joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10004e60
Capabilities:
Enumerate threads
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
mov eax, dword [0x10019484]
mov ecx, eax
push ebx
push esi
push edi
mov dword [ebp - 0xc], eax
call fcn.10005000
xorps xmm0, xmm0
mov dword [ebp - 0x30], 0x1c
movlpd qword [ebp - 0x2c], xmm0
movlpd qword [ebp - 0x24], xmm0
movlpd qword [ebp - 0x1c], xmm0
mov dword [ebp - 8], 0
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
push 4
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
lea ecx, [ebp - 0x30]
mov dword [ebp - 0x10], eax
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_Thread32First]
test eax, eax
je 0x10004f34
mov dword [ebp - 0x14], 1
mov edx, dword [ebp - 0x14]
mov ebx, dword [ebp - 0x14]
mov edi, dword [ebp - 0x14]
mov esi, dword [ebp - 0x14]
jmp 0x10004ed3
mov edx, dword [ebp - 4]
mov ecx, dword [ebp - 0xc]
mov eax, dword [ebp - 0x28]
cmp eax, dword [ecx + 0x14]
cmove edx, dword [ebp - 0x14]
cmp eax, dword [ecx + 0x18]
mov dword [ebp - 4], edx
mov edx, 1
cmove ebx, edx
cmp eax, dword [ecx + 0x1c]
cmove edi, edx
cmp eax, dword [ecx + 0x20]
cmove esi, edx
cmp eax, dword [ecx + 0x24]
mov edx, dword [ebp - 8]
mov eax, 1
cmove edx, eax
cmp dword [ebp - 4], 0
mov dword [ebp - 8], edx
je 0x10004f21
test edx, edx
je 0x10004f21
test ebx, ebx
je 0x10004f21
test edi, edi
je 0x10004f21
test esi, esi
jne 0x10004f43
lea eax, [ebp - 0x30]
push eax
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_Thread32Next]
test eax, eax
jne 0x10004ed0
jmp 0x10004f43
mov eax, dword [ebp - 0x14]
mov ebx, dword [ebp - 0x14]
mov edi, dword [ebp - 0x14]
mov esi, dword [ebp - 0x14]
mov dword [ebp - 4], eax
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 4], 0
je 0x10004f64
test ebx, ebx
je 0x10004f64
test edi, edi
je 0x10004f64
test esi, esi
je 0x10004f64
cmp dword [ebp - 8], 0
jne 0x10004f70
mov eax, dword [ebp - 0xc]
mov dword [eax + 0x2c], 1
jmp 0x10004f73
mov eax, dword [ebp - 0xc]
cmp dword [eax + 0x2c], 0
jne 0x10004f7f
cmp dword [eax + 0x28], 0
je 0x10004fdf
cmp byte [0x10019488], 0
je 0x10004fd8
cmp dword [0x10019534], 0
je 0x10004fd8
push 4
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov edi, dword [sym.imp.WS2_32.dll_send]
add esp, 4
mov esi, eax
push 0
push 4
push esi
push dword [0x10019534]
mov dword [esi], 0xa0301489
call edi
cmp eax, 0xffffffff
jne 0x10004fce
push 0
push 4
push esi
push dword [0x1001948c]
call edi
cmp eax, 0xffffffff
je 0x10004fe6
push esi
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
add esp, 4
mov byte [0x1001948a], 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov ecx, 2
call fcn.1000e8c0
int3
Function at 0x10005000
Capabilities:
Enumerate threads
Resume thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
push ebx
push esi
xorps xmm0, xmm0
mov dword [ebp - 0x30], 0x1c
push edi
mov esi, ecx
movlpd qword [ebp - 0x2c], xmm0
movlpd qword [ebp - 0x24], xmm0
movlpd qword [ebp - 0x1c], xmm0
mov dword [ebp - 0xc], 0
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
push 4
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
lea ecx, [ebp - 0x30]
mov dword [ebp - 0x10], eax
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_Thread32First]
mov edi, dword [ebp - 0x14]
test eax, eax
mov eax, dword [ebp - 0x14]
mov ebx, dword [ebp - 0x14]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 8], eax
je 0x1000518d
mov ecx, dword [sym.imp.KERNEL32.dll_OpenThread]
mov eax, dword [esi + 0x14]
cmp dword [ebp - 0x28], eax
jne 0x1000509a
push eax
push 0
push 0x1fffff
call ecx
test eax, eax
jne 0x10005083
mov dword [ebp - 4], eax
jmp 0x10005094
push eax
call dword [sym.imp.KERNEL32.dll_ResumeThread]
xor ecx, ecx
test eax, eax
setle cl
mov dword [ebp - 4], ecx
mov ecx, dword [sym.imp.KERNEL32.dll_OpenThread]
mov eax, dword [esi + 0x18]
cmp dword [ebp - 0x28], eax
jne 0x100050c6
push eax
push 0
push 0x1fffff
call ecx
test eax, eax
jne 0x100050b5
mov dword [ebp - 8], eax
jmp 0x100050c6
push eax
call dword [sym.imp.KERNEL32.dll_ResumeThread]
xor ecx, ecx
test eax, eax
setle cl
mov dword [ebp - 8], ecx
mov eax, dword [esi + 0x1c]
cmp dword [ebp - 0x28], eax
jne 0x100050f7
push eax
push 0
push 0x1fffff
call dword [sym.imp.KERNEL32.dll_OpenThread]
test eax, eax
jne 0x100050e4
xor edi, edi
jmp 0x100050f7
push eax
call dword [sym.imp.KERNEL32.dll_ResumeThread]
xor ecx, ecx
test eax, eax
setle cl
mov dword [ebp - 0x14], ecx
mov edi, ecx
mov eax, dword [esi + 0x20]
cmp dword [ebp - 0x28], eax
jne 0x10005123
push eax
push 0
push 0x1fffff
call dword [sym.imp.KERNEL32.dll_OpenThread]
test eax, eax
jne 0x10005115
xor ebx, ebx
jmp 0x10005123
push eax
call dword [sym.imp.KERNEL32.dll_ResumeThread]
xor ebx, ebx
test eax, eax
setle bl
mov eax, dword [esi + 0x24]
cmp dword [ebp - 0x28], eax
jne 0x10005157
push eax
push 0
push 0x1fffff
call dword [sym.imp.KERNEL32.dll_OpenThread]
test eax, eax
jne 0x10005144
xor ecx, ecx
mov dword [ebp - 0xc], ecx
jmp 0x1000515a
push eax
call dword [sym.imp.KERNEL32.dll_ResumeThread]
xor ecx, ecx
test eax, eax
setle cl
mov dword [ebp - 0xc], ecx
jmp 0x1000515a
mov ecx, dword [ebp - 0xc]
cmp dword [ebp - 4], 0
je 0x10005172
cmp dword [ebp - 8], 0
je 0x10005172
test edi, edi
je 0x10005172
test ebx, ebx
je 0x10005172
test ecx, ecx
jne 0x1000518d
lea eax, [ebp - 0x30]
push eax
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_Thread32Next]
mov ecx, dword [sym.imp.KERNEL32.dll_OpenThread]
test eax, eax
jne 0x10005068
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 4], 0
je 0x100051b0
cmp dword [ebp - 8], 0
je 0x100051b0
test edi, edi
je 0x100051b0
test ebx, ebx
je 0x100051b0
cmp dword [ebp - 0xc], 0
jne 0x100051b7
mov dword [esi + 0x28], 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x100051c0
Capabilities:
Get storage device properties

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10012695
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ebx
sub esp, 0x38
push esi
push edi
push 0
push 0
push 3
push 0
push 3
push 0
mov edi, ecx
push str..PhysicalDrive0
mov dword [ebp - 0x20], edi
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
mov dword [ebp - 0x1c], esi
cmp esi, 0xffffffff
jne 0x10005241
xorps xmm0, xmm0
movups xmmword [edi], xmm0
mov dword [edi + 0x10], 0
mov dword [edi + 0x14], 0
mov dword [edi + 0x10], 0
mov dword [edi + 0x14], 0xf
mov byte [edi], 0
jmp 0x10005389
mov dword [ebp - 0x38], 0x100053a0
mov dword [ebp - 0x34], esi
push 0
lea eax, [ebp - 0x18]
mov dword [ebp - 4], 0
push eax
push 8
lea eax, [ebp - 0x30]
mov dword [ebp - 0x3c], 0
push eax
push 0xc
lea eax, [ebp - 0x44]
mov dword [ebp - 0x44], 0
push eax
push 0x2d1400
xorps xmm0, xmm0
mov dword [ebp - 0x40], 0
push esi
movlpd qword [ebp - 0x30], xmm0
mov dword [ebp - 0x18], 0
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
jne 0x100052b5
xorps xmm0, xmm0
movups xmmword [edi], xmm0
mov dword [edi + 0x10], eax
mov dword [edi + 0x14], eax
mov dword [edi + 0x10], eax
mov dword [edi + 0x14], 0xf
mov byte [edi], al
jmp 0x1000537e
mov esi, dword [ebp - 0x2c]
push esi
call fcn.1000ef9f
push esi
push 0
push eax
mov dword [ebp - 0x14], eax
call sub.VCRUNTIME140.dll_memset
mov eax, dword [ebp - 0x14]
add esp, 0x10
mov dword [ebp - 0x28], eax
push 0
lea ecx, [ebp - 0x18]
mov byte [ebp - 4], 2
push ecx
push esi
mov esi, dword [ebp - 0x1c]
push eax
push 0xc
lea eax, [ebp - 0x44]
push eax
push 0x2d1400
push esi
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
xorps xmm0, xmm0
test eax, eax
jne 0x1000531d
push dword [ebp - 0x14]
movups xmmword [edi], xmm0
mov dword [edi + 0x10], eax
mov dword [edi + 0x14], eax
mov dword [edi + 0x10], eax
mov dword [edi + 0x14], 0xf
mov byte [edi], al
call fcn.1000ef9a
add esp, 4
jmp 0x1000537e
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax + 0x18]
movups xmmword [edi], xmm0
mov dword [edi + 0x10], 0
mov dword [edi + 0x14], 0
test ecx, ecx
jne 0x1000534f
mov dword [edi + 0x10], ecx
mov dword [edi + 0x14], 0xf
push eax
mov byte [edi], cl
call fcn.1000ef9a
add esp, 4
jmp 0x1000537e
lea edx, [ecx + eax]
mov ecx, edx
lea eax, [ecx + 1]
mov dword [ebp - 0x1c], eax
nop word [eax + eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x10005360
sub ecx, dword [ebp - 0x1c]
push ecx
push edx
mov ecx, edi
call fcn.10001890
push dword [ebp - 0x14]
call fcn.1000ef9a
add esp, 4
test esi, esi
je 0x10005389
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 0xc]
mov eax, edi
pop edi
mov dword fs:[0], ecx
pop esi
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret
Function at 0x100088a0
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1001282d
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebx
push esi
mov ebx, ecx
mov dword [ebp - 4], 0
cmp byte [0x10019488], 0
je 0x10008946
cmp dword [0x10019534], 0
je 0x10008946
push 0x70
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov cx, word [ebp + 0x18]
mov esi, eax
add esp, 4
mov edx, esi
cmp dword [ebp + 0x1c], 0xf
mov word [esi + 8], cx
lea ecx, [ebp + 8]
cmova ecx, dword [ebp + 8]
mov dword [esi], 0xa4111482
sub edx, ecx
mov dword [esi + 4], ebx
mov al, byte [ecx]
lea ecx, [ecx + 1]
mov byte [edx + ecx + 9], al
test al, al
jne 0x10008903
push 0
push 0x70
push esi
push dword [0x10019534]
call dword [sym.imp.WS2_32.dll_send]
cmp eax, 0xffffffff
jne 0x1000893c
push 0
push 0x70
push esi
push dword [0x1001948c]
call dword [sym.imp.WS2_32.dll_send]
cmp eax, 0xffffffff
je 0x10008998
push esi
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
add esp, 4
cmp ebx, 1
je 0x10008952
mov byte [0x1001948a], 1
mov ecx, dword [ebp + 0x1c]
cmp ecx, 0xf
jbe 0x10008988
mov edx, dword [ebp + 8]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x1000897e
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x1000897e
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push ecx
push edx
call fcn.1000ef69
add esp, 8
mov ecx, dword [ebp - 0xc]
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
mov ecx, 2
call fcn.1000e8c0
int3
Function at 0x100099e0
Capabilities:
Send data
Send data on socket

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x10012895
push eax
mov dword fs:[0], esp
push ebx
sub esp, 0x38
cmp byte [0x10019488], 0
push esi
push edi
je 0x10009bbd
cmp dword [0x10019534], 0
je 0x10009bbd
xorps xmm0, xmm0
mov dword [ebp - 0x34], 0
movups xmmword [ebp - 0x44], xmm0
mov dword [ebp - 0x30], 0xf
mov byte [ebp - 0x44], 0
lea ecx, [ebp - 0x2c]
mov dword [ebp - 4], 0
call fcn.100089b0
mov byte [ebp - 4], 1
mov eax, dword [ebp - 0x28]
mov edi, dword [ebp - 0x2c]
mov dword [ebp - 0x20], eax
cmp edi, eax
je 0x10009b06
cmp dword [edi + 0x14], 0xf
mov edx, edi
jbe 0x10009a72
mov edx, dword [edi]
mov ecx, dword [edi + 0x10]
mov eax, dword [ebp - 0x30]
mov esi, dword [ebp - 0x34]
sub eax, esi
mov dword [ebp - 0x14], ecx
push ecx
push edx
cmp ecx, eax
ja 0x10009aab
cmp dword [ebp - 0x30], 0xf
lea eax, [esi + ecx]
mov dword [ebp - 0x34], eax
lea eax, [ebp - 0x44]
cmova eax, dword [ebp - 0x44]
add esi, eax
push esi
call sub.VCRUNTIME140.dll_memmove
mov eax, dword [ebp - 0x14]
add esp, 0xc
mov byte [esi + eax], 0
jmp 0x10009abb
mov byte [ebp - 0x18], 0
push dword [ebp - 0x18]
push ecx
lea ecx, [ebp - 0x44]
call fcn.10008430
mov edx, dword [ebp - 0x30]
mov eax, edx
mov ecx, dword [ebp - 0x34]
sub eax, ecx
cmp eax, 1
jb 0x10009ae2
lea eax, [ecx + 1]
cmp edx, 0xf
mov dword [ebp - 0x34], eax
lea eax, [ebp - 0x44]
cmova eax, dword [ebp - 0x44]
mov word [eax + ecx], 0x3a
jmp 0x10009afa
push 1
push 0x10014b08
mov byte [ebp - 0x1c], 0
lea ecx, [ebp - 0x44]
push dword [ebp - 0x1c]
push 1
call fcn.10008430
add edi, 0x18
cmp edi, dword [ebp - 0x20]
jne 0x10009a68
lea ecx, [ebp - 0x2c]
mov byte [ebp - 4], 0
call fcn.1000b630
push 0xfa6
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov cx, word [ebp - 0x34]
mov esi, eax
add esp, 4
mov edx, esi
cmp dword [ebp - 0x30], 0xf
mov word [esi + 4], cx
lea ecx, [ebp - 0x44]
cmova ecx, dword [ebp - 0x44]
mov dword [esi], 0xabe71488
sub edx, ecx
nop
mov al, byte [ecx]
lea ecx, [ecx + 1]
mov byte [edx + ecx + 5], al
test al, al
jne 0x10009b40
mov edi, dword [sym.imp.WS2_32.dll_send]
push 0
push 0xfa6
push esi
push dword [0x10019534]
call edi
cmp eax, 0xffffffff
jne 0x10009b7d
push 0
push 0xfa6
push esi
push dword [0x1001948c]
call edi
cmp eax, 0xffffffff
je 0x10009bd0
push esi
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov ecx, dword [ebp - 0x30]
add esp, 4
cmp ecx, 0xf
jbe 0x10009bbd
mov edx, dword [ebp - 0x44]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x10009bb3
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x10009bb3
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push ecx
push edx
call fcn.1000ef69
add esp, 8
mov ecx, dword [ebp - 0xc]
pop edi
mov dword fs:[0], ecx
pop esi
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret
mov ecx, 2
call fcn.1000e8c0
int3
Function at 0x1000d6f0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x1c
push ebx
mov ebx, ecx
push esi
push edi
cmp dword [ebx + 0x38], 0
je 0x1000d71c
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____thiscall_std::basic_streambuf_char__struct_std::char_traits_char__::xsputn_char_const___long_long___int64__]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov eax, dword [ebx + 0x20]
mov esi, dword [ebp + 0xc]
mov edi, dword [ebp + 0x10]
mov dword [esp + 0x20], esi
mov ecx, dword [eax]
lea eax, [ebx + 0x30]
mov dword [esp + 0x24], edi
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x18], eax
test ecx, ecx
je 0x1000d744
mov eax, dword [eax]
mov ecx, dword [eax]
jmp 0x1000d74a
xor ecx, ecx
mov dword [esp + 0x18], eax
mov eax, ecx
cdq
mov dword [esp + 0x10], eax
mov ecx, edx
mov dword [esp + 0x14], ecx
test edi, edi
jl 0x1000d7b2
jg 0x1000d761
test esi, esi
je 0x1000d7b2
test ecx, ecx
jl 0x1000d7ad
jg 0x1000d76b
test eax, eax
je 0x1000d7ad
cmp edi, ecx
jg 0x1000d77f
jl 0x1000d775
cmp esi, eax
jae 0x1000d77f
mov eax, esi
mov dword [esp + 0x10], esi
mov dword [esp + 0x14], edi
push eax
push dword [ebp + 8]
push dword [esp + 0x24]
call sub.VCRUNTIME140.dll_memcpy
mov eax, dword [esp + 0x24]
add esp, 0xc
mov edx, dword [esp + 0x10]
mov ecx, dword [ebp + 8]
add ecx, edx
sub esi, edx
mov eax, dword [eax]
sbb edi, dword [esp + 0x14]
sub dword [eax], edx
mov eax, dword [ebx + 0x20]
add dword [eax], edx
jmp 0x1000d7b5
mov ecx, dword [ebp + 8]
jmp 0x1000d7bf
mov ecx, dword [ebp + 8]
test edi, edi
jl 0x1000d7d9
jg 0x1000d7bf
test esi, esi
je 0x1000d7d9
mov eax, dword [ebx + 0x4c]
test eax, eax
je 0x1000d7d9
push eax
push esi
push 1
push ecx
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
add esp, 0x10
sub esi, eax
sbb edi, 0
mov eax, dword [esp + 0x20]
mov edx, dword [esp + 0x24]
sub eax, esi
sbb edx, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x1000d7f0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0x10]
sub esp, 8
push ebx
mov ebx, ecx
mov ecx, dword [ebp + 0xc]
test eax, eax
jg 0x1000d814
jl 0x1000d809
test ecx, ecx
jne 0x1000d814
xor eax, eax
xor edx, edx
pop ebx
mov esp, ebp
pop ebp
ret 0xc
cmp dword [ebx + 0x38], 0
je 0x1000d82e
push eax
push ecx
push dword [ebp + 8]
mov ecx, ebx
call dword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____thiscall_std::basic_streambuf_char__struct_std::char_traits_char__::xsgetn_char___long_long___int64__]
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov eax, dword [ebx + 0x1c]
push esi
push edi
mov edi, ecx
mov eax, dword [eax]
mov dword [ebp - 8], eax
test eax, eax
je 0x1000d87a
mov eax, dword [ebx + 0x2c]
lea edx, [ebx + 0x2c]
mov dword [ebp - 4], edx
mov eax, dword [eax]
test eax, eax
je 0x1000d880
mov edi, dword [ebp + 8]
cmp eax, ecx
mov esi, ecx
cmovb esi, eax
push esi
push dword [ebp - 8]
push edi
call sub.VCRUNTIME140.dll_memcpy
mov eax, dword [ebx + 0x2c]
add edi, esi
mov dword [ebp + 8], edi
add esp, 0xc
mov edi, dword [ebp + 0xc]
sub edi, esi
sub dword [eax], esi
mov eax, dword [ebx + 0x1c]
add dword [eax], esi
jmp 0x1000d880
lea eax, [ebx + 0x2c]
mov dword [ebp - 4], eax
cmp dword [ebx + 0x4c], 0
mov esi, dword [ebp + 8]
je 0x1000d8f6
mov ecx, dword [ebx + 0xc]
lea eax, [ebx + 0x3c]
cmp dword [ecx], eax
jne 0x1000d8ac
mov eax, dword [ebx + 0xc]
mov edx, dword [ebx + 0x54]
mov ecx, dword [ebx + 0x50]
sub edx, ecx
mov dword [eax], ecx
mov eax, dword [ebx + 0x1c]
mov dword [eax], ecx
mov eax, dword [ebp - 4]
mov eax, dword [eax]
mov dword [eax], edx
mov eax, dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
cmp edi, 0xfff
jbe 0x1000d8e4
nop dword [eax]
push dword [ebx + 0x4c]
push 0xfff
push 1
push esi
call eax
add esp, 0x10
add esi, eax
sub edi, eax
cmp eax, 0xfff
jne 0x1000d8f6
cmp edi, eax
mov eax, dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
ja 0x1000d8c0
test edi, edi
je 0x1000d8f6
push dword [ebx + 0x4c]
push edi
push 1
push esi
call eax
add esp, 0x10
sub edi, eax
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 0x10]
sub eax, edi
pop edi
pop esi
sbb edx, 0
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x1000dc70
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, ecx
cmp ebx, 0xffffffff
jne 0x1000dc8c
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret 4
mov eax, dword [esi + 0x20]
push edi
mov ecx, dword [eax]
test ecx, ecx
je 0x1000dcbe
mov edx, dword [esi + 0x30]
mov edi, dword [edx]
lea eax, [edi + ecx]
cmp ecx, eax
jae 0x1000dcbe
lea ecx, [edi - 1]
mov eax, ebx
mov dword [edx], ecx
mov edx, dword [esi + 0x20]
pop edi
mov esi, dword [edx]
lea ecx, [esi + 1]
mov dword [edx], ecx
mov byte [esi], bl
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
cmp dword [esi + 0x4c], 0
je 0x1000dd81
mov edi, dword [esi + 0xc]
lea eax, [esi + 0x3c]
cmp dword [edi], eax
jne 0x1000dce6
mov edx, dword [esi + 0x54]
mov ecx, dword [esi + 0x50]
sub edx, ecx
mov dword [edi], ecx
mov eax, dword [esi + 0x1c]
mov dword [eax], ecx
mov eax, dword [esi + 0x2c]
mov dword [eax], edx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x1000dcf2
movsx eax, bl
jmp 0x1000dd2a
lea eax, [ebp + 8]
mov byte [ebp - 1], bl
push eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp]
push eax
lea eax, [ebp - 1]
push eax
lea eax, [esi + 0x40]
push eax
call dword [sym.imp.MSVCP140.dll_public:_int___thiscall_std::codecvt_char__char__struct__Mbstatet_::out_struct__Mbstatet___char_const___char_const___char_const____char___char___char___const]
sub eax, 0
je 0x1000dd4a
sub eax, 1
je 0x1000dd4a
sub eax, 2
jne 0x1000dd81
movsx eax, byte [ebp - 1]
push dword [esi + 0x4c]
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
add esp, 8
or ecx, 0xffffffff
cmp eax, ecx
cmove ebx, ecx
pop edi
pop esi
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret 4
mov edi, dword [ebp + 8]
lea eax, [ebp - 0x28]
sub edi, eax
je 0x1000dd68
push dword [esi + 0x4c]
push edi
push 1
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
add esp, 0x10
cmp edi, eax
jne 0x1000dd81
lea ecx, [ebp - 1]
mov byte [esi + 0x3d], 1
or eax, 0xffffffff
cmp dword [ebp - 8], ecx
pop edi
pop esi
cmovne eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret 4
pop edi
pop esi
or eax, 0xffffffff
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x1000e0f0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
push esi
mov esi, ecx
cmp dword [esi + 0x38], 0
je 0x1000e17c
cmp byte [esi + 0x3d], 0
je 0x1000e17c
mov eax, dword [esi]
push edi
push 0xffffffffffffffff
call dword [eax + 0xc]
cmp eax, 0xffffffff
je 0x1000e174
mov ecx, dword [esi + 0x38]
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [esi + 0x40]
push eax
call dword [sym.imp.MSVCP140.dll_public:_int___thiscall_std::codecvt_char__char__struct__Mbstatet_::unshift_struct__Mbstatet___char___char___char___const]
sub eax, 0
je 0x1000e145
sub eax, 1
je 0x1000e149
sub eax, 2
jne 0x1000e174
mov byte [esi + 0x3d], al
mov al, 1
pop edi
pop esi
mov esp, ebp
pop ebp
ret
mov byte [esi + 0x3d], 0
mov edi, dword [ebp - 4]
lea eax, [ebp - 0x24]
sub edi, eax
je 0x1000e167
push dword [esi + 0x4c]
push edi
push 1
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
add esp, 0x10
cmp edi, eax
jne 0x1000e174
cmp byte [esi + 0x3d], 0
pop edi
sete al
pop esi
mov esp, ebp
pop ebp
ret
pop edi
xor al, al
pop esi
mov esp, ebp
pop ebp
ret
mov al, 1
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x1000e6e0
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, ecx
push edi
mov dword [ebp - 4], esi
mov eax, dword [esi]
cmp eax, 0x270
jne 0x1000e73d
lea edx, [esi + 8]
mov edi, eax
nop dword [eax]
mov ecx, dword [edx]
lea edx, [edx + 4]
xor ecx, dword [edx - 8]
and ecx, 0x7fffffff
xor ecx, dword [edx - 8]
mov eax, ecx
and al, 1
movzx eax, al
neg eax
sbb eax, eax
shr ecx, 1
and eax, 0x9908b0df
xor eax, dword [edx + 0x62c]
xor eax, ecx
mov dword [edx + 0x9b8], eax
sub edi, 1
jne 0x1000e700
mov eax, dword [esi]
jmp 0x1000e817
cmp eax, 0x4e0
jb 0x1000e817
lea edi, [esi + 0x9c4]
mov esi, 0xe3
push ebx
mov ebx, dword [edi]
mov eax, ebx
lea edi, [edi + 4]
mov ebx, dword [edi]
mov ecx, ebx
xor ecx, eax
and ecx, 0x7fffffff
xor ecx, eax
mov eax, ecx
and al, 1
movzx eax, al
neg eax
sbb eax, eax
shr ecx, 1
and eax, 0x9908b0df
xor eax, dword [edi + 0x630]
xor eax, ecx
mov dword [edi - 0x9c4], eax
sub esi, 1
jne 0x1000e756
mov edi, dword [ebp - 4]
mov esi, 0x18c
add edi, 0xd50
mov ebx, dword [edi]
nop
mov eax, ebx
lea edi, [edi + 4]
mov ebx, dword [edi]
mov ecx, eax
xor ecx, ebx
and ecx, 0x7fffffff
xor ecx, eax
mov eax, ecx
and al, 1
movzx eax, al
neg eax
sbb eax, eax
shr ecx, 1
and eax, 0x9908b0df
xor eax, dword [edi - 0xd50]
xor eax, ecx
mov dword [edi - 0x9c4], eax
sub esi, 1
jne 0x1000e7a0
mov esi, dword [ebp - 4]
pop ebx
mov eax, dword [esi + 0x1380]
mov ecx, dword [esi + 4]
xor ecx, eax
and ecx, 0x7fffffff
xor ecx, eax
mov eax, ecx
and al, 1
movzx eax, al
neg eax
sbb eax, eax
shr ecx, 1
and eax, 0x9908b0df
xor eax, dword [esi + 0x634]
xor eax, ecx
mov dword [esi + 0x9c0], eax
xor eax, eax
mov dword [esi], 0
mov edx, dword [esi + eax*4 + 4]
inc eax
mov dword [esi], eax
mov ecx, edx
mov eax, dword [esi + 0x1384]
shr ecx, 0xb
and eax, ecx
xor edx, eax
mov eax, edx
and eax, 0xff3a58ad
shl eax, 7
xor edx, eax
mov eax, edx
and eax, 0xffffdf8c
shl eax, 0xf
xor edx, eax
mov eax, edx
shr eax, 0x12
pop edi
xor eax, edx
pop esi
mov esp, ebp
pop ebp
ret