joyce8/EMBER2024-capa huggingface dataset:
Function at 0x44158c
Capabilities:
Set thread local storage value

Disassembly:
push esi
push 0x158
push 8
push dword [0x4a4e34]
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov esi, eax
push esi
push dword [0x4a5c8c]
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
push dword [esp + 8]
mov dword [0x4a5c90], esi
and dword [esi + 0x88], 0
or dword [esi + 0x8c], 0xffffffff
or dword [esi + 0x90], 0xffffffff
push esi
mov dword [esi + 0x84], 0xffffff
mov dword [esi + 0x6c], 2
mov dword [esi + 0x70], 0x3f
call fcn.00447611
mov dword [esi + 0x58], 0x44150b
mov dword [esi + 0x5c], 0x44154a
mov dword [esi + 0x10], fcn.004406a9
mov dword [esi + 0x30], 0x44082e
mov dword [esi + 0x64], 0x440937
mov dword [esi + 0x60], 0x440984
mov dword [esi + 0x34], 0x4410aa
mov dword [esi + 0x24], 0x440f49
mov dword [esi + 0x28], 0x440f72
mov dword [esi + 0x2c], 0x440f9d
mov dword [esi + 0x44], 0x44139b
mov eax, esi
pop esi
ret 4

Function at 0x442a74
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
cmp dword [ebp + 0x1c], 0
mov ecx, dword [esi + 0xb4]
mov dword [ebp - 4], ecx
je 0x442ae9
imul ecx, dword [ebp + 0x10]
mov dword [ebp + 0x10], eax
mov eax, dword [ebp + 0xc]
imul eax, dword [ebp + 0x14]
add eax, dword [ebp + 8]
push ebx
lea edx, [eax + edx*4]
push edi
mov eax, dword [esi + 0xac]
imul eax, dword [ebp + 0x10]
add eax, dword [esi + 0xa8]
mov edi, edx
add eax, ecx
cmp dword [ebp + 0x18], 0
jle 0x442ad8
mov ebx, dword [ebp + 0x18]
mov dword [ebp + 0x14], ebx
mov bl, byte [edi + 2]
xor byte [eax + 2], bl
mov bl, byte [edi + 1]
xor byte [eax + 1], bl
mov bl, byte [edi]
xor byte [eax], bl
add eax, dword [ebp - 4]
add edi, 4
dec dword [ebp + 0x14]
jne 0x442abd
dec dword [ebp + 0x1c]
add edx, dword [ebp + 0xc]
inc dword [ebp + 0x10]
cmp dword [ebp + 0x1c], 0
jne 0x442a9d
pop edi
pop ebx
leave
ret 0x18

Function at 0x4438ae
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
cmp dword [ebp + 0x20], 0
mov edx, dword [esi + 0xb4]
je 0x44392e
push ebx
imul eax, eax, 3
push edi
mov edi, dword [ebp + 0x14]
mov ecx, edx
imul ecx, dword [ebp + 0x10]
mov dword [ebp + 0x10], edi
mov edi, dword [ebp + 0xc]
imul edi, dword [ebp + 0x18]
add edi, dword [ebp + 8]
add eax, edi
mov edi, eax
mov dword [ebp + 0x18], eax
mov eax, dword [esi + 0xac]
imul eax, dword [ebp + 0x10]
add eax, dword [esi + 0xa8]
add eax, ecx
cmp dword [ebp + 0x1c], 0
jle 0x443917
mov ebx, dword [ebp + 0x1c]
mov dword [ebp + 0x14], ebx
mov bl, byte [edi + 2]
xor byte [eax + 2], bl
mov bl, byte [edi + 1]
xor byte [eax + 1], bl
mov bl, byte [edi]
xor byte [eax], bl
add edi, 3
add eax, edx
dec dword [ebp + 0x14]
jne 0x4438fd
mov edi, dword [ebp + 0x18]
add edi, dword [ebp + 0xc]
dec dword [ebp + 0x20]
inc dword [ebp + 0x10]
cmp dword [ebp + 0x20], 0
mov dword [ebp + 0x18], edi
jne 0x4438df
pop edi
pop ebx
pop ebp
ret 0x1c
Function at 0x443988
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
imul eax, eax, 3
cmp dword [ebp + 0x1c], 0
mov dword [ebp - 4], eax
je 0x443a22
mov eax, dword [ebp + 0x14]
imul ecx, ecx, 3
mov dword [ebp + 0x14], eax
mov eax, dword [ebp + 0x10]
imul eax, dword [ebp + 0x18]
add eax, dword [ebp + 0xc]
push ebx
push esi
mov esi, edx
imul esi, esi, 3
add ecx, eax
push edi
mov edi, ecx
mov dword [ebp + 0xc], ecx
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0xac]
imul ecx, dword [ebp + 0x14]
add ecx, dword [eax + 0xa8]
mov edx, dword [ebp - 4]
add ecx, esi
test edx, edx
jle 0x443a0a
mov eax, 0xff
sub eax, dword [ebp + 0x20]
mov dword [ebp + 0x18], edx
mov dword [ebp - 8], eax
movzx eax, byte [ecx]
movzx edx, byte [edi]
imul eax, dword [ebp - 8]
imul edx, dword [ebp + 0x20]
add eax, edx
cdq
mov ebx, 0xff
idiv ebx
inc edi
mov byte [ecx], al
inc ecx
dec dword [ebp + 0x18]
jne 0x4439e9
mov edi, dword [ebp + 0xc]
add edi, dword [ebp + 0x10]
dec dword [ebp + 0x1c]
inc dword [ebp + 0x14]
cmp dword [ebp + 0x1c], 0
mov dword [ebp + 0xc], edi
jne 0x4439bf
pop edi
pop esi
pop ebx
leave
ret 0x1c
Function at 0x401219
Capabilities:
Terminate process

Disassembly:
mov eax, dword fs:[0]
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x40401c
push 0x40109a
push eax
mov dword fs:[0], esp
sub esp, 0x10
push ebx
push esi
push edi
mov dword [ebp - 0x18], esp
push eax
fnstcw word [esp]
or word [esp], 0x300
fldcw word [esp]
add esp, 4
push 0
push 0
push 0x404028
push 0x404024
push 0x404020
call sub.CRTDLL.DLL___GetMainArgs
push dword [0x404028]
push dword [0x404024]
push dword [0x404020]
mov dword [0x404014], esp
call fcn.004024a8
add esp, 0x18
xor ecx, ecx
mov dword [ebp - 4], ecx
push eax
call sub.CRTDLL.DLL_exit
leave
ret

Function at 0x401493
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push 8
push 0x80ce0000
push 0x1b8
push 0x12c
push 0
push 0
push str.Active_Window_Info__Shift_Alt_Tab_to_freeze_display_
call fcn.004013d2
mov dword [0x403020], eax
lea eax, [ebp - 0x10]
push eax
push dword [0x403020]
call sub.USER32.DLL_GetClientRect
push 0xffffffffffffffff
push 0x503308c4
mov eax, dword [ebp - 4]
sub eax, dword [ebp - 0xc]
push eax
mov eax, dword [ebp - 8]
sub eax, dword [ebp - 0x10]
push eax
push 0
push 0
push 0
push dword [0x403020]
push 0x4043b4
call fcn.0040142f
mov dword [section..bss], eax
push dword [0x403020]
call fcn.00401357
add esp, 0x44
push 5
push dword [0x403020]
call sub.USER32.DLL_ShowWindow
push 0
push 0x1f4
push 1
push dword [0x403020]
call sub.USER32.DLL_SetTimer
leave
ret
Function at 0x4021c7
Capabilities:
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x8d0
push ebx
push esi
push edi
push 0
push 0
push 0x406
push dword [ebp + 8]
call sub.USER32.DLL_SendMessageA
mov dword [ebp - 0x8c4], eax
push 0x94
push 0
lea eax, [ebp - 0x8c0]
push eax
call sub.CRTDLL.DLL_memset
add esp, 0xc
mov dword [ebp - 0x8c0], 0x94
lea eax, [ebp - 0x8c0]
push eax
call sub.KERNEL32.DLL_GetVersionExA
xor edi, edi
inc edi
jmp 0x4023a6
cmp dword [ebp - 0x8b0], 2
jne 0x4022d6
lea eax, [ebp - 0x8c8]
push eax
push dword [ebp + 8]
call sub.USER32.DLL_GetWindowThreadProcessId
push dword [ebp - 0x8c8]
push 0
push 0x38
call sub.KERNEL32.DLL_OpenProcess
mov ebx, eax
push str.kernel32.dll
call sub.KERNEL32.DLL_GetModuleHandleA
push str.VirtualAllocEx
push eax
call sub.KERNEL32.DLL_GetProcAddress
mov dword [ebp - 0x8cc], eax
push 4
push 0x3000
push 0x400
push 0
push ebx
call dword [ebp - 0x8cc]
mov esi, eax
push esi
mov eax, edi
dec eax
push eax
push 0x402
push dword [ebp + 8]
call sub.USER32.DLL_SendMessageA
push 0
push 0x400
lea eax, [ebp - 0x825]
push eax
push esi
push ebx
call sub.KERNEL32.DLL_ReadProcessMemory
push str.kernel32.dll
call sub.KERNEL32.DLL_GetModuleHandleA
push str.VirtualFreeEx
push eax
call sub.KERNEL32.DLL_GetProcAddress
mov dword [ebp - 0x8d0], eax
push 0x8000
push 0
push esi
push ebx
call dword [ebp - 0x8d0]
push ebx
call sub.KERNEL32.DLL_CloseHandle
jmp 0x40233b
push 0
push 0x400
push 0
push 4
push 0
push 0xffffffffffffffff
call sub.KERNEL32.DLL_CreateFileMappingA
mov dword [ebp - 0x82c], eax
push 0
push 0
push 0
push 0xf001f
push eax
call sub.KERNEL32.DLL_MapViewOfFile
mov esi, eax
push esi
mov eax, edi
dec eax
push eax
push 0x402
push dword [ebp + 8]
call sub.USER32.DLL_SendMessageA
push 0x400
push esi
lea eax, [ebp - 0x825]
push eax
call sub.CRTDLL.DLL_memcpy
add esp, 0xc
push esi
call sub.KERNEL32.DLL_UnmapViewOfFile
push dword [ebp - 0x82c]
call sub.KERNEL32.DLL_CloseHandle
mov eax, dword [0x40301c]
cmp byte [eax], 0
jne 0x40236d
lea eax, [ebp - 0x825]
push eax
push 0x4040af
push edi
push 0x4040b3
push str._s_d_s_s
lea eax, [ebp - 0x424]
push eax
call sub.CRTDLL.DLL_sprintf
add esp, 0x18
jmp 0x402398
lea eax, [ebp - 0x825]
push eax
push 0x4040af
push edi
push 0x4040b3
push 0x404094
push str._s_s_d_s_s
lea eax, [ebp - 0x424]
push eax
call sub.CRTDLL.DLL_sprintf
add esp, 0x1c
lea eax, [ebp - 0x424]
push eax
call fcn.004017b9
pop ecx
inc edi
cmp edi, dword [ebp - 0x8c4]
jle 0x40221e
pop edi
pop esi
pop ebx
leave
ret
Function at 0x4024a8
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
push ecx
push edi
call sub.KERNEL32.DLL_GetCommandLineA
mov edi, eax
cmp byte [edi], 0x22
jne 0x4024dc
push 0x22
mov eax, edi
inc eax
push eax
call sub.CRTDLL.DLL_strchr
add esp, 8
mov dword [ebp - 4], eax
or eax, eax
je 0x4024f7
mov edi, eax
inc edi
jmp 0x4024d4
inc edi
cmp byte [edi], 0x20
je 0x4024d3
jmp 0x4024f7
inc edi
movsx eax, byte [edi]
or eax, eax
je 0x4024e8
cmp eax, 0x20
jne 0x4024db
jmp 0x4024eb
inc edi
movsx eax, byte [edi]
or eax, eax
je 0x4024f7
cmp eax, 0x20
je 0x4024ea
push 0
call sub.KERNEL32.DLL_GetModuleHandleA
push 1
push edi
push 0
push eax
call fcn.0040129c
pop edi
leave
ret

Function at 0x10044ef4
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
pushal
call 0x10044f03
pop dword [ebp - 0x10]
mov eax, 0x22ccb672
sub eax, 0x12c8676f
sub dword [ebp - 0x10], eax
mov dword [ebp - 0x20], 0xd2786627
add dword [ebp - 0x20], 0x7bd9df24
mov dword [ebp - 0x1c], 0x7ce20b4c
add dword [ebp - 0x1c], 0xb55140f9
mov dword [ebp - 0x18], 0x31ace270
add dword [ebp - 0x18], 0x1a9f61be
mov dword [ebp - 0x14], 0xd49ff5c4
sub dword [ebp - 0x14], 0xd49ff5c4
lea eax, [ebp - 0x20]
push eax
mov eax, 0x919f2721
add eax, 0x7e65f9ef
add eax, dword [ebp - 0x10]
call dword [eax]
mov dword [ebp - 0x20], 0x24ba4d7f
sub dword [ebp - 0x20], 0xb047e429
mov dword [ebp - 0x1c], 0xa317e7b4
sub dword [ebp - 0x1c], 0x61ab863f
mov dword [ebp - 0x18], 0x1aebd4b7
sub dword [ebp - 0x18], 0xb77c684b
mov dword [ebp - 0x14], 0x3504b953
add dword [ebp - 0x14], 0xcafb46ad
lea ebx, [ebp - 0x20]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x10]
call dword [eax]
push 0x40
push 0x1000
push 0x5d7da
push 0
call eax
mov ecx, 0x5083
xor edi, edi
add edi, eax
mov ebx, 0x10061000
add ebx, dword [ebp - 0x10]
mov edx, 0x1d1d7e73
sub dword [ebp - 8], 0x980dd0ae
mov esi, dword [ebx]
add dword [ebp - 4], esi
xor esi, edx
xor dword [ebp - 8], edi
mov dword [edi], esi
sub dword [ebp - 0xc], edx
add edi, 0x97597e3d
add edi, 0x68a681c7
add ebx, 4
loop 0x10045010
add eax, 0xc4846be8
add eax, 0x3b7cc8f7
xor ebx, ebx
add ebx, eax
add eax, 0xaf42b6cd
add eax, 0x50bd4938
mov ecx, 0xa58c0021
add ecx, 0x6a73ffdf
add ecx, dword [ebp - 0x10]
call ebx
leave
ret
Function at 0x401000
Capabilities:
Link many functions at runtime

Disassembly:
push esi
push edi
push str.ntdll.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, eax
push str.NtDelayExecution
push esi
call edi
mov dword [0x40303c], eax
test eax, eax
jne 0x40102e
pop edi
mov eax, 0xc0000034
pop esi
ret
push str.NtWaitForSingleObject
push esi
call edi
mov dword [0x403044], eax
test eax, eax
je 0x401026
push str.NtQuerySystemTime
push esi
call edi
mov dword [0x40308c], eax
test eax, eax
je 0x401026
push str.NtMapViewOfSection
push esi
call edi
mov dword [0x403088], eax
test eax, eax
je 0x401026
push str.NtUnmapViewOfSection
push esi
call edi
mov dword [0x403048], eax
neg eax
sbb eax, eax
and eax, 0x3fffffcc
pop edi
add eax, 0xc0000034
pop esi
ret
Function at 0x70012b7
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
pushal
call 0x70012c6
pop dword [ebp - 8]
mov eax, 0x79e1a039
add eax, 0x8d1e728d
sub dword [ebp - 8], eax
mov dword [ebp - 0x18], 0x7abbb9d2
sub dword [ebp - 0x18], 0x2c697487
mov dword [ebp - 0x14], 0xcfc0b420
sub dword [ebp - 0x14], 0x9d8d67db
mov dword [ebp - 0x10], 0x4b3b0f3b
add dword [ebp - 0x10], 0x11134f3
mov dword [ebp - 0xc], 0xe3dcaa3f
sub dword [ebp - 0xc], 0xe3dcaa3f
lea eax, [ebp - 0x18]
push eax
mov eax, sym.imp.kernel32.dll_GetModuleHandleA
add eax, dword [ebp - 8]
call dword [eax]
mov dword [ebp - 0x18], 0xd607d954
add dword [ebp - 0x18], 0x9e6a9002
mov dword [ebp - 0x14], 0xc471518c
add dword [ebp - 0x14], 0x7cfb0fe9
mov dword [ebp - 0x10], 0xca42c7ce
add dword [ebp - 0x10], 0x992ca49e
mov dword [ebp - 0xc], 0xe219aac3
sub dword [ebp - 0xc], 0xe219aac3
lea ebx, [ebp - 0x18]
push ebx
push eax
mov eax, 0xdf5c7d61
sub eax, 0xd85b4d2d
add eax, dword [ebp - 8]
call dword [eax]
push 0x40
push 0x1000
push 0x3ab5b
push 0
call eax
mov ecx, 0xdee4d0ee
sub ecx, 0xdee48865
xor esi, esi
add esi, eax
mov edi, 0x7020200
add edi, dword [ebp - 8]
mov edx, 0x3f35e891
add dword [ebp - 4], 0x6f39d963
mov ebx, dword [edi]
xor ebx, edx
xor dword [ebp - 4], edi
mov dword [esi], ebx
add esi, 4
add edi, 4
loop 0x70013d9
add eax, 0xe10cd060
add eax, 0x1ef44497
mov ebx, eax
add eax, 5
mov ecx, 0x7000000
add ecx, dword [ebp - 8]
call ebx
leave
ret

Function at 0x700d29f
Capabilities:
Set current directory

Disassembly:
push 8
mov eax, 0x70120f1
call fcn.07001cf8
mov edi, ecx
mov dword [ebp - 0x14], edi
mov esi, dword [ebp + 8]
push esi
call fcn.0700d491
xor ebx, ebx
mov dword [edi], vtable.FileSharedStream.0
mov dword [edi + 0xc], ebx
mov byte [edi + 0x10], bl
mov eax, dword [esi + 0x14]
mov dword [edi + 0x14], eax
lea eax, [edi + 0x18]
push eax
mov dword [ebp - 4], ebx
call dword [sym.imp.kernel32.dll_InitializeCriticalSection]
mov ecx, esi
mov byte [ebp - 4], 1
call fcn.0700dd8a
lea ecx, [ebp - 0x10]
call fcn.0700d23c
mov eax, dword [edi + 0x14]
mov byte [ebp - 4], 2
push dword [eax + 0x14]
call dword [sym.imp.kernel32.dll_SetCurrentDirectoryA]
mov eax, dword [edi + 0x14]
mov eax, dword [eax + 0xc]
test eax, eax
je 0x700d30c
mov eax, dword [eax + 0x14]
jmp 0x700d311
mov eax, 0x70138c2
push 0x7015240
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fopen]
mov dword [edi + 0xc], eax
pop ecx
pop ecx
test eax, eax
je 0x700d343
mov ecx, dword [edi + 4]
call fcn.070076d1
lea ecx, [ebp - 0x10]
mov dword [edi + 8], eax
call fcn.070012b7
mov eax, edi
call fcn.07001ea7
ret 4
push str.file_does_not_exist
push ebx
call fcn.070012b7
int3
Function at 0x10001110
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
movzx eax, byte [0x1004ea70]
mov byte [0x1004ff38], al
movzx eax, byte [0x1004ea71]
mov byte [0x1004ff39], al
movzx eax, byte [0x1004ea72]
mov byte [0x1004ff3a], al
movzx eax, byte [0x1004ea73]
mov byte [0x1004ff3b], al
movzx eax, byte [0x1004ea74]
mov byte [0x1004ff3c], al
movzx eax, byte [0x1004ea75]
mov byte [0x1004ff3d], al
movzx eax, byte [0x1004ea76]
mov byte [0x1004ff3e], al
movzx eax, byte [0x1004ea77]
mov byte [0x1004ff3f], al
movzx eax, byte [0x1004ea78]
mov byte [0x1004ff40], al
movzx eax, byte [0x1004ea79]
mov byte [0x1004ff41], al
movzx eax, byte [0x1004ea7a]
mov byte [0x1004ff42], al
movzx eax, byte [0x1004ea7b]
mov byte [0x1004ff43], al
movzx eax, byte [0x1004ea7c]
mov byte [0x1004ff44], al
movzx eax, byte [0x1004ea7d]
mov byte [0x1004ff45], al
movzx eax, byte [0x1004ea7e]
mov byte [0x1004ff46], al
movzx eax, byte [0x1004ea7f]
mov byte [0x1004ff47], al
mov ebx, 4
mov eax, 0x1004ff45
nop
mov cl, byte [eax]
mov dl, byte [eax - 1]
mov ch, cl
mov dh, byte [eax + 2]
mov byte [ebp - 2], cl
mov cl, byte [eax + 1]
mov byte [ebp - 1], cl
test bl, 3
jne 0x10001237
movzx ecx, cl
mov cl, byte [ecx + 0x10045790]
mov byte [ebp - 4], cl
movzx ecx, dh
mov cl, byte [ecx + 0x10045790]
mov byte [ebp - 1], cl
movzx ecx, dl
mov edx, ebx
shr edx, 2
mov cl, byte [ecx + 0x10045790]
mov dl, byte [edx + 0x10045590]
mov byte [ebp - 3], cl
movzx ecx, byte [ebp - 2]
mov dh, byte [ebp - 3]
xor dl, byte [ecx + 0x10045790]
mov ch, byte [ebp - 4]
mov cl, byte [eax - 0xd]
inc ebx
xor cl, dl
mov byte [eax + 3], cl
mov cl, byte [eax - 0xc]
xor cl, ch
mov byte [eax + 4], cl
mov cl, byte [eax - 0xb]
xor cl, byte [ebp - 1]
mov byte [eax + 5], cl
mov cl, byte [eax - 0xa]
xor cl, dh
mov byte [eax + 6], cl
add eax, 4
cmp ebx, 0x2c
jb 0x100011e0
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10001bc0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1003726d
mov eax, dword fs:[0]
push eax
sub esp, 0x34
mov eax, dword [0x1004e01c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 0xc]
mov eax, dword [ebp + 8]
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x40], eax
cmp dword [esi + 0x14], 0x10
mov dword [ebp - 0x34], esi
jb 0x10001c04
mov eax, dword [esi]
mov dword [ebp - 0x34], eax
mov esi, dword [esi + 0x10]
lea eax, [esi + esi]
push eax
call fcn.10019bc8
mov dword [ebp - 0x3c], eax
mov ecx, esi
mov eax, esi
and eax, 0xf
sub ecx, eax
add ecx, 0x10
push ecx
mov dword [ebp - 0x38], ecx
call fcn.10019bc8
push esi
push dword [ebp - 0x34]
mov edi, eax
push edi
mov dword [ebp - 0x30], edi
call fcn.1001b020
mov eax, dword [ebp - 0x38]
sub eax, esi
push eax
lea eax, [edi + esi]
push 0
push eax
call fcn.1001b5a0
mov cl, byte [ebp - 0x38]
add esp, 0x20
mov eax, dword [ebp - 0x3c]
and cl, 0xf
mov esi, dword [ebp - 0x30]
mov edi, eax
mov byte [ebp - 0x29], cl
sub esi, eax
mov ecx, eax
mov edx, 0x10
mov al, byte [esi + ecx]
lea ecx, [ecx + 1]
mov byte [ecx - 1], al
sub edx, 1
jne 0x10001c65
mov eax, edi
mov dword [0x1004ffe8], 0x1004ea70
mov dword [0x1004ff34], eax
call fcn.10001110
mov eax, dword [ebp - 0x38]
mov esi, 0x1004ea60
mov ecx, dword [ebp - 0x30]
mov dword [0x1004ffec], esi
test eax, eax
je 0x10001d03
dec eax
shr eax, 4
inc eax
mov dword [ebp - 0x34], eax
mov eax, ecx
sub esi, ecx
mov edx, 0x10
nop
mov cl, byte [esi + eax]
lea eax, [eax + 1]
xor byte [eax - 1], cl
sub edx, 1
jne 0x10001cb0
mov esi, dword [ebp - 0x30]
mov ecx, edi
sub esi, edi
mov edx, 0x10
nop word [eax + eax]
mov al, byte [esi + ecx]
lea ecx, [ecx + 1]
mov byte [ecx - 1], al
sub edx, 1
jne 0x10001cd0
mov dword [0x1004ff34], edi
call fcn.10001270
mov ecx, dword [ebp - 0x30]
mov esi, edi
add ecx, 0x10
add edi, 0x10
sub dword [ebp - 0x34], 1
mov dword [ebp - 0x30], ecx
jne 0x10001ca6
mov dword [0x1004ffec], esi
mov ah, byte [ebp - 0x29]
test ah, ah
je 0x10001d44
mov edx, edi
sub ecx, edi
mov esi, 0x10
mov al, byte [edx + ecx]
lea edx, [edx + 1]
mov byte [edx - 1], al
sub esi, 1
jne 0x10001d13
movzx ecx, ah
mov eax, 0x10
sub eax, ecx
push eax
push esi
lea eax, [ecx + edi]
push eax
call fcn.1001b5a0
add esp, 0xc
mov dword [0x1004ff34], edi
call fcn.10001270
push dword [ebp - 0x38]
lea eax, [ebp - 0x28]
push dword [ebp - 0x3c]
push eax
call fcn.10001620
mov eax, dword [ebp - 0x40]
movups xmm0, xmmword [ebp - 0x28]
mov dword [eax], 0
mov dword [eax + 0x10], 0
mov dword [eax + 0x14], 0
movups xmmword [eax], xmm0
movq xmm0, qword [ebp - 0x18]
movq qword [eax + 0x10], xmm0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.10019642
mov esp, ebp
pop ebp
ret 0x10
Function at 0x10017150
Capabilities:
Access peb ldr_data
Get process heap force flags

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100390bd
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x1004e01c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, ecx
mov dword [ebp - 0x10], eax
push 8
mov dword [eax], vtable.std::basic_streambuf_char__struct_std::char_traits_char__.0
call fcn.10019681
mov esi, eax
xorps xmm0, xmm0
movq qword [esi], xmm0
push 1
mov dword [ebp - 4], 0
call fcn.100189a5
mov dword [esi + 4], eax
add esp, 8
mov eax, dword [ebp - 0x10]
lea edi, [eax + 0x14]
lea ecx, [eax + 0x18]
lea edx, [eax + 0x24]
mov dword [eax + 0x34], esi
lea ebx, [eax + 4]
mov dword [eax + 0xc], ebx
lea esi, [eax + 8]
mov dword [eax + 0x10], esi
mov dword [eax + 0x1c], edi
mov dword [eax + 0x20], ecx
mov dword [eax + 0x2c], edx
add eax, 0x28
mov dword [ebp - 0x14], ebx
mov ebx, dword [ebp - 0x10]
mov dword [ebx + 0x30], eax
mov ebx, dword [ebp - 0x14]
mov dword [esi], 0
mov dword [ecx], 0
mov dword [eax], 0
mov dword [ebx], 0
mov dword [edi], 0
mov dword [edx], 0
mov esi, dword [ebp + 8]
mov dword [ebp - 4], 1
mov ebx, dword [ebp - 0x10]
mov dword [ebp + 8], esi
mov dword [ebx], vtable.std::basic_stringbuf_char__struct_std::char_traits_char___class_std::allocator_char__.0
cmp dword [esi + 0x14], 0x10
jb 0x1001721f
mov eax, dword [esi]
mov dword [ebp + 8], eax
mov esi, dword [esi + 0x10]
xor eax, eax
cmp esi, 0x7fffffff
ja 0x100172c3
test esi, esi
je 0x100172a7
cmp esi, 0x1000
jb 0x1001725f
lea eax, [esi + 0x23]
cmp eax, esi
jbe 0x100172c8
push eax
call fcn.10019681
add esp, 4
test eax, eax
je 0x100172cd
lea edi, [eax + 0x23]
and edi, 0xffffffe0
mov dword [edi - 4], eax
jmp 0x1001726a
push esi
call fcn.10019681
add esp, 4
mov edi, eax
push esi
push dword [ebp + 8]
push edi
call fcn.1001b020
mov eax, dword [ebx + 0xc]
lea ecx, [edi + esi]
mov dword [ebx + 0x38], ecx
add esp, 0xc
mov dword [eax], edi
mov eax, dword [ebx + 0x1c]
mov dword [eax], edi
mov eax, dword [ebx + 0x2c]
mov dword [eax], esi
mov eax, dword [ebx + 0x10]
mov ecx, dword [ebx + 0x38]
sub ecx, edi
mov dword [eax], edi
mov eax, dword [ebx + 0x20]
mov dword [eax], edi
mov eax, dword [ebx + 0x30]
mov dword [eax], ecx
mov eax, 1
jmp 0x100172aa
mov dword [ebx + 0x38], eax
mov dword [ebx + 0x3c], eax
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
call fcn.100182d8
call fcn.10001570
call fcn.1001dfdf
int3
Function at 0x100229b1
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, 0x101c
call fcn.1001a5a0
mov eax, dword [0x1004e01c]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x14]
push ebx
push dword [ebp + 8]
mov dword [ebp - 0x100c], eax
call fcn.10028551
pop ecx
mov ecx, dword [ebp + 8]
mov ebx, eax
cmp dword [ecx + 8], 0
jne 0x100229f3
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 0x10]
jmp 0x10022b4f
mov eax, dword [ecx]
sub eax, dword [ecx + 4]
push esi
push edi
push 0
cdq
push 2
push edx
push eax
call fcn.10036d40
push dword [ebp - 0x100c]
mov ecx, ebx
mov dword [ebp - 0x1008], eax
mov esi, ebx
mov dword [ebp - 0x1018], edx
and ecx, 0x3f
sar esi, 6
imul edi, ecx, 0x38
push 0
mov eax, dword [esi*4 + 0x1004fa10]
push dword [edi + eax + 0x24]
push dword [edi + eax + 0x20]
push ebx
call fcn.10028ec3
mov ecx, dword [esi*4 + 0x1004fa10]
add esp, 0x14
mov dword [ebp - 0x1010], eax
mov eax, edx
mov edx, dword [ebp - 0x1010]
mov dword [ebp - 0x101c], eax
cmp edx, dword [edi + ecx + 0x20]
jne 0x10022b48
cmp eax, dword [edi + ecx + 0x24]
jne 0x10022b48
push 0
lea eax, [ebp - 0x1014]
push eax
push 0x1000
lea eax, [ebp - 0x1004]
push eax
push dword [edi + ecx + 0x18]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x10022b48
push dword [ebp - 0x100c]
push 0
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push ebx
call fcn.10028ec3
add esp, 0x14
test edx, edx
jl 0x10022b48
jg 0x10022abe
test eax, eax
jb 0x10022b48
mov ebx, dword [ebp - 0x1018]
mov eax, dword [ebp - 0x1014]
test ebx, ebx
jg 0x10022b48
jl 0x10022ad8
cmp dword [ebp - 0x1008], eax
ja 0x10022b48
lea edi, [ebp - 0x1004]
xor edx, edx
add edi, eax
lea ecx, [ebp - 0x1004]
xor esi, esi
cmp dword [ebp - 0x1008], edx
jne 0x10022af6
test ebx, ebx
je 0x10022b2f
cmp ecx, edi
jae 0x10022b2f
mov al, byte [ecx]
cmp al, 0xd
jne 0x10022b10
lea eax, [edi - 1]
cmp ecx, eax
jae 0x10022b1c
cmp byte [ecx + 1], 0xa
jne 0x10022b1c
inc ecx
jmp 0x10022b1c
movzx eax, al
movsx eax, byte [eax + 0x1004e298]
add ecx, eax
add esi, 1
adc edx, 0
inc ecx
cmp esi, dword [ebp - 0x1008]
jne 0x10022af6
cmp edx, ebx
jne 0x10022af6
lea eax, [ebp - 0x1004]
sub ecx, eax
mov eax, ecx
cdq
add eax, dword [ebp - 0x1010]
adc edx, dword [ebp - 0x101c]
jmp 0x10022b4d
or edx, 0xffffffff
mov eax, edx
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop ebx
call fcn.10019642
leave
ret