joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4281f0
Capabilities:
Terminate thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x53de15
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x58313c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
lea eax, [esi + 0x20]
push eax
mov dword [ebp - 0x10], eax
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov eax, dword [esi + 0xc]
lea edi, [esi + 0xc]
mov dword [ebp - 4], 0
nop
test eax, eax
je 0x428307
mov ecx, esi
call fcn.00427960
lea ebx, [esi + 0x9c]
push ebx
call fcn.00511c14
add esp, 4
test eax, eax
jne 0x428329
mov cl, 1
lea eax, [esi + 0xf4]
xchg byte [eax], cl
lea eax, [esi + 0xcc]
push eax
call fcn.00511d60
push ebx
call fcn.00511c39
mov eax, dword [ebp + 8]
add esp, 8
test eax, eax
je 0x428287
push eax
mov ecx, esi
call fcn.0042a020
mov eax, dword [edi]
nop
test eax, eax
je 0x428307
lea eax, [ebp + 8]
push str.___killing_thread_by_force___
push eax
call fcn.0040a5d0
add esp, 8
mov ecx, dword [0x589740]
mov byte [ebp - 4], 1
test ecx, ecx
je 0x4282b8
mov eax, dword [ecx]
lea edx, [ebp + 8]
push edx
call dword [eax + 4]
jmp 0x4282c1
lea eax, [ebp + 8]
push eax
call fcn.004211a0
mov ecx, dword [ebp + 8]
add ecx, 0xfffffff8
cmp ecx, 0x583008
je 0x4282e5
or eax, 0xffffffff
lock xadd dword [ecx], eax
dec eax
cmp eax, 0xffffffff
jne 0x4282e5
push ecx
call fcn.005128b5
add esp, 4
mov eax, dword [edi]
nop
test eax, eax
je 0x4282f8
mov eax, dword [edi]
nop
push 0
push eax
call dword [sym.imp.KERNEL32.dll_TerminateThread]
xor eax, eax
xchg dword [edi], eax
xor ecx, ecx
lea eax, [esi + 0x10]
xchg dword [eax], ecx
xor bl, bl
jmp 0x428309
mov bl, 1
lea eax, [esi + 0x20]
push eax
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
push eax
call fcn.00511f0f
int3
Function at 0x42a7a0
Capabilities:
Write file on windows

Disassembly:
push ecx
push esi
mov esi, ecx
mov dword [esp + 4], 0
mov eax, dword [esi + 0xc]
test eax, eax
je 0x42a814
push 0
lea ecx, [esp + 8]
push ecx
push dword [esp + 0x18]
push dword [esp + 0x18]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x42a80b
lea eax, [esp + 0x10]
push eax
call fcn.0041ca50
mov edx, eax
add esp, 4
mov eax, dword [esi + 0x10]
mov ecx, dword [edx]
mov dword [esi + 0x10], ecx
mov dword [edx], eax
mov ecx, dword [esp + 0x10]
add ecx, 0xfffffff8
cmp ecx, 0x583008
je 0x42a80b
or eax, 0xffffffff
lock xadd dword [ecx], eax
dec eax
cmp eax, 0xffffffff
jne 0x42a80b
push ecx
call fcn.005128b5
add esp, 4
mov eax, dword [esp + 4]
pop esi
pop ecx
ret 8
xor eax, eax
pop esi
pop ecx
ret 8

Function at 0x42afd0
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [esp + 8]
test eax, eax
jne 0x42afd9
ret
mov dword [esp + 8], eax
jmp fcn.004147b0
Function at 0x42bde0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov ecx, dword [esp + 4]
push esi
test ecx, ecx
je 0x42bf67
mov esi, dword [ecx + 0x1c]
test esi, esi
je 0x42bf67
cmp dword [ecx + 0x20], 0
je 0x42bf67
cmp dword [ecx + 0x24], 0
je 0x42bf67
mov dword [ecx + 0x14], 0
mov dword [ecx + 8], 0
mov dword [ecx + 0x18], 0
mov dword [ecx + 0x2c], 2
mov edx, dword [esi + 0x18]
mov eax, dword [esi + 8]
mov dword [esi + 0x14], 0
mov dword [esi + 0x10], eax
test edx, edx
jns 0x42be41
neg edx
mov dword [esi + 0x18], edx
test edx, edx
mov eax, 0x71
push edi
mov edi, 0x2a
cmovne eax, edi
mov dword [esi + 4], eax
xor eax, eax
cmp edx, 2
push esi
setne al
mov dword [ecx + 0x30], eax
lea eax, [esi + 0x94]
mov dword [esi + 0xb18], eax
lea eax, [esi + 0x988]
mov dword [esi + 0xb24], eax
lea eax, [esi + 0xa7c]
mov dword [esi + 0xb30], eax
xor eax, eax
mov dword [esi + 0x28], 0
mov dword [esi + 0xb20], 0x583018
mov dword [esi + 0xb2c], 0x58302c
mov dword [esi + 0xb38], 0x583040
mov word [esi + 0x16b8], ax
mov dword [esi + 0x16bc], eax
mov dword [esi + 0x16b4], 8
call fcn.0041ecc0
mov eax, dword [esi + 0x2c]
xor edx, edx
mov ecx, dword [esi + 0x4c]
add eax, eax
mov dword [esi + 0x3c], eax
mov eax, dword [esi + 0x44]
mov word [eax + ecx*2 - 2], dx
mov eax, dword [esi + 0x4c]
lea eax, [eax*2 - 2]
push eax
push edx
push dword [esi + 0x44]
call fcn.005153c0
mov eax, dword [esi + 0x84]
add esp, 0x10
lea ecx, [eax + eax*2]
movzx eax, word [ecx*4 + 0x54fdf2]
mov dword [esi + 0x80], eax
movzx eax, word [ecx*4 + 0x54fdf0]
mov dword [esi + 0x8c], eax
movzx eax, word [ecx*4 + 0x54fdf4]
mov dword [esi + 0x90], eax
movzx eax, word [ecx*4 + 0x54fdf6]
mov dword [esi + 0x7c], eax
xor eax, eax
pop edi
mov dword [esi + 0x6c], 0
mov dword [esi + 0x5c], 0
mov dword [esi + 0x74], 0
mov dword [esi + 0x78], 2
mov dword [esi + 0x60], 2
mov dword [esi + 0x68], 0
mov dword [esi + 0x48], 0
pop esi
ret
mov eax, 0xfffffffe
pop esi
ret
Function at 0x42fdf0
Capabilities:
Hash data using fnv

Disassembly:
mov edx, dword [esp + 4]
movzx eax, byte [edx]
xor eax, 0x811c9dc5
imul ecx, eax, 0x1000193
movzx eax, byte [edx + 1]
xor ecx, eax
movzx eax, byte [edx + 2]
imul ecx, ecx, 0x1000193
xor ecx, eax
movzx eax, byte [edx + 3]
imul ecx, ecx, 0x1000193
xor ecx, eax
movzx eax, byte [edx + 4]
imul ecx, ecx, 0x1000193
xor ecx, eax
movzx eax, byte [edx + 5]
imul ecx, ecx, 0x1000193
xor ecx, eax
movzx eax, byte [edx + 6]
imul ecx, ecx, 0x1000193
xor ecx, eax
movzx eax, byte [edx + 7]
imul ecx, ecx, 0x1000193
xor ecx, eax
imul eax, ecx, 0x1000193
ret 4
Function at 0x43a270
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x2c
mov eax, dword [ecx + 8]
mov ecx, dword [ecx + 0x10]
shl ecx, 4
add ecx, eax
mov dword [esp + 0x10], eax
mov dword [esp + 0x28], ecx
cmp eax, ecx
je 0x43a47c
push ebx
push ebp
push esi
push edi
mov ecx, dword [eax + 8]
mov edx, dword [eax + 4]
mov ebp, dword [eax]
mov dword [esp + 0x24], ecx
mov ecx, dword [eax + 0xc]
add ecx, edx
mov dword [esp + 0x34], ebp
mov dword [esp + 0x1c], edx
mov dword [esp + 0x30], ecx
cmp edx, ecx
jge 0x43a467
mov edi, dword [esp + 0x40]
nop dword [eax + eax]
mov edi, dword [edi]
mov eax, edx
mov ebx, dword [esp + 0x40]
mov esi, dword [edi + 0xc]
mov ecx, dword [ebx + 4]
sub eax, dword [ebx + 0x10]
imul esi, edx
cdq
add esi, dword [edi]
mov dword [ebx + 0x14], esi
idiv dword [ecx + 0x18]
imul edx, dword [ecx + 0xc]
add edx, dword [ecx]
mov dword [ebx + 0x18], edx
mov eax, dword [edi + 0x10]
mov ecx, eax
mov edi, dword [esp + 0x40]
mov ebx, dword [esp + 0x24]
imul ecx, ebp
mov dword [esp + 0x14], ebx
sub ebp, dword [edi + 0xc]
mov dword [esp + 0x18], eax
add ecx, esi
cmp dword [edi + 8], 0xfe
jge 0x43a408
mov esi, dword [edi + 4]
mov eax, ebp
cdq
inc ebp
mov ebx, dword [edi + 8]
mov dword [esp + 0x2c], ebp
idiv dword [esi + 0x14]
mov esi, dword [esi + 0x10]
imul esi, edx
mov edx, 0x100
add esi, dword [edi + 0x18]
mov edi, dword [ecx]
movzx eax, byte [esi + 1]
movzx ebp, byte [esi + 2]
or eax, 0xff0000
imul eax, ebx
shl ebp, 0x10
shr eax, 8
and eax, 0xff00ff
mov dword [esp + 0x28], eax
shr eax, 0x10
sub edx, eax
movzx eax, byte [esi]
or ebp, eax
mov esi, 0x100
mov eax, edi
imul ebp, ebx
mov ebx, dword [esp + 0x28]
and eax, 0xff00ff
imul eax, edx
shr edi, 8
and edi, 0xff00ff
imul edi, edx
shr ebp, 8
shr eax, 8
and ebp, 0xff00ff
and eax, 0xff00ff
add ebp, eax
shr edi, 8
mov edx, ebp
and edi, 0xff00ff
shr edx, 8
add ebx, edi
and edx, 0xff00ff
mov eax, ebx
mov edi, dword [esp + 0x40]
shr eax, 8
and eax, 0xff00ff
sub esi, eax
mov eax, ebx
shl eax, 8
shl esi, 8
or esi, eax
mov eax, 0x100
sub eax, edx
mov edx, 0x100
or eax, ebp
mov ebp, dword [esp + 0x2c]
xor esi, eax
mov eax, ebx
shr eax, 8
and esi, 0xff00ff
and eax, 0xff00ff
shl ebx, 8
sub edx, eax
mov eax, dword [esp + 0x14]
shl edx, 8
dec eax
or edx, ebx
mov dword [esp + 0x14], eax
xor esi, edx
mov dword [ecx], esi
add ecx, dword [esp + 0x18]
test eax, eax
jg 0x43a310
jmp 0x43a44c
mov esi, dword [edi + 4]
mov eax, ebp
cdq
dec ebx
inc ebp
idiv dword [esi + 0x14]
mov esi, dword [esi + 0x10]
imul esi, edx
add esi, dword [edi + 0x18]
mov ax, word [esi]
movzx edx, byte [esi + 2]
or edx, 0xffffff00
mov word [esp + 0x10], ax
movzx eax, byte [esp + 0x11]
shl edx, 8
or edx, eax
movzx eax, byte [esp + 0x10]
shl edx, 8
or edx, eax
mov dword [ecx], edx
add ecx, dword [esp + 0x18]
test ebx, ebx
jg 0x43a408
mov edx, dword [esp + 0x1c]
mov ebp, dword [esp + 0x34]
inc edx
mov dword [esp + 0x1c], edx
cmp edx, dword [esp + 0x30]
jl 0x43a2c0
mov eax, dword [esp + 0x20]
add eax, 0x10
mov dword [esp + 0x20], eax
cmp eax, dword [esp + 0x38]
jne 0x43a292
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x2c
ret 4
Function at 0x43c520
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
sub esp, 0x2c
mov eax, dword [ecx + 8]
mov ecx, dword [ecx + 0x10]
shl ecx, 4
add ecx, eax
mov dword [esp + 0x10], eax
mov dword [esp + 0x28], ecx
cmp eax, ecx
je 0x43c6f9
push ebx
push ebp
push esi
push edi
mov ecx, dword [eax]
mov edx, dword [eax + 4]
mov ebp, dword [eax + 8]
mov dword [esp + 0x24], ecx
mov ecx, dword [eax + 0xc]
add ecx, edx
mov dword [esp + 0x34], ebp
mov dword [esp + 0x1c], edx
mov dword [esp + 0x30], ecx
cmp edx, ecx
jge 0x43c6e4
mov edi, dword [esp + 0x40]
nop dword [eax + eax]
mov edi, dword [edi]
mov eax, edx
mov ebx, dword [esp + 0x40]
mov dword [esp + 0x14], ebp
mov esi, dword [edi + 0xc]
mov ecx, dword [ebx + 4]
sub eax, dword [ebx + 0x10]
imul esi, edx
cdq
add esi, dword [edi]
mov dword [ebx + 0x14], esi
idiv dword [ecx + 0x18]
imul edx, dword [ecx + 0xc]
add edx, dword [ecx]
mov dword [ebx + 0x18], edx
mov eax, dword [edi + 0x10]
mov ecx, eax
imul ecx, dword [esp + 0x24]
mov edi, dword [esp + 0x40]
mov ebx, dword [esp + 0x24]
mov dword [esp + 0x18], eax
sub ebx, dword [edi + 0xc]
add ecx, esi
cmp dword [edi + 8], 0xfe
jge 0x43c692
mov esi, dword [edi + 4]
mov eax, ebx
cdq
inc ebx
mov ebp, dword [edi + 8]
mov dword [esp + 0x2c], ebx
idiv dword [esi + 0x14]
mov ebx, dword [esi + 0x10]
mov esi, 0x100
imul ebx, edx
add ebx, dword [edi + 0x18]
movzx edx, byte [ebx + 1]
or edx, 0xff0000
movzx edi, byte [ebx + 2]
imul edx, ebp
shl edi, 0x10
shr edx, 8
and edx, 0xff00ff
mov eax, edx
shr eax, 0x10
sub esi, eax
movzx eax, byte [ecx + 1]
imul eax, esi
shr eax, 8
add eax, edx
movzx edx, byte [ecx + 2]
mov dword [esp + 0x28], eax
movzx eax, byte [ebx]
or edi, eax
mov ebx, dword [esp + 0x28]
movzx eax, byte [ecx]
shl edx, 0x10
or edx, eax
imul edi, ebp
imul edx, esi
shr edi, 8
shr edx, 8
and edi, 0xff00ff
and edx, 0xff00ff
add edi, edx
mov edx, 0x100
mov eax, edi
shr eax, 8
and eax, 0xff00ff
sub edx, eax
mov eax, ebx
shr eax, 8
or edx, edi
mov edi, dword [esp + 0x40]
neg al
or al, bl
and edx, 0xff00ff
mov ebx, dword [esp + 0x2c]
mov byte [ecx + 1], al
mov eax, edx
shr eax, 0x10
mov byte [ecx + 2], al
mov eax, dword [esp + 0x14]
dec eax
mov byte [ecx], dl
add ecx, dword [esp + 0x18]
mov dword [esp + 0x14], eax
test eax, eax
jg 0x43c5c2
jmp 0x43c6c9
mov esi, dword [edi + 4]
mov eax, ebx
cdq
dec ebp
inc ebx
idiv dword [esi + 0x14]
mov esi, dword [esi + 0x10]
imul esi, edx
add esi, dword [edi + 0x18]
mov ax, word [esi]
mov dl, byte [esi + 2]
mov word [esp + 0x10], ax
movzx eax, al
mov byte [ecx], al
movzx eax, byte [esp + 0x11]
mov byte [ecx + 1], al
mov byte [ecx + 2], dl
add ecx, dword [esp + 0x18]
test ebp, ebp
jg 0x43c692
mov edx, dword [esp + 0x1c]
mov ebp, dword [esp + 0x34]
inc edx
mov dword [esp + 0x1c], edx
cmp edx, dword [esp + 0x30]
jl 0x43c570
mov eax, dword [esp + 0x20]
add eax, 0x10
mov dword [esp + 0x20], eax
cmp eax, dword [esp + 0x38]
jne 0x43c542
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x2c
ret 4
Function at 0x450640
Capabilities:
Hash data using fnv

Disassembly:
sub esp, 8
mov edx, dword [esp + 0xc]
mov eax, 0x1fffffff
push ebx
mov ebx, ecx
bsr ecx, eax
push edi
mov edi, 1
mov dword [esp + 8], ebx
mov eax, edi
shl eax, cl
cmp edx, eax
ja 0x450799
lea eax, [edx - 1]
or eax, edi
bsr ecx, eax
push ebp
push esi
mov esi, dword [ebx + 4]
lea ebp, [ebx + 0xc]
push esi
lea ecx, [ecx + 1]
shl edi, cl
mov ecx, ebp
lea eax, [edi + edi]
push eax
call fcn.004502a0
lea eax, [edi - 1]
mov dword [ebx + 0x1c], edi
mov dword [ebx + 0x18], eax
mov ecx, dword [ebx + 4]
mov ecx, dword [ecx]
mov edx, ecx
cmp ecx, esi
je 0x450773
movzx eax, byte [ecx + 8]
xor eax, 0x811c9dc5
mov edx, dword [edx]
imul edi, eax, 0x1000193
movzx eax, byte [ecx + 9]
xor edi, eax
movzx eax, byte [ecx + 0xa]
imul edi, edi, 0x1000193
xor edi, eax
movzx eax, byte [ecx + 0xb]
imul edi, edi, 0x1000193
xor edi, eax
imul eax, edi, 0x1000193
mov edi, dword [ebx + 0x18]
and edi, eax
mov eax, dword [ebp]
lea ebp, [eax + edi*8]
mov dword [esp + 0x1c], ebp
cmp dword [ebp], esi
jne 0x4506f2
mov dword [ebp], ecx
mov dword [ebp + 4], ecx
jmp 0x450766
mov eax, dword [ebp + 4]
mov ebx, dword [ecx + 8]
cmp ebx, dword [eax + 8]
jne 0x45072c
mov eax, dword [eax]
mov dword [esp + 0x14], eax
cmp eax, ecx
je 0x450727
mov ebx, dword [ecx + 4]
mov ebp, dword [esp + 0x14]
mov dword [ebx], edx
mov edi, dword [edx + 4]
mov dword [edi], eax
mov eax, dword [eax + 4]
mov dword [eax], ecx
mov dword [ebp + 4], edi
mov ebp, dword [esp + 0x1c]
mov dword [edx + 4], ebx
mov dword [ecx + 4], eax
mov dword [ebp + 4], ecx
jmp 0x450762
mov ebp, dword [ebp]
mov edi, eax
cmp ebp, eax
je 0x450743
mov eax, dword [eax + 4]
mov edi, eax
cmp ebx, dword [eax + 8]
je 0x45077d
cmp ebp, eax
jne 0x450735
mov ebp, dword [ecx + 4]
mov dword [ebp], edx
mov ebx, dword [edx + 4]
mov dword [ebx], edi
mov eax, dword [edi + 4]
mov dword [eax], ecx
mov dword [edi + 4], ebx
mov dword [edx + 4], ebp
mov dword [ecx + 4], eax
mov eax, dword [esp + 0x1c]
mov dword [eax], ecx
mov ebx, dword [esp + 0x10]
lea ebp, [ebx + 0xc]
mov ecx, edx
cmp edx, esi
jne 0x4506a1
pop esi
pop ebp
pop edi
pop ebx
add esp, 8
ret 4
mov ebx, dword [ecx + 4]
mov ebp, dword [eax]
mov dword [ebx], edx
mov edi, dword [edx + 4]
mov dword [edi], ebp
mov eax, dword [ebp + 4]
mov dword [eax], ecx
mov dword [ebp + 4], edi
mov dword [edx + 4], ebx
mov dword [ecx + 4], eax
jmp 0x450762
push str.invalid_hash_bucket_count
call fcn.005104f6
int3
Function at 0x457050
Capabilities:
Encode data using xor

Disassembly:
push ecx
mov eax, dword [ecx]
push ebx
mov ebx, dword [esp + 0xc]
push ebp
mov eax, dword [eax + 0x10]
mov ebp, dword [esp + 0x18]
push esi
push edi
mov dword [esp + 0x10], eax
nop word [eax + eax]
mov eax, dword [esp + 0x1c]
mov edx, 0x100
mov edi, eax
dec ebp
shr edi, 8
and eax, 0xff00ff
and edi, 0xff00ff
mov ecx, edi
shr ecx, 0x10
sub edx, ecx
mov ecx, dword [ebx]
mov esi, ecx
shr ecx, 8
and ecx, 0xff00ff
and esi, 0xff00ff
imul ecx, edx
imul esi, edx
mov edx, 0x100
shr ecx, 8
and ecx, 0xff00ff
shr esi, 8
add edi, ecx
and esi, 0xff00ff
add esi, eax
mov eax, edi
shr eax, 8
mov ecx, esi
and eax, 0xff00ff
shr ecx, 8
sub edx, eax
and ecx, 0xff00ff
shl edx, 8
mov eax, edi
shl eax, 8
or edx, eax
mov eax, 0x100
sub eax, ecx
mov ecx, 0x100
or eax, esi
xor edx, eax
mov eax, edi
shr eax, 8
and edx, 0xff00ff
and eax, 0xff00ff
shl edi, 8
sub ecx, eax
shl ecx, 8
or ecx, edi
xor edx, ecx
mov dword [ebx], edx
add ebx, dword [esp + 0x10]
test ebp, ebp
jg 0x457070
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret 0xc
Function at 0x45d300
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x28
push ebx
push esi
mov esi, ecx
push edi
mov dword [esp + 0x30], esi
mov eax, dword [esi + 0x14]
mov ebx, dword [eax + 8]
mov eax, ebx
shr eax, 0x18
mov dword [esp + 0xc], ebx
cmp al, 0xff
jae 0x45d36a
test al, al
jne 0x45d330
mov word [esp + 0xc], 0
mov byte [esp + 0xe], al
jmp 0x45d366
mov ecx, eax
movzx eax, bl
imul eax, ecx
add eax, 0x7f
shr eax, 8
mov byte [esp + 0xc], al
movzx eax, byte [esp + 0xd]
imul eax, ecx
add eax, 0x7f
shr eax, 8
mov byte [esp + 0xd], al
movzx eax, byte [esp + 0xe]
imul eax, ecx
add eax, 0x7f
shr eax, 8
mov byte [esp + 0xe], al
mov ebx, dword [esp + 0xc]
push ebp
mov ebp, 1
xor edx, edx
mov dword [esp + 0x14], edx
mov dword [esp + 0x1c], ebp
cmp dword [esi + 0x1c], ebp
jle 0x45d4e0
mov eax, dword [esp + 0x40]
movsd xmm2, qword [0x552168]
dec eax
movd xmm1, eax
mov eax, 0x10
cvtdq2pd xmm1, xmm1
mov dword [esp + 0x20], eax
mov ecx, dword [esi + 0x14]
movaps xmm0, xmm1
mulsd xmm0, qword [ecx + eax]
mov ecx, dword [ecx + eax + 8]
mov eax, ecx
shr eax, 0x18
mov dword [esp + 0x18], ecx
mov dword [esp + 0x10], ecx
addsd xmm0, xmm2
movsd qword [esp + 0x2c], xmm0
mov esi, dword [esp + 0x2c]
sub esi, edx
mov dword [esp + 0x28], esi
cmp al, 0xff
jae 0x45d428
test al, al
jne 0x45d3e6
mov word [esp + 0x10], 0
mov byte [esp + 0x12], al
jmp 0x45d420
mov edx, eax
movzx eax, cl
imul eax, edx
add eax, 0x7f
shr eax, 8
mov byte [esp + 0x10], al
movzx eax, byte [esp + 0x11]
imul eax, edx
add eax, 0x7f
shr eax, 8
mov byte [esp + 0x11], al
movzx eax, byte [esp + 0x12]
imul eax, edx
mov edx, dword [esp + 0x14]
add eax, 0x7f
shr eax, 8
mov byte [esp + 0x12], al
mov ecx, dword [esp + 0x10]
mov dword [esp + 0x18], ecx
mov dword [esp + 0x10], 0
test esi, esi
jle 0x45d4c1
mov eax, ebx
mov ebp, ecx
shr ebx, 8
mov edi, ecx
mov ecx, dword [esp + 0x10]
and ebx, 0xff00ff
shr ebp, 8
and eax, 0xff00ff
and ebp, 0xff00ff
mov dword [esp + 0x24], eax
sub ebp, ebx
and edi, 0xff00ff
shl ebx, 8
sub edi, eax
mov dword [esp + 0x2c], edi
nop
mov eax, ecx
inc ecx
shl eax, 8
cdq
idiv esi
mov edx, ebp
mov esi, eax
mov eax, ebp
imul edi, esi
imul edx, esi
imul eax, esi
mov esi, dword [esp + 0x28]
shr edi, 8
add edi, dword [esp + 0x24]
add edx, ebx
xor edi, edx
add eax, ebx
mov edx, dword [esp + 0x14]
and edi, 0xff00ff
xor edi, eax
mov eax, dword [esp + 0x3c]
mov dword [eax + edx*4], edi
inc edx
mov edi, dword [esp + 0x2c]
mov dword [esp + 0x14], edx
cmp ecx, esi
jl 0x45d470
mov ecx, dword [esp + 0x18]
mov ebp, dword [esp + 0x1c]
mov esi, dword [esp + 0x34]
inc ebp
mov eax, dword [esp + 0x20]
mov ebx, ecx
add eax, 0x10
mov dword [esp + 0x1c], ebp
mov dword [esp + 0x20], eax
cmp ebp, dword [esi + 0x1c]
jl 0x45d3a1
mov ecx, dword [esp + 0x40]
pop ebp
cmp edx, ecx
jge 0x45d4f6
mov eax, dword [esp + 0x38]
sub ecx, edx
lea edi, [eax + edx*4]
mov eax, ebx
rep stosd dword es:[edi], eax
pop edi
pop esi
pop ebx
add esp, 0x28
ret 8
Function at 0x45eb00
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
sub esp, 0x14
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0x28]
mov edx, 0x100
mov ebp, dword [edi + 0x4c]
cmp ebp, 1
mov esi, dword [edi + 0x1a8]
sete al
mov dword [esp + 0x20], esi
mov dword [esp + 0x18], ebp
mov byte [esi + 0x1c], al
mov eax, dword [edi + 4]
push dword [edi + 0x64]
mov ecx, dword [eax + 8]
mov eax, 0x2fe
cmovne eax, edx
push eax
push 1
push edi
call ecx
xor ebx, ebx
mov dword [esi + 0x18], eax
mov eax, dword [esi + 0x14]
add esp, 0x10
mov dword [esp + 0x10], ebx
cmp dword [edi + 0x64], ebx
jle 0x45ec33
nop dword [eax]
mov ecx, dword [esi + ebx*4 + 0x20]
cdq
idiv ecx
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x14], eax
cmp ebp, 1
jne 0x45eb7e
mov eax, dword [esi + 0x18]
add dword [eax + ebx*4], 0xff
mov eax, dword [esi + 0x18]
lea edi, [ecx*2 - 2]
mov ebp, dword [eax + ebx*4]
lea eax, [ecx + 0xfe]
cdq
xor ebx, ebx
idiv edi
xor esi, esi
mov edx, eax
nop word [eax + eax]
cmp esi, edx
jle 0x45ebc4
imul eax, ebx, 0x1fe
add ecx, 0xfe
add ecx, eax
add ecx, 0x1fe
inc ebx
mov eax, ecx
cdq
idiv edi
mov edx, eax
cmp esi, edx
jg 0x45ebb2
mov ecx, dword [esp + 0x14]
movzx ecx, cl
movzx eax, bl
imul ecx, eax
mov byte [esi + ebp], cl
inc esi
mov ecx, dword [esp + 0x1c]
cmp esi, 0xff
jle 0x45eba0
cmp dword [esp + 0x18], 1
jne 0x45ec11
mov ecx, 1
lea edx, [ebp - 1]
movzx eax, byte [ebp]
lea edx, [edx - 1]
mov byte [edx + 1], al
movzx eax, byte [ebp + 0xff]
mov byte [ecx + ebp + 0xff], al
inc ecx
cmp ecx, 0xff
jle 0x45ebf0
mov eax, dword [esp + 0x28]
mov ebx, dword [esp + 0x10]
mov ebp, dword [esp + 0x18]
inc ebx
mov esi, dword [esp + 0x20]
cmp ebx, dword [eax + 0x64]
mov eax, dword [esp + 0x14]
mov dword [esp + 0x10], ebx
jl 0x45eb60
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x14
ret
Function at 0x46d020
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x53fad5
mov eax, dword fs:[0]
push eax
sub esp, 0x18
push ebx
push esi
push edi
mov eax, dword [0x58313c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, dword [ebp + 0x10]
movzx eax, bl
xor eax, 0x811c9dc5
mov esi, dword [ebp + 0xc]
imul ecx, eax, 0x1000193
mov eax, ebx
shr eax, 8
movzx eax, al
mov dword [ebp - 0x10], ebx
xor ecx, eax
mov eax, ebx
imul ecx, ecx, 0x1000193
shr eax, 0x10
movzx eax, al
xor ecx, eax
mov eax, ebx
imul ecx, ecx, 0x1000193
shr eax, 0x18
xor ecx, eax
lea eax, [ebp - 0x10]
imul edi, ecx, 0x1000193
mov ecx, esi
push edi
push eax
lea eax, [ebp - 0x24]
push eax
call fcn.0042ff40
mov eax, dword [eax + 4]
test eax, eax
je 0x46d0bd
cmp eax, dword [esi + 4]
je 0x46d0bd
mov eax, dword [eax + 0xc]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
xor eax, eax
mov word [ebp + 0xc], bx
push 1
mov word [ebp + 0xe], ax
mov dword [ebp + 0x10], eax
lea eax, [ebp + 0x10]
push eax
push 1
lea eax, [ebp + 0xc]
push eax
push dword [ebp + 8]
call dword [sym.imp.GDI32.dll_GetGlyphIndicesW]
cmp eax, 0xffffffff
je 0x46d1e5
mov eax, dword [ebp + 0x10]
mov ecx, 0xffff
cmp ax, cx
je 0x46d1e5
movzx eax, ax
mov ecx, esi
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x10]
push edi
push eax
lea eax, [ebp - 0x1c]
mov dword [ebp - 0x10], ebx
push eax
call fcn.0042ff40
mov eax, dword [ebp - 0x18]
test eax, eax
jne 0x46d1c9
cmp dword [esi + 8], 0xfffffff
je 0x46d1fa
lea eax, [esi + 4]
mov dword [ebp - 0x24], eax
push 0x10
mov dword [ebp - 4], 0
mov dword [ebp - 0x20], 0
call fcn.00512877
mov ecx, dword [ebp - 0x10]
mov ebx, eax
add esp, 4
mov dword [ebp - 0x20], ebx
mov dword [ebx + 8], ecx
mov dword [ebx + 0xc], 0
mov ecx, dword [esi + 8]
mov eax, dword [esi + 0x1c]
inc ecx
mov dword [ebp - 4], 1
movd xmm0, ecx
cvtdq2pd xmm0, xmm0
shr ecx, 0x1f
addsd xmm0, qword [ecx*8 + 0x5521b0]
cvtpd2ps xmm1, xmm0
movd xmm0, eax
cvtdq2pd xmm0, xmm0
shr eax, 0x1f
addsd xmm0, qword [eax*8 + 0x5521b0]
cvtpd2ps xmm0, xmm0
divss xmm1, xmm0
comiss xmm1, dword [esi]
jbe 0x46d1bc
mov ecx, esi
call fcn.004509e0
push edi
lea eax, [ebx + 8]
mov ecx, esi
push eax
lea eax, [ebp - 0x24]
push eax
call fcn.0042ff40
mov ecx, dword [eax]
jmp 0x46d1bf
mov ecx, dword [ebp - 0x1c]
push ebx
push ecx
push edi
mov ecx, esi
call fcn.00450910
mov ecx, dword [ebp - 0x14]
mov dword [eax + 0xc], ecx
movzx eax, word [ebp + 0x10]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
or eax, 0xffffffff
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push str.unordered_map_set_too_long
call fcn.005104f6
int3