joyce8/EMBER2024-capa huggingface dataset:
Function at 0x415cb0
Capabilities:
Accept command line arguments

Disassembly:
lea ecx, [esp + 4]
and esp, 0xfffffff0
push dword [ecx - 4]
push ebp
mov ebp, esp
push edi
push esi
push ebx
push ecx
sub esp, 0x78
call dbg.__main
call dword [sym.imp.kernel32.dll_GetCommandLineA]
mov ebx, eax
movzx eax, byte [eax]
test al, al
je 0x415d3f
cmp al, 9
je 0x415d30
cmp al, 0x20
je 0x415d30
mov dword [ebp - 0x6c], 0
xor edi, edi
lea esi, [esi]
cmp al, 0x5c
je 0x415d98
cmp al, 0x22
je 0x415da8
mov dword [ebp - 0x6c], 0
movzx eax, byte [ebx + 1]
add ebx, 1
test al, al
je 0x415d3f
cmp al, 9
sete cl
cmp al, 0x20
mov esi, ecx
sete cl
mov edx, esi
or dl, cl
je 0x415cf0
test edi, 1
jne 0x415cf0
lea esi, [esi]
movzx eax, byte [ebx + 1]
add ebx, 1
cmp al, 9
je 0x415d30
cmp al, 0x20
je 0x415d30
lea eax, [ebp - 0x5c]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_GetStartupInfoA]
sub esp, 4
test byte [ebp - 0x30], 1
jne 0x415d5a
mov word [ebp - 0x2c], 1
movzx esi, word [ebp - 0x2c]
mov dword [esp], 0
call dword [sym.imp.kernel32.dll_GetModuleHandleA]
sub esp, 4
mov dword [esp + 0xc], esi
mov dword [esp + 8], ebx
mov dword [esp + 4], 0
mov dword [esp], eax
call dbg.WinMain@16
sub esp, 0x10
lea esp, [ebp - 0x10]
pop ecx
pop ebx
pop esi
pop edi
pop ebp
lea esp, [ecx - 4]
ret
add dword [ebp - 0x6c], 1
jmp 0x415d07
and dword [ebp - 0x6c], 1
jne 0x415d00
xor edi, 1
jmp 0x415d07
Function at 0x414220
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4e47a8
mov eax, dword fs:[0]
push eax
sub esp, 0x18
push ebx
push esi
push edi
mov eax, dword [0x52406c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], ecx
mov ebx, dword [ebp + 8]
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x14], ebx
lea ecx, [ebp + 0xc]
mov dword [ebp - 4], 0
call fcn.00403b30
lea ecx, [ebp + 0xc]
call fcn.00403bd0
cmp dword [ebp + 0x20], 0x10
lea esi, [ebp + 0xc]
mov edi, dword [ebp + 0x1c]
mov edx, 0x811c9dc5
cmovae esi, dword [ebp + 0xc]
xor ecx, ecx
test edi, edi
je 0x414295
movzx eax, byte [ecx + esi]
inc ecx
xor eax, edx
imul edx, eax, 0x1000193
cmp ecx, edi
jb 0x414284
mov esi, dword [ebp - 0x10]
mov eax, dword [esi + 0x18]
mov ecx, dword [esi + 0xc]
and eax, edx
mov esi, dword [esi + 4]
mov edi, dword [ecx + eax*8]
add eax, eax
mov edx, dword [ecx + eax*4]
inc eax
mov dword [ebp - 0x1c], edx
lea eax, [ecx + eax*4]
mov dword [ebp - 0x20], eax
cmp edx, esi
jne 0x4142bd
mov eax, esi
jmp 0x4142c1
mov eax, dword [eax]
mov eax, dword [eax]
cmp edi, eax
je 0x41433e
cmp dword [ebp + 0x20], 0x10
lea edx, [ebp + 0xc]
mov ebx, dword [edi + 0x1c]
lea ecx, [edi + 8]
cmovae edx, dword [ebp + 0xc]
cmp ebx, 0x10
mov dword [ebp - 0x24], ebx
mov ebx, dword [ebp - 0x18]
jb 0x4142e4
mov ecx, dword [edi + 8]
push dword [ebp + 0x1c]
mov eax, dword [edi + 0x18]
push edx
mov edx, eax
mov dword [ebp - 0x14], eax
call fcn.0042fac0
add esp, 8
test al, al
jne 0x414306
mov edi, dword [edi]
mov edx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x20]
jmp 0x4142b5
cmp dword [ebp - 0x24], 0x10
lea eax, [edi + 8]
jb 0x414311
mov eax, dword [eax]
cmp dword [ebp + 0x20], 0x10
lea ecx, [ebp + 0xc]
push dword [ebp - 0x14]
cmovae ecx, dword [ebp + 0xc]
mov edx, dword [ebp + 0x1c]
push eax
call fcn.0042fac0
mov edx, dword [ebp - 0x10]
mov cl, al
add esp, 8
mov eax, esi
test cl, cl
je 0x414339
mov eax, dword [edx + 4]
cmovne esi, edi
jmp 0x414343
mov edx, dword [ebp - 0x10]
mov eax, esi
cmp esi, eax
jne 0x41438b
mov ecx, ebx
call fcn.00417ca0
mov dword [ebx + 0x20], 0
mov dword [ebx + 0x24], 0
mov dword [ebx + 0x28], 0
mov edx, dword [ebp + 0x20]
cmp edx, 0x10
jb 0x4143b1
mov ecx, dword [ebp + 0xc]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x4143a7
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4143c7
jmp 0x4143a7
mov ecx, dword [esi + 0x20]
mov eax, dword [edx + 0x20]
shl ecx, 4
add ecx, dword [esi + 0x20]
lea eax, [eax + ecx*4]
mov ecx, ebx
add eax, 0x18
push eax
call fcn.00417a50
jmp 0x414363
push edx
push ecx
call fcn.0046c951
add esp, 8
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x1c
call fcn.004be3cc
int3
Function at 0x414630
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4e4818
mov eax, dword fs:[0]
push eax
sub esp, 0x20
push ebx
push esi
push edi
mov eax, dword [0x52406c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], ecx
mov eax, dword [ebp + 8]
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x18], eax
lea ecx, [ebp + 0xc]
mov dword [ebp - 4], 0
call fcn.00403b30
lea ecx, [ebp + 0xc]
call fcn.00403bd0
cmp dword [ebp + 0x20], 0x10
lea esi, [ebp + 0xc]
mov ebx, dword [ebp + 0xc]
mov edx, 0x811c9dc5
mov edi, dword [ebp + 0x1c]
cmovae esi, ebx
xor ecx, ecx
test edi, edi
je 0x4146a7
movzx eax, byte [ecx + esi]
inc ecx
xor eax, edx
imul edx, eax, 0x1000193
cmp ecx, edi
jb 0x414696
mov esi, dword [ebp - 0x10]
mov eax, dword [esi + 0x18]
mov ecx, dword [esi + 0xc]
and eax, edx
mov esi, dword [esi + 4]
mov dword [ebp - 0x1c], esi
mov edi, dword [ecx + eax*8]
add eax, eax
mov edx, dword [ecx + eax*4]
inc eax
mov dword [ebp - 0x20], edx
lea eax, [ecx + eax*4]
mov dword [ebp - 0x24], eax
nop word [eax + eax]
cmp edx, esi
jne 0x4146d8
mov eax, esi
jmp 0x4146dc
mov eax, dword [eax]
mov eax, dword [eax]
cmp edi, eax
je 0x414757
cmp dword [ebp + 0x20], 0x10
lea edx, [ebp + 0xc]
mov esi, dword [edi + 0x1c]
lea ecx, [edi + 8]
cmovae edx, ebx
mov dword [ebp - 0x28], esi
cmp esi, 0x10
mov esi, dword [ebp - 0x1c]
jb 0x4146fe
mov ecx, dword [edi + 8]
push dword [ebp + 0x1c]
mov eax, dword [edi + 0x18]
push edx
mov edx, eax
mov dword [ebp - 0x18], eax
call fcn.0042fac0
add esp, 8
test al, al
jne 0x414720
mov edi, dword [edi]
mov edx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x24]
jmp 0x4146d0
cmp dword [ebp - 0x28], 0x10
lea eax, [edi + 8]
jb 0x41472b
mov eax, dword [eax]
cmp dword [ebp + 0x20], 0x10
lea ecx, [ebp + 0xc]
push dword [ebp - 0x18]
mov edx, dword [ebp + 0x1c]
cmovae ecx, ebx
push eax
call fcn.0042fac0
mov edx, dword [ebp - 0x10]
mov cl, al
add esp, 8
mov eax, esi
test cl, cl
je 0x414752
mov eax, dword [edx + 4]
cmovne esi, edi
jmp 0x41475c
mov edx, dword [ebp - 0x10]
mov eax, esi
cmp esi, eax
jne 0x41479d
mov esi, dword [ebp - 0x14]
mov eax, dword [ebp + 0x20]
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0xf
mov byte [esi], 0
cmp eax, 0x10
jb 0x4147e9
lea ecx, [eax + 1]
mov eax, ebx
cmp ecx, 0x1000
jb 0x414799
mov ebx, dword [ebx - 4]
add ecx, 0x23
sub eax, ebx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4147ff
push ecx
push ebx
jmp 0x4147e1
mov eax, dword [esi + 0x20]
mov esi, dword [ebp - 0x14]
lea ecx, [eax + eax*2]
mov eax, dword [edx + 0x20]
shl ecx, 4
add ecx, 0x18
add eax, ecx
mov ecx, esi
push eax
call fcn.00432790
mov edx, dword [ebp + 0x20]
cmp edx, 0x10
jb 0x4147e9
mov ecx, dword [ebp + 0xc]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x4147df
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x414804
push edx
push ecx
call fcn.0046c951
add esp, 8
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x1c
call fcn.004be3cc
call fcn.004be3cc
int3
Function at 0x4161a0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x14
push ebx
mov ebx, ecx
push esi
push edi
cmp dword [ebx + 0x38], 0
je 0x4161cb
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.00430020
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov eax, dword [ebx + 0x20]
mov esi, dword [ebp + 0xc]
mov edi, dword [ebp + 0x10]
mov dword [esp + 0x18], esi
mov eax, dword [eax]
mov dword [esp + 0x1c], edi
mov dword [esp + 0x14], eax
test eax, eax
je 0x4161ed
mov eax, dword [ebx + 0x30]
mov eax, dword [eax]
jmp 0x4161ef
xor eax, eax
cdq
mov dword [esp + 0xc], eax
mov ecx, edx
mov dword [esp + 0x10], ecx
test edi, edi
jl 0x416273
jg 0x416204
test esi, esi
je 0x416273
test ecx, ecx
jl 0x41624d
jg 0x41620e
test eax, eax
je 0x41624d
cmp edi, ecx
jg 0x416222
jl 0x416218
cmp esi, eax
jae 0x416222
mov eax, esi
mov dword [esp + 0xc], esi
mov dword [esp + 0x10], edi
push eax
push dword [ebp + 8]
push dword [esp + 0x1c]
call fcn.004ba910
mov ecx, dword [esp + 0x18]
add esp, 0xc
mov edx, dword [ebp + 8]
mov eax, dword [ebx + 0x30]
add edx, ecx
sub esi, ecx
sbb edi, dword [esp + 0x10]
sub dword [eax], ecx
mov eax, dword [ebx + 0x20]
add dword [eax], ecx
jmp 0x416250
mov edx, dword [ebp + 8]
test edi, edi
jl 0x416273
jg 0x41625a
test esi, esi
je 0x416273
mov eax, dword [ebx + 0x4c]
test eax, eax
je 0x416273
push eax
push esi
push 1
push edx
call fcn.004c3e62
add esp, 0x10
sub esi, eax
sbb edi, 0
mov eax, dword [esp + 0x18]
mov edx, dword [esp + 0x1c]
sub eax, esi
sbb edx, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x416290
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x14
push ebx
push esi
push edi
mov edi, ecx
cmp dword [edi + 0x38], 0
je 0x4162bb
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.00427fc0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov eax, dword [edi + 0x1c]
mov esi, dword [ebp + 0xc]
mov ebx, dword [ebp + 0x10]
mov dword [esp + 0x18], esi
mov eax, dword [eax]
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x14], eax
test eax, eax
je 0x4162dd
mov eax, dword [edi + 0x2c]
mov eax, dword [eax]
jmp 0x4162df
xor eax, eax
cdq
mov dword [esp + 0xc], eax
mov ecx, edx
mov dword [esp + 0x10], ecx
test ebx, ebx
jl 0x41637e
jg 0x4162fc
test esi, esi
je 0x41637e
test ecx, ecx
jl 0x416349
jg 0x416306
test eax, eax
je 0x416349
cmp ebx, ecx
jg 0x41631a
jl 0x416310
cmp esi, eax
jae 0x41631a
mov eax, esi
mov dword [esp + 0xc], esi
mov dword [esp + 0x10], ebx
push eax
push dword [esp + 0x18]
push dword [ebp + 8]
call fcn.004ba910
mov ecx, dword [esp + 0x18]
add esp, 0xc
mov edx, dword [ebp + 8]
mov eax, dword [edi + 0x2c]
add edx, ecx
sub esi, ecx
mov dword [esp + 0xc], edx
sbb ebx, dword [esp + 0x10]
sub dword [eax], ecx
mov eax, dword [edi + 0x1c]
add dword [eax], ecx
jmp 0x416350
mov eax, dword [ebp + 8]
mov dword [esp + 0xc], eax
test ebx, ebx
jl 0x41637e
jg 0x41635a
test esi, esi
je 0x41637e
cmp dword [edi + 0x4c], 0
je 0x41637e
mov ecx, edi
call fcn.00418300
push dword [edi + 0x4c]
push esi
push 1
push dword [esp + 0x18]
call fcn.004c40af
add esp, 0x10
sub esi, eax
sbb ebx, 0
mov eax, dword [esp + 0x18]
mov edx, dword [esp + 0x1c]
sub eax, esi
pop edi
pop esi
sbb edx, ebx
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x4166d0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
mov eax, dword [0x52406c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, ecx
cmp ebx, 0xffffffff
jne 0x416700
pop esi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0046c93b
mov esp, ebp
pop ebp
ret 4
mov eax, dword [esi + 0x20]
push edi
mov ecx, dword [eax]
test ecx, ecx
je 0x41673c
mov edx, dword [esi + 0x30]
mov edi, dword [edx]
lea eax, [edi + ecx]
cmp ecx, eax
jae 0x41673c
lea ecx, [edi - 1]
mov dword [edx], ecx
mov edx, dword [esi + 0x20]
mov esi, dword [edx]
lea ecx, [esi + 1]
mov dword [edx], ecx
mov byte [esi], bl
pop edi
pop esi
mov eax, ebx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0046c93b
mov esp, ebp
pop ebp
ret 4
cmp dword [esi + 0x4c], 0
je 0x416821
mov edi, dword [esi + 0xc]
lea eax, [esi + 0x3c]
cmp dword [edi], eax
jne 0x416764
mov edx, dword [esi + 0x54]
mov ecx, dword [esi + 0x50]
sub edx, ecx
mov dword [edi], ecx
mov eax, dword [esi + 0x1c]
mov dword [eax], ecx
mov eax, dword [esi + 0x2c]
mov dword [eax], edx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x416797
push dword [esi + 0x4c]
movsx eax, bl
push eax
call fcn.004c44a6
add esp, 8
or ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, ebx
pop edi
pop esi
mov eax, ecx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0046c93b
mov esp, ebp
pop ebp
ret 4
lea eax, [ebp - 0x2c]
mov byte [ebp - 0x28], bl
mov edx, dword [ecx]
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 0x27]
push eax
lea eax, [ebp - 0x28]
push eax
lea eax, [esi + 0x40]
push eax
call dword [edx + 0x1c]
test eax, eax
js 0x416821
cmp eax, 1
jle 0x4167f4
cmp eax, 3
jne 0x416821
push dword [esi + 0x4c]
push dword [ebp - 0x28]
call fcn.00427f40
add esp, 8
or ecx, 0xffffffff
test al, al
cmovne ecx, ebx
pop edi
pop esi
mov eax, ecx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0046c93b
mov esp, ebp
pop ebp
ret 4
mov edi, dword [ebp - 0x2c]
lea eax, [ebp - 0x24]
sub edi, eax
je 0x416811
push dword [esi + 0x4c]
push edi
push 1
push eax
call fcn.004c3e62
add esp, 0x10
cmp edi, eax
jne 0x416821
lea eax, [ebp - 0x28]
mov byte [esi + 0x3d], 1
cmp dword [ebp - 0x30], eax
jne 0x416727
mov ecx, dword [ebp - 4]
or eax, 0xffffffff
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0046c93b
mov esp, ebp
pop ebp
ret 4
Function at 0x417810
Capabilities:
Access peb ldr_data
Get process heap force flags

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4e4d28
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x52406c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov dword [ebp - 0x10], ebx
mov edi, dword [ebp + 8]
lea esi, [ebx + 0x10]
lea ecx, [esi + 8]
mov dword [ebp + 8], esi
mov eax, dword [edi]
mov dword [ebx], eax
mov eax, dword [edi + 4]
mov dword [ebx + 4], eax
mov eax, dword [edi + 8]
mov dword [ebx + 8], eax
mov eax, dword [edi + 0xc]
mov dword [ebx + 0xc], eax
mov eax, dword [edi + 0x10]
mov dword [esi], eax
mov al, byte [edi + 0x14]
mov byte [esi + 4], al
lea eax, [edi + 0x18]
push eax
call fcn.00418610
movq xmm0, qword [edi + 0x24]
movq qword [esi + 0x14], xmm0
mov eax, dword [edi + 0x2c]
mov dword [esi + 0x1c], eax
movq xmm0, qword [edi + 0x30]
movq qword [esi + 0x20], xmm0
mov eax, dword [edi + 0x38]
mov dword [esi + 0x28], eax
movq xmm0, qword [edi + 0x3c]
movq qword [esi + 0x2c], xmm0
mov eax, dword [edi + 0x44]
mov dword [esi + 0x34], eax
mov dword [ebp - 4], 0
lea esi, [ebx + 0x4c]
movq xmm0, qword [edi + 0x4c]
lea ecx, [ebx + 0x5c]
movq qword [esi], xmm0
mov eax, dword [edi + 0x54]
mov dword [esi + 8], eax
mov eax, dword [edi + 0x58]
mov dword [ebx + 0x58], eax
lea eax, [edi + 0x5c]
push eax
call fcn.00418730
mov ecx, dword [edi + 0x48]
test ecx, ecx
jne 0x4178da
mov dword [ebx + 0x48], ecx
jmp 0x4178f0
lea eax, [edi + 0x4c]
cmp ecx, eax
jne 0x4178e6
mov dword [ebx + 0x48], esi
jmp 0x4178f0
mov ecx, ebx
call fcn.004186e0
mov dword [ebx + 0x48], eax
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x417b00
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [0x52406c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov ebx, ecx
mov dword [ebp - 0x10], edi
mov esi, edi
cmp dword [edi + 0x14], 0x10
jb 0x417b25
mov esi, dword [edi]
xor ecx, ecx
mov edx, 0x811c9dc5
cmp dword [edi + 0x10], ecx
jbe 0x417b43
movzx eax, byte [ecx + esi]
inc ecx
xor eax, edx
imul edx, eax, 0x1000193
cmp ecx, dword [edi + 0x10]
jb 0x417b31
mov eax, dword [ebx + 0x18]
mov ecx, dword [ebx + 0xc]
and eax, edx
mov ebx, dword [ebx + 4]
mov esi, dword [ecx + eax*8]
add eax, eax
mov edx, dword [ecx + eax*4]
inc eax
mov dword [ebp - 8], edx
lea eax, [ecx + eax*4]
mov dword [ebp - 0xc], eax
cmp edx, ebx
jne 0x417b68
mov eax, ebx
jmp 0x417b6c
mov eax, dword [eax]
mov eax, dword [eax]
cmp esi, eax
je 0x417bfb
cmp dword [edi + 0x14], 0x10
mov eax, edi
jb 0x417b7e
mov eax, dword [edi]
cmp dword [esi + 0x1c], 0x10
lea ecx, [esi + 8]
jb 0x417b8a
mov ecx, dword [esi + 8]
push dword [edi + 0x10]
mov edx, dword [esi + 0x18]
push eax
call fcn.0042fac0
add esp, 8
test al, al
jne 0x417ba7
mov esi, dword [esi]
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 0xc]
jmp 0x417b60
mov edi, esi
mov dword [ebp - 0x14], esi
mov dword [ebp - 0x18], edi
mov edi, dword [ebp - 0x10]
cmp dword [ebp - 8], ebx
jne 0x417bbb
mov eax, ebx
jmp 0x417bc2
mov eax, dword [ebp - 0xc]
mov eax, dword [eax]
mov eax, dword [eax]
cmp esi, eax
je 0x417bf3
cmp dword [esi + 0x1c], 0x10
lea edx, [esi + 8]
jb 0x417bd2
mov edx, dword [esi + 8]
cmp dword [edi + 0x14], 0x10
mov ecx, edi
jb 0x417bdc
mov ecx, dword [edi]
push dword [esi + 0x18]
push edx
mov edx, dword [edi + 0x10]
call fcn.0042fac0
add esp, 8
test al, al
je 0x417bf3
mov esi, dword [esi]
jmp 0x417bb2
mov edi, dword [ebp - 0x18]
cmp dword [ebp - 0x14], esi
jne 0x417bff
mov edi, ebx
mov esi, ebx
xor eax, eax
cmp edi, esi
je 0x417c0c
mov edi, dword [edi]
inc eax
cmp edi, esi
jne 0x417c05
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0046c93b
mov esp, ebp
pop ebp
ret 4
Function at 0x418330
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x52406c]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, ecx
push edi
cmp dword [esi + 0x38], 0
je 0x4183d1
cmp byte [esi + 0x3d], 0
je 0x4183d1
mov eax, dword [esi]
push 0xffffffffffffffff
call dword [eax + 0xc]
cmp eax, 0xffffffff
je 0x418387
mov ecx, dword [esi + 0x38]
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 4]
push eax
mov edx, dword [ecx]
lea eax, [ebp - 0x24]
push eax
lea eax, [esi + 0x40]
push eax
call dword [edx + 0x20]
sub eax, 0
je 0x418399
sub eax, 1
je 0x41839d
sub eax, 2
je 0x4183d1
pop edi
xor al, al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0046c93b
mov esp, ebp
pop ebp
ret
mov byte [esi + 0x3d], 0
mov edi, dword [ebp - 0x28]
lea eax, [ebp - 0x24]
sub edi, eax
je 0x4183ba
push dword [esi + 0x4c]
push edi
push 1
push eax
call fcn.004c3e62
add esp, 0x10
cmp edi, eax
jne 0x418387
cmp byte [esi + 0x3d], 0
pop edi
sete al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0046c93b
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
mov al, 1
pop edi
xor ecx, ebp
pop esi
call fcn.0046c93b
mov esp, ebp
pop ebp
ret

Function at 0x419180
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 0xc]
mov edx, 0x811c9dc5
push edi
mov edi, dword [ebp + 8]
mov ecx, 0
sub esi, edi
je 0x4191b1
nop dword [eax]
movzx eax, byte [ecx + edi]
inc ecx
xor eax, edx
imul edx, eax, 0x1000193
cmp ecx, esi
jb 0x4191a0
pop edi
mov eax, edx
pop esi
pop ebp
ret 8
Function at 0x41ea50
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 4], ecx
mov esi, ebx
cmp dword [ebx + 0x14], 0x10
mov edi, dword [ebx + 0x10]
mov dword [ebp - 0xc], eax
jb 0x41ea72
mov esi, dword [ebx]
xor ecx, ecx
mov edx, 0x811c9dc5
test edi, edi
je 0x41ea91
nop dword [eax]
movzx eax, byte [ecx + esi]
inc ecx
xor eax, edx
imul edx, eax, 0x1000193
cmp ecx, edi
jb 0x41ea80
mov edi, dword [ebp - 4]
mov eax, dword [edi + 0x18]
mov ecx, dword [edi + 0xc]
and eax, edx
mov edi, dword [edi + 4]
mov dword [ebp - 0x10], edi
mov esi, dword [ecx + eax*8]
add eax, eax
mov edx, dword [ecx + eax*4]
inc eax
mov dword [ebp - 0x14], edx
lea eax, [ecx + eax*4]
mov dword [ebp - 0x18], eax
cmp edx, edi
jne 0x41eabc
mov eax, edi
jmp 0x41eac0
mov eax, dword [eax]
mov eax, dword [eax]
cmp esi, eax
je 0x41eb42
cmp dword [ebx + 0x14], 0x10
mov edx, ebx
jb 0x41eace
mov edx, dword [ebx]
mov edi, dword [esi + 0x1c]
lea ecx, [esi + 8]
mov dword [ebp - 0x1c], edi
cmp edi, 0x10
mov edi, dword [ebp - 0x10]
jb 0x41eae2
mov ecx, dword [esi + 8]
push dword [ebx + 0x10]
mov eax, dword [esi + 0x18]
push edx
mov edx, eax
mov dword [ebp - 8], eax
call fcn.0042fac0
add esp, 8
test al, al
jne 0x41eb04
mov esi, dword [esi]
mov edx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x18]
jmp 0x41eab4
cmp dword [ebp - 0x1c], 0x10
lea eax, [esi + 8]
jb 0x41eb0f
mov eax, dword [eax]
cmp dword [ebx + 0x14], 0x10
mov ecx, ebx
jb 0x41eb19
mov ecx, dword [ebx]
push dword [ebp - 8]
mov edx, dword [ebx + 0x10]
push eax
call fcn.0042fac0
add esp, 8
test al, al
jne 0x41eb35
test al, al
mov ecx, edi
cmovne edi, esi
jmp 0x41eb44
mov ecx, dword [ebp - 4]
test al, al
cmovne edi, esi
mov ecx, dword [ecx + 4]
jmp 0x41eb44
mov ecx, edi
mov eax, edi
cmp edi, ecx
jne 0x41eb9e
mov esi, dword [ecx]
lea eax, [ebp - 8]
push ecx
push eax
push ecx
mov edi, dword [esi + 4]
push edi
push esi
mov dword [ebp - 8], ebx
call fcn.004238d0
mov ebx, dword [ebp - 4]
mov ecx, eax
mov eax, 0x71c71c6
mov edx, dword [ebx + 8]
sub eax, edx
cmp eax, 1
jb 0x41ebb2
lea eax, [edx + 1]
mov dword [ebx + 8], eax
mov dword [esi + 4], ecx
mov esi, dword [ebp - 0xc]
mov dword [edi], ecx
mov ecx, ebx
mov edx, dword [ebx + 4]
mov edx, dword [edx]
push edx
add edx, 8
push edx
push esi
call fcn.00422bf0
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov dword [ecx], eax
mov eax, ecx
mov byte [ecx + 4], 0
mov esp, ebp
pop ebp
ret 8
push str.list_T__too_long
call fcn.00469c18
int3
Function at 0x423950
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [ebp + 8]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 0xc]
cmp dword [eax + 0x1c], 0x10
push ebx
mov ebx, dword [eax + 0x18]
push esi
lea esi, [eax + 8]
mov dword [ebp - 4], ecx
jb 0x423972
mov esi, dword [esi]
xor edx, edx
push edi
mov edi, 0x811c9dc5
test ebx, ebx
je 0x423991
nop
movzx ecx, byte [edx + esi]
inc edx
xor ecx, edi
imul edi, ecx, 0x1000193
cmp edx, ebx
jb 0x423980
mov ebx, dword [ebp - 4]
mov ecx, dword [ebx + 0x18]
mov edx, dword [ebx + 0xc]
and ecx, edi
pop edi
lea esi, [ecx*8]
mov ecx, dword [edx + esi]
add edx, esi
cmp dword [edx + 4], eax
jne 0x4239cb
cmp ecx, eax
jne 0x4239c3
mov ecx, dword [ebx + 4]
mov dword [edx], ecx
mov edx, dword [ebx + 0xc]
mov ecx, dword [ebx + 4]
mov dword [esi + edx + 4], ecx
jmp 0x4239d3
mov ecx, dword [eax + 4]
mov dword [edx + 4], ecx
jmp 0x4239d3
cmp ecx, eax
jne 0x4239d3
mov ecx, dword [eax]
mov dword [edx], ecx
mov ecx, dword [eax + 4]
mov esi, dword [eax]
push eax
mov dword [ecx], esi
mov edx, dword [eax]
mov ecx, dword [eax + 4]
mov dword [edx + 4], ecx
dec dword [ebx + 8]
call fcn.00419490
mov eax, dword [ebp - 8]
mov dword [eax], esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x427550
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4e5730
mov eax, dword fs:[0]
push eax
push esi
push edi
mov eax, dword [0x52406c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
push 8
mov dword [edi], vtable.std::basic_streambuf_char__struct_std::char_traits_char__.0
call fcn.0046c968
mov esi, eax
xorps xmm0, xmm0
movq qword [esi], xmm0
push 1
mov dword [ebp - 4], 0
call fcn.0046aa25
mov dword [esi + 4], eax
lea ecx, [edi + 8]
lea eax, [edi + 4]
mov dword [edi + 0x34], esi
mov dword [edi + 0xc], eax
add esp, 8
lea eax, [edi + 0x14]
mov dword [edi + 0x10], ecx
mov dword [edi + 0x1c], eax
lea eax, [edi + 0x18]
mov dword [edi + 0x20], eax
lea eax, [edi + 0x24]
mov dword [edi + 0x2c], eax
lea eax, [edi + 0x28]
mov dword [edi + 0x30], eax
mov dword [ecx], 0
mov eax, dword [edi + 0x20]
mov dword [eax], 0
mov eax, dword [edi + 0x30]
mov dword [eax], 0
mov eax, dword [edi + 0xc]
mov dword [eax], 0
mov eax, dword [edi + 0x1c]
mov dword [eax], 0
mov eax, dword [edi + 0x2c]
mov dword [eax], 0
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret