joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10007280
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x13c
mov eax, dword [0x10087400]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push 0
push 2
mov dword [ebp - 0x138], ecx
mov dword [ebp - 0x134], 0
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov esi, eax
cmp esi, 0xffffffff
je 0x10007312
lea eax, [ebp - 0x130]
mov dword [ebp - 0x130], 0x128
push eax
push esi
call dword [sym.imp.KERNEL32.dll_Process32First]
test eax, eax
je 0x10007312
mov edi, dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__stricmp]
mov ebx, dword [sym.imp.KERNEL32.dll_Process32Next]
nop
push dword [ebp - 0x138]
lea eax, [ebp - 0x10c]
push eax
call edi
add esp, 8
test eax, eax
je 0x10007306
lea eax, [ebp - 0x130]
push eax
push esi
call ebx
test eax, eax
jne 0x100072e0
jmp 0x10007312
mov eax, dword [ebp - 0x128]
mov dword [ebp - 0x134], eax
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x134]
xor ecx, ebp
pop edi
pop esi
pop ebx
call fcn.1006b8bb
mov esp, ebp
pop ebp
ret
Function at 0x100080a0
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [0x10087400]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [0x10089178]
push esi
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
push edi
mov eax, dword [eax]
mov eax, dword [eax]
mov dword [0x100893c8], eax
lea edi, [eax + 0x10]
cmp edi, 0x1000
jbe 0x100080f3
lea eax, [ebp - 8]
push eax
push 0x40
push 4
push edi
call esi
lea eax, [ebp - 0xc]
mov dword [edi], fcn.10008090
push eax
push dword [ebp - 8]
push 4
push edi
call esi
mov eax, dword [0x100893c8]
lea edi, [eax + 0x3c]
cmp edi, 0x1000
jbe 0x10008120
lea eax, [ebp - 8]
push eax
push 0x40
push 4
push edi
call esi
lea eax, [ebp - 0xc]
mov dword [edi], fcn.10008090
push eax
push dword [ebp - 8]
push 4
push edi
call esi
mov eax, dword [0x100893c8]
lea edi, [eax + 0x40]
cmp edi, 0x1000
jbe 0x1000814d
lea eax, [ebp - 8]
push eax
push 0x40
push 4
push edi
call esi
lea eax, [ebp - 0xc]
mov dword [edi], fcn.10008090
push eax
push dword [ebp - 8]
push 4
push edi
call esi
mov eax, dword [0x100893c8]
lea edi, [eax + 0x44]
cmp edi, 0x1000
jbe 0x1000817a
lea eax, [ebp - 8]
push eax
push 0x40
push 4
push edi
call esi
lea eax, [ebp - 0xc]
mov dword [edi], fcn.10008090
push eax
push dword [ebp - 8]
push 4
push edi
call esi
mov eax, dword [0x100893c8]
lea edi, [eax + 0x48]
cmp edi, 0x1000
jbe 0x100081a7
lea eax, [ebp - 8]
push eax
push 0x40
push 4
push edi
call esi
lea eax, [ebp - 0xc]
mov dword [edi], fcn.10008090
push eax
push dword [ebp - 8]
push 4
push edi
call esi
mov eax, dword [0x100893c8]
lea edi, [eax + 0x4c]
cmp edi, 0x1000
jbe 0x100081d4
lea eax, [ebp - 8]
push eax
push 0x40
push 4
push edi
call esi
lea eax, [ebp - 0xc]
mov dword [edi], fcn.10008090
push eax
push dword [ebp - 8]
push 4
push edi
call esi
mov eax, dword [0x100893c8]
lea edi, [eax + 0x50]
cmp edi, 0x1000
jbe 0x10008201
lea eax, [ebp - 8]
push eax
push 0x40
push 4
push edi
call esi
lea eax, [ebp - 0xc]
mov dword [edi], fcn.10008090
push eax
push dword [ebp - 8]
push 4
push edi
call esi
mov eax, dword [0x100893c8]
lea edi, [eax + 0x54]
cmp edi, 0x1000
jbe 0x1000822e
lea eax, [ebp - 8]
push eax
push 0x40
push 4
push edi
call esi
lea eax, [ebp - 0xc]
mov dword [edi], fcn.10008090
push eax
push dword [ebp - 8]
push 4
push edi
call esi
mov eax, dword [0x100893c8]
lea edi, [eax + 0x58]
cmp edi, 0x1000
jbe 0x1000825b
lea eax, [ebp - 8]
push eax
push 0x40
push 4
push edi
call esi
lea eax, [ebp - 0xc]
mov dword [edi], fcn.10008090
push eax
push dword [ebp - 8]
push 4
push edi
call esi
mov eax, dword [0x100893c8]
cmp dword [0x100892b4], 0
jne 0x1000829a
lea edi, [eax + 0x34]
push ebx
cmp edi, 0x1000
jbe 0x10008291
mov ebx, dword [edi]
lea eax, [ebp - 8]
push eax
push 0x40
push 4
push edi
call esi
lea eax, [ebp - 0xc]
mov dword [edi], 0x100077d0
push eax
push dword [ebp - 8]
push 4
push edi
call esi
jmp 0x10008293
xor ebx, ebx
mov dword [0x100892b4], ebx
pop ebx
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.1006b8bb
mov esp, ebp
pop ebp
ret
Function at 0x1000af60
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [0x10087400]
xor eax, ebp
mov dword [ebp - 4], eax
movss xmm0, dword [0x10083780]
push ebx
push esi
push edi
mov edi, dword [sym.imp.USER32.dll_GetAsyncKeyState]
or esi, 0xffffffff
movss dword [ebp - 8], xmm0
xor ebx, ebx
nop dword [eax + eax]
mov ecx, ebx
call fcn.100082e0
test eax, eax
jle 0x1000b10e
mov ecx, dword [0x10089230]
sub ecx, dword [0x1008a84c]
add ecx, dword [0x1008a97c]
mov eax, dword [0x1008aa10]
mov cl, byte [ecx + eax]
mov al, bl
not cl
not al
xor cl, al
test cl, 1
je 0x1000b10e
mov eax, dword [0x10089508]
lea ecx, [ebp - 0x14]
mov edx, ebx
push dword [eax*4 + 0x1007f444]
call fcn.10008370
add esp, 4
test al, al
je 0x1000b10e
movq xmm0, qword [ebp - 0x14]
sub esp, 0xc
mov eax, dword [ebp - 0xc]
mov ecx, esp
movq qword [ecx], xmm0
mov dword [ecx + 8], eax
lea ecx, [ebp - 0x20]
call fcn.10008490
add esp, 0xc
test al, al
je 0x1000b10e
mov eax, dword [0x10089294]
cvttss2si edx, dword [ebp - 0x1c]
movd xmm0, eax
cvtdq2pd xmm0, xmm0
shr eax, 0x1f
cvttss2si ecx, dword [ebp - 0x20]
addsd xmm0, qword [eax*8 + 0x10083790]
cvtpd2ps xmm0, xmm0
mulss xmm0, dword [0x100836a0]
cvttss2si eax, xmm0
push eax
mov eax, dword [0x10089290]
movd xmm0, eax
cvtdq2pd xmm0, xmm0
shr eax, 0x1f
addsd xmm0, qword [eax*8 + 0x10083790]
cvtpd2ps xmm0, xmm0
mulss xmm0, dword [0x100836a0]
cvttss2si eax, xmm0
push eax
call fcn.1000ad90
movss xmm1, dword [ebp - 8]
add esp, 8
cvtps2pd xmm1, xmm1
comisd xmm1, xmm0
jbe 0x1000b10e
xorps xmm1, xmm1
cvtsd2ss xmm1, xmm0
movd xmm0, dword [0x10089444]
cvtdq2ps xmm0, xmm0
movss dword [ebp - 8], xmm1
comiss xmm0, xmm1
jbe 0x1000b10e
mov ecx, dword [0x100890ac]
lea eax, [ecx - 1]
cmp eax, 3
ja case.default.0x1000b0b4
jmp dword [eax*4 + 0x1000b138]
mov eax, 1
mov dword [0x100893b4], eax
jmp 0x1000b0f0
mov eax, 2
mov dword [0x100893b4], eax
jmp 0x1000b0f0
mov eax, 0x11
mov dword [0x100893b4], eax
jmp 0x1000b0f0
mov eax, 0x10
mov dword [0x100893b4], eax
jmp 0x1000b0f0
mov eax, dword [0x100893b4]
test ecx, ecx
je 0x1000b105
push eax
call edi
test ax, ax
js 0x1000b105
cmp dword [0x100890ac], 0
jne 0x1000b10e
mov esi, ebx
mov byte [0x1008918f], 1
inc ebx
cmp ebx, 0xf
jle 0x1000af90
mov eax, esi
cmp esi, 0xffffffff
jne 0x1000b126
mov byte [0x1008918f], 0
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1006b8bb
mov esp, ebp
pop ebp
ret
Function at 0x1000b0bb
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [0x10087400]
xor eax, ebp
mov dword [ebp - 4], eax
movss xmm0, dword [0x10083780]
push ebx
push esi
push edi
mov edi, dword [sym.imp.USER32.dll_GetAsyncKeyState]
or esi, 0xffffffff
movss dword [ebp - 8], xmm0
xor ebx, ebx
nop dword [eax + eax]
mov ecx, ebx
call fcn.100082e0
test eax, eax
jle 0x1000b10e
mov ecx, dword [0x10089230]
sub ecx, dword [0x1008a84c]
add ecx, dword [0x1008a97c]
mov eax, dword [0x1008aa10]
mov cl, byte [ecx + eax]
mov al, bl
not cl
not al
xor cl, al
test cl, 1
je 0x1000b10e
mov eax, dword [0x10089508]
lea ecx, [ebp - 0x14]
mov edx, ebx
push dword [eax*4 + 0x1007f444]
call fcn.10008370
add esp, 4
test al, al
je 0x1000b10e
movq xmm0, qword [ebp - 0x14]
sub esp, 0xc
mov eax, dword [ebp - 0xc]
mov ecx, esp
movq qword [ecx], xmm0
mov dword [ecx + 8], eax
lea ecx, [ebp - 0x20]
call fcn.10008490
add esp, 0xc
test al, al
je 0x1000b10e
mov eax, dword [0x10089294]
cvttss2si edx, dword [ebp - 0x1c]
movd xmm0, eax
cvtdq2pd xmm0, xmm0
shr eax, 0x1f
cvttss2si ecx, dword [ebp - 0x20]
addsd xmm0, qword [eax*8 + 0x10083790]
cvtpd2ps xmm0, xmm0
mulss xmm0, dword [0x100836a0]
cvttss2si eax, xmm0
push eax
mov eax, dword [0x10089290]
movd xmm0, eax
cvtdq2pd xmm0, xmm0
shr eax, 0x1f
addsd xmm0, qword [eax*8 + 0x10083790]
cvtpd2ps xmm0, xmm0
mulss xmm0, dword [0x100836a0]
cvttss2si eax, xmm0
push eax
call fcn.1000ad90
movss xmm1, dword [ebp - 8]
add esp, 8
cvtps2pd xmm1, xmm1
comisd xmm1, xmm0
jbe 0x1000b10e
xorps xmm1, xmm1
cvtsd2ss xmm1, xmm0
movd xmm0, dword [0x10089444]
cvtdq2ps xmm0, xmm0
movss dword [ebp - 8], xmm1
comiss xmm0, xmm1
jbe 0x1000b10e
mov ecx, dword [0x100890ac]
lea eax, [ecx - 1]
cmp eax, 3
ja case.default.0x1000b0b4
jmp dword [eax*4 + 0x1000b138]
mov eax, 1
mov dword [0x100893b4], eax
jmp 0x1000b0f0
mov eax, 2
mov dword [0x100893b4], eax
jmp 0x1000b0f0
mov eax, 0x11
mov dword [0x100893b4], eax
jmp 0x1000b0f0
mov eax, 0x10
mov dword [0x100893b4], eax
jmp 0x1000b0f0
mov eax, dword [0x100893b4]
test ecx, ecx
je 0x1000b105
push eax
call edi
test ax, ax
js 0x1000b105
cmp dword [0x100890ac], 0
jne 0x1000b10e
mov esi, ebx
mov byte [0x1008918f], 1
inc ebx
cmp ebx, 0xf
jle 0x1000af90
mov eax, esi
cmp esi, 0xffffffff
jne 0x1000b126
mov byte [0x1008918f], 0
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1006b8bb
mov esp, ebp
pop ebp
ret

Function at 0x1000b150
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push edi
mov edi, ecx
mov dword [ebp - 4], edx
push edi
call dword [sym.imp.USER32.dll_GetKeyState]
cwde
shr eax, 0x10
test eax, eax
je 0x1000b1aa
cmp byte [edi*8 + 0x1008b368], 0
lea esi, [edi*8 + 0x1008b36c]
je 0x1000b18f
cmp dword [esi], 0
je 0x1000b1b2
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, dword [esi]
add ecx, dword [ebp - 4]
cmp ecx, eax
ja 0x1000b1b2
mov byte [edi*8 + 0x1008b368], 1
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [esi], eax
mov eax, 1
pop edi
pop esi
mov esp, ebp
pop ebp
ret
mov byte [edi*8 + 0x1008b368], 0
pop edi
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x100102d0
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [0x1008ab60]
cmp dword [eax], 1
jne 0x100103bf
mov eax, dword [0x10089500]
cmp dword [eax], 0
je 0x100103bf
cmp dword [0x10089454], 0
je 0x100103bf
mov ecx, dword [0x10089230]
sub ecx, dword [0x1008a84c]
add ecx, dword [0x1008a97c]
mov eax, dword [0x1008aa10]
mov ecx, dword [ecx + eax]
call fcn.100082e0
test eax, eax
jle 0x10010341
mov eax, dword [0x10089500]
mov ecx, dword [eax]
add ecx, dword [0x1008a834]
call fcn.100113d0
mov ecx, dword [0x1008a858]
add ecx, eax
call fcn.10011410
jmp 0x10010344
mov eax, dword [ebp - 4]
test eax, eax
jne 0x100103bf
mov eax, dword [0x10089500]
push edi
push 1
mov edi, dword [eax]
call dword [sym.imp.USER32.dll_GetKeyState]
cwde
shr eax, 0x10
test eax, eax
je 0x100103b7
cmp byte [0x1008b370], 0
je 0x10010388
cmp dword [0x1008b374], 0
je 0x100103be
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, dword [0x1008b374]
add ecx, 0xc8
cmp ecx, eax
ja 0x100103be
mov byte [0x1008b370], 1
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push 0
push 2
mov ecx, edi
mov dword [0x1008b374], eax
call dword [0x1008a874]
push 0
push 0
mov ecx, edi
call dword [0x1008a874]
pop edi
mov esp, ebp
pop ebp
ret
mov byte [0x1008b370], 0
pop edi
mov esp, ebp
pop ebp
ret

Function at 0x10010d30
Capabilities:
Check for time delay via gettickcount
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [0x1008ab60]
sub esp, 0xc
cmp dword [eax], 1
push edi
jne 0x10010e36
mov eax, dword [0x10089500]
cmp dword [eax], 0
je 0x10010d93
mov ecx, dword [0x10089230]
sub ecx, dword [0x1008a84c]
add ecx, dword [0x1008a97c]
mov eax, dword [0x1008aa10]
mov ecx, dword [ecx + eax]
call fcn.100082e0
test eax, eax
jle 0x10010d93
mov eax, dword [0x10089500]
mov ecx, dword [eax]
add ecx, dword [0x1008a834]
call fcn.100113d0
mov ecx, dword [0x1008a858]
add ecx, eax
call fcn.10011410
jmp 0x10010d96
mov eax, dword [ebp - 4]
test eax, eax
jne 0x10010e36
cmp dword [0x100890b8], eax
je 0x10010e36
mov eax, dword [0x1008a974]
lea edx, [ebp - 0xc]
sub esp, 0xc
mov dword [ebp - 0xc], eax
mov eax, dword [0x1008a8b0]
mov ecx, esp
mov dword [ebp - 8], eax
lea eax, [ebp - 4]
push ecx
push eax
push edx
call fcn.10012690
mov ecx, dword [0x1008aa44]
call fcn.10005320
add esp, 0xc
mov edi, eax
push 1
call dword [sym.imp.USER32.dll_GetKeyState]
movsx ecx, ax
shr ecx, 0x10
test ecx, ecx
je 0x10010e2f
cmp byte [0x1008b370], 0
je 0x10010e12
cmp dword [0x1008b374], 0
je 0x10010e36
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, dword [0x1008b374]
inc ecx
cmp ecx, eax
ja 0x10010e36
mov byte [0x1008b370], 1
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [0x1008b374], eax
mov dword [edi], 5
pop edi
mov esp, ebp
pop ebp
ret
mov byte [0x1008b370], 0
pop edi
mov esp, ebp
pop ebp
ret
Function at 0x10010ea0
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
mov esi, dword [0x10089464]
mov ebx, ecx
mov dword [ebp - 4], ebx
test esi, esi
jne 0x10010f32
push edi
push 0x28
call fcn.1006bac6
mov ebx, dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov esi, eax
xorps xmm0, xmm0
mov dword [ebp - 8], esi
push 0x190
movups xmmword [esi], xmm0
movups xmmword [esi + 0x10], xmm0
movq qword [esi + 0x20], xmm0
mov dword [esi + 0xc], 0
mov dword [esi], 0
mov dword [esi + 0x10], 0x433c0000
mov dword [esi + 0x14], 0x41900000
mov dword [esi + 4], 1
call ebx
add esp, 8
mov dword [esi + 8], eax
xor edi, edi
nop word [eax + eax]
push 0x14
call ebx
mov ecx, dword [esi + 8]
add esp, 4
mov dword [edi + ecx], eax
add edi, 4
cmp edi, 0x190
jl 0x10010f10
mov ebx, dword [ebp - 4]
pop edi
mov dword [0x10089464], esi
cmp dword [esi], 0
jne 0x10010f44
mov ecx, ebx
call fcn.1000c7e0
mov esi, dword [0x10089464]
movss xmm2, dword [0x10083730]
mov ecx, esi
movss xmm1, dword [0x10083714]
push ebx
call fcn.1000b600
call fcn.1000c390
push 0xa0
call dword [sym.imp.USER32.dll_GetKeyState]
cwde
shr eax, 0x10
test eax, eax
je 0x10010fce
cmp byte [0x1008b868], 0
mov esi, dword [sym.imp.KERNEL32.dll_GetTickCount]
je 0x10010f9e
cmp dword [0x1008b86c], 0
je 0x10010fd5
call esi
mov ecx, dword [0x1008b86c]
add ecx, 0xc8
cmp ecx, eax
ja 0x10010fd5
mov byte [0x1008b868], 1
call esi
cmp byte [0x10089127], 0
pop esi
sete byte [0x10089127]
mov dword [0x1008b86c], eax
cmp byte [0x100892d7], 0
pop ebx
sete byte [0x100892d7]
mov esp, ebp
pop ebp
ret
mov byte [0x1008b868], 0
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10011720
Capabilities:
Access peb ldr_data
Allocate or change rwx memory
Create thread
Spawn thread to rwx shellcode

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [0x10087400]
xor eax, ebp
mov dword [ebp - 4], eax
sub dword [ebp + 0xc], 1
push esi
mov esi, dword [ebp + 8]
jne 0x1001182c
push esi
call dword [sym.imp.KERNEL32.dll_DisableThreadLibraryCalls]
push 0x100115e0
push 1
call dword [sym.imp.KERNEL32.dll_AddVectoredExceptionHandler]
push 0
push 0
push 0
push 0x100116d0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test esi, esi
je 0x100117c3
push edi
mov edi, dword [esi + 0x3c]
lea eax, [ebp - 8]
push eax
push 4
push 0x40
push esi
add edi, esi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
je 0x10011798
push 0x40
push 0
push esi
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
test edi, edi
je 0x100117c2
lea eax, [ebp - 8]
push eax
push 4
push 0xf8
push edi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
je 0x100117c2
push 0xf8
push 0
push edi
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
pop edi
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0xc]
mov ecx, dword [eax + 0x18]
test ecx, ecx
je 0x1001182c
cmp ecx, esi
jne 0x10011823
mov edx, dword [eax + 4]
test edx, edx
je 0x100117e5
mov ecx, dword [eax]
mov dword [edx], ecx
mov edx, dword [eax + 4]
test edx, edx
je 0x100117f1
mov ecx, dword [eax]
mov dword [ecx + 4], edx
mov edx, dword [eax + 0x14]
test edx, edx
je 0x10011800
mov ecx, dword [eax + 0x10]
mov dword [edx], ecx
mov edx, dword [eax + 0x14]
mov ecx, dword [eax + 0x10]
test ecx, ecx
je 0x1001180a
mov dword [ecx + 4], edx
mov edx, dword [eax + 8]
test edx, edx
je 0x10011816
mov ecx, dword [eax + 0xc]
mov dword [ecx], edx
mov edx, dword [eax + 8]
test edx, edx
je 0x10011823
mov ecx, dword [eax + 0xc]
mov dword [edx + 4], ecx
mov eax, dword [eax]
mov ecx, dword [eax + 0x18]
test ecx, ecx
jne 0x100117d6
mov ecx, dword [ebp - 4]
mov eax, 1
xor ecx, ebp
pop esi
call fcn.1006b8bb
mov esp, ebp
pop ebp
ret 0xc
Function at 0x10011d30
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x1c
push ebx
mov ebx, ecx
push esi
push edi
cmp dword [ebx + 0x38], 0
je 0x10011d5c
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____thiscall_std::basic_streambuf_char__struct_std::char_traits_char__::xsputn_char_const___long_long___int64__]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov eax, dword [ebx + 0x20]
mov esi, dword [ebp + 0xc]
mov edi, dword [ebp + 0x10]
mov dword [esp + 0x20], esi
mov ecx, dword [eax]
lea eax, [ebx + 0x30]
mov dword [esp + 0x24], edi
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x18], eax
test ecx, ecx
je 0x10011d84
mov eax, dword [eax]
mov ecx, dword [eax]
jmp 0x10011d8a
xor ecx, ecx
mov dword [esp + 0x18], eax
mov eax, ecx
cdq
mov dword [esp + 0x10], eax
mov ecx, edx
mov dword [esp + 0x14], ecx
test edi, edi
jl 0x10011df2
jg 0x10011da1
test esi, esi
je 0x10011df2
test ecx, ecx
jl 0x10011ded
jg 0x10011dab
test eax, eax
je 0x10011ded
cmp edi, ecx
jg 0x10011dbf
jl 0x10011db5
cmp esi, eax
jae 0x10011dbf
mov eax, esi
mov dword [esp + 0x10], esi
mov dword [esp + 0x14], edi
push eax
push dword [ebp + 8]
push dword [esp + 0x24]
call sub.VCRUNTIME140.dll_memcpy
mov eax, dword [esp + 0x24]
add esp, 0xc
mov edx, dword [esp + 0x10]
mov ecx, dword [ebp + 8]
add ecx, edx
sub esi, edx
mov eax, dword [eax]
sbb edi, dword [esp + 0x14]
sub dword [eax], edx
mov eax, dword [ebx + 0x20]
add dword [eax], edx
jmp 0x10011df5
mov ecx, dword [ebp + 8]
jmp 0x10011dff
mov ecx, dword [ebp + 8]
test edi, edi
jl 0x10011e19
jg 0x10011dff
test esi, esi
je 0x10011e19
mov eax, dword [ebx + 0x4c]
test eax, eax
je 0x10011e19
push eax
push esi
push 1
push ecx
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
add esp, 0x10
sub esi, eax
sbb edi, 0
mov eax, dword [esp + 0x20]
mov edx, dword [esp + 0x24]
sub eax, esi
sbb edx, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x10011e30
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [ebp + 0x10]
push ebx
mov ebx, ecx
mov ecx, dword [ebp + 0xc]
push esi
mov esi, dword [ebp + 8]
mov dword [ebp - 4], esi
test eax, eax
jg 0x10011e5c
jl 0x10011e50
test ecx, ecx
jne 0x10011e5c
pop esi
xor eax, eax
xor edx, edx
pop ebx
mov esp, ebp
pop ebp
ret 0xc
cmp dword [ebx + 0x38], 0
je 0x10011e75
push eax
push ecx
push esi
mov ecx, ebx
call dword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____thiscall_std::basic_streambuf_char__struct_std::char_traits_char__::xsgetn_char___long_long___int64__]
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov eax, dword [ebx + 0x1c]
push edi
mov edi, ecx
mov eax, dword [eax]
mov dword [ebp - 8], eax
test eax, eax
je 0x10011ec3
mov eax, dword [ebx + 0x2c]
lea edx, [ebx + 0x2c]
mov dword [ebp - 0xc], edx
mov eax, dword [eax]
test eax, eax
je 0x10011ec9
mov edi, dword [ebp - 4]
cmp eax, ecx
mov esi, ecx
cmovb esi, eax
push esi
push dword [ebp - 8]
push edi
call sub.VCRUNTIME140.dll_memcpy
mov eax, dword [ebx + 0x2c]
add edi, esi
mov dword [ebp - 4], edi
add esp, 0xc
mov edi, dword [ebp + 0xc]
sub edi, esi
sub dword [eax], esi
mov eax, dword [ebx + 0x1c]
add dword [eax], esi
mov esi, dword [ebp - 4]
jmp 0x10011ec9
lea eax, [ebx + 0x2c]
mov dword [ebp - 0xc], eax
cmp dword [ebx + 0x4c], 0
je 0x10011f36
mov ecx, dword [ebx + 0xc]
lea eax, [ebx + 0x3c]
cmp dword [ecx], eax
jne 0x10011ef2
mov eax, dword [ebx + 0xc]
mov edx, dword [ebx + 0x54]
mov ecx, dword [ebx + 0x50]
sub edx, ecx
mov dword [eax], ecx
mov eax, dword [ebx + 0x1c]
mov dword [eax], ecx
mov eax, dword [ebp - 0xc]
mov eax, dword [eax]
mov dword [eax], edx
mov eax, dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
cmp edi, 0xfff
jbe 0x10011f24
nop
push dword [ebx + 0x4c]
push 0xfff
push 1
push esi
call eax
add esp, 0x10
add esi, eax
sub edi, eax
cmp eax, 0xfff
jne 0x10011f36
cmp edi, eax
mov eax, dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
ja 0x10011f00
test edi, edi
je 0x10011f36
push dword [ebx + 0x4c]
push edi
push 1
push esi
call eax
add esp, 0x10
sub edi, eax
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 0x10]
sub eax, edi
pop edi
pop esi
sbb edx, 0
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x100122b0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
mov eax, dword [0x10087400]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, ecx
cmp ebx, 0xffffffff
jne 0x100122e0
pop esi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1006b8bb
mov esp, ebp
pop ebp
ret 4
mov eax, dword [esi + 0x20]
push edi
mov ecx, dword [eax]
test ecx, ecx
je 0x1001231c
mov edx, dword [esi + 0x30]
mov edi, dword [edx]
lea eax, [edi + ecx]
cmp ecx, eax
jae 0x1001231c
lea ecx, [edi - 1]
mov eax, ebx
mov dword [edx], ecx
mov edx, dword [esi + 0x20]
pop edi
mov esi, dword [edx]
lea ecx, [esi + 1]
mov dword [edx], ecx
mov byte [esi], bl
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1006b8bb
mov esp, ebp
pop ebp
ret 4
cmp dword [esi + 0x4c], 0
je 0x100123f3
mov edi, dword [esi + 0xc]
lea eax, [esi + 0x3c]
cmp dword [edi], eax
jne 0x10012344
mov edx, dword [esi + 0x54]
mov ecx, dword [esi + 0x50]
sub edx, ecx
mov dword [edi], ecx
mov eax, dword [esi + 0x1c]
mov dword [eax], ecx
mov eax, dword [esi + 0x2c]
mov dword [eax], edx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x10012350
movsx eax, bl
jmp 0x10012388
lea eax, [ebp - 0x2c]
mov byte [ebp - 0x25], bl
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x25]
push eax
lea eax, [esi + 0x40]
push eax
call dword [sym.imp.MSVCP140.dll_public:_int___thiscall_std::codecvt_char__char__struct__Mbstatet_::out_struct__Mbstatet___char_const___char_const___char_const____char___char___char___const]
sub eax, 0
je 0x100123b2
sub eax, 1
je 0x100123b2
sub eax, 2
jne 0x100123f3
movsx eax, byte [ebp - 0x25]
push dword [esi + 0x4c]
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
add esp, 8
or ecx, 0xffffffff
cmp eax, ecx
cmove ebx, ecx
pop edi
pop esi
mov eax, ebx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1006b8bb
mov esp, ebp
pop ebp
ret 4
mov edi, dword [ebp - 0x2c]
lea eax, [ebp - 0x24]
sub edi, eax
je 0x100123d0
push dword [esi + 0x4c]
push edi
push 1
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
add esp, 0x10
cmp edi, eax
jne 0x100123f3
lea ecx, [ebp - 0x25]
mov byte [esi + 0x3d], 1
or eax, 0xffffffff
cmp dword [ebp - 0x30], ecx
pop edi
pop esi
cmovne eax, ebx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1006b8bb
mov esp, ebp
pop ebp
ret 4
mov ecx, dword [ebp - 4]
or eax, 0xffffffff
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1006b8bb
mov esp, ebp
pop ebp
ret 4