joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40c347
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x20000
call fcn.0040e140
cmp dword [ebp + 8], 0
je 0x40c3ac
test esi, esi
je 0x40c39a
push 0x22
push esi
call sub.msvcrt.dll_wcschr
test eax, eax
pop ecx
pop ecx
je 0x40c39a
and word [ebp - 0x20000], 0
push esi
push str.__s_
lea eax, [ebp - 0x20000]
push 0xfffe
push eax
call sub.msvcrt.dll__snwprintf
add esp, 0x10
push dword [ebp + 0x1c]
lea eax, [ebp - 0x20000]
push eax
jmp 0x40c39e
push dword [ebp + 0x1c]
push esi
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.DLL_WritePrivateProfileStringW]
leave
ret
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push esi
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.DLL_GetPrivateProfileStringW]
leave
ret

Function at 0x40c3c4
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x4004
call fcn.0040e140
push esi
push edi
xor eax, eax
cmp dword [ebp + 8], eax
push 0x4000
push eax
mov word [ebp - 0x4004], ax
lea eax, [ebp - 0x4002]
mov edi, ecx
push eax
je 0x40c423
call sub.msvcrt.dll_memset
lea eax, [ebp - 0x4004]
push eax
push dword [edi]
push dword [ebp + 0x14]
call fcn.00403df1
add esp, 0x18
push dword [ebp + 0x18]
lea eax, [ebp - 0x4004]
push eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.DLL_WritePrivateProfileStringW]
mov esi, eax
jmp 0x40c464
call sub.msvcrt.dll_memset
add esp, 0xc
push dword [ebp + 0x18]
lea eax, [ebp - 0x4004]
push 0x2000
push eax
push 0x40f99c
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.DLL_GetPrivateProfileStringW]
push dword [ebp + 0x14]
xor ecx, ecx
cmp ecx, eax
sbb esi, esi
push edi
lea edi, [ebp - 0x4004]
neg esi
call fcn.00403e7a
pop ecx
pop ecx
pop edi
mov eax, esi
pop esi
leave
ret

Function at 0x40c46a
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
cmp dword [ebp + 8], 0
push dword [ebp + 0x18]
je 0x40c488
push dword [esi]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call fcn.0040c2fa
add esp, 0x10
pop ebp
ret
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.DLL_GetPrivateProfileIntW]
mov dword [esi], eax
pop ebp
ret

Function at 0x40c4db
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
add eax, eax
mov dword [ebp - 4], eax
lea eax, [ebp - 4]
push eax
push esi
lea eax, [ebp - 8]
push eax
push 0
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x40c514
mov ecx, dword [ebp - 4]
cmp ecx, 2
jb 0x40c510
shr ecx, 1
and word [esi + ecx*2], ax
leave
ret
and word [esi], 0
leave
ret
Function at 0x40ca7d
Capabilities:
Get file size

Disassembly:
push ebx
push esi
mov esi, eax
mov eax, dword [esi]
xor ebx, ebx
cmp eax, ebx
push edi
je 0x40ca93
push eax
call sub.msvcrt.dll_void___cdecl_operator_delete_void__
pop ecx
mov dword [esi], ebx
push dword [esp + 0x10]
call fcn.0040333e
mov edi, eax
cmp edi, 0xffffffff
pop ecx
je 0x40caec
push 0
push edi
call dword [sym.imp.KERNEL32.DLL_GetFileSize]
push eax
mov dword [esi + 4], eax
call sub.msvcrt.dll_void____cdecl_operator_new_unsigned_int_
push dword [esi + 4]
mov dword [esi], eax
push eax
push edi
call fcn.00403d65
mov ebx, eax
add esp, 0x10
test ebx, ebx
je 0x40cae3
mov eax, dword [esi]
cmp dword [eax], 0x66676572
je 0x40cad7
xor ebx, ebx
mov ecx, dword [eax + 0x14]
mov dword [esi + 8], ecx
mov eax, dword [eax + 0x18]
mov dword [esi + 0xc], eax
push edi
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
jmp 0x40cafc
mov esi, dword [esp + 0x14]
test esi, esi
je 0x40cafc
call dword [sym.imp.KERNEL32.DLL_GetLastError]
mov dword [esi], eax
pop edi
pop esi
mov eax, ebx
pop ebx
ret 8
Function at 0x40d8d3
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x238
push esi
lea eax, [ebp - 0x10]
push eax
push dword [ebp + 8]
xor esi, esi
mov dword [ebp - 0x10], esi
call sub.VERSION.dll_GetFileVersionInfoSizeW
cmp eax, esi
mov dword [ebp - 4], eax
jbe 0x40da65
push ebx
mov eax, edi
call fcn.0040480b
push dword [ebp - 4]
call sub.msvcrt.dll_void____cdecl_operator_new_unsigned_int_
pop ecx
mov ebx, eax
push ebx
push dword [ebp - 4]
push esi
push dword [ebp + 8]
call sub.VERSION.dll_GetFileVersionInfoW
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 8]
push eax
push 0x40fce0
push ebx
call sub.VERSION.dll_VerQueryValueW
test eax, eax
je 0x40d956
mov eax, dword [ebp - 8]
mov ecx, dword [eax + 0x30]
mov dword [edi + 4], ecx
mov ecx, dword [eax + 8]
mov dword [edi], ecx
mov ecx, dword [eax + 0x14]
mov dword [edi + 0xc], ecx
mov ecx, dword [eax + 0x10]
mov dword [edi + 8], ecx
mov ecx, dword [eax + 0x24]
mov dword [edi + 0x10], ecx
mov eax, dword [eax + 0x28]
mov dword [edi + 0x14], eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0xc]
push eax
push str.VarFileInfoTranslation
push ebx
call sub.VERSION.dll_VerQueryValueW
test eax, eax
je 0x40d9a5
mov eax, dword [ebp - 0xc]
movzx ecx, word [eax + 2]
movzx eax, word [eax]
push ecx
push eax
push str._4.4X_4.4X
lea eax, [ebp - 0x38]
push 0x14
push eax
call sub.msvcrt.dll__snwprintf
add esp, 0x14
push 0x40f99c
lea eax, [ebp - 0x38]
push eax
push ebx
lea esi, [ebp - 0x238]
call fcn.0040d844
test eax, eax
jne 0x40d9b5
lea eax, [ebp - 0x38]
push str.040904E4
push eax
call sub.msvcrt.dll_wcscpy
pop ecx
pop ecx
push 0x410d40
lea eax, [ebp - 0x38]
push eax
lea esi, [edi + 0x18]
push ebx
call fcn.0040d844
push 0x4113f4
lea eax, [ebp - 0x38]
push eax
lea esi, [edi + 0x218]
push ebx
call fcn.0040d844
push 0x411414
lea eax, [ebp - 0x38]
push eax
lea esi, [edi + 0x418]
push ebx
call fcn.0040d844
push 0x41142c
lea eax, [ebp - 0x38]
push eax
lea esi, [edi + 0x618]
push ebx
call fcn.0040d844
push 0x41144c
lea eax, [ebp - 0x38]
push eax
lea esi, [edi + 0x818]
push ebx
call fcn.0040d844
push 0x411464
lea eax, [ebp - 0x38]
push eax
lea esi, [edi + 0xa18]
push ebx
call fcn.0040d844
push 0x411480
lea eax, [ebp - 0x38]
push eax
lea esi, [edi + 0xc18]
push ebx
call fcn.0040d844
push str.OriginalFileName
lea eax, [ebp - 0x38]
push eax
lea esi, [edi + 0xe18]
push ebx
call fcn.0040d844
xor esi, esi
push ebx
inc esi
call sub.msvcrt.dll_void___cdecl_operator_delete_void__
pop ecx
pop ebx
mov eax, esi
pop esi
leave
ret 4
Function at 0x40da85
Capabilities:
Connect to wmi namespace via wbemlocator

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
lea eax, [ebp - 4]
push eax
push 0x40f49c
push 1
xor esi, esi
push esi
push 0x40f56c
mov dword [ebp - 4], esi
call dword [sym.imp.ole32.dll_CoCreateInstance]
mov ebx, eax
mov eax, dword [ebp - 4]
cmp eax, esi
je 0x40dad6
mov ecx, dword [eax]
push edi
push esi
push esi
push esi
push esi
push esi
push esi
push dword [ebp + 8]
push eax
call dword [ecx + 0xc]
cmp edi, esi
mov ebx, eax
je 0x40dacd
push dword [edi]
call fcn.0040da6c
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
pop esi
mov eax, ebx
pop ebx
leave
ret 4
Function at 0x40debe
Capabilities:
Parse pe header
Terminate process

Disassembly:
push 0x70
push 0x40f440
call fcn.0040e0cc
xor edi, edi
push edi
call dword [sym.imp.KERNEL32.DLL_GetModuleHandleA]
cmp word [eax], 0x5a4d
jne 0x40def9
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x40def9
movzx eax, word [ecx + 0x18]
cmp eax, 0x10b
je 0x40df11
cmp eax, 0x20b
je 0x40defe
mov dword [ebp - 0x1c], edi
jmp 0x40df25
cmp dword [ecx + 0x84], 0xe
jbe 0x40def9
xor eax, eax
cmp dword [ecx + 0xf8], edi
jmp 0x40df1f
cmp dword [ecx + 0x74], 0xe
jbe 0x40def9
xor eax, eax
cmp dword [ecx + 0xe8], edi
setne al
mov dword [ebp - 0x1c], eax
mov dword [ebp - 4], edi
push 2
pop ebx
push ebx
call dword [sym.imp.msvcrt.dll___set_app_type]
pop ecx
or dword [0x4147cc], 0xffffffff
or dword [0x4147d0], 0xffffffff
call dword [sym.imp.msvcrt.dll___p__fmode]
mov ecx, dword [0x4132dc]
mov dword [eax], ecx
call dword [sym.imp.msvcrt.dll___p__commode]
mov ecx, dword [0x4132d8]
mov dword [eax], ecx
mov eax, dword [sym.imp.msvcrt.dll__adjust_fdiv]
mov eax, dword [eax]
mov dword [0x4147c8], eax
call fcn.00406756
cmp dword [section..data], edi
jne 0x40df82
push fcn.00406756
call dword [sym.imp.msvcrt.dll___setusermatherr]
pop ecx
call fcn.0040e0ba
push 0x40f410
push 0x40f40c
call sub.msvcrt.dll__initterm
mov eax, dword [0x4132d4]
mov dword [ebp - 0x20], eax
lea eax, [ebp - 0x20]
push eax
push dword [0x4132d0]
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x2c]
push eax
call dword [sym.imp.msvcrt.dll___wgetmainargs]
mov dword [ebp - 0x30], eax
push 0x40f408
push 0x40f3e8
call sub.msvcrt.dll__initterm
add esp, 0x24
mov eax, dword [sym.imp.msvcrt.dll__wcmdln]
mov esi, dword [eax]
cmp esi, edi
jne 0x40dfe8
or dword [ebp - 4], 0xffffffff
mov eax, 0xff
jmp 0x40e0a2
mov dword [ebp - 0x34], esi
cmp word [esi], 0x22
jne 0x40e036
add esi, ebx
mov dword [ebp - 0x34], esi
mov ax, word [esi]
cmp ax, di
je 0x40e004
cmp ax, 0x22
jne 0x40dff1
cmp word [esi], 0x22
jne 0x40e00f
add esi, ebx
mov dword [ebp - 0x34], esi
mov ax, word [esi]
cmp ax, di
je 0x40e01d
cmp ax, 0x20
jbe 0x40e00a
mov dword [ebp - 0x4c], edi
lea eax, [ebp - 0x78]
push eax
call dword [sym.imp.KERNEL32.DLL_GetStartupInfoW]
test byte [ebp - 0x4c], 1
je 0x40e043
movzx eax, word [ebp - 0x48]
jmp 0x40e046
cmp word [esi], 0x20
jbe 0x40e00f
add esi, ebx
mov dword [ebp - 0x34], esi
jmp 0x40e036
push 0xa
pop eax
push eax
push esi
push edi
push edi
call dword [sym.imp.KERNEL32.DLL_GetModuleHandleA]
push eax
call main
mov esi, eax
mov dword [ebp - 0x7c], esi
cmp dword [ebp - 0x1c], edi
jne 0x40e067
push esi
call dword [sym.imp.msvcrt.dll_exit]
call dword [sym.imp.msvcrt.dll__cexit]
jmp 0x40e09c
or dword [ebp - 4], 0xffffffff
mov eax, esi
call fcn.0040e105
ret
Function at 0x10002184
Capabilities:
Accept command line arguments
Get common file path

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x78c
mov eax, dword [section..data]
xor eax, esp
mov dword [esp + 0x788], eax
push ebx
push esi
lea eax, [esp + 0xc]
push edi
push eax
call fcn.10002277
pop ecx
push 0x62
pop ecx
mov esi, eax
lea edi, [esp + 0x1f8]
rep movsd dword es:[edi], dword [esi]
mov edi, 0x104
lea eax, [esp + 0x588]
push edi
push eax
xor ebx, ebx
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov esi, eax
lea eax, [esp + 0x380]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
push 0x44
lea eax, [esp + 0x1b4]
push ebx
push eax
call fcn.10003860
xor eax, eax
lea edi, [esp + 0x1a8]
stosd dword es:[edi], eax
add esp, 0xc
stosd dword es:[edi], eax
push str.LoaderDll.dll
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
test eax, eax
je 0x10002260
push str.LeCreateProcess
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x10002260
push ebx
push ebx
push ebx
push ebx
lea ecx, [esp + 0x1ac]
push ecx
lea ecx, [esp + 0x1c4]
push ecx
push ebx
lea ecx, [esp + 0x39c]
push ecx
push esi
lea ecx, [esp + 0x5ac]
push ecx
lea ecx, [esp + 0x220]
push ecx
call eax
neg eax
sbb al, al
inc al
jmp 0x10002262
xor al, al
mov ecx, dword [esp + 0x794]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.1000235d
mov esp, ebp
pop ebp
ret

Function at 0x10002277
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
mov edi, dword [ebp + 8]
xor esi, esi
push 0x178
push esi
lea eax, [edi + 0x10]
push eax
call fcn.10003860
add esp, 0xc
mov dword [edi + 8], 0x411
mov eax, 0x3a4
mov dword [edi + 0xc], 0x80
mov dword [edi], eax
mov dword [edi + 4], eax
lea eax, [ebp - 0x38]
push eax
push str.SOFTWAREMicrosoftWindows_NTCurrentVersionTime_ZonesTokyo_Standard_Time
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
test eax, eax
jne 0x1000234d
push ebx
push 0x40
pop ebx
lea eax, [ebp - 8]
mov dword [ebp - 8], ebx
push eax
lea eax, [edi + 0x58]
push eax
push esi
push 2
push 0x10014a30
push esi
push dword [ebp - 0x38]
mov esi, dword [sym.imp.ADVAPI32.dll_RegGetValueW]
call esi
lea eax, [ebp - 8]
mov dword [ebp - 8], ebx
push eax
lea eax, [edi + 0xac]
xor ebx, ebx
push eax
push ebx
push 2
push 0x10014a38
push ebx
push dword [ebp - 0x38]
call esi
lea eax, [ebp - 8]
mov dword [ebp - 8], 0x2c
push eax
lea eax, [ebp - 0x34]
push eax
push ebx
push 8
push 0x10014a40
push ebx
push dword [ebp - 0x38]
call esi
mov ecx, dword [ebp - 0x34]
push dword [ebp - 0x38]
mov dword [edi + 0x54], ecx
mov ecx, dword [ebp - 0x30]
mov dword [edi + 0xa8], ecx
mov dword [edi + 0xfc], ebx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop ebx
mov ecx, dword [ebp - 4]
mov eax, edi
pop edi
xor ecx, ebp
pop esi
call fcn.1000235d
leave
ret
Function at 0x10005866
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x100058a5
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x100058a5
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x100058a5
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x100058a5
cmp dword [ecx + 0x74], 0xe
jbe 0x100058a5
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret
Function at 0x10008524
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
je 0x100085c1
push ebx
push esi
call fcn.100084ed
xor ebx, ebx
sub eax, esi
push ebx
push ebx
push ebx
push ebx
sar eax, 1
push eax
push esi
push ebx
push ebx
mov dword [ebp - 8], eax
call fcn.10008481
add esp, 0x24
mov dword [ebp - 4], eax
test eax, eax
jne 0x1000856e
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x100085c0
push edi
push eax
call fcn.100094df
mov edi, eax
pop ecx
push ebx
test edi, edi
jne 0x1000858e
call fcn.10006fc9
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x100085bf
push ebx
push dword [ebp - 4]
push edi
push dword [ebp - 8]
push esi
push ebx
push ebx
call fcn.10008481
add esp, 0x20
test eax, eax
jne 0x100085ad
push edi
call fcn.10006fc9
jmp 0x100085b5
push ebx
call fcn.10006fc9
mov ebx, edi
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, ebx
pop edi
pop ebx
pop esi
leave
ret

Function at 0x1000882e
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x10010510
push 0x10010508
push str.FlsAlloc
push 0x1f
call fcn.1000874a
mov esi, eax
add esp, 0x10
test esi, esi
je 0x10008862
push dword [ebp + 8]
mov ecx, esi
call dword [0x1000f12c]
call esi
jmp 0x10008868
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
pop esi
pop ebp
ret 4

Function at 0x100088ac
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x10010520
push 0x10010518
push str.FlsGetValue
push 0x21
call fcn.1000874a
mov esi, eax
add esp, 0x10
test esi, esi
je 0x100088e3
push dword [ebp + 8]
mov ecx, esi
call dword [0x1000f12c]
call esi
pop esi
pop ebp
ret 4
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsGetValue]

Function at 0x100088eb
Capabilities:
Set thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x10010528
push 0x10010520
push str.FlsSetValue
push 0x22
call fcn.1000874a
mov esi, eax
add esp, 0x10
test esi, esi
je 0x10008925
push dword [ebp + 0xc]
mov ecx, esi
push dword [ebp + 8]
call dword [0x1000f12c]
call esi
pop esi
pop ebp
ret 8
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsSetValue]
Function at 0x1000dfe0
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x1000e00d
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x1000e00d
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret
Function at 0x42e000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x42e00c
nop
nop
nop
pop eax
nop
nop
add eax, 0x403ac5
nop
sub eax, 0x403a6b
nop
nop
nop
nop
mov ebx, dword [eax]
nop
nop
nop
nop
mov ecx, dword [eax + 4]
mov edx, dword [eax + 8]
nop
nop
nop
xor dword [ebx], edx
nop
nop
nop
nop
nop
add ebx, 4
nop
nop
nop
nop
nop
cmp ebx, ecx
nop
jl 0x42e030
nop
nop
nop
nop
nop
nop
add eax, 0xc
nop
cmp dword [eax], 0
nop
nop
nop
nop
nop
jne 0x42e01e
nop
nop
nop
nop
popal
nop
nop
nop
jmp int.00401219
Function at 0x10001650
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10037af8
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x10055014]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x10], edi
mov esi, dword [ebp + 8]
lea ecx, [edi + 0x2c]
mov dword [edi], vtable.CDbFile.0
mov eax, dword [esi + 4]
mov dword [edi + 4], eax
mov eax, dword [esi + 8]
mov dword [edi + 8], eax
mov eax, dword [esi + 0xc]
mov dword [edi + 0xc], eax
mov eax, dword [esi + 0x10]
mov dword [edi + 0x10], eax
mov eax, dword [esi + 0x14]
mov dword [edi + 0x14], eax
mov eax, dword [esi + 0x18]
mov dword [edi + 0x18], eax
mov eax, dword [esi + 0x1c]
mov dword [edi + 0x1c], eax
mov eax, dword [esi + 0x20]
mov dword [edi + 0x20], eax
mov eax, dword [esi + 0x24]
mov dword [edi + 0x24], eax
mov eax, dword [esi + 0x28]
mov dword [edi + 0x28], eax
lea eax, [esi + 0x2c]
push eax
call dword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__15]
lea eax, [esi + 0x30]
mov dword [ebp - 4], 0
push eax
lea ecx, [edi + 0x30]
call dword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__15]
lea eax, [esi + 0x34]
mov byte [ebp - 4], 1
push eax
lea ecx, [edi + 0x34]
call dword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__15]
mov eax, dword [esi + 0x38]
mov dword [edi + 0x38], eax
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x1000c6c0
Capabilities:
Resume thread

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, ecx
cmp dword [esi + 0x48], 0
je 0x1000c6d3
xor eax, eax
pop esi
pop ebp
ret 0xc
mov eax, dword [ebp + 8]
push 0
push 4
push 0
push 0
mov dword [esi + 0x3c], eax
mov eax, dword [ebp + 0xc]
push esi
mov dword [esi + 0x40], eax
mov eax, dword [ebp + 0x10]
push sym.MrtDataBase.dll_private:_static_unsigned_int___cdecl_CDataBaseManager::DiskWorkThreadProc_void__
mov dword [esi + 0x30], 0
mov dword [esi + 0x44], eax
call dword [sym.imp.mfc140u.dll_AfxBeginThread]
mov dword [esi + 0x48], eax
push dword [eax + 0x2c]
call dword [sym.imp.KERNEL32.dll_ResumeThread]
mov eax, 1
pop esi
pop ebp
ret 0xc

Function at 0x1000c820
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10039518
mov eax, dword fs:[0]
push eax
sub esp, 0x2c
push esi
mov eax, dword [0x10055014]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
push dword [ebp + 8]
lea ecx, [ebp - 0x38]
call fcn.1000c910
lea eax, [ebp - 0x14]
mov dword [ebp - 4], 0
push eax
lea ecx, [esi + 0x30]
call dword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__14]
mov eax, dword [ebp - 0x34]
lea ecx, [esi + 0x2c]
mov dword [esi + 0xc], eax
mov eax, dword [ebp - 0x38]
mov dword [esi + 0x18], eax
mov eax, dword [ebp - 0x2c]
mov dword [esi + 0x10], eax
lea eax, [ebp - 0x18]
push eax
call dword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__14]
lea eax, [ebp - 0x10]
push eax
lea ecx, [esi + 0x34]
call dword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__14]
mov eax, dword [ebp - 0x28]
mov dword [esi + 0x1c], eax
mov eax, dword [ebp - 0x24]
mov dword [esi + 0x20], eax
mov eax, dword [ebp - 0x20]
mov dword [esi + 0x24], eax
mov eax, dword [ebp - 0x1c]
mov dword [esi + 0x28], eax
mov eax, dword [ebp - 0x30]
mov dword [esi + 0x14], eax
mov eax, dword [esi + 8]
test eax, eax
je 0x1000c8c2
push eax
call dword [sym.imp.mfc140u.dll_operator_1]
add esp, 4
lea ecx, [ebp - 0x10]
mov dword [esi + 8], 0
mov dword [esi + 0x38], 0
call dword [sym.imp.mfc140u.dll_Ordinal_1045]
lea ecx, [ebp - 0x14]
call dword [sym.imp.mfc140u.dll_Ordinal_1045]
lea ecx, [ebp - 0x18]
call dword [sym.imp.mfc140u.dll_Ordinal_1045]
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x10017a30
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1003a807
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x10055014]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x10], edi
mov dword [ebp - 4], 0
mov dword [edi + 8], 0
mov dword [edi + 0xc], 0
mov dword [edi + 0x10], 0
lea ecx, [edi + 0x14]
mov byte [ebp - 4], 1
call dword [sym.imp.mfc140u.dll_CFile::CFile]
mov dword [edi + 0x2c], vtable.CArray_struct_StrcPathFileItem__struct_StrcPathFileItem__.0
mov dword [edi + 0x30], 0
mov dword [edi + 0x3c], 0
mov dword [edi + 0x38], 0
mov dword [edi + 0x34], 0
lea ecx, [edi + 0x40]
call dword [sym.imp.mfc140u.dll_Ordinal_296]
mov eax, dword [ebp + 8]
lea ecx, [edi + 0x40]
mov byte [ebp - 4], 4
push 0x10044e10
mov dword [edi], 0
mov dword [edi + 0x28], eax
mov dword [edi + 4], 0
call dword [sym.imp.mfc140u.dll_ATL::CSimpleStringT_wchar_t_1_::operator]
mov eax, dword [edi + 0x30]
test eax, eax
je 0x10017aec
push eax
call dword [sym.imp.mfc140u.dll_operator_1]
add esp, 4
mov dword [edi + 0x30], 0
lea ecx, [ebp + 0xc]
mov dword [edi + 0x38], 0
mov dword [edi + 0x34], 0
call dword [sym.imp.mfc140u.dll_Ordinal_1045]
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 8