joyce8/EMBER2024-capa huggingface dataset:
Function at 0x446900
Capabilities:
Create thread
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x48fb66
mov eax, dword fs:[0]
push eax
mov eax, 0x1444
call fcn.00464680
mov eax, dword [0x4af280]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push 0x4b4548
mov dword [ebp - 0xa40], 0x4b4548
mov byte [ebp - 0xa3c], 0
call fcn.0044c5dd
add esp, 4
test eax, eax
jne 0x446ab3
cmp dword [0x4b4574], 0x7fffffff
je 0x446aba
mov byte [ebp - 0xa3c], 1
mov dword [ebp - 0xa38], 0x4b4528
mov dword [ebp - 4], eax
movzx eax, byte [ebp + 8]
xor eax, 0x811c9dc5
imul ecx, eax, 0x1000193
movzx eax, byte [ebp + 9]
xor ecx, eax
movzx eax, byte [ebp + 0xa]
imul ecx, ecx, 0x1000193
xor ecx, eax
movzx eax, byte [ebp + 0xb]
imul ecx, ecx, 0x1000193
xor ecx, eax
imul eax, ecx, 0x1000193
mov ecx, 0x4b4528
push eax
lea eax, [ebp + 8]
push eax
lea eax, [ebp - 0xa30]
push eax
call fcn.00441e70
mov eax, dword [eax + 4]
test eax, eax
je 0x446a8b
cmp eax, dword [0x4b452c]
je 0x446a8b
lea eax, [ebp + 8]
mov ecx, 0x4b4528
push eax
call fcn.00448cb0
mov dword [ebp - 0x1450], 0
lea esi, [ebp + 0xc]
mov ecx, 0x282
mov dword [ebp - 0xa28], eax
lea edi, [ebp - 0x1448]
rep movsd dword es:[edi], dword [esi]
mov ecx, 0x284
lea esi, [ebp - 0x1450]
lea edi, [ebp - 0xa20]
rep movsd dword es:[edi], dword [esi]
push 0xa18
call fcn.0046421b
add esp, 4
test eax, eax
je 0x446a3e
mov ecx, 0x286
lea esi, [ebp - 0xa28]
mov edi, eax
rep movsd dword es:[edi], dword [esi]
jmp 0x446a40
xor eax, eax
mov dword [ebp - 0xa34], eax
lea ecx, [ebp - 0xa2c]
mov byte [ebp - 4], 1
push ecx
push 0
push eax
push 0x442210
push 0
push 0
call fcn.00474ef2
add esp, 0x18
mov dword [ebp - 0xa30], eax
test eax, eax
je 0x446ad2
mov ecx, dword [ebp - 0xa2c]
mov byte [ebp - 4], 2
test ecx, ecx
je 0x446acb
push ecx
push eax
call fcn.0044ca2e
add esp, 8
test eax, eax
jne 0x446acb
push 0x4b4548
call fcn.0044c5ee
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00464259
mov esp, ebp
pop ebp
ret
push 5
call fcn.0044c865
push 6
mov dword [0x4b4574], 0x7ffffffe
call fcn.0044c865
push 1
call fcn.0044c865
push 6
mov dword [ebp - 0xa2c], 0
call fcn.0044c865
int3
Function at 0x4035ac
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
push ebx
xor ebx, ebx
imul edx, dword [ebx + 0x204f008], 0x8088405
inc edx
mov dword [ebx + 0x204f008], edx
mul edx
mov eax, edx
pop ebx
ret

Function at 0x41cd18
Capabilities:
Decompress data using aplib

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push ebp
mov esi, dword [ebp - 4]
mov edi, dword [ebp - 8]
cld
mov dl, 0x80
mov al, byte [esi]
add esi, 1
mov byte [edi], al
add edi, 1
mov ebx, 2
add dl, dl
jne 0x41cd49
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x41cd31
add dl, dl
jne 0x41cd54
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x41cda5
xor eax, eax
add dl, dl
jne 0x41cd61
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x41ce42
add dl, dl
jne 0x41cd70
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x41cd7b
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x41cd86
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x41cd91
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0x41cd9b
mov ebx, edi
sub ebx, eax
mov al, byte [ebx]
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0x41cd40
mov eax, 1
add dl, dl
jne 0x41cdb3
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x41cdbe
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x41cdaa
sub eax, ebx
mov ebx, 1
jne 0x41cdf1
mov ecx, 1
add dl, dl
jne 0x41cdd7
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x41cde2
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x41cdce
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x41cd40
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x41ce08
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x41ce13
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x41cdff
cmp eax, 0x7d00
sbb ecx, 0xffffffff
cmp eax, 0x500
sbb ecx, 0xffffffff
cmp eax, 0x80
adc ecx, 0
cmp eax, 0x80
adc ecx, 0
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x41cd40
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0x41ce63
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0x41cd40
pop ebp
sub edi, dword [ebp - 8]
mov dword [ebp - 0xc], edi
pop edi
pop esi
pop ebx
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret
Function at 0x41e558
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
mov dword [ebp - 4], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x2037a17
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [ebp - 8], eax
mov ecx, ebx
mov eax, ebx
xor edx, edx
push edx
push eax
mov eax, dword [ecx + 0x3c]
cdq
add eax, dword [esp]
adc edx, dword [esp + 4]
add esp, 8
mov edx, dword [eax + 0x78]
test edx, edx
je 0x41e609
add edx, ebx
mov eax, edx
mov esi, dword [eax + 0x18]
mov edx, dword [eax + 0x1c]
add edx, ebx
mov dword [ebp - 0x10], edx
mov edi, dword [eax + 0x20]
add edi, ebx
mov edx, dword [eax + 0x24]
add edx, ebx
mov dword [ebp - 0xc], edx
mov edx, dword [ebp - 4]
cmp edx, 0xffff
jbe 0x41e5f2
test esi, esi
jbe 0x41e609
mov eax, dword [edi]
add eax, ebx
mov edx, dword [ebp - 4]
call fcn.004088e4
test eax, eax
jne 0x41e5e4
mov eax, dword [ebp - 0xc]
movzx eax, word [eax]
shl eax, 2
add eax, dword [ebp - 0x10]
mov eax, dword [eax]
mov dword [ebp - 8], eax
jmp 0x41e609
add dword [ebp - 0xc], 2
add edi, 4
dec esi
test esi, esi
ja 0x41e5c1
jmp 0x41e609
mov ecx, edx
sub ecx, dword [eax + 0x10]
cmp ecx, dword [eax + 0x14]
jae 0x41e609
mov eax, ecx
shl eax, 2
add eax, dword [ebp - 0x10]
mov eax, dword [eax]
mov dword [ebp - 8], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x2037a1e
ret
Function at 0x41ee60
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x10], ebx
mov dword [ebp - 8], ecx
mov word [ebp - 2], dx
xor eax, eax
push ebp
push 0x203840f
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp + 8]
call fcn.00404cd0
xor ebx, ebx
mov eax, ebx
and eax, 0x80000001
jns 0x41ee9b
dec eax
or eax, 0xfffffffe
inc eax
test eax, eax
jne 0x41eeb4
lea eax, [ebp - 0x10]
mov edx, dword [0x2051268]
mov edx, dword [edx]
mov edx, dword [edx + 0xc]
call fcn.00404d30
jmp 0x41eec7
lea eax, [ebp - 0x10]
mov edx, dword [0x2051268]
mov edx, dword [edx]
mov edx, dword [edx + 0x10]
call fcn.00404d30
lea eax, [ebp - 0x10]
mov edx, ebx
sar edx, 1
jns 0x41eed3
adc edx, 0
mov edx, dword [edx*4 + 0x20500e8]
call fcn.00404f20
push 0
push 0x80
push 3
push 0
push 1
push 0x80000000
mov eax, dword [ebp - 0x10]
call fcn.00404f04
push eax
call fcn.00406b1c
mov esi, eax
cmp esi, 0xffffffff
je 0x41efe1
mov eax, 0x40
call fcn.00403268
mov edi, eax
push 0
lea eax, [ebp - 0xc]
push eax
push 0x40
push edi
push esi
call fcn.00406d74
test eax, eax
je 0x41efd4
mov eax, edi
cmp word [eax], 0x5a4d
jne 0x41efd4
push 0
push 0
mov eax, dword [eax + 0x3c]
push eax
push esi
call fcn.00406dd4
mov eax, edi
call fcn.00403288
mov eax, 0x18
call fcn.00403268
mov edi, eax
push 0
lea eax, [ebp - 0xc]
push eax
push 0x18
push edi
push esi
call fcn.00406d74
test eax, eax
je 0x41efd4
mov eax, edi
cmp dword [eax], 0x4550
jne 0x41efd4
add eax, 4
mov dx, word [eax]
cmp dx, 0x14c
jb 0x41efd4
cmp dx, 0x150
ja 0x41efd4
mov eax, edi
call fcn.00403288
mov eax, 0xe0
call fcn.00403268
mov edi, eax
push 0
lea eax, [ebp - 0xc]
push eax
push 0xe0
push edi
push esi
call fcn.00406d74
test eax, eax
je 0x41efd4
mov eax, edi
mov dx, word [eax + 0x44]
cmp dx, word [ebp - 2]
jne 0x41efd4
mov eax, dword [eax + 0x10]
mov edx, dword [ebp - 8]
mov dword [edx], eax
mov eax, dword [ebp + 8]
mov edx, dword [ebp - 0x10]
call fcn.00404d0c
mov eax, edi
call fcn.00403288
push esi
call fcn.00406ad4
mov eax, dword [ebp + 8]
mov eax, dword [eax]
xor edx, edx
call fcn.0040502c
jne 0x41eff9
inc ebx
cmp ebx, 0x19
jne 0x41ee8d
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x2038416
lea eax, [ebp - 0x10]
call fcn.00404cd0
ret
Function at 0x40690e
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
cmp dword [0x42f764], 0
jne 0x40694c
xor ecx, ecx
push esi
push 8
mov eax, ecx
pop esi
mov edx, eax
and dl, 1
movzx edx, dl
neg edx
sbb edx, edx
and edx, 0xedb88320
shr eax, 1
xor eax, edx
dec esi
jne 0x406922
mov dword [ecx*4 + 0x42f760], eax
inc ecx
cmp ecx, 0x100
jl 0x40691d
pop esi
cmp dword [ebp + 0x10], 0
mov eax, dword [ebp + 8]
not eax
jbe 0x406979
mov ecx, dword [ebp + 0xc]
movzx edx, byte [ecx]
dec dword [ebp + 0x10]
xor edx, eax
and edx, 0xff
shr eax, 8
xor eax, dword [edx*4 + 0x42f760]
inc ecx
cmp dword [ebp + 0x10], 0
ja 0x40695a
not eax
pop ebp
ret 0xc

Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43000c
nop
pop eax
nop
nop
nop
nop
nop
add eax, 0x403d6f
nop
sub eax, 0x403d15
nop
mov ebx, dword [eax]
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
nop
nop
xor dword [ebx], edx
nop
nop
nop
add ebx, 4
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
jl 0x430030
nop
nop
nop
nop
add eax, 0xc
nop
nop
nop
nop
nop
cmp dword [eax], 0
nop
jne 0x43001e
nop
nop
nop
nop
nop
popal
nop
nop
nop
jmp loc.00401219

Function at 0x433000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43300c
nop
nop
nop
nop
nop
pop eax
add eax, 0x40a063
nop
nop
sub eax, 0x40a009
mov ebx, dword [eax]
nop
nop
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
xor dword [ebx], edx
nop
nop
nop
nop
add ebx, 4
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
nop
nop
nop
jl 0x433030
nop
nop
nop
add eax, 0xc
nop
cmp dword [eax], 0
nop
nop
nop
nop
nop
nop
jne 0x43301e
nop
popal
nop
nop
nop
nop
nop
jmp 0x431219
Function at 0x433000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..data
nop
nop
nop
nop
push 4
nop
pop edi
nop
nop
nop
nop
nop
nop
cmp eax, 0
nop
nop
nop
nop
nop
je 0x433072
nop
mov ebx, 0x40de38
nop
mov ecx, ebx
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
nop
nop
xor edx, edx
push eax
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
nop
nop
nop
div edi
xchg ecx, eax
nop
nop
nop
nop
nop
pop eax
nop
nop
nop
nop
nop
mov esi, 0x1c4e4270
nop
nop
nop
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
add eax, edi
loop 0x433060
nop
nop
nop
nop
nop
mov eax, section..data_1
nop
nop
nop
cmp eax, 0
je 0x4330d2
nop
nop
nop
nop
mov ebx, 0x4304d8
nop
mov ecx, ebx
nop
nop
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
push eax
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
div edi
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
pop eax
nop
nop
nop
nop
nop
mov esi, 0x659555a0
nop
nop
nop
nop
xor dword [eax], esi
nop
nop
nop
add eax, edi
nop
nop
nop
nop
nop
nop
loop 0x4330c0
nop
nop
nop
popal
nop
nop
jmp 0x431219
Function at 0x10006b20
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x1001c4d3
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x10
push esi
mov esi, dword [esp + 0x24]
fld dword [esi]
mov dword [esp + 4], 0
fmul dword [esi + 0xc]
mov dword [esp + 8], 0
fld dword [esi + 8]
fmul dword [esi + 4]
fsubp st(1)
fdivr dword [0x1001e1a4]
fstp dword [esp + 0x24]
mov dword [esp + 0x1c], 0
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 0
push method.R_MemoryException_Allocation.virtual_12
push 0x10009eb0
push 2
push 8
lea eax, [esp + 0x14]
push eax
mov byte [esp + 0x30], 1
call fcn.1001c000
push esi
lea ecx, [esp + 8]
mov byte [esp + 0x20], 2
call fcn.10009b80
fld dword [esp + 0x10]
fmul dword [esp + 0x24]
fstp dword [esi]
fld dword [esp + 8]
fmul dword [esp + 0x24]
fchs
fstp dword [esi + 4]
fld dword [esp + 0xc]
fmul dword [esp + 0x24]
fchs
fstp dword [esi + 8]
fld dword [esp + 4]
fmul dword [esp + 0x24]
fstp dword [esi + 0xc]
push method.R_MemoryException_Allocation.virtual_12
push 2
push 8
lea ecx, [esp + 0x10]
push ecx
mov dword [esp + 0x2c], 4
call fcn.1001bf0c
mov ecx, dword [esp + 0x14]
pop esi
mov dword fs:[0], ecx
add esp, 0x1c
ret 4
Function at 0x10009fd0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x1001c609
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
xor eax, eax
push esi
mov esi, ecx
mov dword [esp + 4], esi
mov dword [esi], eax
mov dword [esi + 4], eax
mov dword [esi + 8], eax
mov dword [esi + 0xc], eax
mov dword [esp + 0x10], eax
mov dword [esi + 0x10], eax
mov dword [esi + 0x14], eax
mov dword [esi + 0x18], eax
mov dword [esi + 0x1c], eax
mov dword [esi + 0x20], eax
mov dword [esi + 0x24], eax
mov dword [esi + 0x28], eax
mov dword [esi + 0x2c], eax
mov dword [esi + 0x30], eax
mov dword [esi + 0x34], eax
mov dword [esi + 0x38], eax
mov dword [esi + 0x3c], eax
push method.R_MemoryException_Allocation.virtual_12
push fcn.10009d90
push 4
push 0x10
push esi
mov byte [esp + 0x24], 3
call fcn.1001c000
mov eax, dword [esp + 0x18]
mov ecx, dword [eax]
mov dword [esi], ecx
mov edx, dword [esp + 0x1c]
mov eax, dword [edx]
mov ecx, dword [esp + 0x20]
mov dword [esi + 4], eax
mov edx, dword [ecx]
mov eax, dword [esp + 0x24]
mov dword [esi + 8], edx
mov ecx, dword [eax]
mov edx, dword [esp + 0x28]
mov dword [esi + 0xc], ecx
mov eax, dword [edx]
mov ecx, dword [esp + 0x2c]
mov dword [esi + 0x10], eax
mov edx, dword [ecx]
mov eax, dword [esp + 0x30]
mov dword [esi + 0x14], edx
mov ecx, dword [eax]
mov edx, dword [esp + 0x34]
mov dword [esi + 0x18], ecx
mov eax, dword [edx]
mov ecx, dword [esp + 0x38]
mov dword [esi + 0x1c], eax
mov edx, dword [ecx]
mov eax, dword [esp + 0x3c]
mov dword [esi + 0x20], edx
mov ecx, dword [eax]
mov edx, dword [esp + 0x40]
mov dword [esi + 0x24], ecx
mov eax, dword [edx]
mov ecx, dword [esp + 0x44]
mov dword [esi + 0x28], eax
mov edx, dword [ecx]
mov eax, dword [esp + 0x48]
mov dword [esi + 0x2c], edx
mov ecx, dword [eax]
mov edx, dword [esp + 0x4c]
mov dword [esi + 0x30], ecx
mov eax, dword [edx]
mov ecx, dword [esp + 0x50]
mov dword [esi + 0x34], eax
mov edx, dword [ecx]
mov eax, dword [esp + 0x54]
mov dword [esi + 0x38], edx
mov ecx, dword [eax]
mov dword [esi + 0x3c], ecx
mov eax, esi
mov ecx, dword [esp + 8]
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret 0x40

Function at 0x1000a470
Capabilities:
Create directory

Disassembly:
mov eax, dword [sym.rlmfc.dll_int_R_File::m_archiveHandling]
sub esp, 0x100
cmp eax, 1
push esi
push edi
jne 0x1000a48b
lea edi, [ecx + 1]
lea edx, [esp + 8]
jmp 0x1000a491
lea edx, [esp + 8]
mov edi, ecx
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
shr ecx, 2
mov esi, edi
mov edi, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
or ecx, 0xffffffff
xor eax, eax
lea edi, [esp + 8]
repne scasb al, byte es:[edi]
not ecx
dec ecx
test ecx, ecx
pop edi
pop esi
jle 0x1000a4d2
lea eax, [esp]
dec eax
cmp byte [eax + ecx], 0x5c
je 0x1000a4d2
dec ecx
test ecx, ecx
jg 0x1000a4c7
mov byte [esp + ecx], 0
push 0
lea ecx, [esp + 4]
push ecx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
add esp, 0x100
ret
Function at 0x1000ad80
Capabilities:
Read file on windows

Disassembly:
sub esp, 0x10c
push esi
push edi
mov edi, dword [esp + 0x11c]
test edi, edi
mov esi, ecx
ja 0x1000ada2
pop edi
xor eax, eax
pop esi
add esp, 0x10c
ret 8
mov ecx, dword [esi + 0xc]
mov eax, dword [esi + 0x10]
lea edx, [ecx + edi]
cmp edx, eax
jb 0x1000adb3
sub eax, ecx
mov edi, eax
mov eax, dword [esi]
mov ecx, dword [esp + 0x118]
push eax
push edi
push 1
push ecx
call dword [sym.imp.MSVCRT.dll_fread]
add esp, 0x10
cmp eax, edi
je 0x1000ae4d
mov esi, dword [esi + 4]
lea ecx, [esp + 0xc]
call sym.rlmfc.dll_protected:_void___thiscall_R_Exception::constructor_void_
push esi
lea edx, [esp + 0x10]
push str.Overreading_stream__s
mov edi, vtable.R_FileException_OverreadingStream.0
push edx
mov dword [esp + 0x18], edi
call sym.rlmfc.dll_public:_void___cdecl_R_Exception::setError_char_const__
mov al, byte [0x10046708]
add esp, 0xc
test al, 1
jne 0x1000ae27
mov dl, al
or dl, 1
mov ecx, 0x10046720
mov byte [0x10046708], dl
call sym.rlmfc.dll_protected:_void___thiscall_R_Exception::constructor_void_
push 0x1000eb40
mov dword [0x10046720], edi
call fcn.1001bef4
add esp, 4
lea eax, [esp + 0xc]
push eax
mov ecx, 0x10046720
call sym.rlmfc.dll_public:_class_R_Exception____thiscall_R_Exception::operator_class_R_Exception_const__
push 0x10021610
lea ecx, [esp + 0xc]
push ecx
mov dword [esp + 0x10], 0x10046720
call sub.MSVCRT.dll__CxxThrowException
add dword [esi + 0xc], edi
mov eax, edi
pop edi
pop esi
add esp, 0x10c
ret 8
Function at 0x1000d7b0
Capabilities:
Write file on windows

Disassembly:
push ebx
mov ebx, dword [esp + 8]
push ebp
push esi
mov esi, ecx
push edi
mov ecx, ebx
xor ebp, ebp
call sym.rlmfc.dll_private:_static_char____fastcall_R_File::relativeToAbsolutePath_char_const__
mov edi, eax
mov ecx, edi
call sym.rlmfc.dll_private:_static_char____fastcall_R_File::absolutePathToDirStructure_char_const__
mov ecx, edi
mov dword [esp + 0x14], eax
call sym.rlmfc.dll_private:_static_void___fastcall_R_File::checkPathExistence_char_const__
mov eax, dword [esi + 0x568]
test eax, eax
je 0x1000d7e9
push ebx
mov ecx, esi
call sym.rlmfc.dll_public:_int___thiscall_R_File::del_char_const__
push ebx
mov ecx, esi
call sym.rlmfc.dll_public:_enum_R_File::Location___thiscall_R_File::where_char_const__
cmp eax, 2
jne 0x1000d7fe
mov ebx, dword [esp + 0x14]
xor ebp, ebp
jmp 0x1000d839
mov ebx, dword [esp + 0x14]
push 0x1002eb58
push ebx
call dword [sym.imp.MSVCRT.dll_fopen]
mov esi, eax
add esp, 8
test esi, esi
je 0x1000d839
mov eax, dword [esp + 0x1c]
mov ecx, dword [esp + 0x18]
push esi
push eax
push 1
push ecx
call dword [sym.imp.MSVCRT.dll_fwrite]
push esi
call dword [sym.imp.MSVCRT.dll_fclose]
add esp, 0x14
mov ebp, 1
test edi, edi
je 0x1000d846
push edi
call fcn.1001be40
add esp, 4
test ebx, ebx
je 0x1000d853
push ebx
call fcn.1001be40
add esp, 4
pop edi
pop esi
mov eax, ebp
pop ebp
pop ebx
ret 0xc

Function at 0x1000d860
Capabilities:
Write file on windows

Disassembly:
push ebx
push ebp
push esi
mov ebp, ecx
mov ecx, dword [esp + 0x10]
push edi
call sym.rlmfc.dll_private:_static_char____fastcall_R_File::relativeToAbsolutePath_char_const__
mov edi, eax
mov ecx, edi
call sym.rlmfc.dll_private:_static_char____fastcall_R_File::absolutePathToDirStructure_char_const__
mov ecx, edi
mov ebx, eax
call sym.rlmfc.dll_private:_static_void___fastcall_R_File::checkPathExistence_char_const__
push 0x1002eb5c
push ebx
call dword [sym.imp.MSVCRT.dll_fopen]
mov esi, eax
add esp, 8
test esi, esi
je 0x1000d8c5
push 2
push 0
push esi
call dword [sym.imp.MSVCRT.dll_fseek]
mov eax, dword [esp + 0x28]
mov ecx, dword [esp + 0x24]
push esi
push eax
push 1
push ecx
call dword [sym.imp.MSVCRT.dll_fwrite]
push esi
call dword [sym.imp.MSVCRT.dll_fclose]
add esp, 0x20
mov esi, 1
jmp 0x1000d8dd
mov edx, dword [esp + 0x1c]
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x14]
push edx
push eax
push ecx
mov ecx, ebp
call sym.rlmfc.dll_public:_int___thiscall_R_File::save_char_const___void_const___unsigned_int_
mov esi, eax
test edi, edi
je 0x1000d8ea
push edi
call fcn.1001be40
add esp, 4
test ebx, ebx
je 0x1000d8f7
push ebx
call fcn.1001be40
add esp, 4
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
ret 0xc
Function at 0x1000d900
Capabilities:
Delete file

Disassembly:
mov ecx, dword [esp + 4]
push ebx
push esi
push edi
call sym.rlmfc.dll_private:_static_char____fastcall_R_File::relativeToAbsolutePath_char_const__
mov edi, eax
mov ecx, edi
call sym.rlmfc.dll_private:_static_char____fastcall_R_File::absolutePathToDirStructure_char_const__
mov ebx, eax
push ebx
call dword [sym.imp.MSVCRT.dll_remove]
add esp, 4
mov esi, eax
neg esi
sbb esi, esi
inc esi
test edi, edi
je 0x1000d935
push edi
call fcn.1001be40
add esp, 4
test ebx, ebx
je 0x1000d942
push ebx
call fcn.1001be40
add esp, 4
pop edi
mov eax, esi
pop esi
pop ebx
ret 4

Function at 0x1000e190
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 0x10]
test eax, eax
jne 0x1000e1a2
mov dword [ebp + 0x10], 1
push edi
mov edi, dword [ebp + 0xc]
test edi, edi
mov dword [ebp - 4], 0
jle 0x1000e224
push ebx
push esi
mov esi, dword [ebp + 8]
mov eax, dword [ebp - 4]
cdq
mov ecx, 5
idiv ecx
mov dword [ebp + 0xc], edx
mov ecx, dword [ebp + 0xc]
mov ebx, dword [ebp + 8]
add ebx, dword [ebp - 4]
mov al, byte [ebx]
rol al, cl
mov byte [ebx], al
mov ecx, dword [ebp + 0x10]
mov eax, 0xb92143fb
imul ecx
add edx, ecx
sar edx, 7
mov eax, edx
shr eax, 0x1f
add edx, eax
imul edx, edx, 0x763d
lea eax, [ecx*8]
sub eax, ecx
lea eax, [ecx + eax*8]
lea ecx, [eax + eax*2]
mov eax, ecx
mov ecx, dword [ebp - 4]
sub eax, edx
mov edx, eax
mov al, cl
add al, 3
mov bl, 6
imul bl
xor al, byte [ecx + esi]
add al, dl
mov byte [ecx + esi], al
inc ecx
cmp ecx, edi
mov dword [ebp + 0x10], edx
mov dword [ebp - 4], ecx
jl 0x1000e1b6
pop esi
pop ebx
pop edi
mov esp, ebp
pop ebp
ret 0xc

Function at 0x1000e730
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push esi
mov esi, dword [esp + 0xc]
or eax, 0xffffffff
xor ecx, ecx
test esi, esi
jbe 0x1000e76c
push ebx
push edi
mov edi, dword [esp + 0x10]
xor edx, edx
mov dl, byte [ecx + edi]
mov ebx, eax
and ebx, 0xff
shr eax, 8
and edx, 0xff
xor edx, ebx
mov edx, dword [edx*4 + 0x1002e214]
xor eax, edx
inc ecx
cmp ecx, esi
jb 0x1000e744
pop edi
pop ebx
not eax
pop esi
ret 8
Function at 0x10019610
Capabilities:
Delete file

Disassembly:
push esi
mov esi, ecx
mov eax, dword [esi + 0x5c]
mov edx, dword [eax + 4]
mov eax, dword [edx + esi + 0x60]
cmp dword [eax + 0x4c], 0xffffffff
lea ecx, [esi + 0x5c]
je 0x1001962c
call dword [sym.imp.MSVCIRT.dll_public:_void___thiscall_ofstream::close_void_]
mov eax, dword [esp + 8]
test eax, eax
je 0x10019644
mov ecx, dword [esi + 0x4b9]
push ecx
call dword [sym.imp.MSVCRT.dll_remove]
add esp, 4
mov byte [esi + 0x4e5], 1
pop esi
ret 4

Function at 0x10019790
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x1001d353
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push esi
mov esi, ecx
push edi
xor edi, edi
lea eax, [esi + 4]
lea ecx, [esi + 0xc]
mov dword [esp + 8], esi
mov dword [eax], edi
mov dword [esi + 8], ecx
mov dword [ecx], eax
mov dword [esi + 0x10], edi
mov dword [esi + 0x14], edi
mov dword [esi + 0x18], 0x7fffffff
mov dword [esi + 0x1c], edi
mov dword [esi + 0x20], edi
mov dword [esi + 0x24], edi
mov dword [esi], vtable.R_DLList_class_R_CPUDriver__.0
lea eax, [esi + 0x2c]
lea ecx, [esi + 0x34]
mov dword [esp + 0x14], edi
mov dword [eax], edi
mov dword [esi + 0x30], ecx
mov dword [ecx], eax
mov dword [esi + 0x38], edi
mov dword [esi + 0x3c], edi
mov dword [esi + 0x40], 0x7fffffff
mov dword [esi + 0x44], edi
mov dword [esi + 0x48], edi
mov dword [esi + 0x4c], edi
mov dword [esi + 0x28], vtable.R_DLList_struct_HINSTANCE____.0
push 1
lea ecx, [esi + 0x5c]
mov byte [esp + 0x18], 1
call dword [sym.imp.MSVCIRT.dll_public:_void___thiscall_ofstream::constructor_void_]
lea eax, [esi + 0x4c1]
lea ecx, [esi + 0x4c9]
mov dword [eax], edi
mov dword [esi + 0x4c5], ecx
mov dword [ecx], eax
mov ecx, dword [esp + 0xc]
mov dword [esi + 0x4cd], edi
mov dword [esi + 0x4d1], edi
mov dword [esi + 0x4d9], edi
mov dword [esi + 0x4dd], edi
mov dword [esi + 0x4e1], edi
mov dword [esi + 0x4d5], 0x7fffffff
mov dword [esi + 0x4bd], 0x1001eec4
pop edi
mov eax, esi
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret 4
Function at 0x1001b340
Capabilities:
Get memory capacity

Disassembly:
sub esp, 0x20
lea eax, [esp]
push eax
mov dword [esp + 4], 0x20
call dword [sym.imp.KERNEL32.dll_GlobalMemoryStatus]
mov eax, dword [esp + 8]
add esp, 0x20
ret

Function at 0x1001b360
Capabilities:
Get memory capacity

Disassembly:
sub esp, 0x20
lea eax, [esp]
push eax
mov dword [esp + 4], 0x20
call dword [sym.imp.KERNEL32.dll_GlobalMemoryStatus]
mov eax, dword [esp + 0xc]
add esp, 0x20
ret