joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1723700
Capabilities:
Decompress data using aplib

Disassembly:
pushal
mov esi, dword [esp + 0x24]
mov edi, dword [esp + 0x28]
cld
mov dl, 0x80
xor ebx, ebx
movsb byte es:[edi], byte [esi]
mov bl, 2
call fcn.0172378f
jae 0x172370e
xor ecx, ecx
call fcn.0172378f
jae 0x172373d
xor eax, eax
call fcn.0172378f
jae 0x172374d
mov bl, 2
inc ecx
mov al, 0x10
call fcn.0172378f
adc al, al
jae 0x172372f
jne 0x1723779
stosb byte es:[edi], al
jmp 0x1723711
call fcn.0172379b
sub ecx, ebx
jne 0x1723756
call fcn.01723799
jmp 0x1723775
lodsb al, byte [esi]
shr eax, 1
je 0x1723783
adc ecx, ecx
jmp 0x1723772
xchg ecx, eax
dec eax
shl eax, 8
lodsb al, byte [esi]
call fcn.01723799
cmp eax, 0x7d00
jae 0x1723772
cmp ah, 5
jae 0x1723773
cmp eax, 0x7f
ja 0x1723774
inc ecx
inc ecx
xchg ebp, eax
mov eax, ebp
mov bl, 1
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x1723711
sub edi, dword [esp + 0x28]
mov dword [esp + 0x1c], edi
popal
ret 8
Function at 0x100233e
Capabilities:
Read file via mapping

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x414
mov eax, dword [0x100e0a8]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, ecx
call fcn.0100217a
push esi
mov esi, 0x104
push esi
lea eax, [ebp - 0x414]
push eax
call fcn.0100b6b4
xor ebx, ebx
push ebx
push esi
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x414]
push eax
call fcn.0100b785
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
add eax, 0x27
cmp eax, esi
push 0x1001280
jl 0x10023b0
push 0x27
lea eax, [ebp - 0x52]
push eax
call fcn.0100228e
jmp 0x10023bd
push esi
lea eax, [ebp - 0x20c]
push eax
call fcn.010022c8
lea eax, [ebp - 0x20c]
push eax
push 0x19400
push ebx
push 4
push ebx
call fcn.0100b648
push eax
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
push ebx
push ebx
push ebx
push 2
push eax
mov dword [edi + 4], eax
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov ecx, dword [ebp - 4]
mov dword [edi + 8], eax
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.01005fd1
leave
ret 4

Function at 0x100252b
Capabilities:
Get file size
Read file via mapping

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
push edi
xor esi, esi
push esi
push 0x80
push 3
push esi
push esi
push 0x80000000
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
mov dword [ebp - 8], edi
cmp edi, 0xffffffff
je 0x100260a
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
push esi
push esi
push esi
push 2
push esi
mov dword [ebp - 4], eax
call fcn.0100b648
push eax
push edi
mov edi, dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
call edi
push esi
push dword [ebp - 4]
mov dword [ebp + 8], eax
push esi
push 4
push esi
call fcn.0100b648
push eax
push dword [ebp + 0xc]
call edi
mov dword [ebp + 0xc], eax
cmp eax, esi
je 0x10025e5
cmp dword [ebp + 8], esi
je 0x10025f3
mov edi, dword [sym.imp.KERNEL32.dll_MapViewOfFile]
push ebx
push esi
push esi
push esi
push 4
push dword [ebp + 8]
call edi
push esi
push esi
push esi
push 2
push dword [ebp + 0xc]
mov ebx, eax
call edi
mov edi, eax
cmp ebx, esi
je 0x10025d9
cmp edi, esi
je 0x10025d2
push dword [ebp - 4]
push ebx
push edi
call sub.msvcrt.dll_memcpy
add esp, 0xc
push ebx
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
pop ebx
cmp edi, esi
je 0x10025e5
push edi
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
cmp dword [ebp + 8], esi
je 0x10025f3
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp + 0xc], esi
je 0x1002601
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
leave
ret 0xc
Function at 0x1002615
Capabilities:
Get file size
Read file via mapping

Disassembly:
push 0x14
push 0x100cc90
call fcn.01006000
xor esi, esi
push esi
push 0x80
push 2
push esi
push esi
push 0xc0000000
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [ebp - 0x24], eax
cmp eax, 0xffffffff
je 0x100273d
push esi
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov ebx, eax
push esi
push esi
push esi
push 2
push esi
call fcn.0100b648
push eax
push dword [ebp + 8]
mov edi, dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
call edi
mov dword [ebp + 0xc], eax
push esi
push ebx
push esi
push 4
push esi
call fcn.0100b648
push eax
push dword [ebp - 0x24]
call edi
mov dword [ebp - 0x1c], eax
cmp dword [ebp + 0xc], esi
je 0x1002718
cmp eax, esi
je 0x1002718
push esi
push esi
push esi
push 4
push dword [ebp + 0xc]
mov edi, dword [sym.imp.KERNEL32.dll_MapViewOfFile]
call edi
mov dword [ebp + 8], eax
push esi
push esi
push esi
push 2
push dword [ebp - 0x1c]
call edi
mov dword [ebp - 0x20], eax
cmp eax, esi
je 0x10026fc
cmp dword [ebp + 8], esi
je 0x10026fc
mov dword [ebp - 4], esi
push ebx
push dword [ebp + 8]
push eax
call sub.msvcrt.dll_memcpy
add esp, 0xc
mov dword [ebp - 4], 0xfffffffe
jmp 0x10026fc
cmp dword [ebp - 0x20], esi
je 0x100270a
push dword [ebp - 0x20]
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
cmp dword [ebp + 8], esi
je 0x1002718
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
cmp dword [ebp - 0x1c], esi
je 0x1002726
push dword [ebp - 0x1c]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp + 0xc], esi
je 0x1002734
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword [ebp - 0x24]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
call fcn.01006045
ret 8
Function at 0x100274a
Capabilities:
Get file size

Disassembly:
push 0x3dc
push 0x100ccb0
call fcn.01006088
mov dword [ebp - 0x3e0], 0x80004005
xor edi, edi
mov dword [ebp - 4], edi
mov esi, 0x100e57c
push esi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
push 0x100e5a8
call fcn.010051e3
mov ebx, eax
mov dword [ebp - 0x3e8], ebx
push esi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
cmp ebx, 0xffffffff
je 0x1002852
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov esi, eax
push edi
push edi
push edi
push 4
push edi
call fcn.0100b648
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov dword [ebp - 0x3e4], eax
cmp eax, edi
je 0x1002852
push edi
push edi
push edi
push 2
push eax
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov dword [ebp - 0x3ec], eax
cmp eax, edi
je 0x1002846
push 0xffff
push esi
push eax
mov esi, 0x100e9d0
push esi
call fcn.010072c7
lea eax, [ebp - 0x3dc]
push eax
push esi
call fcn.010071c9
mov dword [ebp - 4], 1
push dword [ebp + 8]
push esi
call fcn.010068b8
mov dword [ebp - 0x3e0], eax
mov dword [ebp - 4], edi
jmp 0x1002834
push esi
call fcn.0100722d
push dword [ebp - 0x3ec]
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
push dword [ebp - 0x3e4]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword [ebp - 0x3e8]
call fcn.010051d2
jmp 0x100287e
mov dword [ebp - 4], 0xfffffffe
mov eax, dword [ebp - 0x3e0]
call fcn.010060d0
ret 4

Function at 0x1002898
Capabilities:
Get file size

Disassembly:
push 0x3e0
push 0x100ccd8
call fcn.01006088
mov eax, dword [ebp + 8]
mov dword [ebp - 0x3e4], eax
mov dword [ebp - 0x3e0], 0x80004005
xor edi, edi
mov dword [ebp - 4], edi
mov esi, 0x100e57c
push esi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
push 0x100e5a8
call fcn.010051e3
mov ebx, eax
mov dword [ebp - 0x3ec], ebx
push esi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
cmp ebx, 0xffffffff
je 0x10029ac
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov esi, eax
push edi
push edi
push edi
push 4
push edi
call fcn.0100b648
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov dword [ebp - 0x3f0], eax
cmp eax, edi
je 0x10029ac
push edi
push edi
push edi
push 2
push eax
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov dword [ebp - 0x3e8], eax
cmp eax, edi
je 0x10029a0
push 0xffff
push esi
push eax
mov esi, 0x100e9d0
push esi
call fcn.010072c7
lea eax, [ebp - 0x3dc]
push eax
push esi
call fcn.010071c9
mov dword [ebp - 4], 1
push dword [ebp - 0x3e4]
push esi
call fcn.010067f4
mov dword [ebp - 0x3e0], eax
mov dword [ebp - 4], edi
jmp 0x100298e
push esi
call fcn.0100722d
push dword [ebp - 0x3e8]
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
push dword [ebp - 0x3f0]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword [ebp - 0x3ec]
call fcn.010051d2
push dword [ebp - 0x3e4]
call fcn.01005b35
pop ecx
jmp 0x10029e4
mov dword [ebp - 4], 0xfffffffe
mov eax, dword [ebp - 0x3e0]
call fcn.010060d0
ret 4
Function at 0x10029fe
Capabilities:
Get file size

Disassembly:
push 0x3dc
push 0x100cd00
call fcn.01006088
mov dword [ebp - 0x3e0], 0x80004005
xor edi, edi
mov dword [ebp - 4], edi
mov esi, 0x100e57c
push esi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
push 0x100e5a8
call fcn.010051e3
mov ebx, eax
mov dword [ebp - 0x3e8], ebx
push esi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
cmp ebx, 0xffffffff
je 0x1002b06
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov esi, eax
push edi
push edi
push edi
push 4
push edi
call fcn.0100b648
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov dword [ebp - 0x3e4], eax
cmp eax, edi
je 0x1002b06
push edi
push edi
push edi
push 2
push eax
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov dword [ebp - 0x3ec], eax
cmp eax, edi
je 0x1002afa
push 0xffff
push esi
push eax
mov esi, 0x100e9d0
push esi
call fcn.010072c7
lea eax, [ebp - 0x3dc]
push eax
push esi
call fcn.010071c9
mov dword [ebp - 4], 1
push dword [ebp + 8]
push esi
call fcn.01006917
mov dword [ebp - 0x3e0], eax
mov dword [ebp - 4], edi
jmp 0x1002ae8
push esi
call fcn.0100722d
push dword [ebp - 0x3ec]
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
push dword [ebp - 0x3e4]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword [ebp - 0x3e8]
call fcn.010051d2
jmp 0x1002b32
mov dword [ebp - 4], 0xfffffffe
mov eax, dword [ebp - 0x3e0]
call fcn.010060d0
ret 4

Function at 0x1002b4c
Capabilities:
Get file size

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
xor edi, edi
push edi
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetFileSize]
push edi
mov esi, eax
add esi, 0x8000
push esi
push edi
push 4
push edi
call fcn.0100b648
push eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov ebx, eax
mov dword [ebp - 4], ebx
cmp ebx, edi
je 0x1002bcb
push edi
push edi
push edi
push 2
push ebx
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov dword [ebp + 8], eax
cmp eax, edi
je 0x1002bc4
mov edi, dword [ebp + 0x10]
push dword [edi]
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov ebx, dword [ebp + 0xc]
push dword [ebx]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp + 8]
mov dword [edi], eax
mov eax, dword [ebp - 4]
mov dword [ebx], eax
mov eax, dword [ebp + 0x14]
mov dword [eax], esi
xor eax, eax
inc eax
jmp 0x1002bcd
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret 0x10
Function at 0x1002f57
Capabilities:
Get file size

Disassembly:
push 0x3ec
push 0x100cd80
call fcn.01006088
mov edi, dword [ebp + 8]
mov dword [ebp - 0x3fc], edi
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x3e4], eax
xor ebx, ebx
mov dword [ebp - 0x3f4], ebx
mov dword [ebp - 0x3e0], 0x80004005
cmp eax, 0xffffffff
jne 0x1002fc9
mov esi, 0x100e57c
push esi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
push 0x100e5a8
call fcn.010051e3
mov dword [ebp - 0x3e4], eax
push esi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
cmp dword [ebp - 0x3e4], 0xffffffff
je 0x10031a0
mov dword [ebp - 0x3f4], 1
push ebx
push dword [ebp - 0x3e4]
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [ebp - 0x3e8], eax
push ebx
push ebx
push ebx
push 4
push ebx
call fcn.0100b648
push eax
push dword [ebp - 0x3e4]
call dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov dword [ebp - 0x3f8], eax
cmp eax, ebx
je 0x10031a0
push ebx
push ebx
push ebx
push 2
push eax
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov dword [ebp - 0x3ec], eax
cmp eax, ebx
je 0x1003194
push 0xffff
push dword [ebp - 0x3e8]
push eax
mov esi, 0x100e9d0
push esi
call fcn.010072c7
lea eax, [ebp - 0x3dc]
push eax
push esi
call fcn.010071c9
test byte [edi + 0x142], 1
je 0x1003069
mov dword [ebp - 0x3f0], ebx
lea eax, [ebp - 0x3f0]
push eax
push esi
call fcn.010067be
mov eax, dword [ebp - 0x3f0]
inc eax
mov dword [edi + 0x146], eax
mov dword [ebp - 4], ebx
push dword [edi + 0x150]
push edi
push esi
call fcn.010081fe
mov dword [ebp - 0x3e0], eax
push 0xfffffffffffffffe
pop ebx
mov dword [ebp - 4], ebx
jmp 0x10030c8
cmp dword [ebp - 0x3e0], 0x80028016
jne 0x1003180
lea eax, [ebp - 0x3e8]
push eax
lea eax, [ebp - 0x3ec]
push eax
lea eax, [ebp - 0x3f8]
push eax
push dword [ebp - 0x3e4]
call fcn.01002b4c
test eax, eax
je 0x1003176
mov dword [ebp - 4], 1
push 0xffff
push dword [ebp - 0x3e8]
push dword [ebp - 0x3ec]
push esi
call fcn.010072c7
push dword [edi + 0x150]
push edi
push esi
call fcn.010081fe
mov dword [ebp - 0x3e0], eax
mov dword [ebp - 4], ebx
jmp 0x1003180
mov dword [ebp - 0x3e0], 0x80004005
push esi
call fcn.0100722d
push dword [ebp - 0x3ec]
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
xor ebx, ebx
push dword [ebp - 0x3f8]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 0x3f4], ebx
je 0x10031bc
cmp dword [ebp - 0x3e4], 0xffffffff
je 0x10031bc
push dword [ebp - 0x3e4]
call fcn.010051d2
push edi
call fcn.01005b35
pop ecx
mov eax, dword [ebp - 0x3e0]
call fcn.010060d0
ret 8
Function at 0x10031d6
Capabilities:
Get file size

Disassembly:
push 0x3f0
push 0x100cda8
call fcn.01006088
mov edi, dword [ebp + 8]
mov dword [ebp - 0x3f4], edi
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x3e8], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x3e4], eax
xor ebx, ebx
mov dword [ebp - 0x3f8], ebx
mov dword [ebp - 0x3e0], 0x80004005
cmp eax, 0xffffffff
jne 0x1003251
mov esi, 0x100e57c
push esi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
push 0x100e5a8
call fcn.010051e3
mov dword [ebp - 0x3e4], eax
push esi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
cmp dword [ebp - 0x3e4], 0xffffffff
je 0x1003444
mov dword [ebp - 0x3f8], 1
push ebx
push dword [ebp - 0x3e4]
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [ebp - 0x3f0], eax
push ebx
push ebx
push ebx
push 4
push ebx
call fcn.0100b648
push eax
push dword [ebp - 0x3e4]
call dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov dword [ebp - 0x3fc], eax
cmp eax, ebx
je 0x1003444
push ebx
push ebx
push ebx
push 2
push eax
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov dword [ebp - 0x3ec], eax
cmp eax, ebx
je 0x1003438
push 0xffff
push dword [ebp - 0x3f0]
push eax
mov esi, 0x100e9d0
push esi
call fcn.010072c7
lea eax, [ebp - 0x3dc]
push eax
push esi
call fcn.010071c9
test byte [edi + 0x142], 1
je 0x10032f1
mov dword [ebp - 0x400], ebx
lea eax, [ebp - 0x400]
push eax
push esi
call fcn.010067be
mov eax, dword [ebp - 0x400]
inc eax
mov dword [edi + 0x146], eax
mov dword [ebp - 4], ebx
push dword [edi + 0x150]
push dword [edi + 0x154]
push dword [ebp - 0x3e8]
push edi
push esi
call fcn.0100861c
mov dword [ebp - 0x3e0], eax
push 0xfffffffffffffffe
pop ebx
mov dword [ebp - 4], ebx
jmp 0x100335c
cmp dword [ebp - 0x3e0], 0x80028016
jne 0x1003424
lea eax, [ebp - 0x3f0]
push eax
lea eax, [ebp - 0x3ec]
push eax
lea eax, [ebp - 0x3fc]
push eax
push dword [ebp - 0x3e4]
call fcn.01002b4c
test eax, eax
je 0x100341a
mov dword [ebp - 4], 1
push 0xffff
push dword [ebp - 0x3f0]
push dword [ebp - 0x3ec]
push esi
call fcn.010072c7
push dword [edi + 0x150]
push dword [edi + 0x154]
push dword [ebp - 0x3e8]
push edi
push esi
call fcn.0100861c
mov dword [ebp - 0x3e0], eax
mov dword [ebp - 4], ebx
jmp 0x1003424
mov dword [ebp - 0x3e0], 0x80004005
push esi
call fcn.0100722d
push dword [ebp - 0x3ec]
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
xor ebx, ebx
push dword [ebp - 0x3fc]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 0x3f8], ebx
je 0x1003460
cmp dword [ebp - 0x3e4], 0xffffffff
je 0x1003460
push dword [ebp - 0x3e4]
call fcn.010051d2
push edi
call fcn.01005b35
push dword [ebp - 0x3e8]
call fcn.01005b35
pop ecx
pop ecx
mov eax, dword [ebp - 0x3e0]
call fcn.010060d0
ret 0xc
Function at 0x1003486
Capabilities:
Get file size

Disassembly:
push 0x3e8
push 0x100cdd0
call fcn.01006088
mov edi, dword [ebp + 8]
mov dword [ebp - 0x3f8], edi
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x3e4], eax
xor ebx, ebx
mov dword [ebp - 0x3f4], ebx
mov dword [ebp - 0x3e0], 0x80004005
cmp eax, 0xffffffff
jne 0x10034f8
mov esi, 0x100e57c
push esi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
push 0x100e5a8
call fcn.010051e3
mov dword [ebp - 0x3e4], eax
push esi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
cmp dword [ebp - 0x3e4], 0xffffffff
je 0x10036ac
mov dword [ebp - 0x3f4], 1
push ebx
push dword [ebp - 0x3e4]
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [ebp - 0x3ec], eax
push ebx
push ebx
push ebx
push 4
push ebx
call fcn.0100b648
push eax
push dword [ebp - 0x3e4]
call dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov dword [ebp - 0x3f0], eax
cmp eax, ebx
je 0x10036ac
push ebx
push ebx
push ebx
push 2
push eax
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov dword [ebp - 0x3e8], eax
cmp eax, ebx
je 0x10036a0
push 0xffff
push dword [ebp - 0x3ec]
push eax
mov esi, 0x100e9d0
push esi
call fcn.010072c7
lea eax, [ebp - 0x3dc]
push eax
push esi
call fcn.010071c9
mov dword [ebp - 4], ebx
cmp dword [edi + 4], ebx
je 0x100357d
lea eax, [edi + 8]
push eax
jmp 0x100357e
push ebx
push dword [edi]
push esi
call fcn.01007d84
mov dword [ebp - 0x3e0], eax
push 0xfffffffffffffffe
pop ebx
mov dword [ebp - 4], ebx
jmp 0x10035d5
cmp dword [ebp - 0x3e0], 0x80028016
jne 0x100368c
lea eax, [ebp - 0x3ec]
push eax
lea eax, [ebp - 0x3e8]
push eax
lea eax, [ebp - 0x3f0]
push eax
push dword [ebp - 0x3e4]
call fcn.01002b4c
test eax, eax
je 0x1003682
mov dword [ebp - 4], 1
push 0xffff
push dword [ebp - 0x3ec]
push dword [ebp - 0x3e8]
push esi
call fcn.010072c7
lea eax, [edi + 8]
push eax
push dword [edi]
push esi
call fcn.01007d84
mov dword [ebp - 0x3e0], eax
mov dword [ebp - 4], ebx
jmp 0x100368c
mov dword [ebp - 0x3e0], 0x80004005
push esi
call fcn.0100722d
push dword [ebp - 0x3e8]
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
xor ebx, ebx
push dword [ebp - 0x3f0]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 0x3f4], ebx
je 0x10036c8
cmp dword [ebp - 0x3e4], 0xffffffff
je 0x10036c8
push dword [ebp - 0x3e4]
call fcn.010051d2
push edi
call fcn.01005b35
pop ecx
mov eax, dword [ebp - 0x3e0]
call fcn.010060d0
ret 8
Function at 0x10036e2
Capabilities:
Get file size

Disassembly:
push 0x3e8
push 0x100cdf8
call fcn.01006088
mov esi, dword [ebp + 8]
mov dword [ebp - 0x3f8], esi
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x3e4], eax
xor ebx, ebx
mov dword [ebp - 0x3f4], ebx
mov dword [ebp - 0x3e0], 0x80004005
cmp eax, 0xffffffff
jne 0x1003754
mov edi, 0x100e57c
push edi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
push 0x100e5a8
call fcn.010051e3
mov dword [ebp - 0x3e4], eax
push edi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
cmp dword [ebp - 0x3e4], 0xffffffff
je 0x1003914
mov dword [ebp - 0x3f4], 1
push ebx
push dword [ebp - 0x3e4]
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [ebp - 0x3ec], eax
push ebx
push ebx
push ebx
push 4
push ebx
call fcn.0100b648
push eax
push dword [ebp - 0x3e4]
call dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov dword [ebp - 0x3f0], eax
cmp eax, ebx
je 0x1003914
push ebx
push ebx
push ebx
push 2
push eax
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov dword [ebp - 0x3e8], eax
cmp eax, ebx
je 0x1003908
push 0xffff
push dword [ebp - 0x3ec]
push eax
mov edi, 0x100e9d0
push edi
call fcn.010072c7
lea eax, [ebp - 0x3dc]
push eax
push edi
call fcn.010071c9
mov dword [ebp - 4], ebx
push dword [esi + 0x10]
push dword [esi + 0xc]
push dword [esi + 8]
push dword [esi + 4]
push dword [esi]
push edi
call fcn.01007aa1
mov dword [ebp - 0x3e0], eax
push 0xfffffffffffffffe
pop ebx
mov dword [ebp - 4], ebx
jmp 0x1003831
cmp dword [ebp - 0x3e0], 0x80028016
jne 0x10038f4
lea eax, [ebp - 0x3ec]
push eax
lea eax, [ebp - 0x3e8]
push eax
lea eax, [ebp - 0x3f0]
push eax
push dword [ebp - 0x3e4]
call fcn.01002b4c
test eax, eax
je 0x10038ea
mov dword [ebp - 4], 1
push 0xffff
push dword [ebp - 0x3ec]
push dword [ebp - 0x3e8]
push edi
call fcn.010072c7
push dword [esi + 0x10]
push dword [esi + 0xc]
push dword [esi + 8]
push dword [esi + 4]
push dword [esi]
push edi
call fcn.01007aa1
mov dword [ebp - 0x3e0], eax
mov dword [ebp - 4], ebx
jmp 0x10038f4
mov dword [ebp - 0x3e0], 0x80004005
push edi
call fcn.0100722d
push dword [ebp - 0x3e8]
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
xor ebx, ebx
push dword [ebp - 0x3f0]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 0x3f4], ebx
je 0x1003930
cmp dword [ebp - 0x3e4], 0xffffffff
je 0x1003930
push dword [ebp - 0x3e4]
call fcn.010051d2
push esi
call fcn.01005b35
pop ecx
mov eax, dword [ebp - 0x3e0]
call fcn.010060d0
ret 8
Function at 0x100394a
Capabilities:
Get file size

Disassembly:
push 0x3e8
push 0x100ce20
call fcn.01006088
mov esi, dword [ebp + 8]
mov dword [ebp - 0x3f8], esi
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x3e4], eax
xor ebx, ebx
mov dword [ebp - 0x3f4], ebx
mov dword [ebp - 0x3e0], 0x80004005
cmp eax, 0xffffffff
jne 0x10039bc
mov edi, 0x100e57c
push edi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
push 0x100e5a8
call fcn.010051e3
mov dword [ebp - 0x3e4], eax
push edi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
cmp dword [ebp - 0x3e4], 0xffffffff
je 0x1003bb6
mov dword [ebp - 0x3f4], 1
push ebx
push dword [ebp - 0x3e4]
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [ebp - 0x3ec], eax
push ebx
push ebx
push ebx
push 4
push ebx
call fcn.0100b648
push eax
push dword [ebp - 0x3e4]
call dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov dword [ebp - 0x3f0], eax
cmp eax, ebx
je 0x1003bb6
push ebx
push ebx
push ebx
push 2
push eax
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov dword [ebp - 0x3e8], eax
cmp eax, ebx
je 0x1003baa
push 0xffff
push dword [ebp - 0x3ec]
push eax
mov edi, 0x100e9d0
push edi
call fcn.010072c7
lea eax, [ebp - 0x3dc]
push eax
push edi
call fcn.010071c9
mov dword [ebp - 4], ebx
push dword [esi + 0x114]
movzx eax, word [esi + 0x110]
push eax
push dword [esi + 0x10c]
push dword [esi + 0x108]
push dword [esi + 0x104]
lea eax, [esi + 4]
push eax
push dword [esi]
push edi
call fcn.01007b85
mov dword [ebp - 0x3e0], eax
push 0xfffffffffffffffe
pop ebx
mov dword [ebp - 4], ebx
jmp 0x1003ab1
cmp dword [ebp - 0x3e0], 0x80028016
jne 0x1003b96
lea eax, [ebp - 0x3ec]
push eax
lea eax, [ebp - 0x3e8]
push eax
lea eax, [ebp - 0x3f0]
push eax
push dword [ebp - 0x3e4]
call fcn.01002b4c
test eax, eax
je 0x1003b8c
mov dword [ebp - 4], 1
push 0xffff
push dword [ebp - 0x3ec]
push dword [ebp - 0x3e8]
push edi
call fcn.010072c7
mov dword [ebp - 0x3e0], eax
test eax, eax
jl 0x1003b43
push dword [esi + 0x114]
movzx eax, word [esi + 0x110]
push eax
push dword [esi + 0x10c]
push dword [esi + 0x108]
push dword [esi + 0x104]
lea eax, [esi + 4]
push eax
push dword [esi]
push edi
call fcn.01007b85
mov dword [ebp - 0x3e0], eax
mov dword [ebp - 4], ebx
jmp 0x1003b96
mov dword [ebp - 0x3e0], 0x80004005
push edi
call fcn.0100722d
push dword [ebp - 0x3e8]
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
xor ebx, ebx
push dword [ebp - 0x3f0]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 0x3f4], ebx
je 0x1003bd2
cmp dword [ebp - 0x3e4], 0xffffffff
je 0x1003bd2
push dword [ebp - 0x3e4]
call fcn.010051d2
push esi
call fcn.01005b35
pop ecx
mov eax, dword [ebp - 0x3e0]
call fcn.010060d0
ret 8