joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10036890
Capabilities:
Write file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, 0x1434
call fcn.1003b6e0
mov eax, dword [0x1004f0c0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
sar eax, 6
mov ecx, dword [ebp + 0xc]
and ecx, 0x3f
imul edx, ecx, 0x38
mov eax, dword [eax*4 + 0x100501c0]
mov ecx, dword [eax + edx + 0x18]
mov dword [ebp - 0x1434], ecx
mov edx, dword [ebp + 0x10]
add edx, dword [ebp + 0x14]
mov dword [ebp - 0x1424], edx
xor eax, eax
mov dword [ebp - 0x1410], eax
mov dword [ebp - 0x140c], eax
mov dword [ebp - 0x1408], eax
mov ecx, dword [ebp + 0x10]
mov dword [ebp - 0x1420], ecx
mov edx, dword [ebp - 0x1420]
cmp edx, dword [ebp - 0x1424]
jae 0x10036a68
lea eax, [ebp - 5]
mov dword [ebp - 0x1430], eax
lea ecx, [ebp - 0x1404]
mov dword [ebp - 0x1418], ecx
mov edx, dword [ebp - 0x1418]
cmp edx, dword [ebp - 0x1430]
jae 0x100369b7
mov eax, dword [ebp - 0x1420]
cmp eax, dword [ebp - 0x1424]
jae 0x100369b7
mov ecx, dword [ebp - 0x1420]
mov dl, byte [ecx]
mov byte [ebp - 0x1419], dl
mov eax, dword [ebp - 0x1420]
add eax, 1
mov dword [ebp - 0x1420], eax
mov cl, byte [ebp - 0x1419]
mov byte [ebp - 0x1411], cl
movsx edx, byte [ebp - 0x1411]
cmp edx, 0xa
jne 0x10036995
mov eax, dword [ebp - 0x1408]
add eax, 1
mov dword [ebp - 0x1408], eax
mov ecx, dword [ebp - 0x1418]
mov byte [ecx], 0xd
mov edx, dword [ebp - 0x1418]
add edx, 1
mov dword [ebp - 0x1418], edx
mov eax, dword [ebp - 0x1418]
mov cl, byte [ebp - 0x1411]
mov byte [eax], cl
mov edx, dword [ebp - 0x1418]
add edx, 1
mov dword [ebp - 0x1418], edx
jmp 0x10036919
mov eax, dword [ebp - 0x1418]
lea ecx, [ebp - 0x1404]
sub eax, ecx
mov dword [ebp - 0x142c], eax
push 0
lea edx, [ebp - 0x1428]
push edx
mov eax, dword [ebp - 0x142c]
push eax
lea ecx, [ebp - 0x1404]
push ecx
mov edx, dword [ebp - 0x1434]
push edx
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x10036a21
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x1410], eax
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0x1410]
mov dword [eax], ecx
mov edx, dword [ebp - 0x140c]
mov dword [eax + 4], edx
mov ecx, dword [ebp - 0x1408]
mov dword [eax + 8], ecx
mov eax, dword [ebp + 8]
jmp 0x10036a88
mov edx, dword [ebp - 0x140c]
add edx, dword [ebp - 0x1428]
mov dword [ebp - 0x140c], edx
mov eax, dword [ebp - 0x1428]
cmp eax, dword [ebp - 0x142c]
jae 0x10036a63
mov ecx, dword [ebp + 8]
mov edx, dword [ebp - 0x1410]
mov dword [ecx], edx
mov eax, dword [ebp - 0x140c]
mov dword [ecx + 4], eax
mov edx, dword [ebp - 0x1408]
mov dword [ecx + 8], edx
mov eax, dword [ebp + 8]
jmp 0x10036a88
jmp 0x100368f2
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0x1410]
mov dword [eax], ecx
mov edx, dword [ebp - 0x140c]
mov dword [eax + 4], edx
mov ecx, dword [ebp - 0x1408]
mov dword [eax + 8], ecx
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10009ee0
mov esp, ebp
pop ebp
ret
Function at 0x10036aa0
Capabilities:
Write file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, 0x1434
call fcn.1003b6e0
mov eax, dword [0x1004f0c0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
sar eax, 6
mov ecx, dword [ebp + 0xc]
and ecx, 0x3f
imul edx, ecx, 0x38
mov eax, dword [eax*4 + 0x100501c0]
mov ecx, dword [eax + edx + 0x18]
mov dword [ebp - 0x1434], ecx
mov edx, dword [ebp + 0x10]
add edx, dword [ebp + 0x14]
mov dword [ebp - 0x1424], edx
xor eax, eax
mov dword [ebp - 0x1410], eax
mov dword [ebp - 0x140c], eax
mov dword [ebp - 0x1408], eax
mov ecx, dword [ebp + 0x10]
mov dword [ebp - 0x141c], ecx
mov edx, dword [ebp - 0x141c]
cmp edx, dword [ebp - 0x1424]
jae 0x10036c8b
lea eax, [ebp - 6]
mov dword [ebp - 0x1430], eax
lea ecx, [ebp - 0x1404]
mov dword [ebp - 0x1414], ecx
mov edx, dword [ebp - 0x1414]
cmp edx, dword [ebp - 0x1430]
jae 0x10036bd6
mov eax, dword [ebp - 0x141c]
cmp eax, dword [ebp - 0x1424]
jae 0x10036bd6
mov ecx, dword [ebp - 0x141c]
mov dx, word [ecx]
mov word [ebp - 0x141e], dx
mov eax, dword [ebp - 0x141c]
add eax, 2
mov dword [ebp - 0x141c], eax
mov cx, word [ebp - 0x141e]
mov word [ebp - 0x1418], cx
movzx edx, word [ebp - 0x1418]
cmp edx, 0xa
jne 0x10036bb2
mov eax, dword [ebp - 0x1408]
add eax, 2
mov dword [ebp - 0x1408], eax
mov ecx, 0xd
mov edx, dword [ebp - 0x1414]
mov word [edx], cx
mov eax, dword [ebp - 0x1414]
add eax, 2
mov dword [ebp - 0x1414], eax
mov ecx, dword [ebp - 0x1414]
mov dx, word [ebp - 0x1418]
mov word [ecx], dx
mov eax, dword [ebp - 0x1414]
add eax, 2
mov dword [ebp - 0x1414], eax
jmp 0x10036b29
mov ecx, dword [ebp - 0x1414]
lea edx, [ebp - 0x1404]
sub ecx, edx
sar ecx, 1
shl ecx, 1
mov dword [ebp - 0x142c], ecx
push 0
lea eax, [ebp - 0x1428]
push eax
mov ecx, dword [ebp - 0x142c]
push ecx
lea edx, [ebp - 0x1404]
push edx
mov eax, dword [ebp - 0x1434]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x10036c44
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x1410], eax
mov ecx, dword [ebp + 8]
mov edx, dword [ebp - 0x1410]
mov dword [ecx], edx
mov eax, dword [ebp - 0x140c]
mov dword [ecx + 4], eax
mov edx, dword [ebp - 0x1408]
mov dword [ecx + 8], edx
mov eax, dword [ebp + 8]
jmp 0x10036cab
mov eax, dword [ebp - 0x140c]
add eax, dword [ebp - 0x1428]
mov dword [ebp - 0x140c], eax
mov ecx, dword [ebp - 0x1428]
cmp ecx, dword [ebp - 0x142c]
jae 0x10036c86
mov edx, dword [ebp + 8]
mov eax, dword [ebp - 0x1410]
mov dword [edx], eax
mov ecx, dword [ebp - 0x140c]
mov dword [edx + 4], ecx
mov eax, dword [ebp - 0x1408]
mov dword [edx + 8], eax
mov eax, dword [ebp + 8]
jmp 0x10036cab
jmp 0x10036b02
mov ecx, dword [ebp + 8]
mov edx, dword [ebp - 0x1410]
mov dword [ecx], edx
mov eax, dword [ebp - 0x140c]
mov dword [ecx + 4], eax
mov edx, dword [ebp - 0x1408]
mov dword [ecx + 8], edx
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10009ee0
mov esp, ebp
pop ebp
ret
Function at 0x4265c0
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x1b000]
push edi
or ebp, 0xffffffff
jmp 0x4265e2
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x4265e9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4265d8
mov eax, 1
add ebx, ebx
jne 0x4265fb
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x4265f0
jne 0x42660c
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x4265f0
xor ecx, ecx
sub eax, 3
jb 0x426620
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x426692
mov ebp, eax
add ebx, ebx
jne 0x42662b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x426638
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x42665c
inc ecx
add ebx, ebx
jne 0x426648
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x42663d
jne 0x426659
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x42663d
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x42667c
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x42666d
jmp 0x4265de
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x42667c
add edi, ecx
jmp 0x4265de
pop esi
mov edi, esi
mov ecx, 0xd
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x42669a
cmp byte [edi], 1
jne 0x42669a
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x42669f
lea edi, [esi + 0x24000]
mov eax, dword [edi]
or eax, eax
je 0x426717
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x28e44]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x28e80]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x4266cc
mov ecx, edi
jns 0x4266fb
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x28e84]
or eax, eax
je 0x426711
mov dword [ebx], eax
add ebx, 4
jmp 0x4266e9
call dword [esi + 0x28e8c]
mov ebp, dword [esi + 0x28e88]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x1d7]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x42674b
sub esp, 0xffffff80
jmp 0x401224

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x410022
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
pushal
call 0x410031
pop dword [ebp - 0x20]
mov eax, 0xefb74c2f
add eax, 0x1089b402
sub dword [ebp - 0x20], eax
push 0x40
push 0x1000
push 0x5251d
push 0
mov eax, sym.imp.kernel32.dll_VirtualAlloc
add eax, dword [ebp - 0x20]
call dword [eax]
mov ecx, 0x4f8d
mov edx, eax
mov ebx, 0xd04059f2
sub ebx, 0xcff8fbf2
add ebx, dword [ebp - 0x20]
mov edi, 0x9e9ffc6d
sub edi, 0xf0db8f0a
xor dword [ebp - 0x1c], ebx
mov esi, dword [ebx]
xor dword [ebp - 4], 0x2c4ee49b
add esi, edi
mov dword [ebp - 0xc], 0xd1aa95e
mov dword [edx], esi
xor dword [ebp - 8], eax
add edx, 0x49c6daa7
add edx, 0xb639255d
add ebx, 0xb39356d3
add ebx, 0x4c6ca931
loop 0x410085
add eax, 0xb9c92e46
add eax, 0x463802c1
xor ebx, ebx
add ebx, eax
add eax, 5
mov ecx, 0x400000
add ecx, dword [ebp - 0x20]
call ebx
leave
ret

Function at 0x4400c9
Capabilities:
Encrypt data using dpapi

Disassembly:
push esi
push edi
push 0x46c6d0
push str.AdvApi32.dll
call main
mov edi, dword [sym.imp.kernel32.dll_GetProcAddress]
mov esi, eax
test esi, esi
js 0x44010c
push str.SystemFunction040
push dword [0x46c6d0]
call edi
push str.SystemFunction041
push dword [0x46c6d0]
mov dword [0x46c6c0], eax
call edi
mov dword [0x46c6c4], eax
jmp 0x440111
mov eax, dword [0x46c6c4]
cmp dword [0x46c6c0], 0
je 0x440122
test eax, eax
jne 0x4401c9
push 0x46c6d4
push str.Crypt32.dll
call main
mov esi, eax
test esi, esi
js 0x4401d3
push str.CryptProtectMemory
push dword [0x46c6d4]
call edi
cmp dword [0x46c6c0], 0
mov dword [0x46c6c8], eax
jne 0x440187
test eax, eax
jne 0x440187
call dword [sym.imp.kernel32.dll_GetLastError]
mov esi, eax
test esi, esi
jle 0x440171
movzx esi, si
or esi, 0x80070000
test esi, esi
js 0x440178
mov esi, 0x80004005
push esi
push 0x28
push str.c:_agent_work138_s_srclibsdutilcryputil.cpp
call fcn.004038f5
jmp 0x4401d3
push str.CryptUnprotectMemory
push dword [0x46c6d4]
call edi
cmp dword [0x46c6c4], 0
mov dword [0x46c6cc], eax
jne 0x4401c9
test eax, eax
jne 0x4401c9
call dword [sym.imp.kernel32.dll_GetLastError]
mov esi, eax
test esi, esi
jle 0x4401bd
movzx esi, si
or esi, 0x80070000
test esi, esi
js 0x4401c4
mov esi, 0x80004005
push esi
push 0x2d
jmp 0x44017b
mov dword [0x46c6d8], 1
pop edi
mov eax, esi
pop esi
ret
Function at 0x10008ff7
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
pushal
call 0x10009006
pop dword [ebp - 0x2c]
mov eax, 0x10009006
sub dword [ebp - 0x2c], eax
mov dword [ebp - 0x3c], 0x9177789a
add dword [ebp - 0x3c], 0xbcdaccb1
mov dword [ebp - 0x38], 0x553e6afa
sub dword [ebp - 0x38], 0x230b1eb5
mov dword [ebp - 0x34], 0x23b9dc8
sub dword [ebp - 0x34], 0xb5ef599a
mov dword [ebp - 0x30], 0x80039ff2
add dword [ebp - 0x30], 0x7ffc600e
lea eax, [ebp - 0x3c]
push eax
mov eax, sym.imp.kernel32.dll_GetModuleHandleA
add eax, dword [ebp - 0x2c]
call dword [eax]
mov dword [ebp - 0x3c], 0x53d467af
sub dword [ebp - 0x3c], 0xdf61fe59
mov dword [ebp - 0x38], 0xe2231592
sub dword [ebp - 0x38], 0xa0b6b41d
mov dword [ebp - 0x34], 0xbe58a557
add dword [ebp - 0x34], 0xa516c715
mov dword [ebp - 0x30], 0xd6bd7906
sub dword [ebp - 0x30], 0xd6bd7906
lea ebx, [ebp - 0x3c]
push ebx
push eax
mov eax, 0xa81fb612
sub eax, 0x981f057a
add eax, dword [ebp - 0x2c]
call dword [eax]
push 0x40
push 0x1000
push 0x368c7
push 0
call eax
mov ecx, 0x443c
xor edx, edx
add edx, eax
mov ebx, 0x10047800
add ebx, dword [ebp - 0x2c]
mov esi, 0x601e943a
sub esi, 0x61f71f22
mov dword [ebp - 0x28], 0x431a894e
mov edi, dword [ebx]
add dword [ebp - 0x10], eax
xor edi, esi
sub dword [ebp - 0x24], 0x82c41af1
mov dword [edx], edi
add edx, 0xb648ed98
sub edx, 0xb648ed94
add ebx, 4
loop 0x10009114
add eax, 0xda41b9cc
add eax, 0x25bf49f7
mov ebx, eax
add eax, 5
mov ecx, 0xd0fcbce4
sub ecx, 0xc0fcbce4
add ecx, dword [ebp - 0x2c]
call ebx
leave
ret
Function at 0x10021eb0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x54
mov eax, dword [0x10107af4]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x30], ecx
mov eax, dword [ebp - 0x30]
cmp dword [eax + 0x38], 0
je 0x10021ed7
mov ecx, dword [ebp - 0x30]
movzx edx, byte [ecx + 0x3d]
test edx, edx
jne 0x10021ede
mov al, 1
jmp 0x10021fcb
mov eax, dword [ebp - 0x30]
mov ecx, dword [eax]
mov edx, dword [ecx + 0xc]
mov dword [ebp - 0x44], edx
call fcn.10018690
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x40]
push eax
mov ecx, dword [ebp - 0x30]
call dword [ebp - 0x44]
mov dword [ebp - 0x48], eax
call fcn.10018690
mov dword [ebp - 0x4c], eax
lea ecx, [ebp - 0x48]
push ecx
lea edx, [ebp - 0x4c]
push edx
call fcn.100235b0
add esp, 8
movzx eax, al
test eax, eax
je 0x10021f24
xor al, al
jmp 0x10021fcb
mov dword [ebp - 0x54], 0x20
mov ecx, dword [ebp - 0x30]
mov edx, dword [ecx + 0x38]
mov dword [ebp - 0x50], edx
lea eax, [ebp - 0x2c]
push eax
lea ecx, [ebp - 8]
push ecx
lea edx, [ebp - 0x28]
push edx
mov eax, dword [ebp - 0x30]
add eax, 0x40
push eax
mov ecx, dword [ebp - 0x50]
call dword [sym.imp.MSVCP140.dll_public:_int___thiscall_std::codecvt_char__char__struct__Mbstatet_::unshift_struct__Mbstatet___char___char___char___const]
mov dword [ebp - 0x34], eax
cmp dword [ebp - 0x34], 0
je 0x10021f67
cmp dword [ebp - 0x34], 1
je 0x10021f6e
cmp dword [ebp - 0x34], 3
je 0x10021fbe
jmp 0x10021fc9
mov ecx, dword [ebp - 0x30]
mov byte [ecx + 0x3d], 0
mov edx, dword [ebp - 0x2c]
lea eax, [ebp - 0x28]
sub edx, eax
mov dword [ebp - 0x38], edx
je 0x10021f9e
mov ecx, dword [ebp - 0x30]
mov edx, dword [ecx + 0x4c]
push edx
mov eax, dword [ebp - 0x38]
push eax
push 1
lea ecx, [ebp - 0x28]
push ecx
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
add esp, 0x10
cmp dword [ebp - 0x38], eax
je 0x10021f9e
xor al, al
jmp 0x10021fcb
mov edx, dword [ebp - 0x30]
movzx eax, byte [edx + 0x3d]
test eax, eax
jne 0x10021fb2
mov dword [ebp - 0x3c], 1
jmp 0x10021fb9
mov dword [ebp - 0x3c], 0
mov al, byte [ebp - 0x3c]
jmp 0x10021fcb
mov ecx, dword [ebp - 0x30]
mov byte [ecx + 0x3d], 0
mov al, 1
jmp 0x10021fcb
xor al, al
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1009c073
mov esp, ebp
pop ebp
ret
Function at 0x10024540
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov dword [ebp - 4], ecx
mov eax, dword [ebp - 4]
cmp dword [eax + 0x38], 0
je 0x1002456c
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 4]
call dword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____thiscall_std::basic_streambuf_char__struct_std::char_traits_char__::xsputn_char_const___long_long___int64__]
jmp 0x10024652
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp + 0x10]
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x10], edx
mov ecx, dword [ebp - 4]
call dword [sym.imp.MSVCP140.dll_protected:_long_long___int64____thiscall_std::basic_streambuf_char__struct_std::char_traits_char__::_Pnavail_void_const]
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], edx
cmp dword [ebp + 0x10], 0
jl 0x10024603
jg 0x10024595
cmp dword [ebp + 0xc], 0
jbe 0x10024603
cmp dword [ebp - 8], 0
jl 0x10024603
jg 0x100245a3
cmp dword [ebp - 0xc], 0
jbe 0x10024603
mov eax, dword [ebp + 0x10]
cmp eax, dword [ebp - 8]
jg 0x100245c1
jl 0x100245b5
mov ecx, dword [ebp + 0xc]
cmp ecx, dword [ebp - 0xc]
jae 0x100245c1
mov edx, dword [ebp + 0xc]
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0xc], edx
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
mov ecx, dword [ebp - 4]
call dword [sym.imp.MSVCP140.dll_protected:_char____thiscall_std::basic_streambuf_char__struct_std::char_traits_char__::pptr_void_const]
push eax
call fcn.100172e0
add esp, 0xc
mov eax, dword [ebp - 0xc]
add eax, dword [ebp + 8]
mov dword [ebp + 8], eax
mov ecx, dword [ebp + 0xc]
sub ecx, dword [ebp - 0xc]
mov edx, dword [ebp + 0x10]
sbb edx, dword [ebp - 8]
mov dword [ebp + 0xc], ecx
mov dword [ebp + 0x10], edx
mov eax, dword [ebp - 0xc]
push eax
mov ecx, dword [ebp - 4]
call dword [sym.imp.MSVCP140.dll_protected:_void___thiscall_std::basic_streambuf_char__struct_std::char_traits_char__::pbump_int_]
cmp dword [ebp + 0x10], 0
jl 0x10024646
jg 0x10024611
cmp dword [ebp + 0xc], 0
jbe 0x10024646
mov ecx, dword [ebp - 4]
cmp dword [ecx + 0x4c], 0
je 0x10024646
mov edx, dword [ebp - 4]
mov eax, dword [edx + 0x4c]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
push 1
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
add esp, 0x10
xor ecx, ecx
mov edx, dword [ebp + 0xc]
sub edx, eax
mov eax, dword [ebp + 0x10]
sbb eax, ecx
mov dword [ebp + 0xc], edx
mov dword [ebp + 0x10], eax
mov eax, dword [ebp - 0x14]
sub eax, dword [ebp + 0xc]
mov edx, dword [ebp - 0x10]
sbb edx, dword [ebp + 0x10]
mov esp, ebp
pop ebp
ret 0xc
Function at 0x1002d5d0
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 8], 0x811c9dc5
push 0
mov eax, dword [ebp + 8]
push eax
call fcn.1002d510
add esp, 8
mov dword [ebp - 0xc], eax
mov dword [ebp - 4], 0
jmp 0x1002d600
mov ecx, dword [ebp - 4]
add ecx, 1
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 4]
cmp edx, dword [ebp - 0xc]
jae 0x1002d61f
mov eax, dword [ebp + 8]
add eax, dword [ebp - 4]
movsx ecx, byte [eax]
xor ecx, dword [ebp - 8]
imul edx, ecx, 0x1000193
mov dword [ebp - 8], edx
jmp 0x1002d5f7
mov eax, dword [ebp - 8]
mov esp, ebp
pop ebp
ret

Function at 0x10039a30
Capabilities:
Create thread
Set console window title

Disassembly:
push ebp
mov ebp, esp
cmp dword [ebp + 0xc], 1
jne 0x10039ad9
call dword [sym.imp.KERNEL32.dll_AllocConsole]
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
call dword [sym.imp.KERNEL32.dll_AttachConsole]
push 0
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
add esp, 4
push eax
push 0x100b8398
push str.CONIN_
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_freopen]
add esp, 0xc
push 1
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
add esp, 4
push eax
push 0x100b83a4
push 0x100b83a8
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_freopen]
add esp, 0xc
push 2
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
add esp, 4
push eax
push 0x100b83b0
push str.CONOUT_
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_freopen]
add esp, 0xc
push 0x100b83bc
call dword [sym.imp.KERNEL32.dll_SetConsoleTitleA]
push 0
push 0
mov eax, dword [ebp + 8]
push eax
push 0x10039880
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_DisableThreadLibraryCalls]
mov eax, 1
pop ebp
ret 0xc
Function at 0x1004bb70
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
mov dword [ebp - 0xc], ecx
push 0x100bdf20
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fopen]
add esp, 8
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x1004bb9b
xor al, al
jmp 0x1004bd1b
push 2
push 0
mov ecx, dword [ebp - 8]
push ecx
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fseek]
add esp, 0xc
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_ftell]
add esp, 4
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
jne 0x1004bbc9
xor al, al
jmp 0x1004bd1b
mov dword [ebp - 0x10], 0
cmp dword [ebp + 0xc], 2
je 0x1004bbdc
cmp dword [ebp + 0xc], 1
jne 0x1004bbe3
mov dword [ebp - 0x10], 2
cmp dword [ebp + 0xc], 0
jne 0x1004bbf0
mov dword [ebp - 0x10], 1
cmp dword [ebp + 0xc], 4
je 0x1004bbfc
cmp dword [ebp + 0xc], 3
jne 0x1004bc03
mov dword [ebp - 0x10], 4
mov eax, dword [ebp - 0x14]
add eax, dword [ebp - 0x10]
push eax
call fcn.1009bb47
add esp, 4
mov dword [ebp - 0x24], eax
mov ecx, dword [ebp - 0x24]
mov dword [ebp - 4], ecx
push 0
push 0
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fseek]
add esp, 0xc
mov eax, dword [ebp - 8]
push eax
mov ecx, dword [ebp - 0x14]
push ecx
push 1
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
add esp, 0x10
cmp eax, dword [ebp - 0x14]
je 0x1004bc7d
mov eax, dword [ebp - 4]
mov dword [ebp - 0x1c], eax
mov ecx, dword [ebp - 0x1c]
push ecx
call fcn.1009c221
add esp, 4
cmp dword [ebp - 0x1c], 0
jne 0x1004bc69
mov dword [ebp - 0x28], 0
jmp 0x1004bc76
mov dword [ebp - 4], 0x8123
mov edx, dword [ebp - 4]
mov dword [ebp - 0x28], edx
xor al, al
jmp 0x1004bd1b
mov dword [ebp - 0x18], 0
jmp 0x1004bc8f
mov eax, dword [ebp - 0x18]
add eax, 1
mov dword [ebp - 0x18], eax
mov ecx, dword [ebp - 0x18]
cmp ecx, dword [ebp - 0x10]
jae 0x1004bca6
mov edx, dword [ebp - 0x14]
add edx, dword [ebp - 0x18]
mov eax, dword [ebp - 4]
mov byte [eax + edx], 0
jmp 0x1004bc86
mov ecx, dword [ebp - 8]
push ecx
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
add esp, 4
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp - 4]
push eax
mov ecx, dword [ebp - 0xc]
call fcn.1004aaa0
mov ecx, dword [ebp - 4]
mov dword [ebp - 0x20], ecx
mov edx, dword [ebp - 0x20]
push edx
call fcn.1009c221
add esp, 4
cmp dword [ebp - 0x20], 0
jne 0x1004bce4
mov dword [ebp - 0x2c], 0
jmp 0x1004bcf1
mov dword [ebp - 4], 0x8123
mov eax, dword [ebp - 4]
mov dword [ebp - 0x2c], eax
mov ecx, dword [ebp - 0xc]
mov edx, dword [ecx + 0x28]
push edx
mov ecx, dword [ebp - 0xc]
call fcn.1004fc80
mov ecx, dword [ebp - 0xc]
mov dword [ecx + 0x2c], eax
mov edx, dword [ebp - 0xc]
cmp dword [edx + 0x2c], 0
jne 0x1004bd13
xor al, al
jmp 0x1004bd1b
mov ecx, dword [ebp - 0xc]
call fcn.1004c110
mov esp, ebp
pop ebp
ret 8