joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10002768
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x168
mov eax, dword [ebp + 8]
xor ecx, ecx
mov dword [0x10035264], 0x2b8
mov edx, ecx
mov dword [ebp - 0x130], eax
mov dword [ebp - 0x134], edx
mov dword [ebp - 0x138], ecx
mov eax, dword [ebp - 0x138]
mov ecx, dword [ebp - 0x134]
lea edx, section..data
mov esi, eax
add esi, 1
imul edi, eax, 0x90
mov ebx, edx
add ebx, edi
add ebx, 0x8c
imul eax, eax, 0x90
add edx, eax
add edx, 0x54
mov eax, dword [ebx]
movzx edx, word [edx]
xor edx, eax
add edx, ecx
cmp esi, 0x53d
mov eax, edx
mov dword [ebp - 0x134], eax
mov dword [ebp - 0x13c], edx
mov dword [ebp - 0x138], esi
jne 0x10002797
lea eax, str.xQV
mov ecx, 0xe
lea edx, [ebp - 0x12c]
mov dword [0x10035264], 0x187f
mov dword [esp], edx
mov dword [esp + 4], eax
mov dword [esp + 8], 0xe
mov dword [ebp - 0x140], edx
mov dword [ebp - 0x144], ecx
call fcn.10001d12
mov dword [0x10035264], 0xb6a
call fcn.10002e94
mov dword [esp], eax
mov eax, dword [ebp - 0x140]
mov dword [esp + 4], eax
call fcn.10001f3d
mov ecx, eax
mov dword [0x10035284], eax
mov eax, esp
mov edx, dword [ebp - 0x13c]
mov dword [eax + 4], edx
mov dword [eax + 0xc], 4
mov dword [eax + 8], 0x1000
mov dword [eax], 0
call ecx
sub esp, 0x10
xor ecx, ecx
mov edx, dword [0x10035264]
add edx, 0x5b1
mov dword [0x10035268], edx
mov edx, ecx
mov dword [ebp - 0x148], eax
mov dword [ebp - 0x14c], edx
mov dword [ebp - 0x150], ecx
mov eax, dword [ebp - 0x150]
mov ecx, dword [ebp - 0x14c]
lea edx, section..data
imul esi, eax, 0x90
mov edi, edx
add edi, esi
add edi, 0x8c
mov esi, dword [edi]
imul edi, eax, 0x90
mov ebx, edx
add ebx, edi
mov edi, dword [ebx]
imul ebx, eax, 0x90
add edx, ebx
add edx, 0x54
movzx edx, word [edx]
xor edx, esi
mov esi, dword [ebp - 0x148]
add esi, ecx
mov dword [esp], esi
mov dword [esp + 4], edi
mov dword [esp + 8], edx
mov dword [ebp - 0x154], eax
mov dword [ebp - 0x158], ecx
mov dword [ebp - 0x15c], edx
call fcn.100033cb
mov eax, dword [ebp - 0x15c]
mov ecx, dword [ebp - 0x158]
add eax, ecx
mov edx, dword [ebp - 0x154]
add edx, 1
cmp edx, 0x53d
mov dword [ebp - 0x14c], eax
mov dword [ebp - 0x150], edx
jne 0x100028a3
lea eax, [0x10005245]
mov ecx, 0x20
lea edx, [ebp - 0x10c]
mov dword [0x10035264], 0xf62
mov dword [esp], edx
mov dword [esp + 4], eax
mov dword [esp + 8], 0x20
mov dword [ebp - 0x160], edx
mov dword [ebp - 0x164], ecx
call fcn.10002ff3
mov dword [0x10035268], 0x218a
mov eax, dword [ebp - 0x160]
mov dword [esp], eax
mov ecx, dword [ebp - 0x148]
mov dword [esp + 4], ecx
mov dword [esp + 8], ecx
mov edx, dword [ebp - 0x13c]
mov dword [esp + 0xc], edx
call fcn.10002bf3
xor eax, eax
mov dword [0x10035264], 0x22f7
mov ecx, dword [ebp - 0x148]
add ecx, 0x79031
mov edx, dword [ebp - 0x130]
mov dword [edx], ecx
mov dword [edx + 4], 0x12b800
mov ecx, dword [ebp - 0x148]
add ecx, 0x1e552
mov dword [edx + 8], ecx
mov dword [edx + 0xc], 0x1f60
mov dword [0x10035268], 0x1607
add esp, 0x168
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x10002a5d
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push esi
and esp, 0xfffffff8
sub esp, 0x98
mov dword [0x10035268], 0x103f
call fcn.1000108b
xor ecx, ecx
cmp eax, 0
mov dword [esp + 0x24], ecx
je 0x10002aaf
jmp 0x10002be9
mov eax, dword [esp + 0x20]
mov dword [esp + 0x24], eax
jmp 0x10002be9
mov eax, dword [esp + 0x1c]
add eax, 0xfffff000
and eax, 0xfffff000
mov dword [esp + 0x18], eax
jmp 0x10002b50
lea eax, [esp + 0x38]
mov dword [0x10035264], 0x20bd
mov dword [0x10035268], 0x1999
mov dword [esp + 0x14], eax
call fcn.10002336
xor ecx, ecx
cmp eax, 0
mov dword [esp + 0x20], ecx
jne 0x10002a8b
lea eax, [esp + 0x28]
mov dword [esp], eax
call fcn.10002768
lea ecx, [0x100025c8]
mov edx, dword [esp + 0x28]
mov dword [esp + 0x68], edx
mov dword [esp + 0x54], 0x12b800
mov edx, dword [0x10035250]
mov dword [esp + 0x38], edx
mov edx, dword [0x10035254]
mov dword [esp + 0x74], edx
mov edx, dword [0x10035258]
mov dword [esp + 0x6c], edx
mov edx, dword [0x1003525c]
mov dword [esp + 0x5c], edx
mov dword [0x10035268], 0x18fe
mov edx, dword [0x10035260]
mov dword [esp + 0x84], edx
mov dword [0x10035264], 0xec1
mov dword [esp + 0x10], eax
mov dword [esp + 0x18], ecx
mov eax, dword [esp + 0x18]
cmp word [eax], 0x5a4d
mov dword [esp + 0x1c], eax
jne 0x10002a98
mov eax, dword [esp + 0x1c]
mov ecx, dword [eax + 0x3c]
cmp dword [eax + ecx], 0x4550
mov dword [esp + 0xc], ecx
jne 0x10002a98
lea eax, [esp + 0x38]
mov ecx, dword [esp + 0x1c]
mov dword [esp + 0x64], ecx
mov edx, dword [esp + 0xc]
mov esi, dword [ecx + edx + 0x50]
mov dword [esp + 0x8c], esi
mov dword [0x10035264], 0x2870
mov dword [0x10035268], 0x604
mov esi, dword [esp + 0x30]
mov dword [esp], eax
mov dword [esp + 4], esi
call fcn.1000262f
mov dword [0x10035268], 0xe81
mov ecx, esp
lea edx, [esp + 0x38]
mov dword [ecx], edx
call eax
sub esp, 4
mov eax, 1
mov dword [0x10035264], 0x216c
mov dword [esp + 0x20], eax
jmp 0x10002a8b
mov eax, dword [esp + 0x24]
lea esp, [ebp - 4]
pop esi
pop ebp
ret
Function at 0x10002bf3
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x34
mov eax, dword [ebp + 0x14]
mov ecx, dword [ebp + 0x10]
mov edx, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
xor edi, edi
mov dword [0x1003526c], 0
mov dword [0x10035270], 0
mov dword [0x1003527c], 0
mov ebx, dword [0x10035268]
mov dword [ebp - 0x10], eax
mov eax, ebx
add eax, 0x2109
mov dword [0x10035264], eax
mov eax, dword [ebp - 0x10]
cmp eax, 0
mov eax, edi
mov dword [ebp - 0x14], eax
mov eax, edi
mov dword [ebp - 0x18], eax
mov eax, ebx
mov dword [ebp - 0x1c], edi
mov dword [ebp - 0x20], ecx
mov dword [ebp - 0x24], edx
mov dword [ebp - 0x28], esi
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x30], ebx
je 0x10002dc8
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x2c]
mov edx, dword [ebp - 0x18]
mov esi, dword [ebp - 0x14]
mov edi, 0x100
add ecx, 0xffffe410
mov dword [0x10035268], ecx
add edx, 1
mov dword [ebp - 0x34], eax
mov eax, edx
cdq
idiv edi
mov dword [0x1003526c], edx
mov dword [0x10035264], 0x1d0b
mov ecx, dword [ebp - 0x28]
movzx ebx, byte [ecx + edx]
add ebx, esi
mov eax, ebx
mov dword [ebp - 0x38], edx
cdq
idiv edi
mov dword [0x10035270], edx
mov dword [0x10035264], 0x6e1
mov esi, dword [ebp - 0x38]
mov cl, byte [ecx + esi]
mov byte [0x10035274], cl
mov dword [0x10035264], 0x20dc
mov edi, dword [ebp - 0x28]
mov cl, byte [edi + edx]
mov byte [edi + esi], cl
mov dword [0x10035268], 0x1432
mov cl, byte [0x10035274]
mov edx, dword [0x10035270]
mov byte [edi + edx], cl
mov dword [0x10035264], 0x1c97
mov edx, dword [0x1003526c]
movzx edx, byte [edi + edx]
mov ebx, dword [0x10035270]
movzx ebx, byte [edi + ebx]
add ebx, edx
and ebx, 0xff
mov dword [0x1003527c], ebx
mov dword [0x10035264], 0x1f96
mov cl, byte [edi + ebx]
mov edx, dword [ebp - 0x20]
mov ebx, dword [ebp - 0x34]
mov ch, byte [edx + ebx]
mov edx, dword [0x10035268]
mov bl, cl
add bl, byte [0x10035281]
mov byte [0x10035280], bl
mov byte [0x10035281], ch
mov byte [0x10035282], cl
xor ch, cl
add edx, 0x1655
mov dword [0x10035264], edx
mov edx, dword [ebp - 0x24]
mov esi, dword [ebp - 0x34]
mov byte [edx + esi], ch
mov edx, dword [0x10035264]
add edx, 0xfffff287
mov dword [0x10035264], edx
add esi, 1
mov edx, dword [0x10035268]
mov edi, dword [ebp - 0x10]
cmp esi, edi
mov edi, edx
mov dword [ebp - 0x3c], esi
mov dword [ebp - 0x30], edi
mov dword [ebp - 0x40], edx
je 0x10002dc8
mov eax, dword [0x10035270]
mov ecx, dword [0x1003526c]
mov edx, dword [ebp - 0x40]
mov esi, dword [ebp - 0x3c]
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x2c], edx
mov dword [ebp - 0x1c], esi
jmp 0x10002c69
mov eax, dword [ebp - 0x30]
add eax, 0xffffe688
mov dword [0x10035264], eax
add esp, 0x34
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x10002ff3
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x20
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
xor esi, esi
mov dword [0x10035270], 0
mov byte [0x10035274], 0
mov edi, dword [0x10035268]
add edi, 0xffffec05
mov dword [0x10035268], edi
mov dword [0x10035264], 0x1b2c
mov dword [0x1003526c], 0
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x18], edx
mov dword [ebp - 0x1c], esi
jmp 0x1000305e
mov dword [0x10035268], 0x504
add esp, 0x20
pop esi
pop edi
pop ebx
pop ebp
ret
mov eax, dword [ebp - 0x1c]
mov ecx, eax
mov dl, cl
mov ecx, dword [ebp - 0x18]
mov byte [ecx + eax], dl
mov eax, dword [0x10035264]
add eax, 0xffffffd9
mov dword [0x10035264], eax
mov eax, dword [0x1003526c]
add eax, 1
mov dword [0x1003526c], eax
cmp eax, 0x100
mov dword [ebp - 0x1c], eax
jl 0x1000305e
mov dword [0x10035264], 0x111f
mov dword [0x1003526c], 0
xor eax, eax
mov ecx, dword [0x10035268]
add ecx, 0xad6
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x24], ecx
mov eax, dword [ebp - 0x24]
mov ecx, dword [ebp - 0x20]
mov edx, 0x2789
mov esi, 0x100
mov dword [ebp - 0x28], eax
mov eax, ecx
xor edi, edi
mov dword [ebp - 0x2c], edx
mov edx, edi
mov edi, dword [ebp - 0x10]
div edi
mov dword [0x10035278], 0
mov ebx, dword [0x10035270]
mov edi, dword [ebp - 0x18]
movzx edi, byte [edi + ecx]
add edi, ebx
mov ebx, dword [ebp - 0x14]
movzx edx, byte [ebx + edx]
add edi, edx
mov dword [0x10035278], edi
mov eax, edi
cdq
idiv esi
mov dword [0x10035270], edx
mov esi, dword [ebp - 0x28]
mov dword [0x10035264], esi
mov esi, dword [ebp - 0x18]
mov bl, byte [esi + ecx]
mov byte [0x10035274], bl
mov dword [0x10035264], 0xde8
mov bl, byte [esi + edx]
mov byte [esi + ecx], bl
mov dword [0x10035264], 0x246f
mov bl, byte [0x10035274]
mov ecx, dword [0x10035270]
mov byte [esi + ecx], bl
mov ecx, dword [0x10035264]
add ecx, 0xffffe7c0
mov dword [0x10035264], ecx
mov dword [0x10035268], 0x1cb3
mov ecx, dword [0x1003526c]
add ecx, 1
mov dword [0x1003526c], ecx
cmp ecx, 0x100
mov edx, dword [ebp - 0x2c]
mov dword [ebp - 0x20], ecx
mov dword [ebp - 0x24], edx
jl 0x100030bb
jmp 0x1000304c
Function at 0x1003c500
Capabilities:
Encode data using xor
Encrypt data using aes via x86 extensions

Disassembly:
push ebp
push ebx
test eax, eax
je 0x1003ca20
test edx, edx
je 0x1003ca20
call fcn.1003c517
mov eax, 0xffffffff
pop ebx
pop ebp
ret

Function at 0x1003ca60
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
mov eax, dword [esp + 4]
mov ecx, dword [esp + 8]
mov edx, dword [esp + 0xc]
call fcn.1003c500
mov edx, dword [esp + 0xc]
shl ecx, 4
test eax, eax
jne 0x1003cad1
lea eax, [edx + ecx + 0x10]
movups xmm0, xmmword [edx]
movups xmm1, xmmword [eax]
movups xmmword [eax], xmm0
movups xmmword [edx], xmm1
lea edx, [edx + 0x10]
lea eax, [eax - 0x10]
movups xmm0, xmmword [edx]
movups xmm1, xmmword [eax]
aesimc xmm0, xmm0
aesimc xmm1, xmm1
lea edx, [edx + 0x10]
lea eax, [eax - 0x10]
movups xmmword [eax + 0x10], xmm0
movups xmmword [edx - 0x10], xmm1
cmp eax, edx
ja 0x1003ca96
movups xmm0, xmmword [edx]
aesimc xmm0, xmm0
movups xmmword [edx], xmm0
pxor xmm0, xmm0
pxor xmm1, xmm1
xor eax, eax
ret

Function at 0x1003d3e0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
push ebx
push esi
push edi
sub esp, 0x10
mov ebp, dword [esp + 0x24]
mov esi, dword [esp + 0x28]
mov edi, dword [esp + 0x2c]
mov eax, dword [esi]
mov ebx, dword [esi + 4]
mov ecx, dword [esi + 8]
mov edx, dword [esi + 0xc]
bswap eax
bswap ebx
bswap ecx
bswap edx
mov dword [edi], eax
mov dword [edi + 4], ebx
mov dword [edi + 8], ecx
mov dword [edi + 0xc], edx
cmp ebp, 0x80
je 0x1003d464
mov eax, dword [esi + 0x10]
mov ebx, dword [esi + 0x14]
cmp ebp, 0xc0
je 0x1003d43c
mov ecx, dword [esi + 0x18]
mov edx, dword [esi + 0x1c]
jmp 0x1003d444
mov ecx, eax
mov edx, ebx
not ecx
not edx
bswap eax
bswap ebx
bswap ecx
bswap edx
mov dword [edi + 0x20], eax
mov dword [edi + 0x24], ebx
mov dword [edi + 0x28], ecx
mov dword [edi + 0x2c], edx
xor eax, dword [edi]
xor ebx, dword [edi + 4]
xor ecx, dword [edi + 8]
xor edx, dword [edi + 0xc]
nop
call fcn.1003d469

Function at 0x1004f380
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x102c5550
mov eax, dword fs:[0]
push eax
push esi
push edi
mov eax, dword [0x1066bbc0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esi], vtable.CryptoPP::FilterWithBufferedInput.0
mov dword [esi + 4], vtable.CryptoPP::FilterWithBufferedInput.1.0
mov dword [ebp - 4], 0
mov eax, dword [esi + 0x2c]
mov ecx, dword [esi + 0x30]
cmp eax, ecx
mov edx, dword [esi + 0x34]
mov edi, edx
cmovb ecx, eax
xor al, al
rep stosb byte es:[edi], al
push edx
call sub.api_ms_win_crt_heap_l1_1_0.dll_free
mov ecx, dword [esi + 0xc]
add esp, 4
test ecx, ecx
je 0x1004f3e4
mov eax, dword [ecx]
push 1
call dword [eax]
test byte [ebp + 8], 1
je 0x1004f3f5
push 0x48
push esi
call fcn.102c1b57
add esp, 8
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x10054e70
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x102c5ca6
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x1066bbc0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x10], edi
mov esi, dword [ebp + 8]
lea ecx, [edi + 0x18]
mov eax, dword [esi]
mov dword [edi], eax
mov eax, dword [esi + 4]
mov dword [edi + 4], eax
mov eax, dword [esi + 8]
mov dword [edi + 8], eax
mov eax, dword [esi + 0xc]
mov dword [edi + 0xc], eax
mov eax, dword [esi + 0x10]
mov dword [edi + 0x10], eax
movzx eax, byte [esi + 0x14]
mov byte [edi + 0x14], al
movzx eax, byte [esi + 0x15]
mov byte [edi + 0x15], al
movzx eax, byte [esi + 0x16]
mov byte [edi + 0x16], al
lea eax, [esi + 0x18]
push eax
call fcn.10052460
lea eax, [esi + 0x30]
mov dword [ebp - 4], 0
lea ecx, [edi + 0x30]
push eax
call fcn.10052460
lea eax, [esi + 0x48]
mov byte [ebp - 4], 1
lea ecx, [edi + 0x48]
push eax
call fcn.10052460
lea eax, [esi + 0x60]
mov byte [ebp - 4], 2
push eax
lea ecx, [edi + 0x60]
call fcn.10052460
movups xmm0, xmmword [esi + 0x78]
movups xmmword [edi + 0x78], xmm0
mov eax, dword [esi + 0x88]
mov dword [edi + 0x88], eax
mov eax, dword [esi + 0x8c]
mov dword [edi + 0x8c], eax
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x100b5eb0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x1c
push ebx
mov ebx, ecx
push esi
push edi
cmp dword [ebx + 0x38], 0
je 0x100b5edc
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____thiscall_std::basic_streambuf_char__struct_std::char_traits_char__::xsputn_char_const___long_long___int64__]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov eax, dword [ebx + 0x20]
mov esi, dword [ebp + 0xc]
mov edi, dword [ebp + 0x10]
mov dword [esp + 0x20], esi
mov ecx, dword [eax]
lea eax, [ebx + 0x30]
mov dword [esp + 0x24], edi
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x18], eax
test ecx, ecx
je 0x100b5f04
mov eax, dword [eax]
mov ecx, dword [eax]
jmp 0x100b5f0a
xor ecx, ecx
mov dword [esp + 0x18], eax
mov eax, ecx
cdq
mov dword [esp + 0x10], eax
mov ecx, edx
mov dword [esp + 0x14], ecx
test edi, edi
jl 0x100b5f72
jg 0x100b5f21
test esi, esi
je 0x100b5f72
test ecx, ecx
jl 0x100b5f6d
jg 0x100b5f2b
test eax, eax
je 0x100b5f6d
cmp edi, ecx
jg 0x100b5f3f
jl 0x100b5f35
cmp esi, eax
jae 0x100b5f3f
mov eax, esi
mov dword [esp + 0x10], esi
mov dword [esp + 0x14], edi
push eax
push dword [ebp + 8]
push dword [esp + 0x24]
call sub.VCRUNTIME140.dll_memcpy
mov eax, dword [esp + 0x24]
add esp, 0xc
mov edx, dword [esp + 0x10]
mov ecx, dword [ebp + 8]
add ecx, edx
sub esi, edx
mov eax, dword [eax]
sbb edi, dword [esp + 0x14]
sub dword [eax], edx
mov eax, dword [ebx + 0x20]
add dword [eax], edx
jmp 0x100b5f75
mov ecx, dword [ebp + 8]
jmp 0x100b5f7f
mov ecx, dword [ebp + 8]
test edi, edi
jl 0x100b5f99
jg 0x100b5f7f
test esi, esi
je 0x100b5f99
mov eax, dword [ebx + 0x4c]
test eax, eax
je 0x100b5f99
push eax
push esi
push 1
push ecx
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
add esp, 0x10
sub esi, eax
sbb edi, 0
mov eax, dword [esp + 0x20]
mov edx, dword [esp + 0x24]
sub eax, esi
sbb edx, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x100b5fb0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [ebp + 0x10]
push ebx
mov ebx, ecx
mov ecx, dword [ebp + 0xc]
push esi
mov esi, dword [ebp + 8]
mov dword [ebp - 4], esi
test eax, eax
jg 0x100b5fdc
jl 0x100b5fd0
test ecx, ecx
jne 0x100b5fdc
pop esi
xor eax, eax
xor edx, edx
pop ebx
mov esp, ebp
pop ebp
ret 0xc
cmp dword [ebx + 0x38], 0
je 0x100b5ff5
push eax
push ecx
push esi
mov ecx, ebx
call dword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____thiscall_std::basic_streambuf_char__struct_std::char_traits_char__::xsgetn_char___long_long___int64__]
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov eax, dword [ebx + 0x1c]
push edi
mov edi, ecx
mov eax, dword [eax]
mov dword [ebp - 8], eax
test eax, eax
je 0x100b6043
mov eax, dword [ebx + 0x2c]
lea edx, [ebx + 0x2c]
mov dword [ebp - 0xc], edx
mov eax, dword [eax]
test eax, eax
je 0x100b6049
mov edi, dword [ebp - 4]
cmp eax, ecx
mov esi, ecx
cmovb esi, eax
push esi
push dword [ebp - 8]
push edi
call sub.VCRUNTIME140.dll_memcpy
mov eax, dword [ebx + 0x2c]
add edi, esi
mov dword [ebp - 4], edi
add esp, 0xc
mov edi, dword [ebp + 0xc]
sub edi, esi
sub dword [eax], esi
mov eax, dword [ebx + 0x1c]
add dword [eax], esi
mov esi, dword [ebp - 4]
jmp 0x100b6049
lea eax, [ebx + 0x2c]
mov dword [ebp - 0xc], eax
cmp dword [ebx + 0x4c], 0
je 0x100b60b6
mov ecx, dword [ebx + 0xc]
lea eax, [ebx + 0x3c]
cmp dword [ecx], eax
jne 0x100b6072
mov eax, dword [ebx + 0xc]
mov edx, dword [ebx + 0x54]
mov ecx, dword [ebx + 0x50]
sub edx, ecx
mov dword [eax], ecx
mov eax, dword [ebx + 0x1c]
mov dword [eax], ecx
mov eax, dword [ebp - 0xc]
mov eax, dword [eax]
mov dword [eax], edx
mov eax, dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
cmp edi, 0xfff
jbe 0x100b60a4
nop
push dword [ebx + 0x4c]
push 0xfff
push 1
push esi
call eax
add esp, 0x10
add esi, eax
sub edi, eax
cmp eax, 0xfff
jne 0x100b60b6
cmp edi, eax
mov eax, dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
ja 0x100b6080
test edi, edi
je 0x100b60b6
push dword [ebx + 0x4c]
push edi
push 1
push esi
call eax
add esp, 0x10
sub edi, eax
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 0x10]
sub eax, edi
pop edi
pop esi
sbb edx, 0
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x100b6440
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
mov eax, dword [0x1066bbc0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, ecx
cmp ebx, 0xffffffff
jne 0x100b6470
pop esi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.102c15f2
mov esp, ebp
pop ebp
ret 4
mov eax, dword [esi + 0x20]
push edi
mov ecx, dword [eax]
test ecx, ecx
je 0x100b64ac
mov edx, dword [esi + 0x30]
mov edi, dword [edx]
lea eax, [edi + ecx]
cmp ecx, eax
jae 0x100b64ac
lea ecx, [edi - 1]
mov eax, ebx
mov dword [edx], ecx
mov edx, dword [esi + 0x20]
pop edi
mov esi, dword [edx]
lea ecx, [esi + 1]
mov dword [edx], ecx
mov byte [esi], bl
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.102c15f2
mov esp, ebp
pop ebp
ret 4
cmp dword [esi + 0x4c], 0
je 0x100b6583
mov edi, dword [esi + 0xc]
lea eax, [esi + 0x3c]
cmp dword [edi], eax
jne 0x100b64d4
mov edx, dword [esi + 0x54]
mov ecx, dword [esi + 0x50]
sub edx, ecx
mov dword [edi], ecx
mov eax, dword [esi + 0x1c]
mov dword [eax], ecx
mov eax, dword [esi + 0x2c]
mov dword [eax], edx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x100b64e0
movsx eax, bl
jmp 0x100b6518
lea eax, [ebp - 0x2c]
mov byte [ebp - 0x25], bl
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x25]
push eax
lea eax, [esi + 0x40]
push eax
call dword [sym.imp.MSVCP140.dll_public:_int___thiscall_std::codecvt_char__char__struct__Mbstatet_::out_struct__Mbstatet___char_const___char_const___char_const____char___char___char___const]
sub eax, 0
je 0x100b6542
sub eax, 1
je 0x100b6542
sub eax, 2
jne 0x100b6583
movsx eax, byte [ebp - 0x25]
push dword [esi + 0x4c]
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
add esp, 8
or ecx, 0xffffffff
cmp eax, ecx
cmove ebx, ecx
pop edi
pop esi
mov eax, ebx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.102c15f2
mov esp, ebp
pop ebp
ret 4
mov edi, dword [ebp - 0x2c]
lea eax, [ebp - 0x24]
sub edi, eax
je 0x100b6560
push dword [esi + 0x4c]
push edi
push 1
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
add esp, 0x10
cmp edi, eax
jne 0x100b6583
lea ecx, [ebp - 0x25]
mov byte [esi + 0x3d], 1
or eax, 0xffffffff
cmp dword [ebp - 0x30], ecx
pop edi
pop esi
cmovne eax, ebx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.102c15f2
mov esp, ebp
pop ebp
ret 4
mov ecx, dword [ebp - 4]
or eax, 0xffffffff
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.102c15f2
mov esp, ebp
pop ebp
ret 4