joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40bef0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x49bb95
mov eax, dword fs:[0]
push eax
sub esp, 0x24
push ebx
push esi
push edi
mov eax, dword [0x4c70c0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, dword [ebp + 8]
cmp ebx, dword [ebp + 0xc]
je 0x40c0e0
cmp dword [ebx + 0x14], 8
mov edx, ebx
mov edi, dword [ebx + 0x10]
jb 0x40bf31
mov edx, dword [ebx]
xor ecx, ecx
mov esi, 0x811c9dc5
add edi, edi
je 0x40bf51
lea esp, [esp]
movzx eax, byte [ecx + edx]
inc ecx
xor eax, esi
imul esi, eax, 0x1000193
cmp ecx, edi
jb 0x40bf40
push esi
push ebx
lea eax, [ebp - 0x28]
push eax
call fcn.0040e7c0
cmp dword [ebp - 0x24], 0
jne 0x40c0d1
cmp dword [0x4ca948], 0x7ffffff
je 0x40c0f4
mov dword [ebp - 0x20], 0x4ca944
mov dword [ebp - 4], 0
push 0x20
mov dword [ebp - 0x1c], 0
call fcn.00435b4c
add esp, 4
mov dword [ebp - 0x1c], eax
lea ecx, [eax + 8]
push ebx
call fcn.0040af80
mov dword [ebp - 4], 1
mov eax, dword [0x4ca948]
fld dword [0x4ca940]
add eax, 1
mov dword [ebp - 0x14], eax
fild dword [ebp - 0x14]
jns 0x40bfc4
fadd dword [0x4b6438]
fstp dword [ebp - 0x10]
fld dword [ebp - 0x10]
mov eax, dword [0x4ca95c]
fild dword [0x4ca95c]
test eax, eax
jns 0x40bfdf
fadd dword [0x4b6438]
fstp dword [ebp - 0x10]
fld dword [ebp - 0x10]
fdivr st(1)
fcomp st(2)
fnstsw ax
test ah, 0x41
jne 0x40c074
fdivrp st(1)
sub esp, 8
mov edi, dword [0x4ca95c]
fstp dword [ebp - 0x10]
fld dword [ebp - 0x10]
fstp qword [esp]
call fcn.0045a3e0
fstp dword [ebp - 0x10]
fld dword [ebp - 0x10]
add esp, 8
fnstcw word [ebp - 0xe]
movzx eax, word [ebp - 0xe]
or eax, 0xc00
mov dword [ebp - 0x14], eax
fldcw word [ebp - 0x14]
fistp qword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
fldcw word [ebp - 0xe]
cmp eax, 8
ja 0x40c03b
mov eax, 8
cmp edi, eax
jae 0x40c050
cmp edi, 0x200
jae 0x40c04e
shl edi, 3
cmp edi, eax
jae 0x40c050
mov edi, eax
push edi
call fcn.0040ddb0
mov edi, dword [ebp - 0x1c]
push esi
lea eax, [edi + 8]
push eax
lea eax, [ebp - 0x30]
push eax
call fcn.0040e7c0
mov ecx, dword [eax]
mov eax, dword [eax + 4]
mov dword [ebp - 0x28], ecx
mov dword [ebp - 0x24], eax
jmp 0x40c07e
mov ecx, dword [ebp - 0x28]
fstp st(0)
mov edi, dword [ebp - 0x1c]
fstp st(0)
mov edx, dword [ecx + 4]
inc dword [0x4ca948]
mov dword [edi], ecx
mov dword [edi + 4], edx
mov dword [edx], edi
mov dword [ecx + 4], edi
and esi, dword [0x4ca958]
mov eax, dword [0x4ca94c]
mov dword [ebp - 0x1c], 0
mov ebx, dword [eax + esi*8]
cmp ebx, dword [0x4ca944]
mov ebx, dword [ebp + 8]
jne 0x40c0b6
mov dword [eax + esi*8], edi
jmp 0x40c0c6
cmp dword [eax + esi*8], ecx
jne 0x40c0c0
mov dword [eax + esi*8], edi
jmp 0x40c0ca
cmp dword [eax + esi*8 + 4], edx
jne 0x40c0ca
mov dword [eax + esi*8 + 4], edi
mov dword [ebp - 4], 0xffffffff
add ebx, 0x18
mov dword [ebp + 8], ebx
cmp ebx, dword [ebp + 0xc]
jne 0x40bf24
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
push str.unordered_map_set_too_long
call fcn.00433ecc
int3
Function at 0x40c180
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x49bbe8
mov eax, dword fs:[0]
push eax
sub esp, 0x20
push ebx
push esi
push edi
mov eax, dword [0x4c70c0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, dword [ebp + 8]
cmp edi, dword [ebp + 0xc]
je 0x40c2cf
cmp dword [edi + 0x14], 8
mov edx, edi
mov esi, dword [edi + 0x10]
jb 0x40c1c1
mov edx, dword [edi]
xor eax, eax
mov ebx, 0x811c9dc5
add esi, esi
je 0x40c1e1
lea esp, [esp]
movzx ecx, byte [eax + edx]
inc eax
xor ecx, ebx
imul ebx, ecx, 0x1000193
cmp eax, esi
jb 0x40c1d0
push ebx
push edi
lea eax, [ebp - 0x1c]
push eax
call fcn.0040d670
cmp dword [ebp - 0x18], 0
jne 0x40c2c3
cmp dword [0x4ca968], 0x4ec4ec4
je 0x40c2e3
mov dword [ebp - 0x24], 0x4ca964
mov dword [ebp - 4], 0
push 0x34
mov dword [ebp - 0x20], 0
call fcn.00435b4c
add esp, 4
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x20], eax
lea esi, [eax + 8]
push edi
mov ecx, esi
mov dword [ebp + 8], esi
call fcn.0040af80
mov dword [esi + 0x18], 0
add esi, 0x1c
mov ecx, dword [edi + 0x28]
mov dword [ebp - 0x10], esi
mov dword [esi + 0xc], ecx
mov eax, dword [ecx]
call dword [eax + 4]
mov ecx, esi
mov byte [ebp - 4], 2
call fcn.0040b1a0
mov eax, dword [edi + 0x18]
mov dword [ebp - 0x10], eax
test eax, eax
je 0x40c26a
lock inc dword [eax + 0x20]
mov esi, dword [ebp + 8]
lea ecx, [esi + 0x18]
call fcn.0040b060
mov eax, dword [ebp - 0x10]
mov dword [esi + 0x18], eax
mov dword [ebp - 4], 3
call fcn.0040c9a0
test al, al
je 0x40c2a8
call fcn.0040c910
push ebx
push esi
lea eax, [ebp - 0x2c]
push eax
call fcn.0040d670
mov ecx, dword [eax]
mov eax, dword [eax + 4]
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 0x18], eax
jmp 0x40c2ab
mov ecx, dword [ebp - 0x1c]
push dword [ebp - 0x14]
mov dword [ebp - 0x20], 0
push ecx
push ebx
call fcn.0040ca00
mov dword [ebp - 4], 0xffffffff
add edi, 0x2c
cmp edi, dword [ebp + 0xc]
jne 0x40c1b4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
push str.unordered_map_set_too_long
call fcn.00433ecc
int3

Function at 0x40c640
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 0xc]
mov ecx, 0
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, 0x811c9dc5
sub edx, edi
sar edx, 1
add edx, edx
je 0x40c671
lea ecx, [ecx]
movzx eax, byte [ecx + edi]
inc ecx
xor eax, esi
imul esi, eax, 0x1000193
cmp ecx, edx
jb 0x40c660
pop edi
mov eax, esi
pop esi
pop ebp
ret 8
Function at 0x40d830
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
xor ecx, ecx
push esi
mov edx, 0x811c9dc5
lea esi, [eax + eax]
test esi, esi
je 0x40d862
push edi
mov edi, dword [ebp + 8]
lea esp, [esp]
movzx eax, byte [ecx + edi]
inc ecx
xor eax, edx
imul edx, eax, 0x1000193
cmp ecx, esi
jb 0x40d850
pop edi
mov eax, edx
pop esi
pop ebp
ret
Function at 0x415440
Capabilities:
Encode data using xor

Disassembly:
push esi
xor edx, edx
push ebx
mov bl, byte [ecx + edx + 4]
mov eax, dword [ecx]
add al, dl
xor al, bl
mov byte [ecx + edx + 4], al
inc edx
cmp edx, 0x25
jb 0x415444
pop ebx
mov byte [ecx + 0x29], 0
lea eax, [ecx + 4]
pop esi
ret
Function at 0x41ac80
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x49cc2f
mov eax, dword fs:[0]
push eax
sub esp, 0x18
push ebx
push esi
push edi
mov eax, dword [0x4c70c0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x20], edi
mov dword [ebp - 0x14], 0
mov dword [edi], 0x4b55e0
mov dword [edi + 0x10], 0x4b5580
mov dword [edi + 0x70], 0
mov dword [edi + 0x90], 0
mov dword [edi + 0x94], 0
mov dword [edi + 0x98], 0
mov dword [edi + 0x68], vtable.std::basic_ios_wchar_t__struct_std::char_traits_wchar_t__.0
mov dword [ebp - 4], 0
mov eax, dword [edi]
mov dword [ebp - 0x14], 1
mov eax, dword [eax + 4]
mov dword [edi + eax], vtable.std::basic_istream_wchar_t__struct_std::char_traits_wchar_t__.0
mov eax, dword [edi]
mov ecx, dword [eax + 4]
lea eax, [ecx - 0x18]
mov dword [ecx + edi - 4], eax
mov eax, dword [edi]
mov dword [edi + 8], 0
mov dword [edi + 0xc], 0
mov ebx, dword [eax + 4]
add ebx, edi
mov ecx, ebx
call fcn.004056d0
lea eax, [edi + 0x18]
mov dword [ebx + 0x3c], 0
mov dword [ebx + 0x38], eax
mov eax, dword [ebx + 0x30]
mov esi, dword [eax + 4]
mov ecx, esi
mov dword [ebp - 0x18], esi
mov eax, dword [esi]
call dword [eax + 4]
lea eax, [ebp - 0x1c]
mov dword [ebp - 4], 3
push eax
call fcn.0040a060
add esp, 4
mov ecx, eax
mov edx, dword [eax]
push 0x20
call dword [edx + 0x30]
movzx eax, ax
mov ecx, esi
mov dword [ebp - 0x18], eax
mov byte [ebp - 4], 2
mov eax, dword [esi]
call dword [eax + 8]
test eax, eax
je 0x41ad87
mov ecx, dword [eax]
push 1
mov edx, dword [ecx]
mov ecx, eax
call edx
cmp dword [ebx + 0x38], 0
mov eax, dword [ebp - 0x18]
mov word [ebx + 0x40], ax
jne 0x41ada4
mov eax, dword [ebx + 0xc]
mov ecx, ebx
push 0
or eax, 4
push eax
call fcn.00405650
mov eax, dword [edi + 0x10]
mov eax, dword [eax + 4]
mov dword [edi + eax + 0x10], vtable.std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__.0
mov eax, dword [edi + 0x10]
mov ecx, dword [eax + 4]
lea eax, [ecx - 8]
mov dword [ecx + edi + 0xc], eax
mov eax, dword [edi]
mov eax, dword [eax + 4]
mov dword [edi + eax], vtable.std::basic_iostream_wchar_t__struct_std::char_traits_wchar_t__.0
mov eax, dword [edi]
mov ecx, dword [eax + 4]
lea eax, [ecx - 0x20]
mov dword [ecx + edi - 4], eax
mov dword [ebp - 4], 6
mov eax, dword [edi]
push 8
mov eax, dword [eax + 4]
mov dword [edi + eax], vtable.std::basic_stringstream_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__.0
mov eax, dword [edi]
mov ecx, dword [eax + 4]
lea eax, [ecx - 0x68]
mov dword [ecx + edi - 4], eax
mov dword [edi + 0x18], vtable.std::basic_streambuf_wchar_t__struct_std::char_traits_wchar_t__.0
call fcn.00435b4c
add esp, 4
mov esi, eax
push 1
mov byte [ebp - 4], 7
call fcn.004340bd
add esp, 4
mov dword [esi + 4], eax
lea ecx, [edi + 0x18]
mov dword [edi + 0x4c], esi
call fcn.00408bd0
mov dword [edi + 0x18], vtable.std::basic_stringbuf_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__.0
mov eax, edi
mov dword [edi + 0x50], 0
mov dword [edi + 0x54], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x41b180
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
mov edi, ecx
mov esi, 7
lea eax, [edi + 4]
mov edx, eax
nop
mov bl, byte [edx]
lea edx, [edx + 1]
mov ecx, dword [edi]
xor cl, bl
mov byte [edx - 1], cl
sub esi, 1
jne 0x41b190
mov byte [edi + 0xb], 0
pop edi
pop esi
pop ebx
ret
Function at 0x41da80
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x49cf15
mov eax, dword fs:[0]
push eax
sub esp, 0x2c
push ebx
push esi
push edi
mov eax, dword [0x4c70c0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov edi, dword [ebp + 0xc]
movzx eax, byte [edi]
xor eax, 0x811c9dc5
imul edx, eax, 0x1000193
movzx eax, byte [edi + 1]
xor edx, eax
movzx eax, byte [edi + 2]
imul edx, edx, 0x1000193
xor edx, eax
movzx eax, byte [edi + 3]
imul ecx, edx, 0x1000193
xor ecx, eax
lea eax, [ebp - 0x18]
imul ebx, ecx, 0x1000193
mov ecx, esi
push ebx
push edi
push eax
mov dword [ebp - 0x20], ebx
call fcn.0041ec10
mov ecx, dword [ebp - 0x14]
test ecx, ecx
je 0x41db02
mov eax, dword [ebp + 8]
mov byte [eax + 4], 0
jmp 0x41dc52
cmp dword [esi + 8], 0x7ffffff
je 0x41dc68
lea eax, [esi + 4]
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x2c], eax
mov dword [ebp - 4], 0
push 0x20
mov dword [ebp - 0x28], 0
call fcn.00435b4c
mov dword [ebp - 0x28], eax
add esp, 4
lea ecx, [eax + 8]
mov eax, dword [edi]
mov dword [ecx], eax
xor eax, eax
mov dword [ecx + 4], eax
mov dword [ecx + 0x14], eax
mov dword [ebp - 0x1c], ecx
mov dword [ecx + 8], eax
mov dword [ecx + 0xc], eax
mov dword [ecx + 0x10], eax
mov dword [ebp - 4], 1
mov eax, dword [esi + 8]
fld dword [esi]
add eax, 1
mov dword [ebp + 0xc], eax
fild dword [ebp + 0xc]
jns 0x41db6b
fadd dword [0x4b6438]
fstp dword [ebp + 0xc]
fld dword [ebp + 0xc]
mov edi, dword [esi + 0x1c]
fild dword [esi + 0x1c]
test edi, edi
jns 0x41db81
fadd dword [0x4b6438]
fstp dword [ebp + 0xc]
fld dword [ebp + 0xc]
fdivr st(1)
fcomp st(2)
fnstsw ax
test ah, 0x41
jne 0x41dc03
fdivrp st(1)
sub esp, 8
fstp dword [ebp + 0xc]
fld dword [ebp + 0xc]
fstp qword [esp]
call fcn.0045a3e0
fstp dword [ebp + 0xc]
fld dword [ebp + 0xc]
add esp, 8
fnstcw word [ebp + 0xe]
movzx eax, word [ebp + 0xe]
or eax, 0xc00
mov dword [ebp - 0x14], eax
fldcw word [ebp - 0x14]
fistp qword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
fldcw word [ebp + 0xe]
cmp eax, 8
ja 0x41dbd3
mov eax, 8
cmp edi, eax
jae 0x41dbe8
cmp edi, 0x200
jae 0x41dbe6
shl edi, 3
cmp edi, eax
jae 0x41dbe8
mov edi, eax
push edi
mov ecx, esi
call fcn.0041e640
push ebx
push dword [ebp - 0x1c]
lea eax, [ebp - 0x34]
mov ecx, esi
push eax
call fcn.0041ec10
mov edi, dword [eax]
jmp 0x41dc0a
mov edi, dword [ebp - 0x18]
fstp st(0)
fstp st(0)
mov ecx, dword [ebp - 0x28]
mov ebx, dword [edi + 4]
inc dword [esi + 8]
mov dword [ecx], edi
mov dword [ecx + 4], ebx
mov dword [ebx], ecx
mov dword [edi + 4], ecx
mov eax, dword [esi + 0x18]
and eax, dword [ebp - 0x20]
mov edx, dword [esi + 0xc]
mov ecx, dword [ebp - 0x24]
mov esi, dword [edx + eax*8]
cmp esi, dword [ecx]
mov ecx, dword [ebp - 0x28]
jne 0x41dc38
mov dword [edx + eax*8], ecx
jmp 0x41dc47
cmp esi, edi
jne 0x41dc41
mov dword [edx + eax*8], ecx
jmp 0x41dc4b
cmp dword [edx + eax*8 + 4], ebx
jne 0x41dc4b
mov dword [edx + eax*8 + 4], ecx
mov eax, dword [ebp + 8]
mov byte [eax + 4], 1
mov dword [eax], ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
push str.unordered_map_set_too_long
call fcn.00433ecc
int3
Function at 0x41e640
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov edx, dword [ebp + 8]
mov eax, 0x1fffffff
push ebx
mov ebx, ecx
bsr ecx, eax
push esi
push edi
mov edi, 1
mov dword [ebp - 4], ebx
mov eax, edi
shl eax, cl
cmp edx, eax
ja 0x41e79a
mov esi, dword [ebx + 4]
lea eax, [edx - 1]
or eax, edi
mov dword [ebp + 8], esi
bsr ecx, eax
push esi
lea ecx, [ecx + 1]
shl edi, cl
lea ecx, [ebx + 0xc]
lea eax, [edi + edi]
push eax
call fcn.0040b0b0
lea eax, [edi - 1]
mov dword [ebx + 0x1c], edi
mov dword [ebx + 0x18], eax
mov eax, dword [ebx + 4]
mov eax, dword [eax]
mov ecx, eax
cmp eax, esi
je 0x41e76d
movzx edx, byte [eax + 8]
xor edx, 0x811c9dc5
mov ecx, dword [ecx]
imul edi, edx, 0x1000193
movzx edx, byte [eax + 9]
xor edi, edx
movzx edx, byte [eax + 0xa]
imul edi, edi, 0x1000193
xor edi, edx
movzx edx, byte [eax + 0xb]
imul edi, edi, 0x1000193
xor edi, edx
imul edx, edi, 0x1000193
mov edi, dword [ebx + 0x18]
and edi, edx
mov edx, dword [ebx + 0xc]
lea edx, [edx + edi*8]
mov edi, dword [edx]
mov dword [ebp - 8], edx
cmp edi, esi
jne 0x41e6f3
mov dword [edx], eax
mov dword [edx + 4], eax
jmp 0x41e763
mov edx, dword [edx + 4]
mov ebx, dword [eax + 8]
cmp ebx, dword [edx + 8]
jne 0x41e72d
mov edx, dword [edx]
mov dword [ebp - 0xc], edx
cmp edx, eax
je 0x41e725
mov ebx, dword [eax + 4]
mov esi, dword [ebp - 0xc]
mov dword [ebx], ecx
mov edi, dword [ecx + 4]
mov dword [edi], edx
mov edx, dword [edx + 4]
mov dword [edx], eax
mov dword [esi + 4], edi
mov esi, dword [ebp + 8]
mov dword [ecx + 4], ebx
mov dword [eax + 4], edx
mov edx, dword [ebp - 8]
mov dword [edx + 4], eax
jmp 0x41e760
cmp edi, edx
je 0x41e73d
mov edx, dword [edx + 4]
cmp ebx, dword [edx + 8]
je 0x41e776
cmp edi, edx
jne 0x41e731
mov ebx, dword [eax + 4]
mov dword [ebp - 0xc], ebx
mov dword [ebx], ecx
mov ebx, dword [ecx + 4]
mov dword [ebx], edx
mov edi, dword [edx + 4]
mov dword [edi], eax
mov dword [edx + 4], ebx
mov edx, dword [ebp - 0xc]
mov dword [ecx + 4], edx
mov edx, dword [ebp - 8]
mov dword [eax + 4], edi
mov dword [edx], eax
mov ebx, dword [ebp - 4]
mov eax, ecx
cmp ecx, esi
jne 0x41e6a2
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
mov ebx, dword [eax + 4]
mov edx, dword [edx]
mov dword [ebp - 0xc], edx
mov esi, edx
mov dword [ebx], ecx
mov edi, dword [ecx + 4]
mov dword [edi], edx
mov edx, dword [edx + 4]
mov dword [edx], eax
mov dword [esi + 4], edi
mov esi, dword [ebp + 8]
mov dword [ecx + 4], ebx
mov dword [eax + 4], edx
jmp 0x41e760
push str.invalid_hash_bucket_count
call fcn.00433ecc
int3
Function at 0x420de0
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x20
mov eax, dword [0x4c70c0]
xor eax, esp
mov dword [esp + 0x1c], eax
push esi
mov esi, dword [ebp + 8]
push edi
test esi, esi
je 0x420f46
mov ecx, esi
call fcn.004637f0
mov ecx, esi
test al, al
je 0x420e27
mov eax, dword [esi]
call dword [eax]
mov al, 1
pop edi
pop esi
mov ecx, dword [esp + 0x1c]
xor ecx, esp
call fcn.00435b39
mov esp, ebp
pop ebp
ret 4
call fcn.00463f60
test al, al
je 0x420f07
mov dword [esp + 8], 0x4d
mov byte [esp + 0xc], 4
mov byte [esp + 0xd], 0x23
mov byte [esp + 0xe], 0x3e
mov byte [esp + 0xf], 0x28
mov byte [esp + 0x10], 0x3f
mov byte [esp + 0x11], 0x39
mov byte [esp + 0x12], 0x6d
mov byte [esp + 0x13], 0x3d
mov byte [esp + 0x14], 0x2c
mov byte [esp + 0x15], 0x3e
mov byte [esp + 0x16], 0x3e
mov byte [esp + 0x17], 0x6d
mov byte [esp + 0x18], 0x39
mov byte [esp + 0x19], 0x22
mov byte [esp + 0x1a], 0x6d
mov byte [esp + 0x1b], 0x29
mov byte [esp + 0x1c], 0x22
mov byte [esp + 0x1d], 0x2e
mov byte [esp + 0x1e], 0x38
mov byte [esp + 0x1f], 0x20
mov byte [esp + 0x20], 0x28
mov byte [esp + 0x21], 0x23
mov byte [esp + 0x22], 0x39
mov al, byte [esp + 0xc]
mov byte [esp + 0x23], 0
xor eax, eax
lea ebx, [ebx]
mov cl, byte [esp + eax + 0xc]
mov edx, dword [esp + 8]
xor dl, cl
mov byte [esp + eax + 0xc], dl
inc eax
cmp eax, 0x17
jb 0x420ec0
lea eax, [esp + 0xc]
mov byte [esp + 0x23], 0
push eax
mov ecx, 0x4cad30
call fcn.0040b670
mov ecx, 0x4cb140
call fcn.00464400
mov al, 1
pop edi
pop esi
mov ecx, dword [esp + 0x1c]
xor ecx, esp
call fcn.00435b39
mov esp, ebp
pop ebp
ret 4
cmp dword [0x4cb154], 8
mov edi, 0x4cb140
jb 0x420f1b
mov edi, dword [0x4cb140]
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0x1c]
push edi
push 0
push 0xc
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
test eax, eax
setne al
pop edi
pop esi
mov ecx, dword [esp + 0x1c]
xor ecx, esp
call fcn.00435b39
mov esp, ebp
pop ebp
ret 4
mov ecx, dword [esp + 0x24]
xor al, al
pop edi
pop esi
xor ecx, esp
call fcn.00435b39
mov esp, ebp
pop ebp
ret 4
Function at 0x425dd0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
mov eax, dword [ebp + 0x10]
sub esp, 0xc
push ebx
push esi
push edi
mov edi, ecx
mov ecx, dword [ebp + 0xc]
test eax, eax
jg 0x425dfb
jl 0x425dee
test ecx, ecx
jne 0x425dfb
xor eax, eax
xor edx, edx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
cmp dword [edi + 0x38], 0
je 0x425ed4
mov dword [esp + 0xc], eax
mov ebx, ecx
mov eax, dword [ebp + 8]
mov dword [esp + 0x10], eax
mov ecx, edi
call fcn.004079b0
mov ecx, edx
mov esi, eax
mov dword [esp + 0x14], ecx
test ecx, ecx
jl 0x425e6b
jg 0x425e2b
test esi, esi
je 0x425e6b
mov eax, dword [esp + 0xc]
cmp eax, ecx
jg 0x425e3f
jl 0x425e39
cmp ebx, esi
jae 0x425e3f
mov esi, ebx
mov dword [esp + 0x14], eax
mov eax, dword [edi + 0x1c]
push esi
push dword [eax]
push dword [esp + 0x18]
call fcn.00437600
mov eax, dword [edi + 0x2c]
add esp, 0xc
mov ecx, dword [esp + 0xc]
sub ebx, esi
sbb ecx, dword [esp + 0x14]
sub dword [eax], esi
mov eax, dword [edi + 0x1c]
add dword [eax], esi
mov eax, dword [esp + 0x10]
jmp 0x425e8e
mov eax, dword [edi]
mov ecx, edi
call dword [eax + 0x1c]
mov ecx, eax
cmp ecx, 0xffffffff
je 0x425ebd
mov eax, dword [esp + 0x10]
add ebx, 0xffffffff
mov esi, 1
mov byte [eax], cl
mov ecx, dword [esp + 0xc]
adc ecx, 0xffffffff
add eax, esi
mov dword [esp + 0xc], ecx
mov dword [esp + 0x10], eax
test ecx, ecx
jg 0x425e12
jl 0x425ec1
test ebx, ebx
jne 0x425e12
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 0x10]
sub eax, ebx
sbb edx, ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov ecx, dword [esp + 0xc]
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 0x10]
sub eax, ebx
sbb edx, ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov eax, dword [edi + 0x1c]
mov esi, ecx
mov ebx, dword [eax]
test ebx, ebx
je 0x425f1f
mov eax, dword [edi + 0x2c]
lea edx, [edi + 0x2c]
mov dword [esp + 0x10], edx
mov eax, dword [eax]
mov dword [esp + 0x14], eax
test eax, eax
je 0x425f26
cmp eax, ecx
jb 0x425efd
mov eax, ecx
mov dword [esp + 0x14], ecx
push eax
push ebx
mov ebx, dword [ebp + 8]
push ebx
call fcn.00437600
mov eax, dword [edi + 0x2c]
add esp, 0xc
mov ecx, dword [esp + 0x14]
add ebx, ecx
sub esi, ecx
sub dword [eax], ecx
mov eax, dword [edi + 0x1c]
add dword [eax], ecx
jmp 0x425f29
lea eax, [edi + 0x2c]
mov dword [esp + 0x10], eax
mov ebx, dword [ebp + 8]
cmp dword [edi + 0x4c], 0
je 0x425f97
mov ecx, dword [edi + 0xc]
lea eax, [edi + 0x3c]
cmp dword [ecx], eax
jne 0x425f53
mov eax, dword [edi + 0xc]
mov edx, dword [edi + 0x54]
mov ecx, dword [edi + 0x50]
sub edx, ecx
mov dword [eax], ecx
mov eax, dword [edi + 0x1c]
mov dword [eax], ecx
mov eax, dword [esp + 0x10]
mov eax, dword [eax]
mov dword [eax], edx
cmp esi, 0xfff
jbe 0x425f82
jmp 0x425f60
push dword [edi + 0x4c]
push 0xfff
push 1
push ebx
call fcn.00440ad3
add esp, 0x10
add ebx, eax
sub esi, eax
cmp eax, 0xfff
jne 0x425f97
cmp esi, eax
ja 0x425f60
test esi, esi
je 0x425f97
push dword [edi + 0x4c]
push esi
push 1
push ebx
call fcn.00440ad3
add esp, 0x10
sub esi, eax
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 0x10]
sub eax, esi
pop edi
pop esi
sbb edx, 0
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x4271d0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x49ddd0
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x4c70c0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov dword [ebp - 0x10], ebx
push 8
mov dword [ebx], vtable.std::basic_streambuf_char__struct_std::char_traits_char__.0
call fcn.00435b4c
mov esi, eax
push 1
mov dword [ebp - 4], 0
call fcn.004340bd
add esp, 8
mov dword [esi + 4], eax
mov ecx, ebx
mov dword [ebx + 0x34], esi
call fcn.00408bd0
mov eax, ebx
lea ecx, [eax + 0x18]
lea edx, [eax + 0x24]
lea esi, [eax + 8]
lea ebx, [eax + 4]
mov dword [eax + 0x2c], edx
mov dword [eax + 0xc], ebx
lea edi, [eax + 0x14]
mov dword [eax], vtable.std::basic_filebuf_char__struct_std::char_traits_char__.0
mov byte [eax + 0x48], 0
mov byte [eax + 0x3d], 0
mov dword [eax + 0x10], esi
mov dword [eax + 0x1c], edi
mov dword [eax + 0x20], ecx
add eax, 0x28
mov dword [ebp - 0x14], ebx
mov ebx, dword [ebp - 0x10]
mov dword [ebx + 0x30], eax
mov ebx, dword [ebp - 0x14]
mov dword [esi], 0
mov dword [ecx], 0
mov dword [eax], 0
mov dword [ebx], 0
mov dword [edi], 0
mov dword [edx], 0
mov edx, dword [ebp - 0x10]
mov dword [edx + 0x4c], 0
mov eax, dword [0x4cb698]
mov ecx, dword [0x4cb69c]
mov dword [edx + 0x40], eax
mov eax, edx
mov dword [edx + 0x44], ecx
mov dword [edx + 0x38], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x429740
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
push esi
mov esi, ecx
cmp dword [esi + 8], 0
mov dword [esi + 0x10], eax
jne 0x42977d
push 0
push 0
push esi
push 0x429710
push 0
push 0
call fcn.00441ff4
add esp, 0x18
mov dword [esi + 4], eax
test eax, eax
je 0x42977d
mov dword [esi + 8], 1
mov al, 1
pop esi
pop ebp
ret 4
xor al, al
pop esi
pop ebp
ret 4

Function at 0x42b7e0
Capabilities:
Encode data using xor

Disassembly:
push esi
xor edx, edx
push ebx
mov bl, byte [ecx + edx + 4]
mov eax, dword [ecx]
add al, dl
xor al, bl
mov byte [ecx + edx + 4], al
inc edx
cmp edx, 0x22
jb 0x42b7e4
pop ebx
mov byte [ecx + 0x26], 0
lea eax, [ecx + 4]
pop esi
ret

Function at 0x42b810
Capabilities:
Encode data using xor

Disassembly:
push esi
xor edx, edx
push ebx
mov bl, byte [ecx + edx + 4]
mov eax, dword [ecx]
add al, dl
xor al, bl
mov byte [ecx + edx + 4], al
inc edx
cmp edx, 0x31
jb 0x42b814
pop ebx
mov byte [ecx + 0x35], 0
lea eax, [ecx + 4]
pop esi
ret

Function at 0x42b840
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
mov edi, ecx
mov esi, 0x19
lea eax, [edi + 4]
mov edx, eax
nop
mov bl, byte [edx]
lea edx, [edx + 1]
mov ecx, dword [edi]
xor cl, bl
mov byte [edx - 1], cl
sub esi, 1
jne 0x42b850
mov byte [edi + 0x1d], 0
pop edi
pop esi
pop ebx
ret