joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10196270
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, dword [ebp + 0xc]
xor ecx, ecx
cmp dword [esi + 0x14], 0x10
push edi
mov dword [ebp - 4], ecx
mov dword [esi + 0x10], ecx
jb 0x1019628b
mov eax, dword [esi]
jmp 0x1019628d
mov eax, esi
mov edi, dword [ebp + 8]
mov byte [eax], cl
cmp edi, ecx
je 0x1019636b
xor eax, eax
cmp byte [edi], 0x5c
jne 0x101962ac
cmp byte [edi + 1], 0x5c
jne 0x101962ac
mov eax, 2
push ebx
mov byte [ebp + 0xf], cl
mov ebx, eax
mov al, byte [ebx + edi]
mov byte [ebp + 8], al
cmp al, 0x2f
je 0x101962c6
cmp al, 0x5c
je 0x101962c6
mov byte [ebp + 0xf], 0
jmp 0x101962d4
cmp byte [ebp + 0xf], 0
jne 0x1019630d
test ebx, ebx
jle 0x101962d4
mov byte [ebp + 0xf], 1
test al, al
je 0x10196310
mov edx, dword [esi + 0x14]
cmp edx, 0x10
jb 0x101962e4
mov ecx, dword [esi]
jmp 0x101962e6
mov ecx, esi
mov eax, dword [esi + 0x10]
add eax, ecx
cmp edx, 0x10
jb 0x101962f4
mov ecx, dword [esi]
jmp 0x101962f6
mov ecx, esi
test eax, eax
je 0x101962fc
sub eax, ecx
mov ecx, dword [ebp + 8]
push ecx
push 1
push eax
mov ecx, esi
call fcn.101663b0
inc dword [ebp - 4]
inc ebx
jmp 0x101962b2
cmp dword [ebp - 4], 0
jle 0x1019636a
mov ecx, dword [esi + 0x14]
cmp ecx, 0x10
jb 0x10196322
mov eax, dword [esi]
jmp 0x10196324
mov eax, esi
mov bl, byte [ebp + 0x10]
mov edi, dword [ebp - 4]
cmp byte [eax + edi - 1], bl
je 0x1019636a
cmp ecx, 0x10
jb 0x10196339
mov eax, dword [esi]
jmp 0x1019633b
mov eax, esi
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x1019636a
test al, 0x10
je 0x1019636a
mov ecx, 0x10
cmp dword [esi + 0x14], ecx
jb 0x10196359
mov eax, dword [esi]
jmp 0x1019635b
mov eax, esi
mov byte [eax + edi], bl
cmp dword [esi + 0x14], ecx
jb 0x10196365
mov esi, dword [esi]
mov byte [esi + edi + 1], 0
pop ebx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x10197240
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x101b2c75
mov eax, dword fs:[0]
push eax
sub esp, 0x20
mov eax, dword [0x10415990]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov esi, edx
mov dword [ebp - 0x2c], esi
call fcn.10167810
cmp byte [eax + 0x4c], 0
je case.0x101972bd.0
test byte [0x10455eec], 1
jne 0x101972af
or dword [0x10455eec], 1
mov ecx, 0x10455e48
mov dword [ebp - 4], 0
call fcn.10169320
push 0x101b4cc0
call fcn.1015f6af
add esp, 4
cmp byte [0x10455e4a], 0
je case.0x101972bd.0
cmp edi, 3
ja case.0x101972bd.0
jmp dword [edi*4 + 0x1019738c]
mov edi, 3
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
lea ecx, [ebp - 0x28]
mov esi, eax
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetConsoleScreenBufferInfo]
movzx ebx, word [ebp - 0x20]
call sub.MSVCR100.dll___iob_func
add eax, 0x40
push eax
call sub.MSVCR100.dll_fflush
mov eax, edi
add esp, 4
dec eax
je 0x10197331
dec eax
je 0x1019732a
dec eax
je 0x10197323
xor eax, eax
jmp 0x10197336
mov edi, 1
jmp 0x101972c9
call sub.MSVCR100.dll___iob_func
add eax, 0x40
push eax
mov eax, dword [ebp + 8]
push 1
push eax
push esi
call sub.MSVCR100.dll_fwrite
add esp, 0x10
jmp 0x10197370
mov eax, 6
jmp 0x10197336
mov eax, 2
jmp 0x10197336
mov eax, 4
mov edi, dword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
or eax, 8
push eax
push esi
call edi
call sub.MSVCR100.dll___iob_func
mov edx, dword [ebp + 8]
add eax, 0x40
push eax
mov eax, dword [ebp - 0x2c]
push 1
push edx
push eax
call sub.MSVCR100.dll_fwrite
call sub.MSVCR100.dll___iob_func
add eax, 0x40
push eax
call sub.MSVCR100.dll_fflush
add esp, 0x14
push ebx
push esi
call edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1015eea7
mov esp, ebp
pop ebp
ret
Function at 0x101972c4
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x101b2c75
mov eax, dword fs:[0]
push eax
sub esp, 0x20
mov eax, dword [0x10415990]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov esi, edx
mov dword [ebp - 0x2c], esi
call fcn.10167810
cmp byte [eax + 0x4c], 0
je case.0x101972bd.0
test byte [0x10455eec], 1
jne 0x101972af
or dword [0x10455eec], 1
mov ecx, 0x10455e48
mov dword [ebp - 4], 0
call fcn.10169320
push 0x101b4cc0
call fcn.1015f6af
add esp, 4
cmp byte [0x10455e4a], 0
je case.0x101972bd.0
cmp edi, 3
ja case.0x101972bd.0
jmp dword [edi*4 + 0x1019738c]
mov edi, 3
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
lea ecx, [ebp - 0x28]
mov esi, eax
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetConsoleScreenBufferInfo]
movzx ebx, word [ebp - 0x20]
call sub.MSVCR100.dll___iob_func
add eax, 0x40
push eax
call sub.MSVCR100.dll_fflush
mov eax, edi
add esp, 4
dec eax
je 0x10197331
dec eax
je 0x1019732a
dec eax
je 0x10197323
xor eax, eax
jmp 0x10197336
mov edi, 1
jmp 0x101972c9
call sub.MSVCR100.dll___iob_func
add eax, 0x40
push eax
mov eax, dword [ebp + 8]
push 1
push eax
push esi
call sub.MSVCR100.dll_fwrite
add esp, 0x10
jmp 0x10197370
mov eax, 6
jmp 0x10197336
mov eax, 2
jmp 0x10197336
mov eax, 4
mov edi, dword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
or eax, 8
push eax
push esi
call edi
call sub.MSVCR100.dll___iob_func
mov edx, dword [ebp + 8]
add eax, 0x40
push eax
mov eax, dword [ebp - 0x2c]
push 1
push edx
push eax
call sub.MSVCR100.dll_fwrite
call sub.MSVCR100.dll___iob_func
add eax, 0x40
push eax
call sub.MSVCR100.dll_fflush
add esp, 0x14
push ebx
push esi
call edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1015eea7
mov esp, ebp
pop ebp
ret
Function at 0x10197302
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x101b2c75
mov eax, dword fs:[0]
push eax
sub esp, 0x20
mov eax, dword [0x10415990]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov esi, edx
mov dword [ebp - 0x2c], esi
call fcn.10167810
cmp byte [eax + 0x4c], 0
je case.0x101972bd.0
test byte [0x10455eec], 1
jne 0x101972af
or dword [0x10455eec], 1
mov ecx, 0x10455e48
mov dword [ebp - 4], 0
call fcn.10169320
push 0x101b4cc0
call fcn.1015f6af
add esp, 4
cmp byte [0x10455e4a], 0
je case.0x101972bd.0
cmp edi, 3
ja case.0x101972bd.0
jmp dword [edi*4 + 0x1019738c]
mov edi, 3
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
lea ecx, [ebp - 0x28]
mov esi, eax
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetConsoleScreenBufferInfo]
movzx ebx, word [ebp - 0x20]
call sub.MSVCR100.dll___iob_func
add eax, 0x40
push eax
call sub.MSVCR100.dll_fflush
mov eax, edi
add esp, 4
dec eax
je 0x10197331
dec eax
je 0x1019732a
dec eax
je 0x10197323
xor eax, eax
jmp 0x10197336
mov edi, 1
jmp 0x101972c9
call sub.MSVCR100.dll___iob_func
add eax, 0x40
push eax
mov eax, dword [ebp + 8]
push 1
push eax
push esi
call sub.MSVCR100.dll_fwrite
add esp, 0x10
jmp 0x10197370
mov eax, 6
jmp 0x10197336
mov eax, 2
jmp 0x10197336
mov eax, 4
mov edi, dword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
or eax, 8
push eax
push esi
call edi
call sub.MSVCR100.dll___iob_func
mov edx, dword [ebp + 8]
add eax, 0x40
push eax
mov eax, dword [ebp - 0x2c]
push 1
push edx
push eax
call sub.MSVCR100.dll_fwrite
call sub.MSVCR100.dll___iob_func
add eax, 0x40
push eax
call sub.MSVCR100.dll_fflush
add esp, 0x14
push ebx
push esi
call edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1015eea7
mov esp, ebp
pop ebp
ret
Function at 0x10197309
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x101b2c75
mov eax, dword fs:[0]
push eax
sub esp, 0x20
mov eax, dword [0x10415990]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov esi, edx
mov dword [ebp - 0x2c], esi
call fcn.10167810
cmp byte [eax + 0x4c], 0
je case.0x101972bd.0
test byte [0x10455eec], 1
jne 0x101972af
or dword [0x10455eec], 1
mov ecx, 0x10455e48
mov dword [ebp - 4], 0
call fcn.10169320
push 0x101b4cc0
call fcn.1015f6af
add esp, 4
cmp byte [0x10455e4a], 0
je case.0x101972bd.0
cmp edi, 3
ja case.0x101972bd.0
jmp dword [edi*4 + 0x1019738c]
mov edi, 3
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
lea ecx, [ebp - 0x28]
mov esi, eax
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetConsoleScreenBufferInfo]
movzx ebx, word [ebp - 0x20]
call sub.MSVCR100.dll___iob_func
add eax, 0x40
push eax
call sub.MSVCR100.dll_fflush
mov eax, edi
add esp, 4
dec eax
je 0x10197331
dec eax
je 0x1019732a
dec eax
je 0x10197323
xor eax, eax
jmp 0x10197336
mov edi, 1
jmp 0x101972c9
call sub.MSVCR100.dll___iob_func
add eax, 0x40
push eax
mov eax, dword [ebp + 8]
push 1
push eax
push esi
call sub.MSVCR100.dll_fwrite
add esp, 0x10
jmp 0x10197370
mov eax, 6
jmp 0x10197336
mov eax, 2
jmp 0x10197336
mov eax, 4
mov edi, dword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
or eax, 8
push eax
push esi
call edi
call sub.MSVCR100.dll___iob_func
mov edx, dword [ebp + 8]
add eax, 0x40
push eax
mov eax, dword [ebp - 0x2c]
push 1
push edx
push eax
call sub.MSVCR100.dll_fwrite
call sub.MSVCR100.dll___iob_func
add eax, 0x40
push eax
call sub.MSVCR100.dll_fflush
add esp, 0x14
push ebx
push esi
call edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1015eea7
mov esp, ebp
pop ebp
ret
Function at 0x101999d0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x101b2eb5
mov eax, dword fs:[0]
push eax
sub esp, 0x20
mov eax, dword [0x10415990]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov esi, edx
mov dword [ebp - 0x2c], esi
call fcn.10167810
cmp byte [eax + 0x4c], 0
je case.0x10199a4d.0
test byte [0x10455eec], 1
jne 0x10199a3f
or dword [0x10455eec], 1
mov ecx, 0x10455e48
mov dword [ebp - 4], 0
call fcn.10169320
push 0x101b4cc0
call fcn.1015f6af
add esp, 4
cmp byte [0x10455e4a], 0
je case.0x10199a4d.0
cmp edi, 3
ja case.0x10199a4d.0
jmp dword [edi*4 + 0x10199b1c]
mov edi, 3
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
lea ecx, [ebp - 0x28]
mov esi, eax
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetConsoleScreenBufferInfo]
movzx ebx, word [ebp - 0x20]
call sub.MSVCR100.dll___iob_func
add eax, 0x40
push eax
call sub.MSVCR100.dll_fflush
mov eax, edi
add esp, 4
dec eax
je 0x10199ac1
dec eax
je 0x10199aba
dec eax
je 0x10199ab3
xor eax, eax
jmp 0x10199ac6
mov edi, 1
jmp 0x10199a59
call sub.MSVCR100.dll___iob_func
add eax, 0x40
push eax
mov eax, dword [ebp + 8]
push 1
push eax
push esi
call sub.MSVCR100.dll_fwrite
add esp, 0x10
jmp 0x10199b00
mov eax, 6
jmp 0x10199ac6
mov eax, 2
jmp 0x10199ac6
mov eax, 4
mov edi, dword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
or eax, 8
push eax
push esi
call edi
call sub.MSVCR100.dll___iob_func
mov edx, dword [ebp + 8]
add eax, 0x40
push eax
mov eax, dword [ebp - 0x2c]
push 1
push edx
push eax
call sub.MSVCR100.dll_fwrite
call sub.MSVCR100.dll___iob_func
add eax, 0x40
push eax
call sub.MSVCR100.dll_fflush
add esp, 0x14
push ebx
push esi
call edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1015eea7
mov esp, ebp
pop ebp
ret
Function at 0x10199a54
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x101b2eb5
mov eax, dword fs:[0]
push eax
sub esp, 0x20
mov eax, dword [0x10415990]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov esi, edx
mov dword [ebp - 0x2c], esi
call fcn.10167810
cmp byte [eax + 0x4c], 0
je case.0x10199a4d.0
test byte [0x10455eec], 1
jne 0x10199a3f
or dword [0x10455eec], 1
mov ecx, 0x10455e48
mov dword [ebp - 4], 0
call fcn.10169320
push 0x101b4cc0
call fcn.1015f6af
add esp, 4
cmp byte [0x10455e4a], 0
je case.0x10199a4d.0
cmp edi, 3
ja case.0x10199a4d.0
jmp dword [edi*4 + 0x10199b1c]
mov edi, 3
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
lea ecx, [ebp - 0x28]
mov esi, eax
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetConsoleScreenBufferInfo]
movzx ebx, word [ebp - 0x20]
call sub.MSVCR100.dll___iob_func
add eax, 0x40
push eax
call sub.MSVCR100.dll_fflush
mov eax, edi
add esp, 4
dec eax
je 0x10199ac1
dec eax
je 0x10199aba
dec eax
je 0x10199ab3
xor eax, eax
jmp 0x10199ac6
mov edi, 1
jmp 0x10199a59
call sub.MSVCR100.dll___iob_func
add eax, 0x40
push eax
mov eax, dword [ebp + 8]
push 1
push eax
push esi
call sub.MSVCR100.dll_fwrite
add esp, 0x10
jmp 0x10199b00
mov eax, 6
jmp 0x10199ac6
mov eax, 2
jmp 0x10199ac6
mov eax, 4
mov edi, dword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
or eax, 8
push eax
push esi
call edi
call sub.MSVCR100.dll___iob_func
mov edx, dword [ebp + 8]
add eax, 0x40
push eax
mov eax, dword [ebp - 0x2c]
push 1
push edx
push eax
call sub.MSVCR100.dll_fwrite
call sub.MSVCR100.dll___iob_func
add eax, 0x40
push eax
call sub.MSVCR100.dll_fflush
add esp, 0x14
push ebx
push esi
call edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1015eea7
mov esp, ebp
pop ebp
ret
Function at 0x10199a92
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x101b2eb5
mov eax, dword fs:[0]
push eax
sub esp, 0x20
mov eax, dword [0x10415990]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov esi, edx
mov dword [ebp - 0x2c], esi
call fcn.10167810
cmp byte [eax + 0x4c], 0
je case.0x10199a4d.0
test byte [0x10455eec], 1
jne 0x10199a3f
or dword [0x10455eec], 1
mov ecx, 0x10455e48
mov dword [ebp - 4], 0
call fcn.10169320
push 0x101b4cc0
call fcn.1015f6af
add esp, 4
cmp byte [0x10455e4a], 0
je case.0x10199a4d.0
cmp edi, 3
ja case.0x10199a4d.0
jmp dword [edi*4 + 0x10199b1c]
mov edi, 3
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
lea ecx, [ebp - 0x28]
mov esi, eax
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetConsoleScreenBufferInfo]
movzx ebx, word [ebp - 0x20]
call sub.MSVCR100.dll___iob_func
add eax, 0x40
push eax
call sub.MSVCR100.dll_fflush
mov eax, edi
add esp, 4
dec eax
je 0x10199ac1
dec eax
je 0x10199aba
dec eax
je 0x10199ab3
xor eax, eax
jmp 0x10199ac6
mov edi, 1
jmp 0x10199a59
call sub.MSVCR100.dll___iob_func
add eax, 0x40
push eax
mov eax, dword [ebp + 8]
push 1
push eax
push esi
call sub.MSVCR100.dll_fwrite
add esp, 0x10
jmp 0x10199b00
mov eax, 6
jmp 0x10199ac6
mov eax, 2
jmp 0x10199ac6
mov eax, 4
mov edi, dword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
or eax, 8
push eax
push esi
call edi
call sub.MSVCR100.dll___iob_func
mov edx, dword [ebp + 8]
add eax, 0x40
push eax
mov eax, dword [ebp - 0x2c]
push 1
push edx
push eax
call sub.MSVCR100.dll_fwrite
call sub.MSVCR100.dll___iob_func
add eax, 0x40
push eax
call sub.MSVCR100.dll_fflush
add esp, 0x14
push ebx
push esi
call edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1015eea7
mov esp, ebp
pop ebp
ret
Function at 0x10199a99
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x101b2eb5
mov eax, dword fs:[0]
push eax
sub esp, 0x20
mov eax, dword [0x10415990]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov esi, edx
mov dword [ebp - 0x2c], esi
call fcn.10167810
cmp byte [eax + 0x4c], 0
je case.0x10199a4d.0
test byte [0x10455eec], 1
jne 0x10199a3f
or dword [0x10455eec], 1
mov ecx, 0x10455e48
mov dword [ebp - 4], 0
call fcn.10169320
push 0x101b4cc0
call fcn.1015f6af
add esp, 4
cmp byte [0x10455e4a], 0
je case.0x10199a4d.0
cmp edi, 3
ja case.0x10199a4d.0
jmp dword [edi*4 + 0x10199b1c]
mov edi, 3
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
lea ecx, [ebp - 0x28]
mov esi, eax
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetConsoleScreenBufferInfo]
movzx ebx, word [ebp - 0x20]
call sub.MSVCR100.dll___iob_func
add eax, 0x40
push eax
call sub.MSVCR100.dll_fflush
mov eax, edi
add esp, 4
dec eax
je 0x10199ac1
dec eax
je 0x10199aba
dec eax
je 0x10199ab3
xor eax, eax
jmp 0x10199ac6
mov edi, 1
jmp 0x10199a59
call sub.MSVCR100.dll___iob_func
add eax, 0x40
push eax
mov eax, dword [ebp + 8]
push 1
push eax
push esi
call sub.MSVCR100.dll_fwrite
add esp, 0x10
jmp 0x10199b00
mov eax, 6
jmp 0x10199ac6
mov eax, 2
jmp 0x10199ac6
mov eax, 4
mov edi, dword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
or eax, 8
push eax
push esi
call edi
call sub.MSVCR100.dll___iob_func
mov edx, dword [ebp + 8]
add eax, 0x40
push eax
mov eax, dword [ebp - 0x2c]
push 1
push edx
push eax
call sub.MSVCR100.dll_fwrite
call sub.MSVCR100.dll___iob_func
add eax, 0x40
push eax
call sub.MSVCR100.dll_fflush
add esp, 0x14
push ebx
push esi
call edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1015eea7
mov esp, ebp
pop ebp
ret
Function at 0x1019bc40
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x101b2f55
mov eax, dword fs:[0]
push eax
sub esp, 0x20
mov eax, dword [0x10415990]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov esi, edx
mov dword [ebp - 0x2c], esi
call fcn.10167810
cmp byte [eax + 0x4c], 0
je case.0x1019bcbd.0
test byte [0x10455eec], 1
jne 0x1019bcaf
or dword [0x10455eec], 1
mov ecx, 0x10455e48
mov dword [ebp - 4], 0
call fcn.10169320
push 0x101b4cc0
call fcn.1015f6af
add esp, 4
cmp byte [0x10455e4a], 0
je case.0x1019bcbd.0
cmp edi, 3
ja case.0x1019bcbd.0
jmp dword [edi*4 + 0x1019bd8c]
mov edi, 3
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
lea ecx, [ebp - 0x28]
mov esi, eax
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetConsoleScreenBufferInfo]
movzx ebx, word [ebp - 0x20]
call sub.MSVCR100.dll___iob_func
add eax, 0x40
push eax
call sub.MSVCR100.dll_fflush
mov eax, edi
add esp, 4
dec eax
je 0x1019bd31
dec eax
je 0x1019bd2a
dec eax
je 0x1019bd23
xor eax, eax
jmp 0x1019bd36
mov edi, 1
jmp 0x1019bcc9
call sub.MSVCR100.dll___iob_func
add eax, 0x40
push eax
mov eax, dword [ebp + 8]
push 1
push eax
push esi
call sub.MSVCR100.dll_fwrite
add esp, 0x10
jmp 0x1019bd70
mov eax, 6
jmp 0x1019bd36
mov eax, 2
jmp 0x1019bd36
mov eax, 4
mov edi, dword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
or eax, 8
push eax
push esi
call edi
call sub.MSVCR100.dll___iob_func
mov edx, dword [ebp + 8]
add eax, 0x40
push eax
mov eax, dword [ebp - 0x2c]
push 1
push edx
push eax
call sub.MSVCR100.dll_fwrite
call sub.MSVCR100.dll___iob_func
add eax, 0x40
push eax
call sub.MSVCR100.dll_fflush
add esp, 0x14
push ebx
push esi
call edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1015eea7
mov esp, ebp
pop ebp
ret
Function at 0x1019bcc4
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x101b2f55
mov eax, dword fs:[0]
push eax
sub esp, 0x20
mov eax, dword [0x10415990]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov esi, edx
mov dword [ebp - 0x2c], esi
call fcn.10167810
cmp byte [eax + 0x4c], 0
je case.0x1019bcbd.0
test byte [0x10455eec], 1
jne 0x1019bcaf
or dword [0x10455eec], 1
mov ecx, 0x10455e48
mov dword [ebp - 4], 0
call fcn.10169320
push 0x101b4cc0
call fcn.1015f6af
add esp, 4
cmp byte [0x10455e4a], 0
je case.0x1019bcbd.0
cmp edi, 3
ja case.0x1019bcbd.0
jmp dword [edi*4 + 0x1019bd8c]
mov edi, 3
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
lea ecx, [ebp - 0x28]
mov esi, eax
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetConsoleScreenBufferInfo]
movzx ebx, word [ebp - 0x20]
call sub.MSVCR100.dll___iob_func
add eax, 0x40
push eax
call sub.MSVCR100.dll_fflush
mov eax, edi
add esp, 4
dec eax
je 0x1019bd31
dec eax
je 0x1019bd2a
dec eax
je 0x1019bd23
xor eax, eax
jmp 0x1019bd36
mov edi, 1
jmp 0x1019bcc9
call sub.MSVCR100.dll___iob_func
add eax, 0x40
push eax
mov eax, dword [ebp + 8]
push 1
push eax
push esi
call sub.MSVCR100.dll_fwrite
add esp, 0x10
jmp 0x1019bd70
mov eax, 6
jmp 0x1019bd36
mov eax, 2
jmp 0x1019bd36
mov eax, 4
mov edi, dword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
or eax, 8
push eax
push esi
call edi
call sub.MSVCR100.dll___iob_func
mov edx, dword [ebp + 8]
add eax, 0x40
push eax
mov eax, dword [ebp - 0x2c]
push 1
push edx
push eax
call sub.MSVCR100.dll_fwrite
call sub.MSVCR100.dll___iob_func
add eax, 0x40
push eax
call sub.MSVCR100.dll_fflush
add esp, 0x14
push ebx
push esi
call edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1015eea7
mov esp, ebp
pop ebp
ret
Function at 0x1019bd02
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x101b2f55
mov eax, dword fs:[0]
push eax
sub esp, 0x20
mov eax, dword [0x10415990]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov esi, edx
mov dword [ebp - 0x2c], esi
call fcn.10167810
cmp byte [eax + 0x4c], 0
je case.0x1019bcbd.0
test byte [0x10455eec], 1
jne 0x1019bcaf
or dword [0x10455eec], 1
mov ecx, 0x10455e48
mov dword [ebp - 4], 0
call fcn.10169320
push 0x101b4cc0
call fcn.1015f6af
add esp, 4
cmp byte [0x10455e4a], 0
je case.0x1019bcbd.0
cmp edi, 3
ja case.0x1019bcbd.0
jmp dword [edi*4 + 0x1019bd8c]
mov edi, 3
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
lea ecx, [ebp - 0x28]
mov esi, eax
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetConsoleScreenBufferInfo]
movzx ebx, word [ebp - 0x20]
call sub.MSVCR100.dll___iob_func
add eax, 0x40
push eax
call sub.MSVCR100.dll_fflush
mov eax, edi
add esp, 4
dec eax
je 0x1019bd31
dec eax
je 0x1019bd2a
dec eax
je 0x1019bd23
xor eax, eax
jmp 0x1019bd36
mov edi, 1
jmp 0x1019bcc9
call sub.MSVCR100.dll___iob_func
add eax, 0x40
push eax
mov eax, dword [ebp + 8]
push 1
push eax
push esi
call sub.MSVCR100.dll_fwrite
add esp, 0x10
jmp 0x1019bd70
mov eax, 6
jmp 0x1019bd36
mov eax, 2
jmp 0x1019bd36
mov eax, 4
mov edi, dword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
or eax, 8
push eax
push esi
call edi
call sub.MSVCR100.dll___iob_func
mov edx, dword [ebp + 8]
add eax, 0x40
push eax
mov eax, dword [ebp - 0x2c]
push 1
push edx
push eax
call sub.MSVCR100.dll_fwrite
call sub.MSVCR100.dll___iob_func
add eax, 0x40
push eax
call sub.MSVCR100.dll_fflush
add esp, 0x14
push ebx
push esi
call edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1015eea7
mov esp, ebp
pop ebp
ret