joyce8/EMBER2024-capa huggingface dataset:
Function at 0x513ae8
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.00513959

Function at 0x519239
Capabilities:
Clear file content

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x2c
push ebx
mov ebx, dword [ebp + 8]
lea ecx, [ebp - 0x2c]
push esi
push edi
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push ebx
call fcn.005191b5
mov eax, dword [ebp - 0x2c]
and eax, dword [ebp - 0x28]
cmp eax, 0xffffffff
je 0x5193b1
mov eax, dword [ebp - 0x24]
and eax, dword [ebp - 0x20]
cmp eax, 0xffffffff
je 0x5193b1
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 8], ecx
mov dword [ebp - 4], eax
test ecx, ecx
jl 0x519360
jg 0x519292
test eax, eax
je 0x519356
push 1
push 0x1000
call fcn.0050d1a3
mov esi, eax
pop ecx
pop ecx
test esi, esi
jne 0x5192b8
mov eax, dword [ebp + 0x14]
push 0xc
pop edi
mov byte [eax + 0x1c], 1
mov dword [eax + 0x18], edi
jmp 0x51934d
push 0x8000
push ebx
call fcn.00508b02
mov edi, dword [ebp + 0x14]
pop ecx
pop ecx
mov ecx, dword [ebp - 0x1c]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0x18]
test eax, eax
jl 0x5192e4
jg 0x5192df
cmp ecx, 0x1000
jb 0x5192e4
mov ecx, 0x1000
push edi
push ecx
push esi
push ebx
call fcn.0050f573
add esp, 0x10
cmp eax, 0xffffffff
je 0x519329
mov ecx, dword [ebp - 4]
cdq
sub ecx, eax
mov eax, dword [ebp - 8]
mov dword [ebp - 4], ecx
sbb eax, edx
mov dword [ebp - 8], eax
test eax, eax
jg 0x5192df
jl 0x519310
test ecx, ecx
jne 0x5192d1
push dword [ebp - 0xc]
push ebx
call fcn.00508b02
push esi
call fcn.0050d11b
add esp, 0xc
xor edi, edi
jmp 0x5193c2
cmp byte [edi + 0x24], 0
je 0x519340
cmp dword [edi + 0x20], 5
jne 0x519340
mov byte [edi + 0x1c], 1
mov dword [edi + 0x18], 0xd
cmp byte [edi + 0x1c], 0
je 0x51934b
mov edi, dword [edi + 0x18]
jmp 0x51934d
xor edi, edi
push esi
call fcn.0050d11b
pop ecx
jmp 0x5193c2
test ecx, ecx
jg 0x519322
jl 0x519360
test eax, eax
jae 0x519322
push 0
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push ebx
call fcn.00513cfa
and eax, edx
add esp, 0x10
cmp eax, 0xffffffff
jne 0x519383
mov edi, dword [ebp + 0x14]
cmp byte [edi + 0x1c], 0
je 0x519322
jmp 0x5193ba
push ebx
call fcn.005119d5
pop ecx
push eax
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
test eax, eax
jne 0x519322
mov esi, dword [ebp + 0x14]
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 0xd
mov byte [esi + 0x24], 1
mov dword [esi + 0x20], eax
pop edi
mov byte [esi + 0x1c], 1
mov dword [esi + 0x18], edi
jmp 0x5193c2
mov edi, dword [ebp + 0x14]
cmp byte [edi + 0x1c], 0
je 0x5193bf
mov edi, dword [edi + 0x18]
jmp 0x5193c2
push 0x16
pop edi
push 0
push dword [ebp - 0x28]
push dword [ebp - 0x2c]
push dword [ebp - 0x14]
call fcn.00513cfa
add esp, 0x10
mov eax, edi
pop edi
pop esi
pop ebx
leave
ret
Function at 0x10010d60
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [ebp + 0xc]
mov edx, ecx
push ebx
mov ebx, dword [ebp + 8]
mov dword [ebp - 0x18], edx
cmp ebx, eax
je 0x10010f04
mov eax, dword [edx + 4]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebx + 4]
mov dword [ebp - 8], eax
movzx eax, byte [ebx + 8]
xor eax, 0x811c9dc5
imul ecx, eax, 0x1000193
movzx eax, byte [ebx + 9]
push esi
push edi
mov edi, dword [edx + 0xc]
mov esi, ebx
xor ecx, eax
mov dword [ebp - 0x20], edi
movzx eax, byte [ebx + 0xa]
imul ecx, ecx, 0x1000193
xor ecx, eax
movzx eax, byte [ebx + 0xb]
imul ecx, ecx, 0x1000193
xor ecx, eax
mov eax, dword [edx + 0x18]
imul ecx, ecx, 0x1000193
and eax, ecx
mov ecx, dword [edi + eax*8]
mov dword [ebp - 4], ecx
lea eax, [edi + eax*8]
mov dword [ebp - 0xc], eax
mov eax, dword [eax + 4]
mov dword [ebp - 0x10], eax
nop word [eax + eax]
mov ebx, esi
mov dword [ebp - 0x14], esi
mov esi, dword [esi]
lea ecx, [ebx + 0x24]
call fcn.10010f30
lea ecx, [ebx + 0x18]
call fcn.10010f90
lea ecx, [ebx + 0xc]
call fcn.10010f90
push 0x3c
push ebx
call fcn.10098d26
mov edx, dword [ebp - 0x18]
add esp, 8
mov eax, dword [ebp - 0x10]
dec dword [edx + 8]
cmp ebx, eax
je 0x10010e40
mov eax, dword [ebp + 0xc]
cmp esi, eax
jne 0x10010de0
mov ecx, dword [ebp - 4]
cmp ecx, dword [ebp + 8]
jne 0x10010efa
mov edi, dword [ebp - 0xc]
mov ecx, dword [ebp - 8]
mov dword [edi], esi
mov dword [ecx], esi
pop edi
mov dword [esi + 4], ecx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
mov ecx, dword [ebp - 4]
mov edi, dword [ebp - 0xc]
cmp ecx, dword [ebp + 8]
jne 0x10010e54
mov eax, dword [ebp - 0x1c]
mov ecx, eax
mov dword [edi], eax
jmp 0x10010e57
mov ecx, dword [ebp - 8]
mov eax, dword [ebp + 0xc]
mov dword [edi + 4], ecx
cmp esi, eax
je 0x10010efa
nop word [eax + eax]
movzx eax, byte [esi + 8]
xor eax, 0x811c9dc5
imul ecx, eax, 0x1000193
movzx eax, byte [esi + 9]
xor ecx, eax
movzx eax, byte [esi + 0xa]
imul ecx, ecx, 0x1000193
xor ecx, eax
movzx eax, byte [esi + 0xb]
imul ecx, ecx, 0x1000193
xor ecx, eax
mov eax, dword [edx + 0x18]
imul ecx, ecx, 0x1000193
and eax, ecx
mov ecx, dword [ebp - 0x20]
lea eax, [ecx + eax*8]
mov dword [ebp - 4], eax
mov eax, dword [eax + 4]
mov dword [ebp - 0x14], eax
mov ebx, esi
mov dword [ebp - 0x10], esi
mov esi, dword [esi]
lea ecx, [ebx + 0x24]
call fcn.10010f30
lea ecx, [ebx + 0x18]
call fcn.10010f90
lea ecx, [ebx + 0xc]
call fcn.10010f90
push 0x3c
push ebx
call fcn.10098d26
mov edx, dword [ebp - 0x18]
add esp, 8
mov eax, dword [ebp - 0x14]
dec dword [edx + 8]
cmp ebx, eax
mov eax, dword [ebp + 0xc]
je 0x10010f0b
cmp esi, eax
jne 0x10010eb7
mov ecx, dword [ebp - 4]
mov dword [ecx], esi
mov ecx, dword [ebp - 8]
pop edi
mov dword [ecx], esi
mov dword [esi + 4], ecx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
mov ecx, dword [ebp - 4]
mov ebx, dword [ebp - 0x1c]
mov dword [ecx], ebx
mov dword [ecx + 4], ebx
cmp esi, eax
jne 0x10010e70
mov ecx, dword [ebp - 8]
pop edi
mov dword [ecx], esi
mov dword [esi + 4], ecx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x1002fd20
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1009afa8
mov eax, dword fs:[0]
push eax
sub esp, 0x10
mov eax, dword [0x100d7040]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x18], edi
xorps xmm0, xmm0
mov dword [ebp - 0x1c], edi
movq qword [edi], xmm0
push 0x14
mov dword [ebp - 4], 0
call fcn.100988c2
mov esi, eax
add esp, 4
mov dword [esi], 1
mov dword [esi + 4], 2
mov dword [esi + 8], 0
mov dword [esi + 0xc], 0
mov dword [esi + 0x10], 0
mov dword [edi + 8], esi
test esi, esi
je 0x1002fd9e
mov eax, 1
lock xadd dword [esi], eax
mov dword [ebp - 0x18], esi
push 8
mov byte [ebp - 4], 2
call fcn.100988c2
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], eax
mov dword [eax], esi
mov dword [eax + 4], 0x10097d00
lea esi, [edi + 4]
mov byte [ebp - 4], 3
push esi
push 0
push eax
push 0x10030c50
push 0
push 0
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
add esp, 0x1c
mov dword [edi], eax
test eax, eax
je 0x1002fe01
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.100988b4
mov esp, ebp
pop ebp
ret 4
push 6
mov dword [esi], 0
call dword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
int3
Function at 0x10033c40
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1009b171
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x100d7040]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x10], edi
mov edx, dword [0x1043f620]
mov ebx, dword [ebp + 8]
mov ecx, dword [0x1043f608]
mov eax, dword [edx + 0x48]
mov eax, dword [ebx + eax]
mov dword [edi], eax
mov eax, dword [edx + 0xdc]
mov eax, dword [ebx + eax]
mov dword [edi + 4], eax
mov eax, dword fs:[0x2c]
mov ecx, dword [eax + ecx*4]
mov eax, dword [0x10440944]
cmp eax, dword [ecx + 4]
jle 0x10033cf4
push 0x10440944
call fcn.10098dd3
add esp, 4
cmp dword [0x10440944], 0xffffffff
jne 0x10033cee
mov dword [ebp - 4], 0
mov ecx, ebx
mov eax, dword [ebx]
mov eax, dword [eax + 0x44]
call eax
push str.m_iEFlags
push eax
call fcn.10082c10
push 0x10440944
mov dword [0x10440940], eax
mov dword [ebp - 4], 0xffffffff
call fcn.10098d82
add esp, 0xc
mov edx, dword [0x1043f620]
mov eax, dword [0x10440940]
mov ecx, ebx
mov eax, dword [eax + ebx]
mov dword [edi + 8], eax
mov eax, dword [edx + 0xe8]
mov eax, dword [ebx + eax]
mov dword [edi + 0xc], eax
mov eax, dword [edx + 0x7c]
mov eax, dword [eax + ebx - 0x50]
mov dword [edi + 0x10], eax
mov eax, dword [edx + 0x7c]
mov eax, dword [eax + ebx - 0x54]
mov dword [edi + 0x14], eax
mov eax, dword [edx + 0xc4]
mov eax, dword [eax + ebx + 8]
mov dword [edi + 0x18], eax
mov eax, dword [edx + 0x74]
movq xmm0, qword [eax + ebx]
movq qword [edi + 0x1c], xmm0
mov eax, dword [eax + ebx + 8]
mov dword [edi + 0x24], eax
mov eax, dword [edx + 0x15c]
movq xmm0, qword [eax + ebx]
movq qword [edi + 0x28], xmm0
mov eax, dword [eax + ebx + 8]
mov dword [edi + 0x30], eax
mov eax, dword [edx + 0x28]
movq xmm0, qword [eax + ebx]
movq qword [edi + 0x34], xmm0
mov eax, dword [eax + ebx + 8]
mov dword [edi + 0x3c], eax
mov eax, dword [ebx]
call dword [eax + 0x28]
mov esi, dword [0x1043f620]
mov ecx, 0xd3
movq xmm0, qword [eax]
movq qword [edi + 0x40], xmm0
mov eax, dword [eax + 8]
mov dword [edi + 0x48], eax
mov eax, dword [esi + 0x1c]
movq xmm0, qword [eax + ebx]
movq qword [edi + 0x4c], xmm0
mov eax, dword [eax + ebx + 8]
mov dword [edi + 0x54], eax
mov eax, dword [esi + 0x10c]
mov eax, dword [ebx + eax]
mov dword [edi + 0x58], eax
mov eax, dword [esi + 0x20]
movq xmm0, qword [eax + ebx]
movq qword [edi + 0x5c], xmm0
mov eax, dword [eax + ebx + 8]
mov dword [edi + 0x64], eax
mov eax, dword [esi + 0x24]
movq xmm0, qword [eax + ebx]
movq qword [edi + 0x68], xmm0
mov eax, dword [eax + ebx + 8]
mov dword [edi + 0x70], eax
add edi, 0x74
mov esi, dword [esi + 0x7c]
mov eax, dword [ebp - 0x10]
mov esi, dword [esi + ebx - 0x14]
rep movsd dword es:[edi], dword [esi]
mov esi, dword [ebx + 0x2990]
lea edi, [eax + 0x3c0]
mov ecx, 0xb6
rep movsd dword es:[edi], dword [esi]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x1003c2d0
Capabilities:
Hash data with crc32

Disassembly:
push ebx
mov ebx, ecx
or eax, 0xffffffff
push esi
push edi
mov edi, 4
lea esi, [ebx + 4]
jmp dword [edi*4 + 0x1003d518]
Function at 0x100552a0
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov edx, dword [ebp + 0xc]
mov eax, dword [ecx + 4]
push ebx
mov dword [ebp - 8], ecx
lea ebx, [edx + 0x30a0]
mov dword [ebp - 0xc], edx
mov dword [ebp - 4], eax
cmp ebx, eax
je 0x100553ff
push esi
push edi
lea esi, [edx + 0x1c]
lea edi, [ebx + 0x1c]
nop dword [eax]
mov eax, dword [ebx]
lea ecx, [esi - 0x1c]
mov dword [ecx], eax
mov edx, ebx
mov eax, dword [edi - 0x18]
sub edx, ecx
mov dword [esi - 0x18], eax
mov ecx, 0x100
mov eax, dword [edi - 0x14]
mov dword [esi - 0x14], eax
mov eax, dword [edi - 0x10]
mov dword [esi - 0x10], eax
mov eax, dword [edi - 0xc]
mov dword [esi - 0xc], eax
mov eax, dword [edi - 8]
mov dword [esi - 8], eax
mov eax, dword [edi - 4]
mov dword [esi - 4], eax
mov eax, dword [edi]
mov dword [esi], eax
movzx eax, byte [edi + 4]
mov byte [esi + 4], al
movzx eax, byte [edi + 5]
mov byte [esi + 5], al
movzx eax, byte [edi + 6]
mov byte [esi + 6], al
movzx eax, byte [edi + 7]
mov byte [esi + 7], al
mov eax, dword [edi + 8]
mov dword [esi + 8], eax
mov eax, dword [edi + 0xc]
mov dword [esi + 0xc], eax
mov eax, dword [edi + 0x10]
mov dword [esi + 0x10], eax
mov eax, dword [edi + 0x14]
mov dword [esi + 0x14], eax
mov eax, dword [edi + 0x18]
mov dword [esi + 0x18], eax
mov eax, dword [edi + 0x1c]
mov dword [esi + 0x1c], eax
mov eax, dword [edi + 0x20]
mov dword [esi + 0x20], eax
mov eax, dword [edi + 0x24]
mov dword [esi + 0x24], eax
mov eax, dword [edi + 0x28]
mov dword [esi + 0x28], eax
mov eax, dword [edi + 0x2c]
mov dword [esi + 0x2c], eax
mov ax, word [edi + 0x30]
mov word [esi + 0x30], ax
movups xmm0, xmmword [edi + 0x34]
movups xmmword [esi + 0x34], xmm0
movq xmm0, qword [edi + 0x44]
movq qword [esi + 0x44], xmm0
mov eax, dword [edi + 0x4c]
mov dword [esi + 0x4c], eax
lea eax, [esi + 0x50]
lea eax, [eax + 0x30]
movups xmm0, xmmword [edx + eax - 0x30]
movups xmmword [eax - 0x30], xmm0
movups xmm0, xmmword [edx + eax - 0x20]
movups xmmword [eax - 0x20], xmm0
movups xmm0, xmmword [edx + eax - 0x10]
movups xmmword [eax - 0x10], xmm0
sub ecx, 1
jne 0x10055383
mov eax, dword [edi + 0x3050]
add ebx, 0x30a0
mov dword [esi + 0x3050], eax
movups xmm0, xmmword [edi + 0x3054]
movups xmmword [esi + 0x3054], xmm0
movups xmm0, xmmword [edi + 0x3064]
movups xmmword [esi + 0x3064], xmm0
movups xmm0, xmmword [edi + 0x3074]
add edi, 0x30a0
movups xmmword [esi + 0x3074], xmm0
add esi, 0x30a0
cmp ebx, dword [ebp - 4]
jne 0x100552d0
mov ecx, dword [ebp - 8]
mov edx, dword [ebp - 0xc]
pop edi
pop esi
mov eax, dword [ebp + 8]
add dword [ecx + 4], 0xffffcf60
pop ebx
mov dword [eax], edx
mov esp, ebp
pop ebp
ret 8

Function at 0x1006a710
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
cmp dword [ebp + 0xc], 1
jne 0x1006a74c
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_DisableThreadLibraryCalls]
push 0
push 0
push dword [ebp + 8]
push 0x10069f80
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
test eax, eax
je 0x1006a743
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 1
pop ebp
ret 0xc
xor eax, eax
pop ebp
ret 0xc
Function at 0x100704f0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1009cf06
mov eax, dword fs:[0]
push eax
sub esp, 0x2c
mov eax, dword [0x100d7040]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x18], esi
mov dword [ebp - 0x20], esi
xorps xmm0, xmm0
mov dword [ebp - 0x1c], 0
xor eax, eax
movups xmmword [esi], xmm0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 7
mov word [esi], ax
mov dword [ebp - 4], eax
lea eax, [ebp - 0x14]
push eax
push 0
push 0
push 0x100a05a0
mov dword [ebp - 0x1c], 1
call dword [sym.imp.SHELL32.dll_SHGetKnownFolderPath]
test eax, eax
js 0x100705b0
lea eax, [ebp - 0x14]
mov ecx, esi
push eax
call fcn.10076c30
mov byte [ebp - 0x18], 0
lea ecx, [ebp - 0x38]
push dword [ebp - 0x18]
call fcn.1007cc10
add esp, 4
lea eax, [ebp - 0x38]
mov dword [ebp - 4], 1
push eax
mov ecx, esi
call fcn.1000a600
lea ecx, [ebp - 0x38]
call fcn.10011150
push dword [ebp - 0x14]
call dword [sym.imp.ole32.dll_CoTaskMemFree]
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.100988b4
mov esp, ebp
pop ebp
ret
Function at 0x10070a00
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x1c
push ebx
mov ebx, ecx
push esi
push edi
cmp dword [ebx + 0x38], 0
je 0x10070a2c
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____thiscall_std::basic_streambuf_char__struct_std::char_traits_char__::xsputn_char_const___long_long___int64__]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov eax, dword [ebx + 0x20]
mov esi, dword [ebp + 0xc]
mov edi, dword [ebp + 0x10]
mov dword [esp + 0x20], esi
mov ecx, dword [eax]
lea eax, [ebx + 0x30]
mov dword [esp + 0x24], edi
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x18], eax
test ecx, ecx
je 0x10070a54
mov eax, dword [eax]
mov ecx, dword [eax]
jmp 0x10070a5a
xor ecx, ecx
mov dword [esp + 0x18], eax
mov eax, ecx
cdq
mov dword [esp + 0x10], eax
mov ecx, edx
mov dword [esp + 0x14], ecx
test edi, edi
jl 0x10070ac2
jg 0x10070a71
test esi, esi
je 0x10070ac2
test ecx, ecx
jl 0x10070abd
jg 0x10070a7b
test eax, eax
je 0x10070abd
cmp edi, ecx
jg 0x10070a8f
jl 0x10070a85
cmp esi, eax
jae 0x10070a8f
mov eax, esi
mov dword [esp + 0x10], esi
mov dword [esp + 0x14], edi
push eax
push dword [ebp + 8]
push dword [esp + 0x24]
call sub.VCRUNTIME140.dll_memcpy
mov eax, dword [esp + 0x24]
add esp, 0xc
mov edx, dword [esp + 0x10]
mov ecx, dword [ebp + 8]
add ecx, edx
sub esi, edx
mov eax, dword [eax]
sbb edi, dword [esp + 0x14]
sub dword [eax], edx
mov eax, dword [ebx + 0x20]
add dword [eax], edx
jmp 0x10070ac5
mov ecx, dword [ebp + 8]
jmp 0x10070acf
mov ecx, dword [ebp + 8]
test edi, edi
jl 0x10070ae9
jg 0x10070acf
test esi, esi
je 0x10070ae9
mov eax, dword [ebx + 0x4c]
test eax, eax
je 0x10070ae9
push eax
push esi
push 1
push ecx
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
add esp, 0x10
sub esi, eax
sbb edi, 0
mov eax, dword [esp + 0x20]
mov edx, dword [esp + 0x24]
sub eax, esi
sbb edx, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x10070b00
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [ebp + 0x10]
push ebx
mov ebx, ecx
mov ecx, dword [ebp + 0xc]
push esi
mov esi, dword [ebp + 8]
mov dword [ebp - 4], esi
test eax, eax
jg 0x10070b2c
jl 0x10070b20
test ecx, ecx
jne 0x10070b2c
pop esi
xor eax, eax
xor edx, edx
pop ebx
mov esp, ebp
pop ebp
ret 0xc
cmp dword [ebx + 0x38], 0
je 0x10070b45
push eax
push ecx
push esi
mov ecx, ebx
call dword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____thiscall_std::basic_streambuf_char__struct_std::char_traits_char__::xsgetn_char___long_long___int64__]
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov eax, dword [ebx + 0x1c]
push edi
mov edi, ecx
mov eax, dword [eax]
mov dword [ebp - 8], eax
test eax, eax
je 0x10070b8d
mov eax, dword [ebx + 0x2c]
lea edx, [ebx + 0x2c]
mov dword [ebp - 0xc], edx
mov eax, dword [eax]
test eax, eax
je 0x10070b93
cmp eax, ecx
mov esi, ecx
cmovb esi, eax
push esi
push dword [ebp - 8]
push dword [ebp - 4]
call sub.VCRUNTIME140.dll_memcpy
mov eax, dword [ebx + 0x2c]
sub edi, esi
add dword [ebp - 4], esi
add esp, 0xc
sub dword [eax], esi
mov eax, dword [ebx + 0x1c]
add dword [eax], esi
mov esi, dword [ebp - 4]
jmp 0x10070b93
lea eax, [ebx + 0x2c]
mov dword [ebp - 0xc], eax
cmp dword [ebx + 0x4c], 0
je 0x10070c06
mov ecx, dword [ebx + 0xc]
lea eax, [ebx + 0x3c]
cmp dword [ecx], eax
jne 0x10070bbc
mov eax, dword [ebx + 0xc]
mov edx, dword [ebx + 0x54]
mov ecx, dword [ebx + 0x50]
sub edx, ecx
mov dword [eax], ecx
mov eax, dword [ebx + 0x1c]
mov dword [eax], ecx
mov eax, dword [ebp - 0xc]
mov eax, dword [eax]
mov dword [eax], edx
mov eax, dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
cmp edi, 0xfff
jbe 0x10070bf4
nop dword [eax]
push dword [ebx + 0x4c]
push 0xfff
push 1
push esi
call eax
add esp, 0x10
add esi, eax
sub edi, eax
cmp eax, 0xfff
jne 0x10070c06
cmp edi, eax
mov eax, dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
ja 0x10070bd0
test edi, edi
je 0x10070c06
push dword [ebx + 0x4c]
push edi
push 1
push esi
call eax
add esp, 0x10
sub edi, eax
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 0x10]
sub eax, edi
pop edi
pop esi
sbb edx, 0
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x10070f80
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
mov eax, dword [0x100d7040]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, ecx
cmp ebx, 0xffffffff
jne 0x10070fb0
pop esi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100988b4
mov esp, ebp
pop ebp
ret 4
mov eax, dword [esi + 0x20]
push edi
mov ecx, dword [eax]
test ecx, ecx
je 0x10070fec
mov edx, dword [esi + 0x30]
mov edi, dword [edx]
lea eax, [edi + ecx]
cmp ecx, eax
jae 0x10070fec
lea ecx, [edi - 1]
mov eax, ebx
mov dword [edx], ecx
mov edx, dword [esi + 0x20]
pop edi
mov esi, dword [edx]
lea ecx, [esi + 1]
mov dword [edx], ecx
mov byte [esi], bl
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100988b4
mov esp, ebp
pop ebp
ret 4
cmp dword [esi + 0x4c], 0
je 0x100710c3
mov edi, dword [esi + 0xc]
lea eax, [esi + 0x3c]
cmp dword [edi], eax
jne 0x10071014
mov edx, dword [esi + 0x54]
mov ecx, dword [esi + 0x50]
sub edx, ecx
mov dword [edi], ecx
mov eax, dword [esi + 0x1c]
mov dword [eax], ecx
mov eax, dword [esi + 0x2c]
mov dword [eax], edx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x10071020
movsx eax, bl
jmp 0x10071058
lea eax, [ebp - 0x2c]
mov byte [ebp - 0x25], bl
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x25]
push eax
lea eax, [esi + 0x40]
push eax
call dword [sym.imp.MSVCP140.dll_public:_int___thiscall_std::codecvt_char__char__struct__Mbstatet_::out_struct__Mbstatet___char_const___char_const___char_const____char___char___char___const]
sub eax, 0
je 0x10071082
sub eax, 1
je 0x10071082
sub eax, 2
jne 0x100710c3
movsx eax, byte [ebp - 0x25]
push dword [esi + 0x4c]
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
add esp, 8
or ecx, 0xffffffff
cmp eax, ecx
cmove ebx, ecx
pop edi
pop esi
mov eax, ebx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100988b4
mov esp, ebp
pop ebp
ret 4
mov edi, dword [ebp - 0x2c]
lea eax, [ebp - 0x24]
sub edi, eax
je 0x100710a0
push dword [esi + 0x4c]
push edi
push 1
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
add esp, 0x10
cmp edi, eax
jne 0x100710c3
lea ecx, [ebp - 0x25]
mov byte [esi + 0x3d], 1
or eax, 0xffffffff
cmp dword [ebp - 0x30], ecx
pop edi
pop esi
cmovne eax, ebx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100988b4
mov esp, ebp
pop ebp
ret 4
mov ecx, dword [ebp - 4]
or eax, 0xffffffff
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.100988b4
mov esp, ebp
pop ebp
ret 4
Function at 0x10072780
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x100d7040]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, ecx
cmp dword [esi + 0x38], 0
je 0x1007283c
cmp byte [esi + 0x3d], 0
je 0x1007283c
mov eax, dword [esi]
push edi
push 0xffffffffffffffff
call dword [eax + 0xc]
cmp eax, 0xffffffff
je 0x1007282a
mov ecx, dword [esi + 0x38]
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [esi + 0x40]
push eax
call dword [sym.imp.MSVCP140.dll_public:_int___thiscall_std::codecvt_char__char__struct__Mbstatet_::unshift_struct__Mbstatet___char___char___char___const]
sub eax, 0
je 0x100727f1
sub eax, 1
je 0x100727f5
sub eax, 2
jne 0x1007282a
mov byte [esi + 0x3d], al
mov al, 1
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100988b4
mov esp, ebp
pop ebp
ret
mov byte [esi + 0x3d], 0
mov edi, dword [ebp - 0x28]
lea eax, [ebp - 0x24]
sub edi, eax
je 0x10072813
push dword [esi + 0x4c]
push edi
push 1
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
add esp, 0x10
cmp edi, eax
jne 0x1007282a
cmp byte [esi + 0x3d], 0
pop edi
sete al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100988b4
mov esp, ebp
pop ebp
ret
pop edi
xor al, al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100988b4
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
mov al, 1
xor ecx, ebp
pop esi
call fcn.100988b4
mov esp, ebp
pop ebp
ret