joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4030f0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4c02db
mov eax, dword fs:[0]
push eax
sub esp, 0x80
mov eax, dword [0x50d024]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [0x50e524]
mov esi, 0x50e514
cmp dword [0x50e528], 8
mov edx, 0x811c9dc5
mov ebx, dword [ebp + 8]
cmovae esi, dword [0x50e514]
xor ecx, ecx
lea edi, [eax + eax]
test edi, edi
je 0x403158
movzx eax, byte [ecx + esi]
inc ecx
xor eax, edx
imul edx, eax, 0x1000193
cmp ecx, edi
jb 0x403147
push edx
push 0x50e514
lea eax, [ebp - 0x8c]
mov ecx, 0x511900
push eax
call fcn.00407890
mov edi, dword [0x511904]
mov eax, dword [eax + 4]
test eax, eax
cmovne edi, eax
cmp edi, dword [0x511904]
je 0x40318a
mov edi, dword [edi + 0x20]
jmp 0x40318c
xor edi, edi
mov eax, dword [edi]
mov ecx, edi
mov eax, dword [eax + 0x28]
call eax
test al, al
jne 0x4032b5
push 0x2d
xor eax, eax
mov dword [ebp - 0x28], 0
mov dword [ebp - 0x18], 0
lea ecx, [ebp - 0x28]
mov dword [ebp - 0x14], 0
push str.SoftwareCaphyonAdvanced_InstallerSettings_
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 7
mov word [ebp - 0x28], ax
call fcn.00409630
mov dword [ebp - 4], 0
lea eax, [ebp - 0x28]
push ecx
push 1
push ecx
push eax
lea ecx, [ebp - 0x84]
call fcn.0046ea60
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x28]
call fcn.00409da0
lea eax, [ebp - 0x40]
mov ecx, ebx
push eax
call fcn.0046d480
mov esi, eax
mov byte [ebp - 4], 3
xor eax, eax
push 0xf
mov dword [ebp - 0x28], 0
lea ecx, [ebp - 0x28]
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0
push str.Repository_Path
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 7
mov word [ebp - 0x28], ax
call fcn.00409630
mov byte [ebp - 4], 4
lea eax, [ebp - 0x28]
push ecx
push esi
push eax
lea ecx, [ebp - 0x84]
call fcn.0046eca0
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x28]
call fcn.00409da0
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x40]
call fcn.00409da0
mov dword [ebp - 4], 6
lea ecx, [ebp - 0x60]
call fcn.00409da0
mov byte [ebp - 4], 5
lea ecx, [ebp - 0x78]
call fcn.00409da0
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x84]
test eax, eax
je 0x4032ae
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x84], 0
mov dword [ebp - 0x80], 0
lea eax, [ebp - 0x40]
mov ecx, ebx
push eax
call fcn.0046d480
mov esi, eax
mov dword [ebp - 4], 8
mov ecx, edi
mov edx, dword [edi]
call dword [edx + 0xc]
cmp dword [esi + 0x14], 8
mov edx, esi
jb 0x4032da
mov edx, dword [esi]
cmp dword [eax + 0x14], 8
mov ecx, dword [eax + 0x10]
jb 0x4032e5
mov eax, dword [eax]
cmp ecx, dword [esi + 0x10]
jne 0x4032f9
push ecx
mov ecx, eax
call fcn.004082f0
add esp, 4
test eax, eax
je 0x403301
mov eax, dword [edi]
mov ecx, edi
push esi
call dword [eax + 8]
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x40]
call fcn.00409da0
mov al, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00498bc4
mov esp, ebp
pop ebp
ret 4
Function at 0x407920
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4c1325
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push ebx
push esi
push edi
mov eax, dword [0x50d024]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov edx, dword [ebp + 0xc]
mov edi, edx
cmp dword [edx + 0x14], 8
mov eax, dword [edx + 0x10]
jb 0x40795a
mov edi, dword [edx]
xor ecx, ecx
mov esi, 0x811c9dc5
add eax, eax
je 0x40797b
mov edx, eax
movzx eax, byte [ecx + edi]
inc ecx
xor eax, esi
imul esi, eax, 0x1000193
cmp ecx, edx
jb 0x407967
mov edx, dword [ebp + 0xc]
push esi
push edx
lea eax, [ebp - 0x20]
mov ecx, ebx
push eax
call fcn.00407890
mov ecx, dword [ebp - 0x1c]
test ecx, ecx
je 0x4079ac
mov eax, dword [ebp + 8]
mov dword [eax], ecx
mov byte [eax + 4], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
cmp dword [ebx + 8], 0x71c71c7
je 0x407b09
lea eax, [ebx + 4]
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x18], eax
mov dword [ebp - 4], 0
push 0x24
mov dword [ebp - 0x14], 0
call fcn.0049905d
mov edi, eax
add esp, 4
mov dword [ebp - 0x14], edi
push dword [ebp + 0xc]
lea eax, [edi + 8]
mov ecx, eax
mov dword [ebp - 0x10], eax
call fcn.00406970
mov byte [ebp - 4], 2
mov eax, dword [ebp + 0xc]
mov ecx, dword [eax + 0x18]
mov dword [edi + 0x20], ecx
mov dword [ebp - 4], 3
mov eax, dword [ebx + 8]
inc eax
movss xmm3, dword [ebx]
movd xmm0, eax
cvtdq2pd xmm0, xmm0
shr eax, 0x1f
addsd xmm0, qword [eax*8 + 0x4f1a60]
mov eax, dword [ebx + 0x1c]
movd xmm1, eax
cvtdq2pd xmm1, xmm1
shr eax, 0x1f
cvtpd2ps xmm0, xmm0
addsd xmm1, qword [eax*8 + 0x4f1a60]
movaps xmm2, xmm0
cvtpd2ps xmm1, xmm1
divss xmm2, xmm1
comiss xmm2, xmm3
jbe 0x407a99
divss xmm0, xmm3
call fcn.00408690
call fcn.004c0030
mov ecx, 8
cmp eax, ecx
cmova ecx, eax
mov eax, dword [ebx + 0x1c]
cmp eax, ecx
jae 0x407a7d
cmp eax, 0x200
jae 0x407a7b
shl eax, 3
cmp eax, ecx
jae 0x407a7d
mov eax, ecx
push eax
mov ecx, ebx
call fcn.00408390
push esi
lea eax, [edi + 8]
mov ecx, ebx
push eax
lea eax, [ebp - 0x20]
push eax
call fcn.00407890
mov edx, dword [eax]
jmp 0x407a9c
mov edx, dword [ebp - 0x20]
mov eax, dword [ebx + 8]
mov ecx, dword [edx + 4]
inc eax
mov dword [ebx + 8], eax
mov dword [edi], edx
mov dword [edi + 4], ecx
mov dword [ecx], edi
mov dword [edx + 4], edi
mov eax, dword [ebx + 0x18]
mov dword [ebp + 0xc], ecx
and eax, esi
mov ecx, dword [ebx + 0xc]
mov dword [ebp - 0x14], 0
mov esi, dword [ecx + eax*8]
cmp esi, dword [ebx + 4]
jne 0x407acf
mov dword [ecx + eax*8], edi
jmp 0x407ae1
cmp esi, edx
jne 0x407ad8
mov dword [ecx + eax*8], edi
jmp 0x407ae5
mov edx, dword [ebp + 0xc]
cmp dword [ecx + eax*8 + 4], edx
jne 0x407ae5
mov dword [ecx + eax*8 + 4], edi
mov eax, dword [ebp + 8]
mov dword [eax], edi
mov byte [eax + 4], 1
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
push str.unordered_map_set_too_long
call fcn.004822a8
int3
Function at 0x4086d0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push esi
mov esi, dword [esp + 0x10]
xor ecx, ecx
test esi, esi
je 0x4086fa
mov edx, dword [esp + 8]
push edi
mov edi, dword [esp + 0x10]
movzx eax, byte [ecx + edi]
inc ecx
xor eax, edx
imul edx, eax, 0x1000193
cmp ecx, esi
jb 0x4086e4
pop edi
mov eax, edx
pop esi
ret
mov eax, dword [esp + 8]
pop esi
ret

Function at 0x408f50
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4c11e0
mov eax, dword fs:[0]
push eax
push ebx
push esi
push edi
mov eax, dword [0x50d024]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, edx
mov ebx, ecx
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x408fd5
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x408fd5
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [ebp + 8]
lea edx, [esi + eax]
and ecx, 0xf
jbe 0x408fb7
cmp esi, edx
jae 0x408fd5
movzx eax, word [esi]
lea esi, [esi + eax*2]
add esi, 2
sub ecx, 1
jne 0x408fa5
cmp esi, edx
jae 0x408fd5
cmp word [esi], 0
je 0x408fd5
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x419eb0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4c4ea5
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push ebx
push esi
push edi
mov eax, dword [0x50d024]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov edx, dword [ebp + 0xc]
mov edi, edx
cmp dword [edx + 0x14], 8
mov eax, dword [edx + 0x10]
jb 0x419eea
mov edi, dword [edx]
xor ecx, ecx
mov esi, 0x811c9dc5
add eax, eax
je 0x419f0b
mov edx, eax
movzx eax, byte [ecx + edi]
inc ecx
xor eax, esi
imul esi, eax, 0x1000193
cmp ecx, edx
jb 0x419ef7
mov edx, dword [ebp + 0xc]
push esi
push edx
lea eax, [ebp - 0x20]
mov ecx, ebx
push eax
call fcn.00407890
mov ecx, dword [ebp - 0x1c]
test ecx, ecx
je 0x419f3c
mov eax, dword [ebp + 8]
mov dword [eax], ecx
mov byte [eax + 4], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
cmp dword [ebx + 8], 0x5d1745d
je 0x41a0a6
lea eax, [ebx + 4]
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x18], eax
mov dword [ebp - 4], 0
push 0x2c
mov dword [ebp - 0x14], 0
call fcn.0049905d
mov edi, eax
add esp, 4
mov dword [ebp - 0x14], edi
push dword [ebp + 0xc]
lea eax, [edi + 8]
mov ecx, eax
mov dword [ebp - 0x10], eax
call fcn.00406970
mov byte [ebp - 4], 2
mov ecx, dword [ebp + 0xc]
mov dword [edi + 0x20], 0x4e8470
mov eax, dword [ecx + 0x1c]
mov dword [edi + 0x24], eax
mov eax, dword [ecx + 0x20]
mov dword [edi + 0x28], eax
mov dword [ebp - 4], 3
mov eax, dword [ebx + 8]
inc eax
movss xmm3, dword [ebx]
movd xmm0, eax
cvtdq2pd xmm0, xmm0
shr eax, 0x1f
addsd xmm0, qword [eax*8 + 0x4f1a60]
mov eax, dword [ebx + 0x1c]
movd xmm1, eax
cvtdq2pd xmm1, xmm1
shr eax, 0x1f
cvtpd2ps xmm0, xmm0
addsd xmm1, qword [eax*8 + 0x4f1a60]
movaps xmm2, xmm0
cvtpd2ps xmm1, xmm1
divss xmm2, xmm1
comiss xmm2, xmm3
jbe 0x41a036
divss xmm0, xmm3
call fcn.00408690
call fcn.004c0030
mov ecx, 8
cmp eax, ecx
cmova ecx, eax
mov eax, dword [ebx + 0x1c]
cmp eax, ecx
jae 0x41a01a
cmp eax, 0x200
jae 0x41a018
shl eax, 3
cmp eax, ecx
jae 0x41a01a
mov eax, ecx
push eax
mov ecx, ebx
call fcn.0041a200
push esi
lea eax, [edi + 8]
mov ecx, ebx
push eax
lea eax, [ebp - 0x20]
push eax
call fcn.00407890
mov edx, dword [eax]
jmp 0x41a039
mov edx, dword [ebp - 0x20]
mov eax, dword [ebx + 8]
mov ecx, dword [edx + 4]
inc eax
mov dword [ebx + 8], eax
mov dword [edi], edx
mov dword [edi + 4], ecx
mov dword [ecx], edi
mov dword [edx + 4], edi
mov eax, dword [ebx + 0x18]
mov dword [ebp + 0xc], ecx
and eax, esi
mov ecx, dword [ebx + 0xc]
mov dword [ebp - 0x14], 0
mov esi, dword [ecx + eax*8]
cmp esi, dword [ebx + 4]
jne 0x41a06c
mov dword [ecx + eax*8], edi
jmp 0x41a07e
cmp esi, edx
jne 0x41a075
mov dword [ecx + eax*8], edi
jmp 0x41a082
mov edx, dword [ebp + 0xc]
cmp dword [ecx + eax*8 + 4], edx
jne 0x41a082
mov dword [ecx + eax*8 + 4], edi
mov eax, dword [ebp + 8]
mov dword [eax], edi
mov byte [eax + 4], 1
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
push str.unordered_map_set_too_long
call fcn.004822a8
int3
Function at 0x41b1c0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4c532d
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push ebx
push esi
push edi
mov eax, dword [0x50d024]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov edx, dword [ebp + 0xc]
mov edi, edx
cmp dword [edx + 0x14], 8
mov eax, dword [edx + 0x10]
jb 0x41b1fa
mov edi, dword [edx]
xor ecx, ecx
mov esi, 0x811c9dc5
add eax, eax
je 0x41b21b
mov edx, eax
movzx eax, byte [ecx + edi]
inc ecx
xor eax, esi
imul esi, eax, 0x1000193
cmp ecx, edx
jb 0x41b207
mov edx, dword [ebp + 0xc]
push esi
push edx
lea eax, [ebp - 0x1c]
mov ecx, ebx
push eax
call fcn.00407890
mov ecx, dword [ebp - 0x18]
test ecx, ecx
je 0x41b24c
mov eax, dword [ebp + 8]
mov dword [eax], ecx
mov byte [eax + 4], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
cmp dword [ebx + 8], 0x3c3c3c3
je 0x41b397
lea eax, [ebx + 4]
mov dword [ebp - 0x10], 0
mov dword [ebp - 0x14], eax
mov dword [ebp - 4], 0
push 0x44
mov dword [ebp - 0x10], 0
call fcn.0049905d
add esp, 4
mov edi, eax
mov dword [ebp - 0x10], edi
push dword [ebp + 0xc]
lea ecx, [edi + 8]
call fcn.0041b9f0
mov dword [ebp - 4], 1
mov ecx, dword [ebx + 8]
mov eax, dword [ebx + 0x1c]
inc ecx
movss xmm3, dword [ebx]
movd xmm0, ecx
cvtdq2pd xmm0, xmm0
shr ecx, 0x1f
movd xmm1, eax
addsd xmm0, qword [ecx*8 + 0x4f1a60]
cvtdq2pd xmm1, xmm1
shr eax, 0x1f
cvtpd2ps xmm0, xmm0
addsd xmm1, qword [eax*8 + 0x4f1a60]
movaps xmm2, xmm0
cvtpd2ps xmm1, xmm1
divss xmm2, xmm1
comiss xmm2, xmm3
jbe 0x41b327
divss xmm0, xmm3
call fcn.00408690
call fcn.004c0030
mov ecx, 8
cmp eax, ecx
cmova ecx, eax
mov eax, dword [ebx + 0x1c]
cmp eax, ecx
jae 0x41b30b
cmp eax, 0x200
jae 0x41b309
shl eax, 3
cmp eax, ecx
jae 0x41b30b
mov eax, ecx
push eax
mov ecx, ebx
call fcn.0041b520
push esi
lea eax, [edi + 8]
mov ecx, ebx
push eax
lea eax, [ebp - 0x1c]
push eax
call fcn.00407890
mov edx, dword [eax]
jmp 0x41b32a
mov edx, dword [ebp - 0x1c]
mov eax, dword [ebx + 8]
mov ecx, dword [edx + 4]
inc eax
mov dword [ebx + 8], eax
mov dword [edi], edx
mov dword [edi + 4], ecx
mov dword [ecx], edi
mov dword [edx + 4], edi
mov eax, dword [ebx + 0x18]
mov dword [ebp + 0xc], ecx
and eax, esi
mov ecx, dword [ebx + 0xc]
mov dword [ebp - 0x10], 0
mov esi, dword [ecx + eax*8]
cmp esi, dword [ebx + 4]
jne 0x41b35d
mov dword [ecx + eax*8], edi
jmp 0x41b36f
cmp esi, edx
jne 0x41b366
mov dword [ecx + eax*8], edi
jmp 0x41b373
mov edx, dword [ebp + 0xc]
cmp dword [ecx + eax*8 + 4], edx
jne 0x41b373
mov dword [ecx + eax*8 + 4], edi
mov eax, dword [ebp + 8]
mov dword [eax], edi
mov byte [eax + 4], 1
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
push str.unordered_map_set_too_long
call fcn.004822a8
int3
Function at 0x41d330
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4c5d0e
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push ebx
push esi
push edi
mov eax, dword [0x50d024]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, ecx
mov dword [ebp - 0x10], eax
mov edx, dword [ebp + 0xc]
add eax, 0x6c
mov dword [ebp - 0x14], 0
mov edi, edx
mov dword [ebp - 0x18], eax
cmp dword [edx + 0x14], 8
mov ebx, dword [edx + 0x10]
jb 0x41d37a
mov edi, dword [edx]
xor ecx, ecx
mov esi, 0x811c9dc5
add ebx, ebx
je 0x41d399
movzx eax, byte [ecx + edi]
inc ecx
xor eax, esi
imul esi, eax, 0x1000193
cmp ecx, ebx
jb 0x41d385
mov eax, dword [ebp - 0x18]
push esi
push edx
lea ecx, [ebp - 0x1c]
push ecx
mov ecx, eax
call fcn.00407890
mov ecx, dword [ebp - 0x10]
mov eax, dword [eax + 4]
test eax, eax
jne 0x41d3b3
mov eax, dword [ecx + 0x70]
cmp eax, dword [ecx + 0x70]
jne 0x41d405
mov esi, dword [ebp + 8]
xor eax, eax
push eax
push 0x4e70b8
mov ecx, esi
mov dword [esi], 0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 7
mov word [esi], ax
call fcn.00409630
mov dword [ebp - 4], 0
mov dword [ebp - 0x14], 1
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
mov ecx, dword [ebp + 8]
add eax, 0x20
push eax
call fcn.00406970
mov dword [ebp - 4], 0
mov dword [ebp - 0x14], 1
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x41e5d0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4c60f0
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push ebx
push esi
push edi
mov eax, dword [0x50d024]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov edx, dword [ebp + 0xc]
mov edi, edx
cmp dword [edx + 0x14], 8
mov eax, dword [edx + 0x10]
jb 0x41e60a
mov edi, dword [edx]
xor ecx, ecx
mov esi, 0x811c9dc5
add eax, eax
je 0x41e62b
mov edx, eax
movzx eax, byte [ecx + edi]
inc ecx
xor eax, esi
imul esi, eax, 0x1000193
cmp ecx, edx
jb 0x41e617
mov edx, dword [ebp + 0xc]
push esi
push edx
lea eax, [ebp - 0x20]
mov ecx, ebx
push eax
call fcn.00407890
mov ecx, dword [ebp - 0x1c]
test ecx, ecx
je 0x41e65c
mov eax, dword [ebp + 8]
mov dword [eax], ecx
mov byte [eax + 4], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
cmp dword [ebx + 8], 0x2e8ba2e
je 0x41e7bf
lea eax, [ebx + 4]
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x18], eax
mov dword [ebp - 4], 0
push 0x58
mov dword [ebp - 0x14], 0
call fcn.0049905d
mov edi, eax
add esp, 4
mov dword [ebp - 0x14], edi
push dword [ebp + 0xc]
lea eax, [edi + 8]
mov ecx, eax
mov dword [ebp - 0x10], eax
call fcn.00406970
mov byte [ebp - 4], 3
lea ecx, [edi + 0x20]
mov eax, dword [ebp + 0xc]
add eax, 0x18
push eax
call fcn.0041e040
mov dword [ebp - 4], 5
mov eax, dword [ebx + 8]
inc eax
movss xmm3, dword [ebx]
movd xmm0, eax
cvtdq2pd xmm0, xmm0
shr eax, 0x1f
addsd xmm0, qword [eax*8 + 0x4f1a60]
mov eax, dword [ebx + 0x1c]
movd xmm1, eax
cvtdq2pd xmm1, xmm1
shr eax, 0x1f
cvtpd2ps xmm0, xmm0
addsd xmm1, qword [eax*8 + 0x4f1a60]
movaps xmm2, xmm0
cvtpd2ps xmm1, xmm1
divss xmm2, xmm1
comiss xmm2, xmm3
jbe 0x41e74f
divss xmm0, xmm3
call fcn.00408690
call fcn.004c0030
mov ecx, 8
cmp eax, ecx
cmova ecx, eax
mov eax, dword [ebx + 0x1c]
cmp eax, ecx
jae 0x41e733
cmp eax, 0x200
jae 0x41e731
shl eax, 3
cmp eax, ecx
jae 0x41e733
mov eax, ecx
push eax
mov ecx, ebx
call fcn.0041f430
push esi
lea eax, [edi + 8]
mov ecx, ebx
push eax
lea eax, [ebp - 0x20]
push eax
call fcn.00407890
mov edx, dword [eax]
jmp 0x41e752
mov edx, dword [ebp - 0x20]
mov eax, dword [ebx + 8]
mov ecx, dword [edx + 4]
inc eax
mov dword [ebx + 8], eax
mov dword [edi], edx
mov dword [edi + 4], ecx
mov dword [ecx], edi
mov dword [edx + 4], edi
mov eax, dword [ebx + 0x18]
mov dword [ebp + 0xc], ecx
and eax, esi
mov ecx, dword [ebx + 0xc]
mov dword [ebp - 0x14], 0
mov esi, dword [ecx + eax*8]
cmp esi, dword [ebx + 4]
jne 0x41e785
mov dword [ecx + eax*8], edi
jmp 0x41e797
cmp esi, edx
jne 0x41e78e
mov dword [ecx + eax*8], edi
jmp 0x41e79b
mov edx, dword [ebp + 0xc]
cmp dword [ecx + eax*8 + 4], edx
jne 0x41e79b
mov dword [ecx + eax*8 + 4], edi
mov eax, dword [ebp + 8]
mov dword [eax], edi
mov byte [eax + 4], 1
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
push str.unordered_map_set_too_long
call fcn.004822a8
int3
Function at 0x41e7d0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4c6140
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push ebx
push esi
push edi
mov eax, dword [0x50d024]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov edx, dword [ebp + 0xc]
mov edi, edx
cmp dword [edx + 0x14], 8
mov eax, dword [edx + 0x10]
jb 0x41e80a
mov edi, dword [edx]
xor ecx, ecx
mov esi, 0x811c9dc5
add eax, eax
je 0x41e82b
mov edx, eax
movzx eax, byte [ecx + edi]
inc ecx
xor eax, esi
imul esi, eax, 0x1000193
cmp ecx, edx
jb 0x41e817
mov edx, dword [ebp + 0xc]
push esi
push edx
lea eax, [ebp - 0x20]
mov ecx, ebx
push eax
call fcn.00407890
mov ecx, dword [ebp - 0x1c]
test ecx, ecx
je 0x41e85c
mov eax, dword [ebp + 8]
mov dword [eax], ecx
mov byte [eax + 4], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
cmp dword [ebx + 8], 0x71c71c7
je 0x41e9c0
lea eax, [ebx + 4]
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x18], eax
mov dword [ebp - 4], 0
push 0x24
mov dword [ebp - 0x14], 0
call fcn.0049905d
mov edi, eax
add esp, 4
mov dword [ebp - 0x14], edi
push dword [ebp + 0xc]
lea eax, [edi + 8]
mov ecx, eax
mov dword [ebp - 0x10], eax
call fcn.00406970
mov byte [ebp - 4], 3
mov ecx, dword [ebp + 0xc]
mov eax, dword [ecx + 0x18]
mov dword [ecx + 0x18], 0
mov dword [edi + 0x20], eax
mov dword [ebp - 4], 5
mov eax, dword [ebx + 8]
inc eax
movss xmm3, dword [ebx]
movd xmm0, eax
cvtdq2pd xmm0, xmm0
shr eax, 0x1f
addsd xmm0, qword [eax*8 + 0x4f1a60]
mov eax, dword [ebx + 0x1c]
movd xmm1, eax
cvtdq2pd xmm1, xmm1
shr eax, 0x1f
cvtpd2ps xmm0, xmm0
addsd xmm1, qword [eax*8 + 0x4f1a60]
movaps xmm2, xmm0
cvtpd2ps xmm1, xmm1
divss xmm2, xmm1
comiss xmm2, xmm3
jbe 0x41e950
divss xmm0, xmm3
call fcn.00408690
call fcn.004c0030
mov ecx, 8
cmp eax, ecx
cmova ecx, eax
mov eax, dword [ebx + 0x1c]
cmp eax, ecx
jae 0x41e934
cmp eax, 0x200
jae 0x41e932
shl eax, 3
cmp eax, ecx
jae 0x41e934
mov eax, ecx
push eax
mov ecx, ebx
call fcn.0041f650
push esi
lea eax, [edi + 8]
mov ecx, ebx
push eax
lea eax, [ebp - 0x20]
push eax
call fcn.00407890
mov edx, dword [eax]
jmp 0x41e953
mov edx, dword [ebp - 0x20]
mov eax, dword [ebx + 8]
mov ecx, dword [edx + 4]
inc eax
mov dword [ebx + 8], eax
mov dword [edi], edx
mov dword [edi + 4], ecx
mov dword [ecx], edi
mov dword [edx + 4], edi
mov eax, dword [ebx + 0x18]
mov dword [ebp + 0xc], ecx
and eax, esi
mov ecx, dword [ebx + 0xc]
mov dword [ebp - 0x14], 0
mov esi, dword [ecx + eax*8]
cmp esi, dword [ebx + 4]
jne 0x41e986
mov dword [ecx + eax*8], edi
jmp 0x41e998
cmp esi, edx
jne 0x41e98f
mov dword [ecx + eax*8], edi
jmp 0x41e99c
mov edx, dword [ebp + 0xc]
cmp dword [ecx + eax*8 + 4], edx
jne 0x41e99c
mov dword [ecx + eax*8 + 4], edi
mov eax, dword [ebp + 8]
mov dword [eax], edi
mov byte [eax + 4], 1
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
push str.unordered_map_set_too_long
call fcn.004822a8
int3
Function at 0x421570
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4c11ad
mov eax, dword fs:[0]
push eax
sub esp, 0x24
mov eax, dword [0x50d024]
xor eax, ebp
mov dword [ebp - 0x14], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
lea ecx, [ebp - 0x2c]
push eax
call fcn.00406970
mov dword [ebp - 4], 0
lea eax, [ebp - 0x2c]
cmp dword [ebp - 0x18], 8
cmovae eax, dword [ebp - 0x2c]
push eax
call dword [sym.imp.USER32.dll_CharLowerW]
mov eax, dword [ebp - 0x1c]
lea edx, [ebp - 0x2c]
cmp dword [ebp - 0x18], 8
mov esi, 0x811c9dc5
cmovae edx, dword [ebp - 0x2c]
xor ecx, ecx
lea edi, [eax + eax]
test edi, edi
je 0x4215f1
nop dword [eax + eax]
movzx eax, byte [ecx + edx]
inc ecx
xor eax, esi
imul esi, eax, 0x1000193
cmp ecx, edi
jb 0x4215e0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x2c]
call fcn.00409da0
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.00498bc4
mov esp, ebp
pop ebp
ret 4