joyce8/EMBER2024-capa huggingface dataset:
Function at 0x46b8e8
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff30
push ebx
xor edx, edx
mov dword [ebp - 4], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x46b964
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, ebx
call fcn.0040415c
push 0xc9
lea eax, [ebp - 0xcd]
push eax
call sub.KERNEL32.DLL_GetSystemDirectoryA
lea eax, [ebp - 4]
mov dl, byte [ebp - 0xcd]
call fcn.00404344
lea eax, [ebp - 4]
mov edx, 0x46b978
call fcn.00404424
mov dword [0x470e2c], 0x34acfdb
mov edx, ebx
mov eax, dword [ebp - 4]
call fcn.0046b47c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x46b96b
lea eax, [ebp - 4]
call fcn.0040415c
ret

Function at 0x46b98c
Capabilities:
Open clipboard
Read clipboard data

Disassembly:
push ebp
mov ebp, esp
push 0
push ebx
push esi
mov esi, eax
xor eax, eax
push ebp
push 0x46ba1e
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, esi
call fcn.0040415c
push 0
call sub.user32.dll_OpenClipboard
push 1
call sub.user32.dll_GetClipboardData
mov ebx, eax
test ebx, ebx
je 0x46ba03
push ebx
call sub.KERNEL32.DLL_GlobalLock
mov edx, eax
lea eax, [ebp - 4]
call fcn.00404354
mov eax, dword [ebp - 4]
call fcn.0040441c
cmp eax, 0xc8
jle 0x46b9f3
lea eax, [ebp - 4]
push eax
mov ecx, 0xc8
mov edx, 1
mov eax, dword [ebp - 4]
call fcn.0040467c
mov eax, esi
mov edx, dword [ebp - 4]
call fcn.004041b0
push ebx
call sub.KERNEL32.DLL_GlobalUnlock
call sub.user32.dll_CloseClipboard
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x46ba25
lea eax, [ebp - 4]
call fcn.0040415c
ret

Function at 0x46ba2c
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push ebx
mov ebx, eax
xor eax, eax
push ebp
push 0x46bab4
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 4]
mov edx, 0x104
call fcn.004047a8
push 0xffffffffffffffff
push 6
mov eax, dword [ebp - 4]
call fcn.0040461c
push eax
push 0
call sub.shell32.dll_SHGetSpecialFolderPathA
test eax, eax
jne 0x46ba73
lea eax, [ebp - 4]
call fcn.0040415c
jmp 0x46ba8f
lea edx, [ebp - 8]
mov eax, dword [ebp - 4]
call fcn.004089bc
mov edx, dword [ebp - 8]
lea eax, [ebp - 4]
mov ecx, dword [0x46f6b8]
call fcn.00404468
mov eax, ebx
mov edx, dword [ebp - 4]
call fcn.004041b0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x46babb
lea eax, [ebp - 8]
mov edx, 2
call fcn.00404180
ret
Function at 0x46bac0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffbf0
push ebx
xor edx, edx
mov dword [ebp - 4], edx
mov dword [ebp - 8], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x46bbe3
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 4]
call fcn.0040415c
lea eax, [ebp - 8]
call fcn.0040415c
mov dword [ebp - 0x10], 0x400
lea eax, [ebp - 0xc]
push eax
push 0xf003f
push 0
mov eax, dword [0x46f6bc]
call fcn.0040461c
push eax
push 0x80000001
call sub.advapi32.dll_RegOpenKeyExA
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x410]
push eax
push 0
push 0
mov eax, dword [0x46f6c0]
call fcn.0040461c
push eax
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegQueryValueExA
test eax, eax
jne 0x46bb53
lea eax, [ebp - 4]
lea edx, [ebp - 0x410]
mov ecx, 0x400
call fcn.004043cc
mov eax, dword [ebp - 4]
call fcn.0040441c
test eax, eax
je 0x46bbb5
mov dword [ebp - 0x10], 0x400
lea eax, [ebp - 4]
mov edx, dword [ebp - 4]
mov dl, byte [edx]
call fcn.00404344
mov dword [0x470e24], 0x21fef079
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x410]
push eax
push 0
push 0
mov eax, dword [ebp - 4]
call fcn.0040461c
push eax
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegQueryValueExA
test eax, eax
jne 0x46bbb5
lea eax, [ebp - 8]
lea edx, [ebp - 0x410]
mov ecx, 0x400
call fcn.004043cc
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegCloseKey
mov eax, ebx
mov edx, dword [ebp - 8]
call fcn.004041b0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x46bbea
lea eax, [ebp - 8]
mov edx, 2
call fcn.00404180
ret

Function at 0x46bd24
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push ebx
xor eax, eax
push ebp
push 0x46bdf4
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [0x470e24], 0xf2b1ae3
xor ebx, ebx
lea eax, [ebx]
push eax
call sub.user32.dll_GetAsyncKeyState
and ax, 1
cmp ax, 1
jne 0x46bdcc
mov eax, ebx
add eax, 0xffffffd0
sub eax, 0xa
jb 0x46bd72
add eax, 0xfffffff9
sub eax, 0x1a
jb 0x46bd72
add eax, 0xfffffffa
sub eax, 0x1a
jae 0x46bda0
push dword [0x470c1c]
push 0x46be08
lea eax, [ebp - 4]
mov edx, ebx
call fcn.00404344
push dword [ebp - 4]
push 0x46be14
mov eax, 0x470c1c
mov edx, 4
call fcn.004044dc
jmp 0x46bdcc
push dword [0x470c1c]
push 0x46be20
lea edx, [ebp - 8]
mov eax, ebx
call fcn.004082f4
push dword [ebp - 8]
push 0x46be2c
mov eax, 0x470c1c
mov edx, 4
call fcn.004044dc
inc ebx
cmp ebx, 0x100
jne 0x46bd46
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x46bdfb
lea eax, [ebp - 8]
mov edx, 2
call fcn.00404180
ret
Function at 0x408947
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
mov eax, 0x4085d8
call fcn.00408973
sub esp, 4
mov dword [esp], edi
mov edi, dword [esp]
add esp, 4
inc esi
xor dword [edx], eax
and edi, esi
inc edx
push edi
pop esi
cmp edx, ebx
jne fcn.00408947
add edi, edi
mov edi, 0xe71a4985
ret
Function at 0x41e4b6
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [ebp + 8]
mov ecx, eax
push ebx
mov ebx, dword [ebp + 0xc]
and eax, 0x3f
push esi
sar ecx, 6
push edi
imul edi, eax, 0x38
mov dword [ebp - 8], ecx
mov eax, dword [ecx*4 + 0x4322a8]
push 0xa
pop edx
mov dword [ebp - 0x18], edx
mov ecx, dword [eax + edi + 0x18]
mov dword [ebp - 0x1c], ecx
mov ecx, dword [ebp + 0x10]
test ecx, ecx
je 0x41e4fc
cmp word [ebx], dx
jne 0x41e4fc
or byte [eax + edi + 0x28], 4
jmp 0x41e501
and byte [eax + edi + 0x28], 0xfb
lea edx, [ebx + ecx*2]
mov eax, ebx
mov dword [ebp - 0xc], edx
mov esi, ebx
mov dword [ebp - 4], eax
cmp ebx, edx
jae 0x41e664
mov dword [ebp - 0x10], 0xd
movzx ecx, word [eax]
mov edx, ecx
mov dword [ebp - 0x14], edx
mov edx, dword [ebp - 0xc]
cmp ecx, 0x1a
je 0x41e644
add eax, 2
cmp cx, word [ebp - 0x10]
je 0x41e542
mov dword [ebp - 4], eax
mov word [esi], cx
jmp 0x41e578
cmp eax, edx
jae 0x41e586
movzx eax, word [eax]
xor ecx, ecx
cmp ax, word [ebp - 0x18]
mov edx, eax
push 0xa
sete cl
xor eax, eax
lea ecx, [ecx*2 + 2]
add dword [ebp - 4], ecx
pop ecx
cmp dx, cx
mov edx, dword [ebp - 0xc]
sete al
dec eax
and eax, 3
add eax, ecx
mov word [esi], ax
mov eax, dword [ebp - 4]
push 2
pop ecx
add esi, ecx
cmp eax, edx
jb 0x41e51d
jmp 0x41e664
push 0
lea eax, [ebp - 0x18]
push eax
push 2
lea eax, [ebp - 4]
push eax
push dword [ebp - 0x1c]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x41e63f
cmp dword [ebp - 0x18], 0
je 0x41e63f
mov edx, dword [ebp - 8]
push 0xa
mov eax, dword [edx*4 + 0x4322a8]
test byte [eax + edi + 0x28], 0x48
je 0x41e615
lea eax, [esi + 2]
mov dword [ebp - 0x1c], eax
mov ax, word [ebp - 4]
pop ecx
mov word [ebp - 2], ax
cmp ax, cx
jne 0x41e5d9
mov word [esi], cx
jmp 0x41e610
push 0xd
pop ecx
mov word [esi], cx
movzx ecx, ax
mov eax, dword [edx*4 + 0x4322a8]
mov dx, word [ebp - 2]
shr ecx, 8
push 0xa
mov byte [eax + edi + 0x2a], dl
mov edx, dword [ebp - 8]
mov eax, dword [edx*4 + 0x4322a8]
mov byte [eax + edi + 0x2b], cl
mov eax, dword [edx*4 + 0x4322a8]
pop ecx
mov byte [eax + edi + 0x2c], cl
mov esi, dword [ebp - 0x1c]
jmp 0x41e664
pop eax
cmp word [ebp - 4], ax
jne 0x41e625
cmp esi, ebx
jne 0x41e625
mov word [esi], ax
jmp 0x41e661
push 1
push 0xffffffffffffffff
push 0xfffffffffffffffe
push dword [ebp + 8]
call fcn.0041bb9f
add esp, 0x10
push 0xa
pop eax
cmp word [ebp - 4], ax
je 0x41e664
push 0xd
pop eax
jmp 0x41e620
mov edx, dword [ebp - 8]
mov edx, dword [edx*4 + 0x4322a8]
mov al, byte [edx + edi + 0x28]
test al, 0x40
jne 0x41e65e
or al, 2
mov byte [edx + edi + 0x28], al
jmp 0x41e664
mov word [esi], cx
add esi, 2
sub esi, ebx
and esi, 0xfffffffe
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret
Function at 0x402700
Capabilities:
Create new key via cryptacquirecontext
Hash data via wincrypt
Initialize hashing via wincrypt

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4be995
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push ebx
push esi
push edi
mov eax, dword [0x50a074]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x1c], 0x4e4de4
mov dword [ebp - 0x18], 0
mov dword [ebp - 4], 0
mov dword [ebp - 0x14], 0x4e4dec
mov dword [ebp - 0x10], 0
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
call dword [eax + 4]
push 0xf0000000
push 0x18
push str.Microsoft_Enhanced_RSA_and_AES_Cryptographic_Provider
push 0
lea eax, [ebp - 0x18]
push eax
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
mov ebx, dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x40279f
mov eax, dword [ebp - 0x14]
lea ecx, [ebp - 0x14]
call dword [eax + 4]
lea eax, [ebp - 0x10]
push eax
push 0
push 0
push 0x800c
push dword [ebp - 0x18]
call dword [sym.imp.ADVAPI32.dll_CryptCreateHash]
test eax, eax
jne 0x4027a7
call ebx
mov esi, eax
test esi, esi
jne 0x4027c0
push 0
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_CryptHashData]
test eax, eax
jne 0x4027ca
call ebx
mov esi, eax
mov eax, 0xc
mov dword [edi + eax], esi
jmp 0x4027d6
push dword [ebp - 0x10]
mov ecx, edi
call fcn.00402c80
mov esi, eax
mov byte [ebp - 4], 0
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x14], 0x4e4dec
test eax, eax
je 0x4027ef
push eax
call dword [sym.imp.ADVAPI32.dll_CryptDestroyHash]
mov dword [ebp - 0x10], 0
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x1c], 0x4e4de4
test eax, eax
je 0x402814
push 0
push eax
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
mov eax, esi
mov dword [ebp - 0x18], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x403f70
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4bed20
mov eax, dword fs:[0]
push eax
push ebx
push esi
push edi
mov eax, dword [0x50a074]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, edx
mov ebx, ecx
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x403ff7
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x403ff7
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [ebp + 8]
lea edx, [esi + eax]
and ecx, 0xf
jbe 0x403fd7
cmp esi, edx
jae 0x403ff7
movzx eax, word [esi]
lea esi, [esi + eax*2]
add esi, 2
sub ecx, 1
jne 0x403fc5
cmp esi, edx
jae 0x403ff7
xor eax, eax
cmp word [esi], ax
cmove esi, eax
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x404500
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4beda6
mov eax, dword fs:[0]
push eax
sub esp, 0x2c
mov eax, dword [0x50a074]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, edx
mov dword [ebp - 0x30], eax
mov esi, ecx
mov dword [ebp - 0x34], esi
push 0
mov dword [ebp - 0x38], esi
push 0
mov dword [ebp - 0x2c], 0
mov eax, dword [eax + 0xc]
push 0x2000003
add eax, 0x30
push eax
push 1
call dword [sym.imp.CRYPT32.dll_CertNameToStrW]
mov edi, eax
xorps xmm0, xmm0
test edi, edi
je 0x404604
push edi
push 0
lea ecx, [ebp - 0x28]
mov dword [ebp - 0x18], 0
movups xmmword [ebp - 0x28], xmm0
mov dword [ebp - 0x14], 0
call fcn.00404ab0
mov dword [ebp - 4], 1
lea ecx, [ebp - 0x28]
cmp dword [ebp - 0x14], 8
mov eax, dword [ebp - 0x30]
cmovae ecx, dword [ebp - 0x28]
push edi
push ecx
mov eax, dword [eax + 0xc]
push 0x2000003
add eax, 0x30
push eax
push 1
call dword [sym.imp.CRYPT32.dll_CertNameToStrW]
mov eax, dword [ebp - 0x18]
lea ecx, [ebp - 0x28]
dec eax
xorps xmm0, xmm0
cmp dword [ebp - 0x14], 8
mov dword [ebp - 0x18], eax
cmovae ecx, dword [ebp - 0x28]
xor edx, edx
mov word [ecx + eax*2], dx
xor eax, eax
movups xmmword [esi], xmm0
movups xmm0, xmmword [ebp - 0x28]
mov word [ebp - 0x28], ax
movups xmmword [esi], xmm0
movq xmm0, qword [ebp - 0x18]
movq qword [esi + 0x10], xmm0
mov dword [ebp - 0x18], edx
mov dword [ebp - 0x14], 7
mov dword [ebp - 0x2c], 1
mov byte [ebp - 4], al
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], 7
mov word [ebp - 0x28], ax
jmp 0x404632
movups xmmword [esi], xmm0
mov dword [esi + 0x10], 0
xor eax, eax
mov dword [esi + 0x14], 0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 7
mov word [esi], ax
mov dword [ebp - 4], eax
mov dword [ebp - 0x2c], 1
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00497376
mov esp, ebp
pop ebp
ret
Function at 0x406010
Capabilities:
Get common file path

Disassembly:
sub esp, 8
lea eax, [esp + 4]
push esi
push edi
push eax
push 0x23
push 0
mov esi, edx
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderLocation]
test eax, eax
jns 0x4060b1
push str.Shell32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
test eax, eax
je 0x4060a9
push str.SHGetSpecialFolderPathW
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edi, eax
test edi, edi
je 0x4060a9
push 0x20a
call fcn.00497844
add esp, 4
mov dword [esi + 4], eax
mov dword [esi], 0x105
push 0
push 0x23
push eax
push 0
call edi
test eax, eax
je 0x40609d
mov esi, dword [esi + 4]
xor edx, edx
mov ecx, esi
cmp word [esi], dx
je 0x40609d
nop
lea ecx, [ecx + 2]
inc edx
cmp word [ecx], 0
jne 0x406080
test edx, edx
je 0x40609d
cmp word [esi + edx*2 - 2], 0x5c
je 0x40609d
mov dword [esi + edx*2], 0x5c
cmp eax, 1
pop edi
sete al
pop esi
add esp, 8
ret
pop edi
xor al, al
pop esi
add esp, 8
ret
push 0x20a
call fcn.00497844
add esp, 4
mov dword [esi + 4], eax
mov dword [esi], 0x105
push eax
push dword [esp + 0x10]
call dword [sym.imp.SHELL32.dll_SHGetPathFromIDListW]
mov edi, eax
test edi, edi
je 0x406101
mov esi, dword [esi + 4]
xor edx, edx
mov ecx, esi
cmp word [esi], dx
je 0x406101
lea ecx, [ecx + 2]
inc edx
cmp word [ecx], 0
jne 0x4060e4
test edx, edx
je 0x406101
cmp word [esi + edx*2 - 2], 0x5c
je 0x406101
mov dword [esi + edx*2], 0x5c
lea eax, [esp + 8]
mov dword [esp + 8], 0
push eax
call dword [sym.imp.SHELL32.dll_SHGetMalloc]
mov eax, dword [esp + 8]
push dword [esp + 0xc]
push eax
mov ecx, dword [eax]
call dword [ecx + 0x14]
cmp edi, 1
pop edi
sete al
pop esi
add esp, 8
ret
Function at 0x406840
Capabilities:
Create directory
Delete file
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4bf219
mov eax, dword fs:[0]
push eax
sub esp, 0x234
mov eax, dword [0x50a074]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x238], edi
mov eax, dword [ebp + 8]
mov dword [ebp - 0x23c], edi
mov dword [ebp - 0x234], 0
cmp dword [edx + 0x14], 8
jb 0x406890
mov edx, dword [edx]
lea ecx, [ebp - 0x218]
push ecx
push 0
push eax
push edx
call dword [sym.imp.KERNEL32.dll_GetTempFileNameW]
test eax, eax
jne 0x4068d8
xorps xmm0, xmm0
movups xmmword [edi], xmm0
movq qword [edi + 0x10], xmm0
movups xmmword [edi], xmm0
mov dword [edi + 0x10], eax
mov dword [edi + 0x14], eax
mov dword [edi + 0x10], eax
mov dword [edi + 0x14], 7
mov word [edi], ax
mov dword [ebp - 4], eax
mov dword [ebp - 0x234], 1
jmp 0x4069f9
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push 0
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
xorps xmm0, xmm0
mov dword [ebp - 0x220], 0
lea ecx, [ebp - 0x218]
mov dword [ebp - 0x21c], 0
movups xmmword [ebp - 0x230], xmm0
lea edx, [ecx + 2]
nop dword [eax + eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x406920
sub ecx, edx
lea eax, [ebp - 0x218]
sar ecx, 1
push ecx
push eax
lea ecx, [ebp - 0x230]
call fcn.00403c90
mov dword [ebp - 4], 3
lea eax, [ebp - 0x230]
push 1
sub esp, 0x18
mov dword [ebp - 0x238], esp
mov esi, esp
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0x240], esp
push eax
call fcn.00404f50
mov byte [ebp - 4], 4
mov byte [ebp - 4], 3
mov ecx, esi
call fcn.00421f20
add esp, 0x18
mov byte [ebp - 4], 5
mov byte [ebp - 4], 3
mov ecx, edi
call fcn.00422330
mov byte [ebp - 4], 3
mov dword [ebp - 0x234], 1
mov byte [ebp - 4], 0
mov ecx, dword [ebp - 0x21c]
cmp ecx, 8
jb 0x4069dc
mov edx, dword [ebp - 0x230]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x4069d2
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x406a16
push ecx
push edx
call fcn.00497801
add esp, 8
xor eax, eax
mov dword [ebp - 0x220], 0
mov dword [ebp - 0x21c], 7
mov word [ebp - 0x230], ax
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00497376
mov esp, ebp
pop ebp
ret
call fcn.0049c7bf
int3
Function at 0x407360
Capabilities:
Create directory
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4bf585
mov eax, dword fs:[0]
push eax
sub esp, 0x5c
mov eax, dword [0x50a074]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov eax, dword fs:[0x2c]
mov esi, dword [eax]
mov eax, dword [0x50cedc]
cmp eax, dword [esi + 4]
jle 0x407478
push 0x50cedc
call fcn.004974da
add esp, 4
cmp dword [0x50cedc], 0xffffffff
jne 0x407478
mov dword [ebp - 4], 0
push 0x38
mov dword [ebp - 0x5c], 0x50cee0
mov dword [0x50cee0], 0
mov dword [0x50cee4], 0
mov dword [0x50cee8], 0
call fcn.0049780f
add esp, 4
mov dword [eax], eax
mov dword [eax + 4], eax
mov dword [0x50cee4], eax
mov byte [ebp - 4], 1
mov dword [0x50ceec], 0
mov dword [0x50cef0], 0
mov dword [0x50cef4], 0
mov byte [ebp - 4], 2
mov ecx, 0x50ceec
push dword [0x50cee4]
mov dword [0x50cef8], 7
push 0x10
mov dword [0x50cefc], 8
mov dword [0x50cee0], 0x3f800000
call fcn.004076c0
mov byte [ebp - 4], 0
push 0x4d6a00
call fcn.004977ec
mov dword [ebp - 4], 0xffffffff
push 0x50cedc
call fcn.00497490
add esp, 8
mov eax, dword [0x50cecc]
cmp eax, dword [esi + 4]
jle 0x4074c0
push 0x50cecc
call fcn.004974da
add esp, 4
cmp dword [0x50cecc], 0xffffffff
jne 0x4074c0
mov dword [ebp - 4], 5
push 0x4d6960
call fcn.004977ec
mov dword [ebp - 4], 0xffffffff
push 0x50cecc
call fcn.00497490
add esp, 8
cmp dword [edi + 0x14], 8
mov esi, edi
mov ebx, dword [edi + 0x10]
jb 0x4074cd
mov esi, dword [edi]
xor ecx, ecx
mov edx, 0x811c9dc5
add ebx, ebx
je 0x4074e9
movzx eax, byte [ecx + esi]
inc ecx
xor eax, edx
imul edx, eax, 0x1000193
cmp ecx, ebx
jb 0x4074d8
push edx
push edi
lea eax, [ebp - 0x68]
push eax
call fcn.00408080
mov esi, dword [0x50cee4]
mov eax, dword [eax + 4]
test eax, eax
cmovne esi, eax
cmp esi, dword [0x50cee4]
jne 0x407511
mov esi, 0x50aae8
jmp 0x407514
add esi, 0x20
cmp dword [esi + 0x10], 0
je 0x407534
cmp dword [esi + 0x14], 8
mov eax, esi
jb 0x407524
mov eax, dword [esi]
push 0
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov eax, esi
jmp 0x4075b8
cmp dword [edi + 0x14], 8
mov edx, edi
jb 0x40753e
mov edx, dword [edi]
push 0
lea ecx, [ebp - 0x58]
call fcn.00406770
add esp, 4
mov dword [ebp - 4], 6
lea ecx, [ebp - 0x40]
push edi
call fcn.00404f50
mov byte [ebp - 4], 7
lea eax, [ebp - 0x28]
mov dword [ebp - 0x5c], eax
lea ecx, [ebp - 0x28]
lea eax, [ebp - 0x58]
push eax
call fcn.00404f50
mov byte [ebp - 4], 0xb
lea eax, [ebp - 0x40]
push eax
lea eax, [ebp - 0x60]
push eax
call fcn.004077c0
mov byte [ebp - 4], 0xc
lea eax, [ebp - 0x28]
mov dword [ebp - 0x64], eax
mov byte [ebp - 4], 0xc
mov ecx, eax
call fcn.00403e10
mov byte [ebp - 4], 6
lea ecx, [ebp - 0x40]
call fcn.00403e10
mov esi, dword [ebp - 0x60]
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x58]
call fcn.00403e10
lea eax, [esi + 0x20]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00497376
mov esp, ebp
pop ebp
ret
Function at 0x4077c0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4bf61d
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push ebx
push esi
push edi
mov eax, dword [0x50a074]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, dword [ebp + 0xc]
mov edx, ebx
cmp dword [ebx + 0x14], 8
mov edi, dword [ebx + 0x10]
jb 0x4077f8
mov edx, dword [ebx]
xor ecx, ecx
mov esi, 0x811c9dc5
add edi, edi
je 0x407814
movzx eax, byte [ecx + edx]
inc ecx
xor eax, esi
imul esi, eax, 0x1000193
cmp ecx, edi
jb 0x407803
push esi
push ebx
lea eax, [ebp - 0x1c]
push eax
call fcn.00408080
mov ecx, dword [ebp - 0x18]
test ecx, ecx
je 0x407843
mov eax, dword [ebp + 8]
mov dword [eax], ecx
mov byte [eax + 4], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
cmp dword [0x50cee8], 0x4924924
je 0x4079a0
mov dword [ebp - 0x14], 0x50cee4
mov dword [ebp - 0x10], 0
mov dword [ebp - 4], 0
push 0x38
mov dword [ebp - 0x10], 0
call fcn.0049780f
mov edi, eax
add esp, 4
mov dword [ebp - 0x10], edi
lea ecx, [edi + 8]
push ebx
call fcn.00408130
mov dword [ebp - 4], 1
mov ecx, dword [0x50cee8]
mov ebx, dword [0x50cefc]
lea eax, [ecx + 1]
movd xmm0, eax
cvtdq2pd xmm0, xmm0
shr eax, 0x1f
movd xmm1, ebx
addsd xmm0, qword [eax*8 + 0x4edd90]
cvtdq2pd xmm1, xmm1
mov eax, ebx
shr eax, 0x1f
cvtpd2ps xmm0, xmm0
addsd xmm1, qword [eax*8 + 0x4edd90]
movaps xmm2, xmm0
cvtpd2ps xmm1, xmm1
divss xmm2, xmm1
movss xmm1, dword [0x50cee0]
comiss xmm2, xmm1
jbe 0x40792e
divss xmm0, xmm1
call fcn.00408200
call fcn.004bdbb0
mov ecx, 8
cmp eax, ecx
cmova ecx, eax
cmp ebx, ecx
jae 0x407910
cmp ebx, 0x200
jae 0x40790e
shl ebx, 3
cmp ebx, ecx
jae 0x407910
mov ebx, ecx
push ebx
call fcn.00407b20
push esi
lea eax, [edi + 8]
push eax
lea eax, [ebp - 0x1c]
push eax
call fcn.00408080
mov ecx, dword [0x50cee8]
mov edx, dword [eax]
jmp 0x407931
mov edx, dword [ebp - 0x1c]
mov ebx, dword [edx + 4]
inc ecx
mov dword [0x50cee8], ecx
mov dword [edi], edx
mov dword [edi + 4], ebx
mov dword [ebx], edi
mov dword [edx + 4], edi
mov eax, dword [0x50cef8]
mov ecx, dword [0x50ceec]
and eax, esi
mov dword [ebp - 0x10], 0
mov esi, dword [ecx + eax*8]
cmp esi, dword [0x50cee4]
jne 0x407969
mov dword [ecx + eax*8], edi
jmp 0x407978
cmp esi, edx
jne 0x407972
mov dword [ecx + eax*8], edi
jmp 0x40797c
cmp dword [ecx + eax*8 + 4], ebx
jne 0x40797c
mov dword [ecx + eax*8 + 4], edi
mov eax, dword [ebp + 8]
mov dword [eax], edi
mov byte [eax + 4], 1
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
push str.unordered_map_set_too_long
call fcn.00480755
int3