joyce8/EMBER2024-capa huggingface dataset:
Function at 0x180d97b7
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
mov esi, ecx
mov ecx, 0x18211710
push edi
call fcn.1801f0d2
mov ecx, 0x18211610
mov dword [esi + 0x10], 0xc
call fcn.1801f0d2
xor eax, eax
lea ecx, [ebp - 4]
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], eax
call fcn.18009c8e
push str.update
mov esi, 0x181e03d4
lea eax, [ebp - 4]
push esi
push eax
call fcn.18013d2c
add esp, 0xc
lea edx, [ebp - 0x1c]
lea ecx, [ebp - 4]
call fcn.180d9567
mov ebx, dword [ebp - 0x1c]
test eax, eax
js 0x180d9890
cmp ebx, dword [ebp - 0x18]
je 0x180d9828
mov edi, 0x80040712
jmp 0x180d998b
push str.uninstall
lea eax, [ebp - 4]
push esi
push eax
call fcn.18013d2c
add esp, 0xc
lea edx, [ebp - 0x1c]
lea ecx, [ebp - 4]
call fcn.180d9567
mov ebx, dword [ebp - 0x1c]
test eax, eax
js 0x180d9890
cmp ebx, dword [ebp - 0x18]
je 0x180d985b
mov edi, 0xa0430721
jmp 0x180d998b
push str.install
lea eax, [ebp - 4]
push esi
push eax
call fcn.18013d2c
add esp, 0xc
lea edx, [ebp - 0x1c]
lea ecx, [ebp - 4]
call fcn.180d9567
mov ebx, dword [ebp - 0x1c]
test eax, eax
js 0x180d9890
mov edi, dword [ebp - 0x18]
cmp ebx, edi
je 0x180d9890
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
test eax, eax
jne 0x180d989a
mov edi, 0x80040706
jmp 0x180d998b
push eax
lea ecx, [ebp - 8]
call fcn.18006d98
mov esi, dword [ebp - 8]
cmp dword [esi - 0xc], 0
je 0x180d997e
push 0
push str.MicrosoftEdgeUpdate.exe
lea ecx, [ebp - 8]
call fcn.18011f97
mov dword [ebp - 0xc], eax
cmp eax, 0xffffffff
je 0x180d997e
push str.MicrosoftEdgeUpdate.exe
call fcn.18165959
add eax, dword [ebp - 0xc]
pop ecx
push eax
lea ecx, [ebp - 8]
mov dword [ebp - 0xc], eax
call fcn.18009dbc
push 0x22
pop ecx
cmp cx, ax
mov ecx, dword [ebp - 0xc]
jne 0x180d98f1
inc ecx
mov eax, dword [esi - 0xc]
sub eax, ecx
lea ecx, [ebp - 8]
push eax
lea eax, [ebp - 0x10]
push eax
call fcn.1800db4b
lea ecx, [ebp - 0x10]
call fcn.18011e9f
and dword [ebp - 0xc], 0
sub edi, ebx
sar edi, 2
test edi, edi
je 0x180d995a
lea ecx, [ebp - 8]
call fcn.18009c8e
mov ecx, dword [ebp - 0xc]
lea edx, [ebp - 8]
mov ecx, dword [ebx + ecx*4]
call fcn.18014fed
test eax, eax
js 0x180d9944
push 0
push dword [ebp - 0x10]
lea ecx, [ebp - 8]
call fcn.18011f97
cmp eax, 0xffffffff
jne 0x180d996c
mov ecx, dword [ebp - 8]
add ecx, 0xfffffff0
call fcn.1800687d
mov eax, dword [ebp - 0xc]
inc eax
mov dword [ebp - 0xc], eax
cmp eax, edi
jb 0x180d9918
mov edi, 0x80040711
mov ecx, dword [ebp - 0x10]
lea ecx, [ecx - 0x10]
call fcn.1800687d
jmp 0x180d9983
mov ecx, dword [ebp - 8]
lea ecx, [ecx - 0x10]
call fcn.1800687d
mov edi, 0x80040710
jmp 0x180d995f
mov edi, 0x80040706
lea ecx, [esi - 0x10]
call fcn.1800687d
mov ecx, dword [ebp - 4]
lea ecx, [ecx - 0x10]
call fcn.1800687d
test ebx, ebx
je 0x180d99ab
mov ecx, dword [ebp - 0x14]
sub ecx, ebx
and ecx, 0xfffffffc
push ecx
push ebx
call fcn.1800a00f
pop ecx
pop ecx
mov eax, edi
pop edi
pop esi
pop ebx
leave
ret 4
Function at 0x180daebd
Capabilities:
Query service status
Start service

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
mov eax, dword [0x1820f00c]
xor eax, ebp
mov dword [ebp - 4], eax
movzx ecx, byte [0x18217983]
push ebx
push esi
neg ecx
push edi
sbb ecx, ecx
push 7
pop edi
and ecx, 0x18217880
je 0x180daf0c
xor eax, eax
mov dword [ebp - 0x38], ecx
inc eax
mov dword [ebp - 0x34], edi
push eax
push edi
mov dword [ebp - 0x30], eax
call fcn.18008988
mov dword [ebp - 0x2c], eax
lea eax, [ebp - 0x38]
push str._StartService_
push eax
call fcn.18006aa4
pop ecx
pop ecx
push 0xf003f
xor ebx, ebx
push ebx
push ebx
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov esi, eax
mov dword [ebp - 0x28], esi
test esi, esi
jne 0x180daf30
call fcn.18017850
mov ebx, eax
jmp 0x180dafb3
lea ecx, [ebp - 0x24]
call fcn.18060411
push 0x14
push dword [ebp - 0x24]
push esi
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov esi, eax
test esi, esi
jne 0x180daf53
call fcn.18017850
mov ebx, eax
jmp 0x180daf90
mov ecx, edi
xor eax, eax
lea edi, [ebp - 0x20]
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x20]
push eax
push esi
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
test eax, eax
je 0x180daf77
cmp dword [ebp - 0x1c], 4
je 0x180daf90
cmp dword [ebp - 0x1c], 2
je 0x180daf90
push ebx
push ebx
push esi
call dword [sym.imp.ADVAPI32.dll_StartServiceW]
test eax, eax
jne 0x180daf90
call fcn.18017850
cmp eax, 0x80070420
jne 0x180daf96
test esi, esi
je 0x180daf9f
jmp 0x180daf98
mov ebx, eax
push esi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov ecx, dword [ebp - 0x24]
lea ecx, [ecx - 0x10]
call fcn.1800687d
push dword [ebp - 0x28]
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov ecx, dword [ebp - 4]
mov eax, ebx
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1814cf3d
leave
ret
Function at 0x180db69f
Capabilities:
Get common file path
Set current directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x21c
mov eax, dword [0x1820f00c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov ebx, ecx
lea ecx, [ebp - 0x214]
push edi
call fcn.180127d3
xor edi, edi
mov esi, dword [eax]
xor eax, eax
mov word [ebp - 0x210], ax
test esi, esi
je 0x180db6f1
cmp word [esi], di
je 0x180db6f1
lea eax, [ebp - 0x210]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
push esi
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
mov ecx, dword [ebp - 0x214]
lea ecx, [ecx - 0x10]
call fcn.1800687d
cmp byte [ebx], 0
je 0x180db71a
call fcn.1801a8a4
lea eax, [ebp - 0x218]
push eax
call fcn.1801b759
xor ebx, ebx
inc ebx
jmp 0x180db730
call fcn.1801a8a4
lea eax, [ebp - 0x214]
push eax
call fcn.1801aace
push 2
mov ebx, edi
pop edi
mov ecx, dword [eax]
sub ecx, 0x10
call fcn.18009e91
mov esi, eax
test edi, edi
je 0x180db74e
mov ecx, dword [ebp - 0x214]
lea ecx, [ecx - 0x10]
call fcn.1800687d
test ebx, ebx
je 0x180db760
mov ecx, dword [ebp - 0x218]
lea ecx, [ecx - 0x10]
call fcn.1800687d
lea ecx, [esi + 0x10]
call fcn.1800c005
lea ecx, [esi]
call fcn.1800687d
cmp word [ebp - 0x210], 0
je 0x180db786
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1814cf3d
leave
ret
Function at 0x180e177c
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov ebx, ecx
mov dword [ebp - 4], edx
push 0
push 0x14
and dword [ebx], 0
call fcn.180dfa31
mov esi, eax
pop ecx
pop ecx
test esi, esi
jne 0x180e17a0
push 7
pop eax
jmp 0x180e1811
cmp dword [0x1820fdfc], 0
push edi
mov edi, dword [ebp + 8]
je 0x180e17e8
mov eax, dword [0x1820fefc]
test eax, eax
je 0x180e17c2
push 0xc8
call eax
pop ecx
test eax, eax
jne 0x180e17e8
mov eax, dword [ebp - 4]
mov dword [esi + 8], eax
lea eax, [esi + 4]
push eax
xor eax, eax
mov dword [esi + 0xc], edi
push eax
push esi
push 0x180e175c
push eax
push eax
call fcn.1818aae9
add esp, 0x18
mov dword [esi], eax
test eax, eax
jne 0x180e17f5
push 0x14
push 0
push esi
call fcn.181620e0
add esp, 0xc
cmp dword [esi + 8], 0
jne 0x180e180c
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push edi
mov dword [esi + 4], eax
call dword [ebp - 4]
pop ecx
mov dword [esi + 0x10], eax
mov dword [ebx], esi
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret

Function at 0x180e93ae
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, ecx
mov ebx, edx
mov esi, dword [edi + 0x88]
test esi, esi
je 0x180e93e6
mov eax, dword [ebp + 0xc]
push 8
push 0
mov dword [eax], esi
mov eax, dword [esi + 0x10]
mov dword [edi + 0x88], eax
push dword [esi + 8]
and dword [esi + 0x10], 0
call fcn.181620e0
add esp, 0xc
jmp 0x180e9446
movzx eax, word [edi + 0x8c]
cdq
add eax, 0x28
adc edx, 0
push edx
push eax
call fcn.180dfd64
pop ecx
pop ecx
mov ecx, dword [ebp + 0xc]
mov esi, eax
mov dword [ecx], esi
test esi, esi
jne 0x180e942f
mov eax, dword [edi + 0x98]
lea ecx, [ebx - 1]
push esi
cdq
push ecx
push edx
push eax
call fcn.18186280
mov ecx, dword [edi + 0x3c]
push edx
mov edx, dword [ebp + 8]
push eax
call fcn.180df33c
pop ecx
pop ecx
push 7
pop eax
jmp 0x180e9454
lea eax, [esi + 0x28]
mov dword [esi + 0x14], edi
mov dword [esi + 8], eax
push 0x20
pop eax
mov word [esi + 0x1c], ax
xor eax, eax
inc eax
mov word [esi + 0x1e], ax
mov eax, dword [ebp + 8]
mov dword [esi + 4], eax
mov dword [esi + 0x18], ebx
inc dword [edi + 0x78]
xor eax, eax
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret
Function at 0x1813b6b9
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x134
mov eax, dword [0x1820f00c]
xor eax, ebp
mov dword [ebp - 4], eax
movzx eax, word [ebp + 8]
push esi
mov esi, dword [0x18216000]
push edi
push 0xf0
push eax
xor edi, edi
mov dword [ebp - 0x10c], ecx
push esi
inc edi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
test eax, eax
je 0x1813b828
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x1813b828
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x1813b828
push ebx
movzx eax, word [esi]
xor ecx, ecx
cmp cx, ax
je 0x1813b827
mov ecx, dword [esi + 4]
mov ebx, eax
movzx eax, word [esi + 2]
add esi, 8
mov dword [ebp - 0x110], ecx
mov ecx, 0x403
cmp cx, ax
jne 0x1813b7a0
push 3
lea eax, [ebp - 0x104]
push esi
lea ecx, [ebp - 0x108]
mov dword [ebp - 0x108], eax
call fcn.18035567
push dword [ebp - 0x108]
mov eax, dword [ebp - 0x10c]
push 0
push 0x143
push ebx
push dword [eax + 4]
call dword [sym.imp.USER32.dll_SendDlgItemMessageW]
inc eax
neg eax
sbb eax, eax
and edi, eax
lea eax, [ebp - 0x104]
cmp dword [ebp - 0x108], eax
je 0x1813b815
push dword [ebp - 0x108]
call fcn.1816581c
pop ecx
jmp 0x1813b815
mov ecx, 0x1234
cmp cx, ax
jne 0x1813b815
or dword [ebp - 0x130], 0xffffffff
lea eax, [ebp - 0x104]
push 3
push esi
lea ecx, [ebp - 0x108]
mov dword [ebp - 0x134], 1
mov dword [ebp - 0x108], eax
call fcn.18035567
mov eax, dword [ebp - 0x108]
lea ecx, [ebp - 0x104]
mov dword [ebp - 0x12c], eax
cmp eax, ecx
je 0x1813b7f2
push eax
call fcn.1816581c
pop ecx
lea eax, [ebp - 0x134]
push eax
mov eax, dword [ebp - 0x10c]
push 0
push 0x40b
push ebx
push dword [eax + 4]
call dword [sym.imp.USER32.dll_SendDlgItemMessageW]
cmp eax, 0xffffffff
je 0x1813b825
add esi, dword [ebp - 0x110]
test edi, edi
jne 0x1813b718
jmp 0x1813b827
xor edi, edi
pop ebx
mov ecx, dword [ebp - 4]
mov eax, edi
pop edi
xor ecx, ebp
pop esi
call fcn.1814cf3d
leave
ret 4
Function at 0x1813d874
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
push edi
mov esi, ecx
call fcn.1813ca25
lea edi, [esi + 0x1e4]
xor ecx, ecx
mov edx, dword [edi]
inc ecx
mov ebx, 0x100
mov eax, dword [edx - 8]
sub ecx, dword [edx - 4]
sub eax, ebx
or eax, ecx
jge 0x1813d8a9
push ebx
mov ecx, edi
call fcn.18006f9e
mov edx, dword [edi]
push ebx
push edx
push dword [esi + 4]
call dword [sym.imp.USER32.dll_GetWindowTextW]
push 0xffffffffffffffff
mov ecx, edi
call fcn.18009cb5
push 1
mov ecx, esi
call fcn.1813f27b
push 8
call fcn.1814d7d1
pop ecx
mov ecx, eax
call fcn.1802f424
mov ecx, dword [esi + 0x1c4]
mov dword [esi + 0x1c4], eax
test ecx, ecx
je 0x1813d8ef
push 8
push ecx
call fcn.1814d45b
pop ecx
pop ecx
mov ebx, dword [sym.imp.USER32.dll_GetDlgItem]
push 0x7d9
push dword [esi + 4]
call ebx
xor edi, edi
push edi
push 1
push 0x40a
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
lea eax, [ebp - 4]
mov dword [ebp - 4], edi
push eax
push 0x182024d8
push 3
push edi
push 0x181eb104
call dword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
js 0x1813d94b
mov edi, dword [ebp - 4]
and dword [ebp - 4], 0
mov ecx, dword [esi + 0x1ec]
test ecx, ecx
je 0x1813d945
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
mov dword [esi + 0x1ec], edi
mov ecx, esi
call fcn.1813e7fd
lea ecx, [ebp - 8]
call fcn.18009c8e
push 0xbdc
lea ecx, [ebp - 8]
call fcn.18006f4a
lea eax, [ebp - 8]
mov ecx, esi
push eax
call fcn.1813f2ed
mov ecx, esi
call fcn.1813f24c
push 0x7db
push dword [esi + 4]
call ebx
push eax
call dword [sym.imp.USER32.dll_SetFocus]
mov ecx, dword [ebp - 8]
lea ecx, [ecx - 0x10]
call fcn.1800687d
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
test eax, eax
je 0x1813d9a5
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
xor eax, eax
leave
ret 0x10

Function at 0x1813e8cb
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, ecx
mov ecx, dword [ebp + 8]
call fcn.1801f7f1
test al, al
je 0x1813e8f6
push 0x7dc
push dword [esi + 4]
call dword [sym.imp.USER32.dll_GetDlgItem]
push 0
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
jmp 0x1813e924
lea ecx, [ebp + 8]
call fcn.18009c8e
push dword [ebp + 0xc]
lea ecx, [ebp + 8]
call fcn.18006f4a
lea eax, [ebp + 8]
mov ecx, esi
push eax
push 0x7dc
call fcn.1813e749
mov ecx, dword [ebp + 8]
lea ecx, [ecx - 0x10]
call fcn.1800687d
pop esi
pop ebp
ret 8
Function at 0x18141bef
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x74
mov eax, dword [0x1820f00c]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x14]
push ebx
push esi
push edi
mov dword [eax], 1
mov ebx, ecx
lea eax, [ebp - 0x14]
xor esi, esi
push eax
mov dword [ebp - 0x14], esi
push dword [ebx + 4]
mov dword [ebp - 0x10], esi
mov dword [ebp - 0xc], esi
mov dword [ebp - 8], esi
call dword [sym.imp.USER32.dll_GetClientRect]
mov eax, dword [ebx + 4]
lea ecx, [ebp - 0x58]
push ecx
push eax
mov dword [ebp - 0x60], esi
mov dword [ebp - 0x5c], eax
call dword [sym.imp.USER32.dll_BeginPaint]
cmp byte [ebx + 0x28], 0
mov dword [ebp - 0x60], eax
je 0x18141c4a
mov ecx, dword [ebx + 0x38]
jmp 0x18141c58
cmp byte [ebx + 0x27], 0
je 0x18141c55
mov ecx, dword [ebx + 0x34]
jmp 0x18141c58
mov ecx, dword [ebx + 0x30]
push ecx
push eax
call dword [sym.imp.GDI32.dll_SelectObject]
push dword [ebx + 0x44]
push dword [ebp - 0x60]
call dword [sym.imp.GDI32.dll_SelectObject]
push 2
push 2
push dword [ebp - 8]
push dword [ebp - 0xc]
push dword [ebp - 0x10]
push dword [ebp - 0x14]
push dword [ebp - 0x60]
call dword [sym.imp.GDI32.dll_RoundRect]
cmp byte [ebx + 0x29], 0
je 0x18141ca2
lea esi, [ebp - 0x14]
lea edi, [ebp - 0x70]
movsd dword es:[edi], dword [esi]
lea eax, [ebp - 0x70]
push eax
push dword [ebp - 0x60]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
call dword [sym.imp.USER32.dll_DrawFocusRect]
push dword [ebx + 4]
call dword [sym.imp.USER32.dll_GetWindowTextLengthW]
mov esi, eax
test esi, esi
je 0x18141d28
lea ecx, [ebp - 0x74]
call fcn.18009c8e
inc esi
lea ecx, [ebp - 0x74]
push esi
call fcn.18006e57
push esi
push eax
push dword [ebx + 4]
call dword [sym.imp.USER32.dll_GetWindowTextW]
push 0xffffffffffffffff
lea ecx, [ebp - 0x74]
call fcn.18009cb5
push dword [ebx + 0x2c]
push dword [ebp - 0x60]
call dword [sym.imp.GDI32.dll_SelectObject]
cmp byte [ebx + 0x27], 0
je 0x18141cef
mov eax, dword [ebx + 0x40]
jmp 0x18141cf2
mov eax, dword [ebx + 0x3c]
push eax
push dword [ebp - 0x60]
call dword [sym.imp.GDI32.dll_SetTextColor]
push 1
push dword [ebp - 0x60]
call dword [sym.imp.GDI32.dll_SetBkMode]
push 0x25
lea eax, [ebp - 0x14]
push eax
mov eax, dword [ebp - 0x74]
push dword [eax - 0xc]
push eax
push dword [ebp - 0x60]
call dword [sym.imp.USER32.dll_DrawTextW]
mov ecx, dword [ebp - 0x74]
lea ecx, [ecx - 0x10]
call fcn.1800687d
lea eax, [ebp - 0x58]
push eax
push dword [ebp - 0x5c]
call dword [sym.imp.USER32.dll_EndPaint]
mov ecx, dword [ebp - 4]
xor eax, eax
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1814cf3d
leave
ret 0x10
Function at 0x1817a687
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.1817a304

Function at 0x1818aef5
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.1818ad6b

Function at 0x1818ecf3
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateThread]
pop ebp
ret

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x403110
Capabilities:
Access peb ldr_data
Get process heap force flags

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x48a5f2
mov eax, dword fs:[0]
push eax
sub esp, 8
push esi
push edi
mov eax, dword [0x4b37a0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x14], esi
mov dword [ebp - 0x10], 0
mov dword [esi], 0x4a53a4
mov dword [esi + 0x70], vtable.std::basic_ios_char__struct_std::char_traits_char__.0
mov dword [ebp - 4], 0
lea edi, [esi + 0x10]
mov eax, dword [esi]
mov dword [ebp - 0x10], 1
mov eax, dword [eax + 4]
mov dword [esi + eax], vtable.std::basic_istream_char__struct_std::char_traits_char__.0
mov eax, dword [esi]
mov ecx, dword [eax + 4]
push ecx
push edi
lea eax, [ecx - 0x18]
mov dword [ecx + esi - 4], eax
mov eax, dword [esi]
mov dword [esi + 8], 0
mov dword [esi + 0xc], 0
mov ecx, dword [eax + 4]
add ecx, esi
call fcn.00404650
mov dword [ebp - 4], 2
mov eax, dword [esi]
mov eax, dword [eax + 4]
mov dword [esi + eax], vtable.std::basic_ifstream_char__struct_std::char_traits_char__.0
mov eax, dword [esi]
mov ecx, dword [eax + 4]
lea eax, [ecx - 0x70]
mov dword [ecx + esi - 4], eax
mov ecx, edi
call fcn.00404190
lea eax, [edi + 4]
mov dword [edi], vtable.std::basic_filebuf_char__struct_std::char_traits_char__.0
mov dword [edi + 0xc], eax
lea ecx, [edi + 8]
lea eax, [edi + 0x14]
mov byte [edi + 0x4c], 0
mov dword [edi + 0x1c], eax
lea eax, [edi + 0x18]
mov dword [edi + 0x20], eax
lea eax, [edi + 0x24]
mov dword [edi + 0x2c], eax
lea eax, [edi + 0x28]
mov dword [edi + 0x30], eax
mov byte [edi + 0x45], 0
mov dword [edi + 0x10], ecx
mov dword [ecx], 0
mov eax, dword [edi + 0x20]
mov dword [eax], 0
mov eax, dword [edi + 0x30]
mov dword [eax], 0
mov eax, dword [edi + 0xc]
mov dword [eax], 0
mov eax, dword [edi + 0x1c]
mov dword [eax], 0
mov eax, dword [edi + 0x2c]
mov dword [eax], 0
mov eax, dword [0x4ba888]
mov dword [edi + 0x50], 0
mov dword [edi + 0x48], eax
mov dword [edi + 0x40], 0
mov eax, dword [ebp + 8]
mov byte [ebp - 4], 3
cmp dword [eax + 0x14], 8
jb 0x403245
mov eax, dword [eax]
push ecx
push 0x21
push eax
mov ecx, edi
call fcn.00403c60
test eax, eax
jne 0x40327d
mov eax, dword [esi]
mov ecx, dword [eax + 4]
mov eax, dword [ecx + esi + 0xc]
add ecx, esi
or eax, 2
cmp dword [ecx + 0x38], 0
jne 0x40326b
or eax, 4
and eax, 0x17
mov dword [ecx + 0xc], eax
test dword [ecx + 0x10], eax
je 0x40327d
push 0
call fcn.00406020
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 0x10
Function at 0x403e70
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x48a678
mov eax, dword fs:[0]
push eax
sub esp, 0x28
mov eax, dword [0x4b37a0]
xor eax, esp
mov dword [esp + 0x20], eax
push ebx
push esi
push edi
mov eax, dword [0x4b37a0]
xor eax, esp
push eax
lea eax, [esp + 0x38]
mov dword fs:[0], eax
mov ebx, ecx
cmp dword [ebx + 0x40], 0
je 0x403fc4
cmp byte [ebx + 0x45], 0
je 0x403fc4
mov eax, dword [ebx]
push 0xffffffffffffffff
call dword [eax + 0xc]
cmp eax, 0xffffffff
jne 0x403ed0
xor al, al
jmp 0x403fc6
mov ecx, 0xf
mov byte [esp + 0x18], 0
xorps xmm0, xmm0
mov dword [esp + 0x2c], ecx
cmp ecx, 0x10
movq qword [esp + 0x18], xmm0
lea eax, [esp + 0x18]
mov dword [esp + 0x28], 8
cmovae eax, dword [esp + 0x18]
mov byte [eax + 8], 0
mov dword [esp + 0x40], 0
jmp 0x403f10
cmp dword [esp + 0x2c], 0x10
lea eax, [esp + 0x14]
mov ecx, dword [ebx + 0x40]
lea edi, [esp + 0x18]
cmovae edi, dword [esp + 0x18]
lea esi, [esp + 0x18]
cmovae esi, dword [esp + 0x18]
push eax
mov eax, dword [esp + 0x2c]
mov edx, dword [ecx]
add eax, edi
push eax
push esi
lea eax, [ebx + 0x48]
push eax
call dword [edx + 0x20]
sub eax, 0
je 0x403f51
dec eax
je 0x403f55
sub eax, 2
je 0x403fab
xor bl, bl
jmp 0x403fad
mov byte [ebx + 0x45], 0
mov ecx, dword [esp + 0x2c]
lea eax, [esp + 0x18]
mov edx, dword [esp + 0x18]
cmp ecx, 0x10
mov esi, dword [esp + 0x14]
cmovae eax, edx
sub esi, eax
je 0x403f8c
push dword [ebx + 0x50]
cmp ecx, 0x10
lea eax, [esp + 0x1c]
push esi
cmovae eax, edx
push 1
push eax
call fcn.004587fd
add esp, 0x10
cmp esi, eax
jne 0x403f4d
cmp byte [ebx + 0x45], 0
je 0x403fab
test esi, esi
jne 0x403f10
push esi
push 8
lea ecx, [esp + 0x20]
call fcn.00403bb0
jmp 0x403f10
mov bl, 1
cmp dword [esp + 0x2c], 0x10
jb 0x403fc0
push dword [esp + 0x18]
call fcn.00455fa6
add esp, 4
mov al, bl
jmp 0x403fc6
mov al, 1
mov ecx, dword [esp + 0x38]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x20]
xor ecx, esp
call fcn.0045755a
mov esp, ebp
pop ebp
ret
Function at 0x404f20
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x48a87a
mov eax, dword fs:[0]
push eax
sub esp, 0x18
mov eax, dword [0x4b37a0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov edi, dword [ebp + 8]
push 0
mov dword [ebp - 0x18], esi
call fcn.00456630
mov dword [ebp - 4], 0
mov dword [esi + 4], 0
mov byte [esi + 8], 0
mov dword [esi + 0xc], 0
mov byte [esi + 0x10], 0
xor eax, eax
mov dword [esi + 0x14], 0
mov word [esi + 0x18], ax
mov dword [esi + 0x1c], eax
mov word [esi + 0x20], ax
mov dword [esi + 0x24], eax
mov byte [esi + 0x28], al
mov dword [esi + 0x2c], eax
mov byte [esi + 0x30], al
mov byte [ebp - 4], 6
test edi, edi
jne 0x404fc6
lea eax, [ebp - 0x14]
mov dword [ebp - 0x14], str.bad_locale_name
push eax
lea ecx, [ebp - 0x24]
call fcn.00457b6b
push 0x4b0bc4
lea eax, [ebp - 0x24]
mov dword [ebp - 0x24], vtable.std::runtime_error.0
push eax
call fcn.0045b97c
push edi
push esi
call fcn.00456503
add esp, 8
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0045755a
mov esp, ebp
pop ebp
ret 4

Function at 0x405630
Capabilities:
Get process heap force flags

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x48a908
mov eax, dword fs:[0]
push eax
sub esp, 0x20
push esi
mov eax, dword [0x4b37a0]
xor eax, esp
push eax
lea eax, [esp + 0x28]
mov dword fs:[0], eax
mov esi, ecx
sub esp, 0x18
mov ecx, esp
push 0xffffffffffffffff
push 0
push dword [ebp + 0x10]
mov dword [ecx + 0x14], 0xf
mov dword [ecx + 0x10], 0
mov byte [ecx], 0
call fcn.004058a0
push dword [ebp + 0xc]
lea eax, [esp + 0x28]
push dword [ebp + 8]
push eax
call fcn.00405560
add esp, 0x24
mov dword [esp + 0x30], 0
cmp dword [eax + 0x14], 0x10
jb 0x4056a1
mov eax, dword [eax]
mov dword [esp + 8], eax
mov ecx, esi
lea eax, [esp + 8]
push eax
call fcn.00457b6b
cmp dword [esp + 0x20], 0x10
mov dword [esi], vtable.std::runtime_error.0
jb 0x4056ca
push dword [esp + 0xc]
call fcn.00455fa6
add esp, 4
mov eax, dword [ebp + 8]
mov dword [esi + 0xc], eax
mov eax, dword [ebp + 0xc]
mov dword [esi + 0x10], eax
mov eax, esi
mov dword [esi], vtable.std::_System_error.0
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret 0xc