joyce8/EMBER2024-capa huggingface dataset:
Function at 0x43e580
Capabilities:
Encode data using xor
Encrypt data using aes via x86 extensions

Disassembly:
push ebp
push ebx
test eax, eax
je 0x43eaa0
test edx, edx
je 0x43eaa0
call fcn.0043e597
mov eax, 0xffffffff
pop ebx
pop ebp
ret

Function at 0x43eae0
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
mov eax, dword [esp + 4]
mov ecx, dword [esp + 8]
mov edx, dword [esp + 0xc]
call fcn.0043e580
mov edx, dword [esp + 0xc]
shl ecx, 4
test eax, eax
jne 0x43eb51
lea eax, [edx + ecx + 0x10]
movups xmm0, xmmword [edx]
movups xmm1, xmmword [eax]
movups xmmword [eax], xmm0
movups xmmword [edx], xmm1
lea edx, [edx + 0x10]
lea eax, [eax - 0x10]
movups xmm0, xmmword [edx]
movups xmm1, xmmword [eax]
aesimc xmm0, xmm0
aesimc xmm1, xmm1
lea edx, [edx + 0x10]
lea eax, [eax - 0x10]
movups xmmword [eax + 0x10], xmm0
movups xmmword [edx - 0x10], xmm1
cmp eax, edx
ja 0x43eb16
movups xmm0, xmmword [edx]
aesimc xmm0, xmm0
movups xmmword [edx], xmm0
pxor xmm0, xmm0
pxor xmm1, xmm1
xor eax, eax
ret

Function at 0x43f460
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
push ebx
push esi
push edi
sub esp, 0x10
mov ebp, dword [esp + 0x24]
mov esi, dword [esp + 0x28]
mov edi, dword [esp + 0x2c]
mov eax, dword [esi]
mov ebx, dword [esi + 4]
mov ecx, dword [esi + 8]
mov edx, dword [esi + 0xc]
bswap eax
bswap ebx
bswap ecx
bswap edx
mov dword [edi], eax
mov dword [edi + 4], ebx
mov dword [edi + 8], ecx
mov dword [edi + 0xc], edx
cmp ebp, 0x80
je 0x43f4e4
mov eax, dword [esi + 0x10]
mov ebx, dword [esi + 0x14]
cmp ebp, 0xc0
je 0x43f4bc
mov ecx, dword [esi + 0x18]
mov edx, dword [esi + 0x1c]
jmp 0x43f4c4
mov ecx, eax
mov edx, ebx
not ecx
not edx
bswap eax
bswap ebx
bswap ecx
bswap edx
mov dword [edi + 0x20], eax
mov dword [edi + 0x24], ebx
mov dword [edi + 0x28], ecx
mov dword [edi + 0x2c], edx
xor eax, dword [edi]
xor ebx, dword [edi + 4]
xor ecx, dword [edi + 8]
xor edx, dword [edi + 0xc]
nop
call fcn.0043f4e9
Function at 0x447a70
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x59e825
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push ebx
push esi
push edi
mov eax, dword [0x615e80]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, dword [ebp + 0xc]
mov edx, ebx
cmp dword [ebx + 0x14], 0xf
mov edi, dword [ebx + 0x10]
jbe 0x447aa8
mov edx, dword [ebx]
xor ecx, ecx
mov esi, 0x811c9dc5
test edi, edi
je 0x447ac4
movzx eax, byte [edx + ecx]
inc ecx
xor eax, esi
imul esi, eax, 0x1000193
cmp ecx, edi
jb 0x447ab3
push esi
push ebx
lea eax, [ebp - 0x18]
push eax
call fcn.00447e80
mov ecx, dword [ebp - 0x14]
test ecx, ecx
je 0x447af3
mov eax, dword [ebp + 8]
mov dword [eax], ecx
mov byte [eax + 4], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
cmp dword [0x61c6c8], 0x7ffffff
je 0x447c5b
mov dword [ebp - 0x20], 0x61c6c4
mov dword [ebp - 4], 0
push 0x20
mov dword [ebp - 0x1c], 0
call fcn.0057317f
mov edi, eax
add esp, 4
mov dword [ebp - 0x1c], edi
lea ecx, [edi + 8]
push ebx
call fcn.00447f90
mov dword [ebp - 4], 1
mov ecx, dword [0x61c6c8]
mov ebx, dword [0x61c6dc]
lea eax, [ecx + 1]
movd xmm0, eax
cvtdq2pd xmm0, xmm0
shr eax, 0x1f
addsd xmm0, qword [eax*8 + 0x60d8f0]
mov eax, ebx
shr eax, 0x1f
cvtpd2ps xmm2, xmm0
movd xmm0, ebx
cvtdq2pd xmm0, xmm0
movaps xmm1, xmm2
addsd xmm0, qword [eax*8 + 0x60d8f0]
cvtpd2ps xmm0, xmm0
divss xmm1, xmm0
movss xmm0, dword [0x61c6c0]
comiss xmm1, xmm0
jbe 0x447bf7
divss xmm2, xmm0
sub esp, 8
cvtps2pd xmm0, xmm2
movsd qword [ebp - 0x18], xmm0
fld qword [ebp - 0x18]
fstp qword [esp]
call fcn.0059d280
fstp qword [ebp - 0x18]
movsd xmm0, qword [ebp - 0x18]
add esp, 8
cvtpd2ps xmm0, xmm0
call fcn.00573ba0
mov ecx, 8
cmp eax, ecx
cmova ecx, eax
cmp ebx, ecx
jae 0x447bd9
cmp ebx, 0x200
jae 0x447bd7
shl ebx, 3
cmp ebx, ecx
jae 0x447bd9
mov ebx, ecx
push ebx
call fcn.00447d00
push esi
lea eax, [edi + 8]
push eax
lea eax, [ebp - 0x20]
push eax
call fcn.00447e80
mov ecx, dword [0x61c6c8]
mov edx, dword [eax]
jmp 0x447bfa
mov edx, dword [ebp - 0x18]
mov ebx, dword [edx + 4]
inc ecx
mov dword [0x61c6c8], ecx
mov dword [edi], edx
mov dword [edi + 4], ebx
mov dword [ebx], edi
mov dword [edx + 4], edi
mov eax, dword [0x61c6d8]
mov ecx, dword [0x61c6cc]
and eax, esi
mov esi, dword [ecx + eax*8]
cmp esi, dword [0x61c6c4]
jne 0x447c2b
mov dword [ecx + eax*8], edi
jmp 0x447c3a
cmp esi, edx
jne 0x447c34
mov dword [ecx + eax*8], edi
jmp 0x447c3e
cmp dword [ecx + eax*8 + 4], ebx
jne 0x447c3e
mov dword [ecx + eax*8 + 4], edi
mov eax, dword [ebp + 8]
mov dword [eax], edi
mov byte [eax + 4], 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
push str.unordered_map_set_too_long
call fcn.00574951
int3
Function at 0x447d00
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov eax, 0x1fffffff
sub esp, 8
bsr ecx, eax
push ebx
push ebp
push esi
mov esi, 1
mov eax, esi
shl eax, cl
mov ecx, dword [esp + 0x18]
push edi
cmp ecx, eax
ja 0x447e75
lea eax, [ecx - 1]
mov ebx, dword [0x61c6c4]
or eax, esi
mov dword [esp + 0x14], ebx
bsr ecx, eax
push ebx
lea ecx, [ecx + 1]
shl esi, cl
mov ecx, 0x61c6cc
lea eax, [esi + esi]
push eax
call fcn.00447890
mov edi, dword [0x61c6c4]
lea eax, [esi - 1]
mov dword [0x61c6d8], eax
mov dword [0x61c6dc], esi
mov edi, dword [edi]
cmp edi, ebx
je 0x447e6b
mov esi, edi
nop word [eax + eax]
cmp dword [esi + 0x1c], 0xf
lea ebx, [esi + 8]
mov edi, dword [edi]
jbe 0x447d7e
mov ebx, dword [esi + 8]
xor ecx, ecx
mov edx, 0x811c9dc5
cmp dword [esi + 0x18], ecx
jbe 0x447da7
nop word [eax + eax]
movzx eax, byte [ebx + ecx]
inc ecx
xor eax, edx
imul edx, eax, 0x1000193
cmp ecx, dword [esi + 0x18]
jb 0x447d90
mov eax, dword [0x61c6d8]
mov ecx, dword [esp + 0x14]
and edx, eax
mov eax, dword [0x61c6cc]
lea eax, [eax + edx*8]
mov dword [esp + 0x1c], eax
cmp dword [eax], ecx
jne 0x447dc4
mov dword [eax], esi
mov dword [eax + 4], esi
jmp 0x447e3d
mov ebx, dword [eax + 4]
lea ecx, [esi + 8]
lea edx, [ebx + 8]
call fcn.00447f10
test al, al
je 0x447dfd
mov ebx, dword [ebx]
cmp ebx, esi
je 0x447df4
mov edx, dword [esi + 4]
mov dword [edx], edi
mov ecx, dword [edi + 4]
mov dword [ecx], ebx
mov eax, dword [ebx + 4]
mov dword [eax], esi
mov dword [ebx + 4], ecx
mov dword [edi + 4], edx
mov dword [esi + 4], eax
mov eax, dword [esp + 0x1c]
mov dword [eax + 4], esi
jmp 0x447e3d
mov eax, dword [esp + 0x1c]
cmp dword [eax], ebx
je 0x447e1f
mov ebx, dword [ebx + 4]
lea ecx, [esi + 8]
lea edx, [ebx + 8]
call fcn.00447f10
test al, al
jne 0x447e4f
mov eax, dword [esp + 0x1c]
cmp dword [eax], ebx
jne 0x447e05
mov edx, dword [esi + 4]
mov dword [edx], edi
mov ecx, dword [edi + 4]
mov dword [ecx], ebx
mov eax, dword [ebx + 4]
mov dword [eax], esi
mov dword [ebx + 4], ecx
mov dword [edi + 4], edx
mov dword [esi + 4], eax
mov eax, dword [esp + 0x1c]
mov dword [eax], esi
mov esi, edi
cmp edi, dword [esp + 0x14]
je 0x447e6b
mov eax, dword [0x61c6d8]
jmp 0x447d70
mov edx, dword [esi + 4]
mov ebx, dword [ebx]
mov dword [edx], edi
mov ecx, dword [edi + 4]
mov dword [ecx], ebx
mov eax, dword [ebx + 4]
mov dword [eax], esi
mov dword [ebx + 4], ecx
mov dword [edi + 4], edx
mov dword [esi + 4], eax
jmp 0x447e3d
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret 4
push str.invalid_hash_bucket_count
call fcn.00574951
int3
Function at 0x44fe40
Capabilities:
Create process on windows

Disassembly:
sub esp, 0x5c
mov eax, dword [0x615e80]
xor eax, esp
mov dword [esp + 0x54], eax
push ebx
push esi
mov esi, ecx
lea ecx, [esp + 0x44]
call fcn.004653b0
push 0x38
lea eax, [esp + 0x10]
mov dword [esp + 0xc], 0x3c
push 0
push eax
call fcn.00577820
add esp, 0xc
mov dword [esp + 0x14], str.runas
cmp dword [esp + 0x58], 7
lea eax, [esp + 0x44]
mov dword [esp + 0x1c], str._multiwindow
cmova eax, dword [esp + 0x44]
mov dword [esp + 0x18], eax
lea eax, [esp + 8]
push eax
mov dword [esp + 0x14], 0
mov dword [esp + 0x28], 0xa
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
test eax, eax
je 0x44febc
mov byte [esi], 0
mov bl, 1
jmp 0x44febe
xor bl, bl
mov ecx, dword [esp + 0x58]
cmp ecx, 7
jbe 0x44fef6
mov edx, dword [esp + 0x44]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x44feec
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x44ff09
push ecx
push edx
call fcn.0057314e
add esp, 8
mov ecx, dword [esp + 0x5c]
mov al, bl
pop esi
pop ebx
xor ecx, esp
call fcn.00573140
add esp, 0x5c
ret
call fcn.0057ae3f
int3
Function at 0x452220
Capabilities:
Get number of processors

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x59f0ff
mov eax, dword fs:[0]
push eax
push ebx
sub esp, 0x10
push esi
push edi
mov eax, dword [0x615e80]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, edx
mov dword [ebp - 0x14], ecx
push 0x48
call fcn.0057317f
mov edi, eax
add esp, 4
mov dword [ebp - 0x1c], edi
mov dword [ebp - 4], 0
lea ecx, [edi + 0x10]
mov esi, dword [esi]
xorps xmm0, xmm0
movups xmmword [edi], xmm0
push 0xa
movups xmmword [ecx], xmm0
push 0x60d7a0
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 0
call fcn.00447220
mov byte [ebp - 4], 1
lea ecx, [edi + 0x3c]
mov edx, esi
mov dword [edi + 0x28], 0
mov dword [edi + 0x2c], 0
mov dword [edi + 0x30], 0x64
mov dword [edi + 0x34], 0
mov byte [edi + 0x38], 0
call fcn.00453ef0
mov eax, dword [ebp - 0x14]
mov dword [eax], edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret
Function at 0x4540a0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
sub esp, 8
movzx eax, cx
push ebx
push esi
push edi
push 0x60c350
push eax
push 0
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov esi, eax
test esi, esi
je 0x454103
push esi
push 0
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x454103
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
test edi, edi
je 0x454103
push esi
push 0
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ebx, eax
push ebx
push 2
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov esi, eax
test esi, esi
je 0x454103
push esi
call dword [sym.imp.KERNEL32.dll_GlobalLock]
test eax, eax
jne 0x45410c
push esi
call dword [sym.imp.KERNEL32.dll_GlobalFree]
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 8
ret
push ebx
push edi
push eax
call fcn.005772a0
add esp, 0xc
push esi
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
lea eax, [esp + 0xc]
mov dword [esp + 0xc], 0
push eax
push 1
push esi
call dword [sym.imp.ole32.dll_CreateStreamOnHGlobal]
test eax, eax
jns 0x45413f
push esi
call dword [sym.imp.KERNEL32.dll_GlobalFree]
mov edi, dword [esp + 0xc]
test edi, edi
je 0x454103
push 0x10
call dword [sym.imp.gdiplus.dll_GdipAlloc]
mov esi, eax
test esi, esi
je 0x454182
lea eax, [esp + 0x10]
mov dword [esi], vtable.Gdiplus::Bitmap.0
push eax
push edi
mov dword [esp + 0x18], 0
call dword [sym.imp.gdiplus.dll_GdipCreateBitmapFromStream]
mov dword [esi + 8], eax
mov eax, dword [esp + 0x10]
mov dword [esi + 4], eax
mov eax, esi
pop edi
pop esi
pop ebx
add esp, 8
ret
xor esi, esi
pop edi
mov eax, esi
pop esi
pop ebx
add esp, 8
ret
Function at 0x45cfb0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x59ff05
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push ebx
push esi
push edi
mov eax, dword [0x615e80]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov dword [ebp - 0x18], ebx
push 0
lea ecx, [ebp - 0x20]
call fcn.005749e4
mov dword [ebp - 4], 0
mov eax, dword [0x61c5a0]
mov edi, dword [0x61c6fc]
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x14], eax
test edi, edi
jne 0x45d032
push edi
lea ecx, [ebp - 0x10]
call fcn.005749e4
cmp dword [0x61c6fc], edi
jne 0x45d024
mov eax, dword [0x61b9c0]
inc eax
mov dword [0x61b9c0], eax
mov dword [0x61c6fc], eax
lea ecx, [ebp - 0x10]
call fcn.00574a3c
mov edi, dword [0x61c6fc]
mov edx, dword [ebp + 8]
lea ecx, [edi*4]
mov dword [ebp - 0x10], ecx
mov edx, dword [edx + 4]
cmp edi, dword [edx + 0xc]
jae 0x45d053
mov eax, dword [edx + 8]
mov esi, dword [ecx + eax]
test esi, esi
jne 0x45d0b4
jmp 0x45d058
xor esi, esi
mov dword [ebp - 0x10], ecx
cmp byte [edx + 0x14], 0
je 0x45d071
call fcn.00574cb7
cmp edi, dword [eax + 0xc]
jae 0x45d075
mov eax, dword [eax + 8]
mov esi, dword [ebp - 0x10]
mov esi, dword [esi + eax]
test esi, esi
jne 0x45d0b4
mov esi, dword [ebp - 0x1c]
test esi, esi
jne 0x45d0b4
push dword [ebp + 8]
lea eax, [ebp - 0x14]
push eax
call fcn.00462c70
add esp, 8
cmp eax, 0xffffffff
je 0x45d14f
mov esi, dword [ebp - 0x14]
mov dword [ebp + 8], esi
push esi
mov byte [ebp - 4], 1
call fcn.00574c8b
mov eax, dword [esi]
add esp, 4
mov ecx, esi
call dword [eax + 4]
mov dword [0x61c5a0], esi
lea ecx, [ebp - 0x20]
call fcn.00574a3c
mov eax, dword [esi]
mov ecx, esi
mov eax, dword [eax + 0xc]
call eax
test al, al
je 0x45d0e4
mov dword [ebx + 0x38], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
mov eax, dword [ebp - 0x18]
lea edi, [eax + 0x14]
lea ecx, [eax + 0x18]
lea edx, [eax + 0x24]
mov dword [eax + 0x38], esi
lea ebx, [eax + 4]
mov dword [eax + 0xc], ebx
lea esi, [eax + 8]
mov dword [eax + 0x10], esi
mov dword [eax + 0x1c], edi
mov dword [eax + 0x20], ecx
mov dword [eax + 0x2c], edx
add eax, 0x28
mov dword [ebp + 8], ebx
mov ebx, dword [ebp - 0x18]
mov dword [ebx + 0x30], eax
mov ebx, dword [ebp + 8]
mov dword [esi], 0
mov dword [ecx], 0
mov dword [eax], 0
mov dword [ebx], 0
mov dword [edi], 0
mov dword [edx], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
call fcn.00448110
int3
Function at 0x45d3c0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x1c
cmp dword [ecx + 0x38], 0
push ebx
push esi
push edi
mov dword [esp + 0x10], ecx
je 0x45d4ba
mov esi, dword [ebp + 0x10]
mov ebx, esi
mov edx, dword [ebp + 0xc]
mov edi, edx
mov eax, dword [ebp + 8]
mov dword [esp + 0xc], eax
test esi, esi
jl 0x45d4a9
jg 0x45d3fd
test edx, edx
je 0x45d4a9
lea edx, [ecx + 0x30]
mov eax, dword [ecx + 0x20]
mov dword [esp + 0x1c], edx
mov eax, dword [eax]
mov dword [esp + 0x18], eax
test eax, eax
je 0x45d417
mov eax, dword [edx]
mov eax, dword [eax]
jmp 0x45d419
xor eax, eax
cdq
mov esi, eax
mov eax, edx
mov dword [esp + 0x14], eax
test eax, eax
jl 0x45d467
jg 0x45d42c
test esi, esi
je 0x45d467
cmp ebx, eax
jg 0x45d43c
jl 0x45d436
cmp edi, esi
jae 0x45d43c
mov esi, edi
mov dword [esp + 0x14], ebx
mov eax, dword [esp + 0xc]
push esi
push eax
push dword [esp + 0x20]
call fcn.005772a0
mov edx, dword [esp + 0x28]
add esp, 0xc
mov ecx, dword [esp + 0x10]
sub edi, esi
sbb ebx, dword [esp + 0x14]
mov eax, dword [edx]
sub dword [eax], esi
mov eax, dword [ecx + 0x20]
add dword [eax], esi
jmp 0x45d48d
mov eax, dword [ecx]
mov edx, dword [eax + 0xc]
mov eax, dword [esp + 0xc]
movzx eax, byte [eax]
push eax
call edx
cmp eax, 0xffffffff
je 0x45d4a3
mov ecx, dword [esp + 0x10]
add edi, 0xffffffff
mov esi, 1
adc ebx, 0xffffffff
lea edx, [ecx + 0x30]
add dword [esp + 0xc], esi
test ebx, ebx
jg 0x45d400
jl 0x45d4a3
test edi, edi
jne 0x45d400
mov edx, dword [ebp + 0xc]
mov esi, dword [ebp + 0x10]
sub edx, edi
mov eax, edx
sbb esi, ebx
mov edx, esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov eax, dword [ecx + 0x20]
mov esi, dword [ebp + 0xc]
mov edi, dword [ebp + 0x10]
mov dword [esp + 0x20], esi
mov edx, dword [eax]
lea eax, [ecx + 0x30]
mov dword [esp + 0x24], edi
mov dword [esp + 0x1c], edx
mov dword [esp + 0x18], eax
test edx, edx
je 0x45d4e2
mov eax, dword [eax]
mov edx, dword [eax]
jmp 0x45d4e8
xor edx, edx
mov dword [esp + 0x18], eax
mov eax, edx
cdq
mov dword [esp + 0x14], eax
mov dword [esp + 0xc], edx
test edi, edi
jl 0x45d550
jg 0x45d4fd
test esi, esi
je 0x45d550
test edx, edx
jl 0x45d54b
jg 0x45d507
test eax, eax
je 0x45d54b
cmp edi, edx
jg 0x45d51b
jl 0x45d511
cmp esi, eax
jae 0x45d51b
mov eax, esi
mov dword [esp + 0x14], esi
mov dword [esp + 0xc], edi
mov ebx, dword [ebp + 8]
push eax
push ebx
push dword [esp + 0x24]
call fcn.005772a0
mov eax, dword [esp + 0x24]
add esp, 0xc
mov edx, dword [esp + 0x14]
add ebx, edx
mov ecx, dword [esp + 0x10]
sub esi, edx
mov eax, dword [eax]
sbb edi, dword [esp + 0xc]
sub dword [eax], edx
mov eax, dword [ecx + 0x20]
add dword [eax], edx
jmp 0x45d553
mov ebx, dword [ebp + 8]
jmp 0x45d55d
mov ebx, dword [ebp + 8]
test edi, edi
jl 0x45d576
jg 0x45d55d
test esi, esi
je 0x45d576
mov eax, dword [ecx + 0x4c]
test eax, eax
je 0x45d576
push eax
push esi
push 1
push ebx
call fcn.0058089e
add esp, 0x10
sub esi, eax
sbb edi, 0
mov eax, dword [esp + 0x20]
mov edx, dword [esp + 0x24]
sub eax, esi
sbb edx, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x45dae0
Capabilities:
Write file on windows

Disassembly:
sub esp, 0x30
mov eax, dword [0x615e80]
xor eax, esp
mov dword [esp + 0x2c], eax
push ebx
mov ebx, dword [esp + 0x38]
push esi
mov esi, ecx
cmp ebx, 0xffffffff
jne 0x45db10
pop esi
xor eax, eax
pop ebx
mov ecx, dword [esp + 0x2c]
xor ecx, esp
call fcn.00573140
add esp, 0x30
ret 4
mov eax, dword [esi + 0x20]
push edi
mov ecx, dword [eax]
test ecx, ecx
je 0x45db4d
mov edx, dword [esi + 0x30]
mov edi, dword [edx]
lea eax, [edi + ecx]
cmp ecx, eax
jae 0x45db4d
lea ecx, [edi - 1]
mov eax, ebx
mov dword [edx], ecx
mov edx, dword [esi + 0x20]
pop edi
mov esi, dword [edx]
lea ecx, [esi + 1]
mov dword [edx], ecx
mov byte [esi], bl
pop esi
pop ebx
mov ecx, dword [esp + 0x2c]
xor ecx, esp
call fcn.00573140
add esp, 0x30
ret 4
cmp dword [esi + 0x4c], 0
je 0x45dc59
mov edi, dword [esi + 0xc]
lea eax, [esi + 0x3c]
cmp dword [edi], eax
jne 0x45db75
mov edx, dword [esi + 0x54]
mov ecx, dword [esi + 0x50]
sub edx, ecx
mov dword [edi], ecx
mov eax, dword [esi + 0x1c]
mov dword [eax], ecx
mov eax, dword [esi + 0x2c]
mov dword [eax], edx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x45dba9
push dword [esi + 0x4c]
movsx eax, bl
push eax
call fcn.0057eb74
add esp, 8
or ecx, 0xffffffff
cmp eax, ecx
cmove ebx, ecx
pop edi
pop esi
mov eax, ebx
pop ebx
mov ecx, dword [esp + 0x2c]
xor ecx, esp
call fcn.00573140
add esp, 0x30
ret 4
mov byte [esp + 0xf], bl
mov eax, dword [ecx]
mov edx, dword [eax + 0x1c]
lea eax, [esp + 0x10]
push eax
lea eax, [esp + 0x3c]
push eax
lea eax, [esp + 0x20]
push eax
lea eax, [esp + 0x20]
push eax
lea eax, [esp + 0x20]
push eax
lea eax, [esp + 0x23]
push eax
lea eax, [esi + 0x40]
push eax
call edx
sub eax, 0
je 0x45dc14
sub eax, 1
je 0x45dc14
sub eax, 2
jne 0x45dc59
push dword [esi + 0x4c]
movsx eax, byte [esp + 0x13]
push eax
call fcn.0057eb74
add esp, 8
or ecx, 0xffffffff
cmp eax, ecx
cmove ebx, ecx
pop edi
pop esi
mov eax, ebx
pop ebx
mov ecx, dword [esp + 0x2c]
xor ecx, esp
call fcn.00573140
add esp, 0x30
ret 4
mov edi, dword [esp + 0x10]
lea eax, [esp + 0x18]
sub edi, eax
je 0x45dc33
push dword [esi + 0x4c]
push edi
push 1
push eax
call fcn.0058089e
add esp, 0x10
cmp edi, eax
jne 0x45dc59
lea ecx, [esp + 0xf]
mov byte [esi + 0x3d], 1
or eax, 0xffffffff
cmp dword [esp + 0x14], ecx
pop edi
pop esi
cmovne eax, ebx
pop ebx
mov ecx, dword [esp + 0x2c]
xor ecx, esp
call fcn.00573140
add esp, 0x30
ret 4
mov ecx, dword [esp + 0x38]
or eax, 0xffffffff
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.00573140
add esp, 0x30
ret 4
Function at 0x460850
Capabilities:
Write file on windows

Disassembly:
sub esp, 0x28
mov eax, dword [0x615e80]
xor eax, esp
mov dword [esp + 0x24], eax
push esi
mov esi, ecx
cmp dword [esi + 0x38], 0
je 0x460912
cmp byte [esi + 0x3d], 0
je 0x460912
mov eax, dword [esi]
push edi
push 0xffffffffffffffff
call dword [eax + 0xc]
cmp eax, 0xffffffff
je 0x4608ff
mov ecx, dword [esi + 0x38]
mov eax, dword [ecx]
mov edx, dword [eax + 0x20]
lea eax, [esp + 8]
push eax
lea eax, [esp + 0x30]
push eax
lea eax, [esp + 0x14]
push eax
lea eax, [esi + 0x40]
push eax
call edx
sub eax, 0
je 0x4608c4
sub eax, 1
je 0x4608c8
sub eax, 2
jne 0x4608ff
mov byte [esi + 0x3d], al
mov al, 1
pop edi
pop esi
mov ecx, dword [esp + 0x24]
xor ecx, esp
call fcn.00573140
add esp, 0x28
ret
mov byte [esi + 0x3d], 0
mov edi, dword [esp + 8]
lea eax, [esp + 0xc]
sub edi, eax
je 0x4608e7
push dword [esi + 0x4c]
push edi
push 1
push eax
call fcn.0058089e
add esp, 0x10
cmp edi, eax
jne 0x4608ff
cmp byte [esi + 0x3d], 0
pop edi
sete al
pop esi
mov ecx, dword [esp + 0x24]
xor ecx, esp
call fcn.00573140
add esp, 0x28
ret
pop edi
xor al, al
pop esi
mov ecx, dword [esp + 0x24]
xor ecx, esp
call fcn.00573140
add esp, 0x28
ret
mov ecx, dword [esp + 0x28]
mov al, 1
pop esi
xor ecx, esp
call fcn.00573140
add esp, 0x28
ret

Function at 0x461580
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x59e970
mov eax, dword fs:[0]
push eax
push esi
push edi
mov eax, dword [0x615e80]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
push 8
mov dword [edi], vtable.std::basic_streambuf_char__struct_std::char_traits_char__.0
mov dword [edi + 4], 0
mov dword [edi + 8], 0
mov dword [edi + 0xc], 0
mov dword [edi + 0x10], 0
mov dword [edi + 0x14], 0
mov dword [edi + 0x18], 0
mov dword [edi + 0x1c], 0
mov dword [edi + 0x20], 0
mov dword [edi + 0x24], 0
mov dword [edi + 0x28], 0
mov dword [edi + 0x2c], 0
mov dword [edi + 0x30], 0
call fcn.0057317f
mov esi, eax
push 1
mov dword [ebp - 4], 0
call fcn.00574cbd
add esp, 8
mov dword [esi + 4], eax
mov ecx, edi
mov dword [edi + 0x34], esi
call fcn.00461520
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x4670d0
Capabilities:
Write file on windows

Disassembly:
mov eax, 0x10008
call fcn.005738a0
mov eax, dword [0x615e80]
xor eax, esp
mov dword [esp + 0x10004], eax
cmp dword [edx + 0x14], 7
push esi
mov esi, ecx
mov dword [esp + 4], 0
jbe 0x4670fb
mov edx, dword [edx]
push 0x60d77c
push edx
lea eax, [esp + 0xc]
push eax
call fcn.0057f22d
add esp, 0xc
cmp dword [esp + 4], 0
je 0x46713d
cmp dword [esi + 0x14], 7
jbe 0x46711d
mov esi, dword [esi]
push 0x60d784
push esi
call fcn.0051c240
mov esi, eax
add esp, 8
test esi, esi
jne 0x467155
push dword [esp + 4]
call fcn.0057fd4f
add esp, 4
xor al, al
pop esi
mov ecx, dword [esp + 0x10004]
xor ecx, esp
call fcn.00573140
add esp, 0x10008
ret
push esi
call fcn.0051c260
push esi
call fcn.0051c210
add esp, 8
test eax, eax
jne 0x46719e
nop dword [eax + eax]
push 0x10000
lea eax, [esp + 0xc]
push eax
push esi
call fcn.0051c8f0
push dword [esp + 0x10]
push eax
lea eax, [esp + 0x1c]
push 1
push eax
call fcn.0058089e
push esi
call fcn.0051c210
add esp, 0x20
test eax, eax
je 0x467170
push esi
call fcn.0051c950
push dword [esp + 8]
call fcn.0057fd4f
mov ecx, dword [esp + 0x10010]
add esp, 8
mov al, 1
pop esi
xor ecx, esp
call fcn.00573140
add esp, 0x10008
ret