joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1880f3
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0xc
push ebp
push esi
push edi
push dword [esp + 0x24]
mov edi, dword [esp + 0x24]
mov eax, 0x10001318
push edi
push eax
push edx
push ecx
call fcn.00196f8c
push edi
push eax
call fcn.00196f8c
mov dword [esp + 0x2c], 0x9c58
shl dword [esp + 0x2c], 0xb
shl dword [esp + 0x2c], 7
shl dword [esp + 0x2c], 6
xor dword [esp + 0x2c], 0x58006fa3
mov dword [esp + 0x28], 0x467b
shr dword [esp + 0x28], 4
add dword [esp + 0x28], 0xeae
shr dword [esp + 0x28], 1
xor dword [esp + 0x28], 0x9b8
mov eax, dword [0x10001318]
mov ebp, dword [0x1000131c]
xor ebp, eax
mov dword [esp + 0x30], eax
mov eax, ebp
mov ecx, ebp
and eax, 0xfffffffc
mov esi, ebp
add eax, 4
and cl, 3
cmovne esi, eax
mov eax, dword [esp + 0x28]
mov eax, dword [esp + 0x2c]
add esp, 0x18
mov ecx, esi
call fcn.001894ad
mov dword [esp + 0x10], eax
pop ecx
test eax, eax
je 0x1881df
shr esi, 2
mov edx, 0x10001320
push ebx
xor ebx, ebx
and dword [esp + 0x14], ebx
lea ecx, [esi*4 + 0x10001320]
mov esi, ecx
sub esi, edx
add esi, 3
shr esi, 2
cmp ecx, edx
cmovb esi, dword [esp + 0x14]
test esi, esi
je 0x1881d8
mov ecx, eax
sub ecx, edx
mov eax, dword [edx]
xor eax, dword [esp + 0x18]
inc ebx
mov dword [ecx + edx], eax
lea edx, [edx + 4]
cmp ebx, esi
jb 0x1881c3
mov eax, dword [esp + 0x10]
pop ebx
test edi, edi
je 0x1881df
mov dword [edi], ebp
pop edi
pop esi
pop ebp
add esp, 0xc
ret

Function at 0x1881e6
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ecx
push ecx
push ebx
mov ebx, dword [esp + 0x18]
push ebp
push dword [esp + 0x20]
mov ebp, dword [esp + 0x18]
push ebx
push dword [esp + 0x20]
push ebp
push edx
push ecx
call fcn.00196f8c
add esp, 0x18
mov dword [esp + 0x14], 0xab5a
mov eax, dword [esp + 0x14]
xor edx, edx
push 0x25
pop ecx
div ecx
mov dword [esp + 0x14], eax
add dword [esp + 0x14], 0xffff4706
xor dword [esp + 0x14], 0xffff4ba2
mov ecx, dword [ebx + 0x3c]
mov eax, dword [esp + 0x14]
add ecx, ebx
sub ebp, dword [ecx + 0x34]
mov edx, dword [ecx + eax*8 + 0x78]
mov dword [esp + 0x14], ebp
add edx, ebx
mov ebp, dword [ecx + eax*8 + 0x7c]
add ebp, edx
mov dword [esp + 0xc], ebp
cmp edx, ebp
jae 0x18829c
push esi
push edi
mov edi, dword [edx + 4]
lea esi, [edx + 8]
add edi, edx
cmp esi, edi
jae 0x188293
mov ebp, dword [esp + 0x1c]
movzx eax, word [esi]
mov ecx, eax
mov dword [esp + 0x10], 0x3000
and ecx, 0xfff
and eax, 0xf000
add ecx, dword [edx]
add ecx, ebx
cmp ax, word [esp + 0x10]
jne 0x188288
add dword [ecx], ebp
add esi, 2
cmp esi, edi
jb 0x188263
mov ebp, dword [esp + 0x14]
add edx, dword [edx + 4]
cmp edx, ebp
jb 0x188253
pop edi
pop esi
pop ebp
pop ebx
pop ecx
pop ecx
ret
Function at 0x18ab9b
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov ebx, dword [ebp + 8]
push ebx
push edx
push ecx
call fcn.00196f8c
mov dword [ebp - 4], 0xa6b3
add esp, 0xc
shl dword [ebp - 4], 6
xor dword [ebp - 4], 0x29acc0
mov dword [ebp + 8], 0xd994
add dword [ebp + 8], 0xffff1d19
shr dword [ebp + 8], 7
or dword [ebp + 8], 0x6a235ce6
xor dword [ebp + 8], 0x6bffffe9
mov dword [ebp + 8], 0x3e49
add dword [ebp + 8], 0xed7f
add dword [ebp + 8], 0xffff4b31
xor dword [ebp + 8], 0x76e9
cmp byte [ebx], 0
je 0x18ac69
push esi
push edi
mov edi, dword [ebp - 4]
mov dword [ebp + 8], 0xd994
add dword [ebp + 8], 0xffff1d19
shr dword [ebp + 8], 7
or dword [ebp + 8], 0x6a235ce6
xor dword [ebp + 8], 0x6bffffe9
mov cl, byte [ebp + 8]
mov esi, dword [ebp - 4]
mov dword [ebp + 8], 0x3e49
add dword [ebp + 8], 0xed7f
add dword [ebp + 8], 0xffff4b31
xor dword [ebp + 8], 0x76e9
shl esi, cl
mov cl, byte [ebp + 8]
mov edx, dword [ebp - 4]
movsx eax, byte [ebx]
mov dword [ebp - 4], eax
add dword [ebp - 4], esi
shl edx, cl
add dword [ebp - 4], edx
sub dword [ebp - 4], edi
inc ebx
cmp byte [ebx], 0
jne 0x18ac03
pop edi
pop esi
mov eax, dword [ebp - 4]
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x18ac71
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x10
push ebx
push ebp
push esi
push edi
push dword [esp + 0x2c]
push dword [esp + 0x2c]
push dword [esp + 0x2c]
push edx
push ecx
call fcn.00196f8c
mov dword [esp + 0x28], 0x92a2
lea edi, [ecx + 4]
or dword [esp + 0x28], 0xe114fde5
xor dword [esp + 0x28], 0xe1148c1c
mov dword [esp + 0x24], 0x6710
shl dword [esp + 0x24], 0xa
xor dword [esp + 0x24], 0x19c20f2
mov eax, dword [ecx]
mov ebp, dword [edi]
add edi, 4
xor ebp, eax
mov dword [esp + 0x2c], eax
mov dword [esp + 0x30], ebp
lea esi, [ebp + 1]
mov eax, esi
mov ecx, esi
and eax, 0xfffffffc
add eax, 4
and cl, 3
cmovne esi, eax
mov eax, dword [esp + 0x24]
mov eax, dword [esp + 0x28]
add esp, 0x10
lea ecx, [esi + esi]
call fcn.001894ad
mov ebx, eax
mov dword [esp + 0x18], ebx
pop ecx
test ebx, ebx
je 0x18ad63
shr esi, 2
xor eax, eax
lea ecx, [edi + esi*4]
mov esi, ebx
mov edx, ecx
sub edx, edi
add edx, 3
shr edx, 2
cmp edi, ecx
cmova edx, eax
test edx, edx
je 0x18ad5d
mov ebx, dword [esp + 0x18]
xor ebp, ebp
mov ecx, dword [edi]
lea edi, [edi + 4]
xor ecx, ebx
movzx eax, cl
mov word [esi], ax
mov eax, ecx
shr eax, 8
lea esi, [esi + 8]
movzx eax, al
mov word [esi - 6], ax
shr ecx, 0x10
movzx eax, cl
shr ecx, 8
inc ebp
mov word [esi - 4], ax
movzx eax, cl
mov word [esi - 2], ax
cmp ebp, edx
jb 0x18ad20
mov ebx, dword [esp + 0x14]
mov ebp, dword [esp + 0x1c]
xor eax, eax
mov word [ebx + ebp*2], ax
pop edi
pop esi
pop ebp
mov eax, ebx
pop ebx
add esp, 0x10
ret
Function at 0x192c61
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push ecx
push dword [ebp + 8]
push edx
push ecx
call fcn.00196f8c
mov dword [ebp - 4], 0x28ce
add esp, 0xc
shl dword [ebp - 4], 0xd
xor dword [ebp - 4], 0x519c10b
cmp dword [ecx + 4], 0x40
jae 0x192c8e
xor eax, eax
jmp 0x192cb7
mov ecx, dword [ecx]
mov eax, 0x5a4d
cmp word [ecx], ax
jne 0x192c8a
mov eax, dword [ecx + 0x3c]
add eax, ecx
cmp dword [eax], 0x4550
jne 0x192c8a
movzx edx, word [eax + 0x18]
mov ecx, dword [ebp - 4]
push esi
xor esi, esi
cmp edx, ecx
cmovne eax, esi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x199b2a
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x28
push ebx
push ebp
push esi
push edi
push dword [esp + 0x40]
mov ebp, ecx
push dword [esp + 0x40]
push edx
push ebp
call fcn.00196f8c
mov dword [esp + 0x3c], 0x5f0661
xor esi, esi
mov dword [esp + 0x40], 0x3030b4
add esp, 0x10
mov dword [esp + 0x34], esi
mov dword [esp + 0x10], 0xe9d0
add dword [esp + 0x10], 0xa5c0
shl dword [esp + 0x10], 9
xor dword [esp + 0x10], 0x31f4f02
mov dword [esp + 0x18], 0x902d
shr dword [esp + 0x18], 3
xor dword [esp + 0x18], 0x49d7
mov dword [esp + 0x14], 0x3568
add dword [esp + 0x14], 0xd6fe
xor dword [esp + 0x14], 0x10c66
mov eax, dword [ebp + 0x3c]
mov edi, dword [esp + 0x14]
mov dword [esp + 0x28], eax
mov ebx, dword [eax + ebp + 0x78]
add ebx, ebp
mov eax, dword [ebx + 0x1c]
mov ecx, dword [ebx + 0x20]
add eax, ebp
mov dword [esp + 0x24], eax
add ecx, ebp
mov eax, dword [ebx + 0x24]
add eax, ebp
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x20], eax
jmp 0x199bf5
mov eax, dword [ecx + edi*4]
mov edx, dword [esp + 0x40]
add eax, ebp
push eax
push dword [esp + 0x1c]
mov ecx, dword [esp + 0x18]
call fcn.0018ad6d
pop ecx
pop ecx
test eax, eax
je 0x199bfc
mov ecx, dword [esp + 0x1c]
inc edi
cmp edi, dword [ebx + 0x18]
jb 0x199bd3
jmp 0x199c22
mov eax, dword [esp + 0x20]
mov esi, dword [esp + 0x24]
movzx eax, word [eax + edi*2]
mov esi, dword [esi + eax*4]
add esi, ebp
cmp esi, ebx
jb 0x199c22
mov ecx, dword [esp + 0x28]
xor eax, eax
mov ecx, dword [ecx + ebp + 0x7c]
add ecx, ebx
cmp esi, ecx
cmovb esi, eax
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
add esp, 0x28
ret
Function at 0x10062f62
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push 0x79e7d2af
mov dword [esp + 4], 0xb52a0184
mov dword [esp], 0x8923c1ed
jmp 0x100682f6
pushfd
push 0x1f52625d
mov dword [esp + 8], 0x33f25ada
mov byte [esp + 4], bh
lea esp, [esp + 8]
jmp 0x1007845a
mov word [esp], 0x7831
xchg dword [esp + 0x14], ecx
bswap bx
movsx bx, dl
pushfd
lea ebp, [edi - 0x56db3f15]
xchg dword [esp + 0x14], esi
lea esp, [esp + 0x14]
pushal
xchg dword [esp + 0x1c], ebp
movsx bp, bl
push ecx
mov dword [esp + 0x1c], ebx
movsx bx, bl
jmp 0x10079728
setno bl
mov dword [esp + 0x18], esi
mov bl, byte [esp]
jmp 0x10077c4f

Function at 0x1006300a
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov dword [esp + 0x40], 0x30698962
push ebx
push 0xdf5f17ae
lea esp, [esp + 0x48]
jmp 0x10077819
pushfd
mov dword [esp], ebp
jnp 0x1007848d
pushfd
pushfd
mov dword [esp + 4], ebx
push ebp
pushfd
pushfd
pushfd
mov dword [esp + 0x10], esi
jmp 0x10078d3c
mov dword [esp + 0x44], esi
pushfd
pushfd
lea esp, [esp + 0x4c]
jmp 0x10077c6f
pushfd
push esp
jmp 0x10077cf4
jmp 0x10078b17
mov dword [esp + 0x40], ecx
jmp 0x10078471
pushal
mov dword [esp + 0x1c], ebx
pushfd
pushal
pushfd
pushfd
mov dword [esp + 0x44], esi
jmp 0x100788cf
mov dword [esp + 0xc], ecx
pushfd
call fcn.10078706

Function at 0x1007861f
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push dword [esp]
mov dword [esp + 0x28], esi
push 0x914cd076
push dword [esp + 4]
pushfd
mov dword [esp + 4], 0xd692be52
lea esp, [esp + 0x34]
jmp 0x10077c6f
jmp 0x10077e94

Function at 0x10078706
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov dword [esp + 0x10], esi
pushal
push 0x108f2581
mov byte [esp + 4], dh
pushfd
lea esp, [esp + 0x38]
jmp 0x10077c6f

Function at 0x10079638
Capabilities:
Encrypt data using rc4 prga

Disassembly:
dec cl
movzx eax, al
bswap ecx
mov ecx, dword [eax*4 + 0x10077fdb]
pushfd
pushfd
inc ecx
pushfd
call fcn.10077d76
Function at 0x401e95
Capabilities:
Encode data using xor
Get common file path
Set file attributes
Write file on windows

Disassembly:
push ebp
mov ebp, esp
pushal
push 0x80
push 0x40bb31
call sub.KERNEL32.DLL_SetFileAttributesA
popal
mov eax, 0x40c08d
mov word [eax], 0xa0d
add eax, 2
push 0x1fd
push eax
push 0x2734
push dword [ebp + 8]
call sub.user32.dll_GetDlgItemTextA
mov eax, 0x40c28d
mov word [eax], 0xa0d
add eax, 2
push 0x1fd
push eax
push 0x2738
push dword [ebp + 8]
call sub.user32.dll_GetDlgItemTextA
push 0x40bf85
push 0x100
call sub.KERNEL32.DLL_GetCurrentDirectoryA
push 0x40b766
push 0x40bf85
call sub.KERNEL32.DLL_lstrcatA
push 0
push 0
push 2
push 0
push 0
push 0x40000000
push 0x40bf85
call sub.KERNEL32.DLL_CreateFileA
push eax
push eax
push eax
mov ebx, eax
push 0x40c08d
call sub.KERNEL32.DLL_lstrlenA
push 0
push 0x40c089
push 0x16
push str.RAR_Registration_Data
push ebx
call sub.KERNEL32.DLL_WriteFile
pop ebx
push 0x40c08d
call sub.KERNEL32.DLL_lstrlenA
push 0
push 0x40c089
push eax
push 0x40c08d
push ebx
call sub.KERNEL32.DLL_WriteFile
pop ebx
push 0x40c28d
call sub.KERNEL32.DLL_lstrlenA
push 0
push 0x40c089
push eax
push 0x40c28d
push ebx
call sub.KERNEL32.DLL_WriteFile
pop ebx
push ebx
push 0x200
push 0x40c08d
push 0x2734
push dword [ebp + 8]
call sub.user32.dll_GetDlgItemTextA
push 0x40c08d
push 0x40c28d
call sub.KERNEL32.DLL_lstrcpyA
push 0x200
push 0x40c08d
push 0x2738
push dword [ebp + 8]
call sub.user32.dll_GetDlgItemTextA
push 0x40c08d
push 0x40c28d
call sub.KERNEL32.DLL_lstrcatA
push 0x40c28d
call sub.KERNEL32.DLL_lstrlenA
mov edx, eax
mov esi, 0x40c28d
mov al, byte [esi]
not al
xor al, dl
add al, 0x30
mov byte [esi], al
inc esi
dec edx
cmp edx, 0
jne 0x401fde
push 0x200
push 0x40c08d
call sub.KERNEL32.DLL_RtlZeroMemory
mov esi, 0x40c08d
mov word [esi], 0xa0d
push str.UID
push esi
call sub.KERNEL32.DLL_lstrcatA
push 0x40c28d
push esi
call sub.KERNEL32.DLL_lstrcatA
push 0x40bb41
push esi
call sub.KERNEL32.DLL_lstrcatA
push esi
call sub.KERNEL32.DLL_lstrlenA
push 0
push 0x40c089
push eax
push esi
push ebx
call sub.KERNEL32.DLL_WriteFile
pop ebx
push ebx
call sub.KERNEL32.DLL_CloseHandle
push 2
push 0x40bb52
call sub.KERNEL32.DLL_SetFileAttributesA
leave
ret 4
Function at 0x40289c
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
pushal
mov dword [ebp - 0x10], 0
push 0
push 0x82
push 3
push 0
push 2
push 0xc0000000
push dword [ebp + 8]
call sub.KERNEL32.DLL_CreateFileA
cmp eax, 0xffffffff
je 0x402943
mov dword [ebp - 4], eax
push 0
push 0
push 0
push 4
push 0
push eax
call sub.KERNEL32.DLL_CreateFileMappingA
or eax, eax
je 0x40293b
mov dword [ebp - 8], eax
push 0
push 0
push 0
push 2
push eax
call sub.KERNEL32.DLL_MapViewOfFile
or eax, eax
je 0x402933
mov dword [ebp - 0xc], eax
push 0
push dword [ebp - 4]
call sub.KERNEL32.DLL_GetFileSize
mov dword [ebp - 0x14], eax
push 0xffffffffffffffff
push dword [ebp - 0x14]
push 0xc
push 0x40b6d3
push 0x40b6c7
push 0x40b60f
push 0x40b603
push dword [ebp - 0xc]
call fcn.00403080
mov dword [ebp - 0x10], eax
push dword [ebp - 0xc]
call sub.KERNEL32.DLL_UnmapViewOfFile
push dword [ebp - 8]
call sub.KERNEL32.DLL_CloseHandle
push dword [ebp - 4]
call sub.KERNEL32.DLL_CloseHandle
popal
mov eax, dword [ebp - 0x10]
leave
ret 4

Function at 0x40294b
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
pushal
mov dword [ebp - 0x10], 0
push 0
push 0x82
push 3
push 0
push 2
push 0xc0000000
push dword [ebp + 8]
call sub.KERNEL32.DLL_CreateFileA
cmp eax, 0xffffffff
je 0x4029f2
mov dword [ebp - 4], eax
push 0
push 0
push 0
push 4
push 0
push eax
call sub.KERNEL32.DLL_CreateFileMappingA
or eax, eax
je 0x4029ea
mov dword [ebp - 8], eax
push 0
push 0
push 0
push 2
push eax
call sub.KERNEL32.DLL_MapViewOfFile
or eax, eax
je 0x4029e2
mov dword [ebp - 0xc], eax
push 0
push dword [ebp - 4]
call sub.KERNEL32.DLL_GetFileSize
mov dword [ebp - 0x14], eax
push 0xffffffffffffffff
push dword [ebp - 0x14]
push 0xc
push 0x40b63b
push 0x40b62f
push 0x40b577
push 0x40b56b
push dword [ebp - 0xc]
call fcn.00403080
mov dword [ebp - 0x10], eax
push dword [ebp - 0xc]
call sub.KERNEL32.DLL_UnmapViewOfFile
push dword [ebp - 8]
call sub.KERNEL32.DLL_CloseHandle
push dword [ebp - 4]
call sub.KERNEL32.DLL_CloseHandle
popal
mov eax, dword [ebp - 0x10]
leave
ret 4

Function at 0x4029fa
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
pushal
mov dword [ebp - 0x10], 0
push 0
push 0x82
push 3
push 0
push 2
push 0xc0000000
push dword [ebp + 8]
call sub.KERNEL32.DLL_CreateFileA
cmp eax, 0xffffffff
je 0x402aa1
mov dword [ebp - 4], eax
push 0
push 0
push 0
push 4
push 0
push eax
call sub.KERNEL32.DLL_CreateFileMappingA
or eax, eax
je 0x402a99
mov dword [ebp - 8], eax
push 0
push 0
push 0
push 2
push eax
call sub.KERNEL32.DLL_MapViewOfFile
or eax, eax
je 0x402a91
mov dword [ebp - 0xc], eax
push 0
push dword [ebp - 4]
call sub.KERNEL32.DLL_GetFileSize
mov dword [ebp - 0x14], eax
push 0xffffffffffffffff
push dword [ebp - 0x14]
push 6
push 0x40b64d
push 0x40b647
push 0x40b589
push 0x40b583
push dword [ebp - 0xc]
call fcn.00403080
mov dword [ebp - 0x10], eax
push dword [ebp - 0xc]
call sub.KERNEL32.DLL_UnmapViewOfFile
push dword [ebp - 8]
call sub.KERNEL32.DLL_CloseHandle
push dword [ebp - 4]
call sub.KERNEL32.DLL_CloseHandle
popal
mov eax, dword [ebp - 0x10]
leave
ret 4
Function at 0x402aa9
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
pushal
mov dword [ebp - 0x10], 0
push 0
push 0x82
push 3
push 0
push 2
push 0xc0000000
push dword [ebp + 8]
call sub.KERNEL32.DLL_CreateFileA
cmp eax, 0xffffffff
je 0x402b50
mov dword [ebp - 4], eax
push 0
push 0
push 0
push 4
push 0
push eax
call sub.KERNEL32.DLL_CreateFileMappingA
or eax, eax
je 0x402b48
mov dword [ebp - 8], eax
push 0
push 0
push 0
push 2
push eax
call sub.KERNEL32.DLL_MapViewOfFile
or eax, eax
je 0x402b40
mov dword [ebp - 0xc], eax
push 0
push dword [ebp - 4]
call sub.KERNEL32.DLL_GetFileSize
mov dword [ebp - 0x14], eax
push 0xffffffffffffffff
push dword [ebp - 0x14]
push 9
push 0x40b65c
push 0x40b653
push 0x40b598
push 0x40b58f
push dword [ebp - 0xc]
call fcn.00403080
mov dword [ebp - 0x10], eax
push dword [ebp - 0xc]
call sub.KERNEL32.DLL_UnmapViewOfFile
push dword [ebp - 8]
call sub.KERNEL32.DLL_CloseHandle
push dword [ebp - 4]
call sub.KERNEL32.DLL_CloseHandle
popal
mov eax, dword [ebp - 0x10]
leave
ret 4

Function at 0x402b58
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
pushal
mov dword [ebp - 0x10], 0
push 0
push 0x82
push 3
push 0
push 2
push 0xc0000000
push dword [ebp + 8]
call sub.KERNEL32.DLL_CreateFileA
cmp eax, 0xffffffff
je 0x402bff
mov dword [ebp - 4], eax
push 0
push 0
push 0
push 4
push 0
push eax
call sub.KERNEL32.DLL_CreateFileMappingA
or eax, eax
je 0x402bf7
mov dword [ebp - 8], eax
push 0
push 0
push 0
push 2
push eax
call sub.KERNEL32.DLL_MapViewOfFile
or eax, eax
je 0x402bef
mov dword [ebp - 0xc], eax
push 0
push dword [ebp - 4]
call sub.KERNEL32.DLL_GetFileSize
mov dword [ebp - 0x14], eax
push 0xffffffffffffffff
push dword [ebp - 0x14]
push 7
push 0x40b66c
push 0x40b665
push 0x40b5a8
push 0x40b5a1
push dword [ebp - 0xc]
call fcn.00403080
mov dword [ebp - 0x10], eax
push dword [ebp - 0xc]
call sub.KERNEL32.DLL_UnmapViewOfFile
push dword [ebp - 8]
call sub.KERNEL32.DLL_CloseHandle
push dword [ebp - 4]
call sub.KERNEL32.DLL_CloseHandle
popal
mov eax, dword [ebp - 0x10]
leave
ret 4

Function at 0x402c07
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
pushal
mov dword [ebp - 0x10], 0
push 0
push 0x82
push 3
push 0
push 2
push 0xc0000000
push dword [ebp + 8]
call sub.KERNEL32.DLL_CreateFileA
cmp eax, 0xffffffff
je 0x402cae
mov dword [ebp - 4], eax
push 0
push 0
push 0
push 4
push 0
push eax
call sub.KERNEL32.DLL_CreateFileMappingA
or eax, eax
je 0x402ca6
mov dword [ebp - 8], eax
push 0
push 0
push 0
push 2
push eax
call sub.KERNEL32.DLL_MapViewOfFile
or eax, eax
je 0x402c9e
mov dword [ebp - 0xc], eax
push 0
push dword [ebp - 4]
call sub.KERNEL32.DLL_GetFileSize
mov dword [ebp - 0x14], eax
push 0xffffffffffffffff
push dword [ebp - 0x14]
push 7
push 0x40b67b
push 0x40b673
push 0x40b5b7
push 0x40b5af
push dword [ebp - 0xc]
call fcn.00403080
mov dword [ebp - 0x10], eax
push dword [ebp - 0xc]
call sub.KERNEL32.DLL_UnmapViewOfFile
push dword [ebp - 8]
call sub.KERNEL32.DLL_CloseHandle
push dword [ebp - 4]
call sub.KERNEL32.DLL_CloseHandle
popal
mov eax, dword [ebp - 0x10]
leave
ret 4
Function at 0x402cb6
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
pushal
mov dword [ebp - 0x10], 0
push 0
push 0x82
push 3
push 0
push 2
push 0xc0000000
push dword [ebp + 8]
call sub.KERNEL32.DLL_CreateFileA
cmp eax, 0xffffffff
je 0x402d5d
mov dword [ebp - 4], eax
push 0
push 0
push 0
push 4
push 0
push eax
call sub.KERNEL32.DLL_CreateFileMappingA
or eax, eax
je 0x402d55
mov dword [ebp - 8], eax
push 0
push 0
push 0
push 2
push eax
call sub.KERNEL32.DLL_MapViewOfFile
or eax, eax
je 0x402d4d
mov dword [ebp - 0xc], eax
push 0
push dword [ebp - 4]
call sub.KERNEL32.DLL_GetFileSize
mov dword [ebp - 0x14], eax
push 0xffffffffffffffff
push dword [ebp - 0x14]
push 0xa
push 0x40b68d
push 0x40b683
push 0x40b5c9
push 0x40b5bf
push dword [ebp - 0xc]
call fcn.00403080
mov dword [ebp - 0x10], eax
push dword [ebp - 0xc]
call sub.KERNEL32.DLL_UnmapViewOfFile
push dword [ebp - 8]
call sub.KERNEL32.DLL_CloseHandle
push dword [ebp - 4]
call sub.KERNEL32.DLL_CloseHandle
popal
mov eax, dword [ebp - 0x10]
leave
ret 4

Function at 0x402d65
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
pushal
mov dword [ebp - 0x10], 0
push 0
push 0x82
push 3
push 0
push 2
push 0xc0000000
push dword [ebp + 8]
call sub.KERNEL32.DLL_CreateFileA
cmp eax, 0xffffffff
je 0x402e0c
mov dword [ebp - 4], eax
push 0
push 0
push 0
push 4
push 0
push eax
call sub.KERNEL32.DLL_CreateFileMappingA
or eax, eax
je 0x402e04
mov dword [ebp - 8], eax
push 0
push 0
push 0
push 2
push eax
call sub.KERNEL32.DLL_MapViewOfFile
or eax, eax
je 0x402dfc
mov dword [ebp - 0xc], eax
push 0
push dword [ebp - 4]
call sub.KERNEL32.DLL_GetFileSize
mov dword [ebp - 0x14], eax
push 0xffffffffffffffff
push dword [ebp - 0x14]
push 7
push 0x40b69e
push 0x40b697
push 0x40b5da
push 0x40b5d3
push dword [ebp - 0xc]
call fcn.00403080
mov dword [ebp - 0x10], eax
push dword [ebp - 0xc]
call sub.KERNEL32.DLL_UnmapViewOfFile
push dword [ebp - 8]
call sub.KERNEL32.DLL_CloseHandle
push dword [ebp - 4]
call sub.KERNEL32.DLL_CloseHandle
popal
mov eax, dword [ebp - 0x10]
leave
ret 4

Function at 0x402e14
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
pushal
mov dword [ebp - 0x10], 0
push 0
push 0x82
push 3
push 0
push 2
push 0xc0000000
push dword [ebp + 8]
call sub.KERNEL32.DLL_CreateFileA
cmp eax, 0xffffffff
je 0x402ebb
mov dword [ebp - 4], eax
push 0
push 0
push 0
push 4
push 0
push eax
call sub.KERNEL32.DLL_CreateFileMappingA
or eax, eax
je 0x402eb3
mov dword [ebp - 8], eax
push 0
push 0
push 0
push 2
push eax
call sub.KERNEL32.DLL_MapViewOfFile
or eax, eax
je 0x402eab
mov dword [ebp - 0xc], eax
push 0
push dword [ebp - 4]
call sub.KERNEL32.DLL_GetFileSize
mov dword [ebp - 0x14], eax
push 0xffffffffffffffff
push dword [ebp - 0x14]
push 7
push 0x40b6ac
push 0x40b6a5
push 0x40b5e8
push 0x40b5e1
push dword [ebp - 0xc]
call fcn.00403080
mov dword [ebp - 0x10], eax
push dword [ebp - 0xc]
call sub.KERNEL32.DLL_UnmapViewOfFile
push dword [ebp - 8]
call sub.KERNEL32.DLL_CloseHandle
push dword [ebp - 4]
call sub.KERNEL32.DLL_CloseHandle
popal
mov eax, dword [ebp - 0x10]
leave
ret 4
Function at 0x402ec3
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
pushal
mov dword [ebp - 0x10], 0
push 0
push 0x82
push 3
push 0
push 2
push 0xc0000000
push dword [ebp + 8]
call sub.KERNEL32.DLL_CreateFileA
cmp eax, 0xffffffff
je 0x402f6a
mov dword [ebp - 4], eax
push 0
push 0
push 0
push 4
push 0
push eax
call sub.KERNEL32.DLL_CreateFileMappingA
or eax, eax
je 0x402f62
mov dword [ebp - 8], eax
push 0
push 0
push 0
push 2
push eax
call sub.KERNEL32.DLL_MapViewOfFile
or eax, eax
je 0x402f5a
mov dword [ebp - 0xc], eax
push 0
push dword [ebp - 4]
call sub.KERNEL32.DLL_GetFileSize
mov dword [ebp - 0x14], eax
push 0xffffffffffffffff
push dword [ebp - 0x14]
push 0xa
push 0x40b6bd
push 0x40b6b3
push 0x40b5f9
push 0x40b5ef
push dword [ebp - 0xc]
call fcn.00403080
mov dword [ebp - 0x10], eax
push dword [ebp - 0xc]
call sub.KERNEL32.DLL_UnmapViewOfFile
push dword [ebp - 8]
call sub.KERNEL32.DLL_CloseHandle
push dword [ebp - 4]
call sub.KERNEL32.DLL_CloseHandle
popal
mov eax, dword [ebp - 0x10]
leave
ret 4

Function at 0x402f72
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
pushal
mov dword [ebp - 0x10], 0
push 0
push 0x82
push 3
push 0
push 2
push 0xc0000000
push dword [ebp + 8]
call sub.KERNEL32.DLL_CreateFileA
cmp eax, 0xffffffff
je 0x403019
mov dword [ebp - 4], eax
push 0
push 0
push 0
push 4
push 0
push eax
call sub.KERNEL32.DLL_CreateFileMappingA
or eax, eax
je 0x403011
mov dword [ebp - 8], eax
push 0
push 0
push 0
push 2
push eax
call sub.KERNEL32.DLL_MapViewOfFile
or eax, eax
je 0x403009
mov dword [ebp - 0xc], eax
push 0
push dword [ebp - 4]
call sub.KERNEL32.DLL_GetFileSize
mov dword [ebp - 0x14], eax
push 0xffffffffffffffff
push dword [ebp - 0x14]
push 0xa
push 0x40b6e9
push 0x40b6df
push 0x40b625
push 0x40b61b
push dword [ebp - 0xc]
call fcn.00403080
mov dword [ebp - 0x10], eax
push dword [ebp - 0xc]
call sub.KERNEL32.DLL_UnmapViewOfFile
push dword [ebp - 8]
call sub.KERNEL32.DLL_CloseHandle
push dword [ebp - 4]
call sub.KERNEL32.DLL_CloseHandle
popal
mov eax, dword [ebp - 0x10]
leave
ret 4