joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10030230
Capabilities:
Access peb ldr_data

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10178121
mov eax, dword fs:[0]
push eax
push ebx
sub esp, 0x40
mov eax, dword [0x10204014]
xor eax, ebp
mov dword [ebp - 0x14], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov eax, dword [ebx + 8]
mov dword [ebp - 0x4c], eax
mov dword [ebp - 0x40], eax
mov eax, dword [ebx + 0xc]
mov dword [ebp - 0x44], 0
mov dword [ebp - 0x48], eax
xor eax, eax
mov dword [ebp - 0x2c], 0
mov dword [ebp - 0x28], 0
mov dword [ebp - 0x2c], 0
mov dword [ebp - 0x28], 7
mov word [ebp - 0x3c], ax
mov dword [ebp - 4], 1
xorps xmm0, xmm0
movq qword [ebp - 0x20], xmm0
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x18], eax
mov byte [ebp - 4], 2
lea esi, [edi + 0x30]
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x24], esi
test esi, esi
je 0x100302e1
mov eax, dword [esi]
test eax, eax
je 0x100302e1
push eax
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov byte [ebp - 4], 3
lea eax, [edi + 0x24]
lea ecx, [ebp - 0x20]
cmp ecx, eax
je 0x100302fc
push dword [ebp - 0x4c]
push dword [eax + 4]
push dword [eax]
call fcn.10014790
mov byte [ebp - 4], 2
test esi, esi
je 0x10030318
mov eax, dword [esi]
test eax, eax
je 0x10030311
push eax
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov dword [ebp - 0x24], 0
mov esi, dword [ebp - 0x20]
mov edi, dword [ebp - 0x1c]
cmp esi, edi
jne 0x10030380
mov esi, dword [ebp - 0x40]
xor eax, eax
movups xmm0, xmmword [ebp - 0x3c]
mov word [ebp - 0x3c], ax
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
movups xmmword [esi], xmm0
movq xmm0, qword [ebp - 0x2c]
movq qword [esi + 0x10], xmm0
mov dword [ebp - 0x2c], 0
mov dword [ebp - 0x28], 7
mov dword [ebp - 0x44], 1
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x20]
call fcn.10007b20
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x3c]
call fcn.10007f50
mov eax, esi
jmp 0x100303ff
cmp dword [esi + 0x14], 8
mov eax, esi
jb 0x1003038a
mov eax, dword [esi]
mov edx, dword [ebp - 0x48]
mov ecx, edx
cmp dword [edx + 0x14], 8
jb 0x10030397
mov ecx, dword [edx]
push eax
push ecx
call dword [sym.imp.SHLWAPI.dll_StrStrIW]
test eax, eax
jne 0x100303d4
add esi, 0x18
cmp esi, edi
jne 0x10030380
mov esi, dword [ebp - 0x40]
movups xmm0, xmmword [ebp - 0x3c]
mov word [ebp - 0x3c], ax
mov dword [esi + 0x10], eax
mov dword [esi + 0x14], eax
movups xmmword [esi], xmm0
movq xmm0, qword [ebp - 0x2c]
movq qword [esi + 0x10], xmm0
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x28], 7
jmp 0x10030358
mov ecx, dword [ebp - 0x40]
push esi
call fcn.10007680
mov dword [ebp - 0x44], 1
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x20]
call fcn.10007b20
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x3c]
call fcn.10007f50
mov eax, dword [ebp - 0x40]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.1016e794
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret 8
Function at 0x10032320
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [0x10204014]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 8], ecx
mov esi, ebx
cmp dword [ebx + 0x14], 8
mov edi, dword [ebx + 0x10]
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x10], edi
jb 0x1003234f
mov esi, dword [ebx]
xor ecx, ecx
mov edx, 0x811c9dc5
add edi, edi
je 0x10032371
nop word [eax + eax]
movzx eax, byte [ecx + esi]
inc ecx
xor eax, edx
imul edx, eax, 0x1000193
cmp ecx, edi
jb 0x10032360
mov esi, dword [ebp - 8]
mov eax, dword [esi + 0x18]
mov ecx, dword [esi + 0xc]
and eax, edx
mov esi, dword [esi + 4]
mov dword [ebp - 8], esi
mov edx, dword [ecx + eax*8]
add eax, eax
mov edi, dword [ecx + eax*4]
inc eax
mov dword [ebp - 0x1c], edi
lea eax, [ecx + eax*4]
mov dword [ebp - 0x20], eax
mov dword [ebp - 0xc], edx
cmp edi, esi
jne 0x1003239f
mov eax, esi
jmp 0x100323a3
mov eax, dword [eax]
mov eax, dword [eax]
cmp edx, eax
je 0x1003245e
add edx, 8
mov eax, ebx
cmp dword [ebx + 0x14], 8
jb 0x100323b8
mov eax, dword [ebx]
cmp dword [edx + 0x14], 8
mov edi, edx
jb 0x100323c2
mov edi, dword [edx]
mov esi, dword [edx + 0x10]
mov ecx, dword [ebp - 0x10]
mov dword [ebp - 0x14], esi
cmp esi, ecx
jne 0x10032430
test esi, esi
jbe 0x100323e9
sub edi, eax
mov cx, word [eax + edi]
cmp cx, word [eax]
jne 0x10032430
add eax, 2
sub esi, 1
jne 0x100323d5
mov ecx, dword [ebp - 0x10]
cmp dword [edx + 0x14], 8
jb 0x100323f1
mov edx, dword [edx]
cmp dword [ebx + 0x14], 8
jb 0x100323f9
mov ebx, dword [ebx]
cmp ecx, dword [ebp - 0x14]
jne 0x10032443
test ecx, ecx
je 0x10032415
sub ebx, edx
mov ax, word [edx + ebx]
cmp ax, word [edx]
jne 0x10032443
add edx, 2
sub ecx, 1
jne 0x10032404
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword [eax], ecx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1016e794
mov esp, ebp
pop ebp
ret 8
mov edx, dword [ebp - 0xc]
mov esi, dword [ebp - 8]
mov edi, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x20]
mov edx, dword [edx]
jmp 0x10032394
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 8]
pop edi
pop esi
mov dword [eax], ecx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1016e794
mov esp, ebp
pop ebp
ret 8
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
mov dword [eax], esi
pop esi
pop ebx
call fcn.1016e794
mov esp, ebp
pop ebp
ret 8

Function at 0x100324e0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 8]
push ebx
push esi
push edi
cmp dword [edx + 0x14], 8
mov ebx, ecx
mov edi, dword [edx + 0x10]
jb 0x100324f6
mov edx, dword [edx]
xor ecx, ecx
mov esi, 0x811c9dc5
add edi, edi
je 0x10032512
movzx eax, byte [ecx + edx]
inc ecx
xor eax, esi
imul esi, eax, 0x1000193
cmp ecx, edi
jb 0x10032501
mov eax, dword [ebx + 0x18]
pop edi
and eax, esi
pop esi
pop ebx
pop ebp
ret 4
Function at 0x10033540
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [ebp + 8]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 0xc]
push ebx
push esi
push edi
cmp dword [eax + 0x14], 8
mov esi, eax
mov ecx, dword [eax + 0x10]
mov dword [ebp - 4], eax
jb 0x10033562
mov esi, dword [eax]
lea edi, [ecx + ecx]
mov edx, 0x811c9dc5
xor ecx, ecx
test edi, edi
je 0x10033581
movzx eax, byte [ecx + esi]
inc ecx
xor eax, edx
imul edx, eax, 0x1000193
cmp ecx, edi
jb 0x10033570
and edx, dword [0x102087c4]
mov ecx, dword [0x102087b8]
lea eax, [edx + edx]
mov ebx, dword [ecx + edx*8]
mov edx, dword [ecx + eax*4]
lea ecx, [ecx + eax*4]
add ecx, 4
mov dword [ebp - 0x14], edx
mov dword [ebp - 8], ecx
mov eax, dword [0x102087b0]
cmp edx, eax
je 0x100335af
mov eax, dword [ecx]
mov eax, dword [eax]
cmp ebx, eax
je 0x1003365a
mov eax, dword [ebp - 4]
lea edx, [ebx + 8]
mov ecx, eax
cmp dword [eax + 0x14], 8
jb 0x100335c7
mov ecx, dword [eax]
cmp dword [edx + 0x14], 8
mov edi, edx
jb 0x100335d1
mov edi, dword [edx]
mov esi, dword [edx + 0x10]
mov dword [ebp - 0xc], esi
cmp esi, dword [eax + 0x10]
jne 0x1003362f
test esi, esi
jbe 0x100335f6
sub edi, ecx
mov ax, word [edi + ecx]
cmp ax, word [ecx]
jne 0x1003362f
add ecx, 2
sub esi, 1
jne 0x100335e2
mov eax, dword [ebp - 4]
cmp dword [edx + 0x14], 8
jb 0x100335fe
mov edx, dword [edx]
cmp dword [eax + 0x14], 8
mov ecx, eax
jb 0x10033608
mov ecx, dword [eax]
mov esi, dword [eax + 0x10]
cmp esi, dword [ebp - 0xc]
jne 0x1003363c
test esi, esi
je 0x10033627
sub ecx, edx
mov ax, word [ecx + edx]
cmp ax, word [edx]
jne 0x1003363c
add edx, 2
sub esi, 1
jne 0x10033616
mov esi, dword [0x102087b0]
jmp 0x10033644
mov ebx, dword [ebx]
mov edx, dword [ebp - 0x14]
mov ecx, dword [ebp - 8]
jmp 0x100335a2
mov esi, dword [0x102087b0]
mov ebx, esi
cmp ebx, esi
je 0x10033660
mov eax, dword [ebp - 0x10]
pop edi
pop esi
mov dword [eax], ebx
mov byte [eax + 4], 0
pop ebx
mov esp, ebp
pop ebp
ret 8
mov esi, dword [0x102087b0]
mov eax, dword [ebp - 4]
mov esi, dword [esi]
push ecx
mov dword [ebp - 8], eax
lea eax, [ebp - 8]
push eax
mov edi, dword [esi + 4]
push ecx
push edi
push esi
call fcn.10034cb0
mov edx, dword [0x102087b4]
mov ecx, 0x6666665
sub ecx, edx
cmp ecx, 1
jae 0x10033695
push str.list_T__too_long
call dword [sym.imp.MSVCP140.dll_void___cdecl_std::_Xlength_error_char_const__]
inc edx
mov ecx, 0x102087ac
mov dword [0x102087b4], edx
mov dword [esi + 4], eax
mov esi, dword [ebp - 0x10]
mov dword [edi], eax
mov eax, dword [0x102087b0]
mov eax, dword [eax]
push eax
add eax, 8
push eax
push esi
call fcn.100340a0
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x10033de0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x101788f6
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push ebx
push esi
push edi
mov eax, dword [0x10204014]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
call fcn.10034790
mov esi, eax
mov dword [ebp - 0x14], esi
mov word [esi + 0xc], 0
mov dword [ebp - 4], 0
lea ecx, [esi + 0x10]
mov dword [ebp - 0x18], ecx
mov eax, dword [ebp + 0xc]
mov eax, dword [eax]
mov dword [ebp + 0xc], eax
mov eax, dword [eax]
mov dword [ecx], eax
lea edi, [ecx + 8]
mov dword [ebp - 0x1c], edi
mov dword [ebp - 0x20], edi
xorps xmm0, xmm0
movups xmmword [edi], xmm0
movups xmmword [edi + 0x10], xmm0
movq qword [edi + 0x20], xmm0
mov ecx, edi
call fcn.1002f2e0
mov byte [ebp - 4], 1
mov byte [ebp - 4], 2
mov byte [ebp - 4], 3
mov dword [edi + 0x28], 0
mov byte [ebp - 4], 4
lea eax, [edi + 0x30]
mov dword [ebp - 0x20], eax
mov dword [eax + 0x10], 0
mov dword [eax + 0x14], 0
mov dword [eax + 0x10], 0
mov dword [eax + 0x14], 7
xor ecx, ecx
mov word [eax], cx
mov byte [ebp - 4], 5
mov byte [ebp - 4], 6
mov byte [ebp - 4], 7
mov byte [ebp - 4], 8
mov byte [ebp - 4], cl
mov dword [ebp - 4], 0xffffffff
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc

Function at 0x10034580
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x101789d8
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x10204014]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], ecx
mov edi, dword [ebp + 0xc]
mov eax, dword [ebp + 8]
mov dword [ebp - 0x14], eax
cmp dword [edi + 0x1c], 8
lea esi, [edi + 8]
mov ebx, dword [edi + 0x18]
jb 0x100345c3
mov esi, dword [edi + 8]
xor ecx, ecx
mov edx, 0x811c9dc5
add ebx, ebx
je 0x100345e1
nop
movzx eax, byte [ecx + esi]
inc ecx
xor eax, edx
imul edx, eax, 0x1000193
cmp ecx, ebx
jb 0x100345d0
mov ebx, dword [ebp - 0x10]
mov eax, dword [ebx + 0x18]
mov ecx, dword [ebx + 0xc]
and eax, edx
lea edx, [eax*8]
add ecx, edx
cmp dword [ecx + 4], edi
jne 0x10034617
cmp dword [ecx], edi
jne 0x1003460f
mov eax, dword [ebx + 4]
mov dword [ecx], eax
mov ecx, dword [ebx + 0xc]
mov eax, dword [ebx + 4]
mov dword [edx + ecx + 4], eax
jmp 0x1003461f
mov eax, dword [edi + 4]
mov dword [ecx + 4], eax
jmp 0x1003461f
cmp dword [ecx], edi
jne 0x1003461f
mov eax, dword [edi]
mov dword [ecx], eax
mov eax, dword [edi + 4]
lea ecx, [edi + 8]
mov esi, dword [edi]
mov dword [ebp - 0x10], ecx
mov dword [eax], esi
mov edx, dword [edi]
mov eax, dword [edi + 4]
mov dword [edx + 4], eax
dec dword [ebx + 8]
mov dword [ebp - 4], 0xffffffff
call fcn.10007f50
push 0x28
push edi
call fcn.1016eb33
mov eax, dword [ebp - 0x14]
add esp, 8
mov dword [eax], esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x1003c250
Capabilities:
Access peb ldr_data
Get process heap flags
Get process heap force flags

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10179e16
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push ebx
push esi
push edi
mov eax, dword [0x10204014]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
call fcn.1003c530
mov edx, eax
mov dword [ebp - 0x14], edx
mov word [edx + 0xc], 0
mov dword [ebp - 4], 0
lea ecx, [edx + 0x10]
mov dword [ebp - 0x18], ecx
mov eax, dword [ebp + 0xc]
mov eax, dword [eax]
mov dword [ebp + 0xc], eax
mov eax, dword [eax]
mov dword [ecx], eax
add ecx, 4
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 0x20], ecx
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 0
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 7
xor eax, eax
mov word [ecx], ax
mov byte [ebp - 4], 1
mov byte [ebp - 4], 2
mov byte [ebp - 4], 3
lea eax, [ecx + 0x18]
mov dword [ebp - 0x20], eax
mov dword [eax + 0x10], 0
mov dword [eax + 0x14], 0
mov dword [eax + 0x10], 0
mov dword [eax + 0x14], 7
xor esi, esi
mov word [eax], si
mov byte [ebp - 4], 4
mov byte [ebp - 4], 5
mov byte [ebp - 4], 6
mov byte [ecx + 0x30], 0
mov byte [ebp - 4], 7
mov byte [ebp - 4], 8
mov byte [ebp - 4], 0
mov dword [ebp - 4], 0xffffffff
mov eax, edx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x10050080
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1017cfd2
mov eax, dword fs:[0]
push eax
sub esp, 0x14c
mov eax, dword [0x10204014]
xor eax, ebp
mov dword [ebp - 0x10], eax
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, dword [ebp + 8]
mov dword [ebp - 0x158], edi
mov dword [ebp - 0x150], 0
push 1
mov dword [ebp - 0x14], 0
call fcn.1016e7bd
mov dword [ebp - 0x14], eax
push 0x118
push 0
mov byte [eax], 0
lea eax, [ebp - 0x144]
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0x10
mov dword [ebp - 0x148], 0x11c
lea eax, [ebp - 0x148]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x10050113
cmp dword [ebp - 0x144], 6
mov eax, dword [ebp - 0x14]
setae cl
mov byte [eax], cl
mov dword [ebp - 4], 1
call fcn.1013e5f0
mov dword [ebp - 0x154], eax
cmp eax, 0xffffffff
jne 0x1005014c
xor eax, eax
mov dword [edi + 0x10], 0
mov dword [edi + 0x14], 7
mov word [edi], ax
mov dword [ebp - 0x150], 1
jmp 0x100501f7
lea eax, [ebp - 0x154]
mov dword [ebp - 0x14c], 0
push eax
lea eax, [ebp - 0x14c]
push eax
call fcn.1013f240
test al, al
jne 0x1005018f
xor eax, eax
mov dword [edi + 0x10], 0
mov dword [edi + 0x14], 7
mov word [edi], ax
mov dword [ebp - 0x150], 1
mov byte [ebp - 4], al
jmp 0x100501fb
push dword [ebp - 0x14c]
lea eax, [ebp - 0x2c]
push eax
call fcn.1013f300
mov byte [ebp - 4], 2
push dword [ebp - 0x14c]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
movups xmm0, xmmword [ebp - 0x2c]
mov dword [edi + 0x10], 0
xor eax, eax
mov dword [edi + 0x14], 0
movups xmmword [edi], xmm0
mov word [ebp - 0x2c], ax
movq xmm0, qword [ebp - 0x1c]
movq qword [edi + 0x10], xmm0
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x18], 7
mov dword [ebp - 0x150], 1
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x2c]
call fcn.10007f50
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x14]
call fcn.1013e4a0
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1016e794
mov esp, ebp
pop ebp
ret 4
Function at 0x10067560
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x14
push ebx
mov ebx, ecx
push esi
push edi
cmp dword [ebx + 0x38], 0
je 0x1006758c
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____thiscall_std::basic_streambuf_char__struct_std::char_traits_char__::xsputn_char_const___long_long___int64__]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov eax, dword [ebx + 0x20]
mov esi, dword [ebp + 0xc]
mov edi, dword [ebp + 0x10]
mov dword [esp + 0x18], esi
mov eax, dword [eax]
mov dword [esp + 0x1c], edi
mov dword [esp + 0x14], eax
test eax, eax
je 0x100675ae
mov eax, dword [ebx + 0x30]
mov eax, dword [eax]
jmp 0x100675b0
xor eax, eax
cdq
mov dword [esp + 0xc], eax
mov ecx, edx
mov dword [esp + 0x10], ecx
test edi, edi
jl 0x10067635
jg 0x100675c5
test esi, esi
je 0x10067635
test ecx, ecx
jl 0x1006760e
jg 0x100675cf
test eax, eax
je 0x1006760e
cmp edi, ecx
jg 0x100675e3
jl 0x100675d9
cmp esi, eax
jae 0x100675e3
mov eax, esi
mov dword [esp + 0xc], esi
mov dword [esp + 0x10], edi
push eax
push dword [ebp + 8]
push dword [esp + 0x1c]
call sub.VCRUNTIME140.dll_memcpy
mov ecx, dword [esp + 0x18]
add esp, 0xc
mov edx, dword [ebp + 8]
mov eax, dword [ebx + 0x30]
add edx, ecx
sub esi, ecx
sbb edi, dword [esp + 0x10]
sub dword [eax], ecx
mov eax, dword [ebx + 0x20]
add dword [eax], ecx
jmp 0x10067611
mov edx, dword [ebp + 8]
test edi, edi
jl 0x10067635
jg 0x1006761b
test esi, esi
je 0x10067635
mov eax, dword [ebx + 0x4c]
test eax, eax
je 0x10067635
push eax
push esi
push 1
push edx
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
add esp, 0x10
sub esi, eax
sbb edi, 0
mov eax, dword [esp + 0x18]
mov edx, dword [esp + 0x1c]
sub eax, esi
sbb edx, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x10067650
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x14
push ebx
push esi
push edi
mov edi, ecx
cmp dword [edi + 0x38], 0
je 0x1006767c
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____thiscall_std::basic_streambuf_char__struct_std::char_traits_char__::xsgetn_char___long_long___int64__]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov eax, dword [edi + 0x1c]
mov esi, dword [ebp + 0xc]
mov ebx, dword [ebp + 0x10]
mov dword [esp + 0x18], esi
mov eax, dword [eax]
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x14], eax
test eax, eax
je 0x1006769e
mov eax, dword [edi + 0x2c]
mov eax, dword [eax]
jmp 0x100676a0
xor eax, eax
cdq
mov dword [esp + 0xc], eax
mov ecx, edx
mov dword [esp + 0x10], ecx
test ebx, ebx
jl 0x10067740
jg 0x100676bd
test esi, esi
je 0x10067740
test ecx, ecx
jl 0x1006770a
jg 0x100676c7
test eax, eax
je 0x1006770a
cmp ebx, ecx
jg 0x100676db
jl 0x100676d1
cmp esi, eax
jae 0x100676db
mov eax, esi
mov dword [esp + 0xc], esi
mov dword [esp + 0x10], ebx
push eax
push dword [esp + 0x18]
push dword [ebp + 8]
call sub.VCRUNTIME140.dll_memcpy
mov ecx, dword [esp + 0x18]
add esp, 0xc
mov edx, dword [ebp + 8]
mov eax, dword [edi + 0x2c]
add edx, ecx
sub esi, ecx
mov dword [esp + 0xc], edx
sbb ebx, dword [esp + 0x10]
sub dword [eax], ecx
mov eax, dword [edi + 0x1c]
add dword [eax], ecx
jmp 0x10067711
mov eax, dword [ebp + 8]
mov dword [esp + 0xc], eax
test ebx, ebx
jl 0x10067740
jg 0x1006771b
test esi, esi
je 0x10067740
cmp dword [edi + 0x4c], 0
je 0x10067740
mov ecx, edi
call fcn.10067f60
push dword [edi + 0x4c]
push esi
push 1
push dword [esp + 0x18]
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
add esp, 0x10
sub esi, eax
sbb ebx, 0
mov eax, dword [esp + 0x18]
mov edx, dword [esp + 0x1c]
sub eax, esi
pop edi
pop esi
sbb edx, ebx
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x10067ad0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
mov eax, dword [0x10204014]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, ecx
cmp ebx, 0xffffffff
jne 0x10067b00
pop esi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1016e794
mov esp, ebp
pop ebp
ret 4
mov eax, dword [esi + 0x20]
mov eax, dword [eax]
test eax, eax
je 0x10067b30
mov edx, dword [esi + 0x30]
mov edx, dword [edx]
add edx, eax
cmp eax, edx
jae 0x10067b30
call dword [sym.imp.MSVCP140.dll_protected:_char____thiscall_std::basic_streambuf_char__struct_std::char_traits_char__::_Pninc_void_]
pop esi
mov byte [eax], bl
mov eax, ebx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1016e794
mov esp, ebp
pop ebp
ret 4
cmp dword [esi + 0x4c], 0
push edi
je 0x10067c05
mov edi, dword [esi + 0xc]
lea eax, [esi + 0x3c]
cmp dword [edi], eax
jne 0x10067b59
mov edx, dword [esi + 0x54]
mov ecx, dword [esi + 0x50]
sub edx, ecx
mov dword [edi], ecx
mov eax, dword [esi + 0x1c]
mov dword [eax], ecx
mov eax, dword [esi + 0x2c]
mov dword [eax], edx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x10067b65
movsx eax, bl
jmp 0x10067b9c
lea eax, [ebp - 0x2c]
mov byte [ebp - 0x25], bl
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x25]
push eax
lea eax, [esi + 0x40]
push eax
call dword [sym.imp.MSVCP140.dll_public:_int___thiscall_std::codecvt_char__char__struct__Mbstatet_::out_struct__Mbstatet___char_const___char_const___char_const____char___char___char___const]
test eax, eax
js 0x10067c05
cmp eax, 1
jle 0x10067bc6
cmp eax, 3
jne 0x10067c05
movsx eax, byte [ebp - 0x25]
push dword [esi + 0x4c]
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
add esp, 8
or ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, ebx
pop edi
pop esi
mov eax, ecx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1016e794
mov esp, ebp
pop ebp
ret 4
mov edi, dword [ebp - 0x2c]
lea eax, [ebp - 0x24]
sub edi, eax
je 0x10067be4
push dword [esi + 0x4c]
push edi
push 1
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
add esp, 0x10
cmp edi, eax
jne 0x10067c05
lea eax, [ebp - 0x25]
mov byte [esi + 0x3d], 1
cmp dword [ebp - 0x30], eax
je 0x10067c05
pop edi
pop esi
mov eax, ebx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1016e794
mov esp, ebp
pop ebp
ret 4
mov ecx, dword [ebp - 4]
or eax, 0xffffffff
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1016e794
mov esp, ebp
pop ebp
ret 4
Function at 0x10067f90
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x10204014]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, ecx
push edi
cmp dword [esi + 0x38], 0
je 0x10068033
cmp byte [esi + 0x3d], 0
je 0x10068033
mov eax, dword [esi]
push 0xffffffffffffffff
call dword [eax + 0xc]
cmp eax, 0xffffffff
je 0x10067fe8
mov ecx, dword [esi + 0x38]
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [esi + 0x40]
push eax
call dword [sym.imp.MSVCP140.dll_public:_int___thiscall_std::codecvt_char__char__struct__Mbstatet_::unshift_struct__Mbstatet___char___char___char___const]
sub eax, 0
je 0x10067ffa
sub eax, 1
je 0x10067ffe
sub eax, 2
je 0x10068033
pop edi
xor al, al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1016e794
mov esp, ebp
pop ebp
ret
mov byte [esi + 0x3d], 0
mov edi, dword [ebp - 0x28]
lea eax, [ebp - 0x24]
sub edi, eax
je 0x1006801c
push dword [esi + 0x4c]
push edi
push 1
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
add esp, 0x10
cmp edi, eax
jne 0x10067fe8
cmp byte [esi + 0x3d], 0
pop edi
sete al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1016e794
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
mov al, 1
pop edi
xor ecx, ebp
pop esi
call fcn.1016e794
mov esp, ebp
pop ebp
ret