joyce8/EMBER2024-capa huggingface dataset:
Function at 0x427bc0
Capabilities:
Hash data using djb2

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4bd6dd
mov eax, dword fs:[0]
push eax
sub esp, 0x24
push ebx
push esi
push edi
mov eax, dword [0x4f4164]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push dword [ebp + 8]
lea edi, [ecx + 4]
mov dword [ebp - 0x30], 0
lea ecx, [ebp - 0x30]
call fcn.004265c0
mov eax, dword [ebp + 0xc]
mov ecx, dword [eax]
mov eax, dword [eax + 4]
mov dword [ebp - 0x28], ecx
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x30]
mov esi, 0x1505
mov ecx, eax
mov dword [ebp - 4], 0
movzx eax, word [eax]
test ax, ax
je 0x427c3f
mov edx, eax
mov eax, esi
lea ecx, [ecx + 2]
shl esi, 5
add esi, eax
movzx eax, dx
add esi, eax
movzx eax, word [ecx]
mov edx, eax
test ax, ax
jne 0x427c26
push esi
lea eax, [ebp - 0x30]
mov ecx, edi
push eax
lea eax, [ebp - 0x18]
push eax
call fcn.0041c940
cmp dword [ebp - 0x14], 0
je 0x427c5e
mov byte [ebp - 0xd], 0
jmp 0x427d26
cmp dword [edi + 8], 0xaaaaaaa
je 0x427dcf
lea eax, [edi + 4]
mov dword [ebp - 0x20], eax
mov byte [ebp - 4], 1
mov dword [ebp - 0x1c], 0
push 0x18
lfence
call fcn.00450e28
add esp, 4
lea ecx, [ebp - 0x30]
mov ebx, eax
mov dword [ebp - 0x1c], ebx
push ecx
lea ecx, [ebx + 8]
call fcn.00422240
mov ecx, dword [ebp - 0x28]
mov edx, dword [ebp - 0x24]
mov dword [ebx + 0x10], ecx
mov dword [ebx + 0x14], edx
mov ecx, dword [edi + 8]
inc ecx
mov byte [ebp - 4], 2
mov eax, ecx
shr eax, 0x1f
movd xmm0, ecx
cvtdq2pd xmm0, xmm0
addsd xmm0, qword [eax*8 + 0x4cdde0]
mov eax, dword [edi + 0x1c]
cvtpd2ps xmm1, xmm0
movd xmm0, eax
cvtdq2pd xmm0, xmm0
shr eax, 0x1f
addsd xmm0, qword [eax*8 + 0x4cdde0]
cvtpd2ps xmm0, xmm0
divss xmm1, xmm0
comiss xmm1, dword [edi]
seta al
test al, al
je 0x427d15
push ecx
mov ecx, edi
call fcn.0042a6d0
push eax
mov ecx, edi
call fcn.0042a910
push esi
lea eax, [ebx + 8]
mov ecx, edi
push eax
lea eax, [ebp - 0x20]
push eax
call fcn.0041c940
mov ecx, dword [eax]
jmp 0x427d18
mov ecx, dword [ebp - 0x18]
push ebx
push ecx
push esi
mov ecx, edi
call fcn.0042b200
mov byte [ebp - 0xd], 1
mov ecx, dword [ebp - 0x30]
mov dword [ebp - 4], 4
test ecx, ecx
je 0x427dae
mov ebx, dword [ecx - 8]
test ebx, ebx
je 0x427dae
cmp dword [ecx - 0xc], 0xabcd
jne 0x427dd9
cmp dword [ecx - 4], 0xabcd
jne 0x427dd9
mov eax, dword [ebx + 8]
cmp dword [ecx + eax*2 + 2], 0xabcd
jne 0x427dd9
test ebx, ebx
je 0x427dae
cmp byte [ebx + 0x10], 0
je 0x427d83
mov edi, dword [ebx]
lea eax, [ecx - 0xc]
push eax
mov edx, dword [edi]
mov esi, dword [edx + 8]
mov ecx, esi
call dword [0x4c758c]
mov ecx, edi
call esi
cmp byte [ebx + 0x11], 0
mov edi, dword [ebx]
je 0x427d9d
mov eax, dword [edi]
push ebx
mov esi, dword [eax + 8]
mov ecx, esi
call dword [0x4c758c]
mov ecx, edi
call esi
mov eax, dword [edi]
mov esi, dword [eax + 0xc]
mov ecx, esi
call dword [0x4c758c]
mov ecx, edi
call esi
xor ecx, ecx
mov eax, 0xb7
cmp byte [ebp - 0xd], cl
cmovne eax, ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
push str.unordered_map_set_too_long
call fcn.00451caa
push 0
push 0
call fcn.00494de5
int3
Function at 0x429410
Capabilities:
Hash data using djb2

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 8]
sub esp, 8
mov eax, 0x1505
mov edx, dword [edx]
push ebx
push esi
push edi
movzx esi, word [edx]
mov ebx, ecx
test si, si
je 0x429449
nop dword [eax]
mov ecx, eax
lea edx, [edx + 2]
shl eax, 5
add eax, ecx
movzx ecx, si
add eax, ecx
movzx ecx, word [edx]
mov esi, ecx
test cx, cx
jne 0x429430
push eax
push dword [ebp + 8]
lea eax, [ebp - 8]
push eax
lea ecx, [ebx + 4]
call fcn.0041c940
mov ecx, dword [eax + 4]
test ecx, ecx
jne 0x429463
mov ecx, dword [ebx + 8]
xor edx, edx
lea eax, [ecx + 0xc]
cmp dword [ebx + 8], ecx
pop edi
pop esi
cmove eax, edx
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x429530
Capabilities:
Hash data using djb2

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 8]
sub esp, 8
mov eax, 0x1505
mov edx, dword [edx]
push ebx
push esi
push edi
movzx esi, word [edx]
mov ebx, ecx
test si, si
je 0x429569
nop dword [eax]
mov ecx, eax
lea edx, [edx + 2]
shl eax, 5
add eax, ecx
movzx ecx, si
add eax, ecx
movzx ecx, word [edx]
mov esi, ecx
test cx, cx
jne 0x429550
push eax
push dword [ebp + 8]
lea eax, [ebp - 8]
push eax
lea ecx, [ebx + 4]
call fcn.0041c940
mov ecx, dword [eax + 4]
test ecx, ecx
jne 0x429583
mov ecx, dword [ebx + 8]
xor edx, edx
lea eax, [ecx + 0x10]
cmp dword [ebx + 8], ecx
pop edi
pop esi
cmove eax, edx
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x429bf0
Capabilities:
Hash data using djb2

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4bd870
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x4f4164]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, dword [ebp + 8]
lea ebx, [ecx + 4]
mov esi, 0x1505
mov ecx, dword [edi]
movzx eax, word [ecx]
test ax, ax
je 0x429c49
mov edx, eax
nop
mov eax, esi
lea ecx, [ecx + 2]
shl esi, 5
add esi, eax
movzx eax, dx
add esi, eax
movzx eax, word [ecx]
mov edx, eax
test ax, ax
jne 0x429c30
push esi
push edi
lea eax, [ebp - 0x14]
mov ecx, ebx
push eax
call fcn.0041c940
mov edi, dword [eax + 4]
test edi, edi
je 0x429cc3
mov ecx, dword [ebx + 0x18]
mov eax, dword [ebx + 0xc]
and ecx, esi
lea ecx, [eax + ecx*8]
mov eax, dword [ecx]
cmp dword [ecx + 4], edi
jne 0x429c85
cmp eax, edi
jne 0x429c7d
mov eax, dword [ebx + 4]
mov dword [ecx], eax
mov dword [ecx + 4], eax
jmp 0x429c8d
mov eax, dword [edi + 4]
mov dword [ecx + 4], eax
jmp 0x429c8d
cmp eax, edi
jne 0x429c8d
mov eax, dword [edi]
mov dword [ecx], eax
mov ecx, dword [edi]
lea edx, [ebx + 4]
dec dword [edx + 4]
mov eax, dword [edi + 4]
mov dword [eax], ecx
mov eax, dword [edi + 4]
mov dword [ecx + 4], eax
lea eax, [edi + 8]
mov dword [ebp - 4], 0
push eax
push edx
call fcn.0041d1e0
push 0x10
push edi
call fcn.00450975
add esp, 0x10
mov ecx, 1
jmp 0x429cc5
xor ecx, ecx
xor edx, edx
mov eax, 0x490
test ecx, ecx
cmovne eax, edx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x429cf0
Capabilities:
Hash data using djb2

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4bd890
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x4f4164]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov eax, dword [ebp + 8]
mov edx, 0x1505
mov dword [ebp - 0x10], eax
mov esi, dword [eax + 8]
mov edi, dword [esi + 8]
movzx eax, word [edi]
test ax, ax
je 0x429d4c
mov ecx, eax
mov eax, edx
lea edi, [edi + 2]
shl edx, 5
add edx, eax
movzx eax, cx
add edx, eax
movzx eax, word [edi]
mov ecx, eax
test ax, ax
jne 0x429d33
mov ecx, dword [ebx + 0x1c]
mov eax, dword [ebx + 0x10]
and ecx, edx
lea ecx, [eax + ecx*8]
mov eax, dword [ecx]
cmp dword [ecx + 4], esi
jne 0x429d74
cmp eax, esi
jne 0x429d6c
mov eax, dword [ebx + 8]
mov dword [ecx], eax
mov dword [ecx + 4], eax
jmp 0x429d7c
mov eax, dword [esi + 4]
mov dword [ecx + 4], eax
jmp 0x429d7c
cmp eax, esi
jne 0x429d7c
mov eax, dword [esi]
mov dword [ecx], eax
mov edi, dword [esi]
lea ecx, [ebx + 8]
dec dword [ecx + 4]
mov eax, dword [esi + 4]
mov dword [eax], edi
mov eax, dword [esi + 4]
mov dword [edi + 4], eax
lea eax, [esi + 8]
mov dword [ebp - 4], 0
push eax
push ecx
call fcn.0041d1e0
push 0x10
push esi
call fcn.00450975
mov eax, dword [ebp - 0x10]
add esp, 0x10
mov dword [eax + 8], edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x429dd0
Capabilities:
Hash data using djb2

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4bd870
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x4f4164]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, dword [ebp + 8]
lea ebx, [ecx + 4]
mov esi, 0x1505
mov ecx, dword [edi]
movzx eax, word [ecx]
test ax, ax
je 0x429e29
mov edx, eax
nop
mov eax, esi
lea ecx, [ecx + 2]
shl esi, 5
add esi, eax
movzx eax, dx
add esi, eax
movzx eax, word [ecx]
mov edx, eax
test ax, ax
jne 0x429e10
push esi
push edi
lea eax, [ebp - 0x14]
mov ecx, ebx
push eax
call fcn.0041c940
mov edi, dword [eax + 4]
test edi, edi
je 0x429ea3
mov ecx, dword [ebx + 0x18]
mov eax, dword [ebx + 0xc]
and ecx, esi
lea ecx, [eax + ecx*8]
mov eax, dword [ecx]
cmp dword [ecx + 4], edi
jne 0x429e65
cmp eax, edi
jne 0x429e5d
mov eax, dword [ebx + 4]
mov dword [ecx], eax
mov dword [ecx + 4], eax
jmp 0x429e6d
mov eax, dword [edi + 4]
mov dword [ecx + 4], eax
jmp 0x429e6d
cmp eax, edi
jne 0x429e6d
mov eax, dword [edi]
mov dword [ecx], eax
mov ecx, dword [edi]
lea edx, [ebx + 4]
dec dword [edx + 4]
mov eax, dword [edi + 4]
mov dword [eax], ecx
mov eax, dword [edi + 4]
mov dword [ecx + 4], eax
lea eax, [edi + 8]
mov dword [ebp - 4], 0
push eax
push edx
call fcn.0041d260
push 0x10
push edi
call fcn.00450975
add esp, 0x10
mov ecx, 1
jmp 0x429ea5
xor ecx, ecx
xor edx, edx
mov eax, 0x490
test ecx, ecx
cmovne eax, edx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x429ed0
Capabilities:
Hash data using djb2

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4bd890
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x4f4164]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov eax, dword [ebp + 8]
mov edx, 0x1505
mov dword [ebp - 0x10], eax
mov esi, dword [eax + 8]
mov edi, dword [esi + 8]
movzx eax, word [edi]
test ax, ax
je 0x429f2c
mov ecx, eax
mov eax, edx
lea edi, [edi + 2]
shl edx, 5
add edx, eax
movzx eax, cx
add edx, eax
movzx eax, word [edi]
mov ecx, eax
test ax, ax
jne 0x429f13
mov ecx, dword [ebx + 0x1c]
mov eax, dword [ebx + 0x10]
and ecx, edx
lea ecx, [eax + ecx*8]
mov eax, dword [ecx]
cmp dword [ecx + 4], esi
jne 0x429f54
cmp eax, esi
jne 0x429f4c
mov eax, dword [ebx + 8]
mov dword [ecx], eax
mov dword [ecx + 4], eax
jmp 0x429f5c
mov eax, dword [esi + 4]
mov dword [ecx + 4], eax
jmp 0x429f5c
cmp eax, esi
jne 0x429f5c
mov eax, dword [esi]
mov dword [ecx], eax
mov edi, dword [esi]
lea ecx, [ebx + 8]
dec dword [ecx + 4]
mov eax, dword [esi + 4]
mov dword [eax], edi
mov eax, dword [esi + 4]
mov dword [edi + 4], eax
lea eax, [esi + 8]
mov dword [ebp - 4], 0
push eax
push ecx
call fcn.0041d260
push 0x10
push esi
call fcn.00450975
mov eax, dword [ebp - 0x10]
add esp, 0x10
mov dword [eax + 8], edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x429fb0
Capabilities:
Hash data using djb2

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4bd870
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x4f4164]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, dword [ebp + 8]
lea ebx, [ecx + 4]
mov esi, 0x1505
mov ecx, dword [edi]
movzx eax, word [ecx]
test ax, ax
je 0x42a009
mov edx, eax
nop
mov eax, esi
lea ecx, [ecx + 2]
shl esi, 5
add esi, eax
movzx eax, dx
add esi, eax
movzx eax, word [ecx]
mov edx, eax
test ax, ax
jne 0x429ff0
push esi
push edi
lea eax, [ebp - 0x14]
mov ecx, ebx
push eax
call fcn.0041c940
mov edi, dword [eax + 4]
test edi, edi
je 0x42a083
mov ecx, dword [ebx + 0x18]
mov eax, dword [ebx + 0xc]
and ecx, esi
lea ecx, [eax + ecx*8]
mov eax, dword [ecx]
cmp dword [ecx + 4], edi
jne 0x42a045
cmp eax, edi
jne 0x42a03d
mov eax, dword [ebx + 4]
mov dword [ecx], eax
mov dword [ecx + 4], eax
jmp 0x42a04d
mov eax, dword [edi + 4]
mov dword [ecx + 4], eax
jmp 0x42a04d
cmp eax, edi
jne 0x42a04d
mov eax, dword [edi]
mov dword [ecx], eax
mov ecx, dword [edi]
lea edx, [ebx + 4]
dec dword [edx + 4]
mov eax, dword [edi + 4]
mov dword [eax], ecx
mov eax, dword [edi + 4]
mov dword [ecx + 4], eax
lea eax, [edi + 8]
mov dword [ebp - 4], 0
push eax
push edx
call fcn.0041d1e0
push 0x18
push edi
call fcn.00450975
add esp, 0x10
mov ecx, 1
jmp 0x42a085
xor ecx, ecx
xor edx, edx
mov eax, 0x490
test ecx, ecx
cmovne eax, edx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x42a0b0
Capabilities:
Hash data using djb2

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4bd890
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x4f4164]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov eax, dword [ebp + 8]
mov edx, 0x1505
mov dword [ebp - 0x10], eax
mov esi, dword [eax + 8]
mov edi, dword [esi + 8]
movzx eax, word [edi]
test ax, ax
je 0x42a10c
mov ecx, eax
mov eax, edx
lea edi, [edi + 2]
shl edx, 5
add edx, eax
movzx eax, cx
add edx, eax
movzx eax, word [edi]
mov ecx, eax
test ax, ax
jne 0x42a0f3
mov ecx, dword [ebx + 0x1c]
mov eax, dword [ebx + 0x10]
and ecx, edx
lea ecx, [eax + ecx*8]
mov eax, dword [ecx]
cmp dword [ecx + 4], esi
jne 0x42a134
cmp eax, esi
jne 0x42a12c
mov eax, dword [ebx + 8]
mov dword [ecx], eax
mov dword [ecx + 4], eax
jmp 0x42a13c
mov eax, dword [esi + 4]
mov dword [ecx + 4], eax
jmp 0x42a13c
cmp eax, esi
jne 0x42a13c
mov eax, dword [esi]
mov dword [ecx], eax
mov edi, dword [esi]
lea ecx, [ebx + 8]
dec dword [ecx + 4]
mov eax, dword [esi + 4]
mov dword [eax], edi
mov eax, dword [esi + 4]
mov dword [edi + 4], eax
lea eax, [esi + 8]
mov dword [ebp - 4], 0
push eax
push ecx
call fcn.0041d1e0
push 0x18
push esi
call fcn.00450975
mov eax, dword [ebp - 0x10]
add esp, 0x10
mov dword [eax + 8], edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x42a7d0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x4f4164]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, ecx
cmp dword [ebx + 0x38], 0
je 0x42a8ab
cmp byte [ebx + 0x3d], 0
je 0x42a8ab
mov eax, dword [ebx]
push esi
push 0xffffffffffffffff
mov esi, dword [eax + 0xc]
mov ecx, esi
call dword [0x4c758c]
mov ecx, ebx
call esi
cmp eax, 0xffffffff
je 0x42a899
push edi
mov edi, dword [ebx + 0x38]
mov eax, dword [edi]
mov esi, dword [eax + 0x20]
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 4]
mov ecx, esi
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [ebx + 0x40]
push eax
call dword [0x4c758c]
mov ecx, edi
call esi
pop edi
sub eax, 0
je 0x42a85e
sub eax, 1
je 0x42a862
sub eax, 2
jne 0x42a899
mov byte [ebx + 0x3d], al
mov al, 1
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00450df0
mov esp, ebp
pop ebp
ret
mov byte [ebx + 0x3d], 0
mov esi, dword [ebp - 0x28]
lea eax, [ebp - 0x24]
sub esi, eax
je 0x42a882
lfence
push dword [ebx + 0x4c]
push esi
push 1
push eax
call fcn.0049e277
add esp, 0x10
cmp esi, eax
jne 0x42a899
cmp byte [ebx + 0x3d], 0
pop esi
sete al
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00450df0
mov esp, ebp
pop ebp
ret
pop esi
xor al, al
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00450df0
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
mov al, 1
xor ecx, ebp
pop ebx
call fcn.00450df0
mov esp, ebp
pop ebp
ret
Function at 0x42add0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov edx, dword [ebp + 8]
mov eax, 0x1fffffff
push ebx
push esi
push edi
mov edi, ecx
mov esi, 1
bsr ecx, eax
mov eax, esi
mov dword [ebp - 0x14], edi
shl eax, cl
cmp edx, eax
ja 0x42af51
mov ebx, dword [edi + 4]
lea eax, [edx - 1]
or eax, esi
mov dword [ebp - 0x10], ebx
bsr ecx, eax
push ebx
lea ecx, [ecx + 1]
shl esi, cl
lea ecx, [edi + 0xc]
lea eax, [esi + esi]
push eax
call fcn.0042a340
lea eax, [esi - 1]
mov dword [edi + 0x1c], esi
mov dword [edi + 0x18], eax
mov eax, dword [edi + 4]
mov eax, dword [eax]
cmp eax, ebx
je 0x42af29
mov edi, eax
cmp dword [edi + 0x1c], 0x10
lea ebx, [edi + 8]
mov eax, dword [eax]
mov edx, dword [ebx + 0x10]
mov dword [ebp - 4], eax
mov dword [ebp - 0xc], edx
mov dword [ebp - 8], ebx
jb 0x42ae4e
mov ecx, dword [ebx]
mov dword [ebp - 8], ecx
xor ecx, ecx
mov esi, 0x811c9dc5
test edx, edx
je 0x42ae77
mov ebx, dword [ebp - 8]
mov eax, dword [ebp - 0xc]
nop
movzx edx, byte [ecx + ebx]
inc ecx
xor edx, esi
imul esi, edx, 0x1000193
cmp ecx, eax
jb 0x42ae60
mov eax, dword [ebp - 4]
lea ebx, [edi + 8]
mov ecx, dword [ebp - 0x14]
mov edx, dword [ecx + 0x18]
mov ecx, dword [ecx + 0xc]
and edx, esi
lea ecx, [ecx + edx*8]
mov edx, dword [ecx]
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
cmp edx, dword [ebp - 0x10]
jne 0x42ae9c
mov dword [ecx], edi
mov dword [ecx + 4], edi
jmp 0x42af1e
mov esi, dword [ecx + 4]
lea eax, [esi + 8]
push eax
push ebx
call fcn.0041b450
add esp, 8
test al, al
je 0x42aed9
mov ebx, dword [esi]
mov eax, dword [ebp - 4]
cmp ebx, edi
je 0x42aed1
mov esi, dword [edi + 4]
mov dword [esi], eax
mov edx, dword [eax + 4]
mov dword [edx], ebx
mov ecx, dword [ebx + 4]
mov dword [ecx], edi
mov dword [ebx + 4], edx
mov dword [eax + 4], esi
mov dword [edi + 4], ecx
mov ecx, dword [ebp - 0xc]
mov dword [ecx + 4], edi
jmp 0x42af1e
mov ebx, esi
cmp dword [ebp - 8], esi
je 0x42aefe
mov esi, dword [esi + 4]
mov ebx, esi
lea eax, [ebx + 8]
push eax
lea eax, [edi + 8]
push eax
call fcn.0041b450
add esp, 8
test al, al
jne 0x42af32
cmp dword [ebp - 8], esi
jne 0x42aee0
mov esi, dword [edi + 4]
mov eax, dword [ebp - 4]
mov dword [esi], eax
mov edx, dword [eax + 4]
mov dword [edx], ebx
mov ecx, dword [ebx + 4]
mov dword [ecx], edi
mov dword [ebx + 4], edx
mov dword [eax + 4], esi
mov dword [edi + 4], ecx
mov ecx, dword [ebp - 0xc]
mov dword [ecx], edi
mov edi, eax
cmp eax, dword [ebp - 0x10]
jne 0x42ae32
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
mov ebx, dword [esi]
mov esi, dword [edi + 4]
mov eax, dword [ebp - 4]
mov dword [esi], eax
mov edx, dword [eax + 4]
mov dword [edx], ebx
mov ecx, dword [ebx + 4]
mov dword [ecx], edi
mov dword [ebx + 4], edx
mov dword [eax + 4], esi
mov dword [edi + 4], ecx
jmp 0x42af1e
push str.invalid_hash_bucket_count
call fcn.00451caa
int3
Function at 0x42b090
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4bd910
mov eax, dword fs:[0]
push eax
push esi
push edi
mov eax, dword [0x4f4164]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
push 8
mov dword [esi + 0x30], 0
mov dword [esi + 8], 0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0x201
mov dword [esi + 0x18], 6
mov dword [esi + 0x1c], 0
mov dword [esi + 0x20], 0
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x2c], 0
mov dword [esi + 0xc], 0
call fcn.00450e28
mov edi, eax
add esp, 4
test edi, edi
je 0x42b13b
push 1
mov dword [ebp - 4], 0
call fcn.00452464
mov dword [edi + 4], eax
add esp, 4
mov dword [esi + 0x30], edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
mov dword [esi + 0x30], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x431a80
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
mov eax, dword [0x4f4164]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push edi
mov edi, ecx
cmp ebx, 0xffffffff
jne 0x431ab0
pop edi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00450df0
mov esp, ebp
pop ebp
ret 4
mov eax, dword [edi + 0x20]
push esi
mov ecx, dword [eax]
test ecx, ecx
je 0x431aec
mov edx, dword [edi + 0x30]
mov esi, dword [edx]
lea eax, [esi + ecx]
cmp ecx, eax
jae 0x431aec
lea ecx, [esi - 1]
mov dword [edx], ecx
mov edx, dword [edi + 0x20]
mov esi, dword [edx]
lea ecx, [esi + 1]
mov dword [edx], ecx
mov byte [esi], bl
pop esi
pop edi
mov eax, ebx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00450df0
mov esp, ebp
pop ebp
ret 4
cmp dword [edi + 0x4c], 0
je 0x431be5
mov esi, dword [edi + 0xc]
lea eax, [edi + 0x3c]
cmp dword [esi], eax
jne 0x431b14
mov edx, dword [edi + 0x54]
mov ecx, dword [edi + 0x50]
sub edx, ecx
mov dword [esi], ecx
mov eax, dword [edi + 0x1c]
mov dword [eax], ecx
mov eax, dword [edi + 0x2c]
mov dword [eax], edx
mov eax, dword [edi + 0x38]
mov dword [ebp - 0x2c], eax
test eax, eax
jne 0x431b4a
push dword [edi + 0x4c]
movsx eax, bl
push eax
call fcn.0049d900
add esp, 8
or ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, ebx
pop esi
pop edi
mov eax, ecx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00450df0
mov esp, ebp
pop ebp
ret 4
mov byte [ebp - 0x28], bl
mov eax, dword [eax]
mov esi, dword [eax + 0x1c]
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 4]
mov ecx, esi
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x34]
push eax
lea eax, [ebp - 0x27]
push eax
lea eax, [ebp - 0x28]
push eax
lea eax, [edi + 0x40]
push eax
call dword [0x4c758c]
mov ecx, dword [ebp - 0x2c]
call esi
sub eax, 0
je 0x431bb5
sub eax, 1
je 0x431bb5
sub eax, 2
jne 0x431be5
push dword [edi + 0x4c]
push dword [ebp - 0x28]
call fcn.0041cb10
add esp, 8
or ecx, 0xffffffff
test al, al
cmovne ecx, ebx
pop esi
pop edi
mov eax, ecx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00450df0
mov esp, ebp
pop ebp
ret 4
mov esi, dword [ebp - 0x30]
lea eax, [ebp - 0x24]
sub esi, eax
je 0x431bd5
lfence
push dword [edi + 0x4c]
push esi
push 1
push eax
call fcn.0049e277
add esp, 0x10
cmp esi, eax
jne 0x431be5
lea eax, [ebp - 0x28]
mov byte [edi + 0x3d], 1
cmp dword [ebp - 0x34], eax
jne 0x431ad7
mov ecx, dword [ebp - 4]
or eax, 0xffffffff
pop esi
pop edi
xor ecx, ebp
pop ebx
call fcn.00450df0
mov esp, ebp
pop ebp
ret 4
Function at 0x435d40
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
cmp dword [ecx + 0x38], 0
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
je 0x435e21
mov esi, dword [ebp + 0x10]
mov ebx, esi
mov edx, dword [ebp + 0xc]
mov edi, edx
mov eax, dword [ebp + 8]
mov dword [ebp - 8], eax
test esi, esi
jl 0x435e10
jg 0x435d78
test edx, edx
je 0x435e10
call fcn.0042b420
mov esi, eax
mov eax, edx
mov dword [ebp - 0xc], eax
test eax, eax
jl 0x435dc6
jg 0x435d8e
test esi, esi
je 0x435dc6
cmp ebx, eax
jg 0x435d9d
jl 0x435d98
cmp edi, esi
jae 0x435d9d
mov esi, edi
mov dword [ebp - 0xc], ebx
mov eax, dword [ebp - 8]
push esi
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x20]
push dword [eax]
call fcn.00495210
mov ecx, dword [ebp - 4]
add esp, 0xc
sub edi, esi
sbb ebx, dword [ebp - 0xc]
mov eax, dword [ecx + 0x30]
sub dword [eax], esi
mov eax, dword [ecx + 0x20]
add dword [eax], esi
jmp 0x435df5
mov eax, dword [ebp - 4]
mov eax, dword [eax]
mov esi, dword [eax + 0xc]
mov ecx, esi
mov eax, dword [ebp - 8]
movzx eax, byte [eax]
push eax
call dword [0x4c758c]
mov ecx, dword [ebp - 4]
call esi
cmp eax, 0xffffffff
je 0x435e0a
mov ecx, dword [ebp - 4]
add edi, 0xffffffff
mov esi, 1
adc ebx, 0xffffffff
add dword [ebp - 8], esi
test ebx, ebx
jg 0x435d78
jl 0x435e0a
test edi, edi
jne 0x435d78
mov edx, dword [ebp + 0xc]
mov esi, dword [ebp + 0x10]
sub edx, edi
pop edi
sbb esi, ebx
mov eax, edx
mov edx, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov eax, dword [ecx + 0x20]
mov esi, dword [ebp + 0xc]
mov edi, dword [ebp + 0x10]
mov dword [ebp - 0x10], esi
mov eax, dword [eax]
mov dword [ebp - 0x14], edi
mov dword [ebp - 8], eax
test eax, eax
je 0x435e40
mov eax, dword [ecx + 0x30]
mov eax, dword [eax]
jmp 0x435e42
xor eax, eax
cdq
mov ebx, eax
mov eax, edx
mov dword [ebp - 0xc], eax
test edi, edi
jl 0x435ebb
jg 0x435e54
test esi, esi
je 0x435ebb
test eax, eax
jl 0x435e9f
jg 0x435e5e
test ebx, ebx
je 0x435e9f
cmp edi, eax
jg 0x435e6d
jl 0x435e68
cmp esi, ebx
jae 0x435e6d
mov ebx, esi
mov dword [ebp - 0xc], edi
push ebx
push dword [ebp + 8]
push dword [ebp - 8]
call fcn.00495210
mov ecx, dword [ebp - 4]
add esp, 0xc
mov edx, dword [ebp + 8]
sub esi, ebx
sbb edi, dword [ebp - 0xc]
add edx, ebx
mov eax, dword [ecx + 0x30]
sub dword [eax], ebx
mov eax, dword [ecx + 0x20]
add dword [eax], ebx
test edi, edi
jl 0x435ebb
jg 0x435ea2
test esi, esi
je 0x435ebb
jmp 0x435ea2
mov edx, dword [ebp + 8]
mov eax, dword [ecx + 0x4c]
test eax, eax
je 0x435ebb
push eax
push esi
push 1
push edx
call fcn.0049e277
add esp, 0x10
sub esi, eax
sbb edi, 0
mov eax, dword [ebp - 0x10]
mov edx, dword [ebp - 0x14]
sub eax, esi
sbb edx, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc