joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4183b0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x717f80]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, ecx
cmp dword [esi + 0x38], 0
je 0x41846c
cmp byte [esi + 0x3d], 0
je 0x41846c
mov eax, dword [esi]
push edi
push 0xffffffffffffffff
call dword [eax + 0xc]
cmp eax, 0xffffffff
je 0x41845a
mov ecx, dword [esi + 0x38]
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [esi + 0x40]
push eax
call dword [sym.imp.MSVCP140.dll_public:_int___thiscall_std::codecvt_char__char__struct__Mbstatet_::unshift_struct__Mbstatet___char___char___char___const]
sub eax, 0
je 0x418421
sub eax, 1
je 0x418425
sub eax, 2
jne 0x41845a
mov byte [esi + 0x3d], al
mov al, 1
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00622073
mov esp, ebp
pop ebp
ret
mov byte [esi + 0x3d], 0
mov edi, dword [ebp - 0x28]
lea eax, [ebp - 0x24]
sub edi, eax
je 0x418443
push dword [esi + 0x4c]
push edi
push 1
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
add esp, 0x10
cmp edi, eax
jne 0x41845a
cmp byte [esi + 0x3d], 0
pop edi
sete al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00622073
mov esp, ebp
pop ebp
ret
pop edi
xor al, al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00622073
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
mov al, 1
xor ecx, ebp
pop esi
call fcn.00622073
mov esp, ebp
pop ebp
ret

Function at 0x41b050
Capabilities:
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
mov edi, edx
not ebx
mov esi, ecx
mov eax, ebx
test edi, edi
je 0x41b0b1
mov cl, byte [esi]
lea esi, [esi + 1]
dec edi
cmp cl, 0x23
jne 0x41b094
cmp edi, 2
jb 0x41b094
cmp byte [esi], cl
jne 0x41b094
cmp byte [esi + 1], cl
jne 0x41b094
mov eax, ebx
movzx ecx, cl
movzx edx, al
xor edx, ecx
shr eax, 8
xor eax, dword [edx*4 + 0x6d8de0]
jmp 0x41b065
movzx edx, al
movzx ecx, cl
xor edx, ecx
shr eax, 8
xor eax, dword [edx*4 + 0x6d8de0]
test edi, edi
jne 0x41b065
pop edi
pop esi
not eax
pop ebx
pop ebp
ret
mov cl, byte [esi]
inc esi
test cl, cl
je 0x41b0e0
cmp cl, 0x23
jne 0x41b0c7
cmp byte [esi], cl
jne 0x41b0c7
cmp byte [esi + 1], cl
cmove eax, ebx
movzx edx, al
movzx ecx, cl
xor edx, ecx
shr eax, 8
mov cl, byte [esi]
inc esi
xor eax, dword [edx*4 + 0x6d8de0]
test cl, cl
jne 0x41b0b8
pop edi
pop esi
not eax
pop ebx
pop ebp
ret
Function at 0x41b280
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, ecx
push edi
test esi, esi
jne 0x41b2a5
push 0x645
push str.E:Project_Fxcksociety_FXCK____LOADERLoaderimguiimgui.cpp
push str.filename__mode
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__wassert]
add esp, 0xc
mov edi, dword [ebp + 8]
test edi, edi
je 0x41b2b2
mov dword [edi], 0
mov edx, 0x6e1340
mov ecx, esi
call fcn.0041b0f0
mov esi, eax
test esi, esi
je 0x41b3a2
mov ebx, dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_ftell]
push esi
call ebx
add esp, 4
mov dword [ebp - 4], eax
cmp eax, 0xffffffff
je 0x41b398
push 2
push 0
push esi
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fseek]
add esp, 0xc
test eax, eax
jne 0x41b398
push esi
call ebx
mov ebx, eax
add esp, 4
mov dword [ebp + 8], ebx
cmp ebx, 0xffffffff
je 0x41b398
push 0
push dword [ebp - 4]
push esi
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fseek]
add esp, 0xc
test eax, eax
jne 0x41b398
mov eax, dword [0x7dd8e0]
test eax, eax
je 0x41b32c
inc dword [eax + 0x374]
push ebx
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov ebx, eax
add esp, 4
test ebx, ebx
je 0x41b398
push esi
push dword [ebp + 8]
push 1
push ebx
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
add esp, 0x10
push esi
cmp eax, dword [ebp + 8]
je 0x41b37d
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
mov eax, dword [0x7dd8e0]
add esp, 4
test eax, eax
je 0x41b36a
dec dword [eax + 0x374]
push ebx
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
add esp, 4
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
add esp, 4
test edi, edi
je 0x41b38f
mov eax, dword [ebp + 8]
mov dword [edi], eax
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push esi
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
add esp, 4
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x41d7c0
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, ecx
push edi
cmp dword [esi + 0xfc], 0
jg 0x41d7e8
push 0x6d3
push 0x6dcfe0
push str.Size___0
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__wassert]
add esp, 0xc
mov ecx, dword [esi + 0xfc]
mov edi, 4
mov eax, dword [esi + 0x104]
lea esi, [ebp + 8]
mov eax, dword [eax + ecx*4 - 4]
not eax
movzx ecx, byte [esi]
lea esi, [esi + 1]
movzx edx, al
xor edx, ecx
shr eax, 8
xor eax, dword [edx*4 + 0x6d8de0]
sub edi, 1
jne 0x41d802
mov ecx, dword [0x7dd8e0]
not eax
pop edi
pop esi
cmp dword [ecx + 0x1c84], eax
jne 0x41d834
mov dword [ecx + 0x1c88], eax
cmp dword [ecx + 0x1cbc], eax
jne 0x41d843
mov byte [ecx + 0x1cc0], 1
pop ebp
ret 4
Function at 0x429e80
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [0x717f80]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [0x7dd8e0]
push ebx
mov dword [ebp - 8], ecx
mov ebx, dword [eax + 0x1c48]
cmp dword [ebx + 0xfc], 0
jg 0x429ec0
push 0x6d3
push 0x6dcfe0
push str.Size___0
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__wassert]
add esp, 0xc
mov ecx, dword [ebx + 0xfc]
mov eax, dword [ebx + 0x104]
push esi
push edi
lea esi, [ebp - 8]
mov edi, 4
mov eax, dword [eax + ecx*4 - 4]
not eax
nop dword [eax]
movzx ecx, byte [esi]
lea esi, [esi + 1]
movzx edx, al
xor edx, ecx
shr eax, 8
xor eax, dword [edx*4 + 0x6d8de0]
sub edi, 1
jne 0x429ee0
not eax
lea ecx, [ebx + 0xfc]
pop edi
mov dword [ebp - 8], eax
lea eax, [ebp - 8]
pop esi
push eax
call fcn.0043d8f0
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop ebx
call fcn.00622073
mov esp, ebp
pop ebp
ret

Function at 0x42b580
Capabilities:
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x717f80]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov edi, dword [0x7dd8e0]
mov ebx, edx
cmp byte [edi + 0x1f5d], 0
jne 0x42b5d4
cmp byte [edi + 0x1f5e], 0
jne 0x42b5d4
push dword [edi + 0x2f80]
lea eax, [ebp - 0x14]
push str.Tooltip__02d
push 0x10
push eax
call fcn.0041b010
add esp, 0x10
test bl, 1
je 0x42b6f5
jmp 0x42b66c
movss xmm1, dword [edi + 0x164c]
lea eax, [ebp - 0x14]
movaps xmm0, xmm1
mulss xmm1, dword [0x6e6614]
mulss xmm0, dword [0x6e6624]
addss xmm1, dword [edi + 0xe8]
addss xmm0, dword [edi + 0xe4]
mov dword [edi + 0x1cec], 0
mov dword [edi + 0x1cf0], 0
movss dword [edi + 0x1ce8], xmm1
mov dword [edi + 0x1cd4], 1
movss dword [edi + 0x1ce4], xmm0
mov byte [edi + 0x1d0c], 1
movss xmm0, dword [edi + 0x16a8]
mulss xmm0, dword [0x6e6550]
or dword [edi + 0x1cd0], 0x41
movss dword [edi + 0x1d28], xmm0
push dword [edi + 0x2f80]
push str.Tooltip__02d
push 0x10
push eax
call fcn.0041b010
add esp, 0x10
mov al, byte [ebp - 0x14]
lea esi, [ebp - 0x13]
or edx, 0xffffffff
test al, al
je 0x42b6a7
or ebx, 0xffffffff
nop dword [eax]
cmp al, 0x23
jne 0x42b68e
cmp byte [esi], al
jne 0x42b68e
cmp byte [esi + 1], al
cmove edx, ebx
movzx ecx, dl
movzx eax, al
xor ecx, eax
shr edx, 8
mov al, byte [esi]
inc esi
xor edx, dword [ecx*4 + 0x6d8de0]
test al, al
jne 0x42b680
mov ecx, dword [0x7dd8e0]
not edx
push edx
lea ecx, [ecx + 0x1c30]
call fcn.0041b630
test eax, eax
je 0x42b6f5
cmp byte [eax + 0xc3], 0
je 0x42b6f5
mov byte [eax + 0xca], 1
mov byte [eax + 0xe4], 1
lea eax, [ebp - 0x14]
inc dword [edi + 0x2f80]
push dword [edi + 0x2f80]
push str.Tooltip__02d
push 0x10
push eax
call fcn.0041b010
add esp, 0x10
push 0x22c0347
xor edx, edx
lea ecx, [ebp - 0x14]
call fcn.004257d0
mov ecx, dword [ebp - 4]
add esp, 4
xor ecx, ebp
pop edi
pop esi
pop ebx
call fcn.00622073
mov esp, ebp
pop ebp
ret
Function at 0x4307a0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push ecx
push ebx
push esi
push edi
mov edi, ecx
mov ebx, edx
cmp dword [edi + 0x3030], 0
lea esi, [edi + 0x3034]
je 0x430822
mov ecx, dword [esi + 4]
test ecx, ecx
jns 0x4307dc
mov eax, ecx
cdq
sub eax, edx
sar eax, 1
add eax, ecx
xor ecx, ecx
test eax, eax
cmovg ecx, eax
push ecx
mov ecx, esi
call fcn.0043e7c0
push dword [ebp + 8]
mov ecx, esi
mov dword [esi], 0
push ebx
call fcn.0041b890
mov edx, dword [esi]
mov ecx, 0x7dd8b1
push dword [edi + 0x3030]
lea eax, [edx - 1]
neg edx
sbb edx, edx
and edx, eax
mov eax, dword [edi + 0x303c]
test eax, eax
push edx
cmovne ecx, eax
push 1
push ecx
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
add esp, 0x10
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push dword [ebp + 8]
mov ecx, esi
push ebx
call fcn.0041b890
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x430ce0
Capabilities:
Hash data with crc32

Disassembly:
push esi
push edi
mov edi, ecx
or ecx, 0xffffffff
mov al, byte [edi]
lea esi, [edi + 1]
test al, al
je 0x430d1c
push ebx
or ebx, 0xffffffff
cmp al, 0x23
jne 0x430d02
cmp byte [esi], al
jne 0x430d02
cmp byte [esi + 1], al
cmove ecx, ebx
movzx edx, cl
movzx eax, al
xor edx, eax
shr ecx, 8
mov al, byte [esi]
inc esi
xor ecx, dword [edx*4 + 0x6d8de0]
test al, al
jne 0x430cf4
pop ebx
not ecx
call fcn.00430c30
test eax, eax
jne 0x430d30
mov ecx, edi
pop edi
pop esi
jmp fcn.00430b50
pop edi
pop esi
ret
Function at 0x434910
Capabilities:
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [0x717f80]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
mov esi, ecx
mov dword [ebp - 0x20], esi
push edi
test eax, eax
jle 0x434aa6
lea ebx, [edx + 0x18]
nop word [eax + eax]
mov edx, dword [ebx - 0x18]
test edx, edx
je 0x434a97
mov ecx, esi
call fcn.00434290
mov edi, eax
mov eax, dword [ebx - 0x14]
mov dword [ebp - 0x1c], edi
test eax, eax
je 0x43496e
push eax
lea ecx, [esi + 0x2fb8]
call fcn.0041b630
mov ecx, eax
jmp 0x434970
xor ecx, ecx
mov dword [edi + 0x10], ecx
movsx eax, word [ebx]
movd xmm1, eax
movsx eax, word [ebx + 2]
cvtdq2ps xmm1, xmm1
movd xmm0, eax
cvtdq2ps xmm0, xmm0
movss dword [edi + 0x2c], xmm1
movss dword [edi + 0x30], xmm0
movsx eax, word [ebx + 4]
movd xmm1, eax
movsx eax, word [ebx + 6]
cvtdq2ps xmm1, xmm1
movd xmm0, eax
cvtdq2ps xmm0, xmm0
movss dword [edi + 0x34], xmm1
movss dword [edi + 0x38], xmm0
movsx eax, word [ebx + 8]
movd xmm1, eax
movsx eax, word [ebx + 0xa]
cvtdq2ps xmm1, xmm1
movd xmm0, eax
mov eax, dword [edi + 0x90]
cvtdq2ps xmm0, xmm0
and eax, 0xfffffe49
or eax, 0x49
mov dword [edi + 0x90], eax
movss dword [edi + 0x3c], xmm1
movss dword [edi + 0x40], xmm0
test ecx, ecx
je 0x4349fe
cmp dword [ecx + 0x14], 0
jne 0x4349f5
mov dword [ecx + 0x14], edi
jmp 0x4349fe
cmp dword [ecx + 0x18], 0
jne 0x4349fe
mov dword [ecx + 0x18], edi
mov eax, dword [ebx - 0xc]
mov ecx, edi
mov dword [edi + 0x88], eax
movsx eax, byte [ebx - 8]
mov dword [edi + 0x44], eax
mov eax, dword [ebx - 4]
and eax, 0x61fc20
or dword [edi + 8], eax
mov eax, dword [edi + 0x10]
test eax, eax
je 0x434a2b
mov ecx, eax
mov eax, dword [ecx + 0x10]
test eax, eax
jne 0x434a22
push dword [ecx]
lea eax, [ebp - 0x18]
push str.DockNode__02X
push 0x14
push eax
call fcn.0041b010
mov al, byte [ebp - 0x18]
lea esi, [ebp - 0x17]
add esp, 0x10
or edx, 0xffffffff
test al, al
je 0x434a7a
or edi, 0xffffffff
cmp al, 0x23
jne 0x434a5e
cmp byte [esi], al
jne 0x434a5e
cmp byte [esi + 1], al
cmove edx, edi
movzx ecx, dl
movzx eax, al
xor ecx, eax
shr edx, 8
mov al, byte [esi]
inc esi
xor edx, dword [ecx*4 + 0x6d8de0]
test al, al
jne 0x434a50
mov edi, dword [ebp - 0x1c]
mov ecx, dword [0x7dd8e0]
not edx
push edx
lea ecx, [ecx + 0x1c30]
call fcn.0041b630
mov esi, dword [ebp - 0x20]
mov dword [edi + 0x68], eax
mov eax, dword [ebp + 8]
add ebx, 0x24
sub eax, 1
mov dword [ebp + 8], eax
jne 0x434940
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00622073
mov esp, ebp
pop ebp
ret
Function at 0x446850
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push esi
mov esi, ecx
push edi
mov edi, dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov ecx, dword [esi + 8]
test ecx, ecx
je 0x44688a
mov eax, dword [0x7dd8e0]
mov dword [esi + 4], 0
mov dword [esi], 0
test eax, eax
je 0x44687d
dec dword [eax + 0x374]
push ecx
call edi
add esp, 4
mov dword [esi + 8], 0
mov ecx, dword [esi + 0x14]
test ecx, ecx
je 0x4468bb
mov eax, dword [0x7dd8e0]
mov dword [esi + 0x10], 0
mov dword [esi + 0xc], 0
test eax, eax
je 0x4468ae
dec dword [eax + 0x374]
push ecx
call edi
add esp, 4
mov dword [esi + 0x14], 0
mov ecx, dword [esi + 0x20]
test ecx, ecx
je 0x4468ec
mov eax, dword [0x7dd8e0]
mov dword [esi + 0x1c], 0
mov dword [esi + 0x18], 0
test eax, eax
je 0x4468df
dec dword [eax + 0x374]
push ecx
call edi
add esp, 4
mov dword [esi + 0x20], 0
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x34], 0
mov dword [esi + 0x38], 0
mov ecx, dword [esi + 0x44]
test ecx, ecx
je 0x446939
mov eax, dword [0x7dd8e0]
mov dword [esi + 0x40], 0
mov dword [esi + 0x3c], 0
test eax, eax
je 0x44692c
dec dword [eax + 0x374]
push ecx
call edi
add esp, 4
mov dword [esi + 0x44], 0
mov ecx, dword [esi + 0x50]
test ecx, ecx
je 0x44696a
mov eax, dword [0x7dd8e0]
mov dword [esi + 0x4c], 0
mov dword [esi + 0x48], 0
test eax, eax
je 0x44695d
dec dword [eax + 0x374]
push ecx
call edi
add esp, 4
mov dword [esi + 0x50], 0
mov ecx, dword [esi + 0x5c]
test ecx, ecx
je 0x44699b
mov eax, dword [0x7dd8e0]
mov dword [esi + 0x58], 0
mov dword [esi + 0x54], 0
test eax, eax
je 0x44698e
dec dword [eax + 0x374]
push ecx
call edi
add esp, 4
mov dword [esi + 0x5c], 0
pop edi
lea ecx, [esi + 0x78]
pop esi
jmp fcn.00449330
Function at 0x45f000
Capabilities:
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
cmp dword [ebp + 8], 0
push ebx
push esi
push edi
mov ebx, edx
je 0x45f094
test dword [ecx + 0xc], 0x100000
jne 0x45f033
push 0x206a
push str.E:Project_Fxcksociety_FXCK____LOADERLoaderimguiimgui_widgets.cpp
push str.tab_bar__Flags__ImGuiTabBarFlags_DockNode
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__wassert]
add esp, 0xc
mov cl, byte [ebx]
lea esi, [ebx + 1]
or eax, 0xffffffff
test cl, cl
je 0x45f06a
or edi, 0xffffffff
cmp cl, 0x23
jne 0x45f051
cmp byte [esi], cl
jne 0x45f051
cmp byte [esi + 1], cl
cmove eax, edi
movzx edx, al
movzx ecx, cl
xor edx, ecx
shr eax, 8
mov cl, byte [esi]
inc esi
xor eax, dword [edx*4 + 0x6d8de0]
test cl, cl
jne 0x45f042
mov ecx, dword [0x7dd8e0]
not eax
cmp dword [ecx + 0x1c84], eax
jne 0x45f080
mov dword [ecx + 0x1c88], eax
cmp dword [ecx + 0x1cbc], eax
jne 0x45f100
pop edi
pop esi
mov byte [ecx + 0x1cc0], 1
pop ebx
pop ebp
ret
mov esi, dword [0x7dd8e0]
mov edi, dword [esi + 0x1c48]
cmp dword [edi + 0xfc], 0
jg 0x45f0c7
push 0x6d3
push 0x6dcfe0
push str.Size___0
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__wassert]
mov esi, dword [0x7dd8e0]
add esp, 0xc
mov ecx, dword [edi + 0xfc]
xor edx, edx
mov eax, dword [edi + 0x104]
push dword [eax + ecx*4 - 4]
mov ecx, ebx
call fcn.0041b050
add esp, 4
cmp dword [esi + 0x1c84], eax
jne 0x45f0f1
mov dword [esi + 0x1c88], eax
cmp dword [esi + 0x1cbc], eax
jne 0x45f100
mov byte [esi + 0x1cc0], 1
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x462090
Capabilities:
Access peb ldr_data
Encode data using xor
Hash data using fnv
Resolve function by fnv-1a hash
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
mov esi, dword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
xor edx, edx
push edi
mov edi, ecx
mov dword [ebp - 0x14], 0x918f8e9e
mov dword [ebp - 0x10], 0x223b208d
mov word [ebp - 0xc], 0x100
lea eax, [edx - 5]
xor byte [ebp + edx - 0x14], al
inc edx
cmp edx, 8
jb 0x4620b7
lea edx, [ebp - 0x14]
mov byte [ebp - 0xb], 0
mov ecx, esi
call fcn.00418810
mov edx, edi
mov ecx, esi
call fcn.00418810
push 0x418a30
mov ecx, eax
call dword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______thiscall_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char_______cdecl___class_std::basic_ostream_char__struct_std::char_traits_char_____]
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0xc]
mov edx, dword [eax + 0x18]
mov dword [ebp - 8], edx
mov ecx, dword [edx + 0x3c]
mov ecx, dword [ecx + edx + 0x78]
add ecx, edx
mov dword [ebp - 4], ecx
cmp ecx, edx
je 0x462159
mov edi, dword [ecx + 0x18]
test edi, edi
je 0x462159
mov ecx, dword [ecx + 0x20]
lea ebx, [ecx + edi*4]
add ebx, edx
nop dword [eax]
mov ecx, dword [ebx - 4]
lea ebx, [ebx - 4]
add ecx, edx
dec edi
mov esi, 0x811c9dc5
mov dl, byte [ecx]
inc ecx
test dl, dl
je 0x462152
movsx edx, dl
lea ecx, [ecx + 1]
xor edx, esi
imul esi, edx, 0x1000193
mov dl, byte [ecx - 1]
test dl, dl
jne 0x462135
cmp esi, 0x2fa62ca8
je 0x46215d
mov edx, dword [eax + 0x18]
test edi, edi
jne 0x462120
mov eax, dword [eax]
jmp 0x4620f4
mov esi, dword [ebp - 4]
mov edx, dword [ebp - 8]
push 0xbb8
mov eax, dword [esi + 0x24]
lea eax, [eax + edi*2]
movzx ecx, word [eax + edx]
mov eax, dword [esi + 0x1c]
lea eax, [eax + ecx*4]
mov eax, dword [eax + edx]
add eax, edx
call eax
pop edi
pop esi
mov dword [0], 1
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x462190
Capabilities:
Access peb ldr_data
Encode data using xor
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [0x7ddb08]
sub esp, 0x24
mov dword [0x7ddb04], eax
mov eax, dword [0x7ddad8]
push ebx
push esi
push edi
test eax, eax
jne 0x462297
mov eax, dword fs:[0x30]
xor ebx, ebx
mov dword [ebp - 8], ebx
mov edi, 0xf4d8b55
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0xc]
mov eax, dword [eax]
mov ecx, eax
mov dword [ebp - 0x10], eax
mov dword [ebp - 4], ecx
mov eax, dword [ecx + 0x2c]
mov ecx, dword [ecx + 0x30]
test ebx, ebx
je 0x462206
add eax, 0xfffffff8
mov edx, 0x811c9dc5
movzx eax, ax
shr eax, 1
lea esi, [ecx + eax*2]
cmp ecx, esi
je 0x462202
nop
movsx eax, byte [ecx]
add ecx, 2
xor eax, edx
imul edx, eax, 0x1000193
cmp ecx, esi
jne 0x4621f0
cmp edx, ebx
jne 0x462277
mov eax, dword [ebp - 4]
mov edx, dword [eax + 0x18]
mov dword [ebp - 0xc], edx
mov eax, dword [edx + 0x3c]
mov ecx, dword [eax + edx + 0x78]
mov eax, dword [eax + edx + 0x7c]
mov dword [ebp - 0x18], eax
lea eax, [ecx + edx]
mov dword [ebp - 0x14], eax
cmp eax, edx
je 0x462277
mov esi, dword [eax + 0x18]
test esi, esi
je 0x462277
mov eax, dword [eax + 0x20]
lea ebx, [eax + esi*4]
add ebx, edx
mov ecx, dword [ebx - 4]
lea ebx, [ebx - 4]
add ecx, edx
dec esi
mov edx, 0x811c9dc5
mov al, byte [ecx]
inc ecx
test al, al
je 0x462265
nop dword [eax + eax]
movsx eax, al
lea ecx, [ecx + 1]
xor eax, edx
imul edx, eax, 0x1000193
mov al, byte [ecx - 1]
test al, al
jne 0x462250
cmp edx, edi
mov edx, dword [ebp - 0xc]
je 0x4622ec
test esi, esi
jne 0x462236
mov ebx, dword [ebp - 8]
mov eax, dword [ebp - 4]
mov eax, dword [eax]
mov ecx, eax
mov dword [ebp - 4], eax
cmp eax, dword [ebp - 0x10]
je 0x462290
cmp dword [ecx + 0x18], 0
jne 0x4621d0
xor eax, eax
mov dword [0x7ddad8], eax
call eax
mov ecx, dword [0x7ddb04]
mov dword [0x7ddb08], eax
test ecx, ecx
je 0x4622e3
sub eax, ecx
cmp eax, 0x1770
jbe 0x4622e3
mov dword [ebp - 0x20], 0x9b9095af
xor ecx, ecx
mov word [ebp - 0x1c], 0x100
lea eax, [ecx - 5]
xor byte [ebp + ecx - 0x20], al
inc ecx
cmp ecx, 4
jb 0x4622c0
lea ecx, [ebp - 0x20]
mov byte [ebp - 0x1b], 0
call fcn.00462090
mov dword [0], 1
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
mov edi, dword [ebp - 0x14]
mov eax, dword [edi + 0x24]
lea eax, [eax + esi*2]
movzx ecx, word [eax + edx]
mov eax, dword [edi + 0x1c]
lea eax, [eax + ecx*4]
mov eax, dword [eax + edx]
add eax, edx
cmp eax, edi
jbe 0x462292
mov ecx, dword [ebp - 0x18]
add ecx, edi
cmp eax, ecx
jae 0x462292
mov cl, byte [eax]
mov ebx, 0x811c9dc5
mov dword [ebp - 8], ebx
mov edi, ebx
cmp cl, 0x2e
je 0x46233c
movsx ecx, cl
inc eax
xor ecx, ebx
imul ebx, ecx, 0x1000193
mov cl, byte [eax]
cmp cl, 0x2e
jne 0x462326
mov dword [ebp - 8], ebx
mov cl, byte [eax + 1]
inc eax
test cl, cl
je 0x462358
movsx ecx, cl
lea eax, [eax + 1]
xor ecx, edi
imul edi, ecx, 0x1000193
mov cl, byte [eax]
test cl, cl
jne 0x462344
mov eax, dword [ebp - 0x10]
mov eax, dword [eax]
jmp 0x46227a
Function at 0x463ce0
Capabilities:
Delete file
Encode data using xor

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff0
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
sub esp, 0x50
mov eax, dword [0x717f80]
xor eax, ebp
mov dword [ebp - 4], eax
lea eax, [ebp - 8]
mov dword [ebp - 8], 0
push eax
call dword [sym.imp.KERNEL32.dll_Wow64DisableWow64FsRedirection]
test eax, eax
je 0x463ebe
movups xmm0, xmmword [0x6e6418]
mov eax, dword [0x6e6438]
xor ecx, ecx
cmp dword [0x7dd718], 2
movups xmmword [ebp - 0x40], xmm0
mov dword [ebp - 0x20], eax
movups xmm0, xmmword [0x6e6428]
mov ax, word [0x6e643c]
mov word [ebp - 0x1c], ax
movups xmmword [ebp - 0x30], xmm0
jl 0x463e80
movaps xmm0, xmmword [0x6e6890]
movaps xmm4, xmmword [0x6e6760]
movaps xmm3, xmmword [0x6e6940]
movaps xmm5, xmmword [0x6e6780]
movaps xmmword [ebp - 0x50], xmm0
mov edx, dword [ebp - 0x50]
nop word [eax + eax]
movd xmm0, ecx
lea eax, [ecx + 4]
pshufd xmm2, xmm0, 0
paddd xmm2, xmm4
movaps xmm1, xmm2
movaps xmm0, xmm2
punpckhdq xmm0, xmm2
punpckldq xmm1, xmm2
pmuldq xmm0, xmm3
pmuldq xmm1, xmm3
shufps xmm1, xmm0, 0xdd
psrad xmm1, 4
movaps xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm5
psubd xmm2, xmm0
pshuflw xmm0, xmm2, 0xd8
pshufhw xmm0, xmm0, 0xd8
pshufd xmm1, xmm0, 0xd8
andps xmm1, xmmword [0x6e67a0]
packuswb xmm1, xmm1
movd xmm0, edx
paddb xmm1, xmm0
movd xmm0, dword [ebp + ecx - 0x40]
xorps xmm1, xmm0
movd xmm0, eax
pshufd xmm2, xmm0, 0
movd dword [ebp + ecx - 0x40], xmm1
paddd xmm2, xmm4
movaps xmm1, xmm2
movaps xmm0, xmm2
punpckhdq xmm0, xmm2
punpckldq xmm1, xmm2
pmuldq xmm0, xmm3
pmuldq xmm1, xmm3
shufps xmm1, xmm0, 0xdd
psrad xmm1, 4
movaps xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm5
psubd xmm2, xmm0
pshuflw xmm0, xmm2, 0xd8
pshufhw xmm0, xmm0, 0xd8
pshufd xmm1, xmm0, 0xd8
andps xmm1, xmmword [0x6e67a0]
packuswb xmm1, xmm1
movd xmm0, edx
paddb xmm1, xmm0
movd xmm0, dword [ebp + ecx - 0x3c]
xorps xmm1, xmm0
movd dword [ebp + ecx - 0x3c], xmm1
add ecx, 8
cmp ecx, 0x20
jl 0x463d80
cmp ecx, 0x26
jge 0x463ea8
nop dword [eax]
mov eax, 0x51eb851f
imul ecx
sar edx, 4
mov eax, edx
shr eax, 0x1f
add eax, edx
mov dl, cl
movsx eax, al
imul eax, eax, 0x32
sub dl, al
add dl, 0x36
xor byte [ebp + ecx - 0x40], dl
inc ecx
cmp ecx, 0x26
jl 0x463e80
lea eax, [ebp - 0x40]
push eax
call dword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll_remove]
add esp, 4
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_Wow64RevertWow64FsRedirection]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00622073
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret