joyce8/EMBER2024-capa huggingface dataset:
Function at 0x404e68
Capabilities:
Read .ini file

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
push 0x4027c2
push 0x2000
mov edi, edx
mov dword [ebp - 0xc], ecx
call fcn.004072e1
mov ebx, eax
mov esi, ebx
mov dword [ebp - 0x18], ebx
neg esi
pop ecx
sbb esi, esi
and esi, 0x7ff8fff2
add esi, 0x8007000e
pop ecx
test ebx, ebx
je 0x404ec8
push edi
push 0x1000
push ebx
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileSectionW]
test eax, eax
je 0x404ff1
cmp eax, 0xffe
jne 0x404ec8
mov esi, 0x8007007a
test esi, esi
js 0x404ff1
xor ecx, ecx
mov dword [ebp - 0x10], ecx
cmp word [ebx], cx
je 0x404fee
mov edi, ebx
xor edx, edx
lea ecx, [edi + 2]
mov ax, word [edi]
add edi, 2
cmp ax, dx
jne 0x404ee5
lea eax, [ebp - 4]
mov dword [ebp - 4], edx
push eax
sub edi, ecx
push 0x4023d8
push ebx
sar edi, 1
call dword [sym.imp.msvcrt.dll_wcstok_s]
add esp, 0xc
test eax, eax
je 0x404fde
cmp dword [ebp - 4], 0
je 0x404fde
mov ecx, eax
call fcn.00404d75
mov ecx, dword [ebp - 4]
mov dword [ebp - 8], eax
call fcn.00404d75
mov edx, dword [ebp - 8]
xor ecx, ecx
mov dword [ebp - 4], eax
cmp word [edx], cx
je 0x404fe0
cmp word [eax], cx
je 0x404fe0
mov eax, ecx
mov dword [ebp - 0xc], ecx
mov ecx, dword [eax + 0x408008]
add ecx, dword [ebp + 8]
mov dword [ebp - 0x14], ecx
cmp dword [ecx], 0
jne 0x404f77
push dword [eax + 0x408004]
push edx
call dword [sym.imp.msvcrt.dll__wcsicmp]
pop ecx
pop ecx
test eax, eax
je 0x404f86
mov eax, dword [ebp - 0xc]
mov edx, dword [ebp - 8]
add eax, 0xc
mov dword [ebp - 0xc], eax
cmp eax, 0xf0
jb 0x404f4d
jmp 0x404fde
mov ecx, dword [ebp - 4]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, word [ebp - 0x10]
jne 0x404f8c
sub ecx, edx
sar ecx, 1
push 0x4027c2
push 2
pop edx
lea eax, [ecx + 1]
xor ecx, ecx
mov dword [ebp - 0xc], eax
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.004072e1
pop ecx
pop ecx
mov ecx, dword [ebp - 0x14]
mov dword [ecx], eax
test eax, eax
jne 0x404fcb
mov esi, 0x8007000e
test esi, esi
js 0x404fde
push dword [ebp - 4]
mov edx, dword [ebp - 0xc]
mov ecx, eax
call fcn.00404968
mov esi, eax
xor ecx, ecx
lea ebx, [ebx + edi*2]
add ebx, 2
test esi, esi
jns 0x404ed5
mov ebx, dword [ebp - 0x18]
push ebx
call dword [sym.imp.msvcrt.dll_void___cdecl_operator_delete_void__]
pop ecx
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret 4
Function at 0x405002
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov ebx, edx
mov eax, ecx
mov esi, ebx
mov dword [ebp - 4], eax
neg esi
sbb esi, esi
and esi, 0x7ff8ffa9
add esi, 0x80070057
test ebx, ebx
je 0x405038
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x405038
mov esi, 0x80070002
test esi, esi
js 0x4050bb
push edi
push 0x4027c2
push 0x50
call fcn.004072e1
mov edi, eax
pop ecx
pop ecx
test edi, edi
je 0x40506a
xor ecx, ecx
mov eax, dword [ecx + 0x408008]
add ecx, 0xc
and dword [eax + edi], 0
cmp ecx, 0xf0
jb 0x405053
jmp 0x40506c
xor edi, edi
test edi, edi
jne 0x405075
mov esi, 0x8007000e
test esi, esi
js 0x4050a5
mov edx, dword [ebp - 4]
mov ecx, 0x402100
push edi
call fcn.00404e68
mov esi, eax
test esi, esi
js 0x4050a5
mov edx, dword [ebp - 4]
mov ecx, 0x40211c
push edi
call fcn.00404e68
mov esi, eax
test esi, esi
js 0x4050a5
mov dword [ebx], edi
xor edi, edi
test edi, edi
je 0x4050ba
push 1
mov ecx, edi
call fcn.00404e2c
push edi
call dword [sym.imp.msvcrt.dll_void___cdecl_operator_delete_void__]
pop ecx
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret
Function at 0x406627
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
lea eax, [ebp - 0xc]
push eax
mov ebx, edx
mov dword [ebp - 8], ecx
lea eax, [edi + edi]
push eax
push ebx
xor eax, eax
push 1
push eax
push eax
mov dword [ebp - 4], eax
call dword [sym.imp.WINSPOOL.DRV_GetPrinterDriverDirectoryW]
test eax, eax
jne 0x40666f
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
test esi, esi
jle 0x40666d
movzx esi, si
or esi, 0x80070000
test esi, esi
js 0x40667f
push 0x4026f0
mov edx, edi
mov ecx, ebx
call fcn.0040499d
mov esi, eax
test esi, esi
js 0x4066f2
mov ecx, ebx
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, word [ebp - 4]
jne 0x406688
sub ecx, edx
sar ecx, 1
sub edi, ecx
mov ecx, ebx
add edi, edi
mov dword [ebp - 4], edi
xor edi, edi
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, di
jne 0x4066a6
sub ecx, edx
lea eax, [ebp - 4]
push eax
sar ecx, 1
lea eax, [ebx + ecx*2]
push eax
lea eax, [ebp - 0xc]
push eax
push 2
push 0x402710
push edi
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegGetValueW]
test eax, eax
je 0x4066e7
jg 0x4066dc
mov esi, eax
jmp 0x4066f2
movzx esi, ax
or esi, 0x80070000
jmp 0x4066f2
cmp dword [ebp - 0xc], 1
je 0x4066f2
mov esi, 0x8000ffff
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret 4
Function at 0x406b13
Capabilities:
Terminate process

Disassembly:
push 0xc
push 0x407a88
call fcn.00407108
xor ebx, ebx
mov dword [ebp - 4], ebx
mov eax, dword fs:[0x18]
mov esi, dword [eax + 4]
mov edi, ebx
mov edx, 0x40855c
mov ecx, esi
xor eax, eax
lock cmpxchg dword [edx], ecx
test eax, eax
je 0x406b58
cmp eax, esi
jne 0x406b4b
xor esi, esi
inc esi
mov edi, esi
jmp 0x406b5b
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x406b2f
xor esi, esi
inc esi
cmp dword [0x408560], esi
jne 0x406b6d
push 0x1f
call sub.msvcrt.dll__amsg_exit
pop ecx
jmp 0x406ba7
cmp dword [0x408560], ebx
jne 0x406ba1
mov dword [0x408560], esi
push 0x40118c
push 0x401180
call fcn.00406c8c
pop ecx
pop ecx
test eax, eax
je 0x406ba7
mov dword [ebp - 4], 0xfffffffe
mov eax, 0xff
jmp 0x406c7c
mov dword [0x408204], esi
cmp dword [0x408560], esi
jne 0x406bca
push 0x40117c
push 0x401174
call sub.msvcrt.dll__initterm
pop ecx
pop ecx
mov dword [0x408560], 2
test edi, edi
jne 0x406bd7
xor eax, eax
mov ecx, 0x40855c
xchg dword [ecx], eax
cmp dword [0x408564], 0
je 0x406c03
push 0x408564
call fcn.00406f60
pop ecx
test eax, eax
je 0x406c03
push ebx
push 2
push ebx
mov esi, dword [0x408564]
mov ecx, esi
call dword [0x409178]
call esi
push dword [0x408210]
push dword [0x40820c]
push dword [0x408208]
call fcn.004030cc
add esp, 0xc
mov dword [0x408200], eax
cmp dword [0x408218], 0
jne 0x406c61
push eax
call dword [sym.imp.msvcrt.dll_exit]
mov ecx, dword [ebp - 0x14]
mov eax, dword [ecx]
mov eax, dword [eax]
mov dword [ebp - 0x1c], eax
push ecx
push eax
call sub.msvcrt.dll__XcptFilter
pop ecx
pop ecx
ret
cmp dword [0x408204], 0
jne 0x406c75
call dword [sym.imp.msvcrt.dll__cexit]
mov eax, dword [0x408200]
mov dword [ebp - 4], 0xfffffffe
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
leave
ret
call fcn.00498000
jmp 0x406b13

Function at 0x406e44
Capabilities:
Parse pe header

Disassembly:
push 0xc
push 0x407aa8
call fcn.00407108
xor ecx, ecx
mov eax, dword [ebp + 8]
test eax, eax
je 0x406ea4
cmp eax, 0xffffffff
je 0x406ea4
mov dword [ebp - 4], ecx
mov edx, 0x5a4d
cmp word [eax], dx
jne 0x406e9d
mov edx, dword [eax + 0x3c]
test edx, edx
js 0x406e9d
cmp edx, 0x10000000
jae 0x406e9d
add eax, edx
mov dword [ebp - 0x1c], eax
mov ecx, dword [eax]
sub ecx, 0x4550
neg ecx
sbb ecx, ecx
not ecx
and ecx, eax
jmp 0x406e9a
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 4], 0xfffffffe
mov eax, ecx
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
leave
ret 4

Function at 0x406f10
Capabilities:
Enumerate pe sections

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
xor edx, edx
push ebx
push esi
push edi
mov ecx, dword [eax + 0x3c]
add ecx, eax
movzx eax, word [ecx + 0x14]
movzx ebx, word [ecx + 6]
add eax, 0x18
add eax, ecx
test ebx, ebx
je 0x406f4e
mov edi, dword [ebp + 0xc]
mov esi, dword [eax + 0xc]
cmp edi, esi
jb 0x406f46
mov ecx, dword [eax + 8]
add ecx, esi
cmp edi, ecx
jb 0x406f50
inc edx
add eax, 0x28
cmp edx, ebx
jb 0x406f36
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x407020
Capabilities:
Parse pe header

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov ecx, dword [ebp + 8]
mov eax, 0x5a4d
cmp word [ecx], ax
jne 0x407051
mov eax, dword [ecx + 0x3c]
add eax, ecx
cmp dword [eax], 0x4550
jne 0x407051
mov ecx, 0x10b
cmp word [eax + 0x18], cx
jne 0x407051
mov eax, 1
pop ebp
ret
xor eax, eax
pop ebp
ret
Function at 0x404330
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 8]
movzx eax, byte [edx]
xor eax, 0x811c9dc5
imul ecx, eax, 0x1000193
movzx eax, byte [edx + 1]
xor ecx, eax
movzx eax, byte [edx + 2]
imul ecx, ecx, 0x1000193
xor ecx, eax
movzx eax, byte [edx + 3]
imul ecx, ecx, 0x1000193
xor ecx, eax
movzx eax, byte [edx + 4]
imul ecx, ecx, 0x1000193
xor ecx, eax
movzx eax, byte [edx + 5]
imul ecx, ecx, 0x1000193
xor ecx, eax
movzx eax, byte [edx + 6]
imul ecx, ecx, 0x1000193
xor ecx, eax
movzx eax, byte [edx + 7]
imul ecx, ecx, 0x1000193
xor ecx, eax
imul eax, ecx, 0x1000193
pop ebp
ret 4
Function at 0x4045e0
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x422a55
mov eax, dword fs:[0]
push eax
sub esp, 0x24
push ebx
push esi
push edi
mov eax, dword [0x42d008]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov edx, dword [ebp + 0xc]
mov edi, dword [ebp + 8]
mov dword [ebp - 0x1c], edx
mov dword [ebp - 0x2c], edi
movzx eax, byte [edx]
xor eax, 0x811c9dc5
imul ecx, eax, 0x1000193
movzx eax, byte [edx + 1]
xor ecx, eax
imul eax, ecx, 0x1000193
mov ecx, ebx
push eax
mov dword [ebp - 0x20], eax
lea eax, [ebp - 0x18]
push edx
push eax
call fcn.00405d60
mov eax, dword [ebp - 0x14]
test eax, eax
je 0x404652
mov dword [edi], eax
mov byte [edi + 4], 0
jmp 0x4047c0
cmp dword [ebx + 8], 0x71c71c7
jne 0x404666
push str.unordered_map_set_too_long
call dword [sym.imp.MSVCP140.dll_void___cdecl_std::_Xlength_error_char_const__]
lea eax, [ebx + 4]
mov dword [ebp - 0x28], eax
mov dword [ebp - 4], 0
push 0x24
mov dword [ebp - 0x24], 0
call fcn.00421430
mov esi, eax
add esp, 4
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x24], esi
mov cx, word [eax]
mov word [esi + 8], cx
mov dword [esi + 0x1c], 0
mov dword [esi + 0x20], 0xf
mov byte [esi + 0xc], 0
mov dword [ebp - 4], 1
mov eax, dword [ebx + 8]
inc eax
movss xmm3, dword [ebx]
movd xmm0, eax
cvtdq2pd xmm0, xmm0
shr eax, 0x1f
addsd xmm0, qword [eax*8 + 0x428090]
mov eax, dword [ebx + 0x1c]
cvtpd2ps xmm2, xmm0
movd xmm0, eax
cvtdq2pd xmm0, xmm0
shr eax, 0x1f
movaps xmm1, xmm2
addsd xmm0, qword [eax*8 + 0x428090]
cvtpd2ps xmm0, xmm0
divss xmm1, xmm0
comiss xmm1, xmm3
jbe 0x404760
divss xmm2, xmm3
sub esp, 8
cvtps2pd xmm0, xmm2
movsd qword [ebp - 0x18], xmm0
fld qword [ebp - 0x18]
fstp qword [esp]
call sub.api_ms_win_crt_math_l1_1_0.dll_ceil
fstp qword [ebp - 0x18]
movsd xmm0, qword [ebp - 0x18]
add esp, 8
cvtpd2ps xmm0, xmm0
call fcn.004224b0
mov ecx, 8
cmp eax, ecx
cmova ecx, eax
mov eax, dword [ebx + 0x1c]
cmp eax, ecx
jae 0x404742
cmp eax, 0x200
jae 0x404740
shl eax, 3
cmp eax, ecx
jae 0x404742
mov eax, ecx
push eax
mov ecx, ebx
call fcn.00405330
push dword [ebp - 0x20]
lea eax, [esi + 8]
mov ecx, ebx
push eax
lea eax, [ebp - 0x18]
push eax
call fcn.00405d60
mov edx, dword [eax]
jmp 0x404763
mov edx, dword [ebp - 0x18]
mov eax, dword [ebx + 8]
mov ecx, dword [edx + 4]
inc eax
mov edi, dword [ebp - 0x28]
mov dword [ebx + 8], eax
mov dword [esi], edx
mov dword [esi + 4], ecx
mov dword [ecx], esi
mov dword [edx + 4], esi
mov eax, dword [ebx + 0x18]
and eax, dword [ebp - 0x20]
mov dword [ebp - 0x1c], ecx
mov ecx, dword [ebx + 0xc]
mov dword [ebp - 0x24], 0
mov ebx, dword [ecx + eax*8]
cmp ebx, dword [edi]
jne 0x404799
mov dword [ecx + eax*8], esi
jmp 0x4047ab
cmp ebx, edx
jne 0x4047a2
mov dword [ecx + eax*8], esi
jmp 0x4047af
mov edx, dword [ebp - 0x1c]
cmp dword [ecx + eax*8 + 4], edx
jne 0x4047af
mov dword [ecx + eax*8 + 4], esi
mov edi, dword [ebp - 0x2c]
lea ecx, [ebp - 0x28]
mov dword [edi], esi
mov byte [edi + 4], 1
call fcn.00405030
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x405330
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
mov ebx, ecx
mov eax, 0x1fffffff
bsr ecx, eax
push esi
push edi
mov edi, 1
mov dword [ebp - 0x10], ebx
mov eax, edi
shl eax, cl
mov ecx, dword [ebp + 8]
cmp ecx, eax
jbe 0x405361
push str.invalid_hash_bucket_count
call dword [sym.imp.MSVCP140.dll_void___cdecl_std::_Xlength_error_char_const__]
lea eax, [ecx - 1]
mov esi, dword [ebx + 4]
or eax, 1
mov dword [ebp - 0xc], esi
bsr ecx, eax
push esi
lea ecx, [ecx + 1]
shl edi, cl
lea ecx, [ebx + 0xc]
lea eax, [edi + edi]
push eax
call fcn.004035d0
lea eax, [edi - 1]
mov dword [ebx + 0x1c], edi
mov dword [ebx + 0x18], eax
mov ecx, dword [ebx + 4]
mov ecx, dword [ecx]
mov edx, ecx
cmp ecx, esi
je 0x405453
nop word [eax + eax]
movzx eax, byte [ecx + 8]
mov edx, dword [edx]
xor eax, 0x811c9dc5
imul edi, eax, 0x1000193
movzx eax, byte [ecx + 9]
xor edi, eax
imul eax, edi, 0x1000193
mov edi, dword [ebx + 0x18]
and edi, eax
mov eax, dword [ebx + 0xc]
mov ebx, dword [eax + edi*8]
lea eax, [eax + edi*8]
mov dword [ebp - 8], eax
cmp ebx, esi
jne 0x4053d9
mov dword [eax], ecx
mov dword [eax + 4], ecx
jmp 0x405446
mov eax, dword [eax + 4]
movzx edi, word [ecx + 8]
cmp di, word [eax + 8]
jne 0x405412
mov eax, dword [eax]
cmp eax, ecx
je 0x40540a
mov ebx, dword [ecx + 4]
mov dword [ebp - 4], ebx
mov dword [ebx], edx
mov ebx, dword [edx + 4]
mov dword [ebx], eax
mov edi, dword [eax + 4]
mov dword [edi], ecx
mov dword [eax + 4], ebx
mov eax, dword [ebp - 4]
mov dword [edx + 4], eax
mov dword [ecx + 4], edi
mov eax, dword [ebp - 8]
mov dword [eax + 4], ecx
jmp 0x405446
cmp ebx, eax
je 0x405423
mov eax, dword [eax + 4]
cmp di, word [eax + 8]
je 0x40545c
cmp ebx, eax
jne 0x405416
mov ebx, dword [ecx + 4]
mov dword [ebp - 4], ebx
mov dword [ebx], edx
mov ebx, dword [edx + 4]
mov dword [ebx], eax
mov edi, dword [eax + 4]
mov dword [edi], ecx
mov dword [eax + 4], ebx
mov eax, dword [ebp - 4]
mov dword [edx + 4], eax
mov eax, dword [ebp - 8]
mov dword [ecx + 4], edi
mov dword [eax], ecx
mov ebx, dword [ebp - 0x10]
mov ecx, edx
cmp edx, esi
jne 0x4053a0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
mov ebx, dword [ecx + 4]
mov eax, dword [eax]
mov dword [ebp - 4], eax
mov esi, dword [ebp - 4]
mov dword [ebx], edx
mov edi, dword [edx + 4]
mov dword [edi], eax
mov eax, dword [eax + 4]
mov dword [eax], ecx
mov dword [esi + 4], edi
mov esi, dword [ebp - 0xc]
mov dword [edx + 4], ebx
mov dword [ecx + 4], eax
jmp 0x405446
Function at 0x406770
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x14
push ebx
mov ebx, ecx
push esi
push edi
mov eax, dword [ebx + 8]
sub eax, 1
je 0x4067f9
sub eax, 1
jne 0x40684a
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0xc]
mov dword [esp + 0x10], eax
lea esi, [eax + 8]
push esi
call fcn.00404330
and eax, dword [ebx + 0x50]
mov ecx, dword [ebx + 0x44]
mov edi, dword [ebx + 0x3c]
lea ecx, [ecx + eax*8]
mov eax, dword [ecx + 4]
cmp eax, edi
je 0x40684a
mov edx, dword [esi]
mov ecx, dword [ecx]
mov esi, dword [esi + 4]
cmp edx, dword [eax + 8]
jne 0x4067ca
cmp esi, dword [eax + 0xc]
je 0x4067d3
cmp eax, ecx
je 0x40684a
mov eax, dword [eax + 4]
jmp 0x4067c0
test eax, eax
cmove eax, edi
cmp eax, edi
je 0x40684a
push dword [esp + 0x10]
lea eax, [esp + 0x14]
push eax
lea ecx, [ebx + 0x98]
call fcn.00407530
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
mov edi, dword [ebp + 8]
mov eax, dword [edi + 8]
lea ecx, [edi + 8]
mov edx, dword [eax + 4]
mov esi, dword [edx + 0x20]
sub esi, dword [edx + 0x18]
mov eax, dword [edx + 0x24]
sbb eax, dword [edx + 0x1c]
push eax
push esi
lea eax, [esp + 0x18]
push eax
call fcn.00407490
mov eax, dword [edi + 0xc]
lea ecx, [ebx + 0x78]
add eax, 8
push eax
lea eax, [esp + 0x1c]
push eax
call fcn.00407700
push 0
push 0x3e8
push dword [esp + 0x1c]
mov esi, dword [eax]
push dword [esp + 0x1c]
call fcn.004222a0
add dword [esi + 0x10], eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x406b70
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x4c
mov eax, dword [0x42d008]
xor eax, esp
mov dword [esp + 0x48], eax
push ebx
mov ebx, ecx
mov dword [esp + 0xc], 0x7a120
push esi
push edi
mov dword [esp + 0x10], ebx
mov edx, dword [ebx + 0x14]
mov ecx, dword [ebx + 0x10]
call fcn.00422800
mulsd xmm0, qword [0x428088]
call fcn.00422649
test edx, edx
ja 0x406bc0
jb 0x406bba
cmp eax, 0x7a120
jae 0x406bc0
mov dword [esp + 0x14], eax
jmp 0x406bc5
mov eax, 0x7a120
mov edi, dword [ebx + 0x5c]
mov dword [esp + 0x24], edi
mov esi, dword [edi]
cmp esi, edi
je 0x406cc4
cmp dword [esi + 0x18], eax
jb 0x406c3b
mov ecx, dword [esi + 0x10]
mov eax, dword [esi + 0xc]
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x18], eax
cmp eax, ecx
je 0x406caf
lea ecx, [ebx + 0x38]
mov edi, eax
mov dword [esp + 0x20], ecx
nop word [eax + eax]
mov eax, dword [edi]
mov ebx, dword [esi + 8]
mov dword [esp + 0x48], eax
mov eax, dword [edi + 4]
mov dword [esp + 0x4c], eax
lea eax, [esp + 0x48]
push eax
lea eax, [esp + 0x44]
push eax
call fcn.00407b00
mov ecx, dword [esp + 0x20]
add edi, 8
mov eax, dword [eax]
mov dword [eax + 0x10], ebx
cmp edi, dword [esp + 0x1c]
jne 0x406c00
mov edi, dword [esp + 0x24]
mov ebx, dword [esp + 0x10]
jmp 0x406caf
mov edx, dword [esi + 8]
mov ecx, edx
mov dword [esp + 0x38], 0
mov dword [esp + 0x3c], 0xf
mov byte [esp + 0x28], 0
lea ebx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x406c58
sub ecx, ebx
push ecx
push edx
lea ecx, [esp + 0x30]
call fcn.004034a0
mov ebx, dword [esp + 0x10]
lea eax, [esp + 0x28]
push eax
lea ecx, [ebx + 0x18]
call fcn.004070e0
mov edx, dword [esp + 0x3c]
cmp edx, 0x10
jb 0x406caf
mov ecx, dword [esp + 0x28]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x406ca5
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x406cbe
push edx
push ecx
call fcn.00421460
add esp, 8
mov esi, dword [esi]
cmp esi, edi
je 0x406cc4
mov eax, dword [esp + 0x14]
jmp 0x406bd6
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
mov ecx, dword [ebx + 0x60]
test ecx, ecx
je 0x406d1e
mov eax, dword [ebx + 0x74]
shr eax, 3
cmp eax, ecx
jbe 0x406ce5
mov eax, dword [ebx + 0x5c]
lea ecx, [ebx + 0x58]
push eax
push dword [eax]
call fcn.00407260
jmp 0x406d1e
mov edx, dword [ebx + 0x5c]
call fcn.004081a0
mov eax, dword [ebx + 0x5c]
mov dword [eax], eax
mov eax, dword [ebx + 0x5c]
mov dword [eax + 4], eax
xor eax, eax
mov dword [ebx + 0x60], 0
mov edi, dword [ebx + 0x64]
mov ecx, dword [ebx + 0x68]
sub ecx, edi
add ecx, 3
shr ecx, 2
cmp edi, dword [ebx + 0x68]
cmova ecx, eax
test ecx, ecx
je 0x406d1e
mov eax, dword [ebx + 0x5c]
rep stosd dword es:[edi], eax
lea ecx, [ebx + 0x78]
call fcn.00406f50
mov ecx, dword [esp + 0x54]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.0042141f
mov esp, ebp
pop ebp
ret
Function at 0x4070e0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov eax, ecx
mov dword [ebp - 4], eax
mov esi, edi
cmp dword [edi + 0x14], 0x10
mov ebx, dword [edi + 0x10]
jb 0x4070fe
mov esi, dword [edi]
xor ecx, ecx
mov edx, 0x811c9dc5
test ebx, ebx
je 0x407124
nop dword [eax]
movzx eax, byte [ecx + esi]
inc ecx
xor eax, edx
imul edx, eax, 0x1000193
cmp ecx, ebx
jb 0x407110
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0x18]
mov ebx, dword [eax + 0xc]
and ecx, edx
mov eax, dword [eax + 4]
mov dword [ebp - 8], ecx
mov dword [ebp - 0xc], ebx
mov esi, dword [ebx + ecx*8 + 4]
mov dword [ebp - 0x10], eax
cmp esi, eax
je 0x40721b
mov ebx, dword [ebx + ecx*8]
lea eax, [esi + 8]
push eax
push edi
call fcn.00408830
test al, al
je 0x40716e
cmp esi, ebx
je 0x40721b
mov esi, dword [esi + 4]
lea eax, [esi + 8]
push eax
push edi
call fcn.00408830
test al, al
jne 0x407155
test esi, esi
je 0x40721b
mov ecx, dword [ebp - 8]
mov edx, dword [ebp - 0xc]
mov eax, dword [edx + ecx*8]
cmp dword [edx + ecx*8 + 4], esi
jne 0x40719e
cmp eax, esi
jne 0x407195
mov eax, dword [ebp - 0x10]
mov dword [edx + ecx*8], eax
mov dword [edx + ecx*8 + 4], eax
jmp 0x4071a7
mov eax, dword [esi + 4]
mov dword [edx + ecx*8 + 4], eax
jmp 0x4071a7
cmp eax, esi
jne 0x4071a7
mov eax, dword [esi]
mov dword [edx + ecx*8], eax
mov eax, dword [ebp - 4]
mov ecx, dword [esi]
dec dword [eax + 8]
mov eax, dword [esi + 4]
mov dword [eax], ecx
mov eax, dword [esi + 4]
mov dword [ecx + 4], eax
mov ecx, dword [esi + 0x1c]
cmp ecx, 0x10
jb 0x4071ea
mov eax, dword [esi + 8]
inc ecx
cmp ecx, 0x1000
jb 0x4071e0
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x407215
mov eax, edx
push ecx
push eax
call fcn.00421460
add esp, 8
push 0x20
push esi
mov dword [esi + 0x18], 0
mov dword [esi + 0x1c], 0xf
mov byte [esi + 8], 0
call fcn.00421460
add esp, 8
mov eax, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x408520
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
mov ebx, ecx
mov eax, 0x1fffffff
bsr ecx, eax
push esi
push edi
mov edi, 1
mov dword [ebp - 0x10], ebx
mov eax, edi
shl eax, cl
mov ecx, dword [ebp + 8]
cmp ecx, eax
jbe 0x408551
push str.invalid_hash_bucket_count
call dword [sym.imp.MSVCP140.dll_void___cdecl_std::_Xlength_error_char_const__]
lea eax, [ecx - 1]
mov esi, dword [ebx + 4]
or eax, 1
mov dword [ebp - 0xc], esi
bsr ecx, eax
push esi
lea ecx, [ecx + 1]
shl edi, cl
lea ecx, [ebx + 0xc]
lea eax, [edi + edi]
push eax
call fcn.004035d0
lea eax, [edi - 1]
mov dword [ebx + 0x1c], edi
mov dword [ebx + 0x18], eax
mov ecx, dword [ebx + 4]
mov ecx, dword [ecx]
mov edx, ecx
cmp ecx, esi
je 0x40865c
nop word [eax + eax]
movzx eax, byte [ecx + 8]
xor eax, 0x811c9dc5
mov edx, dword [edx]
imul edi, eax, 0x1000193
movzx eax, byte [ecx + 9]
xor edi, eax
movzx eax, byte [ecx + 0xa]
imul edi, edi, 0x1000193
xor edi, eax
movzx eax, byte [ecx + 0xb]
imul edi, edi, 0x1000193
xor edi, eax
imul eax, edi, 0x1000193
mov edi, dword [ebx + 0x18]
and edi, eax
mov eax, dword [ebx + 0xc]
mov ebx, dword [eax + edi*8]
lea eax, [eax + edi*8]
mov dword [ebp - 8], eax
cmp ebx, esi
jne 0x4085e1
mov dword [eax], ecx
mov dword [eax + 4], ecx
jmp 0x40864f
mov eax, dword [eax + 4]
mov edi, dword [ecx + 8]
cmp edi, dword [eax + 8]
jne 0x408618
mov eax, dword [eax]
cmp eax, ecx
je 0x408610
mov ebx, dword [ecx + 4]
mov dword [ebp - 4], ebx
mov dword [ebx], edx
mov ebx, dword [edx + 4]
mov dword [ebx], eax
mov edi, dword [eax + 4]
mov dword [edi], ecx
mov dword [eax + 4], ebx
mov eax, dword [ebp - 4]
mov dword [edx + 4], eax
mov dword [ecx + 4], edi
mov eax, dword [ebp - 8]
mov dword [eax + 4], ecx
jmp 0x40864f
cmp ebx, eax
je 0x40862c
nop dword [eax]
mov eax, dword [eax + 4]
cmp edi, dword [eax + 8]
je 0x408665
cmp ebx, eax
jne 0x408620
mov ebx, dword [ecx + 4]
mov dword [ebp - 4], ebx
mov dword [ebx], edx
mov ebx, dword [edx + 4]
mov dword [ebx], eax
mov edi, dword [eax + 4]
mov dword [edi], ecx
mov dword [eax + 4], ebx
mov eax, dword [ebp - 4]
mov dword [edx + 4], eax
mov eax, dword [ebp - 8]
mov dword [ecx + 4], edi
mov dword [eax], ecx
mov ebx, dword [ebp - 0x10]
mov ecx, edx
cmp edx, esi
jne 0x408590
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
mov ebx, dword [ecx + 4]
mov eax, dword [eax]
mov dword [ebp - 4], eax
mov esi, dword [ebp - 4]
mov dword [ebx], edx
mov edi, dword [edx + 4]
mov dword [edi], eax
mov eax, dword [eax + 4]
mov dword [eax], ecx
mov dword [esi + 4], edi
mov esi, dword [ebp - 0xc]
mov dword [edx + 4], ebx
mov dword [ecx + 4], eax
jmp 0x40864f