joyce8/EMBER2024-capa huggingface dataset:
Function at 0x102a5140
Capabilities:
Contain obfuscated stackstrings

Disassembly:
add byte [eax], al
lea eax, [ebp - 0x334]
push eax
push dword [ebp + 8]
call dword [ebp - 0x538]
mov dword [ebp - 0x398], eax
mov byte [ebp - 0x544], 1
invalid

Function at 0x102a5e00
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push esp
aas
fmul st(4)
lea eax, [ebp - 0x6f4]
push eax
call fcn.102a449b
pop ecx
push eax
push dword [ebp + 0x18]
push dword [ebp + 0x14]
call fcn.102a4450
add esp, 0xc
mov dword [ebp - 0x730], eax
and dword [ebp - 0x6fc], 0
push 1
pop eax
test eax, eax
je 0x102a6531
lea eax, [ebp - 0x230]
mov dword [ebp - 0x3a0], eax
cmp dword [ebp - 0x6fc], 0
jne 0x102a6006
and byte [ebp - 0x77c], 0
and byte [ebp - 0x77b], 0
mov byte [ebp - 0x77a], 4
and byte [ebp - 0x779], 0
mov byte [ebp - 0x778], 0xb8
mov byte [ebp - 0x777], 0xc1
mov byte [ebp - 0x776], 0xa7
mov byte [ebp - 0x775], 0xab
mov byte [ebp - 0x774], 0x89
mov byte [ebp - 0x773], 0x94
mov byte [ebp - 0x772], 0x9c
mov byte [ebp - 0x771], 0x89
mov byte [ebp - 0x770], 0x9a
mov byte [ebp - 0x76f], 0x96
mov byte [ebp - 0x76e], 0xdb
invalid
invalid
xchg ebx, eax
clc
invalid
invalid
Function at 0x102b4dc0
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10336606
mov eax, dword fs:[0]
push eax
sub esp, 0x34
mov eax, dword [0x10525930]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push 0x104acf40
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
je 0x102b4ef5
push str.InitializeSRWLock
mov eax, dword [ebp - 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x102b4ef5
push str.AcquireSRWLockExclusive
mov ecx, dword [ebp - 0x10]
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
je 0x102b4ef5
push str.ReleaseSRWLockExclusive
mov edx, dword [ebp - 0x10]
push edx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0
je 0x102b4ef5
push str.InitializeConditionVariable
mov eax, dword [ebp - 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0
je 0x102b4ef5
push str.SleepConditionVariableSRW
mov ecx, dword [ebp - 0x10]
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 0
je 0x102b4ef5
push str.WakeAllConditionVariable
mov edx, dword [ebp - 0x10]
push edx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 0
je 0x102b4ef5
push 0x1c
call fcn.1025af50
add esp, 4
mov dword [ebp - 0x30], eax
mov dword [ebp - 4], 0
cmp dword [ebp - 0x30], 0
je 0x102b4edc
mov eax, dword [ebp - 0x28]
push eax
mov ecx, dword [ebp - 0x24]
push ecx
mov edx, dword [ebp - 0x20]
push edx
mov eax, dword [ebp - 0x1c]
push eax
mov ecx, dword [ebp - 0x18]
push ecx
mov edx, dword [ebp - 0x14]
push edx
mov ecx, dword [ebp - 0x30]
call fcn.102b5130
mov dword [ebp - 0x3c], eax
jmp 0x102b4ee3
mov dword [ebp - 0x3c], 0
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x2c], eax
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x2c]
jmp 0x102b4f33
push 0x34
call fcn.1025af50
add esp, 4
mov dword [ebp - 0x38], eax
mov dword [ebp - 4], 1
cmp dword [ebp - 0x38], 0
je 0x102b4f1c
mov ecx, dword [ebp - 0x38]
call fcn.102b5350
mov dword [ebp - 0x40], eax
jmp 0x102b4f23
mov dword [ebp - 0x40], 0
mov ecx, dword [ebp - 0x40]
mov dword [ebp - 0x34], ecx
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x34]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
Function at 0x102bb770
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10336c13
mov eax, dword fs:[0]
push eax
sub esp, 8
mov eax, dword [0x10525930]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x14], ecx
xor eax, eax
mov byte [ebp - 0xd], al
lea ecx, [ebp - 0xd]
push ecx
mov ecx, dword [ebp - 0x14]
call fcn.102bbec0
mov dword [ebp - 4], 0
mov ecx, dword [ebp - 0x14]
add ecx, 0xc
call fcn.102bc100
mov byte [ebp - 4], 1
mov ecx, dword [ebp - 0x14]
add ecx, 0x30
call fcn.102bb810
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret

Function at 0x102bb830
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10336be4
mov eax, dword fs:[0]
push eax
sub esp, 0x24
mov eax, dword [0x10525930]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x2c], ecx
xor eax, eax
mov byte [ebp - 0x1d], al
lea ecx, [ebp - 0x1d]
push ecx
mov ecx, dword [ebp - 0x2c]
call fcn.102bbec0
mov dword [ebp - 4], 0
mov edx, dword [ebp + 8]
add edx, 0xc
push edx
mov ecx, dword [ebp - 0x2c]
add ecx, 0xc
call fcn.102bc120
mov byte [ebp - 4], 1
mov ecx, dword [ebp - 0x2c]
add ecx, 0x30
call fcn.102bb810
lea eax, [ebp - 0x10]
push eax
mov ecx, dword [ebp + 8]
call fcn.102bbf90
lea ecx, [ebp - 0x14]
push ecx
mov ecx, dword [ebp + 8]
call fcn.102bbfb0
jmp 0x102bb8b3
lea ecx, [ebp - 0x10]
call fcn.102bc220
lea edx, [ebp - 0x14]
push edx
lea eax, [ebp - 0x10]
push eax
call fcn.102bc200
add esp, 8
movzx ecx, al
test ecx, ecx
je 0x102bb984
push 0
push 1
mov ecx, dword [ebp - 0x2c]
add ecx, 0xc
call fcn.102bc1a0
mov dword [ebp - 0x18], eax
mov edx, dword [ebp - 0x18]
push edx
push 0x10
call fcn.10009b20
add esp, 8
mov dword [ebp - 0x28], eax
mov byte [ebp - 4], 2
cmp dword [ebp - 0x28], 0
je 0x102bb920
lea ecx, [ebp - 0x10]
call fcn.102b7900
add eax, 0xc
push eax
lea ecx, [ebp - 0x10]
call fcn.102b7900
add eax, 8
push eax
mov ecx, dword [ebp - 0x28]
call fcn.102bb9a0
mov dword [ebp - 0x30], eax
jmp 0x102bb927
mov dword [ebp - 0x30], 0
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x24], eax
mov byte [ebp - 4], 1
mov ecx, dword [ebp - 0x18]
push ecx
mov ecx, dword [ebp - 0x2c]
call fcn.102bbf10
lea ecx, [ebp - 0x10]
call fcn.102b7900
add eax, 8
mov ecx, eax
call fcn.102ba030
push eax
mov ecx, dword [ebp - 0x2c]
call fcn.102baa30
mov dword [ebp - 0x1c], eax
mov edx, dword [ebp - 0x1c]
cmp dword [edx], 0
jne 0x102bb976
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x18]
mov dword [eax + 4], ecx
mov edx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x18]
mov dword [edx], eax
jmp 0x102bb97f
mov ecx, dword [ebp - 0x1c]
mov edx, dword [ebp - 0x18]
mov dword [ecx + 4], edx
jmp 0x102bb8ab
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x2c]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret 4
Function at 0x102be760
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1033704a
mov eax, dword fs:[0]
push eax
sub esp, 0x2c
mov eax, dword [0x10525930]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x30], ecx
mov ecx, dword [ebp - 0x30]
call fcn.102b6520
mov dword [ebp - 4], 0
mov ecx, dword [ebp - 0x30]
add ecx, 4
call fcn.102c1760
mov byte [ebp - 4], 1
mov ecx, dword [ebp - 0x30]
add ecx, 0xc
call fcn.102c3e30
mov byte [ebp - 4], 2
mov eax, dword [ebp - 0x30]
mov dword [eax], vtable.file_collector.0
mov ecx, dword [ebp + 8]
push ecx
mov ecx, dword [ebp - 0x30]
add ecx, 0x14
call fcn.102dfad0
mov byte [ebp - 4], 3
mov ecx, dword [ebp - 0x30]
add ecx, 0x1c
call fcn.10013f00
mov byte [ebp - 4], 4
mov edx, dword [ebp - 0x30]
mov eax, dword [ebp + 0x10]
mov dword [edx + 0x28], eax
mov ecx, dword [ebp + 0x14]
mov dword [edx + 0x2c], ecx
mov edx, dword [ebp - 0x30]
mov eax, dword [ebp + 0x18]
mov dword [edx + 0x30], eax
mov ecx, dword [ebp + 0x1c]
mov dword [edx + 0x34], ecx
mov edx, dword [ebp - 0x30]
add edx, 0x38
push edx
call fcn.102c16c0
add esp, 4
mov byte [ebp - 4], 5
mov ecx, dword [ebp - 0x30]
add ecx, 0x58
call fcn.10012aa0
mov byte [ebp - 4], 6
mov ecx, dword [ebp - 0x30]
add ecx, 0x78
call fcn.102c3f30
mov byte [ebp - 4], 7
mov eax, dword [ebp - 0x30]
mov dword [eax + 0x90], 0
mov dword [eax + 0x94], 0
mov ecx, dword [ebp + 0xc]
push ecx
lea edx, [ebp - 0x2c]
push edx
mov ecx, dword [ebp - 0x30]
call fcn.102c16f0
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x38], eax
mov byte [ebp - 4], 8
mov ecx, dword [ebp - 0x38]
push ecx
mov ecx, dword [ebp - 0x30]
add ecx, 0x58
call fcn.1012ca60
mov byte [ebp - 4], 7
lea ecx, [ebp - 0x2c]
call fcn.1000b370
mov edx, dword [ebp - 0x30]
add edx, 0x58
push edx
call fcn.102c16a0
add esp, 4
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x30]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret 0x18

Function at 0x102df470
Capabilities:
Allocate thread local storage

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1033ab48
mov eax, dword fs:[0]
push eax
sub esp, 0x24
mov eax, dword [0x10525930]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x30], ecx
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
mov ecx, dword [ebp - 0x30]
mov dword [ecx], eax
mov edx, dword [ebp - 0x30]
cmp dword [edx], 0xffffffff
jne 0x102df4de
push str.TLS_capacity_depleted
lea ecx, [ebp - 0x2c]
call fcn.10003680
mov dword [ebp - 4], 0
lea eax, [ebp - 0x2c]
push eax
push 0x2b
push str.libslog_src_thread_specific.cpp
call fcn.102ab870
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x2c]
call fcn.10003790
push 0
mov ecx, dword [ebp - 0x30]
call fcn.102df540
mov eax, dword [ebp - 0x30]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
Function at 0x102e9200
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov ecx, dword [ebp + 8]
call fcn.102c4a90
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0xffffffff
jne 0x102e923b
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
lea edx, [ebp - 0xc]
push edx
call fcn.102e90e0
add esp, 0xc
mov ecx, eax
call fcn.1012a030
jmp 0x102e928e
cmp dword [ebp + 0xc], 0
je 0x102e9249
mov ecx, dword [ebp + 0xc]
call fcn.102ed160
mov eax, dword [ebp - 4]
and eax, 0x400
je 0x102e927f
mov ecx, dword [ebp + 8]
push ecx
call fcn.102e8f90
add esp, 4
movzx edx, al
test edx, edx
je 0x102e9278
mov eax, dword [ebp - 4]
and eax, 0x10
neg eax
sbb eax, eax
and eax, 7
add eax, 4
jmp 0x102e928e
mov eax, 9
jmp 0x102e928e
mov eax, dword [ebp - 4]
and eax, 0x10
neg eax
sbb eax, eax
neg eax
add eax, 2
mov esp, ebp
pop ebp
ret

Function at 0x102e92a0
Capabilities:
Clear file content

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push 0
push 0x80
push 3
push 0
push 0
push 0x40000000
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp + 0xc]
mov dword [ebp - 8], ecx
mov edx, dword [ebp + 0x10]
mov dword [ebp - 4], edx
cmp dword [ebp - 0xc], 0xffffffff
je 0x102e9316
push 0
push 0
mov eax, dword [ebp - 4]
push eax
mov ecx, dword [ebp - 8]
push ecx
mov edx, dword [ebp - 0xc]
push edx
call dword [sym.imp.KERNEL32.dll_SetFilePointerEx]
test eax, eax
je 0x102e9316
mov eax, dword [ebp - 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
test eax, eax
je 0x102e9316
mov ecx, dword [ebp - 0xc]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
je 0x102e9316
mov dword [ebp - 0x10], 1
jmp 0x102e931d
mov dword [ebp - 0x10], 0
mov eax, dword [ebp - 0x10]
mov esp, ebp
pop ebp
ret
Function at 0x102ea0f0
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1033bde1
mov eax, dword fs:[0]
push eax
sub esp, 0x20
mov eax, dword [0x10525930]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push str.boost::filesystem::copy_directory
lea ecx, [ebp - 0x2c]
call fcn.10003680
mov dword [ebp - 4], 0
lea eax, [ebp - 0x2c]
push eax
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
push 0
mov ecx, dword [ebp + 0xc]
call fcn.102c4a90
push eax
mov ecx, dword [ebp + 8]
call fcn.102c4a90
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryExW]
test eax, eax
sete cl
movzx edx, cl
push edx
call fcn.102e8570
add esp, 0x14
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x2c]
call fcn.10003790
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret

Function at 0x102ea190
Capabilities:
Copy file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1033be04
mov eax, dword fs:[0]
push eax
sub esp, 0x20
mov eax, dword [0x10525930]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push str.boost::filesystem::copy_file
lea ecx, [ebp - 0x2c]
call fcn.10003680
mov dword [ebp - 4], 0
lea eax, [ebp - 0x2c]
push eax
mov ecx, dword [ebp + 0x14]
push ecx
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
xor ecx, ecx
cmp dword [ebp + 0x10], 0
sete cl
push ecx
mov ecx, dword [ebp + 0xc]
call fcn.102c4a90
push eax
mov ecx, dword [ebp + 8]
call fcn.102c4a90
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
sete dl
movzx eax, dl
push eax
call fcn.102e8570
add esp, 0x14
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x2c]
call fcn.10003790
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
Function at 0x102ea4c0
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1033be92
mov eax, dword fs:[0]
push eax
sub esp, 0x90
mov eax, dword [0x10525930]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push 0
mov ecx, dword [ebp + 8]
call fcn.102c4a90
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
je 0x102ea512
cmp dword [ebp + 0xc], 0
je 0x102ea50b
mov ecx, dword [ebp + 0xc]
call fcn.102ed160
mov al, 1
jmp 0x102ea5d4
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x10], eax
lea ecx, [ebp - 0x18]
call fcn.1002ea50
cmp dword [ebp - 0x10], 0xb7
jne 0x102ea555
lea eax, [ebp - 0x18]
push eax
mov ecx, dword [ebp + 8]
push ecx
call fcn.102ed640
add esp, 8
movzx edx, al
test edx, edx
je 0x102ea555
cmp dword [ebp + 0xc], 0
je 0x102ea551
mov ecx, dword [ebp + 0xc]
call fcn.102ed160
xor al, al
jmp 0x102ea5d4
cmp dword [ebp + 0xc], 0
jne 0x102ea5c0
push str.boost::filesystem::create_directory
lea ecx, [ebp - 0x9c]
call fcn.10003680
mov dword [ebp - 4], 0
call fcn.102e3df0
push eax
mov eax, dword [ebp - 0x10]
push eax
lea ecx, [ebp - 0x7c]
call fcn.1002ea30
mov ecx, dword [eax + 4]
push ecx
mov edx, dword [eax]
push edx
mov eax, dword [ebp + 8]
push eax
lea ecx, [ebp - 0x9c]
push ecx
lea ecx, [ebp - 0x74]
call fcn.102c2170
push 0x104f7560
lea edx, [ebp - 0x74]
push edx
call fcn.10262720
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x9c]
call fcn.10003790
jmp 0x102ea5d2
call fcn.102e3df0
push eax
mov eax, dword [ebp - 0x10]
push eax
mov ecx, dword [ebp + 0xc]
call fcn.102ed140
xor al, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret

Function at 0x102ea8f0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1033bf5a
mov eax, dword fs:[0]
push eax
sub esp, 0x30
mov eax, dword [0x10525930]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x3c], 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
jne 0x102ea936
mov dword [ebp - 0x14], 1
xor ecx, ecx
mov eax, dword [ebp - 0x14]
mov edx, 2
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.10239540
add esp, 4
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
push eax
lea ecx, [ebp - 0x10]
call fcn.102c3d60
mov dword [ebp - 4], 1
push 0x104b301c
lea ecx, [ebp - 0x38]
call fcn.10003680
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x38]
push ecx
mov edx, dword [ebp + 0xc]
push edx
lea ecx, [ebp - 0x10]
call fcn.102a0fd0
push eax
mov eax, dword [ebp - 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
test eax, eax
sete cl
movzx edx, cl
push edx
call fcn.102e8470
add esp, 0xc
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x38]
call fcn.10003790
lea ecx, [ebp - 0x10]
call fcn.102a0fd0
push eax
mov ecx, dword [ebp + 8]
call fcn.102e6980
mov eax, dword [ebp - 0x3c]
or eax, 1
mov dword [ebp - 0x3c], eax
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x10]
call fcn.102e7e60
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
Function at 0x102ebb90
Capabilities:
Move file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1033c25b
mov eax, dword fs:[0]
push eax
sub esp, 0x20
mov eax, dword [0x10525930]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push str.boost::filesystem::rename
lea ecx, [ebp - 0x2c]
call fcn.10003680
mov dword [ebp - 4], 0
lea eax, [ebp - 0x2c]
push eax
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
push 3
mov ecx, dword [ebp + 0xc]
call fcn.102c4a90
push eax
mov ecx, dword [ebp + 8]
call fcn.102c4a90
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
test eax, eax
sete cl
movzx edx, cl
push edx
call fcn.102e8570
add esp, 0x14
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x2c]
call fcn.10003790
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret

Function at 0x102ebcc0
Capabilities:
Get disk size

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1033c2a1
mov eax, dword fs:[0]
push eax
sub esp, 0x54
push esi
mov eax, dword [0x10525930]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push str.boost::filesystem::space
lea ecx, [ebp - 0x60]
call fcn.10003680
mov dword [ebp - 4], 0
lea eax, [ebp - 0x60]
push eax
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp + 0xc]
push edx
lea eax, [ebp - 0x14]
push eax
lea ecx, [ebp - 0x1c]
push ecx
lea edx, [ebp - 0x3c]
push edx
mov ecx, dword [ebp + 0xc]
call fcn.102c4a90
push eax
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
test eax, eax
sete al
movzx ecx, al
push ecx
call fcn.102e84f0
add esp, 0x10
movzx edx, al
neg edx
sbb edx, edx
add edx, 1
mov byte [ebp - 0x3d], dl
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x60]
call fcn.10003790
movzx eax, byte [ebp - 0x3d]
test eax, eax
je 0x102ebda9
mov eax, dword [ebp - 0x18]
xor edx, edx
mov cl, 0x20
call fcn.10268bc0
mov ecx, dword [ebp - 0x1c]
xor esi, esi
add eax, ecx
adc edx, esi
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x30], edx
mov eax, dword [ebp - 0x10]
xor edx, edx
mov cl, 0x20
call fcn.10268bc0
mov ecx, dword [ebp - 0x14]
xor esi, esi
add eax, ecx
adc edx, esi
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x28], edx
mov eax, dword [ebp - 0x38]
xor edx, edx
mov cl, 0x20
call fcn.10268bc0
mov ecx, dword [ebp - 0x3c]
xor esi, esi
add eax, ecx
adc edx, esi
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x20], edx
jmp 0x102ebdcf
mov dword [ebp - 0x24], 0
mov dword [ebp - 0x20], 0
mov edx, dword [ebp - 0x24]
mov dword [ebp - 0x2c], edx
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x28], eax
mov ecx, dword [ebp - 0x2c]
mov dword [ebp - 0x34], ecx
mov edx, dword [ebp - 0x28]
mov dword [ebp - 0x30], edx
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0x34]
mov dword [eax], ecx
mov edx, dword [ebp - 0x30]
mov dword [eax + 4], edx
mov ecx, dword [ebp - 0x2c]
mov dword [eax + 8], ecx
mov edx, dword [ebp - 0x28]
mov dword [eax + 0xc], edx
mov ecx, dword [ebp - 0x24]
mov dword [eax + 0x10], ecx
mov edx, dword [ebp - 0x20]
mov dword [eax + 0x14], edx
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x102ebe10
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1033c2cc
mov eax, dword fs:[0]
push eax
sub esp, 0x40
mov eax, dword [0x10525930]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ecx, dword [ebp + 0xc]
call fcn.102c4a90
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0xffffffff
jne 0x102ebe69
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call fcn.102e90e0
add esp, 0xc
mov eax, dword [ebp + 8]
jmp 0x102ebfae
mov eax, dword [ebp - 0x10]
and eax, 0x400
je 0x102ebf41
mov ecx, dword [ebp + 0xc]
call fcn.102c4a90
push eax
lea ecx, [ebp - 0x34]
call fcn.102e6980
mov dword [ebp - 4], 0
push 0
push 0x2000000
push 3
push 0
push 7
push 0
lea ecx, [ebp - 0x34]
push ecx
call fcn.102e8f60
add esp, 0x1c
push eax
lea ecx, [ebp - 0x14]
call fcn.102c3d60
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x34]
call fcn.1000b370
cmp dword [ebp - 0x14], 0xffffffff
jne 0x102ebef0
mov edx, dword [ebp + 0x10]
push edx
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
call fcn.102e90e0
add esp, 0xc
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x14]
call fcn.102ed3e0
mov eax, dword [ebp + 8]
jmp 0x102ebfae
mov edx, dword [ebp + 0xc]
push edx
call fcn.102e8f90
add esp, 4
movzx eax, al
test eax, eax
jne 0x102ebf32
mov ecx, dword [ebp - 0x10]
push ecx
mov edx, dword [ebp + 0xc]
push edx
call fcn.102e8a40
add esp, 8
push eax
push 9
mov ecx, dword [ebp + 8]
call fcn.102a4910
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x14]
call fcn.102ed3e0
mov eax, dword [ebp + 8]
jmp 0x102ebfae
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x14]
call fcn.102ed3e0
cmp dword [ebp + 0x10], 0
je 0x102ebf4f
mov ecx, dword [ebp + 0x10]
call fcn.102ed160
mov eax, dword [ebp - 0x10]
and eax, 0x10
je 0x102ebf77
mov ecx, dword [ebp - 0x10]
push ecx
mov edx, dword [ebp + 0xc]
push edx
call fcn.102e8a40
add esp, 8
push eax
push 3
lea ecx, [ebp - 0x40]
call fcn.102a4910
mov dword [ebp - 0x4c], eax
jmp 0x102ebf95
mov eax, dword [ebp - 0x10]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
call fcn.102e8a40
add esp, 8
push eax
push 2
lea ecx, [ebp - 0x48]
call fcn.102a4910
mov dword [ebp - 0x4c], eax
mov edx, dword [ebp - 0x4c]
mov dword [ebp - 0x38], edx
mov eax, dword [ebp - 0x38]
mov ecx, dword [eax]
mov edx, dword [eax + 4]
mov eax, dword [ebp + 8]
mov dword [eax], ecx
mov dword [eax + 4], edx
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret