joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4636c0
Capabilities:
Create udp socket

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, ecx
cmp dword [esi + 0x40], 1
jne 0x4636e1
mov eax, dword [ebp + 8]
test eax, eax
je 0x4636da
cmp word [eax], 0
jne 0x4636e1
mov dword [ebp + 8], str.255.255.255.255
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 8]
lea ebx, [esi + 0x60]
push ebx
push eax
push ecx
call fcn.0044ea40
add esp, 0xc
test eax, eax
jne 0x4636ff
pop esi
pop ebx
pop ebp
ret 0x10
mov eax, dword [ebp + 0x10]
push edi
test eax, eax
je 0x46370d
cmp word [eax], 0
jne 0x463726
mov eax, dword [ebp + 0xc]
mov dx, word [ebx]
mov edi, dword [ebp + 0x14]
push eax
mov word [edi], dx
call dword [sym.imp.WS2_32.dll_htons]
mov word [edi + 2], ax
jmp 0x46373b
mov edi, dword [ebp + 0x14]
mov ecx, dword [ebp + 0xc]
push edi
push ecx
push eax
call fcn.0044dbf0
add esp, 0xc
test eax, eax
je 0x46376e
cmp dword [esi + 0x40], 1
jne 0x46375b
cmp word [edi], 0x17
jne 0x46375b
push 0x273b
call dword [sym.imp.WS2_32.dll_WSASetLastError]
pop edi
pop esi
xor eax, eax
pop ebx
pop ebp
ret 0x10
movzx eax, word [ebx]
cmp ax, word [edi]
je 0x463777
push 0x273f
call dword [sym.imp.WS2_32.dll_WSASetLastError]
pop edi
pop esi
xor eax, eax
pop ebx
pop ebp
ret 0x10
push 0x11
push 2
push eax
call dword [sym.imp.WS2_32.dll_socket]
mov dword [esi + 0x1c], eax
cmp eax, 0xffffffff
je 0x46376e
push 0
push eax
call fcn.0044c890
add esp, 8
test eax, eax
je 0x4637a3
push 0x80004005
call fcn.00436780
mov eax, dword [esi + 0x28]
mov ecx, dword [esi + 0x1c]
push eax
push ecx
call fcn.0044c790
add esp, 8
test eax, eax
je 0x4637c1
push 0x80004005
call fcn.00436780
call dword [sym.imp.WS2_32.dll_WSACreateEvent]
mov edx, dword [ebp + 0xc]
mov dword [esi + 0x20], eax
mov eax, dword [ebp + 8]
push edx
push eax
mov ecx, esi
call fcn.00463690
pop edi
pop esi
mov eax, 1
pop ebx
pop ebp
ret 0x10

Function at 0x463b00
Capabilities:
Create thread

Disassembly:
push esi
mov esi, ecx
lea eax, [esi + 0x48]
push eax
push 0
push esi
push 0x4638f0
push 0
push 0
call dword [sym.imp.MSVCR100.dll__beginthreadex]
xor ecx, ecx
add esp, 0x18
test eax, eax
setne cl
mov dword [esi + 0x44], eax
pop esi
mov eax, ecx
ret
Function at 0x464e80
Capabilities:
Create udp socket

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, ecx
mov ecx, dword [ebp + 0x10]
test ecx, ecx
je 0x464e93
cmp word [ecx], 0
jne 0x464ea0
mov eax, dword [esi + 0x2c]
cmp eax, 1
jne 0x464edb
mov ecx, str.255.255.255.255
push ebx
mov ebx, dword [ebp + 0xc]
push edi
or edi, 0xffffffff
cmp dword [esi + 0x2c], edi
je 0x464ec3
lea eax, [esi + 0x30]
push eax
push ebx
push ecx
call fcn.0044dbf0
add esp, 0xc
test eax, eax
je 0x464f56
mov eax, dword [ebp + 8]
test eax, eax
je 0x464ed0
cmp word [eax], 0
jne 0x464f09
cmp dword [esi + 0x2c], edi
je 0x464ef1
movzx eax, word [esi + 0x30]
jmp 0x464ef6
test eax, eax
jne 0x464ea0
push 0x2741
call dword [sym.imp.WS2_32.dll_WSASetLastError]
xor eax, eax
pop esi
pop ebp
ret 0x10
mov eax, 2
mov edi, dword [ebp + 0x14]
push ebx
mov word [edi], ax
call dword [sym.imp.WS2_32.dll_htons]
mov word [edi + 2], ax
jmp 0x464f1b
mov edi, dword [ebp + 0x14]
push edi
push ebx
push eax
call fcn.0044dbf0
add esp, 0xc
test eax, eax
je 0x464f56
mov eax, dword [esi + 0x2c]
cmp eax, 1
jne 0x464f3d
cmp word [edi], 0x17
jne 0x464f3d
push 0x273b
call dword [sym.imp.WS2_32.dll_WSASetLastError]
pop edi
pop ebx
xor eax, eax
pop esi
pop ebp
ret 0x10
cmp eax, 0xffffffff
je 0x464f5f
mov cx, word [esi + 0x30]
cmp cx, word [edi]
je 0x464f5f
push 0x273f
call dword [sym.imp.WS2_32.dll_WSASetLastError]
pop edi
pop ebx
xor eax, eax
pop esi
pop ebp
ret 0x10
movzx edx, word [edi]
push 0x11
push 2
push edx
call dword [sym.imp.WS2_32.dll_socket]
mov dword [esi + 0x15c], eax
cmp eax, 0xffffffff
je 0x464f56
push 0
push eax
call fcn.0044c890
add esp, 8
test eax, eax
je 0x464f91
push 0x80004005
call fcn.00436780
mov eax, dword [esi + 0x15c]
push 1
push eax
call fcn.0044c5e0
add esp, 8
test eax, eax
je 0x464fb0
push 0x80004005
call fcn.00436780
mov ecx, dword [esi + 8]
mov edx, dword [esi + 0x15c]
push ecx
push edx
call fcn.0044c790
add esp, 8
test eax, eax
je 0x464fd1
push 0x80004005
call fcn.00436780
pop edi
pop ebx
mov eax, 1
pop esi
pop ebp
ret 0x10

Function at 0x465460
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
mov edi, dword [ebp + 8]
xor eax, eax
cmp word [edi], 2
mov esi, ecx
setne al
dec eax
and eax, 0xfffffff4
add eax, 0x1c
push eax
mov eax, dword [esi + 0x15c]
push edi
push eax
call dword [sym.imp.WS2_32.dll_bind]
cmp eax, 0xffffffff
jne 0x465496
pop edi
xor eax, eax
pop esi
pop ebp
ret 4
xor eax, eax
cmp word [edi], 2
lea ecx, [ebp + 8]
setne al
push ecx
lea edx, [esi + 0x4c]
push edx
dec eax
and eax, 0xfffffff4
add eax, 0x1c
mov dword [ebp + 8], eax
mov eax, dword [esi + 0x15c]
push eax
call dword [sym.imp.WS2_32.dll_getsockname]
cmp eax, 0xffffffff
jne 0x4654cd
push 0x80004005
call fcn.00436780
pop edi
mov eax, 1
pop esi
pop ebp
ret 4
Function at 0x466a10
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
mov ebx, ecx
cmp dword [ebx + 0xc], 0
mov dword [ebp - 8], ebx
mov dword [ebp - 0x10], 1
mov dword [ebp - 0xc], 0
jbe 0x466b68
push esi
push edi
push 0
push 0
push ebx
push 0x466860
push 0
push 0
call dword [sym.imp.MSVCR100.dll__beginthreadex]
mov edi, eax
add esp, 0x18
mov dword [ebp - 4], edi
test edi, edi
je 0x466b48
mov eax, dword [ebx + 0x170]
lea esi, [ebx + 0x16c]
lea ecx, [ebp - 4]
cmp ecx, eax
jae 0x466ad1
mov edx, dword [esi]
cmp edx, ecx
ja 0x466ad1
mov edi, ecx
mov ecx, dword [esi + 8]
sub edi, edx
sar edi, 2
cmp eax, ecx
jne 0x466ac1
sub eax, edx
sar eax, 2
cmp eax, 0x3ffffffe
ja 0x466b3d
sub ecx, edx
inc eax
sar ecx, 2
cmp eax, ecx
jbe 0x466ac1
mov edx, ecx
shr edx, 1
mov ebx, 0x3fffffff
sub ebx, edx
cmp ebx, ecx
jae 0x466aae
xor ecx, ecx
jmp 0x466ab0
add ecx, edx
cmp ecx, eax
jae 0x466ab6
mov ecx, eax
push ecx
mov ecx, esi
call fcn.00480580
mov ebx, dword [ebp - 8]
mov eax, dword [esi + 4]
test eax, eax
je 0x466b1f
mov edx, dword [esi]
mov ecx, dword [edx + edi*4]
mov dword [eax], ecx
jmp 0x466b1f
mov ecx, dword [esi + 8]
cmp eax, ecx
jne 0x466b16
mov edx, dword [esi]
sub eax, edx
sar eax, 2
cmp eax, 0x3ffffffe
ja 0x466b3d
sub ecx, edx
inc eax
sar ecx, 2
cmp eax, ecx
jbe 0x466b16
mov edx, ecx
shr edx, 1
mov ebx, 0x3fffffff
sub ebx, edx
cmp ebx, ecx
jae 0x466b03
xor ecx, ecx
jmp 0x466b05
add ecx, edx
cmp ecx, eax
jae 0x466b0b
mov ecx, eax
push ecx
mov ecx, esi
call fcn.00480580
mov ebx, dword [ebp - 8]
mov eax, dword [esi + 4]
test eax, eax
je 0x466b1f
mov dword [eax], edi
mov eax, dword [ebp - 0xc]
add dword [esi + 4], 4
inc eax
mov dword [ebp - 0xc], eax
cmp eax, dword [ebx + 0xc]
jb 0x466a36
mov eax, dword [ebp - 0x10]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push str.vector_T__too_long
call dword [sym.imp.MSVCP100.dll_void___cdecl_std::_Xlength_error_char_const__]
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
mov dword [ebx + 0x168], 8
call dword [sym.imp.KERNEL32.dll_SetLastError]
pop edi
mov dword [ebp - 0x10], 0
pop esi
mov eax, dword [ebp - 0x10]
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x46d790
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
mov ebx, ecx
cmp dword [ebx + 0x14], 0
mov dword [ebp - 8], ebx
mov dword [ebp - 0x10], 1
mov dword [ebp - 0xc], 0
jbe 0x46d8df
push esi
push edi
push 0
push 0
push ebx
push 0x46d660
push 0
push 0
call dword [sym.imp.MSVCR100.dll__beginthreadex]
mov edi, eax
add esp, 0x18
mov dword [ebp - 4], edi
test edi, edi
je 0x46d8c2
mov eax, dword [ebx + 0x70]
lea esi, [ebx + 0x6c]
lea ecx, [ebp - 4]
cmp ecx, eax
jae 0x46d84b
mov edx, dword [esi]
cmp edx, ecx
ja 0x46d84b
mov edi, ecx
mov ecx, dword [esi + 8]
sub edi, edx
sar edi, 2
cmp eax, ecx
jne 0x46d83b
sub eax, edx
sar eax, 2
cmp eax, 0x3ffffffe
ja 0x46d8b7
sub ecx, edx
inc eax
sar ecx, 2
cmp eax, ecx
jbe 0x46d83b
mov edx, ecx
shr edx, 1
mov ebx, 0x3fffffff
sub ebx, edx
cmp ebx, ecx
jae 0x46d828
xor ecx, ecx
jmp 0x46d82a
add ecx, edx
cmp ecx, eax
jae 0x46d830
mov ecx, eax
push ecx
mov ecx, esi
call fcn.00480580
mov ebx, dword [ebp - 8]
mov eax, dword [esi + 4]
test eax, eax
je 0x46d899
mov edx, dword [esi]
mov ecx, dword [edx + edi*4]
mov dword [eax], ecx
jmp 0x46d899
mov ecx, dword [esi + 8]
cmp eax, ecx
jne 0x46d890
mov edx, dword [esi]
sub eax, edx
sar eax, 2
cmp eax, 0x3ffffffe
ja 0x46d8b7
sub ecx, edx
inc eax
sar ecx, 2
cmp eax, ecx
jbe 0x46d890
mov edx, ecx
shr edx, 1
mov ebx, 0x3fffffff
sub ebx, edx
cmp ebx, ecx
jae 0x46d87d
xor ecx, ecx
jmp 0x46d87f
add ecx, edx
cmp ecx, eax
jae 0x46d885
mov ecx, eax
push ecx
mov ecx, esi
call fcn.00480580
mov ebx, dword [ebp - 8]
mov eax, dword [esi + 4]
test eax, eax
je 0x46d899
mov dword [eax], edi
mov eax, dword [ebp - 0xc]
add dword [esi + 4], 4
inc eax
mov dword [ebp - 0xc], eax
cmp eax, dword [ebx + 0x14]
jb 0x46d7b6
mov eax, dword [ebp - 0x10]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push str.vector_T__too_long
call dword [sym.imp.MSVCP100.dll_void___cdecl_std::_Xlength_error_char_const__]
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
mov dword [ebx + 0x68], 8
call dword [sym.imp.KERNEL32.dll_SetLastError]
pop edi
mov dword [ebp - 0x10], 0
pop esi
mov eax, dword [ebp - 0x10]
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x470a90
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
mov ebx, ecx
cmp dword [ebx + 0x14], 0
mov dword [ebp - 8], ebx
mov dword [ebp - 0x10], 1
mov dword [ebp - 0xc], 0
jbe 0x470bdf
push esi
push edi
push 0
push 0
push ebx
push 0x470980
push 0
push 0
call dword [sym.imp.MSVCR100.dll__beginthreadex]
mov edi, eax
add esp, 0x18
mov dword [ebp - 4], edi
test edi, edi
je 0x470bc2
mov eax, dword [ebx + 0x7c]
lea esi, [ebx + 0x78]
lea ecx, [ebp - 4]
cmp ecx, eax
jae 0x470b4b
mov edx, dword [esi]
cmp edx, ecx
ja 0x470b4b
mov edi, ecx
mov ecx, dword [esi + 8]
sub edi, edx
sar edi, 2
cmp eax, ecx
jne 0x470b3b
sub eax, edx
sar eax, 2
cmp eax, 0x3ffffffe
ja 0x470bb7
sub ecx, edx
inc eax
sar ecx, 2
cmp eax, ecx
jbe 0x470b3b
mov edx, ecx
shr edx, 1
mov ebx, 0x3fffffff
sub ebx, edx
cmp ebx, ecx
jae 0x470b28
xor ecx, ecx
jmp 0x470b2a
add ecx, edx
cmp ecx, eax
jae 0x470b30
mov ecx, eax
push ecx
mov ecx, esi
call fcn.00480580
mov ebx, dword [ebp - 8]
mov eax, dword [esi + 4]
test eax, eax
je 0x470b99
mov edx, dword [esi]
mov ecx, dword [edx + edi*4]
mov dword [eax], ecx
jmp 0x470b99
mov ecx, dword [esi + 8]
cmp eax, ecx
jne 0x470b90
mov edx, dword [esi]
sub eax, edx
sar eax, 2
cmp eax, 0x3ffffffe
ja 0x470bb7
sub ecx, edx
inc eax
sar ecx, 2
cmp eax, ecx
jbe 0x470b90
mov edx, ecx
shr edx, 1
mov ebx, 0x3fffffff
sub ebx, edx
cmp ebx, ecx
jae 0x470b7d
xor ecx, ecx
jmp 0x470b7f
add ecx, edx
cmp ecx, eax
jae 0x470b85
mov ecx, eax
push ecx
mov ecx, esi
call fcn.00480580
mov ebx, dword [ebp - 8]
mov eax, dword [esi + 4]
test eax, eax
je 0x470b99
mov dword [eax], edi
mov eax, dword [ebp - 0xc]
add dword [esi + 4], 4
inc eax
mov dword [ebp - 0xc], eax
cmp eax, dword [ebx + 0x14]
jb 0x470ab6
mov eax, dword [ebp - 0x10]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push str.vector_T__too_long
call dword [sym.imp.MSVCP100.dll_void___cdecl_std::_Xlength_error_char_const__]
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
mov dword [ebx + 0x58], 8
call dword [sym.imp.KERNEL32.dll_SetLastError]
pop edi
mov dword [ebp - 0x10], 0
pop esi
mov eax, dword [ebp - 0x10]
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4714e0
Capabilities:
Create udp socket

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
sub esp, 0x1c
push esi
push edi
xor edi, edi
mov esi, ecx
test eax, eax
je 0x4714f8
cmp word [eax], di
jne 0x4714fd
mov eax, str.0.0.0.0
xor ecx, ecx
lea edx, [ebp - 0x1c]
mov word [ebp - 0x1c], cx
mov ecx, dword [ebp + 0xc]
push edx
push ecx
push eax
call fcn.0044dbf0
add esp, 0xc
test eax, eax
je 0x47163b
mov ax, word [ebp - 0x1c]
push 0x11
movzx edx, ax
push 2
push edx
mov word [esi + 0x124], ax
call dword [sym.imp.WS2_32.dll_socket]
mov dword [esi + 0x12c], eax
cmp eax, 0xffffffff
je 0x47163b
push 0
push eax
call fcn.0044c890
add esp, 8
test eax, eax
je 0x47155d
push 0x80004005
call fcn.00436780
mov eax, dword [esi + 4]
mov ecx, dword [esi + 0x12c]
push eax
push ecx
call fcn.0044c790
add esp, 8
test eax, eax
je 0x47157e
push 0x80004005
call fcn.00436780
mov edx, dword [esi + 0x12c]
push 1
push edx
call fcn.0044c5e0
add esp, 8
test eax, eax
je 0x47159d
push 0x80004005
call fcn.00436780
mov ecx, dword [esi + 0x12c]
xor eax, eax
cmp word [ebp - 0x1c], 2
setne al
dec eax
and eax, 0xfffffff4
add eax, 0x1c
push eax
lea eax, [ebp - 0x1c]
push eax
push ecx
call dword [sym.imp.WS2_32.dll_bind]
cmp eax, 0xffffffff
je 0x47161c
push 0
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov edx, dword [esi]
mov eax, dword [esi + 0x12c]
mov edx, dword [edx + 0xe4]
push eax
mov ecx, esi
call edx
cmp eax, 2
je 0x4715f4
mov edi, 1
mov eax, edi
pop edi
pop esi
mov esp, ebp
pop ebp
ret 8
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x471603
mov eax, 0x4c7
push eax
push str.CUdpServer::CreateListenSocket
push 5
mov ecx, esi
call fcn.00470dc0
mov eax, edi
pop edi
pop esi
mov esp, ebp
pop ebp
ret 8
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push eax
push str.CUdpServer::CreateListenSocket
push 4
mov ecx, esi
call fcn.00470dc0
mov eax, edi
pop edi
pop esi
mov esp, ebp
pop ebp
ret 8
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push eax
mov dword [esi + 0x138], 3
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, edi
pop edi
pop esi
mov esp, ebp
pop ebp
ret 8

Function at 0x4717c0
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, ecx
mov eax, dword [esi]
mov edx, dword [eax + 0x2c]
push edi
mov edi, 1
call edx
test eax, eax
jne 0x4717e1
xor edi, edi
mov eax, edi
pop edi
pop esi
pop ebp
ret 8
mov eax, dword [ebp + 0xc]
add eax, 8
xor ecx, ecx
cmp word [eax], 2
setne cl
dec ecx
and ecx, 0xfffffff4
add ecx, 0x1c
push ecx
push eax
mov eax, dword [esi + 0x12c]
push 0
push 0
push 0
push eax
call dword [sym.imp.WS2_32.dll_sendto]
cmp eax, 0xffffffff
jne 0x471837
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x2733
je 0x471837
mov edx, dword [esi]
mov eax, dword [edx + 0x2c]
mov ecx, esi
xor edi, edi
call eax
test eax, eax
je 0x4717d9
push 0x80004005
call fcn.00436780
mov ecx, dword [ebp + 8]
push ecx
push str._S_CNNID:__Iu__send_0_bytes__detect_package__n
call fcn.00438830
add esp, 8
mov eax, edi
pop edi
pop esi
pop ebp
ret 8
Function at 0x471ef0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
push esi
mov esi, dword [eax]
xor eax, eax
cmp word [esi], 2
push edi
setne al
mov edx, 0x811c9dc5
lea edi, [eax - 1]
and edi, 0xffffffec
add edi, 0x1c
xor eax, eax
test edi, edi
jle 0x471f32
push ebx
jmp 0x471f20
movzx ebx, byte [eax + esi]
imul edx, edx, 0x1000193
inc eax
xor edx, ebx
cmp eax, edi
jl 0x471f20
pop ebx
mov esi, dword [ecx + 0x20]
mov eax, esi
and eax, edx
cmp dword [ecx + 0x24], eax
ja 0x471f47
shr esi, 1
or ecx, 0xffffffff
sub ecx, esi
add eax, ecx
pop edi
pop esi
pop ebp
ret 4

Function at 0x4738a0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 0xc]
push ebx
mov ebx, ecx
mov ecx, dword [ebx + 4]
mov dword [ebp - 4], ebx
cmp eax, dword [ecx]
jne 0x4738d1
cmp dword [ebp + 0x10], ecx
jne 0x4738d1
mov ecx, ebx
call fcn.00473810
mov eax, dword [ebx + 4]
mov ecx, dword [eax]
mov eax, dword [ebp + 8]
mov dword [eax], ecx
pop ebx
mov esp, ebp
pop ebp
ret 0xc
cmp eax, dword [ebp + 0x10]
je 0x47398f
push esi
push edi
lea esp, [esp]
mov edx, dword [eax]
mov dword [ebp + 0xc], edx
mov esi, dword [eax + 8]
xor ecx, ecx
cmp word [esi], 2
mov edx, 0x811c9dc5
setne cl
lea edi, [ecx - 1]
and edi, 0xffffffec
add edi, 0x1c
xor ecx, ecx
test edi, edi
jle 0x473919
movzx ebx, byte [ecx + esi]
imul edx, edx, 0x1000193
inc ecx
xor edx, ebx
cmp ecx, edi
jl 0x473905
mov ebx, dword [ebp - 4]
mov esi, dword [ebx + 0x20]
mov ecx, esi
and ecx, edx
cmp dword [ebx + 0x24], ecx
ja 0x47392e
shr esi, 1
or edx, 0xffffffff
sub edx, esi
add ecx, edx
mov edx, dword [ebx + 0x10]
cmp dword [edx + ecx*8 + 4], eax
lea edx, [edx + ecx*8]
jne 0x473957
cmp dword [edx], eax
jne 0x47394f
mov esi, dword [ebx + 4]
mov dword [edx], esi
mov edx, dword [ebx + 0x10]
mov esi, dword [ebx + 4]
mov dword [edx + ecx*8 + 4], esi
jmp 0x47395f
mov ecx, dword [eax + 4]
mov dword [edx + 4], ecx
jmp 0x47395f
cmp dword [edx], eax
jne 0x47395f
mov ecx, dword [eax]
mov dword [edx], ecx
cmp eax, dword [ebx + 4]
je 0x47397f
mov edx, dword [eax + 4]
mov ecx, dword [eax]
mov dword [edx], ecx
mov edx, dword [eax]
mov ecx, dword [eax + 4]
push eax
mov dword [edx + 4], ecx
call sub.mfc100u.dll_delete
add esp, 4
dec dword [ebx + 8]
mov edx, dword [ebp + 0x10]
mov eax, dword [ebp + 0xc]
cmp eax, edx
jne 0x4738e0
pop edi
pop esi
mov ecx, dword [ebp + 8]
mov dword [ecx], eax
mov eax, ecx
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x4753a0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
mov ebx, ecx
cmp dword [ebx + 0x14], 0
mov dword [ebp - 8], ebx
mov dword [ebp - 0x10], 1
mov dword [ebp - 0xc], 0
jbe 0x4754f8
push esi
push edi
push 0
push 0
push ebx
push 0x475200
push 0
push 0
call dword [sym.imp.MSVCR100.dll__beginthreadex]
mov edi, eax
add esp, 0x18
mov dword [ebp - 4], edi
test edi, edi
je 0x4754d8
mov eax, dword [ebx + 0x140]
lea esi, [ebx + 0x13c]
lea ecx, [ebp - 4]
cmp ecx, eax
jae 0x475461
mov edx, dword [esi]
cmp edx, ecx
ja 0x475461
mov edi, ecx
mov ecx, dword [esi + 8]
sub edi, edx
sar edi, 2
cmp eax, ecx
jne 0x475451
sub eax, edx
sar eax, 2
cmp eax, 0x3ffffffe
ja 0x4754cd
sub ecx, edx
inc eax
sar ecx, 2
cmp eax, ecx
jbe 0x475451
mov edx, ecx
shr edx, 1
mov ebx, 0x3fffffff
sub ebx, edx
cmp ebx, ecx
jae 0x47543e
xor ecx, ecx
jmp 0x475440
add ecx, edx
cmp ecx, eax
jae 0x475446
mov ecx, eax
push ecx
mov ecx, esi
call fcn.00480580
mov ebx, dword [ebp - 8]
mov eax, dword [esi + 4]
test eax, eax
je 0x4754af
mov edx, dword [esi]
mov ecx, dword [edx + edi*4]
mov dword [eax], ecx
jmp 0x4754af
mov ecx, dword [esi + 8]
cmp eax, ecx
jne 0x4754a6
mov edx, dword [esi]
sub eax, edx
sar eax, 2
cmp eax, 0x3ffffffe
ja 0x4754cd
sub ecx, edx
inc eax
sar ecx, 2
cmp eax, ecx
jbe 0x4754a6
mov edx, ecx
shr edx, 1
mov ebx, 0x3fffffff
sub ebx, edx
cmp ebx, ecx
jae 0x475493
xor ecx, ecx
jmp 0x475495
add ecx, edx
cmp ecx, eax
jae 0x47549b
mov ecx, eax
push ecx
mov ecx, esi
call fcn.00480580
mov ebx, dword [ebp - 8]
mov eax, dword [esi + 4]
test eax, eax
je 0x4754af
mov dword [eax], edi
mov eax, dword [ebp - 0xc]
add dword [esi + 4], 4
inc eax
mov dword [ebp - 0xc], eax
cmp eax, dword [ebx + 0x14]
jb 0x4753c6
mov eax, dword [ebp - 0x10]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push str.vector_T__too_long
call dword [sym.imp.MSVCP100.dll_void___cdecl_std::_Xlength_error_char_const__]
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
mov dword [ebx + 0x138], 8
call dword [sym.imp.KERNEL32.dll_SetLastError]
pop edi
mov dword [ebp - 0x10], 0
pop esi
mov eax, dword [ebp - 0x10]
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x479330
Capabilities:
Create thread
Resume thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, ecx
mov eax, dword [esi + 0xc]
push edi
xor edi, edi
cmp eax, edi
je 0x479364
lea ecx, [ebp - 4]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetExitCodeThread]
test eax, eax
je 0x479364
xor eax, eax
cmp dword [ebp - 4], 0x103
sete al
cmp eax, edi
jne 0x479452
mov eax, dword [esi + 0xc]
cmp eax, edi
je 0x47938c
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
mov dword [esi + 8], edi
mov dword [esi + 0xc], edi
mov dword [esi + 0x10], eax
mov dword [esi + 0x14], eax
mov dword [esi + 0x18], eax
mov dword [esi + 0x1c], eax
mov dword [esi + 0x20], eax
mov dword [esi + 0x24], eax
push 0x18
call sub.mfc100u.dll_new
add esp, 4
cmp eax, edi
je 0x4793b3
mov edx, dword [ebp + 8]
mov dword [eax], edx
mov ecx, dword [ebp + 0xc]
mov dword [eax + 8], ecx
mov edx, dword [ebp + 0x10]
mov ecx, dword [ebp + 0x14]
mov dword [eax + 0xc], edx
mov dword [eax + 0x10], ecx
mov edi, eax
mov edx, dword [edi]
mov dword [esi + 0x10], edx
mov eax, dword [edi + 4]
mov dword [esi + 0x14], eax
mov ecx, dword [edi + 8]
mov dword [esi + 0x18], ecx
mov edx, dword [edi + 0xc]
mov dword [esi + 0x1c], edx
mov eax, dword [edi + 0x10]
mov dword [esi + 0x20], eax
mov ecx, dword [edi + 0x14]
mov eax, dword [ebp + 0x1c]
push ebx
mov ebx, dword [ebp + 0x18]
lea edx, [esi + 8]
mov dword [esi + 0x24], ecx
mov ecx, dword [ebp + 0x20]
push edx
test ebx, ebx
jne 0x4793ff
push ebx
push edi
push 0x477fd0
push eax
push ecx
call dword [sym.imp.MSVCR100.dll__beginthreadex]
add esp, 0x18
mov dword [esi + 0xc], eax
jmp 0x47942b
push 4
push edi
push 0x477fd0
push eax
push ecx
call dword [sym.imp.MSVCR100.dll__beginthreadex]
add esp, 0x18
mov dword [esi + 0xc], eax
test eax, eax
je 0x47942b
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
mov edx, dword [esi + 0xc]
push edx
call dword [sym.imp.KERNEL32.dll_ResumeThread]
cmp dword [esi + 0xc], 0
pop ebx
jne 0x479467
push 0x65f
call dword [sym.imp.KERNEL32.dll_SetLastError]
push edi
xor esi, esi
call sub.mfc100u.dll_delete
add esp, 4
pop edi
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret 0x1c
push 0x139f
call dword [sym.imp.KERNEL32.dll_SetLastError]
pop edi
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret 0x1c
pop edi
mov eax, 1
pop esi
mov esp, ebp
pop ebp
ret 0x1c
Function at 0x47a3f0
Capabilities:
Get number of processors
Get process heap flags

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5d09e2
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x65db30]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
mov eax, dword [ebp + 8]
mov edx, dword [ebp + 0x10]
mov ecx, dword [ebp + 0xc]
mov dword [esi + 4], eax
lea eax, [ebp + 0xb]
mov dword [esi + 0x10], edx
push eax
lea edx, [ebp + 0xa]
xor edi, edi
mov dword [esi + 0xc], ecx
lea ecx, [esi + 0x38]
push edx
mov dword [esi], edi
mov dword [esi + 8], edi
call fcn.0043c370
lea eax, [ebp + 0xb]
push eax
lea edx, [ebp + 0xa]
lea ecx, [esi + 0x64]
push edx
mov dword [ebp - 4], edi
call fcn.0043c370
mov eax, dword [0x65db58]
mov edx, dword [eax + 0xc]
mov ecx, 0x65db58
mov byte [ebp - 4], 1
call edx
add eax, 0x10
mov dword [esi + 0x90], eax
mov eax, dword [0x65db58]
mov edx, dword [eax + 0xc]
mov ecx, 0x65db58
mov byte [ebp - 4], 2
call edx
add eax, 0x10
mov dword [esi + 0x94], eax
mov eax, dword [esi + 4]
mov ecx, eax
neg ecx
sbb ecx, ecx
and ecx, 0xffff0001
add ecx, 0xffff
mov byte [ebp - 4], 3
mov word [esi + 0x98], cx
mov dword [esi + 0x9c], edi
mov dword [esi + 0xa0], edi
mov dword [esi + 0xa4], edi
mov dword [esi + 0xa8], edi
cmp eax, edi
je 0x47a4f8
push 0x20
call sub.mfc100u.dll_new__
add esp, 4
cmp eax, edi
je 0x47a51f
push fcn.00437cb0
push 0x438270
push 7
lea ebx, [eax + 4]
push 4
push ebx
mov dword [eax], 7
call fcn.005c5a5b
jmp 0x47a521
push 4
call sub.mfc100u.dll_new
mov ebx, eax
add esp, 4
cmp ebx, edi
je 0x47a51f
mov edx, dword [0x65db58]
mov eax, dword [edx + 0xc]
mov ecx, 0x65db58
call eax
add eax, 0x10
mov dword [ebx], eax
jmp 0x47a521
xor ebx, ebx
xor ecx, ecx
cmp dword [esi + 4], edi
lea edx, [esi + 0x18]
sete cl
mov dword [esi + 0x9c], ebx
push ecx
push edx
call fcn.0045a560
add esp, 8
mov dword [esi + 0x30], esi
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x4800a0
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 8]
mov edx, dword [ecx]
movzx ecx, word [edx]
mov eax, 0x811c9dc5
test cx, cx
je 0x4800d9
push esi
lea esi, [ecx - 0x41]
add edx, 2
cmp si, 0x19
ja 0x4800c5
add ecx, 0x20
imul eax, eax, 0x1000193
movzx ecx, cx
xor eax, ecx
movzx ecx, word [edx]
test cx, cx
jne 0x4800b6
pop esi
pop ebp
ret 4