joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1000d340
Capabilities:
Read file on windows
Write file on windows

Disassembly:
push 0xffffffffffffffff
push 0x1006ff60
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x24
push ebx
mov eax, dword [esp + 0x38]
push ebp
push esi
push edi
push 0
push 0x80
push 3
push 0
push 1
push closesocket
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
mov dword [esp + 0x1c], esi
cmp esi, 0xffffffff
mov dword [esp + 0x3c], 0
je 0x1000d449
mov ebp, dword [sym.imp.KERNEL32.dll_ReadFile]
lea ecx, [esp + 0x14]
mov edi, 8
push 0
push ecx
lea edx, [esp + 0x2c]
push edi
push edx
push esi
mov dword [esp + 0x28], edi
call ebp
test eax, eax
je 0x1000d442
cmp dword [esp + 0x14], edi
jne 0x1000d442
cmp dword [esp + 0x24], 0x2424244d
jne 0x1000d442
mov eax, dword [esp + 0x28]
cmp eax, 0x10000
jge 0x1000d442
lea ecx, [esp + 0x10]
push 2
neg eax
push ecx
push eax
push esi
mov dword [esp + 0x20], 0xffffffff
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, 0xffffffff
je 0x1000d442
mov edx, dword [esp + 0x28]
push edx
call fcn.1003bfe0
mov edi, eax
add esp, 4
test edi, edi
setne bl
mov byte [esp + 0x2c], bl
mov dword [esp + 0x30], edi
mov ecx, dword [esp + 0x28]
lea eax, [esp + 0x18]
push 0
push eax
push ecx
push edi
push esi
mov byte [esp + 0x50], 1
call ebp
test eax, eax
je 0x1000d435
mov edx, dword [esp + 0x28]
mov eax, dword [esp + 0x18]
cmp edx, eax
je 0x1000d45e
test bl, bl
je 0x1000d442
push edi
call fcn.1003c010
add esp, 4
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
mov ecx, dword [esp + 0x24]
mov dword fs:[0], ecx
add esp, 0x30
ret
mov ebp, dword [sym.imp.KERNEL32.dll_CloseHandle]
push esi
mov dword [esp + 0x20], 0xffffffff
call ebp
mov eax, dword [esp + 0x44]
push 0
push 0x80
push 3
push 0
push 0
push 0xc0000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
lea ecx, [esp + 0x20]
mov esi, eax
push ecx
push str.E:_baofengSRCMPK.._.._INCLUDE_._utls_AutoHandle.h
push 0x100857ec
push str.m_Handle_hdl_invalid_val
push 1
lea ecx, [esp + 0x58]
mov dword [esp + 0x34], 0x7c
call fcn.1000d990
cmp esi, 0xffffffff
jne 0x1000d4c9
test bl, bl
je 0x1000d449
push edi
call fcn.1003c010
add esp, 4
jmp 0x1000d449
mov eax, dword [esp + 0x28]
lea edx, [esp + 0x18]
push 0
push edx
push eax
push edi
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x1000d4f6
test bl, bl
je 0x1000d4ee
push edi
call fcn.1003c010
add esp, 4
push esi
call ebp
jmp 0x1000d449
mov edx, dword [esp + 0x28]
lea ecx, [esp + 0x10]
push 2
push ecx
neg edx
push edx
push esi
mov dword [esp + 0x20], 0xffffffff
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, 0xffffffff
jne 0x1000d52d
test bl, bl
je 0x1000d525
push edi
call fcn.1003c010
add esp, 4
push esi
call ebp
jmp 0x1000d449
push esi
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
test eax, eax
jne 0x1000d54d
test bl, bl
je 0x1000d545
push edi
call fcn.1003c010
add esp, 4
push esi
call ebp
jmp 0x1000d449
test bl, bl
je 0x1000d55a
push edi
call fcn.1003c010
add esp, 4
push esi
call ebp
mov ecx, dword [esp + 0x34]
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
mov dword fs:[0], ecx
add esp, 0x30
ret
Function at 0x1000d580
Capabilities:
Check if file exists
Get file attributes

Disassembly:
sub esp, 0x1c
push esi
push edi
mov edi, ecx
mov dword [esp + 8], 0x47
cmp dword [edi + 0x24], 0xffffffff
je 0x1000d604
push 0x100858ec
push str.csfail.txt
call dword [sym.imp.MSVCRT.dll_fopen]
mov esi, eax
add esp, 8
test esi, esi
je 0x1000d5d8
mov eax, dword [esp + 8]
push eax
push str.E:_baofengSRCMPKKRFileStream.cpp
push 0x100858a4
push str.m_hFileINVALID_HANDLE_VALUE
push str._s____s____s____d__n
push esi
call dword [sym.imp.MSVCRT.dll_fprintf]
push esi
call dword [sym.imp.MSVCRT.dll_fclose]
add esp, 0x1c
lea ecx, [esp + 8]
push ecx
push str.E:_baofengSRCMPKKRFileStream.cpp
push 0x100858a4
push str.m_hFileINVALID_HANDLE_VALUE
lea ecx, [esp + 0x1c]
call fcn.1000d660
lea edx, [esp + 0xc]
push 0x1007d4f0
push edx
call sub.MSVCRT.dll__CxxThrowException
mov esi, dword [esp + 0x28]
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x1000d61e
pop edi
xor eax, eax
pop esi
add esp, 0x1c
ret 4
push esi
call fcn.1000d340
add esp, 4
push 0
push 0x80
push 3
push 0
push 1
push closesocket
push esi
call dword [sym.imp.KERNEL32.dll_CreateFileA]
xor ecx, ecx
cmp eax, 0xffffffff
mov dword [edi + 0x24], eax
pop edi
setne cl
mov eax, ecx
pop esi
add esp, 0x1c
ret 4

Function at 0x1000d730
Capabilities:
Get file size

Disassembly:
sub esp, 0x1c
mov eax, dword [esp + 0x20]
mov dword [esp], 0x57
mov eax, dword [eax + 0x24]
cmp eax, 0xffffffff
jne 0x1000d7b8
push esi
push 0x100858ec
push str.csfail.txt
call dword [sym.imp.MSVCRT.dll_fopen]
mov esi, eax
add esp, 8
test esi, esi
je 0x1000d78b
mov ecx, dword [esp + 4]
push ecx
push str.E:_baofengSRCMPKKRFileStream.cpp
push 0x10085928
push str.m_hFile_INVALID_HANDLE_VALUE
push str._s____s____s____d__n
push esi
call dword [sym.imp.MSVCRT.dll_fprintf]
push esi
call dword [sym.imp.MSVCRT.dll_fclose]
add esp, 0x1c
lea edx, [esp + 4]
lea ecx, [esp + 8]
push edx
push str.E:_baofengSRCMPKKRFileStream.cpp
push 0x10085928
push str.m_hFile_INVALID_HANDLE_VALUE
call fcn.1000d660
lea eax, [esp + 8]
push 0x1007d4f0
push eax
call sub.MSVCRT.dll__CxxThrowException
pop esi
mov ecx, dword [esp + 0x24]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
add esp, 0x1c
ret 8
Function at 0x1000d8b0
Capabilities:
Read file on windows

Disassembly:
sub esp, 0x1c
mov eax, dword [esp + 0x20]
mov dword [esp], 0x70
mov eax, dword [eax + 0x24]
cmp eax, 0xffffffff
jne 0x1000d938
push esi
push 0x100858ec
push str.csfail.txt
call dword [sym.imp.MSVCRT.dll_fopen]
mov esi, eax
add esp, 8
test esi, esi
je 0x1000d90b
mov ecx, dword [esp + 4]
push ecx
push str.E:_baofengSRCMPKKRFileStream.cpp
push 0x10085928
push str.m_hFile_INVALID_HANDLE_VALUE
push str._s____s____s____d__n
push esi
call dword [sym.imp.MSVCRT.dll_fprintf]
push esi
call dword [sym.imp.MSVCRT.dll_fclose]
add esp, 0x1c
lea edx, [esp + 4]
lea ecx, [esp + 8]
push edx
push str.E:_baofengSRCMPKKRFileStream.cpp
push 0x10085928
push str.m_hFile_INVALID_HANDLE_VALUE
call fcn.1000d660
lea eax, [esp + 8]
push 0x1007d4f0
push eax
call sub.MSVCRT.dll__CxxThrowException
pop esi
mov edx, dword [esp + 0x28]
lea ecx, [esp + 0x20]
push 0
push ecx
mov ecx, dword [esp + 0x2c]
push edx
push ecx
push eax
mov dword [esp + 0x34], 0
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov ecx, dword [esp + 0x2c]
mov edx, dword [esp + 0x20]
test ecx, ecx
je 0x1000d966
mov dword [ecx], edx
test eax, eax
je 0x1000d976
test edx, edx
je 0x1000d976
xor eax, eax
add esp, 0x1c
ret 0x10
mov eax, 0x80004005
add esp, 0x1c
ret 0x10
Function at 0x1000ea30
Capabilities:
Check if file exists
Get file attributes

Disassembly:
sub esp, 0x120
push ebx
push ebp
push esi
mov esi, ecx
xor ebx, ebx
push edi
mov eax, dword [esi + 0x48]
lea ebp, [esi + 0x48]
cmp eax, ebx
mov dword [esp + 0x10], 0x12f
je 0x1000ead4
mov eax, dword [eax]
cmp eax, ebx
je 0x1000ead4
push eax
call dword [sym.imp.OLEAUT32.dll_VariantInit]
cmp eax, ebx
je 0x1000ead4
push 0x100858ec
push str.csfail.txt
call dword [sym.imp.MSVCRT.dll_fopen]
mov esi, eax
add esp, 8
cmp esi, ebx
je 0x1000eaa8
mov eax, dword [esp + 0x10]
push eax
push str.E:_baofengSRCMPKMedia.cpp
push 0x10085a70
push str.m_bstSouce.length__0
push str._s____s____s____d__n
push esi
call dword [sym.imp.MSVCRT.dll_fprintf]
push esi
call dword [sym.imp.MSVCRT.dll_fclose]
add esp, 0x1c
lea ecx, [esp + 0x10]
push ecx
push str.E:_baofengSRCMPKMedia.cpp
push 0x10085a70
push str.m_bstSouce.length__0
lea ecx, [esp + 0x24]
call fcn.1000ebc0
lea edx, [esp + 0x14]
push 0x1007d720
push edx
call sub.MSVCRT.dll__CxxThrowException
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0x2d]
mov byte [esp + 0x2c], bl
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov edi, dword [esp + 0x134]
push edi
call dword [sym.imp.SHLWAPI.dll_PathIsURLA]
test eax, eax
je 0x1000eb39
lea eax, [esp + 0x10]
push ebx
lea ecx, [esp + 0x30]
push eax
push ecx
push edi
mov dword [esp + 0x20], 0x104
call dword [sym.imp.SHLWAPI.dll_PathCreateFromUrlA]
test eax, eax
je 0x1000eb4a
push edi
mov ecx, ebp
call fcn.1000f270
mov ecx, esi
call fcn.1000ee40
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x120
ret 4
push 0x103
lea edx, [esp + 0x30]
push edi
push edx
call dword [sym.imp.KERNEL32.dll_lstrcpynA]
push edi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x1000eb65
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x120
ret 4
test al, 0x10
push edi
mov ecx, esi
je 0x1000eb7e
call fcn.1000ef20
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x120
ret 4
call fcn.1000f000
test eax, eax
jne 0x1000eba7
push edi
mov ecx, ebp
call fcn.1000f270
mov dword [esi + 0x10], ebx
push edi
mov ecx, esi
mov dword [esi + 0x14], ebx
mov dword [esi + 0xc], ebx
call fcn.1000e4a0
mov ecx, esi
call fcn.1000ed20
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x120
ret 4
Function at 0x1000ef20
Capabilities:
Check if file exists
Get file attributes

Disassembly:
sub esp, 0x104
lea eax, [esp]
push ebx
mov ebx, dword [sym.imp.MSVCRT.dll_sprintf]
push ebp
push esi
push edi
mov edi, dword [esp + 0x118]
push edi
push str._s_video_ts.ifo
mov esi, ecx
push eax
call ebx
mov ebp, dword [sym.imp.MSVCRT.dll__fullpath]
lea ecx, [esp + 0x1c]
push 0x104
lea edx, [esp + 0x20]
push ecx
push edx
call ebp
add esp, 0x18
lea eax, [esp + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x1000ef77
and eax, 0x10
cmp al, 0x10
jne 0x1000efaf
push edi
lea ecx, [esp + 0x14]
push str._sVIDEO_TS_video_ts.ifo
push ecx
call ebx
lea edx, [esp + 0x1c]
push 0x104
lea eax, [esp + 0x20]
push edx
push eax
call ebp
add esp, 0x18
lea ecx, [esp + 0x10]
push ecx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x1000efe4
and eax, 0x10
cmp al, 0x10
je 0x1000efe4
lea edx, [esp + 0x10]
push edx
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecA]
lea eax, [esp + 0x10]
lea ecx, [esi + 0x48]
push eax
call fcn.1000f270
xor eax, eax
pop edi
mov dword [esi + 0x10], eax
mov dword [esi + 0x14], eax
mov eax, 1
mov dword [esi + 0xc], eax
pop esi
pop ebp
pop ebx
add esp, 0x104
ret 4
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x104
ret 4

Function at 0x1000f000
Capabilities:
Check if file exists
Get file attributes

Disassembly:
sub esp, 0x104
push esi
push edi
mov edi, dword [esp + 0x110]
mov esi, ecx
push edi
call dword [sym.imp.SHLWAPI.dll_PathFindFileNameA]
test eax, eax
jne 0x1000f027
pop edi
pop esi
add esp, 0x104
ret 4
push str.video_ts.ifo
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
je 0x1000f044
pop edi
xor eax, eax
pop esi
add esp, 0x104
ret 4
push 0x103
lea eax, [esp + 0xc]
push edi
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpynA]
lea ecx, [esp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x1000f072
pop edi
xor eax, eax
pop esi
add esp, 0x104
ret 4
lea edx, [esp + 8]
push edx
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecA]
lea eax, [esp + 8]
lea ecx, [esi + 0x48]
push eax
call fcn.1000f270
mov eax, 1
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
mov dword [esi + 0xc], eax
pop edi
pop esi
add esp, 0x104
ret 4
Function at 0x10010520
Capabilities:
Read file on windows

Disassembly:
sub esp, 0x10c
mov eax, dword [esp + 0x110]
push esi
push 0
push 0x80
push 3
push 0
push 1
push closesocket
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
cmp esi, 0xffffffff
jne 0x10010558
pop esi
xor eax, eax
add esp, 0x10c
ret
lea ecx, [esp + 0xc]
push 0
push ecx
lea edx, [esp + 0x18]
push 0x64
push edx
push esi
mov dword [esp + 0x20], 0
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x1001058a
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop esi
xor eax, eax
add esp, 0x10c
ret
mov al, 0xff
mov cl, 0xfe
mov byte [esp + 5], al
mov byte [esp + 6], al
mov byte [esp + 8], 0xef
mov byte [esp + 9], 0xbb
mov byte [esp + 0xa], 0xbf
mov byte [esp + 4], cl
mov byte [esp + 7], cl
xor eax, eax
mov cl, byte [esp + eax + 0x10]
mov dl, byte [esp + eax + 8]
cmp cl, dl
jne 0x1001060a
inc eax
cmp eax, 3
jb 0x100105af
xor eax, eax
mov dl, byte [esp + eax + 0x10]
mov cl, byte [esp + eax + 4]
cmp dl, cl
jne 0x1001060a
inc eax
cmp eax, 2
jb 0x100105c3
xor eax, eax
mov cl, byte [esp + eax + 0x10]
mov dl, byte [esp + eax + 6]
cmp cl, dl
jne 0x1001060a
inc eax
cmp eax, 2
jb 0x100105d7
mov edx, dword [esp + 0xc]
xor eax, eax
shr edx, 1
je 0x10010625
lea ecx, [esp + 0x10]
cmp byte [ecx], 0
je 0x10010579
inc eax
add ecx, 2
cmp eax, edx
jb 0x100105f7
jmp 0x10010625
mov ecx, dword [esp + 0xc]
xor eax, eax
test ecx, ecx
jbe 0x10010625
mov dl, byte [esp + eax + 0x10]
test dl, dl
je 0x10010579
inc eax
cmp eax, ecx
jb 0x10010614
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop esi
mov eax, 1
add esp, 0x10c
ret
Function at 0x10012cb0
Capabilities:
Read .ini file

Disassembly:
push 0xffffffffffffffff
push 0x1007040c
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x854
push ebx
push ebp
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
push edi
mov edi, dword [esp + 0x874]
xor ebx, ebx
push edi
push ebx
push str.NumberOfEntries
push str.playlist
call esi
push edi
push ebx
mov ebp, eax
push str.Version
push str.playlist
mov dword [esp + 0x38], ebp
call esi
mov esi, 1
cmp ebp, esi
mov dword [esp + 0x24], esi
jl 0x10012e4e
push esi
push str.File_d
lea eax, [esp + 0x34]
push 0x14
push eax
call dword [sym.imp.MSVCRT.dll__snprintf]
add esp, 0x10
lea ecx, [esp + 0x40]
lea edx, [esp + 0x2c]
push edi
push 0x824
push ecx
push ebx
push edx
push str.playlist
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
test eax, eax
je 0x10012e41
mov al, byte [esp + 0x13]
lea edi, [esp + 0x40]
mov byte [esp + 0x14], al
or ecx, 0xffffffff
xor eax, eax
push 1
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov dword [esp + 0x1c], ebx
mov ebp, ecx
lea ecx, [esp + 0x18]
push ebp
mov dword [esp + 0x24], ebx
mov dword [esp + 0x28], ebx
call dword [sym.imp.MSVCP60.dll_private:_bool___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::_Grow_unsigned_int__bool_]
test al, al
je 0x10012da3
mov edi, dword [esp + 0x18]
mov ecx, ebp
mov edx, ecx
lea esi, [esp + 0x40]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov eax, dword [esp + 0x18]
mov dword [esp + 0x1c], ebp
mov byte [eax + ebp], bl
mov ebp, dword [esp + 0x878]
push 0x18
mov dword [esp + 0x870], ebx
mov esi, dword [ebp + 4]
mov edi, dword [esi + 4]
call fcn.1003bfe0
add esp, 4
cmp esi, ebx
mov ecx, esi
jne 0x10012dc9
mov ecx, eax
mov dword [eax], ecx
cmp edi, ebx
mov ecx, edi
jne 0x10012dd3
mov ecx, eax
mov dword [eax + 4], ecx
mov dword [esi + 4], eax
mov ecx, dword [eax + 4]
mov dword [ecx], eax
lea ecx, [esp + 0x14]
add eax, 8
push ecx
push eax
call fcn.100172a0
mov edx, dword [ebp + 8]
mov eax, dword [esp + 0x20]
add esp, 8
inc edx
cmp eax, ebx
mov dword [ebp + 8], edx
mov dword [esp + 0x86c], 0xffffffff
je 0x10012e26
lea ecx, [eax - 1]
mov al, byte [eax - 1]
cmp al, bl
je 0x10012e1d
cmp al, 0xff
je 0x10012e1d
dec al
mov byte [ecx], al
jmp 0x10012e26
push ecx
call fcn.1003c010
add esp, 4
mov esi, dword [esp + 0x24]
mov ebp, dword [esp + 0x28]
mov edi, dword [esp + 0x874]
mov dword [esp + 0x18], ebx
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x20], ebx
inc esi
cmp esi, ebp
mov dword [esp + 0x24], esi
jle 0x10012d11
mov ecx, dword [esp + 0x864]
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
mov dword fs:[0], ecx
add esp, 0x860
ret
Function at 0x100146f0
Capabilities:
Get common file path

Disassembly:
push 0xffffffffffffffff
push 0x1007056b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x920
push esi
mov esi, dword [esp + 0x938]
push esi
push 0x30c
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
push esi
push 0
push 0x10086030
push esi
call dword [sym.imp.KERNEL32.dll_GetTempFileNameA]
lea ecx, [esp + 4]
call fcn.1001da70
mov eax, dword [esp + 0x934]
lea ecx, [esp + 4]
push eax
push ecx
mov dword [esp + 0x934], 0
call fcn.1001daf0
test eax, eax
jne 0x10014784
lea ecx, [esp + 4]
mov dword [esp + 0x92c], 0xffffffff
call fcn.1001dae0
xor eax, eax
pop esi
mov ecx, dword [esp + 0x920]
mov dword fs:[0], ecx
add esp, 0x92c
ret
lea edx, [esp + 4]
push esi
push edx
call fcn.1001dd60
lea ecx, [esp + 4]
mov esi, eax
mov dword [esp + 0x92c], 0xffffffff
call fcn.1001dae0
mov ecx, dword [esp + 0x924]
mov eax, esi
pop esi
mov dword fs:[0], ecx
add esp, 0x92c
ret

Function at 0x10014db0
Capabilities:
Check if file exists
Get disk information
Get file attributes

Disassembly:
push ebx
push ebp
push esi
mov esi, dword [esp + 0x10]
push edi
mov ebp, ecx
push esi
call dword [sym.imp.SHLWAPI.dll_PathFindExtensionA]
mov edi, eax
test edi, edi
je 0x10014e67
push esi
call dword [sym.imp.SHLWAPI.dll_PathGetDriveNumberA]
mov cl, byte [0x1008604a]
mov ebx, eax
mov ax, word [0x10086048]
push esi
mov word [esp + 0x18], ax
add al, bl
mov byte [esp + 0x1a], cl
mov byte [esp + 0x18], al
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x10014e67
test al, 0x10
jne 0x10014e67
push edi
push str..cda
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
jne 0x10014e67
cmp ebx, 0xffffffff
je 0x10014e4d
lea edx, [esp + 0x14]
push edx
call dword [sym.imp.KERNEL32.dll_GetDriveTypeA]
cmp eax, 5
jne 0x10014e4d
mov edi, dword [esp + 0x18]
push esi
test edi, edi
mov ecx, ebp
je 0x10014e3f
call fcn.10013940
mov dword [edi], eax
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
ret 8
call fcn.10013940
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
ret 8
mov eax, dword [esp + 0x18]
test eax, eax
je 0x10014e5b
mov dword [eax], 0
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
ret 8
pop edi
pop esi
pop ebp
mov eax, 0x80004005
pop ebx
ret 8
Function at 0x10017a90
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push 0xffffffffffffffff
push 0x100707d6
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xc
push ebx
push ebp
push esi
mov esi, ecx
xor ebx, ebx
push edi
lea ecx, [esi + 0x20]
mov dword [esp + 0x18], esi
mov dword [esi + 8], ebx
call fcn.1001e320
mov dword [esp + 0x24], ebx
mov dword [esi + 0x48], ebx
mov al, byte [esp + 0x13]
mov cl, byte [esp + 0x13]
push 0x38
mov byte [esp + 0x28], 1
mov byte [esi + 0x4c], al
mov byte [esi + 0x4d], cl
mov byte [esi + 0x54], bl
call fcn.1003bfe0
mov edi, eax
add esp, 4
lea ecx, [esp + 0x14]
mov ebp, edi
mov dword [edi + 4], ebx
mov dword [edi + 0x30], 1
call dword [sym.imp.MSVCP60.dll_public:_void___thiscall_std::_Lockit::constructor_void_]
cmp dword [0x1009bcc0], ebx
jne 0x10017b19
mov dword [0x1009bcc0], edi
mov dword [edi], ebx
mov edx, dword [0x1009bcc0]
xor ebp, ebp
mov dword [edx + 8], ebx
mov ecx, dword [0x1009bcc8]
inc ecx
mov dword [0x1009bcc8], ecx
lea ecx, [esp + 0x14]
call dword [sym.imp.MSVCP60.dll_public:_void___thiscall_std::_Lockit::destructor_void_]
cmp ebp, ebx
je 0x10017b3d
push ebp
call fcn.1003c010
add esp, 4
mov edi, dword [0x1009bcc0]
push 0x38
call fcn.1003bfe0
mov dword [eax + 4], edi
mov dword [eax + 0x30], ebx
mov dword [esi + 0x50], eax
mov dword [esi + 0x58], ebx
mov dword [eax], eax
mov eax, dword [esi + 0x50]
add esp, 4
mov dword [eax + 8], eax
mov dword [esi + 0x10], ebx
push 0x1009bd64
mov dword [esi + 0x14], ebx
mov dword [esi + 0x18], ebx
mov dword [esi + 0x1c], ebx
mov dword [esi + 0xc], 0xffffffff
mov dword [esi], vtable.ATL::CComObject_class_CMedia_.1.0
mov dword [esi + 4], vtable.ATL::CComObject_class_CMedia_.0
call dword [sym.imp.KERNEL32.dll_InterlockedIncrement]
mov ecx, dword [esp + 0x1c]
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x18
ret 4
Function at 0x10017cf0
Capabilities:
Get file size
Read file on windows

Disassembly:
push 0xffffffffffffffff
push 0x10070818
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x10
push ebx
push ebp
xor ebx, ebx
push esi
push edi
mov dword [esp + 0x10], ebx
mov eax, dword [esp + 0x34]
push ebx
push 0x80
push 3
push ebx
push 1
push closesocket
push eax
mov dword [esp + 0x44], ebx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
mov dword [esp + 0x14], esi
or edi, 0xffffffff
mov byte [esp + 0x28], 1
cmp esi, edi
jne 0x10017d63
mov eax, dword [esp + 0x10]
mov dword [esp + 0x28], edi
cmp eax, ebx
je 0x10017de2
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, 0x80070006
jmp 0x10017ebc
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov ebp, eax
cmp ebp, ebx
jne 0x10017d84
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [esp + 0x10]
mov dword [esp + 0x28], edi
cmp eax, ebx
jmp 0x10017dda
lea eax, [ebp + 1]
push eax
call fcn.1003bfe0
mov edi, eax
add esp, 4
cmp edi, ebx
mov dword [esp + 0x1c], edi
setne bl
mov byte [esp + 0x18], bl
lea ecx, [esp + 0x34]
push 0
push ecx
push ebp
push edi
push esi
mov byte [esp + 0x3c], 2
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x10017dec
test bl, bl
je 0x10017dc5
push edi
call fcn.1003c010
add esp, 4
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [esp + 0x10]
mov dword [esp + 0x28], 0xffffffff
test eax, eax
je 0x10017de2
mov edx, dword [eax]
push eax
call dword [edx + 8]
mov eax, 0x80070006
jmp 0x10017ebc
mov eax, dword [esp + 0x34]
lea ecx, [esp + 0x10]
push ecx
mov byte [eax + edi], 0
mov edx, dword [esp + 0x38]
add edx, 0xfffffff8
lea eax, [edi + 8]
push edx
push eax
call fcn.1003c020
test eax, eax
jne 0x10017e3e
test bl, bl
je 0x10017e1b
push edi
call fcn.1003c010
add esp, 4
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [esp + 0x10]
mov dword [esp + 0x28], 0xffffffff
test eax, eax
je 0x10017eb7
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
jmp 0x10017eb7
test bl, bl
je 0x10017e4b
push edi
call fcn.1003c010
add esp, 4
push esi
mov byte [esp + 0x2c], 0
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [esp + 0x10]
push eax
mov edx, dword [eax]
call dword [edx + 0x10]
mov esi, eax
mov eax, dword [esp + 0x10]
push eax
mov ecx, dword [eax]
call dword [ecx + 0xc]
test eax, eax
je 0x10017ea1
test esi, esi
je 0x10017ea1
mov edx, dword [esp + 0x38]
mov ecx, dword [esp + 0x30]
push edx
push eax
push esi
call fcn.10017ee0
mov esi, eax
mov dword [esp + 0x28], 0xffffffff
mov eax, dword [esp + 0x10]
test eax, eax
je 0x10017e9d
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, esi
jmp 0x10017ebc
mov eax, dword [esp + 0x10]
mov dword [esp + 0x28], 0xffffffff
test eax, eax
je 0x10017eb7
mov edx, dword [eax]
push eax
call dword [edx + 8]
mov eax, 0x80004005
mov ecx, dword [esp + 0x20]
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x1c
ret 0xc