joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4790c0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xfffffffffffffffe
push 0x5f51a8
push fcn.00556a70
mov eax, dword fs:[0]
push eax
sub esp, 0x28
mov eax, dword [0x61094c]
xor dword [ebp - 8], eax
xor eax, ebp
mov dword [ebp - 0x1c], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0x10]
mov dword fs:[0], eax
mov dword [ebp - 0x18], esp
mov edi, ecx
mov dword [ebp - 0x2c], edi
mov ebx, dword [ebp + 0x14]
test ebx, ebx
je 0x479108
mov dword [ebx], 0
mov dword [ebp - 0x24], 0
mov dword [ebp - 0x28], 0x1f4
mov dword [ebp - 0x20], 0
mov dword [ebp - 4], 0
mov eax, 0x1fc
call fcn.00554680
mov dword [ebp - 0x18], esp
mov esi, esp
mov dword [ebp - 0x30], esi
test esi, esi
je 0x479146
mov dword [esi], 0xcccc
add esi, 8
mov dword [ebp - 0x30], esi
mov dword [ebp - 0x20], esi
mov dword [ebp - 4], 0xfffffffe
jmp 0x47917d
test esi, esi
je 0x4792e4
lea eax, [ebp - 0x28]
push eax
push esi
lea eax, [ebp - 0x24]
push eax
push 0
push dword [ebp + 8]
push dword [edi]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov edi, eax
cmp edi, 0xea
jne 0x47929a
add esi, 0xfffffff8
cmp dword [esi], 0xdddd
jne 0x4791bd
push esi
call fcn.0055e8cd
add esp, 4
mov dword [ebp - 0x20], 0
mov dword [ebp - 4], 1
mov edx, dword [ebp - 0x28]
lea ecx, [edx + 8]
cmp edx, ecx
sbb eax, eax
test ecx, eax
je 0x479245
cmp edx, ecx
sbb eax, eax
and eax, ecx
cmp eax, 0x400
ja 0x479215
cmp edx, ecx
sbb eax, eax
and eax, ecx
call fcn.00554680
mov dword [ebp - 0x18], esp
mov esi, esp
mov dword [ebp - 0x34], esi
test esi, esi
je 0x479247
mov dword [esi], 0xcccc
add esi, 8
mov dword [ebp - 0x34], esi
mov dword [ebp - 0x20], esi
mov dword [ebp - 4], 0xfffffffe
jmp 0x47927b
cmp edx, ecx
sbb eax, eax
and eax, ecx
push eax
call fcn.00560371
add esp, 4
mov esi, eax
mov dword [ebp - 0x38], esi
test esi, esi
je 0x479247
mov dword [esi], 0xdddd
add esi, 8
mov dword [ebp - 0x38], esi
mov dword [ebp - 0x20], esi
mov dword [ebp - 4], 0xfffffffe
jmp 0x47927b
xor esi, esi
mov dword [ebp - 0x20], esi
mov dword [ebp - 4], 0xfffffffe
jmp 0x47927b
test esi, esi
je 0x4792e4
lea eax, [ebp - 0x28]
push eax
push esi
lea eax, [ebp - 0x24]
push eax
push 0
push dword [ebp + 8]
mov eax, dword [ebp - 0x2c]
push dword [eax]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov edi, eax
test edi, edi
jne 0x4792cc
cmp dword [ebp - 0x24], 3
je 0x4792ab
mov edi, 0xd
jmp 0x4792cc
push dword [ebp + 0x10]
push dword [ebp + 0xc]
lea eax, [ebp - 0x24]
push eax
push dword [ebp - 0x28]
push esi
call fcn.00478f40
add esp, 0x14
mov edi, eax
test ebx, ebx
je 0x4792cc
mov eax, dword [ebp - 0x24]
mov dword [ebx], eax
add esi, 0xfffffff8
cmp dword [esi], 0xdddd
jne 0x4792e0
push esi
call fcn.0055e8cd
add esp, 4
mov eax, edi
jmp 0x4792e9
mov eax, 0xe
lea esp, [ebp - 0x48]
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x1c]
xor ecx, ebp
call fcn.00553daa
mov esp, ebp
pop ebp
ret 0x10
Function at 0x488d40
Capabilities:
Terminate thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, ecx
push edi
xor edi, edi
mov dword [ebp - 4], edi
lea ebx, [esi + 0x14]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
add dword [esi + 0x10], 0xffffffff
jne 0x488dbd
mov eax, dword [esi]
test eax, eax
je 0x488d6b
push eax
call dword [sym.imp.KERNEL32.dll_SetEvent]
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov ecx, dword [esi + 4]
cmp eax, dword [esi + 8]
je 0x488db4
mov eax, dword [esi + 0xc]
mov edi, ecx
mov dword [ebp - 4], eax
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
test edi, edi
je 0x488daa
push dword [ebp - 4]
push edi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x488da3
push 0
push edi
call dword [sym.imp.KERNEL32.dll_TerminateThread]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [esi + 0x10]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x488d81
cmp dword [esi + 0x10], edi
jge 0x488d81
push ebx
mov dword [esi + 0x10], edi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov eax, dword [esi + 0x10]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4a6400
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
xor ecx, ecx
push esi
mov edx, 0x811c9dc5
lea esi, [eax + eax]
test esi, esi
je 0x4a6432
push edi
mov edi, dword [ebp + 8]
nop dword [eax]
movzx eax, byte [ecx + edi]
inc ecx
xor eax, edx
imul edx, eax, 0x1000193
cmp ecx, esi
jb 0x4a6420
pop edi
mov eax, edx
pop esi
pop ebp
ret
Function at 0x4a6f70
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 0x10]
xor ecx, ecx
test esi, esi
je 0x4a6f9b
mov edx, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0xc]
movzx eax, byte [ecx + edi]
inc ecx
xor eax, edx
imul edx, eax, 0x1000193
cmp ecx, esi
jb 0x4a6f84
pop edi
mov eax, edx
pop esi
pop ebp
ret
mov eax, dword [ebp + 8]
pop esi
pop ebp
ret
Function at 0x4aa4b0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5914ec
mov eax, dword fs:[0]
push eax
push ebx
sub esp, 0x30
push esi
push edi
mov eax, dword [0x61094c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, ecx
mov dword [ebp - 0x14], eax
mov edi, dword [ebx + 8]
lea esi, [eax + 8]
mov dword [ebp - 4], 0
xorps xmm0, xmm0
mov dword [ebp - 0x2c], edi
mov dword [ebp - 0x24], 0
movups xmmword [edi], xmm0
push esi
mov dword [ebp - 0x18], edi
movups xmmword [edi + 0x10], xmm0
mov dword [ebp - 0x20], esi
call fcn.0053fbfa
add esp, 4
test eax, eax
jne 0x4aa660
mov eax, dword [ebp - 0x14]
mov dword [ebp - 4], 1
push 0x38
mov eax, dword [eax + 0x38]
mov dword [edi], eax
mov dword [edi + 4], 0
mov dword [edi + 8], 0
call fcn.00553fc1
add esp, 4
mov dword [eax], eax
mov dword [eax + 4], eax
mov dword [edi + 4], eax
lea ecx, [edi + 0xc]
mov dword [ecx], 0
mov dword [ecx + 4], 0
mov dword [ecx + 8], 0
mov edx, dword [ebp - 0x14]
mov byte [ebp - 4], 3
mov eax, dword [edx + 0x50]
mov dword [edi + 0x18], eax
mov eax, dword [edx + 0x54]
mov dword [edi + 0x1c], eax
mov eax, dword [edx + 0x48]
sub eax, dword [edx + 0x44]
push dword [edi + 4]
sar eax, 2
push eax
call fcn.004ab970
mov eax, dword [ebp - 0x14]
mov ecx, edi
mov eax, dword [eax + 0x3c]
push eax
push dword [eax]
call fcn.004ae7e0
push esi
call fcn.0053fc1f
add esp, 4
mov dword [ebp - 4], 0
mov edi, dword [0x620594]
mov dword [ebp - 0x24], 3
mov dword [ebp - 0x20], edi
mov esi, dword [edi]
mov dword [ebp - 0x1c], esi
cmp esi, edi
je 0x4aa647
nop dword [eax]
cmp dword [esi + 0x1c], 8
lea eax, [esi + 8]
mov dword [ebp - 0x14], eax
jb 0x4aa5e1
mov ecx, dword [eax]
mov dword [ebp - 0x14], ecx
mov ecx, dword [eax + 0x10]
mov edx, 0x811c9dc5
xor eax, eax
add ecx, ecx
mov dword [ebp - 0x28], ecx
je 0x4aa60e
mov edi, dword [ebp - 0x14]
mov esi, ecx
movzx ecx, byte [eax + edi]
inc eax
xor ecx, edx
imul edx, ecx, 0x1000193
cmp eax, esi
jb 0x4aa5f7
mov esi, dword [ebp - 0x1c]
mov edi, dword [ebp - 0x20]
mov ecx, dword [ebp - 0x18]
lea eax, [esi + 8]
push edx
push eax
lea eax, [ebp - 0x34]
push eax
call fcn.004a6c80
mov ecx, dword [eax + 4]
test ecx, ecx
je 0x4aa62e
mov eax, dword [ebp - 0x18]
cmp dword [eax + 4], ecx
jne 0x4aa63e
mov ecx, dword [ebp - 0x18]
lea eax, [esi + 8]
push eax
lea eax, [ebp - 0x3c]
push eax
call fcn.004acb20
mov esi, dword [esi]
mov dword [ebp - 0x1c], esi
cmp esi, edi
jne 0x4aa5d0
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret 4
push eax
call fcn.0053fc4a
int3
Function at 0x4ab540
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
mov dword [ebp - 4], ecx
cmp edx, eax
je 0x4ab6ce
cmp dword [edx + 0x1c], 8
mov eax, dword [ecx + 4]
push esi
mov dword [ebp - 0x18], eax
mov esi, edx
mov eax, dword [ecx + 0xc]
push edi
mov dword [ebp - 0x14], eax
lea edi, [edx + 8]
mov eax, dword [edx + 4]
mov dword [ebp - 8], eax
mov eax, dword [edi + 0x10]
jb 0x4ab57b
mov edi, dword [edi]
xor edx, edx
push ebx
mov ebx, 0x811c9dc5
add eax, eax
je 0x4ab5a4
mov ecx, eax
nop dword [eax]
movzx eax, byte [edx + edi]
inc edx
xor eax, ebx
imul ebx, eax, 0x1000193
cmp edx, ecx
jb 0x4ab590
mov ecx, dword [ebp - 4]
mov eax, dword [ecx + 0x18]
mov ecx, dword [ebp - 0x14]
and eax, ebx
lea eax, [ecx + eax*8]
mov ecx, dword [eax]
mov dword [ebp - 0xc], eax
mov eax, dword [eax + 4]
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0x1c], eax
nop dword [eax]
mov ebx, esi
mov dword [ebp - 0x20], esi
mov esi, dword [esi]
lea ecx, [ebx + 0x20]
call fcn.004b1420
lea ecx, [ebx + 8]
call fcn.004257b0
push 0x3c
push ebx
call fcn.00554242
mov eax, dword [ebp - 4]
add esp, 8
dec dword [eax + 8]
mov eax, dword [ebp - 0x1c]
cmp ebx, eax
je 0x4ab618
mov eax, dword [ebp + 0xc]
cmp esi, eax
jne 0x4ab5c0
mov ecx, dword [ebp - 0x10]
cmp ecx, dword [ebp + 8]
jne 0x4ab6c3
mov ecx, dword [ebp - 0xc]
pop ebx
pop edi
mov dword [ecx], esi
mov ecx, dword [ebp - 8]
mov dword [ecx], esi
mov dword [esi + 4], ecx
pop esi
mov esp, ebp
pop ebp
ret 8
mov ecx, dword [ebp - 0x10]
cmp ecx, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
jne 0x4ab62a
mov eax, dword [ebp - 0x18]
mov dword [ecx], eax
jmp 0x4ab62d
mov eax, dword [ebp - 8]
mov dword [ecx + 4], eax
mov eax, dword [ebp + 0xc]
cmp esi, eax
je 0x4ab6c3
nop dword [eax + eax]
cmp dword [esi + 0x1c], 8
lea edx, [esi + 8]
mov ebx, dword [edx + 0x10]
jb 0x4ab64e
mov edx, dword [edx]
xor ecx, ecx
mov edi, 0x811c9dc5
add ebx, ebx
je 0x4ab671
nop dword [eax]
movzx eax, byte [ecx + edx]
inc ecx
xor eax, edi
imul edi, eax, 0x1000193
cmp ecx, ebx
jb 0x4ab660
mov ecx, dword [ebp - 4]
mov eax, dword [ecx + 0x18]
mov ecx, dword [ebp - 0x14]
and eax, edi
lea eax, [ecx + eax*8]
mov dword [ebp - 0x10], eax
mov eax, dword [eax + 4]
mov dword [ebp - 0x20], eax
mov ebx, esi
mov dword [ebp - 0x1c], esi
mov esi, dword [esi]
lea ecx, [ebx + 0x20]
call fcn.004b1420
lea ecx, [ebx + 8]
call fcn.004257b0
push 0x3c
push ebx
call fcn.00554242
mov ecx, dword [ebp - 4]
add esp, 8
mov eax, dword [ebp - 0x20]
dec dword [ecx + 8]
cmp ebx, eax
mov eax, dword [ebp + 0xc]
je 0x4ab6d4
cmp esi, eax
jne 0x4ab688
mov ecx, dword [ebp - 0x10]
mov dword [ecx], esi
mov ecx, dword [ebp - 8]
pop ebx
pop edi
mov dword [ecx], esi
mov dword [esi + 4], ecx
pop esi
mov esp, ebp
pop ebp
ret 8
mov ecx, dword [ebp - 0x10]
mov edi, dword [ebp - 0x18]
mov dword [ecx], edi
mov dword [ecx + 4], edi
cmp esi, eax
jne 0x4ab640
mov ecx, dword [ebp - 8]
pop ebx
pop edi
mov dword [ecx], esi
mov dword [esi + 4], ecx
pop esi
mov esp, ebp
pop ebp
ret 8
Function at 0x4ab700
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
mov dword [ebp - 4], ecx
cmp edx, eax
je 0x4ab88e
cmp dword [edx + 0x1c], 8
mov eax, dword [ecx + 4]
push esi
mov dword [ebp - 0x18], eax
mov esi, edx
mov eax, dword [ecx + 0xc]
push edi
mov dword [ebp - 0x14], eax
lea edi, [edx + 8]
mov eax, dword [edx + 4]
mov dword [ebp - 8], eax
mov eax, dword [edi + 0x10]
jb 0x4ab73b
mov edi, dword [edi]
xor edx, edx
push ebx
mov ebx, 0x811c9dc5
add eax, eax
je 0x4ab764
mov ecx, eax
nop dword [eax]
movzx eax, byte [edx + edi]
inc edx
xor eax, ebx
imul ebx, eax, 0x1000193
cmp edx, ecx
jb 0x4ab750
mov ecx, dword [ebp - 4]
mov eax, dword [ecx + 0x18]
mov ecx, dword [ebp - 0x14]
and eax, ebx
lea eax, [ecx + eax*8]
mov ecx, dword [eax]
mov dword [ebp - 0xc], eax
mov eax, dword [eax + 4]
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0x1c], eax
nop dword [eax]
mov ebx, esi
mov dword [ebp - 0x20], esi
mov esi, dword [esi]
lea ecx, [ebx + 0x20]
call fcn.004257b0
lea ecx, [ebx + 8]
call fcn.004257b0
push 0x38
push ebx
call fcn.00554242
mov eax, dword [ebp - 4]
add esp, 8
dec dword [eax + 8]
mov eax, dword [ebp - 0x1c]
cmp ebx, eax
je 0x4ab7d8
mov eax, dword [ebp + 0xc]
cmp esi, eax
jne 0x4ab780
mov ecx, dword [ebp - 0x10]
cmp ecx, dword [ebp + 8]
jne 0x4ab883
mov ecx, dword [ebp - 0xc]
pop ebx
pop edi
mov dword [ecx], esi
mov ecx, dword [ebp - 8]
mov dword [ecx], esi
mov dword [esi + 4], ecx
pop esi
mov esp, ebp
pop ebp
ret 8
mov ecx, dword [ebp - 0x10]
cmp ecx, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
jne 0x4ab7ea
mov eax, dword [ebp - 0x18]
mov dword [ecx], eax
jmp 0x4ab7ed
mov eax, dword [ebp - 8]
mov dword [ecx + 4], eax
mov eax, dword [ebp + 0xc]
cmp esi, eax
je 0x4ab883
nop dword [eax + eax]
cmp dword [esi + 0x1c], 8
lea edx, [esi + 8]
mov ebx, dword [edx + 0x10]
jb 0x4ab80e
mov edx, dword [edx]
xor ecx, ecx
mov edi, 0x811c9dc5
add ebx, ebx
je 0x4ab831
nop dword [eax]
movzx eax, byte [ecx + edx]
inc ecx
xor eax, edi
imul edi, eax, 0x1000193
cmp ecx, ebx
jb 0x4ab820
mov ecx, dword [ebp - 4]
mov eax, dword [ecx + 0x18]
mov ecx, dword [ebp - 0x14]
and eax, edi
lea eax, [ecx + eax*8]
mov dword [ebp - 0x10], eax
mov eax, dword [eax + 4]
mov dword [ebp - 0x20], eax
mov ebx, esi
mov dword [ebp - 0x1c], esi
mov esi, dword [esi]
lea ecx, [ebx + 0x20]
call fcn.004257b0
lea ecx, [ebx + 8]
call fcn.004257b0
push 0x38
push ebx
call fcn.00554242
mov ecx, dword [ebp - 4]
add esp, 8
mov eax, dword [ebp - 0x20]
dec dword [ecx + 8]
cmp ebx, eax
mov eax, dword [ebp + 0xc]
je 0x4ab894
cmp esi, eax
jne 0x4ab848
mov ecx, dword [ebp - 0x10]
mov dword [ecx], esi
mov ecx, dword [ebp - 8]
pop ebx
pop edi
mov dword [ecx], esi
mov dword [esi + 4], ecx
pop esi
mov esp, ebp
pop ebp
ret 8
mov ecx, dword [ebp - 0x10]
mov edi, dword [ebp - 0x18]
mov dword [ecx], edi
mov dword [ecx + 4], edi
cmp esi, eax
jne 0x4ab800
mov ecx, dword [ebp - 8]
pop ebx
pop edi
mov dword [ecx], esi
mov dword [esi + 4], ecx
pop esi
mov esp, ebp
pop ebp
ret 8
Function at 0x4ac1b0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov edx, dword [ebp + 0xc]
mov eax, ecx
push ebx
push esi
push edi
cmp dword [edx + 0x14], 8
mov edi, edx
mov ebx, dword [edx + 0x10]
mov dword [ebp - 4], eax
jb 0x4ac1ce
mov edi, dword [edx]
xor ecx, ecx
mov esi, 0x811c9dc5
add ebx, ebx
je 0x4ac1f4
nop dword [eax]
movzx eax, byte [ecx + edi]
inc ecx
xor eax, esi
imul esi, eax, 0x1000193
cmp ecx, ebx
jb 0x4ac1e0
mov eax, dword [ebp - 4]
push esi
push edx
lea ecx, [ebp - 0xc]
push ecx
mov ecx, eax
call fcn.004a6c80
pop edi
pop esi
pop ebx
mov ecx, dword [eax + 4]
mov eax, dword [ebp + 8]
test ecx, ecx
jne 0x4ac214
mov ecx, dword [ebp - 4]
mov ecx, dword [ecx + 4]
mov dword [eax], ecx
mov esp, ebp
pop ebp
ret 8

Function at 0x4ac260
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [ebp + 0xc]
cmp dword [eax + 0x1c], 8
push ebx
mov ebx, dword [eax + 0x18]
mov dword [ebp - 4], ecx
lea ecx, [eax + 8]
push esi
push edi
mov dword [ebp - 8], ecx
mov edi, ecx
jb 0x4ac282
mov edi, dword [ecx]
xor edx, edx
mov esi, 0x811c9dc5
add ebx, ebx
je 0x4ac2a1
nop dword [eax]
movzx ecx, byte [edx + edi]
inc edx
xor ecx, esi
imul esi, ecx, 0x1000193
cmp edx, ebx
jb 0x4ac290
mov ebx, dword [ebp - 4]
mov edx, dword [ebx + 0x18]
mov ecx, dword [ebx + 0xc]
and edx, esi
mov esi, dword [ecx + edx*8]
cmp dword [ecx + edx*8 + 4], eax
jne 0x4ac2ce
cmp esi, eax
jne 0x4ac2c5
mov eax, dword [ebx + 4]
mov dword [ecx + edx*8], eax
mov dword [ecx + edx*8 + 4], eax
jmp 0x4ac2d7
mov eax, dword [eax + 4]
mov dword [ecx + edx*8 + 4], eax
jmp 0x4ac2d7
cmp esi, eax
jne 0x4ac2da
mov eax, dword [eax]
mov dword [ecx + edx*8], eax
mov eax, dword [ebp + 0xc]
mov esi, dword [eax]
dec dword [ebx + 8]
mov eax, dword [eax + 4]
mov edi, dword [ebp - 8]
mov dword [eax], esi
mov eax, dword [ebp + 0xc]
lea ecx, [edi + 0x18]
mov eax, dword [eax + 4]
mov dword [esi + 4], eax
call fcn.004257b0
mov ecx, edi
call fcn.004257b0
push 0x38
push dword [ebp + 0xc]
call fcn.00554242
mov eax, dword [ebp + 8]
add esp, 8
pop edi
mov dword [eax], esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x4ae820
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x591b85
mov eax, dword fs:[0]
push eax
sub esp, 0x24
push ebx
push esi
push edi
mov eax, dword [0x61094c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x14], edi
mov edx, dword [ebp + 0xc]
mov ebx, dword [ebp + 8]
mov dword [ebp - 0x10], edx
mov dword [ebp - 0x18], edx
cmp dword [edx + 0x14], 8
mov ecx, dword [edx + 0x10]
jb 0x4ae867
mov eax, dword [edx]
mov dword [ebp - 0x18], eax
lea eax, [ecx + ecx]
mov esi, 0x811c9dc5
xor ecx, ecx
test eax, eax
je 0x4ae897
mov edi, dword [ebp - 0x18]
mov edx, eax
nop word [eax + eax]
movzx eax, byte [ecx + edi]
inc ecx
xor eax, esi
imul esi, eax, 0x1000193
cmp ecx, edx
jb 0x4ae880
mov edi, dword [ebp - 0x14]
mov edx, dword [ebp - 0x10]
push esi
push edx
lea eax, [ebp - 0x24]
mov ecx, edi
push eax
call fcn.004a6c80
mov eax, dword [ebp - 0x20]
test eax, eax
je 0x4ae8b6
mov dword [ebx], eax
mov byte [ebx + 4], 0
jmp 0x4ae9eb
cmp dword [edi + 8], 0x71c71c7
je 0x4aea01
lea eax, [edi + 4]
mov dword [ebp - 0x2c], eax
mov dword [ebp - 4], 0
push 0x24
mov dword [ebp - 0x28], 0
call fcn.00553fc1
add esp, 4
mov edi, eax
mov dword [ebp - 0x28], edi
push dword [ebp - 0x10]
lea ecx, [edi + 8]
call fcn.004289f0
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax + 0x18]
mov dword [edi + 0x20], ecx
mov edx, dword [ebp - 0x14]
mov dword [ebp - 4], 1
mov eax, dword [edx + 8]
inc eax
movss xmm3, dword [edx]
movd xmm0, eax
cvtdq2pd xmm0, xmm0
shr eax, 0x1f
addsd xmm0, qword [eax*8 + 0x5e3010]
mov eax, dword [edx + 0x1c]
mov dword [ebp - 0x1c], eax
movd xmm1, eax
cvtdq2pd xmm1, xmm1
shr eax, 0x1f
cvtpd2ps xmm0, xmm0
addsd xmm1, qword [eax*8 + 0x5e3010]
movaps xmm2, xmm0
cvtpd2ps xmm1, xmm1
divss xmm2, xmm1
comiss xmm2, xmm3
jbe 0x4ae99e
divss xmm0, xmm3
call fcn.004a6f30
call fcn.005546b0
mov ecx, 8
cmp eax, ecx
cmova ecx, eax
mov eax, dword [ebp - 0x1c]
cmp eax, ecx
jae 0x4ae97d
cmp eax, 0x200
jae 0x4ae97b
shl eax, 3
cmp eax, ecx
jae 0x4ae97d
mov eax, ecx
mov ecx, dword [ebp - 0x14]
push eax
call fcn.004a6910
mov ecx, dword [ebp - 0x14]
lea eax, [edi + 8]
push esi
push eax
lea eax, [ebp - 0x24]
push eax
call fcn.004a6c80
mov edx, dword [ebp - 0x14]
mov ecx, dword [eax]
jmp 0x4ae9a1
mov ecx, dword [ebp - 0x24]
mov eax, dword [ecx + 4]
inc dword [edx + 8]
mov dword [edi + 4], eax
mov dword [edi], ecx
mov dword [eax], edi
mov dword [ecx + 4], edi
mov dword [ebp - 0x10], eax
mov eax, dword [edx + 0x18]
and eax, esi
mov dword [ebp - 0x18], ecx
mov ecx, dword [edx + 0xc]
mov esi, dword [ebp - 0x2c]
mov edx, dword [ecx + eax*8]
cmp edx, dword [esi]
jne 0x4ae9ce
mov dword [ecx + eax*8], edi
jmp 0x4ae9e1
cmp edx, dword [ebp - 0x18]
jne 0x4ae9d8
mov dword [ecx + eax*8], edi
jmp 0x4ae9e5
mov edx, dword [ebp - 0x10]
cmp dword [ecx + eax*8 + 4], edx
jne 0x4ae9e5
mov dword [ecx + eax*8 + 4], edi
mov dword [ebx], edi
mov byte [ebx + 4], 1
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
push str.unordered_map_set_too_long
call fcn.0053ed72
int3
Function at 0x4b1c90
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5920ee
mov eax, dword fs:[0]
push eax
sub esp, 0x30
push ebx
push esi
push edi
mov eax, dword [0x61094c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x1c], ecx
mov edx, dword [ebp + 0x10]
mov ecx, edx
mov eax, dword [ebp + 8]
mov ebx, dword [ebp + 0xc]
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x3c], 0
lea esi, [ecx + 2]
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x38], 0
mov dword [ebp - 0x28], 0
mov dword [ebp - 0x24], 7
nop dword [eax + eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x4b1cf0
sub ecx, esi
sar ecx, 1
push ecx
push edx
lea ecx, [ebp - 0x38]
call fcn.00425810
mov eax, dword [ebp - 0x28]
lea esi, [ebp - 0x38]
cmp dword [ebp - 0x24], 8
mov edx, 0x811c9dc5
cmovae esi, dword [ebp - 0x38]
xor ecx, ecx
lea edi, [eax + eax]
test edi, edi
je 0x4b1d36
movzx eax, byte [ecx + esi]
inc ecx
xor eax, edx
imul edx, eax, 0x1000193
cmp ecx, edi
jb 0x4b1d25
push edx
lea eax, [ebp - 0x38]
mov ecx, ebx
push eax
lea eax, [ebp - 0x14]
push eax
call fcn.004a6c80
mov esi, dword [eax + 4]
test esi, esi
jne 0x4b1d50
mov esi, dword [ebx + 4]
lea ecx, [ebp - 0x38]
call fcn.004257b0
cmp esi, dword [ebx + 4]
jne 0x4b1d7f
xorps xmm0, xmm0
movlpd qword [ebp - 0x14], xmm0
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x10], 0
lea ecx, [ebp - 0x14]
mov ebx, 1
xor eax, eax
jmp 0x4b1db0
mov edi, dword [esi + 0x44]
test edi, edi
je 0x4b1e3d
mov ecx, dword [ebp - 0x1c]
mov eax, dword [edi]
push dword [ecx + 0x1c]
mov esi, dword [eax + 8]
lea ecx, [ebp - 0x20]
push ecx
mov ecx, esi
call dword [0x5a0478]
mov ecx, edi
call esi
mov eax, dword [ebp - 0x20]
lea ecx, [ebp - 0x20]
mov ebx, 0xa
mov edx, dword [ebp - 0x18]
or ebx, 4
or edi, 0xffffffff
mov dword [ecx], 0
mov dword [edx], eax
mov eax, dword [ecx + 4]
mov dword [edx + 4], eax
mov dword [ecx + 4], 0
test bl, 2
je 0x4b1dfc
mov esi, dword [ebp - 0x1c]
and ebx, 0xfffffffd
test esi, esi
je 0x4b1dfc
mov eax, edi
lock xadd dword [esi + 4], eax
jne 0x4b1dfc
mov eax, dword [esi]
mov ecx, esi
call dword [eax]
mov eax, edi
lock xadd dword [esi + 8], eax
jne 0x4b1dfc
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 4]
test bl, 1
je 0x4b1e26
mov esi, dword [ebp - 0x10]
test esi, esi
je 0x4b1e26
mov eax, edi
lock xadd dword [esi + 4], eax
jne 0x4b1e26
mov eax, dword [esi]
mov ecx, esi
call dword [eax]
lock xadd dword [esi + 8], edi
dec edi
jne 0x4b1e26
mov edx, dword [esi]
mov ecx, esi
call dword [edx + 4]
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
call fcn.0053ed35
int3