joyce8/EMBER2024-capa huggingface dataset:
Function at 0x401008
Capabilities:
Accept command line arguments

Disassembly:
enter 0x60, 0
lea edi, [0x4c11e4]
sbb dword [ebp - 0x34], 0xffffffec
push edi
push edx
push dword [edi + 0x1c0]
push esi
push dword [edi]
call fcn.004010cc
pop edi
call sub.KERNEL32.dll_GetCommandLineA
call sub.KERNEL32.dll_GetVersion
add esp, 0x60
pop ebp
ret 0xc

Function at 0x401058
Capabilities:
Get keyboard layout
Log keystrokes via polling

Disassembly:
enter 0x54, 0
lea ebx, [edi - 0x50]
and dword [ebx + 0xcc], edi
push ebx
push eax
push eax
push edi
call fcn.00401008
pop ebx
mov ecx, 0
push ecx
call sub.USER32.dll_GetKeyState
mov esi, 0
push esi
call sub.USER32.dll_GetKeyboardLayout
add esp, 0x54
pop ebp
ret 0x10

Function at 0x4010cc
Capabilities:
Log keystrokes via polling

Disassembly:
enter 0x60, 0
mov edx, 0x4c1110
sbb esi, dword [edx - 0xa8]
push edx
push edi
push dword [edx + 0xf4]
push ebx
push eax
call fcn.00401338
pop edx
push edx
push 0
call sub.USER32.dll_GetKeyState
pop edx
push edx
mov edi, 0xfffffff5
push edi
call sub.KERNEL32.dll_GetStdHandle
pop edx
add esp, 0x60
pop ebp
ret 0x10

Function at 0x40121c
Capabilities:
Log keystrokes via polling

Disassembly:
enter 0x58, 0
mov esi, 0x4c11ec
add byte [esi + 0x4c11ec], bh
cmp esi, 0x10d3
jbe 0x40121f
push esi
push ebx
push edi
call fcn.004013b0
pop esi
push 0
call sub.KERNEL32.dll_lstrlenA
push 0
call sub.USER32.dll_GetKeyState
add esp, 0x58
pop ebp
ret 8

Function at 0x401338
Capabilities:
Accept command line arguments

Disassembly:
enter 0x60, 0
lea esi, [edx + 0x64]
xor dword [ebp - 0x18], 0x2d485702
mov ecx, 0
push ecx
call sub.USER32.dll_DestroyMenu
push esi
push dword [esi + 0x15c]
push ecx
push dword [esi + 0x118]
push ecx
call fcn.004011ec
pop esi
call sub.KERNEL32.dll_GetCommandLineA
add esp, 0x60
pop ebp
ret 0x10

Function at 0x401440
Capabilities:
Encode data using xor
Get keyboard layout

Disassembly:
push ebp
sub ebp, ebp
add ebp, esp
sub esp, 0x60
lea esi, [0x4c1018]
sub dword [esi + 0x34], 0x75
push edx
mov ecx, esp
push ecx
push 9
xor dword [esp], 0x73
mov edx, 0x57a
push edx
add dword [esp], 0x3ee
push 0x9e6f5c2a
sub dword [esp], 0x9e234a12
mov ebx, 0xc21345e3
push ebx
push 0x3e2cda6d
pop ebx
xadd dword [esp], ebx
mov ebx, dword [esp]
add esp, 4
mov ebx, dword [ebx]
call ebx
sub esp, 0xfffffffc
mov eax, dword [esp - 4]
xor edx, edx
sbb edx, 0x4c1218
neg edx
mov dword [esi + 0xf0], edx
lea eax, [edx + 0x175]
sub ecx, ecx
add ecx, 0x402579
push 0x568
pop edi
mov ebx, dword [ecx]
add ecx, 3
inc ecx
push ebx
pop dword [eax - 0x175]
add eax, 4
adc dword [ebp - 0xc], 0x4160f555
xor dword [eax - 0x179], 0x9e1374a7
sub dword [eax - 0x179], 0x4eac6723
sub edi, 4
cmp edi, 0
jne 0x4014ba
push 0
call sub.USER32.dll_GetKeyboardLayout
add esp, 0x60
pop ebp
ret 0xc

Function at 0x401540
Capabilities:
Accept command line arguments

Disassembly:
enter 0x34, 0
lea ebx, [0x4c1108]
cmp ebx, 0xd657
jbe 0x401543
add byte [ebp + 0x4c11081d], cl
add byte [ecx + 0xd657fb], al
add byte [esi - 0xf], dh
push ebx
push eax
push esi
call fcn.0040121c
pop ebx
call sub.KERNEL32.dll_GetCommandLineA
call sub.KERNEL32.dll_GetVersion
add esp, 0x34
pop ebp
ret 0xc
Function at 0x40157c
Capabilities:
Suspend thread

Disassembly:
enter 0x30, 0
mov esi, 0x4c1184
xor edi, 0xffffff91
push 0
call sub.KERNEL32.dll_GlobalUnlock
push esi
push dword [esi + 0x144]
push dword [esi + 0x160]
push ebx
call fcn.004012f4
pop esi
mov edi, 0
push edi
call sub.KERNEL32.dll_SuspendThread
add esp, 0x30
pop ebp
ret 8

Function at 0x401724
Capabilities:
Get keyboard layout
Log keystrokes via polling

Disassembly:
enter 0x48, 0
lea edx, [0x4c1198]
adc esi, dword [ebp - 0x3c]
push edx
push dword [edx + 0xfc]
push dword [edx + 0x174]
call fcn.00401610
pop edx
push edx
push 0
call sub.USER32.dll_GetKeyState
pop edx
push edx
push 0
call sub.USER32.dll_GetKeyboardLayout
pop edx
add esp, 0x48
pop ebp
ret 0xc

Function at 0x4017cc
Capabilities:
Suspend thread

Disassembly:
enter 0x40, 0
lea ecx, [ebx + 0xa0]
or esi, dword [ecx - 0x108]
push ecx
mov edi, 0
push edi
call sub.KERNEL32.dll_CloseHandle
pop ecx
push ecx
push dword [ecx + 0x118]
push dword [ecx + 0xb4]
push esi
call fcn.004016ec
pop ecx
push ecx
push 0
call sub.KERNEL32.dll_SuspendThread
pop ecx
add esp, 0x40
pop ebp
ret 0x10

Function at 0x401854
Capabilities:
Log keystrokes via polling

Disassembly:
enter 0x34, 0
lea esi, [0x4c10b4]
and dword [esi - 0x48], edx
call sub.KERNEL32.dll_GetSystemDefaultLangID
push esi
push ecx
push dword [esi + 0x1c]
push dword [esi + 0x58]
push dword [esi + 0x1c0]
call fcn.00401264
pop esi
push 0
call sub.USER32.dll_GetKeyState
add esp, 0x34
pop ebp
ret 0xc

Function at 0x401970
Capabilities:
Get keyboard layout

Disassembly:
enter 0x4c, 0
lea ecx, [0x4c113c]
and edx, 0x2e
push ecx
push dword [ecx + 0x9c]
push dword [ecx + 0x80]
push dword [ecx + 0x148]
push dword [ecx + 0x170]
call fcn.004016a0
pop ecx
push ecx
mov eax, 0
push eax
call sub.USER32.dll_GetKeyboardLayout
pop ecx
push ecx
push 0xfffffffffffffff5
call sub.KERNEL32.dll_GetStdHandle
pop ecx
add esp, 0x4c
pop ebp
ret 0x10

Function at 0x4019bc
Capabilities:
Accept command line arguments

Disassembly:
enter 0x40, 0
lea eax, [0x4c1134]
sub dword [ebp - 0x40], ebx
push eax
call sub.KERNEL32.dll_GetCommandLineA
pop eax
push eax
push esi
push esi
push esi
call fcn.00401818
pop eax
push eax
call sub.KERNEL32.dll_GetTickCount
pop eax
add esp, 0x40
pop ebp
ret 8

Function at 0x4019e8
Capabilities:
Accept command line arguments
Suspend thread

Disassembly:
enter 0x30, 0
lea edi, [ecx - 0x70]
or ecx, edi
push edi
push eax
push dword [edi + 0x40]
push eax
push dword [edi + 0x40]
call fcn.00401058
pop edi
call sub.KERNEL32.dll_GetCommandLineA
mov esi, 0
push esi
call sub.KERNEL32.dll_SuspendThread
add esp, 0x30
pop ebp
ret 0xc

Function at 0x401a58
Capabilities:
Suspend thread

Disassembly:
enter 0x60, 0
mov esi, 0x4c1154
sub dword [ebp - 0x40], 0x2e590375
push esi
push eax
push dword [esi + 0xc0]
call fcn.0040179c
pop esi
push 0
call sub.KERNEL32.dll_SuspendThread
call sub.KERNEL32.dll_GetVersion
add esp, 0x60
pop ebp
ret 8
Function at 0x4012c0
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
push ecx
shl ecx, 0xa
add ecx, edx
cmp byte [0x40c388], 0
je 0x40131a
push esi
push ecx
call fcn.00406c21
add esp, 4
mov dword [ebp - 4], 2
cmp byte [0x40c388], 0
mov esi, eax
lea eax, [ebp - 4]
push eax
push 0x40
push 0x400
push esi
je 0x401307
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret
push dword [0x40c38c]
call dword [sym.imp.KERNEL32.dll_VirtualProtectEx]
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret
push 0x40
push 0x1000
push ecx
push 0
push dword [0x40c38c]
call dword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov esp, ebp
pop ebp
ret
Function at 0x4015a0
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, ecx
mov edx, edi
lea ecx, [edx + 1]
nop
mov al, byte [edx]
inc edx
test al, al
jne 0x4015b0
sub edx, ecx
xor ecx, ecx
lea ebx, [edx + 1]
mov edx, ebx
call fcn.004012c0
cmp byte [0x40c388], 0
mov esi, eax
je 0x4015f6
lea eax, [ebp - 4]
mov dword [ebp - 4], 2
push eax
push 0x40
push 0x400
push esi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
push ebx
push edi
push esi
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
jmp 0x401607
push 0
push ebx
push edi
push esi
push dword [0x40c38c]
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov edx, 0x1c
xor ecx, ecx
call fcn.004012c0
mov edi, eax
mov dword [0x40bb5d], esi
mov edx, 0x18
mov dword [0x40bb62], edi
mov ecx, 0x40bb5c
call fcn.00401340
cmp byte [0x40c388], 0
je 0x40164d
push 0
push esi
call fcn.00406bf0
add esp, 8
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 0x8000
push 0
push esi
push dword [0x40c38c]
call dword [sym.imp.KERNEL32.dll_VirtualFreeEx]
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x401800
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [0x40b040]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push esi
push dword [ebp + 0xc]
mov esi, ecx
push eax
mov byte [esi], 0
mov dword [esi + 0x44], 0
mov dword [esi + 0x48], 0
mov dword [esi + 0x4c], 0x67452301
mov dword [esi + 0x50], 0xefcdab89
mov dword [esi + 0x54], 0x98badcfe
mov dword [esi + 0x58], 0x10325476
call fcn.00402040
cmp byte [esi], 0
jne 0x401913
xor ecx, ecx
lea edx, [esi + 0x46]
nop word [eax + eax]
movzx eax, byte [edx - 2]
lea edx, [edx + 4]
mov byte [ebp + ecx - 0xc], al
movzx eax, byte [edx - 5]
mov byte [ebp + ecx - 0xb], al
movzx eax, byte [edx - 4]
mov byte [ebp + ecx - 0xa], al
movzx eax, byte [edx - 3]
mov byte [ebp + ecx - 9], al
add ecx, 4
cmp ecx, 8
jb 0x401860
mov edx, dword [esi + 0x44]
mov ecx, 0x78
shr edx, 3
mov eax, 0x38
and edx, 0x3f
sub ecx, edx
sub eax, edx
cmp edx, 0x38
push edi
cmovae eax, ecx
mov ecx, esi
push eax
push 0x40bd90
call fcn.00402040
push 8
lea eax, [ebp - 0xc]
mov ecx, esi
push eax
call fcn.00402040
lea edx, [esi + 0x5e]
mov edi, 4
lea eax, [esi + 0x4e]
nop
movzx ecx, byte [eax - 2]
lea eax, [eax + 4]
mov byte [edx - 2], cl
lea edx, [edx + 4]
movzx ecx, byte [eax - 5]
mov byte [edx - 5], cl
movzx ecx, byte [eax - 4]
mov byte [edx - 4], cl
movzx ecx, byte [eax - 3]
mov byte [edx - 3], cl
sub edi, 1
jne 0x4018d0
pop edi
push 0x40
lea ecx, [esi + 1]
push 0
push ecx
call sub.VCRUNTIME140.dll_memset
xorps xmm0, xmm0
add esp, 0xc
movq qword [esi + 0x44], xmm0
mov byte [esi], 1
mov ecx, dword [ebp - 4]
mov eax, esi
xor ecx, ebp
pop esi
call fcn.00406bb2
mov esp, ebp
pop ebp
ret 8
Function at 0x4021e0
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov edx, dword [0x40c390]
mov eax, dword [0x40c394]
push esi
mov esi, ecx
mov dword [0x40bd6c], edx
push edi
lea edi, [edx + 0x600]
mov dword [ebp - 0xc], ecx
mov dword [0x40bd55], edi
mov dword [0x40bd5a], eax
lea edx, [esi + 1]
mov al, byte [esi]
inc esi
test al, al
jne 0x402212
sub esi, edx
cmp byte [0x40c388], al
je 0x40224b
lea eax, [ebp - 8]
mov dword [ebp - 8], 2
push eax
push 0x40
push 0x400
push edi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
push esi
push dword [ebp - 0xc]
push edi
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
jmp 0x40225c
push 0
push esi
push ecx
push edi
push dword [0x40c38c]
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov eax, dword [0x40c390]
add eax, 0x600
mov byte [ebp - 4], 0
add esi, eax
cmp byte [0x40c388], 0
je 0x402295
lea eax, [ebp - 0xc]
mov dword [ebp - 0xc], 2
push eax
push 0x40
push 0x400
push esi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov al, byte [ebp - 4]
mov byte [esi], al
jmp 0x4022aa
push 0
push 1
lea eax, [ebp - 4]
push eax
push esi
push dword [0x40c38c]
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov edx, 0x1d
mov ecx, 0x40bd54
call fcn.00401340
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x4026a0
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
mov eax, dword [0x40b040]
xor eax, ebp
mov dword [ebp - 4], eax
cmp byte [0x40c388], 0
push ebx
push esi
mov esi, dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov ebx, ecx
push edi
mov edi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov byte [ebp - 0x30], 0xeb
je 0x4026f1
lea eax, [ebp - 0x38]
mov dword [ebp - 0x38], 2
push eax
push 0x40
push 0x400
push 0x4638c4
call edi
mov al, byte [ebp - 0x30]
mov byte [0x4638c4], al
jmp 0x402706
push 0
push 1
lea eax, [ebp - 0x30]
push eax
push 0x4638c4
push dword [0x40c38c]
call esi
cmp byte [0x40c388], 0
mov byte [ebp - 0x34], 0x15
je 0x402736
lea eax, [ebp - 0x38]
mov dword [ebp - 0x38], 2
push eax
push 0x40
push 0x400
push 0x4638c5
call edi
mov al, byte [ebp - 0x34]
mov byte [0x4638c5], al
jmp 0x40274b
push 0
push 1
lea eax, [ebp - 0x34]
push eax
push 0x4638c5
push dword [0x40c38c]
call esi
cmp byte [0x40c388], 0
mov byte [ebp - 0x30], 0x90
je 0x40277b
lea eax, [ebp - 0x38]
mov dword [ebp - 0x38], 2
push eax
push 0x40
push 0x400
push 0x4638c6
call edi
mov al, byte [ebp - 0x30]
mov byte [0x4638c6], al
jmp 0x402790
push 0
push 1
lea eax, [ebp - 0x30]
push eax
push 0x4638c6
push dword [0x40c38c]
call esi
cmp byte [0x40c388], 0
mov byte [ebp - 0x34], 0x90
je 0x4027c0
lea eax, [ebp - 0x38]
mov dword [ebp - 0x38], 2
push eax
push 0x40
push 0x400
push 0x4638c7
call edi
mov al, byte [ebp - 0x34]
mov byte [0x4638c7], al
jmp 0x4027d5
push 0
push 1
lea eax, [ebp - 0x34]
push eax
push 0x4638c7
push dword [0x40c38c]
call esi
cmp byte [0x40c388], 0
mov byte [ebp - 0x30], 0x90
je 0x402805
lea eax, [ebp - 0x38]
mov dword [ebp - 0x38], 2
push eax
push 0x40
push 0x400
push 0x4638c8
call edi
mov al, byte [ebp - 0x30]
mov byte [0x4638c8], al
jmp 0x40281a
push 0
push 1
lea eax, [ebp - 0x30]
push eax
push 0x4638c8
push dword [0x40c38c]
call esi
mov ecx, str.onDrawPlantReanim
call fcn.004021e0
mov ecx, eax
mov dword [ebx + 4], 0x4638db
sar eax, 8
mov byte [ebp - 0x1e], al
mov eax, ecx
sar eax, 0x10
mov byte [ebp - 0x1f], cl
shr ecx, 0x18
mov byte [ebp - 0x1d], al
lea eax, [ebp - 0x2c]
push 0x25
mov byte [ebp - 0x1c], cl
mov ecx, ebx
push eax
mov dword [ebx], 5
mov dword [ebp - 0x2c], 0x2474ff53
mov dword [ebp - 0x28], 0x2e82c
mov dword [ebp - 0x24], 0x6eb0000
mov byte [ebp - 0x20], 0x68
mov dword [ebp - 0x1b], 0x8c483c3
mov dword [ebp - 0x17], 0x2e861
mov dword [ebp - 0x13], 0x6eb0000
mov dword [ebp - 0xf], 0x473ae068
mov dword [ebp - 0xb], 0x6ebc300
call fcn.00402360
mov ecx, dword [ebp - 4]
mov eax, ebx
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00406bb2
mov esp, ebp
pop ebp
ret
Function at 0x402ea0
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
mov eax, dword [0x40b040]
xor eax, ebp
mov dword [ebp - 4], eax
cmp byte [0x40c388], 0
push ebx
push esi
mov esi, dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov ebx, ecx
push edi
mov edi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov byte [ebp - 0x28], 0xeb
je 0x402ef1
lea eax, [ebp - 0x30]
mov dword [ebp - 0x30], 2
push eax
push 0x40
push 0x400
push 0x46cbbf
call edi
mov al, byte [ebp - 0x28]
mov byte [0x46cbbf], al
jmp 0x402f06
push 0
push 1
lea eax, [ebp - 0x28]
push eax
push 0x46cbbf
push dword [0x40c38c]
call esi
cmp byte [0x40c388], 0
mov byte [ebp - 0x2c], 0x63
je 0x402f36
lea eax, [ebp - 0x30]
mov dword [ebp - 0x30], 2
push eax
push 0x40
push 0x400
push 0x46cbc0
call edi
mov al, byte [ebp - 0x2c]
mov byte [0x46cbc0], al
jmp 0x402f4b
push 0
push 1
lea eax, [ebp - 0x2c]
push eax
push 0x46cbc0
push dword [0x40c38c]
call esi
cmp byte [0x40c388], 0
mov byte [ebp - 0x28], 0xeb
je 0x402f7b
lea eax, [ebp - 0x30]
mov dword [ebp - 0x30], 2
push eax
push 0x40
push 0x400
push 0x46cc18
call edi
mov al, byte [ebp - 0x28]
mov byte [0x46cc18], al
jmp 0x402f90
push 0
push 1
lea eax, [ebp - 0x28]
push eax
push 0x46cc18
push dword [0x40c38c]
call esi
cmp byte [0x40c388], 0
mov byte [ebp - 0x2c], 0xa
je 0x402fc0
lea eax, [ebp - 0x30]
mov dword [ebp - 0x30], 2
push eax
push 0x40
push 0x400
push 0x46cc19
call edi
mov al, byte [ebp - 0x2c]
mov byte [0x46cc19], al
jmp 0x402fd5
push 0
push 1
lea eax, [ebp - 0x2c]
push eax
push 0x46cc19
push dword [0x40c38c]
call esi
mov ecx, str.onProjectileHitPlant
call fcn.004021e0
mov ecx, eax
mov dword [ebx + 4], 0x46cc28
sar eax, 8
mov byte [ebp - 0x12], al
mov eax, ecx
sar eax, 0x10
mov byte [ebp - 0x13], cl
shr ecx, 0x18
mov byte [ebp - 0x11], al
lea eax, [ebp - 0x24]
push 0x1d
mov byte [ebp - 0x10], cl
mov ecx, ebx
push eax
mov dword [ebx], 6
mov dword [ebp - 0x24], 0x3d
mov dword [ebp - 0x20], 0x50167400
mov dword [ebp - 0x1c], 0x2e855
mov dword [ebp - 0x18], 0x6eb0000
mov byte [ebp - 0x14], 0x68
mov dword [ebp - 0xf], 0x8c483c3
mov dword [ebp - 0xb], 0x1c244489
call fcn.00402360
mov ecx, dword [ebp - 4]
mov eax, ebx
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00406bb2
mov esp, ebp
pop ebp
ret
Function at 0x405a30
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x1c
push ebx
mov ebx, ecx
push esi
push edi
cmp dword [ebx + 0x38], 0
je 0x405a5c
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____thiscall_std::basic_streambuf_char__struct_std::char_traits_char__::xsputn_char_const___long_long___int64__]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov eax, dword [ebx + 0x20]
mov esi, dword [ebp + 0xc]
mov edi, dword [ebp + 0x10]
mov dword [esp + 0x20], esi
mov ecx, dword [eax]
lea eax, [ebx + 0x30]
mov dword [esp + 0x24], edi
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x18], eax
test ecx, ecx
je 0x405a84
mov eax, dword [eax]
mov ecx, dword [eax]
jmp 0x405a8a
xor ecx, ecx
mov dword [esp + 0x18], eax
mov eax, ecx
cdq
mov dword [esp + 0x10], eax
mov ecx, edx
mov dword [esp + 0x14], ecx
test edi, edi
jl 0x405af2
jg 0x405aa1
test esi, esi
je 0x405af2
test ecx, ecx
jl 0x405aed
jg 0x405aab
test eax, eax
je 0x405aed
cmp edi, ecx
jg 0x405abf
jl 0x405ab5
cmp esi, eax
jae 0x405abf
mov eax, esi
mov dword [esp + 0x10], esi
mov dword [esp + 0x14], edi
push eax
push dword [ebp + 8]
push dword [esp + 0x24]
call sub.VCRUNTIME140.dll_memcpy
mov eax, dword [esp + 0x24]
add esp, 0xc
mov edx, dword [esp + 0x10]
mov ecx, dword [ebp + 8]
add ecx, edx
sub esi, edx
mov eax, dword [eax]
sbb edi, dword [esp + 0x14]
sub dword [eax], edx
mov eax, dword [ebx + 0x20]
add dword [eax], edx
jmp 0x405af5
mov ecx, dword [ebp + 8]
jmp 0x405aff
mov ecx, dword [ebp + 8]
test edi, edi
jl 0x405b19
jg 0x405aff
test esi, esi
je 0x405b19
mov eax, dword [ebx + 0x4c]
test eax, eax
je 0x405b19
push eax
push esi
push 1
push ecx
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
add esp, 0x10
sub esi, eax
sbb edi, 0
mov eax, dword [esp + 0x20]
mov edx, dword [esp + 0x24]
sub eax, esi
sbb edx, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x405b30
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0x10]
sub esp, 8
push ebx
mov ebx, ecx
mov ecx, dword [ebp + 0xc]
test eax, eax
jg 0x405b54
jl 0x405b49
test ecx, ecx
jne 0x405b54
xor eax, eax
xor edx, edx
pop ebx
mov esp, ebp
pop ebp
ret 0xc
cmp dword [ebx + 0x38], 0
je 0x405b6e
push eax
push ecx
push dword [ebp + 8]
mov ecx, ebx
call dword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____thiscall_std::basic_streambuf_char__struct_std::char_traits_char__::xsgetn_char___long_long___int64__]
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov eax, dword [ebx + 0x1c]
push esi
push edi
mov edi, ecx
mov eax, dword [eax]
mov dword [ebp - 8], eax
test eax, eax
je 0x405bba
mov eax, dword [ebx + 0x2c]
lea edx, [ebx + 0x2c]
mov dword [ebp - 4], edx
mov eax, dword [eax]
test eax, eax
je 0x405bc0
mov edi, dword [ebp + 8]
cmp eax, ecx
mov esi, ecx
cmovb esi, eax
push esi
push dword [ebp - 8]
push edi
call sub.VCRUNTIME140.dll_memcpy
mov eax, dword [ebx + 0x2c]
add edi, esi
mov dword [ebp + 8], edi
add esp, 0xc
mov edi, dword [ebp + 0xc]
sub edi, esi
sub dword [eax], esi
mov eax, dword [ebx + 0x1c]
add dword [eax], esi
jmp 0x405bc0
lea eax, [ebx + 0x2c]
mov dword [ebp - 4], eax
cmp dword [ebx + 0x4c], 0
mov esi, dword [ebp + 8]
je 0x405c36
mov ecx, dword [ebx + 0xc]
lea eax, [ebx + 0x3c]
cmp dword [ecx], eax
jne 0x405bec
mov eax, dword [ebx + 0xc]
mov edx, dword [ebx + 0x54]
mov ecx, dword [ebx + 0x50]
sub edx, ecx
mov dword [eax], ecx
mov eax, dword [ebx + 0x1c]
mov dword [eax], ecx
mov eax, dword [ebp - 4]
mov eax, dword [eax]
mov dword [eax], edx
mov eax, dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
cmp edi, 0xfff
jbe 0x405c24
nop dword [eax]
push dword [ebx + 0x4c]
push 0xfff
push 1
push esi
call eax
add esp, 0x10
add esi, eax
sub edi, eax
cmp eax, 0xfff
jne 0x405c36
cmp edi, eax
mov eax, dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
ja 0x405c00
test edi, edi
je 0x405c36
push dword [ebx + 0x4c]
push edi
push 1
push esi
call eax
add esp, 0x10
sub edi, eax
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 0x10]
sub eax, edi
pop edi
pop esi
sbb edx, 0
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x405fb0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
mov eax, dword [0x40b040]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, ecx
cmp ebx, 0xffffffff
jne 0x405fe0
pop esi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00406bb2
mov esp, ebp
pop ebp
ret 4
mov eax, dword [esi + 0x20]
push edi
mov ecx, dword [eax]
test ecx, ecx
je 0x40601c
mov edx, dword [esi + 0x30]
mov edi, dword [edx]
lea eax, [edi + ecx]
cmp ecx, eax
jae 0x40601c
lea ecx, [edi - 1]
mov eax, ebx
mov dword [edx], ecx
mov edx, dword [esi + 0x20]
pop edi
mov esi, dword [edx]
lea ecx, [esi + 1]
mov dword [edx], ecx
mov byte [esi], bl
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00406bb2
mov esp, ebp
pop ebp
ret 4
cmp dword [esi + 0x4c], 0
je 0x4060f3
mov edi, dword [esi + 0xc]
lea eax, [esi + 0x3c]
cmp dword [edi], eax
jne 0x406044
mov edx, dword [esi + 0x54]
mov ecx, dword [esi + 0x50]
sub edx, ecx
mov dword [edi], ecx
mov eax, dword [esi + 0x1c]
mov dword [eax], ecx
mov eax, dword [esi + 0x2c]
mov dword [eax], edx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x406050
movsx eax, bl
jmp 0x406088
lea eax, [ebp - 0x2c]
mov byte [ebp - 0x25], bl
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x25]
push eax
lea eax, [esi + 0x40]
push eax
call dword [sym.imp.MSVCP140.dll_public:_int___thiscall_std::codecvt_char__char__struct__Mbstatet_::out_struct__Mbstatet___char_const___char_const___char_const____char___char___char___const]
sub eax, 0
je 0x4060b2
sub eax, 1
je 0x4060b2
sub eax, 2
jne 0x4060f3
movsx eax, byte [ebp - 0x25]
push dword [esi + 0x4c]
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
add esp, 8
or ecx, 0xffffffff
cmp eax, ecx
cmove ebx, ecx
pop edi
pop esi
mov eax, ebx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00406bb2
mov esp, ebp
pop ebp
ret 4
mov edi, dword [ebp - 0x2c]
lea eax, [ebp - 0x24]
sub edi, eax
je 0x4060d0
push dword [esi + 0x4c]
push edi
push 1
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
add esp, 0x10
cmp edi, eax
jne 0x4060f3
lea ecx, [ebp - 0x25]
mov byte [esi + 0x3d], 1
or eax, 0xffffffff
cmp dword [ebp - 0x30], ecx
pop edi
pop esi
cmovne eax, ebx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00406bb2
mov esp, ebp
pop ebp
ret 4
mov ecx, dword [ebp - 4]
or eax, 0xffffffff
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00406bb2
mov esp, ebp
pop ebp
ret 4