joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1000c250
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x1004ecee
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xd8
push esi
mov esi, ecx
mov dword [esp + 0xc], 0
lea ecx, [esp + 0x90]
mov dword [esp + 0x28], 0x10053968
mov dword [esp + 0x38], 0x10053960
call dword [sym.imp.MSVCP120.dll_protected:_void___thiscall_std::basic_ios_char__struct_std::char_traits_char__::constructor_void_]
push 0
lea eax, [esp + 0x44]
mov dword [esp + 0xe8], 0
push eax
lea ecx, [esp + 0x30]
mov dword [esp + 0x14], 1
call dword [sym.imp.MSVCP120.dll_public:_void___thiscall_std::basic_iostream_char__struct_std::char_traits_char__::constructor_class_std::basic_streambuf_char__struct_std::char_traits_char____]
mov dword [esp + 0xe4], 1
mov eax, dword [esp + 0x28]
mov eax, dword [eax + 4]
mov dword [esp + eax + 0x28], vtable.std::basic_stringstream_char__struct_std::char_traits_char___class_std::allocator_char__.0
mov eax, dword [esp + 0x28]
mov ecx, dword [eax + 4]
lea eax, [ecx - 0x68]
mov dword [esp + ecx + 0x24], eax
lea ecx, [esp + 0x40]
call dword [sym.imp.MSVCP120.dll_protected:_void___thiscall_std::basic_streambuf_char__struct_std::char_traits_char__::constructor_void_]
mov dword [esp + 0x40], vtable.std::basic_stringbuf_char__struct_std::char_traits_char___class_std::allocator_char__.0
mov dword [esp + 0x78], 0
mov dword [esp + 0x7c], 0
mov eax, dword [ebp + 0xc]
lea ecx, [esp + 0x38]
mov dword [esp + 0xe4], 3
push dword [eax]
call dword [sym.imp.MSVCP120.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______thiscall_std::basic_ostream_char__struct_std::char_traits_char__::operator___unsigned_int_]
lea eax, [esp + 0x10]
push eax
lea ecx, [esp + 0x2c]
call fcn.10005470
push eax
push dword [ebp + 8]
mov byte [esp + 0xec], 4
mov ecx, dword [esi + 4]
call fcn.100333e0
cmp dword [esp + 0x24], 0x10
jb 0x1000c357
push dword [esp + 0x10]
call dword [sym.imp.MSVCR120.dll_void___cdecl_operator_delete_void__]
add esp, 4
mov eax, dword [esp + 0x28]
mov dword [esp + 0x24], 0xf
mov dword [esp + 0x20], 0
mov byte [esp + 0x10], 0
mov eax, dword [eax + 4]
mov dword [esp + eax + 0x28], vtable.std::basic_stringstream_char__struct_std::char_traits_char___class_std::allocator_char__.0
mov eax, dword [esp + 0x28]
mov ecx, dword [eax + 4]
lea eax, [ecx - 0x68]
mov dword [esp + ecx + 0x24], eax
lea ecx, [esp + 0x40]
call fcn.10005490
lea ecx, [esp + 0x48]
call dword [sym.imp.MSVCP120.dll_public_virtual:_void___thiscall_std::basic_iostream_char__struct_std::char_traits_char__::destructor_void_]
lea ecx, [esp + 0x90]
call dword [sym.imp.MSVCP120.dll_public_virtual:_void___thiscall_std::basic_ios_char__struct_std::char_traits_char__::destructor_void_]
mov ecx, dword [esp + 0xdc]
mov eax, 1
mov dword fs:[0], ecx
pop esi
mov esp, ebp
pop ebp
ret 8
Function at 0x1000c3d0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x1004ecee
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xd8
push esi
mov esi, ecx
mov dword [esp + 0xc], 0
lea ecx, [esp + 0x90]
mov dword [esp + 0x28], 0x10053968
mov dword [esp + 0x38], 0x10053960
call dword [sym.imp.MSVCP120.dll_protected:_void___thiscall_std::basic_ios_char__struct_std::char_traits_char__::constructor_void_]
push 0
lea eax, [esp + 0x44]
mov dword [esp + 0xe8], 0
push eax
lea ecx, [esp + 0x30]
mov dword [esp + 0x14], 1
call dword [sym.imp.MSVCP120.dll_public:_void___thiscall_std::basic_iostream_char__struct_std::char_traits_char__::constructor_class_std::basic_streambuf_char__struct_std::char_traits_char____]
mov dword [esp + 0xe4], 1
mov eax, dword [esp + 0x28]
mov eax, dword [eax + 4]
mov dword [esp + eax + 0x28], vtable.std::basic_stringstream_char__struct_std::char_traits_char___class_std::allocator_char__.0
mov eax, dword [esp + 0x28]
mov ecx, dword [eax + 4]
lea eax, [ecx - 0x68]
mov dword [esp + ecx + 0x24], eax
lea ecx, [esp + 0x40]
call dword [sym.imp.MSVCP120.dll_protected:_void___thiscall_std::basic_streambuf_char__struct_std::char_traits_char__::constructor_void_]
mov dword [esp + 0x40], vtable.std::basic_stringbuf_char__struct_std::char_traits_char___class_std::allocator_char__.0
mov dword [esp + 0x78], 0
mov dword [esp + 0x7c], 0
mov eax, dword [ebp + 0xc]
lea ecx, [esp + 0x38]
mov dword [esp + 0xe4], 3
push dword [eax]
call dword [sym.imp.MSVCP120.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______thiscall_std::basic_ostream_char__struct_std::char_traits_char__::operator___int_]
lea eax, [esp + 0x10]
push eax
lea ecx, [esp + 0x2c]
call fcn.10005470
push eax
push dword [ebp + 8]
mov byte [esp + 0xec], 4
mov ecx, dword [esi + 4]
call fcn.100333e0
cmp dword [esp + 0x24], 0x10
jb 0x1000c4d7
push dword [esp + 0x10]
call dword [sym.imp.MSVCR120.dll_void___cdecl_operator_delete_void__]
add esp, 4
mov eax, dword [esp + 0x28]
mov dword [esp + 0x24], 0xf
mov dword [esp + 0x20], 0
mov byte [esp + 0x10], 0
mov eax, dword [eax + 4]
mov dword [esp + eax + 0x28], vtable.std::basic_stringstream_char__struct_std::char_traits_char___class_std::allocator_char__.0
mov eax, dword [esp + 0x28]
mov ecx, dword [eax + 4]
lea eax, [ecx - 0x68]
mov dword [esp + ecx + 0x24], eax
lea ecx, [esp + 0x40]
call fcn.10005490
lea ecx, [esp + 0x48]
call dword [sym.imp.MSVCP120.dll_public_virtual:_void___thiscall_std::basic_iostream_char__struct_std::char_traits_char__::destructor_void_]
lea ecx, [esp + 0x90]
call dword [sym.imp.MSVCP120.dll_public_virtual:_void___thiscall_std::basic_ios_char__struct_std::char_traits_char__::destructor_void_]
mov ecx, dword [esp + 0xdc]
mov eax, 1
mov dword fs:[0], ecx
pop esi
mov esp, ebp
pop ebp
ret 8
Function at 0x100141c0
Capabilities:
Encode data using base64

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push edi
mov edi, dword [ebp + 8]
test edi, edi
je 0x10014307
mov esi, dword [ebp + 0xc]
test esi, esi
je 0x10014307
push ebx
mov ebx, dword [ebp + 0x10]
mov eax, 0x55555556
imul ebx
mov ecx, edi
mov eax, edx
shr eax, 0x1f
add eax, edx
lea eax, [eax + eax*2]
mov dword [ebp - 4], eax
test eax, eax
jle 0x10014272
lea edx, [eax - 1]
mov eax, 0xaaaaaaab
mul edx
mov edi, edx
shr edi, 1
inc edi
lea esp, [esp]
movzx eax, byte [esi]
shr eax, 2
movzx eax, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_T]
mov byte [ecx], al
movzx edx, byte [esi]
movzx eax, byte [esi + 1]
and edx, 3
shr eax, 4
add edx, edx
movzx eax, byte [eax + edx*8 + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_T]
mov byte [ecx + 1], al
movzx edx, byte [esi + 1]
movzx eax, byte [esi + 2]
and edx, 0xf
shr eax, 6
movzx eax, byte [eax + edx*4 + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_T]
mov byte [ecx + 2], al
movzx eax, byte [esi + 2]
add esi, 3
and eax, 0x3f
movzx eax, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_T]
mov byte [ecx + 3], al
add ecx, 4
dec edi
jne 0x10014210
mov edi, dword [ebp + 8]
mov eax, dword [ebp - 4]
sub ebx, eax
cmp ebx, 1
jne 0x100142b2
movzx eax, byte [esi]
shr eax, 2
pop ebx
movzx eax, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_T]
mov byte [ecx], al
movzx eax, byte [esi]
and eax, 3
shl eax, 4
movzx eax, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_T]
mov byte [ecx + 1], al
mov word [ecx + 2], 0x3d3d
add ecx, 4
mov byte [ecx], 0
sub ecx, edi
pop edi
mov eax, ecx
pop esi
mov esp, ebp
pop ebp
ret
cmp ebx, 2
jne 0x100142f9
movzx eax, byte [esi]
shr eax, 2
movzx eax, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_T]
mov byte [ecx], al
movzx edx, byte [esi]
movzx eax, byte [esi + 1]
and edx, 3
shr eax, 4
add edx, edx
movzx eax, byte [eax + edx*8 + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_T]
mov byte [ecx + 1], al
movzx eax, byte [esi + 1]
and eax, 0xf
movzx eax, byte [eax*4 + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_T]
mov byte [ecx + 2], al
mov byte [ecx + 3], 0x3d
add ecx, 4
pop ebx
mov byte [ecx], 0
sub ecx, edi
pop edi
mov eax, ecx
pop esi
mov esp, ebp
pop ebp
ret
pop edi
or eax, 0xffffffff
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x100145c0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x1004f080
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x20
push esi
push 0
push 0x10053860
lea ecx, [esp + 0x10]
mov dword [esp + 0xc], 0
mov dword [esp + 0x24], 0xf
mov dword [esp + 0x20], 0
mov byte [esp + 0x10], 0
call fcn.10001a10
push dword [ebp + 0x10]
lea ecx, [esp + 0xc]
mov dword [esp + 0x30], 0
push dword [ebp + 0xc]
call fcn.10001f40
mov esi, dword [ebp + 8]
lea eax, [esp + 8]
push eax
push esi
call sym.KwLib.dll_class_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char_____cdecl_KwLib::Charset::GB18030ToUTF8_class_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char___const__
add esp, 8
cmp dword [esp + 0x1c], 0x10
jb 0x10014648
push dword [esp + 8]
call dword [sym.imp.MSVCR120.dll_void___cdecl_operator_delete_void__]
add esp, 4
mov ecx, dword [esp + 0x24]
mov eax, esi
mov dword fs:[0], ecx
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x100147b0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x1004f0bd
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x20
push esi
push 0
push 0x10053860
lea ecx, [esp + 0x10]
mov dword [esp + 0xc], 0
mov dword [esp + 0x24], 0xf
mov dword [esp + 0x20], 0
mov byte [esp + 0x10], 0
call fcn.10001a10
push dword [ebp + 0x10]
lea ecx, [esp + 0xc]
mov dword [esp + 0x30], 0
push dword [ebp + 0xc]
call fcn.10001f40
mov esi, dword [ebp + 8]
lea eax, [esp + 8]
push eax
push esi
call sym.KwLib.dll_class_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char_____cdecl_KwLib::Charset::UTF8ToGB18030_class_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char___const__
add esp, 8
cmp dword [esp + 0x1c], 0x10
jb 0x10014838
push dword [esp + 8]
call dword [sym.imp.MSVCR120.dll_void___cdecl_operator_delete_void__]
add esp, 4
mov ecx, dword [esp + 0x24]
mov eax, esi
mov dword fs:[0], ecx
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x10017f60
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x70
push dword [ebp + 0x10]
lea eax, [esp + 0x1c]
mov dword [esp + 8], 0
push dword [ebp + 0xc]
lea ecx, [esp + 0x10]
mov dword [esp + 0x10], 0
push eax
mov dword [esp + 0x18], 0
mov dword [esp + 0x1c], 0
mov dword [esp + 0x20], 0
mov dword [esp + 0x24], 0
mov dword [esp + 0x28], 0
mov dword [esp + 0x2c], 0x67452301
mov dword [esp + 0x30], 0xefcdab89
mov dword [esp + 0x34], 0x98badcfe
mov dword [esp + 0x38], 0x10325476
call sym.KwLib.dll_private:_void___thiscall_CMD5::md5_update_struct_CMD5::md5_context___unsigned_char___unsigned_long_int_
lea eax, [esp + 8]
push eax
lea eax, [esp + 0x1c]
push eax
lea ecx, [esp + 0x10]
call sym.KwLib.dll_private:_void___thiscall_CMD5::md5_finish_struct_CMD5::md5_context___unsigned_char__const_
push dword [ebp + 0x18]
lea ecx, [esp + 0xc]
push dword [ebp + 0x14]
call sym.KwLib.dll_public:_void___thiscall_CMD5::ToInt_unsigned_long_int___unsigned_long_int__
push dword [ebp + 8]
lea ecx, [esp + 0xc]
call sym.KwLib.dll_public:_class_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char_____thiscall_CMD5::ToString_void_
mov eax, dword [ebp + 8]
mov esp, ebp
pop ebp
ret

Function at 0x10018010
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x70
push dword [ebp + 0x10]
lea eax, [esp + 0x1c]
mov dword [esp + 8], 0
push dword [ebp + 0xc]
lea ecx, [esp + 0x10]
mov dword [esp + 0x10], 0
push eax
mov dword [esp + 0x18], 0
mov dword [esp + 0x1c], 0
mov dword [esp + 0x20], 0
mov dword [esp + 0x24], 0
mov dword [esp + 0x28], 0
mov dword [esp + 0x2c], 0x67452301
mov dword [esp + 0x30], 0xefcdab89
mov dword [esp + 0x34], 0x98badcfe
mov dword [esp + 0x38], 0x10325476
call sym.KwLib.dll_private:_void___thiscall_CMD5::md5_update_struct_CMD5::md5_context___unsigned_char___unsigned_long_int_
lea eax, [esp + 8]
push eax
lea eax, [esp + 0x1c]
push eax
lea ecx, [esp + 0x10]
call sym.KwLib.dll_private:_void___thiscall_CMD5::md5_finish_struct_CMD5::md5_context___unsigned_char__const_
push dword [ebp + 8]
lea ecx, [esp + 0xc]
call sym.KwLib.dll_public:_class_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char_____thiscall_CMD5::ToString_void_
mov eax, dword [ebp + 8]
mov esp, ebp
pop ebp
ret
Function at 0x100180b0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
cmp dword [ebp + 0x10], 0
jne 0x10018226
push ebx
push esi
push edi
mov ecx, 5
lea edi, [ebp - 0x18]
mov esi, str._Y8g2E6n0E1i7L5t2IoOoNk
xor ebx, ebx
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
mov esi, dword [ebp + 0xc]
mov edi, dword [ebp + 8]
test esi, esi
jle 0x10018100
mov eax, 0xb21642c9
mov ecx, ebx
mul ebx
shr edx, 4
imul eax, edx, 0x17
sub ecx, eax
mov al, byte [ebp + ecx - 0x18]
xor byte [ebx + edi], al
inc ebx
cmp ebx, esi
jl 0x100180e1
test esi, esi
je 0x1001817b
mov eax, 0x47
cdq
idiv esi
test edx, edx
je 0x1001817b
mov eax, 0x47
cdq
mov ebx, eax
xor ebx, edx
sub ebx, edx
cmp ebx, esi
jle 0x10018126
mov edi, edi
sub ebx, esi
cmp ebx, esi
jg 0x10018120
push ebx
call fcn.10013326
mov ecx, edi
mov dword [ebp + 0x10], eax
sub ecx, ebx
push ebx
add ecx, esi
push ecx
push eax
call sub.MSVCR120.dll_memcpy
lea eax, [edi - 1]
add esp, 0x10
lea ecx, [esi - 1]
add eax, ebx
add ecx, edi
cmp ecx, eax
jbe 0x10018166
mov edx, ecx
lea esi, [edi - 1]
sub edx, ebx
add esi, ebx
mov al, byte [edx]
lea edx, [edx - 1]
mov byte [ecx], al
dec ecx
cmp ecx, esi
ja 0x10018157
mov esi, dword [ebp + 0xc]
push ebx
mov ebx, dword [ebp + 0x10]
push ebx
push edi
call sub.MSVCR120.dll_memcpy
push ebx
call dword [sym.imp.MSVCR120.dll_void___cdecl_operator_delete___void__]
add esp, 0x10
mov eax, dword [0x10053978]
xor ebx, ebx
mov dword [ebp - 0x10], eax
mov eax, dword [str.OiTvINGwd]
mov dword [ebp - 0xc], eax
mov eax, dword [0x10053980]
mov dword [ebp - 8], eax
mov al, byte [0x10053984]
mov byte [ebp - 4], al
test esi, esi
jle 0x100181c0
mov eax, 0x4ec4ec4f
mov ecx, ebx
mul ebx
shr edx, 2
imul eax, edx, 0xd
sub ecx, eax
mov al, byte [ebp + ecx - 0x10]
xor byte [ebx + edi], al
inc ebx
cmp ebx, esi
jl 0x100181a1
test esi, esi
je 0x10018223
mov eax, 0xffffff7b
cdq
idiv esi
test edx, edx
je 0x10018223
mov eax, 0xffffff7b
cdq
mov ebx, eax
xor ebx, edx
sub ebx, edx
cmp ebx, esi
jle 0x100181e6
mov edi, edi
sub ebx, esi
cmp ebx, esi
jg 0x100181e0
push ebx
call fcn.10013326
push ebx
push edi
push eax
mov dword [ebp + 0x10], eax
call sub.MSVCR120.dll_memcpy
mov ecx, edi
add esp, 0x10
sub ecx, ebx
add ecx, esi
cmp edi, ecx
jae 0x1001820e
mov al, byte [edi + ebx]
mov byte [edi], al
inc edi
cmp edi, ecx
jb 0x10018204
mov esi, dword [ebp + 0x10]
push ebx
push esi
push ecx
call sub.MSVCR120.dll_memcpy
push esi
call dword [sym.imp.MSVCR120.dll_void___cdecl_operator_delete___void__]
add esp, 0x10
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10018230
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
cmp dword [ebp + 0x10], 0
jne 0x100183d0
mov eax, dword [0x10053978]
mov dword [ebp - 0x10], eax
mov eax, dword [str.OiTvINGwd]
push ebx
mov ebx, dword [ebp + 0xc]
mov dword [ebp - 0xc], eax
mov eax, dword [0x10053980]
mov dword [ebp - 8], eax
mov al, byte [0x10053984]
mov byte [ebp - 4], al
push esi
push edi
test ebx, ebx
je 0x100182f6
mov eax, 0x85
cdq
idiv ebx
test edx, edx
je 0x100182f6
mov eax, 0x85
cdq
mov esi, eax
xor esi, edx
sub esi, edx
cmp esi, ebx
jle 0x10018296
lea ebx, [ebx]
sub esi, ebx
cmp esi, ebx
jg 0x10018290
push esi
call fcn.10013326
mov edi, dword [ebp + 8]
mov ecx, edi
sub ecx, esi
mov dword [ebp + 0x10], eax
push esi
add ecx, ebx
push ecx
push eax
call sub.MSVCR120.dll_memcpy
lea eax, [edi - 1]
add esp, 0x10
lea ecx, [ebx - 1]
add eax, esi
add ecx, edi
cmp ecx, eax
jbe 0x100182df
mov edx, ecx
lea ebx, [edi - 1]
sub edx, esi
add ebx, esi
lea ebx, [ebx]
mov al, byte [edx]
lea edx, [edx - 1]
mov byte [ecx], al
dec ecx
cmp ecx, ebx
ja 0x100182d0
mov ebx, dword [ebp + 0xc]
push esi
mov esi, dword [ebp + 0x10]
push esi
push edi
call sub.MSVCR120.dll_memcpy
push esi
call dword [sym.imp.MSVCR120.dll_void___cdecl_operator_delete___void__]
add esp, 0x10
jmp 0x100182f9
mov edi, dword [ebp + 8]
xor esi, esi
test ebx, ebx
jle 0x1001831d
nop
mov eax, 0x4ec4ec4f
mov ecx, esi
mul esi
shr edx, 2
imul eax, edx, 0xd
sub ecx, eax
mov al, byte [ebp + ecx - 0x10]
xor byte [esi + edi], al
inc esi
cmp esi, ebx
jl 0x10018300
lea edi, [ebp - 0x18]
mov ecx, 5
mov esi, str._Y8g2E6n0E1i7L5t2IoOoNk
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
test ebx, ebx
je 0x100183a1
mov eax, 0xffffffb9
cdq
idiv ebx
test edx, edx
je 0x100183a1
mov eax, 0xffffffb9
cdq
mov esi, eax
xor esi, edx
sub esi, edx
cmp esi, ebx
jle 0x10018356
nop
sub esi, ebx
cmp esi, ebx
jg 0x10018350
push esi
call fcn.10013326
mov edi, dword [ebp + 8]
push esi
push edi
push eax
mov dword [ebp + 0x10], eax
call sub.MSVCR120.dll_memcpy
mov ecx, edi
add esp, 0x10
sub ecx, esi
mov edx, edi
add ecx, ebx
cmp edi, ecx
jae 0x1001838a
lea esp, [esp]
mov al, byte [edx + esi]
mov byte [edx], al
inc edx
cmp edx, ecx
jb 0x10018380
push esi
mov esi, dword [ebp + 0x10]
push esi
push ecx
call sub.MSVCR120.dll_memcpy
push esi
call dword [sym.imp.MSVCR120.dll_void___cdecl_operator_delete___void__]
add esp, 0x10
jmp 0x100183a4
mov edi, dword [ebp + 8]
xor esi, esi
test ebx, ebx
jle 0x100183cd
lea ebx, [ebx]
mov eax, 0xb21642c9
mov ecx, esi
mul esi
shr edx, 4
imul eax, edx, 0x17
sub ecx, eax
mov al, byte [ebp + ecx - 0x18]
xor byte [esi + edi], al
inc esi
cmp esi, ebx
jl 0x100183b0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10018a20
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x1004f482
push eax
mov eax, dword [ebp + 8]
mov dword fs:[0], esp
sub esp, 0x498
push ebx
push esi
push edi
test eax, eax
jne 0x10018a63
or eax, 0xffffffff
mov ecx, dword [esp + 0x4a4]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 0x180
push 0x8000
push eax
call dword [sym.imp.MSVCR120.dll_int___cdecl__wopen_wchar_t_const___int__int_]
mov esi, dword [sym.imp.MSVCR120.dll__errno]
add esp, 0xc
mov edi, eax
mov dword [esp + 0x10], edi
call esi
mov ecx, dword [eax]
mov dword [esp + 0x14], ecx
mov dword [esp + 0x4ac], 0
test edi, edi
jns 0x10018aaa
call esi
cmp dword [eax], 0
je 0x10018aec
call esi
mov esi, dword [eax]
jmp 0x10018bc0
push 0x400
lea eax, [esp + 0xa4]
push eax
push edi
call dword [sym.imp.MSVCR120.dll__read]
add esp, 0xc
cmp eax, 0x400
je 0x10018ad8
call esi
cmp dword [eax], 0
je 0x10018aec
call esi
mov esi, dword [eax]
jmp 0x10018bc0
lea eax, [esp + 0xa0]
push eax
call sym.KwLib.dll_bool___cdecl_Music_KFInfoValiate_struct_KFInfoHead__
add esp, 4
test al, al
jne 0x10018af4
or esi, 0xffffffff
jmp 0x10018bc0
push 0x7f
lea eax, [esp + 0x25]
mov byte [esp + 0x24], 0
push 0
push eax
call sub.MSVCR120.dll_memset
add esp, 0xc
lea eax, [esp + 0x20]
push dword [esp + 0xbc]
push dword [esp + 0xbc]
push str._I64d
push 0x7f
push eax
call dword [sym.imp.MSVCR120.dll__snprintf]
mov ebx, dword [ebp + 0x10]
add esp, 0x14
mov ecx, ebx
push dword [ebp + 0x14]
call fcn.10003c50
cmp dword [ebx + 0x14], 0x10
jb 0x10018b44
mov eax, dword [ebx]
jmp 0x10018b46
mov eax, ebx
push dword [ebp + 0x14]
push eax
push edi
call dword [sym.imp.MSVCR120.dll__read]
add esp, 0xc
mov dword [esp + 0xc], eax
test eax, eax
jns 0x10018b69
call esi
cmp dword [eax], 0
je 0x10018aec
call esi
mov esi, dword [eax]
jmp 0x10018bc0
push dword [esp + 0xb4]
push dword [esp + 0xb4]
call sym.KwLib.dll_struct_MusicEncryptPolicy___cdecl_Music_GetEncryptByVer_unsigned_long_long_unsigned___int64__
add esp, 8
mov dword [esp + 0x18], eax
cmp dword [ebx + 0x14], 0x10
jb 0x10018b8d
mov eax, dword [ebx]
jmp 0x10018b8f
mov eax, ebx
lea ecx, [esp + 0x20]
push ecx
push dword [esp + 0x10]
push eax
call edx
mov edi, dword [ebp + 0xc]
lea esi, [esp + 0xac]
add esp, 0xc
mov ecx, 0x1a
rep movsd dword es:[edi], dword [esi]
push dword [esp + 0xc]
mov ecx, ebx
call fcn.10003c50
mov edi, dword [esp + 0x10]
xor esi, esi
test edi, edi
js 0x10018bce
push edi
call dword [sym.imp.MSVCR120.dll__close]
add esp, 4
mov ecx, dword [esp + 0x4a4]
mov eax, esi
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10019470
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x6c
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
test esi, esi
je 0x1001955d
push 0x2e
push esi
call dword [sym.imp.MSVCR120.dll_wcsrchr]
add esp, 8
test eax, eax
je 0x1001955d
push 0x100539bc
push eax
call dword [sym.imp.MSVCR120.dll__wcsicmp]
add esp, 8
test eax, eax
jne 0x1001955d
push 0x180
push 0x8000
push esi
call dword [sym.imp.MSVCR120.dll_int___cdecl__wopen_wchar_t_const___int__int_]
add esp, 0xc
mov ebx, eax
call dword [sym.imp.MSVCR120.dll__errno]
test ebx, ebx
js 0x1001953f
xor eax, eax
mov byte [esp + 0x10], 0
push 0x58
push eax
mov dword [esp + 0x19], eax
mov dword [esp + 0x1d], eax
mov dword [esp + 0x21], eax
mov word [esp + 0x25], ax
mov byte [esp + 0x27], al
lea eax, [esp + 0x28]
push eax
call sub.MSVCR120.dll_memset
push 0x68
lea eax, [esp + 0x20]
push eax
push ebx
call dword [sym.imp.MSVCR120.dll__read]
add esp, 0x18
cmp eax, 0x68
jne 0x1001953f
push 0x10
lea eax, [esp + 0x14]
push str.yeelion_kuwo_tme
push eax
call dword [sym.imp.MSVCR120.dll_strncmp]
add esp, 0xc
test eax, eax
jne 0x1001953f
mov edi, dword [ebp + 0xc]
lea esi, [esp + 0x10]
mov ecx, 0x1a
mov byte [esp + 0xf], 1
rep movsd dword es:[edi], dword [esi]
jmp 0x10019544
mov byte [esp + 0xf], 0
test ebx, ebx
js 0x10019552
push ebx
call dword [sym.imp.MSVCR120.dll__close]
add esp, 4
mov al, byte [esp + 0xf]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
pop edi
pop esi
xor al, al
pop ebx
mov esp, ebp
pop ebp
ret