joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10001a90
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0xe0
mov eax, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
mov dword [esp], eax
call sym.___wine_dbg_get_channel_flags
movzx eax, al
bt eax, esi
jae 0x10001c68
mov edi, dword [0x10007084]
xor eax, eax
mov edx, dword fs:[0x18]
cmp dword [edx + 0x24], edi
je 0x10001b77
test byte [0x10003030], 8
jne 0x10001c10
lea ebx, [ebp - 0xd4]
mov edi, ebx
test byte [0x10003040], 8
jne 0x10001bd0
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x24]
mov dword [esp + 4], str._04x:
mov dword [esp], edi
mov dword [esp + 8], eax
call sym._sprintf
mov edx, dword [ebp + 0x10]
test edx, edx
je 0x10001b19
cmp esi, 3
jbe 0x10001b88
mov dword [esp], 2
call dword [sym.imp.ucrtbase.dll___acrt_iob_func]
mov ecx, ebx
mov edi, eax
mov esi, dword [ecx]
add ecx, 4
lea edx, [esi - 0x1010101]
not esi
and edx, esi
and edx, 0x80808080
je 0x10001b2a
mov esi, edx
mov dword [esp + 0xc], edi
shr esi, 0x10
test edx, 0x8080
mov dword [esp + 4], 1
cmove edx, esi
lea esi, [ecx + 2]
mov dword [esp], ebx
cmove ecx, esi
mov eax, edx
add al, dl
sbb ecx, 3
sub ecx, ebx
mov dword [esp + 8], ecx
call dword [sym.imp.ucrtbase.dll_fwrite]
add esp, 0xe0
pop ebx
pop esi
pop edi
pop ebp
ret
add eax, edi
mov edi, dword [ebp + 0x10]
mov dword [esp + 8], str._s:_s:_s
mov dword [esp], eax
mov dword [esp + 0x14], edi
mov edi, dword [ebp + 0xc]
lea edx, [edi + 1]
mov dword [esp + 0x10], edx
mov edx, dword [esi*4 + 0x10005128]
mov dword [esp + 0xc], edx
mov edx, ebx
sub edx, eax
add edx, 0xc8
mov dword [esp + 4], edx
call sym._snprintf.constprop.0
jmp 0x10001b19
mov dword [esp], 0x10003040
call sym.___wine_dbg_get_channel_flags
test al, 8
je 0x10001af0
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x20]
mov dword [esp], edi
mov dword [esp + 4], str._04x:
mov dword [esp + 8], eax
call sym._sprintf
add edi, eax
jmp 0x10001af0
mov dword [esp], 0x10003030
call sym.___wine_dbg_get_channel_flags
test al, 8
je 0x10001adb
call dword [sym.imp.kernel32.dll_GetTickCount]
mov edx, 0x10624dd3
lea ebx, [ebp - 0xd4]
mov dword [esp + 4], str._3u._03u:
mov ecx, eax
mul edx
mov dword [esp], ebx
shr edx, 6
imul eax, edx, 0x3e8
mov dword [esp + 8], edx
sub ecx, eax
mov dword [esp + 0xc], ecx
call sym._sprintf
lea edi, [ebx + eax]
jmp 0x10001ae3
mov eax, 0xffffffff
jmp 0x10001b77
Function at 0x10001d30
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
mov esi, eax
push ebx
mov ebx, edx
sub esp, 0x214
mov eax, dword [0x100070a0]
test eax, eax
je 0x10001de8
mov dword [esp], ebx
call eax
mov dword [ebx + 8], eax
sub esp, 4
test eax, eax
jns 0x10001d70
mov eax, dword [ebx]
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
lea edi, [ebp - 0x214]
mov dword [esp + 8], 0x104
mov dword [esp + 4], edi
mov dword [esp], esi
call dword [sym.imp.kernel32.dll_GetModuleFileNameW]
mov eax, dword [ebx]
sub esp, 0xc
mov edx, dword [eax]
mov dword [esp + 8], edi
mov dword [esp + 4], str.MODULE
mov dword [esp], eax
call dword [edx + 0xc]
sub esp, 0xc
mov dword [esp + 8], 0x104
mov dword [esp + 4], edi
mov dword [esp], str.SystemRoot
call dword [sym.imp.kernel32.dll_GetEnvironmentVariableW]
mov eax, dword [ebx]
sub esp, 0xc
mov edx, dword [eax]
mov dword [esp + 8], edi
mov dword [esp + 4], str.SystemRoot
mov dword [esp], eax
call dword [edx + 0xc]
sub esp, 0xc
jmp 0x10001d5c
mov dword [esp], str.atl100.dll
call dword [sym.imp.kernel32.dll_LoadLibraryW]
sub esp, 4
test eax, eax
je 0x10001e1d
mov dword [esp + 4], str.AtlCreateRegistrar
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_GetProcAddress]
mov dword [0x100070a0], eax
sub esp, 8
test eax, eax
jne 0x10001d4d
mov dword [ebx + 8], 0x80004002
xor eax, eax
jmp 0x10001d5e
Function at 0x10001e30
Capabilities:
Access peb ldr_data
Extract resource via kernel32 functions
Get process heap flags
Get process heap force flags

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x28
mov eax, dword [ebp + 0xc]
mov edi, dword [ebp + 8]
mov esi, dword [ebp + 0x14]
mov dword [esp + 8], eax
mov eax, dword [ebp + 0x10]
mov dword [esp], edi
mov dword [esp + 4], eax
call dword [sym.imp.kernel32.dll_FindResourceW]
sub esp, 0xc
mov dword [ebp - 0x10], eax
mov dword [esp + 4], eax
mov dword [esp], edi
call dword [sym.imp.kernel32.dll_LoadResource]
mov edx, dword [ebp - 0x10]
sub esp, 8
mov ebx, eax
mov dword [esp + 4], edx
mov dword [esp], edi
call dword [sym.imp.kernel32.dll_SizeofResource]
mov dword [ebp - 0x10], eax
sub esp, 8
test ebx, ebx
je 0x10001fc0
mov eax, dword [esi]
test eax, eax
je 0x10001fa8
mov edx, dword [sym.imp.kernel32.dll_MultiByteToWideChar]
mov eax, dword [ebp - 0x10]
mov dword [esp + 8], ebx
mov dword [esp + 0x14], 0
mov dword [ebp - 0x1c], edx
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], eax
mov dword [esp + 4], 0
mov dword [esp], 0xfde9
call edx
lea ecx, [eax + 1]
sub esp, 0x18
lea eax, [ecx + ecx]
mov dword [ebp - 0x18], ecx
mov ecx, eax
mov dword [esp + 4], 0
mov dword [esp + 8], ecx
mov dword [ebp - 0x14], eax
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapAlloc]
mov ecx, dword [ebp - 0x18]
mov edx, dword [ebp - 0x1c]
sub esp, 0xc
test eax, eax
mov edi, eax
je 0x10001fcc
mov dword [esp + 0x10], eax
mov eax, dword [ebp - 0x10]
mov dword [esp + 0x14], ecx
mov dword [esp + 0xc], eax
mov dword [esp + 8], ebx
mov dword [esp + 4], 0
mov dword [esp], 0xfde9
call edx
mov eax, dword [ebp - 0x14]
mov ecx, dword [esi + 4]
xor edx, edx
sub esp, 0x18
mov word [edi + eax - 2], dx
mov eax, dword [esi]
test ecx, ecx
mov edx, dword [eax]
mov dword [esp + 4], edi
mov dword [esp], eax
jne 0x10001f98
call dword [edx + 0x28]
mov dword [esi + 8], eax
sub esp, 8
mov dword [esp + 8], edi
mov dword [esp + 4], 0
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapFree]
mov eax, dword [esi + 8]
sub esp, 0xc
lea esp, [ebp - 0xc]
not eax
pop ebx
pop esi
shr eax, 0x1f
pop edi
pop ebp
ret 0x10
call dword [edx + 0x24]
mov dword [esi + 8], eax
sub esp, 8
jmp 0x10001f5c
mov edx, esi
mov eax, edi
call sym._create_registrar
test eax, eax
jne 0x10001e96
lea esi, [esi]
xor eax, eax
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret 0x10
mov dword [esi + 8], 0x8007000e
xor eax, eax
jmp 0x10001fc2
Function at 0x430002
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
mov eax, section..text
mov ebx, 0x408ecc
nop
mov ecx, 0x69721821
nop
nop
test eax, eax
nop
nop
nop
nop
nop
je 0x43004e
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x430024
nop
nop
mov eax, section..rsrc
mov ebx, 0x42e1d0
nop
mov ecx, 0x2f1f732e
nop
nop
test eax, eax
nop
nop
nop
nop
nop
nop
je 0x430084
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
add eax, 4
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x43006c
nop
nop
nop
popal
nop
nop
nop
nop
nop
jmp 0x401219
Function at 0x415c6a
Capabilities:
Encode data using xor

Disassembly:
arpl dx, bp
sub ecx, ebx
out 0x90, al
mov dword [ebp + 0x3c25f8bd], 0xc4b38e10
fcomp qword [eax]
sbb byte [ebp - 0x93282ae], dh
xchg edi, eax
inc eax
and eax, 0x425350fb
mov dl, byte [esp + edx*2 - 0x227dcf3e]
mov esi, 0x3b92a4a8
out 0x78, eax
js 0x415cd8
js 0x415cd8
cmp al, 0x35
lahf
adc dword [esp + ebx*4 + 0x701aa7b2], esp
cmp ebx, edx
xor dword [esi], edi
fsub qword [edi]
jp 0x415c3e
in eax, 0x23
mov bh, byte [ebx + ebp*2 - 0x210db75c]
insd dword es:[edi], dx
and esp, ebx
clc
pop ds
mov ebx, 0x1b5484c5
push ebx
adc eax, 0xbfe0954e
in eax, 0xde
mov ch, 0xab
add bl, al
mov dh, byte [eax - 0x52]
push edx
pop eax
jmp 0x57d6370c
in al, dx
invalid

Function at 0x418720
Capabilities:
Write file on windows

Disassembly:
mov eax, dword [esp + 4]
mov dword [esp + 4], eax
mov al, byte [0x4cb9f0]
test al, al
je 0x41878d
mov ecx, dword [0x4cba60]
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetStdHandle]
and ecx, 0xffff
cmp ecx, 0xffffd7b2
push edi
jne 0x41875a
mov eax, dword [0x4c9cac]
test eax, eax
je 0x41875a
push 0xfffffffffffffff5
call esi
push 0xfffffffffffffff5
call esi
mov edi, dword [sym.imp.KERNEL32.dll_WriteFile]
lea edx, [esp + 0xc]
push 0
push edx
push 0x1d
push 0x4ca9c0
push eax
call edi
push 0xfffffffffffffff5
call esi
lea ecx, [esp + 0xc]
push 0
push ecx
push 2
push 0x4cba70
push eax
call edi
pop edi
pop esi
ret
mov al, byte [0x4ca518]
test al, al
jne 0x4187a7
push 0
push 0
push 0x4ca9c0
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
ret

Function at 0x43bb3e
Capabilities:
Authenticate hmac
Encode data using xor

Disassembly:
cwde
popfd
cmp dword [ebx + 0x637fe5f0], esp
and dword [eax + 0x26], 0xffffffe1
cli
mov al, 0x27
test dword gs:[ebx + 0x5e6aae39], edx
mov ebp, 0x6ae06a7f
sar dword [ecx + 0x5ea1b739], 1
invalid

Function at 0x4547ca
Capabilities:
Encode data using xor

Disassembly:
or dword [eax - 0x1c], edi
fldenv [eax - 0x7ff6955b]
imul byte [ebp + 0x5f066663]
jae 0x4547d9
dec esp
xchg edx, eax
mov edi, eax
int3
xchg esp, eax
push ss
and byte [ebp - 0x5d221714], al
mov al, 0x9f
jnp 0x45477c
out dx, al
and eax, 0xc35cd50
scasd eax, dword es:[edi]
push eax
int 0x35
or al, 0xaf
std
adc eax, 0xb1f0e7e9
imul edx, dword [0x2105dd4a], 0xffffff95
out 0xf0, eax
mov cl, 0x6b
adc eax, 0x2105dd4a
xchg ebp, eax
jp 0x454820
pop esi
out 0x94, eax
push es
or al, 0x74
jg 0x45484d
cmp dword [ebx - 0x12], ecx
push ss
dec eax
invalid
in al, dx
or al, 0x8e
jnp 0x45478c
or byte [esi + ecx*8], dh
neg byte [edi - 0x47395523]
out dx, eax
add byte [edx - 0x52], dl
mov eax, dword [0x6c68f879]
push 0xb
inc ecx
mov dh, 0x74
mov eax, dword [0x3692dda9]
add byte [esi + ebx*2 + 0x516dfee2], dl
add byte ss:[esi + ebx*2 + 0x516dfee2], dl
cmp bl, dh
xor bh, ah
xchg byte [eax + esi*2 + 0x5f], dl
xor al, 0xb7
jae 0x454800
xor ebx, dword [esi]
in al, 0xb
sar byte [ecx - 0x7e2dcaf], cl
push edi
push cs
stosb byte es:[edi], al
loop 0x4547e1
mov eax, 0xf269bfd8
pushal
int3
daa
push esi
retf
Function at 0x45c93a
Capabilities:
Encode data using xor

Disassembly:
inc esi
add eax, dword [ecx]
wait
fadd qword [ecx - 0x35480b17]
mov cl, 0x25
mov bh, 0x2f
xlatb
or al, 0xf8
inc ecx
sti
xchg ebp, eax
push edi
adc byte [ebp - 0x20bf2f6c], bh
test eax, 0xcb25fcb1
sub dl, byte [esi]
push ss
or al, 0x5f
sbb al, 0x2e
sbb byte [ebx - 0x49], ch
dec ecx
adc dword [esi], ecx
ja 0x45c95e
in eax, 0x11
jo 0x45c96e
push dword [edi]
aaa
fcmovnu st(0), st(0)
jbe 0x45c978
xchg ebx, ebp
mov esi, 0xdfe98676
adc al, 0x13
xchg cl, ch
fist word [ebx + edx]
les esi, [ebx]
inc eax
mov cl, 0x83
mov dword [0x62ede82], eax
jb 0x45c994
lodsd eax, dword [esi]
xchg edx, eax
movsd dword es:[edi], dword [esi]
clc
int3
mov edi, 0xd100168d
inc esp
cmpsd dword [esi], dword es:[edi]
invalid

Function at 0x47515a
Capabilities:
Encode data using xor

Disassembly:
insb byte es:[edi], dx
les esp, [edi + 0x34]
imul esp, dword [edx + 0xacdc78a], 0x700f46d
mov dl, 0xb1
inc esp
mul byte [eax]
sub al, 0xd3
jbe 0x475144
xor al, 0x69
mov byte [0xacdc78a], al
insd dword es:[edi], dx
hlt
out 0x67, eax
sub dword [esi], 0x43
xor bh, byte [0x6e4a4da7]
sub dword [0x3243], 0x3d
cmpsd dword [esi], dword es:[edi]
dec ebp
dec edx
outsb dx, byte [esi]
mov byte [ebp + 0x2728f49e], al
push ds
and dword [esi - 0x2e0312b5], 0x210bf13d
jle 0x4751d0
xchg edx, eax
pop ebx
add byte [ebp + esi*2 + 0x19ed3296], dl
salc
jnp 0x475190
xor eax, 0x5a064343
pop edi
cmp eax, 0x4be54d8
push 0x39825af9
inc edx
pop edx
cmp byte [ecx], 0x42
and bl, byte [ebx - 0x30]
jge 0x475142
cmpsd dword [esi], dword es:[edi]
add dword [edx - 0x5a], 0x37
fcompi st(3)
mov esi, 0x71ae1b90
lcall 0xa032, 0x9882162b
and al, 0xb1
retf 0xcd8a
inc ebx
int 0xd4
xchg edx, eax
dec ecx
add eax, 0xc68d882
sub ah, byte [eax - 0x40]
bndldx bnd1, [0x8af39454]
imul ecx, ebx, 0x7c
hlt

Function at 0x475e7a
Capabilities:
Encode data using xor

Disassembly:
outsd dx, dword [esi]
inc esi
rcr byte [ebp - 0x7cc58d55], 1
jp 0x475e77
and bh, ch
mov cl, bh
imul edx, dword [ebx + esi*2], 0x52395b48
insb byte es:[edi], dx
and al, 0x31
mov edi, 0x36416a17
xor esi, dword [edi]
add al, 0x20
sub ebp, dword [esp]
pop esi
rcl dword [ecx + 0x2b4164a3], cl
sub eax, 0xd16ccda0
cdq
sub dword [edx], edi
call 0x432352fa
rcr byte [ebp + 0x5b], cl
cmp dword [ebx - 0x7f], edx
mov edx, 0xcec1d074
clc
ror esi, 0xf8
xchg edx, eax
xor byte [edx], dh
cld
push edx
stc
pop edx
xchg dword [edi - 0x5f], esi
and byte [ebx + 0x33368d36], al
imul edx, dword [edi + 0x2c], 0xfffffff3
xchg ecx, eax
pop ss
push esp
lds ecx, cs:[edi + edi - 0x6950c9d5]
scasd eax, dword es:[edi]
xchg esi, eax
aas
sub esi, dword [esi]
scasd eax, dword es:[edi]
xchg esi, eax
stc
cmp al, 0xea
jb 0x475e5a
mov word [edx + esi*2], ds
mov bl, byte [ecx - 0x59]
outsb dx, byte [esi]
inc ebx
rcr cl, cl
xchg byte [0x25ed9c77], bl
ja 0x475e19
into
cmpsb byte [esi], byte es:[edi]
jmp 0x5c409237
Function at 0x48e398
Capabilities:
Encode data using xor

Disassembly:
add byte [eax], ah
adc byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
inc ebx
push esi
and byte [eax], ah
movsb byte es:[edi], byte [esi]
inc ebp
je 0x48e422
rep insd dword es:[edi], dx
std
pop esp
xor esp, dword [edx]
dec edi
push esp
jno 0x48e3ee
sub dword [esi - 0x7139805], esi
xchg esp, eax
test byte [0x65def820], bh
lodsd eax, dword [esi]
mov ebp, 0x61554388
pop edx
sub al, 0x96
pop ss
dec esi
xchg edi, eax
invalid
xor ch, byte [ecx + 0x7c562330]
jge 0x48e499
inc ebp
mov dh, 0x70
in al, dx
fmul dword [edi - 0x6b]
lea edi, [ebx + 0x2562cf1e]
xchg edi, eax
xor al, 4
push esi
pop ss
mov dh, 0x2d
and al, 0x1c
mov eax, 0xbe578458
mov edx, 0x4a13c38b
cmc
cmp al, 0x9e
mov ebx, 0xf6c36f67
inc eax
push ebx
lodsd eax, dword [esi]
inc edi
loop 0x48e4c7
mov byte [ebx + 0x54c470da], bh
mov ebx, 0x54c470da
push 0x2ca8c35c
aam 0x9c
mov ah, 0x4d
mov edi, dword [edx + 0x10]
jbe 0x48e4f6
dec ebx
xor ebp, 0xffffffef
loopne 0x48e538
iretd
leave

Function at 0x4bf59e
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov edx, dword [ebp + 8]
xor ecx, ecx
mov eax, 0x4c7368
cmp edx, dword [eax]
je 0x4bf5c0
add eax, 8
inc ecx
cmp eax, 0x4c73f8
jl 0x4bf5b1
push esi
mov esi, ecx
shl esi, 3
cmp edx, dword [esi + 0x4c7368]
jne 0x4bf6ee
sbb al, 1
add byte [eax], al

Function at 0x4bf5ce
Capabilities:
Write file on windows

Disassembly:
sbb al, 1
add byte [eax], al
mov eax, dword [0x4cba7c]
cmp eax, 1
je 0x4bf6c8
test eax, eax
jne 0x4bf5f1
cmp dword [0x4c72a8], 1
je 0x4bf6c8
cmp edx, 0xfc
je 0x4bf6ee
lea eax, [ebp - 0x1a4]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x4bf628
lea eax, [ebp - 0x1a4]
push str._program_name_unknown_
push eax
call fcn.004bfcb0
pop ecx
pop ecx
lea eax, [ebp - 0x1a4]
push edi
push eax
lea edi, [ebp - 0x1a4]
call fcn.004bfee0
inc eax
pop ecx
cmp eax, 0x3c
jbe 0x4bf66b
lea eax, [ebp - 0x1a4]
push eax
call fcn.004bfee0
mov edi, eax
lea eax, [ebp - 0x1a4]
sub eax, 0x3b
push 3
add edi, eax
push 0x4c3b80
push edi
call fcn.004c16b0
add esp, 0x10
lea eax, [ebp - 0xa0]
push str.Runtime_Error__n_nProgram:
push eax
call fcn.004bfcb0
lea eax, [ebp - 0xa0]
push edi
push eax
call fcn.004bfcc0
lea eax, [ebp - 0xa0]
push 0x4c3b60
push eax
call fcn.004bfcc0
push dword [esi + 0x4c736c]
lea eax, [ebp - 0xa0]
push eax
call fcn.004bfcc0
push 0x12010
lea eax, [ebp - 0xa0]
push str.Microsoft_Visual_C_Runtime_Library
push eax
call fcn.004c1624
add esp, 0x2c
pop edi
jmp 0x4bf6ee
lea eax, [ebp + 8]
lea esi, [esi + 0x4c736c]
push 0
push eax
push dword [esi]
call fcn.004bfee0
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop esi
leave
ret
Function at 0x10011620
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100578de
mov eax, dword fs:[0]
push eax
sub esp, 8
push esi
push edi
mov eax, dword [0x10083a30]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov ecx, dword [esi + 4]
cmp dword [ecx + 0x16], 0
mov eax, 0x32
je 0x1001172e
mov edx, dword [ebp + 8]
push edx
lea ecx, [ebp + 8]
call fcn.10024e70
mov edi, dword [esi + 4]
mov dword [ebp - 4], 0
call sym.ScCore.dll_public:_static_class_ScCore::Encoder_const____cdecl_ScCore::Encoder::getBinary_void_
cmp dword [edi + 0x12], eax
setne al
cmp byte [ebp + 0xc], 0
je 0x10011692
test al, al
je 0x10011692
mov eax, dword [edi + 0x22]
push eax
lea ecx, [ebp + 8]
call fcn.10024e70
mov ecx, dword [esi + 4]
mov edx, dword [ecx + 0x12]
push edx
lea eax, [ebp - 0x10]
push eax
lea ecx, [ebp - 0x14]
push ecx
lea ecx, [ebp + 8]
call fcn.10024e70
mov edi, eax
test edi, edi
jne 0x100116d7
mov eax, dword [ebp - 0x10]
test eax, eax
je 0x100116d7
mov edx, dword [esi + 4]
mov ecx, dword [edx + 0x16]
mov edx, dword [ebp - 0x14]
push ecx
push 1
push eax
push edx
call dword [sym.imp.msvcr100.dll_fwrite]
add esp, 0x10
cmp eax, 1
je 0x100116d7
mov edi, 0x34
mov eax, dword [esi + 4]
mov ecx, dword [eax + 0x16]
push ecx
call dword [sym.imp.msvcr100.dll_ferror]
add esp, 4
test eax, eax
je 0x10011702
mov edx, dword [esi + 4]
mov eax, dword [edx + 0x16]
push eax
call dword [sym.imp.msvcr100.dll_clearerr]
add esp, 4
mov edi, 0x34
jmp 0x1001171d
mov ecx, dword [esi + 4]
mov edx, dword [ecx + 0x16]
push edx
call dword [sym.imp.msvcr100.dll_ftell]
mov esi, dword [esi + 4]
add esp, 4
cmp eax, dword [esi + 0x1a]
jle 0x1001171d
mov dword [esi + 0x1a], eax
lea ecx, [ebp + 8]
mov dword [ebp - 4], 0xffffffff
call sym.ScCore.dll_public:_void___thiscall_ScCore::String::destructor_void_
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 8
Function at 0x10012490
Capabilities:
Read file on windows
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10057a35
mov eax, dword fs:[0]
push eax
sub esp, 0x81c
mov eax, dword [0x10083a30]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
mov edi, ecx
mov edx, dword [edi]
mov dword [ebp - 0x814], eax
mov eax, dword [edx + 0x10]
mov dword [ebp - 0x820], edi
call eax
mov eax, dword [edi + 4]
lea ecx, [ebp - 0x824]
push ecx
lea edx, [ebp - 0x828]
push edx
add eax, 4
push eax
call fcn.10024e70
add esp, 0xc
test eax, eax
jne 0x1001253e
mov ecx, dword [edi + 4]
push 0x1005f994
push ecx
call fcn.10024e70
mov esi, eax
add esp, 8
test esi, esi
jne 0x10012672
mov edx, dword [edi + 4]
mov ebx, dword [edx + 0x16]
mov esi, dword [sym.imp.msvcr100.dll_fseek]
push 2
push eax
push ebx
call esi
add esp, 0xc
test eax, eax
je 0x10012548
mov eax, dword [edi]
mov edx, dword [eax + 0x10]
mov ecx, edi
call edx
mov eax, 0x34
jmp 0x10012674
mov esi, 0x30
jmp 0x10012672
push ebx
call dword [sym.imp.msvcr100.dll_ftell]
push 0
push 0
push ebx
mov edi, eax
call esi
add esp, 0x10
test eax, eax
je 0x10012576
mov ecx, dword [ebp - 0x820]
mov eax, dword [ecx]
mov edx, dword [eax + 0x10]
call edx
mov eax, 0x34
jmp 0x10012674
mov eax, dword [ebp - 0x814]
push eax
lea ecx, [ebp - 0x81c]
call fcn.10024e70
mov ecx, dword [ebp - 0x818]
push 0x1005f9ec
push ecx
mov dword [ebp - 4], 0
call fcn.10024e70
mov esi, eax
add esp, 8
test esi, esi
jne 0x10012653
mov edx, dword [ebp - 0x818]
mov eax, dword [edx + 0x16]
mov dword [ebp - 0x814], eax
test edi, edi
je 0x10012611
mov esi, edi
cmp edi, 0x800
jbe 0x100125cf
mov esi, 0x800
push ebx
push 1
lea ecx, [ebp - 0x810]
push esi
push ecx
call dword [sym.imp.msvcr100.dll_fread]
add esp, 0x10
test eax, eax
je 0x10012692
mov edx, dword [ebp - 0x814]
push edx
push 1
lea eax, [ebp - 0x810]
push esi
push eax
call dword [sym.imp.msvcr100.dll_fwrite]
add esp, 0x10
test eax, eax
je 0x10012692
sub edi, esi
jne 0x100125c0
lea ecx, [ebp - 0x81c]
call sym.ScCore.dll_public_virtual:_int___thiscall_ScCore::File::close_void_
mov esi, eax
test esi, esi
jne 0x10012653
mov ecx, dword [ebp - 0x818]
add ecx, 4
push ecx
call fcn.10024e70
mov edx, dword [ebp - 0x824]
mov eax, dword [ebp - 0x828]
mov ecx, dword [ebp - 0x818]
push edx
push eax
add ecx, 4
push ecx
call fcn.100358a0
add esp, 0x10
mov esi, eax
mov ecx, dword [ebp - 0x820]
mov edx, dword [ecx]
mov eax, dword [edx + 0x10]
call eax
lea ecx, [ebp - 0x81c]
mov dword [ebp - 4], 0xffffffff
call fcn.10024e70
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.10054c82
mov esp, ebp
pop ebp
ret 4
mov esi, 0x34
jmp 0x10012653
Function at 0x10024e70
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
pushal
call 0x10024e7f
pop dword [ebp - 0x34]
mov eax, 0x10024e7f
sub dword [ebp - 0x34], eax
mov dword [ebp - 0x44], 0xd354f0d5
add dword [ebp - 0x44], 0x7afd5476
mov dword [ebp - 0x40], 0x98b58a64
add dword [ebp - 0x40], 0x997dc1e1
mov dword [ebp - 0x3c], 0x69b0e915
add dword [ebp - 0x3c], 0xe29b5b19
mov dword [ebp - 0x38], 0x4198bcba
add dword [ebp - 0x38], 0xbe674346
lea eax, [ebp - 0x44]
push eax
mov eax, 0x3e73a223
sub eax, 0x2e6dd11b
add eax, dword [ebp - 0x34]
call dword [eax]
mov dword [ebp - 0x44], 0x67a3397d
add dword [ebp - 0x44], 0xccf2fd9
mov dword [ebp - 0x40], 0xe849b96f
add dword [ebp - 0x40], 0x5922a806
mov dword [ebp - 0x3c], 0x8fde6006
add dword [ebp - 0x3c], 0xd3910c66
mov dword [ebp - 0x38], 0x984835d8
sub dword [ebp - 0x38], 0x984835d8
lea ebx, [ebp - 0x44]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x34]
call dword [eax]
push 0x40
push 0x1000
push 0x4eabd
push 0
call eax
mov ecx, 0x4b43b976
add ecx, 0xb4bc89da
mov ebx, eax
mov esi, 0x3b204d1e
add esi, 0xd4e8c0e2
add esi, dword [ebp - 0x34]
mov edx, 0x4d6a30ba
sub dword [ebp - 0xc], edx
mov edi, dword [esi]
xor dword [ebp - 0x20], edx
add edi, edx
sub dword [ebp - 0xc], edi
mov dword [ebx], edi
mov dword [ebp - 0x30], 0x20389aeb
add ebx, 0x2569f4fe
sub ebx, 0x2569f4fa
add esi, 0xc3a60caa
add esi, 0x3c59f35a
loop 0x10024f91
add eax, 0xe70639e8
sub eax, 0xe70539d5
mov ebx, eax
add eax, 5
mov ecx, 0x94a5bb97
add ecx, 0x7b5a4469
add ecx, dword [ebp - 0x34]
call ebx
leave
ret

Function at 0x100374d0
Capabilities:
Enumerate gui resources

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push esi
call dword [sym.imp.kernel32.dll_GetCurrentProcessId]
mov dword [ebp - 8], eax
mov dword [ebp - 4], 0
call dword [sym.imp.USER32.dll_GetActiveWindow]
mov esi, eax
test esi, esi
jne 0x100374fb
call dword [sym.imp.USER32.dll_GetForegroundWindow]
mov esi, eax
mov eax, dword [ebp - 8]
push eax
mov eax, esi
call fcn.10024e70
add esp, 4
mov dword [ebp - 4], eax
test eax, eax
je 0x10037529
push eax
call dword [sym.imp.USER32.dll_IsWindowEnabled]
test eax, eax
jne 0x10037522
mov eax, esi
mov dword [ebp - 4], eax
jmp 0x10037525
mov eax, dword [ebp - 4]
test eax, eax
jne 0x1003753b
lea ecx, [ebp - 8]
push ecx
push 0x100374a0
call dword [sym.imp.USER32.dll_EnumWindows]
mov eax, dword [ebp - 4]
pop esi
mov esp, ebp
pop ebp
ret