joyce8/EMBER2024-capa huggingface dataset:
Function at 0x42502d
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, ecx
xor ebx, ebx
push edi
cmp dword [esi + 0x4f8], ebx
je 0x4250a2
cmp dword [ebp + 8], 0x100
jne 0x425090
cmp word [ebp + 0xc], 0xd
jne 0x425090
mov edi, dword [sym.imp.USER32.dll_GetKeyState]
push 0x11
call edi
test ax, ax
jle 0x425066
cmp byte [esi + 0x4fe], bl
je 0x425077
push 0x11
call edi
test ax, ax
jge 0x425090
cmp byte [esi + 0x4ff], bl
jne 0x425090
mov ecx, dword [esi + 0x40]
cmp ecx, ebx
je 0x42508c
push ebx
push ebx
push ebx
push str.return
push esi
call fcn.0041028f
xor eax, eax
jmp 0x4250a5
mov eax, dword [esi + 0x4f8]
mov ecx, dword [eax + 0xc]
mov eax, dword [ecx]
pop edi
pop esi
pop ebx
pop ebp
jmp dword [eax + 0xc]
xor eax, eax
inc eax
pop edi
pop esi
pop ebx
pop ebp
ret 0x10

Function at 0x42c7b7
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, eax
mov eax, dword [esi + 8]
push edi
mov edi, eax
and edi, 7
je 0x42c7dc
cmp eax, edi
jge 0x42c7d4
mov eax, esi
call fcn.0042c16b
mov ecx, edi
shr dword [esi + 0xc], cl
sub dword [esi + 8], edi
xor ecx, ecx
cmp dword [esi + 8], ecx
jle 0x42c7fe
mov al, byte [esi + 0xc]
shr dword [esi + 0xc], 8
add dword [esi + 8], 0xfffffff8
mov byte [ebp + ecx - 4], al
inc ecx
cmp dword [esi + 8], 0
jg 0x42c7e3
cmp ecx, 4
jge 0x42c81d
mov edi, dword [esi + 4]
mov eax, dword [esi]
cmp eax, edi
jb 0x42c80b
xor eax, eax
jmp 0x42c813
mov dl, byte [eax]
inc eax
mov dword [esi], eax
movzx eax, dl
mov byte [ebp + ecx - 4], al
inc ecx
cmp ecx, 4
jl 0x42c801
movzx edi, byte [ebp - 3]
movzx eax, byte [ebp - 4]
movzx ecx, byte [ebp - 2]
shl edi, 8
add edi, eax
movzx eax, byte [ebp - 1]
shl eax, 8
add eax, ecx
mov ecx, edi
xor ecx, 0xffff
cmp eax, ecx
je 0x42c84f
mov eax, str.zlib_corrupt
call fcn.00429d88
jmp 0x42c88a
mov eax, dword [esi]
add eax, edi
cmp eax, dword [esi + 4]
jbe 0x42c85f
mov eax, str.read_past_buffer
jmp 0x42c848
mov eax, dword [esi + 0x10]
add eax, edi
cmp eax, dword [esi + 0x18]
jbe 0x42c874
mov ecx, edi
call fcn.0042c196
test eax, eax
je 0x42c88a
push edi
push dword [esi]
push dword [esi + 0x10]
call fcn.00449e20
add dword [esi], edi
add dword [esi + 0x10], edi
xor eax, eax
add esp, 0xc
inc eax
pop edi
pop esi
leave
ret
Function at 0x440b7c
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
mov eax, dword [0x476110]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, ecx
xor ebx, ebx
push edi
cmp byte [esi + 0x28], bl
je 0x440bed
cmp dword [esi + 0x20], ebx
je 0x440bed
push dword [esi + 4]
call dword [sym.imp.USER32.dll_GetWindowTextLengthW]
mov edi, eax
inc edi
lea eax, [edi + edi]
call fcn.0044a730
mov dword [ebp - 8], esp
cmp esp, ebx
je 0x440bed
push edi
push dword [ebp - 8]
push dword [esi + 4]
call dword [sym.imp.USER32.dll_GetWindowTextW]
mov ecx, dword [esi + 0x20]
push dword [ebp - 8]
add ecx, 0x1b8
call fcn.00412a42
mov ecx, dword [esi + 0x20]
mov eax, dword [ecx]
push ebx
push ebx
push ebx
push str.textchanged
push ecx
call dword [eax + 0x1c]
mov ecx, eax
call fcn.0041028f
xor eax, eax
lea esp, [ebp - 0x14]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004468a0
leave
ret 0x10
Function at 0x100012c0
Capabilities:
Create thread

Disassembly:
mov eax, dword [ecx + 0x68]
test eax, eax
je 0x100012e5
push 0
add ecx, 0x60
push 0
push ecx
push 0x100012f0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
ret
Function at 0x10003840
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x10081fde
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
push esi
mov esi, ecx
push edi
mov dword [esp + 0xc], esi
call sub.MFC42.DLL_CString::CString_4
xor edi, edi
lea ecx, [esi + 4]
mov dword [esp + 0x18], edi
call sub.MFC42.DLL_CString::CString_4
push edi
push edi
push edi
push edi
push 1
push edi
lea ecx, [esi + 0xc]
mov byte [esp + 0x30], 1
call fcn.1002c268
mov al, byte [esp + 0xb]
mov dword [esi + 0x34], edi
mov byte [esi + 0x30], al
mov dword [esi + 0x38], edi
mov dword [esi + 0x3c], edi
mov cl, byte [esp + 0xb]
mov dword [esi + 0x44], edi
mov byte [esi + 0x40], cl
mov dword [esi + 0x48], edi
mov dword [esi + 0x4c], edi
mov dl, byte [esp + 0xb]
mov dword [esi + 0x54], edi
mov byte [esi + 0x50], dl
mov dword [esi + 0x58], edi
mov dword [esi + 0x5c], edi
mov al, byte [esp + 0xb]
mov dword [esi + 0x64], edi
mov byte [esi + 0x60], al
mov dword [esi + 0x68], edi
mov dword [esi + 0x6c], edi
mov ecx, esi
mov byte [esp + 0x18], 6
call fcn.10003a00
mov ecx, dword [esp + 0x10]
mov eax, esi
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x14
ret
Function at 0x10004cb0
Capabilities:
Read file on windows

Disassembly:
mov eax, dword [esp + 8]
push ebx
push esi
push 0x10099b90
mov ebx, ecx
push eax
call dword [sym.imp.MSVCRT.dll_fopen]
mov esi, eax
add esp, 8
test esi, esi
jne 0x10004ce2
push 0x10099b6c
call dword [sym.imp.MSVCRT.dll_printf]
add esp, 4
xor al, al
pop esi
pop ebx
ret 8
push ebp
mov ebp, dword [sym.imp.MSVCRT.dll_fseek]
push edi
push 2
push 0
push esi
call ebp
push esi
call dword [sym.imp.MSVCRT.dll_ftell]
push esi
mov dword [ebx + 0x20], eax
call dword [sym.imp.MSVCRT.dll_rewind]
mov ecx, dword [ebx + 0x20]
inc ecx
push ecx
call sub.MFC42.DLL_operatornew
mov edx, dword [esp + 0x2c]
mov edi, eax
xor eax, eax
push 0
mov dword [edx], edi
mov ecx, dword [ebx + 0x20]
inc ecx
push 0
mov edx, ecx
push esi
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
call ebp
mov ecx, dword [esp + 0x38]
mov eax, dword [ebx + 0x20]
push esi
push eax
mov edx, dword [ecx]
push 1
push edx
call dword [sym.imp.MSVCRT.dll_fread]
push esi
call dword [sym.imp.MSVCRT.dll_fclose]
add esp, 0x38
mov al, 1
pop edi
pop ebp
pop esi
pop ebx
ret 8
Function at 0x10005d00
Capabilities:
Initialize winsock library

Disassembly:
sub esp, 0x190
lea eax, [esp]
push esi
mov esi, ecx
push eax
push 0x202
mov dword [esi], 0x1008a958
call dword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
jne 0x10005cb2
cmp word [esp + 4], 0x202
je 0x10005cb2
call dword [sym.imp.WS2_32.dll_WSACleanup]
mov eax, esi
pop esi
add esp, 0x190
ret
mov ecx, 0x1009fdc8
jmp 0x10005c80

Function at 0x10005d70
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov eax, dword [esp + 4]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x10005d85
xor eax, eax
ret 4
and al, 0x10
xor ecx, ecx
cmp al, 0x10
setne cl
mov eax, ecx
ret 4

Function at 0x10006460
Capabilities:
Act as tcp client
Connect socket
Connect tcp socket
Create tcp socket
Resolve dns

Disassembly:
sub esp, 0x10
push ebx
push 6
push 1
push 2
call dword [sym.imp.WS2_32.dll_socket]
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x10006480
or eax, eax
pop ebx
add esp, 0x10
ret 8
mov eax, dword [esp + 0x18]
mov word [esp + 4], 2
push eax
call dword [sym.imp.WS2_32.dll_gethostbyname]
test eax, eax
jne 0x100064a7
push ebx
call dword [sym.imp.WS2_32.dll_closesocket]
or eax, 0xffffffff
pop ebx
add esp, 0x10
ret 8
movsx ecx, word [eax + 0xa]
mov edx, dword [eax + 0xc]
push esi
mov eax, ecx
push edi
mov esi, dword [edx]
lea edi, [esp + 0x10]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [esp + 0x24]
push ecx
call dword [sym.imp.WS2_32.dll_htons]
lea edx, [esp + 0xc]
push 0x10
push edx
push ebx
mov word [esp + 0x1a], ax
call dword [sym.imp.WS2_32.dll_connect]
pop edi
cmp eax, 0xffffffff
pop esi
jne 0x100064fa
push ebx
call dword [sym.imp.WS2_32.dll_closesocket]
or eax, 0xffffffff
pop ebx
add esp, 0x10
ret 8
mov eax, ebx
pop ebx
add esp, 0x10
ret 8

Function at 0x10006fe0
Capabilities:
Send data
Send data on socket

Disassembly:
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 8]
mov edx, dword [esp + 4]
push 0
push eax
push ecx
push edx
call dword [sym.imp.WS2_32.dll_send]
xor ecx, ecx
cmp eax, 0xffffffff
setne cl
mov eax, ecx
ret
Function at 0x10013c90
Capabilities:
Query or enumerate registry key

Disassembly:
sub esp, 0x12c
mov al, byte [0x1009fd90]
mov edx, ecx
push edi
mov byte [esp + 0x2c], al
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0x2d]
mov dword [esp + 8], 0x104
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea ecx, [esp + 0x24]
lea eax, [esp + 0x20]
push ecx
push eax
lea ecx, [esp + 0x18]
lea eax, [esp + 0x24]
push ecx
push eax
lea ecx, [esp + 0x1c]
lea eax, [esp + 0x24]
push ecx
push eax
lea ecx, [esp + 0x30]
lea eax, [esp + 0x1c]
push ecx
push eax
lea ecx, [esp + 0x28]
push 0
push ecx
mov ecx, dword [edx + 4]
lea eax, [esp + 0x54]
mov dword [esp + 0x2c], 0
push eax
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyA]
test eax, eax
pop edi
je 0x10013d10
xor eax, eax
add esp, 0x12c
ret 0xc
mov edx, dword [esp + 0x138]
mov eax, dword [esp]
mov ecx, dword [esp + 0x134]
mov dword [edx], eax
mov edx, dword [esp + 8]
mov dword [ecx], edx
mov eax, 1
add esp, 0x12c
ret 0xc
Function at 0x10018b20
Capabilities:
Check for peb beingdebugged flag

Disassembly:
push 0xffffffffffffffff
push 0x100839d7
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebx
push ebp
push esi
push edi
mov dword [esp + 0x10], 0
mov eax, dword [esp + 0x28]
mov ebx, dword [esp + 0x2c]
push 0
push 0
push 0xffffffffffffffff
push eax
push 0
push ebx
mov dword [esp + 0x34], 1
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov ebp, eax
lea edi, [ebp + ebp + 2]
push edi
call sub.MFC42.DLL_operatornew
mov ecx, edi
mov esi, eax
mov edx, ecx
xor eax, eax
mov edi, esi
add esp, 4
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, edx
push ebp
and ecx, 3
push esi
rep stosb byte es:[edi], al
mov eax, dword [esp + 0x30]
push 0xffffffffffffffff
push eax
push 0
push ebx
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov ecx, dword [esp + 0x30]
push 0
push 0
push 0
push 0
push 0xffffffffffffffff
push esi
push 0
push ecx
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov ebx, eax
lea edi, [ebx + 1]
push edi
call sub.MFC42.DLL_operatornew
mov ecx, edi
mov ebp, eax
mov edx, ecx
xor eax, eax
mov edi, ebp
add esp, 4
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, edx
push 0
push 0
and ecx, 3
push ebx
push ebp
rep stosb byte es:[edi], al
mov eax, dword [esp + 0x40]
push 0xffffffffffffffff
push esi
push 0
push eax
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
lea ecx, [esp + 0x2c]
call sub.MFC42.DLL_CString::CString_4
push ebp
mov byte [esp + 0x20], 2
push 0x1009b940
lea ecx, [esp + 0x34]
push ecx
call sub.MFC42.DLL_CString::Format
push esi
call sub.MFC42.DLL_operatordelete
push ebp
call sub.MFC42.DLL_operatordelete
mov esi, dword [esp + 0x38]
add esp, 0x14
lea edx, [esp + 0x2c]
mov ecx, esi
push edx
call sub.MFC42.DLL_CString::CString_2
mov dword [esp + 0x10], 1
lea ecx, [esp + 0x2c]
mov byte [esp + 0x1c], 1
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0x28]
mov byte [esp + 0x1c], 0
call sub.MFC42.DLL_CString::CString
mov ecx, dword [esp + 0x14]
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x10
ret
Function at 0x1001f3f0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x1008416b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
push ebp
push esi
mov esi, ecx
push edi
mov dword [esp + 0xc], esi
mov dword [esi], 0x1008b140
mov eax, dword [esi + 0x30]
xor ebp, ebp
cmp eax, ebp
mov dword [esp + 0x1c], 1
je 0x1001f480
mov edx, dword [esi + 0x24]
mov eax, dword [esi + 0x2c]
mov edi, dword [esi + 0x20]
mov ecx, edx
push ebx
sub eax, ecx
mov ecx, dword [esi + 0x28]
mov ebx, edi
sub ecx, ebx
mov ebx, dword [esi + 0x1c]
cmp esi, ebp
je 0x1001f447
mov ebp, dword [esi + 4]
push 0xcc0020
push edx
push edi
push ebp
push eax
mov eax, dword [ebx + 4]
push ecx
push edx
push edi
push eax
call dword [sym.imp.GDI32.dll_BitBlt]
mov eax, dword [esi + 0x18]
pop ebx
test eax, eax
jne 0x1001f471
mov ecx, dword [esi + 4]
push eax
push ecx
call sub.MFC42.DLL_CDC::SelectGdiObject
jmp 0x1001f486
mov eax, dword [eax + 4]
mov ecx, dword [esi + 4]
push eax
push ecx
call sub.MFC42.DLL_CDC::SelectGdiObject
jmp 0x1001f486
mov dword [esi + 8], ebp
mov dword [esi + 4], ebp
lea edi, [esi + 0x10]
mov dword [esp + 0x10], edi
mov dword [edi], 0x1008adc8
mov ecx, edi
mov byte [esp + 0x1c], 2
call sub.MFC42.DLL_CGdiObject::DeleteObject
mov ecx, esi
mov dword [edi], 0x1008adb4
mov dword [esp + 0x1c], 0xffffffff
call fcn.1002c4fc
mov ecx, dword [esp + 0x14]
pop edi
pop esi
pop ebp
mov dword fs:[0], ecx
add esp, 0x14
ret

Function at 0x10021750
Capabilities:
Print debug messages

Disassembly:
mov eax, dword [esp + 4]
push esi
mov esi, ecx
push eax
call sub.MFC42.DLL_CWnd::FromHandle
test eax, eax
mov dword [esp + 8], eax
je 0x100217df
push ebx
lea ecx, [esi + 0x64]
push ebp
push edi
mov eax, ecx
xor edx, edx
xor edi, edi
mov ebx, 0x64
mov dword [eax], edx
mov edx, dword [esp + 0x14]
push edi
push edi
push edi
mov dword [eax + 4], edi
push 0x65
push edx
push ecx
mov dword [eax + 8], ebx
add esi, 4
push 0x50000000
mov ebp, ebx
push 0x1009c4b4
push 0x1008b350
mov ecx, esi
mov dword [eax + 0xc], ebp
call sub.MFC42.DLL_CWnd::CreateControl
pop edi
pop ebp
test eax, eax
pop ebx
je 0x100217d4
push 1
mov ecx, esi
call fcn.100204e0
push 0
push 0
push 0
push 0
push str.www.baidu.com
mov ecx, esi
call fcn.100203d0
mov eax, 1
pop esi
ret 4
push str.WebBrowser_Create_Failed_
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
xor eax, eax
pop esi
ret 4
Function at 0x10024ef0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x1008478f
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x20
mov eax, dword [esp + 0x34]
push esi
push eax
lea ecx, [esp + 0xc]
push 0x10099b60
push ecx
mov dword [esp + 0x10], 0
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0xc
lea edx, [esp + 8]
lea ecx, [esp + 0x38]
push edx
call sub.MFC42.DLL_CString::CString_3
mov esi, dword [esp + 0x34]
lea eax, [esp + 0x38]
push eax
mov ecx, esi
mov dword [esp + 0x30], 1
call sub.MFC42.DLL_CString::CString_2
mov dword [esp + 4], 1
lea ecx, [esp + 0x38]
mov byte [esp + 0x2c], 0
call sub.MFC42.DLL_CString::CString
mov ecx, dword [esp + 0x24]
mov eax, esi
pop esi
mov dword fs:[0], ecx
add esp, 0x2c
ret
Function at 0x10027170
Capabilities:
Read file on windows

Disassembly:
push 0xffffffffffffffff
push 0x100848d8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x70
push ebx
push esi
push edi
mov ecx, 0x18
xor eax, eax
lea edi, [esp + 0x19]
mov byte [esp + 0x18], 0
mov esi, dword [esp + 0x90]
rep stosd dword es:[edi], eax
mov ecx, dword [esi + 0xc]
stosw word es:[edi], ax
stosb byte es:[edi], al
mov eax, dword [esi]
mov edi, dword [esp + 0x8c]
push eax
push 1
push ecx
push edi
call dword [sym.imp.MSVCRT.dll_fread]
add esp, 0x10
cmp eax, 1
mov eax, dword [esi + 0xc]
cdq
sete bl
idiv dword [esi + 0x10]
test bl, bl
mov byte [esp + 0x90], bl
mov dword [esi + 0x14], eax
je 0x1002730c
push ebp
push eax
lea edx, [esp + 0x20]
push str.length__d
push edx
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0xc
lea eax, [esp + 0x1c]
lea ecx, [esi + 0x18]
push eax
mov dword [esp + 0x1c], ecx
call fcn.1002c27a
mov ecx, dword [esi + 0x10]
mov ebp, dword [esi + 0x14]
xor ebx, ebx
xor eax, eax
cmp ecx, 1
mov edx, ebp
sete byte [esp + 0x13]
dec ebp
test edx, edx
je 0x100272b8
inc ebp
mov dword [esp + 0x14], ebp
mov ebp, dword [sym.imp.MSVCRT.dll_memmove]
mov dl, byte [esp + 0x13]
test dl, dl
je 0x1002723c
xor edx, edx
cmp byte [edi], dl
jmp 0x10027241
xor edx, edx
cmp word [edi], dx
sete dl
test edx, edx
je 0x10027268
test eax, eax
je 0x10027261
cmp edi, eax
je 0x10027261
imul ecx, ebx
mov edx, edi
sub edx, eax
push edx
push eax
sub eax, ecx
push eax
call ebp
add esp, 0xc
mov ecx, dword [esi + 0x10]
inc ebx
lea eax, [ecx + edi]
mov edx, dword [esp + 0x14]
add edi, ecx
dec edx
mov dword [esp + 0x14], edx
jne 0x1002722e
test eax, eax
je 0x1002728f
cmp edi, eax
je 0x1002728f
mov ecx, dword [esi + 0x10]
sub edi, eax
imul ecx, ebx
push edi
push eax
sub eax, ecx
push eax
call ebp
add esp, 0xc
test ebx, ebx
je 0x100272b8
push ebx
lea edx, [esp + 0x20]
push str.__d_nulls_removed_
push edx
call dword [sym.imp.MSVCRT.dll_sprintf]
mov ecx, dword [esp + 0x24]
add esp, 0xc
lea eax, [esp + 0x1c]
push eax
call sub.MFC42.DLL_CString::operator
sub dword [esi + 0x14], ebx
mov eax, dword [esi + 0x10]
pop ebp
cmp eax, 1
jle 0x100272f3
mov ecx, dword [esi + 4]
push ecx
call fcn.10026d70
add esp, 4
test al, al
je 0x100272f3
mov edx, dword [esi + 0x14]
mov eax, dword [esp + 0x8c]
push edx
push eax
call fcn.10026d80
mov ecx, dword [esp + 0x1c]
add esp, 8
push str.endian_swap
call sub.MFC42.DLL_CString::operator
mov al, byte [esp + 0x90]
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x70]
mov dword fs:[0], ecx
add esp, 0x7c
ret
lea ecx, [esp + 0x8c]
push ecx
call fcn.10024020
add esp, 4
push eax
lea ecx, [esi + 0x18]
mov dword [esp + 0x88], 0
call fcn.1002c286
lea ecx, [esp + 0x8c]
mov dword [esp + 0x84], 0xffffffff
call sub.MFC42.DLL_CString::CString
mov ecx, dword [esp + 0x7c]
pop edi
mov al, bl
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x7c
ret
Function at 0x100278c0
Capabilities:
Write file on windows

Disassembly:
push 0xffffffffffffffff
push 0x10084968
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x64
push ebp
push esi
push edi
mov ecx, 0x18
xor eax, eax
lea edi, [esp + 0xd]
mov byte [esp + 0xc], 0
mov ebp, dword [esp + 0x84]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov edi, dword [ebp + 0x10]
mov esi, dword [esp + 0x88]
imul edi, dword [ebp + 0x14]
test esi, esi
mov dword [esp + 0x84], edi
jne 0x10027917
mov esi, dword [esp + 0x80]
mov eax, dword [ebp + 4]
push ebx
push eax
xor ebx, ebx
call fcn.10026d70
add esp, 4
test al, al
je 0x1002798b
mov eax, dword [esp + 0x84]
test eax, eax
jne 0x1002796a
mov ecx, dword [ebp + 0x14]
shl ecx, 1
push ecx
call sub.MFC42.DLL_operatornew
mov ecx, dword [ebp + 0x14]
mov ebx, eax
shl ecx, 1
mov edx, ecx
mov edi, ebx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
add esp, 4
and ecx, 3
mov dword [esp + 0x84], ebx
rep movsb byte es:[edi], byte [esi]
mov edi, dword [esp + 0x88]
mov esi, ebx
mov eax, dword [ebp + 0x14]
mov ecx, dword [esp + 0x84]
push eax
push ecx
call fcn.10026d80
add esp, 8
lea ecx, [ebp + 0x18]
push str.endian_swap
call sub.MFC42.DLL_CString::operator
mov edx, dword [ebp]
push edx
push 1
push edi
push esi
call dword [sym.imp.MSVCRT.dll_fwrite]
add esp, 0x10
cmp eax, 1
sete byte [esp + 0x84]
test ebx, ebx
je 0x100279b4
push ebx
call sub.MFC42.DLL_operatordelete
add esp, 4
mov al, byte [esp + 0x84]
pop ebx
test al, al
je 0x100279e6
mov eax, dword [ebp + 0x14]
lea ecx, [esp + 0xc]
push eax
push str.length__d
push ecx
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0xc
lea edx, [esp + 0xc]
lea ecx, [ebp + 0x18]
push edx
call sub.MFC42.DLL_CString::operator
jmp 0x10027a1b
lea eax, [esp + 0x84]
push eax
call fcn.10024020
add esp, 4
push eax
lea ecx, [ebp + 0x18]
mov dword [esp + 0x7c], 0
call fcn.1002c286
lea ecx, [esp + 0x84]
mov dword [esp + 0x78], 0xffffffff
call sub.MFC42.DLL_CString::CString
mov ecx, dword [esp + 0x70]
mov al, byte [esp + 0x80]
pop edi
pop esi
pop ebp
mov dword fs:[0], ecx
add esp, 0x70
ret

Function at 0x10029760
Capabilities:
Create thread

Disassembly:
push 0
push 0
push ecx
push 0x10029370
push 0
push 0
mov dword [ecx + 0x3c], 1
call dword [sym.imp.KERNEL32.dll_CreateThread]
test eax, eax
jne 0x10029782
xor al, al
ret
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, 1
ret
Function at 0x1002a380
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x10084ca9
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x14
push ebx
push esi
mov esi, dword [esp + 0x30]
push 1
xor ebx, ebx
mov ecx, esi
mov eax, dword [esi + 8]
mov dword [esp + 0xc], ebx
push eax
lea eax, [esp + 0x38]
push eax
mov byte [esp + 0x3c], 0x5c
call dword [sym.imp.MSVCP60.dll_public:_unsigned_int___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::rfind_char_const___unsigned_int__unsigned_int_const]
cmp eax, 0xffffffff
jne 0x1002a3fe
mov esi, dword [esp + 0x2c]
mov cl, byte [esp + 0x2c]
push edi
xor edi, edi
mov byte [esi], cl
or ecx, eax
xor eax, eax
mov dword [esi + 4], ebx
mov dword [esi + 8], ebx
mov dword [esi + 0xc], ebx
repne scasb al, byte es:[edi]
not ecx
dec ecx
push ecx
push ebx
mov ecx, esi
call dword [sym.imp.MSVCP60.dll_public:_class_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char______thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::assign_char_const___unsigned_int_]
mov eax, esi
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
add esp, 0x20
ret
mov ecx, dword [esi + 8]
inc eax
push ecx
lea edx, [esp + 0x10]
push eax
push edx
mov ecx, esi
call dword [sym.imp.MSVCP60.dll_public:_class_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char_____thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::substr_unsigned_int__unsigned_int_]
mov esi, dword [esp + 0x2c]
mov al, byte [esp + 0xc]
mov dword [esp + 0x24], ebx
mov byte [esi], al
mov dword [esi + 4], ebx
mov dword [esi + 8], ebx
mov dword [esi + 0xc], ebx
mov ecx, dword [sym.imp.MSVCP60.dll_unsigned_int_const_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::npos]
lea eax, [esp + 0xc]
mov edx, dword [ecx]
mov ecx, esi
push edx
push ebx
push eax
call dword [sym.imp.MSVCP60.dll_public:_class_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char______thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::assign_class_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char___const___unsigned_int__unsigned_int_]
mov ecx, dword [esp + 0x10]
cmp ecx, ebx
je 0x1002a474
mov al, byte [ecx - 1]
cmp al, bl
je 0x1002a46a
cmp al, 0xff
je 0x1002a46a
dec al
mov byte [ecx - 1], al
mov eax, esi
pop esi
pop ebx
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
add esp, 0x20
ret
dec ecx
push ecx
call sub.MFC42.DLL_operatordelete
add esp, 4
mov ecx, dword [esp + 0x1c]
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x20
ret