joyce8/EMBER2024-capa huggingface dataset:
Function at 0x404dd0
Capabilities:
Create shortcut via ishelllink

Disassembly:
sub esp, 0x314
lea eax, [esp]
push eax
push 0x415380
push 1
push 0
push 0x415370
call dword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
jl 0x404eb6
mov eax, dword [esp]
push esi
mov esi, dword [esp + 0x31c]
mov ecx, dword [eax]
push esi
push eax
call dword [ecx + 0x50]
mov eax, dword [esp + 4]
mov ecx, dword [esp + 0x324]
push ecx
push eax
mov edx, dword [eax]
call dword [edx + 0x1c]
mov eax, dword [esp + 4]
mov ecx, dword [esp + 0x328]
push ecx
push eax
mov edx, dword [eax]
call dword [edx + 0x2c]
lea edx, [esp + 0xc]
push esi
push edx
call fcn.00404ec0
add esp, 8
test eax, eax
je 0x404e4f
mov eax, dword [esp + 4]
lea edx, [esp + 0xc]
push edx
push eax
mov ecx, dword [eax]
call dword [ecx + 0x24]
mov eax, dword [esp + 4]
lea edx, [esp + 8]
push edx
push 0x415390
mov ecx, dword [eax]
push eax
call dword [ecx]
mov esi, eax
test esi, esi
jl 0x404ea9
mov ecx, dword [esp + 0x320]
lea eax, [esp + 0x110]
push 0x104
push eax
push 0xffffffffffffffff
push ecx
push 0
push 0
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov eax, dword [esp + 8]
lea ecx, [esp + 0x110]
push 1
push ecx
mov edx, dword [eax]
push eax
call dword [edx + 0x18]
mov esi, eax
mov eax, dword [esp + 8]
push eax
mov edx, dword [eax]
call dword [edx + 8]
mov eax, dword [esp + 4]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
mov eax, esi
pop esi
add esp, 0x314
ret

Function at 0x404f40
Capabilities:
Create shortcut via ishelllink

Disassembly:
sub esp, 0x314
lea eax, [esp]
push eax
push 0x415380
push 1
push 0
push 0x415370
call dword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
jl 0x40503a
mov eax, dword [esp]
push esi
mov esi, dword [esp + 0x31c]
mov ecx, dword [eax]
push esi
push eax
call dword [ecx + 0x50]
mov eax, dword [esp + 4]
mov ecx, dword [esp + 0x324]
push ecx
push eax
mov edx, dword [eax]
call dword [edx + 0x1c]
mov eax, dword [esp + 4]
mov ecx, dword [esp + 0x328]
push ecx
push eax
mov edx, dword [eax]
call dword [edx + 0x2c]
lea edx, [esp + 0xc]
push esi
push edx
call fcn.00404ec0
add esp, 8
test eax, eax
je 0x404fbf
mov eax, dword [esp + 4]
lea edx, [esp + 0xc]
push edx
push eax
mov ecx, dword [eax]
call dword [ecx + 0x24]
mov eax, dword [esp + 4]
mov edx, dword [esp + 0x32c]
push 0
push edx
mov ecx, dword [eax]
push eax
call dword [ecx + 0x44]
mov eax, dword [esp + 4]
lea edx, [esp + 8]
push edx
push 0x415390
mov ecx, dword [eax]
push eax
call dword [ecx]
mov esi, eax
test esi, esi
jl 0x40502d
mov ecx, dword [esp + 0x320]
lea eax, [esp + 0x110]
push 0x104
push eax
push 0xffffffffffffffff
push ecx
push 0
push 0
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov eax, dword [esp + 8]
lea ecx, [esp + 0x110]
push 1
push ecx
mov edx, dword [eax]
push eax
call dword [edx + 0x18]
mov esi, eax
mov eax, dword [esp + 8]
push eax
mov edx, dword [eax]
call dword [edx + 8]
mov eax, dword [esp + 4]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
mov eax, esi
pop esi
add esp, 0x314
ret
Function at 0x405fb0
Capabilities:
Delete file

Disassembly:
sub esp, 0x104
lea eax, [esp]
push esi
push eax
or esi, 0xffffffff
call fcn.004091e0
neg eax
sbb eax, eax
and eax, 9
add eax, 0x10
push eax
call fcn.004068e0
push eax
call fcn.00403b30
add esp, 0xc
test eax, eax
je 0x40606c
push ebx
lea ecx, [esp + 8]
push edi
push ecx
call fcn.00403ac0
add esp, 4
call fcn.00401800
mov edi, eax
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0xc]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov ebx, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
lea edx, [esp + 0xc]
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, str..LNK
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov ebx, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
lea eax, [esp + 0xc]
and ecx, 3
push eax
rep movsb byte es:[edi], byte [esi]
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
neg eax
sbb eax, eax
pop edi
neg eax
pop ebx
dec eax
pop esi
add esp, 0x104
ret
mov eax, esi
pop esi
add esp, 0x104
ret

Function at 0x4063a0
Capabilities:
Get common file path
Set current directory

Disassembly:
sub esp, 0x208
lea eax, [esp + 0x104]
push ebx
push esi
push edi
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
lea ecx, [esp + 0xc]
push 0x104
push ecx
push 0x41d1d4
push str.InstTo
call fcn.00401740
push eax
call fcn.00401710
push eax
call fcn.00406980
mov edi, str.SdActi
or ecx, 0xffffffff
xor eax, eax
add esp, 0x18
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
lea edx, [esp + 0xc]
mov esi, edi
mov ebx, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov al, byte [esp + 0xc]
mov esi, dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
test al, al
je 0x406448
lea eax, [esp + 0xc]
push eax
call esi
push 0
call fcn.00401b40
push eax
call fcn.00401d10
add esp, 8
test eax, eax
jne 0x406448
push 0x41951c
call fcn.00406700
add esp, 4
lea ecx, [esp + 0x110]
push ecx
call esi
pop edi
pop esi
pop ebx
add esp, 0x208
ret

Function at 0x4065e0
Capabilities:
Delete file
Get common file path
Set current directory

Disassembly:
sub esp, 0x104
lea eax, [esp]
push edi
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
mov ecx, dword [esp + 0x10c]
mov edi, dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
push ecx
call edi
mov edx, dword [esp + 0x110]
push edx
call fcn.004038e0
add esp, 4
test eax, eax
jne 0x406638
call fcn.00403950
test eax, eax
je 0x406638
push esi
mov esi, dword [sym.imp.KERNEL32.dll_DeleteFileA]
push eax
call esi
call fcn.00403950
test eax, eax
jne 0x40662b
pop esi
lea eax, [esp + 4]
push eax
call edi
pop edi
add esp, 0x104
ret
Function at 0x406650
Capabilities:
Terminate process

Disassembly:
sub esp, 0x410
push esi
lea eax, [esp + 0x418]
lea ecx, [esp + 4]
mov edx, 4
mov esi, dword [eax + 4]
add eax, 4
mov dword [ecx], esi
add ecx, 4
dec edx
jne 0x406667
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0xc]
mov edx, dword [esp + 8]
push eax
mov eax, dword [esp + 8]
push ecx
mov ecx, dword [esp + 0x420]
push edx
push eax
push ecx
lea edx, [esp + 0x28]
push edx
call fcn.00409f3d
mov eax, dword [0x46e878]
add esp, 0x18
test eax, eax
pop esi
je 0x4066aa
call eax
call fcn.004068e0
push eax
call dword [sym.imp.USER32.dll_SetForegroundWindow]
lea eax, [esp + 0x10]
push eax
call fcn.004099d0
add esp, 4
push 0x40015
call fcn.004068f0
push eax
lea ecx, [esp + 0x18]
push ecx
call fcn.004068e0
push eax
call dword [sym.imp.USER32.dll_MessageBoxA]
cmp eax, 2
jne 0x4066f6
mov eax, dword [0x46e87c]
test eax, eax
je 0x4066ef
call eax
push 0xffffffffffffffff
call fcn.00409fbc
add esp, 0x410
ret

Function at 0x406700
Capabilities:
Terminate process

Disassembly:
sub esp, 0x410
push esi
lea eax, [esp + 0x418]
lea ecx, [esp + 4]
mov edx, 4
mov esi, dword [eax + 4]
add eax, 4
mov dword [ecx], esi
add ecx, 4
dec edx
jne 0x406717
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0xc]
mov edx, dword [esp + 8]
push eax
mov eax, dword [esp + 8]
push ecx
mov ecx, dword [esp + 0x420]
push edx
push eax
push ecx
lea edx, [esp + 0x28]
push edx
call fcn.00409f3d
mov eax, dword [0x46e878]
add esp, 0x18
test eax, eax
pop esi
je 0x40675a
call eax
call fcn.004068e0
push eax
call dword [sym.imp.USER32.dll_SetForegroundWindow]
lea eax, [esp + 0x10]
push eax
call fcn.004099d0
add esp, 4
push 0x40010
call fcn.004068f0
push eax
lea ecx, [esp + 0x18]
push ecx
call fcn.004068e0
push eax
call dword [sym.imp.USER32.dll_MessageBoxA]
cmp eax, 2
jne 0x4067a6
mov eax, dword [0x46e87c]
test eax, eax
je 0x40679f
call eax
push 0xffffffffffffffff
call fcn.00409fbc
add esp, 0x410
ret

Function at 0x406910
Capabilities:
Query or enumerate registry value
Terminate process

Disassembly:
sub esp, 0x1c
push ebx
push esi
push edi
mov edi, dword [sym.imp.USER32.dll_PeekMessageA]
push 1
xor esi, esi
push esi
push esi
push esi
lea eax, [esp + 0x1c]
push eax
call edi
test eax, eax
je 0x40696b
mov ebx, dword [sym.imp.USER32.dll_TranslateMessage]
cmp dword [esp + 0x10], 0x12
je 0x406974
lea ecx, [esp + 0xc]
push ecx
call ebx
cmp dword [esp + 0x10], 0xc000
jae 0x406957
lea edx, [esp + 0xc]
push edx
call dword [sym.imp.USER32.dll_DispatchMessageA]
push 1
push 0
push 0
push 0
lea eax, [esp + 0x1c]
push eax
inc esi
call edi
test eax, eax
jne 0x406934
pop edi
mov eax, esi
pop esi
pop ebx
add esp, 0x1c
ret
mov ecx, dword [esp + 0x14]
push ecx
call fcn.00409fbc
nop
nop
Function at 0x406980
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x40c
mov eax, dword [esp + 0x41c]
push ebp
push esi
mov esi, dword [esp + 0x42c]
push edi
mov edi, dword [esp + 0x42c]
push esi
push eax
push edi
mov dword [esp + 0x18], 0
mov dword [esp + 0x20], 0x200
or ebp, 0xffffffff
call fcn.0040ac90
mov ecx, dword [esp + 0x42c]
mov edx, dword [esp + 0x428]
push ecx
push edx
lea eax, [esp + 0x2c]
push str.Software_s_s
push eax
mov byte [edi + esi - 1], 0
call fcn.00409f3d
add esp, 0x1c
lea ecx, [esp + 0xc]
push ecx
push 0x20019
push 0
lea edx, [esp + 0x24]
push edx
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x406a4b
lea eax, [esp + 0x14]
push eax
mov eax, dword [esp + 0x428]
lea ecx, [esp + 0x21c]
push ecx
mov ecx, dword [esp + 0x14]
lea edx, [esp + 0x18]
push edx
push 0
push eax
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x406a4b
cmp dword [esp + 0x10], 1
jne 0x406a4b
push esi
lea edx, [esp + 0x21c]
push edx
push edi
call fcn.0040ac90
add esp, 0xc
mov byte [edi + esi - 1], 0
xor ebp, ebp
mov eax, dword [esp + 0xc]
test eax, eax
je 0x406a5a
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
mov eax, ebp
pop ebp
add esp, 0x40c
ret

Function at 0x406a70
Capabilities:
Set registry value

Disassembly:
sub esp, 0x204
mov eax, dword [esp + 0x20c]
mov ecx, dword [esp + 0x208]
push esi
push eax
push ecx
lea edx, [esp + 0x10]
push str.Software_s_s
push edx
mov dword [esp + 0x14], 0
or esi, 0xffffffff
call fcn.00409f3d
add esp, 0x10
push 0
lea eax, [esp + 8]
push eax
push 0
push 0xf003f
push 0
push 0x41d1d4
push 0
lea ecx, [esp + 0x24]
push ecx
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x406aff
mov edx, dword [esp + 0x218]
push edi
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
push ecx
push edx
mov edx, dword [esp + 0x220]
push 1
push eax
mov eax, dword [esp + 0x18]
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
pop edi
jne 0x406aff
xor esi, esi
mov eax, dword [esp + 4]
test eax, eax
je 0x406b0e
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop esi
add esp, 0x204
ret
Function at 0x406b20
Capabilities:
Set registry value

Disassembly:
sub esp, 0x404
mov eax, dword [esp + 0x414]
push esi
push eax
lea ecx, [esp + 0xc]
push 0x419570
push ecx
call fcn.00409f3d
mov edx, dword [esp + 0x41c]
mov eax, dword [esp + 0x418]
push edx
push eax
lea ecx, [esp + 0x21c]
push str.Software_s_s
push ecx
mov dword [esp + 0x20], 0
or esi, 0xffffffff
call fcn.00409f3d
add esp, 0x1c
push 0
lea edx, [esp + 8]
push edx
push 0
push 0xf003f
push 0
push 0x41d1d4
push 0
lea eax, [esp + 0x224]
push eax
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x406bcb
mov edx, dword [esp + 0x414]
push edi
or ecx, 0xffffffff
lea edi, [esp + 0xc]
repne scasb al, byte es:[edi]
not ecx
push ecx
lea ecx, [esp + 0x10]
push ecx
push 1
push eax
mov eax, dword [esp + 0x18]
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
pop edi
jne 0x406bcb
xor esi, esi
mov eax, dword [esp + 4]
test eax, eax
je 0x406bda
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop esi
add esp, 0x404
ret

Function at 0x406bf0
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x80c
mov eax, dword [esp + 0x81c]
push eax
lea ecx, [esp + 0x410]
push 0x419570
push ecx
call fcn.00409f3d
push 0x200
lea edx, [esp + 0x41c]
push edx
lea eax, [esp + 0x20]
push eax
mov dword [esp + 0x18], 0
mov dword [esp + 0x1c], 0x200
call fcn.0040ac90
mov ecx, dword [esp + 0x82c]
mov edx, dword [esp + 0x828]
push ecx
push edx
lea eax, [esp + 0x22c]
push str.Software_s_s
push eax
mov byte [esp + 0x233], 0
call fcn.00409f3d
add esp, 0x28
lea ecx, [esp]
push ecx
push 0x20019
push 0
lea edx, [esp + 0x218]
push edx
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x406cdb
lea eax, [esp + 4]
push eax
mov eax, dword [esp + 0x81c]
lea ecx, [esp + 0x610]
push ecx
mov ecx, dword [esp + 8]
lea edx, [esp + 0x10]
push edx
push 0
push eax
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x406cdb
cmp dword [esp + 8], 1
jne 0x406cdb
push 0x200
lea edx, [esp + 0x610]
push edx
lea eax, [esp + 0x14]
push eax
call fcn.0040ac90
add esp, 0xc
mov byte [esp + 0x20b], 0
mov eax, dword [esp]
test eax, eax
je 0x406cea
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea ecx, [esp + 0xc]
push ecx
call fcn.0040ae19
add esp, 0x810
ret
Function at 0x4091e0
Capabilities:
Check os version

Disassembly:
mov eax, dword [0x4196d8]
sub esp, 0x94
cmp eax, 0xffffffff
jne 0x40925c
mov eax, dword [0x4196d4]
cmp eax, 0xffffffff
mov dword [0x4196d8], 0
jne 0x409214
call dword [sym.imp.KERNEL32.dll_GetVersion]
not eax
shr eax, 0x1f
mov dword [0x4196d4], eax
test eax, eax
jne 0x40921f
add esp, 0x94
ret
lea eax, [esp]
push eax
mov dword [esp + 4], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
cmp dword [esp + 0x10], 2
je 0x409242
xor eax, eax
add esp, 0x94
ret
cmp dword [esp + 4], 6
jae 0x409252
xor eax, eax
add esp, 0x94
ret
mov eax, 1
mov dword [0x4196d8], eax
add esp, 0x94
ret
Function at 0x409bd0
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
push esi
mov esi, dword [esp + 0xc]
or ecx, 0xffffffff
xor eax, eax
push edi
mov edi, esi
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov ebp, ecx
mov ecx, dword [0x46ff00]
or eax, 0xffffffff
test ecx, ecx
jne 0x409c32
push ebx
xor edi, edi
mov esi, 0x46f300
mov edx, edi
mov ebx, 8
test dl, 1
je 0x409c10
shr edx, 1
xor edx, 0xedb88320
jmp 0x409c12
shr edx, 1
dec ebx
jne 0x409c01
mov dword [esi], edx
add esi, 4
inc edi
cmp esi, 0x46f700
jl 0x409bfa
mov esi, dword [esp + 0x14]
mov dword [0x46ff00], 1
pop ebx
xor edx, edx
test ebp, ebp
jle 0x409c58
xor ecx, ecx
mov cl, byte [edx + esi]
mov edi, eax
and edi, 0xff
shr eax, 8
xor ecx, edi
mov ecx, dword [ecx*4 + 0x46f300]
xor eax, ecx
inc edx
cmp edx, ebp
jl 0x409c38
pop edi
pop esi
not eax
pop ebp
ret

Function at 0x409c60
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x10
push ebx
or ebx, 0xffffffff
push esi
xor eax, eax
push edi
mov edi, dword [esp + 0x20]
mov ecx, ebx
repne scasb al, byte es:[edi]
mov eax, dword [0x46ff04]
not ecx
dec ecx
test eax, eax
mov dword [esp + 0x10], ecx
mov dword [esp + 0x18], ebx
jne 0x409cdc
push ebp
xor ebp, ebp
mov edi, 0x46f700
mov eax, ebp
cdq
mov dword [esp + 0x10], 8
mov ecx, eax
and ecx, 1
xor esi, esi
or ecx, esi
je 0x409cb0
xor eax, 0x53d46d27
xor edx, 0x85e1c3d7
mov ecx, 1
call fcn.0040ba70
dec dword [esp + 0x10]
jne 0x409c9a
mov dword [edi], eax
mov dword [edi + 4], edx
add edi, 8
inc ebp
cmp edi, 0x46ff00
jl 0x409c8f
mov dword [0x46ff04], 1
pop ebp
mov eax, dword [esp + 0x10]
xor esi, esi
test eax, eax
jle 0x409d2a
mov ecx, dword [esp + 0x20]
xor eax, eax
mov al, byte [esi + ecx]
mov edx, ebx
and edx, 0xff
mov ecx, 8
mov edi, eax
xor edi, edx
mov edx, dword [esp + 0x18]
mov eax, ebx
call fcn.0040ba70
mov ebx, dword [edi*8 + 0x46f700]
xor ebx, eax
mov eax, dword [edi*8 + 0x46f704]
xor eax, edx
mov dword [esp + 0x18], eax
mov eax, dword [esp + 0x10]
inc esi
cmp esi, eax
jl 0x409ce6
mov edx, dword [esp + 0x18]
pop edi
mov eax, ebx
pop esi
not eax
not edx
pop ebx
add esp, 0x10
ret

Function at 0x409d40
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [esp + 4]
push esi
mov esi, dword [esp + 0xc]
cmp esi, 0x400
jb 0x409d7b
mov edx, esi
shr edx, 0xa
mov ecx, edx
neg ecx
shl ecx, 0xa
push edi
add esi, ecx
mov ecx, 0x46ef00
mov edi, dword [ecx]
xor dword [eax], edi
add ecx, 4
add eax, 4
cmp ecx, 0x46f300
jb 0x409d65
dec edx
jne 0x409d60
pop edi
test esi, esi
jle 0x409d8f
mov ecx, 0x46ef00
sub ecx, eax
mov dl, byte [ecx + eax]
xor byte [eax], dl
inc eax
dec esi
jne 0x409d86
pop esi
ret

Function at 0x408932
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x4085d8
sub ecx, 1
call fcn.0040894e
xor dword [esi], eax
inc esi
push ecx
pop ecx
cmp esi, ebx
jne fcn.00408932
mov edx, edx
ret
Function at 0x401000
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push esi
mov esi, dword [esp + 0xc]
xor ecx, ecx
mov edx, 0x811c9dc5
test esi, esi
je 0x401027
push edi
mov edi, dword [esp + 0xc]
movzx eax, byte [ecx + edi]
xor edx, eax
inc ecx
imul edx, edx, 0x1000193
cmp ecx, esi
jb 0x401015
pop edi
mov eax, edx
pop esi
ret

Function at 0x401110
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x461c9a
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push esi
mov eax, dword [0x4772e0]
xor eax, esp
push eax
lea eax, [esp + 0x18]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 8], esi
push 0
call fcn.0041fa76
mov dword [esp + 0x20], 0
mov dword [esi + 4], 0
mov byte [esi + 8], 0
mov dword [esi + 0xc], 0
mov byte [esi + 0x10], 0
xor eax, eax
mov dword [esi + 0x14], 0
mov word [esi + 0x18], ax
mov dword [esi + 0x1c], eax
mov word [esi + 0x20], ax
mov dword [esi + 0x24], eax
mov byte [esi + 0x28], al
mov dword [esi + 0x2c], eax
mov byte [esi + 0x30], al
mov byte [esp + 0x20], 6
mov eax, dword [esp + 0x28]
test eax, eax
jne 0x4011b9
lea eax, [esp + 0x28]
push eax
lea ecx, [esp + 0x10]
mov dword [esp + 0x2c], str.bad_locale_name
call fcn.00408be0
push 0x4752ec
lea eax, [esp + 0x10]
push eax
mov dword [esp + 0x14], vtable.std::runtime_error.0
call fcn.00414d71
push eax
push esi
call fcn.0041f820
add esp, 8
mov eax, esi
mov ecx, dword [esp + 0x18]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x1c
ret 4

Function at 0x401390
Capabilities:
Access peb ldr_data
Get kernel32 base address
Get number of processors

Disassembly:
push 0xffffffffffffffff
push 0x461be0
mov eax, dword fs:[0]
push eax
sub esp, 0x64
push esi
mov eax, dword [0x4772e0]
xor eax, esp
push eax
lea eax, [esp + 0x6c]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 8], esi
mov dword [esi + 4], 0
mov dword [esp + 0x74], 0
push 0x46a0d8
lea ecx, [esp + 0x3c]
mov dword [esi], vtable.std::codecvt_wchar_t__char__int_.0
call fcn.00401110
lea eax, [esp + 0xc]
push eax
mov byte [esp + 0x78], 1
call fcn.0041f4da
movq xmm0, qword [eax]
movq qword [esi + 8], xmm0
movq xmm0, qword [eax + 8]
movq qword [esi + 0x10], xmm0
movq xmm0, qword [eax + 0x10]
movq qword [esi + 0x18], xmm0
movq xmm0, qword [eax + 0x18]
movq qword [esi + 0x20], xmm0
movq xmm0, qword [eax + 0x20]
movq qword [esi + 0x28], xmm0
mov eax, dword [eax + 0x28]
add esp, 4
lea ecx, [esp + 0x38]
mov dword [esi + 0x30], eax
call fcn.004011e0
mov eax, esi
mov ecx, dword [esp + 0x6c]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x70
ret 4
Function at 0x401450
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push 0xffffffffffffffff
push 0x461ba8
mov eax, dword fs:[0]
push eax
sub esp, 0x30
push esi
mov eax, dword [0x4772e0]
xor eax, esp
push eax
lea eax, [esp + 0x38]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 8], esi
mov eax, dword [esp + 0x4c]
mov dword [esi + 4], eax
lea eax, [esp + 0xc]
mov dword [esp + 0x40], 0
push eax
mov dword [esi], vtable.std::codecvt_wchar_t__char__int_.0
call fcn.0041f4da
movq xmm0, qword [eax]
movq qword [esi + 8], xmm0
movq xmm0, qword [eax + 8]
movq qword [esi + 0x10], xmm0
movq xmm0, qword [eax + 0x10]
movq qword [esi + 0x18], xmm0
movq xmm0, qword [eax + 0x18]
movq qword [esi + 0x20], xmm0
movq xmm0, qword [eax + 0x20]
movq qword [esi + 0x28], xmm0
mov eax, dword [eax + 0x28]
mov dword [esi + 0x30], eax
add esp, 4
mov eax, esi
mov ecx, dword [esp + 0x38]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x3c
ret 8

Function at 0x402a50
Capabilities:
Hash data using fnv

Disassembly:
mov ecx, dword [0x47d564]
mov eax, dword [esp + 8]
cmp eax, dword [ecx]
jne 0x402a79
cmp dword [esp + 0xc], ecx
jne 0x402a79
call fcn.004039a0
mov eax, dword [0x47d564]
mov ecx, dword [eax]
mov eax, dword [esp + 4]
mov dword [eax], ecx
ret 0xc
cmp eax, dword [esp + 0xc]
je 0x402b88
push ebx
push esi
push edi
mov esi, eax
mov eax, dword [eax]
mov dword [esp + 0x14], eax
movzx edx, byte [esi + 8]
movzx ecx, byte [esi + 9]
xor edx, 0x811c9dc5
imul edx, edx, 0x1000193
xor edx, ecx
movzx ecx, byte [esi + 0xa]
imul edx, edx, 0x1000193
mov ebx, dword [0x47d578]
xor edx, ecx
movzx ecx, byte [esi + 0xb]
imul edx, edx, 0x1000193
xor edx, ecx
imul edx, edx, 0x1000193
mov edi, ebx
and edi, edx
cmp dword [0x47d57c], edi
ja 0x402add
shr ebx, 1
or ecx, 0xffffffff
sub ecx, ebx
add edi, ecx
mov ecx, dword [0x47d56c]
cmp dword [ecx + edi*8 + 4], esi
lea ecx, [ecx + edi*8]
jne 0x402b10
cmp dword [ecx], esi
jne 0x402b08
mov eax, dword [0x47d564]
mov dword [ecx], eax
mov ecx, dword [0x47d56c]
mov eax, dword [0x47d564]
mov dword [ecx + edi*8 + 4], eax
jmp 0x402b18
mov eax, dword [esi + 4]
mov dword [ecx + 4], eax
jmp 0x402b18
cmp dword [ecx], esi
jne 0x402b1c
mov eax, dword [esi]
mov dword [ecx], eax
mov eax, dword [esp + 0x14]
cmp esi, dword [0x47d564]
je 0x402b7b
mov ecx, dword [esi + 4]
mov eax, dword [esi]
mov dword [ecx], eax
mov ecx, dword [esi]
mov eax, dword [esi + 4]
mov dword [ecx + 4], eax
mov eax, dword [esi + 0x14]
test eax, eax
je 0x402b58
push eax
call fcn.0040afd8
add esp, 4
mov dword [esi + 0x14], 0
mov dword [esi + 0x18], 0
mov dword [esi + 0x1c], 0
lea ecx, [esi + 0xc]
call fcn.00404260
push dword [esi + 0xc]
call fcn.0040afd8
push esi
call fcn.0040afd8
mov eax, dword [esp + 0x1c]
add esp, 8
dec dword [0x47d568]
cmp eax, dword [esp + 0x18]
jne 0x402a86
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 4]
mov dword [ecx], eax
mov eax, ecx
ret 0xc