joyce8/EMBER2024-capa huggingface dataset:
Function at 0x48e206
Capabilities:
Get graphical window text

Disassembly:
push esi
mov esi, ecx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x48e23e
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
lea ecx, [eax + 1]
push ecx
mov ecx, dword [esp + 0xc]
push eax
call fcn.0048c251
push eax
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov ecx, dword [esp + 8]
push 0xffffffffffffffff
call fcn.0048c229
jmp 0x48e24a
mov eax, dword [ecx]
push dword [esp + 8]
call dword [eax + 0x88]
pop esi
ret 4

Function at 0x48fa7b
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
push edi
xor edi, edi
cmp dword [esp + 0x10], edi
mov ebx, ecx
je 0x48fabd
call fcn.00495f94
mov esi, dword [eax + 0xc]
push 0xf0
push dword [esp + 0x14]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
cmp eax, edi
je 0x48fabd
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp eax, edi
jne 0x48fab4
xor eax, eax
jmp 0x48fac5
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
push edi
mov ecx, ebx
call fcn.0048facb
pop edi
pop esi
pop ebx
ret 4

Function at 0x4964c4
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
mov esi, ecx
lea ebx, [esi + 0x1c]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [esp + 0x10], 0
jne 0x4964f2
push dword [esi]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x496510
push dword [esp + 0xc]
mov ecx, esi
push eax
call fcn.0049642a
jmp 0x496510
mov eax, dword [esi + 0x14]
test eax, eax
je 0x496510
push edi
push dword [esp + 0x10]
mov edi, dword [eax + 4]
mov ecx, esi
push eax
call fcn.0049642a
test edi, edi
mov eax, edi
jne 0x4964fa
pop edi
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop esi
pop ebx
ret 8
Function at 0x498d3a
Capabilities:
Check for time delay via gettickcount
Log keystrokes via polling

Disassembly:
sub esp, 0x20
push ebx
push ebp
push esi
mov esi, ecx
push edi
mov edi, dword [sym.imp.USER32.dll_GetKeyState]
xor ebx, ebx
push 1
mov dword [esi + 0x30], ebx
mov dword [esi + 0x34], ebx
mov dword [esi + 0x38], ebx
call edi
test ax, ax
jge 0x498d62
or dword [esi + 0x38], 1
or dword [esi + 0x34], 2
jmp 0x498d73
push 2
call edi
test ax, ax
jge 0x498d73
or dword [esi + 0x38], 2
or dword [esi + 0x34], 1
mov ebp, dword [sym.imp.KERNEL32.dll_GetTickCount]
call ebp
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x34]
push dword [eax + 0x1c]
call dword [sym.imp.USER32.dll_SetCapture]
push eax
call fcn.0048d83b
cmp dword [esi + 0x30], ebx
jne 0x498e4d
mov edi, dword [sym.imp.USER32.dll_PeekMessageA]
mov ebx, 0x100
call dword [sym.imp.USER32.dll_GetCapture]
push eax
call fcn.0048d83b
cmp eax, dword [esp + 0x34]
jne 0x498e4d
push 1
push 0x209
push 0x200
lea eax, [esp + 0x20]
push 0
push eax
call edi
test eax, eax
jne 0x498de9
push 1
push 0x108
push ebx
push eax
lea eax, [esp + 0x24]
push eax
call edi
test eax, eax
je 0x498e2e
mov eax, dword [esp + 0x18]
cmp eax, 0x202
je 0x498e4d
cmp eax, 0x205
je 0x498e4d
cmp eax, 0x201
je 0x498e4d
cmp eax, 0x204
je 0x498e4d
cmp eax, ebx
jne 0x498e14
cmp dword [esp + 0x1c], 0x1b
je 0x498e4d
push dword [esp + 0x2c]
lea eax, [esi + 0x20]
push dword [esp + 0x2c]
push eax
call dword [sym.imp.USER32.dll_PtInRect]
neg eax
sbb eax, eax
inc eax
mov dword [esi + 0x30], eax
call ebp
sub eax, dword [esp + 0x10]
cmp eax, dword [0x5defec]
jbe 0x498e43
mov dword [esi + 0x30], 1
cmp dword [esi + 0x30], 0
je 0x498da6
call dword [sym.imp.USER32.dll_ReleaseCapture]
mov eax, dword [esi + 0x30]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x20
ret 4
Function at 0x403bf8
Capabilities:
Enumerate files on windows

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffec0
mov edi, ecx
mov esi, edx
push esp
push eax
call sub.kernel32.dll_FindFirstFileA
mov ebx, eax
cmp ebx, 0xffffffff
setne al
jmp 0x403c23
push esp
push ebx
call sub.kernel32.dll_FindNextFileA
neg eax
sbb eax, eax
neg eax
test al, al
je 0x403c3b
mov edx, esi
or dx, 0x20
not dx
movzx edx, dx
and edx, dword [esp]
test dl, 0x3f
jne 0x403c16
test al, al
je 0x403c64
mov dword [edi], 0x4d2
mov dword [edi + 4], ebx
mov word [edi + 8], si
mov edx, esp
mov eax, edi
call fcn.00403804
call fcn.00402a38
xor edx, edx
mov dword [eax + 0xc], edx
jmp 0x403ca7
call fcn.00402a38
lea eax, [eax + 0xc]
push eax
call sub.kernel32.dll_GetLastError_1
pop edx
mov dword [edx], eax
call fcn.00402a38
cmp dword [eax + 0xc], 0
jne 0x403c95
call fcn.00402a38
mov dword [eax + 0xc], 2
cmp ebx, 0xffffffff
je 0x403ca0
push ebx
call sub.kernel32.dll_FindClose
mov dword [edi + 4], 0xffffffff
add esp, 0x140
pop edi
pop esi
pop ebx
ret

Function at 0x403d80
Capabilities:
Set current directory

Disassembly:
add esp, 0xfffffefc
push esp
call sub.kernel32.dll_SetCurrentDirectoryA_1
test eax, eax
je 0x403d9f
call fcn.00402a38
xor edx, edx
mov dword [eax + 0xc], edx
jmp 0x403db3
call fcn.00402a38
lea eax, [eax + 0xc]
push eax
call sub.kernel32.dll_GetLastError_1
pop edx
mov dword [edx], eax
add esp, 0x104
ret

Function at 0x403dbc
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov esi, eax
xor ebx, ebx
xor eax, eax
push ebp
push 0x403e31
push dword fs:[eax]
mov dword fs:[eax], esp
push esi
call sub.kernel32.dll_DeleteFileA
test eax, eax
je 0x403ded
call fcn.00402a38
xor edx, edx
mov dword [eax + 0xc], edx
jmp 0x403e27
call fcn.00402a38
lea eax, [eax + 0xc]
push eax
call sub.kernel32.dll_GetLastError_1
pop edx
mov dword [edx], eax
test bl, bl
je 0x403e27
call fcn.00402a38
cmp dword [eax + 0xc], 2
jne 0x403e27
call fcn.00402a38
xor edx, edx
mov dword [eax + 0xc], edx
mov byte [0x40808c], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x403e48
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x403e50
Capabilities:
Create directory

Disassembly:
push ebx
mov ebx, eax
push 0
push ebx
call sub.kernel32.dll_CreateDirectoryA
test eax, eax
je 0x403e77
xor edx, edx
mov eax, ebx
call fcn.00403ec4
call fcn.00402a38
xor edx, edx
mov dword [eax + 0xc], edx
pop ebx
ret
call fcn.00402a38
lea eax, [eax + 0xc]
push eax
call sub.kernel32.dll_GetLastError_1
pop edx
mov dword [edx], eax
pop ebx
ret

Function at 0x403e90
Capabilities:
Delete directory

Disassembly:
push ebx
mov ebx, eax
push ebx
call sub.kernel32.dll_RemoveDirectoryA
test eax, eax
je 0x403eac
call fcn.00402a38
xor edx, edx
mov dword [eax + 0xc], edx
pop ebx
ret
call fcn.00402a38
lea eax, [eax + 0xc]
push eax
call sub.kernel32.dll_GetLastError_1
pop edx
mov dword [edx], eax
pop ebx
ret
Function at 0x403ec4
Capabilities:
Set file attributes

Disassembly:
push ebx
push esi
mov ebx, edx
mov esi, eax
test bx, bx
jne 0x403ed3
mov bx, 0x80
movzx eax, bx
push eax
push esi
call sub.kernel32.dll_SetFileAttributesA
test eax, eax
je 0x403ef1
call fcn.00402a38
xor edx, edx
mov dword [eax + 0xc], edx
pop esi
pop ebx
ret
call fcn.00402a38
lea eax, [eax + 0xc]
push eax
call sub.kernel32.dll_GetLastError_1
pop edx
mov dword [edx], eax
pop esi
pop ebx
ret

Function at 0x4040a4
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, eax
push 0
lea eax, [ebp - 4]
push eax
movzx eax, di
push eax
push esi
push ebx
call sub.kernel32.dll_ReadFile_1
test eax, eax
je 0x4040d5
call fcn.00402a38
xor edx, edx
mov dword [eax + 0xc], edx
jmp 0x4040e9
call fcn.00402a38
lea eax, [eax + 0xc]
push eax
call sub.kernel32.dll_GetLastError_1
pop edx
mov dword [edx], eax
mov eax, dword [ebp + 8]
mov dx, word [ebp - 4]
mov word [eax], dx
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret 4

Function at 0x4040fc
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, eax
push 0
lea eax, [ebp - 4]
push eax
movzx eax, di
push eax
push esi
push ebx
call sub.kernel32.dll_WriteFile_1
test eax, eax
je 0x40412d
call fcn.00402a38
xor edx, edx
mov dword [eax + 0xc], edx
jmp 0x404141
call fcn.00402a38
lea eax, [eax + 0xc]
push eax
call sub.kernel32.dll_GetLastError_1
pop edx
mov dword [edx], eax
mov eax, dword [ebp + 8]
mov dx, word [ebp - 4]
mov word [eax], dx
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret 4
Function at 0x4041a0
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffba0
push ebx
push esi
push edi
mov dword [ebp - 4], eax
mov esi, dword [ebp + 0x10]
mov ebx, dword [ebp + 0x14]
lea eax, [ebp - 0x48]
xor ecx, ecx
mov edx, 0x44
call fcn.00402508
mov dword [ebp - 0x48], 0x44
mov ax, word [ebp + 0xc]
mov word [ebp - 0x18], ax
mov dword [ebp - 0x1c], 1
lea eax, [ebp - 0x58]
xor ecx, ecx
mov edx, 0x10
call fcn.00402508
lea eax, [ebp - 0x258]
mov edx, dword [ebp + 0x18]
call fcn.00403428
test ebx, ebx
je 0x404222
cmp byte [ebx], 0
je 0x404222
mov edx, 0x4043c4
lea eax, [ebp - 0x258]
call fcn.0040348c
lea eax, [ebp - 0x258]
mov ecx, 0x1ff
mov edx, ebx
call fcn.00403518
test esi, esi
je 0x404240
lea eax, [ebp - 0x460]
mov ecx, 0x103
mov edx, esi
call fcn.004034c0
lea esi, [ebp - 0x460]
jmp 0x404249
xor esi, esi
mov byte [ebp - 0x460], 0
lea eax, [ebp - 0x460]
call fcn.004034a8
cmp eax, 3
jle 0x404264
lea eax, [ebp - 0x460]
call fcn.004036c0
lea eax, [ebp - 0x58]
push eax
lea eax, [ebp - 0x48]
push eax
push esi
push 0
push 0x4000020
push 0
push 0
push 0
lea eax, [ebp - 0x258]
push eax
push 0
call sub.kernel32.dll_CreateProcessA
test eax, eax
je 0x4042ae
mov ebx, 0x21
mov dl, byte [ebp + 8]
mov eax, dword [ebp - 0x58]
call fcn.00404154
mov edx, dword [ebp - 4]
mov dword [edx], eax
mov eax, dword [ebp - 0x54]
call fcn.00404070
jmp 0x4043b7
call sub.kernel32.dll_GetLastError_1
mov edi, eax
cmp edi, 0x20
jle 0x4042bf
mov edi, 2
lea eax, [ebp - 0x35c]
mov edx, dword [ebp + 0x18]
call fcn.00403428
lea eax, [ebp - 0x35c]
call fcn.0040367c
lea eax, [ebp - 0x258]
push eax
push esi
lea eax, [ebp - 0x35c]
push eax
call sub.shell32.dll_FindExecutableA
cmp eax, 0x20
jg 0x4042f8
mov ebx, edi
jmp 0x4043b7
mov dl, 0x5c
mov eax, dword [ebp + 0x18]
call fcn.004035ec
mov dl, 0x2e
call fcn.00403648
test eax, eax
je 0x404330
mov edx, 0x4043c4
lea eax, [ebp - 0x258]
call fcn.0040348c
lea eax, [ebp - 0x258]
mov ecx, 0x1ff
mov edx, dword [ebp + 0x18]
call fcn.00403518
test ebx, ebx
je 0x404356
mov edx, 0x4043c4
lea eax, [ebp - 0x258]
call fcn.0040348c
lea eax, [ebp - 0x258]
mov ecx, 0x1ff
mov edx, ebx
call fcn.00403518
lea eax, [ebp - 0x58]
push eax
lea eax, [ebp - 0x48]
push eax
push esi
push 0
push 0x4000020
push 0
push 0
push 0
lea eax, [ebp - 0x258]
push eax
push 0
call sub.kernel32.dll_CreateProcessA
test eax, eax
je 0x40439d
mov dl, byte [ebp + 8]
mov eax, dword [ebp - 0x58]
call fcn.00404154
mov edx, dword [ebp - 4]
mov dword [edx], eax
mov eax, dword [ebp - 0x54]
call fcn.00404070
mov ebx, 0x21
jmp 0x4043b7
mov eax, dword [ebp - 4]
xor edx, edx
mov dword [eax], edx
call sub.kernel32.dll_GetLastError_1
mov edi, eax
cmp edi, 0x20
jle 0x4043b5
mov edi, 2
mov ebx, edi
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x14

Function at 0x40444c
Capabilities:
Get disk information

Disassembly:
push ebx
add esp, 0xfffffff8
mov ebx, eax
mov edx, 0x404478
mov eax, esp
call fcn.00403428
add bl, 0x61
mov byte [esp], bl
push esp
call sub.kernel32.dll_GetDriveTypeA
cmp eax, 1
jne 0x404471
xor eax, eax
pop ecx
pop edx
pop ebx
ret
Function at 0x40448c
Capabilities:
Enumerate pe sections

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffff4
mov ebx, eax
movzx eax, word [ebx + 6]
mov edx, dword [ebx]
lea esi, [edx + eax]
movzx eax, word [ebx + 4]
cmp eax, 0xfa00
jne 0x404554
mov di, 4
movzx eax, word [ebx + 4]
movzx edx, word [ebx + 6]
mov ecx, edx
add ecx, 0x2e
cmp eax, ecx
jl 0x4044d5
movzx ecx, word [esi + 0x1c]
add edx, ecx
movzx ecx, word [esi + 0x1e]
add edx, ecx
add edx, 0x2e
cmp eax, edx
jge 0x404554
mov edx, dword [ebx]
lea eax, [edx + eax + 1]
movzx ecx, di
lea edx, [esp + 4]
call fcn.004024a4
movzx ecx, word [ebx + 4]
movzx edx, word [ebx + 6]
sub ecx, edx
mov eax, dword [ebx]
lea edx, [eax + edx]
xchg edx, eax
call fcn.004024a4
lea edx, [esp + 8]
push edx
movzx edx, word [ebx + 4]
mov ax, word [ebx + 6]
movzx ecx, ax
sub edx, ecx
mov ecx, dword [ebx]
lea edx, [ecx + edx]
mov ecx, eax
mov eax, dword [esp + 8]
call fcn.004040a4
call fcn.00402a38
cmp dword [eax + 0xc], 0
jne 0x40453c
movzx eax, word [esp + 8]
movzx edx, word [ebx + 6]
add eax, edx
cmp eax, 0x2e
jge 0x404546
mov eax, 1
jmp 0x404691
xor eax, eax
mov word [ebx + 6], ax
movzx eax, ax
mov edx, dword [ebx]
lea esi, [edx + eax]
movzx eax, word [ebx + 6]
add eax, 4
movzx edx, word [ebx + 4]
cmp eax, edx
jg 0x404583
mov eax, esi
mov ecx, 4
mov edx, dword [0x408090]
call fcn.00403450
test eax, eax
jne 0x404583
mov eax, 1
jmp 0x404691
movzx ebp, word [ebx + 4]
movzx edi, word [ebx + 6]
mov eax, edi
add eax, 0x2e
cmp ebp, eax
jl 0x4045bc
movzx eax, word [esi + 0x1c]
add edi, eax
movzx eax, word [esi + 0x1e]
add edi, eax
add edi, 0x2e
cmp ebp, edi
jl 0x4045bc
mov edx, 0x40469c
mov eax, esi
mov ecx, 4
call fcn.00403450
test eax, eax
je 0x4045c6
mov eax, 1
jmp 0x404691
mov eax, dword [esi + 0x18]
mov dword [ebx + 0x10], eax
mov eax, dword [esi + 0x14]
mov dword [ebx + 0x14], eax
cmp byte [esi + 5], 0
jne 0x4045e6
xor eax, eax
mov al, byte [esi + 0x26]
mov word [ebx + 0x126], ax
jmp 0x4045ef
mov word [ebx + 0x126], 0
mov eax, dword [esi + 0xc]
mov dword [ebx + 0xc], eax
mov eax, dword [esi + 0x10]
mov dword [ebx + 0x1c], eax
mov ax, word [esi + 8]
mov word [ebx + 0x128], ax
mov eax, dword [esi + 0x2a]
mov dword [ebx + 0x18], eax
mov ax, word [esi + 0xa]
mov word [ebx + 0x124], ax
mov di, word [ebx + 6]
add di, word [esi + 0x1c]
add di, 0x2e
movzx ebp, di
mov eax, dword [ebx]
mov dl, byte [eax + ebp]
mov byte [esp], dl
mov byte [eax + ebp], 0
movzx eax, word [ebx + 6]
mov edx, dword [ebx]
lea edx, [edx + eax + 0x2e]
lea eax, [ebx + 0x20]
mov ecx, 0x103
call fcn.004034c0
mov eax, dword [ebx]
mov dl, byte [esp]
mov byte [eax + ebp], dl
lea eax, [ebx + 0x20]
mov dl, 0x2f
call fcn.00403408
test eax, eax
je 0x404662
mov byte [eax], 0x5c
test eax, eax
jne 0x404651
lea eax, [ebx + 0x20]
push eax
lea eax, [ebx + 0x20]
push eax
call sub.user32.dll_OemToCharA
movzx eax, word [esi + 0x1c]
movzx edx, word [esi + 0x1e]
add eax, edx
add eax, 0x2e
test eax, eax
jg 0x40468b
mov eax, 0xfffffffe
jmp 0x404691
add word [ebx + 6], ax
xor eax, eax
add esp, 0xc
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x404a18
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
mov dword [ebp - 8], ecx
mov dword [ebp - 0xc], edx
mov dword [ebp - 4], eax
push edi
push esi
push ebx
mov edi, dword [ebp - 4]
mov eax, dword [ebp - 8]
mov eax, dword [eax]
lea esi, [0x40948c]
mov ecx, dword [ebp - 0xc]
or ecx, ecx
je 0x404a52
xor ebx, ebx
mov bl, al
shr eax, 8
xor bl, byte [edi]
inc edi
shl ebx, 2
xor eax, dword [esi + ebx]
dec ecx
jne 0x404a3f
mov ebx, dword [ebp - 8]
mov dword [ebx], eax
pop ebx
pop esi
pop edi
mov esp, ebp
pop ebp
ret

Function at 0x404bc0
Capabilities:
Hash data with crc32

Disassembly:
push ebx
xor ebx, ebx
mov ecx, 0x40948c
movzx eax, bx
mov dx, 0xfff8
test al, 1
je 0x404bdc
shr eax, 1
xor eax, 0xedb88320
jmp 0x404bde
shr eax, 1
inc dx
jne 0x404bcf
mov dword [ecx], eax
inc ebx
add ecx, 4
cmp bx, 0x100
jne 0x404bc8
pop ebx
ret

Function at 0x407314
Capabilities:
Get common file path

Disassembly:
push ebx
push esi
push ecx
mov esi, eax
mov byte [esp], 1
mov eax, 0x40740c
call fcn.00407224
test eax, eax
je 0x407343
mov edx, eax
mov eax, esi
call fcn.00403428
mov eax, esi
call fcn.0040724c
test al, al
jne 0x407405
mov eax, 0x407414
call fcn.00407224
test eax, eax
je 0x407369
mov edx, eax
mov eax, esi
call fcn.00403428
mov eax, esi
call fcn.0040724c
test al, al
jne 0x407405
push 0xf0
push esi
call sub.kernel32.dll_GetWindowsDirectoryA
cmp byte [esi], 0
je 0x407397
mov eax, esi
call fcn.00406800
mov edx, 0x407418
mov eax, esi
call fcn.0040348c
mov eax, esi
call fcn.0040724c
test al, al
jne 0x407405
push 0x8001
call sub.kernel32.dll_SetErrorMode
push 0x103
push esi
call sub.kernel32.dll_GetWindowsDirectoryA
cmp byte [esi], 0
je 0x4073bc
mov eax, esi
call fcn.0040724c
test al, al
jne 0x407405
mov bl, 0x43
xor eax, eax
mov al, bl
sub eax, 0x41
call fcn.0040444c
cmp eax, 3
jne 0x4073e8
mov edx, 0x407420
mov eax, esi
call fcn.00403428
mov byte [esi], bl
mov eax, esi
call fcn.0040724c
test al, al
jne 0x407405
inc ebx
cmp bl, 0x5b
jne 0x4073be
push 0x30
push 0x407424
push 0x40742c
push 0
call sub.user32.dll_MessageBoxA_1
mov byte [esp], 0
mov al, byte [esp]
pop edx
pop esi
pop ebx
ret

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x100051d0
Capabilities:
Create thread

Disassembly:
push 0
push 0
push 0
push 0x10005a00
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
ret

Function at 0x10005320
Capabilities:
Write file on windows

Disassembly:
sub esp, 0x28
mov eax, dword [0x10041bd0]
xor eax, esp
mov dword [esp + 0x24], eax
push esi
mov esi, ecx
cmp dword [esi + 0x38], 0
je 0x100053e2
cmp byte [esi + 0x3d], 0
je 0x100053e2
mov eax, dword [esi]
push edi
push 0xffffffffffffffff
call dword [eax + 0xc]
cmp eax, 0xffffffff
je 0x100053cf
mov ecx, dword [esi + 0x38]
lea eax, [esp + 8]
push eax
lea eax, [esp + 0x30]
push eax
lea eax, [esp + 0x14]
push eax
lea eax, [esi + 0x40]
push eax
call dword [sym.imp.MSVCP140D.dll_public:_int___thiscall_std::codecvt_char__char__struct__Mbstatet_::unshift_struct__Mbstatet___char___char___char___const]
sub eax, 0
je 0x10005393
sub eax, 1
je 0x10005397
sub eax, 2
jne 0x100053cf
mov byte [esi + 0x3d], al
mov al, 1
pop edi
pop esi
mov ecx, dword [esp + 0x24]
xor ecx, esp
call fcn.100282d0
add esp, 0x28
ret
mov byte [esi + 0x3d], 0
mov edi, dword [esp + 8]
lea eax, [esp + 0xc]
sub edi, eax
je 0x100053b7
push dword [esi + 0x4c]
push edi
push 1
push eax
call dword [sym.imp.ucrtbased.dll_fwrite]
add esp, 0x10
cmp edi, eax
jne 0x100053cf
cmp byte [esi + 0x3d], 0
pop edi
sete al
pop esi
mov ecx, dword [esp + 0x24]
xor ecx, esp
call fcn.100282d0
add esp, 0x28
ret
pop edi
xor al, al
pop esi
mov ecx, dword [esp + 0x24]
xor ecx, esp
call fcn.100282d0
add esp, 0x28
ret
mov ecx, dword [esp + 0x28]
mov al, 1
pop esi
xor ecx, esp
call fcn.100282d0
add esp, 0x28
ret
Function at 0x10005a90
Capabilities:
Write file on windows

Disassembly:
sub esp, 0x30
mov eax, dword [0x10041bd0]
xor eax, esp
mov dword [esp + 0x2c], eax
push ebx
mov ebx, dword [esp + 0x38]
push esi
mov esi, ecx
cmp ebx, 0xffffffff
jne 0x10005ac0
pop esi
xor eax, eax
pop ebx
mov ecx, dword [esp + 0x2c]
xor ecx, esp
call fcn.100282d0
add esp, 0x30
ret 4
mov eax, dword [esi + 0x20]
mov eax, dword [eax]
test eax, eax
je 0x10005af1
mov edx, dword [esi + 0x30]
mov edx, dword [edx]
add edx, eax
cmp eax, edx
jae 0x10005af1
call dword [sym.imp.MSVCP140D.dll_protected:_char____thiscall_std::basic_streambuf_char__struct_std::char_traits_char__::_Pninc_void_]
pop esi
mov byte [eax], bl
mov eax, ebx
pop ebx
mov ecx, dword [esp + 0x2c]
xor ecx, esp
call fcn.100282d0
add esp, 0x30
ret 4
cmp dword [esi + 0x4c], 0
push edi
je 0x10005bfb
mov edi, dword [esi + 0xc]
lea eax, [esi + 0x3c]
cmp dword [edi], eax
jne 0x10005b1a
mov edx, dword [esi + 0x54]
mov ecx, dword [esi + 0x50]
sub edx, ecx
mov dword [edi], ecx
mov eax, dword [esi + 0x1c]
mov dword [eax], ecx
mov eax, dword [esi + 0x2c]
mov dword [eax], edx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x10005b4f
push dword [esi + 0x4c]
movsx eax, bl
push eax
call dword [sym.imp.ucrtbased.dll_fputc]
add esp, 8
or ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, ebx
pop edi
pop esi
mov eax, ecx
pop ebx
mov ecx, dword [esp + 0x2c]
xor ecx, esp
call fcn.100282d0
add esp, 0x30
ret 4
lea eax, [esp + 0x10]
mov byte [esp + 0xc], bl
push eax
lea eax, [esp + 0x3c]
push eax
lea eax, [esp + 0x20]
push eax
lea eax, [esp + 0x20]
push eax
lea eax, [esp + 0x1d]
push eax
lea eax, [esp + 0x20]
push eax
lea eax, [esi + 0x40]
push eax
call dword [sym.imp.MSVCP140D.dll_public:_int___thiscall_std::codecvt_char__char__struct__Mbstatet_::out_struct__Mbstatet___char_const___char_const___char_const____char___char___char___const]
sub eax, 0
je 0x10005bb7
sub eax, 1
je 0x10005bb7
sub eax, 2
jne 0x10005bfb
push dword [esi + 0x4c]
push dword [esp + 0x10]
call fcn.10004910
add esp, 8
or ecx, 0xffffffff
test al, al
cmovne ecx, ebx
pop edi
pop esi
mov eax, ecx
pop ebx
mov ecx, dword [esp + 0x2c]
xor ecx, esp
call fcn.100282d0
add esp, 0x30
ret 4
mov edi, dword [esp + 0x10]
lea eax, [esp + 0x18]
sub edi, eax
je 0x10005bd7
push dword [esi + 0x4c]
push edi
push 1
push eax
call dword [sym.imp.ucrtbased.dll_fwrite]
add esp, 0x10
cmp edi, eax
jne 0x10005bfb
lea eax, [esp + 0xc]
mov byte [esi + 0x3d], 1
cmp dword [esp + 0x14], eax
je 0x10005bfb
pop edi
pop esi
mov eax, ebx
pop ebx
mov ecx, dword [esp + 0x2c]
xor ecx, esp
call fcn.100282d0
add esp, 0x30
ret 4
mov ecx, dword [esp + 0x38]
or eax, 0xffffffff
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.100282d0
add esp, 0x30
ret 4
Function at 0x10006350
Capabilities:
Read file on windows

Disassembly:
mov eax, dword [esp + 0xc]
push ebx
mov ebx, ecx
push ebp
mov ebp, dword [esp + 0x10]
test eax, eax
jg 0x1000636f
jl 0x10006366
test ebp, ebp
jne 0x1000636f
pop ebp
xor eax, eax
xor edx, edx
pop ebx
ret 0xc
cmp dword [ebx + 0x38], 0
je 0x10006386
push eax
push ebp
push dword [esp + 0x14]
call dword [sym.imp.MSVCP140D.dll_protected_virtual:_long_long___int64____thiscall_std::basic_streambuf_char__struct_std::char_traits_char__::xsgetn_char___long_long___int64__]
pop ebp
pop ebx
ret 0xc
mov eax, dword [ebx + 0x1c]
push esi
push edi
mov edi, ebp
mov ecx, dword [eax]
test ecx, ecx
je 0x100063c6
mov eax, dword [ebx + 0x2c]
mov eax, dword [eax]
test eax, eax
je 0x100063c6
mov edi, dword [esp + 0x14]
cmp eax, ebp
mov esi, ebp
cmovb esi, eax
push esi
push ecx
push edi
call sub.VCRUNTIME140D.dll_memcpy
mov eax, dword [ebx + 0x2c]
add edi, esi
mov dword [esp + 0x20], edi
add esp, 0xc
mov edi, ebp
sub edi, esi
sub dword [eax], esi
mov eax, dword [ebx + 0x1c]
add dword [eax], esi
cmp dword [ebx + 0x4c], 0
mov ecx, edi
mov esi, dword [esp + 0x14]
je 0x1000643c
mov ecx, dword [ebx + 0xc]
lea eax, [ebx + 0x3c]
cmp dword [ecx], eax
jne 0x100063f3
mov eax, dword [ebx + 0xc]
mov edx, dword [ebx + 0x54]
mov ecx, dword [ebx + 0x50]
sub edx, ecx
mov dword [eax], ecx
mov eax, dword [ebx + 0x1c]
mov dword [eax], ecx
mov eax, dword [ebx + 0x2c]
mov dword [eax], edx
mov eax, dword [sym.imp.ucrtbased.dll_fread]
mov ecx, edi
cmp edi, 0xfff
jbe 0x10006428
push dword [ebx + 0x4c]
push 0xfff
push 1
push esi
call eax
sub edi, eax
add esp, 0x10
add esi, eax
mov ecx, edi
cmp eax, 0xfff
jne 0x1000644e
cmp edi, eax
mov eax, dword [sym.imp.ucrtbased.dll_fread]
ja 0x10006402
test ecx, ecx
je 0x1000643c
push dword [ebx + 0x4c]
push edi
push 1
push esi
call eax
mov ecx, edi
add esp, 0x10
sub ecx, eax
mov edx, dword [esp + 0x1c]
sub ebp, ecx
pop edi
pop esi
mov eax, ebp
sbb edx, 0
pop ebp
pop ebx
ret 0xc
mov edx, dword [esp + 0x1c]
sub ebp, edi
pop edi
pop esi
mov eax, ebp
sbb edx, 0
pop ebp
pop ebx
ret 0xc