joyce8/EMBER2024-capa huggingface dataset:
Function at 0x454ae0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x454c02
sub esp, 0x4c
mov eax, dword [esp + 0x64]
test eax, eax
jle 0x454bfb
mov ecx, dword [esp + 0x60]
mov dword [esp + 0x40], ecx
mov eax, dword [0x509e48]
mov dword [esp], eax
call dbg.syscall.(*LazyProc).Addr
mov eax, dword [esp + 4]
mov ecx, dword [esp + 0x40]
mov dword [esp + 0x48], ecx
mov ecx, dword [esp + 0x6c]
mov dword [esp + 0x44], ecx
mov dword [esp], eax
mov dword [esp + 4], 7
mov eax, dword [esp + 0x50]
mov dword [esp + 8], eax
mov eax, dword [esp + 0x54]
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0x58]
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x5c]
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x48]
mov dword [esp + 0x18], eax
mov eax, dword [esp + 0x64]
mov dword [esp + 0x1c], eax
mov eax, dword [esp + 0x44]
mov dword [esp + 0x20], eax
mov dword [esp + 0x24], 0
mov dword [esp + 0x28], 0
call dbg.syscall.Syscall9
mov eax, dword [esp + 0x2c]
mov ecx, dword [esp + 0x34]
test eax, eax
jne 0x454bf5
test ecx, ecx
je 0x454be7
cmp ecx, 0x3e5
jne 0x454bbb
mov ecx, dword [0x507710]
mov edx, dword [0x507714]
mov dword [esp + 0x70], eax
mov dword [esp + 0x74], ecx
mov dword [esp + 0x78], edx
add esp, 0x4c
ret
mov dword [esp + 0x38], eax
mov dword [esp + 0x3c], ecx
lea eax, [0x4fb730]
mov dword [esp], eax
lea eax, [esp + 0x3c]
mov dword [esp + 4], eax
call dbg.runtime.convT2I32
mov ecx, dword [esp + 8]
mov edx, dword [esp + 0xc]
mov eax, dword [esp + 0x38]
jmp 0x454bab
lea edx, [0x4b67d0]
lea ecx, [0x4fb730]
jmp 0x454bab
xor ecx, ecx
mov edx, ecx
jmp 0x454bab
xor ecx, ecx
jmp 0x454b09
call dbg.runtime.morestack_noctxt
jmp dbg.syscall.formatMessage
Function at 0x455500
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x45560c
sub esp, 0x4c
mov eax, dword [0x509f7c]
mov dword [esp], eax
call dbg.syscall.(*LazyProc).Addr
mov eax, dword [esp + 4]
mov ecx, dword [esp + 0x58]
mov dword [esp + 0x48], ecx
mov ecx, dword [esp + 0x60]
mov dword [esp + 0x44], ecx
mov ecx, dword [esp + 0x68]
mov dword [esp + 0x40], ecx
mov ecx, dword [esp + 0x6c]
mov dword [esp + 0x3c], ecx
mov dword [esp], eax
mov dword [esp + 4], 9
mov eax, dword [esp + 0x50]
mov dword [esp + 8], eax
mov eax, dword [esp + 0x54]
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0x48]
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x5c]
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x44]
mov dword [esp + 0x18], eax
mov eax, dword [esp + 0x64]
mov dword [esp + 0x1c], eax
mov eax, dword [esp + 0x40]
mov dword [esp + 0x20], eax
mov eax, dword [esp + 0x3c]
mov dword [esp + 0x24], eax
mov eax, dword [esp + 0x70]
mov dword [esp + 0x28], eax
call dbg.syscall.Syscall9
mov eax, dword [esp + 0x2c]
mov ecx, dword [esp + 0x34]
cmp eax, 0xffffffff
jne 0x455606
test ecx, ecx
je 0x4555f8
cmp ecx, 0x3e5
jne 0x4555d4
mov eax, dword [0x507710]
mov ecx, dword [0x507714]
mov dword [esp + 0x74], eax
mov dword [esp + 0x78], ecx
add esp, 0x4c
ret
mov dword [esp + 0x38], ecx
lea eax, [0x4fb730]
mov dword [esp], eax
lea eax, [esp + 0x38]
mov dword [esp + 4], eax
call dbg.runtime.convT2I32
mov eax, dword [esp + 8]
mov ecx, dword [esp + 0xc]
jmp 0x4555c8
lea ecx, [0x4b67b8]
lea eax, [0x4fb730]
jmp 0x4555c8
xor ecx, ecx
mov eax, ecx
jmp 0x4555c8
call dbg.runtime.morestack_noctxt
jmp dbg.syscall.WSAIoctl
Function at 0x106ec
Capabilities:
Packed with generic packer

Disassembly:
push 8
push 0x10f38
call fcn.00010a1c
jne 0x106fa
mov esi, esi
push ecx
pop ecx
mov esi, esi
mov ebx, ebx
pushfd
popfd
jne 0x10706
je 0x10708
push ebx
pop ebx
push esi
pop esi
mov ecx, ecx
mov edx, edx
mov edi, edi
push edx
pop edx
push eax
pop eax
jmp 0x10718
xor edi, edi
mov dword [ebp - 4], edi
cmp dword [0x10fa4], edi
je 0x10760
push esi
pop esi
mov esi, esi
mov eax, eax
mov ecx, ecx
mov eax, eax
push edx
pop edx
push ebx
pop ebx
mov esi, esi
mov ecx, ecx
jmp 0x10739
mov edi, edi
mov ecx, ecx
push ebx
pop ebx
push ecx
pop ecx
push ecx
pop ecx
mov ebx, ebx
pushal
popal
mov edx, edx
mov ecx, ecx
jne 0x1074d
push esi
pop esi
push ecx
pop ecx
push esi
pop esi
push edx
pop edx
mov ecx, dword [0x10fa4]
jmp 0x108bb
je 0x10762
jmp 0x10764
pushfd
popfd
je 0x10768
push eax
pop eax
push ecx
pop ecx
mov eax, eax
push eax
pop eax
push eax
pop eax
push eax
pop eax
mov esi, esi
je 0x10778
pushfd
popfd
push ecx
pop ecx
mov ecx, ecx
jmp 0x10780
push esi
pop esi
jmp 0x10784
je 0x10786
mov eax, eax
je 0x1078a
push ebx
pop ebx
mov edx, edx
mov edi, edi
push 0x10d6e
call fcn.00010614
mov esi, eax
mov ecx, ecx
push eax
pop eax
push edx
pop edx
push esi
pop esi
pushfd
popfd
push ebx
pop ebx
push ebx
pop ebx
mov ecx, ecx
mov edi, edi
push esi
pop esi
push eax
pop eax
push edx
pop edx
mov ecx, ecx
push ebx
pop ebx
push ecx
pop ecx
push esi
pop esi
cmp esi, edi
jne 0x107f5
jmp 0x107c2
push eax
pop eax
mov eax, eax
push edx
pop edx
pushal
popal
mov edx, edx
push esi
pop esi
push eax
pop eax
push eax
pop eax
push esi
pop esi
push ecx
pop ecx
pushal
popal
mov ebx, ebx
mov edx, edx
mov eax, eax
mov ebx, ebx
push edx
pop edx
mov esi, esi
mov ecx, ecx
mov edi, edi
push ecx
pop ecx
mov edx, edx
mov ebx, ebx
push edx
pop edx
jmp 0x10952
mov ebx, ebx
push esi
pop esi
push esi
pop esi
mov edi, edi
mov eax, eax
mov edx, edx
mov edx, edx
je 0x10805
mov esi, esi
mov edx, edx
mov edi, edi
mov esi, esi
push ebx
pop ebx
mov ecx, ecx
mov esi, esi
jmp 0x10815
push 6
push 0xc5
push str.SVWj_b
push esi
call fcn.000104c0
jmp 0x10829
jmp 0x1082b
mov ecx, ecx
push eax
pop eax
je 0x10831
mov ecx, ecx
pushal
popal
mov edi, edi
je 0x10839
mov edx, edx
pushfd
popfd
push eax
pop eax
mov esi, esi
mov ecx, ecx
pushfd
popfd
mov ecx, ecx
cmp eax, 0xffffffff
jne 0x10871
push ecx
pop ecx
jmp 0x10850
mov esi, esi
je 0x10854
jmp 0x10856
mov ecx, ecx
je 0x1085a
push edx
pop edx
mov eax, eax
push eax
pop eax
je 0x10862
jne 0x10864
mov edx, edx
je 0x10868
mov ebx, ebx
push eax
pop eax
jmp 0x10952
mov esi, esi
jmp 0x10875
push edx
pop edx
mov ecx, ecx
push esi
pop esi
je 0x1087d
mov edx, edx
je 0x10881
pushfd
popfd
push eax
pop eax
push eax
pop eax
mov ebx, ebx
mov ecx, ecx
je 0x1088d
mov esi, esi
mov edi, edi
lea ecx, [eax + esi - 2]
jne 0x10897
push esi
pop esi
mov eax, eax
mov eax, eax
push edx
pop edx
je 0x108a1
pushal
popal
mov ecx, ecx
push ecx
pop ecx
push eax
pop eax
push ecx
pop ecx
je 0x108ad
je 0x108af
jmp 0x108b1
pushfd
popfd
push esi
pop esi
mov dword [0x10fa4], ecx
jmp 0x1618e
mov dword [ebp - 4], 0xfffffffe
xor eax, eax
call fcn.00010a61
ret 4
Function at 0x4a183f
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
mov eax, dword [0x500324]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x20c]
push edi
push 0x208
xor edi, edi
mov dword [ebp - 0x210], esi
push edi
push eax
call fcn.004b9540
add esp, 0xc
lea eax, [ebp - 0x20c]
push eax
mov eax, dword [ebp + 0xc]
or eax, 0x8000
cmp byte [ebp + 0x10], 0
push edi
cmove eax, dword [ebp + 0xc]
push edi
push eax
push edi
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
je 0x4a18aa
xor eax, eax
mov dword [esi + 0x10], edi
mov dword [esi + 0x14], 7
mov word [esi], ax
jmp 0x4a18b8
lea eax, [ebp - 0x20c]
mov ecx, esi
push eax
call fcn.00401bce
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
xor ecx, ebp
pop esi
call fcn.004a18cd
leave
ret

Function at 0x4a3a6e
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateThread]
pop ebp
ret

Function at 0x4ca0f6
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.004c9f75
Function at 0x515f80
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0xc1000]
push edi
jmp 0x515f9a
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x515fa1
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x515f90
mov eax, 1
add ebx, ebx
jne 0x515fb3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x515fc4
jne 0x515fe3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x515fe3
dec eax
add ebx, ebx
jne 0x515fd0
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x515fa8
add ebx, ebx
jne 0x515fdf
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x516035
xor ecx, ecx
sub eax, 3
jb 0x515ffb
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x51606a
sar eax, 1
mov ebp, eax
jmp 0x516006
add ebx, ebx
jne 0x516006
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x515fd4
inc ecx
add ebx, ebx
jne 0x516014
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x515fd4
add ebx, ebx
jne 0x516021
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x516016
jne 0x516032
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x516016
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x516054
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x516046
jmp 0x515f96
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x516054
add edi, ecx
jmp 0x515f96
pop esi
mov edi, esi
mov ecx, 0x3ed9
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x516072
cmp byte [edi], 0x11
jne 0x516072
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x516077
lea edi, [esi + 0x10e000]
mov eax, dword [edi]
or eax, eax
je 0x5160ef
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x153414]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x153590]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x5160a4
mov ecx, edi
jns 0x5160d3
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x153594]
or eax, eax
je 0x5160e9
mov dword [ebx], eax
add ebx, 4
jmp 0x5160c1
call dword [esi + 0x1535a4]
add edi, 4
lea ebx, [esi - 4]
xor eax, eax
mov al, byte [edi]
inc edi
or eax, eax
je 0x516120
cmp al, 0xef
ja 0x516113
add ebx, eax
mov eax, dword [ebx]
xchg ah, al
rol eax, 0x10
xchg ah, al
add eax, esi
mov dword [ebx], eax
jmp 0x5160f5
and al, 0xf
shl eax, 0x10
mov ax, word [edi]
add edi, 2
jmp 0x516102
mov ebp, dword [esi + 0x153598]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x227]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x516154
sub esp, 0xffffff80
jmp 0x425f74
Function at 0x41046b
Capabilities:
Encode data using xor

Disassembly:
sbb ah, byte [ecx - 0x5e]
outsb dx, byte [esi]
test al, 0xaf
in eax, 0x8a
invalid
xchg ecx, eax
enter 0x5115, 0xffffffffffffffe5
cdq
outsb dx, byte [esi]
cmpsd dword [esi], dword es:[edi]
jns 0x4103f1
pop ebp
xchg ecx, eax
xchg ecx, eax
enter 0x3579, 0xffffffffffffff9b
xchg ecx, eax
xchg ecx, eax
sahf
popal
jns 0x41038c
pop eax
xchg ecx, eax
xchg ecx, eax
mov ecx, 0x9191f9c6
rcl dword [ecx + 0x6edafc79]
outsb dx, byte [esi]
sbb ah, byte [ecx + 0x79]
das
wait
xchg ecx, eax
xchg ecx, eax
adc eax, 0x15fbe551
dec edx
in al, 0x94
jns 0x4103ec
sti
adc eax, 0x7994e44a
hlt
pop ebp
xchg ecx, eax
xchg ecx, eax
invalid
sbb bl, ah
jge 0x41042e
nop
sbb dl, byte [ecx - 0x3f8e2be8]
sar dword [ecx + 0x54], 0x2e
xchg ecx, eax
xchg ecx, eax
enter 0x52c8, 0x1a
hlt
in eax, 0xa3
adc esp, ebp
jbe 0x4103c5
in al, 0x94
jns 0x4103bf
xchg dword [ebp - 0x6f], ebx
pop ebp
xchg ecx, eax
xchg ecx, eax
push esi
aam 0x6d
outsd dx, dword [esi]
outsb dx, byte [esi]
outsb dx, byte [esi]
outsb dx, byte [esi]
sbb dl, ah
jno 0x410460
fsub qword [ecx - 0xb]
sbb byte [ecx + edx*4 - 0x376e6e6f], bl
into
iretd
jns 0x410437
pop ebp
xchg ecx, eax
xchg ecx, eax
outsb dx, byte [esi]
in al, 0x71
jns 0x4103fb
pop ebp
xchg ecx, eax
xchg ecx, eax
pop ebp
jns 0x410410
cdq
xchg ecx, eax
xchg ecx, eax
js 0x41045d
outsd dx, dword [esi]
outsb dx, byte [esi]
outsb dx, byte [esi]
js 0x410477
ficom dword [ecx + 0x7d1ac491]
sbb dl, ah
cdq
invalid
Function at 0x98a68c
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
xor esi, esi
cmp dword [ebp + 8], esi
jne 0x98a6b3
call fcn.0092cbf8
mov dword [eax], esi
call fcn.0092cbe5
push 0x16
pop esi
mov dword [eax], esi
call fcn.0092d83a
mov eax, esi
jmp 0x98a708
test dword [ebp + 0xc], 0xfffffff9
jne 0x98a699
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x98a6e0
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.0092cc0b
pop ecx
call fcn.0092cbe5
mov eax, dword [eax]
jmp 0x98a708
test al, 0x10
jne 0x98a706
test al, 1
je 0x98a706
test byte [ebp + 0xc], 2
je 0x98a706
call fcn.0092cbf8
mov dword [eax], 5
call fcn.0092cbe5
mov dword [eax], 0xd
jmp 0x98a6d7
xor eax, eax
pop esi
pop ebp
ret

Function at 0x431002
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
mov eax, section..text
nop
mov ebx, 0x40915c
nop
mov ecx, 0x11410b28
nop
nop
nop
test eax, eax
nop
nop
nop
nop
je 0x43104e
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
inc eax
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
jne 0x431024
nop
nop
mov eax, section..data
nop
mov ebx, 0x42f3f8
mov ecx, 0x68380e1f
nop
nop
nop
nop
nop
test eax, eax
nop
nop
nop
nop
je 0x431084
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
add eax, 4
nop
nop
nop
cmp eax, ebx
nop
nop
nop
jne 0x43106c
nop
nop
nop
nop
nop
nop
nop
nop
popal
jmp 0x401219
Function at 0x401a80
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x44ed0f
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x468014]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
push 0
call fcn.004141fe
mov dword [ebp - 4], 0
mov dword [esi + 4], 0
mov byte [esi + 8], 0
mov byte [ebp - 4], 1
mov dword [esi + 0xc], 0
mov byte [esi + 0x10], 0
mov byte [ebp - 4], 2
xor eax, eax
mov dword [esi + 0x14], 0
mov word [esi + 0x18], ax
mov byte [ebp - 4], 3
mov dword [esi + 0x1c], eax
mov word [esi + 0x20], ax
mov byte [ebp - 4], 4
mov dword [esi + 0x24], eax
mov byte [esi + 0x28], al
mov byte [ebp - 4], 5
mov dword [esi + 0x2c], eax
mov byte [esi + 0x30], al
mov byte [ebp - 4], 6
mov eax, dword [ebp + 8]
test eax, eax
je 0x401b31
push eax
push esi
call fcn.00414659
add esp, 8
mov dword [ebp - 4], 0xffffffff
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret 4
push str.bad_locale_name
call fcn.004143b7
int3

Function at 0x4063e0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x44fa1c
mov eax, dword fs:[0]
push eax
sub esp, 8
push esi
push edi
mov eax, dword [0x468014]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x10], edi
mov dword [edi], 0
mov dword [edi + 4], 0
mov dword [edi + 8], 0
mov dword [ebp - 4], 0
lea esi, [edi + 0xc]
mov dword [ebp - 0x14], esi
push 0x40
mov dword [esi], 0
mov dword [esi + 4], 0
call fcn.004295f9
mov dword [eax], eax
mov dword [eax + 4], eax
mov dword [eax + 8], eax
mov word [eax + 0xc], 0x101
mov dword [esi], eax
mov byte [ebp - 4], 2
mov dword [edi + 0x14], 0
mov dword [edi + 0x18], 0
mov dword [edi + 0x1c], 0
mov byte [ebp - 4], 3
lea esi, [edi + 0x20]
mov dword [ebp - 0x14], esi
push 0x28
mov dword [esi], 0
mov dword [esi + 4], 0
call fcn.004295f9
mov dword [eax], eax
mov dword [eax + 4], eax
mov dword [eax + 8], eax
mov word [eax + 0xc], 0x101
mov dword [esi], eax
mov byte [ebp - 4], 5
lea esi, [edi + 0x28]
mov dword [ebp - 0x14], esi
push 0x28
mov dword [esi], 0
mov dword [esi + 4], 0
call fcn.004295f9
add esp, 0xc
mov dword [eax], eax
mov dword [eax + 4], eax
mov dword [eax + 8], eax
mov word [eax + 0xc], 0x101
mov dword [esi], eax
mov byte [ebp - 4], 7
mov dword [edi + 0x40], 0
mov dword [edi + 0x44], 0xf
mov byte [edi + 0x30], 0
mov dword [ebp - 4], 0xffffffff
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x406500
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x44fa9c
mov eax, dword fs:[0]
push eax
sub esp, 8
push esi
push edi
mov eax, dword [0x468014]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x10], edi
mov dword [ebp - 4], 4
lea ecx, [edi + 0x30]
call fcn.00402940
mov byte [ebp - 4], 3
lea esi, [edi + 0x28]
mov dword [ebp - 0x14], esi
mov byte [ebp - 4], 3
mov ecx, esi
mov eax, dword [esi]
push dword [eax + 4]
push esi
call fcn.00412960
push 0x28
push dword [esi]
call fcn.00429629
add esp, 8
mov byte [ebp - 4], 2
lea esi, [edi + 0x20]
mov dword [ebp - 0x14], esi
mov byte [ebp - 4], 2
mov ecx, esi
mov eax, dword [esi]
push dword [eax + 4]
push esi
call fcn.00412960
push 0x28
push dword [esi]
call fcn.00429629
add esp, 8
mov byte [ebp - 4], 1
lea ecx, [edi + 0x14]
call fcn.00407a90
mov byte [ebp - 4], 0
lea esi, [edi + 0xc]
mov dword [ebp - 0x14], esi
mov byte [ebp - 4], 0
mov ecx, esi
mov eax, dword [esi]
push dword [eax + 4]
push esi
call fcn.004129e0
push 0x40
push dword [esi]
call fcn.00429629
add esp, 8
mov dword [ebp - 4], 0xffffffff
mov ecx, edi
call fcn.00407a90
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x409350
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x44eaf0
mov eax, dword fs:[0]
push eax
push esi
mov eax, dword [0x468014]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
test byte [esi + 0x3c], 1
je 0x4093c2
mov eax, dword [esi + 0x20]
mov ecx, dword [eax]
test ecx, ecx
je 0x40938d
mov eax, dword [esi + 0x30]
mov edx, dword [eax]
add edx, ecx
jmp 0x409397
mov eax, dword [esi + 0x2c]
mov ecx, dword [esi + 0x1c]
mov edx, dword [eax]
add edx, dword [ecx]
mov eax, dword [esi + 0xc]
mov eax, dword [eax]
sub edx, eax
cmp edx, 0x1000
jb 0x4093b8
mov ecx, dword [eax - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x409413
mov eax, ecx
push edx
push eax
call fcn.00429629
add esp, 8
mov eax, dword [esi + 0xc]
mov dword [eax], 0
mov eax, dword [esi + 0x1c]
mov dword [eax], 0
mov eax, dword [esi + 0x2c]
mov dword [eax], 0
mov eax, dword [esi + 0x10]
mov dword [eax], 0
mov eax, dword [esi + 0x20]
mov dword [eax], 0
mov eax, dword [esi + 0x30]
mov dword [eax], 0
and dword [esi + 0x3c], 0xfffffffe
mov dword [esi + 0x38], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
call fcn.0042dfb5
int3
Function at 0x409460
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x44ff7e
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push ebx
push esi
push edi
mov eax, dword [0x468014]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x10], 0
mov eax, dword [ebx]
push 0
push 0
mov eax, dword [eax + 4]
mov dword [ebx + eax], vtable.std::basic_istream_char__struct_std::char_traits_char__.0
mov eax, dword [ebx]
mov edx, dword [eax + 4]
lea eax, [edx - 0x18]
mov dword [edx + ebx - 4], eax
mov eax, dword [ebx]
mov dword [ebx + 8], 0
mov dword [ebx + 0xc], 0
mov edi, dword [eax + 4]
add edi, ebx
mov ecx, edi
mov dword [edi + 0x30], 0
mov dword [edi + 8], 0
mov dword [edi + 0x10], 0
mov dword [edi + 0x14], 0x201
mov dword [edi + 0x18], 6
mov dword [edi + 0x1c], 0
mov dword [edi + 0x20], 0
mov dword [edi + 0x24], 0
mov dword [edi + 0x28], 0
mov dword [edi + 0x2c], 0
call fcn.00404af0
push 8
call fcn.004295f9
push 1
mov esi, eax
call fcn.00414559
mov dword [esi + 4], eax
add esp, 8
mov eax, dword [ebp + 8]
mov dword [edi + 0x30], esi
mov dword [edi + 0x38], eax
mov dword [edi + 0x3c], 0
mov dword [ebp - 4], 2
mov eax, dword [edi + 0x30]
mov esi, dword [eax + 4]
mov ecx, esi
mov dword [ebp - 0x18], esi
mov eax, dword [esi]
call dword [eax + 4]
lea eax, [ebp - 0x1c]
mov dword [ebp - 0x10], 2
push eax
call fcn.0040b720
add esp, 4
mov ecx, eax
mov edx, dword [eax]
push 0x20
mov eax, dword [edx + 0x20]
call eax
mov edx, 2
mov byte [ebp + 0xb], al
mov dword [ebp - 0x10], edx
and edx, 0xfffffffd
mov dword [ebp - 0x10], edx
mov byte [ebp - 4], 1
mov ecx, esi
mov edx, dword [esi]
call dword [edx + 8]
test eax, eax
je 0x409595
mov edx, dword [eax]
mov ecx, eax
push 1
call dword [edx]
cmp dword [edi + 0x38], 0
mov al, byte [ebp + 0xb]
mov byte [edi + 0x40], al
jne 0x4095b1
mov eax, dword [edi + 0xc]
mov ecx, edi
push 0
or eax, 4
push eax
call fcn.00404af0
mov dword [ebp - 4], 0xffffffff
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x415942
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
mov ebx, dword [ebp + 0x10]
push esi
mov esi, dword [ebp + 0xc]
push edi
mov edi, ecx
test ebx, ebx
jg 0x415966
jl 0x41595d
test esi, esi
jne 0x415966
xor eax, eax
xor edx, edx
jmp 0x415a59
cmp dword [edi + 0x38], 0
je 0x41597b
push ebx
push esi
push dword [ebp + 8]
call fcn.004075d0
jmp 0x415a59
mov eax, dword [edi + 0x1c]
mov ecx, esi
mov dword [ebp - 8], ecx
mov dword [ebp - 0xc], esi
mov ecx, dword [eax]
test ecx, ecx
je 0x4159cf
mov eax, dword [edi + 0x2c]
mov eax, dword [eax]
mov dword [ebp - 4], eax
test eax, eax
je 0x4159cf
cmp eax, esi
jb 0x4159a1
mov eax, esi
mov dword [ebp - 4], esi
push eax
push ecx
push dword [ebp + 8]
call fcn.0042a940
mov edx, dword [ebp - 4]
mov ecx, esi
mov eax, dword [ebp + 8]
sub ecx, edx
add eax, edx
mov dword [ebp - 8], ecx
mov dword [ebp - 4], eax
add esp, 0xc
mov eax, dword [edi + 0x2c]
mov dword [ebp - 0xc], ecx
sub dword [eax], edx
mov eax, dword [edi + 0x1c]
add dword [eax], edx
jmp 0x4159d5
mov eax, dword [ebp + 8]
mov dword [ebp - 4], eax
cmp dword [edi + 0x4c], 0
je 0x415a4d
mov ecx, edi
call fcn.00415274
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0xc], eax
cmp eax, 0xfff
jbe 0x415a29
mov ecx, dword [ebp - 4]
push dword [edi + 0x4c]
push 0xfff
push 1
push ecx
call fcn.00434bb3
mov ecx, dword [ebp - 4]
add esp, 0x10
mov edx, dword [ebp - 8]
add ecx, eax
sub edx, eax
mov dword [ebp - 4], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 0xc], edx
cmp eax, 0xfff
jne 0x415a25
cmp edx, eax
ja 0x4159f2
jmp 0x415a2c
sub esi, edx
jmp 0x415a52
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 0xc]
mov ecx, eax
test eax, eax
je 0x415a50
push dword [edi + 0x4c]
push edx
push 1
push dword [ebp - 4]
call fcn.00434bb3
mov ecx, dword [ebp - 0xc]
add esp, 0x10
sub ecx, eax
jmp 0x415a50
mov ecx, dword [ebp - 0xc]
sub esi, ecx
sbb ebx, 0
mov eax, esi
mov edx, ebx
pop edi
pop esi
pop ebx
leave
ret 0xc