joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10052ad0
Capabilities:
Resume thread

Disassembly:
push ebx
mov ebx, ecx
mov eax, dword [ebx]
test eax, eax
je 0x10052b1e
push esi
xor esi, esi
cmp dword [ebx + 8], esi
jbe 0x10052b0e
push edi
mov eax, dword [ebx]
push dword [eax + esi*4]
push 0
push 0x5a
call dword [sym.imp.KERNEL32.dll_OpenThread]
mov edi, eax
test edi, edi
je 0x10052b05
push edi
call dword [sym.imp.KERNEL32.dll_ResumeThread]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
inc esi
cmp esi, dword [ebx + 8]
jb 0x10052ae2
mov eax, dword [ebx]
pop edi
push eax
push 0
push dword [0x100a79bc]
call dword [sym.imp.KERNEL32.dll_HeapFree]
pop esi
pop ebx
ret

Function at 0x10052b20
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [0x100a7010]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
imul esi, ecx, 0x2c
mov ebx, edx
push edi
add esi, dword [0x100a7d80]
mov eax, dword [esi]
mov cl, byte [esi + 0x14]
and cl, 1
lea edi, [eax - 5]
cmove edi, eax
movzx eax, cl
lea ecx, [ebp - 8]
push ecx
push 0x40
lea eax, [eax*2 + 5]
push eax
push edi
mov dword [ebp - 0xc], eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x10052b81
pop edi
pop esi
mov eax, 0xa
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10068185
mov esp, ebp
pop ebp
ret
test ebx, ebx
je 0x10052ba2
mov byte [edi], 0xe9
mov eax, dword [esi + 4]
sub eax, edi
sub eax, 5
mov dword [edi + 1], eax
test byte [esi + 0x14], 1
je 0x10052bc3
mov eax, dword [esi]
mov word [eax], 0xf9eb
jmp 0x10052bc3
mov eax, dword [esi + 0xc]
test byte [esi + 0x14], 1
mov dword [edi], eax
je 0x10052bbd
mov ax, word [esi + 0x10]
mov word [edi + 4], ax
mov al, byte [esi + 0x12]
mov byte [edi + 6], al
jmp 0x10052bc3
mov al, byte [esi + 0x10]
mov byte [edi + 4], al
lea eax, [ebp - 8]
push eax
push dword [ebp - 8]
push dword [ebp - 0xc]
push edi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
push dword [ebp - 0xc]
push edi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_FlushInstructionCache]
mov al, byte [esi + 0x14]
and bl, 1
mov cl, bl
and al, 0xfd
add cl, cl
shl bl, 2
or cl, al
xor eax, eax
and cl, 0xfb
or cl, bl
mov byte [esi + 0x14], cl
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10068185
mov esp, ebp
pop ebp
ret
Function at 0x10052c20
Capabilities:
Resume thread

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [0x100a7d88]
sub esp, 0x10
push ebx
push esi
xor esi, esi
mov ebx, ecx
test edx, edx
je 0x10052c54
mov eax, dword [0x100a7d80]
add eax, 0x14
nop
movzx ecx, byte [eax]
shr ecx, 1
and ecx, 1
cmp ecx, ebx
jne 0x10052c5c
inc esi
add eax, 0x2c
cmp esi, edx
jb 0x10052c40
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
xor eax, eax
cmp esi, 0xffffffff
je 0x10052d12
test ebx, ebx
lea ecx, [ebp - 0x10]
setne al
or edx, 0xffffffff
push eax
call fcn.10052920
add esp, 4
mov dword [ebp - 4], eax
test eax, eax
jne 0x10052d12
mov ecx, dword [0x100a7d88]
push edi
cmp esi, ecx
jae 0x10052cca
imul edi, esi, 0x2c
mov eax, dword [0x100a7d80]
movzx eax, byte [edi + eax + 0x14]
shr eax, 1
and eax, 1
cmp eax, ebx
je 0x10052cbf
mov edx, ebx
mov ecx, esi
call fcn.10052b20
mov dword [ebp - 4], eax
test eax, eax
jne 0x10052cca
mov ecx, dword [0x100a7d88]
jmp 0x10052cc2
mov eax, dword [ebp - 4]
inc esi
add edi, 0x2c
cmp esi, ecx
jb 0x10052c94
mov ebx, dword [ebp - 0x10]
test ebx, ebx
je 0x10052d11
xor esi, esi
cmp dword [ebp - 8], esi
jbe 0x10052cff
push dword [ebx + esi*4]
push 0
push 0x5a
call dword [sym.imp.KERNEL32.dll_OpenThread]
mov edi, eax
test edi, edi
je 0x10052cf9
push edi
call dword [sym.imp.KERNEL32.dll_ResumeThread]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
inc esi
cmp esi, dword [ebp - 8]
jb 0x10052cd8
push ebx
push 0
push dword [0x100a79bc]
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x100544c0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x108
mov eax, dword [0x100a7010]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [ebp + 0xc], 1
push esi
mov esi, dword [ebp + 8]
jne 0x1005459d
push 0x104
lea eax, [ebp - 0x108]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea edx, [ebp - 0x108]
lea ecx, [edx + 1]
nop
mov al, byte [edx]
inc edx
test al, al
jne 0x10054500
sub edx, ecx
mov ecx, str.LFS.exe
lea eax, [ebp + edx - 0x10f]
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x10054535
test dl, dl
je 0x10054531
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x10054535
add eax, 2
add ecx, 2
test dl, dl
jne 0x10054515
xor eax, eax
jmp 0x1005453a
sbb eax, eax
or eax, 1
push 0
push str.RevLimiter
test eax, eax
je 0x10054565
push str.RevLimiter_has_been_loaded_into_a_process_that_is_not_LFS.exe
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
xor eax, eax
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10068185
mov esp, ebp
pop ebp
ret 0xc
push str.dllmain
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
call fcn.10053a10
push esi
call dword [sym.imp.KERNEL32.dll_DisableThreadLibraryCalls]
push 0
push 0
push esi
push 0x100542a0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
test eax, eax
je 0x1005459d
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 4]
mov eax, 1
xor ecx, ebp
pop esi
call fcn.10068185
mov esp, ebp
pop ebp
ret 0xc
Function at 0x10055190
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1006a670
mov eax, dword fs:[0]
push eax
sub esp, 0x20
mov eax, dword [0x100a7010]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
xor esi, esi
call fcn.10052d20
cmp dword [0x100a79bc], esi
jne 0x10055303
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_HeapCreate]
test eax, eax
mov dword [0x100a79bc], eax
mov ecx, 9
mov edi, 0x100a79b8
cmove esi, ecx
xor eax, eax
xchg dword [edi], eax
test esi, esi
jne 0x1005530c
mov eax, dword [0x100a7a50]
mov edx, 0x10055550
push 0x100a7a8c
mov eax, dword [eax]
mov ecx, dword [eax + 0xa8]
call fcn.10052d80
test eax, eax
jne 0x10055313
mov eax, dword [0x100a7a50]
mov edx, 0x10055680
push 0x100a7a90
mov eax, dword [eax]
mov ecx, dword [eax + 0x40]
call fcn.10052d80
test eax, eax
je 0x10055241
push str.Unable_to_hook_Reset__
jmp 0x10055318
lea eax, [ebp - 0x14]
push eax
push 0x40
push 5
push 0x41eed0
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
push 0x100a7cac
mov edx, 0x10056b70
mov ecx, 0x41eed0
call fcn.10052d80
test eax, eax
je 0x10055276
push str.Unable_to_hook_DoVehicleCalculations__
jmp 0x10055318
call fcn.10052d20
cmp dword [0x100a79bc], 0
je 0x100552e8
mov ecx, 1
call fcn.10052c20
xor ecx, ecx
xchg dword [edi], ecx
test eax, eax
jne 0x100552ec
mov dword [ebp - 4], eax
mov ecx, dword [0x100a7a50]
test ecx, ecx
je 0x100552b3
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
mov dword [0x100a7a50], 0
mov ecx, dword [0x100a7a40]
test ecx, ecx
je 0x100552cd
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
mov dword [0x100a7a40], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.10068185
mov esp, ebp
pop ebp
ret
xor eax, eax
xchg dword [edi], eax
push str.MH_EnableHook_failed
lea ecx, [ebp - 0x2c]
call fcn.10054860
push 0x100a5050
lea eax, [ebp - 0x2c]
jmp 0x10055328
xor eax, eax
mov ecx, 0x100a79b8
xchg dword [ecx], eax
push 0x10082248
jmp 0x10055318
push str.Unable_to_hook_EndScene__
lea ecx, [ebp - 0x20]
call fcn.10054860
push 0x100a5050
lea eax, [ebp - 0x20]
push eax
call sub.VCRUNTIME140.dll__CxxThrowException
int3
Function at 0x10056020
Capabilities:
Download url
Receive data

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [0x100a7010]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 8]
mov ebx, ecx
push edi
push 0
push str.RevLimiter
push str.RetrieveTextstart
push 0
mov edi, edx
call dword [sym.imp.USER32.dll_MessageBoxA]
push 0
push 0
lea eax, [ebp - 0xc]
push eax
push esi
push 0
call dword [sym.imp.urlmon.dll_URLOpenBlockingStreamA]
test eax, eax
je 0x1005608a
push 0
push str.RevLimiter
push str.RetrieveText1
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
pop edi
pop esi
xor al, al
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10068185
mov esp, ebp
pop ebp
ret
xor esi, esi
nop dword [eax]
mov edx, dword [ebp - 0xc]
mov eax, dword [edx]
mov ecx, dword [eax + 0xc]
lea eax, [ebp - 8]
push eax
mov eax, edi
sub eax, esi
push eax
lea eax, [ebx + esi]
push eax
push edx
call ecx
test eax, eax
js 0x100560dd
mov ecx, dword [ebp - 8]
add ecx, ebx
mov byte [ecx + esi], 0
add esi, dword [ebp - 8]
cmp eax, 1
je 0x100560c1
cmp esi, edi
jne 0x10056090
mov eax, dword [ebp - 0xc]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
mov ecx, dword [ebp - 4]
mov al, 1
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10068185
mov esp, ebp
pop ebp
ret
push str.Read_failed
lea ecx, [ebp - 0x18]
call fcn.10054860
push 0x100a5050
lea eax, [ebp - 0x18]
push eax
call sub.VCRUNTIME140.dll__CxxThrowException
int3
Function at 0x10056a10
Capabilities:
Create directory
Get disk information

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1006a856
mov eax, dword fs:[0]
push eax
sub esp, 0x108
mov eax, dword [0x100a7010]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x14]
mov dword [ebp - 0x14], 0
push eax
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetVolumeInformationA]
cmp dword [ebp - 0x14], 0x49a973b7
sete al
cmp dword [0xc6a8a8], 0
mov byte [0x100a7a3c], al
je 0x10056a78
test al, al
je 0x10056aee
push 0xb8
lea eax, [ebp - 0xcc]
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 4
lea ecx, [ebp - 0xcc]
push 1
push str.d3d9.dll
call fcn.10057920
push 0
push str.revlimiter
mov dword [ebp - 4], 0
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
test eax, eax
jne 0x10056ac8
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
cmp edi, 0xb7
jne 0x10056b0f
lea ecx, [ebp - 0xcc]
call fcn.10056950
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.10068185
mov esp, ebp
pop ebp
ret
push str.You_have_to_be_in_the_entry_screen_to_be_able_to_attach_the_dll
lea ecx, [ebp - 0xd8]
call fcn.10054860
push 0x100a5050
lea eax, [ebp - 0xd8]
push eax
call sub.VCRUNTIME140.dll__CxxThrowException
push str.Cant_create_directory_revlimiter
lea ecx, [ebp - 0xfc]
call fcn.10053e70
push str._nError_code:
mov ecx, eax
mov byte [ebp - 4], 1
call fcn.10053d40
mov edx, edi
lea ecx, [ebp - 0x114]
mov esi, eax
call fcn.10053960
push eax
mov ecx, esi
mov byte [ebp - 4], 2
call fcn.10053db0
push eax
lea ecx, [ebp - 0xe4]
call fcn.100538c0
push 0x100a5050
lea eax, [ebp - 0xe4]
push eax
call sub.VCRUNTIME140.dll__CxxThrowException
int3
Function at 0x10056bd0
Capabilities:
Log keystrokes via polling

Disassembly:
cmp byte [0x100a723e], 0
push esi
mov esi, ecx
je 0x10056d06
mov ecx, dword [0xddd61c]
test ecx, ecx
je 0x10056d06
mov ecx, dword [ecx + 0x1f4]
test ecx, ecx
je 0x10056d06
cmp ecx, esi
jne 0x10056d06
cmp dword [esi + 0x578], 1
movss xmm2, dword [esi + 0x508]
movaps xmm1, xmm2
mulss xmm2, dword [0x100a7248]
mulss xmm1, dword [0x100a724c]
jne 0x10056c76
movss xmm0, dword [esi + 0x568]
comiss xmm0, xmm1
jb 0x10056c76
mov eax, dword [0x100a7240]
test al, 1
je 0x10056c4d
mov dword [esi + 0x578], 0
mov eax, dword [0x100a7240]
test al, 2
je 0x10056c60
xor eax, eax
mov word [esi + 0x8ca], ax
mov dword [esi + 0x570], eax
mov dword [0x100a79fc], 0
mov byte [0x100a7ca0], 1
jmp 0x10056d06
cmp byte [0x100a7ca0], 0
je 0x10056d06
mov eax, dword [0x100a79fc]
movss xmm0, dword [esi + 0x568]
inc eax
comiss xmm2, xmm0
mov dword [0x100a79fc], eax
jb 0x10056cc1
test byte [0x100a7240], 1
je 0x10056cae
mov dword [esi + 0x578], 1
mov dword [0x100a79fc], 0
mov byte [0x100a7ca0], 0
jmp 0x10056d06
cmp eax, dword [0x100a7244]
jl 0x10056cf4
comiss xmm0, xmm1
jae 0x10056ce8
test byte [0x100a7240], 1
je 0x10056ce1
mov dword [esi + 0x578], 1
mov byte [0x100a7ca0], 0
mov dword [0x100a79fc], 0
jmp 0x10056d06
test byte [0x100a7240], 2
je 0x10056d06
xor eax, eax
mov word [ecx + 0x8ca], ax
mov al, byte [0x100a723c]
mov dl, byte [0x100a7cb0]
test al, al
jne 0x10056d1d
test dl, dl
je 0x10056e2b
mov ecx, dword [0xddd61c]
test ecx, ecx
je 0x10056e2b
mov ecx, dword [ecx + 0x1f4]
test ecx, ecx
je 0x10056e2b
cmp ecx, esi
jne 0x10056e2b
cmp byte [0x100a7ca8], 0
je 0x10056d66
mov dword [ecx + 0x578], 1
mov al, byte [0x100a723c]
mov dl, byte [0x100a7cb0]
mov byte [0x100a7ca8], 0
test dl, dl
jne 0x10056dde
cmp byte [ecx + 0x111d], 2
jb 0x10056e2b
movss xmm1, dword [ecx + 0x4dc]
mulss xmm1, dword [0x100a2c44]
movss xmm0, dword [ecx + 0x6a4]
comiss xmm0, xmm1
ja 0x10056e2b
cmp byte [0x100a7cb2], dl
jne 0x10056db9
movzx eax, word [ecx + 0x8cc]
movd xmm0, eax
cvtdq2ps xmm0, xmm0
comiss xmm0, dword [0x100a2d2c]
ja 0x10056dd0
jmp 0x10056e2b
movzx eax, word [ecx + 0x8de]
movd xmm0, eax
cvtdq2ps xmm0, xmm0
comiss xmm0, dword [0x100a2d2c]
jbe 0x10056e2b
mov eax, 0xffff
mov word [ecx + 0x8de], ax
jmp 0x10056de2
test al, al
je 0x10056e2b
cmp dword [ecx + 0x578], 1
jne 0x10056e2b
movss xmm1, dword [ecx + 0x508]
mulss xmm1, dword [0x100a7250]
movss xmm0, dword [ecx + 0x568]
comiss xmm0, xmm1
jb 0x10056e2b
mov dword [ecx + 0x578], 0
cmp byte [0x100a7cb1], 0
je 0x10056e24
xor eax, eax
mov word [esi + 0x8ca], ax
mov byte [0x100a7ca8], 1
mov ecx, esi
call fcn.100673c0
cmp byte [0x100a723d], 0
je 0x10056e59
mov ecx, dword [0xddd61c]
test ecx, ecx
je 0x10056e59
mov ecx, dword [ecx + 0x1f4]
test ecx, ecx
je 0x10056e59
cmp ecx, esi
jne 0x10056e59
pop esi
jmp fcn.10053380
pop esi
ret
Function at 0x100571c0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x14
push ebx
mov ebx, ecx
push esi
push edi
cmp dword [ebx + 0x38], 0
je 0x100571ec
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____thiscall_std::basic_streambuf_char__struct_std::char_traits_char__::xsputn_char_const___long_long___int64__]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov eax, dword [ebx + 0x20]
mov esi, dword [ebp + 0xc]
mov edi, dword [ebp + 0x10]
mov dword [esp + 0x18], esi
mov eax, dword [eax]
mov dword [esp + 0x1c], edi
mov dword [esp + 0x14], eax
test eax, eax
je 0x1005720e
mov eax, dword [ebx + 0x30]
mov eax, dword [eax]
jmp 0x10057210
xor eax, eax
cdq
mov dword [esp + 0xc], eax
mov ecx, edx
mov dword [esp + 0x10], ecx
test edi, edi
jl 0x10057295
jg 0x10057225
test esi, esi
je 0x10057295
test ecx, ecx
jl 0x10057278
jg 0x1005722f
test eax, eax
je 0x10057278
cmp edi, ecx
jg 0x10057243
jl 0x10057239
cmp esi, eax
jae 0x10057243
mov eax, esi
mov dword [esp + 0xc], esi
mov dword [esp + 0x10], edi
push eax
push dword [ebp + 8]
push dword [esp + 0x1c]
call sub.VCRUNTIME140.dll_memcpy
mov ecx, dword [esp + 0x18]
add esp, 0xc
mov eax, dword [ebx + 0x30]
sub esi, ecx
mov edx, dword [ebp + 8]
sbb edi, dword [esp + 0x10]
add edx, ecx
sub dword [eax], ecx
mov eax, dword [ebx + 0x20]
add dword [eax], ecx
test edi, edi
jl 0x10057295
jg 0x1005727b
test esi, esi
je 0x10057295
jmp 0x1005727b
mov edx, dword [ebp + 8]
mov eax, dword [ebx + 0x4c]
test eax, eax
je 0x10057295
push eax
push esi
push 1
push edx
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
add esp, 0x10
sub esi, eax
sbb edi, 0
mov eax, dword [esp + 0x18]
mov edx, dword [esp + 0x1c]
sub eax, esi
sbb edx, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x100572b0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [ebp + 0x10]
push ebx
mov ebx, ecx
mov ecx, dword [ebp + 8]
mov dword [ebp - 4], ecx
push esi
mov esi, dword [ebp + 0xc]
test eax, eax
jg 0x100572dc
jl 0x100572d0
test esi, esi
jne 0x100572dc
pop esi
xor eax, eax
xor edx, edx
pop ebx
mov esp, ebp
pop ebp
ret 0xc
cmp dword [ebx + 0x38], 0
je 0x100572f5
push eax
push esi
push ecx
mov ecx, ebx
call dword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____thiscall_std::basic_streambuf_char__struct_std::char_traits_char__::xsgetn_char___long_long___int64__]
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov eax, dword [ebx + 0x1c]
push edi
mov edi, esi
mov edx, dword [eax]
test edx, edx
je 0x1005732d
mov eax, dword [ebx + 0x2c]
mov eax, dword [eax]
test eax, eax
je 0x1005732d
cmp eax, dword [ebp + 0xc]
cmovb esi, eax
push esi
push edx
push ecx
call sub.VCRUNTIME140.dll_memcpy
mov eax, dword [ebx + 0x2c]
sub edi, esi
add dword [ebp - 4], esi
add esp, 0xc
sub dword [eax], esi
mov eax, dword [ebx + 0x1c]
add dword [eax], esi
mov esi, dword [ebp + 0xc]
cmp dword [ebx + 0x4c], 0
mov edx, edi
je 0x100573b0
mov ecx, dword [ebx + 0xc]
lea eax, [ebx + 0x3c]
cmp dword [ecx], eax
jne 0x10057356
mov eax, dword [ebx + 0xc]
mov edx, dword [ebx + 0x54]
mov ecx, dword [ebx + 0x50]
sub edx, ecx
mov dword [eax], ecx
mov eax, dword [ebx + 0x1c]
mov dword [eax], ecx
mov eax, dword [ebx + 0x2c]
mov dword [eax], edx
mov eax, dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
mov edx, edi
mov ecx, dword [ebp - 4]
cmp edi, 0xfff
jbe 0x1005739c
nop dword [eax + eax]
push dword [ebx + 0x4c]
push 0xfff
push 1
push ecx
call eax
mov ecx, dword [ebp - 4]
sub edi, eax
add ecx, eax
add esp, 0x10
mov dword [ebp - 4], ecx
mov edx, edi
cmp eax, 0xfff
jne 0x100573c3
cmp edi, eax
mov eax, dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
ja 0x10057370
test edx, edx
je 0x100573b0
push dword [ebx + 0x4c]
push edi
push 1
push ecx
call eax
mov edx, edi
add esp, 0x10
sub edx, eax
sub esi, edx
mov edx, dword [ebp + 0x10]
pop edi
mov eax, esi
sbb edx, 0
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov edx, dword [ebp + 0x10]
sub esi, edi
pop edi
mov eax, esi
sbb edx, 0
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x10057730
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
mov eax, dword [0x100a7010]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, ecx
cmp ebx, 0xffffffff
jne 0x10057760
pop esi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10068185
mov esp, ebp
pop ebp
ret 4
mov eax, dword [esi + 0x20]
mov eax, dword [eax]
test eax, eax
je 0x10057790
mov edx, dword [esi + 0x30]
mov edx, dword [edx]
add edx, eax
cmp eax, edx
jae 0x10057790
call dword [sym.imp.MSVCP140.dll_protected:_char____thiscall_std::basic_streambuf_char__struct_std::char_traits_char__::_Pninc_void_]
pop esi
mov byte [eax], bl
mov eax, ebx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10068185
mov esp, ebp
pop ebp
ret 4
cmp dword [esi + 0x4c], 0
push edi
je 0x10057866
mov edi, dword [esi + 0xc]
lea eax, [esi + 0x3c]
cmp dword [edi], eax
jne 0x100577b9
mov edx, dword [esi + 0x54]
mov ecx, dword [esi + 0x50]
sub edx, ecx
mov dword [edi], ecx
mov eax, dword [esi + 0x1c]
mov dword [eax], ecx
mov eax, dword [esi + 0x2c]
mov dword [eax], edx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x100577c5
movsx eax, bl
jmp 0x100577fd
lea eax, [ebp - 0x2c]
mov byte [ebp - 0x25], bl
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x25]
push eax
lea eax, [esi + 0x40]
push eax
call dword [sym.imp.MSVCP140.dll_public:_int___thiscall_std::codecvt_char__char__struct__Mbstatet_::out_struct__Mbstatet___char_const___char_const___char_const____char___char___char___const]
sub eax, 0
je 0x10057827
sub eax, 1
je 0x10057827
sub eax, 2
jne 0x10057866
movsx eax, byte [ebp - 0x25]
push dword [esi + 0x4c]
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
add esp, 8
or ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, ebx
pop edi
pop esi
mov eax, ecx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10068185
mov esp, ebp
pop ebp
ret 4
mov edi, dword [ebp - 0x2c]
lea eax, [ebp - 0x24]
sub edi, eax
je 0x10057845
push dword [esi + 0x4c]
push edi
push 1
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
add esp, 0x10
cmp edi, eax
jne 0x10057866
lea eax, [ebp - 0x25]
mov byte [esi + 0x3d], 1
cmp dword [ebp - 0x30], eax
je 0x10057866
pop edi
pop esi
mov eax, ebx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10068185
mov esp, ebp
pop ebp
ret 4
mov ecx, dword [ebp - 4]
or eax, 0xffffffff
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10068185
mov esp, ebp
pop ebp
ret 4
Function at 0x10057bf0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x100a7010]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, ecx
cmp dword [esi + 0x38], 0
je 0x10057cac
cmp byte [esi + 0x3d], 0
je 0x10057cac
mov eax, dword [esi]
push edi
push 0xffffffffffffffff
call dword [eax + 0xc]
cmp eax, 0xffffffff
je 0x10057c9a
mov ecx, dword [esi + 0x38]
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [esi + 0x40]
push eax
call dword [sym.imp.MSVCP140.dll_public:_int___thiscall_std::codecvt_char__char__struct__Mbstatet_::unshift_struct__Mbstatet___char___char___char___const]
sub eax, 0
je 0x10057c61
sub eax, 1
je 0x10057c65
sub eax, 2
jne 0x10057c9a
mov byte [esi + 0x3d], al
mov al, 1
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10068185
mov esp, ebp
pop ebp
ret
mov byte [esi + 0x3d], 0
mov edi, dword [ebp - 0x28]
lea eax, [ebp - 0x24]
sub edi, eax
je 0x10057c83
push dword [esi + 0x4c]
push edi
push 1
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
add esp, 0x10
cmp edi, eax
jne 0x10057c9a
cmp byte [esi + 0x3d], 0
pop edi
sete al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10068185
mov esp, ebp
pop ebp
ret
pop edi
xor al, al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10068185
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
mov al, 1
xor ecx, ebp
pop esi
call fcn.10068185
mov esp, ebp
pop ebp
ret