joyce8/EMBER2024-capa huggingface dataset:
Function at 0x44a610
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x57135b
mov eax, dword fs:[0]
push eax
sub esp, 0xc8
push esi
push edi
mov eax, dword [0x5cc6c0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov edx, dword [ebp + 8]
push 0x57fac4
push edx
mov eax, dword [edx]
call dword [eax + 8]
push eax
call dword [sym.imp.USER32.dll_SetWindowTextW]
push 0
lea ecx, [edi + 0x30]
mov byte [edi + 0x374], 1
call fcn.00493ec0
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
call fcn.00467400
push 1
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
mov ecx, eax
call edx
movzx eax, al
sub eax, 1
jne 0x44a7a1
push 0x3d
push str.d:jenkins.jenkinsworkspacepcstorepcstoremainmainwnd.cpp
lea ecx, [ebp - 0x3c]
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x28], 0xf
mov byte [ebp - 0x3c], al
call fcn.00406f00
push 3
push 0x57fd94
lea ecx, [ebp - 0x24]
mov dword [ebp - 4], 0
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x10], 0xf
mov byte [ebp - 0x24], 0
call fcn.00406f00
push 0x33
lea eax, [ebp - 0x3c]
mov byte [ebp - 4], 1
push eax
lea eax, [ebp - 0x24]
push eax
lea ecx, [ebp - 0xd4]
call fcn.0040a870
mov esi, eax
push str.WebWndReady
push esi
mov byte [ebp - 4], 2
call fcn.00409440
add esp, 8
call fcn.00467400
push esi
mov ecx, eax
mov edx, dword [eax]
call dword [edx + 0x1c]
lea ecx, [ebp - 0xd4]
call fcn.0040b790
mov edx, dword [ebp - 0x10]
mov byte [ebp - 4], 0
cmp edx, 0x10
jb 0x44a746
mov ecx, dword [ebp - 0x24]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x44a73c
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x44a7f0
push edx
push ecx
call fcn.004f9d5c
add esp, 8
mov edx, dword [ebp - 0x28]
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x10], 0xf
mov byte [ebp - 0x24], 0
mov dword [ebp - 4], 0xffffffff
cmp edx, 0x10
jb 0x44a78f
mov ecx, dword [ebp - 0x3c]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x44a785
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x44a7f5
push edx
push ecx
call fcn.004f9d5c
add esp, 8
mov dword [ebp - 0x2c], 0
mov dword [ebp - 0x28], 0xf
mov byte [ebp - 0x3c], 0
lea esi, [edi - 0x318]
mov ecx, esi
call fcn.0044d5f0
mov ecx, esi
call fcn.00449570
movzx eax, al
mov ecx, esi
push eax
call fcn.0044d3a0
push 0
push 0
mov ecx, esi
call fcn.0044cc90
push 0
push 0
mov ecx, esi
call fcn.00443810
mov ecx, esi
call fcn.0044dc80
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4
call fcn.00542850
call fcn.00542850
int3
Function at 0x44d1e0
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5726bb
mov eax, dword fs:[0]
push eax
sub esp, 0xec
mov eax, dword [0x5cc6c0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
lea ecx, [esi + 0x348]
call fcn.00493ec0
test eax, eax
jne 0x44d22c
push dword [esi + 4]
lea ecx, [esi + 0x348]
call fcn.00440c50
lea ecx, [esi + 0x348]
call fcn.00493ec0
mov edi, eax
xorps xmm0, xmm0
lea eax, [ebp - 0x20]
push eax
push edi
movups xmmword [ebp - 0x20], xmm0
call dword [sym.imp.USER32.dll_GetWindowRect]
mov edx, dword [ebp - 0x14]
sub edx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x18]
sub eax, dword [ebp - 0x20]
push 1
push ecx
mov dword [esp], 0x3f800000
push edx
push eax
lea eax, [ebp - 0x60]
push eax
call fcn.0041a130
add esp, 0x14
mov ecx, esi
movups xmm0, xmmword [eax]
movups xmmword [ebp - 0x20], xmm0
call fcn.00449570
test al, al
je 0x44d2b5
push edi
call dword [sym.imp.USER32.dll_SetActiveWindow]
mov esi, dword [sym.imp.USER32.dll_SetWindowPos]
push 1
push 0xffffffffffffffff
push 0xffffffffffffffff
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push 0xffffffffffffffff
push edi
call esi
push 3
push 0
push 0
push 0
push 0
push 0
push edi
call esi
push 5
jmp 0x44d36f
call fcn.00467400
push 1
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
mov ecx, eax
call edx
movzx eax, al
sub eax, 1
jne 0x44d36d
push 0x3d
push str.d:jenkins.jenkinsworkspacepcstorepcstoremainmainwnd.cpp
lea ecx, [ebp - 0x50]
mov dword [ebp - 0x40], eax
mov dword [ebp - 0x3c], 0xf
mov byte [ebp - 0x50], al
call fcn.00406f00
push 3
push 0x57fd94
lea ecx, [ebp - 0x38]
mov dword [ebp - 4], 0
mov dword [ebp - 0x28], 0
mov dword [ebp - 0x24], 0xf
mov byte [ebp - 0x38], 0
call fcn.00406f00
push 0x190
lea eax, [ebp - 0x50]
mov byte [ebp - 4], 1
push eax
lea eax, [ebp - 0x38]
push eax
lea ecx, [ebp - 0xf8]
call fcn.0040a870
mov esi, eax
push str.hide_loading_wnd
push esi
mov byte [ebp - 4], 2
call fcn.00409440
add esp, 8
call fcn.00467400
push esi
mov ecx, eax
mov edx, dword [eax]
call dword [edx + 0x1c]
lea ecx, [ebp - 0xf8]
call fcn.0040b790
lea ecx, [ebp - 0x38]
call fcn.00406da0
lea ecx, [ebp - 0x50]
call fcn.00406da0
push 0
push edi
call dword [sym.imp.USER32.dll_ShowWindow]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004fa004
mov esp, ebp
pop ebp
ret
Function at 0x44d5f0
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x572743
mov eax, dword fs:[0]
push eax
sub esp, 0x7c
mov eax, dword [0x5cc6c0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push 0x30
lea eax, [ebp - 0x58]
push 0
push eax
call fcn.0053efc0
add esp, 0xc
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov edx, eax
mov dword [ebp - 0x60], 0
mov ecx, edx
mov dword [ebp - 0x5c], 7
xor eax, eax
mov word [ebp - 0x70], ax
lea esi, [ecx + 2]
nop word [eax + eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x44d650
sub ecx, esi
sar ecx, 1
push ecx
push edx
lea ecx, [ebp - 0x70]
call fcn.00406a80
lea eax, [ebp - 0x70]
mov dword [ebp - 4], 0
push eax
lea ecx, [ebp - 0x58]
call fcn.0046b2d0
mov edx, dword [ebp - 0x5c]
mov byte [ebp - 4], 2
cmp edx, 8
jb 0x44d6ba
mov ecx, dword [ebp - 0x70]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x44d6b0
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x44d83f
push edx
push ecx
call fcn.004f9d5c
add esp, 8
xor eax, eax
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 7
mov word [ebp - 0x28], ax
push 4
push str.from
lea ecx, [ebp - 0x88]
mov byte [ebp - 4], 3
mov dword [ebp - 0x78], eax
mov dword [ebp - 0x74], 7
mov word [ebp - 0x88], ax
call fcn.00406a80
lea eax, [ebp - 0x28]
mov byte [ebp - 4], 4
push eax
lea eax, [ebp - 0x88]
push eax
lea ecx, [ebp - 0x58]
call fcn.0046ba20
mov edx, dword [ebp - 0x74]
mov byte [ebp - 4], 3
cmp edx, 8
jb 0x44d74d
mov ecx, dword [ebp - 0x88]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x44d743
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x44d844
push edx
push ecx
call fcn.004f9d5c
add esp, 8
mov esi, dword [ebp - 0x14]
lea eax, [ebp - 0x28]
push 9
push str.startmenu
push dword [ebp - 0x18]
cmp esi, 8
cmovae eax, dword [ebp - 0x28]
push eax
call fcn.00441c00
add esp, 0x10
test al, al
je 0x44d785
call fcn.0042f1b0
push 0
push 0
push 1
push 0
push str.open_menu
jmp 0x44d7cc
push 7
push str.desktop
push dword [ebp - 0x18]
cmp esi, 8
lea eax, [ebp - 0x28]
cmovae eax, dword [ebp - 0x28]
push eax
call fcn.00441c00
add esp, 0x10
test al, al
je 0x44d7ba
call fcn.0042f1b0
push 0
push 0
push 1
push 0
push str.open_lnk
jmp 0x44d7cc
call fcn.0042f1b0
push 0
push 0
push 1
push 0
push str.show_other
mov ecx, eax
call fcn.00468bc0
mov edx, dword [ebp - 0x14]
cmp edx, 8
jb 0x44d809
mov ecx, dword [ebp - 0x28]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x44d7ff
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x44d849
push edx
push ecx
call fcn.004f9d5c
add esp, 8
xor eax, eax
mov dword [ebp - 0x18], 0
lea ecx, [ebp - 0x58]
mov dword [ebp - 0x14], 7
mov word [ebp - 0x28], ax
call fcn.0046b4f0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004fa004
mov esp, ebp
pop ebp
ret
call fcn.00542850
call fcn.00542850
call fcn.00542850
int3
Function at 0x450820
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x572a80
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
mov eax, dword [0x5cc6c0]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov eax, ecx
mov dword [ebp - 0x18], eax
mov edi, dword [ebp + 0xc]
mov esi, edi
mov ecx, dword [ebp + 8]
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x20], ecx
cmp dword [edi + 0x14], 0x10
mov ebx, dword [edi + 0x10]
mov dword [ebp - 4], 0
jb 0x450873
mov esi, dword [edi]
xor ecx, ecx
mov edx, 0x811c9dc5
test ebx, ebx
je 0x450894
nop
movzx eax, byte [ecx + esi]
inc ecx
xor eax, edx
imul edx, eax, 0x1000193
cmp ecx, ebx
jb 0x450880
mov eax, dword [ebp - 0x18]
mov ecx, dword [eax + 0x18]
mov eax, dword [eax + 0xc]
and ecx, edx
mov esi, dword [ebp - 0x18]
mov dword [ebp - 0x24], ecx
lea eax, [eax + ecx*8]
mov esi, dword [esi + 4]
mov dword [ebp - 0x1c], eax
cmp esi, dword [eax]
je 0x450940
mov esi, dword [eax + 4]
mov esi, dword [esi]
cmp esi, dword [eax]
je 0x450940
mov esi, dword [esi + 4]
cmp dword [esi + 0x1c], 0x10
lea eax, [esi + 8]
mov edx, dword [eax + 0x10]
jb 0x4508d1
mov eax, dword [eax]
cmp dword [edi + 0x14], 0x10
mov ecx, edi
jb 0x4508db
mov ecx, dword [edi]
push edx
push eax
push ebx
push ecx
call fcn.0042baf0
add esp, 0x10
test al, al
mov eax, dword [ebp - 0x1c]
je 0x4508b8
mov edi, dword [ebp + 0x10]
mov ecx, dword [edi + 4]
mov eax, dword [edi]
mov dword [ecx], eax
mov ecx, dword [edi]
mov eax, dword [edi + 4]
mov dword [ecx + 4], eax
lea ecx, [edi + 8]
mov eax, dword [ebp - 0x18]
dec dword [eax + 8]
call fcn.004421e0
push 0x38
push edi
call fcn.004f9d5c
mov eax, dword [ebp - 0x20]
add esp, 8
mov dword [eax], esi
mov byte [eax + 4], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.004fa004
mov esp, ebp
pop ebp
ret 0xc
mov edi, dword [ebp + 0x10]
mov dword [ebp - 0x1c], edi
mov eax, dword [edi]
cmp esi, eax
je 0x45096d
mov ecx, dword [edi + 4]
mov dword [ecx], eax
mov ecx, dword [eax + 4]
mov dword [ecx], esi
mov ecx, dword [esi + 4]
mov dword [ecx], edi
mov ecx, dword [eax + 4]
mov edx, dword [esi + 4]
mov dword [esi + 4], ecx
mov ecx, dword [edi + 4]
mov dword [eax + 4], ecx
mov dword [edi + 4], edx
push dword [ebp - 0x24]
mov ebx, dword [ebp - 0x18]
mov ecx, ebx
push esi
push edi
call fcn.00440270
mov ecx, ebx
mov dword [ebp - 4], 2
call fcn.00457f30
mov eax, dword [ebp - 0x20]
mov dword [eax], edi
mov byte [eax + 4], 1
jmp 0x450922
Function at 0x4509c0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x572ab0
mov eax, dword fs:[0]
push eax
sub esp, 0x14
mov eax, dword [0x5cc6c0]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov eax, ecx
mov dword [ebp - 0x18], eax
mov edi, dword [ebp + 0xc]
mov esi, edi
mov dword [ebp - 4], 0
cmp dword [edi + 0x14], 0x10
mov ebx, dword [edi + 0x10]
jb 0x450a0a
mov esi, dword [edi]
xor ecx, ecx
mov edx, 0x811c9dc5
test ebx, ebx
je 0x450a29
movzx eax, byte [ecx + esi]
inc ecx
xor eax, edx
imul edx, eax, 0x1000193
cmp ecx, ebx
jb 0x450a15
mov eax, dword [ebp - 0x18]
mov ecx, dword [eax + 0x18]
mov eax, dword [eax + 0xc]
and ecx, edx
mov dword [ebp - 0x20], ecx
lea eax, [eax + ecx*8]
mov ecx, dword [ebp - 0x18]
mov dword [ebp - 0x1c], eax
mov esi, dword [ecx + 4]
cmp esi, dword [eax]
je 0x450aa9
mov esi, dword [eax + 4]
mov esi, dword [esi]
nop dword [eax]
cmp esi, dword [eax]
je 0x450aa9
mov esi, dword [esi + 4]
cmp dword [esi + 0x1c], 0x10
lea eax, [esi + 8]
mov edx, dword [eax + 0x10]
jb 0x450a65
mov eax, dword [eax]
cmp dword [edi + 0x14], 0x10
mov ecx, edi
jb 0x450a6f
mov ecx, dword [edi]
push edx
push eax
push ebx
push ecx
call fcn.0042baf0
add esp, 0x10
test al, al
mov eax, dword [ebp - 0x1c]
je 0x450a50
mov eax, dword [ebp + 8]
mov dword [eax], esi
mov byte [eax + 4], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.004fa004
mov esp, ebp
pop ebp
ret 0xc
mov eax, dword [ebp + 0x10]
mov edx, dword [ebp - 0x18]
mov ecx, dword [eax]
mov dword [eax], 0
mov eax, dword [edx + 4]
mov eax, dword [eax]
mov dword [ecx], eax
mov eax, dword [eax + 4]
mov dword [ecx + 4], eax
mov dword [eax], ecx
mov eax, dword [ecx]
mov dword [eax + 4], ecx
inc dword [edx + 8]
mov edi, dword [edx + 4]
mov edi, dword [edi]
mov dword [ebp - 0x1c], edi
mov eax, dword [edi]
cmp esi, eax
je 0x450b00
mov ecx, dword [edi + 4]
mov dword [ecx], eax
mov ecx, dword [eax + 4]
mov dword [ecx], esi
mov ecx, dword [esi + 4]
mov dword [ecx], edi
mov edx, dword [esi + 4]
mov ecx, dword [eax + 4]
mov dword [esi + 4], ecx
mov ecx, dword [edi + 4]
mov dword [eax + 4], ecx
mov dword [edi + 4], edx
mov edx, dword [ebp - 0x18]
push dword [ebp - 0x20]
mov ecx, edx
push esi
push edi
call fcn.00440270
mov ecx, dword [ebp - 0x18]
mov dword [ebp - 4], 2
call fcn.00457fd0
mov eax, dword [ebp + 8]
mov dword [eax], edi
mov byte [eax + 4], 1
jmp 0x450a8b
Function at 0x450b50
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x572ae0
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
mov eax, dword [0x5cc6c0]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov eax, ecx
mov dword [ebp - 0x18], eax
mov edi, dword [ebp + 0xc]
mov esi, edi
mov ecx, dword [ebp + 8]
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x20], ecx
cmp dword [edi + 0x14], 0x10
mov ebx, dword [edi + 0x10]
mov dword [ebp - 4], 0
jb 0x450ba3
mov esi, dword [edi]
xor ecx, ecx
mov edx, 0x811c9dc5
test ebx, ebx
je 0x450bc4
nop
movzx eax, byte [ecx + esi]
inc ecx
xor eax, edx
imul edx, eax, 0x1000193
cmp ecx, ebx
jb 0x450bb0
mov eax, dword [ebp - 0x18]
mov ecx, dword [eax + 0x18]
mov eax, dword [eax + 0xc]
and ecx, edx
mov esi, dword [ebp - 0x18]
mov dword [ebp - 0x24], ecx
lea eax, [eax + ecx*8]
mov esi, dword [esi + 4]
mov dword [ebp - 0x1c], eax
cmp esi, dword [eax]
je 0x450c70
mov esi, dword [eax + 4]
mov esi, dword [esi]
cmp esi, dword [eax]
je 0x450c70
mov esi, dword [esi + 4]
cmp dword [esi + 0x1c], 0x10
lea eax, [esi + 8]
mov edx, dword [eax + 0x10]
jb 0x450c01
mov eax, dword [eax]
cmp dword [edi + 0x14], 0x10
mov ecx, edi
jb 0x450c0b
mov ecx, dword [edi]
push edx
push eax
push ebx
push ecx
call fcn.0042baf0
add esp, 0x10
test al, al
mov eax, dword [ebp - 0x1c]
je 0x450be8
mov edi, dword [ebp + 0x10]
mov ecx, dword [edi + 4]
mov eax, dword [edi]
mov dword [ecx], eax
mov ecx, dword [edi]
mov eax, dword [edi + 4]
mov dword [ecx + 4], eax
lea ecx, [edi + 8]
mov eax, dword [ebp - 0x18]
dec dword [eax + 8]
call fcn.00423d20
push 0x28
push edi
call fcn.004f9d5c
mov eax, dword [ebp - 0x20]
add esp, 8
mov dword [eax], esi
mov byte [eax + 4], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.004fa004
mov esp, ebp
pop ebp
ret 0xc
mov edi, dword [ebp + 0x10]
mov dword [ebp - 0x1c], edi
mov eax, dword [edi]
cmp esi, eax
je 0x450c9d
mov ecx, dword [edi + 4]
mov dword [ecx], eax
mov ecx, dword [eax + 4]
mov dword [ecx], esi
mov ecx, dword [esi + 4]
mov dword [ecx], edi
mov ecx, dword [eax + 4]
mov edx, dword [esi + 4]
mov dword [esi + 4], ecx
mov ecx, dword [edi + 4]
mov dword [eax + 4], ecx
mov dword [edi + 4], edx
push dword [ebp - 0x24]
mov ebx, dword [ebp - 0x18]
mov ecx, ebx
push esi
push edi
call fcn.00440270
mov ecx, ebx
mov dword [ebp - 4], 2
call fcn.00457fd0
mov eax, dword [ebp - 0x20]
mov dword [eax], edi
mov byte [eax + 4], 1
jmp 0x450c52
Function at 0x450cf0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x572b10
mov eax, dword fs:[0]
push eax
sub esp, 0x18
mov eax, dword [0x5cc6c0]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov eax, ecx
mov dword [ebp - 0x18], eax
mov edi, dword [ebp + 0xc]
mov esi, edi
mov dword [ebp - 4], 0
cmp dword [edi + 0x14], 0x10
mov ebx, dword [edi + 0x10]
jb 0x450d3a
mov esi, dword [edi]
xor ecx, ecx
mov edx, 0x811c9dc5
test ebx, ebx
je 0x450d59
movzx eax, byte [ecx + esi]
inc ecx
xor eax, edx
imul edx, eax, 0x1000193
cmp ecx, ebx
jb 0x450d45
mov eax, dword [ebp - 0x18]
mov ecx, dword [eax + 0x18]
mov eax, dword [eax + 0xc]
and ecx, edx
mov esi, dword [ebp - 0x18]
mov dword [ebp - 0x24], ecx
lea eax, [eax + ecx*8]
mov esi, dword [esi + 4]
mov dword [ebp - 0x20], eax
cmp esi, dword [eax]
je 0x450dd9
mov esi, dword [eax + 4]
mov esi, dword [esi]
nop dword [eax]
cmp esi, dword [eax]
je 0x450dd9
mov esi, dword [esi + 4]
cmp dword [esi + 0x1c], 0x10
lea eax, [esi + 8]
mov edx, dword [eax + 0x10]
jb 0x450d95
mov eax, dword [eax]
cmp dword [edi + 0x14], 0x10
mov ecx, edi
jb 0x450d9f
mov ecx, dword [edi]
push edx
push eax
push ebx
push ecx
call fcn.0042baf0
add esp, 0x10
test al, al
mov eax, dword [ebp - 0x20]
je 0x450d80
mov eax, dword [ebp + 8]
mov dword [eax], esi
mov byte [eax + 4], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.004fa004
mov esp, ebp
pop ebp
ret 0xc
mov ebx, dword [ebp - 0x18]
mov eax, dword [ebx + 4]
lea ecx, [ebx + 4]
push edi
mov dword [ebp - 4], 0xffffffff
mov eax, dword [eax]
mov dword [ebp - 0x20], eax
mov edx, dword [eax + 4]
push edx
push eax
mov dword [ebp - 0x1c], edx
call fcn.00450220
mov edx, eax
mov ecx, 0x4924923
mov eax, dword [ebx + 8]
sub ecx, eax
cmp ecx, 1
jb 0x450e9d
inc eax
mov dword [ebx + 8], eax
mov eax, dword [ebp - 0x20]
mov dword [eax + 4], edx
mov eax, dword [ebp - 0x1c]
mov dword [eax], edx
mov edi, dword [ebx + 4]
mov edi, dword [edi]
mov dword [ebp - 0x1c], edi
mov eax, dword [edi]
cmp esi, eax
je 0x450e4f
mov ecx, dword [edi + 4]
mov dword [ecx], eax
mov ecx, dword [eax + 4]
mov dword [ecx], esi
mov ecx, dword [esi + 4]
mov dword [ecx], edi
mov ecx, dword [eax + 4]
mov edx, dword [esi + 4]
mov dword [esi + 4], ecx
mov ecx, dword [edi + 4]
mov dword [eax + 4], ecx
mov dword [edi + 4], edx
push dword [ebp - 0x24]
mov ecx, ebx
push esi
push edi
call fcn.00440270
mov ecx, ebx
mov dword [ebp - 4], 2
call fcn.00457f30
mov eax, dword [ebp + 8]
mov dword [eax], edi
mov byte [eax + 4], 1
jmp 0x450dbb
push str.list_T__too_long
call fcn.00460650
int3
Function at 0x450eb0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
mov esi, edi
mov dword [ebp - 4], ecx
cmp dword [edi + 0x14], 0x10
mov ebx, dword [edi + 0x10]
jb 0x450ecc
mov esi, dword [edi]
xor ecx, ecx
mov edx, 0x811c9dc5
test ebx, ebx
je 0x450ee8
movzx eax, byte [ecx + esi]
inc ecx
xor eax, edx
imul edx, eax, 0x1000193
cmp ecx, ebx
jb 0x450ed7
mov ebx, dword [ebp - 4]
mov eax, dword [ebx + 0x18]
mov ecx, dword [ebx + 0xc]
and eax, edx
mov ebx, dword [ebx + 4]
mov edx, dword [ecx + eax*8]
lea eax, [eax*8 + 4]
add eax, ecx
mov dword [ebp - 8], edx
mov esi, edx
mov dword [ebp - 0xc], eax
nop word [eax + eax]
cmp edx, ebx
jne 0x450f18
mov eax, ebx
jmp 0x450f1c
mov eax, dword [eax]
mov eax, dword [eax]
cmp esi, eax
je 0x450f8f
cmp dword [edi + 0x14], 0x10
lea eax, [esi + 8]
mov ecx, edi
jb 0x450f2d
mov ecx, dword [edi]
mov edi, dword [eax + 0x14]
cmp edi, 0x10
mov edx, dword [eax + 0x10]
mov dword [ebp - 0x10], edi
mov edi, dword [ebp + 0xc]
mov dword [ebp - 0x14], edx
jb 0x450f43
mov eax, dword [eax]
push dword [edi + 0x10]
push ecx
push edx
push eax
call fcn.0042baf0
add esp, 0x10
test al, al
jne 0x450f5f
mov esi, dword [esi]
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 0xc]
jmp 0x450f10
cmp dword [ebp - 0x10], 0x10
lea eax, [esi + 8]
jb 0x450f6a
mov eax, dword [eax]
cmp dword [edi + 0x14], 0x10
mov ecx, edi
jb 0x450f74
mov ecx, dword [edi]
push dword [ebp - 0x14]
push eax
push dword [edi + 0x10]
push ecx
call fcn.0042baf0
add esp, 0x10
mov ecx, ebx
test al, al
cmovne ecx, esi
mov eax, ecx
jmp 0x450f93
mov ecx, ebx
mov eax, ebx
cmp eax, ebx
jne 0x450ff3
mov esi, dword [ebx]
lea eax, [ebp + 0xf]
mov ebx, dword [ebp - 4]
push eax
lea eax, [ebp - 0x14]
mov dword [ebp - 0x14], edi
mov edi, dword [esi + 4]
push eax
push 0x580ff0
push edi
push esi
lea ecx, [ebx + 4]
call fcn.00450180
mov edx, eax
mov ecx, 0x4924923
mov eax, dword [ebx + 8]
sub ecx, eax
cmp ecx, 1
jb 0x451005
inc eax
mov ecx, ebx
mov dword [ebx + 8], eax
mov dword [esi + 4], edx
mov esi, dword [ebp + 8]
mov dword [edi], edx
mov eax, dword [ebx + 4]
mov eax, dword [eax]
push eax
add eax, 8
push eax
push esi
call fcn.00450820
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
mov eax, dword [ebp + 8]
pop edi
pop esi
pop ebx
mov dword [eax], ecx
mov byte [eax + 4], 0
mov esp, ebp
pop ebp
ret 8
push str.list_T__too_long
call fcn.00460650
int3
Function at 0x451010
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [ebp + 8]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 0xc]
cmp dword [eax + 0x1c], 0x10
push ebx
mov ebx, dword [eax + 0x18]
push esi
lea esi, [eax + 8]
mov dword [ebp - 4], ecx
push edi
jb 0x451033
mov esi, dword [esi]
xor edx, edx
mov edi, 0x811c9dc5
test ebx, ebx
je 0x451051
nop
movzx ecx, byte [edx + esi]
inc edx
xor ecx, edi
imul edi, ecx, 0x1000193
cmp edx, ebx
jb 0x451040
mov ebx, dword [ebp - 4]
mov ecx, dword [ebx + 0x18]
mov edx, dword [ebx + 0xc]
and ecx, edi
lea esi, [ecx*8]
mov ecx, dword [edx + esi]
add edx, esi
cmp dword [edx + 4], eax
jne 0x45108a
cmp ecx, eax
jne 0x451082
mov ecx, dword [ebx + 4]
mov dword [edx], ecx
mov edx, dword [ebx + 0xc]
mov ecx, dword [ebx + 4]
mov dword [esi + edx + 4], ecx
jmp 0x451092
mov ecx, dword [eax + 4]
mov dword [edx + 4], ecx
jmp 0x451092
cmp ecx, eax
jne 0x451092
mov ecx, dword [eax]
mov dword [edx], ecx
mov edx, dword [eax + 4]
lea ecx, [ebx + 4]
mov edi, dword [eax]
push eax
mov dword [edx], edi
mov esi, dword [eax]
mov edx, dword [eax + 4]
mov dword [esi + 4], edx
dec dword [ecx + 4]
call fcn.00458320
mov eax, dword [ebp - 8]
mov dword [eax], edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x4510c0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
mov dword [ebp - 4], ecx
mov dword [ebp - 8], eax
cmp dword [edi + 0x1c], 0x10
lea esi, [edi + 8]
mov ebx, dword [edi + 0x18]
jb 0x4510e4
mov esi, dword [edi + 8]
xor ecx, ecx
mov edx, 0x811c9dc5
test ebx, ebx
je 0x451101
nop
movzx eax, byte [ecx + esi]
inc ecx
xor eax, edx
imul edx, eax, 0x1000193
cmp ecx, ebx
jb 0x4510f0
mov ebx, dword [ebp - 4]
mov eax, dword [ebx + 0x18]
mov ecx, dword [ebx + 0xc]
and eax, edx
lea edx, [eax*8]
mov eax, dword [ecx + edx]
add ecx, edx
cmp dword [ecx + 4], edi
jne 0x45113a
cmp eax, edi
jne 0x451132
mov eax, dword [ebx + 4]
mov dword [ecx], eax
mov ecx, dword [ebx + 0xc]
mov eax, dword [ebx + 4]
mov dword [edx + ecx + 4], eax
jmp 0x451142
mov eax, dword [edi + 4]
mov dword [ecx + 4], eax
jmp 0x451142
cmp eax, edi
jne 0x451142
mov eax, dword [edi]
mov dword [ecx], eax
mov eax, dword [edi + 4]
lea ecx, [edi + 8]
mov esi, dword [edi]
mov dword [eax], esi
mov edx, dword [edi]
mov eax, dword [edi + 4]
mov dword [edx + 4], eax
dec dword [ebx + 8]
call fcn.004421e0
push 0x38
push edi
call fcn.004f9d5c
mov eax, dword [ebp - 8]
add esp, 8
pop edi
mov dword [eax], esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8