joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10010feb
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push 0x50
mov eax, 0x1003f493
call fcn.10027266
mov ebx, ecx
mov esi, dword [ebp + 8]
xor eax, eax
lea edx, [ebp - 0x4c]
push eax
mov dword [ebp - 4], eax
push eax
sub esp, 0xc
mov dword [ebp - 0x4c], 0x396f534b
mov ecx, esp
mov dword [ebp - 0x48], 0x6838484f
lea eax, [ebp - 0x21]
mov dword [ebp - 0x44], 0x354a5141
mov dword [ebp - 0x40], 0x5330525a
push ecx
push eax
push edx
mov dword [ebp - 0x3c], 0x554d7a44
mov dword [ebp - 0x38], 0x57554341
mov dword [ebp - 0x34], 0x7164684b
mov dword [ebp - 0x30], 0x77517946
mov dword [ebp - 0x2c], 0x3930524d
mov dword [ebp - 0x28], 0x4141774b
mov word [ebp - 0x24], 0x4241
mov byte [ebp - 0x22], 0x67
call fcn.1001299b
lea ecx, [ebp - 0x5c]
call fcn.1000eb8b
add esp, 0xc
mov ecx, eax
mov byte [ebp - 4], 1
call fcn.10012b0d
push eax
lea ecx, [ebp + 0xc]
call fcn.100126cd
cmp eax, 0xffffffff
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x5c]
setne byte [ebp - 0x1d]
call fcn.10012a79
xor eax, eax
lea edi, [ebp - 0x1c]
stosd dword es:[edi], eax
lea ecx, [ebp - 0x1c]
push ecx
mov ecx, esi
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov eax, dword [esi]
call dword [eax + 4]
mov byte [ebp - 4], 2
mov ecx, dword [ebp - 0x18]
mov esi, dword [ebp - 0x1c]
sub ecx, esi
jne 0x100110c3
push str.invalid_vector_T__subscript
call fcn.10026771
xor eax, eax
cmp byte [ebp - 0x1d], al
push 0x18
pop edx
push ecx
cmovne eax, edx
add eax, ebx
push esi
push eax
call fcn.1001d150
add esp, 0xc
test esi, esi
je 0x100110f1
push esi
call fcn.10016ad3
xor eax, eax
pop ecx
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], eax
mov ecx, dword [ebp + 0xc]
add ecx, 0xfffffff0
call fcn.1000e534
mov al, 1
call fcn.10027215
ret
Function at 0x10012030
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push 0xb74
mov eax, 0x1003f678
call fcn.100272d2
mov ebx, dword [ebp + 0x10]
lea edi, [ebp - 0xb1b]
push 9
pop ecx
xor eax, eax
mov byte [ebp - 0xb1c], 0
push 0xadc
push eax
rep stosd dword es:[edi], eax
lea eax, [ebp - 0xaf7]
push eax
call fcn.1001f3f0
add esp, 0xc
xor edi, edi
mov dword [ebp - 0x18], edi
call fcn.1000e550
push eax
lea ecx, [ebp - 0x18]
call fcn.10012e5e
mov dword [ebp - 4], edi
mov byte [ebp - 4], 1
test ebx, ebx
je 0x10012254
cmp dword [ebx + 8], 0x4a
jne 0x10012254
mov esi, dword [ebx]
test esi, esi
je 0x10012254
mov eax, dword [esi]
cmp eax, 0x4cc7c
jne 0x10012246
mov esi, dword [esi + 8]
lea edi, [ebp - 0xb1c]
mov ecx, 0x2c0
mov dword [ebp - 0xb6c], 0x6e4d694a
rep movsd dword es:[edi], dword [esi]
lea eax, [ebp - 0x9f3]
mov dword [ebp - 0xb68], 0x386b4743
push eax
lea eax, [ebp - 0xb1c]
mov dword [ebp - 0xb64], 0x2f514745
push eax
lea eax, [ebp - 0xaf7]
movsb byte es:[edi], byte [esi]
push eax
push 0
sub esp, 0xc
mov dword [ebp - 0xb60], 0x6d633243
mov ecx, esp
mov dword [ebp - 0xb5c], 0x4134684c
lea eax, [ebp - 0xb1c]
mov dword [ebp - 0xb58], 0x39554266
lea edx, [ebp - 0xb6c]
mov dword [ebp - 0xb54], 0x43634241
push ecx
push eax
push edx
mov dword [ebp - 0xb50], 0x6e4a6744
mov dword [ebp - 0xb4c], 0x7746434e
mov dword [ebp - 0xb48], 0x3659514c
mov dword [ebp - 0xb44], 0x35515449
mov dword [ebp - 0xb40], 0x73737a45
mov dword [ebp - 0xb3c], 0x304e3347
mov dword [ebp - 0xb38], 0x4538794d
mov dword [ebp - 0xb34], 0x3251694e
mov dword [ebp - 0xb30], 0x704e5243
mov dword [ebp - 0xb2c], 0x326b6e50
mov dword [ebp - 0xb28], 0x6b6f334f
mov dword [ebp - 0xb24], 0x41306a48
mov dword [ebp - 0xb20], 0x73414141
call fcn.1001299b
lea ecx, [ebp - 0xb80]
call fcn.1000ea1a
add esp, 0xc
mov ecx, eax
mov byte [ebp - 4], 2
call fcn.10012a95
push eax
lea eax, [ebp - 0x18]
push eax
call fcn.1001440e
add esp, 0x14
mov byte [ebp - 4], 1
lea ecx, [ebp - 0xb80]
call fcn.10012a79
push ecx
mov edi, esp
mov dword [ebp - 0xb74], esp
mov dword [ebp - 0xb70], edi
call fcn.1000e550
push eax
mov ecx, edi
call fcn.10012e5e
mov byte [ebp - 4], 3
mov ecx, edi
mov esi, dword [ebp - 0x18]
push esi
call fcn.10012ff0
test al, al
jne 0x10012223
push esi
mov ecx, edi
call fcn.10012f1a
push ecx
lea eax, [ebp - 0x7eb]
mov byte [ebp - 4], 4
mov ecx, esp
push eax
call fcn.100122de
mov byte [ebp - 4], 1
call fcn.10011acf
pop ecx
pop ecx
lea ecx, [esi - 0x10]
jmp 0x10012268
cmp eax, 0x4d835
jne 0x10012254
xor ecx, ecx
call fcn.10011eda
push ebx
push dword [ebp + 0xc]
push dword [ebp + 8]
push edi
call dword [sym.imp.USER32.dll_CallNextHookEx]
mov ecx, dword [ebp - 0x18]
lea ecx, [ecx - 0x10]
call fcn.1000e534
call fcn.10027224
ret 0xc
Function at 0x10013dab
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
mov ebx, dword [eax]
mov edi, ecx
mov edx, ebx
xor esi, esi
lea ecx, [edx + 2]
mov ax, word [edx]
add edx, 2
cmp ax, si
jne 0x10013dbf
sub edx, ecx
mov ecx, 0x811c9dc5
sar edx, 1
add edx, edx
je 0x10013de8
movzx eax, byte [esi + ebx]
xor eax, ecx
imul ecx, eax, 0x1000193
inc esi
cmp esi, edx
jb 0x10013dd7
mov esi, 0x7fffffff
and ecx, esi
push 0x1f31d
push ecx
call fcn.100178d1
pop ecx
pop ecx
imul ecx, edx, 0x41a7
imul eax, eax, 0xb14
sub ecx, eax
jns 0x10013e0e
add ecx, esi
mov edx, dword [edi + 0x14]
mov eax, edx
and eax, ecx
cmp dword [edi + 0x18], eax
pop edi
pop esi
pop ebx
ja 0x10013e26
shr edx, 1
or ecx, 0xffffffff
sub ecx, edx
add eax, ecx
pop ebp
ret 4

Function at 0x10014e91
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4c
mov eax, dword [0x100512e0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
push ebx
xor ebx, ebx
mov dword [ebp - 0x48], eax
cmp dword [0x1007b070], 0x40
jae 0x10014f87
push esi
lea esi, [edx + ecx]
add ecx, dword [ebp + 0x10]
push edi
cmp ecx, 0x80000000
lea edi, [ebp - 0x40]
push 8
lea eax, [ecx + 0x7ff80000]
mov edx, 0xfff80000
cmovb edx, eax
and dword [ebp - 0x44], ebx
pop ecx
xor eax, eax
mov dword [ebp - 0x48], edx
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x44]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
xor eax, eax
lea edi, [esi - 0x7fff0000]
inc eax
cmp esi, 0x80000000
mov esi, dword [ebp - 0x48]
cmovb edi, eax
cmp edi, esi
jae 0x10014f85
push 0x1c
lea eax, [ebp - 0x20]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
je 0x10014f60
cmp dword [ebp - 0x10], 0x10000
jne 0x10014f54
mov eax, dword [ebp - 0x14]
cmp eax, 0x6c
jb 0x10014f57
mov ecx, dword [ebp - 0x28]
cmp eax, ecx
jb 0x10014f57
lea eax, [ecx - 1]
xor edx, edx
add eax, edi
div ecx
push 0x20
imul eax, ecx
push 0x3000
push 0x6c
push eax
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov ebx, eax
test ebx, ebx
jne 0x10014f64
mov eax, dword [ebp - 0x14]
mov edi, dword [ebp - 0x20]
add edi, eax
cmp edi, esi
jb 0x10014f09
test ebx, ebx
je 0x10014f85
xor eax, eax
cmp dword [eax*4 + 0x1007b1b0], 0
je 0x10014f78
inc eax
cmp eax, 0x40
jb 0x10014f66
jmp 0x10014f85
inc dword [0x1007b070]
mov dword [eax*4 + 0x1007b1b0], ebx
pop edi
pop esi
mov ecx, dword [ebp - 4]
mov eax, ebx
xor ecx, ebp
pop ebx
call fcn.10015618
mov esp, ebp
pop ebp
ret
Function at 0x10014fcb
Capabilities:
Resume thread
Suspend thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2d4
mov eax, dword [0x100512e0]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
push ecx
push 0
push 0x1fffff
mov dword [ebp - 0x2d4], edx
call dword [sym.imp.KERNEL32.dll_OpenThread]
mov esi, eax
cmp esi, 0xffffffff
je 0x1001506b
test esi, esi
je 0x1001506b
push esi
call dword [sym.imp.KERNEL32.dll_SuspendThread]
cmp eax, 0xffffffff
je 0x10015062
mov dword [ebp - 0x2d0], 0x10001
xor edi, edi
jmp 0x1001504e
mov eax, dword [ebp - 0x2d4]
cmp dword [ebp - 0x218], eax
jb 0x1001506b
add eax, dword [ebp + 8]
cmp dword [ebp - 0x218], eax
jae 0x1001506b
push esi
call dword [sym.imp.KERNEL32.dll_ResumeThread]
cmp edi, 3
jge 0x10015062
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
push esi
call dword [sym.imp.KERNEL32.dll_SuspendThread]
inc edi
lea eax, [ebp - 0x2d0]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetThreadContext]
test eax, eax
jne 0x10015019
jmp 0x1001506b
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor esi, esi
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
xor ecx, ebp
pop esi
call fcn.10015618
mov esp, ebp
pop ebp
ret

Function at 0x1001507d
Capabilities:
Resume thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetCurrentThread]
call edi
push eax
call dword [sym.imp.KERNEL32.dll_GetThreadPriority]
push 0xf
mov dword [ebp - 4], eax
call edi
push eax
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
xor esi, esi
cmp dword [0x1007b07c], esi
jbe 0x100150cf
mov eax, dword [0x1007b078]
push dword [eax + esi*4]
call dword [sym.imp.KERNEL32.dll_ResumeThread]
mov eax, dword [0x1007b078]
push dword [eax + esi*4]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
inc esi
cmp esi, dword [0x1007b07c]
jb 0x100150aa
push dword [0x1007b078]
call fcn.1001679e
and dword [0x1007b078], 0
and dword [0x1007b07c], 0
pop ecx
push dword [ebp - 4]
call edi
push eax
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x1001532f
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x7c
mov eax, dword [0x100512e0]
xor eax, esp
mov dword [esp + 0x78], eax
push ebx
push esi
mov esi, dword [0x1007b060]
push edi
xor edi, edi
call fcn.10014de4
mov ecx, esi
call fcn.10014e21
mov ebx, eax
mov ecx, 0x10011266
mov dword [esp + 0x18], ebx
call fcn.10014e21
push 0x50
mov dword [esp + 0x14], eax
xorps xmm0, xmm0
lea eax, [esp + 0x2c]
movlpd qword [esp + 0x24], xmm0
push edi
push eax
call fcn.1001f3f0
add esp, 0xc
lea eax, [esp + 0x20]
mov ecx, ebx
push eax
call fcn.1001527b
mov esi, eax
mov dword [esp + 0x20], esi
pop ecx
cmp esi, 5
jb 0x10015510
mov edx, esi
mov ecx, ebx
call fcn.100150fb
push dword [esp + 0x2c]
mov ecx, ebx
push dword [esp + 0x2c]
push dword [esp + 0x2c]
push dword [esp + 0x2c]
call fcn.10014e91
mov edi, eax
add esp, 0x10
test edi, edi
je 0x1001550b
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
and dword [esp + 0x80], 0
lea ecx, [esp + 0x80]
and dword [esp + 0x7c], 0
push ecx
push 0x40
push esi
push ebx
push eax
mov dword [esp + 0x20], eax
call dword [sym.imp.KERNEL32.dll_VirtualProtectEx]
test eax, eax
je 0x100154f0
lea eax, [esp + 0x7c]
push eax
push 0x40
push 0x6c
push edi
push dword [esp + 0x1c]
call dword [sym.imp.KERNEL32.dll_VirtualProtectEx]
test eax, eax
je 0x100154c9
xor ecx, ecx
lea eax, [edi + 0x2c]
test esi, esi
je 0x10015441
mov edx, eax
sub ebx, eax
mov al, byte [ebx + edx]
mov byte [edx], al
mov byte [edi + ecx + 0x4c], al
inc ecx
inc edx
cmp ecx, esi
jb 0x1001542b
mov ebx, dword [esp + 0x18]
lea eax, [edi + 0x2c]
lea edx, [esi + ebx]
lea ecx, [eax + esi]
call fcn.10014e52
mov edx, dword [esp + 0x10]
mov ecx, ebx
sub ecx, edx
mov eax, edx
sub eax, ebx
cmp edx, ebx
cmovb eax, ecx
cmp eax, 0x7fff0000
jbe 0x1001548e
lea esi, [edi + 0xc]
mov ecx, esi
call fcn.10014e52
sub eax, edi
sub eax, 0xc
push eax
push esi
push dword [esp + 0x14]
call dword [sym.imp.KERNEL32.dll_FlushInstructionCache]
mov edx, esi
mov ecx, ebx
call fcn.10014e52
mov esi, dword [esp + 0x1c]
jmp 0x10015495
mov ecx, ebx
call fcn.10014e52
mov eax, dword [esp + 0x10]
mov dword [edi + 8], eax
lea eax, [edi + 0x2c]
push esi
push eax
push dword [esp + 0x14]
mov dword [edi + 4], esi
mov dword [edi], ebx
call dword [sym.imp.KERNEL32.dll_FlushInstructionCache]
lea eax, [esp + 0x7c]
push eax
push dword [esp + 0x80]
push 0x6c
push edi
push dword [esp + 0x1c]
call dword [sym.imp.KERNEL32.dll_VirtualProtectEx]
push esi
push ebx
push dword [esp + 0x14]
call dword [sym.imp.KERNEL32.dll_FlushInstructionCache]
lea eax, [esp + 0x80]
push eax
push dword [esp + 0x84]
push esi
push ebx
push dword [esp + 0x1c]
call dword [sym.imp.KERNEL32.dll_VirtualProtectEx]
cmp dword [edi], 0
je 0x100154ff
lea eax, [edi + 0x2c]
mov dword [0x1007b060], eax
jmp 0x1001550b
xor edx, edx
mov ecx, edi
inc edx
call fcn.10014f98
xor edi, edi
call fcn.1001507d
push 0x1007b2b0
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov ecx, dword [esp + 0x84]
xor eax, eax
test edi, edi
pop edi
pop esi
setne al
pop ebx
xor ecx, esp
call fcn.10015618
mov esp, ebp
pop ebp
ret
Function at 0x10015537
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
mov eax, dword [0x100512e0]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
xor edi, edi
call fcn.10014de4
mov esi, edi
mov eax, dword [esi*4 + 0x1007b1b0]
test eax, eax
je 0x1001556b
add eax, 0x2c
cmp eax, dword [0x1007b060]
je 0x1001560c
inc esi
cmp esi, 0x40
jb 0x10015551
mov esi, edi
test esi, esi
je 0x100155ef
mov edx, dword [esi + 4]
mov ecx, dword [esi]
push ebx
call fcn.100150fb
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov ebx, eax
mov dword [ebp - 8], edi
lea eax, [ebp - 8]
push eax
push 0x40
push dword [esi + 4]
push dword [esi]
push ebx
call dword [sym.imp.KERNEL32.dll_VirtualProtectEx]
test eax, eax
je 0x100155e9
mov ecx, dword [esi]
cmp dword [esi + 4], edi
jbe 0x100155b7
mov al, byte [esi + edi + 0x4c]
mov byte [edi + ecx], al
inc edi
cmp edi, dword [esi + 4]
jb 0x100155aa
push dword [esi + 4]
push dword [esi]
push ebx
call dword [sym.imp.KERNEL32.dll_FlushInstructionCache]
lea eax, [ebp - 8]
push eax
push dword [ebp - 8]
push dword [esi + 4]
push dword [esi]
push ebx
call dword [sym.imp.KERNEL32.dll_VirtualProtectEx]
mov eax, dword [esi]
xor edi, edi
xor edx, edx
mov dword [0x1007b060], eax
mov ecx, esi
inc edi
call fcn.10014f98
call fcn.1001507d
pop ebx
push 0x1007b2b0
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov ecx, dword [ebp - 4]
mov eax, edi
pop edi
xor ecx, ebp
pop esi
call fcn.10015618
mov esp, ebp
pop ebp
ret
mov esi, dword [esi*4 + 0x1007b1b0]
jmp 0x10015573

Function at 0x10018393
Capabilities:
Link many functions at runtime

Disassembly:
push esi
push 0
call dword [sym.imp.KERNEL32.dll_EncodePointer]
mov esi, eax
push esi
call fcn.1001bcb2
push esi
call fcn.10017f57
push esi
jmp loc.10082000
Function at 0x1002905e
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateThread]
pop ebp
ret
Function at 0x10001c05
Capabilities:
Print debug messages

Disassembly:
push 4
mov eax, 0x1002c674
call fcn.1002b067
mov esi, ecx
mov dword [ebp - 0x10], esi
push dword [ebp + 8]
lea edi, [esi + 4]
mov dword [esi], vtable.CMemMappedFile.0
xor ebx, ebx
mov ecx, edi
mov dword [edi + 0x10], ebx
mov dword [edi + 0x14], ebx
call fcn.10002b37
mov eax, dword [ebp + 0xc]
mov dword [esi + 0x1c], ebx
mov dword [esi + 0x20], ebx
mov dword [esi + 0x24], eax
mov dword [esi + 0x28], ebx
mov dword [esi + 0x2c], ebx
mov byte [esi + 0x30], 1
mov dword [ebp - 4], ebx
cmp byte [0x1003cdfb], bl
jne 0x10001c5a
cmp byte [0x1003cdfa], bl
je 0x10001c96
cmp dword [edi + 0x14], 0x10
jb 0x10001c62
mov edi, dword [edi]
push edi
push str.CMemMappedFile__s__ctor__reference_
mov edi, 0x1003c818
push edi
call fcn.10024f57
add esp, 0xc
cmp byte [0x1003cdfa], 0
je 0x10001c86
push edi
call dword [sym.imp.kernel32.dll_OutputDebugStringA]
cmp byte [0x1003cdfb], 0
je 0x10001c96
push edi
call fcn.10005eb0
pop ecx
push esi
call fcn.10024f57
pop ecx
mov eax, esi
call fcn.1002b030
ret 8

Function at 0x10001ca7
Capabilities:
Print debug messages

Disassembly:
push 4
mov eax, 0x1002c674
call fcn.1002b067
mov esi, ecx
mov dword [ebp - 0x10], esi
lea edi, [esi + 4]
mov dword [esi], vtable.CMemMappedFile.0
push edi
call fcn.1000282f
pop ecx
mov eax, dword [ebp + 8]
xor ecx, ecx
mov dword [esi + 0x1c], ecx
mov dword [esi + 0x20], ecx
mov dword [esi + 0x24], eax
mov dword [esi + 0x28], ecx
mov dword [esi + 0x2c], ecx
mov byte [esi + 0x30], cl
mov dword [ebp - 4], ecx
cmp byte [0x1003cdfb], cl
jne 0x10001cf2
cmp byte [0x1003cdfa], cl
je 0x10001d2f
cmp dword [edi + 0x14], 0x10
jb 0x10001cfa
mov edi, dword [edi]
push eax
push edi
push str.CMemMappedFile__s__ctor__new_with_size_lu_
mov edi, 0x1003c818
push edi
call fcn.10024f57
add esp, 0x10
cmp byte [0x1003cdfa], 0
je 0x10001d1f
push edi
call dword [sym.imp.kernel32.dll_OutputDebugStringA]
cmp byte [0x1003cdfb], 0
je 0x10001d2f
push edi
call fcn.10005eb0
pop ecx
mov ecx, esi
call fcn.100033f0
mov eax, esi
call fcn.1002b030
ret 4

Function at 0x10001d40
Capabilities:
Print debug messages

Disassembly:
push 4
mov eax, 0x1002c674
call fcn.1002b067
mov esi, ecx
mov dword [ebp - 0x10], esi
lea edi, [esi + 4]
mov dword [esi], vtable.CMemMappedFile.0
push edi
call fcn.1000282f
pop ecx
xor eax, eax
mov dword [esi + 0x1c], eax
mov dword [esi + 0x20], eax
mov dword [esi + 0x24], eax
mov dword [esi + 0x28], eax
mov dword [esi + 0x2c], eax
mov byte [esi + 0x30], al
mov dword [ebp - 4], eax
cmp byte [0x1003cdfb], al
jne 0x10001d88
cmp byte [0x1003cdfa], al
je 0x10001dc4
cmp dword [edi + 0x14], 0x10
jb 0x10001d90
mov edi, dword [edi]
push edi
push str.CMemMappedFile__s__ctor__new_
mov edi, 0x1003c818
push edi
call fcn.10024f57
add esp, 0xc
cmp byte [0x1003cdfa], 0
je 0x10001db4
push edi
call dword [sym.imp.kernel32.dll_OutputDebugStringA]
cmp byte [0x1003cdfb], 0
je 0x10001dc4
push edi
call fcn.10005eb0
pop ecx
mov eax, esi
call fcn.1002b030
ret
Function at 0x10002659
Capabilities:
Print debug messages

Disassembly:
push 4
mov eax, 0x1002c7a2
call fcn.1002b067
cmp byte [0x1003cdfb], 0
mov edi, 0x1003c818
mov esi, dword [ebp + 8]
jne 0x1000267f
cmp byte [0x1003cdfa], 0
je 0x100026ae
push esi
push str.CMemMappedFile_CreateWithSize__size_lu_
push edi
call fcn.10024f57
add esp, 0xc
cmp byte [0x1003cdfa], 0
je 0x1000269e
push edi
call dword [sym.imp.kernel32.dll_OutputDebugStringA]
cmp byte [0x1003cdfb], 0
je 0x100026ae
push edi
call fcn.10005eb0
pop ecx
call fcn.10024f57
test al, al
je 0x1000270a
call fcn.1001be5e
test al, al
je 0x1000270a
cmp byte [0x1003cdfb], 0
jne 0x100026d2
cmp byte [0x1003cdfa], 0
je 0x10002701
push esi
push str.CMemMappedFile::CreateWithSize__lu___REMOTE_CREATION_
push edi
call fcn.10024f57
add esp, 0xc
cmp byte [0x1003cdfa], 0
je 0x100026f1
push edi
call dword [sym.imp.kernel32.dll_OutputDebugStringA]
cmp byte [0x1003cdfb], 0
je 0x10002701
push edi
call fcn.10005eb0
pop ecx
push esi
call fcn.1001bc5c
pop ecx
jmp 0x10002767
cmp byte [0x1003cdfb], 0
jne 0x1000271c
cmp byte [0x1003cdfa], 0
je 0x1000274b
push esi
push str.CMemMappedFile::CreateWithSize__lu___LOCAL_CREATION_
push edi
call fcn.10024f57
add esp, 0xc
cmp byte [0x1003cdfa], 0
je 0x1000273b
push edi
call dword [sym.imp.kernel32.dll_OutputDebugStringA]
cmp byte [0x1003cdfb], 0
je 0x1000274b
push edi
call fcn.10005eb0
pop ecx
push 0x34
call fcn.10024f57
pop ecx
mov ecx, eax
mov dword [ebp - 0x10], ecx
xor eax, eax
mov dword [ebp - 4], eax
test ecx, ecx
je 0x10002767
push esi
call fcn.10001ca7
call fcn.1002b030
ret

Function at 0x100028d9
Capabilities:
Print debug messages

Disassembly:
push 0x28
mov eax, 0x1002c80c
call fcn.1002b09b
mov ecx, dword [ebp + 0xc]
xor ebx, ebx
mov esi, dword [ebp + 8]
mov dword [ebp - 0x2c], ebx
mov dword [ebp - 0x30], ecx
cmp byte [0x1003cdfb], bl
jne 0x10002903
cmp byte [0x1003cdfa], bl
je 0x10002940
cmp dword [esi + 0x14], 0x10
mov eax, esi
jb 0x1000290d
mov eax, dword [esi]
push ecx
push eax
push str.CMemMappedFile_GetExistingMemoryMappedFile__name_s__size_lu_
mov edi, 0x1003c818
push edi
call fcn.10024f57
add esp, 0x10
cmp byte [0x1003cdfa], bl
je 0x10002931
push edi
call dword [sym.imp.kernel32.dll_OutputDebugStringA]
cmp byte [0x1003cdfb], bl
je 0x10002940
push edi
call fcn.10005eb0
pop ecx
push esi
call fcn.10024f57
mov edi, eax
pop ecx
test edi, edi
jne 0x100029a6
push 0x34
call fcn.10024f57
mov edi, eax
pop ecx
mov dword [ebp - 0x34], edi
mov dword [ebp - 4], ebx
test edi, edi
je 0x1000298b
push esi
lea ecx, [ebp - 0x28]
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x14], ebx
call fcn.10002b37
push dword [ebp - 0x30]
xor ebx, ebx
lea eax, [ebp - 0x28]
inc ebx
mov ecx, edi
push eax
mov byte [ebp - 4], bl
mov dword [ebp - 0x2c], ebx
call fcn.10001c05
mov edi, eax
jmp 0x1000298d
mov edi, ebx
test bl, 1
je 0x100029a6
mov eax, dword [ebp - 0x14]
cmp eax, 0x10
jb 0x100029a6
inc eax
push eax
push dword [ebp - 0x28]
call fcn.10024f57
pop ecx
pop ecx
mov eax, edi
call fcn.1002b045
ret
Function at 0x100033f0
Capabilities:
Print debug messages

Disassembly:
mov al, byte [0x1003cdfb]
push esi
mov esi, ecx
push edi
mov edi, 0x1003c818
test al, al
jne 0x1000340a
cmp byte [0x1003cdfa], al
je 0x10003449
lea eax, [esi + 4]
cmp dword [eax + 0x14], 0x10
jb 0x10003415
mov eax, dword [eax]
push eax
push str.CMemMappedFile__s__createMemoryMappedFile
push edi
call fcn.10024f57
add esp, 0xc
cmp byte [0x1003cdfa], 0
je 0x10003434
push edi
call dword [sym.imp.kernel32.dll_OutputDebugStringA]
mov al, byte [0x1003cdfb]
test al, al
je 0x10003449
push edi
call fcn.10005eb0
mov al, byte [0x1003cdfb]
pop ecx
mov ecx, dword [esi + 0x24]
test ecx, ecx
je 0x100034e5
mov ecx, esi
call fcn.10024f57
mov dword [esi + 0x20], eax
test eax, eax
je 0x100034b9
cmp byte [0x1003cdfb], 0
jne 0x10003474
cmp byte [0x1003cdfa], 0
je 0x100034b1
lea eax, [esi + 4]
cmp dword [eax + 0x14], 0x10
jb 0x1000347f
mov eax, dword [eax]
push dword [esi + 0x24]
push eax
push str.CMemMappedFile__s__created_file_of_size___lu
push edi
call fcn.10024f57
add esp, 0x10
cmp byte [0x1003cdfa], 0
je 0x100034a1
push edi
call dword [sym.imp.kernel32.dll_OutputDebugStringA]
cmp byte [0x1003cdfb], 0
je 0x100034b1
push edi
call fcn.10005eb0
pop ecx
push esi
call fcn.10024f57
jmp 0x1000352b
cmp byte [0x1003cdfb], 0
jne 0x100034cb
cmp byte [0x1003cdfa], 0
je 0x1000352c
add esi, 4
cmp dword [esi + 0x14], 0x10
jb 0x100034d6
mov esi, dword [esi]
call dword [sym.imp.kernel32.dll_GetLastError]
push eax
push esi
push str.CMemMappedFile__s__ERROR_CREATING__err_u_
jmp 0x10003503
test al, al
jne 0x100034f1
cmp byte [0x1003cdfa], al
je 0x1000352c
add esi, 4
cmp dword [esi + 0x14], 0x10
jb 0x100034fc
mov esi, dword [esi]
push ecx
push esi
push str.CMemMappedFile__s__ERROR_CREATING__SIZE__0_
push edi
call fcn.10024f57
add esp, 0x10
cmp byte [0x1003cdfa], 0
je 0x1000351c
push edi
call dword [sym.imp.kernel32.dll_OutputDebugStringA]
cmp byte [0x1003cdfb], 0
je 0x1000352c
push edi
call fcn.10005eb0
pop ecx
pop edi
pop esi
ret

Function at 0x10003670
Capabilities:
Print debug messages

Disassembly:
cmp byte [0x1003cdfb], 0
push esi
mov esi, ecx
jne 0x10003685
cmp byte [0x1003cdfa], 0
je 0x100036c9
lea eax, [esi + 4]
cmp dword [eax + 0x14], 0x10
jb 0x10003690
mov eax, dword [eax]
push edi
push dword [esi + 0x24]
mov edi, 0x1003c818
push eax
push str.CMemMappedFile__s__size___lu
push edi
call fcn.10024f57
add esp, 0x10
cmp byte [0x1003cdfa], 0
je 0x100036b8
push edi
call dword [sym.imp.kernel32.dll_OutputDebugStringA]
cmp byte [0x1003cdfb], 0
je 0x100036c8
push edi
call fcn.10005eb0
pop ecx
pop edi
mov eax, dword [esi + 0x24]
pop esi
ret
Function at 0x100036e0
Capabilities:
Print debug messages

Disassembly:
cmp byte [0x1003cdfb], 0
push esi
mov esi, ecx
jne 0x100036f5
cmp byte [0x1003cdfa], 0
je 0x10003748
lea ecx, [esi + 4]
cmp dword [ecx + 0x14], 0x10
jb 0x10003700
mov ecx, dword [ecx]
cmp dword [esi + 0x20], 0
mov edx, str.false
push edi
mov eax, str.true
mov edi, 0x1003c818
cmove eax, edx
push eax
push ecx
push str.CMemMappedFile__s__isValid___s
push edi
call fcn.10024f57
add esp, 0x10
cmp byte [0x1003cdfa], 0
je 0x10003737
push edi
call dword [sym.imp.kernel32.dll_OutputDebugStringA]
cmp byte [0x1003cdfb], 0
je 0x10003747
push edi
call fcn.10005eb0
pop ecx
pop edi
cmp dword [esi + 0x20], 0
pop esi
setne al
ret