joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4dfbe0
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x9d000]
push edi
jmp 0x4dfbfa
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x4dfc01
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4dfbf0
mov eax, 1
add ebx, ebx
jne 0x4dfc13
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x4dfc24
jne 0x4dfc43
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4dfc43
dec eax
add ebx, ebx
jne 0x4dfc30
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x4dfc08
add ebx, ebx
jne 0x4dfc3f
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x4dfc95
xor ecx, ecx
sub eax, 3
jb 0x4dfc5b
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x4dfcca
sar eax, 1
mov ebp, eax
jmp 0x4dfc66
add ebx, ebx
jne 0x4dfc66
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4dfc34
inc ecx
add ebx, ebx
jne 0x4dfc74
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4dfc34
add ebx, ebx
jne 0x4dfc81
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x4dfc76
jne 0x4dfc92
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x4dfc76
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x4dfcb4
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x4dfca6
jmp 0x4dfbf6
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x4dfcb4
add edi, ecx
jmp 0x4dfbf6
pop esi
mov edi, esi
mov ecx, 0x377e
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x4dfcd2
cmp byte [edi], 0x11
jne 0x4dfcd2
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x4dfcd7
lea edi, [esi + 0xdb000]
mov eax, dword [edi]
or eax, eax
je 0x4dfd4f
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x10ce98]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x10cfec]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x4dfd04
mov ecx, edi
jns 0x4dfd33
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x10cff0]
or eax, eax
je 0x4dfd49
mov dword [ebx], eax
add ebx, 4
jmp 0x4dfd21
call dword [esi + 0x10d000]
mov ebp, dword [esi + 0x10cff4]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x22f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x4dfd83
sub esp, 0xffffff80
jmp 0x416310
Function at 0x407010
Capabilities:
Enumerate pe sections

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
xor edx, edx
push ebx
push esi
push edi
mov ecx, dword [eax + 0x3c]
add ecx, eax
movzx eax, word [ecx + 0x14]
movzx ebx, word [ecx + 6]
add eax, 0x18
add eax, ecx
test ebx, ebx
je 0x40704e
mov edi, dword [ebp + 0xc]
mov esi, dword [eax + 0xc]
cmp edi, esi
jb 0x407046
mov ecx, dword [eax + 8]
add ecx, esi
cmp edi, ecx
jb 0x407050
inc edx
add eax, 0x28
cmp edx, ebx
jb 0x407036
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x407120
Capabilities:
Parse pe header

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov ecx, dword [ebp + 8]
mov eax, 0x5a4d
cmp word [ecx], ax
jne 0x407151
mov eax, dword [ecx + 0x3c]
add eax, ecx
cmp dword [eax], 0x4550
jne 0x407151
mov ecx, 0x10b
cmp word [eax + 0x18], cx
jne 0x407151
mov eax, 1
pop ebp
ret
xor eax, eax
pop ebp
ret

Function at 0x40123a
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4e8
push edi
and dword [ebp - 0xc], 0
mov byte [ebp - 0x110], 0
mov dword [ebp - 4], 1
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x390]
push eax
call sub.iphlpapi.DLL_GetAdaptersInfo
mov dword [ebp - 8], eax
push 0
call sub.KERNEL32.dll_DeleteFileA
cmp dword [ebp - 4], 0
jne 0x4013f1
call eax
pop edi
pop esi
mov eax, ebx
pop ebx
pop ebp
ret 8
mov eax, dword [ebp - 8]
Function at 0x40344c
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
pushal
call 0x40345b
pop dword [ebp - 4]
mov eax, 0x378d8a5d
add eax, 0xc8b2a9fe
sub dword [ebp - 4], eax
mov dword [ebp - 0x14], 0xc25f1890
sub dword [ebp - 0x14], 0x740cd345
mov dword [ebp - 0x10], 0xc488fe58
sub dword [ebp - 0x10], 0x9255b213
mov dword [ebp - 0xc], 0xf940c7a4
add dword [ebp - 0xc], 0x530b7c8a
mov dword [ebp - 8], 0x60a396c5
sub dword [ebp - 8], 0x60a396c5
lea eax, [ebp - 0x14]
push eax
mov eax, sym.imp.kernel32.dll_GetModuleHandleA
add eax, dword [ebp - 4]
call dword [eax]
mov dword [ebp - 0x14], 0x67c72f9e
sub dword [ebp - 0x14], 0xf354c648
mov dword [ebp - 0x10], 0xf3c05ecb
add dword [ebp - 0x10], 0x4dac02aa
mov dword [ebp - 0xc], 0xabe1e307
add dword [ebp - 0xc], 0xb78d8965
mov dword [ebp - 8], 0x801bf492
add dword [ebp - 8], 0x7fe40b6e
lea ebx, [ebp - 0x14]
push ebx
push eax
mov eax, 0xa22fe395
add eax, 0x5e105cbb
add eax, dword [ebp - 4]
call dword [eax]
push 0x40
push 0x1000
push 0x373c7
push 0
call eax
mov ecx, 0x952c913e
sub ecx, 0x952c47c2
xor ebx, ebx
add ebx, eax
mov esi, 0x5bea3650
add esi, 0xa4564db0
add esi, dword [ebp - 4]
mov edi, 0xba84d62a
sub edi, 0x1f816fd8
mov edx, dword [esi]
xor edx, edi
mov dword [ebx], edx
add ebx, 0x563c6187
sub ebx, 0x563c6183
add esi, 4
loop 0x40357a
add eax, 0xe631613a
add eax, 0x19cfb789
mov ebx, eax
add eax, 5
mov ecx, 0x2651be3a
add ecx, 0xd9ee41c6
add ecx, dword [ebp - 4]
call ebx
leave
ret
Function at 0x405640
Capabilities:
Resolve function by parsing pe exports

Disassembly:
nop
jmp 0x40564c
mov ebp, esp
jmp 0x40565b
mov edx, dword fs:[edx + 0x30]
nop
jmp 0x40566c
mov edx, dword [edx + 0xc]
nop
mov edx, dword [edx + 0x14]
nop
nop
movzx ecx, word [edx + 0x26]
jmp 0x405684
xor edi, edi
nop
jmp 0x405693
mov esi, dword [edx + 0x28]
jmp 0x4056a3
jmp 0x4056b4
xor eax, eax
nop
jmp 0x4056c3
lodsb al, byte [esi]
nop
cmp al, 0x61
nop
jmp 0x4056d2
jl 0x4056e6
nop
nop
sub al, 0x20
nop
jmp 0x4056e6
jmp 0x4056f5
ror edi, 0xd
jmp 0x405709
add edi, eax
nop
jmp 0x405718
dec ecx
jne 0x4056a3
nop
jmp 0x40572c
push edx
nop
jmp 0x405738
mov edx, dword [edx + 0x10]
push edi
mov eax, dword [edx + 0x3c]
nop
jmp 0x40574e
add eax, edx
jmp 0x40575a
mov eax, dword [eax + 0x78]
nop
jmp 0x40576b
test eax, eax
jmp 0x405779
je 0x405957
nop
jmp 0x40578b
add eax, edx
push eax
jmp 0x40579d
mov ebx, dword [eax + 0x20]
nop
mov ecx, dword [eax + 0x18]
nop
jmp 0x4057b0
add ebx, edx
nop
jmp 0x4057bd
jmp 0x4057ce
test ecx, ecx
nop
je 0x405946
nop
xor edi, edi
jmp 0x4057eb
dec ecx
mov esi, dword [ebx + ecx*4]
nop
add esi, edx
jmp 0x4057fc
nop
jmp 0x40580f
xor eax, eax
nop
jmp 0x405826
ror edi, 0xd
lodsb al, byte [esi]
nop
jmp 0x405839
add edi, eax
cmp al, ah
jne 0x4057fc
jmp fcn.00405850
nop
pop eax
jmp 0x405957
pop edi
pop edx
mov edx, dword [edx]
jmp 0x405674

Function at 0x405850
Capabilities:
Resolve function by parsing pe exports

Disassembly:
add edi, dword [ebp - 8]
jmp 0x405860
cmp edi, dword [ebp + 0x24]
jmp 0x405871
jne 0x4057bd
pop eax
nop
jmp 0x40588b
mov ebx, dword [eax + 0x24]
nop
jmp 0x40589e
or al, byte [eax]
add byte [eax], al
add ebx, edx
nop
mov cx, word [ebx + ecx*2]
nop
mov ebx, dword [eax + 0x1c]
add ebx, edx
nop
jmp 0x4058ba
mov eax, dword [ebx + ecx*4]
add eax, edx
mov dword [esp + 0x24], eax
nop
jmp 0x4058d8
pop ebx
nop
jmp 0x4058e7
pop ebx
jmp 0x4058fa
popal
nop
jmp 0x405909
pop ecx
nop
jmp 0x40591e
pop edx
jmp 0x405932
push ecx
nop
jmp 0x405943
jmp eax

Function at 0x40b457
Capabilities:
Encode data using base64

Disassembly:
leave
cld
imul esi, dword [ebx], 0xffffffd2
xor ebp, dword [edx + ecx*4]
pop ebp
aaa
pop ds
mov byte [ebx], 0x3a
ljmp 0xc718
loop 0x40b468
shl edx, 2
shr ebx, 6
or eax, dword [ebx + edx*2]
mov bh, byte [edx]
sbb bh, al
pop esi
push cs
mov byte [eax - 1], dl
cmp dl, byte [esi - 1]
and edx, 0x3f
inc eax
cmp esi, ecx
dec eax
jae 0x40b415
mov dword [eax], 0x6cfe3c88
cwde
call 0xf253c4da
jge 0x40b4e6
xor ecx, ecx
and al, 0xc
shr ecx, 2
adc byte [edx - 0x30], cl
mov eax, eax
invalid
mov edx, dword [ebp + 0x6d]
mov eax, 0xc22b0000
pop edi
pop esi
inc eax
dec esp
pop ebp
ret 0xc
Function at 0x42e000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x42e00c
pop eax
nop
nop
nop
nop
nop
nop
add eax, 0x403ac5
nop
sub eax, 0x403a6b
nop
nop
mov ebx, dword [eax]
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
mov edx, dword [eax + 8]
nop
nop
xor dword [ebx], edx
nop
nop
nop
nop
nop
nop
nop
add ebx, 4
nop
nop
nop
nop
cmp ebx, ecx
nop
jl 0x42e030
nop
nop
nop
add eax, 0xc
nop
nop
nop
cmp dword [eax], 0
nop
nop
nop
nop
nop
nop
nop
jne 0x42e01e
nop
nop
popal
nop
nop
nop
jmp loc.00401219
Function at 0x402770
Capabilities:
Contain obfuscated stackstrings

Disassembly:
and byte [ebp - 0x3c4], 0
and byte [ebp - 0x3c3], 0
mov byte [ebp - 0x3c2], 0x99
and byte [ebp - 0x3c1], 0
mov byte [ebp - 0x3c0], 0x21
mov byte [ebp - 0x3bf], 3
mov byte [ebp - 0x3be], 0x12
adc al, dh
test dword [ebx - 4], eax
invalid
jmp [ebx]
mov byte [ebp - 0x3bc], 9
mov byte [ebp - 0x3bb], 2
mov byte [ebp - 0x3ba], 0x13
mov byte [ebp - 0x3b9], 0xa
mov byte [ebp - 0x3b8], 3
mov byte [ebp - 0x3b7], 0x20
mov byte [ebp - 0x3b6], 0xf
mov byte [ebp - 0x3b5], 0xa
mov byte [ebp - 0x3b4], 3
mov byte [ebp - 0x3b3], 0x28
mov byte [ebp - 0x3b2], 7
mov byte [ebp - 0x3b1], 0xb
mov byte [ebp - 0x3b0], 3
mov byte [ebp - 0x3af], 0x27
mov byte [ebp - 0x3ae], 0x66
lea eax, [ebp - 0x3c4]
push eax
call fcn.00401e8f
pop ecx
push eax
push dword [ebp + 0x18]
push dword [ebp + 0x14]
call fcn.00401e44
add esp, 0xc
mov dword [ebp - 0x538], eax
and byte [ebp - 0x3ec], 0
and byte [ebp - 0x3eb], 0
mov byte [ebp - 0x3ea], 0x11
and byte [ebp - 0x3e9], 0
mov byte [ebp - 0x3e8], 0xa9
mov byte [ebp - 0x3e7], 0x8b
mov byte [ebp - 0x3e6], 0x9a
mov byte [ebp - 0x3e5], 0xa3
mov byte [ebp - 0x3e4], 0x81
mov byte [ebp - 0x3e3], 0x8a
mov byte [ebp - 0x3e2], 0x9b
mov byte [ebp - 0x3e1], 0x82
mov byte [ebp - 0x3e0], 0x8b
mov byte [ebp - 0x3df], 0xa6
mov byte [ebp - 0x3de], 0x8f
mov byte [ebp - 0x3dd], 0x80
mov byte [ebp - 0x3dc], 0x8a
mov byte [ebp - 0x3db], 0x82
mov byte [ebp - 0x3da], 0x8b
mov byte [ebp - 0x3d9], 0xaf
mov byte [ebp - 0x3d8], 0xee
lea eax, [ebp - 0x3ec]
push eax
call fcn.00401e8f
pop ecx
push eax
push dword [ebp + 0x18]
push dword [ebp + 0x14]
call fcn.00401e44
add esp, 0xc
mov dword [ebp - 0x340], eax
call fcn.00401e7f
dec esi
or eax, 0xcca58046
cli
invalid

Function at 0x407080
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
mov esi, eax
mov eax, dword [0x409214]
mov dword [eax], ecx
mov ebx, edx
test ebx, ebx
jle 0x4070a1
mov eax, 0xff
call fcn.00402680
xor byte [esi], al
inc esi
dec ebx
jne 0x407091
pop esi
pop ebx
ret
Function at 0x4057ac
Capabilities:
Contain obfuscated stackstrings

Disassembly:
and byte [ebp - 0x36b], 0
mov byte [ebp - 0x36a], 0xaa
and byte [ebp - 0x369], 0
mov byte [ebp - 0x368], 0x12
mov byte [ebp - 0x367], 0x30
mov byte [ebp - 0x366], 0x21
mov byte [ebp - 0x365], 6
mov byte [ebp - 0x364], 0x2c
mov byte [ebp - 0x363], 0x26
mov byte [ebp - 0x362], 0x21
mov byte [ebp - 0x361], 0x30
mov byte [ebp - 0x360], 0x38
mov byte [ebp - 0x35f], 0x11
mov byte [ebp - 0x35e], 0x3c
mov byte [ebp - 0x35d], 0x27
mov byte [ebp - 0x35c], 0x30
mov byte [ebp - 0x35b], 0x36
invalid
invalid
cmpsb byte [esi], byte es:[edi]
cld
invalid
invalid
Function at 0x433003
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
mov eax, section..text
nop
nop
mov ebx, 0x40de38
nop
mov ecx, 0x6011906
test eax, eax
nop
nop
nop
nop
je 0x43304e
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
jne 0x433024
nop
mov eax, section..data
mov ebx, 0x4304d8
nop
nop
mov ecx, 0x63d20ddc
nop
nop
test eax, eax
nop
nop
je 0x433084
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
add eax, 4
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
nop
jne 0x43306c
nop
nop
popal
nop
nop
nop
jmp 0x431219
Function at 0x4104dc
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
pushal
call 0x4104eb
pop dword [ebp - 0x20]
mov eax, 0x4104eb
sub dword [ebp - 0x20], eax
push 0x40
push 0x1000
push 0x408e2
push 0
mov eax, sym.imp.kernel32.dll_VirtualAlloc
add eax, dword [ebp - 0x20]
call dword [eax]
mov ecx, 0xc37aadab
sub ecx, 0xc37a5a7f
xor ebx, ebx
add ebx, eax
mov esi, 0xe7ff1d1a
sub esi, 0xe7bbc91a
add esi, dword [ebp - 0x20]
mov edi, 0xb3ff2e79
add edi, 0x83b8ee3d
xor dword [ebp - 0x1c], 0x3eb1b22
mov edx, dword [esi]
sub dword [ebp - 8], eax
sub edx, edi
add dword [ebp - 8], ebx
mov dword [ebx], edx
add ebx, 0xee69aaa
add ebx, 0xf119655a
add esi, 0x4fee9df6
sub esi, 0x4fee9df2
loop 0x410542
add eax, 0xcc8fdbc
add eax, 0xf33841c7
xor ebx, ebx
add ebx, eax
add eax, 0xc19011c9
sub eax, 0xc19011c4
mov ecx, 0xa258ee4e
sub ecx, 0xa218ee4e
add ecx, dword [ebp - 0x20]
call ebx
leave
ret

Function at 0x41d2d5
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.0040e95e
and dword [ebp - 4], 0
cmp dword [0x4310f8], 0
mov ebx, eax
jne 0x41d386
push str.USER32.DLL
call dword [sym.imp.kernel32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x41d437
mov esi, dword [sym.imp.kernel32.dll_GetProcAddress]
push 0x42d324
push edi
call esi
test eax, eax
je 0x41d437
push eax
call fcn.004104dc
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x4310f8], eax
call esi
push eax
call fcn.004104dc
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x4310fc], eax
call esi
push eax
call fcn.004104dc
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x431100], eax
call esi
push eax
call fcn.004104dc
pop ecx
mov dword [0x431108], eax
test eax, eax
je 0x41d386
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.004104dc
pop ecx
mov dword [0x431104], eax
mov eax, dword [0x431104]
cmp eax, ebx
je 0x41d3de
cmp dword [0x431108], ebx
je 0x41d3de
push eax
call fcn.004104dc
push dword [0x431108]
mov esi, eax
call fcn.004104dc
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x41d3de
test edi, edi
je 0x41d3de
call esi
test eax, eax
je 0x41d3d5
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x41d3d5
test byte [ebp - 0xc], 1
jne 0x41d3de
or dword [ebp + 0x10], 0x200000
jmp 0x41d417
mov eax, dword [0x4310fc]
cmp eax, ebx
je 0x41d417
push eax
call fcn.004104dc
pop ecx
test eax, eax
je 0x41d417
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x41d417
mov eax, dword [0x431100]
cmp eax, ebx
je 0x41d417
push eax
call fcn.004104dc
pop ecx
test eax, eax
je 0x41d417
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x4310f8]
call fcn.004104dc
pop ecx
test eax, eax
je 0x41d437
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x41d439
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x405e20
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x48bcc8
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x4b4050]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov dword [ebp - 0x10], ebx
mov edi, dword [ebp + 8]
lea eax, [ebx + 4]
xorps xmm0, xmm0
mov dword [ebx], vtable.std::exception.0
push eax
movq qword [eax], xmm0
lea eax, [edi + 4]
push eax
call fcn.00467f05
add esp, 8
mov dword [ebp - 4], 0
lea esi, [ebx + 0xc]
mov dword [ebx], vtable.toml::exception.0
lea ecx, [esi + 0xc]
mov eax, dword [edi + 0xc]
mov dword [esi], eax
mov eax, dword [edi + 0x10]
mov dword [esi + 4], eax
mov eax, dword [edi + 0x14]
mov dword [esi + 8], eax
lea eax, [edi + 0x18]
push eax
mov dword [ebp + 8], esi
call fcn.0041f220
lea eax, [edi + 0x30]
mov byte [ebp - 4], 1
push eax
lea ecx, [esi + 0x24]
call fcn.0041f220
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x417780
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x48ea50
mov eax, dword fs:[0]
push eax

Function at 0x418240
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov edx, dword [ebp + 8]
mov eax, ecx
push ebx
push esi
push edi
cmp dword [edx + 0x14], 0x10
mov edi, edx
mov ebx, dword [edx + 0x10]
mov dword [ebp - 8], eax
jb 0x41825e
mov edi, dword [edx]
xor ecx, ecx
mov esi, 0x811c9dc5
test ebx, ebx
je 0x418284
nop dword [eax]
movzx eax, byte [ecx + edi]
inc ecx
xor eax, esi
imul esi, eax, 0x1000193
cmp ecx, ebx
jb 0x418270
mov eax, dword [ebp - 8]
push esi
push edx
lea ecx, [ebp - 0xc]
push ecx
mov ecx, eax
call fcn.004291d0
mov eax, dword [ebp - 8]
test eax, eax
je 0x4182a4
pop edi
pop esi
add eax, 0x20
pop ebx
mov esp, ebp
pop ebp
ret 4
push str.invalid_unordered_map_K__T__key
call fcn.004537dc
int3
Function at 0x418890
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0xc
mov eax, dword [ebp + 0x10]
push ebx
mov ebx, ecx
mov ecx, dword [ebp + 0xc]
push esi
push edi
mov edi, dword [ebp + 8]
mov dword [esp + 0xc], edi
test eax, eax
jg 0x4188c2
jl 0x4188b5
test ecx, ecx
jne 0x4188c2
xor eax, eax
xor edx, edx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
cmp dword [ebx + 0x38], 0
je 0x418982
mov dword [esp + 0x10], ecx
mov dword [esp + 0xc], eax
mov ecx, ebx
call fcn.00421ba0
mov esi, eax
mov eax, edx
mov dword [esp + 0x14], eax
test eax, eax
jl 0x41892e
jg 0x4188ed
test esi, esi
je 0x41892e
mov ecx, dword [esp + 0xc]
cmp ecx, eax
jg 0x418905
mov eax, dword [esp + 0x10]
jl 0x4188ff
cmp eax, esi
jae 0x418905
mov esi, eax
mov dword [esp + 0x14], ecx
mov eax, dword [ebx + 0x1c]
push esi
push dword [eax]
push edi
call fcn.004682e0
mov eax, dword [ebx + 0x2c]
add esp, 0xc
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 0xc]
sub ecx, esi
sbb edx, dword [esp + 0x14]
sub dword [eax], esi
mov eax, dword [ebx + 0x1c]
add dword [eax], esi
jmp 0x41894f
mov eax, dword [ebx]
mov ecx, ebx
call dword [eax + 0x1c]
mov edx, dword [esp + 0xc]
cmp eax, 0xffffffff
je 0x41896b
mov ecx, dword [esp + 0x10]
mov esi, 1
add ecx, 0xffffffff
mov byte [edi], al
adc edx, 0xffffffff
add edi, esi
mov dword [esp + 0xc], edx
mov dword [esp + 0x10], ecx
test edx, edx
jg 0x4188d4
jl 0x41896b
test ecx, ecx
jne 0x4188d4
mov eax, dword [ebp + 0xc]
sub eax, dword [esp + 0x10]
mov esi, dword [ebp + 0x10]
sbb esi, edx
mov edx, esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov eax, dword [ebx + 0x1c]
lea esi, [ebx + 0x2c]
mov edi, ecx
mov edx, dword [eax]
test edx, edx
je 0x4189c0
mov eax, dword [esi]
mov eax, dword [eax]
test eax, eax
je 0x4189c0
cmp eax, ecx
mov esi, ecx
cmovb esi, eax
push esi
push edx
push dword [esp + 0x14]
call fcn.004682e0
mov eax, dword [ebx + 0x2c]
sub edi, esi
add dword [esp + 0x18], esi
add esp, 0xc
sub dword [eax], esi
mov eax, dword [ebx + 0x1c]
add dword [eax], esi
lea esi, [ebx + 0x2c]
cmp dword [ebx + 0x4c], 0
je 0x418a29
mov ecx, dword [ebx + 0xc]
lea eax, [ebx + 0x3c]
cmp dword [ecx], eax
jne 0x4189e6
mov eax, dword [ebx + 0xc]
mov edx, dword [ebx + 0x54]
mov ecx, dword [ebx + 0x50]
sub edx, ecx
mov dword [eax], ecx
mov eax, dword [ebx + 0x1c]
mov dword [eax], ecx
mov eax, dword [esi]
mov dword [eax], edx
mov esi, dword [esp + 0xc]
cmp edi, 0xfff
jbe 0x418a14
push dword [ebx + 0x4c]
push 0xfff
push 1
push esi
call fcn.00472fde
add esp, 0x10
add esi, eax
sub edi, eax
cmp eax, 0xfff
jne 0x418a29
cmp edi, eax
ja 0x4189f2
test edi, edi
je 0x418a29
push dword [ebx + 0x4c]
push edi
push 1
push esi
call fcn.00472fde
add esp, 0x10
sub edi, eax
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 0x10]
sub eax, edi
pop edi
pop esi
sbb edx, 0
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x423df0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x48f760
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x4b4050]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, ecx
mov dword [ebp - 0x10], eax
push 8
mov dword [eax], vtable.std::basic_streambuf_char__struct_std::char_traits_char__.0
call fcn.00456359
mov esi, eax
xorps xmm0, xmm0
movq qword [esi], xmm0
push 1
mov dword [ebp - 4], 0
call fcn.0045398d
mov dword [esi + 4], eax
add esp, 8
mov eax, dword [ebp - 0x10]
lea edi, [eax + 0x14]
lea ecx, [eax + 0x18]
lea edx, [eax + 0x24]
mov dword [eax + 0x34], esi
lea ebx, [eax + 4]
mov dword [eax + 0xc], ebx
lea esi, [eax + 8]
mov dword [eax + 0x10], esi
mov dword [eax + 0x1c], edi
mov dword [eax + 0x20], ecx
mov dword [eax + 0x2c], edx
add eax, 0x28
mov dword [ebp - 0x14], ebx
mov ebx, dword [ebp - 0x10]
mov dword [ebx + 0x30], eax
mov ebx, dword [ebp - 0x14]
mov dword [esi], 0
mov dword [ecx], 0
mov dword [eax], 0
mov eax, dword [ebp - 0x10]
mov dword [ebx], 0
mov dword [edi], 0
mov dword [edx], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret