joyce8/EMBER2024-capa huggingface dataset:
Function at 0x44e190
Capabilities:
Enumerate files on windows
Get common file path

Disassembly:
sub esp, 0xa74
mov eax, dword [0x49eb88]
xor eax, esp
mov dword [esp + 0xa70], eax
push esi
push edi
xor eax, eax
push 0x206
mov esi, ecx
push eax
lea ecx, [esp + 0x262]
push ecx
mov word [esp + 0x264], ax
call fcn.00450880
add esp, 0xc
push 0
push 0x1a
lea edx, [esp + 0x260]
push edx
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
xor eax, eax
push 0x206
push eax
lea ecx, [esp + 0x87a]
push ecx
mov word [esp + 0x87c], ax
call fcn.00450880
lea edx, [esp + 0x264]
push edx
push str._sSogouExplorer
lea eax, [esp + 0x884]
push 0x103
push eax
call fcn.0041fd50
add esp, 0x1c
lea ecx, [esp + 8]
push ecx
lea edx, [esp + 0x874]
push edx
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov edi, eax
cmp edi, 0xffffffff
jne 0x44e251
mov eax, dword [0x4a4c50]
pop edi
pop esi
mov ecx, dword [esp + 0xa70]
xor ecx, esp
call fcn.0044f9f3
add esp, 0xa74
ret
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_FindNextFileW]
push ebp
lea eax, [esp + 0x10]
push eax
push edi
xor ebp, ebp
call ebx
test eax, eax
je 0x44e2e6
lea ecx, [esp + 0x10]
push ecx
mov ecx, esi
call fcn.0044d830
test eax, eax
je 0x44e2d3
xor edx, edx
push 0x206
push edx
lea eax, [esp + 0x472]
push eax
mov word [esp + 0x474], dx
call fcn.00450880
push str.uhistory.db
lea ecx, [esp + 0x4c]
push ecx
lea edx, [esp + 0x274]
push edx
push str._sSogouExplorer_s_s
lea eax, [esp + 0x484]
push 0x104
push eax
call fcn.0041fd50
add esp, 0x24
lea ecx, [esp + 0x468]
push ecx
mov ecx, esi
call fcn.0044dea0
test eax, eax
jne 0x44e2e1
lea edx, [esp + 0x10]
push edx
push edi
call ebx
test eax, eax
jne 0x44e267
jmp 0x44e2e6
mov ebp, 1
push edi
call dword [sym.imp.KERNEL32.dll_FindClose]
test ebp, ebp
pop ebp
pop ebx
je 0x44e30f
pop edi
mov eax, 1
pop esi
mov ecx, dword [esp + 0xa70]
xor ecx, esp
call fcn.0044f9f3
add esp, 0xa74
ret
xor eax, eax
push 0x206
push eax
lea ecx, [esp + 0x672]
push ecx
mov word [esp + 0x674], ax
call fcn.00450880
push str.uhistory.db
lea edx, [esp + 0x268]
push edx
push str._sSogouExplorer_s
lea eax, [esp + 0x680]
push 0x104
push eax
call fcn.0041fd50
add esp, 0x20
lea ecx, [esp + 0x668]
push ecx
mov ecx, esi
call fcn.0044dea0
mov ecx, dword [esp + 0xa78]
neg eax
pop edi
sbb eax, eax
pop esi
xor ecx, esp
neg eax
call fcn.0044f9f3
add esp, 0xa74
ret

Function at 0x44f9f3
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x49eb88]
jne 0x44f9fd
repz ret
jmp fcn.00458618
Function at 0x474f84
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.0045c738
and dword [ebp - 4], 0
cmp dword [0x4a6a98], 0
mov ebx, eax
jne 0x475035
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x4750e6
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x4750e6
push eax
call fcn.0045c6c6
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x4a6a98], eax
call esi
push eax
call fcn.0045c6c6
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x4a6a9c], eax
call esi
push eax
call fcn.0045c6c6
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x4a6aa0], eax
call esi
push eax
call fcn.0045c6c6
pop ecx
mov dword [0x4a6aa8], eax
test eax, eax
je 0x475035
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.0045c6c6
pop ecx
mov dword [0x4a6aa4], eax
mov eax, dword [0x4a6aa4]
cmp eax, ebx
je 0x47508d
cmp dword [0x4a6aa8], ebx
je 0x47508d
push eax
call fcn.0045c741
push dword [0x4a6aa8]
mov esi, eax
call fcn.0045c741
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x47508d
test edi, edi
je 0x47508d
call esi
test eax, eax
je 0x475084
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x475084
test byte [ebp - 0xc], 1
jne 0x47508d
or dword [ebp + 0x10], 0x200000
jmp 0x4750c6
mov eax, dword [0x4a6a9c]
cmp eax, ebx
je 0x4750c6
push eax
call fcn.0045c741
pop ecx
test eax, eax
je 0x4750c6
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x4750c6
mov eax, dword [0x4a6aa0]
cmp eax, ebx
je 0x4750c6
push eax
call fcn.0045c741
pop ecx
test eax, eax
je 0x4750c6
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x4a6a98]
call fcn.0045c741
pop ecx
test eax, eax
je 0x4750e6
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x4750e8
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x4030a4
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push esi
push 0
mov eax, dword [ebp + 8]
push eax
push dword [ebp + 0xc]
mov eax, dword [ebp + 0x10]
push eax
push dword [ebp + 0x14]
call sub.kernel32.dll_WriteFile
test eax, eax
setne al
movsx eax, al
push eax
call fcn.00402f44
mov esi, eax
cmp dword [0x407f24], 0xffffffff
je 0x403105
mov eax, dword [ebp + 0x14]
cmp eax, dword [0x407f20]
jne 0x403105
lea eax, [ebp - 0x1c]
push eax
push dword [0x407f20]
call sub.kernel32.dll_GetConsoleScreenBufferInfo
movsx eax, word [ebp - 0x18]
mov dword [0x407f2c], eax
movsx eax, word [ebp - 0x16]
mov dword [0x407f30], eax
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret 0x10

Function at 0x40321c
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38c
push esi
push edi
mov edi, 3
push 0x408a84
call fcn.004063d0
mov esi, dword [eax]
push 0x408a84
call fcn.004063d0
mov dword [eax], 0x40
lea eax, [ebp - 0x150]
push eax
lea eax, [ebp - 0x38c]
push eax
push 0
call fcn.00405c38
call fcn.00405ab4
lea eax, [ebp - 0x150]
push eax
push 1
call fcn.00405b40
call fcn.004046a8
test eax, eax
jne 0x40335d
lea eax, [ebp - 0x150]
push eax
lea eax, [ebp - 0x190]
push eax
push 0x40
push 0
call fcn.00405c18
call fcn.004046a8
test eax, eax
jne 0x4032d3
cmp word [ebp - 0x190], 0x5a4d
jne 0x4032d3
lea eax, [ebp - 0x150]
push eax
push dword [ebp - 0x154]
call fcn.00405b5c
lea eax, [ebp - 0x150]
push eax
lea eax, [ebp - 0x190]
push eax
push 2
push 0
call fcn.00405c18
jmp 0x4032dd
mov dword [ebp - 0x154], 0
lea eax, [ebp - 0x150]
push eax
push dword [ebp - 0x154]
call fcn.00405b5c
call fcn.004046a8
test eax, eax
jne 0x403341
cmp word [ebp - 0x190], 0x4550
jne 0x403341
lea eax, [ebp - 0x150]
push eax
lea eax, [ebp - 0x288]
push eax
push 0xf8
push 0
call fcn.00405c18
call fcn.004046a8
test eax, eax
jne 0x403341
cmp dword [ebp - 0x288], 0x4550
jne 0x403341
cmp word [ebp - 0x22c], 3
jne 0x403341
mov edi, 2
lea eax, [ebp - 0x150]
push eax
call fcn.00405b8c
push 0x408a7c
call fcn.004063d0
mov dword [eax], 0
push 0x408a84
call fcn.004063d0
mov dword [eax], esi
mov eax, edi
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x4033b4
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push esi
mov eax, dword [ebp + 8]
push eax
push dword [ebp + 0xc]
push dword [ebp + 0x10]
push dword [ebp + 0x14]
push dword [ebp + 0x18]
push dword [ebp + 0x1c]
call sub.kernel32.dll_CreateThread
mov esi, eax
push esi
call sub.kernel32.dll_CloseHandle
test esi, esi
setne al
movsx eax, al
push eax
call fcn.00402f44
mov esi, eax
mov eax, esi
pop esi
pop ebp
ret 0x18
Function at 0x403458
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x110
push ebx
push esi
push edi
cmp dword [0x407fc4], 0
je 0x40347a
mov eax, dword [0x407fc4]
mov dword [ebp - 4], eax
jmp 0x40350f
push 0x104
call fcn.0040477c
mov dword [ebp - 4], eax
push 0x104
push dword [ebp - 4]
push 0
call sub.kernel32.dll_GetModuleFileNameA
push dword [ebp - 4]
call fcn.00404244
inc eax
mov ebx, eax
call sub.kernel32.dll_GetCommandLineA
mov esi, eax
mov al, byte [esi]
dec al
cmp al, 0x1f
jbe 0x4034bf
push esi
lea eax, [ebp - 0x108]
push eax
call fcn.004033f0
mov esi, eax
inc esi
push esi
call fcn.00404244
inc eax
mov edi, eax
lea eax, [ebp - 4]
push eax
mov eax, ebx
add eax, edi
inc eax
push eax
call fcn.004047dc
call sub.kernel32.dll_AreFileApisANSI
test eax, eax
jne 0x4034f0
push edi
mov eax, dword [ebp - 4]
add eax, ebx
push eax
push esi
call sub.user32.dll_CharToOemBuffA
jmp 0x4034fd
push esi
mov eax, dword [ebp - 4]
add eax, ebx
push eax
push edi
call fcn.00404fbc
mov eax, dword [ebp - 4]
add eax, ebx
add eax, edi
mov byte [eax], 0
mov eax, dword [ebp - 4]
mov dword [0x407fc4], eax
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4035ec
Capabilities:
Contain obfuscated stackstrings
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
push ebx
push esi
mov dword [ebp - 0x24], 0x52414853
mov dword [ebp - 0x20], 0x454d4445
mov dword [ebp - 0x1c], 0x5356354d
call sub.kernel32.dll_GetCurrentProcessId
push eax
push 0
lea eax, [ebp - 0x18]
push eax
push 0xb
call fcn.00404f30
xor eax, eax
mov bl, 0
cmp dword [0x407f68], 0
jne 0x40363a
push 0x407cb8
push 1
call fcn.00402e50
mov dword [0x407f68], eax
cmp dword [0x407f68], 0
jne 0x403653
push 0x8000
call fcn.0040477c
mov esi, eax
mov bl, 1
jmp 0x40368d
lea eax, [ebp - 0x24]
push eax
push 0
push 6
call dword [0x407f68]
test eax, eax
jne 0x40367d
lea eax, [ebp - 0x24]
push eax
push 0x8000
push 0
push 4
push 0
push 0xffffffffffffffff
call sub.kernel32.dll_CreateFileMappingA
mov bl, 1
push 0
push 0
push 0
push 6
push eax
call sub.kernel32.dll_MapViewOfFile
mov esi, eax
test bl, bl
je 0x4036b6
push esi
push 0x8000
push 0xff
call fcn.00405018
push esi
push 0x24
push 0
call fcn.00405018
mov eax, esi
add eax, 0xc
push eax
call fcn.00404864
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x403a64
Capabilities:
Manipulate console buffer

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x418
push esi
call fcn.004039f0
lea edx, [ebp - 0x400]
movzx ecx, word [ebp + 0x14]
dec ecx
xor esi, esi
jmp 0x403a9c
mov eax, dword [ebp + 8]
movzx eax, byte [eax]
mov word [edx + 2], ax
mov eax, dword [ebp + 0x18]
movzx eax, byte [eax]
mov word [edx], ax
inc dword [ebp + 0x18]
add edx, 4
inc esi
cmp ecx, esi
jge 0x403a82
mov ax, word [ebp + 0x14]
mov word [ebp - 0x404], ax
mov word [ebp - 0x402], 1
mov word [ebp - 0x408], 0
mov word [ebp - 0x406], 0
mov ax, word [ebp + 0x10]
mov word [ebp - 0x410], ax
mov ax, word [ebp + 0xc]
mov word [ebp - 0x40e], ax
movzx ecx, word [ebp + 0x10]
movzx eax, word [ebp + 0x14]
add ecx, eax
dec ecx
mov word [ebp - 0x40c], cx
mov ax, word [ebp + 0xc]
mov word [ebp - 0x40a], ax
lea eax, [ebp - 0x410]
push eax
push dword [ebp - 0x408]
push dword [ebp - 0x404]
lea eax, [ebp - 0x400]
push eax
push dword [0x407f20]
call sub.kernel32.dll_WriteConsoleOutputA
pop esi
mov esp, ebp
pop ebp
ret 0x14

Function at 0x403e44
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
sub esp, 4
push 2
lea eax, [ebp - 4]
push eax
push dword [ebp + 0xc]
push dword [ebp + 0x10]
call sub.kernel32.dll_GetLocaleInfoA
test eax, eax
jle 0x403e64
mov al, byte [ebp - 4]
jmp 0x403e67
mov al, byte [ebp + 8]
mov esp, ebp
pop ebp
ret 0xc
Function at 0x405ef0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
push esi
push edi
or edi, 0xffffffff
or eax, 0xffffffff
mov dword [ebp - 0x24], 0
xor esi, esi
mov edx, dword [0x408318]
add edx, 0x24
mov esi, edx
cmp dword [edx], 0xffffffff
je 0x405f2e
mov ecx, dword [edx + 8]
cmp ecx, dword [ebp + 0x10]
ja 0x405f29
mov ecx, dword [edx + 8]
cmp ecx, dword [esi + 8]
jbe 0x405f29
mov esi, edx
add edx, 0x10
jmp 0x405f12
mov edx, esi
cmp dword [edx], 0xffffffff
je 0x406042
mov ecx, dword [edx + 8]
cmp ecx, dword [ebp + 0x10]
ja 0x406042
mov ecx, dword [edx + 8]
cmp ecx, dword [ebp + 0x10]
ja 0x406040
mov ecx, dword [edx + 8]
sub dword [ebp + 0x10], ecx
mov ecx, dword [edx + 8]
mov dword [ebp - 0x18], ecx
mov edx, dword [edx + 0xc]
test edx, edx
je 0x406040
mov cl, byte [edx]
sub cl, 0x3c
jne 0x405f76
jmp 0x406040
sub cl, 3
jne 0x405f90
inc edx
mov dword [ebp - 0xc], edx
movzx ecx, byte [edx]
inc ecx
add edx, ecx
mov byte [ebp - 0x25], 1
jmp 0x40603b
inc cl
jne 0x405fa4
movzx ecx, word [edx + 1]
add edi, ecx
add edx, 3
jmp 0x40603b
inc cl
jne 0x405fb8
movzx ecx, word [edx + 1]
add edi, ecx
mov ecx, dword [edx + 3]
add eax, ecx
add edx, 7
jmp 0x405fcb
movzx ecx, byte [edx]
shr ecx, 6
add edi, ecx
mov cl, byte [edx]
and cl, 0x3f
movzx ecx, cl
add eax, ecx
inc edx
cmp eax, dword [ebp + 0x10]
jne 0x405fd5
mov esi, eax
mov dword [ebp - 0x24], edi
cmp eax, dword [ebp + 0x10]
jl 0x406032
sub eax, dword [ebp + 0x10]
cmp eax, 0xa
jle 0x405fe8
cmp byte [ebp - 0x25], 0
jne 0x406030
mov eax, dword [ebp - 0xc]
mov cl, byte [eax]
mov eax, dword [ebp + 0xc]
mov byte [eax], cl
mov dword [ebp - 0x14], 0
mov eax, dword [ebp - 0xc]
movzx eax, byte [eax]
cmp eax, dword [ebp - 0x14]
jle 0x40601e
inc dword [ebp - 0x14]
mov ecx, dword [ebp - 0xc]
mov eax, dword [ebp - 0x14]
mov dl, byte [eax + ecx]
xor dl, 0xaa
mov ecx, dword [ebp + 0xc]
mov eax, dword [ebp - 0x14]
mov byte [eax + ecx], dl
jmp 0x405ff9
movzx eax, word [ebp - 0x24]
mov ecx, dword [ebp + 8]
mov dword [ecx], eax
add esi, dword [ebp - 0x18]
mov eax, esi
jmp 0x406042
jmp 0x406040
mov esi, eax
mov dword [ebp - 0x24], edi
mov byte [ebp - 0x25], 0
jmp 0x405f68
xor eax, eax
pop edi
pop esi
mov esp, ebp
pop ebp
ret 0xc

Function at 0x406518
Capabilities:
Query environment variable

Disassembly:
sub esp, 0x10
cld
push ecx
call fcn.004064f4
call fcn.004035ec
mov dword [0x408318], eax
lea edx, [eax + 0x18]
mov dword [0x408378], edx
pop edx
call fcn.00406374
call sub.kernel32.dll_GetEnvironmentStrings
mov dword [0x408344], eax
push 0
call sub.kernel32.dll_GetModuleHandleA
mov dword [0x408358], eax
mov dword [0x408380], eax
call fcn.0040321c
cmp eax, 3
setb byte [0x408321]
call fcn.0040423c
lea eax, [esp]
xor edx, edx
mov ecx, dword fs:[edx]
mov dword fs:[edx], eax
mov dword [eax], ecx
mov dword [eax + 4], 0x4067a4
mov dword [eax + 8], ebp
jmp dword [esp + 0x10]
Function at 0x10001bff
Capabilities:
Print debug messages

Disassembly:
push 4
mov eax, 0x1002c5fd
call fcn.1002b257
mov esi, ecx
mov dword [ebp - 0x10], esi
push dword [ebp + 8]
lea edi, [esi + 4]
mov dword [esi], vtable.CMemMappedFile.0
xor ebx, ebx
mov ecx, edi
mov dword [edi + 0x10], ebx
mov dword [edi + 0x14], ebx
call fcn.10002b1a
mov eax, dword [ebp + 0xc]
mov dword [esi + 0x1c], ebx
mov dword [esi + 0x20], ebx
mov dword [esi + 0x24], eax
mov dword [esi + 0x28], ebx
mov dword [esi + 0x2c], ebx
mov byte [esi + 0x30], 1
mov dword [ebp - 4], ebx
cmp byte [0x1003ce0b], bl
jne 0x10001c54
cmp byte [0x1003ce0a], bl
je 0x10001c90
cmp dword [edi + 0x14], 0x10
jb 0x10001c5c
mov edi, dword [edi]
push edi
push str.CMemMappedFile__s__ctor__reference_
mov edi, 0x1003c820
push edi
call fcn.100259bf
add esp, 0xc
cmp byte [0x1003ce0a], 0
je 0x10001c80
push edi
call dword [sym.imp.kernel32.dll_OutputDebugStringA]
cmp byte [0x1003ce0b], 0
je 0x10001c90
push edi
call fcn.10005ee0
pop ecx
push esi
call fcn.100259bf
pop ecx
mov eax, esi
call fcn.1002b220
ret 8

Function at 0x10001ca1
Capabilities:
Print debug messages

Disassembly:
push 4
mov eax, 0x1002c5fd
call fcn.1002b257
mov esi, ecx
mov dword [ebp - 0x10], esi
lea edi, [esi + 4]
mov dword [esi], vtable.CMemMappedFile.0
push edi
call fcn.10002814
pop ecx
mov eax, dword [ebp + 8]
xor ecx, ecx
mov dword [esi + 0x1c], ecx
mov dword [esi + 0x20], ecx
mov dword [esi + 0x24], eax
mov dword [esi + 0x28], ecx
mov dword [esi + 0x2c], ecx
mov byte [esi + 0x30], cl
mov dword [ebp - 4], ecx
cmp byte [0x1003ce0b], cl
jne 0x10001cec
cmp byte [0x1003ce0a], cl
je 0x10001d29
cmp dword [edi + 0x14], 0x10
jb 0x10001cf4
mov edi, dword [edi]
push eax
push edi
push str.CMemMappedFile__s__ctor__new_with_size_lu_
mov edi, 0x1003c820
push edi
call fcn.100259bf
add esp, 0x10
cmp byte [0x1003ce0a], 0
je 0x10001d19
push edi
call dword [sym.imp.kernel32.dll_OutputDebugStringA]
cmp byte [0x1003ce0b], 0
je 0x10001d29
push edi
call fcn.10005ee0
pop ecx
mov ecx, esi
call fcn.100033f0
mov eax, esi
call fcn.1002b220
ret 4

Function at 0x10001d3a
Capabilities:
Print debug messages

Disassembly:
push 4
mov eax, 0x1002c5fd
call fcn.1002b257
mov esi, ecx
mov dword [ebp - 0x10], esi
lea edi, [esi + 4]
mov dword [esi], vtable.CMemMappedFile.0
push edi
call fcn.10002814
pop ecx
xor eax, eax
mov dword [esi + 0x1c], eax
mov dword [esi + 0x20], eax
mov dword [esi + 0x24], eax
mov dword [esi + 0x28], eax
mov dword [esi + 0x2c], eax
mov byte [esi + 0x30], al
mov dword [ebp - 4], eax
cmp byte [0x1003ce0b], al
jne 0x10001d82
cmp byte [0x1003ce0a], al
je 0x10001dbe
cmp dword [edi + 0x14], 0x10
jb 0x10001d8a
mov edi, dword [edi]
push edi
push str.CMemMappedFile__s__ctor__new_
mov edi, 0x1003c820
push edi
call fcn.100259bf
add esp, 0xc
cmp byte [0x1003ce0a], 0
je 0x10001dae
push edi
call dword [sym.imp.kernel32.dll_OutputDebugStringA]
cmp byte [0x1003ce0b], 0
je 0x10001dbe
push edi
call fcn.10005ee0
pop ecx
mov eax, esi
call fcn.1002b220
ret
Function at 0x1000263e
Capabilities:
Print debug messages

Disassembly:
push 4
mov eax, 0x1002c735
call fcn.1002b257
cmp byte [0x1003ce0b], 0
mov edi, 0x1003c820
mov esi, dword [ebp + 8]
jne 0x10002664
cmp byte [0x1003ce0a], 0
je 0x10002693
push esi
push str.CMemMappedFile_CreateWithSize__size_lu_
push edi
call fcn.100259bf
add esp, 0xc
cmp byte [0x1003ce0a], 0
je 0x10002683
push edi
call dword [sym.imp.kernel32.dll_OutputDebugStringA]
cmp byte [0x1003ce0b], 0
je 0x10002693
push edi
call fcn.10005ee0
pop ecx
call fcn.100259bf
test al, al
je 0x100026ef
call fcn.1001c19e
test al, al
je 0x100026ef
cmp byte [0x1003ce0b], 0
jne 0x100026b7
cmp byte [0x1003ce0a], 0
je 0x100026e6
push esi
push str.CMemMappedFile::CreateWithSize__lu___REMOTE_CREATION_
push edi
call fcn.100259bf
add esp, 0xc
cmp byte [0x1003ce0a], 0
je 0x100026d6
push edi
call dword [sym.imp.kernel32.dll_OutputDebugStringA]
cmp byte [0x1003ce0b], 0
je 0x100026e6
push edi
call fcn.10005ee0
pop ecx
push esi
call fcn.1001bf9c
pop ecx
jmp 0x1000274c
cmp byte [0x1003ce0b], 0
jne 0x10002701
cmp byte [0x1003ce0a], 0
je 0x10002730
push esi
push str.CMemMappedFile::CreateWithSize__lu___LOCAL_CREATION_
push edi
call fcn.100259bf
add esp, 0xc
cmp byte [0x1003ce0a], 0
je 0x10002720
push edi
call dword [sym.imp.kernel32.dll_OutputDebugStringA]
cmp byte [0x1003ce0b], 0
je 0x10002730
push edi
call fcn.10005ee0
pop ecx
push 0x34
call fcn.100259bf
pop ecx
mov ecx, eax
mov dword [ebp - 0x10], ecx
xor eax, eax
mov dword [ebp - 4], eax
test ecx, ecx
je 0x1000274c
push esi
call fcn.10001ca1
call fcn.1002b220
ret

Function at 0x100028bc
Capabilities:
Print debug messages

Disassembly:
push 0x28
mov eax, 0x1002c7ad
call fcn.1002b28b
mov ecx, dword [ebp + 0xc]
xor ebx, ebx
mov esi, dword [ebp + 8]
mov dword [ebp - 0x2c], ebx
mov dword [ebp - 0x30], ecx
cmp byte [0x1003ce0b], bl
jne 0x100028e6
cmp byte [0x1003ce0a], bl
je 0x10002923
cmp dword [esi + 0x14], 0x10
mov eax, esi
jb 0x100028f0
mov eax, dword [esi]
push ecx
push eax
push str.CMemMappedFile_GetExistingMemoryMappedFile__name_s__size_lu_
mov edi, 0x1003c820
push edi
call fcn.100259bf
add esp, 0x10
cmp byte [0x1003ce0a], bl
je 0x10002914
push edi
call dword [sym.imp.kernel32.dll_OutputDebugStringA]
cmp byte [0x1003ce0b], bl
je 0x10002923
push edi
call fcn.10005ee0
pop ecx
push esi
call fcn.100259bf
mov edi, eax
pop ecx
test edi, edi
jne 0x10002989
push 0x34
call fcn.100259bf
mov edi, eax
pop ecx
mov dword [ebp - 0x34], edi
mov dword [ebp - 4], ebx
test edi, edi
je 0x1000296e
push esi
lea ecx, [ebp - 0x28]
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x14], ebx
call fcn.10002b1a
push dword [ebp - 0x30]
xor ebx, ebx
lea eax, [ebp - 0x28]
inc ebx
mov ecx, edi
push eax
mov byte [ebp - 4], bl
mov dword [ebp - 0x2c], ebx
call fcn.10001bff
mov edi, eax
jmp 0x10002970
mov edi, ebx
test bl, 1
je 0x10002989
mov eax, dword [ebp - 0x14]
cmp eax, 0x10
jb 0x10002989
inc eax
push eax
push dword [ebp - 0x28]
call fcn.100259bf
pop ecx
pop ecx
mov eax, edi
call fcn.1002b235
ret
Function at 0x100033f0
Capabilities:
Print debug messages

Disassembly:
mov al, byte [0x1003ce0b]
push esi
mov esi, ecx
push edi
mov edi, 0x1003c820
test al, al
jne 0x1000340a
cmp byte [0x1003ce0a], al
je 0x10003449
lea eax, [esi + 4]
cmp dword [eax + 0x14], 0x10
jb 0x10003415
mov eax, dword [eax]
push eax
push str.CMemMappedFile__s__createMemoryMappedFile
push edi
call fcn.100259bf
add esp, 0xc
cmp byte [0x1003ce0a], 0
je 0x10003434
push edi
call dword [sym.imp.kernel32.dll_OutputDebugStringA]
mov al, byte [0x1003ce0b]
test al, al
je 0x10003449
push edi
call fcn.10005ee0
mov al, byte [0x1003ce0b]
pop ecx
mov ecx, dword [esi + 0x24]
test ecx, ecx
je 0x100034e5
mov ecx, esi
call fcn.100259bf
mov dword [esi + 0x20], eax
test eax, eax
je 0x100034b9
cmp byte [0x1003ce0b], 0
jne 0x10003474
cmp byte [0x1003ce0a], 0
je 0x100034b1
lea eax, [esi + 4]
cmp dword [eax + 0x14], 0x10
jb 0x1000347f
mov eax, dword [eax]
push dword [esi + 0x24]
push eax
push str.CMemMappedFile__s__created_file_of_size___lu
push edi
call fcn.100259bf
add esp, 0x10
cmp byte [0x1003ce0a], 0
je 0x100034a1
push edi
call dword [sym.imp.kernel32.dll_OutputDebugStringA]
cmp byte [0x1003ce0b], 0
je 0x100034b1
push edi
call fcn.10005ee0
pop ecx
push esi
call fcn.100259bf
jmp 0x1000352b
cmp byte [0x1003ce0b], 0
jne 0x100034cb
cmp byte [0x1003ce0a], 0
je 0x1000352c
add esi, 4
cmp dword [esi + 0x14], 0x10
jb 0x100034d6
mov esi, dword [esi]
call dword [sym.imp.kernel32.dll_GetLastError]
push eax
push esi
push str.CMemMappedFile__s__ERROR_CREATING__err_u_
jmp 0x10003503
test al, al
jne 0x100034f1
cmp byte [0x1003ce0a], al
je 0x1000352c
add esi, 4
cmp dword [esi + 0x14], 0x10
jb 0x100034fc
mov esi, dword [esi]
push ecx
push esi
push str.CMemMappedFile__s__ERROR_CREATING__SIZE__0_
push edi
call fcn.100259bf
add esp, 0x10
cmp byte [0x1003ce0a], 0
je 0x1000351c
push edi
call dword [sym.imp.kernel32.dll_OutputDebugStringA]
cmp byte [0x1003ce0b], 0
je 0x1000352c
push edi
call fcn.10005ee0
pop ecx
pop edi
pop esi
ret

Function at 0x10003670
Capabilities:
Print debug messages

Disassembly:
cmp byte [0x1003ce0b], 0
push esi
mov esi, ecx
jne 0x10003685
cmp byte [0x1003ce0a], 0
je 0x100036c9
lea eax, [esi + 4]
cmp dword [eax + 0x14], 0x10
jb 0x10003690
mov eax, dword [eax]
push edi
push dword [esi + 0x24]
mov edi, 0x1003c820
push eax
push str.CMemMappedFile__s__size___lu
push edi
call fcn.100259bf
add esp, 0x10
cmp byte [0x1003ce0a], 0
je 0x100036b8
push edi
call dword [sym.imp.kernel32.dll_OutputDebugStringA]
cmp byte [0x1003ce0b], 0
je 0x100036c8
push edi
call fcn.10005ee0
pop ecx
pop edi
mov eax, dword [esi + 0x24]
pop esi
ret
Function at 0x100036e0
Capabilities:
Print debug messages

Disassembly:
cmp byte [0x1003ce0b], 0
push esi
mov esi, ecx
jne 0x100036f5
cmp byte [0x1003ce0a], 0
je 0x10003748
lea ecx, [esi + 4]
cmp dword [ecx + 0x14], 0x10
jb 0x10003700
mov ecx, dword [ecx]
cmp dword [esi + 0x20], 0
mov edx, str.false
push edi
mov eax, str.true
mov edi, 0x1003c820
cmove eax, edx
push eax
push ecx
push str.CMemMappedFile__s__isValid___s
push edi
call fcn.100259bf
add esp, 0x10
cmp byte [0x1003ce0a], 0
je 0x10003737
push edi
call dword [sym.imp.kernel32.dll_OutputDebugStringA]
cmp byte [0x1003ce0b], 0
je 0x10003747
push edi
call fcn.10005ee0
pop ecx
pop edi
cmp dword [esi + 0x20], 0
pop esi
setne al
ret