joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4012c0
Capabilities:
Create thread

Disassembly:
push esi
push edi
cmp dword [ecx + 0xc], 0
mov esi, ecx
je 0x4012d1
xor eax, eax
pop edi
pop esi
ret 4
mov ecx, esi
call fcn.00401190
mov edi, eax
test edi, edi
jl 0x40131e
mov eax, dword [esp + 0xc]
lea ecx, [esi + 0x10]
push ecx
mov dword [esi + 0x44], eax
push 0
push esi
push 0x4015e0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [esi + 0xc], eax
test eax, eax
jne 0x40130b
call fcn.00403d40
mov edi, eax
jmp 0x40131e
push 0xffffffffffffffff
mov eax, dword [esi + 4]
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov edi, dword [esi + 8]
test edi, edi
jge 0x40132c
mov ecx, esi
call fcn.00401240
mov eax, edi
pop edi
pop esi
ret 4
xor eax, eax
pop edi
mov dword [esi + 0x38], 0
pop esi
ret 4

Function at 0x402410
Capabilities:
Get session user name

Disassembly:
sub esp, 0x58
cmp dword [0x422840], 0
push esi
push edi
je 0x402428
mov ecx, 0x422844
call fcn.00401c20
lea eax, [esp + 0x68]
push eax
call fcn.00401b40
mov esi, dword [esp + 0x9c]
add esp, 4
test esi, 0x40000000
je 0x40245a
lea eax, [esp + 0x88]
push eax
call fcn.00403710
add esp, 4
mov edi, eax
test edi, edi
jl 0x40247f
mov eax, dword [esp + 0x9c]
lea ecx, [esp + 0x88]
mov edx, dword [esp + 0x64]
push eax
lea eax, [esp + 0x7c]
push esi
push ecx
push edx
push eax
call fcn.00402c00
add esp, 0x14
mov edi, eax
cmp dword [0x422840], 0
je 0x402492
mov ecx, 0x422844
call fcn.00401c30
test edi, edi
jge 0x40256e
lea eax, [esp + 0x38]
push 0x27
lea ecx, [esp + 0x8c]
push eax
push ecx
call fcn.00403d60
add esp, 0xc
test eax, eax
jge 0x4024ba
mov byte [esp + 0x38], 0
test esi, 0x80000000
lea eax, [esp + 0x38]
mov dword [esp + 8], eax
je 0x4024ef
mov ecx, dword [0x4227e4]
test ecx, ecx
je 0x40256e
lea eax, [esp + 8]
mov esi, dword [ecx]
push eax
push 1
push 5
push edi
call dword [esi + 0x18]
mov eax, edi
pop edi
pop esi
add esp, 0x58
ret
mov byte [esp + 0x14], 0
cmp dword [0x42126c], 0
jne 0x402525
push 0
call sub.RPCRT4.dll_RpcImpersonateClient
test eax, eax
jne 0x402525
lea eax, [esp + 0x10]
lea ecx, [esp + 0x14]
mov dword [esp + 0x10], 0x21
push eax
push ecx
call dword [sym.imp.ADVAPI32.dll_GetUserNameA]
call sub.RPCRT4.dll_RpcRevertToSelf
cmp byte [esp + 0x14], 0
je 0x402555
lea eax, [esp + 0x14]
mov ecx, dword [0x4227e4]
mov dword [esp + 0xc], eax
test ecx, ecx
je 0x40256e
lea eax, [esp + 8]
mov esi, dword [ecx]
push eax
push 2
push 0xf
push edi
call dword [esi + 0x18]
mov eax, edi
pop edi
pop esi
add esp, 0x58
ret
mov ecx, dword [0x4227e4]
test ecx, ecx
je 0x40256e
lea eax, [esp + 8]
mov esi, dword [ecx]
push eax
push 1
push 4
push edi
call dword [esi + 0x18]
mov eax, edi
pop edi
pop esi
add esp, 0x58
ret
Function at 0x4042d0
Capabilities:
Query or enumerate registry value

Disassembly:
mov eax, dword [esp + 0x10]
sub esp, 4
mov ecx, dword [esp + 0xc]
push esi
mov esi, dword [esp + 0x14]
mov dword [esp + 4], eax
lea eax, [esp + 4]
push eax
push esi
mov eax, dword [esp + 0x14]
push ecx
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueA]
test eax, eax
je 0x404358
cmp eax, 0xe
jg 0x404308
je 0x40433a
cmp eax, 2
je 0x404330
jmp 0x404316
cmp eax, 0xea
je 0x404344
cmp eax, 0x3f2
je 0x40434e
test eax, eax
je 0x404329
and eax, 0xffff
pop esi
or eax, 0x80070000
add esp, 4
ret
xor eax, eax
pop esi
add esp, 4
ret
mov eax, 0x80040152
pop esi
add esp, 4
ret
mov eax, 0x8007000e
pop esi
add esp, 4
ret
mov eax, 0x80040153
pop esi
add esp, 4
ret
mov eax, 0x80040152
pop esi
add esp, 4
ret
cmp byte [esi], 1
pop esi
sbb eax, eax
add esp, 4
and eax, 0x80040153
ret

Function at 0x4043a0
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
sub esp, 0x108
lea eax, [esp]
push ebx
lea ecx, [esp + 8]
push esi
mov ebx, dword [esp + 0x118]
push edi
mov esi, dword [esp + 0x118]
push ebp
mov dword [esp + 0x10], 0x104
push eax
push ecx
push ebx
push esi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueA]
test eax, eax
je 0x404408
cmp eax, 2
je 0x404458
cmp eax, 0x3f2
je 0x404458
test eax, eax
je 0x4043fb
and eax, 0xffff
pop ebp
or eax, 0x80070000
pop edi
pop esi
pop ebx
add esp, 0x108
ret
xor eax, eax
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x108
ret
cmp dword [esp + 0x128], 0
mov ebp, dword [esp + 0x124]
je 0x404442
mov edi, ebp
mov ecx, 0xffffffff
sub eax, eax
repne scasb al, byte es:[edi]
not ecx
lea edi, [esp + 0x14]
sub eax, eax
lea edx, [ecx - 1]
mov ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
dec ecx
cmp ecx, edx
jbe 0x404442
mov byte [esp + edx + 0x14], 0
lea eax, [esp + 0x14]
push eax
push ebp
call fcn.00418560
add esp, 8
cmp eax, 1
sbb eax, eax
inc eax
jmp 0x404464
mov eax, 1
mov ebp, dword [esp + 0x124]
test eax, eax
je 0x40449a
mov edi, ebp
mov ecx, 0xffffffff
sub eax, eax
repne scasb al, byte es:[edi]
not ecx
push ecx
push ebp
push 1
push ebx
push esi
call dword [sym.imp.ADVAPI32.dll_RegSetValueA]
test eax, eax
je 0x40449a
and eax, 0xffff
pop ebp
or eax, 0x80070000
pop edi
pop esi
pop ebx
add esp, 0x108
ret
xor eax, eax
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x108
ret
Function at 0x4044b0
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
sub esp, 0x10c
lea eax, [esp]
push ebx
push esi
push edi
mov esi, dword [esp + 0x11c]
push ebp
mov ebp, dword [esp + 0x124]
push eax
push ebp
push esi
call fcn.00404260
add esp, 0xc
mov edi, eax
test edi, edi
jge 0x4044f5
cmp edi, 0x80040152
jne 0x404559
mov eax, 1
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x10c
ret
mov ebx, dword [sym.imp.ADVAPI32.dll_RegEnumKeyA]
lea eax, [esp + 0x14]
push 0x105
mov ecx, dword [esp + 0x14]
push eax
push 0
push ecx
call ebx
test eax, eax
jne 0x40452c
lea eax, [esp + 0x14]
mov ecx, dword [esp + 0x10]
push eax
push ecx
call fcn.004044b0
add esp, 8
mov edi, eax
test edi, edi
jge 0x4044fb
jmp 0x404559
mov eax, dword [esp + 0x10]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [esp + 0x10], 0
push ebp
push esi
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
test eax, eax
je 0x404559
mov edi, eax
and edi, 0xffff
or edi, 0x80070000
cmp dword [esp + 0x10], 0
je 0x40456b
mov eax, dword [esp + 0x10]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, edi
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x10c
ret

Function at 0x4045f0
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
sub esp, 0xc
lea eax, [esp]
push esi
lea ecx, [esp + 0xc]
push edi
lea edx, [esp + 0xc]
push eax
mov edi, dword [esp + 0x20]
push ecx
mov esi, dword [esp + 0x20]
push edx
mov dword [esp + 0x14], 4
push 0
push edi
push esi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
je 0x40464a
cmp eax, 2
je 0x404663
cmp eax, 0x3f2
je 0x404663
test eax, eax
je 0x404642
and eax, 0xffff
pop edi
or eax, 0x80070000
pop esi
add esp, 0xc
ret
xor eax, eax
pop edi
pop esi
add esp, 0xc
ret
cmp dword [esp + 0xc], 4
jne 0x404663
mov ecx, dword [esp + 0x10]
mov eax, dword [esp + 0x20]
pop edi
pop esi
mov dword [eax], ecx
xor eax, eax
add esp, 0xc
ret
mov eax, dword [esp + 0x20]
push 4
push eax
push 4
push 0
push edi
push esi
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
je 0x40468a
and eax, 0xffff
pop edi
or eax, 0x80070000
pop esi
add esp, 0xc
ret
xor eax, eax
pop edi
pop esi
add esp, 0xc
ret
Function at 0x41665d
Capabilities:
Encode data using xor

Disassembly:
mov dh, 0x1a
clc
inc eax
insd dword es:[edi], dx
push edi
xchg dword [esi - 0x41], esi
push eax
lea edi, [ebx - 0x30]
salc
wait
jle 0x41662b
stosd dword es:[edi], eax
push 0x8b3335ca
pop esi
xor al, 0xac

Function at 0x417a10
Capabilities:
Accept command line arguments

Disassembly:
push ecx
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
push 0
push 0
push 3
push 0
push 3
push 0x40000000
push str.CONOUT_
mov esi, eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
lea eax, [esp + 8]
push eax
push esi
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
test eax, eax
je 0x417a5f
mov ecx, dword [0x4c3a9c]
push 0x4c378c
push ecx
mov dword [0x4c0064], edi
call dword [sym.imp.KERNEL32.dll_GetConsoleMode]
mov eax, edi
pop edi
pop esi
pop ecx
ret

Function at 0x4b8e95
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov edx, dword [ebp + 8]
xor ecx, ecx
mov eax, 0x4c0350
cmp edx, dword [eax]
je 0x4b8eb7
add eax, 8
inc ecx
cmp eax, 0x4c03e0
jl 0x4b8ea8
push esi
mov esi, ecx
shl esi, 3
cmp edx, dword [esi + 0x4c0350]
jne 0x4b8fe5
mov eax, dword [0x4c4cdc]
cmp eax, 1
je 0x4b8fbf
test eax, eax
jne 0x4b8ee8
cmp dword [0x4c0278], 1
je 0x4b8fbf
cmp edx, 0xfc
je 0x4b8fe5
lea eax, [ebp - 0x1a4]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x4b8f1f
lea eax, [ebp - 0x1a4]
push str._program_name_unknown_
push eax
call fcn.004b9880
pop ecx
pop ecx
lea eax, [ebp - 0x1a4]
push edi
push eax
lea edi, [ebp - 0x1a4]
call fcn.004b9d10
inc eax
pop ecx
cmp eax, 0x3c
jbe 0x4b8f62
lea eax, [ebp - 0x1a4]
push eax
call fcn.004b9d10
mov edi, eax
lea eax, [ebp - 0x1a4]
sub eax, 0x3b
push 3
add edi, eax
push 0x4be6bc
push edi
call fcn.004bbbe0
add esp, 0x10
lea eax, [ebp - 0xa0]
push str.Runtime_Error__n_nProgram:
push eax
call fcn.004b9880
lea eax, [ebp - 0xa0]
push edi
push eax
call fcn.004b9890
lea eax, [ebp - 0xa0]
push 0x4be69c
push eax
call fcn.004b9890
push dword [esi + 0x4c0354]
lea eax, [ebp - 0xa0]
push eax
call fcn.004b9890
push 0x12010
lea eax, [ebp - 0xa0]
push str.Microsoft_Visual_C_Runtime_Library
push eax
call fcn.004bbb54
add esp, 0x2c
pop edi
jmp 0x4b8fe5
lea eax, [ebp + 8]
lea esi, [esi + 0x4c0354]
push 0
push eax
push dword [esi]
call fcn.004b9d10
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop esi
leave
ret
Function at 0x10001c71
Capabilities:
Print debug messages

Disassembly:
push 4
mov eax, 0x1002b4ac
call fcn.1002a0c8
mov esi, ecx
mov dword [ebp - 0x10], esi
push dword [ebp + 8]
lea edi, [esi + 4]
mov dword [esi], vtable.CMemMappedFile.0
xor ebx, ebx
mov ecx, edi
mov dword [edi + 0x10], ebx
mov dword [edi + 0x14], ebx
call fcn.10002a03
mov eax, dword [ebp + 0xc]
mov dword [esi + 0x1c], ebx
mov dword [esi + 0x20], ebx
mov dword [esi + 0x24], eax
mov dword [esi + 0x28], ebx
mov dword [esi + 0x2c], ebx
mov byte [esi + 0x30], 1
mov dword [ebp - 4], ebx
cmp byte [0x1003cde0], bl
je 0x10001cea
cmp dword [edi + 0x14], 0x10
jb 0x10001cc6
mov edi, dword [edi]
push edi
push str.CMemMappedFile__s__ctor__reference_
mov edi, 0x1003c7f0
push edi
call fcn.100232ad
add esp, 0xc
cmp byte [0x1003cde0], 0
je 0x10001cea
push edi
call dword [sym.imp.kernel32.dll_OutputDebugStringA]
push esi
call fcn.100232ad
pop ecx
mov eax, esi
call fcn.1002a091
ret 8

Function at 0x10001cfb
Capabilities:
Print debug messages

Disassembly:
push 4
mov eax, 0x1002b4ac
call fcn.1002a0c8
mov esi, ecx
mov dword [ebp - 0x10], esi
lea edi, [esi + 4]
mov dword [esi], vtable.CMemMappedFile.0
push edi
call fcn.100026c3
pop ecx
mov eax, dword [ebp + 8]
xor ecx, ecx
mov dword [esi + 0x1c], ecx
mov dword [esi + 0x20], ecx
mov dword [esi + 0x24], eax
mov dword [esi + 0x28], ecx
mov dword [esi + 0x2c], ecx
mov byte [esi + 0x30], cl
mov dword [ebp - 4], ecx
cmp byte [0x1003cde0], cl
je 0x10001d6b
cmp dword [edi + 0x14], 0x10
jb 0x10001d46
mov edi, dword [edi]
push eax
push edi
push str.CMemMappedFile__s__ctor__new_with_size_lu_
mov edi, 0x1003c7f0
push edi
call fcn.100232ad
add esp, 0x10
cmp byte [0x1003cde0], 0
je 0x10001d6b
push edi
call dword [sym.imp.kernel32.dll_OutputDebugStringA]
mov ecx, esi
call fcn.100031a0
mov eax, esi
call fcn.1002a091
ret 4

Function at 0x10001d7c
Capabilities:
Print debug messages

Disassembly:
push 4
mov eax, 0x1002b4ac
call fcn.1002a0c8
mov esi, ecx
mov dword [ebp - 0x10], esi
lea edi, [esi + 4]
mov dword [esi], vtable.CMemMappedFile.0
push edi
call fcn.100026c3
pop ecx
xor eax, eax
mov dword [esi + 0x1c], eax
mov dword [esi + 0x20], eax
mov dword [esi + 0x24], eax
mov dword [esi + 0x28], eax
mov dword [esi + 0x2c], eax
mov byte [esi + 0x30], al
mov dword [ebp - 4], eax
cmp byte [0x1003cde0], al
je 0x10001de8
cmp dword [edi + 0x14], 0x10
jb 0x10001dc4
mov edi, dword [edi]
push edi
push str.CMemMappedFile__s__ctor__new_
mov edi, 0x1003c7f0
push edi
call fcn.100232ad
add esp, 0xc
cmp byte [0x1003cde0], 0
je 0x10001de8
push edi
call dword [sym.imp.kernel32.dll_OutputDebugStringA]
mov eax, esi
call fcn.1002a091
ret
Function at 0x10002388
Capabilities:
Print debug messages

Disassembly:
push 0x20
mov eax, 0x1002b5ba
call fcn.1002a0fc
cmp byte [0x1003cde0], 0
mov ebx, 0x1003c7f0
mov esi, dword [ebp + 8]
je 0x100023ce
cmp dword [esi + 0x14], 8
mov eax, esi
jb 0x100023af
mov eax, dword [esi]
push eax
push str.CMemMappedFile_CreateAndLoadFromFile__file__11S_
push ebx
call fcn.100232ad
add esp, 0xc
cmp byte [0x1003cde0], 0
je 0x100023ce
push ebx
call dword [sym.imp.kernel32.dll_OutputDebugStringA]
xor edi, edi
call fcn.100232ad
test al, al
jne 0x1000243d
push 0x34
call fcn.100232ad
pop ecx
mov dword [ebp - 0x2c], eax
xor ebx, ebx
mov dword [ebp - 4], ebx
test eax, eax
je 0x100023f8
mov ecx, eax
call fcn.10001d7c
mov edi, eax
jmp 0x100023fa
mov edi, ebx
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x28]
push esi
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x14], ebx
call fcn.10002a85
mov eax, dword [edi]
lea ecx, [ebp - 0x28]
push ecx
mov dword [ebp - 4], 1
mov esi, dword [eax + 0x28]
mov ecx, esi
call dword [0x1002e5c4]
mov ecx, edi
call esi
lea ecx, [ebp - 0x28]
mov dword [ebp - 4], 2
call fcn.100232ad
jmp 0x10002548
call fcn.1001bb6e
test al, al
je 0x100024fe
push esi
call fcn.100232ad
mov ebx, eax
pop ecx
test ebx, ebx
je 0x100024d1
cmp byte [0x1003cde0], 0
je 0x100024b4
cmp dword [esi + 0x14], 8
mov ecx, esi
jb 0x1000246a
mov ecx, dword [esi]
push ecx
push str.CMemMappedFile::CreateAndLoadFromFile___11S_
mov edi, 0x1003c7f0
push edi
call fcn.100232ad
add esp, 0xc
cmp byte [0x1003cde0], 0
je 0x100024b4
push edi
call dword [sym.imp.kernel32.dll_OutputDebugStringA]
cmp byte [0x1003cde0], 0
je 0x100024b4
push str.CMemMappedFile___remote_creation
push edi
call fcn.100232ad
cmp byte [0x1003cde0], 0
pop ecx
pop ecx
je 0x100024b4
push edi
call dword [sym.imp.kernel32.dll_OutputDebugStringA]
push ebx
call fcn.1001b987
mov edi, eax
pop ecx
push esi
mov ecx, dword [edi]
mov esi, dword [ecx + 0x28]
mov ecx, esi
call dword [0x1002e5c4]
mov ecx, edi
call esi
jmp 0x10002548
cmp byte [0x1003cde0], 0
je 0x10002548
push str.CMemMappedFile__ERROR_diskFileSize__0_
mov esi, 0x1003c7f0
push esi
call fcn.100232ad
cmp byte [0x1003cde0], 0
pop ecx
pop ecx
je 0x10002548
push esi
call dword [sym.imp.kernel32.dll_OutputDebugStringA]
jmp 0x10002548
cmp byte [0x1003cde0], 0
je 0x10002524
push str.CMemMappedFile___creation_deferred
push ebx
call fcn.100232ad
cmp byte [0x1003cde0], 0
pop ecx
pop ecx
je 0x10002524
push ebx
call dword [sym.imp.kernel32.dll_OutputDebugStringA]
push 0x34
call fcn.100232ad
pop ecx
mov dword [ebp - 0x2c], eax
mov dword [ebp - 4], 3
test eax, eax
je 0x10002546
push esi
mov ecx, eax
call fcn.100232ad
mov edi, eax
jmp 0x10002548
xor edi, edi
mov eax, edi
call fcn.1002a0a6
ret
Function at 0x10002550
Capabilities:
Print debug messages

Disassembly:
push 4
mov eax, 0x1002b5ec
call fcn.1002a0c8
cmp byte [0x1003cde0], 0
mov edi, 0x1003c7f0
mov esi, dword [ebp + 8]
je 0x1000258c
push esi
push str.CMemMappedFile_CreateWithSize__size_lu_
push edi
call fcn.100232ad
add esp, 0xc
cmp byte [0x1003cde0], 0
je 0x1000258c
push edi
call dword [sym.imp.kernel32.dll_OutputDebugStringA]
call fcn.100232ad
test al, al
je 0x100025cf
call fcn.1001bb6e
test al, al
je 0x100025cf
cmp byte [0x1003cde0], 0
je 0x100025c6
push esi
push str.CMemMappedFile::CreateWithSize__lu___REMOTE_CREATION_
push edi
call fcn.100232ad
add esp, 0xc
cmp byte [0x1003cde0], 0
je 0x100025c6
push edi
call dword [sym.imp.kernel32.dll_OutputDebugStringA]
push esi
call fcn.1001b987
pop ecx
jmp 0x10002613
cmp byte [0x1003cde0], 0
je 0x100025f7
push esi
push str.CMemMappedFile::CreateWithSize__lu___LOCAL_CREATION_
push edi
call fcn.100232ad
add esp, 0xc
cmp byte [0x1003cde0], 0
je 0x100025f7
push edi
call dword [sym.imp.kernel32.dll_OutputDebugStringA]
push 0x34
call fcn.100232ad
pop ecx
mov ecx, eax
mov dword [ebp - 0x10], ecx
xor eax, eax
mov dword [ebp - 4], eax
test ecx, ecx
je 0x10002613
push esi
call fcn.10001cfb
call fcn.1002a091
ret

Function at 0x1000276d
Capabilities:
Print debug messages

Disassembly:
push 0x28
mov eax, 0x1002b656
call fcn.1002a0fc
mov ecx, dword [ebp + 0xc]
xor ebx, ebx
mov esi, dword [ebp + 8]
mov dword [ebp - 0x2c], ebx
mov dword [ebp - 0x30], ecx
cmp byte [0x1003cde0], bl
je 0x100027bd
cmp dword [esi + 0x14], 0x10
mov eax, esi
jb 0x10002799
mov eax, dword [esi]
push ecx
push eax
push str.CMemMappedFile_GetExistingMemoryMappedFile__name_s__size_lu_
mov edi, 0x1003c7f0
push edi
call fcn.100232ad
add esp, 0x10
cmp byte [0x1003cde0], bl
je 0x100027bd
push edi
call dword [sym.imp.kernel32.dll_OutputDebugStringA]
push esi
call fcn.100232ad
mov edi, eax
pop ecx
test edi, edi
jne 0x10002822
push 0x34
call fcn.100232ad
mov edi, eax
pop ecx
mov dword [ebp - 0x34], edi
mov dword [ebp - 4], ebx
test edi, edi
je 0x10002808
push esi
lea ecx, [ebp - 0x28]
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x14], ebx
call fcn.10002a03
push dword [ebp - 0x30]
xor ebx, ebx
lea eax, [ebp - 0x28]
inc ebx
mov ecx, edi
push eax
mov byte [ebp - 4], bl
mov dword [ebp - 0x2c], ebx
call fcn.10001c71
mov edi, eax
jmp 0x1000280a
mov edi, ebx
or dword [ebp - 4], 0xffffffff
test bl, 1
je 0x10002822
lea ecx, [ebp - 0x28]
mov dword [ebp - 4], 3
call fcn.100232ad
mov eax, edi
call fcn.1002a0a6
ret
Function at 0x100031a0
Capabilities:
Print debug messages

Disassembly:
mov al, byte [0x1003cde0]
push esi
mov esi, ecx
push edi
mov edi, 0x1003c7f0
test al, al
je 0x100031e1
lea eax, [esi + 4]
cmp dword [eax + 0x14], 0x10
jb 0x100031bd
mov eax, dword [eax]
push eax
push str.CMemMappedFile__s__createMemoryMappedFile
push edi
call fcn.100232ad
mov al, byte [0x1003cde0]
add esp, 0xc
test al, al
je 0x100031e1
push edi
call dword [sym.imp.kernel32.dll_OutputDebugStringA]
mov al, byte [0x1003cde0]
mov ecx, dword [esi + 0x24]
test ecx, ecx
je 0x10003258
mov ecx, esi
call fcn.100232ad
mov dword [esi + 0x20], eax
test eax, eax
je 0x10003235
cmp byte [0x1003cde0], 0
je 0x1000322c
lea eax, [esi + 4]
cmp dword [eax + 0x14], 0x10
jb 0x1000320a
mov eax, dword [eax]
push dword [esi + 0x24]
push eax
push str.CMemMappedFile__s__created_file_of_size___lu
push edi
call fcn.100232ad
add esp, 0x10
cmp byte [0x1003cde0], 0
je 0x1000322c
push edi
call dword [sym.imp.kernel32.dll_OutputDebugStringA]
push esi
call fcn.100232ad
pop ecx
jmp 0x10003287
cmp byte [0x1003cde0], 0
je 0x10003287
add esi, 4
cmp dword [esi + 0x14], 0x10
jb 0x10003249
mov esi, dword [esi]
call dword [sym.imp.kernel32.dll_GetLastError]
push eax
push esi
push str.CMemMappedFile__s__ERROR_CREATING__err_u_
jmp 0x1000326e
test al, al
je 0x10003287
add esi, 4
cmp dword [esi + 0x14], 0x10
jb 0x10003267
mov esi, dword [esi]
push ecx
push esi
push str.CMemMappedFile__s__ERROR_CREATING__SIZE__0_
push edi
call fcn.100232ad
add esp, 0x10
cmp byte [0x1003cde0], 0
je 0x10003287
push edi
call dword [sym.imp.kernel32.dll_OutputDebugStringA]
pop edi
pop esi
ret

Function at 0x10003460
Capabilities:
Print debug messages

Disassembly:
cmp byte [0x1003cde0], 0
push esi
mov esi, ecx
je 0x100034a0
lea eax, [esi + 4]
cmp dword [eax + 0x14], 0x10
jb 0x10003477
mov eax, dword [eax]
push edi
push dword [esi + 0x24]
mov edi, 0x1003c7f0
push eax
push str.CMemMappedFile__s__size___lu
push edi
call fcn.100232ad
add esp, 0x10
cmp byte [0x1003cde0], 0
je 0x1000349f
push edi
call dword [sym.imp.kernel32.dll_OutputDebugStringA]
pop edi
mov eax, dword [esi + 0x24]
pop esi
ret

Function at 0x100034c0
Capabilities:
Print debug messages

Disassembly:
cmp byte [0x1003cde0], 0
push esi
mov esi, ecx
je 0x1000350f
lea edx, [esi + 4]
cmp dword [edx + 0x14], 0x10
jb 0x100034d7
mov edx, dword [edx]
cmp dword [esi + 0x20], 0
mov ecx, str.false
push edi
mov eax, str.true
mov edi, 0x1003c7f0
cmove eax, ecx
push eax
push edx
push str.CMemMappedFile__s__isValid___s
push edi
call fcn.100232ad
add esp, 0x10
cmp byte [0x1003cde0], 0
je 0x1000350e
push edi
call dword [sym.imp.kernel32.dll_OutputDebugStringA]
pop edi
cmp dword [esi + 0x20], 0
pop esi
setne al
ret
Function at 0x10003580
Capabilities:
Get file size
Print debug messages
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
cmp byte [0x1003cde0], 0
push ebx
push esi
mov esi, dword [ebp + 8]
mov ebx, 0x1003c7f0
push edi
mov edi, ecx
je 0x100035d0
cmp dword [esi + 0x14], 8
mov ecx, esi
jb 0x100035a5
mov ecx, dword [esi]
lea eax, [edi + 4]
cmp dword [eax + 0x14], 0x10
jb 0x100035b0
mov eax, dword [eax]
push ecx
push eax
push str.CMemMappedFile__s__load_from_file___11S
push ebx
call fcn.100232ad
add esp, 0x10
cmp byte [0x1003cde0], 0
je 0x100035d0
push ebx
call dword [sym.imp.kernel32.dll_OutputDebugStringA]
xor ebx, ebx
cmp dword [esi + 0x14], 8
jb 0x100035da
mov esi, dword [esi]
push ebx
push ebx
push 3
push ebx
push 1
push 0x80000000
push esi
call dword [sym.imp.kernel32.dll_CreateFileW]
push ebx
push eax
mov dword [ebp - 8], eax
call dword [sym.imp.kernel32.dll_GetFileSize]
mov ecx, eax
test ecx, ecx
je 0x10003696
mov eax, dword [edi]
mov dword [edi + 0x24], ecx
push ecx
mov esi, dword [eax + 0xc]
mov ecx, esi
call dword [0x1002e5c4]
mov ecx, edi
call esi
test eax, eax
je 0x100036cc
push ebx
lea eax, [ebp - 4]
mov dword [ebp - 4], ebx
push eax
push dword [edi + 0x24]
push dword [edi + 0x28]
push dword [ebp - 8]
call dword [sym.imp.kernel32.dll_ReadFile]
test eax, eax
je 0x10003646
mov eax, dword [ebp - 4]
cmp eax, dword [edi + 0x24]
jne 0x10003646
mov bl, 1
jmp 0x10003683
cmp byte [0x1003cde0], bl
je 0x10003683
lea esi, [edi + 4]
cmp dword [esi + 0x14], 0x10
jb 0x10003659
mov esi, dword [esi]
call dword [sym.imp.kernel32.dll_GetLastError]
push eax
push esi
push str.CMemMappedFile__s__ERROR_READING_FILE__err_u_
mov esi, 0x1003c7f0
push esi
call fcn.100232ad
add esp, 0x10
cmp byte [0x1003cde0], bl
je 0x10003683
push esi
call dword [sym.imp.kernel32.dll_OutputDebugStringA]
mov eax, dword [edi]
mov esi, dword [eax + 0x10]
mov ecx, esi
call dword [0x1002e5c4]
mov ecx, edi
call esi
jmp 0x100036cc
cmp byte [0x1003cde0], bl
je 0x100036cc
add edi, 4
cmp dword [edi + 0x14], 0x10
jb 0x100036a9
mov edi, dword [edi]
push edi
push str.CMemMappedFile__s__ERROR___EMPTY_FILE
mov esi, 0x1003c7f0
push esi
call fcn.100232ad
add esp, 0xc
cmp byte [0x1003cde0], bl
je 0x100036cc
push esi
call dword [sym.imp.kernel32.dll_OutputDebugStringA]
push dword [ebp - 8]
call dword [sym.imp.kernel32.dll_CloseHandle]
pop edi
pop esi
mov al, bl
pop ebx
leave
ret 4