joyce8/EMBER2024-capa huggingface dataset:
Function at 0x483caf
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 0x20]
sub esp, 0x18
push edi
mov edi, dword [ebp + 0x14]
test ecx, ecx
je 0x483cd5
mov eax, dword [ecx]
push 3
push dword [edi + 8]
push 1
push ecx
call dword [eax + 0x10]
test eax, eax
jne 0x483e52
cmp byte [edi + 1], 0
push esi
je 0x483de9
mov esi, dword [ebp + 0x18]
mov al, byte [esi]
shr al, 3
test al, 1
je 0x483cf6
mov eax, 0x80004001
jmp 0x483e51
mov edx, dword [ebp + 0x10]
xor ecx, ecx
push ebx
mov ebx, dword [ebp + 0xc]
mov eax, dword [edx + 0x60]
add eax, dword [ebx + 0x38]
adc ecx, dword [ebx + 0x3c]
add eax, dword [edx + 0x40]
mov dword [ebp - 0x18], eax
adc ecx, dword [edx + 0x44]
mov eax, dword [edx + 0x10]
mov dword [ebp - 0x14], ecx
mov ecx, dword [edx + 0x14]
mov dword [ebp - 0x10], eax
lea eax, [edi + 0x20]
mov dword [ebp - 0xc], ecx
lea ecx, [esi + 0x20]
push eax
call fcn.0046023d
movzx eax, byte [edi + 4]
mov ecx, esi
push eax
push 0x800
call fcn.00482237
mov eax, dword [edi + 0x14]
mov dword [esi + 0x18], eax
mov eax, dword [edi + 0x2c]
mov ecx, dword [edi + 0x30]
mov dword [esi + 0x64], ecx
mov dword [esi + 0x60], eax
mov eax, dword [edi + 0x34]
mov ecx, dword [edi + 0x38]
mov dword [esi + 0x6c], ecx
mov dword [esi + 0x68], eax
mov eax, dword [edi + 0x3c]
mov ecx, dword [edi + 0x40]
mov dword [esi + 0x74], ecx
lea ecx, [esi + 0x48]
mov dword [esi + 0x70], eax
mov al, byte [edi + 3]
mov byte [esi + 0x78], al
call fcn.004820c6
lea ecx, [esi + 0x2c]
call fcn.004820c6
mov edi, dword [ebp + 8]
mov ecx, esi
mov eax, dword [edi + 0x38]
mov edx, dword [edi + 0x3c]
mov dword [ecx + 0x40], eax
lea eax, [ebp - 8]
mov dword [ecx + 0x44], edx
lea ecx, [esi + 0x2c]
push eax
call fcn.0046480b
mov byte [ebp + 0x20], al
mov ecx, edi
push dword [ebp + 0x20]
push dword [esi + 0x14]
push dword [esi + 0x10]
push dword [esi + 0xc]
push dword [esi + 8]
push dword [esi + 0x24]
call fcn.00487435
push esi
mov ecx, edi
call fcn.00487b2f
push dword [ebp + 0x1c]
lea eax, [ebp - 0x18]
push eax
push edi
push dword [ebx + 0x80]
call fcn.00484214
add esp, 0x10
pop ebx
test eax, eax
jne 0x483e51
mov ecx, dword [ebp + 0x24]
mov eax, dword [ebp - 0x10]
add dword [ecx], eax
mov eax, dword [ebp - 0xc]
adc dword [ecx + 4], eax
jmp 0x483e4f
mov esi, dword [ebp + 0xc]
mov ecx, dword [ebp + 0x10]
mov edx, dword [esi + 0x38]
add edx, dword [ecx + 0x40]
mov eax, dword [esi + 0x3c]
adc eax, dword [ecx + 0x44]
mov dword [ebp - 0x18], edx
mov dword [ebp - 0x14], eax
call fcn.00481d63
mov edi, dword [ebp + 8]
push dword [ebp + 0x1c]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 0x18]
mov ecx, dword [edi + 0x38]
mov dword [ebp - 0xc], edx
mov edx, dword [edi + 0x3c]
mov dword [eax + 0x40], ecx
mov dword [eax + 0x44], edx
lea eax, [ebp - 0x18]
push eax
push edi
push dword [esi + 0x80]
call fcn.00484214
add esp, 0x10
test eax, eax
jne 0x483e51
mov edx, dword [ebp + 0x24]
mov ecx, edi
mov esi, dword [ebp - 0x10]
mov eax, dword [ebp - 0xc]
push eax
add dword [edx], esi
push esi
adc dword [edx + 4], eax
call fcn.00487422
xor eax, eax
pop esi
pop edi
leave
ret
Function at 0x48429e
Capabilities:
Terminate process

Disassembly:
push ebx
push esi
mov esi, ecx
lea ebx, [esi + 4]
cmp dword [ebx], 0
jne 0x4842b5
push ebx
call fcn.0047bdf9
pop ecx
test eax, eax
jne 0x4842f7
push edi
lea edi, [esi + 8]
cmp dword [edi], 0
jne 0x4842c9
push edi
call fcn.0047bdf9
pop ecx
test eax, eax
jne 0x4842f6
push ebx
call fcn.0047be81
push edi
call fcn.0047be81
lea eax, [esi + 0xc]
mov byte [esi + 0x10], 0
cmp dword [eax], 0
pop ecx
pop ecx
je 0x4842e7
xor eax, eax
jmp 0x4842f6
push esi
push 0x484260
push eax
call fcn.0047bf75
add esp, 0xc
pop edi
pop esi
pop ebx
ret
Function at 0x488730
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov ecx, dword [ebp + 8]
xor eax, eax
push ebx
push esi
mov dword [ebp - 8], eax
lea edx, [ecx + 0x325c8]
mov dword [ebp - 0xc], edx
push edi
nop word [eax + eax]
xor ebx, ebx
mov dword [ebp - 4], 4
mov edi, eax
lea eax, [ebx + 1]
nop
movzx edx, word [ecx + eax*2 + 0x32c4c]
mov esi, edi
and esi, 1
shr edx, 4
mov ecx, esi
shr edi, 1
neg ecx
add eax, eax
sar ecx, 4
or eax, esi
and ecx, 0x7f
xor edx, ecx
mov ecx, dword [ebp + 8]
add ebx, dword [ecx + edx*4 + 0x30f34]
sub dword [ebp - 4], 1
jne 0x488760
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 8]
inc eax
mov dword [ebp - 8], eax
mov dword [edx], ebx
add edx, 4
mov dword [ebp - 0xc], edx
cmp eax, 0x10
jb 0x488750
pop edi
pop esi
pop ebx
mov dword [ecx + 0x84], 0
mov esp, ebp
pop ebp
ret
Function at 0x4887c0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x21c
mov eax, dword [0x4fa078]
xor eax, ebp
mov dword [ebp - 4], eax
push edi
mov edi, dword [ebp + 8]
mov eax, 4
push ebx
mov dword [ebp - 0x20c], eax
push esi
nop dword [eax]
nop dword [eax + eax]
movzx ecx, byte [edi + eax + 0x30734]
mov ebx, ecx
mov dword [ebp - 0x218], ecx
mov edx, ecx
shr ebx, 1
and edx, 1
dec ebx
or edx, 2
mov ecx, ebx
shl edx, cl
xor ecx, ecx
sub eax, edx
mov dword [ebp - 0x214], edx
mov dword [ebp - 0x208], ecx
lea esi, [ecx + 1]
test ebx, ebx
je 0x488880
mov edx, eax
shr eax, 1
mov dword [ebp - 0x210], eax
and edx, 1
mov eax, esi
add esi, esi
sub eax, dword [ebp - 0x218]
or esi, edx
add eax, dword [ebp - 0x214]
movzx ecx, word [edi + eax*2 + 0x32b66]
mov eax, edx
neg eax
shr ecx, 4
sar eax, 4
and eax, 0x7f
xor ecx, eax
mov eax, dword [ebp - 0x208]
add eax, dword [edi + ecx*4 + 0x30f34]
mov dword [ebp - 0x208], eax
mov eax, dword [ebp - 0x210]
sub ebx, 1
jne 0x488826
mov ecx, dword [ebp - 0x208]
mov eax, dword [ebp - 0x20c]
mov dword [ebp + eax*4 - 0x204], ecx
inc eax
mov dword [ebp - 0x20c], eax
cmp eax, 0x80
jb 0x4887f0
lea ecx, [ebp - 0x204]
mov dword [ebp - 0x218], 4
sub ecx, edi
lea esi, [edi + 0x319c8]
lea eax, [edi + 0x32968]
mov dword [ebp - 0x21c], esi
lea edx, [edi + 0x31dd0]
mov dword [ebp - 0x208], eax
sub ecx, 0x31dc8
mov dword [ebp - 0x20c], edx
mov dword [ebp - 0x214], ecx
mov eax, dword [edi + 0x88]
xor ebx, ebx
mov dword [ebp - 0x210], ebx
test eax, eax
je 0x488952
mov eax, ebx
xor esi, esi
mov ebx, dword [ebp - 0x208]
or eax, 0x40
mov edx, eax
and eax, 1
shr edx, 1
neg eax
sar eax, 4
and eax, 0x7f
movzx ecx, word [ebx + edx*2]
shr ecx, 4
xor ecx, eax
mov eax, edx
add esi, dword [edi + ecx*4 + 0x30f34]
cmp eax, 1
jne 0x488900
mov ebx, dword [ebp - 0x210]
mov eax, dword [ebp - 0x21c]
mov dword [eax + ebx*4], esi
inc ebx
mov eax, dword [edi + 0x88]
mov dword [ebp - 0x210], ebx
cmp ebx, eax
jb 0x4888f3
mov esi, dword [ebp - 0x21c]
mov edx, dword [ebp - 0x20c]
mov ecx, 0xe
cmp eax, ecx
jbe 0x488976
nop dword [eax + eax]
mov eax, ecx
shr eax, 1
shl eax, 4
sub eax, 0x50
add dword [esi + ecx*4], eax
inc ecx
cmp ecx, dword [edi + 0x88]
jb 0x488960
mov eax, dword [esi]
mov ecx, 4
mov ebx, dword [ebp - 0x214]
mov dword [edx - 8], eax
mov eax, dword [esi + 4]
mov dword [edx - 4], eax
mov eax, dword [esi + 8]
mov dword [edx], eax
mov eax, dword [esi + 0xc]
mov dword [edx + 4], eax
add edx, 8
nop word [eax + eax]
movzx eax, byte [edi + ecx + 0x30734]
lea edx, [edx + 4]
inc ecx
mov eax, dword [esi + eax*4]
add eax, dword [ebx + edx - 4]
mov dword [edx - 4], eax
cmp ecx, 0x80
jb 0x4889a0
mov edx, dword [ebp - 0x20c]
add esi, 0x100
sub dword [ebp - 0x208], 0xffffff80
add edx, 0x200
sub ebx, 0x200
mov dword [ebp - 0x21c], esi
sub dword [ebp - 0x218], 1
mov dword [ebp - 0x20c], edx
mov dword [ebp - 0x214], ebx
jne 0x4888e1
mov ecx, dword [ebp - 4]
pop esi
pop ebx
mov dword [edi + 0x80], 0
xor ecx, ebp
pop edi
call fcn.0044b735
mov esp, ebp
pop ebp
ret
Function at 0x48a210
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
mov ebx, dword [ebp + 0x18]
push esi
push edi
mov edi, dword [ebp + 8]
movzx ecx, word [edi]
mov eax, ecx
xor ecx, 0x7f0
shr eax, 4
shr ecx, 4
mov eax, dword [ebx + eax*4]
mov edx, dword [ebx + ecx*4]
movzx ecx, word [edi + 2]
mov dword [ebp - 8], eax
mov eax, ecx
shr eax, 4
xor ecx, 0x7f0
shr ecx, 4
mov eax, dword [ebx + eax*4]
add eax, edx
mov dword [ebp - 0xc], eax
mov eax, dword [ebx + ecx*4]
add eax, edx
xor esi, esi
mov dword [ebp - 0x10], eax
mov dword [ebp + 0x18], esi
cmp esi, dword [ebp + 0x10]
jae 0x48a384
mov edx, esi
mov dword [ebp - 4], 0
mov esi, dword [ebp - 4]
or edx, 8
mov eax, dword [ebp + 0xc]
mov ecx, edx
shr ecx, 1
and edx, 1
neg edx
sar edx, 4
and edx, 0x7f
lea eax, [ecx + eax*8]
movzx eax, word [edi + eax*2 + 4]
shr eax, 4
xor eax, edx
mov edx, ecx
add esi, dword [ebx + eax*4]
cmp edx, 1
jne 0x48a278
mov eax, dword [ebp - 8]
mov ecx, dword [ebp + 0x14]
add eax, esi
mov esi, dword [ebp + 0x18]
mov dword [ecx + esi*4], eax
inc esi
mov dword [ebp + 0x18], esi
cmp esi, 8
jb 0x48a260
cmp esi, 0x10
jae 0x48a320
lea eax, [esi - 8]
mov dword [ebp - 4], eax
cmp esi, dword [ebp + 0x10]
jae 0x48a384
mov esi, dword [ebp + 8]
mov edx, eax
xor edi, edi
or edx, 8
mov eax, dword [ebp + 0xc]
mov ecx, edx
shr ecx, 1
and edx, 1
neg edx
sar edx, 4
and edx, 0x7f
lea eax, [ecx + eax*8]
movzx eax, word [esi + eax*2 + 0x104]
shr eax, 4
xor eax, edx
mov edx, ecx
add edi, dword [ebx + eax*4]
cmp edx, 1
jne 0x48a2d6
mov esi, dword [ebp + 0x18]
mov ecx, dword [ebp + 0x14]
mov eax, dword [ebp - 0xc]
add eax, edi
mov dword [ecx + esi*4], eax
inc esi
mov eax, dword [ebp - 4]
inc eax
mov dword [ebp + 0x18], esi
mov dword [ebp - 4], eax
cmp esi, 0x10
jb 0x48a2c3
cmp esi, dword [ebp + 0x10]
jae 0x48a384
lea eax, [esi - 0x10]
mov dword [ebp - 4], eax
nop dword [eax + eax]
mov esi, dword [ebp + 8]
xor edi, edi
or eax, 0x100
nop word [eax + eax]
mov edx, eax
and eax, 1
shr edx, 1
neg eax
sar eax, 4
and eax, 0x7f
movzx ecx, word [esi + edx*2 + 0x204]
shr ecx, 4
xor ecx, eax
mov eax, edx
add edi, dword [ebx + ecx*4]
cmp eax, 1
jne 0x48a340
mov esi, dword [ebp + 0x18]
mov ecx, dword [ebp + 0x14]
mov eax, dword [ebp - 0x10]
add eax, edi
mov dword [ecx + esi*4], eax
inc esi
mov eax, dword [ebp - 4]
inc eax
mov dword [ebp + 0x18], esi
mov dword [ebp - 4], eax
cmp esi, dword [ebp + 0x10]
jb 0x48a330
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x48a470
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 0xc]
push ebx
mov ebx, dword [ebp + 0x10]
push esi
push edi
xor edi, edi
or ecx, 0x100
mov edx, dword [ebp + 8]
mov eax, ecx
shr eax, 8
movzx esi, word [edx + eax*2]
mov edx, ecx
shr edx, 7
add ecx, ecx
and edx, 1
shr esi, 4
neg edx
sar edx, 4
and edx, 0x7f
xor esi, edx
add edi, dword [ebx + esi*4]
cmp ecx, 0x10000
jb 0x48a484
mov eax, edi
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x48a4c0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 0xc]
push ebx
push esi
mov esi, 0x100
xor ebx, ebx
push edi
mov edi, dword [ebp + 0x10]
or ecx, esi
add edi, edi
mov edx, esi
and edx, edi
mov eax, ecx
add edx, esi
shr eax, 8
add eax, edx
mov edx, dword [ebp + 8]
movzx edx, word [edx + eax*2]
mov eax, ecx
shr eax, 7
add ecx, ecx
and eax, 1
shr edx, 4
neg eax
sar eax, 4
and eax, 0x7f
xor edx, eax
mov eax, dword [ebp + 0x14]
add ebx, dword [eax + edx*4]
mov edx, ecx
xor edx, edi
not edx
and esi, edx
cmp ecx, 0x10000
jb 0x48a4d5
pop edi
pop esi
mov eax, ebx
pop ebx
pop ebp
ret

Function at 0x48c8e0
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
xor edx, edx
push esi
mov dword [eax + 0x34], 0
lea esi, [eax + 0x60]
mov word [eax + 0x1e], 0
mov dword [eax + 0x24], 0
mov dword [eax + 0x30], 0x20
mov byte [eax + 0x1d], 1
mov dword [eax + 0x48], 4
mov ecx, edx
lea esi, [esi + 4]
and ecx, 1
mov eax, edx
shr eax, 1
neg ecx
and ecx, 0xedb88320
inc edx
xor ecx, eax
mov eax, ecx
shr ecx, 1
and eax, 1
neg eax
and eax, 0xedb88320
xor eax, ecx
mov ecx, eax
shr eax, 1
and ecx, 1
neg ecx
and ecx, 0xedb88320
xor ecx, eax
mov eax, ecx
shr ecx, 1
and eax, 1
neg eax
and eax, 0xedb88320
xor eax, ecx
mov ecx, eax
shr eax, 1
and ecx, 1
neg ecx
and ecx, 0xedb88320
xor ecx, eax
mov eax, ecx
shr ecx, 1
and eax, 1
neg eax
and eax, 0xedb88320
xor eax, ecx
mov ecx, eax
shr eax, 1
and ecx, 1
neg ecx
and ecx, 0xedb88320
xor ecx, eax
mov eax, ecx
shr ecx, 1
and eax, 1
neg eax
and eax, 0xedb88320
xor eax, ecx
mov dword [esi - 4], eax
cmp edx, 0x100
jb 0x48c912
pop esi
pop ebp
ret
Function at 0x48df80
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, dword [ebp + 8]
cmp dword [esi], 0
je 0x48df94
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret
push ebx
push edi
lea edi, [esi + 0x30]
push edi
call fcn.0047be0d
add esp, 4
test eax, eax
jne 0x48e025
lea eax, [esi + 0x14]
mov dword [esi + 0x28], 1
push eax
call fcn.0047bdf9
add esp, 4
test eax, eax
jne 0x48e025
lea eax, [esi + 0x18]
push eax
call fcn.0047bdf9
add esp, 4
test eax, eax
jne 0x48e025
lea eax, [esi + 0x1c]
push eax
call fcn.0047bdf9
add esp, 4
test eax, eax
jne 0x48e025
mov ebx, dword [ebp + 0x14]
lea eax, [esi + 0x20]
push ebx
push ebx
push eax
call fcn.0047bf16
add esp, 0xc
test eax, eax
jne 0x48e025
push ebx
push eax
lea eax, [esi + 0x24]
push eax
call fcn.0047bf16
add esp, 0xc
test eax, eax
jne 0x48e025
push dword [ebp + 0x10]
lea eax, [esi + 0x10]
mov dword [esi + 4], 1
push dword [ebp + 0xc]
push eax
call fcn.0047bf75
add esp, 0xc
test eax, eax
je 0x48e11d
cmp dword [esi + 0x10], 0
mov ebx, edi
mov dword [ebp + 8], ebx
je 0x48e0c7
cmp dword [esi + 4], 0
mov eax, dword [esi + 0x48]
mov dword [ebp - 4], eax
jne 0x48e0a1
cmp dword [esi + 0x2c], 0
mov dword [esi + 0xc], 1
je 0x48e05b
push edi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov dword [esi + 0x2c], 0
lea eax, [esi + 0x20]
push eax
call fcn.0047bf3f
push dword [esi + 0x1c]
call fcn.0047bef1
mov edi, dword [ebp - 4]
add esp, 8
cmp edi, dword [esi + 0x48]
je 0x48e09a
lea ebx, [esi + 0x20]
nop word [eax + eax]
push dword [esi + 0x24]
inc edi
call fcn.0047bef1
push ebx
call fcn.0047bf3f
add esp, 8
cmp edi, dword [esi + 0x48]
jne 0x48e080
mov ebx, dword [ebp + 8]
mov dword [esi + 4], 1
lea edi, [esi + 0x14]
mov dword [esi + 8], 1
push edi
call fcn.0047be9d
push dword [esi + 0x10]
call fcn.0047bef1
lea eax, [esi + 0x10]
push eax
call fcn.0047beca
add esp, 0xc
jmp 0x48e0ca
lea edi, [esi + 0x14]
cmp dword [esi + 0x28], 0
je 0x48e0de
push ebx
call dword [sym.imp.KERNEL32.dll_DeleteCriticalSection]
mov dword [esi + 0x28], 0
push edi
call fcn.0047beca
lea eax, [esi + 0x18]
push eax
call fcn.0047beca
lea eax, [esi + 0x1c]
push eax
call fcn.0047beca
lea ecx, [esi + 0x20]
push ecx
call fcn.0047beca
lea ecx, [esi + 0x24]
push ecx
call fcn.0047beca
add esp, 0x14
mov dword [esi], 0
mov eax, 0xc
pop edi
pop ebx
pop esi
mov esp, ebp
pop ebp
ret
pop edi
pop ebx
mov dword [esi], 1
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x48fcf8
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateThread]
pop ebp
ret

Function at 0x4b9545
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.004b93c4

Function at 0x4be444
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.004be104
Function at 0x1003f210
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x102328a0
mov eax, dword fs:[0]
push eax
sub esp, 0x28
mov eax, dword [0x102ff008]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], ecx
mov ecx, 0x103822ce
call fcn.102317b0
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax + 0x3c]
and ecx, 1
je 0x1003f2d4
mov edx, dword [ebp - 0x10]
add edx, 0x40
mov dword [ebp - 0x30], edx
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax + 0x20]
mov edx, dword [ecx]
mov dword [ebp - 0x1c], edx
cmp dword [ebp - 0x1c], 0
je 0x1003f280
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax + 0x30]
mov edx, dword [ebp - 0x10]
mov eax, dword [edx + 0x20]
mov edx, dword [eax]
add edx, dword [ecx]
mov dword [ebp - 0x14], edx
jmp 0x1003f293
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax + 0x2c]
mov edx, dword [ebp - 0x10]
mov eax, dword [edx + 0x1c]
mov edx, dword [eax]
add edx, dword [ecx]
mov dword [ebp - 0x14], edx
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax + 0xc]
mov edx, dword [ecx]
mov dword [ebp - 0x20], edx
mov eax, dword [ebp - 0x14]
sub eax, dword [ebp - 0x20]
mov dword [ebp - 0x2c], eax
mov ecx, dword [ebp - 0x10]
mov edx, dword [ecx + 0xc]
mov eax, dword [edx]
mov dword [ebp - 0x24], eax
mov ecx, dword [ebp - 0x34]
mov dword [ebp - 0x18], ecx
mov edx, dword [ebp - 0x24]
mov dword [ebp - 0x28], edx
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x18], eax
mov ecx, dword [ebp - 0x2c]
push ecx
mov edx, dword [ebp - 0x18]
push edx
mov ecx, dword [ebp - 0x30]
call fcn.1003f950
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax + 0xc]
mov dword [ecx], 0
mov edx, dword [ebp - 0x10]
mov eax, dword [edx + 0x1c]
mov dword [eax], 0
xor ecx, ecx
mov edx, dword [ebp - 0x10]
mov eax, dword [edx + 0x2c]
mov dword [eax], ecx
mov ecx, dword [ebp - 0x10]
mov edx, dword [ecx + 0x10]
mov dword [edx], 0
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax + 0x20]
mov dword [ecx], 0
xor edx, edx
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax + 0x30]
mov dword [ecx], edx
mov edx, dword [ebp - 0x10]
mov dword [edx + 0x38], 0
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax + 0x3c]
and ecx, 0xfffffffe
mov edx, dword [ebp - 0x10]
mov dword [edx + 0x3c], ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
Function at 0x100518f0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov dword [ebp - 4], ecx
mov ecx, 0x103822dc
call fcn.102317b0
mov eax, dword [ebp - 4]
cmp dword [eax + 0x38], 0
je 0x10051926
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 4]
call dword [sym.imp.MSVCP140D.dll_protected_virtual:_long_long___int64____thiscall_std::basic_streambuf_char__struct_std::char_traits_char__::xsputn_char_const___long_long___int64__]
jmp 0x10051a5b
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp + 0x10]
mov dword [ebp - 0x20], ecx
mov dword [ebp - 0x1c], edx
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0x20]
cmp dword [ecx], 0
je 0x1005194a
mov edx, dword [ebp - 4]
mov eax, dword [edx + 0x30]
mov ecx, dword [eax]
mov dword [ebp - 8], ecx
jmp 0x10051951
mov dword [ebp - 8], 0
mov eax, dword [ebp - 8]
cdq
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], edx
cmp dword [ebp + 0x10], 0
jl 0x10051a0c
jg 0x10051971
cmp dword [ebp + 0xc], 0
jbe 0x10051a0c
cmp dword [ebp - 0x14], 0
jl 0x10051a0c
jg 0x10051987
cmp dword [ebp - 0x18], 0
jbe 0x10051a0c
mov edx, dword [ebp + 0x10]
cmp edx, dword [ebp - 0x14]
jg 0x100519a5
jl 0x10051999
mov eax, dword [ebp + 0xc]
cmp eax, dword [ebp - 0x18]
jae 0x100519a5
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp + 0x10]
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x14], edx
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0x20]
mov edx, dword [ecx]
mov dword [ebp - 0x10], edx
mov eax, dword [ebp - 0x18]
push eax
mov ecx, dword [ebp + 8]
push ecx
mov edx, dword [ebp - 0x10]
push edx
call dword [sym.imp.VCRUNTIME140D.dll_memcpy]
add esp, 0xc
mov eax, dword [ebp - 0x18]
add eax, dword [ebp + 8]
mov dword [ebp + 8], eax
mov ecx, dword [ebp + 0xc]
sub ecx, dword [ebp - 0x18]
mov edx, dword [ebp + 0x10]
sbb edx, dword [ebp - 0x14]
mov dword [ebp + 0xc], ecx
mov dword [ebp + 0x10], edx
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 0x30]
mov eax, dword [edx]
sub eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 0x30]
mov dword [edx], eax
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0x20]
mov edx, dword [ecx]
add edx, dword [ebp - 0xc]
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0x20]
mov dword [ecx], edx
cmp dword [ebp + 0x10], 0
jl 0x10051a4f
jg 0x10051a1a
cmp dword [ebp + 0xc], 0
jbe 0x10051a4f
mov edx, dword [ebp - 4]
cmp dword [edx + 0x4c], 0
je 0x10051a4f
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0x4c]
push ecx
mov edx, dword [ebp + 0xc]
push edx
push 1
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.ucrtbased.dll_fwrite]
add esp, 0x10
xor ecx, ecx
mov edx, dword [ebp + 0xc]
sub edx, eax
mov eax, dword [ebp + 0x10]
sbb eax, ecx
mov dword [ebp + 0xc], edx
mov dword [ebp + 0x10], eax
mov eax, dword [ebp - 0x20]
sub eax, dword [ebp + 0xc]
mov edx, dword [ebp - 0x1c]
sbb edx, dword [ebp + 0x10]
mov esp, ebp
pop ebp
ret 0xc
Function at 0x100536c0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x60
mov eax, dword [0x102ff008]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x30], ecx
mov ecx, 0x103822dc
call fcn.102317b0
mov eax, dword [ebp - 0x30]
cmp dword [eax + 0x38], 0
je 0x100536f1
mov ecx, dword [ebp - 0x30]
movzx edx, byte [ecx + 0x3d]
test edx, edx
jne 0x100536f8
mov al, 1
jmp 0x100537f8
mov eax, dword [ebp - 0x30]
mov ecx, dword [eax]
mov edx, dword [ecx + 0xc]
mov dword [ebp - 0x4c], edx
mov eax, dword [ebp - 0x5c]
mov dword [ebp - 0x40], eax
mov dword [ebp - 0x40], 0xffffffff
mov ecx, dword [ebp - 0x40]
push ecx
mov ecx, dword [ebp - 0x30]
call dword [ebp - 0x4c]
mov dword [ebp - 0x54], eax
mov dword [ebp - 0x50], 0xffffffff
mov edx, dword [ebp - 0x50]
cmp edx, dword [ebp - 0x54]
jne 0x10053735
mov dword [ebp - 0x44], 1
jmp 0x1005373c
mov dword [ebp - 0x44], 0
mov al, byte [ebp - 0x44]
mov byte [ebp - 0x31], al
movzx ecx, byte [ebp - 0x31]
test ecx, ecx
je 0x10053751
xor al, al
jmp 0x100537f8
mov dword [ebp - 0x60], 0x20
mov edx, dword [ebp - 0x30]
mov eax, dword [edx + 0x38]
mov dword [ebp - 0x58], eax
lea ecx, [ebp - 0x2c]
push ecx
lea edx, [ebp - 8]
push edx
lea eax, [ebp - 0x28]
push eax
mov ecx, dword [ebp - 0x30]
add ecx, 0x40
push ecx
mov ecx, dword [ebp - 0x58]
call dword [sym.imp.MSVCP140D.dll_public:_int___thiscall_std::codecvt_char__char__struct__Mbstatet_::unshift_struct__Mbstatet___char___char___char___const]
mov dword [ebp - 0x38], eax
cmp dword [ebp - 0x38], 0
je 0x10053794
cmp dword [ebp - 0x38], 1
je 0x1005379b
cmp dword [ebp - 0x38], 3
je 0x100537eb
jmp 0x100537f6
mov edx, dword [ebp - 0x30]
mov byte [edx + 0x3d], 0
mov eax, dword [ebp - 0x2c]
lea ecx, [ebp - 0x28]
sub eax, ecx
mov dword [ebp - 0x3c], eax
je 0x100537cb
mov edx, dword [ebp - 0x30]
mov eax, dword [edx + 0x4c]
push eax
mov ecx, dword [ebp - 0x3c]
push ecx
push 1
lea edx, [ebp - 0x28]
push edx
call dword [sym.imp.ucrtbased.dll_fwrite]
add esp, 0x10
cmp dword [ebp - 0x3c], eax
je 0x100537cb
xor al, al
jmp 0x100537f8
mov eax, dword [ebp - 0x30]
movzx ecx, byte [eax + 0x3d]
test ecx, ecx
jne 0x100537df
mov dword [ebp - 0x48], 1
jmp 0x100537e6
mov dword [ebp - 0x48], 0
mov al, byte [ebp - 0x48]
jmp 0x100537f8
mov edx, dword [ebp - 0x30]
mov byte [edx + 0x3d], 0
mov al, 1
jmp 0x100537f8
xor al, al
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10169cb0
mov esp, ebp
pop ebp
ret