joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10007990
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [0x1003400c]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x24]
mov dword [ebp - 0xc], eax
mov eax, dword [0x28a727c]
push esi
mov esi, dword [sym.imp.KERNEL32.dll_IsBadReadPtr]
push 4
mov eax, dword [eax + 0x1c]
push 0x28a6e50
mov dword [ebp - 8], eax
call esi
test eax, eax
jne 0x10007b8d
push edi
mov edi, dword [0x28a6e50]
push 4
add edi, 0x12c
push edi
call esi
test eax, eax
jne 0x10007b8c
mov edi, dword [edi]
push 4
add edi, 0x3c
push edi
call esi
test eax, eax
jne 0x10007b8c
mov edi, dword [edi]
add edi, dword [ebp + 0xc]
push 4
push edi
call esi
test eax, eax
jne 0x10007b8c
mov edi, dword [edi]
push 4
add edi, 0x36c
push edi
call esi
test eax, eax
jne 0x10007b8c
mov edi, dword [edi]
push 4
add edi, 0x94
push edi
call esi
test eax, eax
jne 0x10007b8c
mov edi, dword [edi]
push 4
add edi, 0x36c
push edi
call esi
test eax, eax
jne 0x10007b8c
mov edi, dword [edi]
push 4
push edi
call esi
test eax, eax
jne 0x10007b8c
mov edi, dword [edi]
add edi, dword [ebp + 0x20]
push 4
push edi
call esi
test eax, eax
jne 0x10007b8c
push 4
push 0x28a6e50
call esi
test eax, eax
jne 0x10007b8c
push ebx
mov ebx, dword [0x28a6e50]
push 4
add ebx, 0x12c
push ebx
call esi
test eax, eax
jne 0x10007b8b
mov ebx, dword [ebx]
push 4
add ebx, 0x3c
push ebx
call esi
test eax, eax
jne 0x10007b8b
mov ebx, dword [ebx]
add ebx, dword [ebp + 0xc]
push 4
push ebx
call esi
test eax, eax
jne 0x10007b8b
mov ebx, dword [ebx]
push 4
add ebx, 0x2e0
push ebx
call esi
test eax, eax
jne 0x10007b8b
mov ebx, dword [ebx]
push 4
push ebx
call esi
test eax, eax
jne 0x10007b8b
mov ecx, dword [ebp - 8]
mov eax, dword [ebx]
cmp eax, dword [ecx]
jne 0x10007b8b
push 4
push 0x28a6e50
call esi
test eax, eax
jne 0x10007b8b
mov ebx, dword [0x28a6e50]
push 4
add ebx, 0x12c
push ebx
call esi
test eax, eax
jne 0x10007b8b
mov ebx, dword [ebx]
push 4
add ebx, 0x3c
push ebx
call esi
test eax, eax
jne 0x10007b8b
mov ebx, dword [ebx]
add ebx, dword [ebp + 0xc]
push 4
push ebx
call esi
test eax, eax
jne 0x10007b8b
mov ebx, dword [ebx]
push 4
add ebx, 0x36c
push ebx
call esi
test eax, eax
jne 0x10007b8b
mov ebx, dword [ebx]
push 4
add ebx, 0x15c
push ebx
call esi
test eax, eax
jne 0x10007b8b
mov eax, dword [ebx]
cmp eax, 7
je 0x10007b67
cmp eax, 0xea67
je 0x10007b67
cmp eax, 0x11177
je 0x10007b67
cmp eax, 0x327
jne 0x10007b8b
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [ebp - 8]
push eax
push 0x40
push 1
push edi
call esi
mov ecx, dword [ebp - 0xc]
mov al, byte [ecx]
mov byte [edi], al
lea eax, [ebp - 8]
push eax
push dword [ebp - 8]
push 1
push edi
call esi
pop ebx
pop edi
mov ecx, dword [ebp - 4]
xor eax, eax
xor ecx, ebp
pop esi
call fcn.100271b9
mov esp, ebp
pop ebp
ret
Function at 0x10022320
Capabilities:
Create thread
Terminate process

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
push esi
sub eax, 0
je 0x1002236d
sub eax, 1
jne 0x10022380
mov esi, dword [ebp + 8]
push esi
call dword [sym.imp.KERNEL32.dll_DisableThreadLibraryCalls]
push 0x64
push 0x1f4
mov dword [0x1003a6f8], esi
call dword [sym.imp.KERNEL32.dll_Beep]
push 0
push 0
push 0
push 0x10022150
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov eax, 1
pop esi
pop ebp
ret 0xc
mov esi, dword [ebp + 8]
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
push 0
push esi
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov eax, 1
pop esi
pop ebp
ret 0xc

Function at 0x10022710
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [0x1003400c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov edi, ecx
mov dword [ebp - 8], edx
mov ecx, 4
lea eax, [ebp - 8]
movzx edx, word [edi - 0x16]
mov ebx, dword [edi - 0xc]
cmp dx, 5
cmovl edx, ecx
movsx ecx, dx
mov esi, ecx
mov dword [ebp - 0xc], ecx
and esi, 0x80000003
sete cl
test esi, esi
jns 0x1002275f
lea ecx, [esi - 1]
or ecx, 0xfffffffc
cmp ecx, 0xffffffff
sete cl
test cl, cl
je 0x10022797
xor ecx, ecx
cmp cx, dx
jge 0x10022797
mov esi, dword [ebp - 0xc]
lea ecx, [ebp - 8]
dec esi
sub edi, ecx
sar esi, 2
inc esi
mov edx, dword [eax]
lea eax, [eax + 4]
add edx, ebx
mov ecx, edx
shr edx, 0x19
xor ecx, 0xfac6d9
shl ecx, 7
or ecx, edx
mov dword [edi + eax - 4], ecx
sub esi, 1
jne 0x10022777
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.100271b9
mov esp, ebp
pop ebp
ret
Function at 0x10022cf0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [0x1003400c]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
push 0x1002f868
push eax
lea eax, [ebp - 8]
mov dword [ebp - 0xc], ecx
push eax
mov dword [ebp - 8], 0
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fopen_s]
mov ebx, dword [ebp - 8]
add esp, 0xc
test ebx, ebx
jne 0x10022d40
lea eax, [ebx - 3]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100271b9
mov esp, ebp
pop ebp
ret 4
push 2
push 0
push ebx
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fseek]
add esp, 0xc
test eax, eax
je 0x10022d59
mov esi, 0xfffffffd
jmp 0x10022dd1
push ebx
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_ftell]
mov esi, eax
add esp, 4
test esi, esi
js 0x10022d52
jne 0x10022d6f
xor esi, esi
jmp 0x10022dd1
lea eax, [esi + 1]
push 0x10029350
push eax
call fcn.10027929
mov edi, eax
add esp, 8
test edi, edi
jne 0x10022d8b
lea esi, [eax - 2]
jmp 0x10022dd1
push 0
push 0
push ebx
mov byte [edi + esi], 0
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fseek]
add esp, 0xc
push ebx
push esi
push 1
push edi
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
add esp, 0x10
cmp eax, esi
je 0x10022dbc
push edi
call fcn.10027425
mov esi, 0xfffffffd
jmp 0x10022dce
mov ecx, dword [ebp - 0xc]
push eax
push edi
call fcn.100239c0
push edi
mov esi, eax
call fcn.10027425
add esp, 4
push dword [ebp - 8]
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
mov ecx, dword [ebp - 4]
add esp, 4
mov eax, esi
xor ecx, ebp
pop edi
pop esi
pop ebx
call fcn.100271b9
mov esp, ebp
pop ebp
ret 4

Function at 0x10026150
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, dword [ebp + 8]
test esi, esi
je 0x100261f0
mov ecx, dword [esi]
xor eax, eax
push ebx
push edi
xor edi, edi
mov byte [ecx + 0x16], al
mov ecx, dword [esi]
mov byte [ecx + 0x17], al
mov ecx, dword [esi]
mov byte [ecx + 0x18], al
mov ecx, dword [esi]
mov byte [ecx + 0x19], al
mov ebx, dword [esi + 4]
test ebx, ebx
jle 0x100261a0
mov esi, dword [esi]
movzx edx, byte [esi + edi]
mov ecx, eax
shr ecx, 0x18
inc edi
xor edx, ecx
shl eax, 8
xor eax, dword [edx*4 + 0x1002b770]
cmp edi, ebx
jl 0x10026183
mov esi, dword [ebp + 8]
mov ebx, dword [esi + 0xc]
xor edi, edi
test ebx, ebx
jle 0x100261cd
mov esi, dword [esi + 8]
nop dword [eax]
movzx edx, byte [esi + edi]
mov ecx, eax
shr ecx, 0x18
inc edi
xor edx, ecx
shl eax, 8
xor eax, dword [edx*4 + 0x1002b770]
cmp edi, ebx
jl 0x100261b0
mov esi, dword [ebp + 8]
mov ecx, dword [esi]
mov edx, eax
shr edx, 8
pop edi
pop ebx
mov byte [ecx + 0x16], al
mov ecx, dword [esi]
mov byte [ecx + 0x17], dl
mov edx, eax
mov ecx, dword [esi]
shr edx, 0x10
shr eax, 0x18
mov byte [ecx + 0x18], dl
mov ecx, dword [esi]
mov byte [ecx + 0x19], al
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x405660
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x224
mov eax, dword [0x533840]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ecx, 0x597d58
push esi
push edi
lea edx, [ecx + 1]
nop
mov al, byte [ecx]
inc ecx
test al, al
jne 0x405680
sub ecx, edx
jne 0x405834
push ecx
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
test eax, eax
je 0x405845
push 0x104
push 0x597b48
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
mov ecx, 0x597b48
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x4056b7
sub ecx, edx
jne 0x4056cc
push str.Cant_find_program_path__0_o_n
jmp 0x40584a
lea eax, [ecx + 0x597b47]
cmp eax, 0x597b48
je 0x4056f5
nop dword [eax]
mov dl, byte [eax - 1]
cmp dl, 0x5c
je 0x4056f5
cmp dl, 0x2f
je 0x4056f5
dec eax
cmp eax, 0x597b48
jne 0x4056e0
sub eax, 0x597b48
mov esi, 0x102
cmp eax, esi
cmovl esi, eax
lea eax, [ebp - 0x218]
push esi
push 0x597b48
push eax
call fcn.004c6400
add esp, 0xc
mov byte [ebp + esi - 0x218], 0
test esi, esi
je 0x405740
lea eax, [ebp - 0x218]
push eax
push str._sDemReadLogs
push 0x597a38
call fcn.00405a20
add esp, 0xc
jmp 0x405752
push str.DemReadLogs
push 0x597a38
call fcn.00405a20
add esp, 8
push 0x597a38
call fcn.004cff7f
add esp, 4
lea eax, [ebp - 0x220]
push eax
call fcn.004cffe9
add esp, 4
lea eax, [ebp - 0x220]
push eax
call fcn.004d02e2
mov esi, eax
add esp, 4
mov ecx, dword [esi]
mov edx, dword [esi + 4]
mov edi, dword [esi + 8]
mov ebx, dword [esi + 0xc]
mov eax, dword [esi + 0x14]
push ecx
mov ecx, dword [esi + 0x10]
add eax, 0x76c
cmp byte [0x58b97b], 0
push edx
push edi
push ebx
push ecx
push eax
lea eax, [ebp - 0x110]
je 0x4057c4
push 0x597c50
push 0x597a38
push str._s_s__i__i__i___i__i__i.log
push eax
call fcn.00405a20
add esp, 0x28
jmp 0x4057d7
push 0x597a38
push str._sDEM__i__i__i___i__i__i.log
push eax
call fcn.00405a20
add esp, 0x24
lea eax, [ebp - 0x110]
push 0x515470
push eax
call fcn.004c9665
mov edi, eax
add esp, 8
test edi, edi
je 0x405834
push dword [esi]
mov eax, dword [esi + 0x14]
push dword [esi + 4]
add eax, 0x76c
push dword [esi + 8]
push dword [esi + 0xc]
push dword [esi + 0x10]
push eax
push str.File_started__i__i__i___i:_i:_i_n_n
push edi
call fcn.00405a40
push edi
call fcn.004c9888
add esp, 0x24
xor ecx, ecx
nop
mov al, byte [ebp + ecx - 0x110]
lea ecx, [ecx + 1]
mov byte [ecx + 0x597d57], al
test al, al
jne 0x405820
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004c43a7
mov esp, ebp
pop ebp
ret
push str.Module_handle_is_NULL__n
push 2
call fcn.004cacc2
add esp, 4
push eax
call fcn.00405a40
push str.PAUSE
call fcn.004cfc23
add esp, 0xc
push 5
call fcn.004cff69
int3
Function at 0x40b4b0
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4f2590
mov eax, dword fs:[0]
push eax
push esi
push edi
mov eax, dword [0x533840]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
push 8
mov dword [edi], vtable.std::basic_streambuf_char__struct_std::char_traits_char__.0
mov dword [edi + 4], 0
mov dword [edi + 8], 0
mov dword [edi + 0xc], 0
mov dword [edi + 0x10], 0
mov dword [edi + 0x14], 0
mov dword [edi + 0x18], 0
mov dword [edi + 0x1c], 0
mov dword [edi + 0x20], 0
mov dword [edi + 0x24], 0
mov dword [edi + 0x28], 0
mov dword [edi + 0x2c], 0
mov dword [edi + 0x30], 0
call fcn.004c45ce
mov esi, eax
push 1
mov dword [ebp - 4], 0
call fcn.004b773c
add esp, 8
mov dword [esi + 4], eax
mov ecx, edi
mov dword [edi + 0x34], esi
call fcn.0040b450
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x41d0f0
Capabilities:
Print debug messages
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
mov eax, 0x13bc
call fcn.004c5100
mov eax, dword [0x533840]
xor eax, esp
mov dword [esp + 0x13b8], eax
mov eax, dword [ebp + 0x10]
push ebx
push esi
mov esi, ecx
mov dword [esp + 8], eax
mov ecx, dword [ebp + 0x14]
mov ebx, edx
push edi
xor edi, edi
mov dword [esp + 0x10], ecx
cmp esi, 2
jne 0x41d15c
push dword [0x59ad8c]
lea eax, [esp + 0x24]
push dword [0x59ad88]
push str._s___d__:
push 0x139b
push eax
call fcn.00412000
mov edi, eax
add esp, 0x14
cmp edi, 0xffffffff
je 0x41d179
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 0x10]
push ecx
push ecx
mov edx, 0x139b
lea ecx, [esp + 0x28]
push eax
sub edx, edi
add ecx, edi
call fcn.004059e0
add esp, 0xc
cmp eax, 0xffffffff
jne 0x41d193
mov eax, 2
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x13b8]
xor ecx, esp
call fcn.004c43a7
mov esp, ebp
pop ebp
ret
cmp esi, 2
jne 0x41d1ae
add eax, edi
lea ecx, [esp + 0x20]
add eax, ecx
push 0x52b398
push eax
call fcn.00405a20
add esp, 8
mov eax, dword [ebp + 8]
mov edi, dword [sym.imp.KERNEL32.dll_TlsSetValue]
mov dword [esp + 0x1c], eax
mov eax, dword [0x59a894]
mov dword [esp + 0x14], 0x538d6c
mov dword [esp + 0x18], ebx
cmp eax, 0xffffffff
je 0x41d1d9
lea ecx, [esp + 0x14]
push ecx
push eax
call edi
lea eax, [esp + 0x20]
push eax
push 0x51549c
call fcn.00405870
add esp, 8
lea eax, [esp + 0x20]
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
xor ebx, ebx
cmp esi, 2
je 0x41d204
cmp esi, 3
sete bl
inc ebx
mov eax, dword [0x59a894]
cmp eax, 0xffffffff
je 0x41d213
push 0
push eax
call edi
mov eax, ebx
sub eax, 0
je 0x41d21f
sub eax, 2
je 0x41d236
mov ecx, dword [esp + 0x13c4]
mov eax, ebx
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.004c43a7
mov esp, ebp
pop ebp
ret
push str.Exiting_on_SPEW_ABORT_n
call fcn.0041d2a0
add esp, 4
push 0
call fcn.004cff69
int3
Function at 0x41e760
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x204
mov eax, dword [0x533840]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, ecx
mov ebx, edx
test esi, esi
je 0x41e8ce
mov eax, dword fs:[0x2c]
mov ecx, dword [eax]
mov eax, dword [0x59be48]
cmp eax, dword [ecx + 4]
jle 0x41e7c8
push 0x59be48
call fcn.004c48ee
add esp, 4
cmp dword [0x59be48], 0xffffffff
jne 0x41e7c8
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
push 0x59be48
setne byte [0x59be4c]
call fcn.004c489d
add esp, 4
cmp byte [0x59adbd], 0
jne 0x41e842
mov byte [0x59adbd], 1
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
test eax, eax
je 0x41e842
push 0x1ff
push eax
lea eax, [ebp - 0x204]
push eax
call fcn.004d5bb0
lea eax, [ebp - 0x204]
mov byte [ebp - 5], 0
push eax
call fcn.004d5e4a
lea eax, [ebp - 0x204]
push str._RANDOMIZEMEMORY
push eax
call fcn.004c5e90
add esp, 0x18
test eax, eax
je 0x41e823
mov byte [0x59adbc], 1
lea eax, [ebp - 0x204]
push str._NOINITMEMORY
push eax
call fcn.004c5e90
add esp, 8
test eax, eax
je 0x41e842
mov byte [0x5342d1], 0
cmp byte [0x59adbc], 0
je 0x41e888
test ebx, ebx
jle 0x41e8ce
mov ecx, dword [0x599c04]
sub esi, ecx
nop word [eax + eax]
movzx eax, cl
mov al, byte [eax + 0x515d68]
mov byte [esi + ecx], al
inc ecx
sub ebx, 1
jne 0x41e860
pop esi
mov dword [0x599c04], ecx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004c43a7
mov esp, ebp
pop ebp
ret
cmp byte [0x59be4c], 0
je 0x41e8ce
mov edx, ebx
sar edx, 2
test edx, edx
je 0x41e8af
shl edx, 2
mov eax, 0xffeeffee
push edi
mov ecx, edx
mov edi, esi
shr ecx, 2
add esi, edx
rep stosd dword es:[edi], eax
pop edi
and ebx, 3
je 0x41e8ce
mov ecx, 0x534304
sub ecx, esi
nop dword [eax + eax]
mov al, byte [ecx + esi]
lea esi, [esi + 1]
mov byte [esi - 1], al
sub ebx, 1
jne 0x41e8c0
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
pop ebx
call fcn.004c43a7
mov esp, ebp
pop ebp
ret

Function at 0x41e8e0
Capabilities:
Check for time delay via queryperformancecounter

Disassembly:
push ebp
mov ebp, esp
and esp, 0xffffffc0
mov eax, dword [0x59ad98]
sub esp, 0x40
or eax, dword [0x59ad9c]
jne 0x41e90c
push 0x59ad98
call dword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
push 0x59ada0
call dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
lea eax, [esp + 0x30]
push eax
call dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov ecx, dword [esp + 0x30]
sub ecx, dword [0x59ada0]
mov edx, dword [esp + 0x34]
sbb edx, dword [0x59ada4]
call fcn.004c4fb0
mov edx, dword [0x59ad9c]
mov ecx, dword [0x59ad98]
movsd qword [esp + 0x38], xmm0
call fcn.004c4fb0
cmp dword [0x599c28], 0
movsd xmm1, qword [esp + 0x38]
divsd xmm1, xmm0
jne 0x41e961
movaps xmm0, xmm1
mov esp, ebp
pop ebp
ret
sub esp, 8
movsd qword [esp], xmm1
call dword [0x537fb8]
fstp qword [esp + 0x40]
movsd xmm0, qword [esp + 0x40]
add esp, 8
mov esp, ebp
pop ebp
ret
Function at 0x41ee00
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [0x599c74]
sub esp, 8
test eax, eax
jne 0x41ee14
mov byte [ebp - 1], al
jmp 0x41ee61
push eax
push 1
lea eax, [ebp - 1]
push 1
push eax
call fcn.004ca508
mov eax, dword [0x599c6c]
add esp, 0x10
mov ecx, dword [0x599c68]
inc eax
mov dword [0x599c6c], eax
cmp eax, ecx
jle 0x41ee59
push str.g_CurFilePos___g_FileLen
push str._VCR_ASSERT_FAILED:__s__n
call fcn.0041eda0
mov eax, dword [0x599c6c]
add esp, 8
mov ecx, dword [0x599c68]
cmp eax, ecx
jl 0x41ee61
call dword [0x537fa4]
test byte [ebp - 1], 0x80
je 0x41ee78
lea ecx, [ebp - 8]
call fcn.00422a80
and byte [ebp - 1], 0x7f
mov ecx, dword [ebp - 8]
jmp 0x41ee7d
xor ecx, ecx
mov dword [ebp - 8], ecx
movzx eax, cx
cmp eax, dword [0x599c48]
jl 0x41ee99
push eax
push str.VCR_ReadEvent:_invalid_threadID___d_.
call fcn.0041d270
mov ecx, dword [ebp - 8]
add esp, 8
movzx eax, byte [ebp - 1]
mov dword [0x5344e4], eax
movzx eax, cx
lea ecx, [eax + eax*2]
mov eax, dword [0x599c4c]
push dword [eax + ecx*4 + 4]
call dword [sym.imp.KERNEL32.dll_SetEvent]
mov esp, ebp
pop ebp
ret
Function at 0x422310
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov ebx, ecx
push esi
mov esi, ebx
push edi
lea ecx, [esi + 1]
nop
mov al, byte [esi]
inc esi
test al, al
jne 0x422320
sub esi, ecx
lea ecx, [ebp - 4]
inc esi
call fcn.00422a80
movzx eax, word [ebp - 4]
cmp eax, esi
je 0x422348
push ebx
push str.ReadAndVerifyShortString___s___lengths_different.
call fcn.0041eda0
add esp, 8
cmp dword [0x59adc4], esi
jge 0x422374
push dword [0x59adc0]
call fcn.004c43be
push esi
call fcn.004c43b5
mov edi, eax
mov dword [0x59adc4], esi
add esp, 8
mov dword [0x59adc0], edi
jmp 0x42237a
mov edi, dword [0x59adc0]
mov eax, dword [0x599c74]
test eax, eax
jne 0x422390
push esi
push eax
push edi
call fcn.004c62a0
add esp, 0xc
jmp 0x4223e0
push eax
push esi
push 1
push edi
call fcn.004ca508
mov eax, dword [0x599c6c]
add esp, 0x10
mov ecx, dword [0x599c68]
add eax, esi
mov dword [0x599c6c], eax
cmp eax, ecx
jle 0x4223d2
push str.g_CurFilePos___g_FileLen
push str._VCR_ASSERT_FAILED:__s__n
call fcn.0041eda0
mov eax, dword [0x599c6c]
add esp, 8
mov ecx, dword [0x599c68]
cmp eax, ecx
jl 0x4223da
call dword [0x537fa4]
mov edi, dword [0x59adc0]
mov ecx, edi
mov edx, ebx
sub esi, 4
jb 0x422401
nop dword [eax]
mov eax, dword [ecx]
cmp eax, dword [edx]
jne 0x422406
add ecx, 4
add edx, 4
sub esi, 4
jae 0x4223f0
cmp esi, 0xfffffffc
je 0x422442
mov al, byte [ecx]
cmp al, byte [edx]
jne 0x422433
cmp esi, 0xfffffffd
je 0x422442
mov al, byte [ecx + 1]
cmp al, byte [edx + 1]
jne 0x422433
cmp esi, 0xfffffffe
je 0x422442
mov al, byte [ecx + 2]
cmp al, byte [edx + 2]
jne 0x422433
cmp esi, 0xffffffff
je 0x422442
mov al, byte [ecx + 3]
cmp al, byte [edx + 3]
je 0x422442
push edi
push ebx
push str.ReadAndVerifyShortString:_strings_different___s_vs__s_.
call fcn.0041eda0
add esp, 0xc
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x422a80
Capabilities:
Read file on windows

Disassembly:
mov eax, dword [0x599c74]
test eax, eax
jne 0x422a8d
mov word [ecx], ax
ret
push eax
push 2
push 1
push ecx
call fcn.004ca508
add esp, 0x10
mov eax, dword [0x599c6c]
add eax, 2
mov dword [0x599c6c], eax
mov ecx, dword [0x599c68]
cmp eax, ecx
jle 0x422ad1
push str.g_CurFilePos___g_FileLen
push str._VCR_ASSERT_FAILED:__s__n
call fcn.0041eda0
mov eax, dword [0x599c6c]
add esp, 8
mov ecx, dword [0x599c68]
cmp eax, ecx
jl 0x422a8c
jmp dword [0x537fa4]

Function at 0x422ae0
Capabilities:
Read file on windows

Disassembly:
mov eax, dword [0x599c74]
test eax, eax
jne 0x422aec
mov dword [ecx], eax
ret
push eax
push 4
push 1
push ecx
call fcn.004ca508
add esp, 0x10
mov eax, dword [0x599c6c]
add eax, 4
mov dword [0x599c6c], eax
mov ecx, dword [0x599c68]
cmp eax, ecx
jle 0x422b30
push str.g_CurFilePos___g_FileLen
push str._VCR_ASSERT_FAILED:__s__n
call fcn.0041eda0
mov eax, dword [0x599c6c]
add esp, 8
mov ecx, dword [0x599c68]
cmp eax, ecx
jl 0x422aeb
jmp dword [0x537fa4]
Function at 0x422b40
Capabilities:
Read file on windows

Disassembly:
mov eax, dword [0x599c74]
test eax, eax
jne 0x422b51
xorps xmm0, xmm0
movq qword [ecx], xmm0
ret
push eax
push 8
push 1
push ecx
call fcn.004ca508
add esp, 0x10
mov eax, dword [0x599c6c]
add eax, 8
mov dword [0x599c6c], eax
mov ecx, dword [0x599c68]
cmp eax, ecx
jle 0x422b95
push str.g_CurFilePos___g_FileLen
push str._VCR_ASSERT_FAILED:__s__n
call fcn.0041eda0
mov eax, dword [0x599c6c]
add esp, 8
mov ecx, dword [0x599c68]
cmp eax, ecx
jl 0x422b50
jmp dword [0x537fa4]
Function at 0x4851f0
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x14
push esi
mov esi, dword [esp + 0x20]
mov ecx, 2
push edi
mov edi, dword [esp + 0x20]
mov dword [esp + 0x18], ecx
cmp edi, 8
jle 0x485256
push dword [esp + 0x28]
push esi
push edi
call fcn.00484d00
add esp, 0xc
mov ecx, 8
mov dword [esp + 0x18], ecx
cmp edi, 0x20
jle 0x485256
mov dword [esp + 0x20], 0x20
nop
push dword [esp + 0x28]
push esi
push ecx
push edi
call fcn.00485570
mov ecx, dword [esp + 0x30]
add esp, 0x10
lea eax, [ecx*4]
mov dword [esp + 0x20], eax
cmp eax, edi
jl 0x485230
mov dword [esp + 0x18], ecx
lea eax, [ecx*4]
cmp eax, edi
jne 0x48535d
xor edx, edx
test ecx, ecx
jle 0x4853b9
lea eax, [ecx + ecx*2]
lea edi, [esi + eax*8]
lea eax, [esi + ecx*8]
mov dword [esp + 0x20], eax
mov eax, ecx
shl eax, 4
add eax, esi
mov ecx, dword [esp + 0x20]
movsd xmm3, qword [esi + edx*8]
movsd xmm6, qword [eax]
movsd xmm5, qword [esi + edx*8 + 8]
movsd xmm7, qword [ecx]
movsd xmm2, qword [ecx + 8]
addsd xmm7, xmm3
subsd xmm3, qword [ecx]
xorps xmm5, xmmword [0x52db20]
movsd xmm4, qword [eax + 8]
subsd xmm5, xmm2
subsd xmm2, qword [esi + edx*8 + 8]
movsd qword [esp + 0x10], xmm3
movaps xmm3, xmm6
addsd xmm3, qword [edi]
subsd xmm6, qword [edi]
movsd qword [esp + 8], xmm2
movaps xmm2, xmm4
addsd xmm2, qword [edi + 8]
subsd xmm4, qword [edi + 8]
movaps xmm0, xmm3
addsd xmm0, xmm7
subsd xmm7, xmm3
movsd qword [esi + edx*8], xmm0
movaps xmm0, xmm5
subsd xmm0, xmm2
addsd xmm2, xmm5
movsd qword [esi + edx*8 + 8], xmm0
add edx, 2
movsd xmm0, qword [esp + 0x10]
subsd xmm0, xmm4
movsd qword [eax], xmm7
addsd xmm4, qword [esp + 0x10]
movsd qword [eax + 8], xmm2
add eax, 0x10
movsd qword [ecx], xmm0
movsd xmm0, qword [esp + 8]
subsd xmm0, xmm6
addsd xmm6, qword [esp + 8]
movsd qword [ecx + 8], xmm0
add ecx, 0x10
movsd qword [edi], xmm4
movsd qword [edi + 8], xmm6
add edi, 0x10
mov dword [esp + 0x20], ecx
cmp edx, dword [esp + 0x18]
jl 0x485283
pop edi
pop esi
add esp, 0x14
ret
xor eax, eax
test ecx, ecx
jle 0x4853b9
movsd xmm5, qword [0x52db20]
lea edx, [esi + 8]
lea edx, [edx + ecx*8]
movsd xmm3, qword [edx - 8]
movsd xmm4, qword [esi + eax*8]
movaps xmm0, xmm3
movsd xmm1, qword [esi + eax*8 + 8]
addsd xmm0, xmm4
movsd xmm2, qword [edx]
subsd xmm4, xmm3
subsd xmm2, xmm1
xorps xmm1, xmm5
movsd qword [esi + eax*8], xmm0
subsd xmm1, qword [edx]
movsd qword [esi + eax*8 + 8], xmm1
add eax, 2
movsd qword [edx - 8], xmm4
movsd qword [edx], xmm2
add edx, 0x10
cmp eax, ecx
jl 0x485371
pop edi
pop esi
add esp, 0x14
ret