joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1001690
Capabilities:
Access peb ldr_data
Get process heap force flags

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x10bace8
mov eax, dword fs:[0]
push eax
sub esp, 0x28
mov eax, dword [0x11155dc]
xor eax, esp
mov dword [esp + 0x20], eax
push esi
mov eax, dword [0x11155dc]
xor eax, esp
push eax
lea eax, [esp + 0x30]
mov dword fs:[0], eax
mov esi, ecx
mov eax, dword [ebp + 0x10]
sub esp, 0x18
mov ecx, esp
push 0xffffffffffffffff
push 0
mov dword [ecx + 0x14], 0xf
mov dword [ecx + 0x10], 0
push eax
mov byte [ecx], 0
call 0x1003160
push dword [ebp + 0xc]
lea eax, [esp + 0x2c]
push dword [ebp + 8]
push eax
call fcn.01001590
add esp, 0x24
mov dword [esp + 0x38], 0
cmp dword [eax + 0x14], 0x10
jb 0x100170d
mov eax, dword [eax]
mov dword [esp + 0xc], eax
mov ecx, esi
lea eax, [esp + 0xc]
push eax
call 0x101ff40
cmp dword [esp + 0x24], 0x10
mov dword [esi], 0x10bd2a8
jb 0x1001736
push dword [esp + 0x10]
call 0x10208ef
add esp, 4
mov ecx, dword [ebp + 8]
mov eax, esi
mov dword [esi + 0xc], ecx
mov ecx, dword [ebp + 0xc]
mov dword [esi], 0x10bd344
mov dword [esi + 0x10], ecx
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [esp + 0x20]
xor ecx, esp
call 0x101fccb
mov esp, ebp
pop ebp
ret 0xc
Function at 0x40ab88
Capabilities:
Access peb ldr_data
Get process heap force flags

Disassembly:
push ebx
mov ebx, esp
push ecx
push ecx
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x51cece
mov eax, dword fs:[0]
push eax
push ebx
sub esp, 0x50
mov eax, dword [0x580014]
xor eax, ebp
mov dword [ebp - 0x14], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov eax, dword [ebx + 8]
lea ecx, [ebp - 0x28]
mov dword [ebp - 0x24], eax
mov eax, dword [ebx + 0xc]
mov dword [ebp - 0x20], eax
mov eax, dword [ebx + 0x10]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebx + 0x14]
push ecx
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x14]
push eax
push ecx
lea ecx, [ebp - 0x4c]
mov dword [ebp - 0x28], edx
call fcn.0040ac70
push eax
lea ecx, [ebp - 0x5c]
call fcn.0040a393
push eax
mov al, byte [edi + 0x28]
mov cl, byte [edi + 0x38]
mov edx, dword [edi + 0x34]
mov byte [ebp - 0x2c], al
lea eax, [ebp - 0x2a]
push eax
lea eax, [ebp - 0x40]
mov byte [ebp - 0x2a], cl
mov ecx, dword [edi + 0x30]
push eax
lea eax, [ebp - 0x2c]
mov byte [ebp - 0x29], 1
push eax
lea eax, [edi + 0x20]
mov dword [ebp - 0x40], ecx
push eax
lea eax, [edi + 0x18]
mov dword [ebp - 0x3c], edx
push eax
lea eax, [edi + 8]
mov byte [ebp - 0x38], 1
push eax
push edi
mov byte [ebp - 0x2b], 1
call dword [sym.imp.Mso20Win32Client.dll_Ordinal_32084]
lea ecx, [ebp - 0x58]
call fcn.0040a7f0
lea ecx, [ebp - 0x4c]
call fcn.0040a7f0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.0051a430
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret 0x10
Function at 0x40c29a
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push esi
mov esi, ecx
push edi
xor edi, edi
push 4
pop eax
mov word [esi + 0x60], ax
movzx eax, ax
or eax, 0x10000
mov dword [esi], 0x533aac
mov dword [esi + 4], 0x533a50
mov dword [esi + 8], 0x533a10
mov dword [esi + 0xc], 0x5339ec
mov dword [esi + 0x10], edi
mov dword [esi + 0x20], edi
mov dword [esi + 0x58], edi
mov dword [esi + 0x5c], edi
mov dword [esi + 0x60], eax
mov dword [esi + 0x64], edi
mov dword [esi + 0x68], edi
mov dword [esi + 0x14], edi
mov dword [esi + 0x18], edi
mov dword [esi + 0x1c], edi
mov dword [esi + 0x78], edi
mov dword [esi + 0x44], edi
mov dword [esi + 0x48], edi
mov dword [esi + 0x4c], edi
mov dword [esi + 0x50], edi
mov dword [esi + 0x70], edi
mov ecx, dword [esi + 0x20]
test ecx, ecx
je 0x40c30a
mov dword [esi + 0x20], edi
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
mov dword [esi + 0x24], 8
mov dword [esi + 0x28], edi
mov dword [esi + 0x2c], edi
mov dword [esi + 0x30], edi
mov dword [esi + 0x34], edi
mov dword [esi + 0x38], edi
mov dword [esi + 0x3c], edi
mov dword [esi + 0x40], edi
mov dword [esi + 0x6c], edi
mov dword [esi + 0x74], edi
mov dword [esi + 0x54], 1
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push edi
mov dword [esi + 0x7c], eax
lea eax, [esi + 0x80]
push edi
push eax
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSectionEx]
mov dword [esi + 0x98], edi
mov ecx, dword [esi + 0x10]
test ecx, ecx
je 0x40c36c
mov dword [esi + 0x10], edi
mov eax, dword [ecx + 4]
add ecx, 4
mov eax, dword [eax + 4]
add eax, ecx
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
pop edi
mov eax, esi
pop esi
ret
Function at 0x41668a
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x580014]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
xor ebx, ebx
push esi
mov esi, ecx
cmp dword [0x591d94], ebx
je 0x41682f
lock inc dword [0x591d90]
cmp dword [0x591d98], ebx
je 0x4166dc
or eax, 0xffffffff
lock xadd dword [0x591d90], eax
jne 0x41682f
push 0x58e378
call dword [sym.imp.KERNEL32.dll_DeleteCriticalSection]
jmp 0x41682f
push edi
push 0x58e378
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
test esi, esi
je 0x41676a
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov dword [ebp - 0xc], eax
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push dword [0x58b4c0]
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x10]
push eax
push 0x58b4c0
mov dword [ebp - 8], ebx
call dword [sym.imp.Mso20Win32Client.dll_Ordinal_41289]
mov edi, dword [0x58b4c0]
mov edx, ebx
mov esi, dword [0x58b4d4]
dec edi
test esi, esi
jle 0x416823
mov eax, dword [0x58b4e0]
mov ecx, dword [eax + edx*4]
cmp byte [ecx + 4], bl
je 0x416760
cmp dword [ecx + 0x28], 0xffffffff
jne 0x416760
mov eax, dword [ecx + 8]
cmp eax, dword [ebp - 0xc]
jne 0x416760
cmp dword [ecx + 0x24], ebx
je 0x416760
cmp dword [ebp - 8], ebx
je 0x416757
cmp byte [ecx + 5], bl
jne 0x416760
mov dword [ecx + 0x28], edi
mov esi, dword [0x58b4d4]
inc edx
cmp edx, esi
jl 0x41672d
jmp 0x416823
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [ebp - 0x14], eax
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov ebx, dword [0x58b4c0]
sub ebx, 1
js 0x416823
imul ecx, ebx, 0xc
add ecx, dword [0x58b4cc]
mov esi, ecx
lea edi, [ebp - 0x10]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
cmp dword [ebp - 0xc], eax
je 0x4167a6
sub ecx, 0xc
sub ebx, 1
jns 0x416791
test ebx, ebx
js 0x416823
cmp dword [0x58b4d4], 0
jle 0x416815
xor esi, esi
mov eax, dword [0x58b4e0]
mov edi, dword [eax + esi*4]
mov eax, dword [edi + 0x28]
cmp eax, ebx
jne 0x416806
mov ecx, dword [edi + 0x24]
test ecx, ecx
je 0x416804
mov eax, dword [ebp - 0x14]
mov edx, eax
sub edx, dword [ebp - 0x10]
sub eax, dword [edi + 0x10]
cmp edx, eax
cmova edx, eax
add dword [edi + 0x18], edx
sub ecx, 1
je 0x4167fa
sub ecx, 1
je 0x4167f5
push 0x74c708
call dword [sym.imp.Mso20Win32Client.dll_Ordinal_30245]
jmp 0x4167fd
sub dword [edi + 0x20], edx
jmp 0x4167fd
sub dword [edi + 0x1c], edx
or dword [edi + 0x28], 0xffffffff
or eax, 0xffffffff
cmp eax, ebx
jle 0x41680c
dec eax
mov dword [edi + 0x28], eax
inc esi
cmp esi, dword [0x58b4d4]
jl 0x4167b5
push 1
push ebx
push 0x58b4c0
call dword [sym.imp.Mso20Win32Client.dll_Ordinal_30224]
push 0x58e378
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop edi
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
pop ebx
call fcn.0051a430
leave
ret
Function at 0x426226
Capabilities:
Identify system language via api

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
mov eax, dword [0x580014]
xor eax, ebp
mov dword [ebp - 4], eax
call dword [sym.imp.KERNEL32.dll_GetUserDefaultLangID]
cmp dword [0x591de0], 1
mov word [0x591de4], ax
jne 0x42626a
cmp dword [0x591dd8], 1
jne 0x426258
xor eax, eax
jmp 0x4262b0
push 0x591b18
push 0x400
call dword [sym.imp.mso40uiWin32Client.dll_Ordinal_47989]
jmp 0x4262b0
push esi
push 0x20
lea eax, [ebp - 0x44]
xor esi, esi
push eax
push 0x1014
mov dword [0x591ddc], esi
call dword [sym.imp.KERNEL32.dll_GetUserDefaultLCID]
push eax
call dword [sym.imp.Mso30Win32Client.dll_Ordinal_45315]
test eax, eax
jne 0x426296
mov eax, 0x80004005
jmp 0x4262af
cmp word [ebp - 0x44], 0x30
je 0x4262a4
cmp word [ebp - 0x44], 0x32
jne 0x4262a7
xor esi, esi
inc esi
mov dword [0x591ddc], esi
xor eax, eax
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0051a430
leave
ret

Function at 0x433689
Capabilities:
Check for time delay via gettickcount

Disassembly:
mov eax, dword [0x58e390]
push edi
mov edi, ecx
test eax, eax
je 0x4336e2
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetTickCount]
call esi
sub eax, dword [0x580280]
cmp eax, edi
jbe 0x4336dc
call esi
mov edi, eax
mov eax, dword [0x58e390]
mov esi, dword [eax*4 + 0x535500]
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push edi
push esi
push str.RecentDarwinAuto
push eax
push str._T_d__s:_forgetting__s__time_i
call fcn.00434510
add esp, 0x14
xor eax, eax
mov dword [0x58e390], eax
jmp 0x4336e1
mov eax, dword [0x58e390]
pop esi
pop edi
ret

Function at 0x4351fe
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x51d4f4
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x580014]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov ebx, dword [sym.imp.KERNEL32.dll_GetTickCount]
xor eax, eax
mov dword [esi], 0x590318
mov dword [esi + 4], eax
mov dword [esi + 8], eax
mov dword [esi + 0xc], eax
mov dword [esi + 0x10], eax
call ebx
mov dword [ebp - 0x10], eax
jmp 0x435293
and dword [ebp - 4], 0
push dword [esi]
call dword [sym.imp.MSVCP140.dll__Mtx_trylock]
pop ecx
test eax, eax
je 0x435261
cmp eax, 3
jne 0x4352b3
xor al, al
jmp 0x435263
mov al, 1
or dword [ebp - 4], 0xffffffff
test al, al
jne 0x43526f
xor eax, eax
jmp 0x43527a
lea ecx, [esi + 4]
call fcn.0041217d
xor eax, eax
inc eax
mov dword [esi + 0xc], eax
cmp eax, 1
je 0x43529f
push 1
push 0
call dword [sym.imp.KERNEL32.dll_SleepEx]
mov dword [esi + 0x10], 1
call ebx
sub eax, dword [ebp - 0x10]
cmp eax, 0xbb8
jb 0x435247
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
leave
ret 4
push eax
call dword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_C_error_int_]
int3
Function at 0x43531b
Capabilities:
Get common file path
Get file size
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x178
mov eax, dword [0x580014]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
lea eax, [ebp - 0x16c]
mov dword [ebp - 0x174], ecx
push eax
mov esi, 0x104
push esi
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
test eax, eax
je 0x435489
push ebx
push edi
push esi
mov esi, dword [sym.imp.Mso20Win32Client.dll_Ordinal_539]
lea eax, [ebp - 0x16c]
push eax
push str.office.log
call esi
xor edi, edi
lea eax, [ebp - 0x16c]
push edi
push 0x80
push 4
push edi
push edi
push 0x40000000
push eax
call dword [sym.imp.Mso20Win32Client.dll_Ordinal_8993]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x435487
lea eax, [ebp - 0x178]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetFileSize]
cmp dword [ebp - 0x178], edi
jne 0x4353ad
cmp eax, 0x100000
jbe 0x4353b4
push ebx
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
cmp dword [0x592068], edi
je 0x4353c7
push 2
push edi
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
push 0x64
lea eax, [ebp - 0x68]
mov dword [0x592068], 1
push eax
push edi
push edi
push edi
push 0x400
call dword [sym.imp.KERNEL32.dll_GetDateFormatA]
push 0x64
lea eax, [ebp - 0x68]
push eax
push 0x5414b8
call esi
mov esi, dword [sym.imp.KERNEL32.dll_lstrlenA]
lea eax, [ebp - 0x170]
push edi
push eax
lea eax, [ebp - 0x68]
push eax
call esi
mov edi, dword [sym.imp.KERNEL32.dll_WriteFile]
push eax
lea eax, [ebp - 0x68]
push eax
push ebx
call edi
push 0x64
lea eax, [ebp - 0x68]
push eax
xor eax, eax
push eax
push eax
push eax
push 0x400
call dword [sym.imp.KERNEL32.dll_GetTimeFormatA]
push 0x64
lea eax, [ebp - 0x68]
push eax
push 0x5414b8
call dword [sym.imp.Mso20Win32Client.dll_Ordinal_539]
push 0
lea eax, [ebp - 0x170]
push eax
lea eax, [ebp - 0x68]
push eax
call esi
push eax
lea eax, [ebp - 0x68]
push eax
push ebx
call edi
push 0
lea eax, [ebp - 0x170]
push eax
push dword [ebp - 0x174]
call esi
push eax
push dword [ebp - 0x174]
push ebx
call edi
push 0
lea eax, [ebp - 0x170]
push eax
push 2
push 0x541f4c
push ebx
call edi
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.0051a430
leave
ret

Function at 0x4359cc
Capabilities:
Get common file path

Disassembly:
cmp word [0x591e58], 0
push esi
mov esi, 0x591e58
jne 0x435a11
push esi
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
test eax, eax
je 0x435a11
push edi
mov edi, 0x105
push edi
push esi
push str.GimmeSetup__.log
call dword [sym.imp.Mso20Win32Client.dll_Ordinal_26907]
test eax, eax
jne 0x435a10
push edi
mov edx, esi
mov ecx, 0x52c134
call fcn.00407189
pop edi
push esi
push str.WzGetGimmeCatalystLogFile
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push eax
push str._T_d__s:_GimmeSetup__.log_file:__s
call fcn.00434510
add esp, 0x10
mov eax, esi
pop esi
ret
Function at 0x436653
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x580014]
xor eax, ebp
mov dword [ebp - 4], eax
or dword [ebp - 0x1c], 0xffffffff
push esi
push edi
mov edi, ecx
xor esi, esi
cmp edi, dword [0x591e50]
jne 0x43667c
mov eax, dword [0x591e54]
jmp 0x4366dd
lea eax, [ebp - 0x1c]
push eax
push esi
push 0x532538
call dword [sym.imp.Mso20Win32Client.dll_Ordinal_10937]
test eax, eax
jne 0x4366cf
push 0xa
push edi
push 0xa
lea eax, [ebp - 0x18]
mov dword [ebp - 0x20], 4
push eax
call dword [sym.imp.Mso20Win32Client.dll_Ordinal_62510]
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x28]
push eax
push esi
lea eax, [ebp - 0x18]
push eax
push dword [ebp - 0x1c]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [ebp - 0x1c]
test eax, eax
cmove esi, dword [ebp - 0x24]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [0x591e50], edi
mov eax, esi
mov dword [0x591e54], esi
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.0051a430
leave
ret
Function at 0x445b93
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
xor esi, esi
mov ecx, 0x811c9dc5
cmp dword [ebp + 8], esi
jbe 0x445bb6
movzx eax, byte [esi + edx]
xor eax, ecx
imul ecx, eax, 0x1000193
inc esi
cmp esi, dword [ebp + 8]
jb 0x445ba4
mov eax, ecx
pop esi
leave
ret 4
Function at 0x464a07
Capabilities:
Encode data using xor

Disassembly:
add byte [eax], al
add dword [eax + 5], eax
add byte [edx], 4
add byte [eax + 0x6c000010], al
in eax, 0x7d
out dx, al
xor ebx, edi
pop ds
xchg ebx, eax
bound edi, qword [edx - 1]
add byte [eax + eax], al
add byte [ebp + 4], bl
add byte [eax], al
daa
mov dl, 4
sbb byte [ecx], 0
sub byte [edx + 0x8004], dh
add dword [eax], eax
push es
add byte [ebx], cl
add byte [ecx + 0x53435255], al
xor dword cs:[edi + 0x30], ebx
add byte ss:[eax], al
add al, byte [eax + 5]
add byte [edx], 4
add byte [eax + 0x46000010], al
out 0x43, al
jge fcn.00464a07
xchg edx, eax
arpl word [eax], dx
ja 0x4649ea
or eax, 0x400eb
add byte [eax + 0xf000010], al
fnsave dword [ebx]
mov bl, 0x11
daa
jle 0x464a54
jmp dword [edi]
daa
xchg ebp, eax
jae 0x464ad4
add byte [eax + eax], al
add byte [ebp + 4], bl
add byte [eax], al
sub byte [edx + 0x215c8004], dh
add byte [eax], al
sub dword [edx + 0x8004], esi
add dword [eax], eax
push es
add byte [ebx], cl
add byte [ecx + 0x53435255], al
xor dword cs:[edi + 0x30], ebx
xor eax, 0x40050000
add eax, 0x4004282
add byte [eax + 0x37000010], al
lcall 0x9a13, 0xd9cca0d5
add eax, 0x3a8d49
add al, 0
add byte [eax - 0x1bfffff0], al
stc
shl dh, cl
xlatb
sbb byte [ecx], 0x51
sbb esi, dword [ebx]
shr byte [0x400], 0x80
adc byte [eax], al
add dl, ch
mov ch, 0x23
out 0x6f, eax
sub bh, 0x6b
cmp dword [ecx + 0x400], 0x1080
jns 0x464ad7
std
invalid
lea edi, [edx]
add byte [eax + eax], al
add al, 0
add byte [eax + 0x2e000010], al
int3
Function at 0x4b033f
Capabilities:
Encode data using xor

Disassembly:
xor byte [eax], 4
add byte [eax + 0x35], al
add byte [eax], al
add eax, dword [eax]
add dword [ebx], eax
add byte [edx], al
add byte [ecx], al
add byte [eax], cl
xor byte [eax], al
sbb al, 0x3f
jp 0x4b032c
inc ebx
add byte [eax], al
add byte [eax], al
add al, byte [eax]
add dword [eax], eax

Function at 0x4cf297
Capabilities:
Encode data using xor

Disassembly:
mov bl, 0x17
bound edi, qword [esi - 0x7dd49e1a]
out dx, al
push esp
das
cdq
xor al, 0x37
xor al, 0xcb
sub eax, 0x96ebd85e
insd dword es:[edi], dx
scasd eax, dword es:[edi]
pop ds
pandn mm2, qword [ecx]
std
pop edx
lcall 0x727c, 0x6e7a5f9e
pop edi
jp 0x4cf308
jl 0x4cf30e
test dword [edx - 0x42a4be82], 0xee343985
call 0xdc2e864a
mov eax, 0xfbcc2694
xor eax, 0x7eeae23b
shl dword [ebp + 0x24], cl
scasd eax, dword es:[edi]
out dx, eax
pop edx
fcom qword [ebp - 0x6376d279]
pushfd
push edx
xlatb
inc ebp
loop 0x4cf276
sbb dword [edi - 8], edx
cmpsb byte fs:[esi], byte es:[edi]
xor dh, ah
stosd dword es:[edi], eax
xchg esi, eax
dec ebp
mov ecx, 0x926d6bd2
xchg edx, eax
xchg edx, eax
jg 0x4cf2c1
sbb byte [ebp + 0x55baac3c], 0xdf
imul edi, dword [edi + 0x54993f24], 0x1858b912
retf

Function at 0x4d0279
Capabilities:
Encode data using xor

Disassembly:
dec esi
call 0xfe6a14c1
mov ebp, dword [ebx + ebp*4 - 0x24606080]
in eax, dx
das
mov bh, bh
mov bh, 0x59
pop ecx
mov ebp, 0x7d9f46c2
inc ecx
adc al, 0xef
clc
salc
add eax, edx
dec ebx
adc al, 0x77
jne 0x4d02d8
mov dl, 0xb6
mov edx, 0xc7b58d5a
invalid
push edx
shl dword [ebp - 0x7f], cl
cmp byte [edx + 0x2d], ah
fnstenv [edx]
or eax, 0xc4b24c9a
and byte [ebx + esi*4 + 0x744cdbe7], dh
sub dword [edx + 0x48361fa8], ebp
enter 0x5eea, 0xffffffffffffff9a
or dword [ebp - 0x5fbbb7a1], ecx
xor al, 4
sbb al, 0xa7
loope 0x4d02f9
invalid
Function at 0x4d3529
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x44
push ebx
push esi
mov esi, ecx
mov ecx, 0x100
push edi
movzx eax, word [esi + 4]
mov ebx, dword [esi + 8]
cmp ax, cx
jbe 0x4d3592
push 6
pop ecx
xor eax, eax
lea edi, [esp + 0x18]
rep stosd dword es:[edi], eax
mov eax, dword [ebp + 0xc]
lea esi, [esp + 0x18]
push 6
mov dword [esp + 0x34], eax
lea edi, [esp + 0x3c]
pop ecx
lea eax, [esp + 0x30]
push eax
rep movsd dword es:[edi], dword [esi]
lea eax, [esp + 0x14]
mov ecx, ebx
push eax
call fcn.004d4bdb
mov edx, dword [ebp + 8]
mov eax, dword [esp + 0x10]
mov cl, byte [esp + 0x14]
add eax, 0x18
mov dword [edx], eax
mov eax, edx
mov byte [edx + 4], cl
jmp 0x4d3634
movzx eax, word [esi + 6]
mov ecx, ebx
mov edi, eax
mov dword [esp + 0x10], eax
push dword [esp + 0x10]
shl edi, 5
lea eax, [ebp + 0xc]
add edi, ebx
push eax
mov edx, edi
call fcn.004d49cb
mov ebx, eax
cmp ebx, edi
je 0x4d35cd
mov eax, dword [ebp + 0xc]
cmp dword [ebx], eax
jne 0x4d35cd
mov eax, dword [ebp + 8]
lea ecx, [ebx + 8]
mov dword [eax], ecx
mov byte [eax + 4], 0
jmp 0x4d3634
movzx eax, word [esi + 4]
movzx ecx, word [esi + 6]
cmp cx, ax
jae 0x4d3617
sub edi, ebx
lea eax, [ebx + 0x20]
push edi
push ebx
push eax
call sub.VCRUNTIME140.dll_memmove
mov eax, dword [ebp + 0xc]
lea edi, [esp + 0x24]
add esp, 0xc
lea edx, [ebx + 8]
inc word [esi + 6]
lea esi, [esp + 0x18]
mov dword [ebx], eax
xor eax, eax
push 6
pop ecx
rep stosd dword es:[edi], eax
mov eax, dword [ebp + 8]
mov edi, edx
push 6
pop ecx
rep movsd dword es:[edi], dword [esi]
mov dword [eax], edx
mov byte [eax + 4], 1
jmp 0x4d3634
mov eax, dword [esp + 0x10]
mov ecx, esi
inc eax
push eax
call fcn.004d363d
push dword [ebp + 0xc]
mov ecx, esi
push dword [ebp + 8]
call fcn.004d3529
mov eax, dword [ebp + 8]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x4eab49
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
push esi
lea esi, [ecx + 0x70]
mov dword [ebp - 4], eax
imul ecx, eax, 0x1000193
imul eax, edx, 0x100011b
mov dword [ebp - 8], edx
xor ecx, eax
lea eax, [ebp - 8]
push ecx
push eax
lea eax, [ebp - 0x10]
mov ecx, esi
push eax
call fcn.004d4e81
mov eax, dword [eax + 4]
test eax, eax
jne 0x4eab87
mov eax, dword [esi + 4]
cmp eax, dword [esi + 4]
pop esi
jne 0x4eab91
xor eax, eax
jmp 0x4eab94
mov eax, dword [eax + 0x10]
leave
ret 8
Function at 0x4fbd33
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov edx, dword [ebp + 8]
mov eax, 0x1fffffff
push ebx
mov ebx, ecx
bsr ecx, eax
push esi
push edi
xor edi, edi
mov dword [ebp - 0x10], ebx
inc edi
mov eax, edi
shl eax, cl
cmp edx, eax
jbe 0x4fbd62
push str.invalid_hash_bucket_count
call dword [sym.imp.MSVCP140.dll_void___cdecl_std::_Xlength_error_char_const__]
mov esi, dword [ebx + 4]
lea eax, [edx - 1]
or eax, edi
mov dword [ebp + 8], esi
bsr ecx, eax
push esi
lea ecx, [ecx + 1]
shl edi, cl
lea ecx, [ebx + 0xc]
lea eax, [edi + edi]
push eax
call fcn.0044297f
lea eax, [edi - 1]
mov dword [ebx + 0x1c], edi
mov dword [ebx + 0x18], eax
mov eax, dword [ebx + 4]
mov eax, dword [eax]
mov ecx, eax
cmp eax, esi
je 0x4fbe6d
imul edx, dword [eax + 8], 0x100011b
imul ebx, dword [eax + 0xc], 0x1000193
mov ecx, dword [ecx]
xor ebx, edx
mov edx, dword [ebp - 0x10]
and ebx, dword [edx + 0x18]
mov edx, dword [edx + 0xc]
mov dword [ebp - 8], ebx
mov dword [ebp - 0xc], edx
mov edi, dword [edx + ebx*8]
cmp edi, esi
jne 0x4fbdce
mov dword [edx + ebx*8], eax
mov dword [edx + ebx*8 + 4], eax
jmp 0x4fbe63
mov edx, dword [edx + ebx*8 + 4]
mov esi, dword [eax + 8]
mov dword [ebp - 4], edx
cmp esi, dword [edx + 8]
jne 0x4fbe1b
mov esi, dword [eax + 0xc]
cmp esi, dword [edx + 0xc]
mov esi, dword [ebp + 8]
jne 0x4fbe1b
mov edx, dword [edx]
mov dword [ebp - 4], edx
cmp edx, eax
je 0x4fbe12
mov ebx, dword [eax + 4]
mov esi, dword [ebp - 4]
mov dword [ebx], ecx
mov edi, dword [ecx + 4]
mov dword [edi], edx
mov edx, dword [edx + 4]
mov dword [edx], eax
mov dword [esi + 4], edi
mov esi, dword [ebp + 8]
mov dword [ecx + 4], ebx
mov ebx, dword [ebp - 8]
mov dword [eax + 4], edx
mov edi, dword [ebp - 0xc]
mov dword [edi + ebx*8 + 4], eax
jmp 0x4fbe63
cmp edi, edx
je 0x4fbe3c
mov ebx, dword [eax + 8]
mov edx, dword [edx + 4]
cmp ebx, dword [edx + 8]
jne 0x4fbe35
mov ebx, dword [eax + 0xc]
cmp ebx, dword [edx + 0xc]
je 0x4fbe74
mov ebx, dword [eax + 8]
cmp edi, edx
jne 0x4fbe22
mov dword [ebp - 4], edx
mov ebx, dword [eax + 4]
mov esi, dword [ebp - 4]
mov dword [ebx], ecx
mov edi, dword [ecx + 4]
mov dword [edi], edx
mov edx, dword [edx + 4]
mov dword [edx], eax
mov dword [esi + 4], edi
mov edi, dword [ebp - 0xc]
mov dword [ecx + 4], ebx
mov dword [eax + 4], edx
mov edx, dword [ebp - 8]
mov dword [edi + edx*8], eax
mov esi, dword [ebp + 8]
mov eax, ecx
cmp ecx, esi
jne 0x4fbd9a
pop edi
pop esi
pop ebx
leave
ret 4
mov ebx, dword [eax + 4]
mov edx, dword [edx]
mov dword [ebp - 0xc], edx
mov esi, edx
mov dword [ebx], ecx
mov edi, dword [ecx + 4]
mov dword [edi], edx
mov edx, dword [edx + 4]
mov dword [edx], eax
mov dword [esi + 4], edi
mov dword [ecx + 4], ebx
mov dword [eax + 4], edx
jmp 0x4fbe60