joyce8/EMBER2024-capa huggingface dataset:
Function at 0x466fe0
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0x31], 0
je 0x467002
xor eax, eax
jmp 0x466ff0
lea edx, [eax + esi]
lea ecx, [eax - 0xc]
inc eax
xor byte [edx], cl
cmp eax, 0x30
jb 0x466ff0
mov byte [esi + 0x31], 0
pop esi
ret

Function at 0x467010
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0x35], 0
je 0x467032
xor eax, eax
jmp 0x467020
lea edx, [eax + esi]
lea ecx, [eax - 0xc]
inc eax
xor byte [edx], cl
cmp eax, 0x34
jb 0x467020
mov byte [esi + 0x35], 0
pop esi
ret

Function at 0x467040
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0x37], 0
je 0x467062
xor eax, eax
jmp 0x467050
lea edx, [eax + esi]
lea ecx, [eax - 0xc]
inc eax
xor byte [edx], cl
cmp eax, 0x36
jb 0x467050
mov byte [esi + 0x37], 0
pop esi
ret

Function at 0x467070
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0x1e], 0
je 0x467092
xor eax, eax
jmp 0x467080
lea edx, [eax + esi]
lea ecx, [eax - 0xc]
inc eax
xor byte [edx], cl
cmp eax, 0x1d
jb 0x467080
mov byte [esi + 0x1e], 0
pop esi
ret

Function at 0x4672b0
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0x57], 0
je 0x4672d2
xor eax, eax
jmp 0x4672c0
lea edx, [eax + esi]
lea ecx, [eax - 0xc]
inc eax
xor byte [edx], cl
cmp eax, 0x56
jb 0x4672c0
mov byte [esi + 0x57], 0
pop esi
ret

Function at 0x4672e0
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0x21], 0
je 0x467302
xor eax, eax
jmp 0x4672f0
lea edx, [eax + esi]
lea ecx, [eax - 0xc]
inc eax
xor byte [edx], cl
cmp eax, 0x20
jb 0x4672f0
mov byte [esi + 0x21], 0
pop esi
ret

Function at 0x467330
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0x23], 0
je 0x467352
xor eax, eax
jmp 0x467340
lea edx, [eax + esi]
lea ecx, [eax - 0xc]
inc eax
xor byte [edx], cl
cmp eax, 0x22
jb 0x467340
mov byte [esi + 0x23], 0
pop esi
ret

Function at 0x467360
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0x1b], 0
je 0x467382
xor eax, eax
jmp 0x467370
lea edx, [eax + esi]
lea ecx, [eax - 0xc]
inc eax
xor byte [edx], cl
cmp eax, 0x1a
jb 0x467370
mov byte [esi + 0x1b], 0
pop esi
ret

Function at 0x467390
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0x5a], 0
je 0x4673b2
xor eax, eax
jmp 0x4673a0
lea edx, [eax + esi]
lea ecx, [eax - 0xc]
inc eax
xor byte [edx], cl
cmp eax, 0x59
jb 0x4673a0
mov byte [esi + 0x5a], 0
pop esi
ret

Function at 0x4673c0
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0x25], 0
je 0x4673e2
xor eax, eax
jmp 0x4673d0
lea edx, [eax + esi]
lea ecx, [eax - 0xc]
inc eax
xor byte [edx], cl
cmp eax, 0x24
jb 0x4673d0
mov byte [esi + 0x25], 0
pop esi
ret

Function at 0x4673f0
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0x17], 0
je 0x467412
xor eax, eax
jmp 0x467400
lea edx, [eax + esi]
lea ecx, [eax - 0xc]
inc eax
xor byte [edx], cl
cmp eax, 0x16
jb 0x467400
mov byte [esi + 0x17], 0
pop esi
ret
Function at 0x467420
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0x5c], 0
je 0x467442
xor eax, eax
jmp 0x467430
lea edx, [eax + esi]
lea ecx, [eax - 0xc]
inc eax
xor byte [edx], cl
cmp eax, 0x5b
jb 0x467430
mov byte [esi + 0x5c], 0
pop esi
ret

Function at 0x467450
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0x27], 0
je 0x467472
xor eax, eax
jmp 0x467460
lea edx, [eax + esi]
lea ecx, [eax - 0xc]
inc eax
xor byte [edx], cl
cmp eax, 0x26
jb 0x467460
mov byte [esi + 0x27], 0
pop esi
ret

Function at 0x467480
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0x2e], 0
je 0x4674a2
xor eax, eax
jmp 0x467490
lea edx, [eax + esi]
lea ecx, [eax - 0xc]
inc eax
xor byte [edx], cl
cmp eax, 0x2d
jb 0x467490
mov byte [esi + 0x2e], 0
pop esi
ret

Function at 0x4674b0
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0x1a], 0
je 0x4674d2
xor eax, eax
jmp 0x4674c0
lea edx, [eax + esi]
lea ecx, [eax - 0xc]
inc eax
xor byte [edx], cl
cmp eax, 0x19
jb 0x4674c0
mov byte [esi + 0x1a], 0
pop esi
ret

Function at 0x4676c0
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0x1d], 0
je 0x4676e2
xor eax, eax
jmp 0x4676d0
lea edx, [eax + esi]
lea ecx, [eax - 0xc]
inc eax
xor byte [edx], cl
cmp eax, 0x1c
jb 0x4676d0
mov byte [esi + 0x1d], 0
pop esi
ret

Function at 0x4676f0
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0x34], 0
je 0x467712
xor eax, eax
jmp 0x467700
lea edx, [eax + esi]
lea ecx, [eax - 0xc]
inc eax
xor byte [edx], cl
cmp eax, 0x33
jb 0x467700
mov byte [esi + 0x34], 0
pop esi
ret

Function at 0x467720
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0x14], 0
je 0x467742
xor eax, eax
jmp 0x467730
lea edx, [eax + esi]
lea ecx, [eax - 0xc]
inc eax
xor byte [edx], cl
cmp eax, 0x13
jb 0x467730
mov byte [esi + 0x14], 0
pop esi
ret

Function at 0x467750
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0xf], 0
je 0x467772
xor eax, eax
jmp 0x467760
lea edx, [eax + esi]
lea ecx, [eax - 0xc]
inc eax
xor byte [edx], cl
cmp eax, 0xe
jb 0x467760
mov byte [esi + 0xf], 0
pop esi
ret

Function at 0x467780
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0x22], 0
je 0x4677a2
xor eax, eax
jmp 0x467790
lea edx, [eax + esi]
lea ecx, [eax - 0xc]
inc eax
xor byte [edx], cl
cmp eax, 0x21
jb 0x467790
mov byte [esi + 0x22], 0
pop esi
ret

Function at 0x4677b0
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0x15], 0
je 0x4677d2
xor eax, eax
jmp 0x4677c0
lea edx, [eax + esi]
lea ecx, [eax - 0xc]
inc eax
xor byte [edx], cl
cmp eax, 0x14
jb 0x4677c0
mov byte [esi + 0x15], 0
pop esi
ret

Function at 0x4677e0
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0x18], 0
je 0x467802
xor eax, eax
jmp 0x4677f0
lea edx, [eax + esi]
lea ecx, [eax - 0xc]
inc eax
xor byte [edx], cl
cmp eax, 0x17
jb 0x4677f0
mov byte [esi + 0x18], 0
pop esi
ret
Function at 0x467810
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0x1c], 0
je 0x467832
xor eax, eax
jmp 0x467820
lea edx, [eax + esi]
lea ecx, [eax - 0xc]
inc eax
xor byte [edx], cl
cmp eax, 0x1b
jb 0x467820
mov byte [esi + 0x1c], 0
pop esi
ret

Function at 0x467840
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0x2d], 0
je 0x467862
xor eax, eax
jmp 0x467850
lea edx, [eax + esi]
lea ecx, [eax - 0xc]
inc eax
xor byte [edx], cl
cmp eax, 0x2c
jb 0x467850
mov byte [esi + 0x2d], 0
pop esi
ret

Function at 0x4679a0
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0x13], 0
je 0x4679c2
xor eax, eax
jmp 0x4679b0
lea edx, [eax + esi]
lea ecx, [eax - 0xc]
inc eax
xor byte [edx], cl
cmp eax, 0x12
jb 0x4679b0
mov byte [esi + 0x13], 0
pop esi
ret

Function at 0x4679d0
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0xd], 0
je 0x4679f2
xor eax, eax
jmp 0x4679e0
lea edx, [eax + esi]
lea ecx, [eax - 0xc]
inc eax
xor byte [edx], cl
cmp eax, 0xc
jb 0x4679e0
mov byte [esi + 0xd], 0
pop esi
ret

Function at 0x467a00
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0xb], 0
je 0x467a22
xor eax, eax
jmp 0x467a10
lea edx, [eax + esi]
lea ecx, [eax - 0xc]
inc eax
xor byte [edx], cl
cmp eax, 0xa
jb 0x467a10
mov byte [esi + 0xb], 0
pop esi
ret

Function at 0x467a30
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 9], 0
je 0x467a52
xor eax, eax
jmp 0x467a40
lea edx, [eax + esi]
lea ecx, [eax - 0xc]
inc eax
xor byte [edx], cl
cmp eax, 8
jb 0x467a40
mov byte [esi + 9], 0
pop esi
ret

Function at 0x467a60
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0x10], 0
je 0x467a82
xor eax, eax
jmp 0x467a70
lea edx, [eax + esi]
lea ecx, [eax - 0xc]
inc eax
xor byte [edx], cl
cmp eax, 0xf
jb 0x467a70
mov byte [esi + 0x10], 0
pop esi
ret

Function at 0x467a90
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0x11], 0
je 0x467ab2
xor eax, eax
jmp 0x467aa0
lea edx, [eax + esi]
lea ecx, [eax - 0xc]
inc eax
xor byte [edx], cl
cmp eax, 0x10
jb 0x467aa0
mov byte [esi + 0x11], 0
pop esi
ret

Function at 0x467ac0
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 7], 0
je 0x467ae2
xor eax, eax
jmp 0x467ad0
lea edx, [eax + esi]
lea ecx, [eax - 0xc]
inc eax
xor byte [edx], cl
cmp eax, 6
jb 0x467ad0
mov byte [esi + 7], 0
pop esi
ret

Function at 0x467af0
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0x33], 0
je 0x467b12
xor eax, eax
jmp 0x467b00
lea edx, [eax + esi]
lea ecx, [eax - 0xc]
inc eax
xor byte [edx], cl
cmp eax, 0x32
jb 0x467b00
mov byte [esi + 0x33], 0
pop esi
ret

Function at 0x467b20
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0xc], 0
je 0x467b42
xor eax, eax
jmp 0x467b30
lea edx, [eax + esi]
lea ecx, [eax - 0xc]
inc eax
xor byte [edx], cl
cmp eax, 0xb
jb 0x467b30
mov byte [esi + 0xc], 0
pop esi
ret
Function at 0x467b60
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 3], 0
je 0x467b82
xor eax, eax
jmp 0x467b70
lea edx, [eax + esi]
lea ecx, [eax - 0xc]
inc eax
xor byte [edx], cl
cmp eax, 2
jb 0x467b70
mov byte [esi + 3], 0
pop esi
ret

Function at 0x467b90
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 8], 0
je 0x467bb2
xor eax, eax
jmp 0x467ba0
lea edx, [eax + esi]
lea ecx, [eax - 0xc]
inc eax
xor byte [edx], cl
cmp eax, 7
jb 0x467ba0
mov byte [esi + 8], 0
pop esi
ret

Function at 0x467bc0
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 5], 0
je 0x467be2
xor eax, eax
jmp 0x467bd0
lea edx, [eax + esi]
lea ecx, [eax - 0xc]
inc eax
xor byte [edx], cl
cmp eax, 4
jb 0x467bd0
mov byte [esi + 5], 0
pop esi
ret

Function at 0x467c50
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0x12], 0
je 0x467c72
xor eax, eax
jmp 0x467c60
lea edx, [eax + esi]
lea ecx, [eax - 0xc]
inc eax
xor byte [edx], cl
cmp eax, 0x11
jb 0x467c60
mov byte [esi + 0x12], 0
pop esi
ret

Function at 0x467c80
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0x16], 0
je 0x467ca2
xor eax, eax
jmp 0x467c90
lea edx, [eax + esi]
lea ecx, [eax - 0xc]
inc eax
xor byte [edx], cl
cmp eax, 0x15
jb 0x467c90
mov byte [esi + 0x16], 0
pop esi
ret

Function at 0x467cb0
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0xe], 0
je 0x467cd2
xor eax, eax
jmp 0x467cc0
lea edx, [eax + esi]
lea ecx, [eax - 0xc]
inc eax
xor byte [edx], cl
cmp eax, 0xd
jb 0x467cc0
mov byte [esi + 0xe], 0
pop esi
ret

Function at 0x467ce0
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0x19], 0
je 0x467d02
xor eax, eax
jmp 0x467cf0
lea edx, [eax + esi]
lea ecx, [eax - 0xc]
inc eax
xor byte [edx], cl
cmp eax, 0x18
jb 0x467cf0
mov byte [esi + 0x19], 0
pop esi
ret

Function at 0x467d10
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0xa], 0
je 0x467d32
xor eax, eax
jmp 0x467d20
lea edx, [eax + esi]
lea ecx, [eax - 0xc]
inc eax
xor byte [edx], cl
cmp eax, 9
jb 0x467d20
mov byte [esi + 0xa], 0
pop esi
ret

Function at 0x467d40
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0x2f], 0
je 0x467d62
xor eax, eax
jmp 0x467d50
lea edx, [eax + esi]
lea ecx, [eax - 0xc]
inc eax
xor byte [edx], cl
cmp eax, 0x2e
jb 0x467d50
mov byte [esi + 0x2f], 0
pop esi
ret

Function at 0x467d70
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0x20], 0
je 0x467d92
xor eax, eax
jmp 0x467d80
lea edx, [eax + esi]
lea ecx, [eax - 0xc]
inc eax
xor byte [edx], cl
cmp eax, 0x1f
jb 0x467d80
mov byte [esi + 0x20], 0
pop esi
ret

Function at 0x467da0
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 6], 0
je 0x467dc2
xor eax, eax
jmp 0x467db0
lea edx, [eax + esi]
lea ecx, [eax - 0xc]
inc eax
xor byte [edx], cl
cmp eax, 5
jb 0x467db0
mov byte [esi + 6], 0
pop esi
ret
Function at 0x467dd0
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 4], 0
je 0x467df2
xor eax, eax
jmp 0x467de0
lea edx, [eax + esi]
lea ecx, [eax - 0xc]
inc eax
xor byte [edx], cl
cmp eax, 3
jb 0x467de0
mov byte [esi + 4], 0
pop esi
ret
Function at 0x46c730
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x505310
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xc
push ebx
mov eax, ecx
push esi
push edi
push 8
mov dword [ebp - 0x10], eax
mov dword [eax], vtable.std::basic_streambuf_char__struct_std::char_traits_char__.0
call fcn.004df290
mov esi, eax
push 1
mov dword [ebp - 4], 0
call fcn.004de09e
mov dword [esi + 4], eax
add esp, 8
mov eax, dword [ebp - 0x10]
lea edi, [eax + 0x14]
lea ecx, [eax + 0x18]
lea edx, [eax + 0x24]
mov dword [eax + 0x34], esi
lea ebx, [eax + 4]
mov dword [eax + 0xc], ebx
lea esi, [eax + 8]
mov dword [eax + 0x10], esi
mov dword [eax + 0x1c], edi
mov dword [eax + 0x20], ecx
mov dword [eax + 0x2c], edx
add eax, 0x28
mov dword [ebp - 0x14], ebx
mov ebx, dword [ebp - 0x10]
mov dword [ebp - 0x18], eax
mov dword [ebx + 0x30], eax
mov ebx, dword [ebp - 0x14]
mov dword [esi], 0
mov dword [ecx], 0
mov dword [eax], 0
mov eax, dword [ebp - 0x10]
mov dword [ebx], 0
mov ebx, dword [ebp - 0x10]
mov dword [edi], 0
mov dword [edx], 0
mov dword [eax + 0x10], esi
mov dword [ebx], vtable.std::basic_filebuf_char__struct_std::char_traits_char__.0
mov byte [ebx + 0x48], 0
mov byte [ebx + 0x3d], 0
mov ebx, dword [ebp - 0x14]
mov dword [eax + 0xc], ebx
mov ebx, dword [ebp - 0x10]
mov dword [eax + 0x1c], edi
mov dword [eax + 0x20], ecx
mov dword [eax + 0x2c], edx
mov eax, dword [ebp - 0x18]
mov dword [ebx + 0x30], eax
mov ebx, dword [ebp - 0x14]
mov dword [esi], 0
mov dword [ecx], 0
mov dword [eax], 0
mov dword [ebx], 0
mov dword [edi], 0
mov dword [edx], 0
mov edx, dword [ebp - 0x10]
pop edi
pop esi
pop ebx
mov dword [edx + 0x4c], 0
mov eax, dword [0x537830]
mov ecx, dword [0x537834]
mov dword [edx + 0x44], ecx
mov ecx, dword [ebp - 0xc]
mov dword [edx + 0x40], eax
mov eax, edx
mov dword [edx + 0x38], 0
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
Function at 0x46c8e0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x50c25d
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x14
push ebx
mov ebx, ecx
push esi
push edi
push 0
mov eax, dword [ebx]
push 0
mov dword [ebp - 0x14], ebx
mov eax, dword [eax + 4]
mov dword [ebx + eax], vtable.std::basic_istream_char__struct_std::char_traits_char__.0
mov eax, dword [ebx]
mov edx, dword [eax + 4]
lea eax, [edx - 0x18]
mov dword [edx + ebx - 4], eax
mov eax, dword [ebx]
mov dword [ebx + 8], 0
mov dword [ebx + 0xc], 0
mov edi, dword [eax + 4]
add edi, ebx
mov ecx, edi
mov dword [edi + 0x30], 0
mov dword [edi + 8], 0
mov dword [edi + 0x10], 0
mov dword [edi + 0x14], 0x201
mov dword [edi + 0x18], 6
mov dword [edi + 0x1c], 0
mov dword [edi + 0x20], 0
mov dword [edi + 0x24], 0
mov dword [edi + 0x28], 0
mov dword [edi + 0x2c], 0
call fcn.00403de0
push 8
call fcn.004df290
add esp, 4
mov esi, eax
push 1
mov dword [ebp - 4], 1
call fcn.004de09e
mov dword [esi + 4], eax
add esp, 4
mov eax, dword [ebp + 8]
mov dword [edi + 0x30], esi
mov dword [edi + 0x38], eax
mov dword [edi + 0x3c], 0
mov esi, dword [esi + 4]
mov ecx, esi
mov dword [ebp - 0x1c], esi
mov eax, dword [esi]
call dword [eax + 4]
lea eax, [ebp - 0x20]
mov dword [ebp - 4], 2
push eax
call fcn.0046de70
add esp, 4
mov ecx, eax
mov edx, dword [eax]
push 0x20
mov edx, dword [edx + 0x20]
call edx
mov byte [ebp - 4], 0
mov ecx, esi
mov edx, dword [esi]
mov byte [ebp + 0xb], al
call dword [edx + 8]
test eax, eax
je 0x46c9f6
mov edx, dword [eax]
mov ecx, eax
push 1
call dword [edx]
cmp dword [edi + 0x38], 0
mov al, byte [ebp + 0xb]
mov byte [edi + 0x40], al
jne 0x46ca12
mov eax, dword [edi + 0xc]
mov ecx, edi
push 0
or eax, 4
push eax
call fcn.00403de0
mov ecx, dword [ebp - 0xc]
mov eax, ebx
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret 0xc

Function at 0x46dba0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x505310
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
push ebx
mov eax, ecx
push esi
push edi
push 8
mov dword [ebp - 0x10], eax
mov dword [eax], vtable.std::basic_streambuf_char__struct_std::char_traits_char__.0
call fcn.004df290
mov esi, eax
push 1
mov dword [ebp - 4], 0
call fcn.004de09e
mov dword [esi + 4], eax
add esp, 8
mov eax, dword [ebp - 0x10]
lea edi, [eax + 0x14]
lea ecx, [eax + 0x18]
lea edx, [eax + 0x24]
mov dword [eax + 0x34], esi
lea ebx, [eax + 4]
mov dword [eax + 0xc], ebx
lea esi, [eax + 8]
mov dword [eax + 0x10], esi
mov dword [eax + 0x1c], edi
mov dword [eax + 0x20], ecx
mov dword [eax + 0x2c], edx
add eax, 0x28
mov dword [ebp - 0x14], ebx
mov ebx, dword [ebp - 0x10]
mov dword [ebx + 0x30], eax
mov ebx, dword [ebp - 0x14]
mov dword [esi], 0
mov dword [ecx], 0
mov ecx, dword [ebp - 0xc]
mov dword [eax], 0
mov eax, dword [ebp - 0x10]
mov dword [ebx], 0
mov dword [edi], 0
pop edi
pop esi
mov dword [edx], 0
pop ebx
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
Function at 0x46f370
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov edx, dword [ebp + 8]
mov eax, ecx
push ebx
push esi
push edi
cmp dword [edx + 0x14], 0x10
mov edi, edx
mov ebx, dword [edx + 0x10]
mov dword [ebp - 8], eax
jb 0x46f38e
mov edi, dword [edx]
xor ecx, ecx
mov esi, 0x811c9dc5
test ebx, ebx
je 0x46f3b4
lea esp, [esp]
movzx eax, byte [ecx + edi]
inc ecx
xor eax, esi
imul esi, eax, 0x1000193
cmp ecx, ebx
jb 0x46f3a0
mov eax, dword [ebp - 8]
push esi
push edx
lea ecx, [ebp - 0xc]
push ecx
mov ecx, eax
call fcn.004758d0
xor ecx, ecx
pop edi
pop esi
cmp dword [eax + 4], ecx
pop ebx
setne cl
mov eax, ecx
mov esp, ebp
pop ebp
ret 4

Function at 0x470ab0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 0xc]
mov edx, 0x811c9dc5
push edi
mov edi, dword [ebp + 8]
mov ecx, 0
sub esi, edi
je 0x470ae1
lea esp, [esp]
movzx eax, byte [ecx + edi]
inc ecx
xor eax, edx
imul edx, eax, 0x1000193
cmp ecx, esi
jb 0x470ad0
pop edi
mov eax, edx
pop esi
pop ebp
ret 8
Function at 0x477700
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x50ca55
push eax
mov dword fs:[0], esp
sub esp, 0x20
push ebx
mov ebx, dword [ebp + 0xc]
mov edx, ebx
push esi
push edi
mov edi, ecx
cmp dword [ebx + 0x14], 0x10
jb 0x47772d
mov edx, dword [ebx]
xor ecx, ecx
mov esi, 0x811c9dc5
cmp dword [ebx + 0x10], ecx
jbe 0x477752
lea esp, [esp]
movzx eax, byte [ecx + edx]
inc ecx
xor eax, esi
imul esi, eax, 0x1000193
cmp ecx, dword [ebx + 0x10]
jb 0x477740
push esi
push ebx
lea eax, [ebp - 0x18]
mov ecx, edi
push eax
call fcn.004758d0
mov ecx, dword [ebp - 0x14]
test ecx, ecx
je 0x477772
mov eax, dword [ebp + 8]
mov byte [eax + 4], 0
jmp 0x4778b2
cmp dword [edi + 8], 0x7ffffff
je 0x4778c7
lea eax, [edi + 4]
mov dword [ebp - 0x24], eax
mov dword [ebp - 4], 0
push 0x20
mov dword [ebp - 0x20], 0
call fcn.004df290
add esp, 4
mov dword [ebp - 0x20], eax
add eax, 8
mov ecx, eax
mov dword [ebp - 0x1c], eax
push ebx
call fcn.0046a770
mov dword [ebp - 4], 1
mov eax, dword [edi + 8]
fld dword [edi]
add eax, 1
mov dword [ebp + 0xc], eax
fild dword [ebp + 0xc]
jns 0x4777cb
fadd dword [0x526a40]
fstp dword [ebp + 0xc]
fld dword [ebp + 0xc]
mov ebx, dword [edi + 0x1c]
fild dword [edi + 0x1c]
test ebx, ebx
jns 0x4777e1
fadd dword [0x526a40]
fstp dword [ebp + 0xc]
fld dword [ebp + 0xc]
fdivr st(1)
fcomp st(2)
fnstsw ax
test ah, 0x41
jne 0x477863
fdivrp st(1)
sub esp, 8
fstp dword [ebp + 0xc]
fld dword [ebp + 0xc]
fstp qword [esp]
call fcn.005043d0
fstp dword [ebp + 0xc]
fld dword [ebp + 0xc]
add esp, 8
fnstcw word [ebp + 0xe]
movzx eax, word [ebp + 0xe]
or eax, 0xc00
mov dword [ebp - 0x14], eax
fldcw word [ebp - 0x14]
fistp qword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
fldcw word [ebp + 0xe]
cmp eax, 8
ja 0x477833
mov eax, 8
cmp ebx, eax
jae 0x477848
cmp ebx, 0x200
jae 0x477846
shl ebx, 3
cmp ebx, eax
jae 0x477848
mov ebx, eax
push ebx
mov ecx, edi
call fcn.0047b450
push esi
push dword [ebp - 0x1c]
lea eax, [ebp - 0x2c]
mov ecx, edi
push eax
call fcn.004758d0
mov ebx, dword [eax]
jmp 0x47786a
mov ebx, dword [ebp - 0x18]
fstp st(0)
fstp st(0)
mov eax, dword [ebx + 4]
mov ecx, dword [ebp - 0x20]
inc dword [edi + 8]
mov dword [ebp + 0xc], eax
mov dword [ecx + 4], eax
mov dword [ecx], ebx
mov dword [eax], ecx
mov dword [ebx + 4], ecx
mov eax, dword [edi + 0x18]
mov edx, dword [edi + 0xc]
and eax, esi
mov esi, dword [edx + eax*8]
cmp esi, dword [edi + 4]
jne 0x477895
mov dword [edx + eax*8], ecx
jmp 0x4778a7
cmp esi, ebx
jne 0x47789e
mov dword [edx + eax*8], ecx
jmp 0x4778ab
mov esi, dword [ebp + 0xc]
cmp dword [edx + eax*8 + 4], esi
jne 0x4778ab
mov dword [edx + eax*8 + 4], ecx
mov eax, dword [ebp + 8]
mov byte [eax + 4], 1
pop edi
mov dword [eax], ecx
mov ecx, dword [ebp - 0xc]
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret 8
push str.unordered_map_set_too_long
call fcn.004dd6e9
int3
Function at 0x482d70
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x50d085
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x14
push ebx
push esi
push edi
push dword [ebp + 0xc]
lea eax, [ebp - 0x20]
mov esi, ecx
push dword [ebp + 8]
mov dword [ebp - 0x14], esi
push eax
call fcn.004836a0
cmp byte [eax + 8], 0
mov ecx, dword [eax]
mov edx, dword [eax + 4]
mov dword [ebp - 0x10], ecx
mov dword [ebp + 8], edx
je 0x482dc8
mov eax, ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
cmp dword [esi + 4], 0x4924924
je 0x482e60
mov ebx, dword [esi]
mov dword [ebp - 0x1c], esi
mov dword [ebp - 4], 0
push 0x38
mov dword [ebp - 0x18], 0
call fcn.004df290
mov edi, eax
add esp, 4
mov dword [ebp - 0x18], edi
push dword [ebp + 0xc]
lea ecx, [edi + 0x10]
mov dword [ebp - 4], 1
call fcn.0046a770
mov edx, dword [ebp + 0xc]
push edi
push dword [ebp + 8]
mov al, byte [edx + 0x18]
push dword [ebp - 0x10]
mov byte [edi + 0x28], al
mov ecx, dword [edx + 0x24]
mov eax, dword [edx + 0x20]
mov dword [edi + 0x34], ecx
mov ecx, dword [ebp - 0x14]
mov dword [edi + 0x30], eax
mov byte [edx + 0x18], 0
mov dword [edx + 0x20], 0
mov dword [edx + 0x24], 0
mov dword [edi], ebx
mov dword [edi + 4], ebx
mov dword [edi + 8], ebx
mov word [edi + 0xc], 0
call fcn.00471810
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret 8
call fcn.00406c10
int3