joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1015f45
Capabilities:
Delete file
Get common file path

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x428
mov eax, dword [0x1049010]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
xor ebx, ebx
mov esi, 0x204
push esi
lea eax, [ebp - 0x208]
push ebx
push eax
mov dword [ebp - 0x424], ebx
mov dword [ebp - 0x20c], ebx
call sub.msvcrt.dll_memset
push esi
lea eax, [ebp - 0x410]
push ebx
push eax
mov dword [ebp - 0x414], ebx
call sub.msvcrt.dll_memset
add esp, 0x18
push edi
mov dword [ebp - 0x428], 0x104
mov dword [ebp - 0x41c], ebx
mov dword [ebp - 0x418], ebx
call fcn.01019699
cmp eax, 0xfeedf001
jne 0x1015fcc
mov esi, dword [ebp + 0xc]
cmp esi, ebx
je 0x1015fcc
push edi
call fcn.0101958b
cmp esi, eax
jbe 0x1015fdb
mov dword [ebp - 0x41c], 0x57
jmp 0x1016115
push ebx
push esi
push edi
call fcn.0101a142
mov dword [ebp - 0x418], eax
cmp eax, ebx
je 0x1016121
push edi
call fcn.010198f1
test eax, eax
jns 0x1016121
lea eax, [ebp - 0x428]
push eax
lea eax, [ebp - 0x414]
push eax
push edi
call fcn.0101aca2
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x10160de
xor eax, eax
cmp ax, word [ebp - 0x414]
je 0x10160de
lea eax, [ebp - 0x20c]
push eax
push ebx
push 0x10026b0
lea eax, [ebp - 0x414]
push eax
call dword [sym.imp.KERNEL32.dll_GetTempFileNameW]
test eax, eax
je 0x10160de
or dword [ebp - 0x420], 0xffffffff
lea eax, [ebp - 0x420]
push eax
lea eax, [ebp - 0x20c]
push eax
push esi
push dword [ebp - 0x418]
call fcn.0101e491
test eax, eax
je 0x10160b2
push dword [ebp - 0x420]
push dword [ebp - 0x418]
call fcn.0101f98b
mov esi, eax
mov dword [ebp - 0x424], esi
cmp esi, ebx
je 0x10160b2
push esi
push dword [ebp - 0x418]
call fcn.010199da
test eax, eax
jne 0x10160ba
push esi
call fcn.0101ef07
mov dword [ebp - 0x424], ebx
jmp 0x10160ba
call edi
mov dword [ebp - 0x41c], eax
cmp dword [ebp - 0x420], 0xffffffff
je 0x10160cf
push dword [ebp - 0x420]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
jmp 0x10160e8
mov dword [ebp - 0x41c], 0x660
cmp dword [ebp - 0x424], ebx
jne 0x101610d
push dword [ebp - 0x418]
call fcn.0101abff
test eax, eax
jne 0x1016107
call edi
mov dword [ebp - 0x41c], eax
mov dword [ebp - 0x418], ebx
cmp dword [ebp - 0x41c], ebx
je 0x1016121
push dword [ebp - 0x41c]
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x418]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.01010796
leave
ret 8
Function at 0x101630b
Capabilities:
Set file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x34
push edi
push 0xa
pop ecx
xor eax, eax
lea edi, [ebp - 0x34]
rep stosd dword es:[edi], eax
mov dword [ebp - 4], 0x8000ffff
pop edi
test edx, edx
je 0x1016339
and edx, 0x3127
or edx, 0x80
mov dword [ebp - 0x14], edx
test esi, esi
je 0x1016348
mov eax, dword [esi]
mov dword [ebp - 0x34], eax
mov eax, dword [esi + 4]
mov dword [ebp - 0x30], eax
test ebx, ebx
je 0x1016357
mov eax, dword [ebx]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebx + 4]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp + 0xc]
test eax, eax
je 0x1016369
mov ecx, dword [eax]
mov eax, dword [eax + 4]
mov dword [ebp - 0x24], ecx
mov dword [ebp - 0x20], eax
push 4
push 0x28
lea eax, [ebp - 0x34]
push eax
lea eax, [ebp - 0xc]
push eax
push dword [ebp + 8]
call dword [sym.imp.ntdll.dll_NtSetInformationFile]
test eax, eax
jge 0x1016389
cmp eax, 0xc000000d
jne 0x101638d
and dword [ebp - 4], 0
mov eax, dword [ebp - 4]
leave
ret 8
Function at 0x1016653
Capabilities:
Set file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
mov eax, dword [ebp + 0x10]
push ebx
push esi
mov esi, dword [eax + 0x4c]
push edi
xor edi, edi
xor ebx, ebx
cmp esi, edi
je 0x101679a
push edi
push dword [ebp + 8]
call fcn.01015eca
test eax, 0x40000
je 0x101679a
push 0x80
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
cmp esi, edi
je 0x1016787
mov dword [ebp - 4], edi
mov eax, dword [esi]
mov dword [ebp - 8], edi
cmp word [eax], di
je 0x10166c0
push eax
push dword [ebp + 0xc]
lea eax, [ebp - 4]
push 0x1002818
push eax
call fcn.0101160d
add esp, 0x10
mov dword [ebp + 0x14], edi
jmp 0x10166e1
cmp dword [ebp + 0x14], edi
je 0x10166e3
mov eax, dword [ebp + 0x14]
cmp dword [eax], 0xffffffff
je 0x10166e3
push dword [ebp + 0xc]
lea eax, [ebp - 4]
push 0x1002810
push eax
call fcn.0101160d
add esp, 0xc
mov ebx, eax
cmp ebx, edi
jl 0x1016749
cmp dword [ebp - 4], edi
je 0x1016712
push edi
push dword [ebp - 4]
call fcn.0101509b
mov dword [ebp - 8], eax
cmp eax, edi
jne 0x1016712
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, edi
jle 0x1016710
and eax, 0xffff
or eax, 0x80070000
mov ebx, eax
cmp ebx, edi
jl 0x1016749
cmp dword [ebp - 8], edi
je 0x1016749
push edi
push dword [ebp + 0x14]
lea eax, [esi + 0x10]
push edi
push dword [ebp - 8]
push eax
push dword [ebp + 8]
call fcn.0101e358
test eax, eax
jne 0x1016749
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, edi
jle 0x1016747
and eax, 0xffff
or eax, 0x80070000
mov ebx, eax
cmp dword [ebp - 4], edi
je 0x1016766
push dword [ebp - 4]
push edi
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
test eax, eax
je 0x1016766
mov dword [ebp - 4], edi
cmp dword [ebp - 8], edi
je 0x101677c
push dword [ebp - 8]
push edi
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
cmp ebx, edi
mov esi, dword [esi + 0x24]
jge 0x1016691
mov eax, dword [ebp + 0x10]
push dword [eax + 0x10]
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
mov eax, ebx
jmp 0x101679c
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret 0x10
Function at 0x1016a9a
Capabilities:
Check if file exists
Get file attributes
Set file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x10
push edi
push dword [ebp + 0x14]
xor eax, eax
mov word [ebp - 8], ax
lea edi, [ebp - 6]
stosd dword es:[edi], eax
stosw word es:[edi], ax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x1016ac5
push dword [ebp + 0x14]
call fcn.010153f7
xor edi, edi
push edi
push edi
lea eax, [ebp - 8]
push eax
push dword [ebp + 0x14]
call dword [sym.imp.ntdll.dll_RtlDosPathNameToNtPathName_U]
test al, al
je 0x1016bc8
movzx eax, word [ebp - 8]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push esi
add eax, 0x10
push eax
push 8
call ebx
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov esi, eax
cmp esi, edi
je 0x1016b7a
mov dword [ebp - 0x10], edi
xor eax, eax
lea edi, [ebp - 0xc]
stosd dword es:[edi], eax
movzx eax, word [ebp - 8]
push eax
push dword [ebp - 4]
lea eax, [esi + 0xc]
push eax
call dword [sym.imp.msvcrt.dll_memmove]
mov byte [esi], 0
xor edi, edi
mov dword [esi + 4], edi
movzx eax, word [ebp - 8]
mov dword [esi + 8], eax
movzx eax, word [ebp - 8]
add esp, 0xc
push 0xb
add eax, 0x10
push eax
push esi
lea eax, [ebp - 0x10]
push eax
push dword [ebp + 0x10]
call dword [sym.imp.ntdll.dll_NtSetInformationFile]
cmp eax, edi
jge 0x1016b6c
push 0x13f5
push 0x10028b8
or eax, 0x10000000
mov edi, eax
push edi
push 0x1002888
push dword [ebp + 0xc]
push dword [ebp + 8]
push 1
call fcn.01015538
push esi
push 0
call ebx
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
jmp 0x1016bad
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, edi
jle 0x1016b8e
and eax, 0xffff
or eax, 0x80070000
push 0x13ff
push 0x10028b8
mov edi, eax
push edi
push 0x100286c
push dword [ebp + 0x14]
push dword [ebp + 8]
push 1
call fcn.01015538
push dword [ebp - 4]
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
push 0
push dword [eax + 0x18]
call dword [sym.imp.ntdll.dll_RtlFreeHeap]
pop esi
pop ebx
jmp 0x1016bec
push 0x1409
push 0x10028b8
mov eax, 0x80070003
push eax
push 0x1002828
push dword [ebp + 0x14]
mov edi, eax
push dword [ebp + 8]
push 1
call fcn.01015538
test edi, edi
jl 0x1016bf4
xor eax, eax
jmp 0x1016bf6
mov eax, edi
pop edi
leave
ret 0x10
Function at 0x101828a
Capabilities:
Delete file

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
mov ebx, eax
xor eax, eax
push esi
push edi
mov dword [ebp - 4], eax
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0xc]
push eax
push dword [ebp + 8]
call fcn.0101965b
mov eax, dword [ebx]
mov esi, dword [eax + 0x10]
mov edi, esi
and edi, 0x400
je 0x10182ce
test byte [ebp - 8], 0x80
jne 0x10182ce
xor eax, eax
jmp 0x1018414
and esi, 0x4000
mov dword [ebp - 0x10], esi
je 0x10182e2
test dword [ebp - 8], 0x20000
je 0x10182c7
test byte [ebx + 0x20], 2
jne 0x1018397
lea esi, [ebx + 4]
mov ecx, dword [esi]
cmp ecx, 0xffffffff
je 0x1018343
test dword [ebp - 0xc], 0x1000000
je 0x101830d
test edi, edi
jne 0x101830d
mov edx, dword [ebp + 8]
call fcn.01016c00
jmp 0x101833f
push 1
push dword [ebx + 8]
add eax, 0x14
push ecx
push eax
push dword [ebp + 8]
call fcn.0101e405
test eax, eax
je 0x101832b
or dword [ebx + 0x20], 2
xor esi, esi
jmp 0x101839d
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jle 0x101833f
and eax, 0xffff
or eax, 0x80070000
mov esi, eax
jmp 0x1018399
test edi, edi
jne 0x101834c
cmp dword [ebp - 0x10], edi
je 0x1018367
push dword [ebp + 8]
call fcn.0101a106
push eax
call fcn.0101fcf0
mov dword [ebp - 4], eax
test eax, eax
jne 0x1018393
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov eax, dword [ebx]
mov ecx, dword [eax + 8]
mov eax, dword [ebp - 4]
test eax, eax
jne 0x1018376
mov eax, dword [ebx + 8]
push 1
push esi
push ecx
push eax
mov eax, dword [ebx]
add eax, 0x14
push eax
push dword [ebp + 8]
call fcn.0101e358
test eax, eax
je 0x101832b
or dword [ebx + 0x20], 3
jmp 0x1018327
xor ecx, ecx
jmp 0x101836c
xor esi, esi
test esi, esi
jl 0x10183f1
cmp dword [ebp + 0xc], 0
je 0x10183f1
cmp dword [ebp - 0x10], 0
je 0x10183bc
push dword [ebx + 8]
lea eax, [ebx + 4]
push eax
push dword [ebp + 8]
mov eax, dword [ebx]
call fcn.01016851
jmp 0x10183d1
test edi, edi
je 0x10183d3
push dword [ebx]
lea eax, [ebx + 4]
push dword [ebx + 8]
push eax
push dword [ebp + 8]
call fcn.01017a1b
mov esi, eax
test esi, esi
jl 0x10183f1
mov eax, dword [ebx]
cmp dword [eax + 0x4c], 0
je 0x10183f1
lea ecx, [ebx + 4]
push ecx
push eax
push dword [ebx + 8]
push dword [ebp + 8]
call fcn.01016653
mov esi, eax
cmp dword [ebp - 4], 0
je 0x1018412
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push dword [ebp - 4]
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov eax, esi
pop edi
pop esi
pop ebx
leave
ret 8
Function at 0x1018ad0
Capabilities:
Create thread

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push esi
push edi
push 0x30
xor edi, edi
push 8
mov dword [ebp - 4], edi
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov esi, eax
cmp esi, edi
jne 0x1018b11
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, edi
jle 0x1018c6b
and eax, 0xffff
or eax, 0x80070000
jmp 0x1018c6b
mov eax, dword [ebp + 8]
push ebx
lea ecx, [esi + 0x28]
push ecx
lea ecx, [esi + 0x24]
push ecx
push eax
mov dword [esi], eax
call fcn.0101965b
mov eax, dword [ebp + 0xc]
cmp eax, 1
jbe 0x1018c4f
mov dword [esi + 0x2c], eax
lea eax, [esi + 4]
push eax
push edi
push 0x40
lea eax, [esi + 0x10]
push eax
call fcn.01015896
cmp eax, edi
mov dword [ebp - 4], eax
jl 0x1018c5f
lea eax, [esi + 0x14]
push eax
push edi
push 0x100
lea eax, [esi + 0x20]
push eax
call fcn.01015896
cmp eax, edi
mov dword [ebp - 4], eax
jl 0x1018c5f
mov ebx, dword [sym.imp.KERNEL32.dll_CreateEventW]
push edi
push edi
push 1
push edi
call ebx
mov dword [esi + 0x18], eax
cmp eax, edi
jne 0x1018b98
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, edi
jle 0x1018b95
and eax, 0xffff
or eax, 0x80070000
mov dword [ebp - 4], eax
cmp dword [ebp - 4], edi
jl 0x1018c5f
push edi
push edi
push 1
push edi
call ebx
mov dword [esi + 8], eax
cmp eax, edi
jne 0x1018bc6
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, edi
jle 0x1018bc3
and eax, 0xffff
or eax, 0x80070000
mov dword [ebp - 4], eax
cmp dword [ebp - 4], edi
jl 0x1018c5f
push edi
push edi
push esi
push 0x1018604
push edi
push edi
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [esi + 0x1c], eax
cmp eax, edi
jne 0x1018bfd
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, edi
jle 0x1018bfa
and eax, 0xffff
or eax, 0x80070000
mov dword [ebp - 4], eax
cmp dword [ebp - 4], edi
jl 0x1018c5f
push edi
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov ebx, dword [sym.imp.KERNEL32.dll_SetThreadIdealProcessor]
push eax
call ebx
mov eax, dword [ebp + 0xc]
dec eax
push eax
push dword [esi + 0x1c]
call ebx
push edi
push edi
push esi
push 0x10184cb
push edi
push edi
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [esi + 0xc], eax
cmp eax, edi
jne 0x1018c4a
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, edi
jle 0x1018c47
and eax, 0xffff
or eax, 0x80070000
mov dword [ebp - 4], eax
cmp dword [ebp - 4], edi
jl 0x1018c5f
mov eax, dword [ebp + 0x10]
push esi
push dword [ebp + 8]
mov dword [eax], esi
call fcn.01019857
jmp 0x1018c67
push dword [ebp + 8]
call fcn.01016169
mov eax, dword [ebp - 4]
pop ebx
pop edi
pop esi
leave
ret 0xc
Function at 0x101bef5
Capabilities:
Get file size
Write file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x10
push esi
xor esi, esi
mov dword [ebp - 4], esi
mov dword [ebp - 8], esi
cmp dword [ebp + 8], esi
je 0x101c0d5
cmp dword [ebp + 0x14], esi
jne 0x101bf1e
cmp dword [ebp + 0xc], 0xffffffff
je 0x101c0d5
push ebx
push edi
mov ebx, 0x80070000
cmp dword [ebp + 0x10], esi
je 0x101bfe8
push dword [ebp + 0x10]
call fcn.0101987a
test al, 8
jne 0x101bfe8
push dword [ebp + 0x10]
call fcn.0101a345
mov ecx, eax
xor eax, eax
and dword [ebp + 0x10], eax
mov dword [ebp - 0x10], esi
lea edi, [ebp - 0xc]
stosd dword es:[edi], eax
lea eax, [ebp - 0x10]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
jne 0x101bf95
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
call esi
mov edi, 0xffff
test eax, eax
jle 0x101bf7a
and eax, edi
or eax, ebx
test eax, eax
jge 0x101bf8a
call esi
test eax, eax
jle 0x101bf86
and eax, edi
or eax, ebx
mov esi, eax
jmp 0x101bf8f
mov esi, 0x80004005
test esi, esi
jl 0x101bfce
jmp 0x101bf9a
mov edi, 0xffff
push dword [ebp - 0xc]
lea eax, [ebp + 0x10]
push dword [ebp - 0x10]
push 0x1003358
push eax
call fcn.0101160d
mov esi, eax
add esp, 0x10
test esi, esi
jl 0x101bfce
push dword [ebp + 0x10]
push 0
push 0x1003364
push dword [ebp + 8]
call fcn.0102c491
add esp, 0x10
mov esi, eax
cmp dword [ebp + 0x10], 0
je 0x101bfed
push dword [ebp + 0x10]
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
jmp 0x101bfed
mov edi, 0xffff
test esi, esi
jl 0x101c0a4
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 4]
push eax
push dword [ebp + 8]
call fcn.0102be5a
mov esi, eax
test esi, esi
jl 0x101c0a4
mov eax, dword [ebp - 4]
lea edx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
test cx, cx
jne 0x101c015
sub eax, edx
sar eax, 1
cmp dword [ebp + 0xc], 0xffffffff
lea esi, [eax + eax + 2]
jne 0x101c056
push esi
push 0x40
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov ecx, dword [ebp + 0x14]
mov dword [ecx], eax
test eax, eax
je 0x101c07d
push esi
push dword [ebp - 4]
push eax
call sub.msvcrt.dll_memcpy
mov eax, dword [ebp + 0x18]
add esp, 0xc
add esi, 0xfffffffe
mov dword [eax], esi
jmp 0x101c079
and dword [ebp + 0x10], 0
push 0
lea eax, [ebp + 0x10]
push eax
add esi, 0xfffffffe
push esi
push dword [ebp - 4]
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x101c07d
cmp dword [ebp + 0x10], esi
jne 0x101c07d
xor esi, esi
jmp 0x101c0a4
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
call esi
test eax, eax
jle 0x101c08f
and eax, edi
or eax, ebx
test eax, eax
jge 0x101c09f
call esi
test eax, eax
jle 0x101c09b
and eax, edi
or eax, ebx
mov esi, eax
jmp 0x101c0a4
mov esi, 0x80004005
cmp dword [ebp - 4], 0
pop edi
pop ebx
je 0x101c0c6
push dword [ebp - 4]
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
test eax, eax
je 0x101c0c6
and dword [ebp - 4], 0
push esi
call fcn.0101b6b1
xor eax, eax
test esi, esi
setge al
jmp 0x101c0df
push 0x57
call dword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
pop esi
leave
ret 0x14
Function at 0x101c0e9
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
push edi
lea eax, [ebp - 4]
push eax
push dword [ebp + 0x20]
xor edi, edi
push dword [ebp + 0x1c]
mov dword [ebp - 8], edi
mov dword [ebp - 4], edi
mov dword [ebp - 0xc], edi
call fcn.01011101
cmp dword [ebp + 8], edi
je 0x101c246
mov ebx, dword [ebp + 0xc]
cmp dword [ebp + 0x10], edi
jne 0x101c128
cmp ebx, 0xffffffff
je 0x101c246
cmp eax, edi
jl 0x101c246
cmp dword [ebp + 0x1c], edi
jne 0x101c13e
cmp dword [ebp + 0x20], edi
je 0x101c246
push dword [ebp + 8]
call fcn.010199fa
mov esi, eax
mov dword [ebp + 0xc], esi
cmp esi, edi
je 0x101c246
push esi
call fcn.0102be93
cmp ebx, 0xffffffff
jne 0x101c167
push dword [ebp - 4]
push dword [ebp + 0x10]
push esi
jmp 0x101c1bd
mov eax, dword [ebp + 0x18]
mov dword [ebp + 8], edi
mov edi, dword [ebp - 4]
push edi
push 8
mov dword [ebp + 0x10], eax
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov esi, eax
mov dword [ebp - 8], esi
test esi, esi
je 0x101c1c4
push 0
lea eax, [ebp + 0x10]
push eax
push dword [ebp + 0x14]
push ebx
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
test eax, eax
je 0x101c1c4
push 0
lea eax, [ebp + 8]
push eax
push edi
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x101c1c4
cmp dword [ebp + 8], edi
jne 0x101c1c4
push edi
push esi
push dword [ebp + 0xc]
call fcn.0102bde3
jmp 0x101c1ec
mov ebx, dword [sym.imp.KERNEL32.dll_GetLastError]
call ebx
mov edi, 0xffff
mov esi, 0x80070000
test eax, eax
jle 0x101c1e0
and eax, edi
or eax, esi
test eax, eax
jge 0x101c1f0
call ebx
test eax, eax
jle 0x101c1ec
and eax, edi
or eax, esi
mov esi, eax
jmp 0x101c1f5
mov esi, 0x80004005
test esi, esi
jl 0x101c21f
lea eax, [ebp - 0xc]
push eax
push 0x1003384
push dword [ebp + 0xc]
call fcn.0102c4b2
mov esi, eax
add esp, 0xc
test esi, esi
jl 0x101c21f
mov eax, dword [ebp + 0x24]
test eax, eax
je 0x101c21f
mov ecx, dword [ebp - 0xc]
mov dword [eax], ecx
cmp dword [ebp - 8], 0
je 0x101c237
push dword [ebp - 8]
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
push esi
call fcn.0101b6b1
xor eax, eax
test esi, esi
setge al
jmp 0x101c250
push 0x57
call dword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret 0x20
Function at 0x101de9f
Capabilities:
Get file size

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x34
mov eax, dword [0x1049010]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
xor ebx, ebx
xor eax, eax
push esi
push edi
mov esi, dword [ebp + 8]
mov byte [ebp - 0x18], bl
lea edi, [ebp - 0x17]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
xor eax, eax
lea edi, [ebp - 0x24]
mov dword [ebp - 0x28], ebx
mov dword [ebp - 0x20], ecx
mov dword [ebp - 0x34], edx
mov dword [ebp - 0x1c], ebx
stosd dword es:[edi], eax
mov dword [ebp - 0x2c], ebx
mov dword [ebp - 0x30], ebx
cmp ecx, ebx
je 0x101dfe4
cmp edx, 0xffffffff
je 0x101dfe4
cmp esi, ebx
je 0x101dfe4
cmp word [esi], bx
je 0x101dfe4
cmp dword [ebp + 0xc], ebx
je 0x101dfe4
lea eax, [ebp - 0x28]
push eax
push edx
call dword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
je 0x101df30
mov eax, dword [ebp + 0x10]
mov edi, dword [ebp - 0x28]
cmp eax, ebx
je 0x101df57
cmp edi, dword [eax]
jne 0x101df30
mov ecx, dword [ebp - 0x24]
cmp ecx, dword [eax + 4]
je 0x101df57
push 0xd
pop edi
push 0x1017
push 0x10034f0
push 0x8007000d
push 0x10034a0
push esi
push dword [ebp - 0x20]
push 1
call fcn.01015538
jmp 0x101dfd8
push 0x14
push dword [ebp + 0xc]
mov dword [ebp - 0x1c], ebx
call fcn.01015632
test eax, eax
je 0x101df7a
cmp edi, ebx
jne 0x101df7a
cmp dword [ebp - 0x24], ebx
jne 0x101df7a
mov dword [ebp - 0x1c], 1
jmp 0x101dfdf
push ebx
push ebx
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 0x2c]
push eax
push dword [ebp - 0x20]
call fcn.01019cd7
test eax, eax
je 0x101dfd3
push dword [ebp - 0x30]
lea eax, [ebp - 0x18]
push dword [ebp - 0x2c]
push eax
push dword [0x1049a84]
push dword [0x1049a80]
push dword [ebp - 0x24]
push dword [ebp - 0x28]
push dword [ebp - 0x34]
push dword [ebp - 0x20]
call fcn.0101fea4
test eax, eax
je 0x101dfd3
mov esi, dword [ebp + 0xc]
push 0x14
pop ecx
lea edi, [ebp - 0x18]
xor eax, eax
repe cmpsb byte [esi], byte es:[edi]
je 0x101dfcf
sbb eax, eax
sbb eax, 0xffffffff
cmp eax, ebx
je 0x101df71
mov edi, 0x241
push edi
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, dword [ebp - 0x1c]
jmp 0x101dfee
push 0x57
call dword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.01010796
leave
ret 0xc
Function at 0x101eaa7
Capabilities:
Get file size

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x18
push esi
push edi
push dword [ebp + 8]
xor edi, edi
mov dword [ebp - 0xc], edi
call fcn.0101a106
mov esi, eax
mov dword [ebp - 8], edi
cmp esi, edi
jne 0x101eace
xor eax, eax
jmp 0x101ebdc
push esi
call fcn.01019755
test al, 1
jne 0x101ebd9
test al, 2
je 0x101ebd9
push ebx
lea eax, [ebp - 4]
push eax
push esi
call fcn.0101fda6
mov ebx, eax
cmp ebx, 0xffffffff
je 0x101ebd3
push dword [esi + 0x10]
push dword [esi + 8]
push dword [esi + 0x1bc]
push ebx
call fcn.01021f8c
mov dword [ebp - 0xc], eax
cmp eax, edi
je 0x101eb98
mov dword [ebp - 0x18], edi
xor eax, eax
lea edi, [ebp - 0x14]
stosd dword es:[edi], eax
lea eax, [ebp - 0x18]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetFileSizeEx]
push esi
call fcn.01019755
mov ecx, dword [ebp - 4]
xor edi, edi
push edi
push 0x40
mov dword [ebp - 0x10], eax
lea eax, [esi + 0x48]
push eax
push edi
push 2
push dword [ebp + 8]
mov edx, ebx
call fcn.0101e7d5
mov dword [ebp - 0xc], eax
cmp eax, edi
je 0x101eb6d
push esi
call fcn.01019755
test al, 2
je 0x101eb76
test byte [ebp - 0x10], 2
jne 0x101eb76
and dword [esi + 0x190], 0xfffffffd
jmp 0x101eb76
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 8], eax
push edi
push edi
push dword [esi + 0x1dc]
push dword [esi + 0x1d8]
push dword [esi + 4]
call fcn.0101a018
push dword [esi + 4]
call fcn.0101a0d0
xor edi, edi
jmp 0x101eba1
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 8], eax
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 4], edi
je 0x101ebc5
push dword [ebp - 4]
push edi
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
test eax, eax
je 0x101ebc5
mov dword [ebp - 4], edi
cmp dword [ebp - 8], edi
je 0x101ebd3
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, dword [ebp - 0xc]
pop ebx
jmp 0x101ebdc
xor eax, eax
inc eax
pop edi
pop esi
leave
ret 4