joyce8/EMBER2024-capa huggingface dataset:
Function at 0x402fe0
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x23c
mov eax, dword [0x410008]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x10]
push ebx
push esi
push edi
mov edi, dword [ebp + 0x14]
mov ebx, edx
push 0x210
mov dword [ebp - 0x23c], eax
mov esi, ecx
lea eax, [ebp - 0x230]
mov dword [ebp - 0x234], edi
push 0
push eax
call sub.VCRUNTIME140.dll_memset
lea ecx, [ebp - 0x228]
add esp, 0xc
mov eax, ecx
mov edx, 0x104
sub esi, eax
lea eax, [edx + 0x7ffffefa]
test eax, eax
je 0x40304f
movzx eax, word [esi + ecx]
test ax, ax
je 0x40304f
mov word [ecx], ax
add ecx, 2
sub edx, 1
jne 0x403031
movq xmm0, qword [str.LoadLibraryExW]
lea eax, [ecx - 2]
test edx, edx
movq qword [ebp - 0x14], xmm0
mov edx, 0x40c3e0
cmovne eax, ecx
xor ecx, ecx
mov dword [ebp - 0x18], ecx
mov word [eax], cx
mov ecx, ebx
mov eax, dword [0x40c4c0]
mov dword [ebp - 0xc], eax
mov ax, word [0x40c4c4]
mov word [ebp - 8], ax
mov al, byte [0x40c4c6]
mov byte [ebp - 6], al
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x14]
push eax
call fcn.00401a90
add esp, 8
test al, al
jne 0x4030bf
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [edi], eax
mov eax, 7
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0040a480
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 0x18]
mov esi, fcn.00403240
push 0x40
sub esi, 0x403200
mov dword [ebp - 0x22c], eax
push 0x3000
lea eax, [esi + 0x220]
push eax
push 0
push ebx
call dword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov edi, eax
test edi, edi
jne 0x403112
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [ebp - 0x234]
mov dword [ecx], eax
lea eax, [edi + 3]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0040a480
mov esp, ebp
pop ebp
ret
push 0
push 0x210
lea eax, [ebp - 0x230]
push eax
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
test eax, eax
jne 0x40315f
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [ebp - 0x234]
push 0x8000
push 0
push edi
push ebx
mov dword [ecx], eax
call dword [sym.imp.KERNEL32.dll_VirtualFreeEx]
mov eax, 9
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0040a480
mov esp, ebp
pop ebp
ret
push 0
push esi
lea eax, [edi + 0x21f]
and eax, 0xfffffff0
push 0x403200
push eax
push ebx
mov dword [ebp - 0x238], eax
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
test eax, eax
je 0x40312c
mov ecx, dword [ebp - 0x234]
lea eax, [ebp - 0x1c]
mov esi, dword [ebp + 8]
mov edx, dword [ebp - 0x238]
push eax
mov eax, dword [ebp + 0xc]
shr eax, 5
push ecx
and al, 1
mov dword [ebp - 0x1c], 0
movzx eax, al
mov ecx, ebx
push eax
push esi
push edi
call fcn.00406fe0
mov edx, dword [ebp - 0x23c]
add esp, 0x14
mov ecx, dword [ebp - 0x1c]
mov dword [ebp - 0x238], eax
mov dword [edx], ecx
cmp esi, 3
je 0x4031e0
push 0x8000
push 0
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_VirtualFreeEx]
mov eax, dword [ebp - 0x238]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0040a480
mov esp, ebp
pop ebp
ret
Function at 0x404e20
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
push esi
push 0x40
mov esi, ecx
push 0x3000
push dword [esi + 0x18]
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov dword [esi + 4], eax
test eax, eax
jne 0x404e54
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [ebp + 8]
pop esi
mov dword [ecx], eax
mov eax, 4
pop ebp
ret 4
test byte [esi + 0x3c], 8
push edi
je 0x404e8a
call dword [sym.imp.KERNEL32.dll_GetTickCount64]
push eax
call dword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_srand]
add esp, 4
call dword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
and eax, 0x80000fff
jns 0x404e7f
dec eax
or eax, 0xfffff000
inc eax
add eax, 0x10f
and eax, 0xfffffff0
mov dword [esi + 0x20], eax
mov eax, dword [esi + 0x20]
sub eax, 0x405640
add eax, 0x14
add eax, dword [esi + 0x18]
push 0x40
add eax, 0x4058e0
test byte [esi + 0x3c], 8
push 0x3000
mov dword [esi + 0x1c], eax
push eax
jne 0x404ed0
mov eax, dword [esi + 0x10]
push dword [eax + 0x1c]
push dword [esi + 0x38]
call dword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov ecx, eax
mov dword [esi + 0x24], ecx
test ecx, ecx
jne 0x404f0a
push 0x40
push 0x3000
push dword [esi + 0x1c]
push 0
push dword [esi + 0x38]
call dword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov ecx, eax
mov dword [esi + 0x24], ecx
test ecx, ecx
jne 0x404f0a
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [ebp + 8]
push 0x8000
push 0
push dword [esi + 4]
mov dword [ecx], eax
call dword [sym.imp.KERNEL32.dll_VirtualFree]
pop edi
mov eax, 3
pop esi
pop ebp
ret 4
add ecx, dword [esi + 0x20]
mov eax, dword [esi + 0x18]
add eax, ecx
mov dword [esi + 0x28], ecx
mov dword [esi + 0x30], eax
add eax, 0x14
mov dword [esi + 0x2c], eax
xor eax, eax
pop edi
pop esi
pop ebp
ret 4
Function at 0x404f30
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x410008]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
mov esi, ecx
mov dword [ebp - 0x28], eax
push edi
mov eax, dword [esi + 0x10]
push dword [eax + 0x3c]
push dword [esi]
push dword [esi + 4]
call sub.VCRUNTIME140.dll_memcpy
mov eax, dword [esi + 0xc]
xor ebx, ebx
add esp, 0xc
movzx edi, word [eax + 0x14]
add edi, eax
mov eax, dword [esi + 0x14]
cmp word [eax + 2], bx
je 0x404fa0
add edi, 0x28
mov eax, dword [edi]
test eax, eax
je 0x404f91
push eax
mov eax, dword [edi + 4]
add eax, dword [esi]
push eax
mov eax, dword [edi - 4]
add eax, dword [esi + 4]
push eax
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
mov eax, dword [esi + 0x14]
inc ebx
add edi, 0x28
movzx eax, word [eax + 2]
cmp ebx, eax
jne 0x404f75
test byte [esi + 0x3c], 8
mov ebx, dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
je 0x405037
mov eax, dword [esi + 0x20]
xor ecx, ecx
shr eax, 2
mov edx, 4
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.0040a48e
add esp, 4
mov dword [ebp - 0x24], eax
call dword [sym.imp.KERNEL32.dll_GetTickCount64]
mov ebx, dword [esi + 0x20]
xor edx, edx
mov ecx, ebx
mov edi, eax
shr ecx, 2
sub ecx, 1
je 0x405015
nop dword [eax]
mov eax, dword [ebp - 0x24]
mov ecx, edx
and ecx, 0x1f
mov dword [eax + edx*4], edi
mov eax, edx
mov ebx, dword [esi + 0x20]
inc edx
shl eax, cl
xor edi, eax
mov eax, ebx
shr eax, 2
sub edi, 0x11111111
dec eax
cmp edx, eax
jb 0x404ff0
push 0
push ebx
mov ebx, dword [ebp - 0x24]
push ebx
push dword [esi + 0x24]
push dword [esi + 0x38]
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
push ebx
call fcn.0040a497
mov ebx, dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
add esp, 4
mov ecx, dword [esi + 0x38]
mov edx, 0x40c3e0
call fcn.00401990
mov ecx, dword [esi + 0x38]
mov edi, eax
lea eax, [ebp - 8]
mov dword [ebp - 8], 0
push eax
push str.LoadLibraryA
mov edx, edi
call fcn.00401ac0
add esp, 8
test al, al
je 0x405119
mov ecx, dword [esi + 0x38]
lea eax, [ebp - 0xc]
push eax
push 0x40c714
mov edx, edi
mov dword [ebp - 0xc], 0
call fcn.00401ac0
add esp, 8
test al, al
je 0x405119
mov eax, dword [ebp - 8]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x18], eax
mov eax, dword [esi + 0x28]
push 0
mov dword [ebp - 0x14], eax
mov eax, dword [esi + 0x3c]
push 0x14
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x20]
push eax
push dword [esi + 0x30]
mov dword [ebp - 0x20], 0
push dword [esi + 0x38]
call ebx
test eax, eax
jne 0x4050e6
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [ebp - 0x28]
mov dword [ecx], eax
mov eax, 9
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0040a480
mov esp, ebp
pop ebp
ret 4
push 0
mov eax, 0x4058e0
sub eax, 0x405640
push eax
push 0x405640
push dword [esi + 0x2c]
push dword [esi + 0x38]
call ebx
test eax, eax
je 0x4050c3
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0040a480
mov esp, ebp
pop ebp
ret 4
mov ecx, dword [ebp - 4]
mov eax, 7
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0040a480
mov esp, ebp
pop ebp
ret 4
Function at 0x405c60
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x1c
push ebx
mov ebx, ecx
push esi
push edi
cmp dword [ebx + 0x38], 0
je 0x405c8c
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____thiscall_std::basic_streambuf_char__struct_std::char_traits_char__::xsputn_char_const___long_long___int64__]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov eax, dword [ebx + 0x20]
mov esi, dword [ebp + 0xc]
mov edi, dword [ebp + 0x10]
mov dword [esp + 0x20], esi
mov ecx, dword [eax]
lea eax, [ebx + 0x30]
mov dword [esp + 0x24], edi
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x18], eax
test ecx, ecx
je 0x405cb4
mov eax, dword [eax]
mov ecx, dword [eax]
jmp 0x405cba
xor ecx, ecx
mov dword [esp + 0x18], eax
mov eax, ecx
cdq
mov dword [esp + 0x10], eax
mov ecx, edx
mov dword [esp + 0x14], ecx
test edi, edi
jl 0x405d22
jg 0x405cd1
test esi, esi
je 0x405d22
test ecx, ecx
jl 0x405d1d
jg 0x405cdb
test eax, eax
je 0x405d1d
cmp edi, ecx
jg 0x405cef
jl 0x405ce5
cmp esi, eax
jae 0x405cef
mov eax, esi
mov dword [esp + 0x10], esi
mov dword [esp + 0x14], edi
push eax
push dword [ebp + 8]
push dword [esp + 0x24]
call sub.VCRUNTIME140.dll_memcpy
mov eax, dword [esp + 0x24]
add esp, 0xc
mov edx, dword [esp + 0x10]
mov ecx, dword [ebp + 8]
add ecx, edx
sub esi, edx
mov eax, dword [eax]
sbb edi, dword [esp + 0x14]
sub dword [eax], edx
mov eax, dword [ebx + 0x20]
add dword [eax], edx
jmp 0x405d25
mov ecx, dword [ebp + 8]
jmp 0x405d2f
mov ecx, dword [ebp + 8]
test edi, edi
jl 0x405d49
jg 0x405d2f
test esi, esi
je 0x405d49
mov eax, dword [ebx + 0x4c]
test eax, eax
je 0x405d49
push eax
push esi
push 1
push ecx
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
add esp, 0x10
sub esi, eax
sbb edi, 0
mov eax, dword [esp + 0x20]
mov edx, dword [esp + 0x24]
sub eax, esi
sbb edx, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x405d60
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [ebp + 0x10]
push ebx
mov ebx, ecx
mov ecx, dword [ebp + 0xc]
push esi
mov esi, dword [ebp + 8]
mov dword [ebp - 4], esi
test eax, eax
jg 0x405d8c
jl 0x405d80
test ecx, ecx
jne 0x405d8c
pop esi
xor eax, eax
xor edx, edx
pop ebx
mov esp, ebp
pop ebp
ret 0xc
cmp dword [ebx + 0x38], 0
je 0x405da5
push eax
push ecx
push esi
mov ecx, ebx
call dword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____thiscall_std::basic_streambuf_char__struct_std::char_traits_char__::xsgetn_char___long_long___int64__]
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov eax, dword [ebx + 0x1c]
push edi
mov edi, ecx
mov eax, dword [eax]
mov dword [ebp - 8], eax
test eax, eax
je 0x405df3
mov eax, dword [ebx + 0x2c]
lea edx, [ebx + 0x2c]
mov dword [ebp - 0xc], edx
mov eax, dword [eax]
test eax, eax
je 0x405df9
mov edi, dword [ebp - 4]
cmp eax, ecx
mov esi, ecx
cmovb esi, eax
push esi
push dword [ebp - 8]
push edi
call sub.VCRUNTIME140.dll_memcpy
mov eax, dword [ebx + 0x2c]
add edi, esi
mov dword [ebp - 4], edi
add esp, 0xc
mov edi, dword [ebp + 0xc]
sub edi, esi
sub dword [eax], esi
mov eax, dword [ebx + 0x1c]
add dword [eax], esi
mov esi, dword [ebp - 4]
jmp 0x405df9
lea eax, [ebx + 0x2c]
mov dword [ebp - 0xc], eax
cmp dword [ebx + 0x4c], 0
je 0x405e66
mov ecx, dword [ebx + 0xc]
lea eax, [ebx + 0x3c]
cmp dword [ecx], eax
jne 0x405e22
mov eax, dword [ebx + 0xc]
mov edx, dword [ebx + 0x54]
mov ecx, dword [ebx + 0x50]
sub edx, ecx
mov dword [eax], ecx
mov eax, dword [ebx + 0x1c]
mov dword [eax], ecx
mov eax, dword [ebp - 0xc]
mov eax, dword [eax]
mov dword [eax], edx
mov eax, dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
cmp edi, 0xfff
jbe 0x405e54
nop
push dword [ebx + 0x4c]
push 0xfff
push 1
push esi
call eax
add esp, 0x10
add esi, eax
sub edi, eax
cmp eax, 0xfff
jne 0x405e66
cmp edi, eax
mov eax, dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
ja 0x405e30
test edi, edi
je 0x405e66
push dword [ebx + 0x4c]
push edi
push 1
push esi
call eax
add esp, 0x10
sub edi, eax
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 0x10]
sub eax, edi
pop edi
pop esi
sbb edx, 0
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x4061a0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
mov eax, dword [0x410008]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, ecx
cmp ebx, 0xffffffff
jne 0x4061d0
pop esi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0040a480
mov esp, ebp
pop ebp
ret 4
mov eax, dword [esi + 0x20]
push edi
mov ecx, dword [eax]
test ecx, ecx
je 0x40620c
mov edx, dword [esi + 0x30]
mov edi, dword [edx]
lea eax, [edi + ecx]
cmp ecx, eax
jae 0x40620c
lea ecx, [edi - 1]
mov eax, ebx
mov dword [edx], ecx
mov edx, dword [esi + 0x20]
pop edi
mov esi, dword [edx]
lea ecx, [esi + 1]
mov dword [edx], ecx
mov byte [esi], bl
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0040a480
mov esp, ebp
pop ebp
ret 4
cmp dword [esi + 0x4c], 0
je 0x4062e3
mov edi, dword [esi + 0xc]
lea eax, [esi + 0x3c]
cmp dword [edi], eax
jne 0x406234
mov edx, dword [esi + 0x54]
mov ecx, dword [esi + 0x50]
sub edx, ecx
mov dword [edi], ecx
mov eax, dword [esi + 0x1c]
mov dword [eax], ecx
mov eax, dword [esi + 0x2c]
mov dword [eax], edx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x406240
movsx eax, bl
jmp 0x406278
lea eax, [ebp - 0x2c]
mov byte [ebp - 0x25], bl
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x25]
push eax
lea eax, [esi + 0x40]
push eax
call dword [sym.imp.MSVCP140.dll_public:_int___thiscall_std::codecvt_char__char__struct__Mbstatet_::out_struct__Mbstatet___char_const___char_const___char_const____char___char___char___const]
sub eax, 0
je 0x4062a2
sub eax, 1
je 0x4062a2
sub eax, 2
jne 0x4062e3
movsx eax, byte [ebp - 0x25]
push dword [esi + 0x4c]
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
add esp, 8
or ecx, 0xffffffff
cmp eax, ecx
cmove ebx, ecx
pop edi
pop esi
mov eax, ebx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0040a480
mov esp, ebp
pop ebp
ret 4
mov edi, dword [ebp - 0x2c]
lea eax, [ebp - 0x24]
sub edi, eax
je 0x4062c0
push dword [esi + 0x4c]
push edi
push 1
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
add esp, 0x10
cmp edi, eax
jne 0x4062e3
lea ecx, [ebp - 0x25]
mov byte [esi + 0x3d], 1
or eax, 0xffffffff
cmp dword [ebp - 0x30], ecx
pop edi
pop esi
cmovne eax, ebx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0040a480
mov esp, ebp
pop ebp
ret 4
mov ecx, dword [ebp - 4]
or eax, 0xffffffff
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0040a480
mov esp, ebp
pop ebp
ret 4
Function at 0x406660
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x410008]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, ecx
cmp dword [esi + 0x38], 0
je 0x40671c
cmp byte [esi + 0x3d], 0
je 0x40671c
mov eax, dword [esi]
push edi
push 0xffffffffffffffff
call dword [eax + 0xc]
cmp eax, 0xffffffff
je 0x40670a
mov ecx, dword [esi + 0x38]
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [esi + 0x40]
push eax
call dword [sym.imp.MSVCP140.dll_public:_int___thiscall_std::codecvt_char__char__struct__Mbstatet_::unshift_struct__Mbstatet___char___char___char___const]
sub eax, 0
je 0x4066d1
sub eax, 1
je 0x4066d5
sub eax, 2
jne 0x40670a
mov byte [esi + 0x3d], al
mov al, 1
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0040a480
mov esp, ebp
pop ebp
ret
mov byte [esi + 0x3d], 0
mov edi, dword [ebp - 0x28]
lea eax, [ebp - 0x24]
sub edi, eax
je 0x4066f3
push dword [esi + 0x4c]
push edi
push 1
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
add esp, 0x10
cmp edi, eax
jne 0x40670a
cmp byte [esi + 0x3d], 0
pop edi
sete al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0040a480
mov esp, ebp
pop ebp
ret
pop edi
xor al, al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0040a480
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
mov al, 1
xor ecx, ebp
pop esi
call fcn.0040a480
mov esp, ebp
pop ebp
ret
Function at 0x408a40
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
mov eax, dword [0x410008]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
mov edi, 0xffff
mov esi, ecx
cmp di, bx
jne 0x408a77
pop edi
pop esi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0040a480
mov esp, ebp
pop ebp
ret 4
mov eax, dword [esi + 0x20]
mov ecx, dword [eax]
test ecx, ecx
je 0x408ab1
mov edx, dword [esi + 0x30]
mov eax, dword [edx]
lea eax, [ecx + eax*2]
cmp ecx, eax
jae 0x408ab1
dec dword [edx]
mov ax, bx
mov edx, dword [esi + 0x20]
pop edi
mov esi, dword [edx]
lea ecx, [esi + 2]
mov dword [edx], ecx
mov word [esi], bx
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0040a480
mov esp, ebp
pop ebp
ret 4
cmp dword [esi + 0x4c], 0
je 0x408b84
mov ecx, dword [esi + 0xc]
lea eax, [esi + 0x3c]
cmp dword [ecx], eax
jne 0x408ade
mov eax, dword [esi + 0xc]
mov edx, dword [esi + 0x54]
mov ecx, dword [esi + 0x50]
sub edx, ecx
sar edx, 1
mov dword [eax], ecx
mov eax, dword [esi + 0x1c]
mov dword [eax], ecx
mov eax, dword [esi + 0x2c]
mov dword [eax], edx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x408b11
push dword [esi + 0x4c]
push ebx
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputwc]
add esp, 8
movzx ecx, bx
cmp ax, di
cmove ecx, edi
pop edi
pop esi
mov ax, cx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0040a480
mov esp, ebp
pop ebp
ret 4
movzx eax, bx
mov dword [ebp - 0x28], eax
lea eax, [ebp - 0x2c]
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 0x26]
push eax
lea eax, [ebp - 0x28]
push eax
lea eax, [esi + 0x40]
push eax
call dword [sym.imp.MSVCP140.dll_public:_int___thiscall_std::codecvt_wchar_t__char__struct__Mbstatet_::out_struct__Mbstatet___wchar_t_const___wchar_t_const___wchar_t_const____char___char___char___const]
sub eax, 0
je 0x408b50
sub eax, 1
je 0x408b50
sub eax, 2
jne 0x408b84
push dword [esi + 0x4c]
push dword [ebp - 0x28]
jmp 0x408ae9
mov eax, dword [ebp - 0x2c]
lea ecx, [ebp - 0x24]
sub eax, ecx
mov dword [ebp - 0x34], eax
je 0x408b74
push dword [esi + 0x4c]
push eax
mov eax, ecx
push 1
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
add esp, 0x10
cmp dword [ebp - 0x34], eax
jne 0x408b84
lea ecx, [ebp - 0x28]
movzx eax, bx
cmp dword [ebp - 0x30], ecx
mov byte [esi + 0x3e], 1
cmovne edi, eax
mov ecx, dword [ebp - 4]
mov ax, di
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0040a480
mov esp, ebp
pop ebp
ret 4
Function at 0x408f30
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x410008]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, ecx
cmp dword [esi + 0x38], 0
je 0x408ff4
cmp byte [esi + 0x3e], 0
je 0x408ff4
mov eax, dword [esi]
push edi
push 0xffff
call dword [eax + 0xc]
mov ecx, 0xffff
cmp cx, ax
je 0x408fe2
mov ecx, dword [esi + 0x38]
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [esi + 0x40]
push eax
call dword [sym.imp.MSVCP140.dll_public:_int___thiscall_std::codecvt_wchar_t__char__struct__Mbstatet_::unshift_struct__Mbstatet___char___char___char___const]
sub eax, 0
je 0x408fa9
sub eax, 1
je 0x408fad
sub eax, 2
jne 0x408fe2
mov byte [esi + 0x3e], al
mov al, 1
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0040a480
mov esp, ebp
pop ebp
ret
mov byte [esi + 0x3e], 0
mov edi, dword [ebp - 0x28]
lea eax, [ebp - 0x24]
sub edi, eax
je 0x408fcb
push dword [esi + 0x4c]
push edi
push 1
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
add esp, 0x10
cmp edi, eax
jne 0x408fe2
cmp byte [esi + 0x3e], 0
pop edi
sete al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0040a480
mov esp, ebp
pop ebp
ret
pop edi
xor al, al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0040a480
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
mov al, 1
xor ecx, ebp
pop esi
call fcn.0040a480
mov esp, ebp
pop ebp
ret

Function at 0x4094a0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ecx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
setne al
ret
Function at 0x4094b0
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x40b810
mov eax, dword fs:[0]
push eax
sub esp, 0xdc
mov eax, dword [0x410008]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
push 0xb8
lea eax, [ebp - 0xe0]
push 0
push eax
call sub.VCRUNTIME140.dll_memset
push esi
lea ecx, [ebp - 0xe0]
call fcn.004063a0
mov dword [ebp - 4], 0
lea ecx, [ebp - 0xe0]
mov eax, dword [ebp - 0xe0]
add ecx, dword [eax + 4]
call dword [sym.imp.MSVCP140.dll_public:_bool___thiscall_std::ios_base::good_void_const]
test al, al
jne 0x409529
mov esi, 0x20000001
jmp 0x4095ff
lea eax, [ebp - 0x28]
push eax
lea ecx, [ebp - 0xe0]
call dword [sym.imp.MSVCP140.dll_public:_class_std::fpos_struct__Mbstatet____thiscall_std::basic_istream_char__struct_std::char_traits_char__::tellg_void_]
mov ecx, dword [ebp - 0x20]
add ecx, dword [ebp - 0x28]
mov eax, dword [ebp - 0x1c]
adc eax, dword [ebp - 0x24]
test eax, eax
jg 0x40955d
jl 0x409553
cmp ecx, 0x1000
jae 0x40955d
mov esi, 0x20000002
jmp 0x4095ff
push 0x1000
call fcn.0040a48e
add esp, 4
lea ecx, [ebp - 0xe0]
mov edi, eax
push 0
push 0
push 0
call dword [sym.imp.MSVCP140.dll_public:_class_std::basic_istream_char__struct_std::char_traits_char______thiscall_std::basic_istream_char__struct_std::char_traits_char__::seekg_long_long___int64___int_]
push 0
push 0x1000
push edi
lea ecx, [ebp - 0xe0]
call dword [sym.imp.MSVCP140.dll_public:_class_std::basic_istream_char__struct_std::char_traits_char______thiscall_std::basic_istream_char__struct_std::char_traits_char__::read_char___long_long___int64__]
lea ecx, [ebp - 0xd0]
call fcn.00406730
test eax, eax
jne 0x4095b9
push eax
mov eax, dword [ebp - 0xe0]
lea ecx, [ebp - 0xe0]
push 2
add ecx, dword [eax + 4]
call dword [sym.imp.MSVCP140.dll_public:_void___thiscall_std::basic_ios_char__struct_std::char_traits_char__::setstate_int__bool_]
mov eax, dword [edi + 0x3c]
movzx esi, word [edi]
push edi
mov ebx, dword [eax + edi]
movzx eax, word [eax + edi + 4]
mov dword [ebp - 0xe4], eax
call fcn.0040a497
mov eax, 0x5a4d
add esp, 4
cmp si, ax
jne 0x4095fa
cmp ebx, 0x4550
jne 0x4095fa
mov eax, 0x14c
cmp word [ebp - 0xe4], ax
jne 0x4095fa
xor esi, esi
jmp 0x4095ff
mov esi, 0x20000003
lea ecx, [ebp - 0xe0]
call fcn.00405580
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0040a480
mov esp, ebp
pop ebp
ret