joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10011140
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push 0x424
mov eax, 0x10043a41
call fcn.1001f59e
mov edx, dword [ebp + 0x10]
mov eax, dword [ebp + 8]
mov esi, dword [ebp + 0xc]
xor ebx, ebx
mov dword [ebp - 0x41c], edx
mov dword [ebp - 0x430], ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 0x428], ecx
mov dword [ebp - 0x42c], ebx
mov dword [ebp - 0x418], ebx
push 2
push ebx
push eax
mov byte [ebp - 4], 1
call dword [sym.imp.kernel32.dll_LoadLibraryExW]
mov edi, eax
mov dword [ebp - 0x424], edi
test edi, edi
jne 0x100111a1
call fcn.1000e50a
mov esi, eax
jmp 0x10011279
push dword [ebp - 0x41c]
push esi
push edi
call dword [sym.imp.kernel32.dll_FindResourceW]
mov esi, eax
test esi, esi
jne 0x100111bf
call fcn.1000e50a
jmp 0x10011270
push esi
push edi
call dword [sym.imp.kernel32.dll_LoadResource]
mov dword [ebp - 0x420], eax
test eax, eax
je 0x100111b5
push esi
push edi
call dword [sym.imp.kernel32.dll_SizeofResource]
mov esi, eax
lea eax, [esi + 1]
mov dword [ebp - 0x41c], esi
cmp eax, esi
jae 0x100111f2
mov esi, 0x8007000e
jmp 0x10011272
push eax
lea ecx, [ebp - 0x418]
mov byte [ebp - 4], 2
call fcn.1003b748
mov dword [ebp - 4], 1
jmp 0x10011226
cmp dword [ebp - 0x418], 0
je 0x100111e8
push esi
push dword [ebp - 0x418]
push esi
push dword [ebp - 0x420]
push ebx
push 3
call dword [sym.imp.kernel32.dll_MultiByteToWideChar]
mov ecx, eax
test ecx, ecx
je 0x100111b5
mov eax, dword [ebp - 0x418]
push dword [ebp + 0x14]
xor edx, edx
mov word [eax + ecx*2], dx
push dword [ebp - 0x418]
lea ecx, [ebp - 0x42c]
call fcn.1003b748
mov esi, eax
push edi
call dword [sym.imp.kernel32.dll_FreeLibrary]
lea eax, [ebp - 0x414]
cmp dword [ebp - 0x418], eax
je 0x10011292
lea ecx, [ebp - 0x418]
call fcn.10011348
mov eax, esi
call fcn.1001f5f7
ret 0x10
Function at 0x1001f1ed
Capabilities:
Accept command line arguments

Disassembly:
push 8
push 0x100463b8
call fcn.10021546
mov eax, dword [ebp + 0xc]
cmp eax, 1
jne 0x1001f27b
call fcn.10021514
test eax, eax
jne 0x1001f211
xor eax, eax
jmp 0x1001f347
call fcn.10020948
test eax, eax
jne 0x1001f221
call fcn.10021532
jmp 0x1001f20a
call fcn.100214c8
call dword [sym.imp.kernel32.dll_GetCommandLineA]
mov dword [0x10193274], eax
call fcn.1003b748
mov dword [0x101913dc], eax
call fcn.1003b748
test eax, eax
jns 0x1001f24b
call fcn.10020621
jmp 0x1001f21a
call fcn.1003b748
test eax, eax
js 0x1001f274
call fcn.10021100
test eax, eax
js 0x1001f274
push 0
call fcn.1003b748
pop ecx
test eax, eax
jne 0x1001f274
inc dword [0x101913d8]
jmp 0x1001f344
call fcn.100210ad
jmp 0x1001f244
xor edi, edi
cmp eax, edi
jne 0x1001f2da
cmp dword [0x101913d8], edi
jle 0x1001f20a
dec dword [0x101913d8]
mov dword [ebp - 4], edi
cmp dword [0x10191744], edi
jne 0x1001f29f
call fcn.10020e3b
cmp dword [ebp + 0x10], edi
jne 0x1001f2b3
call fcn.100210ad
call fcn.10020621
call fcn.10021532
mov dword [ebp - 4], 0xfffffffe
call fcn.1001f2c6
jmp 0x1001f344
cmp eax, 2
jne 0x1001f338
call fcn.100205ed
push 0x214
push 1
call fcn.1003b748
pop ecx
pop ecx
mov esi, eax
cmp esi, edi
je 0x1001f20a
push esi
push dword [0x1004a940]
push dword [0x10191724]
call dword [sym.imp.kernel32.dll_DecodePointer]
call eax
test eax, eax
je 0x1001f32c
push edi
push esi
call fcn.10020662
pop ecx
pop ecx
call dword [sym.imp.kernel32.dll_GetCurrentThreadId]
mov dword [esi], eax
or dword [esi + 4], 0xffffffff
jmp 0x1001f344
push esi
call fcn.1003b748
pop ecx
jmp 0x1001f20a
cmp eax, 3
jne 0x1001f344
push edi
call fcn.1003b748
pop ecx
xor eax, eax
inc eax
call fcn.1002158b
ret 0xc

Function at 0x1001f4a5
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x1004a900]
jne 0x1001fc43
repz ret
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x328
mov dword [0x10191500], eax
mov dword [0x101914fc], ecx
mov dword [0x101914f8], edx
mov dword [0x101914f4], ebx
mov dword [0x101914f0], esi
mov dword [0x101914ec], edi
mov word [0x10191518], ss
mov word [0x1019150c], cs
mov word [0x101914e8], ds
mov word [0x101914e4], es
mov word [0x101914e0], fs
mov word [0x101914dc], gs
pushfd
pop dword [0x10191510]
mov eax, dword [ebp]
mov dword [0x10191504], eax
mov eax, dword [ebp + 4]
mov dword [0x10191508], eax
lea eax, [ebp + 8]
mov dword [0x10191514], eax
mov eax, dword [ebp - 0x320]
mov dword [0x10191450], 0x10001
mov eax, dword [0x10191508]
mov dword [0x10191404], eax
mov dword [0x101913f8], 0xc0000409
mov dword [0x101913fc], 1
mov eax, dword [0x1004a900]
mov dword [ebp - 0x328], eax
mov eax, dword [0x1004a904]
mov dword [ebp - 0x324], eax
call dword [sym.imp.kernel32.dll_IsDebuggerPresent]
mov dword [0x10191448], eax
push 1
call fcn.10022bfb
pop ecx
push 0
call dword [sym.imp.kernel32.dll_SetUnhandledExceptionFilter]
push 0x10003a64
call dword [sym.imp.kernel32.dll_UnhandledExceptionFilter]
cmp dword [0x10191448], 0
jne 0x1001fd2f
push 1
call fcn.10022bfb
pop ecx
push 0xc0000409
call dword [sym.imp.kernel32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.kernel32.dll_TerminateProcess]
leave
ret
Function at 0x10033620
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebx
push esi
mov esi, ecx
xor ebx, ebx
cmp dword [esi + 0x34], ebx
je 0x10033636
push dword [esi + 0x34]
call fcn.1003b748
mov dword [esi + 0x34], ebx
mov ecx, dword [esi + 0x44]
test ecx, ecx
je 0x10033646
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
mov dword [esi + 0x44], ebx
mov ecx, dword [esi + 0x48]
test ecx, ecx
je 0x10033656
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
mov dword [esi + 0x48], ebx
mov ecx, dword [esi + 0x50]
test ecx, ecx
je 0x10033666
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
mov dword [esi + 0x50], ebx
mov ecx, dword [esi + 0x4c]
test ecx, ecx
je 0x10033676
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
mov dword [esi + 0x4c], ebx
mov ecx, dword [esi + 0x54]
test ecx, ecx
je 0x10033686
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
mov dword [esi + 0x54], ebx
push edi
push 7
lea edi, [esi + 0x58]
pop ebx
mov ecx, dword [edi]
test ecx, ecx
je 0x1003369c
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
and dword [edi], 0
add edi, 4
dec ebx
jne 0x1003368d
mov ecx, dword [esi + 0x7c]
pop edi
test ecx, ecx
je 0x100336b5
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
mov dword [esi + 0x7c], ebx
jmp 0x100336b7
xor ebx, ebx
mov ecx, dword [esi + 0x78]
test ecx, ecx
je 0x100336c7
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
mov dword [esi + 0x78], ebx
mov ecx, dword [esi + 0x3c]
test ecx, ecx
je 0x100336d7
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
mov dword [esi + 0x3c], ebx
mov dword [esi + 0x25c], ebx
mov dword [esi + 0x264], ebx
cmp dword [esi + 0x260], ebx
je 0x100336f1
mov dword [esi + 0x260], ebx
mov eax, dword [esi + 0x2d4]
test eax, eax
je 0x10033708
push eax
call fcn.1003b748
pop ecx
mov dword [esi + 0x2d4], ebx
mov eax, dword [esi + 0x150]
test eax, eax
je 0x1003371f
push eax
call fcn.1003b748
pop ecx
mov dword [esi + 0x150], ebx
mov ecx, esi
pop esi
pop ebx

Function at 0x1003b748
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x50
pushal
call 0x1003b757
pop dword [ebp - 0x40]
mov eax, 0x30c9da29
add eax, 0xdf39dd2e
sub dword [ebp - 0x40], eax
push 0x40
push 0x1000
push 0x42169
push 0
mov eax, 0x66695e2a
add eax, 0xa996b356
add eax, dword [ebp - 0x40]
call dword [eax]
mov ecx, 0x4da6
mov ebx, eax
mov esi, 0x3f526d12
add esi, 0xd0c78aee
add esi, dword [ebp - 0x40]
mov edx, 0xe4cc62b0
sub dword [ebp - 0xc], esi
mov edi, dword [esi]
add dword [ebp - 0x20], 0x2b6bf756
xor edi, edx
xor dword [ebp - 8], edx
mov dword [ebx], edi
xor dword [ebp - 0x34], 0xf33b16fe
add ebx, 0x71753658
sub ebx, 0x71753654
add esi, 0x55b4a535
sub esi, 0x55b4a531
loop 0x1003b7aa
add eax, 0x229f952a
sub eax, 0x229e6bbf
xor ebx, ebx
add ebx, eax
add eax, 0x165a6a56
sub eax, 0x165a6a51
mov ecx, 0x6c43e061
sub ecx, 0x5c43e061
add ecx, dword [ebp - 0x40]
call ebx
leave
ret
Function at 0x42e672
Capabilities:
Authenticate hmac
Encode data using xor

Disassembly:
sbb cl, 0xd2
dec edx
test esi, esp
std
mov dl, 5
xor al, 0x9e
inc edi
psubsw mm1, qword [ebx + ebp + 0x494db602]
dec ecx
dec ecx
xor byte [edi], cl
jle 0x42e65e
inc esp
pop ss
mov bh, dl
or al, 0x88
lea eax, [ebx]
invalid

Function at 0x45c212
Capabilities:
Encode data using xor

Disassembly:
mov bh, 0x97
pop ebp
cmpsb byte [esi], byte es:[edi]
cmp al, 0x1d
cmp dh, byte [ebp - 0x63]
pop ss
add eax, 0x76e1c4ec
inc ebp
add al, 0xb1
mov esp, 0x644e9773
invalid

Function at 0x4c89ca
Capabilities:
Encode data using xor

Disassembly:
out 0xfb, al
imul edx, dword [ecx - 0x6b0fba21], 0xffffff8c
mov cl, 0x60
sub al, 0xa9
mov esi, 0xae7ecdc9
in eax, 0x2c
xor byte [esi], dh
mov edi, 0xef12afb1
mov byte [0x3a487810], al
in eax, 0x8f
sub dword [esi - 0x2f], 0xfffffffa
add esi, dword [esi - 0x690971fb]
or eax, 0x8c91e861
xchg ecx, eax
mov word [ecx], gs
in al, dx
xchg ecx, eax
mov word [ecx], gs
in al, dx
xchg ebp, eax
adc eax, 0xbf04832a
dec ebx
bound ecx, qword cs:[edx - 0x23]
cli
dec eax
pop esi
push esi
cld
dec edi
fsubr dword [ecx - 0x26]
aas
sahf
out 0x62, eax
jl 0x4c899b
xchg edx, eax
xor al, 0x72
invalid

Function at 0x5de392
Capabilities:
Encode data using xor

Disassembly:
mov cl, 0x31
xchg ecx, eax
rcr dword [edx - 0x11266a3b], 1
mov byte [ecx + 0x36e7c395], cl
mov si, bp
adc ax, 0xe845
cmp eax, 0x6daa0e7c
sub ebx, dword [eax - 0x79712acd]
shr ebx, 1
les ebx, [eax - 0x7a]
cmpsd dword [esi], dword es:[edi]
jns fcn.005de392
div byte [0x788aa756]
mov ch, 0x5a
jo 0x5de435
mov word [edi - 0x55], es
inc esi
and dl, byte [ebx + 0x17]
jmp dword [ecx]
or ah, byte [ebx + 0x6c1e1bf6]
pushal
insb byte es:[edi], dx
lss ecx, [edx + 0x42]
pop edx
invalid

Function at 0x633716
Capabilities:
Encode data using xor

Disassembly:
loop 0x63375f
leave
mov byte [esi - 0x28fcebef], dh
salc
adc ch, byte [ebp + 0x468da91f]
int3
std
nop
push ebp
fcomp qword [ebx + 0x3c25301e]
aad 0x6c
dec eax
mov edi, 0x4bb84511
inc ecx
mov dl, cl
sbb dh, cl
invalid
Function at 0x425f50
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x71cf4d
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x857060]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x10], edi
mov ebx, dword [ebp + 8]
mov dword [ebp - 0x14], edi
mov dword [ebp - 4], 0
mov dword [edi], vtable.adobe::nglcontroller::AMTLegacyProfile.0
mov dword [edi + 4], 0
mov dword [edi + 0x18], 0
mov dword [edi + 0x1c], 0xf
mov byte [edi + 8], 0
mov byte [ebp - 4], 1
lea esi, [edi + 0x30]
mov dword [edi + 0x20], 0
mov dword [edi + 0x24], 0
mov dword [edi + 0x28], 0
mov dword [edi + 0x2c], 0
push 0x28
mov dword [ebp - 0x10], esi
mov dword [esi], 0
mov dword [esi + 4], 0
call fcn.006d0976
add esp, 4
mov dword [eax], eax
mov dword [eax + 4], eax
mov dword [eax + 8], eax
mov word [eax + 0xc], 0x101
mov dword [esi], eax
xor eax, eax
mov word [edi + 0x38], ax
mov dword [edi + 0x4c], eax
mov dword [edi + 0x50], 0xf
mov byte [edi + 0x3c], al
mov dword [edi + 0x64], eax
mov dword [edi + 0x68], 0xf
mov byte [edi + 0x54], al
mov dword [edi + 0x7c], eax
mov dword [edi + 0x80], 0xf
mov byte [edi + 0x6c], al
mov dword [edi + 0x94], eax
mov dword [edi + 0x98], 0xf
mov byte [edi + 0x84], al
mov byte [ebp - 4], 6
mov dword [edi + 0x9c], eax
mov dword [edi + 0xa0], eax
mov dword [edi + 0xa4], eax
mov word [edi + 0xa8], ax
mov dword [edi + 0xac], 2
mov word [edi + 0xb0], ax
cmp dword [ebx + 0x10], eax
je 0x426077
push ebx
mov ecx, edi
call fcn.00426280
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x428ba0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 0x10]
xor ecx, ecx
test esi, esi
je 0x428bcb
mov edx, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0xc]
movzx eax, byte [ecx + edi]
inc ecx
xor eax, edx
imul edx, eax, 0x1000193
cmp ecx, esi
jb 0x428bb4
pop edi
mov eax, edx
pop esi
pop ebp
ret
mov eax, dword [ebp + 8]
pop esi
pop ebp
ret

Function at 0x42c330
Capabilities:
Create thread

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x71d979
mov eax, dword fs:[0]
push eax
push ebx
sub esp, 0x7c
mov eax, dword [0x857060]
xor eax, ebp
mov dword [ebp - 0x14], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebx + 8]
mov dword [ebp - 4], 0
mov dword [ebp - 0x24], 0
mov byte [ebp - 4], 1
mov ecx, dword [esi + 0x24]
test ecx, ecx
je 0x42c396
mov eax, dword [ecx]
lea edx, [ebp - 0x48]
push edx
mov eax, dword [eax]
call eax
mov dword [ebp - 0x24], eax
lea eax, [ebx + 0xc]
mov byte [ebp - 4], 2
push eax
lea ecx, [ebp - 0x88]
call fcn.00449340
lea eax, [ebp - 0x70]
mov dword [ebp - 0x4c], 0
mov dword [ebp - 0x20], eax
mov byte [ebp - 4], 4
mov ecx, dword [esi + 0x24]
test ecx, ecx
je 0x42c3ce
mov eax, dword [ecx]
lea edx, [ebp - 0x70]
push edx
mov eax, dword [eax]
call eax
mov dword [ebp - 0x4c], eax
push 0x40
mov byte [ebp - 4], 5
call fcn.006d0976
mov esi, eax
add esp, 4
lea eax, [ebp - 0x70]
mov dword [esi + 0x10], 0
lea ecx, [esi + 0x18]
mov dword [esi + 0x14], 0
movups xmm0, xmmword [ebp - 0x88]
push eax
movups xmmword [esi], xmm0
movq xmm0, qword [ebp - 0x78]
movq qword [esi + 0x10], xmm0
mov dword [ebp - 0x78], 0
mov dword [ebp - 0x74], 0xf
mov byte [ebp - 0x88], 0
call fcn.004527a0
mov dword [ebp - 0x20], esi
lea eax, [ebp - 0x18]
mov byte [ebp - 4], 6
push eax
push 0
push esi
push 0x44f770
push 0
push 0
call fcn.006f230d
add esp, 0x18
mov dword [ebp - 0x1c], eax
test eax, eax
je 0x42c4d6
lea ecx, [ebp - 0x88]
mov byte [ebp - 4], 8
call fcn.0042c580
lea ecx, [ebp - 0x1c]
call fcn.00429f30
cmp dword [ebp - 0x18], 0
jne 0x42c4e4
mov ecx, dword [ebp - 0x24]
test ecx, ecx
je 0x42c487
mov edx, dword [ecx]
lea eax, [ebp - 0x48]
cmp ecx, eax
setne al
movzx eax, al
push eax
call dword [edx + 0x10]
mov dword [ebp - 0x24], 0
mov edx, dword [ebx + 0x20]
cmp edx, 0x10
jb 0x42c4b7
mov ecx, dword [ebx + 0xc]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x42c4ad
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x42c4e9
push edx
push ecx
call fcn.006d0bf7
add esp, 8
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.006d0965
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret 0x1c
push 6
mov dword [ebp - 0x18], 0
call fcn.006c0730
call fcn.006f286c
call fcn.006f1bea
int3
Function at 0x447570
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x14
cmp dword [ecx + 0x38], 0
push ebx
push esi
push edi
mov dword [esp + 0xc], ecx
je 0x447656
mov esi, dword [ebp + 0x10]
mov ebx, esi
mov edx, dword [ebp + 0xc]
mov edi, edx
mov eax, dword [ebp + 8]
mov dword [esp + 0x10], eax
test esi, esi
jl 0x447645
jg 0x4475b0
test edx, edx
je 0x447645
nop dword [eax]
call fcn.00449f10
mov esi, eax
mov eax, edx
mov dword [esp + 0x14], eax
test eax, eax
jl 0x447604
jg 0x4475c7
test esi, esi
je 0x447604
cmp ebx, eax
jg 0x4475d7
jl 0x4475d1
cmp edi, esi
jae 0x4475d7
mov esi, edi
mov dword [esp + 0x14], ebx
mov ecx, dword [esp + 0xc]
mov eax, dword [esp + 0x10]
push esi
push eax
mov eax, dword [ecx + 0x20]
push dword [eax]
call fcn.006e8ef0
mov ecx, dword [esp + 0x18]
add esp, 0xc
sub edi, esi
sbb ebx, dword [esp + 0x14]
mov eax, dword [ecx + 0x30]
sub dword [eax], esi
mov eax, dword [ecx + 0x20]
add dword [eax], esi
jmp 0x447629
mov ecx, dword [esp + 0xc]
mov eax, dword [esp + 0x10]
mov edx, dword [ecx]
movzx eax, byte [eax]
push eax
call dword [edx + 0xc]
cmp eax, 0xffffffff
je 0x44763f
mov ecx, dword [esp + 0xc]
add edi, 0xffffffff
mov esi, 1
adc ebx, 0xffffffff
add dword [esp + 0x10], esi
test ebx, ebx
jg 0x4475b0
jl 0x44763f
test edi, edi
jne 0x4475b0
mov edx, dword [ebp + 0xc]
mov esi, dword [ebp + 0x10]
sub edx, edi
mov eax, edx
sbb esi, ebx
mov edx, esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov eax, dword [ecx + 0x20]
mov esi, dword [ebp + 0xc]
mov edi, dword [ebp + 0x10]
mov dword [esp + 0x18], esi
mov eax, dword [eax]
mov dword [esp + 0x1c], edi
mov dword [esp + 0x10], eax
test eax, eax
je 0x447678
mov eax, dword [ecx + 0x30]
mov eax, dword [eax]
jmp 0x44767a
xor eax, eax
cdq
mov ebx, eax
mov eax, edx
mov dword [esp + 0x14], eax
test edi, edi
jl 0x4476f8
jg 0x44768d
test esi, esi
je 0x4476f8
test eax, eax
jl 0x4476d2
jg 0x447697
test ebx, ebx
je 0x4476d2
cmp edi, eax
jg 0x4476a7
jl 0x4476a1
cmp esi, ebx
jae 0x4476a7
mov ebx, esi
mov dword [esp + 0x14], edi
push ebx
push dword [ebp + 8]
push dword [esp + 0x18]
call fcn.006e8ef0
mov ecx, dword [esp + 0x18]
add esp, 0xc
mov edx, dword [ebp + 8]
add edx, ebx
sub esi, ebx
mov eax, dword [ecx + 0x30]
sbb edi, dword [esp + 0x14]
sub dword [eax], ebx
mov eax, dword [ecx + 0x20]
add dword [eax], ebx
jmp 0x4476d5
mov edx, dword [ebp + 8]
test edi, edi
jl 0x4476f8
jg 0x4476df
test esi, esi
je 0x4476f8
mov eax, dword [ecx + 0x4c]
test eax, eax
je 0x4476f8
push eax
push esi
push 1
push edx
call fcn.006f2c59
add esp, 0x10
sub esi, eax
sbb edi, 0
mov eax, dword [esp + 0x18]
mov edx, dword [esp + 0x1c]
sub eax, esi
sbb edx, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x447c40
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
mov eax, dword [0x857060]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, ecx
cmp ebx, 0xffffffff
jne 0x447c70
pop esi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.006d0965
mov esp, ebp
pop ebp
ret 4
mov eax, dword [esi + 0x20]
push edi
mov ecx, dword [eax]
test ecx, ecx
je 0x447cac
mov edx, dword [esi + 0x30]
mov edi, dword [edx]
lea eax, [edi + ecx]
cmp ecx, eax
jae 0x447cac
lea ecx, [edi - 1]
mov dword [edx], ecx
mov edx, dword [esi + 0x20]
mov esi, dword [edx]
lea ecx, [esi + 1]
mov dword [edx], ecx
mov byte [esi], bl
pop edi
pop esi
mov eax, ebx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.006d0965
mov esp, ebp
pop ebp
ret 4
cmp dword [esi + 0x4c], 0
je 0x447d93
mov edi, dword [esi + 0xc]
lea eax, [esi + 0x3c]
cmp dword [edi], eax
jne 0x447cd4
mov edx, dword [esi + 0x54]
mov ecx, dword [esi + 0x50]
sub edx, ecx
mov dword [edi], ecx
mov eax, dword [esi + 0x1c]
mov dword [eax], ecx
mov eax, dword [esi + 0x2c]
mov dword [eax], edx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x447d07
push dword [esi + 0x4c]
movsx eax, bl
push eax
call fcn.006f1c64
add esp, 8
or ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, ebx
pop edi
pop esi
mov eax, ecx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.006d0965
mov esp, ebp
pop ebp
ret 4
lea eax, [ebp - 0x2c]
mov byte [ebp - 0x25], bl
mov edx, dword [ecx]
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x25]
push eax
lea eax, [esi + 0x40]
push eax
call dword [edx + 0x1c]
test eax, eax
js 0x447d93
cmp eax, 1
jle 0x447d66
cmp eax, 3
jne 0x447d93
push dword [esi + 0x4c]
movsx eax, byte [ebp - 0x25]
push eax
call fcn.006f1c64
add esp, 8
or ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, ebx
pop edi
pop esi
mov eax, ecx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.006d0965
mov esp, ebp
pop ebp
ret 4
mov edi, dword [ebp - 0x2c]
lea eax, [ebp - 0x24]
sub edi, eax
je 0x447d83
push dword [esi + 0x4c]
push edi
push 1
push eax
call fcn.006f2c59
add esp, 0x10
cmp edi, eax
jne 0x447d93
lea eax, [ebp - 0x25]
mov byte [esi + 0x3d], 1
cmp dword [ebp - 0x30], eax
jne 0x447c97
mov ecx, dword [ebp - 4]
or eax, 0xffffffff
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.006d0965
mov esp, ebp
pop ebp
ret 4
Function at 0x449990
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x857060]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, ecx
cmp dword [esi + 0x38], 0
je 0x449a4a
cmp byte [esi + 0x3d], 0
je 0x449a4a
mov eax, dword [esi]
push edi
push 0xffffffffffffffff
call dword [eax + 0xc]
cmp eax, 0xffffffff
je 0x449a38
mov ecx, dword [esi + 0x38]
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 4]
push eax
mov edx, dword [ecx]
lea eax, [ebp - 0x24]
push eax
lea eax, [esi + 0x40]
push eax
call dword [edx + 0x20]
sub eax, 0
je 0x449a00
sub eax, 1
je 0x449a04
sub eax, 2
jne 0x449a38
mov byte [esi + 0x3d], al
mov al, 1
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.006d0965
mov esp, ebp
pop ebp
ret
mov byte [esi + 0x3d], 0
mov edi, dword [ebp - 0x28]
lea eax, [ebp - 0x24]
sub edi, eax
je 0x449a21
push dword [esi + 0x4c]
push edi
push 1
push eax
call fcn.006f2c59
add esp, 0x10
cmp edi, eax
jne 0x449a38
cmp byte [esi + 0x3d], 0
pop edi
sete al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.006d0965
mov esp, ebp
pop ebp
ret
pop edi
xor al, al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.006d0965
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
mov al, 1
xor ecx, ebp
pop esi
call fcn.006d0965
mov esp, ebp
pop ebp
ret

Function at 0x44b150
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x720930
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x857060]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, ecx
mov dword [ebp - 0x10], eax
push 8
mov dword [eax], vtable.std::basic_streambuf_char__struct_std::char_traits_char__.0
call fcn.006d0976
mov esi, eax
xorps xmm0, xmm0
movq qword [esi], xmm0
push 1
mov dword [ebp - 4], 0
call fcn.006c0917
mov dword [esi + 4], eax
add esp, 8
mov eax, dword [ebp - 0x10]
lea edi, [eax + 0x14]
lea ecx, [eax + 0x18]
lea edx, [eax + 0x24]
mov dword [eax + 0x34], esi
lea ebx, [eax + 4]
mov dword [eax + 0xc], ebx
lea esi, [eax + 8]
mov dword [eax + 0x10], esi
mov dword [eax + 0x1c], edi
mov dword [eax + 0x20], ecx
mov dword [eax + 0x2c], edx
add eax, 0x28
mov dword [ebp - 0x14], ebx
mov ebx, dword [ebp - 0x10]
mov dword [ebx + 0x30], eax
mov ebx, dword [ebp - 0x14]
mov dword [esi], 0
mov dword [ecx], 0
mov dword [eax], 0
mov eax, dword [ebp - 0x10]
mov dword [ebx], 0
mov dword [edi], 0
mov dword [edx], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x44e690
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x720e8f
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push esi
push edi
mov eax, dword [0x857060]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov dword [ebp - 0x10], ebx
mov edi, dword [ebp + 8]
lea ecx, [ebx + 4]
mov dword [ebp - 0x18], ebx
mov eax, dword [edi]
mov dword [ebx], eax
lea eax, [edi + 4]
push eax
call fcn.00449340
mov dword [ebp - 4], 0
lea esi, [ebx + 0x30]
mov eax, dword [edi + 0x20]
mov dword [ebx + 0x20], eax
mov eax, dword [edi + 0x24]
mov dword [ebx + 0x24], eax
mov eax, dword [edi + 0x28]
mov dword [ebx + 0x28], eax
mov eax, dword [edi + 0x2c]
mov dword [ebp - 0x10], esi
mov dword [ebx + 0x2c], eax
push 0x28
mov dword [esi], 0
mov dword [esi + 4], 0
mov dword [ebp - 0x14], esi
mov dword [ebp - 0x10], esi
call fcn.006d0976
add esp, 4
mov dword [eax], eax
mov dword [eax + 4], eax
mov dword [eax + 8], eax
mov word [eax + 0xc], 0x101
mov dword [esi], eax
mov byte [ebp - 4], 1
lea eax, [edi + 0x30]
push dword [ebp - 0x18]
mov ecx, esi
push eax
call fcn.0044e510
mov byte [ebp - 4], 2
lea ecx, [ebx + 0x3c]
mov ax, word [edi + 0x38]
mov word [ebx + 0x38], ax
lea eax, [edi + 0x3c]
push eax
call fcn.00449340
lea eax, [edi + 0x54]
mov byte [ebp - 4], 3
push eax
lea ecx, [ebx + 0x54]
call fcn.00449340
lea eax, [edi + 0x6c]
mov byte [ebp - 4], 4
push eax
lea ecx, [ebx + 0x6c]
call fcn.00449340
lea eax, [edi + 0x84]
mov byte [ebp - 4], 5
push eax
lea ecx, [ebx + 0x84]
call fcn.00449340
mov eax, dword [edi + 0x9c]
mov dword [ebx + 0x9c], eax
mov eax, dword [edi + 0xa0]
mov dword [ebx + 0xa0], eax
mov eax, ebx
mov ecx, dword [edi + 0xa4]
mov dword [ebx + 0xa4], ecx
mov ecx, dword [edi + 0xa8]
mov dword [ebx + 0xa8], ecx
mov ecx, dword [edi + 0xac]
mov dword [ebx + 0xac], ecx
movzx ecx, byte [edi + 0xb0]
mov byte [ebx + 0xb0], cl
movzx ecx, byte [edi + 0xb1]
mov byte [ebx + 0xb1], cl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4