joyce8/EMBER2024-capa huggingface dataset:
Function at 0x407fc0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ebx
lea eax, [ebp - 8]
sub esp, 0x84
mov dword [ebp - 0x50], ecx
mov dword [ebp - 0x34], 0x4bda00
mov dword [ebp - 0x2c], eax
lea eax, [ebp - 0x4c]
mov dword [ebp - 0x30], 0x4be860
mov dword [ebp - 0x28], 0x408678
mov dword [ebp - 0x24], esp
mov dword [esp], eax
call fcn.00414b80
mov eax, 1
lock xadd dword [0x4d0244], eax
mov edx, dword [ebp - 0x50]
add eax, 1
mov dword [ebp - 0x10], 0
mov dword [ebp - 0x54], eax
mov eax, dword [ebp + 0xc]
mov dword [edx + 0x58], 0
mov dword [edx + 0x5c], 0
mov dword [edx + 0x60], 0
mov dword [edx + 0x64], 0
mov dword [edx], eax
mov eax, dword [ebp + 0x10]
mov dword [edx + 0x68], 0
mov dword [edx + 0x70], 0
mov dword [edx + 0x74], 0
mov dword [edx + 0x7c], 0
mov dword [edx + 4], eax
mov eax, dword [ebp + 0x14]
mov dword [edx + 0x80], 0
mov dword [edx + 0x84], 0
mov byte [edx + 0x88], 0
mov dword [edx + 0xa4], 0
mov dword [edx + 8], eax
mov eax, dword [ebp + 0x1c]
mov dword [edx + 0xa8], 0
mov dword [edx + 0xac], 0
mov dword [edx + 0xb0], 0
mov dword [edx + 0xb4], 0
mov dword [edx + 0x6c], eax
mov eax, dword [ebp + 0x18]
mov byte [edx + 0xb8], 0
mov byte [edx + 0xb9], 0
mov byte [edx + 0xba], 0
mov dword [edx + 0x78], eax
mov eax, dword [ebp + 0x28]
test eax, eax
je 0x408420
mov eax, dword [ebp + 0x28]
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp + 0x28]
mov dword [ebp - 0x48], 1
call fcn.004098e0
test al, al
jne 0x408230
mov eax, dword [ebp - 0x50]
mov eax, dword [eax + 0xc]
mov dword [ebp - 0x58], eax
mov ebx, dword [ebp - 0x58]
test ebx, ebx
je 0x408282
mov eax, dword [ebp - 0x50]
lea ecx, [eax + 0xbc]
mov dword [ebp - 0x58], ecx
mov dword [esp], 0x18
mov dword [ebp - 0x48], 1
call fcn.004bcd90
mov ecx, dword [ebp - 0x58]
mov dword [eax + 8], 0
mov dword [eax + 0xc], 0
mov dword [eax + 0x10], 0
mov dword [esp], ecx
mov ecx, eax
call fcn.004afeb0
mov eax, dword [ebp - 0x50]
sub esp, 4
add dword [eax + 0xc4], 1
cmp dword [ebp - 0x54], 1
je 0x4084e0
mov eax, dword [ebp + 0x18]
test eax, eax
je 0x4081d4
mov dword [esp], 0x4d0248
mov dword [ebp - 0x48], 1
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov ecx, dword [0x4d0264]
sub esp, 4
test ecx, ecx
je 0x408500
mov edx, dword [ecx + 4]
mov eax, dword [ecx + 8]
mov ebx, dword [ebp - 0x50]
cmp eax, edx
mov dword [ebp - 0xc], ebx
je 0x408534
test edx, edx
je 0x4081a7
mov eax, dword [ebp - 0x50]
mov dword [edx], eax
add edx, 4
mov dword [ecx + 4], edx
test byte [ebp + 0x18], 1
jne 0x4084b0
test byte [ebp + 0x18], 4
jne 0x408210
mov dword [esp], 0x4d0248
mov dword [ebp - 0x48], 1
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
sub esp, 4
mov eax, dword [ebp - 0x10]
test eax, eax
mov dword [ebp - 0x50], eax
je 0x4081f9
mov ecx, dword [ebp - 0x50]
call fcn.004094e0
mov dword [esp + 4], 0x348
mov eax, dword [ebp - 0x50]
mov dword [esp], eax
call fcn.004bcd60
lea eax, [ebp - 0x4c]
mov dword [esp], eax
call fcn.00414c10
mov ebx, dword [ebp - 4]
leave
ret 0x28
mov dword [esp], 0x407960
mov dword [ebp - 0x48], 1
call dword [0x4c10ac]
mov ebx, dword [ebp - 0x50]
mov dword [ebx + 0x80], eax
jmp 0x4081bd
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x10], 0
invalid
Function at 0x4096c0
Capabilities:
Read pipe
Write file on windows
Write pipe

Disassembly:
push edi
push esi
push ebx
mov ebx, ecx
sub esp, 0xb0
mov edi, dword [ecx + 0x24]
mov esi, dword [esp + 0xc0]
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [esp + 0x30], eax
lea eax, [ebx + 0x38]
mov edx, dword [ebx + 0x20]
mov dword [esp + 0x34], edi
lea edi, [esp + 0x28]
mov dword [esp + 0x2c], 1
mov dword [esp + 0x38], eax
lea eax, [ebx + 0x3c]
mov dword [esp + 0x4c], 0
mov dword [esp + 0x48], edx
mov dword [esp + 0x50], 0
mov dword [esp + 0x3c], eax
lea eax, [ebx + 0x40]
mov dword [esp + 0x54], 0
mov dword [esp + 0x58], 0
mov dword [esp + 0x5c], 0
mov dword [esp + 0x40], eax
mov eax, dword [ebx + 0x1c]
mov dword [esp + 0x60], 0
mov dword [esp + 0x64], 0
mov dword [esp + 0x68], 0
mov dword [esp + 0x6c], 0
mov dword [esp + 0x44], eax
lea eax, [esp + 0x58]
mov dword [esp + 0x70], 0
mov dword [esp + 0x74], 0
mov dword [esp + 0x78], 0
mov dword [esp + 0xc], eax
lea eax, [esp + 0x2c]
mov dword [esp + 0x7c], 0
mov dword [esp + 0x80], 0
mov dword [esp + 0x28], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], edi
mov dword [esp + 0x10], 0x2c
mov dword [esp + 8], 0x2c
mov dword [esp + 4], eax
mov dword [esp], esi
call dword [sym.imp.KERNEL32.dll_TransactNamedPipe]
sub esp, 0x1c
test eax, eax
je 0x4097d0
cmp dword [esp + 0x58], 2
je 0x4097e0
add esp, 0xb0
xor eax, eax
pop ebx
pop esi
pop edi
ret 4
mov eax, dword [esp + 0x5c]
test eax, eax
je 0x4097d0
mov ecx, dword [esp + 0x78]
test ecx, ecx
je 0x4097d0
mov edx, dword [esp + 0x7c]
test edx, edx
je 0x4097d0
mov eax, dword [esp + 0x80]
test eax, eax
je 0x4097d0
lea eax, [esp + 0x84]
mov dword [esp + 0x88], 0
mov dword [esp + 0x8c], 0
mov dword [esp + 0x90], 0
mov dword [esp + 0x94], 0
mov dword [esp + 0x98], 0
mov dword [esp + 0x9c], 0
mov dword [esp + 0xa0], 0
mov dword [esp + 0xa4], 0
mov dword [esp + 0xa8], 0
mov dword [esp + 0xac], 0
mov dword [esp + 0x84], 3
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], edi
mov dword [esp + 8], 0x2c
mov dword [esp + 4], eax
mov dword [esp], esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
sub esp, 0x14
test eax, eax
je 0x4097d0
mov eax, dword [esp + 0x78]
mov dword [ebx + 0x28], eax
mov eax, dword [esp + 0x7c]
mov dword [ebx + 0x2c], eax
mov eax, dword [esp + 0x80]
mov dword [ebx + 0x30], eax
mov eax, dword [esp + 0x5c]
mov dword [ebx + 0x34], eax
add esp, 0xb0
mov eax, 1
pop ebx
pop esi
pop edi
ret 4

Function at 0x4135c0
Capabilities:
Write file on windows

Disassembly:
push ebx
sub esp, 0x18
mov eax, dword [sym.imp.msvcrt.dll__iob]
mov dword [esp + 8], 0x1b
mov dword [esp + 4], 1
lea ebx, [esp + 0x24]
mov dword [esp], str.Mingw_w64_runtime_failure:_n
add eax, 0x40
mov dword [esp + 0xc], eax
call sub.msvcrt.dll_fwrite
mov eax, dword [esp + 0x20]
mov dword [esp + 8], ebx
mov dword [esp + 4], eax
mov eax, dword [sym.imp.msvcrt.dll__iob]
add eax, 0x40
mov dword [esp], eax
call sub.msvcrt.dll_vfprintf
call sub.msvcrt.dll_abort
jmp fcn.00413620
Function at 0x413620
Capabilities:
Allocate or change rwx memory

Disassembly:
push edi
push esi
push ebx
sub esp, 0x30
mov esi, dword [0x4d05e0]
test esi, esi
jle 0x413713
mov edi, dword [0x4d05e4]
xor ebx, ebx
lea edx, [edi + 0xc]
nop
mov ecx, dword [edx]
cmp ecx, eax
ja 0x413654
mov edi, dword [edx + 4]
add ecx, dword [edi + 8]
cmp eax, ecx
jb 0x41370c
add ebx, 1
add edx, 0x14
cmp ebx, esi
jne 0x413640
mov dword [esp], eax
mov esi, eax
call fcn.00413f10
test eax, eax
mov edi, eax
je 0x413750
mov esi, dword [0x4d05e4]
lea ebx, [ebx + ebx*4]
shl ebx, 2
add esi, ebx
mov dword [esi + 0x10], eax
mov dword [esi], 0
call fcn.00414020
add eax, dword [edi + 0xc]
mov dword [esi + 0xc], eax
lea eax, [esp + 0x14]
mov dword [esp + 8], 0x1c
mov dword [esp + 4], eax
mov eax, dword [0x4d05e4]
mov eax, dword [eax + ebx + 0xc]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
sub esp, 0xc
test eax, eax
je 0x413730
mov eax, dword [esp + 0x28]
lea edx, [eax - 0x40]
and edx, 0xffffffbf
je 0x413705
sub eax, 4
and eax, 0xfffffffb
je 0x413705
add ebx, dword [0x4d05e4]
mov eax, dword [esp + 0x14]
mov edx, dword [esp + 0x20]
mov dword [ebx + 4], eax
mov dword [ebx + 8], edx
mov dword [esp + 0xc], ebx
mov dword [esp + 8], 0x40
mov dword [esp + 4], edx
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
sub esp, 0x10
test eax, eax
je 0x41371a
add dword [0x4d05e0], 1
add esp, 0x30
pop ebx
pop esi
pop edi
ret
xor ebx, ebx
jmp 0x41365e
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp], str.__VirtualProtect_failed_with_code_0x_x
mov dword [esp + 4], eax
call fcn.004135c0
mov eax, dword [0x4d05e4]
mov eax, dword [eax + ebx + 0xc]
mov dword [esp + 8], eax
mov eax, dword [edi + 8]
mov dword [esp], str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov dword [esp + 4], eax
call fcn.004135c0
mov dword [esp + 4], esi
mov dword [esp], str.Address__p_has_no_image_section
call fcn.004135c0

Function at 0x413b90
Capabilities:
Get thread local storage value

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x1c
mov dword [esp], 0x4d05f8
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov ebx, dword [0x4d05f0]
sub esp, 4
mov ebp, dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
test ebx, ebx
je 0x413be5
lea esi, [esi]
mov eax, dword [ebx]
mov dword [esp], eax
call ebp
sub esp, 4
mov esi, eax
call edi
test eax, eax
jne 0x413bde
test esi, esi
je 0x413bde
mov eax, dword [ebx + 4]
mov dword [esp], esi
call eax
mov ebx, dword [ebx + 8]
test ebx, ebx
jne 0x413bc0
mov dword [esp], 0x4d05f8
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
sub esp, 4
add esp, 0x1c
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x414640
Capabilities:
Encode data using xor

Disassembly:
xor esi, 0x3946443c
xor dword [0x4c26af], 0x1b6acc1c
not edx
inc esi
shr esi, 0x1a
xor esi, edx
xor eax, 0x1edee7ab
mov ecx, 0x812040
call fcn.00407d63
xchg eax, eax
inc esi
ror eax, 0xe
inc esi
sub dword [0x4c251e], ecx
sub dword [0x4c2238], 0x668b10a
neg edx
mov dword [0x4c2854], 0x378bf09c
shl esi, 0x1c
loop 0x414603
mov ecx, 0x29f866
xchg eax, eax
inc esi
mov edx, dword [0x4c2154]
shr eax, 9
or eax, ebp
sbb dword [esi - 1], ebx
dec dword [ebx + 0x42]
call fcn.0040a45f
shr eax, 0xf
dec edx
rol eax, 1
neg esi
rol esi, 0x11
neg esi
loop 0x414635
mov ecx, 0x451a6a
xchg edi, eax
neg eax
inc eax
xor esi, dword [0x4c1126]
xchg edx, esi
inc edx
xchg esi, edx
xor dword [0x4c23cf], edi
xchg edi, eax
mov dword [0x4c2321], edi
loop 0x414662
rol esi, 0x14
and eax, 0xbdaef7e
push 0
add eax, 0x605d310
rol dword [0x33f82b06], cl
cld
xor esi, eax
call fcn.0040856f
neg eax
dec eax
xor esi, eax
call fcn.0040a45f
add edi, 0x4623d6d
sub eax, eax
call fcn.00401001
call fcn.004066ba
push 0x320033
xor esi, 0x2707d94
neg eax
dec esi
sub dword [0x4c2360], 0x28c4010
and dword [0x4c25c8], ecx
xor edx, dword [0x4c1930]
invalid
invalid

Function at 0x41ad60
Capabilities:
Query environment variable

Disassembly:
push ebp
push edi
mov edi, edx
push esi
push ebx
lea ebx, [ecx - 1]
mov ecx, 0x66666667
sub esp, 0x2c
mov dword [esp + 0x1c], eax
mov eax, ebx
mov dword [esp + 0x10], ebx
sar eax, 0x1f
mov esi, dword [esp + 0x40]
mov dword [esp + 0x14], eax
mov eax, ebx
sar ebx, 0x1f
imul ecx
mov ecx, edx
sar ecx, 2
sub ecx, ebx
mov ebx, 1
je 0x41adb3
mov ebp, 0x66666667
mov eax, ecx
sar ecx, 0x1f
add ebx, 1
imul ebp
sar edx, 2
sub edx, ecx
mov ecx, edx
jne 0x41ada0
mov edx, dword [esi + 0x28]
cmp edx, 0xffffffff
je 0x41ae30
mov ecx, dword [esi + 8]
cmp ebx, edx
cmovl ebx, edx
lea edx, [ebx + 2]
mov eax, ecx
sub eax, edx
cmp ecx, edx
mov edx, 0xffffffff
cmovle eax, edx
mov ecx, 1
mov edx, edi
mov dword [esi + 8], eax
mov eax, dword [esp + 0x1c]
add ebx, 1
mov dword [esp], esi
call fcn.0041a620
mov eax, dword [esi + 0x28]
mov dword [esi + 0xc], eax
mov eax, dword [esi + 4]
mov edx, eax
and eax, 0x20
or edx, 0x1c0
or eax, 0x45
mov dword [esi + 4], edx
mov edx, esi
call fcn.0041a1d0
add dword [esi + 8], ebx
mov eax, dword [esp + 0x10]
mov ecx, esi
mov edx, dword [esp + 0x14]
add esp, 0x2c
pop ebx
pop esi
pop edi
pop ebp
jmp fcn.0041aa60
mov eax, dword [0x4c1060]
cmp eax, 0xffffffff
je 0x41ae5b
test eax, eax
je 0x41ae4b
mov edx, 2
mov dword [esi + 0x28], edx
jmp 0x41adbb
call fcn.004221e0
test al, 1
mov edx, 3
jne 0x41ae3e
jmp 0x41ae43
mov dword [esp], 0x4c7c47
call sub.msvcrt.dll_getenv
test eax, eax
je 0x41ae81
movsx eax, byte [eax]
sub eax, 0x30
cmp eax, 2
setbe al
movzx eax, al
mov dword [0x4c1060], eax
jmp 0x41ae3a
xor eax, eax
jmp 0x41ae77
Function at 0x41d0c0
Capabilities:
Query environment variable

Disassembly:
push ebp
push edi
mov edi, edx
push esi
push ebx
lea ebx, [ecx - 1]
mov ecx, 0x66666667
sub esp, 0x2c
mov dword [esp + 0x1c], eax
mov eax, ebx
mov dword [esp + 0x10], ebx
sar eax, 0x1f
mov esi, dword [esp + 0x40]
mov dword [esp + 0x14], eax
mov eax, ebx
sar ebx, 0x1f
imul ecx
mov ecx, edx
sar ecx, 2
sub ecx, ebx
mov ebx, 1
je 0x41d113
mov ebp, 0x66666667
mov eax, ecx
sar ecx, 0x1f
add ebx, 1
imul ebp
sar edx, 2
sub edx, ecx
mov ecx, edx
jne 0x41d100
mov edx, dword [esi + 0x28]
cmp edx, 0xffffffff
je 0x41d190
mov ecx, dword [esi + 8]
cmp ebx, edx
cmovl ebx, edx
lea edx, [ebx + 2]
mov eax, ecx
sub eax, edx
cmp ecx, edx
mov edx, 0xffffffff
cmovle eax, edx
mov ecx, 1
mov edx, edi
mov dword [esi + 8], eax
mov eax, dword [esp + 0x1c]
add ebx, 1
mov dword [esp], esi
call fcn.0041c810
mov eax, dword [esi + 0x28]
mov dword [esi + 0xc], eax
mov eax, dword [esi + 4]
mov edx, eax
and eax, 0x20
or edx, 0x1c0
or eax, 0x45
mov dword [esi + 4], edx
mov edx, esi
call fcn.0041c320
add dword [esi + 8], ebx
mov eax, dword [esp + 0x10]
mov ecx, esi
mov edx, dword [esp + 0x14]
add esp, 0x2c
pop ebx
pop esi
pop edi
pop ebp
jmp fcn.0041cdc0
mov eax, dword [0x4c107c]
cmp eax, 0xffffffff
je 0x41d1bb
test eax, eax
je 0x41d1ab
mov edx, 2
mov dword [esi + 0x28], edx
jmp 0x41d11b
call fcn.004221e0
test al, 1
mov edx, 3
jne 0x41d19e
jmp 0x41d1a3
mov dword [esp], str.PRINTF_EXPONENT_DIGITS
call sub.msvcrt.dll_getenv
test eax, eax
je 0x41d1e1
movsx eax, byte [eax]
sub eax, 0x30
cmp eax, 2
setbe al
movzx eax, al
mov dword [0x4c107c], eax
jmp 0x41d19a
xor eax, eax
jmp 0x41d1d7
Function at 0x479ce0
Capabilities:
Read file on windows

Disassembly:
push ebp
push edi
mov edi, ecx
push esi
push ebx
sub esp, 0x1c
mov esi, dword [esp + 0x30]
mov ebx, dword [esp + 0x34]
mov ecx, edi
call fcn.00479b60
mov dword [esp + 8], ebx
mov dword [esp + 4], esi
mov dword [esp], eax
call sub.msvcrt.dll__read
cmp eax, 0xffffffff
mov ebp, eax
je 0x479d20
add esp, 0x1c
mov eax, ebp
pop ebx
pop esi
pop edi
pop ebp
ret 8
call dword [sym.imp.msvcrt.dll__errno]
cmp dword [eax], 4
je 0x479cf1
add esp, 0x1c
mov eax, ebp
pop ebx
pop esi
pop edi
pop ebp
ret 8
Function at 0x430002
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
mov eax, section..text
nop
mov ebx, 0x408ecc
nop
mov ecx, 0x3cf31c1c
nop
nop
nop
nop
test eax, eax
nop
je 0x43004e
nop
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
inc eax
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
nop
nop
jne 0x430024
nop
mov eax, section..data
nop
mov ebx, 0x42e1d0
nop
mov ecx, 0x13a768ae
test eax, eax
nop
nop
nop
nop
nop
nop
je 0x430084
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
add eax, 4
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
nop
jne 0x43006c
nop
popal
nop
nop
nop
nop
jmp 0x401219
Function at 0x10026d30
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100a53a3
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push esi
push edi
mov eax, dword [0x100c0040]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, edx
mov dword [ebp - 0x10], ecx
push 0x448
call fcn.100a3b32
add esp, 4
mov dword [ebp - 0x14], eax
mov dword [ebp - 4], 0
lea edi, [eax + 0xc]
xorps xmm0, xmm0
mov dword [ebp - 0x1c], edi
movq qword [eax], xmm0
mov dword [eax + 8], 0
mov dword [eax + 4], 1
mov dword [eax + 8], 1
mov dword [eax], 0x100b06c0
mov eax, dword [esi]
mov dword [edi + 0xc], 0
mov dword [edi + 0x20], 0
mov dword [edi + 0x24], 0
mov dword [edi + 0x28], 0
mov dword [edi + 0x2c], 0
mov dword [edi + 0x30], 0
mov dword [edi + 0x34], 0
mov dword [edi + 0x38], 0
mov dword [edi + 0x3c], 0
mov dword [edi + 0x40], 0
mov dword [edi + 0x44], 0
mov dword [edi + 0x48], 0
mov dword [edi + 0x4c], 0
mov dword [edi + 0x50], 0
mov dword [edi + 0x54], 0
mov dword [edi + 0x58], 0
mov dword [edi + 0x5c], 0
mov dword [edi + 0x60], 0
mov dword [edi + 0x64], 0
mov dword [edi + 0x68], 0
mov dword [edi + 0x6c], 0
mov dword [edi + 0x70], 0
movups xmmword [edi + 0x80], xmm0
mov dword [edi + 0x90], 0
mov dword [edi + 0x94], 0xf
mov byte [edi + 0x80], 0
movups xmmword [edi + 0x98], xmm0
mov dword [edi + 0xa8], 0
mov dword [edi + 0xac], 0xf
mov byte [edi + 0x98], 0
mov byte [ebp - 4], 2
mov ecx, edi
mov word [edi + 0xb1], 0
mov byte [edi + 0xb3], 0
push eax
mov dword [edi + 0xb0], 0
mov dword [edi + 0x3ec], 0
mov dword [edi + 0x3f0], 0
mov dword [edi + 0x3f4], 0
mov byte [edi + 0x3f8], 0
mov dword [edi + 0x3fc], 0
mov byte [edi + 0x400], 0
mov dword [edi + 0x404], 0
mov dword [edi + 0x408], 0
mov dword [edi + 0x40c], 0
mov dword [edi + 0x410], 0
mov dword [edi + 0x414], 0
mov dword [edi + 0x418], 0
mov word [edi + 0x428], 0
call fcn.10020c40
mov ecx, dword [ebp - 0x10]
xorps xmm0, xmm0
mov eax, dword [ebp - 0x14]
movq qword [ecx], xmm0
mov dword [ecx + 4], 0
mov dword [ecx + 4], eax
mov eax, ecx
mov dword [ecx], edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x1002ed20
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x100c0040]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, ecx
cmp dword [esi + 0x38], 0
je 0x1002eddc
cmp byte [esi + 0x3d], 0
je 0x1002eddc
mov eax, dword [esi]
push edi
push 0xffffffffffffffff
call dword [eax + 0xc]
cmp eax, 0xffffffff
je 0x1002edca
mov ecx, dword [esi + 0x38]
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [esi + 0x40]
push eax
call dword [sym.imp.MSVCP140.dll_public:_int___thiscall_std::codecvt_char__char__struct__Mbstatet_::unshift_struct__Mbstatet___char___char___char___const]
sub eax, 0
je 0x1002ed91
sub eax, 1
je 0x1002ed95
sub eax, 2
jne 0x1002edca
mov byte [esi + 0x3d], al
mov al, 1
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100a3b16
mov esp, ebp
pop ebp
ret
mov byte [esi + 0x3d], 0
mov edi, dword [ebp - 0x28]
lea eax, [ebp - 0x24]
sub edi, eax
je 0x1002edb3
push dword [esi + 0x4c]
push edi
push 1
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
add esp, 0x10
cmp edi, eax
jne 0x1002edca
cmp byte [esi + 0x3d], 0
pop edi
sete al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100a3b16
mov esp, ebp
pop ebp
ret
pop edi
xor al, al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100a3b16
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
mov al, 1
xor ecx, ebp
pop esi
call fcn.100a3b16
mov esp, ebp
pop ebp
ret
Function at 0x100315f0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
cmp byte [0x100d01bc], 0
push ebx
push esi
push edi
je 0x1003177e
mov ecx, dword [0x100fe5c8]
mov eax, dword [ecx]
mov eax, dword [eax + 0x68]
call eax
test al, al
je 0x1003177e
mov ecx, dword [0x100fe64c]
xor ebx, ebx
mov dword [ebp - 4], ecx
mov eax, dword [ecx + 0x28]
mov dword [ebp - 8], eax
test eax, eax
je 0x1003177e
mov eax, dword [ecx + 0x1c]
mov ecx, dword [eax + ebx*4]
mov eax, dword [ecx]
mov eax, dword [eax + 0x30]
call eax
mov esi, eax
mov edi, 0x811c9dc5
xor ecx, ecx
nop word [eax + eax]
inc ecx
cmp byte [ecx + esi], 0
jne 0x10031650
xor edx, edx
test ecx, ecx
je 0x10031679
nop dword [eax]
movsx eax, byte [edx + esi]
inc edx
xor eax, edi
imul edi, eax, 0x1000193
cmp edx, ecx
jb 0x10031660
cmp edi, 0x5ff56dc5
je 0x10031688
inc ebx
cmp ebx, dword [ebp - 8]
jae 0x1003177e
mov ecx, dword [ebp - 4]
jmp 0x10031634
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x1c]
mov edi, dword [eax + ebx*4]
test edi, edi
je 0x1003177e
mov edx, dword [edi + 0x88]
test edx, edx
je 0x1003177e
movss xmm1, dword [0x100b62a8]
xor ebx, ebx
cmp edx, 4
jl 0x1003174b
mov ecx, dword [edi + 0x7c]
lea esi, [edx - 4]
shr esi, 2
add ecx, 0x1078
inc esi
lea ebx, [esi*4]
movss xmm0, dword [ecx - 0xc60]
ucomiss xmm0, xmm1
lahf
test ah, 0x44
jp 0x100316ec
mov dword [ecx - 0xc60], 0x7f7fffff
movss xmm0, dword [ecx - 0x840]
ucomiss xmm0, xmm1
lahf
test ah, 0x44
jp 0x10031707
mov dword [ecx - 0x840], 0x7f7fffff
movss xmm0, dword [ecx - 0x420]
ucomiss xmm0, xmm1
lahf
test ah, 0x44
jp 0x10031722
mov dword [ecx - 0x420], 0x7f7fffff
movss xmm0, dword [ecx]
ucomiss xmm0, xmm1
lahf
test ah, 0x44
jp 0x10031735
mov dword [ecx], 0x7f7fffff
add ecx, 0x1080
sub esi, 1
jne 0x100316d1
cmp ebx, edx
jl 0x1003174f
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
test edx, edx
jle 0x1003177e
imul ecx, ebx, 0x420
add ecx, 0x418
add ecx, dword [edi + 0x7c]
sub edx, ebx
movss xmm0, dword [ecx]
ucomiss xmm0, xmm1
lahf
test ah, 0x44
jp 0x10031773
mov dword [ecx], 0x7f7fffff
add ecx, 0x420
sub edx, 1
jne 0x10031760
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x100336f0
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100a5b55
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push ebx
push esi
push edi
mov eax, dword [0x100c0040]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, dword [ebp + 8]
movzx eax, byte [edi]
xor eax, 0x811c9dc5
imul ecx, eax, 0x1000193
movzx eax, byte [edi + 1]
xor ecx, eax
movzx eax, byte [edi + 2]
imul ecx, ecx, 0x1000193
xor ecx, eax
movzx eax, byte [edi + 3]
imul ecx, ecx, 0x1000193
xor ecx, eax
lea eax, [ebp - 0x14]
imul ebx, ecx, 0x1000193
push ebx
push edi
push eax
call fcn.10034f60
mov esi, dword [ebp - 0x10]
test esi, esi
jne 0x10033860
cmp dword [0x10103d40], 0xfffffff
jne 0x1003377a
push str.unordered_map_set_too_long
call dword [sym.imp.MSVCP140.dll_void___cdecl_std::_Xlength_error_char_const__]
mov dword [ebp - 0x1c], 0x10103d3c
mov dword [ebp - 4], 0
push 0x10
mov dword [ebp - 0x18], 0
call fcn.100a3b32
mov ecx, dword [edi]
mov esi, eax
add esp, 4
mov dword [ebp - 0x18], esi
mov dword [esi + 8], ecx
mov dword [esi + 0xc], 0
mov dword [ebp - 4], 1
mov ecx, dword [0x10103d40]
lea eax, [ecx + 1]
movd xmm0, eax
cvtdq2pd xmm0, xmm0
shr eax, 0x1f
addsd xmm0, qword [eax*8 + 0x100b6550]
mov eax, dword [0x10103d54]
cvtpd2ps xmm1, xmm0
movd xmm0, eax
cvtdq2pd xmm0, xmm0
shr eax, 0x1f
addsd xmm0, qword [eax*8 + 0x100b6550]
cvtpd2ps xmm0, xmm0
divss xmm1, xmm0
comiss xmm1, dword [0x10103d38]
jbe 0x10033819
call fcn.10034d70
push ebx
lea eax, [esi + 8]
push eax
lea eax, [ebp - 0x1c]
push eax
call fcn.10034f60
mov ecx, dword [0x10103d40]
mov edx, dword [eax]
jmp 0x1003381c
mov edx, dword [ebp - 0x14]
mov edi, dword [edx + 4]
inc ecx
mov dword [0x10103d40], ecx
mov dword [esi], edx
mov dword [esi + 4], edi
mov dword [edi], esi
mov dword [edx + 4], esi
mov eax, dword [0x10103d50]
mov ecx, dword [0x10103d44]
and eax, ebx
mov ebx, dword [ecx + eax*8]
cmp ebx, dword [0x10103d3c]
jne 0x1003384d
mov dword [ecx + eax*8], esi
jmp 0x1003385c
cmp ebx, edx
jne 0x10033856
mov dword [ecx + eax*8], esi
jmp 0x10033860
cmp dword [ecx + eax*8 + 4], edi
jne 0x10033860
mov dword [ecx + eax*8 + 4], esi
lea eax, [esi + 0xc]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4