joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4b5b90
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov edx, dword [ebp + 8]
mov eax, 0x1fffffff
push ebx
push esi
push edi
mov edi, ecx
mov esi, 1
bsr ecx, eax
mov eax, esi
mov dword [ebp - 0x10], edi
shl eax, cl
cmp edx, eax
ja 0x4b5d11
mov ebx, dword [edi + 4]
lea eax, [edx - 1]
or eax, esi
mov dword [ebp - 0xc], ebx
bsr ecx, eax
push ebx
lea ecx, [ecx + 1]
shl esi, cl
lea ecx, [edi + 0xc]
lea eax, [esi + esi]
push eax
call fcn.004948d0
lea eax, [esi - 1]
mov dword [edi + 0x1c], esi
mov dword [edi + 0x18], eax
mov eax, dword [edi + 4]
mov eax, dword [eax]
cmp eax, ebx
je 0x4b5ce9
mov edi, eax
cmp dword [edi + 0x1c], 0x10
lea ebx, [edi + 8]
mov eax, dword [eax]
mov edx, dword [ebx + 0x10]
mov dword [ebp + 8], eax
mov dword [ebp - 8], edx
mov dword [ebp - 4], ebx
jb 0x4b5c0e
mov ecx, dword [ebx]
mov dword [ebp - 4], ecx
xor ecx, ecx
mov esi, 0x811c9dc5
test edx, edx
je 0x4b5c37
mov ebx, dword [ebp - 4]
mov eax, dword [ebp - 8]
nop
movzx edx, byte [ecx + ebx]
inc ecx
xor edx, esi
imul esi, edx, 0x1000193
cmp ecx, eax
jb 0x4b5c20
mov eax, dword [ebp + 8]
lea ebx, [edi + 8]
mov ecx, dword [ebp - 0x10]
mov edx, dword [ecx + 0x18]
mov ecx, dword [ecx + 0xc]
and edx, esi
lea ecx, [ecx + edx*8]
mov edx, dword [ecx]
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
cmp edx, dword [ebp - 0xc]
jne 0x4b5c5c
mov dword [ecx], edi
mov dword [ecx + 4], edi
jmp 0x4b5cde
mov esi, dword [ecx + 4]
lea eax, [esi + 8]
push eax
push ebx
call fcn.00489620
add esp, 8
test al, al
je 0x4b5c99
mov ebx, dword [esi]
mov eax, dword [ebp + 8]
cmp ebx, edi
je 0x4b5c91
mov esi, dword [edi + 4]
mov dword [esi], eax
mov edx, dword [eax + 4]
mov dword [edx], ebx
mov ecx, dword [ebx + 4]
mov dword [ecx], edi
mov dword [ebx + 4], edx
mov dword [eax + 4], esi
mov dword [edi + 4], ecx
mov ecx, dword [ebp - 8]
mov dword [ecx + 4], edi
jmp 0x4b5cde
mov ebx, esi
cmp dword [ebp - 4], esi
je 0x4b5cbe
mov esi, dword [esi + 4]
mov ebx, esi
lea eax, [ebx + 8]
push eax
lea eax, [edi + 8]
push eax
call fcn.00489620
add esp, 8
test al, al
jne 0x4b5cf2
cmp dword [ebp - 4], esi
jne 0x4b5ca0
mov esi, dword [edi + 4]
mov eax, dword [ebp + 8]
mov dword [esi], eax
mov edx, dword [eax + 4]
mov dword [edx], ebx
mov ecx, dword [ebx + 4]
mov dword [ecx], edi
mov dword [ebx + 4], edx
mov dword [eax + 4], esi
mov dword [edi + 4], ecx
mov ecx, dword [ebp - 8]
mov dword [ecx], edi
mov edi, eax
cmp eax, dword [ebp - 0xc]
jne 0x4b5bf2
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
mov ebx, dword [esi]
mov esi, dword [edi + 4]
mov eax, dword [ebp + 8]
mov dword [esi], eax
mov edx, dword [eax + 4]
mov dword [edx], ebx
mov ecx, dword [ebx + 4]
mov dword [ecx], edi
mov dword [ebx + 4], edx
mov dword [eax + 4], esi
mov dword [edi + 4], ecx
jmp 0x4b5cde
push str.invalid_hash_bucket_count
call fcn.006ee17a
int3
Function at 0x4bca60
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x74234d
push eax
mov dword fs:[0], esp
push esi
push edi
push 4
call fcn.00516cd0
add esp, 4
test eax, eax
je 0x4bca91
mov ecx, dword [ebp + 0x10]
mov ecx, dword [ecx]
mov dword [eax], ecx
jmp 0x4bca93
xor eax, eax
mov dword [ebp + 0x10], eax
mov esi, dword [ebp + 0xc]
mov dword [ebp - 4], 0
lea edi, [esi + 4]
push edi
push 0
push eax
push 0x4bca10
push 0
push 0
call fcn.00715c5f
add esp, 0x18
mov dword [esi], eax
test eax, eax
je 0x4bcace
mov ecx, dword [ebp - 0xc]
pop edi
mov dword fs:[0], ecx
pop esi
mov esp, ebp
pop ebp
ret
push 6
mov dword [edi], 0
call fcn.006ef3a7
int3
Function at 0x4c1b20
Capabilities:
Get session user name

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x220
push 0x200
lea eax, [ebp - 0x220]
push 0
push eax
call fcn.007051b0
add esp, 0xc
mov dword [ebp - 4], 0x100
push 0
call dword [sym.imp.KERNEL32.dll_SetLastError]
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jle 0x4c1b60
movzx eax, ax
or eax, 0x80070000
push ebx
push esi
push 0x400
push 0
push eax
lea eax, [ebp - 0x20]
push eax
call fcn.00570860
mov esi, eax
add esp, 0x10
cmp dword [esi + 0x14], 8
jb 0x4c1b80
mov esi, dword [esi]
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x220]
push eax
call dword [sym.imp.ADVAPI32.dll_GetUserNameW]
push esi
test eax, eax
push str.failed_to_get_current_user_name:__s
sete al
push eax
mov eax, dword [ebp + 4]
push str.C:_buildAgentworkci_deploy_ninja_boot_x86_gitClientInstallerWindows_srcUtil.cpp
push 0x122
push eax
call fcn.004946a0
mov edx, dword [ebp - 0xc]
add esp, 0x18
cmp edx, 8
jb 0x4c1bed
mov ecx, dword [ebp - 0x20]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x4c1be3
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4c1c9a
push edx
push ecx
call fcn.00516d60
add esp, 8
mov ebx, dword [ebp + 8]
xor ecx, ecx
mov eax, dword [ebp - 4]
mov dword [ebp - 8], eax
mov dword [ebx], 0
mov dword [ebx + 0x10], 0
mov dword [ebx + 0x14], 7
mov word [ebx], cx
cmp eax, 7
ja 0x4c1c39
lea esi, [eax + eax]
mov dword [ebx + 0x10], eax
push esi
lea eax, [ebp - 0x220]
push eax
push ebx
call fcn.00704c30
add esp, 0xc
xor eax, eax
mov word [esi + ebx], ax
mov eax, ebx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
cmp eax, 0x7ffffffe
ja 0x4c1c9f
mov esi, eax
or esi, 7
cmp esi, 0x7ffffffe
jbe 0x4c1c54
mov esi, bind
jmp 0x4c1c5e
mov eax, 0xa
cmp esi, eax
cmovb esi, eax
push edi
lea eax, [esi + 1]
mov ecx, ebx
push eax
call fcn.00486a90
mov edi, eax
mov dword [ebx + 0x14], esi
mov eax, dword [ebp - 8]
mov dword [ebx + 0x10], eax
lea esi, [eax + eax]
push esi
lea eax, [ebp - 0x220]
push eax
push edi
call fcn.00704c30
add esp, 0xc
xor eax, eax
mov word [esi + edi], ax
mov eax, ebx
mov dword [ebx], edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
call fcn.0070f5b4
call fcn.00486890
int3
Function at 0x4c1e60
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x742945
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x30
push esi
push edi
mov dword [ebp - 0x24], 0
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x1c], 0
lea eax, [ebp - 0x24]
mov dword [ebp - 4], 0
push eax
push dword [ebp + 8]
call fcn.004c0b30
call fcn.004b97a0
mov edi, dword [ebp - 0x20]
mov esi, eax
mov eax, dword [ebp - 0x14]
sub esp, 8
mov dword [ebp - 0x14], eax
mov ecx, edi
sub ecx, dword [ebp - 0x24]
mov eax, esp
sar ecx, 2
mov dword [ebp - 0x18], ecx
lea ecx, [ebp - 0x18]
push 2
mov dword [eax], 2
mov dword [eax + 4], 0
mov dword [eax + 8], ecx
lea eax, [ebp - 0x3c]
push 0x762e90
push eax
call fcn.004894e0
add esp, 0x1c
lea eax, [ebp - 0x3c]
mov byte [ebp - 4], 1
push eax
push str.RobloxProcessHandlesCount
mov ecx, esi
call fcn.004b5ff0
mov edx, dword [ebp - 0x28]
cmp edx, 0x10
jb 0x4c1f33
mov ecx, dword [ebp - 0x3c]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x4c1f29
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4c2001
push edx
push ecx
call fcn.00516d60
add esp, 8
mov esi, dword [ebp - 0x24]
cmp esi, edi
je 0x4c1f7c
nop word [eax + eax]
push 0
call dword [sym.imp.KERNEL32.dll_SetLastError]
push 1
push dword [esi]
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
test eax, eax
jne 0x4c1f63
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 5
jne 0x4c1fdc
jmp 0x4c1f75
push dword [0x8450ac]
push dword [esi]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
jne 0x4c1fd0
add esi, 4
cmp esi, edi
jne 0x4c1f40
xor eax, eax
mov edx, dword [ebp - 0x24]
mov dword [ebp - 0x10], eax
test edx, edx
je 0x4c1ff1
mov esi, edx
cmp esi, edi
je 0x4c1fac
nop
mov eax, dword [esi]
test eax, eax
je 0x4c1fa2
cmp eax, 0xffffffff
je 0x4c1fa2
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
add esi, 4
cmp esi, edi
jne 0x4c1f90
mov edx, dword [ebp - 0x24]
mov ecx, dword [ebp - 0x1c]
mov eax, edx
sub ecx, edx
and ecx, 0xfffffffc
cmp ecx, 0x1000
jb 0x4c1fe4
mov edx, dword [edx - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4c2006
jmp 0x4c1fe4
cmp eax, 0xffffffff
je 0x4c1fdc
push eax
call dword [sym.imp.KERNEL32.dll_SetLastError]
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x4c1f7e
push ecx
push edx
call fcn.00516d60
mov eax, dword [ebp - 0x10]
add esp, 8
mov ecx, dword [ebp - 0xc]
pop edi
mov dword fs:[0], ecx
pop esi
mov esp, ebp
pop ebp
ret
call fcn.0070f5b4
call fcn.0070f5b4
int3
Function at 0x4c8940
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
test eax, eax
jne 0x4c894c
pop ebp
ret
mov dword [ebp + 0xc], eax
pop ebp
jmp fcn.004c6220

Function at 0x4c9820
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
test esi, esi
je 0x4c99f3
cmp dword [esi + 0x20], 0
je 0x4c99f3
cmp dword [esi + 0x24], 0
je 0x4c99f3
mov ecx, dword [esi + 0x1c]
test ecx, ecx
je 0x4c99f3
cmp dword [ecx], esi
jne 0x4c99f3
mov eax, dword [ecx + 4]
cmp eax, 0x2a
je 0x4c9887
cmp eax, 0x39
je 0x4c9887
cmp eax, 0x45
je 0x4c9887
cmp eax, 0x49
je 0x4c9887
cmp eax, 0x5b
je 0x4c9887
cmp eax, 0x67
je 0x4c9887
cmp eax, 0x71
je 0x4c9887
cmp eax, 0x29a
jne 0x4c99f3
mov dword [esi + 0x14], 0
mov dword [esi + 8], 0
mov dword [esi + 0x18], 0
mov dword [esi + 0x2c], 2
mov edx, dword [ecx + 0x18]
mov eax, dword [ecx + 8]
mov dword [ecx + 0x14], 0
mov dword [ecx + 0x10], eax
test edx, edx
jns 0x4c98bc
neg edx
mov dword [ecx + 0x18], edx
cmp edx, 2
jne 0x4c98cc
mov dword [ecx + 4], 0x39
xor eax, eax
jmp 0x4c98e5
push edi
mov edi, 0x2a
test edx, edx
mov eax, 0x71
cmovne eax, edi
mov dword [ecx + 4], eax
mov eax, 1
pop edi
mov dword [esi + 0x30], eax
lea eax, [ecx + 0x94]
mov dword [ecx + 0xb18], eax
lea eax, [ecx + 0x988]
mov dword [ecx + 0xb24], eax
lea eax, [ecx + 0xa7c]
mov dword [ecx + 0xb30], eax
xor eax, eax
push ecx
mov dword [ecx + 0x28], 0
mov dword [ecx + 0xb20], 0x763860
mov dword [ecx + 0xb2c], 0x763874
mov dword [ecx + 0xb38], 0x763888
mov word [ecx + 0x16b8], ax
mov dword [ecx + 0x16bc], eax
call fcn.004c7760
mov esi, dword [esi + 0x1c]
xor edx, edx
mov eax, dword [esi + 0x2c]
mov ecx, dword [esi + 0x4c]
add eax, eax
mov dword [esi + 0x3c], eax
mov eax, dword [esi + 0x44]
mov word [eax + ecx*2 - 2], dx
mov eax, dword [esi + 0x4c]
lea eax, [eax*2 - 2]
push eax
push edx
push dword [esi + 0x44]
call fcn.007051b0
mov eax, dword [esi + 0x84]
add esp, 0x10
lea ecx, [eax + eax*2]
movzx eax, word [ecx*4 + 0x765bca]
mov dword [esi + 0x80], eax
movzx eax, word [ecx*4 + 0x765bc8]
mov dword [esi + 0x8c], eax
movzx eax, word [ecx*4 + 0x765bcc]
mov dword [esi + 0x90], eax
xor eax, eax
movzx ecx, word [ecx*4 + 0x765bce]
mov dword [esi + 0x7c], ecx
mov dword [esi + 0x6c], 0
mov dword [esi + 0x5c], 0
mov dword [esi + 0x74], 0
mov dword [esi + 0x16b4], 0
mov dword [esi + 0x78], 2
mov dword [esi + 0x60], 2
mov dword [esi + 0x68], 0
mov dword [esi + 0x48], 0
pop esi
pop ebp
ret
mov eax, 0xfffffffe
pop esi
pop ebp
ret
Function at 0x4cb860
Capabilities:
Delete registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x7429dd
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x20
push edi
mov eax, dword [ebp + 8]
mov edi, str.SOFTWAREROBLOX_CorporationEnvironmentsRobloxPlayerChannel
mov dword [ebp - 4], 0
sub eax, 0
jne 0x4cb895
mov edi, str.SOFTWAREROBLOX_CorporationEnvironmentsRobloxStudioChannel
lea eax, [ebp + 8]
mov dword [ebp + 8], 0
push eax
push 0x20006
push 0
push edi
push reloc.WS2_32.dll_accept
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x4cb95b
push dword [ebp + 0x10]
lea eax, [ebp - 0x2c]
push dword [ebp + 0xc]
push eax
call fcn.00518fb0
add esp, 0xc
cmp dword [eax + 0x14], 8
jb 0x4cb8d5
mov eax, dword [eax]
push esi
push eax
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
lea ecx, [ebp - 0x2c]
mov esi, eax
call fcn.00484ba0
test esi, esi
pop esi
jne 0x4cb95b
cmp byte [0xa968b0], 0
mov eax, dword [str.Output]
mov ecx, dword [0x8f6408]
mov dword [ebp - 0x10], eax
je 0x4cb92e
cmp byte [0x8f63f8], 0
je 0x4cb92e
test cl, cl
je 0x4cb9bd
cmp cl, 6
jb 0x4cb9bd
shr ecx, 8
cmp cl, 3
jb 0x4cb9bd
jmp 0x4cb936
test cl, cl
je 0x4cb9bd
mov dword [ebp - 0x10], 0xa06fa2
mov eax, dword [ebp - 0x10]
push dword [ebp + 0xc]
sub eax, 0x2a0576
push dword [ebp + 0x10]
push edi
push eax
push dword [0x8f640c]
push dword [0x8f6408]
jmp 0x4cb9b5
cmp byte [0xa968b0], 0
mov eax, dword [str.Error]
mov ecx, dword [0x8f6410]
mov dword [ebp - 0x10], eax
je 0x4cb98e
cmp byte [0x8f63f8], 0
je 0x4cb98e
test cl, cl
je 0x4cb9bd
cmp cl, 6
jb 0x4cb9bd
shr ecx, 8
cmp cl, 3
jb 0x4cb9bd
jmp 0x4cb992
test cl, cl
je 0x4cb9bd
mov dword [ebp - 0x10], 0xa24dfa
mov eax, dword [ebp - 0x10]
push dword [ebp + 0xc]
sub eax, 0x2be392
push dword [ebp + 0x10]
push edi
push eax
push dword [0x8f6414]
push dword [0x8f6410]
call fcn.005180a0
add esp, 0x18
mov eax, dword [ebp + 8]
pop edi
test eax, eax
je 0x4cb9cc
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
Function at 0x4cb9e0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x7429fd
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x3c
push esi
push edi
xor eax, eax
mov dword [ebp - 0x30], 0
push 0x108
lea ecx, [ebp - 0x30]
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x1c], 7
mov word [ebp - 0x30], ax
call fcn.00486a90
mov edx, eax
mov dword [ebp - 0x20], 0x100
xor eax, eax
mov dword [ebp - 0x1c], 0x107
mov ecx, 0x80
mov edi, edx
rep stosd dword es:[edi], eax
mov word [edx + 0x200], ax
mov dword [ebp - 0x30], edx
mov dword [ebp - 4], eax
mov esi, str.SOFTWAREROBLOX_CorporationEnvironmentsRobloxPlayerChannel
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x10], 0x200
sub eax, 0
jne 0x4cba66
mov esi, str.SOFTWAREROBLOX_CorporationEnvironmentsRobloxStudioChannel
push dword [ebp + 0x14]
cmp dword [ebp - 0x1c], 8
lea eax, [ebp - 0x48]
push dword [ebp + 0x10]
lea edi, [ebp - 0x30]
push eax
cmovae edi, edx
call fcn.00518fb0
add esp, 0xc
cmp dword [eax + 0x14], 8
jb 0x4cba8a
mov eax, dword [eax]
lea ecx, [ebp - 0x10]
push ecx
push edi
push 0
push 2
push eax
push esi
push reloc.WS2_32.dll_accept
call dword [sym.imp.ADVAPI32.dll_RegGetValueW]
mov edx, dword [ebp - 0x34]
mov edi, eax
cmp edx, 8
jb 0x4cbadc
mov ecx, dword [ebp - 0x48]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x4cbad2
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4cbc16
push edx
push ecx
call fcn.00516d60
add esp, 8
xor eax, eax
mov dword [ebp - 0x38], 0
mov dword [ebp - 0x34], 7
mov word [ebp - 0x48], ax
test edi, edi
jne 0x4cbb5d
cmp dword [ebp - 0x1c], 8
lea eax, [ebp - 0x30]
mov esi, dword [ebp + 8]
cmovae eax, dword [ebp - 0x30]
push 0xc350
push eax
push esi
call fcn.00519080
mov edx, dword [ebp - 0x1c]
add esp, 0xc
cmp edx, 8
jb 0x4cbb4b
mov ecx, dword [ebp - 0x30]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x4cbb41
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4cbc11
push edx
push ecx
call fcn.00516d60
add esp, 8
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop edi
pop esi
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
cmp byte [0xa968b0], 0
mov eax, dword [str.Error]
mov ecx, dword [0x8f6410]
mov dword [ebp - 0x14], eax
je 0x4cbb90
cmp byte [0x8f63f8], 0
je 0x4cbb90
test cl, cl
je 0x4cbbbf
cmp cl, 6
jb 0x4cbbbf
shr ecx, 8
cmp cl, 3
jb 0x4cbbbf
jmp 0x4cbb94
test cl, cl
je 0x4cbbbf
mov dword [ebp - 0x14], 0x987f67
mov eax, dword [ebp - 0x14]
push dword [ebp + 0x10]
sub eax, 0x22157f
push dword [ebp + 0x14]
push esi
push eax
push dword [0x8f6414]
push dword [0x8f6410]
call fcn.005180a0
add esp, 0x18
mov esi, dword [ebp + 8]
mov edx, dword [ebp - 0x1c]
mov dword [esi], 0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0xf
mov byte [esi], 0
cmp edx, 8
jb 0x4cbb4b
mov ecx, dword [ebp - 0x30]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x4cbb41
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x4cbb41
call fcn.0070f5b4
call fcn.0070f5b4
int3
Function at 0x4ccdb0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x742ac5
push eax
mov dword fs:[0], esp
sub esp, 0x10
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
mov ebx, ecx
mov edx, edi
cmp dword [edi + 0x14], 0x10
jb 0x4ccddd
mov edx, dword [edi]
xor ecx, ecx
mov esi, 0x811c9dc5
cmp dword [edi + 0x10], ecx
jbe 0x4cce02
nop dword [eax]
movzx eax, byte [ecx + edx]
inc ecx
xor eax, esi
imul esi, eax, 0x1000193
cmp ecx, dword [edi + 0x10]
jb 0x4ccdf0
push esi
push edi
lea eax, [ebp - 0x14]
mov ecx, ebx
push eax
call fcn.00489ef0
mov ecx, dword [ebp - 0x10]
test ecx, ecx
je 0x4cce32
mov eax, dword [ebp + 8]
mov dword [eax], ecx
mov byte [eax + 4], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
cmp dword [ebx + 8], 0x4924924
je 0x4ccf0c
lea eax, [ebx + 4]
mov dword [ebp - 0x1c], eax
push 0x38
mov dword [ebp - 4], 0
mov dword [ebp - 0x18], 0
call fcn.00516cd0
add esp, 4
mov dword [ebp - 0x18], eax
push edi
lea edi, [eax + 8]
mov ecx, edi
call fcn.004838a0
mov dword [edi + 0x18], 0
mov dword [edi + 0x28], 0
mov dword [edi + 0x2c], 0xf
mov eax, dword [ebx + 8]
inc eax
mov dword [ebp - 4], 1
movd xmm0, eax
cvtdq2pd xmm0, xmm0
shr eax, 0x1f
addsd xmm0, qword [eax*8 + 0x75f520]
mov eax, dword [ebx + 0x1c]
cvtpd2ps xmm1, xmm0
movd xmm0, eax
cvtdq2pd xmm0, xmm0
shr eax, 0x1f
addsd xmm0, qword [eax*8 + 0x75f520]
cvtpd2ps xmm0, xmm0
divss xmm1, xmm0
comiss xmm1, dword [ebx]
jbe 0x4ccedf
mov ecx, ebx
call fcn.004ce530
push esi
push edi
lea eax, [ebp - 0x14]
mov ecx, ebx
push eax
call fcn.00489ef0
mov ecx, dword [eax]
jmp 0x4ccee2
mov ecx, dword [ebp - 0x14]
push dword [ebp - 0x18]
push ecx
push esi
mov ecx, ebx
call fcn.004ce260
mov ecx, dword [ebp + 8]
pop edi
pop esi
pop ebx
mov dword [ecx], eax
mov eax, ecx
mov byte [ecx + 4], 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 8
push str.unordered_map_set_too_long
call fcn.006ee17a
int3
Function at 0x4cd740
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x742b1d
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x20
push edi
mov edi, dword [ebp + 8]
mov edx, ecx
mov dword [ebp - 0x10], edx
cmp edi, dword [ebp + 0xc]
je 0x4cd8ef
push ebx
push esi
nop
cmp dword [edi + 0x14], 0x10
mov ebx, edi
jb 0x4cd77a
mov ebx, dword [edi]
xor ecx, ecx
mov esi, 0x811c9dc5
cmp dword [edi + 0x10], ecx
jbe 0x4cd798
movzx eax, byte [ecx + ebx]
inc ecx
xor eax, esi
imul esi, eax, 0x1000193
cmp ecx, dword [edi + 0x10]
jb 0x4cd786
push esi
push edi
lea eax, [ebp - 0x1c]
mov ecx, edx
push eax
call fcn.00489ef0
cmp dword [ebp - 0x18], 0
jne 0x4cd8de
mov ecx, dword [ebp - 0x10]
cmp dword [ecx + 8], 0x4924924
je 0x4cd900
lea eax, [ecx + 4]
mov dword [ebp - 0x24], eax
push 0x38
mov dword [ebp - 4], 0
mov dword [ebp - 0x20], 0
call fcn.00516cd0
mov ebx, eax
add esp, 4
mov dword [ebp - 0x20], ebx
lea eax, [ebx + 8]
push edi
mov ecx, eax
mov dword [ebp + 8], eax
call fcn.004838a0
lea eax, [edi + 0x18]
mov byte [ebp - 4], 1
lea ecx, [ebx + 0x20]
push eax
call fcn.004838a0
mov edx, dword [ebp - 0x10]
mov dword [ebp - 4], 2
mov eax, dword [edx + 8]
inc eax
movd xmm0, eax
cvtdq2pd xmm0, xmm0
shr eax, 0x1f
addsd xmm0, qword [eax*8 + 0x75f520]
mov eax, dword [edx + 0x1c]
cvtpd2ps xmm1, xmm0
movd xmm0, eax
cvtdq2pd xmm0, xmm0
shr eax, 0x1f
addsd xmm0, qword [eax*8 + 0x75f520]
cvtpd2ps xmm0, xmm0
divss xmm1, xmm0
comiss xmm1, dword [edx]
seta al
test al, al
je 0x4cd877
mov ecx, edx
call fcn.004ce530
mov ecx, dword [ebp - 0x10]
lea eax, [ebx + 8]
push esi
push eax
lea eax, [ebp - 0x2c]
push eax
call fcn.00489ef0
mov edx, dword [ebp - 0x10]
mov ecx, dword [eax]
mov eax, dword [eax + 4]
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 0x18], eax
jmp 0x4cd87a
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ecx + 4]
inc dword [edx + 8]
mov dword [ebx + 4], eax
mov dword [ebx], ecx
mov dword [eax], ebx
mov dword [ecx + 4], ebx
mov dword [ebp - 0x14], eax
mov eax, dword [edx + 0x18]
mov dword [ebp + 8], ecx
and eax, esi
mov ecx, dword [edx + 0xc]
mov dword [ebp - 0x20], 0
mov esi, dword [ecx + eax*8]
cmp esi, dword [edx + 4]
jne 0x4cd8b7
mov dword [ecx + eax*8], ebx
mov dword [ecx + eax*8 + 4], ebx
mov dword [ebp - 4], 0xffffffff
jmp 0x4cd8e1
cmp esi, dword [ebp + 8]
jne 0x4cd8c8
mov dword [ecx + eax*8], ebx
mov dword [ebp - 4], 0xffffffff
jmp 0x4cd8e1
mov esi, dword [ebp - 0x14]
cmp dword [ecx + eax*8 + 4], esi
jne 0x4cd8d5
mov dword [ecx + eax*8 + 4], ebx
mov dword [ebp - 4], 0xffffffff
jmp 0x4cd8e1
mov edx, dword [ebp - 0x10]
add edi, 0x30
cmp edi, dword [ebp + 0xc]
jne 0x4cd770
pop esi
pop ebx
mov ecx, dword [ebp - 0xc]
pop edi
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 8
push str.unordered_map_set_too_long
call fcn.006ee17a
int3
Function at 0x4cdd00
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x742ac5
push eax
mov dword fs:[0], esp
sub esp, 0x18
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov ebx, ecx
mov edx, edi
cmp dword [edi + 0x14], 0x10
jb 0x4cdd2d
mov edx, dword [edi]
xor ecx, ecx
mov esi, 0x811c9dc5
cmp dword [edi + 0x10], ecx
jbe 0x4cdd52
nop dword [eax]
movzx eax, byte [ecx + edx]
inc ecx
xor eax, esi
imul esi, eax, 0x1000193
cmp ecx, dword [edi + 0x10]
jb 0x4cdd40
push esi
push edi
lea eax, [ebp - 0x14]
mov ecx, ebx
push eax
call fcn.00489ef0
mov eax, dword [ebp - 0x10]
test eax, eax
jne 0x4cde28
cmp dword [ebx + 8], 0x4924924
je 0x4cde3e
lea eax, [ebx + 4]
mov dword [ebp - 0x1c], eax
push 0x38
mov dword [ebp - 4], 0
mov dword [ebp - 0x18], 0
call fcn.00516cd0
mov ecx, eax
add esp, 4
mov dword [ebp - 0x18], ecx
push edi
lea edi, [ecx + 8]
mov ecx, edi
call fcn.004838a0
mov dword [edi + 0x18], 0
mov dword [edi + 0x28], 0
mov dword [edi + 0x2c], 0xf
mov eax, dword [ebx + 8]
inc eax
mov dword [ebp - 4], 1
movd xmm0, eax
cvtdq2pd xmm0, xmm0
shr eax, 0x1f
addsd xmm0, qword [eax*8 + 0x75f520]
mov eax, dword [ebx + 0x1c]
cvtpd2ps xmm1, xmm0
movd xmm0, eax
cvtdq2pd xmm0, xmm0
shr eax, 0x1f
addsd xmm0, qword [eax*8 + 0x75f520]
cvtpd2ps xmm0, xmm0
divss xmm1, xmm0
comiss xmm1, dword [ebx]
jbe 0x4cde19
mov ecx, ebx
call fcn.004ce530
push esi
push edi
lea eax, [ebp - 0x24]
mov ecx, ebx
push eax
call fcn.00489ef0
mov ecx, dword [eax]
jmp 0x4cde1c
mov ecx, dword [ebp - 0x14]
push dword [ebp - 0x18]
push ecx
push esi
mov ecx, ebx
call fcn.004ce260
mov ecx, dword [ebp - 0xc]
add eax, 0x20
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret 4
push str.unordered_map_set_too_long
call fcn.006ee17a
int3