joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1004e289
Capabilities:
Clear file content

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x2c
push ebx
mov ebx, dword [ebp + 8]
lea ecx, [ebp - 0x2c]
push esi
push edi
push dword [ebp + 0x10]
mov edi, dword [ebp + 0x14]
push dword [ebp + 0xc]
push ebx
call fcn.1004e097
mov eax, dword [ebp - 0x2c]
and eax, dword [ebp - 0x28]
cmp eax, 0xffffffff
je 0x1004e3f8
mov eax, dword [ebp - 0x24]
and eax, dword [ebp - 0x20]
cmp eax, 0xffffffff
je 0x1004e3f8
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 8], ecx
mov dword [ebp - 4], eax
test ecx, ecx
jl 0x1004e3ad
jg 0x1004e2e5
test eax, eax
je 0x1004e3a3
push 1
push 0x1000
call fcn.10050b29
mov esi, eax
pop ecx
pop ecx
test esi, esi
jne 0x1004e308
push 0xc
pop ebx
mov byte [edi + 0x1c], 1
mov dword [edi + 0x18], ebx
jmp 0x1004e39a
push 0x8000
push ebx
call fcn.1004bb6e
pop ecx
pop ecx
mov ecx, dword [ebp - 0x1c]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0x18]
test eax, eax
jl 0x1004e331
jg 0x1004e32c
cmp ecx, 0x1000
jb 0x1004e331
mov ecx, 0x1000
push edi
push ecx
push esi
push ebx
call fcn.10048d56
add esp, 0x10
cmp eax, 0xffffffff
je 0x1004e376
mov ecx, dword [ebp - 4]
cdq
sub ecx, eax
mov eax, dword [ebp - 8]
mov dword [ebp - 4], ecx
sbb eax, edx
mov dword [ebp - 8], eax
test eax, eax
jg 0x1004e32c
jl 0x1004e35d
test ecx, ecx
jne 0x1004e31e
push dword [ebp - 0xc]
push ebx
call fcn.1004bb6e
push esi
call fcn.1004b94c
add esp, 0xc
xor ebx, ebx
jmp 0x1004e406
cmp byte [edi + 0x24], 0
je 0x1004e38d
cmp dword [edi + 0x20], 5
jne 0x1004e38d
mov byte [edi + 0x1c], 1
mov dword [edi + 0x18], 0xd
cmp byte [edi + 0x1c], 0
je 0x1004e398
mov ebx, dword [edi + 0x18]
jmp 0x1004e39a
xor ebx, ebx
push esi
call fcn.1004b94c
pop ecx
jmp 0x1004e406
test ecx, ecx
jg 0x1004e36f
jl 0x1004e3ad
test eax, eax
jae 0x1004e36f
push 0
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push ebx
call fcn.100483a1
and eax, edx
add esp, 0x10
cmp eax, 0xffffffff
jne 0x1004e3cd
cmp byte [edi + 0x1c], 0
je 0x1004e36f
jmp 0x1004e3fe
push ebx
call fcn.1004de01
pop ecx
push eax
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
test eax, eax
jne 0x1004e36f
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 0xd
mov byte [edi + 0x24], 1
mov dword [edi + 0x20], eax
pop ebx
mov byte [edi + 0x1c], 1
mov dword [edi + 0x18], ebx
jmp 0x1004e406
cmp byte [edi + 0x1c], 0
je 0x1004e403
mov ebx, dword [edi + 0x18]
jmp 0x1004e406
push 0x16
pop ebx
push 0
push dword [ebp - 0x28]
push dword [ebp - 0x2c]
push dword [ebp - 0x14]
call fcn.100483a1
add esp, 0x10
mov eax, ebx
pop edi
pop esi
pop ebx
leave
ret

Function at 0x10055ac2
Capabilities:
Print debug messages

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.10055996
Function at 0x10059825
Capabilities:
Enumerate files on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x264
mov eax, dword [0x1007b008]
xor eax, ebp
mov dword [ebp - 4], eax
mov edx, dword [ebp + 0xc]
mov ecx, dword [ebp + 0x10]
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov dword [ebp - 0x25c], ecx
cmp edx, edi
je 0x10059870
movzx eax, word [edx]
lea ecx, [ebp - 0x255]
push eax
call fcn.10059b82
test al, al
jne 0x1005986a
sub edx, 2
cmp edx, edi
jne 0x10059850
mov ecx, dword [ebp - 0x25c]
movzx esi, word [edx]
cmp esi, 0x3a
jne 0x10059892
lea eax, [edi + 2]
cmp edx, eax
je 0x10059892
push ecx
xor ebx, ebx
push ebx
push ebx
push edi
call fcn.100594ec
add esp, 0x10
jmp 0x1005998c
push esi
lea ecx, [ebp - 0x255]
call fcn.10059b82
sub edx, edi
movzx eax, al
sar edx, 1
inc edx
neg eax
sbb eax, eax
xor ebx, ebx
push ebx
push ebx
and eax, edx
push ebx
mov dword [ebp - 0x260], eax
lea eax, [ebp - 0x254]
push eax
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_FindFirstFileExW]
mov esi, eax
cmp esi, 0xffffffff
jne 0x100598d5
push dword [ebp - 0x25c]
jmp 0x10059882
mov ebx, dword [ebp - 0x25c]
push 0x2e
mov eax, dword [ebx + 4]
sub eax, dword [ebx]
sar eax, 2
mov dword [ebp - 0x25c], eax
pop eax
cmp word [ebp - 0x228], ax
jne 0x10059912
cmp word [ebp - 0x226], 0
je 0x10059933
cmp word [ebp - 0x226], ax
jne 0x10059912
cmp word [ebp - 0x224], 0
je 0x10059933
push ebx
push dword [ebp - 0x260]
lea eax, [ebp - 0x228]
push edi
push eax
call fcn.100594ec
add esp, 0x10
mov dword [ebp - 0x264], eax
test eax, eax
jne 0x1005997f
lea eax, [ebp - 0x254]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
push 0x2e
test eax, eax
pop eax
jne 0x100598ec
mov eax, dword [ebx + 4]
mov edx, dword [ebx]
sub eax, edx
mov ecx, dword [ebp - 0x25c]
sar eax, 2
cmp ecx, eax
jne 0x10059967
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
xor eax, eax
jmp 0x1005998c
push 0x100590ee
sub eax, ecx
push 4
push eax
lea eax, [edx + ecx*4]
push eax
call fcn.10022cc0
add esp, 0x10
jmp 0x1005995c
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
mov eax, dword [ebp - 0x264]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10016a35
leave
ret
Function at 0x1005abca
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
je 0x1005ac67
push ebx
push esi
call fcn.1005ab86
xor ebx, ebx
sub eax, esi
push ebx
push ebx
push ebx
push ebx
sar eax, 1
push eax
push esi
push ebx
push ebx
mov dword [ebp - 8], eax
call fcn.10050720
add esp, 0x24
mov dword [ebp - 4], eax
test eax, eax
jne 0x1005ac14
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x1005ac66
push edi
push eax
call fcn.1004b986
mov edi, eax
pop ecx
push ebx
test edi, edi
jne 0x1005ac34
call fcn.1004b94c
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x1005ac65
push ebx
push dword [ebp - 4]
push edi
push dword [ebp - 8]
push esi
push ebx
push ebx
call fcn.10050720
add esp, 0x20
test eax, eax
jne 0x1005ac53
push edi
call fcn.1004b94c
jmp 0x1005ac5b
push ebx
call fcn.1004b94c
mov ebx, edi
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, ebx
pop edi
pop ebx
pop esi
leave
ret

Function at 0x1005ac6a
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
jne 0x1005ac7b
pop esi
ret
push ebx
push edi
push esi
call fcn.1005ab86
mov ebx, eax
sub ebx, esi
and ebx, 0xfffffffe
push ebx
call fcn.1004b986
mov edi, eax
pop ecx
pop ecx
test edi, edi
je 0x1005aca3
push ebx
push esi
push edi
call fcn.100208e0
add esp, 0xc
push 0
call fcn.1004b94c
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, edi
pop edi
pop ebx
pop esi
ret

Function at 0x1005b547
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.1005af18

Function at 0x1005ebec
Capabilities:
Get geographical location

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push esi
push edi
call fcn.1004c4e3
mov esi, dword [ebp + 8]
mov edi, eax
push 2
lea eax, [ebp - 4]
mov ecx, esi
push eax
and ecx, 0x3ff
push 0x20000001
or ecx, 0x400
push ecx
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x1005ec5b
cmp esi, dword [ebp - 4]
je 0x1005ec56
cmp dword [ebp + 0xc], 0
je 0x1005ec56
mov esi, dword [edi + 0x50]
lea ecx, [esi + 2]
mov ax, word [esi]
add esi, 2
test ax, ax
jne 0x1005ec33
push dword [edi + 0x50]
sub esi, ecx
sar esi, 1
call fcn.1005e73e
pop ecx
xor ecx, ecx
cmp eax, esi
setne cl
mov eax, ecx
jmp 0x1005ec5d
xor eax, eax
inc eax
jmp 0x1005ec5d
xor eax, eax
pop edi
pop esi
leave
ret
Function at 0x1005ecc2
Capabilities:
Get geographical location

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [0x1007b008]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push ebx
mov ebx, dword [ebp + 0x10]
push esi
mov esi, dword [ebp + 8]
push edi
mov dword [ebp - 0x18], eax
call fcn.1004c4e3
add eax, 0x50
lea edi, [ebp - 0x10]
mov dword [ebp - 0x14], eax
xor eax, eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
call fcn.1004c4e3
lea ecx, [ebp - 0x10]
xor edx, edx
mov dword [eax + 0x34c], ecx
lea ecx, [esi + 0x80]
mov eax, dword [ebp - 0x14]
mov dword [eax], esi
lea edi, [eax + 4]
mov dword [edi], ecx
test ecx, ecx
je 0x1005ed39
cmp word [ecx], dx
je 0x1005ed39
mov eax, dword [0x100731c4]
push edi
dec eax
push eax
push 0x100730b0
call fcn.1005ec61
mov eax, dword [ebp - 0x14]
add esp, 0xc
xor edx, edx
mov dword [ebp - 0x10], edx
mov eax, dword [eax]
test eax, eax
je 0x1005edac
cmp word [eax], dx
je 0x1005edac
mov eax, dword [edi]
test eax, eax
je 0x1005ed5d
cmp word [eax], dx
je 0x1005ed5d
lea eax, [ebp - 0x10]
push eax
call fcn.1005e644
jmp 0x1005ed66
lea eax, [ebp - 0x10]
push eax
call fcn.1005e6df
cmp dword [ebp - 0x10], 0
pop ecx
jne 0x1005edd6
mov eax, dword [0x100730ac]
push dword [ebp - 0x14]
dec eax
push eax
push 0x10072da0
call fcn.1005ec61
add esp, 0xc
test al, al
je 0x1005edd6
mov eax, dword [edi]
xor edi, edi
test eax, eax
je 0x1005eda1
cmp word [eax], di
je 0x1005eda1
lea eax, [ebp - 0x10]
push eax
call fcn.1005e644
pop ecx
jmp 0x1005edd8
lea eax, [ebp - 0x10]
push eax
call fcn.1005e6df
jmp 0x1005ed9e
mov eax, dword [edi]
test eax, eax
je 0x1005edc3
cmp word [eax], dx
je 0x1005edc3
lea eax, [ebp - 0x10]
push eax
call fcn.1005e5db
pop ecx
jmp 0x1005edd6
mov dword [ebp - 0x10], 0x104
call dword [sym.imp.KERNEL32.dll_GetUserDefaultLCID]
mov dword [ebp - 8], eax
mov dword [ebp - 0xc], eax
xor edi, edi
cmp dword [ebp - 0x10], 0
je 0x1005eea1
lea eax, [ebp - 0x10]
push eax
lea eax, [esi + 0x100]
neg esi
sbb esi, esi
and esi, eax
push esi
call fcn.1005eae6
mov esi, eax
pop ecx
pop ecx
test esi, esi
je 0x1005eea1
movzx ecx, si
push ecx
call dword [sym.imp.KERNEL32.dll_IsValidCodePage]
test eax, eax
je 0x1005eea1
push 1
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_IsValidLocale]
test eax, eax
je 0x1005eea1
mov eax, dword [ebp - 0x18]
test eax, eax
je 0x1005ee2e
mov dword [eax], esi
mov eax, dword [ebp - 0x14]
push edi
push 0x55
add eax, 0x250
push eax
push dword [ebp - 0xc]
call fcn.1004d4d7
test ebx, ebx
je 0x1005ee9c
push edi
push 0x55
lea eax, [ebx + 0x120]
push eax
push dword [ebp - 0xc]
call fcn.1004d4d7
push 0x40
push ebx
push 0x1001
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x1005eea1
push 0x40
lea eax, [ebx + 0x80]
push eax
push 0x1002
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x1005eea1
push 0xa
push 0x10
lea ecx, [ebx + 0x100]
push ecx
push esi
call fcn.100552bd
add esp, 0x10
xor eax, eax
inc eax
jmp 0x1005eea3
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10016a35
leave
ret
Function at 0x1005f30d
Capabilities:
Get disk information

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [0x1007b008]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
cmp eax, 0x1a
jbe 0x1005f350
call fcn.10042fc8
mov dword [eax], 0xf
call fcn.10042fdb
mov dword [eax], 0xd
call fcn.1004afb3
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10016a35
leave
ret
test eax, eax
jne 0x1005f357
inc eax
jmp 0x1005f344
add eax, 0x40
push 0x3a
mov word [ebp - 0xc], ax
pop eax
mov word [ebp - 0xa], ax
push 0x5c
pop eax
mov word [ebp - 8], ax
xor eax, eax
mov word [ebp - 6], ax
lea eax, [ebp - 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
mov ecx, eax
test ecx, ecx
je 0x1005f342
xor eax, eax
cmp ecx, 1
setne al
jmp 0x1005f344
Function at 0x100016b0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [0x10037040]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov edi, ecx
xor edx, edx
mov ecx, dword [ebp + 0xc]
mov dword [ebp - 0x18], edi
mov dword [ebp - 0x10], ecx
mov esi, dword [edi]
lea eax, [esi*4]
test eax, eax
je 0x100016fc
mov ebx, dword [ebp + 8]
sub ebx, ecx
mov al, byte [ecx + ebx]
lea ecx, [ecx + 1]
mov byte [ecx - 1], al
inc edx
mov esi, dword [edi]
lea eax, [esi*4]
cmp edx, eax
jb 0x100016e2
mov ecx, dword [ebp - 0x10]
lea edi, [esi*4]
mov esi, dword [ebp - 0x18]
mov eax, dword [esi + 4]
inc eax
shl eax, 4
cmp edi, eax
jae 0x10001845
lea eax, [edi - 3]
add eax, ecx
mov bh, byte [eax]
nop dword [eax]
mov cl, byte [eax + 1]
xor edx, edx
mov ch, byte [eax + 2]
mov bl, byte [eax - 1]
mov dword [ebp - 0x1c], eax
mov eax, edi
shr eax, 2
div dword [esi]
mov byte [ebp - 8], bl
mov eax, edx
mov byte [ebp - 7], bh
mov byte [ebp - 0xa], cl
mov byte [ebp - 6], cl
mov byte [ebp - 9], ch
mov byte [ebp - 5], ch
test eax, eax
jne 0x100017a7
lea eax, [ebp - 8]
mov byte [ebp - 8], bh
push eax
mov byte [ebp - 7], cl
mov byte [ebp - 6], ch
mov byte [ebp - 5], bl
call fcn.10001620
mov eax, dword [esi]
xor edx, edx
mov cl, 1
lea esi, [eax*4]
mov eax, edi
div esi
mov esi, eax
sub esi, 1
je 0x10001794
nop word [eax + eax]
mov dl, cl
add cl, cl
shr dl, 7
movzx eax, dl
imul eax, eax, 0x1b
xor cl, al
sub esi, 1
jne 0x10001780
mov bl, byte [ebp - 8]
mov dh, byte [ebp - 5]
xor bl, cl
mov dl, byte [ebp - 6]
mov bh, byte [ebp - 7]
mov esi, dword [ebp - 0x18]
jmp 0x100017d0
mov edx, dword [esi]
cmp edx, 6
jbe 0x100017ca
cmp eax, 4
jne 0x100017ca
lea eax, [ebp - 8]
push eax
call fcn.10001620
mov dh, byte [ebp - 5]
mov dl, byte [ebp - 6]
mov bh, byte [ebp - 7]
mov bl, byte [ebp - 8]
jmp 0x100017d0
mov dh, byte [ebp - 9]
mov dl, byte [ebp - 0xa]
mov eax, dword [esi]
mov ecx, dword [ebp - 0x10]
shl eax, 2
sub ecx, eax
movzx eax, byte [ecx + edi]
mov ecx, dword [ebp - 0x1c]
xor al, bl
mov byte [ecx + 3], al
mov ecx, dword [esi]
mov eax, dword [ebp - 0x10]
shl ecx, 2
sub eax, ecx
mov al, byte [eax + edi + 1]
xor al, bh
mov ebx, dword [ebp - 0x1c]
mov byte [ebx + 4], al
lea ecx, [ebx + 4]
mov byte [ebp - 9], al
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x14], ecx
mov ecx, dword [esi]
shl ecx, 2
sub eax, ecx
movzx eax, byte [eax + edi + 2]
xor al, dl
mov byte [ebx + 5], al
mov ecx, dword [esi]
mov eax, dword [ebp - 0x10]
shl ecx, 2
sub eax, ecx
movzx eax, byte [eax + edi + 3]
add edi, 4
xor al, dh
mov byte [ebx + 6], al
mov eax, dword [esi + 4]
mov bh, byte [ebp - 9]
inc eax
shl eax, 4
cmp edi, eax
mov eax, dword [ebp - 0x14]
jb 0x10001720
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10026c90
mov esp, ebp
pop ebp
ret 8
Function at 0x10010760
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x10037040]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push ebx
push esi
mov esi, dword [ebp + 8]
mov dword [ebp - 8], esi
cmp dword [eax + 0x14], 0xf
jbe 0x10010783
mov eax, dword [eax]
push 0
push 0x80
push 3
push 0
push 1
push 0x80000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov ebx, eax
mov dword [ebp - 0x18], ebx
cmp ebx, 0xffffffff
je 0x100107be
push 0
push ebx
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [ebp - 0x1c], eax
cmp eax, 0xffffffff
jne 0x100107e6
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi], 0
mov eax, esi
mov dword [esi + 4], 0
mov dword [esi + 8], 0
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10026c90
mov esp, ebp
pop ebp
ret 8
xor ecx, ecx
mov dword [ebp - 0x10], 0
push edi
xor edi, edi
mov dword [ebp - 0x20], ecx
xor ebx, ebx
mov dword [ebp - 0x14], edi
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0xc], ebx
test eax, eax
je 0x10010835
cmp eax, 0x7fffffff
ja 0x100108fb
push eax
lea ecx, [ebp - 0x14]
call fcn.10001e00
mov eax, dword [ebp - 0x1c]
mov edi, dword [ebp - 0x14]
push eax
push ebx
push edi
call sub.VCRUNTIME140.dll_memset
mov eax, dword [ebp - 0x1c]
add esp, 0xc
mov ebx, dword [ebp - 0xc]
lea ecx, [edi + eax]
mov dword [ebp - 0x20], ecx
push 0
lea ecx, [ebp - 8]
push ecx
push eax
push edi
push dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_ReadFile]
push dword [ebp - 0x18]
test eax, eax
jne 0x10010893
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi], 0
mov dword [esi + 4], 0
mov dword [esi + 8], 0
test edi, edi
je 0x100108e6
sub ebx, edi
mov eax, edi
cmp ebx, 0x1000
jb 0x10010887
mov edi, dword [eax - 4]
add ebx, 0x23
sub eax, edi
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x100108d5
push ebx
push edi
call fcn.10026cc1
add esp, 8
jmp 0x100108e6
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x1c]
cmp dword [ebp - 8], eax
je 0x100108db
mov dword [esi], 0
mov dword [esi + 4], 0
mov dword [esi + 8], 0
test edi, edi
je 0x100108e6
sub ebx, edi
mov eax, edi
cmp ebx, 0x1000
jb 0x10010887
mov edi, dword [eax - 4]
add ebx, 0x23
sub eax, edi
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x10010887
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
mov eax, dword [ebp - 0x20]
mov dword [esi], edi
mov dword [esi + 4], eax
mov dword [esi + 8], ebx
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10026c90
mov esp, ebp
pop ebp
ret 8
call fcn.10001df0
int3
Function at 0x10010c80
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x1c
push ebx
mov ebx, ecx
push esi
push edi
cmp dword [ebx + 0x38], 0
je 0x10010cac
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____thiscall_std::basic_streambuf_char__struct_std::char_traits_char__::xsputn_char_const___long_long___int64__]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov eax, dword [ebx + 0x20]
mov esi, dword [ebp + 0xc]
mov edi, dword [ebp + 0x10]
mov dword [esp + 0x20], esi
mov ecx, dword [eax]
lea eax, [ebx + 0x30]
mov dword [esp + 0x24], edi
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x18], eax
test ecx, ecx
je 0x10010cd4
mov eax, dword [eax]
mov ecx, dword [eax]
jmp 0x10010cda
xor ecx, ecx
mov dword [esp + 0x18], eax
mov eax, ecx
cdq
mov dword [esp + 0x10], eax
mov ecx, edx
mov dword [esp + 0x14], ecx
test edi, edi
jl 0x10010d42
jg 0x10010cf1
test esi, esi
je 0x10010d42
test ecx, ecx
jl 0x10010d3d
jg 0x10010cfb
test eax, eax
je 0x10010d3d
cmp edi, ecx
jg 0x10010d0f
jl 0x10010d05
cmp esi, eax
jae 0x10010d0f
mov eax, esi
mov dword [esp + 0x10], esi
mov dword [esp + 0x14], edi
push eax
push dword [ebp + 8]
push dword [esp + 0x24]
call sub.VCRUNTIME140.dll_memcpy
mov eax, dword [esp + 0x24]
add esp, 0xc
mov edx, dword [esp + 0x10]
mov ecx, dword [ebp + 8]
add ecx, edx
sub esi, edx
mov eax, dword [eax]
sbb edi, dword [esp + 0x14]
sub dword [eax], edx
mov eax, dword [ebx + 0x20]
add dword [eax], edx
jmp 0x10010d45
mov ecx, dword [ebp + 8]
jmp 0x10010d4f
mov ecx, dword [ebp + 8]
test edi, edi
jl 0x10010d69
jg 0x10010d4f
test esi, esi
je 0x10010d69
mov eax, dword [ebx + 0x4c]
test eax, eax
je 0x10010d69
push eax
push esi
push 1
push ecx
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
add esp, 0x10
sub esi, eax
sbb edi, 0
mov eax, dword [esp + 0x20]
mov edx, dword [esp + 0x24]
sub eax, esi
sbb edx, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x10010d80
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [ebp + 0x10]
push ebx
mov ebx, ecx
mov ecx, dword [ebp + 0xc]
push esi
mov esi, dword [ebp + 8]
mov dword [ebp - 4], esi
test eax, eax
jg 0x10010dac
jl 0x10010da0
test ecx, ecx
jne 0x10010dac
pop esi
xor eax, eax
xor edx, edx
pop ebx
mov esp, ebp
pop ebp
ret 0xc
cmp dword [ebx + 0x38], 0
je 0x10010dc5
push eax
push ecx
push esi
mov ecx, ebx
call dword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____thiscall_std::basic_streambuf_char__struct_std::char_traits_char__::xsgetn_char___long_long___int64__]
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov eax, dword [ebx + 0x1c]
push edi
mov edi, ecx
mov eax, dword [eax]
mov dword [ebp - 8], eax
test eax, eax
je 0x10010e13
mov eax, dword [ebx + 0x2c]
lea edx, [ebx + 0x2c]
mov dword [ebp - 0xc], edx
mov eax, dword [eax]
test eax, eax
je 0x10010e19
mov edi, dword [ebp - 4]
cmp eax, ecx
mov esi, ecx
cmovb esi, eax
push esi
push dword [ebp - 8]
push edi
call sub.VCRUNTIME140.dll_memcpy
mov eax, dword [ebx + 0x2c]
add edi, esi
mov dword [ebp - 4], edi
add esp, 0xc
mov edi, dword [ebp + 0xc]
sub edi, esi
sub dword [eax], esi
mov eax, dword [ebx + 0x1c]
add dword [eax], esi
mov esi, dword [ebp - 4]
jmp 0x10010e19
lea eax, [ebx + 0x2c]
mov dword [ebp - 0xc], eax
cmp dword [ebx + 0x4c], 0
je 0x10010e86
mov ecx, dword [ebx + 0xc]
lea eax, [ebx + 0x3c]
cmp dword [ecx], eax
jne 0x10010e42
mov eax, dword [ebx + 0xc]
mov edx, dword [ebx + 0x54]
mov ecx, dword [ebx + 0x50]
sub edx, ecx
mov dword [eax], ecx
mov eax, dword [ebx + 0x1c]
mov dword [eax], ecx
mov eax, dword [ebp - 0xc]
mov eax, dword [eax]
mov dword [eax], edx
mov eax, dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
cmp edi, 0xfff
jbe 0x10010e74
nop
push dword [ebx + 0x4c]
push 0xfff
push 1
push esi
call eax
add esp, 0x10
add esi, eax
sub edi, eax
cmp eax, 0xfff
jne 0x10010e86
cmp edi, eax
mov eax, dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
ja 0x10010e50
test edi, edi
je 0x10010e86
push dword [ebx + 0x4c]
push edi
push 1
push esi
call eax
add esp, 0x10
sub edi, eax
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 0x10]
sub eax, edi
pop edi
pop esi
sbb edx, 0
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x10011200
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
mov eax, dword [0x10037040]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, ecx
cmp ebx, 0xffffffff
jne 0x10011230
pop esi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10026c90
mov esp, ebp
pop ebp
ret 4
mov eax, dword [esi + 0x20]
push edi
mov ecx, dword [eax]
test ecx, ecx
je 0x1001126c
mov edx, dword [esi + 0x30]
mov edi, dword [edx]
lea eax, [edi + ecx]
cmp ecx, eax
jae 0x1001126c
lea ecx, [edi - 1]
mov eax, ebx
mov dword [edx], ecx
mov edx, dword [esi + 0x20]
pop edi
mov esi, dword [edx]
lea ecx, [esi + 1]
mov dword [edx], ecx
mov byte [esi], bl
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10026c90
mov esp, ebp
pop ebp
ret 4
cmp dword [esi + 0x4c], 0
je 0x10011343
mov edi, dword [esi + 0xc]
lea eax, [esi + 0x3c]
cmp dword [edi], eax
jne 0x10011294
mov edx, dword [esi + 0x54]
mov ecx, dword [esi + 0x50]
sub edx, ecx
mov dword [edi], ecx
mov eax, dword [esi + 0x1c]
mov dword [eax], ecx
mov eax, dword [esi + 0x2c]
mov dword [eax], edx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x100112a0
movsx eax, bl
jmp 0x100112d8
lea eax, [ebp - 0x2c]
mov byte [ebp - 0x25], bl
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x25]
push eax
lea eax, [esi + 0x40]
push eax
call dword [sym.imp.MSVCP140.dll_public:_int___thiscall_std::codecvt_char__char__struct__Mbstatet_::out_struct__Mbstatet___char_const___char_const___char_const____char___char___char___const]
sub eax, 0
je 0x10011302
sub eax, 1
je 0x10011302
sub eax, 2
jne 0x10011343
movsx eax, byte [ebp - 0x25]
push dword [esi + 0x4c]
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
add esp, 8
or ecx, 0xffffffff
cmp eax, ecx
cmove ebx, ecx
pop edi
pop esi
mov eax, ebx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10026c90
mov esp, ebp
pop ebp
ret 4
mov edi, dword [ebp - 0x2c]
lea eax, [ebp - 0x24]
sub edi, eax
je 0x10011320
push dword [esi + 0x4c]
push edi
push 1
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
add esp, 0x10
cmp edi, eax
jne 0x10011343
lea ecx, [ebp - 0x25]
mov byte [esi + 0x3d], 1
or eax, 0xffffffff
cmp dword [ebp - 0x30], ecx
pop edi
pop esi
cmovne eax, ebx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10026c90
mov esp, ebp
pop ebp
ret 4
mov ecx, dword [ebp - 4]
or eax, 0xffffffff
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10026c90
mov esp, ebp
pop ebp
ret 4