joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1019bd09
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x101b2f55
mov eax, dword fs:[0]
push eax
sub esp, 0x20
mov eax, dword [0x10415990]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov esi, edx
mov dword [ebp - 0x2c], esi
call fcn.10167810
cmp byte [eax + 0x4c], 0
je case.0x1019bcbd.0
test byte [0x10455eec], 1
jne 0x1019bcaf
or dword [0x10455eec], 1
mov ecx, 0x10455e48
mov dword [ebp - 4], 0
call fcn.10169320
push 0x101b4cc0
call fcn.1015f6af
add esp, 4
cmp byte [0x10455e4a], 0
je case.0x1019bcbd.0
cmp edi, 3
ja case.0x1019bcbd.0
jmp dword [edi*4 + 0x1019bd8c]
mov edi, 3
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
lea ecx, [ebp - 0x28]
mov esi, eax
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetConsoleScreenBufferInfo]
movzx ebx, word [ebp - 0x20]
call sub.MSVCR100.dll___iob_func
add eax, 0x40
push eax
call sub.MSVCR100.dll_fflush
mov eax, edi
add esp, 4
dec eax
je 0x1019bd31
dec eax
je 0x1019bd2a
dec eax
je 0x1019bd23
xor eax, eax
jmp 0x1019bd36
mov edi, 1
jmp 0x1019bcc9
call sub.MSVCR100.dll___iob_func
add eax, 0x40
push eax
mov eax, dword [ebp + 8]
push 1
push eax
push esi
call sub.MSVCR100.dll_fwrite
add esp, 0x10
jmp 0x1019bd70
mov eax, 6
jmp 0x1019bd36
mov eax, 2
jmp 0x1019bd36
mov eax, 4
mov edi, dword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
or eax, 8
push eax
push esi
call edi
call sub.MSVCR100.dll___iob_func
mov edx, dword [ebp + 8]
add eax, 0x40
push eax
mov eax, dword [ebp - 0x2c]
push 1
push edx
push eax
call sub.MSVCR100.dll_fwrite
call sub.MSVCR100.dll___iob_func
add eax, 0x40
push eax
call sub.MSVCR100.dll_fflush
add esp, 0x14
push ebx
push esi
call edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1015eea7
mov esp, ebp
pop ebp
ret
Function at 0x1019e970
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x101b3365
mov eax, dword fs:[0]
push eax
sub esp, 0x20
mov eax, dword [0x10415990]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov esi, edx
mov dword [ebp - 0x2c], esi
call fcn.10167810
cmp byte [eax + 0x4c], 0
je case.0x1019e9ed.0
test byte [0x10455eec], 1
jne 0x1019e9df
or dword [0x10455eec], 1
mov ecx, 0x10455e48
mov dword [ebp - 4], 0
call fcn.10169320
push 0x101b4cc0
call fcn.1015f6af
add esp, 4
cmp byte [0x10455e4a], 0
je case.0x1019e9ed.0
cmp edi, 3
ja case.0x1019e9ed.0
jmp dword [edi*4 + 0x1019eabc]
mov edi, 3
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
lea ecx, [ebp - 0x28]
mov esi, eax
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetConsoleScreenBufferInfo]
movzx ebx, word [ebp - 0x20]
call sub.MSVCR100.dll___iob_func
add eax, 0x40
push eax
call sub.MSVCR100.dll_fflush
mov eax, edi
add esp, 4
dec eax
je 0x1019ea61
dec eax
je 0x1019ea5a
dec eax
je 0x1019ea53
xor eax, eax
jmp 0x1019ea66
mov edi, 1
jmp 0x1019e9f9
call sub.MSVCR100.dll___iob_func
add eax, 0x40
push eax
mov eax, dword [ebp + 8]
push 1
push eax
push esi
call sub.MSVCR100.dll_fwrite
add esp, 0x10
jmp 0x1019eaa0
mov eax, 6
jmp 0x1019ea66
mov eax, 2
jmp 0x1019ea66
mov eax, 4
mov edi, dword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
or eax, 8
push eax
push esi
call edi
call sub.MSVCR100.dll___iob_func
mov edx, dword [ebp + 8]
add eax, 0x40
push eax
mov eax, dword [ebp - 0x2c]
push 1
push edx
push eax
call sub.MSVCR100.dll_fwrite
call sub.MSVCR100.dll___iob_func
add eax, 0x40
push eax
call sub.MSVCR100.dll_fflush
add esp, 0x14
push ebx
push esi
call edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1015eea7
mov esp, ebp
pop ebp
ret
Function at 0x1019e9f4
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x101b3365
mov eax, dword fs:[0]
push eax
sub esp, 0x20
mov eax, dword [0x10415990]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov esi, edx
mov dword [ebp - 0x2c], esi
call fcn.10167810
cmp byte [eax + 0x4c], 0
je case.0x1019e9ed.0
test byte [0x10455eec], 1
jne 0x1019e9df
or dword [0x10455eec], 1
mov ecx, 0x10455e48
mov dword [ebp - 4], 0
call fcn.10169320
push 0x101b4cc0
call fcn.1015f6af
add esp, 4
cmp byte [0x10455e4a], 0
je case.0x1019e9ed.0
cmp edi, 3
ja case.0x1019e9ed.0
jmp dword [edi*4 + 0x1019eabc]
mov edi, 3
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
lea ecx, [ebp - 0x28]
mov esi, eax
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetConsoleScreenBufferInfo]
movzx ebx, word [ebp - 0x20]
call sub.MSVCR100.dll___iob_func
add eax, 0x40
push eax
call sub.MSVCR100.dll_fflush
mov eax, edi
add esp, 4
dec eax
je 0x1019ea61
dec eax
je 0x1019ea5a
dec eax
je 0x1019ea53
xor eax, eax
jmp 0x1019ea66
mov edi, 1
jmp 0x1019e9f9
call sub.MSVCR100.dll___iob_func
add eax, 0x40
push eax
mov eax, dword [ebp + 8]
push 1
push eax
push esi
call sub.MSVCR100.dll_fwrite
add esp, 0x10
jmp 0x1019eaa0
mov eax, 6
jmp 0x1019ea66
mov eax, 2
jmp 0x1019ea66
mov eax, 4
mov edi, dword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
or eax, 8
push eax
push esi
call edi
call sub.MSVCR100.dll___iob_func
mov edx, dword [ebp + 8]
add eax, 0x40
push eax
mov eax, dword [ebp - 0x2c]
push 1
push edx
push eax
call sub.MSVCR100.dll_fwrite
call sub.MSVCR100.dll___iob_func
add eax, 0x40
push eax
call sub.MSVCR100.dll_fflush
add esp, 0x14
push ebx
push esi
call edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1015eea7
mov esp, ebp
pop ebp
ret
Function at 0x1019ea32
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x101b3365
mov eax, dword fs:[0]
push eax
sub esp, 0x20
mov eax, dword [0x10415990]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov esi, edx
mov dword [ebp - 0x2c], esi
call fcn.10167810
cmp byte [eax + 0x4c], 0
je case.0x1019e9ed.0
test byte [0x10455eec], 1
jne 0x1019e9df
or dword [0x10455eec], 1
mov ecx, 0x10455e48
mov dword [ebp - 4], 0
call fcn.10169320
push 0x101b4cc0
call fcn.1015f6af
add esp, 4
cmp byte [0x10455e4a], 0
je case.0x1019e9ed.0
cmp edi, 3
ja case.0x1019e9ed.0
jmp dword [edi*4 + 0x1019eabc]
mov edi, 3
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
lea ecx, [ebp - 0x28]
mov esi, eax
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetConsoleScreenBufferInfo]
movzx ebx, word [ebp - 0x20]
call sub.MSVCR100.dll___iob_func
add eax, 0x40
push eax
call sub.MSVCR100.dll_fflush
mov eax, edi
add esp, 4
dec eax
je 0x1019ea61
dec eax
je 0x1019ea5a
dec eax
je 0x1019ea53
xor eax, eax
jmp 0x1019ea66
mov edi, 1
jmp 0x1019e9f9
call sub.MSVCR100.dll___iob_func
add eax, 0x40
push eax
mov eax, dword [ebp + 8]
push 1
push eax
push esi
call sub.MSVCR100.dll_fwrite
add esp, 0x10
jmp 0x1019eaa0
mov eax, 6
jmp 0x1019ea66
mov eax, 2
jmp 0x1019ea66
mov eax, 4
mov edi, dword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
or eax, 8
push eax
push esi
call edi
call sub.MSVCR100.dll___iob_func
mov edx, dword [ebp + 8]
add eax, 0x40
push eax
mov eax, dword [ebp - 0x2c]
push 1
push edx
push eax
call sub.MSVCR100.dll_fwrite
call sub.MSVCR100.dll___iob_func
add eax, 0x40
push eax
call sub.MSVCR100.dll_fflush
add esp, 0x14
push ebx
push esi
call edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1015eea7
mov esp, ebp
pop ebp
ret
Function at 0x1019ea39
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x101b3365
mov eax, dword fs:[0]
push eax
sub esp, 0x20
mov eax, dword [0x10415990]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov esi, edx
mov dword [ebp - 0x2c], esi
call fcn.10167810
cmp byte [eax + 0x4c], 0
je case.0x1019e9ed.0
test byte [0x10455eec], 1
jne 0x1019e9df
or dword [0x10455eec], 1
mov ecx, 0x10455e48
mov dword [ebp - 4], 0
call fcn.10169320
push 0x101b4cc0
call fcn.1015f6af
add esp, 4
cmp byte [0x10455e4a], 0
je case.0x1019e9ed.0
cmp edi, 3
ja case.0x1019e9ed.0
jmp dword [edi*4 + 0x1019eabc]
mov edi, 3
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
lea ecx, [ebp - 0x28]
mov esi, eax
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetConsoleScreenBufferInfo]
movzx ebx, word [ebp - 0x20]
call sub.MSVCR100.dll___iob_func
add eax, 0x40
push eax
call sub.MSVCR100.dll_fflush
mov eax, edi
add esp, 4
dec eax
je 0x1019ea61
dec eax
je 0x1019ea5a
dec eax
je 0x1019ea53
xor eax, eax
jmp 0x1019ea66
mov edi, 1
jmp 0x1019e9f9
call sub.MSVCR100.dll___iob_func
add eax, 0x40
push eax
mov eax, dword [ebp + 8]
push 1
push eax
push esi
call sub.MSVCR100.dll_fwrite
add esp, 0x10
jmp 0x1019eaa0
mov eax, 6
jmp 0x1019ea66
mov eax, 2
jmp 0x1019ea66
mov eax, 4
mov edi, dword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
or eax, 8
push eax
push esi
call edi
call sub.MSVCR100.dll___iob_func
mov edx, dword [ebp + 8]
add eax, 0x40
push eax
mov eax, dword [ebp - 0x2c]
push 1
push edx
push eax
call sub.MSVCR100.dll_fwrite
call sub.MSVCR100.dll___iob_func
add eax, 0x40
push eax
call sub.MSVCR100.dll_fflush
add esp, 0x14
push ebx
push esi
call edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1015eea7
mov esp, ebp
pop ebp
ret
Function at 0x101a0870
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x101b3645
mov eax, dword fs:[0]
push eax
sub esp, 0x20
mov eax, dword [0x10415990]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov esi, edx
mov dword [ebp - 0x2c], esi
call fcn.10167810
cmp byte [eax + 0x4c], 0
je case.0x101a08ed.0
test byte [0x10455eec], 1
jne 0x101a08df
or dword [0x10455eec], 1
mov ecx, 0x10455e48
mov dword [ebp - 4], 0
call fcn.10169320
push 0x101b4cc0
call fcn.1015f6af
add esp, 4
cmp byte [0x10455e4a], 0
je case.0x101a08ed.0
cmp edi, 3
ja case.0x101a08ed.0
jmp dword [edi*4 + 0x101a09bc]
mov edi, 3
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
lea ecx, [ebp - 0x28]
mov esi, eax
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetConsoleScreenBufferInfo]
movzx ebx, word [ebp - 0x20]
call sub.MSVCR100.dll___iob_func
add eax, 0x40
push eax
call sub.MSVCR100.dll_fflush
mov eax, edi
add esp, 4
dec eax
je 0x101a0961
dec eax
je 0x101a095a
dec eax
je 0x101a0953
xor eax, eax
jmp 0x101a0966
mov edi, 1
jmp 0x101a08f9
call sub.MSVCR100.dll___iob_func
add eax, 0x40
push eax
mov eax, dword [ebp + 8]
push 1
push eax
push esi
call sub.MSVCR100.dll_fwrite
add esp, 0x10
jmp 0x101a09a0
mov eax, 6
jmp 0x101a0966
mov eax, 2
jmp 0x101a0966
mov eax, 4
mov edi, dword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
or eax, 8
push eax
push esi
call edi
call sub.MSVCR100.dll___iob_func
mov edx, dword [ebp + 8]
add eax, 0x40
push eax
mov eax, dword [ebp - 0x2c]
push 1
push edx
push eax
call sub.MSVCR100.dll_fwrite
call sub.MSVCR100.dll___iob_func
add eax, 0x40
push eax
call sub.MSVCR100.dll_fflush
add esp, 0x14
push ebx
push esi
call edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1015eea7
mov esp, ebp
pop ebp
ret
Function at 0x101a08f4
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x101b3645
mov eax, dword fs:[0]
push eax
sub esp, 0x20
mov eax, dword [0x10415990]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov esi, edx
mov dword [ebp - 0x2c], esi
call fcn.10167810
cmp byte [eax + 0x4c], 0
je case.0x101a08ed.0
test byte [0x10455eec], 1
jne 0x101a08df
or dword [0x10455eec], 1
mov ecx, 0x10455e48
mov dword [ebp - 4], 0
call fcn.10169320
push 0x101b4cc0
call fcn.1015f6af
add esp, 4
cmp byte [0x10455e4a], 0
je case.0x101a08ed.0
cmp edi, 3
ja case.0x101a08ed.0
jmp dword [edi*4 + 0x101a09bc]
mov edi, 3
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
lea ecx, [ebp - 0x28]
mov esi, eax
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetConsoleScreenBufferInfo]
movzx ebx, word [ebp - 0x20]
call sub.MSVCR100.dll___iob_func
add eax, 0x40
push eax
call sub.MSVCR100.dll_fflush
mov eax, edi
add esp, 4
dec eax
je 0x101a0961
dec eax
je 0x101a095a
dec eax
je 0x101a0953
xor eax, eax
jmp 0x101a0966
mov edi, 1
jmp 0x101a08f9
call sub.MSVCR100.dll___iob_func
add eax, 0x40
push eax
mov eax, dword [ebp + 8]
push 1
push eax
push esi
call sub.MSVCR100.dll_fwrite
add esp, 0x10
jmp 0x101a09a0
mov eax, 6
jmp 0x101a0966
mov eax, 2
jmp 0x101a0966
mov eax, 4
mov edi, dword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
or eax, 8
push eax
push esi
call edi
call sub.MSVCR100.dll___iob_func
mov edx, dword [ebp + 8]
add eax, 0x40
push eax
mov eax, dword [ebp - 0x2c]
push 1
push edx
push eax
call sub.MSVCR100.dll_fwrite
call sub.MSVCR100.dll___iob_func
add eax, 0x40
push eax
call sub.MSVCR100.dll_fflush
add esp, 0x14
push ebx
push esi
call edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1015eea7
mov esp, ebp
pop ebp
ret
Function at 0x101a0932
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x101b3645
mov eax, dword fs:[0]
push eax
sub esp, 0x20
mov eax, dword [0x10415990]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov esi, edx
mov dword [ebp - 0x2c], esi
call fcn.10167810
cmp byte [eax + 0x4c], 0
je case.0x101a08ed.0
test byte [0x10455eec], 1
jne 0x101a08df
or dword [0x10455eec], 1
mov ecx, 0x10455e48
mov dword [ebp - 4], 0
call fcn.10169320
push 0x101b4cc0
call fcn.1015f6af
add esp, 4
cmp byte [0x10455e4a], 0
je case.0x101a08ed.0
cmp edi, 3
ja case.0x101a08ed.0
jmp dword [edi*4 + 0x101a09bc]
mov edi, 3
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
lea ecx, [ebp - 0x28]
mov esi, eax
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetConsoleScreenBufferInfo]
movzx ebx, word [ebp - 0x20]
call sub.MSVCR100.dll___iob_func
add eax, 0x40
push eax
call sub.MSVCR100.dll_fflush
mov eax, edi
add esp, 4
dec eax
je 0x101a0961
dec eax
je 0x101a095a
dec eax
je 0x101a0953
xor eax, eax
jmp 0x101a0966
mov edi, 1
jmp 0x101a08f9
call sub.MSVCR100.dll___iob_func
add eax, 0x40
push eax
mov eax, dword [ebp + 8]
push 1
push eax
push esi
call sub.MSVCR100.dll_fwrite
add esp, 0x10
jmp 0x101a09a0
mov eax, 6
jmp 0x101a0966
mov eax, 2
jmp 0x101a0966
mov eax, 4
mov edi, dword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
or eax, 8
push eax
push esi
call edi
call sub.MSVCR100.dll___iob_func
mov edx, dword [ebp + 8]
add eax, 0x40
push eax
mov eax, dword [ebp - 0x2c]
push 1
push edx
push eax
call sub.MSVCR100.dll_fwrite
call sub.MSVCR100.dll___iob_func
add eax, 0x40
push eax
call sub.MSVCR100.dll_fflush
add esp, 0x14
push ebx
push esi
call edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1015eea7
mov esp, ebp
pop ebp
ret
Function at 0x101a0939
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x101b3645
mov eax, dword fs:[0]
push eax
sub esp, 0x20
mov eax, dword [0x10415990]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov esi, edx
mov dword [ebp - 0x2c], esi
call fcn.10167810
cmp byte [eax + 0x4c], 0
je case.0x101a08ed.0
test byte [0x10455eec], 1
jne 0x101a08df
or dword [0x10455eec], 1
mov ecx, 0x10455e48
mov dword [ebp - 4], 0
call fcn.10169320
push 0x101b4cc0
call fcn.1015f6af
add esp, 4
cmp byte [0x10455e4a], 0
je case.0x101a08ed.0
cmp edi, 3
ja case.0x101a08ed.0
jmp dword [edi*4 + 0x101a09bc]
mov edi, 3
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
lea ecx, [ebp - 0x28]
mov esi, eax
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetConsoleScreenBufferInfo]
movzx ebx, word [ebp - 0x20]
call sub.MSVCR100.dll___iob_func
add eax, 0x40
push eax
call sub.MSVCR100.dll_fflush
mov eax, edi
add esp, 4
dec eax
je 0x101a0961
dec eax
je 0x101a095a
dec eax
je 0x101a0953
xor eax, eax
jmp 0x101a0966
mov edi, 1
jmp 0x101a08f9
call sub.MSVCR100.dll___iob_func
add eax, 0x40
push eax
mov eax, dword [ebp + 8]
push 1
push eax
push esi
call sub.MSVCR100.dll_fwrite
add esp, 0x10
jmp 0x101a09a0
mov eax, 6
jmp 0x101a0966
mov eax, 2
jmp 0x101a0966
mov eax, 4
mov edi, dword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
or eax, 8
push eax
push esi
call edi
call sub.MSVCR100.dll___iob_func
mov edx, dword [ebp + 8]
add eax, 0x40
push eax
mov eax, dword [ebp - 0x2c]
push 1
push edx
push eax
call sub.MSVCR100.dll_fwrite
call sub.MSVCR100.dll___iob_func
add eax, 0x40
push eax
call sub.MSVCR100.dll_fflush
add esp, 0x14
push ebx
push esi
call edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1015eea7
mov esp, ebp
pop ebp
ret
Function at 0x101a4fb0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x101b3aa5
mov eax, dword fs:[0]
push eax
sub esp, 0x20
mov eax, dword [0x10415990]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov esi, edx
mov dword [ebp - 0x2c], esi
call fcn.10167810
cmp byte [eax + 0x4c], 0
je case.0x101a502d.0
test byte [0x10455eec], 1
jne 0x101a501f
or dword [0x10455eec], 1
mov ecx, 0x10455e48
mov dword [ebp - 4], 0
call fcn.10169320
push 0x101b4cc0
call fcn.1015f6af
add esp, 4
cmp byte [0x10455e4a], 0
je case.0x101a502d.0
cmp edi, 3
ja case.0x101a502d.0
jmp dword [edi*4 + 0x101a50fc]
mov edi, 3
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
lea ecx, [ebp - 0x28]
mov esi, eax
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetConsoleScreenBufferInfo]
movzx ebx, word [ebp - 0x20]
call sub.MSVCR100.dll___iob_func
add eax, 0x40
push eax
call sub.MSVCR100.dll_fflush
mov eax, edi
add esp, 4
dec eax
je 0x101a50a1
dec eax
je 0x101a509a
dec eax
je 0x101a5093
xor eax, eax
jmp 0x101a50a6
mov edi, 1
jmp 0x101a5039
call sub.MSVCR100.dll___iob_func
add eax, 0x40
push eax
mov eax, dword [ebp + 8]
push 1
push eax
push esi
call sub.MSVCR100.dll_fwrite
add esp, 0x10
jmp 0x101a50e0
mov eax, 6
jmp 0x101a50a6
mov eax, 2
jmp 0x101a50a6
mov eax, 4
mov edi, dword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
or eax, 8
push eax
push esi
call edi
call sub.MSVCR100.dll___iob_func
mov edx, dword [ebp + 8]
add eax, 0x40
push eax
mov eax, dword [ebp - 0x2c]
push 1
push edx
push eax
call sub.MSVCR100.dll_fwrite
call sub.MSVCR100.dll___iob_func
add eax, 0x40
push eax
call sub.MSVCR100.dll_fflush
add esp, 0x14
push ebx
push esi
call edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1015eea7
mov esp, ebp
pop ebp
ret
Function at 0x101a5034
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x101b3aa5
mov eax, dword fs:[0]
push eax
sub esp, 0x20
mov eax, dword [0x10415990]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov esi, edx
mov dword [ebp - 0x2c], esi
call fcn.10167810
cmp byte [eax + 0x4c], 0
je case.0x101a502d.0
test byte [0x10455eec], 1
jne 0x101a501f
or dword [0x10455eec], 1
mov ecx, 0x10455e48
mov dword [ebp - 4], 0
call fcn.10169320
push 0x101b4cc0
call fcn.1015f6af
add esp, 4
cmp byte [0x10455e4a], 0
je case.0x101a502d.0
cmp edi, 3
ja case.0x101a502d.0
jmp dword [edi*4 + 0x101a50fc]
mov edi, 3
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
lea ecx, [ebp - 0x28]
mov esi, eax
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetConsoleScreenBufferInfo]
movzx ebx, word [ebp - 0x20]
call sub.MSVCR100.dll___iob_func
add eax, 0x40
push eax
call sub.MSVCR100.dll_fflush
mov eax, edi
add esp, 4
dec eax
je 0x101a50a1
dec eax
je 0x101a509a
dec eax
je 0x101a5093
xor eax, eax
jmp 0x101a50a6
mov edi, 1
jmp 0x101a5039
call sub.MSVCR100.dll___iob_func
add eax, 0x40
push eax
mov eax, dword [ebp + 8]
push 1
push eax
push esi
call sub.MSVCR100.dll_fwrite
add esp, 0x10
jmp 0x101a50e0
mov eax, 6
jmp 0x101a50a6
mov eax, 2
jmp 0x101a50a6
mov eax, 4
mov edi, dword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
or eax, 8
push eax
push esi
call edi
call sub.MSVCR100.dll___iob_func
mov edx, dword [ebp + 8]
add eax, 0x40
push eax
mov eax, dword [ebp - 0x2c]
push 1
push edx
push eax
call sub.MSVCR100.dll_fwrite
call sub.MSVCR100.dll___iob_func
add eax, 0x40
push eax
call sub.MSVCR100.dll_fflush
add esp, 0x14
push ebx
push esi
call edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1015eea7
mov esp, ebp
pop ebp
ret
Function at 0x101a5072
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x101b3aa5
mov eax, dword fs:[0]
push eax
sub esp, 0x20
mov eax, dword [0x10415990]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov esi, edx
mov dword [ebp - 0x2c], esi
call fcn.10167810
cmp byte [eax + 0x4c], 0
je case.0x101a502d.0
test byte [0x10455eec], 1
jne 0x101a501f
or dword [0x10455eec], 1
mov ecx, 0x10455e48
mov dword [ebp - 4], 0
call fcn.10169320
push 0x101b4cc0
call fcn.1015f6af
add esp, 4
cmp byte [0x10455e4a], 0
je case.0x101a502d.0
cmp edi, 3
ja case.0x101a502d.0
jmp dword [edi*4 + 0x101a50fc]
mov edi, 3
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
lea ecx, [ebp - 0x28]
mov esi, eax
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetConsoleScreenBufferInfo]
movzx ebx, word [ebp - 0x20]
call sub.MSVCR100.dll___iob_func
add eax, 0x40
push eax
call sub.MSVCR100.dll_fflush
mov eax, edi
add esp, 4
dec eax
je 0x101a50a1
dec eax
je 0x101a509a
dec eax
je 0x101a5093
xor eax, eax
jmp 0x101a50a6
mov edi, 1
jmp 0x101a5039
call sub.MSVCR100.dll___iob_func
add eax, 0x40
push eax
mov eax, dword [ebp + 8]
push 1
push eax
push esi
call sub.MSVCR100.dll_fwrite
add esp, 0x10
jmp 0x101a50e0
mov eax, 6
jmp 0x101a50a6
mov eax, 2
jmp 0x101a50a6
mov eax, 4
mov edi, dword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
or eax, 8
push eax
push esi
call edi
call sub.MSVCR100.dll___iob_func
mov edx, dword [ebp + 8]
add eax, 0x40
push eax
mov eax, dword [ebp - 0x2c]
push 1
push edx
push eax
call sub.MSVCR100.dll_fwrite
call sub.MSVCR100.dll___iob_func
add eax, 0x40
push eax
call sub.MSVCR100.dll_fflush
add esp, 0x14
push ebx
push esi
call edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1015eea7
mov esp, ebp
pop ebp
ret