joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40f980
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push esi
mov esi, dword [ebp + 8]
cmp dword [esi + 0x10], 0
je 0x40fa97
push ebx
push edi
push 0x7e04cc
call dword [sym.imp.KERNEL32.DLL_EnterCriticalSection]
mov byte [0x7e04e4], 1
mov edx, esi
cmp dword [esi + 0x14], 0x10
mov ebx, dword [esi + 0x10]
jb 0x40f9b5
mov edx, dword [esi]
xor ecx, ecx
mov edi, 0x811c9dc5
test ebx, ebx
je 0x40f9d1
movzx eax, byte [ecx + edx]
inc ecx
xor eax, edi
imul edi, eax, 0x1000193
cmp ecx, ebx
jb 0x40f9c0
push edi
push esi
lea eax, [ebp - 8]
mov ecx, 0x7e04e8
push eax
call fcn.00410190
mov esi, dword [eax + 4]
test esi, esi
je 0x40fa83
mov ecx, dword [0x7e0500]
mov eax, dword [0x7e04f4]
and ecx, edi
lea ecx, [eax + ecx*8]
mov eax, dword [ecx]
cmp dword [ecx + 4], esi
jne 0x40fa1b
cmp eax, esi
jne 0x40fa13
mov eax, dword [0x7e04ec]
mov dword [ecx], eax
mov dword [ecx + 4], eax
jmp 0x40fa23
mov eax, dword [esi + 4]
mov dword [ecx + 4], eax
jmp 0x40fa23
cmp eax, esi
jne 0x40fa23
mov eax, dword [esi]
mov dword [ecx], eax
mov ecx, dword [esi]
dec dword [0x7e04f0]
mov eax, dword [esi + 4]
mov dword [eax], ecx
mov eax, dword [esi + 4]
mov dword [ecx + 4], eax
mov ecx, dword [esi + 0x1c]
cmp ecx, 0x10
jb 0x40fa66
mov eax, dword [esi + 8]
inc ecx
cmp ecx, 0x1000
jb 0x40fa5c
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40fa9e
mov eax, edx
push ecx
push eax
call fcn.0068976d
add esp, 8
push 0x24
push esi
mov dword [esi + 0x18], 0
mov dword [esi + 0x1c], 0xf
mov byte [esi + 8], 0
call fcn.0068976d
add esp, 8
push 0x7e04cc
call dword [sym.imp.KERNEL32.DLL_LeaveCriticalSection]
pop edi
mov byte [0x7e04e4], 0
pop ebx
pop esi
mov esp, ebp
pop ebp
ret 4
call fcn.00695b77
int3
Function at 0x40ffc0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x6cb9d5
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push ebx
push esi
push edi
mov eax, dword [0x7df5fc]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov edx, dword [ebp + 0xc]
mov edi, edx
cmp dword [edx + 0x14], 0x10
jb 0x40fff7
mov edi, dword [edx]
xor ecx, ecx
mov esi, 0x811c9dc5
cmp dword [edx + 0x10], ecx
jbe 0x410015
movzx eax, byte [ecx + edi]
inc ecx
xor eax, esi
imul esi, eax, 0x1000193
cmp ecx, dword [edx + 0x10]
jb 0x410003
push esi
push edx
lea eax, [ebp - 0x14]
mov ecx, ebx
push eax
call fcn.00410190
mov ecx, dword [ebp - 0x10]
test ecx, ecx
je 0x410046
mov eax, dword [ebp + 8]
mov dword [eax], ecx
mov byte [eax + 4], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
cmp dword [ebx + 8], 0x71c71c7
je 0x410183
lea eax, [ebx + 4]
mov dword [ebp - 0x1c], eax
mov dword [ebp - 4], 0
push 0x24
mov dword [ebp - 0x18], 0
call fcn.0068973d
add esp, 4
mov edi, eax
mov dword [ebp - 0x18], edi
push dword [ebp + 0xc]
lea ecx, [edi + 8]
call fcn.0040fb90
mov dword [edi + 0x20], 0
mov dword [ebp - 4], 1
mov eax, dword [ebx + 8]
inc eax
movss xmm3, dword [ebx]
movd xmm0, eax
cvtdq2pd xmm0, xmm0
shr eax, 0x1f
addsd xmm0, qword [eax*8 + 0x77e6e0]
mov eax, dword [ebx + 0x1c]
movd xmm1, eax
cvtdq2pd xmm1, xmm1
shr eax, 0x1f
cvtpd2ps xmm0, xmm0
addsd xmm1, qword [eax*8 + 0x77e6e0]
movaps xmm2, xmm0
cvtpd2ps xmm1, xmm1
divss xmm2, xmm1
comiss xmm2, xmm3
jbe 0x410121
divss xmm0, xmm3
call fcn.0040e8c0
call fcn.006cb750
mov ecx, 8
cmp eax, ecx
cmova ecx, eax
mov eax, dword [ebx + 0x1c]
cmp eax, ecx
jae 0x410105
cmp eax, 0x200
jae 0x410103
shl eax, 3
cmp eax, ecx
jae 0x410105
mov eax, ecx
push eax
mov ecx, ebx
call fcn.00410750
push esi
lea eax, [edi + 8]
mov ecx, ebx
push eax
lea eax, [ebp - 0x1c]
push eax
call fcn.00410190
mov edx, dword [eax]
jmp 0x410124
mov edx, dword [ebp - 0x14]
mov eax, dword [ebx + 8]
mov ecx, dword [edx + 4]
inc eax
mov dword [ebx + 8], eax
mov dword [edi], edx
mov dword [edi + 4], ecx
mov dword [ecx], edi
mov dword [edx + 4], edi
mov eax, dword [ebx + 0x18]
mov dword [ebp + 0xc], ecx
and eax, esi
mov ecx, dword [ebx + 0xc]
mov esi, dword [ecx + eax*8]
cmp esi, dword [ebx + 4]
jne 0x410150
mov dword [ecx + eax*8], edi
jmp 0x410162
cmp esi, edx
jne 0x410159
mov dword [ecx + eax*8], edi
jmp 0x410166
mov edx, dword [ebp + 0xc]
cmp dword [ecx + eax*8 + 4], edx
jne 0x410166
mov dword [ecx + eax*8 + 4], edi
mov eax, dword [ebp + 8]
mov dword [eax], edi
mov byte [eax + 4], 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
push str.unordered_map_set_too_long
call fcn.0067626b
int3
Function at 0x4106c0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 8]
push esi
push edi
cmp dword [edx + 0x14], 0x10
mov edi, dword [edx + 0x10]
jb 0x4106d3
mov edx, dword [edx]
xor ecx, ecx
mov esi, 0x811c9dc5
test edi, edi
je 0x4106f1
nop
movzx eax, byte [ecx + edx]
inc ecx
xor eax, esi
imul esi, eax, 0x1000193
cmp ecx, edi
jb 0x4106e0
pop edi
mov eax, esi
pop esi
pop ebp
ret 4
Function at 0x412200
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x6cbd93
mov eax, dword fs:[0]
push eax
mov eax, 0x13b4
call section..text
mov eax, dword [0x7df5fc]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x13b4], esi
mov dword [ebp - 0x13ac], esi
mov dword [ebp - 4], 0
mov dword [ebp - 0x13b8], esi
mov dword [ebp - 0x13b0], 0
mov eax, dword fs:[0x2c]
mov ecx, dword [eax]
mov eax, dword [0x8238c8]
cmp eax, dword [ecx + 4]
jle 0x4122d2
push 0x8238c8
call fcn.00689c05
add esp, 4
cmp dword [0x8238c8], 0xffffffff
jne 0x4122d2
mov dword [ebp - 4], 1
mov ecx, 0x8238d0
push 0x3e
push str.0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz
mov dword [0x8238d0], 0
mov dword [0x8238e0], 0
mov dword [0x8238e4], 0xf
call fcn.00414b60
push 0x6f0b90
call fcn.006899b7
push 0x8238c8
mov byte [ebp - 4], 0
call fcn.00689bbb
add esp, 8
push 0x30
mov dword [esi], 0
mov ecx, esi
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0xf
push 0xc
mov byte [esi], 0
call fcn.00414a00
mov dword [ebp - 4], 0
mov dword [ebp - 0x13b0], 1
call fcn.00677c25
mov edx, eax
mov dword [ebp - 0x14], 0xffffffff
mov dword [ebp - 0x1394], edx
mov ecx, 1
nop
mov eax, edx
shr eax, 0x1e
xor eax, edx
imul edx, eax, 0x6c078965
add edx, ecx
mov dword [ebp + ecx*4 - 0x1394], edx
inc ecx
cmp ecx, 0x270
jb 0x412320
mov eax, dword [0x8238e0]
mov ecx, dword [esi + 0x10]
dec eax
cmp dword [esi + 0x14], 0x10
mov dword [ebp - 0x1398], 0x270
mov dword [ebp - 0x13c0], 0
mov dword [ebp - 0x13a8], eax
jb 0x412374
mov edi, dword [esi]
add ecx, edi
mov dword [ebp - 0x13a0], edi
jmp 0x41237e
add ecx, esi
mov dword [ebp - 0x13a0], esi
mov edi, esi
mov dword [ebp - 0x13a4], ecx
cmp edi, ecx
je 0x41245e
nop dword [eax]
cmp eax, 0x80000000
mov esi, eax
cmovae esi, eax
cmp esi, 0xffffffff
jne 0x4123ae
lea ecx, [ebp - 0x1398]
call fcn.00417560
mov edx, eax
jmp 0x412405
lea eax, [esi + 1]
mov dword [ebp - 0x139c], eax
xor edi, edi
xor eax, eax
test esi, esi
je 0x4123cf
lea ecx, [ebp - 0x1398]
call fcn.00417560
mov edi, eax
or eax, 0xffffffff
xor edx, edx
div dword [ebp - 0x139c]
mov ecx, eax
mov dword [ebp - 0x13ac], edx
xor edx, edx
mov eax, edi
div dword [ebp - 0x139c]
cmp eax, ecx
jb 0x4123f5
cmp dword [ebp - 0x13ac], esi
jne 0x4123b7
mov eax, edi
xor edx, edx
div dword [ebp - 0x139c]
mov edi, dword [ebp - 0x13a0]
lea eax, [edx - 0x80000000]
cmp eax, 0x80000000
lea ecx, [eax - 0x80000000]
lea edx, [eax - 0x80000000]
cmovae edx, ecx
cmp dword [0x8238e0], edx
jbe 0x41247b
cmp dword [0x8238e4], 0x10
mov eax, 0x8238d0
cmovae eax, dword [0x8238d0]
mov al, byte [eax + edx]
mov byte [edi], al
inc edi
mov eax, dword [ebp - 0x13a8]
mov dword [ebp - 0x13a0], edi
cmp edi, dword [ebp - 0x13a4]
jne 0x412390
mov esi, dword [ebp - 0x13b4]
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00689f2f
mov esp, ebp
pop ebp
ret
call fcn.00415e50
int3
Function at 0x412490
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 8]
push esi
push edi
mov dword [ecx + 0x1384], 0xffffffff
lea edi, [ecx + 8]
mov dword [ecx + 4], edx
mov esi, 1
nop dword [eax]
mov eax, edx
lea edi, [edi + 4]
shr eax, 0x1e
xor eax, edx
imul edx, eax, 0x6c078965
add edx, esi
inc esi
mov dword [edi - 4], edx
cmp esi, 0x270
jb 0x4124b0
pop edi
mov dword [ecx], 0x270
mov eax, ecx
pop esi
pop ebp
ret 4

Function at 0x4146a0
Capabilities:
Access peb ldr_data
Get process heap force flags

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x6cc000
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x7df5fc]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, ecx
mov dword [ebp - 0x10], eax
push 8
mov dword [eax], vtable.std::basic_streambuf_char__struct_std::char_traits_char__.0
call fcn.0068973d
mov esi, eax
push 1
mov dword [ebp - 4], 0
call fcn.00676541
mov dword [esi + 4], eax
add esp, 8
mov eax, dword [ebp - 0x10]
lea ecx, [eax + 0x18]
lea edx, [eax + 0x24]
lea edi, [eax + 0x14]
mov dword [eax + 0x20], ecx
lea ebx, [eax + 4]
mov dword [eax + 0xc], ebx
mov dword [eax + 0x34], esi
lea esi, [eax + 8]
mov dword [eax + 0x2c], edx
mov dword [eax + 0x10], esi
mov dword [eax + 0x1c], edi
add eax, 0x28
mov dword [ebp - 0x14], ebx
mov ebx, dword [ebp - 0x10]
mov dword [ebx + 0x30], eax
mov ebx, dword [ebp - 0x14]
mov dword [esi], 0
mov dword [ecx], 0
mov dword [eax], 0
mov dword [ebx], 0
mov ebx, dword [ebp + 8]
mov ecx, ebx
mov esi, dword [ebp - 0x10]
not ecx
and ecx, 1
mov dword [edi], 0
shl ecx, 2
mov eax, ebx
mov dword [edx], 0
mov edx, ecx
or edx, 2
mov dword [esi], vtable.std::basic_stringbuf_char__struct_std::char_traits_char___class_std::allocator_char__.0
and al, 2
mov dword [esi + 0x38], 0
mov eax, ebx
cmovne edx, ecx
mov ecx, edx
or ecx, 8
and al, 8
cmove ecx, edx
mov eax, ecx
or eax, 0x10
and bl, 4
cmove eax, ecx
mov dword [esi + 0x3c], eax
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x415910
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 8]
mov eax, 1
push ebx
mov ebx, ecx
push esi
push edi
mov edi, dword [ebp + 0xc]
mov dword [ebx + 4], edx
lea esi, [ebx + 8]
nop dword [eax]
mov ecx, edx
lea esi, [esi + 4]
shr ecx, 0x1e
xor edx, ecx
imul edx, edi
add edx, eax
inc eax
mov dword [esi - 4], edx
cmp eax, 0x270
jb 0x415930
pop edi
pop esi
mov dword [ebx], 0x270
pop ebx
pop ebp
ret 8
Function at 0x415960
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x6cc000
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x7df5fc]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, ecx
mov dword [ebp - 0x10], eax
push 8
mov dword [eax], vtable.std::basic_streambuf_char__struct_std::char_traits_char__.0
call fcn.0068973d
mov esi, eax
push 1
mov dword [ebp - 4], 0
call fcn.00676541
mov dword [esi + 4], eax
add esp, 8
mov eax, dword [ebp - 0x10]
lea edi, [eax + 0x14]
lea ecx, [eax + 0x18]
lea edx, [eax + 0x24]
mov dword [eax + 0x34], esi
lea ebx, [eax + 4]
mov dword [eax + 0xc], ebx
lea esi, [eax + 8]
mov dword [eax + 0x10], esi
mov dword [eax + 0x1c], edi
mov dword [eax + 0x20], ecx
mov dword [eax + 0x2c], edx
add eax, 0x28
mov dword [ebp - 0x14], ebx
mov ebx, dword [ebp - 0x10]
mov dword [ebx + 0x30], eax
mov ebx, dword [ebp - 0x14]
mov dword [esi], 0
mov dword [ecx], 0
mov dword [eax], 0
mov eax, dword [ebp - 0x10]
mov dword [ebx], 0
mov dword [edi], 0
mov dword [edx], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x417560
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push edi
mov edi, ecx
mov dword [ebp - 4], edi
mov eax, dword [edi]
cmp eax, 0x270
jne 0x4175be
lea edx, [edi + 8]
mov esi, eax
nop dword [eax]
mov ecx, dword [edx - 4]
lea edx, [edx + 4]
xor ecx, dword [edx - 4]
and ecx, 0x7fffffff
xor ecx, dword [edx - 8]
mov eax, ecx
and al, 1
movzx eax, al
neg eax
sbb eax, eax
shr ecx, 1
and eax, 0x9908b0df
xor eax, dword [edx + 0x62c]
xor eax, ecx
mov dword [edx + 0x9b8], eax
sub esi, 1
jne 0x417580
mov eax, dword [edi]
jmp 0x4176a9
cmp eax, 0x4e0
jb 0x4176a9
mov eax, dword [edi + 0x9c4]
push ebx
lea ebx, [edi + 0x9c4]
mov edi, 0xe3
nop dword [eax + eax]
mov ecx, dword [ebx + 4]
lea edx, [ebx + 4]
xor ecx, eax
and ecx, 0x7fffffff
xor ecx, eax
mov eax, ecx
and al, 1
movzx eax, al
neg eax
sbb eax, eax
shr ecx, 1
and eax, 0x9908b0df
xor eax, dword [ebx + 0x634]
xor eax, ecx
mov dword [ebx - 0x9c0], eax
lea ebx, [edx]
mov eax, dword [edx]
sub edi, 1
jne 0x4175e0
mov ebx, dword [ebp - 4]
mov edi, 0x18c
add ebx, 0xd50
mov eax, dword [ebx]
nop dword [eax]
mov ecx, eax
lea edx, [ebx + 4]
xor ecx, dword [edx]
and ecx, 0x7fffffff
xor ecx, eax
mov eax, ecx
and al, 1
movzx eax, al
neg eax
sbb eax, eax
shr ecx, 1
and eax, 0x9908b0df
xor eax, dword [ebx - 0xd4c]
xor eax, ecx
mov dword [ebx - 0x9c0], eax
lea ebx, [edx]
mov eax, dword [edx]
sub edi, 1
jne 0x417630
mov edi, dword [ebp - 4]
pop ebx
mov ecx, dword [edi + 0x1380]
xor ecx, dword [edi + 4]
and ecx, 0x7fffffff
xor ecx, dword [edi + 0x1380]
mov eax, ecx
and al, 1
movzx eax, al
neg eax
sbb eax, eax
shr ecx, 1
and eax, 0x9908b0df
xor eax, dword [edi + 0x634]
xor eax, ecx
mov dword [edi + 0x9c0], eax
xor eax, eax
mov dword [edi], 0
mov edx, dword [edi + eax*4 + 4]
inc eax
mov dword [edi], eax
mov ecx, edx
mov eax, dword [edi + 0x1384]
shr ecx, 0xb
and eax, ecx
xor edx, eax
mov eax, edx
and eax, 0xff3a58ad
shl eax, 7
xor edx, eax
mov eax, edx
and eax, 0xffffdf8c
shl eax, 0xf
xor edx, eax
mov eax, edx
shr eax, 0x12
pop edi
xor eax, edx
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x41a340
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
mov esi, dword [ebp + 8]
mov ebx, ecx
mov dword [ebp - 8], ebx
cmp dword [esi + 0x10], 0
je 0x41a45a
lea eax, [ebx + 4]
push eax
mov dword [ebp - 4], eax
call dword [sym.imp.KERNEL32.DLL_EnterCriticalSection]
mov byte [ebx + 0x1c], 1
mov edx, esi
add ebx, 0x20
cmp dword [esi + 0x14], 0x10
mov dword [ebp + 8], ebx
mov ebx, dword [esi + 0x10]
jb 0x41a37e
mov edx, dword [esi]
xor ecx, ecx
push edi
mov edi, 0x811c9dc5
test ebx, ebx
je 0x41a3a1
nop word [eax + eax]
movzx eax, byte [ecx + edx]
inc ecx
xor eax, edi
imul edi, eax, 0x1000193
cmp ecx, ebx
jb 0x41a390
mov ebx, dword [ebp + 8]
lea eax, [ebp - 0x10]
push edi
push esi
push eax
mov ecx, ebx
call fcn.00410190
mov esi, dword [eax + 4]
test esi, esi
je 0x41a449
mov ecx, dword [ebx + 0x18]
mov eax, dword [ebx + 0xc]
and ecx, edi
lea ecx, [eax + ecx*8]
mov eax, dword [ecx]
cmp dword [ecx + 4], esi
jne 0x41a3e4
cmp eax, esi
jne 0x41a3dc
mov eax, dword [ebx + 4]
mov dword [ecx], eax
mov dword [ecx + 4], eax
jmp 0x41a3ec
mov eax, dword [esi + 4]
mov dword [ecx + 4], eax
jmp 0x41a3ec
cmp eax, esi
jne 0x41a3ec
mov eax, dword [esi]
mov dword [ecx], eax
mov ecx, dword [esi]
dec dword [ebx + 8]
mov eax, dword [esi + 4]
mov dword [eax], ecx
mov eax, dword [esi + 4]
mov dword [ecx + 4], eax
mov ecx, dword [esi + 0x1c]
cmp ecx, 0x10
jb 0x41a42c
mov eax, dword [esi + 8]
inc ecx
cmp ecx, 0x1000
jb 0x41a422
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x41a462
mov eax, edx
push ecx
push eax
call fcn.0068976d
add esp, 8
push 0x24
push esi
mov dword [esi + 0x18], 0
mov dword [esi + 0x1c], 0xf
mov byte [esi + 8], 0
call fcn.0068976d
add esp, 8
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.DLL_LeaveCriticalSection]
mov eax, dword [ebp - 8]
pop edi
mov byte [eax + 0x1c], 0
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
call fcn.00695b77
int3
Function at 0x41aa50
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x6cc895
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push ebx
push esi
push edi
mov eax, dword [0x7df5fc]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov edx, dword [ebp + 0xc]
mov edi, edx
cmp dword [edx + 0x14], 0x10
jb 0x41aa87
mov edi, dword [edx]
xor ecx, ecx
mov esi, 0x811c9dc5
cmp dword [edx + 0x10], ecx
jbe 0x41aaa5
movzx eax, byte [ecx + edi]
inc ecx
xor eax, esi
imul esi, eax, 0x1000193
cmp ecx, dword [edx + 0x10]
jb 0x41aa93
push esi
push edx
lea eax, [ebp - 0x14]
mov ecx, ebx
push eax
call fcn.00410190
mov ecx, dword [ebp - 0x10]
test ecx, ecx
je 0x41aad6
mov eax, dword [ebp + 8]
mov dword [eax], ecx
mov byte [eax + 4], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
cmp dword [ebx + 8], 0x7ffffff
je 0x41ac0c
lea eax, [ebx + 4]
mov dword [ebp - 0x1c], eax
mov dword [ebp - 4], 0
push 0x20
mov dword [ebp - 0x18], 0
call fcn.0068973d
add esp, 4
mov edi, eax
mov dword [ebp - 0x18], edi
push dword [ebp + 0xc]
lea ecx, [edi + 8]
call fcn.0040fb90
mov dword [ebp - 4], 1
mov eax, dword [ebx + 8]
inc eax
movss xmm3, dword [ebx]
movd xmm0, eax
cvtdq2pd xmm0, xmm0
shr eax, 0x1f
addsd xmm0, qword [eax*8 + 0x77e6e0]
mov eax, dword [ebx + 0x1c]
movd xmm1, eax
cvtdq2pd xmm1, xmm1
shr eax, 0x1f
cvtpd2ps xmm0, xmm0
addsd xmm1, qword [eax*8 + 0x77e6e0]
movaps xmm2, xmm0
cvtpd2ps xmm1, xmm1
divss xmm2, xmm1
comiss xmm2, xmm3
jbe 0x41abaa
divss xmm0, xmm3
call fcn.0040e8c0
call fcn.006cb750
mov ecx, 8
cmp eax, ecx
cmova ecx, eax
mov eax, dword [ebx + 0x1c]
cmp eax, ecx
jae 0x41ab8e
cmp eax, 0x200
jae 0x41ab8c
shl eax, 3
cmp eax, ecx
jae 0x41ab8e
mov eax, ecx
push eax
mov ecx, ebx
call fcn.0041ae40
push esi
lea eax, [edi + 8]
mov ecx, ebx
push eax
lea eax, [ebp - 0x1c]
push eax
call fcn.00410190
mov edx, dword [eax]
jmp 0x41abad
mov edx, dword [ebp - 0x14]
mov eax, dword [ebx + 8]
mov ecx, dword [edx + 4]
inc eax
mov dword [ebx + 8], eax
mov dword [edi], edx
mov dword [edi + 4], ecx
mov dword [ecx], edi
mov dword [edx + 4], edi
mov eax, dword [ebx + 0x18]
mov dword [ebp + 0xc], ecx
and eax, esi
mov ecx, dword [ebx + 0xc]
mov esi, dword [ecx + eax*8]
cmp esi, dword [ebx + 4]
jne 0x41abd9
mov dword [ecx + eax*8], edi
jmp 0x41abeb
cmp esi, edx
jne 0x41abe2
mov dword [ecx + eax*8], edi
jmp 0x41abef
mov edx, dword [ebp + 0xc]
cmp dword [ecx + eax*8 + 4], edx
jne 0x41abef
mov dword [ecx + eax*8 + 4], edi
mov eax, dword [ebp + 8]
mov dword [eax], edi
mov byte [eax + 4], 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
push str.unordered_map_set_too_long
call fcn.0067626b
int3
Function at 0x41cbe0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov edx, dword [ebp + 0x14]
mov eax, dword [ebp + 0xc]
push ebx
push esi
mov esi, dword [ebp + 0x20]
mov dword [edx], eax
mov eax, dword [ebp + 0x18]
push edi
mov dword [esi], eax
mov eax, dword [edx]
mov dword [ebp - 0x10], ecx
cmp eax, dword [ebp + 0x10]
je 0x41cd75
mov dword [ebp - 0xc], 1
mov ecx, dword [esi]
mov edi, 0x3ff
mov dword [ebp - 4], ecx
cmp ecx, dword [ebp + 0x1c]
je 0x41cd72
mov edx, dword [ebp + 8]
xor bl, bl
movzx ecx, word [eax]
mov eax, ecx
mov byte [ebp + 0x1b], bl
movzx edx, word [edx]
cmp word [ebp - 0xc], dx
jae 0x41cc55
lea eax, [ecx + 0x2400]
cmp ax, di
ja 0x41cd88
lea eax, [ecx - 0xdc00]
mov ecx, edx
shl ecx, 0xa
or eax, ecx
jmp 0x41cc6d
add ecx, 0x2800
cmp cx, di
ja 0x41cc6d
add eax, 0xffff2840
mov bl, 1
shl eax, 0xa
mov byte [ebp + 0x1b], bl
cmp eax, 0x80
jae 0x41cc7f
xor edi, edi
mov dl, al
mov ecx, edi
mov dword [ebp - 8], edi
jmp 0x41ccc9
mov edx, eax
cmp eax, 0x800
jae 0x41cc9a
mov edi, 1
shr edx, 6
or dl, 0xc0
mov dword [ebp - 8], edi
mov ecx, edi
jmp 0x41ccc9
cmp eax, 0x10000
jae 0x41ccb3
mov edi, 2
shr edx, 0xc
or dl, 0xe0
mov dword [ebp - 8], edi
mov ecx, edi
jmp 0x41ccc9
shr edx, 0x12
mov edi, 3
movzx ecx, bl
or dl, 0xf0
xor ecx, 1
add ecx, ecx
mov dword [ebp - 8], ecx
lea ebx, [ecx + 1]
mov ecx, dword [ebp + 0x1c]
sub ecx, dword [ebp - 4]
mov dword [ebp - 0x14], ecx
cmp ecx, ebx
jl 0x41cd72
mov esi, dword [ebp + 8]
movzx ecx, word [esi]
mov esi, dword [ebp + 0x20]
test cx, cx
jne 0x41cd12
mov ecx, dword [ebp - 0x10]
test byte [ecx + 0xc], 2
je 0x41cd12
lea ecx, [ebx + 3]
cmp dword [ebp - 0x14], ecx
jl 0x41cd72
mov ecx, dword [ebp - 4]
mov byte [ecx], 0xef
inc dword [esi]
mov ecx, dword [esi]
mov byte [ecx], 0xbb
inc dword [esi]
mov ecx, dword [esi]
mov byte [ecx], 0xbf
inc dword [esi]
mov ecx, dword [ebp + 0x14]
add dword [ecx], 2
cmp byte [ebp + 0x1b], 0
jne 0x41cd23
cmp edi, 3
jae 0x41cd2c
mov ecx, dword [esi]
mov ebx, dword [ebp - 8]
mov byte [ecx], dl
inc dword [esi]
test ebx, ebx
je 0x41cd4f
lea edi, [edi + edi*2]
add edi, edi
sub edi, 6
mov edx, eax
mov ecx, edi
dec ebx
shr edx, cl
mov ecx, dword [esi]
and dl, 0x3f
or dl, 0x80
mov byte [ecx], dl
inc dword [esi]
test ebx, ebx
jg 0x41cd35
shr eax, 0xa
mov ecx, 1
cmp byte [ebp + 0x1b], 0
cmovne ecx, eax
mov eax, dword [ebp + 8]
mov word [eax], cx
mov eax, dword [ebp + 0x14]
mov eax, dword [eax]
cmp eax, dword [ebp + 0x10]
jne 0x41cc0e
mov edx, dword [ebp + 0x14]
mov ecx, dword [ebp + 0xc]
xor eax, eax
cmp ecx, dword [edx]
pop edi
pop esi
sete al
pop ebx
mov esp, ebp
pop ebp
ret 0x1c
pop edi
pop esi
mov eax, 2
pop ebx
mov esp, ebp
pop ebp
ret 0x1c
Function at 0x44a022
Capabilities:
Check os version

Disassembly:
push ebx
push ebp
push esi
push edi
mov esi, ecx
call dword [sym.imp.KERNEL32.DLL_GetVersion]
mov dword [esi], eax
lea edi, [esi + 4]
xor eax, eax
lea ebx, [esi + 0x124]
mov ebp, 0x11c
mov byte [esi + 0x120], al
push ebp
push eax
push edi
mov dword [ebx], eax
call fcn.0068ccc0
mov ecx, dword [esi]
add esp, 0xc
cmp cl, 5
jb 0x44a070
push edi
mov dword [edi], ebp
call dword [sym.imp.KERNEL32.DLL_GetVersionExW]
mov ecx, dword [esi]
test eax, eax
setne al
mov byte [esi + 0x120], al
cmp cl, 6
jb 0x44a098
push str.GetProductInfo
push 0x6f60d8
call fcn.00473e2b
test eax, eax
je 0x44a098
movzx ecx, byte [esi + 1]
push ebx
push 0
push 0
push ecx
movzx ecx, byte [esi]
push ecx
call eax
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
ret

Function at 0x44b046
Capabilities:
Create directory

Disassembly:
mov eax, 0x6cfafe
call fcn.006899cc
sub esp, 0x38
cmp dword [ebp + 8], 0
je 0x44b120
mov eax, dword [ebp + 0xc]
or eax, dword [ebp + 0x10]
je 0x44b120
push edi
lea eax, [ebp - 0x14]
mov edi, 0x7ead1c
push eax
mov ecx, edi
call fcn.0044a83e
mov eax, dword [ebp - 0x14]
add eax, 0x34
setne byte [ebp - 0xd]
test eax, eax
je 0x44b08d
call fcn.00489fdc
and dword [ebp - 4], 0
lea eax, [ebp - 0x44]
push 0x6f6c7c
push eax
call fcn.004848ce
cmp dword [ebp - 0x30], 8
lea eax, [ebp - 0x44]
mov byte [ebp - 4], 1
jb 0x44b0af
mov eax, dword [ebp - 0x44]
push 0
push eax
call dword [sym.imp.KERNEL32.DLL_CreateDirectoryW]
push dword [ebp + 0x14]
lea eax, [ebp - 0x2c]
push eax
call fcn.004849d5
cmp dword [ebp - 0x18], 8
lea eax, [ebp - 0x2c]
mov byte [ebp - 4], 2
jb 0x44b0d4
mov eax, dword [ebp - 0x2c]
push dword [ebp + 0xc]
push dword [ebp + 8]
push eax
call fcn.0047369e
lea eax, [ebp + 0x14]
mov ecx, edi
push eax
call fcn.0044a83e
mov ecx, dword [ebp + 0x14]
call fcn.0049c2fb
push 1
push dword [ebp + 8]
call fcn.0046f19e
lea ecx, [ebp - 0x2c]
call fcn.0044823e
lea ecx, [ebp - 0x44]
call fcn.0044823e
cmp byte [ebp - 0xd], 0
mov dword [ebp - 4], 3
pop edi
je 0x44b120
call fcn.0048a01d
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
leave
ret 0x10