joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10004c30
Capabilities:
Initialize winsock library

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x194
mov eax, dword [0x1008c224]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
lea eax, [ebp - 0x194]
push eax
push 2
call dword [sym.imp.WS2_32.dll_WSAStartup]
mov esi, eax
test esi, esi
je 0x10004c7f
push esi
call sym.vmtools.dll_Err_Errno2String
push eax
push esi
push str.SimpleSock:_Error_in_WSAStartup:__d__s__n
call sym.vmtools.dll_Warning
add esp, 0x10
xor eax, eax
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1004e3f2
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 0x194]
cmp al, 2
jne 0x10004ca6
mov ecx, eax
shr ecx, 8
test cl, cl
jne 0x10004ca6
mov eax, 1
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1004e3f2
mov esp, ebp
pop ebp
ret
mov edx, eax
shr edx, 8
movzx ecx, dl
movzx edx, al
push ecx
push edx
push str.SimpleSock:_Unsupported_Winsock_version__d._d_n
call sym.vmtools.dll_Warning
mov ecx, dword [ebp - 4]
add esp, 0xc
xor ecx, ebp
xor eax, eax
pop esi
call fcn.1004e3f2
mov esp, ebp
pop ebp
ret

Function at 0x10004ce0
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, dword [ebp + 0x10]
push edi
test esi, esi
jle 0x10004d42
mov ebx, dword [ebp + 0xc]
mov edi, dword [ebp + 8]
push 0
push esi
push ebx
push edi
call dword [sym.imp.WS2_32.dll_recv]
test eax, eax
je 0x10004d5e
cmp eax, 0xffffffff
jne 0x10004d37
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov edi, eax
cmp edi, 0x2714
je 0x10004d3b
push edi
call sym.vmtools.dll_Err_Errno2String
push eax
mov eax, dword [ebp + 8]
push edi
push eax
push str.SimpleSock:_Recv_error_for_socket__d:__d__s_
call sym.vmtools.dll_Warning
add esp, 0x14
pop edi
pop esi
xor eax, eax
pop ebx
pop ebp
ret
sub esi, eax
add ebx, eax
test esi, esi
jg 0x10004cf0
mov esi, dword [ebp + 0x10]
mov ecx, dword [ebp + 8]
push ecx
push esi
push str.SimpleSock:_Recved__d_bytes_from_socket__d_n
call sym.vmtools.dll_Debug
add esp, 0xc
pop edi
pop esi
mov eax, 1
pop ebx
pop ebp
ret
push edi
push str.SimpleSock:_Socket__d_closed_by_peer.
call sym.vmtools.dll_Debug
add esp, 8
pop edi
pop esi
xor eax, eax
pop ebx
pop ebp
ret

Function at 0x10004d80
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, dword [ebp + 0x10]
push edi
xor edi, edi
test esi, esi
jle 0x10004de4
nop
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
push 0
push esi
lea ecx, [edi + eax]
push ecx
push edx
call dword [sym.imp.WS2_32.dll_send]
cmp eax, 0xffffffff
jne 0x10004dd9
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov ebx, eax
cmp ebx, 0x2714
je 0x10004ddd
push ebx
call sym.vmtools.dll_Err_Errno2String
push eax
mov eax, dword [ebp + 8]
push ebx
push eax
push str.SimpleSock:_Send_error_for_socket__d:__d__s_
call sym.vmtools.dll_Warning
add esp, 0x14
pop edi
pop esi
xor eax, eax
pop ebx
pop ebp
ret
sub esi, eax
add edi, eax
test esi, esi
jg 0x10004d90
mov esi, dword [ebp + 0x10]
mov ecx, dword [ebp + 8]
push ecx
push esi
push str.SimpleSock:_Sent__d_bytes_from_socket__d_n
call sym.vmtools.dll_Debug
add esp, 0xc
pop edi
pop esi
mov eax, 1
pop ebx
pop ebp
ret
Function at 0x100061c0
Capabilities:
Get session user name

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x208
mov eax, dword [0x1008c224]
xor eax, ebp
mov dword [ebp - 4], eax
xor eax, eax
push 0x1fe
push eax
lea ecx, [ebp - 0x202]
push ecx
mov word [ebp - 0x204], ax
call sub.MSVCR90.dll_memset
mov eax, dword [0x1008cd90]
add esp, 0xc
mov dword [ebp - 0x208], 0x100
test eax, eax
jne 0x1000624b
lea edx, [ebp - 0x208]
push edx
lea eax, [ebp - 0x204]
push eax
call dword [sym.imp.ADVAPI32.dll_GetUserNameW]
test eax, eax
je 0x10006246
push 0
push 0
push 0
lea ecx, [ebp - 0x204]
push 0xffffffffffffffff
push ecx
call sub.glib_2.0.dll_g_utf16_to_utf8
add esp, 0x14
mov dword [0x1008cd90], eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1004e3f2
mov esp, ebp
pop ebp
ret
mov eax, dword [0x1008cd90]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1004e3f2
mov esp, ebp
pop ebp
ret

Function at 0x100067e2
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword fs:[0x30]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0xc]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
add eax, 0xc
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
mov eax, dword [eax]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
cmp eax, dword [ebp - 8]
je 0x10006842
mov eax, dword [ebp - 4]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
push dword [eax + 0x30]
call fcn.1000679b
pop ecx
cmp dword [ebp + 8], eax
jne 0x10006838
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0x18]
jmp 0x10006844
mov eax, dword [ebp - 4]
mov eax, dword [eax]
mov dword [ebp - 4], eax
jmp 0x10006811
xor eax, eax
mov esp, ebp
pop ebp
ret

Function at 0x100068bc
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 0xc]
add ecx, dword [eax + 0x3c]
mov dword [ebp - 0xc], ecx
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
mov edx, dword [ebp + 0xc]
add edx, dword [ecx + eax*8 + 0x78]
mov dword [ebp - 8], edx
mov eax, dword [ebp - 8]
mov ecx, dword [ebp + 0xc]
add ecx, dword [eax + 0x20]
mov dword [ebp - 0x10], ecx
mov eax, dword [ebp - 8]
mov ecx, dword [ebp + 0xc]
add ecx, dword [eax + 0x1c]
mov dword [ebp - 0x1c], ecx
mov eax, dword [ebp - 8]
mov ecx, dword [ebp + 0xc]
add ecx, dword [eax + 0x24]
mov dword [ebp - 0x18], ecx
and dword [ebp - 4], 0
jmp 0x1000690f
mov eax, dword [ebp - 4]
inc eax
mov dword [ebp - 4], eax
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 4]
cmp ecx, dword [eax + 0x18]
jae 0x10006954
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 0x10]
mov edx, dword [ebp + 0xc]
add edx, dword [ecx + eax*4]
mov dword [ebp - 0x14], edx
push dword [ebp - 0x14]
push dword [ebp + 0x14]
call fcn.1000686d
pop ecx
pop ecx
cmp eax, dword [ebp + 0x10]
jne 0x10006952
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 0x18]
movzx eax, word [ecx + eax*2]
mov ecx, dword [ebp - 0x1c]
mov edx, dword [ebp + 0xc]
add edx, dword [ecx + eax*4]
mov eax, edx
jmp 0x10006956
jmp 0x10006908
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x10007130
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
push ecx
mov ecx, dword [esi + 0x80]
push 2
push 1
lea eax, [ebp - 1]
push eax
push ecx
call dword [sym.imp.WS2_32.dll_recv]
cmp eax, 1
jne 0x10007158
mov ecx, esi
mov dword [esi + 0x38], eax
call fcn.100070c0
mov esp, ebp
pop ebp
ret

Function at 0x100071a0
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov ebx, dword [0x1008cd9c]
push esi
mov esi, eax
mov ecx, dword [esi]
push edi
mov edi, 0x38
test cl, 4
je 0x100071c0
mov edi, 0x3b
mov eax, dword [esi + 0x3c]
test al, 8
je 0x100071ca
or edi, 4
or eax, ecx
test al, 0x10
je 0x1000721b
mov eax, dword [esi + 0x80]
push eax
call sub.glib_2.0.dll_g_io_channel_win32_new_socket
add esp, 4
test byte [esi], 4
mov dword [esi + 0x8c], eax
je 0x1000720e
mov edx, dword [esi + 0x80]
push 2
push 1
lea ecx, [ebp - 1]
push ecx
push edx
call dword [sym.imp.WS2_32.dll_recv]
cmp eax, 1
jne 0x1000720e
mov ecx, esi
mov dword [esi + 0x38], eax
call fcn.100070c0
test byte [esi + 0x3c], 8
je 0x10007242
call fcn.10007160
jmp 0x10007242
test al, al
jns 0x1000722d
mov eax, dword [esi + 0x80]
push eax
call sub.glib_2.0.dll_g_io_channel_win32_new_fd
jmp 0x10007239
mov ecx, dword [esi + 0x80]
push ecx
call sub.glib_2.0.dll_g_io_channel_win32_new_messages
mov dword [esi + 0x8c], eax
add esp, 4
mov edx, dword [esi + 0x8c]
push esi
push 0x10007960
push edi
push edx
call sub.glib_2.0.dll_g_io_add_watch
mov dword [esi + 0x88], eax
mov eax, dword [esi + 0x80]
mov ecx, dword [ebx + 4]
push esi
push eax
push ecx
call sub.glib_2.0.dll_g_hash_table_insert
add esp, 0x1c
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x10007b50
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
push ebx
push str.panic.commitAddrSpaceReserved
push 0
call sym.vmtools.dll_Preference_GetBool
push str.panic.addrSpaceReservedKB
push 0x1800
mov bl, al
call sym.vmtools.dll_Config_GetLong
add esp, 0x10
test eax, eax
je 0x10007c1b
cmp eax, 0x5000
jbe 0x10007b8b
mov eax, 0x5000
shl eax, 0xa
mov dword [0x1008cda4], eax
xor eax, eax
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], eax
mov dword [ebp - 4], eax
lea eax, [ebp - 0x24]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov ecx, dword [ebp - 0x20]
mov edx, dword [0x1008cda4]
lea eax, [edx + ecx - 1]
xor edx, edx
div ecx
push 1
imul eax, ecx
movsx ecx, bl
neg ecx
sbb ecx, ecx
and ecx, 0x1000
add ecx, 0x2000
push ecx
push eax
push 0
mov dword [0x1008cda4], eax
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov ecx, dword [0x1008cda4]
shr ecx, 0xa
mov dword [0x1008cda8], eax
cmp ecx, 0x1800
je 0x10007c1b
test eax, eax
je 0x10007c1b
push ecx
push eax
push str.Reserved_virtual_address_space_for_CoreDump_addr:_p__size:_IuKB__n
call sym.vmtools.dll_Log
add esp, 0xc
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10008430
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push edi
mov edi, dword [ebp + 8]
mov ebx, eax
push 0x1c
lea eax, [ebp - 0x20]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
jne 0x10008456
pop edi
xor al, al
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 0x1c]
cdq
push edi
mov dword [ebx], eax
mov dword [ebx + 4], edx
call sym.vmtools.dll_W32Util_GetModuleByAddress
add esp, 4
test eax, eax
je 0x1000844e
push eax
call sym.vmtools.dll_Win32U_GetModuleFileName
mov ecx, dword [ebp + 0x10]
add esp, 4
mov dword [ecx], eax
test eax, eax
je 0x1000844e
push esi
mov esi, dword [ebx]
push 0x40
push esi
call dword [sym.imp.KERNEL32.dll_IsBadReadPtr]
test eax, eax
jne 0x10008509
mov esi, dword [esi + 0x3c]
add esi, dword [ebx]
push pe_nt_image_headers32
push esi
call dword [sym.imp.KERNEL32.dll_IsBadReadPtr]
test eax, eax
jne 0x10008509
movzx edx, word [esi + 0x14]
add edx, 0xf8
push edx
push esi
call dword [sym.imp.KERNEL32.dll_IsBadReadPtr]
test eax, eax
jne 0x10008509
movzx eax, word [esi + 0x14]
lea eax, [eax + esi + 0x18]
push 0x28
push eax
mov dword [ebp + 0xc], eax
call dword [sym.imp.KERNEL32.dll_IsBadReadPtr]
test eax, eax
jne 0x10008509
movzx eax, word [esi + 6]
sub edi, dword [ebx]
xor ebx, ebx
mov ecx, edi
mov dword [ebp - 4], eax
test eax, eax
jbe 0x10008509
mov eax, dword [ebp + 0xc]
add eax, 0x10
mov esi, dword [eax]
mov edi, dword [eax - 8]
mov edx, dword [eax - 4]
cmp esi, edi
ja 0x100084f6
mov esi, edi
cmp ecx, edx
jb 0x10008500
add esi, edx
cmp ecx, esi
jbe 0x10008512
inc ebx
add eax, 0x28
cmp ebx, dword [ebp - 4]
jb 0x100084e8
pop esi
pop edi
xor al, al
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp + 0x14]
inc ebx
pop esi
sub ecx, edx
mov edx, dword [ebp + 0x18]
mov dword [eax], ebx
pop edi
mov dword [edx], ecx
mov al, 1
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10008530
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [0x1008cddc]
test eax, eax
je 0x10008556
mov eax, dword [ebp + 8]
test eax, eax
je 0x1000868a
mov ecx, dword [0x1008cdd8]
mov dword [eax], ecx
mov al, byte [0x1008cde0]
pop ebp
ret
call fcn.10007e40
mov eax, dword [0x1008cddc]
test eax, eax
jne 0x1000866c
push str.dbghelp.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov dword [0x1008cdd8], eax
test eax, eax
jne 0x1000858e
push str.CoreDump:_Cant_find_DbgHelp.dll__n
call sym.vmtools.dll_Warning
add esp, 4
jmp 0x1000866c
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push edi
push str.SymInitializeW
push eax
call esi
mov edx, dword [0x1008cdd8]
push str.SymGetModuleBase64
push edx
mov edi, eax
call esi
mov dword [0x1008cdc4], eax
mov eax, dword [0x1008cdd8]
push str.SymLoadModuleExW
push eax
call esi
mov ecx, dword [0x1008cdd8]
push str.SymSetSearchPathW
push ecx
mov dword [0x1008cdcc], eax
call esi
mov edx, dword [0x1008cdd8]
push str.SymFromAddrW
push edx
mov dword [0x1008cdd0], eax
call esi
mov dword [0x1008cdc8], eax
mov eax, dword [0x1008cdd8]
push str.SymGetSymFromAddr64
push eax
call esi
mov dword [0x1008cdd4], eax
test edi, edi
jne 0x10008608
push str.CoreDump:_Cant_find_SymInitializeW__n
jmp 0x10008662
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call edi
test eax, eax
jne 0x10008620
push str.CoreDump:_SymInitializeW_failed_n
jmp 0x10008662
cmp dword [0x1008cdc4], 0
je 0x1000865d
cmp dword [0x1008cdcc], 0
je 0x1000865d
cmp dword [0x1008cdd0], 0
je 0x1000865d
cmp dword [0x1008cdc8], 0
jne 0x10008654
cmp dword [0x1008cdd4], 0
jne 0x10008654
push str.CoreDump:_Failed_to_resolve_dbghelp.dll_symbols._No_backtrace._____n
jmp 0x10008662
mov byte [0x1008cde0], 1
jmp 0x1000866a
push str.CoreDump:_Failed_to_resolve_dbghelp.dll_symbols__ver._6.3_required___No_backtrace._____n
call sym.vmtools.dll_Warning
add esp, 4
pop edi
pop esi
mov eax, dword [ebp + 8]
test eax, eax
je 0x1000867b
mov ecx, dword [0x1008cdd8]
mov dword [eax], ecx
mov dword [0x1008cddc], 1
call fcn.10007e60
mov al, byte [0x1008cde0]
pop ebp
ret

Function at 0x100092e0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
lea eax, [ebp - 0xc]
sub esp, 0xc
push eax
call sym.vmtools.dll_DynBuf_Init
mov ecx, dword [ebp + 0x10]
mov edx, dword [ebp + 0xc]
push ecx
push edx
lea eax, [ebp - 0xc]
push eax
call fcn.100091e0
add esp, 0x10
test al, al
jne 0x10009325
lea ecx, [ebp - 0xc]
push ecx
call sym.vmtools.dll_DynBuf_Destroy
add esp, 4
call dword [sym.imp.MSVCR90.dll__errno]
mov dword [eax], 0xc
xor al, al
mov esp, ebp
pop ebp
ret
mov edx, dword [ebp + 8]
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 0xc]
push edx
push 1
push eax
push ecx
call dword [sym.imp.MSVCR90.dll_fwrite]
add esp, 0x10
cmp eax, 1
je 0x10009353
lea edx, [ebp - 0xc]
push edx
call sym.vmtools.dll_DynBuf_Destroy
add esp, 4
xor al, al
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0xc]
push eax
call sym.vmtools.dll_DynBuf_Destroy
add esp, 4
mov al, 1
mov esp, ebp
pop ebp
ret
Function at 0x1000a680
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push ecx
mov ecx, dword [ebp + 0x14]
push edi
xor edi, edi
test ecx, ecx
je 0x1000a690
mov dword [ecx], edi
mov dword [ebp - 4], eax
test eax, eax
jl 0x1000a770
push ebx
push esi
jmp 0x1000a6a3
mov eax, dword [ebp - 4]
test eax, eax
jne 0x1000a6ac
mov esi, dword [ebp + 8]
jmp 0x1000a6c7
mov ecx, dword [ebp + 0x10]
mov edx, dword [ebp + 0xc]
push ecx
dec eax
push eax
push edx
push str._s__d_s
push 0
call sym.vmtools.dll_Str_SafeAsprintf
add esp, 0x14
mov esi, eax
test edi, edi
jne 0x1000a704
push edi
push 1
push esi
call fcn.1000ca80
add esp, 0xc
test eax, eax
je 0x1000a6e2
sub eax, 2
neg eax
sbb eax, eax
mov ebx, eax
cmp eax, 0xffffffff
jne 0x1000a73b
call sym.vmtools.dll_Err_ErrString
push eax
push esi
push str.FileRotateByRename
push str.FILE:__s:_failed_to_remove__s:__s_n
call sym.vmtools.dll_Log
add esp, 0x10
jmp 0x1000a73b
push edi
push esi
call fcn.10016370
mov ebx, eax
add esp, 8
cmp ebx, 0xffffffff
jne 0x1000a73b
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
je 0x1000a73b
push eax
call sym.vmtools.dll_Err_Errno2String
push eax
push str.FileRotateByRename
push edi
push esi
push 0x10061324
call sym.vmtools.dll_Log
add esp, 0x18
cmp esi, dword [ebp + 8]
jne 0x1000a758
cmp dword [ebp + 0x14], 0
je 0x1000a758
test ebx, ebx
jne 0x1000a758
push edi
call sym.vmtools.dll_UtilSafeStrdup0
mov ecx, dword [ebp + 0x14]
add esp, 4
mov dword [ecx], eax
push edi
call dword [sym.imp.MSVCR90.dll_free]
add esp, 4
sub dword [ebp - 4], 1
mov edi, esi
jns 0x1000a6a0
pop esi
pop ebx
pop edi
mov esp, ebp
pop ebp
ret
Function at 0x1000b7e0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, dword [ebp + 0x10]
push edi
mov dword [ebp - 4], 0
mov ebx, esi
cmp esi, 0x80000000
jb 0x1000b80f
push 0x2a7
push str.d:_build_ob_bora_4448491_bora_lib_file_fileIOWin32.c
push str.VERIFY__s:_d_n
call sym.vmtools.dll_Panic
test esi, esi
jbe 0x1000b837
mov edi, dword [ebp + 0xc]
mov ecx, dword [ebp + 8]
mov edx, dword [ecx]
push 0
lea eax, [ebp - 4]
push eax
push esi
push edi
push edx
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x1000b849
mov eax, dword [ebp - 4]
add edi, eax
sub esi, eax
jne 0x1000b816
mov eax, dword [ebp + 0x14]
test eax, eax
je 0x1000b840
mov dword [eax], ebx
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp + 0x14]
test eax, eax
je 0x1000b857
sub ebx, esi
add ebx, dword [ebp - 4]
mov dword [eax], ebx
pop edi
pop esi
mov eax, 2
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x1000b870
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, dword [ebp + 0x10]
push edi
mov dword [ebp - 4], 0
mov ebx, esi
cmp esi, 0x80000000
jb 0x1000b89f
push 0x2de
push str.d:_build_ob_bora_4448491_bora_lib_file_fileIOWin32.c
push str.VERIFY__s:_d_n
call sym.vmtools.dll_Panic
test esi, esi
jbe 0x1000b8cb
mov edi, dword [ebp + 0xc]
mov ecx, dword [ebp + 8]
mov edx, dword [ecx]
push 0
lea eax, [ebp - 4]
push eax
push esi
push edi
push edx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x1000b8dd
mov eax, dword [ebp - 4]
test eax, eax
je 0x1000b8f7
add edi, eax
sub esi, eax
jne 0x1000b8a6
mov eax, dword [ebp + 0x14]
test eax, eax
je 0x1000b8d4
mov dword [eax], ebx
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp + 0x14]
test eax, eax
je 0x1000b8eb
sub ebx, esi
add ebx, dword [ebp - 4]
mov dword [eax], ebx
pop edi
pop esi
mov eax, 2
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp + 0x14]
test eax, eax
je 0x1000b902
sub ebx, esi
mov dword [eax], ebx
pop edi
pop esi
mov eax, 5
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x1000b9f0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
test eax, eax
jne 0x1000ba0c
push 0x1e7
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, 2
pop ebp
ret
push ebx
push esi
push 1
push eax
call sym.vmtools.dll_Unicode_GetAllocBytes
add esp, 8
mov esi, eax
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
push esi
mov ebx, eax
call dword [sym.imp.MSVCR90.dll_free]
add esp, 4
cmp ebx, 0xffffffff
jne 0x1000ba3c
pop esi
mov eax, 2
pop ebx
pop ebp
ret
test bl, 0x10
jne 0x1000ba50
test bl, 1
je 0x1000ba50
mov eax, 2
test byte [ebp + 0xc], al
jne 0x1000ba52
xor eax, eax
pop esi
pop ebx
pop ebp
ret
Function at 0x1000c2f0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x74
push ebx
push esi
mov esi, dword [ebp + 0xc]
push edi
mov edi, dword [ebp + 8]
push 0
push 0xffffffffffffffff
push 0
push esi
push 0xffffffffffffffff
push 0
push edi
mov byte [ebp - 1], 0
mov ebx, 0x80
call sym.vmtools.dll_Unicode_CompareRange
add esp, 0x1c
test eax, eax
jne 0x1000c329
pop edi
pop esi
mov al, 1
pop ebx
mov esp, ebp
pop ebp
ret
push 1
push edi
call sym.vmtools.dll_Unicode_GetAllocBytes
mov edi, eax
push 1
push esi
mov dword [ebp - 0xc], edi
call sym.vmtools.dll_Unicode_GetAllocBytes
add esp, 0x10
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov dword [ebp - 8], eax
call edi
mov esi, eax
cmp esi, 0xffffffff
je 0x1000c40e
mov eax, dword [ebp - 8]
push eax
call edi
cmp eax, 0xffffffff
je 0x1000c40e
and esi, 0x10
and eax, 0x10
cmp esi, eax
jne 0x1000c40e
test esi, esi
je 0x1000c37e
mov ebx, 0x2000080
mov ecx, dword [ebp - 0xc]
mov esi, dword [sym.imp.KERNEL32.dll_CreateFileW]
push 0
push ebx
push 3
push 0
push 0
push 0
push ecx
call esi
mov edi, eax
cmp edi, 0xffffffff
je 0x1000c40e
lea edx, [ebp - 0x40]
push edx
push edi
call dword [sym.imp.KERNEL32.dll_GetFileInformationByHandle]
test eax, eax
jne 0x1000c3b4
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x1000c40e
mov eax, dword [ebp - 8]
push 0
push ebx
push 3
push 0
push 0
push 0
push eax
call esi
mov esi, eax
cmp esi, 0xffffffff
je 0x1000c3ab
lea ecx, [ebp - 0x74]
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetFileInformationByHandle]
push edi
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
jne 0x1000c3e9
call edi
push esi
call edi
jmp 0x1000c40e
call edi
push esi
call edi
mov edx, dword [ebp - 0x24]
cmp edx, dword [ebp - 0x58]
jne 0x1000c40a
mov eax, dword [ebp - 0x14]
cmp eax, dword [ebp - 0x48]
jne 0x1000c40a
mov ecx, dword [ebp - 0x10]
mov byte [ebp - 1], 1
cmp ecx, dword [ebp - 0x44]
je 0x1000c40e
mov byte [ebp - 1], 0
mov edx, dword [ebp - 0xc]
mov esi, dword [sym.imp.MSVCR90.dll_free]
push edx
call esi
mov eax, dword [ebp - 8]
push eax
call esi
mov al, byte [ebp - 1]
add esp, 8
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1000c910
Capabilities:
Move file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [ebp + 8]
push esi
push edi
mov dword [ebp - 4], 0
mov dword [ebp - 0xc], 0x20
mov dword [ebp - 8], 5
test eax, eax
je 0x1000ca3b
mov esi, dword [ebp + 0xc]
test esi, esi
je 0x1000ca3b
push ebx
push 1
push eax
call sym.vmtools.dll_Unicode_GetAllocBytes
push 1
push esi
mov edi, eax
call sym.vmtools.dll_Unicode_GetAllocBytes
add esp, 0x10
mov ebx, eax
jmp 0x1000c960
push 1
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
test eax, eax
jne 0x1000c978
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
jmp 0x1000c97a
xor esi, esi
mov eax, dword [ebp + 0x10]
cmp dword [ebp - 4], eax
jae 0x1000c990
xor eax, eax
cmp dword [ebp + eax*4 - 0xc], esi
je 0x1000c9ee
inc eax
cmp eax, 2
jb 0x1000c984
push edi
mov edi, dword [sym.imp.MSVCR90.dll_free]
call edi
push ebx
call edi
add esp, 8
pop ebx
test esi, esi
je 0x1000ca40
mov edi, dword [ebp + 0x10]
test edi, edi
je 0x1000ca02
cmp dword [ebp - 4], edi
jb 0x1000ca02
push esi
push esi
call sym.vmtools.dll_Err_Errno2String
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
add esp, 4
push eax
push ecx
push edx
push edi
push str.File_RenameRetry
push str.FILE:__s:_Retry_time_expired___u___s___s___last_error__s___d__n
call sym.vmtools.dll_Log
add esp, 0x1c
push esi
push str.File_RenameRetry
call fcn.1000c670
add esp, 8
pop edi
pop esi
mov esp, ebp
pop ebp
ret
push 0x64
push 0xa
call fcn.1000a600
add esp, 8
add dword [ebp - 4], eax
jmp 0x1000c960
push esi
push esi
call sym.vmtools.dll_Err_Errno2String
mov ecx, dword [ebp + 8]
add esp, 4
push eax
mov eax, dword [ebp + 0xc]
push eax
push ecx
push str.File_RenameRetry
push str.FILE:__s:_Non_retriable_error_encountered___s___s_:__s___d__n
call sym.vmtools.dll_Log
add esp, 0x18
push esi
push str.File_RenameRetry
call fcn.1000c670
add esp, 8
pop edi
pop esi
mov esp, ebp
pop ebp
ret
mov esi, 0x1e7
push esi
push str.File_RenameRetry
call fcn.1000c670
add esp, 8
pop edi
pop esi
mov esp, ebp
pop ebp
ret