joyce8/EMBER2024-capa huggingface dataset:
Function at 0x92bbb0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x9553d8
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x99986c]
xor eax, esp
push eax
lea eax, [esp + 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 8], esi
mov eax, dword [esp + 0x1c]
push eax
call fcn.0090cf60
xor eax, eax
mov dword [esp + 0x14], eax
mov ecx, dword [esp + 0x20]
mov dword [esi], vtable.PEFileAccessorMSIAppended.0
mov dword [esi + 0x2c], eax
mov dword [esi + 0x30], eax
mov dword [esi + 0x34], eax
mov dword [esi + 0x38], eax
mov dword [esi + 0x28], ecx
mov dword [esi + 0x40], eax
mov dword [esi + 0x44], eax
mov dword [esp + 0x14], 0xffffffff
mov eax, esi
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x10
ret 8

Function at 0x92f730
Capabilities:
Reference sql statements

Disassembly:
push 0xffffffffffffffff
push 0x95556e
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push esi
push edi
mov eax, dword [0x99986c]
xor eax, esp
push eax
lea eax, [esp + 0x18]
mov dword fs:[0], eax
mov edi, ecx
test byte [0x99e374], 1
jne 0x92f78e
or dword [0x99e374], 1
mov dword [esp + 0x20], 0
mov ecx, 0x99e2d0
call fcn.0090a020
push 0x9582a0
call fcn.0091bfe3
add esp, 4
mov dword [esp + 0x20], 0xffffffff
cmp dword [0x99e2d4], 0
jne 0x92f87a
mov ecx, dword [edi + 0x390]
mov edx, dword [edi + 0x3a4]
lea eax, [esp + 0xc]
push eax
push str.SELECT__Value__FROM__Property__WHERE__Property___ProductVersion
push ecx
mov dword [esp + 0x18], 0
mov dword [esp + 0x1c], 0
call edx
mov esi, eax
test esi, esi
jne 0x92f821
mov ecx, dword [edi + 0x3a8]
push eax
mov eax, dword [esp + 0x10]
push eax
call ecx
mov esi, eax
test esi, esi
jne 0x92f821
mov eax, dword [esp + 0xc]
mov ecx, dword [edi + 0x3ac]
lea edx, [esp + 0x10]
push edx
push eax
call ecx
mov esi, eax
test esi, esi
jne 0x92f821
mov edx, dword [0x99e2d8]
mov ecx, dword [0x99e2d0]
lea eax, [esp + 0x14]
push eax
mov eax, dword [edi + 0x3c0]
push ecx
mov dword [esp + 0x1c], edx
mov edx, dword [esp + 0x18]
push 1
push edx
call eax
mov esi, eax
test esi, esi
je 0x92f85e
mov eax, dword [esp + 0x10]
test eax, eax
je 0x92f832
mov ecx, dword [edi + 0x3c8]
push eax
call ecx
mov eax, dword [esp + 0xc]
test eax, eax
je 0x92f843
mov edx, dword [edi + 0x3c8]
push eax
call edx
push esi
call dword [0x9822c8]
xor eax, eax
mov ecx, dword [esp + 0x18]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x18
ret
mov eax, dword [esp + 0x14]
push eax
mov ecx, 0x99e2d0
call fcn.00909e10
mov ecx, dword [esp + 0xc]
mov edx, dword [edi + 0x3c8]
push ecx
call edx
mov eax, dword [0x99e2d0]
mov ecx, dword [esp + 0x18]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x18
ret
Function at 0x937c30
Capabilities:
Check for peb beingdebugged flag

Disassembly:
push 0xffffffffffffffff
push 0x9560a8
mov eax, dword fs:[0]
push eax
sub esp, 0x18
push ebp
push esi
push edi
mov eax, dword [0x99986c]
xor eax, esp
push eax
lea eax, [esp + 0x28]
mov dword fs:[0], eax
lea ecx, [esp + 0x10]
call fcn.0092a550
xor ebp, ebp
mov dword [esp + 0x30], ebp
mov edi, dword [esp + 0x38]
mov eax, edi
lea edx, [eax + 2]
mov edi, edi
mov cx, word [eax]
add eax, 2
cmp cx, bp
jne 0x937c70
sub eax, edx
sar eax, 1
xor ecx, ecx
inc eax
mov edx, 2
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.0084dd30
mov ecx, edi
add esp, 4
mov dword [esp + 0x10], eax
lea esi, [ecx + 2]
mov dx, word [ecx]
add ecx, 2
cmp dx, bp
jne 0x937ca2
sub ecx, esi
sar ecx, 1
push edi
inc ecx
push ecx
push eax
call fcn.0091cabe
mov esi, dword [esp + 0x48]
add esp, 0xc
cmp esi, ebp
jne 0x937ccb
mov dword [esp + 0x14], ebp
jmp 0x937d1d
mov eax, esi
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
cmp cx, bp
jne 0x937cd0
sub eax, edx
sar eax, 1
xor ecx, ecx
inc eax
mov edx, 2
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.0084dd30
mov ecx, esi
add esp, 4
mov dword [esp + 0x14], eax
lea edi, [ecx + 2]
mov dx, word [ecx]
add ecx, 2
cmp dx, bp
jne 0x937d02
sub ecx, edi
sar ecx, 1
push esi
inc ecx
push ecx
push eax
call fcn.0091cabe
add esp, 0xc
mov edi, dword [esp + 0x40]
cmp edi, ebp
jne 0x937d2f
mov dword [esp + 0x1c], ebp
mov dword [esp + 0x18], ebp
jmp 0x937d4c
mov esi, dword [esp + 0x44]
push esi
mov dword [esp + 0x20], esi
call fcn.0084dd30
push esi
push edi
push eax
mov dword [esp + 0x28], eax
call fcn.0091b5e0
add esp, 0x10
mov esi, dword [esp + 0x48]
cmp esi, ebp
jne 0x937d5a
mov dword [esp + 0x20], ebp
jmp 0x937dad
mov eax, esi
lea edx, [eax + 2]
nop
mov cx, word [eax]
add eax, 2
cmp cx, bp
jne 0x937d60
sub eax, edx
sar eax, 1
xor ecx, ecx
inc eax
mov edx, 2
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.0084dd30
mov ecx, esi
add esp, 4
mov dword [esp + 0x20], eax
lea edi, [ecx + 2]
mov dx, word [ecx]
add ecx, 2
cmp dx, bp
jne 0x937d92
sub ecx, edi
sar ecx, 1
push esi
inc ecx
push ecx
push eax
call fcn.0091cabe
add esp, 0xc
mov eax, dword [esp + 0x4c]
lea ecx, [esp + 0x10]
push ecx
mov ecx, 0x99e1f4
mov dword [esp + 0x28], eax
call fcn.00937a90
mov dword [esp + 0x30], 0xffffffff
lea ecx, [esp + 0x10]
call fcn.0092a6e0
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
add esp, 0x24
ret
Function at 0x6c6dfc
Capabilities:
Execute anti-debugging instructions

Disassembly:
jmp 0x6c6e3b
dec edx
pop si
lea edi, [ebx + esi]
xchg byte [esp + 0x1a], cl
pop word [esp + 5]
setl dh
jmp 0x6c6e25

Function at 0x6c7b4e
Capabilities:
Execute anti-debugging instructions

Disassembly:
bswap ebp
sub esp, 3
xchg dword [esp + 0x19], eax
lea ebp, [edi*4]
jmp 0x6c7b50
jmp 0x6c7b38
sub esp, 8
lea esp, [esp + 0x19]
xchg dword [esp + 3], ecx
mov eax, dword [esp + 2]
bswap eax
jmp 0x6c7b81
push word [esp + 0x14]
not ebp
mov dword [esp + 3], edx
mov dx, word [esp + 0x11]
xchg esi, edx
jmp 0x6c7d3e
bswap esi
xchg ecx, ebp
xchg esi, edi
mov edx, 0x79993f05
jmp 0x6c7bd8
sub esp, 0x19
lea esp, [esp + 0x50]
neg bx
stc
bsr dx, bx
cld
jmp 0x6c7bb0
mov edi, 0xd32e1ef0
xchg ebx, ebp
mov ebx, dword [esp]
lea ecx, [edx*4]
clc
push ebx
jmp 0x6c7c2a
pop dword [esp + 0x1e]
mov word [esp + 0x12], ax
mov byte [esp + 0x30], al
mov di, word [esp + 0x2c]
neg cx
xchg byte [esp + 8], ah
jmp 0x6c7bc6
cmc
rdtsc
sub esp, 0xe
bt esi, esp
bswap edx
rcl bl, 6
jmp 0x6c7cf2
xchg dword [esp], ebx
pop edx
bts cx, cx
std
cld
bts dx, cx
jmp 0x6c7c14
sub esp, 0x1e
sub esp, 0x16
lea esp, [esp + 0x34]
popfd
jmp 0x6c7cb5
bsr dx, si
mov byte [esp + 6], dl
dec ecx
lea esp, [esp + 1]
lea esp, [esp + 8]
popal
jmp 0x6c7c3a
mov edx, 0x551f4ea3
pushfd
mov dx, si
bts di, dx
rdtsc
xchg bp, dx
jmp 0x6c7c50
push 0x1d635284
add dword [esp], reloc.MSVCRT.dll_strncpy
pushal
jmp 0x6c7cd1
lea esp, [esp + 0x15]
call fcn.006c7d1b
mov dword [esp + 9], esp
lea esp, [esp + 0xb]
bswap edi
push ax
rdtsc
not cx
jmp 0x6c7ca1
setl al
push word [esp + 3]
mov cl, 0x27
pushal
push word [esp + 0x14]
mov cl, 0xe7
jmp 0x6c7bf9

Function at 0x6c7d76
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov word [esp + 8], cx
mov dword [esp + 7], edx
mov word [esp + 0xa], di
jmp 0x6c7d05
or ecx, dword [edi]
iretd
mov dword [esp + 3], esi
mov byte [esp + 6], bl
pop dword [esp + 6]
jmp 0x6c7d55
push word [esp + 6]
lea esp, [esp + 0xa]
mov byte [esp + 1], ah
call fcn.006c7d92
push ds
mov ebx, dword [ebx]
jle 0x6c7cf9
and dh, byte [esp + ebp - 0x7ccb3a5e]
mov ecx, 0x20e9fb98
invalid
and dh, bh
Function at 0x40dad0
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0xb000]
push edi
or ebp, 0xffffffff
jmp 0x40daf2
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x40daf9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x40dae8
mov eax, 1
add ebx, ebx
jne 0x40db0b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x40db00
jne 0x40db1c
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x40db00
xor ecx, ecx
sub eax, 3
jb 0x40db30
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x40dba2
mov ebp, eax
add ebx, ebx
jne 0x40db3b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x40db48
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x40db6c
inc ecx
add ebx, ebx
jne 0x40db58
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x40db4d
jne 0x40db69
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x40db4d
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x40db8c
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x40db7d
jmp 0x40daee
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x40db8c
add edi, ecx
jmp 0x40daee
pop esi
mov edi, esi
mov ecx, 0x6f
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x40dbaa
cmp byte [edi], 1
jne 0x40dbaa
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x40dbaf
lea edi, [esi + 0xb000]
mov eax, dword [edi]
or eax, eax
je 0x40dc27
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x1131c]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x113a8]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x40dbdc
mov ecx, edi
jns 0x40dc0b
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x113ac]
or eax, eax
je 0x40dc21
mov dword [ebx], eax
add ebx, 4
jmp 0x40dbf9
call dword [esi + 0x113b4]
mov ebp, dword [esi + 0x113b0]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x207]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x40dc5b
sub esp, 0xffffff80
jmp 0x4023eb
Function at 0x402a64
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
push ebx
push esi
push edi
mov esi, 0x37
mov ebx, 0x42705c
cmp dword [ebx], 0
jne 0x402a04
mov dword [ebx], fcn.00401474
lea eax, [ebx - 0x1c]
mov dword [ebx - 8], eax
lea eax, [ebx - 0x1c]
mov dword [ebx - 0x18], eax
xor eax, eax
mov dword [ebx - 0x10], eax
mov dword [ebx - 0x14], 1
movzx eax, word [ebx - 0x1a]
add eax, eax
add eax, eax
lea eax, [eax + eax*2]
add eax, 0xef
and eax, 0xffffff00
add eax, 0x30
cmp eax, 0xb30
jae 0x402a40
mov eax, 0xb30
add eax, 0x4d0
shr eax, 0xd
cmp eax, 7
jbe 0x402a52
mov eax, 7
mov ecx, eax
mov dl, 0xff
shl dl, cl
mov byte [ebx - 0x1b], dl
shl eax, 0xd
add ax, 0xb30
mov word [ebx - 4], ax
movzx edi, word [ebx - 0x1a]
movzx eax, di
mov ecx, eax
shl ecx, 4
lea ecx, [ecx + ecx*2]
add ecx, 0xef
and ecx, 0xffffff00
add ecx, 0x30
cmp ecx, 0x7330
jae 0x402a91
mov ecx, 0x7330
cmp ecx, 0xff30
jbe 0x402a9e
mov ecx, 0xff30
mov eax, ecx
sub eax, 0x20
movzx edx, di
mov ecx, edx
xor edx, edx
div ecx
imul di
add ax, 0xef
and ax, 0xff00
add ax, 0x30
mov word [ebx - 2], ax
add ebx, 0x20
dec esi
jne 0x4029f9
call fcn.004029a8
mov dword [0x428708], 0x428708
mov dword [0x42870c], 0x428708
mov esi, 0x400
mov edx, 0x4287a8
mov eax, edx
mov dword [eax], eax
mov dword [eax + 4], eax
add edx, 8
dec esi
jne 0x402aec
mov dword [0x42a7ac], 0x42a7ac
mov dword [0x42a7b0], 0x42a7ac
pop edi
pop esi
pop ebx
ret

Function at 0x407ab4
Capabilities:
Check if file exists
Get file attributes

Disassembly:
test eax, eax
jne 0x407a52
test edx, edx
je 0x407a51
mov eax, dword [edx - 4]
neg eax
ret
test edx, edx
jne 0x407a5a
mov eax, dword [eax - 4]
ret
push ebx
push ebp
push esi
mov ebp, dword [eax - 4]
mov ebx, dword [edx - 4]
sub ebp, ebx
sbb ecx, ecx
and ecx, ebp
add ecx, ebx
lea esi, [ecx + eax]
add edx, ecx
neg ecx
je 0x407ad7
movzx eax, word [ecx + esi]
movzx ebx, word [ecx + edx]
cmp eax, ebx
je 0x407ad2
cmp al, bl
je 0x407ab0
mov ah, 0
mov bh, 0
cmp al, 0x61
jl 0x407a93
cmp al, 0x7a
jg 0x407a93
sub eax, 0x20
cmp bl, 0x61
jl 0x407aa0
cmp bl, 0x7a
jg 0x407aa0
sub ebx, 0x20
sub eax, ebx
jne 0x407ad9
movzx eax, word [ecx + esi]
movzx ebx, word [ecx + edx]
cmp ah, bh
je 0x407ad2
shr eax, 8
shr ebx, 8
cmp al, 0x61
jl 0x407ac1
cmp al, 0x7a
jg 0x407ac1
sub eax, 0x20
cmp bl, 0x61
jl 0x407ace
cmp bl, 0x7a
jg 0x407ace
sub ebx, 0x20
sub eax, ebx
jne 0x407ad9
add ecx, 2
jl 0x407a74
mov eax, ebp
pop esi
pop ebp
pop ebx
ret
Function at 0x407ad8
Capabilities:
Check if file exists
Get file attributes

Disassembly:
test eax, eax
jne 0x407a52
test edx, edx
je 0x407a51
mov eax, dword [edx - 4]
neg eax
ret
test edx, edx
jne 0x407a5a
mov eax, dword [eax - 4]
ret
push ebx
push ebp
push esi
mov ebp, dword [eax - 4]
mov ebx, dword [edx - 4]
sub ebp, ebx
sbb ecx, ecx
and ecx, ebp
add ecx, ebx
lea esi, [ecx + eax]
add edx, ecx
neg ecx
je 0x407ad7
movzx eax, word [ecx + esi]
movzx ebx, word [ecx + edx]
cmp eax, ebx
je 0x407ad2
cmp al, bl
je 0x407ab0
mov ah, 0
mov bh, 0
cmp al, 0x61
jl 0x407a93
cmp al, 0x7a
jg 0x407a93
sub eax, 0x20
cmp bl, 0x61
jl 0x407aa0
cmp bl, 0x7a
jg 0x407aa0
sub ebx, 0x20
sub eax, ebx
jne 0x407ad9
movzx eax, word [ecx + esi]
movzx ebx, word [ecx + edx]
cmp ah, bh
je 0x407ad2
shr eax, 8
shr ebx, 8
cmp al, 0x61
jl 0x407ac1
cmp al, 0x7a
jg 0x407ac1
sub eax, 0x20
cmp bl, 0x61
jl 0x407ace
cmp bl, 0x7a
jg 0x407ace
sub ebx, 0x20
sub eax, ebx
jne 0x407ad9
add ecx, 2
jl 0x407a74
mov eax, ebp
pop esi
pop ebp
pop ebx
ret

Function at 0x407c2c
Capabilities:
Get disk size

Disassembly:
or cl, cl
jne fcn.00407c3c
mov ecx, 0xa
test dword [eax + 4], 0x80000000
je fcn.00407c3c
push dword [eax + 4]
push dword [eax]
mov eax, esp
neg dword [esp]
adc dword [esp + 4], 0
neg dword [esp + 4]
call fcn.00407c3c
mov byte [esi - 1], 0x2d
dec esi
inc ecx
add esp, 8
ret
Function at 0x401290
Capabilities:
Execute command

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
and esp, 0xfffffff0
mov eax, 0
add eax, 0xf
add eax, 0xf
shr eax, 4
shl eax, 4
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
call fcn.00401760
call sym.___main
lea eax, [ebp - 8]
mov dword [esp + 8], eax
lea eax, [ebp - 4]
mov dword [esp + 4], eax
mov dword [esp], str._d__d
call sym._scanf
mov eax, dword [ebp - 4]
cmp eax, dword [ebp - 8]
jle 0x4012f1
mov eax, dword [ebp - 8]
mov dword [esp + 4], eax
mov dword [esp], 0x403006
call sym._printf
jmp 0x401304
mov eax, dword [ebp - 4]
mov dword [esp + 4], eax
mov dword [esp], 0x403006
call sym._printf
mov dword [esp], str.pause
call sub.msvcrt.dll_system
mov eax, 0
leave
ret

Function at 0x401920
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
pop ebp
jmp sym.___do_sjlj_init
Function at 0x402d00
Capabilities:
Write file on windows

Disassembly:
push 0x2c
mov eax, 0x434516
call fcn.0041d834
mov ebx, dword [ebp + 8]
mov esi, ecx
cmp ebx, 0xffffffff
jne 0x402d20
xor eax, eax
call fcn.0041d8b7
ret 4
mov eax, dword [esi + 0x24]
mov ecx, dword [eax]
xor edi, edi
cmp ecx, edi
je 0x402d48
mov eax, dword [esi + 0x34]
mov edx, dword [eax]
add edx, ecx
cmp ecx, edx
jae 0x402d48
dec dword [eax]
mov esi, dword [esi + 0x24]
mov eax, dword [esi]
lea ecx, [eax + 1]
mov dword [esi], ecx
mov byte [eax], bl
mov eax, ebx
jmp 0x402d18
cmp dword [esi + 0x54], edi
jne 0x402d52
or eax, 0xffffffff
jmp 0x402d18
mov eax, esi
call fcn.00403b7c
cmp dword [esi + 0x44], edi
jne 0x402d74
push dword [esi + 0x54]
movsx eax, bl
push eax
call dword [sym.imp.MSVCR100.dll_fputc]
pop ecx
pop ecx
cmp eax, 0xffffffff
je 0x402d4d
jmp 0x402d44
push edi
push 8
lea ecx, [ebp - 0x2c]
mov byte [ebp - 0x2d], bl
mov dword [ebp - 0x18], 0xf
mov dword [ebp - 0x1c], edi
mov byte [ebp - 0x2c], 0
call fcn.00417882
mov dword [ebp - 4], edi
cmp dword [ebp - 0x18], 0x10
mov eax, dword [ebp - 0x2c]
jae 0x402e31
lea eax, [ebp - 0x2c]
mov ecx, eax
add eax, dword [ebp - 0x1c]
lea edx, [ebp - 0x34]
push edx
push eax
push ecx
mov ecx, dword [esi + 0x44]
lea eax, [ebp - 0x38]
push eax
lea eax, [ebp - 0x2c]
push eax
lea eax, [ebp - 0x2d]
push eax
lea eax, [esi + 0x4c]
push eax
call dword [sym.imp.MSVCP100.dll_public:_int___thiscall_std::codecvt_char__char__int_::out_int___char_const___char_const___char_const____char___char___char___const]
test eax, eax
js 0x402e59
cmp eax, 1
jg 0x402e39
cmp dword [ebp - 0x18], 0x10
mov eax, dword [ebp - 0x2c]
jae 0x402de0
lea eax, [ebp - 0x2c]
mov edi, dword [ebp - 0x34]
sub edi, eax
je 0x402e07
cmp dword [ebp - 0x18], 0x10
mov eax, dword [ebp - 0x2c]
jae 0x402df3
lea eax, [ebp - 0x2c]
push dword [esi + 0x54]
push edi
push 1
push eax
call dword [sym.imp.MSVCR100.dll_fwrite]
add esp, 0x10
cmp edi, eax
jne 0x402e59
lea eax, [ebp - 0x2d]
mov byte [esi + 0x49], 1
cmp dword [ebp - 0x38], eax
jne 0x402e55
test edi, edi
jne 0x402d93
cmp dword [ebp - 0x1c], 0x20
jae 0x402e59
push edi
push 8
lea ecx, [ebp - 0x2c]
call fcn.00417882
jmp 0x402d93
mov ecx, dword [ebp - 0x2c]
jmp 0x402da5
cmp eax, 3
jne 0x402e59
movsx eax, byte [ebp - 0x2d]
push dword [esi + 0x54]
push eax
call dword [sym.imp.MSVCR100.dll_fputc]
or esi, 0xffffffff
pop ecx
pop ecx
cmp eax, esi
je 0x402e5c
mov esi, ebx
jmp 0x402e5c
or esi, 0xffffffff
push 0
push 1
lea ecx, [ebp - 0x2c]
call fcn.00417882
mov eax, esi
jmp 0x402d18
Function at 0x403a82
Capabilities:
Write file on windows

Disassembly:
push 0x24
mov eax, 0x434700
call fcn.0041d834
xor edi, edi
cmp dword [esi + 0x44], edi
je 0x403b74
cmp byte [esi + 0x49], 0
je 0x403b74
mov eax, dword [esi]
push 0xffffffffffffffff
mov ecx, esi
call dword [eax + 0xc]
cmp eax, 0xffffffff
jne 0x403ab8
xor al, al
jmp 0x403b76
push edi
push 8
lea ecx, [ebp - 0x2c]
mov dword [ebp - 0x18], 0xf
mov dword [ebp - 0x1c], edi
mov byte [ebp - 0x2c], 0
call fcn.00417882
mov dword [ebp - 4], edi
lea ebx, [esi + 0x4c]
cmp dword [ebp - 0x18], 0x10
mov eax, dword [ebp - 0x2c]
jae 0x403b16
lea eax, [ebp - 0x2c]
mov ecx, eax
add eax, dword [ebp - 0x1c]
lea edx, [ebp - 0x30]
push edx
push eax
push ecx
mov ecx, dword [esi + 0x44]
push ebx
call dword [sym.imp.MSVCP100.dll_public:_int___thiscall_std::codecvt_char__char__int_::unshift_int___char___char___char___const]
sub eax, 0
je 0x403b1b
dec eax
je 0x403b1f
dec eax
dec eax
je 0x403b70
xor bl, bl
push 0
push 1
lea ecx, [ebp - 0x2c]
call fcn.00417882
mov al, bl
jmp 0x403b76
mov ecx, dword [ebp - 0x2c]
jmp 0x403ae5
mov byte [esi + 0x49], 0
cmp dword [ebp - 0x18], 0x10
mov eax, dword [ebp - 0x2c]
jae 0x403b2b
lea eax, [ebp - 0x2c]
mov edi, dword [ebp - 0x30]
sub edi, eax
je 0x403b52
cmp dword [ebp - 0x18], 0x10
mov eax, dword [ebp - 0x2c]
jae 0x403b3e
lea eax, [ebp - 0x2c]
push dword [esi + 0x54]
push edi
push 1
push eax
call dword [sym.imp.MSVCR100.dll_fwrite]
add esp, 0x10
cmp edi, eax
jne 0x403b04
cmp byte [esi + 0x49], 0
je 0x403b70
test edi, edi
jne 0x403ad7
push edi
push 8
lea ecx, [ebp - 0x2c]
call fcn.00417882
jmp 0x403ad7
mov bl, 1
jmp 0x403b06
mov al, 1
call fcn.0041d8b7
ret
Function at 0x408295
Capabilities:
Write file on windows

Disassembly:
push 0x2c
mov eax, 0x434516
call fcn.0041d834
mov ebx, 0xffff
mov esi, ecx
cmp bx, word [ebp + 8]
jne 0x4082b5
xor eax, eax
jmp 0x408439
mov eax, dword [esi + 0x24]
mov ecx, dword [eax]
xor edi, edi
cmp ecx, edi
je 0x4082e6
mov eax, dword [esi + 0x34]
mov edx, dword [eax]
lea edx, [ecx + edx*2]
cmp ecx, edx
jae 0x4082e6
dec dword [eax]
mov esi, dword [esi + 0x24]
mov eax, dword [esi]
lea ecx, [eax + 2]
mov dword [esi], ecx
mov ecx, dword [ebp + 8]
mov word [eax], cx
mov ax, cx
jmp 0x408439
cmp dword [esi + 0x54], edi
je 0x408437
mov eax, esi
call fcn.00408f51
cmp dword [esi + 0x44], edi
jne 0x40831b
push dword [esi + 0x54]
push dword [ebp + 8]
call dword [sym.imp.MSVCR100.dll_fputwc]
pop ecx
cmp ax, bx
movzx eax, word [ebp + 8]
pop ecx
jne 0x408439
jmp 0x408437
movzx eax, word [ebp + 8]
push edi
push 8
lea ecx, [ebp - 0x2c]
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x18], 0xf
mov dword [ebp - 0x1c], edi
mov byte [ebp - 0x2c], 0
call fcn.00417882
mov dword [ebp - 4], edi
jmp 0x408342
xor edi, edi
cmp dword [ebp - 0x18], 0x10
mov eax, dword [ebp - 0x2c]
jae 0x4083e0
lea eax, [ebp - 0x2c]
mov ecx, eax
add eax, dword [ebp - 0x1c]
lea edx, [ebp - 0x34]
push edx
push eax
push ecx
mov ecx, dword [esi + 0x44]
lea eax, [ebp - 0x38]
push eax
lea eax, [ebp - 0x2e]
push eax
lea eax, [ebp - 0x30]
push eax
lea eax, [esi + 0x4c]
push eax
call dword [sym.imp.MSVCP100.dll_public:_int___thiscall_std::codecvt_wchar_t__char__int_::out_int___wchar_t_const___wchar_t_const___wchar_t_const____char___char___char___const]
cmp eax, edi
jl 0x40842c
cmp eax, 1
jg 0x4083e8
cmp dword [ebp - 0x18], 0x10
mov eax, dword [ebp - 0x2c]
jae 0x40838f
lea eax, [ebp - 0x2c]
mov edi, dword [ebp - 0x34]
sub edi, eax
je 0x4083b6
cmp dword [ebp - 0x18], 0x10
mov eax, dword [ebp - 0x2c]
jae 0x4083a2
lea eax, [ebp - 0x2c]
push dword [esi + 0x54]
push edi
push 1
push eax
call dword [sym.imp.MSVCR100.dll_fwrite]
add esp, 0x10
cmp edi, eax
jne 0x408416
lea eax, [ebp - 0x30]
mov byte [esi + 0x4a], 1
cmp dword [ebp - 0x38], eax
jne 0x40841a
test edi, edi
jne 0x408340
cmp dword [ebp - 0x1c], 0x20
push edi
lea ecx, [ebp - 0x2c]
jae 0x408430
push 8
call fcn.00417882
jmp 0x408340
mov ecx, dword [ebp - 0x2c]
jmp 0x408354
cmp eax, 3
jne 0x40842c
push dword [esi + 0x54]
push dword [ebp - 0x30]
call dword [sym.imp.MSVCR100.dll_fputwc]
movzx esi, word [ebp + 8]
pop ecx
pop ecx
cmp ax, bx
jne 0x408406
mov esi, ebx
push edi
push 1
lea ecx, [ebp - 0x2c]
call fcn.00417882
mov ax, si
jmp 0x408439
push 0
jmp 0x40842d
push 0
push 1
lea ecx, [ebp - 0x2c]
call fcn.00417882
mov ax, word [ebp + 8]
jmp 0x408439
push edi
lea ecx, [ebp - 0x2c]
push 1
call fcn.00417882
mov eax, ebx
call fcn.0041d8b7
ret 4
Function at 0x408e53
Capabilities:
Write file on windows

Disassembly:
push 0x24
mov eax, 0x434700
call fcn.0041d834
xor ebx, ebx
cmp dword [esi + 0x44], ebx
je 0x408f49
cmp byte [esi + 0x4a], bl
je 0x408f49
mov eax, dword [esi]
mov edi, 0xffff
push edi
mov ecx, esi
call dword [eax + 0xc]
movzx eax, ax
cmp di, ax
jne 0x408e8f
xor al, al
jmp 0x408f4b
push ebx
push 8
lea ecx, [ebp - 0x2c]
mov dword [ebp - 0x18], 0xf
mov dword [ebp - 0x1c], ebx
mov byte [ebp - 0x2c], bl
call fcn.00417882
mov dword [ebp - 4], ebx
cmp dword [ebp - 0x18], 0x10
mov eax, dword [ebp - 0x2c]
jae 0x408eeb
lea eax, [ebp - 0x2c]
mov ecx, eax
add eax, dword [ebp - 0x1c]
lea edx, [ebp - 0x30]
push edx
push eax
push ecx
mov ecx, dword [esi + 0x44]
lea eax, [esi + 0x4c]
push eax
call dword [sym.imp.MSVCP100.dll_public:_int___thiscall_std::codecvt_wchar_t__char__int_::unshift_int___char___char___char___const]
sub eax, ebx
je 0x408ef0
dec eax
je 0x408ef4
dec eax
dec eax
je 0x408f45
xor bl, bl
push 0
push 1
lea ecx, [ebp - 0x2c]
call fcn.00417882
mov al, bl
jmp 0x408f4b
mov ecx, dword [ebp - 0x2c]
jmp 0x408eb8
mov byte [esi + 0x4a], 0
cmp dword [ebp - 0x18], 0x10
mov eax, dword [ebp - 0x2c]
jae 0x408f00
lea eax, [ebp - 0x2c]
mov edi, dword [ebp - 0x30]
sub edi, eax
je 0x408f27
cmp dword [ebp - 0x18], 0x10
mov eax, dword [ebp - 0x2c]
jae 0x408f13
lea eax, [ebp - 0x2c]
push dword [esi + 0x54]
push edi
push 1
push eax
call dword [sym.imp.MSVCR100.dll_fwrite]
add esp, 0x10
cmp edi, eax
jne 0x408ed9
cmp byte [esi + 0x4a], 0
je 0x408f45
cmp edi, ebx
jne 0x408eaa
push ebx
push 8
lea ecx, [ebp - 0x2c]
call fcn.00417882
jmp 0x408eaa
mov bl, 1
jmp 0x408edb
mov al, 1
call fcn.0041d8b7
ret