joyce8/EMBER2024-capa huggingface dataset:
Function at 0x65adef
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
mov eax, dword [0x904fe8]
xor eax, ebp
mov dword [ebp - 4], eax
push dword [ecx + 0x154]
mov eax, dword [ecx + 0x58]
push dword [ecx + 0x168]
add eax, dword [ecx + 0x50]
movaps xmm0, xmmword [0x86a420]
add eax, dword [ecx + 0x48]
mov edx, dword [ebp + 8]
push eax
movups xmmword [ebp - 0x44], xmm0
lea eax, [ebp - 0x44]
mov dword [ebp - 0x14], 0x203a7964
movaps xmm0, xmmword [0x86a410]
movups xmmword [ebp - 0x34], xmm0
push eax
movaps xmm0, xmmword [0x86a400]
push edx
movups xmmword [ebp - 0x24], xmm0
mov dword [ebp - 0x10], 0x20202020
mov dword [ebp - 0xc], 0xa752520
mov byte [ebp - 8], 0
call fcn.0061b77b
mov ecx, dword [ebp - 4]
add esp, 0x14
xor ecx, ebp
call fcn.007207bc
leave
ret 4

Function at 0x65af82
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push 8
mov eax, 0x7ca3a9
call fcn.00720804
mov esi, ecx
mov edi, dword [ebp + 8]
mov ebx, dword [ebp + 0xc]
push edi
push 0x65a4da
mov dword [edi + 0x14], ebx
imul eax, dword [ebx + 0x40], 0x3c
mov ecx, dword [esi + 4]
add ecx, 8
add eax, dword [esi + 0x78]
inc dword [esi + 0x168]
mov dword [ebp + 8], eax
lea eax, [ebp - 0x14]
push eax
call fcn.006231e7
mov ecx, dword [ebp - 0x14]
and dword [ebp - 4], 0
mov eax, dword [ecx + 0x10]
mov dword [edi + 0x18], eax
mov eax, dword [ecx + 0x14]
mov dword [edi + 0x1c], eax
push dword [esi + 8]
mov edx, dword [ebx + 0x34]
lea ebx, [edi + 0x20]
mov eax, dword [esi + 0x10]
sub eax, dword [esi + 0x160]
push 0
push edi
push 0x65a145
push ebx
push eax
test edx, edx
je 0x65b017
push dword [esi + 0x44]
movzx eax, byte [edx + 0xb1]
push dword [esi + 0x40]
push eax
push dword [esi + 0x3c]
push dword [esi + 0x38]
push dword [edx + 0xc]
push dword [edx + 8]
push dword [ebp + 8]
push dword [edx]
call fcn.00644de5
jmp 0x65b025
mov eax, dword [ebp + 0xc]
push dword [ebp + 8]
push dword [eax + 0x38]
call fcn.00644d93
mov eax, dword [ebx]
lea ecx, [ebp - 0x14]
add dword [esi + 0x160], eax
adc dword [esi + 0x164], 0
call fcn.0061929b
call fcn.007207cd
ret 8

Function at 0x66a275
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 8]
xor ecx, ecx
mov eax, dword [ebp + 0xc]
shr eax, cl
add ecx, 8
xor byte [edx], al
inc edx
cmp ecx, 0x20
jb 0x66a27d
pop ebp
ret
Function at 0x672e29
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10c
mov eax, dword [0x904fe8]
xor eax, ebp
mov dword [ebp - 4], eax
push 0
push 1
lea eax, [ebp - 0x105]
mov byte [ebp - 0x105], 1
push eax
push dword [ecx + 0x35c]
call dword [sym.imp.WS2_32.dll_send]
cmp eax, 0xffffffff
jne 0x672ea8
push esi
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov esi, eax
lea eax, [ebp - 0x10c]
push eax
lea eax, [ebp - 0x104]
mov dword [ebp - 0x10c], esi
push eax
call fcn.0061b638
lea eax, [ebp - 0x104]
push eax
push esi
push str.Failed_to_preemptively_wake_worker_thread.._Error__d_:__s
push 0x14e
push str.d:package_cache_tact3.9.2_srcdownloaddownload_curl.windows.cpp
push 4
push str.tact
call fcn.007a784a
add esp, 0x24
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.007207bc
leave
ret

Function at 0x677c98
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, 0x811c9dc5
mov cl, byte [edi]
lea edx, [ecx - 0x41]
lea eax, [ecx + 0x20]
cmp dl, 0x19
movzx ecx, cl
movzx eax, al
cmovbe ecx, eax
inc edi
test cl, cl
je 0x677ccb
movzx eax, cl
xor eax, esi
imul esi, eax, 0x1000193
jmp 0x677ca5
pop edi
mov eax, esi
pop esi
pop ebp
ret 4

Function at 0x67fb4d
Capabilities:
Hash data with md5

Disassembly:
push ebx
push esi
mov esi, ecx
xor ebx, ebx
mov eax, dword [esi + 0x19c]
test eax, eax
je 0x67fb7e
cmp byte [esi + 0x1a0], bl
je 0x67fb6c
push eax
call fcn.0063ff17
pop ecx
mov dword [esi + 0x19c], ebx
mov dword [esi + 0x1a4], ebx
mov dword [esi + 0x1a8], ebx
mov eax, dword [esi + 0x210]
test eax, eax
je 0x67fb95
push eax
call fcn.0066b60e
pop ecx
mov dword [esi + 0x210], ebx
lea ecx, [esi + 0x78]
call fcn.0066d044
mov byte [esi + 0x70], bl
lea ecx, [esi + 0x1b0]
mov dword [esi + 0x64], ebx
mov dword [esi + 0x68], ebx
mov dword [esi + 0x6c], ebx
mov dword [esi + 0x130], ebx
mov dword [esi + 0x134], ebx
mov dword [esi + 0x13c], ebx
mov byte [esi + 0x140], bl
mov byte [esi + 0x164], bl
mov dword [esi + 0x14c], ebx
mov dword [esi + 0x15c], ebx
mov dword [esi + 0x168], ebx
pop esi
pop ebx
jmp fcn.006ad216
Function at 0x68b0c1
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
mov eax, dword [ebp + 8]
xor edx, edx
cmp dword [eax], edx
je 0x68b0d4
push 0x11
pop eax
leave
ret
push ebx
push esi
mov esi, dword [ebp + 0x10]
push edi
cmp dword [esi + 0xc], edx
je 0x68b1f1
mov ebx, dword [esi + 8]
test ebx, ebx
je 0x68b1f1
movzx eax, byte [esi + 4]
xor ecx, ecx
mov dword [ebp - 8], eax
xor edi, edi
add eax, edx
bts ecx, eax
cmp eax, 0x20
cmovae edi, ecx
xor ecx, edi
cmp eax, 0x40
mov eax, edi
mov edi, dword [esi + 0xc]
cmovae eax, ecx
cmp edx, eax
jb 0x68b141
ja 0x68b11b
cmp edi, ecx
jbe 0x68b141
push eax
push ecx
push edi
push str.Key_layout_count___u__exceeds_maximum___llu_
push 0x12e
push str.d:package_cachecasc1.4.58_src_static.cpp
push 4
push str.casc
call fcn.007a784a
add esp, 0x20
jmp 0x68b20f
test edi, edi
je 0x68b16c
movzx ecx, byte [ebx + 1]
movzx eax, byte [ebx + 2]
add ecx, dword [ebp - 8]
movzx esi, byte [ebx]
add ecx, eax
mov eax, esi
mov dword [ebp - 4], esi
mov esi, dword [ebp + 0x10]
add eax, ecx
cmp eax, 0x38
jne 0x68b184
inc edx
add ebx, 8
cmp edx, edi
jb 0x68b145
cmp dword [esi + 0x20], 0
jbe 0x68b1cf
cmp dword [esi + 0x20], 1
jne 0x68b194
push str.Aligned_cached_buffer_count_of_1_isnt_valid__it_must_be_2_or_greater
push 0x142
jmp 0x68b1fb
push 0x38
push eax
push edx
push str.Key_layout__u__total_bit_count___u__isnt_expected_bit_count___u_
push 0x139
jmp 0x68b128
mov ecx, dword [esi + 0x24]
test ecx, ecx
jne 0x68b1a7
push str.Aligned_cached_buffer_size_of_0_isnt_valid
push 0x148
jmp 0x68b1fb
lea eax, [ecx - 1]
test ecx, eax
je 0x68b1cf
push ecx
push str.Aligned_cached_buffer_size_must_be_a_power_of_2___u_isnt_
push 0x14f
push str.d:package_cachecasc1.4.58_src_static.cpp
push 4
push str.casc
call fcn.007a784a
add esp, 0x18
jmp 0x68b20f
mov eax, dword [esi + 0x1c]
test eax, eax
jne 0x68b1db
call fcn.006acdac
push esi
lea ecx, [ebp + 0xc]
push ecx
push eax
mov ecx, eax
call fcn.0068a6a0
mov ecx, dword [ebp + 8]
mov dword [ecx], eax
xor eax, eax
jmp 0x68b212
push str.Must_provide_at_least_1_key_bit_layout.
push 0x127
push str.d:package_cachecasc1.4.58_src_static.cpp
push 4
push str.casc
call fcn.007a784a
add esp, 0x14
push 0xa
pop eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x68cda0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
mov ebx, dword [ebp + 0x10]
push esi
mov esi, dword [ebp + 8]
push edi
mov dword [ebp - 4], ecx
mov edi, dword [esi + 0x3c]
mov eax, dword [esi + 0x4c]
lea eax, [edi + eax*8]
mov dword [ebp + 8], eax
cmp edi, eax
je 0x68ce10
add ecx, 0x24
mov dword [ebp + 0x10], ecx
mov eax, dword [edi]
mov dword [ebp - 0xc], eax
mov eax, dword [edi + 4]
mov dword [ebp - 8], eax
lea eax, [ebp - 0xc]
push eax
call fcn.00681ecc
test eax, eax
je 0x68ce05
mov eax, dword [eax + 8]
cmp dword [eax + 0x38], esi
jne 0x68cded
add eax, 0x20
jmp 0x68cdf5
cmp dword [eax + 0x78], esi
jne 0x68ce05
add eax, 0x60
push ebx
push dword [ebp + 0xc]
push eax
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0x18]
call fcn.0068d16b
mov ecx, dword [ebp + 0x10]
add edi, 8
cmp edi, dword [ebp + 8]
jne 0x68cdc8
mov eax, dword [ebp + 0xc]
lea ecx, [esi + 0x38]
mov dword [esi + 0x28], eax
call fcn.0050da05
xor ecx, ecx
mov byte [esi + 0x2e], cl
mov eax, dword [0x872588]
mov dword [esi + 0x30], eax
mov eax, dword [0x87258c]
mov dword [esi + 0x34], eax
cmp byte [esi + 0x2d], cl
jne 0x68ce3c
test bl, bl
je 0x68ce4f
mov word [esi + 0x2c], cx
mov dword [esi + 8], ecx
mov dword [esi + 0xc], ecx
mov dword [esi + 0x10], ecx
mov dword [esi + 0x14], ecx
mov dword [esi + 0x28], ecx
lea eax, [esi + 0x54]
push eax
call fcn.006b49b9
pop ecx
pop edi
pop esi
pop ebx
leave
ret 0xc
Function at 0x68d914
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push 8
push 0x80
mov eax, 0x7cec20
call fcn.00721b3a
mov esi, ecx
mov dword [ebp - 0x6c], esi
mov eax, dword [ebx + 8]
and dword [ebp - 0x60], 0
mov dword [ebp - 0x70], eax
mov eax, dword [esi]
mov dword [ebp - 0x68], eax
lea eax, [ebp - 0x58]
mov dword [ebp - 0x64], eax
mov dword [ebp - 0x5c], reloc.WS2_32.dll_htonl
mov edi, dword [esi + 0x18]
and dword [ebp - 4], 0
add edi, 0xc
push edi
mov dword [ebp - 0x80], edi
mov dword [ebp - 0x8c], edi
call fcn.006acdfa
add esi, 0x1c
mov byte [ebp - 4], 1
push esi
mov dword [ebp - 0x7c], esi
call fcn.006b2e80
mov eax, dword [ebp - 0x70]
pop ecx
pop ecx
mov ecx, dword [eax + 0x3c]
mov eax, dword [eax + 0x4c]
mov dword [ebp - 0x84], ecx
lea eax, [ecx + eax*8]
mov dword [ebp - 0x74], eax
cmp ecx, eax
je 0x68da04
mov ecx, dword [ebp - 0x6c]
mov edi, dword [ebp - 0x84]
add ecx, 0x24
mov esi, dword [ebp - 0x70]
mov dword [ebp - 0x78], ecx
mov eax, dword [edi]
mov dword [ebp - 0x88], eax
mov eax, dword [edi + 4]
mov dword [ebp - 0x84], eax
lea eax, [ebp - 0x88]
push eax
call fcn.00681ecc
test eax, eax
je 0x68d9c2
mov eax, dword [eax + 8]
jmp 0x68d9c4
xor eax, eax
test eax, eax
je 0x68d9f3
cmp dword [eax + 0x18], 0
je 0x68d9f3
cmp dword [eax + 0x38], 0
je 0x68d9d9
cmp dword [eax + 0x38], esi
jne 0x68d9f3
cmp dword [eax + 0x78], 0
je 0x68d9e4
cmp dword [eax + 0x78], esi
jne 0x68d9f3
cmp byte [eax + 0x48], 0
je 0x68d9f3
push eax
lea ecx, [ebp - 0x68]
call fcn.0065cb86
mov ecx, dword [ebp - 0x78]
add edi, 8
cmp edi, dword [ebp - 0x74]
jne 0x68d99c
mov esi, dword [ebp - 0x7c]
mov edi, dword [ebp - 0x80]
push dword [ebx + 0x10]
mov ecx, dword [ebp - 0x6c]
push dword [ebx + 0xc]
push dword [ebp - 0x70]
call fcn.0068cda0
push esi
call fcn.006b2e8e
push edi
mov byte [ebp - 4], 2
call fcn.006ace18
mov eax, dword [ebp - 0x6c]
mov byte [ebp - 4], 0
mov eax, dword [eax + 0x18]
add eax, 0x10
push eax
call fcn.006b50a3
mov edi, dword [ebp - 0x64]
add esp, 0xc
mov eax, dword [ebp - 0x60]
lea eax, [edi + eax*8]
mov dword [ebp - 0x74], eax
cmp edi, eax
je 0x68dac1
mov eax, dword [ebp - 0x6c]
add eax, 0x24
mov dword [ebp - 0x80], eax
push esi
call fcn.006b2e80
pop ecx
mov ecx, dword [ebp - 0x80]
push edi
call fcn.00681ecc
test eax, eax
je 0x68da6d
mov eax, dword [eax + 8]
jmp 0x68da6f
xor eax, eax
test eax, eax
jne 0x68da84
push esi
mov byte [ebp - 4], 3
call fcn.006b2e8e
pop ecx
mov byte [ebp - 4], 0
jmp 0x68dab9
mov ecx, dword [eax + 0x18]
mov eax, dword [eax + 0x1c]
mov dword [ebp - 0x7c], ecx
mov dword [ebp - 0x78], eax
push esi
mov byte [ebp - 4], 4
call fcn.006b2e8e
pop ecx
mov ecx, dword [ebp - 0x7c]
mov byte [ebp - 4], 0
test ecx, ecx
je 0x68dab9
push dword [edi + 4]
mov eax, dword [ebp - 0x6c]
push dword [edi]
push dword [eax + 4]
push dword [ebp - 0x78]
call ecx
add esp, 0x10
add edi, 8
cmp edi, dword [ebp - 0x74]
jne 0x68da54
lea ecx, [ebp - 0x68]
call fcn.0061db38
mov ecx, dword [ebp - 0x14]
call fcn.00721b15
ret 0xc
Function at 0x694212
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push esi
mov esi, dword [ebp + 8]
mov edx, ecx
movzx eax, byte [edx + esi]
xor ecx, eax
inc edx
cmp edx, 9
jb 0x69421d
mov eax, ecx
shr eax, 4
xor eax, ecx
movzx ecx, byte [ebp + 0xc]
add eax, ecx
and eax, 0xf
pop esi
pop ebp
ret

Function at 0x69432d
Capabilities:
Check if file exists
Check mutex on windows

Disassembly:
push 0x24
mov eax, 0x7cf499
call fcn.00720838
xor ebx, ebx
mov dword [ebp - 0x28], 0xc
push ebx
lea eax, [ebp - 0x24]
mov dword [ebp - 0x20], ebx
push eax
push 1
push str.D:_A__GA___WD__A__GA___AN_S:_ML__NW___ME_
call sub.ADVAPI32.dll_ConvertStringSecurityDescriptorToSecurityDescriptorW
test eax, eax
jne 0x694386
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.Failed_to_create_security_descriptor_from_string._Error___u_
push 0x86
push str.d:package_cachecasc1.4.58_srcdynamiccontainer_index.cpp
push 4
push str.casc
call fcn.007a784a
add esp, 0x18
xor al, al
jmp 0x694474
lea eax, [ebp - 0x28]
mov byte [ebp - 0x2c], 1
mov dword [ebp - 0x30], eax
mov ecx, dword [ebp + 0xc]
mov dword [ebp - 4], ebx
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x694399
sub ecx, edx
lea eax, [ecx*2 + 2]
call fcn.00721a30
mov eax, esp
lea ecx, [ebp - 0x11]
push dword [ebp + 0xc]
push eax
call fcn.0063a082
mov edi, dword [ebp + 8]
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x18], ebx
push eax
push ebx
lea eax, [ebp - 0x28]
push eax
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov dword [edi], eax
test eax, eax
jne 0x69440f
call esi
cmp eax, 5
jne 0x69445a
push dword [ebp - 0x1c]
push ebx
push 0x100000
call dword [sym.imp.KERNEL32.dll_OpenMutexW]
mov dword [edi], eax
test eax, eax
jne 0x69440f
call esi
cmp eax, 2
jne 0x694439
mov eax, dword [ebp - 0x18]
inc eax
mov dword [ebp - 0x18], eax
cmp eax, 5
mov eax, dword [ebp - 0x1c]
jb 0x6943cb
cmp dword [edi], ebx
jne 0x694467
call esi
push eax
push dword [ebp + 0xc]
push str.Exhausted_retries_creating_global_mutex._LockName___s__:_LastError___u_
push 0xae
push str.d:package_cachecasc1.4.58_srcdynamiccontainer_index.cpp
push 4
push str.casc
call fcn.007a784a
add esp, 0x1c
jmp 0x694469
push eax
push str.Failed_to_open_global_mutex._Error___u_
push 0xa6
push str.d:package_cachecasc1.4.58_srcdynamiccontainer_index.cpp
push 4
push str.casc
call fcn.007a784a
add esp, 0x18
jmp 0x694469
push eax
push str.Failed_to_create_global_mutex._Error___u_
push 0x9b
jmp 0x694444
mov bl, 1
push dword [ebp - 0x24]
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov al, bl
lea esp, [ebp - 0x40]
call fcn.007207e2
ret
Function at 0x695464
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
push 0x3d6be971
push 0x16
push esi
call fcn.006a3b49
add esp, 0xc
xor ecx, ecx
push 4
pop edi
mov byte [esi + ecx + 0x16], al
shr eax, 8
inc ecx
cmp ecx, edi
jb 0x695483
mov ebx, dword [ebp + 0xc]
push 0x1a
lea ecx, [ebx + 0x1e]
mov eax, ecx
and eax, 0xf
mov edx, dword [eax*4 + 0x873250]
xor edx, ecx
mov eax, edx
mov byte [ebp - 4], dl
shr eax, 8
mov byte [ebp - 3], al
mov eax, edx
shr eax, 0x10
shr edx, 0x18
mov byte [ebp - 2], al
xor eax, eax
mov byte [ebp - 1], dl
sub ebx, esi
mov edx, esi
mov dword [ebp + 0x10], eax
pop esi
mov al, byte [edx]
lea ecx, [ebx + edx]
and ecx, 3
xor byte [ebp + ecx + 0x10], al
inc edx
sub esi, 1
jne 0x6954c8
mov edx, dword [ebp + 8]
add edx, 0x1a
lea ecx, [edx + ebx]
and ecx, 3
mov al, byte [ebp + ecx + 0x10]
xor al, byte [ebp + ecx - 4]
mov byte [edx], al
inc edx
sub edi, 1
jne 0x6954e0
pop edi
pop esi
pop ebx
leave
ret

Function at 0x6954fb
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
mov edx, dword [ebp + 8]
xor eax, eax
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
mov esi, edi
push 0x1e
mov dword [ebp - 4], eax
sub esi, edx
pop ebx
mov al, byte [edx]
lea ecx, [esi + edx]
and ecx, 3
xor byte [ebp + ecx - 4], al
inc edx
sub ebx, 1
jne 0x695514
movzx ecx, byte [ebp - 1]
add edi, 0x1e
movzx eax, byte [ebp - 2]
shl ecx, 8
or ecx, eax
movzx eax, byte [ebp - 3]
shl ecx, 8
or ecx, eax
movzx eax, byte [ebp - 4]
shl ecx, 8
or ecx, eax
mov eax, edi
and eax, 0xf
mov eax, dword [eax*4 + 0x873250]
xor eax, edi
pop edi
cmp ecx, eax
pop esi
sete al
pop ebx
leave
ret

Function at 0x699df0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push esi
mov esi, dword [ebp + 8]
mov edx, ecx
movzx eax, byte [edx + esi]
xor ecx, eax
inc edx
cmp edx, 9
jb 0x699dfb
mov eax, ecx
shr eax, 4
xor eax, ecx
and eax, 0xf
pop esi
pop ebp
ret
Function at 0x699f29
Capabilities:
Check if file exists
Check mutex on windows

Disassembly:
push 0x24
mov eax, 0x7cf499
call fcn.00720838
xor ebx, ebx
mov dword [ebp - 0x28], 0xc
push ebx
lea eax, [ebp - 0x24]
mov dword [ebp - 0x20], ebx
push eax
push 1
push str.D:_A__GA___WD__A__GA___AN_S:_ML__NW___ME_
call sub.ADVAPI32.dll_ConvertStringSecurityDescriptorToSecurityDescriptorW
test eax, eax
jne 0x699f82
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.Failed_to_create_security_descriptor_from_string._Error___u_
push 0x87
push str.d:package_cachecasc1.4.58_src_residencycontainer_index.cpp
push 4
push str.casc
call fcn.007a784a
add esp, 0x18
xor al, al
jmp 0x69a070
lea eax, [ebp - 0x28]
mov byte [ebp - 0x2c], 1
mov dword [ebp - 0x30], eax
mov ecx, dword [ebp + 0xc]
mov dword [ebp - 4], ebx
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x699f95
sub ecx, edx
lea eax, [ecx*2 + 2]
call fcn.00721a30
mov eax, esp
lea ecx, [ebp - 0x11]
push dword [ebp + 0xc]
push eax
call fcn.0063a082
mov edi, dword [ebp + 8]
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x18], ebx
push eax
push ebx
lea eax, [ebp - 0x28]
push eax
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov dword [edi], eax
test eax, eax
jne 0x69a00b
call esi
cmp eax, 5
jne 0x69a056
push dword [ebp - 0x1c]
push ebx
push 0x100000
call dword [sym.imp.KERNEL32.dll_OpenMutexW]
mov dword [edi], eax
test eax, eax
jne 0x69a00b
call esi
cmp eax, 2
jne 0x69a035
mov eax, dword [ebp - 0x18]
inc eax
mov dword [ebp - 0x18], eax
cmp eax, 5
mov eax, dword [ebp - 0x1c]
jb 0x699fc7
cmp dword [edi], ebx
jne 0x69a063
call esi
push eax
push dword [ebp + 0xc]
push str.Exhausted_retries_creating_global_mutex._LockName___s__:_LastError___u_
push 0xaf
push str.d:package_cachecasc1.4.58_src_residencycontainer_index.cpp
push 4
push str.casc
call fcn.007a784a
add esp, 0x1c
jmp 0x69a065
push eax
push str.Failed_to_open_global_mutex._Error___u_
push 0xa7
push str.d:package_cachecasc1.4.58_src_residencycontainer_index.cpp
push 4
push str.casc
call fcn.007a784a
add esp, 0x18
jmp 0x69a065
push eax
push str.Failed_to_create_global_mutex._Error___u_
push 0x9c
jmp 0x69a040
mov bl, 1
push dword [ebp - 0x24]
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov al, bl
lea esp, [ebp - 0x40]
call fcn.007207e2
ret
Function at 0x6a2b21
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1350
call fcn.00721650
mov eax, dword [0x904fe8]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
mov edi, dword [ebp + 8]
lea eax, [ebp - 0x71c]
push 0x618
push 0
push eax
call fcn.00739c90
add esp, 0xc
lea eax, [ebp - 0x71c]
mov esi, 0x30c
push esi
push eax
push 0xffffffffffffffff
push edi
push 0
push 0xfde9
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
test eax, eax
je 0x6a2c54
push 0
lea eax, [ebp - 0xd34]
push eax
push esi
lea eax, [ebp - 0x71c]
push eax
call dword [sym.imp.KERNEL32.dll_GetFullPathNameW]
test eax, eax
je 0x6a2c38
cmp eax, esi
jae 0x6a2c38
push esi
lea eax, [ebp - 0x134c]
push eax
lea eax, [ebp - 0xd34]
push eax
call dword [sym.imp.KERNEL32.dll_GetVolumePathNameW]
test eax, eax
jne 0x6a2bff
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
lea eax, [ebp - 0x1350]
push eax
lea eax, [ebp - 0x104]
mov dword [ebp - 0x1350], esi
push eax
call fcn.0061b638
lea eax, [ebp - 0x104]
push eax
push esi
push edi
push str.Failed_to_get_volume_name_for_path__s._Error___u_:__s
push 0x25
push str.d:package_cachecasc1.4.58_srcdynamicdrive_type.win32.cpp
push 4
push str.casc
call fcn.007a784a
add esp, 0x28
jmp 0x6a2c54
lea eax, [ebp - 0x134c]
push eax
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
dec eax
sub eax, 1
je 0x6a2c34
sub eax, 1
je 0x6a2c2f
sub eax, 1
je 0x6a2c2a
sub eax, 1
je 0x6a2c34
sub eax, 1
jne 0x6a2c54
push 4
jmp 0x6a2c31
xor eax, eax
inc eax
jmp 0x6a2c56
push 2
pop eax
jmp 0x6a2c56
push 3
jmp 0x6a2c31
push edi
push str.Failed_to_get_full_path_name_for_path__s.
push 0x1a
push str.d:package_cachecasc1.4.58_srcdynamicdrive_type.win32.cpp
push 4
push str.casc
call fcn.007a784a
add esp, 0x18
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.007207bc
leave
ret
Function at 0x6aa2e6
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x728
mov eax, dword [0x904fe8]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
mov dword [ebp - 0x728], eax
xor esi, esi
mov eax, dword [ebp + 0x10]
xor edi, edi
mov dword [ebp - 0x720], eax
mov eax, dword [ebp + 0x14]
push 0x30c
mov dword [ebp - 0x724], eax
lea eax, [ebp - 0x71c]
push eax
push 0xffffffffffffffff
push ebx
push esi
push 0xfde9
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
test eax, eax
jne 0x6aa38a
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
lea eax, [ebp - 0x720]
push eax
lea eax, [ebp - 0x104]
mov dword [ebp - 0x720], esi
push eax
call fcn.0061b638
lea eax, [ebp - 0x104]
push eax
push esi
push ebx
push str.Failed_to_convert_path__s_to_wide_string._Error___u_:__s
push 0x74
push str.d:package_cachecasc1.4.58_srcdynamic_shmem_control.win32.cpp
push 4
push str.casc
call fcn.007a784a
xor eax, eax
add esp, 0x28
inc eax
jmp 0x6aa494
lea eax, [ebp - 0x71c]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push 0
push 0x100
push 1
push 0
push 3
push 0xc0000000
lea eax, [ebp - 0x71c]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov ecx, dword [ebp - 0x720]
mov dword [ecx], eax
cmp eax, 0xffffffff
jne 0x6aa419
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
cmp esi, 0x70
je 0x6aa414
push 0
push 0x100
push 3
push 0
push 3
push 0xc0000000
lea eax, [ebp - 0x71c]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov ecx, dword [ebp - 0x720]
mov dword [ecx], eax
cmp eax, 0xffffffff
jne 0x6aa422
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 0
mov esi, eax
call dword [sym.imp.KERNEL32.dll_Sleep]
inc edi
cmp edi, 0xa
jb 0x6aa397
jmp 0x6aa422
push 7
pop eax
jmp 0x6aa494
mov eax, dword [ebp - 0x724]
mov byte [eax], 1
mov eax, dword [ebp - 0x720]
cmp dword [eax], 0xffffffff
jne 0x6aa455
push esi
push ebx
push str.Failed_to_open_shmem_control_file__s._Error___u_
push 0xa8
push str.d:package_cachecasc1.4.58_srcdynamic_shmem_control.win32.cpp
push 4
push str.casc
call fcn.007a784a
push esi
call fcn.006aa6d4
add esp, 0x20
jmp 0x6aa494
test edi, edi
je 0x6aa492
push edi
push str.dynamic_container.shmem_ctrl.bind.retry_succeeded
lea eax, [ebp - 0x104]
push str._s._u
push eax
call fcn.006aa2ca
mov ecx, dword [ebp - 0x728]
lea eax, [ebp - 0x104]
add esp, 0xc
mov dword [esp], 0x3f800000
push 0
push 1
push eax
push 0
call fcn.0068b6dd
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.007207bc
leave
ret