joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1002c280
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x40
mov esi, ecx
mov ecx, dword [ebp + 0xc]
cmp dword [ebp + 0x10], 0
mov edi, edx
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0x103
je 0x1002c2c4
mov eax, dword [ebp + 0x1c]
mov ebx, dword [ebp + 0x18]
lea edx, [esp + 0x20]
mov dword [esp + 0x20], ebx
mov dword [esp + 0x24], eax
xor eax, eax
mov ebx, 1
jmp 0x1002c2ca
xor ebx, ebx
xor eax, eax
xor edx, edx
mov dword [esp + 0x1c], eax
lea eax, [esp + 8]
mov dword [esp + 0x18], ebx
push 0
push edx
push ecx
push dword [ebp + 8]
push eax
push 0
push 0
push 0
push edi
call dword [sym.imp.ntdll.dll_NtWriteFile]
cmp eax, 0x103
jne 0x1002c306
push 0xffffffffffffffff
push edi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov eax, dword [esp + 8]
cmp eax, 0x103
je 0x1002c32b
test eax, eax
js 0x1002c315
mov eax, dword [esp + 0xc]
mov dword [esi + 4], eax
mov al, 4
jmp 0x1002c321
push eax
call dword [sym.imp.ntdll.dll_RtlNtStatusToDosError]
mov dword [esi + 4], eax
xor eax, eax
mov byte [esi], al
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
lea eax, [esp + 4]
mov dword [esp + 0x18], 0x10081a78
mov dword [esp + 0x1c], 1
mov dword [esp + 0x28], 0
mov dword [esp + 0x10], 0
mov byte [esp + 0x14], 0
lea ecx, [esp + 0x10]
lea edx, [esp + 0x34]
mov dword [esp + 0x20], eax
lea eax, [esp + 0x18]
mov dword [esp + 0x24], 0
push eax
push ecx
push edx
call fcn.10019480
add esp, 0xc
mov ecx, dword [esp + 0x34]
mov edx, dword [esp + 0x38]
call fcn.100047d0
mov ecx, 7
int 0x29
ud2

Function at 0x1002c8d0
Capabilities:
Create udp socket

Disassembly:
push ebx
push edi
push esi
mov eax, dword [esp + 0x14]
mov esi, dword [esp + 0x10]
mov edi, dword [esp + 0x18]
mov ebx, 0x17
cmp word [eax], 0
mov eax, 2
cmove ebx, eax
push 0x81
push 0
push 0
push 0
push edi
push ebx
call dword [sym.imp.WS2_32.dll_WSASocketW]
cmp eax, 0xffffffff
je 0x1002c914
mov dword [esi + 4], eax
mov byte [esi], 4
mov eax, esi
pop esi
pop edi
pop ebx
ret
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x2726
je 0x1002c928
cmp eax, 0x2739
jne 0x1002c953
push 1
push 0
push 0
push 0
push edi
push ebx
call dword [sym.imp.WS2_32.dll_WSASocketW]
cmp eax, 0xffffffff
je 0x1002c95b
mov edi, eax
push 0
push 1
push eax
call dword [sym.imp.KERNEL32.dll_SetHandleInformation]
test eax, eax
je 0x1002c96c
mov dword [esi + 4], edi
jmp 0x1002c90b
mov byte [esi], 0
mov dword [esi + 4], eax
jmp 0x1002c90e
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov dword [esi + 4], eax
mov dword [esi], 0
jmp 0x1002c90e
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
mov edx, eax
shr eax, 0x18
mov byte [esi], 0
shr ecx, 8
shl edx, 0x18
mov byte [esi + 7], al
mov dword [esi + 1], edx
mov word [esi + 5], cx
push edi
call dword [sym.imp.WS2_32.dll_closesocket]
jmp 0x1002c90e
Function at 0x1002c9a0
Capabilities:
Connect socket

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x1c
mov ecx, dword [esp + 0x38]
mov esi, dword [esp + 0x30]
mov eax, dword [esp + 0x34]
cmp word [ecx], 0
je 0x1002c9d1
movups xmm0, xmmword [ecx + 4]
mov ebx, dword [ecx + 0x18]
lea edi, [ecx + 0x14]
add ecx, 0x1c
mov edx, 0x1c
mov bp, 0x17
jmp 0x1002c9e3
lea edi, [ecx + 2]
add ecx, 6
mov edx, 0x10
mov bp, 2
xorps xmm0, xmm0
movzx ecx, word [ecx]
mov edi, dword [edi]
mov word [esp], bp
rol cx, 8
mov word [esp + 2], cx
mov dword [esp + 4], edi
movups xmmword [esp + 8], xmm0
mov dword [esp + 0x18], ebx
mov ecx, esp
push edx
push ecx
push dword [eax]
call dword [sym.imp.WS2_32.dll_connect]
cmp eax, 0xffffffff
je 0x1002ca18
mov byte [esi], 4
jmp 0x1002ca27
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov dword [esi + 4], eax
mov dword [esi], 0
mov eax, esi
add esp, 0x1c
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x1002cdd0
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebx
push edi
push esi
sub esp, 8
mov esi, dword [esp + 0x18]
mov eax, dword [esp + 0x20]
mov edx, dword [esp + 0x24]
mov ecx, dword [esp + 0x1c]
mov dword [esp], 0
mov dword [esp + 4], 0
lea edi, [esp + 4]
mov ebx, esp
push 0
push 0
push edi
push ebx
push edx
push eax
push dword [ecx]
call dword [sym.imp.WS2_32.dll_WSARecv]
test eax, eax
je 0x1002ce25
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x274a
jne 0x1002ce30
mov dword [esi + 4], 0
jmp 0x1002ce2b
mov eax, dword [esp]
mov dword [esi + 4], eax
mov byte [esi], 4
jmp 0x1002ce36
mov byte [esi], 0
mov dword [esi + 4], eax
mov eax, esi
add esp, 8
pop esi
pop edi
pop ebx
ret
Function at 0x1002ce40
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0xb0
mov esi, ecx
mov ecx, dword [ebp + 0xc]
mov edi, closesocket
pxor xmm0, xmm0
lea ebx, [esp + 8]
lea eax, [esp + 0x20]
mov dword [esp + 8], 0x80
movdqa xmmword [esp + 0x90], xmm0
movdqa xmmword [esp + 0x80], xmm0
movdqa xmmword [esp + 0x70], xmm0
movdqa xmmword [esp + 0x60], xmm0
movdqa xmmword [esp + 0x50], xmm0
movdqa xmmword [esp + 0x40], xmm0
movdqa xmmword [esp + 0x30], xmm0
movdqa xmmword [esp + 0x20], xmm0
cmp ecx, 0x7fffffff
cmovb edi, ecx
mov ecx, dword [ebp + 0x10]
push ebx
push eax
push ecx
push edi
push dword [ebp + 8]
push edx
call dword [sym.imp.WS2_32.dll_recvfrom]
cmp eax, 0xffffffff
je 0x1002cf0f
movzx edx, word [esp + 0x20]
mov ecx, dword [esp + 8]
cmp edx, 0x17
je 0x1002cf7c
cmp edx, 2
jne 0x1002cf69
cmp ecx, 0xf
jbe 0x1002d00f
movzx edx, word [esp + 0x22]
mov ecx, dword [esp + 0x24]
rol dx, 8
mov dword [esp + 0xc], ecx
movd xmm0, ecx
mov word [esp + 0x10], dx
pslld xmm0, 0x10
movups xmm1, xmmword [esp + 0xe]
jmp 0x1002cfa4
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x274a
jne 0x1002cfbb
movzx ecx, word [esp + 0x20]
mov eax, dword [esp + 8]
cmp ecx, 0x17
je 0x1002cfca
cmp ecx, 2
jne 0x1002cf69
cmp eax, 0xf
jbe 0x1002d00f
movzx ecx, word [esp + 0x22]
mov eax, dword [esp + 0x24]
rol cx, 8
mov dword [esp + 0xc], eax
movd xmm0, eax
mov word [esp + 0x10], cx
pslld xmm0, 0x10
movups xmm1, xmmword [esp + 0xe]
jmp 0x1002cfee
mov byte [esp + 0xe], 2
mov eax, 0x100829c0
mov ecx, dword [esp + 0xe]
mov dword [esi + 8], ecx
jmp 0x1002cfbf
cmp ecx, 0x1b
jbe 0x1002d020
movzx ecx, word [esp + 0x22]
mov edi, dword [esp + 0x24]
mov edx, dword [esp + 0x38]
movups xmm1, xmmword [esp + 0x28]
mov ebx, 1
movd xmm0, ebx
rol cx, 8
mov dword [esi], eax
movd dword [esi + 4], xmm0
movups xmmword [esi + 8], xmm1
mov dword [esi + 0x18], edi
mov dword [esi + 0x1c], edx
mov word [esi + 0x20], cx
jmp 0x1002d007
mov byte [esi + 8], 0
mov dword [esi + 0xc], eax
mov word [esi + 4], 2
jmp 0x1002d007
cmp eax, 0x1b
jbe 0x1002d020
movzx eax, word [esp + 0x22]
mov edx, dword [esp + 0x24]
mov ecx, dword [esp + 0x38]
movups xmm1, xmmword [esp + 0x28]
mov edi, 1
movd xmm0, edi
rol ax, 8
mov dword [esi], 0
movd dword [esi + 4], xmm0
movups xmmword [esi + 8], xmm1
mov dword [esi + 0x18], edx
mov dword [esi + 0x1c], ecx
mov word [esi + 0x20], ax
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
push 0x1008294c
push 0x42
push str.assertion_failed:_len_as_usize___mem::size_of::_c::sockaddr_in___library_std_src_sys_common_net.rs
call sym.kso.dll_core::panicking::panic::hd53872080d8d36e0
push 0x100829a0
push 0x43
push 0x1008295c
call sym.kso.dll_core::panicking::panic::hd53872080d8d36e0
int3
Function at 0x1002d040
Capabilities:
Send data
Send data on socket

Disassembly:
push edi
push esi
push eax
mov esi, dword [esp + 0x10]
mov eax, dword [esp + 0x18]
mov edx, dword [esp + 0x1c]
mov ecx, dword [esp + 0x14]
mov dword [esp], 0
mov edi, esp
push 0
push 0
push 0
push edi
push edx
push eax
push dword [ecx]
call dword [sym.imp.WS2_32.dll_WSASend]
cmp eax, 0xffffffff
je 0x1002d07d
mov eax, dword [esp]
mov dword [esi + 4], eax
mov byte [esi], 4
jmp 0x1002d08c
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov dword [esi + 4], eax
mov dword [esi], 0
mov eax, esi
add esp, 4
pop esi
pop edi
ret

Function at 0x1002d0a0
Capabilities:
Set socket configuration

Disassembly:
push ebp
push ebx
push edi
push esi
push eax
mov edi, dword [esp + 0x28]
xor ebp, ebp
cmp edi, 0x3b9aca00
je 0x1002d10e
mov eax, dword [esp + 0x24]
mov esi, dword [esp + 0x20]
mov ebx, 0x3e8
mul ebx
mov ebp, eax
mov eax, esi
seto cl
mul ebx
mov ebx, edx
mov esi, eax
add ebx, ebp
mov ebp, 0xffffffff
setb al
or al, cl
jne 0x1002d10e
mov ecx, 0x431bde83
mov eax, edi
mul ecx
shr edx, 0x12
add esi, edx
adc ebx, 0
jb 0x1002d10e
imul eax, edx, 0xf4240
xor ecx, ecx
sub edi, eax
setne cl
add esi, ecx
adc ebx, 0
jb 0x1002d10e
xor ebp, ebp
neg ebx
sbb ebp, ebp
or ebp, esi
je 0x1002d159
mov ecx, dword [esp + 0x1c]
mov eax, dword [esp + 0x2c]
mov dword [esp], ebp
mov edx, esp
mov ecx, dword [ecx]
push 4
push edx
push eax
push 0xffff
push ecx
call dword [sym.imp.WS2_32.dll_setsockopt]
mov esi, dword [esp + 0x18]
mov cl, 4
cmp eax, 0xffffffff
jne 0x1002d14d
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
xor ecx, ecx
mov byte [esi + 3], 0
mov word [esi + 1], 0
mov dword [esi + 4], eax
mov byte [esi], cl
mov eax, esi
add esp, 4
pop esi
pop edi
pop ebx
pop ebp
ret
mov esi, dword [esp + 0x18]
mov byte [esi], 2
mov dword [esi + 4], 0x10081b40
jmp 0x1002d14f

Function at 0x1002d210
Capabilities:
Set socket configuration

Disassembly:
push esi
push eax
movzx ecx, byte [esp + 0x14]
mov esi, dword [esp + 0xc]
mov eax, dword [esp + 0x10]
mov dword [esp], ecx
mov ecx, esp
push ecx
push 0x8004667e
push dword [eax]
call dword [sym.imp.WS2_32.dll_ioctlsocket]
cmp eax, 0xffffffff
je 0x1002d241
mov byte [esi], 4
mov eax, esi
add esp, 4
pop esi
ret
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov dword [esi + 4], eax
mov dword [esi], 0
mov eax, esi
add esp, 4
pop esi
ret

Function at 0x1002d260
Capabilities:
Set socket configuration

Disassembly:
push ebx
push esi
push eax
xor ecx, ecx
xor edx, edx
cmp dword [esp + 0x20], 0x3b9aca00
mov esi, dword [esp + 0x10]
mov eax, dword [esp + 0x14]
setne bl
je 0x1002d280
mov ecx, dword [esp + 0x18]
mov eax, dword [eax]
mov dl, bl
mov word [esp], dx
mov word [esp + 2], cx
mov ecx, esp
push 4
push ecx
push 0x80
push 0xffff
push eax
call dword [sym.imp.WS2_32.dll_setsockopt]
mov cl, 4
cmp eax, 0xffffffff
jne 0x1002d2bf
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
xor ecx, ecx
mov byte [esi + 3], 0
mov word [esi + 1], 0
mov dword [esi + 4], eax
mov byte [esi], cl
mov eax, esi
add esp, 4
pop esi
pop ebx
ret
Function at 0x1002dfb0
Capabilities:
Set current directory

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x28
mov dword [ebp - 0x1c], esp
mov dword [ebp - 0x10], 0xffffffff
mov dword [ebp - 0x14], 0x1003cca0
lea ecx, [ebp - 0x18]
mov eax, dword [ebp + 0xc]
mov edx, dword fs:[0]
mov dword [ebp - 0x18], edx
mov dword fs:[0], ecx
mov ecx, dword [ebp + 0x10]
mov dword [ebp - 0x34], eax
lea edx, [ebp - 0x34]
add ecx, eax
mov dword [ebp - 0x30], ecx
lea ecx, [ebp - 0x28]
mov word [ebp - 0x2c], 0
call fcn.1000a560
mov edx, dword [ebp - 0x20]
cmp edx, dword [ebp - 0x28]
jne 0x1002e017
lea ecx, [ebp - 0x28]
mov dword [ebp - 0x10], 0
call fcn.10009b10
mov edx, dword [ebp - 0x20]
mov edi, dword [ebp - 0x24]
mov esi, dword [ebp + 8]
mov word [edi + edx*2], 0
push edi
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
test eax, eax
je 0x1002e059
mov byte [esi], 4
mov eax, dword [ebp - 0x28]
test eax, eax
je 0x1002e046
add eax, eax
push 2
push eax
push edi
call sym.kso.dll___rust_dealloc
add esp, 0xc
mov eax, dword [ebp - 0x18]
mov dword fs:[0], eax
mov eax, esi
add esp, 0x28
pop esi
pop edi
pop ebx
pop ebp
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esi + 4], eax
mov dword [esi], 0
mov eax, dword [ebp - 0x28]
test eax, eax
jne 0x1002e038
jmp 0x1002e046
Function at 0x1002f990
Capabilities:
Read file on windows

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x20
mov ebp, dword [esp + 0x34]
mov esi, ecx
mov ecx, dword [ebp + 4]
mov ebx, dword [ebp + 8]
mov eax, ecx
sub eax, ebx
jb 0x1002fa4c
mov ecx, dword [ebp]
xorps xmm0, xmm0
mov edi, esp
mov dword [esp], 0
movups xmmword [esp + 0xc], xmm0
mov dword [esp + 0x1c], edi
lea edi, [esp + 0xc]
add ecx, ebx
push 0x1002fde0
push edi
push eax
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_ReadFileEx]
test eax, eax
je 0x1002fa11
mov edi, dword [sym.imp.KERNEL32.dll_SleepEx]
nop word cs:[eax + eax]
nop
push 1
push 0xffffffffffffffff
call edi
cmp dword [esp], 0
je 0x1002f9f0
mov edi, dword [esp + 4]
test edi, edi
je 0x1002fa2f
mov ecx, edi
call fcn.100379e0
cmp al, 0xb
jne 0x1002fa24
jmp 0x1002fa41
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
mov ecx, edi
call fcn.100379e0
cmp al, 0xb
je 0x1002fa41
mov dword [esi + 4], edi
mov dword [esi], 0
jmp 0x1002fa44
add ebx, dword [esp + 8]
mov dword [ebp + 8], ebx
mov eax, dword [ebp + 0xc]
cmp eax, ebx
cmova ebx, eax
mov dword [ebp + 0xc], ebx
mov byte [esi], 4
add esp, 0x20
pop esi
pop edi
pop ebx
pop ebp
ret
push 0x1007e78c
push ecx
push ebx
call sym.kso.dll_core::slice::index::slice_start_index_len_fail::h148b5e412c56b9cc
int3

Function at 0x10030240
Capabilities:
Read file on windows

Disassembly:
push ebx
push edi
push esi
sub esp, 0x18
cmp dword [edx], 0
mov edi, edx
jne 0x1003030f
mov ebx, dword [edi + 0xc]
mov esi, ecx
mov edx, dword [ebx]
test edx, edx
jne 0x10030269
mov eax, dword [ebx + 8]
xor edx, edx
lea ecx, [eax + 0xf]
cmp ecx, 0xf
jbe 0x100302de
mov eax, dword [ebx + 8]
cmp edx, eax
je 0x100302f9
mov ecx, dword [edi + 8]
sub edx, eax
add eax, dword [ebx + 4]
mov dword [esp], 0
mov ebx, esp
push ecx
push ebx
push edx
push eax
push dword [edi + 0x10]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x100302a4
mov eax, dword [esp]
mov ecx, 2
test eax, eax
jne 0x100302c2
jmp 0x100302b6
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x3e5
je 0x100302bd
cmp eax, 0x6d
jne 0x100302d3
mov word [esi], 4
jmp 0x100302cc
mov ecx, 1
mov dword [edi], ecx
mov dword [edi + 4], eax
mov word [esi], 0x104
add esp, 0x18
pop esi
pop edi
pop ebx
ret
mov dword [esi], 0
mov dword [esi + 4], eax
jmp 0x100302cc
mov edx, eax
mov ecx, ebx
push 0x10
call fcn.1007c050
add esp, 4
mov edx, dword [ebx]
mov eax, dword [ebx + 8]
cmp edx, eax
jne 0x10030274
mov ecx, ebx
push 1
call fcn.1007c050
add esp, 4
mov edx, dword [ebx]
mov eax, dword [ebx + 8]
jmp 0x10030274
mov edx, esp
mov ecx, edi
mov dword [esp], 0
call fcn.1007bef0
int3
Function at 0x10030ed0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x14
mov esi, dword [ebp + 0x10]
mov dword [ebp - 0x1c], esp
mov dword [ebp - 0x10], 0xffffffff
mov dword [ebp - 0x14], 0x1003cd90
lea eax, [ebp - 0x18]
mov ecx, dword fs:[0]
test esi, esi
mov dword [ebp - 0x18], ecx
mov dword fs:[0], eax
je 0x10030f2a
js 0x10030f9a
movzx eax, byte [sym.kso.dll___rust_no_alloc_shim_is_unstable]
push 1
push esi
call sym.kso.dll___rust_alloc
add esp, 8
mov edi, eax
test eax, eax
jne 0x10030f2f
push esi
push 1
call sym.kso.dll_alloc::alloc::handle_alloc_error::h0f7631ec9b341a7f
mov edi, 1
mov ebx, dword [ebp + 8]
push esi
push dword [ebp + 0xc]
push edi
call fcn.1006f790
add esp, 0xc
mov edx, dword [ebx + 0x30]
cmp edx, dword [ebx + 0x28]
jne 0x10030f67
lea ecx, [ebx + 0x28]
mov dword [ebp - 0x20], edi
mov dword [ebp - 0x10], 0
call fcn.10009c50
mov eax, dword [ebp + 8]
mov esi, dword [ebp + 0x10]
mov edi, dword [ebp - 0x20]
mov edx, dword [eax + 0x30]
mov ebx, eax
mov eax, dword [ebx + 0x2c]
lea ecx, [edx + edx*4]
inc edx
mov dword [eax + ecx*4], 0
mov dword [eax + ecx*4 + 4], esi
mov dword [eax + ecx*4 + 8], edi
mov dword [eax + ecx*4 + 0xc], esi
mov byte [eax + ecx*4 + 0x10], 0
mov dword [ebx + 0x30], edx
mov eax, dword [ebp - 0x18]
mov dword fs:[0], eax
add esp, 0x14
pop esi
pop edi
pop ebx
pop ebp
ret
call sym.kso.dll_alloc::raw_vec::capacity_overflow::hb4380fcd4c99d9cf
nop
push ebp
sub esp, 0xc
add ebp, 0xc
cmp dword [ebp + 0x10], 0
je 0x10030fbd
push 1
push dword [ebp + 0x10]
push dword [ebp - 0x20]
call sym.kso.dll___rust_dealloc
add esp, 0xc
add esp, 0xc
pop ebp
ret
Function at 0x100310e0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x14
mov esi, dword [ebp + 0x10]
mov dword [ebp - 0x1c], esp
mov dword [ebp - 0x10], 0xffffffff
mov dword [ebp - 0x14], 0x1003cda0
lea eax, [ebp - 0x18]
mov ecx, dword fs:[0]
test esi, esi
mov dword [ebp - 0x18], ecx
mov dword fs:[0], eax
je 0x1003113a
js 0x100311aa
movzx eax, byte [sym.kso.dll___rust_no_alloc_shim_is_unstable]
push 1
push esi
call sym.kso.dll___rust_alloc
add esp, 8
mov edi, eax
test eax, eax
jne 0x1003113f
push esi
push 1
call sym.kso.dll_alloc::alloc::handle_alloc_error::h0f7631ec9b341a7f
mov edi, 1
mov ebx, dword [ebp + 8]
push esi
push dword [ebp + 0xc]
push edi
call fcn.1006f790
add esp, 0xc
mov edx, dword [ebx + 0x30]
cmp edx, dword [ebx + 0x28]
jne 0x10031177
lea ecx, [ebx + 0x28]
mov dword [ebp - 0x20], edi
mov dword [ebp - 0x10], 0
call fcn.10009c50
mov eax, dword [ebp + 8]
mov esi, dword [ebp + 0x10]
mov edi, dword [ebp - 0x20]
mov edx, dword [eax + 0x30]
mov ebx, eax
mov eax, dword [ebx + 0x2c]
lea ecx, [edx + edx*4]
inc edx
mov dword [eax + ecx*4], 1
mov dword [eax + ecx*4 + 4], esi
mov dword [eax + ecx*4 + 8], edi
mov dword [eax + ecx*4 + 0xc], esi
mov byte [eax + ecx*4 + 0x10], 0
mov dword [ebx + 0x30], edx
mov eax, dword [ebp - 0x18]
mov dword fs:[0], eax
add esp, 0x14
pop esi
pop edi
pop ebx
pop ebp
ret
call sym.kso.dll_alloc::raw_vec::capacity_overflow::hb4380fcd4c99d9cf
nop
push ebp
sub esp, 0xc
add ebp, 0xc
cmp dword [ebp + 0x10], 0
je 0x100311cd
push 1
push dword [ebp + 0x10]
push dword [ebp - 0x20]
call sym.kso.dll___rust_dealloc
add esp, 0xc
add esp, 0xc
pop ebp
ret
Function at 0x100355e0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x24
mov esi, ecx
lea ecx, [esp + 0xc]
push dword [esp + 0x38]
call fcn.100380b0
add esp, 4
mov edx, dword [esp + 0xc]
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x14]
cmp edx, 0x80000000
jne 0x1003561e
mov dword [esp + 4], eax
mov dword [esp + 8], ecx
mov dword [esp], closesocket
jmp 0x10035640
mov dword [esp + 0x18], edx
mov dword [esp + 0x20], ecx
mov ecx, esp
lea edx, [esp + 0x18]
mov dword [esp + 0x1c], eax
call fcn.100289d0
mov edi, dword [esp]
cmp edi, 0x80000000
jne 0x10035652
mov ecx, esp
call fcn.10004e00
mov dword [esi], closesocket
add esp, 0x24
jmp 0x1003568b
mov ebx, dword [esp + 4]
mov ebp, dword [esp + 8]
push ebx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x10035673
mov dword [esi], edi
mov dword [esi + 4], ebx
mov dword [esi + 8], ebp
add esp, 0x24
jmp 0x1003568b
test edi, edi
mov dword [esi], closesocket
je 0x1003566e
add edi, edi
push 2
push edi
push ebx
call sym.kso.dll___rust_dealloc
add esp, 0x30
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x10036370
Capabilities:
Generate random numbers via rtlgenrandom

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x60
mov esi, esp
mov dword [esi + 0x48], ebp
mov dword [esi + 0x4c], esp
mov dword [esi + 0x58], 0xffffffff
mov dword [esi + 0x54], 0x1003cdf0
mov edi, ecx
lea eax, [esi + 0x50]
xorps xmm0, xmm0
mov ecx, dword fs:[0]
mov dword [esi + 0x50], ecx
mov dword fs:[0], eax
movaps xmmword [esi + 0x10], xmm0
lea eax, [esi + 0x10]
push 0x10
push eax
call dword [sym.imp.ADVAPI32.dll_SystemFunction036]
test al, al
je 0x100363ee
mov eax, dword [esi + 0x10]
mov ecx, dword [esi + 0x14]
mov edx, dword [esi + 0x18]
mov ebx, dword [esi + 0x1c]
mov dword [esi + 4], eax
mov eax, dword [esi + 0x50]
mov dword fs:[0], eax
mov dword [edi + 0xc], ebx
mov dword [edi + 8], edx
mov dword [edi + 4], ecx
mov eax, dword [esi + 4]
mov dword [edi], eax
mov eax, edi
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov byte [esi + 8], 0
mov dword [esi + 0xc], eax
lea eax, [esi + 8]
mov dword [esi + 0x30], 0x10081f5c
mov dword [esi + 0x34], 1
mov dword [esi + 0x40], 0
mov dword [esi + 0x58], 0
mov dword [esi + 0x28], eax
lea eax, [esi + 0x28]
mov dword [esi + 0x2c], sym.kso.dll___std::io::error::Error_as_core::fmt::Display_::fmt::hc311fd6605f5ab1e
mov dword [esi + 0x38], eax
mov dword [esi + 0x3c], 1
lea eax, [esi + 0x30]
push 0x10081f8c
push eax
call sym.kso.dll_core::panicking::panic_fmt::h502dc0a95427940e
add esp, 8
ud2
Function at 0x100370c0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x1c
mov dword [ebp - 0x1c], esp
mov dword [ebp - 0x10], 0xffffffff
mov dword [ebp - 0x14], 0x1003ce20
lea eax, [ebp - 0x18]
mov ebx, dword [ebp + 0x10]
mov ecx, dword fs:[0]
mov dword [ebp - 0x18], ecx
mov dword fs:[0], eax
movzx eax, byte [sym.kso.dll___rust_no_alloc_shim_is_unstable]
push 4
push 8
call sym.kso.dll___rust_alloc
add esp, 8
test eax, eax
je 0x100371a2
mov esi, eax
mov edi, dword [ebp + 8]
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 0x14]
mov dword [esi], ebx
mov dword [esi + 4], ecx
push 0
push 0x10000
push esi
push 0x10037220
push eax
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
test eax, eax
je 0x1003713d
mov dword [edi + 4], eax
mov byte [edi], 4
jmp 0x1003718f
mov eax, dword [esi]
mov ecx, dword [esi + 4]
mov dword [ebp - 0x28], esi
mov dword [ebp - 0x10], 1
mov dword [ebp - 0x24], eax
push eax
mov dword [ebp - 0x20], ecx
call dword [ecx]
add esp, 4
mov ecx, dword [ebp - 0x20]
mov edi, dword [ebp + 8]
mov eax, dword [ecx + 4]
test eax, eax
je 0x10037174
push dword [ecx + 8]
push eax
push dword [ebp - 0x24]
call sym.kso.dll___rust_dealloc
add esp, 0xc
push 4
push 8
push dword [ebp - 0x28]
call sym.kso.dll___rust_dealloc
add esp, 0xc
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov byte [edi], 0
mov dword [edi + 4], eax
mov eax, dword [ebp - 0x18]
mov dword fs:[0], eax
mov eax, edi
add esp, 0x1c
pop esi
pop edi
pop ebx
pop ebp
ret
mov dword [ebp - 0x10], 0
push 8
push 4
call sym.kso.dll_alloc::alloc::handle_alloc_error::h0f7631ec9b341a7f
add esp, 8
ud2