joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4051e0
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [ebp + 8]
mov ecx, 0x300
push ebx
push esi
mov esi, dword [ebp + 0xc]
xor ebx, ebx
push edi
xor edi, edi
mov dword [ebp - 8], eax
mov word [ebp - 4], cx
mov byte [esi], 0
cmp dword [ebp + 0x10], ebx
jle 0x40525d
cmp byte [ebp + 0x18], 0
je 0x405225
push dword [ebp + 0x14]
lea eax, [ebp - 8]
push 1
push eax
call fcn.00406eb0
add esp, 0xc
test eax, eax
je 0x405293
mov eax, dword [ebp + 8]
push 0
push 1
lea ecx, [ebp + 0xf]
push ecx
push eax
call dword [sym.imp.WS2_32.dll_recv]
cmp eax, 0xffffffff
je 0x40529c
test eax, eax
je 0x405269
mov al, byte [ebp + 0xf]
cmp al, 0xa
je 0x40525d
cmp al, 0xd
je 0x405254
mov byte [esi], al
inc edi
mov eax, dword [ebp + 0x10]
inc esi
dec eax
cmp edi, eax
jge 0x40525d
mov eax, dword [ebp + 8]
inc ebx
cmp ebx, dword [ebp + 0x10]
jl 0x405207
mov eax, edi
mov byte [esi], 0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [section..data]
cmp dword [eax], 3
jl 0x405293
push dword [ebp + 8]
push 0x44d
push str.http_read_line
call fcn.004048f0
push eax
push str._s__s:_d_disconnected_on_the_other_end__u_n
call fcn.004048b0
add esp, 0x14
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
mov esi, dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
call esi
cmp dword [eax], 0xb
je 0x405293
mov eax, dword [section..data]
cmp dword [eax], 1
jl 0x4052e1
call esi
push dword [eax]
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_strerror]
add esp, 4
push eax
push dword [ebp + 8]
push 0x448
push str.http_read_line
call fcn.004048f0
push eax
push str._s__s:_d_fd:__d_read_error:__s_n
call fcn.004048b0
add esp, 0x18
pop edi
pop esi
or eax, 0xffffffff
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4052f0
Capabilities:
Send data
Send data on socket
Send http request

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
push dword [ebp + 0x10]
call fcn.00406a20
mov edi, dword [ebp + 0xc]
mov ebx, eax
mov ecx, edi
mov dword [ebp - 4], ebx
add esp, 4
lea edx, [ecx + 1]
nop
mov al, byte [ecx]
inc ecx
test al, al
jne 0x405310
sub ecx, edx
mov edx, ebx
lea esi, [edx + 1]
nop
mov al, byte [edx]
inc edx
test al, al
jne 0x405320
sub edx, esi
lea eax, [edx + 5]
add eax, ecx
push eax
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
push ebx
push edi
mov esi, eax
push str._s_r_n_s_r_n
push esi
call fcn.00404950
add esp, 0x14
mov edi, eax
test ebx, ebx
mov ebx, dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
je 0x40535b
push dword [ebp - 4]
call ebx
add esp, 4
push 0
push edi
push esi
push dword [ebp + 8]
call dword [sym.imp.WS2_32.dll_send]
cmp eax, edi
je 0x4053a3
mov ecx, dword [section..data]
cmp dword [ecx], 1
jl 0x405397
push edi
push eax
push esi
push 0x46d
push str.http_send
call fcn.004048f0
push eax
push str._s__s:_d_HTTP_send___error:_s__u__strlen_u__n
call fcn.004048b0
add esp, 0x1c
test esi, esi
je 0x4053a3
push esi
call ebx
add esp, 4
xor esi, esi
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4053c0
Capabilities:
Initialize winsock library
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x194
mov eax, dword [0x51df40]
xor eax, ebp
mov dword [ebp - 4], eax
lea eax, [ebp - 0x194]
push eax
push 0x202
call dword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
je 0x40541a
mov eax, dword [section..data]
cmp dword [eax], 1
jl 0x405412
push 0
push 0x1f1
push str.netsock_init
call fcn.004048f0
push eax
push str._s__s:_d_Bad_winsock_version_n
call fcn.004048b0
add esp, 0x14
push 1
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004d3ed5
mov esp, ebp
pop ebp
ret

Function at 0x405430
Capabilities:
Create tcp socket
Create udp socket
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push 0
push 1
push 2
mov dword [ebp - 4], 1
call dword [sym.imp.WS2_32.dll_socket]
cmp byte [ebp + 0x10], 0
mov esi, eax
lea eax, [ebp + 0x10]
mov dword [ebp + 0x10], 0
push eax
push 0x8004667e
push esi
jne 0x405468
mov dword [ebp + 0x10], 1
call dword [sym.imp.WS2_32.dll_ioctlsocket]
test esi, esi
jns 0x4054a4
mov eax, dword [section..data]
cmp dword [eax], 1
jl 0x40549c
push dword [ebp + 8]
push 0x285
push str.open_tcp_socket
call fcn.004048f0
push eax
push str._s__s:_d_cannot_create_tcp_socket__x_n
call fcn.004048b0
add esp, 0x14
or eax, 0xffffffff
pop esi
mov esp, ebp
pop ebp
ret
push 4
lea eax, [ebp - 4]
push eax
push 8
push 0xffff
push esi
call dword [sym.imp.WS2_32.dll_setsockopt]
push dword [ebp + 0xc]
push dword [ebp + 8]
push esi
call fcn.004049a0
add esp, 0xc
test al, al
jne 0x4054da
push esi
call dword [sym.imp.WS2_32.dll_closesocket]
or eax, 0xffffffff
pop esi
mov esp, ebp
pop ebp
ret
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x4054f0
Capabilities:
Create udp socket
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
push esi
push 0
push 2
push 2
call dword [sym.imp.WS2_32.dll_socket]
cmp byte [ebp + 0x10], 0
mov esi, eax
jne 0x40551f
lea eax, [ebp + 0x10]
mov dword [ebp + 0x10], 1
push eax
push 0x8004667e
push esi
call dword [sym.imp.WS2_32.dll_ioctlsocket]
test esi, esi
jns 0x405553
mov eax, dword [section..data]
cmp dword [eax], 1
jl 0x40554d
push dword [ebp + 8]
push 0x2a4
push str.open_udp_socket
call fcn.004048f0
push eax
push str._s__s:_d_cannot_create_udp_socket__x_n
call fcn.004048b0
add esp, 0x14
or eax, 0xffffffff
pop esi
pop ebp
ret
push dword [ebp + 0xc]
push dword [ebp + 8]
push esi
call fcn.004049a0
add esp, 0xc
test al, al
jne 0x405573
push esi
call dword [sym.imp.WS2_32.dll_closesocket]
or eax, 0xffffffff
pop esi
pop ebp
ret
mov eax, esi
pop esi
pop ebp
ret
Function at 0x405580
Capabilities:
Create raw socket
Get socket status
Receive data
Receive data on socket
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x148
mov eax, dword [0x51df40]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push 1
push 3
push 2
call dword [sym.imp.WS2_32.dll_socket]
mov ecx, dword [ebp + 8]
xorps xmm0, xmm0
mov edi, eax
movlpd qword [ebp - 0x13c], xmm0
movups xmmword [ebp - 0x30], xmm0
mov eax, 2
mov dword [ebp - 0x2c], ecx
xor bl, bl
mov word [ebp - 0x30], ax
mov byte [ebp - 0x13c], 8
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__getpid]
mov word [ebp - 0x138], ax
lea ecx, [ebp - 0x13c]
mov eax, 1
xor edx, edx
mov word [ebp - 0x136], ax
mov esi, 4
movzx eax, word [ecx]
lea ecx, [ecx + 2]
add edx, eax
sub esi, 1
jne 0x4055f1
mov ecx, edx
movzx eax, dx
shr ecx, 0x10
add ecx, eax
mov eax, ecx
shr eax, 0x10
add eax, ecx
not eax
push 0x10
mov word [ebp - 0x13a], ax
lea eax, [ebp - 0x30]
push eax
push esi
push 8
lea eax, [ebp - 0x13c]
push eax
push edi
call dword [sym.imp.WS2_32.dll_sendto]
mov ecx, dword [ebp + 0xc]
imul eax, ecx, 0x3e8
mov dword [ebp - 0x130], edi
mov dword [ebp - 0x134], 1
mov dword [ebp - 0x148], esi
mov dword [ebp - 0x144], eax
test ecx, ecx
je 0x405673
lea eax, [ebp - 0x148]
push eax
push esi
push esi
lea eax, [ebp - 0x134]
push eax
push edi
call dword [sym.imp.WS2_32.dll_select]
test eax, eax
jle 0x4056aa
lea eax, [ebp - 0x140]
mov dword [ebp - 0x140], 0x10
push eax
lea eax, [ebp - 0x30]
push eax
push 0
push 0x1c
lea eax, [ebp - 0x20]
push eax
push edi
call dword [sym.imp.WS2_32.dll_recvfrom]
test eax, eax
jle 0x4056aa
cmp byte [ebp - 0xc], 0
mov eax, 1
movzx ebx, bl
cmove ebx, eax
push edi
call dword [sym.imp.WS2_32.dll_closesocket]
mov ecx, dword [ebp - 4]
mov al, bl
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004d3ed5
mov esp, ebp
pop ebp
ret

Function at 0x405700
Capabilities:
Connect socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x51df40]
xor eax, ebp
mov dword [ebp - 4], eax
movups xmm0, xmmword [ebp + 0xc]
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
mov edi, dword [sym.imp.KERNEL32.dll_Sleep]
xor esi, esi
movups xmmword [ebp - 0x14], xmm0
push 0x10
lea eax, [ebp - 0x14]
push eax
push ebx
call dword [sym.imp.WS2_32.dll_connect]
test eax, eax
js 0x405792
push 0x64
call edi
inc esi
cmp esi, 2
jb 0x405726
mov eax, dword [section..data]
cmp dword [eax], 1
jl 0x40577f
push dword [ebp - 0x12]
call dword [sym.imp.WS2_32.dll_ntohs]
movzx eax, ax
push eax
push dword [ebp - 0x10]
call dword [sym.imp.WS2_32.dll_inet_ntoa]
push eax
push 0x231
push str.tcp_connect
call fcn.004048f0
push eax
push str._s__s:_d_cannot_connect_addr_s__port_d_n
call fcn.004048b0
add esp, 0x18
pop edi
pop esi
xor al, al
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004d3ed5
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
mov al, 1
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004d3ed5
mov esp, ebp
pop ebp
ret
Function at 0x4057b0
Capabilities:
Connect socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x51df40]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push dword [ebp + 0x10]
mov eax, 2
mov word [ebp - 0x14], ax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x10], eax
call dword [sym.imp.WS2_32.dll_htons]
mov ebx, dword [ebp + 8]
xor esi, esi
mov edi, dword [sym.imp.KERNEL32.dll_Sleep]
mov word [ebp - 0x12], ax
movups xmm0, xmmword [ebp - 0x14]
movups xmmword [ebp - 0x14], xmm0
push 0x10
lea eax, [ebp - 0x14]
push eax
push ebx
call dword [sym.imp.WS2_32.dll_connect]
test eax, eax
js 0x40585e
push 0x64
call edi
inc esi
cmp esi, 2
jb 0x4057f2
mov eax, dword [section..data]
cmp dword [eax], 1
jl 0x40584b
push dword [ebp - 0x12]
call dword [sym.imp.WS2_32.dll_ntohs]
movzx eax, ax
push eax
push dword [ebp - 0x10]
call dword [sym.imp.WS2_32.dll_inet_ntoa]
push eax
push 0x231
push str.tcp_connect
call fcn.004048f0
push eax
push str._s__s:_d_cannot_connect_addr_s__port_d_n
call fcn.004048b0
add esp, 0x18
pop edi
pop esi
xor al, al
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004d3ed5
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
mov al, 1
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004d3ed5
mov esp, ebp
pop ebp
ret

Function at 0x406630
Capabilities:
Encode data using base64

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 0xc]
mov eax, 0x55555556
push esi
push edi
lea ecx, [ebx*4]
imul ecx
mov eax, edx
add edx, 4
shr eax, 0x1f
add eax, edx
push eax
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov edi, eax
add esp, 4
mov dword [ebp + 0xc], edi
mov esi, edi
test edi, edi
jne 0x40666e
pop edi
pop esi
or eax, 0xffffffff
pop ebx
pop ebp
ret
xor eax, eax
test ebx, ebx
jle 0x4066fd
mov edi, dword [ebp + 8]
nop dword [eax + eax]
movzx edx, byte [eax + edi]
inc eax
shl edx, 8
cmp eax, ebx
jge 0x406692
movzx ecx, byte [eax + edi]
add edx, ecx
inc eax
shl edx, 8
cmp eax, ebx
jge 0x4066a0
movzx ecx, byte [eax + edi]
add edx, ecx
mov ecx, edx
inc eax
shr ecx, 0x12
movzx ecx, byte [ecx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [esi], cl
mov ecx, edx
shr ecx, 0xc
and ecx, 0x3f
movzx ecx, byte [ecx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [esi + 1], cl
mov ecx, edx
shr ecx, 6
and edx, 0x3f
and ecx, 0x3f
movzx ecx, byte [ecx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [esi + 2], cl
movzx ecx, byte [edx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [esi + 3], cl
cmp eax, ebx
jle 0x4066e8
mov byte [esi + 3], 0x3d
lea ecx, [ebx + 1]
cmp eax, ecx
jle 0x4066f3
mov byte [esi + 2], 0x3d
add esi, 4
cmp eax, ebx
jl 0x406680
mov edi, dword [ebp + 0xc]
mov eax, dword [ebp + 0x10]
lea ecx, [edi + 1]
mov byte [esi], 0
mov dword [eax], edi
mov al, byte [edi]
inc edi
test al, al
jne 0x406708
sub edi, ecx
mov eax, edi
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x406920
Capabilities:
Hash data using djb2

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 8]
mov eax, 0x1505
test edx, edx
jne 0x406933
xor eax, eax
pop ebp
ret
push esi
movsx esi, byte [edx]
test esi, esi
je 0x406953
nop dword [eax + eax]
mov ecx, eax
lea edx, [edx + 1]
shl eax, 5
add eax, esi
movsx esi, byte [edx]
add eax, ecx
test esi, esi
jne 0x406940
pop esi
pop ebp
ret

Function at 0x406eb0
Capabilities:
Get socket status

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x22c
mov eax, dword [0x51df40]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [ebp + 0xc], 1
push esi
push edi
mov edi, dword [ebp + 8]
ja 0x407048
xor eax, eax
mov dword [ebp - 0x120], 0x11c
push 0xfe
push eax
mov word [ebp - 0x10c], ax
lea eax, [ebp - 0x10a]
push eax
mov dword [ebp - 0x114], 0
mov dword [ebp - 0x110], 0
call sub.VCRUNTIME140.dll_memset
mov esi, dword [sym.imp.KERNEL32.dll_VerSetConditionMask]
add esp, 0xc
xor eax, eax
mov word [ebp - 0xa], ax
mov dword [ebp - 8], eax
push 3
push 0x20
push 3
push 1
push 3
push 2
push eax
push eax
call esi
push edx
push eax
call esi
push edx
push eax
call esi
push edx
push eax
push 0x23
lea eax, [ebp - 0x120]
mov dword [ebp - 0x11c], 0xa
xor ecx, ecx
mov dword [ebp - 0x118], 0
push eax
mov word [ebp - 0xc], cx
call dword [sym.imp.KERNEL32.dll_VerifyVersionInfoW]
test eax, eax
jne 0x407048
movzx ecx, word [edi + 4]
mov dword [ebp - 0x224], eax
mov dword [ebp - 0x108], eax
test ecx, 0x300
je 0x406f92
mov eax, dword [edi]
mov dword [ebp - 0x220], eax
mov dword [ebp - 0x224], 1
test cl, 0x10
je 0x406fa9
mov eax, dword [edi]
mov dword [ebp - 0x104], eax
mov dword [ebp - 0x108], 1
mov ecx, dword [ebp + 0x10]
mov eax, 0x10624dd3
imul ecx
sar edx, 6
mov eax, edx
shr eax, 0x1f
add eax, edx
mov dword [ebp - 0x22c], eax
imul eax, eax, 0x3e8
sub ecx, eax
imul eax, ecx, 0x3e8
mov dword [ebp - 0x228], eax
lea eax, [ebp - 0x22c]
push eax
push 0
lea eax, [ebp - 0x108]
push eax
lea eax, [ebp - 0x224]
push eax
mov eax, dword [edi]
inc eax
push eax
call dword [sym.imp.WS2_32.dll_select]
mov esi, eax
test esi, esi
js 0x407036
xor eax, eax
mov word [edi + 6], ax
lea eax, [ebp - 0x224]
push eax
push dword [edi]
call sub.WS2_32.dll___WSAFDIsSet
test eax, eax
je 0x40701f
mov eax, 0x300
or word [edi + 6], ax
lea eax, [ebp - 0x108]
push eax
push dword [edi]
call sub.WS2_32.dll___WSAFDIsSet
test eax, eax
je 0x407036
or word [edi + 6], 0x10
pop edi
mov eax, esi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004d3ed5
mov esp, ebp
pop ebp
ret
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push edi
call dword [sym.imp.WS2_32.dll_WSAPoll]
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.004d3ed5
mov esp, ebp
pop ebp
ret
Function at 0x4081b0
Capabilities:
Connect socket
Resolve dns

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [0x51df40]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
mov esi, dword [ebp + 0xc]
push edi
push 0x3a
push eax
mov dword [ebp - 0x18], eax
call sub.VCRUNTIME140.dll_strchr
mov ebx, eax
add esp, 8
test ebx, ebx
je 0x4081f1
lea eax, [ebx + 1]
push eax
call dword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll_atoi]
add esp, 4
mov byte [ebx], 0
mov edi, eax
jmp 0x408202
cmp byte [ebp + 0x10], 0
mov edi, 0x50
mov eax, 0x1bb
cmovne edi, eax
push dword [ebp - 0x18]
call dword [sym.imp.WS2_32.dll_gethostbyname]
mov ebx, eax
test ebx, ebx
jne 0x40822f
pop edi
pop esi
mov dword [0x5203bc], 2
or eax, 0xffffffff
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004d3ed5
mov esp, ebp
pop ebp
ret
movsx eax, word [ebx + 0xa]
push eax
mov eax, dword [ebx + 0xc]
push dword [eax]
lea eax, [ebp - 0x10]
push eax
call sub.VCRUNTIME140.dll_memcpy
mov ax, word [ebx + 8]
add esp, 0xc
mov word [ebp - 0x14], ax
push edi
call dword [sym.imp.WS2_32.dll_htons]
push 0
mov word [ebp - 0x12], ax
movsx eax, word [ebx + 8]
push 1
push eax
call dword [sym.imp.WS2_32.dll_socket]
mov dword [esi], eax
cmp eax, 0xffffffff
je 0x40833d
push 0x10
lea ecx, [ebp - 0x14]
push ecx
push eax
call dword [sym.imp.WS2_32.dll_connect]
cmp eax, 0xffffffff
je 0x40833d
cmp byte [ebp + 0x10], 0
je 0x408323
call fcn.00405c80
push eax
call fcn.00405bb0
add esp, 4
mov dword [esi + 8], eax
test eax, eax
je 0x408323
push 0
push eax
call fcn.00405bc0
push dword [esi + 8]
mov dword [esi + 4], 0
call fcn.00405c30
push dword [esi]
mov dword [esi + 4], eax
push eax
call fcn.00405c50
push dword [ebp - 0x18]
push 0
push 0x37
push dword [esi + 4]
call fcn.00405c00
call fcn.00405910
push dword [esi + 4]
call fcn.00405bf0
add esp, 0x28
cmp eax, 1
je 0x40832a
push dword [esi]
call dword [sym.imp.WS2_32.dll_closesocket]
push dword [esi + 4]
call fcn.00405c10
push dword [esi + 8]
mov dword [esi + 4], 0
call fcn.00405ba0
add esp, 8
or eax, 0xffffffff
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004d3ed5
mov esp, ebp
pop ebp
ret
mov dword [esi + 4], 0
mov eax, dword [esi]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004d3ed5
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
or eax, 0xffffffff
pop edi
pop esi
xor ecx, ebp
mov dword [0x5203bc], 1
pop ebx
call fcn.004d3ed5
mov esp, ebp
pop ebp
ret
Function at 0x412940
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0x18]
push esi
mov esi, 1
cmp eax, 0x140
jne 0x41295a
mov esi, 2
jmp 0x412962
xor ecx, ecx
cmp eax, 0x60
cmove esi, ecx
push 0x708
call fcn.004d4281
add esp, 4
test eax, eax
je 0x412994
push dword [ebp + 0x24]
mov ecx, eax
push dword [ebp + 0x20]
push dword [ebp + 0x1c]
push esi
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.0040aec0
mov esi, eax
jmp 0x412996
xor esi, esi
push 0
push 0
push esi
push 0x412510
push dword [esi + 0x1c]
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [esi + 0x28], eax
test eax, eax
je 0x4129b7
mov eax, esi
pop esi
pop ebp
ret
mov eax, dword [esi]
mov ecx, esi
push 1
call dword [eax]
xor eax, eax
pop esi
pop ebp
ret
Function at 0x4162c0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4d607e
mov eax, dword fs:[0]
push eax
sub esp, 8
push esi
push edi
mov eax, dword [0x51df40]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x14], edi
mov dword [edi], vtable.cspot::Session.0
mov dword [edi + 4], 0
mov dword [ebp - 4], 0
mov dword [edi + 8], 0
mov dword [edi + 0xc], 0
mov dword [edi + 0x10], 0
mov dword [edi + 0x14], 0
lea esi, [edi + 0x18]
mov byte [ebp - 4], 2
lea eax, [ebp - 0x10]
mov dword [ebp - 0x10], 0x2f
xorps xmm0, xmm0
push eax
movups xmmword [esi], xmm0
push esi
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0xf
call fcn.004092c0
mov ecx, dword [ebp - 0x10]
mov dword [esi], eax
mov dword [esi + 0x10], 0x28
mov dword [esi + 0x14], ecx
movups xmm0, xmmword [str.142137fd329622137a14901634264e6f332e2411]
movups xmmword [eax], xmm0
movups xmm0, xmmword [0x4df1c0]
movups xmmword [eax + 0x10], xmm0
movq xmm0, qword [0x4df1d0]
movq qword [eax + 0x20], xmm0
mov byte [eax + 0x28], 0
mov dword [edi + 0x30], 0
mov dword [edi + 0x34], 0
push 0x3d0
mov byte [ebp - 4], 4
call fcn.004d4281
add esp, 0xc
mov dword [ebp - 0x10], eax
mov byte [ebp - 4], 5
test eax, eax
je 0x4163b0
mov ecx, eax
call fcn.0042fcd0
jmp 0x4163b2
xor eax, eax
mov esi, dword [edi + 4]
mov dword [edi + 4], eax
test esi, esi
je 0x4163d1
mov ecx, esi
call fcn.0042fe40
push 0x3d0
push esi
call fcn.004d42b1
add esp, 8
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x418c70
Capabilities:
Get process heap flags

Disassembly:
push esi
mov esi, ecx
mov ecx, dword [esi + 0x10]
call fcn.00438a20
mov ecx, dword [esi + 8]
call fcn.0041b930
mov ecx, dword [esi]
pop esi
mov ecx, dword [ecx + 0x7c]
jmp fcn.0042c0f0

Function at 0x41b8f0
Capabilities:
Create thread

Disassembly:
push esi
mov esi, ecx
mov al, byte [esi + 0x419]
lea ecx, [esi + 0x419]
nop
test al, al
jne 0x41b920
mov al, 1
xchg byte [ecx], al
push 0
push 0
push esi
push 0x412510
push dword [esi + 0x1c]
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [esi + 0x28], eax
pop esi
ret
Function at 0x4284e0
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 8]
movzx eax, byte [edx]
xor eax, 0x811c9dc5
imul ecx, eax, 0x1000193
movzx eax, byte [edx + 1]
xor ecx, eax
movzx eax, byte [edx + 2]
imul ecx, ecx, 0x1000193
xor ecx, eax
movzx eax, byte [edx + 3]
imul ecx, ecx, 0x1000193
xor ecx, eax
movzx eax, byte [edx + 4]
imul ecx, ecx, 0x1000193
xor ecx, eax
movzx eax, byte [edx + 5]
imul ecx, ecx, 0x1000193
xor ecx, eax
movzx eax, byte [edx + 6]
imul ecx, ecx, 0x1000193
xor ecx, eax
movzx eax, byte [edx + 7]
imul ecx, ecx, 0x1000193
xor ecx, eax
imul eax, ecx, 0x1000193
pop ebp
ret 4
Function at 0x429350
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4d79f5
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push ebx
push esi
push edi
mov eax, dword [0x51df40]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov esi, dword [ebp + 0xc]
movzx eax, byte [esi]
xor eax, 0x811c9dc5
imul edx, eax, 0x1000193
movzx eax, byte [esi + 1]
xor edx, eax
movzx eax, byte [esi + 2]
imul edx, edx, 0x1000193
xor edx, eax
movzx eax, byte [esi + 3]
imul ecx, edx, 0x1000193
xor ecx, eax
imul eax, ecx, 0x1000193
mov ecx, edi
push eax
mov dword [ebp + 0xc], eax
lea eax, [ebp - 0x18]
push esi
push eax
call fcn.00428b20
mov ecx, dword [ebp - 0x14]
test ecx, ecx
je 0x4293e3
mov eax, dword [ebp + 8]
mov dword [eax], ecx
mov byte [eax + 4], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
cmp dword [edi + 8], 0x4924924
je 0x4294f4
lea eax, [edi + 4]
mov dword [ebp - 0x20], eax
push 0x38
mov dword [ebp - 4], 0
mov dword [ebp - 0x1c], 0
call fcn.004d4281
mov ecx, dword [esi]
add esp, 4
mov dword [ebp - 0x1c], eax
add eax, 8
lea ebx, [eax + 8]
mov dword [ebp - 0x10], eax
mov dword [eax], ecx
lea eax, [esi + 8]
mov dword [ebx + 0x24], 0
mov ecx, dword [esi + 0x2c]
test ecx, ecx
je 0x42945f
cmp ecx, eax
jne 0x429455
mov eax, dword [ecx]
push ebx
call dword [eax + 4]
mov dword [ebx + 0x24], eax
mov ecx, dword [esi + 0x2c]
test ecx, ecx
je 0x42945f
mov eax, dword [ecx]
mov edx, dword [eax + 0x10]
lea eax, [esi + 8]
cmp ecx, eax
setne al
push eax
call edx
jmp 0x429458
mov dword [ebx + 0x24], ecx
mov dword [esi + 0x2c], 0
mov eax, dword [edi + 8]
inc eax
mov dword [ebp - 4], 1
movd xmm0, eax
cvtdq2pd xmm0, xmm0
shr eax, 0x1f
addsd xmm0, qword [eax*8 + 0x4df6d0]
mov eax, dword [edi + 0x1c]
cvtpd2ps xmm1, xmm0
movd xmm0, eax
cvtdq2pd xmm0, xmm0
shr eax, 0x1f
addsd xmm0, qword [eax*8 + 0x4df6d0]
cvtpd2ps xmm0, xmm0
divss xmm1, xmm0
comiss xmm1, dword [edi]
jbe 0x4294c3
mov ecx, edi
call fcn.0042b470
mov esi, dword [ebp + 0xc]
lea eax, [ebp - 0x18]
push esi
push dword [ebp - 0x10]
mov ecx, edi
push eax
call fcn.00428b20
mov ecx, dword [eax]
jmp 0x4294c9
mov ecx, dword [ebp - 0x18]
mov esi, dword [ebp + 0xc]
push dword [ebp - 0x1c]
push ecx
push esi
mov ecx, edi
call fcn.0042b410
mov ecx, dword [ebp + 8]
mov dword [ecx], eax
mov eax, ecx
mov byte [ecx + 4], 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
push str.unordered_map_set_too_long
call sub.MSVCP140.dll_void___cdecl_std::_Xlength_error_char_const__
int3