joyce8/EMBER2024-capa huggingface dataset:
Function at 0x42e660
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
mov eax, dword [0x48c184]
add eax, 0xffffffff
mov dword [0x48c184], eax
jns 0x42e7a5
push ebx
push esi
mov esi, 0x493690
push edi
mov edi, 0x493688
cmp eax, 0xffffffff
jge 0x42e6b1
mov eax, 0x1105
mov ecx, 0x49368c
mov dword [0x493688], eax
mov edx, 0x26f
nop dword [eax]
imul eax, eax, 0x10dcd
lea ecx, [ecx + 4]
mov dword [ecx - 4], eax
sub edx, 1
jne 0x42e6a0
mov eax, dword [0x493688]
mov ebx, 0xe3
mov edx, dword [0x49368c]
mov dword [0x48c184], 0x26f
mov dword [0x49404c], 0x49368c
mov ecx, edx
xor ecx, eax
and ecx, 0x7ffffffe
xor ecx, eax
mov eax, edx
and al, 1
shr ecx, 1
movzx eax, al
neg eax
sbb eax, eax
and eax, 0x9908b0df
xor ecx, eax
mov eax, edx
xor ecx, dword [esi + 0x62c]
mov dword [edi], ecx
add edi, 4
mov edx, dword [esi]
add esi, 4
sub ebx, 1
jne 0x42e6d5
push ebp
mov ebx, 0x493688
mov ebp, 0x18c
mov ecx, edx
lea edi, [edi + 4]
xor ecx, eax
lea ebx, [ebx + 4]
and ecx, 0x7ffffffe
lea esi, [esi + 4]
xor ecx, eax
mov eax, edx
and al, 1
shr ecx, 1
movzx eax, al
neg eax
sbb eax, eax
and eax, 0x9908b0df
xor ecx, eax
mov eax, edx
xor ecx, dword [ebx - 4]
mov dword [edi - 4], ecx
mov edx, dword [esi - 4]
sub ebp, 1
jne 0x42e717
mov edx, dword [0x493688]
mov ecx, edx
xor ecx, eax
and ecx, 0x7ffffffe
xor ecx, eax
mov eax, edx
and al, 1
shr ecx, 1
movzx eax, al
neg eax
pop ebp
sbb eax, eax
and eax, 0x9908b0df
xor ecx, eax
mov eax, edx
xor ecx, dword [ebx]
shr eax, 0xb
xor edx, eax
mov dword [edi], ecx
mov eax, edx
and eax, 0xff3a58ad
shl eax, 7
xor edx, eax
mov eax, edx
and eax, 0xffffdf8c
shl eax, 0xf
xor edx, eax
pop edi
mov eax, edx
shr eax, 0x12
pop esi
xor eax, edx
pop ebx
ret
mov eax, dword [0x49404c]
mov ecx, dword [eax]
add eax, 4
mov dword [0x49404c], eax
mov eax, ecx
shr eax, 0xb
xor ecx, eax
mov eax, ecx
and eax, 0xff3a58ad
shl eax, 7
xor ecx, eax
mov eax, ecx
and eax, 0xffffdf8c
shl eax, 0xf
xor ecx, eax
mov eax, ecx
shr eax, 0x12
xor eax, ecx
ret
Function at 0x430980
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, dword [esp + 0xc]
xor dl, dl
xor eax, eax
push edi
mov edi, dword [esp + 0xc]
test esi, esi
jle 0x430a10
cmp esi, 0x20
jb 0x430a03
movaps xmm3, xmmword [0x479e40]
mov ecx, esi
and ecx, 0xffffffe0
xorps xmm2, xmm2
xorps xmm1, xmm1
nop dword [eax]
movups xmm0, xmmword [eax + edi]
andps xmm0, xmm3
xorps xmm2, xmm0
movups xmm0, xmmword [edi + eax + 0x10]
add eax, 0x20
andps xmm0, xmm3
xorps xmm1, xmm0
cmp eax, ecx
jl 0x4309b0
xorps xmm1, xmm2
movaps xmm0, xmm1
psrldq xmm0, 8
xorps xmm1, xmm0
movups xmm0, xmm1
psrldq xmm0, 4
xorps xmm1, xmm0
movups xmm0, xmm1
psrldq xmm0, 2
xorps xmm1, xmm0
movups xmm0, xmm1
psrldq xmm0, 1
xorps xmm1, xmm0
movd edx, xmm1
cmp eax, esi
jge 0x430a10
mov cl, byte [edi + eax]
inc eax
and cl, 0xaa
xor dl, cl
cmp eax, esi
jl 0x430a03
push esi
push edi
push 0x494069
mov byte [0x494068], dl
call fcn.0044fcb0
add esp, 0xc
xor ecx, ecx
test esi, esi
jle 0x430a6a
mov edx, dword [esp + 0x18]
push ebx
mov ebx, dword [esp + 0x18]
nop dword [eax]
nop dword [eax + eax]
movzx eax, byte [ecx + 0x494069]
mov al, byte [eax + 0x48c588]
mov byte [ecx + 0x494069], al
test edx, edx
je 0x430a61
xor al, bl
xor al, 0xcc
mov byte [ecx + 0x494069], al
inc ecx
xor edx, 1
cmp ecx, esi
jl 0x430a40
pop ebx
pop edi
pop esi
ret

Function at 0x430a70
Capabilities:
Encode data using xor

Disassembly:
push edi
movzx edi, byte [esp + 0xc]
test edi, edi
je 0x430aba
mov eax, dword [esp + 8]
add eax, 2
push esi
movzx ecx, byte [eax + 1]
lea eax, [eax + 4]
movzx edx, byte [eax - 5]
mov esi, dword [ecx*4 + 0x48f888]
movzx ecx, byte [eax - 6]
xor esi, dword [edx*4 + 0x48f088]
xor esi, dword [ecx*4 + 0x48ec88]
movzx ecx, byte [eax - 4]
xor esi, dword [ecx*4 + 0x48f488]
mov dword [eax - 6], esi
sub edi, 1
jne 0x430a82
pop esi
pop edi
ret
Function at 0x431c10
Capabilities:
Encode data using xor
Encrypt data using aes
Reference aes constants

Disassembly:
sub esp, 0x28
mov eax, dword [0x48fe40]
xor eax, esp
mov dword [esp + 0x24], eax
push ebx
mov ebx, dword [0x4b5068]
add ebx, 0xfffffffa
push ebp
mov ebp, dword [esp + 0x3c]
push esi
mov esi, dword [esp + 0x38]
lea edx, [ebx - 1]
push edi
test edx, edx
js 0x431ca7
lea ecx, [ebx*4]
shl edx, 2
lea eax, [ecx - 4]
shr ecx, 2
sub esi, eax
lea edi, [esp + 0x14]
add esi, edx
sub edx, eax
add edi, edx
xor eax, eax
mov edx, dword [0x4b5068]
rep movsd dword es:[edi], dword [esi]
xor edi, edi
xor esi, esi
lea ecx, [edx + 1]
cmp edi, ecx
jge 0x431cb1
cmp esi, ebx
jge 0x431c8c
nop
cmp eax, 4
jge 0x431c86
mov ecx, dword [esp + esi*4 + 0x14]
lea edx, [eax + edi*4]
inc esi
mov dword [ebp + edx*4], ecx
inc eax
cmp esi, ebx
jl 0x431c70
mov edx, dword [0x4b5068]
cmp eax, 4
lea ecx, [edi + 1]
cmovne ecx, edi
mov edi, ecx
xor ecx, ecx
cmp eax, 4
cmovne ecx, eax
mov eax, ecx
cmp esi, ebx
jl 0x431c64
jmp 0x431cb1
mov edx, dword [0x4b5068]
xor edi, edi
xor eax, eax
lea ecx, [edx + 1]
cmp edi, ecx
jge 0x431df4
mov esi, 0x48fc88
movzx ecx, byte [esp + ebx*4 + 0x11]
mov dl, byte [esp + 0x14]
xor dl, byte [ecx + str.cw]
mov byte [esp + 0x14], dl
movzx ecx, byte [esp + ebx*4 + 0x12]
movzx ecx, byte [ecx + str.cw]
xor byte [esp + 0x15], cl
movzx ecx, byte [esp + ebx*4 + 0x13]
movzx ecx, byte [ecx + str.cw]
xor byte [esp + 0x16], cl
movzx ecx, byte [esp + ebx*4 + 0x10]
movzx ecx, byte [ecx + str.cw]
xor byte [esp + 0x17], cl
movzx ecx, byte [esi]
add esi, 4
xor cl, dl
mov dword [esp + 0x10], esi
mov byte [esp + 0x14], cl
mov edx, 1
cmp ebx, 8
je 0x431d40
cmp ebx, edx
jle 0x431d31
mov ecx, dword [esp + edx*4 + 0x10]
xor dword [esp + edx*4 + 0x14], ecx
inc edx
cmp edx, ebx
jl 0x431d22
jmp 0x431da1
xor esi, esi
test ebx, ebx
jle 0x431de1
jmp 0x431da3
mov ecx, dword [esp + edx*4 + 0x10]
xor dword [esp + edx*4 + 0x14], ecx
inc edx
cmp edx, 4
jl 0x431d40
movzx ecx, byte [esp + 0x20]
mov edx, 5
movzx ecx, byte [ecx + str.cw]
xor byte [esp + 0x24], cl
movzx ecx, byte [esp + 0x21]
movzx ecx, byte [ecx + str.cw]
xor byte [esp + 0x25], cl
movzx ecx, byte [esp + 0x22]
movzx ecx, byte [ecx + str.cw]
xor byte [esp + 0x26], cl
movzx ecx, byte [esp + 0x23]
movzx ecx, byte [ecx + str.cw]
xor byte [esp + 0x27], cl
mov ecx, dword [esp + edx*4 + 0x10]
xor dword [esp + edx*4 + 0x14], ecx
inc edx
cmp edx, 8
jl 0x431d93
xor esi, esi
mov ecx, dword [0x4b5068]
inc ecx
cmp edi, ecx
jge 0x431de1
cmp esi, ebx
jge 0x431dc8
cmp eax, 4
jge 0x431dc8
mov ecx, dword [esp + esi*4 + 0x14]
lea edx, [eax + edi*4]
inc esi
mov dword [ebp + edx*4], ecx
inc eax
cmp esi, ebx
jl 0x431db2
cmp eax, 4
lea ecx, [edi + 1]
cmovne ecx, edi
mov edi, ecx
xor ecx, ecx
cmp eax, 4
cmovne ecx, eax
mov eax, ecx
cmp esi, ebx
jl 0x431da3
mov ecx, dword [0x4b5068]
mov esi, dword [esp + 0x10]
inc ecx
cmp edi, ecx
jl 0x431cc1
mov ecx, dword [esp + 0x34]
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.0044e4cb
add esp, 0x28
ret
Function at 0x431e10
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, dword [esp + 0xc]
push esi
xor esi, esi
test ebp, ebp
je 0x431e59
push ebx
push edi
mov edi, dword [ecx + 8]
movzx eax, word [ecx]
mov edx, dword [esp + 0x14]
mov ebx, eax
shr ebx, 8
xor bl, byte [edx + esi]
inc esi
movzx edx, bl
add dx, ax
movzx eax, word [ecx + 2]
movzx edx, dx
imul edx, eax
movzx eax, word [ecx + 4]
add dx, ax
movzx eax, bl
add edi, eax
mov word [ecx], dx
mov dword [ecx + 8], edi
cmp esi, ebp
jb 0x431e21
pop edi
pop ebx
pop esi
pop ebp
ret 8

Function at 0x431ec0
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
sub esp, 0x18
mov eax, dword [0x48fe40]
xor eax, esp
mov dword [esp + 0x14], eax
lea eax, [esp]
mov dword [esp], 0x10
push eax
lea eax, [esp + 8]
push eax
push dword [ecx + 0x1b0]
call dword [sym.imp.WS2_32.dll_getsockname]
push dword [esp + 6]
call dword [sym.imp.WS2_32.dll_ntohs]
mov ecx, dword [esp + 0x14]
xor ecx, esp
call fcn.0044e4cb
add esp, 0x18
ret

Function at 0x431f10
Capabilities:
Initialize winsock library

Disassembly:
push esi
mov esi, ecx
lea eax, [esi + 0x20]
push eax
push 0x202
call dword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
jne 0x431f8a
push eax
push 1
push 2
call dword [sym.imp.WS2_32.dll_socket]
mov dword [esi + 0x1b0], eax
cmp eax, 0xffffffff
je 0x431f8a
push dword [esp + 8]
mov eax, 2
mov word [esi], ax
call dword [sym.imp.WS2_32.dll_inet_addr]
push dword [esp + 0x10]
mov dword [esi + 4], eax
call dword [sym.imp.WS2_32.dll_htons]
push 0x10
push esi
push dword [esi + 0x1b0]
mov word [esi + 2], ax
call dword [sym.imp.WS2_32.dll_bind]
cmp eax, 0xffffffff
je 0x431f8a
push 1
push dword [esi + 0x1b0]
call dword [sym.imp.WS2_32.dll_listen]
test eax, eax
pop esi
setns al
ret 0xc
xor al, al
pop esi
ret 0xc
Function at 0x431f90
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4752dd
mov eax, dword fs:[0]
push eax
sub esp, 0x54
mov eax, dword [0x48fe40]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov esi, dword [ebp + 8]
xorps xmm0, xmm0
mov dword [ebp - 0x5c], esi
movups xmmword [ebp - 0x40], xmm0
mov dword [ebp - 0x30], 0
movups xmmword [ebp - 0x28], xmm0
mov dword [ebp - 0x2c], 0xf
mov byte [ebp - 0x40], 0
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0xf
mov byte [ebp - 0x28], 0
push 0
push 4
lea eax, [ebp - 0x5c]
mov dword [ebp - 4], 0
push eax
push dword [edi + 0x1b4]
mov dword [ebp - 0x5c], 0
call dword [sym.imp.WS2_32.dll_recv]
mov ecx, dword [ebp - 0x14]
xorps xmm0, xmm0
mov dword [ebp - 0x48], 0
mov dword [ebp - 0x44], 0xf
movups xmmword [ebp - 0x58], xmm0
mov byte [ebp - 0x58], 0
cmp ecx, 0xf
jbe 0x432060
mov edx, dword [ebp - 0x28]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x432056
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x432181
push ecx
push edx
call fcn.0044e17e
add esp, 8
movups xmm0, xmmword [ebp - 0x58]
mov eax, dword [ebp - 0x5c]
movups xmmword [ebp - 0x28], xmm0
movq xmm0, qword [ebp - 0x48]
movq qword [ebp - 0x18], xmm0
mov ecx, dword [ebp - 0x18]
cmp eax, ecx
ja 0x432090
cmp dword [ebp - 0x14], 0xf
lea ecx, [ebp - 0x28]
mov dword [ebp - 0x18], eax
cmova ecx, dword [ebp - 0x28]
mov byte [ecx + eax], 0
jmp 0x43209d
sub eax, ecx
lea ecx, [ebp - 0x28]
push 0
push eax
call fcn.004107f0
cmp dword [ebp - 0x14], 0xf
lea eax, [ebp - 0x28]
push 0
push dword [ebp - 0x5c]
cmova eax, dword [ebp - 0x28]
push eax
push dword [edi + 0x1b4]
call dword [sym.imp.WS2_32.dll_recv]
push 0
push 4
lea eax, [ebp - 0x5c]
push eax
push dword [edi + 0x1b4]
call dword [sym.imp.WS2_32.dll_recv]
mov eax, dword [ebp - 0x5c]
mov ecx, dword [ebp - 0x30]
cmp eax, ecx
ja 0x4320ec
cmp dword [ebp - 0x2c], 0xf
lea ecx, [ebp - 0x40]
mov dword [ebp - 0x30], eax
cmova ecx, dword [ebp - 0x40]
mov byte [ecx + eax], 0
jmp 0x4320f9
sub eax, ecx
lea ecx, [ebp - 0x40]
push 0
push eax
call fcn.004107f0
cmp dword [ebp - 0x2c], 0xf
lea eax, [ebp - 0x40]
push 0
push dword [ebp - 0x5c]
cmova eax, dword [ebp - 0x40]
push eax
push dword [edi + 0x1b4]
call dword [sym.imp.WS2_32.dll_recv]
xorps xmm0, xmm0
mov eax, esi
movups xmmword [esi], xmm0
mov dword [esi + 0x10], 0
movups xmm0, xmmword [ebp - 0x40]
mov dword [esi + 0x14], 0
movups xmmword [esi], xmm0
movq xmm0, qword [ebp - 0x30]
movq qword [esi + 0x10], xmm0
xorps xmm0, xmm0
movups xmmword [esi + 0x18], xmm0
mov dword [esi + 0x28], 0
movups xmm0, xmmword [ebp - 0x28]
mov dword [esi + 0x2c], 0
movups xmmword [esi + 0x18], xmm0
movq xmm0, qword [ebp - 0x18]
movq qword [esi + 0x28], xmm0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0044e4cb
mov esp, ebp
pop ebp
ret 4
call fcn.004532bf
int3
Function at 0x432190
Capabilities:
Send data
Send data on socket

Disassembly:
push ecx
mov eax, dword [esp + 0xc]
push esi
mov esi, dword [sym.imp.WS2_32.dll_send]
push edi
push 0
mov edi, ecx
mov dword [esp + 0xc], eax
push 4
lea eax, [esp + 0x10]
push eax
push dword [edi + 0x1b4]
call esi
push 0
push dword [esp + 0x18]
push dword [esp + 0x18]
push dword [edi + 0x1b4]
call esi
mov eax, dword [esp + 0x1c]
push 0
mov dword [esp + 0xc], eax
lea eax, [esp + 0xc]
push 4
push eax
push dword [edi + 0x1b4]
call esi
push 0
push dword [esp + 0x20]
push dword [esp + 0x20]
push dword [edi + 0x1b4]
call esi
pop edi
pop esi
pop ecx
ret 0x10

Function at 0x432220
Capabilities:
Connect socket

Disassembly:
push esi
push dword [esp + 8]
mov esi, ecx
mov eax, 2
mov word [esi], ax
call dword [sym.imp.WS2_32.dll_inet_addr]
push dword [esp + 0x10]
mov dword [esi + 4], eax
call dword [sym.imp.WS2_32.dll_htons]
push 0x10
push esi
push dword [esi + 0x1a0]
mov word [esi + 2], ax
call dword [sym.imp.WS2_32.dll_connect]
test eax, eax
pop esi
setns al
ret 0xc

Function at 0x432260
Capabilities:
Initialize winsock library

Disassembly:
push esi
mov esi, ecx
lea eax, [esi + 0x10]
push eax
push 0x202
call dword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
jne 0x43228f
push eax
push 1
push 2
call dword [sym.imp.WS2_32.dll_socket]
cmp eax, 0xffffffff
mov dword [esi + 0x1a0], eax
pop esi
setne al
ret
xor al, al
pop esi
ret
Function at 0x4322a0
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4752dd
mov eax, dword fs:[0]
push eax
sub esp, 0x54
mov eax, dword [0x48fe40]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov esi, dword [ebp + 8]
xorps xmm0, xmm0
mov dword [ebp - 0x5c], esi
movups xmmword [ebp - 0x40], xmm0
mov dword [ebp - 0x30], 0
movups xmmword [ebp - 0x28], xmm0
mov dword [ebp - 0x2c], 0xf
mov byte [ebp - 0x40], 0
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0xf
mov byte [ebp - 0x28], 0
push 0
push 4
lea eax, [ebp - 0x5c]
mov dword [ebp - 4], 0
push eax
push dword [edi + 0x1a0]
mov dword [ebp - 0x5c], 0
call dword [sym.imp.WS2_32.dll_recv]
mov ecx, dword [ebp - 0x14]
xorps xmm0, xmm0
mov dword [ebp - 0x48], 0
mov dword [ebp - 0x44], 0xf
movups xmmword [ebp - 0x58], xmm0
mov byte [ebp - 0x58], 0
cmp ecx, 0xf
jbe 0x432370
mov edx, dword [ebp - 0x28]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x432366
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x432491
push ecx
push edx
call fcn.0044e17e
add esp, 8
movups xmm0, xmmword [ebp - 0x58]
mov eax, dword [ebp - 0x5c]
movups xmmword [ebp - 0x28], xmm0
movq xmm0, qword [ebp - 0x48]
movq qword [ebp - 0x18], xmm0
mov ecx, dword [ebp - 0x18]
cmp eax, ecx
ja 0x4323a0
cmp dword [ebp - 0x14], 0xf
lea ecx, [ebp - 0x28]
mov dword [ebp - 0x18], eax
cmova ecx, dword [ebp - 0x28]
mov byte [ecx + eax], 0
jmp 0x4323ad
sub eax, ecx
lea ecx, [ebp - 0x28]
push 0
push eax
call fcn.004107f0
cmp dword [ebp - 0x14], 0xf
lea eax, [ebp - 0x28]
push 0
push dword [ebp - 0x5c]
cmova eax, dword [ebp - 0x28]
push eax
push dword [edi + 0x1a0]
call dword [sym.imp.WS2_32.dll_recv]
push 0
push 4
lea eax, [ebp - 0x5c]
push eax
push dword [edi + 0x1a0]
call dword [sym.imp.WS2_32.dll_recv]
mov eax, dword [ebp - 0x5c]
mov ecx, dword [ebp - 0x30]
cmp eax, ecx
ja 0x4323fc
cmp dword [ebp - 0x2c], 0xf
lea ecx, [ebp - 0x40]
mov dword [ebp - 0x30], eax
cmova ecx, dword [ebp - 0x40]
mov byte [ecx + eax], 0
jmp 0x432409
sub eax, ecx
lea ecx, [ebp - 0x40]
push 0
push eax
call fcn.004107f0
cmp dword [ebp - 0x2c], 0xf
lea eax, [ebp - 0x40]
push 0
push dword [ebp - 0x5c]
cmova eax, dword [ebp - 0x40]
push eax
push dword [edi + 0x1a0]
call dword [sym.imp.WS2_32.dll_recv]
xorps xmm0, xmm0
mov eax, esi
movups xmmword [esi], xmm0
mov dword [esi + 0x10], 0
movups xmm0, xmmword [ebp - 0x40]
mov dword [esi + 0x14], 0
movups xmmword [esi], xmm0
movq xmm0, qword [ebp - 0x30]
movq qword [esi + 0x10], xmm0
xorps xmm0, xmm0
movups xmmword [esi + 0x18], xmm0
mov dword [esi + 0x28], 0
movups xmm0, xmmword [ebp - 0x28]
mov dword [esi + 0x2c], 0
movups xmmword [esi + 0x18], xmm0
movq xmm0, qword [ebp - 0x18]
movq qword [esi + 0x28], xmm0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0044e4cb
mov esp, ebp
pop ebp
ret 4
call fcn.004532bf
int3
Function at 0x434660
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0x18]
mov ebp, ecx
mov esi, edi
cmp dword [edi + 0x14], 0x10
jb 0x434674
mov esi, dword [edi]
mov ebx, dword [edi + 0x10]
xor ecx, ecx
mov edx, 0x811c9dc5
test ebx, ebx
je 0x434693
movzx eax, byte [ecx + esi]
inc ecx
xor eax, edx
imul edx, eax, 0x1000193
cmp ecx, ebx
jb 0x434682
mov ecx, dword [ebp + 0x18]
mov eax, dword [ebp + 0xc]
and ecx, edx
mov edx, dword [ebp + 4]
mov dword [esp + 0x18], edx
mov esi, dword [eax + ecx*8 + 4]
cmp esi, edx
jne 0x4346be
mov eax, dword [esp + 0x14]
xor esi, esi
test esi, esi
pop edi
cmove esi, edx
mov dword [eax], esi
pop esi
pop ebp
pop ebx
ret 8
mov ebp, dword [eax + ecx*8]
cmp dword [esi + 0x1c], 0x10
lea edx, [esi + 8]
jb 0x4346cd
mov edx, dword [esi + 8]
cmp dword [edi + 0x14], 0x10
mov ecx, edi
jb 0x4346d7
mov ecx, dword [edi]
push dword [esi + 0x18]
push edx
push ebx
push ecx
call fcn.00403a40
add esp, 0x10
test al, al
jne 0x4346f4
cmp esi, ebp
je 0x4346f2
mov esi, dword [esi + 4]
jmp 0x4346c1
xor esi, esi
mov eax, dword [esp + 0x14]
test esi, esi
mov edx, dword [esp + 0x18]
cmove esi, edx
pop edi
mov dword [eax], esi
pop esi
pop ebp
pop ebx
ret 8
Function at 0x438800
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x475d45
mov eax, dword fs:[0]
push eax
sub esp, 0x18
push ebx
push esi
push edi
mov eax, dword [0x48fe40]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov edi, dword [ebp + 8]
mov edx, edi
cmp dword [edi + 0x14], 0x10
jb 0x438837
mov edx, dword [edi]
xor ecx, ecx
mov esi, 0x811c9dc5
cmp dword [edi + 0x10], ecx
jbe 0x438855
movzx eax, byte [ecx + edx]
inc ecx
xor eax, esi
imul esi, eax, 0x1000193
cmp ecx, dword [edi + 0x10]
jb 0x438843
push esi
push edi
lea eax, [ebp - 0x14]
mov ecx, ebx
push eax
call fcn.00434040
mov eax, dword [ebp - 0x10]
test eax, eax
jne 0x438925
cmp dword [ebx + 8], 0x6666666
je 0x43893c
lea eax, [ebx + 4]
mov dword [ebp - 0x1c], eax
push 0x28
mov dword [ebp - 4], 0
mov dword [ebp - 0x18], 0
call fcn.0044e14e
mov ecx, eax
add esp, 4
mov dword [ebp - 0x18], ecx
push edi
lea edi, [ecx + 8]
mov ecx, edi
call fcn.0040b2a0
xorps xmm0, xmm0
movq qword [edi + 0x18], xmm0
mov dword [edi + 0x1c], 0
mov eax, dword [ebx + 8]
inc eax
mov dword [ebp - 4], 1
movd xmm0, eax
cvtdq2pd xmm0, xmm0
shr eax, 0x1f
addsd xmm0, qword [eax*8 + 0x479680]
mov eax, dword [ebx + 0x1c]
cvtpd2ps xmm1, xmm0
movd xmm0, eax
cvtdq2pd xmm0, xmm0
shr eax, 0x1f
addsd xmm0, qword [eax*8 + 0x479680]
cvtpd2ps xmm0, xmm0
divss xmm1, xmm0
comiss xmm1, dword [ebx]
jbe 0x438916
mov ecx, ebx
call fcn.00439060
push esi
push edi
lea eax, [ebp - 0x24]
mov ecx, ebx
push eax
call fcn.00434040
mov ecx, dword [eax]
jmp 0x438919
mov ecx, dword [ebp - 0x14]
push dword [ebp - 0x18]
push ecx
push esi
mov ecx, ebx
call fcn.00439000
add eax, 0x20
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
push str.unordered_map_set_too_long
call fcn.0044cdba
int3
Function at 0x438ce0
Capabilities:
Hash data using fnv

Disassembly:
sub esp, 8
mov edx, dword [esp + 0xc]
mov eax, 0x1fffffff
push ebp
mov ebp, ecx
bsr ecx, eax
push edi
mov edi, 1
mov dword [esp + 0xc], ebp
mov eax, edi
shl eax, cl
cmp edx, eax
ja 0x438e0f
lea eax, [edx - 1]
or eax, edi
bsr ecx, eax
push esi
mov esi, dword [ebp + 4]
push esi
lea ecx, [ecx + 1]
shl edi, cl
lea ecx, [ebp + 0xc]
lea eax, [edi + edi]
push eax
call fcn.00432f00
lea eax, [edi - 1]
mov dword [ebp + 0x1c], edi
mov dword [ebp + 0x18], eax
mov eax, dword [ebp + 4]
mov eax, dword [eax]
mov ecx, eax
cmp eax, esi
je 0x438dea
push ebx
nop
mov bl, byte [eax + 8]
mov edi, dword [ebp + 0x18]
mov ecx, dword [ecx]
movzx edx, bl
xor edx, 0x811c9dc5
imul edx, edx, 0x1000193
and edi, edx
mov edx, dword [ebp + 0xc]
lea ebp, [edx + edi*8]
mov edi, dword [ebp]
mov dword [esp + 0x1c], ebp
cmp edi, esi
jne 0x438d72
mov dword [ebp], eax
mov dword [ebp + 4], eax
jmp 0x438ddb
mov edx, dword [ebp + 4]
cmp bl, byte [edx + 8]
jne 0x438da9
mov edx, dword [edx]
mov dword [esp + 0x10], edx
cmp edx, eax
je 0x438da4
mov ebx, dword [eax + 4]
mov ebp, dword [esp + 0x10]
mov dword [ebx], ecx
mov edi, dword [ecx + 4]
mov dword [edi], edx
mov edx, dword [edx + 4]
mov dword [edx], eax
mov dword [ebp + 4], edi
mov ebp, dword [esp + 0x1c]
mov dword [ecx + 4], ebx
mov dword [eax + 4], edx
mov dword [ebp + 4], eax
jmp 0x438ddb
cmp edi, edx
je 0x438dbc
nop dword [eax]
mov edx, dword [edx + 4]
cmp bl, byte [edx + 8]
je 0x438df3
cmp edi, edx
jne 0x438db0
mov ebp, dword [eax + 4]
mov dword [ebp], ecx
mov ebx, dword [ecx + 4]
mov dword [ebx], edx
mov edi, dword [edx + 4]
mov dword [edi], eax
mov dword [edx + 4], ebx
mov edx, dword [esp + 0x1c]
mov dword [ecx + 4], ebp
mov dword [eax + 4], edi
mov dword [edx], eax
mov ebp, dword [esp + 0x14]
mov eax, ecx
cmp ecx, esi
jne 0x438d40
pop ebx
pop esi
pop edi
pop ebp
add esp, 8
ret 4
mov ebx, dword [eax + 4]
mov ebp, dword [edx]
mov dword [ebx], ecx
mov edi, dword [ecx + 4]
mov dword [edi], ebp
mov edx, dword [ebp + 4]
mov dword [edx], eax
mov dword [ebp + 4], edi
mov dword [ecx + 4], ebx
mov dword [eax + 4], edx
jmp 0x438ddb
push str.invalid_hash_bucket_count
call fcn.0044cdba
int3
Function at 0x439890
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
sub esp, 0x120
mov eax, dword [0x48fe40]
xor eax, esp
mov dword [esp + 0x11c], eax
push ebx
mov ebx, dword [esp + 0x128]
mov eax, ebx
push ebp
push esi
push edi
cmp dword [ebx + 0x14], 0x10
jb 0x4398b9
mov eax, dword [ebx]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x439a0e
mov edi, dword [ebx + 0x10]
test edi, edi
je 0x439a62
xor ebp, ebp
mov esi, 0x479fd0
lea ecx, [esi + 1]
nop
mov al, byte [esi]
inc esi
test al, al
jne 0x4398e0
sub esi, ecx
mov dword [esp + 0x10], ebx
cmp dword [ebx + 0x14], 0x10
jb 0x4398f9
mov eax, dword [ebx]
mov dword [esp + 0x10], eax
test esi, esi
je 0x439953
cmp ebp, edi
jae 0x439953
push 0x100
lea eax, [esp + 0x30]
push 0
push eax
call fcn.00450230
mov ecx, 0x479fd0
lea edx, [esi + 0x479fd0]
add esp, 0xc
cmp edx, ecx
je 0x439931
movzx eax, byte [ecx]
inc ecx
mov byte [esp + eax + 0x2c], 1
cmp ecx, edx
jne 0x439924
mov esi, dword [esp + 0x10]
lea edx, [edi + esi]
lea eax, [esi + ebp]
cmp eax, edx
jae 0x439953
nop
movzx ecx, byte [eax]
cmp byte [esp + ecx + 0x2c], 0
jne 0x439a29
inc eax
cmp eax, edx
jb 0x439940
or eax, 0xffffffff
cmp eax, 0xffffffff
mov dword [esp + 0x24], 0
mov esi, edi
mov dword [esp + 0x28], 0
cmovne esi, eax
xorps xmm0, xmm0
cmp edi, esi
mov ecx, esi
movups xmmword [esp + 0x14], xmm0
cmovb ecx, edi
mov eax, ebx
cmp dword [ebx + 0x14], 0x10
jb 0x439987
mov eax, dword [ebx]
push ecx
push eax
lea ecx, [esp + 0x1c]
call fcn.00401790
cmp dword [esp + 0x24], 0
je 0x4399ce
cmp dword [esp + 0x28], 0x10
lea eax, [esp + 0x14]
cmovae eax, dword [esp + 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x4399ce
cmp dword [esp + 0x28], 0x10
lea eax, [esp + 0x14]
cmovae eax, dword [esp + 0x14]
push eax
call fcn.0045d88e
add esp, 4
test eax, eax
jne 0x439a30
mov ecx, dword [esp + 0x28]
lea ebp, [esi + 1]
cmp ecx, 0x10
jb 0x439a03
mov edx, dword [esp + 0x14]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x4399f9
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x439a66
push ecx
push edx
call fcn.0044e17e
add esp, 8
mov edi, dword [ebx + 0x10]
cmp ebp, edi
jb 0x4398d6
mov al, 1
mov ecx, dword [esp + 0x12c]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.0044e4cb
add esp, 0x120
ret
sub eax, esi
jmp 0x439956
mov ecx, dword [esp + 0x28]
cmp ecx, 0x10
jb 0x439a62
mov edx, dword [esp + 0x14]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x439a58
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x439a66
push ecx
push edx
call fcn.0044e17e
add esp, 8
xor al, al
jmp 0x439a10
call fcn.004532bf
int3