joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1000ebf0
Capabilities:
Print debug messages
Read file on windows

Disassembly:
push 0xffffffffffffffff
push 0x1004e1bb
mov eax, dword fs:[0]
push eax
mov eax, 0x1574
call fcn.1003a830
mov eax, dword [0x10062da0]
xor eax, esp
mov dword [esp + 0x156c], eax
push ebx
push ebp
push edi
mov eax, dword [0x10062da0]
xor eax, esp
push eax
lea eax, [esp + 0x1584]
mov dword fs:[0], eax
mov edi, ecx
mov ebp, dword [esp + 0x1594]
lea eax, [esp + 0x101c]
push eax
call fcn.10021990
lea ecx, [esp + 0x101c]
push ecx
xor ebx, ebx
push edi
mov dword [esp + 0x1594], ebx
call fcn.10022a30
add esp, 8
test al, al
jne 0x1000ec8a
push str.GetBackDevicePath_GetUsbDiskInfo_fail
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov edi, str.GetBackDevicePath_GetUsbDiskInfo_fail
call fcn.10011e30
lea ecx, [esp + 0x101c]
call fcn.10021b70
xor al, al
jmp 0x1000ee5a
push edi
lea edi, [esp + 0x10b8]
call fcn.10022b20
add esp, 4
push 0x1ff
lea edx, [esp + 0x1381]
push ebx
push edx
mov byte [esp + 0x1388], bl
call fcn.10037cf0
add esp, 0xc
push 0xff
lea eax, [esp + 0x1281]
push ebx
push eax
mov byte [esp + 0x1288], bl
call fcn.10037cf0
mov ecx, dword [0x100676ac]
imul ecx, ecx, 0xb
add esp, 0xc
push ebx
push ebx
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
push ebx
lea edx, [esp + 0x1c]
push edx
push 0x200
lea eax, [esp + 0x1388]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_ReadFile]
push 0xff
lea ecx, [esp + 0x1181]
push ebx
push ecx
mov dword [esp + 0x20], 0x100
mov byte [esp + 0x1188], bl
call fcn.10037cf0
add esp, 0xc
push 0x100
lea edx, [esp + 0x1480]
push edx
lea eax, [esp + 0x1184]
push 0x101
push eax
call fcn.10032c83
push 0x100
lea ecx, [esp + 0x1390]
push ecx
lea edx, [esp + 0x1294]
push 0x101
push edx
call fcn.10032c83
add esp, 0x20
cmp dword [esp + 0x127c], 0x424b5244
je 0x1000ed9c
push str.GetBackDevicePath_check_BKRD_fail
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov edi, str.GetBackDevicePath_check_BKRD_fail
call fcn.10011e30
lea ecx, [esp + 0x101c]
call fcn.10021b70
xor al, al
jmp 0x1000ee5a
mov ecx, dword [esp + 0x10ec]
mov eax, 0x10
cmp dword [esp + 0x1100], eax
jae 0x1000edb8
lea ecx, [esp + 0x10ec]
cmp dword [esp + 0x10e4], eax
mov eax, dword [esp + 0x10d0]
jae 0x1000edcf
lea eax, [esp + 0x10d0]
lea edx, [esp + 0x14]
push edx
lea edx, [esp + 0x1180]
push edx
lea edx, [esp + 0x10bc]
push edx
push ecx
push eax
lea eax, [esp + 0x1290]
push eax
lea ebx, [esp + 0x34]
call fcn.1001f820
cmp dword [esp + 0x117c], 0x424b4450
je 0x1000ee29
push str.GetBackDevicePath_check_BKDP_fail
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov edi, str.GetBackDevicePath_check_BKDP_fail
call fcn.10011e30
lea ecx, [esp + 0x101c]
call fcn.10021b70
xor al, al
jmp 0x1000ee5a
lea eax, [esp + 0x1180]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x1000ee33
sub eax, edx
push eax
lea ecx, [esp + 0x1184]
push ecx
mov ecx, ebp
call fcn.10001fc0
lea ecx, [esp + 0x101c]
call fcn.10021b70
mov al, 1
mov ecx, dword [esp + 0x1584]
mov dword fs:[0], ecx
pop ecx
pop edi
pop ebp
pop ebx
mov ecx, dword [esp + 0x156c]
xor ecx, esp
call fcn.10032551
add esp, 0x1580
ret
Function at 0x1000ee90
Capabilities:
Read file on windows

Disassembly:
mov eax, 0x100c
call fcn.1003a830
mov eax, dword [0x10062da0]
xor eax, esp
mov dword [esp + 0x1008], eax
push ebp
mov ebp, dword [esp + 0x1014]
jmp 0x1000eec2
push 0xfff
lea eax, [esp + 0xd]
push 0
push eax
mov byte [esp + 0x14], 0
call fcn.10037cf0
add esp, 0xc
test ebx, ebx
je 0x1000efbd
test edi, edi
je 0x1000efbd
mov ecx, dword [0x100676ac]
push 0
push 0
lea edx, [ecx*8]
push edx
push esi
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov ecx, dword [0x100676ac]
push 0
lea eax, [esp + 8]
push eax
push ecx
lea edx, [esp + 0x14]
push edx
push esi
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x1000ef40
call dword [sym.imp.KERNEL32.dll_GetLastError]
pop ebp
mov ecx, dword [esp + 0x1008]
xor ecx, esp
call fcn.10032551
add esp, 0x100c
ret 4
cmp dword [esp + 8], 0x46544b45
jne 0x1000efbd
push 0xb0
lea eax, [esp + 0x10]
push eax
push 0xb1
push edi
call fcn.10032c83
add esp, 0x10
call fcn.1000e4f0
test eax, eax
je 0x1000efbd
push ebp
push edi
mov ecx, ebx
call fcn.1000e800
add esp, 8
test eax, eax
jne 0x1000efbd
mov eax, dword [0x1006a058]
test eax, eax
je 0x1000ef8b
push eax
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
cmp dword [edi], 0x46544b45
jne 0x1000efbd
jmp 0x1000efa3
xor eax, eax
pop ebp
mov ecx, dword [esp + 0x1008]
xor ecx, esp
call fcn.10032551
add esp, 0x100c
ret 4
mov ecx, dword [esp + 0x100c]
pop ebp
xor ecx, esp
mov eax, 1
call fcn.10032551
add esp, 0x100c
ret 4

Function at 0x1000efe0
Capabilities:
Read file on windows
Write file on windows

Disassembly:
mov eax, 0x1008
call fcn.1003a830
mov eax, dword [0x10062da0]
xor eax, esp
mov dword [esp + 0x1004], eax
push ebp
push edi
push 0xfff
lea eax, [esp + 0x11]
push 0
push eax
mov ebp, 1
mov dword [esp + 0x14], 0
mov byte [esp + 0x18], 0
call fcn.10037cf0
mov eax, dword [0x100676ac]
mov edi, dword [sym.imp.KERNEL32.dll_SetFilePointer]
add esp, 0xc
push 0
push 0
lea ecx, [eax + eax*4]
push ecx
push esi
call edi
mov eax, dword [0x100676ac]
push 0
lea edx, [esp + 0xc]
push edx
push eax
lea ecx, [esp + 0x18]
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x1000f0a5
mov eax, dword [0x100676ac]
push 0
push 0
lea edx, [eax + eax*4]
push edx
push esi
call edi
mov ecx, dword [0x100676ac]
push 0
lea eax, [esp + 0xc]
push eax
push ecx
lea edx, [esp + 0x18]
push edx
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x1000f0a5
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x13
jne 0x1000f0a5
pop edi
xor eax, eax
pop ebp
mov ecx, dword [esp + 0x1004]
xor ecx, esp
call fcn.10032551
add esp, 0x1008
ret
mov ecx, dword [esp + 0x100c]
pop edi
mov eax, ebp
pop ebp
xor ecx, esp
call fcn.10032551
add esp, 0x1008
ret
Function at 0x1000f4d0
Capabilities:
Encode data using xor
Read file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
mov eax, 0x1190
call fcn.1003a830
mov eax, dword [0x10062da0]
xor eax, esp
mov dword [esp + 0x118c], eax
push esi
push edi
mov ecx, 0x45
lea esi, [ebp + 8]
lea edi, [esp + 0x10]
rep movsd dword es:[edi], dword [esi]
mov edi, dword [ebp + 0x11c]
jmp 0x1000f516
push 0x63
lea eax, [esp + 0x12d]
push 0
push eax
mov dword [esp + 0x18], 0
mov byte [esp + 0x134], 0
call fcn.10037cf0
push 0xfff
lea ecx, [esp + 0x1a1]
push 0
push ecx
mov byte [esp + 0x1a8], 0
call fcn.10037cf0
add esp, 0x18
test edi, edi
jne 0x1000f575
mov eax, 1
pop edi
pop esi
mov ecx, dword [esp + 0x118c]
xor ecx, esp
call fcn.10032551
mov esp, ebp
pop ebp
ret 0x118
mov esi, dword [esp + 0x1c]
push 0
push 0
lea edx, [esi*4]
push edx
push ebx
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
push 0
lea eax, [esp + 0x10]
push eax
push esi
lea ecx, [esp + 0x19c]
push ecx
push ebx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x1000f684
lea edx, [esp + 0x190]
push 0x1005858c
push edx
call fcn.10033870
lea ecx, [esp + 0x198]
add esp, 8
cmp eax, ecx
jne 0x1000f55a
lea edx, [esp + 0x193]
push 0x1005858c
push edx
call fcn.10033870
add esp, 8
test eax, eax
je 0x1000f55a
lea ecx, [esp + 0x190]
sub eax, ecx
sub eax, 3
push eax
lea edx, [esp + 0x197]
push edx
lea eax, [esp + 0x130]
push eax
call fcn.10034390
push 0xa
lea ecx, [esp + 0x138]
push 0
push ecx
call fcn.1003470e
mov esi, eax
mov edx, esi
sar edx, 0x10
xor edx, esi
add esp, 0x18
movzx ecx, dx
xor eax, eax
lea esp, [esp]
xor word [esp + eax*2 + 0x1a8], cx
mov edx, 0xff
sub edx, eax
inc eax
add ecx, edx
cmp eax, 0xf4
jl 0x1000f630
push 0x2f
lea eax, [esp + 0x1ac]
push eax
push 0x30
push edi
call fcn.10032c83
xor esi, 0x88888888
add esp, 0x10
cmp dword [edi], esi
jne 0x1000f55a
xor eax, eax
pop edi
pop esi
mov ecx, dword [esp + 0x118c]
xor ecx, esp
call fcn.10032551
mov esp, ebp
pop ebp
ret 0x118
jmp 0x1000f694
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [esp + 0x1194]
pop edi
pop esi
xor ecx, esp
call fcn.10032551
mov esp, ebp
pop ebp
ret 0x118
Function at 0x1000f820
Capabilities:
Encode data using xor
Read file on windows

Disassembly:
sub esp, 0x530
mov eax, dword [0x10062da0]
xor eax, esp
mov dword [esp + 0x528], eax
push ebx
push esi
push edi
mov ebx, ecx
push 0x3ff
lea eax, [esp + 0x135]
mov ecx, 0x45
lea esi, [esp + 0x544]
lea edi, [esp + 0x1c]
push 0
rep movsd dword es:[edi], dword [esi]
mov esi, dword [esp + 0x65c]
push eax
mov byte [esp + 0x13c], 0
call fcn.10037cf0
mov eax, dword [esp + 0x28]
add esp, 0xc
test eax, eax
jne 0x1000f882
mov eax, 8
mov dword [esp + 0x1c], eax
mov ecx, dword [esp + 0x24]
imul ecx, eax
push 0
push 0
push ecx
push ebx
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov eax, dword [esp + 0x24]
push 0
lea edx, [esp + 0x18]
push edx
push eax
lea ecx, [esp + 0x13c]
push ecx
push ebx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x1000f8db
push str.EDPEDISK:__ReadOrgSector__Read_Fail__n
push eax
push 0x898
push str.ReadOrgSector
mov ecx, str..Format.cpp
call fcn.10010760
add esp, 0x10
mov eax, 1
jmp 0x1000f99e
call fcn.1001f600
lea eax, [esp + 0x28]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x1000f8e7
sub eax, edx
jne 0x1000f91d
mov eax, 0x10068de8
lea edx, [eax + 1]
lea ebx, [ebx]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x1000f900
sub eax, edx
push 0x10068de8
inc eax
push eax
lea edx, [esp + 0x30]
push edx
call fcn.100329ad
add esp, 0xc
lea eax, [esp + 0x28]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x1000f924
mov ecx, 0
sub eax, edx
mov edx, ecx
je 0x1000f94f
movzx edi, byte [esp + edx + 0x28]
movzx ebx, cl
xor edi, ebx
shr ecx, 8
xor ecx, dword [edi*4 + 0x100676c0]
inc edx
cmp edx, eax
jb 0x1000f936
mov dword [esp + 0x10], ecx
mov ecx, dword [esp + 0x24]
lea eax, [esp + 0x10]
push eax
push ecx
lea edx, [esp + 0x138]
push edx
mov ecx, edx
mov edx, 4
call fcn.1001f2b0
add esp, 0xc
cmp dword [esp + 0x130], 0x42474c4c
jne 0x1000f99c
mov eax, dword [esp + 0x24]
push eax
lea ecx, [esp + 0x134]
push ecx
push esi
call fcn.1003e240
mov eax, dword [esi + 4]
add esp, 0xc
jmp 0x1000f99e
xor eax, eax
mov ecx, dword [esp + 0x534]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.10032551
add esp, 0x530
ret 0x118
Function at 0x1000ff30
Capabilities:
Print debug messages

Disassembly:
sub esp, 0x134
mov eax, dword [0x10062da0]
xor eax, esp
mov dword [esp + 0x130], eax
mov eax, dword [esp + 0x140]
push ebx
mov ebx, dword [esp + 0x13c]
push ebp
mov ebp, dword [esp + 0x144]
push esi
mov esi, dword [esp + 0x150]
push edi
push pe_nt_image_headers32
mov dword [esp + 0x18], eax
lea eax, [esp + 0x2c]
push 0
push eax
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x2c], ecx
mov dword [esp + 0x24], edx
mov dword [esp + 0x28], esi
mov dword [esp + 0x30], 0
call fcn.10037cf0
add esp, 0xc
test ebx, ebx
je 0x1000fffb
cmp ebx, 0xffffffff
je 0x1000fffb
test esi, esi
je 0x1000fffb
test ebp, ebp
je 0x1000fffb
mov ecx, dword [0x100676ac]
push 0xff
lea edx, [esp + 0x38]
push 0x10068ce0
push edx
mov dword [esp + 0x3c], ecx
call fcn.10034390
add esp, 0xc
push ebp
sub esp, 0x114
mov edi, esp
mov ecx, 0x45
lea esi, [esp + 0x13c]
rep movsd dword es:[edi], dword [esi]
call fcn.1000f4d0
test eax, eax
je 0x1001001b
push 0x10058694
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov edi, 0x10058694
call fcn.10011e30
mov eax, 1
mov ecx, dword [esp + 0x140]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.10032551
add esp, 0x134
ret 0x10
cmp dword [ebp + 0x21], 0x42474c4c
je 0x10010036
push 0x100586b8
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov edi, 0x100586b8
jmp 0x1000fff6
movzx eax, byte [ebp + 0x2b]
movzx ecx, byte [ebp + 0x2c]
mov edx, dword [esp + 0x20]
push edx
mov dword [esp + 0x2c], eax
mov eax, dword [esp + 0x18]
mov dword [esp + 0x30], ecx
push eax
lea ecx, [esp + 0x2c]
mov edx, ebx
mov ebx, dword [esp + 0x20]
push ecx
push edx
call fcn.1000f1c0
mov esi, eax
test esi, esi
je 0x10010080
push 0x100586dc
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov edi, 0x100586dc
call fcn.10011e30
mov eax, esi
jmp 0x10010000
movzx ecx, byte [ebp + 0x2a]
movzx eax, byte [ebp + 0x29]
mov edx, dword [esp + 0x10]
sub esp, 0x114
mov dword [esp + 0x140], ecx
mov edi, esp
push edx
mov edx, dword [esp + 0x134]
mov dword [esp + 0x140], eax
mov ecx, 0x45
lea esi, [esp + 0x13c]
rep movsd dword es:[edi], dword [esi]
call fcn.1000f9c0
jmp 0x10010000
Function at 0x100100d0
Capabilities:
Encode data using xor
Print debug messages
Write file on windows

Disassembly:
mov eax, 0x1130
call fcn.1003a830
mov eax, dword [0x10062da0]
xor eax, esp
mov dword [esp + 0x1128], eax
mov eax, dword [esp + 0x1134]
push ebp
push esi
push edi
mov ecx, 0x45
lea esi, [esp + 0x1144]
lea edi, [esp + 0x18]
rep movsd dword es:[edi], dword [esi]
mov edi, dword [esp + 0x1258]
mov esi, dword [esp + 0x125c]
mov dword [esp + 0x10], eax
jmp 0x10010128
push 0xfff
lea ecx, [esp + 0x135]
push 0
push ecx
mov byte [esp + 0x13c], 0
call fcn.10037cf0
mov ebp, dword [esp + 0x28]
add esp, 0xc
test ebp, ebp
jne 0x10010154
mov ebp, 0xc
mov eax, 0x88
xor byte [esi + 3], al
xor byte [esi + 6], al
mov edx, eax
mov ax, word [esp + 0x128]
xor word [esi], dx
mov ecx, 0x206
cmp ax, cx
jne 0x100101a5
push 0x120
push edi
lea edx, [esp + 0x138]
push 0x121
push edx
call fcn.10032c83
push 0xe
push esi
lea eax, [esp + 0x268]
push 0xf
push eax
call fcn.10032c83
add esp, 0x20
jmp 0x100101f3
mov ecx, 0x202
cmp ax, cx
jne 0x100101de
push 0xc0
push ebx
lea edx, [esp + 0x138]
push 0xc1
push edx
call fcn.10032c83
push 0xe
push esi
lea eax, [esp + 0x208]
push 0xf
push eax
call fcn.10032c83
add esp, 0x20
jmp 0x100101f3
push 0x10058708
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov edi, 0x10058708
call fcn.10011e30
call fcn.1001f600
mov eax, 0x10068ce0
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x10010200
mov ecx, 0
sub eax, edx
mov edx, ecx
je 0x1001022d
movzx esi, byte [edx + 0x10068ce0]
movzx edi, cl
xor esi, edi
shr ecx, 8
xor ecx, dword [esi*4 + 0x100676c0]
inc edx
cmp edx, eax
jb 0x10010212
mov dword [esp + 0x14], ecx
lea ecx, [esp + 0x14]
push ecx
lea edx, [esp + 0x134]
push 0x200
push edx
mov ecx, edx
mov edx, 4
call fcn.1001f410
imul ebp, dword [0x100676ac]
mov esi, dword [esp + 0x1c]
add esp, 0xc
push 0
push 0
push ebp
push esi
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
jmp 0x10010279
mov ecx, dword [0x100676ac]
push 0
lea eax, [esp + 0x10]
push eax
push ecx
lea edx, [esp + 0x13c]
push edx
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x1001029e
xor eax, eax
jmp 0x100102a4
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [esp + 0x1134]
pop edi
pop esi
pop ebp
xor ecx, esp
call fcn.10032551
add esp, 0x1130
ret 0x120
Function at 0x100102c0
Capabilities:
Read file on windows
Write file on windows

Disassembly:
sub esp, 0x18
push ebx
push ebp
push esi
jmp 0x100102d8
mov eax, dword [0x100676a8]
mul dword [0x100676a4]
mov esi, dword [0x100676ac]
xor ebp, ebp
push ebp
push esi
push edx
push eax
call fcn.1003abe0
mov ecx, dword [0x1006769c]
push ecx
mov ecx, dword [0x10067698]
push ecx
push edx
push eax
call fcn.1003abe0
test eax, eax
jne 0x1001031a
test edx, edx
jne 0x1001031a
xor eax, eax
pop esi
pop ebp
pop ebx
add esp, 0x18
ret
sub eax, 0x80000
sbb edx, ebp
mov dword [esp + 0x1c], edx
lea edx, [esi + esi*4]
add edx, edx
push edx
mov dword [esp + 0x1c], eax
call fcn.10024af0
mov esi, eax
add esp, 4
test esi, esi
je 0x10010311
mov eax, dword [0x100676ac]
mov ebx, dword [sym.imp.KERNEL32.dll_SetFilePointer]
push 0
push 0
lea ecx, [eax*4]
push ecx
push edi
call ebx
mov eax, dword [0x100676ac]
push 0
lea edx, [esp + 0x18]
push edx
lea eax, [eax + eax*8]
push eax
push esi
push edi
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x100103a3
mov edx, dword [esp + 0x18]
push 0
lea ecx, [esp + 0x20]
push ecx
push edx
push edi
call ebx
push 0
lea eax, [esp + 0x14]
push eax
mov eax, dword [0x100676ac]
lea ecx, [eax + eax*8]
push ecx
push esi
push edi
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x100103a3
mov ebp, 1
push esi
call fcn.10024afb
add esp, 4
jmp 0x100103bc
pop esi
mov eax, ebp
pop ebp
pop ebx
add esp, 0x18
ret

Function at 0x100103d0
Capabilities:
Read file on windows

Disassembly:
mov eax, 0x1008
call fcn.1003a830
mov eax, dword [0x10062da0]
xor eax, esp
mov dword [esp + 0x1004], eax
push 0xfff
lea eax, [esp + 9]
push 0
push eax
mov byte [esp + 0x10], 0
call fcn.10037cf0
mov ecx, dword [0x100676ac]
add esp, 0xc
push 0
push 0
lea edx, [ecx*4]
push edx
push esi
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov ecx, dword [0x100676ac]
push 0
lea eax, [esp + 4]
push eax
push ecx
lea edx, [esp + 0x10]
push edx
push esi
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x10010460
lea eax, [esp + 4]
push 0x1005858c
push eax
call fcn.10033870
lea ecx, [esp + 0xc]
add esp, 8
cmp eax, ecx
jne 0x10010460
mov dl, byte [esp + 0x3d]
mov al, byte [esp + 0x3e]
mov byte [edi + 0x21], dl
mov byte [edi + 0x22], al
mov ecx, dword [esp + 0x1004]
xor ecx, esp
mov eax, 1
call fcn.10032551
add esp, 0x1008
ret
Function at 0x10011950
Capabilities:
Print debug messages

Disassembly:
sub esp, 0x134
mov eax, dword [0x10062da0]
xor eax, esp
mov dword [esp + 0x130], eax
push ebx
xor ebx, ebx
push edi
cmp dword [esi + 0x28], ebx
je 0x10011a2b
cmp dword [esi + 0x2c], ebx
je 0x10011a2b
xor eax, eax
mov dword [esp + 0x19], eax
mov dword [esp + 0x1d], eax
mov dword [esp + 0x21], eax
mov dword [esp + 0x25], eax
mov word [esp + 0x29], ax
mov byte [esp + 0x2b], al
lea eax, [esp + 0x18]
push 1
mov ecx, eax
push ecx
mov byte [esp + 0x20], bl
mov dword [esp + 0x14], 0xc
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x18], eax
call dword [sym.imp.ADVAPI32.dll_InitializeSecurityDescriptor]
mov edx, dword [esp + 0x10]
push ebx
push ebx
push 1
push edx
call dword [sym.imp.ADVAPI32.dll_SetSecurityDescriptorDacl]
mov eax, dword [esi + 0x2c]
push 0x1005882c
push eax
push ebx
push 4
lea ecx, [esp + 0x1c]
push ecx
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_CreateFileMappingA]
mov dword [esi + 0x20], eax
cmp eax, ebx
jne 0x10011a44
push 0x103
lea edx, [esp + 0x31]
push ebx
push edx
mov byte [esp + 0x38], bl
call fcn.10037cf0
add esp, 0xc
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea eax, [esp + 0x30]
push 0x10058850
push eax
call fcn.100117d0
add esp, 0xc
lea ecx, [esp + 0x2c]
push ecx
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
lea edi, [esp + 0x2c]
call fcn.10011e30
xor eax, eax
pop edi
pop ebx
mov ecx, dword [esp + 0x130]
xor ecx, esp
call fcn.10032551
add esp, 0x134
ret
push ebx
push ebx
push ebx
push 0xf001f
push eax
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov dword [esi + 0x30], eax
cmp eax, ebx
jne 0x10011a7e
push 0x1005887c
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov edi, 0x1005887c
call fcn.10011e30
mov edx, dword [esi + 0x20]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi + 0x20], ebx
jmp 0x10011a2b
cmp dword [esi + 0x18], 0x10
jb 0x10011a89
mov eax, dword [esi + 4]
jmp 0x10011a8c
lea eax, [esi + 4]
push eax
push ebx
push 1
lea eax, [esp + 0x18]
push eax
call dword [sym.imp.KERNEL32.dll_CreateEventA]
mov ecx, dword [esp + 0x138]
pop edi
pop ebx
mov dword [esi + 0x1c], eax
xor ecx, esp
mov eax, 1
call fcn.10032551
add esp, 0x134
ret
Function at 0x10011ac0
Capabilities:
Print debug messages

Disassembly:
sub esp, 0x114
mov eax, dword [0x10062da0]
xor eax, esp
mov dword [esp + 0x110], eax
push esi
push edi
mov edi, ecx
cmp dword [edi + 0x28], 0
je 0x10011b43
mov eax, dword [edi + 0x2c]
test eax, eax
je 0x10011b43
push 0x1005882c
push eax
push 0
push 4
push 0
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_CreateFileMappingA]
mov esi, eax
test esi, esi
jne 0x10011b5c
push 0x103
push eax
mov byte [esp + 0x14], al
lea eax, [esp + 0x15]
push eax
call fcn.10037cf0
add esp, 0xc
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea ecx, [esp + 0x10]
push str.EDPEDISK:Could_not_open_file_mapping_object_err_d._n
push ecx
call fcn.100117d0
add esp, 0xc
lea edx, [esp + 0xc]
push edx
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
lea edi, [esp + 0xc]
call fcn.10011e30
xor eax, eax
pop edi
pop esi
mov ecx, dword [esp + 0x110]
xor ecx, esp
call fcn.10032551
add esp, 0x114
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
je 0x10011b82
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push str.EDPEDISK:create_new_file_mapping_object__n
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov edi, str.EDPEDISK:create_new_file_mapping_object__n
jmp 0x10011b3e
push 0
push 0
push 0
push 0xf001f
push esi
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
test eax, eax
jne 0x10011bb6
push str.EDPEDISK:Could_not_map_view_of_file._n
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov edi, str.EDPEDISK:Could_not_map_view_of_file._n
call fcn.10011e30
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x10011b43
mov ecx, dword [edi + 0x2c]
push ecx
push eax
mov eax, dword [edi + 0x28]
inc ecx
push ecx
push eax
call fcn.10032c83
add esp, 0x10
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [esp + 0x118]
pop edi
pop esi
xor ecx, esp
mov eax, 1
call fcn.10032551
add esp, 0x114
ret
Function at 0x10011bf0
Capabilities:
Print debug messages

Disassembly:
sub esp, 0x17c
mov eax, dword [0x10062da0]
xor eax, esp
mov dword [esp + 0x178], eax
cmp dword [esi + 0x28], 0
push ebp
push edi
je 0x10011c71
mov eax, dword [esi + 0x2c]
test eax, eax
je 0x10011c71
push 0x1005882c
push eax
push 0
push 4
push 0
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_CreateFileMappingA]
mov ebp, eax
test ebp, ebp
jne 0x10011c8a
push 0x103
push eax
mov byte [esp + 0x7c], al
lea eax, [esp + 0x7d]
push eax
call fcn.10037cf0
add esp, 0xc
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea ecx, [esp + 0x78]
push str.EDPEDISK:Could_not_open_file_mapping_object_err_d._n
push ecx
call fcn.100117d0
add esp, 0xc
lea edx, [esp + 0x74]
push edx
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
lea edi, [esp + 0x74]
call fcn.10011e30
xor eax, eax
pop edi
pop ebp
mov ecx, dword [esp + 0x178]
xor ecx, esp
call fcn.10032551
add esp, 0x17c
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
je 0x10011cb0
push ebp
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push str.EDPEDISK:create_new_file_mapping_object__n
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov edi, str.EDPEDISK:create_new_file_mapping_object__n
jmp 0x10011c6c
push 0
push 0
push 0
push 0xf001f
push ebp
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
test eax, eax
jne 0x10011ce4
push str.EDPEDISK:Could_not_map_view_of_file._n
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov edi, str.EDPEDISK:Could_not_map_view_of_file._n
call fcn.10011e30
push ebp
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x10011c71
mov ecx, dword [esi + 0x2c]
mov edx, dword [esi + 0x28]
push ecx
push edx
inc ecx
push ecx
push eax
call fcn.10032c83
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
add esp, 0x10
push ebp
call edi
cmp dword [esi + 0x18], 0x10
jb 0x10011d0b
mov eax, dword [esi + 4]
jmp 0x10011d0e
lea eax, [esi + 4]
push eax
push 0
push 0x1f0003
call dword [sym.imp.KERNEL32.dll_OpenEventA]
mov dword [esi + 0x24], eax
test eax, eax
jne 0x10011d64
push 0x63
push eax
mov byte [esp + 0x14], al
lea eax, [esp + 0x15]
push eax
call fcn.10037cf0
add esp, 0xc
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea ecx, [esp + 0x10]
push str.EDPEDISK:Client_OpenEvent_share_memory_event_Fail_err__d
push ecx
call fcn.100117d0
add esp, 0xc
lea edx, [esp + 0xc]
push edx
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
lea edi, [esp + 0xc]
jmp 0x10011c6c
push eax
call dword [sym.imp.KERNEL32.dll_SetEvent]
push 0xbb8
call dword [sym.imp.KERNEL32.dll_Sleep]
mov eax, dword [esi + 0x24]
push eax
call dword [sym.imp.KERNEL32.dll_ResetEvent]
mov ecx, dword [esi + 0x24]
push ecx
call edi
mov ecx, dword [esp + 0x180]
pop edi
pop ebp
xor ecx, esp
mov eax, 1
call fcn.10032551
add esp, 0x17c
ret