joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40cdf0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x14
cmp dword [ecx + 0x38], 0
push ebx
push esi
push edi
mov dword [esp + 0xc], ecx
je 0x40ced6
mov esi, dword [ebp + 0x10]
mov ebx, esi
mov edx, dword [ebp + 0xc]
mov edi, edx
mov eax, dword [ebp + 8]
mov dword [esp + 0x10], eax
test esi, esi
jl 0x40cec5
jg 0x40ce30
test edx, edx
je 0x40cec5
nop dword [eax]
call fcn.00405650
mov esi, eax
mov eax, edx
mov dword [esp + 0x14], eax
test eax, eax
jl 0x40ce84
jg 0x40ce47
test esi, esi
je 0x40ce84
cmp ebx, eax
jg 0x40ce57
jl 0x40ce51
cmp edi, esi
jae 0x40ce57
mov esi, edi
mov dword [esp + 0x14], ebx
mov ecx, dword [esp + 0xc]
mov eax, dword [esp + 0x10]
push esi
push eax
mov eax, dword [ecx + 0x20]
push dword [eax]
call fcn.004bf500
mov ecx, dword [esp + 0x18]
add esp, 0xc
sub edi, esi
sbb ebx, dword [esp + 0x14]
mov eax, dword [ecx + 0x30]
sub dword [eax], esi
mov eax, dword [ecx + 0x20]
add dword [eax], esi
jmp 0x40cea9
mov ecx, dword [esp + 0xc]
mov eax, dword [esp + 0x10]
mov edx, dword [ecx]
movzx eax, byte [eax]
push eax
call dword [edx + 0xc]
cmp eax, 0xffffffff
je 0x40cebf
mov ecx, dword [esp + 0xc]
add edi, 0xffffffff
mov esi, 1
adc ebx, 0xffffffff
add dword [esp + 0x10], esi
test ebx, ebx
jg 0x40ce30
jl 0x40cebf
test edi, edi
jne 0x40ce30
mov edx, dword [ebp + 0xc]
mov esi, dword [ebp + 0x10]
sub edx, edi
mov eax, edx
sbb esi, ebx
mov edx, esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov eax, dword [ecx + 0x20]
mov esi, dword [ebp + 0xc]
mov edi, dword [ebp + 0x10]
mov dword [esp + 0x18], esi
mov eax, dword [eax]
mov dword [esp + 0x1c], edi
mov dword [esp + 0x10], eax
test eax, eax
je 0x40cef8
mov eax, dword [ecx + 0x30]
mov eax, dword [eax]
jmp 0x40cefa
xor eax, eax
cdq
mov ebx, eax
mov eax, edx
mov dword [esp + 0x14], eax
test edi, edi
jl 0x40cf78
jg 0x40cf0d
test esi, esi
je 0x40cf78
test eax, eax
jl 0x40cf5c
jg 0x40cf17
test ebx, ebx
je 0x40cf5c
cmp edi, eax
jg 0x40cf27
jl 0x40cf21
cmp esi, ebx
jae 0x40cf27
mov ebx, esi
mov dword [esp + 0x14], edi
push ebx
push dword [ebp + 8]
push dword [esp + 0x18]
call fcn.004bf500
mov ecx, dword [esp + 0x18]
add esp, 0xc
mov edx, dword [ebp + 8]
sub esi, ebx
sbb edi, dword [esp + 0x14]
add edx, ebx
mov eax, dword [ecx + 0x30]
sub dword [eax], ebx
mov eax, dword [ecx + 0x20]
add dword [eax], ebx
test edi, edi
jl 0x40cf78
jg 0x40cf5f
test esi, esi
je 0x40cf78
jmp 0x40cf5f
mov edx, dword [ebp + 8]
mov eax, dword [ecx + 0x4c]
test eax, eax
je 0x40cf78
push eax
push esi
push 1
push edx
call fcn.004c884b
add esp, 0x10
sub esi, eax
sbb edi, 0
mov eax, dword [esp + 0x18]
mov edx, dword [esp + 0x1c]
sub eax, esi
sbb edx, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x40cf90
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0xc
mov eax, dword [ebp + 0x10]
push ebx
mov ebx, ecx
mov ecx, dword [ebp + 0xc]
push esi
push edi
mov edi, dword [ebp + 8]
mov dword [esp + 0xc], edi
test eax, eax
jg 0x40cfc2
jl 0x40cfb5
test ecx, ecx
jne 0x40cfc2
xor eax, eax
xor edx, edx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
cmp dword [ebx + 0x38], 0
je 0x40d082
mov dword [esp + 0x10], ecx
mov dword [esp + 0xc], eax
mov ecx, ebx
call fcn.004097f0
mov esi, eax
mov eax, edx
mov dword [esp + 0x14], eax
test eax, eax
jl 0x40d02e
jg 0x40cfed
test esi, esi
je 0x40d02e
mov ecx, dword [esp + 0xc]
cmp ecx, eax
jg 0x40d005
mov eax, dword [esp + 0x10]
jl 0x40cfff
cmp eax, esi
jae 0x40d005
mov esi, eax
mov dword [esp + 0x14], ecx
mov eax, dword [ebx + 0x1c]
push esi
push dword [eax]
push edi
call fcn.004bf500
mov eax, dword [ebx + 0x2c]
add esp, 0xc
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 0xc]
sub ecx, esi
sbb edx, dword [esp + 0x14]
sub dword [eax], esi
mov eax, dword [ebx + 0x1c]
add dword [eax], esi
jmp 0x40d04f
mov eax, dword [ebx]
mov ecx, ebx
call dword [eax + 0x1c]
mov edx, dword [esp + 0xc]
cmp eax, 0xffffffff
je 0x40d06b
mov ecx, dword [esp + 0x10]
mov esi, 1
add ecx, 0xffffffff
mov byte [edi], al
adc edx, 0xffffffff
add edi, esi
mov dword [esp + 0xc], edx
mov dword [esp + 0x10], ecx
test edx, edx
jg 0x40cfd4
jl 0x40d06b
test ecx, ecx
jne 0x40cfd4
mov eax, dword [ebp + 0xc]
sub eax, dword [esp + 0x10]
mov ecx, dword [ebp + 0x10]
sbb ecx, edx
mov edx, ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov eax, dword [ebx + 0x1c]
mov edi, ecx
mov edx, dword [eax]
test edx, edx
je 0x40d0c1
mov eax, dword [ebx + 0x2c]
mov eax, dword [eax]
test eax, eax
je 0x40d0c1
mov edi, dword [esp + 0xc]
cmp eax, ecx
mov esi, ecx
cmovb esi, eax
push esi
push edx
push edi
call fcn.004bf500
mov eax, dword [ebx + 0x2c]
add edi, esi
mov dword [esp + 0x18], edi
add esp, 0xc
mov edi, dword [ebp + 0xc]
sub edi, esi
sub dword [eax], esi
mov eax, dword [ebx + 0x1c]
add dword [eax], esi
cmp dword [ebx + 0x4c], 0
mov ecx, edi
je 0x40d130
mov esi, dword [ebx + 0xc]
lea eax, [ebx + 0x3c]
cmp dword [esi], eax
jne 0x40d0e7
mov edx, dword [ebx + 0x54]
mov ecx, dword [ebx + 0x50]
sub edx, ecx
mov dword [esi], ecx
mov eax, dword [ebx + 0x1c]
mov dword [eax], ecx
mov eax, dword [ebx + 0x2c]
mov dword [eax], edx
mov esi, dword [esp + 0xc]
mov ecx, edi
cmp edi, 0xfff
jbe 0x40d119
push dword [ebx + 0x4c]
push 0xfff
push 1
push esi
call fcn.004c8e44
sub edi, eax
add esp, 0x10
add esi, eax
mov ecx, edi
cmp eax, 0xfff
jne 0x40d144
cmp edi, eax
ja 0x40d0f5
test ecx, ecx
je 0x40d130
push dword [ebx + 0x4c]
push edi
push 1
push esi
call fcn.004c8e44
mov ecx, edi
add esp, 0x10
sub ecx, eax
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 0x10]
sub eax, ecx
sbb edx, 0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 0x10]
sub eax, edi
pop edi
pop esi
sbb edx, 0
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x40d4b0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
mov eax, dword [0x5a9824]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, ecx
cmp ebx, 0xffffffff
jne 0x40d4e0
pop esi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004bb607
mov esp, ebp
pop ebp
ret 4
mov eax, dword [esi + 0x20]
push edi
mov ecx, dword [eax]
test ecx, ecx
je 0x40d51c
mov edx, dword [esi + 0x30]
mov edi, dword [edx]
lea eax, [edi + ecx]
cmp ecx, eax
jae 0x40d51c
lea ecx, [edi - 1]
mov dword [edx], ecx
mov edx, dword [esi + 0x20]
mov esi, dword [edx]
lea ecx, [esi + 1]
mov dword [edx], ecx
mov byte [esi], bl
pop edi
pop esi
mov eax, ebx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004bb607
mov esp, ebp
pop ebp
ret 4
cmp dword [esi + 0x4c], 0
je 0x40d604
mov edi, dword [esi + 0xc]
lea eax, [esi + 0x3c]
cmp dword [edi], eax
jne 0x40d544
mov edx, dword [esi + 0x54]
mov ecx, dword [esi + 0x50]
sub edx, ecx
mov dword [edi], ecx
mov eax, dword [esi + 0x1c]
mov dword [eax], ecx
mov eax, dword [esi + 0x2c]
mov dword [eax], edx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x40d577
push dword [esi + 0x4c]
movsx eax, bl
push eax
call fcn.004c7e09
add esp, 8
or ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, ebx
pop edi
pop esi
mov eax, ecx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004bb607
mov esp, ebp
pop ebp
ret 4
lea eax, [ebp - 0x2c]
mov byte [ebp - 0x25], bl
mov edx, dword [ecx]
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x25]
push eax
lea eax, [esi + 0x40]
push eax
call dword [edx + 0x1c]
sub eax, 0
je 0x40d5d7
sub eax, 1
je 0x40d5d7
sub eax, 2
jne 0x40d604
push dword [esi + 0x4c]
movsx eax, byte [ebp - 0x25]
push eax
call fcn.004c7e09
add esp, 8
or ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, ebx
pop edi
pop esi
mov eax, ecx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004bb607
mov esp, ebp
pop ebp
ret 4
mov edi, dword [ebp - 0x2c]
lea eax, [ebp - 0x24]
sub edi, eax
je 0x40d5f4
push dword [esi + 0x4c]
push edi
push 1
push eax
call fcn.004c884b
add esp, 0x10
cmp edi, eax
jne 0x40d604
lea eax, [ebp - 0x25]
mov byte [esi + 0x3d], 1
cmp dword [ebp - 0x30], eax
jne 0x40d507
mov ecx, dword [ebp - 4]
or eax, 0xffffffff
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004bb607
mov esp, ebp
pop ebp
ret 4
Function at 0x40dd40
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x5a9824]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, ecx
cmp dword [esi + 0x38], 0
je 0x40ddfa
cmp byte [esi + 0x3d], 0
je 0x40ddfa
mov eax, dword [esi]
push edi
push 0xffffffffffffffff
call dword [eax + 0xc]
cmp eax, 0xffffffff
je 0x40dde8
mov ecx, dword [esi + 0x38]
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 4]
push eax
mov edx, dword [ecx]
lea eax, [ebp - 0x24]
push eax
lea eax, [esi + 0x40]
push eax
call dword [edx + 0x20]
sub eax, 0
je 0x40ddb0
sub eax, 1
je 0x40ddb4
sub eax, 2
jne 0x40dde8
mov byte [esi + 0x3d], al
mov al, 1
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004bb607
mov esp, ebp
pop ebp
ret
mov byte [esi + 0x3d], 0
mov edi, dword [ebp - 0x28]
lea eax, [ebp - 0x24]
sub edi, eax
je 0x40ddd1
push dword [esi + 0x4c]
push edi
push 1
push eax
call fcn.004c884b
add esp, 0x10
cmp edi, eax
jne 0x40dde8
cmp byte [esi + 0x3d], 0
pop edi
sete al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004bb607
mov esp, ebp
pop ebp
ret
pop edi
xor al, al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004bb607
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
mov al, 1
xor ecx, ebp
pop esi
call fcn.004bb607
mov esp, ebp
pop ebp
ret
Function at 0x42f5b0
Capabilities:
Write file on windows

Disassembly:
push ebx
push esi
push edi
mov edi, ecx
mov eax, dword [edi + 0x10]
mov dword [edi], vtable.DefaultErrStreamBuf.0
mov esi, dword [eax]
mov eax, dword [edi + 0x20]
mov ebx, dword [eax]
cmp esi, ebx
je 0x42f5fc
push 2
call fcn.004c8562
push eax
sub ebx, esi
push ebx
push 1
push esi
call fcn.004c884b
mov eax, dword [edi + 0x10]
add esp, 0x14
mov ecx, dword [edi + 0x20]
mov esi, dword [eax]
mov eax, dword [edi + 0x30]
mov edx, dword [eax]
add edx, dword [ecx]
mov dword [ecx], esi
sub edx, esi
mov eax, dword [edi + 0x30]
mov dword [eax], edx
mov eax, dword [edi + 0x10]
mov esi, dword [eax]
push esi
call fcn.004bb615
mov esi, dword [edi + 0x34]
add esp, 4
mov dword [edi], vtable.std::basic_streambuf_char__struct_std::char_traits_char__.0
test esi, esi
je 0x42f635
mov ecx, dword [esi + 4]
test ecx, ecx
je 0x42f62a
mov eax, dword [ecx]
call dword [eax + 8]
test eax, eax
je 0x42f62a
mov edx, dword [eax]
mov ecx, eax
push 1
call dword [edx]
push 8
push esi
call fcn.004bb64a
add esp, 8
pop edi
pop esi
pop ebx
ret

Function at 0x42f8d0
Capabilities:
Write file on windows

Disassembly:
push ebx
push esi
push edi
mov edi, ecx
mov eax, dword [edi + 0x10]
mov ebx, dword [eax]
mov eax, dword [edi + 0x20]
mov esi, dword [eax]
cmp ebx, esi
je 0x42f911
push 2
call fcn.004c8562
push eax
sub esi, ebx
push esi
push 1
push ebx
call fcn.004c884b
mov eax, dword [edi + 0x10]
add esp, 0x14
mov ecx, dword [edi + 0x20]
mov esi, dword [eax]
mov eax, dword [edi + 0x30]
mov edx, dword [eax]
add edx, dword [ecx]
mov dword [ecx], esi
sub edx, esi
mov eax, dword [edi + 0x30]
mov dword [eax], edx
pop edi
pop esi
xor eax, eax
pop ebx
ret
Function at 0x42f9d0
Capabilities:
Check for time delay via queryperformancecounter
Check os version

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4e6ed1
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push esi
mov eax, dword [0x5a9824]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword fs:[0x2c]
mov ecx, dword [0x5b0b10]
mov esi, dword [eax + ecx*4]
mov eax, dword [0x5b0460]
cmp eax, dword [esi + 0x14]
jg 0x42faa4
mov eax, dword [0x5b0468]
cmp eax, dword [esi + 0x14]
jg 0x42faf9
cmp byte [0x5b0464], 0
je 0x42fa62
mov eax, dword [0x5b0470]
cmp eax, dword [esi + 0x14]
jg 0x42fb34
push 0x5b046c
lea ecx, [ebp - 0x10]
call fcn.0042e810
lea eax, [ebp - 0x1c]
push eax
call dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
lea ecx, [ebp - 0x10]
call fcn.0042e830
jmp 0x42fa6c
lea eax, [ebp - 0x1c]
push eax
call dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov edx, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x1c]
call fcn.004bc640
mulsd xmm0, qword [0x5b0458]
call fcn.004bc530
mov esi, dword [ebp + 8]
push edx
push eax
push esi
call fcn.0042e930
add esp, 0xc
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
push 0x5b0460
call fcn.004bbb88
add esp, 4
cmp dword [0x5b0460], 0xffffffff
jne 0x42fa16
lea eax, [ebp - 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
mov edx, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x14]
call fcn.004bc640
movsd xmm1, qword [0x4f12c0]
divsd xmm1, xmm0
push 0x5b0460
movsd qword [0x5b0458], xmm1
call fcn.004bbb3e
add esp, 4
jmp 0x42fa16
push 0x5b0468
call fcn.004bbb88
add esp, 4
cmp dword [0x5b0468], 0xffffffff
jne 0x42fa27
call dword [sym.imp.KERNEL32.dll_GetVersion]
cmp al, 6
push 0x5b0468
setb byte [0x5b0464]
call fcn.004bbb3e
add esp, 4
jmp 0x42fa27
push 0x5b0470
call fcn.004bbb88
add esp, 4
cmp dword [0x5b0470], 0xffffffff
jne 0x42fa41
mov ecx, 0x5b046c
mov dword [ebp - 4], 0
call fcn.0042e9e0
push 0x4e7c60
call fcn.004bb9cc
push 0x5b0470
mov dword [ebp - 4], 0xffffffff
call fcn.004bbb3e
add esp, 8
jmp 0x42fa41
Function at 0x42fc10
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4e6c9d
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x5a9824]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
lea eax, [esi + 4]
push eax
push 0
push dword [ebp + 8]
push 0x42fd00
push 0
push 0
call fcn.004cd76c
add esp, 0x18
mov dword [esi], eax
test eax, eax
jne 0x42fcd5
push str.Failed_to_create_thread
call fcn.0042f670
push eax
call fcn.00405940
mov ebx, eax
add esp, 8
mov ecx, dword [ebx]
mov ecx, dword [ecx + 4]
mov ecx, dword [ecx + ebx + 0x30]
mov edi, dword [ecx + 4]
mov ecx, edi
mov dword [ebp - 0x10], edi
mov edx, dword [edi]
call dword [edx + 4]
lea eax, [ebp - 0x14]
mov dword [ebp - 4], 0
push eax
call fcn.004057c0
add esp, 4
mov ecx, eax
mov edx, dword [eax]
push 0xa
mov eax, dword [edx + 0x20]
call eax
mov byte [ebp + 8], al
mov dword [ebp - 4], 0xffffffff
test edi, edi
je 0x42fcc4
mov eax, dword [edi]
mov ecx, edi
call dword [eax + 8]
test eax, eax
je 0x42fcc4
mov edx, dword [eax]
mov ecx, eax
push 1
call dword [edx]
push dword [ebp + 8]
mov ecx, ebx
call fcn.00406460
mov ecx, ebx
call fcn.00405360
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x431110
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4e70c3
mov eax, dword fs:[0]
push eax
sub esp, 8
push esi
mov eax, dword [0x5a9824]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
call fcn.0042fd80
mov dword [esi], vtable.sf::SoundStream.0
push 0x18
mov dword [ebp - 4], 0
mov dword [esi + 8], 0
call fcn.004bb61a
add esp, 4
mov dword [ebp - 0x14], eax
test eax, eax
je 0x43117e
mov dword [eax], vtable.sf::priv::ThreadMemberFunc_class_sf::SoundStream_.0
mov dword [eax + 8], 0x4316b0
mov dword [eax + 0xc], 0
mov dword [eax + 0x10], esi
jmp 0x431180
xor eax, eax
mov dword [esi + 0xc], eax
lea ecx, [esi + 0x10]
mov byte [ebp - 4], 1
call fcn.0042e9e0
mov dword [esi + 0x14], 0
lea eax, [esi + 0x58]
mov byte [esi + 0x18], 0
xorps xmm0, xmm0
movq qword [esi + 0x1c], xmm0
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x2c], 0
mov dword [esi + 0x30], 0
mov byte [esi + 0x34], 0
mov dword [esi + 0x38], 0
mov dword [esi + 0x3c], 0
push 0xa
movups xmmword [esi + 0x40], xmm0
push eax
mov byte [ebp - 4], 2
movq qword [esi + 0x50], xmm0
call fcn.0042e950
add esp, 8
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x434330
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4e7464
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push ebx
push esi
push edi
mov eax, dword [0x5a9824]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, ecx
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x14], 0
lea esi, [eax + 8]
mov dword [eax], vtable.sf::priv::SoundFileWriterOgg.0
mov dword [eax + 4], 0
mov dword [ebp - 0x18], esi
mov dword [esi], 0x5a15e0
mov dword [ebp - 4], 0
mov dword [esi + 0x70], 0
mov dword [esi + 0x90], 0
mov dword [esi + 0x94], 0
mov dword [esi + 0x98], 0
mov dword [esi + 0x68], vtable.std::basic_ios_char__struct_std::char_traits_char__.0
push 0
lea edi, [esi + 4]
mov byte [ebp - 4], 1
push 0
push edi
mov ecx, esi
mov dword [ebp - 0x14], 1
mov dword [ebp - 0x10], edi
call fcn.00409810
mov eax, dword [esi]
push 8
mov dword [ebp - 4], 2
mov dword [ebp - 0x20], edi
mov eax, dword [eax + 4]
mov dword [esi + eax], vtable.std::basic_ofstream_char__struct_std::char_traits_char__.0
mov eax, dword [esi]
mov ecx, dword [eax + 4]
lea eax, [ecx - 0x68]
mov dword [ecx + esi - 4], eax
mov dword [edi], vtable.std::basic_streambuf_char__struct_std::char_traits_char__.0
call fcn.004bb61a
mov ebx, eax
add esp, 4
test ebx, ebx
je 0x434418
push 1
mov byte [ebp - 4], 3
call fcn.004b9ccb
add esp, 4
mov dword [ebx + 4], eax
jmp 0x43441a
xor ebx, ebx
mov dword [edi + 0x34], ebx
lea edx, [edi + 8]
lea ebx, [edi + 4]
mov dword [ebp - 0x18], edx
mov edx, dword [ebp - 0x10]
lea eax, [esi + 4]
mov dword [ebp - 0x14], ebx
lea ecx, [eax + 0x18]
mov ebx, dword [ebp - 0x10]
lea esi, [eax + 0x24]
add eax, 0x28
add edi, 0x14
push 0x1f8
push 0
mov dword [ebx], vtable.std::basic_filebuf_char__struct_std::char_traits_char__.0
mov byte [ebx + 0x48], 0
mov byte [ebx + 0x3d], 0
mov ebx, dword [ebp - 0x14]
mov dword [edx + 0xc], ebx
mov ebx, dword [ebp - 0x10]
mov edx, dword [ebp - 0x18]
mov dword [ebx + 0x10], edx
mov dword [ebx + 0x2c], esi
mov dword [ebx + 0x30], eax
mov dword [ebx + 0x1c], edi
mov dword [ebx + 0x20], ecx
mov ebx, dword [ebp - 0x14]
mov dword [edx], 0
mov edx, dword [ebp - 0x10]
mov dword [ecx], 0
mov dword [eax], 0
mov dword [ebx], 0
mov dword [edi], 0
mov dword [esi], 0
mov esi, dword [ebp - 0x1c]
mov dword [edx + 0x4c], 0
mov eax, dword [0x5b1778]
mov ecx, dword [0x5b177c]
mov dword [edx + 0x40], eax
lea eax, [esi + 0xb8]
push eax
mov dword [edx + 0x44], ecx
mov dword [edx + 0x38], 0
call fcn.004bfa80
add esp, 0xc
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4358c0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4e7464
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push ebx
push esi
push edi
mov eax, dword [0x5a9824]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, ecx
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x14], 0
lea esi, [eax + 8]
mov dword [eax], vtable.sf::priv::SoundFileWriterWav.0
mov dword [ebp - 0x18], esi
mov dword [esi], 0x5a15e0
mov dword [ebp - 4], 0
mov dword [esi + 0x70], 0
mov dword [esi + 0x90], 0
mov dword [esi + 0x94], 0
mov dword [esi + 0x98], 0
mov dword [esi + 0x68], vtable.std::basic_ios_char__struct_std::char_traits_char__.0
push 0
lea edi, [esi + 4]
mov byte [ebp - 4], 1
push 0
push edi
mov ecx, esi
mov dword [ebp - 0x14], 1
mov dword [ebp - 0x10], edi
call fcn.00409810
mov eax, dword [esi]
push 8
mov dword [ebp - 4], 2
mov dword [ebp - 0x20], edi
mov eax, dword [eax + 4]
mov dword [esi + eax], vtable.std::basic_ofstream_char__struct_std::char_traits_char__.0
mov eax, dword [esi]
mov ecx, dword [eax + 4]
lea eax, [ecx - 0x68]
mov dword [ecx + esi - 4], eax
mov dword [edi], vtable.std::basic_streambuf_char__struct_std::char_traits_char__.0
call fcn.004bb61a
mov ebx, eax
add esp, 4
test ebx, ebx
je 0x4359a1
push 1
mov byte [ebp - 4], 3
call fcn.004b9ccb
add esp, 4
mov dword [ebx + 4], eax
jmp 0x4359a3
xor ebx, ebx
mov dword [edi + 0x34], ebx
lea edx, [edi + 8]
lea ebx, [edi + 4]
mov dword [ebp - 0x18], edx
mov edx, dword [ebp - 0x10]
lea eax, [esi + 4]
mov dword [ebp - 0x14], ebx
lea ecx, [eax + 0x18]
mov ebx, dword [ebp - 0x10]
lea esi, [eax + 0x24]
add edi, 0x14
add eax, 0x28
mov dword [ebx], vtable.std::basic_filebuf_char__struct_std::char_traits_char__.0
mov byte [ebx + 0x48], 0
mov byte [ebx + 0x3d], 0
mov ebx, dword [ebp - 0x14]
mov dword [edx + 0xc], ebx
mov ebx, dword [ebp - 0x10]
mov edx, dword [ebp - 0x18]
mov dword [ebx + 0x10], edx
mov dword [ebx + 0x30], eax
mov dword [ebx + 0x1c], edi
mov dword [ebx + 0x20], ecx
mov dword [ebx + 0x2c], esi
mov ebx, dword [ebp - 0x14]
mov dword [edx], 0
mov edx, dword [ebp - 0x10]
mov dword [ecx], 0
mov dword [eax], 0
mov dword [ebx], 0
mov dword [edi], 0
mov dword [esi], 0
mov dword [edx + 0x4c], 0
mov eax, dword [0x5b1778]
mov ecx, dword [0x5b177c]
mov dword [edx + 0x40], eax
mov eax, dword [ebp - 0x1c]
mov dword [edx + 0x44], ecx
mov dword [edx + 0x38], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x436110
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
push 0
lea edi, [ecx + 8]
mov dword [ebp - 8], 0x46464952
push 4
lea eax, [ebp - 8]
mov ecx, edi
push eax
call fcn.0040c9e0
push 0
push 4
lea eax, [ebp - 4]
mov dword [ebp - 4], 0
push eax
mov ecx, edi
call fcn.0040c9e0
push 0
push 4
lea eax, [ebp - 0xc]
mov dword [ebp - 0xc], 0x45564157
push eax
mov ecx, edi
call fcn.0040c9e0
push 0
push 4
lea eax, [ebp - 0x10]
mov dword [ebp - 0x10], 0x20746d66
push eax
mov ecx, edi
call fcn.0040c9e0
push 0
push 4
lea eax, [ebp - 4]
mov dword [ebp - 4], 0x10
push eax
mov ecx, edi
call fcn.0040c9e0
push 0
push 2
lea eax, [ebp - 4]
mov word [ebp - 4], 1
push eax
mov ecx, edi
call fcn.0040c9e0
mov ebx, dword [ebp + 0xc]
mov ecx, edi
movzx esi, bx
mov eax, esi
mov byte [ebp + 0xc], bl
shr eax, 8
push 0
mov byte [ebp + 0xd], al
lea eax, [ebp + 0xc]
push 2
push eax
call fcn.0040c9e0
mov ecx, dword [ebp + 8]
mov eax, ecx
shr eax, 8
mov byte [ebp + 0xd], al
mov eax, ecx
shr eax, 0x10
mov byte [ebp + 0xe], al
mov eax, ecx
shr eax, 0x18
push 0
mov byte [ebp + 0xf], al
lea eax, [ebp + 0xc]
push 4
mov byte [ebp + 0xc], cl
mov ecx, edi
push eax
call fcn.0040c9e0
mov ecx, dword [ebp + 8]
imul ecx, ebx
mov dword [ebp + 8], ecx
add ecx, ecx
mov byte [ebp + 8], cl
mov eax, ecx
shr eax, 8
mov byte [ebp + 9], al
mov eax, ecx
shr eax, 0x10
push 0
shr ecx, 0x18
mov byte [ebp + 0xa], al
lea eax, [ebp + 8]
push 4
mov byte [ebp + 0xb], cl
mov ecx, edi
push eax
call fcn.0040c9e0
lea eax, [esi + esi]
mov ecx, edi
movzx eax, ax
mov byte [ebp + 8], al
shr eax, 8
push 0
mov byte [ebp + 9], al
lea eax, [ebp + 8]
push 2
push eax
call fcn.0040c9e0
push 0
push 2
lea eax, [ebp + 8]
mov word [ebp + 8], 0x10
push eax
mov ecx, edi
call fcn.0040c9e0
push 0
push 4
lea eax, [ebp - 0x14]
mov dword [ebp - 0x14], 0x61746164
push eax
mov ecx, edi
call fcn.0040c9e0
push 0
push 4
lea eax, [ebp + 8]
mov dword [ebp + 8], 0
push eax
mov ecx, edi
call fcn.0040c9e0
pop edi
pop esi
mov al, 1
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x464ea0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [ebp + 0x18]
push ebx
mov ebx, dword [ebp + 8]
movzx edx, word [eax]
mov eax, dword [ebp + 0xc]
mov ebx, dword [ebx]
mov dword [ebp - 4], ebx
cmp ebx, eax
jb 0x464ec3
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
push esi
mov esi, dword [ebp + 0x14]
sub eax, ebx
cmp esi, eax
push edi
cmova esi, eax
xor edi, edi
mov dword [ebp + 0x14], esi
test esi, esi
je 0x464f11
mov edi, dword [ebp + 0x10]
sub ebx, edi
lea ecx, [ecx]
movzx eax, byte [ebx + edi]
lea edi, [edi + 1]
mov ecx, edx
shr ecx, 8
xor ecx, eax
add eax, edx
imul eax, eax, 0x3193
mov edx, 0x58bf
mov byte [edi - 1], cl
sub edx, eax
and edx, 0xffff
dec esi
jne 0x464ee0
mov esi, dword [ebp + 0x14]
mov edi, esi
mov ebx, dword [ebp - 4]
mov eax, dword [ebp + 8]
lea ecx, [ebx + esi]
mov dword [eax], ecx
mov eax, dword [ebp + 0x18]
mov word [eax], dx
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret