joyce8/EMBER2024-capa huggingface dataset:
Function at 0x50232d24
Capabilities:
Packed with generic packer

Disassembly:
or byte [ebx], dl
push esp
inc edi
jb 0x50232d9a
inc edx
jne 0x50232da1
je 0x50232d9e
outsb dx, byte [esi]
inc esp
jb 0x50232d94
ja 0x50232d7a
jbe 0x50232d9c
outsb dx, byte [esi]
je 0x50232d3a
add eax, 0x65530608
outsb dx, byte [esi]
jb 0x50232d4b
push esp
dec edi
bound ebp, qword [edx + 0x65]
arpl word [eax + eax + 5], si
dec ecx
outsb dx, byte [esi]
js 0x50232d5a
add byte [0x65646e49], al
js 0x50232d5a
dec ecx
outsb dx, byte [esi]
je 0x50232dbc
jb 0x50232d63
or byte [esi], al
push es
inc ebx
popal
outsb dx, byte [esi]
jbe 0x50232dc2
jae 0x50232d6a
push esp
inc ebx
popal
outsb dx, byte [esi]
jbe 0x50232dca
jae 0x50232d7b
adc byte [edx + edx*2], al
add al, 0x52
arpl word gs:[ebp + eax + 0x54], si
push edx
arpl word gs:[eax + eax + 5], si
push ebx
je 0x50232ddc
popal
je 0x50232de2
adc byte [edx + eax*2 + 0x75], dl
je 0x50232df7
outsd dx, dword [esi]
outsb dx, byte [esi]
inc esp
jb 0x50232de9
ja 0x50232ddd
je 0x50232ded
je 0x50232df3
add byte [esp + edi*2], cl
and al, 0x50
cmp byte [esp + 0x50], bh
jl 0x50232dba
push eax
and byte [edx + edx + 0x50], cl
push eax
add byte [eax], al
add byte [eax], al
mov al, 0xb4
add byte [eax], al
add byte [eax - 0x6fafdd4c], dh
and dl, byte [eax - 0x70]
test al, 0x2d
and edx, dword [eax + 8]
or byte [edi], dl
outsd dx, dword [esi]
outsb dx, byte [esi]
jb 0x50232dd3
je 0x50232dfe
push esp
add byte [0x74617453], al
adc byte gs:[edx + eax*2 + 0x75], dl

Function at 0x50232da8
Capabilities:
Packed with generic packer

Disassembly:
or byte [edi], dl
push esp
inc edi
jb 0x50232e1e
inc edx
jne 0x50232e25
je 0x50232e22
outsb dx, byte [esi]
inc esp
jb 0x50232e18
ja 0x50232e02
arpl word [edi + 0x6e], bp
inc ebp
jbe 0x50232e24
outsb dx, byte [esi]
je 0x50232dc2
push es
or byte [esi], al
push ebx
outsb dx, byte gs:[esi]
jb 0x50232dd3
push esp
dec edi
bound ebp, qword [edx + 0x65]
arpl word [eax + eax + 5], si
dec ecx
outsb dx, byte [esi]
js 0x50232de2
add byte [0x65646e49], al
js 0x50232de2
dec ecx
outsb dx, byte [esi]
je 0x50232e44
jb 0x50232deb
or byte [esi], al
push es
inc ebx
popal
outsb dx, byte [esi]
jbe 0x50232e4a
jae 0x50232df2
push esp
inc ebx
popal
outsb dx, byte [esi]
jbe 0x50232e52
jae 0x50232e03
adc byte [edx + edx*2], al
add al, 0x52
arpl word gs:[ebp + eax + 0x54], si
push edx
arpl word gs:[eax + eax + 5], si
push ebx
je 0x50232e64
popal
je 0x50232e6a
adc byte [edx + eax*2 + 0x75], dl
je 0x50232e7f
outsd dx, dword [esi]
outsb dx, byte [esi]
inc esp
jb 0x50232e71
ja 0x50232e65
je 0x50232e75
je 0x50232e7b
add dword [edx], ecx
push esp
js 0x50232e90
dec edi
jae 0x50232e86
jae 0x50232e86
je 0x50232e2a
pop es
dec ecx
outsb dx, byte [esi]
je 0x50232e8c
jb 0x50232e2b
add byte [esp + edi*2], cl
or al, 0x7c
and al, 0x50
cmp byte [esp + 0x50], bh
and byte [edx + edx + 0x50], cl
add byte [eax], al
add byte [eax], al
mov al, 0xb4
and dl, byte [eax + 0x38]
jl 0x50232e66
push eax
nop
dec eax
and edx, dword cs:[eax + 8]
or byte [esi], dl
outsd dx, dword [esi]
outsb dx, byte [esi]
pop es
je 0x50232e73
or byte [edi + 0x6c], cl
js 0x50232e84
js 0x50232e96
Function at 0x50232e48
Capabilities:
Packed with generic packer

Disassembly:
or byte [esi], dl
push esp
inc edi
jb 0x50232ebe
inc edx
jne 0x50232ec5
je 0x50232ec2
outsb dx, byte [esi]
push edx
outsd dx, dword gs:[esi]
jb 0x50232ebd
jb 0x50232ea1
jbe 0x50232ec3
outsb dx, byte [esi]
je 0x50232e61
add ecx, dword [eax]
push es
push ebx
outsb dx, byte gs:[esi]
jb 0x50232e72
push esp
dec edi
bound ebp, qword [edx + 0x65]
arpl word [eax + eax + 8], si
add byte [eax], cl
dec edi
insb byte es:[edi], dx
dec ecx
outsb dx, byte [esi]
js 0x50232e84
dec ecx
outsb dx, byte [esi]
je 0x50232ee6
jb 0x50232e85
add byte [eax], cl
or byte [esi + 0x65], cl
ja 0x50232ed3
dec esi
ja 0x50232ed3
outsb dx, byte [esi]
js 0x50232e96
dec ecx
outsb dx, byte [esi]
je 0x50232ef8
jb 0x50232e97
add byte [esp + edi*2], cl
or al, 0x7c
and al, 0x50
cmp byte [esp + 0x50], bh
cmp byte [esp + 0x50], bh
and al, 0x50
nop
cld
and edx, dword cs:[eax]
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax + 0x30], dh
and edx, dword [eax]
add byte [eax], al
add byte [eax], al
add byte [eax], al
add al, dh
das
add byte [eax], al
invalid
and edx, dword [eax + 0x5e]
push eax
pop esi
xor byte [ebx], ah
push eax
sbb al, 3
add byte [eax], al
push 0xe0501ca2
adc byte [edx], dl
push eax
call 0x807340e9
adc dword [edx], edx
push eax
mov word [0x11405012], ds
adc dl, byte [eax - 0x24]
sbb al, 0x12
push eax
push eax
adc dl, byte [eax + 0x50]
adc dword [edx], edx
push eax
lodsb al, byte [esi]
push edx
sbb eax, 0x1210b050
push eax
mov eax, 0x14501210
cmp eax, 0x8e985023
cwde
invalid
adc al, 0x3d
and edx, dword [eax - 0x68]
cwde
Function at 0x50232efc
Capabilities:
Packed with generic packer

Disassembly:
cwde
mov ds, word [0x1d425450]
sbb eax, 0x1d425450
push eax
sbb byte [ecx + 0x23], 0x50
movsb byte es:[edi], byte [esi]
sbb eax, 0x3de4501d
and edx, dword [eax + 4]
sub dword [0x1cf0fc50], ebx
push eax
xchg esp, eax
sbb eax, 0x1d445012
adc dl, byte [eax + 0x3c]
sbb eax, 0x1d9c5012
adc dl, byte [eax - 0x78]
cmp esp, dword [ebx]
push eax
mov esp, 0xc8501d88
mov ds, word [0x1d8e1450]
push eax
clc
loop 0x50232f57
push eax
xchg esp, eax
sbb byte [0x1d82b450], 0x50
call 0x90734cc7
sbb eax, 0x1d7ee850
push eax
inc eax
loop 0x50232f67
push eax
je 0x50232f6d
sbb eax, 0x1d1fa050
push eax
cmp byte [ebp + ebx + 0x50], ah
push eax
in al, 0xf0
sbb al, 0x50
je 0x50232f42
sbb al, 0x50
insb byte es:[edi], dx
sbb al, 0x50
jo 0x50232efe
sbb eax, 0x1cf55c50
push eax
push eax
pop esp
cmc
sbb al, 0x50
mov al, 0xf3
sbb al, 0x50
sbb al, 0x50
je 0x50232fbf
sbb eax, 0x2350f450
push eax
and al, 0x20
sbb eax, 0x1d7f7450
push eax
xor al, 0x80
sbb eax, 0x1d79b850
push eax
sbb byte [eax + 0x297c501d], al
sbb eax, 0x1d34b850
push eax
adc byte [ecx + 0x23], cl
push eax
call 0xe47352d9
inc eax
sbb eax, 0x1d3ea850
push eax
insb byte es:[edi], dx
inc esp
sbb eax, 0x1d449050
push eax
and al, 0x45
sbb eax, 0x1d432850
push eax
rol byte [edx + 0x1d], 0x50
xor byte [edi - 0x7e9fafe3], dl
sbb eax, 0x1da4f050
push eax
movsb byte es:[edi], byte [esi]
xchg esi, eax
sbb eax, 0x1d486450
push eax
cwde
jge 0x50232fec
push eax
invalid
push eax
hlt
aam 0x3d
and edx, dword [eax + 0x12]
add byte [eax], dh
mov al, 0
mov ebp, 0x80007
mov dword [0x15011402], eax
add esi, ebx
push dword [eax - 0x1d001e01]
invalid
Function at 0x50235dec
Capabilities:
Check for peb ntglobalflag flag

Disassembly:
push cs
adc byte [eax + edx*2 + 0x61], dl
jb 0x50235e58
outsb dx, byte [esi]
je 0x50235e3c
outsd dx, dword [esi]
jb 0x50235e66
push ebx
je 0x50235e5d
je 0x50235e63
sbb byte [eax], al
add byte [eax], al
add dword [eax], eax
add byte [eax], al
and al, 0x7c
and al, 0x50
add byte [eax], al
add byte [eax], al
mov eax, eax
adc al, 0x5e
and edx, dword [eax + 3]
add edx, dword [edi]
arpl word [edi + 0x48], bp
je 0x50235ec3
outsd dx, dword [esi]
outsb dx, byte [esi]
inc esp
inc esp
outsd dx, dword [esi]
mov eax, eax

Function at 0x50235e14
Capabilities:
Check for peb ntglobalflag flag

Disassembly:
add edx, dword [edi]
push esp
inc esp
outsd dx, dword [esi]
arpl word [ebx + 0x43], bp
popal
jo 0x50235e93
imul ebp, dword [edi + 0x6e], 0x6569724f
outsb dx, byte [esi]
je 0x50235e8a
je 0x50235e94
outsd dx, dword [esi]
outsb dx, byte [esi]
add dword [eax], eax
add byte [eax], al
add byte [ecx], al
add byte [eax], al
add byte [eax], dl
pop esi
and edx, dword [eax + 0xd]
arpl word fs:[edi + 0x48], bp
outsd dx, dword [esi]
jb 0x50235eab
jp 0x50235eb3
outsb dx, byte [esi]
je 0x50235ea8
insb byte es:[edi], dx
or esp, dword [ebx + 0x6f]
push esi
jb 0x50235ec4
imul esp, dword [ebx + 0x61], 0x6143116c
jo 0x50235ecd
imul ebp, dword [edi + 0x6e], 0x6f446465
arpl word [ebx + 0x54], bp
jb 0x50235eca
mov eax, eax
insb byte es:[edi], dx
pop esi
and edx, dword [eax + 3]
add edx, dword [0x636f4454]
add byte [eax], al
push 0x850235e
jo 0x50235ef7
bound ecx, qword [esi + 0x6f]
outsb dx, byte [esi]
popal
inc esp
outsd dx, dword [esi]

Function at 0x50235e6c
Capabilities:
Check for peb ntglobalflag flag

Disassembly:
add edx, dword [0x636f4454]
imul eax, dword [ebx + 0x61], 0x70
je 0x50235ee1
outsd dx, dword [esi]
outsb dx, byte [esi]
push eax
imul ebp, dword [esi + 0x42], 0x6f747475
outsb dx, byte [esi]
add dword [eax], eax
add byte [eax], al
add byte [edx], al
add byte [eax], al
add byte [eax + 0x5e], ch
and edx, dword [eax + 8]
arpl word fs:[eax + 0x62], si
dec esi
outsd dx, dword [esi]
outsb dx, byte [esi]
push es
arpl word fs:[eax + 0x62], si
push ebp
jo 0x50235ea9
arpl word fs:[eax + 0x62], si
inc esp
outsd dx, dword [esi]
ja 0x50235f17
adc dword [ebx + 0x61], eax
jo 0x50235f22
imul ebp, dword [edi + 0x6e], 0x6f446465
arpl word [ebx + 0x54], bp
jb 0x50235f1f
nop
adc al, 0x5f
and edx, dword [eax]
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], ah
pop edi
and edx, dword [eax + 0xc]
add byte [eax], al
add byte [eax], dl
jl 0x50235f0b
push eax
push eax
shl byte [ebx + 0x50], 1
mov word [ebx + 0x50], fs
push eax
adc dl, byte [esp + eax*2 + 0x6f]
Function at 0x5023b20c
Capabilities:
Hide graphical window

Disassembly:
push esi
mov esi, eax
cmp dl, byte [esi + 0x28d]
je 0x5023b247
mov byte [esi + 0x28d], dl
xor edx, edx
mov eax, dword [esi + 0x2c8]
call sym.vcl120.bpl__Controls_TControl_SetVisible_qqro
push 0
mov eax, dword [esi + 0x2c8]
call sym.vcl120.bpl__Controls_TWinControl_GetHandle_qqrv
push eax
call sub.user32.dll_ShowWindow
mov eax, esi
mov edx, dword [eax]
call dword [edx + 0x80]
pop esi
ret
Function at 0x42e004
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
call 0x42e00c
nop
nop
nop
nop
pop eax
nop
nop
add eax, 0x403ac5
sub eax, 0x403a6b
nop
mov ebx, dword [eax]
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
nop
xor dword [ebx], edx
nop
nop
nop
add ebx, 4
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
nop
jl 0x42e030
nop
add eax, 0xc
nop
nop
nop
nop
cmp dword [eax], 0
nop
nop
nop
nop
jne 0x42e01e
nop
nop
nop
nop
nop
nop
nop
popal
jmp loc.00401219

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x30009909
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x50
pushal
call 0x30009918
pop dword [ebp - 0x40]
mov eax, 0x76cbf6e5
sub eax, 0x46cb5dcd
sub dword [ebp - 0x40], eax
push 0x40
push 0x1000
push 0x3a515
push 0
mov eax, 0xb64169ee
add eax, 0x79bea72a
add eax, dword [ebp - 0x40]
call dword [eax]
mov ecx, 0x4b68
mov edi, eax
mov ebx, 0x68b66a89
sub ebx, 0x38b40289
add ebx, dword [ebp - 0x40]
mov esi, 0x792a4771
xor dword [ebp - 0x1c], eax
mov edx, dword [ebx]
add edx, esi
xor dword [ebp - 0x30], 0x325cf199
mov dword [edi], edx
add edi, 0x42fd681e
add edi, 0xbd0297e6
add ebx, 4
loop 0x3000996b
add eax, 0xaa4740eb
add eax, 0x55b9df88
xor ebx, ebx
add ebx, eax
add eax, 0x5641651d
sub eax, 0x56416518
mov ecx, 0xe69cb0e0
add ecx, 0x49634f20
add ecx, dword [ebp - 0x40]
call ebx
leave
ret
Function at 0x30014af0
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x30020490]
jne 0x30016bf1
repz ret
push ebp
mov ebp, esp
sub esp, 0x328
mov dword [0x30021d98], eax
mov dword [0x30021d94], ecx
mov dword [0x30021d90], edx
mov dword [0x30021d8c], ebx
mov dword [0x30021d88], esi
mov dword [0x30021d84], edi
mov word [0x30021db0], ss
mov word [0x30021da4], cs
mov word [0x30021d80], ds
mov word [0x30021d7c], es
mov word [0x30021d78], fs
mov word [0x30021d74], gs
pushfd
pop dword [0x30021da8]
mov eax, dword [ebp]
mov dword [0x30021d9c], eax
mov eax, dword [ebp + 4]
mov dword [0x30021da0], eax
lea eax, [ebp + 8]
mov dword [0x30021dac], eax
mov eax, dword [ebp - 0x320]
mov dword [0x30021ce8], 0x10001
mov eax, dword [0x30021da0]
mov dword [0x30021c9c], eax
mov dword [0x30021c90], 0xc0000409
mov dword [0x30021c94], 1
mov eax, dword [0x30020490]
mov dword [ebp - 0x328], eax
mov eax, dword [0x30020494]
mov dword [ebp - 0x324], eax
call dword [sym.imp.kernel32.dll_IsDebuggerPresent]
mov dword [0x30021ce0], eax
push 1
call fcn.3001ac97
pop ecx
push 0
call dword [sym.imp.kernel32.dll_SetUnhandledExceptionFilter]
push 0x30002c70
call dword [sym.imp.kernel32.dll_UnhandledExceptionFilter]
cmp dword [0x30021ce0], 0
jne 0x30016ce1
push 1
call fcn.3001ac97
pop ecx
push 0xc0000409
call dword [sym.imp.kernel32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.kernel32.dll_TerminateProcess]
leave
ret
Function at 0x10007c1f
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x54
pushal
call 0x10007c2e
pop dword [ebp - 0x44]
mov eax, 0x6a1d5aa9
add eax, 0xa5e32185
sub dword [ebp - 0x44], eax
mov dword [ebp - 0x54], 0xf67d38ba
add dword [ebp - 0x54], 0x57d50c91
mov dword [ebp - 0x50], 0x38ee719
add dword [ebp - 0x50], 0x2ea4652c
mov dword [ebp - 0x4c], 0x5de899c0
add dword [ebp - 0x4c], 0xee63aa6e
mov dword [ebp - 0x48], 0x591f46b4
sub dword [ebp - 0x48], 0x591f46b4
lea eax, [ebp - 0x54]
push eax
mov eax, 0x6dddaa3a
add eax, 0xa222d61a
add eax, dword [ebp - 0x44]
call dword [eax]
mov dword [ebp - 0x54], 0x6fdf1c12
add dword [ebp - 0x54], 0x4934d44
mov dword [ebp - 0x50], 0x21a1c883
add dword [ebp - 0x50], 0x1fca98f2
mov dword [ebp - 0x4c], 0x334337b
add dword [ebp - 0x4c], 0x603b38f1
mov dword [ebp - 0x48], 0x6b881a41
sub dword [ebp - 0x48], 0x6b881a41
lea ebx, [ebp - 0x54]
push ebx
push eax
mov eax, 0x9ae18136
sub eax, 0x8ae100e6
add eax, dword [ebp - 0x44]
call dword [eax]
push 0x40
push 0x1000
push 0x39a9a
push 0
call eax
mov ecx, 0x53fb
mov edx, eax
mov ebx, 0x1000fa00
add ebx, dword [ebp - 0x44]
mov esi, 0x9e4fec9f
add esi, 0x3c4c1b6c
sub dword [ebp - 0x40], edx
mov edi, dword [ebx]
mov dword [ebp - 0x3c], 0x62aa48a3
xor edi, esi
xor dword [ebp - 0x3c], ebx
mov dword [edx], edi
add dword [ebp - 0x10], 0x77f351ca
add edx, 4
add ebx, 0xf207bd1a
sub ebx, 0xf207bd16
loop 0x10007d44
add eax, 0x265f5fb
sub eax, 0x264b33c
xor ebx, ebx
add ebx, eax
add eax, 0xdc834f04
add eax, 0x237cb101
mov ecx, 0x54372bdc
add ecx, 0xbbc8d424
add ecx, dword [ebp - 0x44]
call ebx
leave
ret
Function at 0x402d00
Capabilities:
Write file on windows

Disassembly:
push 0x2c
mov eax, 0x434516
call fcn.0041d834
mov ebx, dword [ebp + 8]
mov esi, ecx
cmp ebx, 0xffffffff
jne 0x402d20
xor eax, eax
call fcn.0041d8b7
ret 4
mov eax, dword [esi + 0x24]
mov ecx, dword [eax]
xor edi, edi
cmp ecx, edi
je 0x402d48
mov eax, dword [esi + 0x34]
mov edx, dword [eax]
add edx, ecx
cmp ecx, edx
jae 0x402d48
dec dword [eax]
mov esi, dword [esi + 0x24]
mov eax, dword [esi]
lea ecx, [eax + 1]
mov dword [esi], ecx
mov byte [eax], bl
mov eax, ebx
jmp 0x402d18
cmp dword [esi + 0x54], edi
jne 0x402d52
or eax, 0xffffffff
jmp 0x402d18
mov eax, esi
call fcn.00403b7c
cmp dword [esi + 0x44], edi
jne 0x402d74
push dword [esi + 0x54]
movsx eax, bl
push eax
call dword [sym.imp.MSVCR100.dll_fputc]
pop ecx
pop ecx
cmp eax, 0xffffffff
je 0x402d4d
jmp 0x402d44
push edi
push 8
lea ecx, [ebp - 0x2c]
mov byte [ebp - 0x2d], bl
mov dword [ebp - 0x18], 0xf
mov dword [ebp - 0x1c], edi
mov byte [ebp - 0x2c], 0
call fcn.004181b7
mov dword [ebp - 4], edi
cmp dword [ebp - 0x18], 0x10
mov eax, dword [ebp - 0x2c]
jae 0x402e31
lea eax, [ebp - 0x2c]
mov ecx, eax
add eax, dword [ebp - 0x1c]
lea edx, [ebp - 0x34]
push edx
push eax
push ecx
mov ecx, dword [esi + 0x44]
lea eax, [ebp - 0x38]
push eax
lea eax, [ebp - 0x2c]
push eax
lea eax, [ebp - 0x2d]
push eax
lea eax, [esi + 0x4c]
push eax
call dword [sym.imp.MSVCP100.dll_public:_int___thiscall_std::codecvt_char__char__int_::out_int___char_const___char_const___char_const____char___char___char___const]
test eax, eax
js 0x402e59
cmp eax, 1
jg 0x402e39
cmp dword [ebp - 0x18], 0x10
mov eax, dword [ebp - 0x2c]
jae 0x402de0
lea eax, [ebp - 0x2c]
mov edi, dword [ebp - 0x34]
sub edi, eax
je 0x402e07
cmp dword [ebp - 0x18], 0x10
mov eax, dword [ebp - 0x2c]
jae 0x402df3
lea eax, [ebp - 0x2c]
push dword [esi + 0x54]
push edi
push 1
push eax
call dword [sym.imp.MSVCR100.dll_fwrite]
add esp, 0x10
cmp edi, eax
jne 0x402e59
lea eax, [ebp - 0x2d]
mov byte [esi + 0x49], 1
cmp dword [ebp - 0x38], eax
jne 0x402e55
test edi, edi
jne 0x402d93
cmp dword [ebp - 0x1c], 0x20
jae 0x402e59
push edi
push 8
lea ecx, [ebp - 0x2c]
call fcn.004181b7
jmp 0x402d93
mov ecx, dword [ebp - 0x2c]
jmp 0x402da5
cmp eax, 3
jne 0x402e59
movsx eax, byte [ebp - 0x2d]
push dword [esi + 0x54]
push eax
call dword [sym.imp.MSVCR100.dll_fputc]
or esi, 0xffffffff
pop ecx
pop ecx
cmp eax, esi
je 0x402e5c
mov esi, ebx
jmp 0x402e5c
or esi, 0xffffffff
push 0
push 1
lea ecx, [ebp - 0x2c]
call fcn.004181b7
mov eax, esi
jmp 0x402d18
Function at 0x403a82
Capabilities:
Write file on windows

Disassembly:
push 0x24
mov eax, 0x434700
call fcn.0041d834
xor edi, edi
cmp dword [esi + 0x44], edi
je 0x403b74
cmp byte [esi + 0x49], 0
je 0x403b74
mov eax, dword [esi]
push 0xffffffffffffffff
mov ecx, esi
call dword [eax + 0xc]
cmp eax, 0xffffffff
jne 0x403ab8
xor al, al
jmp 0x403b76
push edi
push 8
lea ecx, [ebp - 0x2c]
mov dword [ebp - 0x18], 0xf
mov dword [ebp - 0x1c], edi
mov byte [ebp - 0x2c], 0
call fcn.004181b7
mov dword [ebp - 4], edi
lea ebx, [esi + 0x4c]
cmp dword [ebp - 0x18], 0x10
mov eax, dword [ebp - 0x2c]
jae 0x403b16
lea eax, [ebp - 0x2c]
mov ecx, eax
add eax, dword [ebp - 0x1c]
lea edx, [ebp - 0x30]
push edx
push eax
push ecx
mov ecx, dword [esi + 0x44]
push ebx
call dword [sym.imp.MSVCP100.dll_public:_int___thiscall_std::codecvt_char__char__int_::unshift_int___char___char___char___const]
sub eax, 0
je 0x403b1b
dec eax
je 0x403b1f
dec eax
dec eax
je 0x403b70
xor bl, bl
push 0
push 1
lea ecx, [ebp - 0x2c]
call fcn.004181b7
mov al, bl
jmp 0x403b76
mov ecx, dword [ebp - 0x2c]
jmp 0x403ae5
mov byte [esi + 0x49], 0
cmp dword [ebp - 0x18], 0x10
mov eax, dword [ebp - 0x2c]
jae 0x403b2b
lea eax, [ebp - 0x2c]
mov edi, dword [ebp - 0x30]
sub edi, eax
je 0x403b52
cmp dword [ebp - 0x18], 0x10
mov eax, dword [ebp - 0x2c]
jae 0x403b3e
lea eax, [ebp - 0x2c]
push dword [esi + 0x54]
push edi
push 1
push eax
call dword [sym.imp.MSVCR100.dll_fwrite]
add esp, 0x10
cmp edi, eax
jne 0x403b04
cmp byte [esi + 0x49], 0
je 0x403b70
test edi, edi
jne 0x403ad7
push edi
push 8
lea ecx, [ebp - 0x2c]
call fcn.004181b7
jmp 0x403ad7
mov bl, 1
jmp 0x403b06
mov al, 1
call fcn.0041d8b7
ret
Function at 0x408295
Capabilities:
Write file on windows

Disassembly:
push 0x2c
mov eax, 0x434516
call fcn.0041d834
mov ebx, 0xffff
mov esi, ecx
cmp bx, word [ebp + 8]
jne 0x4082b5
xor eax, eax
jmp 0x408439
mov eax, dword [esi + 0x24]
mov ecx, dword [eax]
xor edi, edi
cmp ecx, edi
je 0x4082e6
mov eax, dword [esi + 0x34]
mov edx, dword [eax]
lea edx, [ecx + edx*2]
cmp ecx, edx
jae 0x4082e6
dec dword [eax]
mov esi, dword [esi + 0x24]
mov eax, dword [esi]
lea ecx, [eax + 2]
mov dword [esi], ecx
mov ecx, dword [ebp + 8]
mov word [eax], cx
mov ax, cx
jmp 0x408439
cmp dword [esi + 0x54], edi
je 0x408437
mov eax, esi
call fcn.00408f51
cmp dword [esi + 0x44], edi
jne 0x40831b
push dword [esi + 0x54]
push dword [ebp + 8]
call dword [sym.imp.MSVCR100.dll_fputwc]
pop ecx
cmp ax, bx
movzx eax, word [ebp + 8]
pop ecx
jne 0x408439
jmp 0x408437
movzx eax, word [ebp + 8]
push edi
push 8
lea ecx, [ebp - 0x2c]
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x18], 0xf
mov dword [ebp - 0x1c], edi
mov byte [ebp - 0x2c], 0
call fcn.004181b7
mov dword [ebp - 4], edi
jmp 0x408342
xor edi, edi
cmp dword [ebp - 0x18], 0x10
mov eax, dword [ebp - 0x2c]
jae 0x4083e0
lea eax, [ebp - 0x2c]
mov ecx, eax
add eax, dword [ebp - 0x1c]
lea edx, [ebp - 0x34]
push edx
push eax
push ecx
mov ecx, dword [esi + 0x44]
lea eax, [ebp - 0x38]
push eax
lea eax, [ebp - 0x2e]
push eax
lea eax, [ebp - 0x30]
push eax
lea eax, [esi + 0x4c]
push eax
call dword [sym.imp.MSVCP100.dll_public:_int___thiscall_std::codecvt_wchar_t__char__int_::out_int___wchar_t_const___wchar_t_const___wchar_t_const____char___char___char___const]
cmp eax, edi
jl 0x40842c
cmp eax, 1
jg 0x4083e8
cmp dword [ebp - 0x18], 0x10
mov eax, dword [ebp - 0x2c]
jae 0x40838f
lea eax, [ebp - 0x2c]
mov edi, dword [ebp - 0x34]
sub edi, eax
je 0x4083b6
cmp dword [ebp - 0x18], 0x10
mov eax, dword [ebp - 0x2c]
jae 0x4083a2
lea eax, [ebp - 0x2c]
push dword [esi + 0x54]
push edi
push 1
push eax
call dword [sym.imp.MSVCR100.dll_fwrite]
add esp, 0x10
cmp edi, eax
jne 0x408416
lea eax, [ebp - 0x30]
mov byte [esi + 0x4a], 1
cmp dword [ebp - 0x38], eax
jne 0x40841a
test edi, edi
jne 0x408340
cmp dword [ebp - 0x1c], 0x20
push edi
lea ecx, [ebp - 0x2c]
jae 0x408430
push 8
call fcn.004181b7
jmp 0x408340
mov ecx, dword [ebp - 0x2c]
jmp 0x408354
cmp eax, 3
jne 0x40842c
push dword [esi + 0x54]
push dword [ebp - 0x30]
call dword [sym.imp.MSVCR100.dll_fputwc]
movzx esi, word [ebp + 8]
pop ecx
pop ecx
cmp ax, bx
jne 0x408406
mov esi, ebx
push edi
push 1
lea ecx, [ebp - 0x2c]
call fcn.004181b7
mov ax, si
jmp 0x408439
push 0
jmp 0x40842d
push 0
push 1
lea ecx, [ebp - 0x2c]
call fcn.004181b7
mov ax, word [ebp + 8]
jmp 0x408439
push edi
lea ecx, [ebp - 0x2c]
push 1
call fcn.004181b7
mov eax, ebx
call fcn.0041d8b7
ret 4
Function at 0x408e53
Capabilities:
Write file on windows

Disassembly:
push 0x24
mov eax, 0x434700
call fcn.0041d834
xor ebx, ebx
cmp dword [esi + 0x44], ebx
je 0x408f49
cmp byte [esi + 0x4a], bl
je 0x408f49
mov eax, dword [esi]
mov edi, 0xffff
push edi
mov ecx, esi
call dword [eax + 0xc]
movzx eax, ax
cmp di, ax
jne 0x408e8f
xor al, al
jmp 0x408f4b
push ebx
push 8
lea ecx, [ebp - 0x2c]
mov dword [ebp - 0x18], 0xf
mov dword [ebp - 0x1c], ebx
mov byte [ebp - 0x2c], bl
call fcn.004181b7
mov dword [ebp - 4], ebx
cmp dword [ebp - 0x18], 0x10
mov eax, dword [ebp - 0x2c]
jae 0x408eeb
lea eax, [ebp - 0x2c]
mov ecx, eax
add eax, dword [ebp - 0x1c]
lea edx, [ebp - 0x30]
push edx
push eax
push ecx
mov ecx, dword [esi + 0x44]
lea eax, [esi + 0x4c]
push eax
call dword [sym.imp.MSVCP100.dll_public:_int___thiscall_std::codecvt_wchar_t__char__int_::unshift_int___char___char___char___const]
sub eax, ebx
je 0x408ef0
dec eax
je 0x408ef4
dec eax
dec eax
je 0x408f45
xor bl, bl
push 0
push 1
lea ecx, [ebp - 0x2c]
call fcn.004181b7
mov al, bl
jmp 0x408f4b
mov ecx, dword [ebp - 0x2c]
jmp 0x408eb8
mov byte [esi + 0x4a], 0
cmp dword [ebp - 0x18], 0x10
mov eax, dword [ebp - 0x2c]
jae 0x408f00
lea eax, [ebp - 0x2c]
mov edi, dword [ebp - 0x30]
sub edi, eax
je 0x408f27
cmp dword [ebp - 0x18], 0x10
mov eax, dword [ebp - 0x2c]
jae 0x408f13
lea eax, [ebp - 0x2c]
push dword [esi + 0x54]
push edi
push 1
push eax
call dword [sym.imp.MSVCR100.dll_fwrite]
add esp, 0x10
cmp edi, eax
jne 0x408ed9
cmp byte [esi + 0x4a], 0
je 0x408f45
cmp edi, ebx
jne 0x408eaa
push ebx
push 8
lea ecx, [ebp - 0x2c]
call fcn.004181b7
jmp 0x408eaa
mov bl, 1
jmp 0x408edb
mov al, 1
call fcn.0041d8b7
ret