joyce8/EMBER2024-capa huggingface dataset:
Function at 0x456450
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4ce191
mov eax, dword fs:[0]
push eax
sub esp, 0x2c
push esi
push edi
mov eax, dword [0x501230]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 0xc]
lea eax, [ebp - 0x34]
push eax
mov dword [ebp - 0x10], 0
xorps xmm0, xmm0
mov dword [ebp - 0x38], vtable.std::exception.0
lea eax, [esi + 4]
movq qword [ebp - 0x34], xmm0
push eax
call sub.VCRUNTIME140.dll___std_exception_copy
mov eax, dword [esi + 0xc]
add esp, 8
movaps xmm0, xmmword [0x4e25b0]
mov dword [ebp - 0x2c], eax
mov eax, dword [esi + 0x10]
mov dword [ebp - 0x28], eax
movups xmmword [ebp - 0x20], xmm0
mov dword [ebp - 0x38], vtable.boost::exception_detail::error_info_injector_class_boost::bad_lexical_cast_.0
mov dword [ebp - 0x24], vtable.boost::exception_detail::error_info_injector_class_boost::bad_lexical_cast_.1.0
mov edi, dword [ebp + 8]
mov dword [ebp - 4], 0
mov dword [edi + 0x28], 0x4e8b6c
mov dword [edi + 0x30], vtable.boost::exception_detail::clone_base.0
lea eax, [ebp - 0x38]
mov byte [ebp - 4], 1
push eax
mov ecx, edi
mov dword [ebp - 0x10], 2
call fcn.00459da0
mov eax, dword [edi + 0x28]
lea esi, [edi + 0x14]
mov dword [edi], vtable.boost::exception_detail::clone_impl_struct_boost::exception_detail::error_info_injector_class_boost::bad_lexical_cast__.0
mov dword [esi], vtable.boost::exception_detail::clone_impl_struct_boost::exception_detail::error_info_injector_class_boost::bad_lexical_cast__.1.0
mov dword [ebp - 4], 3
mov eax, dword [eax + 4]
mov dword [eax + edi + 0x28], vtable.boost::exception_detail::clone_impl_struct_boost::exception_detail::error_info_injector_class_boost::bad_lexical_cast__.2.0
mov eax, dword [edi + 0x28]
mov ecx, dword [eax + 4]
lea eax, [ecx - 8]
mov dword [ecx + edi + 0x24], eax
lea eax, [ebp - 0x24]
push eax
push esi
call fcn.00429460
mov eax, dword [edi + 0x28]
add esp, 8
mov dword [edi], vtable.boost::wrapexcept_class_boost::bad_lexical_cast_.0
mov dword [esi], vtable.boost::wrapexcept_class_boost::bad_lexical_cast_.1.0
mov eax, dword [eax + 4]
mov dword [eax + edi + 0x28], vtable.boost::wrapexcept_class_boost::bad_lexical_cast_.2.0
mov eax, dword [edi + 0x28]
mov ecx, dword [eax + 4]
lea eax, [ecx - 8]
mov dword [ecx + edi + 0x24], eax
mov dword [ebp - 0x38], vtable.boost::exception_detail::error_info_injector_class_boost::bad_lexical_cast_.0
mov dword [ebp - 0x24], vtable.boost::exception.0
mov ecx, dword [ebp - 0x20]
mov dword [ebp - 4], 4
test ecx, ecx
je 0x456588
mov eax, dword [ecx]
mov eax, dword [eax + 0x10]
call eax
mov ecx, dword [ebp - 0x20]
xor edx, edx
test al, al
cmovne ecx, edx
mov dword [ebp - 0x20], ecx
lea eax, [ebp - 0x34]
mov dword [ebp - 0x38], vtable.std::exception.0
push eax
call sub.VCRUNTIME140.dll___std_exception_destroy
add esp, 4
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x466a50
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
sub esp, 0x1c
mov eax, dword [esp + 0x24]
mov edx, ecx
mov ecx, dword [esp + 0x20]
mov dword [esp + 0xc], edx
cmp ecx, eax
je 0x466bdf
cmp dword [ecx + 0x1c], 0x10
mov eax, dword [edx + 4]
push ebp
lea ebp, [edx + 4]
mov dword [esp + 0x18], eax
mov eax, dword [edx + 0xc]
push esi
mov dword [esp + 0x18], eax
mov esi, ecx
mov eax, dword [ecx + 4]
push edi
mov dword [esp + 0xc], eax
lea edi, [ecx + 8]
jb 0x466a92
mov edi, dword [ecx + 8]
push ebx
mov ebx, dword [ecx + 0x18]
mov edx, 0x811c9dc5
xor ecx, ecx
test ebx, ebx
je 0x466ab2
movzx eax, byte [ecx + edi]
inc ecx
xor eax, edx
imul edx, eax, 0x1000193
cmp ecx, ebx
jb 0x466aa1
mov eax, dword [esp + 0x1c]
mov ecx, dword [esp + 0x20]
mov eax, dword [eax + 0x18]
and eax, edx
lea eax, [ecx + eax*8]
mov ecx, dword [eax]
mov dword [esp + 0x14], eax
mov eax, dword [eax + 4]
mov dword [esp + 0x18], ecx
mov dword [esp + 0x28], eax
mov edi, esi
mov ebx, esi
mov esi, dword [esi]
lea eax, [edi + 8]
push eax
push ebp
call fcn.00463980
push 0x28
push edi
call fcn.004c7626
dec dword [ebp + 4]
add esp, 0x10
cmp ebx, dword [esp + 0x28]
je 0x466b26
mov eax, dword [esp + 0x34]
cmp esi, eax
jne 0x466ad3
mov ecx, dword [esp + 0x18]
cmp ecx, dword [esp + 0x30]
jne 0x466bd2
mov ecx, dword [esp + 0x14]
pop ebx
pop edi
mov dword [ecx], esi
mov ecx, dword [esp + 8]
mov dword [ecx], esi
mov dword [esi + 4], ecx
pop esi
pop ebp
add esp, 0x1c
ret 8
mov ecx, dword [esp + 0x18]
cmp ecx, dword [esp + 0x30]
mov ecx, dword [esp + 0x14]
jne 0x466b3c
mov eax, dword [esp + 0x24]
mov dword [ecx], eax
jmp 0x466b40
mov eax, dword [esp + 0x10]
mov dword [ecx + 4], eax
mov eax, dword [esp + 0x34]
cmp esi, eax
je 0x466bd2
nop
cmp dword [esi + 0x1c], 0x10
lea edi, [esi + 8]
jb 0x466b5c
mov edi, dword [esi + 8]
mov ebx, dword [esi + 0x18]
xor ecx, ecx
mov edx, 0x811c9dc5
test ebx, ebx
je 0x466b81
nop word [eax + eax]
movzx eax, byte [ecx + edi]
inc ecx
xor eax, edx
imul edx, eax, 0x1000193
cmp ecx, ebx
jb 0x466b70
mov eax, dword [esp + 0x1c]
mov ecx, dword [esp + 0x20]
mov eax, dword [eax + 0x18]
and eax, edx
lea eax, [ecx + eax*8]
mov dword [esp + 0x30], eax
mov eax, dword [eax + 4]
mov dword [esp + 0x28], eax
nop dword [eax]
mov edi, esi
mov ebx, esi
mov esi, dword [esi]
lea eax, [edi + 8]
push eax
push ebp
call fcn.00463980
push 0x28
push edi
call fcn.004c7626
dec dword [ebp + 4]
add esp, 0x10
mov eax, dword [esp + 0x34]
cmp ebx, dword [esp + 0x28]
je 0x466be5
cmp esi, eax
jne 0x466ba0
mov ecx, dword [esp + 0x30]
mov dword [ecx], esi
mov ecx, dword [esp + 0x10]
pop ebx
pop edi
mov dword [ecx], esi
mov dword [esi + 4], ecx
pop esi
pop ebp
add esp, 0x1c
ret 8
mov ecx, dword [esp + 0x30]
mov edx, dword [esp + 0x24]
mov dword [ecx], edx
mov dword [ecx + 4], edx
cmp esi, eax
jne 0x466b50
mov ecx, dword [esp + 0x10]
pop ebx
pop edi
mov dword [ecx], esi
mov dword [esi + 4], ecx
pop esi
pop ebp
add esp, 0x1c
ret 8
Function at 0x4776d0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4d1fe5
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push esi
mov eax, dword [0x501230]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
cmp dword [esi + 0xa8], 0
je 0x4777bb
push 0x20
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x18], 0
call fcn.004c75f6
add esp, 4
mov dword [eax], eax
mov dword [eax + 4], eax
mov dword [ebp - 0x1c], eax
lea eax, [esi + 0x100]
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x14]
mov dword [ebp - 0x14], eax
mov byte [ebp - 0x10], 0
call fcn.00429a70
push 0
mov ecx, esi
mov dword [ebp - 4], 1
call fcn.00477c70
mov edx, dword [esi + 0x12c]
test edx, edx
je 0x4777b3
mov eax, dword [ebp + 8]
mov ecx, eax
cmp dword [eax + 0x14], 0x10
jb 0x477768
mov ecx, dword [eax]
push edx
push 1
push dword [eax + 0x10]
push ecx
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
push dword [esi + 0x12c]
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fflush]
push dword [esi + 0x12c]
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_ftell]
cdq
add esp, 0x18
cmp edx, dword [esi + 0x3c]
jb 0x4777b3
ja 0x47779d
cmp eax, dword [esi + 0x38]
jbe 0x4777b3
cmp byte [0x5095d8], 0
jne 0x4777b3
lea eax, [ebp - 0x1c]
mov ecx, esi
push eax
push 1
call fcn.0047b640
lea ecx, [ebp - 0x1c]
call fcn.00470c00
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x48a4d0
Capabilities:
Check for time delay via queryperformancecounter

Disassembly:
sub esp, 0x10
lea eax, [esp]
push eax
call dword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
test eax, eax
je 0x48a581
cmp dword [esp + 4], 0
jg 0x48a4fc
jl 0x48a595
cmp dword [esp], 0
jbe 0x48a595
push esi
push edi
mov edi, dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
lea eax, [esp + 0x10]
push eax
xor esi, esi
call edi
test eax, eax
jne 0x48a522
inc esi
cmp esi, 3
ja 0x48a56d
lea eax, [esp + 0x10]
push eax
call edi
test eax, eax
je 0x48a511
mov edx, dword [esp + 0x14]
mov ecx, dword [esp + 0x10]
call fcn.004c86a0
mulsd xmm0, qword [0x4e9c60]
mov edx, dword [esp + 0xc]
mov ecx, dword [esp + 8]
movsd qword [esp + 0x10], xmm0
call fcn.004c86a0
movsd xmm1, qword [esp + 0x10]
divsd xmm1, xmm0
movaps xmm0, xmm1
call fcn.004c8590
mov ecx, dword [esp + 0x1c]
pop edi
pop esi
mov dword [ecx], eax
mov eax, ecx
mov dword [ecx + 4], edx
add esp, 0x10
ret
push 0x1a6
push str.E:.conan_f900534a1include_boost_thread_detail_platform_time.hpp
push str.0___Boost::Thread___QueryPerformanceCounter_Internal_Error_
call fcn.00462910
push 0x197
push str.E:.conan_f900534a1include_boost_thread_detail_platform_time.hpp
push str.0___Boost::Thread___QueryPerformanceFrequency_Internal_Error_
call fcn.00462910
push 0x19c
push str.E:.conan_f900534a1include_boost_thread_detail_platform_time.hpp
push str.0___Boost::Thread___QueryPerformanceFrequency_Internal_Error_
call fcn.00462910
int3
Function at 0x497b30
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4d4c5f
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x501230]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push 0x13b8
call fcn.004c75f6
mov esi, eax
add esp, 4
mov dword [ebp - 0x10], esi
mov dword [ebp - 4], 0
test esi, esi
je 0x497bc7
push 2
push esi
call sub.MSVCP140.dll__Mtx_init_in_situ
add esp, 8
mov byte [ebp - 4], 1
call sub.MSVCP140.dll_unsigned_int___cdecl_std::_Random_device_void_
mov edx, eax
mov dword [esi + 0x13b4], 0xffffffff
mov dword [esi + 0x34], edx
lea edi, [esi + 0x38]
mov ecx, 1
nop dword [eax]
mov eax, edx
lea edi, [edi + 4]
shr eax, 0x1e
xor eax, edx
imul edx, eax, 0x6c078965
add edx, ecx
inc ecx
mov dword [edi - 4], edx
cmp ecx, 0x270
jb 0x497ba0
mov dword [esi + 0x30], 0x270
jmp 0x497bc9
xor esi, esi
mov edi, dword [0x5011d4]
mov dword [0x5011d4], esi
test edi, edi
je 0x497bed
push edi
call sub.MSVCP140.dll__Mtx_destroy_in_situ
push 0x13b8
push edi
call fcn.004c7626
add esp, 0xc
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x497cd0
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push esi
push edi
mov edi, ecx
mov eax, dword [edi]
cmp eax, 0x270
jne 0x497d20
lea edx, [edi + 8]
mov esi, eax
mov ecx, dword [edx - 4]
lea edx, [edx + 4]
xor ecx, dword [edx - 4]
and ecx, 0x7fffffff
xor ecx, dword [edx - 8]
mov eax, ecx
and al, 1
movzx eax, al
neg eax
sbb eax, eax
shr ecx, 1
and eax, 0x9908b0df
xor eax, dword [edx + 0x62c]
xor eax, ecx
mov dword [edx + 0x9b8], eax
sub esi, 1
jne 0x497ce2
mov eax, dword [edi]
jmp 0x497e07
cmp eax, 0x4e0
jb 0x497e07
mov eax, dword [edi + 0x9c4]
push ebx
lea ebx, [edi + 0x9c4]
push ebp
mov ebp, 0xe3
nop
mov ecx, dword [ebx + 4]
lea edx, [ebx + 4]
xor ecx, eax
and ecx, 0x7fffffff
xor ecx, eax
mov eax, ecx
and al, 1
movzx eax, al
neg eax
sbb eax, eax
shr ecx, 1
and eax, 0x9908b0df
xor eax, dword [ebx + 0x634]
xor eax, ecx
mov dword [ebx - 0x9c0], eax
lea ebx, [edx]
mov eax, dword [edx]
sub ebp, 1
jne 0x497d40
mov eax, dword [edi + 0xd50]
lea ebx, [edi + 0xd50]
mov ebp, 0x18c
nop word [eax + eax]
mov ecx, eax
lea edx, [ebx + 4]
xor ecx, dword [edx]
and ecx, 0x7fffffff
xor ecx, eax
mov eax, ecx
and al, 1
movzx eax, al
neg eax
sbb eax, eax
shr ecx, 1
and eax, 0x9908b0df
xor eax, dword [ebx - 0xd4c]
xor eax, ecx
mov dword [ebx - 0x9c0], eax
lea ebx, [edx]
mov eax, dword [edx]
sub ebp, 1
jne 0x497d90
mov ecx, dword [edi + 0x1380]
xor ecx, dword [edi + 4]
and ecx, 0x7fffffff
xor ecx, dword [edi + 0x1380]
mov eax, ecx
and al, 1
movzx eax, al
neg eax
pop ebp
sbb eax, eax
shr ecx, 1
and eax, 0x9908b0df
xor eax, dword [edi + 0x634]
xor eax, ecx
mov dword [edi + 0x9c0], eax
xor eax, eax
mov dword [edi], 0
pop ebx
mov edx, dword [edi + eax*4 + 4]
inc eax
mov dword [edi], eax
mov ecx, edx
mov eax, dword [edi + 0x1384]
shr ecx, 0xb
and eax, ecx
xor edx, eax
mov eax, edx
and eax, 0xff3a58ad
shl eax, 7
xor edx, eax
mov eax, edx
and eax, 0xffffdf8c
shl eax, 0xf
xor edx, eax
mov eax, edx
shr eax, 0x12
pop edi
xor eax, edx
pop esi
ret
Function at 0x498560
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push ecx
push ebx
push ebp
push esi
mov dword [esp + 0xc], ecx
push edi
nop dword [eax]
mov edi, dword [ecx]
mov eax, dword [edi]
cmp eax, 0x270
jne 0x4985c3
lea eax, [edi + 8]
mov esi, 0x270
mov edx, dword [eax - 4]
lea eax, [eax + 4]
xor edx, dword [eax - 4]
and edx, 0x7fffffff
xor edx, dword [eax - 8]
mov ecx, edx
and cl, 1
movzx ecx, cl
neg ecx
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [eax + 0x62c]
xor ecx, edx
mov dword [eax + 0x9b8], ecx
sub esi, 1
jne 0x498583
mov eax, dword [edi]
jmp 0x4986a5
cmp eax, 0x4e0
jb 0x4986a5
mov eax, dword [edi + 0x9c4]
lea ebx, [edi + 0x9c4]
mov ebp, 0xe3
nop
mov ecx, dword [ebx + 4]
lea edx, [ebx + 4]
xor ecx, eax
and ecx, 0x7fffffff
xor ecx, eax
mov eax, ecx
and al, 1
movzx eax, al
neg eax
sbb eax, eax
shr ecx, 1
and eax, 0x9908b0df
xor eax, dword [ebx + 0x634]
xor eax, ecx
mov dword [ebx - 0x9c0], eax
lea ebx, [edx]
mov eax, dword [edx]
sub ebp, 1
jne 0x4985e0
mov eax, dword [edi + 0xd50]
lea ebx, [edi + 0xd50]
mov ebp, 0x18c
nop word [eax + eax]
mov ecx, eax
lea edx, [ebx + 4]
xor ecx, dword [edx]
and ecx, 0x7fffffff
xor ecx, eax
mov eax, ecx
and al, 1
movzx eax, al
neg eax
sbb eax, eax
shr ecx, 1
and eax, 0x9908b0df
xor eax, dword [ebx - 0xd4c]
xor eax, ecx
mov dword [ebx - 0x9c0], eax
lea ebx, [edx]
mov eax, dword [edx]
sub ebp, 1
jne 0x498630
mov ecx, dword [edi + 0x1380]
xor ecx, dword [edi + 4]
and ecx, 0x7fffffff
xor ecx, dword [edi + 0x1380]
mov eax, ecx
and al, 1
movzx eax, al
neg eax
sbb eax, eax
shr ecx, 1
and eax, 0x9908b0df
xor eax, dword [edi + 0x634]
xor eax, ecx
mov dword [edi + 0x9c0], eax
xor eax, eax
mov dword [edi], 0
mov edx, dword [edi + eax*4 + 4]
inc eax
mov dword [edi], eax
mov ecx, edx
mov eax, dword [edi + 0x1384]
shr ecx, 0xb
and eax, ecx
mov ecx, dword [esp + 0x10]
xor edx, eax
mov eax, edx
and eax, 0xff3a58ad
shl eax, 7
xor edx, eax
mov eax, edx
and eax, 0xffffdf8c
shl eax, 0xf
xor edx, eax
mov eax, edx
shr eax, 0x12
xor eax, edx
cmp eax, dword [ecx + 8]
ja 0x498570
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret

Function at 0x49cdc0
Capabilities:
Encode data using xor

Disassembly:
mov edx, dword [esp + 4]
push esi
push edi
cmp dword [edx + 0x14], 0x10
mov edi, dword [edx + 0x10]
jb 0x49cdd1
mov edx, dword [edx]
mov al, byte [edx]
movsx ecx, al
shl ecx, 7
test edi, edi
jns 0x49cde7
mov edi, closesocket
lea esi, [edi - 1]
jmp 0x49cdf0
lea esi, [edi - 1]
test esi, esi
js 0x49ce03
nop
movsx eax, byte [edx]
lea edx, [edx + 1]
imul ecx, ecx, 0xf4243
xor ecx, eax
sub esi, 1
jns 0x49cdf0
xor ecx, edi
pop edi
mov eax, ecx
pop esi
ret
Function at 0x4b5880
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4d7a9d
mov eax, dword fs:[0]
push eax
sub esp, 0x58
mov eax, dword [0x501230]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebp + 8]
mov edx, dword [ebp + 0xc]
mov esi, dword [ebp + 0x14]
test eax, eax
je 0x4b58e6
push ecx
push 1
push eax
push edx
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
add esp, 0x10
cmp eax, 1
jne 0x4b58fa
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004c75e8
mov esp, ebp
pop ebp
ret
push 0x25f
push str..._tech1utils_src_fileutils.cpp
push 0x4ea7ac
call fcn.00462910
push esi
lea eax, [ebp - 0x28]
push str.cannot_write_
push eax
call fcn.004554f0
push 0x4ea5bc
push eax
lea eax, [ebp - 0x40]
mov dword [ebp - 4], 0
push eax
call fcn.00424a10
mov esi, eax
mov byte [ebp - 4], 1
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
push dword [eax]
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_strerror]
push eax
lea eax, [ebp - 0x58]
push esi
push eax
call fcn.00424a10
add esp, 0x28
push eax
lea ecx, [ebp - 0x64]
mov byte [ebp - 4], 2
call fcn.0045ad10
push 0x4f2dc0
lea eax, [ebp - 0x64]
push eax
call sub.VCRUNTIME140.dll__CxxThrowException
int3
Function at 0x4bbd60
Capabilities:
Write file on windows

Disassembly:
sub esp, 0x44
mov eax, dword [0x501230]
xor eax, esp
mov dword [esp + 0x40], eax
mov edx, dword [esp + 0x48]
push ebx
push ebp
push esi
mov eax, dword [edx]
push edi
cmp eax, 3
ja case.0x4bbd7d.0
jmp dword [eax*4 + 0x4bbe8c]
mov edi, 2
jmp 0x4bbd9b
mov edi, 3
jmp 0x4bbd9b
mov edi, 1
jmp 0x4bbd9b
xor edi, edi
push edx
lea eax, [ecx + 4]
push eax
lea eax, [esp + 0x1c]
push eax
call fcn.004bb920
push 2
mov ebp, eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
push eax
call dword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll__lock_file]
add esp, 0x14
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
mov ebx, dword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
mov esi, eax
test esi, esi
je 0x4bbdea
jmp dword [edi*4 + 0x4bbe9c]
cmp dword [ebp + 0x14], 0x10
mov dword [esp + 0x10], ebp
jb 0x4bbdfb
mov eax, dword [ebp]
mov dword [esp + 0x10], eax
mov edi, dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
push 2
call edi
push eax
push dword [ebp + 0x10]
push 1
push dword [esp + 0x20]
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
push 2
call edi
push eax
push dword [ebp + 0x1c]
push 1
push dword [ebp + 0x18]
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
lea edi, [ebp + 0x20]
add esp, 0x28
cmp dword [edi + 0x14], 0x10
jb 0x4bbe36
mov edi, dword [edi]
push 2
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
push eax
push dword [ebp + 0x30]
push 1
push edi
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
add esp, 0x14
test esi, esi
je 0x4bbe5a
push 0x107
push esi
call ebx
push 2
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
push eax
call dword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll__unlock_file]
add esp, 8
lea ecx, [esp + 0x14]
call fcn.004bb020
mov ecx, dword [esp + 0x50]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.004c75e8
add esp, 0x44
ret 4
Function at 0x4bbd84
Capabilities:
Write file on windows

Disassembly:
sub esp, 0x44
mov eax, dword [0x501230]
xor eax, esp
mov dword [esp + 0x40], eax
mov edx, dword [esp + 0x48]
push ebx
push ebp
push esi
mov eax, dword [edx]
push edi
cmp eax, 3
ja case.0x4bbd7d.0
jmp dword [eax*4 + 0x4bbe8c]
mov edi, 2
jmp 0x4bbd9b
mov edi, 3
jmp 0x4bbd9b
mov edi, 1
jmp 0x4bbd9b
xor edi, edi
push edx
lea eax, [ecx + 4]
push eax
lea eax, [esp + 0x1c]
push eax
call fcn.004bb920
push 2
mov ebp, eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
push eax
call dword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll__lock_file]
add esp, 0x14
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
mov ebx, dword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
mov esi, eax
test esi, esi
je 0x4bbdea
jmp dword [edi*4 + 0x4bbe9c]
cmp dword [ebp + 0x14], 0x10
mov dword [esp + 0x10], ebp
jb 0x4bbdfb
mov eax, dword [ebp]
mov dword [esp + 0x10], eax
mov edi, dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
push 2
call edi
push eax
push dword [ebp + 0x10]
push 1
push dword [esp + 0x20]
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
push 2
call edi
push eax
push dword [ebp + 0x1c]
push 1
push dword [ebp + 0x18]
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
lea edi, [ebp + 0x20]
add esp, 0x28
cmp dword [edi + 0x14], 0x10
jb 0x4bbe36
mov edi, dword [edi]
push 2
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
push eax
push dword [ebp + 0x30]
push 1
push edi
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
add esp, 0x14
test esi, esi
je 0x4bbe5a
push 0x107
push esi
call ebx
push 2
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
push eax
call dword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll__unlock_file]
add esp, 8
lea ecx, [esp + 0x14]
call fcn.004bb020
mov ecx, dword [esp + 0x50]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.004c75e8
add esp, 0x44
ret 4
Function at 0x4bbd8b
Capabilities:
Write file on windows

Disassembly:
sub esp, 0x44
mov eax, dword [0x501230]
xor eax, esp
mov dword [esp + 0x40], eax
mov edx, dword [esp + 0x48]
push ebx
push ebp
push esi
mov eax, dword [edx]
push edi
cmp eax, 3
ja case.0x4bbd7d.0
jmp dword [eax*4 + 0x4bbe8c]
mov edi, 2
jmp 0x4bbd9b
mov edi, 3
jmp 0x4bbd9b
mov edi, 1
jmp 0x4bbd9b
xor edi, edi
push edx
lea eax, [ecx + 4]
push eax
lea eax, [esp + 0x1c]
push eax
call fcn.004bb920
push 2
mov ebp, eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
push eax
call dword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll__lock_file]
add esp, 0x14
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
mov ebx, dword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
mov esi, eax
test esi, esi
je 0x4bbdea
jmp dword [edi*4 + 0x4bbe9c]
cmp dword [ebp + 0x14], 0x10
mov dword [esp + 0x10], ebp
jb 0x4bbdfb
mov eax, dword [ebp]
mov dword [esp + 0x10], eax
mov edi, dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
push 2
call edi
push eax
push dword [ebp + 0x10]
push 1
push dword [esp + 0x20]
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
push 2
call edi
push eax
push dword [ebp + 0x1c]
push 1
push dword [ebp + 0x18]
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
lea edi, [ebp + 0x20]
add esp, 0x28
cmp dword [edi + 0x14], 0x10
jb 0x4bbe36
mov edi, dword [edi]
push 2
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
push eax
push dword [ebp + 0x30]
push 1
push edi
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
add esp, 0x14
test esi, esi
je 0x4bbe5a
push 0x107
push esi
call ebx
push 2
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
push eax
call dword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll__unlock_file]
add esp, 8
lea ecx, [esp + 0x14]
call fcn.004bb020
mov ecx, dword [esp + 0x50]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.004c75e8
add esp, 0x44
ret 4
Function at 0x4bbd92
Capabilities:
Write file on windows

Disassembly:
sub esp, 0x44
mov eax, dword [0x501230]
xor eax, esp
mov dword [esp + 0x40], eax
mov edx, dword [esp + 0x48]
push ebx
push ebp
push esi
mov eax, dword [edx]
push edi
cmp eax, 3
ja case.0x4bbd7d.0
jmp dword [eax*4 + 0x4bbe8c]
mov edi, 2
jmp 0x4bbd9b
mov edi, 3
jmp 0x4bbd9b
mov edi, 1
jmp 0x4bbd9b
xor edi, edi
push edx
lea eax, [ecx + 4]
push eax
lea eax, [esp + 0x1c]
push eax
call fcn.004bb920
push 2
mov ebp, eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
push eax
call dword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll__lock_file]
add esp, 0x14
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
mov ebx, dword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
mov esi, eax
test esi, esi
je 0x4bbdea
jmp dword [edi*4 + 0x4bbe9c]
cmp dword [ebp + 0x14], 0x10
mov dword [esp + 0x10], ebp
jb 0x4bbdfb
mov eax, dword [ebp]
mov dword [esp + 0x10], eax
mov edi, dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
push 2
call edi
push eax
push dword [ebp + 0x10]
push 1
push dword [esp + 0x20]
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
push 2
call edi
push eax
push dword [ebp + 0x1c]
push 1
push dword [ebp + 0x18]
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
lea edi, [ebp + 0x20]
add esp, 0x28
cmp dword [edi + 0x14], 0x10
jb 0x4bbe36
mov edi, dword [edi]
push 2
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
push eax
push dword [ebp + 0x30]
push 1
push edi
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
add esp, 0x14
test esi, esi
je 0x4bbe5a
push 0x107
push esi
call ebx
push 2
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
push eax
call dword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll__unlock_file]
add esp, 8
lea ecx, [esp + 0x14]
call fcn.004bb020
mov ecx, dword [esp + 0x50]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.004c75e8
add esp, 0x44
ret 4