joyce8/EMBER2024-capa huggingface dataset:
Function at 0x545776
Capabilities:
Encode data using xor

Disassembly:
ficom word [edx + ecx]
pop esp
cmp dword [ebx + 0x75], ebx
xor byte [ebx - 0x48], ch
jne 0x5457c6
test dword [ebx + eax], ebx
lodsd eax, dword [esi]
outsb dx, byte [esi]
test ecx, ebx
salc
dec esi
test al, 0x69
dec ecx
cmp byte [ebx - 0x63f76fa1], dh
pop eax
xchg edi, eax
stosd dword es:[edi], eax
ja 0x545772
inc edi
mov ah, 0x31
pop ebx
clc
xor edx, 0x41ff4d0
sbb al, dl
add al, 0x64
sbb al, dl
test al, 0x4b
dec ebp
mov esi, 0x977d73eb
aad 0x1d
and ecx, dword [edx + ebp]
cld
jl 0x54579f
mov word [esi], gs
pop esp
lodsb al, byte [esi]
lodsb al, byte [esi]
movsd dword es:[edi], dword [esi]
cmpsd dword [esi], dword es:[edi]
rol byte [eax - 0x72], 0xd
ljmp 0xe8e1
dec esi
pushfd
inc edx
push ecx
stc
xor eax, 0xc18382f2
inc ecx
mov bl, 0xfa
enter 0xffffffffffff9912, 9
cdq
or dword [edi - 0x6792e6cb], ebp
cmp eax, 0x32f901b5
cmp eax, 0x259378e9
or dword [edi - 0x6792e6cb], ebp
cmp eax, 0x32f901b5
cmp eax, 0x259378e9
out dx, eax
inc ecx
stosb byte es:[edi], al
sub bl, byte [ecx - 0x27928326]
push es
popfd
push eax
xor ebp, esp
mov eax, 0xaac35a6d
fstp xword [ebx]
insd dword es:[edi], dx
cmp dword [edi + edi*8 - 0x21], ebx
out dx, eax
cmpsb byte [esi], byte es:[edi]
push ds
fidivr word [edx - 0x7e7245b4]
xor dword [ecx - 0x73a2de01], ebp
push es
sbb ch, ah
out dx, eax
mov al, byte [0xc2c2ae4]
stc
out 0x89, al
popfd
wait
popfd
push es
mov dword [0x72817c4d], eax
ficomp word [esp + ecx*8 - 0x53]
mov esp, 0x860ca28d
mov edx, 0xe1acf18d
jbe 0x5457d7
salc
int 0x88
mov byte [ecx - 0x649984d], bh
sar byte [eax - 0x9fae245], 0x1e
fmul qword [edi + 0x6cc30a1d]
std
pop ebp
mov esi, 0x53316a1c
iretd
Function at 0x618216
Capabilities:
Encode data using xor

Disassembly:
sub dl, al
rcl ebx, 0xec
in al, 0x34
mov ah, 0x25
insb byte es:[edi], dx
adc bl, bh
inc edx
cmpsb byte [esi], byte es:[edi]
test eax, 0xfb9dff7d
jge 0x618183
call [ebp + 0x12a9c7fb]
jmp 0xd9526fa1
popfd
sti
invalid
or al, 0x48
jno 0x618182
mov eax, dword [0x56f0cc38]
pop eax
salc
xchg ebp, eax
rol byte [ebp - 0x5608a2b6], 0x67
push cs
dec ebp
scasd eax, dword es:[edi]
inc esi
test dword [ecx + 0x68eb4a20], eax
ror dl, 0x51
stosd dword es:[edi], eax
lds esp, [ebx + 0x61]
shl byte [edx - 0x4fd08eaa], cl
push esi
out dx, al
xor bl, al
mov dword [edx + 0x56], esi
loopne 0x618173
xchg edi, eax
xchg byte [eax], ch
add ah, byte [ebx - 0x38b63916]
xor byte [0x7042754a], al
loop 0x61823f
sbb dh, byte [ecx - 0x5be39af1]
pushal
daa
cld
mov bh, 0xbf
xor ah, byte [edi + 0x53]
pop esp
adc esi, ebx
xor dword [ebp - 0x41175b96], esp
enter 0x1ba3, 0x5f
add eax, 0x7fd0e641
loopne 0x61819a
out dx, eax
pop ss
mov ebx, dword [edx + 0x47d446a8]
mov esi, dword [ebp + edx*8 + 0x10f7346c]
push ss
dec esp
movsb byte es:[edi], byte [esi]
enter 0x4152, 0xffffffffffffffd7
clc
cmpsd dword [esi], dword es:[edi]
inc esp
xor byte [eax*4 + 0x190107ea], bl
dec ebx
xor ch, cl
das
rol dword [edx + 0x4f8cbc4a], 1
sahf
jle 0x618202
xchg esi, eax
xor dword [ebp + 0x6c], 0x645709af
aad 0x51
or dword [ebp + 0xd024bc7], 0x94077074
add cl, byte [0x94077074]
push es
retf

Function at 0x6572cd
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov edx, dword [ebp + 8]
xor ecx, ecx
mov eax, 0x65e3b8
cmp edx, dword [eax]
je 0x6572ef
add eax, 8
inc ecx
cmp eax, 0x65e448
jl 0x6572e0
push esi
mov esi, ecx
shl esi, 3
cmp edx, dword [esi + 0x65e3b8]
jne 0x65741d
mov eax, dword [0xa63d28]
cmp eax, 1
je 0x6573f7
test eax, eax
jne 0x657320
cmp dword [0x65e2e4], 1
je 0x6573f7
cmp edx, 0xfc
je 0x65741d
lea eax, [ebp - 0x1a4]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x657357
lea eax, [ebp - 0x1a4]
push 0x65c648
push eax
call fcn.00657cb0
pop ecx
pop ecx
lea eax, [ebp - 0x1a4]
push edi
push eax
lea edi, [ebp - 0x1a4]
call fcn.00658140
inc eax
pop ecx
cmp eax, 0x3c
jbe 0x65739a
lea eax, [ebp - 0x1a4]
push eax
call fcn.00658140
mov edi, eax
lea eax, [ebp - 0x1a4]
sub eax, 0x3b
push 3
add edi, eax
push 0x65c644
push edi
call fcn.0065a010
add esp, 0x10
lea eax, [ebp - 0xa0]
push 0x65c628
push eax
call fcn.00657cb0
lea eax, [ebp - 0xa0]
push edi
push eax
call fcn.00657cc0
lea eax, [ebp - 0xa0]
push 0x65c624
push eax
call fcn.00657cc0
push dword [esi + 0x65e3bc]
lea eax, [ebp - 0xa0]
push eax
call fcn.00657cc0
push 0x12010
lea eax, [ebp - 0xa0]
push 0x65c5fc
push eax
call fcn.00659f84
add esp, 0x2c
pop edi
jmp 0x65741d
lea eax, [ebp + 8]
lea esi, [esi + 0x65e3bc]
push 0
push eax
push dword [esi]
call fcn.00658140
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop esi
leave
ret
Function at 0x42c4f5
Capabilities:
Delete file

Disassembly:
push 0x3c
mov eax, 0x5d2ce3
call fcn.0059a00f
lea eax, [ebp - 0x48]
mov esi, 0x668598
push eax
mov ecx, esi
call fcn.004060a2
mov eax, dword [eax]
xor edi, edi
push 7
xor ecx, ecx
mov dword [ebp - 0x40], edi
pop ebx
mov word [ebp - 0x40], cx
lea ecx, [ebp - 0x40]
push eax
mov dword [ebp - 4], edi
mov dword [ebp - 0x30], edi
mov dword [ebp - 0x2c], ebx
call fcn.00404983
mov ecx, dword [ebp - 0x48]
mov byte [ebp - 4], 2
lea ecx, [ecx - 0x10]
call fcn.00405641
push str.cache.dat
lea ecx, [ebp - 0x40]
call fcn.00406547
cmp dword [ebp - 0x2c], 8
lea eax, [ebp - 0x40]
cmovae eax, dword [ebp - 0x40]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
lea eax, [ebp - 0x44]
mov ecx, esi
push eax
call fcn.004060a2
mov eax, dword [eax]
xor ecx, ecx
mov dword [ebp - 0x28], edi
mov word [ebp - 0x28], cx
lea ecx, [ebp - 0x28]
push eax
mov byte [ebp - 4], 3
mov dword [ebp - 0x18], edi
mov dword [ebp - 0x14], ebx
call fcn.00404983
mov ecx, dword [ebp - 0x44]
mov byte [ebp - 4], 5
lea ecx, [ecx - 0x10]
call fcn.00405641
lea eax, [ebp - 0x28]
push eax
call fcn.00471a90
lea ecx, [ebp - 0x28]
mov dword [esp], str.IconsCache
call fcn.00406547
lea eax, [ebp - 0x28]
push eax
call fcn.00471a90
lea eax, [ebp - 0x28]
push eax
call fcn.0046fd40
mov eax, dword [ebp - 0x14]
mov esi, 0x1000
pop ecx
pop ecx
cmp eax, 8
jb 0x42c604
mov ecx, dword [ebp - 0x28]
lea eax, [eax*2 + 2]
mov dword [ebp - 0x44], eax
mov dword [ebp - 0x48], ecx
cmp eax, esi
jb 0x42c5fb
lea eax, [ebp - 0x44]
push eax
lea eax, [ebp - 0x48]
push eax
call fcn.004048a9
mov eax, dword [ebp - 0x44]
pop ecx
pop ecx
mov ecx, dword [ebp - 0x48]
push eax
push ecx
call fcn.00599f8e
pop ecx
pop ecx
xor eax, eax
mov dword [ebp - 0x18], edi
mov word [ebp - 0x28], ax
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x14], ebx
cmp eax, 8
jb 0x42c64a
mov ecx, dword [ebp - 0x40]
lea eax, [eax*2 + 2]
mov dword [ebp - 0x48], eax
mov dword [ebp - 0x44], ecx
cmp eax, esi
jb 0x42c641
lea eax, [ebp - 0x48]
push eax
lea eax, [ebp - 0x44]
push eax
call fcn.004048a9
mov eax, dword [ebp - 0x48]
pop ecx
pop ecx
mov ecx, dword [ebp - 0x44]
push eax
push ecx
call fcn.00599f8e
pop ecx
pop ecx
mov al, 1
call fcn.00599fbe
ret

Function at 0x433aa5
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push edi
push 0x11
mov edi, ecx
call dword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
jns 0x433b26
push esi
lea eax, [ebp - 0xc]
mov ecx, edi
push eax
call fcn.00431f4d
lea ecx, [ebp - 0xc]
mov esi, dword [eax + 4]
sub esi, dword [eax]
sar esi, 2
call fcn.0041de7f
cmp esi, 1
pop esi
ja 0x433b42
mov eax, dword [ebp + 8]
sub eax, 0x45
je 0x433b1d
dec eax
sub eax, 1
je 0x433b14
sub eax, 0xb
je 0x433afd
sub eax, 5
jne 0x433b26
push eax
push 0x8807
jmp 0x433b04
push 0
push 0x8805
push 0x111
push dword [edi + 0x20]
call dword [sym.imp.USER32.dll_PostMessageW]
jmp 0x433b44
push 0
push 0x8808
jmp 0x433b04
push 0
push 0x8806
jmp 0x433b04
push 0x10
call dword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
jns 0x433b42
cmp dword [ebp + 8], 0x2e
jne 0x433b42
push 0
push 0x8803
jmp 0x433b04
xor eax, eax
pop edi
leave
ret 4
Function at 0x449f72
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov ebx, ecx
push edi
call fcn.00449ebd
test edi, edi
je 0x449fa0
cmp dword [edi + 8], 0
je 0x449fa0
push dword [ebx + 4]
push str.Removing__s
push dword [edi + 8]
call fcn.0044bbd4
add esp, 0xc
mov ecx, ebx
call fcn.0044aac9
test edi, edi
je 0x449fb0
mov eax, dword [edi + 8]
jmp 0x449fb2
xor eax, eax
push eax
mov ecx, ebx
call fcn.0044aef0
mov eax, dword [ebx + 0x1c]
sub eax, dword [ebx + 0x18]
push 0x2c
cdq
pop ecx
idiv ecx
test eax, eax
je 0x44a003
lea esi, [ebx + 4]
mov dword [ebp + 8], 0x7d0
push dword [esi]
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x44a003
cmp dword [ebp + 8], 0
jle 0x44a04a
push dword [esi]
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
sub dword [ebp + 8], 0x64
mov esi, eax
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
test esi, esi
lea esi, [ebx + 4]
je 0x449fe0
add ebx, 4
push dword [ebx]
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov esi, dword [edi + 4]
mov dword [ebp + 8], eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp dword [ebp + 8], 0
jne 0x44a0b1
cmp eax, 5
jne 0x44a078
push ebx
push dword [0x6689bc]
call fcn.0044b476
pop ecx
pop ecx
mov ecx, dword [edi + 8]
test ecx, ecx
je 0x44a0bc
push str.__ERROR_ACCESS_DENIED__the_file_will_be_deleted_on_the_next_system_restart
call fcn.0044bbcb
jmp 0x44a0bc
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 5
jne 0x44a003
push esi
push dword [0x6689bc]
call fcn.0044b476
pop ecx
pop ecx
mov ecx, dword [edi + 8]
test ecx, ecx
je 0x44a074
push str.__ERROR_ACCESS_DENIED__the_file_will_be_deleted_on_the_next_system_restart
call fcn.0044bbcb
xor eax, eax
jmp 0x44a0bf
cmp eax, 2
jne 0x44a08d
test esi, esi
je 0x44a088
mov ecx, esi
call fcn.00448128
xor eax, eax
inc eax
jmp 0x44a0bf
cmp dword [edi + 8], 0
je 0x44a0a4
push eax
push str.__DeleteFile_failed_with_error__u
push dword [edi + 8]
call fcn.0044bbd4
add esp, 0xc
test esi, esi
je 0x44a0bc
mov ecx, esi
call fcn.00448128
jmp 0x44a0bc
test esi, esi
je 0x44a0bc
mov ecx, esi
call fcn.0044814c
mov eax, dword [ebp + 8]
pop edi
pop esi
pop ebx
pop ebp
ret 4
Function at 0x44a0c6
Capabilities:
Check if file exists
Delete directory

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
lea eax, [ebp - 4]
mov ebx, ecx
push eax
call fcn.00445724
push dword [eax]
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
mov ecx, dword [ebp - 4]
mov esi, eax
add ecx, 0xfffffff0
call fcn.00405641
test esi, esi
je 0x44a13f
mov esi, dword [ebp + 8]
mov ecx, ebx
push esi
call fcn.00449f14
cmp dword [esi + 8], 0
mov edi, dword [esi + 4]
mov dword [ebp + 8], eax
je 0x44a11e
push dword [ebx + 4]
push str.Removing__s
push dword [esi + 8]
call fcn.0044bbd4
mov eax, dword [ebp + 8]
add esp, 0xc
test eax, eax
je 0x44a19b
lea eax, [ebx + 4]
push dword [eax]
mov dword [ebp + 8], eax
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
test eax, eax
je 0x44a149
test edi, edi
je 0x44a13f
mov ecx, edi
call fcn.0044814c
xor eax, eax
inc eax
pop edi
pop esi
pop ebx
leave
ret 4
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp dword [esi + 8], 0
mov ebx, eax
je 0x44a168
push ebx
push str.__RemoveDirectory_failed_with_error__u
push dword [esi + 8]
call fcn.0044bbd4
add esp, 0xc
cmp ebx, 0x20
jne 0x44a18e
push dword [ebp + 8]
push dword [0x6689bc]
call fcn.0044b476
pop ecx
pop ecx
mov ecx, dword [esi + 8]
test ecx, ecx
je 0x44a18e
push str.__ERROR_SHARING_VIOLATION__the_folder_will_be_deleted_on_the_next_system_restart
call fcn.0044bbcb
test edi, edi
je 0x44a1ac
mov ecx, edi
call fcn.00448128
jmp 0x44a1ac
mov ecx, dword [esi + 8]
test ecx, ecx
je 0x44a1ac
push str.__Unable_to_remove_a_non_empty_directory._Normally_it_will_be_deleted_on_the_next_system_reboot.
call fcn.0044bbcb
xor eax, eax
jmp 0x44a142

Function at 0x44aac9
Capabilities:
Set file attributes

Disassembly:
push 0x80
push dword [ecx + 4]
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
ret
Function at 0x44aef0
Capabilities:
Create process on windows

Disassembly:
push 0x1c4
mov eax, 0x5d6cf3
call fcn.0059a00f
mov edi, dword [ebp + 8]
lea esi, [ecx + 4]
push esi
lea ecx, [ebp - 0x178]
call fcn.00447936
and dword [ebp - 4], 0
lea ecx, [ebp - 0x178]
call fcn.00447b3f
test eax, eax
je 0x44b050
push str.DllCanUnloadNow
lea ecx, [ebp - 0x178]
call fcn.00447af4
test eax, eax
je 0x44b050
push str.DllGetClassObject
lea ecx, [ebp - 0x178]
call fcn.00447af4
test eax, eax
je 0x44b050
push str.DllRegisterServer
lea ecx, [ebp - 0x178]
call fcn.00447af4
test eax, eax
je 0x44b050
push str.DllUnregisterServer
lea ecx, [ebp - 0x178]
call fcn.00447af4
test eax, eax
je 0x44b050
test edi, edi
je 0x44af98
push str.__Unregister_COM_Object
mov ecx, edi
call fcn.0044bbcb
push 0x44
pop ebx
push ebx
lea eax, [ebp - 0x1d0]
push 0
push eax
call fcn.0059dbb0
mov dword [ebp - 0x1d0], ebx
lea eax, [ebp - 0x18c]
push 0x10
xor ebx, ebx
push ebx
push eax
call fcn.0059dbb0
add esp, 0x18
lea ecx, [ebp - 0x17c]
call fcn.00404c19
push dword [esi]
lea eax, [ebp - 0x17c]
mov byte [ebp - 4], 1
push str.regsvr32.exe__s__u___s_
push eax
call fcn.00405013
mov esi, dword [ebp - 0x17c]
lea eax, [ebp - 0x18c]
add esp, 0xc
push eax
lea eax, [ebp - 0x1d0]
push eax
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x44b038
push 0xbb8
push dword [ebp - 0x18c]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push dword [ebp - 0x18c]
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call edi
push dword [ebp - 0x188]
call edi
jmp 0x44b048
test edi, edi
je 0x44b048
push str.__Unregister_COM_Object:_failed_to_create_regsvr32_process
mov ecx, edi
call fcn.0044bbcb
lea ecx, [esi - 0x10]
call fcn.00405641
lea ecx, [ebp - 0x178]
call fcn.004479a0
call fcn.00599fbe
ret 4

Function at 0x44c67c
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, dword [ecx + 0x2c]
push edi
mov edi, dword [ecx + 0x30]
mov eax, edi
sub eax, esi
push 0x2c
cdq
pop ebx
idiv ebx
test eax, eax
je 0x44c741
call fcn.0044c170
test eax, eax
je 0x44c741
cmp esi, edi
je 0x44c741
mov ebx, dword [ebp + 8]
test ebx, ebx
je 0x44c6c7
push dword [esi + 4]
push str.__TerminateProcess__u
push ebx
call fcn.0044bbd4
add esp, 0xc
push dword [esi + 4]
push 0
push 0x1fffff
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov dword [ebp + 8], eax
test eax, eax
je 0x44c71d
push 0
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
test eax, eax
jne 0x44c704
test ebx, ebx
je 0x44c704
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.__TerminateProcess_failed_with_error__u
push ebx
call fcn.0044bbd4
add esp, 0xc
push 0x5dc
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x44c736
test ebx, ebx
je 0x44c736
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.__OpenProcess_failed_with_error__u
push ebx
call fcn.0044bbd4
add esp, 0xc
add esi, 0x2c
cmp esi, edi
jne 0x44c6b2
pop edi
pop esi
pop ebx
pop ebp
ret 4
Function at 0x463090
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5d9615
mov eax, dword fs:[0]
push eax
sub esp, 0x18
push ebx
push esi
push edi
mov eax, dword [0x65eb68]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov edi, dword [ebp + 8]
mov edx, edi
cmp dword [edi + 0x14], 0x10
jb 0x4630c7
mov edx, dword [edi]
xor ecx, ecx
mov esi, 0x811c9dc5
cmp dword [edi + 0x10], ecx
jbe 0x4630e5
movzx eax, byte [ecx + edx]
inc ecx
xor eax, esi
imul esi, eax, 0x1000193
cmp ecx, dword [edi + 0x10]
jb 0x4630d3
push esi
push edi
lea eax, [ebp - 0x14]
mov ecx, ebx
push eax
call fcn.0045e6e0
mov eax, dword [ebp - 0x10]
test eax, eax
jne 0x4631b5
cmp dword [ebx + 8], 0x6666666
je 0x4631cc
lea eax, [ebx + 4]
mov dword [ebp - 0x1c], eax
push 0x28
mov dword [ebp - 4], 0
mov dword [ebp - 0x18], 0
call fcn.005649a6
mov ecx, eax
add esp, 4
mov dword [ebp - 0x18], ecx
push edi
lea edi, [ecx + 8]
mov ecx, edi
call fcn.0045a330
xorps xmm0, xmm0
movq qword [edi + 0x18], xmm0
mov dword [edi + 0x1c], 0
mov eax, dword [ebx + 8]
inc eax
mov dword [ebp - 4], 1
movd xmm0, eax
cvtdq2pd xmm0, xmm0
shr eax, 0x1f
addsd xmm0, qword [eax*8 + 0x5edf10]
mov eax, dword [ebx + 0x1c]
cvtpd2ps xmm1, xmm0
movd xmm0, eax
cvtdq2pd xmm0, xmm0
shr eax, 0x1f
addsd xmm0, qword [eax*8 + 0x5edf10]
cvtpd2ps xmm0, xmm0
divss xmm1, xmm0
comiss xmm1, dword [ebx]
jbe 0x4631a6
mov ecx, ebx
call fcn.00463b00
push esi
push edi
lea eax, [ebp - 0x24]
mov ecx, ebx
push eax
call fcn.0045e6e0
mov ecx, dword [eax]
jmp 0x4631a9
mov ecx, dword [ebp - 0x14]
push dword [ebp - 0x18]
push ecx
push esi
mov ecx, ebx
call fcn.00463a60
add eax, 0x20
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
push str.unordered_map_set_too_long
call fcn.0059b7e1
int3
Function at 0x463720
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov edx, dword [ebp + 8]
mov eax, 0x1fffffff
push ebx
mov ebx, ecx
bsr ecx, eax
push esi
push edi
mov edi, 1
mov dword [ebp - 0x10], ebx
mov eax, edi
shl eax, cl
cmp edx, eax
ja 0x463869
mov esi, dword [ebx + 4]
lea eax, [edx - 1]
or eax, edi
mov dword [ebp - 8], esi
bsr ecx, eax
push esi
lea ecx, [ecx + 1]
shl edi, cl
lea ecx, [ebx + 0xc]
lea eax, [edi + edi]
push eax
call fcn.004634f0
mov ecx, dword [ebx + 4]
lea eax, [edi - 1]
mov dword [ebx + 0x18], eax
mov dword [ebx + 0x1c], edi
mov ecx, dword [ecx]
mov edx, ecx
cmp ecx, esi
je 0x46383c
movzx eax, byte [ecx + 8]
mov edi, dword [ebx + 0x18]
xor eax, 0x811c9dc5
mov edx, dword [edx]
imul eax, eax, 0x1000193
and edi, eax
mov eax, dword [ebx + 0xc]
mov ebx, dword [eax + edi*8]
mov dword [ebp - 4], ebx
lea eax, [eax + edi*8]
mov dword [ebp - 0xc], eax
cmp ebx, esi
jne 0x4637b5
mov dword [eax], ecx
mov dword [eax + 4], ecx
jmp 0x46382f
mov eax, dword [eax + 4]
mov bl, byte [ecx + 8]
cmp bl, byte [eax + 8]
mov ebx, dword [ebp - 4]
jne 0x4637f2
mov eax, dword [eax]
mov dword [ebp + 8], eax
cmp eax, ecx
je 0x4637ea
mov ebx, dword [ecx + 4]
mov esi, dword [ebp + 8]
mov dword [ebx], edx
mov edi, dword [edx + 4]
mov dword [edi], eax
mov eax, dword [eax + 4]
mov dword [eax], ecx
mov dword [esi + 4], edi
mov esi, dword [ebp - 8]
mov dword [edx + 4], ebx
mov dword [ecx + 4], eax
mov eax, dword [ebp - 0xc]
mov dword [eax + 4], ecx
jmp 0x46382f
mov edi, eax
cmp ebx, eax
je 0x46380c
mov eax, dword [eax + 4]
mov edi, eax
mov bl, byte [ecx + 8]
cmp bl, byte [eax + 8]
mov ebx, dword [ebp - 4]
je 0x463845
cmp ebx, eax
jne 0x4637f8
mov eax, dword [ecx + 4]
mov dword [ebp + 8], eax
mov dword [eax], edx
mov ebx, dword [edx + 4]
mov dword [ebx], edi
mov eax, dword [edi + 4]
mov dword [eax], ecx
mov dword [edi + 4], ebx
mov edi, dword [ebp + 8]
mov dword [edx + 4], edi
mov dword [ecx + 4], eax
mov eax, dword [ebp - 0xc]
mov dword [eax], ecx
mov ebx, dword [ebp - 0x10]
mov ecx, edx
cmp edx, esi
jne 0x463782
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
mov ebx, dword [ecx + 4]
mov eax, dword [eax]
mov dword [ebp + 8], eax
mov esi, eax
mov dword [ebx], edx
mov edi, dword [edx + 4]
mov dword [edi], eax
mov eax, dword [eax + 4]
mov dword [eax], ecx
mov dword [esi + 4], edi
mov esi, dword [ebp - 8]
mov dword [edx + 4], ebx
mov dword [ecx + 4], eax
jmp 0x46382f
push str.invalid_hash_bucket_count
call fcn.0059b7e1
int3
Function at 0x46fa20
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push 1
push 0
push 0
push dword [ebp + 8]
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
xor ecx, ecx
cmp eax, 0x20
cmovle eax, ecx
pop ebp
ret

Function at 0x46fd40
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x22c
mov eax, dword [0x65eb68]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
xor al, al
push edi
mov edi, dword [esi + 0x10]
test edi, edi
je 0x46fe09
cmp edi, 0x104
jae 0x46fe09
push 0x208
lea eax, [ebp - 0x20c]
push 0
push eax
call fcn.0059dbb0
add esp, 0xc
cmp dword [esi + 0x14], 8
jb 0x46fd8f
mov esi, dword [esi]
lea eax, [edi + edi]
push eax
lea eax, [ebp - 0x20c]
push esi
push eax
call fcn.0059d630
lea eax, [ebp - 0x20c]
mov dword [ebp - 0x22c], 0
mov dword [ebp - 0x224], eax
add esp, 0xc
mov eax, 0x414
mov dword [ebp - 0x220], 0
mov word [ebp - 0x21c], ax
lea eax, [ebp - 0x22c]
mov dword [ebp - 0x21a], 0
push eax
mov dword [ebp - 0x216], 0
mov dword [ebp - 0x212], 0
mov dword [ebp - 0x228], 3
call dword [sym.imp.SHELL32.dll_SHFileOperationW]
test eax, eax
sete al
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.00599f9c
mov esp, ebp
pop ebp
ret
Function at 0x471bd0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5da4e5
mov eax, dword fs:[0]
push eax
sub esp, 0x4c
mov eax, dword [0x65eb68]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edx, dword [ebp + 8]
xor bl, bl
test edx, edx
je 0x471dc5
cmp word [edx], 0
je 0x471dc5
mov ecx, edx
mov dword [ebp - 0x28], 0
xor eax, eax
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 7
mov word [ebp - 0x28], ax
lea esi, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x471c32
sub ecx, esi
sar ecx, 1
push ecx
push edx
lea ecx, [ebp - 0x28]
call fcn.004049aa
push 0
push 0x5f10fc
lea eax, [ebp - 0x28]
mov dword [ebp - 4], 0
push 0x5f714c
push eax
call fcn.00406ebd
mov ecx, dword [ebp - 0x18]
add esp, 0x10
cmp ecx, 2
jbe 0x471d6b
cmp ecx, 1
jbe 0x471de3
mov esi, dword [ebp - 0x14]
lea eax, [ebp - 0x28]
mov edi, dword [ebp - 0x28]
cmp esi, 8
cmovae eax, edi
cmp word [eax + 2], 0x3a
jne 0x471d71
push 4
push str..._
cmp esi, 8
lea eax, [ebp - 0x28]
push 0
cmovae eax, edi
push ecx
push eax
call fcn.00406c26
add esp, 0x14
cmp eax, 0xffffffff
jne 0x471d71
push 0x5f72c8
lea ecx, [ebp - 0x58]
call fcn.0043df5f
cmp dword [ebp - 0x14], 8
lea ecx, [ebp - 0x28]
push dword [ebp - 0x18]
cmovae ecx, dword [ebp - 0x28]
push ecx
mov ecx, eax
mov byte [ebp - 4], 1
call fcn.0040656e
mov edx, eax
mov ecx, dword [edx]
mov eax, dword [edx + 0x14]
mov dword [ebp - 0x40], ecx
mov ecx, dword [edx + 4]
mov dword [ebp - 0x3c], ecx
mov ecx, dword [edx + 8]
mov dword [ebp - 0x38], ecx
mov ecx, dword [edx + 0xc]
mov dword [ebp - 0x2c], eax
xor eax, eax
mov dword [ebp - 0x34], ecx
mov ecx, dword [edx + 0x10]
mov word [edx], ax
lea eax, [ebp - 0x40]
mov dword [ebp - 0x30], ecx
lea ecx, [ebp - 0x28]
push eax
mov dword [edx + 0x10], 0
mov dword [edx + 0x14], 7
call fcn.00428fbe
mov edx, dword [ebp - 0x2c]
cmp edx, 8
jb 0x471d63
mov ecx, dword [ebp - 0x40]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x471d59
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x471de8
push edx
push ecx
call fcn.00599f8e
add esp, 8
lea ecx, [ebp - 0x58]
call fcn.00404866
mov edi, dword [ebp - 0x28]
mov esi, dword [ebp - 0x14]
cmp esi, 8
lea eax, [ebp - 0x28]
cmovae eax, edi
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov edx, dword [ebp - 0x14]
cmp eax, 0xffffffff
movzx ebx, bl
mov ecx, 1
cmovne ebx, ecx
cmp edx, 8
jb 0x471dc5
mov ecx, dword [ebp - 0x28]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x471dbb
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x471ded
push edx
push ecx
call fcn.00599f8e
add esp, 8
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00599f9c
mov esp, ebp
pop ebp
ret
call fcn.00404954
call fcn.005a1930
call fcn.005a1930
int3