joyce8/EMBER2024-capa huggingface dataset:
Function at 0x412d80
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4757ab
mov eax, dword fs:[0]
push eax
sub esp, 0x20
mov eax, dword [0x487080]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x28], ebx
mov edi, dword [ebp + 8]
push edi
mov dword [ebp - 0x2c], ebx
mov dword [ebp - 0x24], edi
call fcn.0041c2c0
mov dword [ebp - 4], 0
lea esi, [ebx + 0x18]
mov dword [ebp - 0x28], esi
mov eax, dword [edi + 0x18]
mov dword [esi], eax
push 0x20
mov dword [esi + 4], 0
mov dword [esi + 8], 0
call fcn.0047319b
add esp, 4
mov dword [eax], eax
mov dword [eax + 4], eax
mov dword [esi + 4], eax
lea ecx, [esi + 0xc]
mov dword [ecx], 0
mov dword [ecx + 4], 0
mov dword [ecx + 8], 0
mov byte [ebp - 4], 2
mov eax, dword [edi + 0x30]
push dword [esi + 4]
mov dword [esi + 0x18], eax
mov eax, dword [edi + 0x34]
mov dword [esi + 0x1c], eax
mov eax, dword [edi + 0x28]
sub eax, dword [edi + 0x24]
sar eax, 2
push eax
call fcn.0041e1b0
mov eax, dword [edi + 0x1c]
mov ecx, esi
push eax
push dword [eax]
call fcn.004224b0
lea eax, [edi + 0x38]
mov byte [ebp - 4], 3
push eax
lea ecx, [ebx + 0x38]
call fcn.0041ac80
lea eax, [edi + 0x58]
mov byte [ebp - 4], 4
push eax
lea ecx, [ebx + 0x58]
call fcn.0041ac80
lea eax, [edi + 0x78]
mov byte [ebp - 4], 5
push eax
lea ecx, [ebx + 0x78]
call fcn.0041c2c0
lea eax, [edi + 0x90]
mov byte [ebp - 4], 6
push eax
lea ecx, [ebx + 0x90]
call fcn.0041c2c0
lea eax, [edi + 0xa8]
mov byte [ebp - 4], 7
push eax
lea ecx, [ebx + 0xa8]
call fcn.0041c2c0
mov byte [ebp - 4], 8
movzx eax, byte [edi + 0xc0]
mov byte [ebx + 0xc0], al
movzx eax, byte [edi + 0xc1]
mov byte [ebx + 0xc1], al
mov eax, dword [edi + 0xc4]
mov dword [ebx + 0xc4], eax
add ebx, 0xc8
mov dword [ebx], 0
mov dword [ebx + 4], 0
mov eax, 0x92492493
mov dword [ebx + 8], 0
mov ecx, dword [edi + 0xcc]
sub ecx, dword [edi + 0xc8]
imul ecx
add edx, ecx
sar edx, 4
mov eax, edx
shr eax, 0x1f
add eax, edx
je 0x412f84
cmp eax, 0x9249249
ja 0x412fb1
push eax
mov ecx, ebx
call fcn.00421500
mov dword [ebp - 0x28], ebx
mov esi, dword [ebp - 0x24]
xorps xmm0, xmm0
mov ecx, dword [ebp - 0x20]
mov edi, dword [ebx]
movq qword [ebp - 0x1c], xmm0
mov ebx, dword [esi + 0xcc]
mov esi, dword [esi + 0xc8]
lea eax, [ecx + 0xc8]
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x1c], edi
mov dword [ebp - 0x18], edi
mov dword [ebp - 0x14], eax
mov byte [ebp - 4], 0xa
cmp esi, ebx
je 0x412f6b
nop
push esi
mov ecx, edi
call fcn.0041c2c0
mov eax, dword [esi + 0x18]
add esi, 0x1c
mov dword [edi + 0x18], eax
add edi, 0x1c
mov dword [ebp - 0x18], edi
cmp esi, ebx
jne 0x412f50
push ecx
mov edx, edi
mov ecx, edi
call fcn.0041fc80
mov ecx, dword [ebp - 0x20]
add esp, 4
mov dword [ecx + 0xcc], edi
mov edi, dword [ebp - 0x24]
mov eax, dword [ebp - 0x20]
mov cl, byte [edi + 0xd4]
mov byte [eax + 0xd4], cl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00472ead
mov esp, ebp
pop ebp
ret 4
call fcn.0041d8e0
int3
Function at 0x414880
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 0xc], ecx
xor edx, edx
mov dword [ebp - 8], 0x372234
mov byte [ebp - 4], 1
lea eax, [edx + 0x1c]
xor byte [ebp + edx - 8], al
inc edx
cmp edx, 3
jb 0x414896
lea eax, [ebp - 8]
mov byte [ebp - 4], 0
push eax
call fcn.004533b0
mov eax, dword [0x4896f8]
add esp, 4
cmp byte [eax + 0x1d8f], 0
mov ecx, dword [eax + 0x1ba8]
je 0x4148fc
cmp byte [eax + 0x1d8e], 0
jne 0x4148fc
test byte [eax + 0x1c4c], 4
jne 0x414a6f
mov ecx, dword [eax + 0x1d54]
cmp ecx, dword [eax + 0x1c48]
jne 0x414a6f
test ecx, ecx
je 0x414a6f
jmp 0x414996
mov edx, dword [eax + 0x1c50]
test dl, 1
je 0x414a6f
cmp dword [eax + 0x1bac], ecx
je 0x41491b
test dl, dl
jns 0x414a6f
mov edx, dword [eax + 0x1be0]
test edx, edx
je 0x41493f
cmp edx, dword [eax + 0x1c48]
je 0x41493f
cmp byte [eax + 0x1bed], 0
jne 0x41493f
cmp edx, dword [ecx + 0x50]
jne 0x414a6f
mov edx, dword [eax + 0x1d50]
test edx, edx
je 0x414971
mov edx, dword [edx + 0x2e0]
test edx, edx
je 0x414971
cmp byte [edx + 0x8b], 0
je 0x414971
cmp edx, dword [ecx + 0x2e0]
je 0x414971
test dword [edx + 8], 0xc000000
jne 0x414a6f
test byte [eax + 0x1c4c], 4
jne 0x414a6f
mov eax, dword [eax + 0x1c48]
cmp eax, dword [ecx + 0x50]
jne 0x414996
cmp byte [ecx + 0x8c], 0
jne 0x414a6f
push ebx
push esi
push edi
xor ecx, ecx
call fcn.0043a7c0
mov ecx, dword [0x4896f8]
mov eax, dword [ecx + 0x1ba8]
movss xmm0, dword [ecx + 0x1944]
mulss xmm0, dword [0x480910]
mov byte [eax + 0x8c], 1
mov ebx, dword [ecx + 0x1ba8]
mov ecx, dword [ebx + 0x194]
lea edi, [ebx + 0x194]
mov esi, dword [edi + 4]
movss dword [ebp - 8], xmm0
cmp ecx, esi
jne 0x414a08
inc ecx
test esi, esi
je 0x4149f1
mov eax, esi
cdq
sub eax, edx
sar eax, 1
add eax, esi
jmp 0x4149f6
mov eax, 8
cmp eax, ecx
cmovg ecx, eax
push ecx
mov ecx, edi
call fcn.00440270
movss xmm0, dword [ebp - 8]
mov edx, dword [edi]
mov ecx, dword [edi + 8]
mov eax, dword [ebx + 0x184]
push 1
mov dword [ecx + edx*4], eax
xor edx, edx
inc dword [edi]
mov ecx, dword [ebp - 0xc]
movss dword [ebx + 0x184], xmm0
call fcn.00452b90
mov ecx, dword [0x4896f8]
add esp, 4
mov eax, dword [ecx + 0x1ba8]
mov byte [eax + 0x8c], 1
mov edx, dword [ecx + 0x1ba8]
mov ecx, dword [edx + 0x194]
mov eax, dword [edx + 0x19c]
mov eax, dword [eax + ecx*4 - 4]
mov dword [edx + 0x184], eax
lea eax, [ecx - 1]
mov dword [edx + 0x194], eax
call fcn.00438f30
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4193c0
Capabilities:
Encode data using xor

Disassembly:
push edi
mov edi, ecx
cmp byte [edi + 0x10], 0
je 0x419448
movups xmm4, xmmword [0x480a40]
push ebx
mov ebx, 0x1f
push esi
lea eax, [ebx - 0x13]
nop word [eax + eax]
lea ecx, [ebx - 1]
movd xmm2, ebx
lea esi, [ebx - 3]
movd xmm0, ecx
movd xmm3, esi
lea edx, [ebx - 2]
punpckldq xmm3, xmm0
movd xmm0, dword [edi + ebx - 0x1f]
punpcklbw xmm0, xmm0
movd xmm1, edx
punpcklwd xmm0, xmm0
punpckldq xmm1, xmm2
punpckldq xmm3, xmm1
psrad xmm0, 0x18
xorps xmm3, xmm0
andps xmm3, xmm4
packuswb xmm3, xmm3
packuswb xmm3, xmm3
movd dword [edi + ebx - 0x1f], xmm3
add ebx, 4
cmp ebx, 0x2b
jb 0x4193e0
pop esi
pop ebx
lea edx, [edi + eax]
lea ecx, [eax + 0x1c]
inc eax
xor byte [edx], cl
cmp eax, 0xf
jb 0x419436
mov byte [edi + 0x10], 0
mov eax, edi
pop edi
ret

Function at 0x419450
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
push edi
mov edi, ecx
cmp byte [edi + 9], 0
je 0x4194ca
movups xmm4, xmmword [0x480a40]
mov eax, 0x1f
push ebx
push esi
lea ebx, [eax - 0x1d]
nop word [eax + eax]
lea ecx, [eax - 1]
movd xmm2, eax
lea esi, [eax - 3]
movd xmm0, ecx
movd xmm3, esi
lea edx, [eax - 2]
punpckldq xmm3, xmm0
movd xmm0, dword [edi + eax - 0x1f]
punpcklbw xmm0, xmm0
movd xmm1, edx
punpcklwd xmm0, xmm0
punpckldq xmm1, xmm2
punpckldq xmm3, xmm1
psrad xmm0, 0x18
xorps xmm3, xmm0
andps xmm3, xmm4
packuswb xmm3, xmm3
packuswb xmm3, xmm3
movd dword [edi + eax - 0x1f], xmm3
add eax, 4
sub ebx, 1
jne 0x419470
pop esi
pop ebx
mov byte [edi + 9], 0
mov eax, edi
pop edi
ret

Function at 0x4194d0
Capabilities:
Encode data using xor

Disassembly:
cmp byte [ecx + 0xe], 0
je 0x419542
movups xmm4, xmmword [0x480a40]
push esi
push edi
mov edi, 0x1f
lea eax, [edi - 1]
movd xmm2, edi
lea esi, [edi - 3]
movd xmm0, eax
movd xmm3, esi
lea edx, [edi - 2]
punpckldq xmm3, xmm0
movd xmm0, dword [ecx + edi - 0x1f]
punpcklbw xmm0, xmm0
movd xmm1, edx
punpcklwd xmm0, xmm0
punpckldq xmm1, xmm2
punpckldq xmm3, xmm1
psrad xmm0, 0x18
xorps xmm3, xmm0
andps xmm3, xmm4
packuswb xmm3, xmm3
packuswb xmm3, xmm3
movd dword [ecx + edi - 0x1f], xmm3
add edi, 4
cmp edi, 0x2b
jb 0x4194e4
xor byte [ecx + 0xc], 0x28
pop edi
pop esi
mov byte [ecx + 0xe], 0
mov eax, ecx
ret
Function at 0x419fe0
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0x1a], 0
je 0x41a0b9
movd xmm0, dword [esi]
mov eax, 0x10
movups xmm2, xmmword [0x480a40]
movaps xmm1, xmmword [0x480a00]
punpcklbw xmm0, xmm0
punpcklwd xmm0, xmm0
psrad xmm0, 0x18
xorps xmm1, xmm0
andps xmm1, xmm2
packuswb xmm1, xmm1
packuswb xmm1, xmm1
movd dword [esi], xmm1
movd xmm0, dword [esi + 4]
movaps xmm1, xmmword [str._______]
punpcklbw xmm0, xmm0
punpcklwd xmm0, xmm0
psrad xmm0, 0x18
xorps xmm1, xmm0
andps xmm1, xmm2
packuswb xmm1, xmm1
packuswb xmm1, xmm1
movd dword [esi + 4], xmm1
movd xmm0, dword [esi + 8]
movaps xmm1, xmmword [0x480a20]
punpcklbw xmm0, xmm0
punpcklwd xmm0, xmm0
psrad xmm0, 0x18
xorps xmm1, xmm0
andps xmm1, xmm2
packuswb xmm1, xmm1
packuswb xmm1, xmm1
movd dword [esi + 8], xmm1
movd xmm0, dword [esi + 0xc]
movaps xmm1, xmmword [0x480a30]
punpcklbw xmm0, xmm0
punpcklwd xmm0, xmm0
psrad xmm0, 0x18
xorps xmm1, xmm0
andps xmm1, xmm2
packuswb xmm1, xmm1
packuswb xmm1, xmm1
movd dword [esi + 0xc], xmm1
lea edx, [esi + eax]
lea ecx, [eax + 0x1c]
inc eax
xor byte [edx], cl
cmp eax, 0x19
jb 0x41a0a7
mov byte [esi + 0x1a], 0
pop esi
ret

Function at 0x41a0c0
Capabilities:
Encode data using xor

Disassembly:
push edi
mov edi, ecx
cmp byte [edi + 0xf], 0
je 0x41a148
movups xmm4, xmmword [0x480a40]
push ebx
mov ebx, 0x1f
push esi
lea eax, [ebx - 0x13]
nop word [eax + eax]
lea ecx, [ebx - 1]
movd xmm2, ebx
lea esi, [ebx - 3]
movd xmm0, ecx
movd xmm3, esi
lea edx, [ebx - 2]
punpckldq xmm3, xmm0
movd xmm0, dword [edi + ebx - 0x1f]
punpcklbw xmm0, xmm0
movd xmm1, edx
punpcklwd xmm0, xmm0
punpckldq xmm1, xmm2
punpckldq xmm3, xmm1
psrad xmm0, 0x18
xorps xmm3, xmm0
andps xmm3, xmm4
packuswb xmm3, xmm3
packuswb xmm3, xmm3
movd dword [edi + ebx - 0x1f], xmm3
add ebx, 4
cmp ebx, 0x2b
jb 0x41a0e0
pop esi
pop ebx
lea edx, [edi + eax]
lea ecx, [eax + 0x1c]
inc eax
xor byte [edx], cl
cmp eax, 0xe
jb 0x41a136
mov byte [edi + 0xf], 0
pop edi
ret

Function at 0x41a150
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, ecx
cmp byte [esi + 6], 0
je 0x41a172
xor eax, eax
nop
lea edx, [esi + eax]
lea ecx, [eax + 0x1c]
inc eax
xor byte [edx], cl
cmp eax, 5
jb 0x41a160
mov byte [esi + 6], 0
push ecx
mov ecx, dword [ebp + 8]
lea eax, [esi + 5]
push eax
push esi
call fcn.0041f260
mov eax, dword [ebp + 8]
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x41a500
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x1c
push ebx
mov ebx, ecx
push esi
push edi
cmp dword [ebx + 0x38], 0
je 0x41a52c
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____thiscall_std::basic_streambuf_char__struct_std::char_traits_char__::xsputn_char_const___long_long___int64__]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov eax, dword [ebx + 0x20]
mov esi, dword [ebp + 0xc]
mov edi, dword [ebp + 0x10]
mov dword [esp + 0x20], esi
mov ecx, dword [eax]
lea eax, [ebx + 0x30]
mov dword [esp + 0x24], edi
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x18], eax
test ecx, ecx
je 0x41a554
mov eax, dword [eax]
mov ecx, dword [eax]
jmp 0x41a55a
xor ecx, ecx
mov dword [esp + 0x18], eax
mov eax, ecx
cdq
mov dword [esp + 0x10], eax
mov ecx, edx
mov dword [esp + 0x14], ecx
test edi, edi
jl 0x41a5c2
jg 0x41a571
test esi, esi
je 0x41a5c2
test ecx, ecx
jl 0x41a5bd
jg 0x41a57b
test eax, eax
je 0x41a5bd
cmp edi, ecx
jg 0x41a58f
jl 0x41a585
cmp esi, eax
jae 0x41a58f
mov eax, esi
mov dword [esp + 0x10], esi
mov dword [esp + 0x14], edi
push eax
push dword [ebp + 8]
push dword [esp + 0x24]
call sub.VCRUNTIME140.dll_memcpy
mov eax, dword [esp + 0x24]
add esp, 0xc
mov edx, dword [esp + 0x10]
mov ecx, dword [ebp + 8]
add ecx, edx
sub esi, edx
mov eax, dword [eax]
sbb edi, dword [esp + 0x14]
sub dword [eax], edx
mov eax, dword [ebx + 0x20]
add dword [eax], edx
jmp 0x41a5c5
mov ecx, dword [ebp + 8]
jmp 0x41a5cf
mov ecx, dword [ebp + 8]
test edi, edi
jl 0x41a5e9
jg 0x41a5cf
test esi, esi
je 0x41a5e9
mov eax, dword [ebx + 0x4c]
test eax, eax
je 0x41a5e9
push eax
push esi
push 1
push ecx
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
add esp, 0x10
sub esi, eax
sbb edi, 0
mov eax, dword [esp + 0x20]
mov edx, dword [esp + 0x24]
sub eax, esi
sbb edx, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x41a600
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [ebp + 0x10]
push ebx
mov ebx, ecx
mov ecx, dword [ebp + 0xc]
push esi
mov esi, dword [ebp + 8]
mov dword [ebp - 4], esi
test eax, eax
jg 0x41a62c
jl 0x41a620
test ecx, ecx
jne 0x41a62c
pop esi
xor eax, eax
xor edx, edx
pop ebx
mov esp, ebp
pop ebp
ret 0xc
cmp dword [ebx + 0x38], 0
je 0x41a645
push eax
push ecx
push esi
mov ecx, ebx
call dword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____thiscall_std::basic_streambuf_char__struct_std::char_traits_char__::xsgetn_char___long_long___int64__]
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov eax, dword [ebx + 0x1c]
push edi
mov edi, ecx
mov eax, dword [eax]
mov dword [ebp - 8], eax
test eax, eax
je 0x41a693
mov eax, dword [ebx + 0x2c]
lea edx, [ebx + 0x2c]
mov dword [ebp - 0xc], edx
mov eax, dword [eax]
test eax, eax
je 0x41a699
mov edi, dword [ebp - 4]
cmp eax, ecx
mov esi, ecx
cmovb esi, eax
push esi
push dword [ebp - 8]
push edi
call sub.VCRUNTIME140.dll_memcpy
mov eax, dword [ebx + 0x2c]
add edi, esi
mov dword [ebp - 4], edi
add esp, 0xc
mov edi, dword [ebp + 0xc]
sub edi, esi
sub dword [eax], esi
mov eax, dword [ebx + 0x1c]
add dword [eax], esi
mov esi, dword [ebp - 4]
jmp 0x41a699
lea eax, [ebx + 0x2c]
mov dword [ebp - 0xc], eax
cmp dword [ebx + 0x4c], 0
je 0x41a706
mov ecx, dword [ebx + 0xc]
lea eax, [ebx + 0x3c]
cmp dword [ecx], eax
jne 0x41a6c2
mov eax, dword [ebx + 0xc]
mov edx, dword [ebx + 0x54]
mov ecx, dword [ebx + 0x50]
sub edx, ecx
mov dword [eax], ecx
mov eax, dword [ebx + 0x1c]
mov dword [eax], ecx
mov eax, dword [ebp - 0xc]
mov eax, dword [eax]
mov dword [eax], edx
mov eax, dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
cmp edi, 0xfff
jbe 0x41a6f4
nop
push dword [ebx + 0x4c]
push 0xfff
push 1
push esi
call eax
add esp, 0x10
add esi, eax
sub edi, eax
cmp eax, 0xfff
jne 0x41a706
cmp edi, eax
mov eax, dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
ja 0x41a6d0
test edi, edi
je 0x41a706
push dword [ebx + 0x4c]
push edi
push 1
push esi
call eax
add esp, 0x10
sub edi, eax
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 0x10]
sub eax, edi
pop edi
pop esi
sbb edx, 0
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x41aa80
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
mov eax, dword [0x487080]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, ecx
cmp ebx, 0xffffffff
jne 0x41aab0
pop esi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00472ead
mov esp, ebp
pop ebp
ret 4
mov eax, dword [esi + 0x20]
push edi
mov ecx, dword [eax]
test ecx, ecx
je 0x41aaec
mov edx, dword [esi + 0x30]
mov edi, dword [edx]
lea eax, [edi + ecx]
cmp ecx, eax
jae 0x41aaec
lea ecx, [edi - 1]
mov eax, ebx
mov dword [edx], ecx
mov edx, dword [esi + 0x20]
pop edi
mov esi, dword [edx]
lea ecx, [esi + 1]
mov dword [edx], ecx
mov byte [esi], bl
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00472ead
mov esp, ebp
pop ebp
ret 4
cmp dword [esi + 0x4c], 0
je 0x41abc3
mov edi, dword [esi + 0xc]
lea eax, [esi + 0x3c]
cmp dword [edi], eax
jne 0x41ab14
mov edx, dword [esi + 0x54]
mov ecx, dword [esi + 0x50]
sub edx, ecx
mov dword [edi], ecx
mov eax, dword [esi + 0x1c]
mov dword [eax], ecx
mov eax, dword [esi + 0x2c]
mov dword [eax], edx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x41ab20
movsx eax, bl
jmp 0x41ab58
lea eax, [ebp - 0x2c]
mov byte [ebp - 0x25], bl
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x25]
push eax
lea eax, [esi + 0x40]
push eax
call dword [sym.imp.MSVCP140.dll_public:_int___thiscall_std::codecvt_char__char__struct__Mbstatet_::out_struct__Mbstatet___char_const___char_const___char_const____char___char___char___const]
sub eax, 0
je 0x41ab82
sub eax, 1
je 0x41ab82
sub eax, 2
jne 0x41abc3
movsx eax, byte [ebp - 0x25]
push dword [esi + 0x4c]
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
add esp, 8
or ecx, 0xffffffff
cmp eax, ecx
cmove ebx, ecx
pop edi
pop esi
mov eax, ebx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00472ead
mov esp, ebp
pop ebp
ret 4
mov edi, dword [ebp - 0x2c]
lea eax, [ebp - 0x24]
sub edi, eax
je 0x41aba0
push dword [esi + 0x4c]
push edi
push 1
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
add esp, 0x10
cmp edi, eax
jne 0x41abc3
lea ecx, [ebp - 0x25]
mov byte [esi + 0x3d], 1
or eax, 0xffffffff
cmp dword [ebp - 0x30], ecx
pop edi
pop esi
cmovne eax, ebx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00472ead
mov esp, ebp
pop ebp
ret 4
mov ecx, dword [ebp - 4]
or eax, 0xffffffff
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00472ead
mov esp, ebp
pop ebp
ret 4

Function at 0x41ae10
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 0xc]
mov edx, 0x811c9dc5
push edi
mov edi, dword [ebp + 8]
mov ecx, 0
sub esi, edi
je 0x41ae41
nop dword [eax]
movzx eax, byte [edi + ecx]
inc ecx
xor eax, edx
imul edx, eax, 0x1000193
cmp ecx, esi
jb 0x41ae30
pop edi
mov eax, edx
pop esi
pop ebp
ret 8
Function at 0x41d0f0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x487080]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, ecx
cmp dword [esi + 0x38], 0
je 0x41d1ac
cmp byte [esi + 0x3d], 0
je 0x41d1ac
mov eax, dword [esi]
push edi
push 0xffffffffffffffff
call dword [eax + 0xc]
cmp eax, 0xffffffff
je 0x41d19a
mov ecx, dword [esi + 0x38]
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [esi + 0x40]
push eax
call dword [sym.imp.MSVCP140.dll_public:_int___thiscall_std::codecvt_char__char__struct__Mbstatet_::unshift_struct__Mbstatet___char___char___char___const]
sub eax, 0
je 0x41d161
sub eax, 1
je 0x41d165
sub eax, 2
jne 0x41d19a
mov byte [esi + 0x3d], al
mov al, 1
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00472ead
mov esp, ebp
pop ebp
ret
mov byte [esi + 0x3d], 0
mov edi, dword [ebp - 0x28]
lea eax, [ebp - 0x24]
sub edi, eax
je 0x41d183
push dword [esi + 0x4c]
push edi
push 1
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
add esp, 0x10
cmp edi, eax
jne 0x41d19a
cmp byte [esi + 0x3d], 0
pop edi
sete al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00472ead
mov esp, ebp
pop ebp
ret
pop edi
xor al, al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00472ead
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
mov al, 1
xor ecx, ebp
pop esi
call fcn.00472ead
mov esp, ebp
pop ebp
ret
Function at 0x4238b0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
mov dword [ebp - 8], ecx
cmp edx, eax
je 0x423a21
cmp dword [edx + 0x1c], 0xf
mov eax, dword [ecx + 4]
mov dword [ebp - 0x1c], eax
mov eax, dword [ecx + 0xc]
push ebx
mov dword [ebp - 0x18], eax
lea ebx, [edx + 8]
mov eax, dword [edx + 4]
push esi
mov dword [ebp - 0xc], eax
mov esi, edx
jbe 0x4238e9
mov ebx, dword [edx + 8]
mov eax, dword [edx + 0x18]
xor edx, edx
push edi
mov edi, 0x811c9dc5
test eax, eax
je 0x423914
mov ecx, eax
nop word [eax + eax]
movzx eax, byte [ebx + edx]
inc edx
xor eax, edi
imul edi, eax, 0x1000193
cmp edx, ecx
jb 0x423900
mov ecx, dword [ebp - 8]
mov eax, dword [ecx + 0x18]
mov ecx, dword [ebp - 0x18]
and eax, edi
lea eax, [ecx + eax*8]
mov ecx, dword [eax]
mov dword [ebp - 0x10], eax
mov eax, dword [eax + 4]
mov dword [ebp - 4], ecx
mov dword [ebp - 0x14], eax
nop dword [eax]
mov edi, esi
mov ebx, esi
mov esi, dword [esi]
lea edx, [edi + 8]
call fcn.00424880
push 0x40
push edi
call fcn.00473531
mov eax, dword [ebp - 8]
add esp, 8
dec dword [eax + 8]
cmp ebx, dword [ebp - 0x14]
je 0x42397d
mov eax, dword [ebp + 0xc]
cmp esi, eax
jne 0x423930
mov ecx, dword [ebp - 4]
cmp ecx, dword [ebp + 8]
jne 0x423a16
mov ecx, dword [ebp - 0x10]
pop edi
mov dword [ecx], esi
mov ecx, dword [ebp - 0xc]
mov dword [ecx], esi
mov dword [esi + 4], ecx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
mov ecx, dword [ebp - 4]
cmp ecx, dword [ebp + 8]
mov ecx, dword [ebp - 0x10]
jne 0x42398f
mov eax, dword [ebp - 0x1c]
mov dword [ecx], eax
jmp 0x423992
mov eax, dword [ebp - 0xc]
mov dword [ecx + 4], eax
mov eax, dword [ebp + 0xc]
cmp esi, eax
je 0x423a16
nop dword [eax]
cmp dword [esi + 0x1c], 0xf
lea edi, [esi + 8]
jbe 0x4239ac
mov edi, dword [esi + 8]
mov ebx, dword [esi + 0x18]
xor ecx, ecx
mov edx, 0x811c9dc5
test ebx, ebx
je 0x4239d1
nop word [eax + eax]
movzx eax, byte [edi + ecx]
inc ecx
xor eax, edx
imul edx, eax, 0x1000193
cmp ecx, ebx
jb 0x4239c0
mov ecx, dword [ebp - 8]
mov eax, dword [ebp - 0x18]
and edx, dword [ecx + 0x18]
lea eax, [eax + edx*8]
mov dword [ebp - 4], eax
mov eax, dword [eax + 4]
mov dword [ebp - 0x14], eax
mov edi, esi
mov ebx, esi
mov esi, dword [esi]
lea edx, [edi + 8]
call fcn.00424880
push 0x40
push edi
call fcn.00473531
mov ecx, dword [ebp - 8]
add esp, 8
mov eax, dword [ebp + 0xc]
dec dword [ecx + 8]
cmp ebx, dword [ebp - 0x14]
je 0x423a27
cmp esi, eax
jne 0x4239e6
mov ecx, dword [ebp - 4]
mov dword [ecx], esi
mov ecx, dword [ebp - 0xc]
pop edi
mov dword [ecx], esi
mov dword [esi + 4], ecx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
mov ecx, dword [ebp - 4]
mov edx, dword [ebp - 0x1c]
mov dword [ecx], edx
mov dword [ecx + 4], edx
cmp esi, eax
jne 0x4239a0
mov ecx, dword [ebp - 0xc]
pop edi
mov dword [ecx], esi
mov dword [esi + 4], ecx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8