joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1011290c
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x2c
mov eax, dword [0x101d9590]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
mov ecx, dword [ebp + 0xc]
push ebx
xor ebx, ebx
push edi
mov dword [ebp - 0x2c], ecx
mov edi, ebx
mov dword [ebp - 0x24], ebx
test eax, eax
je 0x10112ac9
test ecx, ecx
je 0x10112ac9
push ebx
push 0x8000080
push 3
push ebx
push ebx
push 0x80000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov ecx, eax
mov dword [ebp - 0x20], ecx
cmp ecx, 0xffffffff
jne 0x1011296f
call fcn.101117ac
mov eax, 0x80004005
jmp 0x10112ace
push esi
and dword [ebp - 0x28], edi
push 0x18
pop esi
sub esi, ebx
cmp esi, 0x400000
jbe 0x10112985
mov esi, 0x400000
push 0
lea eax, [ebp - 0x28]
push eax
push esi
lea eax, [ebp + ebx - 0x1c]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x10112aa4
cmp dword [ebp - 0x28], edi
je 0x10112aa9
cmp dword [ebp - 0x28], esi
jne 0x10112aa9
mov ecx, dword [ebp - 0x20]
add ebx, esi
cmp ebx, 0x18
jne 0x10112970
cmp dword [ebp - 0x1c], edi
je 0x10112a9b
cmp dword [ebp - 0x18], edi
je 0x10112a9b
cmp dword [ebp - 0x14], edi
je 0x10112a9b
cmp dword [ebp - 8], edi
je 0x101129ec
mov eax, dword [ebp - 0x10]
imul eax, dword [ebp - 0xc]
cmp eax, dword [ebp - 0x1c]
jne 0x10112a9b
push 0x100014bc
push 0x2c
call fcn.10018970
pop ecx
pop ecx
test eax, eax
je 0x10112a09
mov ecx, eax
call fcn.101127f0
mov edi, eax
jmp 0x10112a0b
xor edi, edi
test edi, edi
jne 0x10112a19
mov esi, 0x8007000e
jmp 0x10112aae
cmp dword [ebp - 8], 0
push dword [ebp - 0x14]
mov ecx, edi
push dword [ebp - 0x18]
je 0x10112a43
push dword [ebp - 0xc]
push dword [ebp - 0x10]
call fcn.10112648
mov esi, eax
test esi, esi
jns 0x10112a5c
mov edx, dword [edi]
push 1
mov ecx, edi
call dword [edx + 0x4c]
jmp 0x10112aae
push dword [ebp - 0x1c]
call fcn.101124e8
mov esi, eax
test esi, esi
jns 0x10112a5c
mov eax, dword [edi]
push 1
mov ecx, edi
call dword [eax + 0x4c]
jmp 0x10112aae
mov eax, dword [edi]
lea ecx, [ebp - 0x24]
push ecx
push dword [ebp - 0x1c]
push 0
push edi
call dword [eax + 0x28]
mov esi, eax
test esi, esi
js 0x10112aae
mov eax, dword [ebp - 0x14]
imul eax, dword [ebp - 0x18]
imul eax, dword [ebp - 0x1c]
mov ebx, dword [ebp - 0x20]
shl eax, 2
push eax
push dword [ebp - 0x24]
push ebx
call fcn.1011184b
mov esi, eax
test esi, esi
js 0x10112ab1
mov eax, dword [ebp - 0x2c]
mov dword [eax], edi
xor esi, esi
jmp 0x10112ab1
mov esi, 0x8876086c
mov ebx, ecx
jmp 0x10112ab1
call fcn.101117ac
mov esi, 0x80004005
mov ebx, dword [ebp - 0x20]
cmp dword [ebp - 0x24], 0
je 0x10112abd
mov eax, dword [edi]
push edi
call dword [eax + 0x2c]
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, esi
pop esi
jmp 0x10112ace
mov eax, 0x8876086c
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop ebx
call fcn.101becf5
leave
ret 8
Function at 0x10112ae3
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x2c
mov eax, dword [0x101d9590]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
mov ecx, dword [ebp + 0xc]
push ebx
xor ebx, ebx
push edi
mov dword [ebp - 0x2c], ecx
mov edi, ebx
mov dword [ebp - 0x24], ebx
test eax, eax
je 0x10112ca0
test ecx, ecx
je 0x10112ca0
push ebx
push 0x8000080
push 3
push ebx
push ebx
push 0x80000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov ecx, eax
mov dword [ebp - 0x20], ecx
cmp ecx, 0xffffffff
jne 0x10112b46
call fcn.101117ac
mov eax, 0x80004005
jmp 0x10112ca5
push esi
and dword [ebp - 0x28], edi
push 0x18
pop esi
sub esi, ebx
cmp esi, 0x400000
jbe 0x10112b5c
mov esi, 0x400000
push 0
lea eax, [ebp - 0x28]
push eax
push esi
lea eax, [ebp + ebx - 0x1c]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x10112c7b
cmp dword [ebp - 0x28], edi
je 0x10112c80
cmp dword [ebp - 0x28], esi
jne 0x10112c80
mov ecx, dword [ebp - 0x20]
add ebx, esi
cmp ebx, 0x18
jne 0x10112b47
cmp dword [ebp - 0x1c], edi
je 0x10112c72
cmp dword [ebp - 0x18], edi
je 0x10112c72
cmp dword [ebp - 0x14], edi
je 0x10112c72
cmp dword [ebp - 8], edi
je 0x10112bc3
mov eax, dword [ebp - 0x10]
imul eax, dword [ebp - 0xc]
cmp eax, dword [ebp - 0x1c]
jne 0x10112c72
push 0x100014bc
push 0x2c
call fcn.10018970
pop ecx
pop ecx
test eax, eax
je 0x10112be0
mov ecx, eax
call fcn.101127f0
mov edi, eax
jmp 0x10112be2
xor edi, edi
test edi, edi
jne 0x10112bf0
mov esi, 0x8007000e
jmp 0x10112c85
cmp dword [ebp - 8], 0
push dword [ebp - 0x14]
mov ecx, edi
push dword [ebp - 0x18]
je 0x10112c1a
push dword [ebp - 0xc]
push dword [ebp - 0x10]
call fcn.10112648
mov esi, eax
test esi, esi
jns 0x10112c33
mov edx, dword [edi]
push 1
mov ecx, edi
call dword [edx + 0x4c]
jmp 0x10112c85
push dword [ebp - 0x1c]
call fcn.101124e8
mov esi, eax
test esi, esi
jns 0x10112c33
mov eax, dword [edi]
push 1
mov ecx, edi
call dword [eax + 0x4c]
jmp 0x10112c85
mov eax, dword [edi]
lea ecx, [ebp - 0x24]
push ecx
push dword [ebp - 0x1c]
push 0
push edi
call dword [eax + 0x28]
mov esi, eax
test esi, esi
js 0x10112c85
mov eax, dword [ebp - 0x14]
imul eax, dword [ebp - 0x18]
imul eax, dword [ebp - 0x1c]
mov ebx, dword [ebp - 0x20]
shl eax, 2
push eax
push dword [ebp - 0x24]
push ebx
call fcn.1011184b
mov esi, eax
test esi, esi
js 0x10112c88
mov eax, dword [ebp - 0x2c]
mov dword [eax], edi
xor esi, esi
jmp 0x10112c88
mov esi, 0x8876086c
mov ebx, ecx
jmp 0x10112c88
call fcn.101117ac
mov esi, 0x80004005
mov ebx, dword [ebp - 0x20]
cmp dword [ebp - 0x24], 0
je 0x10112c94
mov eax, dword [edi]
push edi
call dword [eax + 0x2c]
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, esi
pop esi
jmp 0x10112ca5
mov eax, 0x8876086c
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop ebx
call fcn.101becf5
leave
ret 8
Function at 0x10142864
Capabilities:
Contain obfuscated stackstrings
Write file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x101d9590]
xor eax, ebp
mov dword [ebp - 4], eax
xor eax, eax
push eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], eax
mov dword [ebp - 0x28], eax
lea eax, [ebp - 0x28]
push eax
push 0x20
lea eax, [ebp - 0x24]
push eax
push dword [ecx + 0x30]
mov dword [ebp - 0x24], 0x20666f78
mov dword [ebp - 0x20], 0x34303330
mov dword [ebp - 0x1c], 0x206e6962
mov dword [ebp - 0x18], 0x32333030
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov ecx, dword [ebp - 4]
neg eax
sbb eax, eax
and eax, 0x7ff8fff2
xor ecx, ebp
add eax, 0x8007000e
call fcn.101becf5
leave
ret

Function at 0x10142e63
Capabilities:
Get file size
Read file via mapping

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
push edi
xor esi, esi
push esi
push esi
push 3
push esi
push 1
push 0x80000000
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov edi, eax
cmp edi, 0xffffffff
jne 0x10142e94
mov eax, 0x88760389
jmp 0x10142f7d
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [ebp - 4], eax
cmp eax, 0xffffffff
jne 0x10142eb5
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 0x8876038f
jmp 0x10142f7d
push ebx
push esi
push esi
push esi
push 2
push esi
push edi
call dword [sym.imp.KERNEL32.dll_CreateFileMappingA]
mov ebx, eax
mov dword [ebp - 8], ebx
cmp ebx, 0xffffffff
jne 0x10142ede
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 0x8876038f
jmp 0x10142f7c
push esi
push esi
push esi
push 4
push ebx
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov dword [ebp + 8], eax
test eax, eax
jne 0x10142ef8
mov ebx, 0x8876038f
jmp 0x10142f31
push 0x100014bc
push 0x24
call fcn.10018970
pop ecx
pop ecx
test eax, eax
je 0x10142f1d
push dword [ebp - 4]
mov ecx, eax
push dword [ebp + 8]
push ebx
push edi
call fcn.10147f30
mov ebx, eax
jmp 0x10142f1f
mov ebx, esi
test ebx, ebx
jne 0x10142f43
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov ebx, 0x8007000e
push dword [ebp - 8]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push edi
call esi
mov eax, ebx
jmp 0x10142f7c
push 0x100014bc
push 0x30
call fcn.10018970
pop ecx
pop ecx
test eax, eax
je 0x10142f62
push ebx
push dword [ebp + 0xc]
mov ecx, eax
call fcn.10142b7d
mov esi, eax
mov eax, dword [ebp + 0x10]
mov dword [eax], esi
test esi, esi
jne 0x10142f7a
mov eax, dword [ebx]
push 1
mov ecx, ebx
call dword [eax]
mov eax, 0x8007000e
jmp 0x10142f7c
xor eax, eax
pop ebx
pop edi
pop esi
leave
ret 0xc
Function at 0x10142f88
Capabilities:
Get file size
Read file via mapping

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x11c
mov eax, dword [0x101d9590]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 0x10]
push esi
mov esi, dword [ebp + 0xc]
push edi
mov edi, dword [ebp + 8]
mov dword [ebp - 0x118], esi
mov dword [ebp - 0x114], ebx
call fcn.10018843
test eax, eax
jne 0x10142fea
push 0x104
lea eax, [ebp - 0x108]
push edi
push eax
call sub.msvcrt.dll_wcstombs
add esp, 0xc
push ebx
push esi
lea eax, [ebp - 0x108]
push eax
mov byte [ebp - 5], 0
call fcn.10142e63
jmp 0x10143101
xor esi, esi
push esi
push esi
push 3
push esi
push 1
push 0x80000000
push edi
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
cmp edi, 0xffffffff
jne 0x10143010
mov eax, 0x88760389
jmp 0x10143101
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [ebp - 0x11c], eax
cmp eax, 0xffffffff
jne 0x10143034
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 0x8876038f
jmp 0x10143101
push esi
push esi
push esi
push 2
push esi
push edi
call dword [sym.imp.KERNEL32.dll_CreateFileMappingA]
mov ebx, eax
mov dword [ebp - 0x110], ebx
cmp ebx, 0xffffffff
je 0x10143023
push esi
push esi
push esi
push 4
push ebx
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov dword [ebp - 0x10c], eax
test eax, eax
jne 0x1014306b
mov ebx, 0x8876038f
jmp 0x101430ad
push 0x100014bc
push 0x24
call fcn.10018970
pop ecx
pop ecx
test eax, eax
je 0x10143096
push dword [ebp - 0x11c]
mov ecx, eax
push dword [ebp - 0x10c]
push ebx
push edi
call fcn.10147f30
mov ebx, eax
jmp 0x10143098
mov ebx, esi
test ebx, ebx
jne 0x101430c2
push dword [ebp - 0x10c]
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov ebx, 0x8007000e
push dword [ebp - 0x110]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push edi
call esi
mov eax, ebx
jmp 0x10143101
push 0x100014bc
push 0x30
call fcn.10018970
pop ecx
pop ecx
test eax, eax
je 0x101430e4
push ebx
push dword [ebp - 0x118]
mov ecx, eax
call fcn.10142b7d
mov esi, eax
mov eax, dword [ebp - 0x114]
mov dword [eax], esi
test esi, esi
jne 0x101430ff
mov eax, dword [ebx]
push 1
mov ecx, ebx
call dword [eax]
mov eax, 0x8007000e
jmp 0x10143101
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.101becf5
leave
ret 0xc
Function at 0x10143bf8
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
mov esi, ecx
mov eax, dword [esi + 0x40]
sub eax, 0
je 0x10143c32
dec eax
jne 0x10143c95
push 0x100110f4
push 0x100110e8
push esi
call fcn.10143315
add esp, 0xc
push 0x100110e0
mov ecx, esi
call fcn.101427c5
jmp 0x10143c95
lea eax, [ebp - 8]
push eax
push 4
lea eax, [ebp - 4]
add esi, 0x30
push eax
mov ecx, esi
mov dword [ebp - 4], 0x20666f78
call fcn.10146502
lea eax, [ebp - 8]
push eax
push 4
lea eax, [ebp - 4]
push eax
mov ecx, esi
mov dword [ebp - 4], 0x33303330
call fcn.10146502
lea eax, [ebp - 8]
push eax
push 4
lea eax, [ebp - 4]
push eax
mov ecx, esi
mov dword [ebp - 4], 0x206e6962
call fcn.10146502
lea eax, [ebp - 8]
push eax
push 4
lea eax, [ebp - 4]
push eax
mov ecx, esi
mov dword [ebp - 4], 0x32333030
call fcn.10146502
xor eax, eax
pop esi
leave
ret
Function at 0x10144041
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xa8
mov eax, dword [0x101d9590]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, ecx
mov eax, dword [esi + 0x50]
push edi
mov dword [ebp - 0xa0], esi
test eax, eax
je 0x10144259
xor ebx, ebx
cmp dword [eax], ebx
je 0x10144259
mov eax, dword [esi + 0x54]
test eax, eax
je 0x10144259
cmp dword [eax], ebx
je 0x10144259
mov eax, dword [esi + 0x40]
sub eax, ebx
je 0x101440a9
dec eax
jne 0x101440cb
push dword [esi + 0x58]
call fcn.10143b43
push 0x10011120
mov ecx, esi
call fcn.101427c5
jmp 0x101440cb
lea eax, [ebp - 0x98]
push eax
push 2
lea eax, [ebp - 0x88]
push eax
lea ecx, [esi + 0x30]
mov dword [ebp - 0x88], 0x37
call fcn.10146502
push 1
push ebx
push ebx
push dword [esi + 0x3c]
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov edi, eax
mov dword [ebp - 0x9c], edi
cmp edi, 0xffffffff
jne 0x101440ef
mov eax, 0x8876038f
jmp 0x1014425b
mov eax, dword [esi + 0x50]
mov dword [ebp - 0x88], ebx
cmp dword [eax], ebx
jbe 0x10144259
mov eax, dword [esi + 0x54]
mov eax, dword [eax + 0xc]
push 0
push 0
mov ecx, ebx
push dword [eax + ecx*4]
push dword [esi + 0x3c]
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, 0xffffffff
je 0x101440e5
push edi
mov ecx, esi
call fcn.10142840
and dword [ebp - 0x90], 0
lea ecx, [ebp - 0xa4]
push ecx
lea eax, [esi + 0x30]
push 4
lea ecx, [ebp - 0x90]
push ecx
mov ecx, eax
mov dword [ebp - 0x98], eax
call fcn.10146502
push 0
push 0
push edi
push dword [esi + 0x3c]
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, 0xffffffff
je 0x101440e5
mov eax, dword [esi + 0x50]
mov eax, dword [eax + 0xc]
mov ecx, ebx
shl ecx, 2
add eax, ecx
xor ecx, ecx
push ecx
push 0x8000080
push 3
push ecx
push ecx
push 0x80000000
push dword [eax]
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebp - 0x90], eax
cmp eax, 0xffffffff
je 0x101440e5
and dword [ebp - 0x94], 0
push 0
lea ecx, [ebp - 0x8c]
push ecx
push 0x80
lea ecx, [ebp - 0x84]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x1014422f
mov esi, dword [ebp - 0x90]
mov edi, dword [ebp - 0x94]
mov ebx, dword [ebp - 0x98]
cmp dword [ebp - 0x8c], 0
je 0x10144217
lea eax, [ebp - 0xa8]
push eax
push dword [ebp - 0x8c]
lea eax, [ebp - 0x84]
push eax
mov ecx, ebx
call fcn.10146502
add edi, dword [ebp - 0x8c]
push 0
lea eax, [ebp - 0x8c]
push eax
push 0x80
lea eax, [ebp - 0x84]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x101441cd
mov esi, dword [ebp - 0xa0]
mov ebx, dword [ebp - 0x88]
mov dword [ebp - 0x94], edi
mov edi, dword [ebp - 0x9c]
push dword [ebp - 0x90]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
add edi, dword [ebp - 0x94]
mov eax, dword [esi + 0x50]
inc ebx
mov dword [ebp - 0x9c], edi
mov dword [ebp - 0x88], ebx
cmp ebx, dword [eax]
jb 0x10144100
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.101becf5
leave
ret
Function at 0x10144628
Capabilities:
Delete file

Disassembly:
mov edi, edi
push esi
push edi
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
mov esi, ecx
push dword [esi + 0x30]
mov dword [esi], 0x10011150
call edi
push dword [esi + 0x34]
call edi
cmp dword [esi + 0x38], 0xffffffff
je 0x1014464f
push dword [esi + 0x38]
call edi
mov al, byte [esi + 0x48]
test al, 0x40
je 0x10144665
test al, al
js 0x10144672
push dword [esi + 0xc]
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
jmp 0x10144672
test al, al
js 0x10144672
push dword [esi + 0xc]
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push dword [esi + 0xc]
call sub.msvcrt.dll_void___cdecl_operator_delete_void__
mov eax, dword [esi + 8]
pop ecx
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
lea ecx, [esi + 0x20]
call fcn.101436a4
pop edi
lea ecx, [esi + 0x10]
pop esi
jmp fcn.10142b41
Function at 0x101452a4
Capabilities:
Delete file

Disassembly:
mov edi, edi
push ebx
push esi
mov esi, ecx
push edi
mov dword [esi], 0x1001108c
call fcn.10144041
lea ecx, [esi + 0x30]
call fcn.101464b4
push dword [esi + 0x3c]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edi, dword [esi + 0x48]
test edi, edi
je 0x101452de
push dword [edi + 0xc]
call sub.msvcrt.dll_free
push edi
call sub.msvcrt.dll_void___cdecl_operator_delete_void__
pop ecx
pop ecx
mov edi, dword [esi + 0x4c]
test edi, edi
je 0x101452f5
push dword [edi + 0xc]
call sub.msvcrt.dll_free
push edi
call sub.msvcrt.dll_void___cdecl_operator_delete_void__
pop ecx
pop ecx
mov eax, dword [esi + 0x50]
test eax, eax
je 0x1014533f
xor edi, edi
cmp dword [eax], edi
jbe 0x10145328
mov eax, dword [esi + 0x50]
mov eax, dword [eax + 0xc]
push dword [eax + edi*4]
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov eax, dword [esi + 0x50]
mov eax, dword [eax + 0xc]
push dword [eax + edi*4]
call sub.msvcrt.dll_free
mov eax, dword [esi + 0x50]
inc edi
pop ecx
cmp edi, dword [eax]
jb 0x10145302
mov edi, dword [esi + 0x50]
test edi, edi
je 0x1014533f
push dword [edi + 0xc]
call sub.msvcrt.dll_free
push edi
call sub.msvcrt.dll_void___cdecl_operator_delete_void__
pop ecx
pop ecx
mov edi, dword [esi + 0x54]
test edi, edi
je 0x10145356
push dword [edi + 0xc]
call sub.msvcrt.dll_free
push edi
call sub.msvcrt.dll_void___cdecl_operator_delete_void__
pop ecx
pop ecx
cmp byte [esi + 0x5c], 0
je 0x1014536c
cmp dword [esi + 0x44], 1
jne 0x1014537a
push dword [esi + 0x2c]
call fcn.101479dd
jmp 0x1014537a
cmp dword [esi + 0x44], 1
jne 0x1014537a
push dword [esi + 0x2c]
call fcn.101478b5
push dword [esi + 0x2c]
call sub.msvcrt.dll_void___cdecl_operator_delete_void__
mov eax, dword [esi + 8]
mov edx, dword [eax]
pop ecx
push eax
call dword [edx + 8]
lea ecx, [esi + 0x30]
call fcn.10146583
lea ecx, [esi + 0x1c]
call fcn.10148d74
pop edi
lea ecx, [esi + 0xc]
pop esi
pop ebx
jmp fcn.10142b41
Function at 0x101453ac
Capabilities:
Delete file

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push edi
mov edi, dword [ebp + 0xc]
mov ecx, edi
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x101453bb
sub ecx, edx
lea esi, [ecx + 1]
push 0x100014bc
push esi
call fcn.10018970
pop ecx
pop ecx
mov dword [ebp + 0xc], eax
test eax, eax
jne 0x101453e5
mov eax, 0x8007000e
jmp 0x10145496
push ebx
push esi
push edi
push eax
call sub.msvcrt.dll_memcpy
add esp, 0xc
xor esi, esi
push esi
push 0x8000080
push 2
push esi
push esi
push 0x40000000
push edi
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x10145417
mov esi, 0x8876038f
jmp 0x1014545f
push 0x100014bc
push 0x60
call fcn.10018970
pop ecx
pop ecx
test eax, eax
je 0x10145448
mov edx, dword [ebp + 0x10]
mov ecx, edx
shr ecx, 1
and ecx, 1
push ecx
and edx, 1
push edx
push ebx
push dword [ebp + 0xc]
mov ecx, eax
push dword [ebp + 8]
call fcn.101439fd
mov esi, eax
test esi, esi
jne 0x1014546c
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push edi
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov esi, 0x8007000e
push dword [ebp + 0xc]
call sub.msvcrt.dll_void___cdecl_operator_delete_void__
pop ecx
mov eax, esi
jmp 0x10145495
mov ecx, esi
call fcn.10143bf8
test eax, eax
je 0x1014548e
mov eax, dword [esi]
push 1
mov ecx, esi
call dword [eax + 0x18]
push edi
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov eax, 0x8876038f
jmp 0x10145495
mov eax, dword [ebp + 0x14]
mov dword [eax], esi
xor eax, eax
pop ebx
pop edi
pop esi
pop ebp
ret 0x10
Function at 0x101454a1
Capabilities:
Delete file

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x118
mov eax, dword [0x101d9590]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [ebp + 0x10]
push esi
mov esi, dword [ebp + 0x14]
push edi
mov edi, dword [ebp + 0xc]
mov dword [ebp - 0x114], eax
mov dword [ebp - 0x118], esi
call fcn.10018843
test eax, eax
jne 0x1014550c
push 0x104
lea eax, [ebp - 0x108]
push edi
push eax
call sub.msvcrt.dll_wcstombs
add esp, 0xc
push esi
push ebx
lea eax, [ebp - 0x108]
push eax
push dword [ebp - 0x114]
mov byte [ebp - 5], 0
call fcn.101453ac
jmp 0x1014562e
mov ecx, edi
lea edx, [ecx + 2]
xor esi, esi
mov ax, word [ecx]
add ecx, 2
cmp ax, si
jne 0x10145513
sub ecx, edx
sar ecx, 1
lea eax, [ecx + 1]
push 0x100014bc
xor ecx, ecx
push 2
pop edx
mov dword [ebp - 0x10c], eax
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.10018970
pop ecx
pop ecx
mov ecx, eax
mov dword [ebp - 0x110], ecx
test ecx, ecx
jne 0x1014555c
mov eax, 0x8007000e
jmp 0x1014562e
mov eax, dword [ebp - 0x10c]
add eax, eax
push eax
push edi
push ecx
call sub.msvcrt.dll_memcpy
add esp, 0xc
push esi
push 0x8000080
push 2
pop eax
push eax
push esi
push esi
push 0x40000000
push edi
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [ebp - 0x10c], eax
cmp eax, 0xffffffff
jne 0x10145599
mov esi, 0x8876038f
jmp 0x101455f2
push 0x100014bc
push 0x60
call fcn.10018970
pop ecx
pop ecx
test eax, eax
je 0x101455d5
mov ecx, ebx
shr ecx, 1
and ecx, 1
push ecx
and ebx, 1
push ebx
mov ebx, dword [ebp - 0x10c]
push ebx
push dword [ebp - 0x110]
mov ecx, eax
push dword [ebp - 0x114]
call fcn.10143a9f
mov esi, eax
jmp 0x101455db
mov ebx, dword [ebp - 0x10c]
test esi, esi
jne 0x10145602
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push edi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov esi, 0x8007000e
push dword [ebp - 0x110]
call sub.msvcrt.dll_void___cdecl_operator_delete_void__
pop ecx
mov eax, esi
jmp 0x1014562e
mov ecx, esi
call fcn.10143bf8
test eax, eax
je 0x10145624
mov eax, dword [esi]
push 1
mov ecx, esi
call dword [eax + 0x18]
push edi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov eax, 0x8876038f
jmp 0x1014562e
mov eax, dword [ebp - 0x118]
mov dword [eax], esi
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.101becf5
leave
ret 0x10
Function at 0x10146043
Capabilities:
Get file size
Read file via mapping

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
push esi
push edi
xor esi, esi
push esi
push esi
push 3
push esi
push 1
push 0x80000000
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov edi, eax
cmp edi, 0xffffffff
jne 0x10146075
mov eax, 0x88760389
jmp 0x1014616b
lea eax, [ebp - 8]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [ebp - 0xc], eax
cmp eax, 0xffffffff
jne 0x10146099
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 0x8876038f
jmp 0x1014616b
cmp dword [ebp - 8], esi
jg 0x101460a5
jl 0x10146088
cmp eax, 0x20
jb 0x10146088
push ebx
push esi
push esi
push esi
push 2
push esi
push edi
call dword [sym.imp.KERNEL32.dll_CreateFileMappingA]
mov ebx, eax
mov dword [ebp - 4], ebx
cmp ebx, 0xffffffff
jne 0x101460ce
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 0x8876038f
jmp 0x1014616a
push esi
push esi
push esi
push 4
push ebx
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov dword [ebp + 8], eax
test eax, eax
jne 0x101460e8
mov ebx, 0x8876038f
jmp 0x10146120
push 0x100014bc
push 0x54
call fcn.10018970
pop ecx
pop ecx
test eax, eax
je 0x1014610e
push dword [ebp - 0xc]
mov ecx, eax
push dword [ebp + 8]
push ebx
push edi
push dword [ebp + 0xc]
call fcn.10144c6c
mov esi, eax
test esi, esi
jne 0x10146132
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov ebx, 0x8007000e
push dword [ebp - 4]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push edi
call esi
mov eax, ebx
jmp 0x1014616a
mov ecx, esi
call fcn.10144e41
mov edi, eax
test edi, edi
js 0x10146159
mov ecx, esi
call fcn.10145ea5
mov edi, eax
test edi, edi
js 0x10146159
mov ecx, esi
call fcn.101459a2
mov edi, eax
test edi, edi
jns 0x10146163
mov ecx, dword [esi]
push esi
call dword [ecx + 8]
mov eax, edi
jmp 0x1014616a
mov eax, dword [ebp + 0x10]
mov dword [eax], esi
xor eax, eax
pop ebx
pop edi
pop esi
leave
ret 0xc