joyce8/EMBER2024-capa huggingface dataset:
Function at 0x403780
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x14
cmp dword [ecx + 0x38], 0
push ebx
push esi
push edi
mov dword [esp + 0xc], ecx
je 0x403868
mov esi, dword [ebp + 0x10]
mov ebx, esi
mov edx, dword [ebp + 0xc]
mov edi, edx
mov eax, dword [ebp + 8]
mov dword [esp + 0x10], eax
test esi, esi
jl 0x403857
jg 0x4037c0
test edx, edx
je 0x403857
nop dword [eax]
call fcn.00405350
mov esi, eax
mov eax, edx
mov dword [esp + 0x14], eax
test eax, eax
jl 0x403814
jg 0x4037d7
test esi, esi
je 0x403814
cmp ebx, eax
jg 0x4037e7
jl 0x4037e1
cmp edi, esi
jae 0x4037e7
mov esi, edi
mov dword [esp + 0x14], ebx
mov ecx, dword [esp + 0xc]
mov eax, dword [esp + 0x10]
push esi
push eax
mov eax, dword [ecx + 0x20]
push dword [eax]
call fcn.00446540
mov ecx, dword [esp + 0x18]
add esp, 0xc
sub edi, esi
sbb ebx, dword [esp + 0x14]
mov eax, dword [ecx + 0x30]
sub dword [eax], esi
mov eax, dword [ecx + 0x20]
add dword [eax], esi
jmp 0x40383b
mov ecx, dword [esp + 0xc]
mov eax, dword [ecx]
mov edx, dword [eax + 0xc]
mov eax, dword [esp + 0x10]
movzx eax, byte [eax]
push eax
call edx
cmp eax, 0xffffffff
je 0x403851
mov ecx, dword [esp + 0xc]
add edi, 0xffffffff
mov esi, 1
adc ebx, 0xffffffff
add dword [esp + 0x10], esi
test ebx, ebx
jg 0x4037c0
jl 0x403851
test edi, edi
jne 0x4037c0
mov edx, dword [ebp + 0xc]
mov esi, dword [ebp + 0x10]
sub edx, edi
mov eax, edx
sbb esi, ebx
mov edx, esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov eax, dword [ecx + 0x20]
mov esi, dword [ebp + 0xc]
mov edi, dword [ebp + 0x10]
mov dword [esp + 0x18], esi
mov eax, dword [eax]
mov dword [esp + 0x1c], edi
mov dword [esp + 0x10], eax
test eax, eax
je 0x40388a
mov eax, dword [ecx + 0x30]
mov eax, dword [eax]
jmp 0x40388c
xor eax, eax
cdq
mov ebx, eax
mov eax, edx
mov dword [esp + 0x14], eax
test edi, edi
jl 0x40390a
jg 0x40389f
test esi, esi
je 0x40390a
test eax, eax
jl 0x4038ee
jg 0x4038a9
test ebx, ebx
je 0x4038ee
cmp edi, eax
jg 0x4038b9
jl 0x4038b3
cmp esi, ebx
jae 0x4038b9
mov ebx, esi
mov dword [esp + 0x14], edi
push ebx
push dword [ebp + 8]
push dword [esp + 0x18]
call fcn.00446540
mov ecx, dword [esp + 0x18]
add esp, 0xc
mov edx, dword [ebp + 8]
sub esi, ebx
sbb edi, dword [esp + 0x14]
add edx, ebx
mov eax, dword [ecx + 0x30]
sub dword [eax], ebx
mov eax, dword [ecx + 0x20]
add dword [eax], ebx
test edi, edi
jl 0x40390a
jg 0x4038f1
test esi, esi
je 0x40390a
jmp 0x4038f1
mov edx, dword [ebp + 8]
mov eax, dword [ecx + 0x4c]
test eax, eax
je 0x40390a
push eax
push esi
push 1
push edx
call fcn.0044cb85
add esp, 0x10
sub esi, eax
sbb edi, 0
mov eax, dword [esp + 0x18]
mov edx, dword [esp + 0x1c]
sub eax, esi
sbb edx, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x403e90
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
mov eax, dword [0x481014]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, ecx
cmp ebx, 0xffffffff
jne 0x403ec0
pop esi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0042f2f9
mov esp, ebp
pop ebp
ret 4
mov eax, dword [esi + 0x20]
push edi
mov ecx, dword [eax]
test ecx, ecx
je 0x403efc
mov edx, dword [esi + 0x30]
mov edi, dword [edx]
lea eax, [edi + ecx]
cmp ecx, eax
jae 0x403efc
lea ecx, [edi - 1]
mov dword [edx], ecx
mov edx, dword [esi + 0x20]
mov esi, dword [edx]
lea ecx, [esi + 1]
mov dword [edx], ecx
mov byte [esi], bl
pop edi
pop esi
mov eax, ebx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0042f2f9
mov esp, ebp
pop ebp
ret 4
cmp dword [esi + 0x4c], 0
je 0x403fe5
mov edi, dword [esi + 0xc]
lea eax, [esi + 0x3c]
cmp dword [edi], eax
jne 0x403f24
mov edx, dword [esi + 0x54]
mov ecx, dword [esi + 0x50]
sub edx, ecx
mov dword [edi], ecx
mov eax, dword [esi + 0x1c]
mov dword [eax], ecx
mov eax, dword [esi + 0x2c]
mov dword [eax], edx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x403f57
push dword [esi + 0x4c]
movsx eax, bl
push eax
call fcn.00449e97
add esp, 8
or ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, ebx
pop edi
pop esi
mov eax, ecx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0042f2f9
mov esp, ebp
pop ebp
ret 4
mov byte [ebp - 0x25], bl
mov eax, dword [ecx]
mov edx, dword [eax + 0x1c]
lea eax, [ebp - 0x2c]
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x25]
push eax
lea eax, [esi + 0x40]
push eax
call edx
test eax, eax
js 0x403fe5
cmp eax, 1
jle 0x403fb8
cmp eax, 3
jne 0x403fe5
push dword [esi + 0x4c]
movsx eax, byte [ebp - 0x25]
push eax
call fcn.00449e97
add esp, 8
or ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, ebx
pop edi
pop esi
mov eax, ecx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0042f2f9
mov esp, ebp
pop ebp
ret 4
mov edi, dword [ebp - 0x2c]
lea eax, [ebp - 0x24]
sub edi, eax
je 0x403fd5
push dword [esi + 0x4c]
push edi
push 1
push eax
call fcn.0044cb85
add esp, 0x10
cmp edi, eax
jne 0x403fe5
lea eax, [ebp - 0x25]
mov byte [esi + 0x3d], 1
cmp dword [ebp - 0x30], eax
jne 0x403ee7
mov ecx, dword [ebp - 4]
or eax, 0xffffffff
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0042f2f9
mov esp, ebp
pop ebp
ret 4
Function at 0x404fc0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x481014]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, ecx
cmp dword [esi + 0x38], 0
je 0x40507c
cmp byte [esi + 0x3d], 0
je 0x40507c
mov eax, dword [esi]
push edi
push 0xffffffffffffffff
call dword [eax + 0xc]
cmp eax, 0xffffffff
je 0x40506a
mov ecx, dword [esi + 0x38]
mov eax, dword [ecx]
mov edx, dword [eax + 0x20]
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [esi + 0x40]
push eax
call edx
sub eax, 0
je 0x405032
sub eax, 1
je 0x405036
sub eax, 2
jne 0x40506a
mov byte [esi + 0x3d], al
mov al, 1
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0042f2f9
mov esp, ebp
pop ebp
ret
mov byte [esi + 0x3d], 0
mov edi, dword [ebp - 0x28]
lea eax, [ebp - 0x24]
sub edi, eax
je 0x405053
push dword [esi + 0x4c]
push edi
push 1
push eax
call fcn.0044cb85
add esp, 0x10
cmp edi, eax
jne 0x40506a
cmp byte [esi + 0x3d], 0
pop edi
sete al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0042f2f9
mov esp, ebp
pop ebp
ret
pop edi
xor al, al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0042f2f9
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
mov al, 1
xor ecx, ebp
pop esi
call fcn.0042f2f9
mov esp, ebp
pop ebp
ret

Function at 0x405250
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x464070
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push esi
push edi
mov eax, dword [0x481014]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x10], edi
push 8
mov dword [edi], vtable.std::basic_streambuf_char__struct_std::char_traits_char__.0
call fcn.0042f30f
mov esi, eax
push 1
mov dword [ebp - 4], 0
call fcn.0042d6c8
mov dword [esi + 4], eax
lea ebx, [edi + 4]
mov eax, dword [ebp - 0x10]
lea edx, [edi + 8]
mov dword [ebp - 0x14], ebx
lea ecx, [eax + 0x18]
mov ebx, dword [ebp - 0x10]
add esp, 8
mov dword [ebp - 0x18], edx
mov edx, dword [ebp - 0x10]
mov dword [edi + 0x34], esi
add edi, 0x14
mov dword [ebx], vtable.std::basic_filebuf_char__struct_std::char_traits_char__.0
lea esi, [eax + 0x24]
mov byte [ebx + 0x48], 0
add eax, 0x28
mov byte [ebx + 0x3d], 0
mov ebx, dword [ebp - 0x14]
mov dword [edx + 0xc], ebx
mov ebx, dword [ebp - 0x10]
mov edx, dword [ebp - 0x18]
mov dword [ebx + 0x30], eax
mov dword [ebx + 0x20], ecx
mov dword [ebx + 0x10], edx
mov dword [ebx + 0x1c], edi
mov dword [ebx + 0x2c], esi
mov ebx, dword [ebp - 0x14]
mov dword [edx], 0
mov dword [ecx], 0
mov ecx, dword [ebp - 0x10]
mov dword [eax], 0
mov eax, dword [0x48672c]
mov dword [ebx], 0
mov dword [edi], 0
mov dword [esi], 0
mov dword [ecx + 0x40], eax
mov eax, dword [0x486730]
mov dword [ecx + 0x44], eax
mov eax, ecx
mov dword [ecx + 0x4c], 0
mov dword [ecx + 0x38], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x407410
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
mov ebx, ecx
mov dword [ebp - 4], edx
push esi
push edi
mov eax, dword [ebx + 0x3c]
add eax, ebx
je 0x407499
cmp dword [eax + 0x7c], 0
je 0x407499
mov eax, dword [eax + 0x78]
add eax, ebx
mov dword [ebp - 0xc], eax
mov ecx, dword [eax + 0x1c]
add ecx, ebx
mov dword [ebp - 0x10], ecx
cmp edx, 0xffff
ja 0x407457
sub edx, dword [eax + 0x10]
cmp edx, dword [eax + 0x14]
ja 0x407499
mov eax, dword [ecx + edx*4]
pop edi
pop esi
add eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret
mov ecx, dword [eax + 0x18]
xor esi, esi
mov dword [ebp - 8], ecx
test ecx, ecx
je 0x407499
mov edi, dword [eax + 0x20]
mov ch, byte [edx]
add edi, ebx
nop word [eax + eax]
mov eax, dword [edi]
mov cl, ch
add eax, ebx
cmp cl, byte [eax]
jne 0x407490
sub edx, eax
nop dword [eax]
test cl, cl
je 0x4074a2
mov cl, byte [edx + eax + 1]
inc eax
cmp cl, byte [eax]
je 0x407480
mov edx, dword [ebp - 4]
inc esi
add edi, 4
cmp esi, dword [ebp - 8]
jb 0x407470
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x10]
pop edi
mov eax, dword [eax + 0x24]
lea eax, [eax + esi*2]
movzx eax, word [eax + ebx]
pop esi
mov eax, dword [ecx + eax*4]
add eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x416880
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x464a7d
mov eax, dword fs:[0]
push eax
sub esp, 0x74
mov eax, dword [0x481014]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov al, byte [ebp + 0xc]
mov ebx, dword [ebp + 8]
mov byte [ebp - 0x71], al
mov eax, dword [edi + 8]
test eax, eax
je 0x4168cd
push eax
call fcn.0044a898
add esp, 4
mov dword [edi + 8], 0
lea ecx, [edi + 0xc]
cmp ecx, ebx
je 0x4168e7
cmp dword [ebx + 0x14], 8
mov eax, ebx
jb 0x4168de
mov eax, dword [ebx]
push dword [ebx + 0x10]
push eax
call fcn.004053c0
cmp byte [ebp - 0x71], 0
mov eax, 0x4772b8
mov ecx, 0x4772c0
mov dword [ebp - 0x78], 0
cmove eax, ecx
cmp dword [edi], 0
mov dword [ebp - 0x7c], eax
jle 0x416a1e
nop dword [eax + eax]
sub esp, 0x18
mov esi, esp
sub esp, 0x18
mov ecx, esp
push ebx
call fcn.00404720
mov ecx, esi
call fcn.004165c0
add esp, 0x18
call fcn.00416390
mov esi, dword [ebp - 0x7c]
add esp, 0x18
xor eax, eax
mov dword [ebp - 0x18], 0
mov word [ebp - 0x28], ax
mov eax, esi
mov dword [ebp - 0x14], 7
lea edx, [eax + 2]
nop
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x416950
sub eax, edx
lea ecx, [ebp - 0x28]
sar eax, 1
push eax
push esi
call fcn.004053c0
cmp dword [ebp - 0x14], 8
lea ecx, [ebp - 0x28]
mov eax, ebx
cmovae ecx, dword [ebp - 0x28]
cmp dword [ebx + 0x14], 8
jb 0x41697e
mov eax, dword [ebx]
push 0x40
push ecx
push eax
call fcn.0044e981
mov edx, dword [ebp - 0x14]
add esp, 0xc
mov esi, eax
mov dword [edi + 8], esi
cmp edx, 8
jb 0x4169c9
mov ecx, dword [ebp - 0x28]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x4169bf
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x416a6b
push edx
push ecx
call fcn.0042f33f
add esp, 8
test esi, esi
jne 0x4169e6
push dword [edi + 4]
call dword [sym.imp.KERNEL32.dll_Sleep]
mov eax, dword [ebp - 0x78]
inc eax
mov dword [ebp - 0x78], eax
cmp eax, dword [edi]
jge 0x416a1e
jmp 0x416910
cmp byte [ebp - 0x71], 0
je 0x416a00
push dword [edi + 8]
push 3
push 1
push 0x476028
call fcn.0044cb85
add esp, 0x10
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0042f2f9
mov esp, ebp
pop ebp
ret 8
call fcn.0044cc56
lea edx, [edi + 0xc]
lea ecx, [ebp - 0x40]
mov esi, dword [eax]
call fcn.00416180
push eax
mov edx, str.Failed_opening_file
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x58]
call fcn.0041dc80
add esp, 4
push str._for_writing
mov edx, eax
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x70]
call fcn.00405cb0
add esp, 4
mov edx, esi
mov byte [ebp - 4], 2
mov ecx, eax
call fcn.00415fd0
call fcn.0044e102
int3
Function at 0x417620
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x464b69
mov eax, dword fs:[0]
push eax
sub esp, 0x18
push esi
push edi
mov eax, dword [0x481014]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x10], edi
mov dword [ebp - 0x20], edi
mov dword [ebp - 4], 0
lea ecx, [edi + 4]
mov dword [edi], vtable.spdlog::pattern_formatter.0
push 2
push 0x477458
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 0xf
mov byte [ecx], 0
call fcn.004054d0
movups xmm0, xmmword [ebp + 0xc]
mov dword [edi + 0x2c], 0
mov dword [edi + 0x30], 0
movups xmmword [edi + 0x1c], xmm0
mov byte [ebp + 0xc], 0
movq xmm0, qword [ebp + 0x1c]
movq qword [edi + 0x2c], xmm0
mov dword [ebp + 0x1c], 0
mov dword [ebp + 0x20], 0xf
mov dword [edi + 0x34], 0
mov dword [edi + 0x60], 0
mov dword [edi + 0x64], 0
mov dword [edi + 0x68], 0
mov dword [edi + 0x6c], 0
mov dword [edi + 0x70], 0
lea ecx, [edi + 0x74]
mov byte [ebp - 4], 3
call fcn.0041d590
mov byte [ebp - 4], 4
xorps xmm0, xmm0
xor eax, eax
movups xmmword [edi + 0x38], xmm0
push 0x128
movups xmmword [edi + 0x48], xmm0
mov dword [edi + 0x58], 0
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x18], eax
call fcn.0042f30f
mov ecx, eax
add esp, 4
mov dword [ebp - 0x10], ecx
movq xmm0, qword [ebp - 0x1c]
mov eax, dword [ebp - 0x14]
movq qword [ecx + 4], xmm0
mov dword [ecx + 0xc], eax
lea eax, [ecx + 0x28]
mov dword [ecx], vtable.spdlog::details::full_formatter.0
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 0
mov dword [ecx + 0x20], 0
mov dword [ecx + 0x18], vtable.fmt::v7::basic_memory_buffer_char__250__class_std::allocator_char__.0
mov dword [ecx + 0x1c], eax
mov dword [ecx + 0x24], 0xfa
mov dword [ebp - 0x24], 0
mov dword [ebp - 0x10], ecx
mov byte [ebp - 4], 6
mov eax, dword [edi + 0x6c]
cmp eax, dword [edi + 0x70]
je 0x417774
mov dword [eax], ecx
add dword [edi + 0x6c], 4
jmp 0x41778e
lea ecx, [ebp - 0x10]
push ecx
push eax
lea ecx, [edi + 0x68]
call fcn.00420760
mov ecx, dword [ebp - 0x10]
test ecx, ecx
je 0x41778e
mov eax, dword [ecx]
push 1
call dword [eax]
mov edx, dword [ebp + 0x20]
cmp edx, 0x10
jb 0x4177be
mov ecx, dword [ebp + 0xc]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x4177b4
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4177d3
push edx
push ecx
call fcn.0042f33f
add esp, 8
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 0x1c
call fcn.0044e102
int3
Function at 0x4190f0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x464f3d
mov eax, dword fs:[0]
push eax
sub esp, 0x44
mov eax, dword [0x481014]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov dword [ebp - 0x44], ebx
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x28]
mov eax, dword [ebp + 8]
add eax, 8
push eax
call fcn.004048f0
mov byte [ebp - 4], 1
lea esi, [ebp - 0x28]
cmp dword [ebp - 0x14], 0x10
mov edx, 0x811c9dc5
mov edi, dword [ebp - 0x18]
cmovae esi, dword [ebp - 0x28]
xor ecx, ecx
test edi, edi
je 0x419164
movzx eax, byte [ecx + esi]
inc ecx
xor eax, edx
imul edx, eax, 0x1000193
cmp ecx, edi
jb 0x419153
push edx
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x4c]
push eax
lea ecx, [ebx + 0x90]
call fcn.00420480
mov eax, dword [eax + 4]
test eax, eax
jne 0x419185
mov eax, dword [ebx + 0x94]
mov ecx, dword [ebp - 0x44]
cmp eax, dword [ecx + 0x94]
lea eax, [ebp - 0x28]
push eax
jne 0x419275
lea eax, [ebp - 0x4c]
push eax
lea ecx, [ebx + 0x90]
call fcn.00420020
mov ecx, dword [ebp + 0xc]
or edi, 0xffffffff
mov edx, dword [eax]
mov eax, dword [ebp + 8]
mov dword [ebp + 8], 0
mov dword [ebp + 0xc], 0
mov esi, dword [edx + 0x24]
mov dword [edx + 0x20], eax
mov dword [edx + 0x24], ecx
test esi, esi
je 0x4191ec
mov eax, edi
lock xadd dword [esi + 4], eax
jne 0x4191ec
mov eax, dword [esi]
mov ecx, esi
call dword [eax]
mov eax, edi
lock xadd dword [esi + 8], eax
jne 0x4191ec
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 4]
mov edx, dword [ebp - 0x14]
cmp edx, 0x10
jb 0x419220
mov ecx, dword [ebp - 0x28]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x419216
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x41929a
push edx
push ecx
call fcn.0042f33f
add esp, 8
mov esi, dword [ebp + 0xc]
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0xf
mov byte [ebp - 0x28], 0
test esi, esi
je 0x419257
mov eax, edi
lock xadd dword [esi + 4], eax
jne 0x419257
mov eax, dword [esi]
mov ecx, esi
call dword [eax]
lock xadd dword [esi + 8], edi
dec edi
jne 0x419257
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 4]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0042f2f9
mov esp, ebp
pop ebp
ret 8
lea ecx, [ebp - 0x40]
call fcn.0041dc30
sub esp, 0x14
mov byte [ebp - 4], 2
mov ecx, esp
mov edx, eax
push str._already_exists
call fcn.00405cb0
add esp, 4
call fcn.00416010
call fcn.0044e102
int3
Function at 0x41fdb0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4657f6
mov eax, dword fs:[0]
push eax
sub esp, 0x18
push ebx
push esi
push edi
mov eax, dword [0x481014]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x18], ecx
push 0x40
call fcn.0042f30f
mov ebx, eax
add esp, 4
mov dword [ebp - 0x10], ebx
mov dword [ebp - 4], 0
lea edi, [ebx + 0xc]
xorps xmm0, xmm0
movq qword [ebx], xmm0
mov dword [ebx + 8], 0
push 0xfffffffffffffff5
mov dword [ebx + 4], 1
mov dword [ebx + 8], 1
mov dword [ebx], vtable.std::_Ref_count_obj2_class_spdlog::sinks::wincolor_stdout_sink_struct_spdlog::details::console_mutex__.0
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
mov dword [edi + 4], 0
mov dword [ebp - 0x14], eax
mov dword [edi + 0x14], eax
mov eax, dword [0x48677c]
mov dword [edi], vtable.spdlog::sinks::wincolor_sink_struct_spdlog::details::console_mutex_.0
mov dword [edi + 8], 0x40008
mov dword [edi + 0xc], 0x30002
mov dword [edi + 0x10], 0x60007
test al, 1
jne 0x41fe70
or eax, 1
push 2
push 0x48674c
mov dword [0x48677c], eax
call fcn.0042e641
push 0x466e00
call fcn.0042f8bc
add esp, 0xc
push 0x98
mov dword [edi + 0x18], 0x48674c
call fcn.0042f30f
mov esi, eax
mov dword [ebp - 0x1c], esi
sub esp, 0x14
mov byte [ebp - 4], 1
mov ecx, esp
push 2
push 0x477234
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 0xf
mov byte [ecx], 0
call fcn.004054d0
push ecx
mov ecx, esi
call fcn.00417620
lea ecx, [ebp - 0x10]
mov dword [ebp - 0x10], 0
mov dword [edi + 0x20], eax
call fcn.0041d270
lea eax, [ebp - 0x24]
push eax
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_GetConsoleMode]
movzx ecx, word [edi + 8]
test eax, eax
movzx edx, word [edi + 0x10]
setne al
mov byte [edi + 0x1d], 1
mov byte [edi + 0x1c], al
movzx eax, word [edi + 0xe]
mov word [edi + 0x26], ax
movzx eax, word [edi + 0xc]
mov word [edi + 0x28], ax
movzx eax, word [edi + 0x12]
or ax, cx
mov word [edi + 0x24], dx
mov word [edi + 0x2a], ax
movzx eax, word [edi + 0xa]
or ax, cx
mov dword [edi], vtable.spdlog::sinks::wincolor_stdout_sink_struct_spdlog::details::console_mutex_.0
mov word [edi + 0x2c], ax
or ecx, edx
or ecx, 0x40
xor eax, eax
mov word [edi + 0x30], ax
mov eax, dword [ebp - 0x18]
mov word [edi + 0x2e], cx
mov dword [eax], edi
mov dword [eax + 4], ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x420020
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x465835
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push ebx
push esi
push edi
mov eax, dword [0x481014]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov edx, dword [ebp + 0xc]
mov edi, edx
cmp dword [edx + 0x14], 0x10
jb 0x420057
mov edi, dword [edx]
xor ecx, ecx
mov esi, 0x811c9dc5
cmp dword [edx + 0x10], ecx
jbe 0x420075
movzx eax, byte [ecx + edi]
inc ecx
xor eax, esi
imul esi, eax, 0x1000193
cmp ecx, dword [edx + 0x10]
jb 0x420063
push esi
push edx
lea eax, [ebp - 0x20]
mov ecx, ebx
push eax
call fcn.00420480
mov ecx, dword [ebp - 0x1c]
test ecx, ecx
je 0x4200a6
mov eax, dword [ebp + 8]
mov dword [eax], ecx
mov byte [eax + 4], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
cmp dword [ebx + 8], 0x6666666
je 0x42021b
lea eax, [ebx + 4]
mov dword [ebp - 0x14], eax
mov dword [ebp - 4], 0
push 0x28
mov dword [ebp - 0x10], 0
call fcn.0042f30f
add esp, 4
mov edi, eax
mov dword [ebp - 0x10], edi
push dword [ebp + 0xc]
lea ecx, [edi + 8]
call fcn.004048f0
mov dword [edi + 0x20], 0
mov dword [edi + 0x24], 0
mov dword [ebp - 4], 1
mov eax, dword [ebx + 8]
inc eax
movss xmm3, dword [ebx]
movd xmm0, eax
cvtdq2pd xmm0, xmm0
shr eax, 0x1f
addsd xmm0, qword [eax*8 + 0x477ae0]
mov eax, dword [ebx + 0x1c]
cvtpd2ps xmm2, xmm0
movd xmm0, eax
cvtdq2pd xmm0, xmm0
shr eax, 0x1f
movaps xmm1, xmm2
addsd xmm0, qword [eax*8 + 0x477ae0]
cvtpd2ps xmm0, xmm0
divss xmm1, xmm0
comiss xmm1, xmm3
jbe 0x4201a8
divss xmm2, xmm3
sub esp, 8
cvtps2pd xmm0, xmm2
movsd qword [ebp - 0x20], xmm0
fld qword [ebp - 0x20]
fstp qword [esp]
call fcn.00461e60
fstp qword [ebp - 0x20]
movsd xmm0, qword [ebp - 0x20]
add esp, 8
cvtpd2ps xmm0, xmm0
call fcn.00463880
mov ecx, 8
cmp eax, ecx
cmova ecx, eax
mov eax, dword [ebx + 0x1c]
cmp eax, ecx
jae 0x42018c
cmp eax, 0x200
jae 0x42018a
shl eax, 3
cmp eax, ecx
jae 0x42018c
mov eax, ecx
push eax
mov ecx, ebx
call fcn.00424250
push esi
lea eax, [edi + 8]
mov ecx, ebx
push eax
lea eax, [ebp - 0x20]
push eax
call fcn.00420480
mov edx, dword [eax]
jmp 0x4201ab
mov edx, dword [ebp - 0x20]
mov eax, dword [ebx + 8]
mov ecx, dword [edx + 4]
inc eax
mov dword [ebx + 8], eax
mov dword [edi], edx
mov dword [edi + 4], ecx
mov dword [ecx], edi
mov dword [edx + 4], edi
mov eax, dword [ebx + 0x18]
mov dword [ebp + 0xc], ecx
and eax, esi
mov ecx, dword [ebx + 0xc]
mov dword [ebp - 0x10], 0
mov esi, dword [ecx + eax*8]
cmp esi, dword [ebx + 4]
jne 0x4201de
mov dword [ecx + eax*8], edi
jmp 0x4201f0
cmp esi, edx
jne 0x4201e7
mov dword [ecx + eax*8], edi
jmp 0x4201f4
mov edx, dword [ebp + 0xc]
cmp dword [ecx + eax*8 + 4], edx
jne 0x4201f4
mov dword [ecx + eax*8 + 4], edi
mov esi, dword [ebp + 8]
lea ecx, [ebp - 0x14]
mov dword [esi], edi
mov byte [esi + 4], 1
call fcn.00420a80
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
push str.unordered_map_set_too_long
call fcn.0042d4f7
int3