joyce8/EMBER2024-capa huggingface dataset:
Function at 0x403980
Capabilities:
Encode data using xor
Encrypt data using aes
Reference aes constants

Disassembly:
push ecx
push ebx
push ebp
push esi
push edi
mov esi, ecx
push ecx
mov dword [esp + 0x14], esi
call fcn.004037f0
mov ebp, eax
add esp, 4
xor ebx, ebx
lea edi, [ebp*4]
test edi, edi
jle 0x4039f4
mov ecx, dword [esp + 0x10]
lea esi, [esi + edi*4]
add esi, 8
add ecx, 8
mov edx, dword [ecx - 8]
lea ecx, [ecx + 0x10]
mov eax, dword [esi - 8]
lea esi, [esi - 0x10]
mov dword [ecx - 0x18], eax
add ebx, 4
mov eax, dword [esi + 0xc]
sub edi, 4
mov dword [esi + 8], edx
mov edx, dword [ecx - 0x14]
mov dword [ecx - 0x14], eax
mov eax, dword [esi + 0x10]
mov dword [esi + 0xc], edx
mov edx, dword [ecx - 0x10]
mov dword [ecx - 0x10], eax
mov eax, dword [esi + 0x14]
mov dword [esi + 0x10], edx
mov edx, dword [ecx - 0xc]
mov dword [ecx - 0xc], eax
mov dword [esi + 0x14], edx
cmp ebx, edi
jl 0x4039b0
mov esi, dword [esp + 0x10]
cmp ebp, 1
jle 0x403b6d
add esi, 4
lea edi, [ebp - 1]
mov edx, dword [esi + 0xc]
lea esi, [esi + 0x10]
mov eax, edx
shr eax, 0x18
movzx ecx, byte [eax*4 + str.ccccwwww]
movzx eax, byte [esi - 3]
mov ecx, dword [ecx*4 + 0x468df0]
movzx eax, byte [eax*4 + str.ccccwwww]
xor ecx, dword [eax*4 + 0x4691f0]
movzx eax, dl
mov edx, dword [esi]
movzx eax, byte [eax*4 + str.ccccwwww]
xor ecx, dword [eax*4 + 0x4689f0]
movzx eax, byte [esi - 2]
movzx eax, byte [eax*4 + str.ccccwwww]
xor ecx, dword [eax*4 + 0x4685f0]
mov eax, edx
shr eax, 0x10
movzx eax, al
mov dword [esi - 4], ecx
movzx ecx, byte [eax*4 + str.ccccwwww]
mov eax, edx
shr eax, 8
movzx eax, al
mov ecx, dword [ecx*4 + 0x4685f0]
movzx eax, byte [eax*4 + str.ccccwwww]
xor ecx, dword [eax*4 + 0x4691f0]
mov eax, edx
shr eax, 0x18
movzx eax, byte [eax*4 + str.ccccwwww]
xor ecx, dword [eax*4 + 0x468df0]
movzx eax, dl
mov edx, dword [esi + 4]
movzx eax, byte [eax*4 + str.ccccwwww]
xor ecx, dword [eax*4 + 0x4689f0]
mov eax, edx
shr eax, 0x10
movzx eax, al
mov dword [esi], ecx
movzx ecx, byte [eax*4 + str.ccccwwww]
mov eax, edx
shr eax, 8
movzx eax, al
mov ecx, dword [ecx*4 + 0x4685f0]
movzx eax, byte [eax*4 + str.ccccwwww]
xor ecx, dword [eax*4 + 0x4691f0]
mov eax, edx
shr eax, 0x18
movzx eax, byte [eax*4 + str.ccccwwww]
xor ecx, dword [eax*4 + 0x468df0]
movzx eax, dl
mov edx, dword [esi + 8]
movzx eax, byte [eax*4 + str.ccccwwww]
xor ecx, dword [eax*4 + 0x4689f0]
mov eax, edx
shr eax, 0x10
movzx eax, al
mov dword [esi + 4], ecx
movzx ecx, byte [eax*4 + str.ccccwwww]
mov eax, edx
shr eax, 8
movzx eax, al
mov ecx, dword [ecx*4 + 0x4685f0]
movzx eax, byte [eax*4 + str.ccccwwww]
xor ecx, dword [eax*4 + 0x4691f0]
mov eax, edx
shr eax, 0x18
movzx eax, byte [eax*4 + str.ccccwwww]
xor ecx, dword [eax*4 + 0x468df0]
movzx eax, dl
movzx eax, byte [eax*4 + str.ccccwwww]
xor ecx, dword [eax*4 + 0x4689f0]
mov dword [esi + 8], ecx
sub edi, 1
jne 0x403a03
pop edi
pop esi
mov eax, ebp
pop ebp
pop ebx
pop ecx
ret
Function at 0x4063b0
Capabilities:
Hash data with md5

Disassembly:
sub esp, 0x70
mov eax, dword [0x46f084]
xor eax, esp
mov dword [esp + 0x6c], eax
push ebx
push ebp
push esi
push edi
mov edi, ecx
mov dword [esp + 0x34], 0
push 8
lea ecx, [esp + 0x24]
mov dword [esp + 0x34], 0
mov dword [esp + 0x24], 0x67452301
mov dword [esp + 0x28], 0xefcdab89
mov dword [esp + 0x2c], 0x98badcfe
mov dword [esp + 0x30], 0x10325476
call fcn.004065f0
add esp, 4
lea edx, [esp + 0x20]
lea ecx, [esp + 0x10]
call fcn.004066c0
xor ebx, ebx
lea esi, [esp + 0x1e]
lea eax, [edi + 0x12]
lea ebp, [ebx + 4]
nop dword [eax + eax]
movzx ecx, byte [eax + 1]
lea esi, [esi - 4]
movzx edx, byte [esi + 5]
lea eax, [eax - 4]
add ebx, ecx
movzx ecx, byte [eax + 4]
add ebx, edx
movzx edx, byte [esi + 3]
mov byte [eax + 5], bl
shr ebx, 8
add ebx, ecx
movzx ecx, byte [esi + 4]
add ebx, ecx
movzx ecx, byte [eax + 3]
mov byte [eax + 4], bl
shr ebx, 8
add edx, ebx
movzx ebx, byte [esi + 2]
add edx, ecx
movzx ecx, byte [eax + 2]
mov byte [eax + 3], dl
shr edx, 8
add ebx, edx
add ebx, ecx
mov byte [eax + 2], bl
shr ebx, 8
sub ebp, 1
jne 0x406420
mov eax, dword [edi]
xor edx, edx
cmp eax, 8
lea ecx, [eax - 8]
cmovae edx, ecx
mov ecx, dword [esp + 0x7c]
mov dword [edi], edx
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.0042df20
add esp, 0x70
ret
Function at 0x41f2a0
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
lea eax, [ebp - 0x24]
push ebx
mov ebx, dword [sym.imp.WS2_32.dll_recv]
push 2
push 0x20
push eax
push dword [0x46eea4]
call ebx
test eax, eax
jle 0x41f329
mov ecx, dword [0x46eea4]
push esi
push edi
lea edi, [ebp - 0x24]
mov dword [ebp - 4], ecx
xor esi, esi
push 0
mov eax, 0x20
sub eax, esi
push eax
push edi
push ecx
call ebx
test eax, eax
jle 0x41f2ef
mov ecx, dword [ebp - 4]
add esi, eax
add edi, eax
cmp esi, 0x20
jl 0x41f2d1
mov al, byte [ebp - 0xc]
pop edi
pop esi
cmp al, byte [ebp + 8]
jne 0x41f329
mov ecx, dword [ebp + 0xc]
cmp dword [ebp - 0x1c], 0
setne al
mov byte [ecx], al
mov eax, dword [ebp - 0x20]
mov dword [ecx + 4], eax
mov eax, dword [ebp - 0x18]
push eax
mov byte [ecx + 8], al
lea eax, [ebp - 0x14]
push eax
lea eax, [ecx + 9]
push eax
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
mov al, 1
pop ebx
mov esp, ebp
pop ebp
ret
xor al, al
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x41f330
Capabilities:
Receive data
Receive data on socket
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x8c
mov eax, dword [0x46f084]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov eax, 0x14
lea ecx, [ebp - 0x84]
mov word [ebp - 0x84], ax
mov al, byte [ebp + 8]
push edi
mov byte [ebp - 0x80], al
xor eax, eax
push 0
mov word [ebp - 0x7e], ax
mov dword [ebp - 0x7c], eax
mov dword [ebp - 0x78], eax
mov ax, word [ebp + 0xc]
push 0x20
mov word [ebp - 0x74], ax
mov eax, dword [0x46eea0]
push ecx
push eax
mov dword [ebp - 0x8c], eax
call dword [sym.imp.WS2_32.dll_send]
mov ebx, dword [sym.imp.WS2_32.dll_recv]
mov ecx, 0x20
cmp eax, 0xffffffff
je 0x41f3e7
lea edi, [ebp - 0x84]
xor esi, esi
push 0
sub ecx, esi
push ecx
push edi
push dword [ebp - 0x8c]
call ebx
test eax, eax
jle 0x41f3c3
add esi, eax
add edi, eax
cmp esi, 0x20
jge 0x41f3c8
mov ecx, 0x20
jmp 0x41f3a1
cmp eax, 0xffffffff
je 0x41f3e7
cmp word [ebp - 0x84], 1
jne 0x41f3e7
cmp dword [ebp - 0x80], 0
jne 0x41f3de
cmp dword [ebp - 0x7c], 0
jne 0x41f3e7
mov byte [ebp - 0x85], 1
jmp 0x41f3ee
mov byte [ebp - 0x85], 0
mov eax, 0x1e
mov word [ebp - 0x5f], 0
mov word [ebp - 0x64], ax
lea ecx, [ebp - 0x64]
mov al, byte [ebp + 8]
push 0
mov byte [ebp - 0x60], al
mov eax, 0x14
push 0x20
mov word [ebp - 0x58], ax
mov eax, dword [0x46eea0]
push ecx
push eax
mov dword [ebp - 0x54], 0
mov byte [ebp - 0x5d], 1
mov dword [ebp - 0x5c], 0
mov dword [ebp - 0x8c], eax
call dword [sym.imp.WS2_32.dll_send]
cmp eax, 0xffffffff
je 0x41f480
lea edi, [ebp - 0x64]
xor esi, esi
push 0
mov eax, 0x20
sub eax, esi
push eax
push edi
push dword [ebp - 0x8c]
call ebx
test eax, eax
jle 0x41f464
add esi, eax
add edi, eax
cmp esi, 0x20
jl 0x41f442
jmp 0x41f469
cmp eax, 0xffffffff
je 0x41f480
cmp word [ebp - 0x64], 1
jne 0x41f480
cmp dword [ebp - 0x60], 0
jne 0x41f47c
cmp dword [ebp - 0x5c], 0
jne 0x41f480
mov bl, 1
jmp 0x41f482
xor bl, bl
and bl, byte [ebp - 0x85]
lea ecx, [ebp - 0x44]
mov eax, 0x1e
mov word [ebp - 0x3f], 0x101
mov word [ebp - 0x44], ax
mov al, byte [ebp + 8]
push 0
mov byte [ebp - 0x40], al
mov eax, 0x20
push 0x20
mov word [ebp - 0x38], ax
mov eax, dword [0x46eea0]
push ecx
push eax
mov dword [ebp - 0x34], 0
mov byte [ebp - 0x3d], 0
mov dword [ebp - 0x3c], 0
mov dword [ebp - 0x8c], eax
call dword [sym.imp.WS2_32.dll_send]
cmp eax, 0xffffffff
je 0x41f531
lea edi, [ebp - 0x44]
xor esi, esi
nop dword [eax]
push 0
mov eax, 0x20
sub eax, esi
push eax
push edi
push dword [ebp - 0x8c]
call dword [sym.imp.WS2_32.dll_recv]
test eax, eax
jle 0x41f506
add esi, eax
add edi, eax
cmp esi, 0x20
jl 0x41f4e0
jmp 0x41f50b
cmp eax, 0xffffffff
je 0x41f531
cmp word [ebp - 0x44], 1
jne 0x41f531
cmp dword [ebp - 0x40], 0
jne 0x41f51e
cmp dword [ebp - 0x3c], 0
jne 0x41f531
pop edi
pop esi
mov al, bl
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0042df20
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor al, al
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0042df20
mov esp, ebp
pop ebp
ret
Function at 0x41f550
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov ecx, dword [ebp + 0xc]
xor eax, eax
mov word [ebp - 6], ax
xorps xmm0, xmm0
mov al, byte [ebp + 8]
mov byte [ebp - 8], al
mov eax, dword [ecx + 4]
mov dword [ebp - 0x1c], eax
movzx eax, byte [ecx]
mov dword [ebp - 0x18], eax
movzx eax, byte [ecx + 8]
push eax
mov dword [ebp - 0x14], eax
lea eax, [ecx + 9]
push eax
lea eax, [ebp - 0x10]
mov dword [ebp - 0x20], 0x46
push eax
movlpd qword [ebp - 0x10], xmm0
mov byte [ebp - 7], 0
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
mov dword [ebp - 4], 0
lea eax, [ebp - 0x20]
push 0
push 0x20
push eax
push dword [0x46eea4]
call dword [sym.imp.WS2_32.dll_send]
mov esp, ebp
pop ebp
ret

Function at 0x41f5c0
Capabilities:
Act as tcp client
Connect socket
Connect tcp socket
Create tcp socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x46f084]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push edi
push 6
push 1
push 2
xor bl, bl
call dword [sym.imp.WS2_32.dll_socket]
mov edi, eax
cmp edi, 0xffffffff
jne 0x41f5ff
call dword [sym.imp.WS2_32.dll_WSACleanup]
or eax, edi
pop edi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0042df20
mov esp, ebp
pop ebp
ret
mov eax, 2
push str.127.0.0.1
mov word [ebp - 0x14], ax
call dword [sym.imp.WS2_32.dll_inet_addr]
push dword [ebp + 8]
mov dword [ebp - 0x10], eax
call dword [sym.imp.WS2_32.dll_htons]
mov word [ebp - 0x12], ax
lea eax, [ebp - 0x14]
push 0x10
push eax
push edi
call dword [sym.imp.WS2_32.dll_connect]
cmp eax, 0xffffffff
jne 0x41f6c9
push esi
mov esi, dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
test bl, bl
jne 0x41f69a
push str.ISOtest___configurable_implement:
push 2
call esi
add esp, 4
push eax
call fcn.0041f8f0
add esp, 8
push str.ISOAgLib_CAN_Init:_Cant_connect_to_CAN_Server__socket_variant_._n
push 2
call esi
add esp, 4
push eax
call fcn.0041f8f0
add esp, 8
push str.ISOtest___configurable_implement:
push 2
call esi
add esp, 4
push eax
call fcn.0041f8f0
add esp, 8
push str.ISOAgLib_CAN_Init:_Waiting_for_CAN_Server_to_be_started___Retrying_every_second..._n
push 2
call esi
add esp, 4
push eax
call fcn.0041f8f0
add esp, 8
mov bl, 1
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0x10
lea eax, [ebp - 0x14]
push eax
push edi
call dword [sym.imp.WS2_32.dll_connect]
cmp eax, 0xffffffff
je 0x41f640
pop esi
test bl, bl
je 0x41f6c9
push str.ISOAgLib_CAN_Init:_Finally_connected_to_CAN_Server._Continuing_with_application..._n_n
call fcn.0041f920
add esp, 4
mov ecx, dword [ebp - 4]
mov eax, edi
pop edi
xor ecx, ebp
pop ebx
call fcn.0042df20
mov esp, ebp
pop ebp
ret
Function at 0x41f880
Capabilities:
Receive data
Receive data on socket
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
push 0
push 0x20
push ebx
push dword [ebp + 0xc]
call dword [sym.imp.WS2_32.dll_send]
cmp eax, 0xffffffff
je 0x41f8e1
mov edi, ebx
xor esi, esi
push 0
mov eax, 0x20
sub eax, esi
push eax
push edi
push dword [ebp + 0xc]
call dword [sym.imp.WS2_32.dll_recv]
test eax, eax
jle 0x41f8c3
add esi, eax
add edi, eax
cmp esi, 0x20
jl 0x41f8a0
jmp 0x41f8c8
cmp eax, 0xffffffff
je 0x41f8e1
cmp word [ebx], 1
jne 0x41f8e1
cmp dword [ebx + 4], 0
jne 0x41f8da
cmp dword [ebx + 8], 0
jne 0x41f8e1
pop edi
pop esi
mov al, 1
pop ebx
pop ebp
ret
pop edi
pop esi
xor al, al
pop ebx
pop ebp
ret

Function at 0x41fa00
Capabilities:
Initialize winsock library
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
mov al, byte [ebp + 8]
mov byte [0x48aad3], al
pop ebp
jmp fcn.0041f6e0

Function at 0x41fa90
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [0x48aad4]
test eax, eax
je 0x41faaf
push eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
add esp, 0x10
pop ebp
ret

Function at 0x41fac0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [0x48aad4]
test eax, eax
je 0x41fadf
push eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
add esp, 0x10
pop ebp
ret
Function at 0x420350
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
mov ax, word [ebp + 8]
mov edx, 0x46eea8
mov word [0x48aae0], ax
mov eax, dword [ebp + 0xc]
mov dword [0x48aae4], eax
nop word [eax + eax]
mov cl, byte [edx]
lea edx, [edx + 1]
mov al, cl
sub al, 0x1e
mov byte [edx - 1], al
cmp cl, 0x1e
jne 0x420370
mov edx, 0x46eeb0
mov cl, byte [edx]
lea edx, [edx + 1]
mov al, cl
sub al, 0x1e
mov byte [edx - 1], al
cmp cl, 0x1e
jne 0x420386
mov edx, 0x46eee4
nop dword [eax]
mov cl, byte [edx]
lea edx, [edx + 1]
mov al, cl
sub al, 0x1e
mov byte [edx - 1], al
cmp cl, 0x1e
jne 0x4203a0
mov edx, 0x46ef00
mov cl, byte [edx]
lea edx, [edx + 1]
mov al, cl
sub al, 0x1e
mov byte [edx - 1], al
cmp cl, 0x1e
jne 0x4203b6
mov edx, str.pmaicwR_qk_pr_
nop dword [eax]
mov cl, byte [edx]
lea edx, [edx + 1]
mov al, cl
sub al, 0x1e
mov byte [edx - 1], al
cmp cl, 0x1e
jne 0x4203d0
mov edx, 0x46ef2c
mov cl, byte [edx]
lea edx, [edx + 1]
mov al, cl
sub al, 0x1e
mov byte [edx - 1], al
cmp cl, 0x1e
jne 0x4203e6
mov edx, 0x46ef60
nop dword [eax]
mov cl, byte [edx]
lea edx, [edx + 1]
mov al, cl
sub al, 0x1e
mov byte [edx - 1], al
cmp cl, 0x1e
jne 0x420400
mov edx, 0x46ef7c
mov cl, byte [edx]
lea edx, [edx + 1]
mov al, cl
sub al, 0x1e
mov byte [edx - 1], al
cmp cl, 0x1e
jne 0x420416
mov edx, 0x46efa8
nop dword [eax]
mov cl, byte [edx]
lea edx, [edx + 1]
mov al, cl
sub al, 0x1e
mov byte [edx - 1], al
cmp cl, 0x1e
jne 0x420430
mov edx, 0x46efd8
mov cl, byte [edx]
lea edx, [edx + 1]
mov al, cl
sub al, 0x1e
mov byte [edx - 1], al
cmp cl, 0x1e
jne 0x420446
mov edx, 0x46efb4
nop dword [eax]
mov cl, byte [edx]
lea edx, [edx + 1]
mov al, cl
sub al, 0x1e
mov byte [edx - 1], al
cmp cl, 0x1e
jne 0x420460
mov edx, 0x46efc8
mov cl, byte [edx]
lea edx, [edx + 1]
mov al, cl
sub al, 0x1e
mov byte [edx - 1], al
cmp cl, 0x1e
jne 0x420476
push ebx
call fcn.0041fc80
mov bl, al
test bl, bl
je 0x4204a8
push 0
push 0
push 0
push 0x41fc20
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov al, bl
pop ebx
pop ebp
ret
Function at 0x427e10
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x46f084]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, ecx
cmp dword [esi + 0x38], 0
je 0x427ecc
cmp byte [esi + 0x3d], 0
je 0x427ecc
mov eax, dword [esi]
push edi
push 0xffffffffffffffff
call dword [eax + 0xc]
cmp eax, 0xffffffff
je 0x427eba
mov ecx, dword [esi + 0x38]
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [esi + 0x40]
push eax
call dword [sym.imp.MSVCP140.dll_public:_int___thiscall_std::codecvt_char__char__struct__Mbstatet_::unshift_struct__Mbstatet___char___char___char___const]
sub eax, 0
je 0x427e81
sub eax, 1
je 0x427e85
sub eax, 2
jne 0x427eba
mov byte [esi + 0x3d], al
mov al, 1
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0042df20
mov esp, ebp
pop ebp
ret
mov byte [esi + 0x3d], 0
mov edi, dword [ebp - 0x28]
lea eax, [ebp - 0x24]
sub edi, eax
je 0x427ea3
push dword [esi + 0x4c]
push edi
push 1
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
add esp, 0x10
cmp edi, eax
jne 0x427eba
cmp byte [esi + 0x3d], 0
pop edi
sete al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0042df20
mov esp, ebp
pop ebp
ret
pop edi
xor al, al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0042df20
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
mov al, 1
xor ecx, ebp
pop esi
call fcn.0042df20
mov esp, ebp
pop ebp
ret
Function at 0x4280b0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
mov eax, dword [0x46f084]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, ecx
cmp ebx, 0xffffffff
jne 0x4280e0
pop esi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0042df20
mov esp, ebp
pop ebp
ret 4
mov eax, dword [esi + 0x20]
mov eax, dword [eax]
test eax, eax
je 0x428110
mov edx, dword [esi + 0x30]
mov edx, dword [edx]
add edx, eax
cmp eax, edx
jae 0x428110
call dword [sym.imp.MSVCP140.dll_protected:_char____thiscall_std::basic_streambuf_char__struct_std::char_traits_char__::_Pninc_void_]
pop esi
mov byte [eax], bl
mov eax, ebx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0042df20
mov esp, ebp
pop ebp
ret 4
cmp dword [esi + 0x4c], 0
push edi
je 0x42820d
mov edi, dword [esi + 0xc]
lea eax, [esi + 0x3c]
cmp dword [edi], eax
jne 0x428139
mov edx, dword [esi + 0x54]
mov ecx, dword [esi + 0x50]
sub edx, ecx
mov dword [edi], ecx
mov eax, dword [esi + 0x1c]
mov dword [eax], ecx
mov eax, dword [esi + 0x2c]
mov dword [eax], edx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x42816d
push dword [esi + 0x4c]
movsx eax, bl
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
add esp, 8
or ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, ebx
pop edi
pop esi
mov eax, ecx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0042df20
mov esp, ebp
pop ebp
ret 4
lea eax, [ebp - 0x2c]
mov byte [ebp - 0x28], bl
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 0x27]
push eax
lea eax, [ebp - 0x28]
push eax
lea eax, [esi + 0x40]
push eax
call dword [sym.imp.MSVCP140.dll_public:_int___thiscall_std::codecvt_char__char__struct__Mbstatet_::out_struct__Mbstatet___char_const___char_const___char_const____char___char___char___const]
sub eax, 0
je 0x4281cc
sub eax, 1
je 0x4281cc
sub eax, 2
jne 0x42820d
push dword [esi + 0x4c]
push dword [ebp - 0x28]
call fcn.004273d0
add esp, 8
or ecx, 0xffffffff
test al, al
cmovne ecx, ebx
pop edi
pop esi
mov eax, ecx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0042df20
mov esp, ebp
pop ebp
ret 4
mov edi, dword [ebp - 0x2c]
lea eax, [ebp - 0x24]
sub edi, eax
je 0x4281ea
push dword [esi + 0x4c]
push edi
push 1
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
add esp, 0x10
cmp edi, eax
jne 0x42820d
lea ecx, [ebp - 0x28]
mov byte [esi + 0x3d], 1
or eax, 0xffffffff
cmp dword [ebp - 0x30], ecx
pop edi
pop esi
cmovne eax, ebx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0042df20
mov esp, ebp
pop ebp
ret 4
mov ecx, dword [ebp - 4]
or eax, 0xffffffff
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0042df20
mov esp, ebp
pop ebp
ret 4
Function at 0x4297c0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0x10]
sub esp, 8
push ebx
mov ebx, ecx
mov ecx, dword [ebp + 0xc]
test eax, eax
jg 0x4297e4
jl 0x4297d9
test ecx, ecx
jne 0x4297e4
xor eax, eax
xor edx, edx
pop ebx
mov esp, ebp
pop ebp
ret 0xc
cmp dword [ebx + 0x38], 0
je 0x4297fe
push eax
push ecx
push dword [ebp + 8]
mov ecx, ebx
call dword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____thiscall_std::basic_streambuf_char__struct_std::char_traits_char__::xsgetn_char___long_long___int64__]
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov eax, dword [ebx + 0x1c]
push esi
push edi
mov edi, ecx
mov eax, dword [eax]
mov dword [ebp - 8], eax
test eax, eax
je 0x42984a
mov eax, dword [ebx + 0x2c]
lea edx, [ebx + 0x2c]
mov dword [ebp - 4], edx
mov eax, dword [eax]
test eax, eax
je 0x429850
mov edi, dword [ebp + 8]
cmp eax, ecx
mov esi, ecx
cmovb esi, eax
push esi
push dword [ebp - 8]
push edi
call sub.VCRUNTIME140.dll_memcpy
mov eax, dword [ebx + 0x2c]
add edi, esi
mov dword [ebp + 8], edi
add esp, 0xc
mov edi, dword [ebp + 0xc]
sub edi, esi
sub dword [eax], esi
mov eax, dword [ebx + 0x1c]
add dword [eax], esi
jmp 0x429850
lea eax, [ebx + 0x2c]
mov dword [ebp - 4], eax
cmp dword [ebx + 0x4c], 0
mov esi, dword [ebp + 8]
je 0x4298c6
mov ecx, dword [ebx + 0xc]
lea eax, [ebx + 0x3c]
cmp dword [ecx], eax
jne 0x42987c
mov eax, dword [ebx + 0xc]
mov edx, dword [ebx + 0x54]
mov ecx, dword [ebx + 0x50]
sub edx, ecx
mov dword [eax], ecx
mov eax, dword [ebx + 0x1c]
mov dword [eax], ecx
mov eax, dword [ebp - 4]
mov eax, dword [eax]
mov dword [eax], edx
mov eax, dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
cmp edi, 0xfff
jbe 0x4298b4
nop dword [eax]
push dword [ebx + 0x4c]
push 0xfff
push 1
push esi
call eax
add esp, 0x10
add esi, eax
sub edi, eax
cmp eax, 0xfff
jne 0x4298c6
cmp edi, eax
mov eax, dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
ja 0x429890
test edi, edi
je 0x4298c6
push dword [ebx + 0x4c]
push edi
push 1
push esi
call eax
add esp, 0x10
sub edi, eax
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 0x10]
sub eax, edi
pop edi
pop esi
sbb edx, 0
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x4298e0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
mov ebx, ecx
cmp dword [ebx + 0x38], 0
je 0x429905
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____thiscall_std::basic_streambuf_char__struct_std::char_traits_char__::xsputn_char_const___long_long___int64__]
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov eax, dword [ebx + 0x20]
push esi
mov esi, dword [ebp + 0xc]
push edi
mov ecx, dword [eax]
lea eax, [ebx + 0x30]
mov edi, dword [ebp + 0x10]
mov dword [ebp - 0x10], esi
mov dword [ebp - 0x14], edi
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], eax
test ecx, ecx
je 0x42992b
mov eax, dword [eax]
mov ecx, dword [eax]
jmp 0x429930
xor ecx, ecx
mov dword [ebp - 8], eax
mov eax, ecx
cdq
mov dword [ebp + 0x10], eax
mov ecx, edx
mov dword [ebp - 4], ecx
test edi, edi
jl 0x429990
jg 0x429945
test esi, esi
je 0x429990
test ecx, ecx
jl 0x42998b
jg 0x42994f
test eax, eax
je 0x42998b
cmp edi, ecx
jg 0x429961
jl 0x429959
cmp esi, eax
jae 0x429961
mov eax, esi
mov dword [ebp + 0x10], esi
mov dword [ebp - 4], edi
push eax
push dword [ebp + 8]
push dword [ebp - 0xc]
call sub.VCRUNTIME140.dll_memcpy
mov eax, dword [ebp - 8]
add esp, 0xc
mov edx, dword [ebp + 0x10]
mov ecx, dword [ebp + 8]
add ecx, edx
sub esi, edx
mov eax, dword [eax]
sbb edi, dword [ebp - 4]
sub dword [eax], edx
mov eax, dword [ebx + 0x20]
add dword [eax], edx
jmp 0x429993
mov ecx, dword [ebp + 8]
jmp 0x42999d
mov ecx, dword [ebp + 8]
test edi, edi
jl 0x4299b7
jg 0x42999d
test esi, esi
je 0x4299b7
mov eax, dword [ebx + 0x4c]
test eax, eax
je 0x4299b7
push eax
push esi
push 1
push ecx
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
add esp, 0x10
sub esi, eax
sbb edi, 0
mov eax, dword [ebp - 0x10]
mov edx, dword [ebp - 0x14]
sub eax, esi
sbb edx, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc

Function at 0x429ca0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4300d3
mov eax, dword fs:[0]
push eax
sub esp, 8
push esi
push edi
mov eax, dword [0x46f084]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x10], edi
push 0x1c
mov dword [edi], 0
mov dword [edi + 4], 0
call fcn.0042e12b
mov dword [eax], eax
mov dword [eax + 4], eax
mov dword [eax + 8], eax
mov word [eax + 0xc], 0x101
mov dword [edi], eax
lea esi, [edi + 8]
mov dword [ebp - 4], 0
push 0x30
mov dword [ebp - 0x14], esi
mov dword [esi], 0
mov dword [esi + 4], 0
call fcn.0042e12b
add esp, 8
mov dword [eax], eax
mov dword [eax + 4], eax
mov dword [eax + 8], eax
mov word [eax + 0xc], 0x101
mov dword [esi], eax
mov dword [edi + 0x10], 0
mov dword [edi + 0x1c], 0
mov dword [edi + 0x2c], 0
mov dword [edi + 0x30], 0xf
mov byte [edi + 0x1c], 0
mov ecx, edi
mov byte [ebp - 4], 2
mov dword [edi + 0x34], 0
mov dword [edi + 0x38], 0
call fcn.0042a270
push dword [ebp + 0xc]
mov ecx, edi
push dword [ebp + 8]
call fcn.0042a2f0
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 8