joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40b2b0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x5d0a30
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x38
push ebx
push esi
mov esi, ecx
mov eax, dword [esi + 0x10]
mov ecx, dword [esi + 4]
mov edx, dword [esi]
mov dword [esp + 0x1c], eax
lea eax, [edx + ecx*4]
push edi
mov dword [esp + 0x1c], eax
mov eax, dword [ebp + 8]
xor edi, edi
mov dword [esp + 0x24], edi
mov dword [esp + 0x28], eax
mov dword [esp + 0x4c], edi
lea ecx, [esp + 0x2c]
mov dword [esp + 0x30], ecx
mov dword [esp + 0x3c], edi
mov dword [esp + 0x38], edi
mov dword [esp + 0x34], edi
inc eax
push eax
lea edx, [esp + 0x1c]
mov byte [esp + 0x50], 1
push edx
lea ecx, [esp + 0x38]
mov dword [esp + 0x20], edi
call fcn.005001e0
mov ecx, dword [esp + 0x34]
mov eax, dword [esp + 0x28]
lea eax, [ecx + eax*4]
mov dword [eax], eax
mov eax, dword [esi + 4]
mov dword [esp + 0x24], ecx
mov ecx, dword [esi]
mov dword [esi], edi
mov dword [esi + 4], eax
mov ebx, dword [esi + 0x18]
mov edx, eax
mov dword [esp + 0x30], ecx
mov dword [esp + 0x34], edx
mov dword [esi + 0x10], edi
mov dword [esp + 0x18], ebx
cmp ebx, dword [esp + 0x1c]
je 0x40b3eb
lea ecx, [ecx]
mov edi, dword [ebx]
mov dword [esp + 0x14], edi
test edi, edi
je 0x40b3d8
cmp dword [edi + 0x18], 0x10
lea eax, [edi + 4]
jb 0x40b377
mov ecx, dword [eax]
jmp 0x40b379
mov ecx, eax
mov edx, dword [eax + 0x10]
add edx, ecx
cmp dword [eax + 0x14], 0x10
jb 0x40b386
mov eax, dword [eax]
mov ecx, eax
mov dword [esp + 0x10], eax
xor eax, eax
cmp ecx, edx
je 0x40b3b7
mov edi, eax
mov ebx, eax
shl edi, 6
shr ebx, 2
add edi, ebx
movsx ebx, byte [ecx]
lea edi, [edi + ebx - 0x61c88647]
inc ecx
xor eax, edi
cmp ecx, edx
jne 0x40b392
mov ebx, dword [esp + 0x18]
mov edi, dword [esp + 0x14]
xor edx, edx
div dword [esp + 0x28]
mov eax, dword [esp + 0x24]
mov ecx, dword [edi]
mov dword [ebx], ecx
lea eax, [eax + edx*4]
mov edx, dword [eax]
mov dword [edi], edx
mov dword [eax], edi
mov edi, dword [ebx]
mov dword [esp + 0x14], edi
test edi, edi
jne 0x40b36a
add ebx, 4
mov dword [esp + 0x18], ebx
cmp ebx, dword [esp + 0x1c]
jne 0x40b360
xor edi, edi
mov eax, dword [esp + 0x20]
mov ecx, dword [esi]
mov dword [esi + 0x10], eax
mov eax, dword [esp + 0x24]
mov dword [esi], eax
mov eax, dword [esp + 0x28]
mov edx, dword [esi + 4]
mov dword [esi + 4], eax
mov dword [esp + 0x24], ecx
mov dword [esp + 0x28], edx
cmp dword [esi + 0x10], edi
je 0x40b42c
mov eax, dword [esi]
mov dword [esi + 0x18], eax
cmp dword [eax], edi
jne 0x40b436
lea ebx, [ebx]
add eax, 4
mov dword [esi + 0x18], eax
cmp dword [eax], edi
je 0x40b420
jmp 0x40b436
mov edx, eax
mov eax, dword [esi]
lea ecx, [eax + edx*4]
mov dword [esi + 0x18], ecx
mov ecx, esi
call fcn.0040b5c0
mov dword [esi + 0x1c], eax
cmp dword [esp + 0x30], edi
je 0x40b44f
lea ecx, [esp + 0x30]
call fcn.00409d40
cmp dword [esp + 0x24], edi
je 0x40b45e
lea ecx, [esp + 0x24]
call fcn.00409d40
mov ecx, dword [esp + 0x44]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x40b6f0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x5d09f0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x38
push ebx
push esi
mov esi, ecx
mov eax, dword [esi + 0x10]
mov ecx, dword [esi + 4]
mov edx, dword [esi]
mov dword [esp + 0x1c], eax
lea eax, [edx + ecx*4]
push edi
mov dword [esp + 0x1c], eax
mov eax, dword [ebp + 8]
xor edi, edi
mov dword [esp + 0x24], edi
mov dword [esp + 0x28], eax
mov dword [esp + 0x4c], edi
lea ecx, [esp + 0x2c]
mov dword [esp + 0x30], ecx
mov dword [esp + 0x3c], edi
mov dword [esp + 0x38], edi
mov dword [esp + 0x34], edi
inc eax
push eax
lea edx, [esp + 0x1c]
mov byte [esp + 0x50], 1
push edx
lea ecx, [esp + 0x38]
mov dword [esp + 0x20], edi
call fcn.005001e0
mov ecx, dword [esp + 0x34]
mov eax, dword [esp + 0x28]
lea eax, [ecx + eax*4]
mov dword [eax], eax
mov eax, dword [esi + 4]
mov dword [esp + 0x24], ecx
mov ecx, dword [esi]
mov dword [esi], edi
mov dword [esi + 4], eax
mov ebx, dword [esi + 0x18]
mov edx, eax
mov dword [esp + 0x30], ecx
mov dword [esp + 0x34], edx
mov dword [esi + 0x10], edi
mov dword [esp + 0x18], ebx
cmp ebx, dword [esp + 0x1c]
je 0x40b82b
lea ecx, [ecx]
mov edi, dword [ebx]
mov dword [esp + 0x14], edi
test edi, edi
je 0x40b818
cmp dword [edi + 0x18], 0x10
lea eax, [edi + 4]
jb 0x40b7b7
mov ecx, dword [eax]
jmp 0x40b7b9
mov ecx, eax
mov edx, dword [eax + 0x10]
add edx, ecx
cmp dword [eax + 0x14], 0x10
jb 0x40b7c6
mov eax, dword [eax]
mov ecx, eax
mov dword [esp + 0x10], eax
xor eax, eax
cmp ecx, edx
je 0x40b7f7
mov edi, eax
mov ebx, eax
shl edi, 6
shr ebx, 2
add edi, ebx
movsx ebx, byte [ecx]
lea edi, [edi + ebx - 0x61c88647]
inc ecx
xor eax, edi
cmp ecx, edx
jne 0x40b7d2
mov ebx, dword [esp + 0x18]
mov edi, dword [esp + 0x14]
xor edx, edx
div dword [esp + 0x28]
mov eax, dword [esp + 0x24]
mov ecx, dword [edi]
mov dword [ebx], ecx
lea eax, [eax + edx*4]
mov edx, dword [eax]
mov dword [edi], edx
mov dword [eax], edi
mov edi, dword [ebx]
mov dword [esp + 0x14], edi
test edi, edi
jne 0x40b7aa
add ebx, 4
mov dword [esp + 0x18], ebx
cmp ebx, dword [esp + 0x1c]
jne 0x40b7a0
xor edi, edi
mov eax, dword [esp + 0x20]
mov ecx, dword [esi]
mov dword [esi + 0x10], eax
mov eax, dword [esp + 0x24]
mov dword [esi], eax
mov eax, dword [esp + 0x28]
mov edx, dword [esi + 4]
mov dword [esi + 4], eax
mov dword [esp + 0x24], ecx
mov dword [esp + 0x28], edx
cmp dword [esi + 0x10], edi
je 0x40b86c
mov eax, dword [esi]
mov dword [esi + 0x18], eax
cmp dword [eax], edi
jne 0x40b876
lea ebx, [ebx]
add eax, 4
mov dword [esi + 0x18], eax
cmp dword [eax], edi
je 0x40b860
jmp 0x40b876
mov edx, eax
mov eax, dword [esi]
lea ecx, [eax + edx*4]
mov dword [esi + 0x18], ecx
mov ecx, esi
call fcn.0040b5c0
mov dword [esi + 0x1c], eax
cmp dword [esp + 0x30], edi
je 0x40b88f
lea ecx, [esp + 0x30]
call fcn.0040a330
cmp dword [esp + 0x24], edi
je 0x40b89e
lea ecx, [esp + 0x24]
call fcn.0040a330
mov ecx, dword [esp + 0x44]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x40b9e0
Capabilities:
Access peb ldr_data
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x5d09d0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x40
push ebx
push esi
mov esi, ecx
mov eax, dword [esi + 0x10]
mov ecx, dword [esi + 4]
mov edx, dword [esi]
push edi
mov dword [esp + 0x1c], eax
mov eax, dword [ebp + 8]
lea ebx, [edx + ecx*4]
xor edi, edi
mov dword [esp + 0x18], ebx
mov dword [esp + 0x20], edi
mov dword [esp + 0x24], eax
mov dword [esp + 0x54], edi
lea ecx, [esp + 0x28]
mov dword [esp + 0x38], ecx
mov dword [esp + 0x44], edi
mov dword [esp + 0x40], edi
mov dword [esp + 0x3c], edi
inc eax
push eax
lea edx, [esp + 0x18]
mov byte [esp + 0x58], 1
push edx
lea ecx, [esp + 0x40]
mov dword [esp + 0x1c], edi
call fcn.005001e0
mov ecx, dword [esp + 0x3c]
mov eax, dword [esp + 0x24]
mov byte [esp + 0x54], 0
lea eax, [ecx + eax*4]
mov dword [eax], eax
mov eax, dword [esi + 4]
mov dword [esp + 0x20], ecx
mov ecx, dword [esi]
mov dword [esi], edi
mov dword [esi + 4], eax
mov dword [esp + 0x2c], ecx
mov ecx, dword [esi + 0x18]
mov edx, eax
mov dword [esp + 0x30], edx
mov dword [esi + 0x10], edi
mov dword [esp + 0xc], ecx
cmp ecx, ebx
je 0x40bb1e
mov edi, dword [ecx]
mov dword [esp + 0x14], edi
test edi, edi
je 0x40bb0d
mov ecx, dword [edi + 0x18]
lea eax, [edi + 4]
cmp ecx, 0x10
jb 0x40baa9
mov ebx, dword [eax]
jmp 0x40baab
mov ebx, eax
mov edx, dword [eax + 0x10]
add edx, ebx
cmp ecx, 0x10
jb 0x40bab7
mov eax, dword [eax]
mov ecx, eax
mov dword [esp + 0x10], eax
xor eax, eax
cmp ecx, edx
je 0x40bae4
mov edi, eax
mov ebx, eax
shl edi, 6
shr ebx, 2
add edi, ebx
movsx ebx, byte [ecx]
lea edi, [edi + ebx - 0x61c88647]
inc ecx
xor eax, edi
cmp ecx, edx
jne 0x40bac3
mov edi, dword [esp + 0x14]
xor edx, edx
div dword [esp + 0x24]
mov eax, dword [esp + 0x20]
mov ecx, dword [esp + 0xc]
lea eax, [eax + edx*4]
mov edx, dword [edi]
mov dword [ecx], edx
mov edx, dword [eax]
mov dword [edi], edx
mov dword [eax], edi
mov edi, dword [ecx]
mov dword [esp + 0x14], edi
test edi, edi
jne 0x40ba9a
mov ebx, dword [esp + 0x18]
add ecx, 4
mov dword [esp + 0xc], ecx
cmp ecx, ebx
jne 0x40ba90
xor edi, edi
mov eax, dword [esp + 0x1c]
mov ecx, dword [esi]
mov dword [esi + 0x10], eax
mov eax, dword [esp + 0x20]
mov dword [esi], eax
mov eax, dword [esp + 0x24]
mov edx, dword [esi + 4]
mov dword [esi + 4], eax
mov dword [esp + 0x20], ecx
mov dword [esp + 0x24], edx
cmp dword [esi + 0x10], edi
je 0x40bb5c
mov eax, dword [esi]
mov dword [esi + 0x18], eax
cmp dword [eax], edi
jne 0x40bb66
lea ecx, [ecx]
add eax, 4
mov dword [esi + 0x18], eax
cmp dword [eax], edi
je 0x40bb50
jmp 0x40bb66
mov edx, eax
mov eax, dword [esi]
lea ecx, [eax + edx*4]
mov dword [esi + 0x18], ecx
mov ecx, esi
call fcn.0040b5c0
mov dword [esi + 0x1c], eax
cmp dword [esp + 0x2c], edi
je 0x40bb7f
lea ecx, [esp + 0x2c]
call fcn.0040a830
mov dword [esp + 0x54], 0xffffffff
cmp dword [esp + 0x20], edi
je 0x40bb96
lea ecx, [esp + 0x20]
call fcn.0040a830
mov ecx, dword [esp + 0x4c]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x40c680
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 8]
mov edx, dword [ebp + 0xc]
xor eax, eax
cmp ecx, edx
je 0x40c6b3
push esi
push edi
mov esi, eax
mov edi, eax
shl esi, 6
shr edi, 2
add esi, edi
movsx edi, byte [ecx]
lea esi, [esi + edi - 0x61c88647]
inc ecx
xor eax, esi
mov dword [ebp + 8], ecx
cmp ecx, edx
jne 0x40c691
pop edi
pop esi
pop ebp
ret

Function at 0x40e780
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov edx, dword [eax]
mov dword [ecx], edx
mov dword [ecx + 0x9c0], 1
push ebx
jmp 0x40e7a0
mov eax, dword [ecx + 0x9c0]
mov edx, dword [ecx + eax*4 - 4]
mov ebx, edx
shr ebx, 0x1e
xor ebx, edx
imul ebx, ebx, 0x6c078965
add ebx, eax
mov dword [ecx + eax*4], ebx
inc dword [ecx + 0x9c0]
cmp dword [ecx + 0x9c0], 0x270
jb 0x40e7a0
pop ebx
pop ebp
ret 4

Function at 0x4106b0
Capabilities:
Generate random numbers using a mersenne twister

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push esi
mov esi, dword [ebp + 0x10]
push edi
mov edi, dword [ebp + 0xc]
sub esi, edi
test esi, esi
jne 0x4106cc
mov eax, edi
pop edi
pop esi
mov esp, ebp
pop ebp
ret
cmp esi, 0xffffffff
jne 0x4106e9
mov ecx, dword [ebp + 8]
call fcn.00410810
test edi, edi
jns 0x4106e1
or ecx, esi
sub ecx, edi
add eax, edi
pop edi
pop esi
mov esp, ebp
pop ebp
ret
xor edx, edx
push ebx
cmp esi, 0xffffffff
jbe 0x410766
xor ecx, ecx
lea eax, [esi + 1]
div ecx
mov ebx, dword [ebp + 8]
mov dword [ebp - 4], ecx
mov edi, 1
mov dword [ebp - 8], eax
cmp dword [ebp - 8], edi
jae 0x410740
mov byte [ebp - 0xc], 0
mov edx, dword [ebp - 0xc]
push edx
push esi
push 0
push ebx
call fcn.00410860
add esp, 0x10
cmp eax, 0xffffffff
ja 0x410706
cmp eax, esi
ja 0x410706
mov ecx, dword [ebp + 0xc]
push ecx
push eax
lea ecx, [ebp + 0xf]
call fcn.004107f0
pop ebx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
mov ecx, ebx
call fcn.00410810
imul eax, edi
add dword [ebp - 4], eax
mov eax, esi
sub eax, edi
inc eax
neg edi
cmp edi, eax
je 0x41075c
xor edi, edi
jmp 0x410740
mov eax, dword [ebp - 4]
pop ebx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
or eax, 0xffffffff
lea ecx, [esi + 1]
div ecx
mov ebx, eax
cmp edx, esi
jne 0x410775
inc ebx
mov edi, dword [ebp + 8]
jmp 0x410780
cmp dword [edi + 0x9c0], 0x270
jne 0x410793
mov ecx, edi
call fcn.00410980
mov eax, dword [edi + 0x9c0]
mov ecx, dword [edi + eax*4]
inc eax
mov edx, ecx
shr edx, 0xb
xor ecx, edx
mov dword [edi + 0x9c0], eax
mov eax, ecx
and eax, 0xff3a58ad
shl eax, 7
xor ecx, eax
mov edx, ecx
and edx, 0xffffdf8c
shl edx, 0xf
xor ecx, edx
mov eax, ecx
shr eax, 0x12
xor eax, ecx
xor edx, edx
div ebx
cmp eax, esi
ja 0x410780
mov ecx, dword [ebp + 0xc]
test ecx, ecx
jns 0x4107de
or edx, 0xffffffff
sub edx, ecx
pop ebx
pop edi
add eax, ecx
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x410860
Capabilities:
Generate random numbers using a mersenne twister

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push esi
mov esi, dword [ebp + 0x10]
push edi
mov edi, dword [ebp + 0xc]
sub esi, edi
jne 0x41087a
mov eax, edi
pop edi
pop esi
mov esp, ebp
pop ebp
ret
cmp esi, 0xffffffff
jne 0x41088f
mov ecx, dword [ebp + 8]
call fcn.00410810
add eax, edi
pop edi
pop esi
mov esp, ebp
pop ebp
ret
xor edx, edx
push ebx
cmp esi, 0xffffffff
jbe 0x410906
xor ecx, ecx
lea eax, [esi + 1]
div ecx
mov ebx, dword [ebp + 8]
mov dword [ebp + 0x10], ecx
mov edi, 1
mov dword [ebp - 4], eax
lea esp, [esp]
cmp dword [ebp - 4], edi
jae 0x4108e0
mov byte [ebp - 8], 0
mov edx, dword [ebp - 8]
push edx
push esi
push 0
push ebx
call fcn.00410860
add esp, 0x10
cmp eax, 0xffffffff
ja 0x4108b0
cmp eax, esi
ja 0x4108b0
add eax, dword [ebp + 0xc]
pop ebx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
mov ecx, ebx
call fcn.00410810
imul eax, edi
add dword [ebp + 0x10], eax
mov eax, esi
sub eax, edi
inc eax
neg edi
cmp edi, eax
je 0x4108fc
xor edi, edi
jmp 0x4108e0
mov eax, dword [ebp + 0x10]
pop ebx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
or eax, 0xffffffff
lea ecx, [esi + 1]
div ecx
mov ebx, eax
cmp edx, esi
jne 0x410915
inc ebx
mov edi, dword [ebp + 8]
jmp 0x410920
cmp dword [edi + 0x9c0], 0x270
jne 0x410933
mov ecx, edi
call fcn.00410980
mov eax, dword [edi + 0x9c0]
mov ecx, dword [edi + eax*4]
inc eax
mov edx, ecx
shr edx, 0xb
xor ecx, edx
mov dword [edi + 0x9c0], eax
mov eax, ecx
and eax, 0xff3a58ad
shl eax, 7
xor ecx, eax
mov edx, ecx
and edx, 0xffffdf8c
shl edx, 0xf
xor ecx, edx
mov eax, ecx
shr eax, 0x12
xor eax, ecx
xor edx, edx
div ebx
cmp eax, esi
ja 0x410920
add eax, dword [ebp + 0xc]
pop ebx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x412490
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5cfecb
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
push esi
mov esi, ecx
push edi
lea ecx, [esi + 4]
mov dword [ebp - 0x14], esi
mov dword [esi], vtable.std::basic_streambuf_char__struct_std::char_traits_char__.0
call fcn.0051b97f
push 4
mov dword [ebp - 4], 0
call fcn.0052d4ce
mov edi, eax
add esp, 4
test edi, edi
je 0x412507
push ebx
call fcn.0051b664
mov dword [edi], eax
call fcn.0051b51e
push 0
lea ecx, [ebp - 0x10]
mov ebx, eax
call fcn.0051b249
mov eax, dword [ebx + 4]
cmp eax, 0xffffffff
jae 0x4124fc
inc eax
mov dword [ebx + 4], eax
lea ecx, [ebp - 0x10]
call fcn.0051b271
pop ebx
jmp 0x412509
xor edi, edi
mov dword [esi + 0x38], edi
lea eax, [esi + 8]
mov dword [esi + 0x10], eax
lea ecx, [esi + 0x18]
mov dword [esi + 0x20], ecx
lea edx, [esi + 0x1c]
mov dword [esi + 0x24], edx
lea eax, [esi + 0xc]
mov dword [esi + 0x14], eax
lea ecx, [esi + 0x28]
mov dword [esi + 0x30], ecx
lea edx, [esi + 0x2c]
mov dword [esi + 0x34], edx
mov dword [eax], 0
mov eax, dword [esi + 0x24]
mov dword [eax], 0
mov ecx, dword [esi + 0x34]
mov dword [ecx], 0
mov edx, dword [esi + 0x10]
mov dword [edx], 0
mov eax, dword [esi + 0x20]
mov dword [eax], 0
mov ecx, dword [esi + 0x30]
mov dword [ecx], 0
mov ecx, dword [ebp - 0xc]
pop edi
mov eax, esi
pop esi
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
Function at 0x4213f0
Capabilities:
Resume thread

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, ecx
mov eax, dword [esi + 4]
mov dword [esi], vtable.CThread.0
test eax, eax
je 0x42143b
cmp byte [esi + 0xe], 0
jne 0x42143b
cmp byte [esi + 0xc], 0
mov byte [esi + 0xe], 1
je 0x42141a
push eax
call dword [sym.imp.KERNEL32.dll_ResumeThread]
mov eax, dword [esi + 4]
push 0xffffffffffffffff
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov eax, dword [esi + 4]
test eax, eax
je 0x42143b
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi + 4], 0
test byte [ebp + 8], 1
je 0x42144a
push esi
call fcn.0052d217
add esp, 4
mov eax, esi
pop esi
pop ebp
ret 4

Function at 0x4266a0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5d1beb
mov eax, dword fs:[0]
push eax
sub esp, 0x22c
mov eax, dword [0x67e3b0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
xor ebx, ebx
push 0x103
lea eax, [ebp - 0x113]
push ebx
push eax
mov byte [ebp - 0x114], bl
call fcn.0052e6e0
add esp, 0xc
lea ecx, [ebp - 0x114]
push ecx
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
mov eax, dword [edi + 4]
mov ecx, dword [edi]
cmp ecx, eax
je 0x426731
mov edx, dword [ebp - 0x238]
push edx
push ecx
push eax
push eax
call fcn.0040dfa0
mov ecx, dword [ebp - 0x238]
push ecx
mov esi, eax
mov eax, dword [edi + 4]
lea edx, [edi + 0xc]
push edx
push eax
push esi
call fcn.0040e030
add esp, 0x20
mov dword [edi + 4], esi
lea ecx, [ebp - 0x114]
xor esi, esi
lea esp, [esp]
mov al, byte [ebp + esi - 0x114]
cmp al, 0x3b
je 0x426753
cmp al, bl
jne 0x42680c
push ecx
lea eax, [ebp - 0x218]
push eax
mov byte [ebp + esi - 0x114], bl
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea eax, [ebp - 0x218]
mov dword [ebp - 0x220], 0xf
mov dword [ebp - 0x224], ebx
mov byte [ebp - 0x234], bl
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x426787
sub eax, edx
push eax
lea ecx, [ebp - 0x218]
push ecx
lea ecx, [ebp - 0x234]
call fcn.00405440
lea edx, [ebp - 0x234]
push edx
mov ecx, edi
mov dword [ebp - 4], ebx
call fcn.00422bc0
mov dword [ebp - 4], 0xffffffff
cmp dword [ebp - 0x220], 0x10
jb 0x4267d3
mov eax, dword [ebp - 0x234]
push eax
call fcn.0052d217
add esp, 4
inc esi
cmp esi, 0x104
jge 0x426819
movsx ecx, byte [ebp + esi - 0x114]
push ecx
call fcn.0052f143
add esp, 4
test eax, eax
je 0x4267fa
cmp byte [ebp + esi - 0x114], bl
jne 0x4267d3
cmp byte [ebp + esi - 0x114], bl
lea eax, [ebp + esi - 0x114]
je 0x426819
mov ecx, eax
inc esi
cmp esi, 0x104
jl 0x426740
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00530614
mov esp, ebp
pop ebp
ret
Function at 0x4276a0
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5d0bd7
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x67e3b0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, dword [ebp + 8]
xor eax, eax
mov dword [ebp - 0x10], eax
mov dword [ebx], 0x6472e8
mov dword [ebx + 0x60], vtable.std::basic_ios_char__struct_std::char_traits_char__.0
mov dword [ebp - 4], eax
mov eax, dword [ebx]
mov ecx, dword [eax + 4]
mov dword [ebx + ecx], vtable.std::basic_ostream_char__struct_std::char_traits_char__.0
mov edx, dword [ebx]
mov edi, dword [edx + 4]
add edi, ebx
mov ecx, edi
mov dword [ebp - 0x10], 1
call fcn.00419130
lea esi, [ebx + 4]
push 0x20
mov ecx, edi
mov dword [edi + 0x38], esi
mov dword [edi + 0x3c], 0
call fcn.004165f0
cmp dword [edi + 0x38], 0
mov byte [edi + 0x40], al
jne 0x427733
mov eax, dword [edi + 0xc]
or eax, 4
or eax, 4
push 0
push eax
mov ecx, edi
call fcn.00419030
mov dword [ebp - 4], 2
mov eax, dword [ebx]
mov ecx, dword [eax + 4]
mov dword [ebx + ecx], vtable.std::basic_ofstream_char__struct_std::char_traits_char__.0
mov ecx, esi
call fcn.00412490
lea edx, [esi + 8]
mov dword [esi + 0x10], edx
lea ecx, [esi + 0x18]
mov dword [esi + 0x20], ecx
lea edx, [esi + 0x1c]
mov dword [esi + 0x24], edx
mov dword [esi], vtable.std::basic_filebuf_char__struct_std::char_traits_char__.0
mov byte [esi + 0x50], 0
mov byte [esi + 0x49], 0
lea ecx, [esi + 0x28]
mov dword [esi + 0x30], ecx
xor ecx, ecx
lea eax, [esi + 0xc]
mov dword [esi + 0x14], eax
lea edx, [esi + 0x2c]
mov dword [esi + 0x34], edx
mov dword [eax], ecx
mov eax, dword [esi + 0x24]
mov dword [eax], ecx
mov edx, dword [esi + 0x34]
mov dword [edx], ecx
mov eax, dword [esi + 0x10]
mov dword [eax], ecx
mov edx, dword [esi + 0x20]
mov dword [edx], ecx
mov eax, dword [esi + 0x30]
mov edx, dword [0x793918]
mov dword [eax], ecx
mov dword [esi + 0x54], ecx
mov dword [esi + 0x4c], edx
mov dword [esi + 0x44], ecx
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x4283c0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5d0b28
mov eax, dword fs:[0]
push eax
sub esp, 0x24
mov eax, dword [0x67e3b0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
xor ebx, ebx
cmp dword [edi + 0x44], ebx
je 0x4284e0
cmp byte [edi + 0x49], bl
je 0x4284e0
mov eax, dword [edi]
mov edx, dword [eax + 0xc]
push 0xffffffffffffffff
mov ecx, edi
call edx
cmp eax, 0xffffffff
je 0x4284d4
mov ecx, 0xf
xor eax, eax
mov byte [ebp - 0x2c], bl
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x1c], 8
cmp ecx, 0x10
jae 0x428434
lea eax, [ebp - 0x2c]
mov byte [eax + 8], bl
mov dword [ebp - 4], ebx
mov eax, dword [ebp - 0x2c]
mov ebx, dword [ebp - 0x18]
mov edx, eax
cmp ebx, 0x10
jae 0x42844c
lea edx, [ebp - 0x2c]
mov eax, edx
add edx, dword [ebp - 0x1c]
mov ecx, dword [edi + 0x44]
mov esi, dword [ecx]
lea ebx, [ebp - 0x30]
push ebx
push edx
push eax
lea eax, [edi + 0x4c]
push eax
mov eax, dword [esi + 0x18]
call eax
sub eax, 0
je 0x428475
dec eax
je 0x428479
sub eax, 2
lea ecx, [ebp - 0x2c]
jne 0x4284cf
jmp 0x4284db
mov byte [edi + 0x49], 0
mov ebx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x2c]
mov ecx, eax
cmp ebx, 0x10
jae 0x428489
lea ecx, [ebp - 0x2c]
mov esi, dword [ebp - 0x30]
sub esi, ecx
je 0x4284b2
cmp ebx, 0x10
jae 0x428498
lea eax, [ebp - 0x2c]
mov ecx, dword [edi + 0x54]
push ecx
push esi
push 1
push eax
call fcn.00560603
add esp, 0x10
cmp esi, eax
jne 0x4284cc
mov ebx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x2c]
cmp byte [edi + 0x49], 0
je 0x4284d8
test esi, esi
jne 0x428440
push esi
push 8
lea ecx, [ebp - 0x2c]
call fcn.0040c2b0
jmp 0x42843a
lea ecx, [ebp - 0x2c]
call fcn.004868c0
xor al, al
jmp 0x4284e2
lea ecx, [ebp - 0x2c]
call fcn.004868c0
mov al, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00530614
mov esp, ebp
pop ebp
ret