joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4039b0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x477769
mov eax, dword fs:[0]
push eax
sub esp, 0x18
push esi
push edi
mov eax, dword [0x49c100]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x10], edi
mov dword [ebp - 0x20], edi
mov dword [ebp - 4], 0
lea ecx, [edi + 4]
mov dword [edi], vtable.spdlog::pattern_formatter.0
xorps xmm0, xmm0
push 2
movups xmmword [ecx], xmm0
push 0x488a38
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 0
call fcn.0040af40
xorps xmm0, xmm0
movups xmmword [edi + 0x1c], xmm0
mov dword [edi + 0x2c], 0
movups xmm0, xmmword [ebp + 0xc]
mov dword [edi + 0x30], 0
mov byte [ebp + 0xc], 0
movups xmmword [edi + 0x1c], xmm0
movq xmm0, qword [ebp + 0x1c]
movq qword [edi + 0x2c], xmm0
mov dword [ebp + 0x1c], 0
mov dword [ebp + 0x20], 0xf
mov dword [edi + 0x34], 0
mov byte [edi + 0x38], 1
mov dword [edi + 0x60], 0
mov dword [edi + 0x64], 0
mov dword [edi + 0x68], 0
mov dword [edi + 0x6c], 0
mov dword [edi + 0x70], 0
lea ecx, [edi + 0x74]
mov byte [ebp - 4], 3
call fcn.00406780
mov byte [ebp - 4], 4
xorps xmm0, xmm0
xor eax, eax
movups xmmword [edi + 0x3c], xmm0
push 0x138
movups xmmword [edi + 0x4c], xmm0
mov dword [edi + 0x5c], 0
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x18], eax
call fcn.00475da2
push 0x138
push 0
push eax
mov dword [ebp - 0x10], eax
call sub.VCRUNTIME140.dll_memset
mov ecx, dword [ebp - 0x10]
add esp, 0x10
movq xmm0, qword [ebp - 0x1c]
mov eax, dword [ebp - 0x14]
movq qword [ecx + 4], xmm0
mov dword [ecx + 0xc], eax
lea eax, [ecx + 0x28]
mov dword [ecx], vtable.spdlog::details::full_formatter.0
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 0
mov dword [ecx + 0x1c], eax
xor eax, eax
mov dword [ecx + 0x20], 0
mov dword [ecx + 0x18], vtable.fmt::v10::basic_memory_buffer_char__250__class_std::allocator_char__.0
mov dword [ecx + 0x24], 0xfa
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x18], eax
movq xmm0, qword [ebp - 0x1c]
movq qword [ecx + 0x128], xmm0
mov dword [ebp - 0x14], eax
mov dword [ecx + 0x130], eax
mov dword [ecx + method.std::_Ref_count_class_sio::string_message_.virtual_8], vtable.spdlog::details::mdc_formatter_struct_spdlog::details::null_scoped_padder_.0
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x10], ecx
mov byte [ebp - 4], 6
mov eax, dword [edi + 0x6c]
cmp eax, dword [edi + 0x70]
je 0x403b44
mov dword [eax], ecx
add dword [edi + 0x6c], 4
jmp 0x403b5e
lea ecx, [ebp - 0x10]
push ecx
push eax
lea ecx, [edi + 0x68]
call fcn.004110c0
mov ecx, dword [ebp - 0x10]
test ecx, ecx
je 0x403b5e
mov eax, dword [ecx]
push 1
call dword [eax]
mov ecx, dword [ebp + 0x20]
cmp ecx, 0xf
jbe 0x403b94
mov edx, dword [ebp + 0xc]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x403b8a
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x403b8a
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push ecx
push edx
call fcn.0047613e
add esp, 8
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 0x1c
Function at 0x405010
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x477abd
mov eax, dword fs:[0]
push eax
sub esp, 0x40
mov eax, dword [0x49c100]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov dword [ebp - 0x2c], ebx
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x28]
mov eax, dword [ebp + 8]
add eax, 8
push eax
call fcn.00407130
mov byte [ebp - 4], 1
lea esi, [ebp - 0x28]
cmp dword [ebp - 0x14], 0xf
mov edx, 0x811c9dc5
mov edi, dword [ebp - 0x18]
cmova esi, dword [ebp - 0x28]
xor ecx, ecx
test edi, edi
je 0x405084
movzx eax, byte [esi + ecx]
inc ecx
xor eax, edx
imul edx, eax, 0x1000193
cmp ecx, edi
jb 0x405073
push edx
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x34]
push eax
lea ecx, [ebx + 0x90]
call fcn.00410f40
mov eax, dword [eax + 4]
test eax, eax
jne 0x4050a5
mov eax, dword [ebx + 0x94]
mov ecx, dword [ebp - 0x2c]
cmp eax, dword [ecx + 0x94]
lea eax, [ebp - 0x28]
push eax
jne 0x405190
lea ecx, [ebx + 0x90]
call fcn.00406b60
mov ecx, dword [ebp + 8]
or edi, 0xffffffff
mov edx, dword [ebp + 0xc]
mov dword [ebp + 8], 0
mov dword [ebp + 0xc], 0
mov esi, dword [eax + 4]
mov dword [eax], ecx
mov dword [eax + 4], edx
test esi, esi
je 0x405105
mov eax, edi
lock xadd dword [esi + 4], eax
jne 0x405105
mov eax, dword [esi]
mov ecx, esi
call dword [eax]
mov eax, edi
lock xadd dword [esi + 8], eax
jne 0x405105
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 4]
mov ecx, dword [ebp - 0x14]
cmp ecx, 0xf
jbe 0x40513b
mov edx, dword [ebp - 0x28]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x405131
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x405131
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push ecx
push edx
call fcn.0047613e
add esp, 8
mov esi, dword [ebp + 0xc]
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0xf
mov byte [ebp - 0x28], 0
test esi, esi
je 0x405172
mov eax, edi
lock xadd dword [esi + 4], eax
jne 0x405172
mov eax, dword [esi]
mov ecx, esi
call dword [eax]
lock xadd dword [esi + 8], edi
dec edi
jne 0x405172
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 4]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00475cb4
mov esp, ebp
pop ebp
ret 8
lea eax, [ebp - 0x4c]
push str.logger_with_name_
push eax
call fcn.00409c70
sub esp, 0xc
mov byte [ebp - 4], 2
mov ecx, esp
push str._already_exists
push eax
push ecx
call fcn.00407750
add esp, 0xc
call fcn.00402660
int3
Function at 0x405b70
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x477cc0
mov eax, dword fs:[0]
push eax
sub esp, 0x300
mov eax, dword [0x49c100]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push 0x2f0
lea eax, [ebp - 0x30c]
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
lea ecx, [ebp - 0x30c]
call fcn.00416520
push 4
mov dword [ebp - 4], 0
call fcn.00475da2
lea ecx, [ebp - 0x30c]
mov dword [ebp - 0x1c], eax
mov dword [eax], ecx
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 1
push ecx
push 0
push eax
push 0x411e60
push 0
push 0
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
add esp, 0x1c
mov dword [ebp - 0x18], eax
test eax, eax
je 0x405d05
lea ecx, [ebp - 0x18]
mov byte [ebp - 4], 2
call fcn.00402110
lea ecx, [ebp - 0x30c]
call fcn.00417de0
mov byte [ebp - 4], 0
cmp dword [ebp - 0x14], 0
je 0x405c26
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_terminate]
lea ecx, [ebp - 0x30c]
mov dword [ebp - 4], 3
call fcn.00417de0
lea ecx, [ebp - 0xd4]
call dword [sym.imp.elvtx_shared.dll_public:_void___thiscall_ApplicationSocketClient::destructor_void_]
lea ecx, [ebp - 0x104]
call fcn.00413560
lea ecx, [ebp - 0x2d4]
call fcn.00416930
lea ecx, [ebp - 0x2e8]
call dword [sym.imp.elvtx_shared.dll_public:_void___thiscall_EventManager::destructor_void_]
mov ecx, dword [ebp - 0x2ec]
cmp ecx, 0xf
jbe 0x405ca2
mov edx, dword [ebp - 0x300]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x405c98
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x405c98
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push ecx
push edx
call fcn.0047613e
add esp, 8
mov esi, dword [ebp - 0x308]
mov dword [ebp - 0x2f0], 0
mov dword [ebp - 0x2ec], 0xf
mov byte [ebp - 0x300], 0
test esi, esi
je 0x405ce8
or edi, 0xffffffff
mov eax, edi
lock xadd dword [esi + 4], eax
jne 0x405ce8
mov eax, dword [esi]
mov ecx, esi
call dword [eax]
lock xadd dword [esi + 8], edi
dec edi
jne 0x405ce8
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 4]
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00475cb4
mov esp, ebp
pop ebp
ret
push 6
mov dword [ebp - 0x14], 0
call dword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
int3
Function at 0x409dd0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x478226
mov eax, dword fs:[0]
push eax
sub esp, 0x140
mov eax, dword [0x49c100]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x11c]
push 0x10c
push 0
push eax
call sub.VCRUNTIME140.dll_memset
lea eax, [ebp - 0x10c]
mov dword [ebp - 0x114], 0
add esp, 0xc
mov dword [ebp - method.fmt::v10::basic_memory_buffer_char__250__class_std::allocator_char__.virtual_0], vtable.fmt::v10::basic_memory_buffer_char__250__class_std::allocator_char__.0
mov dword [ebp - 0x118], eax
mov dword [ebp - 0x110], 0xfa
mov dword [ebp - 4], 0
lea edx, [ebp - 0x11c]
mov ecx, dword [edi + 8]
push edx
push esi
mov eax, dword [ecx]
call dword [eax + 4]
mov ebx, dword [edi + 0x5c]
mov esi, dword [ebp - 0x114]
add ebx, esi
cmp ebx, dword [edi + 0x54]
jbe 0x409e95
lea ecx, [edi + 0x60]
call fcn.004056d0
lea ecx, [edi + 0x60]
call fcn.00405760
test eax, eax
je 0x409e8f
mov ecx, edi
call fcn.0040fd50
mov esi, dword [ebp - 0x114]
mov ebx, esi
jmp 0x409e95
mov esi, dword [ebp - 0x114]
mov eax, dword [edi + 0x68]
test eax, eax
je 0x409eb3
push eax
push esi
push 1
push dword [ebp - 0x118]
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
add esp, 0x10
cmp eax, esi
jne 0x409f1e
mov ecx, dword [ebp - 0x118]
lea eax, [ebp - 0x10c]
mov dword [edi + 0x5c], ebx
mov dword [ebp - method.fmt::v10::basic_memory_buffer_char__250__class_std::allocator_char__.virtual_0], vtable.fmt::v10::basic_memory_buffer_char__250__class_std::allocator_char__.0
cmp ecx, eax
je 0x409f00
mov edx, dword [ebp - 0x110]
mov eax, ecx
cmp edx, 0x1000
jb 0x409ef6
mov ecx, dword [eax - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x409ef6
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push edx
push ecx
call fcn.0047613e
add esp, 8
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00475cb4
mov esp, ebp
pop ebp
ret 4
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
lea edx, [edi + 0x6c]
lea ecx, [ebp - 0x134]
mov esi, dword [eax]
call fcn.00402760
push eax
lea eax, [ebp - 0x14c]
mov byte [ebp - 4], 1
push str.Failed_writing_to_file
push eax
call fcn.00409cd0
add esp, 0xc
mov edx, esi
mov byte [ebp - 4], 2
mov ecx, eax
call fcn.004025c0
int3
Function at 0x40a2f0
Capabilities:
Access peb ldr_data
Get number of processors

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x478345
mov eax, dword fs:[0]
push eax
push ebx
sub esp, 0x40
push esi
push edi
mov eax, dword [0x49c100]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x14], 0
call fcn.00404f70
mov edi, eax
mov eax, dword [ebx + 8]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebx + 0xc]
mov dword [ebp - 0x20], edi
lea esi, [edi + 0x30]
mov dword [ebp - 0x18], eax
push esi
mov dword [ebp - 0x24], esi
call dword [sym.imp.MSVCP140.dll__Mtx_lock]
add esp, 4
test eax, eax
je 0x40a364
push 5
call dword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
mov eax, dword [esi + 0x2c]
cmp eax, 0x7fffffff
jne 0x40a37a
dec eax
push 6
mov dword [esi + 0x2c], eax
call dword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
push 0x64
mov dword [ebp - 4], 0
call fcn.00475da2
add esp, 4
mov dword [ebp - 0x28], eax
lea ecx, [ebp - 0x50]
mov dword [ebp - 0x50], vtable.std::_Func_impl_no_alloc_class__public:_void___thiscall_spdlog::details::registry::flush_every_long_long___int64___struct_std::ratio_1__1___class_std::chrono::duration_long_long___int64___struct_std::ratio_1__1___::_2::_lambda_1___void___.0
mov dword [ebp - 0x4c], edi
mov dword [ebp - 0x2c], ecx
push dword [ebp - 0x18]
mov byte [ebp - 4], 2
push dword [ebp - 0x1c]
mov dword [ebp - 0x14], 1
push ecx
mov ecx, eax
call fcn.00412770
mov dword [ebp - 0x1c], eax
mov ecx, dword [ebp - 0x2c]
test ecx, ecx
je 0x40a3d5
mov edi, dword [ecx]
lea eax, [ebp - 0x50]
cmp ecx, eax
setne dl
movzx eax, dl
push eax
call dword [edi + 0x10]
mov edi, dword [ebp - 0x20]
mov eax, dword [edi + 0x110]
mov ecx, dword [ebp - 0x1c]
mov dword [edi + 0x110], ecx
test eax, eax
je 0x40a3ee
push eax
call fcn.00407300
push esi
call dword [sym.imp.MSVCP140.dll__Mtx_unlock]
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret
Function at 0x40f790
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
mov ebx, ecx
mov eax, 0x1fffffff
bsr ecx, eax
push esi
push edi
mov edi, 1
mov dword [ebp - 0x10], ebx
mov eax, edi
shl eax, cl
mov ecx, dword [ebp + 8]
cmp ecx, eax
jbe 0x40f7c1
push str.invalid_hash_bucket_count
call dword [sym.imp.MSVCP140.dll_void___cdecl_std::_Xlength_error_char_const__]
lea eax, [ecx - 1]
mov esi, dword [ebx + 4]
or eax, 1
mov dword [ebp - 8], esi
bsr ecx, eax
push esi
lea ecx, [ecx + 1]
shl edi, cl
lea ecx, [ebx + 0xc]
lea eax, [edi + edi]
push eax
call fcn.004075e0
lea eax, [edi - 1]
mov dword [ebx + 0x1c], edi
mov dword [ebx + 0x18], eax
mov eax, dword [ebx + 4]
mov eax, dword [eax]
mov ecx, eax
cmp eax, esi
je 0x40f8a9
nop word [eax + eax]
mov bl, byte [eax + 8]
mov ecx, dword [ecx]
movzx edx, bl
xor edx, 0x811c9dc5
imul edi, edx, 0x1000193
mov edx, dword [ebp - 0x10]
and edi, dword [edx + 0x18]
mov edx, dword [edx + 0xc]
lea edx, [edx + edi*8]
mov edi, dword [edx]
mov dword [ebp - 0xc], edx
cmp edi, esi
jne 0x40f830
mov dword [edx], eax
mov dword [edx + 4], eax
jmp 0x40f89f
mov edx, dword [edx + 4]
cmp bl, byte [edx + 8]
jne 0x40f867
mov edx, dword [edx]
mov dword [ebp - 4], edx
cmp edx, eax
je 0x40f85f
mov ebx, dword [eax + 4]
mov esi, dword [ebp - 4]
mov dword [ebx], ecx
mov edi, dword [ecx + 4]
mov dword [edi], edx
mov edx, dword [edx + 4]
mov dword [edx], eax
mov dword [esi + 4], edi
mov esi, dword [ebp - 8]
mov dword [ecx + 4], ebx
mov dword [eax + 4], edx
mov edx, dword [ebp - 0xc]
mov dword [edx + 4], eax
jmp 0x40f89f
cmp edi, edx
je 0x40f87c
nop dword [eax + eax]
mov edx, dword [edx + 4]
cmp bl, byte [edx + 8]
je 0x40f8b2
cmp edi, edx
jne 0x40f870
mov ebx, dword [eax + 4]
mov dword [ebp - 4], ebx
mov dword [ebx], ecx
mov ebx, dword [ecx + 4]
mov dword [ebx], edx
mov edi, dword [edx + 4]
mov dword [edi], eax
mov dword [edx + 4], ebx
mov edx, dword [ebp - 4]
mov dword [ecx + 4], edx
mov edx, dword [ebp - 0xc]
mov dword [eax + 4], edi
mov dword [edx], eax
mov eax, ecx
cmp ecx, esi
jne 0x40f800
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
mov ebx, dword [eax + 4]
mov edx, dword [edx]
mov dword [ebp - 4], edx
mov esi, edx
mov dword [ebx], ecx
mov edi, dword [ecx + 4]
mov dword [edi], edx
mov edx, dword [edx + 4]
mov dword [edx], eax
mov dword [esi + 4], edi
mov esi, dword [ebp - 8]
mov dword [ecx + 4], ebx
mov dword [eax + 4], edx
jmp 0x40f89f
Function at 0x40f8f0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
mov ebx, ecx
mov eax, 0x1fffffff
bsr ecx, eax
push esi
mov esi, 1
mov dword [ebp - 0x14], ebx
mov eax, esi
shl eax, cl
mov ecx, dword [ebp + 8]
push edi
cmp ecx, eax
jbe 0x40f921
push str.invalid_hash_bucket_count
call dword [sym.imp.MSVCP140.dll_void___cdecl_std::_Xlength_error_char_const__]
lea eax, [ecx - 1]
or eax, 1
bsr ecx, eax
mov eax, dword [ebx + 4]
push eax
mov dword [ebp - 8], eax
lea ecx, [ecx + 1]
shl esi, cl
lea ecx, [ebx + 0xc]
lea eax, [esi + esi]
push eax
call fcn.004075e0
lea eax, [esi - 1]
mov dword [ebx + 0x1c], esi
mov dword [ebx + 0x18], eax
mov esi, dword [ebx + 4]
mov eax, dword [ebp - 8]
mov esi, dword [esi]
mov edi, esi
cmp esi, eax
je 0x40fa4a
nop dword [eax]
cmp dword [esi + 0x1c], 0xf
lea ecx, [esi + 8]
mov edi, dword [edi]
mov edx, dword [ecx + 0x10]
mov dword [ebp - 0x10], edi
mov dword [ebp - 0xc], edx
mov dword [ebp - 4], ecx
jbe 0x40f97c
mov edx, dword [ecx]
mov dword [ebp - 4], edx
xor edx, edx
mov ebx, 0x811c9dc5
cmp dword [ecx + 0x10], edx
jbe 0x40f9a7
mov eax, dword [ebp - 4]
mov edi, dword [ebp - 0xc]
nop
movzx ecx, byte [eax + edx]
inc edx
xor ecx, ebx
imul ebx, ecx, 0x1000193
cmp edx, edi
jb 0x40f990
mov edi, dword [ebp - 0x10]
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 0x14]
and ebx, dword [ecx + 0x18]
mov ecx, dword [ecx + 0xc]
lea ecx, [ecx + ebx*8]
mov dword [ebp - 4], ecx
cmp dword [ecx], eax
jne 0x40f9c4
mov dword [ecx], esi
mov dword [ecx + 4], esi
jmp 0x40fa40
mov ebx, dword [ecx + 4]
lea eax, [ebx + 8]
push eax
lea eax, [esi + 8]
push eax
call fcn.0040fcc0
test al, al
jne 0x40f9fe
mov ebx, dword [ebx]
cmp ebx, esi
je 0x40f9f6
mov edx, dword [esi + 4]
mov dword [edx], edi
mov ecx, dword [edi + 4]
mov dword [ecx], ebx
mov eax, dword [ebx + 4]
mov dword [eax], esi
mov dword [ebx + 4], ecx
mov dword [edi + 4], edx
mov dword [esi + 4], eax
mov eax, dword [ebp - 4]
mov dword [eax + 4], esi
jmp 0x40fa3d
mov eax, dword [ebp - 4]
cmp dword [eax], ebx
je 0x40fa20
mov ebx, dword [ebx + 4]
lea eax, [ebx + 8]
push eax
lea eax, [esi + 8]
push eax
call fcn.0040fcc0
test al, al
je 0x40fa53
mov eax, dword [ebp - 4]
cmp dword [eax], ebx
jne 0x40fa05
mov edx, dword [esi + 4]
mov dword [edx], edi
mov ecx, dword [edi + 4]
mov dword [ecx], ebx
mov eax, dword [ebx + 4]
mov dword [eax], esi
mov dword [ebx + 4], ecx
mov dword [edi + 4], edx
mov dword [esi + 4], eax
mov eax, dword [ebp - 4]
mov dword [eax], esi
mov eax, dword [ebp - 8]
mov esi, edi
cmp edi, eax
jne 0x40f960
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
mov edx, dword [esi + 4]
mov ebx, dword [ebx]
mov dword [edx], edi
mov ecx, dword [edi + 4]
mov dword [ecx], ebx
mov eax, dword [ebx + 4]
mov dword [eax], esi
mov dword [ebx + 4], ecx
mov dword [edi + 4], edx
mov dword [esi + 4], eax
jmp 0x40fa3d
Function at 0x412770
Capabilities:
Access peb ldr_data
Create thread

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x478b12
mov eax, dword fs:[0]
push eax
push ebx
sub esp, 0x50
mov eax, dword [0x49c100]
xor eax, ebp
mov dword [ebp - 0x14], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x18], esi
mov eax, dword [ebx + 8]
xorps xmm0, xmm0
mov dword [ebp - 0x28], esi
mov dword [ebp - 0x1c], eax
movq qword [esi + 4], xmm0
mov dword [ebp - 4], 0
lea eax, [esi + 0x3c]
movups xmmword [esi + 0x18], xmm0
push eax
movq qword [esi + 0x28], xmm0
mov dword [esi + 0x30], 0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
mov dword [esi + 0x34], 0xffffffff
mov dword [esi + 0xc], 2
mov dword [esi + 0x38], 0
call dword [sym.imp.MSVCP140.dll__Cnd_init_in_situ]
add esp, 4
mov byte [ebp - 4], 1
mov edx, dword [ebx + 0xc]
mov eax, edx
mov edi, dword [ebx + 0x10]
or eax, edi
jne 0x41283f
mov byte [esi], al
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.00475cb4
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret 0xc
test edi, edi
jg 0x41284d
jl 0x412849
test edx, edx
jae 0x41284d
or al, 0xff
jmp 0x41284f
mov al, 1
test al, al
setg cl
mov byte [esi], cl
test al, al
jle 0x41281d
mov byte [ebp - 4], 2
mov ecx, dword [ebp - 0x1c]
mov dword [ebp - 0x60], esi
mov dword [ebp - 0x34], 0
mov ecx, dword [ecx + 0x24]
test ecx, ecx
je 0x412885
mov eax, dword [ecx]
lea edx, [ebp - 0x58]
push edx
mov eax, dword [eax]
call eax
mov edi, dword [ebx + 0x10]
mov edx, dword [ebx + 0xc]
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x30], edx
mov dword [ebp - 0x2c], edi
push 0x38
mov byte [ebp - 4], 3
call fcn.00475da2
mov edi, eax
add esp, 4
mov dword [ebp - 0x18], edi
mov eax, dword [ebp - 0x60]
lea ecx, [edi + 8]
mov dword [edi], eax
mov dword [ebp - 0x1c], ecx
mov dword [ecx + 0x24], 0
mov byte [ebp - 4], 5
mov edx, dword [ebp - 0x34]
test edx, edx
je 0x4128c7
mov eax, dword [edx]
push ecx
mov ecx, edx
mov eax, dword [eax]
call eax
mov dword [edi + 0x2c], eax
mov eax, dword [ebp - 0x30]
mov ecx, dword [ebp - 0x2c]
mov dword [edi + 0x30], eax
mov dword [edi + 0x34], ecx
mov dword [ebp - 0x18], edi
lea eax, [ebp - 0x20]
mov byte [ebp - 4], 6
push eax
push 0
push edi
push 0x412c20
push 0
push 0
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov ecx, eax
add esp, 0x18
mov dword [ebp - 0x24], ecx
test ecx, ecx
je 0x41293a
cmp dword [esi + 8], 0
je 0x412908
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_terminate]
mov eax, dword [ebp - 0x20]
xorps xmm0, xmm0
mov dword [esi + 4], ecx
mov ecx, dword [ebp - 0x34]
movlpd qword [ebp - 0x24], xmm0
mov dword [esi + 8], eax
test ecx, ecx
je 0x41281d
mov edx, dword [ecx]
lea eax, [ebp - 0x58]
cmp ecx, eax
setne al
movzx eax, al
push eax
call dword [edx + 0x10]
jmp 0x41281d
push 6
mov dword [ebp - 0x20], 0
call dword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
int3