joyce8/EMBER2024-capa huggingface dataset:
Function at 0x812290
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x6f9988
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push esi
push edi
mov eax, dword [0x70b060]
xor eax, esp
push eax
lea eax, [esp + 0x20]
mov dword fs:[0], eax
mov edi, ecx
lea ecx, [esp + 0x10]
mov dword [esp + 0xc], 0x6fba08
call fcn.00804040
mov dword [esp + 0xc], 0x6fba14
push 0
push 0x6fb744
lea ecx, [edi + 0x2be]
mov dword [esp + 0x30], 0
call fcn.007ff820
lea ecx, [esp + 0xc]
call fcn.008146d0
test eax, eax
je 0x81233e
movzx eax, word [0x70a74c]
push eax
push 0x86
call fcn.00817eb0
push eax
lea ecx, [edi + 0x2be]
call fcn.007ff6c0
test eax, eax
jne 0x812334
push 0x409
push 0x86
call fcn.00817eb0
push eax
lea ecx, [edi + 0x2be]
call fcn.007ff6c0
push 1
lea ecx, [edi + 0x64]
call fcn.008012e0
lea ecx, [esp + 0x10]
mov dword [esp + 0x28], 0xffffffff
mov dword [esp + 0xc], 0x6fba08
call fcn.00804170
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x20
ret

Function at 0x812e30
Capabilities:
Access peb ldr_data
Get number of processors

Disassembly:
push 0xffffffffffffffff
push 0x6f9adb
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push ebx
push esi
push edi
mov eax, dword [0x70b060]
xor eax, esp
push eax
lea eax, [esp + 0x24]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0x14], esi
xor edi, edi
push edi
push edi
push ecx
mov eax, esp
mov dword [esp + 0x1c], esp
mov dword [eax], edi
call fcn.008119b0
lea ecx, [esi + 0x64]
mov dword [esp + 0x2c], edi
mov dword [esi], 0x6fcacc
call fcn.00801c30
mov ebx, 1
lea ecx, [esi + 0xf1]
mov byte [esp + 0x2c], bl
call fcn.00815ad0
lea ecx, [esi + 0x180]
mov byte [esp + 0x2c], 2
call fcn.00806140
lea ecx, [esi + 0x201]
mov byte [esp + 0x2c], 3
call fcn.008006f0
mov dword [esi + 0x2b6], edi
mov dword [esi + 0x2ba], edi
mov eax, dword [0x70bfb0]
mov edx, dword [eax + 0xc]
mov ecx, 0x70bfb0
mov byte [esp + 0x2c], 4
call edx
add eax, 0x10
mov dword [esi + 0x2be], eax
mov dword [esi + 0x2c2], ebx
push 0x30
mov byte [esp + 0x30], 5
mov dword [esi + 0x2ce], edi
call fcn.00ae7ba2
add esp, 4
cmp eax, edi
je 0x812f5b
mov dword [esi + 0x2ca], eax
mov dword [eax], eax
mov eax, dword [esi + 0x2ca]
mov dword [eax + 4], eax
mov eax, dword [esi + 0x2ca]
mov dword [eax + 8], eax
mov eax, dword [esi + 0x2ca]
mov byte [eax + 0x28], bl
mov ecx, dword [esi + 0x2ca]
mov byte [ecx + 0x29], bl
mov dword [esi + 0x2d6], edi
mov edx, dword [0x70cfb0]
push 0x80
push edx
call dword [0x6fb314]
mov dword [esi + 0x2d6], eax
mov eax, esi
mov ecx, dword [esp + 0x24]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x20
ret
lea eax, [esp + 0x10]
push eax
lea ecx, [esp + 0x1c]
mov dword [esp + 0x14], edi
call fcn.00ae8479
push 0x70352c
lea ecx, [esp + 0x1c]
push ecx
mov dword [esp + 0x20], 0x6fca38
call fcn.00ae6aa2
int3
Function at 0x816990
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x6fa070
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
mov eax, dword [0x70b060]
xor eax, esp
mov dword [esp + 0x18], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x70b060]
xor eax, esp
push eax
lea eax, [esp + 0x30]
mov dword fs:[0], eax
mov eax, dword [0x70bfb0]
mov edx, dword [eax + 0xc]
mov ebp, dword [esp + 0x44]
mov esi, ecx
mov ecx, 0x70bfb0
mov dword [esp + 0x14], esi
call edx
add eax, 0x10
mov dword [esi], eax
xor edx, edx
mov dword [esp + 0x38], edx
cmp ebp, edx
jle 0x816b43
mov ax, word [esp + 0x40]
xor ecx, ecx
mov word [esp + 0x18], ax
mov word [esp + 0x1a], cx
lea esi, [edx + 1]
cmp ax, dx
je 0x816a1f
lea esi, [esp + 0x18]
lea ecx, [esi + 2]
mov edi, edi
mov ax, word [esi]
add esi, 2
cmp ax, dx
jne 0x816a10
sub esi, ecx
sar esi, 1
mov dword [esp + 0x1c], edx
lea edi, [esi + 1]
mov eax, edi
xor ecx, ecx
shld ecx, eax, 1
add eax, eax
mov byte [esp + 0x38], 1
cmp ecx, edx
ja 0x816a3e
cmp eax, 0xffffffff
jbe 0x816a48
push 0x80070216
call fcn.007fe550
cmp eax, 0xa
jbe 0x816a59
push eax
lea ecx, [esp + 0x20]
call fcn.008165e0
jmp 0x816a61
lea edx, [esp + 0x20]
mov dword [esp + 0x1c], edx
mov ecx, dword [esp + 0x1c]
push 1
lea eax, [esp + 0x1c]
push eax
push edi
push ecx
call fcn.00ae7063
add esp, 0x10
cmp eax, 0x50
ja 0x816b68
movzx edx, byte [eax + 0x419634]
jmp dword [edx*4 + 0x419624]
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x18]
xor ecx, esp
call fcn.00ae701a
add esp, 0x28
ret 8
push 0x80004005
call fcn.007fe550
mov edi, edi
inc edi
xchg ebp, eax
inc ecx
add byte [0x50004195], bh
xchg ebp, eax
inc ecx
add byte [eax], bl
xchg esi, eax
inc ecx
add byte [eax], al
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ecx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [edx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [edx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [eax]
int3
Function at 0x84d0b1
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ecx
mov byte [ebp - 1], 0
jmp 0x84d0c3
mov al, byte [ebp - 1]
add al, 1
mov byte [ebp - 1], al
movzx ecx, byte [ebp - 1]
cmp ecx, 8
jge 0x84d111
movzx edx, word [ebp + 0xc]
and edx, 0x80
je 0x84d0e5
movzx eax, word [ebp + 0xc]
xor eax, 0x658e
mov word [ebp + 0xc], ax
movzx ecx, word [ebp + 0xc]
shl ecx, 1
mov word [ebp + 0xc], cx
movzx edx, byte [ebp + 8]
and edx, 0x80
je 0x84d107
mov ax, word [ebp + 0xc]
add ax, 1
mov word [ebp + 0xc], ax
mov cl, byte [ebp + 8]
shl cl, 1
mov byte [ebp + 8], cl
jmp 0x84d0bb
mov ax, word [ebp + 0xc]
mov esp, ebp
pop ebp
ret

Function at 0x84d171
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ecx
jmp 0x84d180
mov eax, dword [ebp + 0xc]
sub eax, 1
mov dword [ebp + 0xc], eax
cmp dword [ebp + 0xc], 0
jbe 0x84d1f6
mov ecx, dword [ebp + 8]
mov dl, byte [ecx]
mov byte [ebp - 2], dl
mov byte [ebp - 1], 0
jmp 0x84d19c
mov al, byte [ebp - 1]
add al, 1
mov byte [ebp - 1], al
movzx ecx, byte [ebp - 1]
cmp ecx, 8
jge 0x84d1eb
movzx edx, word [ebp + 0x10]
and edx, 0x8000
je 0x84d1be
movzx eax, word [ebp + 0x10]
xor eax, 0x8411
mov word [ebp + 0x10], ax
mov cx, word [ebp + 0x10]
shl cx, 1
mov word [ebp + 0x10], cx
movzx edx, byte [ebp - 2]
and edx, 0x80
je 0x84d1e1
mov ax, word [ebp + 0x10]
add ax, 1
mov word [ebp + 0x10], ax
mov cl, byte [ebp - 2]
shl cl, 1
mov byte [ebp - 2], cl
jmp 0x84d194
mov edx, dword [ebp + 8]
add edx, 1
mov dword [ebp + 8], edx
jmp 0x84d177
mov ax, word [ebp + 0x10]
mov esp, ebp
pop ebp
ret
Function at 0x8c4461
Capabilities:
Hash data using sha256

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
xor ecx, ecx
mov dword [eax + 0x104], ecx
mov dword [eax + 0x100], ecx
mov dword [eax + 0x108], 0x6a09e667
mov dword [eax + 0x10c], 0xbb67ae85
mov dword [eax + 0x110], 0x3c6ef372
mov dword [eax + 0x114], 0xa54ff53a
mov dword [eax + 0x118], 0x510e527f
mov dword [eax + 0x11c], 0x9b05688c
mov dword [eax + 0x120], 0x1f83d9ab
mov dword [eax + 0x124], 0x5be0cd19
mov dword [eax], 0x428a2f98
mov dword [eax + 4], 0x71374491
mov dword [eax + 8], 0xb5c0fbcf
mov dword [eax + 0xc], 0xe9b5dba5
mov dword [eax + 0x10], 0x3956c25b
mov dword [eax + 0x14], 0x59f111f1
mov dword [eax + 0x18], 0x923f82a4
mov dword [eax + 0x1c], 0xab1c5ed5
mov dword [eax + 0x20], 0xd807aa98
mov dword [eax + 0x24], 0x12835b01
mov dword [eax + 0x28], 0x243185be
mov dword [eax + 0x2c], 0x550c7dc3
mov dword [eax + 0x30], 0x72be5d74
mov dword [eax + 0x34], 0x80deb1fe
mov dword [eax + 0x38], 0x9bdc06a7
mov dword [eax + 0x3c], 0xc19bf174
mov dword [eax + 0x40], 0xe49b69c1
mov dword [eax + 0x44], 0xefbe4786
mov dword [eax + 0x48], 0xfc19dc6
mov dword [eax + 0x4c], 0x240ca1cc
mov dword [eax + 0x50], 0x2de92c6f
mov dword [eax + 0x54], 0x4a7484aa
mov dword [eax + 0x58], 0x5cb0a9dc
mov dword [eax + 0x5c], 0x76f988da
mov dword [eax + 0x60], 0x983e5152
mov dword [eax + 0x64], 0xa831c66d
mov dword [eax + 0x68], 0xb00327c8
mov dword [eax + 0x6c], 0xbf597fc7
mov dword [eax + 0x70], 0xc6e00bf3
mov dword [eax + 0x74], 0xd5a79147
mov dword [eax + 0x78], 0x6ca6351
mov dword [eax + 0x7c], 0x14292967
mov dword [eax + 0x80], 0x27b70a85
mov dword [eax + 0x84], 0x2e1b2138
mov dword [eax + 0x88], 0x4d2c6dfc
mov dword [eax + 0x8c], 0x53380d13
mov dword [eax + 0x90], 0x650a7354
mov dword [eax + 0x94], 0x766a0abb
mov dword [eax + 0x98], 0x81c2c92e
mov dword [eax + 0x9c], 0x92722c85
mov dword [eax + 0xa0], 0xa2bfe8a1
mov dword [eax + 0xa4], 0xa81a664b
mov dword [eax + 0xa8], 0xc24b8b70
mov dword [eax + 0xac], 0xc76c51a3
mov dword [eax + 0xb0], 0xd192e819
mov dword [eax + 0xb4], 0xd6990624
mov dword [eax + 0xb8], 0xf40e3585
mov dword [eax + 0xbc], 0x106aa070
mov dword [eax + 0xc0], 0x19a4c116
mov dword [eax + 0xc4], 0x1e376c08
mov dword [eax + 0xc8], 0x2748774c
mov dword [eax + 0xcc], 0x34b0bcb5
mov dword [eax + 0xd0], 0x391c0cb3
mov dword [eax + 0xd4], 0x4ed8aa4a
mov dword [eax + 0xd8], 0x5b9cca4f
mov dword [eax + 0xdc], 0x682e6ff3
mov dword [eax + 0xe0], 0x748f82ee
mov dword [eax + 0xe4], 0x78a5636f
mov dword [eax + 0xe8], 0x84c87814
mov dword [eax + 0xec], 0x8cc70208
mov dword [eax + 0xf0], 0x90befffa
mov dword [eax + 0xf4], 0xa4506ceb
mov dword [eax + 0xf8], 0xbef9a3f7
mov dword [eax + 0xfc], 0xc67178f2
pop ebp
ret
Function at 0x8e0801
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov dword [ebp - 4], 0
mov byte [ebp - 0x14], 0x30
mov byte [ebp - 0x13], 0x31
mov byte [ebp - 0x12], 0x32
mov byte [ebp - 0x11], 0x33
mov byte [ebp - 0x10], 0x34
mov byte [ebp - 0xf], 0x35
mov byte [ebp - 0xe], 0x36
mov byte [ebp - 0xd], 0x37
mov byte [ebp - 0xc], 0x38
mov byte [ebp - 0xb], 0x39
mov byte [ebp - 0xa], 0x61
mov byte [ebp - 9], 0x62
mov byte [ebp - 8], 0x63
mov byte [ebp - 7], 0x64
mov byte [ebp - 6], 0x65
mov byte [ebp - 5], 0x66
mov eax, dword [ebp + 0xc]
shl eax, 1
cmp eax, dword [ebp + 0x14]
jbe 0x8e085d
or eax, 0xffffffff
jmp 0x8e08aa
jmp 0x8e0868
mov ecx, dword [ebp - 4]
add ecx, 1
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 4]
cmp edx, dword [ebp + 0xc]
jae 0x8e08a8
mov eax, dword [ebp + 8]
add eax, dword [ebp - 4]
movzx ecx, byte [eax]
sar ecx, 4
and ecx, 0xf
mov edx, dword [ebp - 4]
mov eax, dword [ebp + 0x10]
mov cl, byte [ebp + ecx - 0x14]
mov byte [eax + edx*2], cl
mov edx, dword [ebp + 8]
add edx, dword [ebp - 4]
movzx eax, byte [edx]
and eax, 0xf
mov ecx, dword [ebp - 4]
mov edx, dword [ebp + 0x10]
mov al, byte [ebp + eax - 0x14]
mov byte [edx + ecx*2 + 1], al
jmp 0x8e085f
xor eax, eax
mov esp, ebp
pop ebp
ret

Function at 0x8e9751
Capabilities:
Encode data using xor

Disassembly:
aaa
xchg edx, eax
lodsd eax, dword [esi]
mov dword [0x420113e3], eax
xor byte [edi - 0x78], cl
jp 0x8e9719
into
inc ecx
jge 0x8e9730
or eax, 0xb134ac16
in al, dx
adc al, 0x2a
add dword [eax], ebx
xchg ebx, eax
push 0x4336c858
sbb cl, dh
sub byte [eax], ah
scasb al, byte es:[edi]
mov al, byte [0x5486e121]
cmp esp, dword [esi]
sub eax, 0xccf57ac6
int3
push 0x956d59
call fcn.00a5eff4
sar edi, 0x3f
and dword [ebp + 0x7d], eax
and eax, 0x34b74b45
xchg ebp, eax
inc ebx
cmp dword [ebx], eax
or eax, 0x3884e827
cmp al, 0x44
movsb byte es:[edi], byte [esi]
nop
xor dword cs:[eax + 0x3793c292], ecx
lodsd eax, dword [esi]
cmp al, 0x69
cmp al, 0x62
jecxz 0x8e9718
and al, 0xb
dec esi
pushal
pop eax
mov esp, 0x7478c2ba
mov byte [ebx - 0x2b], 0xec
dec ebp
pop es
or esp, ecx
pushfd
xchg esp, eax
inc ebx
mov al, byte [0xc910c64b]
pushfd
xor byte [edi + 0x46], bl
div dword [edx - 0xe]
jle 0x8e9823
sti
push edx
invalid
add al, 0xf0
movsd dword es:[edi], dword [esi]
push eax
retf

Function at 0x8ec271
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x3c]
add ecx, eax
movzx eax, word [ecx + 0x14]
push ebx
push esi
movzx esi, word [ecx + 6]
xor edx, edx
push edi
lea eax, [eax + ecx + 0x18]
test esi, esi
jle 0x8ec2ac
mov edi, dword [ebp + 0xc]
mov ecx, dword [eax + 0xc]
cmp edi, ecx
jb 0x8ec2a4
mov ebx, dword [eax + 8]
add ebx, ecx
cmp edi, ebx
jb 0x8ec2ae
inc edx
add eax, 0x28
cmp edx, esi
jl 0x8ec294
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x8ec721
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
mov edi, dword [eax + 0x3c]
movzx ecx, word [edi + eax + 0x14]
add edi, eax
xor edx, edx
xor ebx, ebx
lea esi, [ecx + edi + 0x18]
cmp dx, word [edi + 6]
jb 0x8ec754
pop edi
pop esi
xor eax, eax
pop ebx
pop ebp
ret
mov eax, dword [ebp + 8]
mov ecx, dword [esi + 0xc]
mov edx, dword [ebp + 0xc]
push ecx
push edx
push eax
call fcn.008ec561
mov ecx, dword [ebp + 0x10]
add esp, 0xc
cmp ecx, eax
jb 0x8ec775
mov edx, dword [esi + 8]
add edx, eax
cmp ecx, edx
jb 0x8ec788
movzx eax, word [edi + 6]
inc ebx
add esi, 0x28
cmp ebx, eax
jl 0x8ec751
pop edi
pop esi
xor eax, eax
pop ebx
pop ebp
ret
pop edi
mov eax, esi
pop esi
pop ebx
pop ebp
ret
Function at 0x404bf0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x40a155
mov eax, dword fs:[0]
push eax
sub esp, 0x10
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push 4
call fcn.00408d67
add esp, 4
mov dword [ebp - 0x14], eax
mov dword [eax], 0x404bc0
lea ecx, [ebp - 0x18]
mov dword [ebp - 4], 0
push ecx
push 0
push eax
push 0x4085c0
push 0
push 0
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
add esp, 0x18
mov dword [ebp - 0x1c], eax
test eax, eax
je 0x404c77
mov dword [ebp - 4], 1
mov ecx, dword [ebp - 0x18]
test ecx, ecx
je 0x404c6f
push ecx
push eax
call dword [sym.imp.MSVCP140.dll__Thrd_detach]
add esp, 8
test eax, eax
je 0x404c86
push 1
call dword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
push 6
mov dword [ebp - 0x18], 0
call dword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00408d54
mov esp, ebp
pop ebp
ret
Function at 0x4056c0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x1c
push ebx
mov ebx, ecx
push esi
push edi
cmp dword [ebx + 0x38], 0
je 0x4056ec
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____thiscall_std::basic_streambuf_char__struct_std::char_traits_char__::xsputn_char_const___long_long___int64__]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov eax, dword [ebx + 0x20]
mov esi, dword [ebp + 0xc]
mov edi, dword [ebp + 0x10]
mov dword [esp + 0x20], esi
mov ecx, dword [eax]
lea eax, [ebx + 0x30]
mov dword [esp + 0x24], edi
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x18], eax
test ecx, ecx
je 0x405714
mov eax, dword [eax]
mov ecx, dword [eax]
jmp 0x40571a
xor ecx, ecx
mov dword [esp + 0x18], eax
mov eax, ecx
cdq
mov dword [esp + 0x10], eax
mov ecx, edx
mov dword [esp + 0x14], ecx
test edi, edi
jl 0x4057a4
jg 0x405731
test esi, esi
je 0x4057a4
test ecx, ecx
jl 0x405787
jg 0x40573b
test eax, eax
je 0x405787
cmp edi, ecx
jg 0x40574f
jl 0x405745
cmp esi, eax
jae 0x40574f
mov eax, esi
mov dword [esp + 0x10], esi
mov dword [esp + 0x14], edi
push eax
push dword [ebp + 8]
push dword [esp + 0x24]
call sub.VCRUNTIME140.dll_memcpy
mov eax, dword [esp + 0x24]
add esp, 0xc
mov ecx, dword [esp + 0x10]
mov edx, dword [ebp + 8]
add edx, ecx
sub esi, ecx
mov eax, dword [eax]
sbb edi, dword [esp + 0x14]
sub dword [eax], ecx
mov eax, dword [ebx + 0x20]
add dword [eax], ecx
test edi, edi
jl 0x4057a4
jg 0x40578a
test esi, esi
je 0x4057a4
jmp 0x40578a
mov edx, dword [ebp + 8]
mov eax, dword [ebx + 0x4c]
test eax, eax
je 0x4057a4
push eax
push esi
push 1
push edx
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
add esp, 0x10
sub esi, eax
sbb edi, 0
mov eax, dword [esp + 0x20]
mov edx, dword [esp + 0x24]
sub eax, esi
sbb edx, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x4057c0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [ebp + 0x10]
push ebx
mov ebx, ecx
mov ecx, dword [ebp + 0xc]
push esi
mov esi, dword [ebp + 8]
mov dword [ebp - 4], esi
test eax, eax
jg 0x4057ec
jl 0x4057e0
test ecx, ecx
jne 0x4057ec
pop esi
xor eax, eax
xor edx, edx
pop ebx
mov esp, ebp
pop ebp
ret 0xc
cmp dword [ebx + 0x38], 0
je 0x405805
push eax
push ecx
push esi
mov ecx, ebx
call dword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____thiscall_std::basic_streambuf_char__struct_std::char_traits_char__::xsgetn_char___long_long___int64__]
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov eax, dword [ebx + 0x1c]
push edi
mov edi, ecx
mov eax, dword [eax]
mov dword [ebp - 8], eax
test eax, eax
je 0x40584d
mov eax, dword [ebx + 0x2c]
lea edx, [ebx + 0x2c]
mov dword [ebp - 0xc], edx
mov eax, dword [eax]
test eax, eax
je 0x405853
cmp eax, ecx
mov esi, ecx
cmovb esi, eax
push esi
push dword [ebp - 8]
push dword [ebp - 4]
call sub.VCRUNTIME140.dll_memcpy
mov eax, dword [ebx + 0x2c]
sub edi, esi
add dword [ebp - 4], esi
add esp, 0xc
sub dword [eax], esi
mov eax, dword [ebx + 0x1c]
add dword [eax], esi
mov esi, dword [ebp - 4]
jmp 0x405853
lea eax, [ebx + 0x2c]
mov dword [ebp - 0xc], eax
cmp dword [ebx + 0x4c], 0
je 0x4058c6
mov ecx, dword [ebx + 0xc]
lea eax, [ebx + 0x3c]
cmp dword [ecx], eax
jne 0x40587c
mov eax, dword [ebx + 0xc]
mov edx, dword [ebx + 0x54]
mov ecx, dword [ebx + 0x50]
sub edx, ecx
mov dword [eax], ecx
mov eax, dword [ebx + 0x1c]
mov dword [eax], ecx
mov eax, dword [ebp - 0xc]
mov eax, dword [eax]
mov dword [eax], edx
mov eax, dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
cmp edi, 0xfff
jbe 0x4058b4
nop dword [eax]
push dword [ebx + 0x4c]
push 0xfff
push 1
push esi
call eax
add esp, 0x10
add esi, eax
sub edi, eax
cmp eax, 0xfff
jne 0x4058c6
cmp edi, eax
mov eax, dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
ja 0x405890
test edi, edi
je 0x4058c6
push dword [ebx + 0x4c]
push edi
push 1
push esi
call eax
add esp, 0x10
sub edi, eax
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 0x10]
sub eax, edi
pop edi
pop esi
sbb edx, 0
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x405c40
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, ecx
cmp ebx, 0xffffffff
jne 0x405c70
pop esi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00408d54
mov esp, ebp
pop ebp
ret 4
mov eax, dword [esi + 0x20]
push edi
mov ecx, dword [eax]
test ecx, ecx
je 0x405cac
mov edx, dword [esi + 0x30]
mov edi, dword [edx]
lea eax, [edi + ecx]
cmp ecx, eax
jae 0x405cac
lea ecx, [edi - 1]
mov eax, ebx
mov dword [edx], ecx
mov edx, dword [esi + 0x20]
pop edi
mov esi, dword [edx]
lea ecx, [esi + 1]
mov dword [edx], ecx
mov byte [esi], bl
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00408d54
mov esp, ebp
pop ebp
ret 4
cmp dword [esi + 0x4c], 0
je 0x405d83
mov edi, dword [esi + 0xc]
lea eax, [esi + 0x3c]
cmp dword [edi], eax
jne 0x405cd4
mov edx, dword [esi + 0x54]
mov ecx, dword [esi + 0x50]
sub edx, ecx
mov dword [edi], ecx
mov eax, dword [esi + 0x1c]
mov dword [eax], ecx
mov eax, dword [esi + 0x2c]
mov dword [eax], edx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x405ce0
movsx eax, bl
jmp 0x405d18
lea eax, [ebp - 0x2c]
mov byte [ebp - 0x25], bl
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x25]
push eax
lea eax, [esi + 0x40]
push eax
call dword [sym.imp.MSVCP140.dll_public:_int___thiscall_std::codecvt_char__char__struct__Mbstatet_::out_struct__Mbstatet___char_const___char_const___char_const____char___char___char___const]
sub eax, 0
je 0x405d42
sub eax, 1
je 0x405d42
sub eax, 2
jne 0x405d83
movsx eax, byte [ebp - 0x25]
push dword [esi + 0x4c]
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
add esp, 8
or ecx, 0xffffffff
cmp eax, ecx
cmove ebx, ecx
pop edi
pop esi
mov eax, ebx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00408d54
mov esp, ebp
pop ebp
ret 4
mov edi, dword [ebp - 0x2c]
lea eax, [ebp - 0x24]
sub edi, eax
je 0x405d60
push dword [esi + 0x4c]
push edi
push 1
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
add esp, 0x10
cmp edi, eax
jne 0x405d83
lea ecx, [ebp - 0x25]
mov byte [esi + 0x3d], 1
or eax, 0xffffffff
cmp dword [ebp - 0x30], ecx
pop edi
pop esi
cmovne eax, ebx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00408d54
mov esp, ebp
pop ebp
ret 4
mov ecx, dword [ebp - 4]
or eax, 0xffffffff
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00408d54
mov esp, ebp
pop ebp
ret 4
Function at 0x406370
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, ecx
cmp dword [esi + 0x38], 0
je 0x40642c
cmp byte [esi + 0x3d], 0
je 0x40642c
mov eax, dword [esi]
push edi
push 0xffffffffffffffff
call dword [eax + 0xc]
cmp eax, 0xffffffff
je 0x40641a
mov ecx, dword [esi + 0x38]
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [esi + 0x40]
push eax
call dword [sym.imp.MSVCP140.dll_public:_int___thiscall_std::codecvt_char__char__struct__Mbstatet_::unshift_struct__Mbstatet___char___char___char___const]
sub eax, 0
je 0x4063e1
sub eax, 1
je 0x4063e5
sub eax, 2
jne 0x40641a
mov byte [esi + 0x3d], al
mov al, 1
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00408d54
mov esp, ebp
pop ebp
ret
mov byte [esi + 0x3d], 0
mov edi, dword [ebp - 0x28]
lea eax, [ebp - 0x24]
sub edi, eax
je 0x406403
push dword [esi + 0x4c]
push edi
push 1
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
add esp, 0x10
cmp edi, eax
jne 0x40641a
cmp byte [esi + 0x3d], 0
pop edi
sete al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00408d54
mov esp, ebp
pop ebp
ret
pop edi
xor al, al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00408d54
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
mov al, 1
xor ecx, ebp
pop esi
call fcn.00408d54
mov esp, ebp
pop ebp
ret