joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40be00
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x24
mov eax, dword [0x4d9164]
xor eax, esp
mov dword [esp + 0x20], eax
push ebx
push esi
mov esi, ecx
push edi
cmp dword [esi + 0x14], 0
je 0x40bf08
cmp dword [esi + 0x18], 8
lea eax, [esi + 4]
xorps xmm0, xmm0
movlpd qword [esp + 0x24], xmm0
jb 0x40be37
mov eax, dword [eax]
push 0xffffffffffffffff
push 0x4000000
push 4
push 0
push 3
push 0xc0000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
cmp edi, 0xffffffff
jne 0x40be69
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov dword [esp + 0x20], 0x4d9c28
jmp 0x40be75
mov ebx, dword [esp + 0x24]
mov dword [esp + 0x20], 0x4d9bd0
mov eax, dword [esi]
cmp eax, 0xffffffff
je 0x40be83
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi], edi
cmp edi, 0xffffffff
je 0x40bee4
push 0
push 4
push 0
push 0
push edi
call dword [sym.imp.KERNEL32.dll_LockFile]
test eax, eax
je 0x40bedd
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push 0
mov dword [esp + 0x28], eax
lea eax, [esp + 0x24]
push eax
push 0x10
lea eax, [esp + 0x30]
mov dword [esp + 0x2c], 0
push eax
push dword [esi]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x40becf
call dword [sym.imp.KERNEL32.dll_GetLastError]
xor ebx, ebx
mov dword [esp + 0x20], 0x4d9bd0
mov cl, 1
jmp 0x40bedf
xor cl, cl
lea eax, [esi + 0x1c]
xchg byte [eax], cl
mov ecx, dword [esp + 0x20]
mov eax, dword [0x4d9bd4]
cmp eax, dword [ecx + 4]
jne 0x40bf3b
test ebx, ebx
jne 0x40bf3b
mov ecx, dword [esp + 0x2c]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.004810ea
mov esp, ebp
pop ebp
ret
mov edx, 0x57
lea ecx, [esp + 0x24]
call fcn.00403c70
mov edx, str.file_path_is_empty
lea ecx, [esp + 0xc]
push dword [eax + 4]
push dword [eax]
call fcn.00403d30
add esp, 8
lea eax, [esp + 0xc]
push 0x4d5a0c
push eax
call fcn.0048311c
push ecx
push ebx
mov edx, str.failed_to_lock
lea ecx, [esp + 0x14]
call fcn.00403d30
add esp, 8
lea eax, [esp + 0xc]
push 0x4d5a0c
push eax
call fcn.0048311c
int3
Function at 0x4116a0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4a9140
mov eax, dword fs:[0]
push eax
sub esp, 8
mov eax, dword [0x4d9164]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
lea eax, [ebp - 0x14]
mov dword [ebp - 0x14], 0
push eax
push 0x20019
push 0
push str.SoftwareBitdefenderInternalCrashEnabled
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x4117f5
mov eax, dword [ebp - 0x14]
test eax, eax
je 0x411703
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
js 0x4117f5
mov eax, dword fs:[0x2c]
mov ecx, dword [eax]
mov eax, dword [0x4de14c]
cmp eax, dword [ecx + 0x58]
jle 0x411749
push 0x4de14c
call fcn.004812aa
add esp, 4
cmp dword [0x4de14c], 0xffffffff
jne 0x411749
push 0x4de14c
mov dword [0x4de150], esi
call fcn.00481260
add esp, 4
mov ecx, dword [0x4de148]
mov edx, str.crash
mov eax, ecx
mov si, word [eax]
cmp si, word [edx]
jne 0x41177c
test si, si
je 0x411778
mov si, word [eax + 2]
cmp si, word [edx + 2]
jne 0x41177c
add eax, 4
add edx, 4
test si, si
jne 0x411756
xor eax, eax
jmp 0x411781
sbb eax, eax
or eax, 1
test eax, eax
jne 0x41178c
mov ecx, 0x411540
jmp 0x4117cb
mov eax, str.abort
mov dx, word [ecx]
cmp dx, word [eax]
jne 0x4117b7
test dx, dx
je 0x4117b3
mov dx, word [ecx + 2]
cmp dx, word [eax + 2]
jne 0x4117b7
add ecx, 4
add eax, 4
test dx, dx
jne 0x411791
xor eax, eax
jmp 0x4117bc
sbb eax, eax
or eax, 1
test eax, eax
mov ecx, 0x411590
mov edx, 0x411570
cmove ecx, edx
xor eax, eax
cmp eax, dword [0x4de150]
push 0
push 0
sbb eax, eax
and eax, 0x4de150
push eax
push ecx
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
test eax, eax
je 0x4117f5
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004810ea
mov esp, ebp
pop ebp
ret
Function at 0x411820
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x2c
mov eax, dword [0x4d9164]
xor eax, esp
mov dword [esp + 0x28], eax
cmp byte [ecx + 0x10], 0
push ebx
je 0x4118f1
push str.Desktop
push 0xc8
lea eax, [esp + 0x18]
push eax
call fcn.0040ab60
cmp byte [esp + 0x28], 0
je 0x4118f6
cmp dword [esp + 0x24], 8
lea ecx, [esp + 0xc]
push ecx
lea ecx, [esp + 0xc]
mov dword [esp + 0xc], 0
push ecx
push 0
push 0x10
lea eax, [esp + 0x20]
mov dword [esp + 0x1c], 4
cmovae eax, dword [esp + 0x20]
push str.NoRestrictBDAppsOnUpdate
push eax
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegGetValueW]
test eax, eax
je 0x4118a6
mov edx, 0x4d9c28
jmp 0x4118ad
xor eax, eax
mov edx, 0x4d9bd0
mov edx, dword [edx + 4]
cmp edx, dword [0x4d9bd4]
jne 0x4118c2
test eax, eax
jne 0x4118c2
mov ecx, dword [esp + 8]
jmp 0x4118cc
xor ecx, ecx
cmp edx, dword [0x4d9bd4]
jne 0x4118f6
test eax, eax
jne 0x4118f6
test ecx, ecx
je 0x4118f6
lea ecx, [esp + 0x10]
call fcn.0041c8b0
xor al, al
pop ebx
mov ecx, dword [esp + 0x28]
xor ecx, esp
call fcn.004810ea
mov esp, ebp
pop ebp
ret 4
mov byte [esp + 0x28], 0
lea ecx, [esp + 0x10]
call fcn.0041c8b0
lea eax, [esp + 8]
mov dword [esp + 8], 0
push eax
push 0x20019
push 0
push str..DEFAULTSoftwareSetID_bd.update.configure
push 0x80000003
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x41194c
mov eax, dword [esp + 8]
test eax, eax
je 0x41194c
push eax
mov bl, 1
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov al, bl
pop ebx
mov ecx, dword [esp + 0x28]
xor ecx, esp
call fcn.004810ea
mov esp, ebp
pop ebp
ret 4
mov ecx, dword [esp + 0x2c]
xor bl, bl
mov al, bl
pop ebx
xor ecx, esp
call fcn.004810ea
mov esp, ebp
pop ebp
ret 4
Function at 0x417c40
Capabilities:
Get token membership

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x4d9164]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword fs:[0x2c]
mov ecx, dword [eax]
mov eax, dword [0x4de160]
cmp eax, dword [ecx + 0x58]
jle 0x417cf8
push 0x4de160
call fcn.004812aa
add esp, 4
cmp dword [0x4de160], 0xffffffff
jne 0x417cf8
lea eax, [ebp - 0x14]
mov dword [ebp - 8], 0
push eax
push 0
push 0
push 0
push 0
push 0
push 0
push 0x220
push 0x20
push 2
lea eax, [ebp - 0x10]
mov dword [ebp - 0x10], 0
push eax
mov word [ebp - 0xc], 0x500
mov dword [ebp - 0x14], 0
call dword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
test eax, eax
je 0x417ce0
lea eax, [ebp - 8]
push eax
push dword [ebp - 0x14]
push 0
call dword [sym.imp.ADVAPI32.dll_CheckTokenMembership]
push dword [ebp - 0x14]
neg eax
sbb eax, eax
and dword [ebp - 8], eax
call dword [sym.imp.ADVAPI32.dll_FreeSid]
cmp dword [ebp - 8], 1
push 0x4de160
sete byte [0x4de164]
call fcn.00481260
add esp, 4
mov ecx, dword [ebp - 4]
mov al, byte [0x4de164]
xor ecx, ebp
call fcn.004810ea
mov esp, ebp
pop ebp
ret
Function at 0x418190
Capabilities:
Set current directory

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4a9e63
mov eax, dword fs:[0]
push eax
sub esp, 0xe4
mov eax, dword [0x4d9164]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
xor eax, eax
mov dword [ebp - 0x2c], 0
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x18], 7
mov word [ebp - 0x2c], ax
mov dword [ebp - 4], eax
lea ecx, [ebp - 0x48]
mov byte [ebp - 4], 1
call fcn.00406d40
push eax
lea ecx, [ebp - 0x2c]
call fcn.0041e870
mov edx, dword [ebp - 0x34]
cmp edx, 8
jb 0x41822e
mov ecx, dword [ebp - 0x48]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x418224
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x418411
push edx
push ecx
call fcn.00481131
add esp, 8
lea eax, [ebp - 0x2c]
mov dword [ebp - 4], 0
push eax
mov ecx, 0x4d9c04
call fcn.0041e870
lea ecx, [ebp - 0x48]
call fcn.00417b90
cmp dword [eax + 0x14], 8
jb 0x418253
mov eax, dword [eax]
push eax
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
mov edx, dword [ebp - 0x34]
test eax, eax
sete bl
cmp edx, 8
jb 0x418299
mov ecx, dword [ebp - 0x48]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x41828f
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x418416
push edx
push ecx
call fcn.00481131
add esp, 8
test bl, bl
je 0x41835b
push ecx
push str.set_current_dir
push 4
lea ecx, [ebp - 0xf0]
call fcn.00403580
mov byte [ebp - 4], 4
cmp byte [ebp - 0xa8], 0
je 0x4182d5
lea eax, [ebp - 0xf0]
push str.Failed_to_set_current_directory__err:
push eax
call fcn.004280f0
add esp, 8
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp byte [ebp - 0xa8], 0
je 0x4182f0
push eax
lea ecx, [ebp - 0xf0]
call fcn.00433fb0
lea ecx, [ebp - 0x90]
call fcn.004037b0
lea eax, [ebp - 0x90]
mov byte [ebp - 4], 5
push eax
mov dword [ebp - 0x90], vtable.std::ios_base.0
call fcn.0043f761
mov edx, dword [ebp - 0x18]
add esp, 4
cmp edx, 8
jb 0x4183f3
mov ecx, dword [ebp - 0x2c]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x41834c
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x41841b
push edx
push ecx
call fcn.00481131
add esp, 8
jmp 0x4183f3
mov edx, dword [ebp - 0x18]
cmp edx, 8
jb 0x418395
mov ecx, dword [ebp - 0x2c]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x41838b
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x41841b
push edx
push ecx
call fcn.00481131
add esp, 8
mov al, 1
jmp 0x4183f5
xor al, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.004810ea
mov esp, ebp
pop ebp
ret
call fcn.004861f9
call fcn.004861f9
call fcn.004861f9
int3
Function at 0x41ab00
Capabilities:
Hash data using djb2

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 8]
mov dword [ebp - 4], eax
push ebx
push esi
mov eax, dword [eax + 8]
mov ebx, ecx
push edi
mov esi, 0x1505
mov edx, dword [eax + 8]
movzx edi, word [edx]
test di, di
je 0x41ab3b
mov ecx, esi
lea edx, [edx + 2]
shl esi, 5
add esi, ecx
movzx ecx, di
add esi, ecx
movzx ecx, word [edx]
mov edi, ecx
test cx, cx
jne 0x41ab22
mov edx, dword [ebx + 0x1c]
mov ecx, dword [ebx + 0x10]
and edx, esi
lea edx, [ecx + edx*8]
mov ecx, dword [edx]
cmp dword [edx + 4], eax
jne 0x41ab63
cmp ecx, eax
jne 0x41ab5b
mov ecx, dword [ebx + 8]
mov dword [edx], ecx
mov dword [edx + 4], ecx
jmp 0x41ab6b
mov ecx, dword [eax + 4]
mov dword [edx + 4], ecx
jmp 0x41ab6b
cmp ecx, eax
jne 0x41ab6b
mov ecx, dword [eax]
mov dword [edx], ecx
push eax
lea ecx, [ebx + 8]
call fcn.00423c40
mov ecx, dword [ebp - 4]
pop edi
pop esi
pop ebx
mov dword [ecx + 8], eax
mov esp, ebp
pop ebp
ret 4

Function at 0x41ab90
Capabilities:
Hash data using djb2

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
lea edi, [ecx + 4]
mov esi, 0x1505
mov ecx, dword [ebx]
movzx eax, word [ecx]
test ax, ax
je 0x41abc9
mov edx, eax
mov eax, esi
lea ecx, [ecx + 2]
shl esi, 5
add esi, eax
movzx eax, dx
add esi, eax
movzx eax, word [ecx]
mov edx, eax
test ax, ax
jne 0x41abb0
push esi
push ebx
lea eax, [ebp - 8]
mov ecx, edi
push eax
call fcn.0042a390
mov edx, dword [eax + 4]
test edx, edx
je 0x41ac39
mov ecx, dword [edi + 0x18]
mov eax, dword [edi + 0xc]
and ecx, esi
lea ecx, [eax + ecx*8]
mov eax, dword [ecx]
cmp dword [ecx + 4], edx
jne 0x41ac21
cmp eax, edx
jne 0x41ac0b
mov eax, dword [edi + 4]
mov dword [ecx], eax
mov dword [ecx + 4], eax
lea ecx, [edi + 4]
push edx
call fcn.00423c40
mov ecx, 1
jmp 0x41ac3b
mov eax, dword [edx + 4]
mov dword [ecx + 4], eax
lea ecx, [edi + 4]
push edx
call fcn.00423c40
mov ecx, 1
jmp 0x41ac3b
cmp eax, edx
jne 0x41ac29
mov eax, dword [edx]
mov dword [ecx], eax
push edx
lea ecx, [edi + 4]
call fcn.00423c40
mov ecx, 1
jmp 0x41ac3b
xor ecx, ecx
xor edx, edx
mov eax, 0x490
pop edi
test ecx, ecx
pop esi
cmovne eax, edx
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x41ac50
Capabilities:
Hash data using djb2

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 8]
sub esp, 8
mov eax, 0x1505
mov edx, dword [edx]
push ebx
push esi
push edi
movzx esi, word [edx]
mov ebx, ecx
test si, si
je 0x41ac89
nop dword [eax]
mov ecx, eax
lea edx, [edx + 2]
shl eax, 5
add eax, ecx
movzx ecx, si
add eax, ecx
movzx ecx, word [edx]
mov esi, ecx
test cx, cx
jne 0x41ac70
push eax
push dword [ebp + 8]
lea eax, [ebp - 8]
push eax
lea ecx, [ebx + 4]
call fcn.0042a390
mov ecx, dword [eax + 4]
test ecx, ecx
jne 0x41aca3
mov ecx, dword [ebx + 8]
xor edx, edx
lea eax, [ecx + 0xc]
cmp dword [ebx + 8], ecx
pop edi
pop esi
cmove eax, edx
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x41b0b0
Capabilities:
Hash data using djb2

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 8]
mov dword [ebp - 4], eax
push ebx
push esi
mov eax, dword [eax + 8]
mov ebx, ecx
push edi
mov esi, 0x1505
mov edx, dword [eax + 8]
movzx edi, word [edx]
test di, di
je 0x41b0eb
mov ecx, esi
lea edx, [edx + 2]
shl esi, 5
add esi, ecx
movzx ecx, di
add esi, ecx
movzx ecx, word [edx]
mov edi, ecx
test cx, cx
jne 0x41b0d2
mov edx, dword [ebx + 0x1c]
mov ecx, dword [ebx + 0x10]
and edx, esi
lea edx, [ecx + edx*8]
mov ecx, dword [edx]
cmp dword [edx + 4], eax
jne 0x41b113
cmp ecx, eax
jne 0x41b10b
mov ecx, dword [ebx + 8]
mov dword [edx], ecx
mov dword [edx + 4], ecx
jmp 0x41b11b
mov ecx, dword [eax + 4]
mov dword [edx + 4], ecx
jmp 0x41b11b
cmp ecx, eax
jne 0x41b11b
mov ecx, dword [eax]
mov dword [edx], ecx
push eax
lea ecx, [ebx + 8]
call fcn.00423cf0
mov ecx, dword [ebp - 4]
pop edi
pop esi
pop ebx
mov dword [ecx + 8], eax
mov esp, ebp
pop ebp
ret 4

Function at 0x41b140
Capabilities:
Hash data using djb2

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
lea edi, [ecx + 4]
mov esi, 0x1505
mov ecx, dword [ebx]
movzx eax, word [ecx]
test ax, ax
je 0x41b179
mov edx, eax
mov eax, esi
lea ecx, [ecx + 2]
shl esi, 5
add esi, eax
movzx eax, dx
add esi, eax
movzx eax, word [ecx]
mov edx, eax
test ax, ax
jne 0x41b160
push esi
push ebx
lea eax, [ebp - 8]
mov ecx, edi
push eax
call fcn.0042a390
mov edx, dword [eax + 4]
test edx, edx
je 0x41b1e9
mov ecx, dword [edi + 0x18]
mov eax, dword [edi + 0xc]
and ecx, esi
lea ecx, [eax + ecx*8]
mov eax, dword [ecx]
cmp dword [ecx + 4], edx
jne 0x41b1d1
cmp eax, edx
jne 0x41b1bb
mov eax, dword [edi + 4]
mov dword [ecx], eax
mov dword [ecx + 4], eax
lea ecx, [edi + 4]
push edx
call fcn.00423cf0
mov ecx, 1
jmp 0x41b1eb
mov eax, dword [edx + 4]
mov dword [ecx + 4], eax
lea ecx, [edi + 4]
push edx
call fcn.00423cf0
mov ecx, 1
jmp 0x41b1eb
cmp eax, edx
jne 0x41b1d9
mov eax, dword [edx]
mov dword [ecx], eax
push edx
lea ecx, [edi + 4]
call fcn.00423cf0
mov ecx, 1
jmp 0x41b1eb
xor ecx, ecx
xor edx, edx
mov eax, 0x490
pop edi
test ecx, ecx
pop esi
cmovne eax, edx
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x41b200
Capabilities:
Hash data using djb2

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 8]
sub esp, 8
mov eax, 0x1505
mov edx, dword [edx]
push ebx
push esi
push edi
movzx esi, word [edx]
mov ebx, ecx
test si, si
je 0x41b239
nop dword [eax]
mov ecx, eax
lea edx, [edx + 2]
shl eax, 5
add eax, ecx
movzx ecx, si
add eax, ecx
movzx ecx, word [edx]
mov esi, ecx
test cx, cx
jne 0x41b220
push eax
push dword [ebp + 8]
lea eax, [ebp - 8]
push eax
lea ecx, [ebx + 4]
call fcn.0042a390
mov ecx, dword [eax + 4]
test ecx, ecx
jne 0x41b253
mov ecx, dword [ebx + 8]
xor edx, edx
lea eax, [ecx + 0x10]
cmp dword [ebx + 8], ecx
pop edi
pop esi
cmove eax, edx
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x41b510
Capabilities:
Hash data using djb2

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 8]
mov edx, 0x1505
push ebx
push esi
mov ebx, ecx
mov dword [ebp - 4], eax
mov esi, dword [eax + 8]
push edi
mov ecx, dword [esi + 8]
movzx eax, word [ecx]
test ax, ax
je 0x41b54d
mov edi, eax
mov eax, edx
lea ecx, [ecx + 2]
shl edx, 5
add edx, eax
movzx eax, di
add edx, eax
movzx eax, word [ecx]
mov edi, eax
test ax, ax
jne 0x41b534
mov ecx, dword [ebx + 0x1c]
mov eax, dword [ebx + 0x10]
and ecx, edx
lea ecx, [eax + ecx*8]
mov eax, dword [ecx]
cmp dword [ecx + 4], esi
jne 0x41b575
cmp eax, esi
jne 0x41b56d
mov eax, dword [ebx + 8]
mov dword [ecx], eax
mov dword [ecx + 4], eax
jmp 0x41b57d
mov eax, dword [esi + 4]
mov dword [ecx + 4], eax
jmp 0x41b57d
cmp eax, esi
jne 0x41b57d
mov eax, dword [esi]
mov dword [ecx], eax
mov edi, dword [esi]
lea edx, [esi + 8]
dec dword [ebx + 0xc]
mov eax, dword [esi + 4]
mov dword [eax], edi
mov eax, dword [esi + 4]
mov dword [edi + 4], eax
call fcn.00431640
push 0x10
push esi
call fcn.00481131
mov eax, dword [ebp - 4]
add esp, 8
mov dword [eax + 8], edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x41b5b0
Capabilities:
Hash data using djb2

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
lea ebx, [ecx + 4]
mov esi, 0x1505
mov ecx, dword [edi]
movzx eax, word [ecx]
test ax, ax
je 0x41b5e9
mov edx, eax
mov eax, esi
lea ecx, [ecx + 2]
shl esi, 5
add esi, eax
movzx eax, dx
add esi, eax
movzx eax, word [ecx]
mov edx, eax
test ax, ax
jne 0x41b5d0
push esi
push edi
lea eax, [ebp - 8]
mov ecx, ebx
push eax
call fcn.0042a390
mov edi, dword [eax + 4]
test edi, edi
je 0x41b657
mov ecx, dword [ebx + 0x18]
mov eax, dword [ebx + 0xc]
and ecx, esi
lea ecx, [eax + ecx*8]
mov eax, dword [ecx]
cmp dword [ecx + 4], edi
jne 0x41b625
cmp eax, edi
jne 0x41b61d
mov eax, dword [ebx + 4]
mov dword [ecx], eax
mov dword [ecx + 4], eax
jmp 0x41b62d
mov eax, dword [edi + 4]
mov dword [ecx + 4], eax
jmp 0x41b62d
cmp eax, edi
jne 0x41b62d
mov eax, dword [edi]
mov dword [ecx], eax
mov ecx, dword [edi]
lea edx, [edi + 8]
dec dword [ebx + 8]
mov eax, dword [edi + 4]
mov dword [eax], ecx
mov eax, dword [edi + 4]
mov dword [ecx + 4], eax
call fcn.00431640
push 0x10
push edi
call fcn.00481131
add esp, 8
mov ecx, 1
jmp 0x41b659
xor ecx, ecx
xor edx, edx
mov eax, 0x490
pop edi
test ecx, ecx
pop esi
cmovne eax, edx
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x41bf10
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x14
cmp dword [ecx + 0x38], 0
push ebx
push esi
push edi
mov dword [esp + 0xc], ecx
je 0x41c004
mov esi, dword [ebp + 0x10]
mov ebx, esi
mov edx, dword [ebp + 0xc]
mov edi, edx
mov eax, dword [ebp + 8]
mov dword [esp + 0x10], eax
test esi, esi
jl 0x41bff3
jg 0x41bf50
test edx, edx
je 0x41bff3
nop dword [eax]
call fcn.00421a20
mov esi, eax
mov eax, edx
mov dword [esp + 0x14], eax
test eax, eax
jl 0x41bfa4
jg 0x41bf67
test esi, esi
je 0x41bfa4
cmp ebx, eax
jg 0x41bf77
jl 0x41bf71
cmp edi, esi
jae 0x41bf77
mov esi, edi
mov dword [esp + 0x14], ebx
mov eax, dword [esp + 0x10]
push esi
push eax
mov eax, dword [esp + 0x14]
mov eax, dword [eax + 0x20]
push dword [eax]
call fcn.00483190
mov ecx, dword [esp + 0x18]
add esp, 0xc
sub edi, esi
sbb ebx, dword [esp + 0x14]
mov eax, dword [ecx + 0x30]
sub dword [eax], esi
mov eax, dword [ecx + 0x20]
add dword [eax], esi
jmp 0x41bfd7
mov eax, dword [esp + 0xc]
mov eax, dword [eax]
mov esi, dword [eax + 0xc]
mov ecx, esi
mov eax, dword [esp + 0x10]
movzx eax, byte [eax]
push eax
call dword [0x4b3390]
mov ecx, dword [esp + 0x10]
call esi
cmp eax, 0xffffffff
je 0x41bfed
mov ecx, dword [esp + 0xc]
add edi, 0xffffffff
mov esi, 1
adc ebx, 0xffffffff
add dword [esp + 0x10], esi
test ebx, ebx
jg 0x41bf50
jl 0x41bfed
test edi, edi
jne 0x41bf50
mov edx, dword [ebp + 0xc]
mov esi, dword [ebp + 0x10]
sub edx, edi
mov eax, edx
sbb esi, ebx
mov edx, esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov eax, dword [ecx + 0x20]
mov esi, dword [ebp + 0xc]
mov edi, dword [ebp + 0x10]
mov dword [esp + 0x18], esi
mov eax, dword [eax]
mov dword [esp + 0x1c], edi
mov dword [esp + 0x10], eax
test eax, eax
je 0x41c026
mov eax, dword [ecx + 0x30]
mov eax, dword [eax]
jmp 0x41c028
xor eax, eax
cdq
mov ebx, eax
mov eax, edx
mov dword [esp + 0x14], eax
test edi, edi
jl 0x41c0a6
jg 0x41c03b
test esi, esi
je 0x41c0a6
test eax, eax
jl 0x41c08a
jg 0x41c045
test ebx, ebx
je 0x41c08a
cmp edi, eax
jg 0x41c055
jl 0x41c04f
cmp esi, ebx
jae 0x41c055
mov ebx, esi
mov dword [esp + 0x14], edi
push ebx
push dword [ebp + 8]
push dword [esp + 0x18]
call fcn.00483190
mov ecx, dword [esp + 0x18]
add esp, 0xc
mov edx, dword [ebp + 8]
sub esi, ebx
sbb edi, dword [esp + 0x14]
add edx, ebx
mov eax, dword [ecx + 0x30]
sub dword [eax], ebx
mov eax, dword [ecx + 0x20]
add dword [eax], ebx
test edi, edi
jl 0x41c0a6
jg 0x41c08d
test esi, esi
je 0x41c0a6
jmp 0x41c08d
mov edx, dword [ebp + 8]
mov eax, dword [ecx + 0x4c]
test eax, eax
je 0x41c0a6
push eax
push esi
push 1
push edx
call fcn.0048fdfe
add esp, 0x10
sub esi, eax
sbb edi, 0
mov eax, dword [esp + 0x18]
mov edx, dword [esp + 0x1c]
sub eax, esi
sbb edx, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x41c630
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
mov eax, dword [0x4d9164]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push edi
mov edi, ecx
cmp ebx, 0xffffffff
jne 0x41c660
pop edi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004810ea
mov esp, ebp
pop ebp
ret 4
mov eax, dword [edi + 0x20]
push esi
mov ecx, dword [eax]
test ecx, ecx
je 0x41c69c
mov edx, dword [edi + 0x30]
mov esi, dword [edx]
lea eax, [esi + ecx]
cmp ecx, eax
jae 0x41c69c
lea ecx, [esi - 1]
mov dword [edx], ecx
mov edx, dword [edi + 0x20]
mov esi, dword [edx]
lea ecx, [esi + 1]
mov dword [edx], ecx
mov byte [esi], bl
pop esi
pop edi
mov eax, ebx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004810ea
mov esp, ebp
pop ebp
ret 4
cmp dword [edi + 0x4c], 0
je 0x41c794
mov esi, dword [edi + 0xc]
lea eax, [edi + 0x3c]
cmp dword [esi], eax
jne 0x41c6c4
mov edx, dword [edi + 0x54]
mov ecx, dword [edi + 0x50]
sub edx, ecx
mov dword [esi], ecx
mov eax, dword [edi + 0x1c]
mov dword [eax], ecx
mov eax, dword [edi + 0x2c]
mov dword [eax], edx
mov eax, dword [edi + 0x38]
mov dword [ebp - 0x34], eax
test eax, eax
jne 0x41c6fa
push dword [edi + 0x4c]
movsx eax, bl
push eax
call fcn.0048e543
add esp, 8
or ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, ebx
pop esi
pop edi
mov eax, ecx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004810ea
mov esp, ebp
pop ebp
ret 4
mov byte [ebp - 0x25], bl
mov eax, dword [eax]
mov esi, dword [eax + 0x1c]
lea eax, [ebp - 0x2c]
push eax
lea eax, [ebp - 4]
mov ecx, esi
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x25]
push eax
lea eax, [edi + 0x40]
push eax
call dword [0x4b3390]
mov ecx, dword [ebp - 0x34]
call esi
sub eax, 0
je 0x41c767
sub eax, 1
je 0x41c767
sub eax, 2
jne 0x41c794
push dword [edi + 0x4c]
movsx eax, byte [ebp - 0x25]
push eax
call fcn.0048e543
add esp, 8
or ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, ebx
pop esi
pop edi
mov eax, ecx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004810ea
mov esp, ebp
pop ebp
ret 4
mov esi, dword [ebp - 0x2c]
lea eax, [ebp - 0x24]
sub esi, eax
je 0x41c784
push dword [edi + 0x4c]
push esi
push 1
push eax
call fcn.0048fdfe
add esp, 0x10
cmp esi, eax
jne 0x41c794
lea eax, [ebp - 0x25]
mov byte [edi + 0x3d], 1
cmp dword [ebp - 0x30], eax
jne 0x41c687
mov ecx, dword [ebp - 4]
or eax, 0xffffffff
pop esi
pop edi
xor ecx, ebp
pop ebx
call fcn.004810ea
mov esp, ebp
pop ebp
ret 4