joyce8/EMBER2024-capa huggingface dataset:
Function at 0x46e7c0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4d0061
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push ebx
push esi
push edi
mov eax, dword [0x5091d4]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov eax, dword fs:[0x2c]
mov ecx, dword [0x6d9fe0]
mov ecx, dword [eax + ecx*4]
mov eax, dword [0x6d8508]
cmp eax, dword [ecx + 4]
jg 0x46e888
mov edx, dword [ebp + 8]
mov edi, edx
mov dword [ebp - 4], 1
cmp dword [edx + 0x14], 0x10
mov ebx, dword [edx + 0x10]
jb 0x46e822
mov edi, dword [edx]
xor ecx, ecx
mov esi, 0x811c9dc5
test ebx, ebx
je 0x46e841
nop dword [eax]
movzx eax, byte [ecx + edi]
inc ecx
xor eax, esi
imul esi, eax, 0x1000193
cmp ecx, ebx
jb 0x46e830
push esi
push edx
lea eax, [ebp - 0x1c]
mov ecx, 0x6d84e8
push eax
call fcn.0043afe0
mov eax, dword [ebp - 0x18]
test eax, eax
je 0x46e8d2
mov ax, word [eax + 0x20]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 0x6d8508
call fcn.0049fd00
add esp, 4
cmp dword [0x6d8508], 0xffffffff
jne 0x46e80b
push 0x6d84e8
lea ecx, [ebp - 0x11]
mov dword [ebp - 4], 0
call fcn.0046be10
push 0x4d4a80
call fcn.0049fbb8
push 0x6d8508
call fcn.0049fcb6
add esp, 8
jmp 0x46e80b
push str.invalid_unordered_map_K__T__key
call fcn.0049c5b2
int3
Function at 0x46eef0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4d0125
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push ebx
push esi
push edi
mov eax, dword [0x5091d4]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov edx, dword [ebp + 0xc]
mov edi, edx
cmp dword [edx + 0x14], 0x10
jb 0x46ef27
mov edi, dword [edx]
xor ecx, ecx
mov esi, 0x811c9dc5
cmp dword [edx + 0x10], ecx
jbe 0x46ef45
movzx eax, byte [ecx + edi]
inc ecx
xor eax, esi
imul esi, eax, 0x1000193
cmp ecx, dword [edx + 0x10]
jb 0x46ef33
push esi
push edx
lea eax, [ebp - 0x14]
mov ecx, ebx
push eax
call fcn.0043afe0
mov ecx, dword [ebp - 0x10]
test ecx, ecx
je 0x46ef76
mov eax, dword [ebp + 8]
mov dword [eax], ecx
mov byte [eax + 4], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
cmp dword [ebx + 8], 0x30c30c3
je 0x46f09d
lea eax, [ebx + 4]
mov dword [ebp - 0x1c], eax
push 0x54
mov dword [ebp - 4], 0
mov dword [ebp - 0x18], 0
call fcn.0049f7ea
add esp, 4
mov edi, eax
mov dword [ebp - 0x18], edi
push dword [ebp + 0xc]
lea ecx, [edi + 8]
call fcn.004027c0
mov dword [edi + 0x20], 0
mov dword [edi + 0x30], 0
mov dword [edi + 0x34], 0xf
mov byte [edi + 0x38], 0
mov byte [edi + 0x50], 0
mov ecx, dword [ebx + 8]
inc ecx
mov dword [ebp - 4], 1
mov eax, ecx
shr eax, 0x1f
movd xmm0, ecx
cvtdq2pd xmm0, xmm0
addsd xmm0, qword [eax*8 + 0x4d60a0]
mov eax, dword [ebx + 0x1c]
cvtpd2ps xmm1, xmm0
movd xmm0, eax
cvtdq2pd xmm0, xmm0
shr eax, 0x1f
addsd xmm0, qword [eax*8 + 0x4d60a0]
cvtpd2ps xmm0, xmm0
divss xmm1, xmm0
comiss xmm1, dword [ebx]
jbe 0x46f03b
push ecx
mov ecx, ebx
call fcn.00454f60
push eax
mov ecx, ebx
call fcn.0043c410
push esi
lea eax, [edi + 8]
mov ecx, ebx
push eax
lea eax, [ebp - 0x1c]
push eax
call fcn.0043afe0
mov edx, dword [eax]
jmp 0x46f03e
mov edx, dword [ebp - 0x14]
mov eax, dword [ebx + 8]
mov ecx, dword [edx + 4]
inc eax
mov dword [ebx + 8], eax
mov dword [edi], edx
mov dword [edi + 4], ecx
mov dword [ecx], edi
mov dword [edx + 4], edi
mov eax, dword [ebx + 0x18]
mov dword [ebp + 0xc], ecx
and eax, esi
mov ecx, dword [ebx + 0xc]
mov esi, dword [ecx + eax*8]
cmp esi, dword [ebx + 4]
jne 0x46f06a
mov dword [ecx + eax*8], edi
jmp 0x46f07c
cmp esi, edx
jne 0x46f073
mov dword [ecx + eax*8], edi
jmp 0x46f080
mov edx, dword [ebp + 0xc]
cmp dword [ecx + eax*8 + 4], edx
jne 0x46f080
mov dword [ecx + eax*8 + 4], edi
mov eax, dword [ebp + 8]
mov dword [eax], edi
mov byte [eax + 4], 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
push str.unordered_map_set_too_long
call fcn.0049c592
int3
Function at 0x46fce0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
mov dword [ebp - 4], ecx
cmp edx, eax
je 0x46fe53
cmp dword [edx + 0x1c], 0x10
mov eax, dword [ecx + 4]
push esi
mov dword [ebp - 0x18], eax
mov esi, edx
mov eax, dword [ecx + 0xc]
push edi
mov dword [ebp - 0x14], eax
lea edi, [edx + 8]
mov eax, dword [edx + 4]
mov dword [ebp - 8], eax
mov eax, dword [edi + 0x10]
jb 0x46fd1b
mov edi, dword [edi]
xor edx, edx
push ebx
mov ebx, 0x811c9dc5
test eax, eax
je 0x46fd44
mov ecx, eax
nop dword [eax]
movzx eax, byte [edx + edi]
inc edx
xor eax, ebx
imul ebx, eax, 0x1000193
cmp edx, ecx
jb 0x46fd30
mov ecx, dword [ebp - 4]
mov eax, dword [ecx + 0x18]
mov ecx, dword [ebp - 0x14]
and eax, ebx
lea eax, [ecx + eax*8]
mov ecx, dword [eax]
mov dword [ebp - 0xc], eax
mov eax, dword [eax + 4]
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0x1c], eax
nop dword [eax]
mov edi, esi
mov ebx, esi
mov esi, dword [esi]
lea ecx, [edi + 8]
call fcn.0046f720
push 0x54
push edi
call fcn.0049f81a
mov eax, dword [ebp - 4]
add esp, 8
dec dword [eax + 8]
cmp ebx, dword [ebp - 0x1c]
je 0x46fdad
mov eax, dword [ebp + 0xc]
cmp esi, eax
jne 0x46fd60
mov ecx, dword [ebp - 0x10]
cmp ecx, dword [ebp + 8]
jne 0x46fe48
mov ecx, dword [ebp - 0xc]
pop ebx
pop edi
mov dword [ecx], esi
mov ecx, dword [ebp - 8]
mov dword [ecx], esi
mov dword [esi + 4], ecx
pop esi
mov esp, ebp
pop ebp
ret 8
mov ecx, dword [ebp - 0x10]
cmp ecx, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
jne 0x46fdbf
mov eax, dword [ebp - 0x18]
mov dword [ecx], eax
jmp 0x46fdc2
mov eax, dword [ebp - 8]
mov dword [ecx + 4], eax
mov eax, dword [ebp + 0xc]
cmp esi, eax
je 0x46fe48
nop dword [eax]
cmp dword [esi + 0x1c], 0x10
lea edx, [esi + 8]
mov ebx, dword [edx + 0x10]
jb 0x46fdde
mov edx, dword [edx]
xor ecx, ecx
mov edi, 0x811c9dc5
test ebx, ebx
je 0x46fe01
nop dword [eax]
movzx eax, byte [ecx + edx]
inc ecx
xor eax, edi
imul edi, eax, 0x1000193
cmp ecx, ebx
jb 0x46fdf0
mov ecx, dword [ebp - 4]
mov eax, dword [ecx + 0x18]
mov ecx, dword [ebp - 0x14]
and eax, edi
lea eax, [ecx + eax*8]
mov dword [ebp + 8], eax
mov eax, dword [eax + 4]
mov dword [ebp - 0x1c], eax
mov edi, esi
mov ebx, esi
mov esi, dword [esi]
lea ecx, [edi + 8]
call fcn.0046f720
push 0x54
push edi
call fcn.0049f81a
mov ecx, dword [ebp - 4]
add esp, 8
mov eax, dword [ebp + 0xc]
dec dword [ecx + 8]
cmp ebx, dword [ebp - 0x1c]
je 0x46fe59
cmp esi, eax
jne 0x46fe18
mov ecx, dword [ebp + 8]
mov dword [ecx], esi
mov ecx, dword [ebp - 8]
pop ebx
pop edi
mov dword [ecx], esi
mov dword [esi + 4], ecx
pop esi
mov esp, ebp
pop ebp
ret 8
mov ecx, dword [ebp + 8]
mov edi, dword [ebp - 0x18]
mov dword [ecx], edi
mov dword [ecx + 4], edi
cmp esi, eax
jne 0x46fdd0
mov ecx, dword [ebp - 8]
pop ebx
pop edi
mov dword [ecx], esi
mov dword [esi + 4], ecx
pop esi
mov esp, ebp
pop ebp
ret 8
Function at 0x46fe80
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4d056d
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push esi
push edi
mov eax, dword [0x5091d4]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov esi, dword [edi + 4]
add esi, 0x40
push esi
mov dword [ebp - 0x18], esi
call fcn.0049e42b
add esp, 4
test eax, eax
jne 0x46ff35
mov dword [ebp - 4], eax
mov eax, dword [edi + 4]
mov edi, dword [ebp + 8]
mov ebx, edi
mov dword [ebp - 0x10], eax
cmp dword [edi + 0x14], 0x10
jb 0x46fed6
mov ebx, dword [edi]
xor edx, edx
mov ecx, 0x811c9dc5
cmp dword [edi + 0x10], edx
jbe 0x46fef7
movzx eax, byte [edx + ebx]
inc edx
xor eax, ecx
imul ecx, eax, 0x1000193
cmp edx, dword [edi + 0x10]
jb 0x46fee2
mov eax, dword [ebp - 0x10]
push ecx
push edi
lea ecx, [ebp - 0x14]
push ecx
mov ecx, eax
call fcn.0043afe0
mov edi, dword [ebp - 0x10]
test edi, edi
je 0x46ff2b
push esi
call fcn.0049e450
add esp, 4
lea eax, [edi + 0x20]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
push str.invalid_unordered_map_K__T__key
call fcn.0049c5b2
push eax
call fcn.0049e7dd
int3

Function at 0x46ffe0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
mov ebx, ecx
push esi
push edi
mov dword [ebp - 4], ebx
mov esi, dword [ebx + 4]
add esi, 0x40
push esi
call fcn.0049e42b
add esp, 4
test eax, eax
jne 0x47006d
mov edi, dword [ebp + 8]
mov ebx, edi
cmp dword [edi + 0x14], 0x10
jb 0x47000e
mov ebx, dword [edi]
xor ecx, ecx
mov edx, 0x811c9dc5
cmp dword [edi + 0x10], ecx
jbe 0x470032
nop word [eax + eax]
movzx eax, byte [ecx + ebx]
inc ecx
xor eax, edx
imul edx, eax, 0x1000193
cmp ecx, dword [edi + 0x10]
jb 0x470020
mov ecx, dword [ebp - 4]
lea eax, [ebp - 0xc]
push edx
push edi
push eax
mov ebx, dword [ecx + 4]
mov ecx, ebx
call fcn.0043afe0
mov edi, dword [eax + 4]
test edi, edi
je 0x470051
mov ebx, dword [ebx + 4]
jmp 0x470056
mov edi, dword [ebx + 4]
mov ebx, edi
push esi
call fcn.0049e450
add esp, 4
cmp edi, ebx
setne al
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
push eax
call fcn.0049e7dd
int3
Function at 0x4797c0
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push edi
mov esi, ecx
push 0
push dword [esi + 0x3c]
call dword [sym.imp.USER32.dll_ShowWindow]
mov byte [esi + 0x40], 0
mov ecx, dword [esi + 0x1c]
mov edi, dword [esi + 0x10]
mov byte [ebp - 1], 0
test ecx, ecx
jns 0x4797ff
mov eax, ecx
neg eax
je 0x4797ff
mov eax, ecx
mov edx, edi
not eax
shr eax, 5
lea eax, [eax*4 + 4]
sub edx, eax
jmp 0x479807
mov eax, ecx
shr eax, 5
lea edx, [edi + eax*4]
lea eax, [ebp - 1]
and ecx, 0x1f
push eax
push ecx
push edx
push 0
push edi
call fcn.0045c920
add esp, 0x14
mov al, 1
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x47f0f0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4c7fc5
mov eax, dword fs:[0]
push eax
sub esp, 0x44
mov eax, dword [0x5091d4]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword fs:[0x2c]
mov ecx, dword [0x6d9fe0]
mov ecx, dword [eax + ecx*4]
mov eax, dword [0x6d8534]
cmp eax, dword [ecx + 4]
jg 0x47f206
cmp dword [0x509074], 0
jne 0x47f1e8
lea eax, [ebp - 0x44]
mov dword [ebp - 0x44], 0
push eax
push 0
push 0
push 0x4dda30
call sub.SHELL32.dll_SHGetKnownFolderPath
test eax, eax
jne 0x47f23c
mov ecx, dword [ebp - 0x44]
lea edx, [ecx + 2]
nop dword [eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x47f170
mov eax, dword [0x509074]
sub ecx, edx
sar ecx, 1
cmp ecx, eax
ja 0x47f1a9
cmp dword [0x509078], 8
mov eax, 0x509064
mov dword [0x509074], ecx
cmovae eax, dword [0x509064]
xor edx, edx
mov word [eax + ecx*2], dx
jmp 0x47f1b8
sub ecx, eax
push 0
push ecx
mov ecx, 0x509064
call fcn.0041a110
cmp dword [0x509078], 8
mov ecx, 0x509064
mov eax, dword [0x509074]
cmovae ecx, dword [0x509064]
add eax, eax
push eax
push dword [ebp - 0x44]
push ecx
call fcn.004a11f0
add esp, 0xc
push dword [ebp - 0x44]
call dword [sym.imp.ole32.dll_CoTaskMemFree]
mov eax, 0x509064
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0049f836
mov esp, ebp
pop ebp
ret
push 0x6d8534
call fcn.0049fd00
add esp, 4
cmp dword [0x6d8534], 0xffffffff
jne 0x47f138
push 0x4d4b40
call fcn.0049fbb8
push 0x6d8534
call fcn.0049fcb6
add esp, 8
jmp 0x47f138
push str.An_runtime_exception_occurred:
lea ecx, [ebp - 0x28]
call fcn.00402850
push str.Could_not_get_startup_directory.
push eax
lea eax, [ebp - 0x40]
mov dword [ebp - 4], 0
push eax
call fcn.004020f0
add esp, 0xc
push eax
lea ecx, [ebp - 0x50]
mov byte [ebp - 4], 1
call fcn.00402b30
push 0x4f9f28
lea eax, [ebp - 0x50]
push eax
call fcn.004a0dc4
int3
Function at 0x482b70
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4d2125
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push ebx
push esi
push edi
mov eax, dword [0x5091d4]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov edi, dword [ebp + 0xc]
movzx eax, byte [edi]
xor eax, 0x811c9dc5
imul edx, eax, 0x1000193
movzx eax, byte [edi + 1]
xor edx, eax
movzx eax, byte [edi + 2]
imul edx, edx, 0x1000193
xor edx, eax
movzx eax, byte [edi + 3]
imul ecx, edx, 0x1000193
xor ecx, eax
lea eax, [ebp - 0x14]
imul ebx, ecx, 0x1000193
mov ecx, esi
push ebx
push edi
push eax
call fcn.0040e540
mov ecx, dword [ebp - 0x10]
test ecx, ecx
je 0x482c00
mov eax, dword [ebp + 8]
mov dword [eax], ecx
mov byte [eax + 4], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
cmp dword [esi + 8], 0xccccccc
je 0x482cd4
lea eax, [esi + 4]
mov dword [ebp - 0x1c], eax
push 0x14
mov dword [ebp - 4], 0
mov dword [ebp - 0x18], 0
call fcn.0049f7ea
mov edx, dword [ebp + 0x10]
add esp, 4
mov ecx, dword [edi]
mov dword [ebp - 0x18], eax
add eax, 8
mov dword [ebp + 0xc], eax
mov dword [eax], ecx
lea ecx, [eax + 4]
push dword [edx]
call fcn.00483fc0
mov eax, dword [esi + 8]
inc eax
mov dword [ebp - 4], 1
movd xmm0, eax
cvtdq2pd xmm0, xmm0
shr eax, 0x1f
addsd xmm0, qword [eax*8 + 0x4d60a0]
mov eax, dword [esi + 0x1c]
cvtpd2ps xmm1, xmm0
movd xmm0, eax
cvtdq2pd xmm0, xmm0
shr eax, 0x1f
addsd xmm0, qword [eax*8 + 0x4d60a0]
cvtpd2ps xmm0, xmm0
divss xmm1, xmm0
comiss xmm1, dword [esi]
jbe 0x482ca6
mov ecx, esi
call fcn.00483050
push ebx
push dword [ebp + 0xc]
lea eax, [ebp - 0x14]
mov ecx, esi
push eax
call fcn.0040e540
mov ecx, dword [eax]
jmp 0x482ca9
mov ecx, dword [ebp - 0x14]
push dword [ebp - 0x18]
push ecx
push ebx
mov ecx, esi
call fcn.00464dc0
mov ecx, dword [ebp + 8]
mov dword [ecx], eax
mov eax, ecx
mov byte [ecx + 4], 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
push str.unordered_map_set_too_long
call fcn.0049c592
int3
Function at 0x482ed0
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4d2165
mov eax, dword fs:[0]
push eax
sub esp, 0x18
push ebx
push esi
push edi
mov eax, dword [0x5091d4]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov edi, dword [ebp + 8]
movzx eax, byte [edi]
xor eax, 0x811c9dc5
imul edx, eax, 0x1000193
movzx eax, byte [edi + 1]
xor edx, eax
movzx eax, byte [edi + 2]
imul edx, edx, 0x1000193
xor edx, eax
movzx eax, byte [edi + 3]
imul ecx, edx, 0x1000193
xor ecx, eax
lea eax, [ebp - 0x14]
imul ebx, ecx, 0x1000193
mov ecx, esi
push ebx
push edi
push eax
call fcn.0040e540
mov eax, dword [ebp - 0x10]
test eax, eax
jne 0x482ff7
cmp dword [esi + 8], 0xccccccc
je 0x48300e
lea eax, [esi + 4]
mov dword [ebp - 0x1c], eax
push 0x14
mov dword [ebp - 4], 0
mov dword [ebp - 0x18], 0
call fcn.0049f7ea
mov dword [ebp - 0x18], eax
add esp, 4
lea ecx, [eax + 8]
mov eax, dword [edi]
mov dword [ebp + 8], ecx
mov dword [ecx], eax
add ecx, 4
call fcn.004840c0
mov eax, dword [esi + 8]
inc eax
mov dword [ebp - 4], 1
movd xmm0, eax
cvtdq2pd xmm0, xmm0
shr eax, 0x1f
addsd xmm0, qword [eax*8 + 0x4d60a0]
mov eax, dword [esi + 0x1c]
cvtpd2ps xmm1, xmm0
movd xmm0, eax
cvtdq2pd xmm0, xmm0
shr eax, 0x1f
addsd xmm0, qword [eax*8 + 0x4d60a0]
cvtpd2ps xmm0, xmm0
divss xmm1, xmm0
comiss xmm1, dword [esi]
jbe 0x482fe8
mov ecx, esi
call fcn.00483050
push ebx
push dword [ebp + 8]
lea eax, [ebp - 0x24]
mov ecx, esi
push eax
call fcn.0040e540
mov ecx, dword [eax]
jmp 0x482feb
mov ecx, dword [ebp - 0x14]
push dword [ebp - 0x18]
push ecx
push ebx
mov ecx, esi
call fcn.00464dc0
add eax, 0xc
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
push str.unordered_map_set_too_long
call fcn.0049c592
int3
Function at 0x4830e0
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [ebp + 0xc]
mov edx, ecx
push ebx
mov ebx, dword [ebp + 8]
mov dword [ebp - 0x10], edx
cmp ebx, eax
je 0x483251
mov eax, dword [edx + 4]
mov dword [ebp - 0x14], eax
mov eax, dword [ebx + 4]
mov dword [ebp - 4], eax
movzx eax, byte [ebx + 8]
xor eax, 0x811c9dc5
imul ecx, eax, 0x1000193
movzx eax, byte [ebx + 9]
push esi
push edi
mov edi, dword [edx + 0xc]
mov esi, ebx
xor ecx, eax
mov dword [ebp - 0x1c], edi
movzx eax, byte [ebx + 0xa]
imul ecx, ecx, 0x1000193
xor ecx, eax
movzx eax, byte [ebx + 0xb]
imul ecx, ecx, 0x1000193
xor ecx, eax
mov eax, dword [edx + 0x18]
imul ecx, ecx, 0x1000193
and eax, ecx
mov ecx, dword [edi + eax*8]
mov dword [ebp - 0xc], ecx
lea eax, [edi + eax*8]
mov dword [ebp - 8], eax
mov eax, dword [eax + 4]
mov dword [ebp - 0x18], eax
nop word [eax + eax]
mov edi, esi
mov ebx, esi
mov esi, dword [esi]
lea ecx, [edi + 0xc]
call fcn.004843b0
push 0x14
push edi
call fcn.0049f81a
mov edx, dword [ebp - 0x10]
add esp, 8
dec dword [edx + 8]
cmp ebx, dword [ebp - 0x18]
je 0x4831ad
mov eax, dword [ebp + 0xc]
cmp esi, eax
jne 0x483160
mov ecx, dword [ebp - 0xc]
cmp ecx, dword [ebp + 8]
jne 0x483247
mov edi, dword [ebp - 8]
mov ecx, dword [ebp - 4]
mov dword [edi], esi
mov dword [ecx], esi
pop edi
mov dword [esi + 4], ecx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
mov ecx, dword [ebp - 0xc]
mov edi, dword [ebp - 8]
cmp ecx, dword [ebp + 8]
jne 0x4831c1
mov eax, dword [ebp - 0x14]
mov ecx, eax
mov dword [edi], eax
jmp 0x4831c4
mov ecx, dword [ebp - 4]
mov eax, dword [ebp + 0xc]
mov dword [edi + 4], ecx
cmp esi, eax
je 0x483247
nop
movzx eax, byte [esi + 8]
xor eax, 0x811c9dc5
imul ecx, eax, 0x1000193
movzx eax, byte [esi + 9]
xor ecx, eax
movzx eax, byte [esi + 0xa]
imul ecx, ecx, 0x1000193
xor ecx, eax
movzx eax, byte [esi + 0xb]
imul ecx, ecx, 0x1000193
xor ecx, eax
imul eax, ecx, 0x1000193
mov ecx, dword [edx + 0x18]
and ecx, eax
mov eax, dword [ebp - 0x1c]
lea eax, [eax + ecx*8]
mov dword [ebp + 8], eax
mov eax, dword [eax + 4]
mov dword [ebp - 0x18], eax
mov edi, esi
mov ebx, esi
mov esi, dword [esi]
lea ecx, [edi + 0xc]
call fcn.004843b0
push 0x14
push edi
call fcn.0049f81a
mov edx, dword [ebp - 0x10]
add esp, 8
mov eax, dword [ebp + 0xc]
dec dword [edx + 8]
cmp ebx, dword [ebp - 0x18]
je 0x483258
cmp esi, eax
jne 0x483217
mov ecx, dword [ebp + 8]
mov dword [ecx], esi
mov ecx, dword [ebp - 4]
pop edi
mov dword [ecx], esi
mov dword [esi + 4], ecx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
mov ecx, dword [ebp + 8]
mov ebx, dword [ebp - 0x14]
mov dword [ecx], ebx
mov dword [ecx + 4], ebx
cmp esi, eax
jne 0x4831d0
mov ecx, dword [ebp - 4]
pop edi
mov dword [ecx], esi
mov dword [esi + 4], ecx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x4836e0
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 8]
sub esp, 8
movzx eax, dl
xor eax, 0x811c9dc5
imul ecx, eax, 0x1000193
mov eax, edx
shr eax, 8
movzx eax, al
xor ecx, eax
mov eax, edx
shr eax, 0x10
imul ecx, ecx, 0x1000193
movzx eax, al
shr edx, 0x18
xor ecx, eax
imul eax, ecx, 0x1000193
mov ecx, 0x6d8568
xor eax, edx
imul eax, eax, 0x1000193
push eax
lea eax, [ebp + 8]
push eax
lea eax, [ebp - 8]
push eax
call fcn.0040e540
mov ecx, dword [0x6d856c]
mov eax, dword [eax + 4]
test eax, eax
cmovne ecx, eax
cmp ecx, dword [0x6d856c]
setne al
mov esp, ebp
pop ebp
ret
Function at 0x488960
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
mov ebx, dword [ebp + 8]
push ecx
mov dword [esp], 0x4f800000
call fcn.004ad818
fdivr dword [0x4dbb90]
push ecx
fstp qword [esp]
call fcn.004a5470
movss xmm1, dword [0x4dbb8c]
mov ecx, 1
fstp dword [ebp - 0xc]
fld dword [ebp - 0xc]
add esp, 8
fstp dword [ebp - 0xc]
cvttss2si eax, dword [ebp - 0xc]
xorps xmm2, xmm2
movss dword [ebp - 0xc], xmm1
cmp eax, ecx
movss dword [ebp - 8], xmm2
xorps xmm3, xmm3
cmovl eax, ecx
mov dword [ebp - 4], eax
test eax, eax
jle 0x488b79
mov edx, dword [ebx]
movss xmm4, dword [0x4dbb98]
push esi
push edi
cmp edx, 0x270
jne 0x488a1e
lea edx, [ebx + 8]
mov esi, 0x270
mov ecx, dword [edx - 4]
lea edx, [edx + 4]
xor ecx, dword [edx - 4]
and ecx, 0x7fffffff
xor ecx, dword [edx - 8]
mov eax, ecx
and al, 1
movzx eax, al
neg eax
sbb eax, eax
shr ecx, 1
and eax, 0x9908b0df
xor eax, dword [edx + 0x62c]
xor eax, ecx
mov dword [edx + 0x9b8], eax
sub esi, 1
jne 0x4889e0
mov edx, dword [ebx]
jmp 0x488b08
cmp edx, 0x4e0
jb 0x488b08
mov eax, dword [ebx + 0x9c4]
lea edi, [ebx + 0x9c4]
mov ebx, 0xe3
nop dword [eax + eax]
mov ecx, dword [edi + 4]
lea edx, [edi + 4]
xor ecx, eax
and ecx, 0x7fffffff
xor ecx, eax
mov eax, ecx
and al, 1
movzx eax, al
neg eax
sbb eax, eax
shr ecx, 1
and eax, 0x9908b0df
xor eax, dword [edi + 0x634]
xor eax, ecx
mov dword [edi - 0x9c0], eax
lea edi, [edx]
mov eax, dword [edx]
sub ebx, 1
jne 0x488a40
mov edi, dword [ebp + 8]
mov ebx, 0x18c
add edi, 0xd50
mov eax, dword [edi]
nop dword [eax]
mov ecx, eax
lea edx, [edi + 4]
xor ecx, dword [edx]
and ecx, 0x7fffffff
xor ecx, eax
mov eax, ecx
and al, 1
movzx eax, al
neg eax
sbb eax, eax
shr ecx, 1
and eax, 0x9908b0df
xor eax, dword [edi - 0xd4c]
xor eax, ecx
mov dword [edi - 0x9c0], eax
lea edi, [edx]
mov eax, dword [edx]
sub ebx, 1
jne 0x488a90
mov ebx, dword [ebp + 8]
mov ecx, dword [ebx + 0x1380]
xor ecx, dword [ebx + 4]
and ecx, 0x7fffffff
xor ecx, dword [ebx + 0x1380]
mov eax, ecx
and al, 1
movzx eax, al
neg eax
sbb eax, eax
shr ecx, 1
and eax, 0x9908b0df
xor eax, dword [ebx + 0x634]
xor eax, ecx
xor edx, edx
mov dword [ebx + 0x9c0], eax
mov dword [ebx], 0
mov ecx, dword [ebx + edx*4 + 4]
mov eax, ecx
shr eax, 0xb
inc edx
and eax, dword [ebx + 0x1384]
xor ecx, eax
mov dword [ebx], edx
mov eax, ecx
and eax, 0xff3a58ad
shl eax, 7
xor ecx, eax
mov eax, ecx
and eax, 0xffffdf8c
shl eax, 0xf
xor ecx, eax
mov eax, ecx
shr eax, 0x12
xor eax, ecx
movd xmm0, eax
cvtdq2pd xmm0, xmm0
shr eax, 0x1f
sub dword [ebp - 4], 1
addsd xmm0, qword [eax*8 + 0x4d60a0]
cvtpd2ps xmm0, xmm0
subss xmm0, xmm3
mulss xmm0, xmm1
mulss xmm1, xmm4
addss xmm2, xmm0
jne 0x4889d0
pop edi
movss dword [ebp - 0xc], xmm1
movss dword [ebp - 8], xmm2
pop esi
fld dword [ebp - 8]
fdiv dword [ebp - 0xc]
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x488ce0
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4d29a9
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x5091d4]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov esi, dword [ebx + 4]
add esi, 0x28
push esi
mov dword [ebp - 0x14], esi
call fcn.0049e42b
add esp, 4
test eax, eax
jne 0x488e17
mov edi, dword [ebx + 4]
mov dword [ebp - 4], eax
call fcn.0049e0b9
sub eax, dword [edi + 0x18]
push 0
sbb edx, dword [edi + 0x1c]
push 0x2710
push edx
push eax
call fcn.0049ff00
mov ecx, dword [ebx + 4]
mov edi, eax
mov eax, edx
mov dword [ebp - 0x10], eax
cmp eax, dword [ecx + 0x24]
jl 0x488df8
jg 0x488d61
cmp edi, dword [ecx + 0x20]
jb 0x488df8
add ecx, 8
call fcn.00488890
test al, al
je 0x488df8
mov edx, dword [ebp - 0x10]
mov ecx, edi
call fcn.0049feb0
cvtsd2ss xmm0, xmm0
mov eax, dword [ebx + 4]
mov ecx, dword [0x6d9fe0]
divss xmm0, dword [0x4dbb94]
addss xmm0, dword [eax + 0x10]
minss xmm0, dword [0x4dbb8c]
movss dword [eax + 0x10], xmm0
mov eax, dword fs:[0x2c]
mov ecx, dword [eax + ecx*4]
mov eax, dword [0x6d9940]
cmp eax, dword [ecx + 4]
jg 0x488e1d
push 0x6d85b8
call fcn.00488960
movss xmm0, dword [0x509088]
add esp, 4
subss xmm0, dword [0x509084]
mov eax, dword [ebx + 4]
movss dword [ebp - 0x10], xmm0
fmul dword [ebp - 0x10]
fadd dword [0x509084]
fstp dword [ebp - 0x10]
movss xmm0, dword [ebp - 0x10]
comiss xmm0, dword [eax + 0x10]
ja 0x488df8
mov bl, 1
jmp 0x488dfa
xor bl, bl
push esi
call fcn.0049e450
add esp, 4
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push eax
call fcn.0049e7dd
push 0x6d9940
call fcn.0049fd00
add esp, 4
cmp dword [0x6d9940], 0xffffffff
jne 0x488db8
mov byte [ebp - 4], 1
call fcn.0049ee31
mov dword [0x6d993c], 0xffffffff
mov edx, 1
mov dword [0x6d85bc], eax
jmp 0x488e52
mov ecx, eax
shr ecx, 0x1e
xor ecx, eax
imul eax, ecx, 0x6c078965
add eax, edx
mov dword [edx*4 + 0x6d85bc], eax
inc edx
cmp edx, 0x270
jb 0x488e52
push 0x6d9940
mov dword [0x6d85b8], 0x270
call fcn.0049fcb6
add esp, 4
jmp 0x488db8