joyce8/EMBER2024-capa huggingface dataset:
Function at 0xd2b250
Capabilities:
Compare security identifiers

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0xd3f808
push 0xd2f288
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x2c
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x28], ebx
xor esi, esi
mov dword [ebp - 0x20], esi
mov byte [ebp - 0x24], bl
mov dword [ebp - 4], ebx
mov byte [ebp - 0x34], bl
mov byte [ebp - 0x33], bl
mov byte [ebp - 0x32], bl
mov byte [ebp - 0x31], bl
mov byte [ebp - 0x30], bl
mov byte [ebp - 0x2f], 5
lea eax, [ebp - 0x1c]
push eax
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push 0x12
push 1
lea ecx, [ebp - 0x34]
push ecx
call dword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
test eax, eax
je 0xd2b329
lea edx, [ebp - 0x28]
push edx
push 8
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0xd2b329
mov dword [ebp - 0x2c], ebx
lea eax, [ebp - 0x2c]
push eax
push ebx
push ebx
push 1
mov ecx, dword [ebp - 0x28]
push ecx
mov edi, dword [sym.imp.ADVAPI32.dll_GetTokenInformation]
call edi
mov edx, dword [ebp - 0x2c]
push edx
call fcn.00d2e1d3
add esp, 4
mov esi, eax
mov dword [ebp - 0x38], esi
mov dword [ebp - 0x20], esi
cmp esi, ebx
je 0xd2b329
lea eax, [ebp - 0x2c]
push eax
mov ecx, dword [ebp - 0x2c]
push ecx
push esi
push 1
mov edx, dword [ebp - 0x28]
push edx
call edi
test eax, eax
je 0xd2b329
mov eax, dword [ebp - 0x1c]
push eax
mov ecx, dword [esi]
push ecx
call dword [sym.imp.ADVAPI32.dll_EqualSid]
neg eax
sbb eax, eax
neg eax
mov byte [ebp - 0x24], al
jmp 0xd2b32c
mov al, byte [ebp - 0x24]
mov dword [ebp - 4], 0xffffffff
call fcn.00d2b351
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0xd2bd20
Capabilities:
Query or enumerate registry value

Disassembly:
push ecx
mov edx, dword [esp + 8]
push esi
mov esi, dword [esp + 0x10]
lea eax, [esp + 4]
push eax
mov eax, dword [ecx + 4]
push esi
push 0
push 0
push edx
push eax
mov dword [esp + 0x1c], 8
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0xd2bd58
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x18]
mov dword [esi], ecx
mov dword [esi + 4], edx
pop esi
pop ecx
ret 0x10

Function at 0xd2bd60
Capabilities:
Query or enumerate registry value

Disassembly:
mov edx, dword [esp + 4]
push esi
mov esi, dword [esp + 0xc]
lea eax, [esp + 0x10]
push eax
mov eax, dword [ecx + 4]
push esi
push 0
push 0
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0xd2bd94
mov eax, dword [esp + 0x14]
test eax, eax
je 0xd2bd94
push eax
push esi
call fcn.00d2e20b
add esp, 8
pop esi
ret 0x10

Function at 0xd2bda0
Capabilities:
Query or enumerate registry value

Disassembly:
mov edx, dword [esp + 4]
sub esp, 0x24
lea eax, [esp + 0x28]
push eax
mov eax, dword [ecx + 4]
push 0x20019
push 0
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0xd2be22
push ebx
mov ebx, dword [esp + 0x30]
push esi
xor esi, esi
test ebx, ebx
jbe 0xd2be15
push ebp
mov ebp, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push edi
mov edi, dword [esp + 0x40]
push esi
lea ecx, [esp + 0x18]
push 0xd44320
push ecx
mov dword [esp + 0x1c], 4
call fcn.00d2ddff
mov ecx, dword [esp + 0x44]
add esp, 0xc
lea edx, [esp + 0x10]
lea eax, [esp + 0x14]
push edx
push edi
push 0
push 0
push eax
push ecx
call ebp
inc esi
add edi, 4
cmp esi, ebx
jb 0xd2bdda
pop edi
pop ebp
mov edx, dword [esp + 0x30]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
pop ebx
add esp, 0x24
ret 0xc

Function at 0xd2be30
Capabilities:
Query or enumerate registry value

Disassembly:
mov edx, dword [esp + 4]
sub esp, 0x28
lea eax, [esp + 0x2c]
push eax
mov eax, dword [ecx + 4]
push 0x20019
push 0
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0xd2bec2
push ebp
mov ebp, dword [esp + 0x34]
push esi
xor esi, esi
test ebp, ebp
jbe 0xd2beb5
push ebx
mov ebx, dword [esp + 0x40]
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push esi
lea ecx, [esp + 0x1c]
push 0xd44320
push ecx
mov dword [esp + 0x1c], 4
call fcn.00d2ddff
add esp, 0xc
lea edx, [esp + 0x10]
lea eax, [esp + 0x14]
lea ecx, [esp + 0x18]
push edx
mov edx, dword [esp + 0x40]
push eax
push 0
push 0
push ecx
push edx
call edi
test eax, eax
jne 0xd2beab
mov ax, word [esp + 0x14]
mov word [ebx], ax
inc esi
add ebx, 2
cmp esi, ebp
jb 0xd2be6a
pop edi
pop ebx
mov ecx, dword [esp + 0x34]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
pop ebp
add esp, 0x28
ret 0xc
Function at 0xd2c000
Capabilities:
Get file version info

Disassembly:
push ecx
push ebx
mov ebx, dword [esp + 0xc]
push ebp
push esi
lea eax, [esp + 0xc]
push edi
push eax
push ebx
call sub.VERSION.dll_GetFileVersionInfoSizeW
mov esi, eax
test esi, esi
je 0xd2c131
push esi
call fcn.00d2f145
add esp, 4
mov edi, eax
push edi
push esi
push 0
push ebx
call sub.VERSION.dll_GetFileVersionInfoW
push 0
push 0x80
push 3
push 0
push 0
push 0xc0000000
push ebx
call fcn.00d1e080
mov ebp, eax
add esp, 0x1c
cmp ebp, 0xffffffff
je 0xd2c131
push 0
push ebp
call fcn.00d1e3a0
push 0
push 0
push 0
push 4
push 0
push ebp
mov ebx, eax
call fcn.00d1e260
add esp, 0x20
mov dword [esp + 0x18], eax
test eax, eax
jne 0xd2c08b
push ebp
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
push 0
push 0
push 0
push 6
push eax
call fcn.00d1e2f0
mov esi, eax
add esp, 0x14
test esi, esi
je 0xd2c121
push 0xd44918
push edi
call fcn.00d2d3f0
push eax
push ebx
push esi
call fcn.00d2bf60
push 0xd448f8
push edi
call fcn.00d2d3f0
push eax
push ebx
push esi
call fcn.00d2bf60
push 0xd448d8
push edi
call fcn.00d2d3f0
push eax
push ebx
push esi
call fcn.00d2bf60
push 0xd448c0
push edi
call fcn.00d2d3f0
add esp, 0x44
push eax
push ebx
push esi
call fcn.00d2bf60
push 0xd448a0
push edi
call fcn.00d2d3f0
push eax
push ebx
push esi
call fcn.00d2bf60
push 0xd44888
push edi
call fcn.00d2d3f0
push eax
push ebx
push esi
call fcn.00d2bf60
add esp, 0x34
push esi
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov ecx, dword [esp + 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push ecx
call esi
push ebp
call esi
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
Function at 0xd2d1b0
Capabilities:
Acquire debug privileges

Disassembly:
push ecx
lea eax, [esp]
mov dword [esp], 0
push eax
push 0x20
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [esp]
push 1
push str.SeBackupPrivilege
push ecx
call fcn.00d2d140
mov edx, dword [esp + 0xc]
push 1
push str.SeDebugPrivilege
push edx
call fcn.00d2d140
mov eax, dword [esp + 0x18]
push 1
push str.SeRestorePrivilege
push eax
call fcn.00d2d140
mov ecx, dword [esp + 0x24]
push 1
push str.SeSecurityPrivilege
push ecx
call fcn.00d2d140
mov edx, dword [esp + 0x30]
add esp, 0x30
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, 1
pop ecx
ret

Function at 0xd2dbfa
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push esi
lea eax, [ebp - 4]
push eax
push 0x20019
xor esi, esi
push esi
push str.CLSIDADB880A6_D8FF_11CF_9377_00AA003B7A11InprocServer32
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0xd2dc50
lea eax, [ebp - 8]
push eax
push dword [ebp + 8]
mov dword [ebp - 8], 0x104
push esi
push esi
push 0xd3f87c
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0xd2dc43
inc esi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
jmp 0xd2dc52
xor eax, eax
pop esi
leave
ret 4
Function at 0x100015d0
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1009b7cd
mov eax, dword fs:[0]
push eax
push ebx
sub esp, 0x30
mov eax, dword [0x100b7080]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
movaps xmm0, xmmword [0x100af6f0]
xor ecx, ecx
movups xmmword [ebp - 0x40], xmm0
mov dword [ebp - 0x30], 0x42587452
mov dword [ebp - 0x2c], 0x45524359
mov byte [ebp - 0x28], 0
mov al, byte [ebp - 0x40]
xor byte [ebp + ecx - 0x3f], al
inc ecx
cmp ecx, 0x17
jb 0x10001628
mov byte [ebp - 0x28], 0
mov dl, 0x18
mov dword [ebp - 0x20], 0x6a7d7318
xor ecx, ecx
mov dword [ebp - 0x1c], 0x2b747d76
mov dword [ebp - 0x18], 0x747c362a
mov word [ebp - 0x14], 0x74
lea eax, [ebp - 0x1f]
xor byte [eax + ecx], dl
inc ecx
cmp ecx, 0xc
jae 0x10001669
mov dl, byte [ebp - 0x20]
jmp 0x10001658
lea eax, [ebp - 0x1f]
mov byte [ebp - 0x13], 0
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
lea ecx, [ebp - 0x3f]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ecx, eax
call fcn.10018490
cmp al, 0xe9
jne 0x10001725
movaps xmm0, xmmword [0x100afa10]
xor ecx, ecx
movups xmmword [ebp - 0x24], xmm0
mov word [ebp - 0x14], 0x6e
mov al, byte [ebp - 0x24]
xor byte [ebp + ecx - 0x23], al
inc ecx
cmp ecx, 0x10
jb 0x100016a4
xorps xmm0, xmm0
mov byte [ebp - 0x13], 0
lea ecx, [ebp - 0x23]
mov dword [ebp - 0x30], 0
movups xmmword [ebp - 0x40], xmm0
mov dword [ebp - 0x2c], 0
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x100016d0
sub ecx, edx
lea eax, [ebp - 0x23]
push ecx
push eax
lea ecx, [ebp - 0x40]
call fcn.10002570
lea ecx, [ebp - 0x40]
mov dword [ebp - 4], 0
call fcn.1001d330
mov ecx, dword [ebp - 0x2c]
cmp ecx, 0xf
jbe 0x10001725
mov edx, dword [ebp - 0x40]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x1000171b
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x10001737
push ecx
push edx
call fcn.100812a6
add esp, 8
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret
call fcn.1008643f
int3
Function at 0x10001740
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1009b7fd
mov eax, dword fs:[0]
push eax
push ebx
sub esp, 0x30
mov eax, dword [0x100b7080]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dl, 0x40
mov dword [ebp - 0x20], 0x2d293440
mov dword [ebp - 0x1c], 0x34250725
xor ecx, ecx
mov dword [ebp - 0x18], 0x252d2914
mov byte [ebp - 0x14], 0
lea eax, [ebp - 0x1f]
xor byte [eax + ecx], dl
inc ecx
cmp ecx, 0xb
jae 0x100017a7
mov dl, byte [ebp - 0x20]
jmp 0x10001796
mov byte [ebp - 0x14], 0
mov dl, 0x19
mov dword [ebp - 0x38], 0x6b7c7219
xor ecx, ecx
mov dword [ebp - 0x34], 0x2a757c77
mov dword [ebp - 0x30], 0x757d372b
mov word [ebp - 0x2c], 0x75
nop word [eax + eax]
lea eax, [ebp - 0x37]
xor byte [eax + ecx], dl
inc ecx
cmp ecx, 0xc
jae 0x100017e1
mov dl, byte [ebp - 0x38]
jmp 0x100017d0
lea eax, [ebp - 0x37]
mov byte [ebp - 0x2b], 0
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
lea ecx, [ebp - 0x1f]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ecx, eax
call fcn.10018490
cmp al, 0xe9
jne 0x100018a5
movaps xmm0, xmmword [0x100afad0]
xor ecx, ecx
movups xmmword [ebp - 0x3c], xmm0
mov word [ebp - 0x2c], 0x78
nop dword [eax]
mov al, byte [ebp - 0x3c]
xor byte [ebp + ecx - 0x3b], al
inc ecx
cmp ecx, 0x10
jb 0x10001820
xorps xmm0, xmm0
mov byte [ebp - 0x2b], 0
lea ecx, [ebp - 0x3b]
mov dword [ebp - 0x18], 0
movups xmmword [ebp - 0x28], xmm0
mov dword [ebp - 0x14], 0
lea edx, [ecx + 1]
nop dword [eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x10001850
sub ecx, edx
lea eax, [ebp - 0x3b]
push ecx
push eax
lea ecx, [ebp - 0x28]
call fcn.10002570
lea ecx, [ebp - 0x28]
mov dword [ebp - 4], 0
call fcn.1001d330
mov ecx, dword [ebp - 0x14]
cmp ecx, 0xf
jbe 0x100018a5
mov edx, dword [ebp - 0x28]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x1000189b
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x100018b7
push ecx
push edx
call fcn.100812a6
add esp, 8
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret
call fcn.1008643f
int3

Function at 0x10001d50
Capabilities:
Check for peb beingdebugged flag

Disassembly:
mov eax, dword fs:[0x30]
movzx eax, byte [eax + 2]
ret
Function at 0x10001d60
Capabilities:
Allocate or change rwx memory
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
push 0xfffffffffffffffe
push 0x100b1708
push 0x10082820
mov eax, dword fs:[0]
push eax
add esp, 0xffffffc0
mov eax, dword [0x100b7080]
xor dword [ebp - 8], eax
xor eax, ebp
mov dword [ebp - 0x1c], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0x10]
mov dword fs:[0], eax
mov dword [ebp - 0x18], esp
mov dword [ebp - 0x50], 0
xor eax, eax
mov dword [ebp - 0x48], eax
mov dword [ebp - 0x44], eax
mov dword [ebp - 0x40], eax
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x24], 0
lea ecx, [ebp - 0x48]
push ecx
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
push 0x40
push 0x3000
mov edx, dword [ebp - 0x44]
push edx
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 0
jne 0x10001df5
xor al, al
jmp 0x10001e7e
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x50], eax
mov ecx, dword [ebp - 0x50]
mov byte [ecx], 0xc3
lea edx, [ebp - 0x20]
push edx
push 0x140
mov eax, dword [ebp - 0x44]
push eax
mov ecx, dword [ebp - 0x24]
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x10001e20
xor al, al
jmp 0x10001e7e
mov dword [ebp - 4], 0
mov eax, dword [ebp - 0x24]
push 0x10001e6b
jmp eax
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x1c]
xor ecx, ebp
call fcn.10081245
mov esp, ebp
pop ebp
ret
Function at 0x10002b30
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1009b960
mov eax, dword fs:[0]
push eax
sub esp, 0xcc
mov eax, dword [0x100b7080]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0xb0], edi
mov dword [ebp - 0xb0], edi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push 0x98
mov ebx, eax
lea eax, [ebp - 0xa8]
push 0
push eax
call fcn.100833b0
add esp, 8
lea ecx, [ebp - 0xa8]
call fcn.10007c30
mov dword [ebp - 4], 0
xor eax, eax
movaps xmm0, xmmword [0x100af5f0]
movups xmmword [ebp - 0xc4], xmm0
mov dword [ebp - 0xb4], 0x7b0054
nop word [eax + eax]
mov cl, byte [ebp - 0xc4]
xor byte [ebp + eax - 0xc3], cl
inc eax
cmp eax, 0x12
jb 0x10002bc0
lea edx, [ebp - 0xc3]
mov byte [ebp - 0xb1], 0
lea ecx, [ebp - 0xa8]
call fcn.10005d60
mov esi, eax
push 0
push 8
mov eax, dword [esi]
mov eax, dword [eax + 4]
or dword [eax + esi + 0x14], 4
mov eax, dword [esi]
mov ecx, dword [eax + 4]
mov eax, dword [ecx + esi + 0x14]
and eax, 0xfffff9ff
or eax, 0x800
mov dword [ecx + esi + 0x14], eax
lea eax, [ebp - 0xd8]
push eax
call fcn.1007dcf9
add esp, 0xc
mov ecx, dword [eax]
push dword [eax + 0xc]
push dword [eax + 8]
mov eax, dword [esi]
mov eax, dword [eax + 4]
add eax, esi
push eax
call ecx
mov eax, dword [esi]
add esp, 0xc
mov ecx, esi
mov eax, dword [eax + 4]
push ebx
mov byte [eax + esi + 0x40], 0x30
call fcn.10003590
mov ecx, eax
mov byte [ebp - 0xaa], 0
mov dl, 0x6f
mov byte [ebp - 0xaa], 0
mov al, 0x32
mov byte [ebp - 0xac], dl
xor al, dl
lea edx, [ebp - 0xab]
mov byte [ebp - 0xab], al
call fcn.10005d60
push edi
lea ecx, [ebp - 0xa8]
call fcn.10005960
mov eax, dword [ebp - 0xa8]
mov eax, dword [eax + 4]
mov dword [ebp + eax - 0xa8], vtable.std::basic_ostringstream_char__struct_std::char_traits_char___class_std::allocator_char__.0
mov eax, dword [ebp - 0xa8]
mov ecx, dword [eax + 4]
lea eax, [ecx - 0x50]
mov dword [ebp + ecx - 0xac], eax
lea ecx, [ebp - 0xa4]
call fcn.10007b60
mov eax, dword [ebp - 0xa8]
mov eax, dword [eax + 4]
mov dword [ebp + eax - 0xa8], vtable.std::basic_ostream_char__struct_std::char_traits_char__.0
mov eax, dword [ebp - 0xa8]
mov edx, dword [eax + 4]
lea ecx, [edx - 8]
mov dword [ebp + edx - 0xac], ecx
lea eax, [ebp - 0x58]
mov dword [ebp - 4], 1
push eax
mov dword [ebp - 0x58], vtable.std::ios_base.0
call fcn.1007d8ed
add esp, 4
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.10081245
mov esp, ebp
pop ebp
ret
Function at 0x1000dfb0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x28
mov eax, dword [0x100b7080]
xor eax, esp
mov dword [esp + 0x24], eax
mov eax, dword [ebp + 0xc]
push esi
mov esi, dword [ebp + 0x10]
push edi
mov edi, dword [ebp + 8]
cmp eax, 9
ja case.0x1000dfd8.0
jmp dword [eax*4 + 0x1000e190]
push 0
lea eax, [esp + 0x10]
push eax
push 1
push esi
push edi
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov al, 1
pop edi
pop esi
mov ecx, dword [esp + 0x24]
xor ecx, esp
call fcn.10081245
mov esp, ebp
pop ebp
ret 0xc
push 0
lea eax, [esp + 0x10]
push eax
push 2
push esi
push edi
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov al, 1
pop edi
pop esi
mov ecx, dword [esp + 0x24]
xor ecx, esp
call fcn.10081245
mov esp, ebp
pop ebp
ret 0xc
push 0
lea eax, [esp + 0x10]
mov dword [esp + 0x14], 0
push eax
push 4
lea eax, [esp + 0x1c]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_ReadFile]
push 0
push 0x100a8f68
mov ecx, esi
call fcn.10005860
mov eax, dword [esp + 0x10]
test eax, eax
jle 0x1000e0ce
push ecx
push eax
mov ecx, esi
call fcn.1000ecf0
cmp dword [esi + 0x14], 0xf
jbe 0x1000e06f
mov esi, dword [esi]
push 0
lea eax, [esp + 0x10]
push eax
push dword [esp + 0x18]
push esi
push edi
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov al, 1
pop edi
pop esi
mov ecx, dword [esp + 0x24]
xor ecx, esp
call fcn.10081245
mov esp, ebp
pop ebp
ret 0xc
push 0
lea eax, [esp + 0x10]
push eax
push 4
push esi
push edi
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov al, 1
pop edi
pop esi
mov ecx, dword [esp + 0x24]
xor ecx, esp
call fcn.10081245
mov esp, ebp
pop ebp
ret 0xc
push 0
lea eax, [esp + 0x10]
push eax
push 8
push esi
push edi
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov al, 1
pop edi
pop esi
mov ecx, dword [esp + 0x24]
xor ecx, esp
call fcn.10081245
mov esp, ebp
pop ebp
ret 0xc
push 0x91
push str.C:UsersMONSTERDesktopDreamSoft_v1924DreamSoftN3BaseN3TableBase.hpp
push 0x100a8f68
sub esp, 0x18
xorps xmm0, xmm0
mov ecx, esp
push 0x13
movups xmmword [ecx], xmm0
push str.ERROR____s_n_s:__d_n_n
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 0
call fcn.10002570
lea eax, [esp + 0x38]
push eax
call fcn.1000a3e0
add esp, 0x28
lea eax, [esp + 0x14]
cmp dword [esp + 0x28], 0xf
cmova eax, dword [esp + 0x14]
push 0
push str._ASSERTT_n
push eax
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
mov ecx, dword [esp + 0x28]
cmp ecx, 0xf
jbe 0x1000e174
mov edx, dword [esp + 0x14]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x1000e16a
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x1000e189
push ecx
push edx
call fcn.100812a6
add esp, 8
les ecx, [eax]
mov ecx, dword [esp + 0x2c]
xor al, al
pop edi
pop esi
xor ecx, esp
call fcn.10081245
mov esp, ebp
pop ebp
ret 0xc
call fcn.1008643f
nop
jecxz 0x1000e172
add byte [eax], dl
invalid
Function at 0x1000e005
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x28
mov eax, dword [0x100b7080]
xor eax, esp
mov dword [esp + 0x24], eax
mov eax, dword [ebp + 0xc]
push esi
mov esi, dword [ebp + 0x10]
push edi
mov edi, dword [ebp + 8]
cmp eax, 9
ja case.0x1000dfd8.0
jmp dword [eax*4 + 0x1000e190]
push 0
lea eax, [esp + 0x10]
push eax
push 1
push esi
push edi
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov al, 1
pop edi
pop esi
mov ecx, dword [esp + 0x24]
xor ecx, esp
call fcn.10081245
mov esp, ebp
pop ebp
ret 0xc
push 0
lea eax, [esp + 0x10]
push eax
push 2
push esi
push edi
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov al, 1
pop edi
pop esi
mov ecx, dword [esp + 0x24]
xor ecx, esp
call fcn.10081245
mov esp, ebp
pop ebp
ret 0xc
push 0
lea eax, [esp + 0x10]
mov dword [esp + 0x14], 0
push eax
push 4
lea eax, [esp + 0x1c]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_ReadFile]
push 0
push 0x100a8f68
mov ecx, esi
call fcn.10005860
mov eax, dword [esp + 0x10]
test eax, eax
jle 0x1000e0ce
push ecx
push eax
mov ecx, esi
call fcn.1000ecf0
cmp dword [esi + 0x14], 0xf
jbe 0x1000e06f
mov esi, dword [esi]
push 0
lea eax, [esp + 0x10]
push eax
push dword [esp + 0x18]
push esi
push edi
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov al, 1
pop edi
pop esi
mov ecx, dword [esp + 0x24]
xor ecx, esp
call fcn.10081245
mov esp, ebp
pop ebp
ret 0xc
push 0
lea eax, [esp + 0x10]
push eax
push 4
push esi
push edi
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov al, 1
pop edi
pop esi
mov ecx, dword [esp + 0x24]
xor ecx, esp
call fcn.10081245
mov esp, ebp
pop ebp
ret 0xc
push 0
lea eax, [esp + 0x10]
push eax
push 8
push esi
push edi
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov al, 1
pop edi
pop esi
mov ecx, dword [esp + 0x24]
xor ecx, esp
call fcn.10081245
mov esp, ebp
pop ebp
ret 0xc
push 0x91
push str.C:UsersMONSTERDesktopDreamSoft_v1924DreamSoftN3BaseN3TableBase.hpp
push 0x100a8f68
sub esp, 0x18
xorps xmm0, xmm0
mov ecx, esp
push 0x13
movups xmmword [ecx], xmm0
push str.ERROR____s_n_s:__d_n_n
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 0
call fcn.10002570
lea eax, [esp + 0x38]
push eax
call fcn.1000a3e0
add esp, 0x28
lea eax, [esp + 0x14]
cmp dword [esp + 0x28], 0xf
cmova eax, dword [esp + 0x14]
push 0
push str._ASSERTT_n
push eax
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
mov ecx, dword [esp + 0x28]
cmp ecx, 0xf
jbe 0x1000e174
mov edx, dword [esp + 0x14]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x1000e16a
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x1000e189
push ecx
push edx
call fcn.100812a6
add esp, 8
les ecx, [eax]
mov ecx, dword [esp + 0x2c]
xor al, al
pop edi
pop esi
xor ecx, esp
call fcn.10081245
mov esp, ebp
pop ebp
ret 0xc
call fcn.1008643f
nop
jecxz 0x1000e172
add byte [eax], dl
invalid