joyce8/EMBER2024-capa huggingface dataset:
Function at 0x55652f
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
push ebx
call fcn.0054894d
mov edi, dword [ebp + 0x10]
pop ecx
push 1
pop esi
sub eax, edi
je 0x5565f5
dec eax
push edi
push ebx
mov dword [ebp - 4], eax
call fcn.00549703
pop ecx
pop ecx
cmp eax, 3
jne 0x5565c8
push edi
push ebx
call fcn.00548a08
pop ecx
pop ecx
push 0
push edi
push ebx
test eax, eax
je 0x55658a
call fcn.0054955a
push edx
push eax
push 0x5a8e5c
push dword [ebp + 0xc]
call fcn.00533ee5
add esp, 0x1c
jmp 0x5565a5
call fcn.00549623
fstp qword [esp + 4]
mov dword [esp], 0x59b7a8
push dword [ebp + 0xc]
call fcn.00533ee5
add esp, 0x10
test esi, esi
je 0x5565ad
test eax, eax
jg 0x5565f0
xor esi, esi
mov eax, dword [ebp - 4]
inc edi
test eax, eax
jne 0x55654e
test esi, esi
jne 0x5565f5
push esi
push esi
push ebx
call fcn.00549fad
add esp, 0xc
jmp 0x5565f8
lea eax, [ebp + 0x10]
push eax
push edi
push ebx
call fcn.00549d0c
add esp, 0xc
test esi, esi
je 0x5565ad
push dword [ebp + 0xc]
push dword [ebp + 0x10]
push 1
push eax
call fcn.0051d8bb
add esp, 0x10
cmp eax, dword [ebp + 0x10]
jne 0x5565ad
xor esi, esi
inc esi
jmp 0x5565af
xor eax, eax
inc eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x556948
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1014
call fcn.00482f70
mov eax, dword [0x5bd06c]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
lea ecx, [ebp - 0x1014]
push esi
mov esi, dword [ebp + 0xc]
push edi
push ecx
push eax
call fcn.00549c00
pop ecx
pop ecx
mov edi, 0x1000
lea eax, [ebp - 0x1014]
push edi
push eax
call fcn.0054a536
push esi
push edi
push 1
push eax
call fcn.0051e021
add dword [ebp - 0x100c], eax
add esp, 0x18
cmp eax, edi
je 0x55697b
lea eax, [ebp - 0x1014]
push eax
call fcn.0054a5b5
pop ecx
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.00482224
mov esp, ebp
pop ebp
ret

Function at 0x42e000
Capabilities:
Encode data using xor

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
mov ebx, 0x407ef8
nop
mov ecx, 0x5d4304e
nop
nop
nop
test eax, eax
nop
nop
nop
nop
nop
nop
je 0x42e04e
nop
nop
nop
xor dword [eax], ecx
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
inc eax
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x42e024
nop
nop
nop
nop
mov eax, section..rsrc
nop
nop
mov ebx, 0x42cd70
nop
mov ecx, 0x665d0f5e
nop
nop
test eax, eax
nop
nop
nop
nop
je 0x42e084
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
add eax, 4
nop
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
jne 0x42e06c
nop
nop
nop
nop
nop
nop
nop
popal
nop
jmp 0x401219
Function at 0x10003650
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1006bd5a
mov eax, dword fs:[0]
push eax
sub esp, 0x20
mov eax, dword [0x100962c4]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x28], esi
mov edi, dword [ebp + 8]
push 0
mov dword [ebp - 0x2c], esi
call fcn.10044266
mov dword [ebp - 4], 0
mov dword [esi + 4], 0
mov byte [esi + 8], 0
mov dword [esi + 0xc], 0
mov byte [esi + 0x10], 0
xor eax, eax
mov dword [esi + 0x14], 0
mov word [esi + 0x18], ax
mov dword [esi + 0x1c], eax
mov word [esi + 0x20], ax
mov dword [esi + 0x24], eax
mov byte [esi + 0x28], al
mov dword [esi + 0x2c], eax
mov byte [esi + 0x30], al
mov byte [ebp - 4], 6
test edi, edi
jne 0x10003710
lea eax, [ebp - 0x20]
mov dword [ebp - 0x24], vtable.std::exception.0
push eax
lea eax, [ebp - 0x18]
mov dword [ebp - 0x18], str.bad_locale_name
xorps xmm0, xmm0
mov byte [ebp - 0x14], 1
push eax
movq qword [ebp - 0x20], xmm0
call fcn.1004b53d
add esp, 8
mov dword [ebp - 0x24], vtable.std::runtime_error.0
lea eax, [ebp - 0x24]
push 0x10094728
push eax
call fcn.1004cc2d
push edi
push esi
call fcn.100445ae
add esp, 8
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.10049b55
mov esp, ebp
pop ebp
ret 4
Function at 0x10004850
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1006bfc8
mov eax, dword fs:[0]
push eax
sub esp, 0x228
mov eax, dword [0x100962c4]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x230], esi
mov dword [ebp - 0x214], 0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
mov dword [esi + 0x14], 0xf
cmp dword [esi + 0x14], 0x10
mov dword [ebp - 0x234], esi
mov dword [esi + 0x10], 0
jb 0x100048ba
mov eax, dword [esi]
jmp 0x100048bc
mov eax, esi
mov byte [eax], 0
lea eax, [ebp - 0x210]
mov dword [ebp - 4], 0
push eax
push 0
push 0
push 0x23
push 0
mov dword [ebp - 0x214], 1
call dword [sym.imp.SHELL32.dll_SHGetFolderPathA]
test eax, eax
je 0x100048fc
push 0xe
push str.C:ProgramData
mov ecx, esi
call fcn.10002f60
jmp 0x100049b2
cmp byte [ebp - 0x210], 0
mov dword [ebp - 0x218], 0xf
mov dword [ebp - 0x21c], 0
mov byte [ebp - 0x22c], 0
jne 0x10004924
xor ecx, ecx
jmp 0x10004939
lea ecx, [ebp - 0x210]
lea edx, [ecx + 1]
nop dword [eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x10004930
sub ecx, edx
push ecx
lea eax, [ebp - 0x210]
push eax
lea ecx, [ebp - 0x22c]
call fcn.10002f60
lea eax, [ebp - 0x22c]
cmp esi, eax
je 0x10004994
mov eax, dword [esi + 0x14]
cmp eax, 0x10
jb 0x10004969
inc eax
mov ecx, esi
push eax
push dword [esi]
call fcn.10003190
mov dword [esi + 0x14], 0xf
cmp dword [esi + 0x14], 0x10
mov dword [esi + 0x10], 0
jb 0x10004981
mov eax, dword [esi]
jmp 0x10004983
mov eax, esi
mov byte [eax], 0
mov ecx, esi
lea eax, [ebp - 0x22c]
push eax
call fcn.1000d5a0
mov eax, dword [ebp - 0x218]
cmp eax, 0x10
jb 0x100049b2
inc eax
lea ecx, [ebp - 0x22c]
push eax
push dword [ebp - 0x22c]
call fcn.10003190
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.10049b55
mov esp, ebp
pop ebp
ret

Function at 0x10004ca0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x60
mov eax, dword [0x100962c4]
xor eax, esp
mov dword [esp + 0x5c], eax
push esi
push edi
mov edi, edx
mov esi, ecx
cmp dword [edi], 0x20
jae 0x10004cd2
xor al, al
pop edi
pop esi
mov ecx, dword [esp + 0x5c]
xor ecx, esp
call fcn.10049b55
mov esp, ebp
pop ebp
ret
mov ecx, 1
call fcn.1000a5c0
lea ecx, [esp + 0x2c]
push ecx
push 0x30
lea ecx, [esp + 0x38]
push ecx
push 3
call eax
test eax, eax
jne 0x10004cbf
mov dword [esp + 0xc], 0x310030
xor edx, edx
mov dword [esp + 0x10], 0x330032
mov dword [esp + 0x14], 0x350034
mov dword [esp + 0x18], 0x370036
mov dword [esp + 0x1c], 0x390038
mov dword [esp + 0x20], 0x420041
mov dword [esp + 0x24], 0x440043
mov dword [esp + 0x28], 0x460045
mov cl, byte [esp + edx + 0x30]
lea esi, [esi + 4]
movzx eax, cl
inc edx
shr eax, 4
movzx eax, word [esp + eax*2 + 0xc]
mov word [esi - 4], ax
movsx eax, cl
and eax, 0xf
movzx eax, word [esp + eax*2 + 0xc]
mov word [esi - 2], ax
cmp edx, 0x10
jne 0x10004d32
mov ecx, dword [esp + 0x64]
mov al, 1
mov dword [edi], 0x20
pop edi
pop esi
xor ecx, esp
call fcn.10049b55
mov esp, ebp
pop ebp
ret
Function at 0x10005130
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x100962c4]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push ebx
mov ebx, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0x10]
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0x10]
push eax
push 1
push 0
push edx
push 0x80000002
mov byte [ebp - 0x11], 0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x100051b6
mov eax, dword [edi]
push esi
mov esi, dword [ebp - 0x10]
mov dword [ebp - 8], eax
lea eax, [ebp - 8]
push eax
push dword [ebp - 0xc]
lea eax, [ebp - 0xc]
mov dword [edi], 0
push eax
push 0
push ebx
push esi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
sete bl
test bl, bl
je 0x1000519c
mov eax, dword [ebp - 8]
mov dword [edi], eax
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
pop edi
mov al, bl
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10049b55
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
mov al, byte [ebp - 0x11]
xor ecx, ebp
pop edi
pop ebx
call fcn.10049b55
mov esp, ebp
pop ebp
ret
Function at 0x100051d0
Capabilities:
Persist via run registry key
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1006c088
mov eax, dword fs:[0]
push eax
sub esp, 0x14
mov eax, dword [0x100962c4]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, dword [ebp + 0xc]
xor bl, bl
cmp dword [edi + 0x14], 0x10
mov dword [edi + 0x10], 0
jb 0x10005211
mov eax, dword [edi]
jmp 0x10005213
mov eax, edi
mov byte [eax], 0
lea eax, [ebp - 0x1c]
push eax
push 1
push 0
push str.SOFTWAREMicrosoftWindowsCurrentVersionExplorerShell_Folders
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x100052fe
mov esi, dword [ebp - 0x1c]
mov dword [ebp - 0x20], esi
mov dword [ebp - 4], eax
lea eax, [ebp - 0x14]
push eax
push 0
lea eax, [ebp - 0x18]
push eax
push 0
push str.Common_AppData
push esi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov ecx, eax
mov eax, dword [ebp - 0x18]
cmp eax, 1
je 0x1000526a
cmp eax, 2
jne 0x100052f7
test ecx, ecx
jne 0x100052f7
mov ecx, dword [edi + 0x10]
mov eax, dword [ebp - 0x14]
cmp eax, ecx
ja 0x10005295
mov dword [edi + 0x10], eax
cmp dword [edi + 0x14], 0x10
jb 0x1000528d
mov ecx, dword [edi]
mov byte [ecx + eax], 0
jmp 0x100052a1
mov ecx, edi
mov byte [ecx + eax], 0
jmp 0x100052a1
sub eax, ecx
mov ecx, edi
push 0
push eax
call fcn.1000ea30
cmp dword [edi + 0x14], 0x10
jb 0x100052ab
mov eax, dword [edi]
jmp 0x100052ad
mov eax, edi
lea ecx, [ebp - 0x14]
push ecx
push eax
lea eax, [ebp - 0x18]
push eax
push 0
push str.Common_AppData
push dword [ebp - 0x1c]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x100052f7
mov edx, dword [edi + 0x14]
cmp edx, 0x10
jb 0x100052d6
mov ecx, dword [edi]
jmp 0x100052d8
mov ecx, edi
mov eax, dword [edi + 0x10]
dec eax
add eax, ecx
cmp edx, 0x10
jb 0x100052e7
mov ecx, dword [edi]
jmp 0x100052e9
mov ecx, edi
sub eax, ecx
mov ecx, edi
push 1
push eax
call fcn.10002ec0
mov bl, 1
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.10049b55
mov esp, ebp
pop ebp
ret
Function at 0x100057e0
Capabilities:
Clear file content
Get file size
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [0x100962c4]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
lea eax, [ebp - 0x10]
mov ebx, ecx
push eax
push ebx
mov esi, edx
call dword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
jne 0x10005819
xor al, al
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10049b55
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 0xc]
xor edx, edx
cmp edx, ecx
jl 0x10005885
mov eax, dword [ebp - 0x10]
jg 0x1000582b
cmp esi, eax
jbe 0x10005885
push ecx
push ecx
push eax
mov ecx, ebx
call fcn.10004bf0
add esp, 0xc
test al, al
je 0x10005806
sub esi, dword [ebp - 0x10]
je 0x100058a9
mov eax, 0x200
cmp esi, 0x200
mov edi, esi
push 0
cmova edi, eax
lea eax, [ebp - 8]
push eax
push edi
push 0x1009a948
push ebx
call dword [sym.imp.KERNEL32.dll_WriteFile]
cmp dword [ebp - 8], edi
jne 0x10005806
mov eax, 0x200
sub esi, edi
jne 0x10005846
mov al, 1
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10049b55
mov esp, ebp
pop ebp
ret
push ecx
push edx
push esi
mov ecx, ebx
call fcn.10004bf0
add esp, 0xc
test al, al
je 0x10005806
push ebx
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
test eax, eax
je 0x10005806
mov ecx, dword [ebp - 4]
mov al, 1
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10049b55
mov esp, ebp
pop ebp
ret
Function at 0x100063a0
Capabilities:
Check for time delay via gettickcount
Check for time delay via queryperformancecounter
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
mov eax, dword [0x100962c4]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, ecx
cmp dword [esi + 0xc], 0
jne 0x100063e1
mov eax, dword [0x1009ad68]
test eax, eax
jne 0x100063cf
lea eax, [ebp - 0x34]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [ebp - 0x20]
mov ecx, 1
cmp ecx, eax
sbb eax, eax
and eax, 0xffffffe0
add eax, 0x20
mov dword [esi + 0xc], eax
mov eax, dword [esi + 0xc]
cmp eax, 8
jb 0x10006475
cmp eax, 0x20
jae 0x10006406
pause
inc dword [esi + 0xc]
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10049b55
mov esp, ebp
pop ebp
ret
jne 0x1000645a
call fcn.100062f0
mov dword [esi + 8], eax
lea eax, [ebp - 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
test eax, eax
jne 0x1000643d
call dword [sym.imp.KERNEL32.dll_GetTickCount]
xor ecx, ecx
mov dword [esi], eax
inc dword [esi + 0xc]
mov dword [esi + 4], ecx
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10049b55
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 0xc]
mov eax, dword [ebp - 0x10]
inc dword [esi + 0xc]
mov dword [esi], eax
mov dword [esi + 4], ecx
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10049b55
mov esp, ebp
pop ebp
ret
cmp dword [esi + 8], 0
jne 0x10006487
and al, 1
je 0x100064bc
call dword [sym.imp.KERNEL32.dll_SwitchToThread]
test eax, eax
jne 0x10006475
push eax
call dword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, dword [ebp - 4]
inc dword [esi + 0xc]
xor ecx, ebp
pop esi
call fcn.10049b55
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
test eax, eax
jne 0x1000649f
call dword [sym.imp.KERNEL32.dll_GetTickCount]
xor ecx, ecx
jmp 0x100064a5
mov ecx, dword [ebp - 0xc]
mov eax, dword [ebp - 0x10]
sub eax, dword [esi]
sbb ecx, dword [esi + 4]
test ecx, ecx
jb 0x10006464
ja 0x100064b5
cmp eax, dword [esi + 8]
jb 0x10006464
mov dword [esi + 8], 0
push 1
jmp 0x1000646f
Function at 0x1000d840
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1006be86
mov eax, dword fs:[0]
push eax
push esi
push edi
mov eax, dword [0x100962c4]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
push 8
mov dword [edi], vtable.std::basic_streambuf_char__struct_std::char_traits_char__.0
call fcn.10049b66
mov esi, eax
xorps xmm0, xmm0
movq qword [esi], xmm0
push 1
mov dword [ebp - 4], 0
call fcn.100444ab
mov dword [esi + 4], eax
lea ecx, [edi + 8]
lea eax, [edi + 4]
mov dword [edi + 0x34], esi
mov dword [edi + 0xc], eax
add esp, 8
lea eax, [edi + 0x14]
mov dword [edi + 0x10], ecx
mov dword [edi + 0x1c], eax
lea eax, [edi + 0x18]
mov dword [edi + 0x20], eax
lea eax, [edi + 0x24]
mov dword [edi + 0x2c], eax
lea eax, [edi + 0x28]
mov dword [edi + 0x30], eax
mov dword [ecx], 0
mov eax, dword [edi + 0x20]
mov dword [eax], 0
mov eax, dword [edi + 0x30]
mov dword [eax], 0
mov eax, dword [edi + 0xc]
mov dword [eax], 0
mov eax, dword [edi + 0x1c]
mov dword [eax], 0
mov eax, dword [edi + 0x2c]
mov dword [eax], 0
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x1001baf0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1006e3e8
mov eax, dword fs:[0]
push eax
sub esp, 0x22c
mov eax, dword [0x100962c4]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x230], esi
mov dword [ebp - 0x214], 0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
mov dword [esi + 0x14], 0xf
cmp dword [esi + 0x14], 0x10
mov dword [ebp - 0x234], esi
mov dword [esi + 0x10], 0
jb 0x1001bb5a
mov eax, dword [esi]
jmp 0x1001bb5c
mov eax, esi
mov byte [eax], 0
lea eax, [ebp - 0x210]
mov dword [ebp - 4], 0
push eax
push 0
push 0
push 0x23
push 0
mov dword [ebp - 0x214], 1
call dword [sym.imp.SHELL32.dll_SHGetFolderPathA]
test eax, eax
je 0x1001bb9c
push 0xe
push str.C:ProgramData
mov ecx, esi
call fcn.10002f60
jmp 0x1001bc52
cmp byte [ebp - 0x210], 0
mov dword [ebp - 0x218], 0xf
mov dword [ebp - 0x21c], 0
mov byte [ebp - 0x22c], 0
jne 0x1001bbc4
xor ecx, ecx
jmp 0x1001bbd9
lea ecx, [ebp - 0x210]
lea edx, [ecx + 1]
nop dword [eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x1001bbd0
sub ecx, edx
push ecx
lea eax, [ebp - 0x210]
push eax
lea ecx, [ebp - 0x22c]
call fcn.10002f60
lea eax, [ebp - 0x22c]
cmp esi, eax
je 0x1001bc34
mov eax, dword [esi + 0x14]
cmp eax, 0x10
jb 0x1001bc09
inc eax
mov ecx, esi
push eax
push dword [esi]
call fcn.10003190
mov dword [esi + 0x14], 0xf
cmp dword [esi + 0x14], 0x10
mov dword [esi + 0x10], 0
jb 0x1001bc21
mov eax, dword [esi]
jmp 0x1001bc23
mov eax, esi
mov byte [eax], 0
mov ecx, esi
lea eax, [ebp - 0x22c]
push eax
call fcn.1000d5a0
mov eax, dword [ebp - 0x218]
cmp eax, 0x10
jb 0x1001bc52
inc eax
lea ecx, [ebp - 0x22c]
push eax
push dword [ebp - 0x22c]
call fcn.10003190
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.10049b55
mov esp, ebp
pop ebp
ret
Function at 0x1002af10
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push esi
mov esi, ecx
cmp dword [esi + 0x14], 0
jne 0x1002af2f
push 0
push 0x5e
push str.e:workcodegsspcommonpoco_foundation_srcFile_WIN32U.cpp
push str.__path.empty__
call fcn.100249c0
add esp, 0x10
cmp dword [esi + 0x30], 8
lea eax, [esi + 0x1c]
jb 0x1002af3a
mov eax, dword [eax]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x1002af66
call dword [sym.imp.KERNEL32.dll_GetLastError]
add eax, 0xfffffffe
cmp eax, 0x13
ja case.0x1002af5b.4
movzx eax, byte [eax + 0x1002af7c]
jmp dword [eax*4 + 0x1002af74]
xor al, al
pop esi
ret
mov al, 1
pop esi
ret
lea eax, [esi + 4]
push eax
call fcn.1002b0b0
nop
bound ebp, qword [edi - 0x5095effe]
add dl, byte [eax]
add byte [eax], al
add dword [ecx], eax
add dword [ecx], eax
add dword [ecx], eax
add dword [ecx], eax
add dword [ecx], eax
add dword [eax], eax
add dword [ecx], eax
add dword [ecx], eax
add dword [eax], eax
Function at 0x1002b0b0
Capabilities:
Check for software breakpoints

Disassembly:
push ebp
mov ebp, esp
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x1006f778
push eax
mov dword fs:[0], esp
sub esp, 0x84
push esi
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
cmp esi, 0x10b
ja 0x1002b288
je case.0x1002b0fe.123
lea eax, [esi - 2]
cmp eax, 0xcc
ja case.0x1002b0fe.4
movzx eax, byte [eax + 0x1002b324]
jmp dword [eax*4 + 0x1002b2e8]
push esi
push dword [ebp + 8]
lea ecx, [ebp - 0x38]
call fcn.100255a0
push 0x10090e5c
lea eax, [ebp - 0x38]
push eax
call fcn.1004cc2d
push esi
push dword [ebp + 8]
lea ecx, [ebp - 0x38]
call fcn.10025480
push 0x10090f34
lea eax, [ebp - 0x38]
push eax
call fcn.1004cc2d
push esi
push dword [ebp + 8]
lea ecx, [ebp - 0x38]
call fcn.10025550
push 0x10090e14
lea eax, [ebp - 0x38]
push eax
call fcn.1004cc2d
push esi
push dword [ebp + 8]
lea ecx, [ebp - 0x38]
call fcn.10025120
push 0x10090f7c
lea eax, [ebp - 0x38]
push eax
call fcn.1004cc2d
push esi
push dword [ebp + 8]
lea ecx, [ebp - 0x38]
call fcn.100251f0
push 0x1009109c
lea eax, [ebp - 0x38]
push eax
call fcn.1004cc2d
push esi
push dword [ebp + 8]
lea ecx, [ebp - 0x38]
call fcn.10025d80
push 0x1009100c
lea eax, [ebp - 0x38]
push eax
call fcn.1004cc2d
push esi
push dword [ebp + 8]
lea ecx, [ebp - 0x38]
call fcn.10025b40
push 0x10091054
lea eax, [ebp - 0x38]
push eax
call fcn.1004cc2d
push str.sharing_violation
lea ecx, [ebp - 0x24]
call fcn.10002d90
mov dword [ebp - 4], 0
push esi
push dword [ebp + 8]
lea eax, [ebp - 0x24]
push eax
lea ecx, [ebp - 0x64]
call fcn.100254d0
push 0x10090dd0
lea eax, [ebp - 0x64]
push eax
call fcn.1004cc2d
push str.lock_violation
lea ecx, [ebp - 0x24]
call fcn.10002d90
mov dword [ebp - 4], 1
jmp 0x1002b1cf
push str.EOF_reached
lea ecx, [ebp - 0x24]
call fcn.10002d90
push esi
push dword [ebp + 8]
lea eax, [ebp - 0x24]
mov dword [ebp - 4], 2
push eax
lea ecx, [ebp - 0x64]
call fcn.10025b10
push 0x10091054
jmp 0x1002b1e4
push str.disk_is_full
lea ecx, [ebp - 0x24]
call fcn.10002d90
push esi
push dword [ebp + 8]
lea eax, [ebp - 0x24]
mov dword [ebp - 4], 3
push eax
lea ecx, [ebp - 0x64]
call fcn.10025d50
push 0x1009100c
jmp 0x1002b1e4
push str.negative_seek
lea ecx, [ebp - 0x24]
call fcn.10002d90
mov dword [ebp - 4], 4
jmp 0x1002b1cf
push esi
push dword [ebp + 8]
lea ecx, [ebp - 0x64]
call fcn.100259e0
push 0x10090d48
jmp 0x1002b1e4
cmp esi, 0x781
je case.0x1002b0fe.3
cmp esi, 0x1779
je 0x1002b2b7
push esi
push dword [ebp + 8]
lea ecx, [ebp - 0x90]
call fcn.10025500
push 0x10090dd0
lea eax, [ebp - 0x90]
jmp 0x1002b1e7
push 0x1779
push dword [ebp + 8]
lea ecx, [ebp - 0x64]
call fcn.100255f0
push 0x10090eec
jmp 0x1002b1e4
push esi
push dword [ebp + 8]
lea ecx, [ebp - 0x64]
call fcn.10025990
push 0x10090ea4
jmp 0x1002b1e4
Function at 0x1002b760
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push esi
mov esi, ecx
cmp dword [esi + 0x14], 0
jne 0x1002b782
push 0
push 0x9f
push str.e:workcodegsspcommonpoco_foundation_srcFile_WIN32U.cpp
push str.__path.empty__
call fcn.100249c0
add esp, 0x10
cmp dword [esi + 0x30], 8
lea eax, [esi + 0x1c]
jb 0x1002b78d
mov eax, dword [eax]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x1002b7a1
shr eax, 4
and eax, 1
pop esi
ret
lea eax, [esi + 4]
push eax
call fcn.1002b0b0
int3

Function at 0x1002b7b0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
jmp 0x1002b7c0
push esi
mov esi, ecx
cmp dword [esi + 0x14], 0
jne 0x1002b7e2
push 0
push 0xaa
push str.e:workcodegsspcommonpoco_foundation_srcFile_WIN32U.cpp
push str.__path.empty__
call fcn.100249c0
add esp, 0x10
cmp dword [esi + 0x30], 8
lea eax, [esi + 0x1c]
jb 0x1002b7ed
mov eax, dword [eax]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov ecx, eax
cmp ecx, 0xffffffff
je 0x1002b80e
and ecx, 0x410
xor eax, eax
cmp ecx, 0x400
pop esi
sete al
ret
lea eax, [esi + 4]
push eax
call fcn.1002b0b0
int3

Function at 0x1002bbd0
Capabilities:
Move file

Disassembly:
push ebp
mov ebp, esp
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x1006f7d8
push eax
mov dword fs:[0], esp
sub esp, 0x18
push esi
mov esi, ecx
cmp dword [esi + 0x14], 0
jne 0x1002bc0d
push 0
push 0x133
push str.e:workcodegsspcommonpoco_foundation_srcFile_WIN32U.cpp
push str.__path.empty__
call fcn.100249c0
add esp, 0x10
xor eax, eax
mov dword [ebp - 0x10], 7
mov dword [ebp - 0x14], 0
mov word [ebp - 0x24], ax
mov dword [ebp - 4], eax
lea eax, [ebp - 0x24]
push eax
push dword [ebp + 8]
call fcn.1002ac30
add esp, 8
lea ecx, [ebp - 0x24]
test byte [ebp + 0xc], 1
lea eax, [esi + 0x1c]
je 0x1002bc66
cmp dword [ebp - 0x10], 8
cmovae ecx, dword [ebp - 0x24]
cmp dword [eax + 0x14], 8
jb 0x1002bc4f
mov eax, dword [eax]
push 0
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
test eax, eax
jne 0x1002bc8d
lea eax, [esi + 4]
push eax
call fcn.1002b0b0
cmp dword [ebp - 0x10], 8
cmovae ecx, dword [ebp - 0x24]
cmp dword [eax + 0x14], 8
jb 0x1002bc76
mov eax, dword [eax]
push 1
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
test eax, eax
jne 0x1002bc8d
lea eax, [esi + 4]
push eax
call fcn.1002b0b0
mov eax, dword [ebp - 0x10]
pop esi
cmp eax, 8
jb 0x1002bca3
inc eax
lea ecx, [ebp - 0x24]
push eax
push dword [ebp - 0x24]
call fcn.1000e870
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 8