword [esp + 8]
cmp eax, 0xc0000011
jne 0x1002c2af
mov dword [esi + 4], 0
jmp 0x1002c2c1
cmp eax, 0x103
je 0x1002c2db
test eax, eax
js 0x1002c2cc
mov eax, dword [esp + 0xc]
mov dword [esi + 4], eax
mov byte [esi], 4
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
push eax
call dword [sym.imp.ntdll.dll_RtlNtStatusToDosError]
mov byte [esi], 0
mov dword [esi + 4], eax
jmp 0x1002c2c4
lea eax, [esp + 4]
mov dword [esp + 0x18], 0x10080a78
mov dword [esp + 0x1c], 1
mov dword [esp + 0x28], 0
mov dword [esp + 0x10], 0
mov byte [esp + 0x14], 0
lea ecx, [esp + 0x10]
lea edx, [esp + 0x34]
mov dword [esp + 0x20], eax
lea eax, [esp + 0x18]
mov dword [esp + 0x24], 0
push eax
push ecx
push edx
call fcn.10019540
add esp, 0xc
mov ecx, dword [esp + 0x34]
mov edx, dword [esp + 0x38]
call fcn.100048a0
mov ecx, 7
int 0x29
ud2
Function at 0x1002c340
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x40
mov esi, ecx
mov ecx, dword [ebp + 0xc]
cmp dword [ebp + 0x10], 0
mov edi, edx
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0x103
je 0x1002c384
mov eax, dword [ebp + 0x1c]
mov ebx, dword [ebp + 0x18]
lea edx, [esp + 0x20]
mov dword [esp + 0x20], ebx
mov dword [esp + 0x24], eax
xor eax, eax
mov ebx, 1
jmp 0x1002c38a
xor ebx, ebx
xor eax, eax
xor edx, edx
mov dword [esp + 0x1c], eax
lea eax, [esp + 8]
mov dword [esp + 0x18], ebx
push 0
push edx
push ecx
push dword [ebp + 8]
push eax
push 0
push 0
push 0
push edi
call dword [sym.imp.ntdll.dll_NtWriteFile]
cmp eax, 0x103
jne 0x1002c3c6
push 0xffffffffffffffff
push edi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov eax, dword [esp + 8]
cmp eax, 0x103
je 0x1002c3eb
test eax, eax
js 0x1002c3d5
mov eax, dword [esp + 0xc]
mov dword [esi + 4], eax
mov al, 4
jmp 0x1002c3e1
push eax
call dword [sym.imp.ntdll.dll_RtlNtStatusToDosError]
mov dword [esi + 4], eax
xor eax, eax
mov byte [esi], al
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
lea eax, [esp + 4]
mov dword [esp + 0x18], 0x10080a78
mov dword [esp + 0x1c], 1
mov dword [esp + 0x28], 0
mov dword [esp + 0x10], 0
mov byte [esp + 0x14], 0
lea ecx, [esp + 0x10]
lea edx, [esp + 0x34]
mov dword [esp + 0x20], eax
lea eax, [esp + 0x18]
mov dword [esp + 0x24], 0
push eax
push ecx
push edx
call fcn.10019540
add esp, 0xc
mov ecx, dword [esp + 0x34]
mov edx, dword [esp + 0x38]
call fcn.100048a0
mov ecx, 7
int 0x29
ud2

Function at 0x1002c990
Capabilities:
Create udp socket

Disassembly:
push ebx
push edi
push esi
mov eax, dword [esp + 0x14]
mov esi, dword [esp + 0x10]
mov edi, dword [esp + 0x18]
mov ebx, 0x17
cmp word [eax], 0
mov eax, 2
cmove ebx, eax
push 0x81
push 0
push 0
push 0
push edi
push ebx
call dword [sym.imp.WS2_32.dll_WSASocketW]
cmp eax, 0xffffffff
je 0x1002c9d4
mov dword [esi + 4], eax
mov byte [esi], 4
mov eax, esi
pop esi
pop edi
pop ebx
ret
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x2726
je 0x1002c9e8
cmp eax, 0x2739
jne 0x1002ca13
push 1
push 0
push 0
push 0
push edi
push ebx
call dword [sym.imp.WS2_32.dll_WSASocketW]
cmp eax, 0xffffffff
je 0x1002ca1b
mov edi, eax
push 0
push 1
push eax
call dword [sym.imp.KERNEL32.dll_SetHandleInformation]
test eax, eax
je 0x1002ca2c
mov dword [esi + 4], edi
jmp 0x1002c9cb
mov byte [esi], 0
mov dword [esi + 4], eax
jmp 0x1002c9ce
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov dword [esi + 4], eax
mov dword [esi], 0
jmp 0x1002c9ce
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
mov edx, eax
shr eax, 0x18
mov byte [esi], 0
shr ecx, 8
shl edx, 0x18
mov byte [esi + 7], al
mov dword [esi + 1], edx
mov word [esi + 5], cx
push edi
call dword [sym.imp.WS2_32.dll_closesocket]
jmp 0x1002c9ce
Function at 0x1002ca60
Capabilities:
Connect socket

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x1c
mov ecx, dword [esp + 0x38]
mov esi, dword [esp + 0x30]
mov eax, dword [esp + 0x34]
cmp word [ecx], 0
je 0x1002ca91
movups xmm0, xmmword [ecx + 4]
mov ebx, dword [ecx + 0x18]
lea edi, [ecx + 0x14]
add ecx, 0x1c
mov edx, 0x1c
mov bp, 0x17
jmp 0x1002caa3
lea edi, [ecx + 2]
add ecx, 6
mov edx, 0x10
mov bp, 2
xorps xmm0, xmm0
movzx ecx, word [ecx]
mov edi, dword [edi]
mov word [esp], bp
rol cx, 8
mov word [esp + 2], cx
mov dword [esp + 4], edi
movups xmmword [esp + 8], xmm0
mov dword [esp + 0x18], ebx
mov ecx, esp
push edx
push ecx
push dword [eax]
call dword [sym.imp.WS2_32.dll_connect]
cmp eax, 0xffffffff
je 0x1002cad8
mov byte [esi], 4
jmp 0x1002cae7
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov dword [esi + 4], eax
mov dword [esi], 0
mov eax, esi
add esp, 0x1c
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x1002ce90
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebx
push edi
push esi
sub esp, 8
mov esi, dword [esp + 0x18]
mov eax, dword [esp + 0x20]
mov edx, dword [esp + 0x24]
mov ecx, dword [esp + 0x1c]
mov dword [esp], 0
mov dword [esp + 4], 0
lea edi, [esp + 4]
mov ebx, esp
push 0
push 0
push edi
push ebx
push edx
push eax
push dword [ecx]
call dword [sym.imp.WS2_32.dll_WSARecv]
test eax, eax
je 0x1002cee5
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x274a
jne 0x1002cef0
mov dword [esi + 4], 0
jmp 0x1002ceeb
mov eax, dword [esp]
mov dword [esi + 4], eax
mov byte [esi], 4
jmp 0x1002cef6
mov byte [esi], 0
mov dword [esi + 4], eax
mov eax, esi
add esp, 8
pop esi
pop edi
pop ebx
ret
Function at 0x1002cf00
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0xb0
mov esi, ecx
mov ecx, dword [ebp + 0xc]
mov edi, closesocket
pxor xmm0, xmm0
lea ebx, [esp + 8]
lea eax, [esp + 0x20]
mov dword [esp + 8], 0x80
movdqa xmmword [esp + 0x90], xmm0
movdqa xmmword [esp + 0x80], xmm0
movdqa xmmword [esp + 0x70], xmm0
movdqa xmmword [esp + 0x60], xmm0
movdqa xmmword [esp + 0x50], xmm0
movdqa xmmword [esp + 0x40], xmm0
movdqa xmmword [esp + 0x30], xmm0
movdqa xmmword [esp + 0x20], xmm0
cmp ecx, 0x7fffffff
cmovb edi, ecx
mov ecx, dword [ebp + 0x10]
push ebx
push eax
push ecx
push edi
push dword [ebp + 8]
push edx
call dword [sym.imp.WS2_32.dll_recvfrom]
cmp eax, 0xffffffff
je 0x1002cfcf
movzx edx, word [esp + 0x20]
mov ecx, dword [esp + 8]
cmp edx, 0x17
je 0x1002d03c
cmp edx, 2
jne 0x1002d029
cmp ecx, 0xf
jbe 0x1002d0cf
movzx edx, word [esp + 0x22]
mov ecx, dword [esp + 0x24]
rol dx, 8
mov dword [esp + 0xc], ecx
movd xmm0, ecx
mov word [esp + 0x10], dx
pslld xmm0, 0x10
movups xmm1, xmmword [esp + 0xe]
jmp 0x1002d064
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x274a
jne 0x1002d07b
movzx ecx, word [esp + 0x20]
mov eax, dword [esp + 8]
cmp ecx, 0x17
je 0x1002d08a
cmp ecx, 2
jne 0x1002d029
cmp eax, 0xf
jbe 0x1002d0cf
movzx ecx, word [esp + 0x22]
mov eax, dword [esp + 0x24]
rol cx, 8
mov dword [esp + 0xc], eax
movd xmm0, eax
mov word [esp + 0x10], cx
pslld xmm0, 0x10
movups xmm1, xmmword [esp + 0xe]
jmp 0x1002d0ae
mov byte [esp + 0xe], 2
mov eax, 0x100819c0
mov ecx, dword [esp + 0xe]
mov dword [esi + 8], ecx
jmp 0x1002d07f
cmp ecx, 0x1b
jbe 0x1002d0e0
movzx ecx, word [esp + 0x22]
mov edi, dword [esp + 0x24]
mov edx, dword [esp + 0x38]
movups xmm1, xmmword [esp + 0x28]
mov ebx, 1
movd xmm0, ebx
rol cx, 8
mov dword [esi], eax
movd dword [esi + 4], xmm0
movups xmmword [esi + 8], xmm1
mov dword [esi + 0x18], edi
mov dword [esi + 0x1c], edx
mov word [esi + 0x20], cx
jmp 0x1002d0c7
mov byte [esi + 8], 0
mov dword [esi + 0xc], eax
mov word [esi + 4], 2
jmp 0x1002d0c7
cmp eax, 0x1b
jbe 0x1002d0e0
movzx eax, word [esp + 0x22]
mov edx, dword [esp + 0x24]
mov ecx, dword [esp + 0x38]
movups xmm1, xmmword [esp + 0x28]
mov edi, 1
movd xmm0, edi
rol ax, 8
mov dword [esi], 0
movd dword [esi + 4], xmm0
movups xmmword [esi + 8], xmm1
mov dword [esi + 0x18], edx
mov dword [esi + 0x1c], ecx
mov word [esi + 0x20], ax
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
push 0x1008194c
push 0x42
push str.assertion_failed:_len_as_usize___mem::size_of::_c::sockaddr_in___library_std_src_sys_common_net.rs
call sym.kso.dll_core::panicking::panic::hd53872080d8d36e0
push 0x100819a0
push 0x43
push 0x1008195c
call sym.kso.dll_core::panicking::panic::hd53872080d8d36e0
int3
Function at 0x1002d100
Capabilities:
Send data
Send data on socket

Disassembly:
push edi
push esi
push eax
mov esi, dword [esp + 0x10]
mov eax, dword [esp + 0x18]
mov edx, dword [esp + 0x1c]
mov ecx, dword [esp + 0x14]
mov dword [esp], 0
mov edi, esp
push 0
push 0
push 0
push edi
push edx
push eax
push dword [ecx]
call dword [sym.imp.WS2_32.dll_WSASend]
cmp eax, 0xffffffff
je 0x1002d13d
mov eax, dword [esp]
mov dword [esi + 4], eax
mov byte [esi], 4
jmp 0x1002d14c
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov dword [esi + 4], eax
mov dword [esi], 0
mov eax, esi
add esp, 4
pop esi
pop edi
ret

Function at 0x1002d160
Capabilities:
Set socket configuration

Disassembly:
push ebp
push ebx
push edi
push esi
push eax
mov edi, dword [esp + 0x28]
xor ebp, ebp
cmp edi, 0x3b9aca00
je 0x1002d1ce
mov eax, dword [esp + 0x24]
mov esi, dword [esp + 0x20]
mov ebx, 0x3e8
mul ebx
mov ebp, eax
mov eax, esi
seto cl
mul ebx
mov ebx, edx
mov esi, eax
add ebx, ebp
mov ebp, 0xffffffff
setb al
or al, cl
jne 0x1002d1ce
mov ecx, 0x431bde83
mov eax, edi
mul ecx
shr edx, 0x12
add esi, edx
adc ebx, 0
jb 0x1002d1ce
imul eax, edx, 0xf4240
xor ecx, ecx
sub edi, eax
setne cl
add esi, ecx
adc ebx, 0
jb 0x1002d1ce
xor ebp, ebp
neg ebx
sbb ebp, ebp
or ebp, esi
je 0x1002d219
mov ecx, dword [esp + 0x1c]
mov eax, dword [esp + 0x2c]
mov dword [esp], ebp
mov edx, esp
mov ecx, dword [ecx]
push 4
push edx
push eax
push 0xffff
push ecx
call dword [sym.imp.WS2_32.dll_setsockopt]
mov esi, dword [esp + 0x18]
mov cl, 4
cmp eax, 0xffffffff
jne 0x1002d20d
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
xor ecx, ecx
mov byte [esi + 3], 0
mov word [esi + 1], 0
mov dword [esi + 4], eax
mov byte [esi], cl
mov eax, esi
add esp, 4
pop esi
pop edi
pop ebx
pop ebp
ret
mov esi, dword [esp + 0x18]
mov byte [esi], 2
mov dword [esi + 4], 0x10080b40
jmp 0x1002d20f

Function at 0x1002d2d0
Capabilities:
Set socket configuration

Disassembly:
push esi
push eax
movzx ecx, byte [esp + 0x14]
mov esi, dword [esp + 0xc]
mov eax, dword [esp + 0x10]
mov dword [esp], ecx
mov ecx, esp
push ecx
push 0x8004667e
push dword [eax]
call dword [sym.imp.WS2_32.dll_ioctlsocket]
cmp eax, 0xffffffff
je 0x1002d301
mov byte [esi], 4
mov eax, esi
add esp, 4
pop esi
ret
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov dword [esi + 4], eax
mov dword [esi], 0
mov eax, esi
add esp, 4
pop esi
ret

Function at 0x1002d320
Capabilities:
Set socket configuration

Disassembly:
push ebx
push esi
push eax
xor ecx, ecx
xor edx, edx
cmp dword [esp + 0x20], 0x3b9aca00
mov esi, dword [esp + 0x10]
mov eax, dword [esp + 0x14]
setne bl
je 0x1002d340
mov ecx, dword [esp + 0x18]
mov eax, dword [eax]
mov dl, bl
mov word [esp], dx
mov word [esp + 2], cx
mov ecx, esp
push 4
push ecx
push 0x80
push 0xffff
push eax
call dword [sym.imp.WS2_32.dll_setsockopt]
mov cl, 4
cmp eax, 0xffffffff
jne 0x1002d37f
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
xor ecx, ecx
mov byte [esi + 3], 0
mov word [esi + 1], 0
mov dword [esi + 4], eax
mov byte [esi], cl
mov eax, esi
add esp, 4
pop esi
pop ebx
ret
Function at 0x1002e070
Capabilities:
Set current directory

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x28
mov dword [ebp - 0x1c], esp
mov dword [ebp - 0x10], 0xffffffff
mov dword [ebp - 0x14], 0x1003cd60
lea ecx, [ebp - 0x18]
mov eax, dword [ebp + 0xc]
mov edx, dword fs:[0]
mov dword [ebp - 0x18], edx
mov dword fs:[0], ecx
mov ecx, dword [ebp + 0x10]
mov dword [ebp - 0x34], eax
lea edx, [ebp - 0x34]
add ecx, eax
mov dword [ebp - 0x30], ecx
lea ecx, [ebp - 0x28]
mov word [ebp - 0x2c], 0
call fcn.1000a630
mov edx, dword [ebp - 0x20]
cmp edx, dword [ebp - 0x28]
jne 0x1002e0d7
lea ecx, [ebp - 0x28]
mov dword [ebp - 0x10], 0
call fcn.10009be0
mov edx, dword [ebp - 0x20]
mov edi, dword [ebp - 0x24]
mov esi, dword [ebp + 8]
mov word [edi + edx*2], 0
push edi
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
test eax, eax
je 0x1002e119
mov byte [esi], 4
mov eax, dword [ebp - 0x28]
test eax, eax
je 0x1002e106
add eax, eax
push 2
push eax
push edi
call sym.kso.dll___rust_dealloc
add esp, 0xc
mov eax, dword [ebp - 0x18]
mov dword fs:[0], eax
mov eax, esi
add esp, 0x28
pop esi
pop edi
pop ebx
pop ebp
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esi + 4], eax
mov dword [esi], 0
mov eax, dword [ebp - 0x28]
test eax, eax
jne 0x1002e0f8
jmp 0x1002e106
Function at 0x1002fa50
Capabilities:
Read file on windows

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x20
mov ebp, dword [esp + 0x34]
mov esi, ecx
mov ecx, dword [ebp + 4]
mov ebx, dword [ebp + 8]
mov eax, ecx
sub eax, ebx
jb 0x1002fb0c
mov ecx, dword [ebp]
xorps xmm0, xmm0
mov edi, esp
mov dword [esp], 0
movups xmmword [esp + 0xc], xmm0
mov dword [esp + 0x1c], edi
lea edi, [esp + 0xc]
add ecx, ebx
push 0x1002fea0
push edi
push eax
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_ReadFileEx]
test eax, eax
je 0x1002fad1
mov edi, dword [sym.imp.KERNEL32.dll_SleepEx]
nop word cs:[eax + eax]
nop
push 1
push 0xffffffffffffffff
call edi
cmp dword [esp], 0
je 0x1002fab0
mov edi, dword [esp + 4]
test edi, edi
je 0x1002faef
mov ecx, edi
call fcn.10037aa0
cmp al, 0xb
jne 0x1002fae4
jmp 0x1002fb01
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
mov ecx, edi
call fcn.10037aa0
cmp al, 0xb
je 0x1002fb01
mov dword [esi + 4], edi
mov dword [esi], 0
jmp 0x1002fb04
add ebx, dword [esp + 8]
mov dword [ebp + 8], ebx
mov eax, dword [ebp + 0xc]
cmp eax, ebx
cmova ebx, eax
mov dword [ebp + 0xc], ebx
mov byte [esi], 4
add esp, 0x20
pop esi
pop edi
pop ebx
pop ebp
ret
push 0x1007d78c
push ecx
push ebx
call sym.kso.dll_core::slice::index::slice_start_index_len_fail::h148b5e412c56b9cc
int3

Function at 0x10030300
Capabilities:
Read file on windows

Disassembly:
push ebx
push edi
push esi
sub esp, 0x18
cmp dword [edx], 0
mov edi, edx
jne 0x100303cf
mov ebx, dword [edi + 0xc]
mov esi, ecx
mov edx, dword [ebx]
test edx, edx
jne 0x10030329
mov eax, dword [ebx + 8]
xor edx, edx
lea ecx, [eax + 0xf]
cmp ecx, 0xf
jbe 0x1003039e
mov eax, dword [ebx + 8]
cmp edx, eax
je 0x100303b9
mov ecx, dword [edi + 8]
sub edx, eax
add eax, dword [ebx + 4]
mov dword [esp], 0
mov ebx, esp
push ecx
push ebx
push edx
push eax
push dword [edi + 0x10]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x10030364
mov eax, dword [esp]
mov ecx, 2
test eax, eax
jne 0x10030382
jmp 0x10030376
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x3e5
je 0x1003037d
cmp eax, 0x6d
jne 0x10030393
mov word [esi], 4
jmp 0x1003038c
mov ecx, 1
mov dword [edi], ecx
mov dword [edi + 4], eax
mov word [esi], 0x104
add esp, 0x18
pop esi
pop edi
pop ebx
ret
mov dword [esi], 0
mov dword [esi + 4], eax
jmp 0x1003038c
mov edx, eax
mov ecx, ebx
push 0x10
call fcn.1007b110
add esp, 4
mov edx, dword [ebx]
mov eax, dword [ebx + 8]
cmp edx, eax
jne 0x10030334
mov ecx, ebx
push 1
call fcn.1007b110
add esp, 4
mov edx, dword [ebx]
mov eax, dword [ebx + 8]
jmp 0x10030334
mov edx, esp
mov ecx, edi
mov dword [esp], 0
call fcn.1007afb0
int3
Function at 0x10030f90
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x14
mov esi, dword [ebp + 0x10]
mov dword [ebp - 0x1c], esp
mov dword [ebp - 0x10], 0xffffffff
mov dword [ebp - 0x14], 0x1003ce50
lea eax, [ebp - 0x18]
mov ecx, dword fs:[0]
test esi, esi
mov dword [ebp - 0x18], ecx
mov dword fs:[0], eax
je 0x10030fea
js 0x1003105a
movzx eax, byte [sym.kso.dll___rust_no_alloc_shim_is_unstable]
push 1
push esi
call sym.kso.dll___rust_alloc
add esp, 8
mov edi, eax
test eax, eax
jne 0x10030fef
push esi
push 1
call sym.kso.dll_alloc::alloc::handle_alloc_error::h0f7631ec9b341a7f
mov edi, 1
mov ebx, dword [ebp + 8]
push esi
push dword [ebp + 0xc]
push edi
call fcn.1006f830
add esp, 0xc
mov edx, dword [ebx + 0x30]
cmp edx, dword [ebx + 0x28]
jne 0x10031027
lea ecx, [ebx + 0x28]
mov dword [ebp - 0x20], edi
mov dword [ebp - 0x10], 0
call fcn.10009d20
mov eax, dword [ebp + 8]
mov esi, dword [ebp + 0x10]
mov edi, dword [ebp - 0x20]
mov edx, dword [eax + 0x30]
mov ebx, eax
mov eax, dword [ebx + 0x2c]
lea ecx, [edx + edx*4]
inc edx
mov dword [eax + ecx*4], 0
mov dword [eax + ecx*4 + 4], esi
mov dword [eax + ecx*4 + 8], edi
mov dword [eax + ecx*4 + 0xc], esi
mov byte [eax + ecx*4 + 0x10], 0
mov dword [ebx + 0x30], edx
mov eax, dword [ebp - 0x18]
mov dword fs:[0], eax
add esp, 0x14
pop esi
pop edi
pop ebx
pop ebp
ret
call sym.kso.dll_alloc::raw_vec::capacity_overflow::hb4380fcd4c99d9cf
nop
push ebp
sub esp, 0xc
add ebp, 0xc
cmp dword [ebp + 0x10], 0
je 0x1003107d
push 1
push dword [ebp + 0x10]
push dword [ebp - 0x20]
call sym.kso.dll___rust_dealloc
add esp, 0xc
add esp, 0xc
pop ebp
ret
Function at 0x100311a0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x14
mov esi, dword [ebp + 0x10]
mov dword [ebp - 0x1c], esp
mov dword [ebp - 0x10], 0xffffffff
mov dword [ebp - 0x14], 0x1003ce60
lea eax, [ebp - 0x18]
mov ecx, dword fs:[0]
test esi, esi
mov dword [ebp - 0x18], ecx
mov dword fs:[0], eax
je 0x100311fa
js 0x1003126a
movzx eax, byte [sym.kso.dll___rust_no_alloc_shim_is_unstable]
push 1
push esi
call sym.kso.dll___rust_alloc
add esp, 8
mov edi, eax
test eax, eax
jne 0x100311ff
push esi
push 1
call sym.kso.dll_alloc::alloc::handle_alloc_error::h0f7631ec9b341a7f
mov edi, 1
mov ebx, dword [ebp + 8]
push esi
push dword [ebp + 0xc]
push edi
call fcn.1006f830
add esp, 0xc
mov edx, dword [ebx + 0x30]
cmp edx, dword [ebx + 0x28]
jne 0x10031237
lea ecx, [ebx + 0x28]
mov dword [ebp - 0x20], edi
mov dword [ebp - 0x10], 0
call fcn.10009d20
mov eax, dword [ebp + 8]
mov esi, dword [ebp + 0x10]
mov edi, dword [ebp - 0x20]
mov edx, dword [eax + 0x30]
mov ebx, eax
mov eax, dword [ebx + 0x2c]
lea ecx, [edx + edx*4]
inc edx
mov dword [eax + ecx*4], 1
mov dword [eax + ecx*4 + 4], esi
mov dword [eax + ecx*4 + 8], edi
mov dword [eax + ecx*4 + 0xc], esi
mov byte [eax + ecx*4 + 0x10], 0
mov dword [ebx + 0x30], edx
mov eax, dword [ebp - 0x18]
mov dword fs:[0], eax
add esp, 0x14
pop esi
pop edi
pop ebx
pop ebp
ret
call sym.kso.dll_alloc::raw_vec::capacity_overflow::hb4380fcd4c99d9cf
nop
push ebp
sub esp, 0xc
add ebp, 0xc
cmp dword [ebp + 0x10], 0
je 0x1003128d
push 1
push dword [ebp + 0x10]
push dword [ebp - 0x20]
call sym.kso.dll___rust_dealloc
add esp, 0xc
add esp, 0xc
pop ebp
ret