joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40a9b0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x5c524c]
xor eax, ebp
mov dword [ebp - 4], eax
xor eax, eax
mov dword [ebp - 0x24], 0x77002f
push esi
mov word [ebp - 8], ax
lea esi, [ebp - 0x24]
mov eax, 0x5cc79c
mov dword [ebp - 0x20], 0x5f0064
push edi
mov dword [ebp - 0x1c], 0x6f0070
mov edx, 0x10
mov dword [ebp - 0x18], 0x750070
sub esi, eax
mov dword [ebp - 0x14], 0x5f0070
mov dword [ebp - 0x10], 0x680073
mov dword [ebp - 0xc], 0x77006f
nop dword [eax + eax]
lea ecx, [edx + 0x7fffffee]
test ecx, ecx
je 0x40aa2e
movzx ecx, word [esi + eax]
test cx, cx
je 0x40aa2e
mov word [eax], cx
add eax, 2
sub edx, 1
jne 0x40aa10
lea ecx, [eax - 2]
test edx, edx
pop edi
cmovne ecx, eax
xor eax, eax
pop esi
mov word [ecx], ax
mov eax, 0x5cc79c
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0047467d
mov esp, ebp
pop ebp
ret

Function at 0x40aac0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [0x5c524c]
xor eax, ebp
mov dword [ebp - 4], eax
xor eax, eax
mov dword [ebp - 0x1c], str.A6__q
push esi
mov word [ebp - 8], ax
lea esi, [ebp - 0x1c]
mov eax, 0x5ccf78
mov dword [ebp - 0x18], 0x740073
mov dword [ebp - 0x14], 0x6c0061
mov edx, 0xc
mov dword [ebp - 0x10], 0x44006c
sub esi, eax
mov dword [ebp - 0xc], 0x720069
nop dword [eax]
lea ecx, [edx + 0x7ffffff2]
test ecx, ecx
je 0x40ab2e
movzx ecx, word [esi + eax]
test cx, cx
je 0x40ab2e
mov word [eax], cx
add eax, 2
sub edx, 1
jne 0x40ab10
lea ecx, [eax - 2]
test edx, edx
pop esi
cmovne ecx, eax
xor eax, eax
mov word [ecx], ax
mov eax, 0x5ccf78
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0047467d
mov esp, ebp
pop ebp
ret

Function at 0x40ab50
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
mov eax, dword [0x5c524c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov eax, 0x5cd4c8
mov dword [ebp - 0x34], 0x75002f
lea esi, [ebp - 0x34]
mov dword [ebp - 0x30], 0x69006e
push edi
mov dword [ebp - 0x2c], 0x73006e
mov edx, 0x19
mov dword [ebp - 0x28], 0x610074
sub esi, eax
mov dword [ebp - 0x24], 0x6c006c
mov dword [ebp - 0x20], 0x2f0020
mov dword [ebp - 0x1c], 0x720066
mov dword [ebp - 0x18], 0x6d006f
mov dword [ebp - 0x14], 0x75003d
mov dword [ebp - 0x10], 0x69006e
mov dword [ebp - 0xc], 0x73006e
mov dword [ebp - 8], 0x74
lea ecx, [edx + 0x7fffffe5]
test ecx, ecx
je 0x40abe4
movzx ecx, word [esi + eax]
test cx, cx
je 0x40abe4
mov word [eax], cx
add eax, 2
sub edx, 1
jne 0x40abc6
lea ecx, [eax - 2]
test edx, edx
pop edi
cmovne ecx, eax
xor eax, eax
pop esi
pop ebx
mov word [ecx], ax
mov eax, 0x5cd4c8
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0047467d
mov esp, ebp
pop ebp
ret
Function at 0x454e30
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x74
mov eax, dword [0x5c524c]
xor eax, ebp
mov dword [ebp - 4], eax
xor eax, eax
mov dword [ebp - 0x74], 0x4f0053
push ebx
push esi
mov word [ebp - 8], ax
lea esi, [ebp - 0x74]
mov eax, 0x5cfd60
mov dword [ebp - 0x70], 0x540046
push edi
mov dword [ebp - 0x6c], 0x410057
mov edx, 0x38
mov dword [ebp - 0x68], 0x450052
sub esi, eax
mov dword [ebp - 0x64], 0x4d005c
mov dword [ebp - 0x60], 0x630069
mov dword [ebp - 0x5c], 0x6f0072
mov dword [ebp - 0x58], 0x6f0073
mov dword [ebp - 0x54], 0x740066
mov dword [ebp - 0x50], 0x57005c
mov dword [ebp - 0x4c], 0x6e0069
mov dword [ebp - 0x48], 0x6f0064
mov dword [ebp - 0x44], 0x730077
mov dword [ebp - 0x40], 0x43005c
mov dword [ebp - 0x3c], 0x720075
mov dword [ebp - 0x38], 0x650072
mov dword [ebp - 0x34], 0x74006e
mov dword [ebp - 0x30], 0x650056
mov dword [ebp - 0x2c], 0x730072
mov dword [ebp - 0x28], 0x6f0069
mov dword [ebp - 0x24], 0x5c006e
mov dword [ebp - 0x20], 0x6e0055
mov dword [ebp - 0x1c], 0x6e0069
mov dword [ebp - 0x18], 0x740073
mov dword [ebp - 0x14], 0x6c0061
mov dword [ebp - 0x10], 0x5c006c
mov dword [ebp - 0xc], 0x730025
lea ecx, [edx + 0x7fffffc6]
test ecx, ecx
je 0x454f33
movzx ecx, word [esi + eax]
test cx, cx
je 0x454f33
mov word [eax], cx
add eax, 2
sub edx, 1
jne 0x454f15
lea ecx, [eax - 2]
test edx, edx
pop edi
cmovne ecx, eax
xor eax, eax
pop esi
pop ebx
mov word [ecx], ax
mov eax, 0x5cfd60
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0047467d
mov esp, ebp
pop ebp
ret

Function at 0x454f60
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x68
mov eax, dword [0x5c524c]
xor eax, ebp
mov dword [ebp - 4], eax
xor eax, eax
mov dword [ebp - 0x68], 0x740068
push ebx
push esi
mov word [ebp - 8], ax
lea esi, [ebp - 0x68]
mov eax, 0x5cf9e0
mov dword [ebp - 0x64], 0x700074
push edi
mov dword [ebp - 0x60], 0x3a0073
mov edx, 0x32
mov dword [ebp - 0x5c], 0x2f002f
sub esi, eax
mov dword [ebp - 0x58], 0x610077
mov dword [ebp - 0x54], 0x2e006e
mov dword [ebp - 0x50], 0x75006c
mov dword [ebp - 0x4c], 0x610064
mov dword [ebp - 0x48], 0x680073
mov dword [ebp - 0x44], 0x2e0069
mov dword [ebp - 0x40], 0x6f0063
mov dword [ebp - 0x3c], 0x2f006d
mov dword [ebp - 0x38], 0x6d0063
mov dword [ebp - 0x34], 0x2f0073
mov dword [ebp - 0x30], 0x700061
mov dword [ebp - 0x2c], 0x2f0069
mov dword [ebp - 0x28], 0x69006d
mov dword [ebp - 0x24], 0x720063
mov dword [ebp - 0x20], 0x5f006f
mov dword [ebp - 0x1c], 0x6c0063
mov dword [ebp - 0x18], 0x650069
mov dword [ebp - 0x14], 0x74006e
mov dword [ebp - 0x10], 0x70002e
mov dword [ebp - 0xc], 0x700068
lea ecx, [edx + 0x7fffffcc]
test ecx, ecx
je 0x45504e
movzx ecx, word [esi + eax]
test cx, cx
je 0x45504e
mov word [eax], cx
add eax, 2
sub edx, 1
jne 0x455030
lea ecx, [eax - 2]
test edx, edx
pop edi
cmovne ecx, eax
xor eax, eax
pop esi
pop ebx
mov word [ecx], ax
mov eax, 0x5cf9e0
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0047467d
mov esp, ebp
pop ebp
ret
Function at 0x10001330
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100053b0
mov eax, dword fs:[0]
push eax
sub esp, 0x38
mov eax, dword [0x10009008]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
push str.HeapFree
push str.kernel32.dll
mov dword [ebp - 0x3c], ecx
mov dword [ebp - 0x24], 0x4e52454b
mov dword [ebp - 0x20], 0x32334c45
mov dword [ebp - 0x1c], 0x6c6c642e
mov byte [ebp - 0x18], 0
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x44], eax
lea eax, [ebp - 0x34]
push eax
lea eax, [ebp - 0x24]
mov dword [ebp - 0x34], 0x50746547
push eax
mov dword [ebp - 0x30], 0x65636f72
mov dword [ebp - 0x2c], 0x65487373
mov word [ebp - 0x28], 0x7061
mov byte [ebp - 0x26], 0
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x40], eax
nop
nop
nop
nop
nop
push 0x100074c4
lea eax, [ebp - 0x38]
mov dword [ebp - 4], 0
push eax
mov dword [ebp - 0x38], 0x63
call sub.VCRUNTIME140.dll__CxxThrowException
inc eax
dec ebx
dec eax
inc ebx
push dword [ebp - 0x3c]
push 0
call dword [ebp - 0x40]
push eax
call dword [ebp - 0x44]
mov eax, 0x10001402
ret
Function at 0x10001430
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100053e0
mov eax, dword fs:[0]
push eax
sub esp, 0x24
push ebx
push esi
push edi
mov eax, dword [0x10009008]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x28], edx
mov dword [ebp - 0x30], ecx
push 0x10006354
push str.kernel32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
nop
nop
nop
inc eax
dec ebx
dec eax
inc ebx
mov ecx, dword [ebp + 8]
push 0x100074c4
mov eax, dword [ecx + 4]
mov ecx, dword [ecx]
mov dword [ebp - 0x18], eax
movzx eax, word [ecx + 0x14]
add eax, 0x18
mov dword [ebp - 4], 0
add eax, ecx
mov dword [ebp - 0x24], 0x50
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x24]
push eax
call sub.VCRUNTIME140.dll__CxxThrowException
mov dword [ebp - 0x10], esp
inc eax
dec ebx
dec eax
inc ebx
mov esi, dword [ebp - 0x14]
xor edi, edi
mov eax, dword [ebp + 8]
mov dword [ebp - 0x20], edi
mov eax, dword [eax]
movzx eax, word [eax + 6]
cmp edi, eax
jge 0x10001554
cmp dword [esi + 0x10], 0
jne 0x1000156c
mov eax, dword [ebp - 0x28]
mov ebx, dword [eax + 0x38]
test ebx, ebx
jle 0x10001548
mov eax, dword [esi + 0xc]
add eax, dword [ebp - 0x18]
push 4
push 0x1000
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
push ebx
push 0
push eax
mov dword [esi + 8], eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
inc edi
add esi, 0x28
mov dword [ebp - 0x14], esi
jmp 0x100014be
inc edi
add esi, 0x28
mov dword [ebp - 0x14], esi
jmp 0x100014be
mov eax, 0x1000155a
ret
inc eax
dec ebx
dec eax
inc ebx
mov eax, dword [esi + 0xc]
add eax, dword [ebp - 0x18]
push 4
push 0x1000
push dword [esi + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov dword [ebp - 0x1c], eax
lea eax, [ebp - 0x2c]
push 0x100074c4
mov byte [ebp - 4], 2
push eax
mov dword [ebp - 0x2c], 0x55
call sub.VCRUNTIME140.dll__CxxThrowException
int3
Function at 0x100016b0
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10005420
mov eax, dword fs:[0]
push eax
sub esp, 0x18
mov eax, dword [0x10009008]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov ebx, ecx
mov edi, dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push 0x1000638c
push str.kernel32.dll
mov dword [ebp - 0x20], ebx
call edi
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call esi
nop
nop
nop
nop
nop
push 0x10006398
push str.kernel32.dll
call edi
push eax
call esi
mov dword [ebp - 0x24], eax
mov eax, dword [ebx]
movzx ecx, word [eax + 0x14]
add ecx, eax
mov dword [ebp - 0x18], ecx
nop
nop
nop
nop
nop
nop
nop
nop
nop
push 0x100074c4
lea eax, [ebp - 0x1c]
mov dword [ebp - 4], 0
push eax
mov dword [ebp - 0x1c], 0x40
call sub.VCRUNTIME140.dll__CxxThrowException
mov edi, dword [ebp - 0x20]
xor ecx, ecx
xor ebx, ebx
mov eax, dword [edi]
cmp cx, word [eax + 6]
jae 0x1000180e
mov esi, dword [ebp - 0x18]
add esi, 0x3c
nop
mov eax, dword [esi]
mov ecx, dword [esi]
mov edx, dword [esi]
shr eax, 0x1d
shr ecx, 0x1e
and eax, 1
and ecx, 1
shr edx, 0x1f
nop
nop
nop
nop
test dword [esi], 0x2000000
je 0x10001794
push 0x4000
push dword [esi - 0x14]
push dword [esi - 0x1c]
call dword [sym.imp.KERNEL32.dll_VirtualFree]
jmp 0x100017fc
nop
nop
nop
nop
nop
test dword [esi], 0x4000000
lea eax, [ecx + eax*2]
lea eax, [edx + eax*2]
mov ecx, dword [eax*4 + 0x10006478]
je 0x100017b4
or ecx, 0x200
nop
nop
nop
nop
nop
nop
mov eax, dword [esi - 0x14]
test eax, eax
jne 0x100017d7
test byte [esi], 0x40
je 0x100017cd
mov eax, dword [edi]
mov eax, dword [eax + 0x20]
jmp 0x100017d7
test byte [esi], 0x80
je 0x100017d7
mov eax, dword [edi]
mov eax, dword [eax + 0x24]
nop
nop
nop
nop
nop
nop
test eax, eax
je 0x100017fc
lea eax, [ebp - 0x18]
push eax
push ecx
push dword [esi - 0x14]
push dword [esi - 0x1c]
call dword [ebp - 0x24]
test eax, eax
jne 0x100017fc
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, dword [edi]
inc ebx
add esi, 0x28
movzx eax, word [eax + 6]
cmp ebx, eax
jl 0x10001760
mov eax, 0x10001814
ret
Function at 0x10002040
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100054f0
mov eax, dword fs:[0]
push eax
sub esp, 0x38
mov eax, dword [0x10009008]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov edi, dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push str.HeapFree
push str.kernel32.dll
mov dword [ebp - 0x38], ecx
call edi
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call esi
mov dword [ebp - 0x44], eax
nop
nop
nop
inc eax
dec ebx
dec eax
inc ebx
lea eax, [ebp - 0x20]
mov dword [ebp - 0x30], 0x4e52454b
push eax
lea eax, [ebp - 0x30]
mov dword [ebp - 0x2c], 0x32334c45
push eax
mov dword [ebp - 0x28], 0x6c6c642e
mov byte [ebp - 0x24], 0
mov dword [ebp - 0x20], 0x74726956
mov dword [ebp - 0x1c], 0x466c6175
mov dword [ebp - 0x18], 0x656572
call edi
push eax
call esi
push str.GetProcessHeap
push 0x100063a8
mov dword [ebp - 0x3c], eax
call edi
push eax
call esi
mov dword [ebp - 0x40], eax
nop
nop
nop
nop
nop
nop
nop
nop
push 0x100074c4
lea eax, [ebp - 0x34]
mov dword [ebp - 4], 0
push eax
mov dword [ebp - 0x34], 0x44
call sub.VCRUNTIME140.dll__CxxThrowException
mov esi, dword [ebp - 0x38]
test esi, esi
je 0x10002197
cmp dword [esi + 0x10], 0
je 0x10002137
mov eax, dword [esi]
mov ecx, dword [eax + 0x28]
add ecx, dword [esi + 4]
inc eax
dec ebx
dec eax
inc ebx
push 0
push 0
push dword [esi + 4]
call ecx
mov dword [esi + 0x10], 0
nop
nop
nop
cmp dword [esi + 8], 0
je 0x10002170
xor edi, edi
cmp dword [esi + 0xc], edi
jle 0x10002164
mov ebx, dword [sym.imp.KERNEL32.dll_FreeLibrary]
nop dword [eax]
mov eax, dword [esi + 8]
cmp dword [eax + edi*4], 0xffffffff
je 0x1000215e
push dword [eax + edi*4]
call ebx
inc edi
cmp edi, dword [esi + 0xc]
jl 0x10002150
inc eax
dec ebx
dec eax
inc ebx
mov ecx, dword [esi + 8]
call fcn.10001330
inc eax
dec ebx
dec eax
inc ebx
cmp dword [esi + 4], 0
je 0x10002187
push ??1?$basic_ios@DU?$char_traits@D@std@@@std@@UAE@XZ
push 0
push dword [esi + 4]
call dword [ebp - 0x3c]
nop
nop
nop
nop
nop
nop
push esi
push 0
call dword [ebp - 0x40]
push eax
call dword [ebp - 0x44]
mov eax, 0x1000219d
ret
Function at 0x10002ec0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x1c
push ebx
mov ebx, ecx
push esi
push edi
cmp dword [ebx + 0x38], 0
je 0x10002eec
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____thiscall_std::basic_streambuf_char__struct_std::char_traits_char__::xsputn_char_const___long_long___int64__]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov eax, dword [ebx + 0x20]
mov esi, dword [ebp + 0xc]
mov edi, dword [ebp + 0x10]
mov dword [esp + 0x20], esi
mov ecx, dword [eax]
lea eax, [ebx + 0x30]
mov dword [esp + 0x24], edi
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x18], eax
test ecx, ecx
je 0x10002f14
mov eax, dword [eax]
mov ecx, dword [eax]
jmp 0x10002f1a
xor ecx, ecx
mov dword [esp + 0x18], eax
mov eax, ecx
cdq
mov dword [esp + 0x10], eax
mov ecx, edx
mov dword [esp + 0x14], ecx
test edi, edi
jl 0x10002f82
jg 0x10002f31
test esi, esi
je 0x10002f82
test ecx, ecx
jl 0x10002f7d
jg 0x10002f3b
test eax, eax
je 0x10002f7d
cmp edi, ecx
jg 0x10002f4f
jl 0x10002f45
cmp esi, eax
jae 0x10002f4f
mov eax, esi
mov dword [esp + 0x10], esi
mov dword [esp + 0x14], edi
push eax
push dword [ebp + 8]
push dword [esp + 0x24]
call sub.VCRUNTIME140.dll_memcpy
mov eax, dword [esp + 0x24]
add esp, 0xc
mov edx, dword [esp + 0x10]
mov ecx, dword [ebp + 8]
add ecx, edx
sub esi, edx
mov eax, dword [eax]
sbb edi, dword [esp + 0x14]
sub dword [eax], edx
mov eax, dword [ebx + 0x20]
add dword [eax], edx
jmp 0x10002f85
mov ecx, dword [ebp + 8]
jmp 0x10002f8f
mov ecx, dword [ebp + 8]
test edi, edi
jl 0x10002fa9
jg 0x10002f8f
test esi, esi
je 0x10002fa9
mov eax, dword [ebx + 0x4c]
test eax, eax
je 0x10002fa9
push eax
push esi
push 1
push ecx
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
add esp, 0x10
sub esi, eax
sbb edi, 0
mov eax, dword [esp + 0x20]
mov edx, dword [esp + 0x24]
sub eax, esi
sbb edx, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x10002fc0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [ebp + 0x10]
push ebx
mov ebx, ecx
mov ecx, dword [ebp + 0xc]
push esi
mov esi, dword [ebp + 8]
mov dword [ebp - 4], esi
test eax, eax
jg 0x10002fec
jl 0x10002fe0
test ecx, ecx
jne 0x10002fec
pop esi
xor eax, eax
xor edx, edx
pop ebx
mov esp, ebp
pop ebp
ret 0xc
cmp dword [ebx + 0x38], 0
je 0x10003005
push eax
push ecx
push esi
mov ecx, ebx
call dword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____thiscall_std::basic_streambuf_char__struct_std::char_traits_char__::xsgetn_char___long_long___int64__]
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov eax, dword [ebx + 0x1c]
push edi
mov edi, ecx
mov eax, dword [eax]
mov dword [ebp - 8], eax
test eax, eax
je 0x10003053
mov eax, dword [ebx + 0x2c]
lea edx, [ebx + 0x2c]
mov dword [ebp - 0xc], edx
mov eax, dword [eax]
test eax, eax
je 0x10003059
mov edi, dword [ebp - 4]
cmp eax, ecx
mov esi, ecx
cmovb esi, eax
push esi
push dword [ebp - 8]
push edi
call sub.VCRUNTIME140.dll_memcpy
mov eax, dword [ebx + 0x2c]
add edi, esi
mov dword [ebp - 4], edi
add esp, 0xc
mov edi, dword [ebp + 0xc]
sub edi, esi
sub dword [eax], esi
mov eax, dword [ebx + 0x1c]
add dword [eax], esi
mov esi, dword [ebp - 4]
jmp 0x10003059
lea eax, [ebx + 0x2c]
mov dword [ebp - 0xc], eax
cmp dword [ebx + 0x4c], 0
je 0x100030c6
mov ecx, dword [ebx + 0xc]
lea eax, [ebx + 0x3c]
cmp dword [ecx], eax
jne 0x10003082
mov eax, dword [ebx + 0xc]
mov edx, dword [ebx + 0x54]
mov ecx, dword [ebx + 0x50]
sub edx, ecx
mov dword [eax], ecx
mov eax, dword [ebx + 0x1c]
mov dword [eax], ecx
mov eax, dword [ebp - 0xc]
mov eax, dword [eax]
mov dword [eax], edx
mov eax, dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
cmp edi, 0xfff
jbe 0x100030b4
nop
push dword [ebx + 0x4c]
push 0xfff
push 1
push esi
call eax
add esp, 0x10
add esi, eax
sub edi, eax
cmp eax, 0xfff
jne 0x100030c6
cmp edi, eax
mov eax, dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
ja 0x10003090
test edi, edi
je 0x100030c6
push dword [ebx + 0x4c]
push edi
push 1
push esi
call eax
add esp, 0x10
sub edi, eax
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 0x10]
sub eax, edi
pop edi
pop esi
sbb edx, 0
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x10003440
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
mov eax, dword [0x10009008]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, ecx
cmp ebx, 0xffffffff
jne 0x10003470
pop esi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1000437e
mov esp, ebp
pop ebp
ret 4
mov eax, dword [esi + 0x20]
mov eax, dword [eax]
test eax, eax
je 0x100034a0
mov edx, dword [esi + 0x30]
mov edx, dword [edx]
add edx, eax
cmp eax, edx
jae 0x100034a0
call dword [sym.imp.MSVCP140.dll_protected:_char____thiscall_std::basic_streambuf_char__struct_std::char_traits_char__::_Pninc_void_]
pop esi
mov byte [eax], bl
mov eax, ebx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1000437e
mov esp, ebp
pop ebp
ret 4
cmp dword [esi + 0x4c], 0
push edi
je 0x10003578
mov edi, dword [esi + 0xc]
lea eax, [esi + 0x3c]
cmp dword [edi], eax
jne 0x100034c9
mov edx, dword [esi + 0x54]
mov ecx, dword [esi + 0x50]
sub edx, ecx
mov dword [edi], ecx
mov eax, dword [esi + 0x1c]
mov dword [eax], ecx
mov eax, dword [esi + 0x2c]
mov dword [eax], edx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x100034d5
movsx eax, bl
jmp 0x1000350d
lea eax, [ebp - 0x2c]
mov byte [ebp - 0x25], bl
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x25]
push eax
lea eax, [esi + 0x40]
push eax
call dword [sym.imp.MSVCP140.dll_public:_int___thiscall_std::codecvt_char__char__struct__Mbstatet_::out_struct__Mbstatet___char_const___char_const___char_const____char___char___char___const]
sub eax, 0
je 0x10003537
sub eax, 1
je 0x10003537
sub eax, 2
jne 0x10003578
movsx eax, byte [ebp - 0x25]
push dword [esi + 0x4c]
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
add esp, 8
or ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, ebx
pop edi
pop esi
mov eax, ecx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1000437e
mov esp, ebp
pop ebp
ret 4
mov edi, dword [ebp - 0x2c]
lea eax, [ebp - 0x24]
sub edi, eax
je 0x10003555
push dword [esi + 0x4c]
push edi
push 1
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
add esp, 0x10
cmp edi, eax
jne 0x10003578
lea ecx, [ebp - 0x25]
mov byte [esi + 0x3d], 1
or eax, 0xffffffff
cmp dword [ebp - 0x30], ecx
pop edi
pop esi
cmovne eax, ebx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1000437e
mov esp, ebp
pop ebp
ret 4
mov ecx, dword [ebp - 4]
or eax, 0xffffffff
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1000437e
mov esp, ebp
pop ebp
ret 4
Function at 0x10003810
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x10009008]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, ecx
cmp dword [esi + 0x38], 0
je 0x100038cc
cmp byte [esi + 0x3d], 0
je 0x100038cc
mov eax, dword [esi]
push edi
push 0xffffffffffffffff
call dword [eax + 0xc]
cmp eax, 0xffffffff
je 0x100038ba
mov ecx, dword [esi + 0x38]
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [esi + 0x40]
push eax
call dword [sym.imp.MSVCP140.dll_public:_int___thiscall_std::codecvt_char__char__struct__Mbstatet_::unshift_struct__Mbstatet___char___char___char___const]
sub eax, 0
je 0x10003881
sub eax, 1
je 0x10003885
sub eax, 2
jne 0x100038ba
mov byte [esi + 0x3d], al
mov al, 1
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1000437e
mov esp, ebp
pop ebp
ret
mov byte [esi + 0x3d], 0
mov edi, dword [ebp - 0x28]
lea eax, [ebp - 0x24]
sub edi, eax
je 0x100038a3
push dword [esi + 0x4c]
push edi
push 1
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
add esp, 0x10
cmp edi, eax
jne 0x100038ba
cmp byte [esi + 0x3d], 0
pop edi
sete al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1000437e
mov esp, ebp
pop ebp
ret
pop edi
xor al, al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1000437e
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
mov al, 1
xor ecx, ebp
pop esi
call fcn.1000437e
mov esp, ebp
pop ebp
ret