joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10007b4b
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
xor ebx, ebx
cmp dword [0x1001745c], ebx
push esi
push edi
jne 0x10007bcb
push str.user32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
cmp edi, ebx
je 0x10007c06
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x10010ccc
push edi
call esi
test eax, eax
mov dword [0x1001745c], eax
je 0x10007c06
push str.GetActiveWindow
push edi
call esi
push str.GetLastActivePopup
push edi
mov dword [0x10017460], eax
call esi
cmp dword [0x1001729c], 2
mov dword [0x10017464], eax
jne 0x10007bcb
push str.GetUserObjectInformationA
push edi
call esi
test eax, eax
mov dword [0x1001746c], eax
je 0x10007bcb
push str.GetProcessWindowStation
push edi
call esi
mov dword [0x10017468], eax
mov eax, dword [0x10017468]
test eax, eax
je 0x10007c10
call eax
test eax, eax
je 0x10007bf7
lea ecx, [ebp - 4]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call dword [0x1001746c]
test eax, eax
je 0x10007bf7
test byte [ebp - 8], 1
jne 0x10007c10
cmp dword [0x100172a8], 4
jb 0x10007c0a
or byte [ebp + 0x12], 0x20
jmp 0x10007c2f
xor eax, eax
jmp 0x10007c3f
or byte [ebp + 0x12], 4
jmp 0x10007c2f
mov eax, dword [0x10017460]
test eax, eax
je 0x10007c2f
call eax
mov ebx, eax
test ebx, ebx
je 0x10007c2f
mov eax, dword [0x10017464]
test eax, eax
je 0x10007c2f
push ebx
call eax
mov ebx, eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push ebx
call dword [0x1001745c]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x10009bfe
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4c
push ebx
push esi
push edi
push 4
pop eax
call fcn.100039c0
mov esi, esp
push 0x1c
lea eax, [ebp - 0x28]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
je 0x10009c99
mov ebx, dword [ebp - 0x24]
lea eax, [ebp - 0x4c]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov ecx, dword [ebp - 0x48]
mov eax, dword [0x1001729c]
lea edi, [ecx - 1]
not edi
and edi, esi
sub edi, ecx
mov esi, eax
dec esi
neg esi
sbb esi, esi
and esi, 0xfffffff1
add esi, 0x11
imul esi, ecx
add esi, ebx
cmp edi, esi
mov dword [ebp - 8], ecx
jb 0x10009c99
cmp eax, 1
je 0x10009cba
mov dword [ebp - 4], ebx
mov ebx, 0x1000
push 0x1c
lea eax, [ebp - 0x28]
push eax
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
je 0x10009c99
mov eax, dword [ebp - 0x1c]
add dword [ebp - 4], eax
test dword [ebp - 0x18], ebx
je 0x10009c66
test byte [ebp - 0x13], 1
mov eax, dword [ebp - 0x28]
mov dword [ebp - 4], eax
je 0x10009c95
xor eax, eax
inc eax
jmp 0x10009cd9
cmp edi, eax
jae 0x10009c9d
xor eax, eax
jmp 0x10009cd9
cmp eax, esi
jae 0x10009ca4
mov dword [ebp - 4], esi
push 4
push ebx
push dword [ebp - 8]
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov eax, dword [0x1001729c]
jmp 0x10009cbd
mov dword [ebp - 4], edi
dec eax
neg eax
sbb eax, eax
and eax, 0x103
lea ecx, [ebp - 0xc]
push ecx
inc eax
push eax
push dword [ebp - 8]
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea esp, [ebp - 0x58]
pop edi
pop esi
pop ebx
leave
ret

Function at 0x5a0661
Capabilities:
Parse pe header

Disassembly:
cmp word [eax], 0x5a4d
jmp 0x5a07e5
add eax, dword [eax + 0x3c]
jmp 0x5a087e
add eax, 0x10000
jmp 0x5a0ac2
sub eax, 0x10000
jmp 0x5a04a3
call 0x5a0661
outsb dx, byte [esi]
dec edx
xchg dword [esp], ecx
lea ecx, [ecx + 0x547]
xchg dword [esp], ecx
jmp 0x5a0ba6
shr eax, 0x10
je 0x5a0725
jne 0x5a0725
cmpsb byte [esi], byte es:[edi]
das
push edi
retf 0x840f
shl eax, 0x10
jmp 0x5a097c
xchg dword [esp], ecx
lea ecx, [ecx + 0x24c]
xchg dword [esp], ecx
jmp 0x5a065a
jne 0x5a0ac2
jmp 0x5a04f7
cmp dword [eax], 0x4550
jmp 0x5a0bfb
ret
shr eax, 0x10
jp 0x5a0ad4
jnp 0x5a0ad4
out dx, eax
cmc
test dword [eax - 0x17], edx
mov edx, edi
invalid
shl eax, 0x10
jmp 0x5a05a6
pop eax
jmp 0x5a057d
jne 0x5a0ac2
jmp 0x5a06f8

Function at 0x5a07ca
Capabilities:
Parse pe header

Disassembly:
cmp word [eax], 0x5a4d
jmp 0x5a07e5
add eax, dword [eax + 0x3c]
jmp 0x5a087e
add eax, 0x10000
jmp 0x5a0ac2
sub eax, 0x10000
jmp 0x5a04a3
call 0x5a0661
outsb dx, byte [esi]
dec edx
xchg dword [esp], ecx
lea ecx, [ecx + 0x547]
xchg dword [esp], ecx
jmp 0x5a0ba6
shr eax, 0x10
je 0x5a0725
jne 0x5a0725
cmpsb byte [esi], byte es:[edi]
das
push edi
retf 0x840f
shl eax, 0x10
jmp 0x5a097c
xchg dword [esp], ecx
lea ecx, [ecx + 0x24c]
xchg dword [esp], ecx
jmp 0x5a065a
jne 0x5a0ac2
jmp 0x5a04f7
cmp dword [eax], 0x4550
jmp 0x5a0bfb
ret
shr eax, 0x10
jp 0x5a0ad4
jnp 0x5a0ad4
out dx, eax
cmc
test dword [eax - 0x17], edx
mov edx, edi
invalid
shl eax, 0x10
jmp 0x5a05a6
pop eax
jmp 0x5a057d
jne 0x5a0ac2
jmp 0x5a06f8
Function at 0x402380
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
sub esp, 0x3c
mov edx, 0x402428
mov dword [esp + 0xc], ebx
mov dword [esp + 0x10], esi
mov eax, dword fs:[0x2c]
mov ecx, dword [eax]
push dword [ecx + 0x14]
push dword [ecx + 0x10]
push edx
push 0
call fcn.0044d470
lea ecx, [esp + 0x14]
mov ebx, 1
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], edx
push ecx
push ebx
call fcn.0040caf8
mov esi, dword [esp + 0x44]
mov dword [esp + 0x24], eax
mov eax, dword [esp + 0x40]
mov dword [esp + 0x28], edx
lea edx, [esp + 0x24]
mov dword [esp + 0x30], 0x4bb1b0
mov dword [esp + 0x2c], 1
mov dword [esp + 0x34], eax
mov dword [esp + 0x38], esi
mov dword [esp + 8], edx
mov dword [esp + 4], 3
mov dword [esp], 0x4c1720
call fcn.0044d160
mov ecx, 0x402430
push edx
push eax
push ecx
push 0
call fcn.0040ecb4
mov ebx, dword [esp + 0xc]
mov esi, dword [esp + 0x10]
add esp, 0x3c
ret 8

Function at 0x4043b4
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push eax
push eax
mov dword [esp + 4], ebx
mov eax, dword fs:[0x2c]
mov ecx, dword [eax]
push dword [ecx + 0x4c]
push dword [ecx + 0x48]
call fcn.004249fc
mov ebx, eax
cmp eax, 4
ja case.default.0x4043de
jmp dword [ebx*4 + 0x4b40cc]
mov dword [esp], 0x4bc310
call fcn.0044a170
call fcn.00404250
mov ebx, dword [esp + 4]
add esp, 8
ret
mov dword [esp], 0x4bc3e0
call fcn.0044a170
call fcn.00404250
mov ebx, dword [esp + 4]
add esp, 8
ret
mov dword [esp], 0x4bc4a0
call fcn.0044a170
call fcn.00404250
mov ebx, dword [esp + 4]
add esp, 8
ret
mov dword [esp], 0x4bc620
call fcn.0044a170
call fcn.00404250
mov ebx, dword [esp + 4]
add esp, 8
ret
mov dword [esp], 0x4bc560
call fcn.0044a170
call fcn.00404250
mov ebx, dword [esp + 4]
add esp, 8
ret
mov edx, 0x4bc720
mov esi, 0x4bbbd0
mov eax, 0x4c20c0
push edx
push 0x10
push esi
push 0x13
push 0x379
push 0
push eax
call fcn.0044a170
add esp, 4
call fcn.0044d444
mov dword [esp], eax
call fcn.0044a110
Function at 0x405d50
Capabilities:
Access peb ldr_data

Disassembly:
sub esp, 0x68
mov dword [esp + 0x14], ebx
mov dword [esp + 0x18], esi
mov dword [esp + 0x1c], edi
mov dword [esp + 0x64], eax
mov dword [esp], 0x11
call fcn.0044e3f0
mov esi, eax
mov eax, dword [esp + 0x64]
mov dword [esi], eax
mov ecx, dword fs:[0x2c]
mov edx, dword [ecx]
inc dword [edx + 0x3c]
mov ebx, dword fs:[0x2c]
mov edi, dword [ebx]
mov eax, dword [edi + 0x2c]
or eax, dword [edi + 0x28]
je 0x405efe
mov ecx, dword fs:[0x2c]
mov edx, dword [ecx]
push dword [edx + 0x2c]
push dword [edx + 0x28]
call fcn.00422414
xor al, 1
je 0x405dd9
mov ebx, dword fs:[0x2c]
mov edi, dword [ebx]
push dword [edi + 0x2c]
push dword [edi + 0x28]
call fcn.0044fbec
mov dword [esp + 0x10], 0x4bc8e0
mov dword [esp + 0xc], 1
mov eax, dword fs:[0x2c]
mov ecx, dword [eax]
mov edx, dword [ecx + 0x2c]
mov eax, dword [ecx + 0x28]
mov ebx, dword [esp + 0x64]
add ebx, 4
mov dword [esp + 0x30], eax
mov dword [esp + 0x34], edx
push dword [ebx + 0xc]
push dword [ebx + 8]
push dword [ebx + 4]
push dword [ebx]
lea eax, [esp + 0x50]
call fcn.00427aa8
lea ecx, [esp + 0x30]
mov edi, 2
mov dword [esp + 0x3c], eax
mov dword [esp + 0x38], 0x20
push ecx
push edi
call fcn.00424f54
push edx
mov edx, 0x405f18
push eax
push edx
push esi
call fcn.0044d470
mov dword [esp + 8], edx
mov dword [esp + 4], eax
mov dword [esp], 0x4c1720
call fcn.0044a230
mov ebx, 0x405f20
push ebx
mov dword [esi + 8], eax
mov dword [esi + 0xc], edx
mov byte [esi + 4], 0
push esi
call fcn.00427bb8
cmp byte [esi + 4], 0
je 0x405e9b
mov ebx, 0x4bc8f0
push ebx
push 0xf
call fcn.00422344
mov ebx, dword [esp + 0x14]
mov esi, dword [esp + 0x18]
mov edi, dword [esp + 0x1c]
add esp, 0x68
xor eax, eax
ret 8
mov eax, 0x405f78
push eax
push esi
call fcn.00427bb8
cmp byte [esi + 4], 0
je 0x405ed1
mov edx, 0x4bc900
push edx
push 0x10
call fcn.00422344
mov ebx, dword [esp + 0x14]
mov esi, dword [esp + 0x18]
mov edi, dword [esp + 0x1c]
add esp, 0x68
mov eax, 1
ret 8
mov eax, dword [esp + 0x6c]
call dword [esp + 0x70]
mov ecx, 0x405fd0
push ecx
mov byte [esi + 0x10], al
push esi
call fcn.00427bb8
movsx eax, byte [esi + 0x10]
mov ebx, dword [esp + 0x14]
mov esi, dword [esp + 0x18]
mov edi, dword [esp + 0x1c]
add esp, 0x68
ret 8
mov eax, dword [esp + 0x6c]
call dword [esp + 0x70]
mov ebx, dword [esp + 0x14]
mov esi, dword [esp + 0x18]
mov edi, dword [esp + 0x1c]
add esp, 0x68
ret 8
Function at 0x40caf8
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x78
mov eax, dword [esp + 0x7c]
mov ecx, dword [esp + 0x80]
mov dword [esp + 4], esi
xor esi, esi
mov dword [esp + 0xc], eax
mov dword [esp], ebx
mov dword [esp + 8], edi
mov dword [esp + 0x1c], 0
mov dword [esp + 0x20], 0
mov dword [esp + 0x10], ecx
cmp dword [esp + 0xc], esi
je 0x40cba2
mov edx, dword [esp + 0x80]
mov eax, dword [edx + esi*8]
mov edx, dword [edx + esi*8 + 4]
mov dword [esp + 0x14], eax
mov ebx, dword [esp + 0x20]
mov dword [esp + 0x18], edx
or ebx, dword [esp + 0x1c]
je 0x40cb8b
push dword [esp + 0x20]
push dword [esp + 0x20]
push dword [esp + 0x20]
push dword [esp + 0x20]
lea eax, [esp + 0x3c]
call fcn.0040cec0
mov ebx, eax
mov ecx, 5
add ebx, 0x10
push dword [ebx]
sub ebx, 4
dec ecx
jne 0x40cb74
call fcn.0040daa8
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], edx
jmp 0x40cb9b
mov edi, dword [esp + 0x14]
mov ecx, dword [esp + 0x18]
mov dword [esp + 0x1c], edi
mov dword [esp + 0x20], ecx
inc esi
cmp esi, dword [esp + 0xc]
jb 0x40cb31
push dword [esp + 0x20]
push dword [esp + 0x20]
lea eax, [esp + 0x54]
call fcn.0040dc0c
lea eax, [esp + 0x78]
call fcn.0040cbd0
mov ebx, dword [esp]
mov esi, dword [esp + 4]
mov edi, dword [esp + 8]
add esp, 0x78
ret 8

Function at 0x40e658
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x44
mov dword [esp], esi
mov dword [esp + 4], edi
call fcn.0040e6c8
lea esi, [esp + 0x48]
lea edi, [esp + 0x18]
mov dword [esp + 8], eax
mov ecx, 0xb
rep movsd dword es:[edi], dword [esi]
lea eax, [esp + 0x18]
call fcn.0040dc6c
xor al, 1
je 0x40e6b0
lea eax, [esp + 0x18]
call fcn.0040dc7c
push eax
lea eax, [esp + 0xc]
call fcn.0040ea44
lea eax, [esp + 0x18]
call fcn.0040dc88
lea eax, [esp + 0x18]
call fcn.0040dc6c
xor al, 1
jne 0x40e687
lea eax, [esp + 8]
call fcn.0040e844
mov esi, dword [esp]
mov edi, dword [esp + 4]
add esp, 0x44
ret 0x2c
Function at 0x40eb5c
Capabilities:
Encode data using xor
Hash data using murmur3

Disassembly:
sub esp, 0x10
mov ecx, dword [esp + 0x18]
mov dword [esp + 4], esi
mov esi, dword [esp + 0x18]
mov dword [esp + 8], edi
mov edi, dword [esp + 0x14]
and edi, 0xfffffffc
mov dword [esp], ebx
add edi, ecx
cmp ecx, edi
mov dword [esp + 0xc], eax
je 0x40ebc1
mov eax, esi
call fcn.0040ec60
mov ebx, eax
add esi, 4
imul edx, ebx, 0xcc9e2d51
mov ebx, edx
rol edx, 0xf
mov ebx, edx
imul ecx, ebx, 0x1b873593
mov ebx, ecx
xor dword [esp + 0xc], ebx
mov edx, dword [esp + 0xc]
rol edx, 0xd
lea ecx, [edx + edx*4 - 0x19ab949c]
cmp esi, edi
mov dword [esp + 0xc], ecx
jne 0x40eb86
mov eax, dword [esp + 0x14]
xor ecx, ecx
and eax, 3
cmp eax, 1
je 0x40ebed
cmp eax, 2
je 0x40ebe4
cmp eax, 3
je 0x40ebdd
jmp 0x40ec0b
movzx ecx, byte [esi + 2]
shl ecx, 0x10
movzx ebx, byte [esi + 1]
shl ebx, 8
xor ecx, ebx
movzx edi, byte [esi]
xor ecx, edi
imul edx, ecx, 0xcc9e2d51
mov ecx, edx
rol edx, 0xf
mov ecx, edx
imul eax, ecx, 0x1b873593
mov ecx, eax
xor dword [esp + 0xc], ecx
mov ecx, dword [esp + 0x14]
mov edi, dword [esp + 8]
xor dword [esp + 0xc], ecx
mov bx, word [esp + 0xe]
and ebx, 0xffff
xor ebx, dword [esp + 0xc]
imul esi, ebx, 0x85ebca6b
mov ebx, dword [esp]
mov dword [esp + 0xc], esi
shr esi, 0xd
xor esi, dword [esp + 0xc]
imul edx, esi, 0xc2b2ae35
mov esi, dword [esp + 4]
mov dword [esp + 0xc], edx
mov ax, word [esp + 0xe]
and eax, 0xffff
xor dword [esp + 0xc], eax
mov eax, dword [esp + 0xc]
add esp, 0x10
ret 8

Function at 0x40fbec
Capabilities:
Encode data using xor

Disassembly:
push ebx
xor ebx, ebx
lea eax, [esp + 8]
call fcn.0040f238
xor al, 1
je 0x40fc13
inc ebx
lea eax, [esp + 8]
call fcn.0040f2b8
lea eax, [esp + 8]
call fcn.0040f238
xor al, 1
jne 0x40fbfc
mov eax, ebx
pop ebx
ret 0x20
Function at 0x4118c8
Capabilities:
Encode data using xor

Disassembly:
push ebx
xor ebx, ebx
lea eax, [esp + 8]
call fcn.00410ea0
xor al, 1
je 0x4118ef
inc ebx
lea eax, [esp + 8]
call fcn.00410eb0
lea eax, [esp + 8]
call fcn.00410ea0
xor al, 1
jne 0x4118d8
mov eax, ebx
pop ebx
ret 0x70

Function at 0x411934
Capabilities:
Encode data using xor

Disassembly:
push ebx
mov ebx, eax
lea eax, [esp + 8]
call fcn.00410ea0
xor al, 1
je 0x41196b
lea eax, [esp + 8]
call fcn.00410ea8
push eax
mov eax, ebx
call fcn.0040b998
lea eax, [esp + 8]
call fcn.00410eb0
lea eax, [esp + 8]
call fcn.00410ea0
xor al, 1
jne 0x411944
pop ebx
ret 0x70

Function at 0x414240
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x20
call fcn.004142a4
mov dword [esp], eax
lea eax, [esp + 0x10]
push eax
lea eax, [esp + 0x28]
call fcn.00413d48
lea eax, [esp + 0x10]
call fcn.00413d60
xor al, 1
je 0x414293
lea eax, [esp + 0x10]
call fcn.00413da8
push dword [eax + 4]
push dword [eax]
lea eax, [esp + 8]
call fcn.00414634
lea eax, [esp + 0x10]
call fcn.00413d70
lea eax, [esp + 0x10]
call fcn.00413d60
xor al, 1
jne 0x414266
lea eax, [esp]
call fcn.00414420
add esp, 0x20
ret 0x10
Function at 0x420154
Capabilities:
Get file attributes

Disassembly:
push eax
push eax
call sub.KERNEL32.DLL_GetFileAttributesW
pop ecx
ret

Function at 0x420dc0
Capabilities:
Encode data using xor

Disassembly:
push ebx
mov ebx, eax
lea eax, [esp + 8]
call fcn.00420ae4
xor al, 1
je 0x420dfb
push dword [esp + 0xc]
push dword [esp + 0xc]
call fcn.00420af0
push eax
mov eax, ebx
call fcn.00409154
lea eax, [esp + 8]
call fcn.00420cc8
lea eax, [esp + 8]
call fcn.00420ae4
xor al, 1
jne 0x420dd0
pop ebx
ret 8
Function at 0x42b920
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x18
mov dword [esp], ebx
mov ebx, dword [esp + 0x20]
mov dword [esp + 4], esi
mov ecx, dword [eax]
cmp byte [ecx + 0x64], 0
je 0x42b98d
mov eax, dword [esp + 0x1c]
call fcn.00458bd0
mov dword [esp + 0x10], eax
lea eax, [esp + 8]
mov dword [esp + 0x14], edx
mov edx, dword [esp + 0x10]
mov esi, dword [esp + 0x14]
mov dword [esp + 8], edx
mov dword [esp + 0xc], esi
call fcn.00458d88
xor al, 1
je 0x42b998
lea eax, [esp + 8]
call fcn.00458d04
push eax
mov eax, ebx
call fcn.0042c9e0
lea eax, [esp + 8]
call fcn.00458dc0
lea eax, [esp + 8]
call fcn.00458d88
xor al, 1
jne 0x42b964
jmp 0x42b998
push dword [esp + 0x1c]
mov eax, ebx
call fcn.0042ca00
mov ebx, dword [esp]
mov esi, dword [esp + 4]
add esp, 0x18
ret 8
Function at 0x42c614
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x20
lea ecx, [esp + 4]
mov dword [esp], ebx
xor ebx, ebx
mov dword [esp + 0x1c], eax
push ecx
lea eax, [esp + 0x28]
call fcn.00458288
lea eax, [esp + 4]
call fcn.0045a560
xor al, 1
je 0x42c684
lea eax, [esp + 4]
call fcn.0045a484
mov dword [esp + 0x14], eax
lea eax, [esp + 0x14]
mov dword [esp + 0x18], edx
call fcn.0045a580
push dword [eax]
lea eax, [esp + 0x18]
call fcn.0045a584
push dword [eax]
mov eax, dword [esp + 0x24]
push ebx
call fcn.00458674
mov ebx, eax
lea eax, [esp + 4]
call fcn.0045a550
lea eax, [esp + 4]
call fcn.0045a560
xor al, 1
jne 0x42c63b
lea eax, [esp + 0x24]
call fcn.0042c60c
mov eax, dword [esp + 0x1c]
mov ebx, dword [esp]
add esp, 0x20
ret 8

Function at 0x42c69c
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x20
lea ecx, [esp + 4]
mov dword [esp], ebx
xor ebx, ebx
mov dword [esp + 0x1c], eax
push ecx
lea eax, [esp + 0x28]
call fcn.00458288
lea eax, [esp + 4]
call fcn.0045a560
xor al, 1
je 0x42c718
lea eax, [esp + 4]
call fcn.0045a484
mov dword [esp + 0x14], eax
lea eax, [esp + 0x14]
mov dword [esp + 0x18], edx
call fcn.0045a580
push dword [eax]
mov eax, dword [esp + 0x20]
push ebx
call fcn.00458a20
mov ebx, eax
lea eax, [esp + 0x14]
call fcn.0045a584
push dword [eax]
mov eax, dword [esp + 0x20]
push ebx
call fcn.0045891c
mov ebx, eax
lea eax, [esp + 4]
call fcn.0045a550
lea eax, [esp + 4]
call fcn.0045a560
xor al, 1
jne 0x42c6c3
lea eax, [esp + 0x24]
call fcn.0042c60c
mov eax, dword [esp + 0x1c]
mov ebx, dword [esp]
add esp, 0x20
ret 8

Function at 0x42c8b0
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x20
lea ecx, [esp + 4]
mov dword [esp], ebx
xor ebx, ebx
mov dword [esp + 0x1c], eax
push ecx
lea eax, [esp + 0x28]
call fcn.00458288
lea eax, [esp + 4]
call fcn.0045a560
xor al, 1
je 0x42c92c
lea eax, [esp + 4]
call fcn.0045a484
mov dword [esp + 0x14], eax
lea eax, [esp + 0x14]
mov dword [esp + 0x18], edx
call fcn.0045a580
push dword [eax]
mov eax, dword [esp + 0x20]
push ebx
call fcn.0045891c
mov ebx, eax
lea eax, [esp + 0x14]
call fcn.0045a584
push dword [eax]
mov eax, dword [esp + 0x20]
push ebx
call fcn.00458a20
mov ebx, eax
lea eax, [esp + 4]
call fcn.0045a550
lea eax, [esp + 4]
call fcn.0045a560
xor al, 1
jne 0x42c8d7
push 0xffffffffffffffff
mov eax, dword [esp + 0x20]
push ebx
call fcn.0045891c
lea eax, [esp + 0x24]
call fcn.0042c60c
mov eax, dword [esp + 0x1c]
mov ebx, dword [esp]
add esp, 0x20
ret 8
Function at 0x42e534
Capabilities:
Encode data using xor
Hash data using murmur3

Disassembly:
sub esp, 0x10
mov ecx, dword [esp + 0x18]
mov dword [esp], ebx
mov ebx, dword [esp + 0x18]
mov dword [esp + 4], esi
mov esi, dword [esp + 0x14]
and esi, 0xfffffffc
mov dword [esp + 8], edi
add esi, ecx
cmp ecx, esi
mov dword [esp + 0xc], eax
je 0x42e592
mov ecx, dword [ebx]
add ebx, 4
imul edx, ecx, 0xcc9e2d51
mov ecx, edx
rol edx, 0xf
mov ecx, edx
imul edx, ecx, 0x1b873593
mov ecx, edx
xor dword [esp + 0xc], ecx
mov edx, dword [esp + 0xc]
rol edx, 0xd
lea edx, [edx + edx*4 - 0x19ab949c]
cmp ebx, esi
mov dword [esp + 0xc], edx
jne 0x42e55e
mov eax, dword [esp + 0x14]
xor ecx, ecx
and eax, 3
cmp eax, 1
je 0x42e5be
cmp eax, 2
je 0x42e5b5
cmp eax, 3
je 0x42e5ae
jmp 0x42e5dc
movzx ecx, byte [ebx + 2]
shl ecx, 0x10
movzx esi, byte [ebx + 1]
shl esi, 8
xor ecx, esi
movzx edi, byte [ebx]
xor ecx, edi
imul edx, ecx, 0xcc9e2d51
mov ecx, edx
rol edx, 0xf
mov ecx, edx
imul eax, ecx, 0x1b873593
mov ecx, eax
xor dword [esp + 0xc], ecx
mov ecx, dword [esp + 0x14]
mov edi, dword [esp + 8]
xor dword [esp + 0xc], ecx
mov bx, word [esp + 0xe]
and ebx, 0xffff
xor ebx, dword [esp + 0xc]
imul esi, ebx, 0x85ebca6b
mov ebx, dword [esp]
mov dword [esp + 0xc], esi
shr esi, 0xd
xor esi, dword [esp + 0xc]
imul edx, esi, 0xc2b2ae35
mov esi, dword [esp + 4]
mov dword [esp + 0xc], edx
mov ax, word [esp + 0xe]
and eax, 0xffff
xor dword [esp + 0xc], eax
mov eax, dword [esp + 0xc]
add esp, 0x10
ret 8

Function at 0x42e820
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x54
lea ecx, [esp + 0x38]
mov dword [esp + 0xc], ebx
mov dword [esp + 0x10], esi
mov dword [esp + 0x14], edi
mov dword [esp + 0x50], eax
mov dword [esp + 0x18], 0
mov dword [esp + 0x1c], 0
push ecx
lea eax, [esp + 0x5c]
call fcn.00458288
lea eax, [esp + 0x38]
call fcn.0045a560
xor al, 1
je 0x42e90b
lea eax, [esp + 0x38]
call fcn.0045a484
mov dword [esp + 0x48], eax
lea eax, [esp + 0x48]
mov dword [esp + 0x4c], edx
call fcn.0045a580
mov ebx, dword [eax]
mov ecx, 1
mov dword [esp + 8], ecx
lea edx, [esp + 0x18]
mov edi, 0x4c3110
mov dword [esp + 4], edx
mov dword [esp], edi
call fcn.0044d73c
mov dword [esp + 0x20], eax
mov ecx, dword [esp + 0x20]
lea eax, [esp + 0x48]
mov dword [esp + 0x24], edx
mov edx, dword [esp + 0x24]
lea ecx, [edx + ecx*4]
mov dword [ecx - 4], ebx
call fcn.0045a584
mov esi, dword [eax]
lea edx, [esp + 0x18]
mov dword [esp + 8], 1
mov dword [esp + 4], edx
mov dword [esp], edi
call fcn.0044d73c
mov dword [esp + 0x28], eax
mov ecx, dword [esp + 0x28]
lea eax, [esp + 0x38]
mov dword [esp + 0x2c], edx
mov edx, dword [esp + 0x2c]
lea ecx, [edx + ecx*4]
mov dword [ecx - 4], esi
call fcn.0045a550
lea eax, [esp + 0x38]
call fcn.0045a560
xor al, 1
jne 0x42e862
push dword [esp + 0x1c]
push dword [esp + 0x1c]
mov eax, dword [esp + 0x58]
call fcn.00457048
lea eax, [esp + 0x58]
call fcn.0042c60c
mov eax, dword [esp + 0x50]
mov ebx, dword [esp + 0xc]
mov esi, dword [esp + 0x10]
mov edi, dword [esp + 0x14]
add esp, 0x54
ret 8
Function at 0x430698
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
sub esp, 0x18
mov ecx, dword [esp + 0x1c]
mov edx, dword [esp + 0x20]
mov dword [esp + 4], esi
xor esi, esi
mov dword [esp + 8], ecx
mov dword [esp], ebx
mov dword [esp + 0x10], 0x84222325
mov dword [esp + 0x14], 0xcbf29ce4
mov dword [esp + 0xc], edx
cmp dword [esp + 8], esi
je 0x430708
mov eax, dword [esp + 0x20]
mov ebx, dword [eax + esi*4]
xor ecx, ecx
xor dword [esp + 0x10], ebx
mov ebx, 0x1b3
mov eax, dword [esp + 0x10]
xor dword [esp + 0x14], ecx
mov ecx, 0x100
mov edx, dword [esp + 0x14]
imul ecx, eax
imul edx, ebx
add ecx, edx
mul ebx
add edx, ecx
inc esi
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], edx
cmp esi, dword [esp + 8]
jb 0x4306ca
mov edx, dword [esp + 0x14]
mov eax, dword [esp + 0x10]
mov ebx, dword [esp]
mov esi, dword [esp + 4]
add esp, 0x18
ret 8
Function at 0x43ff10
Capabilities:
Encode data using xor

Disassembly:
push ebx
mov ebx, eax
lea eax, [esp + 8]
call fcn.0043f8f8
xor al, 1
je 0x43ff47
lea eax, [esp + 8]
call fcn.0043f98c
push eax
mov eax, ebx
call fcn.0040abc0
lea eax, [esp + 8]
call fcn.0043f92c
lea eax, [esp + 8]
call fcn.0043f8f8
xor al, 1
jne 0x43ff20
pop ebx
ret 0x14
Function at 0x443b38
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x28
lea eax, [esp + 0x2c]
mov dword [esp], ebx
mov dword [esp + 4], esi
mov dword [esp + 8], edi
call fcn.00449948
test eax, eax
mov dword [esp + 0x14], eax
jne 0x443b6c
mov ebx, dword [esp]
mov esi, dword [esp + 4]
mov edi, dword [esp + 8]
add esp, 0x28
xor eax, eax
xor edx, edx
ret 0xc
lea eax, [esp + 0x28]
call fcn.00443be8
xor ebx, ebx
lea esi, [esp + 0x2c]
mov dword [esp + 0xc], eax
lea edi, [esp + 0x18]
mov dword [esp + 0x10], edx
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
lea eax, [esp + 0x18]
call fcn.0044991c
xor al, 1
je 0x443bcc
lea eax, [esp + 0x18]
call fcn.0044992c
mov ecx, dword [esp + 0x10]
lea edx, [ecx + ebx*4]
mov dword [esp + 0x24], eax
push edx
lea eax, [esp + 0x28]
call fcn.00443244
inc ebx
lea eax, [esp + 0x18]
call fcn.00449924
lea eax, [esp + 0x18]
call fcn.0044991c
xor al, 1
jne 0x443b97
lea eax, [esp + 0x28]
call fcn.00443bf8
mov ebx, dword [esp]
mov esi, dword [esp + 4]
mov edi, dword [esp + 8]
add esp, 0x28
ret 0xc

Function at 0x443d28
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x24
lea eax, [esp + 0x28]
mov dword [esp], ebx
mov dword [esp + 4], esi
call fcn.00443d20
test eax, eax
mov dword [esp + 0x10], eax
jne 0x443d54
mov ebx, dword [esp]
mov esi, dword [esp + 4]
add esp, 0x24
xor eax, eax
xor edx, edx
ret 8
lea eax, [esp + 0x24]
call fcn.00443dd0
mov ecx, dword [esp + 0x28]
mov esi, dword [esp + 0x2c]
mov dword [esp + 8], eax
xor ebx, ebx
lea eax, [esp + 0x18]
mov dword [esp + 0xc], edx
mov dword [esp + 0x18], ecx
mov dword [esp + 0x1c], esi
call fcn.00443c70
xor al, 1
je 0x443db9
lea eax, [esp + 0x18]
call fcn.00443c80
mov edx, dword [esp + 0xc]
lea ecx, [edx + ebx*4]
mov dword [esp + 0x20], eax
push ecx
lea eax, [esp + 0x24]
call fcn.00443244
inc ebx
lea eax, [esp + 0x18]
call fcn.00443c78
lea eax, [esp + 0x18]
call fcn.00443c70
xor al, 1
jne 0x443d84
lea eax, [esp + 0x24]
call fcn.00443de0
mov ebx, dword [esp]
mov esi, dword [esp + 4]
add esp, 0x24
ret 8