joyce8/EMBER2024-capa huggingface dataset:
Function at 0x461a30
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0x17], 0
je 0x461a52
xor eax, eax
nop dword [eax + eax]
lea edx, [eax + esi]
lea ecx, [eax - 0xc]
inc eax
xor byte [edx], cl
cmp eax, 0x16
jb 0x461a40
mov byte [esi + 0x17], 0
pop esi
ret

Function at 0x461a60
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0x5c], 0
je 0x461a82
xor eax, eax
nop dword [eax + eax]
lea edx, [eax + esi]
lea ecx, [eax - 0xc]
inc eax
xor byte [edx], cl
cmp eax, 0x5b
jb 0x461a70
mov byte [esi + 0x5c], 0
pop esi
ret

Function at 0x461a90
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0x27], 0
je 0x461ab2
xor eax, eax
nop dword [eax + eax]
lea edx, [eax + esi]
lea ecx, [eax - 0xc]
inc eax
xor byte [edx], cl
cmp eax, 0x26
jb 0x461aa0
mov byte [esi + 0x27], 0
pop esi
ret

Function at 0x461ae0
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0x2e], 0
je 0x461b02
xor eax, eax
nop dword [eax + eax]
lea edx, [eax + esi]
lea ecx, [eax - 0xc]
inc eax
xor byte [edx], cl
cmp eax, 0x2d
jb 0x461af0
mov byte [esi + 0x2e], 0
pop esi
ret

Function at 0x461b10
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0x1a], 0
je 0x461b32
xor eax, eax
nop dword [eax + eax]
lea edx, [eax + esi]
lea ecx, [eax - 0xc]
inc eax
xor byte [edx], cl
cmp eax, 0x19
jb 0x461b20
mov byte [esi + 0x1a], 0
pop esi
ret

Function at 0x461d20
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0x1d], 0
je 0x461d42
xor eax, eax
nop dword [eax + eax]
lea edx, [eax + esi]
lea ecx, [eax - 0xc]
inc eax
xor byte [edx], cl
cmp eax, 0x1c
jb 0x461d30
mov byte [esi + 0x1d], 0
pop esi
ret

Function at 0x461d50
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 7], 0
je 0x461d72
xor eax, eax
nop dword [eax + eax]
lea edx, [eax + esi]
lea ecx, [eax - 0xc]
inc eax
xor byte [edx], cl
cmp eax, 6
jb 0x461d60
mov byte [esi + 7], 0
pop esi
ret

Function at 0x461d80
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0x34], 0
je 0x461da2
xor eax, eax
nop dword [eax + eax]
lea edx, [eax + esi]
lea ecx, [eax - 0xc]
inc eax
xor byte [edx], cl
cmp eax, 0x33
jb 0x461d90
mov byte [esi + 0x34], 0
pop esi
ret

Function at 0x461db0
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0xf], 0
je 0x461dd2
xor eax, eax
nop dword [eax + eax]
lea edx, [eax + esi]
lea ecx, [eax - 0xc]
inc eax
xor byte [edx], cl
cmp eax, 0xe
jb 0x461dc0
mov byte [esi + 0xf], 0
pop esi
ret

Function at 0x461de0
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0x22], 0
je 0x461e02
xor eax, eax
nop dword [eax + eax]
lea edx, [eax + esi]
lea ecx, [eax - 0xc]
inc eax
xor byte [edx], cl
cmp eax, 0x21
jb 0x461df0
mov byte [esi + 0x22], 0
pop esi
ret
Function at 0x461e10
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0x15], 0
je 0x461e32
xor eax, eax
nop dword [eax + eax]
lea edx, [eax + esi]
lea ecx, [eax - 0xc]
inc eax
xor byte [edx], cl
cmp eax, 0x14
jb 0x461e20
mov byte [esi + 0x15], 0
pop esi
ret

Function at 0x461e40
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0x18], 0
je 0x461e62
xor eax, eax
nop dword [eax + eax]
lea edx, [eax + esi]
lea ecx, [eax - 0xc]
inc eax
xor byte [edx], cl
cmp eax, 0x17
jb 0x461e50
mov byte [esi + 0x18], 0
pop esi
ret

Function at 0x461e70
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0x1c], 0
je 0x461e92
xor eax, eax
nop dword [eax + eax]
lea edx, [eax + esi]
lea ecx, [eax - 0xc]
inc eax
xor byte [edx], cl
cmp eax, 0x1b
jb 0x461e80
mov byte [esi + 0x1c], 0
pop esi
ret

Function at 0x461ea0
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0x14], 0
je 0x461ec2
xor eax, eax
nop dword [eax + eax]
lea edx, [eax + esi]
lea ecx, [eax - 0xc]
inc eax
xor byte [edx], cl
cmp eax, 0x13
jb 0x461eb0
mov byte [esi + 0x14], 0
pop esi
ret

Function at 0x461ed0
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0x2d], 0
je 0x461ef2
xor eax, eax
nop dword [eax + eax]
lea edx, [eax + esi]
lea ecx, [eax - 0xc]
inc eax
xor byte [edx], cl
cmp eax, 0x2c
jb 0x461ee0
mov byte [esi + 0x2d], 0
pop esi
ret

Function at 0x461f00
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0x13], 0
je 0x461f22
xor eax, eax
nop dword [eax + eax]
lea edx, [eax + esi]
lea ecx, [eax - 0xc]
inc eax
xor byte [edx], cl
cmp eax, 0x12
jb 0x461f10
mov byte [esi + 0x13], 0
pop esi
ret

Function at 0x461f30
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0xd], 0
je 0x461f52
xor eax, eax
nop dword [eax + eax]
lea edx, [eax + esi]
lea ecx, [eax - 0xc]
inc eax
xor byte [edx], cl
cmp eax, 0xc
jb 0x461f40
mov byte [esi + 0xd], 0
pop esi
ret

Function at 0x461f60
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0xb], 0
je 0x461f82
xor eax, eax
nop dword [eax + eax]
lea edx, [eax + esi]
lea ecx, [eax - 0xc]
inc eax
xor byte [edx], cl
cmp eax, 0xa
jb 0x461f70
mov byte [esi + 0xb], 0
pop esi
ret

Function at 0x461f90
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 9], 0
je 0x461fb2
xor eax, eax
nop dword [eax + eax]
lea edx, [eax + esi]
lea ecx, [eax - 0xc]
inc eax
xor byte [edx], cl
cmp eax, 8
jb 0x461fa0
mov byte [esi + 9], 0
pop esi
ret

Function at 0x461fc0
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0x10], 0
je 0x461fe2
xor eax, eax
nop dword [eax + eax]
lea edx, [eax + esi]
lea ecx, [eax - 0xc]
inc eax
xor byte [edx], cl
cmp eax, 0xf
jb 0x461fd0
mov byte [esi + 0x10], 0
pop esi
ret
Function at 0x461ff0
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0x11], 0
je 0x462012
xor eax, eax
nop dword [eax + eax]
lea edx, [eax + esi]
lea ecx, [eax - 0xc]
inc eax
xor byte [edx], cl
cmp eax, 0x10
jb 0x462000
mov byte [esi + 0x11], 0
pop esi
ret

Function at 0x462020
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0xc], 0
je 0x462042
xor eax, eax
nop dword [eax + eax]
lea edx, [eax + esi]
lea ecx, [eax - 0xc]
inc eax
xor byte [edx], cl
cmp eax, 0xb
jb 0x462030
mov byte [esi + 0xc], 0
pop esi
ret

Function at 0x462050
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0x20], 0
je 0x462072
xor eax, eax
nop dword [eax + eax]
lea edx, [eax + esi]
lea ecx, [eax - 0xc]
inc eax
xor byte [edx], cl
cmp eax, 0x1f
jb 0x462060
mov byte [esi + 0x20], 0
pop esi
ret

Function at 0x462080
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 8], 0
je 0x4620a2
xor eax, eax
nop dword [eax + eax]
lea edx, [eax + esi]
lea ecx, [eax - 0xc]
inc eax
xor byte [edx], cl
cmp eax, 7
jb 0x462090
mov byte [esi + 8], 0
pop esi
ret

Function at 0x4620b0
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 5], 0
je 0x4620d2
xor eax, eax
nop dword [eax + eax]
lea edx, [eax + esi]
lea ecx, [eax - 0xc]
inc eax
xor byte [edx], cl
cmp eax, 4
jb 0x4620c0
mov byte [esi + 5], 0
pop esi
ret

Function at 0x462140
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0x12], 0
je 0x462162
xor eax, eax
nop dword [eax + eax]
lea edx, [eax + esi]
lea ecx, [eax - 0xc]
inc eax
xor byte [edx], cl
cmp eax, 0x11
jb 0x462150
mov byte [esi + 0x12], 0
pop esi
ret

Function at 0x462170
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0x16], 0
je 0x462192
xor eax, eax
nop dword [eax + eax]
lea edx, [eax + esi]
lea ecx, [eax - 0xc]
inc eax
xor byte [edx], cl
cmp eax, 0x15
jb 0x462180
mov byte [esi + 0x16], 0
pop esi
ret

Function at 0x4621a0
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0xe], 0
je 0x4621c2
xor eax, eax
nop dword [eax + eax]
lea edx, [eax + esi]
lea ecx, [eax - 0xc]
inc eax
xor byte [edx], cl
cmp eax, 0xd
jb 0x4621b0
mov byte [esi + 0xe], 0
pop esi
ret

Function at 0x4621d0
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0x19], 0
je 0x4621f2
xor eax, eax
nop dword [eax + eax]
lea edx, [eax + esi]
lea ecx, [eax - 0xc]
inc eax
xor byte [edx], cl
cmp eax, 0x18
jb 0x4621e0
mov byte [esi + 0x19], 0
pop esi
ret

Function at 0x462200
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0xa], 0
je 0x462222
xor eax, eax
nop dword [eax + eax]
lea edx, [eax + esi]
lea ecx, [eax - 0xc]
inc eax
xor byte [edx], cl
cmp eax, 9
jb 0x462210
mov byte [esi + 0xa], 0
pop esi
ret
Function at 0x462230
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 3], 0
je 0x462252
xor eax, eax
nop dword [eax + eax]
lea edx, [eax + esi]
lea ecx, [eax - 0xc]
inc eax
xor byte [edx], cl
cmp eax, 2
jb 0x462240
mov byte [esi + 3], 0
pop esi
ret

Function at 0x462270
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0x2f], 0
je 0x462292
xor eax, eax
nop dword [eax + eax]
lea edx, [eax + esi]
lea ecx, [eax - 0xc]
inc eax
xor byte [edx], cl
cmp eax, 0x2e
jb 0x462280
mov byte [esi + 0x2f], 0
pop esi
ret

Function at 0x4622a0
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 6], 0
je 0x4622c2
xor eax, eax
nop dword [eax + eax]
lea edx, [eax + esi]
lea ecx, [eax - 0xc]
inc eax
xor byte [edx], cl
cmp eax, 5
jb 0x4622b0
mov byte [esi + 6], 0
pop esi
ret

Function at 0x4622d0
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 4], 0
je 0x4622f2
xor eax, eax
nop dword [eax + eax]
lea edx, [eax + esi]
lea ecx, [eax - 0xc]
inc eax
xor byte [edx], cl
cmp eax, 3
jb 0x4622e0
mov byte [esi + 4], 0
pop esi
ret
Function at 0x466f80
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x501fe0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xc
push ebx
mov eax, ecx
push esi
push edi
push 8
mov dword [ebp - 0x10], eax
mov dword [eax], vtable.std::basic_streambuf_char__struct_std::char_traits_char__.0
call fcn.004dbc10
mov esi, eax
push 1
mov dword [ebp - 4], 0
call fcn.004daa1e
mov dword [esi + 4], eax
add esp, 8
mov eax, dword [ebp - 0x10]
lea edi, [eax + 0x14]
lea ecx, [eax + 0x18]
lea edx, [eax + 0x24]
mov dword [eax + 0x34], esi
lea ebx, [eax + 4]
mov dword [eax + 0xc], ebx
lea esi, [eax + 8]
mov dword [eax + 0x10], esi
mov dword [eax + 0x1c], edi
mov dword [eax + 0x20], ecx
mov dword [eax + 0x2c], edx
add eax, 0x28
mov dword [ebp - 0x14], ebx
mov ebx, dword [ebp - 0x10]
mov dword [ebp - 0x18], eax
mov dword [ebx + 0x30], eax
mov ebx, dword [ebp - 0x14]
mov dword [esi], 0
mov dword [ecx], 0
mov dword [eax], 0
mov eax, dword [ebp - 0x10]
mov dword [ebx], 0
mov ebx, dword [ebp - 0x10]
mov dword [edi], 0
mov dword [edx], 0
mov dword [eax + 0x10], esi
mov dword [ebx], vtable.std::basic_filebuf_char__struct_std::char_traits_char__.0
mov byte [ebx + 0x48], 0
mov byte [ebx + 0x3d], 0
mov ebx, dword [ebp - 0x14]
mov dword [eax + 0xc], ebx
mov ebx, dword [ebp - 0x10]
mov dword [eax + 0x1c], edi
mov dword [eax + 0x20], ecx
mov dword [eax + 0x2c], edx
mov eax, dword [ebp - 0x18]
mov dword [ebx + 0x30], eax
mov ebx, dword [ebp - 0x14]
mov dword [esi], 0
mov dword [ecx], 0
mov dword [eax], 0
mov dword [ebx], 0
mov dword [edi], 0
mov dword [edx], 0
mov edx, dword [ebp - 0x10]
pop edi
pop esi
pop ebx
mov dword [edx + 0x4c], 0
mov eax, dword [0x5355c0]
mov ecx, dword [0x5355c4]
mov dword [edx + 0x44], ecx
mov ecx, dword [ebp - 0xc]
mov dword [edx + 0x40], eax
mov eax, edx
mov dword [edx + 0x38], 0
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
Function at 0x467130
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x50887d
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x14
push ebx
mov ebx, ecx
push esi
push edi
push 0
mov eax, dword [ebx]
push 0
mov dword [ebp - 0x14], ebx
mov eax, dword [eax + 4]
mov dword [ebx + eax], vtable.std::basic_istream_char__struct_std::char_traits_char__.0
mov eax, dword [ebx]
mov edx, dword [eax + 4]
lea eax, [edx - 0x18]
mov dword [edx + ebx - 4], eax
mov eax, dword [ebx]
mov dword [ebx + 8], 0
mov dword [ebx + 0xc], 0
mov edi, dword [eax + 4]
add edi, ebx
mov ecx, edi
mov dword [edi + 0x30], 0
mov dword [edi + 8], 0
mov dword [edi + 0x10], 0
mov dword [edi + 0x14], 0x201
mov dword [edi + 0x18], 6
mov dword [edi + 0x1c], 0
mov dword [edi + 0x20], 0
mov dword [edi + 0x24], 0
mov dword [edi + 0x28], 0
mov dword [edi + 0x2c], 0
call fcn.00403b70
push 8
call fcn.004dbc10
add esp, 4
mov esi, eax
push 1
mov dword [ebp - 4], 1
call fcn.004daa1e
mov dword [esi + 4], eax
add esp, 4
mov eax, dword [ebp + 8]
mov dword [edi + 0x30], esi
mov dword [edi + 0x38], eax
mov dword [edi + 0x3c], 0
mov esi, dword [esi + 4]
mov ecx, esi
mov dword [ebp - 0x1c], esi
mov eax, dword [esi]
call dword [eax + 4]
lea eax, [ebp - 0x20]
mov dword [ebp - 4], 2
push eax
call fcn.00468690
add esp, 4
mov ecx, eax
mov edx, dword [eax]
push 0x20
mov edx, dword [edx + 0x20]
call edx
mov byte [ebp - 4], 0
mov ecx, esi
mov edx, dword [esi]
mov byte [ebp + 0xb], al
call dword [edx + 8]
test eax, eax
je 0x467246
mov edx, dword [eax]
mov ecx, eax
push 1
call dword [edx]
cmp dword [edi + 0x38], 0
mov al, byte [ebp + 0xb]
mov byte [edi + 0x40], al
jne 0x467262
mov eax, dword [edi + 0xc]
mov ecx, edi
push 0
or eax, 4
push eax
call fcn.00403b70
mov ecx, dword [ebp - 0xc]
mov eax, ebx
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret 0xc

Function at 0x4683c0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x501fe0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
push ebx
mov eax, ecx
push esi
push edi
push 8
mov dword [ebp - 0x10], eax
mov dword [eax], vtable.std::basic_streambuf_char__struct_std::char_traits_char__.0
call fcn.004dbc10
mov esi, eax
push 1
mov dword [ebp - 4], 0
call fcn.004daa1e
mov dword [esi + 4], eax
add esp, 8
mov eax, dword [ebp - 0x10]
lea edi, [eax + 0x14]
lea ecx, [eax + 0x18]
lea edx, [eax + 0x24]
mov dword [eax + 0x34], esi
lea ebx, [eax + 4]
mov dword [eax + 0xc], ebx
lea esi, [eax + 8]
mov dword [eax + 0x10], esi
mov dword [eax + 0x1c], edi
mov dword [eax + 0x20], ecx
mov dword [eax + 0x2c], edx
add eax, 0x28
mov dword [ebp - 0x14], ebx
mov ebx, dword [ebp - 0x10]
mov dword [ebx + 0x30], eax
mov ebx, dword [ebp - 0x14]
mov dword [esi], 0
mov dword [ecx], 0
mov ecx, dword [ebp - 0xc]
mov dword [eax], 0
mov eax, dword [ebp - 0x10]
mov dword [ebx], 0
mov dword [edi], 0
pop edi
pop esi
mov dword [edx], 0
pop ebx
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
Function at 0x469a70
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov edx, dword [ebp + 8]
mov eax, ecx
push ebx
push esi
push edi
cmp dword [edx + 0x14], 0x10
mov edi, edx
mov ebx, dword [edx + 0x10]
mov dword [ebp - 8], eax
jb 0x469a8e
mov edi, dword [edx]
xor ecx, ecx
mov esi, 0x811c9dc5
test ebx, ebx
je 0x469ab4
nop dword [eax]
movzx eax, byte [ecx + edi]
inc ecx
xor eax, esi
imul esi, eax, 0x1000193
cmp ecx, ebx
jb 0x469aa0
mov eax, dword [ebp - 8]
push esi
push edx
lea ecx, [ebp - 0xc]
push ecx
mov ecx, eax
call fcn.004700d0
xor ecx, ecx
pop edi
pop esi
cmp dword [eax + 4], ecx
pop ebx
setne cl
mov eax, ecx
mov esp, ebp
pop ebp
ret 4

Function at 0x46afe0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 0xc]
mov edx, 0x811c9dc5
push edi
mov edi, dword [ebp + 8]
mov ecx, 0
sub esi, edi
je 0x46b011
nop dword [eax]
movzx eax, byte [ecx + edi]
inc ecx
xor eax, edx
imul edx, eax, 0x1000193
cmp ecx, esi
jb 0x46b000
pop edi
mov eax, edx
pop esi
pop ebp
ret 8
Function at 0x471d70
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
mov eax, dword fs:[0]
mov edx, dword [ebp + 0xc]
push 0xffffffffffffffff
push 0x509105
push eax
mov dword fs:[0], esp
sub esp, 0x18
cmp dword [edx + 0x14], 0x10
push ebx
push esi
push edi
mov ebx, ecx
mov edi, edx
jb 0x471d9d
mov edi, dword [edx]
xor ecx, ecx
mov esi, 0x811c9dc5
cmp dword [edx + 0x10], ecx
jbe 0x471dc2
nop dword [eax]
movzx eax, byte [ecx + edi]
inc ecx
xor eax, esi
imul esi, eax, 0x1000193
cmp ecx, dword [edx + 0x10]
jb 0x471db0
push esi
push edx
lea eax, [ebp - 0x18]
mov ecx, ebx
push eax
call fcn.004700d0
mov ecx, dword [ebp - 0x14]
test ecx, ecx
je 0x471df2
mov eax, dword [ebp + 8]
mov dword [eax], ecx
mov byte [eax + 4], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
cmp dword [ebx + 8], 0x7ffffff
je 0x471f43
lea eax, [ebx + 4]
mov dword [ebp - 0x20], eax
mov dword [ebp - 4], 0
push 0x20
mov dword [ebp - 0x1c], 0
call fcn.004dbc10
add esp, 4
mov edi, eax
mov dword [ebp - 0x1c], edi
push dword [ebp + 0xc]
lea ecx, [edi + 8]
call fcn.00464ec0
mov dword [ebp - 4], 1
mov eax, dword [ebx + 8]
inc eax
movss xmm3, dword [ebx]
movd xmm0, eax
cvtdq2pd xmm0, xmm0
shr eax, 0x1f
addsd xmm0, qword [eax*8 + 0x524280]
mov eax, dword [ebx + 0x1c]
cvtpd2ps xmm2, xmm0
movd xmm0, eax
cvtdq2pd xmm0, xmm0
shr eax, 0x1f
movaps xmm1, xmm2
addsd xmm0, qword [eax*8 + 0x524280]
cvtpd2ps xmm0, xmm0
divss xmm1, xmm0
comiss xmm1, xmm3
jbe 0x471ee6
divss xmm2, xmm3
sub esp, 8
cvtps2pd xmm0, xmm2
movsd qword [ebp - 0x18], xmm0
fld qword [ebp - 0x18]
fstp qword [esp]
call fcn.00500d50
fstp qword [ebp - 0x18]
movsd xmm0, qword [ebp - 0x18]
add esp, 8
cvtpd2ps xmm0, xmm0
call fcn.00501950
mov ecx, 8
cmp eax, ecx
cmova ecx, eax
mov eax, dword [ebx + 0x1c]
cmp eax, ecx
jae 0x471eca
cmp eax, 0x200
jae 0x471ec8
shl eax, 3
cmp eax, ecx
jae 0x471eca
mov eax, ecx
push eax
mov ecx, ebx
call fcn.00475a40
push esi
lea eax, [edi + 8]
mov ecx, ebx
push eax
lea eax, [ebp - 0x20]
push eax
call fcn.004700d0
mov edx, dword [eax]
jmp 0x471ee9
mov edx, dword [ebp - 0x18]
mov eax, dword [edx + 4]
inc dword [ebx + 8]
mov dword [edi + 4], eax
mov dword [edi], edx
mov dword [eax], edi
mov dword [edx + 4], edi
mov ecx, dword [ebx + 0xc]
mov dword [ebp + 0xc], eax
mov eax, dword [ebx + 0x18]
and eax, esi
mov esi, dword [ecx + eax*8]
cmp esi, dword [ebx + 4]
jne 0x471f11
mov dword [ecx + eax*8], edi
jmp 0x471f23
cmp esi, edx
jne 0x471f1a
mov dword [ecx + eax*8], edi
jmp 0x471f27
mov edx, dword [ebp + 0xc]
cmp dword [ecx + eax*8 + 4], edx
jne 0x471f27
mov dword [ecx + eax*8 + 4], edi
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
mov dword [eax], edi
pop edi
pop esi
mov byte [eax + 4], 1
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret 8
push str.unordered_map_set_too_long
call fcn.004da05e
int3
Function at 0x47d190
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x509735
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x1c
push ebx
push esi
push edi
push dword [ebp + 0xc]
lea eax, [ebp - 0x1c]
mov esi, ecx
push dword [ebp + 8]
mov dword [ebp - 0x10], esi
push eax
call fcn.0047daa0
movq xmm0, qword [eax]
mov eax, dword [eax + 8]
movq qword [ebp - 0x28], xmm0
mov dword [ebp - 0x20], eax
test al, al
je 0x47d1eb
mov eax, dword [ebp - 0x28]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
cmp dword [esi + 4], 0x4924924
je 0x47d283
mov ebx, dword [esi]
mov dword [ebp - 0x18], esi
mov dword [ebp - 4], 0
push 0x38
mov dword [ebp - 0x14], 0
call fcn.004dbc10
mov edi, eax
add esp, 4
mov dword [ebp - 0x14], edi
push dword [ebp + 0xc]
lea ecx, [edi + 0x10]
mov dword [ebp - 4], 1
call fcn.00464ec0
mov edx, dword [ebp + 0xc]
push edi
push dword [ebp - 0x24]
mov al, byte [edx + 0x18]
push dword [ebp - 0x28]
mov byte [edi + 0x28], al
mov ecx, dword [edx + 0x24]
mov eax, dword [edx + 0x20]
mov dword [edi + 0x34], ecx
mov ecx, dword [ebp - 0x10]
mov dword [edi + 0x30], eax
mov byte [edx + 0x18], 0
mov dword [edx + 0x20], 0
mov dword [edx + 0x24], 0
mov dword [edi], ebx
mov dword [edi + 4], ebx
mov dword [edi + 8], ebx
mov word [edi + 0xc], 0
call fcn.0046bd20
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret 8
call fcn.00407d60
int3
Function at 0x47f4e0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [0x534ff4]
push ebx
push esi
push edi
push 0
push 0
push 0
push 0
push dword [ebp + 0xc]
mov dword [ebp - 0x10], edx
mov esi, ecx
call eax
mov ebx, eax
test ebx, ebx
jne 0x47f510
lea eax, [ebx + 1]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 4
lea eax, [ebp + 0x10]
push eax
push 6
push ebx
call dword [0x534ff8]
mov eax, dword [0x534fe4]
push 0
push 0
push 3
push 0
push 0
push 0x50
push esi
push ebx
call eax
cmp byte [ebp + 8], 0
mov esi, eax
mov dword [ebp - 8], esi
mov edx, connect
mov dword [ebp - 4], connect
je 0x47f557
mov dword [ebp - 4], 0x80803000
mov edx, 0x80803000
mov edi, dword [0x534fec]
xor ecx, ecx
mov dword [ebp - 0x16], 0xb3b7b0bc
mov word [ebp - 0x12], 0x100
nop dword [eax]
lea eax, [ecx - 0xc]
xor byte [ebp + ecx - 0x16], al
inc ecx
cmp ecx, 4
jb 0x47f570
push 0
push edx
push 0
push 0
push 0
push dword [ebp - 0x10]
lea eax, [ebp - 0x16]
mov byte [ebp - 0x11], 0
push eax
push esi
call edi
mov ecx, dword [0x534fe8]
mov edi, eax
push 0
push 0
push 0
push 0
push edi
call ecx
test eax, eax
jne 0x47f608
push eax
push 0x6311ef
call fcn.0047f4a0
add esp, 8
mov dword [ebp - 0x10], edx
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
xor ecx, ecx
cmp eax, esi
jne 0x47f605
cmp ecx, dword [ebp - 0x10]
jne 0x47f605
cmp byte [ebp + 8], cl
je 0x47f605
lea eax, [ebp - 0xc]
mov dword [ebp - 4], ecx
push eax
lea eax, [ebp - 4]
mov dword [ebp - 0xc], 4
push eax
push 0x1f
push edi
call dword [0x534fd8]
or dword [ebp - 4], 0x100
lea eax, [ebp - 4]
push 4
push eax
push 0x1f
push edi
call dword [0x534ff8]
mov esi, dword [ebp - 8]
mov eax, dword [0x534ff0]
lea ecx, [ebp - 0xc]
push 0
push ecx
push dword [ebp + 0x14]
mov dword [ebp - 0xc], 4
push 0x20000005
push edi
call eax
test eax, eax
mov ecx, 2
mov eax, 0
cmove eax, ecx
mov dword [ebp - 0x10], eax
test edi, edi
je 0x47f642
push edi
call dword [0x534fdc]
test esi, esi
je 0x47f64d
push esi
call dword [0x534fdc]
push ebx
call dword [0x534fdc]
mov eax, dword [ebp - 0x10]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x47f880
Capabilities:
Reference http user-agent string

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
mov ebx, ecx
mov dword [ebp - 0xc], edx
push esi
push edi
mov edi, dword [sym.imp.USER32.dll_CharNextA]
mov esi, ebx
mov al, byte [ebx]
mov dword [ebp - 0x10], ebx
test al, al
je 0x47f8af
nop
cmp al, 0x2e
je 0x47f8e8
push esi
call edi
mov esi, eax
mov al, byte [esi]
test al, al
jne 0x47f8a0
mov esi, ebx
mov al, byte [esi]
test al, al
je 0x47f8c6
cmp al, 0x2f
je 0x47f8c8
push esi
call edi
mov esi, eax
mov al, byte [esi]
test al, al
jne 0x47f8b7
xor esi, esi
mov al, byte [ebx]
mov ecx, ebx
test al, al
je 0x47f8df
cmp al, 0x2f
je 0x47f8eb
push ecx
call edi
mov ecx, eax
mov al, byte [ecx]
test al, al
jne 0x47f8d0
xor al, al
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
inc esi
jmp 0x47f8b1
add ecx, 2
mov dword [ebp - 8], ecx
test esi, esi
jne 0x47f8fe
push ecx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
jmp 0x47f902
mov eax, esi
sub eax, ecx
mov ebx, dword [sym.imp.KERNEL32.dll_GetProcessHeap]
inc eax
mov dword [ebp - 4], eax
inc eax
push eax
push 8
call ebx
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
push dword [ebp - 4]
mov edi, eax
push dword [ebp - 8]
push edi
call dword [sym.imp.KERNEL32.dll_lstrcpynA]
mov ecx, dword [ebp - 0x10]
mov edx, edi
push 0x7530
push str.Mozilla_5.0__Windows_NT_10.0__Win64__x64__AppleWebKit_537.36__KHTML__like_Gecko__Chrome_117.0.0.0_Safari_537.36_Edg_117.0.2045.36
push dword [ebp - 0xc]
push dword [ebp + 8]
push esi
call fcn.0047f660
add esp, 0x14
mov esi, eax
push edi
push 0
call ebx
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
pop edi
test esi, esi
pop esi
sete al
pop ebx
mov esp, ebp
pop ebp
ret