joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4143c0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x40
mov esi, esp
mov dword [esi + 0x28], ebp
mov edi, ecx
lea eax, [esi + 0x30]
mov dword [eax - 4], esp
mov dword [eax + 8], 0xffffffff
mov dword [eax + 4], 0x44e360
mov ecx, dword fs:[0]
mov dword [eax], ecx
mov dword fs:[0], eax
mov eax, dword [0x7f2594]
mov ecx, dword [0x7f325c]
mov edx, dword fs:[0x2c]
mov ecx, dword [edx + ecx*4]
cmp eax, dword [ecx + 4]
mov dword [esi + 0xc], edi
jg 0x414459
mov eax, dword [0x7f2590]
mov eax, dword [eax + 0x204]
mov dword [esi + 0x38], 0
push edi
call eax
mov ecx, dword [ebp + 8]
mov eax, dword [esi + 0xc]
movups xmm0, xmmword [eax]
movaps xmmword [esi + 0x10], xmm0
movups xmm0, xmmword [ecx]
movups xmmword [eax], xmm0
movaps xmm0, xmmword [esi + 0x10]
movups xmmword [ecx], xmm0
mov ecx, dword [esi + 0x30]
mov dword fs:[0], ecx
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret 4
push 0x7f2594
call fcn.0053e579
add esp, 4
cmp dword [0x7f2594], 0xffffffff
jne 0x414416
mov dword [esi + 0x38], 1
push 0
call fcn.00407a6b
add esp, 4
mov dword [0x7f2590], eax
push 0x7f2594
call fcn.0053e5f3
add esp, 4
mov edi, dword [esi + 0xc]
jmp 0x414416

Function at 0x419dd6
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x20
mov dword [ebp - 0x24], ecx
mov esi, dword [ebp + 8]
lea edi, [ebp - 0x18]
mov dword [edi - 4], esp
mov dword [edi + 8], 0xffffffff
mov dword [edi + 4], 0x44e720
mov eax, dword fs:[0]
mov dword [edi], eax
mov dword fs:[0], edi
push 8
call fcn.0053e4fc
add esp, 4
mov dword [edi + 8], 0
mov dword [ebp - 0x20], eax
mov ecx, eax
push esi
call fcn.0041a006
mov edx, dword [ebp - 0x20]
mov dword [ebp - 0x2c], edx
mov eax, dword [ebp - 0x24]
lea ecx, [eax + 4]
mov dword [ebp - 0x10], 1
xor eax, eax
mov dword [ebp - 0x28], ecx
push ecx
push eax
push edx
push 0x419ea6
push eax
push eax
call fcn.0070868c
add esp, 0x18
mov ecx, dword [ebp - 0x24]
mov dword [ecx], eax
test eax, eax
je 0x419e6a
mov eax, dword [ebp - 0x18]
mov dword fs:[0], eax
add esp, 0x20
pop esi
pop edi
pop ebx
pop ebp
ret 4
mov eax, dword [ebp - 0x28]
mov dword [eax], 0
push 6
call fcn.0053f37d
add esp, 4
nop
push ebp
sub esp, 0x18
add ebp, 0xc
lea ecx, [ebp - 0x2c]
call fcn.00419f64
add esp, 0x18
pop ebp
ret
Function at 0x41ab16
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x20
mov dword [ebp - 0x24], ecx
mov esi, dword [ebp + 8]
lea edi, [ebp - 0x18]
mov dword [edi - 4], esp
mov dword [edi + 8], 0xffffffff
mov dword [edi + 4], 0x44e7b0
mov eax, dword fs:[0]
mov dword [edi], eax
mov dword fs:[0], edi
push 8
call fcn.0053e4fc
add esp, 4
mov dword [edi + 8], 0
mov dword [ebp - 0x20], eax
mov ecx, eax
push esi
call fcn.0041a006
mov edx, dword [ebp - 0x20]
mov dword [ebp - 0x2c], edx
mov eax, dword [ebp - 0x24]
lea ecx, [eax + 4]
mov dword [ebp - 0x10], 1
xor eax, eax
mov dword [ebp - 0x28], ecx
push ecx
push eax
push edx
push 0x41abe6
push eax
push eax
call fcn.0070868c
add esp, 0x18
mov ecx, dword [ebp - 0x24]
mov dword [ecx], eax
test eax, eax
je 0x41abaa
mov eax, dword [ebp - 0x18]
mov dword fs:[0], eax
add esp, 0x20
pop esi
pop edi
pop ebx
pop ebp
ret 4
mov eax, dword [ebp - 0x28]
mov dword [eax], 0
push 6
call fcn.0053f37d
add esp, 4
nop
push ebp
sub esp, 0x18
add ebp, 0xc
lea ecx, [ebp - 0x2c]
call fcn.00419f64
add esp, 0x18
pop ebp
ret

Function at 0x41af34
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x20
mov dword [ebp - 0x24], ecx
mov esi, dword [ebp + 8]
lea edi, [ebp - 0x18]
mov dword [edi - 4], esp
mov dword [edi + 8], 0xffffffff
mov dword [edi + 4], 0x44e7f0
mov eax, dword fs:[0]
mov dword [edi], eax
mov dword fs:[0], edi
push 8
call fcn.0053e4fc
add esp, 4
mov dword [edi + 8], 0
mov dword [ebp - 0x20], eax
mov ecx, eax
push esi
call fcn.0041a006
mov edx, dword [ebp - 0x20]
mov dword [ebp - 0x2c], edx
mov eax, dword [ebp - 0x24]
lea ecx, [eax + 4]
mov dword [ebp - 0x10], 1
xor eax, eax
mov dword [ebp - 0x28], ecx
push ecx
push eax
push edx
push 0x41b004
push eax
push eax
call fcn.0070868c
add esp, 0x18
mov ecx, dword [ebp - 0x24]
mov dword [ecx], eax
test eax, eax
je 0x41afc8
mov eax, dword [ebp - 0x18]
mov dword fs:[0], eax
add esp, 0x20
pop esi
pop edi
pop ebx
pop ebp
ret 4
mov eax, dword [ebp - 0x28]
mov dword [eax], 0
push 6
call fcn.0053f37d
add esp, 4
nop
push ebp
sub esp, 0x18
add ebp, 0xc
lea ecx, [ebp - 0x2c]
call fcn.00419f64
add esp, 0x18
pop ebp
ret
Function at 0x4207da
Capabilities:
Get process heap flags

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x138
mov esi, esp
mov dword [esi + 0x120], ebp
mov edi, ecx
lea eax, [esi + 0x128]
mov dword [eax - 4], esp
mov dword [eax + 8], 0xffffffff
mov dword [eax + 4], 0x44ebb0
mov ecx, dword fs:[0]
mov dword [eax], ecx
mov dword fs:[0], eax
mov eax, dword [0x7f2ac8]
mov ecx, dword [0x7f325c]
mov edx, dword fs:[0x2c]
mov ecx, dword [edx + ecx*4]
cmp eax, dword [ecx + 4]
jg 0x420969
mov dword [esi + 0x130], 0xffffffff
xor ebx, ebx
mov edi, esi
mov ecx, edi
push 0x4209de
push ebx
push 0x79588c
call fcn.0040ad94
lea ecx, [esi + 0x18]
push 0x420b3a
push ebx
push 0x793c3c
call fcn.0040ad94
lea ecx, [esi + 0x30]
push 0x420c3c
push ebx
push str.backup_restore
call fcn.0040ad94
lea ecx, [esi + 0x48]
push 0x420d42
push ebx
push str.backup_save
call fcn.0040ad94
lea ecx, [esi + 0x60]
push 0x420e44
push ebx
push str.backup_load
call fcn.0040ad94
lea ecx, [esi + 0x78]
push 0x420f4a
push ebx
push 0x794f80
call fcn.0040ad94
lea ecx, [esi + 0x90]
push 0x421056
push ebx
push 0x796d67
call fcn.0040ad94
lea ecx, [esi + 0xa8]
push 0x421166
push ebx
push str.async_save
call fcn.0040ad94
lea ecx, [esi + 0xc0]
push 0x4212de
push ebx
push str.async_load
call fcn.0040ad94
lea ecx, [esi + 0xd8]
push 0x421456
push ebx
push 0x7924a0
call fcn.0040ad94
lea ecx, [esi + 0xf0]
push 0x42155c
push ebx
push str.is_backup
call fcn.0040ad94
lea ecx, [esi + 0x108]
push 0x42167c
push ebx
push str.has_backup
call fcn.0040ad94
mov ecx, 0x7f2abc
push 0xc
push edi
push dword [0x7f2ac0]
call fcn.0040b06a
mov eax, dword [esi + 0x128]
mov dword fs:[0], eax
mov eax, 0x7f2abc
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
push 0x7f2ac8
call fcn.0053e579
add esp, 4
cmp dword [0x7f2ac8], 0xffffffff
jne 0x42083a
mov dword [esi + 0x130], 0
mov ecx, edi
call fcn.0040aa42
mov ecx, 0x7f2abc
push eax
call fcn.0040ac04
push 0x401d0e
call fcn.0053e73b
add esp, 4
push 0x7f2ac8
call fcn.0053e5f3
add esp, 4
jmp 0x42083a

Function at 0x421eea
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x20
mov dword [ebp - 0x24], ecx
mov esi, dword [ebp + 8]
lea edi, [ebp - 0x18]
mov dword [edi - 4], esp
mov dword [edi + 8], 0xffffffff
mov dword [edi + 4], 0x44ece0
mov eax, dword fs:[0]
mov dword [edi], eax
mov dword fs:[0], edi
push 8
call fcn.0053e4fc
add esp, 4
mov dword [edi + 8], 0
mov dword [ebp - 0x20], eax
mov ecx, eax
push esi
call fcn.0041a006
mov edx, dword [ebp - 0x20]
mov dword [ebp - 0x2c], edx
mov eax, dword [ebp - 0x24]
lea ecx, [eax + 4]
mov dword [ebp - 0x10], 1
xor eax, eax
mov dword [ebp - 0x28], ecx
push ecx
push eax
push edx
push 0x421fba
push eax
push eax
call fcn.0070868c
add esp, 0x18
mov ecx, dword [ebp - 0x24]
mov dword [ecx], eax
test eax, eax
je 0x421f7e
mov eax, dword [ebp - 0x18]
mov dword fs:[0], eax
add esp, 0x20
pop esi
pop edi
pop ebx
pop ebp
ret 4
mov eax, dword [ebp - 0x28]
mov dword [eax], 0
push 6
call fcn.0053f37d
add esp, 4
nop
push ebp
sub esp, 0x18
add ebp, 0xc
lea ecx, [ebp - 0x2c]
call fcn.00419f64
add esp, 0x18
pop ebp
ret
Function at 0x42228a
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x20
mov dword [ebp - 0x24], ecx
mov esi, dword [ebp + 8]
lea edi, [ebp - 0x18]
mov dword [edi - 4], esp
mov dword [edi + 8], 0xffffffff
mov dword [edi + 4], 0x44ed10
mov eax, dword fs:[0]
mov dword [edi], eax
mov dword fs:[0], edi
push 8
call fcn.0053e4fc
add esp, 4
mov dword [edi + 8], 0
mov dword [ebp - 0x20], eax
mov ecx, eax
push esi
call fcn.0041a006
mov edx, dword [ebp - 0x20]
mov dword [ebp - 0x2c], edx
mov eax, dword [ebp - 0x24]
lea ecx, [eax + 4]
mov dword [ebp - 0x10], 1
xor eax, eax
mov dword [ebp - 0x28], ecx
push ecx
push eax
push edx
push 0x42235a
push eax
push eax
call fcn.0070868c
add esp, 0x18
mov ecx, dword [ebp - 0x24]
mov dword [ecx], eax
test eax, eax
je 0x42231e
mov eax, dword [ebp - 0x18]
mov dword fs:[0], eax
add esp, 0x20
pop esi
pop edi
pop ebx
pop ebp
ret 4
mov eax, dword [ebp - 0x28]
mov dword [eax], 0
push 6
call fcn.0053f37d
add esp, 4
nop
push ebp
sub esp, 0x18
add ebp, 0xc
lea ecx, [ebp - 0x2c]
call fcn.00419f64
add esp, 0x18
pop ebp
ret

Function at 0x42249e
Capabilities:
Check for peb ntglobalflag flag

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x80
mov esi, esp
mov dword [esi + 0x68], ebp
mov dword [esi + 0x20], ecx
lea edi, [esi + 0x70]
mov dword [edi - 4], esp
mov dword [edi + 8], 0xffffffff
mov dword [edi + 4], 0x44ed30
mov eax, dword fs:[0]
mov dword [edi], eax
mov dword fs:[0], edi
xorps xmm0, xmm0
lea ebx, [esi + 0x30]
movsd qword [ebx + 0x10], xmm0
xorps xmm0, xmm0
movaps xmmword [ebx], xmm0
mov ecx, ebx
push 4
push str..bak
call fcn.004051ae
mov dword [edi + 8], 0
lea eax, [esi + 8]
mov ecx, dword [esi + 0x20]
push ebx
push eax
call fcn.00422640
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0xffff
cmp dword [esi + 0x1c], 8
lea eax, [esi + 8]
jb 0x422525
mov eax, dword [esi + 8]
lea ebx, [esi + 0x48]
push 0xffffffffffffffff
push 3
push ebx
push eax
call fcn.00541431
lea edi, [esi + 0x24]
mov dword [edi + 8], eax
mov ecx, edi
push ebx
push eax
call fcn.0041028a
mov eax, dword [edi]
mov ecx, dword [edi + 8]
mov dword [ebx], ecx
mov dword [ebx + 4], 0x727124
test eax, eax
je 0x42255c
cmp eax, 1
setne bl
jmp 0x422562
test ecx, ecx
jne 0x4225bf
xor ebx, ebx
mov eax, dword [esi + 0x1c]
cmp eax, 8
jb 0x42257d
lea eax, [eax*2 + 2]
push eax
push dword [esi + 8]
call fcn.00404bbf
add esp, 8
mov dword [esi + 0x18], 0
mov dword [esi + 0x1c], 7
mov word [esi + 8], 0
mov eax, dword [esi + 0x44]
cmp eax, 8
jb 0x4225ac
lea eax, [eax*2 + 2]
push eax
push dword [esi + 0x30]
call fcn.00404bbf
add esp, 8
mov eax, dword [esi + 0x70]
mov dword fs:[0], eax
mov eax, ebx
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
mov dword [esi + 0x78], 1
lea eax, [esi + 8]
push eax
push ebx
push 0x7924a0
call fcn.004101d4
add esp, 0xc
push ebp
sub esp, 0x10
lea esi, [ebp - 0x7c]
mov ebp, dword [esi + 0x68]
mov eax, dword [esi + 0x1c]
cmp eax, 8
jb 0x4225fd
lea eax, [eax*2 + 2]
push eax
push dword [esi + 8]
call fcn.00404bbf
add esp, 8
mov dword [esi + 0x18], 0
mov dword [esi + 0x1c], 7
mov word [esi + 8], 0
add esp, 0x10
pop ebp
ret
Function at 0x4246ae
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x40
mov esi, esp
mov dword [esi + 0x28], ebp
mov edi, ecx
lea eax, [esi + 0x30]
mov dword [eax - 4], esp
mov dword [eax + 8], 0xffffffff
mov dword [eax + 4], 0x44eea0
mov ecx, dword fs:[0]
mov dword [eax], ecx
mov dword fs:[0], eax
mov eax, dword [edi]
mov eax, dword [eax + 4]
mov ecx, dword [edi + eax + 0xc]
and ecx, 0xfffffffe
xor edx, edx
cmp dword [edi + eax + 0x38], 0
sete dl
shl edx, 2
or edx, ecx
lea ecx, [edi + eax]
push 0
push edx
call fcn.0042517e
lea ecx, [esi + 8]
push 1
push edi
call fcn.00426884
mov eax, dword [edi]
mov ecx, dword [eax + 4]
xor edx, edx
test byte [edi + ecx + 0xc], 6
mov dword [esi + 4], edi
jne 0x424770
mov edx, dword [ebp + 0xc]
mov ecx, dword [edi + ecx + 0x38]
mov edi, dword [ecx]
mov edi, dword [edi + 0x28]
mov dword [esi + 0x38], 2
mov ebx, dword [ebp + 0x10]
lea eax, [esi + 0x10]
push 1
push ebx
push edx
push dword [ebp + 8]
push eax
call edi
movdqu xmm0, xmmword [esi + 0x10]
pshufd xmm1, xmm0, 0xee
paddq xmm1, xmm0
pextrd eax, xmm1, 1
movd ecx, xmm1
and ecx, eax
xor edx, edx
cmp ecx, 0xffffffff
sete dl
add edx, edx
mov edi, dword [esi + 4]
mov eax, dword [edi]
mov ecx, dword [eax + 4]
or edx, dword [edi + ecx + 0xc]
xor eax, eax
cmp dword [edi + ecx + 0x38], 0
sete al
shl eax, 2
or eax, edx
add ecx, edi
mov dword [esi + 0x38], 1
push 0
push eax
call fcn.0042517e
mov eax, dword [esi + 8]
mov ecx, dword [eax]
mov ecx, dword [ecx + 4]
mov ecx, dword [eax + ecx + 0x38]
test ecx, ecx
je 0x4247b7
mov eax, dword [ecx]
mov eax, dword [eax + 8]
mov dword [esi + 0x38], 0
call eax
mov eax, dword [esi + 0x30]
mov dword fs:[0], eax
mov eax, dword [esi + 4]
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret 0xc
Function at 0x4255a0
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x14
mov edi, ecx
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x18]
mov dword [eax - 4], esp
mov dword [eax + 8], 0xffffffff
mov dword [eax + 4], 0x44ef80
mov ecx, dword fs:[0]
mov dword [eax], ecx
mov dword fs:[0], eax
xor ebx, ebx
mov ecx, edi
push ebx
call fcn.0053e98c
mov dword [edi + 4], ebx
mov byte [edi + 8], bl
mov dword [edi + 0xc], ebx
mov byte [edi + 0x10], bl
mov dword [edi + 0x14], ebx
mov word [edi + 0x18], bx
mov dword [edi + 0x1c], ebx
mov word [edi + 0x20], bx
mov dword [edi + 0x24], ebx
mov byte [edi + 0x28], bl
mov dword [edi + 0x2c], ebx
mov byte [edi + 0x30], bl
test esi, esi
mov dword [ebp - 0x20], edi
je 0x42562f
mov dword [ebp - 0x10], 0
push esi
push edi
call fcn.0053ecea
add esp, 8
mov eax, dword [ebp - 0x18]
mov dword fs:[0], eax
mov eax, dword [ebp - 0x20]
add esp, 0x14
pop esi
pop edi
pop ebx
pop ebp
ret 4
mov dword [ebp - 0x10], 0
push str.bad_locale_name
call fcn.0053f44d
add esp, 4
nop
push ebp
sub esp, 8
add ebp, 0xc
mov eax, dword [ebp - 0x20]
mov esi, eax
mov eax, dword [eax + 0x2c]
test eax, eax
je 0x425660
push eax
call fcn.00712486
add esp, 4
mov eax, esi
mov dword [esi + 0x2c], 0
mov eax, dword [esi + 0x24]
test eax, eax
je 0x425679
push eax
call fcn.00712486
add esp, 4
mov eax, esi
mov dword [esi + 0x24], 0
mov eax, dword [esi + 0x1c]
test eax, eax
je 0x425692
push eax
call fcn.00712486
add esp, 4
mov eax, esi
mov dword [esi + 0x1c], 0
mov eax, dword [esi + 0x14]
test eax, eax
je 0x4256ab
push eax
call fcn.00712486
add esp, 4
mov eax, esi
mov dword [esi + 0x14], 0
mov eax, dword [esi + 0xc]
test eax, eax
je 0x4256c4
push eax
call fcn.00712486
add esp, 4
mov eax, esi
mov dword [esi + 0xc], 0
mov eax, dword [esi + 4]
test eax, eax
je 0x4256dd
push eax
call fcn.00712486
add esp, 4
mov ecx, esi
mov dword [esi + 4], 0
call fcn.0053e9bd
add esp, 8
pop ebp
ret
Function at 0x42592a
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x18
lea esi, [ebp - 0x18]
mov dword [esi - 4], esp
mov dword [esi + 8], 0xffffffff
mov dword [esi + 4], 0x44efa0
mov eax, dword fs:[0]
mov dword [esi], eax
mov dword fs:[0], esi
mov dword [ecx], vtable.std::basic_streambuf_char__struct_std::char_traits_char__.0
xorps xmm0, xmm0
movups xmmword [ecx + 4], xmm0
movups xmmword [ecx + 0x14], xmm0
mov dword [ebp - 0x24], ecx
movups xmmword [ecx + 0x24], xmm0
push 8
call fcn.0053e4fc
add esp, 4
mov dword [ebp - 0x20], eax
mov dword [esi + 8], 0
push 1
call fcn.0053eec5
add esp, 4
mov ecx, dword [ebp - 0x20]
mov dword [ecx + 4], eax
mov eax, dword [ebp - 0x24]
mov dword [eax + 0x34], ecx
lea ecx, [eax + 4]
mov dword [eax + 0xc], ecx
lea ecx, [eax + 8]
mov dword [eax + 0x10], ecx
lea ecx, [eax + 0x14]
mov dword [eax + 0x1c], ecx
lea ecx, [eax + 0x18]
mov dword [eax + 0x20], ecx
lea ecx, [eax + 0x24]
mov dword [eax + 0x2c], ecx
lea ecx, [eax + 0x28]
mov dword [eax + 0x30], ecx
xor ecx, ecx
mov dword [eax + 8], ecx
mov dword [eax + 0x18], ecx
mov dword [eax + 0x28], ecx
mov dword [eax + 4], ecx
mov dword [eax + 0x14], ecx
mov dword [eax + 0x24], ecx
mov ecx, dword [ebp - 0x18]
mov dword fs:[0], ecx
add esp, 0x18
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x4259ec
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x20
mov edi, dword [ebp + 8]
mov eax, dword [ebp + 0xc]
lea esi, [ebp - 0x18]
mov dword [esi - 4], esp
mov dword [esi + 8], 0xffffffff
mov dword [esi + 4], 0x44efb0
mov edx, dword fs:[0]
mov dword [esi], edx
mov dword fs:[0], esi
cmp eax, 1
sete byte [ecx + 0x48]
mov byte [ecx + 0x3d], 0
lea eax, [ecx + 4]
mov dword [ecx + 0xc], eax
lea eax, [ecx + 8]
mov dword [ecx + 0x10], eax
lea eax, [ecx + 0x14]
mov dword [ecx + 0x1c], eax
lea eax, [ecx + 0x18]
mov dword [ecx + 0x20], eax
lea eax, [ecx + 0x24]
mov dword [ecx + 0x2c], eax
lea eax, [ecx + 0x28]
mov dword [ecx + 0x30], eax
xor eax, eax
mov dword [ecx + 8], eax
mov dword [ecx + 0x18], eax
mov dword [ecx + 0x28], eax
mov dword [ecx + 4], eax
mov dword [ecx + 0x14], eax
mov dword [ecx + 0x24], eax
test edi, edi
je 0x425aa8
mov dword [ebp - 0x20], ecx
lea ecx, [ebp - 0x2c]
mov dword [ecx], eax
lea edx, [ebp - 0x28]
mov dword [edx], eax
lea esi, [ebp - 0x24]
mov dword [esi], eax
mov dword [ebp - 0x10], eax
push esi
push edx
push ecx
push edi
call fcn.006fe708
add esp, 0x10
mov eax, dword [ebp - 0x24]
mov esi, dword [ebp - 0x28]
mov edx, dword [ebp - 0x2c]
mov ecx, dword [ebp - 0x20]
mov dword [ecx + 0xc], edx
mov dword [ecx + 0x10], edx
mov dword [ecx + 0x1c], esi
mov dword [ecx + 0x20], esi
mov dword [ecx + 0x2c], eax
mov dword [ecx + 0x30], eax
mov edi, dword [ebp + 8]
mov dword [ecx + 0x4c], edi
mov eax, dword [0x7f2b60]
mov edx, dword [0x7f2b64]
mov dword [ecx + 0x44], edx
mov dword [ecx + 0x40], eax
mov dword [ecx + 0x38], 0
mov eax, dword [ebp - 0x18]
mov dword fs:[0], eax
add esp, 0x20
pop esi
pop edi
pop ebx
pop ebp
ret 8
Function at 0x425f24
Capabilities:
Read file on windows

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 8
mov ebx, ecx
mov ecx, dword [esp + 0x24]
mov esi, dword [esp + 0x20]
cmp esi, 1
mov eax, ecx
sbb eax, 0
jl 0x425f53
cmp dword [ebx + 0x38], 0
je 0x425f5c
mov ecx, ebx
add esp, 8
pop esi
pop edi
pop ebx
pop ebp
jmp method.std::basic_streambuf_char__struct_std::char_traits_char__.virtual_32
xor eax, eax
xor edx, edx
jmp 0x426006
mov dword [esp], ecx
mov ebp, dword [esp + 0x1c]
mov eax, dword [ebx + 0x1c]
mov eax, dword [eax]
test eax, eax
mov dword [esp + 4], esi
je 0x425f97
mov ecx, dword [ebx + 0x2c]
mov edi, dword [ecx]
test edi, edi
je 0x425f97
cmp edi, esi
cmovae edi, esi
push edi
push eax
push ebp
call fcn.006fb4d0
add esp, 0xc
add ebp, edi
sub esi, edi
mov eax, dword [ebx + 0x2c]
sub dword [eax], edi
mov eax, dword [ebx + 0x1c]
add dword [eax], edi
cmp dword [ebx + 0x4c], 0
je 0x425ffa
mov eax, dword [ebx + 0xc]
lea ecx, [ebx + 0x3c]
cmp dword [eax], ecx
jne 0x425fbb
mov ecx, dword [ebx + 0x50]
mov edx, dword [ebx + 0x54]
mov dword [eax], ecx
mov eax, dword [ebx + 0x1c]
mov dword [eax], ecx
sub edx, ecx
mov eax, dword [ebx + 0x2c]
mov dword [eax], edx
mov edi, 0xfff
cmp esi, 0x1000
jb 0x425fe1
push dword [ebx + 0x4c]
push edi
push 1
push ebp
call fcn.00712290
add esp, 0x10
add ebp, eax
sub esi, eax
cmp eax, edi
je 0x425fc0
jmp 0x425ffa
test esi, esi
je 0x425ff8
push dword [ebx + 0x4c]
push esi
push 1
push ebp
call fcn.00712290
add esp, 0x10
sub esi, eax
jmp 0x425ffa
xor esi, esi
mov eax, dword [esp + 4]
sub eax, esi
mov edx, dword [esp]
sbb edx, 0
add esp, 8
pop esi
pop edi
pop ebx
pop ebp
ret 0xc
push ebp
push ebx
push edi
push esi
sub esp, 0xc
mov esi, dword [esp + 0x28]
mov edi, dword [esp + 0x24]
cmp edi, 1
mov eax, esi
sbb eax, 0
jl 0x42640e
mov ebx, ecx
mov ebp, dword [esp + 0x20]
mov dword [esp], ecx
mov eax, dword [ebx + 0x1c]
mov eax, dword [eax]
test eax, eax
je 0x4263eb
mov ecx, dword [ebx + 0x2c]
mov ecx, dword [ecx]
test ecx, ecx
jle 0x4263eb
mov dword [esp + 8], ebp
cmp edi, ecx
mov edx, esi
sbb edx, 0
mov edx, esi
mov ebp, edi
jb 0x4263bd
xor edx, edx
mov ebp, ecx
mov dword [esp + 4], edx
push ebp
push eax
mov ebx, dword [esp + 0x10]
push ebx
call fcn.006fb4d0
add esp, 0xc
add ebx, ebp
sub edi, ebp
sbb esi, dword [esp + 4]
mov ecx, dword [esp]
mov eax, dword [ecx + 0x2c]
sub dword [eax], ebp
mov eax, dword [ecx + 0x1c]
add dword [eax], ebp
mov ebp, ebx
mov ebx, ecx
jmp 0x426401
mov eax, dword [ebx]
mov ecx, ebx
call dword [eax + 0x1c]
cmp eax, 0xffffffff
je 0x42640e
mov byte [ebp], al
inc ebp
add edi, 0xffffffff
adc esi, 0xffffffff
mov eax, edi
neg eax
mov eax, 0
sbb eax, esi
jl 0x426396
mov eax, dword [esp + 0x24]
sub eax, edi
mov edx, dword [esp + 0x28]
sbb edx, esi
add esp, 0xc
pop esi
pop edi
pop ebx
pop ebp
ret 0xc
Function at 0x42928c
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x14
mov edi, ecx
lea esi, [ebp - 0x18]
mov dword [esi - 4], esp
mov dword [esi + 8], 0xffffffff
mov dword [esi + 4], 0x44f1a0
mov eax, dword fs:[0]
mov dword [esi], eax
mov dword fs:[0], esi
xorps xmm0, xmm0
movups xmmword [ecx + 0x50], xmm0
movups xmmword [ecx + 0x40], xmm0
movups xmmword [ecx + 0x30], xmm0
movups xmmword [ecx + 0x20], xmm0
movups xmmword [ecx + 0x10], xmm0
movups xmmword [ecx], xmm0
call fcn.00415b50
mov dword [edi], vtable.YamlMulti_class_Product__class_std::filesystem::path_.0
xor eax, eax
mov dword [edi + 0x54], eax
mov dword [ebp - 0x20], edi
mov dword [edi + 0x58], eax
mov dword [esi + 8], eax
push 0x2c
call fcn.0053e4fc
add esp, 4
mov ecx, dword [ebp + 8]
mov dword [eax], eax
mov dword [eax + 4], eax
mov dword [eax + 8], eax
mov word [eax + 0xc], 0x101
mov edx, dword [ebp - 0x20]
mov dword [edx + 0x54], eax
mov dword [edx + 0x5c], 0
mov dword [edx], vtable.sciter::om::rasset_class_Products_.0
mov dword [edx + 0x60], ecx
mov eax, dword [ebp - 0x18]
mov dword fs:[0], eax
mov eax, edx
add esp, 0x14
pop esi
pop edi
pop ebx
pop ebp
ret 4

Function at 0x429346
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x14
mov edi, ecx
lea esi, [ebp - 0x18]
mov dword [esi - 4], esp
mov dword [esi + 8], 0xffffffff
mov dword [esi + 4], 0x44f1b0
mov eax, dword fs:[0]
mov dword [esi], eax
mov dword fs:[0], esi
xorps xmm0, xmm0
movups xmmword [ecx + 0x50], xmm0
movups xmmword [ecx + 0x40], xmm0
movups xmmword [ecx + 0x30], xmm0
movups xmmword [ecx + 0x20], xmm0
movups xmmword [ecx + 0x10], xmm0
movups xmmword [ecx], xmm0
call fcn.00415b50
mov dword [edi], vtable.YamlMulti_struct_Profile__class_std::filesystem::path_.0
xor eax, eax
mov dword [edi + 0x54], eax
mov dword [ebp - 0x20], edi
mov dword [edi + 0x58], eax
mov dword [esi + 8], eax
push 0x2c
call fcn.0053e4fc
add esp, 4
mov ecx, dword [ebp + 8]
mov dword [eax], eax
mov dword [eax + 4], eax
mov dword [eax + 8], eax
mov word [eax + 0xc], 0x101
mov edx, dword [ebp - 0x20]
mov dword [edx + 0x54], eax
mov dword [edx + 0x5c], 0
mov dword [edx], vtable.sciter::om::rasset_class_Profiles_.0
mov dword [edx + 0x60], ecx
mov eax, dword [ebp - 0x18]
mov dword fs:[0], eax
mov eax, edx
add esp, 0x14
pop esi
pop edi
pop ebx
pop ebp
ret 4
Function at 0x42e1b6
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x20
mov dword [ebp - 0x24], ecx
mov esi, dword [ebp + 8]
lea edi, [ebp - 0x18]
mov dword [edi - 4], esp
mov dword [edi + 8], 0xffffffff
mov dword [edi + 4], 0x44f470
mov eax, dword fs:[0]
mov dword [edi], eax
mov dword fs:[0], edi
push 8
call fcn.0053e4fc
add esp, 4
mov dword [edi + 8], 0
mov dword [ebp - 0x20], eax
mov ecx, eax
push esi
call fcn.0041a006
mov edx, dword [ebp - 0x20]
mov dword [ebp - 0x2c], edx
mov eax, dword [ebp - 0x24]
lea ecx, [eax + 4]
mov dword [ebp - 0x10], 1
xor eax, eax
mov dword [ebp - 0x28], ecx
push ecx
push eax
push edx
push 0x42e286
push eax
push eax
call fcn.0070868c
add esp, 0x18
mov ecx, dword [ebp - 0x24]
mov dword [ecx], eax
test eax, eax
je 0x42e24a
mov eax, dword [ebp - 0x18]
mov dword fs:[0], eax
add esp, 0x20
pop esi
pop edi
pop ebx
pop ebp
ret 4
mov eax, dword [ebp - 0x28]
mov dword [eax], 0
push 6
call fcn.0053f37d
add esp, 4
nop
push ebp
sub esp, 0x18
add ebp, 0xc
lea ecx, [ebp - 0x2c]
call fcn.00419f64
add esp, 0x18
pop ebp
ret