joyce8/EMBER2024-capa huggingface dataset:
Function at 0x6c87428d
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x6d362018]
movzx eax, word [eax + 0x14]
movzx eax, ax
mov edx, dword [0x6d362018]
add eax, edx
add eax, 0x18
mov dword [ebp - 0xc], eax
jmp 0x6c874359
jmp 0x6c874405
jmp 0x6c8744b1
jmp 0x6c87455d
jmp 0x6c874609
jmp 0x6c8746b5
jmp 0x6c874761
jmp 0x6c87480d
jmp 0x6c8748b9
jmp 0x6c874965
jmp 0x6c874a11
jmp 0x6c874abd
jmp 0x6c874b69
jmp 0x6c874c15
jmp 0x6c874cc1
jmp 0x6c874d6d
jmp 0x6c874e19
jmp 0x6c874ec5
mov dword [ebp - 0x14], 0
jmp 0x6c874f78
jmp 0x6c875024
jmp 0x6c8750d0
jmp 0x6c87517c
jmp 0x6c875228
jmp 0x6c8752d4
jmp 0x6c875380
jmp 0x6c87542c
jmp 0x6c8754d8
jmp 0x6c875584
jmp 0x6c875630
jmp 0x6c8756dc
jmp 0x6c875788
jmp 0x6c875834
jmp 0x6c8758e0
jmp 0x6c87598c
jmp 0x6c875a38
jmp 0x6c875ae4
mov dword [ebp - 0x18], 0
jmp 0x6c875b97
jmp 0x6c875c43
jmp 0x6c875cef
jmp 0x6c875d9b
jmp 0x6c875e47
jmp 0x6c875ef3
jmp 0x6c875f9f
jmp 0x6c87604b
jmp 0x6c8760f7
jmp 0x6c8761a3
jmp 0x6c87624f
jmp 0x6c8762fb
jmp 0x6c8763a7
jmp 0x6c876453
jmp 0x6c8764ff
jmp 0x6c8765ab
jmp 0x6c876657
jmp 0x6c876703
mov dword [ebp - 0x10], 0
jmp 0x6c8767b6
jmp 0x6c876862
jmp 0x6c87690e
jmp 0x6c8769ba
jmp 0x6c876a66
jmp 0x6c876b12
jmp 0x6c876bbe
jmp 0x6c876c6a
jmp 0x6c876d16
jmp 0x6c876dc2
jmp 0x6c876e6e
jmp 0x6c876f1a
jmp 0x6c876fc6
jmp 0x6c877072
jmp 0x6c87711e
jmp 0x6c8771ca
jmp 0x6c877276
jmp 0x6c877322
mov dword [ebp - 0x10], 0
jmp 0x6c87afee
jmp 0x6c8773da
jmp 0x6c877486
jmp 0x6c877532
jmp 0x6c8775de
jmp 0x6c87768a
jmp 0x6c877736
jmp 0x6c8777e2
jmp 0x6c87788e
jmp 0x6c87793a
jmp 0x6c8779e6
jmp 0x6c877a92
jmp 0x6c877b3e
jmp 0x6c877bea
jmp 0x6c877c96
jmp 0x6c877d42
jmp 0x6c877dee
jmp 0x6c877e9a
jmp 0x6c877f46
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0xc]
mov edx, dword [0x6d362014]
add eax, edx
mov dword [ebp - 0x14], eax
jmp 0x6c878003
jmp 0x6c8780af
jmp 0x6c87815b
jmp 0x6c878207
jmp 0x6c8782b3
jmp 0x6c87835f
jmp 0x6c87840b
jmp 0x6c8784b7
jmp 0x6c878563
jmp 0x6c87860f
jmp 0x6c8786bb
jmp 0x6c878767
jmp 0x6c878813
jmp 0x6c8788bf
jmp 0x6c87896b
jmp 0x6c878a17
jmp 0x6c878ac3
jmp 0x6c878b6f
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0x14]
mov edx, dword [0x6d36201c]
add eax, edx
mov dword [ebp - 0x18], eax
jmp 0x6c878c2c
jmp 0x6c878cd8
jmp 0x6c878d84
jmp 0x6c878e30
jmp 0x6c878edc
jmp 0x6c878f88
jmp 0x6c879034
jmp 0x6c8790e0
jmp 0x6c87918c
jmp 0x6c879238
jmp 0x6c8792e4
jmp 0x6c879390
jmp 0x6c87943c
jmp 0x6c8794e8
jmp 0x6c879594
jmp 0x6c879640
jmp 0x6c8796ec
jmp 0x6c879798
mov eax, dword [0x6d362008]
mov edx, dword [ebp - 0xc]
mov edx, dword [edx + 0x10]
mov dword [esp + 8], edx
mov edx, dword [ebp - 0x18]
mov dword [esp + 4], edx
mov edx, dword [ebp - 0x14]
mov dword [esp], edx
call eax
jmp fcn.6c879862
mov eax, dword [0x6d362018]
movzx eax, word [eax + 6]
movzx eax, ax
cmp eax, dword [ebp - 0x10]
ja 0x6c87732e
nop
leave
ret
Function at 0x401a30
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
mov eax, dword [0x48e0c0]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
mov dword [ebp - 0x40], ecx
mov ecx, 0xb
mov esi, str._pipediscord_ipc_0
lea edi, [ebp - 0x34]
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
mov dword [ebp - 0x44], 0x15
mov eax, 2
imul ecx, eax, 0x15
mov edx, 0x30
mov word [ebp + ecx - 0x34], dx
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0x38], eax
push 0
push 0
push 3
push 0
push 0
push 0xc0000000
lea ecx, [ebp - 0x34]
push ecx
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edx, dword [ebp - 0x38]
mov dword [edx + 4], eax
mov eax, dword [ebp - 0x38]
cmp dword [eax + 4], 0xffffffff
je 0x401aa7
mov ecx, dword [ebp - 0x38]
mov byte [ecx], 1
mov al, 1
jmp 0x401b18
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x3c], eax
cmp dword [ebp - 0x3c], 2
jne 0x401aea
mov edx, 2
imul eax, edx, 0x15
movzx ecx, word [ebp + eax - 0x34]
cmp ecx, 0x39
jge 0x401ae8
mov edx, 2
imul eax, edx, 0x15
mov cx, word [ebp + eax - 0x34]
add cx, 1
mov edx, 2
imul eax, edx, 0x15
mov word [ebp + eax - 0x34], cx
jmp 0x401a75
jmp 0x401b0f
cmp dword [ebp - 0x3c], 0xe7
jne 0x401b0f
push 0x2710
lea ecx, [ebp - 0x34]
push ecx
call dword [sym.imp.KERNEL32.dll_WaitNamedPipeW]
test eax, eax
jne 0x401b0a
xor al, al
jmp 0x401b18
jmp 0x401a75
xor al, al
jmp 0x401b18
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0046367e
mov esp, ebp
pop ebp
ret

Function at 0x401b30
Capabilities:
Read file on windows
Read pipe

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov dword [ebp - 8], ecx
cmp dword [ebp + 8], 0
jne 0x401b46
xor al, al
jmp 0x401bdb
mov eax, dword [ebp - 8]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x401b59
xor al, al
jmp 0x401bdb
mov ecx, dword [ebp - 4]
cmp dword [ecx + 4], 0xffffffff
jne 0x401b66
xor al, al
jmp 0x401bdb
mov dword [ebp - 0xc], 0
push 0
lea edx, [ebp - 0xc]
push edx
push 0
push 0
push 0
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 4]
push ecx
call dword [sym.imp.KERNEL32.dll_PeekNamedPipe]
test eax, eax
je 0x401bd0
mov edx, dword [ebp - 0xc]
cmp edx, dword [ebp + 0xc]
jb 0x401bce
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x10], 0
push 0
lea ecx, [ebp - 0x10]
push ecx
mov edx, dword [ebp - 0x14]
push edx
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 4]
push edx
call dword [sym.imp.KERNEL32.dll_ReadFile]
cmp eax, 1
jne 0x401bc5
mov al, 1
jmp 0x401bdb
mov ecx, dword [ebp - 8]
call fcn.004019d0
nop
jmp 0x401bd9
mov ecx, dword [ebp - 8]
call fcn.004019d0
nop
xor al, al
mov esp, ebp
pop ebp
ret 8
Function at 0x401bf0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov dword [ebp - 0x14], ecx
cmp dword [ebp + 0xc], 0
jne 0x401c03
mov al, 1
jmp 0x401c72
mov eax, dword [ebp - 0x14]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x401c13
xor al, al
jmp 0x401c72
mov ecx, dword [ebp - 4]
cmp dword [ecx + 4], 0xffffffff
jne 0x401c20
xor al, al
jmp 0x401c72
cmp dword [ebp + 8], 0
jne 0x401c2a
xor al, al
jmp 0x401c72
mov edx, dword [ebp + 0xc]
mov dword [ebp - 0xc], edx
mov dword [ebp - 8], 0
push 0
lea eax, [ebp - 8]
push eax
mov ecx, dword [ebp - 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 4]
push ecx
call dword [sym.imp.KERNEL32.dll_WriteFile]
cmp eax, 1
jne 0x401c68
mov edx, dword [ebp - 8]
cmp edx, dword [ebp - 0xc]
jne 0x401c68
mov dword [ebp - 0x10], 1
jmp 0x401c6f
mov dword [ebp - 0x10], 0
mov al, byte [ebp - 0x10]
mov esp, ebp
pop ebp
ret 8

Function at 0x4020b0
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [ebp + 8]
mov dword [ebp - 0xc], eax
mov dword [ebp - 4], 0
cmp dword [ebp + 0xc], 0
je 0x402111
mov ecx, 2
imul edx, ecx, 0
mov eax, dword [ebp + 0xc]
movzx ecx, word [eax + edx]
test ecx, ecx
je 0x402111
push 0
lea edx, [ebp - 4]
push edx
push 0
push 0xf003f
push 0
push 0
push 0
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x40210b
mov eax, dword [ebp - 8]
jmp 0x40214c
mov edx, dword [ebp - 4]
mov dword [ebp - 0xc], edx
mov eax, dword [ebp + 0x1c]
push eax
mov ecx, dword [ebp + 0x18]
push ecx
mov edx, dword [ebp + 0x14]
push edx
push 0
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp - 0xc]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov dword [ebp - 8], eax
cmp dword [ebp - 4], 0
je 0x402149
mov edx, dword [ebp - 4]
cmp edx, dword [ebp + 8]
je 0x402149
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop
mov eax, dword [ebp - 8]
mov esp, ebp
pop ebp
ret
Function at 0x402200
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xaa0
mov eax, dword [0x48e0c0]
xor eax, ebp
mov dword [ebp - 4], eax
push 0x20
lea eax, [ebp - 0x84]
push eax
push 0xffffffffffffffff
mov ecx, dword [ebp + 8]
push ecx
push 0
push 0xfde9
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
push 0x20
lea edx, [ebp - 0x44]
push edx
push 0xffffffffffffffff
mov eax, dword [ebp + 0xc]
push eax
push 0
push 0xfde9
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
lea ecx, [ebp - 0xa9c]
push ecx
push 0x20019
push 0
push str.SoftwareValveSteam
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov dword [ebp - 0xa94], eax
cmp dword [ebp - 0xa94], 0
je 0x402293
push str.Error_opening_Steam_key_n
push 2
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
add esp, 4
push eax
call fcn.00402470
add esp, 8
jmp 0x40239e
mov dword [ebp - 0xa98], 0x208
lea edx, [ebp - 0xa98]
push edx
lea eax, [ebp - 0x28c]
push eax
push 0
push 0
push str.SteamExe
mov ecx, dword [ebp - 0xa9c]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov dword [ebp - 0xa94], eax
mov edx, dword [ebp - 0xa9c]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop
cmp dword [ebp - 0xa94], 0
jne 0x4022e7
cmp dword [ebp - 0xa98], 1
jae 0x402305
push str.Error_reading_SteamExe_key_n
push 2
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
add esp, 4
push eax
call fcn.00402470
add esp, 8
jmp 0x40239e
mov eax, dword [ebp - 0xa98]
shr eax, 1
mov dword [ebp - 0xaa0], eax
mov dword [ebp - 0xa90], 0
jmp 0x40232e
mov ecx, dword [ebp - 0xa90]
add ecx, 1
mov dword [ebp - 0xa90], ecx
mov edx, dword [ebp - 0xa90]
cmp edx, dword [ebp - 0xaa0]
jae 0x402364
mov eax, dword [ebp - 0xa90]
movzx ecx, word [ebp + eax*2 - 0x28c]
cmp ecx, 0x2f
jne 0x402362
mov edx, 0x5c
mov eax, dword [ebp - 0xa90]
mov word [ebp + eax*2 - 0x28c], dx
jmp 0x40231f
lea ecx, [ebp - 0x44]
push ecx
lea edx, [ebp - 0x28c]
push edx
push str.__s__steam:__rungameid__s
push 0x800
lea eax, [ebp - 0xa8c]
push eax
call fcn.00401f60
add esp, 0x14
lea ecx, [ebp - 0xa8c]
push ecx
lea edx, [ebp - 0x84]
push edx
call fcn.00401c80
add esp, 8
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0046367e
mov esp, ebp
pop ebp
ret
Function at 0x403110
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4656ed
mov eax, dword fs:[0]
push eax
sub esp, 0xc
mov eax, dword [0x48e0c0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], ecx
mov eax, dword [ebp + 8]
push eax
lea ecx, [ebp - 0x14]
push ecx
call fcn.00403560
add esp, 8
mov dword [ebp - 4], 0
mov dword [ebp - 0x18], 0x403060
mov edx, dword [ebp - 0x10]
add edx, 4
push edx
push 0
lea ecx, [ebp - 0x14]
call fcn.004045d0
push eax
mov eax, dword [ebp - 0x18]
push eax
push 0
push 0
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
add esp, 0x18
mov ecx, dword [ebp - 0x10]
mov dword [ecx], eax
mov edx, dword [ebp - 0x10]
cmp dword [edx], 0
je 0x403191
lea ecx, [ebp - 0x14]
call fcn.004066a0
nop
jmp 0x4031a3
mov eax, dword [ebp - 0x10]
mov dword [eax + 4], 0
push 6
call sub.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_
nop
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x14]
call fcn.004044c0
nop
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret 4

Function at 0x413770
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4656ed
mov eax, dword fs:[0]
push eax
sub esp, 0xc
mov eax, dword [0x48e0c0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], ecx
mov eax, dword [ebp + 8]
push eax
lea ecx, [ebp - 0x14]
push ecx
call fcn.00413da0
add esp, 8
mov dword [ebp - 4], 0
mov dword [ebp - 0x18], 0x413360
mov edx, dword [ebp - 0x10]
add edx, 4
push edx
push 0
lea ecx, [ebp - 0x14]
call fcn.004045d0
push eax
mov eax, dword [ebp - 0x18]
push eax
push 0
push 0
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
add esp, 0x18
mov ecx, dword [ebp - 0x10]
mov dword [ecx], eax
mov edx, dword [ebp - 0x10]
cmp dword [edx], 0
je 0x4137f1
lea ecx, [ebp - 0x14]
call fcn.004066a0
nop
jmp 0x413803
mov eax, dword [ebp - 0x10]
mov dword [eax + 4], 0
push 6
call sub.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_
nop
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x14]
call fcn.004044c0
nop
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret 4
Function at 0x4151e0
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4658a0
mov eax, dword fs:[0]
push eax
mov eax, dword [0x48e0c0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [0x4cd1f0], 0x30
mov dword [0x4cd1f4], 0x40
mov dword [0x4cd1f8], 0x4164c0
mov dword [0x4cd1fc], 0
mov dword [0x4cd200], 0
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov dword [0x4cd204], eax
mov dword [0x4cd208], 0
mov dword [0x4cd20c], 0
mov dword [0x4cd210], 0
mov dword [0x4cd214], 0
mov dword [0x4cd218], 0x46a4a0
mov dword [0x4cd21c], 0
push 0x4cd1f0
call dword [sym.imp.USER32.dll_RegisterClassExA]
push 0
mov eax, dword [0x4cd204]
push eax
push 0
push 0
push 0x218
push 0x181
push 0x64
push 0x64
push 0x80000000
mov ecx, dword [ebp + 8]
push ecx
push str.class001
push 0
call dword [sym.imp.USER32.dll_CreateWindowExA]
mov dword [0x4cd1ec], eax
push 0xa
mov edx, dword [0x4cd1ec]
push edx
call dword [sym.imp.USER32.dll_ShowWindow]
mov eax, dword [0x4cd1ec]
push eax
call dword [sym.imp.USER32.dll_UpdateWindow]
nop
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret

Function at 0x415520
Capabilities:
Execute command

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x465ebd
mov eax, dword fs:[0]
push eax
sub esp, 0x60
mov eax, dword [0x48e0c0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 4], 1
lea eax, [ebp + 0x20]
push eax
push 0x46a510
lea ecx, [ebp + 8]
push ecx
push 0x46a51c
lea edx, [ebp - 0x58]
push edx
call fcn.004124a0
add esp, 0xc
mov dword [ebp - 0x5c], eax
mov eax, dword [ebp - 0x5c]
mov dword [ebp - 0x60], eax
mov byte [ebp - 4], 2
mov ecx, dword [ebp - 0x60]
push ecx
lea edx, [ebp - 0x40]
push edx
call fcn.00412470
add esp, 0xc
mov dword [ebp - 0x64], eax
mov eax, dword [ebp - 0x64]
mov dword [ebp - 0x68], eax
mov byte [ebp - 4], 3
mov ecx, dword [ebp - 0x68]
push ecx
lea edx, [ebp - 0x28]
push edx
call fcn.00412440
add esp, 0xc
mov byte [ebp - 4], 5
lea ecx, [ebp - 0x40]
call fcn.00414ac0
mov byte [ebp - 4], 6
lea ecx, [ebp - 0x58]
call fcn.00414ac0
nop
lea ecx, [ebp - 0x28]
call fcn.00417740
mov dword [ebp - 0x6c], eax
push 0x46a52c
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
add esp, 4
mov eax, dword [ebp - 0x6c]
push eax
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
add esp, 4
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x28]
call fcn.00414ac0
mov byte [ebp - 4], 0
lea ecx, [ebp + 8]
call fcn.00414ac0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 0x20]
call fcn.00414ac0
nop
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0046367e
mov esp, ebp
pop ebp
ret

Function at 0x415800
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
movzx eax, byte [0x4c51b0]
test eax, eax
jne 0x415829
push 5
push 0
push 0
mov ecx, dword [ebp + 8]
push ecx
push 0
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
mov byte [0x4c51b0], 1
pop ebp
ret
Function at 0x416490
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push ecx
call dword [sym.imp.KERNEL32.dll_AllocConsole]
push 0
push 0x46a4fc
call dword [sym.imp.USER32.dll_FindWindowA]
mov dword [ebp - 4], eax
push 0
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
nop
mov esp, ebp
pop ebp
ret
Function at 0x4193a0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov dword [ebp - 8], ecx
cmp dword [ebp + 0x10], 0
jg 0x4193c0
jl 0x4193b7
cmp dword [ebp + 0xc], 0
ja 0x4193c0
xor eax, eax
xor edx, edx
jmp 0x419508
mov eax, dword [ebp - 8]
cmp dword [eax + 0x38], 0
je 0x4193e3
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 8]
call dword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____thiscall_std::basic_streambuf_char__struct_std::char_traits_char__::xsgetn_char___long_long___int64__]
jmp 0x419508
mov ecx, dword [ebp + 0xc]
mov dword [ebp - 4], ecx
mov edx, dword [ebp + 0xc]
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x28], edx
mov dword [ebp - 0x24], eax
mov ecx, dword [ebp - 8]
call dword [sym.imp.MSVCP140.dll_protected:_long_long___int64____thiscall_std::basic_streambuf_char__struct_std::char_traits_char__::_Gnavail_void_const]
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
jbe 0x419456
lea ecx, [ebp - 0x14]
push ecx
lea edx, [ebp - 4]
push edx
call fcn.00413e30
add esp, 8
mov eax, dword [eax]
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp - 0xc]
push ecx
mov ecx, dword [ebp - 8]
call dword [sym.imp.MSVCP140.dll_protected:_char____thiscall_std::basic_streambuf_char__struct_std::char_traits_char__::gptr_void_const]
push eax
mov edx, dword [ebp + 8]
push edx
call fcn.00417870
add esp, 0xc
mov eax, dword [ebp + 8]
add eax, dword [ebp - 0xc]
mov dword [ebp + 8], eax
mov ecx, dword [ebp - 4]
sub ecx, dword [ebp - 0xc]
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 0xc]
push edx
mov ecx, dword [ebp - 8]
call dword [sym.imp.MSVCP140.dll_protected:_void___thiscall_std::basic_streambuf_char__struct_std::char_traits_char__::gbump_int_]
nop
mov eax, dword [ebp - 8]
cmp dword [eax + 0x4c], 0
je 0x4194f9
mov ecx, dword [ebp - 8]
call fcn.00417000
mov dword [ebp - 0x20], 0xfff
cmp dword [ebp - 4], 0xfff
jbe 0x4194c7
mov ecx, dword [ebp - 8]
mov edx, dword [ecx + 0x4c]
push edx
push 0xfff
push 1
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
add esp, 0x10
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp + 8]
add ecx, dword [ebp - 0x10]
mov dword [ebp + 8], ecx
mov edx, dword [ebp - 4]
sub edx, dword [ebp - 0x10]
mov dword [ebp - 4], edx
cmp dword [ebp - 0x10], 0xfff
je 0x4194c5
xor eax, eax
mov ecx, dword [ebp - 0x28]
sub ecx, dword [ebp - 4]
mov edx, dword [ebp - 0x24]
sbb edx, eax
mov eax, ecx
jmp 0x419508
jmp 0x419472
cmp dword [ebp - 4], 0
jbe 0x4194f9
mov edx, dword [ebp - 8]
mov eax, dword [edx + 0x4c]
push eax
mov ecx, dword [ebp - 4]
push ecx
push 1
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
add esp, 0x10
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 4]
mov dword [ebp - 0x18], eax
mov ecx, dword [ebp - 0x18]
sub ecx, dword [ebp - 0x1c]
mov dword [ebp - 4], ecx
xor edx, edx
mov eax, dword [ebp - 0x28]
sub eax, dword [ebp - 4]
mov ecx, dword [ebp - 0x24]
sbb ecx, edx
mov edx, ecx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x419510
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov dword [ebp - 4], ecx
mov eax, dword [ebp - 4]
cmp dword [eax + 0x38], 0
je 0x41953c
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 4]
call dword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____thiscall_std::basic_streambuf_char__struct_std::char_traits_char__::xsputn_char_const___long_long___int64__]
jmp 0x419623
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp + 0x10]
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x10], edx
mov ecx, dword [ebp - 4]
call dword [sym.imp.MSVCP140.dll_protected:_long_long___int64____thiscall_std::basic_streambuf_char__struct_std::char_traits_char__::_Pnavail_void_const]
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], edx
cmp dword [ebp + 0x10], 0
jl 0x4195d4
jg 0x419565
cmp dword [ebp + 0xc], 0
jbe 0x4195d4
cmp dword [ebp - 8], 0
jl 0x4195d4
jg 0x419573
cmp dword [ebp - 0xc], 0
jbe 0x4195d4
mov eax, dword [ebp + 0x10]
cmp eax, dword [ebp - 8]
jg 0x419591
jl 0x419585
mov ecx, dword [ebp + 0xc]
cmp ecx, dword [ebp - 0xc]
jae 0x419591
mov edx, dword [ebp + 0xc]
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0xc], edx
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
mov ecx, dword [ebp - 4]
call dword [sym.imp.MSVCP140.dll_protected:_char____thiscall_std::basic_streambuf_char__struct_std::char_traits_char__::pptr_void_const]
push eax
call fcn.00417870
add esp, 0xc
mov eax, dword [ebp - 0xc]
add eax, dword [ebp + 8]
mov dword [ebp + 8], eax
mov ecx, dword [ebp + 0xc]
sub ecx, dword [ebp - 0xc]
mov edx, dword [ebp + 0x10]
sbb edx, dword [ebp - 8]
mov dword [ebp + 0xc], ecx
mov dword [ebp + 0x10], edx
mov eax, dword [ebp - 0xc]
push eax
mov ecx, dword [ebp - 4]
call dword [sym.imp.MSVCP140.dll_protected:_void___thiscall_std::basic_streambuf_char__struct_std::char_traits_char__::pbump_int_]
nop
cmp dword [ebp + 0x10], 0
jl 0x419617
jg 0x4195e2
cmp dword [ebp + 0xc], 0
jbe 0x419617
mov ecx, dword [ebp - 4]
cmp dword [ecx + 0x4c], 0
je 0x419617
mov edx, dword [ebp - 4]
mov eax, dword [edx + 0x4c]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
push 1
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
add esp, 0x10
xor ecx, ecx
mov edx, dword [ebp + 0xc]
sub edx, eax
mov eax, dword [ebp + 0x10]
sbb eax, ecx
mov dword [ebp + 0xc], edx
mov dword [ebp + 0x10], eax
mov eax, dword [ebp - 0x14]
sub eax, dword [ebp + 0xc]
mov edx, dword [ebp - 0x10]
sbb edx, dword [ebp + 0x10]
mov esp, ebp
pop ebp
ret 0xc
Function at 0x4262f0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0x1c]
push eax
mov ecx, dword [ebp + 0x14]
push ecx
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
add esp, 0x10
xor edx, edx
pop ebp
ret

Function at 0x426310
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0x1c]
push eax
mov ecx, dword [ebp + 0x14]
push ecx
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
add esp, 0x10
xor edx, edx
pop ebp
ret

Function at 0x4264e0
Capabilities:
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [ebp + 0x10]
not eax
mov dword [ebp - 4], eax
mov ecx, dword [ebp + 8]
mov dword [ebp - 8], ecx
mov dword [ebp - 0x10], 0x46cbf0
mov edx, dword [ebp + 0xc]
mov dword [ebp - 0xc], edx
mov eax, dword [ebp + 0xc]
sub eax, 1
mov dword [ebp + 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x426541
mov ecx, dword [ebp - 4]
shr ecx, 8
mov edx, dword [ebp - 4]
and edx, 0xff
mov eax, dword [ebp - 8]
movzx eax, byte [eax]
xor edx, eax
mov eax, dword [ebp - 0x10]
xor ecx, dword [eax + edx*4]
mov dword [ebp - 0x14], ecx
mov ecx, dword [ebp - 8]
add ecx, 1
mov dword [ebp - 8], ecx
mov edx, dword [ebp - 0x14]
mov dword [ebp - 4], edx
jmp 0x4264fb
mov eax, dword [ebp - 4]
not eax
mov esp, ebp
pop ebp
ret