joyce8/EMBER2024-capa huggingface dataset:
Function at 0x425140
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x24
mov eax, dword [0x501040]
xor eax, esp
mov dword [esp + 0x20], eax
push ebx
push esi
push edi
mov edi, dword [ebp + 0x10]
mov ebx, ecx
mov eax, dword [edi + 0x20]
sub eax, 3
je 0x4252ac
sub eax, 1
jne 0x4252b2
mov esi, dword [ebp + 0xc]
test esi, esi
je 0x4252ac
mov eax, dword [edi + 0x1c]
mov ecx, dword [edi + 0x18]
mov dword [esp + 0x28], eax
mov dword [esp + 0x1c], eax
mov eax, dword [edi + 0x50]
mov dword [esp + 0x24], ecx
mov dword [esp + 0x18], ecx
cmp eax, 0x11
jne 0x4251b6
push dword [edi + 0x40]
mov ecx, dword [ebx + 0x1c]
lea eax, [edi + 0x24]
push eax
push esi
push dword [edi + 0x44]
mov edx, dword [ecx]
push dword [esp + 0x38]
push dword [esp + 0x38]
call dword [edx]
jmp 0x4251d6
cmp eax, 1
jne 0x4251d6
push dword [edi + 0x40]
mov ecx, dword [ebx + 0x1c]
lea eax, [edi + 0x24]
push eax
push esi
push dword [edi + 0x44]
mov edx, dword [ecx]
push dword [esp + 0x38]
push dword [esp + 0x38]
call dword [edx + 4]
xorps xmm0, xmm0
lea eax, [ebx + 0x84]
movups xmmword [edi], xmm0
push eax
mov dword [edi + 0x10], 0
call fcn.00474987
add esp, 4
lea ecx, [esp + 0x18]
push ecx
lea ecx, [esp + 0x10]
push ecx
lea ecx, [ebx + 0x28]
call fcn.004195b0
mov esi, dword [esp + 0x14]
cmp byte [esi + 0xd], 0
jne 0x425235
mov eax, dword [esp + 0x28]
cmp eax, dword [esi + 0x14]
jb 0x425235
ja 0x425222
mov eax, dword [esp + 0x24]
cmp eax, dword [esi + 0x10]
jb 0x425235
cmp esi, dword [ebx + 0x28]
je 0x425235
mov esi, dword [esi + 0x18]
call fcn.00459f00
mov dword [esi + 0x70], eax
mov dword [esi + 0x74], edx
lea eax, [ebx + 0x84]
push eax
call fcn.004749a3
mov ecx, dword [edi + 0x44]
add esp, 4
mov esi, dword [ebp + 8]
mov dword [esp + 0x1c], ecx
mov eax, dword [edi + 0x48]
push 0
sub eax, ecx
mov dword [esp + 0x28], 0
mov dword [esp + 0x1c], eax
lea eax, [edi + 0x40]
push edi
push eax
mov dword [eax], 0x1c
lea eax, [edi + 0x24]
push eax
lea eax, [esp + 0x34]
push eax
lea eax, [esp + 0x3c]
push eax
push 1
lea eax, [esp + 0x34]
push eax
push esi
call dword [sym.imp.WS2_32.dll_WSARecvFrom]
test eax, eax
je 0x4252b2
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x3e5
je 0x4252b2
push edi
push esi
push 0
push dword [ebx + 4]
call dword [sym.imp.KERNEL32.dll_PostQueuedCompletionStatus]
test eax, eax
jne 0x4252b2
mov ecx, ebx
push edi
call fcn.0041c2a0
mov ecx, dword [esp + 0x2c]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.0047299a
mov esp, ebp
pop ebp
ret 0x10
Function at 0x4269d0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4c22b8
mov eax, dword fs:[0]
push eax
sub esp, 8
push esi
push edi
mov eax, dword [0x501040]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x10], edi
mov dword [edi], 0
lea esi, [edi + 0xc]
mov byte [edi + 4], 0
mov dword [edi + 8], 0
mov dword [ebp - 0x14], esi
mov dword [esi], 0
push 0x24
mov dword [esi + 4], 0
mov dword [esi + 8], 0
call fcn.00472c0c
add esp, 4
mov dword [eax], eax
mov dword [eax + 4], eax
mov dword [esi + 4], eax
lea ecx, [esi + 0xc]
mov dword [ebp - 4], 0
mov dword [ecx], 0
mov dword [ecx + 4], 0
mov dword [ecx + 8], 0
mov byte [ebp - 4], 1
mov dword [esi + 0x18], 7
mov dword [esi + 0x1c], 8
mov dword [esi], 0x3f800000
push dword [esi + 4]
push 0x10
call fcn.00407750
mov dword [ebp - 4], 2
mov dword [edi + 0x2c], 0
mov dword [edi + 0x30], 0
mov dword [edi + 0x34], 0
mov byte [ebp - 4], 3
lea esi, [edi + 0x38]
mov dword [ebp - 0x14], esi
push 0x34
mov dword [esi], 0
mov dword [esi + 4], 0
call fcn.00472c0c
mov dword [eax], eax
mov dword [eax + 4], eax
mov dword [eax + 8], eax
mov word [eax + 0xc], 0x101
mov dword [esi], eax
mov byte [ebp - 4], 4
lea esi, [edi + 0x40]
mov dword [ebp - 0x14], esi
push 0x34
mov dword [esi], 0
mov dword [esi + 4], 0
call fcn.00472c0c
add esp, 8
mov dword [eax], eax
mov dword [eax + 4], eax
mov dword [eax + 8], eax
mov word [eax + 0xc], 0x101
mov dword [esi], eax
lea ecx, [edi + 0x48]
mov byte [ebp - 4], 5
call fcn.0042b300
mov byte [ebp - 4], 6
lea esi, [edi + 0x68]
mov dword [ebp - 0x14], esi
push 0x34
mov dword [esi], 0
mov dword [esi + 4], 0
call fcn.00472c0c
add esp, 4
mov dword [eax], eax
mov dword [eax + 4], eax
mov dword [eax + 8], eax
mov word [eax + 0xc], 0x101
mov dword [esi], eax
mov dword [edi + 0x70], 0
mov dword [edi + 0x74], 0
mov dword [edi + 0x78], 0
mov byte [ebp - 4], 8
lea ecx, [edi + 0x80]
mov dword [edi + 0x7c], 0
call fcn.0042b180
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x426bd0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4c2311
mov eax, dword fs:[0]
push eax
sub esp, 8
push esi
push edi
mov eax, dword [0x501040]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x10], edi
xorps xmm0, xmm0
xor eax, eax
movups xmmword [edi + 0x10], xmm0
mov dword [edi + 0x20], 0
mov dword [edi + 0x24], 7
mov word [edi + 0x10], ax
mov dword [ebp - 4], eax
mov dword [edi + 0x28], eax
mov dword [edi + 0x2c], eax
mov dword [edi + 0x30], eax
lea esi, [edi + 0x34]
mov byte [ebp - 4], 1
push 0x28
mov dword [ebp - 0x14], esi
mov dword [esi], eax
mov dword [esi + 4], eax
call fcn.00472c0c
mov dword [eax], eax
mov dword [eax + 4], eax
mov dword [eax + 8], eax
mov word [eax + 0xc], 0x101
mov dword [esi], eax
lea esi, [edi + 0x3c]
mov byte [ebp - 4], 2
push 0x28
mov dword [ebp - 0x14], esi
mov dword [esi], 0
mov dword [esi + 4], 0
call fcn.00472c0c
mov dword [eax], eax
mov dword [eax + 4], eax
mov dword [eax + 8], eax
mov word [eax + 0xc], 0x101
mov dword [esi], eax
lea esi, [edi + 0x44]
mov byte [ebp - 4], 3
push 0x28
mov dword [ebp - 0x14], esi
mov dword [esi], 0
mov dword [esi + 4], 0
call fcn.00472c0c
add esp, 0xc
mov dword [eax], eax
mov dword [eax + 4], eax
mov dword [eax + 8], eax
mov word [eax + 0xc], 0x101
mov dword [esi], eax
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x427ed0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4c23d5
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
mov eax, dword [0x501040]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
xor bl, bl
mov eax, 1
mov ecx, 0x5049cc
xchg dword [ecx], eax
test eax, eax
jne 0x427f26
push 1
push eax
push 0x425d70
push eax
push 0x2710
call dword [sym.imp.WINMM.dll_timeSetEvent]
mov dword [0x5049bc], eax
cmp dword [0x501e98], 7
mov edi, 0x501e84
mov esi, dword [sym.imp.KERNEL32.dll_CreateSemaphoreW]
cmova edi, dword [0x501e84]
push 0
push 0xf4240
push 0
push 0
call esi
mov dword [0x5049b0], eax
test eax, eax
je 0x4280b6
push 0
push 0xf4240
push 0
push 0
call esi
mov dword [0x5049b4], eax
test eax, eax
je 0x4280b6
push 0
push 0xf4240
push 0
push 0
call esi
mov dword [0x5049c4], eax
test eax, eax
je 0x4280b6
mov esi, dword [sym.imp.KERNEL32.dll_CreateEventW]
push 0
push 0
push 0
push 0
call esi
mov dword [0x5049d4], eax
test eax, eax
je 0x4280b6
push 0
push 0
push 0
push 0
call esi
mov dword [0x5049b8], eax
test eax, eax
je 0x4280b6
push 0
push 0
push 1
push 0
call esi
mov dword [0x5049c8], eax
test eax, eax
je 0x4280b6
push edi
push 0
push 0
push 0
call esi
mov dword [0x5049d0], eax
test eax, eax
jne 0x428000
push edi
push eax
push eax
call dword [sym.imp.KERNEL32.dll_OpenEventW]
mov dword [0x5049d0], eax
test eax, eax
je 0x4280b6
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push 1
mov dword [0x5056dc], eax
call fcn.00472c0c
add esp, 4
mov dword [ebp - 0x14], eax
lea ecx, [ebp - 0x20]
mov dword [ebp - 4], 0
push ecx
push 0
push eax
push 0x42ccb0
push 0
push 0
call fcn.004a09bc
mov ecx, eax
add esp, 0x18
mov dword [ebp - 0x24], ecx
test ecx, ecx
je 0x4280f1
mov dword [ebp - 4], 0xffffffff
cmp dword [0x5049f8], 0
jne 0x4280d9
mov eax, dword [ebp - 0x20]
push 1
mov dword [0x5049f4], ecx
mov dword [0x5049f8], eax
call fcn.00472c0c
add esp, 4
mov dword [ebp - 0x14], eax
lea ecx, [ebp - 0x18]
mov dword [ebp - 4], 1
push ecx
push 0
push eax
push 0x42cd60
push 0
push 0
call fcn.004a09bc
mov ecx, eax
add esp, 0x18
mov dword [ebp - 0x1c], ecx
test ecx, ecx
je 0x4280e3
cmp dword [0x504a14], 0
jne 0x4280de
mov eax, dword [ebp - 0x18]
mov bl, 1
mov dword [0x504a10], ecx
mov dword [0x504a14], eax
jmp 0x4280bb
call fcn.00427d40
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0047299a
mov esp, ebp
pop ebp
ret
call fcn.004a0a6d
call fcn.004a0a6d
push 6
mov dword [ebp - 0x18], 0
call fcn.00473f18
push 6
mov dword [ebp - 0x20], 0
call fcn.00473f18
int3
Function at 0x428100
Capabilities:
Check for time delay via queryperformancecounter

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff0
sub esp, 0x68
mov eax, dword [0x501040]
xor eax, esp
mov dword [esp + 0x64], eax
push esi
push edi
call fcn.00459f00
mov esi, dword [sym.imp.KERNEL32.dll_Sleep]
mov edi, dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov dword [esp + 8], eax
mov dword [esp + 0x48], edx
nop
lea eax, [esp + 0x38]
push eax
call dword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
test eax, eax
je 0x42816a
lea eax, [esp + 0x40]
push eax
call edi
test eax, eax
je 0x42816a
push 0
push 0x3e8
push dword [esp + 0x44]
push dword [esp + 0x44]
call fcn.004bfe30
push edx
push eax
push dword [esp + 0x4c]
push dword [esp + 0x4c]
jmp 0x42817f
lea ecx, [esp + 0x50]
call fcn.00415d10
push 0
push 0xf4240
push dword [eax + 4]
push dword [eax]
call fcn.004bfe30
mov ecx, eax
mov eax, dword [0x5049a8]
sub ecx, dword [esp + 8]
sbb edx, dword [esp + 0x48]
mov dword [esp + 0x5c], edx
jne 0x4281b9
jb 0x4281a3
cmp ecx, 0x7d0
ja 0x4281b9
cmp eax, 3
je 0x4281c7
cmp eax, 4
je 0x4281b9
push 0x1f4
call esi
jmp 0x428130
cmp eax, 3
je 0x4281c7
cmp eax, 4
jne 0x428292
mov eax, dword [0x5049d0]
mov dword [esp + 0x64], eax
mov eax, dword [0x5049c8]
mov dword [esp + 0x68], eax
nop dword [eax]
lea eax, [esp + 0x58]
push eax
call dword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
test eax, eax
je 0x4281fa
lea eax, [esp + 0x50]
push eax
call edi
test eax, eax
jne 0x428203
lea ecx, [esp + 0x40]
call fcn.00415d10
push 0x7d0
push 0
lea eax, [esp + 0x6c]
push eax
push 2
call dword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
mov esi, eax
lea eax, [esp + 0x38]
push eax
call dword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
test eax, eax
je 0x428233
lea eax, [esp + 0x48]
push eax
call edi
test eax, eax
jne 0x42823c
lea ecx, [esp + 8]
call fcn.00415d10
test esi, esi
je 0x4281e0
cmp esi, 1
je 0x4282a6
cmp esi, 0x102
jne 0x428292
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
push 0
push 0x1000
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
test esi, esi
je 0x428292
push 0
push 0x18
lea eax, [esp + 0x18]
xorps xmm0, xmm0
push eax
push 0
push esi
movaps xmmword [esp + 0x24], xmm0
movq qword [esp + 0x34], xmm0
call dword [sym.imp.ntdll.dll_NtQueryInformationProcess]
test eax, eax
je 0x428292
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor edx, edx
lea ecx, [edx + 2]
call fcn.00427bf0
xor edx, edx
lea ecx, [edx + 3]
call fcn.00427bf0
mov ecx, dword [esp + 0x6c]
pop edi
pop esi
xor ecx, esp
call fcn.0047299a
mov esp, ebp
pop ebp
ret
Function at 0x42fa10
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x14
mov eax, dword [ebp + 8]
push ebx
mov ebx, ecx
mov dword [esp + 8], eax
push esi
push edi
movzx edi, word [ebp + 0xc]
cmp byte [ebx + 4], 0
je 0x42fa3b
lock inc dword [ebx]
cmp byte [ebx + 4], 0
jne 0x42fa46
lock dec dword [ebx]
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
push edi
push eax
lea edx, [ebx + 0x40]
lea ecx, [ebx + 0x38]
call fcn.0042ed20
mov esi, eax
add esp, 8
test esi, esi
jne 0x42fb5d
test di, di
je 0x42fb4b
lea eax, [ebx + 0x7c]
push eax
call fcn.00474987
mov edx, dword [esp + 0x14]
add esp, 4
movzx eax, dl
xor eax, 0x811c9dc5
mov dword [esp + 0x14], edx
imul ecx, eax, 0x1000193
mov eax, edx
shr eax, 8
movzx eax, al
xor ecx, eax
mov eax, edx
imul ecx, ecx, 0x1000193
shr eax, 0x10
movzx eax, al
xor ecx, eax
mov eax, edx
imul ecx, ecx, 0x1000193
shr eax, 0x18
xor ecx, eax
imul eax, ecx, 0x1000193
lea ecx, [ebx + 0x80]
push eax
lea eax, [esp + 0x18]
push eax
lea eax, [esp + 0x20]
push eax
call fcn.0041d410
mov edx, dword [eax + 4]
test edx, edx
je 0x42fb08
cmp edx, dword [ebx + 0x84]
je 0x42fb08
mov esi, dword [edx + 0xc]
mov edx, dword [edx + 0x10]
cmp esi, edx
je 0x42fb08
movzx ecx, word [esi + 0x18]
cmp cx, di
ja 0x42faf6
cmp di, word [esi + 0x1a]
jbe 0x42fb35
cmp cx, word [esi + 0x1a]
jne 0x42fb01
test cx, cx
je 0x42fb35
add esi, 0x1c
cmp esi, edx
jne 0x42fae7
lea eax, [ebx + 0x7c]
push eax
call fcn.004749a3
mov esi, dword [ebx + 0x2c]
add esp, 4
mov eax, dword [ebx + 0x30]
cmp esi, eax
je 0x42fb4b
nop
cmp word [esi + 0x18], di
ja 0x42fb2c
cmp di, word [esi + 0x1a]
jbe 0x42fb47
add esi, 0x1c
cmp esi, eax
jne 0x42fb20
jmp 0x42fb4b
test esi, esi
je 0x42fb08
lea eax, [ebx + 0x7c]
push eax
call fcn.004749a3
add esp, 4
jmp 0x42fb63
test esi, esi
jne 0x42fb5d
mov edx, dword [esp + 0x10]
lea ecx, [ebx + 0x70]
push edi
call fcn.0042e9e0
add esp, 4
mov esi, eax
xor edi, edi
test esi, esi
je 0x42fbcd
lea eax, [ebx + 8]
push eax
call fcn.00474987
add esp, 4
lea eax, [ebx + 0xc]
cmp dword [esi + 0x14], 0xf
mov edi, esi
jbe 0x42fb7c
mov edi, dword [esi]
xor ecx, ecx
mov edx, 0x811c9dc5
cmp dword [esi + 0x10], ecx
jbe 0x42fb9d
movzx eax, byte [edi + ecx]
inc ecx
xor eax, edx
imul edx, eax, 0x1000193
cmp ecx, dword [esi + 0x10]
jb 0x42fb88
lea eax, [ebx + 0xc]
push edx
push esi
lea ecx, [esp + 0x20]
push ecx
mov ecx, eax
call fcn.0040acc0
mov eax, dword [eax + 4]
test eax, eax
jne 0x42fbb5
mov eax, dword [ebx + 0x10]
cmp eax, dword [ebx + 0x10]
je 0x42fbbf
mov edi, dword [eax + 0x20]
jmp 0x42fbc1
xor edi, edi
lea ecx, [ebx + 8]
push ecx
call fcn.004749a3
add esp, 4
lock dec dword [ebx]
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x430240
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [ebp + 0xc]
mov edx, ecx
push ebx
mov ebx, dword [ebp + 8]
mov dword [ebp - 0x14], edx
cmp ebx, eax
je 0x4303af
mov eax, dword [edx + 4]
mov dword [ebp - 0x18], eax
mov eax, dword [ebx + 4]
mov dword [ebp - 8], eax
movzx eax, byte [ebx + 8]
xor eax, 0x811c9dc5
imul ecx, eax, 0x1000193
movzx eax, byte [ebx + 9]
push esi
push edi
mov edi, dword [edx + 0xc]
mov esi, ebx
xor ecx, eax
mov dword [ebp - 0x1c], edi
movzx eax, byte [ebx + 0xa]
imul ecx, ecx, 0x1000193
xor ecx, eax
movzx eax, byte [ebx + 0xb]
imul ecx, ecx, 0x1000193
xor ecx, eax
mov eax, dword [edx + 0x18]
imul ecx, ecx, 0x1000193
and eax, ecx
mov ecx, dword [edi + eax*8]
mov dword [ebp - 4], ecx
lea eax, [edi + eax*8]
mov dword [ebp - 0xc], eax
mov eax, dword [eax + 4]
mov dword [ebp - 0x10], eax
nop word [eax + eax]
mov edi, esi
mov ebx, esi
mov esi, dword [esi]
lea ecx, [edi + 0xc]
call fcn.0042ba30
push 0x18
push edi
call fcn.00472bfe
mov edx, dword [ebp - 0x14]
add esp, 8
dec dword [edx + 8]
cmp ebx, dword [ebp - 0x10]
je 0x43030d
mov eax, dword [ebp + 0xc]
cmp esi, eax
jne 0x4302c0
mov ecx, dword [ebp - 4]
cmp ecx, dword [ebp + 8]
jne 0x4303a5
mov edi, dword [ebp - 0xc]
mov ecx, dword [ebp - 8]
mov dword [edi], esi
mov dword [ecx], esi
pop edi
mov dword [esi + 4], ecx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
mov ecx, dword [ebp - 4]
mov edi, dword [ebp - 0xc]
cmp ecx, dword [ebp + 8]
jne 0x430321
mov eax, dword [ebp - 0x18]
mov ecx, eax
mov dword [edi], eax
jmp 0x430324
mov ecx, dword [ebp - 8]
mov eax, dword [ebp + 0xc]
mov dword [edi + 4], ecx
cmp esi, eax
je 0x4303a5
nop
movzx eax, byte [esi + 8]
xor eax, 0x811c9dc5
imul ecx, eax, 0x1000193
movzx eax, byte [esi + 9]
xor ecx, eax
movzx eax, byte [esi + 0xa]
imul ecx, ecx, 0x1000193
xor ecx, eax
movzx eax, byte [esi + 0xb]
imul ecx, ecx, 0x1000193
xor ecx, eax
imul eax, ecx, 0x1000193
mov ecx, dword [ebp - 0x1c]
and eax, dword [edx + 0x18]
lea eax, [ecx + eax*8]
mov dword [ebp - 4], eax
mov eax, dword [eax + 4]
mov dword [ebp - 0x10], eax
mov edi, esi
mov ebx, esi
mov esi, dword [esi]
lea ecx, [edi + 0xc]
call fcn.0042ba30
push 0x18
push edi
call fcn.00472bfe
mov edx, dword [ebp - 0x14]
add esp, 8
mov eax, dword [ebp + 0xc]
dec dword [edx + 8]
cmp ebx, dword [ebp - 0x10]
je 0x4303b6
cmp esi, eax
jne 0x430375
mov ecx, dword [ebp - 4]
mov dword [ecx], esi
mov ecx, dword [ebp - 8]
pop edi
mov dword [ecx], esi
mov dword [esi + 4], ecx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
mov ecx, dword [ebp - 4]
mov ebx, dword [ebp - 0x18]
mov dword [ecx], ebx
mov dword [ecx + 4], ebx
cmp esi, eax
jne 0x430330
mov ecx, dword [ebp - 8]
pop edi
mov dword [ecx], esi
mov dword [esi + 4], ecx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x4303e0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
mov dword [ebp - 8], ecx
cmp edx, eax
je 0x43057c
cmp dword [edx + 0x1c], 0xf
mov eax, dword [ecx + 4]
push esi
mov dword [ebp - 0x1c], eax
mov esi, edx
mov eax, dword [ecx + 0xc]
push edi
mov dword [ebp - 0x18], eax
lea edi, [edx + 8]
mov eax, dword [edx + 4]
mov dword [ebp - 0xc], eax
mov eax, dword [edi + 0x10]
jbe 0x43041b
mov edi, dword [edi]
xor edx, edx
push ebx
mov ebx, 0x811c9dc5
test eax, eax
je 0x430444
mov ecx, eax
nop dword [eax]
movzx eax, byte [edi + edx]
inc edx
xor eax, ebx
imul ebx, eax, 0x1000193
cmp edx, ecx
jb 0x430430
mov ecx, dword [ebp - 8]
mov eax, dword [ecx + 0x18]
mov ecx, dword [ebp - 0x18]
and eax, ebx
lea eax, [ecx + eax*8]
mov ecx, dword [eax]
mov dword [ebp - 0x10], eax
mov eax, dword [eax + 4]
mov dword [ebp - 4], ecx
mov dword [ebp - 0x14], eax
nop dword [eax]
mov edi, esi
mov ebx, esi
mov esi, dword [esi]
lea ecx, [edi + 8]
call fcn.0042d330
push 0x2c
push edi
call fcn.00472bfe
mov eax, dword [ebp - 8]
add esp, 8
dec dword [eax + 8]
cmp ebx, dword [ebp - 0x14]
je 0x4304a9
mov eax, dword [ebp + 0xc]
cmp esi, eax
jne 0x430460
mov ecx, dword [ebp - 4]
cmp ecx, dword [ebp + 8]
jne 0x430498
mov edx, dword [ebp - 0x10]
mov dword [edx], esi
mov ecx, dword [ebp - 0xc]
pop ebx
pop edi
mov dword [ecx], esi
mov dword [esi + 4], ecx
pop esi
mov esp, ebp
pop ebp
ret 8
mov ecx, dword [ebp - 4]
mov edx, dword [ebp - 0x10]
cmp ecx, dword [ebp + 8]
jne 0x4304bb
mov ecx, dword [ebp - 0x1c]
mov dword [edx], ecx
jmp 0x4304be
mov ecx, dword [ebp - 0xc]
mov dword [edx + 4], ecx
mov ecx, dword [ebp + 0xc]
cmp esi, ecx
je 0x43056f
nop dword [eax]
cmp dword [esi + 0x1c], 0xf
lea edx, [esi + 8]
mov ebx, dword [edx + 0x10]
jbe 0x4304de
mov edx, dword [edx]
xor ecx, ecx
mov edi, 0x811c9dc5
test ebx, ebx
je 0x430504
nop dword [eax]
movzx eax, byte [edx + ecx]
inc ecx
xor eax, edi
imul edi, eax, 0x1000193
cmp ecx, ebx
jb 0x4304f0
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x18]
mov ecx, dword [ebp - 0x18]
and eax, edi
lea eax, [ecx + eax*8]
mov dword [ebp - 4], eax
mov eax, dword [eax + 4]
mov dword [ebp - 0x14], eax
mov edi, esi
mov ebx, esi
mov esi, dword [esi]
lea ecx, [edi + 8]
call fcn.0042d330
push 0x2c
push edi
call fcn.00472bfe
mov eax, dword [ebp - 8]
add esp, 8
dec dword [eax + 8]
cmp ebx, dword [ebp - 0x14]
je 0x430559
mov eax, dword [ebp + 0xc]
cmp esi, eax
jne 0x430518
mov ecx, dword [ebp - 4]
pop ebx
pop edi
mov dword [ecx], esi
mov ecx, dword [ebp - 0xc]
mov dword [ecx], esi
mov dword [esi + 4], ecx
pop esi
mov esp, ebp
pop ebp
ret 8
mov ecx, dword [ebp - 4]
mov edi, dword [ebp - 0x1c]
mov dword [ecx], edi
mov dword [ecx + 4], edi
mov ecx, dword [ebp + 0xc]
cmp esi, ecx
jne 0x4304d0
mov eax, dword [ebp - 0xc]
pop ebx
pop edi
mov dword [eax], esi
mov dword [esi + 4], eax
mov eax, ecx
pop esi
mov esp, ebp
pop ebp
ret 8
Function at 0x431e80
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4c2be5
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
push ebx
push esi
push edi
mov eax, dword [0x501040]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov edx, dword [ebp + 0xc]
mov edi, dword [ebp + 8]
mov dword [ebp - 0x1c], edi
mov dword [ebp - 0x10], edx
cmp dword [edx + 0x14], 0xf
mov dword [ebp - 0x14], edx
jbe 0x431ec4
mov eax, dword [edx]
mov dword [ebp - 0x14], eax
xor ecx, ecx
mov esi, 0x811c9dc5
cmp dword [edx + 0x10], ecx
jbe 0x431ee8
mov edi, dword [ebp - 0x14]
movzx eax, byte [edi + ecx]
inc ecx
xor eax, esi
imul esi, eax, 0x1000193
cmp ecx, dword [edx + 0x10]
jb 0x431ed3
mov edi, dword [ebp - 0x1c]
push esi
push edx
lea eax, [ebp - 0x18]
mov ecx, ebx
push eax
call fcn.0040acc0
mov eax, dword [ebp - 0x14]
test eax, eax
je 0x431f18
mov dword [edi], eax
mov eax, edi
mov byte [edi + 4], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
cmp dword [ebx + 8], 0x5d1745d
je 0x43205f
lea eax, [ebx + 4]
mov dword [ebp - 0x24], eax
mov dword [ebp - 4], 0
push 0x2c
mov dword [ebp - 0x20], 0
call fcn.00472c0c
add esp, 4
mov edi, eax
mov dword [ebp - 0x20], edi
push dword [ebp - 0x10]
lea ecx, [edi + 8]
call fcn.00407330
mov dword [edi + 0x20], 0
mov dword [edi + 0x24], 0
mov dword [edi + 0x28], 0
mov dword [ebp - 4], 1
mov eax, dword [ebx + 8]
inc eax
movss xmm3, dword [ebx]
movd xmm0, eax
cvtdq2pd xmm0, xmm0
shr eax, 0x1f
addsd xmm0, qword [eax*8 + 0x4f5300]
mov eax, dword [ebx + 0x1c]
movd xmm1, eax
cvtdq2pd xmm1, xmm1
shr eax, 0x1f
cvtpd2ps xmm0, xmm0
addsd xmm1, qword [eax*8 + 0x4f5300]
movaps xmm2, xmm0
cvtpd2ps xmm1, xmm1
divss xmm2, xmm1
comiss xmm2, xmm3
jbe 0x432001
divss xmm0, xmm3
call fcn.00401470
call fcn.004bfb80
mov ecx, 8
cmp eax, ecx
cmova ecx, eax
mov eax, dword [ebx + 0x1c]
cmp eax, ecx
jae 0x431fe5
cmp eax, 0x200
jae 0x431fe3
shl eax, 3
cmp eax, ecx
jae 0x431fe5
mov eax, ecx
push eax
mov ecx, ebx
call fcn.004095e0
push esi
lea eax, [edi + 8]
mov ecx, ebx
push eax
lea eax, [ebp - 0x24]
push eax
call fcn.0040acc0
mov edx, dword [eax]
jmp 0x432004
mov edx, dword [ebp - 0x18]
mov eax, dword [edx + 4]
inc dword [ebx + 8]
mov dword [edi + 4], eax
mov dword [edi], edx
mov dword [eax], edi
mov dword [edx + 4], edi
mov ecx, dword [ebx + 0xc]
mov dword [ebp - 0x10], eax
mov eax, dword [ebx + 0x18]
and eax, esi
mov esi, dword [ecx + eax*8]
cmp esi, dword [ebx + 4]
jne 0x43202c
mov dword [ecx + eax*8], edi
jmp 0x43203e
cmp esi, edx
jne 0x432035
mov dword [ecx + eax*8], edi
jmp 0x432042
mov edx, dword [ebp - 0x10]
cmp dword [ecx + eax*8 + 4], edx
jne 0x432042
mov dword [ecx + eax*8 + 4], edi
mov eax, dword [ebp - 0x1c]
mov dword [eax], edi
mov byte [eax + 4], 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
push str.unordered_map_set_too_long
call fcn.004741ba
int3