joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10053ca0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x9c
mov eax, dword [0x10081730]
xor eax, esp
mov dword [esp + 0x98], eax
mov eax, 0x903
mov word [esp + 8], ax
mov word [esp + 0xa], ax
mov eax, 0x9d7
mov word [esp + 0x20], ax
mov word [esp + 0x22], ax
mov eax, 0xa83
mov word [esp + 0x28], ax
mov word [esp + 0x2a], ax
mov eax, 0xb3e
mov word [esp + 0x38], ax
mov word [esp + 0x3a], ax
mov eax, 0xb40
mov word [esp + 0x3c], ax
mov word [esp + 0x3e], ax
mov eax, 0xb57
mov word [esp + 0x44], ax
mov word [esp + 0x46], ax
mov eax, 0xb83
mov word [esp + 0x48], ax
mov word [esp + 0x4a], ax
mov eax, 0xbd7
mov word [esp + 0x54], ax
mov word [esp + 0x56], ax
mov eax, 0xcbe
mov word [esp + 0x64], ax
mov word [esp + 0x66], ax
mov eax, 0xd57
mov word [esp + 0x80], ax
mov word [esp + 0x82], ax
mov eax, 0xf7f
mov word [esp], 0x300
mov word [esp + 2], 0x361
mov word [esp + 4], 0x483
mov word [esp + 6], 0x486
mov word [esp + 0xc], 0x93e
mov word [esp + 0xe], 0x940
mov word [esp + 0x10], 0x949
mov word [esp + 0x12], 0x94c
mov word [esp + 0x14], 0x982
mov word [esp + 0x16], 0x983
mov word [esp + 0x18], 0x9be
mov word [esp + 0x1a], 0x9c0
mov word [esp + 0x1c], 0x9c7
mov word [esp + 0x1e], 0x9cc
mov word [esp + 0x24], 0xa3e
mov word [esp + 0x26], 0xa40
mov word [esp + 0x2c], 0xabe
mov word [esp + 0x2e], 0xac0
mov word [esp + 0x30], 0xac9
mov word [esp + 0x32], 0xacc
mov word [esp + 0x34], 0xb02
mov word [esp + 0x36], 0xb03
mov word [esp + 0x40], 0xb47
mov word [esp + 0x42], 0xb4c
mov word [esp + 0x4c], 0xbbe
mov word [esp + 0x4e], 0xbbf
mov word [esp + 0x50], 0xbc1
mov word [esp + 0x52], 0xbcc
mov word [esp + 0x58], 0xc01
mov word [esp + 0x5a], 0xc03
mov word [esp + 0x5c], 0xc41
mov word [esp + 0x5e], 0xc44
mov word [esp + 0x60], 0xc82
mov word [esp + 0x62], 0xc83
mov word [esp + 0x68], 0xcc0
mov word [esp + 0x6a], 0xcc4
mov word [esp + 0x6c], 0xcc7
mov word [esp + 0x6e], 0xccb
mov word [esp + 0x70], 0xcd5
mov word [esp + 0x72], 0xcd6
mov word [esp + 0x74], 0xd02
mov word [esp + 0x76], 0xd03
mov word [esp + 0x78], 0xd3e
mov word [esp + 0x7a], 0xd40
mov word [esp + 0x7c], 0xd46
mov word [esp + 0x7e], 0xd4c
mov word [esp + 0x84], ax
mov word [esp + 0x86], ax
mov word [esp + 0x88], 0x20d0
mov word [esp + 0x8a], 0x20e1
cmp cx, 0x361
mov eax, 0xffff
mov word [esp + 0x94], ax
mov word [esp + 0x96], ax
mov word [esp + 0x8c], 0x3099
mov word [esp + 0x8e], 0x309a
mov word [esp + 0x90], 0xfe20
mov word [esp + 0x92], 0xfe23
lea eax, [esp + 2]
jbe 0x10053f0a
add eax, 4
cmp word [eax], cx
jb 0x10053f02
sub eax, 2
cmp cx, word [eax]
jb 0x10053f2f
cmp cx, word [eax + 2]
ja 0x10053f2f
mov al, 1
mov ecx, dword [esp + 0x98]
xor ecx, esp
call fcn.10031c08
add esp, 0x9c
ret
mov ecx, dword [esp + 0x98]
xor ecx, esp
xor al, al
call fcn.10031c08
add esp, 0x9c
ret
Function at 0x10054620
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x1005ee08
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x10081730]
xor eax, esp
push eax
lea eax, [esp + 0x10]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0xc], esi
mov edi, dword [esp + 0x20]
push edi
call fcn.1000223d
test edi, edi
mov dword [esp + 0x18], 0
je 0x10054664
add edi, 0x28
jmp 0x10054666
xor edi, edi
mov dword [esi + 0x28], vtable.boost::exception.0
mov ecx, dword [edi + 4]
test ecx, ecx
mov dword [esi + 0x2c], ecx
je 0x1005467e
mov eax, dword [ecx]
mov edx, dword [eax + 0xc]
call edx
mov eax, dword [edi + 8]
mov dword [esi + 0x30], eax
mov ecx, dword [edi + 0xc]
mov dword [esi + 0x34], ecx
mov edx, dword [edi + 0x10]
mov dword [esi + 0x38], edx
mov dword [esi], vtable.boost::exception_detail::error_info_injector_class_std::logic_error_.1.0
mov dword [esi + 0x28], vtable.boost::exception_detail::error_info_injector_class_std::logic_error_.0
mov eax, esi
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x10
ret 4

Function at 0x100546c0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x1005ee43
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x10081730]
xor eax, esp
push eax
lea eax, [esp + 0x14]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0x10], esi
mov edi, dword [esp + 0x24]
push edi
call fcn.10054620
mov dword [esp + 0x1c], 0
mov dword [esi + 0x3c], vtable.boost::exception_detail::clone_base.0
test edi, edi
mov byte [esp + 0x1c], 1
mov dword [esi], vtable.boost::exception_detail::clone_impl_struct_boost::exception_detail::error_info_injector_class_std::logic_error__.2.0
mov dword [esi + 0x28], vtable.boost::exception_detail::clone_impl_struct_boost::exception_detail::error_info_injector_class_std::logic_error__.1.0
mov dword [esi + 0x3c], vtable.boost::exception_detail::clone_impl_struct_boost::exception_detail::error_info_injector_class_std::logic_error__.0
je 0x10054725
lea ebx, [edi + 0x28]
jmp 0x10054727
xor ebx, ebx
mov ecx, dword [esi + 0x2c]
test ecx, ecx
mov edi, dword [ebx + 4]
je 0x10054738
mov eax, dword [ecx]
mov edx, dword [eax + 0x10]
call edx
test edi, edi
mov dword [esi + 0x2c], edi
je 0x10054748
mov eax, dword [edi]
mov edx, dword [eax + 0xc]
mov ecx, edi
call edx
mov eax, dword [ebx + 8]
mov dword [esi + 0x30], eax
mov ecx, dword [ebx + 0xc]
mov dword [esi + 0x34], ecx
mov edx, dword [ebx + 0x10]
mov dword [esi + 0x38], edx
mov eax, esi
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x10
ret 4
Function at 0x10054780
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x1005ee68
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x10081730]
xor eax, esp
push eax
lea eax, [esp + 0x10]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0xc], esi
mov edi, dword [esp + 0x20]
push edi
call fcn.10024b07
mov dword [esi], vtable.boost::regex_error.0
mov eax, dword [edi + 0x28]
mov dword [esi + 0x28], eax
mov ecx, dword [edi + 0x2c]
mov dword [esi + 0x2c], ecx
mov dword [esi + 0x30], vtable.boost::exception.0
mov ecx, dword [edi + 0x34]
test ecx, ecx
mov dword [esp + 0x18], 0
mov dword [esi + 0x34], ecx
je 0x100547e5
mov edx, dword [ecx]
mov eax, dword [edx + 0xc]
call eax
mov ecx, dword [edi + 0x38]
mov dword [esi + 0x38], ecx
mov edx, dword [edi + 0x3c]
mov dword [esi + 0x3c], edx
mov eax, dword [edi + 0x40]
mov dword [esi + 0x40], eax
mov dword [esi], vtable.boost::exception_detail::error_info_injector_class_boost::regex_error_.1.0
mov dword [esi + 0x30], vtable.boost::exception_detail::error_info_injector_class_boost::regex_error_.0
mov eax, esi
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x10
ret 4

Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..text
mov ebx, 0x408ecc
nop
nop
mov ecx, 0x6dd94245
nop
nop
test eax, eax
nop
nop
nop
nop
nop
nop
je 0x43004e
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
jne 0x430024
nop
mov eax, section..rsrc
mov ebx, 0x42e1d0
nop
nop
mov ecx, 0x589a22f2
nop
nop
test eax, eax
nop
nop
nop
nop
je 0x430084
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
add eax, 4
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
jne 0x43006c
nop
popal
nop
nop
nop
nop
nop
jmp 0x401219
Function at 0x401e1e
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xcc
mov eax, dword [0x4a4fec]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, 0x4800b8
mov dword [ebp - 0x48], eax
mov dword [ebp - 0x40], eax
mov eax, 0x47fd28
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], eax
movzx eax, byte [ebp + 8]
push eax
push 0x4a93b8
push 0x47fce4
lea eax, [ebp - 0xcc]
push 0x18
push eax
mov dword [ebp - 0xcc], 0x4800ac
mov dword [ebp - 0xc8], 0x480094
mov dword [ebp - 0xc4], 0x48008c
mov dword [ebp - 0xc0], 0x480078
mov dword [ebp - 0xbc], 0x480070
mov dword [ebp - 0xb8], 0x48005c
mov dword [ebp - 0xb4], 0x480054
mov dword [ebp - 0xb0], 0x48003c
mov dword [ebp - 0xac], 0x480038
mov dword [ebp - 0xa8], 0x480028
mov dword [ebp - 0xa4], 0x48001c
mov dword [ebp - 0xa0], 0x480004
mov dword [ebp - 0x9c], 0x47fff8
mov dword [ebp - 0x98], 0x47ffe0
mov dword [ebp - 0x94], 0x47ffd4
mov dword [ebp - 0x90], 0x47ffb8
mov dword [ebp - 0x8c], 0x47ffac
mov dword [ebp - 0x88], 0x47ff94
mov dword [ebp - 0x84], 0x47ff84
mov dword [ebp - 0x80], 0x47ff68
mov dword [ebp - 0x7c], 0x47ff54
mov dword [ebp - 0x78], 0x47ff3c
mov dword [ebp - 0x74], 0x47ff2c
mov dword [ebp - 0x70], 0x47ff10
mov dword [ebp - 0x6c], 0x47ff00
mov dword [ebp - 0x68], 0x47fee4
mov dword [ebp - 0x64], 0x47fed0
mov dword [ebp - 0x60], 0x47feb0
mov dword [ebp - 0x5c], 0x47fea4
mov dword [ebp - 0x58], 0x47fe8c
mov dword [ebp - 0x54], 0x47fe74
mov dword [ebp - 0x50], 0x47fe50
mov dword [ebp - 0x4c], 0x47fe40
mov dword [ebp - 0x44], 0x47fe2c
mov dword [ebp - 0x3c], 0x47fe20
mov dword [ebp - 0x38], 0x47fe08
mov dword [ebp - 0x34], 0x47fdf8
mov dword [ebp - 0x30], 0x47fddc
mov dword [ebp - 0x2c], 0x47fdcc
mov dword [ebp - 0x28], 0x47fdb0
mov dword [ebp - 0x24], 0x47fda4
mov dword [ebp - 0x20], 0x47fd8c
mov dword [ebp - 0x1c], 0x47fd80
mov dword [ebp - 0x18], 0x47fd68
mov dword [ebp - 0x14], 0x47fd5c
mov dword [ebp - 0x10], 0x47fd44
call fcn.00401da4
mov ecx, dword [ebp - 4]
add esp, 0x14
neg eax
sbb eax, eax
xor ecx, ebp
neg eax
call fcn.0043cac0
leave
ret

Function at 0x431006
Capabilities:
Encode data using xor

Disassembly:
call 0x43100c
nop
nop
nop
nop
nop
pop eax
nop
add eax, 0x403e6a
nop
sub eax, 0x403e10
nop
nop
nop
mov ebx, dword [eax]
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
xor dword [ebx], edx
nop
nop
nop
nop
nop
add ebx, 4
cmp ebx, ecx
nop
nop
nop
nop
nop
nop
jl 0x431030
nop
nop
nop
nop
add eax, 0xc
nop
nop
nop
cmp dword [eax], 0
nop
nop
nop
jne 0x43101e
nop
nop
nop
nop
nop
nop
nop
popal
jmp fcn.00401219
Function at 0x42e000
Capabilities:
Encode data using xor

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
nop
mov ebx, 0x407ef8
mov ecx, 0x235164ed
nop
test eax, eax
nop
nop
nop
nop
je 0x42e04e
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x42e024
nop
nop
mov eax, section..data
nop
mov ebx, 0x42cd70
nop
mov ecx, 0x2196043f
nop
nop
nop
test eax, eax
nop
nop
nop
nop
je 0x42e084
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
add eax, 4
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
jne 0x42e06c
nop
popal
nop
nop
nop
nop
nop
jmp 0x401219

Function at 0x430006
Capabilities:
Encode data using xor

Disassembly:
call 0x43000c
nop
pop eax
nop
nop
nop
nop
nop
add eax, 0x403daa
nop
sub eax, 0x403d50
mov ebx, dword [eax]
nop
nop
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
mov edx, dword [eax + 8]
nop
nop
xor dword [ebx], edx
nop
nop
nop
nop
nop
nop
nop
add ebx, 4
nop
cmp ebx, ecx
nop
nop
nop
nop
nop
nop
nop
jl 0x430030
nop
add eax, 0xc
nop
nop
nop
cmp dword [eax], 0
nop
nop
nop
jne 0x43001e
nop
nop
nop
nop
nop
nop
nop
nop
popal
jmp loc.00401219
Function at 0x405e70
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0xc
mov eax, dword [ebp + 0x10]
push ebx
mov ebx, ecx
mov ecx, dword [ebp + 0xc]
push esi
push edi
mov edi, dword [ebp + 8]
mov dword [esp + 0xc], edi
test eax, eax
jg 0x405ea2
jl 0x405e95
test ecx, ecx
jne 0x405ea2
xor eax, eax
xor edx, edx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
cmp dword [ebx + 0x38], 0
je 0x405f62
mov dword [esp + 0x10], ecx
mov dword [esp + 0xc], eax
mov ecx, ebx
call fcn.00409c10
mov esi, eax
mov eax, edx
mov dword [esp + 0x14], eax
test eax, eax
jl 0x405f0e
jg 0x405ecd
test esi, esi
je 0x405f0e
mov ecx, dword [esp + 0xc]
cmp ecx, eax
jg 0x405ee5
mov eax, dword [esp + 0x10]
jl 0x405edf
cmp eax, esi
jae 0x405ee5
mov esi, eax
mov dword [esp + 0x14], ecx
mov eax, dword [ebx + 0x1c]
push esi
push dword [eax]
push edi
call fcn.00431ff0
mov eax, dword [ebx + 0x2c]
add esp, 0xc
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 0xc]
sub ecx, esi
sbb edx, dword [esp + 0x14]
sub dword [eax], esi
mov eax, dword [ebx + 0x1c]
add dword [eax], esi
jmp 0x405f2f
mov eax, dword [ebx]
mov ecx, ebx
call dword [eax + 0x1c]
mov edx, dword [esp + 0xc]
cmp eax, 0xffffffff
je 0x405f4b
mov ecx, dword [esp + 0x10]
mov esi, 1
add ecx, 0xffffffff
mov byte [edi], al
adc edx, 0xffffffff
add edi, esi
mov dword [esp + 0xc], edx
mov dword [esp + 0x10], ecx
test edx, edx
jg 0x405eb4
jl 0x405f4b
test ecx, ecx
jne 0x405eb4
mov eax, dword [ebp + 0xc]
sub eax, dword [esp + 0x10]
mov ecx, dword [ebp + 0x10]
sbb ecx, edx
mov edx, ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov eax, dword [ebx + 0x1c]
lea esi, [ebx + 0x2c]
mov edi, ecx
mov edx, dword [eax]
test edx, edx
je 0x405fa6
mov eax, dword [esi]
mov eax, dword [eax]
test eax, eax
je 0x405fa6
mov edi, dword [esp + 0xc]
cmp eax, ecx
mov esi, ecx
cmovb esi, eax
push esi
push edx
push edi
call fcn.00431ff0
mov eax, dword [ebx + 0x2c]
add edi, esi
mov dword [esp + 0x18], edi
add esp, 0xc
mov edi, dword [ebp + 0xc]
sub edi, esi
sub dword [eax], esi
mov eax, dword [ebx + 0x1c]
add dword [eax], esi
lea esi, [ebx + 0x2c]
cmp dword [ebx + 0x4c], 0
je 0x406017
mov ecx, dword [ebx + 0xc]
lea eax, [ebx + 0x3c]
cmp dword [ecx], eax
jne 0x405fcc
mov eax, dword [ebx + 0xc]
mov edx, dword [ebx + 0x54]
mov ecx, dword [ebx + 0x50]
sub edx, ecx
mov dword [eax], ecx
mov eax, dword [ebx + 0x1c]
mov dword [eax], ecx
mov eax, dword [esi]
mov dword [eax], edx
mov esi, dword [esp + 0xc]
cmp edi, 0xfff
jbe 0x406002
nop dword [eax + eax]
push dword [ebx + 0x4c]
push 0xfff
push 1
push esi
call fcn.0044e4e0
add esp, 0x10
add esi, eax
sub edi, eax
cmp eax, 0xfff
jne 0x406017
cmp edi, eax
ja 0x405fe0
test edi, edi
je 0x406017
push dword [ebx + 0x4c]
push edi
push 1
push esi
call fcn.0044e4e0
add esp, 0x10
sub edi, eax
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 0x10]
sub eax, edi
pop edi
pop esi
sbb edx, 0
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x40bc40
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x487890
mov eax, dword fs:[0]
push eax
push ebx
push esi
push edi
mov eax, dword [0x4ae0c0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
push 0x46
push str.D:_vs2022CommunityVCToolsMSVC14.38.33130includexlocale
push 2
lea ebx, [esi + 4]
mov dword [esi], vtable.std::basic_streambuf_char__struct_std::char_traits_char__.0
push 8
mov dword [ebx], 0
mov dword [esi + 8], 0
mov dword [esi + 0xc], 0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
mov dword [esi + 0x18], 0
mov dword [esi + 0x1c], 0
mov dword [esi + 0x20], 0
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x2c], 0
mov dword [esi + 0x30], 0
call fcn.0043e2b0
mov edi, eax
add esp, 0x10
test edi, edi
je 0x40bd55
xorps xmm0, xmm0
movq qword [edi], xmm0
push 1
mov dword [ebp - 4], 0
call fcn.0042b8e0
mov dword [edi + 4], eax
lea ecx, [esi + 0x14]
mov dword [esi + 0x34], edi
lea eax, [esi + 8]
mov dword [esi + 0xc], ebx
lea edx, [esi + 0x18]
mov dword [esi + 0x10], eax
lea edi, [esi + 0x24]
mov dword [esi + 0x1c], ecx
lea ebx, [esi + 0x28]
mov dword [esi + 0x20], edx
add esp, 4
mov dword [esi + 0x2c], edi
mov dword [esi + 0x30], ebx
mov dword [eax], 0
mov eax, esi
mov dword [edx], 0
mov dword [esi + 0x28], 0
mov dword [esi + 4], 0
mov dword [ecx], 0
mov dword [edi], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
call fcn.0042b220
int3
Function at 0x41f9b0
Capabilities:
Access peb ldr_data

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x488ee3
mov eax, dword fs:[0]
push eax
push ebx
sub esp, 8
push esi
push edi
mov eax, dword [0x4ae0c0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x18], edi
push dword [ebx + 8]
push dword [ebx + 0x10]
push dword [ebx + 0xc]
call fcn.0041f3a0
mov dword [ebp - 4], 0
lea esi, [edi + 0x14]
mov dword [edi], vtable.std::filesystem::filesystem_error.0
mov byte [ebp - 4], 1
xorps xmm0, xmm0
mov dword [esi], 0
movups xmmword [esi + 4], xmm0
push 8
mov dword [esi + 0x14], 0
mov dword [esi + 0x18], 0
call fcn.0042f4f0
add esp, 4
mov dword [eax + 4], 0
mov dword [esi], eax
mov dword [eax], esi
xor eax, eax
mov dword [esi + 0x14], 0
mov dword [esi + 0x18], 7
mov word [esi + 4], ax
lea esi, [edi + 0x30]
mov byte [ebp - 4], 3
xorps xmm0, xmm0
mov dword [esi], eax
movups xmmword [esi + 4], xmm0
push 8
mov dword [esi + 0x14], eax
mov dword [esi + 0x18], eax
call fcn.0042f4f0
add esp, 4
mov dword [eax + 4], 0
mov dword [esi], eax
mov dword [eax], esi
xor eax, eax
mov dword [esi + 0x14], 0
mov dword [esi + 0x18], 7
mov word [esi + 4], ax
mov byte [ebp - 4], 4
lea ecx, [edi + 0x4c]
mov eax, dword [edi + 4]
mov esi, str.Unknown_exception
test eax, eax
mov dword [ecx], 0
xorps xmm0, xmm0
cmovne esi, eax
mov eax, esi
movups xmmword [ecx + 4], xmm0
mov dword [ecx + 0x14], 0
mov dword [ecx + 0x18], 0
lea edx, [eax + 1]
mov dword [ebp - 0x14], edx
nop dword [eax]
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x41fad0
sub eax, dword [ebp - 0x14]
push eax
push esi
call fcn.0040dbe0
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret 0xc
Function at 0x41fb00
Capabilities:
Access peb ldr_data

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x488f2b
mov eax, dword fs:[0]
push eax
push ebx
sub esp, 0x28
push esi
push edi
mov eax, dword [0x4ae0c0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x34], edi
mov eax, dword [ebx + 8]
mov esi, dword [ebx + 0xc]
push eax
mov dword [ebp - 0x38], edi
push dword [ebx + 0x14]
mov dword [ebp - 0x30], esi
push dword [ebx + 0x10]
call fcn.0041f3a0
mov dword [ebp - 4], 0
lea ecx, [edi + 0x14]
push esi
mov dword [edi], vtable.std::filesystem::filesystem_error.0
call fcn.00407220
lea esi, [edi + 0x30]
xorps xmm0, xmm0
movups xmmword [esi], xmm0
movq qword [esi + 0x10], xmm0
mov dword [esi + 0x18], 0
mov byte [ebp - 4], 2
mov dword [esi], 0
movups xmmword [esi + 4], xmm0
push 8
mov dword [esi + 0x14], 0
mov dword [esi + 0x18], 0
call fcn.0042f4f0
add esp, 4
mov dword [eax + 4], 0
mov dword [esi], eax
mov dword [eax], esi
xor eax, eax
mov dword [esi + 0x14], 0
mov dword [esi + 0x18], 7
mov word [esi + 4], ax
xorps xmm0, xmm0
mov dword [ebp - 0x14], eax
movups xmmword [ebp - 0x2c], xmm0
movq qword [ebp - 0x1c], xmm0
mov byte [ebp - 4], 4
push 8
mov dword [ebp - 0x2c], eax
movups xmmword [ebp - 0x28], xmm0
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], eax
call fcn.0042f4f0
lea ecx, [ebp - 0x2c]
mov dword [eax + 4], 0
mov dword [ebp - 0x2c], eax
mov dword [eax], ecx
xor eax, eax
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 7
mov word [ebp - 0x28], ax
mov byte [ebp - 4], 5
mov eax, str.Unknown_exception
mov ecx, dword [edi + 4]
test ecx, ecx
push ecx
cmovne eax, ecx
mov edx, esp
mov dword [edx], eax
lea esi, [eax + 1]
nop dword [eax + eax]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x41fc30
sub eax, esi
lea ecx, [edi + 0x4c]
mov dword [edx + 4], eax
lea eax, [ebp - 0x2c]
mov edx, dword [ebp - 0x30]
push eax
call fcn.0041fca0
add esp, 0xc
lea ecx, [ebp - 0x2c]
call fcn.00409c60
mov ecx, dword [ebp - 0x2c]
push 8
push ecx
mov dword [ebp - 0x2c], 0
call fcn.0042f4d0
add esp, 8
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret 0x10
Function at 0x426e60
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
mov ebx, ecx
mov eax, 0x1fffffff
bsr ecx, eax
push esi
mov esi, 1
mov dword [ebp - 0x14], ebx
mov eax, esi
shl eax, cl
mov ecx, dword [ebp + 8]
push edi
cmp ecx, eax
ja 0x426fcd
lea eax, [ecx - 1]
or eax, esi
bsr ecx, eax
mov eax, dword [ebx + 8]
push eax
mov dword [ebp - 8], eax
lea ecx, [ecx + 1]
shl esi, cl
lea ecx, [ebx + 0x10]
lea eax, [esi + esi]
push eax
call fcn.004257e0
lea eax, [esi - 1]
mov dword [ebx + 0x24], esi
mov dword [ebx + 0x20], eax
mov esi, dword [ebx + 8]
mov eax, dword [ebp - 8]
mov esi, dword [esi]
mov edi, esi
cmp esi, eax
je 0x426fa8
cmp dword [esi + 0x20], 0xf
mov ecx, dword [esi + 0x1c]
mov edi, dword [edi]
mov dword [ebp - 0xc], ecx
lea ecx, [esi + 0xc]
mov dword [ebp - 0x10], edi
mov dword [ebp - 4], ecx
jbe 0x426ee1
mov ecx, dword [ecx]
mov dword [ebp - 4], ecx
xor edx, edx
mov ebx, 0x811c9dc5
cmp dword [ebp - 0xc], edx
jbe 0x426f0a
mov eax, dword [ebp - 4]
mov edi, dword [ebp - 0xc]
movzx ecx, byte [edx + eax]
inc edx
xor ecx, ebx
imul ebx, ecx, 0x1000193
cmp edx, edi
jb 0x426ef3
mov edi, dword [ebp - 0x10]
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 0x14]
mov edx, dword [ecx + 0x20]
mov ecx, dword [ecx + 0x14]
and edx, ebx
lea ecx, [ecx + edx*8]
mov dword [ebp - 4], ecx
cmp dword [ecx], eax
jne 0x426f26
mov dword [ecx], esi
mov dword [ecx + 4], esi
jmp 0x426f9e
mov ebx, dword [ecx + 4]
lea ecx, [esi + 8]
lea edx, [ebx + 8]
call fcn.00425fb0
test al, al
je 0x426f5e
mov ebx, dword [ebx]
cmp ebx, esi
je 0x426f56
mov edx, dword [esi + 4]
mov dword [edx], edi
mov ecx, dword [edi + 4]
mov dword [ecx], ebx
mov eax, dword [ebx + 4]
mov dword [eax], esi
mov dword [ebx + 4], ecx
mov dword [edi + 4], edx
mov dword [esi + 4], eax
mov eax, dword [ebp - 4]
mov dword [eax + 4], esi
jmp 0x426f9b
mov eax, dword [ebp - 4]
cmp dword [eax], ebx
je 0x426f7e
mov ebx, dword [ebx + 4]
lea ecx, [esi + 8]
lea edx, [ebx + 8]
call fcn.00425fb0
test al, al
jne 0x426fb1
mov eax, dword [ebp - 4]
cmp dword [eax], ebx
jne 0x426f65
mov edx, dword [esi + 4]
mov dword [edx], edi
mov ecx, dword [edi + 4]
mov dword [ecx], ebx
mov eax, dword [ebx + 4]
mov dword [eax], esi
mov dword [ebx + 4], ecx
mov dword [edi + 4], edx
mov dword [esi + 4], eax
mov eax, dword [ebp - 4]
mov dword [eax], esi
mov eax, dword [ebp - 8]
mov esi, edi
cmp edi, eax
jne 0x426ec5
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
mov edx, dword [esi + 4]
mov ebx, dword [ebx]
mov dword [edx], edi
mov ecx, dword [edi + 4]
mov dword [ecx], ebx
mov eax, dword [ebx + 4]
mov dword [eax], esi
mov dword [ebx + 4], ecx
mov dword [edi + 4], edx
mov dword [esi + 4], eax
jmp 0x426f9b
push str.invalid_hash_bucket_count
call fcn.0042b290
int3
Function at 0x429cd0
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push 2
lea eax, [ebp - 4]
push eax
push 0x20000001
push str._x_sys_default_locale
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoEx]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x429cfc
mov dword [ebp - 4], 0
push 0
push 0
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp - 4]
push edx
mov eax, dword [ebp + 8]
push eax
push 0
push 0x1300
call dword [sym.imp.KERNEL32.dll_FormatMessageA]
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp - 0xc]
push ecx
mov edx, dword [ebp + 0xc]
mov eax, dword [edx]
push eax
call fcn.00429c90
mov esp, ebp
pop ebp
ret 8

Function at 0x434df0
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
call fcn.00434a10
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x434e22
mov eax, dword [ebp - 4]
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp + 8]
push ecx
mov edx, dword [ebp - 0xc]
mov dword [ebp - 8], edx
mov ecx, dword [ebp - 8]
call dword [0x48b1a4]
call dword [ebp - 8]
jmp 0x434e2c
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov esp, ebp
pop ebp
ret