joyce8/EMBER2024-capa huggingface dataset:
Function at 0xca0640
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, 0x6da000
lea edi, [esi - 0x849000]
push edi
jmp 0xca065a
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0xca0661
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0xca0650
mov eax, 1
add ebx, ebx
jne 0xca0673
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0xca0684
jne 0xca06a3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0xca06a3
dec eax
add ebx, ebx
jne 0xca0690
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0xca0668
add ebx, ebx
jne 0xca069f
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0xca06f5
xor ecx, ecx
sub eax, 3
jb 0xca06bb
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0xca072a
sar eax, 1
mov ebp, eax
jmp 0xca06c6
add ebx, ebx
jne 0xca06c6
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0xca0694
inc ecx
add ebx, ebx
jne 0xca06d4
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0xca0694
add ebx, ebx
jne 0xca06e1
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0xca06d6
jne 0xca06f2
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0xca06d6
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0xca0714
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0xca0706
jmp 0xca0656
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0xca0714
add edi, ecx
jmp 0xca0656
pop esi
mov edi, esi
mov ecx, 0x3ee5
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0xca0732
cmp byte [edi], 0x11
jne 0xca0732
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0xca0737
lea edi, [esi + 0x899000]
mov eax, dword [edi]
or eax, eax
je 0xca07af
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x1068704]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x1068880]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0xca0764
mov ecx, edi
jns 0xca0793
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x1068884]
or eax, eax
je 0xca07a9
mov dword [ebx], eax
add ebx, 4
jmp 0xca0781
call dword [esi + 0x1068894]
add edi, 4
lea ebx, [esi - 4]
xor eax, eax
mov al, byte [edi]
inc edi
or eax, eax
je 0xca07e0
cmp al, 0xef
ja 0xca07d3
add ebx, eax
mov eax, dword [ebx]
xchg ah, al
rol eax, 0x10
xchg ah, al
add eax, esi
mov dword [ebx], eax
jmp 0xca07b5
and al, 0xf
shl eax, 0x10
mov ax, word [edi]
add edi, 2
jmp 0xca07c2
mov ebp, dword [esi + 0x1068888]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x22f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0xca0814
sub esp, 0xffffff80
jmp 0x427f4a
Function at 0x5716d0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
not ah
push ebx
aad 0x33
push edx
sub al, 0xf7
lahf
btr ax, sp
or ah, al
mov eax, dword [ebp + 8]
clc
test eax, eax
jmp 0x5724ca
cwde
mov eax, dword [ebp + 8]
bt ax, 0xb
push 0x23797c8c
test eax, eax
pushfd
jmp 0x4f4c14
clc
mov dword [esp], edi
jae 0x4f36b4
bts eax, 0x17
pushal
mov dword [esp + 0x1c], ebx
cmp dh, al
clc
rol al, 4
mov dword [esp + 0x18], edx
jmp 0x4f71b3
pushal
pushal
pushfd
lea esp, [esp + 0x44]
je 0x4e8d7d
shrd si, cx, cl
mov esi, edx
not si
shr esi, cl
mov esi, dword [eax + 0x3c]
push eax
add esi, eax
not dx
mov edx, dword [esi + 0x78]
mov byte [esp], dh
bt sp, 0xb
stc
test edx, edx
push eax
lea esp, [esp + 8]
je 0x4e8d7d
btr cx, cx
add edx, eax
inc ch
mov ecx, dword [esi + 0x7c]
cmp dh, 0x6c
call fcn.00757a25

Function at 0x571a0d
Capabilities:
Encode data using xor

Disassembly:
cmp bh, bh
mov esi, 0xd7131f90
imul ebx, esp, 0x6eabd6cd
xchg ebx, eax
xor eax, 0xf6345de6
lodsb al, byte es:[esi]
invalid
sbb al, 0xdf
fidivr word [esi - 0x5f]
pushfd
test al, 0xce
add edi, ebx
jbe 0x57198e
invalid
lahf
sub ah, ch
push ebx
mov dword [esp], ebp
rol bp, cl
mov ebp, esp
not al
rcl ah, cl
aaa
sub esp, 0x18
sub ax, 0x5d83
inc ax
stc
push esi
or ah, dl
call fcn.005716d0
test eax, 0xace9c829
xor ch, cl
push ebp
mov bh, bl
push eax
out dx, al
scasd eax, dword es:[edi]
or byte [esi + 0x18fb5b0c], bl
adc ebx, ebp
jge 0x571a25
invalid
stosd dword es:[edi], eax
insb byte es:[edi], dx
adc al, 0x23
stosb byte es:[edi], al
push 0x54813219
outsd dx, dword [esi]
sbb al, 0x6a
jge 0x571a2f
jo 0x5719f1
sbb ebx, ebx
wait
adc eax, 0x1aa45524
nop
cmp ebp, ecx
aaa
add edi, edi
invalid

Function at 0x755ec0
Capabilities:
Encode data using xor

Disassembly:
lea esp, [esp + 4]
je 0x4e8d7d
call fcn.004f3afe
stc
cmc
stc
test edi, edi
mov word [esp], sp
mov word [esp], dx
jmp 0x4f4b1c

Function at 0x759985
Capabilities:
Encode data using xor

Disassembly:
mov word [esp], si
mov dword [esp], edi
push 0x6b90182e
lea esp, [esp + 8]
je 0x75c312
pushal
push dword [esp + 4]
stc
cmp al, ah
pushfd
lea esp, [esp + 0x28]
jne 0x4e3b84
fdivr st(7)
push 0x88f261f1
push 0xfaa79d2
inc esi
call fcn.004ee68e
xor al, 0x13
js 0x6d42abf5
jecxz 0x759a3d
inc ecx
adc dword [ebx + 0x1aecd45], eax
jb 0x7599ac
mov ebp, 0x41e1b277
invalid
add dword [bx - 0x11af], eax
xor al, byte [ebx + edx*2 + 0x43b37dde]
hlt
Function at 0x759ed1
Capabilities:
Encode data using xor

Disassembly:
bt esi, edx
push dword [edi]
pop dword [esp + 0x20]
call fcn.004ec7ca
pushal
call fcn.004ef76e
sal byte [ecx + edi - 0x32d76642], cl
pop edx
invalid
stc
pushal
test ah, dl
test ch, 0xe3
sub edi, 4
stc
push dword [esp + 4]
jmp 0x4e4238
mov word [esp + 4], 0xf469
sub edi, 4
cmc
clc
mov byte [esp + 4], 0xeb
stc
push dword [edi]
pop dword [esp + 4]
cmp esi, esp
clc
cmp edi, ebx
mov byte [esp], cl
lea esp, [esp + 4]
ja 0x75579f
rcl al, cl
sub al, 0xac
sub ebx, edi
rcl di, 9
shl di, 0xd
dec al
add ebx, esp
bts di, di
mov edi, ebx
xor al, 0xbd
dec al
mov al, 0x2e
pushal
stc
repne scasb al, byte es:[edi]
pushal
push dword [esp]
lea esp, [esp + 0x44]
jne 0x57021c
invalid
movzx eax, bl
mov byte [edi - 1], 0
pushal
pop eax
mov dword [esp + 0x18], ebx
movzx eax, dl
lea eax, [0x75c8b0]
lea esp, [esp + 0x18]
jle 0x4f2f52
push 0x4f3c2f
call fcn.004f04c0
int 0x1d
xor byte [ecx], dl
sub dword [edx], edx
int 0xf5
jp 0x759f9b
out dx, al
cmp dword [ebp + eax - 0x68ceeca2], edx
mov esp, 0xe232f08f
call 0x23ac8970
invalid
sbb al, 0x33
jecxz 0x759fc4
push edx
mov cs, ecx
test byte [eax - 0x38], cl
jbe 0x759fc7
les edx, [esp + edx + 0x28f5d424]
test al, 0x94
and eax, 0x59fe7066
ret 0x1d4e
sbb dword [ebx - 0x683bbe6f], eax
push ebx
jecxz 0x759f28
and al, 0xe9
push dword [ecx]
pop eax
dec edi
pop ecx
mov ecx, dword [edi]
in al, dx
jmp 0x759f7a
mov esp, 0xef4c278
rol dword [ecx + 0xb], 1
mov ebp, 0x33eeb9c
or al, 0x77
fst dword [esi - 0x67]
retf
hlt
Function at 0x4057c0
Capabilities:
Print debug messages

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5b8d10
mov eax, dword fs:[0]
push eax
push ebx
sub esp, 0x20
push esi
push edi
mov eax, dword [0x624040]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 4], 0
cmp byte [ecx + 4], 0
je 0x40588e
add ecx, 0xb0
call fcn.00409a00
test eax, eax
je 0x40582a
lea ecx, [ebx + 8]
push ecx
mov ecx, eax
call fcn.0040b5d0
test al, al
jne 0x40588e
mov eax, dword [ebx + 8]
mov ecx, str.AAAA
mov edx, str.A
push 0x30
push str._WINTUN__2__DNS__DnsResolver___
cmp byte [eax], 0
cmove edx, ecx
lea ecx, [ebp - 0x2c]
call fcn.00409230
add esp, 8
cmp dword [eax + 0x14], 0xf
jbe 0x405857
mov eax, dword [eax]
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov ecx, dword [ebp - 0x18]
cmp ecx, 0xf
jbe 0x40588e
mov edx, dword [ebp - 0x2c]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x405884
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4058cc
push ecx
push edx
call fcn.0048335e
add esp, 8
mov esi, dword [ebx + 0xc]
test esi, esi
je 0x4058b6
or edi, 0xffffffff
mov eax, edi
lock xadd dword [esi + 4], eax
jne 0x4058b6
mov eax, dword [esi]
mov ecx, esi
call dword [eax]
lock xadd dword [esi + 8], edi
dec edi
jne 0x4058b6
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 4]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret 8
call fcn.0059539e
int3
Function at 0x407cf0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
mov dword [ebp - 8], ecx
cmp edx, eax
je 0x407e8c
cmp dword [edx + 0x1c], 0xf
mov eax, dword [ecx + 4]
push esi
mov dword [ebp - 0x1c], eax
mov esi, edx
mov eax, dword [ecx + 0xc]
push edi
mov dword [ebp - 0x18], eax
lea edi, [edx + 8]
mov eax, dword [edx + 4]
mov dword [ebp - 0xc], eax
mov eax, dword [edi + 0x10]
jbe 0x407d2b
mov edi, dword [edi]
xor edx, edx
push ebx
mov ebx, 0x811c9dc5
test eax, eax
je 0x407d54
mov ecx, eax
nop dword [eax]
movzx eax, byte [edi + edx]
inc edx
xor eax, ebx
imul ebx, eax, 0x1000193
cmp edx, ecx
jb 0x407d40
mov ecx, dword [ebp - 8]
mov eax, dword [ecx + 0x18]
mov ecx, dword [ebp - 0x18]
and eax, ebx
lea eax, [ecx + eax*8]
mov ecx, dword [eax]
mov dword [ebp - 0x10], eax
mov eax, dword [eax + 4]
mov dword [ebp - 4], ecx
mov dword [ebp - 0x14], eax
nop dword [eax]
mov edi, esi
mov ebx, esi
mov esi, dword [esi]
lea ecx, [edi + 8]
call fcn.0040c800
push 0x28
push edi
call fcn.0048335e
mov eax, dword [ebp - 8]
add esp, 8
dec dword [eax + 8]
cmp ebx, dword [ebp - 0x14]
je 0x407db9
mov eax, dword [ebp + 0xc]
cmp esi, eax
jne 0x407d70
mov ecx, dword [ebp - 4]
cmp ecx, dword [ebp + 8]
jne 0x407da8
mov edx, dword [ebp - 0x10]
mov dword [edx], esi
mov ecx, dword [ebp - 0xc]
pop ebx
pop edi
mov dword [ecx], esi
mov dword [esi + 4], ecx
pop esi
mov esp, ebp
pop ebp
ret 8
mov ecx, dword [ebp - 4]
mov edx, dword [ebp - 0x10]
cmp ecx, dword [ebp + 8]
jne 0x407dcb
mov ecx, dword [ebp - 0x1c]
mov dword [edx], ecx
jmp 0x407dce
mov ecx, dword [ebp - 0xc]
mov dword [edx + 4], ecx
mov ecx, dword [ebp + 0xc]
cmp esi, ecx
je 0x407e7f
nop dword [eax]
cmp dword [esi + 0x1c], 0xf
lea edx, [esi + 8]
mov ebx, dword [edx + 0x10]
jbe 0x407dee
mov edx, dword [edx]
xor ecx, ecx
mov edi, 0x811c9dc5
test ebx, ebx
je 0x407e14
nop dword [eax]
movzx eax, byte [edx + ecx]
inc ecx
xor eax, edi
imul edi, eax, 0x1000193
cmp ecx, ebx
jb 0x407e00
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x18]
mov ecx, dword [ebp - 0x18]
and eax, edi
lea eax, [ecx + eax*8]
mov dword [ebp - 4], eax
mov eax, dword [eax + 4]
mov dword [ebp - 0x14], eax
mov edi, esi
mov ebx, esi
mov esi, dword [esi]
lea ecx, [edi + 8]
call fcn.0040c800
push 0x28
push edi
call fcn.0048335e
mov eax, dword [ebp - 8]
add esp, 8
dec dword [eax + 8]
cmp ebx, dword [ebp - 0x14]
je 0x407e69
mov eax, dword [ebp + 0xc]
cmp esi, eax
jne 0x407e28
mov ecx, dword [ebp - 4]
pop ebx
pop edi
mov dword [ecx], esi
mov ecx, dword [ebp - 0xc]
mov dword [ecx], esi
mov dword [esi + 4], ecx
pop esi
mov esp, ebp
pop ebp
ret 8
mov ecx, dword [ebp - 4]
mov edi, dword [ebp - 0x1c]
mov dword [ecx], edi
mov dword [ecx + 4], edi
mov ecx, dword [ebp + 0xc]
cmp esi, ecx
jne 0x407de0
mov eax, dword [ebp - 0xc]
pop ebx
pop edi
mov dword [eax], esi
mov dword [esi + 4], eax
mov eax, ecx
pop esi
mov esp, ebp
pop ebp
ret 8
Function at 0x4090c0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5b8fad
mov eax, dword fs:[0]
push eax
sub esp, 8
mov eax, dword [0x624040]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
push 0x10
call fcn.0048336c
mov ecx, dword [ebp + 8]
mov edx, eax
mov dword [ebp - 0x14], edx
mov eax, dword [ecx]
mov dword [edx], eax
movzx eax, byte [ecx + 4]
mov byte [edx + 4], al
movzx eax, byte [ecx + 5]
mov byte [edx + 5], al
mov eax, dword [ecx + 8]
mov dword [edx + 8], eax
mov eax, dword [ecx + 0xc]
mov dword [edx + 0xc], eax
lea edi, [esi + 4]
mov dword [ebp - 4], 0
push edi
push 0
push edx
push 0x40c390
push 0
push 0
call fcn.00595613
add esp, 0x1c
mov dword [esi], eax
test eax, eax
je 0x40915d
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004830fa
mov esp, ebp
pop ebp
ret 4
push 6
mov dword [edi], 0
call fcn.00484dcd
int3

Function at 0x409410
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov edx, dword [ebp + 0xc]
mov eax, ecx
push ebx
push esi
push edi
cmp dword [edx + 0x14], 0xf
mov edi, edx
mov ebx, dword [edx + 0x10]
mov dword [ebp - 4], eax
jbe 0x40942e
mov edi, dword [edx]
xor ecx, ecx
mov esi, 0x811c9dc5
test ebx, ebx
je 0x409454
nop dword [eax]
movzx eax, byte [edi + ecx]
inc ecx
xor eax, esi
imul esi, eax, 0x1000193
cmp ecx, ebx
jb 0x409440
mov eax, dword [ebp - 4]
push esi
push edx
lea ecx, [ebp - 0xc]
push ecx
mov ecx, eax
call fcn.0040b540
pop edi
pop esi
pop ebx
mov ecx, dword [eax + 4]
mov eax, dword [ebp + 8]
test ecx, ecx
jne 0x409474
mov ecx, dword [ebp - 4]
mov ecx, dword [ecx + 4]
mov dword [eax], ecx
mov esp, ebp
pop ebp
ret 8
Function at 0x409480
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [ebp + 8]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 0xc]
cmp dword [eax + 0x1c], 0xf
push ebx
mov ebx, dword [eax + 0x18]
mov dword [ebp - 4], ecx
lea ecx, [eax + 8]
push esi
push edi
mov dword [ebp - 8], ecx
mov edi, ecx
jbe 0x4094a8
mov edi, dword [ecx]
xor edx, edx
mov esi, 0x811c9dc5
test ebx, ebx
je 0x4094c4
movzx ecx, byte [edi + edx]
inc edx
xor ecx, esi
imul esi, ecx, 0x1000193
cmp edx, ebx
jb 0x4094b3
mov ebx, dword [ebp - 4]
mov edx, dword [ebx + 0x18]
mov ecx, dword [ebx + 0xc]
and edx, esi
mov esi, dword [ecx + edx*8]
cmp dword [ecx + edx*8 + 4], eax
jne 0x4094f1
cmp esi, eax
jne 0x4094e8
mov eax, dword [ebx + 4]
mov dword [ecx + edx*8], eax
mov dword [ecx + edx*8 + 4], eax
jmp 0x4094fa
mov eax, dword [eax + 4]
mov dword [ecx + edx*8 + 4], eax
jmp 0x4094fa
cmp esi, eax
jne 0x4094fd
mov eax, dword [eax]
mov dword [ecx + edx*8], eax
mov eax, dword [ebp + 0xc]
mov esi, dword [eax]
dec dword [ebx + 8]
mov edx, dword [eax + 4]
mov ecx, dword [ebp - 8]
mov dword [edx], esi
mov eax, dword [eax + 4]
mov dword [esi + 4], eax
call fcn.0040c800
push 0x28
push dword [ebp + 0xc]
call fcn.0048335e
mov eax, dword [ebp - 0xc]
add esp, 8
pop edi
mov dword [eax], esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x409530
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5b9035
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
push ebx
push esi
push edi
mov eax, dword [0x624040]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov edx, dword [ebp + 0xc]
mov edi, dword [ebp + 8]
mov dword [ebp - 0x1c], edi
mov dword [ebp - 0x10], edx
cmp dword [edx + 0x14], 0xf
mov dword [ebp - 0x14], edx
jbe 0x409574
mov eax, dword [edx]
mov dword [ebp - 0x14], eax
xor ecx, ecx
mov esi, 0x811c9dc5
cmp dword [edx + 0x10], ecx
jbe 0x409598
mov edi, dword [ebp - 0x14]
movzx eax, byte [edi + ecx]
inc ecx
xor eax, esi
imul esi, eax, 0x1000193
cmp ecx, dword [edx + 0x10]
jb 0x409583
mov edi, dword [ebp - 0x1c]
push esi
push edx
lea eax, [ebp - 0x18]
mov ecx, ebx
push eax
call fcn.0040b540
mov eax, dword [ebp - 0x14]
test eax, eax
je 0x4095c8
mov dword [edi], eax
mov eax, edi
mov byte [edi + 4], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
cmp dword [ebx + 8], 0x6666666
je 0x40971a
lea eax, [ebx + 4]
mov dword [ebp - 0x24], eax
mov dword [ebp - 4], 0
push 0x28
mov dword [ebp - 0x20], 0
call fcn.0048336c
add esp, 4
mov edi, eax
mov dword [ebp - 0x20], edi
push dword [ebp - 0x10]
lea ecx, [edi + 8]
call fcn.00407c20
xorps xmm0, xmm0
movq qword [edi + 0x20], xmm0
mov dword [edi + 0x24], 0
mov dword [ebp - 4], 1
mov eax, dword [ebx + 8]
inc eax
movss xmm3, dword [ebx]
movd xmm0, eax
cvtdq2pd xmm0, xmm0
shr eax, 0x1f
addsd xmm0, qword [eax*8 + 0x60bb80]
mov eax, dword [ebx + 0x1c]
cvtpd2ps xmm2, xmm0
movd xmm0, eax
cvtdq2pd xmm0, xmm0
shr eax, 0x1f
movaps xmm1, xmm2
addsd xmm0, qword [eax*8 + 0x60bb80]
cvtpd2ps xmm0, xmm0
divss xmm1, xmm0
comiss xmm1, xmm3
jbe 0x4096bc
divss xmm2, xmm3
push ecx
movss dword [esp], xmm2
call fcn.004018b0
add esp, 4
fstp dword [ebp - 0x10]
movss xmm0, dword [ebp - 0x10]
call fcn.005b81b0
mov ecx, 8
cmp eax, ecx
cmova ecx, eax
mov eax, dword [ebx + 0x1c]
cmp eax, ecx
jae 0x4096a0
cmp eax, 0x200
jae 0x40969e
shl eax, 3
cmp eax, ecx
jae 0x4096a0
mov eax, ecx
push eax
mov ecx, ebx
call fcn.00409e40
push esi
lea eax, [edi + 8]
mov ecx, ebx
push eax
lea eax, [ebp - 0x24]
push eax
call fcn.0040b540
mov edx, dword [eax]
jmp 0x4096bf
mov edx, dword [ebp - 0x18]
mov eax, dword [edx + 4]
inc dword [ebx + 8]
mov dword [edi + 4], eax
mov dword [edi], edx
mov dword [eax], edi
mov dword [edx + 4], edi
mov ecx, dword [ebx + 0xc]
mov dword [ebp - 0x10], eax
mov eax, dword [ebx + 0x18]
and eax, esi
mov esi, dword [ecx + eax*8]
cmp esi, dword [ebx + 4]
jne 0x4096e7
mov dword [ecx + eax*8], edi
jmp 0x4096f9
cmp esi, edx
jne 0x4096f0
mov dword [ecx + eax*8], edi
jmp 0x4096fd
mov edx, dword [ebp - 0x10]
cmp dword [ecx + eax*8 + 4], edx
jne 0x4096fd
mov dword [ecx + eax*8 + 4], edi
mov eax, dword [ebp - 0x1c]
mov dword [eax], edi
mov byte [eax + 4], 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
push str.unordered_map_set_too_long
call fcn.0048506f
int3
Function at 0x409e40
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
mov ebx, ecx
mov eax, 0x1fffffff
bsr ecx, eax
push esi
mov esi, 1
mov dword [ebp - 0x14], ebx
mov eax, esi
shl eax, cl
mov ecx, dword [ebp + 8]
push edi
cmp ecx, eax
ja 0x409fbd
lea eax, [ecx - 1]
or eax, esi
bsr ecx, eax
mov eax, dword [ebx + 4]
push eax
mov dword [ebp - 8], eax
lea ecx, [ecx + 1]
shl esi, cl
lea ecx, [ebx + 0xc]
lea eax, [esi + esi]
push eax
call fcn.00407f70
lea eax, [esi - 1]
mov dword [ebx + 0x1c], esi
mov dword [ebx + 0x18], eax
mov esi, dword [ebx + 4]
mov eax, dword [ebp - 8]
mov esi, dword [esi]
mov edi, esi
cmp esi, eax
je 0x409f98
cmp dword [esi + 0x1c], 0xf
lea ecx, [esi + 8]
mov edi, dword [edi]
mov edx, dword [ecx + 0x10]
mov dword [ebp - 0x10], edi
mov dword [ebp - 0xc], edx
mov dword [ebp - 4], ecx
jbe 0x409ec1
mov edx, dword [ecx]
mov dword [ebp - 4], edx
xor edx, edx
mov ebx, 0x811c9dc5
cmp dword [ecx + 0x10], edx
jbe 0x409eea
mov eax, dword [ebp - 4]
mov edi, dword [ebp - 0xc]
movzx ecx, byte [eax + edx]
inc edx
xor ecx, ebx
imul ebx, ecx, 0x1000193
cmp edx, edi
jb 0x409ed3
mov edi, dword [ebp - 0x10]
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 0x14]
mov edx, dword [ecx + 0x18]
mov ecx, dword [ecx + 0xc]
and edx, ebx
lea ecx, [ecx + edx*8]
mov dword [ebp - 4], ecx
cmp dword [ecx], eax
jne 0x409f09
mov dword [ecx], esi
mov dword [ecx + 4], esi
jmp 0x409f8e
mov ebx, dword [ecx + 4]
lea eax, [ebx + 8]
push eax
lea eax, [esi + 8]
push eax
call fcn.00408f90
add esp, 8
test al, al
je 0x409f46
mov ebx, dword [ebx]
cmp ebx, esi
je 0x409f3e
mov edx, dword [esi + 4]
mov dword [edx], edi
mov ecx, dword [edi + 4]
mov dword [ecx], ebx
mov eax, dword [ebx + 4]
mov dword [eax], esi
mov dword [ebx + 4], ecx
mov dword [edi + 4], edx
mov dword [esi + 4], eax
mov eax, dword [ebp - 4]
mov dword [eax + 4], esi
jmp 0x409f8b
mov eax, dword [ebp - 4]
cmp dword [eax], ebx
je 0x409f6e
nop dword [eax]
mov ebx, dword [ebx + 4]
lea eax, [ebx + 8]
push eax
lea eax, [esi + 8]
push eax
call fcn.00408f90
add esp, 8
test al, al
jne 0x409fa1
mov eax, dword [ebp - 4]
cmp dword [eax], ebx
jne 0x409f50
mov edx, dword [esi + 4]
mov dword [edx], edi
mov ecx, dword [edi + 4]
mov dword [ecx], ebx
mov eax, dword [ebx + 4]
mov dword [eax], esi
mov dword [ebx + 4], ecx
mov dword [edi + 4], edx
mov dword [esi + 4], eax
mov eax, dword [ebp - 4]
mov dword [eax], esi
mov eax, dword [ebp - 8]
mov esi, edi
cmp edi, eax
jne 0x409ea5
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
mov edx, dword [esi + 4]
mov ebx, dword [ebx]
mov dword [edx], edi
mov ecx, dword [edi + 4]
mov dword [ecx], ebx
mov eax, dword [ebx + 4]
mov dword [eax], esi
mov dword [ebx + 4], ecx
mov dword [edi + 4], edx
mov dword [esi + 4], eax
jmp 0x409f8b
push str.invalid_hash_bucket_count
call fcn.0048506f
int3
Function at 0x417ab0
Capabilities:
Create udp socket

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x2c
mov eax, dword [0x624040]
xor eax, esp
mov dword [esp + 0x28], eax
push ebx
push esi
push edi
push dword [ebp + 0x14]
xorps xmm0, xmm0
mov eax, 2
mov esi, ecx
movlpd qword [esp + 0x2c], xmm0
mov word [esp + 0x24], ax
call dword [sym.imp.WS2_32.dll_htons]
push 0x11
push 2
mov word [esp + 0x2a], ax
mov eax, dword [ebp + 0x10]
push 2
mov dword [esp + 0x30], eax
call dword [sym.imp.WS2_32.dll_socket]
mov edi, eax
test edi, edi
jle 0x417bb8
cmp byte [esi + 0x44], 0
mov ebx, dword [ebp + 0xc]
je 0x417ba0
push 0x1f4
call dword [sym.imp.KERNEL32.dll_Sleep]
cmp dword [esi + 0x7c], 0
je 0x417b96
call fcn.00485845
push 0
push 0x2710
push edx
push eax
call fcn.005b83b0
movq xmm0, qword [esi + 0x80]
mov ebx, eax
movq qword [esp + 0x10], xmm0
mov ecx, ebx
mov eax, edx
sub ecx, dword [esp + 0x10]
sbb eax, dword [esp + 0x14]
mov dword [esp + 0x14], eax
jne 0x417b62
cmp ecx, 0x7530
jb 0x417b93
mov dword [esp + 0x18], ebx
mov dword [esp + 0x1c], edx
movq xmm0, qword [esp + 0x18]
movq qword [esi + 0x80], xmm0
lock inc dword [esp + 0x30]
mov ebx, dword [ebp + 0xc]
lea eax, [esp + 0x20]
push ebx
push dword [ebp + 8]
mov ecx, esi
push eax
push edi
call fcn.00417bd0
jmp 0x417b96
mov ebx, dword [ebp + 0xc]
cmp byte [esi + 0x44], 0
jne 0x417b14
push ebx
push dword [ebp + 8]
lea eax, [esp + 0x28]
mov ecx, esi
push eax
push edi
call fcn.00417bd0
push edi
call dword [sym.imp.WS2_32.dll_closesocket]
mov ecx, dword [esp + 0x34]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.004830fa
mov esp, ebp
pop ebp
ret 0x10