joyce8/EMBER2024-capa huggingface dataset:
Function at 0x44c9f0
Capabilities:
Check os version

Disassembly:
push 0xffffffffffffffff
push 0x489f4e
mov eax, dword fs:[0]
push eax
sub esp, 0x124
mov eax, dword [0x4a9750]
xor eax, esp
mov dword [esp + 0x120], eax
push esi
mov eax, dword [0x4a9750]
xor eax, esp
push eax
lea eax, [esp + 0x12c]
mov dword fs:[0], eax
mov esi, ecx
push 1
mov dword [esp + 0xc], esi
call fcn.00467355
mov dword [esi + 4], eax
push 0x11c
push 0
mov byte [eax], 0
lea eax, [esp + 0x18]
push eax
call fcn.0046ab60
add esp, 0x10
mov dword [esp + 0xc], 0x11c
lea eax, [esp + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x44ca73
cmp dword [esp + 0x10], 6
mov ecx, dword [esi + 4]
setae dl
mov byte [ecx], dl
mov dword [esp + 0x134], 0xffffffff
mov eax, esi
mov ecx, dword [esp + 0x12c]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [esp + 0x120]
xor ecx, esp
call fcn.00466b29
add esp, 0x130
ret

Function at 0x44cd90
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x4888c6
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x4a9750]
xor eax, esp
push eax
lea eax, [esp + 0x10]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0xc], esi
mov byte [esi], 0
xor eax, eax
mov dword [esi + 0x18], 7
mov dword [esi + 0x14], 0
mov word [esi + 4], ax
mov dword [esp + 0x18], eax
lea ecx, [esi + 0x1c]
push 0xffffffffffffffff
push eax
push dword [esp + 0x28]
mov dword [esi + 0x30], 7
mov dword [esi + 0x2c], eax
mov word [esi + 0x1c], ax
call fcn.004035e0
mov byte [esp + 0x18], 1
cmp dword [esi + 0x2c], 0
jne 0x44ce0b
push 3
push 0x49898c
lea ecx, [esi + 0x1c]
call fcn.00403a40
mov dword [esp + 0x18], 0xffffffff
mov eax, esi
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x10
ret 4
Function at 0x44dc70
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x48a1a2
mov eax, dword fs:[0]
push eax
sub esp, 0x18
mov eax, dword [0x4a9750]
xor eax, esp
mov dword [esp + 0x14], eax
push esi
push edi
mov eax, dword [0x4a9750]
xor eax, esp
push eax
lea eax, [esp + 0x24]
mov dword fs:[0], eax
mov esi, ecx
mov edi, dword [esp + 0x34]
push 0
mov dword [esp + 0x10], esi
call fcn.004632e0
mov dword [esp + 0x2c], 0
mov dword [esi + 4], 0
mov byte [esi + 8], 0
mov byte [esp + 0x2c], 1
mov dword [esi + 0xc], 0
mov byte [esi + 0x10], 0
mov byte [esp + 0x2c], 2
xor eax, eax
mov dword [esi + 0x14], 0
mov word [esi + 0x18], ax
mov byte [esp + 0x2c], 3
mov dword [esi + 0x1c], eax
mov word [esi + 0x20], ax
mov byte [esp + 0x2c], 4
mov dword [esi + 0x24], eax
mov byte [esi + 0x28], al
mov byte [esp + 0x2c], 5
mov dword [esi + 0x2c], eax
mov byte [esi + 0x30], al
mov byte [esp + 0x2c], 6
test edi, edi
jne 0x44dd48
lea eax, [esp + 0x1c]
mov dword [esp + 0x1c], str.bad_locale_name
push eax
lea ecx, [esp + 0x14]
call fcn.00468e49
mov byte [esp + 0x2c], 7
mov dword [esp + 0x10], vtable.std::runtime_error.0
mov byte [esp + 0x2c], 6
lea eax, [esp + 0x10]
push 0x4a7590
push eax
call fcn.0046ac7b
push edi
push esi
call fcn.004630e1
add esp, 8
mov dword [esp + 0x2c], 0xffffffff
mov eax, esi
mov ecx, dword [esp + 0x24]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [esp + 0x14]
xor ecx, esp
call fcn.00466b29
add esp, 0x24
ret 4

Function at 0x44e670
Capabilities:
Get process heap force flags

Disassembly:
push 0xffffffffffffffff
push 0x48a430
mov eax, dword fs:[0]
push eax
sub esp, 0x24
push esi
mov eax, dword [0x4a9750]
xor eax, esp
push eax
lea eax, [esp + 0x2c]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 8], esi
sub esp, 0x18
mov ecx, esp
mov dword [esp + 0x24], esp
push 0xffffffffffffffff
push 0
push dword [esp + 0x5c]
mov dword [ecx + 0x14], 0xf
mov dword [ecx + 0x10], 0
mov byte [ecx], 0
call fcn.00403440
mov dword [esp + 0x4c], 0
push dword [esp + 0x5c]
push dword [esp + 0x5c]
mov dword [esp + 0x54], 0xffffffff
lea ecx, [esp + 0x30]
call fcn.0044e510
add esp, 0x20
mov dword [esp + 0x34], 1
cmp dword [eax + 0x14], 0x10
jb 0x44e6f5
mov eax, dword [eax]
mov dword [esp + 0x3c], eax
mov ecx, esi
lea eax, [esp + 0x3c]
push eax
call fcn.00468e49
mov byte [esp + 0x34], 2
mov dword [esi], vtable.std::runtime_error.0
mov byte [esp + 0x34], 4
cmp dword [esp + 0x24], 0x10
jb 0x44e728
push dword [esp + 0x10]
call fcn.00467305
add esp, 4
mov eax, dword [esp + 0x40]
mov dword [esi + 0xc], eax
mov eax, dword [esp + 0x44]
mov dword [esp + 0x24], 0xf
mov dword [esp + 0x20], 0
mov byte [esp + 0x10], 0
mov dword [esi], vtable.std::_System_error.0
mov dword [esi + 0x10], eax
mov dword [esp + 0x34], 0xffffffff
mov eax, esi
mov ecx, dword [esp + 0x2c]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x30
ret 0xc
Function at 0x44eaa0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x48a5b9
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x4a9750]
xor eax, esp
push eax
lea eax, [esp + 0xc]
mov dword fs:[0], eax
mov dword [esp + 8], 0
mov eax, dword [ecx + 0x30]
mov esi, dword [esp + 0x1c]
mov ecx, dword [eax]
mov dword [esi], ecx
mov edx, dword [ecx]
call dword [edx + 4]
mov dword [esp + 0x14], 0
mov dword [esp + 8], 1
mov eax, esi
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x10
ret 4
Function at 0x453320
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x487d89
mov eax, dword fs:[0]
push eax
sub esp, 8
push esi
push edi
mov eax, dword [0x4a9750]
xor eax, esp
push eax
lea eax, [esp + 0x14]
mov dword fs:[0], eax
mov edi, ecx
mov dword [esp + 0x10], edi
mov dword [esp + 0xc], 0
cmp byte [edx], 0
jne 0x45335c
xor esi, esi
jmp 0x45336a
mov esi, edx
lea ecx, [esi + 1]
mov al, byte [esi]
inc esi
test al, al
jne 0x453361
sub esi, ecx
push esi
push edx
push ecx
mov ecx, dword [esp + 0x30]
call fcn.00453840
push eax
mov ecx, edi
call fcn.00431660
mov dword [esp + 0x1c], 0
mov dword [esp + 0xc], 1
mov eax, edi
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x14
ret

Function at 0x4562d0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x48b66b
mov eax, dword fs:[0]
push eax
sub esp, 8
push esi
push edi
mov eax, dword [0x4a9750]
xor eax, esp
push eax
lea eax, [esp + 0x14]
mov dword fs:[0], eax
mov edi, ecx
cmp dword [edi + 0xc], 0
jne 0x456343
push 0x10
call fcn.00462e56
add esp, 4
mov dword [esp + 0x10], eax
mov dword [esp + 0x1c], 0
test eax, eax
je 0x456336
push 0x454440
push 0x454430
push 3
lea esi, [eax + 4]
mov dword [eax], 3
push 4
push esi
call fcn.0046a145
jmp 0x456338
xor esi, esi
mov dword [esp + 0x1c], 0xffffffff
mov dword [edi + 0xc], esi
mov eax, dword [esp + 0x28]
mov ecx, dword [esp + 0x24]
test eax, eax
je 0x456357
cmp byte [ecx + eax - 1], 0xa
jne 0x456357
dec eax
push eax
mov eax, dword [esp + 0x30]
push ecx
mov ecx, dword [edi + 0xc]
lea ecx, [ecx + eax*4]
call fcn.00454450
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x14
ret 0xc
Function at 0x45a370
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x48bd80
mov eax, dword fs:[0]
push eax
sub esp, 0x30
mov eax, dword [0x4a9750]
xor eax, esp
mov dword [esp + 0x28], eax
push esi
push edi
mov eax, dword [0x4a9750]
xor eax, esp
push eax
lea eax, [esp + 0x3c]
mov dword fs:[0], eax
mov esi, ecx
mov edx, dword [esp + 0x4c]
xorps xmm0, xmm0
mov eax, dword [esp + 0x50]
mov edi, dword [esp + 0x54]
movdqu xmmword [esp + 0x1c], xmm0
mov dword [esp + 0x28], 0
movq qword [esp + 0x2c], xmm0
movdqu xmmword [esp + 0xc], xmm0
mov dword [esp + 0x2c], 0
mov dword [esp + 0x2c], 0xf
mov dword [esp + 0x28], 0
mov byte [esp + 0x18], 0
mov dword [esp + 0x44], 1
movq xmm0, qword [eax]
mov eax, dword [eax + 8]
mov dword [esp + 0x14], eax
lea eax, [esp + 0x18]
movq qword [esp + 0xc], xmm0
cmp eax, edx
je 0x45a415
push 0xffffffffffffffff
push 0
push edx
mov ecx, eax
call fcn.00403440
lea eax, [esp + 0xc]
mov dword [esp + 0x30], edi
push eax
lea ecx, [esi + 0x14]
call fcn.0045a7e0
mov dword [esp + 0x44], 0xffffffff
lea ecx, [esp + 0xc]
call fcn.00405ab0
xor al, al
mov ecx, dword [esp + 0x3c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [esp + 0x28]
xor ecx, esp
call fcn.00466b29
add esp, 0x3c
ret 0xc
Function at 0x4623a0
Capabilities:
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
test edx, edx
jne 0x4623ab
xor eax, eax
pop ebp
ret
pop ebp
jmp fcn.004623c0
Function at 0x4797ed
Capabilities:
Link many functions at runtime
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x4a9750]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_EncodePointer]
push esi
push edi
mov dword [ebp - 0x1c], eax
xor esi, esi
mov eax, dword [ebp + 0xc]
push esi
mov dword [ebp - 0x20], eax
call ebx
mov edi, eax
mov dword [ebp - 0x18], edi
call fcn.0046cd3b
mov dword [ebp - 0x14], eax
cmp dword [0x4ac518], esi
jne 0x4798e0
push 0x800
push esi
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
jne 0x47986d
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x57
jne 0x4799c0
push esi
push esi
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
je 0x4799c0
push str.MessageBoxW
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x4799c0
push eax
call ebx
push str.GetActiveWindow
push edi
mov dword [0x4ac518], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetLastActivePopup
push edi
mov dword [0x4ac51c], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetUserObjectInformationW
push edi
mov dword [0x4ac520], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x4ac528], eax
test eax, eax
je 0x4798dd
push str.GetProcessWindowStation
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x4ac524], eax
mov edi, dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x479905
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x4798f8
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp dword [ebp - 0x14], esi
je 0x47991a
push 4
pop eax
jmp 0x4799c2
cmp dword [ebp - 0x14], esi
je 0x47991a
push dword [0x4ac518]
call dword [sym.imp.KERNEL32.dll_DecodePointer]
push 3
jmp 0x4798ff
mov eax, dword [0x4ac524]
mov ebx, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, edi
je 0x479978
cmp dword [0x4ac528], edi
je 0x479978
push eax
call ebx
push dword [0x4ac528]
mov dword [ebp - 0x14], eax
call ebx
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
test ecx, ecx
je 0x479978
test eax, eax
je 0x479978
call ecx
test eax, eax
je 0x47996d
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call dword [ebp - 0x18]
test eax, eax
je 0x47996d
test byte [ebp - 8], 1
jne 0x479978
mov edi, dword [ebp + 0x10]
or edi, 0x200000
jmp 0x4799a8
mov eax, dword [0x4ac51c]
cmp eax, edi
je 0x4799a5
push eax
call ebx
test eax, eax
je 0x4799a5
call eax
mov esi, eax
test esi, esi
je 0x4799a5
mov eax, dword [0x4ac520]
cmp eax, edi
je 0x4799a5
push eax
call ebx
test eax, eax
je 0x4799a5
push esi
call eax
mov esi, eax
mov edi, dword [ebp + 0x10]
push dword [0x4ac518]
call ebx
test eax, eax
je 0x4799c0
push edi
push dword [ebp - 0x20]
push dword [ebp - 0x1c]
push esi
call eax
jmp 0x4799c2
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00466b29
mov esp, ebp
pop ebp
ret
Function at 0x100081b0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1000fadc
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x10016010]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x14], ecx
push 0x3c
call fcn.1000e59d
mov esi, eax
add esp, 4
mov dword [ebp - 0x10], esi
mov edi, dword [ebp + 0xc]
mov ecx, esi
push 0
push 0
mov dword [ebp - 4], 0
mov ebx, dword [ebp + 0x10]
push ebx
push edi
call fcn.10007a90
mov byte [ebp - 4], 1
mov dword [esi], vtable.Buttons.0
add esi, 0x28
mov dword [ebp + 0x10], esi
push 0x18
mov dword [esi], 0
mov dword [esi + 4], 0
call fcn.1000e59d
add esp, 4
mov dword [eax], eax
mov dword [eax + 4], eax
mov dword [eax + 8], eax
mov word [eax + 0xc], 0x101
mov dword [esi], eax
mov esi, dword [ebp - 0x10]
mov dword [ebp - 4], 0xffffffff
mov dword [ebp + 0x10], esi
mov dword [esi + 8], ebx
mov ebx, dword [ebp - 0x14]
mov dword [esi + 0x30], 1
mov dword [esi + 0x34], 0
mov byte [esi + 0x38], 0
mov dword [esi + 4], edi
mov eax, dword [ebx + 0x2c]
cmp eax, dword [ebx + 0x30]
je 0x10008273
mov dword [eax], esi
add dword [ebx + 0x2c], 4
jmp 0x10008280
lea ecx, [ebp + 0x10]
push ecx
push eax
lea ecx, [ebx + 0x28]
call fcn.10007930
mov dword [esi + 0x1c], ebx
cmp dword [ebx + 0x3c], 0
jne 0x10008296
cmp byte [esi + 0x1a], 0
je 0x10008296
mov dword [ebx + 0x3c], esi
mov byte [esi + 0x1b], 1
mov esi, dword [ebx + 0x2c]
lea eax, [ebp + 8]
sub esi, dword [ebx + 0x28]
lea ecx, [ebx + 0x34]
push eax
sar esi, 2
call fcn.10003e70
lea ecx, [esi - 1]
mov dword [eax], ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x1000a2a0
Capabilities:
Encode data using xor
Encrypt data using xtea
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
mov eax, dword [0x10016010]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
mov dword [ebp - 0x28], ebx
mov eax, dword [ebx + 8]
mov ecx, dword [ebx + 0xc]
cmp eax, 1
jne 0x1000a2cc
mov ax, word [ebx]
mov word [ecx + 2], ax
jmp 0x1000a2ea
cmp eax, 2
jne 0x1000a2e4
mov dword [ecx + 2], 0xc1e7cae
mov ecx, dword [ebx + 0xc]
mov ax, word [ebx]
mov word [ecx + 6], ax
jmp 0x1000a2ea
mov ax, word [ebx]
mov word [ecx], ax
mov eax, dword [0x7998bc]
xor edx, edx
cmp dword [ebx + 8], 2
mov esi, dword [ebx]
sete dl
mov dword [ebp - 0x14], eax
mov eax, dword [0x7998c0]
mov dword [ebp - 0x10], eax
mov eax, dword [0x7998c4]
lea edx, [edx*4 + 2]
mov dword [ebp - 0xc], eax
mov eax, dword [0x7998c8]
add esi, edx
mov ecx, esi
mov dword [ebp - 8], eax
mov dword [ebp - 0x2c], edx
mov dword [ebp - 0x1c], esi
and ecx, 0x80000007
jns 0x1000a335
dec ecx
or ecx, 0xfffffff8
add ecx, 1
je 0x1000a343
mov eax, 8
sub eax, ecx
add esi, eax
mov dword [ebp - 0x1c], esi
mov ecx, dword [ebx + 0xc]
mov eax, esi
add ecx, edx
cdq
and edx, 3
mov dword [ebp - 0x20], ecx
add eax, edx
sar eax, 2
mov dword [ebp - 0x24], eax
test eax, eax
jle 0x1000a3d1
xor ebx, ebx
push edi
mov esi, dword [ecx + ebx*4]
xor eax, eax
mov edi, dword [ecx + ebx*4 + 4]
mov dword [ebp - 0x18], 0x20
mov edx, edi
mov ecx, edi
shl ecx, 4
shr edx, 5
xor edx, ecx
mov ecx, eax
and ecx, 3
add edx, edi
mov ecx, dword [ebp + ecx*4 - 0x14]
add ecx, eax
sub eax, 0x61c88647
xor edx, ecx
add esi, edx
mov edx, esi
mov ecx, esi
shl ecx, 4
shr edx, 5
xor edx, ecx
mov ecx, eax
shr ecx, 0xb
add edx, esi
and ecx, 3
mov ecx, dword [ebp + ecx*4 - 0x14]
add ecx, eax
xor edx, ecx
add edi, edx
sub dword [ebp - 0x18], 1
jne 0x1000a370
mov ecx, dword [ebp - 0x20]
mov dword [ecx + ebx*4], esi
mov dword [ecx + ebx*4 + 4], edi
add ebx, 2
cmp ebx, dword [ebp - 0x24]
jl 0x1000a360
mov ebx, dword [ebp - 0x28]
mov esi, dword [ebp - 0x1c]
pop edi
mov eax, dword [ebx + 0xc]
mov ecx, dword [ebp - 0x2c]
add ecx, 0xfffffffe
add ecx, esi
mov word [eax], cx
mov ecx, dword [ebx + 0xc]
mov dword [ebx], esi
push 0
movzx eax, word [ecx]
add eax, 2
push eax
push ecx
push dword [0x10016060]
call dword [sym.imp.WS2_32.dll_send]
push dword [ebx + 0xc]
call fcn.1000eb06
push 0x10
push ebx
call fcn.1000e5cd
mov ecx, dword [ebp - 4]
add esp, 0xc
xor ecx, ebp
pop esi
pop ebx
call fcn.1000e58f
mov esp, ebp
pop ebp
ret 4
Function at 0x1000a590
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call
Get common file path

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x16c
mov eax, dword [0x10016010]
xor eax, esp
mov dword [esp + 0x168], eax
cmp dword [ebp + 0xc], 1
push ebx
push esi
push edi
jne 0x1000a78e
push 0x104
lea eax, [esp + 0x6c]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
movaps xmm0, xmmword [0x10013210]
lea ecx, [esp + 0x38]
movups xmmword [esp + 0x38], xmm0
lea eax, [esp + 0x68]
sub esp, 0xc
movaps xmm0, xmmword [0x10013290]
sub eax, ecx
movups xmmword [esp + 0x54], xmm0
mov edi, esp
mov ebx, eax
movaps xmm0, xmmword [0x10013270]
movups xmmword [esp + 0x64], xmm0
sar ebx, 2
mov dword [edi], 0
mov dword [edi + 4], 0
mov dword [edi + 8], 0
mov dword [esp + 0x1c], eax
test ebx, ebx
je 0x1000a63d
push ebx
mov ecx, edi
call fcn.10003de0
push dword [esp + 0x1c]
mov esi, dword [edi]
lea eax, [esp + 0x48]
push eax
push esi
call sub.VCRUNTIME140.dll_memmove
lea eax, [esi + ebx*4]
add esp, 0xc
mov dword [edi + 4], eax
lea ecx, [esp + 0x2c]
call fcn.1000b790
add esp, 0xc
cmp dword [eax + 0x14], 0x10
jb 0x1000a651
mov eax, dword [eax]
push eax
lea eax, [esp + 0x6c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatA]
mov ecx, dword [esp + 0x34]
cmp ecx, 0x10
jb 0x1000a695
mov edx, dword [esp + 0x20]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x1000a68b
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x1000a68b
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push ecx
push edx
call fcn.1000e5cd
add esp, 8
lea eax, [esp + 0x68]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov ebx, dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov dword [0x100167b4], eax
lea eax, [esp + 0x10]
push eax
push 4
push 4
push 0x5b8574
call ebx
lea eax, [esp + 0x18]
mov dword [0x5b8574], 0x10009730
push eax
push dword [esp + 0x14]
push 4
push 0x5b8574
call ebx
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtectEx]
mov edi, eax
lea eax, [esp + 0x14]
push eax
push 4
push 5
push 0x4c6e87
push edi
call esi
lea eax, [esp + 0x1c]
mov byte [0x4c6e87], 0xe8
push eax
mov dword [0x4c6e88], 0xffff2854
push dword [esp + 0x18]
push 5
push 0x4c6e87
push edi
call esi
lea eax, [esp + 0x14]
mov esi, 0x1000a200
push eax
push 0x80
push 4
push 0x45a34b
sub esi, 0x45a34f
call ebx
mov eax, dword [0x45a34b]
add eax, 0x45a34f
mov dword [0x100167c4], eax
lea eax, [esp + 0x1c]
push eax
push dword [esp + 0x18]
mov dword [0x45a34b], esi
push 5
push 0x45a34b
call ebx
lea eax, [esp + 0x10]
push eax
push 0x40
push 0x238000
push 0x401000
call ebx
lea eax, [esp + 0x18]
mov byte [0x50bca4], 0xeb
push eax
push dword [esp + 0x14]
push 0x238000
push 0x401000
call ebx
mov ecx, dword [esp + 0x174]
mov eax, 1
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.1000e58f
mov esp, ebp
pop ebp
ret 0xc
Function at 0x1000dae0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x1c
push ebx
mov ebx, ecx
push esi
push edi
cmp dword [ebx + 0x38], 0
je 0x1000db0c
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____thiscall_std::basic_streambuf_char__struct_std::char_traits_char__::xsputn_char_const___long_long___int64__]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov eax, dword [ebx + 0x20]
mov esi, dword [ebp + 0xc]
mov edi, dword [ebp + 0x10]
mov dword [esp + 0x20], esi
mov ecx, dword [eax]
lea eax, [ebx + 0x30]
mov dword [esp + 0x24], edi
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x18], eax
test ecx, ecx
je 0x1000db34
mov eax, dword [eax]
mov ecx, dword [eax]
jmp 0x1000db3a
xor ecx, ecx
mov dword [esp + 0x18], eax
mov eax, ecx
cdq
mov dword [esp + 0x10], eax
mov ecx, edx
mov dword [esp + 0x14], ecx
test edi, edi
jl 0x1000dba2
jg 0x1000db51
test esi, esi
je 0x1000dba2
test ecx, ecx
jl 0x1000db9d
jg 0x1000db5b
test eax, eax
je 0x1000db9d
cmp edi, ecx
jg 0x1000db6f
jl 0x1000db65
cmp esi, eax
jae 0x1000db6f
mov eax, esi
mov dword [esp + 0x10], esi
mov dword [esp + 0x14], edi
push eax
push dword [ebp + 8]
push dword [esp + 0x24]
call sub.VCRUNTIME140.dll_memcpy
mov eax, dword [esp + 0x24]
add esp, 0xc
mov edx, dword [esp + 0x10]
mov ecx, dword [ebp + 8]
add ecx, edx
sub esi, edx
mov eax, dword [eax]
sbb edi, dword [esp + 0x14]
sub dword [eax], edx
mov eax, dword [ebx + 0x20]
add dword [eax], edx
jmp 0x1000dba5
mov ecx, dword [ebp + 8]
jmp 0x1000dbaf
mov ecx, dword [ebp + 8]
test edi, edi
jl 0x1000dbc9
jg 0x1000dbaf
test esi, esi
je 0x1000dbc9
mov eax, dword [ebx + 0x4c]
test eax, eax
je 0x1000dbc9
push eax
push esi
push 1
push ecx
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
add esp, 0x10
sub esi, eax
sbb edi, 0
mov eax, dword [esp + 0x20]
mov edx, dword [esp + 0x24]
sub eax, esi
sbb edx, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x1000dbe0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0x10]
sub esp, 8
push ebx
mov ebx, ecx
mov ecx, dword [ebp + 0xc]
test eax, eax
jg 0x1000dc04
jl 0x1000dbf9
test ecx, ecx
jne 0x1000dc04
xor eax, eax
xor edx, edx
pop ebx
mov esp, ebp
pop ebp
ret 0xc
cmp dword [ebx + 0x38], 0
je 0x1000dc1e
push eax
push ecx
push dword [ebp + 8]
mov ecx, ebx
call dword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____thiscall_std::basic_streambuf_char__struct_std::char_traits_char__::xsgetn_char___long_long___int64__]
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov eax, dword [ebx + 0x1c]
push esi
push edi
mov edi, ecx
mov eax, dword [eax]
mov dword [ebp - 8], eax
test eax, eax
je 0x1000dc6a
mov eax, dword [ebx + 0x2c]
lea edx, [ebx + 0x2c]
mov dword [ebp - 4], edx
mov eax, dword [eax]
test eax, eax
je 0x1000dc70
mov edi, dword [ebp + 8]
cmp eax, ecx
mov esi, ecx
cmovb esi, eax
push esi
push dword [ebp - 8]
push edi
call sub.VCRUNTIME140.dll_memcpy
mov eax, dword [ebx + 0x2c]
add edi, esi
mov dword [ebp + 8], edi
add esp, 0xc
mov edi, dword [ebp + 0xc]
sub edi, esi
sub dword [eax], esi
mov eax, dword [ebx + 0x1c]
add dword [eax], esi
jmp 0x1000dc70
lea eax, [ebx + 0x2c]
mov dword [ebp - 4], eax
cmp dword [ebx + 0x4c], 0
mov esi, dword [ebp + 8]
je 0x1000dce6
mov ecx, dword [ebx + 0xc]
lea eax, [ebx + 0x3c]
cmp dword [ecx], eax
jne 0x1000dc9c
mov eax, dword [ebx + 0xc]
mov edx, dword [ebx + 0x54]
mov ecx, dword [ebx + 0x50]
sub edx, ecx
mov dword [eax], ecx
mov eax, dword [ebx + 0x1c]
mov dword [eax], ecx
mov eax, dword [ebp - 4]
mov eax, dword [eax]
mov dword [eax], edx
mov eax, dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
cmp edi, 0xfff
jbe 0x1000dcd4
nop dword [eax]
push dword [ebx + 0x4c]
push 0xfff
push 1
push esi
call eax
add esp, 0x10
add esi, eax
sub edi, eax
cmp eax, 0xfff
jne 0x1000dce6
cmp edi, eax
mov eax, dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
ja 0x1000dcb0
test edi, edi
je 0x1000dce6
push dword [ebx + 0x4c]
push edi
push 1
push esi
call eax
add esp, 0x10
sub edi, eax
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 0x10]
sub eax, edi
pop edi
pop esi
sbb edx, 0
pop ebx
mov esp, ebp
pop ebp
ret 0xc