joyce8/EMBER2024-capa huggingface dataset:
Function at 0x49b395
Capabilities:
Packed with generic packer

Disassembly:
add byte [eax], 0
add byte [eax + 0x4307000a], al
popal
jo 0x49b415
imul ebp, dword [edi + 0x6e], 0x4c5f88
dec eax
add byte [eax], al
invalid
add dword [eax], eax
add byte [eax], al
add byte [eax], al
add byte [eax], al
push cs
add byte [eax], cl
inc esp
jb 0x49b488
dec ebp
outsd dx, dword [esi]
add byte gs:[eax], dl
inc eax
add byte [eax], bh
add byte [eax], al
dec esp
fmul dword [ebx]
add dword [eax], eax
add byte [eax], al
add byte [eax], al
add byte [eax + 1], al
sldt word [edi]
inc ebp
outsb dx, byte [esi]
popal
bound ebp, qword [ebp + 0x64]
adc byte [ebx + 0x4c], ah
add byte [eax + eax], al
inc dword [eax]
fimul dword [ebx]
dec ebx
add byte [edx + ebx*8], cl
dec ebx
add byte [eax], al
add byte [eax], al
add byte [eax], 0
add byte [eax + 0x46040010], al
outsd dx, dword [esi]
outsb dx, byte [esi]
je 0x49b46e
adc byte [eax], al
push eax
popal

Function at 0x49b3df
Capabilities:
Packed with generic packer

Disassembly:
inc ebx
je 0x49b44e
xor eax, dword [esp + ebp - 0x4b]
dec ebx
add byte [esi], cl
add bh, bh
dec esi
add byte [eax], al
inc dword [ecx]
add byte [eax], al
add byte [eax], al
add byte [eax], al
xor ah, 0xff
invalid

Function at 0x49b458
Capabilities:
Packed with generic packer

Disassembly:
add byte [eax], 0
add byte [eax + 0x4307000a], al
popal
jo 0x49b415
imul ebp, dword [edi + 0x6e], 0x4c5f88
dec eax
add byte [eax], al
invalid
add dword [eax], eax
add byte [eax], al
add byte [eax], al
add byte [eax], al
push cs
add byte [eax], cl
inc esp
jb 0x49b488
dec ebp
outsd dx, dword [esi]
add byte gs:[eax], dl
inc eax
add byte [eax], bh
add byte [eax], al
dec esp
fmul dword [ebx]
add dword [eax], eax
add byte [eax], al
add byte [eax], al
add byte [eax + 1], al
sldt word [edi]
inc ebp
outsb dx, byte [esi]
popal
bound ebp, qword [ebp + 0x64]
adc byte [ebx + 0x4c], ah
add byte [eax + eax], al
inc dword [eax]
fimul dword [ebx]
dec ebx
add byte [edx + ebx*8], cl
dec ebx
add byte [eax], al
add byte [eax], al
add byte [eax], 0
add byte [eax + 0x46040010], al
outsd dx, dword [esi]
outsb dx, byte [esi]
je 0x49b46e
adc byte [eax], al
push eax
popal
Function at 0x4afdba
Capabilities:
Access peb ldr_data

Disassembly:
add byte [edi + edi*8 + 0x30], ah
mov dword fs:[eax], esp
mov esi, dword [ebx + 0xc]
dec esi
mov byte [ebp - 1], 1
mov eax, dword [edi + 0x10]
mov edx, 0x4afc60
call fcn.004b2922
jne 0x4afe37
lea ecx, [ebp - 0x10]
mov edx, esi
dec edx
mov eax, ebx
call 0x4e69cd
mov edx, dword [ebp - 0x10]
lea ecx, [ebp - 0xc]
mov al, byte [0x4cf34a]
call 0x511895
test al, al
je 0x4afe27
mov edx, esi
sub edx, 2
mov ecx, dword [ebp - 0xc]
xor ecx, ecx
mov edx, esi
mov eax, ebx
call 0x4e6b12
jmp 0x55ee65
mov eax, dword [edi + 0x10]
mov edx, 0x4afc7c
call fcn.004b2990
jne 0x4afee2
lea ecx, [ebp - 0x10]
mov edx, esi
dec edx
mov eax, ebx
call 0x4e6a3f
mov edx, dword [ebp - 0x10]
lea ecx, [ebp - 0xc]
mov al, byte [0x4cf34a]
invalid
invalid
invalid

Function at 0x4c6af6
Capabilities:
Encrypt data using rc4 prga

Disassembly:
inc eax
add al, dl
sub eax, dword [eax]
adc al, 0x2c
inc eax
add byte [eax], dh
wait

Function at 0x4c6b0d
Capabilities:
Encrypt data using rc4 prga

Disassembly:
insd dword es:[edi], dx
popal
lea eax, gs:[bx + si]
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
mov word [eax + 0x4c], gs
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax + ebp*2 + 0x1c004c], al
add byte [eax], al
mov al, byte [0xf4004c66]
sub al, 0x40
add byte [eax - 0x2fffbfd5], ch
sub eax, dword [eax]

Function at 0x4c6b12
Capabilities:
Encrypt data using rc4 prga

Disassembly:
insd dword es:[edi], dx
popal
lea eax, gs:[bx + si]
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
mov word [eax + 0x4c], gs
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax + ebp*2 + 0x1c004c], al
add byte [eax], al
mov al, byte [0xf4004c66]
sub al, 0x40
add byte [eax - 0x2fffbfd5], ch
sub eax, dword [eax]

Function at 0x4c6b88
Capabilities:
Encrypt data using rc4 prga

Disassembly:
xchg esi, eax
dec esp
add ah, dh
sahf
dec esp
add byte [esi + ebx*4 + 0x4c], bh
add byte [eax + 0x4c], al
add byte [edi + edx*4], cl
dec esp
add byte [edx], ah
dec esp
add byte [eax - 0x7ffb35e], ah
mov byte [0xa6f4004c], al
dec esp
add byte [edx + ebp*4 - 0x54fbffb4], ah
dec esp
add byte [ebx + ebp*4], dh
dec esp
add byte [eax + ebx*4], dh
cwde
dec esp
add byte [eax + 0x40004c98], cl
movsd dword es:[edi], dword [esi]
dec esp
add byte [eax], ch
sub byte [esp + ecx*2 + 0x4ca43000], ch
add byte [eax], dh
lodsb al, byte [esi]
dec esp
add byte [edx + 0x4c], bh
add byte [edi], al
push esp
inc edx
Function at 0x4c6b9b
Capabilities:
Encrypt data using rc4 prga

Disassembly:
imul esi, dword [ebp + ebp*2 + 0x61], 0x54070770
inc edx
imul esi, dword [ebp + ebp*2 + 0x61], 0x4c683470
add al, bh
dec sp
add byte [eax], al
add byte [eax], cl
or byte [edi + 0x72], al
popal
jo 0x4c6c21
imul esp, dword [ebx + 0x73], 0xc08b0000
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
in al, 0x68
dec esp
add byte [eax], dl
add byte [eax], al
add byte [edi + 0x2cf4004c], bl
inc eax
add byte [eax - 0x2fffbfd5], ch
shr byte [ebx], 1
inc eax
add byte [esp + ebp], dl
inc eax
add byte [esp + ebp*4 + 0x540a004c], dh
mov ah, 0xac
dec esp
add byte [edx], cl
push esp
dec ecx
arpl word [edi + 0x6e], bp
dec ecx
insd dword es:[edi], dx
popal
nop
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
js 0x4c6c77
dec esp
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax + 0x69], dh
add byte [eax], al
add byte [eax], al
jo 0x4c6c87
dec esp
add byte [eax + eax], dl
add byte [eax], al
mov al, byte [0xf4004c66]
add byte [eax], al
add byte [eax - 0xbffb39a], ah
sub al, 0x40
add byte [eax - 0x2fffbfd5], ch
sub eax, dword [eax]
adc al, 0xad
dec esp
add byte [eax - 0x38], ch
add ah, al
mov al, 0x4c
add al, dh
mov al, 0x4c
add byte [ecx + esi*4], al
dec esp
add byte [0x6f634954], al
outsb dx, byte [esi]
arpl word [edi + 0x6e], bp
mov eax, eax
pop es
add eax, 0x6f634954
outsb dx, byte [esi]
and al, 0x69
dec esp
add al, bh
dec sp
add byte [eax], al

Function at 0x4c6c3a
Capabilities:
Encrypt data using rc4 prga

Disassembly:
inc eax
add byte [eax - 0x6a], ah
dec esp
add byte [ebp*4 - 0x5333ffb4], bh
dec esp
add byte [eax + 0xc004cad], bl
xchg edi, eax
dec esp
add al, dl
lodsd eax, dword [esi]
dec esp
add ah, bh
lodsd eax, dword [esi]
dec esp
add byte [esi + ebp*4], al
dec esp
add al, ah
cwde
dec esp
add byte [eax + esi*4 - 0x4f47ffb4], ch
dec esp
add al, ch
cwde
dec esp
add byte [eax + ebx*4], dh
dec esp
add byte [eax + 0x2c004c98], cl
scasd eax, dword es:[edi]
dec esp
Function at 0x4c6c9c
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
add byte [eax], cl
inc edi
jb 0x4c6d02
jo 0x4c6d0b
imul esp, dword [ebx + 0x73], 0
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
enter 0x4c69, 0
add byte [eax], al
add byte [eax], al
sbb ebp, dword [edx + 0x4c]
add byte [eax + eax], cl
add byte [eax], al
in al, dx
adc byte [eax], al
inc eax
add ah, dh
hlt
sub al, 0x40
add byte [eax - 0x2fffbfd5], ch
sub eax, dword [eax]
adc al, 0x2c
inc eax
add byte [eax + eax], al
adc al, 0
test byte [edx + 0x4c], ch
add byte [0x6f6c6c41], cl
insb byte es:[edi], dx
insb byte es:[edi], dx
outsd dx, dword [esi]
arpl word [edx + 0x65], dx
jae fcn.004c6d5d
jne 0x4c6d62
arpl word [ebp + 0x13], sp
add byte [eax], al
imul ecx, dword [eax + eax + 0xc], 0x46
jb 0x4c6d61
push edx
jae 0x4c6d70
jne 0x4c6d75
jb 0x4c6d67
arpl word [ebp + 0x15], sp
add byte [eax + 0x6b], dl
dec esp
adc eax, 0x4c6b5000
add byte [esi], cl
push cs
inc ebx
push 0x65676e61
push edx
jae 0x4c6d85
jne 0x4c6d8a
arpl word [ebp + 0x15], sp
add byte [ebx + ebp*2 + 0x410e004c], cl
jae 0x4c6d97
imul esp, dword [edi + 0x6e], 0x6f736552
jne 0x4c6d9f
arpl word [ebp + 0x10], sp
push esp
push edx
jae 0x4c6da4
jne 0x4c6da9
arpl word [ebp + 0x4d], sp
popal
outsb dx, byte [esi]
popal
jb 0x4c6cca
jb 0x4c6cca
ror dword [ecx + 0x66c031c2], 1
rol eax, 5
rol ax, 5
xor al, byte [edx]
inc edx
dec ecx
jne 0x4c6d46
ret
sbb byte [edx], bh
sbb dh, byte [ebp + 9]
add al, 0x24
lea eax, [eax]
test dl, dl
je 0x4c6d84
add esp, 0xfffffff0
call fcn.004c8f7c
mov word [eax + 8], cx
mov dword [eax + 8], ecx
test dl, dl
je 0x4c6d96
pop dword fs:[0]
add esp, 0xc
ret
nop
push ebx
push esi
push edi
push ebp
mov edi, edx
mov esi, eax
movzx edx, word [esi + 8]
push esi
invalid
invalid
mov eax, edi
call 0x58cbd7
or al, 0
mov ebp, eax
mov ebx, dword [esi + 4]
jmp 0x4c6db4
mov ebx, dword [ebx]
test ebx, ebx
je 0x4c6dd0
cmp bp, word [ebx + 0xc]
jne 0x4c6db2
movzx ecx, word [esi + 8]
mov edx, edi
lea eax, [ebx + 0x10]
call 0x58cc0c
test al, al
je 0x4c6db2
test ebx, ebx
jne 0x4c6e08
invalid
Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx

Function at 0x4142e1
Capabilities:
Encode data using xor
Hash data using djb2

Disassembly:
push ebx
push esi
mov esi, ecx
push edi
lea edi, [esi + eax]
mov ebx, 0x1505
cmp esi, edi
jae 0x41430e
movzx eax, byte [esi]
push eax
call fcn.00418b20
mov edx, ebx
shl edx, 5
movsx ecx, al
add ebx, edx
inc esi
add esp, 4
xor ebx, ecx
cmp esi, edi
jb 0x4142f1
pop edi
pop esi
movzx eax, bl
pop ebx
ret

Function at 0x50c6d0
Capabilities:
Encode data using xor

Disassembly:
cmp dword gs:[edi + 0xc], ecx
rcr esi, 1
invalid
add bh, bl
loop 0x50c69b
aam 6
xor byte [edx], ch
daa
mov bh, 0xa5
mov esp, 0x577dbe87
sbb byte [ebx + 0x75576f2b], al
inc esi
jb 0x50c6fe
inc edx
xchg esi, eax
invalid
mov esp, 0xa7ea27db
xchg esi, eax
and eax, 0xa0897ca4
push esp
mov bl, 0xc7
mov ch, 0xc2
add eax, ebx
jae 0x50c6a8
in eax, 0x4b
dec esi
sub ebx, eax
dec eax
jo 0x50c74e
inc edx
jae 0x50c71c
mov byte [0x51e9ae25], al
xchg edi, eax
sar byte [ecx - 0x41], cl
cmp cl, cl
invalid
mov bl, 0xd8
mov eax, dword [0x913e3bae]
cmp bh, byte [ebp - 0x76d29c54]
pop edi
cmp byte [ecx + 0x5b], 0xc5
and byte [ebx - 0x3d7faf24], ch
mov ch, 0xf1
emms
sbb byte [ebp - 0x1a], ah
adc eax, 0x2baa69e1
or dword cs:[edi + 0x55], ebp
out 0x15, al
loope 0x50c789
stosb byte es:[edi], al
sub ebp, dword [esi]
or dword [edi + 0x55], ebp
std
xor ah, byte [eax]
mov esp, 0x7b6b762
mul byte [edx - 0x1c]
or al, 0x8d
frstor dword [ecx]
pop esi
or eax, dword [ebp - 0x75e794d8]
test byte [esi + ecx*2 + 0x48], dh
dec ebx
rcr byte [edi + edi + 0x55], cl
jge 0x50c710
mov dword [0x478dd865], eax
lodsd eax, dword [esi]
sbb eax, 0x17c24f4a
jae 0x50c6dc
dec edx
dec edi
ret 0x7317
sub eax, 0xa8268cab
in eax, 0x89
cmpsd dword [esi], dword es:[edi]
movsd dword es:[edi], dword cs:[esi]
inc esp
cli
or dword [esi + 0x22], 0x3f
test byte [edi], cl
dec ebx
salc
mov ecx, 0x19b3682c
jmp 0x50c78b
Function at 0x4a9e20
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x8b000]
push edi
or ebp, 0xffffffff
jmp 0x4a9e42
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x4a9e49
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4a9e38
mov eax, 1
add ebx, ebx
jne 0x4a9e5b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x4a9e6c
jne 0x4a9e8b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4a9e8b
dec eax
add ebx, ebx
jne 0x4a9e78
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x4a9e50
add ebx, ebx
jne 0x4a9e87
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x4a9edd
xor ecx, ecx
sub eax, 3
jb 0x4a9ea3
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x4a9f12
sar eax, 1
mov ebp, eax
jmp 0x4a9eae
add ebx, ebx
jne 0x4a9eae
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4a9e7c
inc ecx
add ebx, ebx
jne 0x4a9ebc
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4a9e7c
add ebx, ebx
jne 0x4a9ec9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x4a9ebe
jne 0x4a9eda
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x4a9ebe
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x4a9efc
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x4a9eee
jmp 0x4a9e3e
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x4a9efc
add edi, ecx
jmp 0x4a9e3e
pop esi
mov edi, esi
mov ecx, 0x5fe
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x4a9f1a
cmp byte [edi], 9
jne 0x4a9f1a
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x4a9f1f
lea edi, [esi + 0xa7000]
mov eax, dword [edi]
or eax, eax
je 0x4a9f8e
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x10d6f4]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x10d7dc]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x4a9f4c
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x10d7e4]
or eax, eax
je 0x4a9f88
mov dword [ebx], eax
add ebx, 4
jmp 0x4a9f69
call dword [esi + 0x10d7e0]
mov ebp, dword [esi + 0x10d7e8]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x207]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x4a9fc2
sub esp, 0xffffff80
jmp 0x402078
Function at 0x433002
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
mov eax, section..text
nop
nop
push 4
nop
nop
nop
nop
nop
pop edi
nop
nop
nop
nop
nop
cmp eax, 0
nop
je 0x433072
nop
nop
nop
mov ebx, 0x40de38
nop
nop
nop
nop
nop
mov ecx, ebx
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
push eax
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
nop
div edi
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
pop eax
nop
nop
nop
mov esi, 0x49aa48c8
nop
nop
nop
xor dword [eax], esi
nop
nop
add eax, edi
nop
nop
nop
nop
nop
nop
loop 0x433060
nop
nop
mov eax, section..data
cmp eax, 0
nop
nop
nop
nop
nop
je 0x4330d2
nop
nop
mov ebx, 0x4304d8
nop
nop
nop
mov ecx, ebx
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
xor edx, edx
nop
nop
nop
push eax
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
nop
div edi
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
nop
pop eax
nop
mov esi, 0x62b46581
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
add eax, edi
nop
nop
nop
nop
loop 0x4330c0
nop
nop
nop
nop
nop
popal
nop
nop
nop
jmp 0x431219
Function at 0x6287e0
Capabilities:
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [ebp + 8]
mov dword [ebp - 4], eax
mov dword [ebp - 8], 0xffffffff
mov dword [ebp - 0xc], 0
jmp 0x628805
mov ecx, dword [ebp - 0xc]
add ecx, 1
mov dword [ebp - 0xc], ecx
mov edx, dword [ebp - 0xc]
cmp edx, dword [ebp + 0xc]
jae 0x628878
mov eax, dword [ebp - 4]
add eax, dword [ebp - 0xc]
movzx ecx, byte [eax]
movzx edx, byte [ebp - 8]
xor ecx, edx
mov dword [ebp - 0x10], ecx
mov eax, dword [ebp - 8]
shr eax, 8
mov dword [ebp - 8], eax
mov dword [ebp - 0x14], 0
jmp 0x62883a
mov ecx, dword [ebp - 0x14]
add ecx, 1
mov dword [ebp - 0x14], ecx
cmp dword [ebp - 0x14], 8
jge 0x62886d
mov edx, dword [ebp - 0x10]
and edx, 1
neg edx
sbb edx, edx
neg edx
mov byte [ebp - 0x15], dl
mov eax, dword [ebp - 0x10]
shr eax, 1
mov dword [ebp - 0x10], eax
movzx ecx, byte [ebp - 0x15]
test ecx, ecx
je 0x62886b
mov edx, dword [ebp - 0x10]
xor edx, 0xedb88320
mov dword [ebp - 0x10], edx
jmp 0x628831
mov eax, dword [ebp - 8]
xor eax, dword [ebp - 0x10]
mov dword [ebp - 8], eax
jmp 0x6287fc
mov eax, dword [ebp - 8]
not eax
mov esp, ebp
pop ebp
ret
Function at 0x10001c71
Capabilities:
Print debug messages

Disassembly:
push 4
mov eax, 0x1002b4ac
call fcn.1002a0c8
mov esi, ecx
mov dword [ebp - 0x10], esi
push dword [ebp + 8]
lea edi, [esi + 4]
mov dword [esi], vtable.CMemMappedFile.0
xor ebx, ebx
mov ecx, edi
mov dword [edi + 0x10], ebx
mov dword [edi + 0x14], ebx
call fcn.10002a03
mov eax, dword [ebp + 0xc]
mov dword [esi + 0x1c], ebx
mov dword [esi + 0x20], ebx
mov dword [esi + 0x24], eax
mov dword [esi + 0x28], ebx
mov dword [esi + 0x2c], ebx
mov byte [esi + 0x30], 1
mov dword [ebp - 4], ebx
cmp byte [0x1003cde0], bl
je 0x10001cea
cmp dword [edi + 0x14], 0x10
jb 0x10001cc6
mov edi, dword [edi]
push edi
push str.CMemMappedFile__s__ctor__reference_
mov edi, 0x1003c7f0
push edi
call fcn.10017159
add esp, 0xc
cmp byte [0x1003cde0], 0
je 0x10001cea
push edi
call dword [sym.imp.kernel32.dll_OutputDebugStringA]
push esi
call fcn.10017159
pop ecx
mov eax, esi
call fcn.1002a091
ret 8

Function at 0x10001cfb
Capabilities:
Print debug messages

Disassembly:
push 4
mov eax, 0x1002b4ac
call fcn.1002a0c8
mov esi, ecx
mov dword [ebp - 0x10], esi
lea edi, [esi + 4]
mov dword [esi], vtable.CMemMappedFile.0
push edi
call fcn.100026c3
pop ecx
mov eax, dword [ebp + 8]
xor ecx, ecx
mov dword [esi + 0x1c], ecx
mov dword [esi + 0x20], ecx
mov dword [esi + 0x24], eax
mov dword [esi + 0x28], ecx
mov dword [esi + 0x2c], ecx
mov byte [esi + 0x30], cl
mov dword [ebp - 4], ecx
cmp byte [0x1003cde0], cl
je 0x10001d6b
cmp dword [edi + 0x14], 0x10
jb 0x10001d46
mov edi, dword [edi]
push eax
push edi
push str.CMemMappedFile__s__ctor__new_with_size_lu_
mov edi, 0x1003c7f0
push edi
call fcn.10017159
add esp, 0x10
cmp byte [0x1003cde0], 0
je 0x10001d6b
push edi
call dword [sym.imp.kernel32.dll_OutputDebugStringA]
mov ecx, esi
call fcn.100031a0
mov eax, esi
call fcn.1002a091
ret 4

Function at 0x10001d7c
Capabilities:
Print debug messages

Disassembly:
push 4
mov eax, 0x1002b4ac
call fcn.1002a0c8
mov esi, ecx
mov dword [ebp - 0x10], esi
lea edi, [esi + 4]
mov dword [esi], vtable.CMemMappedFile.0
push edi
call fcn.100026c3
pop ecx
xor eax, eax
mov dword [esi + 0x1c], eax
mov dword [esi + 0x20], eax
mov dword [esi + 0x24], eax
mov dword [esi + 0x28], eax
mov dword [esi + 0x2c], eax
mov byte [esi + 0x30], al
mov dword [ebp - 4], eax
cmp byte [0x1003cde0], al
je 0x10001de8
cmp dword [edi + 0x14], 0x10
jb 0x10001dc4
mov edi, dword [edi]
push edi
push str.CMemMappedFile__s__ctor__new_
mov edi, 0x1003c7f0
push edi
call fcn.10017159
add esp, 0xc
cmp byte [0x1003cde0], 0
je 0x10001de8
push edi
call dword [sym.imp.kernel32.dll_OutputDebugStringA]
mov eax, esi
call fcn.1002a091
ret
Function at 0x10002388
Capabilities:
Print debug messages

Disassembly:
push 0x20
mov eax, 0x1002b5ba
call fcn.1002a0fc
cmp byte [0x1003cde0], 0
mov ebx, 0x1003c7f0
mov esi, dword [ebp + 8]
je 0x100023ce
cmp dword [esi + 0x14], 8
mov eax, esi
jb 0x100023af
mov eax, dword [esi]
push eax
push str.CMemMappedFile_CreateAndLoadFromFile__file__11S_
push ebx
call fcn.10017159
add esp, 0xc
cmp byte [0x1003cde0], 0
je 0x100023ce
push ebx
call dword [sym.imp.kernel32.dll_OutputDebugStringA]
xor edi, edi
call fcn.10017159
test al, al
jne 0x1000243d
push 0x34
call fcn.10017159
pop ecx
mov dword [ebp - 0x2c], eax
xor ebx, ebx
mov dword [ebp - 4], ebx
test eax, eax
je 0x100023f8
mov ecx, eax
call fcn.10001d7c
mov edi, eax
jmp 0x100023fa
mov edi, ebx
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x28]
push esi
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x14], ebx
call fcn.10002a85
mov eax, dword [edi]
lea ecx, [ebp - 0x28]
push ecx
mov dword [ebp - 4], 1
mov esi, dword [eax + 0x28]
mov ecx, esi
call dword [0x1002e5c4]
mov ecx, edi
call esi
lea ecx, [ebp - 0x28]
mov dword [ebp - 4], 2
call fcn.10017159
jmp 0x10002548
call fcn.1001bb6e
test al, al
je 0x100024fe
push esi
call fcn.10017159
mov ebx, eax
pop ecx
test ebx, ebx
je 0x100024d1
cmp byte [0x1003cde0], 0
je 0x100024b4
cmp dword [esi + 0x14], 8
mov ecx, esi
jb 0x1000246a
mov ecx, dword [esi]
push ecx
push str.CMemMappedFile::CreateAndLoadFromFile___11S_
mov edi, 0x1003c7f0
push edi
call fcn.10017159
add esp, 0xc
cmp byte [0x1003cde0], 0
je 0x100024b4
push edi
call dword [sym.imp.kernel32.dll_OutputDebugStringA]
cmp byte [0x1003cde0], 0
je 0x100024b4
push str.CMemMappedFile___remote_creation
push edi
call fcn.10017159
cmp byte [0x1003cde0], 0
pop ecx
pop ecx
je 0x100024b4
push edi
call dword [sym.imp.kernel32.dll_OutputDebugStringA]
push ebx
call fcn.1001b987
mov edi, eax
pop ecx
push esi
mov ecx, dword [edi]
mov esi, dword [ecx + 0x28]
mov ecx, esi
call dword [0x1002e5c4]
mov ecx, edi
call esi
jmp 0x10002548
cmp byte [0x1003cde0], 0
je 0x10002548
push str.CMemMappedFile__ERROR_diskFileSize__0_
mov esi, 0x1003c7f0
push esi
call fcn.10017159
cmp byte [0x1003cde0], 0
pop ecx
pop ecx
je 0x10002548
push esi
call dword [sym.imp.kernel32.dll_OutputDebugStringA]
jmp 0x10002548
cmp byte [0x1003cde0], 0
je 0x10002524
push str.CMemMappedFile___creation_deferred
push ebx
call fcn.10017159
cmp byte [0x1003cde0], 0
pop ecx
pop ecx
je 0x10002524
push ebx
call dword [sym.imp.kernel32.dll_OutputDebugStringA]
push 0x34
call fcn.10017159
pop ecx
mov dword [ebp - 0x2c], eax
mov dword [ebp - 4], 3
test eax, eax
je 0x10002546
push esi
mov ecx, eax
call fcn.10017159
mov edi, eax
jmp 0x10002548
xor edi, edi
mov eax, edi
call fcn.1002a0a6
ret
Function at 0x10002550
Capabilities:
Print debug messages

Disassembly:
push 4
mov eax, 0x1002b5ec
call fcn.1002a0c8
cmp byte [0x1003cde0], 0
mov edi, 0x1003c7f0
mov esi, dword [ebp + 8]
je 0x1000258c
push esi
push str.CMemMappedFile_CreateWithSize__size_lu_
push edi
call fcn.10017159
add esp, 0xc
cmp byte [0x1003cde0], 0
je 0x1000258c
push edi
call dword [sym.imp.kernel32.dll_OutputDebugStringA]
call fcn.10017159
test al, al
je 0x100025cf
call fcn.1001bb6e
test al, al
je 0x100025cf
cmp byte [0x1003cde0], 0
je 0x100025c6
push esi
push str.CMemMappedFile::CreateWithSize__lu___REMOTE_CREATION_
push edi
call fcn.10017159
add esp, 0xc
cmp byte [0x1003cde0], 0
je 0x100025c6
push edi
call dword [sym.imp.kernel32.dll_OutputDebugStringA]
push esi
call fcn.1001b987
pop ecx
jmp 0x10002613
cmp byte [0x1003cde0], 0
je 0x100025f7
push esi
push str.CMemMappedFile::CreateWithSize__lu___LOCAL_CREATION_
push edi
call fcn.10017159
add esp, 0xc
cmp byte [0x1003cde0], 0
je 0x100025f7
push edi
call dword [sym.imp.kernel32.dll_OutputDebugStringA]
push 0x34
call fcn.10017159
pop ecx
mov ecx, eax
mov dword [ebp - 0x10], ecx
xor eax, eax
mov dword [ebp - 4], eax
test ecx, ecx
je 0x10002613
push esi
call fcn.10001cfb
call fcn.1002a091
ret

Function at 0x1000276d
Capabilities:
Print debug messages

Disassembly:
push 0x28
mov eax, 0x1002b656
call fcn.1002a0fc
mov ecx, dword [ebp + 0xc]
xor ebx, ebx
mov esi, dword [ebp + 8]
mov dword [ebp - 0x2c], ebx
mov dword [ebp - 0x30], ecx
cmp byte [0x1003cde0], bl
je 0x100027bd
cmp dword [esi + 0x14], 0x10
mov eax, esi
jb 0x10002799
mov eax, dword [esi]
push ecx
push eax
push str.CMemMappedFile_GetExistingMemoryMappedFile__name_s__size_lu_
mov edi, 0x1003c7f0
push edi
call fcn.10017159
add esp, 0x10
cmp byte [0x1003cde0], bl
je 0x100027bd
push edi
call dword [sym.imp.kernel32.dll_OutputDebugStringA]
push esi
call fcn.10017159
mov edi, eax
pop ecx
test edi, edi
jne 0x10002822
push 0x34
call fcn.10017159
mov edi, eax
pop ecx
mov dword [ebp - 0x34], edi
mov dword [ebp - 4], ebx
test edi, edi
je 0x10002808
push esi
lea ecx, [ebp - 0x28]
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x14], ebx
call fcn.10002a03
push dword [ebp - 0x30]
xor ebx, ebx
lea eax, [ebp - 0x28]
inc ebx
mov ecx, edi
push eax
mov byte [ebp - 4], bl
mov dword [ebp - 0x2c], ebx
call fcn.10001c71
mov edi, eax
jmp 0x1000280a
mov edi, ebx
or dword [ebp - 4], 0xffffffff
test bl, 1
je 0x10002822
lea ecx, [ebp - 0x28]
mov dword [ebp - 4], 3
call fcn.10017159
mov eax, edi
call fcn.1002a0a6
ret