joyce8/EMBER2024-capa huggingface dataset:
Function at 0x44ac89
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
push edi
call fcn.0043f45b
xor ebx, ebx
cmp dword [0x47496c], ebx
mov dword [ebp - 8], eax
mov dword [ebp - 4], ebx
mov dword [ebp - 0xc], ebx
mov dword [ebp - 0x10], ebx
jne 0x44ad5f
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
cmp edi, ebx
je 0x44ae3f
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
cmp eax, ebx
je 0x44ae3f
push eax
call fcn.0043f3ed
mov dword [esp], 0x45a9f8
push edi
mov dword [0x47496c], eax
call esi
push eax
call fcn.0043f3ed
mov dword [esp], 0x45a9e4
push edi
mov dword [0x474970], eax
call esi
push eax
call fcn.0043f3ed
mov dword [0x474974], eax
lea eax, [ebp - 0xc]
push eax
call fcn.0043ad7d
test eax, eax
pop ecx
pop ecx
je 0x44ad2d
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.0043fb2d
add esp, 0x14
cmp dword [ebp - 0xc], 2
jne 0x44ad5f
push str.GetUserObjectInformationA
push edi
call esi
push eax
call fcn.0043f3ed
cmp eax, ebx
pop ecx
mov dword [0x47497c], eax
je 0x44ad5f
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.0043f3ed
pop ecx
mov dword [0x474978], eax
mov eax, dword [0x474978]
mov ecx, dword [ebp - 8]
cmp eax, ecx
je 0x44ade4
cmp dword [0x47497c], ecx
je 0x44ade4
push eax
call fcn.0043f464
push dword [0x47497c]
mov esi, eax
call fcn.0043f464
cmp esi, ebx
pop ecx
pop ecx
mov edi, eax
je 0x44ade4
cmp edi, ebx
je 0x44ade4
call esi
cmp eax, ebx
je 0x44adb1
lea ecx, [ebp - 0x14]
push ecx
push 0xc
lea ecx, [ebp - 0x20]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x44adb1
test byte [ebp - 0x18], 1
jne 0x44ade4
lea eax, [ebp - 0x10]
push eax
call fcn.0043adb4
test eax, eax
pop ecx
je 0x44adcc
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.0043fb2d
add esp, 0x14
cmp dword [ebp - 0x10], 4
jb 0x44addb
or dword [ebp + 0x10], 0x200000
jmp 0x44ae1f
or dword [ebp + 0x10], 0x40000
jmp 0x44ae1f
mov eax, dword [0x474970]
cmp eax, dword [ebp - 8]
je 0x44ae1f
push eax
call fcn.0043f464
cmp eax, ebx
pop ecx
je 0x44ae1f
call eax
cmp eax, ebx
mov dword [ebp - 4], eax
je 0x44ae1f
mov eax, dword [0x474974]
cmp eax, dword [ebp - 8]
je 0x44ae1f
push eax
call fcn.0043f464
cmp eax, ebx
pop ecx
je 0x44ae1f
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x47496c]
call fcn.0043f464
cmp eax, ebx
pop ecx
je 0x44ae3f
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x44ae41
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x401096
Capabilities:
Terminate process

Disassembly:
jmp 0x498345
push 0x14
push 0x4fd6e0
call fcn.00401532
push 1
call fcn.0040221b
pop ecx
test al, al
je 0x498272
xor bl, bl
mov byte [ebp - 0x19], bl
and dword [ebp - 4], 0
call fcn.0040238d
mov byte [ebp - 0x24], al
mov eax, dword [0x4fe7b4]
xor ecx, ecx
inc ecx
cmp eax, ecx
je 0x498272
test eax, eax
jne 0x498190
mov dword [0x4fe7b4], ecx
push 0x49f820
push 0x49f514
call sub.api_ms_win_crt_runtime_l1_1_0.dll__initterm_e
pop ecx
pop ecx
test eax, eax
je 0x498173
mov dword [ebp - 4], 0xfffffffe
mov eax, 0xff
jmp 0x498262
push 0x49f410
push section..rdata
call sub.api_ms_win_crt_runtime_l1_1_0.dll__initterm
pop ecx
pop ecx
mov dword [0x4fe7b4], 2
jmp 0x498195
mov bl, cl
mov byte [ebp - 0x19], bl
push dword [ebp - 0x24]
call fcn.004019d3
pop ecx
call fcn.004011ae
mov esi, eax
xor edi, edi
cmp dword [esi], edi
je 0x4981c6
push esi
call fcn.0040178a
pop ecx
test al, al
je 0x4981c6
mov esi, dword [esi]
push edi
push 2
push edi
mov ecx, esi
call dword [section..00cfg]
call esi
call fcn.004010eb
mov esi, eax
cmp dword [esi], edi
je 0x4981e4
push esi
call fcn.0040178a
pop ecx
test al, al
je 0x4981e4
push dword [esi]
call sub.api_ms_win_crt_runtime_l1_1_0.dll__register_thread_local_exe_atexit_callback
pop ecx
call sub.api_ms_win_crt_runtime_l1_1_0.dll__get_initial_narrow_environment
mov edi, eax
call sub.api_ms_win_crt_runtime_l1_1_0.dll___p___argv
mov esi, dword [eax]
call sub.api_ms_win_crt_runtime_l1_1_0.dll___p___argc
push edi
push esi
push dword [eax]
call fcn.00402379
add esp, 0xc
mov esi, eax
call fcn.0040242d
test al, al
je 0x498279
test bl, bl
jne 0x498217
call sub.api_ms_win_crt_runtime_l1_1_0.dll__cexit
push 0
push 1
call fcn.00401a1e
pop ecx
pop ecx
mov dword [ebp - 4], 0xfffffffe
mov eax, esi
jmp 0x498262
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
leave
ret
push 7
call fcn.00401b9f
push esi
call sub.api_ms_win_crt_runtime_l1_1_0.dll_exit
push dword [ebp - 0x20]
call sub.api_ms_win_crt_runtime_l1_1_0.dll__exit
int3
call fcn.004027f2
jmp 0x498106
Function at 0x401ae1
Capabilities:
Write file on windows

Disassembly:
jmp 0x407c30
sub esp, 0x28
mov eax, dword [0x4fe040]
xor eax, esp
mov dword [esp + 0x24], eax
push esi
mov esi, ecx
cmp dword [esi + 0x38], 0
je 0x407cf2
cmp byte [esi + 0x3d], 0
je 0x407cf2
mov eax, dword [esi]
push edi
push 0xffffffffffffffff
call dword [eax + 0xc]
cmp eax, 0xffffffff
je 0x407cdf
mov ecx, dword [esi + 0x38]
lea eax, [esp + 8]
push eax
lea eax, [esp + 0x30]
push eax
lea eax, [esp + 0x14]
push eax
lea eax, [esi + 0x40]
push eax
call dword [sym.imp.MSVCP140.dll_public:_int___thiscall_std::codecvt_char__char__struct__Mbstatet_::unshift_struct__Mbstatet___char___char___char___const]
sub eax, 0
je 0x407ca3
sub eax, 1
je 0x407ca7
sub eax, 2
jne 0x407cdf
mov byte [esi + 0x3d], al
mov al, 1
pop edi
pop esi
mov ecx, dword [esp + 0x24]
xor ecx, esp
call fcn.004018ca
add esp, 0x28
ret
mov byte [esi + 0x3d], 0
mov edi, dword [esp + 8]
lea eax, [esp + 0xc]
sub edi, eax
je 0x407cc7
push dword [esi + 0x4c]
push edi
push 1
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
add esp, 0x10
cmp edi, eax
jne 0x407cdf
cmp byte [esi + 0x3d], 0
pop edi
sete al
pop esi
mov ecx, dword [esp + 0x24]
xor ecx, esp
call fcn.004018ca
add esp, 0x28
ret
pop edi
xor al, al
pop esi
mov ecx, dword [esp + 0x24]
xor ecx, esp
call fcn.004018ca
add esp, 0x28
ret
mov ecx, dword [esp + 0x28]
mov al, 1
pop esi
xor ecx, esp
call fcn.004018ca
add esp, 0x28
ret
Function at 0x401f64
Capabilities:
Query environment variable

Disassembly:
jmp 0x418870
sub esp, 0x190
mov eax, dword [0x4fe040]
xor eax, esp
mov dword [esp + 0x18c], eax
push esi
push edi
mov edi, dword [esp + 0x19c]
push str.FREETYPE_PROPERTIES
call dword [sym.imp.api_ms_win_crt_environment_l1_1_0.dll_getenv]
mov esi, eax
add esp, 4
test esi, esi
je 0x418aad
mov al, byte [esi]
test al, al
je 0x418aad
nop
cmp al, 0x20
je 0x418aa1
cmp al, 9
je 0x418aa1
mov edx, esi
xor eax, eax
mov cl, byte [esi]
test cl, cl
je 0x418927
cmp cl, 0x3a
je 0x418927
inc esi
mov byte [esp + eax + 0x110], cl
mov cl, byte [esi]
test cl, cl
je 0x418926
cmp cl, 0x3a
je 0x418926
inc esi
mov byte [esp + eax + 0x111], cl
mov cl, byte [esi]
test cl, cl
je 0x418921
cmp cl, 0x3a
je 0x418921
inc esi
mov byte [esp + eax + 0x112], cl
mov cl, byte [esi]
test cl, cl
je 0x41891c
cmp cl, 0x3a
je 0x41891c
mov byte [esp + eax + 0x113], cl
inc esi
add eax, 4
cmp eax, 0x80
jl 0x4188c4
jmp 0x418927
add eax, 3
jmp 0x418927
add eax, 2
jmp 0x418927
inc eax
cmp eax, 0x81
jae 0x418ac4
mov byte [esp + eax + 0x110], 0
mov al, byte [esi]
test al, al
je 0x418aad
cmp al, 0x3a
jne 0x418aad
cmp esi, edx
je 0x418aad
inc esi
xor eax, eax
mov edx, esi
nop dword [eax]
mov cl, byte [esi]
test cl, cl
je 0x4189c3
cmp cl, 0x3d
je 0x4189c3
inc esi
mov byte [esp + eax + 0x8c], cl
mov cl, byte [esi]
test cl, cl
je 0x4189c2
cmp cl, 0x3d
je 0x4189c2
inc esi
mov byte [esp + eax + 0x8d], cl
mov cl, byte [esi]
test cl, cl
je 0x4189bd
cmp cl, 0x3d
je 0x4189bd
inc esi
mov byte [esp + eax + 0x8e], cl
mov cl, byte [esi]
test cl, cl
je 0x4189b8
cmp cl, 0x3d
je 0x4189b8
mov byte [esp + eax + 0x8f], cl
inc esi
add eax, 4
cmp eax, 0x80
jl 0x418960
jmp 0x4189c3
add eax, 3
jmp 0x4189c3
add eax, 2
jmp 0x4189c3
inc eax
cmp eax, 0x81
jae 0x418ac4
mov byte [esp + eax + 0x8c], 0
mov al, byte [esi]
test al, al
je 0x418aad
cmp al, 0x3d
jne 0x418aad
cmp esi, edx
je 0x418aad
inc esi
xor eax, eax
mov edx, esi
mov cl, byte [esi]
test cl, cl
je 0x418a60
cmp cl, 0x20
je 0x418a60
cmp cl, 9
je 0x418a60
inc esi
mov byte [esp + eax + 8], cl
mov cl, byte [esi]
test cl, cl
je 0x418a5f
cmp cl, 0x20
je 0x418a5f
cmp cl, 9
je 0x418a5f
inc esi
mov byte [esp + eax + 9], cl
mov cl, byte [esi]
test cl, cl
je 0x418a5a
cmp cl, 0x20
je 0x418a5a
cmp cl, 9
je 0x418a5a
inc esi
mov byte [esp + eax + 0xa], cl
mov cl, byte [esi]
test cl, cl
je 0x418a55
cmp cl, 0x20
je 0x418a55
cmp cl, 9
je 0x418a55
mov byte [esp + eax + 0xb], cl
inc esi
add eax, 4
cmp eax, 0x80
jl 0x4189f5
jmp 0x418a60
add eax, 3
jmp 0x418a60
add eax, 2
jmp 0x418a60
inc eax
cmp eax, 0x81
jae 0x418ac4
mov byte [esp + eax + 8], 0
mov al, byte [esi]
test al, al
je 0x418a7a
cmp al, 0x20
je 0x418a7a
cmp al, 9
jne 0x418aad
cmp esi, edx
je 0x418aad
lea eax, [esp + 8]
push eax
lea eax, [esp + 0x90]
push eax
lea eax, [esp + 0x118]
push eax
push edi
call fcn.00401c7b
add esp, 0x10
cmp byte [esi], 0
je 0x418aad
mov al, byte [esi + 1]
inc esi
test al, al
jne 0x4188b0
mov ecx, dword [esp + 0x194]
pop edi
pop esi
xor ecx, esp
call fcn.004018ca
add esp, 0x190
ret
call fcn.00401181
int3
Function at 0x402270
Capabilities:
Terminate process

Disassembly:
jmp 0x4112d0
push esi
mov esi, ecx
push edi
push esi
call fcn.0040129e
mov edi, eax
add esp, 4
test edi, edi
je 0x411314
push str.Error:_Failed_to_init_freetype._Code:
push dword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
call fcn.004019ce
add esp, 8
mov ecx, eax
push edi
call dword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______thiscall_std::basic_ostream_char__struct_std::char_traits_char__::operator___int_]
push 0x401118
mov ecx, eax
call dword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______thiscall_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char_______cdecl___class_std::basic_ostream_char__struct_std::char_traits_char_____]
push 1
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
lea eax, [esi + 4]
push eax
push 0
push dword [esp + 0x18]
push dword [esp + 0x18]
push dword [esi]
call fcn.004024b9
mov edi, eax
add esp, 0x14
test edi, edi
je 0x411339
push str.Error:_Failed_to_create_face._Code:
jmp 0x4112e8
pop edi
mov eax, esi
pop esi
ret 8

Function at 0x4022c5
Capabilities:
Hash data using fnv

Disassembly:
jmp 0x40f660
mov edx, dword [esp + 8]
movzx eax, byte [edx]
xor eax, dword [esp + 4]
imul ecx, eax, 0x1000193
movzx eax, byte [edx + 1]
xor ecx, eax
movzx eax, byte [edx + 2]
imul ecx, ecx, 0x1000193
xor ecx, eax
movzx eax, byte [edx + 3]
imul ecx, ecx, 0x1000193
xor ecx, eax
imul eax, ecx, 0x1000193
ret

Function at 0x40242d
Capabilities:
Parse pe header

Disassembly:
jmp 0x498fb5
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x498ff4
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x498ff4
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x498ff4
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x498ff4
cmp dword [ecx + 0x74], 0xe
jbe 0x498ff4
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret
Function at 0x402487
Capabilities:
Read file on windows

Disassembly:
jmp 0x409cd0
mov eax, dword [esp + 0xc]
push ebx
mov ebx, ecx
push esi
mov esi, dword [esp + 0x10]
test eax, eax
jg 0x409cef
jl 0x409ce6
test esi, esi
jne 0x409cef
pop esi
xor eax, eax
xor edx, edx
pop ebx
ret 0xc
cmp dword [ebx + 0x38], 0
je 0x409d06
push eax
push esi
push dword [esp + 0x14]
call dword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____thiscall_std::basic_streambuf_char__struct_std::char_traits_char__::xsgetn_char___long_long___int64__]
pop esi
pop ebx
ret 0xc
push ebp
push edi
mov edi, esi
call dword [sym.imp.MSVCP140.dll_protected:_long_long___int64____thiscall_std::basic_streambuf_char__struct_std::char_traits_char__::_Gnavail_void_const]
test eax, eax
je 0x409d45
cmp eax, dword [esp + 0x18]
mov ecx, ebx
cmovb esi, eax
call dword [sym.imp.MSVCP140.dll_protected:_char____thiscall_std::basic_streambuf_char__struct_std::char_traits_char__::gptr_void_const]
mov ebp, dword [esp + 0x14]
push esi
push eax
push ebp
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
mov ecx, ebx
add ebp, esi
sub edi, esi
push esi
call dword [sym.imp.MSVCP140.dll_protected:_void___thiscall_std::basic_streambuf_char__struct_std::char_traits_char__::gbump_int_]
mov esi, dword [esp + 0x18]
jmp 0x409d49
mov ebp, dword [esp + 0x14]
cmp dword [ebx + 0x4c], 0
je 0x409db8
mov ecx, ebx
call dword [sym.imp.MSVCP140.dll_protected:_char____thiscall_std::basic_streambuf_char__struct_std::char_traits_char__::eback_void_const]
lea ecx, [ebx + 0x3c]
cmp eax, ecx
jne 0x409d6e
push dword [ebx + 0x54]
mov eax, dword [ebx + 0x50]
mov ecx, ebx
push eax
push eax
call dword [sym.imp.MSVCP140.dll_protected:_void___thiscall_std::basic_streambuf_char__struct_std::char_traits_char__::setg_char___char___char__]
mov eax, dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
mov ecx, edi
cmp edi, 0xfff
jbe 0x409da6
nop dword [eax]
push dword [ebx + 0x4c]
push 0xfff
push 1
push ebp
call eax
sub edi, eax
add esp, 0x10
add ebp, eax
mov ecx, edi
cmp eax, 0xfff
jne 0x409db8
cmp edi, eax
mov eax, dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
ja 0x409d80
test ecx, ecx
je 0x409db8
push dword [ebx + 0x4c]
push edi
push 1
push ebp
call eax
add esp, 0x10
sub edi, eax
mov edx, dword [esp + 0x1c]
sub esi, edi
pop edi
pop ebp
mov eax, esi
sbb edx, 0
pop esi
pop ebx
ret 0xc
Function at 0x4025a4
Capabilities:
Get file size
Read file on windows
Read file via mapping

Disassembly:
jmp 0x489e60
sub esp, 0xc
push esi
mov esi, dword [esp + 0x14]
test esi, esi
jne 0x489e74
lea eax, [esi + 0x28]
pop esi
add esp, 0xc
ret
push ebx
push 0
push 0x80
push 3
push 0
push 1
push 0x80000000
push dword [esp + 0x34]
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x489ea3
pop ebx
mov eax, 1
pop esi
add esp, 0xc
ret
push ebp
push edi
lea eax, [esp + 0x14]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetFileSizeEx]
mov ebp, dword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
je 0x489fb3
mov ecx, dword [esp + 0x18]
test ecx, ecx
jg 0x489fb3
mov eax, dword [esp + 0x14]
jl 0x489edc
cmp eax, 0x7fffffff
ja 0x489fb3
or eax, ecx
je 0x489fb3
push 0
push 0
push 0
push 2
push 0
push ebx
call dword [sym.imp.KERNEL32.dll_CreateFileMappingA]
mov edi, eax
test edi, edi
je 0x489fb3
mov ecx, dword [esp + 0x14]
push 0
push 0
push 0
push 4
push edi
mov dword [esi + 4], ecx
mov dword [esi + 8], 0
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
push edi
mov dword [esi], eax
call ebp
cmp dword [esi], 0
je 0x489f2d
mov eax, 0x48a0a0
jmp 0x489f7d
push dword [esi + 4]
push dword [esi + 0x1c]
call fcn.0048a040
add esp, 8
mov dword [esi], eax
test eax, eax
je 0x489fb3
mov ebp, dword [sym.imp.KERNEL32.dll_ReadFile]
xor edi, edi
nop dword [eax]
push 0
lea eax, [esp + 0x14]
push eax
mov eax, dword [esi + 4]
sub eax, edi
push eax
mov eax, dword [esi]
add eax, edi
push eax
push ebx
call ebp
test eax, eax
je 0x489fa0
add edi, dword [esp + 0x10]
cmp edi, dword [esi + 4]
jne 0x489f50
mov ebp, dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 0x48a060
push ebx
mov dword [esi + 0x18], eax
call ebp
mov eax, dword [esi]
pop edi
mov dword [esi + 0xc], eax
mov eax, dword [esp + 0x20]
pop ebp
mov dword [esi + 0x10], eax
xor eax, eax
pop ebx
mov dword [esi + 0x14], 0
pop esi
add esp, 0xc
ret
push dword [esi]
push dword [esi + 0x1c]
call fcn.0048a0d0
mov ebp, dword [sym.imp.KERNEL32.dll_CloseHandle]
add esp, 8
push ebx
call ebp
pop edi
pop ebp
pop ebx
mov dword [esi], 0
mov eax, 0x51
mov dword [esi + 4], 0
mov dword [esi + 8], 0
pop esi
add esp, 0xc
ret
Function at 0x40272a
Capabilities:
Write file on windows

Disassembly:
jmp 0x409e10
sub esp, 8
push ebx
mov ebx, ecx
cmp dword [ebx + 0x38], 0
je 0x409e35
push dword [esp + 0x18]
push dword [esp + 0x18]
push dword [esp + 0x18]
call dword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____thiscall_std::basic_streambuf_char__struct_std::char_traits_char__::xsputn_char_const___long_long___int64__]
pop ebx
add esp, 8
ret 0xc
push ebp
push esi
mov esi, dword [esp + 0x1c]
push edi
mov edi, dword [esp + 0x24]
mov dword [esp + 0x10], esi
mov dword [esp + 0x14], edi
call dword [sym.imp.MSVCP140.dll_protected:_long_long___int64____thiscall_std::basic_streambuf_char__struct_std::char_traits_char__::_Pnavail_void_const]
mov ebp, eax
mov eax, edx
mov dword [esp + 0x20], eax
test edi, edi
jl 0x409ea3
jg 0x409e60
test esi, esi
je 0x409ea3
test eax, eax
jl 0x409ee1
jg 0x409e6a
test ebp, ebp
je 0x409ee1
cmp edi, eax
jg 0x409e7a
jl 0x409e74
cmp esi, ebp
jae 0x409e7a
mov ebp, esi
mov dword [esp + 0x20], edi
mov ecx, ebx
call dword [sym.imp.MSVCP140.dll_protected:_char____thiscall_std::basic_streambuf_char__struct_std::char_traits_char__::pptr_void_const]
push ebp
push dword [esp + 0x20]
push eax
call sub.VCRUNTIME140.dll_memcpy
add dword [esp + 0x28], ebp
add esp, 0xc
sub esi, ebp
mov ecx, ebx
sbb edi, dword [esp + 0x20]
push ebp
call dword [sym.imp.MSVCP140.dll_protected:_void___thiscall_std::basic_streambuf_char__struct_std::char_traits_char__::pbump_int_]
mov eax, dword [esp + 0x1c]
test edi, edi
jl 0x409ecb
jg 0x409eb1
test esi, esi
je 0x409ecb
mov ecx, dword [ebx + 0x4c]
test ecx, ecx
je 0x409ecb
push ecx
push esi
push 1
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
add esp, 0x10
sub esi, eax
sbb edi, 0
mov eax, dword [esp + 0x10]
mov edx, dword [esp + 0x14]
sub eax, esi
sbb edx, edi
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret 0xc
mov eax, dword [esp + 0x1c]
jmp 0x409eb1
Function at 0x462b90
Capabilities:
Encode data using xor

Disassembly:
sub esp, 8
mov eax, dword [esp + 0x1c]
push ebx
push ebp
mov ebp, dword [esp + 0x14]
movzx ebx, word [eax]
mov eax, dword [esp + 0x18]
mov ebp, dword [ebp]
mov dword [esp + 8], ebp
cmp ebp, eax
jb 0x462bb7
pop ebp
xor eax, eax
pop ebx
add esp, 8
ret
sub eax, ebp
push esi
mov esi, dword [esp + 0x24]
cmp esi, eax
cmova esi, eax
xor edx, edx
mov dword [esp + 0x24], esi
test esi, esi
je 0x462c07
push edi
mov edi, dword [esp + 0x24]
sub ebp, edi
movzx eax, byte [edi + ebp]
lea edi, [edi + 1]
mov edx, ebx
mov ecx, 0x58bf
shr edx, 8
xor edx, eax
add eax, ebx
imul eax, eax, 0x3193
mov byte [edi - 1], dl
sub ecx, eax
movzx ebx, cx
sub esi, 1
jne 0x462bd4
mov esi, dword [esp + 0x28]
mov edx, esi
mov ebp, dword [esp + 0x10]
pop edi
mov eax, dword [esp + 0x18]
lea ecx, [esi + ebp]
pop esi
pop ebp
mov dword [eax], ecx
mov eax, dword [esp + 0x20]
mov word [eax], bx
mov eax, edx
pop ebx
add esp, 8
ret
Function at 0x475bb0
Capabilities:
Enumerate pe sections

Disassembly:
sub esp, 0xc
mov eax, dword [esp + 0x18]
push esi
mov esi, dword [esp + 0x14]
push edi
mov edi, dword [esi + 0x58]
mov dword [eax], 0
cmp byte [esi + 0x35c], 0
mov dword [esp + 0x10], edi
jne 0x475be7
push dword [esi + 0x68]
push esi
call fcn.0047e270
add esp, 8
test eax, eax
jne 0x475da1
mov edx, dword [esi + 0x348]
push ebx
mov ebx, dword [esi + 0x358]
add edx, 8
mov esi, 6
mov dword [esp + 0xc], esi
push ebp
lea ebp, [edx + ebx*4]
test edi, edi
je 0x475c6f
mov eax, dword [esp + 0x24]
test eax, eax
je 0x475c6f
mov ecx, eax
lea eax, [ecx + 1]
mov dword [esp + 0x14], eax
nop dword [eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x475c20
sub ecx, dword [esp + 0x14]
mov dword [esp + 0x14], ecx
je 0x475c6f
test ebx, ebx
je 0x475c6f
movzx esi, byte [edx + 2]
lea edi, [edx + 4]
movzx eax, byte [edi - 1]
movzx ecx, byte [edx]
shl esi, 8
or esi, eax
shl ecx, 8
movzx eax, byte [edx + 1]
mov edx, dword [esp + 0x18]
or ecx, eax
movzx eax, word [edx + 0xe]
cmp ecx, eax
je 0x475c79
lea eax, [esi + esi*4]
mov edx, edi
lea ebp, [ebp + eax*2]
sub ebx, 1
jne 0x475c35
mov esi, dword [esp + 0x10]
pop ebp
pop ebx
pop edi
mov eax, esi
pop esi
add esp, 0xc
ret
test esi, esi
je 0x475c6b
lea edi, [ebp + 1]
movzx ebx, byte [edi + 4]
test bl, 0x10
je case.default.0x475d03
movzx ecx, byte [edi - 1]
movzx eax, byte [edi]
movzx ebp, byte [edi + 5]
mov edx, dword [esp + 0x20]
shl ecx, 8
or ecx, eax
shl ebp, 8
movzx eax, byte [edi + 1]
shl ecx, 8
or ecx, eax
movzx eax, byte [edi + 2]
shl ecx, 8
or ecx, eax
movzx eax, byte [edi + 6]
or ebp, eax
movzx eax, byte [edi + 7]
shl ebp, 8
or ebp, eax
movzx eax, byte [edi + 8]
shl ebp, 8
or ebp, eax
mov eax, dword [edx + 0x354]
cmp ecx, eax
jae case.default.0x475d03
sub eax, ecx
cmp dword [esp + 0x14], eax
jae case.default.0x475d03
push eax
mov eax, dword [edx + 0x350]
add eax, ecx
push eax
push dword [esp + 0x2c]
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncmp]
add esp, 0xc
test eax, eax
jne case.default.0x475d03
and ebx, 0xf
cmp ebx, 3
ja case.default.0x475d03
jmp dword [ebx*4 + 0x475dac]
mov edx, dword [esp + 0x20]
mov eax, dword [edx + 0x354]
cmp ebp, eax
jae case.default.0x475d03
push eax
mov eax, dword [edx + 0x350]
add eax, ebp
push 0
push eax
call sub.VCRUNTIME140.dll_memchr
add esp, 0xc
test eax, eax
jne 0x475d4a
add edi, 0xa
sub esi, 1
jne 0x475c80
mov esi, dword [esp + 0x10]
mov eax, esi
pop ebp
pop ebx
pop edi
pop esi
add esp, 0xc
ret
mov ecx, dword [esp + 0x28]
mov esi, dword [esp + 0x20]
mov dword [ecx], 1
mov eax, dword [esi + 0x350]
add eax, ebp
xor esi, esi
pop ebp
pop ebx
mov dword [ecx + 4], eax
mov eax, esi
pop edi
pop esi
add esp, 0xc
ret
mov eax, dword [esp + 0x28]
xor esi, esi
mov dword [eax + 4], ebp
pop ebp
pop ebx
mov dword [eax], 2
mov eax, esi
pop edi
pop esi
add esp, 0xc
ret
mov eax, dword [esp + 0x28]
xor esi, esi
mov dword [eax + 4], ebp
pop ebp
pop ebx
mov dword [eax], 3
mov eax, esi
pop edi
pop esi
add esp, 0xc
ret
mov esi, eax
pop edi
pop esi
add esp, 0xc
ret
Function at 0x479d90
Capabilities:
Hash data using murmur3

Disassembly:
mov ecx, dword [esp + 4]
shr ecx, 0x10
xor ecx, dword [esp + 4]
imul ecx, ecx, 0x85ebca6b
mov eax, ecx
shr eax, 0xd
xor eax, ecx
imul ecx, eax, 0xc2b2ae35
mov eax, ecx
shr eax, 0x10
xor eax, ecx
ret
Function at 0x48c910
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
jmp 0x48c920
mov edx, dword [esp + 8]
test edx, edx
jne 0x48c92b
xor eax, eax
ret
mov eax, dword [esp + 4]
push esi
mov esi, dword [esp + 0x10]
not eax
cmp esi, 8
jb 0x48c9ec
push edi
mov edi, esi
shr edi, 3
movzx ecx, byte [edx]
sub esi, 8
xor ecx, eax
shr eax, 8
movzx ecx, cl
xor eax, dword [ecx*4 + 0x4faa10]
movzx ecx, byte [edx + 1]
xor ecx, eax
shr eax, 8
movzx ecx, cl
xor eax, dword [ecx*4 + 0x4faa10]
movzx ecx, byte [edx + 2]
xor ecx, eax
shr eax, 8
movzx ecx, cl
xor eax, dword [ecx*4 + 0x4faa10]
movzx ecx, byte [edx + 3]
xor ecx, eax
shr eax, 8
movzx ecx, cl
xor eax, dword [ecx*4 + 0x4faa10]
movzx ecx, byte [edx + 4]
xor ecx, eax
shr eax, 8
movzx ecx, cl
xor eax, dword [ecx*4 + 0x4faa10]
movzx ecx, byte [edx + 5]
xor ecx, eax
shr eax, 8
movzx ecx, cl
xor eax, dword [ecx*4 + 0x4faa10]
movzx ecx, byte [edx + 6]
xor ecx, eax
shr eax, 8
movzx ecx, cl
xor eax, dword [ecx*4 + 0x4faa10]
movzx ecx, byte [edx + 7]
add edx, 8
xor ecx, eax
shr eax, 8
movzx ecx, cl
xor eax, dword [ecx*4 + 0x4faa10]
sub edi, 1
jne 0x48c945
pop edi
test esi, esi
je 0x48ca0a
movzx ecx, byte [edx]
lea edx, [edx + 1]
xor ecx, eax
shr eax, 8
movzx ecx, cl
xor eax, dword [ecx*4 + 0x4faa10]
sub esi, 1
jne 0x48c9f0
not eax
pop esi
ret