joyce8/EMBER2024-capa huggingface dataset:
Function at 0x562e10c3
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push 0
push ecx
xor ecx, ecx
jne 0x562e110d
mov ecx, esp
xor dword [ecx - 0x55], edi
pop ecx
call 0x562e10b4
dec esp
adc eax, 0x91b81b2a
div bh
int 0x82
xchg ebx, eax
ror cl, 1
into
out dx, eax
call 0x562e10c3
cld
test edx, ebx
or ebp, eax
add dword [esi - 0x7cc26b19], esp
les ecx, [eax]
or dword [esp], ebp
mov ebp, esp
sub esp, 0x100
push ebx
push edx
push ecx
push edi
push esi
mov ebx, dword [ebp + 8]
mov edx, ebx
add ebx, dword [ebx + 0x3c]
mov ebx, dword [ebx + 0x78]
lea ebx, [ebx + edx]
mov eax, dword [ebx + 0x24]
add eax, edx
xor edi, edi
jne 0x566e6d66
or edi, dword [ebx + 0x20]
add edi, edx
mov ecx, dword [ebx + 0x18]
mov esi, dword [edi]
add esi, edx
push 0
push ecx
mov ecx, esp
push 0x55d34c8a
call 0x562e1114
sti
sbb byte [ecx + 0x56], dh
xlatb
les ebp, [ebp + 0x8c483e2]
xchg dword [ecx + 4], eax
xor eax, edx
shl eax, 3
xor ecx, 0
shl eax, 0x1d
add eax, dword [ecx + 4]
pop ecx
push esi
call fcn.562c7f8a
cmp eax, dword [ebp + 0xc]
pop eax
je 0x562e11b3
add edi, 4
add eax, 2
dec ecx
jne 0x562e10f9
call 0x562e1160
loope 0x562e1156
invalid
sbb esi, ebx
mov edi, 0xdbead58c
js 0x562e11b0
mov dh, 0xe8
or byte [eax], al
add byte [eax], al
mov bh, 0x24
lea eax, [edx + 0x53]
nop
mov dword [esi + 0x2308c483], ecx
sal byte [ecx], 0xc0
fsub st(7)
int 0xf
mov bh, 0
movzx eax, word [eax]
jmp 0x562e11c1
shl eax, 2
add eax, dword [ebx + 0x1c]
add eax, edx
mov eax, dword [eax]
add eax, edx
mov ebx, edx
add ebx, dword [edx + 0x3c]
mov ecx, dword [ebx + 0x7c]
mov ebx, dword [ebx + 0x78]
add ebx, edx
add ecx, ebx
cmp eax, ebx
jb 0x562e1174
cmp eax, ecx
ja 0x562e1174
mov esi, eax
lea edi, [ebp - 0x100]
mov al, byte [esi]
mov byte [edi], al
inc edi
inc esi
js 0x562e11fe
or ecx, ecx
xor dword [esp - 0x6b], eax
cmp al, 0x2e
jne 0x562e11f4
lea edi, [ebp - 0x100]
push 0x100
push edi
push esi
call fcn.562c8469
lea esp, [esp - 0x60]
mov dword [esp + 0x5c], edi
lea esp, [esp + 0x5c]
Function at 0x10001270
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [0x10073a68]
mov dword [ebp - 4], eax
jmp 0x10001289
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 4]
mov dword [ebp - 4], edx
cmp dword [ebp - 4], 0
je 0x100012a6
lea eax, [ebp - 8]
push eax
push 0x40
push 0x10000
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
jmp 0x10001280
mov esp, ebp
pop ebp
ret

Function at 0x100012b0
Capabilities:
Resume thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp dword [0x10073a78], eax
je 0x100012ce
mov eax, 0x10dd
jmp 0x100013af
mov eax, dword [0x10073a88]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x1000134c
lea ecx, [ebp - 0xc]
push ecx
mov edx, dword [ebp - 4]
mov eax, dword [edx + 0x14]
push eax
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 0x10]
movzx eax, byte [edx + 0x36]
push eax
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 0xc]
push edx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov eax, dword [ebp - 4]
cmp dword [eax + 4], 0
jne 0x1000132a
mov ecx, dword [ebp - 4]
cmp dword [ecx + 0x10], 0
je 0x1000132a
mov edx, dword [ebp - 4]
mov eax, dword [edx + 0x10]
push eax
call fcn.10001420
add esp, 4
mov ecx, dword [ebp - 4]
mov dword [ecx + 0x10], 0
mov edx, dword [ebp - 4]
mov eax, dword [edx]
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 4]
mov dword [ebp - 0x18], ecx
mov edx, dword [ebp - 0x18]
push edx
call fcn.1004a0fe
add esp, 4
mov eax, dword [ebp - 8]
mov dword [ebp - 4], eax
jmp 0x100012d6
mov dword [0x10073a88], 0
call fcn.100013c0
mov ecx, dword [0x10073a84]
mov dword [ebp - 0x10], ecx
cmp dword [ebp - 0x10], 0
je 0x10001399
mov edx, dword [ebp - 0x10]
mov eax, dword [edx + 4]
push eax
call dword [sym.imp.KERNEL32.dll_ResumeThread]
mov ecx, dword [ebp - 0x10]
mov edx, dword [ecx]
mov dword [ebp - 0x14], edx
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x1c], eax
mov ecx, dword [ebp - 0x1c]
push ecx
call fcn.1004a0fe
add esp, 4
mov edx, dword [ebp - 0x14]
mov dword [ebp - 0x10], edx
jmp 0x10001364
mov dword [0x10073a84], 0
mov dword [0x10073a78], 0
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x10001920
Capabilities:
Hook routines via microsoft detours

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [ebp + 8]
cmp dword [eax], 0x52727464
je 0x10001935
xor eax, eax
jmp 0x100019aa
mov ecx, dword [ebp + 8]
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 4]
add edx, 0x10000
mov dword [ebp - 8], edx
mov eax, dword [ebp + 8]
add eax, 0x48
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x10], 0
jmp 0x10001962
mov ecx, dword [ebp - 0x10]
add ecx, 1
mov dword [ebp - 0x10], ecx
cmp dword [ebp - 0x10], 0x38d
jae 0x100019a5
mov edx, dword [ebp - 0x10]
imul edx, edx, 0x48
mov eax, dword [ebp - 0xc]
cmp dword [eax + edx + 0x40], 0
je 0x100019a3
mov ecx, dword [ebp - 0x10]
imul ecx, ecx, 0x48
mov edx, dword [ebp - 0xc]
mov eax, dword [edx + ecx + 0x40]
cmp eax, dword [ebp - 4]
jb 0x1000199f
mov ecx, dword [ebp - 0x10]
imul ecx, ecx, 0x48
mov edx, dword [ebp - 0xc]
mov eax, dword [edx + ecx + 0x40]
cmp eax, dword [ebp - 8]
jb 0x100019a3
xor eax, eax
jmp 0x100019aa
jmp 0x10001959
mov eax, 1
mov esp, ebp
pop ebp
ret
Function at 0x10002280
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [ebp + 8]
push eax
call fcn.10002350
add esp, 4
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
cmp ecx, dword [ebp + 0xc]
jae 0x1000233c
cmp dword [ebp - 4], 0x50000000
jb 0x100022bc
cmp dword [ebp - 4], 0x80000000
ja 0x100022bc
mov dword [ebp - 4], 0x80010000
jmp 0x10002295
push 0x1c
push 0
lea edx, [ebp - 0x20]
push edx
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
push 0x1c
lea eax, [ebp - 0x20]
push eax
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
jne 0x100022e2
jmp 0x1000233c
cmp dword [ebp - 0x10], 0x10000
jne 0x10002325
cmp dword [ebp - 0x14], 0x10000
jb 0x10002325
push 0x40
push 0x3000
push 0x10000
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 0
je 0x10002318
mov eax, dword [ebp - 0x24]
jmp 0x1000233e
mov eax, dword [ebp - 4]
add eax, 0x10000
mov dword [ebp - 4], eax
jmp 0x10002337
mov ecx, dword [ebp - 0x20]
add ecx, dword [ebp - 0x14]
push ecx
call fcn.10002350
add esp, 4
mov dword [ebp - 4], eax
jmp 0x10002295
xor eax, eax
mov esp, ebp
pop ebp
ret

Function at 0x10002380
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [ebp + 0xc]
sub eax, 0x10000
push eax
call fcn.10002450
add esp, 4
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
cmp ecx, dword [ebp + 8]
jbe 0x10002444
cmp dword [ebp - 4], 0x50000000
jb 0x100023c1
cmp dword [ebp - 4], 0x80000000
ja 0x100023c1
mov dword [ebp - 4], 0x4fff0000
jmp 0x1000239a
push 0x1c
push 0
lea edx, [ebp - 0x20]
push edx
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
push 0x1c
lea eax, [ebp - 0x20]
push eax
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
jne 0x100023e7
jmp 0x10002444
cmp dword [ebp - 0x10], 0x10000
jne 0x1000242a
cmp dword [ebp - 0x14], 0x10000
jb 0x1000242a
push 0x40
push 0x3000
push 0x10000
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 0
je 0x1000241d
mov eax, dword [ebp - 0x24]
jmp 0x10002446
mov eax, dword [ebp - 4]
sub eax, 0x10000
mov dword [ebp - 4], eax
jmp 0x1000243f
mov ecx, dword [ebp - 0x1c]
sub ecx, 0x10000
push ecx
call fcn.10002450
add esp, 4
mov dword [ebp - 4], eax
jmp 0x1000239a
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x10002480
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov dword [ebp - 0xc], 0
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp dword [0x10073a78], eax
je 0x100024a5
mov eax, 0x10dd
jmp 0x1000263d
cmp dword [0x10073a7c], 0
je 0x100024b8
mov eax, dword [0x10073a7c]
jmp 0x1000263d
cmp dword [ebp + 8], 0
jne 0x100024c8
mov eax, 6
jmp 0x1000263d
mov eax, dword [ebp + 8]
cmp dword [eax], 0
jne 0x100024f1
mov dword [ebp - 0xc], 6
mov ecx, dword [ebp - 0xc]
mov dword [0x10073a7c], ecx
mov edx, dword [ebp + 8]
mov dword [0x10073a80], edx
mov eax, dword [ebp - 0xc]
jmp 0x1000263d
push 0x18
call fcn.100492e0
add esp, 4
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
jne 0x1000254a
mov dword [ebp - 0xc], 8
mov ecx, dword [ebp - 0xc]
mov dword [0x10073a7c], ecx
cmp dword [ebp - 0x18], 0
je 0x10002539
mov edx, dword [ebp - 0x18]
mov dword [ebp - 0x20], edx
mov eax, dword [ebp - 0x20]
push eax
call fcn.1004a0fe
add esp, 4
mov dword [ebp - 0x18], 0
mov ecx, dword [ebp + 8]
mov dword [0x10073a80], ecx
mov eax, dword [ebp - 0xc]
jmp 0x1000263d
push 0
mov edx, dword [ebp + 8]
mov eax, dword [edx]
push eax
call fcn.10001000
mov dword [ebp - 0x10], eax
push 0
mov ecx, dword [ebp + 0xc]
push ecx
call fcn.10001000
mov dword [ebp + 0xc], eax
mov edx, dword [ebp - 0x10]
movzx eax, byte [edx + 0x36]
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 0x10]
mov edx, dword [ecx + 0x40]
sub edx, dword [ebp - 8]
mov dword [ebp - 4], edx
cmp dword [ebp - 8], 0
je 0x1000258a
cmp dword [ebp - 8], 0x1e
jbe 0x100025a6
mov dword [ebp - 0xc], 9
cmp dword [0x10073a70], 0
je 0x100025a1
jmp 0x1000251a
jmp 0x10002511
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax + 0x44]
cmp ecx, dword [ebp + 0xc]
je 0x100025cd
mov dword [ebp - 0xc], 9
cmp dword [0x10073a70], 0
je 0x100025c8
jmp 0x1000251a
jmp 0x10002511
mov dword [ebp - 0x14], 0
lea edx, [ebp - 0x14]
push edx
push 0x40
mov eax, dword [ebp - 8]
push eax
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x100025fa
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0xc], eax
jmp 0x10002511
mov edx, dword [ebp - 0x18]
mov dword [edx + 4], 1
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp + 8]
mov dword [eax + 8], ecx
mov edx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x10]
mov dword [edx + 0x10], eax
mov ecx, dword [ebp - 0x18]
mov edx, dword [ebp - 4]
mov dword [ecx + 0xc], edx
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x14]
mov dword [eax + 0x14], ecx
mov edx, dword [ebp - 0x18]
mov eax, dword [0x10073a88]
mov dword [edx], eax
mov ecx, dword [ebp - 0x18]
mov dword [0x10073a88], ecx
xor eax, eax
mov esp, ebp
pop ebp
ret 8
Function at 0x10007df0
Capabilities:
Resolve dns

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff0
sub esp, 0x78
mov eax, dword [0x1007100c]
xor eax, esp
mov dword [esp + 0x74], eax
push esi
push edi
mov edi, dword [ebp + 8]
xorps xmm0, xmm0
movaps xmmword [esp + 0x10], xmm0
mov eax, edi
movaps xmmword [esp + 0x20], xmm0
mov dword [esp + 0x18], 1
cmp dword [edi + 0x14], 0x10
jb 0x10007e28
mov eax, dword [edi]
lea ecx, [esp + 0xc]
push ecx
lea ecx, [esp + 0x14]
push ecx
push str.http
push eax
call dword [sym.imp.WS2_32.dll_getaddrinfo]
test eax, eax
je 0x10007e94
push 0
push 0x400
push 0x10073a90
push 0x400
push eax
push 0
push 0x12ff
call dword [sym.imp.KERNEL32.dll_FormatMessageA]
push 0x10073a90
push str.getaddrinfo:__s_n
push 2
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
add esp, 4
push eax
call fcn.100066b0
add esp, 0xc
xor al, al
pop edi
pop esi
mov ecx, dword [esp + 0x74]
xor ecx, esp
call fcn.100490d4
mov esp, ebp
pop ebp
ret 4
mov esi, dword [esp + 0xc]
test esi, esi
je 0x10007ec8
nop dword [eax]
mov eax, dword [esi + 0x18]
push dword [eax + 4]
call dword [sym.imp.WS2_32.dll_inet_ntoa]
push eax
lea eax, [esp + 0x34]
push 0x41
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strcpy_s]
mov esi, dword [esi + 0x1c]
add esp, 0xc
test esi, esi
jne 0x10007ea0
mov esi, dword [esp + 0xc]
push esi
call dword [sym.imp.WS2_32.dll_freeaddrinfo]
lea edx, [esp + 0x30]
lea ecx, [edx + 1]
mov al, byte [edx]
inc edx
test al, al
jne 0x10007ed6
sub edx, ecx
lea eax, [esp + 0x30]
push edx
push eax
mov ecx, edi
call fcn.10003980
mov ecx, dword [esp + 0x7c]
mov al, 1
pop edi
pop esi
xor ecx, esp
call fcn.100490d4
mov esp, ebp
pop ebp
ret 4
Function at 0x10008e00
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x14
push ebx
mov ebx, ecx
push esi
push edi
cmp dword [ebx + 0x38], 0
je 0x10008e2c
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____thiscall_std::basic_streambuf_char__struct_std::char_traits_char__::xsputn_char_const___long_long___int64__]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov eax, dword [ebx + 0x20]
mov esi, dword [ebp + 0xc]
mov edi, dword [ebp + 0x10]
mov dword [esp + 0x18], esi
mov eax, dword [eax]
mov dword [esp + 0x1c], edi
mov dword [esp + 0x14], eax
test eax, eax
je 0x10008e4e
mov eax, dword [ebx + 0x30]
mov eax, dword [eax]
jmp 0x10008e50
xor eax, eax
cdq
mov dword [esp + 0xc], eax
mov ecx, edx
mov dword [esp + 0x10], ecx
test edi, edi
jl 0x10008ed5
jg 0x10008e65
test esi, esi
je 0x10008ed5
test ecx, ecx
jl 0x10008eae
jg 0x10008e6f
test eax, eax
je 0x10008eae
cmp edi, ecx
jg 0x10008e83
jl 0x10008e79
cmp esi, eax
jae 0x10008e83
mov eax, esi
mov dword [esp + 0xc], esi
mov dword [esp + 0x10], edi
push eax
push dword [ebp + 8]
push dword [esp + 0x1c]
call sub.VCRUNTIME140.dll_memcpy
mov ecx, dword [esp + 0x18]
add esp, 0xc
mov edx, dword [ebp + 8]
mov eax, dword [ebx + 0x30]
add edx, ecx
sub esi, ecx
sbb edi, dword [esp + 0x10]
sub dword [eax], ecx
mov eax, dword [ebx + 0x20]
add dword [eax], ecx
jmp 0x10008eb1
mov edx, dword [ebp + 8]
test edi, edi
jl 0x10008ed5
jg 0x10008ebb
test esi, esi
je 0x10008ed5
mov eax, dword [ebx + 0x4c]
test eax, eax
je 0x10008ed5
push eax
push esi
push 1
push edx
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
add esp, 0x10
sub esi, eax
sbb edi, 0
mov eax, dword [esp + 0x18]
mov edx, dword [esp + 0x1c]
sub eax, esi
sbb edx, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x10008ef0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x14
push ebx
push esi
push edi
mov edi, ecx
cmp dword [edi + 0x38], 0
je 0x10008f1c
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____thiscall_std::basic_streambuf_char__struct_std::char_traits_char__::xsgetn_char___long_long___int64__]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov eax, dword [edi + 0x1c]
mov esi, dword [ebp + 0xc]
mov ebx, dword [ebp + 0x10]
mov dword [esp + 0x18], esi
mov eax, dword [eax]
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x14], eax
test eax, eax
je 0x10008f3e
mov eax, dword [edi + 0x2c]
mov eax, dword [eax]
jmp 0x10008f40
xor eax, eax
cdq
mov dword [esp + 0xc], eax
mov ecx, edx
mov dword [esp + 0x10], ecx
test ebx, ebx
jl 0x10008fe0
jg 0x10008f5d
test esi, esi
je 0x10008fe0
test ecx, ecx
jl 0x10008faa
jg 0x10008f67
test eax, eax
je 0x10008faa
cmp ebx, ecx
jg 0x10008f7b
jl 0x10008f71
cmp esi, eax
jae 0x10008f7b
mov eax, esi
mov dword [esp + 0xc], esi
mov dword [esp + 0x10], ebx
push eax
push dword [esp + 0x18]
push dword [ebp + 8]
call sub.VCRUNTIME140.dll_memcpy
mov ecx, dword [esp + 0x18]
add esp, 0xc
mov edx, dword [ebp + 8]
mov eax, dword [edi + 0x2c]
add edx, ecx
sub esi, ecx
mov dword [esp + 0xc], edx
sbb ebx, dword [esp + 0x10]
sub dword [eax], ecx
mov eax, dword [edi + 0x1c]
add dword [eax], ecx
jmp 0x10008fb1
mov eax, dword [ebp + 8]
mov dword [esp + 0xc], eax
test ebx, ebx
jl 0x10008fe0
jg 0x10008fbb
test esi, esi
je 0x10008fe0
cmp dword [edi + 0x4c], 0
je 0x10008fe0
mov ecx, edi
call fcn.100096b0
push dword [edi + 0x4c]
push esi
push 1
push dword [esp + 0x18]
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
add esp, 0x10
sub esi, eax
sbb ebx, 0
mov eax, dword [esp + 0x18]
mov edx, dword [esp + 0x1c]
sub eax, esi
pop edi
pop esi
sbb edx, ebx
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x10009320
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
mov eax, dword [0x1007100c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, ecx
cmp ebx, 0xffffffff
jne 0x10009350
pop esi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100490d4
mov esp, ebp
pop ebp
ret 4
mov eax, dword [esi + 0x20]
mov eax, dword [eax]
test eax, eax
je 0x10009380
mov edx, dword [esi + 0x30]
mov edx, dword [edx]
add edx, eax
cmp eax, edx
jae 0x10009380
call dword [sym.imp.MSVCP140.dll_protected:_char____thiscall_std::basic_streambuf_char__struct_std::char_traits_char__::_Pninc_void_]
pop esi
mov byte [eax], bl
mov eax, ebx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100490d4
mov esp, ebp
pop ebp
ret 4
cmp dword [esi + 0x4c], 0
push edi
je 0x10009455
mov edi, dword [esi + 0xc]
lea eax, [esi + 0x3c]
cmp dword [edi], eax
jne 0x100093a9
mov edx, dword [esi + 0x54]
mov ecx, dword [esi + 0x50]
sub edx, ecx
mov dword [edi], ecx
mov eax, dword [esi + 0x1c]
mov dword [eax], ecx
mov eax, dword [esi + 0x2c]
mov dword [eax], edx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x100093b5
movsx eax, bl
jmp 0x100093ec
lea eax, [ebp - 0x2c]
mov byte [ebp - 0x25], bl
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x25]
push eax
lea eax, [esi + 0x40]
push eax
call dword [sym.imp.MSVCP140.dll_public:_int___thiscall_std::codecvt_char__char__struct__Mbstatet_::out_struct__Mbstatet___char_const___char_const___char_const____char___char___char___const]
test eax, eax
js 0x10009455
cmp eax, 1
jle 0x10009416
cmp eax, 3
jne 0x10009455
movsx eax, byte [ebp - 0x25]
push dword [esi + 0x4c]
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
add esp, 8
or ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, ebx
pop edi
pop esi
mov eax, ecx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100490d4
mov esp, ebp
pop ebp
ret 4
mov edi, dword [ebp - 0x2c]
lea eax, [ebp - 0x24]
sub edi, eax
je 0x10009434
push dword [esi + 0x4c]
push edi
push 1
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
add esp, 0x10
cmp edi, eax
jne 0x10009455
lea eax, [ebp - 0x25]
mov byte [esi + 0x3d], 1
cmp dword [ebp - 0x30], eax
je 0x10009455
pop edi
pop esi
mov eax, ebx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100490d4
mov esp, ebp
pop ebp
ret 4
mov ecx, dword [ebp - 4]
or eax, 0xffffffff
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.100490d4
mov esp, ebp
pop ebp
ret 4
Function at 0x100096e0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x1007100c]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, ecx
push edi
cmp dword [esi + 0x38], 0
je 0x10009783
cmp byte [esi + 0x3d], 0
je 0x10009783
mov eax, dword [esi]
push 0xffffffffffffffff
call dword [eax + 0xc]
cmp eax, 0xffffffff
je 0x10009738
mov ecx, dword [esi + 0x38]
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [esi + 0x40]
push eax
call dword [sym.imp.MSVCP140.dll_public:_int___thiscall_std::codecvt_char__char__struct__Mbstatet_::unshift_struct__Mbstatet___char___char___char___const]
sub eax, 0
je 0x1000974a
sub eax, 1
je 0x1000974e
sub eax, 2
je 0x10009783
pop edi
xor al, al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100490d4
mov esp, ebp
pop ebp
ret
mov byte [esi + 0x3d], 0
mov edi, dword [ebp - 0x28]
lea eax, [ebp - 0x24]
sub edi, eax
je 0x1000976c
push dword [esi + 0x4c]
push edi
push 1
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
add esp, 0x10
cmp edi, eax
jne 0x10009738
cmp byte [esi + 0x3d], 0
pop edi
sete al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100490d4
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
mov al, 1
pop edi
xor ecx, ebp
pop esi
call fcn.100490d4
mov esp, ebp
pop ebp
ret
Function at 0x1001cf40
Capabilities:
Hash data with md5
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1004c922
mov eax, dword fs:[0]
push eax
sub esp, 0x49c
mov eax, dword [0x1007100c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x4a4], edi
mov dword [ebp - 0x4a8], edi
mov dword [ebp - 0x4a0], 0
push 0x1005ce64
push edx
mov dword [ebp - 0x488], 0
mov dword [ebp - 0x48c], 0
mov dword [ebp - 0x49c], 0x67452301
mov dword [ebp - 0x498], 0xefcdab89
mov dword [ebp - 0x494], 0x98badcfe
mov dword [ebp - 0x490], 0x10325476
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fopen]
mov esi, eax
add esp, 8
test esi, esi
jne 0x1001cfdb
xor edx, edx
jmp 0x1001d046
mov ebx, dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
lea eax, [ebp - 0x410]
push esi
push 0x400
push 1
push eax
call ebx
add esp, 0x10
test eax, eax
je 0x1001d02b
nop dword [eax]
push eax
lea eax, [ebp - 0x410]
push eax
lea ecx, [ebp - 0x49c]
call fcn.1001cd90
push esi
push 0x400
lea eax, [ebp - 0x410]
push 1
push eax
call ebx
add esp, 0x10
test eax, eax
jne 0x1001d000
lea ecx, [ebp - 0x49c]
call fcn.1001ce40
push esi
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
add esp, 4
lea edx, [ebp - 0x434]
mov ecx, edx
mov dword [edi + 0x10], 0
mov dword [edi + 0x14], 0xf
mov byte [edi], 0
lea esi, [ecx + 1]
nop dword [eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x1001d060
sub ecx, esi
push ecx
push edx
mov ecx, edi
call fcn.10003980
mov dword [ebp - 4], 0
mov dword [ebp - 0x4a0], 1
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.100490d4
mov esp, ebp
pop ebp
ret
Function at 0x1001d0b0
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1004c972
mov eax, dword fs:[0]
push eax
sub esp, 0x9c
mov eax, dword [0x1007100c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0xa4], esi
mov ecx, edx
mov dword [ebp - 0xa8], esi
mov dword [ebp - 0xa0], 0
lea edi, [ecx + 1]
nop word [eax + eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x1001d100
sub ecx, edi
cmp ecx, 1
jae 0x1001d131
push 0
mov dword [esi + 0x10], 0
mov ecx, esi
mov dword [esi + 0x14], 0xf
push 0x1005766d
mov byte [esi], al
call fcn.10003980
jmp 0x1001d1c5
mov ecx, edx
mov dword [ebp - 0x88], 0
mov dword [ebp - 0x8c], 0
mov dword [ebp - 0x9c], 0x67452301
mov dword [ebp - 0x98], 0xefcdab89
mov dword [ebp - 0x94], 0x98badcfe
lea edi, [ecx + 1]
mov dword [ebp - 0x90], 0x10325476
mov al, byte [ecx]
inc ecx
test al, al
jne 0x1001d172
sub ecx, edi
push ecx
push edx
lea ecx, [ebp - 0x9c]
call fcn.1001cd90
lea ecx, [ebp - 0x9c]
call fcn.1001ce40
lea ecx, [ebp - 0x34]
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0xf
lea edx, [ecx + 1]
mov byte [esi], 0
nop word [eax + eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x1001d1b0
sub ecx, edx
lea eax, [ebp - 0x34]
push ecx
push eax
mov ecx, esi
call fcn.10003980
mov dword [ebp - 4], 0
mov dword [ebp - 0xa0], 1
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.100490d4
mov esp, ebp
pop ebp
ret