joyce8/EMBER2024-capa huggingface dataset:
Function at 0x413640
Capabilities:
Initialize winsock library

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4d938f
mov eax, dword fs:[0]
push eax
sub esp, 0x1a0
mov eax, dword [0x51093c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x1a8], esi
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x1ac], esi
mov dword [ebp - 0x1a4], eax
mov dword [ebp - 4], 0
mov dword [esi], 0
mov dword [esi + 4], 0
mov dword [esi + 0x20], 0
mov dword [esi + 0x24], 0xf
mov byte [esi + 0x10], 0
lea eax, [esi + 0x48]
push 2
push eax
call fcn.0049eb91
add esp, 8
lea eax, [ebp - 0x1a0]
mov byte [ebp - 4], 3
push eax
push 0x202
call dword [sym.imp.WSOCK32.dll_WSAStartup]
test eax, eax
je 0x4136da
push str.WSAStartup___error_
jmp 0x4136df
push str.WSAStartup___succeed._n
call fcn.00413610
mov ecx, dword [ebp + 0xc]
add esp, 4
test ecx, ecx
je 0x4136f5
lock inc dword [ecx + 4]
mov ecx, dword [ebp + 0xc]
mov eax, dword [ebp + 8]
or ebx, 0xffffffff
mov dword [esi], eax
mov edi, dword [esi + 4]
mov dword [esi + 4], ecx
test edi, edi
je 0x413726
mov eax, ebx
lock xadd dword [edi + 4], eax
jne 0x413726
mov eax, dword [edi]
mov ecx, edi
call dword [eax]
mov eax, ebx
lock xadd dword [edi + 8], eax
jne 0x413726
mov eax, dword [edi]
mov ecx, edi
call dword [eax + 4]
mov eax, dword [ebp + 0x1c]
lea ecx, [esi + 0x10]
mov dword [esi + 0xc], eax
mov eax, dword [ebp - 0x1a4]
cmp ecx, eax
je 0x41374c
cmp dword [eax + 0x14], 0x10
mov edx, eax
jb 0x413743
mov edx, dword [eax]
push dword [eax + 0x10]
push edx
call fcn.00401840
push 0x100000
mov dword [esi + 0x30], 0
mov dword [esi + 0x3c], 0
call fcn.004a2169
mov edi, dword [ebp + 0xc]
add esp, 4
mov dword [esi + 0x38], eax
mov dword [esi + 0x40], 0
test edi, edi
je 0x413796
mov eax, ebx
lock xadd dword [edi + 4], eax
jne 0x413796
mov eax, dword [edi]
mov ecx, edi
call dword [eax]
lock xadd dword [edi + 8], ebx
dec ebx
jne 0x413796
mov edx, dword [edi]
mov ecx, edi
call dword [edx + 4]
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004a2135
mov esp, ebp
pop ebp
ret 0x18
Function at 0x413ba0
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
push edi
mov edi, ecx
lea ebx, [edi + 0x48]
push ebx
call fcn.0049ebb2
add esp, 4
test eax, eax
je 0x413bc4
push eax
call fcn.0049ecab
add esp, 4
mov esi, dword [ebp + 8]
mov ecx, esi
call fcn.0040e470
push eax
mov dword [ebp + 8], eax
call fcn.004a2169
add esp, 4
mov dword [ebp - 4], eax
mov ecx, esi
push dword [ebp + 8]
push eax
call fcn.0041de00
mov esi, dword [ebp + 8]
push esi
call dword [sym.imp.WSOCK32.dll_htonl]
push dword [edi + 0x44]
mov dword [ebp - 8], eax
lea eax, [ebp - 8]
push 4
push eax
push dword [edi + 8]
call dword [sym.imp.WSOCK32.dll_send]
cmp eax, 4
jne 0x413c2e
push dword [edi + 0x44]
push esi
push dword [ebp - 4]
push dword [edi + 8]
call dword [sym.imp.WSOCK32.dll_send]
push dword [ebp - 4]
mov esi, eax
call fcn.004a2172
add esp, 4
cmp esi, dword [ebp + 8]
je 0x413c61
mov ecx, dword [edi]
push 0
push 0xfffffffffffffffc
mov eax, dword [ecx]
call dword [eax + 8]
push ebx
mov byte [edi + 0x34], 0
call fcn.0049ebd7
add esp, 4
test eax, eax
je 0x413c53
push eax
call fcn.0049ecab
add esp, 4
pop edi
pop esi
mov eax, 0xfffffffc
pop ebx
mov esp, ebp
pop ebp
ret 4
push ebx
call fcn.0049ebd7
add esp, 4
test eax, eax
je 0x413c77
push eax
call fcn.0049ecab
add esp, 4
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x413c90
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4d9428
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push ebx
push esi
push edi
mov eax, dword [0x51093c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov esi, dword [ebp + 8]
lea ebx, [edi + 0x48]
push ebx
mov dword [ebp - 4], 0
mov dword [ebp - 0x14], esi
call fcn.0049ebb2
add esp, 4
test eax, eax
je 0x413ce0
push eax
call fcn.0049ecab
add esp, 4
mov ecx, esi
call fcn.0040e470
mov esi, eax
push esi
mov dword [ebp - 0x1c], esi
call fcn.004a2169
mov ecx, dword [ebp - 0x14]
add esp, 4
mov dword [ebp - 0x10], eax
push esi
push eax
call fcn.0041de00
push esi
call dword [sym.imp.WSOCK32.dll_htonl]
push dword [edi + 0x44]
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x18]
push 4
push eax
push dword [edi + 8]
call dword [sym.imp.WSOCK32.dll_send]
cmp eax, 4
je 0x413d4f
mov ecx, dword [edi]
push 0
push 0xfffffffffffffffc
mov eax, dword [ecx]
call dword [eax + 8]
push ebx
mov byte [edi + 0x34], 0
call fcn.0049ebd7
add esp, 4
test eax, eax
je 0x413d48
push eax
call fcn.0049ecab
add esp, 4
mov esi, 0xfffffffc
jmp 0x413d89
push dword [edi + 0x44]
push esi
push dword [ebp - 0x10]
push dword [edi + 8]
call dword [sym.imp.WSOCK32.dll_send]
push dword [ebp - 0x10]
mov esi, eax
call fcn.004a2172
add esp, 4
cmp esi, dword [ebp - 0x1c]
jne 0x413d23
push ebx
call fcn.0049ebd7
add esp, 4
test eax, eax
je 0x413d87
push eax
call fcn.0049ecab
add esp, 4
xor esi, esi
mov edi, dword [ebp + 0xc]
test edi, edi
je 0x413db1
or ebx, 0xffffffff
mov eax, ebx
lock xadd dword [edi + 4], eax
jne 0x413db1
mov eax, dword [edi]
mov ecx, edi
call dword [eax]
lock xadd dword [edi + 8], ebx
dec ebx
jne 0x413db1
mov edx, dword [edi]
mov ecx, edi
call dword [edx + 4]
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x4140a0
Capabilities:
Initialize winsock library

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x194
mov eax, dword [0x51093c]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
lea eax, [ebp - 0x194]
mov esi, ecx
push eax
push 0x202
call dword [sym.imp.WSOCK32.dll_WSAStartup]
test eax, eax
mov edx, str.WSAStartup___succeed._n
mov ecx, str.WSAStartup___error_
cmove ecx, edx
push ecx
call fcn.00413610
mov ecx, dword [ebp + 8]
add esp, 4
mov dword [esi], ecx
mov ecx, esi
call fcn.00414100
mov ecx, dword [ebp - 4]
mov eax, esi
xor ecx, ebp
pop esi
call fcn.004a2135
mov esp, ebp
pop ebp
ret 4
Function at 0x414100
Capabilities:
Create udp socket
Terminate process

Disassembly:
push esi
push edi
push 0x11
push 2
push 2
mov edi, ecx
call dword [sym.imp.WSOCK32.dll_socket]
mov dword [edi + 4], eax
test eax, eax
js 0x414154
xorps xmm0, xmm0
lea esi, [edi + 8]
movups xmmword [esi], xmm0
mov eax, 2
movups xmmword [edi + 0x18], xmm0
mov word [esi], ax
movzx eax, word [edi]
push eax
mov dword [edi + 0xc], 0
call dword [sym.imp.WSOCK32.dll_htons]
push 0x10
push esi
push dword [edi + 4]
mov word [edi + 0xa], ax
call dword [sym.imp.WSOCK32.dll_bind]
pop edi
pop esi
test eax, eax
js 0x414168
ret
push str.socket_creation_failed
call fcn.004bf775
add esp, 4
push 1
call fcn.004bf73b
push str.bind_failed
call fcn.004bf775
add esp, 4
push 1
call fcn.004bf73b
int3

Function at 0x414180
Capabilities:
Terminate process

Disassembly:
push edi
mov edi, ecx
push 0
push dword [edi + 4]
call dword [sym.imp.WSOCK32.dll_shutdown]
push 0
push dword [edi + 4]
call dword [sym.imp.WSOCK32.dll_shutdown]
push dword [edi + 4]
call dword [sym.imp.WSOCK32.dll_closesocket]
mov ecx, edi
pop edi
jmp fcn.00414100

Function at 0x4166a0
Capabilities:
Hash data using fnv

Disassembly:
push ebx
push esi
mov edx, dword [esp + 0xc]
push edi
mov edi, dword [esp + 0x14]
mov esi, dword [edx + 0xc]
movzx eax, byte [edi]
xor eax, 0x811c9dc5
imul ecx, eax, 0x1000193
movzx eax, byte [edi + 1]
xor ecx, eax
movzx eax, byte [edi + 2]
imul ecx, ecx, 0x1000193
xor ecx, eax
movzx eax, byte [edi + 3]
imul ecx, ecx, 0x1000193
xor ecx, eax
imul eax, ecx, 0x1000193
mov ecx, dword [edx + 0x18]
mov edx, dword [edx + 4]
and ecx, eax
mov eax, dword [esi + ecx*8]
add ecx, ecx
mov ebx, dword [esi + ecx*4]
lea esi, [esi + ecx*4]
cmp ebx, edx
jne 0x4166fb
mov ecx, edx
jmp 0x416700
mov ecx, dword [esi + 4]
mov ecx, dword [ecx]
cmp eax, ecx
je 0x41671a
mov ecx, dword [eax + 8]
cmp ecx, dword [edi]
je 0x41670f
mov eax, dword [eax]
jmp 0x4166f3
cmp eax, edx
je 0x41671a
mov eax, dword [eax + 0xc]
pop edi
pop esi
pop ebx
ret
pop edi
pop esi
xor eax, eax
pop ebx
ret
Function at 0x416d90
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4d96d0
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push esi
push edi
mov eax, dword [0x51093c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov ebx, ecx
mov dword [ebp - 0x18], ebx
mov edi, dword [ebp + 0xc]
mov esi, dword [ebx + 4]
mov dword [ebp - 4], 0
movzx eax, byte [edi]
xor eax, 0x811c9dc5
imul edx, eax, 0x1000193
movzx eax, byte [edi + 1]
xor edx, eax
movzx eax, byte [edi + 2]
imul ecx, edx, 0x1000193
mov edx, dword [ebx + 0x18]
xor ecx, eax
movzx eax, byte [edi + 3]
imul ecx, ecx, 0x1000193
xor ecx, eax
imul eax, ecx, 0x1000193
and edx, eax
mov eax, dword [ebx + 0xc]
mov dword [ebp + 0xc], edx
mov ecx, dword [eax + edx*8]
cmp esi, ecx
je 0x416e62
mov esi, dword [eax + edx*8 + 4]
mov esi, dword [esi]
cmp esi, ecx
je 0x416e62
mov esi, dword [esi + 4]
mov eax, dword [edi]
cmp eax, dword [esi + 8]
jne 0x416e17
mov edx, dword [ebp + 0x10]
push 0x10
push edx
mov ecx, dword [edx + 4]
mov eax, dword [edx]
mov dword [ecx], eax
mov ecx, dword [edx]
mov eax, dword [edx + 4]
mov dword [ecx + 4], eax
dec dword [ebx + 8]
call fcn.004a2127
mov eax, dword [ebp + 8]
add esp, 8
mov dword [eax], esi
mov byte [eax + 4], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov edi, dword [ebp + 0x10]
mov dword [ebp - 0x14], edi
mov eax, dword [edi]
cmp esi, eax
je 0x416e92
mov ecx, dword [edi + 4]
mov dword [ecx], eax
mov ecx, dword [eax + 4]
mov dword [ecx], esi
mov ecx, dword [esi + 4]
mov dword [ecx], edi
mov edx, dword [esi + 4]
mov ecx, dword [eax + 4]
mov dword [esi + 4], ecx
mov ecx, dword [edi + 4]
mov dword [eax + 4], ecx
mov dword [edi + 4], edx
mov edx, dword [ebp + 0xc]
mov eax, dword [ebx + 0xc]
lea ecx, [eax + edx*8]
mov eax, dword [ecx]
cmp eax, dword [ebx + 4]
jne 0x416eaa
mov dword [ecx], edi
mov eax, dword [ebx + 0xc]
mov dword [eax + edx*8 + 4], edi
jmp 0x416ecd
cmp eax, esi
jne 0x416eb2
mov dword [ecx], edi
jmp 0x416ecd
mov eax, dword [ecx + 4]
mov eax, dword [eax]
mov dword [ecx + 4], eax
cmp eax, edi
je 0x416ecd
mov eax, dword [ebx + 0xc]
lea ecx, [eax + edx*8]
mov eax, dword [ecx + 4]
mov eax, dword [eax + 4]
mov dword [ecx + 4], eax
mov ecx, ebx
mov dword [ebp - 4], 2
call fcn.00419b20
mov eax, dword [ebp + 8]
mov dword [eax], edi
mov byte [eax + 4], 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x417140
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4d9710
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push ebx
push esi
push edi
mov eax, dword [0x51093c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov ebx, ecx
mov dword [ebp - 0x1c], ebx
mov edi, dword [ebp + 0xc]
mov esi, dword [ebx + 0x18]
mov dword [ebp - 4], 0
movzx eax, byte [edi]
xor eax, 0x811c9dc5
imul edx, eax, 0x1000193
movzx eax, byte [edi + 1]
xor edx, eax
movzx eax, byte [edi + 2]
imul ecx, edx, 0x1000193
mov edx, dword [ebx + 4]
xor ecx, eax
movzx eax, byte [edi + 3]
imul ecx, ecx, 0x1000193
xor ecx, eax
imul eax, ecx, 0x1000193
and esi, eax
mov eax, dword [ebx + 0xc]
mov dword [ebp + 0xc], esi
mov ecx, dword [eax + esi*8]
cmp ecx, edx
jne 0x4171c5
mov esi, edx
jmp 0x4171d0
mov esi, dword [eax + esi*8 + 4]
mov esi, dword [esi]
nop dword [eax + eax]
cmp esi, ecx
je 0x4171fb
mov esi, dword [esi + 4]
mov eax, dword [edi]
cmp eax, dword [esi + 8]
jne 0x4171d0
mov eax, dword [ebp + 8]
mov dword [eax], esi
mov byte [eax + 4], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov eax, dword [edx]
push edi
mov dword [ebp - 4], 0xffffffff
mov dword [ebp - 0x14], eax
mov ecx, dword [eax + 4]
push ecx
mov dword [ebp - 0x18], ecx
lea ecx, [ebx + 4]
push eax
call fcn.004169a0
mov edx, eax
mov ecx, 0xffffffe
mov eax, dword [ebx + 8]
sub ecx, eax
cmp ecx, 1
jb 0x417302
inc eax
mov dword [ebx + 8], eax
mov eax, dword [ebp - 0x14]
mov dword [eax + 4], edx
mov eax, dword [ebp - 0x18]
mov dword [eax], edx
mov ecx, dword [ebx + 4]
mov edi, dword [ecx]
mov dword [ebp - 0x18], edi
mov eax, dword [edi]
cmp esi, eax
je 0x41726e
mov ecx, dword [edi + 4]
mov dword [ecx], eax
mov ecx, dword [eax + 4]
mov dword [ecx], esi
mov ecx, dword [esi + 4]
mov dword [ecx], edi
mov ecx, dword [eax + 4]
mov edx, dword [esi + 4]
mov dword [esi + 4], ecx
mov ecx, dword [edi + 4]
mov dword [eax + 4], ecx
mov dword [edi + 4], edx
mov ecx, dword [ebx + 4]
mov eax, dword [ebx + 0xc]
mov edx, dword [ebp + 0xc]
lea edx, [eax + edx*8]
mov eax, dword [edx]
cmp eax, ecx
jne 0x41728b
mov ecx, dword [ebp + 0xc]
mov dword [edx], edi
mov eax, dword [ebx + 0xc]
mov dword [eax + ecx*8 + 4], edi
jmp 0x4172b1
cmp eax, esi
jne 0x417293
mov dword [edx], edi
jmp 0x4172b1
mov eax, dword [edx + 4]
mov eax, dword [eax]
mov dword [edx + 4], eax
cmp eax, edi
je 0x4172b1
mov eax, dword [ebx + 0xc]
mov ecx, dword [ebp + 0xc]
lea ecx, [eax + ecx*8]
mov eax, dword [ecx + 4]
mov eax, dword [eax + 4]
mov dword [ecx + 4], eax
mov ecx, ebx
mov dword [ebp - 4], 2
call fcn.00419b20
mov eax, dword [ebp + 8]
mov dword [eax], edi
mov byte [eax + 4], 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
push str.list_T__too_long
call fcn.0049e77f
int3
Function at 0x4173b0
Capabilities:
Hash data using fnv

Disassembly:
mov eax, dword [esp + 8]
push esi
push edi
mov edi, ecx
movzx edx, byte [eax + 8]
movzx ecx, byte [eax + 0xa]
xor edx, 0x811c9dc5
imul esi, edx, 0x1000193
movzx edx, byte [eax + 9]
xor esi, edx
imul edx, esi, 0x1000193
xor edx, ecx
movzx ecx, byte [eax + 0xb]
imul edx, edx, 0x1000193
xor edx, ecx
imul ecx, edx, 0x1000193
mov edx, dword [edi + 0x18]
and edx, ecx
lea esi, [edx*8]
mov edx, dword [edi + 0xc]
add edx, esi
mov ecx, dword [edx]
cmp dword [edx + 4], eax
jne 0x417421
cmp ecx, eax
jne 0x417419
mov ecx, dword [edi + 4]
mov dword [edx], ecx
mov edx, dword [edi + 0xc]
mov ecx, dword [edi + 4]
mov dword [esi + edx + 4], ecx
jmp 0x417429
mov ecx, dword [eax + 4]
mov dword [edx + 4], ecx
jmp 0x417429
cmp ecx, eax
jne 0x417429
mov ecx, dword [eax]
mov dword [edx], ecx
mov ecx, dword [eax + 4]
mov esi, dword [eax]
push 0x10
push eax
mov dword [ecx], esi
mov edx, dword [eax]
mov ecx, dword [eax + 4]
mov dword [edx + 4], ecx
dec dword [edi + 8]
call fcn.004a2127
mov eax, dword [esp + 0x14]
add esp, 8
pop edi
mov dword [eax], esi
pop esi
ret 8
Function at 0x43c4a0
Capabilities:
Enumerate pe sections

Disassembly:
sub esp, 0x10
mov edx, ecx
push ebx
push esi
push edi
movzx eax, word [edx + 6]
mov dword [esp + 0x10], edx
mov edi, eax
test ax, ax
js 0x43c5de
mov ecx, dword [esp + 0x24]
shl eax, 5
push ebp
movzx esi, word [ecx + 6]
mov ecx, dword [ecx + 8]
test si, si
js 0x43c53f
mov ebp, esi
mov esi, dword [edx + 8]
shl ebp, 5
add eax, esi
add ebp, ecx
mov dword [esp + 0x10], eax
xor edx, edx
cmp esi, eax
je 0x43c51b
cmp ecx, ebp
je 0x43c51b
mov ebx, dword [ecx]
lea edi, [edx + 1]
cmp dword [esi], ebx
jge 0x43c4f7
add esi, 0x20
jmp 0x43c515
mov eax, dword [esp + 0x10]
jne 0x43c505
add esi, 0x20
add ecx, 0x20
jmp 0x43c515
lea eax, [ecx + 0x12]
add ecx, 0x20
test byte [eax], 0xf
mov eax, dword [esp + 0x10]
cmovne edi, edx
mov edx, edi
cmp esi, eax
jne 0x43c4e5
sub eax, esi
sar eax, 5
add edx, eax
cmp ecx, ebp
je 0x43c539
test byte [ecx + 0x12], 0xf
lea eax, [edx + 1]
cmovne eax, edx
add ecx, 0x20
mov edx, eax
cmp ecx, ebp
jne 0x43c526
push edx
jmp 0x43c5d0
mov ebp, dword [ecx]
xor edi, edi
mov ebx, dword [edx + 8]
add eax, ebx
mov dword [esp + 0x1c], ebp
mov dword [esp + 0x18], eax
mov esi, dword [ebp]
mov dword [esp + 0x10], esi
cmp ebx, eax
je 0x43c5a7
nop dword [eax + eax]
cmp esi, ebp
je 0x43c5a7
mov eax, dword [ebx]
lea ebp, [edi + 1]
cmp eax, dword [esi + 0x10]
jge 0x43c573
add ebx, 0x20
jmp 0x43c599
lea ecx, [esp + 0x10]
jne 0x43c589
mov edi, ebp
add ebx, 0x20
call fcn.004085e0
mov esi, dword [esp + 0x10]
jmp 0x43c59b
call fcn.004085e0
test byte [esi + 0x22], 0xf
mov esi, dword [esp + 0x10]
cmovne ebp, edi
mov edi, ebp
mov eax, dword [esp + 0x18]
mov ebp, dword [esp + 0x1c]
cmp ebx, eax
jne 0x43c560
sub eax, ebx
sar eax, 5
add edi, eax
cmp esi, ebp
je 0x43c5cf
test byte [esi + 0x22], 0xf
lea eax, [edi + 1]
lea ecx, [esp + 0x10]
cmovne eax, edi
mov edi, eax
call fcn.004085e0
mov esi, dword [esp + 0x10]
cmp esi, ebp
jne 0x43c5b2
push edi
mov ecx, dword [esp + 0x18]
call fcn.00439d60
mov edx, dword [esp + 0x14]
pop ebp
mov ecx, dword [esp + 0x24]
movzx eax, word [ecx + 6]
mov esi, dword [ecx + 8]
test ax, ax
jns 0x43c633
mov esi, dword [esi]
mov eax, dword [esi]
mov dword [esp + 0xc], eax
cmp eax, esi
je 0x43c661
mov edi, dword [esp + 0x20]
nop
push dword [ecx]
lea ecx, [eax + 0x18]
push ecx
push dword [eax + 0x10]
mov ecx, edx
push edi
call fcn.0043a0c0
lea ecx, [esp + 0xc]
call fcn.004085e0
mov eax, dword [esp + 0xc]
mov edx, dword [esp + 0x10]
mov ecx, dword [esp + 0x24]
cmp eax, esi
jne 0x43c600
pop edi
pop esi
pop ebx
add esp, 0x10
ret 8
mov edi, eax
shl edi, 5
add edi, esi
cmp esi, edi
je 0x43c661
mov ebx, dword [esp + 0x20]
push dword [ecx]
lea eax, [esi + 8]
mov ecx, edx
push eax
push dword [esi]
push ebx
call fcn.0043a0c0
mov edx, dword [esp + 0x10]
add esi, 0x20
mov ecx, dword [esp + 0x24]
cmp esi, edi
jne 0x43c642
pop edi
pop esi
pop ebx
add esp, 0x10
ret 8
Function at 0x43d220
Capabilities:
Hash data using fnv

Disassembly:
push esi
mov esi, dword [esp + 8]
push edi
mov edi, ecx
movzx eax, byte [esi]
xor eax, 0x811c9dc5
imul edx, eax, 0x1000193
movzx eax, byte [esi + 1]
xor edx, eax
movzx eax, byte [esi + 2]
imul edx, edx, 0x1000193
xor edx, eax
movzx eax, byte [esi + 3]
imul ecx, edx, 0x1000193
xor ecx, eax
movzx eax, byte [esi + 4]
xor eax, 0x811c9dc5
imul edx, ecx, 0x1000193
imul ecx, eax, 0x1000193
movzx eax, byte [esi + 5]
xor ecx, eax
movzx eax, byte [esi + 6]
imul ecx, ecx, 0x1000193
xor ecx, eax
movzx eax, byte [esi + 7]
imul ecx, ecx, 0x1000193
xor ecx, eax
imul eax, ecx, 0x1000193
xor eax, edx
and eax, dword [edi + 0x18]
pop edi
pop esi
ret 4

Function at 0x440d40
Capabilities:
Hash data using fnv

Disassembly:
push ebx
mov ebx, dword [esp + 0xc]
xor ecx, ecx
push ebp
push esi
push edi
mov edx, dword [ebx + 4]
xor ebp, ebp
mov edi, dword [ebx + 8]
xor esi, esi
lea eax, [edi + edx]
cmp edx, eax
cmova edi, ebp
test edi, edi
je 0x440d70
movsx eax, byte [edx]
lea ecx, [ecx + ecx*4]
inc esi
lea edx, [edx + 1]
add ecx, eax
cmp esi, edi
jb 0x440d60
imul eax, dword [ebx], 0x1000193
xor eax, ecx
mov ecx, dword [esp + 0x14]
and eax, dword [ecx + 0x18]
mov edx, dword [ecx + 0xc]
mov edi, dword [ecx + 4]
mov esi, dword [edx + eax*8]
add eax, eax
mov ebp, dword [edx + eax*4]
inc eax
lea eax, [edx + eax*4]
mov dword [esp + 0x18], eax
cmp ebp, edi
jne 0x440d9d
mov eax, edi
jmp 0x440da1
mov eax, dword [eax]
mov eax, dword [eax]
cmp esi, eax
je 0x440de7
mov eax, dword [ebx]
cmp dword [esi + 8], eax
jne 0x440dc4
push dword [ebx + 8]
push dword [ebx + 4]
push dword [esi + 0x10]
push dword [esi + 0xc]
call fcn.00417870
add esp, 0x10
test al, al
jne 0x440dcc
mov esi, dword [esi]
mov eax, dword [esp + 0x18]
jmp 0x440d95
push dword [esi + 0x10]
push dword [esi + 0xc]
push dword [ebx + 8]
push dword [ebx + 4]
call fcn.00417870
add esp, 0x10
test al, al
cmove esi, edi
jmp 0x440de9
mov esi, edi
cmp esi, edi
jne 0x440df4
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
ret
mov eax, dword [esi + 0x14]
pop edi
pop esi
pop ebp
pop ebx
ret
Function at 0x4434c0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4db8e0
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push esi
push edi
mov eax, dword [0x51093c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov edi, ecx
mov dword [ebp - 0x14], edi
mov ebx, dword [ebp + 0xc]
mov dword [ebp - 4], 0
mov dword [ebp - 0x18], ebx
cmp dword [ebx + 0x14], 0x10
mov esi, dword [ebx + 0x10]
jb 0x44350b
mov eax, dword [ebx]
mov dword [ebp - 0x18], eax
xor ecx, ecx
mov edx, 0x811c9dc5
test esi, esi
je 0x443534
mov ebx, dword [ebp - 0x18]
nop dword [eax]
movzx eax, byte [ecx + ebx]
inc ecx
xor eax, edx
imul edx, eax, 0x1000193
cmp ecx, esi
jb 0x443520
mov ebx, dword [ebp + 0xc]
mov eax, dword [edi + 0x18]
and eax, edx
mov edx, edi
lea ecx, [eax*8]
mov dword [ebp + 0xc], ecx
mov eax, dword [edx + 0xc]
mov esi, dword [edx + 4]
mov edi, dword [eax + ecx]
cmp esi, edi
je 0x4435c7
mov esi, dword [eax + ecx + 4]
mov esi, dword [esi]
cmp esi, edi
je 0x4435c7
mov esi, dword [esi + 4]
cmp dword [esi + 0x1c], 0x10
lea edx, [esi + 8]
jb 0x44356b
mov edx, dword [esi + 8]
cmp dword [ebx + 0x14], 0x10
mov ecx, ebx
jb 0x443575
mov ecx, dword [ebx]
push dword [esi + 0x18]
push edx
push dword [ebx + 0x10]
push ecx
call fcn.00447cf0
add esp, 0x10
test al, al
je 0x443558
mov edi, dword [ebp + 0x10]
mov ecx, dword [ebp - 0x14]
add ecx, 4
push edi
mov edx, dword [edi + 4]
mov eax, dword [edi]
mov dword [edx], eax
mov edx, dword [edi]
mov eax, dword [edi + 4]
mov dword [edx + 4], eax
dec dword [ecx + 4]
call fcn.0046c120
mov eax, dword [ebp + 8]
mov dword [eax], esi
mov byte [eax + 4], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov edi, dword [ebp + 0x10]
mov dword [ebp - 0x18], edi
mov eax, dword [edi]
cmp esi, eax
je 0x4435f4
mov ecx, dword [edi + 4]
mov dword [ecx], eax
mov ecx, dword [eax + 4]
mov dword [ecx], esi
mov ecx, dword [esi + 4]
mov dword [ecx], edi
mov ecx, dword [eax + 4]
mov edx, dword [esi + 4]
mov dword [esi + 4], ecx
mov ecx, dword [edi + 4]
mov dword [eax + 4], ecx
mov dword [edi + 4], edx
mov edx, dword [ebp - 0x14]
mov ebx, dword [ebp + 0xc]
mov ecx, dword [edx + 0xc]
add ecx, ebx
mov eax, dword [ecx]
cmp eax, dword [edx + 4]
jne 0x443611
mov dword [ecx], edi
mov eax, dword [edx + 0xc]
mov dword [eax + ebx + 4], edi
jmp 0x443633
cmp eax, esi
jne 0x443619
mov dword [ecx], edi
jmp 0x443633
mov eax, dword [ecx + 4]
mov eax, dword [eax]
mov dword [ecx + 4], eax
cmp eax, edi
je 0x443633
mov ecx, dword [edx + 0xc]
mov eax, dword [ecx + ebx + 4]
mov eax, dword [eax + 4]
mov dword [ecx + ebx + 4], eax
mov ecx, edx
mov dword [ebp - 4], 2
call fcn.0046b8d0
mov eax, dword [ebp + 8]
mov dword [eax], edi
mov byte [eax + 4], 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc