joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40639a
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x11c
push ebx
push esi
push edi
mov edi, dword [sym.imp.KERNEL32.dll_SetErrorMode]
xor eax, eax
push 1
mov dword [ebp - 4], eax
mov dword [ebp - 0x14], 0xc
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], eax
call edi
push 0xffffffffffffffff
push dword [ebp + 8]
lea ebx, [ebp - 0x11c]
push 0x105
mov dword [ebp - 8], eax
call fcn.00408969
mov esi, ebx
call fcn.00406585
mov esi, dword [sym.imp.MSVCRT.dll_strchr]
lea eax, [ebp - 0x11b]
push 0x5c
push eax
call esi
mov ebx, eax
test ebx, ebx
pop ecx
pop ecx
je 0x40646c
lea eax, [ebp - 0x11c]
cmp ebx, eax
jbe 0x40640a
cmp byte [ebx - 1], 0x3a
je 0x40645e
lea eax, [ebp - 0x11b]
cmp ebx, eax
jne 0x406468
cmp byte [ebp - 0x11c], 0x5c
jne 0x406468
push 0x5c
inc ebx
push ebx
call esi
test eax, eax
pop ecx
pop ecx
je 0x4064a1
push 0x5c
inc eax
push eax
jmp 0x406462
lea eax, [ebp - 0x11c]
push 0
push eax
mov byte [ebx], 0
call fcn.00406377
test eax, eax
pop ecx
pop ecx
jne 0x40645b
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x11c]
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
test eax, eax
je 0x4064a1
mov byte [ebx], 0x5c
inc ebx
push 0x5c
push ebx
call esi
pop ecx
mov ebx, eax
pop ecx
test ebx, ebx
jne 0x40642f
lea eax, [ebp - 0x14]
push eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
test eax, eax
jne 0x40649a
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x4064a1
push 0
push dword [ebp + 8]
call fcn.004068b1
test eax, eax
pop ecx
pop ecx
je 0x4064a1
mov dword [ebp - 4], 1
call dword [sym.imp.KERNEL32.dll_GetLastError]
push dword [ebp - 8]
mov esi, eax
call edi
push esi
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov edi, dword [ebp + 0xc]
push dword [ebp - 4]
mov eax, edi
call fcn.004073c6
test eax, eax
pop ecx
je 0x4064eb
push 1
mov esi, edi
call fcn.00409998
push dword [ebp + 8]
push 0x6dde
call fcn.00409ab4
mov ebx, dword [ebp + 8]
pop ecx
pop ecx
push 1
mov eax, edi
call fcn.00409d91
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
leave
ret

Function at 0x4068df
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
mov esi, dword [sym.imp.KERNEL32.dll_SetErrorMode]
push edi
push 1
mov edi, eax
call esi
push dword [ebp + 0xc]
mov dword [ebp - 4], eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov ebx, dword [ebp + 8]
mov dword [ebx], eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
push dword [ebp - 4]
mov dword [ebp - 8], eax
call esi
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
cmp dword [ebx], 0xffffffff
setne al
push eax
mov eax, edi
call fcn.004073c6
test eax, eax
pop ecx
je 0x40695a
push 1
mov esi, edi
call fcn.00409998
push dword [ebp + 0xc]
push dword [ebx]
push 0x6de2
call fcn.00409ab4
mov ebx, dword [ebp + 0xc]
add esp, 0xc
push 1
mov eax, edi
call fcn.00409d91
mov ebx, dword [ebp + 8]
xor eax, eax
cmp dword [ebx], 0xffffffff
pop edi
pop esi
setne al
pop ebx
leave
ret
Function at 0x406967
Capabilities:
Set file attributes

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_SetErrorMode]
push esi
push edi
push 1
mov esi, eax
call ebx
push dword [ebp + 0xc]
mov edi, eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
mov dword [ebp - 4], eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
push edi
mov dword [ebp - 8], eax
call ebx
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_SetLastError]
push dword [ebp - 4]
mov eax, esi
call fcn.004073c6
test eax, eax
pop ecx
je 0x4069d8
push 1
call fcn.00409998
push dword [ebp + 8]
mov edi, esi
push dword [ebp + 0xc]
push 0x6de2
call fcn.00409ab4
mov ebx, dword [ebp + 8]
add esp, 0xc
push 1
mov eax, esi
call fcn.00409d91
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
leave
ret

Function at 0x4069e0
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x144
push esi
mov esi, dword [sym.imp.KERNEL32.dll_SetErrorMode]
push edi
mov dword [ebx + 4], eax
mov eax, dword [ebp + 0xc]
push 1
mov dword [ebx + 8], eax
call esi
mov dword [ebp + 0xc], eax
lea eax, [ebp - 0x144]
push eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebx], eax
call edi
push dword [ebp + 0xc]
mov dword [ebp - 4], eax
call esi
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_SetLastError]
cmp dword [ebx], 0xffffffff
jne 0x406a6e
call edi
cmp eax, 2
je 0x406a43
call edi
cmp eax, 0x12
je 0x406a43
xor eax, eax
jmp 0x406a46
xor eax, eax
inc eax
mov edi, dword [ebp + 0x10]
push eax
mov eax, edi
call fcn.004073c6
test eax, eax
pop ecx
je 0x406a6a
push 1
mov esi, edi
call fcn.00409998
push 0x6de7
call fcn.00409ab4
pop ecx
xor eax, eax
jmp 0x406a9c
mov esi, ebx
lea edi, [ebp - 0x144]
call fcn.00406be8
test eax, eax
jne 0x406a8c
push dword [ebp + 0x10]
push ebx
call fcn.00406aa0
pop ecx
pop ecx
jmp 0x406a9c
lea esi, [ebp - 0x144]
mov edi, ebx
call fcn.00407423
xor eax, eax
inc eax
pop edi
pop esi
leave
ret
Function at 0x406d20
Capabilities:
Check os version
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x9c
push ebx
push esi
push edi
mov edi, dword [sym.imp.KERNEL32.dll_SetErrorMode]
push 1
call edi
push dword [ebp + 8]
mov esi, dword [sym.imp.KERNEL32.dll_GetTempFileNameA]
push 0
push dword [ebp + 0x10]
mov dword [ebp - 8], eax
push dword [ebp + 0xc]
call esi
mov ebx, eax
test ebx, ebx
jne 0x406db1
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 5
jne 0x406db1
lea eax, [ebp - 0x9c]
push eax
mov dword [ebp - 0x9c], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
cmp dword [ebp - 0x98], 4
jne 0x406db1
cmp dword [ebp - 0x94], ebx
jne 0x406db1
cmp dword [ebp - 0x8c], 2
jne 0x406db1
mov dword [ebp - 4], 0x64
push dword [ebp + 8]
dec dword [ebp - 4]
push 0
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call esi
mov ebx, eax
test ebx, ebx
je 0x406db1
cmp dword [ebp - 4], 0
jne 0x406d95
call dword [sym.imp.KERNEL32.dll_GetLastError]
push dword [ebp - 8]
mov esi, eax
call edi
push esi
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov edi, dword [ebp + 0x14]
xor eax, eax
test ebx, ebx
setne al
mov ebx, eax
push ebx
mov eax, edi
call fcn.004073c6
test eax, eax
pop ecx
je 0x406dfa
push 1
mov esi, edi
call fcn.00409998
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push 0x6de6
call fcn.00409ab4
add esp, 0xc
pop edi
pop esi
mov eax, ebx
pop ebx
leave
ret

Function at 0x407776
Capabilities:
Hash data with md5

Disassembly:
xor ecx, ecx
mov dword [eax + 4], ecx
mov dword [eax + 8], ecx
mov dword [eax], 0x413950
mov dword [eax + 0xc], 0x67452301
mov dword [eax + 0x10], 0xefcdab89
mov dword [eax + 0x14], 0x98badcfe
mov dword [eax + 0x18], 0x10325476
mov dword [eax + 0x1c], ecx
mov dword [eax + 0x20], ecx
ret

Function at 0x408b8f
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1008
call fcn.0040f750
push 8
call sub.MSVCRT.dll_void____cdecl_operator_new_unsigned_int_
test eax, eax
pop ecx
je 0x408bb1
and dword [eax + 4], 0
mov dword [ebp - 4], eax
jmp 0x408bb5
and dword [ebp - 4], 0
push esi
push dword [edi + 0xc]
lea esi, [ebp - 8]
push str.R_03d
call fcn.004094cd
pop ecx
pop ecx
mov ecx, dword [ebp - 8]
test ecx, ecx
jne 0x408bd4
mov ecx, 0x4102ca
lea eax, [edi + 0x24]
call fcn.00408e81
push eax
push 0x1000
lea eax, [ebp - 0x1008]
push eax
mov esi, 0x4139cc
push esi
push ecx
lea eax, [edi + 0x20]
call fcn.00408e81
push eax
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
lea eax, [ebp - 0x1008]
push esi
push eax
call sub.MSVCRT.dll_strcmp
pop ecx
test eax, eax
mov eax, dword [ebp - 4]
pop ecx
jne 0x408c23
push dword [ebp + 8]
add eax, 4
call fcn.00404e14
pop ecx
jmp 0x408c49
push ebx
add eax, 4
lea ebx, [ebp - 0x1008]
call fcn.00408e8d
mov eax, dword [ebp - 4]
push 0x4139c8
push 0x4139c4
add eax, 4
push eax
call fcn.00409052
pop ebx
mov eax, dword [ebp - 4]
mov ecx, dword [ebp + 8]
mov dword [eax], ecx
lea eax, [ebp - 4]
push eax
lea esi, [edi + 4]
call fcn.00408d56
lea eax, [ebp - 8]
call fcn.00408e4e
pop esi
leave
ret 4
Function at 0x40b650
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov ebx, dword [edi + 0x24]
push esi
mov esi, dword [edi + 0x34]
sub esi, dword [edi + 0x6c]
mov eax, dword [edi + 0x64]
mov ecx, dword [edi + 0x24]
lea ecx, [ebx + ecx - 0x106]
sub esi, eax
cmp eax, ecx
jb 0x40b6d5
mov eax, dword [edi + 0x30]
push ebx
lea ecx, [eax + ebx]
push ecx
push eax
call sub.MSVCRT.dll_memcpy
mov eax, dword [edi + 0x44]
mov ecx, dword [edi + 0x3c]
sub dword [edi + 0x68], ebx
sub dword [edi + 0x64], ebx
add esp, 0xc
sub dword [edi + 0x54], ebx
mov dword [ebp - 4], eax
lea eax, [ecx + eax*2]
dec eax
dec eax
movzx ecx, word [eax]
mov edx, ecx
sub edx, ebx
cmp ecx, ebx
sbb ecx, ecx
not ecx
and ecx, edx
dec dword [ebp - 4]
mov word [eax], cx
jne 0x40b698
mov eax, dword [edi + 0x38]
mov dword [ebp - 4], ebx
lea eax, [eax + ebx*2]
dec eax
dec eax
movzx ecx, word [eax]
mov edx, ecx
sub edx, ebx
cmp ecx, ebx
sbb ecx, ecx
not ecx
and ecx, edx
dec dword [ebp - 4]
mov word [eax], cx
jne 0x40b6ba
add esi, ebx
mov eax, dword [edi]
cmp dword [eax + 4], 0
je 0x40b730
mov ecx, dword [edi + 0x6c]
add ecx, dword [edi + 0x64]
push esi
add ecx, dword [edi + 0x30]
mov esi, eax
push ecx
call fcn.0040b41c
add dword [edi + 0x6c], eax
mov esi, dword [edi + 0x6c]
cmp esi, 3
pop ecx
pop ecx
jb 0x40b71c
mov eax, dword [edi + 0x64]
mov ecx, dword [edi + 0x30]
lea edx, [eax + ecx]
movzx eax, byte [edx]
mov ecx, dword [edi + 0x50]
mov dword [edi + 0x40], eax
shl eax, cl
movzx ecx, byte [edx + 1]
xor eax, ecx
and eax, dword [edi + 0x4c]
mov dword [edi + 0x40], eax
cmp esi, 0x106
jae 0x40b730
mov eax, dword [edi]
cmp dword [eax + 4], 0
jne 0x40b659
pop esi
pop ebx
leave
ret
Function at 0x40f3cc
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x148
push esi
push edi
push 0x10
pop ecx
mov esi, eax
lea edi, [ebp - 0x148]
push 0x40
rep movsd dword es:[edi], dword [esi]
lea eax, [ebp - 0x140]
pop ecx
mov edx, dword [eax + 0x2c]
xor edx, dword [eax + 0x18]
xor edx, dword [eax - 8]
xor edx, dword [eax]
add eax, 4
dec ecx
mov dword [eax + 0x34], edx
jne 0x40f3ed
and dword [ebp - 4], 0
mov esi, dword [ebp + 8]
mov eax, dword [esi]
mov edx, dword [ebp + 0x14]
mov ecx, eax
shl eax, 5
shr ecx, 0x1b
or ecx, eax
mov eax, dword [ebp - 4]
add ecx, dword [ebp + eax*4 - 0x148]
push 0x14
add ecx, dword [edx]
cdq
pop edi
idiv edi
sub eax, 0
je 0x40f481
dec eax
je 0x40f46c
dec eax
je 0x40f44c
dec eax
jne 0x40f49c
mov eax, dword [ebp + 0xc]
mov eax, dword [eax]
mov edx, dword [ebp + 0x10]
xor eax, dword [edx]
xor eax, dword [ebx]
lea ecx, [ecx + eax - 0x359d3e2a]
jmp 0x40f49c
mov eax, dword [ebp + 0x10]
mov eax, dword [eax]
mov edx, dword [ebp + 0xc]
mov edx, dword [edx]
mov edi, eax
or edi, edx
and edi, dword [ebx]
and eax, edx
or edi, eax
mov dword [ebp - 8], edx
lea ecx, [ecx + edi - 0x70e44324]
jmp 0x40f49c
mov eax, dword [ebp + 0xc]
mov eax, dword [eax]
mov edx, dword [ebp + 0x10]
xor eax, dword [edx]
xor eax, dword [ebx]
lea ecx, [ecx + eax + 0x6ed9eba1]
jmp 0x40f49c
mov eax, dword [ebp + 0xc]
mov eax, dword [eax]
mov edi, dword [ebp + 0x10]
mov edi, dword [edi]
mov edx, eax
not edx
and edx, dword [ebx]
and edi, eax
or edx, edi
lea ecx, [ecx + edx + 0x5a827999]
mov eax, dword [ebx]
mov edx, dword [ebp + 0x14]
mov dword [edx], eax
mov edx, dword [ebp + 0x10]
mov eax, dword [edx]
mov dword [ebx], eax
mov eax, dword [ebp + 0xc]
mov eax, dword [eax]
mov edi, eax
shr eax, 2
shl edi, 0x1e
or edi, eax
inc dword [ebp - 4]
cmp dword [ebp - 4], 0x50
mov dword [edx], edi
mov eax, dword [esi]
mov edx, dword [ebp + 0xc]
mov dword [edx], eax
mov dword [esi], ecx
jl 0x40f405
pop edi
pop esi
leave
ret
Function at 0x10002450
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call
Read .ini file

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
push esi
sub eax, 0
je 0x100025b2
dec eax
jne 0x10002633
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_DisableThreadLibraryCalls]
push str..__ini__ImmortalsConfig.ini
push 0
push 0x10014604
push str.Server
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
cmp eax, 1
jne 0x100024a7
call fcn.10001450
mov esi, dword [sym.imp.KERNEL32.dll_GetCurrentThread]
call esi
mov ecx, eax
call fcn.10001910
mov edx, 0x100021d0
jmp 0x100024c0
call fcn.10001450
mov esi, dword [sym.imp.KERNEL32.dll_GetCurrentThread]
call esi
mov ecx, eax
call fcn.10001910
mov edx, 0x10002240
sub esp, 0xc
mov ecx, 0x100171c4
call fcn.10001990
call fcn.100015d0
push ebx
push edi
mov dword [0x1001c010], 0x7733da
call fcn.10001450
call esi
mov ecx, eax
call fcn.10001910
sub esp, 0xc
mov edx, 0x10002340
mov ecx, 0x100171c0
call fcn.10001990
sub esp, 0xc
mov edx, 0x10002370
mov ecx, 0x1001c010
call fcn.10001990
call fcn.100015d0
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [ebp + 0xc]
push eax
push 0x40
push 4
push 0x773421
call esi
lea eax, [ebp + 0xc]
mov dword [0x773421], 0x909004eb
push eax
push dword [ebp + 0xc]
push 4
push 0x773421
call esi
lea eax, [ebp + 0xc]
push eax
push 0x40
push 1
push 0x5f1484
call esi
lea eax, [ebp + 0xc]
mov byte [0x5f1484], 0xc3
push eax
push dword [ebp + 0xc]
push 1
push 0x5f1484
call esi
lea eax, [ebp + 0xc]
mov edi, 0x945b8d
push eax
push 0x40
push 1
push edi
lea ebx, [edi + 0x14]
call esi
lea eax, [ebp + 0xc]
mov byte [edi], 0x19
push eax
push dword [ebp + 0xc]
push 1
push edi
call esi
lea eax, [ebp + 0xc]
push eax
push 0x40
push 1
push ebx
call esi
lea eax, [ebp + 0xc]
mov byte [ebx], 0x19
push eax
push dword [ebp + 0xc]
push 1
push ebx
call esi
pop edi
pop ebx
mov eax, 1
pop esi
pop ebp
ret 0xc
push str..__ini__ImmortalsConfig.ini
push 0
push 0x10014604
push str.Server
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
cmp eax, 1
jne 0x100025e9
call fcn.10001450
mov esi, dword [sym.imp.KERNEL32.dll_GetCurrentThread]
call esi
mov ecx, eax
call fcn.10001910
mov edx, 0x100021d0
jmp 0x10002602
call fcn.10001450
mov esi, dword [sym.imp.KERNEL32.dll_GetCurrentThread]
call esi
mov ecx, eax
call fcn.10001910
mov edx, 0x10002240
mov ecx, 0x100171c4
call fcn.10001bd0
call fcn.100015d0
call fcn.10001450
call esi
mov ecx, eax
call fcn.10001910
mov edx, 0x10002340
mov ecx, 0x100171c0
call fcn.10001bd0
call fcn.100015d0
mov eax, 1
pop esi
pop ebp
ret 0xc
Function at 0x402b70
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
push 0
push 0
push dword [ebp + 0xc]
mov dword [0x67cbf0], eax
push 0x402970
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
pop ebp
ret

Function at 0x4257f0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x88
mov eax, dword [0x675980]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov dword [ebp - 8], ecx
mov ecx, 0x67d306
call fcn.0050484f
mov eax, dword [ebp - 8]
cmp dword [eax + 0x38], 0
je 0x425827
mov eax, dword [ebp - 8]
movzx ecx, byte [eax + 0x3d]
test ecx, ecx
jne 0x42582e
mov al, 1
jmp 0x425927
mov eax, dword [ebp - 8]
mov ecx, dword [eax]
mov edx, dword [ecx + 0xc]
mov dword [ebp - 0x7c], edx
call fcn.0042c7c0
mov dword [ebp - 0x80], eax
mov eax, dword [ebp - 0x80]
push eax
mov ecx, dword [ebp - 8]
call dword [ebp - 0x7c]
mov dword [ebp - 0x84], eax
call fcn.0042c7c0
mov dword [ebp - 0x88], eax
mov ecx, dword [ebp - 0x84]
push ecx
mov edx, dword [ebp - 0x88]
push edx
call fcn.0042c7e0
add esp, 8
movzx eax, al
test eax, eax
je 0x425880
xor al, al
jmp 0x425927
mov dword [ebp - 0xc], 0x20
mov eax, dword [ebp - 8]
mov ecx, dword [eax + 0x38]
mov dword [ebp - 0x7c], ecx
lea edx, [ebp - 0x34]
push edx
lea eax, [ebp - 0x10]
push eax
lea ecx, [ebp - 0x30]
push ecx
mov edx, dword [ebp - 8]
add edx, 0x40
push edx
mov ecx, dword [ebp - 0x7c]
call dword [sym.imp.MSVCP140.dll_public:_int___thiscall_std::codecvt_char__char__struct__Mbstatet_::unshift_struct__Mbstatet___char___char___char___const]
mov dword [ebp - 0x80], eax
cmp dword [ebp - 0x80], 0
je 0x4258c3
cmp dword [ebp - 0x80], 1
je 0x4258ca
cmp dword [ebp - 0x80], 3
je 0x42591a
jmp 0x425925
mov eax, dword [ebp - 8]
mov byte [eax + 0x3d], 0
mov eax, dword [ebp - 0x34]
lea ecx, [ebp - 0x30]
sub eax, ecx
mov dword [ebp - 0x38], eax
je 0x4258fa
mov eax, dword [ebp - 8]
mov ecx, dword [eax + 0x4c]
push ecx
mov edx, dword [ebp - 0x38]
push edx
push 1
lea eax, [ebp - 0x30]
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
add esp, 0x10
cmp dword [ebp - 0x38], eax
je 0x4258fa
xor al, al
jmp 0x425927
mov eax, dword [ebp - 8]
movzx ecx, byte [eax + 0x3d]
test ecx, ecx
jne 0x42590e
mov dword [ebp - 0x7c], 1
jmp 0x425915
mov dword [ebp - 0x7c], 0
mov al, byte [ebp - 0x7c]
jmp 0x425927
mov eax, dword [ebp - 8]
mov byte [eax + 0x3d], 0
mov al, 1
jmp 0x425927
xor al, al
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.005048c4
mov esp, ebp
pop ebp
ret
Function at 0x434820
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x68
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
mov ecx, 0x67d306
call fcn.0050484f
cmp dword [ebp + 0x10], 0
jg 0x43484d
jl 0x434844
cmp dword [ebp + 0xc], 0
ja 0x43484d
xor eax, eax
xor edx, edx
jmp 0x434994
mov eax, dword [ebp - 4]
cmp dword [eax + 0x38], 0
je 0x434870
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
mov ecx, dword [ebp - 4]
call dword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____thiscall_std::basic_streambuf_char__struct_std::char_traits_char__::xsgetn_char___long_long___int64__]
jmp 0x434994
mov eax, dword [ebp + 0xc]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 0x10]
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], ecx
mov ecx, dword [ebp - 4]
call dword [sym.imp.MSVCP140.dll_protected:_long_long___int64____thiscall_std::basic_streambuf_char__struct_std::char_traits_char__::_Gnavail_void_const]
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
jbe 0x4348e2
lea eax, [ebp - 0x14]
push eax
lea ecx, [ebp - 8]
push ecx
call fcn.00403770
add esp, 8
mov edx, dword [eax]
mov dword [ebp - 0x18], edx
mov eax, dword [ebp - 0x18]
push eax
mov ecx, dword [ebp - 4]
call dword [sym.imp.MSVCP140.dll_protected:_char____thiscall_std::basic_streambuf_char__struct_std::char_traits_char__::gptr_void_const]
push eax
mov ecx, dword [ebp + 8]
push ecx
call fcn.00403260
add esp, 0xc
mov eax, dword [ebp + 8]
add eax, dword [ebp - 0x18]
mov dword [ebp + 8], eax
mov eax, dword [ebp - 8]
sub eax, dword [ebp - 0x18]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 0x18]
push eax
mov ecx, dword [ebp - 4]
call dword [sym.imp.MSVCP140.dll_protected:_void___thiscall_std::basic_streambuf_char__struct_std::char_traits_char__::gbump_int_]
mov eax, dword [ebp - 4]
cmp dword [eax + 0x4c], 0
je 0x434985
mov ecx, dword [ebp - 4]
call fcn.00427180
mov dword [ebp - 0x1c], 0xfff
cmp dword [ebp - 8], 0xfff
jbe 0x434953
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0x4c]
push ecx
push 0xfff
push 1
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
add esp, 0x10
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 8]
add eax, dword [ebp - 0x20]
mov dword [ebp + 8], eax
mov eax, dword [ebp - 8]
sub eax, dword [ebp - 0x20]
mov dword [ebp - 8], eax
cmp dword [ebp - 0x20], 0xfff
je 0x434951
xor eax, eax
mov ecx, dword [ebp - 0x10]
sub ecx, dword [ebp - 8]
mov edx, dword [ebp - 0xc]
sbb edx, eax
mov eax, ecx
jmp 0x434994
jmp 0x4348fe
cmp dword [ebp - 8], 0
jbe 0x434985
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0x4c]
push ecx
mov edx, dword [ebp - 8]
push edx
push 1
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
add esp, 0x10
mov dword [ebp - 0x64], eax
mov ecx, dword [ebp - 8]
mov dword [ebp - 0x68], ecx
mov edx, dword [ebp - 0x68]
sub edx, dword [ebp - 0x64]
mov dword [ebp - 8], edx
xor eax, eax
mov ecx, dword [ebp - 0x10]
sub ecx, dword [ebp - 8]
mov edx, dword [ebp - 0xc]
sbb edx, eax
mov eax, ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x4349a0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x54
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
mov ecx, 0x67d306
call fcn.0050484f
mov eax, dword [ebp - 4]
cmp dword [eax + 0x38], 0
je 0x4349d9
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
mov ecx, dword [ebp - 4]
call dword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____thiscall_std::basic_streambuf_char__struct_std::char_traits_char__::xsputn_char_const___long_long___int64__]
jmp 0x434abf
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 0x10]
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], ecx
mov ecx, dword [ebp - 4]
call dword [sym.imp.MSVCP140.dll_protected:_long_long___int64____thiscall_std::basic_streambuf_char__struct_std::char_traits_char__::_Pnavail_void_const]
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x10], edx
cmp dword [ebp + 0x10], 0
jl 0x434a70
jg 0x434a02
cmp dword [ebp + 0xc], 0
jbe 0x434a70
cmp dword [ebp - 0x10], 0
jl 0x434a70
jg 0x434a10
cmp dword [ebp - 0x14], 0
jbe 0x434a70
mov eax, dword [ebp + 0x10]
cmp eax, dword [ebp - 0x10]
jg 0x434a2e
jl 0x434a22
mov ecx, dword [ebp + 0xc]
cmp ecx, dword [ebp - 0x14]
jae 0x434a2e
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 0x10]
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x10], ecx
mov eax, dword [ebp - 0x14]
push eax
mov ecx, dword [ebp + 8]
push ecx
mov ecx, dword [ebp - 4]
call dword [sym.imp.MSVCP140.dll_protected:_char____thiscall_std::basic_streambuf_char__struct_std::char_traits_char__::pptr_void_const]
push eax
call fcn.00403260
add esp, 0xc
mov eax, dword [ebp - 0x14]
add eax, dword [ebp + 8]
mov dword [ebp + 8], eax
mov eax, dword [ebp + 0xc]
sub eax, dword [ebp - 0x14]
mov ecx, dword [ebp + 0x10]
sbb ecx, dword [ebp - 0x10]
mov dword [ebp + 0xc], eax
mov dword [ebp + 0x10], ecx
mov eax, dword [ebp - 0x14]
push eax
mov ecx, dword [ebp - 4]
call dword [sym.imp.MSVCP140.dll_protected:_void___thiscall_std::basic_streambuf_char__struct_std::char_traits_char__::pbump_int_]
cmp dword [ebp + 0x10], 0
jl 0x434ab3
jg 0x434a7e
cmp dword [ebp + 0xc], 0
jbe 0x434ab3
mov eax, dword [ebp - 4]
cmp dword [eax + 0x4c], 0
je 0x434ab3
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0x4c]
push ecx
mov edx, dword [ebp + 0xc]
push edx
push 1
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
add esp, 0x10
xor ecx, ecx
mov edx, dword [ebp + 0xc]
sub edx, eax
mov eax, dword [ebp + 0x10]
sbb eax, ecx
mov dword [ebp + 0xc], edx
mov dword [ebp + 0x10], eax
mov eax, dword [ebp - 0xc]
sub eax, dword [ebp + 0xc]
mov edx, dword [ebp - 8]
sbb edx, dword [ebp + 0x10]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x439a30
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x50a150
mov eax, dword fs:[0]
push eax
sub esp, 0x44
push ebx
push esi
push edi
mov eax, dword [0x675980]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], ecx
mov ecx, 0x67d7b0
call fcn.0050484f
mov ecx, dword [ebp - 0x10]
call fcn.004399d0
mov ecx, dword [ebp - 0x10]
add ecx, 0x38
call fcn.00437a10
mov ecx, dword [ebp - 0x10]
add ecx, 0x64
call fcn.00437a60
mov dword [ebp - 4], 0
mov ecx, dword [ebp - 0x10]
add ecx, 0x7c
call fcn.0043a270
mov ecx, dword [ebp - 0x10]
add ecx, 0x84
call fcn.0043a270
mov ecx, dword [ebp - 0x10]
add ecx, 0x8c
call fcn.0043a270
mov ecx, dword [ebp - 0x10]
add ecx, 0x94
call fcn.0043a270
mov eax, 4
shl eax, 0
mov ecx, dword [ebp - 0x10]
mov dword [ecx + eax + 0x28], 0xffffffff
mov edx, 4
imul eax, edx, 0
mov ecx, dword [ebp - 0x10]
mov dword [ecx + eax + 0x28], 0xffffffff
mov eax, 4
shl eax, 0
mov ecx, dword [ebp - 0x10]
mov dword [ecx + eax + 0x30], 0
mov edx, 4
imul eax, edx, 0
mov ecx, dword [ebp - 0x10]
mov dword [ecx + eax + 0x30], 0
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret