joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4e0da0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 0xc]
sub esp, 0xc
cmp dword [edx + 0x14], 7
mov eax, dword [edx + 0x10]
push ebx
push esi
push edi
mov ebx, ecx
mov edi, edx
jbe 0x4e0dbb
mov edi, dword [edx]
xor ecx, ecx
mov esi, 0x811c9dc5
add eax, eax
je 0x4e0ddc
mov edx, eax
movzx eax, byte [edi + ecx]
inc ecx
xor eax, esi
imul esi, eax, 0x1000193
cmp ecx, edx
jb 0x4e0dc8
mov edx, dword [ebp + 0xc]
push esi
push edx
lea eax, [ebp - 8]
mov ecx, ebx
push eax
call fcn.0045f7d0
mov ecx, dword [ebp - 4]
test ecx, ecx
je 0x4e0e02
mov eax, dword [ebp + 8]
mov dword [eax], ecx
mov byte [eax + 4], 0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
cmp dword [ebx + 8], 0x71c71c7
je 0x4e0f42
push 0x24
call fcn.005ab82c
add esp, 4
mov edi, eax
push dword [ebp + 0xc]
lea ecx, [edi + 8]
call fcn.004137f0
mov dword [edi + 0x20], 0
mov ecx, dword [ebx + 8]
mov eax, dword [ebx + 0x1c]
inc ecx
movss xmm3, dword [ebx]
movd xmm0, ecx
cvtdq2pd xmm0, xmm0
shr ecx, 0x1f
addsd xmm0, qword [ecx*8 + 0x739f30]
cvtpd2ps xmm2, xmm0
movd xmm0, eax
cvtdq2pd xmm0, xmm0
shr eax, 0x1f
movaps xmm1, xmm2
addsd xmm0, qword [eax*8 + 0x739f30]
cvtpd2ps xmm0, xmm0
divss xmm1, xmm0
comiss xmm1, xmm3
jbe 0x4e0edf
divss xmm2, xmm3
sub esp, 8
cvtps2pd xmm0, xmm2
movsd qword [ebp - 8], xmm0
fld qword [ebp - 8]
fstp qword [esp]
call fcn.005eb4a0
fstp qword [ebp - 8]
movsd xmm0, qword [ebp - 8]
add esp, 8
cvtpd2ps xmm0, xmm0
call fcn.006d4800
mov ecx, 8
cmp eax, ecx
cmova ecx, eax
mov eax, dword [ebx + 0x1c]
cmp eax, ecx
jae 0x4e0ec3
cmp eax, 0x200
jae 0x4e0ec1
shl eax, 3
cmp eax, ecx
jae 0x4e0ec3
mov eax, ecx
push eax
mov ecx, ebx
call fcn.004e1320
push esi
lea eax, [edi + 8]
mov ecx, ebx
push eax
lea eax, [ebp - 8]
push eax
call fcn.0045f7d0
mov edx, dword [eax]
jmp 0x4e0ee2
mov edx, dword [ebp - 8]
mov eax, dword [edx + 4]
inc dword [ebx + 8]
mov dword [edi + 4], eax
mov dword [edi], edx
mov dword [eax], edi
mov dword [edx + 4], edi
mov ecx, dword [ebx + 0xc]
mov dword [ebp + 0xc], eax
mov eax, dword [ebx + 0x18]
and eax, esi
mov esi, dword [ecx + eax*8]
cmp esi, dword [ebx + 4]
jne 0x4e0f0a
mov dword [ecx + eax*8], edi
jmp 0x4e0f2c
cmp esi, edx
jne 0x4e0f23
mov dword [ecx + eax*8], edi
mov eax, dword [ebp + 8]
mov dword [eax], edi
mov byte [eax + 4], 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
mov edx, dword [ebp + 0xc]
cmp dword [ecx + eax*8 + 4], edx
jne 0x4e0f30
mov dword [ecx + eax*8 + 4], edi
mov eax, dword [ebp + 8]
mov dword [eax], edi
pop edi
pop esi
mov byte [eax + 4], 1
pop ebx
mov esp, ebp
pop ebp
ret 8
push str.unordered_map_set_too_long
call fcn.005acb94
int3
Function at 0x4e0f50
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
mov ebx, dword [ebp + 0xc]
push esi
push edi
mov edi, ecx
movzx eax, byte [ebx]
xor eax, 0x811c9dc5
imul edx, eax, 0x1000193
movzx eax, byte [ebx + 1]
xor edx, eax
movzx eax, byte [ebx + 2]
imul edx, edx, 0x1000193
xor edx, eax
movzx eax, byte [ebx + 3]
imul ecx, edx, 0x1000193
xor ecx, eax
imul eax, ecx, 0x1000193
mov ecx, edi
push eax
mov dword [ebp + 0xc], eax
lea eax, [ebp - 0x10]
push ebx
push eax
call fcn.004301e0
mov ecx, dword [ebp - 0xc]
test ecx, ecx
je 0x4e0fb9
mov eax, dword [ebp + 8]
mov dword [eax], ecx
mov byte [eax + 4], 0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
cmp dword [edi + 8], 0x71c71c7
je 0x4e110b
push 0x24
call fcn.005ab82c
mov ecx, dword [ebx]
mov esi, eax
xorps xmm0, xmm0
mov dword [ebp - 4], esi
add esp, 4
mov dword [esi + 8], ecx
xor ecx, ecx
movups xmmword [esi + 0xc], xmm0
mov dword [esi + 0x1c], 0
mov dword [esi + 0x20], 7
mov word [esi + 0xc], cx
mov eax, dword [edi + 8]
mov ebx, dword [edi + 0x1c]
inc eax
movss xmm3, dword [edi]
movd xmm0, eax
cvtdq2pd xmm0, xmm0
shr eax, 0x1f
addsd xmm0, qword [eax*8 + 0x739f30]
mov eax, ebx
shr eax, 0x1f
cvtpd2ps xmm2, xmm0
movd xmm0, ebx
cvtdq2pd xmm0, xmm0
movaps xmm1, xmm2
addsd xmm0, qword [eax*8 + 0x739f30]
cvtpd2ps xmm0, xmm0
divss xmm1, xmm0
comiss xmm1, xmm3
jbe 0x4e10a9
divss xmm2, xmm3
sub esp, 8
cvtps2pd xmm0, xmm2
movsd qword [ebp - 0x10], xmm0
fld qword [ebp - 0x10]
fstp qword [esp]
call fcn.005eb4a0
fstp qword [ebp - 0x10]
movsd xmm0, qword [ebp - 0x10]
add esp, 8
cvtpd2ps xmm0, xmm0
call fcn.006d4800
mov ecx, 8
cmp eax, ecx
cmova ecx, eax
cmp ebx, ecx
jae 0x4e108b
cmp ebx, 0x200
jae 0x4e1089
shl ebx, 3
cmp ebx, ecx
jae 0x4e108b
mov ebx, ecx
push ebx
mov ecx, edi
call fcn.00430000
push dword [ebp + 0xc]
lea eax, [esi + 8]
mov ecx, edi
push eax
lea eax, [ebp - 0x10]
push eax
call fcn.004301e0
mov edx, dword [eax]
jmp 0x4e10ac
mov edx, dword [ebp - 0x10]
mov ebx, dword [edx + 4]
inc dword [edi + 8]
mov dword [esi], edx
mov dword [esi + 4], ebx
mov dword [ebx], esi
mov dword [edx + 4], esi
mov eax, dword [edi + 0x18]
and eax, dword [ebp + 0xc]
mov ecx, dword [edi + 0xc]
mov esi, dword [ecx + eax*8]
cmp esi, dword [edi + 4]
mov esi, dword [ebp - 4]
jne 0x4e10d5
mov dword [ecx + eax*8], esi
jmp 0x4e10f5
cmp dword [ecx + eax*8], edx
jne 0x4e10ef
mov dword [ecx + eax*8], esi
mov eax, dword [ebp + 8]
mov dword [eax], esi
mov byte [eax + 4], 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
cmp dword [ecx + eax*8 + 4], ebx
jne 0x4e10f9
mov dword [ecx + eax*8 + 4], esi
mov eax, dword [ebp + 8]
pop edi
mov dword [eax], esi
pop esi
mov byte [eax + 4], 1
pop ebx
mov esp, ebp
pop ebp
ret 8
push str.unordered_map_set_too_long
call fcn.005acb94
int3
Function at 0x4e1120
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 0xc]
sub esp, 0xc
cmp dword [edx + 0x14], 7
mov eax, dword [edx + 0x10]
push ebx
push esi
push edi
mov ebx, ecx
mov edi, edx
jbe 0x4e113b
mov edi, dword [edx]
xor ecx, ecx
mov esi, 0x811c9dc5
add eax, eax
je 0x4e115c
mov edx, eax
movzx eax, byte [edi + ecx]
inc ecx
xor eax, esi
imul esi, eax, 0x1000193
cmp ecx, edx
jb 0x4e1148
mov edx, dword [ebp + 0xc]
push esi
push edx
lea eax, [ebp - 8]
mov ecx, ebx
push eax
call fcn.0045f7d0
mov ecx, dword [ebp - 4]
test ecx, ecx
je 0x4e1182
mov eax, dword [ebp + 8]
mov dword [eax], ecx
mov byte [eax + 4], 0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
cmp dword [ebx + 8], 0x5d1745d
je 0x4e12d0
push 0x2c
call fcn.005ab82c
add esp, 4
mov edi, eax
push dword [ebp + 0xc]
lea ecx, [edi + 8]
call fcn.004137f0
mov dword [edi + 0x20], 0
mov dword [edi + 0x24], 0
mov dword [edi + 0x28], 0
mov eax, dword [ebx + 8]
inc eax
movss xmm3, dword [ebx]
movd xmm0, eax
cvtdq2pd xmm0, xmm0
shr eax, 0x1f
addsd xmm0, qword [eax*8 + 0x739f30]
mov eax, dword [ebx + 0x1c]
cvtpd2ps xmm2, xmm0
movd xmm0, eax
cvtdq2pd xmm0, xmm0
shr eax, 0x1f
movaps xmm1, xmm2
addsd xmm0, qword [eax*8 + 0x739f30]
cvtpd2ps xmm0, xmm0
divss xmm1, xmm0
comiss xmm1, xmm3
jbe 0x4e126d
divss xmm2, xmm3
sub esp, 8
cvtps2pd xmm0, xmm2
movsd qword [ebp - 8], xmm0
fld qword [ebp - 8]
fstp qword [esp]
call fcn.005eb4a0
fstp qword [ebp - 8]
movsd xmm0, qword [ebp - 8]
add esp, 8
cvtpd2ps xmm0, xmm0
call fcn.006d4800
mov ecx, 8
cmp eax, ecx
cmova ecx, eax
mov eax, dword [ebx + 0x1c]
cmp eax, ecx
jae 0x4e1251
cmp eax, 0x200
jae 0x4e124f
shl eax, 3
cmp eax, ecx
jae 0x4e1251
mov eax, ecx
push eax
mov ecx, ebx
call fcn.004e1320
push esi
lea eax, [edi + 8]
mov ecx, ebx
push eax
lea eax, [ebp - 8]
push eax
call fcn.0045f7d0
mov edx, dword [eax]
jmp 0x4e1270
mov edx, dword [ebp - 8]
mov eax, dword [edx + 4]
inc dword [ebx + 8]
mov dword [edi + 4], eax
mov dword [edi], edx
mov dword [eax], edi
mov dword [edx + 4], edi
mov ecx, dword [ebx + 0xc]
mov dword [ebp + 0xc], eax
mov eax, dword [ebx + 0x18]
and eax, esi
mov esi, dword [ecx + eax*8]
cmp esi, dword [ebx + 4]
jne 0x4e1298
mov dword [ecx + eax*8], edi
jmp 0x4e12ba
cmp esi, edx
jne 0x4e12b1
mov dword [ecx + eax*8], edi
mov eax, dword [ebp + 8]
mov dword [eax], edi
mov byte [eax + 4], 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
mov edx, dword [ebp + 0xc]
cmp dword [ecx + eax*8 + 4], edx
jne 0x4e12be
mov dword [ecx + eax*8 + 4], edi
mov eax, dword [ebp + 8]
mov dword [eax], edi
pop edi
pop esi
mov byte [eax + 4], 1
pop ebx
mov esp, ebp
pop ebp
ret 8
push str.unordered_map_set_too_long
call fcn.005acb94
int3
Function at 0x4e6c10
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
mov ebx, dword [ebp + 0xc]
push esi
mov esi, dword [ebp + 8]
push edi
movzx eax, byte [ebx]
mov edi, ecx
xor eax, 0x811c9dc5
imul edx, eax, 0x1000193
movzx eax, byte [ebx + 1]
xor edx, eax
movzx eax, byte [ebx + 2]
imul ecx, edx, 0x1000193
xor ecx, eax
movzx eax, byte [ebx + 3]
imul ecx, ecx, 0x1000193
xor ecx, eax
imul eax, ecx, 0x1000193
mov ecx, edi
push eax
mov dword [ebp + 8], eax
lea eax, [ebp - 0xc]
push ebx
push eax
call fcn.004301e0
mov eax, dword [ebp - 8]
test eax, eax
je 0x4e6c73
mov dword [esi], eax
xor al, al
jmp 0x4e6d0a
cmp dword [edi + 8], 0x15555555
je 0x4e6d1f
push 0xc
call fcn.005ab82c
mov dword [ebp - 4], eax
add esp, 4
lea ecx, [eax + 8]
mov eax, dword [ebx]
mov dword [ecx], eax
mov eax, dword [edi + 8]
inc eax
mov dword [ebp + 0xc], ecx
movd xmm0, eax
cvtdq2pd xmm0, xmm0
shr eax, 0x1f
addsd xmm0, qword [eax*8 + 0x739f30]
mov eax, dword [edi + 0x1c]
cvtpd2ps xmm1, xmm0
movd xmm0, eax
cvtdq2pd xmm0, xmm0
shr eax, 0x1f
addsd xmm0, qword [eax*8 + 0x739f30]
cvtpd2ps xmm0, xmm0
divss xmm1, xmm0
comiss xmm1, dword [edi]
jbe 0x4e6cf4
mov ecx, edi
call fcn.0043acb0
mov ebx, dword [ebp + 8]
lea eax, [ebp - 0xc]
push ebx
push dword [ebp + 0xc]
mov ecx, edi
push eax
call fcn.004301e0
mov ecx, dword [eax]
jmp 0x4e6cfa
mov ecx, dword [ebp - 0xc]
mov ebx, dword [ebp + 8]
push dword [ebp - 4]
push ecx
push ebx
mov ecx, edi
call fcn.0040fa90
mov dword [esi], eax
mov al, 1
mov ecx, esi
mov edx, 4
pop edi
mov byte [ecx + edx], al
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
push str.unordered_map_set_too_long
call fcn.005acb94
int3
Function at 0x4e7120
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
mov ebx, dword [ebp + 0xc]
push esi
push edi
mov edi, ecx
movzx eax, byte [ebx]
xor eax, 0x811c9dc5
imul edx, eax, 0x1000193
movzx eax, byte [ebx + 1]
xor edx, eax
movzx eax, byte [ebx + 2]
imul edx, edx, 0x1000193
xor edx, eax
movzx eax, byte [ebx + 3]
imul ecx, edx, 0x1000193
xor ecx, eax
imul eax, ecx, 0x1000193
mov ecx, edi
push eax
mov dword [ebp + 0xc], eax
lea eax, [ebp - 0x10]
push ebx
push eax
call fcn.004301e0
mov ecx, dword [ebp - 0xc]
test ecx, ecx
je 0x4e7189
mov eax, dword [ebp + 8]
mov dword [eax], ecx
mov byte [eax + 4], 0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
cmp dword [edi + 8], 0x15555555
je 0x4e72c0
push 0xc
call fcn.005ab82c
mov ecx, dword [ebx]
mov esi, eax
add esp, 4
mov dword [ebp - 4], esi
mov dword [esi + 8], ecx
mov ecx, dword [edi + 8]
mov ebx, dword [edi + 0x1c]
inc ecx
mov eax, ebx
movss xmm3, dword [edi]
shr eax, 0x1f
movd xmm0, ecx
cvtdq2pd xmm0, xmm0
shr ecx, 0x1f
addsd xmm0, qword [ecx*8 + 0x739f30]
cvtpd2ps xmm2, xmm0
movd xmm0, ebx
cvtdq2pd xmm0, xmm0
movaps xmm1, xmm2
addsd xmm0, qword [eax*8 + 0x739f30]
cvtpd2ps xmm0, xmm0
divss xmm1, xmm0
comiss xmm1, xmm3
jbe 0x4e725e
divss xmm2, xmm3
sub esp, 8
cvtps2pd xmm0, xmm2
movsd qword [ebp - 0x10], xmm0
fld qword [ebp - 0x10]
fstp qword [esp]
call fcn.005eb4a0
fstp qword [ebp - 0x10]
movsd xmm0, qword [ebp - 0x10]
add esp, 8
cvtpd2ps xmm0, xmm0
call fcn.006d4800
mov ecx, 8
cmp eax, ecx
cmova ecx, eax
cmp ebx, ecx
jae 0x4e7240
cmp ebx, 0x200
jae 0x4e723e
shl ebx, 3
cmp ebx, ecx
jae 0x4e7240
mov ebx, ecx
push ebx
mov ecx, edi
call fcn.0043ad40
push dword [ebp + 0xc]
lea eax, [esi + 8]
mov ecx, edi
push eax
lea eax, [ebp - 0x10]
push eax
call fcn.004301e0
mov edx, dword [eax]
jmp 0x4e7261
mov edx, dword [ebp - 0x10]
mov ebx, dword [edx + 4]
inc dword [edi + 8]
mov dword [esi], edx
mov dword [esi + 4], ebx
mov dword [ebx], esi
mov dword [edx + 4], esi
mov eax, dword [edi + 0x18]
and eax, dword [ebp + 0xc]
mov ecx, dword [edi + 0xc]
mov esi, dword [ecx + eax*8]
cmp esi, dword [edi + 4]
mov esi, dword [ebp - 4]
jne 0x4e728a
mov dword [ecx + eax*8], esi
jmp 0x4e72aa
cmp dword [ecx + eax*8], edx
jne 0x4e72a4
mov dword [ecx + eax*8], esi
mov eax, dword [ebp + 8]
mov dword [eax], esi
mov byte [eax + 4], 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
cmp dword [ecx + eax*8 + 4], ebx
jne 0x4e72ae
mov dword [ecx + eax*8 + 4], esi
mov eax, dword [ebp + 8]
pop edi
mov dword [eax], esi
pop esi
mov byte [eax + 4], 1
pop ebx
mov esp, ebp
pop ebp
ret 8
push str.unordered_map_set_too_long
call fcn.005acb94
int3
Function at 0x4e72d0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 0xc]
sub esp, 0xc
cmp dword [edx + 0x14], 0xf
push ebx
push esi
push edi
mov ebx, ecx
mov edi, edx
jbe 0x4e72e8
mov edi, dword [edx]
xor ecx, ecx
mov esi, 0x811c9dc5
cmp dword [edx + 0x10], ecx
jbe 0x4e7306
movzx eax, byte [edi + ecx]
inc ecx
xor eax, esi
imul esi, eax, 0x1000193
cmp ecx, dword [edx + 0x10]
jb 0x4e72f4
push esi
push edx
lea eax, [ebp - 8]
mov ecx, ebx
push eax
call fcn.004100f0
mov ecx, dword [ebp - 4]
test ecx, ecx
je 0x4e732c
mov eax, dword [ebp + 8]
mov dword [eax], ecx
mov byte [eax + 4], 0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
cmp dword [ebx + 8], 0x3333333
je 0x4e74cc
push 0x50
call fcn.005ab82c
add esp, 4
mov edi, eax
push dword [ebp + 0xc]
lea ecx, [edi + 8]
call fcn.004141c0
mov dword [edi + 0x30], 0
xorps xmm0, xmm0
mov dword [edi + 0x34], 0
mov dword [edi + 0x38], 0
mov dword [edi + 0x3c], 0
mov dword [edi + 0x40], 0
mov dword [edi + 0x44], 0
mov dword [edi + 0x48], 0
mov dword [edi + 0x4c], 0
movups xmmword [edi + 0x20], xmm0
mov dword [edi + 0x30], 0
mov dword [edi + 0x34], 0xf
mov byte [edi + 0x20], 0
movups xmmword [edi + 0x38], xmm0
mov dword [edi + 0x48], 0
mov dword [edi + 0x4c], 0xf
mov byte [edi + 0x38], 0
mov eax, dword [ebx + 8]
inc eax
movss xmm3, dword [ebx]
movd xmm0, eax
cvtdq2pd xmm0, xmm0
shr eax, 0x1f
addsd xmm0, qword [eax*8 + 0x739f30]
mov eax, dword [ebx + 0x1c]
cvtpd2ps xmm2, xmm0
movd xmm0, eax
cvtdq2pd xmm0, xmm0
shr eax, 0x1f
movaps xmm1, xmm2
addsd xmm0, qword [eax*8 + 0x739f30]
cvtpd2ps xmm0, xmm0
divss xmm1, xmm0
comiss xmm1, xmm3
jbe 0x4e7469
divss xmm2, xmm3
sub esp, 8
cvtps2pd xmm0, xmm2
movsd qword [ebp - 8], xmm0
fld qword [ebp - 8]
fstp qword [esp]
call fcn.005eb4a0
fstp qword [ebp - 8]
movsd xmm0, qword [ebp - 8]
add esp, 8
cvtpd2ps xmm0, xmm0
call fcn.006d4800
mov ecx, 8
cmp eax, ecx
cmova ecx, eax
mov eax, dword [ebx + 0x1c]
cmp eax, ecx
jae 0x4e744d
cmp eax, 0x200
jae 0x4e744b
shl eax, 3
cmp eax, ecx
jae 0x4e744d
mov eax, ecx
push eax
mov ecx, ebx
call fcn.004e75c0
push esi
lea eax, [edi + 8]
mov ecx, ebx
push eax
lea eax, [ebp - 8]
push eax
call fcn.004100f0
mov edx, dword [eax]
jmp 0x4e746c
mov edx, dword [ebp - 8]
mov eax, dword [edx + 4]
inc dword [ebx + 8]
mov dword [edi + 4], eax
mov dword [edi], edx
mov dword [eax], edi
mov dword [edx + 4], edi
mov ecx, dword [ebx + 0xc]
mov dword [ebp + 0xc], eax
mov eax, dword [ebx + 0x18]
and eax, esi
mov esi, dword [ecx + eax*8]
cmp esi, dword [ebx + 4]
jne 0x4e7494
mov dword [ecx + eax*8], edi
jmp 0x4e74b6
cmp esi, edx
jne 0x4e74ad
mov dword [ecx + eax*8], edi
mov eax, dword [ebp + 8]
mov dword [eax], edi
mov byte [eax + 4], 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
mov edx, dword [ebp + 0xc]
cmp dword [ecx + eax*8 + 4], edx
jne 0x4e74ba
mov dword [ecx + eax*8 + 4], edi
mov eax, dword [ebp + 8]
mov dword [eax], edi
pop edi
pop esi
mov byte [eax + 4], 1
pop ebx
mov esp, ebp
pop ebp
ret 8
push str.unordered_map_set_too_long
call fcn.005acb94
int3
Function at 0x4e9be0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
xor edx, edx
push ebx
push 0
lea ecx, [edx + 0xa]
xor bl, bl
call fcn.00412370
add esp, 4
test al, al
je 0x4e9c62
lea eax, [ebp - 4]
push eax
push 0xf003f
push 0
push str.SoftwareMicrosoftWindowsCurrentVersionThemesPersonalize
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x4e9c62
lea eax, [ebp - 8]
mov dword [ebp - 8], 4
push eax
lea eax, [ebp - 0xc]
push eax
push 0
push 0
push str.SystemUsesLightTheme
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x4e9c57
cmp dword [ebp - 0xc], eax
je 0x4e9c57
push dword [ebp - 4]
mov bl, 1
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov al, bl
pop ebx
mov esp, ebp
pop ebp
ret
push dword [ebp - 4]
xor bl, bl
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov al, bl
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4ef8c0
Capabilities:
Encode data using base64

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
mov esi, dword [ebp + 8]
mov eax, 0xaaaaaaab
mov dword [ebp - 4], edx
mov ebx, ecx
push edi
push 0x3d
mov esi, dword [esi]
add esi, 2
mov dword [ebp - 8], ebx
mul esi
shr edx, 1
shl edx, 2
push edx
call fcn.00413bf0
cmp dword [ebx + 0x14], 0xf
mov edi, ebx
jbe 0x4ef8f7
mov edi, dword [ebx]
mov eax, dword [ebp + 8]
xor edx, edx
mov dword [ebp + 8], 3
xor esi, esi
mov ecx, dword [eax]
mov eax, ecx
div dword [ebp + 8]
mov eax, edx
sub ecx, eax
mov dword [ebp + 8], eax
mov dword [ebp - 0xc], ecx
je 0x4ef99d
mov ebx, dword [ebp - 4]
dec ecx
mov eax, 0xaaaaaaab
add ebx, 2
mul ecx
shr edx, 1
inc edx
nop dword [eax]
movzx ecx, byte [ebx - 2]
lea ebx, [ebx + 3]
movzx eax, byte [ebx - 4]
shl ecx, 8
or ecx, eax
movzx eax, byte [ebx - 3]
shl ecx, 8
or ecx, eax
mov eax, ecx
shr eax, 0x12
movzx eax, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [edi + esi], al
mov eax, ecx
shr eax, 0xc
and eax, 0x3f
movzx eax, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [edi + esi + 1], al
mov eax, ecx
shr eax, 6
and ecx, 0x3f
and eax, 0x3f
movzx eax, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [edi + esi + 2], al
movzx eax, byte [ecx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [edi + esi + 3], al
add esi, 4
sub edx, 1
jne 0x4ef930
mov ebx, dword [ebp - 8]
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
test eax, eax
je 0x4efa1a
mov edx, dword [ebp - 4]
sub eax, 1
mov dword [ebp + 8], eax
movzx eax, byte [ecx + edx]
je 0x4ef9bc
movzx edx, byte [ecx + edx + 1]
shl eax, 8
or edx, eax
jmp 0x4ef9be
mov edx, eax
mov eax, edx
mov ecx, edx
shr eax, 2
shr ecx, 0xa
cmp dword [ebp + 8], 0
cmove ecx, eax
mov al, byte [ecx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [edi + esi], al
je 0x4efa04
mov eax, edx
shr eax, 4
and eax, 0x3f
and edx, 0xf
movzx eax, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [edi + esi + 1], al
mov al, byte [edx*4 + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [edi + esi + 2], al
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
and edx, 3
shl edx, 4
mov al, byte [edx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [esi + edi + 1], al
mov al, 0x3d
mov byte [edi + esi + 2], al
pop edi
pop esi
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4f3f60
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
mov dword [ebp - 8], ecx
mov esi, dword [ebx]
add esi, 0x28
cmp dword [esi + 0x14], 0xf
jbe 0x4f3f7c
mov esi, dword [esi]
mov ecx, esi
mov dword [ebp - 0x18], 0
xorps xmm0, xmm0
mov dword [ebp - 0x14], 0
movups xmmword [ebp - 0x28], xmm0
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x4f3f96
sub ecx, edx
push ecx
push esi
lea ecx, [ebp - 0x28]
call fcn.00414570
cmp dword [ebp - 0x14], 0xf
lea edi, [ebp - 0x28]
mov edx, 0x811c9dc5
cmova edi, dword [ebp - 0x28]
xor ecx, ecx
cmp dword [ebp - 0x18], ecx
jbe 0x4f3fd2
movzx eax, byte [edi + ecx]
inc ecx
xor eax, edx
imul edx, eax, 0x1000193
cmp ecx, dword [ebp - 0x18]
jb 0x4f3fc0
mov ecx, dword [ebp - 8]
lea eax, [ebp - 0x28]
push edx
push eax
lea eax, [ebp - 0x10]
push eax
call fcn.004100f0
mov edi, dword [eax + 4]
test edi, edi
jne 0x4f3ff0
mov eax, dword [ebp - 8]
mov edi, dword [eax + 4]
mov eax, dword [ebp - 0x14]
cmp eax, 0xf
jbe 0x4f4026
mov edx, dword [ebp - 0x28]
lea ecx, [eax + 1]
mov eax, edx
cmp ecx, 0x1000
jb 0x4f401c
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4f40ce
push ecx
push edx
call fcn.005ab85c
add esp, 8
mov eax, dword [ebp - 8]
cmp edi, dword [eax + 4]
jne 0x4f40aa
mov edi, dword [ebx]
mov ecx, esi
xorps xmm0, xmm0
mov dword [ebp - 0x18], 0
movups xmmword [ebp - 0x28], xmm0
mov dword [ebp - 0x14], 0
lea edx, [ecx + 1]
nop word [eax + eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x4f4050
sub ecx, edx
push ecx
push esi
lea ecx, [ebp - 0x28]
call fcn.00414570
mov ecx, dword [ebp - 8]
lea eax, [ebp - 0x28]
push eax
call fcn.004be2e0
mov dword [eax], edi
mov ecx, dword [ebp - 0x14]
cmp ecx, 0xf
jbe 0x4f40c5
mov edx, dword [ebp - 0x28]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x4f4097
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4f40d3
push ecx
push edx
call fcn.005ab85c
add esp, 8
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
mov ecx, dword [edi + 0x20]
push dword [ebx]
mov eax, dword [ecx]
call dword [eax + 0x28]
mov ecx, dword [ebx]
test ecx, ecx
je 0x4f40c0
mov eax, dword [ecx]
push 1
call dword [eax]
mov eax, dword [edi + 0x20]
mov dword [ebx], eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
call fcn.005c695f
call fcn.005c695f
int3
Function at 0x4f40e0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov ebx, ecx
mov edx, dword [edi]
test edx, edx
je 0x4f410e
mov esi, dword [ebx + 4]
mov dword [ebp + 8], esi
mov eax, dword [esi]
cmp eax, esi
je 0x4f410e
cmp dword [eax + 0x20], edx
lea ecx, [eax + 8]
je 0x4f4119
mov eax, dword [eax]
cmp eax, esi
jne 0x4f4100
xor al, al
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
mov eax, dword [ebx + 0x40]
test dword [eax + 0xd0], 0x8000000
je 0x4f4131
cmp dword [edx + 0x84], 0
je 0x4f415a
cmp byte [ebp + 0xc], 0
je 0x4f415a
push str.error
mov ecx, ebx
call fcn.004f4be0
mov ecx, dword [edi]
mov esi, eax
push esi
mov edx, dword [ecx]
call dword [edx + 0x28]
mov dword [edi], esi
mov al, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
cmp dword [ecx + 0x14], 0xf
mov dword [ebp + 0xc], ecx
jbe 0x4f4168
mov eax, dword [ecx]
mov dword [ebp + 0xc], eax
xor edx, edx
mov edi, 0x811c9dc5
cmp dword [ecx + 0x10], edx
jbe 0x4f418c
mov esi, dword [ebp + 0xc]
movzx eax, byte [esi + edx]
inc edx
xor eax, edi
imul edi, eax, 0x1000193
cmp edx, dword [ecx + 0x10]
jb 0x4f4177
mov esi, dword [ebp + 8]
push edi
push ecx
lea eax, [ebp - 8]
mov ecx, ebx
push eax
call fcn.004100f0
mov edx, dword [eax + 4]
test edx, edx
je 0x4f41e2
mov ecx, dword [ebx + 0x18]
mov eax, dword [ebx + 0xc]
and ecx, edi
lea ecx, [eax + ecx*8]
mov eax, dword [ecx]
cmp dword [ecx + 4], edx
jne 0x4f41c5
cmp eax, edx
jne 0x4f41bd
mov dword [ecx], esi
mov dword [ecx + 4], esi
jmp 0x4f41cd
mov esi, dword [edx + 4]
mov dword [ecx + 4], esi
jmp 0x4f41cd
cmp eax, edx
jne 0x4f41cd
mov eax, dword [edx]
mov dword [ecx], eax
mov ecx, dword [edx]
dec dword [ebx + 8]
mov eax, dword [edx + 4]
mov dword [eax], ecx
mov eax, dword [edx + 4]
mov dword [ecx + 4], eax
call fcn.0042c6e0
pop edi
pop esi
mov al, 1
pop ebx
mov esp, ebp
pop ebp
ret 8