joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4412b0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x14
mov eax, dword [ebp + 0x10]
push ebx
mov ebx, ecx
mov ecx, dword [ebp + 0xc]
push esi
push edi
mov edi, dword [ebp + 8]
mov dword [esp + 0xc], edi
test eax, eax
jg 0x4412e2
jl 0x4412d5
test ecx, ecx
jne 0x4412e2
xor eax, eax
xor edx, edx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
cmp dword [ebx + 0x38], 0
je 0x4413bf
mov dword [esp + 0x10], eax
lea eax, [ebx + 0x2c]
mov dword [esp + 0xc], ecx
mov dword [esp + 0x14], eax
mov eax, dword [ebx + 0x1c]
mov eax, dword [eax]
mov dword [esp + 0x18], eax
test eax, eax
je 0x441312
mov eax, dword [esp + 0x14]
mov eax, dword [eax]
mov eax, dword [eax]
jmp 0x441314
xor eax, eax
cdq
mov dword [esp + 0x1c], edx
mov esi, eax
test edx, edx
jl 0x441368
jg 0x441325
test esi, esi
je 0x441368
mov eax, dword [esp + 0x10]
cmp eax, edx
jg 0x441339
jl 0x441333
cmp ecx, esi
jae 0x441339
mov esi, ecx
mov dword [esp + 0x1c], eax
push esi
push dword [esp + 0x1c]
push edi
call fcn.00620e40
mov eax, dword [esp + 0x20]
add esp, 0xc
mov ecx, dword [esp + 0xc]
mov edx, dword [esp + 0x10]
sub ecx, esi
mov eax, dword [eax]
sbb edx, dword [esp + 0x1c]
sub dword [eax], esi
mov eax, dword [ebx + 0x1c]
add dword [eax], esi
mov eax, dword [esp + 0x14]
jmp 0x44138c
mov eax, dword [ebx]
mov ecx, ebx
call dword [eax + 0x1c]
mov edx, dword [esp + 0x10]
cmp eax, 0xffffffff
je 0x4413a8
mov ecx, dword [esp + 0xc]
mov esi, 1
add ecx, 0xffffffff
mov byte [edi], al
lea eax, [ebx + 0x2c]
adc edx, 0xffffffff
add edi, esi
mov dword [esp + 0x10], edx
mov dword [esp + 0xc], ecx
test edx, edx
jg 0x4412f7
jl 0x4413a8
test ecx, ecx
jne 0x4412f7
mov eax, dword [ebp + 0xc]
sub eax, dword [esp + 0xc]
mov ecx, dword [ebp + 0x10]
sbb ecx, edx
mov edx, ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov eax, dword [ebx + 0x1c]
lea esi, [ebx + 0x2c]
mov edi, ecx
mov edx, dword [eax]
test edx, edx
je 0x4413fd
mov eax, dword [esi]
mov eax, dword [eax]
test eax, eax
je 0x4413fd
cmp eax, ecx
mov esi, ecx
cmovb esi, eax
push esi
push edx
push dword [esp + 0x14]
call fcn.00620e40
mov eax, dword [ebx + 0x2c]
sub edi, esi
add dword [esp + 0x18], esi
add esp, 0xc
sub dword [eax], esi
mov eax, dword [ebx + 0x1c]
add dword [eax], esi
lea esi, [ebx + 0x2c]
cmp dword [ebx + 0x4c], 0
je 0x441467
mov ecx, dword [ebx + 0xc]
lea eax, [ebx + 0x3c]
cmp dword [ecx], eax
jne 0x441423
mov eax, dword [ebx + 0xc]
mov edx, dword [ebx + 0x54]
mov ecx, dword [ebx + 0x50]
sub edx, ecx
mov dword [eax], ecx
mov eax, dword [ebx + 0x1c]
mov dword [eax], ecx
mov eax, dword [esi]
mov dword [eax], edx
mov esi, dword [esp + 0xc]
cmp edi, 0xfff
jbe 0x441452
nop
push dword [ebx + 0x4c]
push 0xfff
push 1
push esi
call fcn.00637c9d
add esp, 0x10
add esi, eax
sub edi, eax
cmp eax, 0xfff
jne 0x441467
cmp edi, eax
ja 0x441430
test edi, edi
je 0x441467
push dword [ebx + 0x4c]
push edi
push 1
push esi
call fcn.00637c9d
add esp, 0x10
sub edi, eax
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 0x10]
sub eax, edi
pop edi
pop esi
sbb edx, 0
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x4460a0
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x655bd0
mov eax, dword fs:[0]
push eax
push esi
push edi
mov eax, dword [0x6d5ec0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
push 8
mov dword [edi], vtable.std::basic_streambuf_char__struct_std::char_traits_char__.0
mov dword [edi + 4], 0
mov dword [edi + 8], 0
mov dword [edi + 0xc], 0
mov dword [edi + 0x10], 0
mov dword [edi + 0x14], 0
mov dword [edi + 0x18], 0
mov dword [edi + 0x1c], 0
mov dword [edi + 0x20], 0
mov dword [edi + 0x24], 0
mov dword [edi + 0x28], 0
mov dword [edi + 0x2c], 0
mov dword [edi + 0x30], 0
call fcn.0061ec07
mov esi, eax
xorps xmm0, xmm0
movq qword [esi], xmm0
push 1
mov dword [ebp - 4], 0
call fcn.0060d244
add esp, 8
mov dword [esi + 4], eax
mov ecx, edi
mov dword [edi + 0x34], esi
call fcn.0044c2a0
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x44b7f0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
mov dword [ebp - 8], ecx
cmp edx, eax
je 0x44b98c
cmp dword [edx + 0x1c], 0xf
mov eax, dword [ecx + 4]
push esi
mov dword [ebp - 0x1c], eax
mov esi, edx
mov eax, dword [ecx + 0xc]
push edi
mov dword [ebp - 0x18], eax
lea edi, [edx + 8]
mov eax, dword [edx + 4]
mov dword [ebp - 0xc], eax
mov eax, dword [edi + 0x10]
jbe 0x44b82b
mov edi, dword [edi]
xor edx, edx
push ebx
mov ebx, 0x811c9dc5
test eax, eax
je 0x44b854
mov ecx, eax
nop dword [eax]
movzx eax, byte [edi + edx]
inc edx
xor eax, ebx
imul ebx, eax, 0x1000193
cmp edx, ecx
jb 0x44b840
mov ecx, dword [ebp - 8]
mov eax, dword [ecx + 0x18]
mov ecx, dword [ebp - 0x18]
and eax, ebx
lea eax, [ecx + eax*8]
mov ecx, dword [eax]
mov dword [ebp - 0x10], eax
mov eax, dword [eax + 4]
mov dword [ebp - 4], ecx
mov dword [ebp - 0x14], eax
nop dword [eax]
mov edi, esi
mov ebx, esi
mov esi, dword [esi]
lea ecx, [edi + 8]
call fcn.00413c80
push 0x38
push edi
call fcn.0061ef9d
mov eax, dword [ebp - 8]
add esp, 8
dec dword [eax + 8]
cmp ebx, dword [ebp - 0x14]
je 0x44b8b9
mov eax, dword [ebp + 0xc]
cmp esi, eax
jne 0x44b870
mov ecx, dword [ebp - 4]
cmp ecx, dword [ebp + 8]
jne 0x44b8a8
mov edx, dword [ebp - 0x10]
mov dword [edx], esi
mov ecx, dword [ebp - 0xc]
pop ebx
pop edi
mov dword [ecx], esi
mov dword [esi + 4], ecx
pop esi
mov esp, ebp
pop ebp
ret 8
mov ecx, dword [ebp - 4]
mov edx, dword [ebp - 0x10]
cmp ecx, dword [ebp + 8]
jne 0x44b8cb
mov ecx, dword [ebp - 0x1c]
mov dword [edx], ecx
jmp 0x44b8ce
mov ecx, dword [ebp - 0xc]
mov dword [edx + 4], ecx
mov ecx, dword [ebp + 0xc]
cmp esi, ecx
je 0x44b97f
nop dword [eax]
cmp dword [esi + 0x1c], 0xf
lea edx, [esi + 8]
mov ebx, dword [edx + 0x10]
jbe 0x44b8ee
mov edx, dword [edx]
xor ecx, ecx
mov edi, 0x811c9dc5
test ebx, ebx
je 0x44b914
nop dword [eax]
movzx eax, byte [edx + ecx]
inc ecx
xor eax, edi
imul edi, eax, 0x1000193
cmp ecx, ebx
jb 0x44b900
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x18]
mov ecx, dword [ebp - 0x18]
and eax, edi
lea eax, [ecx + eax*8]
mov dword [ebp - 4], eax
mov eax, dword [eax + 4]
mov dword [ebp - 0x14], eax
mov edi, esi
mov ebx, esi
mov esi, dword [esi]
lea ecx, [edi + 8]
call fcn.00413c80
push 0x38
push edi
call fcn.0061ef9d
mov eax, dword [ebp - 8]
add esp, 8
dec dword [eax + 8]
cmp ebx, dword [ebp - 0x14]
je 0x44b969
mov eax, dword [ebp + 0xc]
cmp esi, eax
jne 0x44b928
mov ecx, dword [ebp - 4]
pop ebx
pop edi
mov dword [ecx], esi
mov ecx, dword [ebp - 0xc]
mov dword [ecx], esi
mov dword [esi + 4], ecx
pop esi
mov esp, ebp
pop ebp
ret 8
mov ecx, dword [ebp - 4]
mov edi, dword [ebp - 0x1c]
mov dword [ecx], edi
mov dword [ecx + 4], edi
mov ecx, dword [ebp + 0xc]
cmp esi, ecx
jne 0x44b8e0
mov eax, dword [ebp - 0xc]
pop ebx
pop edi
mov dword [eax], esi
mov dword [esi + 4], eax
mov eax, ecx
pop esi
mov esp, ebp
pop ebp
ret 8
Function at 0x44bca0
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, ecx
push edi
mov dword [ebp - 4], esi
mov eax, dword [esi]
cmp eax, 0x270
jne 0x44bcfd
lea edx, [esi + 8]
mov edi, eax
nop dword [eax]
mov ecx, dword [edx]
lea edx, [edx + 4]
xor ecx, dword [edx - 8]
and ecx, 0x7fffffff
xor ecx, dword [edx - 8]
mov eax, ecx
and al, 1
movzx eax, al
neg eax
sbb eax, eax
shr ecx, 1
and eax, 0x9908b0df
xor eax, dword [edx + 0x62c]
xor eax, ecx
mov dword [edx + 0x9b8], eax
sub edi, 1
jne 0x44bcc0
mov eax, dword [esi]
jmp 0x44bddb
cmp eax, 0x4e0
jb 0x44bddb
lea edi, [esi + 0x9c4]
mov esi, 0xe3
push ebx
mov ebx, dword [edi]
lea edx, [edi]
mov eax, ebx
mov ebx, dword [edx + 4]
lea edi, [edx + 4]
mov ecx, ebx
xor ecx, eax
and ecx, 0x7fffffff
xor ecx, eax
mov eax, ecx
and al, 1
movzx eax, al
neg eax
sbb eax, eax
shr ecx, 1
and eax, 0x9908b0df
xor eax, dword [edx + 0x634]
xor eax, ecx
mov dword [edx - 0x9c0], eax
sub esi, 1
jne 0x44bd16
mov edi, dword [ebp - 4]
mov esi, 0x18c
add edi, 0xd50
mov ebx, dword [edi]
mov eax, ebx
lea edx, [edi]
mov ebx, dword [edx + 4]
lea edi, [edx + 4]
mov ecx, eax
xor ecx, ebx
and ecx, 0x7fffffff
xor ecx, eax
mov eax, ecx
and al, 1
movzx eax, al
neg eax
sbb eax, eax
shr ecx, 1
and eax, 0x9908b0df
xor eax, dword [edx - 0xd4c]
xor eax, ecx
mov dword [edx - 0x9c0], eax
sub esi, 1
jne 0x44bd61
mov esi, dword [ebp - 4]
pop ebx
mov eax, dword [esi + 0x1380]
mov ecx, dword [esi + 4]
xor ecx, eax
and ecx, 0x7fffffff
xor ecx, eax
mov eax, ecx
and al, 1
movzx eax, al
neg eax
sbb eax, eax
shr ecx, 1
and eax, 0x9908b0df
xor eax, dword [esi + 0x634]
xor eax, ecx
mov dword [esi + 0x9c0], eax
xor eax, eax
mov dword [esi], 0
mov edx, dword [esi + eax*4 + 4]
inc eax
mov dword [esi], eax
mov ecx, edx
mov eax, dword [esi + 0x1384]
shr ecx, 0xb
and eax, ecx
xor edx, eax
mov eax, edx
and eax, 0xff3a58ad
shl eax, 7
xor edx, eax
mov eax, edx
and eax, 0xffffdf8c
shl eax, 0xf
xor edx, eax
mov eax, edx
shr eax, 0x12
pop edi
xor eax, edx
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x44cb50
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x65c98c
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push esi
push edi
mov eax, dword [0x6d5ec0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x14], edi
mov dword [ebp - 0x18], edi
mov eax, dword [ebp + 8]
mov dword [ebp - 4], 0
mov dword [edi], eax
mov dword [edi + 4], 0
mov dword [edi + 8], 0
mov dword [edi + 0xc], 0
mov dword [edi + 0x10], 0
mov dword [edi + 0x14], 0
mov dword [edi + 0x18], 0
mov dword [edi + 0x1c], 0
mov dword [edi + 0x20], 0
mov dword [edi + 0x24], 0
mov dword [edi + 0x28], 0
mov dword [edi + 0x2c], 0
lea esi, [edi + 0x38]
mov dword [edi + 0x30], 0
mov byte [edi + 0x34], 0
mov dword [ebp - 0x14], esi
mov dword [esi + 0x24], 0
mov byte [ebp - 4], 4
mov ecx, dword [ebp + 0x34]
test ecx, ecx
je 0x44cc04
mov eax, dword [ecx]
push esi
call dword [eax]
mov dword [esi + 0x24], eax
mov al, byte [ebp + 0xc]
lea ecx, [edi + 0x68]
mov byte [ebp - 4], 5
push 9
mov byte [edi + 0x60], al
call fcn.0044ba80
lea eax, [ebp - 0xd]
mov byte [ebp - 4], 6
push eax
lea ecx, [edi + 0x10]
mov byte [ebp - 0xd], 1
call fcn.0044f9b0
mov ecx, dword [ebp + 0x34]
test ecx, ecx
je 0x44cc44
mov esi, dword [ecx]
lea eax, [ebp + 0x10]
cmp ecx, eax
setne dl
movzx edx, dl
push edx
call dword [esi + 0x10]
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x30
Function at 0x44ee20
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x655bd0
mov eax, dword fs:[0]
push eax
push esi
push edi
mov eax, dword [0x6d5ec0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
push 8
mov dword [edi], vtable.std::basic_streambuf_wchar_t__struct_std::char_traits_wchar_t__.0
mov dword [edi + 4], 0
mov dword [edi + 8], 0
mov dword [edi + 0xc], 0
mov dword [edi + 0x10], 0
mov dword [edi + 0x14], 0
mov dword [edi + 0x18], 0
mov dword [edi + 0x1c], 0
mov dword [edi + 0x20], 0
mov dword [edi + 0x24], 0
mov dword [edi + 0x28], 0
mov dword [edi + 0x2c], 0
mov dword [edi + 0x30], 0
call fcn.0061ec07
mov esi, eax
xorps xmm0, xmm0
movq qword [esi], xmm0
push 1
mov dword [ebp - 4], 0
call fcn.0060d244
add esp, 8
mov dword [esi + 4], eax
mov ecx, edi
mov dword [edi + 0x34], esi
call fcn.0044c2a0
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x4626f0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 0xc]
mov edx, 0x811c9dc5
push edi
mov edi, dword [ebp + 8]
mov ecx, 0
sub esi, edi
je 0x462721
nop dword [eax]
movzx eax, byte [edi + ecx]
inc ecx
xor eax, edx
imul edx, eax, 0x1000193
cmp ecx, esi
jb 0x462710
pop edi
mov eax, edx
pop esi
pop ebp
ret 8

Function at 0x462bf0
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x65e793
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x6d5ec0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x10], edi
mov ecx, dword [ebp + 0x14]
mov dword [ebp - 0x14], edi
mov dword [edi], 0
mov dword [edi + 4], 0
mov dword [edi + 8], 0
mov dword [edi + 0xc], 0
mov dword [edi + 0x10], 0
mov dword [edi + 0x14], 0
mov dword [edi + 0x18], 0
mov dword [edi + 0x1c], 0
mov dword [ebp - 4], 0
mov dword [edi + 0x20], 0
mov dword [edi + 0x24], 0
mov dword [edi + 0x28], 0
mov dword [edi + 0x2c], 0
mov dword [edi + 0x30], 0
mov dword [edi + 0x34], 0
mov dword [edi + 0x38], 0
mov dword [edi + 0x3c], 0
mov dword [edi + 0x40], 0
mov dword [edi + 0x44], 0
mov dword [edi + 0x48], 0
mov byte [ebp - 4], 2
mov eax, dword [ebp + 0xc]
mov dword [edi + 0x4c], 0
mov dword [edi + 0x50], eax
mov eax, dword [ebp + 8]
mov dword [edi + 0x54], eax
mov eax, dword [ebp + 0x1c]
mov dword [edi + 0x5c], eax
mov eax, dword [ebp + 0x18]
mov dword [edi + 0x68], eax
mov dword [edi + 0x58], ecx
mov dword [edi + 0x60], 0
mov byte [edi + 0x64], 0
mov eax, dword [ecx + 8]
shr eax, 3
and al, 1
mov byte [edi + 0x6c], al
mov eax, dword [ebp + 0x10]
mov dword [edi + 0x70], eax
mov esi, dword [ecx + 0x18]
mov ecx, dword [edi + 0x44]
mov edx, ecx
sar edx, 3
mov dword [ebp - 0x10], ecx
cmp esi, edx
jae 0x462d0b
lea ecx, [esi*8]
jmp 0x462d3b
jbe 0x462d3e
mov eax, dword [edi + 0x48]
sar eax, 3
cmp esi, eax
jbe 0x462d23
push ecx
push esi
lea ecx, [edi + 0x40]
call fcn.0047e9a0
jmp 0x462d3e
sub esi, edx
je 0x462d3b
shl esi, 3
push esi
push 0
push ecx
call fcn.006213c0
mov ecx, dword [ebp - 0x10]
add esp, 0xc
add ecx, esi
mov dword [edi + 0x44], ecx
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x1c
Function at 0x467c50
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1fffffff
sub esp, 0x10
bsr ecx, eax
push ebx
push esi
push edi
mov edi, 1
mov eax, edi
shl eax, cl
mov ecx, dword [ebp + 8]
cmp ecx, eax
ja 0x467dbd
lea eax, [ecx - 1]
mov esi, dword [0x6ed3f8]
or eax, edi
mov dword [ebp - 8], esi
bsr ecx, eax
push esi
lea ecx, [ecx + 1]
shl edi, cl
mov ecx, 0x6ed400
lea eax, [edi + edi]
push eax
call fcn.0044df50
mov eax, dword [0x6ed3f8]
lea ebx, [edi - 1]
mov dword [0x6ed40c], ebx
mov dword [0x6ed410], edi
mov eax, dword [eax]
mov ecx, eax
cmp eax, esi
je 0x467db4
nop word [eax + eax]
movzx edx, byte [eax + 8]
xor edx, 0x811c9dc5
mov ecx, dword [ecx]
imul edi, edx, 0x1000193
movzx edx, byte [eax + 9]
xor edi, edx
movzx edx, byte [eax + 0xa]
imul edi, edi, 0x1000193
xor edi, edx
movzx edx, byte [eax + 0xb]
imul edi, edi, 0x1000193
xor edi, edx
mov edx, dword [0x6ed400]
imul edi, edi, 0x1000193
and edi, ebx
mov ebx, dword [edx + edi*8]
lea edx, [edx + edi*8]
mov dword [ebp - 0xc], edx
cmp ebx, esi
jne 0x467d12
mov dword [edx], eax
mov dword [edx + 4], eax
jmp 0x467d7f
mov edx, dword [edx + 4]
mov edi, dword [eax + 8]
cmp edi, dword [edx + 8]
jne 0x467d4c
mov edx, dword [edx]
mov dword [ebp - 4], edx
cmp edx, eax
je 0x467d44
mov ebx, dword [eax + 4]
mov esi, dword [ebp - 4]
mov dword [ebx], ecx
mov edi, dword [ecx + 4]
mov dword [edi], edx
mov edx, dword [edx + 4]
mov dword [edx], eax
mov dword [esi + 4], edi
mov esi, dword [ebp - 8]
mov dword [ecx + 4], ebx
mov dword [eax + 4], edx
mov edx, dword [ebp - 0xc]
mov dword [edx + 4], eax
jmp 0x467d7f
cmp ebx, edx
je 0x467d5c
mov edx, dword [edx + 4]
cmp edi, dword [edx + 8]
je 0x467d90
cmp ebx, edx
jne 0x467d50
mov ebx, dword [eax + 4]
mov dword [ebp - 4], ebx
mov dword [ebx], ecx
mov ebx, dword [ecx + 4]
mov dword [ebx], edx
mov edi, dword [edx + 4]
mov dword [edi], eax
mov dword [edx + 4], ebx
mov edx, dword [ebp - 4]
mov dword [ecx + 4], edx
mov edx, dword [ebp - 0xc]
mov dword [eax + 4], edi
mov dword [edx], eax
mov eax, ecx
cmp ecx, esi
je 0x467db4
mov ebx, dword [0x6ed40c]
jmp 0x467cc0
mov ebx, dword [eax + 4]
mov edx, dword [edx]
mov dword [ebp - 4], edx
mov esi, edx
mov dword [ebx], ecx
mov edi, dword [ecx + 4]
mov dword [edi], edx
mov edx, dword [edx + 4]
mov dword [edx], eax
mov dword [esi + 4], edi
mov esi, dword [ebp - 8]
mov dword [ecx + 4], ebx
mov dword [eax + 4], edx
jmp 0x467d7f
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
push str.invalid_hash_bucket_count
call fcn.0060cc6c
int3
Function at 0x46f910
Capabilities:
Access peb ldr_data

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x65f4c3
mov eax, dword fs:[0]
push eax
push ebx
sub esp, 0x20
push esi
push edi
mov eax, dword [0x6d5ec0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x18], esi
mov dword [ebp - 0x14], esi
mov dword [ebp - 0x14], esi
mov dword [ebp - 4], 0
mov eax, dword [ebx + 4]
xorps xmm0, xmm0
movups xmmword [ebp - 0x28], xmm0
mov dword [ebp - 0x24], 0
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x28], eax
push 0
mov byte [ebp - 4], 2
lea ecx, [ebx + 0x30]
push 0
mov byte [ebx + 0x28], 1
mov dword [ebx + 0x2c], eax
call fcn.0045da00
sub esp, 8
mov byte [ebp - 4], 1
mov ecx, esp
xorps xmm0, xmm0
movq qword [esi], xmm0
mov dword [ecx], 0
mov dword [ecx + 4], 0
mov eax, dword [ebx + 0xc]
test eax, eax
je 0x46f9be
lock inc dword [eax + 4]
mov eax, dword [ebx + 8]
mov dword [ecx], eax
mov eax, dword [ebx + 0xc]
mov dword [ecx + 4], eax
lea eax, [ebx + 0x10]
push eax
mov ecx, esi
call fcn.0047d8e0
mov esi, dword [ebx + 0xc]
test esi, esi
je 0x46f9fc
or edi, 0xffffffff
mov eax, edi
lock xadd dword [esi + 4], eax
jne 0x46f9fc
mov eax, dword [esi]
mov ecx, esi
call dword [eax]
lock xadd dword [esi + 8], edi
dec edi
jne 0x46f9fc
mov edx, dword [esi]
mov ecx, esi
call dword [edx + 4]
lea ecx, [ebx + 0x10]
call fcn.0040d510
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret
Function at 0x47cf20
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 8]
sub esp, 0x1c
push esi
mov esi, dword [ebp + 0xc]
sub esi, edx
sar esi, 2
test esi, esi
je 0x47d0ed
push ebx
mov ebx, dword [0x6ee870]
sub ebx, dword [0x6ee86c]
sar ebx, 2
mov dword [ebp - 0x1c], ebx
cmp esi, 0x26f
jb 0x47cf5c
mov eax, 0xb
jmp 0x47cf85
cmp esi, 0x44
jb 0x47cf68
mov eax, 7
jmp 0x47cf85
cmp esi, 0x27
jb 0x47cf74
mov eax, 5
jmp 0x47cf85
cmp esi, 7
jb 0x47cf80
mov eax, 3
jmp 0x47cf85
lea eax, [esi - 1]
shr eax, 1
mov ecx, esi
sub ecx, eax
shr ecx, 1
add eax, ecx
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0x14], eax
cmp esi, ebx
ja 0x47cf9f
lea eax, [ebx + 1]
mov dword [ebp + 0xc], eax
jmp 0x47cfa2
mov dword [ebp + 0xc], esi
push edi
mov eax, 0x8b8b8b8b
mov ecx, esi
mov edi, edx
rep stosd dword es:[edi], eax
mov eax, dword [ebp + 0xc]
xor edi, edi
test eax, eax
je 0x47d057
nop dword [eax + eax]
mov eax, dword [ebp - 0x10]
xor edx, edx
add eax, edi
mov ecx, dword [ebp + 8]
div esi
lea eax, [ecx + edx*4]
xor edx, edx
mov dword [ebp - 0x18], eax
mov eax, dword [eax]
mov dword [ebp - 8], eax
mov eax, edi
div esi
mov eax, edx
xor edx, edx
mov dword [ebp - 4], eax
lea eax, [ecx + eax*4]
mov dword [ebp - 0xc], eax
lea eax, [edi - 1]
div esi
mov eax, dword [ebp - 0xc]
mov ecx, dword [ecx + edx*4]
xor ecx, dword [ebp - 8]
xor ecx, dword [eax]
mov eax, ecx
shr eax, 0x1b
xor eax, ecx
imul edx, eax, 0x19660d
test edi, edi
jne 0x47d00f
mov eax, ebx
jmp 0x47d024
cmp edi, ebx
ja 0x47d021
mov eax, dword [0x6ee86c]
mov eax, dword [eax + edi*4 - 4]
add eax, dword [ebp - 4]
jmp 0x47d024
mov eax, dword [ebp - 4]
lea ecx, [eax + edx]
mov ebx, dword [ebp + 8]
mov eax, dword [ebp - 8]
add eax, edx
mov edx, dword [ebp - 0x18]
mov dword [edx], eax
xor edx, edx
mov eax, dword [ebp - 0x14]
add eax, edi
inc edi
div esi
add dword [ebx + edx*4], ecx
lea eax, [ebx + edx*4]
mov eax, dword [ebp - 0xc]
mov ebx, dword [ebp - 0x1c]
mov dword [eax], ecx
mov eax, dword [ebp + 0xc]
cmp edi, eax
jb 0x47cfc0
add eax, esi
mov dword [ebp - 0xc], eax
cmp edi, eax
jae 0x47d0eb
mov edx, dword [ebp - 0x10]
lea ecx, [edi - 1]
mov eax, dword [ebp - 0x14]
inc edx
mov ebx, dword [ebp + 8]
inc eax
mov dword [ebp + 0xc], ecx
mov dword [ebp - 0x10], edx
mov dword [ebp - 0x18], eax
nop dword [eax + eax]
lea eax, [edx + ecx]
xor edx, edx
div esi
lea eax, [ebx + edx*4]
xor edx, edx
mov ebx, dword [eax]
mov dword [ebp - 0x1c], eax
lea eax, [ecx + 1]
mov dword [ebp - 0x14], eax
div esi
mov eax, ecx
mov edi, edx
xor edx, edx
div esi
mov eax, dword [ebp + 8]
mov ecx, dword [eax + edx*4]
xor edx, edx
add ecx, dword [eax + edi*4]
add ecx, ebx
mov eax, ecx
shr eax, 0x1b
xor eax, ecx
imul eax, eax, 0x5d588b65
xor ebx, eax
mov ecx, eax
mov eax, dword [ebp - 0x1c]
sub ecx, edi
mov dword [eax], ebx
mov eax, dword [ebp + 0xc]
add eax, dword [ebp - 0x18]
div esi
mov ebx, dword [ebp + 8]
xor dword [ebx + edx*4], ecx
lea eax, [ebx + edx*4]
mov edx, dword [ebp - 0x10]
mov dword [ebx + edi*4], ecx
mov ecx, dword [ebp - 0x14]
mov dword [ebp + 0xc], ecx
lea eax, [ecx + 1]
cmp eax, dword [ebp - 0xc]
jb 0x47d080
pop edi
pop ebx
pop esi
mov esp, ebp
pop ebp
ret 8