joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1000a0e0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
lea eax, [ebp - 0x1c]
mov dword [ebp - 0xc], 0x65536c61
push eax
mov dword [ebp - 6], 0x6e6f69
mov dword [ebp - 0x16], 0x657a696c
mov dword [ebp - 0x1a], 0x61697469
mov word [ebp - 8], 0x7463
mov word [ebp - 0x11], 0x6972
mov word [ebp - 0x1c], 0x6e49
mov word [ebp - 0xe], 0x6369
mov byte [ebp - 0x12], 0x43
mov byte [ebp - 0xf], 0x74
call fcn.10009c20
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x1000a13d
push 0x1006e688
call eax
mov esp, ebp
pop ebp
ret

Function at 0x1000a150
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push esi
lea eax, [ebp - 0x10]
mov word [ebp - 5], 0x64
push eax
mov esi, ecx
mov dword [ebp - 0xe], 0x656d7573
mov dword [ebp - 0xa], 0x65726854
mov word [ebp - 0x10], 0x6552
mov byte [ebp - 6], 0x61
call fcn.10009c20
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x1000a193
push esi
call eax
pop esi
mov esp, ebp
pop ebp
ret
or eax, 0xffffffff
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x1000a1a0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push esi
push edi
lea eax, [ebp - 0x18]
mov dword [ebp - 6], 0x7972746e
push eax
mov esi, edx
mov word [ebp - 0x15], 0x6854
mov edi, ecx
mov word [ebp - 0xa], 0x6f74
mov word [ebp - 0xd], 0x656c
mov word [ebp - 0x18], 0x6547
mov dword [ebp - 0x12], 0x53646165
mov byte [ebp - 2], 0
mov word [ebp - 8], 0x4572
mov byte [ebp - 0x16], 0x74
mov byte [ebp - 0x13], 0x72
mov byte [ebp - 0xb], 0x63
mov byte [ebp - 0xe], 0x65
call fcn.10009c20
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x1000a20d
push dword [ebp + 8]
push esi
push edi
call eax
pop edi
pop esi
mov esp, ebp
pop ebp
ret
pop edi
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x1000a220
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push esi
push edi
lea eax, [ebp - 0x14]
mov dword [ebp - 0x12], 0x61757472
push eax
mov esi, edx
mov dword [ebp - 7], 0x784574
mov edi, ecx
mov dword [ebp - 0xd], 0x746f7250
mov word [ebp - 0x14], 0x6956
mov word [ebp - 9], 0x6365
mov byte [ebp - 0xe], 0x6c
call fcn.10009c20
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x1000a278
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push esi
push edi
call eax
pop edi
pop esi
mov esp, ebp
pop ebp
ret
pop edi
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x1000a810
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
call fcn.10009ca0
test eax, eax
je 0x1000a85f
lea ecx, [ebp - 0x14]
mov dword [ebp - 0x11], 0x65726f46
push ecx
push eax
mov dword [ebp - 5], 0x776f646e
mov dword [ebp - 0xa], 0x57646e75
mov word [ebp - 0x14], 0x6553
mov word [ebp - 0xd], 0x7267
mov byte [ebp - 0x12], 0x74
mov byte [ebp - 1], 0
mov byte [ebp - 6], 0x69
mov byte [ebp - 0xb], 0x6f
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esp, ebp
pop ebp
ret
xor eax, eax
mov esp, ebp
pop ebp
ret

Function at 0x1000a8c0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
call fcn.10009ca0
test eax, eax
je 0x1000a901
lea ecx, [ebp - 0x10]
mov dword [ebp - 5], 0x776f646e
push ecx
push eax
mov dword [ebp - 0xb], 0x65766974
mov dword [ebp - 0x10], 0x41746553
mov word [ebp - 7], 0x6957
mov byte [ebp - 1], 0
mov byte [ebp - 0xc], 0x63
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esp, ebp
pop ebp
ret
xor eax, eax
mov esp, ebp
pop ebp
ret

Function at 0x1000b1f0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x134
push esi
push 0x104
lea eax, [ebp - 0x130]
mov esi, ecx
push 0
push eax
mov dword [ebp - 0x10], esi
call fcn.1000e680
add esp, 0xc
mov dword [ebp - 5], 0x73255c45
lea ecx, [ebp - 0x28]
mov dword [ebp - 0xa], 0x41575446
mov word [ebp - 0xc], 0x4f53
mov byte [ebp - 1], 0
mov byte [ebp - 6], 0x52
call fcn.1000bc20
cmp dword [eax + 0x14], 0x10
jb 0x1000b241
mov eax, dword [eax]
push eax
lea eax, [ebp - 0xc]
push eax
push 0xffffffffffffffff
lea eax, [ebp - 0x130]
push 0x104
push eax
call fcn.1000bb20
mov edx, dword [ebp - 0x14]
add esp, 0x14
cmp edx, 0x10
jb 0x1000b28c
mov ecx, dword [ebp - 0x28]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x1000b282
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x1000b2a1
push edx
push ecx
call fcn.1000c4d9
add esp, 8
lea eax, [ebp - 0x130]
mov ecx, esi
push eax
call fcn.1000bcc0
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret
call fcn.1001f7c7
int3

Function at 0x1000b610
Capabilities:
Contain obfuscated stackstrings

Disassembly:
cmp dword [0x1006e57c], 0
jne 0x1000b637
call fcn.1000a0e0
mov edx, 0x100
mov ecx, 0x1006e580
call fcn.1000a700
mov dword [0x1006e57c], 1
jmp fcn.1000a760

Function at 0x1002b363
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.1002ac0f

Function at 0x1002b36e
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.1002ae4a

Function at 0x10035cce
Capabilities:
Create thread
Print debug messages

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.10035b0c
Function at 0x1003bef0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
call fcn.10009ca0
test eax, eax
je 0x1003bf2e
lea ecx, [ebp - 0x10]
mov dword [ebp - 0xf], 0x69577465
push ecx
push eax
mov dword [ebp - 8], 0x736f5077
mov word [ebp - 0xb], 0x646e
mov byte [ebp - 0x10], 0x53
mov byte [ebp - 4], 0
mov byte [ebp - 9], 0x6f
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esp, ebp
pop ebp
ret
xor eax, eax
mov esp, ebp
pop ebp
ret

Function at 0x1003bf90
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
call fcn.10009ca0
test eax, eax
je 0x1003bfd3
lea ecx, [ebp - 0x14]
mov word [ebp - 0xf], 0x6957
push ecx
push eax
mov dword [ebp - 0x14], 0x6e697242
mov dword [ebp - 0xd], 0x776f646e
mov dword [ebp - 7], 0x706f54
mov byte [ebp - 0x10], 0x67
mov word [ebp - 9], 0x6f54
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esp, ebp
pop ebp
ret
xor eax, eax
mov esp, ebp
pop ebp
ret

Function at 0x1003c200
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
mov eax, dword [ebp + 0xc]
sub esp, 0x118
cmp eax, 1
jne 0x1003c2b0
push ecx
lea edx, [esp + 0x14]
call fcn.10009fa0
add esp, 4
mov dword [esp + 6], 0x75732074
lea edx, [esp]
mov dword [esp + 0xc], 0x74726f
lea ecx, [esp + 0x10]
mov dword [esp + 1], 0x6174736e
mov word [esp + 0xa], 0x7070
mov byte [esp], 0x69
mov byte [esp + 5], 0x6e
call fcn.1000a510
test eax, eax
jne 0x1003c2dc
mov edx, sym.drvhlp.dll_ei80cq
mov ecx, 0x1006e578
call fcn.1000b780
test eax, eax
je 0x1003c2dc
mov edx, sym.drvhlp.dll_i5tdzk
mov ecx, 0x1006e52c
call fcn.1000b780
test eax, eax
je 0x1003c2dc
mov edx, sym.drvhlp.dll_h5b4ds
mov ecx, 0x1006e56c
call fcn.1000b780
test eax, eax
je 0x1003c2dc
mov edx, sym.drvhlp.dll_zkfl21
mov ecx, 0x1006e564
call fcn.1000b780
mov eax, 1
mov esp, ebp
pop ebp
ret 0xc
test eax, eax
jne 0x1003c2dc
mov ecx, 0x1006e578
call fcn.1000b950
mov ecx, 0x1006e52c
call fcn.1000b950
mov ecx, 0x1006e56c
call fcn.1000b950
mov ecx, 0x1006e564
call fcn.1000b950
mov eax, 1
mov esp, ebp
pop ebp
ret 0xc
Function at 0x406720
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
push 0xffffffffffffffff
push 0x41d8cb
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push esi
mov esi, dword [esp + 0x18]
push edi
lea ecx, [esi + 4]
mov dword [esi], 0x4044a4
call fcn.00409294
push 4
mov dword [esp + 0x18], 0
call fcn.0040a776
mov edi, eax
add esp, 4
test edi, edi
je 0x406794
push ebx
call fcn.0040908f
mov dword [edi], eax
call fcn.00408e4e
push 0
lea ecx, [esp + 0x10]
mov ebx, eax
call fcn.00409255
mov eax, dword [ebx + 4]
cmp eax, 0xffffffff
jae 0x406788
inc eax
mov dword [ebx + 4], eax
lea ecx, [esp + 0xc]
call fcn.0040927d
pop ebx
jmp 0x406796
xor edi, edi
mov dword [esi + 0x38], edi
lea eax, [esi + 8]
mov dword [esi + 0x10], eax
lea ecx, [esi + 0x18]
mov dword [esi + 0x20], ecx
lea edx, [esi + 0x1c]
mov dword [esi + 0x24], edx
lea eax, [esi + 0xc]
mov dword [esi + 0x14], eax
lea ecx, [esi + 0x28]
mov dword [esi + 0x30], ecx
lea edx, [esi + 0x2c]
mov dword [esi + 0x34], edx
mov dword [eax], 0
mov eax, dword [esi + 0x24]
mov dword [eax], 0
mov ecx, dword [esi + 0x34]
mov dword [ecx], 0
mov edx, dword [esi + 0x10]
mov dword [edx], 0
mov eax, dword [esi + 0x20]
mov dword [eax], 0
mov ecx, dword [esi + 0x30]
mov dword [ecx], 0
mov ecx, dword [esp + 0xc]
pop edi
mov eax, esi
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret 4

Function at 0x40b26e
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x4213dc]
jne 0x40b278
repz ret
jmp fcn.0041119c
Function at 0x4167a3
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x4213dc]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.0040df4e
and dword [ebp - 0x14], 0
cmp dword [0x81e6f4], 0
mov dword [ebp - 0x18], eax
jne 0x416856
push 0x403fe0
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x4168fe
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x403fd4
push ebx
call edi
test eax, eax
je 0x4168fe
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push 0x403fc4
push ebx
mov dword [0x81e6f4], eax
call edi
push eax
call esi
push 0x403fb0
push ebx
mov dword [0x81e6f8], eax
call edi
push eax
call esi
push 0x403f94
push ebx
mov dword [0x81e6fc], eax
call edi
push eax
call esi
mov dword [0x81e704], eax
test eax, eax
je 0x416856
push 0x403f7c
push ebx
call edi
push eax
call esi
mov dword [0x81e700], eax
mov eax, dword [0x81e700]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x4168af
cmp dword [0x81e704], ecx
je 0x4168af
push eax
call esi
push dword [0x81e704]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x4168af
test ebx, ebx
je 0x4168af
call edi
test eax, eax
je 0x4168a6
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x4168a6
test byte [ebp - 8], 1
jne 0x4168af
or dword [ebp + 0x10], 0x200000
jmp 0x4168e2
mov eax, dword [0x81e6f8]
cmp eax, dword [ebp - 0x18]
je 0x4168e2
push eax
call esi
test eax, eax
je 0x4168e2
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x4168e2
mov eax, dword [0x81e6fc]
cmp eax, dword [ebp - 0x18]
je 0x4168e2
push eax
call esi
test eax, eax
je 0x4168e2
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x81e6f4]
call esi
test eax, eax
je 0x4168fe
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x416900
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0040b26e
leave
ret
Function at 0x431000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..text
mov ebx, 0x40915c
nop
nop
mov ecx, 0x7c826e7c
test eax, eax
nop
nop
nop
nop
je 0x43104e
nop
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
inc eax
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
jne 0x431024
nop
nop
nop
nop
mov eax, section..data
nop
mov ebx, 0x42f3f8
nop
mov ecx, 0x1bc0074e
nop
nop
nop
nop
test eax, eax
nop
je 0x431084
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
add eax, 4
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
jne 0x43106c
nop
nop
nop
nop
nop
nop
popal
nop
nop
jmp 0x401219
Function at 0x40e26c
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x4241e8]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.004051e5
and dword [ebp - 0x14], 0
cmp dword [0xe5ac1c], 0
mov dword [ebp - 0x18], eax
jne 0x40e31f
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x40e3c7
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxW
push ebx
call edi
test eax, eax
je 0x40e3c7
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push str.GetActiveWindow
push ebx
mov dword [0xe5ac1c], eax
call edi
push eax
call esi
push str.GetLastActivePopup
push ebx
mov dword [0xe5ac20], eax
call edi
push eax
call esi
push str.GetUserObjectInformationW
push ebx
mov dword [0xe5ac24], eax
call edi
push eax
call esi
mov dword [0xe5ac2c], eax
test eax, eax
je 0x40e31f
push str.GetProcessWindowStation
push ebx
call edi
push eax
call esi
mov dword [0xe5ac28], eax
mov eax, dword [0xe5ac28]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x40e378
cmp dword [0xe5ac2c], ecx
je 0x40e378
push eax
call esi
push dword [0xe5ac2c]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x40e378
test ebx, ebx
je 0x40e378
call edi
test eax, eax
je 0x40e36f
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x40e36f
test byte [ebp - 8], 1
jne 0x40e378
or dword [ebp + 0x10], 0x200000
jmp 0x40e3ab
mov eax, dword [0xe5ac20]
cmp eax, dword [ebp - 0x18]
je 0x40e3ab
push eax
call esi
test eax, eax
je 0x40e3ab
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x40e3ab
mov eax, dword [0xe5ac24]
cmp eax, dword [ebp - 0x18]
je 0x40e3ab
push eax
call esi
test eax, eax
je 0x40e3ab
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0xe5ac1c]
call esi
test eax, eax
je 0x40e3c7
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x40e3c9
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004051d6
leave
ret

Function at 0x433000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43300c
nop
nop
nop
nop
pop eax
nop
nop
add eax, 0x40a063
nop
sub eax, 0x40a009
mov ebx, dword [eax]
nop
nop
nop
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
mov edx, dword [eax + 8]
nop
nop
xor dword [ebx], edx
nop
nop
nop
nop
nop
nop
nop
add ebx, 4
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
nop
jl 0x433030
add eax, 0xc
nop
nop
nop
nop
cmp dword [eax], 0
nop
nop
jne 0x43301e
nop
nop
nop
nop
popal
nop
nop
nop
nop
nop
jmp 0x431219
Function at 0x407010
Capabilities:
Enumerate pe sections

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
xor edx, edx
push ebx
push esi
push edi
mov ecx, dword [eax + 0x3c]
add ecx, eax
movzx eax, word [ecx + 0x14]
movzx ebx, word [ecx + 6]
add eax, 0x18
add eax, ecx
test ebx, ebx
je 0x40704e
mov edi, dword [ebp + 0xc]
mov esi, dword [eax + 0xc]
cmp edi, esi
jb 0x407046
mov ecx, dword [eax + 8]
add ecx, esi
cmp edi, ecx
jb 0x407050
inc edx
add eax, 0x28
cmp edx, ebx
jb 0x407036
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x407120
Capabilities:
Parse pe header

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov ecx, dword [ebp + 8]
mov eax, 0x5a4d
cmp word [ecx], ax
jne 0x407151
mov eax, dword [ecx + 0x3c]
add eax, ecx
cmp dword [eax], 0x4550
jne 0x407151
mov ecx, 0x10b
cmp word [eax + 0x18], cx
jne 0x407151
mov eax, 1
pop ebp
ret
xor eax, eax
pop ebp
ret

Function at 0x433000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43300c
pop eax
nop
nop
nop
nop
nop
nop
add eax, 0x40a063
nop
sub eax, 0x40a009
nop
nop
mov ebx, dword [eax]
nop
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
xor dword [ebx], edx
nop
nop
nop
add ebx, 4
nop
nop
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
nop
jl 0x433030
nop
nop
nop
add eax, 0xc
nop
nop
cmp dword [eax], 0
nop
nop
nop
nop
nop
jne 0x43301e
nop
nop
nop
popal
nop
nop
jmp 0x431219
Function at 0x402830
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x1c
push ebx
mov ebx, ecx
push esi
push edi
cmp dword [ebx + 0x38], 0
je 0x40285c
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____thiscall_std::basic_streambuf_char__struct_std::char_traits_char__::xsputn_char_const___long_long___int64__]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov eax, dword [ebx + 0x20]
mov esi, dword [ebp + 0xc]
mov edi, dword [ebp + 0x10]
mov dword [esp + 0x20], esi
mov ecx, dword [eax]
lea eax, [ebx + 0x30]
mov dword [esp + 0x24], edi
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x18], eax
test ecx, ecx
je 0x402884
mov eax, dword [eax]
mov ecx, dword [eax]
jmp 0x40288a
xor ecx, ecx
mov dword [esp + 0x18], eax
mov eax, ecx
cdq
mov dword [esp + 0x10], eax
mov ecx, edx
mov dword [esp + 0x14], ecx
test edi, edi
jl 0x4028f2
jg 0x4028a1
test esi, esi
je 0x4028f2
test ecx, ecx
jl 0x4028ed
jg 0x4028ab
test eax, eax
je 0x4028ed
cmp edi, ecx
jg 0x4028bf
jl 0x4028b5
cmp esi, eax
jae 0x4028bf
mov eax, esi
mov dword [esp + 0x10], esi
mov dword [esp + 0x14], edi
push eax
push dword [ebp + 8]
push dword [esp + 0x24]
call sub.VCRUNTIME140.dll_memcpy
mov eax, dword [esp + 0x24]
add esp, 0xc
mov edx, dword [esp + 0x10]
mov ecx, dword [ebp + 8]
add ecx, edx
sub esi, edx
mov eax, dword [eax]
sbb edi, dword [esp + 0x14]
sub dword [eax], edx
mov eax, dword [ebx + 0x20]
add dword [eax], edx
jmp 0x4028f5
mov ecx, dword [ebp + 8]
jmp 0x4028ff
mov ecx, dword [ebp + 8]
test edi, edi
jl 0x402919
jg 0x4028ff
test esi, esi
je 0x402919
mov eax, dword [ebx + 0x4c]
test eax, eax
je 0x402919
push eax
push esi
push 1
push ecx
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
add esp, 0x10
sub esi, eax
sbb edi, 0
mov eax, dword [esp + 0x20]
mov edx, dword [esp + 0x24]
sub eax, esi
sbb edx, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x402930
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [ebp + 0x10]
push ebx
mov ebx, ecx
mov ecx, dword [ebp + 0xc]
push esi
mov esi, dword [ebp + 8]
mov dword [ebp - 4], esi
test eax, eax
jg 0x40295c
jl 0x402950
test ecx, ecx
jne 0x40295c
pop esi
xor eax, eax
xor edx, edx
pop ebx
mov esp, ebp
pop ebp
ret 0xc
cmp dword [ebx + 0x38], 0
je 0x402975
push eax
push ecx
push esi
mov ecx, ebx
call dword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____thiscall_std::basic_streambuf_char__struct_std::char_traits_char__::xsgetn_char___long_long___int64__]
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov eax, dword [ebx + 0x1c]
push edi
mov edi, ecx
mov eax, dword [eax]
mov dword [ebp - 8], eax
test eax, eax
je 0x4029c3
mov eax, dword [ebx + 0x2c]
lea edx, [ebx + 0x2c]
mov dword [ebp - 0xc], edx
mov eax, dword [eax]
test eax, eax
je 0x4029c9
mov edi, dword [ebp - 4]
cmp eax, ecx
mov esi, ecx
cmovb esi, eax
push esi
push dword [ebp - 8]
push edi
call sub.VCRUNTIME140.dll_memcpy
mov eax, dword [ebx + 0x2c]
add edi, esi
mov dword [ebp - 4], edi
add esp, 0xc
mov edi, dword [ebp + 0xc]
sub edi, esi
sub dword [eax], esi
mov eax, dword [ebx + 0x1c]
add dword [eax], esi
mov esi, dword [ebp - 4]
jmp 0x4029c9
lea eax, [ebx + 0x2c]
mov dword [ebp - 0xc], eax
cmp dword [ebx + 0x4c], 0
je 0x402a36
mov ecx, dword [ebx + 0xc]
lea eax, [ebx + 0x3c]
cmp dword [ecx], eax
jne 0x4029f2
mov eax, dword [ebx + 0xc]
mov edx, dword [ebx + 0x54]
mov ecx, dword [ebx + 0x50]
sub edx, ecx
mov dword [eax], ecx
mov eax, dword [ebx + 0x1c]
mov dword [eax], ecx
mov eax, dword [ebp - 0xc]
mov eax, dword [eax]
mov dword [eax], edx
mov eax, dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
cmp edi, 0xfff
jbe 0x402a24
nop
push dword [ebx + 0x4c]
push 0xfff
push 1
push esi
call eax
add esp, 0x10
add esi, eax
sub edi, eax
cmp eax, 0xfff
jne 0x402a36
cmp edi, eax
mov eax, dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
ja 0x402a00
test edi, edi
je 0x402a36
push dword [ebx + 0x4c]
push edi
push 1
push esi
call eax
add esp, 0x10
sub edi, eax
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 0x10]
sub eax, edi
pop edi
pop esi
sbb edx, 0
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x402db0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
mov eax, dword [0x409008]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, ecx
cmp ebx, 0xffffffff
jne 0x402de0
pop esi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00404126
mov esp, ebp
pop ebp
ret 4
mov eax, dword [esi + 0x20]
push edi
mov ecx, dword [eax]
test ecx, ecx
je 0x402e1c
mov edx, dword [esi + 0x30]
mov edi, dword [edx]
lea eax, [edi + ecx]
cmp ecx, eax
jae 0x402e1c
lea ecx, [edi - 1]
mov eax, ebx
mov dword [edx], ecx
mov edx, dword [esi + 0x20]
pop edi
mov esi, dword [edx]
lea ecx, [esi + 1]
mov dword [edx], ecx
mov byte [esi], bl
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00404126
mov esp, ebp
pop ebp
ret 4
cmp dword [esi + 0x4c], 0
je 0x402ef3
mov edi, dword [esi + 0xc]
lea eax, [esi + 0x3c]
cmp dword [edi], eax
jne 0x402e44
mov edx, dword [esi + 0x54]
mov ecx, dword [esi + 0x50]
sub edx, ecx
mov dword [edi], ecx
mov eax, dword [esi + 0x1c]
mov dword [eax], ecx
mov eax, dword [esi + 0x2c]
mov dword [eax], edx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x402e50
movsx eax, bl
jmp 0x402e88
lea eax, [ebp - 0x2c]
mov byte [ebp - 0x25], bl
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x25]
push eax
lea eax, [esi + 0x40]
push eax
call dword [sym.imp.MSVCP140.dll_public:_int___thiscall_std::codecvt_char__char__struct__Mbstatet_::out_struct__Mbstatet___char_const___char_const___char_const____char___char___char___const]
sub eax, 0
je 0x402eb2
sub eax, 1
je 0x402eb2
sub eax, 2
jne 0x402ef3
movsx eax, byte [ebp - 0x25]
push dword [esi + 0x4c]
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
add esp, 8
or ecx, 0xffffffff
cmp eax, ecx
cmove ebx, ecx
pop edi
pop esi
mov eax, ebx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00404126
mov esp, ebp
pop ebp
ret 4
mov edi, dword [ebp - 0x2c]
lea eax, [ebp - 0x24]
sub edi, eax
je 0x402ed0
push dword [esi + 0x4c]
push edi
push 1
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
add esp, 0x10
cmp edi, eax
jne 0x402ef3
lea ecx, [ebp - 0x25]
mov byte [esi + 0x3d], 1
or eax, 0xffffffff
cmp dword [ebp - 0x30], ecx
pop edi
pop esi
cmovne eax, ebx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00404126
mov esp, ebp
pop ebp
ret 4
mov ecx, dword [ebp - 4]
or eax, 0xffffffff
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00404126
mov esp, ebp
pop ebp
ret 4