joyce8/EMBER2024-capa huggingface dataset:
Function at 0x471cbc
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0
push ebx
push esi
mov ebx, eax
xor eax, eax
push ebp
push 0x471d69
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [ebx + 0x28], eax
xor eax, eax
mov dword [ebx + 0x2c], eax
xor eax, eax
mov dword [ebx + 0x30], eax
xor eax, eax
mov dword [ebx + 4], eax
mov dl, 1
mov eax, dword [0x4176dc]
call fcn.00403818
mov esi, eax
mov dword [ebx + 0xc], esi
mov eax, dword [ebx + 8]
cdq
push edx
push eax
mov eax, esi
call fcn.0041b970
mov esi, dword [ebx + 0xc]
mov eax, esi
mov edx, dword [eax]
call dword [edx]
push edx
push eax
mov eax, esi
call fcn.0041b90c
lea eax, [ebp - 4]
mov edx, 0x471d80
call fcn.004046b4
mov eax, dword [ebp - 4]
call fcn.00404adc
mov edx, eax
mov ecx, 1
mov eax, dword [ebx + 0xc]
mov esi, dword [eax]
call dword [esi + 0x10]
xor eax, eax
mov dword [ebx + 0x10], eax
xor eax, eax
mov dword [ebx + 0x14], eax
xor eax, eax
mov dword [ebx + 0x18], eax
xor eax, eax
mov dword [ebx + 0x1c], eax
mov byte [ebx + 0x34], 0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x471d70
lea eax, [ebp - 4]
call fcn.0040461c
ret
Function at 0x4bd0e2
Capabilities:
Encode data using xor

Disassembly:
call fcn.004c74be
pop edx
and ah, byte [ecx - 0x4e]
or byte [ecx + 0x75], ah
add eax, 0x928eba63
pushal
popal
jne 0x4bd0f4
arpl word [edx - 0x679f6d72], di
cwde
mov ebp, dword [edx]
jnp 0x4bd0ec
jbe 0x4bd152
imul esp, dword [ebp - 0x2675c02d], 0x71
push esp
invalid
or ah, byte [ebx - 0x38]
pushal
xchg ecx, eax
arpl word [edi], dx
stosb byte es:[edi], al
ret
mov dword [0x177eff80], eax
call 0x5ebcb8fb
sub byte [esi], dh
adc bl, 0xd
pop ss
mov edx, 0x62b899bb
pop ebp
or byte [eax + 0x30], dh
rol dword [ecx], cl
xchg esp, eax
cmp byte [edi + eax*8], al
mov ecx, 0xeb907001
adc al, 0xff
dec ecx
adc al, 0x2f
inc esi
jns 0x4bd164
cdq
mov eax, 0x70085d62
xor bl, dl
add dword [eax + edi + 0x1b9c704], edx
jo 0x4bd105
jmp 0x4bd18b
in eax, dx
insd dword es:[edi], dx
push ss
popal
inc ebp
retf
and al, 4

Function at 0x4c0f2f
Capabilities:
Packed with generic packer

Disassembly:
pushal
lea esp, [esp + 0x2c]
call fcn.004b86d3
pushfd
call fcn.004a42b9

Function at 0x4c1e53
Capabilities:
Packed with generic packer

Disassembly:
push dword [esp + 0x1c]
lea esp, [esp + 0x30]
call fcn.004b86d3
pushal
xchg dword [esp + 0x20], eax
pushal
mov byte [esp + 8], bl
push dword [esp + 0x40]
ret 0x44
mov eax, dword [0x4984c8]
call fcn.004c9aed
push 0x7bde8c
pushal
mov byte [esp], 0xce
mov dword [esp + 0x20], eax
cwde
mov eax, dword [0x498514]
pushfd
lea esp, [esp + 0x24]
jge 0x4cc10a
push 0xe4aaecd9
lea esp, [esp + 4]
call fcn.004b86d3
call fcn.004b8e18
jmp 0x4baf9e
pushfd
pushal
pushfd
call fcn.004bca7a

Function at 0x4cc0b3
Capabilities:
Packed with generic packer

Disassembly:
mov eax, dword [0x498294]
pushfd
push 0x39a8782c
call fcn.004c8f2a

Function at 0x4cc112
Capabilities:
Packed with generic packer

Disassembly:
jmp 0x4c3248
lea esp, [esp + 0x28]
call fcn.004b86d3
pushfd
pushfd
call fcn.004b4267
not ah
mov eax, dword [0x498964]
push 0x4d552fc1
mov byte [esp + 0xc], dh
jmp 0x4c250e
Function at 0x43754d
Capabilities:
Enumerate pe sections

Disassembly:
sub esp, 0x50
push ebp
lea eax, [esp + 0x28]
push edi
push eax
call fcn.004376fd
mov ecx, dword [esp + 0x5c]
xor edx, edx
xor ebp, ebp
mov dword [esp + 0xc], 1
mov edi, dword [ecx]
mov dword [esp + 0x10], 8
mov dword [esp + 0x14], 2
mov dword [esp + 0x18], 4
mov dx, word [edi + 0x14]
cmp word [edi + 6], bp
mov dword [esp + 0x1c], 0x10
mov dword [esp + 0x20], 0x80
mov dword [esp + 0x24], 0x20
mov dword [esp + 0x28], 0x40
lea eax, [edx + edi + 0x18]
jbe 0x43764b
push ebx
push esi
lea ebx, [eax + 0x24]
mov eax, dword [ebx]
mov ecx, eax
mov edx, eax
shr ecx, 0x1d
shr edx, 0x1e
mov esi, eax
and ecx, 1
and edx, 1
shr esi, 0x1f
test eax, 0x2000000
je 0x4375ee
mov eax, dword [ebx - 0x14]
mov ecx, dword [ebx - 0x1c]
push 0x4000
push eax
push ecx
call dword [esp + 0x4c]
jmp 0x437631
lea edx, [edx + ecx*2]
test eax, 0x4000000
lea ecx, [esi + edx*2]
mov esi, dword [esp + ecx*4 + 0x14]
je 0x437605
or esi, 0x200
mov edx, dword [ebx - 0x14]
mov ecx, edx
test ecx, ecx
jne 0x437620
test al, 0x40
je 0x437617
mov ecx, dword [edi + 0x20]
jmp 0x43761e
test al, 0x80
je 0x437631
mov ecx, dword [edi + 0x24]
test ecx, ecx
jbe 0x437631
mov ecx, dword [ebx - 0x1c]
lea eax, [esp + 0x10]
push eax
push esi
push edx
push ecx
call dword [esp + 0x44]
mov edx, dword [esp + 0x64]
xor eax, eax
inc ebp
add ebx, 0x28
mov edi, dword [edx]
mov ax, word [edi + 6]
cmp ebp, eax
jl 0x4375bd
pop esi
pop ebx
pop edi
pop ebp
add esp, 0x50
ret
Function at 0x10003280
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10151468
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push ebx
push esi
push edi
mov eax, dword [0x101933a0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x10], edi
test edi, edi
je 0x100032b8
push edi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov eax, dword [ebp + 8]
push 0x38
mov dword [ebp - 4], 0
mov ebx, dword [eax]
call fcn.10060ca4
mov esi, eax
add esp, 4
mov dword [ebp + 8], esi
test esi, esi
je 0x100032fc
lea eax, [esi + 0x10]
mov dword [esi + 4], 1
mov dword [esi + 8], 1
mov dword [esi], vtable.std::_Ref_count_obj_class_std::function_void____cdecl___void___.0
mov dword [eax], vtable.std::_Func_impl_no_alloc_class_std::_Binder_struct_std::_Unforced__class__lambda_e9325cb8365b8fa66ee3a54889e9c20b______void___.0
mov dword [eax + 4], ebx
mov dword [eax + 0x24], eax
jmp 0x100032fe
xor esi, esi
lea eax, [esi + 0x10]
mov dword [ebp - 0x14], esi
mov dword [ebp - 0x18], eax
test esi, esi
je 0x1000330f
lock inc dword [esi + 4]
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x1c], esi
mov eax, dword [edi + 0x30]
mov ecx, dword [edi + 0x28]
inc eax
mov byte [ebp - 4], 2
cmp ecx, eax
ja 0x10003331
push 1
lea ecx, [edi + 0x20]
call fcn.10006e10
mov ecx, dword [edi + 0x28]
lea eax, [ecx - 1]
and dword [edi + 0x2c], eax
mov ecx, dword [edi + 0x30]
add ecx, dword [edi + 0x2c]
mov eax, dword [edi + 0x28]
dec eax
and ecx, eax
lea eax, [ecx*4]
mov ecx, dword [edi + 0x24]
mov dword [ebp + 8], eax
cmp dword [ecx + eax], 0
jne 0x1000336e
push 0x28
call fcn.10060ca4
mov ecx, dword [edi + 0x24]
add esp, 4
mov edx, dword [ebp + 8]
mov dword [edx + ecx], eax
mov eax, edx
mov ecx, dword [edi + 0x24]
mov eax, dword [eax + ecx]
lea ecx, [esi + 0x10]
mov dword [eax], vtable.std::_Func_impl_no_alloc_class__lambda_08395d39e88f06bcc27be1f0d5d3a6d9___void___.0
mov dword [eax + 4], ecx
mov dword [eax + 8], esi
mov dword [eax + 0x24], eax
inc dword [edi + 0x30]
cmp dword [edi + 0x18], 0
jne 0x100033ad
lea eax, [edi + 0x1c]
push eax
push 0
push edi
push 0x10006470
push 0
push 0
call fcn.1012fce5
add esp, 0x18
mov dword [edi + 0x18], eax
mov byte [ebp + 0xb], 1
jmp 0x100033b1
mov byte [ebp + 0xb], 0
test esi, esi
je 0x100033d6
or ebx, 0xffffffff
mov eax, ebx
lock xadd dword [esi + 4], eax
jne 0x100033d6
mov eax, dword [esi]
mov ecx, esi
call dword [eax]
lock xadd dword [esi + 8], ebx
dec ebx
jne 0x100033d6
mov edx, dword [esi]
mov ecx, esi
call dword [edx + 4]
push edi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov al, byte [ebp + 0xb]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x1000bf00
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push esi
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x1000bf59
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x1000bf59
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [ebp + 0x10]
lea edx, [esi + eax]
and ecx, 0xf
jbe 0x1000bf4a
cmp esi, edx
jae 0x1000bf59
movzx eax, word [esi]
lea esi, [esi + eax*2]
add esi, 2
sub ecx, 1
jne 0x1000bf38
cmp esi, edx
jae 0x1000bf59
cmp word [esi], 0
je 0x1000bf59
mov eax, esi
pop esi
pop ebp
ret
xor eax, eax
pop esi
pop ebp
ret
Function at 0x1000e990
Capabilities:
Check if file exists
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10152296
mov eax, dword fs:[0]
push eax
sub esp, 0x210
mov eax, dword [0x101933a0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
push 0x208
lea eax, [ebp - 0x218]
push 0
push eax
call fcn.10129ae0
add esp, 0xc
lea eax, [ebp - 0x218]
push 0
push 0x1c
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
push str.2345ExplorerUser_DataDefaultHistory
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x1000eaa7
call fcn.1000b6b0
mov ecx, eax
test ecx, ecx
je 0x1000eac1
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x21c], eax
lea eax, [ebp - 0x218]
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x21c]
test eax, 0xffff0000
jne 0x1000ea50
movzx eax, ax
push eax
call fcn.1000b800
jmp 0x1000ea56
push eax
call fcn.1000e890
mov eax, dword [esi + 8]
lea ecx, [ebp - 0x21c]
mov dword [ebp - 4], 1
push ecx
cmp dword [esi + 0xc], eax
je 0x1000ea79
mov ecx, eax
call fcn.1000a7a0
add dword [esi + 8], 4
jmp 0x1000ea82
push eax
lea ecx, [esi + 4]
call fcn.1000e680
mov edx, dword [ebp - 0x21c]
or eax, 0xffffffff
mov dword [ebp - 4], 0xffffffff
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x1000eaa7
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.10061045
mov esp, ebp
pop ebp
ret
push 0x80004005
call fcn.1000b280
int3
Function at 0x10013c80
Capabilities:
Check if file exists
Get common file path
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x101529d6
mov eax, dword fs:[0]
push eax
sub esp, 0x424
mov eax, dword [0x101933a0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
push 0x208
lea eax, [ebp - 0x218]
push 0
push eax
call fcn.10129ae0
add esp, 0xc
lea eax, [ebp - 0x218]
push 0
push 0x1c
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
push 0x208
lea eax, [ebp - 0x420]
push 0
push eax
call fcn.10129ae0
add esp, 0xc
mov dword [ebp - 0x430], 1
lea eax, [ebp - 0x42c]
mov dword [ebp - 0x42c], 0x104
push eax
lea eax, [ebp - 0x420]
push eax
lea eax, [ebp - 0x430]
push eax
push str.DisplayVersion
push str.SoftwareMicrosoftWindowsCurrentVersionUninstallliebao
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
test eax, eax
jne 0x10013e35
mov dword [ebp - 0x428], eax
lea eax, [ebp - 0x428]
push eax
lea eax, [ebp - 0x420]
push 0x1015cc98
push eax
call fcn.10013e70
add esp, 0xc
lea eax, [ebp - 0x218]
cmp dword [ebp - 0x428], 7
jl 0x10013d6b
push str.Liebao7User_DataDefaultHistory
jmp 0x10013d70
push str.liebaoUser_DataDefaultHistory
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x10013e25
call fcn.1000b6b0
mov ecx, eax
test ecx, ecx
je 0x10013e50
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x424], eax
lea eax, [ebp - 0x218]
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x424]
test eax, 0xffff0000
jne 0x10013dce
movzx eax, ax
push eax
call fcn.1000b800
jmp 0x10013dd4
push eax
call fcn.1000e890
mov eax, dword [edi + 8]
lea ecx, [ebp - 0x424]
mov dword [ebp - 4], 1
push ecx
cmp dword [edi + 0xc], eax
je 0x10013df7
mov ecx, eax
call fcn.1000a7a0
add dword [edi + 8], 4
jmp 0x10013e00
push eax
lea ecx, [edi + 4]
call fcn.1000e680
mov edx, dword [ebp - 0x424]
or eax, 0xffffffff
mov dword [ebp - 4], 0xffffffff
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x10013e25
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
cmp dword [ebp - 0x428], 7
jge 0x10013e35
mov eax, dword [edi]
mov ecx, edi
call dword [eax + 0x10]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.10061045
mov esp, ebp
pop ebp
ret
push 0x80004005
call fcn.1000b280
int3
Function at 0x10013ea0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10152296
mov eax, dword fs:[0]
push eax
sub esp, 0x210
mov eax, dword [0x101933a0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
push 0x208
lea eax, [ebp - 0x218]
push 0
push eax
call fcn.10129ae0
add esp, 0xc
lea eax, [ebp - 0x218]
push 0
push 0x1c
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
push str.TencentQQBrowserUser_DataDefaultHistory
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
call fcn.1000b6b0
mov ecx, eax
test ecx, ecx
je 0x10013fbc
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x21c], eax
lea eax, [ebp - 0x218]
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x21c]
test eax, 0xffff0000
jne 0x10013f4b
movzx eax, ax
push eax
call fcn.1000b800
jmp 0x10013f51
push eax
call fcn.1000e890
mov eax, dword [esi + 8]
lea ecx, [ebp - 0x21c]
mov dword [ebp - 4], 1
push ecx
cmp dword [esi + 0xc], eax
je 0x10013f74
mov ecx, eax
call fcn.1000a7a0
add dword [esi + 8], 4
jmp 0x10013f7d
push eax
lea ecx, [esi + 4]
call fcn.1000e680
mov edx, dword [ebp - 0x21c]
or eax, 0xffffffff
mov dword [ebp - 4], 0xffffffff
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x10013fa2
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.10061045
mov esp, ebp
pop ebp
ret
push 0x80004005
call fcn.1000b280
int3
Function at 0x1001c350
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10151468
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push ebx
push esi
push edi
mov eax, dword [0x101933a0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x10], edi
test edi, edi
je 0x1001c388
push edi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov eax, dword [ebp + 8]
push 0x38
mov dword [ebp - 4], 0
mov ebx, dword [eax]
call fcn.10060ca4
mov esi, eax
add esp, 4
mov dword [ebp + 8], esi
test esi, esi
je 0x1001c3cc
lea eax, [esi + 0x10]
mov dword [esi + 4], 1
mov dword [esi + 8], 1
mov dword [esi], vtable.std::_Ref_count_obj_class_std::function_void____cdecl___void___.0
mov dword [eax], vtable.std::_Func_impl_no_alloc_class_std::_Binder_struct_std::_Unforced__class__lambda_74c3529b9421067b1ea608689d55b705______void___.0
mov dword [eax + 4], ebx
mov dword [eax + 0x24], eax
jmp 0x1001c3ce
xor esi, esi
lea eax, [esi + 0x10]
mov dword [ebp - 0x14], esi
mov dword [ebp - 0x18], eax
test esi, esi
je 0x1001c3df
lock inc dword [esi + 4]
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x1c], esi
mov eax, dword [edi + 0x30]
mov ecx, dword [edi + 0x28]
inc eax
mov byte [ebp - 4], 2
cmp ecx, eax
ja 0x1001c401
push 1
lea ecx, [edi + 0x20]
call fcn.10006e10
mov ecx, dword [edi + 0x28]
lea eax, [ecx - 1]
and dword [edi + 0x2c], eax
mov ecx, dword [edi + 0x30]
add ecx, dword [edi + 0x2c]
mov eax, dword [edi + 0x28]
dec eax
and ecx, eax
lea eax, [ecx*4]
mov ecx, dword [edi + 0x24]
mov dword [ebp + 8], eax
cmp dword [ecx + eax], 0
jne 0x1001c43e
push 0x28
call fcn.10060ca4
mov ecx, dword [edi + 0x24]
add esp, 4
mov edx, dword [ebp + 8]
mov dword [edx + ecx], eax
mov eax, edx
mov ecx, dword [edi + 0x24]
mov eax, dword [eax + ecx]
lea ecx, [esi + 0x10]
mov dword [eax], vtable.std::_Func_impl_no_alloc_class__lambda_9c6163e4fb6938d8d84e0acd6fac75a5___void___.0
mov dword [eax + 4], ecx
mov dword [eax + 8], esi
mov dword [eax + 0x24], eax
inc dword [edi + 0x30]
cmp dword [edi + 0x18], 0
jne 0x1001c47d
lea eax, [edi + 0x1c]
push eax
push 0
push edi
push 0x10006470
push 0
push 0
call fcn.1012fce5
add esp, 0x18
mov dword [edi + 0x18], eax
mov byte [ebp + 0xb], 1
jmp 0x1001c481
mov byte [ebp + 0xb], 0
test esi, esi
je 0x1001c4a6
or ebx, 0xffffffff
mov eax, ebx
lock xadd dword [esi + 4], eax
jne 0x1001c4a6
mov eax, dword [esi]
mov ecx, esi
call dword [eax]
lock xadd dword [esi + 8], ebx
dec ebx
jne 0x1001c4a6
mov edx, dword [esi]
mov ecx, esi
call dword [edx + 4]
push edi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov al, byte [ebp + 0xb]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x10028400
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10151468
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push ebx
push esi
push edi
mov eax, dword [0x101933a0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x10], edi
test edi, edi
je 0x10028438
push edi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov eax, dword [ebp + 0xc]
push 0x38
mov dword [ebp - 4], 0
mov ebx, dword [eax]
call fcn.10060ca4
mov esi, eax
add esp, 4
mov dword [ebp + 0xc], esi
test esi, esi
je 0x10028482
mov eax, dword [ebp + 8]
lea ecx, [esi + 0x10]
mov dword [esi + 4], 1
mov dword [esi + 8], 1
mov dword [esi], vtable.std::_Ref_count_obj_class_std::function_void____cdecl___void___.0
mov dword [ecx], vtable.std::_Func_impl_no_alloc_class_std::_Binder_struct_std::_Unforced__void____cdecl___void____class_DBHelperImpl____void___.0
mov dword [ecx + 4], eax
mov dword [ecx + 8], ebx
mov dword [ecx + 0x24], ecx
jmp 0x10028484
xor esi, esi
lea eax, [esi + 0x10]
mov dword [ebp - 0x14], esi
mov dword [ebp - 0x18], eax
test esi, esi
je 0x10028495
lock inc dword [esi + 4]
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x1c], esi
mov eax, dword [edi + 0x30]
mov ecx, dword [edi + 0x28]
inc eax
mov byte [ebp - 4], 2
cmp ecx, eax
ja 0x100284b7
push 1
lea ecx, [edi + 0x20]
call fcn.10006e10
mov ecx, dword [edi + 0x28]
lea eax, [ecx - 1]
and dword [edi + 0x2c], eax
mov ecx, dword [edi + 0x30]
add ecx, dword [edi + 0x2c]
mov eax, dword [edi + 0x28]
dec eax
and ecx, eax
lea eax, [ecx*4]
mov ecx, dword [edi + 0x24]
mov dword [ebp + 0xc], eax
cmp dword [ecx + eax], 0
jne 0x100284f4
push 0x28
call fcn.10060ca4
mov ecx, dword [edi + 0x24]
add esp, 4
mov edx, dword [ebp + 0xc]
mov dword [edx + ecx], eax
mov eax, edx
mov ecx, dword [edi + 0x24]
mov eax, dword [eax + ecx]
lea ecx, [esi + 0x10]
mov dword [eax], vtable.std::_Func_impl_no_alloc_class__lambda_4587e1104aa284930250f996995fd393___void___.0
mov dword [eax + 4], ecx
mov dword [eax + 8], esi
mov dword [eax + 0x24], eax
inc dword [edi + 0x30]
cmp dword [edi + 0x18], 0
jne 0x10028533
lea eax, [edi + 0x1c]
push eax
push 0
push edi
push 0x10006470
push 0
push 0
call fcn.1012fce5
add esp, 0x18
mov dword [edi + 0x18], eax
mov byte [ebp + 0xf], 1
jmp 0x10028537
mov byte [ebp + 0xf], 0
test esi, esi
je 0x1002855c
or ebx, 0xffffffff
mov eax, ebx
lock xadd dword [esi + 4], eax
jne 0x1002855c
mov eax, dword [esi]
mov ecx, esi
call dword [eax]
lock xadd dword [esi + 8], ebx
dec ebx
jne 0x1002855c
mov edx, dword [esi]
mov ecx, esi
call dword [edx + 4]
push edi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov al, byte [ebp + 0xf]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x1002a780
Capabilities:
Check if file exists
Copy file
Delete file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10154b18
mov eax, dword fs:[0]
push eax
sub esp, 0x20
mov eax, dword [0x101933a0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, dword [ebp + 8]
lea ecx, [ebp - 0x28]
mov esi, dword [ebp + 0xc]
push 0
push 0x1015b608
mov dword [ebp - 0x2c], 0
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0xf
mov byte [ebp - 0x28], 0
call fcn.100084b0
lea eax, [ebp - 0x28]
mov dword [ebp - 4], 0
push eax
call fcn.1002c990
mov bl, al
add esp, 4
test bl, bl
je 0x1002a8df
cmp dword [ebp - 0x18], 0
je 0x1002a8df
cmp dword [edi + 0x14], 0x10
mov eax, edi
jb 0x1002a80a
mov eax, dword [edi]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
test eax, eax
je 0x1002a8e1
cmp dword [esi + 0x14], 0x10
mov eax, esi
jb 0x1002a823
mov eax, dword [esi]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
test eax, eax
je 0x1002a83f
cmp dword [esi + 0x14], 0x10
mov eax, esi
jb 0x1002a838
mov eax, dword [esi]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
cmp dword [esi + 0x14], 0x10
mov eax, esi
jb 0x1002a849
mov eax, dword [esi]
cmp dword [edi + 0x14], 0x10
jb 0x1002a851
mov edi, dword [edi]
push 0
push eax
push edi
call dword [sym.imp.KERNEL32.dll_CopyFileA]
cmp dword [esi + 0x14], 0x10
mov eax, esi
jb 0x1002a865
mov eax, dword [esi]
push 1
lea ecx, [ebp - 0x2c]
push ecx
push eax
call fcn.100f4f90
add esp, 0xc
test eax, eax
jne 0x1002a8e1
mov ecx, dword [ebp - 0x2c]
test ecx, ecx
je 0x1002a8e1
cmp dword [ebp - 0x14], 0x10
lea eax, [ebp - 0x28]
push dword [ebp - 0x18]
cmovae eax, dword [ebp - 0x28]
push eax
push ecx
call fcn.100f4f40
add esp, 0xc
test eax, eax
jne 0x1002a8e1
push eax
push eax
push dword [ebp - 0x2c]
call fcn.100f52d0
mov edx, dword [ebp - 0x14]
add esp, 0xc
test eax, eax
sete bl
cmp edx, 0x10
jb 0x1002a8e9
mov ecx, dword [ebp - 0x28]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x1002a8d3
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x1002a92a
push edx
push ecx
call fcn.10060cd4
add esp, 8
jmp 0x1002a8e9
xor bl, bl
lea ecx, [ebp - 0x28]
call fcn.10004da0
mov eax, dword [ebp - 0x2c]
test eax, eax
je 0x1002a8f9
push eax
call fcn.1006afd0
add esp, 4
test bl, bl
jne 0x1002a90c
cmp dword [esi + 0x14], 0x10
jb 0x1002a905
mov esi, dword [esi]
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.10061045
mov esp, ebp
pop ebp
ret
call fcn.1012d1a9
int3