joyce8/EMBER2024-capa huggingface dataset:
Function at 0x6e034aa7
Capabilities:
Parse url

Disassembly:
push 0xc
mov eax, 0x6e04f542
call fcn.6e04ace3
mov esi, ecx
mov dword [ebp - 0x14], esi
push 7
mov dword [esi], vtable.TFUrlComponents.0
xor edx, edx
pop ecx
xor eax, eax
mov dword [esi + 0x50], edx
mov dword [esi + 0x54], ecx
mov word [esi + 0x40], ax
mov eax, dword [ebp + 0xc]
mov dword [esi + 0x5c], eax
xor eax, eax
mov byte [esi + 0x58], dl
mov dword [ebp - 4], edx
mov dword [esi + 0x70], edx
mov dword [esi + 0x74], ecx
mov word [esi + 0x60], ax
mov dword [esi + 0x88], edx
mov dword [esi + 0x8c], ecx
mov word [esi + 0x78], ax
mov dword [esi + 0xa0], edx
mov dword [esi + 0xa4], ecx
mov word [esi + 0x90], ax
mov eax, dword [ebp + 8]
xor ecx, ecx
add eax, 0x10
mov dword [esi + 4], 0x3c
mov dword [ebp - 0x18], eax
push 2
pop edx
mov edi, dword [eax]
inc edi
mov byte [ebp - 4], 4
mov eax, edi
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.6e01daf9
mov dword [esi + 8], eax
pop ecx
test eax, eax
je 0x6e034c7d
lea ebx, [edi + edi]
mov dword [esi + 0xc], edi
push ebx
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
xor ecx, ecx
mov eax, edi
push 2
pop edx
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.6e01daf9
mov dword [esi + 0x14], eax
pop ecx
test eax, eax
je 0x6e034c7d
push ebx
push 0
push eax
mov dword [esi + 0x18], edi
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
xor ecx, ecx
mov eax, edi
push 2
pop edx
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.6e01daf9
mov dword [esi + 0x20], eax
pop ecx
test eax, eax
je 0x6e034c7d
push ebx
push 0
push eax
mov dword [esi + 0x24], edi
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
xor ecx, ecx
mov eax, edi
push 2
pop edx
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.6e01daf9
mov dword [esi + 0x28], eax
pop ecx
test eax, eax
je 0x6e034c7d
push ebx
push 0
push eax
mov dword [esi + 0x2c], edi
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
xor ecx, ecx
mov eax, edi
push 2
pop edx
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.6e01daf9
mov dword [esi + 0x30], eax
pop ecx
test eax, eax
je 0x6e034c7d
push ebx
push 0
push eax
mov dword [esi + 0x34], edi
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
xor ecx, ecx
mov eax, edi
push 2
pop edx
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.6e01daf9
mov dword [esi + 0x38], eax
pop ecx
test eax, eax
je 0x6e034c7d
push ebx
push 0
push eax
mov dword [esi + 0x3c], edi
call sub.VCRUNTIME140.dll_memset
mov eax, dword [ebp + 8]
add esp, 0xc
cmp dword [eax + 0x14], 8
jb 0x6e034c4d
mov eax, dword [eax]
lea ecx, [esi + 4]
push ecx
mov ecx, dword [ebp - 0x18]
push dword [esi + 0x5c]
push dword [ecx]
push eax
call dword [sym.imp.wininet.dll_InternetCrackUrlW]
test eax, eax
je 0x6e034c7d
mov ecx, esi
call fcn.6e034e25
mov ecx, esi
call fcn.6e034ebb
mov ecx, esi
call fcn.6e034f2a
mov byte [esi + 0x58], 1
cmp byte [esi + 0x58], 0
jne 0x6e034c9d
mov ecx, esi
call fcn.6e034f91
jmp 0x6e034c9d
mov eax, esi
call fcn.6e04ac41
ret 8
Function at 0x6e03856a
Capabilities:
Query or enumerate registry value

Disassembly:
push 0x81c
mov eax, 0x6e04f8c5
call fcn.6e04acac
mov esi, dword [ebp + 8]
xor bl, bl
mov eax, esi
and dword [esi + 0x10], 0
cmp dword [esi + 0x14], 8
jb 0x6e03858c
mov eax, dword [esi]
xor ecx, ecx
mov edi, 0x20019
mov word [eax], cx
lea eax, [ebp - 0x828]
push eax
push edi
push ecx
push str.Outlook.Application
push SysReAllocStringLen
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x6e0387bd
lea eax, [ebp - 0x824]
push eax
push edi
push 0
push str.CurVer
push dword [ebp - 0x828]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x6e0387b1
lea eax, [ebp - 0x820]
mov dword [ebp - 0x820], 0x7d0
push eax
lea eax, [ebp - 0x7e0]
xor ecx, ecx
push eax
lea eax, [ebp - 0x81c]
mov dword [ebp - 0x81c], ecx
push eax
push ecx
push ecx
push dword [ebp - 0x824]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x6e0387a5
cmp dword [ebp - 0x81c], 1
jne 0x6e0387a5
cmp dword [ebp - 0x820], eax
je 0x6e0387a5
and dword [ebp - 0x7e8], eax
lea ecx, [ebp - 0x7f8]
mov word [ebp - 0x7f8], ax
lea eax, [ebp - 0x7e0]
push eax
mov dword [ebp - 0x7e4], 7
call fcn.6e010f41
and dword [ebp - 4], 0
lea ecx, [ebp - 0x7f8]
or edi, 0xffffffff
push edi
push 0x6e05bf1c
call fcn.6e01daf9
cmp eax, edi
je 0x6e038729
inc eax
cmp eax, edi
je 0x6e038729
and dword [ebp - 0x800], 0
xor ecx, ecx
push edi
push eax
lea eax, [ebp - 0x7f8]
mov word [ebp - 0x810], cx
push eax
lea ecx, [ebp - 0x810]
mov dword [ebp - 0x7fc], 7
call fcn.6e01daf9
lea eax, [ebp - 0x810]
mov ecx, esi
push eax
call fcn.6e01daf9
mov eax, dword [ebp - 0x7fc]
cmp eax, 8
jb 0x6e03871b
mov ecx, dword [ebp - 0x810]
lea eax, [eax*2 + 2]
mov dword [ebp - 0x814], eax
mov dword [ebp - 0x818], ecx
mov byte [ebp - 4], 1
cmp eax, 0x1000
jb 0x6e03870e
lea eax, [ebp - 0x814]
push eax
lea eax, [ebp - 0x818]
push eax
call fcn.6e01daf9
mov eax, dword [ebp - 0x814]
pop ecx
pop ecx
mov ecx, dword [ebp - 0x818]
push eax
push ecx
call fcn.6e01daf9
pop ecx
pop ecx
mov byte [ebp - 4], 0
push 0x6e05c910
mov ecx, esi
call fcn.6e033838
mov bl, 1
mov eax, dword [ebp - 0x7e4]
mov dword [ebp - 4], edi
cmp eax, 8
jb 0x6e03878b
mov ecx, dword [ebp - 0x7f8]
lea eax, [eax*2 + 2]
mov dword [ebp - 0x818], eax
mov dword [ebp - 0x814], ecx
mov dword [ebp - 4], 2
cmp eax, 0x1000
jb 0x6e03877f
lea eax, [ebp - 0x818]
push eax
lea eax, [ebp - 0x814]
push eax
call fcn.6e01daf9
mov eax, dword [ebp - 0x818]
pop ecx
pop ecx
mov ecx, dword [ebp - 0x814]
push eax
push ecx
call fcn.6e01daf9
pop ecx
pop ecx
mov dword [ebp - 4], edi
and dword [ebp - 0x7e8], 0
xor eax, eax
mov dword [ebp - 0x7e4], 7
mov word [ebp - 0x7f8], ax
push dword [ebp - 0x824]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push dword [ebp - 0x828]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov al, bl
call fcn.6e04ac56
ret
Function at 0x6e03a931
Capabilities:
Print debug messages

Disassembly:
push 0xc
mov eax, 0x6e04f995
call fcn.6e04ac78
cmp byte [0x6e07289b], 0
mov ebx, 0x6e072068
jne 0x6e03a954
cmp byte [0x6e07289a], 0
je 0x6e03a981
push str._PDFX__PDFXSendOrSave
push ebx
call fcn.6e01daf9
cmp byte [0x6e07289a], 0
pop ecx
pop ecx
je 0x6e03a971
push ebx
call dword [sym.imp.kernel32.dll_OutputDebugStringA]
cmp byte [0x6e07289b], 0
je 0x6e03a981
push ebx
call fcn.6e004210
pop ecx
mov edi, dword [ebp + 8]
lea eax, [ebp - 0x10]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
mov ebx, dword [edi + 0x20]
push dword [ebx + 0x24]
push eax
call fcn.6e01daf9
mov esi, eax
add esp, 0x10
test esi, esi
jne 0x6e03aac9
cmp word [ebx + 0x58], ax
jne 0x6e03aa0b
cmp byte [0x6e07289b], al
jne 0x6e03a9bc
cmp byte [0x6e07289a], al
je 0x6e03a9ee
push str._PDFX__PDFXSendOrSave_Store
mov ebx, 0x6e072068
push ebx
call fcn.6e01daf9
cmp byte [0x6e07289a], 0
pop ecx
pop ecx
je 0x6e03a9de
push ebx
call dword [sym.imp.kernel32.dll_OutputDebugStringA]
cmp byte [0x6e07289b], 0
je 0x6e03a9ee
push ebx
call fcn.6e004210
pop ecx
mov eax, dword [ebp - 0x10]
mov ecx, dword [edi + 0x10]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x18]
push eax
call fcn.6e01daf9
jmp 0x6e03aac9
cmp dword [edi + 0xc], eax
jne 0x6e03aa18
xor eax, eax
inc eax
jmp 0x6e03aacb
push dword [edi + 0xc]
push dword [ebp - 0x10]
call fcn.6e01daf9
pop ecx
pop ecx
test eax, eax
jne 0x6e03aacb
inc dword [edi + 0x38]
mov dword [ebp - 0x14], edi
and dword [ebp - 4], eax
cmp byte [0x6e07289b], al
jne 0x6e03aa55
mov al, byte [0x6e07289a]
test al, al
jne 0x6e03aa55
mov ebx, dword [ebp + 0x14]
mov edi, 0x6e072068
mov esi, ebx
shr esi, 1
jmp 0x6e03aa7a
mov ebx, dword [ebp + 0x14]
mov edi, 0x6e072068
mov esi, ebx
shr esi, 1
mov eax, esi
and eax, 1
push eax
push str._PDFX__PDFXSendOrSave_Send_waitCompleted___d
push edi
call fcn.6e01daf9
mov al, byte [0x6e07289a]
add esp, 0xc
test al, al
je 0x6e03aa85
push edi
call dword [sym.imp.kernel32.dll_OutputDebugStringA]
cmp byte [0x6e07289b], 0
je 0x6e03aa95
push edi
call fcn.6e004210
pop ecx
and esi, 1
push esi
push dword [ebp - 0x10]
call fcn.6e01daf9
mov esi, eax
pop ecx
pop ecx
test esi, esi
je 0x6e03aac1
test bl, 4
je 0x6e03aac1
call fcn.6e048bd5
shr eax, 0x10
mov cx, 9
cmp cx, ax
sbb eax, eax
and esi, eax
lea ecx, [ebp - 0x14]
call fcn.6e01daf9
mov eax, esi
call fcn.6e04ac41
ret
Function at 0x6e03ab3b
Capabilities:
Contain obfuscated stackstrings
Print debug messages

Disassembly:
push 0x54
mov eax, 0x6e04f9bf
call fcn.6e04acac
mov esi, dword [ebp + 8]
xor eax, eax
cmp word [ebp + 0x20], ax
movzx ebx, word [ebp + 0x1c]
setne al
movzx eax, ax
push eax
push esi
call fcn.6e01daf9
pop ecx
pop ecx
test eax, eax
jne 0x6e03ac9b
mov ecx, dword [ebp + 0x10]
test ecx, ecx
je 0x6e03ac98
mov edx, dword [ebp + 0x18]
test edx, edx
je 0x6e03ac98
mov eax, dword [esi + 4]
mov dword [ebp - 0x60], eax
mov dword [ebp - 0x5c], esi
inc dword [eax + 0x38]
inc dword [esi + 0x14]
and dword [ebp - 4], 0
test bx, bx
mov eax, dword [esi + 4]
mov dword [ebp - 0x54], eax
mov eax, 0x50555348
mov dword [ebp - 0x58], 0x50455354
cmovne eax, dword [ebp - 0x58]
mov dword [ebp - 0x50], eax
xor eax, eax
mov word [ebp - 0x4c], ax
test bx, bx
lea eax, [esi + 0xc]
mov dword [ebp - 0x38], ecx
mov dword [ebp - 0x48], eax
mov esi, 0x50454552
mov eax, 0x50444154
mov dword [ebp - 0x44], 4
cmovne eax, esi
mov dword [ebp - 0x34], edx
mov dword [ebp - 0x40], eax
xor eax, eax
mov word [ebp - 0x3c], ax
mov word [ebp - 0x2c], ax
lea eax, [ebp + 0x14]
mov dword [ebp - 0x28], eax
xor eax, eax
cmp byte [0x6e07289b], 0
push 4
pop ecx
mov word [ebp - 0x1c], ax
lea eax, [ebp + 0xc]
mov dword [ebp - 0x30], 0x504f4653
mov dword [ebp - 0x24], ecx
mov dword [ebp - 0x20], 0x4c454e20
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], ecx
jne 0x6e03ac21
cmp byte [0x6e07289a], 0
je 0x6e03ac6b
mov esi, dword [ebp - 0x54]
test bx, bx
mov ecx, str.kPDFXPush
mov eax, str.kPDFXPushError
cmove eax, ecx
mov ebx, 0x6e072068
push eax
push esi
push str.__lx__PDFXSendOrSave__s_
push ebx
call fcn.6e01daf9
add esp, 0x10
cmp byte [0x6e07289a], 0
je 0x6e03ac59
push ebx
call dword [sym.imp.kernel32.dll_OutputDebugStringA]
cmp byte [0x6e07289b], 0
je 0x6e03ac6e
push ebx
call fcn.6e004210
pop ecx
jmp 0x6e03ac6e
mov esi, dword [ebp - 0x54]
xor eax, eax
cmp word [ebp + 0x20], ax
push 8
pop ecx
cmovne eax, ecx
push eax
push 4
lea eax, [ebp - 0x50]
push eax
push esi
call fcn.6e03a931
add esp, 0x10
lea ecx, [ebp - 0x60]
mov esi, eax
call fcn.6e01daf9
mov eax, esi
jmp 0x6e03ac9b
push 3
pop eax
call fcn.6e04ac56
ret
Function at 0x6e03aca1
Capabilities:
Contain obfuscated stackstrings
Print debug messages

Disassembly:
push 0x50
mov eax, 0x6e04f9f3
call fcn.6e04acac
mov eax, dword [ebp + 0x10]
mov esi, dword [ebp + 8]
mov dword [ebp - 0x54], eax
xor eax, eax
cmp word [ebp + 0x1c], ax
setne al
movzx eax, ax
push eax
push esi
call fcn.6e01daf9
pop ecx
pop ecx
test eax, eax
jne 0x6e03adc5
mov eax, dword [esi + 4]
mov dword [ebp - 0x5c], eax
mov dword [ebp - 0x58], esi
inc dword [eax + 0x38]
inc dword [esi + 0x14]
and dword [ebp - 4], 0
xor eax, eax
mov ebx, dword [esi + 4]
mov word [ebp - 0x4c], ax
lea eax, [esi + 0xc]
mov dword [ebp - 0x48], eax
xor eax, eax
push 4
pop ecx
mov word [ebp - 0x3c], ax
lea eax, [ebp + 0xc]
mov dword [ebp - 0x38], eax
xor eax, eax
push 0
mov word [ebp - 0x2c], ax
mov eax, dword [ebp - 0x54]
push SysReAllocString
push eax
mov dword [ebp - 0x50], 0x50525350
mov dword [ebp - 0x44], ecx
mov dword [ebp - 0x40], 0x52535043
mov dword [ebp - 0x34], ecx
mov dword [ebp - 0x30], 0x52535048
mov dword [ebp - 0x28], eax
call fcn.6e01daf9
mov dword [ebp - 0x24], eax
add esp, 0xc
xor eax, eax
mov dword [ebp - 0x20], 0x55524544
cmp byte [0x6e07289b], 0
mov word [ebp - 0x1c], ax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x14], eax
jne 0x6e03ad69
cmp byte [0x6e07289a], 0
je 0x6e03ad9d
push ebx
push str.__lx__PDFXSendOrSave_kPDFXPushResponse_
mov esi, 0x6e072068
push esi
call fcn.6e01daf9
add esp, 0xc
cmp byte [0x6e07289a], 0
je 0x6e03ad8d
push esi
call dword [sym.imp.kernel32.dll_OutputDebugStringA]
cmp byte [0x6e07289b], 0
je 0x6e03ad9d
push esi
call fcn.6e004210
pop ecx
xor eax, eax
cmp word [ebp + 0x1c], ax
push 8
pop ecx
cmovne eax, ecx
push eax
push 4
lea eax, [ebp - 0x50]
push eax
push ebx
call fcn.6e03a931
add esp, 0x10
lea ecx, [ebp - 0x5c]
mov esi, eax
call fcn.6e01daf9
mov eax, esi
call fcn.6e04ac56
ret
Function at 0x6e03e078
Capabilities:
Print debug messages

Disassembly:
push 4
mov eax, 0x6e04fa7e
call fcn.6e04ac78
mov esi, ecx
mov dword [ebp - 0x10], esi
push dword [ebp + 8]
lea edi, [esi + 4]
mov dword [esi], vtable.CMemMappedFile.0
xor ebx, ebx
mov ecx, edi
mov dword [edi + 0x10], ebx
mov dword [edi + 0x14], ebx
call fcn.6e01daf9
mov eax, dword [ebp + 0xc]
mov dword [esi + 0x1c], ebx
mov dword [esi + 0x20], ebx
mov dword [esi + 0x24], eax
mov dword [esi + 0x28], ebx
mov dword [esi + 0x2c], ebx
mov byte [esi + 0x30], 1
mov dword [ebp - 4], ebx
cmp byte [0x6e07289b], bl
jne 0x6e03e0cd
cmp byte [0x6e07289a], bl
je 0x6e03e109
cmp dword [edi + 0x14], 0x10
jb 0x6e03e0d5
mov edi, dword [edi]
push edi
push str.CMemMappedFile__s__ctor__reference_
mov edi, 0x6e072488
push edi
call fcn.6e01daf9
add esp, 0xc
cmp byte [0x6e07289a], 0
je 0x6e03e0f9
push edi
call dword [sym.imp.kernel32.dll_OutputDebugStringA]
cmp byte [0x6e07289b], 0
je 0x6e03e109
push edi
call fcn.6e004210
pop ecx
push esi
call fcn.6e01daf9
pop ecx
mov eax, esi
call fcn.6e04ac41
ret 8

Function at 0x6e03e11a
Capabilities:
Print debug messages

Disassembly:
push 4
mov eax, 0x6e04fa7e
call fcn.6e04ac78
mov esi, ecx
mov dword [ebp - 0x10], esi
lea edi, [esi + 4]
mov dword [esi], vtable.CMemMappedFile.0
push edi
call fcn.6e03e896
pop ecx
mov eax, dword [ebp + 8]
xor ecx, ecx
mov dword [esi + 0x1c], ecx
mov dword [esi + 0x20], ecx
mov dword [esi + 0x24], eax
mov dword [esi + 0x28], ecx
mov dword [esi + 0x2c], ecx
mov byte [esi + 0x30], cl
mov dword [ebp - 4], ecx
cmp byte [0x6e07289b], cl
jne 0x6e03e165
cmp byte [0x6e07289a], cl
je 0x6e03e1a2
cmp dword [edi + 0x14], 0x10
jb 0x6e03e16d
mov edi, dword [edi]
push eax
push edi
push str.CMemMappedFile__s__ctor__new_with_size_lu_
mov edi, 0x6e072488
push edi
call fcn.6e01daf9
add esp, 0x10
cmp byte [0x6e07289a], 0
je 0x6e03e192
push edi
call dword [sym.imp.kernel32.dll_OutputDebugStringA]
cmp byte [0x6e07289b], 0
je 0x6e03e1a2
push edi
call fcn.6e004210
pop ecx
mov ecx, esi
call fcn.6e03eca0
mov eax, esi
call fcn.6e04ac41
ret 4

Function at 0x6e03e1b3
Capabilities:
Print debug messages

Disassembly:
push 4
mov eax, 0x6e04fa7e
call fcn.6e04ac78
mov esi, ecx
mov dword [ebp - 0x10], esi
lea edi, [esi + 4]
mov dword [esi], vtable.CMemMappedFile.0
push edi
call fcn.6e03e896
pop ecx
xor eax, eax
mov dword [esi + 0x1c], eax
mov dword [esi + 0x20], eax
mov dword [esi + 0x24], eax
mov dword [esi + 0x28], eax
mov dword [esi + 0x2c], eax
mov byte [esi + 0x30], al
mov dword [ebp - 4], eax
cmp byte [0x6e07289b], al
jne 0x6e03e1fb
cmp byte [0x6e07289a], al
je 0x6e03e237
cmp dword [edi + 0x14], 0x10
jb 0x6e03e203
mov edi, dword [edi]
push edi
push str.CMemMappedFile__s__ctor__new_
mov edi, 0x6e072488
push edi
call fcn.6e01daf9
add esp, 0xc
cmp byte [0x6e07289a], 0
je 0x6e03e227
push edi
call dword [sym.imp.kernel32.dll_OutputDebugStringA]
cmp byte [0x6e07289b], 0
je 0x6e03e237
push edi
call fcn.6e004210
pop ecx
mov eax, esi
call fcn.6e04ac41
ret
Function at 0x6e03e6c0
Capabilities:
Print debug messages

Disassembly:
push 4
mov eax, 0x6e04fafb
call fcn.6e04ac78
cmp byte [0x6e07289b], 0
mov edi, 0x6e072488
mov esi, dword [ebp + 8]
jne 0x6e03e6e6
cmp byte [0x6e07289a], 0
je 0x6e03e715
push esi
push str.CMemMappedFile_CreateWithSize__size_lu_
push edi
call fcn.6e01daf9
add esp, 0xc
cmp byte [0x6e07289a], 0
je 0x6e03e705
push edi
call dword [sym.imp.kernel32.dll_OutputDebugStringA]
cmp byte [0x6e07289b], 0
je 0x6e03e715
push edi
call fcn.6e004210
pop ecx
call fcn.6e01daf9
test al, al
je 0x6e03e771
call fcn.6e04068e
test al, al
je 0x6e03e771
cmp byte [0x6e07289b], 0
jne 0x6e03e739
cmp byte [0x6e07289a], 0
je 0x6e03e768
push esi
push str.CMemMappedFile::CreateWithSize__lu___REMOTE_CREATION_
push edi
call fcn.6e01daf9
add esp, 0xc
cmp byte [0x6e07289a], 0
je 0x6e03e758
push edi
call dword [sym.imp.kernel32.dll_OutputDebugStringA]
cmp byte [0x6e07289b], 0
je 0x6e03e768
push edi
call fcn.6e004210
pop ecx
push esi
call fcn.6e04048c
pop ecx
jmp 0x6e03e7ce
cmp byte [0x6e07289b], 0
jne 0x6e03e783
cmp byte [0x6e07289a], 0
je 0x6e03e7b2
push esi
push str.CMemMappedFile::CreateWithSize__lu___LOCAL_CREATION_
push edi
call fcn.6e01daf9
add esp, 0xc
cmp byte [0x6e07289a], 0
je 0x6e03e7a2
push edi
call dword [sym.imp.kernel32.dll_OutputDebugStringA]
cmp byte [0x6e07289b], 0
je 0x6e03e7b2
push edi
call fcn.6e004210
pop ecx
push 0x34
call fcn.6e01daf9
pop ecx
mov ecx, eax
mov dword [ebp - 0x10], ecx
xor eax, eax
mov dword [ebp - 4], eax
test ecx, ecx
je 0x6e03e7ce
push esi
call fcn.6e03e11a
call fcn.6e04ac41
ret

Function at 0x6e03e93e
Capabilities:
Print debug messages

Disassembly:
push 0x28
mov eax, 0x6e04fb73
call fcn.6e04acac
mov ecx, dword [ebp + 0xc]
xor ebx, ebx
mov esi, dword [ebp + 8]
mov dword [ebp - 0x2c], ebx
mov dword [ebp - 0x30], ecx
cmp byte [0x6e07289b], bl
jne 0x6e03e968
cmp byte [0x6e07289a], bl
je 0x6e03e9a5
cmp dword [esi + 0x14], 0x10
mov eax, esi
jb 0x6e03e972
mov eax, dword [esi]
push ecx
push eax
push str.CMemMappedFile_GetExistingMemoryMappedFile__name_s__size_lu_
mov edi, 0x6e072488
push edi
call fcn.6e01daf9
add esp, 0x10
cmp byte [0x6e07289a], bl
je 0x6e03e996
push edi
call dword [sym.imp.kernel32.dll_OutputDebugStringA]
cmp byte [0x6e07289b], bl
je 0x6e03e9a5
push edi
call fcn.6e004210
pop ecx
push esi
call fcn.6e01daf9
mov edi, eax
pop ecx
test edi, edi
jne 0x6e03ea0b
push 0x34
call fcn.6e01daf9
mov edi, eax
pop ecx
mov dword [ebp - 0x34], edi
mov dword [ebp - 4], ebx
test edi, edi
je 0x6e03e9f0
push esi
lea ecx, [ebp - 0x28]
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x14], ebx
call fcn.6e01daf9
push dword [ebp - 0x30]
xor ebx, ebx
lea eax, [ebp - 0x28]
inc ebx
mov ecx, edi
push eax
mov byte [ebp - 4], bl
mov dword [ebp - 0x2c], ebx
call fcn.6e03e078
mov edi, eax
jmp 0x6e03e9f2
mov edi, ebx
test bl, 1
je 0x6e03ea0b
mov eax, dword [ebp - 0x14]
cmp eax, 0x10
jb 0x6e03ea0b
inc eax
push eax
push dword [ebp - 0x28]
call fcn.6e01daf9
pop ecx
pop ecx
mov eax, edi
call fcn.6e04ac56
ret
Function at 0x6e03eca0
Capabilities:
Print debug messages

Disassembly:
mov al, byte [0x6e07289b]
push esi
mov esi, ecx
push edi
mov edi, 0x6e072488
test al, al
jne 0x6e03ecba
cmp byte [0x6e07289a], al
je 0x6e03ecf9
lea eax, [esi + 4]
cmp dword [eax + 0x14], 0x10
jb 0x6e03ecc5
mov eax, dword [eax]
push eax
push str.CMemMappedFile__s__createMemoryMappedFile
push edi
call fcn.6e01daf9
add esp, 0xc
cmp byte [0x6e07289a], 0
je 0x6e03ece4
push edi
call dword [sym.imp.kernel32.dll_OutputDebugStringA]
mov al, byte [0x6e07289b]
test al, al
je 0x6e03ecf9
push edi
call fcn.6e004210
mov al, byte [0x6e07289b]
pop ecx
mov ecx, dword [esi + 0x24]
test ecx, ecx
je 0x6e03ed95
mov ecx, esi
call fcn.6e01daf9
mov dword [esi + 0x20], eax
test eax, eax
je 0x6e03ed69
cmp byte [0x6e07289b], 0
jne 0x6e03ed24
cmp byte [0x6e07289a], 0
je 0x6e03ed61
lea eax, [esi + 4]
cmp dword [eax + 0x14], 0x10
jb 0x6e03ed2f
mov eax, dword [eax]
push dword [esi + 0x24]
push eax
push str.CMemMappedFile__s__created_file_of_size___lu
push edi
call fcn.6e01daf9
add esp, 0x10
cmp byte [0x6e07289a], 0
je 0x6e03ed51
push edi
call dword [sym.imp.kernel32.dll_OutputDebugStringA]
cmp byte [0x6e07289b], 0
je 0x6e03ed61
push edi
call fcn.6e004210
pop ecx
push esi
call fcn.6e01daf9
jmp 0x6e03eddb
cmp byte [0x6e07289b], 0
jne 0x6e03ed7b
cmp byte [0x6e07289a], 0
je 0x6e03eddc
add esi, 4
cmp dword [esi + 0x14], 0x10
jb 0x6e03ed86
mov esi, dword [esi]
call dword [sym.imp.kernel32.dll_GetLastError]
push eax
push esi
push str.CMemMappedFile__s__ERROR_CREATING__err_u_
jmp 0x6e03edb3
test al, al
jne 0x6e03eda1
cmp byte [0x6e07289a], al
je 0x6e03eddc
add esi, 4
cmp dword [esi + 0x14], 0x10
jb 0x6e03edac
mov esi, dword [esi]
push ecx
push esi
push str.CMemMappedFile__s__ERROR_CREATING__SIZE__0_
push edi
call fcn.6e01daf9
add esp, 0x10
cmp byte [0x6e07289a], 0
je 0x6e03edcc
push edi
call dword [sym.imp.kernel32.dll_OutputDebugStringA]
cmp byte [0x6e07289b], 0
je 0x6e03eddc
push edi
call fcn.6e004210
pop ecx
pop edi
pop esi
ret

Function at 0x6e03ef10
Capabilities:
Print debug messages

Disassembly:
cmp byte [0x6e07289b], 0
push esi
mov esi, ecx
jne 0x6e03ef25
cmp byte [0x6e07289a], 0
je 0x6e03ef69
lea eax, [esi + 4]
cmp dword [eax + 0x14], 0x10
jb 0x6e03ef30
mov eax, dword [eax]
push edi
push dword [esi + 0x24]
mov edi, 0x6e072488
push eax
push str.CMemMappedFile__s__size___lu
push edi
call fcn.6e01daf9
add esp, 0x10
cmp byte [0x6e07289a], 0
je 0x6e03ef58
push edi
call dword [sym.imp.kernel32.dll_OutputDebugStringA]
cmp byte [0x6e07289b], 0
je 0x6e03ef68
push edi
call fcn.6e004210
pop ecx
pop edi
mov eax, dword [esi + 0x24]
pop esi
ret
Function at 0x6e03ef80
Capabilities:
Print debug messages

Disassembly:
cmp byte [0x6e07289b], 0
push esi
mov esi, ecx
jne 0x6e03ef95
cmp byte [0x6e07289a], 0
je 0x6e03efe8
lea ecx, [esi + 4]
cmp dword [ecx + 0x14], 0x10
jb 0x6e03efa0
mov ecx, dword [ecx]
cmp dword [esi + 0x20], 0
mov edx, 0x6e0539c4
push edi
mov eax, str.true
mov edi, 0x6e072488
cmove eax, edx
push eax
push ecx
push str.CMemMappedFile__s__isValid___s
push edi
call fcn.6e01daf9
add esp, 0x10
cmp byte [0x6e07289a], 0
je 0x6e03efd7
push edi
call dword [sym.imp.kernel32.dll_OutputDebugStringA]
cmp byte [0x6e07289b], 0
je 0x6e03efe7
push edi
call fcn.6e004210
pop ecx
pop edi
cmp dword [esi + 0x20], 0
pop esi
setne al
ret
Function at 0x6e03f050
Capabilities:
Get file size
Print debug messages
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
cmp byte [0x6e07289b], 0
push ebx
push esi
mov esi, dword [ebp + 8]
mov ebx, 0x6e072488
push edi
mov edi, ecx
jne 0x6e03f074
cmp byte [0x6e07289a], 0
je 0x6e03f0b9
cmp dword [esi + 0x14], 8
mov ecx, esi
jb 0x6e03f07e
mov ecx, dword [esi]
lea eax, [edi + 4]
cmp dword [eax + 0x14], 0x10
jb 0x6e03f089
mov eax, dword [eax]
push ecx
push eax
push str.CMemMappedFile__s__load_from_file___11S
push ebx
call fcn.6e01daf9
add esp, 0x10
cmp byte [0x6e07289a], 0
je 0x6e03f0a9
push ebx
call dword [sym.imp.kernel32.dll_OutputDebugStringA]
cmp byte [0x6e07289b], 0
je 0x6e03f0b9
push ebx
call fcn.6e004210
pop ecx
xor ebx, ebx
cmp dword [esi + 0x14], 8
jb 0x6e03f0c3
mov esi, dword [esi]
push ebx
push ebx
push 3
push ebx
push 1
push SysReAllocStringLen
push esi
call dword [sym.imp.kernel32.dll_CreateFileW]
push ebx
push eax
mov dword [ebp - 8], eax
call dword [sym.imp.kernel32.dll_GetFileSize]
mov ecx, eax
test ecx, ecx
je 0x6e03f196
mov eax, dword [edi]
mov dword [edi + 0x24], ecx
push ecx
mov esi, dword [eax + 0xc]
mov ecx, esi
call dword [0x6e052870]
mov ecx, edi
call esi
test eax, eax
je 0x6e03f1e3
push ebx
lea eax, [ebp - 4]
mov dword [ebp - 4], ebx
push eax
push dword [edi + 0x24]
push dword [edi + 0x28]
push dword [ebp - 8]
call dword [sym.imp.kernel32.dll_ReadFile]
test eax, eax
je 0x6e03f12f
mov eax, dword [ebp - 4]
cmp eax, dword [edi + 0x24]
jne 0x6e03f12f
mov bl, 1
jmp 0x6e03f183
cmp byte [0x6e07289b], bl
jne 0x6e03f13f
cmp byte [0x6e07289a], bl
je 0x6e03f183
lea esi, [edi + 4]
cmp dword [esi + 0x14], 0x10
jb 0x6e03f14a
mov esi, dword [esi]
call dword [sym.imp.kernel32.dll_GetLastError]
push eax
push esi
push str.CMemMappedFile__s__ERROR_READING_FILE__err_u_
mov esi, 0x6e072488
push esi
call fcn.6e01daf9
add esp, 0x10
cmp byte [0x6e07289a], bl
je 0x6e03f174
push esi
call dword [sym.imp.kernel32.dll_OutputDebugStringA]
cmp byte [0x6e07289b], bl
je 0x6e03f183
push esi
call fcn.6e004210
pop ecx
mov eax, dword [edi]
mov esi, dword [eax + 0x10]
mov ecx, esi
call dword [0x6e052870]
mov ecx, edi
call esi
jmp 0x6e03f1e3
cmp byte [0x6e07289b], bl
jne 0x6e03f1a6
cmp byte [0x6e07289a], bl
je 0x6e03f1e3
add edi, 4
cmp dword [edi + 0x14], 0x10
jb 0x6e03f1b1
mov edi, dword [edi]
push edi
push str.CMemMappedFile__s__ERROR___EMPTY_FILE
mov esi, 0x6e072488
push esi
call fcn.6e01daf9
add esp, 0xc
cmp byte [0x6e07289a], bl
je 0x6e03f1d4
push esi
call dword [sym.imp.kernel32.dll_OutputDebugStringA]
cmp byte [0x6e07289b], bl
je 0x6e03f1e3
push esi
call fcn.6e004210
pop ecx
push dword [ebp - 8]
call dword [sym.imp.kernel32.dll_CloseHandle]
pop edi
pop esi
mov al, bl
pop ebx
leave
ret 4