joyce8/EMBER2024-capa huggingface dataset:
Function at 0x408470
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov edx, dword [ebp + 8]
mov eax, closesocket
push ebx
mov ebx, dword [ebp + 0xc]
cmp ebx, eax
push esi
push edi
mov edi, ecx
mov dword [ebp - 4], edx
cmova ebx, eax
mov dword [ebp - 0x10], edi
mov dword [ebp + 0xc], ebx
mov eax, dword [edi + 0x34]
mov esi, dword [edi + 0x38]
cmp eax, esi
jae 0x4084dd
mov ecx, dword [edi + 0x28]
sub esi, eax
cmp ebx, esi
ja 0x4084c2
push ebx
add eax, ecx
push eax
push edx
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
mov eax, ebx
add dword [edi + 0x34], ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
push esi
add ecx, eax
push ecx
push edx
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
mov eax, esi
add dword [edi + 0x34], esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
mov eax, dword [edi]
mov eax, dword [eax + 4]
call eax
test al, al
jne 0x4084f4
pop edi
pop esi
or eax, 0xffffffff
pop ebx
mov esp, ebp
pop ebp
ret 8
mov eax, dword [edi + 4]
mov dword [edi + 0x34], 0
mov dword [edi + 0x38], 0
mov dword [ebp - 8], eax
cmp ebx, 0x1000
jae 0x408580
mov eax, dword [edi + 0x28]
mov edi, eax
mov ebx, dword [ebp - 8]
push 0
push 0x1000
push edi
push ebx
call dword [sym.imp.WS2_32.dll_recv]
mov esi, eax
test esi, esi
jns 0x40853a
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
cmp dword [eax], 4
je 0x408518
test esi, esi
mov edi, dword [ebp - 0x10]
mov ebx, dword [ebp + 0xc]
jle 0x4085a2
mov eax, dword [edi + 0x28]
cmp esi, ebx
jg 0x408562
mov edi, dword [ebp - 4]
push esi
push eax
push edi
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
mov eax, esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
push ebx
push eax
push dword [ebp - 4]
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
mov dword [edi + 0x34], ebx
mov dword [edi + 0x38], esi
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
mov edi, dword [ebp - 4]
push 0
push ebx
push edi
push eax
call dword [sym.imp.WS2_32.dll_recv]
mov esi, eax
test esi, esi
jns 0x4085a2
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
cmp dword [eax], 4
mov eax, dword [ebp - 8]
je 0x408583
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x408680
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x90
mov eax, dword [0x44b00c]
xor eax, esp
mov dword [esp + 0x8c], eax
push esi
mov esi, dword [ebp + 8]
lea eax, [esp + 8]
push edi
mov edi, dword [ebp + 0xc]
push eax
lea eax, [esp + 0x14]
mov dword [esp + 0x10], 0x80
push eax
push dword [ecx + 4]
call dword [sym.imp.WS2_32.dll_getsockname]
test eax, eax
jne 0x4086d3
mov edx, dword [esp + 0xc]
lea ecx, [esp + 0x10]
push edi
push esi
call fcn.00403c10
add esp, 8
mov ecx, dword [esp + 0x94]
pop edi
pop esi
xor ecx, esp
call fcn.0043827f
mov esp, ebp
pop ebp
ret 8
Function at 0x408850
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x43a0be
mov eax, dword fs:[0]
push eax
sub esp, 8
push esi
push edi
mov eax, dword [0x44b00c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x10], edi
mov dword [edi], 0
mov dword [edi + 0x10], 0
mov dword [edi + 0x14], 0
mov dword [edi + 0x10], 0
mov dword [edi + 0x14], 0xf
mov byte [edi], 0
mov dword [ebp - 4], 0
mov dword [edi + 0x18], 0
mov dword [edi + 0x28], 0
mov dword [edi + 0x2c], 0xf
mov byte [edi + 0x18], 0
lea esi, [edi + 0x30]
mov byte [ebp - 4], 1
push 0x40
mov dword [ebp - 0x14], esi
mov dword [esi], 0
mov dword [esi + 4], 0
call fcn.00438496
mov dword [eax], eax
mov dword [eax + 4], eax
mov dword [eax + 8], eax
mov word [eax + 0xc], 0x101
mov dword [esi], eax
mov dword [edi + 0x38], 0
mov dword [edi + 0x48], 0
mov dword [edi + 0x4c], 0xf
mov byte [edi + 0x38], 0
mov dword [edi + 0x50], 0
mov dword [edi + 0x60], 0
mov dword [edi + 0x64], 0xf
mov byte [edi + 0x50], 0
mov dword [edi + 0x68], 0xffffffff
mov dword [edi + 0x6c], 0
mov dword [edi + 0x7c], 0
mov dword [edi + 0x80], 0xf
mov byte [edi + 0x6c], 0
mov dword [edi + 0x84], 0xffffffff
mov dword [edi + 0x88], 0
mov dword [edi + 0x98], 0
mov dword [edi + 0x9c], 0xf
mov byte [edi + 0x88], 0
mov dword [edi + 0xa0], 0
mov dword [edi + 0xb0], 0
mov dword [edi + 0xb4], 0xf
mov byte [edi + 0xa0], 0
lea esi, [edi + 0xb8]
mov byte [ebp - 4], 7
push 0x40
mov dword [ebp - 0x14], esi
mov dword [esi], 0
mov dword [esi + 4], 0
call fcn.00438496
mov dword [eax], eax
mov dword [eax + 4], eax
mov dword [eax + 8], eax
mov word [eax + 0xc], 0x101
mov dword [esi], eax
lea esi, [edi + 0xc0]
mov byte [ebp - 4], 8
push 0x88
mov dword [ebp - 0x14], esi
mov dword [esi], 0
mov dword [esi + 4], 0
call fcn.00438496
add esp, 0xc
mov dword [eax], eax
mov dword [eax + 4], eax
mov dword [eax + 8], eax
mov word [eax + 0xc], 0x101
mov dword [esi], eax
mov dword [edi + 0xc8], 0
mov dword [edi + 0xcc], 0
mov dword [edi + 0xd0], 0
mov eax, edi
mov dword [edi + 0xd4], 0
mov byte [edi + 0xd8], 0
mov dword [edi + 0xdc], 0
mov dword [edi + 0xe0], 0
mov dword [edi + 0xe4], 0
mov dword [edi + 0xe8], 0
mov dword [edi + 0xec], 0
mov byte [edi + 0xf0], 0
mov dword [edi + 0xf4], 0
mov dword [edi + 0xf8], 0
mov byte [edi + 0xfc], 0
mov dword [edi + 0x100], 0
mov dword [edi + 0x104], 0
mov byte [edi + 0x108], 0
mov dword [edi + 0x134], 0
mov dword [edi + 0x15c], 0
mov dword [edi + 0x184], 0
mov dword [edi + 0x188], 0
mov dword [edi + 0x18c], 0x14
mov dword [edi + 0x190], 0
mov dword [edi + 0x1bc], 0
mov byte [edi + 0x1c0], 0
mov dword [edi + 0x1c4], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x408b10
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x43a0f8
mov eax, dword fs:[0]
push eax
sub esp, 8
push esi
push edi
mov eax, dword [0x44b00c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x10], edi
mov dword [edi], 0
mov dword [edi + 0x10], 0
mov dword [edi + 0x14], 0
mov dword [edi + 0x10], 0
mov dword [edi + 0x14], 0xf
mov byte [edi], 0
mov dword [ebp - 4], 0
mov dword [edi + 0x18], 0xffffffff
mov dword [edi + 0x1c], 0
mov dword [edi + 0x2c], 0
mov dword [edi + 0x30], 0xf
mov byte [edi + 0x1c], 0
lea esi, [edi + 0x34]
mov byte [ebp - 4], 1
push 0x40
mov dword [ebp - 0x14], esi
mov dword [esi], 0
mov dword [esi + 4], 0
call fcn.00438496
add esp, 4
mov dword [eax], eax
mov dword [eax + 4], eax
mov dword [eax + 8], eax
mov word [eax + 0xc], 0x101
mov dword [esi], eax
mov eax, edi
mov dword [edi + 0x3c], 0
mov dword [edi + 0x4c], 0
mov dword [edi + 0x50], 0xf
mov byte [edi + 0x3c], 0
mov dword [edi + 0x54], 0
mov dword [edi + 0x64], 0
mov dword [edi + 0x68], 0xf
mov byte [edi + 0x54], 0
mov dword [edi + 0x6c], 0
mov dword [edi + 0x94], 0
mov dword [edi + 0xbc], 0
mov word [edi + 0xc0], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x40f670
Capabilities:
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [0x44b00c]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push ebx
push esi
mov esi, dword [ecx + 0x2e0]
lea ebx, [ecx + 0x2e4]
push edi
mov edi, dword [ebp + 8]
mov dword [ebp - 0x14], eax
push ebx
mov dword [ebp - 8], ecx
mov eax, dword [edi]
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x10], edi
mov dword [ebp - 0x1c], eax
call dword [sym.imp.MSVCP140.dll__Mtx_lock]
add esp, 4
test eax, eax
je 0x40f6bb
push eax
call dword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_C_error_int_]
push esi
call dword [sym.imp.libssl_1_1.dll_SSL_new]
push ebx
mov esi, eax
call dword [sym.imp.MSVCP140.dll__Mtx_unlock]
add esp, 8
test esi, esi
je 0x40f7ce
lea eax, [ebp - 0xc]
mov dword [ebp - 0xc], 1
push eax
push 0x8004667e
push dword [ebp - 0x1c]
call dword [sym.imp.WS2_32.dll_ioctlsocket]
push 0
push dword [ebp - 0x1c]
call dword [sym.imp.libcrypto_1_1.dll_BIO_new_socket]
push 0
push 1
push 0x66
push eax
mov dword [ebp - 0xc], eax
call dword [sym.imp.libcrypto_1_1.dll_BIO_ctrl]
mov eax, dword [ebp - 0xc]
push eax
push eax
push esi
call dword [sym.imp.libssl_1_1.dll_SSL_set_bio]
mov eax, dword [ebp - 8]
add esp, 0x24
add eax, 8
cmp dword [eax + 0x14], 0x10
jb 0x40f727
mov eax, dword [eax]
push eax
push 0
push 0x37
push esi
call dword [sym.imp.libssl_1_1.dll_SSL_ctrl]
add esp, 0x10
lea ecx, [ebp - 0x18]
push esi
call fcn.0040f810
cmp al, 1
jne 0x40f787
push 0
push 0
push 0x66
push dword [ebp - 0xc]
call dword [sym.imp.libcrypto_1_1.dll_BIO_ctrl]
add esp, 0x10
mov dword [ebp - 8], 0
lea eax, [ebp - 8]
push eax
mov eax, dword [sym.imp.WS2_32.dll_ioctlsocket]
push 0x8004667e
push dword [ebp - 0x1c]
call eax
mov dword [edi + 4], esi
mov al, 1
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0043827f
mov esp, ebp
pop ebp
ret 8
push esi
call dword [sym.imp.libssl_1_1.dll_SSL_shutdown]
push ebx
call dword [sym.imp.MSVCP140.dll__Mtx_lock]
add esp, 8
test eax, eax
je 0x40f7a3
push eax
call dword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_C_error_int_]
push esi
call dword [sym.imp.libssl_1_1.dll_SSL_free]
push ebx
call dword [sym.imp.MSVCP140.dll__Mtx_unlock]
add esp, 8
mov dword [ebp - 8], 0
lea eax, [ebp - 8]
push eax
mov eax, dword [sym.imp.WS2_32.dll_ioctlsocket]
push 0x8004667e
push dword [ebp - 0x1c]
call eax
mov eax, dword [edi]
cmp eax, 0xffffffff
je 0x40f7de
push 2
push eax
call dword [sym.imp.WS2_32.dll_shutdown]
mov eax, dword [edi]
cmp eax, 0xffffffff
je 0x40f7f2
push eax
call dword [sym.imp.WS2_32.dll_closesocket]
mov dword [edi], 0xffffffff
mov ecx, dword [ebp - 4]
xor al, al
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0043827f
mov esp, ebp
pop ebp
ret 8
Function at 0x4117b0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x43aeda
mov eax, dword fs:[0]
push eax
sub esp, 8
push esi
push edi
mov eax, dword [0x44b00c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
mov dword [ebp - 0x14], esi
mov dword [ebp - 4], 1
mov dword [esi], 0
push 0x68
mov dword [ebp - 0x10], esi
mov dword [esi + 4], 0
mov dword [esi + 8], 0
call fcn.00438496
add esp, 4
mov dword [eax], eax
mov dword [eax + 4], eax
mov dword [esi + 4], eax
lea ecx, [esi + 0xc]
mov dword [ecx], 0
mov dword [ecx + 4], 0
mov dword [ecx + 8], 0
mov byte [ebp - 4], 3
push dword [esi + 4]
mov dword [esi + 0x18], 7
push 0x10
mov dword [esi + 0x1c], 8
mov dword [esi], 0x3f800000
call fcn.0041dde0
mov dword [esi + 0x20], 0
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x2c], 0
mov dword [esi + 0x30], 0
mov dword [esi + 0x34], 0
lea ecx, [esi + 0x38]
mov byte [ebp - 4], 6
push 4
push str.None
mov dword [ecx], 0
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 0
call fcn.00422ee0
lea ecx, [esi + 0x58]
mov dword [esi + 0x50], 0
call fcn.004018e0
lea ecx, [esi + 0x60]
mov dword [ecx], 0
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 0xf
mov byte [ecx], 0
lea edi, [esi + 0x78]
mov dword [edi], 0
mov dword [edi + 0x10], 0
mov dword [edi + 0x14], 0xf
mov byte [edi], 0
lea eax, [ebp + 8]
mov byte [ebp - 4], 9
cmp ecx, eax
je 0x4118f8
cmp dword [ebp + 0x1c], 0x10
push dword [ebp + 0x18]
cmovae eax, dword [ebp + 8]
push eax
call fcn.0041c980
lea eax, [ebp + 0x20]
cmp edi, eax
je 0x411912
cmp dword [ebp + 0x34], 0x10
mov ecx, edi
push dword [ebp + 0x30]
cmovae eax, dword [ebp + 0x20]
push eax
call fcn.0041c980
mov ecx, dword [ebp + 0x1c]
mov eax, dword [ebp + 0x38]
mov dword [esi + 0x90], eax
cmp ecx, 0x10
jb 0x41194b
mov edx, dword [ebp + 8]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x411941
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x411983
push ecx
push edx
call fcn.0043882c
add esp, 8
mov ecx, dword [ebp + 0x34]
mov dword [ebp + 0x18], 0
mov dword [ebp + 0x1c], 0xf
mov byte [ebp + 8], 0
cmp ecx, 0x10
jb 0x411993
mov edx, dword [ebp + 0x20]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x411989
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x411989
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push ecx
push edx
call fcn.0043882c
add esp, 8
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 0x34
Function at 0x419ad0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov edx, dword [ebp + 8]
push ebx
push esi
push edi
cmp dword [edx + 0x14], 0x10
mov esi, edx
mov dword [ebp - 4], ecx
jb 0x419ae9
mov esi, dword [edx]
mov ebx, dword [edx + 0x10]
xor ecx, ecx
mov edi, 0x811c9dc5
test ebx, ebx
je 0x419b08
movzx eax, byte [ecx + esi]
inc ecx
xor eax, edi
imul edi, eax, 0x1000193
cmp ecx, ebx
jb 0x419af7
mov ebx, dword [ebp - 4]
lea eax, [ebp - 0xc]
push edi
push edx
push eax
mov ecx, ebx
call fcn.00422160
mov esi, dword [eax + 4]
test esi, esi
je 0x419b80
mov ecx, dword [ebx + 0x18]
mov eax, dword [ebx + 0xc]
and ecx, edi
lea ecx, [eax + ecx*8]
mov eax, dword [ecx]
cmp dword [ecx + 4], esi
jne 0x419b47
cmp eax, esi
jne 0x419b3f
mov eax, dword [ebx + 4]
mov dword [ecx], eax
mov dword [ecx + 4], eax
jmp 0x419b4f
mov eax, dword [esi + 4]
mov dword [ecx + 4], eax
jmp 0x419b4f
cmp eax, esi
jne 0x419b4f
mov eax, dword [esi]
mov dword [ecx], eax
mov ecx, dword [esi]
dec dword [ebx + 8]
mov eax, dword [esi + 4]
mov dword [eax], ecx
mov eax, dword [esi + 4]
mov dword [ecx + 4], eax
lea ecx, [esi + 8]
call fcn.00406f90
push 0x38
push esi
call fcn.0043882c
add esp, 8
mov eax, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x41a920
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x1c
push ebx
mov ebx, ecx
push esi
push edi
cmp dword [ebx + 0x38], 0
je 0x41a94c
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____thiscall_std::basic_streambuf_char__struct_std::char_traits_char__::xsputn_char_const___long_long___int64__]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov eax, dword [ebx + 0x20]
mov esi, dword [ebp + 0xc]
mov edi, dword [ebp + 0x10]
mov dword [esp + 0x20], esi
mov ecx, dword [eax]
lea eax, [ebx + 0x30]
mov dword [esp + 0x24], edi
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x18], eax
test ecx, ecx
je 0x41a974
mov eax, dword [eax]
mov ecx, dword [eax]
jmp 0x41a97a
xor ecx, ecx
mov dword [esp + 0x18], eax
mov eax, ecx
cdq
mov dword [esp + 0x10], eax
mov ecx, edx
mov dword [esp + 0x14], ecx
test edi, edi
jl 0x41a9e2
jg 0x41a991
test esi, esi
je 0x41a9e2
test ecx, ecx
jl 0x41a9dd
jg 0x41a99b
test eax, eax
je 0x41a9dd
cmp edi, ecx
jg 0x41a9af
jl 0x41a9a5
cmp esi, eax
jae 0x41a9af
mov eax, esi
mov dword [esp + 0x10], esi
mov dword [esp + 0x14], edi
push eax
push dword [ebp + 8]
push dword [esp + 0x24]
call sub.VCRUNTIME140.dll_memcpy
mov eax, dword [esp + 0x24]
add esp, 0xc
mov edx, dword [esp + 0x10]
mov ecx, dword [ebp + 8]
add ecx, edx
sub esi, edx
mov eax, dword [eax]
sbb edi, dword [esp + 0x14]
sub dword [eax], edx
mov eax, dword [ebx + 0x20]
add dword [eax], edx
jmp 0x41a9e5
mov ecx, dword [ebp + 8]
jmp 0x41a9ef
mov ecx, dword [ebp + 8]
test edi, edi
jl 0x41aa09
jg 0x41a9ef
test esi, esi
je 0x41aa09
mov eax, dword [ebx + 0x4c]
test eax, eax
je 0x41aa09
push eax
push esi
push 1
push ecx
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
add esp, 0x10
sub esi, eax
sbb edi, 0
mov eax, dword [esp + 0x20]
mov edx, dword [esp + 0x24]
sub eax, esi
sbb edx, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x41aa20
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [ebp + 0x10]
push ebx
mov ebx, ecx
mov ecx, dword [ebp + 0xc]
push esi
mov esi, dword [ebp + 8]
mov dword [ebp - 4], esi
test eax, eax
jg 0x41aa4c
jl 0x41aa40
test ecx, ecx
jne 0x41aa4c
pop esi
xor eax, eax
xor edx, edx
pop ebx
mov esp, ebp
pop ebp
ret 0xc
cmp dword [ebx + 0x38], 0
je 0x41aa65
push eax
push ecx
push esi
mov ecx, ebx
call dword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____thiscall_std::basic_streambuf_char__struct_std::char_traits_char__::xsgetn_char___long_long___int64__]
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov eax, dword [ebx + 0x1c]
push edi
mov edi, ecx
mov eax, dword [eax]
mov dword [ebp - 8], eax
test eax, eax
je 0x41aab3
mov eax, dword [ebx + 0x2c]
lea edx, [ebx + 0x2c]
mov dword [ebp - 0xc], edx
mov eax, dword [eax]
test eax, eax
je 0x41aab9
mov edi, dword [ebp - 4]
cmp eax, ecx
mov esi, ecx
cmovb esi, eax
push esi
push dword [ebp - 8]
push edi
call sub.VCRUNTIME140.dll_memcpy
mov eax, dword [ebx + 0x2c]
add edi, esi
mov dword [ebp - 4], edi
add esp, 0xc
mov edi, dword [ebp + 0xc]
sub edi, esi
sub dword [eax], esi
mov eax, dword [ebx + 0x1c]
add dword [eax], esi
mov esi, dword [ebp - 4]
jmp 0x41aab9
lea eax, [ebx + 0x2c]
mov dword [ebp - 0xc], eax
cmp dword [ebx + 0x4c], 0
je 0x41ab26
mov ecx, dword [ebx + 0xc]
lea eax, [ebx + 0x3c]
cmp dword [ecx], eax
jne 0x41aae2
mov eax, dword [ebx + 0xc]
mov edx, dword [ebx + 0x54]
mov ecx, dword [ebx + 0x50]
sub edx, ecx
mov dword [eax], ecx
mov eax, dword [ebx + 0x1c]
mov dword [eax], ecx
mov eax, dword [ebp - 0xc]
mov eax, dword [eax]
mov dword [eax], edx
mov eax, dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
cmp edi, 0xfff
jbe 0x41ab14
nop
push dword [ebx + 0x4c]
push 0xfff
push 1
push esi
call eax
add esp, 0x10
add esi, eax
sub edi, eax
cmp eax, 0xfff
jne 0x41ab26
cmp edi, eax
mov eax, dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
ja 0x41aaf0
test edi, edi
je 0x41ab26
push dword [ebx + 0x4c]
push edi
push 1
push esi
call eax
add esp, 0x10
sub edi, eax
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 0x10]
sub eax, edi
pop edi
pop esi
sbb edx, 0
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x41ae90
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
mov eax, dword [0x44b00c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, ecx
cmp ebx, 0xffffffff
jne 0x41aec0
pop esi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0043827f
mov esp, ebp
pop ebp
ret 4
mov eax, dword [esi + 0x20]
mov eax, dword [eax]
test eax, eax
je 0x41aef0
mov edx, dword [esi + 0x30]
mov edx, dword [edx]
add edx, eax
cmp eax, edx
jae 0x41aef0
call dword [sym.imp.MSVCP140.dll_protected:_char____thiscall_std::basic_streambuf_char__struct_std::char_traits_char__::_Pninc_void_]
pop esi
mov byte [eax], bl
mov eax, ebx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0043827f
mov esp, ebp
pop ebp
ret 4
cmp dword [esi + 0x4c], 0
push edi
je 0x41afc8
mov edi, dword [esi + 0xc]
lea eax, [esi + 0x3c]
cmp dword [edi], eax
jne 0x41af19
mov edx, dword [esi + 0x54]
mov ecx, dword [esi + 0x50]
sub edx, ecx
mov dword [edi], ecx
mov eax, dword [esi + 0x1c]
mov dword [eax], ecx
mov eax, dword [esi + 0x2c]
mov dword [eax], edx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x41af25
movsx eax, bl
jmp 0x41af5d
lea eax, [ebp - 0x2c]
mov byte [ebp - 0x25], bl
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x25]
push eax
lea eax, [esi + 0x40]
push eax
call dword [sym.imp.MSVCP140.dll_public:_int___thiscall_std::codecvt_char__char__struct__Mbstatet_::out_struct__Mbstatet___char_const___char_const___char_const____char___char___char___const]
sub eax, 0
je 0x41af87
sub eax, 1
je 0x41af87
sub eax, 2
jne 0x41afc8
movsx eax, byte [ebp - 0x25]
push dword [esi + 0x4c]
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
add esp, 8
or ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, ebx
pop edi
pop esi
mov eax, ecx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0043827f
mov esp, ebp
pop ebp
ret 4
mov edi, dword [ebp - 0x2c]
lea eax, [ebp - 0x24]
sub edi, eax
je 0x41afa5
push dword [esi + 0x4c]
push edi
push 1
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
add esp, 0x10
cmp edi, eax
jne 0x41afc8
lea ecx, [ebp - 0x25]
mov byte [esi + 0x3d], 1
or eax, 0xffffffff
cmp dword [ebp - 0x30], ecx
pop edi
pop esi
cmovne eax, ebx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0043827f
mov esp, ebp
pop ebp
ret 4
mov ecx, dword [ebp - 4]
or eax, 0xffffffff
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0043827f
mov esp, ebp
pop ebp
ret 4

Function at 0x41c480
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 0xc]
mov edx, 0x811c9dc5
push edi
mov edi, dword [ebp + 8]
mov ecx, 0
sub esi, edi
je 0x41c4b1
nop dword [eax]
movzx eax, byte [ecx + edi]
inc ecx
xor eax, edx
imul edx, eax, 0x1000193
cmp ecx, esi
jb 0x41c4a0
pop edi
mov eax, edx
pop esi
pop ebp
ret 8
Function at 0x41d180
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
mov dword [ebp - 0xc], ecx
cmp edx, eax
je 0x41d2f3
cmp dword [edx + 0x1c], 0x10
mov eax, dword [ecx + 4]
mov dword [ebp - 0x1c], eax
mov eax, dword [ecx + 0xc]
push ebx
mov dword [ebp - 0x18], eax
lea ebx, [edx + 8]
mov eax, dword [edx + 4]
push esi
mov dword [ebp - 0x10], eax
mov esi, edx
jb 0x41d1b9
mov ebx, dword [edx + 8]
mov eax, dword [edx + 0x18]
xor edx, edx
push edi
mov edi, 0x811c9dc5
test eax, eax
je 0x41d1e4
mov ecx, eax
nop word [eax + eax]
movzx eax, byte [edx + ebx]
inc edx
xor eax, edi
imul edi, eax, 0x1000193
cmp edx, ecx
jb 0x41d1d0
mov ecx, dword [ebp - 0xc]
mov eax, dword [ecx + 0x18]
mov ecx, dword [ebp - 0x18]
and eax, edi
lea eax, [ecx + eax*8]
mov ecx, dword [eax]
mov dword [ebp - 0x14], eax
mov eax, dword [eax + 4]
mov dword [ebp - 4], ecx
mov dword [ebp - 8], eax
nop dword [eax]
mov edi, esi
mov ebx, esi
mov esi, dword [esi]
lea ecx, [edi + 8]
call fcn.00406f90
push 0x38
push edi
call fcn.0043882c
mov edi, dword [ebp - 0xc]
add esp, 8
dec dword [edi + 8]
cmp ebx, dword [ebp - 8]
je 0x41d24d
mov eax, dword [ebp + 0xc]
cmp esi, eax
jne 0x41d200
mov ecx, dword [ebp - 4]
cmp ecx, dword [ebp + 8]
jne 0x41d2e8
mov ecx, dword [ebp - 0x14]
pop edi
mov dword [ecx], esi
mov ecx, dword [ebp - 0x10]
mov dword [ecx], esi
mov dword [esi + 4], ecx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
mov ecx, dword [ebp - 4]
cmp ecx, dword [ebp + 8]
mov ecx, dword [ebp - 0x14]
jne 0x41d25f
mov eax, dword [ebp - 0x1c]
mov dword [ecx], eax
jmp 0x41d262
mov eax, dword [ebp - 0x10]
mov dword [ecx + 4], eax
mov eax, dword [ebp + 0xc]
cmp esi, eax
je 0x41d2e8
nop dword [eax]
cmp dword [esi + 0x1c], 0x10
lea ebx, [esi + 8]
jb 0x41d27c
mov ebx, dword [esi + 8]
mov eax, dword [esi + 0x18]
xor ecx, ecx
mov dword [ebp - 8], eax
mov edx, 0x811c9dc5
test eax, eax
je 0x41d2a4
mov edi, eax
nop
movzx eax, byte [ecx + ebx]
inc ecx
xor eax, edx
imul edx, eax, 0x1000193
cmp ecx, edi
jb 0x41d290
mov edi, dword [ebp - 0xc]
mov eax, dword [edi + 0x18]
mov ecx, dword [ebp - 0x18]
and eax, edx
lea eax, [ecx + eax*8]
mov dword [ebp - 4], eax
mov eax, dword [eax + 4]
mov dword [ebp - 8], eax
mov edi, esi
mov ebx, esi
mov esi, dword [esi]
lea ecx, [edi + 8]
call fcn.00406f90
push 0x38
push edi
call fcn.0043882c
mov edi, dword [ebp - 0xc]
add esp, 8
mov eax, dword [ebp + 0xc]
dec dword [edi + 8]
cmp ebx, dword [ebp - 8]
je 0x41d2f9
cmp esi, eax
jne 0x41d2b8
mov ecx, dword [ebp - 4]
mov dword [ecx], esi
mov ecx, dword [ebp - 0x10]
pop edi
mov dword [ecx], esi
mov dword [esi + 4], ecx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
mov ecx, dword [ebp - 4]
mov edx, dword [ebp - 0x1c]
mov dword [ecx], edx
mov dword [ecx + 4], edx
cmp esi, eax
jne 0x41d270
mov ecx, dword [ebp - 0x10]
pop edi
mov dword [ecx], esi
mov dword [esi + 4], ecx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8