joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1266f04
Capabilities:
Check http status code

Disassembly:
ret
xor ebp, esi
mov dword [esp + edi - 0x58b12edd], ebp
and esi, 0x7c2f0f36
lea edx, [edx + ebp - 0x6b4b37a2]
jbe 0x12543fc
xor bp, di
push ecx
push edx
call fcn.014cc4e4
dec ecx
mov esp, edx
rcr dx, 0x89
pop esi
inc cx
rcr ebx, cl
dec eax
cdq
inc ebp
btc edi, edx
pop eax
inc eax
shr bh, 0x1e
pop ecx
inc esp
adc ebx, esp
inc esp
movzx esi, sp
inc ebp
xchg al, bl
inc ecx
pop edi
inc cx
btr eax, 0x35
inc ecx
pop esi
btr dx, 0xf
inc ecx
sub ebx, esp
inc ecx
pop esp
inc ecx
add cl, 0x8c
inc ecx
pop ebx
inc ebp
bsr edx, ebp
inc ecx
pop edx
inc eax
or ch, 0x72
inc ecx
pop eax
inc eax
adc bh, 0x2c
inc eax
add bh, dh
pop ebx
sar dx, cl
add ebp, 0x23b70cd5
xchg dx, di
pop edx
bt bp, 0x8c
inc ecx
pop ecx
inc ax
movzx edi, ah
inc ecx
pop ebp
shr bp, cl
popfd
jmp 0x1469992
pop edi
not bp
pop ebp
jmp 0x1186fe1

Function at 0x12b9746
Capabilities:
Encode data using base64

Disassembly:
xor ebx, edx
cmc
test ecx, ebx
stc
add esi, edx
jmp 0x1520704
shr byte [esp + edi - 0x267fffe8], 0xf7
mov edx, dword [esp + edi*2 - 0x4cffffec]
test word [esp + edi*2 - 0x4cffffec], dx
lea ebx, [ebx + edi*4 - 0x1be6d6b4]
jle 0x14f25ea
add edi, edi
neg dword [esp + 0x18]
call fcn.014fc625
call fcn.0130e73d
xor edx, ebx
neg edx
clc
xor edx, 0x664f502e
test esi, ebp
cmp ebp, 0x17183e33
cmp sp, dx
bswap edx
test eax, esi
sub edx, 0x368e6fc9
jmp 0x1255139
mov word [edi + 4], dx
pushfd
or dl, 0xb7
bts edx, ecx
cmp dx, si
pop dword [edi]
sub ebp, 4
mov edx, dword [ebp]
jmp 0x144c440
mov edx, 0x226206e8
jge 0x1551957
jmp fcn.013658c5
mov ebp, dword [esp + ebp*4 - 0x6d114bd0]
setb dl
jge 0x152e7b1
sub edi, 2
shr dl, cl
jmp 0x14a0fe1

Function at 0x1379d7d
Capabilities:
Check http status code

Disassembly:
and al, 0x20
push edi
mov ecx, dword [esp + ecx*2 - 0x403ffec]
mov dword [esp + 0x14], ebx
mov edi, 0x69b766ae
call fcn.0151c783
leave
adc byte [ecx], dl
jae 0x125442c
invalid
inc edi
jle 0x12543d3
add al, 0xca
add byte [esi + 0x312c45f1], ch
or dword [edx - 0x55], edi
cmp al, 0xb1
jb 0x1254489
enter 0x5663, 0x11
mov edx, 0xc740197f
push esi
sbb eax, 0x72b40e4f
mov al, 0xea
mov bl, 0xa6
hlt
push ebx
salc
invalid
bswap ecx
jno 0x12543fc
Function at 0x13c0064
Capabilities:
Encode data using xor

Disassembly:
cmp dword [esp + 0x14], 0x3e6875a7
jns 0x151a043
call fcn.0130eeae
inc ecx
mov eax, dword [edx + 4]
inc ecx
mov edx, dword [edx]
movsx esi, cx
dec ecx
sub edx, 8
inc eax
setno dh
sbb esi, edi
mul edx
inc ecx
mov dword [edx + 8], edx
inc ecx
mov dh, bh
bswap si
dec eax
mov esi, 0x6754138b
inc ecx
mov dword [edx + 0xc], eax
inc cx
movzx esi, dh
dec ecx
movsx esi, di
inc eax
xchg dh, dh
pushfd
inc ecx
pop dword [edx]
dec ecx
sub edi, 4
inc ecx
mov esi, dword [edi]
inc ecx
xor esi, eax
sub esi, 0x4b5034ac
cmc
xor esi, 0x38f70552
ror esi, 3
stc
inc cx
test ebx, esp
xor esi, 0x6e5b2d5e
jmp 0x140586a
mov eax, dword [esp + 8]
mov eax, dword [eax]
mov dword [esp + 8], ebx
and al, 8
mov word [esp + 4], 0x3df9
shr bl, 0xe5
add dword [esp + 0x18], 0xff9f9aa7
call fcn.013d3063
mov ss, word [ebp - 0x19]
fsub dword [edx - 0x5f]
sub dword [edi], ebx
and dword [ebx - 0x631ff35e], edx
sub al, 0x58
push ebp
out 0xd8, eax
bound esp, qword [ecx - 0x6cdee0d7]
mov byte [0x2c9ce00c], al
pop eax
xor ah, al
rcl dword [ecx - 0x17], 0x15
loopne 0x151a066
ja 0x151a0aa
adc ah, byte [eax + 8]
push ebp
shl eax, 0x9f
inc ecx
les ebx, [edx]
clc
lahf
sub ch, byte [esi + edi*2]
add al, 0x60
nop
into
dec esp
or al, ah
aam 0x28
je 0x151a087
pop ds
xchg dword [ebx - 0x24], edi
sub byte [eax + 0x4e], ah
and al, 0x22
or edx, dword [ebx]
aas
sub dword [esi + ebp], 0x6d
sbb al, 0xd6
add ecx, dword [ecx - 0x73a7970f]
xlatb
adc eax, 0xfb681c42
sbb al, 0x68
sti
xchg esp, eax
aad 0x9f
cmp al, 0x4d
jg 0x151a04b
push edi
dec edx
sar byte [edx + 0x40], cl
test dword [ebp + 0x32f3f11d], 0x7c485d98
jno 0x151a0b5
sub dword [eax - 0x77], 0x66c49266
ljmp 0x7a22

Function at 0x13cbc5a
Capabilities:
Encode data using xor

Disassembly:
push 0x4af6673f
pushfd
add byte [esp + 4], 0xc8
jl 0x121bd8c
neg word [esp + 4]
call fcn.01378f01
clc
not eax
cmp dh, al
xor ebx, eax
test sp, 0x21cf
jmp 0x13c3c6b

Function at 0x13e66fb
Capabilities:
Check for software breakpoints

Disassembly:
mov eax, dword [ebp + ebx*4]
push eax
cmp ah, 0xcc
jmp 0x146ba48
call eax
mov ebp, dword [ebp - 4]
bswap si
mov dword [ebp], eax
mov edi, ebp
xor dx, 0x4df5
sbb ebp, 0x3c340a7f
pop ebx
adc ebp, edi
add bp, 0x67bb
sal bp, 0x2b
pop esi
pop ebp
add edx, esp
bt edx, ebp
stc
mov edx, dword [ebp]
stc
clc
add ebp, 4
xor edx, ebx
jmp 0x12fd4f0
inc edx
bswap edx
inc edx
stc
test dh, 0x31
clc
xor edx, 0x297108ca
xor ebx, edx
test dl, 0x46
add esi, edx
jmp esi
mov dword [esp + 0x1c], edi
xchg dword [esp + 0x28], esi
mov edi, dword [esp + 0x24]
setae byte [esp + 0x1c]
call fcn.01359452
jne 0x11afa2a
mov eax, dword [ebp]
jmp 0x1298ba1
sub ebx, 1
jmp 0x13e6711
Function at 0x143c462
Capabilities:
Encode data using xor

Disassembly:
not dword [esp + ebp - 0x279d7fa4]
jns fcn.0136199b
neg dword [esp + ebp - 0x279d7f98]
sub dword [esp + ebp - 0x279d7fa8], 0x13353dd2
shl word [esp + ebp - 0x279d7f98], 0x33
mov ebp, dword [esp + ebp*2 - 0x4f3aff5c]
cmp dword [esp + 0x14], 0x58a8380a
call fcn.012d60e6
cmp edx, dword [edi + esi + 0x713958b1]
ficomp word [eax - 0x3e9d2294]
mov cl, 0x58
cmp dword [ecx - 0x22], esi
cwde
insb byte es:[edi], dx
frstor dword [edx - 0x3f]
sti
mov edx, 0x9341eba1
out dx, al
aad 0xab
pop esp
add dword [edx + 0x126a403a], 0x63
cli
adc al, 0x76
mov bl, 0xb7
call 0xb8c3b3bb
push edx
xor edx, ecx
sbb edx, dword [edx + 0x6b282b06]
jge 0x143c4a1
repz ret

Function at 0x14f25dd
Capabilities:
Encode data using base64

Disassembly:
push edx
xchg dword [esp + 0x10], eax
add ebp, 0x467434a6
neg ebp

Function at 0x15034c3
Capabilities:
Encode data using xor

Disassembly:
cmp word [esp + 0x10], 0x4164
call fcn.014eb0a0
dec edx
cmc
jmp 0x1388b45
test dword [esp + edx - 0x714413f1], 0x67121204
xchg dword [esp + edx - 0x714413e5], ebp
mov edx, dword [esp + edx - 0x714413f9]
jge 0x11ba662
call fcn.01504ae3
xor ebx, edx
test edx, 0x37e7323c
add ebp, edx
jmp 0x15729d6
jo 0x13057c3
mov ebx, dword [esp + ecx - 0x4f6f194c]
mov dword [esp + ebx*2 - 0x6727ffec], ecx
lea esi, [esi + ebx*2 - 0x48c889fa]
not dword [esp + ebx*2 - 0x6727ffec]
and dword [esp + ebx*2 - 0x6727ffe4], ebx
or dword [esp + ebx - 0x3393fffc], ecx
lea ebx, [ebx + ecx + 0x1f184534]
sub dword [esp + ecx - 0x4f6f1954], 0x30ed13a5
shl byte [esp + ecx - 0x4f6f1954], 0x24
js 0x154b871
mov dword [esp + ecx - 0x4f6f194c], 0x1ef10d06
push edx
xchg dword [esp + 0x24], esi
mov ecx, dword [esp + 0xc]
sub word [esp + 0x18], 0xcbb
mov edx, 0x264510dc
movzx bx, byte [esp + edx*2 - 0x4c8a21af]
pop edx
call fcn.013c5a8c
inc ecx
test esp, esp
jmp 0x1526f01
rol edx, 2
xor ebx, edx
add ebp, edx
jmp fcn.01249a28
mov dword [esp + edx - 0x71441486], edx
jb 0x12fd469
seta dl
mov word [esp + edx - 0x714413fd], dx
adc al, 3
in al, dx
mov ebx, 0x15ac8d8e
cmp dword [eax], 0xa481c9f7
adc al, 3
in al, dx
mov ebx, 0xa36e098e
inc ebx
lea ebp, [ebp + edx - 0x3608c77f]
and dword [esp + edx - 0x714413fd], 0x43a36e09
and byte [esp + edx - 0x714413f1], dh
jae 0x1292cb9
sbb dword [ebp + 0x6d3bfc33], edx
jp 0x15034db
and dword [edx], 0xffffff9d
mov bl, 0xc6
and dword [edx - 0x2d], 0xffffff9e
pop ss
in al, dx
xor ebx, edi
cmc
xlatb
or esi, 0x6b
ja 0x15034d6
adc esp, dword [ebx + 0x6c3e6e77]
mov al, byte [0xfc190786]
jmp dword [esi + edi*4 - 0x2018fc24]
xor ecx, 0xf384d45
stc
clc
ror ecx, 1
sub ecx, 0xc135ca0
test bp, bp
xor ebx, ecx
add ebp, ecx
jmp fcn.011b2325
mov ebp, dword [esp + ebx - 0x12d3d3a5]
sub dword [esp + ebx*2 - 0x25a7a752], 0x2d6c3cb4
ja 0x147458e
jmp ebp
Function at 0x408415
Capabilities:
Access peb ldr_data

Disassembly:
xor eax, eax
push eax
push eax
push eax
push ebx
push eax
push eax
push 0x160d6838
call ebp
pop eax
pop eax
popal
jmp 0x408528
fldpi
wait
fnstenv [esp - 0xc]
xor edx, edx
mov dl, 0x77
xor ecx, ecx
mov esi, dword fs:[ecx + 0x30]
mov esi, dword [esi + 0xc]
mov esi, dword [esi + 0x1c]
mov eax, dword [esi + 8]
mov edi, dword [esi + 0x20]
mov esi, dword [esi]
cmp byte [edi + 0x18], cl
jne 0x40853f
pop ecx
Function at 0x403c60
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x492e80
mov eax, dword fs:[0]
push eax
push esi
push edi
mov eax, dword [0x4be130]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov eax, dword [esi + 0x2c]
cmp eax, dword [esi + 0x30]
mov edx, dword [esi + 0x34]
mov edi, edx
sbb ecx, ecx
mov dword [ebp - 4], 0
and ecx, 0xfffffffc
xor al, al
push edx
mov ecx, dword [ecx + esi + 0x30]
rep stosb byte es:[edi], al
call fcn.00420db0
mov eax, dword [esi + 0x1c]
mov ecx, dword [esi + 0x20]
cmp eax, ecx
mov edx, dword [esi + 0x24]
mov edi, edx
cmovb ecx, eax
mov dword [ebp - 4], 1
xor al, al
rep stosb byte es:[edi], al
push edx
call fcn.00420db0
mov ecx, dword [esi + 0xc]
add esp, 8
test ecx, ecx
je 0x403cdc
mov eax, dword [ecx]
push 1
call dword [eax]
test byte [ebp + 8], 1
je 0x403ced
push 0x40
push esi
call fcn.00466cf9
add esp, 8
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4

Function at 0x4072a0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x4be130]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, ecx
cmp dword [esi + 0x38], 0
je 0x40735a
cmp byte [esi + 0x3d], 0
je 0x40735a
mov eax, dword [esi]
push edi
push 0xffffffffffffffff
call dword [eax + 0xc]
cmp eax, 0xffffffff
je 0x407348
mov ecx, dword [esi + 0x38]
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 4]
push eax
mov edx, dword [ecx]
lea eax, [ebp - 0x24]
push eax
lea eax, [esi + 0x40]
push eax
call dword [edx + 0x20]
sub eax, 0
je 0x407310
sub eax, 1
je 0x407314
sub eax, 2
jne 0x407348
mov byte [esi + 0x3d], al
mov al, 1
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00466d07
mov esp, ebp
pop ebp
ret
mov byte [esi + 0x3d], 0
mov edi, dword [ebp - 0x28]
lea eax, [ebp - 0x24]
sub edi, eax
je 0x407331
push dword [esi + 0x4c]
push edi
push 1
push eax
call fcn.00472cb1
add esp, 0x10
cmp edi, eax
jne 0x407348
cmp byte [esi + 0x3d], 0
pop edi
sete al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00466d07
mov esp, ebp
pop ebp
ret
pop edi
xor al, al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00466d07
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
mov al, 1
xor ecx, ebp
pop esi
call fcn.00466d07
mov esp, ebp
pop ebp
ret
Function at 0x4089e0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
mov eax, dword [0x4be130]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, ecx
cmp ebx, 0xffffffff
jne 0x408a10
pop esi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00466d07
mov esp, ebp
pop ebp
ret 4
mov eax, dword [esi + 0x20]
push edi
mov ecx, dword [eax]
test ecx, ecx
je 0x408a4c
mov edx, dword [esi + 0x30]
mov edi, dword [edx]
lea eax, [edi + ecx]
cmp ecx, eax
jae 0x408a4c
lea ecx, [edi - 1]
mov dword [edx], ecx
mov edx, dword [esi + 0x20]
mov esi, dword [edx]
lea ecx, [esi + 1]
mov dword [edx], ecx
mov byte [esi], bl
pop edi
pop esi
mov eax, ebx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00466d07
mov esp, ebp
pop ebp
ret 4
cmp dword [esi + 0x4c], 0
je 0x408b31
mov edi, dword [esi + 0xc]
lea eax, [esi + 0x3c]
cmp dword [edi], eax
jne 0x408a74
mov edx, dword [esi + 0x54]
mov ecx, dword [esi + 0x50]
sub edx, ecx
mov dword [edi], ecx
mov eax, dword [esi + 0x1c]
mov dword [eax], ecx
mov eax, dword [esi + 0x2c]
mov dword [eax], edx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x408aa7
push dword [esi + 0x4c]
movsx eax, bl
push eax
call fcn.0047233a
add esp, 8
or ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, ebx
pop edi
pop esi
mov eax, ecx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00466d07
mov esp, ebp
pop ebp
ret 4
lea eax, [ebp - 0x2c]
mov byte [ebp - 0x28], bl
mov edx, dword [ecx]
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 0x27]
push eax
lea eax, [ebp - 0x28]
push eax
lea eax, [esi + 0x40]
push eax
call dword [edx + 0x1c]
test eax, eax
js 0x408b31
cmp eax, 1
jle 0x408b04
cmp eax, 3
jne 0x408b31
push dword [esi + 0x4c]
push dword [ebp - 0x28]
call fcn.004059e0
add esp, 8
or ecx, 0xffffffff
test al, al
cmovne ecx, ebx
pop edi
pop esi
mov eax, ecx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00466d07
mov esp, ebp
pop ebp
ret 4
mov edi, dword [ebp - 0x2c]
lea eax, [ebp - 0x24]
sub edi, eax
je 0x408b21
push dword [esi + 0x4c]
push edi
push 1
push eax
call fcn.00472cb1
add esp, 0x10
cmp edi, eax
jne 0x408b31
lea eax, [ebp - 0x28]
mov byte [esi + 0x3d], 1
cmp dword [ebp - 0x30], eax
jne 0x408a37
mov ecx, dword [ebp - 4]
or eax, 0xffffffff
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00466d07
mov esp, ebp
pop ebp
ret 4
Function at 0x40a130
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x493530
mov eax, dword fs:[0]
push eax
sub esp, 0x64
push esi
mov eax, dword [0x4be130]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
mov eax, dword [ebp + 8]
mov dword [esi + 4], eax
push 0
lea ecx, [ebp - 0x70]
mov dword [ebp - 4], 0
mov dword [esi], vtable.std::codecvt_wchar_t__char__struct__Mbstatet_.0
call fcn.004504ff
mov dword [ebp - 0x6c], 0
mov byte [ebp - 0x68], 0
mov dword [ebp - 0x64], 0
mov byte [ebp - 0x60], 0
xor eax, eax
mov dword [ebp - 0x5c], 0
mov word [ebp - 0x58], ax
mov dword [ebp - 0x54], eax
mov word [ebp - 0x50], ax
mov dword [ebp - 0x4c], eax
mov byte [ebp - 0x48], al
mov dword [ebp - 0x44], eax
mov byte [ebp - 0x40], al
lea eax, [ebp - 0x70]
mov byte [ebp - 4], 7
push 0x49b1a0
push eax
call fcn.00450863
lea eax, [ebp - 0x3c]
push eax
call fcn.00450b2e
add esp, 0xc
lea ecx, [ebp - 0x70]
movups xmm0, xmmword [eax]
movups xmmword [esi + 8], xmm0
movups xmm0, xmmword [eax + 0x10]
movups xmmword [esi + 0x18], xmm0
movq xmm0, qword [eax + 0x20]
movq qword [esi + 0x28], xmm0
mov eax, dword [eax + 0x28]
mov dword [esi + 0x30], eax
call fcn.00406c40
mov dword [esi], vtable.std::codecvt_utf8_wchar_t__1114111__0_.0
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x40a280
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x49357f
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push ebx
push esi
push edi
mov eax, dword [0x4be130]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, ecx
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x14], 0
xor ecx, ecx
mov dword [eax + 0x10], 0
mov dword [eax + 0x14], 7
mov word [eax], cx
lea esi, [eax + 0x18]
mov dword [ebp - 4], ecx
mov dword [ebp - 0x18], esi
mov dword [esi], 0x49b270
mov dword [esi + 0x68], vtable.std::basic_ios_wchar_t__struct_std::char_traits_wchar_t__.0
push ecx
push ecx
lea edi, [esi + 4]
mov byte [ebp - 4], 1
push edi
mov ecx, esi
mov dword [ebp - 0x14], 1
mov dword [ebp - 0x10], edi
call fcn.00409f60
mov eax, dword [esi]
push 8
mov dword [ebp - 4], 2
mov dword [ebp - 0x20], edi
mov eax, dword [eax + 4]
mov dword [esi + eax], vtable.std::basic_ofstream_wchar_t__struct_std::char_traits_wchar_t__.0
mov eax, dword [esi]
mov ecx, dword [eax + 4]
lea eax, [ecx - 0x68]
mov dword [ecx + esi - 4], eax
mov dword [edi], vtable.std::basic_streambuf_wchar_t__struct_std::char_traits_wchar_t__.0
call fcn.00466cc9
mov ebx, eax
add esp, 4
test ebx, ebx
je 0x40a343
push 1
mov byte [ebp - 4], 3
call fcn.00450763
add esp, 4
mov dword [ebx + 4], eax
jmp 0x40a345
xor ebx, ebx
mov dword [edi + 0x34], ebx
lea edx, [edi + 8]
lea ebx, [edi + 4]
mov dword [ebp - 0x18], edx
mov edx, dword [ebp - 0x10]
lea eax, [esi + 4]
mov dword [ebp - 0x14], ebx
lea ecx, [eax + 0x18]
mov ebx, dword [ebp - 0x10]
lea esi, [eax + 0x24]
add edi, 0x14
add eax, 0x28
mov dword [ebx], vtable.std::basic_filebuf_wchar_t__struct_std::char_traits_wchar_t__.0
mov byte [ebx + 0x48], 0
mov byte [ebx + 0x3e], 0
mov ebx, dword [ebp - 0x14]
mov dword [edx + 0xc], ebx
mov ebx, dword [ebp - 0x10]
mov edx, dword [ebp - 0x18]
mov dword [ebx + 0x20], ecx
mov dword [ebx + 0x30], eax
mov dword [ebx + 0x10], edx
mov dword [ebx + 0x1c], edi
mov dword [ebx + 0x2c], esi
mov ebx, dword [ebp - 0x14]
mov dword [edx], 0
mov dword [ecx], 0
mov ecx, dword [ebp - 0x10]
mov dword [eax], 0
mov dword [ebx], 0
mov dword [edi], 0
mov dword [esi], 0
mov dword [ecx + 0x4c], 0
mov eax, dword [0x4c3a54]
mov dword [ecx + 0x40], eax
mov eax, dword [0x4c3a58]
mov dword [ecx + 0x44], eax
mov eax, dword [ebp - 0x1c]
mov dword [ecx + 0x38], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x40a9c0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x4be130]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, ecx
cmp dword [esi + 0x38], 0
je 0x40aa82
cmp byte [esi + 0x3e], 0
je 0x40aa82
mov eax, dword [esi]
push edi
push 0xffff
call dword [eax + 0xc]
mov ecx, 0xffff
cmp cx, ax
je 0x40aa70
mov ecx, dword [esi + 0x38]
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 4]
push eax
mov edx, dword [ecx]
lea eax, [ebp - 0x24]
push eax
lea eax, [esi + 0x40]
push eax
call dword [edx + 0x20]
sub eax, 0
je 0x40aa38
sub eax, 1
je 0x40aa3c
sub eax, 2
jne 0x40aa70
mov byte [esi + 0x3e], al
mov al, 1
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00466d07
mov esp, ebp
pop ebp
ret
mov byte [esi + 0x3e], 0
mov edi, dword [ebp - 0x28]
lea eax, [ebp - 0x24]
sub edi, eax
je 0x40aa59
push dword [esi + 0x4c]
push edi
push 1
push eax
call fcn.00472cb1
add esp, 0x10
cmp edi, eax
jne 0x40aa70
cmp byte [esi + 0x3e], 0
pop edi
sete al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00466d07
mov esp, ebp
pop ebp
ret
pop edi
xor al, al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00466d07
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
mov al, 1
xor ecx, ebp
pop esi
call fcn.00466d07
mov esp, ebp
pop ebp
ret
Function at 0x40b9b0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
mov eax, dword [0x4be130]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
mov edi, dword [ebp + 8]
mov eax, 0xffff
mov esi, ecx
cmp ax, di
jne 0x40b9e5
pop edi
xor eax, eax
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00466d07
mov esp, ebp
pop ebp
ret 4
mov eax, dword [esi + 0x20]
push ebx
mov ecx, dword [eax]
test ecx, ecx
je 0x40ba23
mov edx, dword [esi + 0x30]
mov ebx, dword [edx]
lea eax, [ecx + ebx*2]
cmp ecx, eax
jae 0x40ba23
lea ecx, [ebx - 1]
mov dword [edx], ecx
mov edx, dword [esi + 0x20]
mov esi, dword [edx]
lea ecx, [esi + 2]
mov dword [edx], ecx
mov word [esi], di
pop ebx
mov ax, di
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00466d07
mov esp, ebp
pop ebp
ret 4
cmp dword [esi + 0x4c], 0
je 0x40baff
mov ebx, dword [esi + 0xc]
lea eax, [esi + 0x3c]
cmp dword [ebx], eax
jne 0x40ba4d
mov edx, dword [esi + 0x54]
mov ecx, dword [esi + 0x50]
sub edx, ecx
mov dword [ebx], ecx
mov eax, dword [esi + 0x1c]
sar edx, 1
mov dword [eax], ecx
mov eax, dword [esi + 0x2c]
mov dword [eax], edx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x40ba86
push dword [esi + 0x4c]
push edi
call fcn.004733aa
mov ecx, 0xffff
add esp, 8
cmp ax, cx
movzx eax, di
jne 0x40bb04
pop ebx
pop edi
mov eax, ecx
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00466d07
mov esp, ebp
pop ebp
ret 4
movzx eax, di
mov dword [ebp - 0x28], eax
lea eax, [ebp - 0x2c]
mov edx, dword [ecx]
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 0x26]
push eax
lea eax, [ebp - 0x28]
push eax
lea eax, [esi + 0x40]
push eax
call dword [edx + 0x1c]
test eax, eax
js 0x40baff
cmp eax, 1
jle 0x40bad2
cmp eax, 3
jne 0x40baff
push dword [esi + 0x4c]
push dword [ebp - 0x28]
call fcn.00409b50
add esp, 8
test al, al
movzx eax, di
jne 0x40bb04
jmp 0x40baff
mov ebx, dword [ebp - 0x2c]
lea eax, [ebp - 0x24]
sub ebx, eax
je 0x40baef
push dword [esi + 0x4c]
push ebx
push 1
push eax
call fcn.00472cb1
add esp, 0x10
cmp ebx, eax
jne 0x40baff
lea eax, [ebp - 0x28]
mov byte [esi + 0x3e], 1
cmp dword [ebp - 0x30], eax
jne 0x40ba0d
mov eax, 0xffff
mov ecx, dword [ebp - 4]
pop ebx
pop edi
xor ecx, ebp
pop esi
call fcn.00466d07
mov esp, ebp
pop ebp
ret 4
Function at 0x410940
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x493b78
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push ebx
push esi
push edi
mov eax, dword [0x4be130]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov edx, dword [ebp + 0xc]
mov edi, edx
cmp dword [edx + 0x14], 8
mov eax, dword [edx + 0x10]
jb 0x41097a
mov edi, dword [edx]
xor ecx, ecx
mov esi, 0x811c9dc5
add eax, eax
je 0x41099b
mov edx, eax
movzx eax, byte [ecx + edi]
inc ecx
xor eax, esi
imul esi, eax, 0x1000193
cmp ecx, edx
jb 0x410987
mov edx, dword [ebp + 0xc]
push esi
push edx
lea eax, [ebp - 0x18]
mov ecx, ebx
push eax
call fcn.0040ffd0
mov ecx, dword [ebp - 0x14]
test ecx, ecx
je 0x4109cc
mov eax, dword [ebp + 8]
mov dword [eax], ecx
mov byte [eax + 4], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
cmp dword [ebx + 8], 0x4924924
je 0x410b36
lea eax, [ebx + 4]
mov dword [ebp - 0x20], eax
push 0x38
mov dword [ebp - 4], 0
mov dword [ebp - 0x1c], 0
call fcn.00466cc9
mov edi, eax
add esp, 4
mov dword [ebp - 0x1c], edi
push dword [ebp + 0xc]
lea eax, [edi + 8]
mov ecx, eax
mov dword [ebp - 0x10], eax
call fcn.004131d0
push dword [ebp + 0x10]
lea ecx, [edi + 0x20]
mov byte [ebp - 4], 1
call fcn.004131d0
mov eax, dword [ebx + 8]
inc eax
movss xmm3, dword [ebx]
mov dword [ebp - 4], 2
movd xmm0, eax
cvtdq2pd xmm0, xmm0
shr eax, 0x1f
addsd xmm0, qword [eax*8 + 0x49c280]
mov eax, dword [ebx + 0x1c]
cvtpd2ps xmm2, xmm0
movd xmm0, eax
cvtdq2pd xmm0, xmm0
shr eax, 0x1f
movaps xmm1, xmm2
addsd xmm0, qword [eax*8 + 0x49c280]
cvtpd2ps xmm0, xmm0
divss xmm1, xmm0
comiss xmm1, xmm3
jbe 0x410ad4
divss xmm2, xmm3
sub esp, 8
cvtps2pd xmm0, xmm2
movsd qword [ebp - 0x18], xmm0
fld qword [ebp - 0x18]
fstp qword [esp]
call fcn.00475730
fstp qword [ebp - 0x18]
movsd xmm0, qword [ebp - 0x18]
add esp, 8
cvtpd2ps xmm0, xmm0
call fcn.004671b0
mov ecx, 8
cmp eax, ecx
cmova ecx, eax
mov eax, dword [ebx + 0x1c]
cmp eax, ecx
jae 0x410ab8
cmp eax, 0x200
jae 0x410ab6
shl eax, 3
cmp eax, ecx
jae 0x410ab8
mov eax, ecx
push eax
mov ecx, ebx
call fcn.00416020
push esi
lea eax, [edi + 8]
mov ecx, ebx
push eax
lea eax, [ebp - 0x20]
push eax
call fcn.0040ffd0
mov edx, dword [eax]
jmp 0x410ad7
mov edx, dword [ebp - 0x18]
mov eax, dword [ebx + 8]
mov ecx, dword [edx + 4]
inc eax
mov dword [ebx + 8], eax
mov dword [edi], edx
mov dword [edi + 4], ecx
mov dword [ecx], edi
mov dword [edx + 4], edi
mov eax, dword [ebx + 0x18]
mov dword [ebp + 0xc], ecx
and eax, esi
mov ecx, dword [ebx + 0xc]
mov esi, dword [ecx + eax*8]
cmp esi, dword [ebx + 4]
jne 0x410b03
mov dword [ecx + eax*8], edi
jmp 0x410b15
cmp esi, edx
jne 0x410b0c
mov dword [ecx + eax*8], edi
jmp 0x410b19
mov edx, dword [ebp + 0xc]
cmp dword [ecx + eax*8 + 4], edx
jne 0x410b19
mov dword [ecx + eax*8 + 4], edi
mov eax, dword [ebp + 8]
mov dword [eax], edi
mov byte [eax + 4], 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
push str.unordered_map_set_too_long
call fcn.00450472
int3