joyce8/EMBER2024-capa huggingface dataset:
Function at 0x478fe0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xfffffffffffffffe
push 0x5f4d60
push fcn.00556990
mov eax, dword fs:[0]
push eax
sub esp, 0x28
mov eax, dword [0x61094c]
xor dword [ebp - 8], eax
xor eax, ebp
mov dword [ebp - 0x1c], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0x10]
mov dword fs:[0], eax
mov dword [ebp - 0x18], esp
mov edi, ecx
mov dword [ebp - 0x2c], edi
mov ebx, dword [ebp + 0x14]
test ebx, ebx
je 0x479028
mov dword [ebx], 0
mov dword [ebp - 0x24], 0
mov dword [ebp - 0x28], 0x1f4
mov dword [ebp - 0x20], 0
mov dword [ebp - 4], 0
mov eax, 0x1fc
call fcn.005545a0
mov dword [ebp - 0x18], esp
mov esi, esp
mov dword [ebp - 0x30], esi
test esi, esi
je 0x479066
mov dword [esi], 0xcccc
add esi, 8
mov dword [ebp - 0x30], esi
mov dword [ebp - 0x20], esi
mov dword [ebp - 4], 0xfffffffe
jmp 0x47909d
test esi, esi
je 0x479204
lea eax, [ebp - 0x28]
push eax
push esi
lea eax, [ebp - 0x24]
push eax
push 0
push dword [ebp + 8]
push dword [edi]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov edi, eax
cmp edi, 0xea
jne 0x4791ba
add esi, 0xfffffff8
cmp dword [esi], 0xdddd
jne 0x4790dd
push esi
call fcn.0055e7dd
add esp, 4
mov dword [ebp - 0x20], 0
mov dword [ebp - 4], 1
mov edx, dword [ebp - 0x28]
lea ecx, [edx + 8]
cmp edx, ecx
sbb eax, eax
test ecx, eax
je 0x479165
cmp edx, ecx
sbb eax, eax
and eax, ecx
cmp eax, 0x400
ja 0x479135
cmp edx, ecx
sbb eax, eax
and eax, ecx
call fcn.005545a0
mov dword [ebp - 0x18], esp
mov esi, esp
mov dword [ebp - 0x34], esi
test esi, esi
je 0x479167
mov dword [esi], 0xcccc
add esi, 8
mov dword [ebp - 0x34], esi
mov dword [ebp - 0x20], esi
mov dword [ebp - 4], 0xfffffffe
jmp 0x47919b
cmp edx, ecx
sbb eax, eax
and eax, ecx
push eax
call fcn.0056027d
add esp, 4
mov esi, eax
mov dword [ebp - 0x38], esi
test esi, esi
je 0x479167
mov dword [esi], 0xdddd
add esi, 8
mov dword [ebp - 0x38], esi
mov dword [ebp - 0x20], esi
mov dword [ebp - 4], 0xfffffffe
jmp 0x47919b
xor esi, esi
mov dword [ebp - 0x20], esi
mov dword [ebp - 4], 0xfffffffe
jmp 0x47919b
test esi, esi
je 0x479204
lea eax, [ebp - 0x28]
push eax
push esi
lea eax, [ebp - 0x24]
push eax
push 0
push dword [ebp + 8]
mov eax, dword [ebp - 0x2c]
push dword [eax]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov edi, eax
test edi, edi
jne 0x4791ec
cmp dword [ebp - 0x24], 3
je 0x4791cb
mov edi, 0xd
jmp 0x4791ec
push dword [ebp + 0x10]
push dword [ebp + 0xc]
lea eax, [ebp - 0x24]
push eax
push dword [ebp - 0x28]
push esi
call fcn.00478e60
add esp, 0x14
mov edi, eax
test ebx, ebx
je 0x4791ec
mov eax, dword [ebp - 0x24]
mov dword [ebx], eax
add esi, 0xfffffff8
cmp dword [esi], 0xdddd
jne 0x479200
push esi
call fcn.0055e7dd
add esp, 4
mov eax, edi
jmp 0x479209
mov eax, 0xe
lea esp, [ebp - 0x48]
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x1c]
xor ecx, ebp
call fcn.00553cca
mov esp, ebp
pop ebp
ret 0x10
Function at 0x488c50
Capabilities:
Terminate thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, ecx
push edi
xor edi, edi
mov dword [ebp - 4], edi
lea ebx, [esi + 0x14]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
add dword [esi + 0x10], 0xffffffff
jne 0x488ccd
mov eax, dword [esi]
test eax, eax
je 0x488c7b
push eax
call dword [sym.imp.KERNEL32.dll_SetEvent]
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov ecx, dword [esi + 4]
cmp eax, dword [esi + 8]
je 0x488cc4
mov eax, dword [esi + 0xc]
mov edi, ecx
mov dword [ebp - 4], eax
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
test edi, edi
je 0x488cba
push dword [ebp - 4]
push edi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x488cb3
push 0
push edi
call dword [sym.imp.KERNEL32.dll_TerminateThread]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [esi + 0x10]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x488c91
cmp dword [esi + 0x10], edi
jge 0x488c91
push ebx
mov dword [esi + 0x10], edi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov eax, dword [esi + 0x10]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4a6310
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
xor ecx, ecx
push esi
mov edx, 0x811c9dc5
lea esi, [eax + eax]
test esi, esi
je 0x4a6342
push edi
mov edi, dword [ebp + 8]
nop dword [eax]
movzx eax, byte [ecx + edi]
inc ecx
xor eax, edx
imul edx, eax, 0x1000193
cmp ecx, esi
jb 0x4a6330
pop edi
mov eax, edx
pop esi
pop ebp
ret
Function at 0x4a6e80
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 0x10]
xor ecx, ecx
test esi, esi
je 0x4a6eab
mov edx, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0xc]
movzx eax, byte [ecx + edi]
inc ecx
xor eax, edx
imul edx, eax, 0x1000193
cmp ecx, esi
jb 0x4a6e94
pop edi
mov eax, edx
pop esi
pop ebp
ret
mov eax, dword [ebp + 8]
pop esi
pop ebp
ret
Function at 0x4aa3c0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x59102c
mov eax, dword fs:[0]
push eax
push ebx
sub esp, 0x30
push esi
push edi
mov eax, dword [0x61094c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, ecx
mov dword [ebp - 0x14], eax
mov edi, dword [ebx + 8]
lea esi, [eax + 8]
mov dword [ebp - 4], 0
xorps xmm0, xmm0
mov dword [ebp - 0x2c], edi
mov dword [ebp - 0x24], 0
movups xmmword [edi], xmm0
push esi
mov dword [ebp - 0x18], edi
movups xmmword [edi + 0x10], xmm0
mov dword [ebp - 0x20], esi
call fcn.0053fb1a
add esp, 4
test eax, eax
jne 0x4aa570
mov eax, dword [ebp - 0x14]
mov dword [ebp - 4], 1
push 0x38
mov eax, dword [eax + 0x38]
mov dword [edi], eax
mov dword [edi + 4], 0
mov dword [edi + 8], 0
call fcn.00553ee1
add esp, 4
mov dword [eax], eax
mov dword [eax + 4], eax
mov dword [edi + 4], eax
lea ecx, [edi + 0xc]
mov dword [ecx], 0
mov dword [ecx + 4], 0
mov dword [ecx + 8], 0
mov edx, dword [ebp - 0x14]
mov byte [ebp - 4], 3
mov eax, dword [edx + 0x50]
mov dword [edi + 0x18], eax
mov eax, dword [edx + 0x54]
mov dword [edi + 0x1c], eax
mov eax, dword [edx + 0x48]
sub eax, dword [edx + 0x44]
push dword [edi + 4]
sar eax, 2
push eax
call fcn.004ab880
mov eax, dword [ebp - 0x14]
mov ecx, edi
mov eax, dword [eax + 0x3c]
push eax
push dword [eax]
call fcn.004ae6f0
push esi
call fcn.0053fb3f
add esp, 4
mov dword [ebp - 4], 0
mov edi, dword [0x620594]
mov dword [ebp - 0x24], 3
mov dword [ebp - 0x20], edi
mov esi, dword [edi]
mov dword [ebp - 0x1c], esi
cmp esi, edi
je 0x4aa557
nop dword [eax]
cmp dword [esi + 0x1c], 8
lea eax, [esi + 8]
mov dword [ebp - 0x14], eax
jb 0x4aa4f1
mov ecx, dword [eax]
mov dword [ebp - 0x14], ecx
mov ecx, dword [eax + 0x10]
mov edx, 0x811c9dc5
xor eax, eax
add ecx, ecx
mov dword [ebp - 0x28], ecx
je 0x4aa51e
mov edi, dword [ebp - 0x14]
mov esi, ecx
movzx ecx, byte [eax + edi]
inc eax
xor ecx, edx
imul edx, ecx, 0x1000193
cmp eax, esi
jb 0x4aa507
mov esi, dword [ebp - 0x1c]
mov edi, dword [ebp - 0x20]
mov ecx, dword [ebp - 0x18]
lea eax, [esi + 8]
push edx
push eax
lea eax, [ebp - 0x34]
push eax
call fcn.004a6b90
mov ecx, dword [eax + 4]
test ecx, ecx
je 0x4aa53e
mov eax, dword [ebp - 0x18]
cmp dword [eax + 4], ecx
jne 0x4aa54e
mov ecx, dword [ebp - 0x18]
lea eax, [esi + 8]
push eax
lea eax, [ebp - 0x3c]
push eax
call fcn.004aca30
mov esi, dword [esi]
mov dword [ebp - 0x1c], esi
cmp esi, edi
jne 0x4aa4e0
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret 4
push eax
call fcn.0053fb6a
int3
Function at 0x4ab450
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
mov dword [ebp - 4], ecx
cmp edx, eax
je 0x4ab5de
cmp dword [edx + 0x1c], 8
mov eax, dword [ecx + 4]
push esi
mov dword [ebp - 0x18], eax
mov esi, edx
mov eax, dword [ecx + 0xc]
push edi
mov dword [ebp - 0x14], eax
lea edi, [edx + 8]
mov eax, dword [edx + 4]
mov dword [ebp - 8], eax
mov eax, dword [edi + 0x10]
jb 0x4ab48b
mov edi, dword [edi]
xor edx, edx
push ebx
mov ebx, 0x811c9dc5
add eax, eax
je 0x4ab4b4
mov ecx, eax
nop dword [eax]
movzx eax, byte [edx + edi]
inc edx
xor eax, ebx
imul ebx, eax, 0x1000193
cmp edx, ecx
jb 0x4ab4a0
mov ecx, dword [ebp - 4]
mov eax, dword [ecx + 0x18]
mov ecx, dword [ebp - 0x14]
and eax, ebx
lea eax, [ecx + eax*8]
mov ecx, dword [eax]
mov dword [ebp - 0xc], eax
mov eax, dword [eax + 4]
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0x1c], eax
nop dword [eax]
mov ebx, esi
mov dword [ebp - 0x20], esi
mov esi, dword [esi]
lea ecx, [ebx + 0x20]
call fcn.004b1330
lea ecx, [ebx + 8]
call fcn.00425730
push 0x3c
push ebx
call fcn.00554162
mov eax, dword [ebp - 4]
add esp, 8
dec dword [eax + 8]
mov eax, dword [ebp - 0x1c]
cmp ebx, eax
je 0x4ab528
mov eax, dword [ebp + 0xc]
cmp esi, eax
jne 0x4ab4d0
mov ecx, dword [ebp - 0x10]
cmp ecx, dword [ebp + 8]
jne 0x4ab5d3
mov ecx, dword [ebp - 0xc]
pop ebx
pop edi
mov dword [ecx], esi
mov ecx, dword [ebp - 8]
mov dword [ecx], esi
mov dword [esi + 4], ecx
pop esi
mov esp, ebp
pop ebp
ret 8
mov ecx, dword [ebp - 0x10]
cmp ecx, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
jne 0x4ab53a
mov eax, dword [ebp - 0x18]
mov dword [ecx], eax
jmp 0x4ab53d
mov eax, dword [ebp - 8]
mov dword [ecx + 4], eax
mov eax, dword [ebp + 0xc]
cmp esi, eax
je 0x4ab5d3
nop dword [eax + eax]
cmp dword [esi + 0x1c], 8
lea edx, [esi + 8]
mov ebx, dword [edx + 0x10]
jb 0x4ab55e
mov edx, dword [edx]
xor ecx, ecx
mov edi, 0x811c9dc5
add ebx, ebx
je 0x4ab581
nop dword [eax]
movzx eax, byte [ecx + edx]
inc ecx
xor eax, edi
imul edi, eax, 0x1000193
cmp ecx, ebx
jb 0x4ab570
mov ecx, dword [ebp - 4]
mov eax, dword [ecx + 0x18]
mov ecx, dword [ebp - 0x14]
and eax, edi
lea eax, [ecx + eax*8]
mov dword [ebp - 0x10], eax
mov eax, dword [eax + 4]
mov dword [ebp - 0x20], eax
mov ebx, esi
mov dword [ebp - 0x1c], esi
mov esi, dword [esi]
lea ecx, [ebx + 0x20]
call fcn.004b1330
lea ecx, [ebx + 8]
call fcn.00425730
push 0x3c
push ebx
call fcn.00554162
mov ecx, dword [ebp - 4]
add esp, 8
mov eax, dword [ebp - 0x20]
dec dword [ecx + 8]
cmp ebx, eax
mov eax, dword [ebp + 0xc]
je 0x4ab5e4
cmp esi, eax
jne 0x4ab598
mov ecx, dword [ebp - 0x10]
mov dword [ecx], esi
mov ecx, dword [ebp - 8]
pop ebx
pop edi
mov dword [ecx], esi
mov dword [esi + 4], ecx
pop esi
mov esp, ebp
pop ebp
ret 8
mov ecx, dword [ebp - 0x10]
mov edi, dword [ebp - 0x18]
mov dword [ecx], edi
mov dword [ecx + 4], edi
cmp esi, eax
jne 0x4ab550
mov ecx, dword [ebp - 8]
pop ebx
pop edi
mov dword [ecx], esi
mov dword [esi + 4], ecx
pop esi
mov esp, ebp
pop ebp
ret 8
Function at 0x4ab610
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
mov dword [ebp - 4], ecx
cmp edx, eax
je 0x4ab79e
cmp dword [edx + 0x1c], 8
mov eax, dword [ecx + 4]
push esi
mov dword [ebp - 0x18], eax
mov esi, edx
mov eax, dword [ecx + 0xc]
push edi
mov dword [ebp - 0x14], eax
lea edi, [edx + 8]
mov eax, dword [edx + 4]
mov dword [ebp - 8], eax
mov eax, dword [edi + 0x10]
jb 0x4ab64b
mov edi, dword [edi]
xor edx, edx
push ebx
mov ebx, 0x811c9dc5
add eax, eax
je 0x4ab674
mov ecx, eax
nop dword [eax]
movzx eax, byte [edx + edi]
inc edx
xor eax, ebx
imul ebx, eax, 0x1000193
cmp edx, ecx
jb 0x4ab660
mov ecx, dword [ebp - 4]
mov eax, dword [ecx + 0x18]
mov ecx, dword [ebp - 0x14]
and eax, ebx
lea eax, [ecx + eax*8]
mov ecx, dword [eax]
mov dword [ebp - 0xc], eax
mov eax, dword [eax + 4]
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0x1c], eax
nop dword [eax]
mov ebx, esi
mov dword [ebp - 0x20], esi
mov esi, dword [esi]
lea ecx, [ebx + 0x20]
call fcn.00425730
lea ecx, [ebx + 8]
call fcn.00425730
push 0x38
push ebx
call fcn.00554162
mov eax, dword [ebp - 4]
add esp, 8
dec dword [eax + 8]
mov eax, dword [ebp - 0x1c]
cmp ebx, eax
je 0x4ab6e8
mov eax, dword [ebp + 0xc]
cmp esi, eax
jne 0x4ab690
mov ecx, dword [ebp - 0x10]
cmp ecx, dword [ebp + 8]
jne 0x4ab793
mov ecx, dword [ebp - 0xc]
pop ebx
pop edi
mov dword [ecx], esi
mov ecx, dword [ebp - 8]
mov dword [ecx], esi
mov dword [esi + 4], ecx
pop esi
mov esp, ebp
pop ebp
ret 8
mov ecx, dword [ebp - 0x10]
cmp ecx, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
jne 0x4ab6fa
mov eax, dword [ebp - 0x18]
mov dword [ecx], eax
jmp 0x4ab6fd
mov eax, dword [ebp - 8]
mov dword [ecx + 4], eax
mov eax, dword [ebp + 0xc]
cmp esi, eax
je 0x4ab793
nop dword [eax + eax]
cmp dword [esi + 0x1c], 8
lea edx, [esi + 8]
mov ebx, dword [edx + 0x10]
jb 0x4ab71e
mov edx, dword [edx]
xor ecx, ecx
mov edi, 0x811c9dc5
add ebx, ebx
je 0x4ab741
nop dword [eax]
movzx eax, byte [ecx + edx]
inc ecx
xor eax, edi
imul edi, eax, 0x1000193
cmp ecx, ebx
jb 0x4ab730
mov ecx, dword [ebp - 4]
mov eax, dword [ecx + 0x18]
mov ecx, dword [ebp - 0x14]
and eax, edi
lea eax, [ecx + eax*8]
mov dword [ebp - 0x10], eax
mov eax, dword [eax + 4]
mov dword [ebp - 0x20], eax
mov ebx, esi
mov dword [ebp - 0x1c], esi
mov esi, dword [esi]
lea ecx, [ebx + 0x20]
call fcn.00425730
lea ecx, [ebx + 8]
call fcn.00425730
push 0x38
push ebx
call fcn.00554162
mov ecx, dword [ebp - 4]
add esp, 8
mov eax, dword [ebp - 0x20]
dec dword [ecx + 8]
cmp ebx, eax
mov eax, dword [ebp + 0xc]
je 0x4ab7a4
cmp esi, eax
jne 0x4ab758
mov ecx, dword [ebp - 0x10]
mov dword [ecx], esi
mov ecx, dword [ebp - 8]
pop ebx
pop edi
mov dword [ecx], esi
mov dword [esi + 4], ecx
pop esi
mov esp, ebp
pop ebp
ret 8
mov ecx, dword [ebp - 0x10]
mov edi, dword [ebp - 0x18]
mov dword [ecx], edi
mov dword [ecx + 4], edi
cmp esi, eax
jne 0x4ab710
mov ecx, dword [ebp - 8]
pop ebx
pop edi
mov dword [ecx], esi
mov dword [esi + 4], ecx
pop esi
mov esp, ebp
pop ebp
ret 8
Function at 0x4ac0c0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov edx, dword [ebp + 0xc]
mov eax, ecx
push ebx
push esi
push edi
cmp dword [edx + 0x14], 8
mov edi, edx
mov ebx, dword [edx + 0x10]
mov dword [ebp - 4], eax
jb 0x4ac0de
mov edi, dword [edx]
xor ecx, ecx
mov esi, 0x811c9dc5
add ebx, ebx
je 0x4ac104
nop dword [eax]
movzx eax, byte [ecx + edi]
inc ecx
xor eax, esi
imul esi, eax, 0x1000193
cmp ecx, ebx
jb 0x4ac0f0
mov eax, dword [ebp - 4]
push esi
push edx
lea ecx, [ebp - 0xc]
push ecx
mov ecx, eax
call fcn.004a6b90
pop edi
pop esi
pop ebx
mov ecx, dword [eax + 4]
mov eax, dword [ebp + 8]
test ecx, ecx
jne 0x4ac124
mov ecx, dword [ebp - 4]
mov ecx, dword [ecx + 4]
mov dword [eax], ecx
mov esp, ebp
pop ebp
ret 8

Function at 0x4ac170
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [ebp + 0xc]
cmp dword [eax + 0x1c], 8
push ebx
mov ebx, dword [eax + 0x18]
mov dword [ebp - 4], ecx
lea ecx, [eax + 8]
push esi
push edi
mov dword [ebp - 8], ecx
mov edi, ecx
jb 0x4ac192
mov edi, dword [ecx]
xor edx, edx
mov esi, 0x811c9dc5
add ebx, ebx
je 0x4ac1b1
nop dword [eax]
movzx ecx, byte [edx + edi]
inc edx
xor ecx, esi
imul esi, ecx, 0x1000193
cmp edx, ebx
jb 0x4ac1a0
mov ebx, dword [ebp - 4]
mov edx, dword [ebx + 0x18]
mov ecx, dword [ebx + 0xc]
and edx, esi
mov esi, dword [ecx + edx*8]
cmp dword [ecx + edx*8 + 4], eax
jne 0x4ac1de
cmp esi, eax
jne 0x4ac1d5
mov eax, dword [ebx + 4]
mov dword [ecx + edx*8], eax
mov dword [ecx + edx*8 + 4], eax
jmp 0x4ac1e7
mov eax, dword [eax + 4]
mov dword [ecx + edx*8 + 4], eax
jmp 0x4ac1e7
cmp esi, eax
jne 0x4ac1ea
mov eax, dword [eax]
mov dword [ecx + edx*8], eax
mov eax, dword [ebp + 0xc]
mov esi, dword [eax]
dec dword [ebx + 8]
mov eax, dword [eax + 4]
mov edi, dword [ebp - 8]
mov dword [eax], esi
mov eax, dword [ebp + 0xc]
lea ecx, [edi + 0x18]
mov eax, dword [eax + 4]
mov dword [esi + 4], eax
call fcn.00425730
mov ecx, edi
call fcn.00425730
push 0x38
push dword [ebp + 0xc]
call fcn.00554162
mov eax, dword [ebp + 8]
add esp, 8
pop edi
mov dword [eax], esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x4ae730
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5916c5
mov eax, dword fs:[0]
push eax
sub esp, 0x24
push ebx
push esi
push edi
mov eax, dword [0x61094c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x14], edi
mov edx, dword [ebp + 0xc]
mov ebx, dword [ebp + 8]
mov dword [ebp - 0x10], edx
mov dword [ebp - 0x18], edx
cmp dword [edx + 0x14], 8
mov ecx, dword [edx + 0x10]
jb 0x4ae777
mov eax, dword [edx]
mov dword [ebp - 0x18], eax
lea eax, [ecx + ecx]
mov esi, 0x811c9dc5
xor ecx, ecx
test eax, eax
je 0x4ae7a7
mov edi, dword [ebp - 0x18]
mov edx, eax
nop word [eax + eax]
movzx eax, byte [ecx + edi]
inc ecx
xor eax, esi
imul esi, eax, 0x1000193
cmp ecx, edx
jb 0x4ae790
mov edi, dword [ebp - 0x14]
mov edx, dword [ebp - 0x10]
push esi
push edx
lea eax, [ebp - 0x24]
mov ecx, edi
push eax
call fcn.004a6b90
mov eax, dword [ebp - 0x20]
test eax, eax
je 0x4ae7c6
mov dword [ebx], eax
mov byte [ebx + 4], 0
jmp 0x4ae8fb
cmp dword [edi + 8], 0x71c71c7
je 0x4ae911
lea eax, [edi + 4]
mov dword [ebp - 0x2c], eax
mov dword [ebp - 4], 0
push 0x24
mov dword [ebp - 0x28], 0
call fcn.00553ee1
add esp, 4
mov edi, eax
mov dword [ebp - 0x28], edi
push dword [ebp - 0x10]
lea ecx, [edi + 8]
call fcn.00428970
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax + 0x18]
mov dword [edi + 0x20], ecx
mov edx, dword [ebp - 0x14]
mov dword [ebp - 4], 1
mov eax, dword [edx + 8]
inc eax
movss xmm3, dword [edx]
movd xmm0, eax
cvtdq2pd xmm0, xmm0
shr eax, 0x1f
addsd xmm0, qword [eax*8 + 0x5e2f00]
mov eax, dword [edx + 0x1c]
mov dword [ebp - 0x1c], eax
movd xmm1, eax
cvtdq2pd xmm1, xmm1
shr eax, 0x1f
cvtpd2ps xmm0, xmm0
addsd xmm1, qword [eax*8 + 0x5e2f00]
movaps xmm2, xmm0
cvtpd2ps xmm1, xmm1
divss xmm2, xmm1
comiss xmm2, xmm3
jbe 0x4ae8ae
divss xmm0, xmm3
call fcn.004a6e40
call fcn.005545d0
mov ecx, 8
cmp eax, ecx
cmova ecx, eax
mov eax, dword [ebp - 0x1c]
cmp eax, ecx
jae 0x4ae88d
cmp eax, 0x200
jae 0x4ae88b
shl eax, 3
cmp eax, ecx
jae 0x4ae88d
mov eax, ecx
mov ecx, dword [ebp - 0x14]
push eax
call fcn.004a6820
mov ecx, dword [ebp - 0x14]
lea eax, [edi + 8]
push esi
push eax
lea eax, [ebp - 0x24]
push eax
call fcn.004a6b90
mov edx, dword [ebp - 0x14]
mov ecx, dword [eax]
jmp 0x4ae8b1
mov ecx, dword [ebp - 0x24]
mov eax, dword [ecx + 4]
inc dword [edx + 8]
mov dword [edi + 4], eax
mov dword [edi], ecx
mov dword [eax], edi
mov dword [ecx + 4], edi
mov dword [ebp - 0x10], eax
mov eax, dword [edx + 0x18]
and eax, esi
mov dword [ebp - 0x18], ecx
mov ecx, dword [edx + 0xc]
mov esi, dword [ebp - 0x2c]
mov edx, dword [ecx + eax*8]
cmp edx, dword [esi]
jne 0x4ae8de
mov dword [ecx + eax*8], edi
jmp 0x4ae8f1
cmp edx, dword [ebp - 0x18]
jne 0x4ae8e8
mov dword [ecx + eax*8], edi
jmp 0x4ae8f5
mov edx, dword [ebp - 0x10]
cmp dword [ecx + eax*8 + 4], edx
jne 0x4ae8f5
mov dword [ecx + eax*8 + 4], edi
mov dword [ebx], edi
mov byte [ebx + 4], 1
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
push str.unordered_map_set_too_long
call fcn.0053ec92
int3
Function at 0x4b1ba0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x591c2e
mov eax, dword fs:[0]
push eax
sub esp, 0x30
push ebx
push esi
push edi
mov eax, dword [0x61094c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x1c], ecx
mov edx, dword [ebp + 0x10]
mov ecx, edx
mov eax, dword [ebp + 8]
mov ebx, dword [ebp + 0xc]
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x3c], 0
lea esi, [ecx + 2]
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x38], 0
mov dword [ebp - 0x28], 0
mov dword [ebp - 0x24], 7
nop dword [eax + eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x4b1c00
sub ecx, esi
sar ecx, 1
push ecx
push edx
lea ecx, [ebp - 0x38]
call fcn.00425790
mov eax, dword [ebp - 0x28]
lea esi, [ebp - 0x38]
cmp dword [ebp - 0x24], 8
mov edx, 0x811c9dc5
cmovae esi, dword [ebp - 0x38]
xor ecx, ecx
lea edi, [eax + eax]
test edi, edi
je 0x4b1c46
movzx eax, byte [ecx + esi]
inc ecx
xor eax, edx
imul edx, eax, 0x1000193
cmp ecx, edi
jb 0x4b1c35
push edx
lea eax, [ebp - 0x38]
mov ecx, ebx
push eax
lea eax, [ebp - 0x14]
push eax
call fcn.004a6b90
mov esi, dword [eax + 4]
test esi, esi
jne 0x4b1c60
mov esi, dword [ebx + 4]
lea ecx, [ebp - 0x38]
call fcn.00425730
cmp esi, dword [ebx + 4]
jne 0x4b1c8f
xorps xmm0, xmm0
movlpd qword [ebp - 0x14], xmm0
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x10], 0
lea ecx, [ebp - 0x14]
mov ebx, 1
xor eax, eax
jmp 0x4b1cc0
mov edi, dword [esi + 0x44]
test edi, edi
je 0x4b1d4d
mov ecx, dword [ebp - 0x1c]
mov eax, dword [edi]
push dword [ecx + 0x1c]
mov esi, dword [eax + 8]
lea ecx, [ebp - 0x20]
push ecx
mov ecx, esi
call dword [0x5a0478]
mov ecx, edi
call esi
mov eax, dword [ebp - 0x20]
lea ecx, [ebp - 0x20]
mov ebx, 0xa
mov edx, dword [ebp - 0x18]
or ebx, 4
or edi, 0xffffffff
mov dword [ecx], 0
mov dword [edx], eax
mov eax, dword [ecx + 4]
mov dword [edx + 4], eax
mov dword [ecx + 4], 0
test bl, 2
je 0x4b1d0c
mov esi, dword [ebp - 0x1c]
and ebx, 0xfffffffd
test esi, esi
je 0x4b1d0c
mov eax, edi
lock xadd dword [esi + 4], eax
jne 0x4b1d0c
mov eax, dword [esi]
mov ecx, esi
call dword [eax]
mov eax, edi
lock xadd dword [esi + 8], eax
jne 0x4b1d0c
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 4]
test bl, 1
je 0x4b1d36
mov esi, dword [ebp - 0x10]
test esi, esi
je 0x4b1d36
mov eax, edi
lock xadd dword [esi + 4], eax
jne 0x4b1d36
mov eax, dword [esi]
mov ecx, esi
call dword [eax]
lock xadd dword [esi + 8], edi
dec edi
jne 0x4b1d36
mov edx, dword [esi]
mov ecx, esi
call dword [edx + 4]
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
call fcn.0053ec55
int3