joyce8/EMBER2024-capa huggingface dataset:
Function at 0x44ce20
Capabilities:
Check for time delay via queryperformancecounter

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x5c
cmp dword [0x74b5d8], 0
push ebx
push esi
mov esi, edx
mov dword [ebp - 8], ecx
push edi
mov dword [ebp - 4], esi
je 0x44d007
mov ebx, dword [esi + 8]
mov edi, dword [esi]
mov ecx, dword [ebp - 4]
mov esi, dword [esi + 0xc]
mov dword [ebp - 0x24], 0
lea eax, [edi + ebx]
sub ebx, edi
mov ecx, dword [ecx + 4]
cdq
sub eax, edx
sar eax, 1
mov dword [ebp - 0x30], eax
lea eax, [ecx + esi]
cdq
sub esi, ecx
mov ecx, dword [ebp - 8]
sub eax, edx
sar eax, 1
cmp ebx, esi
mov dword [ebp - 0x2c], eax
cmovle esi, ebx
mov eax, esi
cdq
and edx, 3
add eax, edx
sar eax, 2
movd xmm0, eax
mov eax, dword [ecx]
cvtdq2ps xmm0, xmm0
movss dword [ebp - 0x28], xmm0
call dword [eax + 0x38]
lea eax, [ebp - 0x38]
push eax
call dword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
mov esi, dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
lea eax, [ebp - 0x40]
push eax
call esi
mov ebx, dword [sym.imp.USER32.dll_PeekMessageW]
xorps xmm0, xmm0
movss dword [ebp - 4], xmm0
mov eax, dword [ebp - 0x24]
test eax, eax
jne 0x44cfd7
lea eax, [ebp - 0x18]
push eax
call esi
mov edi, dword [ebp - 0x18]
mov ecx, edi
sub ecx, dword [ebp - 0x40]
mov esi, dword [ebp - 0x14]
mov edx, esi
sbb edx, dword [ebp - 0x3c]
call fcn.006d4970
mov edx, dword [ebp - 0x34]
mov ecx, dword [ebp - 0x38]
cvtsd2ss xmm0, xmm0
movss dword [ebp - 0xc], xmm0
call fcn.006d4970
movss xmm1, dword [ebp - 0xc]
cvtsd2ss xmm0, xmm0
mov dword [ebp - 0x3c], esi
mov esi, dword [ebp - 8]
mov ecx, esi
mov dword [ebp - 0x40], edi
divss xmm1, xmm0
mov eax, dword [esi]
movss xmm0, dword [0x739878]
minss xmm0, xmm1
addss xmm0, dword [ebp - 4]
movss dword [ebp - 4], xmm0
call dword [eax + 0x34]
mov dword [ebp - 0x24], eax
test eax, eax
jne 0x44cfd7
lea eax, [ebp - 0x30]
push eax
push 0x44cab0
push dword [0x74b5d8]
call dword [sym.imp.USER32.dll_EnumChildWindows]
cmp dword [ebp - 0x24], 0
jne 0x44cf99
push 0x400003
push 0
push 0
xorps xmm0, xmm0
mov dword [ebp - 0x44], 0
push 0
lea eax, [ebp - 0x5c]
movq qword [ebp - 0x4c], xmm0
push eax
movups xmmword [ebp - 0x5c], xmm0
call ebx
test eax, eax
je 0x44cf99
lea eax, [ebp - 0x5c]
push eax
call dword [sym.imp.USER32.dll_TranslateMessage]
lea eax, [ebp - 0x5c]
push eax
call dword [sym.imp.USER32.dll_DispatchMessageW]
push 0x400003
push 0
push 0
push 0
lea eax, [ebp - 0x5c]
push eax
call ebx
test eax, eax
jne 0x44cf70
push 1
call dword [sym.imp.KERNEL32.dll_Sleep]
movss xmm0, dword [0x739980]
comiss xmm0, dword [ebp - 4]
mov esi, dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
ja 0x44ceb5
mov eax, dword [ebp - 0x24]
test eax, eax
jne 0x44cfd7
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x44d007
call dword [sym.imp.KERNEL32.dll_DebugBreak]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea ecx, [ebp - 0x20]
push ecx
push dword [ebp + 0xc]
push dword [ebp + 8]
push eax
push dword [0x74b5d8]
call dword [0x74d65c]
add esp, 0x14
test eax, eax
js 0x44d007
lea eax, [ebp - 0x20]
mov ecx, 0x74c540
push eax
lea eax, [ebp - 0x18]
push eax
call fcn.0045b500
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x455a20
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x74b714]
xorps xmm0, xmm0
push esi
movlpd qword [ebp - 0x20], xmm0
push edi
mov esi, dword [eax]
mov edi, dword [ebp - 0x1c]
mov dword [ebp - 0x14], esi
mov dword [ebp - 8], edi
cmp esi, eax
je 0x455b2f
mov eax, dword [ebp - 0x20]
mov dword [ebp - 4], eax
mov eax, dword [0x74b714]
nop word [eax + eax]
cmp dword [esi + 0x20], 0
lea edx, [esi + 8]
je 0x455b13
cmp dword [edx + 0x14], 0xf
mov eax, dword [edx + 0x10]
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x10], edx
jbe 0x455a91
mov eax, dword [edx]
mov dword [ebp - 0x10], eax
xor ecx, ecx
mov eax, 0x811c9dc5
cmp dword [edx + 0x10], ecx
jbe 0x455ac5
mov edx, dword [ebp - 0x10]
mov edi, eax
mov esi, dword [ebp - 0x1c]
movzx eax, byte [edx + ecx]
inc ecx
xor eax, edi
imul edi, eax, 0x1000193
cmp ecx, esi
jb 0x455aa5
mov esi, dword [ebp - 0x14]
mov dword [ebp - 0xc], edi
mov edi, dword [ebp - 8]
mov eax, dword [ebp - 0xc]
lea edx, [esi + 8]
push eax
push edx
lea eax, [ebp - 0x28]
mov ecx, 0x74b730
push eax
call fcn.004100f0
mov ecx, dword [0x74b734]
mov eax, dword [eax + 4]
test eax, eax
cmovne ecx, eax
cmp ecx, dword [0x74b734]
je 0x455b18
movzx edx, byte [ecx + 0x39]
xor eax, eax
bts eax, edx
xor ecx, ecx
cmp edx, 0x20
cmovae ecx, eax
xor eax, ecx
cmp edx, 0x40
mov edx, dword [ebp - 4]
cmovae ecx, eax
or edx, eax
or edi, ecx
mov dword [ebp - 4], edx
mov dword [ebp - 8], edi
jmp 0x455b1b
mov edx, dword [ebp - 4]
jmp 0x455b20
mov edx, dword [ebp - 4]
mov eax, dword [0x74b714]
mov esi, dword [esi]
mov dword [ebp - 0x14], esi
cmp esi, eax
jne 0x455a70
jmp 0x455b35
mov edx, dword [ebp - 0x20]
mov dword [ebp - 4], edx
cmp dword [0x74b6e0], 0
mov eax, edx
je 0x455b8a
or eax, edi
je 0x455b88
mov eax, dword [0x74b734]
mov ecx, dword [eax]
cmp ecx, eax
je 0x455b88
mov eax, dword [ebp - 4]
movzx edx, byte [ecx + 0x39]
xor esi, esi
mov ecx, dword [ecx]
bts esi, edx
xor edi, edi
cmp edx, 0x20
cmovae edi, esi
xor esi, edi
cmp edx, 0x40
mov edx, dword [ebp - 8]
cmovae edi, esi
or eax, esi
or edx, edi
mov dword [ebp - 8], edx
cmp ecx, dword [0x74b734]
jne 0x455b52
pop edi
pop esi
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret
mov eax, edx
mov edx, edi
pop edi
pop esi
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret
Function at 0x4574d0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
cmp dword [eax + 0x10], 0
jne 0x457535
mov edi, dword [0x74bfdc]
mov esi, dword [edi]
cmp esi, edi
je 0x457522
nop dword [eax]
mov ebx, dword [esi + 0x20]
test ebx, ebx
je 0x45751c
mov ecx, dword [ebx]
test ecx, ecx
je 0x457502
mov eax, dword [ecx]
call dword [eax + 0xc]
push dword [ebx + 4]
mov dword [ebx], 0
call dword [sym.imp.USER32.dll_DestroyWindow]
push 0xc
push ebx
call fcn.005ab85c
add esp, 8
mov esi, dword [esi]
cmp esi, edi
jne 0x4574f0
mov ecx, 0x74bfd8
call fcn.0045b670
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
push eax
lea eax, [ebp + 8]
mov ecx, 0x74bfd8
push eax
call fcn.00429d10
mov esi, dword [ebp + 8]
mov ebx, dword [0x74bfdc]
mov dword [ebp - 4], esi
cmp esi, ebx
je 0x4575e4
mov ecx, dword [esi + 0x20]
test ecx, ecx
je 0x45756b
push ecx
call fcn.0044e680
mov ebx, dword [0x74bfdc]
cmp dword [esi + 0x1c], 0xf
lea edx, [esi + 8]
mov eax, dword [edx + 0x10]
jbe 0x457579
mov edx, dword [edx]
xor ecx, ecx
mov edi, 0x811c9dc5
test eax, eax
je 0x45759a
mov esi, eax
movzx eax, byte [edx + ecx]
inc ecx
xor eax, edi
imul edi, eax, 0x1000193
cmp ecx, esi
jb 0x457586
mov esi, dword [ebp - 4]
and edi, dword [0x74bff0]
mov eax, dword [0x74bfe4]
lea ecx, [eax + edi*8]
mov eax, dword [ecx]
cmp dword [ecx + 4], esi
jne 0x4575c2
cmp eax, esi
jne 0x4575ba
mov dword [ecx], ebx
mov dword [ecx + 4], ebx
jmp 0x4575ca
mov ebx, dword [esi + 4]
mov dword [ecx + 4], ebx
jmp 0x4575ca
cmp eax, esi
jne 0x4575ca
mov eax, dword [esi]
mov dword [ecx], eax
mov ecx, dword [esi]
mov edx, esi
dec dword [0x74bfe0]
mov eax, dword [esi + 4]
mov dword [eax], ecx
mov eax, dword [esi + 4]
mov dword [ecx + 4], eax
call fcn.0042c6e0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x4589b0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
sub esp, 0x28
push esi
push edi
mov edi, dword [0x74b714]
mov dword [ebp - 0x1c], edi
mov esi, dword [edi]
mov dword [ebp - 0x14], esi
cmp esi, edi
je 0x458ab7
mov eax, dword [esi + 0x20]
lea edx, [esi + 8]
mov dword [ebp - 0x10], eax
test eax, eax
je 0x458aaa
cmp dword [edx + 0x14], 0xf
mov eax, dword [edx + 0x10]
mov dword [ebp - 0x18], eax
mov dword [ebp - 8], edx
jbe 0x458a06
mov eax, dword [edx]
mov dword [ebp - 8], eax
xor eax, eax
mov ecx, 0x811c9dc5
cmp dword [edx + 0x10], eax
jbe 0x458a40
mov edi, dword [ebp - 8]
mov edx, ecx
mov esi, dword [ebp - 0x18]
nop word [eax + eax]
movzx ecx, byte [edi + eax]
inc eax
xor ecx, edx
imul edx, ecx, 0x1000193
cmp eax, esi
jb 0x458a20
mov esi, dword [ebp - 0x14]
mov edi, dword [ebp - 0x1c]
mov dword [ebp - 4], edx
mov ecx, dword [ebp - 4]
lea edx, [esi + 8]
push ecx
push edx
lea eax, [ebp - 0x28]
mov ecx, 0x74b730
push eax
call fcn.004100f0
mov edx, dword [0x74b734]
mov ecx, edx
mov eax, dword [eax + 4]
test eax, eax
cmovne ecx, eax
mov eax, dword [0x74b6e4]
test al, 0x21
jne 0x458a8a
cmp ecx, edx
je 0x458a84
mov cl, byte [ecx + 0x39]
mov eax, 1
shl eax, cl
test dword [0x74b6e8], eax
mov eax, dword [0x74b6e4]
jne 0x458a8a
mov byte [ebp - 0xc], 0
jmp 0x458a8e
mov byte [ebp - 0xc], 1
mov ecx, dword [ebp - 0x10]
test al, 0xc0
push dword [ebp - 0xc]
setne byte [ebp - 0x20]
mov eax, dword [ecx]
call dword [eax + 0x14]
mov ecx, dword [ebp - 0x10]
push dword [ebp - 0x20]
mov eax, dword [ecx]
call dword [eax + 0x18]
mov esi, dword [esi]
mov dword [ebp - 0x14], esi
cmp esi, edi
jne 0x4589e1
call fcn.00455110
pop edi
pop esi
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret
Function at 0x45b010
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
sub esp, 0x28
push esi
push edi
lea eax, [ebp - 0x20]
push eax
call dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov edi, dword [ebp - 0x20]
mov ecx, edi
sub ecx, dword [0x74b850]
mov esi, dword [ebp - 0x1c]
mov edx, esi
sbb edx, dword [0x74b854]
call fcn.006d4970
mov edx, dword [0x74b85c]
mov ecx, dword [0x74b858]
cvtsd2ss xmm0, xmm0
movss dword [ebp - 0x10], xmm0
call fcn.006d4970
movss xmm1, dword [ebp - 0x10]
cvtsd2ss xmm0, xmm0
mov al, byte [0x74b6e4]
and al, 1
mov dword [0x74b850], edi
mov edi, dword [0x74b714]
mov dword [0x74b854], esi
movss xmm2, dword [0x7399b0]
divss xmm1, xmm0
mov esi, dword [edi]
mov byte [ebp - 1], al
mov dword [ebp - 0x18], edi
mov dword [ebp - 0x10], esi
minss xmm2, xmm1
movss dword [ebp - 0x1c], xmm2
cmp esi, edi
je 0x45b1e8
mov eax, dword [esi + 0x24]
lea ecx, [esi + 8]
cmp eax, dword [ecx + 0x20]
je 0x45b1d6
cmp dword [ecx + 0x14], 0xf
mov eax, dword [ecx + 0x10]
mov dword [ebp - 0x14], eax
mov dword [ebp - 0xc], ecx
jbe 0x45b0d7
mov eax, dword [ecx]
mov dword [ebp - 0xc], eax
xor edx, edx
mov eax, 0x811c9dc5
cmp dword [ecx + 0x10], edx
jbe 0x45b110
mov edi, dword [ebp - 0xc]
mov ecx, eax
mov esi, dword [ebp - 0x14]
nop dword [eax + eax]
movzx eax, byte [edi + edx]
inc edx
xor eax, ecx
imul ecx, eax, 0x1000193
cmp edx, esi
jb 0x45b0f0
mov esi, dword [ebp - 0x10]
mov edi, dword [ebp - 0x18]
mov dword [ebp - 8], ecx
mov eax, dword [ebp - 8]
lea ecx, [esi + 8]
push eax
push ecx
lea eax, [ebp - 0x28]
mov ecx, 0x74b730
push eax
call fcn.004100f0
mov ecx, dword [0x74b734]
mov eax, dword [eax + 4]
test eax, eax
cmovne ecx, eax
cmp ecx, dword [0x74b734]
je 0x45b149
mov cl, byte [ecx + 0x39]
mov eax, 1
shl eax, cl
test dword [ebx + 8], eax
je 0x45b149
mov al, 1
jmp 0x45b14b
xor al, al
cmp byte [ebp - 1], 0
jne 0x45b155
test al, al
je 0x45b160
test byte [esi + 0x48], 2
lea eax, [esi + 8]
je 0x45b1d6
jmp 0x45b163
lea eax, [esi + 8]
mov ecx, dword [eax + 0x3c]
cmp ecx, 2
je 0x45b1c3
cmp ecx, 3
je 0x45b1c3
movss xmm1, dword [eax + 0x34]
movss xmm0, dword [0x739850]
comiss xmm0, xmm1
ja 0x45b1d6
movaps xmm0, xmm2
addss xmm0, dword [eax + 0x48]
movss dword [eax + 0x48], xmm0
divss xmm0, dword [0x739a10]
comiss xmm1, xmm0
ja 0x45b1d6
mov ecx, dword [eax + 0x18]
test ecx, ecx
je 0x45b1c9
mov eax, dword [ecx]
mov eax, dword [eax + 0x10]
call eax
cmp eax, 4
lea eax, [esi + 8]
jne 0x45b1c9
test byte [eax + 0x40], 1
jne 0x45b1d6
cmp byte [eax + 0x92], 0
je 0x45b1c9
jmp 0x45b1d6
cmp byte [ebx + 0xc], 0
je 0x45b1d6
push 0
push eax
mov ecx, 0x74b6e0
call fcn.00450260
mov esi, dword [esi]
movss xmm2, dword [ebp - 0x1c]
mov dword [ebp - 0x10], esi
cmp esi, edi
jne 0x45b0b4
call fcn.00459e50
pop edi
pop esi
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret 8
Function at 0x45b250
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push esi
push edi
mov edi, ecx
mov edx, 0x1571
mov eax, 1
mov dword [edi + 0x1384], 0xffffffff
lea esi, [edi + 8]
mov dword [edi + 4], 0x1571
mov ecx, edx
lea esi, [esi + 4]
shr ecx, 0x1e
xor ecx, edx
imul edx, ecx, 0x6c078965
add edx, eax
inc eax
mov dword [esi - 4], edx
cmp eax, 0x270
jb 0x45b272
mov dword [edi], 0x270
mov eax, edi
pop edi
pop esi
ret

Function at 0x45b800
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov ebx, ecx
mov edx, edi
cmp dword [edi + 0x14], 0xf
jbe 0x45b818
mov edx, dword [edi]
xor ecx, ecx
mov esi, 0x811c9dc5
cmp dword [edi + 0x10], ecx
jbe 0x45b836
movzx eax, byte [edx + ecx]
inc ecx
xor eax, esi
imul esi, eax, 0x1000193
cmp ecx, dword [edi + 0x10]
jb 0x45b824
push esi
push edi
lea eax, [ebp - 0xc]
mov ecx, ebx
push eax
call fcn.004100f0
mov eax, dword [ebp - 8]
test eax, eax
jne 0x45b8f0
cmp dword [ebx + 8], 0x3ffffff
je 0x45b8fc
push pe_nt_image_headers32
call fcn.005ab82c
add esp, 4
mov dword [ebp + 8], eax
lea ecx, [eax + 8]
push edi
call fcn.004141c0
mov edi, dword [ebp + 8]
xorps xmm0, xmm0
add edi, 8
lea ecx, [edi + 0x18]
movups xmmword [ecx], xmm0
movups xmmword [ecx + 0x10], xmm0
call fcn.00460700
mov eax, dword [ebx + 8]
inc eax
movd xmm0, eax
cvtdq2pd xmm0, xmm0
shr eax, 0x1f
addsd xmm0, qword [eax*8 + 0x739f30]
mov eax, dword [ebx + 0x1c]
cvtpd2ps xmm1, xmm0
movd xmm0, eax
cvtdq2pd xmm0, xmm0
shr eax, 0x1f
addsd xmm0, qword [eax*8 + 0x739f30]
cvtpd2ps xmm0, xmm0
divss xmm1, xmm0
comiss xmm1, dword [ebx]
jbe 0x45b8e1
mov ecx, ebx
call fcn.0045dfd0
push esi
push edi
lea eax, [ebp - 0xc]
mov ecx, ebx
push eax
call fcn.004100f0
mov ecx, dword [eax]
jmp 0x45b8e4
mov ecx, dword [ebp - 0xc]
push dword [ebp + 8]
push ecx
push esi
mov ecx, ebx
call fcn.0040fa90
pop edi
pop esi
add eax, 0x20
pop ebx
mov esp, ebp
pop ebp
ret 4
push str.unordered_map_set_too_long
call fcn.005acb94
int3
Function at 0x45b910
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov ebx, ecx
mov edx, edi
cmp dword [edi + 0x14], 0xf
jbe 0x45b928
mov edx, dword [edi]
xor ecx, ecx
mov esi, 0x811c9dc5
cmp dword [edi + 0x10], ecx
jbe 0x45b946
movzx eax, byte [edx + ecx]
inc ecx
xor eax, esi
imul esi, eax, 0x1000193
cmp ecx, dword [edi + 0x10]
jb 0x45b934
push esi
push edi
lea eax, [ebp - 0xc]
mov ecx, ebx
push eax
call fcn.004100f0
mov eax, dword [ebp - 8]
test eax, eax
jne 0x45ba2f
cmp dword [ebx + 8], 0x3ffffff
je 0x45ba3b
push pe_nt_image_headers32
call fcn.005ab82c
xorps xmm0, xmm0
mov dword [ebp + 8], eax
add esp, 4
movups xmmword [eax + 8], xmm0
mov dword [eax + 0x18], 0
lea ecx, [eax + 0x20]
mov dword [eax + 0x1c], 0
movups xmm0, xmmword [edi]
movups xmmword [eax + 8], xmm0
movq xmm0, qword [edi + 0x10]
movq qword [eax + 0x18], xmm0
xorps xmm0, xmm0
mov dword [edi + 0x10], 0
mov dword [edi + 0x14], 0xf
mov byte [edi], 0
movups xmmword [ecx], xmm0
movups xmmword [ecx + 0x10], xmm0
call fcn.00460700
mov eax, dword [ebx + 8]
inc eax
movd xmm0, eax
cvtdq2pd xmm0, xmm0
shr eax, 0x1f
addsd xmm0, qword [eax*8 + 0x739f30]
mov eax, dword [ebx + 0x1c]
cvtpd2ps xmm1, xmm0
movd xmm0, eax
cvtdq2pd xmm0, xmm0
shr eax, 0x1f
addsd xmm0, qword [eax*8 + 0x739f30]
cvtpd2ps xmm0, xmm0
divss xmm1, xmm0
comiss xmm1, dword [ebx]
jbe 0x45ba1f
mov ecx, ebx
call fcn.0045dfd0
mov edi, dword [ebp + 8]
mov ecx, ebx
push esi
lea eax, [edi + 8]
push eax
lea eax, [ebp - 0xc]
push eax
call fcn.004100f0
mov ecx, dword [eax]
jmp 0x45ba25
mov ecx, dword [ebp - 0xc]
mov edi, dword [ebp + 8]
push edi
push ecx
push esi
mov ecx, ebx
call fcn.0040fa90
pop edi
pop esi
add eax, 0x20
pop ebx
mov esp, ebp
pop ebp
ret 4
push str.unordered_map_set_too_long
call fcn.005acb94
int3
Function at 0x45bcf0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [ebp + 0xc]
push edi
mov edi, ecx
mov dword [ebp - 0x10], edi
cmp eax, ebx
je 0x45be92
cmp dword [eax + 0x1c], 0xf
lea edx, [eax + 8]
mov ecx, dword [edi + 4]
mov dword [ebp - 0x18], ecx
mov ecx, dword [edi + 0xc]
mov dword [ebp - 0x14], ecx
mov ecx, dword [eax + 4]
mov eax, dword [edx + 0x10]
mov dword [ebp - 0x1c], ecx
jbe 0x45bd2b
mov edx, dword [edx]
xor ecx, ecx
push esi
mov esi, 0x811c9dc5
test eax, eax
je 0x45bd54
mov edi, eax
nop dword [eax]
movzx eax, byte [edx + ecx]
inc ecx
xor eax, esi
imul esi, eax, 0x1000193
cmp ecx, edi
jb 0x45bd40
mov edi, dword [ebp - 0x10]
mov eax, dword [edi + 0x18]
mov ecx, dword [ebp - 0x14]
and eax, esi
lea eax, [ecx + eax*8]
mov ecx, dword [eax]
mov dword [ebp - 4], eax
mov eax, dword [eax + 4]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 8]
mov edx, eax
mov dword [ebp - 0xc], ecx
mov esi, dword [eax]
call fcn.0042c6e0
dec dword [edi + 8]
mov eax, dword [ebp + 8]
cmp eax, dword [ebp - 8]
je 0x45bda2
mov dword [ebp - 0x20], esi
cmp esi, ebx
je 0x45bdb1
mov edx, esi
mov esi, dword [esi]
call fcn.0042c6e0
dec dword [edi + 8]
mov eax, dword [ebp - 8]
cmp dword [ebp - 0x20], eax
jne 0x45bd84
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 4]
cmp dword [ebp - 0xc], eax
jne 0x45bdd5
mov eax, dword [ebp - 0x18]
mov dword [ecx], eax
jmp 0x45bdd8
mov eax, dword [ebp + 8]
cmp dword [ebp - 0xc], eax
jne 0x45be89
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 4]
mov dword [ecx], esi
mov dword [eax], esi
mov dword [esi + 4], eax
mov eax, ebx
pop esi
pop edi
pop ebx
mov esp, ebp
pop ebp
ret 8
mov eax, dword [ebp - 0x1c]
mov dword [ecx + 4], eax
cmp esi, ebx
je 0x45be89
cmp dword [esi + 0x1c], 0xf
lea edx, [esi + 8]
mov eax, dword [edx + 0x10]
mov dword [ebp - 0x20], esi
mov dword [ebp + 8], eax
jbe 0x45bdf7
mov edx, dword [edx]
xor ecx, ecx
mov ebx, 0x811c9dc5
test eax, eax
je 0x45be19
mov edi, dword [ebp + 8]
movzx eax, byte [edx + ecx]
inc ecx
xor eax, ebx
imul ebx, eax, 0x1000193
cmp ecx, edi
jb 0x45be05
mov edi, dword [ebp - 0x10]
mov eax, dword [edi + 0x18]
mov edx, esi
mov ecx, dword [ebp - 0x14]
and eax, ebx
mov ebx, dword [ecx + eax*8 + 4]
mov esi, dword [esi]
mov dword [ebp - 0xc], ebx
lea eax, [ecx + eax*8]
mov dword [ebp + 8], eax
call fcn.0042c6e0
dec dword [edi + 8]
cmp dword [ebp - 0x20], ebx
je 0x45be58
nop
mov ebx, esi
cmp esi, dword [ebp + 0xc]
je 0x45be81
mov edx, esi
mov esi, dword [esi]
call fcn.0042c6e0
dec dword [edi + 8]
cmp ebx, dword [ebp - 0xc]
jne 0x45be40
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0x18]
mov ebx, dword [ebp + 0xc]
mov dword [eax], ecx
mov dword [eax + 4], ecx
cmp esi, ebx
jne 0x45bde3
mov eax, dword [ebp - 0x1c]
mov dword [eax], esi
mov dword [esi + 4], eax
mov eax, ebx
pop esi
pop edi
pop ebx
mov esp, ebp
pop ebp
ret 8
mov eax, dword [ebp + 8]
mov ebx, dword [ebp + 0xc]
mov dword [eax], esi
mov eax, dword [ebp - 0x1c]
mov dword [eax], esi
mov dword [esi + 4], eax
pop esi
pop edi
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x45bea0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
mov dword [ebp - 4], ecx
cmp edx, eax
je 0x45c015
cmp dword [edx + 0x1c], 0xf
mov eax, dword [ecx + 4]
push ebx
push esi
mov dword [ebp - 0x14], eax
mov esi, edx
mov eax, dword [ecx + 0xc]
push edi
mov dword [ebp - 0x10], eax
lea edi, [edx + 8]
mov eax, dword [edx + 4]
mov dword [ebp - 0x18], eax
mov eax, dword [edi + 0x10]
jbe 0x45bedc
mov edi, dword [edi]
xor edx, edx
mov ebx, 0x811c9dc5
test eax, eax
je 0x45bf04
mov ecx, eax
nop dword [eax]
movzx eax, byte [edi + edx]
inc edx
xor eax, ebx
imul ebx, eax, 0x1000193
cmp edx, ecx
jb 0x45bef0
mov ecx, dword [ebp - 4]
mov eax, dword [ecx + 0x18]
mov ecx, dword [ebp - 0x10]
and eax, ebx
lea eax, [ecx + eax*8]
mov ecx, dword [eax]
mov dword [ebp - 8], eax
mov eax, dword [eax + 4]
mov dword [ebp - 0xc], ecx
mov dword [ebp - 0x1c], eax
nop dword [eax]
mov edi, esi
mov ebx, esi
mov esi, dword [esi]
lea ecx, [edi + 8]
call fcn.00427020
push 0xa0
push edi
call fcn.005ab85c
mov eax, dword [ebp - 4]
add esp, 8
dec dword [eax + 8]
cmp ebx, dword [ebp - 0x1c]
je 0x45bf71
cmp esi, dword [ebp + 0xc]
jne 0x45bf20
mov ecx, dword [ebp - 0xc]
cmp ecx, dword [ebp + 8]
jne 0x45c007
mov eax, dword [ebp - 0x18]
mov edx, dword [ebp - 8]
pop edi
mov dword [edx], esi
mov dword [eax], esi
mov dword [esi + 4], eax
mov eax, dword [ebp + 0xc]
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
mov ecx, dword [ebp - 0xc]
mov edx, dword [ebp - 8]
cmp ecx, dword [ebp + 8]
jne 0x45bf83
mov ecx, dword [ebp - 0x14]
mov dword [edx], ecx
jmp 0x45bf86
mov ecx, dword [ebp - 0x18]
mov dword [edx + 4], ecx
cmp esi, dword [ebp + 0xc]
je 0x45c007
nop
cmp dword [esi + 0x1c], 0xf
lea edi, [esi + 8]
mov ebx, dword [edi + 0x10]
jbe 0x45bf9e
mov edi, dword [edi]
xor ecx, ecx
mov edx, 0x811c9dc5
test ebx, ebx
je 0x45bfc4
nop dword [eax]
movzx eax, byte [edi + ecx]
inc ecx
xor eax, edx
imul edx, eax, 0x1000193
cmp ecx, ebx
jb 0x45bfb0
mov eax, dword [ebp - 4]
and edx, dword [eax + 0x18]
mov eax, dword [ebp - 0x10]
lea eax, [eax + edx*8]
mov dword [ebp + 8], eax
mov eax, dword [eax + 4]
mov dword [ebp - 0x1c], eax
mov edi, esi
mov ebx, esi
mov esi, dword [esi]
lea ecx, [edi + 8]
call fcn.00427020
push 0xa0
push edi
call fcn.005ab85c
mov eax, dword [ebp - 4]
add esp, 8
dec dword [eax + 8]
cmp ebx, dword [ebp - 0x1c]
je 0x45c01b
cmp esi, dword [ebp + 0xc]
jne 0x45bfd6
mov ecx, dword [ebp + 8]
mov dword [ecx], esi
mov eax, dword [ebp - 0x18]
pop edi
mov dword [eax], esi
mov dword [esi + 4], eax
mov eax, dword [ebp + 0xc]
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
mov ecx, dword [ebp + 8]
mov edx, dword [ebp - 0x14]
mov dword [ecx], edx
mov dword [ecx + 4], edx
cmp esi, dword [ebp + 0xc]
jne 0x45bf90
mov eax, dword [ebp - 0x18]
pop edi
mov dword [eax], esi
mov dword [esi + 4], eax
mov eax, dword [ebp + 0xc]
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8