joyce8/EMBER2024-capa huggingface dataset:
Function at 0x46b170
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x83ba35
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push esi
push edi
mov eax, dword [0xa5d1d4]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, ecx
mov dword [ebp - 0x10], eax
add eax, 4
mov dword [ebp - 0x20], eax
push 0x38
mov dword [ebp - 4], 0
mov dword [ebp - 0x1c], 0
call fcn.007fff35
mov ecx, dword [ebp + 0xc]
add esp, 4
mov dword [ebp - 0x1c], eax
lea edi, [eax + 8]
mov edx, dword [ecx]
mov ecx, edx
mov dword [ebp - 0x14], edi
mov dword [edi], 0
mov dword [edi + 0x10], 0
mov dword [edi + 0x14], 7
lea esi, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x46b1e1
sub ecx, esi
sar ecx, 1
push ecx
push edx
mov ecx, edi
call fcn.00437690
mov eax, dword [ebp + 0x10]
xor ecx, ecx
mov dword [edi + 0x18], 0
mov dword [edi + 0x28], 0
mov dword [edi + 0x2c], 0
movups xmm0, xmmword [eax]
movups xmmword [edi + 0x18], xmm0
movq xmm0, qword [eax + 0x10]
movq qword [edi + 0x28], xmm0
mov dword [eax + 0x10], 0
mov dword [eax + 0x14], 7
mov word [eax], cx
cmp dword [edi + 0x14], 8
mov edx, dword [edi + 0x10]
mov dword [ebp - 4], 1
mov dword [ebp + 0xc], edi
jb 0x46b24d
mov eax, dword [edi]
mov dword [ebp + 0xc], eax
xor ecx, ecx
mov esi, 0x811c9dc5
add edx, edx
je 0x46b274
mov edi, dword [ebp + 0xc]
nop dword [eax + eax]
movzx eax, byte [ecx + edi]
inc ecx
xor eax, esi
imul esi, eax, 0x1000193
cmp ecx, edx
jb 0x46b260
mov edi, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x10]
lea eax, [ebp - 0x18]
push esi
push edi
push eax
call fcn.00449ca0
mov eax, dword [ebp - 0x14]
test eax, eax
je 0x46b2c3
cmp dword [ebp - 0x1c], 0
mov esi, dword [ebp + 8]
mov dword [esi], eax
mov byte [esi + 4], 0
je 0x46b2ae
push edi
push dword [ebp - 0x20]
call fcn.0044a180
push 0x38
push dword [ebp - 0x1c]
call fcn.007fff65
add esp, 0x10
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 0xc
mov ecx, dword [ebp - 0x10]
mov eax, dword [ecx + 8]
cmp eax, 0x4924924
je 0x46b356
inc eax
movd xmm0, eax
cvtdq2pd xmm0, xmm0
shr eax, 0x1f
addsd xmm0, qword [eax*8 + 0x88b6b0]
mov eax, dword [ecx + 0x1c]
cvtpd2ps xmm1, xmm0
movd xmm0, eax
cvtdq2pd xmm0, xmm0
shr eax, 0x1f
addsd xmm0, qword [eax*8 + 0x88b6b0]
cvtpd2ps xmm0, xmm0
divss xmm1, xmm0
comiss xmm1, dword [ecx]
jbe 0x46b32b
call fcn.00453df0
mov ecx, dword [ebp - 0x10]
lea eax, [ebp - 0x18]
push esi
push edi
push eax
call fcn.00449ca0
mov ecx, dword [ebp - 0x10]
mov edx, dword [eax]
jmp 0x46b32e
mov edx, dword [ebp - 0x18]
push dword [ebp - 0x1c]
push edx
push esi
call fcn.00453d50
mov ecx, dword [ebp + 8]
mov dword [ecx], eax
mov eax, ecx
mov byte [ecx + 4], 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 0xc
push str.unordered_map_set_too_long
call fcn.007fc74d
int3
Function at 0x46bf60
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x83bc96
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0xa5d1d4]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], ecx
mov edi, dword [ebp + 8]
xor eax, eax
mov dword [ecx], 0
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 0
movups xmm0, xmmword [edi]
movups xmmword [ecx], xmm0
movq xmm0, qword [edi + 0x10]
movq qword [ecx + 0x10], xmm0
mov dword [edi + 0x10], 0
mov dword [edi + 0x14], 7
mov word [edi], ax
lea esi, [ecx + 0x18]
mov dword [ebp - 4], eax
mov dword [esi], eax
mov dword [esi + 0x10], eax
mov dword [esi + 0x14], eax
movups xmm0, xmmword [edi + 0x18]
mov dword [ebp + 8], esi
movups xmmword [esi], xmm0
movq xmm0, qword [edi + 0x28]
movq qword [esi + 0x10], xmm0
mov dword [edi + 0x28], eax
mov dword [edi + 0x2c], 7
mov word [edi + 0x18], ax
mov dword [esi + 0x18], eax
mov dword [esi + 0x28], eax
mov dword [esi + 0x2c], eax
movups xmm0, xmmword [edi + 0x30]
movups xmmword [esi + 0x18], xmm0
movq xmm0, qword [edi + 0x40]
movq qword [esi + 0x28], xmm0
mov dword [edi + 0x40], eax
mov dword [edi + 0x44], 7
mov word [edi + 0x30], ax
mov dword [esi + 0x30], eax
mov dword [esi + 0x40], eax
mov dword [esi + 0x44], eax
movups xmm0, xmmword [edi + 0x48]
movups xmmword [esi + 0x30], xmm0
movq xmm0, qword [edi + 0x58]
movq qword [esi + 0x40], xmm0
mov dword [edi + 0x58], eax
mov dword [edi + 0x5c], 7
mov word [edi + 0x48], ax
mov ax, word [edi + 0x60]
lea ecx, [esi + 0x4c]
mov word [esi + 0x48], ax
lea eax, [edi + 0x64]
push eax
mov byte [ebp - 4], 3
call fcn.0046bc90
mov dword [esi + 0x6c], 0
xor eax, eax
mov dword [esi + 0x7c], 0
mov dword [esi + 0x80], 0
movups xmm0, xmmword [edi + 0x84]
movups xmmword [esi + 0x6c], xmm0
movq xmm0, qword [edi + 0x94]
movq qword [esi + 0x7c], xmm0
mov dword [edi + 0x94], 0
mov dword [edi + 0x98], 7
mov word [edi + 0x84], ax
mov dword [esi + 0x84], eax
mov dword [esi + 0x94], eax
mov dword [esi + 0x98], eax
movups xmm0, xmmword [edi + 0x9c]
movups xmmword [esi + 0x84], xmm0
movq xmm0, qword [edi + 0xac]
movq qword [esi + 0x94], xmm0
mov dword [edi + 0xac], eax
mov dword [edi + 0xb0], 7
mov word [edi + 0x9c], ax
lea eax, [edi + 0xb4]
mov byte [ebp - 4], 4
push eax
mov esi, dword [ebp - 0x10]
lea ecx, [esi + 0xb4]
call fcn.0046bc90
mov eax, dword [edi + 0xd4]
mov edx, dword [edi + 0xdc]
mov ecx, dword [edi + 0xd8]
mov dword [edi + 0xdc], 0
mov dword [edi + 0xd8], 0
mov dword [edi + 0xd4], 0
mov dword [esi + 0xd4], eax
xor eax, eax
mov dword [esi + 0xd8], ecx
mov dword [esi + 0xdc], edx
mov dword [esi + 0xe0], 0
mov dword [esi + 0xf0], 0
mov dword [esi + 0xf4], 0
movups xmm0, xmmword [edi + 0xe0]
movups xmmword [esi + 0xe0], xmm0
movq xmm0, qword [edi + 0xf0]
movq qword [esi + 0xf0], xmm0
mov word [edi + 0xe0], ax
mov eax, esi
mov dword [edi + 0xf0], 0
mov dword [edi + 0xf4], 7
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x471440
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
sub esp, 0xc
cmp dword [eax + 0x14], 8
jb 0x471451
mov eax, dword [eax]
mov ecx, dword [ebp + 8]
cmp dword [ecx + 0x14], 8
jb 0x47145c
mov ecx, dword [ecx]
push esi
push edi
push eax
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov esi, eax
test esi, esi
je 0x4714d7
push esi
push 0
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x4714d7
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
test edi, edi
je 0x4714d7
push esi
push 0
call dword [sym.imp.KERNEL32.dll_SizeofResource]
lea ecx, [ebp - 0xc]
push ecx
push 0
push 0
push eax
push edi
call fcn.00494260
mov esi, eax
add esp, 0x14
test esi, esi
je 0x4714d7
lea eax, [ebp - 0xc]
push eax
push 0x10
push esi
call fcn.00493130
add esp, 0xc
test eax, eax
je 0x4714ce
push dword [ebp + 0x10]
push eax
call fcn.00471cb0
add esp, 8
pop edi
pop esi
mov esp, ebp
pop ebp
ret
push esi
call fcn.00494450
add esp, 4
pop edi
xor al, al
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x473010
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x83ca0d
mov eax, dword fs:[0]
push eax
sub esp, 0x3c
mov eax, dword [0xa5d1d4]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov ebx, dword [ebp + 8]
lea edx, [edi + 0x24]
movzx eax, bl
xor eax, 0x811c9dc5
mov dword [ebp - 0x3c], edx
imul ecx, eax, 0x1000193
mov eax, ebx
shr eax, 8
movzx eax, al
xor eax, ecx
mov dword [ebp - 0x2c], ecx
imul ecx, eax, 0x1000193
mov eax, ebx
shr eax, 0x10
movzx eax, al
xor ecx, eax
mov eax, ebx
imul ecx, ecx, 0x1000193
shr eax, 0x18
xor ecx, eax
imul eax, ecx, 0x1000193
mov ecx, edx
push eax
lea eax, [ebp + 8]
push eax
lea eax, [ebp - 0x38]
push eax
call fcn.004503a0
mov esi, dword [eax + 4]
test esi, esi
jne 0x47309e
mov esi, dword [edi + 0x28]
cmp esi, dword [edi + 0x28]
jne 0x4731d6
movzx eax, bh
lea esi, [edi + 4]
xor eax, dword [ebp - 0x2c]
imul ecx, eax, 0x1000193
movzx eax, byte [ebp + 0xa]
xor ecx, eax
movzx eax, byte [ebp + 0xb]
imul ecx, ecx, 0x1000193
xor ecx, eax
lea eax, [ebp + 8]
imul edi, ecx, 0x1000193
mov ecx, esi
push edi
push eax
lea eax, [ebp - 0x30]
push eax
call fcn.004503a0
mov eax, dword [ebp - 0x2c]
test eax, eax
jne 0x4731a1
cmp dword [esi + 8], 0x4924924
je 0x4731f7
lea eax, [esi + 4]
mov dword [ebp - 0x38], eax
push 0x38
mov dword [ebp - 4], 0
mov dword [ebp - 0x34], 0
call fcn.007fff35
mov ebx, eax
add esp, 4
mov eax, dword [ebp + 8]
mov dword [ebp - 0x34], ebx
mov dword [ebx + 8], eax
mov dword [ebx + 0x34], 0
mov eax, dword [esi + 8]
inc eax
mov dword [ebp - 4], 1
movd xmm0, eax
cvtdq2pd xmm0, xmm0
shr eax, 0x1f
addsd xmm0, qword [eax*8 + 0x88b6b0]
mov eax, dword [esi + 0x1c]
cvtpd2ps xmm1, xmm0
movd xmm0, eax
cvtdq2pd xmm0, xmm0
shr eax, 0x1f
addsd xmm0, qword [eax*8 + 0x88b6b0]
cvtpd2ps xmm0, xmm0
divss xmm1, xmm0
comiss xmm1, dword [esi]
seta al
test al, al
je 0x47318d
mov ecx, esi
call fcn.00460790
push edi
lea eax, [ebx + 8]
mov ecx, esi
push eax
lea eax, [ebp - 0x38]
push eax
call fcn.004503a0
mov ecx, dword [eax]
jmp 0x473190
mov ecx, dword [ebp - 0x30]
push ebx
push ecx
push edi
mov ecx, esi
mov dword [ebp - 4], 0xffffffff
call fcn.00453d50
mov ecx, dword [eax + 0x34]
test ecx, ecx
je 0x473201
mov eax, dword [ecx]
lea edx, [ebp - 0x28]
push edx
call dword [eax + 8]
mov ecx, dword [ebp - 0x3c]
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp + 8]
mov dword [ebp - 4], 2
push eax
lea eax, [ebp - 0x48]
push eax
call fcn.00472630
lea ecx, [ebp - 0x28]
mov esi, dword [eax]
call fcn.00436590
lea eax, [esi + 0xc]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.008001d2
mov esp, ebp
pop ebp
ret 4
push str.unordered_map_set_too_long
call fcn.007fc74d
call fcn.007fc710
int3
Function at 0x473840
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov edx, dword [ebp + 0xc]
mov eax, ecx
push ebx
push esi
push edi
cmp dword [edx + 0x14], 8
mov edi, edx
mov ebx, dword [edx + 0x10]
mov dword [ebp - 4], eax
jb 0x47385e
mov edi, dword [edx]
xor ecx, ecx
mov esi, 0x811c9dc5
add ebx, ebx
je 0x473884
nop dword [eax]
movzx eax, byte [ecx + edi]
inc ecx
xor eax, esi
imul esi, eax, 0x1000193
cmp ecx, ebx
jb 0x473870
mov eax, dword [ebp - 4]
push esi
push edx
lea ecx, [ebp - 0xc]
push ecx
mov ecx, eax
call fcn.00449ca0
pop edi
pop esi
pop ebx
mov ecx, dword [eax + 4]
mov eax, dword [ebp + 8]
test ecx, ecx
jne 0x4738a4
mov ecx, dword [ebp - 4]
mov ecx, dword [ecx + 4]
mov dword [eax], ecx
mov esp, ebp
pop ebp
ret 8

Function at 0x473a70
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x83cadd
mov eax, dword fs:[0]
push eax
sub esp, 0x28
push ebx
push esi
push edi
mov eax, dword [0xa5d1d4]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push 0x24
mov dword [ebp - 0x34], 0
mov dword [ebp - 0x30], 0
mov dword [ebp - 0x2c], 0
call fcn.007fff35
add esp, 4
mov dword [eax], eax
mov dword [eax + 4], eax
mov dword [ebp - 0x30], eax
mov dword [ebp - 4], 0
mov dword [ebp - 0x28], 0
mov dword [ebp - 0x24], 0
mov dword [ebp - 0x20], 0
push eax
push 0x10
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 1
mov dword [ebp - 0x1c], 7
mov dword [ebp - 0x18], 8
mov dword [ebp - 0x34], 0x3f800000
call fcn.004370d0
lea eax, [ebp - 0x34]
mov dword [ebp - 4], 2
push eax
call fcn.00474280
mov esi, dword [ebp + 8]
add esp, 4
cmp esi, dword [ebp + 0xc]
je 0x473b6b
nop word [eax + eax]
cmp dword [esi + 0x14], 8
mov edi, esi
mov ebx, dword [esi + 0x10]
jb 0x473b2d
mov edi, dword [esi]
xor ecx, ecx
mov edx, 0x811c9dc5
add ebx, ebx
je 0x473b49
movzx eax, byte [ecx + edi]
inc ecx
xor eax, edx
imul edx, eax, 0x1000193
cmp ecx, ebx
jb 0x473b38
push edx
push esi
lea eax, [ebp - 0x14]
push eax
lea ecx, [ebp - 0x34]
call fcn.00449ca0
mov eax, dword [eax + 4]
test eax, eax
je 0x473b63
cmp eax, dword [ebp - 0x30]
jne 0x473b89
add esi, 0x18
cmp esi, dword [ebp + 0xc]
jne 0x473b20
xor bl, bl
lea ecx, [ebp - 0x34]
call fcn.0045cdb0
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov bl, 1
jmp 0x473b6d

Function at 0x473e00
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
push esi
push dword [eax]
push 0
push 1
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
test esi, esi
je 0x473e37
push ebx
push 0
push esi
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
test eax, eax
push esi
setne bl
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, bl
pop ebx
pop esi
pop ebp
ret 4
xor al, al
pop esi
pop ebp
ret 4
Function at 0x473eb0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
push ebx
mov ebx, ecx
mov dword [ebp - 0x14], ebx
cmp edx, eax
je 0x47402c
cmp dword [edx + 0x1c], 8
lea ecx, [ebx + 4]
mov eax, dword [ecx]
push esi
mov dword [ebp - 0x1c], eax
mov esi, edx
mov eax, dword [ebx + 0xc]
push edi
mov dword [ebp - 0x18], eax
lea edi, [edx + 8]
mov eax, dword [edx + 4]
mov dword [ebp - 8], eax
mov eax, dword [edi + 0x10]
mov dword [ebp - 4], ecx
jb 0x473ef3
mov edi, dword [edi]
xor edx, edx
mov ebx, 0x811c9dc5
add eax, eax
je 0x473f14
mov ecx, eax
movzx eax, byte [edx + edi]
inc edx
xor eax, ebx
imul ebx, eax, 0x1000193
cmp edx, ecx
jb 0x473f00
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x14]
mov edx, dword [ebp - 0x18]
mov eax, dword [eax + 0x18]
and eax, ebx
lea eax, [edx + eax*8]
mov edx, dword [eax]
mov dword [ebp - 0xc], eax
mov eax, dword [eax + 4]
mov dword [ebp - 0x10], edx
mov dword [ebp - 0x20], eax
mov edi, esi
mov ebx, esi
mov esi, dword [esi]
lea eax, [edi + 8]
push eax
push ecx
call fcn.0044a230
push 0x24
push edi
call fcn.007fff65
mov ecx, dword [ebp - 4]
add esp, 0x10
dec dword [ecx + 4]
cmp ebx, dword [ebp - 0x20]
je 0x473f7f
mov eax, dword [ebp + 0xc]
cmp esi, eax
jne 0x473f30
mov ecx, dword [ebp - 0x10]
cmp ecx, dword [ebp + 8]
jne 0x474022
mov ecx, dword [ebp - 0xc]
pop edi
mov dword [ecx], esi
mov ecx, dword [ebp - 8]
mov dword [ecx], esi
mov dword [esi + 4], ecx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
mov ecx, dword [ebp - 0x10]
cmp ecx, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
jne 0x473f91
mov eax, dword [ebp - 0x1c]
mov dword [ecx], eax
jmp 0x473f94
mov eax, dword [ebp - 8]
mov dword [ecx + 4], eax
mov eax, dword [ebp + 0xc]
cmp esi, eax
je 0x474022
cmp dword [esi + 0x1c], 8
lea edx, [esi + 8]
mov ebx, dword [edx + 0x10]
jb 0x473fb0
mov edx, dword [edx]
xor ecx, ecx
mov edi, 0x811c9dc5
add ebx, ebx
je 0x473fd1
nop dword [eax + eax]
movzx eax, byte [ecx + edx]
inc ecx
xor eax, edi
imul edi, eax, 0x1000193
cmp ecx, ebx
jb 0x473fc0
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x18]
mov eax, dword [eax + 0x18]
and eax, edi
lea eax, [ecx + eax*8]
mov ecx, dword [ebp - 4]
mov dword [ebp + 8], eax
mov eax, dword [eax + 4]
mov dword [ebp - 0x20], eax
nop dword [eax + eax]
mov edi, esi
mov ebx, esi
mov esi, dword [esi]
lea eax, [edi + 8]
push eax
push ecx
call fcn.0044a230
push 0x24
push edi
call fcn.007fff65
mov ecx, dword [ebp - 4]
add esp, 0x10
mov eax, dword [ebp + 0xc]
dec dword [ecx + 4]
cmp ebx, dword [ebp - 0x20]
je 0x474033
cmp esi, eax
jne 0x473ff0
mov ecx, dword [ebp + 8]
mov dword [ecx], esi
mov ecx, dword [ebp - 8]
pop edi
mov dword [ecx], esi
mov dword [esi + 4], ecx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
mov ecx, dword [ebp + 8]
mov edi, dword [ebp - 0x1c]
mov dword [ecx], edi
mov dword [ecx + 4], edi
cmp esi, eax
jne 0x473fa2
mov ecx, dword [ebp - 8]
pop edi
mov dword [ecx], esi
mov dword [esi + 4], ecx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x474280
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x83cb80
mov eax, dword fs:[0]
push eax
sub esp, 0x23c
mov eax, dword [0xa5d1d4]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, dword [ebp + 8]
mov ecx, edi
call fcn.00474060
push 0
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov esi, eax
mov dword [ebp - 0x240], esi
lea eax, [ebp - 0x23c]
mov dword [ebp - 4], 0
push eax
push esi
mov dword [ebp - 0x23c], 0x22c
call sub.KERNEL32.dll_Process32FirstW
test eax, eax
je 0x474326
nop word [eax + eax]
cmp dword [ebp - 0x234], 0
jbe 0x474315
lea eax, [ebp - 0x234]
mov ecx, edi
push eax
lea eax, [ebp - 0x218]
push eax
lea eax, [ebp - 0x248]
push eax
call fcn.004735e0
lea eax, [ebp - 0x23c]
push eax
push esi
call sub.KERNEL32.dll_Process32NextW
test eax, eax
jne 0x4742f0
test esi, esi
je 0x474331
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.008001d2
mov esp, ebp
pop ebp
ret
Function at 0x4745a0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x83cc0d
mov eax, dword fs:[0]
push eax
sub esp, 0x20
push ebx
push esi
push edi
mov eax, dword [0xa5d1d4]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edx, ecx
mov dword [ebp - 0x10], edx
mov edi, dword [ebp + 8]
cmp edi, dword [ebp + 0xc]
je 0x474769
nop dword [eax]
cmp dword [edi + 0x14], 8
mov ebx, edi
mov eax, dword [edi + 0x10]
jb 0x4745ed
mov ebx, dword [edi]
xor ecx, ecx
mov esi, 0x811c9dc5
add eax, eax
mov dword [ebp + 8], eax
je 0x474614
mov edx, eax
nop dword [eax]
movzx eax, byte [ecx + ebx]
inc ecx
xor eax, esi
imul esi, eax, 0x1000193
cmp ecx, edx
jb 0x474600
mov edx, dword [ebp - 0x10]
push esi
push edi
lea eax, [ebp - 0x1c]
mov ecx, edx
push eax
call fcn.00449ca0
cmp dword [ebp - 0x18], 0
jne 0x47475a
mov ecx, dword [ebp - 0x10]
cmp dword [ecx + 8], 0x4924924
je 0x47477d
lea eax, [ecx + 4]
mov dword [ebp - 0x24], eax
push 0x38
mov dword [ebp - 4], 0
mov dword [ebp - 0x20], 0
call fcn.007fff35
mov ebx, eax
add esp, 4
mov dword [ebp - 0x20], ebx
lea eax, [ebx + 8]
push edi
mov ecx, eax
mov dword [ebp + 8], eax
call fcn.00436170
lea eax, [edi + 0x18]
mov byte [ebp - 4], 1
lea ecx, [ebx + 0x20]
push eax
call fcn.00436170
mov edx, dword [ebp - 0x10]
mov dword [ebp - 4], 2
mov eax, dword [edx + 8]
inc eax
movd xmm0, eax
cvtdq2pd xmm0, xmm0
shr eax, 0x1f
addsd xmm0, qword [eax*8 + 0x88b6b0]
mov eax, dword [edx + 0x1c]
cvtpd2ps xmm1, xmm0
movd xmm0, eax
cvtdq2pd xmm0, xmm0
shr eax, 0x1f
addsd xmm0, qword [eax*8 + 0x88b6b0]
cvtpd2ps xmm0, xmm0
divss xmm1, xmm0
comiss xmm1, dword [edx]
seta al
test al, al
je 0x4746f3
mov ecx, edx
call fcn.00453df0
mov ecx, dword [ebp - 0x10]
lea eax, [ebx + 8]
push esi
push eax
lea eax, [ebp - 0x2c]
push eax
call fcn.00449ca0
mov edx, dword [ebp - 0x10]
mov ecx, dword [eax]
mov eax, dword [eax + 4]
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 0x18], eax
jmp 0x4746f6
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ecx + 4]
inc dword [edx + 8]
mov dword [ebx + 4], eax
mov dword [ebx], ecx
mov dword [eax], ebx
mov dword [ecx + 4], ebx
mov dword [ebp - 0x14], eax
mov eax, dword [edx + 0x18]
mov dword [ebp + 8], ecx
and eax, esi
mov ecx, dword [edx + 0xc]
mov dword [ebp - 0x20], 0
mov esi, dword [ecx + eax*8]
cmp esi, dword [edx + 4]
jne 0x474733
mov dword [ecx + eax*8], ebx
mov dword [ecx + eax*8 + 4], ebx
mov dword [ebp - 4], 0xffffffff
jmp 0x47475d
cmp esi, dword [ebp + 8]
jne 0x474744
mov dword [ecx + eax*8], ebx
mov dword [ebp - 4], 0xffffffff
jmp 0x47475d
mov esi, dword [ebp - 0x14]
cmp dword [ecx + eax*8 + 4], esi
jne 0x474751
mov dword [ecx + eax*8 + 4], ebx
mov dword [ebp - 4], 0xffffffff
jmp 0x47475d
mov edx, dword [ebp - 0x10]
add edi, 0x30
cmp edi, dword [ebp + 0xc]
jne 0x4745e0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
push str.unordered_map_set_too_long
call fcn.007fc74d
int3
Function at 0x4749e0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x83ccdd
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push ebx
push esi
push edi
mov eax, dword [0xa5d1d4]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, dword [ebp + 8]
lea ebx, [ecx + 4]
mov edx, edi
cmp dword [edi + 0x14], 8
mov eax, dword [edi + 0x10]
jb 0x474a1b
mov edx, dword [edi]
xor ecx, ecx
mov esi, 0x811c9dc5
add eax, eax
je 0x474a3c
mov edi, eax
movzx eax, byte [ecx + edx]
inc ecx
xor eax, esi
imul esi, eax, 0x1000193
cmp ecx, edi
jb 0x474a28
mov edi, dword [ebp + 8]
push esi
push edi
lea eax, [ebp - 0x14]
mov ecx, ebx
push eax
call fcn.00449ca0
mov ecx, dword [ebp - 0x10]
test ecx, ecx
je 0x474a84
mov eax, dword [ebp + 0xc]
add ecx, 0x20
cmp ecx, eax
je 0x474b40
cmp dword [eax + 0x14], 8
mov edx, dword [eax + 0x10]
jb 0x474a69
mov eax, dword [eax]
push edx
push eax
call fcn.00437690
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
cmp dword [ebx + 8], 0x4924924
je 0x474b54
lea eax, [ebx + 4]
mov dword [ebp - 0x1c], eax
push 0x38
mov dword [ebp - 4], 0
mov dword [ebp - 0x18], 0
call fcn.007fff35
add esp, 4
mov dword [ebp - 0x18], eax
add eax, 8
mov ecx, eax
mov dword [ebp + 8], eax
push edi
call fcn.00436170
mov edi, dword [ebp + 8]
push dword [ebp + 0xc]
mov byte [ebp - 4], 1
lea ecx, [edi + 0x18]
call fcn.00436170
mov eax, dword [ebx + 8]
inc eax
mov dword [ebp - 4], 2
movd xmm0, eax
cvtdq2pd xmm0, xmm0
shr eax, 0x1f
addsd xmm0, qword [eax*8 + 0x88b6b0]
mov eax, dword [ebx + 0x1c]
cvtpd2ps xmm1, xmm0
movd xmm0, eax
cvtdq2pd xmm0, xmm0
shr eax, 0x1f
addsd xmm0, qword [eax*8 + 0x88b6b0]
cvtpd2ps xmm0, xmm0
divss xmm1, xmm0
comiss xmm1, dword [ebx]
jbe 0x474b31
mov ecx, ebx
call fcn.00453df0
push esi
push edi
lea eax, [ebp - 0x14]
mov ecx, ebx
push eax
call fcn.00449ca0
mov ecx, dword [eax]
jmp 0x474b34
mov ecx, dword [ebp - 0x14]
push dword [ebp - 0x18]
push ecx
push esi
mov ecx, ebx
call fcn.00453d50
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
push str.unordered_map_set_too_long
call fcn.007fc74d
int3
Function at 0x47cc20
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
mov eax, ecx
mov dword [ebp - 4], eax
mov esi, edi
cmp dword [edi + 0x14], 8
mov ebx, dword [edi + 0x10]
jb 0x47cc3c
mov esi, dword [edi]
xor ecx, ecx
mov edx, 0x811c9dc5
add ebx, ebx
je 0x47cc5b
movzx eax, byte [ecx + esi]
inc ecx
xor eax, edx
imul edx, eax, 0x1000193
cmp ecx, ebx
jb 0x47cc47
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0x18]
mov eax, dword [eax + 0xc]
and ecx, edx
mov edx, dword [ebp - 4]
mov esi, dword [eax + ecx*8 + 4]
cmp esi, dword [edx + 4]
je 0x47cca4
mov ebx, dword [eax + ecx*8]
mov eax, dword [edi + 0x10]
lea ecx, [esi + 8]
cmp eax, dword [ecx + 0x10]
jne 0x47cc89
push ecx
mov ecx, edi
call fcn.007392d0
test eax, eax
je 0x47cc92
cmp esi, ebx
je 0x47cca4
mov esi, dword [esi + 4]
jmp 0x47cc72
test esi, esi
je 0x47cca4
mov eax, dword [ebp + 8]
pop edi
mov dword [eax], esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
mov ecx, dword [eax + 4]
mov eax, dword [ebp + 8]
mov dword [eax], ecx
mov esp, ebp
pop ebp
ret 8