joyce8/EMBER2024-capa huggingface dataset:
Function at 0x401868
Capabilities:
Enumerate process modules

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x358
lea eax, [ebp - 0x18]
mov dword [esp], eax
call dbg.verificarGTAExecutado
test eax, eax
jne 0x4018a9
mov dword [esp], 0xc
call dbg.definirCorTexto
mov dword [esp], str.GTA_SA_nao_esta_executado._Nao_e_possivel_mostrar_as_DLLs.
call sym._puts
mov dword [esp], 7
call dbg.definirCorTexto
jmp 0x401a28
mov eax, dword [ebp - 0x18]
mov dword [esp + 4], eax
mov dword [esp], 8
call sym._CreateToolhelp32Snapshot_8
sub esp, 8
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0xffffffff
jne 0x4018f1
mov dword [esp], 0xc
call dbg.definirCorTexto
mov dword [esp], str.Erro_ao_criar_snapshot_de_modulos.
call sym._puts
mov dword [esp], 7
call dbg.definirCorTexto
jmp 0x401a28
mov dword [ebp - 0x23c], 0x224
lea eax, [ebp - 0x23c]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x14]
mov dword [esp], eax
call sym._Module32First_8
sub esp, 8
test eax, eax
je 0x401a1a
mov dword [esp], str.Detectando_DLLs_injetadas...
call sym._puts
mov dword [esp + 4], str..dll
lea eax, [ebp - 0x23c]
add eax, 0x20
mov dword [esp], eax
call sym._strstr
test eax, eax
je 0x4019fa
mov dword [esp + 8], 0x104
lea eax, [ebp - 0x23c]
add eax, 0x20
mov dword [esp + 4], eax
lea eax, [ebp - 0x344]
mov dword [esp], eax
call sym._strncpy
mov eax, dword [ebp - 0x228]
mov dword [ebp - 0x240], eax
mov dword [ebp - 0xc], 0
mov dword [ebp - 0x10], 0
jmp 0x4019d6
mov eax, dword [ebp - 0x10]
imul edx, eax, 0x108
mov eax, dword [ebp + 8]
add eax, edx
mov dword [esp + 4], eax
lea eax, [ebp - 0x344]
mov dword [esp], eax
call sym._strcmp
test eax, eax
jne 0x4019d2
mov edx, dword [ebp - 0x240]
mov eax, dword [ebp - 0x10]
imul ecx, eax, 0x108
mov eax, dword [ebp + 8]
add eax, ecx
mov eax, dword [eax + 0x104]
cmp edx, eax
jne 0x4019d2
mov dword [ebp - 0xc], 1
jmp 0x4019de
add dword [ebp - 0x10], 1
mov eax, dword [ebp - 0x10]
cmp eax, dword [ebp + 0xc]
jb 0x401987
cmp dword [ebp - 0xc], 0
jne 0x4019fa
lea eax, [ebp - 0x344]
mov dword [esp + 4], eax
mov dword [esp], str.Nova_DLL_injetada:__s_n
call sym._printf
lea eax, [ebp - 0x23c]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x14]
mov dword [esp], eax
call sym._Module32Next_8
sub esp, 8
test eax, eax
jne 0x401927
mov eax, dword [ebp - 0x14]
mov dword [esp], eax
call sym._CloseHandle_4
sub esp, 4
leave
ret
Function at 0x401d50
Capabilities:
Terminate thread

Disassembly:
lea ecx, [esp + 4]
and esp, 0xfffffff0
push dword [ecx - 4]
push ebp
mov ebp, esp
push ecx
sub esp, 0x34
call sym.___main
mov dword [ebp - 0xc], 0
mov dword [ebp - 0x10], 0
call dbg.mostrarMenu
call sym.__kbhit
test eax, eax
je case.default.0x401daf
call sym.__getch
mov byte [ebp - 0x11], al
cmp byte [ebp - 0x11], 0
jne 0x401f3f
call sym.__getch
mov byte [ebp - 0x11], al
movsx eax, byte [ebp - 0x11]
sub eax, 0x3b
cmp eax, 4
ja case.default.0x401daf
mov eax, dword [eax*4 + 0x40652c]
jmp eax
mov dword [esp], 0xa
call dbg.definirCorTexto
mov dword [esp], 0
call dbg.verificarGTAExecutado
test eax, eax
je 0x401de5
mov dword [ebp - 0xc], 1
mov dword [esp], str.GTA_SA_esta_executado.
call sym._puts
jmp 0x401f81
mov dword [ebp - 0xc], 0
mov dword [esp], 0xc
call dbg.definirCorTexto
mov dword [esp], str.GTA_SA_nao_esta_executado.
call sym._puts
mov dword [esp], 7
call dbg.definirCorTexto
jmp 0x401f81
cmp dword [ebp - 0xc], 0
je 0x401e2c
call dbg.fecharGTA
mov dword [ebp - 0xc], 0
jmp 0x401f81
mov dword [esp], 0xc
call dbg.definirCorTexto
mov dword [esp], str.O_programa_nao_esta_aberto.
call sym._puts
mov dword [esp], 0x7d0
call sym._Sleep_4
sub esp, 4
call dbg.limparLinhaAtual
jmp 0x401f81
mov dword [esp], 0
call dbg.mostrarModulosGTA
jmp 0x401f81
mov dword [esp], 1
call dbg.mostrarModulosGTA
jmp 0x401f81
cmp dword [ebp - 0x10], 0
jne 0x401f18
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
mov dword [esp + 8], dbg.monitorarInjecaoDLL@4
mov dword [esp + 4], 0
mov dword [esp], 0
call sym._CreateThread_24
sub esp, 0x18
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jne 0x401ef2
mov dword [esp], 0xc
call dbg.definirCorTexto
mov dword [esp], str.Erro_ao_criar_thread_para_monitoramento_de_DLLs.
call sym._puts
mov dword [esp], 7
call dbg.definirCorTexto
jmp 0x401f81
mov dword [esp], 0xa
call dbg.definirCorTexto
mov dword [esp], str.Monitoramento_de_DLLs_injetadas_iniciado.
call sym._puts
mov dword [esp], 7
call dbg.definirCorTexto
jmp 0x401f81
mov dword [esp], 0xc
call dbg.definirCorTexto
mov dword [esp], str.Monitoramento_de_DLLs_ja_esta_em_andamento.
call sym._puts
mov dword [esp], 7
call dbg.definirCorTexto
nop
jmp 0x401f81
cmp byte [ebp - 0x11], 0x1b
jne case.default.0x401daf
mov dword [esp], str.Saindo_do_programa...
call sym._puts
cmp dword [ebp - 0x10], 0
je 0x401f86
mov dword [esp + 4], 0
mov eax, dword [ebp - 0x10]
mov dword [esp], eax
call sym._TerminateThread_8
sub esp, 8
mov eax, dword [ebp - 0x10]
mov dword [esp], eax
call sym._CloseHandle_4
sub esp, 4
jmp 0x401f86
jmp case.default.0x401daf
nop
mov eax, 0
mov ecx, dword [ebp - 4]
leave
lea esp, [ecx - 4]
ret
Function at 0x4025e0
Capabilities:
Get thread local storage value

Disassembly:
push esi
push ebx
sub esp, 0x14
mov dword [esp], 0x408044
call sym._EnterCriticalSection_4
mov ebx, dword [0x40803c]
sub esp, 4
test ebx, ebx
je 0x40262b
nop
mov eax, dword [ebx]
mov dword [esp], eax
call sym._TlsGetValue_4
sub esp, 4
mov esi, eax
call sym._GetLastError_0
test eax, eax
jne 0x402624
test esi, esi
je 0x402624
mov eax, dword [ebx + 4]
mov dword [esp], esi
call eax
mov ebx, dword [ebx + 8]
test ebx, ebx
jne 0x402600
mov dword [esp], 0x408044
call sym._LeaveCriticalSection_4
sub esp, 4
add esp, 0x14
pop ebx
pop esi
ret

Function at 0x402810
Capabilities:
Write file on windows

Disassembly:
push esi
push ebx
sub esp, 0x14
mov eax, dword [sym.imp.msvcrt.dll__iob]
mov dword [esp + 8], 0x17
mov dword [esp + 4], 1
lea esi, [esp + 0x24]
mov dword [esp], str.Mingw_runtime_failure:_n
lea ebx, [eax + 0x40]
mov dword [esp + 0xc], ebx
call sym._fwrite
mov eax, dword [esp + 0x20]
mov dword [esp + 8], esi
mov dword [esp], ebx
mov dword [esp + 4], eax
call sym._vfprintf
call sym._abort
lea esi, [esi]

Function at 0x402860
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
push edi
mov edi, ecx
push esi
push ebx
mov ebx, eax
mov esi, edx
sub esp, 0x4c
lea eax, [esp + 0x24]
mov dword [esp + 8], 0x1c
mov dword [esp], ebx
mov dword [esp + 4], eax
call sym._VirtualQuery_12
sub esp, 0xc
test eax, eax
je 0x402938
mov eax, dword [esp + 0x38]
cmp eax, 0x40
je 0x40289e
cmp eax, 4
jne 0x4028c0
mov dword [esp + 8], edi
mov dword [esp + 4], esi
mov dword [esp], ebx
call sym._memcpy
add esp, 0x4c
pop ebx
pop esi
pop edi
pop ebp
ret
mov eax, dword [esp + 0x30]
lea ebp, [esp + 0x20]
mov dword [esp + 8], 0x40
mov dword [esp + 0xc], ebp
mov dword [esp + 4], eax
mov eax, dword [esp + 0x24]
mov dword [esp], eax
call sym._VirtualProtect_16
sub esp, 0x10
mov edx, dword [esp + 0x38]
mov dword [esp + 8], edi
mov dword [esp + 4], esi
mov dword [esp], ebx
mov dword [esp + 0x1c], edx
call sym._memcpy
mov edx, dword [esp + 0x1c]
cmp edx, 0x40
je 0x4028ae
cmp edx, 4
je 0x4028ae
mov eax, dword [esp + 0x20]
mov dword [esp + 0xc], ebp
mov dword [esp + 8], eax
mov eax, dword [esp + 0x30]
mov dword [esp + 4], eax
mov eax, dword [esp + 0x24]
mov dword [esp], eax
call sym._VirtualProtect_16
sub esp, 0x10
add esp, 0x4c
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp + 8], ebx
mov dword [esp + 4], 0x1c
mov dword [esp], str.__VirtualQuery_failed_for__d_bytes_at_address__p
call fcn.00402810
Function at 0x403890
Capabilities:
Get socket status

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x124
mov eax, dword [0x42000c]
xor eax, esp
mov dword [esp + 0x120], eax
mov eax, dword [ecx + 0x14]
mov edx, dword [ecx + 8]
push ebx
mov ebx, dword [sym.imp.WS2_32.dll_select]
mov dword [esp + 0xc], eax
mov eax, dword [ecx + 0xc]
push esi
mov esi, dword [ecx + 0x10]
mov dword [esp + 0x10], eax
mov eax, dword [ecx + 4]
push edi
mov edi, dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
mov dword [esp + 0x1c], eax
mov dword [esp + 0x24], eax
mov dword [esp + 0x20], 1
mov dword [esp + 0x10], edx
mov dword [esp + 0x14], esi
lea ecx, [esp + 0x10]
inc eax
push ecx
push 0
push 0
lea ecx, [esp + 0x2c]
push ecx
push eax
call ebx
mov esi, eax
test esi, esi
jns 0x40390f
call edi
cmp dword [eax], 4
jne 0x40390d
mov eax, dword [esp + 0x1c]
jmp 0x4038e8
test esi, esi
mov ecx, dword [esp + 0x12c]
setg al
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.00416887
mov esp, ebp
pop ebp
ret

Function at 0x4039e0
Capabilities:
Resolve dns

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x494
mov eax, dword [0x42000c]
xor eax, esp
mov dword [esp + 0x490], eax
push ebx
mov ebx, dword [ebp + 8]
lea eax, [esp + 4]
push esi
mov esi, dword [ebp + 0xc]
push edi
push eax
lea eax, [esp + 0x14]
mov dword [esp + 0x10], 0x80
push eax
push dword [ecx + 4]
call dword [sym.imp.WS2_32.dll_getpeername]
test eax, eax
jne 0x403aa9
mov ax, word [esp + 0x10]
mov edi, dword [esp + 0xc]
cmp ax, 2
je 0x403a3b
cmp ax, 0x17
jne 0x403a4a
push dword [esp + 0x12]
call dword [sym.imp.WS2_32.dll_ntohs]
movzx eax, ax
mov dword [esi], eax
push 0x401
lea eax, [esp + 0x94]
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
lea eax, [esp + 0x90]
push 2
push 0
push 0
push 0x401
push eax
push edi
lea eax, [esp + 0x28]
push eax
call dword [sym.imp.WS2_32.dll_getnameinfo]
test eax, eax
jne 0x403aa9
lea edx, [esp + 0x90]
lea esi, [edx + 1]
nop
mov al, byte [edx]
inc edx
test al, al
jne 0x403a90
sub edx, esi
lea eax, [esp + 0x90]
push edx
push eax
mov ecx, ebx
call fcn.0040aaf0
mov ecx, dword [esp + 0x49c]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.00416887
mov esp, ebp
pop ebp
ret 8
Function at 0x403c50
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x417b80
mov eax, dword fs:[0]
push eax
sub esp, 8
push esi
push edi
mov eax, dword [0x42000c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x10], edi
mov dword [edi + 0x10], 0
mov dword [edi + 0x14], 0xf
mov byte [edi], 0
mov dword [ebp - 4], 0
mov dword [edi + 0x28], 0
mov dword [edi + 0x2c], 0xf
mov byte [edi + 0x18], 0
lea esi, [edi + 0x30]
mov byte [ebp - 4], 1
push 0x40
mov dword [ebp - 0x14], esi
mov dword [esi], 0
mov dword [esi + 4], 0
call fcn.00416aa1
mov dword [eax], eax
mov dword [eax + 4], eax
mov dword [eax + 8], eax
mov word [eax + 0xc], 0x101
mov dword [esi], eax
mov dword [edi + 0x48], 0
mov dword [edi + 0x4c], 0xf
mov byte [edi + 0x38], 0
mov dword [edi + 0x60], 0
mov dword [edi + 0x64], 0xf
mov byte [edi + 0x50], 0
mov dword [edi + 0x68], 0xffffffff
mov dword [edi + 0x7c], 0
mov dword [edi + 0x80], 0xf
mov byte [edi + 0x6c], 0
mov dword [edi + 0x94], 0
mov dword [edi + 0x98], 0xf
mov byte [edi + 0x84], 0
lea esi, [edi + 0x9c]
mov byte [ebp - 4], 6
push 0x40
mov dword [ebp - 0x14], esi
mov dword [esi], 0
mov dword [esi + 4], 0
call fcn.00416aa1
mov dword [eax], eax
mov dword [eax + 4], eax
mov dword [eax + 8], eax
mov word [eax + 0xc], 0x101
mov dword [esi], eax
lea esi, [edi + 0xa4]
mov byte [ebp - 4], 7
push 0x88
mov dword [ebp - 0x14], esi
mov dword [esi], 0
mov dword [esi + 4], 0
call fcn.00416aa1
add esp, 0xc
mov dword [eax], eax
mov dword [eax + 4], eax
mov dword [eax + 8], eax
mov word [eax + 0xc], 0x101
mov dword [esi], eax
mov dword [edi + 0xac], 0
mov dword [edi + 0xb0], 0
mov dword [edi + 0xb4], 0
mov dword [edi + 0xb8], 0
mov byte [edi + 0xbc], 0
mov dword [edi + 0xc0], 0
mov dword [edi + 0xc4], 0
mov dword [edi + 0xc8], 0
mov dword [edi + 0xcc], 0
mov dword [edi + 0xd0], 0
mov byte [edi + 0xd4], 0
mov dword [edi + 0xd8], 0
mov dword [edi + 0xdc], 0
mov byte [edi + 0xe0], 0
mov dword [edi + 0xe4], 0
mov dword [edi + 0xe8], 0
mov byte [edi + 0xec], 0
mov eax, edi
mov dword [edi + 0x114], 0
mov dword [edi + 0x13c], 0
mov dword [edi + 0x164], 0
mov dword [edi + 0x168], 0x14
mov dword [edi + 0x16c], 0
mov dword [edi + 0x194], 0
mov byte [edi + 0x198], 0
mov dword [edi + 0x19c], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x4041a0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x417bb8
mov eax, dword fs:[0]
push eax
sub esp, 8
push esi
push edi
mov eax, dword [0x42000c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x10], edi
mov dword [edi + 0x10], 0
mov dword [edi + 0x14], 0xf
mov byte [edi], 0
mov dword [ebp - 4], 0
mov dword [edi + 0x18], 0xffffffff
mov dword [edi + 0x2c], 0
mov dword [edi + 0x30], 0xf
mov byte [edi + 0x1c], 0
lea esi, [edi + 0x34]
mov byte [ebp - 4], 1
push 0x40
mov dword [ebp - 0x14], esi
mov dword [esi], 0
mov dword [esi + 4], 0
call fcn.00416aa1
add esp, 4
mov dword [eax], eax
mov dword [eax + 4], eax
mov dword [eax + 8], eax
mov word [eax + 0xc], 0x101
mov dword [esi], eax
mov eax, edi
mov dword [edi + 0x4c], 0
mov dword [edi + 0x50], 0xf
mov byte [edi + 0x3c], 0
mov dword [edi + 0x64], 0
mov dword [edi + 0x68], 0xf
mov byte [edi + 0x54], 0
mov dword [edi + 0x6c], 0
mov dword [edi + 0x94], 0
mov dword [edi + 0xbc], 0
mov byte [edi + 0xc0], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x409ae0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x14
push ebx
mov ebx, ecx
push esi
push edi
cmp dword [ebx + 0x38], 0
je 0x409b0c
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____thiscall_std::basic_streambuf_char__struct_std::char_traits_char__::xsputn_char_const___long_long___int64__]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov eax, dword [ebx + 0x20]
mov esi, dword [ebp + 0xc]
mov edi, dword [ebp + 0x10]
mov dword [esp + 0x18], esi
mov eax, dword [eax]
mov dword [esp + 0x1c], edi
mov dword [esp + 0x14], eax
test eax, eax
je 0x409b2e
mov eax, dword [ebx + 0x30]
mov eax, dword [eax]
jmp 0x409b30
xor eax, eax
cdq
mov dword [esp + 0xc], eax
mov ecx, edx
mov dword [esp + 0x10], ecx
test edi, edi
jl 0x409bb5
jg 0x409b45
test esi, esi
je 0x409bb5
test ecx, ecx
jl 0x409b98
jg 0x409b4f
test eax, eax
je 0x409b98
cmp edi, ecx
jg 0x409b63
jl 0x409b59
cmp esi, eax
jae 0x409b63
mov eax, esi
mov dword [esp + 0xc], esi
mov dword [esp + 0x10], edi
push eax
push dword [ebp + 8]
push dword [esp + 0x1c]
call sub.VCRUNTIME140.dll_memcpy
mov ecx, dword [esp + 0x18]
add esp, 0xc
mov eax, dword [ebx + 0x30]
sub esi, ecx
mov edx, dword [ebp + 8]
sbb edi, dword [esp + 0x10]
add edx, ecx
sub dword [eax], ecx
mov eax, dword [ebx + 0x20]
add dword [eax], ecx
test edi, edi
jl 0x409bb5
jg 0x409b9b
test esi, esi
je 0x409bb5
jmp 0x409b9b
mov edx, dword [ebp + 8]
mov eax, dword [ebx + 0x4c]
test eax, eax
je 0x409bb5
push eax
push esi
push 1
push edx
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
add esp, 0x10
sub esi, eax
sbb edi, 0
mov eax, dword [esp + 0x18]
mov edx, dword [esp + 0x1c]
sub eax, esi
sbb edx, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x409bd0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [ebp + 0x10]
push ebx
mov ebx, ecx
mov ecx, dword [ebp + 8]
mov dword [ebp - 8], ecx
push esi
mov esi, dword [ebp + 0xc]
test eax, eax
jg 0x409bfc
jl 0x409bf0
test esi, esi
jne 0x409bfc
pop esi
xor eax, eax
xor edx, edx
pop ebx
mov esp, ebp
pop ebp
ret 0xc
cmp dword [ebx + 0x38], 0
je 0x409c15
push eax
push esi
push ecx
mov ecx, ebx
call dword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____thiscall_std::basic_streambuf_char__struct_std::char_traits_char__::xsgetn_char___long_long___int64__]
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov eax, dword [ebx + 0x1c]
push edi
mov edi, esi
mov dword [ebp - 4], esi
mov edx, dword [eax]
test edx, edx
je 0x409c55
mov eax, dword [ebx + 0x2c]
mov eax, dword [eax]
test eax, eax
je 0x409c55
mov edi, dword [ebp + 0xc]
cmp eax, edi
cmovb esi, eax
push esi
push edx
push ecx
call sub.VCRUNTIME140.dll_memcpy
mov eax, dword [ebx + 0x2c]
sub edi, esi
add dword [ebp - 8], esi
add esp, 0xc
mov dword [ebp - 4], edi
sub dword [eax], esi
mov eax, dword [ebx + 0x1c]
add dword [eax], esi
mov esi, dword [ebp + 0xc]
cmp dword [ebx + 0x4c], 0
je 0x409d0c
mov ecx, dword [ebx + 0xc]
lea eax, [ebx + 0x3c]
cmp dword [ecx], eax
jne 0x409c80
mov eax, dword [ebx + 0xc]
mov edx, dword [ebx + 0x54]
mov ecx, dword [ebx + 0x50]
sub edx, ecx
mov dword [eax], ecx
mov eax, dword [ebx + 0x1c]
mov dword [eax], ecx
mov eax, dword [ebx + 0x2c]
mov dword [eax], edx
mov eax, dword [ebp - 4]
mov edx, eax
mov ecx, dword [ebp - 8]
cmp eax, 0xfff
mov eax, dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
mov dword [ebp - 4], edx
jbe 0x409ccf
nop word [eax + eax]
push dword [ebx + 0x4c]
push 0xfff
push 1
push ecx
call eax
mov ecx, dword [ebp - 8]
sub edi, eax
add ecx, eax
mov dword [ebp - 4], edi
add esp, 0x10
mov dword [ebp - 8], ecx
mov edx, edi
cmp eax, 0xfff
jne 0x409cf9
cmp edi, eax
mov eax, dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
ja 0x409ca0
cmp dword [ebp - 4], 0
jbe 0x409d0f
push dword [ebx + 0x4c]
push edi
push 1
push ecx
call eax
mov edx, dword [ebp - 4]
add esp, 0x10
sub edx, eax
sub esi, edx
mov edx, dword [ebp + 0x10]
mov eax, esi
pop edi
pop esi
sbb edx, 0
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov edx, dword [ebp + 0x10]
sub esi, edi
pop edi
mov eax, esi
sbb edx, 0
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov edx, dword [ebp - 4]
sub esi, edx
mov edx, dword [ebp + 0x10]
pop edi
mov eax, esi
sbb edx, 0
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x40a080
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
mov eax, dword [0x42000c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, ecx
cmp ebx, 0xffffffff
jne 0x40a0b0
pop esi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00416887
mov esp, ebp
pop ebp
ret 4
mov eax, dword [esi + 0x20]
mov eax, dword [eax]
test eax, eax
je 0x40a0e0
mov edx, dword [esi + 0x30]
mov edx, dword [edx]
add edx, eax
cmp eax, edx
jae 0x40a0e0
call dword [sym.imp.MSVCP140.dll_protected:_char____thiscall_std::basic_streambuf_char__struct_std::char_traits_char__::_Pninc_void_]
pop esi
mov byte [eax], bl
mov eax, ebx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00416887
mov esp, ebp
pop ebp
ret 4
cmp dword [esi + 0x4c], 0
push edi
je 0x40a1b5
mov edi, dword [esi + 0xc]
lea eax, [esi + 0x3c]
cmp dword [edi], eax
jne 0x40a109
mov edx, dword [esi + 0x54]
mov ecx, dword [esi + 0x50]
sub edx, ecx
mov dword [edi], ecx
mov eax, dword [esi + 0x1c]
mov dword [eax], ecx
mov eax, dword [esi + 0x2c]
mov dword [eax], edx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x40a115
movsx eax, bl
jmp 0x40a14c
lea eax, [ebp - 0x2c]
mov byte [ebp - 0x25], bl
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x25]
push eax
lea eax, [esi + 0x40]
push eax
call dword [sym.imp.MSVCP140.dll_public:_int___thiscall_std::codecvt_char__char__struct__Mbstatet_::out_struct__Mbstatet___char_const___char_const___char_const____char___char___char___const]
test eax, eax
js 0x40a1b5
cmp eax, 1
jle 0x40a176
cmp eax, 3
jne 0x40a1b5
movsx eax, byte [ebp - 0x25]
push dword [esi + 0x4c]
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
add esp, 8
or ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, ebx
pop edi
pop esi
mov eax, ecx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00416887
mov esp, ebp
pop ebp
ret 4
mov edi, dword [ebp - 0x2c]
lea eax, [ebp - 0x24]
sub edi, eax
je 0x40a194
push dword [esi + 0x4c]
push edi
push 1
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
add esp, 0x10
cmp edi, eax
jne 0x40a1b5
lea eax, [ebp - 0x25]
mov byte [esi + 0x3d], 1
cmp dword [ebp - 0x30], eax
je 0x40a1b5
pop edi
pop esi
mov eax, ebx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00416887
mov esp, ebp
pop ebp
ret 4
mov ecx, dword [ebp - 4]
or eax, 0xffffffff
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00416887
mov esp, ebp
pop ebp
ret 4

Function at 0x40a510
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 0xc]
mov edx, 0x811c9dc5
push edi
mov edi, dword [ebp + 8]
mov ecx, 0
sub esi, edi
je 0x40a541
nop dword [eax]
movzx eax, byte [ecx + edi]
inc ecx
xor eax, edx
imul edx, eax, 0x1000193
cmp ecx, esi
jb 0x40a530
pop edi
mov eax, edx
pop esi
pop ebp
ret 8
Function at 0x40af40
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x42000c]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, ecx
cmp dword [esi + 0x38], 0
je 0x40affc
cmp byte [esi + 0x3d], 0
je 0x40affc
mov eax, dword [esi]
push edi
push 0xffffffffffffffff
call dword [eax + 0xc]
cmp eax, 0xffffffff
je 0x40afea
mov ecx, dword [esi + 0x38]
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [esi + 0x40]
push eax
call dword [sym.imp.MSVCP140.dll_public:_int___thiscall_std::codecvt_char__char__struct__Mbstatet_::unshift_struct__Mbstatet___char___char___char___const]
sub eax, 0
je 0x40afb1
sub eax, 1
je 0x40afb5
sub eax, 2
jne 0x40afea
mov byte [esi + 0x3d], al
mov al, 1
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00416887
mov esp, ebp
pop ebp
ret
mov byte [esi + 0x3d], 0
mov edi, dword [ebp - 0x28]
lea eax, [ebp - 0x24]
sub edi, eax
je 0x40afd3
push dword [esi + 0x4c]
push edi
push 1
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
add esp, 0x10
cmp edi, eax
jne 0x40afea
cmp byte [esi + 0x3d], 0
pop edi
sete al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00416887
mov esp, ebp
pop ebp
ret
pop edi
xor al, al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00416887
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
mov al, 1
xor ecx, ebp
pop esi
call fcn.00416887
mov esp, ebp
pop ebp
ret