joyce8/EMBER2024-capa huggingface dataset:
Function at 0x444018
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x47d348]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push dword [ebp + 0x10]
mov esi, ecx
push dword [ebp + 0xc]
push dword [ebp + 8]
call sym.BearSCInstall.exe_public_virtual:_void___thiscall_DuiLib::CControlUI::Move_struct_tagSIZE__bool_
mov ecx, dword [esi + 0x4b0]
test ecx, ecx
je 0x444094
lea eax, [ebp - 0x14]
push eax
call fcn.00443b86
lea eax, [ebp - 0x14]
push eax
call dword [sym.imp.USER32.dll_IsRectEmpty]
mov ecx, dword [esi + 0x4b0]
test eax, eax
je 0x444070
push 0
call sym.BearSCInstall.exe_public:_struct_HWND______thiscall_DuiLib::CWindowWnd::operator_struct_HWND____void_const
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
jmp 0x444094
mov eax, dword [ebp - 8]
sub eax, dword [ebp - 0x10]
push 0x54
push eax
mov eax, dword [ebp - 0xc]
sub eax, dword [ebp - 0x14]
push eax
push dword [ebp - 0x10]
push dword [ebp - 0x14]
push 0
call sym.BearSCInstall.exe_public:_struct_HWND______thiscall_DuiLib::CWindowWnd::operator_struct_HWND____void_const
push eax
call dword [sym.imp.USER32.dll_SetWindowPos]
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.0044df71
leave
ret 0xc

Function at 0x44417d
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x47d348]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push dword [ebp + 0x18]
lea esi, [ebp + 8]
mov ebx, ecx
sub esp, 0x10
mov edi, esp
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
call sym.BearSCInstall.exe_public_virtual:_void___thiscall_DuiLib::CControlUI::SetPos_struct_tagRECT__bool_
mov ecx, dword [ebx + 0x4b0]
test ecx, ecx
je 0x444201
lea eax, [ebp - 0x14]
push eax
call fcn.00443b86
lea eax, [ebp - 0x14]
push eax
call dword [sym.imp.USER32.dll_IsRectEmpty]
mov ecx, dword [ebx + 0x4b0]
test eax, eax
je 0x4441dd
push 0
call sym.BearSCInstall.exe_public:_struct_HWND______thiscall_DuiLib::CWindowWnd::operator_struct_HWND____void_const
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
jmp 0x444201
mov eax, dword [ebp - 8]
sub eax, dword [ebp - 0x10]
push 0x54
push eax
mov eax, dword [ebp - 0xc]
sub eax, dword [ebp - 0x14]
push eax
push dword [ebp - 0x10]
push dword [ebp - 0x14]
push 0
call sym.BearSCInstall.exe_public:_struct_HWND______thiscall_DuiLib::CWindowWnd::operator_struct_HWND____void_const
push eax
call dword [sym.imp.USER32.dll_SetWindowPos]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0044df71
leave
ret 0x14
Function at 0x44b5fa
Capabilities:
Get file attributes

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
cmp dword [eax + 0x14], 8
jb 0x44b608
mov eax, dword [eax]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
shr eax, 4
and al, 1
pop ebp
ret

Function at 0x44b653
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
cmp dword [eax + 0x14], 8
jb 0x44b661
mov eax, dword [eax]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
setne al
pop ebp
ret

Function at 0x44bf1f
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
lea eax, [ebp - 4]
push eax
push dword [ecx]
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov esi, eax
cmp esi, 0xffffffff
jne 0x44bf45
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x44bf45
xor al, al
jmp 0x44bf59
mov eax, dword [ebp + 8]
xor ecx, ecx
mov edx, dword [ebp - 4]
add ecx, esi
adc edx, 0
mov dword [eax], ecx
mov dword [eax + 4], edx
mov al, 1
pop esi
leave
ret 4

Function at 0x44d0f5
Capabilities:
Create directory

Disassembly:
push 0x38
mov eax, 0x451b0b
call fcn.0044e5e5
xor ebx, ebx
push ebx
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
je 0x44d115
mov al, 1
jmp 0x44d15c
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
je 0x44d126
xor al, al
jmp 0x44d15c
lea ecx, [ebp - 0x44]
call fcn.0044d25f
lea ecx, [ebp - 0x1c]
call fcn.0044c7ec
push dword [ebp + 8]
lea ecx, [ebp - 0x44]
mov dword [ebp - 4], ebx
call fcn.0044d2f7
test al, al
je 0x44d151
mov ebx, dword [ebp - 0x24]
shr ebx, 4
and bl, 1
push dword [ebp - 0x1c]
call fcn.0044e693
pop ecx
mov al, bl
call fcn.0044e5ae
ret

Function at 0x44d1b9
Capabilities:
Set file attributes

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
test eax, eax
setne al
pop ebp
ret

Function at 0x44d80e
Capabilities:
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
or ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, eax
mov eax, ecx
pop ebp
ret

Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..text
mov ebx, 0x408f6c
nop
mov ecx, 0x289461ef
nop
nop
nop
nop
test eax, eax
nop
nop
nop
nop
nop
je 0x43004e
nop
nop
nop
xor dword [eax], ecx
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x430024
nop
nop
mov eax, section..data
mov ebx, 0x42e3d0
nop
mov ecx, 0x537d70c7
nop
nop
nop
nop
test eax, eax
nop
nop
nop
nop
je 0x430084
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
add eax, 4
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
jne 0x43006c
nop
nop
nop
nop
nop
nop
nop
popal
nop
jmp 0x401219
Function at 0x4065bf
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x120
push esi
mov esi, 0x104
lea eax, [ebp - 0x120]
push esi
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
cmp eax, esi
pop esi
jbe 0x4065e3
xor eax, eax
test eax, eax
je 0x4065f5
cmp byte [ebp + eax - 0x121], 0x5c
je 0x4065f5
xor ecx, ecx
jmp 0x4065f8
xor ecx, ecx
inc ecx
push dword [ebp + 8]
lea ecx, [ecx + 0x40a014]
lea eax, [ebp + eax - 0x120]
push ecx
push str._s_s.dll
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x10
lea eax, [ebp - 0x120]
push 8
push 0
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryExA]
leave
ret 4

Function at 0x4066e4
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
cmp dword [0x4232bc], 0
push esi
jne 0x40671b
xor ecx, ecx
push 8
mov eax, ecx
pop esi
mov edx, eax
and dl, 1
neg dl
sbb edx, edx
and edx, 0xedb88320
shr eax, 1
xor eax, edx
dec esi
jne 0x4066f5
mov dword [ecx*4 + 0x4232b8], eax
inc ecx
cmp ecx, 0x100
jl 0x4066f0
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 8]
test edx, edx
not eax
jbe 0x40674c
mov ecx, dword [esp + 0xc]
push edi
movzx edi, byte [ecx]
mov esi, eax
and esi, 0xff
xor esi, edi
shr eax, 8
mov esi, dword [esi*4 + 0x4232b8]
xor eax, esi
inc ecx
dec edx
jne 0x40672e
pop edi
not eax
pop esi
ret 0xc

Function at 0x433002
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
call 0x43300c
nop
nop
nop
nop
pop eax
nop
nop
add eax, 0x40a063
sub eax, 0x40a009
nop
nop
nop
mov ebx, dword [eax]
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
xor dword [ebx], edx
nop
nop
nop
add ebx, 4
cmp ebx, ecx
nop
nop
nop
nop
nop
nop
jl 0x433030
nop
nop
nop
nop
add eax, 0xc
nop
cmp dword [eax], 0
nop
nop
nop
nop
nop
nop
jne 0x43301e
nop
nop
nop
nop
nop
nop
popal
jmp 0x431219
Function at 0x47ef74
Capabilities:
Execute anti-debugging instructions

Disassembly:
push 0xf0468978
jmp 0x47ef4b
call 0x47efa3
mov esi, dword [esp + 0x2c]
cpuid
rdtsc
mov edi, 0x2b6695a8
not eax
jmp 0x47f0f5
mov dword [esp + 8], edi
lea esp, [esp + 8]
pushfd
jmp 0x47d484
rdtsc
call 0x47efed
lea ebx, [esp - 0x3a]
mov ebx, ecx
jmp 0x47f052
push ecx
dec ebx
lea esp, [esp + 3]
inc bh
xchg bx, dx
mov ch, ah
lea esp, [esp + 1]
call fcn.0047f0dc
jo 0x47f0c3
push 0xffffffffffffff85
add esi, 0x55b532fb
mov cx, dx
xor cx, 0xb740
jo 0x47f038
jno 0x47f06c
mov dh, 0x24
inc ebx
mov esi, 0x514e277c
push ecx
dec ebx
lea esp, [esp + 3]
jmp 0x47f0ab
sub esp, 0xc0
mov edi, esp
xchg dl, ah
lea ecx, [ecx + edi]
jmp 0x47f010
inc bh
xchg bx, dx
jmp 0x47f043
not cl
jmp 0x47f083
shr ebx, 1
mov ebp, 0x48f669c
and al, 0x8d
and al, 1
lea esp, [esp + 1]
lea edi, [edi + 0x47]
jmp 0x47f169
lea ebp, [esp]
neg ax
jge 0x47f0c2
not cl
jmp 0x47f083
lea ebx, [esp + 0x57]
inc ebx
push dword [esp + 0xc]
ret 0x10
add bx, ax
sub esp, 0xc
mov dl, 1
xchg dword [esp + 0xc], edi
btr ecx, eax
rcr dl, 0
jmp 0x47f117

Function at 0x51e98c
Capabilities:
Execute anti-debugging instructions

Disassembly:
rdtsc
mov bl, 0x68
xchg dh, ch
add esp, 6
lea ebp, [edi*4]
shr edi, cl
not bl
mov dx, word [esp + 1]
pop dword [esp]
sub esp, 0x17
cld
jmp 0x51e934
rdtsc
push dword [esp + 3]
jmp 0x51e94a

Function at 0x51eae9
Capabilities:
Execute anti-debugging instructions

Disassembly:
bts ebp, ebp
mov word [esp + 3], dx
rcl cl, 6
add ah, 0x1e
jmp 0x51eb24
lea ebx, reloc.KERNEL32.dll_GetProcAddress
mov dx, bp
xchg cl, dl
rdtsc
add esp, 9
push cx
jmp 0x51ed19
shl dh, cl
rdtsc
xchg di, ax
push edi
pop bp
cpuid
jmp 0x51ec78
mov di, bx
cmc
mov byte [esp], cl
xchg dl, ch
lea edi, [eax + ebp]
mov si, word [esp]
jmp 0x51eb60
pushfd
cld
push dword [esp]
pop dword [esp + 8]
xchg byte [esp + 6], dl
neg edx
jmp 0x51ebb0
xchg word [esp], dx
mov ebx, 0x66814dbb
bsf bp, bp
sub esp, 0xa
xchg ecx, eax
mov ax, sp
jmp 0x51ec1c
lea ebp, reloc.KERNEL32.dll_GetProcAddress
mov dh, byte [esp + 1]
setnp ch
sete cl
xchg dh, bl
lea esp, [esp + 2]
jmp 0x51eb85
Function at 0x10016331
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x60
pushal
call 0x10016340
pop dword [ebp - 0x50]
mov eax, 0x10016340
sub dword [ebp - 0x50], eax
mov dword [ebp - 0x60], 0x8a7b6771
add dword [ebp - 0x60], 0xc3d6ddda
mov dword [ebp - 0x5c], 0x62824cec
add dword [ebp - 0x5c], 0xcfb0ff59
mov dword [ebp - 0x58], 0xfbfc0aa8
add dword [ebp - 0x58], 0x50503986
mov dword [ebp - 0x54], 0xdd569934
sub dword [ebp - 0x54], 0xdd569934
lea eax, [ebp - 0x60]
push eax
mov eax, 0x89f66ffa
sub eax, 0x79f4cff2
add eax, dword [ebp - 0x50]
call dword [eax]
mov dword [ebp - 0x60], 0x7d4a98fc
sub dword [ebp - 0x60], 0x8d82fa6
mov dword [ebp - 0x5c], 0x2547a403
sub dword [ebp - 0x5c], 0xe3db428e
mov dword [ebp - 0x58], 0xfd7ecdf8
sub dword [ebp - 0x58], 0x9a0f618c
mov dword [ebp - 0x54], 0xf3a5ebec
sub dword [ebp - 0x54], 0xf3a5ebec
lea ebx, [ebp - 0x60]
push ebx
push eax
mov eax, 0x3dfffb3
add eax, 0xc21a059
add eax, dword [ebp - 0x50]
call dword [eax]
push 0x40
push 0x1000
push 0x38c7c
push 0
call eax
mov ecx, 0x97f5cd17
add ecx, 0x680a7514
mov edi, eax
mov edx, 0xb84a31ec
add edx, 0x57b81814
add edx, dword [ebp - 0x50]
mov esi, 0xc565599e
mov ebx, dword [edx]
add dword [ebp - 0x38], 0x10b64ad4
sub ebx, esi
xor dword [ebp - 8], 0x16b0640e
mov dword [edi], ebx
xor dword [ebp - 0x3c], ebx
add edi, 4
add edx, 0xd386b338
add edx, 0x2c794ccc
loop 0x10016457
add eax, 0xd71782f0
add eax, 0x28e9788f
mov ebx, eax
add eax, 5
mov ecx, 0x10000000
add ecx, dword [ebp - 0x50]
call ebx
leave
ret

Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
nop
mov ebx, 0x408ecc
nop
mov ecx, 0x11746e07
nop
nop
test eax, eax
nop
nop
je 0x43004e
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
cmp eax, ebx
nop
nop
jne 0x430024
nop
nop
nop
mov eax, section..data
nop
mov ebx, 0x42e1d0
nop
mov ecx, 0x7bd21480
nop
nop
nop
test eax, eax
nop
nop
nop
je 0x430084
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
add eax, 4
nop
nop
nop
cmp eax, ebx
nop
nop
nop
jne 0x43006c
nop
nop
nop
nop
nop
nop
popal
nop
nop
nop
jmp 0x401219
Function at 0x10009220
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x58
pushal
call 0x1000922f
pop dword [ebp - 0x48]
mov eax, 0xcd25eb8b
add eax, 0x42daa6a4
sub dword [ebp - 0x48], eax
mov dword [ebp - 0x58], 0xb01d4e6f
add dword [ebp - 0x58], 0x9e34f6dc
mov dword [ebp - 0x54], 0xbd5f042b
add dword [ebp - 0x54], 0x74d4481a
mov dword [ebp - 0x50], 0x852f62c8
sub dword [ebp - 0x50], 0x38e31e9a
mov dword [ebp - 0x4c], 0x37fd6bd1
add dword [ebp - 0x4c], 0xc802942f
lea eax, [ebp - 0x58]
push eax
mov eax, sym.imp.kernel32.dll_GetModuleHandleA
add eax, dword [ebp - 0x48]
call dword [eax]
mov dword [ebp - 0x58], 0x4aedd90d
sub dword [ebp - 0x58], 0xd67b6fb7
mov dword [ebp - 0x54], 0xeb5e6af8
sub dword [ebp - 0x54], 0xa9f20983
mov dword [ebp - 0x50], 0x26522a8a
add dword [ebp - 0x50], 0x3d1d41e2
mov dword [ebp - 0x4c], 0x77a1fa21
add dword [ebp - 0x4c], 0x885e05df
lea ebx, [ebp - 0x58]
push ebx
push eax
mov eax, 0xba1f1bd3
sub eax, 0xaa1e7b63
add eax, dword [ebp - 0x48]
call dword [eax]
push 0x40
push 0x1000
push 0x39a24
push 0
call eax
mov ecx, 0x4e7d
mov edi, eax
mov ebx, 0x28552f49
sub ebx, 0x1853fd49
add ebx, dword [ebp - 0x48]
mov esi, 0x39ea7aea
sub dword [ebp - 0x40], edi
mov edx, dword [ebx]
add dword [ebp - 0x24], edx
add edx, esi
xor dword [ebp - 0x38], eax
mov dword [edi], edx
sub dword [ebp - 0x44], edi
add edi, 0x982df12
sub edi, 0x982df0e
add ebx, 4
loop 0x10009340
add eax, 0x12cc7
xor ebx, ebx
add ebx, eax
add eax, 5
mov ecx, 0x22ed8046
sub ecx, 0x12ed8046
add ecx, dword [ebp - 0x48]
call ebx
leave
ret
Function at 0x10017339
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov edx, 0x811c9dc5
xor ecx, ecx
movzx eax, byte [esp + ecx + 4]
xor eax, edx
imul edx, eax, 0x1000193
inc ecx
cmp ecx, 4
jb 0x10017340
mov eax, edx
ret 4
Function at 0x10025cf8
Capabilities:
Generate random numbers via winapi

Disassembly:
push 0xd8
mov eax, 0x1023e39b
call fcn.10236073
mov edi, dword [ebp + 0xc]
xor ebx, ebx
mov esi, dword [ebp + 8]
mov dword [ebp - 0xc0], esi
test edi, edi
jne 0x10025d26
mov dword [esi], ebx
mov dword [esi + 4], ebx
mov dword [esi + 8], ebx
jmp 0x10025de8
xorps xmm0, xmm0
mov dword [ebp - 0xc4], ebx
movups xmmword [ebp - 0xe4], xmm0
movups xmmword [ebp - 0xd4], xmm0
push ebx
push ebx
push 0x10261b60
lea eax, [ebp - 0xe4]
mov dword [ebp - 4], ebx
push eax
call sub.bcrypt.dll_BCryptOpenAlgorithmProvider
mov dword [ebp - 0xc0], eax
test eax, eax
js 0x10025df0
lea eax, [ebp - 0xb9]
mov byte [ebp - 0xb9], bl
push eax
push edi
lea ecx, [ebp - 0x1c]
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x14], ebx
call fcn.1000899b
mov eax, dword [ebp - 0x18]
mov edi, dword [ebp - 0x1c]
sub eax, edi
push ebx
push eax
push edi
push dword [ebp - 0xe4]
mov byte [ebp - 4], 3
call sub.bcrypt.dll_BCryptGenRandom
mov ebx, eax
test ebx, ebx
jns 0x10025dcf
push str.InternalError
lea ecx, [ebp - 0x40]
lfence
call fcn.100047be
push ebx
lea eax, [ebp - 0x58]
mov byte [ebp - 4], 4
push str.BCryptRandomBytes:_BCrypt_Failed_to_generate_random_data____08x
push eax
call fcn.1000d1e8
add esp, 0xc
mov byte [ebp - 4], 5
lea ecx, [ebp - 0x40]
jmp 0x10025e22
mov eax, dword [ebp - 0x18]
lea ecx, [ebp - 0xe4]
mov dword [esi + 4], eax
mov eax, dword [ebp - 0x14]
mov dword [esi], edi
mov dword [esi + 8], eax
call fcn.10024f53
mov eax, esi
call fcn.10236022
ret
push str.InternalError
lea ecx, [ebp - 0x28]
lfence
call fcn.100047be
push dword [ebp - 0xc0]
lea eax, [ebp - 0x40]
mov byte [ebp - 4], 1
push str.BCryptRandomBytes:_BCrypt_Failed_to_open_random_number_generator_algorithm_provider____08x
push eax
call fcn.1000d1e8
add esp, 0xc
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x28]
push ecx
push eax
lea ecx, [ebp - 0xb8]
call fcn.1014ecdb
push 0x102e88c4
lea eax, [ebp - 0xb8]
push eax
call sub.VCRUNTIME140.dll__CxxThrowException
int3
Function at 0x1004d5d2
Capabilities:
Encode data using base64

Disassembly:
push 0x14
mov eax, 0x102488ec
call fcn.10236040
xor ebx, ebx
mov dword [ebp - 0x20], ebx
mov esi, dword [ebp + 8]
mov dword [esi], ebx
mov dword [esi + 4], ebx
mov dword [esi + 8], ebx
mov eax, dword [ebp + 0x10]
xor edx, edx
push 3
pop ecx
div ecx
mov ecx, esi
mov dword [ebp - 4], ebx
shl eax, 2
push eax
mov dword [ebp - 0x20], 1
call fcn.1004d8ee
mov eax, dword [ebp + 0x10]
mov edi, ebx
mov word [ebp - 0x14], bx
mov byte [ebp - 0x12], bl
test eax, eax
je 0x1004d797
push 3
pop ecx
mov edx, dword [ebp + 0xc]
dec eax
mov dword [ebp + 0x10], eax
mov al, byte [edx]
mov byte [ebp + edi - 0x14], al
inc edi
mov ah, byte [ebp - 0x12]
inc edx
mov dword [ebp + 0xc], edx
mov dl, byte [ebp - 0x13]
mov dh, byte [ebp - 0x14]
mov byte [ebp - 0x10], ah
mov byte [ebp - 0xe], dl
mov byte [ebp - 0xf], dh
cmp edi, ecx
jne 0x1004d6ba
mov al, dh
mov cl, dh
shr al, 2
and cl, 3
mov byte [ebp - 0x18], al
mov edi, ebx
shl cl, 4
mov al, dl
shr al, 4
add cl, al
mov al, ah
mov byte [ebp - 0x17], cl
mov cl, dl
and cl, 0xf
shr al, 6
shl cl, 2
add cl, al
and ah, 0x3f
mov byte [ebp - 0x16], cl
mov byte [ebp - 0x15], ah
movzx eax, byte [ebp + edi - 0x18]
mov cl, byte [eax + 0x10265c10]
mov eax, dword [esi + 4]
mov byte [ebp - 0xd], cl
cmp eax, dword [esi + 8]
je 0x1004d69d
mov byte [eax], cl
inc dword [esi + 4]
jmp 0x1004d6a9
lea ecx, [ebp - 0xd]
push ecx
push eax
mov ecx, esi
call fcn.1000d3dc
inc edi
cmp edi, 4
jl 0x1004d680
mov dl, byte [ebp - 0xe]
mov edi, ebx
mov dh, byte [ebp - 0xf]
push 3
pop ecx
mov eax, dword [ebp + 0x10]
test eax, eax
jne 0x1004d624
mov dword [ebp - 0x1c], edi
test edi, edi
je 0x1004d797
mov eax, edi
cmp edi, ecx
jge 0x1004d6f2
cmp eax, ecx
jae 0x1004d79f
mov byte [ebp + eax - 0x14], bl
inc eax
cmp eax, ecx
jl 0x1004d6d8
mov ah, byte [ebp - 0x12]
mov dl, byte [ebp - 0x13]
mov dh, byte [ebp - 0x14]
jmp 0x1004d6f5
mov ah, byte [ebp - 0x10]
mov al, dh
and dh, 3
shr al, 2
mov byte [ebp - 0x18], al
mov al, dl
shr al, 4
and dl, 0xf
shl dh, 4
add dh, al
shl dl, 2
mov al, ah
mov byte [ebp - 0x17], dh
shr al, 6
and ah, 0x3f
add dl, al
mov byte [ebp - 0x15], ah
lea eax, [edi + 1]
mov byte [ebp - 0x16], dl
mov dword [ebp - 0x14], eax
test eax, eax
jle 0x1004d763
mov edi, eax
movzx eax, byte [ebp + ebx - 0x18]
mov cl, byte [eax + 0x10265c10]
mov eax, dword [esi + 4]
mov byte [ebp - 0x10], cl
cmp eax, dword [esi + 8]
je 0x1004d74c
mov byte [eax], cl
inc dword [esi + 4]
jmp 0x1004d758
lea ecx, [ebp - 0x10]
push ecx
push eax
mov ecx, esi
call fcn.1000d3dc
inc ebx
cmp ebx, edi
jl 0x1004d72f
mov edi, dword [ebp - 0x1c]
push 3
pop ecx
cmp edi, ecx
jge 0x1004d797
sub ecx, edi
mov byte [ebp - 0x10], 0x3d
mov dword [ebp - 0x1c], ecx
mov eax, dword [esi + 4]
cmp eax, dword [esi + 8]
je 0x1004d780
mov byte [eax], 0x3d
inc dword [esi + 4]
jmp 0x1004d78f
lea ecx, [ebp - 0x10]
push ecx
push eax
mov ecx, esi
call fcn.1000d3dc
mov ecx, dword [ebp - 0x1c]
sub ecx, 1
mov dword [ebp - 0x1c], ecx
jne 0x1004d770
mov eax, esi
call fcn.1023600e
ret
call fcn.1014ecdb
int3
Function at 0x1004d9b7
Capabilities:
Create thread

Disassembly:
push 8
mov eax, 0x1024896e
call fcn.10236040
mov edi, ecx
push dword [ebp + 8]
lea eax, [ebp - 0x10]
push eax
call fcn.1004da61
pop ecx
pop ecx
xor ecx, ecx
mov ebx, dword [eax]
mov dword [eax], ecx
mov dword [ebp - 0x14], ebx
mov dword [ebp - 4], ecx
cmp dword [ebp - 0x10], ecx
je 0x1004d9f1
push dword [ebp - 0x10]
lea ecx, [ebp - 0x10]
call fcn.1004db4d
xor ecx, ecx
lea esi, [edi + 4]
push esi
push ecx
push ebx
push 0x1004d960
push ecx
push ecx
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
add esp, 0x18
mov dword [edi], eax
test eax, eax
je 0x1004da15
call fcn.1023600e
ret 4
and dword [esi], 0
push 6
call sub.msvcp140.dll_void___cdecl_std::_Throw_Cpp_error_int_
int3

Function at 0x1004e90d
Capabilities:
Create thread

Disassembly:
push 8
mov eax, 0x10248cc4
call fcn.10236040
mov edi, ecx
push dword [ebp + 0xc]
lea eax, [ebp - 0x10]
push dword [ebp + 8]
push eax
call fcn.1004e97b
xor ecx, ecx
add esp, 0xc
mov ebx, dword [eax]
mov dword [eax], ecx
mov dword [ebp - 0x14], ebx
mov dword [ebp - 4], ecx
cmp dword [ebp - 0x10], ecx
je 0x1004e94c
push 8
push dword [ebp - 0x10]
call fcn.1014ecdb
pop ecx
pop ecx
xor ecx, ecx
lea esi, [edi + 4]
push esi
push ecx
push ebx
push 0x1004e8b0
push ecx
push ecx
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
add esp, 0x18
mov dword [edi], eax
test eax, eax
je 0x1004e970
call fcn.1023600e
ret 8
and dword [esi], 0
push 6
call sub.msvcp140.dll_void___cdecl_std::_Throw_Cpp_error_int_
int3

Function at 0x10051588
Capabilities:
Move file

Disassembly:
push 0x34
mov eax, 0x10249546
call fcn.10236073
mov eax, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
push eax
lea eax, [ebp - 0x40]
push eax
call fcn.10056d14
mov edi, eax
and dword [ebp - 4], 0
lea eax, [ebp - 0x28]
push esi
push eax
call fcn.10056d14
add esp, 0x10
cmp dword [edi + 0x14], 8
jb 0x100515bf
mov edi, dword [edi]
cmp dword [eax + 0x14], 8
jb 0x100515c7
mov eax, dword [eax]
push edi
push eax
call dword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll__wrename]
pop ecx
pop ecx
lea ecx, [ebp - 0x28]
mov esi, eax
call fcn.100486a0
lea ecx, [ebp - 0x40]
call fcn.100486a0
mov eax, esi
call fcn.10236022
ret
Function at 0x10051930
Capabilities:
Write file on windows

Disassembly:
sub esp, 0x30
mov eax, dword [0x1030fff4]
xor eax, esp
mov dword [esp + 0x2c], eax
push ebx
mov ebx, dword [esp + 0x38]
push esi
push edi
or edi, 0xffffffff
mov esi, ecx
cmp ebx, edi
jne 0x10051955
xor eax, eax
jmp 0x10051a1d
mov eax, dword [esi + 0x20]
cmp dword [eax], 0
je 0x10051977
mov edx, dword [esi + 0x30]
mov edx, dword [edx]
add edx, dword [eax]
cmp dword [eax], edx
jae 0x10051977
call dword [sym.imp.msvcp140.dll_protected:_char____thiscall_std::basic_streambuf_char__struct_std::char_traits_char__::_Pninc_void_]
mov byte [eax], bl
mov eax, ebx
jmp 0x10051a1d
cmp dword [esi + 0x4c], 0
push ebp
je 0x10051a1a
call fcn.10051791
mov ecx, dword [esi + 0x38]
mov al, bl
test ecx, ecx
jne 0x100519a2
push dword [esi + 0x4c]
push eax
call fcn.10051323
test al, al
pop ecx
pop ecx
cmovne edi, ebx
jmp 0x10051a1a
mov byte [esp + 0x10], al
lea eax, [esp + 0x14]
push eax
lea eax, [esp + 0x40]
push eax
lea eax, [esp + 0x24]
push eax
lea eax, [esp + 0x24]
push eax
lea eax, [esp + 0x21]
push eax
lea eax, [esp + 0x24]
push eax
lea eax, [esi + 0x40]
push eax
call dword [sym.imp.msvcp140.dll_public:_int___thiscall_std::codecvt_char__char__struct__Mbstatet_::out_struct__Mbstatet___char_const___char_const___char_const____char___char___char___const]
sub eax, 0
je 0x100519e7
sub eax, 1
je 0x100519e7
dec eax
sub eax, 1
jne 0x10051a1a
push dword [esi + 0x4c]
push dword [esp + 0x14]
jmp 0x10051994
mov ebp, dword [esp + 0x14]
lea eax, [esp + 0x1c]
sub ebp, eax
je 0x10051a0a
lfence
push dword [esi + 0x4c]
push ebp
push 1
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
add esp, 0x10
cmp ebp, eax
jne 0x10051a1a
lea eax, [esp + 0x10]
mov byte [esi + 0x3d], 1
cmp dword [esp + 0x18], eax
mov eax, ebx
jne 0x10051a1c
mov eax, edi
pop ebp
mov ecx, dword [esp + 0x38]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.10236000
add esp, 0x30
ret 4