joyce8/EMBER2024-capa huggingface dataset:
Function at 0x404100
Capabilities:
Write file on windows

Disassembly:
push ebp
mov eax, dword [esp + 8]
mov ebp, esp
sub esp, 0x410
cmp eax, dword [0x406390]
push ebx
push esi
push edi
jb 0x404136
mov dword [0x40609c], 9
mov dword [0x4060a0], 0
mov eax, 0xffffffff
jmp 0x404292
xor esi, esi
mov dword [ebp - 8], esi
cmp dword [ebp + 0x10], esi
jne 0x404147
xor eax, eax
jmp 0x404292
mov eax, dword [ebp + 8]
test byte [eax + 0x406398], 0x20
je 0x404160
push 2
push 0
push eax
call fcn.004038b5
add esp, 0xc
mov eax, dword [ebp + 8]
test byte [eax + 0x406398], 0x80
je 0x4041ea
mov dword [ebp - 0xc], 0
mov edi, dword [ebp + 0xc]
mov eax, edi
sub eax, dword [ebp + 0xc]
cmp eax, dword [ebp + 0x10]
jae 0x404222
lea ebx, [ebp - 0x410]
mov eax, edi
sub eax, dword [ebp + 0xc]
cmp eax, dword [ebp + 0x10]
jae 0x4041b4
mov al, byte [edi]
inc edi
cmp al, 0xa
jne 0x4041a0
inc esi
mov byte [ebx], 0xd
inc ebx
lea ecx, [ebp - 0x410]
mov byte [ebx], al
inc ebx
mov eax, ebx
sub eax, ecx
cmp eax, 0x400
jl 0x40418a
lea eax, [ebp - 0x410]
push 0
sub ebx, eax
lea ecx, [ebp - 0x410]
lea eax, [ebp - 4]
push eax
push ebx
push ecx
mov eax, dword [ebp + 8]
push dword [eax*4 + 0x4063d8]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x404219
mov eax, dword [ebp - 4]
add dword [ebp - 8], eax
cmp eax, ebx
jge 0x404176
jmp 0x404222
push 0
lea eax, [ebp - 4]
push eax
mov eax, dword [ebp + 8]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [eax*4 + 0x4063d8]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x404219
mov dword [ebp - 0xc], 0
mov eax, dword [ebp - 4]
mov dword [ebp - 8], eax
jmp 0x404222
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 8], 0
jne 0x40428d
cmp dword [ebp - 0xc], 0
je 0x40425a
cmp dword [ebp - 0xc], 5
jne 0x404248
mov dword [0x40609c], 9
mov eax, dword [ebp - 0xc]
mov dword [0x4060a0], eax
jmp 0x404253
push dword [ebp - 0xc]
call fcn.00403f05
add esp, 4
mov eax, 0xffffffff
jmp 0x404292
mov eax, dword [ebp + 8]
test byte [eax + 0x406398], 0x40
je 0x404272
mov eax, dword [ebp + 0xc]
cmp byte [eax], 0x1a
jne 0x404272
xor eax, eax
jmp 0x404292
mov dword [0x40609c], 0x1c
mov dword [0x4060a0], 0
mov eax, 0xffffffff
jmp 0x404292
mov eax, dword [ebp - 8]
sub eax, esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4042ca
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
push edi
mov esi, dword [ebp + 8]
cmp esi, dword [0x406390]
jb 0x4042fc
mov dword [0x40609c], 9
mov dword [0x4060a0], 0
mov eax, 0xffffffff
jmp 0x4044bd
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp + 0x10]
mov dword [ebp - 8], 0
test edx, edx
je 0x4044bb
mov al, byte [esi + 0x406398]
test al, 2
jne 0x4044bb
test al, 0x48
je 0x40433f
mov al, byte [esi + str._n_n_n_n_n_n_n_n_n_n_n_n_n_n_n_n_n_n_n_n_n_n_n_n_n_n_n_n_n_n_n_n_n_n_n_n_n_n_n_n_n_n_n_n_n_n_n_n_n_n_n_n_n_n_n_n_n_n_n_n_n_n_n_n_e_]
cmp al, 0xa
je 0x40433f
dec edx
mov byte [ecx], al
mov dword [ebp - 8], 1
mov byte [esi + str._n_n_n_n_n_n_n_n_n_n_n_n_n_n_n_n_n_n_n_n_n_n_n_n_n_n_n_n_n_n_n_n_n_n_n_n_n_n_n_n_n_n_n_n_n_n_n_n_n_n_n_n_n_n_n_n_n_n_n_n_n_n_n_n_e_], 0xa
inc ecx
push 0
lea eax, [ebp - 0x10]
push eax
push edx
push ecx
push dword [esi*4 + 0x4063d8]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x404398
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 5
jne 0x40437c
mov dword [0x40609c], 9
mov dword [0x4060a0], eax
mov eax, 0xffffffff
jmp 0x4044bd
cmp eax, 0x6d
je 0x4044bb
push eax
call fcn.00403f05
add esp, 4
mov eax, 0xffffffff
jmp 0x4044bd
mov eax, dword [ebp - 0x10]
add dword [ebp - 8], eax
mov al, byte [esi + 0x406398]
test al, 0x80
je 0x4044b6
mov ecx, dword [ebp + 0xc]
cmp byte [ecx], 0xa
jne 0x4043b8
or al, 4
jmp 0x4043ba
and al, 0xfb
mov ebx, dword [ebp + 0xc]
mov byte [esi + 0x406398], al
mov edi, ebx
mov eax, dword [ebp - 8]
add eax, ebx
mov dword [ebp - 0xc], eax
cmp ebx, eax
jae 0x4044b0
mov al, byte [edi]
cmp al, 0x1a
je 0x40449e
cmp al, 0xd
je 0x4043eb
inc edi
mov byte [ebx], al
jmp 0x404492
mov ecx, dword [ebp - 0xc]
dec ecx
cmp ecx, edi
jbe 0x40440f
lea ecx, [edi + 1]
cmp byte [ecx], 0xa
jne 0x404406
add edi, 2
mov byte [ebx], 0xa
jmp 0x404492
mov edi, ecx
mov byte [ebx], al
jmp 0x404492
inc edi
push 0
lea eax, [ebp - 0x10]
lea ecx, [ebp - 1]
mov dword [ebp - 8], 0
push eax
push 1
push ecx
push dword [esi*4 + 0x4063d8]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x40443d
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x40448f
cmp dword [ebp - 0x10], 0
je 0x40448f
test byte [esi + 0x406398], 0x48
je 0x40446c
cmp byte [ebp - 1], 0xa
jne 0x40445d
mov byte [ebx], 0xa
jmp 0x404492
mov byte [ebx], 0xd
inc ebx
mov al, byte [ebp - 1]
mov byte [esi + str._n_n_n_n_n_n_n_n_n_n_n_n_n_n_n_n_n_n_n_n_n_n_n_n_n_n_n_n_n_n_n_n_n_n_n_n_n_n_n_n_n_n_n_n_n_n_n_n_n_n_n_n_n_n_n_n_n_n_n_n_n_n_n_n_e_], al
jmp 0x404493
cmp dword [ebp + 0xc], ebx
jne 0x40447c
cmp byte [ebp - 1], 0xa
jne 0x40447c
mov byte [ebx], 0xa
jmp 0x404492
push 1
push 0xffffffffffffffff
push esi
call fcn.004038b5
add esp, 0xc
cmp byte [ebp - 1], 0xa
je 0x404493
mov byte [ebx], 0xd
inc ebx
cmp edi, dword [ebp - 0xc]
jb 0x4043d5
jmp 0x4044b0
mov al, byte [esi + 0x406398]
test al, 0x40
jne 0x4044b0
or al, 2
mov byte [esi + 0x406398], al
sub ebx, dword [ebp + 0xc]
mov dword [ebp - 8], ebx
mov eax, dword [ebp - 8]
jmp 0x4044bd
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x404c88
Capabilities:
Clear file content

Disassembly:
push ebp
mov eax, 0x1008
mov ebp, esp
call fcn.00404ea0
push ebx
push esi
push edi
mov esi, dword [ebp + 8]
mov dword [ebp - 4], 0
cmp dword [0x406390], esi
ja 0x404cb9
mov dword [0x40609c], 9
jmp 0x404db0
push 1
push 0
push esi
call fcn.004038b5
add esp, 0xc
mov dword [ebp - 8], eax
cmp eax, 0xffffffff
je 0x404db0
push 2
push 0
push esi
call fcn.004038b5
add esp, 0xc
cmp eax, 0xffffffff
je 0x404db0
mov ecx, dword [ebp + 0xc]
mov ebx, ecx
sub ebx, eax
test ebx, ebx
jle 0x404d5d
lea edi, [ebp - 0x1008]
xor eax, eax
mov ecx, 0x400
push 0x8000
rep stosd dword es:[edi], eax
push esi
call fcn.00404e26
add esp, 8
mov edi, eax
mov eax, 0x1000
cmp ebx, eax
jge 0x404d1d
mov eax, ebx
push eax
lea ecx, [ebp - 0x1008]
push ecx
push esi
call fcn.00404100
add esp, 0xc
cmp eax, 0xffffffff
je 0x404d3b
sub ebx, eax
test ebx, ebx
jg 0x404d12
jmp 0x404d51
cmp dword [0x4060a0], 5
jne 0x404d4e
mov dword [0x40609c], 0xd
mov dword [ebp - 4], eax
push edi
push esi
call fcn.00404e26
add esp, 8
jmp 0x404d9d
jge 0x404d9d
push 0
push ecx
push esi
call fcn.004038b5
add esp, 0xc
push esi
call fcn.0040407b
add esp, 4
push eax
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
cmp eax, 1
sbb ecx, ecx
mov dword [ebp - 4], ecx
cmp ecx, 0xffffffff
jne 0x404d9d
mov dword [0x40609c], 0xd
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [0x4060a0], eax
push 0
push dword [ebp - 8]
push esi
call fcn.004038b5
add esp, 0xc
mov eax, dword [ebp - 4]
jmp 0x404db5
mov eax, 0xffffffff
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x433002
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
call 0x43300c
nop
nop
nop
pop eax
nop
nop
add eax, 0x40a063
nop
nop
sub eax, 0x40a009
nop
nop
nop
nop
mov ebx, dword [eax]
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
nop
xor dword [ebx], edx
nop
nop
add ebx, 4
nop
nop
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
jl 0x433030
nop
nop
nop
add eax, 0xc
nop
nop
nop
cmp dword [eax], 0
nop
nop
nop
jne 0x43301e
nop
nop
popal
nop
nop
nop
nop
jmp 0x431219
Function at 0x40333c
Capabilities:
Accept command line arguments
Parse pe header

Disassembly:
push 0x14
push 0x410aa0
call fcn.00406024
mov eax, 0x5a4d
cmp word [0x400000], ax
jne 0x40323d
mov eax, dword [0x40003c]
cmp dword [eax + 0x400000], 0x4550
jne 0x40323d
mov ecx, 0x10b
cmp word [eax + 0x400018], cx
jne 0x40323d
cmp dword [eax + 0x400074], 0xe
jbe 0x40323d
xor ecx, ecx
cmp dword [eax + 0x4000e8], ecx
setne cl
mov dword [ebp - 0x1c], ecx
jmp 0x403241
and dword [ebp - 0x1c], 0
push 1
call main
pop ecx
test eax, eax
jne 0x403255
push 0x1c
call main
pop ecx
call fcn.00407199
test eax, eax
jne 0x403266
push 0x10
call main
pop ecx
call fcn.00406d3d
and dword [ebp - 4], 0
call fcn.00403bed
test eax, eax
jge 0x403280
push 0x1b
call main
pop ecx
call sub.kernel32.dll_GetCommandLineW
mov dword [0x413d00], eax
call fcn.00406ce0
mov dword [0x412ff8], eax
call main
test eax, eax
jge 0x4032a5
push 8
call main
pop ecx
call fcn.00406a03
test eax, eax
jge 0x4032b6
push 9
call main
pop ecx
push 1
call main
pop ecx
test eax, eax
je 0x4032c9
push eax
call main
pop ecx
mov eax, dword [0x413340]
mov dword [0x413344], eax
push eax
push dword [0x413334]
push dword [0x41332c]
call main
add esp, 0xc
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x1c], 0
jne 0x4032f7
push eax
call main
call fcn.0040428b
jmp 0x40332c
mov dword [ebp - 4], 0xfffffffe
mov eax, dword [ebp - 0x20]
call fcn.00406069
ret
call main
jmp 0x4031eb

Function at 0x40d240
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40
pushal
call 0x40d24f
pop dword [ebp - 0x30]
mov eax, 0xddf13e25
sub eax, 0xddb06bd6
sub dword [ebp - 0x30], eax
push 0x40
push 0x1000
push 0x39852
push 0
mov eax, 0x94d76921
add eax, 0x6b6977ff
add eax, dword [ebp - 0x30]
call dword [eax]
mov ecx, 0x2bf2baa6
sub ecx, 0x2bf271e8
mov edi, eax
mov ebx, 0x417800
add ebx, dword [ebp - 0x30]
mov esi, 0xf00c19db
sub esi, 0x202b2c6f
mov edx, dword [ebx]
xor dword [ebp - 0x10], edx
add edx, esi
mov dword [ebp - 0x2c], 0x7334e24
mov dword [edi], edx
mov dword [ebp - 0x24], 0x1fd2bed4
add edi, 4
add ebx, 4
loop 0x40d2a8
add eax, 0xb5be1b12
sub eax, 0xb5bd0547
mov ebx, eax
add eax, 0x4134ed20
sub eax, 0x4134ed1b
mov ecx, 0x400000
add ecx, dword [ebp - 0x30]
call ebx
leave
ret
Function at 0x100019a6
Capabilities:
Print debug messages

Disassembly:
push 4
mov eax, 0x100276db
call fcn.10026576
mov esi, ecx
mov dword [ebp - 0x10], esi
push dword [ebp + 8]
lea edi, [esi + 4]
mov dword [esi], vtable.CMemMappedFile.0
mov ecx, edi
call fcn.1001d8de
mov eax, dword [ebp + 0xc]
xor ecx, ecx
mov dword [esi + 0x1c], ecx
mov dword [esi + 0x20], ecx
mov dword [esi + 0x24], eax
mov dword [esi + 0x28], ecx
mov dword [esi + 0x2c], ecx
mov byte [esi + 0x30], 1
mov dword [ebp - 4], ecx
cmp byte [0x10036ee8], cl
je 0x10001a1a
cmp dword [edi + 0x14], 0x10
jb 0x100019f5
mov edi, dword [edi]
push edi
push str.CMemMappedFile__s__ctor__reference_
mov edi, 0x100368d8
push edi
call dword [sym.imp.MSVCR120.dll_sprintf]
add esp, 0xc
cmp byte [0x10036ee8], 0
je 0x10001a1a
push edi
call dword [sym.imp.kernel32.dll_OutputDebugStringA]
push esi
call fcn.1001d8de
pop ecx
mov eax, esi
call fcn.10026544
ret 8

Function at 0x10001a2b
Capabilities:
Print debug messages

Disassembly:
push 4
mov eax, 0x100276db
call fcn.10026576
mov esi, ecx
mov dword [ebp - 0x10], esi
lea edi, [esi + 4]
mov dword [esi], vtable.CMemMappedFile.0
push edi
call fcn.100021f9
pop ecx
mov eax, dword [ebp + 8]
xor ecx, ecx
mov dword [esi + 0x1c], ecx
mov dword [esi + 0x20], ecx
mov dword [esi + 0x24], eax
mov dword [esi + 0x28], ecx
mov dword [esi + 0x2c], ecx
mov byte [esi + 0x30], cl
mov dword [ebp - 4], ecx
cmp byte [0x10036ee8], cl
je 0x10001a9c
cmp dword [edi + 0x14], 0x10
jb 0x10001a76
mov edi, dword [edi]
push eax
push edi
push str.CMemMappedFile__s__ctor__new_with_size_lu_
mov edi, 0x100368d8
push edi
call dword [sym.imp.MSVCR120.dll_sprintf]
add esp, 0x10
cmp byte [0x10036ee8], 0
je 0x10001a9c
push edi
call dword [sym.imp.kernel32.dll_OutputDebugStringA]
mov ecx, esi
call fcn.10002e0d
mov eax, esi
call fcn.10026544
ret 4

Function at 0x10001aad
Capabilities:
Print debug messages

Disassembly:
push 4
mov eax, 0x100276db
call fcn.10026576
mov esi, ecx
mov dword [ebp - 0x10], esi
lea edi, [esi + 4]
mov dword [esi], vtable.CMemMappedFile.0
push edi
call fcn.100021f9
pop ecx
xor eax, eax
mov dword [esi + 0x1c], eax
mov dword [esi + 0x20], eax
mov dword [esi + 0x24], eax
mov dword [esi + 0x28], eax
mov dword [esi + 0x2c], eax
mov byte [esi + 0x30], al
mov dword [ebp - 4], eax
cmp byte [0x10036ee8], al
je 0x10001b1a
cmp dword [edi + 0x14], 0x10
jb 0x10001af5
mov edi, dword [edi]
push edi
push str.CMemMappedFile__s__ctor__new_
mov edi, 0x100368d8
push edi
call dword [sym.imp.MSVCR120.dll_sprintf]
add esp, 0xc
cmp byte [0x10036ee8], 0
je 0x10001b1a
push edi
call dword [sym.imp.kernel32.dll_OutputDebugStringA]
mov eax, esi
call fcn.10026544
ret
Function at 0x10001c19
Capabilities:
Print debug messages

Disassembly:
push 4
mov eax, 0x100276db
call fcn.10026576
mov esi, ecx
mov dword [ebp - 0x10], esi
mov dword [esi], vtable.CMemMappedFile.0
and dword [ebp - 4], 0
cmp byte [0x10036ee8], 0
je 0x10001c6d
lea eax, [esi + 4]
cmp dword [eax + 0x14], 0x10
jb 0x10001c48
mov eax, dword [eax]
push eax
push str.CMemMappedFile__s__dtor
mov edi, 0x100368d8
push edi
call dword [sym.imp.MSVCR120.dll_sprintf]
add esp, 0xc
cmp byte [0x10036ee8], 0
je 0x10001c6d
push edi
call dword [sym.imp.kernel32.dll_OutputDebugStringA]
mov ecx, esi
call fcn.10004020
cmp dword [esi + 0x20], 0
je 0x10001c83
push dword [esi + 0x20]
call dword [sym.imp.kernel32.dll_CloseHandle]
cmp dword [esi + 0x1c], 0
je 0x10001c92
push dword [esi + 0x1c]
call sub.MSVCR120.dll_void___cdecl_operator_delete_void__
pop ecx
push esi
call fcn.1001d8de
or dword [ebp - 4], 0xffffffff
pop ecx
push 0
push 1
lea ecx, [esi + 4]
call fcn.1001d8de
call fcn.10026544
ret
Function at 0x10001ed1
Capabilities:
Print debug messages

Disassembly:
push 0x20
mov eax, 0x10027712
call fcn.100265a9
cmp byte [0x10036ee8], 0
mov esi, 0x100368d8
mov edi, dword [ebp + 8]
mov ebx, dword [sym.imp.kernel32.dll_OutputDebugStringA]
je 0x10001f1c
cmp dword [edi + 0x14], 8
jb 0x10001efe
mov eax, dword [edi]
jmp 0x10001f00
mov eax, edi
push eax
push str.CMemMappedFile_CreateAndLoadFromFile__file__11S_
push esi
call dword [sym.imp.MSVCR120.dll_sprintf]
add esp, 0xc
cmp byte [0x10036ee8], 0
je 0x10001f1c
push esi
call ebx
xor esi, esi
call fcn.1001d8de
test al, al
jne 0x10001f75
push 0x34
call sub.MSVCR120.dll_void____cdecl_operator_new_unsigned_int_
pop ecx
mov dword [ebp - 0x2c], eax
and dword [ebp - 4], esi
test eax, eax
je 0x10001f44
mov ecx, eax
call fcn.10001aad
mov esi, eax
jmp 0x10001f46
xor esi, esi
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x28]
push edi
call fcn.1001d8de
push eax
mov eax, dword [esi]
xor edi, edi
inc edi
mov ecx, esi
mov dword [ebp - 4], edi
call dword [eax + 0x28]
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x28]
push 0
push edi
call fcn.1001d8de
jmp 0x1000207d
call fcn.100196ae
test al, al
je 0x10002031
push edi
call fcn.1001d8de
mov dword [ebp - 0x2c], eax
pop ecx
test eax, eax
je 0x10002007
cmp byte [0x10036ee8], 0
je 0x10001ff2
cmp dword [edi + 0x14], 8
jb 0x10001fa3
mov eax, dword [edi]
jmp 0x10001fa5
mov eax, edi
mov esi, dword [sym.imp.MSVCR120.dll_sprintf]
push eax
push str.CMemMappedFile::CreateAndLoadFromFile___11S_
push 0x100368d8
call esi
add esp, 0xc
cmp byte [0x10036ee8], 0
je 0x10001ff2
push 0x100368d8
call ebx
cmp byte [0x10036ee8], 0
je 0x10001ff2
push str.CMemMappedFile___remote_creation
push 0x100368d8
call esi
cmp byte [0x10036ee8], 0
pop ecx
pop ecx
je 0x10001ff2
push 0x100368d8
call ebx
push dword [ebp - 0x2c]
call fcn.100194d2
mov esi, eax
pop ecx
push edi
mov ecx, esi
mov edx, dword [esi]
call dword [edx + 0x28]
jmp 0x1000207d
cmp byte [0x10036ee8], 0
je 0x1000207d
push str.CMemMappedFile__ERROR_diskFileSize__0_
mov edi, 0x100368d8
push edi
call dword [sym.imp.MSVCR120.dll_sprintf]
cmp byte [0x10036ee8], 0
pop ecx
pop ecx
je 0x1000207d
push edi
call ebx
jmp 0x1000207d
cmp byte [0x10036ee8], 0
je 0x10002059
push str.CMemMappedFile___creation_deferred
mov esi, 0x100368d8
push esi
call dword [sym.imp.MSVCR120.dll_sprintf]
cmp byte [0x10036ee8], 0
pop ecx
pop ecx
je 0x10002059
push esi
call ebx
push 0x34
call sub.MSVCR120.dll_void____cdecl_operator_new_unsigned_int_
pop ecx
mov dword [ebp - 0x2c], eax
mov dword [ebp - 4], 2
test eax, eax
je 0x1000207b
push edi
mov ecx, eax
call fcn.10001992
mov esi, eax
jmp 0x1000207d
xor esi, esi
mov eax, esi
call fcn.10026558
ret
Function at 0x10002085
Capabilities:
Print debug messages

Disassembly:
push 4
mov eax, 0x10027b41
call fcn.10026576
cmp byte [0x10036ee8], 0
mov edi, dword [sym.imp.kernel32.dll_OutputDebugStringA]
mov esi, dword [ebp + 8]
mov ebx, dword [sym.imp.MSVCR120.dll_sprintf]
je 0x100020c9
push esi
push str.CMemMappedFile_CreateWithSize__size_lu_
push 0x100368d8
call ebx
add esp, 0xc
cmp byte [0x10036ee8], 0
je 0x100020c9
push 0x100368d8
call edi
call fcn.1001d8de
test al, al
je 0x1000210d
call fcn.100196ae
test al, al
je 0x1000210d
cmp byte [0x10036ee8], 0
je 0x10002104
push esi
push str.CMemMappedFile::CreateWithSize__lu___REMOTE_CREATION_
push 0x100368d8
call ebx
add esp, 0xc
cmp byte [0x10036ee8], 0
je 0x10002104
push 0x100368d8
call edi
push esi
call fcn.100194d2
pop ecx
jmp 0x10002152
cmp byte [0x10036ee8], 0
je 0x10002136
push esi
push str.CMemMappedFile::CreateWithSize__lu___LOCAL_CREATION_
push 0x100368d8
call ebx
add esp, 0xc
cmp byte [0x10036ee8], 0
je 0x10002136
push 0x100368d8
call edi
push 0x34
call sub.MSVCR120.dll_void____cdecl_operator_new_unsigned_int_
pop ecx
mov ecx, eax
mov dword [ebp - 0x10], ecx
xor eax, eax
mov dword [ebp - 4], eax
test ecx, ecx
je 0x10002152
push esi
call fcn.10001a2b
call fcn.10026544
ret

Function at 0x1000229e
Capabilities:
Print debug messages

Disassembly:
push 0x28
mov eax, 0x10027783
call fcn.100265a9
mov ecx, dword [ebp + 0xc]
xor ebx, ebx
mov esi, dword [ebp + 8]
mov dword [ebp - 0x30], ebx
mov dword [ebp - 0x2c], ecx
cmp byte [0x10036ee8], bl
je 0x100022f1
cmp dword [esi + 0x14], 0x10
jb 0x100022ca
mov eax, dword [esi]
jmp 0x100022cc
mov eax, esi
push ecx
push eax
push str.CMemMappedFile_GetExistingMemoryMappedFile__name_s__size_lu_
mov edi, 0x100368d8
push edi
call dword [sym.imp.MSVCR120.dll_sprintf]
add esp, 0x10
cmp byte [0x10036ee8], bl
je 0x100022f1
push edi
call dword [sym.imp.kernel32.dll_OutputDebugStringA]
push esi
call fcn.1001d8de
mov edi, eax
pop ecx
test edi, edi
jne 0x1000234c
push 0x34
call sub.MSVCR120.dll_void____cdecl_operator_new_unsigned_int_
mov edi, eax
pop ecx
mov dword [ebp - 0x34], edi
and dword [ebp - 4], 0
test edi, edi
je 0x10002335
push esi
lea ecx, [ebp - 0x28]
call fcn.1001d8de
push dword [ebp - 0x2c]
xor ebx, ebx
mov byte [ebp - 4], 1
inc ebx
mov ecx, edi
push eax
mov dword [ebp - 0x30], ebx
call fcn.100019a6
mov edi, eax
jmp 0x10002337
xor edi, edi
or dword [ebp - 4], 0xffffffff
test bl, 1
je 0x1000234c
push 0
push 1
lea ecx, [ebp - 0x28]
call fcn.1001d8de
mov eax, edi
call fcn.10026558
ret
Function at 0x10002e0d
Capabilities:
Print debug messages

Disassembly:
mov al, byte [0x10036ee8]
push ebx
mov ebx, dword [sym.imp.MSVCR120.dll_sprintf]
push esi
mov esi, ecx
push edi
mov edi, dword [sym.imp.kernel32.dll_OutputDebugStringA]
test al, al
je 0x10002e57
lea eax, [esi + 4]
cmp dword [eax + 0x14], 0x10
jb 0x10002e32
mov eax, dword [eax]
push eax
push str.CMemMappedFile__s__createMemoryMappedFile
push 0x100368d8
call ebx
mov al, byte [0x10036ee8]
add esp, 0xc
test al, al
je 0x10002e57
push 0x100368d8
call edi
mov al, byte [0x10036ee8]
mov ecx, dword [esi + 0x24]
test ecx, ecx
je 0x10002ee8
mov ecx, esi
call fcn.1001d8de
mov dword [esi + 0x20], eax
test eax, eax
je 0x10002eb0
cmp byte [0x10036ee8], 0
je 0x10002ea7
lea eax, [esi + 4]
cmp dword [eax + 0x14], 0x10
jb 0x10002e84
mov eax, dword [eax]
push dword [esi + 0x24]
push eax
push str.CMemMappedFile__s__created_file_of_size___lu
push 0x100368d8
call ebx
add esp, 0x10
cmp byte [0x10036ee8], 0
je 0x10002ea7
push 0x100368d8
call edi
push esi
call fcn.1001d8de
pop ecx
jmp 0x10002f18
cmp byte [0x10036ee8], 0
je 0x10002f18
add esi, 4
cmp dword [esi + 0x14], 0x10
jb 0x10002ec4
mov esi, dword [esi]
call dword [sym.imp.kernel32.dll_GetLastError]
push eax
push esi
push str.CMemMappedFile__s__ERROR_CREATING__err_u_
mov esi, 0x100368d8
push esi
call ebx
add esp, 0x10
cmp byte [0x10036ee8], 0
je 0x10002f18
push esi
jmp 0x10002f16
test al, al
je 0x10002f18
add esi, 4
cmp dword [esi + 0x14], 0x10
jb 0x10002ef7
mov esi, dword [esi]
push ecx
push esi
push str.CMemMappedFile__s__ERROR_CREATING__SIZE__0_
push 0x100368d8
call ebx
add esp, 0x10
cmp byte [0x10036ee8], 0
je 0x10002f18
push 0x100368d8
call edi
pop edi
pop esi
pop ebx
ret

Function at 0x100034a7
Capabilities:
Print debug messages

Disassembly:
cmp byte [0x10036ee8], 0
push esi
mov esi, ecx
je 0x100034e8
lea eax, [esi + 4]
cmp dword [eax + 0x14], 0x10
jb 0x100034be
mov eax, dword [eax]
push edi
push dword [esi + 0x24]
mov edi, 0x100368d8
push eax
push str.CMemMappedFile__s__size___lu
push edi
call dword [sym.imp.MSVCR120.dll_sprintf]
add esp, 0x10
cmp byte [0x10036ee8], 0
je 0x100034e7
push edi
call dword [sym.imp.kernel32.dll_OutputDebugStringA]
pop edi
mov eax, dword [esi + 0x24]
pop esi
ret

Function at 0x100034f0
Capabilities:
Print debug messages

Disassembly:
cmp byte [0x10036ee8], 0
push esi
mov esi, ecx
je 0x10003540
lea edx, [esi + 4]
cmp dword [edx + 0x14], 0x10
jb 0x10003507
mov edx, dword [edx]
cmp dword [esi + 0x20], 0
mov ecx, str.false
push edi
mov eax, str.true
mov edi, 0x100368d8
cmove eax, ecx
push eax
push edx
push str.CMemMappedFile__s__isValid___s
push edi
call dword [sym.imp.MSVCR120.dll_sprintf]
add esp, 0x10
cmp byte [0x10036ee8], 0
je 0x1000353f
push edi
call dword [sym.imp.kernel32.dll_OutputDebugStringA]
pop edi
xor eax, eax
cmp dword [esi + 0x20], eax
pop esi
setne al
ret
Function at 0x10004087
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
cmp byte [0x10036ee8], 0
push ebx
mov ebx, dword [ebp + 0xc]
push esi
push edi
mov edi, dword [ebp + 0x10]
mov esi, ecx
je 0x100040d3
lea eax, [esi + 4]
cmp dword [eax + 0x14], 0x10
jb 0x100040a9
mov eax, dword [eax]
push edi
push ebx
push eax
push str.CMemMappedFile__s__writeBytes_offset_u__length_u_
push 0x100368d8
call dword [sym.imp.MSVCR120.dll_sprintf]
add esp, 0x14
cmp byte [0x10036ee8], 0
je 0x100040d3
push 0x100368d8
call dword [sym.imp.kernel32.dll_OutputDebugStringA]
mov edx, dword [esi]
lea eax, [ebx + edi]
push eax
mov ecx, esi
call dword [edx + 0xc]
test eax, eax
je 0x100040fc
push edi
push dword [ebp + 8]
add eax, ebx
push eax
call sub.MSVCR120.dll_memcpy
mov eax, dword [esi]
add esp, 0xc
mov ecx, esi
call dword [eax + 0x10]
mov al, 1
jmp 0x10004139
cmp byte [0x10036ee8], 0
je 0x10004137
lea eax, [esi + 4]
cmp dword [eax + 0x14], 0x10
jb 0x10004110
mov eax, dword [eax]
push edi
push ebx
push eax
push str.CMemMappedFile__s__ERROR_WRITING__NO_MEMORY_MAPPED_FILE_
mov ebx, 0x100368d8
push ebx
call dword [sym.imp.MSVCR120.dll_sprintf]
add esp, 0x14
cmp byte [0x10036ee8], 0
je 0x10004137
push ebx
call dword [sym.imp.kernel32.dll_OutputDebugStringA]
xor al, al
pop edi
pop esi
pop ebx
pop ebp
ret 0xc

Function at 0x10004910
Capabilities:
Hide graphical window

Disassembly:
push 0x10
mov eax, 0x1002785d
call fcn.10026576
mov eax, ecx
mov dword [ebp - 0x10], eax
add eax, 0x30
mov edi, eax
mov dword [ebp - 0x14], eax
push edi
mov dword [ebp - 0x1c], edi
call dword [sym.imp.kernel32.dll_TryEnterCriticalSection]
neg eax
sbb esi, esi
neg esi
mov dword [ebp - 0x18], esi
and dword [ebp - 4], 0
lea eax, [ebp - 0x1c]
push eax
call fcn.1001d8de
mov ebx, dword [sym.imp.kernel32.dll_LeaveCriticalSection]
jmp 0x1000497f
or dword [ebp - 4], 0xffffffff
test esi, esi
je 0x1000495c
push edi
call ebx
mov edi, dword [ebp - 0x14]
push edi
mov dword [ebp - 0x1c], edi
call dword [sym.imp.kernel32.dll_TryEnterCriticalSection]
neg eax
sbb esi, esi
neg esi
mov dword [ebp - 0x18], esi
and dword [ebp - 4], 0
lea eax, [ebp - 0x1c]
push eax
call fcn.1001d8de
pop ecx
test eax, eax
je 0x10004951
mov edx, dword [ebp - 0x10]
xor ecx, ecx
cmp dword [ebp + 8], ecx
sete cl
mov eax, dword [edx + 0x24]
inc ecx
mov dword [eax + 0x18], ecx
mov eax, dword [edx + 0x2c]
push eax
mov dword [ebp - 0x14], eax
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x100049c9
mov eax, dword [ebp + 8]
neg eax
sbb eax, eax
and eax, 5
push eax
push dword [ebp - 0x14]
call dword [sym.imp.USER32.dll_ShowWindow]
cmp dword [ebp + 8], 0
jne 0x100049c9
mov ecx, dword [ebp - 0x10]
call fcn.10004cd1
or dword [ebp - 4], 0xffffffff
test esi, esi
je 0x100049d4
push edi
call ebx
call fcn.10026544
ret 4