joyce8/EMBER2024-capa huggingface dataset:
Function at 0x401cb0
Capabilities:
Terminate process

Disassembly:
mov eax, dword [esp + 4]
cmp eax, dword [esp + 8]
jge 0x401cbb
ret
push str.argument_missing__n
call fcn.00401120
add esp, 4
push 1
call fcn.00423abc
int3

Function at 0x403220
Capabilities:
Terminate process

Disassembly:
push ecx
push esi
mov esi, dword [esp + 0x10]
push 0
push esi
mov dword [esp + 0xc], 0
call fcn.00401050
add esp, 8
test esi, esi
je 0x40326d
mov eax, dword [esi + 0xdc]
test eax, eax
je 0x403258
cdq
cmp dword [esi + 0x220], eax
jne 0x403258
cmp dword [esi + 0x224], edx
je 0x40326a
lea eax, [esp + 4]
push eax
push esi
push dword [esp + 0x14]
call fcn.00404360
add esp, 0xc
pop esi
pop ecx
ret
push str.NULL_structure_pointer_scannerX___n
push 2
call fcn.00420148
add esp, 4
push eax
call fcn.00401070
add esp, 8
push 1
call fcn.00423abc
int3

Function at 0x4032d0
Capabilities:
Enumerate files on windows
Enumerate files recursively

Disassembly:
mov eax, 0x1950
call fcn.0041c4e0
mov eax, dword [0x4a99c8]
xor eax, esp
mov dword [esp + 0x194c], eax
mov eax, dword [esp + 0x1968]
push ebx
mov ebx, dword [esp + 0x1968]
push ebp
push esi
mov esi, dword [esp + 0x196c]
xor ebp, ebp
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], ebp
push edi
mov edi, dword [esp + 0x1964]
test esi, esi
je 0x403324
push edi
push str.processing_dir_:__s_n
call fcn.00414b20
add esp, 8
push edi
push 0x440cf0
lea eax, [esp + 0x164]
push 0x800
push eax
call fcn.00401010
add esp, 0x10
lea eax, [esp + 0x1c]
push eax
lea eax, [esp + 0x160]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov dword [esp + 0x18], eax
cmp eax, 0xffffffff
je 0x403451
mov ebp, dword [esp + 0x1968]
test byte [esp + 0x1c], 0x10
je 0x4033d3
test esi, esi
je 0x403383
lea eax, [esp + 0x48]
push eax
push str.dir:__s_n
call fcn.00401120
add esp, 8
cmp byte [esp + 0x48], 0x2e
je 0x403436
lea eax, [esp + 0x48]
push eax
push edi
push str._s_s
lea eax, [esp + 0x968]
push 0x800
push eax
call fcn.00401010
mov eax, dword [esp + 0x1980]
add esp, 0x14
test eax, eax
je 0x403436
push dword [esp + 0x14]
push ebx
push esi
push eax
lea eax, [esp + 0x96c]
push ebp
push eax
call fcn.004032d0
add esp, 0x18
jmp 0x403436
test esi, esi
je 0x4033ea
lea eax, [esp + 0x48]
push eax
push edi
push str.file_:__s_s_n
call fcn.00414b20
add esp, 0xc
lea eax, [esp + 0x48]
push eax
push edi
push str._s_s
lea eax, [esp + 0x1168]
push 0x800
push eax
call fcn.00401010
add esp, 0x14
test ebx, ebx
je 0x40341f
push dword [esp + 0x14]
lea eax, [esp + 0x1160]
push eax
call ebx
add esp, 8
mov eax, dword [0x4aa37c]
inc dword [esp + 0x10]
inc eax
mov dword [0x4aa37c], eax
test ebp, ebp
je 0x403436
cmp eax, ebp
jge 0x40344d
lea eax, [esp + 0x1c]
push eax
push dword [esp + 0x1c]
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x403366
mov ebp, dword [esp + 0x10]
test esi, esi
je 0x403464
push edi
push ebp
push str.dirwalk_trace:__u_files___s_n
call fcn.00414b20
add esp, 0xc
mov ecx, dword [esp + 0x195c]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.0041c143
add esp, 0x1950
ret
Function at 0x4034c0
Capabilities:
Get file size
Read file via mapping

Disassembly:
sub esp, 8
push esi
mov esi, dword [esp + 0x10]
push 0
push 0x80
push 3
push 0
push 0
push closesocket
push dword [esi]
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [esi + 0x10], eax
cmp eax, 0xffffffff
je 0x40353c
lea ecx, [esp + 4]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSizeEx]
mov eax, dword [esp + 4]
push 0
push 0
push 0
push 2
push 0
push dword [esi + 0x10]
mov dword [esi + 8], eax
mov eax, dword [esp + 0x20]
mov dword [esi + 0xc], eax
call dword [sym.imp.KERNEL32.dll_CreateFileMappingA]
mov dword [esi + 0x14], eax
cmp eax, 0xffffffff
je 0x40353c
push 0
push 0
push 0
push 4
push eax
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov dword [esi + 0x18], eax
test eax, eax
je 0x40353c
xor eax, eax
pop esi
add esp, 8
ret
or eax, 0xffffffff
pop esi
add esp, 8
ret

Function at 0x4039a0
Capabilities:
Terminate process

Disassembly:
push dword [esp + 4]
push 1
call fcn.004248dd
add esp, 8
test eax, eax
je 0x4039b3
ret
push 2
call fcn.00420148
push eax
push str.pmalloc_ran_out_of_memory_n
call fcn.0042a27d
add esp, 0xc
push 1
call fcn.00423abc
int3

Function at 0x4039d0
Capabilities:
Terminate process

Disassembly:
mov eax, dword [esp + 4]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x4039d7
sub eax, edx
push ebx
push esi
lea ebx, [eax + 1]
push ebx
push 1
call fcn.004248dd
mov esi, eax
add esp, 8
test esi, esi
je 0x403a09
push ebx
push dword [esp + 0x10]
push esi
call fcn.0041d5a0
add esp, 0xc
mov eax, esi
pop esi
pop ebx
ret
push 2
call fcn.00420148
push eax
push str.pmalloc_ran_out_of_memory_n
call fcn.0042a27d
add esp, 0xc
push 1
call fcn.00423abc
int3
Function at 0x407bb0
Capabilities:
Terminate process

Disassembly:
inc dword [0x4aa3bc]
mov eax, dword [0x4aa3b4]
test eax, eax
je 0x407c36
push esi
lea ecx, [esp + 8]
push ecx
push eax
call fcn.00414030
mov esi, eax
add esp, 8
test esi, esi
je 0x407be8
push dword [esp + 0x10]
push dword [esi + 8]
call fcn.00414d90
add esp, 8
inc dword [esi + 0xc]
pop esi
ret
push 1
push 0x10
call fcn.004248dd
mov esi, eax
add esp, 8
test esi, esi
je 0x407c37
mov eax, dword [esp + 8]
mov dword [esi], eax
mov eax, dword [esp + 0xc]
push fcn.004248e8
mov dword [esi + 4], eax
mov dword [esi + 0xc], 1
call fcn.00414df0
push dword [esp + 0x14]
mov dword [esi + 8], eax
push eax
call fcn.00414d30
push esi
push esi
push dword [0x4aa3b4]
call fcn.004141a0
add esp, 0x18
pop esi
ret
push str.no_memory_left___n
call fcn.00414b20
add esp, 4
push 1
call fcn.00423abc
int3

Function at 0x407c50
Capabilities:
Terminate process

Disassembly:
push ecx
movss xmm0, dword [esp + 8]
lea eax, [esp]
inc dword [0x4aa3c0]
push esi
push eax
push dword [0x4aa3b8]
movss dword [esp + 0xc], xmm0
call fcn.00414030
mov esi, eax
add esp, 8
test esi, esi
je 0x407c91
push dword [esp + 0x10]
push dword [esi + 4]
call fcn.00414d90
add esp, 8
inc dword [esi + 8]
pop esi
pop ecx
ret
push 1
push 0xc
call fcn.004248dd
mov esi, eax
add esp, 8
test esi, esi
je 0x407cde
movss xmm0, dword [esp + 0xc]
push fcn.004248e8
movss dword [esi], xmm0
mov dword [esi + 8], 1
call fcn.00414df0
push dword [esp + 0x14]
mov dword [esi + 4], eax
push eax
call fcn.00414d30
push esi
push esi
push dword [0x4aa3b8]
call fcn.004141a0
add esp, 0x18
pop esi
pop ecx
ret
push str.no_memory_left___n
call fcn.00414b20
add esp, 4
push 1
call fcn.00423abc
int3

Function at 0x408570
Capabilities:
Terminate process

Disassembly:
mov ecx, dword [esp + 4]
cmp ecx, 0x40
jge 0x40858b
mov ecx, dword [ecx*4 + 0x4aa658]
mov eax, 0x441b08
test ecx, ecx
cmovne eax, ecx
ret
push str._too_many_features_n
call fcn.00414b20
add esp, 4
push 1
call fcn.00423abc
int3
Function at 0x412ca0
Capabilities:
Parse pe header

Disassembly:
sub esp, 8
mov edx, dword [esp + 0x10]
xor eax, eax
push ebx
push ebp
push esi
lea ebx, [edx - 1]
xor ebp, ebp
mov dword [esp + 0xc], ebx
push edi
test ebx, ebx
jle 0x412d6c
mov edi, dword [esp + 0x1c]
mov esi, edi
mov ebx, dword [esp + 0x24]
sub dword [esp + 0x28], ebx
mov ecx, dword [esp + 0x10]
cmp byte [esi], 0x4d
jne 0x412d62
cmp byte [eax + edi + 1], 0x5a
jne 0x412d62
mov edi, edx
sub edi, eax
cmp edi, 0x40
jb 0x412d5e
movzx edx, byte [esi + 0x3f]
movzx ecx, byte [esi + 0x3e]
shl edx, 8
or edx, ecx
movzx ecx, byte [esi + 0x3d]
shl edx, 8
or edx, ecx
movzx ecx, byte [esi + 0x3c]
shl edx, 8
or edx, ecx
xor ecx, ecx
mov dword [esp + 0x14], edx
add dword [esp + 0x14], 4
adc ecx, ecx
test ecx, ecx
ja 0x412d56
jb 0x412d25
cmp dword [esp + 0x14], edi
ja 0x412d56
cmp byte [esi + edx], 0x50
jne 0x412d56
cmp byte [esi + edx + 1], 0x45
jne 0x412d56
cmp byte [esi + edx + 2], 0
jne 0x412d56
cmp byte [esi + edx + 3], 0
jne 0x412d56
add edx, 4
cmp ebp, dword [esp + 0x2c]
jge 0x412d6c
mov ecx, dword [esp + 0x28]
inc ebp
mov dword [ecx + ebx], edx
mov dword [ebx], eax
add ebx, 4
mov edx, dword [esp + 0x20]
mov ecx, dword [esp + 0x10]
mov edi, dword [esp + 0x1c]
inc eax
inc esi
cmp eax, ecx
jl 0x412cd0
pop edi
pop esi
mov eax, ebp
pop ebp
pop ebx
add esp, 8
ret
Function at 0x412d80
Capabilities:
Terminate process

Disassembly:
sub esp, 0x108
mov eax, dword [0x4a99c8]
xor eax, esp
mov dword [esp + 0x104], eax
push esi
mov esi, dword [esp + 0x110]
push edi
mov edi, dword [esp + 0x118]
mov dword [esi + 0x14], 0xffffffff
test edi, edi
je 0x412f16
mov ecx, edi
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x412db8
sub ecx, edx
je 0x412f16
push 0x100
lea eax, [esp + 0x10]
push edi
push eax
call fcn.0042aef0
push 6
lea eax, [esp + 0x1c]
push str.tcp:__
push eax
call fcn.00424910
add esp, 0x18
test eax, eax
je 0x412ee8
push 7
lea eax, [esp + 0x10]
push str.http:__
push eax
call fcn.00424910
add esp, 0xc
test eax, eax
je 0x412ee8
push 6
lea eax, [esp + 0x10]
push str.ssl:__
push eax
call fcn.00424910
add esp, 0xc
test eax, eax
je 0x412ee8
push 8
lea eax, [esp + 0x10]
push str.https:__
push eax
call fcn.00424910
add esp, 0xc
test eax, eax
je 0x412ee8
push 6
lea eax, [esp + 0x10]
push str.tcp:__
push eax
call fcn.00424910
add esp, 0xc
test eax, eax
je 0x412f16
push 7
lea eax, [esp + 0x10]
push str.http:__
push eax
call fcn.00424910
add esp, 0xc
test eax, eax
je 0x412f16
push 6
lea eax, [esp + 0x10]
push str.ssl:__
push eax
call fcn.00424910
add esp, 0xc
test eax, eax
je 0x412f16
push 8
lea eax, [esp + 0x10]
push str.https:__
push eax
call fcn.00424910
add esp, 0xc
test eax, eax
je 0x412f16
cmp dword [esi + 4], 0
jne 0x412f16
cmp dword [esp + 0x11c], 0
lea eax, [esp + 0xc]
mov dword [esi + 8], eax
mov ecx, 0x470ef8
mov eax, 0x470ed8
cmovne eax, ecx
push eax
lea eax, [esp + 0x10]
push eax
call fcn.004248c6
add esp, 8
mov dword [esi + 4], eax
test eax, eax
je 0x412f2f
jmp 0x412f16
push dword [esp + 0x120]
push edi
push esi
call fcn.00413190
push esi
call fcn.00412fe0
add esp, 0x10
pop edi
pop esi
mov ecx, dword [esp + 0x104]
xor ecx, esp
call fcn.0041c143
add esp, 0x108
ret
mov ecx, dword [esp + 0x10c]
xor eax, eax
pop edi
pop esi
xor ecx, esp
call fcn.0041c143
add esp, 0x108
ret
push 1
call fcn.00423abc
int3

Function at 0x412f40
Capabilities:
Write file on windows

Disassembly:
push esi
mov esi, dword [esp + 8]
mov eax, dword [esi + 4]
test eax, eax
je 0x412f90
push eax
push 1
push dword [esp + 0x18]
push dword [esp + 0x18]
call fcn.0042b7e5
add esp, 0x10
cmp eax, 1
jge 0x412faa
push str.spx_event_send:_failed_write_n
push 2
call fcn.00420148
add esp, 4
push eax
call fcn.00401070
push dword [esi + 4]
call fcn.004247a0
add esp, 0xc
mov dword [esi + 4], 0
or eax, 0xffffffff
pop esi
ret
cmp dword [esi], 0
je 0x412fa8
push dword [esp + 0x10]
push dword [esp + 0x10]
push esi
call fcn.00413370
add esp, 0xc
pop esi
ret
xor eax, eax
pop esi
ret
Function at 0x412fe0
Capabilities:
Act as tcp client
Connect socket
Connect tcp socket
Connect udp socket
Create tcp socket
Create udp socket
Resolve dns

Disassembly:
push ecx
push esi
mov esi, dword [esp + 0xc]
cmp dword [esi + 0x10], 1
jne 0x413114
cmp dword [0x4ab1b4], 0
mov eax, dword [esi + 0x118]
push ebx
push edi
lea ebx, [esi + 0x11c]
mov dword [esp + 0xc], eax
lea edi, [esi + 0x18]
je 0x41301f
push eax
push edi
push 1
push str.spx_tcpio_connect:_connecting_type:_d_host_ip:_s_port:_d_n
call fcn.00414b20
add esp, 0x10
push ebp
xorps xmm0, xmm0
mov eax, 2
movups xmmword [ebx], xmm0
push edi
mov word [ebx], ax
call sub.WS2_32.dll_gethostbyname
mov ecx, eax
mov dword [esp + 0x18], ecx
test ecx, ecx
je 0x413070
cmp dword [0x4ab1b4], 0
je 0x413058
push str.spx_tcpio_connect:_server_found_n
call fcn.00414b20
mov ecx, dword [esp + 0x1c]
add esp, 4
movsx eax, word [ecx + 0xa]
lea ebp, [ebx + 4]
push eax
mov eax, dword [ecx + 0xc]
push dword [eax]
push ebp
call fcn.0041d5a0
add esp, 0xc
jmp 0x41307f
push edi
lea ebp, [esi + 0x120]
call sub.WS2_32.dll_inet_addr
mov dword [ebp], eax
cmp dword [0x4ab1b4], 0
je 0x4130b7
push dword [ebp]
call sub.WS2_32.dll_ntohl
movzx ecx, al
push ecx
mov ecx, eax
shr ecx, 8
movzx ecx, cl
push ecx
mov ecx, eax
shr eax, 0x18
shr ecx, 0x10
movzx ecx, cl
push ecx
push eax
push str.spx_tcpio_connect:_IP____u._u._u._u_n
call fcn.00414b20
add esp, 0x14
push dword [esp + 0x10]
call sub.WS2_32.dll_htons
push 0
push 1
push 2
mov word [esi + 0x11e], ax
call sub.WS2_32.dll_socket
mov edi, eax
pop ebp
test edi, edi
js 0x4130ec
push 0x10
push ebx
push edi
call sub.WS2_32.dll_connect
test eax, eax
jns 0x4130ef
push edi
call sub.WS2_32.dll_closesocket
or edi, 0xffffffff
mov dword [esi + 0x14], edi
test edi, edi
pop edi
pop ebx
jns 0x413114
cmp dword [0x4ab1b4], 0
je 0x41310e
push str.spx_tcpio_connect:_tcpConnect___failed_n
call fcn.00401120
add esp, 4
or eax, 0xffffffff
pop esi
pop ecx
ret
mov ecx, dword [esi + 0x130]
mov eax, dword [esi + 0x134]
add ecx, 1
mov dword [esi + 0x130], ecx
adc eax, 0
cmp dword [0x4ab1b4], 0
mov dword [esi + 0x134], eax
je 0x41314a
push eax
push ecx
push str.spx_tcpio_connect:_connected__num_connects_lld_n
call fcn.00401120
add esp, 0xc
xor eax, eax
pop esi
pop ecx
ret
Function at 0x413190
Capabilities:
Terminate process

Disassembly:
sub esp, 0x104
mov eax, dword [0x4a99c8]
xor eax, esp
mov dword [esp + 0x100], eax
push ebx
mov ebx, dword [esp + 0x110]
push esi
mov esi, dword [esp + 0x110]
push edi
push 0x148
push 0
push esi
call fcn.0041db20
mov eax, dword [esp + 0x128]
lea edx, [esp + 0x18]
add esp, 0xc
mov dword [esi + 0xc], eax
mov ecx, ebx
sub edx, ebx
mov al, byte [ecx]
lea ecx, [ecx + 1]
mov byte [edx + ecx - 1], al
test al, al
jne 0x4131d7
push ebx
call fcn.004039d0
mov dword [esi], eax
lea eax, [esp + 0x10]
push 0x471010
push eax
call fcn.0042cf90
mov edi, eax
add esp, 0xc
test edi, edi
je 0x413339
mov edx, 0x471014
mov ecx, edi
nop
mov al, byte [ecx]
cmp al, byte [edx]
jne 0x413230
test al, al
je 0x41322c
mov al, byte [ecx + 1]
cmp al, byte [edx + 1]
jne 0x413230
add ecx, 2
add edx, 2
test al, al
jne 0x413210
xor eax, eax
jmp 0x413235
sbb eax, eax
or eax, 1
test eax, eax
je 0x4132b7
mov ecx, str.http
mov eax, edi
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x413260
test dl, dl
je 0x41325c
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x413260
add eax, 2
add ecx, 2
test dl, dl
jne 0x413240
xor eax, eax
jmp 0x413265
sbb eax, eax
or eax, 1
test eax, eax
je 0x4132b7
mov ecx, 0x471020
mov eax, edi
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x413290
test dl, dl
je 0x41328c
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x413290
add eax, 2
add ecx, 2
test dl, dl
jne 0x413270
xor eax, eax
jmp 0x413295
sbb eax, eax
or eax, 1
test eax, eax
jne 0x413354
mov eax, dword [esi]
mov dword [esi + 0x10], 0x1f41
mov byte [eax], 0x74
mov eax, dword [esi]
mov byte [eax + 1], 0x63
mov eax, dword [esi]
mov byte [eax + 2], 0x70
jmp 0x4132be
mov dword [esi + 0x10], 1
push 0x471010
push 0
call fcn.0042cf90
mov edx, eax
add esp, 8
test edx, edx
je 0x413339
cmp byte [edx], 0x2f
jne 0x413339
mov cl, byte [edx + 1]
add edx, 2
cmp cl, 0x2f
jne 0x413339
test edx, edx
je 0x4132fd
mov ecx, esi
sub ecx, edx
nop dword [eax + eax]
mov al, byte [edx]
lea edx, [edx + 1]
mov byte [ecx + edx + 0x17], al
test al, al
jne 0x4132f0
push 0x441088
push 0
call fcn.0042cf90
add esp, 8
test eax, eax
je 0x413339
push eax
call fcn.00424705
add esp, 4
mov dword [esi + 0x118], eax
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x100]
xor ecx, esp
call fcn.0041c143
add esp, 0x104
ret
mov ecx, dword [esp + 0x10c]
or eax, 0xffffffff
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.0041c143
add esp, 0x104
ret
push ebx
push edi
push str.spade:_unsupported_output_protocol__s_in_URL____s_n
call fcn.00414b20
add esp, 0xc
push 1
call fcn.00423abc
int3
Function at 0x413eb0
Capabilities:
Terminate process

Disassembly:
push esi
push 0x20
call fcn.004039a0
mov esi, eax
add esp, 4
test esi, esi
je 0x413f4b
mov ecx, dword [esp + 8]
mov eax, 4
test ecx, ecx
mov dword [esi + 0x14], 0
cmovg eax, ecx
mov ecx, dword [esp + 0xc]
cdq
sub eax, edx
mov dword [esi + 0x10], ecx
and eax, 0xfffffffe
mov dword [esi + 0xc], eax
shl eax, 2
push eax
push esi
call fcn.00414410
add esp, 8
mov dword [esi], eax
test eax, eax
jne 0x413f0a
push esi
call fcn.00403980
add esp, 4
xor eax, eax
pop esi
ret
push 0
call fcn.00424ac8
push eax
call fcn.0042cfcf
add esp, 8
call fcn.0042cfae
cdq
shld edx, eax, 0x1f
shl eax, 0x1f
mov dword [esi + 4], eax
mov dword [esi + 8], edx
call fcn.0042cfae
cdq
or eax, dword [esi + 4]
or edx, dword [esi + 8]
xor eax, 0xdeadbeef
xor edx, 0
mov dword [esi + 4], eax
mov dword [esi + 8], edx
mov eax, esi
pop esi
ret
push 0x20
push str.no_memory_in_pdict:priv_malloc_n_zd__n
push 2
call fcn.00420148
add esp, 4
push eax
call fcn.00401070
add esp, 0xc
push 1
call fcn.00423abc
int3

Function at 0x4141a0
Capabilities:
Terminate process

Disassembly:
push esi
mov esi, dword [esp + 8]
push edi
mov eax, dword [esi + 0xc]
cmp dword [esi + 0x14], eax
jne 0x4141ba
add eax, eax
push eax
push esi
call fcn.004142b0
add esp, 8
push 0x10
call fcn.004039a0
mov edi, eax
add esp, 4
test edi, edi
je 0x414220
inc dword [esi + 0x1c]
add dword [esi + 0x18], 0x10
mov eax, dword [esi + 0x10]
push ebx
mov ebx, dword [esp + 0x14]
test eax, eax
jne 0x4141eb
mov eax, ebx
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x4141e2
sub eax, edx
push dword [esi + 4]
push eax
push ebx
call fcn.00414470
mov dword [edi + 0xc], eax
add esp, 0xc
mov ecx, dword [esi + 0xc]
mov dword [edi + 8], ebx
dec ecx
and ecx, eax
mov eax, dword [esp + 0x18]
mov dword [edi + 4], eax
mov eax, dword [esi]
pop ebx
mov eax, dword [eax + ecx*4]
mov dword [edi], eax
mov eax, dword [esi]
mov dword [eax + ecx*4], edi
mov eax, edi
inc dword [esi + 0x14]
pop edi
pop esi
ret
push 0x10
push str.no_memory_in_pdict:priv_malloc_n_zd__n
push 2
call fcn.00420148
add esp, 4
push eax
call fcn.00401070
add esp, 0xc
push 1
call fcn.00423abc
int3
Function at 0x4142b0
Capabilities:
Terminate process

Disassembly:
sub esp, 0x2c
push ebx
push ebp
mov ebp, dword [esp + 0x38]
push esi
push edi
xor edi, edi
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 0x10]
mov ebx, dword [ebp + 0x18]
mov dword [esp + 0x18], eax
mov eax, dword [esp + 0x44]
cdq
sub eax, edx
mov dword [esp + 0x2c], ecx
mov ecx, dword [ebp + 4]
mov edx, eax
sar edx, 1
mov dword [esp + 0x30], edi
mov dword [esp + 0x20], ecx
mov dword [esp + 0x34], ebx
lea eax, [edx + edx]
mov dword [esp + 0x28], eax
lea esi, [edx*8]
mov eax, dword [ebp + 8]
mov dword [esp + 0x24], eax
mov eax, dword [ebp + 0x1c]
mov dword [esp + 0x10], eax
mov dword [esp + 0x38], eax
test esi, esi
jne 0x414320
push 0x3f
push str.pdict.c
push str.n__0
call fcn.0042bfdb
add esp, 0xc
push esi
call fcn.004039a0
mov ecx, eax
add esp, 4
mov dword [esp + 0x14], ecx
test ecx, ecx
je 0x4143e0
mov eax, dword [esp + 0x10]
lea edx, [ebx + esi]
xor ebx, ebx
mov dword [esp + 0x34], edx
inc eax
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x38], eax
mov dword [esp + 0x44], ebx
cmp dword [ebp + 0xc], ebx
jle 0x4143a1
mov eax, dword [ebp]
mov eax, dword [eax + ebx*4]
test eax, eax
je 0x414393
mov ebp, dword [esp + 0x28]
mov ebx, dword [esp + 0x14]
dec ebp
nop dword [eax]
mov ecx, dword [eax + 0xc]
inc edi
mov esi, dword [eax]
and ecx, ebp
lea edx, [ebx + ecx*4]
mov ecx, dword [edx]
mov dword [eax], ecx
mov dword [edx], eax
mov eax, esi
test esi, esi
jne 0x414370
mov ebx, dword [esp + 0x44]
mov ebp, dword [esp + 0x40]
mov dword [esp + 0x30], edi
inc ebx
mov dword [esp + 0x44], ebx
cmp ebx, dword [ebp + 0xc]
jl 0x414356
mov edx, dword [esp + 0x34]
mov ecx, dword [ebp]
test ecx, ecx
je 0x4143c4
mov eax, dword [esp + 0x10]
mov dword [esp + 0x38], eax
imul eax, dword [esp + 0x18], 0xfffffffc
push ecx
add edx, eax
mov dword [esp + 0x38], edx
call fcn.00403980
add esp, 4
movups xmm0, xmmword [esp + 0x1c]
pop edi
pop esi
movups xmmword [ebp], xmm0
xor eax, eax
movups xmm0, xmmword [esp + 0x24]
movups xmmword [ebp + 0x10], xmm0
pop ebp
pop ebx
add esp, 0x2c
ret
push esi
push str.no_memory_in_pdict:priv_malloc_n_zd__n
push 2
call fcn.00420148
add esp, 4
push eax
call fcn.00401070
add esp, 0xc
push 1
call fcn.00423abc
int3

Function at 0x414410
Capabilities:
Terminate process

Disassembly:
push esi
mov esi, dword [esp + 0xc]
test esi, esi
jne 0x41442d
push 0x3f
push str.pdict.c
push str.n__0
call fcn.0042bfdb
add esp, 0xc
push esi
call fcn.004039a0
mov ecx, eax
add esp, 4
test ecx, ecx
je 0x41444e
mov eax, dword [esp + 8]
test eax, eax
je 0x41444a
inc dword [eax + 0x1c]
add dword [eax + 0x18], esi
mov eax, ecx
pop esi
ret
push esi
push str.no_memory_in_pdict:priv_malloc_n_zd__n
push 2
call fcn.00420148
add esp, 4
push eax
call fcn.00401070
add esp, 0xc
push 1
call fcn.00423abc
int3
Function at 0x414470
Capabilities:
Hash data using murmur3

Disassembly:
sub esp, 8
mov eax, dword [esp + 0x10]
mov edx, dword [esp + 0xc]
push ebp
push esi
push edi
lea ebp, [edx + eax]
mov dword [esp + 0x10], ebp
cmp eax, 0x10
jb 0x414516
mov esi, dword [esp + 0x20]
lea eax, [ebp - 0x10]
mov dword [esp + 0xc], eax
mov ebp, dword [esp + 0xc]
push ebx
lea edi, [esi + 0x24234428]
lea ebx, [esi - 0x7a143589]
lea eax, [esi + 0x61c8864f]
imul ecx, dword [edx], 0x7a143589
sub edi, ecx
imul ecx, dword [edx + 4], 0x7a143589
rol edi, 0xd
imul edi, edi, 0x9e3779b1
sub ebx, ecx
imul ecx, dword [edx + 8], 0x7a143589
rol ebx, 0xd
imul ebx, ebx, 0x9e3779b1
sub esi, ecx
imul ecx, dword [edx + 0xc], 0x7a143589
rol esi, 0xd
add edx, 0x10
imul esi, esi, 0x9e3779b1
sub eax, ecx
rol eax, 0xd
imul eax, eax, 0x9e3779b1
cmp edx, ebp
jbe 0x4144b0
mov ebp, dword [esp + 0x14]
rol eax, 0x12
rol esi, 0xc
rol ebx, 7
add eax, esi
add eax, ebx
rol edi, 1
add eax, edi
pop ebx
jmp 0x41451f
mov eax, dword [esp + 0x20]
add eax, 0x165667b1
add eax, dword [esp + 0x1c]
lea esi, [edx + 4]
cmp esi, ebp
ja 0x41454a
nop word [eax + eax]
imul ecx, dword [edx], 0x3d4d51c3
mov edx, esi
lea esi, [edx + 4]
sub eax, ecx
rol eax, 0x11
imul eax, eax, 0x27d4eb2f
cmp esi, ebp
jbe 0x414530
mov edi, ebp
xor ecx, ecx
sub edi, edx
xor esi, esi
cmp edx, ebp
cmova edi, ecx
test edi, edi
je 0x41457c
nop dword [eax + eax]
movzx ecx, byte [edx]
lea edx, [edx + 1]
imul ecx, ecx, 0x165667b1
inc esi
add ecx, eax
rol ecx, 0xb
imul eax, ecx, 0x9e3779b1
cmp esi, edi
jb 0x414560
mov ecx, eax
shr ecx, 0xf
xor ecx, eax
imul ecx, ecx, 0x85ebca77
pop edi
pop esi
pop ebp
mov eax, ecx
shr eax, 0xd
xor eax, ecx
imul ecx, eax, 0xc2b2ae3d
mov eax, ecx
shr eax, 0x10
xor eax, ecx
add esp, 8
ret
Function at 0x4164a0
Capabilities:
Terminate process

Disassembly:
push ecx
push ebp
mov ebp, dword [esp + 0xc]
push esi
push edi
xor edi, edi
xor esi, esi
push edi
push ebp
call fcn.00416a70
add esp, 8
test eax, eax
je 0x41652c
nop word [eax + eax]
inc edi
inc esi
push edi
push ebp
call fcn.00416a70
add esp, 8
test eax, eax
jne 0x4164c0
test esi, esi
je 0x41652c
push 4
push esi
call fcn.004248dd
add esp, 8
mov dword [esp + 0xc], eax
test eax, eax
je 0x416533
xor edi, edi
push ebx
test esi, esi
jle 0x41651c
nop
push edi
push ebp
call fcn.00416a70
mov ebx, eax
add esp, 8
test ebx, ebx
je 0x41651c
push ebx
call fcn.00416db0
add esp, 4
test eax, eax
je 0x416547
mov ecx, dword [esp + 0x10]
mov eax, dword [ebx + 0x10]
mov dword [ecx + edi*4], eax
inc edi
cmp edi, esi
jl 0x4164f0
mov eax, dword [esp + 0x1c]
pop ebx
pop edi
mov dword [eax], esi
mov eax, dword [esp + 8]
pop esi
pop ebp
pop ecx
ret
pop edi
pop esi
xor eax, eax
pop ebp
pop ecx
ret
push str.out_of_memory:_cjson_string_array__n
call fcn.00414b20
add esp, 4
push 0
call fcn.00423abc
push str.config_expected_string_array__n
call fcn.00414b20
add esp, 4
push 1
call fcn.00423abc
int3