joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10002c30
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x14
mov dword [esp], ecx
mov edx, dword [esp + 0x2c]
mov edi, dword [edx]
mov ecx, dword [edx + 4]
test ecx, ecx
mov dword [esp + 4], ecx
je 0x10002c5e
mov esi, ecx
and esi, 3
cmp ecx, 4
jae 0x10002c65
mov eax, 0x811c9dc5
xor ebp, ebp
jmp 0x10002caa
mov eax, 0x811c9dc5
jmp 0x10002cd2
and ecx, 0xfffffffc
mov eax, 0x811c9dc5
xor ebp, ebp
nop
movzx ebx, byte [edi + ebp]
xor ebx, eax
imul eax, ebx, 0x1000193
movzx ebx, byte [edi + ebp + 1]
xor ebx, eax
imul eax, ebx, 0x1000193
movzx ebx, byte [edi + ebp + 2]
xor ebx, eax
imul eax, ebx, 0x1000193
movzx ebx, byte [edi + ebp + 3]
xor ebx, eax
imul eax, ebx, 0x1000193
add ebp, 4
cmp ecx, ebp
jne 0x10002c70
test esi, esi
je 0x10002cd2
add ebp, edi
xor ecx, ecx
nop word cs:[eax + eax]
movzx ebx, byte [ebp + ecx]
xor ebx, eax
imul eax, ebx, 0x1000193
inc ecx
cmp esi, ecx
jne 0x10002cc0
mov ebp, dword [edx + 8]
mov ecx, dword [edx + 0xc]
test ecx, ecx
mov dword [esp + 8], ecx
je 0x10002cfb
mov edx, ecx
and edx, 3
mov dword [esp + 0x10], edx
cmp ecx, 4
mov dword [esp + 0xc], edi
jae 0x10002d02
mov ebx, 0x811c9dc5
xor esi, esi
jmp 0x10002d4b
mov ecx, 0x2393b8a
jmp 0x10002d7b
and ecx, 0xfffffffc
mov ebx, 0x811c9dc5
xor esi, esi
nop dword [eax]
movzx edx, byte [ebp + esi]
xor edx, ebx
imul edx, edx, 0x1000193
movzx ebx, byte [ebp + esi + 1]
xor ebx, edx
imul edx, ebx, 0x1000193
movzx ebx, byte [ebp + esi + 2]
xor ebx, edx
imul ebx, ebx, 0x1000193
movzx edx, byte [ebp + esi + 3]
xor edx, ebx
imul ebx, edx, 0x1000193
add esi, 4
cmp ecx, esi
jne 0x10002d10
mov edi, dword [esp + 0x10]
test edi, edi
je 0x10002d71
add esi, ebp
xor ecx, ecx
nop word [eax + eax]
movzx edx, byte [esi + ecx]
xor edx, ebx
imul ebx, edx, 0x1000193
inc ecx
cmp edi, ecx
jne 0x10002d60
imul ecx, edx, 0x2000326
mov edi, dword [esp + 0xc]
xor ecx, eax
mov eax, dword [esp]
and ecx, dword [eax + 0x18]
mov edx, dword [eax + 4]
mov eax, dword [eax + 0xc]
mov esi, dword [eax + ecx*8 + 4]
xor ebx, ebx
cmp esi, edx
je 0x10002e0a
mov dword [esp], edx
add ecx, ecx
mov ebx, dword [eax + ecx*4]
mov ecx, dword [esp + 4]
cmp ecx, dword [esi + 0xc]
jne 0x10002df0
nop word cs:[eax + eax]
test ecx, ecx
je 0x10002dc9
push ecx
push dword [esi + 8]
push edi
call fcn.1000557e
mov ecx, dword [esp + 0x10]
add esp, 0xc
test eax, eax
jne 0x10002df0
mov eax, dword [esp + 8]
cmp eax, dword [esi + 0x14]
jne 0x10002df0
mov eax, dword [esp + 8]
test eax, eax
je 0x10002e05
push eax
push dword [esi + 0x10]
push ebp
call fcn.1000557e
mov ecx, dword [esp + 0x10]
add esp, 0xc
test eax, eax
je 0x10002e05
nop
cmp esi, ebx
je 0x10002dfe
mov esi, dword [esi + 4]
cmp ecx, dword [esi + 0xc]
je 0x10002db0
jmp 0x10002df0
mov edx, dword [esp]
xor ebx, ebx
jmp 0x10002e0a
mov ebx, esi
mov edx, dword [esp]
test ebx, ebx
cmovne edx, ebx
mov eax, dword [esp + 0x28]
mov dword [eax], edx
add esp, 0x14
pop esi
pop edi
pop ebx
pop ebp
ret 8
Function at 0x10002ec0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x20
mov esi, ecx
mov eax, dword [ebp + 8]
mov dword [ebp - 0x1c], esp
mov dword [ebp - 0x10], 0xffffffff
lea ecx, [ebp - 0x18]
mov dword [ebp - 0x14], 0x10003c90
mov edx, dword fs:[0]
mov dword [ebp - 0x18], edx
mov dword fs:[0], ecx
mov eax, dword [eax]
mov dword [esi], eax
lea eax, [esi + 4]
mov dword [ebp - 0x24], eax
mov dword [esi + 4], 0
mov dword [esi + 8], 0
push 0x1c
call fcn.10003caa
add esp, 4
mov dword [eax], eax
mov dword [eax + 4], eax
mov dword [ebp - 0x28], eax
mov dword [esi + 4], eax
lea eax, [esi + 0xc]
mov dword [ebp - 0x20], eax
movaps xmm0, xmmword [0x10054340]
movups xmmword [esi + 0xc], xmm0
mov dword [esi + 0x1c], 8
mov dword [ebp - 0x2c], esi
mov dword [esi], 0x3f800000
mov dword [ebp - 0x10], 0
push 0x40
call fcn.10003caa
add esp, 4
mov esi, eax
mov edi, dword [ebp - 0x2c]
mov ecx, dword [edi + 0xc]
mov eax, dword [edi + 0x14]
sub eax, ecx
je 0x10002f84
cmp eax, 0x1000
jb 0x10002f7a
mov edx, dword [ecx - 4]
add ecx, 0xfffffffc
sub ecx, edx
cmp ecx, 0x20
jae 0x10002fc4
add eax, 0x23
mov ecx, edx
push eax
push ecx
call fcn.10003cdf
add esp, 8
mov dword [edi + 0xc], esi
mov eax, esi
add eax, 0x40
mov dword [edi + 0x10], eax
mov dword [edi + 0x14], eax
movd xmm0, dword [ebp - 0x28]
pshufd xmm0, xmm0, 0
movdqu xmmword [esi], xmm0
movdqu xmmword [esi + 0x10], xmm0
movdqu xmmword [esi + 0x20], xmm0
movdqu xmmword [esi + 0x30], xmm0
mov eax, dword [ebp - 0x18]
mov dword fs:[0], eax
mov eax, edi
add esp, 0x20
pop esi
pop edi
pop ebx
pop ebp
ret 8
call fcn.10007ee6
nop dword [eax]
push ebp
sub esp, 8
add ebp, 0xc
mov ecx, dword [ebp - 0x20]
call fcn.100028f0
mov ecx, dword [ebp - 0x24]
call fcn.10003170
add esp, 8
pop ebp
ret
Function at 0x1000409c
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
push esi
mov ecx, dword [eax + 0x3c]
add ecx, eax
movzx eax, word [ecx + 0x14]
lea edx, [ecx + 0x18]
add edx, eax
movzx eax, word [ecx + 6]
imul esi, eax, 0x28
add esi, edx
jmp 0x100040d1
mov ecx, dword [edx + 0xc]
cmp dword [ebp + 0xc], ecx
jb 0x100040ce
mov eax, dword [edx + 8]
add eax, ecx
cmp dword [ebp + 0xc], eax
jb 0x100040da
add edx, 0x28
cmp edx, esi
jne 0x100040bc
xor eax, eax
pop esi
pop ebp
ret
mov eax, edx
jmp 0x100040d7

Function at 0x10007342
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x10007381
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x10007381
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x10007381
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x10007381
cmp dword [ecx + 0x74], 0xe
jbe 0x10007381
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret

Function at 0x100095f0
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x1000961d
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x1000961d
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret
Function at 0x1000c4e4
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
je 0x1000c581
push ebx
push esi
call fcn.1000c584
xor ebx, ebx
sub eax, esi
push ebx
push ebx
push ebx
push ebx
sar eax, 1
push eax
push esi
push ebx
push ebx
mov dword [ebp - 8], eax
call fcn.1000c3ea
add esp, 0x24
mov dword [ebp - 4], eax
test eax, eax
jne 0x1000c52e
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x1000c580
push edi
push eax
call fcn.1000c970
mov edi, eax
pop ecx
push ebx
test edi, edi
jne 0x1000c54e
call fcn.1000ada0
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x1000c57f
push ebx
push dword [ebp - 4]
push edi
push dword [ebp - 8]
push esi
push ebx
push ebx
call fcn.1000c3ea
add esp, 0x20
test eax, eax
jne 0x1000c56d
push edi
call fcn.1000ada0
jmp 0x1000c575
push ebx
call fcn.1000ada0
mov ebx, edi
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, ebx
pop edi
pop ebx
pop esi
leave
ret
Function at 0xb006f80
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x84
mov dword [ebp - 0x60], 1
mov dword [ebp - 0x1c], 0x20
mov dword [ebp - 0x28], 0x13
mov dword [ebp - 0x54], 0x20
mov dword [ebp - 0x30], 0
mov dword [ebp - 0x14], 0
mov eax, dword [ebp - 0x54]
mov dword [ebp - 0x74], eax
mov byte [ebp - 0x45], 0x2d
mov dword [ebp - 0x4c], 0x30
mov dword [ebp - 0x64], 0x13
mov dword [ebp - 0x5c], 0x21
mov dword [ebp - 0x58], 0
mov eax, dword [ebp - 0x5c]
mov dword [ebp - 0x78], eax
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x10], 0
mov word [ebp - 0x3e], 0x61e4
mov dword [ebp - 0x3c], 0
mov dword [ebp - 0x68], 0x20001009
mov dword [ebp - 0x34], 0xb8b0
mov dword [ebp - 0x6c], 0
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x7c], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x44], eax
mov dword [ebp - 0x24], 0
mov dword [ebp - 0x38], 0
mov dword [ebp - 0x70], 0
mov edi, 0x13
lea eax, [ebp - 0x6c]
mov cl, al
mov esi, eax
add cl, 0xd8
mov byte [ebp - 0x7d], cl
lea ebx, [ebp - 0x10]
jmp 0xb007077
mov eax, 1
add dword [ebp - 0x38], eax
mov ax, word [ebp - 0x3e]
lea ecx, [ebp - 0x58]
or ax, cx
add byte [ebp - 0x45], 0x9b
mov cx, word [ebp - 0x3e]
mov word [ebp - 0x3e], ax
add cx, 0x4e9e
mov word [ebp - 0x3e], cx
movzx eax, byte [0xb00bdfc]
mov ecx, dword [ebp - 0x38]
mov byte [ebp - 0x45], 0x28
mov byte [ebp - 0x45], 0xd8
mov dl, byte [ebp - 0x7d]
mov byte [ebp - 0x45], dl
cmp ecx, eax
jae 0xb0071aa
mov dword [ebp - 0x58], 0
mov eax, dword [ebp - 0x38]
or dword [ebp - 0x6c], esi
xor edx, edx
div dword [ebp - 0x78]
cmp edx, edi
jne 0xb007100
mov eax, dword [ebp - 0x24]
xor edx, edx
div dword [ebp - 0x38]
lea eax, [ebp - 0x3e]
sub eax, dword [ebp - 0x30]
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x14], ecx
mov byte [0xb00d707], dl
mov eax, 0x20001009
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x7c]
mov dword [esp], eax
mov dword [esp + 0xc], 2
mov dword [esp + 8], 0xb00d82d
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
sub esp, 0x10
jmp 0xb007138
mov ax, word [ebp - 0x3e]
mov dword [ebp - 0x58], 0
neg ax
mov word [ebp - 0x3e], ax
mov eax, dword [ebp - 0x38]
mov ecx, dword [ebp - 0x10]
mov dword [ebp - 0x10], ecx
xor edx, edx
div dword [ebp - 0x74]
mov dword [esp + 8], edx
mov dword [esp + 4], 0xb00d82d
mov dword [esp], 0xb00d707
call fcn.0b003ff0
mov eax, dword [ebp - 0x38]
and dword [ebp - 0x30], ebx
xor edx, edx
mov ecx, 0x30
div ecx
cmp edx, edi
jne 0xb007170
mov eax, dword [ebp - 0x24]
xor edx, edx
div dword [ebp - 0x38]
mov eax, dword [ebp - 0x58]
or eax, ebx
mov dword [ebp - 0x10], eax
mov byte [0xb00d707], dl
jmp 0xb007050
mov eax, dword [ebp - 0x38]
xor edx, edx
mov ecx, 0x20
div ecx
mov di, 0x3df1
sub di, word [ebp - 0x3e]
mov dword [esp + 8], edx
mov dword [esp + 4], 0xb00d82d
mov dword [esp], 0xb00d707
call fcn.0b003ff0
mov word [ebp - 0x3e], di
mov edi, 0x13
jmp 0xb007050
mov eax, dword [ebp - 0x24]
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x14], ecx
add esp, 0x84
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x49deb0
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x91000]
push edi
or ebp, 0xffffffff
jmp 0x49ded2
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x49ded9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x49dec8
mov eax, 1
add ebx, ebx
jne 0x49deeb
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x49dee0
jne 0x49defc
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x49dee0
xor ecx, ecx
sub eax, 3
jb 0x49df10
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x49df82
mov ebp, eax
add ebx, ebx
jne 0x49df1b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x49df28
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x49df4c
inc ecx
add ebx, ebx
jne 0x49df38
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x49df2d
jne 0x49df49
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x49df2d
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x49df6c
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x49df5d
jmp 0x49dece
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x49df6c
add edi, ecx
jmp 0x49dece
pop esi
mov edi, esi
mov ecx, 0xbb0
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x49df8a
cmp byte [edi], 0xd
jne 0x49df8a
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov eax, ebx
loop 0x49df8f
lea edi, [esi + 0x9b000]
mov eax, dword [edi]
or eax, eax
je 0x49dffe
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x9e4a0]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x9e518]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x49dfbc
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x9e51c]
or eax, eax
je 0x49dff8
mov dword [ebx], eax
add ebx, 4
jmp 0x49dfd9
call dword [esi + 0x9e520]
popal
jmp 0x41b6b4
Function at 0x48b410
Capabilities:
Read file on windows
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
mov edi, ecx
cmp dword [edi + 0x8c], 1
jne 0x48b49f
xor eax, eax
cmp dword [edi + 0x60], 8
mov word [ebp - 8], ax
mov dword [ebp - 4], eax
lea eax, [edi + 0x4c]
jb 0x48b43b
mov eax, dword [eax]
push str.rb__ccsUTF_8
push eax
lea eax, [ebp - 4]
push eax
call fcn.0068bec4
mov eax, dword [ebp - 4]
add esp, 0xc
test eax, eax
je 0x48b49f
push eax
push 2
lea eax, [ebp - 8]
push 1
push eax
call fcn.0068c399
push dword [ebp - 4]
call fcn.0068bfa4
mov cl, byte [ebp - 8]
add esp, 0x14
mov al, byte [ebp - 7]
cmp cl, 0xff
jne 0x48b47c
cmp al, 0xfe
je 0x48b49f
cmp al, 0xff
jne 0x48b485
cmp cl, 0xfe
je 0x48b49f
mov eax, dword [ebx]
test eax, eax
je 0x48b498
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebx], 0
mov ecx, edi
call fcn.0048ca10
cmp dword [edi + 0x60], 8
lea esi, [edi + 0x4c]
jb 0x48b4ac
mov eax, dword [esi]
jmp 0x48b4ae
mov eax, esi
push 0
push 0x80
push 3
push 0
push 3
push 0x40000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [ebx], eax
cmp eax, 0xffffffff
jne 0x48b54c
cmp dword [esi + 0x14], 8
jb 0x48b4d6
mov esi, dword [esi]
push 0
push 0x80
push 1
push 0
push 3
push 0x40000000
push esi
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [ebx], eax
cmp eax, 0xffffffff
jne 0x48b501
pop edi
pop esi
xor al, al
pop ebx
mov esp, ebp
pop ebp
ret 4
cmp dword [edi + 0x8c], 1
push 0
jne 0x48b531
mov ecx, 0xfeff
mov word [ebp - 4], cx
lea ecx, [ebp - 8]
push ecx
push 2
lea ecx, [ebp - 4]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop edi
pop esi
mov al, 1
pop ebx
mov esp, ebp
pop ebp
ret 4
lea ecx, [ebp - 8]
mov word [ebp - 4], 0xbbef
push ecx
push 3
lea ecx, [ebp - 4]
mov byte [ebp - 2], 0xbf
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop edi
pop esi
mov al, 1
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x48bb00
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, dword [ebp + 8]
mov ebx, ecx
lea ecx, [esi + 2]
nop
mov ax, word [esi]
add esi, 2
test ax, ax
jne 0x48bb10
push 2
push 0
push 0
push dword [ebx + 0x68]
sub esi, ecx
sar esi, 1
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
push 0
lea eax, [ebp - 4]
mov dword [ebp - 4], 0
push eax
add esi, esi
push esi
push dword [ebp + 8]
push dword [ebx + 0x68]
call dword [sym.imp.KERNEL32.dll_WriteFile]
push 0
lea eax, [ebp - 4]
mov dword [ebp - 4], 0
push eax
push 4
push 0x787214
push dword [ebx + 0x68]
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x48bb70
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, dword [ebp + 8]
mov ebx, ecx
lea ecx, [esi + 1]
nop
mov al, byte [esi]
inc esi
test al, al
jne 0x48bb80
push 2
push 0
push 0
push dword [ebx + 0x68]
sub esi, ecx
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
push 0
lea eax, [ebp - 4]
mov dword [ebp - 4], 0
push eax
push esi
push dword [ebp + 8]
push dword [ebx + 0x68]
call dword [sym.imp.KERNEL32.dll_WriteFile]
push 0
lea eax, [ebp - 4]
mov dword [ebp - 4], 0
push eax
push 2
push 0x78721c
push dword [ebx + 0x68]
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x491270
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x6cb7b0
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x806f14]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, ecx
mov dword [ebp - 0x10], eax
push 8
mov dword [eax], vtable.std::basic_streambuf_wchar_t__struct_std::char_traits_wchar_t__.0
call fcn.0066c51d
mov esi, eax
push 1
mov dword [ebp - 4], 0
call fcn.0066e9f4
mov dword [esi + 4], eax
add esp, 8
mov eax, dword [ebp - 0x10]
lea edi, [eax + 0x14]
lea ecx, [eax + 0x18]
lea edx, [eax + 0x24]
mov dword [eax + 0x34], esi
lea ebx, [eax + 4]
mov dword [eax + 0xc], ebx
lea esi, [eax + 8]
mov dword [eax + 0x10], esi
mov dword [eax + 0x1c], edi
mov dword [eax + 0x20], ecx
mov dword [eax + 0x2c], edx
add eax, 0x28
mov dword [ebp - 0x14], ebx
mov ebx, dword [ebp - 0x10]
mov dword [ebx + 0x30], eax
mov ebx, dword [ebp - 0x14]
mov dword [esi], 0
mov dword [ecx], 0
mov dword [eax], 0
mov eax, dword [ebp - 0x10]
mov dword [ebx], 0
mov dword [edi], 0
mov dword [edx], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4945a0
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, ecx
push ebx
push esi
lea esi, [eax + 0x4c]
mov dword [ebp - 0xc], eax
xor bl, bl
cmp dword [esi + 0x14], 8
push edi
jb 0x4945bd
mov eax, dword [esi]
jmp 0x4945bf
mov eax, esi
push 0
push 0x80
push 3
push 0
push 3
push SysReAllocString
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
cmp edi, 0xffffffff
jne 0x4945ea
pop edi
pop esi
xor al, al
pop ebx
mov esp, ebp
pop ebp
ret 4
lea eax, [ebp - 0x14]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
je 0x494609
mov eax, dword [ebp - 0x14]
mov bl, 1
mov dword [ebp - 8], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 4], eax
jmp 0x494615
mov eax, dword [ebp - 0x10]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 8], eax
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test bl, bl
je 0x49468b
cmp dword [ebp - 4], 0
jl 0x49468b
jg 0x494631
cmp dword [ebp - 8], 0xa00000
jb 0x49468b
mov ebx, dword [ebp - 0xc]
mov eax, dword [ebx + 0x68]
lea edi, [ebx + 0x68]
test eax, eax
je 0x494645
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [esi + 0x14], 8
jb 0x49464d
mov esi, dword [esi]
push 0
push 0x80
push 5
push 0
push 3
push 0x40000000
push esi
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [edi], eax
test eax, eax
je 0x494679
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [edi], 0
mov eax, dword [ebx]
mov ecx, ebx
push edi
mov eax, dword [eax]
call eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
pop edi
pop esi
mov al, bl
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x495160
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, dword [ebp + 8]
mov ebx, ecx
push edi
test esi, esi
je 0x4951c3
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
test eax, eax
je 0x4951c3
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x495192
pop edi
shr eax, 4
pop esi
and al, 1
pop ebx
pop ebp
ret 4
push esi
call fcn.006a3ec5
mov edi, eax
push 0x5c
push edi
call fcn.006ca73a
add esp, 0xc
test eax, eax
je 0x4951e1
xor ecx, ecx
mov word [eax], cx
mov ecx, ebx
push edi
call fcn.00495160
push edi
test al, al
jne 0x4951cc
call fcn.006970b0
add esp, 4
pop edi
pop esi
xor al, al
pop ebx
pop ebp
ret 4
call fcn.006970b0
add esp, 4
push 0
push esi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
je 0x4951c3
pop edi
pop esi
mov al, 1
pop ebx
pop ebp
ret 4
Function at 0x498fd0
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x6cbb49
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x806f14]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
mov dword [esi + 8], 0xffffffff
mov dword [esi + 4], 0xffffffff
mov dword [esi + 0xc], 0
mov dword [esi + 0x20], 0x80cfc0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 5
mov dword [esi + 0x18], 0
mov dword [esi + 0x1c], 0
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
lea ecx, [esi + 0x2c]
mov dword [esi], vtable.TiXmlDeclaration.0
mov dword [ebp - 4], 0
mov dword [ecx], 0x80cfc0
mov dword [esi + 0x30], 0x80cfc0
mov dword [esi + 0x34], 0x80cfc0
mov edi, dword [ebp + 8]
mov edx, edi
mov byte [ebp - 4], 3
lea ebx, [edx + 1]
mov al, byte [edx]
inc edx
test al, al
jne 0x499071
sub edx, ebx
push edx
push edi
call fcn.00498d00
mov edi, dword [ebp + 0xc]
mov edx, edi
lea ecx, [edx + 1]
nop dword [eax]
mov al, byte [edx]
inc edx
test al, al
jne 0x499090
sub edx, ecx
lea ecx, [esi + 0x30]
push edx
push edi
call fcn.00498d00
mov edi, dword [ebp + 0x10]
mov edx, edi
lea ecx, [edx + 1]
nop dword [eax + eax]
mov al, byte [edx]
inc edx
test al, al
jne 0x4990b0
sub edx, ecx
lea ecx, [esi + 0x34]
push edx
push edi
call fcn.00498d00
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc

Function at 0x4990e0
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x6cbb83
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x806f14]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
mov dword [esi + 8], 0xffffffff
mov dword [esi + 4], 0xffffffff
mov dword [esi + 0xc], 0
mov dword [esi + 0x20], 0x80cfc0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
mov dword [esi + 0x18], 0
mov dword [esi + 0x1c], 0
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
lea ecx, [esi + 0x34]
mov dword [esi], vtable.TiXmlDocument.0
mov dword [ebp - 4], 0
mov dword [ecx], 0x80cfc0
mov dword [esi + 0x40], 0xffffffff
mov dword [esi + 0x3c], 0xffffffff
push 0
push 0x728b70
mov byte [ebp - 4], 1
mov dword [esi + 0x38], 4
mov byte [esi + 0x44], 0
mov byte [esi + 0x2c], 0
mov dword [esi + 0x30], 0
call fcn.00498d00
mov dword [esi + 0x40], 0
mov eax, esi
mov dword [esi + 0x3c], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret