joyce8/EMBER2024-capa huggingface dataset:
Function at 0x148abee4
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov ecx, 5
push 0
push 0
dec ecx
jne 0x148abeec
push ecx
push ebx
push esi
xor eax, eax
push ebp
push 0x148ac09a
push dword fs:[eax]
mov dword fs:[eax], esp
call fcn.148ab8e8
lea ecx, [ebp - 0x18]
mov edx, 0x148ac0b0
mov eax, 0x148ac0bc
call fcn.148a9880
mov edx, dword [ebp - 0x18]
lea eax, [ebp - 0x14]
call fcn.14873dc8
mov eax, dword [ebp - 0x14]
call fcn.14898850
lea edx, [ebp - 4]
call fcn.148a58b0
mov eax, dword [ebp - 4]
xor edx, edx
call fcn.14873f00
jne 0x148abf4a
or eax, 0xffffffff
call fcn.148a1dc8
lea ecx, [ebp - 0x20]
mov edx, 0x148ac0b0
mov eax, 0x148ac0bc
call fcn.148a9880
mov edx, dword [ebp - 0x20]
lea eax, [ebp - 0x1c]
call fcn.14873dc8
mov eax, dword [ebp - 0x1c]
call fcn.14898850
call fcn.148a42ac
test al, al
je 0x148abf80
or eax, 0xffffffff
call fcn.148a1dc8
call fcn.148a69a8
mov edx, eax
cmp word [edx], 0x5a4d
jne 0x148ac037
mov ecx, eax
mov ebx, ecx
add ebx, dword [edx + 0x3c]
mov edx, ebx
cmp dword [edx], 0x4550
jne 0x148ac037
mov ebx, dword [edx + 0x50]
add ebx, ecx
mov esi, ebx
add esi, 4
mov edx, dword [ebx]
lea eax, [ebp - 8]
call fcn.14873bdc
lea eax, [ebp - 8]
call fcn.14873a78
mov ecx, dword [ebx]
mov edx, esi
call fcn.14876c64
lea eax, [ebp - 0x10]
mov edx, dword [ebp - 8]
call fcn.148736e4
mov eax, dword [ebp - 0x10]
call fcn.148738a8
push eax
push 0
lea eax, [ebp - 0xc]
push eax
push 0
lea ecx, [ebp - 0x2c]
mov edx, 0x148ac0b0
mov eax, 0x148ac0d0
call fcn.148a9880
lea eax, [ebp - 0x2c]
mov edx, dword [0x148dc7b8]
mov edx, dword [edx]
call fcn.148738b0
mov eax, dword [ebp - 0x2c]
lea edx, [ebp - 0x28]
call fcn.14878098
mov edx, dword [ebp - 0x28]
lea eax, [ebp - 0x24]
call fcn.14873dc8
mov eax, dword [ebp - 0x24]
push eax
lea eax, [ebp - 0x10]
call fcn.14873a78
mov ecx, eax
mov eax, dword [ebp - 4]
pop edx
call fcn.1489904c
or eax, 0xffffffff
call fcn.148a1dc8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x148ac0a1
lea eax, [ebp - 0x2c]
mov edx, 2
call fcn.14873670
lea eax, [ebp - 0x24]
call fcn.14873c58
lea eax, [ebp - 0x20]
call fcn.1487364c
lea eax, [ebp - 0x1c]
call fcn.14873c58
lea eax, [ebp - 0x18]
call fcn.1487364c
lea eax, [ebp - 0x14]
call fcn.14873c58
lea eax, [ebp - 0x10]
call fcn.1487364c
lea eax, [ebp - 8]
call fcn.1487364c
lea eax, [ebp - 4]
call fcn.14873c58
ret
Function at 0x148ac0d8
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ebx
push esi
xor eax, eax
push ebp
push 0x148ac210
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
call fcn.148a74d4
test al, al
jne 0x148ac1d5
call fcn.148a69a8
mov edx, eax
cmp word [edx], 0x5a4d
jne 0x148ac1d5
mov ecx, eax
mov esi, ecx
add esi, dword [edx + 0x3c]
mov edx, esi
cmp dword [edx], 0x4550
jne 0x148ac1d5
mov esi, dword [edx + 0x50]
add esi, ecx
mov ecx, esi
add ecx, 4
mov dword [ebp - 8], ecx
mov edx, dword [esi]
lea eax, [ebp - 4]
call fcn.14873bdc
lea eax, [ebp - 4]
call fcn.14873a78
mov ecx, dword [esi]
mov edx, dword [ebp - 8]
call fcn.14876c64
lea ecx, [ebp - 0x14]
mov edx, 0x148ac228
mov eax, 0x148ac234
call fcn.148a9880
lea eax, [ebp - 0x14]
mov edx, dword [0x148dc7b8]
mov edx, dword [edx]
call fcn.148738b0
mov eax, dword [ebp - 0x14]
lea edx, [ebp - 0x10]
call fcn.14878098
mov edx, dword [ebp - 0x10]
lea eax, [ebp - 0xc]
call fcn.14873dc8
mov eax, dword [ebp - 0xc]
push eax
lea ecx, [ebp - 0x1c]
mov edx, 0x148ac228
mov eax, 0x148ac248
call fcn.148a9880
mov edx, dword [ebp - 0x1c]
lea eax, [ebp - 0x18]
call fcn.14873dc8
mov eax, dword [ebp - 0x18]
call fcn.14898850
push eax
mov eax, dword [ebp - 4]
call fcn.148738a8
push eax
lea eax, [ebp - 4]
call fcn.14873a78
mov edx, eax
pop ecx
pop eax
call fcn.1489a450
test al, al
je 0x148ac1d5
mov bl, 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x148ac217
lea eax, [ebp - 0x1c]
call fcn.1487364c
lea eax, [ebp - 0x18]
call fcn.14873c58
lea eax, [ebp - 0x14]
mov edx, 2
call fcn.14873670
lea eax, [ebp - 0xc]
call fcn.14873c58
lea eax, [ebp - 4]
call fcn.1487364c
ret
Function at 0x148ac504
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ebx
push esi
xor eax, eax
push ebp
push 0x148ac63c
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x10]
call fcn.148a5778
mov eax, dword [ebp - 0x10]
xor edx, edx
call fcn.14873f00
je 0x148ac607
call fcn.148a69a8
mov edx, eax
cmp word [edx], 0x5a4d
jne 0x148ac607
mov ecx, eax
mov ebx, ecx
add ebx, dword [edx + 0x3c]
mov edx, ebx
cmp dword [edx], 0x4550
jne 0x148ac607
mov esi, dword [edx + 0x50]
add esi, ecx
mov ebx, esi
add ebx, 4
mov edx, dword [esi]
lea eax, [ebp - 8]
call fcn.14873bdc
lea eax, [ebp - 8]
call fcn.14873a78
mov ecx, dword [esi]
mov edx, ebx
call fcn.14876c64
lea eax, [ebp - 0xc]
mov edx, dword [ebp - 8]
call fcn.148736e4
mov eax, dword [0x148dc794]
push eax
call fcn.14876918
mov eax, dword [ebp - 0xc]
call fcn.148738a8
push eax
push 0
mov eax, dword [0x148dc8e8]
push eax
push 0
lea ecx, [ebp - 0x1c]
mov edx, 0x148ac654
mov eax, 0x148ac660
call fcn.148a9880
lea eax, [ebp - 0x1c]
mov edx, dword [0x148dc7b8]
mov edx, dword [edx]
call fcn.148738b0
mov eax, dword [ebp - 0x1c]
lea edx, [ebp - 0x18]
call fcn.14878098
mov edx, dword [ebp - 0x18]
lea eax, [ebp - 0x14]
call fcn.14873dc8
mov eax, dword [ebp - 0x14]
push eax
lea eax, [ebp - 0xc]
call fcn.14873a78
mov ecx, eax
mov eax, dword [ebp - 0x10]
pop edx
call fcn.1489904c
mov eax, dword [0x148dc794]
push eax
call fcn.14876a58
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x148ac643
lea eax, [ebp - 0x1c]
mov edx, 2
call fcn.14873670
lea eax, [ebp - 0x14]
mov edx, 2
call fcn.14873c70
lea eax, [ebp - 0xc]
mov edx, 2
call fcn.14873670
ret
Function at 0x148acaf0
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov ecx, 6
push 0
push 0
dec ecx
jne 0x148acaf8
push ebx
push esi
xor eax, eax
push ebp
push 0x148acc9c
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
lea ecx, [ebp - 0x1c]
mov edx, 0x148accb4
mov eax, 0x148accc0
call fcn.148a9880
mov edx, dword [ebp - 0x1c]
lea eax, [ebp - 0x18]
call fcn.14873dc8
mov eax, dword [ebp - 0x18]
call fcn.14898850
call fcn.148a42ac
cmp al, 1
je 0x148acc41
lea ecx, [ebp - 0x24]
mov edx, 0x148accb4
mov eax, 0x148accc0
call fcn.148a9880
mov edx, dword [ebp - 0x24]
lea eax, [ebp - 0x20]
call fcn.14873dc8
mov eax, dword [ebp - 0x20]
call fcn.14898850
lea edx, [ebp - 4]
call fcn.148a58b0
mov eax, dword [ebp - 4]
xor edx, edx
call fcn.14873f00
je 0x148acc41
call fcn.148a69a8
mov edx, eax
cmp word [edx], 0x5a4d
jne 0x148acc41
mov ecx, eax
mov esi, ecx
add esi, dword [edx + 0x3c]
mov edx, esi
cmp dword [edx], 0x4550
jne 0x148acc41
mov esi, dword [edx + 0x50]
add esi, ecx
mov ecx, esi
add ecx, 4
mov dword [ebp - 0xc], ecx
mov edx, dword [esi]
lea eax, [ebp - 8]
call fcn.14873bdc
lea eax, [ebp - 8]
call fcn.14873a78
mov ecx, dword [esi]
mov edx, dword [ebp - 0xc]
call fcn.14876c64
lea eax, [ebp - 0x14]
mov edx, dword [ebp - 8]
call fcn.148736e4
mov eax, dword [ebp - 0x14]
call fcn.148738a8
push eax
push 0
lea eax, [ebp - 0x10]
push eax
push 0
lea ecx, [ebp - 0x30]
mov edx, 0x148accb4
mov eax, 0x148accd4
call fcn.148a9880
lea eax, [ebp - 0x30]
mov edx, dword [0x148dc7b8]
mov edx, dword [edx]
call fcn.148738b0
mov eax, dword [ebp - 0x30]
lea edx, [ebp - 0x2c]
call fcn.14878098
mov edx, dword [ebp - 0x2c]
lea eax, [ebp - 0x28]
call fcn.14873dc8
mov eax, dword [ebp - 0x28]
push eax
lea eax, [ebp - 0x14]
call fcn.14873a78
mov ecx, eax
mov eax, dword [ebp - 4]
pop edx
call fcn.1489904c
test eax, eax
je 0x148acc41
mov bl, 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x148acca3
lea eax, [ebp - 0x30]
mov edx, 2
call fcn.14873670
lea eax, [ebp - 0x28]
call fcn.14873c58
lea eax, [ebp - 0x24]
call fcn.1487364c
lea eax, [ebp - 0x20]
call fcn.14873c58
lea eax, [ebp - 0x1c]
call fcn.1487364c
lea eax, [ebp - 0x18]
call fcn.14873c58
lea eax, [ebp - 0x14]
call fcn.1487364c
lea eax, [ebp - 8]
call fcn.1487364c
lea eax, [ebp - 4]
call fcn.14873c58
ret
Function at 0x148ace2c
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ebx
push esi
xor eax, eax
push ebp
push 0x148acf64
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x10]
call fcn.148a5778
mov eax, dword [ebp - 0x10]
xor edx, edx
call fcn.14873f00
je 0x148acf2f
call fcn.148a69a8
mov edx, eax
cmp word [edx], 0x5a4d
jne 0x148acf2f
mov ecx, eax
mov ebx, ecx
add ebx, dword [edx + 0x3c]
mov edx, ebx
cmp dword [edx], 0x4550
jne 0x148acf2f
mov esi, dword [edx + 0x50]
add esi, ecx
mov ebx, esi
add ebx, 4
mov edx, dword [esi]
lea eax, [ebp - 8]
call fcn.14873bdc
lea eax, [ebp - 8]
call fcn.14873a78
mov ecx, dword [esi]
mov edx, ebx
call fcn.14876c64
lea eax, [ebp - 0xc]
mov edx, dword [ebp - 8]
call fcn.148736e4
mov eax, dword [0x148dc794]
push eax
call fcn.14876918
mov eax, dword [ebp - 0xc]
call fcn.148738a8
push eax
push 0
mov eax, dword [0x148dc8e8]
push eax
push 0
lea ecx, [ebp - 0x1c]
mov edx, 0x148acf7c
mov eax, 0x148acf88
call fcn.148a9880
lea eax, [ebp - 0x1c]
mov edx, dword [0x148dc7b8]
mov edx, dword [edx]
call fcn.148738b0
mov eax, dword [ebp - 0x1c]
lea edx, [ebp - 0x18]
call fcn.14878098
mov edx, dword [ebp - 0x18]
lea eax, [ebp - 0x14]
call fcn.14873dc8
mov eax, dword [ebp - 0x14]
push eax
lea eax, [ebp - 0xc]
call fcn.14873a78
mov ecx, eax
mov eax, dword [ebp - 0x10]
pop edx
call fcn.1489904c
mov eax, dword [0x148dc794]
push eax
call fcn.14876a58
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x148acf6b
lea eax, [ebp - 0x1c]
mov edx, 2
call fcn.14873670
lea eax, [ebp - 0x14]
mov edx, 2
call fcn.14873c70
lea eax, [ebp - 0xc]
mov edx, 2
call fcn.14873670
ret
Function at 0x148ad690
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ebx
push esi
xor eax, eax
push ebp
push 0x148ad7c8
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x10]
call fcn.148a5778
mov eax, dword [ebp - 0x10]
xor edx, edx
call fcn.14873f00
je 0x148ad793
call fcn.148a69a8
mov edx, eax
cmp word [edx], 0x5a4d
jne 0x148ad793
mov ecx, eax
mov ebx, ecx
add ebx, dword [edx + 0x3c]
mov edx, ebx
cmp dword [edx], 0x4550
jne 0x148ad793
mov esi, dword [edx + 0x50]
add esi, ecx
mov ebx, esi
add ebx, 4
mov edx, dword [esi]
lea eax, [ebp - 8]
call fcn.14873bdc
lea eax, [ebp - 8]
call fcn.14873a78
mov ecx, dword [esi]
mov edx, ebx
call fcn.14876c64
lea eax, [ebp - 0xc]
mov edx, dword [ebp - 8]
call fcn.148736e4
mov eax, dword [0x148dc794]
push eax
call fcn.14876918
mov eax, dword [ebp - 0xc]
call fcn.148738a8
push eax
push 0
mov eax, dword [0x148dc8e8]
push eax
push 0
lea ecx, [ebp - 0x1c]
mov edx, 0x148ad7e0
mov eax, 0x148ad7ec
call fcn.148a9880
lea eax, [ebp - 0x1c]
mov edx, dword [0x148dc7b8]
mov edx, dword [edx]
call fcn.148738b0
mov eax, dword [ebp - 0x1c]
lea edx, [ebp - 0x18]
call fcn.14878098
mov edx, dword [ebp - 0x18]
lea eax, [ebp - 0x14]
call fcn.14873dc8
mov eax, dword [ebp - 0x14]
push eax
lea eax, [ebp - 0xc]
call fcn.14873a78
mov ecx, eax
mov eax, dword [ebp - 0x10]
pop edx
call fcn.1489904c
mov eax, dword [0x148dc794]
push eax
call fcn.14876a58
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x148ad7cf
lea eax, [ebp - 0x1c]
mov edx, 2
call fcn.14873670
lea eax, [ebp - 0x14]
mov edx, 2
call fcn.14873c70
lea eax, [ebp - 0xc]
mov edx, 2
call fcn.14873670
ret
Function at 0x148add90
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ebx
push esi
xor eax, eax
push ebp
push 0x148adedd
push dword fs:[eax]
mov dword fs:[eax], esp
call fcn.148a41c8
cmp al, 1
jne 0x148addc1
xor eax, eax
call fcn.148adb58
jmp 0x148adea8
lea eax, [ebp - 0x10]
call fcn.148a5778
mov eax, dword [ebp - 0x10]
xor edx, edx
call fcn.14873f00
je 0x148adea8
call fcn.148a69a8
mov edx, eax
cmp word [edx], 0x5a4d
jne 0x148adea8
mov ecx, eax
mov ebx, ecx
add ebx, dword [edx + 0x3c]
mov edx, ebx
cmp dword [edx], 0x4550
jne 0x148adea8
mov esi, dword [edx + 0x50]
add esi, ecx
mov ebx, esi
add ebx, 4
mov edx, dword [esi]
lea eax, [ebp - 8]
call fcn.14873bdc
lea eax, [ebp - 8]
call fcn.14873a78
mov ecx, dword [esi]
mov edx, ebx
call fcn.14876c64
lea eax, [ebp - 0xc]
mov edx, dword [ebp - 8]
call fcn.148736e4
mov eax, dword [0x148dc794]
push eax
call fcn.14876918
mov eax, dword [ebp - 0xc]
call fcn.148738a8
push eax
push 0
mov eax, dword [0x148dc8e8]
push eax
push 0
lea ecx, [ebp - 0x1c]
mov edx, 0x148adef8
mov eax, 0x148adf04
call fcn.148a9880
lea eax, [ebp - 0x1c]
mov edx, dword [0x148dc7b8]
mov edx, dword [edx]
call fcn.148738b0
mov eax, dword [ebp - 0x1c]
lea edx, [ebp - 0x18]
call fcn.14878098
mov edx, dword [ebp - 0x18]
lea eax, [ebp - 0x14]
call fcn.14873dc8
mov eax, dword [ebp - 0x14]
push eax
lea eax, [ebp - 0xc]
call fcn.14873a78
mov ecx, eax
mov eax, dword [ebp - 0x10]
pop edx
call fcn.1489904c
mov eax, dword [0x148dc794]
push eax
call fcn.14876a58
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x148adee4
lea eax, [ebp - 0x1c]
mov edx, 2
call fcn.14873670
lea eax, [ebp - 0x14]
mov edx, 2
call fcn.14873c70
lea eax, [ebp - 0xc]
mov edx, 2
call fcn.14873670
ret

Function at 0x148b0214
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
push ebx
xor ebx, ebx
imul edx, dword [ebx + 0x419008], 0x8088405
inc edx
mov dword [ebx + 0x419008], edx
mul edx
mov eax, edx
pop ebx
ret

Function at 0x148c25c0
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffff8
mov ebp, ecx
mov ebx, edx
mov dword [esp], eax
mov eax, ebp
mov edx, dword [esp]
call fcn.148b1410
mov esi, ebx
mov eax, dword [ebp]
call fcn.148b1658
test ax, ax
jbe 0x148c262b
mov word [esp + 4], ax
mov bx, 1
mov eax, ebp
call fcn.148b18b0
movzx edi, bx
mov edx, dword [ebp]
mov dl, byte [edx + edi - 1]
movzx ecx, si
shr ecx, 8
xor dl, cl
mov byte [eax + edi - 1], dl
mov eax, dword [esp]
movzx eax, byte [eax + edi - 1]
add si, ax
imul ax, si, 0xce6d
add ax, 0x58bf
mov esi, eax
inc ebx
dec word [esp + 4]
jne 0x148c25f0
pop ecx
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x148c2de0
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ebp
push ecx
mov esi, ecx
mov edi, edx
mov ebx, eax
mov eax, esi
mov edx, ebx
call fcn.148b1410
mov eax, dword [esi]
call fcn.148b1658
test ax, ax
jbe 0x148c2e40
mov word [esp], ax
mov bx, 1
mov eax, esi
call fcn.148b18b0
movzx ebp, bx
mov edx, dword [esi]
mov dl, byte [edx + ebp - 1]
movzx ecx, di
shr ecx, 8
xor dl, cl
mov byte [eax + ebp - 1], dl
mov eax, dword [esi]
movzx eax, byte [eax + ebp - 1]
add di, ax
imul ax, di, 0xce6d
add ax, 0x58bf
mov edi, eax
inc ebx
dec word [esp]
jne 0x148c2e08
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x148cfd30
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ebx
push esi
xor eax, eax
push ebp
push 0x148cfe72
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0xc]
call fcn.148a5778
call fcn.148a69a8
mov edx, eax
cmp word [edx], 0x5a4d
jne 0x148cfe35
mov ecx, eax
mov ebx, ecx
add ebx, dword [edx + 0x3c]
mov edx, ebx
cmp dword [edx], 0x4550
jne 0x148cfe35
mov ebx, dword [edx + 0x50]
add ebx, ecx
mov esi, ebx
add esi, 4
mov edx, dword [ebx]
lea eax, [ebp - 4]
call fcn.14873bdc
lea eax, [ebp - 4]
call fcn.14873a78
mov ecx, dword [ebx]
mov edx, esi
call fcn.14876c64
lea eax, [ebp - 8]
mov edx, dword [ebp - 4]
call fcn.148736e4
mov eax, dword [0x148dc794]
push eax
call fcn.14876918
mov eax, dword [ebp - 8]
call fcn.148738a8
push eax
push 0
mov eax, dword [0x148dc8e8]
push eax
push 0
lea ecx, [ebp - 0x18]
mov edx, 0x148cfe88
mov eax, 0x148cfe94
call fcn.148a9880
lea eax, [ebp - 0x18]
mov edx, dword [0x148dc7b8]
mov edx, dword [edx]
call fcn.148738b0
mov eax, dword [ebp - 0x18]
lea edx, [ebp - 0x14]
call fcn.14878098
mov edx, dword [ebp - 0x14]
lea eax, [ebp - 0x10]
call fcn.14873dc8
mov eax, dword [ebp - 0x10]
push eax
lea eax, [ebp - 8]
call fcn.14873a78
mov ecx, eax
mov eax, dword [ebp - 0xc]
pop edx
call fcn.1489904c
mov eax, dword [0x148dc794]
push eax
call fcn.14876a58
push 0x9c40
call fcn.14876b00
mov eax, dword [0x148dc8e8]
xor edx, edx
mov dword [eax], edx
or eax, 0xffffffff
call fcn.148a1dc8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x148cfe79
lea eax, [ebp - 0x18]
mov edx, 2
call fcn.14873670
lea eax, [ebp - 0x10]
mov edx, 2
call fcn.14873c70
lea eax, [ebp - 8]
mov edx, 2
call fcn.14873670
ret
Function at 0x148d0d1c
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov ecx, 5
push 0
push 0
dec ecx
jne 0x148d0d24
push ebx
push esi
xor eax, eax
push ebp
push 0x148d0f44
push dword fs:[eax]
mov dword fs:[eax], esp
call fcn.14876990
lea edx, [ebp - 8]
call fcn.148a75d0
mov ecx, dword [ebp - 8]
mov edx, dword [0x148dc7b8]
mov edx, dword [edx]
lea eax, [ebp - 4]
call fcn.148738f4
mov eax, dword [ebp - 4]
call fcn.14873a6c
push eax
push 0
push 0
call fcn.148768f8
call fcn.148769c8
cmp eax, 0xb7
jne 0x148d0d83
or eax, 0xffffffff
call fcn.148a1dc8
jmp 0x148d0d79
push 0x148dd954
call fcn.14876a50
mov eax, 0x148dd94c
xor edx, edx
call fcn.14873bdc
call fcn.148a69a8
mov edx, eax
cmp word [edx], 0x5a4d
jne 0x148d0de1
mov ecx, eax
mov ebx, ecx
add ebx, dword [edx + 0x3c]
mov edx, ebx
cmp dword [edx], 0x4550
jne 0x148d0de1
mov ebx, dword [edx + 0x50]
add ebx, ecx
mov esi, ebx
add esi, 4
mov edx, dword [ebx]
mov eax, 0x148dd94c
call fcn.14873bdc
mov eax, 0x148dd94c
call fcn.14873a78
mov ecx, dword [ebx]
mov edx, esi
call fcn.14876c64
push 0x148dd940
lea ecx, [ebp - 0xc]
mov edx, 0x148d0f5c
mov eax, 0x148d0f68
call fcn.148a66a4
mov edx, dword [ebp - 0xc]
mov ecx, 0x148d0460
mov eax, 0x148d0f80
call fcn.14876fb8
push 0x148dd944
lea ecx, [ebp - 0x10]
mov edx, 0x148d0f98
mov eax, 0x148d0fa4
call fcn.148a66a4
mov edx, dword [ebp - 0x10]
mov ecx, 0x148d0530
mov eax, 0x148d0f80
call fcn.14876fb8
push 0x148dd93c
lea ecx, [ebp - 0x14]
mov edx, 0x148d0fbc
mov eax, 0x148d0fc8
call fcn.148a66a4
mov edx, dword [ebp - 0x14]
mov ecx, 0x148d0854
mov eax, 0x148d0f80
call fcn.14876fb8
push 0x148dd92c
lea ecx, [ebp - 0x18]
mov edx, 0x148d0fd8
mov eax, 0x148d0fe4
call fcn.148a66a4
mov edx, dword [ebp - 0x18]
mov ecx, 0x148d05d4
mov eax, 0x148d0ffc
call fcn.14876fb8
push 0x148dd930
lea ecx, [ebp - 0x1c]
mov edx, 0x148d1010
mov eax, 0x148d101c
call fcn.148a66a4
mov edx, dword [ebp - 0x1c]
mov ecx, 0x148d0694
mov eax, 0x148d0ffc
call fcn.14876fb8
push 0x148dd934
lea ecx, [ebp - 0x20]
mov edx, 0x148d1034
mov eax, 0x148d1040
call fcn.148a66a4
mov edx, dword [ebp - 0x20]
mov ecx, 0x148d0728
mov eax, 0x148d0ffc
call fcn.14876fb8
push 0x148dd938
lea ecx, [ebp - 0x24]
mov edx, 0x148d1058
mov eax, 0x148d1064
call fcn.148a66a4
mov edx, dword [ebp - 0x24]
mov ecx, 0x148d07d4
mov eax, 0x148d0ffc
call fcn.14876fb8
push 0x148dd948
lea ecx, [ebp - 0x28]
mov edx, 0x148d107c
mov eax, 0x148d1088
call fcn.148a66a4
mov edx, dword [ebp - 0x28]
mov ecx, 0x148d093c
mov eax, 0x148d10a0
call fcn.14876fb8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x148d0f4b
lea eax, [ebp - 0x28]
mov edx, 0xa
call fcn.14873670
ret
Function at 0x148d15a4
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push ebx
push esi
mov ebx, eax
xor eax, eax
push ebp
push 0x148d164b
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 4]
call fcn.14873c58
call fcn.148a69a8
mov edx, eax
cmp word [edx], 0x5a4d
jne 0x148d15ff
mov ecx, eax
mov esi, ecx
add esi, dword [edx + 0x3c]
mov edx, esi
cmp dword [edx], 0x4550
jne 0x148d15ff
mov esi, dword [edx + 0x50]
add esi, ecx
mov ecx, esi
mov esi, dword [edx + 0x50]
add esi, eax
add esi, 4
add esi, dword [ecx]
lea eax, [ebp - 4]
mov edx, esi
call fcn.14873d70
mov eax, dword [ebp - 4]
call fcn.14873de8
cmp eax, 0xa
jge 0x148d1626
call fcn.14876978
mov edx, eax
lea eax, [ebp - 8]
call fcn.14873d70
mov eax, dword [ebp - 8]
lea edx, [ebp - 4]
call fcn.148a5250
mov edx, ebx
mov eax, dword [ebp - 4]
call fcn.148a5250
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x148d1652
lea eax, [ebp - 8]
mov edx, 2
call fcn.14873c70
ret
Function at 0x10007120
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10051558
mov eax, dword fs:[0]
push eax
sub esp, 0x24
mov eax, dword [0x10069070]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
cmp dword [ebx + 0x38], 0
je 0x1000724f
cmp byte [ebx + 0x3d], 0
je 0x1000724f
mov eax, dword [ebx]
push 0xffffffffffffffff
call dword [eax + 0xc]
cmp eax, 0xffffffff
sete al
test al, al
je 0x10007179
xor al, al
jmp 0x10007251
push 0
push 8
lea ecx, [ebp - 0x28]
mov dword [ebp - 0x14], 0xf
mov dword [ebp - 0x18], 0
mov byte [ebp - 0x28], 0
call fcn.10006c30
mov dword [ebp - 4], 0
mov edx, dword [ebp - 0x28]
mov ecx, dword [ebp - 0x14]
cmp ecx, 0x10
lea eax, [ebp - 0x2c]
mov ecx, dword [ebx + 0x38]
lea edi, [ebp - 0x28]
push eax
mov eax, dword [ebp - 0x18]
lea esi, [ebp - 0x28]
cmovae edi, edx
cmovae esi, edx
mov edx, dword [ecx]
add eax, edi
push eax
push esi
lea eax, [ebx + 0x40]
push eax
call dword [edx + 0x20]
sub eax, 0
je 0x100071e7
sub eax, 1
je 0x100071eb
sub eax, 2
je 0x10007241
lea ecx, [ebp - 0x28]
xor bl, bl
call fcn.10002e90
mov al, bl
jmp 0x10007251
mov byte [ebx + 0x3d], 0
mov ecx, dword [ebp - 0x14]
lea eax, [ebp - 0x28]
mov edx, dword [ebp - 0x28]
cmp ecx, 0x10
mov esi, dword [ebp - 0x2c]
cmovae eax, edx
sub esi, eax
je 0x10007223
push dword [ebx + 0x4c]
cmp ecx, 0x10
lea eax, [ebp - 0x28]
push esi
cmovae eax, edx
push 1
push eax
call fcn.10032f7e
add esp, 0x10
cmp esi, eax
jne 0x100071d9
mov ecx, dword [ebp - 0x14]
mov edx, dword [ebp - 0x28]
cmp byte [ebx + 0x3d], 0
je 0x10007241
test esi, esi
jne 0x100071a4
push esi
push 8
lea ecx, [ebp - 0x28]
call fcn.10006d00
jmp 0x1000719e
lea ecx, [ebp - 0x28]
mov bl, 1
call fcn.10002e90
mov al, bl
jmp 0x10007251
mov al, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1002ac23
mov esp, ebp
pop ebp
ret

Function at 0x100076e0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10051326
mov eax, dword fs:[0]
push eax
push esi
push edi
mov eax, dword [0x10069070]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
push 8
mov dword [edi], vtable.std::basic_streambuf_char__struct_std::char_traits_char__.0
call fcn.1002b1b4
mov esi, eax
push 1
mov dword [ebp - 4], 0
call fcn.10017873
mov dword [esi + 4], eax
lea ecx, [edi + 8]
lea eax, [edi + 4]
mov dword [edi + 0x34], esi
mov dword [edi + 0xc], eax
add esp, 8
lea eax, [edi + 0x14]
mov dword [edi + 0x10], ecx
mov dword [edi + 0x1c], eax
lea eax, [edi + 0x18]
mov dword [edi + 0x20], eax
lea eax, [edi + 0x24]
mov dword [edi + 0x2c], eax
lea eax, [edi + 0x28]
mov dword [edi + 0x30], eax
mov dword [ecx], 0
mov eax, dword [edi + 0x20]
mov dword [eax], 0
mov eax, dword [edi + 0x30]
mov dword [eax], 0
mov eax, dword [edi + 0xc]
mov dword [eax], 0
mov eax, dword [edi + 0x1c]
mov dword [eax], 0
mov eax, dword [edi + 0x2c]
mov dword [eax], 0
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret