joyce8/EMBER2024-capa huggingface dataset:
Function at 0x420860
Capabilities:
Inspect section memory permissions

Disassembly:
sub esp, 0x124
push ebx
push ebp
push esi
push edi
mov ecx, 0x3e
xor eax, eax
lea edi, [esp + 0x3c]
xor ebx, ebx
rep stosd dword es:[edi], eax
mov ecx, 0xa
lea edi, [esp + 0x14]
rep stosd dword es:[edi], eax
mov ecx, dword [esp + 0x138]
lea eax, [esp + 0x3c]
push eax
push ecx
mov dword [esp + 0x18], ebx
xor esi, esi
call fcn.00420cd0
add eax, 4
movsx edx, word [esp + 0x50]
jo 0x4209b6
add eax, 0x14
jo 0x4209b6
add eax, edx
jo 0x4209b6
mov edi, eax
mov ax, word [esp + 0x42]
sub ax, 1
jo 0x4209b6
movsx ebp, ax
cmp ebp, ebx
jl 0x4209a7
lea ecx, [esp + 0x14]
push ecx
call fcn.004210b0
push 0x28
push edi
push eax
call fcn.00421000
mov eax, dword [esp + 0x38]
test eax, 0x20000000
je 0x42091e
test eax, 0x40000000
je 0x42090d
and eax, 0x80000000
neg eax
sbb eax, eax
and eax, 0x20
add eax, 0x20
jmp 0x420943
and eax, 0x80000000
neg eax
sbb eax, eax
and eax, 0x70
add eax, 0x10
jmp 0x420943
test eax, 0x40000000
je 0x420936
and eax, 0x80000000
neg eax
sbb eax, eax
and eax, 2
add eax, 2
jmp 0x420943
and eax, 0x80000000
neg eax
sbb eax, eax
and eax, 7
inc eax
lea edx, [esp + 0x10]
mov esi, eax
push edx
call fcn.004210b0
push eax
push esi
mov ecx, dword [esp + 0x28]
mov esi, dword [esp + 0x140]
mov eax, dword [esp + 0x24]
add ecx, esi
push eax
jo 0x4209b6
push ecx
call fcn.00420fe0
test eax, eax
je 0x420990
add edi, 0x28
jo 0x4209b6
add ebx, 1
jo 0x4209b6
cmp ebx, ebp
jle 0x4208d7
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x124
ret 4
mov esi, 4
call dword [sym.imp.KERNEL32.DLL_SetFileApisToANSI]
call dword [sym.imp.KERNEL32.DLL_SetFileApisToOEM]
call dword [sym.imp.USER32.DLL_WaitMessage]
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x124
ret 4
call dword [sym.imp.MSVBVM60.DLL___vbaErrorOverflow]
nop
nop
nop
nop

Function at 0x401000
Capabilities:
Access peb ldr_data

Disassembly:
push 0
push 2
push 0x402065
push 0x402053
call dword [sym.imp.Winmm.dll_mciSendStringA]
cmp eax, 0x107
je 0x40101c
ret
mov edi, edi
mov esi, 0x4010c7
mov edi, esi
push 1
push 0x402083
push 1
push 0
push 0
call dword [sym.imp.kernel32.dll_CreateSemaphoreW]
mov edx, eax
pop ebx
mov ecx, 0x380
mov al, byte [esi]
sub al, bl
stosb byte es:[edi], al
inc esi
loop 0x401040
push dword fs:[0x30]
mov eax, dword [esp]
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0x1c]
mov eax, dword [eax]
mov eax, dword [eax + 8]
cmp word [eax], 0x5a4d
je 0x401066
xor eax, eax
mov dword [0x402096], eax
add esp, 4
ret
Function at 0x401300
Capabilities:
Terminate process

Disassembly:
mov eax, dword [0x50600c]
mov dword [eax], 0
jmp fcn.00401120
Function at 0x406440
Capabilities:
Parse credit card information

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x28
mov ebp, dword [esp + 0x40]
mov eax, dword [esp + 0x3c]
cmp eax, ebp
je 0x406556
movzx edx, byte [eax]
cmp edx, 0x5b
jg 0x4064d7
cmp edx, 0x24
je 0x406516
cmp edx, 0x28
jne 0x406556
lea edx, [eax + 1]
cmp edx, ebp
je 0x406556
cmp byte [edx], 0x3f
jne 0x406556
lea edx, [eax + 2]
cmp edx, ebp
je 0x406556
movzx edx, byte [edx]
cmp edx, 0x21
je 0x406601
cmp edx, 0x3d
jne 0x406556
mov edi, esp
mov esi, ecx
mov ecx, edi
mov ebx, eax
call fcn.00406f80
mov eax, dword [esi + 0xc]
mov dword [esp + 0xc], eax
add ebx, 3
mov ecx, edi
push ebp
push ebx
call fcn.00405950
mov ebx, eax
mov edi, dword [esp + 0x10]
mov ecx, esi
push dword [esi + 0x10]
push 0
jmp 0x40662e
cmp edx, 0x5c
je 0x406560
cmp edx, 0x5e
jne 0x406556
push 0xc
mov edi, eax
mov esi, ecx
call sub.libc.dll_operator_new_unsigned_int_
add esp, 4
mov ecx, eax
mov eax, edi
mov edx, 0x5f0
and edx, dword [esi + 0xc]
cmp edx, 0x400
mov edx, dword [esi + 0x24]
mov edi, dword [edx + 4]
mov dword [ecx + 4], edi
mov dword [ecx], 0x506c74
jmp 0x406545
push 0xc
mov edi, eax
mov esi, ecx
call sub.libc.dll_operator_new_unsigned_int_
add esp, 4
mov ecx, eax
mov eax, edi
mov edx, 0x5f0
and edx, dword [esi + 0xc]
cmp edx, 0x400
mov edx, dword [esi + 0x24]
mov edi, dword [edx + 4]
mov dword [ecx + 4], edi
mov dword [ecx], 0x506cbc
sete byte [ecx + 8]
mov dword [edx + 4], ecx
mov ecx, dword [esi + 0x24]
mov ecx, dword [ecx + 4]
mov dword [esi + 0x24], ecx
inc eax
add esp, 0x28
pop esi
pop edi
pop ebx
pop ebp
ret 8
lea edx, [eax + 1]
cmp edx, ebp
je 0x406556
movzx edx, byte [edx]
cmp edx, 0x42
je 0x4065b0
cmp edx, 0x62
jne 0x406556
push 0x18
mov ebx, eax
mov edi, ecx
call sub.libc.dll_operator_new_unsigned_int_
add esp, 4
mov esi, eax
mov eax, dword [edi + 0x24]
mov eax, dword [eax + 4]
mov dword [esi + 4], eax
mov dword [esi], 0x506d04
lea ecx, [esi + 8]
push edi
call fcn.00504b94
mov eax, ebx
mov ecx, dword [edi + 4]
mov edx, dword [edi + 8]
mov dword [esi + 0x10], edx
mov dword [esi + 0xc], ecx
mov byte [esi + 0x14], 0
jmp 0x4065ea
push 0x18
mov ebx, eax
mov edi, ecx
call sub.libc.dll_operator_new_unsigned_int_
add esp, 4
mov esi, eax
mov eax, dword [edi + 0x24]
mov eax, dword [eax + 4]
mov dword [esi + 4], eax
mov dword [esi], 0x506d04
lea ecx, [esi + 8]
push edi
call fcn.00504b94
mov eax, ebx
mov ecx, dword [edi + 4]
mov edx, dword [edi + 8]
mov dword [esi + 0x10], edx
mov dword [esi + 0xc], ecx
mov byte [esi + 0x14], 1
mov ecx, dword [edi + 0x24]
mov dword [ecx + 4], esi
mov ecx, dword [edi + 0x24]
mov ecx, dword [ecx + 4]
mov dword [edi + 0x24], ecx
add eax, 2
jmp 0x406556
mov edi, esp
mov esi, ecx
mov ecx, edi
mov ebx, eax
call fcn.00406f80
mov eax, dword [esi + 0xc]
mov dword [esp + 0xc], eax
add ebx, 3
mov ecx, edi
push ebp
push ebx
call fcn.00405950
mov ebx, eax
mov edi, dword [esp + 0x10]
mov ecx, esi
push dword [esi + 0x10]
push 1
lea eax, [esp + 8]
push eax
call fcn.00406fc0
add dword [esi + 0x10], edi
cmp ebx, ebp
je 0x406653
cmp byte [ebx], 0x29
jne 0x406653
inc ebx
mov ecx, esp
call fcn.00405910
mov eax, ebx
jmp 0x406556
call fcn.00407050
int3
Function at 0x431610
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
push ebx
push edi
push esi
push eax
mov esi, ecx
mov edi, dword [esp + 0x18]
mov eax, dword [0x50acf4]
add eax, 8
mov dword [esp], eax
mov dword [ecx], eax
add ecx, 8
test byte [edi + 8], 1
jne 0x431644
lea eax, [edi + 8]
mov edx, dword [eax + 8]
mov dword [ecx + 8], edx
movsd xmm0, qword [eax]
movsd qword [ecx], xmm0
jmp 0x43164f
push dword [edi + 0xc]
push dword [edi + 0x10]
call fcn.00401a90
mov ebx, dword [0x5060cc]
add ebx, 8
mov dword [esi + 4], ebx
movsd xmm0, qword [edi + 0x14]
movsd qword [esi + 0x14], xmm0
mov eax, dword [edi + 0x1c]
mov dword [esi + 0x1c], eax
mov ebp, dword [0x50acf8]
add ebp, 8
mov dword [esi], ebp
lea ecx, [esi + 0x24]
test byte [edi + 0x24], 1
jne 0x431692
lea eax, [edi + 0x24]
mov edx, dword [eax + 8]
mov dword [ecx + 8], edx
movsd xmm0, qword [eax]
movsd qword [ecx], xmm0
jmp 0x43169d
push dword [edi + 0x28]
push dword [edi + 0x2c]
call fcn.00401a90
mov dword [esi + 0x20], ebx
movzx eax, byte [edi + 0x30]
mov byte [esi + 0x30], al
mov eax, dword [0x50b45c]
add eax, 8
mov dword [esi], eax
lea ecx, [esi + 0x38]
test byte [edi + 0x38], 1
jne 0x4316cd
lea eax, [edi + 0x38]
mov edx, dword [eax + 8]
mov dword [ecx + 8], edx
movsd xmm0, qword [eax]
movsd qword [ecx], xmm0
jmp 0x4316d8
push dword [edi + 0x3c]
push dword [edi + 0x40]
call fcn.00401a90
mov dword [esi + 0x34], ebx
mov eax, dword [esp]
mov dword [esi + 0x44], eax
lea ecx, [esi + 0x4c]
test byte [edi + 0x4c], 1
jne 0x4316fd
lea eax, [edi + 0x4c]
mov edx, dword [eax + 8]
mov dword [ecx + 8], edx
movsd xmm0, qword [eax]
movsd qword [ecx], xmm0
jmp 0x431708
push dword [edi + 0x50]
push dword [edi + 0x54]
call fcn.00401a90
mov dword [esi + 0x48], ebx
movsd xmm0, qword [edi + 0x58]
movsd qword [esi + 0x58], xmm0
mov eax, dword [edi + 0x60]
mov dword [esi + 0x60], eax
mov dword [esi + 0x44], ebp
lea ecx, [esi + 0x68]
test byte [edi + 0x68], 1
jne 0x43173a
lea eax, [edi + 0x68]
mov edx, dword [eax + 8]
mov dword [ecx + 8], edx
movsd xmm0, qword [eax]
movsd qword [ecx], xmm0
jmp 0x431745
push dword [edi + 0x6c]
push dword [edi + 0x70]
call fcn.00401a90
mov dword [esi + 0x64], ebx
movzx eax, byte [edi + 0x74]
mov byte [esi + 0x74], al
movzx eax, word [edi + 0x78]
mov word [esi + 0x78], ax
add esp, 4
pop esi
pop edi
pop ebx
pop ebp
ret 4
Function at 0x43aee0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebx
push edi
push esi
mov esi, ecx
mov edi, dword [esp + 0x10]
mov eax, dword [edi]
mov dword [ecx], eax
add ecx, 8
test byte [edi + 8], 1
jne 0x43af09
lea eax, [edi + 8]
mov edx, dword [eax + 8]
mov dword [ecx + 8], edx
movsd xmm0, qword [eax]
movsd qword [ecx], xmm0
jmp 0x43af14
push dword [edi + 0xc]
push dword [edi + 0x10]
call fcn.00401a90
mov ebx, dword [0x5060cc]
add ebx, 8
mov dword [esi + 4], ebx
lea ecx, [esi + 0x18]
test byte [edi + 0x18], 1
jne 0x43af98
lea eax, [edi + 0x18]
mov edx, dword [eax + 8]
mov dword [ecx + 8], edx
movsd xmm0, qword [eax]
movsd qword [ecx], xmm0
mov dword [esi + 0x14], ebx
lea ecx, [esi + 0x28]
test byte [edi + 0x28], 1
je 0x43afaf
push dword [edi + 0x2c]
push dword [edi + 0x30]
call fcn.00401a90
mov dword [esi + 0x24], ebx
lea ecx, [esi + 0x38]
test byte [edi + 0x38], 1
je 0x43afcc
push dword [edi + 0x3c]
push dword [edi + 0x40]
call fcn.00401a90
mov dword [esi + 0x34], ebx
lea ecx, [esi + 0x48]
test byte [edi + 0x48], 1
je 0x43afe9
push dword [edi + 0x4c]
push dword [edi + 0x50]
call fcn.00401a90
mov dword [esi + 0x44], ebx
lea ecx, [esi + 0x58]
test byte [edi + 0x58], 1
je 0x43b006
push dword [edi + 0x5c]
push dword [edi + 0x60]
call fcn.00401a90
jmp 0x43b017
push dword [edi + 0x1c]
push dword [edi + 0x20]
call fcn.00401a90
mov dword [esi + 0x14], ebx
lea ecx, [esi + 0x28]
test byte [edi + 0x28], 1
jne 0x43af46
lea eax, [edi + 0x28]
mov edx, dword [eax + 8]
mov dword [ecx + 8], edx
movsd xmm0, qword [eax]
movsd qword [ecx], xmm0
mov dword [esi + 0x24], ebx
lea ecx, [esi + 0x38]
test byte [edi + 0x38], 1
jne 0x43af5d
lea eax, [edi + 0x38]
mov edx, dword [eax + 8]
mov dword [ecx + 8], edx
movsd xmm0, qword [eax]
movsd qword [ecx], xmm0
mov dword [esi + 0x34], ebx
lea ecx, [esi + 0x48]
test byte [edi + 0x48], 1
jne 0x43af74
lea eax, [edi + 0x48]
mov edx, dword [eax + 8]
mov dword [ecx + 8], edx
movsd xmm0, qword [eax]
movsd qword [ecx], xmm0
mov dword [esi + 0x44], ebx
lea ecx, [esi + 0x58]
test byte [edi + 0x58], 1
jne 0x43af8b
lea eax, [edi + 0x58]
mov edx, dword [eax + 8]
mov dword [ecx + 8], edx
movsd xmm0, qword [eax]
movsd qword [ecx], xmm0
mov dword [esi + 0x54], ebx
movzx eax, word [edi + 0x64]
mov word [esi + 0x64], ax
lea ecx, [esi + 0x6c]
test byte [edi + 0x6c], 1
jne 0x43b03e
lea eax, [edi + 0x6c]
mov edx, dword [eax + 8]
mov dword [ecx + 8], edx
movsd xmm0, qword [eax]
movsd qword [ecx], xmm0
jmp 0x43b049
push dword [edi + 0x70]
push dword [edi + 0x74]
call fcn.00401a90
mov dword [esi + 0x68], ebx
movzx eax, word [edi + 0x78]
mov word [esi + 0x78], ax
pop esi
pop edi
pop ebx
ret 4
Function at 0x43dfb0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
push ebx
push edi
push esi
push eax
mov esi, ecx
mov edi, dword [esp + 0x24]
mov ecx, dword [esp + 0x20]
mov eax, dword [esp + 0x1c]
mov ebp, dword [esp + 0x18]
mov byte [eax], 0
mov byte [ecx], 0
mov ecx, edi
call fcn.0043b780
movzx eax, byte [ebp + 4]
test al, 1
je 0x43b678
mov eax, dword [ebp + 8]
test eax, eax
jne 0x43b682
jmp 0x43b769
shr eax, 1
test eax, eax
je 0x43b769
lea ebx, [ebp + 4]
lea ecx, [esi + 0x24]
call fcn.0043b780
lea ecx, [esi + 0x3c]
mov dword [esp], ecx
push ebx
call fcn.00504a9e
mov ecx, esi
push ebp
call fcn.0043b8e0
test al, al
je 0x43b6ae
mov ebx, dword [esp + 0x1c]
mov byte [ebx], 1
jmp 0x43b6c0
mov ecx, esi
push ebp
call fcn.0043ba00
mov ebx, dword [esp + 0x1c]
mov byte [ebx], al
test al, al
je 0x43b6ee
mov ecx, esi
push ebp
call fcn.0043bb30
mov byte [ebx], al
test al, al
je 0x43b6ea
mov ecx, dword [esi + 0xa0]
lea eax, [esi + 0x38]
push eax
call fcn.0043acc0
mov ecx, eax
xor cl, 1
mov edx, dword [esp + 0x20]
mov byte [edx], cl
jmp 0x43b6f0
xor eax, eax
jmp 0x43b6f2
xor eax, eax
mov byte [ebx], al
mov byte [esi + 0x88], al
mov eax, dword [esi + 0x24]
mov dword [edi], eax
lea ecx, [edi + 8]
lea eax, [esi + 0x2c]
push eax
call fcn.00504a9e
lea ecx, [edi + 0x18]
push dword [esp]
call fcn.00504a9e
lea ecx, [edi + 0x28]
lea eax, [esi + 0x4c]
push eax
call fcn.00504a9e
lea ecx, [edi + 0x38]
lea eax, [esi + 0x5c]
push eax
call fcn.00504a9e
lea ecx, [edi + 0x48]
lea eax, [esi + 0x6c]
push eax
call fcn.00504a9e
lea ecx, [edi + 0x58]
lea eax, [esi + 0x7c]
push eax
call fcn.00504a9e
movzx eax, word [esi + 0x88]
mov word [edi + 0x64], ax
lea ecx, [edi + 0x6c]
lea eax, [esi + 0x90]
push eax
call fcn.00504a9e
movzx eax, word [esi + 0x9c]
mov word [edi + 0x78], ax
mov al, 1
add esp, 4
pop esi
pop edi
pop ebx
pop ebp
ret 0x10
mov ecx, dword [ecx + 0x24]
jmp 0x43b640
Function at 0x448e50
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov edx, dword [ecx + 0xcc]
test edx, edx
je 0x448e93
push ebx
push edi
push esi
mov esi, dword [esp + 0x14]
mov eax, dword [esp + 0x10]
add ecx, 0xcc
mov edi, ecx
nop dword [eax]
lea ebx, [edx + 4]
cmp dword [edx + 0x10], eax
cmovae ebx, edx
cmovae edi, edx
mov edx, dword [ebx]
test edx, edx
jne 0x448e70
cmp edi, ecx
je 0x448e8b
cmp dword [edi + 0x10], eax
jbe 0x448e98
xor eax, eax
pop esi
pop edi
pop ebx
ret 8
xor eax, eax
ret 8
movsd xmm0, qword [edi + 0x28]
movsd qword [esi + 0x10], xmm0
movups xmm0, xmmword [edi + 0x18]
movups xmmword [esi], xmm0
lea ecx, [esi + 0x1c]
lea eax, [edi + 0x34]
push eax
call fcn.00504a9e
lea ecx, [esi + 0x2c]
lea eax, [edi + 0x44]
push eax
call fcn.00504a9e
lea ecx, [esi + 0x3c]
lea eax, [edi + 0x54]
push eax
call fcn.00504a9e
mov eax, dword [edi + 0x60]
mov dword [esi + 0x48], eax
movzx eax, byte [edi + 0x64]
mov byte [esi + 0x4c], al
lea ecx, [esi + 0x54]
lea eax, [edi + 0x6c]
push eax
call fcn.00504a9e
mov eax, dword [edi + 0x78]
mov dword [esi + 0x60], eax
lea ecx, [esi + 0x68]
lea eax, [edi + 0x80]
push eax
call fcn.00504a9e
movzx eax, byte [edi + 0x8c]
mov byte [esi + 0x74], al
lea ecx, [esi + 0x7c]
lea eax, [edi + 0x94]
push eax
call fcn.00504a9e
movsd xmm0, qword [edi + 0xa0]
movsd qword [esi + 0x88], xmm0
movzx eax, byte [edi + 0xa8]
mov byte [esi + 0x90], al
lea ecx, [esi + 0x98]
lea eax, [edi + 0xb0]
push eax
call fcn.00504a9e
movsd xmm0, qword [edi + 0xbc]
movsd qword [esi + 0xa4], xmm0
mov al, 1
pop esi
pop edi
pop ebx
ret 8
Function at 0x44b880
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebx
push edi
push esi
mov esi, ecx
mov edi, dword [esp + 0x10]
movsd xmm0, qword [edi + 0x10]
movsd qword [ecx + 0x10], xmm0
movups xmm0, xmmword [edi]
movups xmmword [ecx], xmm0
add ecx, 0x1c
test byte [edi + 0x1c], 1
jne 0x44b8b5
lea eax, [edi + 0x1c]
mov edx, dword [eax + 8]
mov dword [ecx + 8], edx
movsd xmm0, qword [eax]
movsd qword [ecx], xmm0
jmp 0x44b8c0
push dword [edi + 0x20]
push dword [edi + 0x24]
call fcn.00401a90
mov ebx, dword [0x5060cc]
add ebx, 8
mov dword [esi + 0x18], ebx
lea ecx, [esi + 0x2c]
test byte [edi + 0x2c], 1
jne 0x44b8ff
lea eax, [edi + 0x2c]
mov edx, dword [eax + 8]
mov dword [ecx + 8], edx
movsd xmm0, qword [eax]
movsd qword [ecx], xmm0
mov dword [esi + 0x28], ebx
lea ecx, [esi + 0x3c]
test byte [edi + 0x3c], 1
je 0x44b916
push dword [edi + 0x40]
push dword [edi + 0x44]
call fcn.00401a90
jmp 0x44b927
push dword [edi + 0x30]
push dword [edi + 0x34]
call fcn.00401a90
mov dword [esi + 0x28], ebx
lea ecx, [esi + 0x3c]
test byte [edi + 0x3c], 1
jne 0x44b8f2
lea eax, [edi + 0x3c]
mov edx, dword [eax + 8]
mov dword [ecx + 8], edx
movsd xmm0, qword [eax]
movsd qword [ecx], xmm0
mov dword [esi + 0x38], ebx
movzx eax, byte [edi + 0x4c]
mov byte [esi + 0x4c], al
mov eax, dword [edi + 0x48]
mov dword [esi + 0x48], eax
lea ecx, [esi + 0x54]
test byte [edi + 0x54], 1
jne 0x44b953
lea eax, [edi + 0x54]
mov edx, dword [eax + 8]
mov dword [ecx + 8], edx
movsd xmm0, qword [eax]
movsd qword [ecx], xmm0
jmp 0x44b95e
push dword [edi + 0x58]
push dword [edi + 0x5c]
call fcn.00401a90
mov dword [esi + 0x50], ebx
mov eax, dword [edi + 0x60]
mov dword [esi + 0x60], eax
lea ecx, [esi + 0x68]
test byte [edi + 0x68], 1
jne 0x44b983
lea eax, [edi + 0x68]
mov edx, dword [eax + 8]
mov dword [ecx + 8], edx
movsd xmm0, qword [eax]
movsd qword [ecx], xmm0
jmp 0x44b98e
push dword [edi + 0x6c]
push dword [edi + 0x70]
call fcn.00401a90
mov dword [esi + 0x64], ebx
movzx eax, byte [edi + 0x74]
mov byte [esi + 0x74], al
lea ecx, [esi + 0x7c]
test byte [edi + 0x7c], 1
jne 0x44b9b4
lea eax, [edi + 0x7c]
mov edx, dword [eax + 8]
mov dword [ecx + 8], edx
movsd xmm0, qword [eax]
movsd qword [ecx], xmm0
jmp 0x44b9c5
push dword [edi + 0x80]
push dword [edi + 0x84]
call fcn.00401a90
mov dword [esi + 0x78], ebx
movzx eax, byte [edi + 0x90]
mov byte [esi + 0x90], al
movsd xmm0, qword [edi + 0x88]
movsd qword [esi + 0x88], xmm0
lea ecx, [esi + 0x98]
test byte [edi + 0x98], 1
jne 0x44ba0a
lea eax, [edi + 0x98]
mov edx, dword [eax + 8]
mov dword [ecx + 8], edx
movsd xmm0, qword [eax]
movsd qword [ecx], xmm0
jmp 0x44ba1b
push dword [edi + 0x9c]
push dword [edi + 0xa0]
call fcn.00401a90
mov dword [esi + 0x94], ebx
movsd xmm0, qword [edi + 0xa4]
movsd qword [esi + 0xa4], xmm0
pop esi
pop edi
pop ebx
ret 4
Function at 0x457fb0
Capabilities:
Write file on windows

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x10
cmp dword [ecx + 0x40], 0
je 0x458153
mov esi, ecx
mov ecx, dword [ecx + 0x44]
test ecx, ecx
je 0x458165
mov dword [esp], 0
mov eax, dword [esi + 0x5c]
test al, 0x10
jne 0x45800b
test al, 8
je 0x45815a
movsd xmm0, qword [esi + 0x50]
movsd qword [esp + 8], xmm0
cmp byte [esi + 0x62], 0
je 0x458090
mov ecx, dword [esi + 0x10]
sub ecx, dword [esi + 0xc]
mov eax, ecx
sar eax, 0x1f
xor ebx, ebx
jmp 0x4580fc
mov eax, dword [esi + 0x18]
cmp eax, dword [esi + 0x14]
je 0x458025
mov eax, dword [esi]
mov ecx, esi
push 0xffffffffffffffff
call dword [eax + 0x34]
cmp eax, 0xffffffff
je 0x458116
lea ebp, [esi + 0x48]
nop dword [eax + eax]
mov eax, dword [esi + 0x20]
mov ecx, dword [esi + 0x44]
mov edx, dword [esi + 0x34]
add edx, eax
mov edi, dword [ecx]
lea ebx, [esp + 4]
push ebx
push edx
push eax
push ebp
call dword [edi + 0x14]
mov ebx, eax
mov edi, dword [esp + 4]
mov eax, dword [esi + 0x20]
sub edi, eax
push dword [esi + 0x40]
push edi
push 1
push eax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fwrite
add esp, 0x10
cmp eax, edi
jne 0x458116
cmp ebx, 1
je 0x458030
cmp ebx, 2
je 0x458116
push dword [esi + 0x40]
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fflush
add esp, 4
test eax, eax
jne 0x458116
jmp 0x45815a
mov eax, dword [ecx]
call dword [eax + 0x18]
mov edx, dword [esi + 0x24]
mov edi, dword [esi + 0x28]
sub edi, edx
test eax, eax
jle 0x4580bc
mov edx, edi
mov ecx, dword [esi + 0x10]
sub ecx, dword [esi + 0xc]
sar edx, 0x1f
imul ecx, eax
mov eax, ecx
sar eax, 0x1f
add ecx, edi
adc eax, edx
xor ebx, ebx
jmp 0x4580fc
mov eax, dword [esi + 0xc]
cmp eax, dword [esi + 0x10]
je 0x4580f3
mov ebx, edi
sar ebx, 0x1f
mov ecx, dword [esi + 0x44]
sub eax, dword [esi + 8]
mov ebp, dword [ecx]
push eax
push edx
push dword [esi + 0x20]
lea eax, [esp + 0x14]
push eax
call dword [ebp + 0x20]
add eax, dword [esi + 0x20]
mov ecx, dword [esi + 0x24]
sub ecx, eax
mov eax, ecx
sar eax, 0x1f
add ecx, edi
adc eax, ebx
mov bl, 1
jmp 0x4580fc
mov eax, edi
sar eax, 0x1f
xor ebx, ebx
mov ecx, edi
xor edx, edx
neg ecx
sbb edx, eax
push 1
push edx
push ecx
push dword [esi + 0x40]
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll__fseeki64]
add esp, 0x10
test eax, eax
je 0x45811f
mov dword [esp], 0xffffffff
jmp 0x45815a
test bl, bl
je 0x45812e
movsd xmm0, qword [esp + 8]
movsd qword [esi + 0x48], xmm0
mov eax, dword [esi + 0x20]
mov dword [esi + 0x28], eax
mov dword [esi + 0x24], eax
mov dword [esi + 8], 0
mov dword [esi + 0xc], 0
mov dword [esi + 0x10], 0
mov dword [esi + 0x5c], 0
mov dword [esp], 0
mov eax, dword [esp]
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret
call fcn.00458590
int3
Function at 0x45c1f0
Capabilities:
Write file on windows

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x10
mov eax, dword [esp + 0x24]
movzx edx, byte [eax + 4]
test dl, 1
je 0x45c212
mov esi, dword [eax + 8]
mov bl, 1
test esi, esi
jne 0x45c220
jmp 0x45c2e4
mov esi, edx
shr esi, 1
mov bl, 1
test esi, esi
je 0x45c2e4
cmp byte [ecx + 0x44], 0
jne 0x45c2e2
mov ebp, dword [ecx + 0x30]
test ebp, ebp
je 0x45c23d
mov edi, ecx
test dl, 1
je 0x45c278
mov eax, dword [eax + 0xc]
jmp 0x45c27b
mov edi, ecx
mov byte [ecx + 0x44], 1
movzx eax, byte [0x533388]
test al, al
je 0x45c2f0
mov esi, esp
mov ecx, esi
push 0xd
push 0x533ffc
call fcn.00451b90
test byte [esp + 4], 1
je 0x45c2c3
mov eax, dword [esp + 0xc]
test byte [edi + 0x24], 1
jne 0x45c2cd
lea ecx, [edi + 0x25]
jmp 0x45c2d0
add eax, 5
push ebp
push esi
push 1
push eax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fwrite
add esp, 0x10
cmp eax, esi
jne 0x45c299
push dword [edi + 0x30]
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fflush
add esp, 4
jmp 0x45c2e4
mov byte [edi + 0x44], 1
movzx eax, byte [0x533388]
test al, al
je 0x45c32e
mov esi, esp
mov ecx, esi
push 0xc
push 0x533ffc
call fcn.00451b90
test byte [esp + 4], 1
jne 0x45c269
lea eax, [esp + 5]
test byte [edi + 0x24], 1
je 0x45c273
mov ecx, dword [edi + 0x2c]
push ecx
push eax
push edi
call fcn.0043e620
add esp, 0xc
mov ecx, esi
call fcn.0045cab0
xor ebx, ebx
mov eax, ebx
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret 4
push 0x533388
call sub.libc.dll___cxa_guard_acquire
add esp, 4
test eax, eax
je 0x45c252
mov ecx, 0x533ffc
call fcn.00451820
push 0x45c6a0
call fcn.00401310
add esp, 4
push 0x533388
call sub.libc.dll___cxa_guard_release
add esp, 4
jmp 0x45c252
push 0x533388
call sub.libc.dll___cxa_guard_acquire
add esp, 4
test eax, eax
je 0x45c2ac
mov ecx, 0x533ffc
call fcn.00451820
push 0x45c6a0
call fcn.00401310
add esp, 4
push 0x533388
call sub.libc.dll___cxa_guard_release
add esp, 4
jmp 0x45c2ac
Function at 0x467ad0
Capabilities:
Query environment variable

Disassembly:
movzx eax, byte [esp + 0xc]
mov ecx, dword [esp + 4]
mov edx, dword [esp + 8]
mov dword [0x533574], edx
mov dword [0x533570], ecx
test al, al
jne 0x467afe
push str.LLVM_DISABLE_CRASH_REPORT
call sub.api_ms_win_crt_environment_l1_1_0.dll_getenv
add esp, 4
test eax, eax
je 0x467b03
call fcn.004aecf0
push 0x467690
push 0x16
call sub.api_ms_win_crt_runtime_l1_1_0.dll_signal
add esp, 8
push 0x8003
call dword [sym.imp.KERNEL32.dll_SetErrorMode]
push 1
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__set_error_mode]
add esp, 4
call fcn.004677e0
push 0x5334cc
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
ret