joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10063d50
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0xc
push ebx
push esi
mov esi, ecx
push edi
mov dword [esp + 0x14], esi
mov al, byte [esi + 0x44]
test al, al
js 0x10063e5a
xor ebx, ebx
test al, al
jle 0x10063def
lea ecx, [esi + 0x78]
mov dword [esp + 0x10], ecx
nop word [eax + eax]
mov ecx, dword [ecx]
mov ecx, dword [ecx + 0x48]
test byte [ecx + 0x1c], 0x20
je 0x10063dd6
mov eax, dword [ecx + 0x14]
dec dword [eax + 0x78]
mov edx, dword [eax + 0x88]
mov dword [ecx + 0x10], edx
mov esi, dword [eax + 0x3c]
mov dword [eax + 0x88], ecx
push dword [ecx + 4]
mov eax, dword [eax + 0x98]
mov ecx, dword [ecx + 0x18]
mov edi, dword [esi]
dec ecx
cdq
push edx
push eax
push 0
push ecx
call fcn.1015d970
push edx
push eax
push esi
mov esi, dword [edi + 0x48]
mov ecx, esi
call dword [0x1019a4f8]
call esi
mov esi, dword [esp + 0x24]
add esp, 0x10
jmp 0x10063ddb
call fcn.10059aa0
mov ecx, dword [esp + 0x10]
inc ebx
movsx eax, byte [esi + 0x44]
add ecx, 4
mov dword [esp + 0x10], ecx
cmp ebx, eax
jl 0x10063d80
mov eax, dword [esi + 0x74]
mov edx, dword [eax + 0x48]
test byte [edx + 0x1c], 0x20
je 0x10063e4f
mov eax, dword [edx + 0x14]
dec dword [eax + 0x78]
mov ecx, dword [eax + 0x88]
mov dword [edx + 0x10], ecx
mov esi, dword [eax + 0x3c]
mov dword [eax + 0x88], edx
push dword [edx + 4]
mov ecx, dword [edx + 0x18]
mov eax, dword [eax + 0x98]
dec ecx
mov edi, dword [esi]
cdq
push edx
push eax
push 0
push ecx
call fcn.1015d970
push edx
push eax
push esi
mov esi, dword [edi + 0x48]
mov ecx, esi
call dword [0x1019a4f8]
call esi
mov esi, dword [esp + 0x24]
add esp, 0x10
mov byte [esi + 0x44], 0xff
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov ecx, edx
call fcn.10059aa0
mov byte [esi + 0x44], 0xff
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x100686c0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push ecx
push ebx
push esi
mov esi, ecx
mov dword [esp + 8], 0
push edi
mov al, byte [esi + 0x44]
test al, al
js 0x10068771
mov edx, dword [esi + 0x74]
je 0x100687ec
mov ecx, dword [edx + 0x48]
call fcn.1005f520
mov al, byte [esi + 0x44]
sub al, 1
mov byte [esi + 0x44], al
je 0x10068766
nop word [eax + eax]
movsx eax, al
mov eax, dword [esi + eax*4 + 0x78]
mov ecx, dword [eax + 0x48]
test byte [ecx + 0x1c], 0x20
je 0x10068757
mov edx, dword [ecx + 0x14]
dec dword [edx + 0x78]
mov eax, dword [edx + 0x88]
mov dword [ecx + 0x10], eax
mov edi, dword [edx + 0x3c]
mov eax, dword [edx + 0x98]
mov dword [edx + 0x88], ecx
push dword [ecx + 4]
mov ecx, dword [ecx + 0x18]
mov ebx, dword [edi]
dec ecx
cdq
push edx
push eax
push 0
push ecx
call fcn.1015d970
push edx
push eax
push edi
mov edi, dword [ebx + 0x48]
mov ecx, edi
call dword [0x1019a4f8]
call edi
add esp, 0x10
jmp 0x1006875c
call fcn.10059aa0
mov al, byte [esi + 0x44]
sub al, 1
mov byte [esi + 0x44], al
jne 0x10068700
mov edx, dword [esi + 0x78]
mov dword [esi + 0x74], edx
jmp 0x10068801
mov edx, dword [esi + 0x40]
test edx, edx
jne 0x10068787
mov byte [esi], 1
mov eax, 0x10
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov al, byte [esi]
cmp al, 3
jb 0x100687b3
cmp al, 4
jne 0x1006879b
mov eax, dword [esi + 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push dword [esi + 0x10]
call fcn.10050ca0
mov edx, dword [esi + 0x40]
add esp, 4
mov dword [esi + 0x10], 0
mov byte [esi], 1
movzx eax, byte [esi + 2]
lea edi, [esi + 0x74]
mov ecx, dword [esi + 8]
push eax
push 0
push edi
mov ecx, dword [ecx + 4]
call fcn.10065620
mov ecx, eax
add esp, 0xc
mov dword [esp + 0xc], ecx
test ecx, ecx
je 0x100687e0
mov byte [esi], 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov edx, dword [edi]
mov byte [esi + 0x44], 0
mov al, byte [edx + 2]
mov byte [esi + 0x45], al
cmp byte [edx], 0
je 0x10068860
movzx eax, byte [edx + 2]
xor ecx, ecx
cmp dword [esi + 0x70], ecx
sete cl
cmp ecx, eax
jne 0x10068860
and byte [esi + 1], 0xf1
xor eax, eax
mov word [esi + 0x46], ax
mov word [esi + 0x32], ax
cmp word [edx + 0x18], ax
jbe 0x10068822
mov byte [esi], al
mov eax, dword [esp + 0xc]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
cmp byte [edx + 8], al
jne 0x10068778
cmp dword [edx + 4], 1
je 0x10068842
mov ecx, 0x10fd7
call fcn.100df020
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
movzx ecx, byte [edx + 9]
mov eax, dword [edx + 0x38]
mov edx, dword [ecx + eax + 8]
mov ecx, esi
bswap edx
mov byte [esi], 0
call fcn.10068630
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 0x101d02b4
push 0x10fca
push str.database_corruption
push str._s_at_line__d_of___.10s_
push 0xb
call fcn.10053700
add esp, 0x14
mov eax, 0xb
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10069170
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push ecx
push ebx
push esi
mov esi, ecx
push edi
mov al, byte [esi]
test al, al
je 0x100691ae
cmp al, 3
jb 0x10069193
call fcn.100640a0
test eax, eax
jne 0x100692cf
mov al, byte [esi]
cmp al, 1
je 0x100692c1
cmp al, 2
jne 0x100691ae
cmp dword [esi + 4], 0
mov byte [esi], 0
jl 0x100692cd
mov edi, dword [esi + 0x74]
movzx eax, word [esi + 0x46]
mov ecx, eax
cmp byte [edi + 8], 0
jne 0x100691f6
mov eax, dword [edi + 0x40]
mov ax, word [eax + ecx*2]
mov ch, al
mov cl, ah
movzx eax, word [edi + 0x1a]
movzx edx, cx
mov ecx, esi
and edx, eax
mov eax, dword [edi + 0x38]
mov edx, dword [edx + eax]
bswap edx
call fcn.10068630
test eax, eax
jne 0x100692cf
mov ecx, esi
call fcn.10068950
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
test ax, ax
jne 0x10069299
nop
mov bl, byte [esi + 0x44]
test bl, bl
je 0x100692be
and byte [esi + 1], 0xf9
xor eax, eax
mov ecx, dword [esi + 0x74]
movsx edx, bl
dec bl
mov word [esi + 0x32], ax
mov ax, word [esi + edx*2 + 0x46]
mov word [esi + 0x46], ax
mov byte [esi + 0x44], bl
mov eax, dword [esi + edx*4 + 0x74]
mov dword [esi + 0x74], eax
mov edx, dword [ecx + 0x48]
test byte [edx + 0x1c], 0x20
je 0x10069280
mov eax, dword [edx + 0x14]
dec dword [eax + 0x78]
mov ecx, dword [eax + 0x88]
mov dword [edx + 0x10], ecx
mov edi, dword [eax + 0x3c]
mov dword [eax + 0x88], edx
push dword [edx + 4]
mov ecx, dword [edx + 0x18]
mov eax, dword [eax + 0x98]
dec ecx
mov ebx, dword [edi]
cdq
push edx
push eax
push 0
push ecx
call fcn.1015d970
push edx
push eax
push edi
mov edi, dword [ebx + 0x48]
mov ecx, edi
call dword [0x1019a4f8]
call edi
add esp, 0x10
jmp 0x10069287
mov ecx, edx
call fcn.10059aa0
movzx eax, word [esi + 0x46]
test ax, ax
je 0x10069200
mov edi, dword [esi + 0x74]
mov ecx, eax
lea eax, [ecx - 1]
mov word [esi + 0x46], ax
cmp byte [edi + 2], 0
je 0x100692cd
cmp byte [edi + 8], 0
jne 0x100692cd
push 0
push esi
call fcn.100692e0
add esp, 8
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov byte [esi], 1
mov eax, 0x65
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1006e140
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x14
push ebx
push esi
push edi
mov esi, edx
mov edi, ecx
xorps xmm0, xmm0
mov dword [esp + 0x1c], edi
mov ecx, esi
movlpd qword [esp + 0x10], xmm0
call fcn.100686c0
cmp eax, 0x10
jne 0x1006e182
mov eax, dword [ebp + 8]
mov dword [eax], 0
mov dword [eax + 4], 0
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
test eax, eax
jne 0x1006e2de
mov ecx, dword [esp + 0x10]
mov ebx, dword [esp + 0x14]
mov dword [esp + 0xc], ecx
nop word [eax + eax]
cmp dword [edi + 0x110], 0
jne 0x1006e2de
mov edi, dword [esi + 0x74]
mov cl, byte [edi + 8]
test cl, cl
jne 0x1006e1c0
cmp byte [edi + 2], cl
jne 0x1006e27e
movzx eax, word [edi + 0x18]
cdq
add dword [esp + 0xc], eax
adc ebx, edx
mov dword [esp + 0x10], ebx
test cl, cl
je 0x1006e27e
nop word [eax + eax]
mov dl, byte [esi + 0x44]
test dl, dl
je 0x1006e2c7
and byte [esi + 1], 0xf9
xor eax, eax
movsx ecx, dl
dec dl
mov word [esi + 0x32], ax
mov ax, word [esi + ecx*2 + 0x46]
mov word [esi + 0x46], ax
mov byte [esi + 0x44], dl
mov eax, dword [esi + ecx*4 + 0x74]
mov dword [esi + 0x74], eax
mov edx, dword [edi + 0x48]
test byte [edx + 0x1c], 0x20
je 0x1006e25d
mov eax, dword [edx + 0x14]
dec dword [eax + 0x78]
mov ecx, dword [eax + 0x88]
mov dword [edx + 0x10], ecx
mov edi, dword [eax + 0x3c]
mov dword [eax + 0x88], edx
push dword [edx + 4]
mov ecx, dword [edx + 0x18]
mov eax, dword [eax + 0x98]
dec ecx
mov ebx, dword [edi]
cdq
push edx
push eax
push 0
push ecx
call fcn.1015d970
push edx
push eax
push edi
mov edi, dword [ebx + 0x48]
mov ecx, edi
call dword [0x1019a4f8]
call edi
add esp, 0x10
jmp 0x1006e264
mov ecx, edx
call fcn.10059aa0
mov edi, dword [esi + 0x74]
movzx eax, word [esi + 0x46]
cmp ax, word [edi + 0x18]
jae 0x1006e1e0
mov ebx, dword [esp + 0x10]
inc eax
mov word [esi + 0x46], ax
movzx ecx, word [esi + 0x46]
movzx eax, word [edi + 0x18]
cmp ecx, eax
jne 0x1006e297
movzx ecx, byte [edi + 9]
mov eax, dword [edi + 0x38]
mov edx, dword [ecx + eax + 8]
jmp 0x1006e2b1
mov eax, dword [edi + 0x40]
mov ax, word [eax + ecx*2]
mov ch, al
mov cl, ah
movzx eax, word [edi + 0x1a]
movzx edx, cx
and edx, eax
mov eax, dword [edi + 0x38]
mov edx, dword [edx + eax]
bswap edx
mov ecx, esi
call fcn.10068630
test eax, eax
jne 0x1006e2de
mov edi, dword [esp + 0x1c]
jmp 0x1006e1a0
mov eax, dword [ebp + 8]
mov ecx, dword [esp + 0xc]
mov dword [eax], ecx
mov ecx, dword [esp + 0x10]
mov dword [eax + 4], ecx
mov ecx, esi
call fcn.100686c0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10082a20
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
mov eax, ecx
mov ebx, edx
push edi
push 0
push 0x14
mov dword [ebp - 4], eax
mov dword [eax], 0
call fcn.100509f0
mov esi, eax
add esp, 8
test esi, esi
jne 0x10082a52
lea eax, [esi + 7]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
cmp byte [0x101f6c3c], 0
je 0x10082aa4
mov edi, dword [0x101f6d2c]
test edi, edi
je 0x10082a7b
push 0xc8
mov ecx, edi
call dword [0x1019a4f8]
call edi
add esp, 4
test eax, eax
jne 0x10082aa4
mov edi, dword [ebp + 8]
lea eax, [esi + 4]
push eax
push 0
push esi
push 0x100539e0
push 0
push 0
mov dword [esi + 8], ebx
mov dword [esi + 0xc], edi
call fcn.1016d36c
add esp, 0x18
mov dword [esi], eax
test eax, eax
jne 0x10082ab4
jmp 0x10082aa7
mov edi, dword [ebp + 8]
xorps xmm0, xmm0
movups xmmword [esi], xmm0
mov dword [esi + 0x10], 0
cmp dword [esi + 8], 0
jne 0x10082ad4
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push edi
mov ecx, ebx
mov dword [esi + 4], eax
call dword [0x1019a4f8]
call ebx
add esp, 4
mov dword [esi + 0x10], eax
mov eax, dword [ebp - 4]
pop edi
mov dword [eax], esi
xor eax, eax
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x100909d0
Capabilities:
Reference sql statements

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push dword [ebp + 8]
mov edi, edx
mov ebx, ecx
push edi
push str.sqlite_master
push edi
push str.SELECT_1_FROM___w_._s_WHERE_name_NOT_LIKE_sqliteX____ESCAPE_X_AND_sql_NOT_LIKE_create_virtual___AND_sqlite_rename_test__Q__sql__type__name___d_NULL
push ebx
call fcn.10096380
add esp, 0x18
cmp dword [ebp + 8], 0
jne 0x10090a0b
push edi
push str.sqlite_master
push str.SELECT_1_FROM_temp._s_WHERE_name_NOT_LIKE_sqliteX____ESCAPE_X_AND_sql_NOT_LIKE_create_virtual___AND_sqlite_rename_test__Q__sql__type__name__1_NULL
push ebx
call fcn.10096380
add esp, 0x10
pop edi
pop ebx
pop ebp
ret

Function at 0x100969b0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, ecx
mov dword [ebp - 0xc], edx
push esi
xor edx, edx
mov dword [ebp - 0x10], eax
xor esi, esi
mov dword [ebp - 4], edx
push edi
mov edi, dword [ebp + 8]
cmp dword [eax + 0x14], edx
jle 0x10096a6d
push ebx
mov eax, dword [eax + 0x10]
mov ebx, esi
xor ebx, 1
cmp esi, 2
cmovge ebx, esi
mov ecx, ebx
add ecx, ecx
mov edx, dword [eax + ecx*8 + 0xc]
mov dword [ebp - 8], edx
test edi, edi
je 0x10096a32
mov eax, dword [eax + ecx*8]
sub edi, eax
movzx edx, byte [eax]
movzx ecx, byte [edi + eax]
cmp edx, ecx
jne 0x10096a08
test edx, edx
je 0x10096a32
inc eax
jmp 0x100969f6
movzx ecx, byte [ecx + 0x101b7250]
movzx edx, byte [edx + 0x101b7250]
sub edx, ecx
jne 0x10096a1d
inc eax
jmp 0x100969f6
test ebx, ebx
jne 0x10096a51
mov edx, dword [ebp + 8]
mov ecx, str.main
call fcn.100543b0
test eax, eax
jne 0x10096a51
mov ecx, dword [ebp - 8]
mov edx, dword [ebp - 0xc]
push 0
lea ecx, [ecx + 0x18]
call fcn.100558c0
add esp, 4
mov edx, dword [eax + 8]
mov dword [ebp - 4], edx
test edx, edx
jne 0x10096a64
jmp 0x10096a54
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 0x10]
inc esi
mov edi, dword [ebp + 8]
cmp esi, dword [eax + 0x14]
jl 0x100969d4
pop ebx
pop edi
mov eax, edx
pop esi
mov esp, ebp
pop ebp
ret
pop edi
mov eax, edx
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x100e0100
Capabilities:
Access peb ldr_data
Check for peb beingdebugged flag

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1019214c
mov eax, dword fs:[0]
push eax
sub esp, 8
push esi
push edi
mov eax, dword [0x101f62b4]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x10], edi
mov dword [ebp - 0x14], edi
xor eax, eax
mov word [edi], 0
mov byte [edi + 2], 0
mov dword [edi + 4], 0x20000
mov dword [edi + 0x18], 0
mov dword [edi + 0x1c], 7
mov word [edi + 8], ax
mov dword [ebp - 4], eax
mov dword [edi + 0x30], eax
mov dword [edi + 0x34], 7
mov word [edi + 0x20], ax
mov dword [edi + 0x48], eax
mov dword [edi + 0x4c], 7
mov word [edi + 0x38], ax
mov dword [edi + 0x60], eax
mov dword [edi + 0x64], 7
mov word [edi + 0x50], ax
mov byte [ebp - 4], 3
lea esi, [edi + 0x84]
mov dword [edi + 0x68], 0x200000
mov dword [edi + 0x6c], eax
mov dword [edi + 0x70], eax
mov dword [edi + 0x74], eax
mov dword [edi + 0x78], eax
mov dword [edi + 0x7c], eax
mov word [edi + 0x80], 0x100
push 0x40
mov dword [ebp - 0x10], esi
mov dword [esi], eax
mov dword [esi + 4], eax
call fcn.1015c7bb
add esp, 4
mov dword [eax], eax
mov dword [eax + 4], eax
mov dword [eax + 8], eax
mov word [eax + 0xc], 0x101
mov dword [esi], eax
mov eax, edi
mov byte [edi + 0x8c], 0
mov dword [edi + 0x90], 0x3c
mov word [edi + 0x94], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x100e16d0
Capabilities:
Clear file content

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
push edi
push 0
push 0x80
push 3
push 0
push 1
mov eax, ecx
mov ebx, edx
push 0x40000000
push eax
mov dword [ebp - 4], eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
cmp edi, 0xffffffff
jne 0x100e1756
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, dword [0x101fc34c]
mov dword [ebx], eax
test edi, edi
je 0x100e171b
cmp byte [0x101fc342], 0
jne 0x100e1726
call fcn.100e0200
mov edi, dword [0x101fc34c]
mov esi, dword [edi]
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, dword [esi + 0x24]
mov ecx, esi
push eax
push dword [ebp - 4]
push str.Failed_to_open_the_file_handle_at__s._Error___d_
push 0x101ace8c
push edi
call dword [0x1019a4f8]
call esi
add esp, 0x14
xor al, al
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [0x101fc34c]
test eax, eax
je 0x100e1768
cmp byte [0x101fc342], 0
jne 0x100e1772
call fcn.100e0200
mov eax, dword [0x101fc34c]
push dword [ebp + 0xc]
mov esi, dword [eax]
push dword [ebp + 8]
push str.file_size_to_which_we_have_to_extend_is__llu
mov esi, dword [esi + 4]
mov ecx, esi
push eax
call dword [0x1019a4f8]
call esi
add esp, 0x10
push 0
push 0
push dword [ebp + 0xc]
push dword [ebp + 8]
push edi
call dword [sym.imp.KERNEL32.dll_SetFilePointerEx]
test eax, eax
je 0x100e17fe
push edi
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
test eax, eax
je 0x100e17c2
push edi
mov bl, 1
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, bl
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebx], eax
mov ebx, dword [0x101fc34c]
test ebx, ebx
je 0x100e17dd
cmp byte [0x101fc342], 0
jne 0x100e17e8
call fcn.100e0200
mov ebx, dword [0x101fc34c]
mov esi, dword [ebx]
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push dword [ebp + 0xc]
push dword [ebp + 8]
push str.Failed_to_set_the_end_of_the_file_to_size__llu._Error____d
jmp 0x100e1838
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebx], eax
mov ebx, dword [0x101fc34c]
test ebx, ebx
je 0x100e1819
cmp byte [0x101fc342], 0
jne 0x100e1824
call fcn.100e0200
mov ebx, dword [0x101fc34c]
mov esi, dword [ebx]
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push dword [ebp + 0xc]
push dword [ebp + 8]
push str.Failed_to_resize_the_file_to_size__ld._Error____d
mov esi, dword [esi + 0x24]
mov ecx, esi
push 0x101ace8c
push ebx
call dword [0x1019a4f8]
call esi
add esp, 0x18
xor bl, bl
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
mov al, bl
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x100e1860
Capabilities:
Check if file exists
Delete file

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov ebx, ecx
mov esi, edx
push ebx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x100e18b5
mov edx, dword [0x101fc34c]
test edx, edx
je 0x100e1888
cmp byte [0x101fc342], al
jne 0x100e1893
call fcn.100e0200
mov edx, dword [0x101fc34c]
mov eax, dword [edx]
push ebx
push str.File_does_not_exist_at__s
push edx
mov esi, dword [eax + 4]
mov ecx, esi
call dword [0x1019a4f8]
call esi
add esp, 0xc
mov al, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push ebx
mov byte [ebp - 1], 0
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x100e18ac
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, dword [0x101fc34c]
mov dword [esi], eax
test edi, edi
je 0x100e18df
cmp byte [0x101fc342], 0
jne 0x100e18ea
call fcn.100e0200
mov edi, dword [0x101fc34c]
mov esi, dword [edi]
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, dword [esi + 4]
mov ecx, esi
push eax
push ebx
push str.Failed_to_delete_file_at_path:_ls_error:_d
push edi
call dword [0x1019a4f8]
call esi
mov al, byte [ebp - 1]
add esp, 0x10
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x100e1920
Capabilities:
Check if file exists

Disassembly:
push esi
mov esi, ecx
push esi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x100e1968
mov edx, dword [0x101fc34c]
test edx, edx
je 0x100e1940
cmp byte [0x101fc342], al
jne 0x100e194b
call fcn.100e0200
mov edx, dword [0x101fc34c]
mov eax, dword [edx]
push esi
push str.File_does_not_exist_at__s
push edx
mov esi, dword [eax + 4]
mov ecx, esi
call dword [0x1019a4f8]
call esi
add esp, 0xc
xor al, al
pop esi
ret
mov al, 1
pop esi
ret

Function at 0x100e1970
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, ecx
push edi
mov dword [ebp - 4], edi
call dword [sym.imp.SHLWAPI.dll_PathIsDirectoryW]
test eax, eax
je 0x100e19da
push edi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x100e19e3
mov edi, dword [0x101fc34c]
test edi, edi
je 0x100e19a8
cmp byte [0x101fc342], 0
jne 0x100e19b3
call fcn.100e0200
mov edi, dword [0x101fc34c]
mov esi, dword [edi]
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, dword [esi + 0x24]
mov ecx, esi
push eax
push dword [ebp - 4]
push str.Failed_to_get_the_directory_attributes_for____s._Error_is__d.
push 0x101ace8c
push edi
call dword [0x1019a4f8]
call esi
add esp, 0x14
xor al, al
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [0x101fc34c]
test eax, eax
je 0x100e19f5
cmp byte [0x101fc342], 0
jne 0x100e19ff
call fcn.100e0200
mov eax, dword [0x101fc34c]
mov esi, dword [eax]
push ebx
push edi
push str.The_file_attributes_of_directory____s_is__d
mov esi, dword [esi + 4]
mov ecx, esi
push eax
call dword [0x1019a4f8]
call esi
add esp, 0x10
shr ebx, 4
and bl, 1
mov al, bl
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x100e55d0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10192690
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x101f62b4]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, ecx
mov dword [ebp - 0x10], eax
push 8
mov dword [eax], vtable.std::basic_streambuf_wchar_t__struct_std::char_traits_wchar_t__.0
call fcn.1015c7bb
mov esi, eax
xorps xmm0, xmm0
movq qword [esi], xmm0
push 1
mov dword [ebp - 4], 0
call fcn.1015aca4
mov dword [esi + 4], eax
add esp, 8
mov eax, dword [ebp - 0x10]
lea edi, [eax + 0x14]
lea ecx, [eax + 0x18]
lea edx, [eax + 0x24]
mov dword [eax + 0x34], esi
lea ebx, [eax + 4]
mov dword [eax + 0xc], ebx
lea esi, [eax + 8]
mov dword [eax + 0x10], esi
mov dword [eax + 0x1c], edi
mov dword [eax + 0x20], ecx
mov dword [eax + 0x2c], edx
add eax, 0x28
mov dword [ebp - 0x14], ebx
mov ebx, dword [ebp - 0x10]
mov dword [ebx + 0x30], eax
mov ebx, dword [ebp - 0x14]
mov dword [esi], 0
mov dword [ecx], 0
mov dword [eax], 0
mov eax, dword [ebp - 0x10]
mov dword [ebx], 0
mov dword [edi], 0
mov dword [edx], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x100e7ec0
Capabilities:
Terminate thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1018d620
mov eax, dword fs:[0]
push eax
push ebx
push esi
push edi
mov eax, dword [0x101f62b4]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 4], 0
mov eax, dword [edi + 0x24]
mov dword [edi], vtable.WorkerThread.0
test eax, eax
je 0x100e7f5f
push 0xffffffffffffffff
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov ebx, eax
test ebx, ebx
je 0x100e7f4f
mov ecx, dword [0x101fc34c]
test ecx, ecx
je 0x100e7f1d
cmp byte [0x101fc342], 0
jne 0x100e7f28
call fcn.100e0200
mov ecx, dword [0x101fc34c]
mov esi, dword [ecx]
push ebx
push dword [edi + 0x38]
mov esi, dword [esi + 0x14]
push str.Forcing_the_thread___d__to_terminate_forcibly._Thread_seem_to_get_hanged._Error____d
push ecx
mov ecx, esi
call dword [0x1019a4f8]
call esi
add esp, 0x10
push 0
push dword [edi + 0x24]
call dword [sym.imp.KERNEL32.dll_TerminateThread]
push dword [edi + 0x24]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [edi + 0x24], 0
lea eax, [edi + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteCriticalSection]
push 0x3c
push edi
call fcn.1015cb05
add esp, 8
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4