joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10031dd0
Capabilities:
Resume thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
call sub.KERNEL32.dll_GetCurrentThreadId
cmp dword [0x100458f4], eax
je 0x10031ded
mov eax, 0x10dd
jmp 0x10031ed0
mov eax, dword [0x10045904]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x10031e6c
lea ecx, [ebp - 0x1c]
push ecx
mov edx, dword [ebp - 4]
mov eax, dword [edx + 0x14]
push eax
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 0x10]
movzx eax, byte [edx + 0x36]
push eax
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 0xc]
push edx
call sub.KERNEL32.dll_VirtualProtect
mov eax, dword [ebp - 4]
cmp dword [eax + 4], 0
jne 0x10031e48
mov ecx, dword [ebp - 4]
cmp dword [ecx + 0x10], 0
je 0x10031e48
mov edx, dword [ebp - 4]
mov eax, dword [edx + 0x10]
push eax
call fcn.10030c70
add esp, 4
mov ecx, dword [ebp - 4]
mov dword [ecx + 0x10], 0
mov edx, dword [ebp - 4]
mov eax, dword [edx]
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp - 4]
mov dword [ebp - 0xc], ecx
push 0x18
mov edx, dword [ebp - 0xc]
push edx
call fcn.10033325
add esp, 8
mov eax, dword [ebp - 0x10]
mov dword [ebp - 4], eax
jmp 0x10031df5
mov dword [0x10045904], 0
call fcn.10031550
mov ecx, dword [0x10045900]
mov dword [ebp - 8], ecx
cmp dword [ebp - 8], 0
je 0x10031eba
mov edx, dword [ebp - 8]
mov eax, dword [edx + 4]
push eax
call sub.KERNEL32.dll_ResumeThread
mov ecx, dword [ebp - 8]
mov edx, dword [ecx]
mov dword [ebp - 0x18], edx
mov eax, dword [ebp - 8]
mov dword [ebp - 0x14], eax
push 8
mov ecx, dword [ebp - 0x14]
push ecx
call fcn.10033325
add esp, 8
mov edx, dword [ebp - 0x18]
mov dword [ebp - 8], edx
jmp 0x10031e84
mov dword [0x10045900], 0
mov dword [0x100458f4], 0
xor eax, eax
mov esp, ebp
pop ebp
ret

Function at 0x100323b0
Capabilities:
Suspend thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
cmp dword [0x100458f8], 0
je 0x100323c9
mov eax, dword [0x100458f8]
jmp 0x10032468
call sub.KERNEL32.dll_GetCurrentThread
cmp dword [ebp + 8], eax
jne 0x100323da
xor eax, eax
jmp 0x10032468
push 8
call fcn.100332d2
add esp, 4
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x10032432
mov dword [ebp - 8], 8
cmp dword [ebp - 4], 0
je 0x1003241b
mov ecx, dword [ebp - 4]
mov dword [ebp - 0x10], ecx
push 8
mov edx, dword [ebp - 0x10]
push edx
call fcn.10033325
add esp, 8
mov dword [ebp - 4], 0
mov eax, dword [ebp - 8]
mov dword [0x100458f8], eax
mov dword [0x100458fc], 0
mov eax, dword [ebp - 8]
jmp 0x10032468
mov ecx, dword [ebp + 8]
push ecx
call sub.KERNEL32.dll_SuspendThread
cmp eax, 0xffffffff
jne 0x1003244a
call sub.KERNEL32.dll_GetLastError
mov dword [ebp - 8], eax
jmp 0x100323fa
mov edx, dword [ebp - 4]
mov eax, dword [ebp + 8]
mov dword [edx + 4], eax
mov ecx, dword [ebp - 4]
mov edx, dword [0x10045900]
mov dword [ecx], edx
mov eax, dword [ebp - 4]
mov dword [0x10045900], eax
xor eax, eax
mov esp, ebp
pop ebp
ret 4
Function at 0x402920
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x50cac0
mov eax, dword fs:[0]
push eax
sub esp, 0x5c
mov eax, dword [0x5732cc]
xor eax, esp
mov dword [esp + 0x58], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x5732cc]
xor eax, esp
push eax
lea eax, [esp + 0x70]
mov dword fs:[0], eax
mov edi, dword [esp + 0x80]
mov esi, ecx
push 0x24
xor ebx, ebx
mov ebp, 0xf
push str.AlgorithmParametersBase:_parameter__
lea ecx, [esp + 0x20]
mov dword [esp + 0x1c], esi
mov dword [esp + 0x34], ebp
mov dword [esp + 0x30], ebx
mov byte [esp + 0x20], bl
call fcn.00401c40
push edi
lea eax, [esp + 0x1c]
push eax
lea ecx, [esp + 0x58]
push ecx
mov dword [esp + 0x84], ebx
call fcn.00402210
push str.__not_used
push eax
lea edx, [esp + 0x48]
push edx
mov byte [esp + 0x90], 1
call fcn.00402210
add esp, 0x18
mov edi, eax
mov ecx, esi
mov byte [esp + 0x78], 2
call fcn.004dc516
mov byte [esp + 0x78], 3
push 0xffffffffffffffff
lea ecx, [esi + 0x10]
mov dword [esi], vtable.CryptoPP::Exception.0
mov dword [esi + 0xc], 6
push ebx
mov dword [ecx + 0x14], ebp
mov dword [ecx + 0x10], ebx
push edi
mov byte [ecx], bl
call fcn.004019d0
mov edi, 0x10
cmp dword [esp + 0x48], edi
jb 0x402a00
mov eax, dword [esp + 0x34]
push eax
call fcn.004db440
add esp, 4
mov dword [esp + 0x48], ebp
mov dword [esp + 0x44], ebx
mov byte [esp + 0x34], bl
cmp dword [esp + 0x64], edi
jb 0x402a1f
mov ecx, dword [esp + 0x50]
push ecx
call fcn.004db440
add esp, 4
mov dword [esp + 0x64], ebp
mov dword [esp + 0x60], ebx
mov byte [esp + 0x50], bl
cmp dword [esp + 0x2c], edi
jb 0x402a3e
mov edx, dword [esp + 0x18]
push edx
call fcn.004db440
add esp, 4
mov eax, esi
mov dword [esi], vtable.CryptoPP::AlgorithmParametersBase::ParameterNotUsed.0
mov ecx, dword [esp + 0x70]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x58]
xor ecx, esp
call fcn.004db901
add esp, 0x68
ret 4
Function at 0x408750
Capabilities:
Access peb ldr_data
Get process heap flags
Get process heap force flags

Disassembly:
push 0xffffffffffffffff
push 0x50d7c8
mov eax, dword fs:[0]
push eax
push ebx
push ebp
push esi
mov eax, dword [0x5732cc]
xor eax, esp
push eax
lea eax, [esp + 0x10]
mov dword fs:[0], eax
mov ebx, dword [esp + 0x28]
mov esi, dword [esp + 0x20]
mov eax, dword [esp + 0x24]
mov byte [esi + 8], cl
xor ecx, ecx
mov dword [esi + 4], eax
mov byte [esi + 9], cl
mov dword [esp + 0x18], ecx
mov dword [esi], vtable.CryptoPP::AlgorithmParametersBase2_class_CryptoPP::ConstByteArrayParameter_.0
mov dl, byte [ebx]
mov byte [esi + 0xc], dl
mov eax, dword [ebx + 4]
mov dword [esi + 0x10], eax
mov edx, dword [ebx + 8]
mov dword [esi + 0x14], edx
mov eax, dword [ebx + 0x10]
push ecx
push eax
lea ecx, [esi + 0x18]
mov dword [esi + 0x1c], eax
call fcn.00404450
mov ebp, dword [esi + 0x1c]
mov dword [esi + 0x20], eax
mov ecx, dword [ebx + 0x14]
push ebp
push ecx
push ebp
push eax
call fcn.004dd253
mov dword [esi], 0x54233c
mov dword [esi + 0x24], vtable.CryptoPP::AlgorithmParametersBase.0
mov edx, dword [edi + 4]
mov dword [esi + 0x28], edx
mov al, byte [edi + 8]
mov byte [esi + 0x2c], al
movzx ecx, byte [edi + 9]
mov byte [esi + 0x2d], cl
mov dword [esi + 0x24], vtable.CryptoPP::AlgorithmParametersBase2_int_.0
mov edx, dword [edi + 0xc]
add esp, 0x10
lea ecx, [edi + 0x10]
lea eax, [esi + 0x34]
mov dword [esi + 0x30], edx
mov dword [esi + 0x24], vtable.CryptoPP::AlgorithmParameters_class_CryptoPP::AlgorithmParameters_class_CryptoPP::AlgorithmParameters_class_CryptoPP::NullNameValuePairs__unsigned_char_const____unsigned_char___int_.0
call fcn.00408b10
mov byte [edi + 9], 1
mov eax, esi
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebp
pop ebx
add esp, 0xc
ret 0xc
Function at 0x408830
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
push 0xffffffffffffffff
push 0x50d840
mov eax, dword fs:[0]
push eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x5732cc]
xor eax, esp
push eax
lea eax, [esp + 0x14]
mov dword fs:[0], eax
mov ebx, dword [esp + 0x2c]
mov edi, edx
mov esi, dword [esp + 0x24]
mov eax, dword [esp + 0x28]
mov byte [esi + 8], cl
xor ecx, ecx
mov dword [esi + 4], eax
mov byte [esi + 9], cl
mov dword [esp + 0x1c], ecx
mov dword [esi], vtable.CryptoPP::AlgorithmParametersBase2_class_CryptoPP::ConstByteArrayParameter_.0
mov dl, byte [ebx]
mov byte [esi + 0xc], dl
mov eax, dword [ebx + 4]
mov dword [esi + 0x10], eax
mov edx, dword [ebx + 8]
mov dword [esi + 0x14], edx
mov eax, dword [ebx + 0x10]
push ecx
push eax
lea ecx, [esi + 0x18]
mov dword [esi + 0x1c], eax
call fcn.00404450
mov ebp, dword [esi + 0x1c]
mov dword [esi + 0x20], eax
mov ecx, dword [ebx + 0x14]
push ebp
push ecx
push ebp
push eax
call fcn.004dd253
add esp, 0x10
mov ebx, 1
lea ebp, [esi + 0x24]
mov dword [esp + 0x1c], ebx
push ebp
mov dword [esi], 0x542350
call fcn.00408d30
mov dword [ebp], 0x54233c
mov dword [ebp + 0x24], vtable.CryptoPP::AlgorithmParametersBase.0
mov edx, dword [edi + 0x28]
mov dword [ebp + 0x28], edx
mov al, byte [edi + 0x2c]
mov byte [ebp + 0x2c], al
movzx ecx, byte [edi + 0x2d]
mov byte [ebp + 0x2d], cl
mov dword [ebp + 0x24], vtable.CryptoPP::AlgorithmParametersBase2_int_.0
mov edx, dword [edi + 0x30]
lea ecx, [edi + 0x34]
lea eax, [ebp + 0x34]
mov dword [ebp + 0x30], edx
mov dword [ebp + 0x24], vtable.CryptoPP::AlgorithmParameters_class_CryptoPP::AlgorithmParameters_class_CryptoPP::AlgorithmParameters_class_CryptoPP::NullNameValuePairs__unsigned_char_const____unsigned_char___int_.0
call fcn.00408b10
mov byte [edi + 0x2d], bl
mov byte [edi + 9], bl
mov eax, esi
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret 0xc
Function at 0x409c50
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push 0xffffffffffffffff
push 0x50cfc3
mov eax, dword fs:[0]
push eax
sub esp, 0x58
mov eax, dword [0x5732cc]
xor eax, esp
mov dword [esp + 0x54], eax
push ebp
push esi
push edi
mov eax, dword [0x5732cc]
xor eax, esp
push eax
lea eax, [esp + 0x68]
mov dword fs:[0], eax
mov esi, dword [esp + 0x78]
push 0xb0
mov edi, ecx
call fcn.004dc69d
add esp, 4
mov dword [esp + 0x18], eax
xor ebp, ebp
mov dword [esp + 0x70], ebp
cmp eax, ebp
je 0x409caa
push eax
call fcn.0040b7f0
mov ebp, eax
mov dword [esp + 0x70], 0xffffffff
mov eax, dword [edi + 0x24]
test eax, eax
je 0x409cc8
mov ecx, dword [eax]
mov ecx, dword [ecx + 4]
add ecx, eax
mov eax, dword [ecx]
mov edx, dword [eax]
push 1
call edx
lea ecx, [esp + 0x14]
push ecx
mov dword [edi + 0x24], ebp
mov eax, dword [esi]
mov edx, dword [eax + 4]
push 0x575ae8
push str.InputFileName
mov ecx, esi
call edx
test al, al
je 0x409d8d
mov eax, dword [esi]
mov edx, dword [eax + 4]
lea ecx, [esp + 0x10]
push ecx
push 0x574f4c
push str.InputBinaryMode
mov ecx, esi
mov byte [esp + 0x1c], 1
call edx
movzx eax, byte [esp + 0x10]
mov ecx, dword [esp + 0x14]
mov esi, dword [edi + 0x24]
neg eax
sbb eax, eax
and eax, 0x20
or eax, 1
push ecx
call fcn.0040b9d0
mov eax, dword [edi + 0x24]
mov edx, dword [eax]
mov ecx, dword [edx + 4]
test byte [ecx + eax + 0xc], 6
je 0x409d88
mov edx, dword [esp + 0x14]
mov eax, edx
mov dword [esp + 0x30], 0xf
mov dword [esp + 0x2c], 0
mov byte [esp + 0x1c], 0
lea esi, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x409d51
sub eax, esi
push eax
push edx
lea ecx, [esp + 0x24]
call fcn.00401c40
lea edx, [esp + 0x1c]
push edx
lea esi, [esp + 0x3c]
mov dword [esp + 0x74], 1
call fcn.004096b0
push 0x56b870
mov eax, esi
push eax
call fcn.004db4d1
mov dword [edi + 0x28], eax
jmp 0x409daa
lea eax, [edi + 0x28]
push eax
mov dword [eax], 0
mov edx, dword [esi]
mov eax, dword [edx + 4]
push 0x575aac
push str.InputStreamPointer
mov ecx, esi
call eax
mov byte [edi + 0x34], 0
mov ecx, dword [esp + 0x68]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
mov ecx, dword [esp + 0x54]
xor ecx, esp
call fcn.004db901
add esp, 0x64
ret 4
Function at 0x40a660
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push 0xffffffffffffffff
push 0x50cfc3
mov eax, dword fs:[0]
push eax
sub esp, 0x58
mov eax, dword [0x5732cc]
xor eax, esp
mov dword [esp + 0x54], eax
push ebp
push esi
push edi
mov eax, dword [0x5732cc]
xor eax, esp
push eax
lea eax, [esp + 0x68]
mov dword fs:[0], eax
mov esi, dword [esp + 0x78]
push 0xa8
mov edi, ecx
call fcn.004dc69d
add esp, 4
mov dword [esp + 0x18], eax
mov dword [esp + 0x70], 0
test eax, eax
je 0x40a6c1
push 1
mov ecx, eax
call fcn.0040c2c0
mov ebp, eax
jmp 0x40a6c3
xor ebp, ebp
mov dword [esp + 0x70], 0xffffffff
mov eax, dword [edi + 0xc]
test eax, eax
je 0x40a6e1
mov ecx, dword [eax]
mov ecx, dword [ecx + 4]
add ecx, eax
mov eax, dword [ecx]
mov edx, dword [eax]
push 1
call edx
lea ecx, [esp + 0x14]
push ecx
mov dword [edi + 0xc], ebp
mov eax, dword [esi]
mov edx, dword [eax + 4]
push 0x575ae8
push str.OutputFileName
mov ecx, esi
call edx
test al, al
je 0x40a7ac
mov eax, dword [esi]
mov edx, dword [eax + 4]
lea ecx, [esp + 0x10]
push ecx
push 0x574f4c
push str.OutputBinaryMode
mov ecx, esi
mov byte [esp + 0x1c], 1
call edx
movzx eax, byte [esp + 0x10]
mov ecx, dword [edi + 0xc]
neg eax
sbb eax, eax
and eax, 0x20
push 0x40
or eax, 0x12
push eax
mov eax, dword [esp + 0x1c]
push eax
call fcn.0040c4a0
mov eax, dword [edi + 0xc]
mov ecx, dword [eax]
mov edx, dword [ecx + 4]
test byte [edx + eax + 0xc], 6
je 0x40a7a7
mov edx, dword [esp + 0x14]
mov eax, edx
mov dword [esp + 0x30], 0xf
mov dword [esp + 0x2c], 0
mov byte [esp + 0x1c], 0
lea esi, [eax + 1]
lea ecx, [ecx]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x40a770
sub eax, esi
push eax
push edx
lea ecx, [esp + 0x24]
call fcn.00401c40
lea eax, [esp + 0x1c]
push eax
lea esi, [esp + 0x3c]
mov dword [esp + 0x74], 1
call fcn.00409a80
push 0x56b90c
mov ecx, esi
push ecx
call fcn.004db4d1
mov dword [edi + 0x10], eax
jmp 0x40a7c9
lea eax, [edi + 0x10]
push eax
mov dword [eax], 0
mov edx, dword [esi]
mov eax, dword [edx + 4]
push 0x575af8
push str.OutputStreamPointer
mov ecx, esi
call eax
mov ecx, dword [esp + 0x68]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
mov ecx, dword [esp + 0x54]
xor ecx, esp
call fcn.004db901
add esp, 0x64
ret 4
Function at 0x40b6b0
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x50d370
mov eax, dword fs:[0]
push eax
sub esp, 8
mov eax, dword [0x5732cc]
xor eax, esp
mov dword [esp + 4], eax
push ebx
push esi
mov eax, dword [0x5732cc]
xor eax, esp
push eax
lea eax, [esp + 0x14]
mov dword fs:[0], eax
mov esi, ecx
xor ebx, ebx
mov dword [esi + 0xc], ebx
mov dword [esp + 0xc], esi
mov dword [esi + 0x14], ebx
mov dword [esp + 0x1c], 2
mov ecx, dword [esi + 0xc]
cmp ecx, ebx
je 0x40b705
mov eax, dword [ecx]
mov edx, dword [eax]
push 1
call edx
mov eax, dword [esp + 0x24]
mov dword [esi + 0xc], eax
mov dword [esi], vtable.CryptoPP::SourceTemplate_class_CryptoPP::FileStore_.0
mov dword [esi + 4], vtable.CryptoPP::SourceTemplate_class_CryptoPP::FileStore_.1.0
mov dword [esi + 0x24], 0xffffffff
mov byte [esi + 0x28], bl
mov dword [esi + 0x30], ebx
mov dword [esi + 0x34], ebx
mov dword [esi + 0x18], vtable.CryptoPP::FileStore.1.0
mov dword [esi + 0x1c], vtable.CryptoPP::FileStore.0
mov dword [esi + 0x3c], ebx
mov dword [esi + 0x40], ebx
mov eax, esi
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov ecx, dword [esp + 4]
xor ecx, esp
call fcn.004db901
add esp, 0x14
ret 4
Function at 0x40b7f0
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
push 0xffffffffffffffff
push 0x50ce37
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push ebp
push esi
push edi
mov eax, dword [0x5732cc]
xor eax, esp
push eax
lea eax, [esp + 0x18]
mov dword fs:[0], eax
mov ebp, dword [esp + 0x28]
xor ebx, ebx
mov dword [esp + 0x14], ebx
mov dword [ebp], 0x542560
mov dword [ebp + 0x68], vtable.std::basic_ios_char__struct_std::char_traits_char__.0
mov dword [esp + 0x20], ebx
mov eax, dword [ebp]
mov ecx, dword [eax + 4]
mov dword [ecx + ebp], vtable.std::basic_istream_char__struct_std::char_traits_char__.0
mov edx, dword [ebp]
mov dword [ebp + 8], ebx
mov dword [ebp + 0xc], ebx
mov edi, dword [edx + 4]
add edi, ebp
mov ecx, edi
mov dword [esp + 0x14], 1
call fcn.004094d0
lea esi, [ebp + 0x10]
push 0x20
mov ecx, edi
mov dword [edi + 0x38], esi
mov dword [edi + 0x3c], ebx
call fcn.0040d3f0
mov byte [edi + 0x40], al
cmp dword [edi + 0x38], ebx
jne 0x40b887
mov eax, dword [edi + 0xc]
or eax, 4
or eax, 4
push ebx
push eax
mov ecx, edi
call fcn.00409360
mov dword [esp + 0x20], 2
mov eax, dword [ebp]
mov ecx, dword [eax + 4]
mov dword [ecx + ebp], vtable.std::basic_ifstream_char__struct_std::char_traits_char__.0
mov ecx, esi
call fcn.0040d290
lea edx, [esi + 8]
mov dword [esi + 0x10], edx
mov dword [esi], vtable.std::basic_filebuf_char__struct_std::char_traits_char__.0
mov byte [esi + 0x50], bl
mov byte [esi + 0x49], bl
lea ecx, [esi + 0x18]
mov dword [esi + 0x20], ecx
lea edx, [esi + 0x1c]
mov dword [esi + 0x24], edx
lea eax, [esi + 0xc]
mov dword [esi + 0x14], eax
lea ecx, [esi + 0x28]
mov dword [esi + 0x30], ecx
lea edx, [esi + 0x2c]
mov dword [esi + 0x34], edx
mov dword [eax], ebx
mov eax, dword [esi + 0x24]
mov dword [eax], ebx
mov ecx, dword [esi + 0x34]
mov dword [ecx], ebx
mov edx, dword [esi + 0x10]
mov dword [edx], ebx
mov eax, dword [esi + 0x20]
mov dword [eax], ebx
mov ecx, dword [esi + 0x30]
mov dword [ecx], ebx
mov dword [esi + 0x54], ebx
mov edx, dword [0x578a34]
mov dword [esi + 0x4c], edx
mov dword [esi + 0x44], ebx
mov eax, ebp
mov ecx, dword [esp + 0x18]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret 4
Function at 0x40c2c0
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
push 0xffffffffffffffff
push 0x50cde7
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push ebp
push esi
push edi
mov eax, dword [0x5732cc]
xor eax, esp
push eax
lea eax, [esp + 0x1c]
mov dword fs:[0], eax
mov ebp, ecx
mov dword [esp + 0x18], ebp
xor ebx, ebx
mov dword [esp + 0x14], ebx
cmp dword [esp + 0x2c], ebx
je 0x40c313
mov dword [ebp], 0x542568
mov dword [ebp + 0x60], vtable.std::basic_ios_char__struct_std::char_traits_char__.0
mov dword [esp + 0x24], ebx
mov dword [esp + 0x14], 1
mov eax, dword [ebp]
mov ecx, dword [eax + 4]
mov dword [ecx + ebp], vtable.std::basic_ostream_char__struct_std::char_traits_char__.0
mov edx, dword [ebp]
mov edi, dword [edx + 4]
add edi, ebp
mov ecx, edi
call fcn.004094d0
lea esi, [ebp + 4]
push 0x20
mov ecx, edi
mov dword [edi + 0x38], esi
mov dword [edi + 0x3c], ebx
call fcn.0040d3f0
mov byte [edi + 0x40], al
cmp dword [edi + 0x38], ebx
jne 0x40c35b
mov eax, dword [edi + 0xc]
or eax, 4
or eax, 4
push ebx
push eax
mov ecx, edi
call fcn.00409360
mov dword [esp + 0x24], 2
mov eax, dword [ebp]
mov ecx, dword [eax + 4]
mov dword [ecx + ebp], vtable.std::basic_ofstream_char__struct_std::char_traits_char__.0
mov ecx, esi
call fcn.0040d290
lea edx, [esi + 8]
mov dword [esi + 0x10], edx
mov dword [esi], vtable.std::basic_filebuf_char__struct_std::char_traits_char__.0
mov byte [esi + 0x50], bl
mov byte [esi + 0x49], bl
lea ecx, [esi + 0x18]
mov dword [esi + 0x20], ecx
lea edx, [esi + 0x1c]
mov dword [esi + 0x24], edx
lea eax, [esi + 0xc]
mov dword [esi + 0x14], eax
lea ecx, [esi + 0x28]
mov dword [esi + 0x30], ecx
lea edx, [esi + 0x2c]
mov dword [esi + 0x34], edx
mov dword [eax], ebx
mov eax, dword [esi + 0x24]
mov dword [eax], ebx
mov ecx, dword [esi + 0x34]
mov dword [ecx], ebx
mov edx, dword [esi + 0x10]
mov dword [edx], ebx
mov eax, dword [esi + 0x20]
mov dword [eax], ebx
mov ecx, dword [esi + 0x30]
mov dword [ecx], ebx
mov dword [esi + 0x54], ebx
mov edx, dword [0x578a34]
mov dword [esi + 0x4c], edx
mov dword [esi + 0x44], ebx
mov eax, ebp
mov ecx, dword [esp + 0x1c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x14
ret 4
Function at 0x40cc70
Capabilities:
Write file on windows

Disassembly:
push 0xffffffffffffffff
push 0x50c408
mov eax, dword fs:[0]
push eax
sub esp, 0x24
mov eax, dword [0x5732cc]
xor eax, esp
mov dword [esp + 0x20], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x5732cc]
xor eax, esp
push eax
lea eax, [esp + 0x38]
mov dword fs:[0], eax
mov edi, ecx
cmp dword [edi + 0x44], 0
je 0x40cdb9
cmp byte [edi + 0x49], 0
je 0x40cdb9
mov eax, dword [edi]
mov edx, dword [eax + 0xc]
push 0xffffffffffffffff
call edx
cmp eax, 0xffffffff
je 0x40cdac
mov ecx, 0xf
xor eax, eax
mov byte [esp + 0x18], 0
mov dword [esp + 0x2c], ecx
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], eax
mov dword [esp + 0x28], 8
cmp ecx, 0x10
jae 0x40ccf3
lea eax, [esp + 0x18]
mov byte [eax + 8], 0
mov dword [esp + 0x40], 0
lea ebx, [edi + 0x4c]
mov eax, dword [esp + 0x18]
mov ebp, dword [esp + 0x2c]
mov edx, eax
cmp ebp, 0x10
jae 0x40cd17
lea edx, [esp + 0x18]
mov eax, edx
add edx, dword [esp + 0x28]
mov ecx, dword [edi + 0x44]
mov esi, dword [ecx]
lea ebp, [esp + 0x14]
push ebp
push edx
push eax
mov eax, dword [esi + 0x18]
push ebx
call eax
sub eax, 0
je 0x40cd40
dec eax
je 0x40cd44
sub eax, 2
lea ecx, [esp + 0x18]
jne 0x40cda7
jmp 0x40cdb4
mov byte [edi + 0x49], 0
mov ebp, dword [esp + 0x2c]
mov eax, dword [esp + 0x18]
mov ecx, eax
cmp ebp, 0x10
jae 0x40cd57
lea ecx, [esp + 0x18]
mov esi, dword [esp + 0x14]
sub esi, ecx
je 0x40cd84
cmp ebp, 0x10
jae 0x40cd68
lea eax, [esp + 0x18]
mov ecx, dword [edi + 0x54]
push ecx
push esi
push 1
push eax
call fcn.004df0ac
add esp, 0x10
cmp esi, eax
jne 0x40cda3
mov ebp, dword [esp + 0x2c]
mov eax, dword [esp + 0x18]
cmp byte [edi + 0x49], 0
je 0x40cdb0
test esi, esi
jne 0x40cd0a
push esi
push 8
lea ecx, [esp + 0x20]
call fcn.00404d30
jmp 0x40cd02
lea ecx, [esp + 0x18]
call fcn.004018f0
xor al, al
jmp 0x40cdbb
lea ecx, [esp + 0x18]
call fcn.004018f0
mov al, 1
mov ecx, dword [esp + 0x38]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x20]
xor ecx, esp
call fcn.004db901
add esp, 0x30
ret
Function at 0x40d290
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
push 0xffffffffffffffff
push 0x50c15b
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x5732cc]
xor eax, esp
push eax
lea eax, [esp + 0x18]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0x14], esi
lea ecx, [esi + 4]
mov dword [esi], vtable.std::basic_streambuf_char__struct_std::char_traits_char__.0
call fcn.004db1f0
push 4
mov dword [esp + 0x24], 0
call fcn.004dc69d
mov edi, eax
add esp, 4
test edi, edi
je 0x40d312
call fcn.004daeb2
mov dword [edi], eax
call fcn.004dac71
push 0
lea ecx, [esp + 0x14]
mov ebx, eax
call fcn.004daba6
mov eax, dword [ebx + 4]
cmp eax, 0xffffffff
jae 0x40d307
inc eax
mov dword [ebx + 4], eax
lea ecx, [esp + 0x10]
call fcn.004dabce
jmp 0x40d314
xor edi, edi
lea eax, [esi + 8]
mov dword [esi + 0x10], eax
lea ecx, [esi + 0x18]
mov dword [esi + 0x20], ecx
lea edx, [esi + 0x1c]
mov dword [esi + 0x24], edx
mov dword [esi + 0x38], edi
lea eax, [esi + 0xc]
mov dword [esi + 0x14], eax
lea ecx, [esi + 0x28]
mov dword [esi + 0x30], ecx
lea edx, [esi + 0x2c]
mov dword [esi + 0x34], edx
mov dword [eax], 0
mov eax, dword [esi + 0x24]
mov dword [eax], 0
mov ecx, dword [esi + 0x34]
mov dword [ecx], 0
mov edx, dword [esi + 0x10]
mov dword [edx], 0
mov eax, dword [esi + 0x20]
mov dword [eax], 0
mov ecx, dword [esi + 0x30]
mov dword [ecx], 0
mov eax, esi
mov ecx, dword [esp + 0x18]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x14
ret

Function at 0x40f960
Capabilities:
Access peb ldr_data
Get process heap force flags

Disassembly:
push 0xffffffffffffffff
push 0x50d338
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x5732cc]
xor eax, esp
push eax
lea eax, [esp + 0x14]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0x10], esi
mov cl, byte [esp + 0x30]
mov eax, dword [esp + 0x28]
mov byte [esi + 8], cl
xor ecx, ecx
mov dword [esi + 4], eax
mov byte [esi + 9], cl
mov edi, dword [esp + 0x2c]
mov dword [esp + 0x1c], ecx
mov dword [esi], vtable.CryptoPP::AlgorithmParametersBase2_class_CryptoPP::ConstByteArrayParameter_.0
mov dl, byte [edi]
mov byte [esi + 0xc], dl
mov eax, dword [edi + 4]
mov dword [esi + 0x10], eax
mov edx, dword [edi + 8]
mov dword [esi + 0x14], edx
mov eax, dword [edi + 0x10]
push ecx
push eax
lea ecx, [esi + 0x18]
mov dword [esi + 0x1c], eax
call fcn.00404450
mov ebx, dword [esi + 0x1c]
mov dword [esi + 0x20], eax
mov ecx, dword [edi + 0x14]
push ebx
push ecx
push ebx
push eax
call fcn.004dd253
mov dword [esi], vtable.CryptoPP::AlgorithmParameters_class_CryptoPP::NullNameValuePairs__class_CryptoPP::ConstByteArrayParameter_.0
add esp, 0x10
mov dword [esi + 0x24], vtable.CryptoPP::NullNameValuePairs.0
mov eax, esi
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x10
ret 0x10