joyce8/EMBER2024-capa huggingface dataset:
Function at 0x408690
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
mov eax, 0x1fffffff
mov esi, 1
push edi
mov edi, ecx
bsr ecx, eax
mov eax, esi
mov dword [ebp - 0x14], edi
shl eax, cl
mov ecx, dword [ebp + 8]
cmp ecx, eax
jbe 0x4086c1
push str.invalid_hash_bucket_count
call dword [sym.imp.MSVCP140.dll_void___cdecl_std::_Xlength_error_char_const__]
lea eax, [ecx - 1]
mov ebx, dword [edi + 4]
or eax, 1
mov dword [ebp - 0xc], ebx
bsr ecx, eax
push ebx
lea ecx, [ecx + 1]
shl esi, cl
lea ecx, [edi + 0xc]
lea eax, [esi + esi]
push eax
call fcn.004035d0
lea eax, [esi - 1]
mov dword [edi + 0x1c], esi
mov dword [edi + 0x18], eax
mov eax, dword [edi + 4]
mov eax, dword [eax]
cmp eax, ebx
je 0x4087f0
mov edi, eax
nop word [eax + eax]
cmp dword [edi + 0x1c], 0x10
lea ebx, [edi + 8]
mov eax, dword [eax]
mov edx, dword [ebx + 0x10]
mov dword [ebp - 8], eax
mov dword [ebp - 0x10], edx
mov dword [ebp - 4], ebx
jb 0x40871c
mov ecx, dword [ebx]
mov dword [ebp - 4], ecx
xor ecx, ecx
mov esi, 0x811c9dc5
test edx, edx
je 0x408747
mov ebx, dword [ebp - 4]
mov eax, dword [ebp - 0x10]
nop dword [eax]
movzx edx, byte [ecx + ebx]
inc ecx
xor edx, esi
imul esi, edx, 0x1000193
cmp ecx, eax
jb 0x408730
mov eax, dword [ebp - 8]
lea ebx, [edi + 8]
mov ecx, dword [ebp - 0x14]
mov edx, dword [ecx + 0x18]
mov ecx, dword [ecx + 0xc]
and edx, esi
lea ecx, [ecx + edx*8]
mov edx, dword [ebp - 0xc]
mov dword [ebp - 4], ecx
cmp dword [ecx], edx
jne 0x408766
mov dword [ecx], edi
mov dword [ecx + 4], edi
jmp 0x4087df
mov esi, dword [ecx + 4]
lea eax, [esi + 8]
push eax
push ebx
call fcn.00408830
test al, al
jne 0x4087a0
mov ecx, dword [esi]
mov eax, dword [ebp - 8]
cmp ecx, edi
je 0x408798
mov ebx, dword [edi + 4]
mov dword [ebx], eax
mov esi, dword [eax + 4]
mov dword [esi], ecx
mov edx, dword [ecx + 4]
mov dword [edx], edi
mov dword [ecx + 4], esi
mov dword [eax + 4], ebx
mov dword [edi + 4], edx
mov ecx, dword [ebp - 4]
mov dword [ecx + 4], edi
jmp 0x4087df
mov eax, dword [ebp - 4]
cmp dword [eax], esi
je 0x4087bf
mov esi, dword [esi + 4]
lea eax, [esi + 8]
push eax
push ebx
call fcn.00408830
test al, al
je 0x4087f9
mov eax, dword [ebp - 4]
cmp dword [eax], esi
jne 0x4087a7
mov ebx, dword [edi + 4]
mov eax, dword [ebp - 8]
mov dword [ebx], eax
mov edx, dword [eax + 4]
mov dword [edx], esi
mov ecx, dword [esi + 4]
mov dword [ecx], edi
mov dword [esi + 4], edx
mov dword [eax + 4], ebx
mov dword [edi + 4], ecx
mov ecx, dword [ebp - 4]
mov dword [ecx], edi
mov edi, eax
cmp eax, dword [ebp - 0xc]
jne 0x408700
nop word [eax + eax]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
mov ebx, dword [esi]
mov esi, dword [edi + 4]
mov eax, dword [ebp - 8]
mov dword [esi], eax
mov edx, dword [eax + 4]
mov dword [edx], ebx
mov ecx, dword [ebx + 4]
mov dword [ecx], edi
mov dword [ebx + 4], edx
mov dword [eax + 4], esi
mov dword [edi + 4], ecx
jmp 0x4087df
Function at 0x409160
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x44
mov eax, dword [0x42d008]
xor eax, esp
mov dword [esp + 0x40], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [ebp + 0xc]
push esi
push edi
mov edi, ecx
mov dword [esp + 0x24], eax
mov eax, dword [ebp + 0x10]
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], ebx
mov edx, dword [edi + 0x1c]
mov eax, dword [edx + 0xe0]
mov dword [esp + 0xc], eax
test eax, eax
jne 0x4091e9
mov ecx, dword [edx + 0xe8]
mov eax, ecx
mov esi, dword [edx + 0xec]
or eax, esi
je 0x4091e5
lea eax, [esp + 0x38]
mov dword [esp + 0x3c], esi
push eax
mov dword [esp + 0x3c], ecx
lea esi, [edx + 0x30]
call fcn.00404330
push eax
lea eax, [esp + 0x3c]
mov ecx, esi
push eax
lea eax, [esp + 0x30]
push eax
call fcn.004047e0
mov eax, dword [eax + 4]
test eax, eax
jne 0x4091e2
mov eax, dword [esi + 4]
mov eax, dword [eax + 0x10]
mov dword [esp + 0xc], eax
mov eax, dword [ebx + 4]
mov ecx, dword [edi + 0x20]
add eax, 8
push eax
lea eax, [esp + 0x34]
add ecx, 8
push eax
call fcn.00409be0
push 0
push 0xf4240
xorps xmm0, xmm0
mov esi, dword [eax]
add esi, 0x10
movlpd qword [esp + 0x4c], xmm0
mov dword [esp + 0x20], esi
push dword [esi + 0x24]
push dword [esi + 0x20]
call fcn.004222a0
push 0
push 0xf4240
push dword [esi + 0x14]
mov dword [esp + 0x44], eax
push dword [esi + 0x10]
call fcn.004222a0
push 0
push 0xf4240
push dword [esi + 0x1c]
mov ebx, eax
push dword [esi + 0x18]
call fcn.004222a0
push 0
push 0xf4240
push dword [esi + 4]
mov edi, eax
push dword [esi]
call fcn.004222a0
mov esi, eax
mov eax, dword [esp + 0x18]
push 0
push 0xf4240
push dword [eax + 0xc]
push dword [eax + 8]
call fcn.004222a0
push dword [esp + 0x38]
lea ecx, [esp + 0x48]
push ebx
push edi
push esi
push eax
mov eax, dword [esp + 0x20]
push dword [esp + 0x30]
push dword [eax + 0x14]
mov dx, word [eax]
push dword [eax + 0x10]
push dword [eax + 0xc]
push dword [eax + 8]
push dword [eax + 4]
call fcn.00409300
mov ecx, dword [esp + 0x4c]
add esp, 0x2c
mov esi, dword [esp + 0x44]
push dword [esp + 0x48]
mov ecx, dword [ecx + 4]
push esi
push dword [ecx + 0x1c]
movzx eax, word [ecx + 0x5c]
push dword [ecx + 0x18]
push eax
push dword [ecx + 0x58]
push dword [ecx + 0x54]
push 0x4256e8
push 0x425718
push dword [esp + 0x48]
call dword [sym.imp.CppBuildInsights.dll_InjectEvent]
push esi
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov ecx, dword [esp + 0x78]
add esp, 0x2c
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.0042141f
mov esp, ebp
pop ebp
ret 0xc
Function at 0x40c0d0
Capabilities:
Access peb ldr_data
Get process heap flags
Get process heap force flags

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x422f7d
mov eax, dword fs:[0]
push eax
push ebx
sub esp, 8
push esi
push edi
mov eax, dword [0x42d008]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x14], edi
mov dword [ebp - 4], 0
lea esi, [edi + 0x10]
mov dword [edi], vtable.vcperf::ContextBuilder.0
mov dword [edi + 4], 0
mov dword [edi + 8], 0
mov dword [edi + 0xc], 0
mov dword [ebp - 0x18], esi
mov dword [esi], 0
push 0x28
mov dword [esi + 4], 0
mov dword [esi + 8], 0
call fcn.00421430
add esp, 4
mov dword [eax], eax
mov dword [eax + 4], eax
mov dword [esi + 4], eax
lea ecx, [esi + 0xc]
mov dword [ecx], 0
mov dword [ecx + 4], 0
mov dword [ecx + 8], 0
mov byte [ebp - 4], 2
mov dword [esi + 0x18], 7
mov dword [esi + 0x1c], 8
mov dword [esi], 0x3f800000
push dword [esi + 4]
push 0x10
call fcn.004035d0
mov byte [ebp - 4], 3
lea esi, [edi + 0x30]
mov dword [ebp - 0x18], esi
mov dword [esi], 0
push 0x18
mov dword [esi + 4], 0
mov dword [esi + 8], 0
call fcn.00421430
add esp, 4
mov dword [eax], eax
mov dword [eax + 4], eax
mov dword [esi + 4], eax
lea ecx, [esi + 0xc]
mov dword [ecx], 0
mov dword [ecx + 4], 0
mov dword [ecx + 8], 0
mov byte [ebp - 4], 5
mov dword [esi + 0x18], 7
mov dword [esi + 0x1c], 8
mov dword [esi], 0x3f800000
push dword [esi + 4]
push 0x10
call fcn.004035d0
xorps xmm0, xmm0
movups xmmword [edi + 0x50], xmm0
mov dword [edi + 0x50], 0
mov dword [edi + 0x54], 0
mov dword [edi + 0x58], 0
mov byte [edi + 0x5c], 0
mov byte [ebp - 4], 7
lea esi, [edi + 0x60]
mov dword [ebp - 0x18], esi
mov dword [esi], 0
push 0x30
mov dword [esi + 4], 0
mov dword [esi + 8], 0
call fcn.00421430
add esp, 4
mov dword [eax], eax
mov dword [eax + 4], eax
mov dword [esi + 4], eax
lea ecx, [esi + 0xc]
mov dword [ecx], 0
mov dword [ecx + 4], 0
mov dword [ecx + 8], 0
mov byte [ebp - 4], 9
mov dword [esi + 0x18], 7
mov dword [esi + 0x1c], 8
mov dword [esi], 0x3f800000
push dword [esi + 4]
push 0x10
call fcn.004035d0
lea ecx, [edi + 0x80]
mov byte [ebp - 4], 0xa
call fcn.0040f090
lea ecx, [edi + 0xa0]
mov byte [ebp - 4], 0xb
call fcn.0040f090
mov byte [ebp - 4], 0xc
lea esi, [edi + 0xc0]
mov dword [ebp - 0x18], esi
mov dword [esi], 0
push 0x24
mov dword [esi + 4], 0
mov dword [esi + 8], 0
call fcn.00421430
add esp, 4
mov dword [eax], eax
mov dword [eax + 4], eax
mov dword [esi + 4], eax
lea ecx, [esi + 0xc]
mov dword [ecx], 0
mov dword [ecx + 4], 0
mov dword [ecx + 8], 0
mov byte [ebp - 4], 0xe
mov dword [esi + 0x18], 7
mov dword [esi + 0x1c], 8
mov dword [esi], 0x3f800000
push dword [esi + 4]
push 0x10
call fcn.004035d0
mov dword [edi + 0xe0], 0
mov eax, edi
mov dword [edi + 0xe8], 0
mov dword [edi + 0xec], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret
Function at 0x417790
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x14
push ebx
mov ebx, ecx
push esi
push edi
cmp dword [ebx + 0x38], 0
je 0x4177bc
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____thiscall_std::basic_streambuf_char__struct_std::char_traits_char__::xsputn_char_const___long_long___int64__]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov eax, dword [ebx + 0x20]
mov esi, dword [ebp + 0xc]
mov edi, dword [ebp + 0x10]
mov dword [esp + 0x18], esi
mov eax, dword [eax]
mov dword [esp + 0x1c], edi
mov dword [esp + 0x14], eax
test eax, eax
je 0x4177de
mov eax, dword [ebx + 0x30]
mov eax, dword [eax]
jmp 0x4177e0
xor eax, eax
cdq
mov dword [esp + 0xc], eax
mov ecx, edx
mov dword [esp + 0x10], ecx
test edi, edi
jl 0x417865
jg 0x4177f5
test esi, esi
je 0x417865
test ecx, ecx
jl 0x417848
jg 0x4177ff
test eax, eax
je 0x417848
cmp edi, ecx
jg 0x417813
jl 0x417809
cmp esi, eax
jae 0x417813
mov eax, esi
mov dword [esp + 0xc], esi
mov dword [esp + 0x10], edi
push eax
push dword [ebp + 8]
push dword [esp + 0x1c]
call sub.VCRUNTIME140.dll_memcpy
mov ecx, dword [esp + 0x18]
add esp, 0xc
mov eax, dword [ebx + 0x30]
sub esi, ecx
mov edx, dword [ebp + 8]
sbb edi, dword [esp + 0x10]
add edx, ecx
sub dword [eax], ecx
mov eax, dword [ebx + 0x20]
add dword [eax], ecx
test edi, edi
jl 0x417865
jg 0x41784b
test esi, esi
je 0x417865
jmp 0x41784b
mov edx, dword [ebp + 8]
mov eax, dword [ebx + 0x4c]
test eax, eax
je 0x417865
push eax
push esi
push 1
push edx
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
add esp, 0x10
sub esi, eax
sbb edi, 0
mov eax, dword [esp + 0x18]
mov edx, dword [esp + 0x1c]
sub eax, esi
sbb edx, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x417880
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [ebp + 0x10]
push ebx
mov ebx, ecx
mov ecx, dword [ebp + 8]
mov dword [ebp - 8], ecx
push esi
mov esi, dword [ebp + 0xc]
test eax, eax
jg 0x4178ac
jl 0x4178a0
test esi, esi
jne 0x4178ac
pop esi
xor eax, eax
xor edx, edx
pop ebx
mov esp, ebp
pop ebp
ret 0xc
cmp dword [ebx + 0x38], 0
je 0x4178c5
push eax
push esi
push ecx
mov ecx, ebx
call dword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____thiscall_std::basic_streambuf_char__struct_std::char_traits_char__::xsgetn_char___long_long___int64__]
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov eax, dword [ebx + 0x1c]
push edi
mov edi, esi
mov dword [ebp - 4], esi
mov edx, dword [eax]
test edx, edx
je 0x417905
mov eax, dword [ebx + 0x2c]
mov eax, dword [eax]
test eax, eax
je 0x417905
mov edi, dword [ebp + 0xc]
cmp eax, edi
cmovb esi, eax
push esi
push edx
push ecx
call sub.VCRUNTIME140.dll_memcpy
mov eax, dword [ebx + 0x2c]
sub edi, esi
add dword [ebp - 8], esi
add esp, 0xc
mov dword [ebp - 4], edi
sub dword [eax], esi
mov eax, dword [ebx + 0x1c]
add dword [eax], esi
mov esi, dword [ebp + 0xc]
cmp dword [ebx + 0x4c], 0
je 0x4179bc
mov ecx, dword [ebx + 0xc]
lea eax, [ebx + 0x3c]
cmp dword [ecx], eax
jne 0x417930
mov eax, dword [ebx + 0xc]
mov edx, dword [ebx + 0x54]
mov ecx, dword [ebx + 0x50]
sub edx, ecx
mov dword [eax], ecx
mov eax, dword [ebx + 0x1c]
mov dword [eax], ecx
mov eax, dword [ebx + 0x2c]
mov dword [eax], edx
mov eax, dword [ebp - 4]
mov edx, eax
mov ecx, dword [ebp - 8]
cmp eax, 0xfff
mov eax, dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
mov dword [ebp - 4], edx
jbe 0x41797f
nop word [eax + eax]
push dword [ebx + 0x4c]
push 0xfff
push 1
push ecx
call eax
mov ecx, dword [ebp - 8]
sub edi, eax
add ecx, eax
mov dword [ebp - 4], edi
add esp, 0x10
mov dword [ebp - 8], ecx
mov edx, edi
cmp eax, 0xfff
jne 0x4179a9
cmp edi, eax
mov eax, dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
ja 0x417950
cmp dword [ebp - 4], 0
jbe 0x4179bf
push dword [ebx + 0x4c]
push edi
push 1
push ecx
call eax
mov edx, dword [ebp - 4]
add esp, 0x10
sub edx, eax
sub esi, edx
mov edx, dword [ebp + 0x10]
mov eax, esi
pop edi
pop esi
sbb edx, 0
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov edx, dword [ebp + 0x10]
sub esi, edi
pop edi
mov eax, esi
sbb edx, 0
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov edx, dword [ebp - 4]
sub esi, edx
mov edx, dword [ebp + 0x10]
pop edi
mov eax, esi
sbb edx, 0
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x417d30
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
mov eax, dword [0x42d008]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, ecx
cmp ebx, 0xffffffff
jne 0x417d60
pop esi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0042141f
mov esp, ebp
pop ebp
ret 4
mov eax, dword [esi + 0x20]
mov eax, dword [eax]
test eax, eax
je 0x417d90
mov edx, dword [esi + 0x30]
mov edx, dword [edx]
add edx, eax
cmp eax, edx
jae 0x417d90
call dword [sym.imp.MSVCP140.dll_protected:_char____thiscall_std::basic_streambuf_char__struct_std::char_traits_char__::_Pninc_void_]
pop esi
mov byte [eax], bl
mov eax, ebx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0042141f
mov esp, ebp
pop ebp
ret 4
cmp dword [esi + 0x4c], 0
push edi
je 0x417e65
mov edi, dword [esi + 0xc]
lea eax, [esi + 0x3c]
cmp dword [edi], eax
jne 0x417db9
mov edx, dword [esi + 0x54]
mov ecx, dword [esi + 0x50]
sub edx, ecx
mov dword [edi], ecx
mov eax, dword [esi + 0x1c]
mov dword [eax], ecx
mov eax, dword [esi + 0x2c]
mov dword [eax], edx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x417dc5
movsx eax, bl
jmp 0x417dfc
lea eax, [ebp - 0x2c]
mov byte [ebp - 0x25], bl
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x25]
push eax
lea eax, [esi + 0x40]
push eax
call dword [sym.imp.MSVCP140.dll_public:_int___thiscall_std::codecvt_char__char__struct__Mbstatet_::out_struct__Mbstatet___char_const___char_const___char_const____char___char___char___const]
test eax, eax
js 0x417e65
cmp eax, 1
jle 0x417e26
cmp eax, 3
jne 0x417e65
movsx eax, byte [ebp - 0x25]
push dword [esi + 0x4c]
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
add esp, 8
or ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, ebx
pop edi
pop esi
mov eax, ecx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0042141f
mov esp, ebp
pop ebp
ret 4
mov edi, dword [ebp - 0x2c]
lea eax, [ebp - 0x24]
sub edi, eax
je 0x417e44
push dword [esi + 0x4c]
push edi
push 1
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
add esp, 0x10
cmp edi, eax
jne 0x417e65
lea eax, [ebp - 0x25]
mov byte [esi + 0x3d], 1
cmp dword [ebp - 0x30], eax
je 0x417e65
pop edi
pop esi
mov eax, ebx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0042141f
mov esp, ebp
pop ebp
ret 4
mov ecx, dword [ebp - 4]
or eax, 0xffffffff
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0042141f
mov esp, ebp
pop ebp
ret 4
Function at 0x419500
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x42d008]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, ecx
cmp dword [esi + 0x38], 0
je 0x4195bc
cmp byte [esi + 0x3d], 0
je 0x4195bc
mov eax, dword [esi]
push edi
push 0xffffffffffffffff
call dword [eax + 0xc]
cmp eax, 0xffffffff
je 0x4195aa
mov ecx, dword [esi + 0x38]
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [esi + 0x40]
push eax
call dword [sym.imp.MSVCP140.dll_public:_int___thiscall_std::codecvt_char__char__struct__Mbstatet_::unshift_struct__Mbstatet___char___char___char___const]
sub eax, 0
je 0x419571
sub eax, 1
je 0x419575
sub eax, 2
jne 0x4195aa
mov byte [esi + 0x3d], al
mov al, 1
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0042141f
mov esp, ebp
pop ebp
ret
mov byte [esi + 0x3d], 0
mov edi, dword [ebp - 0x28]
lea eax, [ebp - 0x24]
sub edi, eax
je 0x419593
push dword [esi + 0x4c]
push edi
push 1
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
add esp, 0x10
cmp edi, eax
jne 0x4195aa
cmp byte [esi + 0x3d], 0
pop edi
sete al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0042141f
mov esp, ebp
pop ebp
ret
pop edi
xor al, al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0042141f
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
mov al, 1
xor ecx, ebp
pop esi
call fcn.0042141f
mov esp, ebp
pop ebp
ret
Function at 0x41c360
Capabilities:
Access peb ldr_data

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x424301
mov eax, dword fs:[0]
push eax
push ebx
sub esp, 8
push esi
push edi
mov eax, dword [0x42d008]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x14], edi
mov dword [ebp - 4], 0
lea esi, [edi + 4]
mov dword [edi], vtable.vcperf::ExecutionHierarchy.0
mov dword [ebp - 0x18], esi
mov dword [esi], 0
push 0x78
mov dword [esi + 4], 0
mov dword [esi + 8], 0
call fcn.00421430
add esp, 4
mov dword [eax], eax
mov dword [eax + 4], eax
mov dword [esi + 4], eax
lea ecx, [esi + 0xc]
mov dword [ecx], 0
mov dword [ecx + 4], 0
mov dword [ecx + 8], 0
mov byte [ebp - 4], 2
mov dword [esi + 0x18], 7
mov dword [esi + 0x1c], 8
mov dword [esi], 0x3f800000
push dword [esi + 4]
push 0x10
call fcn.004035d0
mov dword [edi + 0x24], 0
mov dword [edi + 0x28], 0
mov dword [edi + 0x2c], 0
mov eax, dword [ebx + 8]
lea esi, [edi + 0x48]
mov byte [ebp - 4], 4
push 0x28
movups xmm0, xmmword [eax]
movups xmmword [edi + 0x30], xmm0
movq xmm0, qword [eax + 0x10]
movq qword [edi + 0x40], xmm0
mov dword [ebp - 0x18], esi
mov dword [esi], 0
mov dword [esi + 4], 0
mov dword [esi + 8], 0
call fcn.00421430
add esp, 4
mov dword [eax], eax
mov dword [eax + 4], eax
mov dword [esi + 4], eax
lea ecx, [esi + 0xc]
mov dword [ecx], 0
mov dword [ecx + 4], 0
mov dword [ecx + 8], 0
mov byte [ebp - 4], 6
mov dword [esi + 0x18], 7
mov dword [esi + 0x1c], 8
mov dword [esi], 0x3f800000
push dword [esi + 4]
push 0x10
call fcn.004035d0
mov byte [ebp - 4], 7
lea esi, [edi + 0x68]
mov dword [ebp - 0x18], esi
mov dword [esi], 0
push 0x28
mov dword [esi + 4], 0
mov dword [esi + 8], 0
call fcn.00421430
add esp, 4
mov dword [eax], eax
mov dword [eax + 4], eax
mov dword [esi + 4], eax
lea ecx, [esi + 0xc]
mov dword [ecx], 0
mov dword [ecx + 4], 0
mov dword [ecx + 8], 0
mov byte [ebp - 4], 9
mov dword [esi + 0x18], 7
mov dword [esi + 0x1c], 8
mov dword [esi], 0x3f800000
push dword [esi + 4]
push 0x10
call fcn.004035d0
mov byte [ebp - 4], 0xa
lea esi, [edi + 0x88]
mov dword [ebp - 0x18], esi
mov dword [esi], 0
push 0x20
mov dword [esi + 4], 0
mov dword [esi + 8], 0
call fcn.00421430
add esp, 4
mov dword [eax], eax
mov dword [eax + 4], eax
mov dword [esi + 4], eax
lea ecx, [esi + 0xc]
mov dword [ecx], 0
mov dword [ecx + 4], 0
mov dword [ecx + 8], 0
mov byte [ebp - 4], 0xc
mov dword [esi + 0x18], 7
mov dword [esi + 0x1c], 8
mov dword [esi], 0x3f800000
push dword [esi + 4]
push 0x10
call fcn.004035d0
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret 4
Function at 0x420b90
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
mov ebx, ecx
mov eax, 0x1fffffff
bsr ecx, eax
push esi
mov esi, 1
mov dword [ebp - 0x18], ebx
mov eax, esi
shl eax, cl
mov ecx, dword [ebp + 8]
push edi
cmp ecx, eax
jbe 0x420bc1
push str.invalid_hash_bucket_count
call dword [sym.imp.MSVCP140.dll_void___cdecl_std::_Xlength_error_char_const__]
lea eax, [ecx - 1]
or eax, 1
bsr ecx, eax
mov eax, dword [ebx + 4]
push eax
mov dword [ebp - 0xc], eax
lea ecx, [ecx + 1]
shl esi, cl
lea ecx, [ebx + 0xc]
lea eax, [esi + esi]
push eax
call fcn.004035d0
mov ecx, dword [ebp - 0xc]
lea eax, [esi - 1]
mov dword [ebx + 0x18], eax
mov dword [ebx + 0x1c], esi
mov edi, dword [ebx + 4]
mov edi, dword [edi]
mov eax, edi
cmp edi, ecx
je 0x420cf5
nop dword [eax]
cmp dword [edi + 0x1c], 0x10
lea ebx, [edi + 8]
mov eax, dword [eax]
mov esi, dword [ebx + 0x10]
mov dword [ebp - 8], eax
mov dword [ebp - 0x14], esi
mov dword [ebp - 0x10], ebx
jb 0x420c1c
mov edx, dword [ebx]
mov dword [ebp - 0x10], edx
xor edx, edx
mov dword [ebp - 4], 0x811c9dc5
test esi, esi
je 0x420c4f
mov ecx, dword [ebp - 4]
mov ebx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x14]
movzx esi, byte [edx + ebx]
inc edx
xor esi, ecx
imul ecx, esi, 0x1000193
cmp edx, eax
jb 0x420c32
mov eax, dword [ebp - 8]
lea ebx, [edi + 8]
mov dword [ebp - 4], ecx
mov ecx, dword [ebp - 0xc]
mov edx, dword [ebp - 0x18]
mov esi, dword [edx + 0x18]
and esi, dword [ebp - 4]
mov edx, dword [edx + 0xc]
lea edx, [edx + esi*8]
mov dword [ebp - 4], edx
cmp dword [edx], ecx
jne 0x420c6f
mov dword [edx], edi
mov dword [edx + 4], edi
jmp 0x420ceb
mov esi, dword [edx + 4]
lea eax, [esi + 8]
push eax
push ebx
call fcn.00408830
test al, al
jne 0x420ca9
mov ecx, dword [esi]
mov eax, dword [ebp - 8]
cmp ecx, edi
je 0x420ca1
mov ebx, dword [edi + 4]
mov dword [ebx], eax
mov esi, dword [eax + 4]
mov dword [esi], ecx
mov edx, dword [ecx + 4]
mov dword [edx], edi
mov dword [ecx + 4], esi
mov dword [eax + 4], ebx
mov dword [edi + 4], edx
mov ecx, dword [ebp - 4]
mov dword [ecx + 4], edi
jmp 0x420ce8
mov eax, dword [ebp - 4]
cmp dword [eax], esi
je 0x420cc8
mov esi, dword [esi + 4]
lea eax, [esi + 8]
push eax
push ebx
call fcn.00408830
test al, al
je 0x420cfe
mov eax, dword [ebp - 4]
cmp dword [eax], esi
jne 0x420cb0
mov ebx, dword [edi + 4]
mov eax, dword [ebp - 8]
mov dword [ebx], eax
mov edx, dword [eax + 4]
mov dword [edx], esi
mov ecx, dword [esi + 4]
mov dword [ecx], edi
mov dword [esi + 4], edx
mov dword [eax + 4], ebx
mov dword [edi + 4], ecx
mov ecx, dword [ebp - 4]
mov dword [ecx], edi
mov ecx, dword [ebp - 0xc]
mov edi, eax
cmp eax, ecx
jne 0x420c00
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
mov ebx, dword [esi]
mov esi, dword [edi + 4]
mov eax, dword [ebp - 8]
mov dword [esi], eax
mov edx, dword [eax + 4]
mov dword [edx], ebx
mov ecx, dword [ebx + 4]
mov dword [ecx], edi
mov dword [ebx + 4], edx
mov dword [eax + 4], esi
mov dword [edi + 4], ecx
jmp 0x420ce8