joyce8/EMBER2024-capa huggingface dataset:
Function at 0x6d91e2c0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov ecx, dword [0x6da20954]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x6d91e453
sub esp, 0x24
mov eax, dword [esp + 0x28]
test byte [eax], al
lea ecx, [eax + 0x18]
mov dword [esp + 0x20], ecx
nop
mov dword [esp], ecx
call fcn.6d8ca5a0
mov eax, dword [esp + 0x28]
movzx ecx, byte [eax + 0x1c]
test cl, cl
jne 0x6d91e43c
mov byte [eax + 0x1c], 1
inc dword [eax + 0x24]
inc dword [eax + 0x60]
mov dword [esp], eax
call fcn.6d8f0090
mov dword [esp + 0x14], 0
mov eax, dword [esp + 0x28]
mov dword [esp], eax
mov dword [esp + 4], 0x72
mov byte [esp + 8], 0
lea ecx, [esp + 0x14]
mov dword [esp + 0xc], ecx
call fcn.6d8f0770
mov eax, dword [esp + 0x10]
mov dword [esp + 0x1c], eax
mov ecx, dword [esp + 0x28]
mov dword [esp], ecx
mov dword [esp + 4], 0x77
mov byte [esp + 8], 0
lea edx, [esp + 0x14]
mov dword [esp + 0xc], edx
call fcn.6d8f0770
mov eax, dword [esp + 0x28]
mov ecx, dword [eax + 0x3c]
mov edx, dword [esp + 0x10]
mov dword [esp + 0x18], edx
test ecx, ecx
je 0x6d91e3a8
lea ecx, [eax + 0x28]
mov dword [esp], ecx
call fcn.6d910a90
mov eax, dword [0x6da209f0]
test eax, eax
jne 0x6d91e38f
mov eax, dword [esp + 0x28]
jmp 0x6d91e39d
mov eax, dword [esp + 0x28]
mov ecx, dword [eax + 0x3c]
call fcn.6d921280
mov dword [edi], ecx
mov dword [eax + 0x3c], 0
mov edx, dword [esp + 0x18]
mov ecx, dword [eax + 0x78]
test ecx, ecx
je 0x6d91e3df
lea ecx, [eax + 0x64]
mov dword [esp], ecx
call fcn.6d910a90
mov eax, dword [0x6da209f0]
test eax, eax
jne 0x6d91e3ca
mov eax, dword [esp + 0x28]
jmp 0x6d91e3d8
mov eax, dword [esp + 0x28]
mov ecx, dword [eax + 0x78]
call fcn.6d921280
mov dword [edi], ecx
mov dword [eax + 0x78], 0
nop
nop
mov eax, dword [esp + 0x20]
mov dword [esp], eax
call fcn.6d8ca7c0
mov eax, dword [esp + 0x1c]
test eax, eax
je 0x6d91e405
mov dword [esp], eax
mov dword [esp + 4], 3
call fcn.6d8f0570
mov eax, dword [esp + 0x18]
test eax, eax
je 0x6d91e41d
mov dword [esp], eax
mov dword [esp + 4], 3
call fcn.6d8f0570
mov eax, dword [esp + 0x14]
test eax, eax
je 0x6d91e438
nop
lea ecx, [0x6da208c0]
mov dword [esp], ecx
mov dword [esp + 4], eax
call fcn.6d8c2be0
add esp, 0x24
ret
lea eax, [0x6d96a934]
mov dword [esp], eax
mov dword [esp + 4], 0x24
call fcn.6d8f4f30
nop
call fcn.6d91fe70
jmp fcn.6d91e2c0
Function at 0x6d921120
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
movd xmm0, dword [esp + 8]
pinsrw xmm0, ebx, 4
pshufhw xmm0, xmm0, 0
movdqa xmm1, xmm0
pxor xmm0, xmmword [0x6da20b60]
aesenc xmm0, xmm0
cmp ebx, 0x10
jb 0x6d91f8cb
je 0x6d91f91e
cmp ebx, 0x20
jbe 0x6d91f924
cmp ebx, 0x40
jbe 0x6d91f96a
jmp 0x6d91fa0b
test ebx, ebx
je 0x6d91f914
add eax, 0x10
test ax, 0xff0
je 0x6d91f900
movdqu xmm1, xmmword [eax - 0x10]
add ebx, ebx
pand xmm1, xmmword [ebx*8 + 0x6d982c60]
pxor xmm1, xmm0
aesenc xmm1, xmm1
aesenc xmm1, xmm1
aesenc xmm1, xmm1
movd dword [edx], xmm1
ret
movdqu xmm1, xmmword [eax + ebx - 0x20]
add ebx, ebx
pshufb xmm1, xmmword [ebx*8 + 0x6d982d60]
jmp 0x6d91f8e8
aesenc xmm0, xmm0
movd dword [edx], xmm0
ret
movdqu xmm1, xmmword [eax]
jmp 0x6d91f8e8
pxor xmm1, xmmword [0x6da20b70]
aesenc xmm1, xmm1
movdqu xmm2, xmmword [eax]
movdqu xmm3, xmmword [eax + ebx - 0x10]
pxor xmm2, xmm0
pxor xmm3, xmm1
aesenc xmm2, xmm2
aesenc xmm3, xmm3
aesenc xmm2, xmm2
aesenc xmm3, xmm3
aesenc xmm2, xmm2
aesenc xmm3, xmm3
pxor xmm2, xmm3
movd dword [edx], xmm2
ret
movdqa xmm2, xmm1
movdqa xmm3, xmm1
pxor xmm1, xmmword [0x6da20b70]
pxor xmm2, xmmword [0x6da20b80]
pxor xmm3, xmmword [0x6da20b90]
aesenc xmm1, xmm1
aesenc xmm2, xmm2
aesenc xmm3, xmm3
movdqu xmm4, xmmword [eax]
movdqu xmm5, xmmword [eax + 0x10]
movdqu xmm6, xmmword [eax + ebx - 0x20]
movdqu xmm7, xmmword [eax + ebx - 0x10]
pxor xmm4, xmm0
pxor xmm5, xmm1
pxor xmm6, xmm2
pxor xmm7, xmm3
aesenc xmm4, xmm4
aesenc xmm5, xmm5
aesenc xmm6, xmm6
aesenc xmm7, xmm7
aesenc xmm4, xmm4
aesenc xmm5, xmm5
aesenc xmm6, xmm6
aesenc xmm7, xmm7
aesenc xmm4, xmm4
aesenc xmm5, xmm5
aesenc xmm6, xmm6
aesenc xmm7, xmm7
pxor xmm4, xmm6
pxor xmm5, xmm7
pxor xmm4, xmm5
movd dword [edx], xmm4
ret
movdqa xmm2, xmm1
movdqa xmm3, xmm1
pxor xmm1, xmmword [0x6da20b70]
pxor xmm2, xmmword [0x6da20b80]
pxor xmm3, xmmword [0x6da20b90]
aesenc xmm1, xmm1
aesenc xmm2, xmm2
aesenc xmm3, xmm3
movdqu xmm4, xmmword [eax + ebx - 0x40]
movdqu xmm5, xmmword [eax + ebx - 0x30]
movdqu xmm6, xmmword [eax + ebx - 0x20]
movdqu xmm7, xmmword [eax + ebx - 0x10]
aesenc xmm4, xmm0
aesenc xmm5, xmm1
aesenc xmm6, xmm2
aesenc xmm7, xmm3
dec ebx
shr ebx, 6
movdqu xmm0, xmmword [eax]
movdqu xmm1, xmmword [eax + 0x10]
movdqu xmm2, xmmword [eax + 0x20]
movdqu xmm3, xmmword [eax + 0x30]
aesenc xmm4, xmm0
aesenc xmm5, xmm1
aesenc xmm6, xmm2
aesenc xmm7, xmm3
aesenc xmm4, xmm4
aesenc xmm5, xmm5
aesenc xmm6, xmm6
aesenc xmm7, xmm7
add eax, 0x40
dec ebx
jne 0x6d91fa6a
aesenc xmm4, xmm4
aesenc xmm5, xmm5
aesenc xmm6, xmm6
aesenc xmm7, xmm7
aesenc xmm4, xmm4
aesenc xmm5, xmm5
aesenc xmm6, xmm6
aesenc xmm7, xmm7
aesenc xmm4, xmm4
aesenc xmm5, xmm5
aesenc xmm6, xmm6
aesenc xmm7, xmm7
pxor xmm4, xmm6
pxor xmm5, xmm7
pxor xmm4, xmm5
movd dword [edx], xmm4
ret
cmp byte [0x6da20847], 0
je 0x6d92113a
mov eax, dword [esp + 4]
mov ebx, dword [esp + 0xc]
lea edx, [esp + 0x10]
jmp 0x6d91f890
jmp fcn.6d8c9240
Function at 0x6d92f180
Capabilities:
Hash data using sha224
Hash data using sha256

Disassembly:
mov ecx, dword [0x6da20954]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x6d92f226
mov eax, dword [esp + 4]
movzx ecx, byte [eax + 0x6c]
test cl, cl
je 0x6d92f1d9
mov dword [eax], 0xc1059ed8
mov dword [eax + 4], 0x367cd507
mov dword [eax + 8], 0x3070dd17
mov dword [eax + 0xc], 0xf70e5939
mov dword [eax + 0x10], 0xffc00b31
mov dword [eax + 0x14], 0x68581511
mov dword [eax + 0x18], 0x64f98fa7
mov dword [eax + 0x1c], 0xbefa4fa4
jmp 0x6d92f210
mov dword [eax], 0x6a09e667
mov dword [eax + 4], 0xbb67ae85
mov dword [eax + 8], 0x3c6ef372
mov dword [eax + 0xc], 0xa54ff53a
mov dword [eax + 0x10], 0x510e527f
mov dword [eax + 0x14], 0x9b05688c
mov dword [eax + 0x18], 0x1f83d9ab
mov dword [eax + 0x1c], 0x5be0cd19
mov dword [eax + 0x60], 0
mov dword [eax + 0x64], 0
mov dword [eax + 0x68], 0
ret
call fcn.6d91fe70
jmp fcn.6d92f180
Function at 0x6d93ad90
Capabilities:
Enumerate pe sections

Disassembly:
mov ecx, dword [0x6da20954]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x6d93af7a
sub esp, 0x48
mov eax, dword [0x6d94bd04]
mov ecx, dword [esp + 0x50]
movzx edx, word [ecx + 2]
movzx ebx, word [ecx + 8]
movzx ebp, word [ecx + 0xa]
movzx esi, word [ecx + 0xc]
mov edi, dword [esp + 0x4c]
mov dword [esp], edi
mov dword [esp + 4], edx
mov dword [esp + 8], 1
mov dword [esp + 0xc], ebx
mov dword [esp + 0x10], ebp
mov dword [esp + 0x14], esi
mov dword [esp + 0x18], 0
mov dword [esp + 0x1c], eax
call fcn.6d937a70
lea edi, [esp + 0x34]
lea esi, [esp + 0x20]
call fcn.6d92195e
lea edi, [esp]
lea esi, [esp + 0x34]
call fcn.6d92195e
call fcn.6d937260
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x18]
add eax, 0x15180
mov dword [esp], eax
adc ecx, 0
mov dword [esp + 4], ecx
mov dword [esp + 8], 0x93a80
mov dword [esp + 0xc], 0
call fcn.6d91c4e0
mov eax, dword [esp + 0x50]
movzx ecx, word [eax + 4]
mov edx, dword [esp + 0x10]
mov ebx, eax
mov eax, 0xc22e4507
mov ebp, edx
imul edx
mov eax, ebp
sar ebp, 0x1f
add eax, edx
sar eax, 0x10
sub eax, ebp
sub ecx, eax
test ecx, ecx
jge 0x6d93ae67
add ecx, 7
movzx edx, word [ebx + 6]
lea ebp, [edx - 1]
cmp ebp, 4
jge 0x6d93ae81
lea ebx, [edx + edx*2]
lea edx, [edx + ebx*2]
lea ecx, [ecx + edx - 6]
mov edx, ecx
jmp 0x6d93aef8
movzx eax, word [ebx + 2]
cmp eax, 2
jne 0x6d93aece
mov edx, dword [esp + 0x4c]
test edx, 3
jne 0x6d93aeca
mov ebx, edx
sar edx, 0x1f
mov ebp, eax
mov eax, 0x51eb851f
mov esi, edx
imul ebx
mov edi, edx
sar edx, 5
sub edx, esi
imul edx, edx, 0x64
cmp ebx, edx
jne 0x6d93aec3
sar edi, 7
sub edi, esi
imul edx, edi, 0x190
cmp ebx, edx
jne 0x6d93aed0
mov ebx, 0x1d
jmp 0x6d93aeee
mov ebp, eax
jmp 0x6d93aed0
mov ebp, eax
cmp ebp, 0xd
jae 0x6d93af6d
lea eax, [ebp - 1]
lea edx, [0x6d948460]
mov ebx, dword [edx + ebp*4]
cmp eax, 0xd
jae 0x6d93af63
sub ebx, dword [edx + ebp*4 - 4]
lea edx, [ecx + 0x1d]
cmp ebx, edx
jge 0x6d93aef8
lea edx, [ecx + 0x16]
mov ecx, dword [esp + 0x38]
test ecx, 0x80000000
je 0x6d93af2a
mov ebx, dword [esp + 0x34]
shl ecx, 1
mov ebp, ebx
shl ebx, 1
shr ebp, 0x1f
or ebp, ecx
mov ecx, ebp
shl ebp, 1
shr ecx, 0x1f
shr ebx, 0x1f
or ebp, ebx
add ebp, 0xd7b17f80
adc ecx, 0xd
jmp 0x6d93af32
mov ebp, dword [esp + 0x3c]
mov ecx, dword [esp + 0x40]
lea eax, [edx - 1]
mov edx, eax
sar edx, 0x1f
mov ebx, 0x15180
mov esi, edx
mul ebx
imul ebx, esi, 0x15180
add edx, ebx
add eax, ebp
adc edx, ecx
add eax, 0x886e0900
mov dword [esp + 0x54], eax
adc edx, 0xfffffff1
mov dword [esp + 0x58], edx
add esp, 0x48
ret
mov ecx, 0xd
call fcn.6d921300
mov eax, ebp
mov ecx, 0xd
call fcn.6d921300
nop
call fcn.6d91fe70
jmp fcn.6d93ad90
Function at 0x6d945d90
Capabilities:
Write file on windows

Disassembly:
sub esp, 0x1c
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 1
mov dword [esp], 0
call dword [sym.imp.KERNEL32.dll_CreateEventA]
sub esp, 0x10
mov dword [0x6da261a8], eax
test eax, eax
je 0x6d945dd8
mov dword [esp], 0x6da261ac
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
sub esp, 4
add esp, 0x1c
ret
mov dword [esp], 2
call dword [0x6d94f0bc]
mov dword [esp + 8], 0x3d
mov dword [esp + 0xc], eax
mov dword [esp + 4], 1
mov dword [esp], str.runtime:_failed_to_create_runtime_initialization_wait_event._n
call sub.msvcrt.dll_fwrite
call sub.msvcrt.dll_abort
lea esi, [esi]

Function at 0x6d946580
Capabilities:
Allocate or change rwx memory

Disassembly:
push edi
push esi
push ebx
sub esp, 0x30
mov esi, dword [0x6da26538]
test esi, esi
jle 0x6d946690
mov edi, dword [0x6da2653c]
xor ebx, ebx
lea edx, [edi + 0xc]
nop
mov ecx, dword [edx]
cmp ecx, eax
ja 0x6d9465b4
mov edi, dword [edx + 4]
add ecx, dword [edi + 8]
cmp eax, ecx
jb 0x6d946635
add ebx, 1
add edx, 0x14
cmp ebx, esi
jne 0x6d9465a0
mov dword [esp], eax
mov ebx, eax
call fcn.6d946cd0
test eax, eax
mov edi, eax
je 0x6d9466b7
mov eax, dword [0x6da2653c]
lea ebx, [esi + esi*4]
shl ebx, 2
add eax, ebx
mov dword [eax + 0x10], edi
mov dword [eax], 0
call fcn.6d946dd0
add eax, dword [edi + 0xc]
mov edx, dword [0x6da2653c]
mov dword [edx + ebx + 0xc], eax
lea edx, [esp + 0x14]
mov dword [esp + 8], 0x1c
mov dword [esp], eax
mov dword [esp + 4], edx
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
sub esp, 0xc
test eax, eax
je 0x6d946697
mov eax, dword [esp + 0x28]
lea edx, [eax - 0x40]
and edx, 0xffffffbf
je 0x6d94662e
sub eax, 4
and eax, 0xfffffffb
jne 0x6d946640
add dword [0x6da26538], 1
add esp, 0x30
pop ebx
pop esi
pop edi
ret
add ebx, dword [0x6da2653c]
mov eax, dword [esp + 0x14]
mov edx, dword [esp + 0x20]
mov dword [ebx + 4], eax
mov dword [ebx + 8], edx
mov dword [esp + 0xc], ebx
mov dword [esp + 8], 0x40
mov dword [esp + 4], edx
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
sub esp, 0x10
test eax, eax
jne 0x6d94662e
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp], str.__VirtualProtect_failed_with_code_0x_x
mov dword [esp + 4], eax
call fcn.6d947310
lea esi, [esi]
xor esi, esi
jmp 0x6d9465be
mov eax, dword [0x6da2653c]
mov eax, dword [eax + ebx + 0xc]
mov dword [esp + 8], eax
mov eax, dword [edi + 8]
mov dword [esp], str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov dword [esp + 4], eax
call fcn.6d947310
mov dword [esp + 4], ebx
mov dword [esp], str.Address__p_has_no_image_section
call fcn.6d947310
mov esi, esi
lea edi, [edi]
Function at 0x6d946950
Capabilities:
Get thread local storage value

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x1c
mov dword [esp], 0x6da26548
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov ebx, dword [0x6da26540]
sub esp, 4
test ebx, ebx
je 0x6d9469a5
mov ebp, dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
lea esi, [esi]
mov eax, dword [ebx]
mov dword [esp], eax
call ebp
sub esp, 4
mov esi, eax
call edi
test eax, eax
jne 0x6d94699e
test esi, esi
je 0x6d94699e
mov eax, dword [ebx + 4]
mov dword [esp], esi
call eax
mov ebx, dword [ebx + 8]
test ebx, ebx
jne 0x6d946980
mov dword [esp], 0x6da26548
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
sub esp, 4
add esp, 0x1c
pop ebx
pop esi
pop edi
pop ebp
ret

Function at 0x6d947310
Capabilities:
Write file on windows

Disassembly:
push ebx
sub esp, 0x18
mov dword [esp], 2
lea ebx, [esp + 0x24]
call fcn.6d9472f0
mov dword [esp + 8], 0x1b
mov dword [esp + 0xc], eax
mov dword [esp + 4], 1
mov dword [esp], str.Mingw_w64_runtime_failure:_n
call sub.msvcrt.dll_fwrite
mov dword [esp], 2
call fcn.6d9472f0
mov edx, dword [esp + 0x20]
mov dword [esp + 8], ebx
mov dword [esp], eax
mov dword [esp + 4], edx
call sub.msvcrt.dll_vfprintf
call sub.msvcrt.dll_abort
nop
nop
nop
nop
nop
jmp fcn.6d8c13e0
Function at 0x401220
Capabilities:
Query environment variable
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x214
mov eax, dword [0x409040]
xor eax, ebp
mov dword [ebp - 4], eax
push edi
push 0x104
lea eax, [ebp - 0x20c]
mov edi, ecx
push eax
mov dword [ebp - 0x210], edi
push str.APPDATA
mov dword [ebp - 0x210], edi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
test eax, eax
je 0x40138f
push esi
xorps xmm0, xmm0
lea esi, [ebp - 0x20c]
movups xmmword [edi], xmm0
mov dword [edi + 0x10], 0
lea ecx, [esi + 2]
mov dword [edi + 0x14], 0
nop
mov ax, word [esi]
add esi, 2
test ax, ax
jne 0x401280
sub esi, ecx
sar esi, 1
cmp esi, 0x7ffffffe
ja 0x4013b4
cmp esi, 7
ja 0x4012d5
mov dword [edi + 0x10], esi
lea eax, [ebp - 0x20c]
add esi, esi
mov dword [edi + 0x14], 7
push esi
push eax
push edi
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
xor eax, eax
mov word [esi + edi], ax
mov eax, edi
pop esi
pop edi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004042c8
mov esp, ebp
pop ebp
ret
push ebx
mov ebx, esi
or ebx, 7
cmp ebx, 0x7ffffffe
jbe 0x40131e
mov eax, 0x7fffffff
mov dword [ebp - 0x210], 0x7ffffffe
add eax, eax
cmp eax, 0x1000
jb 0x40134a
lea ecx, [eax + 0x23]
cmp ecx, eax
jbe 0x4013b9
push ecx
call fcn.004042d6
add esp, 4
test eax, eax
je 0x401344
lea ebx, [eax + 0x23]
and ebx, 0xffffffe0
mov dword [ebx - 4], eax
jmp 0x401355
mov eax, 0xa
cmp ebx, eax
cmovb ebx, eax
mov dword [ebp - 0x210], ebx
lea eax, [ebx + 1]
cmp eax, 0x7fffffff
ja 0x4013b9
add eax, eax
jne 0x4012f4
xor ebx, ebx
jmp 0x401355
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push eax
call fcn.004042d6
add esp, 4
mov ebx, eax
mov eax, dword [ebp - 0x210]
mov dword [edi + 0x10], esi
add esi, esi
mov dword [edi + 0x14], eax
lea eax, [ebp - 0x20c]
push esi
push eax
push ebx
mov dword [edi], ebx
call sub.VCRUNTIME140.dll_memcpy
mov ecx, dword [ebp - 4]
add esp, 0xc
xor eax, eax
xor ecx, ebp
mov word [esi + ebx], ax
mov eax, edi
pop ebx
pop esi
pop edi
call fcn.004042c8
mov esp, ebp
pop ebp
ret
mov ecx, dword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcerr]
mov edx, 0x406320
push 0x4037c0
call fcn.00403590
mov ecx, eax
call dword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______thiscall_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t_______cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t_____]
push 1
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
call fcn.00401170
call fcn.004010d0
int3
Function at 0x402120
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x1c
push ebx
mov ebx, ecx
push esi
push edi
cmp dword [ebx + 0x38], 0
je 0x40214c
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____thiscall_std::basic_streambuf_char__struct_std::char_traits_char__::xsputn_char_const___long_long___int64__]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov eax, dword [ebx + 0x20]
mov esi, dword [ebp + 0xc]
mov edi, dword [ebp + 0x10]
mov dword [esp + 0x20], esi
mov ecx, dword [eax]
lea eax, [ebx + 0x30]
mov dword [esp + 0x24], edi
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x18], eax
test ecx, ecx
je 0x402174
mov eax, dword [eax]
mov ecx, dword [eax]
jmp 0x40217a
xor ecx, ecx
mov dword [esp + 0x18], eax
mov eax, ecx
cdq
mov dword [esp + 0x10], eax
mov ecx, edx
mov dword [esp + 0x14], ecx
test edi, edi
jl 0x4021e2
jg 0x402191
test esi, esi
je 0x4021e2
test ecx, ecx
jl 0x4021dd
jg 0x40219b
test eax, eax
je 0x4021dd
cmp edi, ecx
jg 0x4021af
jl 0x4021a5
cmp esi, eax
jae 0x4021af
mov eax, esi
mov dword [esp + 0x10], esi
mov dword [esp + 0x14], edi
push eax
push dword [ebp + 8]
push dword [esp + 0x24]
call sub.VCRUNTIME140.dll_memcpy
mov eax, dword [esp + 0x24]
add esp, 0xc
mov edx, dword [esp + 0x10]
mov ecx, dword [ebp + 8]
add ecx, edx
sub esi, edx
mov eax, dword [eax]
sbb edi, dword [esp + 0x14]
sub dword [eax], edx
mov eax, dword [ebx + 0x20]
add dword [eax], edx
jmp 0x4021e5
mov ecx, dword [ebp + 8]
jmp 0x4021ef
mov ecx, dword [ebp + 8]
test edi, edi
jl 0x402209
jg 0x4021ef
test esi, esi
je 0x402209
mov eax, dword [ebx + 0x4c]
test eax, eax
je 0x402209
push eax
push esi
push 1
push ecx
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
add esp, 0x10
sub esi, eax
sbb edi, 0
mov eax, dword [esp + 0x20]
mov edx, dword [esp + 0x24]
sub eax, esi
sbb edx, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x402220
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [ebp + 0x10]
push ebx
mov ebx, ecx
mov ecx, dword [ebp + 0xc]
push esi
mov esi, dword [ebp + 8]
mov dword [ebp - 4], esi
test eax, eax
jg 0x40224c
jl 0x402240
test ecx, ecx
jne 0x40224c
pop esi
xor eax, eax
xor edx, edx
pop ebx
mov esp, ebp
pop ebp
ret 0xc
cmp dword [ebx + 0x38], 0
je 0x402265
push eax
push ecx
push esi
mov ecx, ebx
call dword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____thiscall_std::basic_streambuf_char__struct_std::char_traits_char__::xsgetn_char___long_long___int64__]
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov eax, dword [ebx + 0x1c]
push edi
mov edi, ecx
mov eax, dword [eax]
mov dword [ebp - 8], eax
test eax, eax
je 0x4022b3
mov eax, dword [ebx + 0x2c]
lea edx, [ebx + 0x2c]
mov dword [ebp - 0xc], edx
mov eax, dword [eax]
test eax, eax
je 0x4022b9
mov edi, dword [ebp - 4]
cmp eax, ecx
mov esi, ecx
cmovb esi, eax
push esi
push dword [ebp - 8]
push edi
call sub.VCRUNTIME140.dll_memcpy
mov eax, dword [ebx + 0x2c]
add edi, esi
mov dword [ebp - 4], edi
add esp, 0xc
mov edi, dword [ebp + 0xc]
sub edi, esi
sub dword [eax], esi
mov eax, dword [ebx + 0x1c]
add dword [eax], esi
mov esi, dword [ebp - 4]
jmp 0x4022b9
lea eax, [ebx + 0x2c]
mov dword [ebp - 0xc], eax
cmp dword [ebx + 0x4c], 0
je 0x402326
mov ecx, dword [ebx + 0xc]
lea eax, [ebx + 0x3c]
cmp dword [ecx], eax
jne 0x4022e2
mov eax, dword [ebx + 0xc]
mov edx, dword [ebx + 0x54]
mov ecx, dword [ebx + 0x50]
sub edx, ecx
mov dword [eax], ecx
mov eax, dword [ebx + 0x1c]
mov dword [eax], ecx
mov eax, dword [ebp - 0xc]
mov eax, dword [eax]
mov dword [eax], edx
mov eax, dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
cmp edi, 0xfff
jbe 0x402314
nop
push dword [ebx + 0x4c]
push 0xfff
push 1
push esi
call eax
add esp, 0x10
add esi, eax
sub edi, eax
cmp eax, 0xfff
jne 0x402326
cmp edi, eax
mov eax, dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
ja 0x4022f0
test edi, edi
je 0x402326
push dword [ebx + 0x4c]
push edi
push 1
push esi
call eax
add esp, 0x10
sub edi, eax
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 0x10]
sub eax, edi
pop edi
pop esi
sbb edx, 0
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x4026a0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
mov eax, dword [0x409040]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, ecx
cmp ebx, 0xffffffff
jne 0x4026d0
pop esi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004042c8
mov esp, ebp
pop ebp
ret 4
mov eax, dword [esi + 0x20]
push edi
mov ecx, dword [eax]
test ecx, ecx
je 0x40270c
mov edx, dword [esi + 0x30]
mov edi, dword [edx]
lea eax, [edi + ecx]
cmp ecx, eax
jae 0x40270c
lea ecx, [edi - 1]
mov eax, ebx
mov dword [edx], ecx
mov edx, dword [esi + 0x20]
pop edi
mov esi, dword [edx]
lea ecx, [esi + 1]
mov dword [edx], ecx
mov byte [esi], bl
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004042c8
mov esp, ebp
pop ebp
ret 4
cmp dword [esi + 0x4c], 0
je 0x4027e3
mov edi, dword [esi + 0xc]
lea eax, [esi + 0x3c]
cmp dword [edi], eax
jne 0x402734
mov edx, dword [esi + 0x54]
mov ecx, dword [esi + 0x50]
sub edx, ecx
mov dword [edi], ecx
mov eax, dword [esi + 0x1c]
mov dword [eax], ecx
mov eax, dword [esi + 0x2c]
mov dword [eax], edx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x402740
movsx eax, bl
jmp 0x402778
lea eax, [ebp - 0x2c]
mov byte [ebp - 0x25], bl
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x25]
push eax
lea eax, [esi + 0x40]
push eax
call dword [sym.imp.MSVCP140.dll_public:_int___thiscall_std::codecvt_char__char__struct__Mbstatet_::out_struct__Mbstatet___char_const___char_const___char_const____char___char___char___const]
sub eax, 0
je 0x4027a2
sub eax, 1
je 0x4027a2
sub eax, 2
jne 0x4027e3
movsx eax, byte [ebp - 0x25]
push dword [esi + 0x4c]
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
add esp, 8
or ecx, 0xffffffff
cmp eax, ecx
cmove ebx, ecx
pop edi
pop esi
mov eax, ebx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004042c8
mov esp, ebp
pop ebp
ret 4
mov edi, dword [ebp - 0x2c]
lea eax, [ebp - 0x24]
sub edi, eax
je 0x4027c0
push dword [esi + 0x4c]
push edi
push 1
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
add esp, 0x10
cmp edi, eax
jne 0x4027e3
lea ecx, [ebp - 0x25]
mov byte [esi + 0x3d], 1
or eax, 0xffffffff
cmp dword [ebp - 0x30], ecx
pop edi
pop esi
cmovne eax, ebx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004042c8
mov esp, ebp
pop ebp
ret 4
mov ecx, dword [ebp - 4]
or eax, 0xffffffff
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004042c8
mov esp, ebp
pop ebp
ret 4
Function at 0x4031f0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x409040]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, ecx
cmp dword [esi + 0x38], 0
je 0x4032ac
cmp byte [esi + 0x3d], 0
je 0x4032ac
mov eax, dword [esi]
push edi
push 0xffffffffffffffff
call dword [eax + 0xc]
cmp eax, 0xffffffff
je 0x40329a
mov ecx, dword [esi + 0x38]
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [esi + 0x40]
push eax
call dword [sym.imp.MSVCP140.dll_public:_int___thiscall_std::codecvt_char__char__struct__Mbstatet_::unshift_struct__Mbstatet___char___char___char___const]
sub eax, 0
je 0x403261
sub eax, 1
je 0x403265
sub eax, 2
jne 0x40329a
mov byte [esi + 0x3d], al
mov al, 1
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004042c8
mov esp, ebp
pop ebp
ret
mov byte [esi + 0x3d], 0
mov edi, dword [ebp - 0x28]
lea eax, [ebp - 0x24]
sub edi, eax
je 0x403283
push dword [esi + 0x4c]
push edi
push 1
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
add esp, 0x10
cmp edi, eax
jne 0x40329a
cmp byte [esi + 0x3d], 0
pop edi
sete al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004042c8
mov esp, ebp
pop ebp
ret
pop edi
xor al, al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004042c8
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
mov al, 1
xor ecx, ebp
pop esi
call fcn.004042c8
mov esp, ebp
pop ebp
ret

Function at 0x404b69
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x404ba8
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x404ba8
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x404ba8
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x404ba8
cmp dword [ecx + 0x74], 0xe
jbe 0x404ba8
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret