joyce8/EMBER2024-capa huggingface dataset:
Function at 0x402340
Capabilities:
Hook routines via microsoft detours

Disassembly:
push ebx
push esi
mov esi, ecx
push edi
cmp esi, 0x7ff80000
jbe 0x402362
lea edi, [esi - 0x7ff80000]
cmp esi, 0x80000000
jb 0x402367
mov ebx, 0xfff80000
jmp 0x40236d
mov edi, 0x10000
lea ebx, [esi + 0x7ff80000]
mov edx, dword [0x48cd44]
mov eax, dword [0x48cd4c]
test edx, edx
jne 0x402388
test eax, eax
je 0x40239b
mov edx, eax
mov dword [0x48cd44], edx
mov ecx, dword [edx + 8]
test ecx, ecx
je 0x40239b
cmp ecx, edi
jb 0x40239b
cmp ecx, ebx
jbe 0x402490
mov edx, eax
mov dword [0x48cd44], edx
test eax, eax
je 0x4023cd
mov ecx, eax
mov eax, dword [ecx + 8]
test eax, eax
je 0x4023bc
cmp eax, edi
jb 0x4023bc
cmp eax, ebx
jbe 0x402490
mov edx, dword [edx + 4]
mov eax, edx
mov dword [0x48cd44], edx
mov ecx, edx
test eax, eax
jne 0x4023a9
and esi, 0xffff0000
lea eax, [esi - 0x40000000]
cmp esi, 0x40000000
jbe 0x4024b7
mov edx, eax
mov ecx, edi
call fcn.00402260
mov edx, eax
test edx, edx
jne 0x40244e
lea eax, [esi - 0x40000000]
cmp esi, 0x40000000
jbe 0x402417
mov edx, esi
mov ecx, eax
call fcn.00402180
mov edx, eax
test edx, edx
jne 0x40244e
cmp esi, 0x40000000
jae 0x40242c
lea edx, [esi + 0x40000000]
mov ecx, esi
call fcn.00402260
mov edx, eax
test edx, edx
jne 0x40244e
mov edx, esi
mov ecx, edi
call fcn.00402260
mov edx, eax
test edx, edx
jne 0x40244e
mov edx, ebx
mov ecx, esi
call fcn.00402180
mov edx, eax
test edx, edx
je 0x4024d9
mov dword [edx], 0x52727464
xor ecx, ecx
mov dword [edx + 8], 0
mov esi, 0x38b
mov eax, dword [0x48cd4c]
mov dword [edx + 4], eax
lea eax, [edx + 0xffa8]
mov dword [0x48cd44], edx
mov dword [0x48cd4c], edx
nop dword [eax]
mov dword [eax + 0x40], ecx
mov ecx, eax
sub eax, 0x48
sub esi, 1
jne 0x402480
mov dword [edx + 8], ecx
mov esi, dword [edx + 8]
cmp esi, edi
jb 0x4024d9
cmp esi, ebx
ja 0x4024d9
mov ecx, dword [esi + 0x40]
push 0x48
push 0xcc
push esi
mov dword [edx + 8], ecx
call fcn.00412360
add esp, 0xc
mov eax, esi
pop edi
pop esi
pop ebx
ret
jae 0x4023fa
lea ecx, [esi + 0x40000000]
mov edx, ebx
call fcn.00402180
mov edx, eax
test edx, edx
jne 0x40244e
jmp 0x402419
pop edi
pop esi
xor eax, eax
pop ebx
ret
Function at 0x4024e0
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [0x443040]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, ecx
test esi, esi
jne 0x402508
xor eax, eax
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0040fc87
mov esp, ebp
pop ebp
ret
cmp byte [esi], 0xff
mov ecx, dword [sym.imp.KERNEL32.dll_VirtualQuery]
push ebx
push edi
mov ebx, 0x5a4d
jne 0x402577
cmp byte [esi + 1], 0x25
jne 0x402577
mov edi, dword [esi + 2]
lea eax, [ebp - 0x20]
push 0x1c
push eax
push esi
call ecx
mov edx, dword [ebp - 0x1c]
cmp word [edx], bx
jne 0x402571
mov ecx, dword [edx + 0x3c]
cmp dword [ecx + edx], 0x4550
jne 0x402571
mov ebx, dword [ecx + edx + 0xd8]
lea eax, [ebx + edx]
cmp edi, eax
jb 0x40256c
mov eax, dword [ecx + edx + 0xdc]
mov ecx, dword [sym.imp.KERNEL32.dll_VirtualQuery]
add eax, ebx
add eax, edx
mov ebx, 0x5a4d
cmp edi, eax
jae 0x402577
mov esi, dword [edi]
jmp 0x402577
mov ebx, 0x5a4d
mov ecx, dword [sym.imp.KERNEL32.dll_VirtualQuery]
cmp byte [esi], 0xeb
jne 0x4025ef
movsx eax, byte [esi + 1]
add esi, 2
add esi, eax
mov al, byte [esi]
cmp al, 0xff
jne 0x4025e3
cmp byte [esi + 1], 0x25
jne 0x4025ef
mov edi, dword [esi + 2]
lea eax, [ebp - 0x20]
push 0x1c
push eax
push esi
call ecx
mov edx, dword [ebp - 0x1c]
cmp word [edx], bx
jne 0x4025ef
mov ecx, dword [edx + 0x3c]
cmp dword [ecx + edx], 0x4550
jne 0x4025ef
mov ebx, dword [ecx + edx + 0xd8]
lea eax, [ebx + edx]
cmp edi, eax
jb 0x4025ef
mov eax, dword [ecx + edx + 0xdc]
add eax, ebx
add eax, edx
cmp edi, eax
jae 0x4025ef
mov esi, dword [edi]
mov eax, esi
pop edi
pop ebx
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0040fc87
mov esp, ebp
pop ebp
ret
cmp al, 0xe9
jne 0x4025ef
mov ecx, dword [esi + 1]
add esi, 5
add esi, ecx
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
pop ebx
xor ecx, ebp
pop esi
call fcn.0040fc87
mov esp, ebp
pop ebp
ret

Function at 0x402610
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [0x443040]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [0x48cd40], 0
jne 0x40268d
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov ecx, eax
mov edx, 0x48cd40
xor eax, eax
lock cmpxchg dword [edx], ecx
test eax, eax
jne 0x40268d
push esi
mov esi, dword [0x48cd4c]
mov dword [0x48cd54], eax
mov dword [0x48cd50], eax
mov dword [0x48cd3c], eax
mov dword [0x48cd48], eax
test esi, esi
je 0x40267c
push edi
mov edi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [ebp - 8]
push eax
push 0x40
push 0x10000
push esi
call edi
mov esi, dword [esi + 4]
test esi, esi
jne 0x402666
pop edi
xor eax, eax
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0040fc87
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
mov eax, 0x10dd
xor ecx, ebp
call fcn.0040fc87
mov esp, ebp
pop ebp
ret
Function at 0x405760
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x110
mov eax, dword [0x443040]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov edi, ecx
mov ebx, edx
push 0
push edi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
mov edx, dword [0x48cc2c]
push edx
push edi
push edi
lea eax, [edx + 1]
mov dword [0x48cc2c], eax
lea eax, [ebp - 0x110]
push str._s__s__d.bin
push eax
call fcn.00409b90
add esp, 0x14
lea eax, [ebp - 0x110]
push 0x43e058
push eax
call fcn.004156f5
mov esi, eax
add esp, 8
test esi, esi
je 0x4057e8
push esi
push 1
push dword [ebp + 8]
push ebx
call fcn.0041b5a9
push esi
call fcn.00415ada
add esp, 0x14
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0040fc87
mov esp, ebp
pop ebp
ret
push edi
lea eax, [ebp - 0x110]
push eax
push str.Cant_open__s_file_to_write__s_dump_n
call fcn.00401a70
mov ecx, dword [ebp - 4]
add esp, 0xc
xor ecx, ebp
pop edi
pop esi
pop ebx
call fcn.0040fc87
mov esp, ebp
pop ebp
ret
Function at 0x407960
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x14
mov eax, dword [ebp + 0x10]
push ebx
mov ebx, ecx
mov ecx, dword [ebp + 0xc]
push esi
push edi
mov edi, dword [ebp + 8]
mov dword [esp + 0xc], edi
test eax, eax
jg 0x407992
jl 0x407985
test ecx, ecx
jne 0x407992
xor eax, eax
xor edx, edx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
cmp dword [ebx + 0x38], 0
je 0x407a6f
mov dword [esp + 0x10], eax
lea eax, [ebx + 0x2c]
mov dword [esp + 0xc], ecx
mov dword [esp + 0x14], eax
mov eax, dword [ebx + 0x1c]
mov eax, dword [eax]
mov dword [esp + 0x18], eax
test eax, eax
je 0x4079c2
mov eax, dword [esp + 0x14]
mov eax, dword [eax]
mov eax, dword [eax]
jmp 0x4079c4
xor eax, eax
cdq
mov dword [esp + 0x1c], edx
mov esi, eax
test edx, edx
jl 0x407a18
jg 0x4079d5
test esi, esi
je 0x407a18
mov eax, dword [esp + 0x10]
cmp eax, edx
jg 0x4079e9
jl 0x4079e3
cmp ecx, esi
jae 0x4079e9
mov esi, ecx
mov dword [esp + 0x1c], eax
push esi
push dword [esp + 0x1c]
push edi
call fcn.00412570
mov eax, dword [esp + 0x20]
add esp, 0xc
mov ecx, dword [esp + 0xc]
mov edx, dword [esp + 0x10]
sub ecx, esi
mov eax, dword [eax]
sbb edx, dword [esp + 0x1c]
sub dword [eax], esi
mov eax, dword [ebx + 0x1c]
add dword [eax], esi
mov eax, dword [esp + 0x14]
jmp 0x407a3c
mov eax, dword [ebx]
mov ecx, ebx
call dword [eax + 0x1c]
mov edx, dword [esp + 0x10]
cmp eax, 0xffffffff
je 0x407a58
mov ecx, dword [esp + 0xc]
mov esi, 1
add ecx, 0xffffffff
mov byte [edi], al
lea eax, [ebx + 0x2c]
adc edx, 0xffffffff
add edi, esi
mov dword [esp + 0x10], edx
mov dword [esp + 0xc], ecx
test edx, edx
jg 0x4079a7
jl 0x407a58
test ecx, ecx
jne 0x4079a7
mov eax, dword [ebp + 0xc]
sub eax, dword [esp + 0xc]
mov ecx, dword [ebp + 0x10]
sbb ecx, edx
mov edx, ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov eax, dword [ebx + 0x1c]
lea esi, [ebx + 0x2c]
mov edi, ecx
mov edx, dword [eax]
test edx, edx
je 0x407ab3
mov eax, dword [esi]
mov eax, dword [eax]
test eax, eax
je 0x407ab3
mov edi, dword [esp + 0xc]
cmp eax, ecx
mov esi, ecx
cmovb esi, eax
push esi
push edx
push edi
call fcn.00412570
mov eax, dword [ebx + 0x2c]
add edi, esi
mov dword [esp + 0x18], edi
add esp, 0xc
mov edi, dword [ebp + 0xc]
sub edi, esi
sub dword [eax], esi
mov eax, dword [ebx + 0x1c]
add dword [eax], esi
lea esi, [ebx + 0x2c]
cmp dword [ebx + 0x4c], 0
je 0x407b1c
mov ecx, dword [ebx + 0xc]
lea eax, [ebx + 0x3c]
cmp dword [ecx], eax
jne 0x407ad9
mov eax, dword [ebx + 0xc]
mov edx, dword [ebx + 0x54]
mov ecx, dword [ebx + 0x50]
sub edx, ecx
mov dword [eax], ecx
mov eax, dword [ebx + 0x1c]
mov dword [eax], ecx
mov eax, dword [esi]
mov dword [eax], edx
mov esi, dword [esp + 0xc]
cmp edi, 0xfff
jbe 0x407b07
push dword [ebx + 0x4c]
push 0xfff
push 1
push esi
call fcn.0041c4fc
add esp, 0x10
add esi, eax
sub edi, eax
cmp eax, 0xfff
jne 0x407b1c
cmp edi, eax
ja 0x407ae5
test edi, edi
je 0x407b1c
push dword [ebx + 0x4c]
push edi
push 1
push esi
call fcn.0041c4fc
add esp, 0x10
sub edi, eax
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 0x10]
sub eax, edi
pop edi
pop esi
sbb edx, 0
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x409ce0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x432e45
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push ebx
push esi
push edi
mov eax, dword [0x443040]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edx, dword [ebp + 0xc]
mov edi, edx
mov ebx, dword [ebp + 8]
mov dword [ebp - 0x10], edx
cmp dword [edx + 0x14], 0xf
jbe 0x409d1b
mov edi, dword [edx]
xor ecx, ecx
mov esi, 0x811c9dc5
cmp dword [edx + 0x10], ecx
jbe 0x409d39
movzx eax, byte [edi + ecx]
inc ecx
xor eax, esi
imul esi, eax, 0x1000193
cmp ecx, dword [edx + 0x10]
jb 0x409d27
push esi
push edx
lea eax, [ebp - 0x18]
push eax
call fcn.0040ac80
mov eax, dword [ebp - 0x14]
test eax, eax
je 0x409d56
mov dword [ebx], eax
mov byte [ebx + 4], 0
jmp 0x409eb5
cmp dword [0x48cd24], 0x71c71c7
je 0x409ecb
mov dword [ebp - 0x20], 0x48cd20
mov dword [ebp - 4], 0
push 0x24
mov dword [ebp - 0x1c], 0
call fcn.00410117
add esp, 4
mov edi, eax
mov dword [ebp - 0x1c], edi
push dword [ebp - 0x10]
lea ecx, [edi + 8]
call fcn.00408d60
mov dword [edi + 0x20], 0
mov dword [ebp - 4], 1
mov edx, dword [0x48cd24]
lea eax, [edx + 1]
movd xmm0, eax
cvtdq2pd xmm0, xmm0
shr eax, 0x1f
addsd xmm0, qword [eax*8 + 0x43f8f0]
mov eax, dword [0x48cd38]
cvtpd2ps xmm2, xmm0
movd xmm0, eax
cvtdq2pd xmm0, xmm0
shr eax, 0x1f
movaps xmm1, xmm2
addsd xmm0, qword [eax*8 + 0x43f8f0]
cvtpd2ps xmm0, xmm0
divss xmm1, xmm0
movss xmm0, dword [0x48cd1c]
comiss xmm1, xmm0
jbe 0x409e64
divss xmm2, xmm0
sub esp, 8
cvtps2pd xmm0, xmm2
movsd qword [ebp - 0x18], xmm0
fld qword [ebp - 0x18]
fstp qword [esp]
call fcn.00430be0
fstp qword [ebp - 0x18]
movsd xmm0, qword [ebp - 0x18]
add esp, 8
cvtpd2ps xmm0, xmm0
call fcn.004326a0
mov ecx, 8
cmp eax, ecx
cmova ecx, eax
mov eax, dword [0x48cd38]
cmp eax, ecx
jae 0x409e46
cmp eax, 0x200
jae 0x409e44
shl eax, 3
cmp eax, ecx
jae 0x409e46
mov eax, ecx
push eax
call fcn.0040a790
push esi
lea eax, [edi + 8]
push eax
lea eax, [ebp - 0x20]
push eax
call fcn.0040ac80
mov edx, dword [0x48cd24]
mov ecx, dword [eax]
jmp 0x409e67
mov ecx, dword [ebp - 0x18]
mov eax, dword [ecx + 4]
inc edx
mov dword [0x48cd24], edx
mov dword [edi], ecx
mov dword [edi + 4], eax
mov dword [eax], edi
mov dword [ecx + 4], edi
and esi, dword [0x48cd34]
mov dword [ebp - 0x10], eax
mov eax, dword [0x48cd28]
mov edx, dword [eax + esi*8]
cmp edx, dword [0x48cd20]
jne 0x409e99
mov dword [eax + esi*8], edi
jmp 0x409eab
cmp edx, ecx
jne 0x409ea2
mov dword [eax + esi*8], edi
jmp 0x409eaf
mov ecx, dword [ebp - 0x10]
cmp dword [eax + esi*8 + 4], ecx
jne 0x409eaf
mov dword [eax + esi*8 + 4], edi
mov dword [ebx], edi
mov byte [ebx + 4], 1
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
push str.unordered_map_set_too_long
call fcn.00410d0d
int3
Function at 0x40a790
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1fffffff
sub esp, 0x10
bsr ecx, eax
push ebx
push esi
mov esi, 1
mov eax, esi
shl eax, cl
mov ecx, dword [ebp + 8]
push edi
cmp ecx, eax
ja 0x40a90f
lea eax, [ecx - 1]
or eax, esi
bsr ecx, eax
mov eax, dword [0x48cd20]
push eax
mov dword [ebp - 8], eax
lea ecx, [ecx + 1]
shl esi, cl
mov ecx, 0x48cd28
lea eax, [esi + esi]
push eax
call fcn.00409960
lea eax, [esi - 1]
mov dword [0x48cd38], esi
mov esi, dword [0x48cd20]
mov dword [0x48cd34], eax
mov eax, dword [ebp - 8]
mov esi, dword [esi]
mov edi, esi
cmp esi, eax
je 0x40a8ea
nop dword [eax]
cmp dword [esi + 0x1c], 0xf
lea ecx, [esi + 8]
mov edi, dword [edi]
mov dword [ebp - 0x10], edi
mov dword [ebp - 4], ecx
jbe 0x40a816
mov edx, dword [ecx]
mov dword [ebp - 4], edx
mov ecx, dword [ecx + 0x10]
xor edx, edx
mov dword [ebp - 0xc], ecx
mov ebx, 0x811c9dc5
test ecx, ecx
je 0x40a847
mov eax, dword [ebp - 4]
mov edi, ecx
nop dword [eax]
movzx ecx, byte [eax + edx]
inc edx
xor ecx, ebx
imul ebx, ecx, 0x1000193
cmp edx, edi
jb 0x40a830
mov edi, dword [ebp - 0x10]
mov eax, dword [ebp - 8]
and ebx, dword [0x48cd34]
mov ecx, dword [0x48cd28]
lea ecx, [ecx + ebx*8]
mov dword [ebp - 4], ecx
cmp dword [ecx], eax
jne 0x40a864
mov dword [ecx], esi
mov dword [ecx + 4], esi
jmp 0x40a8e0
mov ebx, dword [ecx + 4]
lea eax, [ebx + 8]
push eax
lea eax, [esi + 8]
push eax
call fcn.0040af10
test al, al
jne 0x40a89e
mov ebx, dword [ebx]
cmp ebx, esi
je 0x40a896
mov edx, dword [esi + 4]
mov dword [edx], edi
mov ecx, dword [edi + 4]
mov dword [ecx], ebx
mov eax, dword [ebx + 4]
mov dword [eax], esi
mov dword [ebx + 4], ecx
mov dword [edi + 4], edx
mov dword [esi + 4], eax
mov eax, dword [ebp - 4]
mov dword [eax + 4], esi
jmp 0x40a8dd
mov eax, dword [ebp - 4]
cmp dword [eax], ebx
je 0x40a8c0
mov ebx, dword [ebx + 4]
lea eax, [ebx + 8]
push eax
lea eax, [esi + 8]
push eax
call fcn.0040af10
test al, al
je 0x40a8f3
mov eax, dword [ebp - 4]
cmp dword [eax], ebx
jne 0x40a8a5
mov edx, dword [esi + 4]
mov dword [edx], edi
mov ecx, dword [edi + 4]
mov dword [ecx], ebx
mov eax, dword [ebx + 4]
mov dword [eax], esi
mov dword [ebx + 4], ecx
mov dword [edi + 4], edx
mov dword [esi + 4], eax
mov eax, dword [ebp - 4]
mov dword [eax], esi
mov eax, dword [ebp - 8]
mov esi, edi
cmp edi, eax
jne 0x40a800
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
mov edx, dword [esi + 4]
mov ebx, dword [ebx]
mov dword [edx], edi
mov ecx, dword [edi + 4]
mov dword [ecx], ebx
mov eax, dword [ebx + 4]
mov dword [eax], esi
mov dword [ebx + 4], ecx
mov dword [edi + 4], edx
mov dword [esi + 4], eax
jmp 0x40a8dd
push str.invalid_hash_bucket_count
call fcn.00410d0d
int3
Function at 0x40ad10
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x432e45
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push ebx
push esi
push edi
mov eax, dword [0x443040]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edx, dword [ebp + 0xc]
mov edi, edx
mov ebx, dword [ebp + 8]
mov dword [ebp - 0x10], edx
cmp dword [edx + 0x14], 0xf
jbe 0x40ad4b
mov edi, dword [edx]
xor ecx, ecx
mov esi, 0x811c9dc5
cmp dword [edx + 0x10], ecx
jbe 0x40ad69
movzx eax, byte [edi + ecx]
inc ecx
xor eax, esi
imul esi, eax, 0x1000193
cmp ecx, dword [edx + 0x10]
jb 0x40ad57
push esi
push edx
lea eax, [ebp - 0x18]
push eax
call fcn.0040ac80
mov eax, dword [ebp - 0x14]
test eax, eax
je 0x40ad86
mov dword [ebx], eax
mov byte [ebx + 4], 0
jmp 0x40aee9
cmp dword [0x48cd24], 0x71c71c7
je 0x40aeff
mov dword [ebp - 0x20], 0x48cd20
mov dword [ebp - 4], 0
push 0x24
mov dword [ebp - 0x1c], 0
call fcn.00410117
add esp, 4
mov edi, eax
mov dword [ebp - 0x1c], edi
push dword [ebp - 0x10]
lea ecx, [edi + 8]
call fcn.00408d60
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax + 0x18]
mov dword [edi + 0x20], ecx
mov dword [ebp - 4], 1
mov ecx, dword [0x48cd24]
lea eax, [ecx + 1]
movd xmm0, eax
cvtdq2pd xmm0, xmm0
shr eax, 0x1f
addsd xmm0, qword [eax*8 + 0x43f8f0]
mov eax, dword [0x48cd38]
cvtpd2ps xmm2, xmm0
movd xmm0, eax
cvtdq2pd xmm0, xmm0
shr eax, 0x1f
movaps xmm1, xmm2
addsd xmm0, qword [eax*8 + 0x43f8f0]
cvtpd2ps xmm0, xmm0
divss xmm1, xmm0
movss xmm0, dword [0x48cd1c]
comiss xmm1, xmm0
jbe 0x40ae96
divss xmm2, xmm0
sub esp, 8
cvtps2pd xmm0, xmm2
movsd qword [ebp - 0x18], xmm0
fld qword [ebp - 0x18]
fstp qword [esp]
call fcn.00430be0
fstp qword [ebp - 0x18]
movsd xmm0, qword [ebp - 0x18]
add esp, 8
cvtpd2ps xmm0, xmm0
call fcn.004326a0
mov ecx, 8
cmp eax, ecx
cmova ecx, eax
mov eax, dword [0x48cd38]
cmp eax, ecx
jae 0x40ae78
cmp eax, 0x200
jae 0x40ae76
shl eax, 3
cmp eax, ecx
jae 0x40ae78
mov eax, ecx
push eax
call fcn.0040a790
push esi
lea eax, [edi + 8]
push eax
lea eax, [ebp - 0x20]
push eax
call fcn.0040ac80
mov ecx, dword [0x48cd24]
mov edx, dword [eax]
jmp 0x40ae99
mov edx, dword [ebp - 0x18]
mov eax, dword [edx + 4]
inc ecx
mov dword [0x48cd24], ecx
mov dword [edi + 4], eax
mov dword [edi], edx
mov dword [eax], edi
mov dword [edx + 4], edi
mov ecx, dword [0x48cd28]
mov dword [ebp - 0x10], eax
mov eax, dword [0x48cd34]
and eax, esi
mov esi, dword [ecx + eax*8]
cmp esi, dword [0x48cd20]
jne 0x40aecd
mov dword [ecx + eax*8], edi
jmp 0x40aedf
cmp esi, edx
jne 0x40aed6
mov dword [ecx + eax*8], edi
jmp 0x40aee3
mov edx, dword [ebp - 0x10]
cmp dword [ecx + eax*8 + 4], edx
jne 0x40aee3
mov dword [ecx + eax*8 + 4], edi
mov dword [ebx], edi
mov byte [ebx + 4], 1
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
push str.unordered_map_set_too_long
call fcn.00410d0d
int3
Function at 0x40afd0
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call
Suspend thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [0x443040]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov edi, ecx
cmp dword [edi + 8], 0
je 0x40b02c
mov eax, dword [edi]
mov ebx, dword [sym.imp.KERNEL32.dll_VirtualProtect]
push 0x48ce14
mov dword [ebp - 8], eax
mov eax, dword [edi + 0x24]
push 0x40
push 4
mov esi, dword [eax + 4]
push esi
call ebx
test eax, eax
je 0x40b1c1
mov eax, dword [ebp - 8]
push 0x48ce14
mov eax, dword [eax]
mov dword [esi], eax
push dword [0x48ce14]
push 4
push esi
call ebx
jmp 0x40b1c1
cmp dword [edi + 0x14], 0
je 0x40b072
mov eax, dword [edi]
mov ebx, dword [sym.imp.KERNEL32.dll_VirtualProtect]
push 0x48ce14
mov dword [ebp - 8], eax
mov eax, dword [edi + 0x24]
push 0x40
push 4
mov esi, dword [eax]
push esi
call ebx
test eax, eax
je 0x40b1c1
mov eax, dword [ebp - 8]
push 0x48ce14
mov eax, dword [eax]
mov dword [esi], eax
push dword [0x48ce14]
push 4
push esi
call ebx
jmp 0x40b1c1
call fcn.00402610
mov ebx, dword [sym.imp.KERNEL32.dll_GetCurrentThread]
call ebx
cmp dword [0x48cd3c], 0
mov esi, eax
jne 0x40b0dd
call ebx
cmp esi, eax
je 0x40b0dd
push 8
call fcn.00410117
add esp, 4
mov ebx, eax
push esi
call dword [sym.imp.KERNEL32.dll_SuspendThread]
cmp eax, 0xffffffff
jne 0x40b0cd
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
push 8
push ebx
call fcn.00410147
add esp, 8
mov dword [0x48cd3c], esi
mov dword [0x48cd48], 0
jmp 0x40b0dd
mov eax, dword [0x48cd50]
mov dword [ebx + 4], esi
mov dword [ebx], eax
mov dword [0x48cd50], ebx
mov eax, dword [edi + 4]
mov dword [ebp - 0xc], eax
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp dword [0x48cd40], eax
jne 0x40b1bc
cmp dword [0x48cd3c], 0
jne 0x40b1bc
cmp dword [edi], 0
jne 0x40b116
mov dword [0x48cd3c], 6
jmp 0x40b1b6
push 0x18
call fcn.00410117
mov ecx, dword [edi]
add esp, 4
mov esi, eax
call fcn.004024e0
mov ecx, dword [ebp - 0xc]
mov ebx, eax
call fcn.004024e0
movzx ecx, byte [ebx + 0x36]
mov edx, eax
mov eax, dword [ebx + 0x40]
sub eax, ecx
mov dword [ebp - 0xc], eax
test ecx, ecx
je 0x40b198
cmp ecx, 0x1e
ja 0x40b198
cmp dword [ebx + 0x44], edx
jne 0x40b198
lea edx, [ebp - 8]
mov dword [ebp - 8], 0
push edx
push 0x40
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x40b170
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x40b1a6
mov eax, dword [ebp - 0xc]
mov dword [esi + 0xc], eax
mov dword [esi + 4], 1
mov dword [esi + 8], edi
mov dword [esi + 0x10], ebx
mov eax, dword [ebp - 8]
mov dword [esi + 0x14], eax
mov eax, dword [0x48cd54]
mov dword [esi], eax
mov dword [0x48cd54], esi
jmp 0x40b1bc
cmp dword [0x48cbc8], 0
mov eax, 9
jne 0x40b1ab
mov dword [0x48cd3c], eax
push 0x18
push esi
call fcn.00410147
add esp, 8
mov dword [0x48cd48], edi
call fcn.004026a0
mov eax, dword [edi + 0x24]
test eax, eax
je 0x40b1d3
push 0
push eax
call fcn.00410147
add esp, 8
push 0x28
push edi
call fcn.00410147
mov ecx, dword [ebp - 4]
add esp, 8
xor ecx, ebp
pop edi
pop esi
pop ebx
call fcn.0040fc87
mov esp, ebp
pop ebp
ret
Function at 0x40b1f0
Capabilities:
Suspend thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov ebx, edx
mov esi, ecx
push 0x28
mov dword [ebp - 4], ebx
call fcn.00410117
mov edi, eax
add esp, 4
mov dword [edi + 8], 0
mov dword [edi + 0xc], 0
mov dword [edi + 0x10], 0
mov dword [edi + 0x14], 0
mov dword [edi + 0x18], 0
mov dword [edi + 0x1c], 0
mov dword [edi + 0x24], 0
mov eax, dword [0x48cd10]
mov dword [edi + 0x20], eax
mov dword [0x48cd10], edi
mov dword [edi], esi
mov dword [edi + 4], ebx
call fcn.00402610
mov ebx, dword [sym.imp.KERNEL32.dll_GetCurrentThread]
call ebx
cmp dword [0x48cd3c], 0
mov esi, eax
jne 0x40b2b9
call ebx
cmp esi, eax
je 0x40b2b9
push 8
call fcn.00410117
add esp, 4
mov ebx, eax
push esi
call dword [sym.imp.KERNEL32.dll_SuspendThread]
cmp eax, 0xffffffff
jne 0x40b2a9
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
push 8
push ebx
call fcn.00410147
add esp, 8
mov dword [0x48cd3c], esi
mov dword [0x48cd48], 0
jmp 0x40b2b9
mov eax, dword [0x48cd50]
mov dword [ebx + 4], esi
mov dword [ebx], eax
mov dword [0x48cd50], ebx
mov edx, dword [ebp - 4]
sub esp, 0xc
mov ecx, edi
call fcn.00402ad0
call fcn.004026a0
mov edx, dword [edi]
mov eax, edi
mov ecx, dword [ebp + 8]
pop edi
pop esi
pop ebx
mov dword [ecx], edx
mov esp, ebp
pop ebp
ret

Function at 0x40b2e0
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [ebp + 0xc]
push ebx
push esi
push edi
mov esi, ecx
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x10]
push 8
mov dword [ebp - 8], esi
mov dword [ebp - 0xc], eax
call fcn.00410117
mov edi, dword [ebp + 8]
mov ebx, eax
push 0x28
mov dword [ebx], esi
mov ecx, dword [esi]
lea esi, [ecx + edi*4]
mov dword [ebx + 4], esi
call fcn.00410117
mov ecx, dword [0x48cd10]
mov edx, eax
xorps xmm0, xmm0
mov dword [0x48cd10], edx
add esp, 8
movups xmmword [edx], xmm0
movups xmmword [edx + 0x10], xmm0
push 0x48ce14
movq qword [edx + 0x20], xmm0
mov dword [edx + 0x20], ecx
mov eax, dword [esi]
mov ecx, dword [ebp - 4]
mov dword [edx + 4], ecx
mov ecx, dword [ebp - 8]
mov dword [edx + 8], ecx
mov ecx, dword [ebp - 0xc]
mov dword [edx + 0x10], edi
mov edi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
push 0x40
mov dword [edx], eax
mov dword [edx + 0x24], ebx
mov dword [edx + 0xc], 0
mov dword [ecx], eax
mov esi, dword [ebx + 4]
push 4
push esi
call edi
test eax, eax
je 0x40b38a
mov eax, dword [ebp - 4]
push 0x48ce14
mov dword [esi], eax
push dword [0x48ce14]
push 4
push esi
call edi
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret