joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10004300
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10072850
mov eax, dword fs:[0]
push eax
sub esp, 0x338
mov eax, dword [0x1044a964]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x340], esi
mov dword [ebp - 0x338], 0
mov dword [ebp - 0x344], esi
mov dword [ebp - 0x340], eax
mov dword [ebp - 0x328], 0
mov dword [ebp - 0x324], 0xf
mov byte [ebp - 0x338], 0
mov dword [ebp - 4], 0
mov byte [ebp - 0x114], 0
test eax, eax
je 0x100044dc
mov ecx, eax
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x10004385
sub ecx, edx
je 0x100044dc
lea eax, [ebp - 0x114]
push eax
push 0x103
call dword [sym.imp.KERNEL32.dll_GetLogicalDriveStringsA]
test eax, eax
je 0x100044dc
mov ax, word [0x10078108]
lea edi, [ebp - 0x114]
mov word [ebp - 0x320], ax
movzx eax, byte [0x1007810a]
mov byte [ebp - 0x31e], al
mov al, byte [ebp - 0x114]
mov dword [ebp - 0x33c], 0
nop
mov byte [ebp - 0x320], al
lea eax, [ebp - 0x218]
push 0x104
push eax
lea eax, [ebp - 0x320]
push eax
call dword [sym.imp.KERNEL32.dll_QueryDosDeviceA]
test eax, eax
je 0x1000449c
lea esi, [ebp - 0x218]
lea ecx, [esi + 1]
mov al, byte [esi]
inc esi
test al, al
jne 0x10004410
sub esi, ecx
cmp esi, 0x104
jae 0x1000449c
push esi
lea eax, [ebp - 0x218]
push eax
push dword [ebp - 0x340]
lfence
call fcn.10052280
xor ecx, ecx
add esp, 0xc
test eax, eax
sete cl
mov dword [ebp - 0x33c], ecx
test eax, eax
jne 0x100044a2
mov eax, dword [ebp - 0x340]
add eax, esi
push eax
lea eax, [ebp - 0x320]
push eax
lea eax, [ebp - 0x31c]
push str._s_s
push eax
lfence
call fcn.10003480
lea ecx, [ebp - 0x31c]
add esp, 0x10
lea edx, [ecx + 1]
nop dword [eax + eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x10004480
sub ecx, edx
lea eax, [ebp - 0x31c]
push ecx
push eax
lea ecx, [ebp - 0x338]
call fcn.10005040
mov ecx, dword [ebp - 0x33c]
mov al, byte [edi]
inc edi
test al, al
jne 0x100044a2
test ecx, ecx
jne 0x100044b7
mov al, byte [edi]
test al, al
jne 0x100043e0
mov ecx, dword [ebp - 0x344]
lea eax, [ebp - 0x338]
push eax
call fcn.100035c0
lea ecx, [ebp - 0x338]
call fcn.100037b0
mov eax, dword [ebp - 0x344]
jmp 0x1000452f
movups xmm0, xmmword [ebp - 0x338]
mov dword [esi], 0
lea ecx, [ebp - 0x338]
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
movups xmmword [esi], xmm0
mov byte [ebp - 0x338], 0
movq xmm0, qword [ebp - 0x328]
movq qword [esi + 0x10], xmm0
mov dword [ebp - 0x328], 0
mov dword [ebp - 0x324], 0xf
call fcn.100037b0
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1004ce42
mov esp, ebp
pop ebp
ret
Function at 0x10004550
Capabilities:
Acquire debug privileges

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [0x1044a964]
xor eax, ebp
mov dword [ebp - 4], eax
lea eax, [ebp - 8]
mov dword [ebp - 8], 0
push eax
push 0x28
push 0xffffffffffffffff
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x100045be
push 2
push str.SeSecurityPrivilege
push dword [ebp - 8]
call fcn.10003930
add esp, 0xc
test al, al
je 0x100045be
push 2
push str.SeDebugPrivilege
push dword [ebp - 8]
call fcn.10003930
add esp, 0xc
test al, al
je 0x100045be
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, 1
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1004ce42
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor al, al
xor ecx, ebp
call fcn.1004ce42
mov esp, ebp
pop ebp
ret

Function at 0x100046e0
Capabilities:
Get process image filename

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10c
mov eax, dword [0x1044a964]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x108]
push edi
mov edi, dword [ebp + 0xc]
push 0x104
push eax
push edi
mov dword [ebp - 0x10c], esi
call sub.KERNEL32.dll_K32GetProcessImageFileNameA
test eax, eax
je 0x1000474a
lea ecx, [ebp - 0x108]
mov dword [esi], 0
mov dword [esi + 0x10], 0
lea edx, [ecx + 1]
mov dword [esi + 0x14], 0xf
mov byte [esi], 0
mov al, byte [ecx]
inc ecx
test al, al
jne 0x10004737
sub ecx, edx
lea eax, [ebp - 0x108]
push ecx
push eax
jmp 0x100047b2
push 0x104
lea eax, [ebp - 0x108]
push 0
push eax
call fcn.1004f110
add esp, 0xc
lea eax, [ebp - 0x108]
push 0x104
push eax
push 0
push edi
call sub.KERNEL32.dll_K32GetModuleFileNameExA
mov dword [esi], 0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0xf
mov byte [esi], 0
test eax, eax
je 0x100047ab
lea ecx, [ebp - 0x108]
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x10004798
sub ecx, edx
lea eax, [ebp - 0x108]
push ecx
push eax
jmp 0x100047b2
push 0
push 0x10078104
mov ecx, esi
call fcn.10005040
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
xor ecx, ebp
pop esi
call fcn.1004ce42
mov esp, ebp
pop ebp
ret
Function at 0x10004af0
Capabilities:
Enumerate process modules

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1024
call fcn.1004ce50
mov eax, dword [0x1044a964]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push 0x100
lea eax, [ebp - 0x10c]
mov dword [ebp - 0x120], 0x11c
push 0
push eax
mov dword [ebp - 0x114], 0
mov dword [ebp - 0x110], 0
call fcn.1004f110
add esp, 0xc
xor eax, eax
mov word [ebp - 0xa], ax
mov dword [ebp - 8], eax
push 3
push 0x20
push 3
push 1
push 3
push 2
push eax
push eax
call dword [sym.imp.KERNEL32.dll_VerSetConditionMask]
push edx
push eax
call dword [sym.imp.KERNEL32.dll_VerSetConditionMask]
push edx
push eax
call dword [sym.imp.KERNEL32.dll_VerSetConditionMask]
push edx
push eax
push 0x23
lea eax, [ebp - 0x120]
mov dword [ebp - 0x11c], 6
xor ecx, ecx
mov dword [ebp - 0x118], 0
push eax
mov word [ebp - 0xc], cx
call dword [sym.imp.KERNEL32.dll_VerifyVersionInfoW]
test eax, eax
je 0x10004c9a
mov esi, dword [0x1044be64]
test esi, esi
je 0x10004c9a
lea eax, [ebp - 0x1008]
mov dword [ebp - 0x1008], 0
push eax
push 0
push 0
push 0x2000000
push 0
mov ecx, esi
call dword [0x10077410]
call esi
test eax, eax
jne 0x10004d4e
nop dword [eax + eax]
mov eax, dword [ebp - 0x1008]
test eax, eax
jne 0x10004bee
xor ecx, ecx
jmp 0x10004c1d
mov esi, dword [0x1044be80]
lea ecx, [ebp - 0x1024]
push 0
push 0x18
push ecx
push 0
push eax
mov ecx, esi
call dword [0x10077410]
call esi
xor ecx, ecx
test eax, eax
mov eax, dword [ebp - 0x1008]
cmovns ecx, dword [ebp - 0x1014]
push eax
push ecx
call fcn.10003be0
mov ecx, dword [0x1044be98]
add esp, 8
cmp ecx, dword [0x1044be9c]
je 0x10004c46
mov eax, dword [ebp - 0x1008]
mov dword [ecx], eax
add dword [0x1044be98], 4
jmp 0x10004c58
lea eax, [ebp - 0x1008]
push eax
push ecx
mov ecx, 0x1044be94
call fcn.10003320
mov esi, dword [0x1044be64]
lea eax, [ebp - 0x1008]
push eax
push 0
push 0
push 0x2000000
push dword [ebp - 0x1008]
mov ecx, esi
call dword [0x10077410]
call esi
test eax, eax
je 0x10004be0
call fcn.10003a60
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1004ce42
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x1008]
push eax
push 0x1000
lea eax, [ebp - 0x1004]
push eax
call sub.KERNEL32.dll_K32EnumProcesses
test eax, eax
jne 0x10004cbb
call fcn.10023ce0
push edi
xor edi, edi
test dword [ebp - 0x1008], 0xfffffffc
jbe 0x10004d4d
nop
cmp dword [ebp + edi*4 - 0x1004], 0
je 0x10004d3f
mov esi, dword [ebp + edi*4 - 0x1004]
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
cmp esi, eax
je 0x10004d3f
push esi
push 0
push 0x400
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
mov dword [ebp - 0x100c], esi
test esi, esi
je 0x10004d3f
push esi
push dword [ebp + edi*4 - 0x1004]
call fcn.10003be0
mov eax, dword [0x1044be98]
add esp, 8
cmp eax, dword [0x1044be9c]
je 0x10004d2d
mov dword [eax], esi
add dword [0x1044be98], 4
jmp 0x10004d3f
lea ecx, [ebp - 0x100c]
push ecx
push eax
mov ecx, 0x1044be94
call fcn.10003320
mov eax, dword [ebp - 0x1008]
inc edi
shr eax, 2
cmp edi, eax
jb 0x10004cd0
pop edi
call fcn.10003a60
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.1004ce42
mov esp, ebp
pop ebp
ret
Function at 0x10006050
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, ecx
mov ecx, 0x3a
xor eax, eax
mov dl, byte [edi + eax + 0x260e6b3b]
xor dl, cl
inc ecx
mov byte [eax + esi], dl
and ecx, 0x800000ff
jns 0x1000607e
dec ecx
or ecx, 0xffffff00
inc ecx
inc eax
cmp eax, 0xc
jl 0x10006061
pop edi
mov byte [esi + 0xc], 0
mov eax, esi
pop esi
pop ebp
ret 4
Function at 0x10007500
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10072c70
mov eax, dword fs:[0]
push eax
sub esp, 0xde0
mov eax, dword [0x1044a964]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
lea eax, [ebp + 0xc]
mov dword [ebp - 0x1c], 0x65737973
push eax
push dword [ebp + 8]
lea eax, [ebp - 0xcf4]
mov dword [ebp - 0x18], 0x2e327272
push eax
mov dword [ebp - 0x14], 0x747874
call dword [sym.imp.USER32.dll_wvsprintfA]
push 0
call fcn.10055b6a
mov dword [ebp - 0xcfc], eax
lea eax, [ebp - 0xcfc]
push eax
mov dword [ebp - 0xcf8], edx
call fcn.10055b38
movaps xmm0, xmmword [str._02d:_02d:_02d____02d:_02d:_d_::]
movups xmm2, xmmword [eax]
movups xmm1, xmmword [eax + 0x10]
mov word [ebp - 0x20], 0x20
movups xmmword [ebp - 0x40], xmm0
movaps xmm0, xmmword [0x10078500]
movups xmmword [ebp - 0x30], xmm0
movaps xmm0, xmm1
psrldq xmm0, 4
movd eax, xmm0
movaps xmm0, xmm2
psrldq xmm0, 0xc
add eax, 0x76c
push eax
movd eax, xmm1
inc eax
push eax
movd eax, xmm0
movaps xmm0, xmm2
psrldq xmm0, 4
push eax
movd eax, xmm2
psrldq xmm2, 8
push eax
movd eax, xmm0
push eax
movd eax, xmm2
push eax
lea eax, [ebp - 0x40]
push eax
lea eax, [ebp - 0x524]
push eax
call fcn.1000de50
push 0xb0
lea eax, [ebp - 0xdac]
push 0
push eax
call fcn.1004f110
add esp, 0x34
lea eax, [ebp - 0x1c]
lea ecx, [ebp - 0xdac]
push 1
push 0x40
push 0xa
push eax
call fcn.10006150
push 0xa
lea eax, [ebp - 0xcf4]
mov dword [ebp - 4], 0
push eax
lea eax, [ebp - 0x524]
push eax
lea eax, [ebp - 0xdac]
push eax
call fcn.10005550
add esp, 8
push eax
call fcn.10005550
add esp, 8
push eax
call fcn.10005250
mov esi, eax
add esp, 8
mov ecx, dword [esi]
mov ecx, dword [ecx + 4]
add ecx, esi
push 0xa
call fcn.1000d870
movzx ecx, al
push ecx
mov ecx, esi
call fcn.1000cf90
mov ecx, esi
call fcn.1000c7d0
lea ecx, [ebp - 0xda8]
call fcn.1000b9d0
test eax, eax
jne 0x100076b5
mov eax, dword [ebp - 0xdac]
xor edx, edx
mov ecx, dword [eax + 4]
mov eax, 4
cmp dword [ebp + ecx - 0xd74], edx
cmovne eax, edx
or eax, dword [ebp + ecx - 0xda0]
and eax, 0x15
or eax, 2
mov dword [ebp + ecx - 0xda0], eax
mov ecx, dword [ebp + ecx - 0xd9c]
and ecx, eax
jne 0x100076da
lea ecx, [ebp - 0xdac]
call fcn.100070b0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1004ce42
mov esp, ebp
pop ebp
ret
test cl, 4
je 0x100076e6
mov esi, str.ios_base::badbit_set
jmp 0x100076f6
test cl, 2
mov esi, str.ios_base::failbit_set
mov eax, str.ios_base::eofbit_set
cmove esi, eax
lea eax, [ebp - 0xdb4]
push 1
push eax
call fcn.1000cca0
add esp, 8
lea ecx, [ebp - 0xdc8]
push eax
push esi
call fcn.10006840
push 0x10088dbc
lea eax, [ebp - 0xdc8]
push eax
call fcn.1004e5bd
int3
Function at 0x10007730
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10072d08
mov eax, dword fs:[0]
push eax
sub esp, 0xdf8
mov eax, dword [0x1044a964]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0xc98], 0
mov dword [ebp - 0xc90], 0x10000
mov dword [ebp - 0xc80], 0
mov dword [ebp - 0xc7c], 0
mov dword [ebp - 0xc94], 0
mov eax, dword [ebp - 0xc90]
push eax
call fcn.100542fc
add esp, 4
mov dword [ebp - 0xc80], eax
mov ecx, dword [ebp - 0xc90]
push ecx
push 0
mov edx, dword [ebp - 0xc80]
push edx
call fcn.1004f110
add esp, 0xc
mov eax, dword [0x1044bea8]
mov dword [ebp - 0xcd4], eax
push 0
mov ecx, dword [ebp - 0xc90]
push ecx
mov edx, dword [ebp - 0xc80]
push edx
push 0x10
mov eax, dword [ebp - 0xcd4]
mov dword [ebp - 0xcac], eax
mov ecx, dword [ebp - 0xcac]
call dword [0x10077410]
call dword [ebp - 0xcac]
mov dword [ebp - 0xc94], eax
cmp dword [ebp - 0xc94], 0xc0000004
jne 0x10007836
mov ecx, dword [ebp - 0xc90]
shl ecx, 1
mov dword [ebp - 0xc90], ecx
mov edx, dword [ebp - 0xc90]
push edx
mov eax, dword [ebp - 0xc80]
push eax
call fcn.10054307
add esp, 8
mov dword [ebp - 0xc80], eax
jmp 0x100077bd
cmp dword [ebp - 0xc94], 0
jge 0x10007853
mov ecx, dword [ebp - 0xc80]
push ecx
call fcn.100542e1
add esp, 4
jmp 0x100089f8
mov dword [ebp - 0xc9c], 0
jmp 0x1000786e
Function at 0x10009e1f
Capabilities:
Create thread

Disassembly:
jae 0x10009e1d
jmp 0x10009e18
call fcn.10009e1f
jae 0x10009e18
add esp, 4
jmp 0x10009e24
dec dword [esp]
jno 0x10009e29
jns 0x10009e14
jp 0x10009e2d
add esp, 4
popf
jmp 0x10009e34
push eax
push edx
xor edx, 0x90
push edx
sub edx, 0x80
pop eax
add eax, edx
pop edx
pop eax
je 0x10009e4d
jne 0x10009e4d
call 0x1fc0d1a1
wait
rcl byte [edx + 0x33], 0xd0
push eax
xor eax, eax
setnp al
push edx
xor edx, eax
shl edx, 2
xchg edx, eax
pop edx
or eax, ecx
pop eax
push 0
push 0
push 0
push 0x10009f40
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x10009e81
call fcn.10023ce0
xor eax, eax
test eax, eax
je 0x10009e8a
jne 0x10009e89
call 0x93048f11
rol byte [ebx + eax*4], 0xf0
add eax, 0x3eb037c
or esi, dword [ebx + edi*8 - 8]
xor eax, 3
add eax, 4
xor eax, 5
jl 0x10009e98
jmp 0x10009e9a
je 0x10009e95
clc
jae 0x10009e9f
or esi, dword fs:[0x240]
xor eax, 0x240
xor edx, eax
add eax, edx
sub edx, 0x240
push eax
pop edx
xor edx, 0x6c0
nop
nop
xor ecx, ecx
xor eax, eax
mov ecx, 0x240
add ecx, 3
sub ecx, eax
nop
push eax
pop ecx
xor eax, eax
nop
nop
push eax
xor eax, eax
pop eax
xor edx, edx
xor eax, edx
push ecx
pop ecx
xor eax, eax
nop
pushf
push 0xa
jae 0x10009ee7
jmp 0x10009ee2
call 0x10009ee9
jae 0x10009ee2
add esp, 4
jmp 0x10009eee
dec dword [esp]
jno 0x10009ef3
jns 0x10009ede
jp 0x10009ef7
add esp, 4
popf
jmp 0x10009efe
push eax
push edx
xor edx, 0x90
push edx
sub edx, 0x80
pop eax
add eax, edx
pop edx
pop eax
je 0x10009f17
jne 0x10009f17
call 0x1fc0d26b
wait
rcl byte [edx + 0x33], 0xd0
push eax
xor eax, eax
setnp al
push edx
xor edx, eax
shl edx, 2
xchg edx, eax
pop edx
or eax, ecx
pop eax
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x1000a3c0
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x12c
mov eax, dword [0x1044a964]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
push 0
push 2
mov dword [ebp - 0x12c], 0x128
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov esi, eax
lea eax, [ebp - 0x12c]
push eax
push esi
call sub.KERNEL32.dll_Process32First
test eax, eax
je 0x1000a419
mov edi, dword [ebp + 8]
nop
cmp dword [ebp - 0x124], edi
je 0x1000a432
lea eax, [ebp - 0x12c]
push eax
push esi
call sub.KERNEL32.dll_Process32Next
test eax, eax
jne 0x1000a400
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
xor eax, eax
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1004ce42
mov esp, ebp
pop ebp
ret
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push edi
push 0
push 0x100000
call dword [sym.imp.KERNEL32.dll_OpenProcess]
xor ebx, ebx
test eax, eax
setne bl
test eax, eax
je 0x1000a45a
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 4]
mov eax, ebx
pop ebx
pop edi
xor ecx, ebp
pop esi
call fcn.1004ce42
mov esp, ebp
pop ebp
ret
Function at 0x1000a580
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x1044a964]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, ecx
cmp dword [ebx + 0x38], 0
je 0x1000a65b
cmp byte [ebx + 0x3d], 0
je 0x1000a65b
mov eax, dword [ebx]
push esi
push 0xffffffffffffffff
mov esi, dword [eax + 0xc]
mov ecx, esi
call dword [0x10077410]
mov ecx, ebx
call esi
cmp eax, 0xffffffff
je 0x1000a649
push edi
mov edi, dword [ebx + 0x38]
mov eax, dword [edi]
mov esi, dword [eax + 0x20]
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 4]
mov ecx, esi
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [ebx + 0x40]
push eax
call dword [0x10077410]
mov ecx, edi
call esi
pop edi
sub eax, 0
je 0x1000a60e
sub eax, 1
je 0x1000a612
sub eax, 2
jne 0x1000a649
mov byte [ebx + 0x3d], al
mov al, 1
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1004ce42
mov esp, ebp
pop ebp
ret
mov byte [ebx + 0x3d], 0
mov esi, dword [ebp - 0x28]
lea eax, [ebp - 0x24]
sub esi, eax
je 0x1000a632
lfence
push dword [ebx + 0x4c]
push esi
push 1
push eax
call fcn.1005552c
add esp, 0x10
cmp esi, eax
jne 0x1000a649
cmp byte [ebx + 0x3d], 0
pop esi
sete al
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1004ce42
mov esp, ebp
pop ebp
ret
pop esi
xor al, al
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1004ce42
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
mov al, 1
xor ecx, ebp
pop ebx
call fcn.1004ce42
mov esp, ebp
pop ebp
ret
Function at 0x1000c930
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10072fed
mov eax, dword fs:[0]
push eax
sub esp, 0x20
push ebx
push esi
push edi
mov eax, dword [0x1044a964]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
push 8
mov dword [ebx + 0x30], 0
mov dword [ebx + 8], 0
mov dword [ebx + 0x10], 0
mov dword [ebx + 0x14], 0x201
mov dword [ebx + 0x18], 6
mov dword [ebx + 0x1c], 0
mov dword [ebx + 0x20], 0
mov dword [ebx + 0x24], 0
mov dword [ebx + 0x28], 0
mov dword [ebx + 0x2c], 0
mov dword [ebx + 0xc], 0
call fcn.1004caea
mov edi, eax
add esp, 4
test edi, edi
je 0x1000c9d4
xorps xmm0, xmm0
movq qword [edi], xmm0
push 1
mov dword [ebp - 4], 0
call fcn.1004af44
add esp, 4
mov dword [edi + 4], eax
jmp 0x1000c9d6
xor edi, edi
mov eax, dword [ebp + 8]
mov dword [ebx + 0x30], edi
mov dword [ebx + 0x38], eax
mov dword [ebx + 0x3c], 0
mov edi, dword [edi + 4]
mov dword [ebp - 0x14], edi
mov eax, dword [edi]
mov esi, dword [eax + 4]
mov ecx, esi
call dword [0x10077410]
mov ecx, edi
call esi
lea eax, [ebp - 0x18]
mov dword [ebp - 4], 1
push eax
call fcn.10005a80
mov edi, eax
add esp, 4
mov ecx, dword [edi]
push 0x20
mov esi, dword [ecx + 0x20]
mov ecx, esi
call dword [0x10077410]
mov ecx, edi
call esi
mov edi, dword [ebp - 0x14]
mov byte [ebp - 0xd], al
mov dword [ebp - 4], 0xffffffff
test edi, edi
je 0x1000ca62
mov edx, dword [edi]
mov esi, dword [edx + 8]
mov ecx, esi
call dword [0x10077410]
mov ecx, edi
call esi
mov edi, eax
test edi, edi
je 0x1000ca5f
mov ecx, dword [edi]
push 1
mov esi, dword [ecx]
mov ecx, esi
call dword [0x10077410]
mov ecx, edi
call esi
mov al, byte [ebp - 0xd]
cmp dword [ebx + 0x38], 0
mov byte [ebx + 0x40], al
jne 0x1000ca7e
mov eax, dword [ebx + 0xc]
mov ecx, dword [ebx + 0x10]
and eax, 0x13
or eax, 4
mov dword [ebx + 0xc], eax
and ecx, eax
jne 0x1000caa1
cmp byte [ebp + 0xc], 0
je 0x1000ca8d
push ebx
call fcn.1004b490
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
test cl, 4
je 0x1000caad
mov esi, str.ios_base::badbit_set
jmp 0x1000cabd
test cl, 2
mov esi, str.ios_base::failbit_set
mov eax, str.ios_base::eofbit_set
cmove esi, eax
lea eax, [ebp - 0x18]
push 1
push eax
call fcn.1000cca0
add esp, 8
lea ecx, [ebp - 0x2c]
push eax
push esi
call fcn.10006840
push 0x10088dbc
lea eax, [ebp - 0x2c]
push eax
call fcn.1004e5bd
int3
Function at 0x1000cd50
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
mov eax, dword [0x1044a964]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push edi
mov edi, ecx
cmp ebx, 0xffffffff
jne 0x1000cd80
pop edi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1004ce42
mov esp, ebp
pop ebp
ret 4
mov eax, dword [edi + 0x20]
push esi
mov ecx, dword [eax]
test ecx, ecx
je 0x1000cdbc
mov edx, dword [edi + 0x30]
mov esi, dword [edx]
lea eax, [esi + ecx]
cmp ecx, eax
jae 0x1000cdbc
lea ecx, [esi - 1]
mov dword [edx], ecx
mov edx, dword [edi + 0x20]
mov esi, dword [edx]
lea ecx, [esi + 1]
mov dword [edx], ecx
mov byte [esi], bl
pop esi
pop edi
mov eax, ebx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1004ce42
mov esp, ebp
pop ebp
ret 4
cmp dword [edi + 0x4c], 0
je 0x1000ceb5
mov esi, dword [edi + 0xc]
lea eax, [edi + 0x3c]
cmp dword [esi], eax
jne 0x1000cde4
mov edx, dword [edi + 0x54]
mov ecx, dword [edi + 0x50]
sub edx, ecx
mov dword [esi], ecx
mov eax, dword [edi + 0x1c]
mov dword [eax], ecx
mov eax, dword [edi + 0x2c]
mov dword [eax], edx
mov eax, dword [edi + 0x38]
mov dword [ebp - 0x34], eax
test eax, eax
jne 0x1000ce1a
push dword [edi + 0x4c]
movsx eax, bl
push eax
call fcn.10054bb5
add esp, 8
or ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, ebx
pop esi
pop edi
mov eax, ecx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1004ce42
mov esp, ebp
pop ebp
ret 4
mov byte [ebp - 0x28], bl
mov eax, dword [eax]
mov esi, dword [eax + 0x1c]
lea eax, [ebp - 0x2c]
push eax
lea eax, [ebp - 4]
mov ecx, esi
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 0x27]
push eax
lea eax, [ebp - 0x28]
push eax
lea eax, [edi + 0x40]
push eax
call dword [0x10077410]
mov ecx, dword [ebp - 0x34]
call esi
sub eax, 0
je 0x1000ce85
sub eax, 1
je 0x1000ce85
sub eax, 2
jne 0x1000ceb5
push dword [edi + 0x4c]
push dword [ebp - 0x28]
call fcn.10005830
add esp, 8
or ecx, 0xffffffff
test al, al
cmovne ecx, ebx
pop esi
pop edi
mov eax, ecx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1004ce42
mov esp, ebp
pop ebp
ret 4
mov esi, dword [ebp - 0x2c]
lea eax, [ebp - 0x24]
sub esi, eax
je 0x1000cea5
lfence
push dword [edi + 0x4c]
push esi
push 1
push eax
call fcn.1005552c
add esp, 0x10
cmp esi, eax
jne 0x1000ceb5
lea eax, [ebp - 0x28]
mov byte [edi + 0x3d], 1
cmp dword [ebp - 0x30], eax
jne 0x1000cda7
mov ecx, dword [ebp - 4]
or eax, 0xffffffff
pop esi
pop edi
xor ecx, ebp
pop ebx
call fcn.1004ce42
mov esp, ebp
pop ebp
ret 4