joyce8/EMBER2024-capa huggingface dataset:
Function at 0x487c10
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5eb675
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push ebx
push esi
push edi
mov eax, dword [0x670440]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, dword [ebp + 0xc]
movzx eax, byte [edi]
xor eax, 0x811c9dc5
imul ecx, eax, 0x1000193
movzx eax, byte [edi + 1]
xor ecx, eax
movzx eax, byte [edi + 2]
imul ecx, ecx, 0x1000193
xor ecx, eax
movzx eax, byte [edi + 3]
imul ecx, ecx, 0x1000193
xor ecx, eax
lea eax, [ebp - 0x14]
imul ebx, ecx, 0x1000193
push ebx
push edi
push eax
call fcn.004883c0
mov ecx, dword [ebp - 0x10]
test ecx, ecx
je 0x487c9c
mov eax, dword [ebp + 8]
mov dword [eax], ecx
mov byte [eax + 4], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
cmp dword [0x67bd10], 0xfffffff
je 0x487de7
mov dword [ebp - 0x1c], 0x67bd0c
mov dword [ebp - 4], 0
push 0x10
mov dword [ebp - 0x18], 0
call fcn.00502e30
mov ecx, dword [edi]
mov esi, eax
add esp, 4
mov dword [ebp - 0x18], esi
mov dword [esi + 8], ecx
mov dword [esi + 0xc], 0
mov dword [ebp - 4], 1
mov ecx, dword [0x67bd10]
mov edi, dword [0x67bd24]
lea eax, [ecx + 1]
movd xmm0, eax
cvtdq2pd xmm0, xmm0
shr eax, 0x1f
movd xmm1, edi
addsd xmm0, qword [eax*8 + 0x6602a0]
cvtdq2pd xmm1, xmm1
mov eax, edi
shr eax, 0x1f
cvtpd2ps xmm0, xmm0
addsd xmm1, qword [eax*8 + 0x6602a0]
movaps xmm2, xmm0
cvtpd2ps xmm1, xmm1
divss xmm2, xmm1
movss xmm1, dword [0x67bd08]
comiss xmm2, xmm1
jbe 0x487d83
divss xmm0, xmm1
call fcn.00454eb0
call fcn.00503830
mov ecx, 8
cmp eax, ecx
cmova ecx, eax
cmp edi, ecx
jae 0x487d65
cmp edi, 0x200
jae 0x487d63
shl edi, 3
cmp edi, ecx
jae 0x487d65
mov edi, ecx
push edi
call fcn.00488060
push ebx
lea eax, [esi + 8]
push eax
lea eax, [ebp - 0x1c]
push eax
call fcn.004883c0
mov ecx, dword [0x67bd10]
mov edx, dword [eax]
jmp 0x487d86
mov edx, dword [ebp - 0x14]
mov edi, dword [edx + 4]
inc ecx
mov dword [0x67bd10], ecx
mov dword [esi], edx
mov dword [esi + 4], edi
mov dword [edi], esi
mov dword [edx + 4], esi
mov eax, dword [0x67bd20]
mov ecx, dword [0x67bd14]
and eax, ebx
mov ebx, dword [ecx + eax*8]
cmp ebx, dword [0x67bd0c]
jne 0x487db7
mov dword [ecx + eax*8], esi
jmp 0x487dc6
cmp ebx, edx
jne 0x487dc0
mov dword [ecx + eax*8], esi
jmp 0x487dca
cmp dword [ecx + eax*8 + 4], edi
jne 0x487dca
mov dword [ecx + eax*8 + 4], esi
mov eax, dword [ebp + 8]
mov dword [eax], esi
mov byte [eax + 4], 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
push str.unordered_map_set_too_long
call fcn.004eb99c
int3
Function at 0x487e00
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5eb6b5
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push ebx
push esi
push edi
mov eax, dword [0x670440]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, dword [ebp + 0xc]
movzx eax, byte [edi]
xor eax, 0x811c9dc5
imul ecx, eax, 0x1000193
movzx eax, byte [edi + 1]
xor ecx, eax
movzx eax, byte [edi + 2]
imul ecx, ecx, 0x1000193
xor ecx, eax
movzx eax, byte [edi + 3]
imul ecx, ecx, 0x1000193
xor ecx, eax
lea eax, [ebp - 0x14]
imul ebx, ecx, 0x1000193
push ebx
push edi
push eax
call fcn.00488350
mov ecx, dword [ebp - 0x10]
test ecx, ecx
je 0x487e8c
mov eax, dword [ebp + 8]
mov dword [eax], ecx
mov byte [eax + 4], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
cmp dword [0x67bcec], 0x15555555
je 0x487fd0
mov dword [ebp - 0x1c], 0x67bce8
mov dword [ebp - 4], 0
push 0xc
mov dword [ebp - 0x18], 0
call fcn.00502e30
mov ecx, dword [edi]
mov esi, eax
add esp, 4
mov dword [ebp - 0x18], esi
mov dword [esi + 8], ecx
mov dword [ebp - 4], 1
mov ecx, dword [0x67bcec]
mov edi, dword [0x67bd00]
lea eax, [ecx + 1]
movd xmm0, eax
cvtdq2pd xmm0, xmm0
shr eax, 0x1f
movd xmm1, edi
addsd xmm0, qword [eax*8 + 0x6602a0]
cvtdq2pd xmm1, xmm1
mov eax, edi
shr eax, 0x1f
cvtpd2ps xmm0, xmm0
addsd xmm1, qword [eax*8 + 0x6602a0]
movaps xmm2, xmm0
cvtpd2ps xmm1, xmm1
divss xmm2, xmm1
movss xmm1, dword [0x67bce4]
comiss xmm2, xmm1
jbe 0x487f6c
divss xmm0, xmm1
call fcn.00454eb0
call fcn.00503830
mov ecx, 8
cmp eax, ecx
cmova ecx, eax
cmp edi, ecx
jae 0x487f4e
cmp edi, 0x200
jae 0x487f4c
shl edi, 3
cmp edi, ecx
jae 0x487f4e
mov edi, ecx
push edi
call fcn.004881e0
push ebx
lea eax, [esi + 8]
push eax
lea eax, [ebp - 0x1c]
push eax
call fcn.00488350
mov ecx, dword [0x67bcec]
mov edx, dword [eax]
jmp 0x487f6f
mov edx, dword [ebp - 0x14]
mov edi, dword [edx + 4]
inc ecx
mov dword [0x67bcec], ecx
mov dword [esi], edx
mov dword [esi + 4], edi
mov dword [edi], esi
mov dword [edx + 4], esi
mov eax, dword [0x67bcfc]
mov ecx, dword [0x67bcf0]
and eax, ebx
mov ebx, dword [ecx + eax*8]
cmp ebx, dword [0x67bce8]
jne 0x487fa0
mov dword [ecx + eax*8], esi
jmp 0x487faf
cmp ebx, edx
jne 0x487fa9
mov dword [ecx + eax*8], esi
jmp 0x487fb3
cmp dword [ecx + eax*8 + 4], edi
jne 0x487fb3
mov dword [ecx + eax*8 + 4], esi
mov eax, dword [ebp + 8]
mov dword [eax], esi
mov byte [eax + 4], 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
push str.unordered_map_set_too_long
call fcn.004eb99c
int3
Function at 0x488060
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1fffffff
sub esp, 8
bsr ecx, eax
push ebx
push esi
push edi
mov edi, 1
mov eax, edi
shl eax, cl
mov ecx, dword [ebp + 8]
cmp ecx, eax
ja 0x4881cd
lea eax, [ecx - 1]
mov esi, dword [0x67bd0c]
or eax, edi
mov dword [ebp + 8], esi
bsr ecx, eax
push esi
lea ecx, [ecx + 1]
shl edi, cl
mov ecx, 0x67bd14
lea eax, [edi + edi]
push eax
call fcn.00456800
mov eax, dword [0x67bd0c]
lea ebx, [edi - 1]
mov dword [0x67bd20], ebx
mov dword [0x67bd24], edi
mov eax, dword [eax]
mov ecx, eax
cmp eax, esi
je 0x4881c4
nop word [eax + eax]
movzx edx, byte [eax + 8]
xor edx, 0x811c9dc5
mov ecx, dword [ecx]
imul edi, edx, 0x1000193
movzx edx, byte [eax + 9]
xor edi, edx
movzx edx, byte [eax + 0xa]
imul edi, edi, 0x1000193
xor edi, edx
movzx edx, byte [eax + 0xb]
imul edi, edi, 0x1000193
xor edi, edx
mov edx, dword [0x67bd14]
imul edi, edi, 0x1000193
and edi, ebx
mov ebx, dword [edx + edi*8]
lea edx, [edx + edi*8]
mov dword [ebp - 4], edx
cmp ebx, esi
jne 0x488122
mov dword [edx], eax
mov dword [edx + 4], eax
jmp 0x48818f
mov edx, dword [edx + 4]
mov edi, dword [eax + 8]
cmp edi, dword [edx + 8]
jne 0x48815c
mov edx, dword [edx]
mov dword [ebp - 8], edx
cmp edx, eax
je 0x488154
mov ebx, dword [eax + 4]
mov esi, dword [ebp - 8]
mov dword [ebx], ecx
mov edi, dword [ecx + 4]
mov dword [edi], edx
mov edx, dword [edx + 4]
mov dword [edx], eax
mov dword [esi + 4], edi
mov esi, dword [ebp + 8]
mov dword [ecx + 4], ebx
mov dword [eax + 4], edx
mov edx, dword [ebp - 4]
mov dword [edx + 4], eax
jmp 0x48818f
cmp ebx, edx
je 0x48816c
mov edx, dword [edx + 4]
cmp edi, dword [edx + 8]
je 0x4881a0
cmp ebx, edx
jne 0x488160
mov ebx, dword [eax + 4]
mov dword [ebp - 8], ebx
mov dword [ebx], ecx
mov ebx, dword [ecx + 4]
mov dword [ebx], edx
mov edi, dword [edx + 4]
mov dword [edi], eax
mov dword [edx + 4], ebx
mov edx, dword [ebp - 8]
mov dword [ecx + 4], edx
mov edx, dword [ebp - 4]
mov dword [eax + 4], edi
mov dword [edx], eax
mov eax, ecx
cmp ecx, esi
je 0x4881c4
mov ebx, dword [0x67bd20]
jmp 0x4880d0
mov ebx, dword [eax + 4]
mov edx, dword [edx]
mov dword [ebp - 8], edx
mov esi, edx
mov dword [ebx], ecx
mov edi, dword [ecx + 4]
mov dword [edi], edx
mov edx, dword [edx + 4]
mov dword [edx], eax
mov dword [esi + 4], edi
mov esi, dword [ebp + 8]
mov dword [ecx + 4], ebx
mov dword [eax + 4], edx
jmp 0x48818f
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
push str.invalid_hash_bucket_count
call fcn.004eb99c
int3
Function at 0x4881e0
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1fffffff
sub esp, 8
bsr ecx, eax
push ebx
push esi
mov esi, 1
mov eax, esi
shl eax, cl
mov ecx, dword [ebp + 8]
push edi
cmp ecx, eax
ja 0x488340
lea eax, [ecx - 1]
mov ebx, dword [0x67bce8]
or eax, esi
mov dword [ebp - 4], ebx
bsr ecx, eax
push ebx
lea ecx, [ecx + 1]
shl esi, cl
mov ecx, 0x67bcf0
lea eax, [esi + esi]
push eax
call fcn.00456800
mov ecx, dword [0x67bce8]
lea edi, [esi - 1]
mov dword [0x67bcfc], edi
mov dword [0x67bd00], esi
mov ecx, dword [ecx]
cmp ecx, ebx
je 0x488337
mov eax, ecx
nop dword [eax + eax]
movzx edx, byte [eax + 8]
xor edx, 0x811c9dc5
mov ecx, dword [ecx]
imul esi, edx, 0x1000193
movzx edx, byte [eax + 9]
xor esi, edx
movzx edx, byte [eax + 0xa]
imul esi, esi, 0x1000193
xor esi, edx
movzx edx, byte [eax + 0xb]
imul esi, esi, 0x1000193
xor esi, edx
mov edx, dword [0x67bcf0]
imul esi, esi, 0x1000193
and esi, edi
mov edi, dword [edx + esi*8]
lea ebx, [edx + esi*8]
mov dword [ebp + 8], ebx
cmp edi, dword [ebp - 4]
jne 0x4882a3
mov dword [ebx], eax
mov dword [ebx + 4], eax
jmp 0x488309
mov edx, dword [ebx + 4]
mov esi, dword [eax + 8]
cmp esi, dword [edx + 8]
jne 0x4882da
mov edx, dword [edx]
mov dword [ebp - 8], edx
cmp edx, eax
je 0x4882d5
mov edi, dword [eax + 4]
mov ebx, dword [ebp - 8]
mov dword [edi], ecx
mov esi, dword [ecx + 4]
mov dword [esi], edx
mov edx, dword [edx + 4]
mov dword [edx], eax
mov dword [ebx + 4], esi
mov ebx, dword [ebp + 8]
mov dword [ecx + 4], edi
mov dword [eax + 4], edx
mov dword [ebx + 4], eax
jmp 0x488309
cmp edi, edx
je 0x4882ec
nop
mov edx, dword [edx + 4]
cmp esi, dword [edx + 8]
je 0x48831b
cmp edi, edx
jne 0x4882e0
mov ebx, dword [eax + 4]
mov dword [ebx], ecx
mov edi, dword [ecx + 4]
mov dword [edi], edx
mov esi, dword [edx + 4]
mov dword [esi], eax
mov dword [edx + 4], edi
mov edx, dword [ebp + 8]
mov dword [ecx + 4], ebx
mov dword [eax + 4], esi
mov dword [edx], eax
mov eax, ecx
cmp ecx, dword [ebp - 4]
je 0x488337
mov edi, dword [0x67bcfc]
jmp 0x488250
mov edi, dword [eax + 4]
mov ebx, dword [edx]
mov dword [edi], ecx
mov esi, dword [ecx + 4]
mov dword [esi], ebx
mov edx, dword [ebx + 4]
mov dword [edx], eax
mov dword [ebx + 4], esi
mov dword [ecx + 4], edi
mov dword [eax + 4], edx
jmp 0x488309
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
push str.invalid_hash_bucket_count
call fcn.004eb99c
int3
Function at 0x488430
Capabilities:
Get token membership

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x670440]
xor eax, ebp
mov dword [ebp - 4], eax
lea eax, [ebp - 0x10]
mov dword [ebp - 0x14], 0
push eax
push 0
push 0
push 0
push 0
push 0
push 0
push 0x220
push 0x20
push 2
lea eax, [ebp - 0xc]
mov dword [ebp - 0x10], 0
push eax
mov dword [ebp - 0xc], 0
mov word [ebp - 8], 0x500
call dword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
test eax, eax
je 0x488495
lea eax, [ebp - 0x14]
push eax
push dword [ebp - 0x10]
push 0
call dword [sym.imp.ADVAPI32.dll_CheckTokenMembership]
test eax, eax
jne 0x48849b
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov eax, dword [ebp - 0x10]
test eax, eax
je 0x4884a9
push eax
call dword [sym.imp.ADVAPI32.dll_FreeSid]
cmp dword [ebp - 0x14], 0
mov ecx, dword [ebp - 4]
setne al
xor ecx, ebp
call fcn.00502d42
mov esp, ebp
pop ebp
ret
Function at 0x48a430
Capabilities:
Enumerate process modules

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
mov eax, 0x1444
call fcn.00503b50
mov eax, dword [0x670440]
xor eax, esp
mov dword [esp + 0x1440], eax
push ebx
push esi
push edi
lea eax, [esp + 0x14]
mov dword [esp + 0x18], edx
push eax
push 0x1000
lea eax, [esp + 0x40]
push eax
call dword [sym.imp.KERNEL32.dll_K32EnumProcesses]
test eax, eax
je 0x48a5bc
mov ebx, dword [esp + 0x14]
xor edi, edi
shr ebx, 2
test ebx, ebx
je 0x48a5bc
mov esi, dword [esp + edi*4 + 0x38]
test esi, esi
je 0x48a5b3
mov eax, dword [0x65fb58]
movups xmm0, xmmword [str._unknown_]
push 0x1f4
mov dword [esp + 0x104c], eax
lea eax, [esp + 0x1050]
push 0
push eax
movups xmmword [esp + 0x1044], xmm0
call fcn.005b9800
add esp, 0xc
push esi
push 0
push 0x410
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
test esi, esi
je 0x48a5b3
lea eax, [esp + 0x1c]
push eax
push 4
lea eax, [esp + 0x18]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_K32EnumProcessModules]
test eax, eax
je 0x48a508
push 0x104
lea eax, [esp + 0x103c]
push eax
push dword [esp + 0x18]
push esi
call dword [sym.imp.KERNEL32.dll_K32GetModuleBaseNameW]
lea eax, [esp + 0x1038]
push eax
push 0x65f9e4
call fcn.005c72c4
add esp, 8
test eax, eax
jne 0x48a5ac
push 0x104
lea eax, [esp + 0x1244]
push eax
push dword [esp + 0x18]
push esi
call dword [sym.imp.KERNEL32.dll_K32GetModuleFileNameExW]
test eax, eax
je 0x48a5ac
lea edx, [esp + 0x1240]
lea ecx, [esp + 0x20]
call fcn.0044b380
cmp dword [esp + 0x34], 7
lea eax, [esp + 0x20]
cmova eax, dword [esp + 0x20]
push eax
push dword [esp + 0x1c]
call fcn.005c72c4
add esp, 8
test eax, eax
je 0x48a5d3
mov ecx, dword [esp + 0x34]
cmp ecx, 7
jbe 0x48a5ac
mov edx, dword [esp + 0x20]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x48a5a2
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x48a629
push ecx
push edx
call fcn.005030b1
add esp, 8
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
inc edi
cmp edi, ebx
jb 0x48a483
xor al, al
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x1440]
xor ecx, esp
call fcn.00502d42
mov esp, ebp
pop ebp
ret
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [esp + 0x34]
cmp ecx, 7
jbe 0x48a612
mov edx, dword [esp + 0x20]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x48a608
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x48a629
push ecx
push edx
call fcn.005030b1
add esp, 8
mov ecx, dword [esp + 0x144c]
mov al, 1
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.00502d42
mov esp, ebp
pop ebp
ret
call fcn.005be8d2
int3
Function at 0x48af90
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5ebc1e
mov eax, dword fs:[0]
push eax
sub esp, 0x24
mov eax, dword [0x670440]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, dword [ebp + 8]
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x30], 0
mov esi, dword [ecx]
mov dword [ebp - 0x2c], edi
mov dword [ebp - 0x2c], eax
cmp dword [esi + 0x14], 7
jbe 0x48afd7
mov esi, dword [esi]
xor eax, eax
mov dword [ebp - 4], 0
xorps xmm0, xmm0
mov dword [ebp - 0x18], 0
push eax
movups xmmword [ebp - 0x28], xmm0
push 0x105
lea ecx, [ebp - 0x28]
mov dword [ebp - 0x14], 7
mov word [ebp - 0x28], ax
mov dword [ebp - 0x30], 2
call fcn.0046a360
cmp dword [ebp - 0x14], 7
lea eax, [ebp - 0x28]
push esi
cmova eax, dword [ebp - 0x28]
push 0x104
push eax
push 0x65b5a0
push dword [ebp - 0x2c]
push str.config
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
mov ecx, eax
test ecx, ecx
jns 0x48b03d
xor ecx, ecx
jmp 0x48b047
mov eax, 0x104
cmp ecx, eax
cmovg ecx, eax
mov eax, dword [ebp - 0x18]
cmp ecx, eax
ja 0x48b064
cmp dword [ebp - 0x14], 7
lea eax, [ebp - 0x28]
mov dword [ebp - 0x18], ecx
cmova eax, dword [ebp - 0x28]
xor edx, edx
mov word [eax + ecx*2], dx
jmp 0x48b071
sub ecx, eax
push 0
push ecx
lea ecx, [ebp - 0x28]
call fcn.0046a360
cmp dword [ebp - 0x14], 7
lea edx, [ebp - 0x28]
mov ecx, edi
cmova edx, dword [ebp - 0x28]
call fcn.0047e2e0
mov ecx, dword [ebp - 0x14]
cmp ecx, 7
jbe 0x48b0b9
mov edx, dword [ebp - 0x28]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x48b0af
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x48b0d8
push ecx
push edx
call fcn.005030b1
add esp, 8
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00502d42
mov esp, ebp
pop ebp
ret 8
call fcn.005be8d2
int3
Function at 0x48c860
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5ebe55
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push ebx
push esi
push edi
mov eax, dword [0x670440]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, dword [ebp + 0xc]
mov edx, ebx
cmp dword [ebx + 0x14], 0xf
mov edi, dword [ebx + 0x10]
jbe 0x48c898
mov edx, dword [ebx]
xor ecx, ecx
mov esi, 0x811c9dc5
test edi, edi
je 0x48c8b4
movzx eax, byte [edx + ecx]
inc ecx
xor eax, esi
imul esi, eax, 0x1000193
cmp ecx, edi
jb 0x48c8a3
push esi
push ebx
lea eax, [ebp - 0x14]
push eax
call fcn.0048cfe0
mov ecx, dword [ebp - 0x10]
test ecx, ecx
je 0x48c8e3
mov eax, dword [ebp + 8]
mov dword [eax], ecx
mov byte [eax + 4], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
cmp dword [0x67c6b4], 0x7ffffff
je 0x48ca2b
mov dword [ebp - 0x1c], 0x67c6b0
mov dword [ebp - 4], 0
push 0x20
mov dword [ebp - 0x18], 0
call fcn.00502e30
mov edi, eax
add esp, 4
mov dword [ebp - 0x18], edi
lea ecx, [edi + 8]
push ebx
call fcn.0044aa70
mov dword [ebp - 4], 1
mov ecx, dword [0x67c6b4]
mov ebx, dword [0x67c6c8]
lea eax, [ecx + 1]
movd xmm0, eax
cvtdq2pd xmm0, xmm0
shr eax, 0x1f
movd xmm1, ebx
addsd xmm0, qword [eax*8 + 0x6602a0]
cvtdq2pd xmm1, xmm1
mov eax, ebx
shr eax, 0x1f
cvtpd2ps xmm0, xmm0
addsd xmm1, qword [eax*8 + 0x6602a0]
movaps xmm2, xmm0
cvtpd2ps xmm1, xmm1
divss xmm2, xmm1
movss xmm1, dword [0x67c6ac]
comiss xmm2, xmm1
jbe 0x48c9c7
divss xmm0, xmm1
call fcn.00454eb0
call fcn.00503830
mov ecx, 8
cmp eax, ecx
cmova ecx, eax
cmp ebx, ecx
jae 0x48c9a9
cmp ebx, 0x200
jae 0x48c9a7
shl ebx, 3
cmp ebx, ecx
jae 0x48c9a9
mov ebx, ecx
push ebx
call fcn.0048cdf0
push esi
lea eax, [edi + 8]
push eax
lea eax, [ebp - 0x1c]
push eax
call fcn.0048cfe0
mov ecx, dword [0x67c6b4]
mov edx, dword [eax]
jmp 0x48c9ca
mov edx, dword [ebp - 0x14]
mov ebx, dword [edx + 4]
inc ecx
mov dword [0x67c6b4], ecx
mov dword [edi], edx
mov dword [edi + 4], ebx
mov dword [ebx], edi
mov dword [edx + 4], edi
mov eax, dword [0x67c6c4]
mov ecx, dword [0x67c6b8]
and eax, esi
mov esi, dword [ecx + eax*8]
cmp esi, dword [0x67c6b0]
jne 0x48c9fb
mov dword [ecx + eax*8], edi
jmp 0x48ca0a
cmp esi, edx
jne 0x48ca04
mov dword [ecx + eax*8], edi
jmp 0x48ca0e
cmp dword [ecx + eax*8 + 4], ebx
jne 0x48ca0e
mov dword [ecx + eax*8 + 4], edi
mov eax, dword [ebp + 8]
mov dword [eax], edi
mov byte [eax + 4], 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
push str.unordered_map_set_too_long
call fcn.004eb99c
int3
Function at 0x4906d0
Capabilities:
Connect to wmi namespace via wbemlocator

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5ec1fc
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push esi
push edi
mov eax, dword [0x670440]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
cmp dword [ebx + 8], 0
lea esi, [ebx + 8]
jne 0x4907b5
mov eax, dword fs:[0x2c]
mov edx, dword [eax]
mov eax, dword [0x67c6f4]
cmp eax, dword [edx + 4]
jle 0x490746
push 0x67c6f4
call fcn.00502dcc
add esp, 4
cmp dword [0x67c6f4], 0xffffffff
jne 0x490746
push 0x67c6f4
mov byte [0x67c6f0], 0
call fcn.00502d7b
add esp, 4
cmp byte [0x67c6f0], 0
jne 0x490780
push 0
push 0
push 0
push 3
push 0
push 0
push 0
push 0xffffffffffffffff
push 0
mov byte [0x67c6f0], 1
call dword [sym.imp.ole32.dll_CoInitializeSecurity]
test eax, eax
jns 0x490780
push eax
push str.Failed_to_initialize_security._Error_code__0x_0x
call fcn.0044afd0
add esp, 8
mov eax, dword [ebx]
mov ecx, ebx
call dword [eax + 4]
push esi
push 0x653914
push 1
push 0
push 0x653924
call dword [sym.imp.ole32.dll_CoCreateInstance]
mov edi, eax
test edi, edi
jns 0x4907b5
push edi
push str.Failed_to_create_IWbemLocator_object._Error_code__0x_0x
call fcn.0044afd0
lea esi, [ebx + 0x38]
jmp 0x4908c1
mov edi, dword [esi]
lea ecx, [ebx + 0x38]
mov eax, dword [edi]
mov eax, dword [eax + 0xc]
mov dword [ebp - 0x14], eax
mov eax, dword [ebx + 0x38]
call dword [eax + 4]
lea eax, [ebx + 0x40]
push 0xc
mov dword [ebp - 0x10], eax
call fcn.00502e30
mov esi, eax
add esp, 4
mov dword [ebp - 0x18], esi
mov dword [ebp - 4], 0
test esi, esi
je 0x490804
push str.ROOTCIMV2
mov dword [esi + 4], 0
mov dword [esi + 8], 1
call fcn.005045e0
mov dword [esi], eax
jmp 0x490806
xor esi, esi
mov dword [ebp - 4], 0xffffffff
mov dword [ebp - 0x18], esi
test esi, esi
je 0x4908e8
push dword [ebp - 0x10]
mov dword [ebp - 4], 1
push 0
push 0
push 0
push 0
push 0
push 0
push dword [esi]
push edi
call dword [ebp - 0x14]
mov edi, eax
mov dword [ebp - 4], 0xffffffff
or eax, 0xffffffff
lock xadd dword [esi + 8], eax
dec eax
jne 0x49087d
mov eax, dword [esi]
test eax, eax
je 0x49085b
push eax
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
mov dword [esi], 0
mov eax, dword [esi + 4]
test eax, eax
je 0x490872
push eax
call fcn.005030e2
add esp, 4
mov dword [esi + 4], 0
push 0xc
push esi
call fcn.005030b1
add esp, 8
lea esi, [ebx + 0x38]
test edi, edi
jns 0x490899
push edi
push str.ROOTCIMV2
push str.Could_not_connect_to__s._Error_code__0x_0x
call fcn.0044afd0
add esp, 0xc
jmp 0x4908c4
push 0
push 0
push 3
push 3
push 0
push 0
push 0xa
push dword [ebx + 0x40]
call dword [sym.imp.ole32.dll_CoSetProxyBlanket]
mov edi, eax
test edi, edi
jns 0x4908d2
push edi
push str.Could_not_set_proxy_blanket._Error_code__0x_0x
call fcn.0044afd0
add esp, 8
mov eax, dword [ebx]
mov ecx, ebx
call dword [eax + 4]
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 4]
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
push 0x8007000e
call fcn.005044a0
int3
Function at 0x49a650
Capabilities:
Encode data using xor
Hash data using djb2

Disassembly:
push esi
mov esi, dword [esp + 8]
test esi, esi
je 0x49a6ff
push esi
call fcn.004adcb0
add esp, 4
test al, al
jne 0x49a6ff
push ebx
push edi
mov edi, esi
xor ebx, ebx
lea ecx, [edi + 1]
mov al, byte [edi]
inc edi
test al, al
jne 0x49a677
sub edi, ecx
push edi
push 0x2e
push esi
call fcn.004b9db0
add esp, 0xc
test eax, eax
je 0x49a6ab
sub eax, esi
push eax
push 0x2e
push esi
call fcn.004b9db0
mov ebx, eax
add esp, 0xc
test ebx, ebx
je 0x49a6ad
inc ebx
mov ecx, esi
sub ecx, ebx
add edi, ecx
test ebx, ebx
cmovne esi, ebx
lea ebx, [esi + edi]
mov edi, 0x1505
cmp esi, ebx
jae 0x49a6de
nop dword [eax]
mov al, byte [esi]
push eax
call fcn.004aa2f0
movsx ecx, al
inc esi
mov eax, edi
add esp, 4
shl eax, 5
add eax, edi
xor ecx, eax
mov edi, ecx
cmp esi, ebx
jb 0x49a6c0
mov eax, 0x4104105
mov esi, edi
mul edi
sub esi, edx
shr esi, 1
add esi, edx
shr esi, 5
mov ecx, esi
shl ecx, 6
sub ecx, esi
sub edi, ecx
mov eax, edi
pop edi
pop ebx
pop esi
ret
xor eax, eax
pop esi
ret