joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100b95e0
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [ebp + 8]
mov ecx, eax
push ebx
mov ebx, dword [ebp + 0xc]
and eax, 0x3f
push esi
sar ecx, 6
push edi
imul edi, eax, 0x38
mov dword [ebp - 8], ecx
mov eax, dword [ecx*4 + 0x102b9408]
push 0xa
pop edx
mov dword [ebp - 0x18], edx
mov ecx, dword [eax + edi + 0x18]
mov dword [ebp - 0x1c], ecx
mov ecx, dword [ebp + 0x10]
test ecx, ecx
je 0x100b9626
cmp word [ebx], dx
jne 0x100b9626
or byte [eax + edi + 0x28], 4
jmp 0x100b962b
and byte [eax + edi + 0x28], 0xfb
lea edx, [ebx + ecx*2]
mov eax, ebx
mov dword [ebp - 0xc], edx
mov esi, ebx
mov dword [ebp - 4], eax
cmp ebx, edx
jae 0x100b978e
mov dword [ebp - 0x10], 0xd
movzx ecx, word [eax]
mov edx, ecx
mov dword [ebp - 0x14], edx
mov edx, dword [ebp - 0xc]
cmp ecx, 0x1a
je 0x100b976e
add eax, 2
cmp cx, word [ebp - 0x10]
je 0x100b966c
mov dword [ebp - 4], eax
mov word [esi], cx
jmp 0x100b96a2
cmp eax, edx
jae 0x100b96b0
movzx eax, word [eax]
xor ecx, ecx
cmp ax, word [ebp - 0x18]
mov edx, eax
push 0xa
sete cl
xor eax, eax
lea ecx, [ecx*2 + 2]
add dword [ebp - 4], ecx
pop ecx
cmp dx, cx
mov edx, dword [ebp - 0xc]
sete al
dec eax
and eax, 3
add eax, ecx
mov word [esi], ax
mov eax, dword [ebp - 4]
push 2
pop ecx
add esi, ecx
cmp eax, edx
jb 0x100b9647
jmp 0x100b978e
push 0
lea eax, [ebp - 0x18]
push eax
push 2
lea eax, [ebp - 4]
push eax
push dword [ebp - 0x1c]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x100b9769
cmp dword [ebp - 0x18], 0
je 0x100b9769
mov edx, dword [ebp - 8]
push 0xa
mov eax, dword [edx*4 + 0x102b9408]
test byte [eax + edi + 0x28], 0x48
je 0x100b973f
lea eax, [esi + 2]
mov dword [ebp - 0x1c], eax
mov ax, word [ebp - 4]
pop ecx
mov word [ebp - 2], ax
cmp ax, cx
jne 0x100b9703
mov word [esi], cx
jmp 0x100b973a
push 0xd
pop ecx
mov word [esi], cx
movzx ecx, ax
mov eax, dword [edx*4 + 0x102b9408]
mov dx, word [ebp - 2]
shr ecx, 8
push 0xa
mov byte [eax + edi + 0x2a], dl
mov edx, dword [ebp - 8]
mov eax, dword [edx*4 + 0x102b9408]
mov byte [eax + edi + 0x2b], cl
mov eax, dword [edx*4 + 0x102b9408]
pop ecx
mov byte [eax + edi + 0x2c], cl
mov esi, dword [ebp - 0x1c]
jmp 0x100b978e
pop eax
cmp word [ebp - 4], ax
jne 0x100b974f
cmp esi, ebx
jne 0x100b974f
mov word [esi], ax
jmp 0x100b978b
push 1
push 0xffffffffffffffff
push 0xfffffffffffffffe
push dword [ebp + 8]
call fcn.100ba1b3
add esp, 0x10
push 0xa
pop eax
cmp word [ebp - 4], ax
je 0x100b978e
push 0xd
pop eax
jmp 0x100b974a
mov edx, dword [ebp - 8]
mov edx, dword [edx*4 + 0x102b9408]
mov al, byte [edx + edi + 0x28]
test al, 0x40
jne 0x100b9788
or al, 2
mov byte [edx + edi + 0x28], al
jmp 0x100b978e
mov word [esi], cx
add esi, 2
sub esi, ebx
and esi, 0xfffffffe
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret
Function at 0x100ba7a4
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x1013ef18
push 0x1013ef10
push str.FlsAlloc
push 0x1f
call fcn.100ba60f
mov esi, eax
add esp, 0x10
test esi, esi
je 0x100ba7d8
push dword [ebp + 8]
mov ecx, esi
call dword [0x100ce2dc]
call esi
jmp 0x100ba7de
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
pop esi
pop ebp
ret 4

Function at 0x100ba822
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x1013ef28
push 0x1013ef20
push str.FlsGetValue
push 0x21
call fcn.100ba60f
mov esi, eax
add esp, 0x10
test esi, esi
je 0x100ba859
push dword [ebp + 8]
mov ecx, esi
call dword [0x100ce2dc]
call esi
pop esi
pop ebp
ret 4
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsGetValue]

Function at 0x100ba861
Capabilities:
Set thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x1013ef30
push 0x1013ef28
push str.FlsSetValue
push 0x22
call fcn.100ba60f
mov esi, eax
add esp, 0x10
test esi, esi
je 0x100ba89b
push dword [ebp + 0xc]
mov ecx, esi
push dword [ebp + 8]
call dword [0x100ce2dc]
call esi
pop esi
pop ebp
ret 8
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsSetValue]
Function at 0x100bf2d8
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
je 0x100bf375
push ebx
push esi
call fcn.100bf2a1
xor ebx, ebx
sub eax, esi
push ebx
push ebx
push ebx
push ebx
sar eax, 1
push eax
push esi
push ebx
push ebx
mov dword [ebp - 8], eax
call fcn.100be0e7
add esp, 0x24
mov dword [ebp - 4], eax
test eax, eax
jne 0x100bf322
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x100bf374
push edi
push eax
call fcn.100b73c3
mov edi, eax
pop ecx
push ebx
test edi, edi
jne 0x100bf342
call fcn.100b7389
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x100bf373
push ebx
push dword [ebp - 4]
push edi
push dword [ebp - 8]
push esi
push ebx
push ebx
call fcn.100be0e7
add esp, 0x20
test eax, eax
jne 0x100bf361
push edi
call fcn.100b7389
jmp 0x100bf369
push ebx
call fcn.100b7389
mov ebx, edi
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, ebx
pop edi
pop ebx
pop esi
leave
ret

Function at 0x100bf378
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
jne 0x100bf389
pop esi
ret
push ebx
push edi
push esi
call fcn.100bf2a1
mov ebx, eax
sub ebx, esi
and ebx, 0xfffffffe
push ebx
call fcn.100b73c3
mov edi, eax
pop ecx
pop ecx
test edi, edi
je 0x100bf3b1
push ebx
push esi
push edi
call fcn.100a0150
add esp, 0xc
push 0
call fcn.100b7389
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, edi
pop edi
pop ebx
pop esi
ret

Function at 0x100bfb0b
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.100bf626

Function at 0x100c1d21
Capabilities:
Get geographical location

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push esi
push edi
call fcn.100b4b55
mov esi, dword [ebp + 8]
mov edi, eax
push 2
lea eax, [ebp - 4]
mov ecx, esi
push eax
and ecx, 0x3ff
push 0x20000001
or ecx, 0x400
push ecx
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x100c1d90
cmp esi, dword [ebp - 4]
je 0x100c1d8b
cmp dword [ebp + 0xc], 0
je 0x100c1d8b
mov esi, dword [edi + 0x50]
lea ecx, [esi + 2]
mov ax, word [esi]
add esi, 2
test ax, ax
jne 0x100c1d68
push dword [edi + 0x50]
sub esi, ecx
sar esi, 1
call fcn.100c1873
pop ecx
xor ecx, ecx
cmp eax, esi
setne cl
mov eax, ecx
jmp 0x100c1d92
xor eax, eax
inc eax
jmp 0x100c1d92
xor eax, eax
pop edi
pop esi
leave
ret
Function at 0x100c1df7
Capabilities:
Get geographical location

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [0x102afb00]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push ebx
mov ebx, dword [ebp + 0x10]
push esi
mov esi, dword [ebp + 8]
push edi
mov dword [ebp - 0x18], eax
call fcn.100b4b55
add eax, 0x50
lea edi, [ebp - 0x10]
mov dword [ebp - 0x14], eax
xor eax, eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
call fcn.100b4b55
lea ecx, [ebp - 0x10]
xor edx, edx
mov dword [eax + 0x34c], ecx
lea ecx, [esi + 0x80]
mov eax, dword [ebp - 0x14]
mov dword [eax], esi
lea edi, [eax + 4]
mov dword [edi], ecx
test ecx, ecx
je 0x100c1e6e
cmp word [ecx], dx
je 0x100c1e6e
mov eax, dword [0x1013f414]
push edi
dec eax
push eax
push 0x1013f300
call fcn.100c1d96
mov eax, dword [ebp - 0x14]
add esp, 0xc
xor edx, edx
mov dword [ebp - 0x10], edx
mov eax, dword [eax]
test eax, eax
je 0x100c1ee1
cmp word [eax], dx
je 0x100c1ee1
mov eax, dword [edi]
test eax, eax
je 0x100c1e92
cmp word [eax], dx
je 0x100c1e92
lea eax, [ebp - 0x10]
push eax
call fcn.100c1779
jmp 0x100c1e9b
lea eax, [ebp - 0x10]
push eax
call fcn.100c1814
cmp dword [ebp - 0x10], 0
pop ecx
jne 0x100c1f0b
mov eax, dword [0x1013f2fc]
push dword [ebp - 0x14]
dec eax
push eax
push 0x1013eff0
call fcn.100c1d96
add esp, 0xc
test al, al
je 0x100c1f0b
mov eax, dword [edi]
xor edi, edi
test eax, eax
je 0x100c1ed6
cmp word [eax], di
je 0x100c1ed6
lea eax, [ebp - 0x10]
push eax
call fcn.100c1779
pop ecx
jmp 0x100c1f0d
lea eax, [ebp - 0x10]
push eax
call fcn.100c1814
jmp 0x100c1ed3
mov eax, dword [edi]
test eax, eax
je 0x100c1ef8
cmp word [eax], dx
je 0x100c1ef8
lea eax, [ebp - 0x10]
push eax
call fcn.100c172e
pop ecx
jmp 0x100c1f0b
mov dword [ebp - 0x10], 0x104
call dword [sym.imp.KERNEL32.dll_GetUserDefaultLCID]
mov dword [ebp - 8], eax
mov dword [ebp - 0xc], eax
xor edi, edi
cmp dword [ebp - 0x10], 0
je 0x100c1fd6
lea eax, [ebp - 0x10]
push eax
lea eax, [esi + 0x100]
neg esi
sbb esi, esi
and esi, eax
push esi
call fcn.100c1c1b
mov esi, eax
pop ecx
pop ecx
test esi, esi
je 0x100c1fd6
movzx ecx, si
push ecx
call dword [sym.imp.KERNEL32.dll_IsValidCodePage]
test eax, eax
je 0x100c1fd6
push 1
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_IsValidLocale]
test eax, eax
je 0x100c1fd6
mov eax, dword [ebp - 0x18]
test eax, eax
je 0x100c1f63
mov dword [eax], esi
mov eax, dword [ebp - 0x14]
push edi
push 0x55
add eax, 0x250
push eax
push dword [ebp - 0xc]
call fcn.100ba9a1
test ebx, ebx
je 0x100c1fd1
push edi
push 0x55
lea eax, [ebx + 0x120]
push eax
push dword [ebp - 0xc]
call fcn.100ba9a1
push 0x40
push ebx
push 0x1001
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x100c1fd6
push 0x40
lea eax, [ebx + 0x80]
push eax
push 0x1002
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x100c1fd6
push 0xa
push 0x10
lea ecx, [ebx + 0x100]
push ecx
push esi
call fcn.100c7a19
add esp, 0x10
xor eax, eax
inc eax
jmp 0x100c1fd8
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1009f2f8
leave
ret
Function at 0x100c8131
Capabilities:
Clear file content

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x2c
push ebx
mov ebx, dword [ebp + 8]
lea ecx, [ebp - 0x2c]
push esi
push edi
push dword [ebp + 0x10]
mov edi, dword [ebp + 0x14]
push dword [ebp + 0xc]
push ebx
call fcn.100c80ad
mov eax, dword [ebp - 0x2c]
and eax, dword [ebp - 0x28]
cmp eax, 0xffffffff
je 0x100c82a0
mov eax, dword [ebp - 0x24]
and eax, dword [ebp - 0x20]
cmp eax, 0xffffffff
je 0x100c82a0
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 8], ecx
mov dword [ebp - 4], eax
test ecx, ecx
jl 0x100c8255
jg 0x100c818d
test eax, eax
je 0x100c824b
push 1
push 0x1000
call fcn.100ba30d
mov esi, eax
pop ecx
pop ecx
test esi, esi
jne 0x100c81b0
push 0xc
pop ebx
mov byte [edi + 0x1c], 1
mov dword [edi + 0x18], ebx
jmp 0x100c8242
push 0x8000
push ebx
call fcn.100c7fde
pop ecx
pop ecx
mov ecx, dword [ebp - 0x1c]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0x18]
test eax, eax
jl 0x100c81d9
jg 0x100c81d4
cmp ecx, 0x1000
jb 0x100c81d9
mov ecx, 0x1000
push edi
push ecx
push esi
push ebx
call fcn.100bb5ae
add esp, 0x10
cmp eax, 0xffffffff
je 0x100c821e
mov ecx, dword [ebp - 4]
cdq
sub ecx, eax
mov eax, dword [ebp - 8]
mov dword [ebp - 4], ecx
sbb eax, edx
mov dword [ebp - 8], eax
test eax, eax
jg 0x100c81d4
jl 0x100c8205
test ecx, ecx
jne 0x100c81c6
push dword [ebp - 0xc]
push ebx
call fcn.100c7fde
push esi
call fcn.100b7389
add esp, 0xc
xor ebx, ebx
jmp 0x100c82ae
cmp byte [edi + 0x24], 0
je 0x100c8235
cmp dword [edi + 0x20], 5
jne 0x100c8235
mov byte [edi + 0x1c], 1
mov dword [edi + 0x18], 0xd
cmp byte [edi + 0x1c], 0
je 0x100c8240
mov ebx, dword [edi + 0x18]
jmp 0x100c8242
xor ebx, ebx
push esi
call fcn.100b7389
pop ecx
jmp 0x100c82ae
test ecx, ecx
jg 0x100c8217
jl 0x100c8255
test eax, eax
jae 0x100c8217
push 0
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push ebx
call fcn.100ba1b3
and eax, edx
add esp, 0x10
cmp eax, 0xffffffff
jne 0x100c8275
cmp byte [edi + 0x1c], 0
je 0x100c8217
jmp 0x100c82a6
push ebx
call fcn.100c601a
pop ecx
push eax
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
test eax, eax
jne 0x100c8217
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 0xd
mov byte [edi + 0x24], 1
mov dword [edi + 0x20], eax
pop ebx
mov byte [edi + 0x1c], 1
mov dword [edi + 0x18], ebx
jmp 0x100c82ae
cmp byte [edi + 0x1c], 0
je 0x100c82ab
mov ebx, dword [edi + 0x18]
jmp 0x100c82ae
push 0x16
pop ebx
push 0
push dword [ebp - 0x28]
push dword [ebp - 0x2c]
push dword [ebp - 0x14]
call fcn.100ba1b3
add esp, 0x10
mov eax, ebx
pop edi
pop esi
pop ebx
leave
ret

Function at 0x100c8d00
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x100c8d2d
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x100c8d2d
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret
Function at 0x4016d0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x43ec6c
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push ebx
push esi
push edi
mov eax, dword [0x4540fc]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov dword [ebp - 0x18], ebx
lea esi, [ebx + 4]
mov dword [ebx], vtable.FastObserver::EventListener.0
mov dword [ebp - 0x14], esi
mov dword [esi], 0
push 0x14
mov dword [esi + 4], 0
mov dword [esi + 8], 0
call fcn.00421549
add esp, 4
mov dword [eax], eax
mov dword [eax + 4], eax
mov dword [esi + 4], eax
lea ecx, [esi + 0xc]
mov dword [ebp - 4], 0
mov dword [ecx], 0
mov dword [ecx + 4], 0
mov dword [ecx + 8], 0
mov byte [ebp - 4], 1
push dword [esi + 4]
mov dword [esi + 0x18], 7
push 0x10
mov dword [esi + 0x1c], 8
mov dword [esi], 0x3f800000
call fcn.00402270
lea esi, [ebx + 0x24]
mov dword [ebp - 4], 2
xorps xmm0, xmm0
movq qword [esi], xmm0
mov dword [esi], 0
mov byte [esi + 4], 0
lea eax, [ebx + 0x2c]
mov byte [eax], 0
mov dword [ebp - 0x14], eax
lea eax, [ebx + 0x30]
push 2
push eax
call fcn.0041f700
lea eax, [ebp - 0x10]
mov byte [ebp - 4], 4
push eax
lea ecx, [ebp - 0x20]
mov dword [ebp - 0x10], ebx
call fcn.00402370
mov ebx, eax
add esp, 0xc
or edi, 0xffffffff
cmp esi, ebx
je 0x4017f0
mov ecx, dword [esi]
test ecx, ecx
je 0x4017e0
mov eax, edi
lock xadd dword [ecx + 4], eax
jne 0x4017e0
mov edx, dword [ecx + 0x78]
test edx, edx
je 0x4017da
mov eax, dword [edx]
push ecx
mov ecx, edx
jmp 0x4017de
mov eax, dword [ecx]
push 1
call dword [eax]
mov eax, dword [ebx]
mov dword [ebx], 0
mov dword [esi], eax
mov al, byte [ebx + 4]
mov byte [esi + 4], al
mov ecx, dword [ebp - 0x20]
test ecx, ecx
je 0x401813
lock xadd dword [ecx + 4], edi
dec edi
jne 0x401813
mov edx, dword [ecx + 0x78]
test edx, edx
je 0x40180d
mov eax, dword [edx]
push ecx
mov ecx, edx
jmp 0x401811
mov eax, dword [ecx]
push 1
call dword [eax]
mov eax, dword [esi]
test eax, eax
je 0x401829
cmp byte [esi + 4], 0
je 0x401825
cmp byte [eax + 0x6c], 0
jne 0x401829
mov al, 1
jmp 0x40182b
xor al, al
mov ecx, dword [ebp - 0x14]
xchg byte [ecx], al
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x401cf0
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x43ecfd
mov eax, dword fs:[0]
push eax
sub esp, 0x18
push ebx
push esi
push edi
mov eax, dword [0x4540fc]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
lea esi, [edi + 0x30]
push esi
mov dword [ebp - 0x18], esi
call fcn.0041f720
add esp, 4
test eax, eax
jne 0x401e50
mov eax, dword [esi + 0x2c]
cmp eax, 0x7fffffff
je 0x401e57
mov ebx, dword [ebp + 8]
mov ecx, ebx
mov dword [ebp - 4], 0
mov eax, dword [ebx]
call dword [eax + 8]
mov edx, eax
mov eax, dword [edi + 8]
mov dword [ebp - 0x14], eax
mov eax, edx
shr eax, 8
movzx ecx, dl
xor ecx, 0x811c9dc5
movzx eax, al
imul ecx, ecx, 0x1000193
mov dword [ebp - 0x10], edx
xor ecx, eax
mov eax, edx
shr eax, 0x10
imul ecx, ecx, 0x1000193
movzx eax, al
shr edx, 0x18
xor ecx, eax
imul eax, ecx, 0x1000193
lea ecx, [edi + 4]
xor eax, edx
imul eax, eax, 0x1000193
push eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x20]
push eax
call fcn.00402610
mov eax, dword [eax + 4]
test eax, eax
jne 0x401db0
mov eax, dword [edi + 8]
cmp eax, dword [ebp - 0x14]
je 0x401e33
mov eax, dword [ebx]
mov ecx, ebx
call dword [eax + 8]
mov dword [ebp - 0x14], eax
lea ecx, [edi + 4]
lea eax, [ebp - 0x14]
push eax
call fcn.004021d0
xor edx, edx
mov dword [ebp - 0x24], eax
lea ecx, [ebp - 0x20]
mov dword [ebp - 0x20], edx
mov dword [ebp - 0x1c], ecx
mov ebx, dword [eax]
mov ecx, dword [ebx]
cmp ecx, ebx
je 0x401e15
mov edx, dword [ebp + 8]
mov edi, dword [ecx]
cmp dword [ecx + 8], edx
jne 0x401e0c
dec dword [eax + 4]
mov edx, dword [ecx]
mov dword [ecx], 0
mov eax, dword [ecx + 4]
mov dword [eax], edx
mov dword [edx + 4], eax
mov eax, dword [ebp - 0x1c]
mov edx, dword [ebp + 8]
mov dword [eax], ecx
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x1c], ecx
mov ecx, edi
cmp edi, ebx
jne 0x401de4
mov edx, dword [ebp - 0x20]
test edx, edx
je 0x401e33
nop dword [eax]
mov edi, dword [edx]
push 0xc
push edx
call fcn.00421518
add esp, 8
mov edx, edi
test edi, edi
jne 0x401e20
push esi
call fcn.0041f745
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
push 5
call fcn.004202d4
dec eax
push 6
mov dword [esi + 0x2c], eax
call fcn.004202d4
int3
Function at 0x401e70
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 8]
sub esp, 8
movzx eax, dl
xor eax, 0x811c9dc5
push esi
mov esi, dword [ecx + 8]
push edi
lea edi, [ecx + 4]
imul ecx, eax, 0x1000193
mov eax, edx
sar eax, 8
movzx eax, al
xor ecx, eax
mov eax, edx
imul ecx, ecx, 0x1000193
sar eax, 0x10
movzx eax, al
sar edx, 0x18
xor ecx, eax
movzx eax, dl
imul ecx, ecx, 0x1000193
xor ecx, eax
imul eax, ecx, 0x1000193
mov ecx, edi
push eax
lea eax, [ebp + 8]
push eax
lea eax, [ebp - 8]
push eax
call fcn.00402610
mov eax, dword [eax + 4]
test eax, eax
jne 0x401ed7
mov eax, dword [edi + 4]
cmp eax, esi
je 0x401f19
lea eax, [ebp + 8]
mov ecx, edi
push eax
call fcn.00402150
mov ecx, edi
mov esi, dword [eax]
lea eax, [ebp + 8]
push eax
mov esi, dword [esi]
call fcn.00402150
cmp esi, dword [eax]
je 0x401f19
nop dword [eax]
mov ecx, dword [esi + 8]
mov eax, dword [ecx]
call dword [eax + 4]
mov esi, dword [esi]
lea eax, [ebp + 8]
push eax
mov ecx, edi
call fcn.00402150
cmp esi, dword [eax]
jne 0x401f00
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4

Function at 0x402150
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, ecx
movzx eax, byte [edi]
xor eax, 0x811c9dc5
imul edx, eax, 0x1000193
movzx eax, byte [edi + 1]
xor edx, eax
movzx eax, byte [edi + 2]
imul edx, edx, 0x1000193
xor edx, eax
movzx eax, byte [edi + 3]
imul ecx, edx, 0x1000193
xor ecx, eax
imul eax, ecx, 0x1000193
mov ecx, dword [esi + 0x18]
and ecx, eax
mov eax, dword [esi + 0xc]
lea edx, [eax + ecx*8]
mov eax, dword [edx + 4]
cmp eax, dword [esi + 4]
je 0x4021c3
mov ecx, dword [edi]
mov edx, dword [edx]
pop edi
pop esi
cmp ecx, dword [eax + 8]
je 0x4021bc
nop word [eax + eax]
cmp eax, edx
je 0x4021c3
mov eax, dword [eax + 4]
cmp ecx, dword [eax + 8]
jne 0x4021b0
add eax, 0xc
pop ebp
ret 4
push str.invalid_unordered_map_K__T__key
call fcn.0041f2cc
int3
Function at 0x402a00
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov edx, dword [ebp + 8]
mov eax, 0x1fffffff
push ebx
mov ebx, ecx
bsr ecx, eax
push esi
push edi
mov edi, 1
mov dword [ebp - 4], ebx
mov eax, edi
shl eax, cl
cmp edx, eax
ja 0x402b5a
mov esi, dword [ebx + 4]
lea eax, [edx - 1]
or eax, edi
mov dword [ebp + 8], esi
bsr ecx, eax
push esi
lea ecx, [ecx + 1]
shl edi, cl
lea ecx, [ebx + 0xc]
lea eax, [edi + edi]
push eax
call fcn.00402270
lea eax, [edi - 1]
mov dword [ebx + 0x1c], edi
mov dword [ebx + 0x18], eax
mov eax, dword [ebx + 4]
mov eax, dword [eax]
mov ecx, eax
cmp eax, esi
je 0x402b2d
movzx edx, byte [eax + 8]
xor edx, 0x811c9dc5
mov ecx, dword [ecx]
imul edi, edx, 0x1000193
movzx edx, byte [eax + 9]
xor edi, edx
movzx edx, byte [eax + 0xa]
imul edi, edi, 0x1000193
xor edi, edx
movzx edx, byte [eax + 0xb]
imul edi, edi, 0x1000193
xor edi, edx
imul edx, edi, 0x1000193
mov edi, dword [ebx + 0x18]
and edi, edx
mov edx, dword [ebx + 0xc]
lea edx, [edx + edi*8]
mov edi, dword [edx]
mov dword [ebp - 8], edx
cmp edi, esi
jne 0x402ab3
mov dword [edx], eax
mov dword [edx + 4], eax
jmp 0x402b23
mov edx, dword [edx + 4]
mov ebx, dword [eax + 8]
cmp ebx, dword [edx + 8]
jne 0x402aed
mov edx, dword [edx]
mov dword [ebp - 0xc], edx
cmp edx, eax
je 0x402ae5
mov ebx, dword [eax + 4]
mov esi, dword [ebp - 0xc]
mov dword [ebx], ecx
mov edi, dword [ecx + 4]
mov dword [edi], edx
mov edx, dword [edx + 4]
mov dword [edx], eax
mov dword [esi + 4], edi
mov esi, dword [ebp + 8]
mov dword [ecx + 4], ebx
mov dword [eax + 4], edx
mov edx, dword [ebp - 8]
mov dword [edx + 4], eax
jmp 0x402b20
cmp edi, edx
je 0x402afd
mov edx, dword [edx + 4]
cmp ebx, dword [edx + 8]
je 0x402b36
cmp edi, edx
jne 0x402af1
mov ebx, dword [eax + 4]
mov dword [ebp - 0xc], ebx
mov dword [ebx], ecx
mov ebx, dword [ecx + 4]
mov dword [ebx], edx
mov edi, dword [edx + 4]
mov dword [edi], eax
mov dword [edx + 4], ebx
mov edx, dword [ebp - 0xc]
mov dword [ecx + 4], edx
mov edx, dword [ebp - 8]
mov dword [eax + 4], edi
mov dword [edx], eax
mov ebx, dword [ebp - 4]
mov eax, ecx
cmp ecx, esi
jne 0x402a62
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
mov ebx, dword [eax + 4]
mov edx, dword [edx]
mov dword [ebp - 0xc], edx
mov esi, edx
mov dword [ebx], ecx
mov edi, dword [ecx + 4]
mov dword [edi], edx
mov edx, dword [edx + 4]
mov dword [edx], eax
mov dword [esi + 4], edi
mov esi, dword [ebp + 8]
mov dword [ecx + 4], ebx
mov dword [eax + 4], edx
jmp 0x402b20
push str.invalid_hash_bucket_count
call fcn.0041f2ac
int3
Function at 0x407550
Capabilities:
Initialize winhttp library

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x43f791
mov eax, dword fs:[0]
push eax
sub esp, 8
push esi
mov eax, dword [0x4540fc]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push 8
mov dword [ebp - 0x10], 0x457f68
mov dword [0x457f68], 0
mov dword [0x457f6c], 0
mov dword [0x457f70], 0
mov dword [0x457f74], 0
mov dword [0x457f78], 0
call fcn.00421549
mov dword [eax + 4], 0
mov dword [0x457f68], eax
mov dword [eax], 0x457f68
push 2
push 0x457f7c
mov dword [ebp - 4], 0
call fcn.0041f700
add esp, 0xc
xorps xmm0, xmm0
movq qword [0x457fac], xmm0
mov dword [0x457fac], 0
mov byte [0x457fb0], 0
mov byte [ebp - 4], 2
mov eax, dword [ebp + 8]
mov byte [0x457fb4], 0
mov dword [0x457fb8], 0
mov ecx, dword [eax]
sub ecx, 0x10
call fcn.00407e40
add eax, 0x10
mov dword [0x457fbc], eax
mov eax, dword [ebp + 0xc]
mov byte [ebp - 4], 3
mov ecx, dword [eax]
sub ecx, 0x10
call fcn.00407e40
add eax, 0x10
mov dword [0x457fc0], eax
mov byte [ebp - 4], 4
call fcn.00409200
mov ecx, eax
test ecx, ecx
je 0x4076ed
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp + 8], eax
push str.WinHTTP_1.0
lea ecx, [ebp + 8]
mov byte [ebp - 4], 5
call fcn.00407d80
test al, al
jne 0x40767f
push 0xb
push str.WinHTTP_1.0
lea ecx, [ebp + 8]
call fcn.00407f30
push 0
push 0
push 0
mov byte [ebp - 4], 4
mov esi, dword [ebp + 8]
push 0
push esi
call dword [sym.imp.WINHTTP.dll_WinHttpOpen]
mov dword [0x457fb8], eax
test eax, eax
je 0x4076b9
push 0x2710
push 0x2710
push 0x2710
push 0x2710
push eax
call dword [sym.imp.WINHTTP.dll_WinHttpSetTimeouts]
add esi, 0xfffffff0
or eax, 0xffffffff
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x4076d1
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
call fcn.00407710
mov eax, 0x457f68
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret 8
push 0x80004005
call fcn.00408fe0
int3