joyce8/EMBER2024-capa huggingface dataset:
Function at 0x3403ebe8
Capabilities:
Get common file path
Get disk information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc44
push edi
xor eax, eax
mov al, byte [0x341a2fe8]
and eax, 1
test eax, eax
jne 0x3403ec26
mov cl, byte [0x341a2fe8]
or cl, 1
mov byte [0x341a2fe8], cl
mov ecx, 0x341a2fe4
call fcn.3400b090
push 0x3403edf2
call fcn.340bdbfb
add esp, 4
xor edx, edx
mov dl, byte [0x341a2fe8]
and edx, 2
test edx, edx
jne 0x3403ec58
mov al, byte [0x341a2fe8]
or al, 2
mov byte [0x341a2fe8], al
mov ecx, 0x341a2fe0
call fcn.3400b090
push 0x3403ede3
call fcn.340bdbfb
add esp, 4
mov ecx, 0x341a2fe4
call fcn.340020d0
test eax, eax
je 0x3403ed9f
mov word [ebp - 0x410], 0
mov ecx, 0x103
xor eax, eax
lea edi, [ebp - 0x40e]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
push 0x208
lea ecx, [ebp - 0x410]
push ecx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
test eax, eax
jbe 0x3403ed9f
push str.System32
lea edx, [ebp - 0x410]
push edx
call fcn.340bd8ca
add esp, 8
mov word [ebp - 0xc44], 0
mov ecx, 0x103
xor eax, eax
lea edi, [ebp - 0xc42]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
push 0x208
lea eax, [ebp - 0xc44]
push eax
lea ecx, [ebp - 0x410]
push ecx
call fcn.340372fa
add esp, 0xc
mov dword [ebp - 0x834], eax
cmp dword [ebp - 0x834], 0
jne 0x3403ed07
lea edx, [ebp - 0xc44]
push edx
mov ecx, 0x341a2fe4
call fcn.340a75b0
mov eax, dword [0x3417afa8]
mov dword [ebp - 0x830], eax
mov cx, word [0x3417afac]
mov word [ebp - 0x82c], cx
xor edx, edx
mov dword [ebp - 0x82a], edx
mov word [ebp - 0x826], dx
mov ax, word [ebp - 0x410]
mov word [ebp - 0x830], ax
mov word [ebp - 0x820], 0
mov ecx, 0x103
xor eax, eax
lea edi, [ebp - 0x81e]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
push 0x208
lea ecx, [ebp - 0x820]
push ecx
lea edx, [ebp - 0x830]
push edx
call dword [sym.imp.KERNEL32.dll_QueryDosDeviceW]
mov dword [ebp - 0x824], eax
cmp dword [ebp - 0x824], 0
jbe 0x3403ed9f
lea eax, [ebp - 0x40c]
push eax
lea ecx, [ebp - 0x820]
push ecx
push 0x3417afb0
push 0x341a2fe0
call fcn.340aa2b0
add esp, 0x10
cmp dword [ebp + 8], 0
je 0x3403edd4
cmp dword [ebp + 0xc], 0
jle 0x3403edd4
mov edx, dword [ebp + 0xc]
push edx
push 0
mov ecx, 0x341a2fe0
call fcn.340a8000
push eax
mov eax, dword [ebp + 8]
push eax
call fcn.340bd451
add esp, 0xc
push 0xffffffffffffffff
mov ecx, 0x341a2fe0
call fcn.340a80d0
mov ecx, 0x341a2fe4
call fcn.340020c0
pop edi
mov esp, ebp
pop ebp
ret
Function at 0x3403f9bc
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
cmp dword [ebp + 8], 0
je 0x3403f9ce
cmp dword [ebp + 0xc], 0x40
jae 0x3403f9d2
xor eax, eax
jmp 0x3403fa35
mov eax, dword [ebp + 8]
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
xor edx, edx
mov dx, word [ecx]
cmp edx, 0x5a4d
jne 0x3403fa33
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0x3c]
add ecx, 4
cmp dword [ebp + 0xc], ecx
jbe 0x3403fa33
mov edx, dword [ebp - 4]
mov eax, dword [ebp + 8]
add eax, dword [edx + 0x3c]
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 8]
cmp dword [ecx], 0x4550
je 0x3403fa2c
mov edx, dword [ebp - 8]
xor eax, eax
mov ax, word [edx]
cmp eax, 0x454e
je 0x3403fa2c
mov ecx, dword [ebp - 8]
xor edx, edx
mov dx, word [ecx]
cmp edx, 0x454c
jne 0x3403fa33
mov eax, 1
jmp 0x3403fa35
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x34040820
Capabilities:
Get local ipv4 addresses
Get socket information
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
mov dword [ebp - 4], 1
cmp dword [ebp + 0xc], 0
jne 0x3404083d
cmp dword [ebp + 0x10], 0
je 0x340408ee
mov word [ebp - 0x1c], 0
xor eax, eax
mov dword [ebp - 0x1a], eax
mov dword [ebp - 0x16], eax
mov dword [ebp - 0x12], eax
mov word [ebp - 0xe], ax
mov dword [ebp - 8], 0x10
lea ecx, [ebp - 8]
push ecx
lea edx, [ebp - 0x1c]
push edx
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.WS2_32.dll_getsockname]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0xffffffff
jne 0x340408b5
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0x2726
jne 0x340408b5
push 4
lea ecx, [ebp + 8]
push ecx
push 0x700b
push 0xffff
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.WS2_32.dll_setsockopt]
lea eax, [ebp - 8]
push eax
lea ecx, [ebp - 0x1c]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.WS2_32.dll_getsockname]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0xffffffff
je 0x340408e7
lea eax, [ebp - 0x1c]
mov dword [ebp - 0x24], eax
cmp dword [ebp + 0xc], 0
je 0x340408d2
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp - 0x24]
mov eax, dword [edx + 4]
mov dword [ecx], eax
cmp dword [ebp + 0x10], 0
je 0x340408e5
mov ecx, dword [ebp + 0x10]
mov edx, dword [ebp - 0x24]
mov ax, word [edx + 2]
mov word [ecx], ax
jmp 0x340408ee
mov dword [ebp - 4], 0
cmp dword [ebp + 0x14], 0
jne 0x340408fe
cmp dword [ebp + 0x18], 0
je 0x340409af
mov word [ebp - 0x3c], 0
xor ecx, ecx
mov dword [ebp - 0x3a], ecx
mov dword [ebp - 0x36], ecx
mov dword [ebp - 0x32], ecx
mov word [ebp - 0x2e], cx
mov dword [ebp - 0x28], 0x10
lea edx, [ebp - 0x28]
push edx
lea eax, [ebp - 0x3c]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.WS2_32.dll_getpeername]
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], 0xffffffff
jne 0x34040976
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov dword [ebp - 0x40], eax
cmp dword [ebp - 0x40], 0x2726
jne 0x34040976
push 4
lea edx, [ebp + 8]
push edx
push 0x700b
push 0xffff
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.WS2_32.dll_setsockopt]
lea ecx, [ebp - 0x28]
push ecx
lea edx, [ebp - 0x3c]
push edx
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.WS2_32.dll_getsockname]
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], 0xffffffff
je 0x340409a8
lea ecx, [ebp - 0x3c]
mov dword [ebp - 0x44], ecx
cmp dword [ebp + 0x14], 0
je 0x34040993
mov edx, dword [ebp + 0x14]
mov eax, dword [ebp - 0x44]
mov ecx, dword [eax + 4]
mov dword [edx], ecx
cmp dword [ebp + 0x18], 0
je 0x340409a6
mov edx, dword [ebp + 0x18]
mov eax, dword [ebp - 0x44]
mov cx, word [eax + 2]
mov word [edx], cx
jmp 0x340409af
mov dword [ebp - 4], 0
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
Function at 0x34079c36
Capabilities:
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x3413f3fc
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
sub esp, 0x60
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x6c], ecx
mov dword [ebp - 0x44], 0
mov dword [ebp - 0x48], 0
lea ecx, [ebp - 0x40]
call fcn.340df380
mov dword [ebp - 4], 0
push 1
lea eax, [ebp - 0x40]
push eax
mov ecx, dword [ebp - 0x6c]
call fcn.34078e29
test eax, eax
je 0x34079d30
push 0xffffffffffffffff
lea ecx, [ebp - 0x40]
call fcn.340dfcb0
push 0x211
push 0x34188aa8
call fcn.3407bcd0
add esp, 8
mov byte [ebp - 4], 1
push 0
lea ecx, [ebp - 0x40]
call fcn.340dfd00
mov dword [ebp - 0x70], eax
mov ecx, dword [ebp - 0x70]
mov dword [ebp - 0x54], ecx
cmp dword [ebp - 0x54], 0
je 0x34079cd9
mov edx, dword [ebp - 0x54]
mov eax, dword [edx + 0x10]
mov dword [ebp - 0x44], eax
mov ecx, dword [ebp - 0x54]
mov edx, dword [ecx + 8]
mov dword [ebp - 0x48], edx
jmp 0x34079cf3
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x40]
call fcn.340dfce0
mov dword [ebp - 0x50], eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x4c], eax
push 0x223
push 0x34188ac8
mov eax, dword [ebp - 0x4c]
push eax
mov ecx, dword [ebp - 0x50]
push ecx
call fcn.3407bd79
add esp, 0x10
lea ecx, [ebp - 0x40]
call fcn.340dfa80
cmp dword [ebp - 0x44], 0
jbe 0x34079dfa
cmp dword [ebp + 8], 0
je 0x34079dfa
mov edx, dword [ebp + 0xc]
cmp edx, dword [ebp - 0x44]
jb 0x34079dfa
mov eax, dword [ebp - 0x48]
and eax, 2
mov dword [ebp - 0x60], eax
mov ecx, dword [ebp - 0x60]
push ecx
lea edx, [ebp - 0x5c]
push edx
mov ecx, dword [ebp - 0x6c]
call fcn.34079760
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x5c]
call fcn.340020c0
push eax
push 0
push 4
call dword [sym.imp.KERNEL32.dll_OpenFileMappingW]
mov dword [ebp - 0x58], eax
cmp dword [ebp - 0x58], 0
je 0x34079dee
mov eax, dword [ebp - 0x44]
push eax
push 0
push 0
push 4
mov ecx, dword [ebp - 0x58]
push ecx
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov dword [ebp - 0x64], eax
cmp dword [ebp - 0x64], 0
je 0x34079ddd
mov edx, dword [ebp + 0xc]
push edx
push 0
mov eax, dword [ebp + 8]
push eax
call fcn.340bd3e0
add esp, 0xc
mov ecx, dword [ebp - 0x44]
push ecx
mov edx, dword [ebp - 0x64]
push edx
mov eax, dword [ebp + 8]
push eax
call fcn.340be130
add esp, 0xc
mov ecx, dword [ebp - 0x64]
push ecx
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov dword [ebp - 0x64], 0
mov edx, dword [ebp - 0x58]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0x58], 0
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x5c]
call fcn.340a7330
mov eax, dword [ebp - 0x44]
mov dword [ebp - 0x68], eax
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x40]
call fcn.340df520
mov eax, dword [ebp - 0x68]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x34079cf3
Capabilities:
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x3413f3fc
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
sub esp, 0x60
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x6c], ecx
mov dword [ebp - 0x44], 0
mov dword [ebp - 0x48], 0
lea ecx, [ebp - 0x40]
call fcn.340df380
mov dword [ebp - 4], 0
push 1
lea eax, [ebp - 0x40]
push eax
mov ecx, dword [ebp - 0x6c]
call fcn.34078e29
test eax, eax
je 0x34079d30
push 0xffffffffffffffff
lea ecx, [ebp - 0x40]
call fcn.340dfcb0
push 0x211
push 0x34188aa8
call fcn.3407bcd0
add esp, 8
mov byte [ebp - 4], 1
push 0
lea ecx, [ebp - 0x40]
call fcn.340dfd00
mov dword [ebp - 0x70], eax
mov ecx, dword [ebp - 0x70]
mov dword [ebp - 0x54], ecx
cmp dword [ebp - 0x54], 0
je 0x34079cd9
mov edx, dword [ebp - 0x54]
mov eax, dword [edx + 0x10]
mov dword [ebp - 0x44], eax
mov ecx, dword [ebp - 0x54]
mov edx, dword [ecx + 8]
mov dword [ebp - 0x48], edx
jmp 0x34079cf3
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x40]
call fcn.340dfce0
mov dword [ebp - 0x50], eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x4c], eax
push 0x223
push 0x34188ac8
mov eax, dword [ebp - 0x4c]
push eax
mov ecx, dword [ebp - 0x50]
push ecx
call fcn.3407bd79
add esp, 0x10
lea ecx, [ebp - 0x40]
call fcn.340dfa80
cmp dword [ebp - 0x44], 0
jbe 0x34079dfa
cmp dword [ebp + 8], 0
je 0x34079dfa
mov edx, dword [ebp + 0xc]
cmp edx, dword [ebp - 0x44]
jb 0x34079dfa
mov eax, dword [ebp - 0x48]
and eax, 2
mov dword [ebp - 0x60], eax
mov ecx, dword [ebp - 0x60]
push ecx
lea edx, [ebp - 0x5c]
push edx
mov ecx, dword [ebp - 0x6c]
call fcn.34079760
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x5c]
call fcn.340020c0
push eax
push 0
push 4
call dword [sym.imp.KERNEL32.dll_OpenFileMappingW]
mov dword [ebp - 0x58], eax
cmp dword [ebp - 0x58], 0
je 0x34079dee
mov eax, dword [ebp - 0x44]
push eax
push 0
push 0
push 4
mov ecx, dword [ebp - 0x58]
push ecx
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov dword [ebp - 0x64], eax
cmp dword [ebp - 0x64], 0
je 0x34079ddd
mov edx, dword [ebp + 0xc]
push edx
push 0
mov eax, dword [ebp + 8]
push eax
call fcn.340bd3e0
add esp, 0xc
mov ecx, dword [ebp - 0x44]
push ecx
mov edx, dword [ebp - 0x64]
push edx
mov eax, dword [ebp + 8]
push eax
call fcn.340be130
add esp, 0xc
mov ecx, dword [ebp - 0x64]
push ecx
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov dword [ebp - 0x64], 0
mov edx, dword [ebp - 0x58]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0x58], 0
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x5c]
call fcn.340a7330
mov eax, dword [ebp - 0x44]
mov dword [ebp - 0x68], eax
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x40]
call fcn.340df520
mov eax, dword [ebp - 0x68]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x34079e25
Capabilities:
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x3413f418
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
sub esp, 0x68
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x74], ecx
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x48], 0
mov dword [ebp - 0x4c], 0
lea ecx, [ebp - 0x44]
call fcn.340df380
mov dword [ebp - 4], 0
push 1
lea eax, [ebp - 0x44]
push eax
mov ecx, dword [ebp - 0x74]
call fcn.34078e29
test eax, eax
je 0x34079f26
push 0xffffffffffffffff
lea ecx, [ebp - 0x44]
call fcn.340dfcb0
push 0x24e
push 0x34188ad8
call fcn.3407bcd0
add esp, 8
mov byte [ebp - 4], 1
push 0
lea ecx, [ebp - 0x44]
call fcn.340dfd00
mov dword [ebp - 0x78], eax
mov ecx, dword [ebp - 0x78]
mov dword [ebp - 0x58], ecx
cmp dword [ebp - 0x58], 0
je 0x34079ecf
mov edx, dword [ebp - 0x58]
mov eax, dword [edx + 0x10]
mov dword [ebp - 0x48], eax
mov ecx, dword [ebp - 0x58]
mov edx, dword [ecx + 8]
mov dword [ebp - 0x4c], edx
jmp 0x34079ee9
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x44]
call fcn.340dfce0
mov dword [ebp - 0x54], eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x50], eax
push 0x260
push 0x34188af8
mov eax, dword [ebp - 0x50]
push eax
mov ecx, dword [ebp - 0x54]
push ecx
call fcn.3407bd79
add esp, 0x10
lea ecx, [ebp - 0x44]
call fcn.340dfa80
cmp dword [ebp - 0x48], 0
jbe 0x34079ff9
mov edx, dword [ebp - 0x4c]
and edx, 2
mov dword [ebp - 0x64], edx
mov eax, dword [ebp - 0x64]
push eax
lea ecx, [ebp - 0x60]
push ecx
mov ecx, dword [ebp - 0x74]
call fcn.34079760
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x60]
call fcn.340020c0
push eax
push 0
push 4
call dword [sym.imp.KERNEL32.dll_OpenFileMappingW]
mov dword [ebp - 0x5c], eax
cmp dword [ebp - 0x5c], 0
je 0x34079fed
mov edx, dword [ebp - 0x48]
push edx
push 0
push 0
push 4
mov eax, dword [ebp - 0x5c]
push eax
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov dword [ebp - 0x68], eax
cmp dword [ebp - 0x68], 0
je 0x34079fdc
mov ecx, dword [ebp - 0x48]
push ecx
call fcn.340bd438
add esp, 4
mov dword [ebp - 0x6c], eax
mov edx, dword [ebp - 0x6c]
mov dword [ebp - 0x14], edx
cmp dword [ebp - 0x14], 0
je 0x34079fcb
mov eax, dword [ebp - 0x48]
push eax
push 0
mov ecx, dword [ebp - 0x14]
push ecx
call fcn.340bd3e0
add esp, 0xc
mov edx, dword [ebp - 0x48]
push edx
mov eax, dword [ebp - 0x68]
push eax
mov ecx, dword [ebp - 0x14]
push ecx
call fcn.340be130
add esp, 0xc
mov edx, dword [ebp - 0x68]
push edx
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov dword [ebp - 0x68], 0
mov eax, dword [ebp - 0x5c]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0x5c], 0
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x60]
call fcn.340a7330
cmp dword [ebp + 8], 0
je 0x3407a007
mov ecx, dword [ebp + 8]
mov edx, dword [ebp - 0x48]
mov dword [ecx], edx
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x70], eax
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x44]
call fcn.340df520
mov eax, dword [ebp - 0x70]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x3407a4ec
Capabilities:
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x3413f48d
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
sub esp, 0x60
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x6c], ecx
mov dword [ebp - 0x44], 0
mov dword [ebp - 0x48], 0
lea ecx, [ebp - 0x40]
call fcn.340df380
mov dword [ebp - 4], 0
push 1
lea eax, [ebp - 0x40]
push eax
mov ecx, dword [ebp - 0x6c]
call fcn.34078e29
test eax, eax
je 0x3407a5e6
push 0xffffffffffffffff
lea ecx, [ebp - 0x40]
call fcn.340dfcb0
push 0x331
push 0x34188c48
call fcn.3407bcd0
add esp, 8
mov byte [ebp - 4], 1
push 0
lea ecx, [ebp - 0x40]
call fcn.340dfd00
mov dword [ebp - 0x70], eax
mov ecx, dword [ebp - 0x70]
mov dword [ebp - 0x54], ecx
cmp dword [ebp - 0x54], 0
je 0x3407a58f
mov edx, dword [ebp - 0x54]
mov eax, dword [edx + 0x28]
mov dword [ebp - 0x44], eax
mov ecx, dword [ebp - 0x54]
mov edx, dword [ecx + 8]
mov dword [ebp - 0x48], edx
jmp 0x3407a5a9
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x40]
call fcn.340dfce0
mov dword [ebp - 0x50], eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x4c], eax
push 0x343
push 0x34188c68
mov eax, dword [ebp - 0x4c]
push eax
mov ecx, dword [ebp - 0x50]
push ecx
call fcn.3407bd79
add esp, 0x10
lea ecx, [ebp - 0x40]
call fcn.340dfa80
cmp dword [ebp - 0x44], 0
jbe 0x3407a6b0
cmp dword [ebp + 8], 0
je 0x3407a6b0
mov edx, dword [ebp + 0xc]
cmp edx, dword [ebp - 0x44]
jb 0x3407a6b0
mov eax, dword [ebp - 0x48]
and eax, 2
mov dword [ebp - 0x60], eax
mov ecx, dword [ebp - 0x60]
push ecx
lea edx, [ebp - 0x5c]
push edx
mov ecx, dword [ebp - 0x6c]
call fcn.3407a04d
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x5c]
call fcn.340020c0
push eax
push 0
push 4
call dword [sym.imp.KERNEL32.dll_OpenFileMappingW]
mov dword [ebp - 0x58], eax
cmp dword [ebp - 0x58], 0
je 0x3407a6a4
mov eax, dword [ebp - 0x44]
push eax
push 0
push 0
push 4
mov ecx, dword [ebp - 0x58]
push ecx
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov dword [ebp - 0x64], eax
cmp dword [ebp - 0x64], 0
je 0x3407a693
mov edx, dword [ebp + 0xc]
push edx
push 0
mov eax, dword [ebp + 8]
push eax
call fcn.340bd3e0
add esp, 0xc
mov ecx, dword [ebp - 0x44]
push ecx
mov edx, dword [ebp - 0x64]
push edx
mov eax, dword [ebp + 8]
push eax
call fcn.340be130
add esp, 0xc
mov ecx, dword [ebp - 0x64]
push ecx
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov dword [ebp - 0x64], 0
mov edx, dword [ebp - 0x58]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0x58], 0
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x5c]
call fcn.340a7330
mov eax, dword [ebp - 0x44]
mov dword [ebp - 0x68], eax
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x40]
call fcn.340df520
mov eax, dword [ebp - 0x68]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x3407a6db
Capabilities:
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x3413f4a9
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
sub esp, 0x68
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x74], ecx
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x48], 0
mov dword [ebp - 0x4c], 0
lea ecx, [ebp - 0x44]
call fcn.340df380
mov dword [ebp - 4], 0
push 1
lea eax, [ebp - 0x44]
push eax
mov ecx, dword [ebp - 0x74]
call fcn.34078e29
test eax, eax
je 0x3407a7dc
push 0xffffffffffffffff
lea ecx, [ebp - 0x44]
call fcn.340dfcb0
push 0x36e
push 0x34188c78
call fcn.3407bcd0
add esp, 8
mov byte [ebp - 4], 1
push 0
lea ecx, [ebp - 0x44]
call fcn.340dfd00
mov dword [ebp - 0x78], eax
mov ecx, dword [ebp - 0x78]
mov dword [ebp - 0x58], ecx
cmp dword [ebp - 0x58], 0
je 0x3407a785
mov edx, dword [ebp - 0x58]
mov eax, dword [edx + 0x28]
mov dword [ebp - 0x48], eax
mov ecx, dword [ebp - 0x58]
mov edx, dword [ecx + 8]
mov dword [ebp - 0x4c], edx
jmp 0x3407a79f
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x44]
call fcn.340dfce0
mov dword [ebp - 0x54], eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x50], eax
push 0x380
push 0x34188c98
mov eax, dword [ebp - 0x50]
push eax
mov ecx, dword [ebp - 0x54]
push ecx
call fcn.3407bd79
add esp, 0x10
lea ecx, [ebp - 0x44]
call fcn.340dfa80
cmp dword [ebp - 0x48], 0
jbe 0x3407a8af
mov edx, dword [ebp - 0x4c]
and edx, 2
mov dword [ebp - 0x64], edx
mov eax, dword [ebp - 0x64]
push eax
lea ecx, [ebp - 0x60]
push ecx
mov ecx, dword [ebp - 0x74]
call fcn.3407a04d
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x60]
call fcn.340020c0
push eax
push 0
push 4
call dword [sym.imp.KERNEL32.dll_OpenFileMappingW]
mov dword [ebp - 0x5c], eax
cmp dword [ebp - 0x5c], 0
je 0x3407a8a3
mov edx, dword [ebp - 0x48]
push edx
push 0
push 0
push 4
mov eax, dword [ebp - 0x5c]
push eax
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov dword [ebp - 0x68], eax
cmp dword [ebp - 0x68], 0
je 0x3407a892
mov ecx, dword [ebp - 0x48]
push ecx
call fcn.340bd438
add esp, 4
mov dword [ebp - 0x6c], eax
mov edx, dword [ebp - 0x6c]
mov dword [ebp - 0x14], edx
cmp dword [ebp - 0x14], 0
je 0x3407a881
mov eax, dword [ebp - 0x48]
push eax
push 0
mov ecx, dword [ebp - 0x14]
push ecx
call fcn.340bd3e0
add esp, 0xc
mov edx, dword [ebp - 0x48]
push edx
mov eax, dword [ebp - 0x68]
push eax
mov ecx, dword [ebp - 0x14]
push ecx
call fcn.340be130
add esp, 0xc
mov edx, dword [ebp - 0x68]
push edx
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov dword [ebp - 0x68], 0
mov eax, dword [ebp - 0x5c]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0x5c], 0
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x60]
call fcn.340a7330
cmp dword [ebp + 8], 0
je 0x3407a8bd
mov ecx, dword [ebp + 8]
mov edx, dword [ebp - 0x48]
mov dword [ecx], edx
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x70], eax
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x44]
call fcn.340df520
mov eax, dword [ebp - 0x70]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x3407cd8f
Capabilities:
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x3413f6f2
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
sub esp, 0x60
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x6c], ecx
mov dword [ebp - 0x44], 0
mov dword [ebp - 0x48], 0
lea ecx, [ebp - 0x40]
call fcn.340df380
mov dword [ebp - 4], 0
push 1
lea eax, [ebp - 0x40]
push eax
mov ecx, dword [ebp - 0x6c]
call fcn.3407c07c
test eax, eax
je 0x3407ce89
push 0xffffffffffffffff
lea ecx, [ebp - 0x40]
call fcn.340dfcb0
push 0x200
push 0x34189284
call fcn.3407bcd0
add esp, 8
mov byte [ebp - 4], 1
push 0
lea ecx, [ebp - 0x40]
call fcn.340dfd00
mov dword [ebp - 0x70], eax
mov ecx, dword [ebp - 0x70]
mov dword [ebp - 0x54], ecx
cmp dword [ebp - 0x54], 0
je 0x3407ce32
mov edx, dword [ebp - 0x54]
mov eax, dword [edx + 0x14]
mov dword [ebp - 0x44], eax
mov ecx, dword [ebp - 0x54]
mov edx, dword [ecx + 0xc]
mov dword [ebp - 0x48], edx
jmp 0x3407ce4c
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x40]
call fcn.340dfce0
mov dword [ebp - 0x50], eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x4c], eax
push 0x212
push 0x341892ac
mov eax, dword [ebp - 0x4c]
push eax
mov ecx, dword [ebp - 0x50]
push ecx
call fcn.3407bd79
add esp, 0x10
lea ecx, [ebp - 0x40]
call fcn.340dfa80
cmp dword [ebp - 0x44], 0
jbe 0x3407cf53
cmp dword [ebp + 8], 0
je 0x3407cf53
mov edx, dword [ebp + 0xc]
cmp edx, dword [ebp - 0x44]
jb 0x3407cf53
mov eax, dword [ebp - 0x48]
and eax, 2
mov dword [ebp - 0x60], eax
mov ecx, dword [ebp - 0x60]
push ecx
lea edx, [ebp - 0x5c]
push edx
mov ecx, dword [ebp - 0x6c]
call fcn.3407c8e2
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x5c]
call fcn.340020c0
push eax
push 0
push 4
call dword [sym.imp.KERNEL32.dll_OpenFileMappingW]
mov dword [ebp - 0x58], eax
cmp dword [ebp - 0x58], 0
je 0x3407cf47
mov eax, dword [ebp - 0x44]
push eax
push 0
push 0
push 4
mov ecx, dword [ebp - 0x58]
push ecx
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov dword [ebp - 0x64], eax
cmp dword [ebp - 0x64], 0
je 0x3407cf36
mov edx, dword [ebp + 0xc]
push edx
push 0
mov eax, dword [ebp + 8]
push eax
call fcn.340bd3e0
add esp, 0xc
mov ecx, dword [ebp - 0x44]
push ecx
mov edx, dword [ebp - 0x64]
push edx
mov eax, dword [ebp + 8]
push eax
call fcn.340be130
add esp, 0xc
mov ecx, dword [ebp - 0x64]
push ecx
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov dword [ebp - 0x64], 0
mov edx, dword [ebp - 0x58]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0x58], 0
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x5c]
call fcn.340a7330
mov eax, dword [ebp - 0x44]
mov dword [ebp - 0x68], eax
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x40]
call fcn.340df520
mov eax, dword [ebp - 0x68]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8