joyce8/EMBER2024-capa huggingface dataset:
Function at 0xfb287b
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 0xc]
push esi
push edi
push 1
xor edi, edi
pop eax
cmp ebx, eax
jl 0xfb2892
cmp ebx, 8
jle 0xfb2894
xor eax, eax
mov esi, dword [ebp + 8]
push 0xfc5258
push eax
push esi
call fcn.00fb1409
lea ecx, [esi + 0x6af70]
lea eax, [esi + 0x6af78]
add esp, 0xc
cmp dword [ecx], edi
mov dword [eax], edi
jne 0xfb28c4
mov dword [eax], 1
mov dword [ecx], 0x10000
push 0x1fffc
lea eax, [esi + 0x4af70]
push edi
push eax
mov dword [esi + 0x6af6c], edi
call fcn.00fb5536
mov eax, ebx
add esp, 0xc
shl eax, 3
cmp ebx, 2
movzx ecx, word [eax + 0xfbbde2]
mov dword [esi + 0x6af98], ecx
movzx ecx, word [eax + 0xfbbde0]
mov dword [esi + 0x6af9c], ecx
movzx ecx, word [eax + 0xfbbde4]
mov dword [esi + 0x6afa0], ecx
movzx eax, word [eax + 0xfbbde6]
mov dword [esi + 0x6af94], eax
jg 0xfb2925
mov eax, dword [ebp + 0x10]
or byte [eax], 4
jmp 0xfb2930
cmp ebx, 8
jl 0xfb2930
mov eax, dword [ebp + 0x10]
or byte [eax], 2
lea ebx, [esi + 0x1af70]
push 0x10000
push ebx
push esi
mov dword [esi + 0x6af84], edi
mov dword [esi + 0x6af74], edi
call dword [esi + 0xc]
add esp, 0xc
cmp eax, edi
mov dword [esi + 0x6af90], eax
je 0xfb29a0
cmp eax, 0xffffffff
je 0xfb29a0
cmp eax, 0x106
mov dword [esi + 0x6af8c], edi
jae 0xfb2972
push esi
call fcn.00fb2b78
pop ecx
mov dword [esi + 0x6af7c], edi
movzx eax, byte [ebx + edi]
mov ecx, dword [esi + 0x6af7c]
and eax, 0x7fff
and ecx, 0x3ff
shl ecx, 5
xor eax, ecx
inc edi
cmp edi, 2
mov dword [esi + 0x6af7c], eax
jb 0xfb2978
jmp 0xfb29b0
mov dword [esi + 0x6af8c], 1
mov dword [esi + 0x6af90], edi
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0xfb2ca0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, dword [ebp + 8]
xor ebx, ebx
mov dword [ebp - 4], ebx
mov eax, dword [esi + 0x6af90]
mov dword [esi + 0x6af80], 2
cmp eax, ebx
je 0xfb2ec5
push edi
mov edi, 0x7fff
cmp eax, 3
jb 0xfb2d1e
mov ecx, dword [esi + 0x6af84]
mov edx, dword [esi + 0x6af7c]
and edx, 0x3ff
movzx eax, byte [ecx + esi + 0x1af72]
and eax, edi
shl edx, 5
xor eax, edx
and ecx, edi
mov dword [esi + 0x6af7c], eax
mov eax, dword [esi + eax*4 + 0x4af70]
mov dword [ebp - 4], eax
mov dword [esi + ecx*4 + 0x2af70], eax
mov eax, dword [esi + 0x6af7c]
mov ecx, dword [esi + 0x6af84]
mov dword [esi + eax*4 + 0x4af70], ecx
cmp dword [ebp - 4], 0
je 0xfb2d5f
mov eax, dword [esi + 0x6af84]
sub eax, dword [ebp - 4]
cmp eax, 0x7efa
ja 0xfb2d5f
mov ecx, dword [esi + 0x6af90]
lea eax, [esi + 0x6afa0]
cmp dword [eax], ecx
jbe 0xfb2d46
mov dword [eax], ecx
push dword [ebp - 4]
push esi
call fcn.00fb29b5
mov ebx, eax
mov eax, dword [esi + 0x6af90]
pop ecx
cmp ebx, eax
pop ecx
jbe 0xfb2d5f
mov ebx, eax
cmp ebx, 3
jb 0xfb2e3e
lea eax, [ebx - 3]
push eax
mov eax, dword [esi + 0x6af84]
sub eax, dword [esi + 0x6af88]
push eax
push esi
call fcn.00fb21e7
sub dword [esi + 0x6af90], ebx
add esp, 0xc
cmp ebx, dword [esi + 0x6af98]
mov dword [ebp + 8], eax
mov eax, dword [esi + 0x6af90]
ja 0xfb2df7
cmp eax, 3
jb 0xfb2df7
dec ebx
inc dword [esi + 0x6af84]
mov ecx, dword [esi + 0x6af84]
mov edx, dword [esi + 0x6af7c]
movzx eax, byte [esi + ecx + 0x1af72]
and edx, 0x3ff
and eax, edi
shl edx, 5
xor eax, edx
and ecx, edi
mov dword [esi + 0x6af7c], eax
dec ebx
mov eax, dword [esi + eax*4 + 0x4af70]
mov dword [ebp - 4], eax
mov dword [esi + ecx*4 + 0x2af70], eax
mov eax, dword [esi + 0x6af7c]
mov ecx, dword [esi + 0x6af84]
mov dword [esi + eax*4 + 0x4af70], ecx
jne 0xfb2d9f
jmp 0xfb2e61
add dword [esi + 0x6af84], ebx
mov eax, dword [esi + 0x6af84]
lea edx, [esi + 0x6af7c]
push 0xfc52b4
lea ecx, [eax + esi]
push 1
push esi
xor ebx, ebx
movzx eax, byte [ecx + 0x1af70]
mov dword [edx], eax
and eax, 0x3ff
movzx ecx, byte [ecx + 0x1af71]
and ecx, edi
shl eax, 5
xor ecx, eax
mov dword [edx], ecx
call fcn.00fb1409
add esp, 0xc
jmp 0xfb2e67
mov eax, dword [esi + 0x6af84]
movzx eax, byte [eax + esi + 0x1af70]
push eax
push 0
push esi
call fcn.00fb21e7
add esp, 0xc
dec dword [esi + 0x6af90]
mov dword [ebp + 8], eax
inc dword [esi + 0x6af84]
cmp dword [ebp + 8], 0
je 0xfb2ea3
mov eax, dword [esi + 0x6af74]
test eax, eax
jl 0xfb2e80
lea ecx, [eax + esi + 0x1af70]
jmp 0xfb2e82
xor ecx, ecx
mov edx, dword [esi + 0x6af84]
push 0
sub edx, eax
push edx
push ecx
push esi
call fcn.00fb1fdf
mov eax, dword [esi + 0x6af84]
add esp, 0x10
mov dword [esi + 0x6af74], eax
cmp dword [esi + 0x6af90], 0x106
jae 0xfb2eb6
push esi
call fcn.00fb2b78
pop ecx
mov eax, dword [esi + 0x6af90]
test eax, eax
jne 0xfb2ccc
pop edi
mov eax, dword [esi + 0x6af74]
test eax, eax
jl 0xfb2ed8
lea ecx, [eax + esi + 0x1af70]
jmp 0xfb2eda
xor ecx, ecx
mov edx, dword [esi + 0x6af84]
push 1
sub edx, eax
push edx
push ecx
push esi
call fcn.00fb1fdf
add esp, 0x10
pop esi
pop ebx
leave
ret
Function at 0xfb3a21
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 0xc]
test edx, edx
jne 0xfb3a2f
xor eax, eax
pop ebp
ret
mov eax, dword [ebp + 8]
cmp dword [ebp + 0x10], 8
push esi
push edi
not eax
mov ecx, 0xff
jb 0xfb3b10
mov edi, dword [ebp + 0x10]
push ebx
shr edi, 3
movzx ebx, byte [edx]
mov esi, eax
sub dword [ebp + 0x10], 8
and esi, ecx
xor esi, ebx
mov ebx, eax
shr ebx, 8
mov eax, dword [esi*4 + 0xfbbe30]
xor eax, ebx
inc edx
mov esi, eax
movzx ebx, byte [edx]
and esi, ecx
xor esi, ebx
movzx ebx, byte [edx + 1]
mov esi, dword [esi*4 + 0xfbbe30]
shr eax, 8
xor esi, eax
inc edx
mov eax, esi
and eax, ecx
xor eax, ebx
movzx ebx, byte [edx + 1]
mov eax, dword [eax*4 + 0xfbbe30]
shr esi, 8
xor eax, esi
inc edx
mov esi, eax
and esi, ecx
xor esi, ebx
movzx ebx, byte [edx + 1]
mov esi, dword [esi*4 + 0xfbbe30]
shr eax, 8
xor esi, eax
inc edx
mov eax, esi
and eax, ecx
xor eax, ebx
movzx ebx, byte [edx + 1]
mov eax, dword [eax*4 + 0xfbbe30]
shr esi, 8
xor eax, esi
inc edx
mov esi, eax
and esi, ecx
xor esi, ebx
movzx ebx, byte [edx + 1]
mov esi, dword [esi*4 + 0xfbbe30]
shr eax, 8
xor esi, eax
inc edx
mov eax, esi
and eax, ecx
xor eax, ebx
movzx ebx, byte [edx + 1]
mov eax, dword [eax*4 + 0xfbbe30]
shr esi, 8
xor eax, esi
inc edx
mov esi, eax
and esi, ecx
xor esi, ebx
shr eax, 8
mov esi, dword [esi*4 + 0xfbbe30]
xor eax, esi
inc edx
dec edi
jne 0xfb3a4c
pop ebx
cmp dword [ebp + 0x10], 0
je 0xfb3b31
movzx edi, byte [edx]
mov esi, eax
and esi, ecx
xor esi, edi
shr eax, 8
mov esi, dword [esi*4 + 0xfbbe30]
xor eax, esi
inc edx
dec dword [ebp + 0x10]
jne 0xfb3b16
pop edi
pop esi
not eax
pop ebp
ret

Function at 0xfb3b37
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 8]
push esi
push edi
mov edx, 0xff
mov esi, dword [ecx]
movzx edi, byte [ebp + 0xc]
mov eax, esi
and eax, edx
xor eax, edi
shr esi, 8
mov eax, dword [eax*4 + 0xfbbe30]
xor eax, esi
mov esi, dword [ecx + 8]
mov dword [ecx], eax
and eax, edx
add eax, dword [ecx + 4]
mov edi, esi
and edi, edx
imul eax, eax, 0x8088405
inc eax
mov dword [ecx + 4], eax
shr eax, 0x18
xor eax, edi
pop edi
shr esi, 8
mov eax, dword [eax*4 + 0xfbbe30]
xor eax, esi
pop esi
mov dword [ecx + 8], eax
pop ebp
ret
Function at 0xfb3d11
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4c
push edi
mov edi, dword [ebp + 8]
lea eax, [ebp - 0x4c]
push eax
push edi
call dword [0xfba10c]
test eax, eax
jne 0xfb3d34
mov eax, 0x200
jmp 0xfb3ea9
mov ecx, dword [ebp - 0x4c]
push ebx
push esi
push 1
mov edx, ecx
pop eax
xor ebx, ebx
and edx, eax
mov dword [ebp - 8], ebx
je 0xfb3d4a
mov dword [ebp - 8], eax
test cl, 2
je 0xfb3d53
or dword [ebp - 8], 2
test cl, 4
je 0xfb3d5c
or dword [ebp - 8], 4
mov eax, ecx
and eax, 0x10
je 0xfb3d67
or dword [ebp - 8], 0x10
test cl, 0x20
je 0xfb3d70
or dword [ebp - 8], 0x20
cmp eax, ebx
je 0xfb3d7a
or byte [ebp - 5], 0x40
jmp 0xfb3d7e
or byte [ebp - 5], 0x80
or byte [ebp - 5], 1
cmp edx, ebx
jne 0xfb3d8a
or byte [ebp - 6], 0x80
push ebx
push edi
call dword [0xfba0ac]
cmp eax, 0x28
mov dword [ebp - 0x10], eax
jbe 0xfb3e25
mov esi, dword [0xfba0a8]
push ebx
push ebx
push ebx
push edi
call esi
lea eax, [ebp - 0xc]
push ebx
push eax
lea eax, [ebp - 2]
push 2
push eax
push edi
mov edi, dword [0xfba0dc]
call edi
push ebx
push ebx
push 0x24
push dword [ebp + 8]
call esi
lea eax, [ebp - 0xc]
push ebx
push eax
lea eax, [ebp - 0x14]
push 4
push eax
push dword [ebp + 8]
call edi
cmp word [ebp - 2], 0x54ad
jne 0xfb3e25
mov eax, dword [ebp - 0x14]
lea ecx, [eax + 0x34]
cmp dword [ebp - 0x10], ecx
jbe 0xfb3e25
push ebx
push ebx
push eax
push dword [ebp + 8]
call esi
lea eax, [ebp - 0xc]
push ebx
push eax
lea eax, [ebp - 0x18]
push 4
push eax
push dword [ebp + 8]
call edi
mov eax, dword [ebp - 0x18]
cmp eax, 0x5a4d
je 0xfb3e21
cmp eax, 0x454e
je 0xfb3e21
cmp eax, 0x454c
je 0xfb3e21
cmp eax, 0x4550
jne 0xfb3e25
or byte [ebp - 6], 0x40
mov eax, dword [ebp + 0xc]
cmp eax, ebx
je 0xfb3e31
mov ecx, dword [ebp - 8]
mov dword [eax], ecx
mov eax, dword [ebp + 0x10]
cmp eax, ebx
je 0xfb3e3d
mov ecx, dword [ebp - 0x10]
mov dword [eax], ecx
mov esi, dword [ebp + 0x14]
cmp esi, ebx
je 0xfb3e79
push dword [ebp - 0x3c]
push dword [ebp - 0x40]
call fcn.00fb3c90
push dword [ebp - 0x34]
mov dword [esi], eax
mov dword [esi + 4], edx
push dword [ebp - 0x38]
call fcn.00fb3c90
push dword [ebp - 0x44]
mov dword [esi + 8], eax
mov dword [esi + 0xc], edx
push dword [ebp - 0x48]
call fcn.00fb3c90
mov dword [esi + 0x10], eax
add esp, 0x18
mov dword [esi + 0x14], edx
mov esi, dword [ebp + 0x18]
cmp esi, ebx
je 0xfb3ea5
lea eax, [ebp + 0xe]
push eax
lea eax, [ebp + 0xa]
push eax
push dword [ebp - 0x34]
push dword [ebp - 0x38]
call fcn.00fb3cb4
movzx eax, word [ebp + 0xa]
movzx ecx, word [ebp + 0xe]
shl eax, 0x10
add esp, 0x10
or eax, ecx
mov dword [esi], eax
pop esi
xor eax, eax
pop ebx
pop edi
leave
ret
Function at 0x10002630
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x1c
push ebx
mov ebx, ecx
push esi
push edi
cmp dword [ebx + 0x38], 0
je 0x1000265c
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____thiscall_std::basic_streambuf_char__struct_std::char_traits_char__::xsputn_char_const___long_long___int64__]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov eax, dword [ebx + 0x20]
mov esi, dword [ebp + 0xc]
mov edi, dword [ebp + 0x10]
mov dword [esp + 0x20], esi
mov ecx, dword [eax]
lea eax, [ebx + 0x30]
mov dword [esp + 0x24], edi
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x18], eax
test ecx, ecx
je 0x10002684
mov eax, dword [eax]
mov ecx, dword [eax]
jmp 0x1000268a
xor ecx, ecx
mov dword [esp + 0x18], eax
mov eax, ecx
cdq
mov dword [esp + 0x10], eax
mov ecx, edx
mov dword [esp + 0x14], ecx
test edi, edi
jl 0x100026f2
jg 0x100026a1
test esi, esi
je 0x100026f2
test ecx, ecx
jl 0x100026ed
jg 0x100026ab
test eax, eax
je 0x100026ed
cmp edi, ecx
jg 0x100026bf
jl 0x100026b5
cmp esi, eax
jae 0x100026bf
mov eax, esi
mov dword [esp + 0x10], esi
mov dword [esp + 0x14], edi
push eax
push dword [ebp + 8]
push dword [esp + 0x24]
call sub.VCRUNTIME140.dll_memcpy
mov eax, dword [esp + 0x24]
add esp, 0xc
mov edx, dword [esp + 0x10]
mov ecx, dword [ebp + 8]
add ecx, edx
sub esi, edx
mov eax, dword [eax]
sbb edi, dword [esp + 0x14]
sub dword [eax], edx
mov eax, dword [ebx + 0x20]
add dword [eax], edx
jmp 0x100026f5
mov ecx, dword [ebp + 8]
jmp 0x100026ff
mov ecx, dword [ebp + 8]
test edi, edi
jl 0x10002719
jg 0x100026ff
test esi, esi
je 0x10002719
mov eax, dword [ebx + 0x4c]
test eax, eax
je 0x10002719
push eax
push esi
push 1
push ecx
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
add esp, 0x10
sub esi, eax
sbb edi, 0
mov eax, dword [esp + 0x20]
mov edx, dword [esp + 0x24]
sub eax, esi
sbb edx, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x10002730
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0xc
mov eax, dword [ebp + 0x10]
push ebx
mov ebx, ecx
mov ecx, dword [ebp + 0xc]
push esi
mov esi, dword [ebp + 8]
mov dword [esp + 8], esi
push edi
test eax, eax
jg 0x10002762
jl 0x10002755
test ecx, ecx
jne 0x10002762
xor eax, eax
xor edx, edx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
cmp dword [ebx + 0x38], 0
je 0x1000277c
push eax
push ecx
push esi
mov ecx, ebx
call dword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____thiscall_std::basic_streambuf_char__struct_std::char_traits_char__::xsgetn_char___long_long___int64__]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov eax, dword [ebx + 0x1c]
mov edi, ecx
mov eax, dword [eax]
mov dword [esp + 0x10], eax
test eax, eax
je 0x100027c9
mov eax, dword [ebx + 0x2c]
lea edx, [ebx + 0x2c]
mov dword [esp + 0x14], edx
mov eax, dword [eax]
test eax, eax
je 0x100027d0
cmp eax, ecx
mov esi, ecx
cmovb esi, eax
push esi
push dword [esp + 0x14]
push dword [esp + 0x14]
call sub.VCRUNTIME140.dll_memcpy
mov eax, dword [ebx + 0x2c]
sub edi, esi
add dword [esp + 0x18], esi
add esp, 0xc
sub dword [eax], esi
mov eax, dword [ebx + 0x1c]
add dword [eax], esi
mov esi, dword [esp + 0xc]
jmp 0x100027d0
lea eax, [ebx + 0x2c]
mov dword [esp + 0x14], eax
cmp dword [ebx + 0x4c], 0
je 0x10002846
mov ecx, dword [ebx + 0xc]
lea eax, [ebx + 0x3c]
cmp dword [ecx], eax
jne 0x100027fa
mov eax, dword [ebx + 0xc]
mov edx, dword [ebx + 0x54]
mov ecx, dword [ebx + 0x50]
sub edx, ecx
mov dword [eax], ecx
mov eax, dword [ebx + 0x1c]
mov dword [eax], ecx
mov eax, dword [esp + 0x14]
mov eax, dword [eax]
mov dword [eax], edx
mov eax, dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
cmp edi, 0xfff
jbe 0x10002834
nop word [eax + eax]
push dword [ebx + 0x4c]
push 0xfff
push 1
push esi
call eax
add esp, 0x10
add esi, eax
sub edi, eax
cmp eax, 0xfff
jne 0x10002846
cmp edi, eax
mov eax, dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
ja 0x10002810
test edi, edi
je 0x10002846
push dword [ebx + 0x4c]
push edi
push 1
push esi
call eax
add esp, 0x10
sub edi, eax
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 0x10]
sub eax, edi
pop edi
pop esi
sbb edx, 0
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x10002bc0
Capabilities:
Write file on windows

Disassembly:
sub esp, 0x30
mov eax, dword [0x10027040]
xor eax, esp
mov dword [esp + 0x2c], eax
push ebx
mov ebx, dword [esp + 0x38]
push esi
mov esi, ecx
cmp ebx, 0xffffffff
jne 0x10002bf0
pop esi
xor eax, eax
pop ebx
mov ecx, dword [esp + 0x2c]
xor ecx, esp
call fcn.1000daaa
add esp, 0x30
ret 4
mov eax, dword [esi + 0x20]
push edi
mov ecx, dword [eax]
test ecx, ecx
je 0x10002c2d
mov edx, dword [esi + 0x30]
mov edi, dword [edx]
lea eax, [edi + ecx]
cmp ecx, eax
jae 0x10002c2d
lea ecx, [edi - 1]
mov eax, ebx
mov dword [edx], ecx
mov edx, dword [esi + 0x20]
pop edi
mov esi, dword [edx]
lea ecx, [esi + 1]
mov dword [edx], ecx
mov byte [esi], bl
pop esi
pop ebx
mov ecx, dword [esp + 0x2c]
xor ecx, esp
call fcn.1000daaa
add esp, 0x30
ret 4
cmp dword [esi + 0x4c], 0
je 0x10002d12
mov edi, dword [esi + 0xc]
lea eax, [esi + 0x3c]
cmp dword [edi], eax
jne 0x10002c55
mov edx, dword [esi + 0x54]
mov ecx, dword [esi + 0x50]
sub edx, ecx
mov dword [edi], ecx
mov eax, dword [esi + 0x1c]
mov dword [eax], ecx
mov eax, dword [esi + 0x2c]
mov dword [eax], edx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x10002c61
movsx eax, bl
jmp 0x10002ca1
lea eax, [esp + 0xc]
mov byte [esp + 0x17], bl
push eax
lea eax, [esp + 0x3c]
push eax
lea eax, [esp + 0x20]
push eax
lea eax, [esp + 0x1c]
push eax
lea eax, [esp + 0x28]
push eax
lea eax, [esp + 0x2b]
push eax
lea eax, [esi + 0x40]
push eax
call dword [sym.imp.MSVCP140.dll_public:_int___thiscall_std::codecvt_char__char__struct__Mbstatet_::out_struct__Mbstatet___char_const___char_const___char_const____char___char___char___const]
sub eax, 0
je 0x10002ccc
sub eax, 1
je 0x10002ccc
sub eax, 2
jne 0x10002d12
movsx eax, byte [esp + 0x17]
push dword [esi + 0x4c]
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
add esp, 8
or ecx, 0xffffffff
cmp eax, ecx
cmove ebx, ecx
pop edi
pop esi
mov eax, ebx
pop ebx
mov ecx, dword [esp + 0x2c]
xor ecx, esp
call fcn.1000daaa
add esp, 0x30
ret 4
mov edi, dword [esp + 0xc]
lea eax, [esp + 0x18]
sub edi, eax
je 0x10002cec
push dword [esi + 0x4c]
push edi
push 1
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
add esp, 0x10
cmp edi, eax
jne 0x10002d12
lea ecx, [esp + 0x17]
mov byte [esi + 0x3d], 1
or eax, 0xffffffff
cmp dword [esp + 0x10], ecx
pop edi
pop esi
cmovne eax, ebx
pop ebx
mov ecx, dword [esp + 0x2c]
xor ecx, esp
call fcn.1000daaa
add esp, 0x30
ret 4
mov ecx, dword [esp + 0x38]
or eax, 0xffffffff
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.1000daaa
add esp, 0x30
ret 4
Function at 0x10003c60
Capabilities:
Write file on windows

Disassembly:
sub esp, 0x28
mov eax, dword [0x10027040]
xor eax, esp
mov dword [esp + 0x24], eax
push esi
mov esi, ecx
cmp dword [esi + 0x38], 0
je 0x10003d22
cmp byte [esi + 0x3d], 0
je 0x10003d22
mov eax, dword [esi]
push edi
push 0xffffffffffffffff
call dword [eax + 0xc]
cmp eax, 0xffffffff
je 0x10003d0f
mov ecx, dword [esi + 0x38]
lea eax, [esp + 8]
push eax
lea eax, [esp + 0x30]
push eax
lea eax, [esp + 0x14]
push eax
lea eax, [esi + 0x40]
push eax
call dword [sym.imp.MSVCP140.dll_public:_int___thiscall_std::codecvt_char__char__struct__Mbstatet_::unshift_struct__Mbstatet___char___char___char___const]
sub eax, 0
je 0x10003cd3
sub eax, 1
je 0x10003cd7
sub eax, 2
jne 0x10003d0f
mov byte [esi + 0x3d], al
mov al, 1
pop edi
pop esi
mov ecx, dword [esp + 0x24]
xor ecx, esp
call fcn.1000daaa
add esp, 0x28
ret
mov byte [esi + 0x3d], 0
mov edi, dword [esp + 8]
lea eax, [esp + 0xc]
sub edi, eax
je 0x10003cf7
push dword [esi + 0x4c]
push edi
push 1
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
add esp, 0x10
cmp edi, eax
jne 0x10003d0f
cmp byte [esi + 0x3d], 0
pop edi
sete al
pop esi
mov ecx, dword [esp + 0x24]
xor ecx, esp
call fcn.1000daaa
add esp, 0x28
ret
pop edi
xor al, al
pop esi
mov ecx, dword [esp + 0x24]
xor ecx, esp
call fcn.1000daaa
add esp, 0x28
ret
mov ecx, dword [esp + 0x28]
mov al, 1
pop esi
xor ecx, esp
call fcn.1000daaa
add esp, 0x28
ret
Function at 0x1000af00
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [ebp + 0xc]
sub eax, 0x10000
push eax
call fcn.1000b0d0
add esp, 4
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
cmp ecx, dword [ebp + 8]
jbe 0x1000afdd
mov edx, dword [ebp - 4]
cmp edx, dword [section..data]
jb 0x1000af4a
mov eax, dword [ebp - 4]
cmp eax, dword [0x10027004]
ja 0x1000af4a
mov ecx, dword [ebp - 4]
sub ecx, 0x8000000
mov dword [ebp - 4], ecx
jmp 0x1000af1a
push 0x1c
push 0
lea edx, [ebp - 0x24]
push edx
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
push 0x1c
lea eax, [ebp - 0x24]
push eax
mov ecx, dword [ebp - 4]
push ecx
call sub.KERNEL32.dll_VirtualQuery
test eax, eax
jne 0x1000af6f
jmp 0x1000afdd
cmp dword [ebp - 0x14], 0x10000
jne 0x1000afc3
cmp dword [ebp - 0x18], 0x10000
jb 0x1000afc3
push 0x40
push 0x3000
push 0x10000
mov edx, dword [ebp - 4]
push edx
call sub.KERNEL32.dll_VirtualAlloc
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x1000afa6
mov eax, dword [ebp - 8]
jmp 0x1000afdf
call sub.KERNEL32.dll_GetLastError
cmp eax, 0x677
jne 0x1000afb6
xor eax, eax
jmp 0x1000afdf
mov eax, dword [ebp - 4]
sub eax, 0x10000
mov dword [ebp - 4], eax
jmp 0x1000afd8
mov ecx, dword [ebp - 0x20]
sub ecx, 0x10000
push ecx
call fcn.1000b0d0
add esp, 4
mov dword [ebp - 4], eax
jmp 0x1000af1a
xor eax, eax
mov esp, ebp
pop ebp
ret

Function at 0x1000aff0
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [ebp + 8]
push eax
call fcn.1000b100
add esp, 4
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
cmp ecx, dword [ebp + 0xc]
jae 0x1000b0c5
mov edx, dword [ebp - 4]
cmp edx, dword [section..data]
jb 0x1000b035
mov eax, dword [ebp - 4]
cmp eax, dword [0x10027004]
ja 0x1000b035
mov ecx, dword [ebp - 4]
add ecx, 0x8000000
mov dword [ebp - 4], ecx
jmp 0x1000b005
push 0x1c
push 0
lea edx, [ebp - 0x24]
push edx
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
push 0x1c
lea eax, [ebp - 0x24]
push eax
mov ecx, dword [ebp - 4]
push ecx
call sub.KERNEL32.dll_VirtualQuery
test eax, eax
jne 0x1000b05a
jmp 0x1000b0c5
cmp dword [ebp - 0x14], 0x10000
jne 0x1000b0ae
cmp dword [ebp - 0x18], 0x10000
jb 0x1000b0ae
push 0x40
push 0x3000
push 0x10000
mov edx, dword [ebp - 4]
push edx
call sub.KERNEL32.dll_VirtualAlloc
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x1000b091
mov eax, dword [ebp - 8]
jmp 0x1000b0c7
call sub.KERNEL32.dll_GetLastError
cmp eax, 0x677
jne 0x1000b0a1
xor eax, eax
jmp 0x1000b0c7
mov eax, dword [ebp - 4]
add eax, 0x10000
mov dword [ebp - 4], eax
jmp 0x1000b0c0
mov ecx, dword [ebp - 0x24]
add ecx, dword [ebp - 0x18]
push ecx
call fcn.1000b100
add esp, 4
mov dword [ebp - 4], eax
jmp 0x1000b005
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x1000b130
Capabilities:
Hook routines via microsoft detours

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
lea eax, [ebp - 0xc]
push eax
lea ecx, [ebp - 0x10]
push ecx
mov edx, dword [ebp + 8]
push edx
call fcn.1000b520
add esp, 0xc
mov dword [ebp - 4], 0
cmp dword [0x100275d4], 0
jne 0x1000b16d
cmp dword [0x100275d0], 0
je 0x1000b16d
mov eax, dword [0x100275d0]
mov dword [0x100275d4], eax
cmp dword [0x100275d4], 0
je 0x1000b1ea
mov ecx, dword [0x100275d4]
cmp dword [ecx + 8], 0
je 0x1000b1ea
mov edx, dword [0x100275d4]
mov eax, dword [edx + 8]
cmp eax, dword [ebp - 0x10]
jb 0x1000b1ea
mov ecx, dword [0x100275d4]
mov edx, dword [ecx + 8]
cmp edx, dword [ebp - 0xc]
ja 0x1000b1ea
mov eax, dword [0x100275d4]
mov ecx, dword [eax + 8]
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 4]
cmp edx, dword [ebp - 0x10]
jb 0x1000b1b9
mov eax, dword [ebp - 4]
cmp eax, dword [ebp - 0xc]
jbe 0x1000b1c0
xor eax, eax
jmp 0x1000b309
mov ecx, dword [0x100275d4]
mov edx, dword [ebp - 4]
mov eax, dword [edx + 0x40]
mov dword [ecx + 8], eax
push 0x48
push 0xcc
mov ecx, dword [ebp - 4]
push ecx
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
mov eax, dword [ebp - 4]
jmp 0x1000b309
mov edx, dword [0x100275d0]
mov dword [0x100275d4], edx
jmp 0x1000b206
mov eax, dword [0x100275d4]
mov ecx, dword [eax + 4]
mov dword [0x100275d4], ecx
cmp dword [0x100275d4], 0
je 0x1000b246
cmp dword [0x100275d4], 0
je 0x1000b244
mov edx, dword [0x100275d4]
cmp dword [edx + 8], 0
je 0x1000b244
mov eax, dword [0x100275d4]
mov ecx, dword [eax + 8]
cmp ecx, dword [ebp - 0x10]
jb 0x1000b244
mov edx, dword [0x100275d4]
mov eax, dword [edx + 8]
cmp eax, dword [ebp - 0xc]
ja 0x1000b244
jmp 0x1000b19e
jmp 0x1000b1f8
mov ecx, dword [ebp + 8]
and ecx, 0xffff
mov edx, dword [ebp + 8]
sub edx, ecx
mov dword [ebp + 8], edx
mov eax, dword [ebp - 0xc]
push eax
mov ecx, dword [ebp - 0x10]
push ecx
mov edx, dword [ebp + 8]
push edx
call fcn.1000b310
add esp, 0xc
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
je 0x1000b307
mov eax, dword [ebp - 0x18]
mov dword [0x100275d4], eax
mov ecx, dword [0x100275d4]
mov dword [ecx], 0x52727464
mov edx, dword [0x100275d4]
mov dword [edx + 8], 0
mov eax, dword [0x100275d4]
mov ecx, dword [0x100275d0]
mov dword [eax + 4], ecx
mov edx, dword [0x100275d4]
mov dword [0x100275d0], edx
mov dword [ebp - 0x14], 0
mov eax, dword [0x100275d4]
add eax, 0x48
mov dword [ebp - 4], eax
mov dword [ebp - 8], 0x38c
jmp 0x1000b2d7
mov ecx, dword [ebp - 8]
sub ecx, 1
mov dword [ebp - 8], ecx
cmp dword [ebp - 8], 1
jle 0x1000b2f7
imul edx, dword [ebp - 8], 0x48
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 0x14]
mov dword [eax + edx + 0x40], ecx
imul edx, dword [ebp - 8], 0x48
add edx, dword [ebp - 4]
mov dword [ebp - 0x14], edx
jmp 0x1000b2ce
mov eax, dword [0x100275d4]
mov ecx, dword [ebp - 0x14]
mov dword [eax + 8], ecx
jmp 0x1000b19e
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x1000c050
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [0x100275d0]
mov dword [ebp - 4], eax
jmp 0x1000c069
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 4]
mov dword [ebp - 4], edx
cmp dword [ebp - 4], 0
je 0x1000c090
lea eax, [ebp - 8]
push eax
push 0x40
push 0x10000
mov ecx, dword [ebp - 4]
push ecx
call sub.KERNEL32.dll_VirtualProtect
test eax, eax
jne 0x1000c08e
call sub.KERNEL32.dll_GetLastError
jmp 0x1000c092
jmp 0x1000c060
xor eax, eax
mov esp, ebp
pop ebp
ret