joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1000d650
Capabilities:
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1005f16d
mov eax, dword fs:[0]
push eax
sub esp, 0x24
mov eax, dword [0x1007d00c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x28], ecx
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 0x10]
mov ecx, dword [ebp + 0x14]
mov esi, dword [ebp + 0x1c]
cmp dword [eax], 0xffffffff
mov edi, dword [ebp + 8]
mov ebx, dword [ebp + 0x18]
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x14], edx
mov dword [ebp - 0x2c], ecx
je 0x1000d705
mov ecx, dword [0x1007d030]
mov eax, dword [0x1007d034]
cmp ecx, 0x257edfd1
jne 0x1000d6b8
cmp eax, 0xb2ab117a
je 0x1000d6c7
cmp ecx, 0x257edfd0
jne 0x1000d6cb
cmp eax, 0xb2ab117a
jne 0x1000d6cb
mov al, 1
jmp 0x1000d6dc
mov eax, dword [0x1007d028]
mov ecx, 0x1007d028
push 1
mov eax, dword [eax + 0x18]
call eax
mov dword [esi], 1
mov dword [esi + 4], 0x1007d028
movzx ecx, al
add ecx, 2
mov dword [esi + 8], ecx
movq xmm0, qword [esi]
movq qword [edi], xmm0
mov ecx, dword [esi + 8]
mov dword [edi + 8], ecx
jmp 0x1000d807
push 1
push 0
push 0
push ebx
push ecx
push edx
call dword [sym.imp.WS2_32.dll_WSASocketW]
mov ebx, eax
mov ecx, esi
cmp ebx, 0xffffffff
sete dl
call fcn.1000a620
cmp ebx, 0xffffffff
jne 0x1000d72c
or ebx, ebx
jmp 0x1000d74a
cmp dword [ebp - 0x14], 0x17
jne 0x1000d74a
push 4
lea eax, [ebp - 0x14]
mov dword [ebp - 0x14], 0
push eax
push 0x1b
push 0x29
push ebx
call dword [sym.imp.WS2_32.dll_setsockopt]
mov dword [ebp - 4], 0
cmp ebx, 0xffffffff
jne 0x1000d766
movq xmm0, qword [esi]
movq qword [edi], xmm0
mov eax, dword [esi + 8]
jmp 0x1000d804
mov ecx, dword [ebp - 0x28]
lea eax, [ebp - 0x20]
push esi
push ebx
push eax
mov ecx, dword [ecx + 4]
call fcn.1000c290
mov ecx, dword [eax + 8]
test cl, 1
je 0x1000d7bf
cmp ecx, 1
jne 0x1000d789
cmp dword [eax], 0
je 0x1000d7bf
movq xmm0, qword [esi]
lea edx, [ebp - 0x21]
movq qword [edi], xmm0
mov ecx, ebx
mov eax, dword [esi + 8]
xorps xmm0, xmm0
mov dword [edi + 8], eax
lea eax, [ebp - 0x20]
push eax
push 1
movq qword [ebp - 0x20], xmm0
mov dword [ebp - 0x18], 0
mov byte [ebp - 0x21], 0
call fcn.1000a8d0
add esp, 8
jmp 0x1000d807
mov eax, dword [ebp - 0x30]
mov ecx, dword [ebp - 0x2c]
mov dword [ebp - 0x28], 0xffffffff
mov dword [eax], ebx
sub ecx, 1
je 0x1000d7e4
sub ecx, 1
je 0x1000d7de
mov byte [eax + 4], 0
jmp 0x1000d7e8
mov byte [eax + 4], 0x20
jmp 0x1000d7e8
mov byte [eax + 4], 0x10
push dword [ebp - 0x2c]
push ecx
lea ecx, [eax + 8]
call fcn.100284a0
xorps xmm0, xmm0
xor eax, eax
movq qword [esi], xmm0
mov dword [esi + 8], eax
movq qword [edi], xmm0
mov dword [edi + 8], eax
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1005c9d3
mov esp, ebp
pop ebp
ret 0x18
Function at 0x1000d830
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [0x1007d00c]
xor eax, ebp
mov dword [ebp - 4], eax
mov edx, dword [ebp + 0xc]
push ebx
mov ebx, ecx
mov ecx, dword [ebp + 8]
push esi
push edi
mov edi, dword [ebp + 0x1c]
mov eax, dword [ebx + 4]
add eax, 0x18
lock inc dword [eax]
cmp byte [ebp + 0x18], 0
je 0x1000d870
mov esi, dword [ebx + 4]
mov dword [edi + 8], 0
mov dword [edi + 0xc], 0
jmp 0x1000d8d2
mov eax, dword [ecx]
cmp eax, 0xffffffff
jne 0x1000d88a
mov esi, dword [ebx + 4]
mov dword [edi + 8], 0x2719
mov dword [edi + 0xc], 0
jmp 0x1000d8d2
push 0
push edi
push dword [ebp + 0x14]
lea ecx, [ebp - 8]
mov dword [ebp - 8], 0
push ecx
push dword [ebp + 0x10]
push edx
push eax
call dword [sym.imp.WS2_32.dll_WSASend]
mov esi, eax
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x4d2
mov ecx, 0x274d
cmove eax, ecx
test esi, esi
je 0x1000d938
cmp eax, 0x3e5
je 0x1000d938
mov esi, dword [ebx + 4]
mov dword [edi + 8], eax
mov eax, dword [ebp - 8]
mov dword [edi + 0xc], eax
push edi
push 2
push 0
mov dword [edi + 0x1c], 1
mov dword [edi], 0x1007d078
push dword [esi + 0x14]
call dword [sym.imp.KERNEL32.dll_PostQueuedCompletionStatus]
test eax, eax
jne 0x1000d941
lea ebx, [esi + 0x38]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov dword [edi + 0x14], 0
mov eax, dword [esi + 0x58]
test eax, eax
je 0x1000d90e
mov dword [eax + 0x14], edi
jmp 0x1000d911
mov dword [esi + 0x54], edi
mov dword [esi + 0x58], edi
lea eax, [esi + 0x34]
mov ecx, 1
xchg dword [eax], ecx
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1005c9d3
mov esp, ebp
pop ebp
ret 0x18
mov ecx, dword [ebx + 4]
push edi
call fcn.1000c720
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1005c9d3
mov esp, ebp
pop ebp
ret 0x18
Function at 0x1000d960
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [0x1007d00c]
xor eax, ebp
mov dword [ebp - 4], eax
mov edx, dword [ebp + 0xc]
push ebx
push esi
mov esi, dword [ebp + 0x1c]
push edi
mov edi, ecx
mov ecx, dword [ebp + 8]
mov eax, dword [edi + 4]
add eax, 0x18
lock inc dword [eax]
cmp byte [ebp + 0x18], 0
je 0x1000d9a0
mov edi, dword [edi + 4]
mov dword [esi + 8], 0
mov dword [esi + 0xc], 0
jmp 0x1000da15
mov ecx, dword [ecx]
cmp ecx, 0xffffffff
jne 0x1000d9ba
mov edi, dword [edi + 4]
mov dword [esi + 8], 0x2719
mov dword [esi + 0xc], 0
jmp 0x1000da15
mov eax, dword [ebp + 0x14]
push 0
push esi
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
mov dword [ebp - 8], 0
push eax
push dword [ebp + 0x10]
push edx
push ecx
call dword [sym.imp.WS2_32.dll_WSARecv]
mov ebx, eax
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x40
jne 0x1000d9f1
mov eax, 0x2746
jmp 0x1000d9fe
cmp eax, 0x4d2
mov ecx, 0x274d
cmove eax, ecx
test ebx, ebx
je 0x1000da7b
cmp eax, 0x3e5
je 0x1000da7b
mov edi, dword [edi + 4]
mov dword [esi + 8], eax
mov eax, dword [ebp - 8]
mov dword [esi + 0xc], eax
push esi
push 2
push 0
mov dword [esi + 0x1c], 1
mov dword [esi], 0x1007d078
push dword [edi + 0x14]
call dword [sym.imp.KERNEL32.dll_PostQueuedCompletionStatus]
test eax, eax
jne 0x1000da84
lea ebx, [edi + 0x38]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov dword [esi + 0x14], 0
mov eax, dword [edi + 0x58]
test eax, eax
je 0x1000da51
mov dword [eax + 0x14], esi
jmp 0x1000da54
mov dword [edi + 0x54], esi
mov dword [edi + 0x58], esi
lea eax, [edi + 0x34]
mov ecx, 1
xchg dword [eax], ecx
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1005c9d3
mov esp, ebp
pop ebp
ret 0x18
mov ecx, dword [edi + 4]
push esi
call fcn.1000c720
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1005c9d3
mov esp, ebp
pop ebp
ret 0x18
Function at 0x1000daa0
Capabilities:
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x34
mov eax, dword [0x1007d00c]
xor eax, esp
mov dword [esp + 0x30], eax
mov eax, dword [ebp + 0x10]
push ebx
mov ebx, ecx
mov dword [esp + 0xc], eax
mov eax, dword [ebp + 0x20]
mov ecx, dword [ebp + 8]
mov dword [esp + 0x10], eax
mov eax, dword [ebx + 4]
push esi
push edi
mov edi, dword [ebp + 0x28]
add eax, 0x18
mov dword [esp + 0x1c], ecx
lock inc dword [eax]
cmp dword [ecx], 0xffffffff
jne 0x1000daee
mov esi, dword [ebx + 4]
mov dword [edi + 8], 0x2719
jmp 0x1000dc04
cmp byte [ebp + 0xc], 0
je 0x1000db03
mov esi, dword [ebx + 4]
mov dword [edi + 8], 1
jmp 0x1000dc04
push 1
push 0
push 0
push dword [ebp + 0x1c]
xorps xmm0, xmm0
mov dword [esp + 0x3c], 0
push dword [ebp + 0x18]
movq qword [esp + 0x38], xmm0
push dword [ebp + 0x14]
call dword [sym.imp.WS2_32.dll_WSASocketW]
mov esi, eax
lea ecx, [esp + 0x24]
cmp esi, 0xffffffff
sete dl
call fcn.1000a620
cmp esi, 0xffffffff
jne 0x1000db43
or esi, esi
jmp 0x1000db63
cmp dword [ebp + 0x14], 0x17
jne 0x1000db63
push 4
lea eax, [esp + 0x24]
mov dword [esp + 0x24], 0
push eax
push 0x1b
push 0x29
push esi
call dword [sym.imp.WS2_32.dll_setsockopt]
mov eax, dword [esp + 0x14]
mov ecx, dword [eax]
cmp ecx, 0xffffffff
je 0x1000db9b
lea eax, [esp + 0x30]
mov dword [esp + 0x38], 0
push eax
xorps xmm0, xmm0
mov byte [esp + 0x17], 0
push 1
lea edx, [esp + 0x1b]
movq qword [esp + 0x38], xmm0
call fcn.1000a8d0
mov eax, dword [esp + 0x1c]
add esp, 8
mov dword [eax], esi
cmp esi, 0xffffffff
jne 0x1000dbc5
push ecx
mov ecx, dword [ebx + 4]
lea eax, [esp + 0x28]
push eax
push edi
call fcn.1000c790
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x30]
xor ecx, esp
call fcn.1005c9d3
mov esp, ebp
pop ebp
ret 0x24
push edi
lea eax, [esp + 0x24]
mov dword [esp + 0x24], 0
push eax
mov eax, dword [ebp + 0x24]
push eax
push eax
mov eax, dword [esp + 0x2c]
push 0
push dword [esp + 0x2c]
push esi
push dword [eax]
call dword [sym.imp.MSWSOCK.dll_AcceptEx]
mov esi, eax
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
test esi, esi
jne 0x1000dc72
cmp eax, 0x3e5
je 0x1000dc72
mov esi, dword [ebx + 4]
mov dword [edi + 8], eax
push edi
push 2
push 0
mov dword [edi + 0x1c], 1
mov dword [edi], 0x1007d078
mov dword [edi + 0xc], 0
push dword [esi + 0x14]
call dword [sym.imp.KERNEL32.dll_PostQueuedCompletionStatus]
test eax, eax
jne 0x1000dc7b
lea ebx, [esi + 0x38]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov dword [edi + 0x14], 0
mov eax, dword [esi + 0x58]
test eax, eax
je 0x1000dc47
mov dword [eax + 0x14], edi
jmp 0x1000dc4a
mov dword [esi + 0x54], edi
mov dword [esi + 0x58], edi
lea eax, [esi + 0x34]
mov ecx, 1
xchg dword [eax], ecx
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x30]
xor ecx, esp
call fcn.1005c9d3
mov esp, ebp
pop ebp
ret 0x24
mov ecx, dword [ebx + 4]
push edi
call fcn.1000c720
mov ecx, dword [esp + 0x3c]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.1005c9d3
mov esp, ebp
pop ebp
ret 0x24
Function at 0x1000ec00
Capabilities:
Terminate thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [0x1007d00c]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, ecx
push edi
mov ecx, dword [esi + 0x1c]
test ecx, ecx
je 0x1000eccb
or eax, 0xffffffff
lock xadd dword [ecx + 0x18], eax
jne 0x1000ec2e
call fcn.1000c500
mov ecx, dword [esi + 0x1c]
call fcn.1000c500
mov edi, dword [esi + 0x20]
test edi, edi
je 0x1000ecb7
mov eax, dword [edi + 8]
mov dword [ebp - 0xc], eax
mov eax, dword [edi + 4]
push 0xffffffffffffffff
mov dword [ebp - 8], eax
lea eax, [ebp - 0xc]
push 0
push eax
push 2
call dword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
push dword [edi + 8]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
mov ecx, 0x100821c0
lock xadd dword [ecx], eax
mov ecx, dword [edi + 4]
push 0
push ecx
test eax, eax
je 0x1000ec7f
call dword [sym.imp.KERNEL32.dll_TerminateThread]
jmp 0x1000ec95
push method.boost::asio::detail::execution_context_service_base_class_boost::asio::detail::win_iocp_socket_service_class_boost::asio::ip::tcp__.virtual_8
call dword [sym.imp.KERNEL32.dll_QueueUserAPC]
push 0xffffffffffffffff
push dword [edi + 4]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov edi, dword [esi + 0x20]
test edi, edi
je 0x1000ecb0
push dword [edi + 4]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0xc
push edi
call fcn.1005ce33
add esp, 8
mov dword [esi + 0x20], 0
mov ecx, dword [esi + 0x1c]
test ecx, ecx
je 0x1000ecc4
mov eax, dword [ecx]
push 1
call dword [eax]
mov dword [esi + 0x1c], 0
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.1005c9d3
mov esp, ebp
pop ebp
ret
Function at 0x10011c30
Capabilities:
Hash data using sha1

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x164
mov eax, dword [0x1007d00c]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
mov ebx, edx
mov dword [ebp - 0x164], eax
push edi
mov edx, ecx
mov dword [ebp - 0x160], ebx
xor edi, edi
mov dword [ebp - 0x15c], edx
mov dword [ebp - 0x18], 0x67452301
mov dword [ebp - 0x14], 0xefcdab89
mov dword [ebp - 0x10], 0x98badcfe
mov dword [ebp - 0xc], 0x10325476
mov dword [ebp - 8], 0xc3d2e1f0
cmp ebx, 0x40
jb 0x10011cfe
nop dword [eax]
lea eax, [edi + 0x40]
cmp edi, eax
jae 0x10011ce3
lea eax, [edx + 2]
mov ebx, 0x10
add eax, edi
lea esi, [ebp - 0x158]
add edi, 0x40
nop word [eax + eax]
movzx edx, byte [eax - 2]
lea esi, [esi + 4]
movzx ecx, byte [eax - 1]
lea eax, [eax + 4]
shl edx, 8
or edx, ecx
movzx ecx, byte [eax - 4]
shl edx, 8
or edx, ecx
movzx ecx, byte [eax - 3]
shl edx, 8
or edx, ecx
mov dword [esi - 4], edx
sub ebx, 1
jne 0x10011cb0
mov ebx, dword [ebp - 0x160]
lea edx, [ebp - 0x158]
lea ecx, [ebp - 0x18]
call fcn.10011a00
mov edx, dword [ebp - 0x15c]
lea eax, [ebx - 0x40]
cmp edi, eax
jbe 0x10011c90
sub ebx, edi
mov eax, 0xf
nop word [eax + eax]
mov dword [ebp + eax*4 - 0x158], 0
sub eax, 1
jns 0x10011d10
xor esi, esi
lea ecx, [esi + 3]
test ebx, ebx
je 0x10011d5a
add edi, edx
nop dword [eax + eax]
mov eax, esi
lea edx, [ebp - 0x158]
shr eax, 2
lea edx, [edx + eax*4]
mov eax, esi
and eax, 3
sub ecx, eax
movzx eax, byte [edi + esi]
shl ecx, 3
inc esi
shl eax, cl
mov ecx, 3
or dword [edx], eax
cmp esi, ebx
jb 0x10011d30
mov eax, esi
lea edx, [ebp - 0x158]
shr eax, 2
and esi, 3
lea edx, [edx + eax*4]
sub ecx, esi
shl ecx, 3
mov eax, 0x80
shl eax, cl
or dword [edx], eax
cmp ebx, 0x38
jb 0x10011db0
lea edx, [ebp - 0x158]
lea ecx, [ebp - 0x18]
call fcn.10011a00
mov eax, 0xf
nop dword [eax]
nop word [eax + eax]
mov dword [ebp + eax*4 - 0x158], 0
sub eax, 1
jns 0x10011da0
mov eax, dword [ebp - 0x160]
lea edx, [ebp - 0x158]
shl eax, 3
lea ecx, [ebp - 0x18]
mov dword [ebp - 0x11c], eax
call fcn.10011a00
mov esi, dword [ebp - 0x164]
mov edx, 0x13
mov eax, edx
mov ecx, edx
and eax, 0xfffffffc
not ecx
and ecx, 3
shl ecx, 3
mov eax, dword [ebp + eax - 0x18]
shr eax, cl
mov byte [esi + edx], al
sub edx, 1
jns 0x10011dd8
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1005c9d3
mov esp, ebp
pop ebp
ret
Function at 0x10012310
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x624
mov eax, dword [0x1007d00c]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [0x10082218]
cmp dword [eax], 0xffffffff
jne 0x100124ed
xor eax, eax
push esi
cmp ax, word [0x1008221c]
jne 0x1001249a
mov dword [ebp - 0x624], eax
lea eax, [ebp - 0x624]
push eax
push 0x201
push 0
push str.SoftwareRazer_Chroma_SDK
push reloc.WS2_32.dll_bind
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1001249a
lea eax, [ebp - 0x620]
mov dword [ebp - 0x620], 0x208
push eax
lea eax, [ebp - 0x61c]
push eax
push 0
push 0
push 0x10069594
push dword [ebp - 0x624]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1001248e
lea eax, [ebp - 0x61c]
push eax
lea eax, [ebp - 0x414]
push 0x104
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscpy_s]
add esp, 0xc
lea eax, [ebp - 0x414]
push str.Logs
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
push 0x104
lea eax, [ebp - 0x20c]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test eax, eax
je 0x1001248e
mov ax, word [ebp - 0x20c]
xor edx, edx
xor ecx, ecx
test ax, ax
je 0x10012421
movzx esi, ax
nop
movzx eax, si
cmp eax, 0x20
je 0x10012411
mov word [ebp + edx*2 - 0x20c], ax
inc edx
movzx eax, word [ebp + ecx*2 - 0x20a]
inc ecx
mov esi, eax
test ax, ax
jne 0x10012400
add edx, edx
cmp edx, 0x208
jae 0x100124fb
xor eax, eax
mov word [ebp + edx - 0x20c], ax
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathStripPathW]
push str..log
lea eax, [ebp - 0x20c]
push 0x104
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscat_s]
add esp, 0xc
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x414]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
lea eax, [ebp - 0x414]
push eax
push 0x104
push 0x1008221c
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscpy_s]
add esp, 0xc
push dword [ebp - 0x624]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov esi, dword [0x10082218]
cmp dword [esi], 0xffffffff
jne 0x100124c9
push 0
push 0x80
push 4
push 0
push 3
push 0xc0000000
push 0x1008221c
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [esi], eax
cmp eax, 0xffffffff
je 0x100124ec
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x100124de
push 0
call dword [sym.imp.KERNEL32.dll_SetLastError]
push 2
push 0
push 0
push dword [esi]
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1005c9d3
mov esp, ebp
pop ebp
ret
call fcn.1005cf63
int3
Function at 0x10012a50
Capabilities:
Check if file exists
Delete file
Get file size
Move file

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x424
mov eax, dword [0x1007d00c]
xor eax, esp
mov dword [esp + 0x420], eax
push ebx
push esi
mov ebx, ecx
lea eax, [esp + 0xc]
push edi
push eax
xorps xmm0, xmm0
mov dword [esp + 0x10], ebx
mov eax, dword [ebx + 0x48]
movq qword [esp + 0x14], xmm0
push dword [eax]
call dword [sym.imp.KERNEL32.dll_GetFileSizeEx]
cmp dword [esp + 0x14], 0
jl 0x10012bd1
jg 0x10012aa7
cmp dword [esp + 0x10], 0x500000
jbe 0x10012bd1
mov eax, dword [ebx + 0x48]
push dword [eax]
call dword [sym.imp.KERNEL32.dll_FlushFileBuffers]
mov esi, dword [ebx + 0x48]
mov eax, dword [esi]
cmp eax, 0xffffffff
je 0x10012ace
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp eax, 1
jne 0x10012ace
mov dword [esi], 0xffffffff
push 5
lea edi, [ebx + 0x4c]
push edi
push str._s__d.bak
lea eax, [esp + 0x22c]
push 0x104
push eax
call fcn.10001330
add esp, 0x14
lea eax, [esp + 0x220]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov ebx, dword [sym.imp.KERNEL32.dll_MoveFileW]
mov esi, 4
push esi
push edi
push str._s__d.bak
lea eax, [esp + 0x24]
push 0x104
push eax
call fcn.10001330
add esp, 0x14
lea eax, [esp + 0x18]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x10012b5d
lea eax, [esi + 1]
push eax
push edi
push str._s__d.bak
lea eax, [esp + 0x22c]
push 0x104
push eax
call fcn.10001330
add esp, 0x14
lea eax, [esp + 0x220]
push eax
lea eax, [esp + 0x1c]
push eax
call ebx
dec esi
test esi, esi
jg 0x10012b07
push edi
push str._s_1.bak
lea eax, [esp + 0x20]
push 0x104
push eax
call fcn.10001330
add esp, 0x10
lea eax, [esp + 0x18]
push eax
push edi
call ebx
mov esi, dword [esp + 0xc]
mov esi, dword [esi + 0x48]
cmp dword [esi], 0xffffffff
jne 0x10012bae
push 0
push 0x80
push 4
push 0
push 3
push 0xc0000000
push edi
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [esi], eax
cmp eax, 0xffffffff
je 0x10012bd1
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x10012bc3
push 0
call dword [sym.imp.KERNEL32.dll_SetLastError]
push 2
push 0
push 0
push dword [esi]
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov ecx, dword [esp + 0x42c]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.1005c9d3
mov esp, ebp
pop ebp
ret
Function at 0x10013560
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1005f9c0
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x1007d00c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x14], edi
mov ecx, dword [edi + 0x484]
mov eax, ecx
mov esi, dword [edi + 0x480]
sub eax, esi
sar eax, 2
test eax, eax
je 0x1001360b
cmp esi, ecx
je 0x1001360b
mov edi, ecx
nop word [eax + eax]
mov eax, dword [esi]
push eax
push 0
push 1
mov dword [ebp - 0x10], eax
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov ebx, eax
test ebx, ebx
je 0x10013601
push 1
push ebx
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
test eax, eax
je 0x10013601
push dword [ebp - 0x10]
push str.CChromaConnectServer::terminate_endpoint
push str._WSServer___s__pid___d
push 0x23b
push str.c:workspacechromasdkRC3.36CoreChromaConnectServerChromaConnectServer.cpp
push 3
call fcn.10012170
push eax
call fcn.10012510
add esp, 0x1c
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
add esi, 4
cmp esi, edi
jne 0x100135b0
mov edi, dword [ebp - 0x14]
mov eax, dword [edi + 0x480]
test eax, eax
je 0x10013666
mov ecx, dword [edi + 0x488]
sub ecx, eax
and ecx, 0xfffffffc
cmp ecx, 0x1000
jb 0x1001363e
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x1001377a
mov eax, edx
push ecx
push eax
call fcn.1005ce33
mov dword [edi + 0x480], 0
add esp, 8
mov dword [edi + 0x484], 0
mov dword [edi + 0x488], 0
mov esi, dword [edi + 0x47c]
test esi, esi
je 0x10013691
or ebx, 0xffffffff
mov eax, ebx
lock xadd dword [esi + 4], eax
jne 0x10013691
mov eax, dword [esi]
mov ecx, esi
call dword [eax]
lock xadd dword [esi + 8], ebx
dec ebx
jne 0x10013691
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 4]
mov ebx, dword [sym.imp.MSVCP140.dll__Cnd_destroy_in_situ]
lea eax, [edi + 0x450]
push eax
call ebx
mov esi, dword [sym.imp.MSVCP140.dll__Mtx_destroy_in_situ]
lea eax, [edi + 0x420]
push eax
call esi
lea eax, [edi + 0x3f4]
push eax
call ebx
lea eax, [edi + 0x3c4]
push eax
call esi
add esp, 0x10
lea ecx, [edi + 0x3b0]
call fcn.1001a6c0
cmp dword [edi + 0x3ac], 0
jne 0x10013780
lea eax, [edi + 0x380]
push eax
call ebx
lea eax, [edi + 0x350]
push eax
call esi
add esp, 8
lea ecx, [edi + 0x33c]
call fcn.1001a6c0
cmp dword [edi + 0x338], 0
jne 0x10013780
lea eax, [edi + 0x304]
push eax
call esi
add esp, 4
cmp dword [edi + 0x2fc], 0
jne 0x10013780
mov eax, dword [edi + 0x2f0]
lea esi, [edi + 0x2f0]
mov ecx, esi
push dword [eax + 4]
push esi
call fcn.10029c80
push 0x18
push dword [esi]
call fcn.1005ce33
mov eax, dword [edi + 0x2e8]
lea esi, [edi + 0x2e8]
add esp, 8
mov ecx, esi
push dword [eax + 4]
push esi
call fcn.10029cf0
push 0x18
push dword [esi]
call fcn.1005ce33
add esp, 8
lea ecx, [edi + 8]
call fcn.1001f0d0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_terminate]
int3