joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4417e0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x14
mov eax, dword [ebp + 0x10]
push ebx
mov ebx, ecx
mov ecx, dword [ebp + 0xc]
push esi
push edi
mov edi, dword [ebp + 8]
mov dword [esp + 0xc], edi
test eax, eax
jg 0x441812
jl 0x441805
test ecx, ecx
jne 0x441812
xor eax, eax
xor edx, edx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
cmp dword [ebx + 0x38], 0
je 0x4418ef
mov dword [esp + 0x10], eax
lea eax, [ebx + 0x2c]
mov dword [esp + 0xc], ecx
mov dword [esp + 0x14], eax
mov eax, dword [ebx + 0x1c]
mov eax, dword [eax]
mov dword [esp + 0x18], eax
test eax, eax
je 0x441842
mov eax, dword [esp + 0x14]
mov eax, dword [eax]
mov eax, dword [eax]
jmp 0x441844
xor eax, eax
cdq
mov dword [esp + 0x1c], edx
mov esi, eax
test edx, edx
jl 0x441898
jg 0x441855
test esi, esi
je 0x441898
mov eax, dword [esp + 0x10]
cmp eax, edx
jg 0x441869
jl 0x441863
cmp ecx, esi
jae 0x441869
mov esi, ecx
mov dword [esp + 0x1c], eax
push esi
push dword [esp + 0x1c]
push edi
call fcn.006217b0
mov eax, dword [esp + 0x20]
add esp, 0xc
mov ecx, dword [esp + 0xc]
mov edx, dword [esp + 0x10]
sub ecx, esi
mov eax, dword [eax]
sbb edx, dword [esp + 0x1c]
sub dword [eax], esi
mov eax, dword [ebx + 0x1c]
add dword [eax], esi
mov eax, dword [esp + 0x14]
jmp 0x4418bc
mov eax, dword [ebx]
mov ecx, ebx
call dword [eax + 0x1c]
mov edx, dword [esp + 0x10]
cmp eax, 0xffffffff
je 0x4418d8
mov ecx, dword [esp + 0xc]
mov esi, 1
add ecx, 0xffffffff
mov byte [edi], al
lea eax, [ebx + 0x2c]
adc edx, 0xffffffff
add edi, esi
mov dword [esp + 0x10], edx
mov dword [esp + 0xc], ecx
test edx, edx
jg 0x441827
jl 0x4418d8
test ecx, ecx
jne 0x441827
mov eax, dword [ebp + 0xc]
sub eax, dword [esp + 0xc]
mov ecx, dword [ebp + 0x10]
sbb ecx, edx
mov edx, ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov eax, dword [ebx + 0x1c]
lea esi, [ebx + 0x2c]
mov edi, ecx
mov edx, dword [eax]
test edx, edx
je 0x44192d
mov eax, dword [esi]
mov eax, dword [eax]
test eax, eax
je 0x44192d
cmp eax, ecx
mov esi, ecx
cmovb esi, eax
push esi
push edx
push dword [esp + 0x14]
call fcn.006217b0
mov eax, dword [ebx + 0x2c]
sub edi, esi
add dword [esp + 0x18], esi
add esp, 0xc
sub dword [eax], esi
mov eax, dword [ebx + 0x1c]
add dword [eax], esi
lea esi, [ebx + 0x2c]
cmp dword [ebx + 0x4c], 0
je 0x441997
mov ecx, dword [ebx + 0xc]
lea eax, [ebx + 0x3c]
cmp dword [ecx], eax
jne 0x441953
mov eax, dword [ebx + 0xc]
mov edx, dword [ebx + 0x54]
mov ecx, dword [ebx + 0x50]
sub edx, ecx
mov dword [eax], ecx
mov eax, dword [ebx + 0x1c]
mov dword [eax], ecx
mov eax, dword [esi]
mov dword [eax], edx
mov esi, dword [esp + 0xc]
cmp edi, 0xfff
jbe 0x441982
nop
push dword [ebx + 0x4c]
push 0xfff
push 1
push esi
call fcn.0063861d
add esp, 0x10
add esi, eax
sub edi, eax
cmp eax, 0xfff
jne 0x441997
cmp edi, eax
ja 0x441960
test edi, edi
je 0x441997
push dword [ebx + 0x4c]
push edi
push 1
push esi
call fcn.0063861d
add esp, 0x10
sub edi, eax
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 0x10]
sub eax, edi
pop edi
pop esi
sbb edx, 0
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x4462f0
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x656550
mov eax, dword fs:[0]
push eax
push esi
push edi
mov eax, dword [0x6d6ec0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
push 8
mov dword [edi], vtable.std::basic_streambuf_char__struct_std::char_traits_char__.0
mov dword [edi + 4], 0
mov dword [edi + 8], 0
mov dword [edi + 0xc], 0
mov dword [edi + 0x10], 0
mov dword [edi + 0x14], 0
mov dword [edi + 0x18], 0
mov dword [edi + 0x1c], 0
mov dword [edi + 0x20], 0
mov dword [edi + 0x24], 0
mov dword [edi + 0x28], 0
mov dword [edi + 0x2c], 0
mov dword [edi + 0x30], 0
call fcn.0061f577
mov esi, eax
xorps xmm0, xmm0
movq qword [esi], xmm0
push 1
mov dword [ebp - 4], 0
call fcn.0060dbb4
add esp, 8
mov dword [esi + 4], eax
mov ecx, edi
mov dword [edi + 0x34], esi
call fcn.0044c830
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x44bd80
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
mov dword [ebp - 8], ecx
cmp edx, eax
je 0x44bf1c
cmp dword [edx + 0x1c], 0xf
mov eax, dword [ecx + 4]
push esi
mov dword [ebp - 0x1c], eax
mov esi, edx
mov eax, dword [ecx + 0xc]
push edi
mov dword [ebp - 0x18], eax
lea edi, [edx + 8]
mov eax, dword [edx + 4]
mov dword [ebp - 0xc], eax
mov eax, dword [edi + 0x10]
jbe 0x44bdbb
mov edi, dword [edi]
xor edx, edx
push ebx
mov ebx, 0x811c9dc5
test eax, eax
je 0x44bde4
mov ecx, eax
nop dword [eax]
movzx eax, byte [edi + edx]
inc edx
xor eax, ebx
imul ebx, eax, 0x1000193
cmp edx, ecx
jb 0x44bdd0
mov ecx, dword [ebp - 8]
mov eax, dword [ecx + 0x18]
mov ecx, dword [ebp - 0x18]
and eax, ebx
lea eax, [ecx + eax*8]
mov ecx, dword [eax]
mov dword [ebp - 0x10], eax
mov eax, dword [eax + 4]
mov dword [ebp - 4], ecx
mov dword [ebp - 0x14], eax
nop dword [eax]
mov edi, esi
mov ebx, esi
mov esi, dword [esi]
lea ecx, [edi + 8]
call fcn.00413c20
push 0x38
push edi
call fcn.0061f90d
mov eax, dword [ebp - 8]
add esp, 8
dec dword [eax + 8]
cmp ebx, dword [ebp - 0x14]
je 0x44be49
mov eax, dword [ebp + 0xc]
cmp esi, eax
jne 0x44be00
mov ecx, dword [ebp - 4]
cmp ecx, dword [ebp + 8]
jne 0x44be38
mov edx, dword [ebp - 0x10]
mov dword [edx], esi
mov ecx, dword [ebp - 0xc]
pop ebx
pop edi
mov dword [ecx], esi
mov dword [esi + 4], ecx
pop esi
mov esp, ebp
pop ebp
ret 8
mov ecx, dword [ebp - 4]
mov edx, dword [ebp - 0x10]
cmp ecx, dword [ebp + 8]
jne 0x44be5b
mov ecx, dword [ebp - 0x1c]
mov dword [edx], ecx
jmp 0x44be5e
mov ecx, dword [ebp - 0xc]
mov dword [edx + 4], ecx
mov ecx, dword [ebp + 0xc]
cmp esi, ecx
je 0x44bf0f
nop dword [eax]
cmp dword [esi + 0x1c], 0xf
lea edx, [esi + 8]
mov ebx, dword [edx + 0x10]
jbe 0x44be7e
mov edx, dword [edx]
xor ecx, ecx
mov edi, 0x811c9dc5
test ebx, ebx
je 0x44bea4
nop dword [eax]
movzx eax, byte [edx + ecx]
inc ecx
xor eax, edi
imul edi, eax, 0x1000193
cmp ecx, ebx
jb 0x44be90
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x18]
mov ecx, dword [ebp - 0x18]
and eax, edi
lea eax, [ecx + eax*8]
mov dword [ebp - 4], eax
mov eax, dword [eax + 4]
mov dword [ebp - 0x14], eax
mov edi, esi
mov ebx, esi
mov esi, dword [esi]
lea ecx, [edi + 8]
call fcn.00413c20
push 0x38
push edi
call fcn.0061f90d
mov eax, dword [ebp - 8]
add esp, 8
dec dword [eax + 8]
cmp ebx, dword [ebp - 0x14]
je 0x44bef9
mov eax, dword [ebp + 0xc]
cmp esi, eax
jne 0x44beb8
mov ecx, dword [ebp - 4]
pop ebx
pop edi
mov dword [ecx], esi
mov ecx, dword [ebp - 0xc]
mov dword [ecx], esi
mov dword [esi + 4], ecx
pop esi
mov esp, ebp
pop ebp
ret 8
mov ecx, dword [ebp - 4]
mov edi, dword [ebp - 0x1c]
mov dword [ecx], edi
mov dword [ecx + 4], edi
mov ecx, dword [ebp + 0xc]
cmp esi, ecx
jne 0x44be70
mov eax, dword [ebp - 0xc]
pop ebx
pop edi
mov dword [eax], esi
mov dword [esi + 4], eax
mov eax, ecx
pop esi
mov esp, ebp
pop ebp
ret 8
Function at 0x44c230
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, ecx
push edi
mov dword [ebp - 4], esi
mov eax, dword [esi]
cmp eax, 0x270
jne 0x44c28d
lea edx, [esi + 8]
mov edi, eax
nop dword [eax]
mov ecx, dword [edx]
lea edx, [edx + 4]
xor ecx, dword [edx - 8]
and ecx, 0x7fffffff
xor ecx, dword [edx - 8]
mov eax, ecx
and al, 1
movzx eax, al
neg eax
sbb eax, eax
shr ecx, 1
and eax, 0x9908b0df
xor eax, dword [edx + 0x62c]
xor eax, ecx
mov dword [edx + 0x9b8], eax
sub edi, 1
jne 0x44c250
mov eax, dword [esi]
jmp 0x44c36b
cmp eax, 0x4e0
jb 0x44c36b
lea edi, [esi + 0x9c4]
mov esi, 0xe3
push ebx
mov ebx, dword [edi]
lea edx, [edi]
mov eax, ebx
mov ebx, dword [edx + 4]
lea edi, [edx + 4]
mov ecx, ebx
xor ecx, eax
and ecx, 0x7fffffff
xor ecx, eax
mov eax, ecx
and al, 1
movzx eax, al
neg eax
sbb eax, eax
shr ecx, 1
and eax, 0x9908b0df
xor eax, dword [edx + 0x634]
xor eax, ecx
mov dword [edx - 0x9c0], eax
sub esi, 1
jne 0x44c2a6
mov edi, dword [ebp - 4]
mov esi, 0x18c
add edi, 0xd50
mov ebx, dword [edi]
mov eax, ebx
lea edx, [edi]
mov ebx, dword [edx + 4]
lea edi, [edx + 4]
mov ecx, eax
xor ecx, ebx
and ecx, 0x7fffffff
xor ecx, eax
mov eax, ecx
and al, 1
movzx eax, al
neg eax
sbb eax, eax
shr ecx, 1
and eax, 0x9908b0df
xor eax, dword [edx - 0xd4c]
xor eax, ecx
mov dword [edx - 0x9c0], eax
sub esi, 1
jne 0x44c2f1
mov esi, dword [ebp - 4]
pop ebx
mov eax, dword [esi + 0x1380]
mov ecx, dword [esi + 4]
xor ecx, eax
and ecx, 0x7fffffff
xor ecx, eax
mov eax, ecx
and al, 1
movzx eax, al
neg eax
sbb eax, eax
shr ecx, 1
and eax, 0x9908b0df
xor eax, dword [esi + 0x634]
xor eax, ecx
mov dword [esi + 0x9c0], eax
xor eax, eax
mov dword [esi], 0
mov edx, dword [esi + eax*4 + 4]
inc eax
mov dword [esi], eax
mov ecx, edx
mov eax, dword [esi + 0x1384]
shr ecx, 0xb
and eax, ecx
xor edx, eax
mov eax, edx
and eax, 0xff3a58ad
shl eax, 7
xor edx, eax
mov eax, edx
and eax, 0xffffdf8c
shl eax, 0xf
xor edx, eax
mov eax, edx
shr eax, 0x12
pop edi
xor eax, edx
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x44d0b0
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x65d37c
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push esi
push edi
mov eax, dword [0x6d6ec0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x14], edi
mov dword [ebp - 0x18], edi
mov eax, dword [ebp + 8]
mov dword [ebp - 4], 0
mov dword [edi], eax
mov dword [edi + 4], 0
mov dword [edi + 8], 0
mov dword [edi + 0xc], 0
mov dword [edi + 0x10], 0
mov dword [edi + 0x14], 0
mov dword [edi + 0x18], 0
mov dword [edi + 0x1c], 0
mov dword [edi + 0x20], 0
mov dword [edi + 0x24], 0
mov dword [edi + 0x28], 0
mov dword [edi + 0x2c], 0
lea esi, [edi + 0x38]
mov dword [edi + 0x30], 0
mov byte [edi + 0x34], 0
mov dword [ebp - 0x14], esi
mov dword [esi + 0x24], 0
mov byte [ebp - 4], 4
mov ecx, dword [ebp + 0x34]
test ecx, ecx
je 0x44d164
mov eax, dword [ecx]
push esi
call dword [eax]
mov dword [esi + 0x24], eax
mov al, byte [ebp + 0xc]
lea ecx, [edi + 0x68]
mov byte [ebp - 4], 5
push 9
mov byte [edi + 0x60], al
call fcn.0044c010
lea eax, [ebp - 0xd]
mov byte [ebp - 4], 6
push eax
lea ecx, [edi + 0x10]
mov byte [ebp - 0xd], 1
call fcn.0044ff70
mov ecx, dword [ebp + 0x34]
test ecx, ecx
je 0x44d1a4
mov esi, dword [ecx]
lea eax, [ebp + 0x10]
cmp ecx, eax
setne dl
movzx edx, dl
push edx
call dword [esi + 0x10]
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x30
Function at 0x44f3e0
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x656550
mov eax, dword fs:[0]
push eax
push esi
push edi
mov eax, dword [0x6d6ec0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
push 8
mov dword [edi], vtable.std::basic_streambuf_wchar_t__struct_std::char_traits_wchar_t__.0
mov dword [edi + 4], 0
mov dword [edi + 8], 0
mov dword [edi + 0xc], 0
mov dword [edi + 0x10], 0
mov dword [edi + 0x14], 0
mov dword [edi + 0x18], 0
mov dword [edi + 0x1c], 0
mov dword [edi + 0x20], 0
mov dword [edi + 0x24], 0
mov dword [edi + 0x28], 0
mov dword [edi + 0x2c], 0
mov dword [edi + 0x30], 0
call fcn.0061f577
mov esi, eax
xorps xmm0, xmm0
movq qword [esi], xmm0
push 1
mov dword [ebp - 4], 0
call fcn.0060dbb4
add esp, 8
mov dword [esi + 4], eax
mov ecx, edi
mov dword [edi + 0x34], esi
call fcn.0044c830
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x462ef0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 0xc]
mov edx, 0x811c9dc5
push edi
mov edi, dword [ebp + 8]
mov ecx, 0
sub esi, edi
je 0x462f21
nop dword [eax]
movzx eax, byte [edi + ecx]
inc ecx
xor eax, edx
imul edx, eax, 0x1000193
cmp ecx, esi
jb 0x462f10
pop edi
mov eax, edx
pop esi
pop ebp
ret 8

Function at 0x463480
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x65f203
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x6d6ec0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x10], edi
mov ecx, dword [ebp + 0x14]
mov dword [ebp - 0x14], edi
mov dword [edi], 0
mov dword [edi + 4], 0
mov dword [edi + 8], 0
mov dword [edi + 0xc], 0
mov dword [edi + 0x10], 0
mov dword [edi + 0x14], 0
mov dword [edi + 0x18], 0
mov dword [edi + 0x1c], 0
mov dword [ebp - 4], 0
mov dword [edi + 0x20], 0
mov dword [edi + 0x24], 0
mov dword [edi + 0x28], 0
mov dword [edi + 0x2c], 0
mov dword [edi + 0x30], 0
mov dword [edi + 0x34], 0
mov dword [edi + 0x38], 0
mov dword [edi + 0x3c], 0
mov dword [edi + 0x40], 0
mov dword [edi + 0x44], 0
mov dword [edi + 0x48], 0
mov byte [ebp - 4], 2
mov eax, dword [ebp + 0xc]
mov dword [edi + 0x4c], 0
mov dword [edi + 0x50], eax
mov eax, dword [ebp + 8]
mov dword [edi + 0x54], eax
mov eax, dword [ebp + 0x1c]
mov dword [edi + 0x5c], eax
mov eax, dword [ebp + 0x18]
mov dword [edi + 0x68], eax
mov dword [edi + 0x58], ecx
mov dword [edi + 0x60], 0
mov byte [edi + 0x64], 0
mov eax, dword [ecx + 8]
shr eax, 3
and al, 1
mov byte [edi + 0x6c], al
mov eax, dword [ebp + 0x10]
mov dword [edi + 0x70], eax
mov esi, dword [ecx + 0x18]
mov ecx, dword [edi + 0x44]
mov edx, ecx
sar edx, 3
mov dword [ebp - 0x10], ecx
cmp esi, edx
jae 0x46359b
lea ecx, [esi*8]
jmp 0x4635cb
jbe 0x4635ce
mov eax, dword [edi + 0x48]
sar eax, 3
cmp esi, eax
jbe 0x4635b3
push ecx
push esi
lea ecx, [edi + 0x40]
call fcn.0047f220
jmp 0x4635ce
sub esi, edx
je 0x4635cb
shl esi, 3
push esi
push 0
push ecx
call fcn.00621d30
mov ecx, dword [ebp - 0x10]
add esp, 0xc
add ecx, esi
mov dword [edi + 0x44], ecx
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x1c
Function at 0x4684e0
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1fffffff
sub esp, 0x10
bsr ecx, eax
push ebx
push esi
push edi
mov edi, 1
mov eax, edi
shl eax, cl
mov ecx, dword [ebp + 8]
cmp ecx, eax
ja 0x46864d
lea eax, [ecx - 1]
mov esi, dword [0x6ee3f8]
or eax, edi
mov dword [ebp - 8], esi
bsr ecx, eax
push esi
lea ecx, [ecx + 1]
shl edi, cl
mov ecx, 0x6ee400
lea eax, [edi + edi]
push eax
call fcn.0044e510
mov eax, dword [0x6ee3f8]
lea ebx, [edi - 1]
mov dword [0x6ee40c], ebx
mov dword [0x6ee410], edi
mov eax, dword [eax]
mov ecx, eax
cmp eax, esi
je 0x468644
nop word [eax + eax]
movzx edx, byte [eax + 8]
xor edx, 0x811c9dc5
mov ecx, dword [ecx]
imul edi, edx, 0x1000193
movzx edx, byte [eax + 9]
xor edi, edx
movzx edx, byte [eax + 0xa]
imul edi, edi, 0x1000193
xor edi, edx
movzx edx, byte [eax + 0xb]
imul edi, edi, 0x1000193
xor edi, edx
mov edx, dword [0x6ee400]
imul edi, edi, 0x1000193
and edi, ebx
mov ebx, dword [edx + edi*8]
lea edx, [edx + edi*8]
mov dword [ebp - 0xc], edx
cmp ebx, esi
jne 0x4685a2
mov dword [edx], eax
mov dword [edx + 4], eax
jmp 0x46860f
mov edx, dword [edx + 4]
mov edi, dword [eax + 8]
cmp edi, dword [edx + 8]
jne 0x4685dc
mov edx, dword [edx]
mov dword [ebp - 4], edx
cmp edx, eax
je 0x4685d4
mov ebx, dword [eax + 4]
mov esi, dword [ebp - 4]
mov dword [ebx], ecx
mov edi, dword [ecx + 4]
mov dword [edi], edx
mov edx, dword [edx + 4]
mov dword [edx], eax
mov dword [esi + 4], edi
mov esi, dword [ebp - 8]
mov dword [ecx + 4], ebx
mov dword [eax + 4], edx
mov edx, dword [ebp - 0xc]
mov dword [edx + 4], eax
jmp 0x46860f
cmp ebx, edx
je 0x4685ec
mov edx, dword [edx + 4]
cmp edi, dword [edx + 8]
je 0x468620
cmp ebx, edx
jne 0x4685e0
mov ebx, dword [eax + 4]
mov dword [ebp - 4], ebx
mov dword [ebx], ecx
mov ebx, dword [ecx + 4]
mov dword [ebx], edx
mov edi, dword [edx + 4]
mov dword [edi], eax
mov dword [edx + 4], ebx
mov edx, dword [ebp - 4]
mov dword [ecx + 4], edx
mov edx, dword [ebp - 0xc]
mov dword [eax + 4], edi
mov dword [edx], eax
mov eax, ecx
cmp ecx, esi
je 0x468644
mov ebx, dword [0x6ee40c]
jmp 0x468550
mov ebx, dword [eax + 4]
mov edx, dword [edx]
mov dword [ebp - 4], edx
mov esi, edx
mov dword [ebx], ecx
mov edi, dword [ecx + 4]
mov dword [edi], edx
mov edx, dword [edx + 4]
mov dword [edx], eax
mov dword [esi + 4], edi
mov esi, dword [ebp - 8]
mov dword [ecx + 4], ebx
mov dword [eax + 4], edx
jmp 0x46860f
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
push str.invalid_hash_bucket_count
call fcn.0060d5dc
int3
Function at 0x4701a0
Capabilities:
Access peb ldr_data

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x65ff33
mov eax, dword fs:[0]
push eax
push ebx
sub esp, 0x20
push esi
push edi
mov eax, dword [0x6d6ec0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x18], esi
mov dword [ebp - 0x14], esi
mov dword [ebp - 0x14], esi
mov dword [ebp - 4], 0
mov eax, dword [ebx + 4]
xorps xmm0, xmm0
movups xmmword [ebp - 0x28], xmm0
mov dword [ebp - 0x24], 0
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x28], eax
push 0
mov byte [ebp - 4], 2
lea ecx, [ebx + 0x30]
push 0
mov byte [ebx + 0x28], 1
mov dword [ebx + 0x2c], eax
call fcn.0045e1a0
sub esp, 8
mov byte [ebp - 4], 1
mov ecx, esp
xorps xmm0, xmm0
movq qword [esi], xmm0
mov dword [ecx], 0
mov dword [ecx + 4], 0
mov eax, dword [ebx + 0xc]
test eax, eax
je 0x47024e
lock inc dword [eax + 4]
mov eax, dword [ebx + 8]
mov dword [ecx], eax
mov eax, dword [ebx + 0xc]
mov dword [ecx + 4], eax
lea eax, [ebx + 0x10]
push eax
mov ecx, esi
call fcn.0047e160
mov esi, dword [ebx + 0xc]
test esi, esi
je 0x47028c
or edi, 0xffffffff
mov eax, edi
lock xadd dword [esi + 4], eax
jne 0x47028c
mov eax, dword [esi]
mov ecx, esi
call dword [eax]
lock xadd dword [esi + 8], edi
dec edi
jne 0x47028c
mov edx, dword [esi]
mov ecx, esi
call dword [edx + 4]
lea ecx, [ebx + 0x10]
call fcn.0040d4b0
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret
Function at 0x47d7a0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 8]
sub esp, 0x1c
push esi
mov esi, dword [ebp + 0xc]
sub esi, edx
sar esi, 2
test esi, esi
je 0x47d96d
push ebx
mov ebx, dword [0x6ef870]
sub ebx, dword [0x6ef86c]
sar ebx, 2
mov dword [ebp - 0x1c], ebx
cmp esi, 0x26f
jb 0x47d7dc
mov eax, 0xb
jmp 0x47d805
cmp esi, 0x44
jb 0x47d7e8
mov eax, 7
jmp 0x47d805
cmp esi, 0x27
jb 0x47d7f4
mov eax, 5
jmp 0x47d805
cmp esi, 7
jb 0x47d800
mov eax, 3
jmp 0x47d805
lea eax, [esi - 1]
shr eax, 1
mov ecx, esi
sub ecx, eax
shr ecx, 1
add eax, ecx
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0x14], eax
cmp esi, ebx
ja 0x47d81f
lea eax, [ebx + 1]
mov dword [ebp + 0xc], eax
jmp 0x47d822
mov dword [ebp + 0xc], esi
push edi
mov eax, 0x8b8b8b8b
mov ecx, esi
mov edi, edx
rep stosd dword es:[edi], eax
mov eax, dword [ebp + 0xc]
xor edi, edi
test eax, eax
je 0x47d8d7
nop dword [eax + eax]
mov eax, dword [ebp - 0x10]
xor edx, edx
add eax, edi
mov ecx, dword [ebp + 8]
div esi
lea eax, [ecx + edx*4]
xor edx, edx
mov dword [ebp - 0x18], eax
mov eax, dword [eax]
mov dword [ebp - 8], eax
mov eax, edi
div esi
mov eax, edx
xor edx, edx
mov dword [ebp - 4], eax
lea eax, [ecx + eax*4]
mov dword [ebp - 0xc], eax
lea eax, [edi - 1]
div esi
mov eax, dword [ebp - 0xc]
mov ecx, dword [ecx + edx*4]
xor ecx, dword [ebp - 8]
xor ecx, dword [eax]
mov eax, ecx
shr eax, 0x1b
xor eax, ecx
imul edx, eax, 0x19660d
test edi, edi
jne 0x47d88f
mov eax, ebx
jmp 0x47d8a4
cmp edi, ebx
ja 0x47d8a1
mov eax, dword [0x6ef86c]
mov eax, dword [eax + edi*4 - 4]
add eax, dword [ebp - 4]
jmp 0x47d8a4
mov eax, dword [ebp - 4]
lea ecx, [eax + edx]
mov ebx, dword [ebp + 8]
mov eax, dword [ebp - 8]
add eax, edx
mov edx, dword [ebp - 0x18]
mov dword [edx], eax
xor edx, edx
mov eax, dword [ebp - 0x14]
add eax, edi
inc edi
div esi
add dword [ebx + edx*4], ecx
lea eax, [ebx + edx*4]
mov eax, dword [ebp - 0xc]
mov ebx, dword [ebp - 0x1c]
mov dword [eax], ecx
mov eax, dword [ebp + 0xc]
cmp edi, eax
jb 0x47d840
add eax, esi
mov dword [ebp - 0xc], eax
cmp edi, eax
jae 0x47d96b
mov edx, dword [ebp - 0x10]
lea ecx, [edi - 1]
mov eax, dword [ebp - 0x14]
inc edx
mov ebx, dword [ebp + 8]
inc eax
mov dword [ebp + 0xc], ecx
mov dword [ebp - 0x10], edx
mov dword [ebp - 0x18], eax
nop dword [eax + eax]
lea eax, [edx + ecx]
xor edx, edx
div esi
lea eax, [ebx + edx*4]
xor edx, edx
mov ebx, dword [eax]
mov dword [ebp - 0x1c], eax
lea eax, [ecx + 1]
mov dword [ebp - 0x14], eax
div esi
mov eax, ecx
mov edi, edx
xor edx, edx
div esi
mov eax, dword [ebp + 8]
mov ecx, dword [eax + edx*4]
xor edx, edx
add ecx, dword [eax + edi*4]
add ecx, ebx
mov eax, ecx
shr eax, 0x1b
xor eax, ecx
imul eax, eax, 0x5d588b65
xor ebx, eax
mov ecx, eax
mov eax, dword [ebp - 0x1c]
sub ecx, edi
mov dword [eax], ebx
mov eax, dword [ebp + 0xc]
add eax, dword [ebp - 0x18]
div esi
mov ebx, dword [ebp + 8]
xor dword [ebx + edx*4], ecx
lea eax, [ebx + edx*4]
mov edx, dword [ebp - 0x10]
mov dword [ebx + edi*4], ecx
mov ecx, dword [ebp - 0x14]
mov dword [ebp + 0xc], ecx
lea eax, [ecx + 1]
cmp eax, dword [ebp - 0xc]
jb 0x47d900
pop edi
pop ebx
pop esi
mov esp, ebp
pop ebp
ret 8