joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4637c4
Capabilities:
Inspect load icon resource

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffefc
push ebx
push esi
test dl, dl
je 0x4637db
add esp, 0xfffffff0
call fcn.00403cc4
mov byte [ebp - 1], dl
mov ebx, eax
xor edx, edx
mov eax, ebx
call fcn.0041f528
mov eax, dword [0x492d98]
cmp word [eax + 2], 0
jne 0x463803
mov eax, dword [0x492d98]
mov dword [eax + 4], ebx
mov dword [eax], fcn.00464eb4
mov eax, dword [0x492edc]
cmp word [eax + 2], 0
jne 0x46381d
mov eax, dword [0x492edc]
mov dword [eax + 4], ebx
mov dword [eax], fcn.004650ac
mov byte [ebx + 0x34], 0
mov dl, 1
mov eax, dword [0x416310]
call fcn.00403970
mov dword [ebx + 0x90], eax
mov dl, 1
mov eax, dword [0x416310]
call fcn.00403970
mov dword [ebx + 0xa8], eax
xor eax, eax
mov dword [ebx + 0x60], eax
xor eax, eax
mov dword [ebx + 0x84], eax
mov dword [ebx + 0x5c], 0xff000018
mov dword [ebx + 0x78], 0x1f4
mov byte [ebx + 0x7c], 1
xor eax, eax
mov dword [ebx + 0x80], eax
mov dword [ebx + 0x74], 0x9c4
mov byte [ebx + 0x88], 0
mov byte [ebx + 0x9d], 1
mov byte [ebx + 0xb4], 1
mov dl, 1
mov eax, dword [0x421b5c]
call fcn.00429a04
mov esi, eax
mov dword [ebx + 0x98], esi
push 0x4639a4
mov eax, dword [0x492c14]
mov eax, dword [eax]
push eax
call sub.user32.dll_LoadIconA
mov edx, eax
mov eax, esi
call fcn.00429dd4
mov eax, dword [ebx + 0x98]
mov dword [eax + 0x14], ebx
mov dword [eax + 0x10], 0x46564c
push pe_nt_image_headers32
lea eax, [ebp - 0x101]
push eax
mov eax, dword [0x492c14]
mov eax, dword [eax]
push eax
call sub.kernel32.dll_GetModuleFileNameA_1
lea eax, [ebp - 0x101]
push eax
lea eax, [ebp - 0x101]
push eax
call sub.user32.dll_OemToCharA
lea eax, [ebp - 0x101]
mov dl, 0x5c
call fcn.0040d5f4
test eax, eax
je 0x463912
lea edx, [eax + 1]
lea eax, [ebp - 0x101]
call fcn.004096f0
lea eax, [ebp - 0x101]
mov dl, 0x2e
call fcn.0040d61c
test eax, eax
je 0x463926
mov byte [eax], 0
lea eax, [ebp - 0x101]
inc eax
push eax
call sub.user32.dll_CharLowerA
lea eax, [ebx + 0x8c]
lea edx, [ebp - 0x101]
mov ecx, pe_nt_image_headers32
call fcn.004049e4
mov eax, dword [0x4929b8]
cmp byte [eax], 0
jne 0x46395a
mov eax, ebx
call fcn.00463acc
mov byte [ebx + 0x59], 1
mov byte [ebx + 0x5a], 1
mov byte [ebx + 0x5b], 1
mov byte [ebx + 0x9e], 1
xor eax, eax
mov dword [ebx + 0xa0], eax
mov eax, ebx
call fcn.00465828
mov eax, ebx
call fcn.004661ec
mov eax, ebx
cmp byte [ebp - 1], 0
je 0x46399a
call fcn.00403d1c
pop dword fs:[0]
add esp, 0xc
mov eax, ebx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x463d4c
Capabilities:
Enumerate gui resources

Disassembly:
push ebx
push esi
add esp, 0xfffffff8
mov ebx, eax
mov eax, dword [0x494be4]
cmp dword [eax + 0x30], 0
je 0x463df6
cmp dword [ebx + 0x94], 0
jne 0x463df0
mov eax, dword [ebx + 0x30]
mov dword [esp], eax
mov byte [esp + 4], dl
mov eax, esp
push eax
push 0x463cdc
call sub.user32.dll_EnumWindows
mov eax, dword [ebx + 0x90]
cmp dword [eax + 8], 0
je 0x463df0
push 3
mov eax, dword [esp + 4]
push eax
call sub.user32.dll_GetWindow
mov esi, eax
mov dword [esp], esi
push 0xffffffffffffffec
push esi
call sub.user32.dll_GetWindowLongA
test al, 8
je 0x463db6
mov dword [esp], 0xfffffffe
mov eax, dword [ebx + 0x90]
mov esi, dword [eax + 8]
dec esi
cmp esi, 0
jl 0x463df0
push 0x213
push 0
push 0
push 0
push 0
mov eax, dword [esp + 0x14]
push eax
mov edx, esi
mov eax, dword [ebx + 0x90]
call fcn.004189c8
push eax
call sub.user32.dll_SetWindowPos
dec esi
cmp esi, 0xffffffff
jne 0x463dc5
inc dword [ebx + 0x94]
pop ecx
pop edx
pop esi
pop ebx
ret

Function at 0x464958
Capabilities:
Get graphical window text

Disassembly:
push ebx
push esi
add esp, 0xffffff00
mov esi, edx
mov ebx, eax
cmp byte [ebx + 0xa4], 0
je 0x46498d
push pe_nt_image_headers32
lea eax, [esp + 4]
push eax
mov eax, dword [ebx + 0x30]
push eax
call sub.user32.dll_GetWindowTextA
mov ecx, eax
mov edx, esp
mov eax, esi
call fcn.00404864
jmp 0x46499a
mov eax, esi
mov edx, dword [ebx + 0x8c]
call fcn.004047c8
add esp, 0x100
pop esi
pop ebx
ret

Function at 0x465a04
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
mov ebx, eax
mov esi, dword [ebx + 0x84]
test esi, esi
je 0x465a45
mov eax, esi
call fcn.0044bbd0
test al, al
je 0x465a45
mov eax, dword [ebx + 0x84]
call fcn.0044b8cc
push eax
call sub.user32.dll_IsWindowVisible
test eax, eax
je 0x465a45
push 0
mov eax, dword [ebx + 0x84]
call fcn.0044b8cc
push eax
call sub.user32.dll_ShowWindow
pop esi
pop ebx
ret

Function at 0x468cf8
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
mov edi, edx
mov ebx, eax
mov esi, dword [ebp + 8]
cmp dword [esi], 0
jne 0x468d1f
push 0
push 0
mov dx, 4
mov eax, ebx
call fcn.0046837c
cmp dword [ebx + 0x38], 0xffffffff
jne 0x468d34
push 0xffffffffffffffff
push 0xffffffffffffffe8
mov dx, 0x18
mov eax, ebx
call fcn.0046837c
mov eax, dword [esi]
push eax
mov edx, edi
mov ecx, dword [ebp - 4]
xor eax, eax
call fcn.00468cb4
mov eax, dword [esi]
push eax
lea eax, [ebp - 8]
push eax
mov eax, dword [ebp - 4]
push eax
push edi
mov eax, dword [ebx + 0x38]
push eax
call sub.kernel32.dll_WriteFile_1
test eax, eax
jne 0x468d6c
call sub.kernel32.dll_GetLastError_1
cmp eax, 0x3e5
je 0x468d6c
xor eax, eax
jmp 0x468d6e
mov al, 1
test al, al
jne 0x468d86
call sub.kernel32.dll_GetLastError_1
xor edx, edx
push edx
push eax
mov dx, 2
mov eax, ebx
call fcn.0046837c
mov cl, 1
mov dl, 6
mov eax, ebx
call fcn.0046b7b8
mov eax, dword [ebp - 8]
pop edi
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret 4
Function at 0x468e08
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
mov edi, edx
mov ebx, eax
mov esi, dword [ebp + 8]
cmp dword [esi], 0
jne 0x468e2f
push 0
push 0
mov dx, 4
mov eax, ebx
call fcn.0046837c
mov eax, dword [esi]
mov byte [eax + 0x14], 1
cmp dword [ebx + 0x38], 0xffffffff
jne 0x468e4a
push 0xffffffffffffffff
push 0xffffffffffffffe8
mov dx, 0x18
mov eax, ebx
call fcn.0046837c
mov eax, dword [esi]
push eax
lea eax, [ebp - 8]
push eax
mov eax, dword [ebp - 4]
push eax
push edi
mov eax, dword [ebx + 0x38]
push eax
call sub.kernel32.dll_ReadFile_1
test eax, eax
jne 0x468e73
call sub.kernel32.dll_GetLastError_1
cmp eax, 0x3e5
je 0x468e73
xor eax, eax
jmp 0x468e75
mov al, 1
test al, al
jne 0x468e8d
call sub.kernel32.dll_GetLastError_1
xor edx, edx
push edx
push eax
mov dx, 3
mov eax, ebx
call fcn.0046837c
mov eax, dword [ebp - 8]
pop edi
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret 4

Function at 0x46bc34
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe4
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 8], edx
mov dword [ebp - 0xc], edx
mov edi, eax
xor eax, eax
push ebp
push 0x46bd68
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 4]
push eax
push 0x20019
push 0
push 0x46bd78
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA_1
mov ebx, eax
test ebx, ebx
jne 0x46bd4d
mov dl, 1
mov eax, dword [0x416974]
call fcn.00403970
mov dword [ebp - 0x1c], eax
xor eax, eax
push ebp
push 0x46bd46
push dword fs:[eax]
mov dword fs:[eax], esp
xor esi, esi
mov dword [ebp - 0x10], pe_nt_image_headers32
mov dword [ebp - 0x14], pe_nt_image_headers32
lea eax, [ebp - 8]
mov edx, dword [ebp - 0x10]
call fcn.00404dc0
lea eax, [ebp - 0xc]
mov edx, dword [ebp - 0x14]
call fcn.00404dc0
lea eax, [ebp - 0x14]
push eax
mov eax, dword [ebp - 0xc]
call fcn.00404c34
push eax
lea eax, [ebp - 0x18]
push eax
push 0
lea eax, [ebp - 0x10]
push eax
mov eax, dword [ebp - 8]
call fcn.00404c34
push eax
push esi
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegEnumValueA
mov ebx, eax
test ebx, ebx
jne 0x46bd06
mov edx, dword [ebp - 0x14]
dec edx
lea eax, [ebp - 0xc]
call fcn.00404dc0
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 0x1c]
mov ecx, dword [eax]
call dword [ecx + 0x38]
inc esi
jmp 0x46bd0e
cmp ebx, 0x103
jne 0x46bd12
test ebx, ebx
je 0x46bc98
mov eax, dword [ebp - 0x1c]
mov edx, dword [eax]
call dword [edx + 0x90]
mov edx, dword [ebp - 0x1c]
mov eax, edi
mov ecx, dword [eax]
call dword [ecx + 8]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x46bd4d
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegCloseKey_1
mov eax, dword [ebp - 0x1c]
call fcn.004039a0
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x46bd6f
lea eax, [ebp - 0xc]
mov edx, 2
call fcn.00404798
ret
Function at 0x4781d8
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push ebp
mov ebp, esp
mov ecx, 8
push 0
push 0
dec ecx
jne 0x4781e0
push ecx
push ebx
push esi
push edi
mov ebx, eax
xor eax, eax
push ebp
push 0x4783d2
push dword fs:[eax]
mov dword fs:[eax], esp
mov esi, dword [ebx + 8]
lea ecx, [ebp - 0xc]
mov edx, 0x4783e8
mov eax, esi
call fcn.00475f68
mov edx, dword [ebp - 0xc]
lea eax, [ebx + 0xc]
call fcn.004047c8
lea ecx, [ebp - 0x10]
mov edx, 0x4783fc
mov eax, esi
call fcn.00475f68
mov edx, dword [ebp - 0x10]
lea eax, [ebx + 0x28]
call fcn.004047c8
lea ecx, [ebp - 0x14]
mov edx, 0x478414
mov eax, esi
call fcn.00475f68
mov edx, dword [ebp - 0x14]
lea eax, [ebx + 0x10]
call fcn.004047c8
lea ecx, [ebp - 0x18]
mov edx, 0x478430
mov eax, esi
call fcn.00475f68
mov edx, dword [ebp - 0x18]
lea eax, [ebx + 0x14]
call fcn.004047c8
lea ecx, [ebp - 0x1c]
mov edx, 0x47844c
mov eax, esi
call fcn.00475f68
mov edx, dword [ebp - 0x1c]
lea eax, [ebx + 0x24]
call fcn.004047c8
lea ecx, [ebp - 0x24]
mov edx, 0x478464
mov eax, esi
call fcn.00475f68
mov eax, dword [ebp - 0x24]
lea edx, [ebp - 0x20]
call fcn.00408b2c
mov eax, dword [ebp - 0x20]
or edx, 0xffffffff
call fcn.00409074
mov edi, eax
mov dword [ebx + 0x18], edi
test edi, edi
setge al
mov byte [ebx + 0x4c], al
lea ecx, [ebp - 0x28]
mov edx, 0x47847c
mov eax, esi
call fcn.00475f68
mov eax, dword [ebp - 0x28]
call fcn.00475080
fstp qword [ebx + 0x30]
wait
lea ecx, [ebp - 0x2c]
mov edx, 0x47848c
mov eax, esi
call fcn.00475f68
mov eax, dword [ebp - 0x2c]
call fcn.00475080
fstp qword [ebx + 0x40]
wait
lea ecx, [ebp - 0x30]
mov edx, 0x4784a4
mov eax, esi
call fcn.00475f68
mov eax, dword [ebp - 0x30]
or edx, 0xffffffff
call fcn.00409074
inc eax
je 0x478375
lea ecx, [ebp - 0x34]
mov edx, 0x4784a4
mov eax, esi
call fcn.00475f68
mov eax, dword [ebp - 0x34]
call fcn.00409038
mov edi, eax
mov eax, edi
mov ecx, 0xe10
cdq
idiv ecx
mov dword [ebp - 8], eax
mov eax, edi
mov ecx, 0xe10
cdq
idiv ecx
mov ecx, edx
mov eax, ecx
push ecx
mov ecx, 0x3c
cdq
idiv ecx
pop ecx
mov dword [ebp - 4], eax
mov eax, ecx
mov ecx, 0x3c
cdq
idiv ecx
mov edi, edx
push 0
mov ecx, edi
mov dx, word [ebp - 4]
mov ax, word [ebp - 8]
call fcn.0040a660
fstp qword [ebp - 0x3c]
wait
call fcn.0040a9c4
fadd qword [ebp - 0x3c]
fstp qword [ebx + 0x38]
wait
jmp 0x478390
lea ecx, [ebp - 0x40]
mov edx, 0x4784a4
mov eax, esi
call fcn.00475f68
mov eax, dword [ebp - 0x40]
call fcn.00475080
fstp qword [ebx + 0x38]
wait
lea ecx, [ebp - 0x44]
mov edx, 0x4784b4
mov eax, esi
call fcn.00475f68
mov edx, dword [ebp - 0x44]
lea eax, [ebx + 0x48]
call fcn.004047c8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4783d9
lea eax, [ebp - 0x44]
mov edx, 2
call fcn.00404798
lea eax, [ebp - 0x34]
mov edx, 0xb
call fcn.00404798
ret
Function at 0x484670
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
xor edx, edx
push ebp
push 0x4846ca
push dword fs:[edx]
mov dword fs:[edx], esp
mov eax, dword [eax + 0x30]
call fcn.00484660
mov ebx, eax
lea edx, [ebp - 4]
mov eax, edi
call fcn.00473cec
mov edx, dword [ebp - 4]
mov eax, dword [ebx + 0xc]
call fcn.004738ec
mov edx, dword [esi + 8]
mov eax, dword [ebx + 0x10]
mov ecx, dword [eax]
call dword [ecx + 8]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4846d1
lea eax, [ebp - 4]
call fcn.00404774
ret

Function at 0x487f14
Capabilities:
Get hostname

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffb8
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x44], ebx
mov dword [ebp - 0x48], ebx
mov edi, ecx
mov esi, edx
mov ebx, eax
lea eax, [ebp - 0x10]
mov edx, dword [0x415898]
call fcn.004051b8
xor eax, eax
push ebp
push 0x488058
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [0x49289c], 0
jne 0x487f67
mov ecx, dword [0x4929ec]
mov dl, 1
mov eax, dword [0x407c64]
call fcn.0040c7e0
call fcn.0040412c
lea eax, [ebp - 0x20]
xor ecx, ecx
mov edx, 0x10
call fcn.0040307c
mov eax, ebx
call fcn.00405004
mov dword [ebp - 0x1c], eax
push esi
push edi
mov esi, 0x488068
lea edi, [ebp - 0x30]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
pop edi
pop esi
lea eax, [ebp - 0x30]
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0xc]
call fcn.00406284
xor eax, eax
mov dword [ebp - 8], eax
mov eax, ebx
call fcn.00405014
test eax, eax
jle 0x487fff
mov dword [ebp - 4], 0x10
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x40]
push eax
call sub.kernel32.dll_GetComputerNameA
test eax, eax
je 0x487ff8
lea eax, [ebp - 0x44]
mov edx, ebx
call fcn.004049fc
mov eax, dword [ebp - 0x44]
push eax
lea eax, [ebp - 0x48]
lea edx, [ebp - 0x40]
mov ecx, 0x10
call fcn.004049e4
mov eax, dword [ebp - 0x48]
pop edx
call fcn.00408abc
test eax, eax
jne 0x487ff8
mov ebx, 0x15
jmp 0x488004
mov ebx, 0x10
jmp 0x488004
mov ebx, 0x15
lea eax, [ebp - 0x10]
push eax
push 1
lea eax, [ebp - 0x20]
push eax
push ebx
push 0
push esi
call dword [0x49289c]
call fcn.00487e6c
mov eax, dword [ebp - 8]
call fcn.00487e6c
mov eax, edi
mov edx, dword [ebp - 0xc]
call fcn.0040629c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x48805f
lea eax, [ebp - 0x48]
mov edx, 2
call fcn.00404798
lea eax, [ebp - 0x10]
mov edx, dword [0x415898]
call fcn.00405288
ret
Function at 0x403380
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x14
push ebx
mov ebx, ecx
push esi
push edi
cmp dword [ebx + 0x38], 0
je 0x4033ab
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.00403cd0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov eax, dword [ebx + 0x20]
mov esi, dword [ebp + 0xc]
mov edi, dword [ebp + 0x10]
mov dword [esp + 0x18], esi
mov eax, dword [eax]
mov dword [esp + 0x1c], edi
mov dword [esp + 0x14], eax
test eax, eax
je 0x4033cd
mov eax, dword [ebx + 0x30]
mov eax, dword [eax]
jmp 0x4033cf
xor eax, eax
cdq
mov dword [esp + 0xc], eax
mov ecx, edx
mov dword [esp + 0x10], ecx
test edi, edi
jl 0x403453
jg 0x4033e4
test esi, esi
je 0x403453
test ecx, ecx
jl 0x40342d
jg 0x4033ee
test eax, eax
je 0x40342d
cmp edi, ecx
jg 0x403402
jl 0x4033f8
cmp esi, eax
jae 0x403402
mov eax, esi
mov dword [esp + 0xc], esi
mov dword [esp + 0x10], edi
push eax
push dword [ebp + 8]
push dword [esp + 0x1c]
call fcn.005c7c40
mov ecx, dword [esp + 0x18]
add esp, 0xc
mov edx, dword [ebp + 8]
mov eax, dword [ebx + 0x30]
add edx, ecx
sub esi, ecx
sbb edi, dword [esp + 0x10]
sub dword [eax], ecx
mov eax, dword [ebx + 0x20]
add dword [eax], ecx
jmp 0x403430
mov edx, dword [ebp + 8]
test edi, edi
jl 0x403453
jg 0x40343a
test esi, esi
je 0x403453
mov eax, dword [ebx + 0x4c]
test eax, eax
je 0x403453
push eax
push esi
push 1
push edx
call fcn.005cc458
add esp, 0x10
sub esi, eax
sbb edi, 0
mov eax, dword [esp + 0x18]
mov edx, dword [esp + 0x1c]
sub eax, esi
sbb edx, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x403470
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x14
push ebx
push esi
push edi
mov edi, ecx
cmp dword [edi + 0x38], 0
je 0x40349b
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.00403db0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov eax, dword [edi + 0x1c]
mov esi, dword [ebp + 0xc]
mov ebx, dword [ebp + 0x10]
mov dword [esp + 0x18], esi
mov eax, dword [eax]
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x14], eax
test eax, eax
je 0x4034bd
mov eax, dword [edi + 0x2c]
mov eax, dword [eax]
jmp 0x4034bf
xor eax, eax
cdq
mov dword [esp + 0xc], eax
mov ecx, edx
mov dword [esp + 0x10], ecx
test ebx, ebx
jl 0x40355e
jg 0x4034dc
test esi, esi
je 0x40355e
test ecx, ecx
jl 0x403529
jg 0x4034e6
test eax, eax
je 0x403529
cmp ebx, ecx
jg 0x4034fa
jl 0x4034f0
cmp esi, eax
jae 0x4034fa
mov eax, esi
mov dword [esp + 0xc], esi
mov dword [esp + 0x10], ebx
push eax
push dword [esp + 0x18]
push dword [ebp + 8]
call fcn.005c7c40
mov ecx, dword [esp + 0x18]
add esp, 0xc
mov edx, dword [ebp + 8]
mov eax, dword [edi + 0x2c]
add edx, ecx
sub esi, ecx
mov dword [esp + 0xc], edx
sbb ebx, dword [esp + 0x10]
sub dword [eax], ecx
mov eax, dword [edi + 0x1c]
add dword [eax], ecx
jmp 0x403530
mov eax, dword [ebp + 8]
mov dword [esp + 0xc], eax
test ebx, ebx
jl 0x40355e
jg 0x40353a
test esi, esi
je 0x40355e
cmp dword [edi + 0x4c], 0
je 0x40355e
mov ecx, edi
call fcn.004043f0
push dword [edi + 0x4c]
push esi
push 1
push dword [esp + 0x18]
call fcn.005cca43
add esp, 0x10
sub esi, eax
sbb ebx, 0
mov eax, dword [esp + 0x18]
mov edx, dword [esp + 0x1c]
sub eax, esi
pop edi
pop esi
sbb edx, ebx
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x4038c0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
mov eax, dword [0x6807dc]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, ecx
cmp ebx, 0xffffffff
jne 0x4038f0
pop esi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0055cf54
mov esp, ebp
pop ebp
ret 4
mov eax, dword [esi + 0x20]
push edi
mov ecx, dword [eax]
test ecx, ecx
je 0x40392c
mov edx, dword [esi + 0x30]
mov edi, dword [edx]
lea eax, [edi + ecx]
cmp ecx, eax
jae 0x40392c
lea ecx, [edi - 1]
mov dword [edx], ecx
mov edx, dword [esi + 0x20]
mov esi, dword [edx]
lea ecx, [esi + 1]
mov dword [edx], ecx
mov byte [esi], bl
pop edi
pop esi
mov eax, ebx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0055cf54
mov esp, ebp
pop ebp
ret 4
cmp dword [esi + 0x4c], 0
je 0x403a11
mov edi, dword [esi + 0xc]
lea eax, [esi + 0x3c]
cmp dword [edi], eax
jne 0x403954
mov edx, dword [esi + 0x54]
mov ecx, dword [esi + 0x50]
sub edx, ecx
mov dword [edi], ecx
mov eax, dword [esi + 0x1c]
mov dword [eax], ecx
mov eax, dword [esi + 0x2c]
mov dword [eax], edx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x403987
push dword [esi + 0x4c]
movsx eax, bl
push eax
call fcn.005cba27
add esp, 8
or ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, ebx
pop edi
pop esi
mov eax, ecx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0055cf54
mov esp, ebp
pop ebp
ret 4
lea eax, [ebp - 0x2c]
mov byte [ebp - 0x28], bl
mov edx, dword [ecx]
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 0x27]
push eax
lea eax, [ebp - 0x28]
push eax
lea eax, [esi + 0x40]
push eax
call dword [edx + 0x1c]
test eax, eax
js 0x403a11
cmp eax, 1
jle 0x4039e4
cmp eax, 3
jne 0x403a11
push dword [esi + 0x4c]
push dword [ebp - 0x28]
call fcn.00402050
add esp, 8
or ecx, 0xffffffff
test al, al
cmovne ecx, ebx
pop edi
pop esi
mov eax, ecx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0055cf54
mov esp, ebp
pop ebp
ret 4
mov edi, dword [ebp - 0x2c]
lea eax, [ebp - 0x24]
sub edi, eax
je 0x403a01
push dword [esi + 0x4c]
push edi
push 1
push eax
call fcn.005cc458
add esp, 0x10
cmp edi, eax
jne 0x403a11
lea eax, [ebp - 0x28]
mov byte [esi + 0x3d], 1
cmp dword [ebp - 0x30], eax
jne 0x403917
mov ecx, dword [ebp - 4]
or eax, 0xffffffff
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0055cf54
mov esp, ebp
pop ebp
ret 4
Function at 0x4044b0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x6807dc]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, ecx
push edi
cmp dword [esi + 0x38], 0
je 0x404551
cmp byte [esi + 0x3d], 0
je 0x404551
mov eax, dword [esi]
push 0xffffffffffffffff
call dword [eax + 0xc]
cmp eax, 0xffffffff
je 0x404507
mov ecx, dword [esi + 0x38]
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 4]
push eax
mov edx, dword [ecx]
lea eax, [ebp - 0x24]
push eax
lea eax, [esi + 0x40]
push eax
call dword [edx + 0x20]
sub eax, 0
je 0x404519
sub eax, 1
je 0x40451d
sub eax, 2
je 0x404551
pop edi
xor al, al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0055cf54
mov esp, ebp
pop ebp
ret
mov byte [esi + 0x3d], 0
mov edi, dword [ebp - 0x28]
lea eax, [ebp - 0x24]
sub edi, eax
je 0x40453a
push dword [esi + 0x4c]
push edi
push 1
push eax
call fcn.005cc458
add esp, 0x10
cmp edi, eax
jne 0x404507
cmp byte [esi + 0x3d], 0
pop edi
sete al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0055cf54
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
mov al, 1
pop edi
xor ecx, ebp
pop esi
call fcn.0055cf54
mov esp, ebp
pop ebp
ret
Function at 0x404730
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5f4cc8
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push ebx
push esi
push edi
mov eax, dword [0x6807dc]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov dword [ebp - 0x10], ebx
mov eax, dword [ebx]
push 0
push 0
mov dword [ebp - 0x14], 0
mov eax, dword [eax + 4]
mov dword [ebx + eax], vtable.std::basic_istream_char__struct_std::char_traits_char__.0
mov eax, dword [ebx]
mov edx, dword [eax + 4]
lea eax, [edx - 0x18]
mov dword [edx + ebx - 4], eax
mov eax, dword [ebx]
mov dword [ebx + 8], 0
mov dword [ebx + 0xc], 0
mov edi, dword [eax + 4]
add edi, ebx
mov ecx, edi
mov dword [edi + 0x30], 0
mov dword [edi + 8], 0
mov dword [edi + 0x10], 0
mov dword [edi + 0x14], 0x201
mov dword [edi + 0x18], 6
mov dword [edi + 0x1c], 0
mov dword [edi + 0x20], 0
mov dword [edi + 0x24], 0
mov dword [edi + 0x28], 0
mov dword [edi + 0x2c], 0
call fcn.00401e80
push 8
call fcn.0055cf6a
mov esi, eax
xorps xmm0, xmm0
movq qword [esi], xmm0
push 1
mov dword [ebp - 4], 1
call fcn.0055af3a
mov dword [esi + 4], eax
add esp, 8
mov eax, dword [ebp + 8]
mov dword [edi + 0x30], esi
mov dword [edi + 0x38], eax
mov dword [edi + 0x3c], 0
mov dword [ebp - 4], 2
mov ecx, dword [esi + 4]
mov dword [ebp - 0x18], ecx
mov eax, dword [ecx]
call dword [eax + 4]
lea eax, [ebp - 0x1c]
mov dword [ebp - 4], 3
push eax
call fcn.00405050
add esp, 4
mov ecx, eax
mov edx, dword [eax]
push 0x20
mov eax, dword [edx + 0x20]
call eax
mov byte [ebp + 0xb], al
mov dword [ebp - 4], 4
mov ecx, dword [ebp - 0x18]
test ecx, ecx
je 0x404868
mov edx, dword [ecx]
call dword [edx + 8]
test eax, eax
je 0x404868
mov edx, dword [eax]
mov ecx, eax
push 1
call dword [edx]
mov al, byte [ebp + 0xb]
mov byte [ebp - 4], 0
cmp dword [edi + 0x38], 0
mov byte [edi + 0x40], al
jne 0x404888
mov eax, dword [edi + 0xc]
mov ecx, edi
or eax, 4
push 0
push eax
call fcn.00401e80
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x404b50
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5f4d20
mov eax, dword fs:[0]
push eax
push esi
push edi
mov eax, dword [0x6807dc]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
push 8
mov dword [edi], vtable.std::basic_streambuf_char__struct_std::char_traits_char__.0
call fcn.0055cf6a
mov esi, eax
xorps xmm0, xmm0
movq qword [esi], xmm0
push 1
mov dword [ebp - 4], 0
call fcn.0055af3a
mov dword [esi + 4], eax
lea ecx, [edi + 8]
lea eax, [edi + 4]
mov dword [edi + 0x34], esi
mov dword [edi + 0xc], eax
add esp, 8
lea eax, [edi + 0x14]
mov dword [edi + 0x10], ecx
mov dword [edi + 0x1c], eax
lea eax, [edi + 0x18]
mov dword [edi + 0x20], eax
lea eax, [edi + 0x24]
mov dword [edi + 0x2c], eax
lea eax, [edi + 0x28]
mov dword [edi + 0x30], eax
mov dword [ecx], 0
mov eax, dword [edi + 0x20]
mov dword [eax], 0
mov eax, dword [edi + 0x30]
mov dword [eax], 0
mov eax, dword [edi + 0xc]
mov dword [eax], 0
mov eax, dword [edi + 0x1c]
mov dword [eax], 0
mov eax, dword [edi + 0x2c]
mov dword [eax], 0
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret