joyce8/EMBER2024-capa huggingface dataset:
Function at 0x444320
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4a2025
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push ebx
push esi
push edi
mov eax, dword [0x4c6180]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov ebx, dword [ebp + 0xc]
movzx eax, byte [ebx]
xor eax, 0x811c9dc5
imul edx, eax, 0x1000193
movzx eax, byte [ebx + 1]
xor edx, eax
movzx eax, byte [ebx + 2]
imul edx, edx, 0x1000193
xor edx, eax
movzx eax, byte [ebx + 3]
imul ecx, edx, 0x1000193
xor ecx, eax
imul eax, ecx, 0x1000193
mov ecx, edi
push eax
mov dword [ebp + 0xc], eax
lea eax, [ebp - 0x1c]
push ebx
push eax
call fcn.0041d7b0
mov ecx, dword [ebp - 0x18]
test ecx, ecx
je 0x4443b3
mov eax, dword [ebp + 8]
mov dword [eax], ecx
mov byte [eax + 4], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
cmp dword [edi + 8], 0x11a7b96
je 0x4444f0
lea eax, [edi + 4]
mov dword [ebp - 0x14], eax
mov dword [ebp - 4], 0
push 0xe8
mov dword [ebp - 0x10], 0
call fcn.00474a76
mov ecx, dword [ebx]
lea edx, [ebx + 8]
mov esi, eax
add esp, 4
mov dword [ebp - 0x10], esi
mov dword [esi + 8], ecx
lea ecx, [esi + 0x10]
push edx
call fcn.0043be60
mov dword [ebp - 4], 1
mov eax, dword [edi + 8]
mov ebx, dword [edi + 0x1c]
inc eax
movss xmm3, dword [edi]
movd xmm0, eax
cvtdq2pd xmm0, xmm0
shr eax, 0x1f
movd xmm1, ebx
addsd xmm0, qword [eax*8 + 0x4b5140]
cvtdq2pd xmm1, xmm1
mov eax, ebx
shr eax, 0x1f
cvtpd2ps xmm0, xmm0
addsd xmm1, qword [eax*8 + 0x4b5140]
movaps xmm2, xmm0
cvtpd2ps xmm1, xmm1
divss xmm2, xmm1
comiss xmm2, xmm3
jbe 0x444492
divss xmm0, xmm3
call fcn.00407430
call fcn.0049c5e0
mov ecx, 8
cmp eax, ecx
cmova ecx, eax
cmp ebx, ecx
jae 0x444474
cmp ebx, 0x200
jae 0x444472
shl ebx, 3
cmp ebx, ecx
jae 0x444474
mov ebx, ecx
push ebx
mov ecx, edi
call fcn.0041dba0
push dword [ebp + 0xc]
lea eax, [esi + 8]
mov ecx, edi
push eax
lea eax, [ebp - 0x1c]
push eax
call fcn.0041d7b0
mov edx, dword [eax]
jmp 0x444495
mov edx, dword [ebp - 0x1c]
mov ebx, dword [edx + 4]
inc dword [edi + 8]
mov dword [esi], edx
mov dword [esi + 4], ebx
mov dword [ebx], esi
mov dword [edx + 4], esi
mov eax, dword [edi + 0x18]
and eax, dword [ebp + 0xc]
mov ecx, dword [edi + 0xc]
mov esi, dword [ebp - 0x14]
mov edi, dword [ecx + eax*8]
cmp edi, dword [esi]
mov esi, dword [ebp - 0x10]
jne 0x4444c0
mov dword [ecx + eax*8], esi
jmp 0x4444cf
cmp edi, edx
jne 0x4444c9
mov dword [ecx + eax*8], esi
jmp 0x4444d3
cmp dword [ecx + eax*8 + 4], ebx
jne 0x4444d3
mov dword [ecx + eax*8 + 4], esi
mov eax, dword [ebp + 8]
mov dword [eax], esi
mov byte [eax + 4], 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
push str.unordered_map_set_too_long
call fcn.0045bc99
int3
Function at 0x444a10
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 8]
sub esp, 0x1c
push ebx
push edi
mov edi, dword [ebp + 0xc]
mov ebx, ecx
cmp edx, edi
jne 0x444a2e
mov eax, edi
pop edi
pop ebx
mov esp, ebp
pop ebp
ret 8
mov eax, dword [ebx + 4]
mov dword [ebp - 0x14], eax
mov eax, dword [edx + 4]
mov dword [ebp - 4], eax
movzx eax, byte [edx + 8]
xor eax, 0x811c9dc5
imul ecx, eax, 0x1000193
movzx eax, byte [edx + 9]
push esi
mov esi, dword [ebx + 0xc]
mov dword [ebp - 0x1c], esi
xor ecx, eax
movzx eax, byte [edx + 0xa]
imul ecx, ecx, 0x1000193
xor ecx, eax
movzx eax, byte [edx + 0xb]
imul ecx, ecx, 0x1000193
xor ecx, eax
mov eax, dword [ebx + 0x18]
imul ecx, ecx, 0x1000193
and eax, ecx
mov ecx, dword [esi + eax*8]
mov dword [ebp - 0x10], ecx
lea eax, [esi + eax*8]
mov esi, dword [edx]
mov dword [ebp - 8], eax
mov eax, dword [eax + 4]
mov dword [ebp - 0xc], eax
call fcn.004438d0
dec dword [ebx + 8]
mov eax, dword [ebp + 8]
cmp eax, dword [ebp - 0xc]
je 0x444abe
nop dword [eax]
mov dword [ebp - 0x18], esi
cmp esi, edi
je 0x444acd
mov edx, esi
mov esi, dword [esi]
call fcn.004438d0
dec dword [ebx + 8]
mov eax, dword [ebp - 0xc]
cmp dword [ebp - 0x18], eax
jne 0x444aa0
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 8]
cmp dword [ebp - 0x10], eax
jne 0x444aed
mov eax, dword [ebp - 0x14]
mov dword [ecx], eax
jmp 0x444af0
mov ecx, dword [ebp - 0x10]
cmp ecx, dword [ebp + 8]
jne 0x444ada
mov ecx, dword [ebp - 8]
mov dword [ecx], esi
mov eax, dword [ebp - 4]
mov dword [eax], esi
mov dword [esi + 4], eax
mov eax, edi
pop esi
pop edi
pop ebx
mov esp, ebp
pop ebp
ret 8
mov eax, dword [ebp - 4]
mov dword [ecx + 4], eax
cmp esi, edi
je 0x444ada
nop word [eax + eax]
movzx eax, byte [esi + 8]
mov edx, esi
xor eax, 0x811c9dc5
mov edi, esi
imul ecx, eax, 0x1000193
movzx eax, byte [esi + 9]
xor ecx, eax
movzx eax, byte [esi + 0xa]
imul ecx, ecx, 0x1000193
xor ecx, eax
movzx eax, byte [esi + 0xb]
mov esi, dword [esi]
imul ecx, ecx, 0x1000193
xor ecx, eax
mov eax, dword [ebx + 0x18]
imul ecx, ecx, 0x1000193
and eax, ecx
mov ecx, dword [ebp - 0x1c]
lea eax, [ecx + eax*8]
mov dword [ebp - 0x10], eax
mov eax, dword [eax + 4]
mov dword [ebp + 8], eax
call fcn.004438d0
dec dword [ebx + 8]
cmp edi, dword [ebp + 8]
je 0x444b7a
nop word [eax + eax]
mov eax, dword [ebp + 0xc]
mov edi, esi
cmp esi, eax
je 0x444ba3
mov edx, esi
mov esi, dword [esi]
call fcn.004438d0
dec dword [ebx + 8]
cmp edi, dword [ebp + 8]
jne 0x444b60
mov ecx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x14]
mov edi, dword [ebp + 0xc]
mov dword [ecx], eax
mov dword [ecx + 4], eax
cmp esi, edi
jne 0x444b00
mov eax, dword [ebp - 4]
mov dword [eax], esi
mov dword [esi + 4], eax
mov eax, edi
pop esi
pop edi
pop ebx
mov esp, ebp
pop ebp
ret 8
mov ecx, dword [ebp - 0x10]
mov dword [ecx], esi
mov ecx, dword [ebp - 4]
mov dword [ecx], esi
mov dword [esi + 4], ecx
pop esi
pop edi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x44a280
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4a234d
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push ebx
push esi
push edi
mov eax, dword [0x4c6180]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
lea esi, [edi + 4]
push esi
mov dword [ebp - 0x10], esi
call fcn.0045d274
add esp, 4
test eax, eax
jne 0x44a3a1
mov eax, dword [esi + 0x2c]
cmp eax, 0x7fffffff
je 0x44a3a8
lea eax, [ebp + 8]
mov dword [ebp - 4], 0
push eax
lea ecx, [edi + 0x3c]
call fcn.0044aa80
test byte [eax], 0x20
jne 0x44a384
lea ecx, [ebp + 8]
push ecx
lea ecx, [ebp - 0x1c]
push ecx
lea ecx, [edi + 0x5c]
call fcn.00402c40
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp + 8]
cmp byte [eax + 0xd], 0
jne 0x44a311
cmp ecx, dword [eax + 0x10]
jb 0x44a311
cmp eax, dword [edi + 0x5c]
jne 0x44a384
movzx eax, cl
xor eax, 0x811c9dc5
imul ecx, eax, 0x1000193
movzx eax, byte [ebp + 9]
xor ecx, eax
movzx eax, byte [ebp + 0xa]
imul ecx, ecx, 0x1000193
xor ecx, eax
movzx eax, byte [ebp + 0xb]
imul ecx, ecx, 0x1000193
xor ecx, eax
imul eax, ecx, 0x1000193
lea ecx, [edi + 0x3c]
push eax
lea eax, [ebp + 8]
push eax
lea eax, [ebp - 0x18]
push eax
call fcn.0041d7b0
mov ecx, dword [eax + 4]
test ecx, ecx
jne 0x44a35e
mov ecx, dword [edi + 0x40]
cmp ecx, dword [edi + 0x40]
je 0x44a384
mov eax, dword [ebp + 0xc]
mov dword [ecx + 0x10], eax
lea eax, [ebp + 8]
push eax
lea ecx, [edi + 0x3c]
call fcn.0044aa80
mov dword [ebp + 0xc], eax
lea ecx, [edi + 0x34]
lea eax, [ebp + 0xc]
push eax
call fcn.0044aaa0
push esi
call fcn.0045d285
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
push 5
call fcn.0045d4c6
dec eax
push 6
mov dword [esi + 0x2c], eax
call fcn.0045d4c6
int3
Function at 0x44ad70
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4a24ed
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x4c6180]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x10], edi
mov eax, dword [ebp + 8]
mov dword [edi], eax
mov dword [edi + 4], 0
mov dword [ebp - 4], 0
push 0xe8
mov dword [edi + 4], 0
call fcn.00474a76
mov ecx, dword [ebp + 0x10]
mov esi, eax
mov dword [edi + 4], esi
push 0xd4
push 0
mov ecx, dword [ecx]
mov ecx, dword [ecx]
mov dword [esi + 8], ecx
lea ecx, [esi + 0x14]
push ecx
call fcn.00476f60
add esp, 0x10
mov dword [esi + 0x10], 1
mov dword [esi + 0x14], 0
mov byte [ebp - 4], 1
call fcn.0040a3a0
mov ecx, eax
test ecx, ecx
je 0x44afcb
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [esi + 0x18], eax
mov byte [ebp - 4], 2
call fcn.0040a3a0
mov ecx, eax
test ecx, ecx
je 0x44afcb
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [esi + 0x1c], eax
mov byte [ebp - 4], 3
call fcn.0040a3a0
test eax, eax
je 0x44afcb
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0xc]
add eax, 0x10
xorps xmm0, xmm0
mov dword [esi + 0x20], eax
mov eax, edi
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x2c], 0
mov dword [esi + 0x30], 0
mov dword [esi + 0x34], 0
movq qword [esi + 0x38], xmm0
mov dword [esi + 0x40], 0
mov byte [esi + 0x44], 0
mov dword [esi + 0x48], 0
mov dword [esi + 0x4c], 0
mov dword [esi + 0x50], 0
mov dword [esi + 0x54], 0
movq qword [esi + 0x58], xmm0
mov dword [esi + 0x60], 0
mov byte [esi + 0x64], 0
movsd qword [esi + 0x68], xmm0
mov dword [esi + 0x70], 0
mov dword [esi + 0x74], 0
mov dword [esi + 0x78], 0
mov dword [esi + 0x7c], 0
mov dword [esi + 0x80], 0
mov dword [esi + 0x84], 0
mov dword [esi + 0x88], 0
mov dword [esi + 0x8c], 0
mov dword [esi + 0x90], 0
mov dword [esi + 0x94], 0
mov dword [esi + 0x98], 0
mov dword [esi + 0x9c], 0
mov byte [esi + 0xa0], 1
movsd qword [esi + 0xa8], xmm0
mov dword [esi + 0xb0], 0
mov dword [esi + 0xb4], 0
mov dword [esi + 0xb8], 0
mov dword [esi + 0xbc], 0
mov dword [esi + 0xc0], 0
mov dword [esi + 0xc4], 0
mov dword [esi + 0xc8], 0
mov dword [esi + 0xcc], 0
mov dword [esi + 0xd0], 0
mov dword [esi + 0xd4], 0
mov dword [esi + 0xd8], 0
mov dword [esi + 0xdc], 0
mov dword [esi + 0xe0], 0
mov dword [esi + 0xe4], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 0x10
push 0x80004005
call fcn.00407590
int3
Function at 0x44d380
Capabilities:
Terminate process

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4a27cd
mov eax, dword fs:[0]
push eax
push ecx
push ebx
sub esp, 0x30
mov eax, dword [0x4c6180]
xor eax, ebp
mov dword [ebp - 0x1c], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov edx, ecx
mov dword [ebp - 4], 0
lea esi, [ecx + 2]
xorps xmm0, xmm0
mov dword [ebp - 0x24], 0
movups xmmword [ebp - 0x34], xmm0
mov dword [ebp - 0x20], 0
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x44d3e3
sub ecx, esi
sar ecx, 1
push ecx
push edx
lea ecx, [ebp - 0x34]
call fcn.004074a0
mov byte [ebp - 4], 1
call fcn.0047a326
cmp dword [ebp - 0x20], 7
lea esi, [ebp - 0x34]
mov edi, eax
lea eax, [ebp - 0x38]
cmova esi, dword [ebp - 0x34]
push 0xa
push eax
push esi
mov dword [edi], 0
call fcn.00482a04
add esp, 0xc
mov dword [ebp - 0x3c], eax
cmp esi, dword [ebp - 0x38]
je 0x44d4bc
cmp dword [edi], 0x22
je 0x44d4c6
mov ecx, dword [ebp - 0x20]
cmp ecx, 7
jbe 0x44d475
mov edx, dword [ebp - 0x34]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x44d468
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x44d4d0
push ecx
push edx
call fcn.00474a68
mov eax, dword [ebp - 0x3c]
add esp, 8
push eax
push 0
push 0x1fffff
call dword [sym.imp.KERNEL32.dll_OpenProcess]
test eax, eax
je 0x44d49e
push 0
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
jmp 0x44d49e
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x1c]
xor ecx, ebp
call fcn.00474a5a
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret
push str.invalid_stoul_argument
call fcn.0045bc79
push str.stoul_argument_out_of_range
call fcn.0045bcb9
call fcn.0047a0cf
int3
Function at 0x44e400
Capabilities:
Connect pipe
Write file on windows
Write pipe

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push 0x4c6c94
mov esi, ecx
call fcn.0045d274
add esp, 4
test eax, eax
jne 0x44e483
cmp dword [0x4c6cc0], 0x7fffffff
je 0x44e48a
mov eax, dword [0x4c6c88]
push 0
push eax
call dword [sym.imp.KERNEL32.dll_ConnectNamedPipe]
test eax, eax
jne 0x44e444
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x217
jne 0x44e46c
mov edx, dword [esi]
mov ecx, dword [0x4c6c88]
mov eax, dword [edx - 0xc]
push 0
lea esi, [ebp - 4]
push esi
push eax
push edx
push ecx
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x44e46c
cmp dword [ebp - 4], 0
jbe 0x44e46c
mov bl, 1
jmp 0x44e46e
xor bl, bl
push 0x4c6c94
call fcn.0045d285
add esp, 4
mov al, bl
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 5
call fcn.0045d4c6
push 6
mov dword [0x4c6cc0], 0x7ffffffe
call fcn.0045d4c6
int3

Function at 0x44ea50
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push esi
mov esi, dword [ecx + 4]
call fcn.0044ec80
lea eax, [ebp - 4]
mov dword [ebp - 8], 0
push eax
push 0xf003f
push 0
push dword [0x4cc2cc]
mov dword [ebp - 4], 0
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
push 4
lea eax, [ebp - 8]
push eax
push 4
push 0
push str.status
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call fcn.0044ec80
xor ecx, ecx
call fcn.0044f810
push 0
mov ecx, esi
call fcn.004253f0
xor al, al
mov ecx, 0x4c6c80
xchg byte [ecx], al
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x44eeb0
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 0xc]
sub esp, 8
movzx eax, dl
xor eax, 0x811c9dc5
push ebx
imul ebx, eax, 0x1000193
mov eax, edx
sar eax, 8
movzx eax, al
push esi
push edi
xor eax, ebx
mov edi, ecx
imul ecx, eax, 0x1000193
mov eax, edx
sar eax, 0x10
movzx eax, al
sar edx, 0x18
xor ecx, eax
movzx eax, dl
imul ecx, ecx, 0x1000193
xor ecx, eax
imul eax, ecx, 0x1000193
lea ecx, [edi + 0x40]
push eax
lea eax, [ebp + 0xc]
push eax
lea eax, [ebp - 8]
push eax
call fcn.0041d7b0
mov eax, dword [eax + 4]
test eax, eax
jne 0x44ef15
mov eax, dword [edi + 0x44]
cmp eax, dword [edi + 0x44]
je 0x44ef71
movzx eax, byte [ebp + 0xd]
xor eax, ebx
imul ecx, eax, 0x1000193
movzx eax, byte [ebp + 0xe]
xor ecx, eax
movzx eax, byte [ebp + 0xf]
imul edx, ecx, 0x1000193
lea ecx, [edi + 0x40]
xor edx, eax
imul eax, edx, 0x1000193
push eax
lea eax, [ebp + 0xc]
push eax
lea eax, [ebp - 8]
push eax
call fcn.0041d7b0
mov ecx, dword [ebp - 4]
test ecx, ecx
je 0x44efab
movups xmm0, xmmword [ecx + 0xc]
mov eax, dword [ebp + 8]
pop edi
pop esi
pop ebx
movups xmmword [eax], xmm0
movups xmm0, xmmword [ecx + 0x1c]
movups xmmword [eax + 0x10], xmm0
mov esp, ebp
pop ebp
ret 8
mov eax, dword [ebp + 8]
xorps xmm0, xmm0
pop edi
pop esi
pop ebx
mov dword [eax], 0
mov dword [eax + 4], 0
mov dword [eax + 8], 0
mov dword [eax + 0xc], 0
movq qword [eax + 0x10], xmm0
mov dword [eax + 0x18], 0
mov byte [eax + 0x1c], 0
mov esp, ebp
pop ebp
ret 8
push str.invalid_unordered_map_K__T__key
call fcn.0045bcb9
int3
Function at 0x44efc0
Capabilities:
Hash data using fnv
Set registry value

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4a290d
mov eax, dword fs:[0]
push eax
push ebx
sub esp, 0x30
push esi
push edi
mov eax, dword [0x4c6180]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, ecx
mov dword [ebp - 0x14], eax
mov edi, dword [ebx + 8]
lea esi, [eax + 0x40]
movzx eax, byte [edi]
xor eax, 0x811c9dc5
imul edx, eax, 0x1000193
movzx eax, byte [edi + 1]
xor edx, eax
movzx eax, byte [edi + 2]
imul ecx, edx, 0x1000193
xor ecx, eax
movzx eax, byte [edi + 3]
imul ecx, ecx, 0x1000193
xor ecx, eax
imul eax, ecx, 0x1000193
mov ecx, esi
push eax
push edi
lea eax, [ebp - 0x1c]
push eax
call fcn.0041d7b0
mov ecx, dword [eax + 4]
test ecx, ecx
jne 0x44f04f
mov ecx, dword [esi + 4]
mov eax, dword [ebp - 0x14]
push edi
cmp ecx, dword [eax + 0x44]
lea eax, [ebp - 0x1c]
mov ecx, esi
push eax
je 0x44f087
movups xmm0, xmmword [edi + 4]
movups xmmword [ebp - 0x30], xmm0
movups xmm0, xmmword [edi + 0x14]
movups xmmword [ebp - 0x40], xmm0
call fcn.00454010
movups xmm0, xmmword [ebp - 0x30]
mov eax, dword [eax]
movups xmmword [eax + 0xc], xmm0
movups xmm0, xmmword [ebp - 0x40]
movups xmmword [eax + 0x1c], xmm0
jmp 0x44f08c
call fcn.00455580
lea eax, [ebp - 0x20]
push eax
push dword [0x4cc2cc]
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyW]
mov edi, dword [ebp - 0x14]
lea eax, [ebp - 0x18]
push esi
push eax
mov ecx, edi
call fcn.00453370
mov dword [ebp - 4], 0
mov esi, dword [ebp - 0x18]
mov eax, dword [esi - 0xc]
test eax, eax
jle 0x44f0e6
add eax, eax
push eax
push esi
push 1
push str.SettingV1
push 0x4b26b0
push dword [ebp - 0x20]
call dword [sym.imp.ADVAPI32.dll_RegSetKeyValueW]
lea eax, [ebp - 0x18]
push eax
lea ecx, [edi + 0x60]
call fcn.00409ef0
push dword [ebp - 0x20]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
add esi, 0xfffffff0
or eax, 0xffffffff
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x44f107
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret 8
Function at 0x44f650
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4a29bb
mov eax, dword fs:[0]
push eax
sub esp, 0x234
mov eax, dword [0x4c6180]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
lea eax, [ebp - 0x218]
push eax
push dword [0x4cc2cc]
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyW]
lea eax, [ebp - 0x21c]
mov dword [ebp - 0x21c], 0x200
push eax
lea eax, [ebp - 0x210]
push eax
lea eax, [ebp - 0x220]
push eax
push 0
push str.SettingV1
push dword [ebp - 0x218]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [ebp - 0x218]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea ecx, [ebp - 0x210]
lea edx, [ecx + 2]
nop dword [eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x44f6e0
sub ecx, edx
sar ecx, 1
cmp ecx, 0x14
jbe 0x44f7dd
call fcn.0040a3a0
mov ecx, eax
test ecx, ecx
je 0x44f7f7
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x214], eax
lea eax, [ebp - 0x210]
mov dword [ebp - 4], 0
push eax
lea ecx, [ebp - 0x214]
call fcn.00409810
test al, al
jne 0x44f762
lea ecx, [ebp - 0x210]
lea edx, [ecx + 2]
nop dword [eax + eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x44f740
sub ecx, edx
lea eax, [ebp - 0x210]
sar ecx, 1
push ecx
push eax
lea ecx, [ebp - 0x214]
call fcn.00409a50
lea eax, [ebp - 0x214]
mov dword [ebp - 4], 1
push eax
lea eax, [ebp - 0x240]
push eax
call fcn.0044f120
push eax
lea ecx, [esi + 0x40]
call fcn.00453b80
lea ecx, [ebp - 0x240]
call fcn.00425fd0
mov dword [ebp - 4], 0xffffffff
or eax, 0xffffffff
mov edx, dword [ebp - 0x214]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x44f7b5
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
lea edx, [ebp - 0x210]
lea ecx, [esi + 0x60]
lea esi, [edx + 2]
mov ax, word [edx]
add edx, 2
test ax, ax
jne 0x44f7c1
sub edx, esi
lea eax, [ebp - 0x210]
sar edx, 1
push edx
push eax
call fcn.00409a50
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00474a5a
mov esp, ebp
pop ebp
ret
push 0x80004005
call fcn.00407590
int3
Function at 0x454010
Capabilities:
Hash data using fnv

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4a0965
mov eax, dword fs:[0]
push eax
push ebx
sub esp, 0x18
push esi
push edi
mov eax, dword [0x4c6180]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov esi, dword [ebx + 0xc]
movzx eax, byte [esi]
xor eax, 0x811c9dc5
imul edx, eax, 0x1000193
movzx eax, byte [esi + 1]
xor edx, eax
movzx eax, byte [esi + 2]
imul edx, edx, 0x1000193
xor edx, eax
movzx eax, byte [esi + 3]
imul ecx, edx, 0x1000193
xor ecx, eax
imul eax, ecx, 0x1000193
mov ecx, edi
push eax
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x1c]
push esi
push eax
call fcn.0041d7b0
mov ecx, dword [ebp - 0x18]
test ecx, ecx
je 0x4540a7
mov eax, dword [ebx + 8]
mov dword [eax], ecx
mov byte [eax + 4], 0
jmp 0x454200
cmp dword [edi + 8], 0x5d1745d
je 0x454216
lea eax, [edi + 4]
mov dword [ebp - 0x24], eax
mov dword [ebp - 4], 0
push 0x2c
mov dword [ebp - 0x20], 0
call fcn.00474a76
mov ecx, dword [ebx + 0xc]
mov esi, eax
xorps xmm0, xmm0
mov dword [ebp - 0x20], esi
add esp, 4
mov ecx, dword [ecx]
mov dword [esi + 8], ecx
movups xmmword [esi + 0xc], xmm0
movups xmmword [esi + 0x1c], xmm0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
mov dword [esi + 0x18], 0
movq qword [esi + 0x1c], xmm0
mov dword [esi + 0x24], 0
mov byte [esi + 0x28], 0
mov dword [ebp - 4], 1
mov eax, dword [edi + 8]
inc eax
movss xmm3, dword [edi]
movd xmm0, eax
cvtdq2pd xmm0, xmm0
shr eax, 0x1f
addsd xmm0, qword [eax*8 + 0x4b5140]
mov eax, dword [edi + 0x1c]
movd xmm1, eax
cvtdq2pd xmm1, xmm1
shr eax, 0x1f
cvtpd2ps xmm0, xmm0
addsd xmm1, qword [eax*8 + 0x4b5140]
movaps xmm2, xmm0
cvtpd2ps xmm1, xmm1
divss xmm2, xmm1
comiss xmm2, xmm3
jbe 0x4541b0
divss xmm0, xmm3
call fcn.00407430
call fcn.0049c5e0
mov ecx, 8
cmp eax, ecx
cmova ecx, eax
mov eax, dword [edi + 0x1c]
cmp eax, ecx
jae 0x45418c
cmp eax, 0x200
jae 0x45418a
shl eax, 3
cmp eax, ecx
jae 0x45418c
mov eax, ecx
push eax
mov ecx, edi
call fcn.0041dba0
push dword [ebp - 0x14]
lea eax, [esi + 8]
mov ecx, edi
push eax
lea eax, [ebp - 0x1c]
push eax
call fcn.0041d7b0
mov edx, dword [eax]
mov eax, dword [eax + 4]
mov dword [ebp - 0x18], eax
jmp 0x4541b3
mov edx, dword [ebp - 0x1c]
mov eax, dword [edx + 4]
inc dword [edi + 8]
mov dword [esi + 4], eax
mov dword [esi], edx
mov dword [eax], esi
mov dword [edx + 4], esi
mov ecx, dword [edi + 0xc]
mov esi, dword [ebp - 0x24]
mov dword [ebp - 0x18], eax
mov eax, dword [edi + 0x18]
and eax, dword [ebp - 0x14]
mov edi, dword [ecx + eax*8]
cmp edi, dword [esi]
mov esi, dword [ebp - 0x20]
jne 0x4541e1
mov dword [ecx + eax*8], esi
jmp 0x4541f3
cmp edi, edx
jne 0x4541ea
mov dword [ecx + eax*8], esi
jmp 0x4541f7
mov edx, dword [ebp - 0x18]
cmp dword [ecx + eax*8 + 4], edx
jne 0x4541f7
mov dword [ecx + eax*8 + 4], esi
mov eax, dword [ebx + 8]
mov dword [eax], esi
mov byte [eax + 4], 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret 8
push str.unordered_map_set_too_long
call fcn.0045bc99
int3