joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1009be10
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10160538
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push ebx
push esi
mov eax, dword [0x10438fc0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
xor ebx, ebx
mov dword [esi + 8], 8
mov dword [esi + 0xc], ebx
mov byte [esi + 0x10], bl
mov dword [esi + 0x18], ebx
mov dword [ebp - 4], ebx
mov dword [esi], vtable.SqlNodeColumns.0
mov dword [esi + 0x28], ebx
mov dword [esi + 0x2c], ebx
mov byte [esi + 0x30], 1
mov dword [esi + 0x20], ebx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push 0x40
push ebx
push eax
mov dword [esi + 0x20], eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov dword [esi + 0x24], eax
cmp eax, ebx
je 0x1009be98
mov dword [esi + 0x2c], 0x10
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
push 1
lea eax, [ebp - 0x10]
push eax
lea ecx, [ebp - 0x1c]
mov dword [ebp - 0x10], str.bad_allocation
call dword [sym.imp.MSVCR100.dll_public:_void___thiscall_std::exception::constructor_char_const__const_const___int_]
push 0x104241f4
lea ecx, [ebp - 0x1c]
push ecx
mov dword [ebp - 0x1c], vtable.std::bad_alloc.0
call sub.MSVCR100.dll__CxxThrowException
int3

Function at 0x1009d760
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10160538
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push ebx
push esi
mov eax, dword [0x10438fc0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
xor ebx, ebx
mov dword [esi + 8], 0x17
mov dword [esi + 0xc], ebx
mov byte [esi + 0x10], bl
mov dword [esi + 0x18], ebx
mov dword [ebp - 4], ebx
mov dword [esi], vtable.SqlNodeSelectList.0
mov dword [esi + 0x28], ebx
mov dword [esi + 0x2c], ebx
mov byte [esi + 0x30], 1
mov dword [esi + 0x20], ebx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push 0x40
push ebx
push eax
mov dword [esi + 0x20], eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov dword [esi + 0x24], eax
cmp eax, ebx
je 0x1009d7eb
mov dword [esi + 0x2c], 0x10
mov byte [esi + 0x34], bl
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
push 1
lea eax, [ebp - 0x10]
push eax
lea ecx, [ebp - 0x1c]
mov dword [ebp - 0x10], str.bad_allocation
call dword [sym.imp.MSVCR100.dll_public:_void___thiscall_std::exception::constructor_char_const__const_const___int_]
push 0x104241f4
lea ecx, [ebp - 0x1c]
push ecx
mov dword [ebp - 0x1c], vtable.std::bad_alloc.0
call sub.MSVCR100.dll__CxxThrowException
int3
Function at 0x1009dd40
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x101604e3
mov eax, dword fs:[0]
push eax
sub esp, 0x20
push ebx
push esi
push edi
mov eax, dword [0x10438fc0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
xor ebx, ebx
mov dword [esi + 8], 0x10
mov dword [esi + 0xc], ebx
mov byte [esi + 0x10], bl
mov dword [esi + 0x18], ebx
mov dword [ebp - 4], ebx
mov edi, dword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov dword [esi], vtable.SqlNodeTables.0
mov dword [esi + 0x28], ebx
mov dword [esi + 0x2c], ebx
mov byte [esi + 0x30], 1
mov dword [esi + 0x20], ebx
call edi
push 0x40
push ebx
push eax
mov dword [esi + 0x20], eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov dword [esi + 0x24], eax
cmp eax, ebx
je 0x1009de25
mov dword [esi + 0x2c], 0x10
mov byte [ebp - 4], 1
mov dword [esi + 0x3c], ebx
mov dword [esi + 0x40], ebx
mov byte [esi + 0x44], 1
mov dword [esi + 0x34], ebx
call edi
push 0x40
push ebx
push eax
mov dword [esi + 0x34], eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov dword [esi + 0x38], eax
cmp eax, ebx
je 0x1009ddfa
mov dword [esi + 0x40], 0x10
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
push 1
lea eax, [ebp - 0x10]
push eax
lea ecx, [ebp - 0x20]
mov dword [ebp - 0x10], str.bad_allocation
call dword [sym.imp.MSVCR100.dll_public:_void___thiscall_std::exception::constructor_char_const__const_const___int_]
push 0x104241f4
lea ecx, [ebp - 0x20]
push ecx
mov dword [ebp - 0x20], vtable.std::bad_alloc.0
call sub.MSVCR100.dll__CxxThrowException
push 1
lea edx, [ebp - 0x14]
push edx
lea ecx, [ebp - 0x2c]
mov dword [ebp - 0x14], str.bad_allocation
call dword [sym.imp.MSVCR100.dll_public:_void___thiscall_std::exception::constructor_char_const__const_const___int_]
push 0x104241f4
lea eax, [ebp - 0x2c]
push eax
mov dword [ebp - 0x2c], vtable.std::bad_alloc.0
call sub.MSVCR100.dll__CxxThrowException
int3
Function at 0x1009e430
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10160538
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push ebx
push esi
mov eax, dword [0x10438fc0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
xor ebx, ebx
mov dword [esi + 8], 0x1a
mov dword [esi + 0xc], ebx
mov byte [esi + 0x10], bl
mov dword [esi + 0x18], ebx
mov dword [ebp - 4], ebx
mov dword [esi], vtable.SqlNodeColumnDefinitions.0
mov dword [esi + 0x28], ebx
mov dword [esi + 0x2c], ebx
mov byte [esi + 0x30], 1
mov dword [esi + 0x20], ebx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push 0x40
push ebx
push eax
mov dword [esi + 0x20], eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov dword [esi + 0x24], eax
cmp eax, ebx
je 0x1009e4b8
mov dword [esi + 0x2c], 0x10
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
push 1
lea eax, [ebp - 0x10]
push eax
lea ecx, [ebp - 0x1c]
mov dword [ebp - 0x10], str.bad_allocation
call dword [sym.imp.MSVCR100.dll_public:_void___thiscall_std::exception::constructor_char_const__const_const___int_]
push 0x104241f4
lea ecx, [ebp - 0x1c]
push ecx
mov dword [ebp - 0x1c], vtable.std::bad_alloc.0
call sub.MSVCR100.dll__CxxThrowException
int3
Function at 0x1009ff00
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10161647
mov eax, dword fs:[0]
push eax
push ebx
push esi
push edi
mov eax, dword [0x10438fc0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, dword [ebp + 8]
mov dword [edi], vtable.CatalogItem.0
mov dword [edi + 8], 0xffffffff
mov eax, dword [0x10196680]
mov dword [edi + 0xc], eax
mov ecx, dword [0x10196684]
mov dword [edi + 0x10], ecx
mov edx, dword [0x10196688]
mov dword [edi + 0x14], edx
mov eax, dword [0x1019668c]
mov dword [edi + 0x18], eax
mov ecx, dword [0x10196680]
mov dword [edi + 0x1c], ecx
mov edx, dword [0x10196684]
mov dword [edi + 0x20], edx
mov eax, dword [0x10196688]
xor ebx, ebx
mov dword [edi + 0x24], eax
mov ecx, dword [0x1019668c]
push ebx
push ebx
lea esi, [edi + 0x2c]
mov dword [edi + 0x28], ecx
push ebx
mov dword [esi], ebx
call fcn.100163a0
push ebx
push ebx
lea esi, [edi + 0x30]
mov dword [ebp - 4], ebx
push ebx
mov dword [esi], ebx
call fcn.100163a0
push ebx
push ebx
lea esi, [edi + 0x34]
mov byte [ebp - 4], 1
push ebx
mov dword [esi], ebx
call fcn.100163a0
push ebx
push ebx
lea esi, [edi + 0x38]
mov byte [ebp - 4], 2
push ebx
mov dword [esi], ebx
call fcn.100163a0
push ebx
mov byte [ebp - 4], 3
or eax, 0xffffffff
push ebx
lea esi, [edi + 0x44]
mov dword [edi + 0x3c], eax
mov dword [edi + 0x40], eax
push ebx
mov dword [esi], ebx
call fcn.100163a0
push ebx
push ebx
lea esi, [edi + 0x48]
mov byte [ebp - 4], 4
push ebx
mov dword [esi], ebx
call fcn.100163a0
mov esi, dword [sym.imp.OLEAUT32.dll_VariantClear]
or eax, 0xffffffff
mov word [edi + 0x50], ax
xor edx, edx
lea eax, [edi + 0x58]
mov word [edi + 0x4c], dx
mov byte [edi + 0x4e], bl
mov dword [edi + 0x54], ebx
push eax
mov dword [eax + 0x10], ebx
call esi
lea eax, [edi + 0x70]
mov dword [eax + 0x10], ebx
push eax
call esi
xor ecx, ecx
mov byte [edi + 0x88], 1
mov word [edi + 0x8a], cx
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x100a28a0
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push ecx
push ebx
push esi
push edi
mov edi, ecx
mov eax, dword [edi + 0x48]
test eax, eax
je 0x100a294a
or ebx, 0xffffffff
cmp dword [eax + 4], ebx
setne al
test al, al
je 0x100a294a
cmp dword [edi + 4], 0
je 0x100a28e7
cmp byte [ebp + 8], 0
je 0x100a28e7
cmp byte [edi + 0x4d], 0
je 0x100a28e7
cmp byte [edi + 0x4c], 0
jne 0x100a28e7
push 1
call fcn.100a1ee0
mov esi, dword [edi + 0x48]
mov eax, dword [esi + 4]
cmp eax, ebx
je 0x100a28fb
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi + 4], ebx
cmp byte [esi + 0xc], 0
mov ebx, dword [sym.imp.KERNEL32.dll_DeleteFileW]
je 0x100a290c
mov eax, dword [esi]
push eax
call ebx
cmp byte [edi + 0x4c], 0
je 0x100a291a
mov ecx, dword [edi + 0x48]
mov edx, dword [ecx]
push edx
call ebx
mov esi, dword [edi + 0x48]
xor ebx, ebx
cmp esi, ebx
je 0x100a2928
call fcn.1002e860
movzx eax, byte [edi + 0x4c]
push eax
mov eax, dword [edi + 0x50]
mov dword [edi + 0x48], ebx
mov dword [edi + 0x58], ebx
mov dword [edi + 0x5c], ebx
call fcn.100a4410
mov esi, dword [edi + 0x6c]
cmp esi, ebx
je 0x100a294a
call fcn.100a52f0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x100a2d80
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0xc
push esi
mov esi, dword [edi + 0x48]
mov eax, dword [esi + 4]
cmp eax, 0xffffffff
jne 0x100a2dac
mov dword [esi + 8], 6
mov eax, dword [edi + 0x48]
mov ecx, dword [eax + 8]
mov dword [edi + 0x54], ecx
xor al, al
pop esi
mov esp, ebp
pop ebp
ret
xor edx, edx
push edx
push edx
push edx
xor ecx, ecx
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_SetFilePointerEx]
test eax, eax
jne 0x100a2dd6
mov dword [esi + 8], 0x19
mov eax, dword [edi + 0x48]
mov ecx, dword [eax + 8]
mov dword [edi + 0x54], ecx
xor al, al
pop esi
mov esp, ebp
pop ebp
ret
mov dword [esi + 8], 0
mov esi, dword [edi + 0x48]
mov dword [esp + 4], 0
mov eax, dword [esi + 4]
cmp eax, 0xffffffff
jne 0x100a2df9
mov dword [esi + 8], 6
jmp 0x100a2e1a
push 0
lea edx, [esp + 8]
push edx
push 0x28
lea ecx, [edi + 0x10]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
neg eax
sbb eax, eax
and eax, 2
add eax, 0xfffffffe
mov dword [esi + 8], eax
cmp dword [edi + 0x10], 3
jae 0x100a2e3b
mov esi, dword [edi + 0x48]
lea eax, [esp + 8]
push eax
call fcn.10023400
mov ecx, dword [esp + 8]
mov edx, dword [esp + 0xc]
mov dword [edi + 0x28], ecx
mov dword [edi + 0x2c], edx
mov dword [edi + 0x38], 0x28
cmp dword [edi + 0x10], 1
jne 0x100a2e4d
mov eax, dword [edi + 0x1c]
jmp 0x100a2e4f
xor eax, eax
add eax, 4
mov dword [edi + 0x3c], eax
mov eax, dword [edi + 0x1c]
add eax, 0xfffffffc
cmp eax, 3
ja case.default.0x100a2e60
jmp dword [eax*4 + 0x100a2ed8]
xor eax, eax
lea ecx, [eax + 1]
jmp 0x100a2e8d
xor eax, eax
mov ecx, 0x100
jmp 0x100a2e8d
xor eax, eax
mov ecx, 0x10000
jmp 0x100a2e8d
xor eax, eax
mov ecx, 0x1000000
jmp 0x100a2e8d
xor eax, eax
xor ecx, ecx
mov dword [edi + 0x40], eax
mov eax, dword [edi + 0x10]
mov dword [edi + 0x44], ecx
cmp eax, 3
jbe 0x100a2eb0
cmp eax, 0x270c
je 0x100a2eb0
mov dword [edi + 0x54], 0xffffffff
xor al, al
pop esi
mov esp, ebp
pop ebp
ret
cmp dword [edi + 0x24], 0
jl 0x100a2ecb
jg 0x100a2ebe
cmp dword [edi + 0x20], 0
jbe 0x100a2ecb
mov eax, 1
mov byte [edi + 0x4d], al
pop esi
mov esp, ebp
pop ebp
ret
xor eax, eax
mov byte [edi + 0x4d], al
mov al, 1
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x100a2ef0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [esi + 4]
sub esp, 8
cmp eax, 0xffffffff
jne 0x100a2f07
mov dword [esi + 8], 6
jmp 0x100a2f2a
xor edx, edx
push edx
push edx
push edx
xor ecx, ecx
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_SetFilePointerEx]
test eax, eax
jne 0x100a2f23
mov dword [esi + 8], 0x19
jmp 0x100a2f2a
mov dword [esi + 8], 0
mov eax, dword [esi + 4]
mov dword [ebp - 4], 0
cmp eax, 0xffffffff
jne 0x100a2f48
mov dword [esi + 8], 6
mov al, 1
mov esp, ebp
pop ebp
ret 0x28
push 0
lea ecx, [ebp - 4]
push ecx
push 0x28
lea edx, [ebp + 8]
push edx
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
neg eax
sbb eax, eax
and eax, 3
add eax, 0xfffffffd
mov dword [esi + 8], eax
mov al, 1
mov esp, ebp
pop ebp
ret 0x28
Function at 0x100a3020
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, dword [edi + 0x48]
mov eax, dword [esi + 4]
cmp eax, 0xffffffff
jne 0x100a304a
mov dword [esi + 8], 6
mov eax, dword [edi + 0x48]
mov ecx, dword [eax + 8]
mov dword [edi + 0x54], ecx
xor al, al
pop esi
pop ebx
pop ecx
pop ebp
ret 0xc
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
push 0
push 0
push ecx
push edx
push eax
call dword [sym.imp.KERNEL32.dll_SetFilePointerEx]
test eax, eax
jne 0x100a307a
mov dword [esi + 8], 0x19
mov eax, dword [edi + 0x48]
mov ecx, dword [eax + 8]
mov dword [edi + 0x54], ecx
xor al, al
pop esi
pop ebx
pop ecx
pop ebp
ret 0xc
mov ecx, dword [ebp + 0x10]
mov dword [esi + 8], 0
mov esi, dword [edi + 0x48]
mov ebx, dword [edi + 0x3c]
xor edx, edx
mov dword [ecx + 8], edx
mov eax, dword [esi + 4]
mov dword [ebp + 0x10], edx
cmp eax, 0xffffffff
jne 0x100a30a3
mov dword [esi + 8], 6
jmp 0x100a30be
push edx
lea edx, [ebp + 0x10]
push edx
push ebx
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
neg eax
sbb eax, eax
and eax, 2
add eax, 0xfffffffe
mov dword [esi + 8], eax
cmp dword [ebp + 0x10], ebx
jne 0x100a3038
pop esi
mov al, 1
pop ebx
pop ecx
pop ebp
ret 0xc

Function at 0x100a30d0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push edi
mov edi, dword [esi + 0x48]
mov eax, dword [edi + 4]
cmp eax, 0xffffffff
jne 0x100a30fa
mov dword [edi + 8], 6
mov edx, dword [esi + 0x48]
mov eax, dword [edx + 8]
mov dword [esi + 0x54], eax
xor al, al
pop edi
pop ebx
pop ecx
pop ebp
ret 0xc
mov ecx, dword [ebp + 0xc]
mov ebx, dword [ebp + 8]
push 0
push 0
push ecx
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_SetFilePointerEx]
test eax, eax
jne 0x100a312a
mov dword [edi + 8], 0x19
mov edx, dword [esi + 0x48]
mov eax, dword [edx + 8]
mov dword [esi + 0x54], eax
xor al, al
pop edi
pop ebx
pop ecx
pop ebp
ret 0xc
mov dword [edi + 8], 0
cmp ebx, dword [esi + 0x58]
jne 0x100a3154
mov ecx, dword [ebp + 0xc]
cmp ecx, dword [esi + 0x5c]
jne 0x100a3154
mov ecx, dword [ebp + 0x10]
mov edx, dword [ecx]
mov dword [esi + 0x60], edx
mov eax, dword [ecx + 4]
mov dword [esi + 0x64], eax
mov edx, dword [ecx + 8]
mov dword [esi + 0x68], edx
jmp 0x100a3157
mov ecx, dword [ebp + 0x10]
mov edi, dword [esi + 0x48]
mov eax, dword [edi + 4]
mov ebx, dword [esi + 0x3c]
xor edx, edx
mov dword [ebp + 0x10], edx
cmp eax, 0xffffffff
jne 0x100a3173
mov dword [edi + 8], 6
jmp 0x100a3190
push edx
lea edx, [ebp + 0x10]
push edx
push ebx
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
neg eax
sbb eax, eax
and eax, 3
add eax, 0xfffffffd
mov dword [edi + 8], eax
xor edx, edx
cmp dword [ebp + 0x10], ebx
je 0x100a31bd
mov eax, dword [ebp + 8]
cmp eax, dword [esi + 0x58]
jne 0x100a31ab
mov ecx, dword [ebp + 0xc]
cmp ecx, dword [esi + 0x5c]
jne 0x100a31ab
mov dword [esi + 0x58], edx
mov dword [esi + 0x5c], edx
mov edx, dword [esi + 0x48]
mov eax, dword [edx + 8]
mov dword [esi + 0x54], eax
xor al, al
pop edi
pop ebx
pop ecx
pop ebp
ret 0xc
pop edi
mov al, 1
pop ebx
pop ecx
pop ebp
ret 0xc
Function at 0x100a3bb0
Capabilities:
Check if file exists
Delete file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1016293c
mov eax, dword fs:[0]
push eax
sub esp, 8
push esi
push edi
mov eax, dword [0x10438fc0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebx + 0x48]
test eax, eax
je 0x100a3bf2
cmp dword [eax + 4], 0xffffffff
setne al
test al, al
je 0x100a3bf2
push 0
mov ecx, ebx
call fcn.100a28a0
mov eax, dword [ebx]
mov edi, dword [sym.imp.KERNEL32.dll_DeleteFileW]
push eax
call edi
test eax, eax
jne 0x100a3c0f
call fcn.10023ad0
cmp eax, 2
jne 0x100a3c97
mov esi, dword [ebx + 0x50]
mov eax, dword [esi + 0x18]
test eax, eax
je 0x100a3c28
cmp dword [eax + 4], 0xffffffff
je 0x100a3c28
push 0
mov eax, esi
call fcn.100a4410
mov esi, dword [esi]
push esi
call edi
test eax, eax
jne 0x100a3c3b
call fcn.10023ad0
cmp eax, 2
jne 0x100a3c97
cmp dword [ebx + 0x6c], 0
jne 0x100a3c72
push 0x160
call dword [sym.imp.MSVCR100.dll_void____cdecl_operator_new_unsigned_int_]
add esp, 4
mov dword [ebp - 0x10], eax
mov dword [ebp - 4], 0
test eax, eax
je 0x100a3c6d
mov ecx, dword [ebx + 0x1c]
mov edx, dword [ebx]
push ecx
push edx
mov edi, eax
call fcn.100a5260
jmp 0x100a3c6f
xor eax, eax
mov dword [ebx + 0x6c], eax
mov esi, dword [ebx + 0x6c]
call fcn.100a52f0
test eax, eax
js 0x100a3c8d
lea edi, [esi + 0x150]
call fcn.100a5f80
test eax, eax
jns 0x100a3cba
call fcn.10023ad0
cmp eax, 2
je 0x100a3cba
sub eax, 5
neg eax
sbb eax, eax
and eax, 0xfffffffa
add eax, 5
mov dword [ebx + 0x54], eax
xor al, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
mov al, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x100a3cd0
Capabilities:
Move file

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x10167e3c
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push ebx
push esi
push edi
mov eax, dword [0x10438fc0]
xor eax, esp
push eax
lea eax, [esp + 0x20]
mov dword fs:[0], eax
mov ebx, ecx
mov eax, dword [ebx + 0x48]
test eax, eax
je 0x100a3d17
cmp dword [eax + 4], 0xffffffff
setne al
test al, al
je 0x100a3d17
push 0
call fcn.100a28a0
lea eax, [esp + 0x14]
mov ecx, ebx
call fcn.100a1ed0
mov edi, dword [ebp + 8]
mov dword [esp + 0x28], 0
mov eax, dword [ebx]
push edi
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileW]
test eax, eax
je 0x100a3d53
mov esi, dword [ebx + 0x50]
mov eax, edi
call fcn.100a4520
test al, al
jne 0x100a3d8a
mov edx, dword [ebx]
push edx
push edi
call dword [sym.imp.KERNEL32.dll_MoveFileW]
mov eax, dword [esp + 0x14]
test eax, eax
je 0x100a3d73
lea ecx, [eax - 0xc]
test ecx, ecx
je 0x100a3d73
add eax, 0xfffffff4
dec dword [eax]
jne 0x100a3d73
push eax
call dword [sym.imp.MSVCR100.dll_void___cdecl_operator_delete___void__]
add esp, 4
xor al, al
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
cmp dword [ebx + 0x6c], 0
jne 0x100a3ddb
push 0x160
call dword [sym.imp.MSVCR100.dll_void____cdecl_operator_new_unsigned_int_]
add esp, 4
mov dword [esp + 0x18], eax
mov byte [esp + 0x28], 1
test eax, eax
je 0x100a3dbe
mov ecx, dword [ebx + 0x1c]
mov edx, dword [ebx]
push ecx
push edx
mov edi, eax
call fcn.100a5260
mov edi, dword [ebp + 8]
jmp 0x100a3dc0
xor eax, eax
mov byte [esp + 0x28], 0
mov dword [ebx + 0x6c], eax
test eax, eax
jne 0x100a3ddb
mov eax, dword [esp + 0x14]
test eax, eax
je 0x100a3d73
lea edx, [eax - 0xc]
test edx, edx
jmp 0x100a3d60
push 0
lea eax, [esp + 0x1c]
call fcn.100164f0
mov byte [esp + 0x28], 2
mov ecx, dword [ebx + 0x6c]
lea ecx, [ecx + 0x150]
lea edx, [esp + 0x18]
call fcn.100a5fe0
mov esi, eax
mov byte [esp + 0x28], 0
mov eax, dword [esp + 0x18]
test eax, eax
je 0x100a3e24
lea ecx, [eax - 0xc]
test ecx, ecx
je 0x100a3e24
add eax, 0xfffffff4
dec dword [eax]
jne 0x100a3e24
push eax
call dword [sym.imp.MSVCR100.dll_void___cdecl_operator_delete___void__]
add esp, 4
test esi, esi
jns 0x100a3e5e
mov edx, dword [ebx]
mov eax, dword [ebp + 8]
push edx
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileW]
mov edi, dword [esp + 0x14]
mov esi, dword [ebx + 0x50]
mov eax, edi
call fcn.100a4520
test edi, edi
je 0x100a3d73
lea ecx, [edi - 0xc]
test ecx, ecx
je 0x100a3d73
lea eax, [edi - 0xc]
jmp 0x100a3d65
mov edi, dword [ebp + 8]
mov eax, ebx
call fcn.10016670
movzx edx, byte [ebx + 8]
mov eax, dword [ebx + 4]
push edx
push eax
mov ecx, ebx
call fcn.100a1a80
mov bl, al
mov eax, dword [esp + 0x14]
test eax, eax
je 0x100a3e9a
lea ecx, [eax - 0xc]
test ecx, ecx
je 0x100a3e9a
add eax, 0xfffffff4
dec dword [eax]
jne 0x100a3e9a
push eax
call dword [sym.imp.MSVCR100.dll_void___cdecl_operator_delete___void__]
add esp, 4
mov al, bl
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x100a4090
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1016293c
mov eax, dword fs:[0]
push eax
sub esp, 8
push esi
push edi
mov eax, dword [0x10438fc0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebx + 0x18]
xor edi, edi
cmp eax, edi
je 0x100a40ce
cmp dword [eax + 4], 0xffffffff
je 0x100a40ce
push edi
mov eax, ebx
call fcn.100a4410
push 0x10
call dword [sym.imp.MSVCR100.dll_void____cdecl_operator_new_unsigned_int_]
mov esi, eax
add esp, 4
mov dword [ebp - 0x10], esi
mov dword [ebp - 4], edi
cmp esi, edi
je 0x100a4101
push edi
mov edi, dword [ebx]
call fcn.100164f0
mov dword [esi + 4], 0xffffffff
mov dword [esi + 8], 0
mov byte [esi + 0xc], 0
mov edi, esi
mov dword [ebx + 0x18], edi
mov eax, dword [edi + 4]
cmp eax, 0xffffffff
je 0x100a411a
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [edi + 4], 0xffffffff
cmp byte [edi + 0xc], 0
je 0x100a4129
mov eax, dword [edi]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov eax, dword [edi]
push 0
push 0
push 2
push 0
push 1
push 0xc0000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
cmp eax, 0xffffffff
jne 0x100a417c
call fcn.10023ad0
mov dword [edi + 8], eax
mov esi, dword [ebx + 0x18]
mov ecx, dword [esi + 8]
mov dword [ebx + 0x30], ecx
test esi, esi
je 0x100a4160
call fcn.1002e860
mov dword [ebx + 0x18], 0
xor al, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 8
mov edx, dword [ebp + 8]
xor esi, esi
mov dword [edi + 4], eax
mov byte [edi + 0xc], 0
mov dword [edi + 8], esi
mov edi, dword [ebx + 0x1c]
mov dword [ebx + 4], edx
cmp edi, esi
je 0x100a41b1
mov eax, dword [edi]
cmp eax, esi
je 0x100a41a7
push eax
call dword [sym.imp.MSVCR100.dll_free]
add esp, 4
mov dword [edi], esi
push edi
call dword [sym.imp.MSVCR100.dll_void___cdecl_operator_delete_void__]
add esp, 4
push 0x1044dcc0
push 0x14
call fcn.10148ac6
add esp, 8
cmp eax, esi
je 0x100a41d4
mov dword [eax], esi
mov dword [eax + 4], esi
mov dword [eax + 8], esi
mov dword [eax + 0xc], esi
mov dword [eax + 0x10], esi
jmp 0x100a41d6
xor eax, eax
mov dword [ebx + 0x1c], eax
cmp eax, esi
je 0x100a4167
mov dword [ebx + 0xc], esi
mov dword [ebx + 0x10], esi
mov esi, dword [ebp + 0xc]
mov dword [ebx + 8], 3
mov edi, ebx
mov dword [ebx + 0x14], esi
call fcn.100a4fa0
mov eax, esi
mov dword [ebx + 0x20], esi
shl eax, 0xa
add esi, 0xfffffffc
mov dword [ebx + 0x24], eax
cmp esi, 3
ja case.default.0x100a420a
jmp dword [esi*4 + 0x100a4254]
xor eax, eax
lea ecx, [eax + 1]
jmp 0x100a4237
xor eax, eax
mov ecx, 0x100
jmp 0x100a4237
xor eax, eax
mov ecx, 0x10000
jmp 0x100a4237
xor eax, eax
mov ecx, 0x1000000
jmp 0x100a4237
xor eax, eax
xor ecx, ecx
mov dword [ebx + 0x28], eax
mov dword [ebx + 0x2c], ecx
mov al, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 8