joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4237a8
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
push ebx
push edi
push esi
mov ecx, dword [ecx + 4]
mov eax, dword [ecx + 0x3c]
movzx edx, word [ecx + eax + 6]
test edx, edx
je 0x4237f1
add eax, ecx
mov esi, dword [esp + 0x14]
xor ebx, ebx
movzx edi, word [eax + 0x14]
lea edi, [eax + edi + 0x18]
xor eax, eax
test edi, edi
je 0x4237f7
mov ebp, dword [edi + 0xc]
test ebp, ebp
je 0x4237e0
add ebp, ecx
cmp ebp, esi
jbe 0x4237e2
jmp 0x4237e9
xor ebp, ebp
add ebp, dword [edi + 8]
cmp ebp, esi
ja 0x4237f5
inc ebx
add edi, 0x28
cmp ebx, edx
jb 0x4237cd
xor eax, eax
jmp 0x4237f7
mov eax, edi
pop esi
pop edi
pop ebx
pop ebp
ret 4

Function at 0x423898
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x10
mov edi, dword [ebp + 0xc]
test edi, edi
je 0x42397a
mov eax, dword [ecx + 4]
mov ebx, ecx
mov edx, dword [eax + 0x3c]
cmp dword [eax + edx + 0x74], 0
je 0x42397a
cmp word [eax + edx + 0x14], 0x68
jb 0x42397a
mov esi, dword [ebx]
mov ecx, ebx
push dword [eax + edx + 0x78]
call dword [esi + 4]
test eax, eax
je 0x42397a
mov esi, eax
mov eax, dword [ebp + 8]
cmp eax, 0xffff
ja 0x4238f2
mov word [edi], ax
jmp 0x4239a7
mov eax, dword [ebx]
mov ecx, ebx
push dword [esi + 0x20]
call dword [eax + 4]
mov edx, eax
mov eax, dword [esi + 0x18]
lea ecx, [eax*4]
test ecx, ecx
je 0x42397a
mov dword [ebp - 0x18], esi
lea esi, [edx + eax*4]
mov eax, dword [ebp + 8]
mov dword [ebp - 0x10], ebx
mov ebx, edx
mov dword [ebp - 0x14], edx
inc eax
mov dword [ebp - 0x1c], eax
mov edi, esi
mov ecx, dword [ebp - 0x10]
sub edi, ebx
mov eax, edi
shr edi, 0x1f
sar eax, 2
add edi, eax
mov eax, dword [ecx]
and edi, 0x7ffffffe
push dword [ebx + edi*2]
call dword [eax + 4]
mov ecx, dword [ebp + 8]
mov cl, byte [ecx]
test cl, cl
je 0x423958
mov edx, dword [ebp - 0x1c]
cmp cl, byte [eax]
jne 0x42395a
mov cl, byte [edx]
inc eax
inc edx
test cl, cl
jne 0x42394c
xor ecx, ecx
movzx eax, byte [eax]
movzx ecx, cl
lea edi, [ebx + edi*2]
sub ecx, eax
je 0x423986
test ecx, ecx
lea eax, [edi + 4]
cmovle esi, edi
cmovg ebx, eax
xor eax, eax
cmp ebx, esi
jne 0x423921
jmp 0x42397c
xor eax, eax
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret 8
mov ecx, dword [ebp - 0x10]
mov esi, dword [ebp - 0x18]
mov eax, dword [ecx]
push dword [esi + 0x24]
call dword [eax + 4]
sub edi, dword [ebp - 0x14]
mov ecx, dword [ebp + 0xc]
sar edi, 1
movzx eax, word [eax + edi]
add ax, word [esi + 0x10]
mov word [ecx], ax
mov al, 1
jmp 0x42397c
Function at 0x42aad0
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
mov eax, 0x1408
call fcn.004ddd80
mov eax, dword [0x5ce16c]
xor eax, ebp
mov dword [ebp - 0x10], eax
mov eax, dword [0x5cd020]
cmp eax, 0xffffffff
je 0x42ac30
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x42ac30
mov esi, eax
cmp eax, 1
jne 0x42ab1b
push 0
push dword [0x5cd020]
jmp 0x42ac28
lea edi, [ebp - 0x810]
push 0x800
push esi
push edi
call fcn.004e0ad0
add esp, 0xc
mov eax, dword [0x5cd020]
push edi
mov dword [ebp - 0x1414], eax
push eax
call fcn.0043fc80
add esp, 8
push esi
call fcn.004ddd6f
add esp, 4
mov eax, dword [0x5d9e54]
mov ecx, dword [0x5db524]
mov edx, dword fs:[0x2c]
mov ecx, dword [edx + ecx*4]
cmp eax, dword [ecx + 4]
jg 0x42ac45
mov esi, dword [0x5d9e50]
mov ecx, esi
call fcn.0042b050
lea eax, [ebp - 0x1410]
push 0xc00
push 0x5d9250
push eax
call fcn.004e0ad0
add esp, 0xc
push esi
call dword [sym.imp.KERNEL32.dll_ReleaseSRWLockExclusive]
mov esi, 0x100
mov al, 1
nop word cs:[eax + eax]
nop dword [eax]
test al, 1
je 0x42ac20
mov ebx, 0xfffff400
xor eax, eax
lea edi, [ebp - 0x810]
nop word cs:[eax + eax]
nop dword [eax + eax]
mov ecx, dword [edi]
test ecx, ecx
je 0x42ac10
cmp dword [ebp + ebx - 0x810], 0
je 0x42ac10
mov edx, dword [edi + 4]
cmp edx, dword [ebp + ebx - 0x808]
jne 0x42ac10
mov edx, dword [ebp + ebx - 0x80c]
test edx, edx
je 0x42ac10
mov dword [edi], 0
push ecx
call edx
add esp, 4
mov al, 1
nop word cs:[eax + eax]
nop
add edi, 8
add ebx, 0xc
jne 0x42abd0
cmp esi, 2
lea esi, [esi - 1]
jae 0x42abb0
push 1
push dword [ebp - 0x1414]
call fcn.0043fc80
add esp, 8
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004dd9ae
add esp, 0x1408
pop esi
pop edi
pop ebx
pop ebp
ret
push 0x5d9e54
call fcn.004dd8ba
add esp, 4
mov eax, dword [0x5d9e54]
cmp eax, 0xffffffff
jne 0x42ab6f
push 4
call fcn.004dd435
add esp, 4
mov ecx, eax
mov esi, eax
call fcn.0040d2f0
mov dword [0x5d9e50], esi
push 0x5d9e54
call fcn.004dd870
add esp, 4
jmp 0x42ab6f
Function at 0x42acb0
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
mov eax, dword [0x5cd020]
mov esi, ecx
cmp eax, 0xffffffff
je 0x42accd
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
jne 0x42acd2
call fcn.0042add0
mov eax, dword [0x5d9e54]
mov ecx, dword [0x5db524]
mov edx, dword fs:[0x2c]
mov ecx, dword [edx + ecx*4]
cmp eax, dword [ecx + 4]
jg 0x42ad7a
mov edi, dword [0x5d9e50]
mov ecx, edi
call fcn.0042b050
mov eax, dword [0x5d924c]
xor ecx, ecx
inc eax
nop dword [eax + eax]
lea edx, [eax + ecx]
movzx edx, dl
lea ebx, [edx + edx*2]
cmp dword [ebx*4 + 0x5d9250], 0
je 0x42ad2e
inc ecx
cmp ecx, 0xff
jbe 0x42ad10
jmp 0x42ad5e
mov ecx, dword [ebp + 8]
lea eax, [ebx*4 + 0x5d9250]
mov dword [0x5d924c], edx
mov dword [eax], 1
lea eax, [edx*4]
mov dword [eax + eax*2 + 0x5d9254], ecx
mov dword [esi], edx
mov eax, dword [eax + eax*2 + 0x5d9258]
mov dword [esi + 4], eax
push edi
call dword [sym.imp.KERNEL32.dll_ReleaseSRWLockExclusive]
mov eax, dword [esi]
cmp eax, 0xffffffff
je 0x42adc0
cmp eax, 0x100
jge 0x42adc5
pop esi
pop edi
pop ebx
pop ebp
ret 4
push 0x5d9e54
call fcn.004dd8ba
add esp, 4
mov eax, dword [0x5d9e54]
cmp eax, 0xffffffff
jne 0x42acf3
push 4
call fcn.004dd435
add esp, 4
mov ecx, eax
mov edi, eax
call fcn.0040d2f0
mov dword [0x5d9e50], edi
push 0x5d9e54
call fcn.004dd870
add esp, 4
jmp 0x42acf3
int3
int3

Function at 0x42add0
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
sub esp, 0x808
mov eax, dword [0x5ce16c]
xor eax, ebp
mov dword [ebp - 0xc], eax
mov eax, dword [0x5cd020]
cmp eax, 0xffffffff
mov dword [ebp - 0x810], eax
jne 0x42ae6e
lea esi, [ebp - 0x810]
push esi
call fcn.0043fc50
add esp, 4
test al, al
je 0x42aee6
mov ecx, dword [ebp - 0x810]
cmp ecx, 0xffffffff
jne 0x42ae45
push esi
call fcn.0043fc50
add esp, 4
test al, al
je 0x42aeeb
cmp dword [ebp - 0x810], 0xffffffff
je 0x42aeeb
push 0xffffffffffffffff
call fcn.0043fc70
add esp, 4
mov ecx, dword [ebp - 0x810]
mov eax, 0xffffffff
lock cmpxchg dword [0x5cd020], ecx
mov eax, dword [ebp - 0x810]
je 0x42ae6e
push eax
call fcn.0043fc70
add esp, 4
mov eax, dword [0x5cd020]
mov dword [ebp - 0x810], eax
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
jne 0x42aee1
lea edi, [ebp - 0x80c]
push 0x800
push 0
push edi
call fcn.004e15d0
add esp, 0xc
push edi
push dword [ebp - 0x810]
call fcn.0043fc80
add esp, 8
push 0x800
call fcn.004ddd74
add esp, 4
mov esi, eax
push 0x800
push edi
push eax
call fcn.004e0ad0
add esp, 0xc
push esi
push dword [ebp - 0x810]
call fcn.0043fc80
add esp, 8
mov ecx, dword [ebp - 0xc]
xor ecx, ebp
call fcn.004dd9ae
mov eax, esi
add esp, 0x808
pop esi
pop edi
pop ebp
ret
int3
int3
int3
Function at 0x42b0b0
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [esp + 8]
test eax, eax
js 0x42b0bd
jmp 0x43fcc0
xor eax, eax
ret
push ebp
push ebx
push edi
push esi
push eax
mov edx, dword [esp + 0x18]
xor ecx, ecx
test edx, edx
je 0x43fd9f
mov eax, dword [esp + 0x1c]
test eax, eax
jle 0x43fd9f
mov edi, eax
mov esi, eax
and edi, 3
shr esi, 2
je 0x43fd25
mov ecx, eax
mov ebx, edx
and ecx, 0xfffffffc
mov dword [esp], ecx
nop word cs:[eax + eax]
nop
movzx ebp, word [ebx]
add ebp, eax
movzx eax, word [ebx + 2]
add ebx, 4
mov ecx, ebp
shl ecx, 0x10
xor ecx, ebp
shl eax, 0xb
xor ecx, eax
mov eax, ecx
shr eax, 0xb
add eax, ecx
dec esi
jg 0x43fd00
add edx, dword [esp]
cmp edi, 1
je 0x43fd4e
cmp edi, 2
je 0x43fd60
cmp edi, 3
jne 0x43fd73
movzx ecx, word [edx]
add eax, ecx
movsx ecx, byte [edx + 2]
shl ecx, 0x12
xor ecx, eax
shl eax, 0x10
xor ecx, eax
mov eax, ecx
shr eax, 0xb
jmp 0x43fd71
movsx ecx, byte [edx]
add eax, ecx
mov ecx, eax
shl ecx, 0xa
xor ecx, eax
mov eax, ecx
shr eax, 1
jmp 0x43fd71
movzx ecx, word [edx]
add eax, ecx
mov ecx, eax
shl ecx, 0xb
xor ecx, eax
mov eax, ecx
shr eax, 0x11
add eax, ecx
lea ecx, [eax*8]
xor ecx, eax
mov eax, ecx
shr eax, 5
add eax, ecx
mov ecx, eax
shl ecx, 4
xor ecx, eax
mov eax, ecx
shr eax, 0x11
add eax, ecx
mov edx, eax
shl edx, 0x19
xor edx, eax
mov ecx, edx
shr ecx, 6
add ecx, edx
mov eax, ecx
add esp, 4
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x42b5d0
Capabilities:
Check for time delay via queryperformancecounter
Execute anti-debugging instructions

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x38
mov eax, dword [0x5ce16c]
xorpd xmm0, xmm0
xor eax, ebp
mov dword [esp + 0x30], eax
movsd xmm1, qword [0x5d9e70]
ucomisd xmm1, xmm0
jne 0x42b754
jp 0x42b754
mov edi, dword [sym.imp.KERNEL32.dll_GetCurrentThread]
call edi
push eax
call dword [sym.imp.KERNEL32.dll_GetThreadPriority]
mov dword [esp + 0xc], eax
call edi
push 2
push eax
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
mov eax, dword [0x5d9e80]
mov ecx, dword [0x5db524]
mov edx, dword fs:[0x2c]
mov ecx, dword [edx + ecx*4]
cmp eax, dword [ecx + 4]
jg 0x42b779
mov eax, dword [0x5d9e90]
mov ecx, dword [0x5db524]
mov edx, dword fs:[0x2c]
mov ecx, dword [edx + ecx*4]
cmp eax, dword [ecx + 4]
jg 0x42b7b3
rdtsc
lea esi, [esp + 0x28]
mov dword [esp + 0x2c], 0
mov dword [esp + 0x28], 0
mov dword [esp + 8], eax
mov dword [esp + 4], edx
push esi
call dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov edi, dword [esp + 0x28]
mov ebx, dword [esp + 0x2c]
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
push dword [esp + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
mov dword [esp + 0x2c], 0
mov dword [esp + 0x28], 0
push esi
call dword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
sub edi, dword [0x5d9e88]
movsd xmm2, qword [0x567510]
sbb ebx, dword [0x5d9e8c]
movd xmm1, edi
fild qword [esp + 0x28]
fstp qword [esp + 0x20]
movd xmm0, ebx
punpckldq xmm1, xmm0
punpckldq xmm1, xmmword [0x5674f0]
subpd xmm1, xmmword [0x567500]
movapd xmm0, xmm1
unpckhpd xmm0, xmm1
addpd xmm0, xmm1
xorpd xmm1, xmm1
divsd xmm0, qword [esp + 0x20]
ucomisd xmm2, xmm0
ja 0x42b754
mov eax, dword [esp + 8]
mov ecx, dword [esp + 4]
sub eax, dword [0x5d9e78]
sbb ecx, dword [0x5d9e7c]
movd xmm2, eax
movd xmm1, ecx
punpckldq xmm2, xmm1
punpckldq xmm2, xmmword [0x5674f0]
subpd xmm2, xmmword [0x567500]
movapd xmm1, xmm2
unpckhpd xmm1, xmm2
addpd xmm1, xmm2
divsd xmm1, xmm0
movsd qword [0x5d9e70], xmm1
movsd qword [esp + 0x18], xmm1
fld qword [esp + 0x18]
fstp xword [esp + 0xc]
mov ecx, dword [esp + 0x30]
xor ecx, ebp
call fcn.004dd9ae
fld xword [esp + 0xc]
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
push 0x5d9e80
call fcn.004dd8ba
add esp, 4
mov eax, dword [0x5d9e80]
cmp eax, 0xffffffff
jne 0x42b642
rdtsc
mov dword [0x5d9e7c], edx
mov dword [0x5d9e78], eax
push 0x5d9e80
call fcn.004dd870
add esp, 4
jmp 0x42b642
push 0x5d9e90
call fcn.004dd8ba
add esp, 4
mov eax, dword [0x5d9e90]
cmp eax, 0xffffffff
jne 0x42b663
lea eax, [esp + 0x28]
mov dword [esp + 0x2c], 0
mov dword [esp + 0x28], 0
push eax
call dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
movsd xmm0, qword [esp + 0x28]
movsd qword [0x5d9e88], xmm0
push 0x5d9e90
call fcn.004dd870
add esp, 4
jmp 0x42b663
Function at 0x42d280
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x14
mov esi, dword [ebp + 0xc]
mov eax, dword [esi + 0x10]
cmp dword [esi + 0x14], 0xf
mov dword [ebp - 0x10], eax
jbe 0x42d29a
mov esi, dword [esi]
cmp dword [ebp - 0x10], 0
mov eax, 0x811c9dc5
mov dword [ebp - 0x14], esi
je 0x42d2bf
mov edx, dword [ebp - 0x10]
nop dword [eax + eax]
movzx edi, byte [esi]
inc esi
xor edi, eax
imul eax, edi, 0x1000193
dec edx
jne 0x42d2b0
and eax, dword [ecx + 0x18]
mov esi, dword [ecx + 4]
mov ecx, dword [ecx + 0xc]
mov dword [ebp - 0x20], ecx
mov ecx, dword [ecx + eax*8]
lea eax, [eax + eax + 1]
mov dword [ebp - 0x1c], eax
mov edi, ecx
mov dword [ebp - 0x18], ecx
cmp ecx, esi
jne 0x42d2e6
jmp 0x42d300
mov edi, dword [edi]
cmp ecx, esi
je 0x42d300
mov eax, dword [ebp - 0x20]
mov edx, dword [ebp - 0x1c]
mov eax, dword [eax + edx*4]
mov eax, dword [eax]
cmp eax, edi
jne 0x42d306
jmp 0x42d34c
mov eax, esi
cmp eax, edi
je 0x42d34c
mov eax, dword [ebp - 0x10]
cmp dword [edi + 0x18], eax
jne 0x42d2e0
cmp dword [edi + 0x1c], 0xf
jbe 0x42d320
mov ebx, dword [edi + 8]
jmp 0x42d323
lea ebx, [edi + 8]
push dword [ebp - 0x10]
push dword [ebp - 0x14]
push ebx
call fcn.004deeb5
add esp, 0xc
mov ecx, dword [ebp - 0x18]
test eax, eax
jne 0x42d2e0
push dword [ebp - 0x10]
push ebx
push dword [ebp - 0x14]
call fcn.004deeb5
add esp, 0xc
test eax, eax
je 0x42d35b
mov eax, dword [ebp + 8]
mov dword [eax], esi
add esp, 0x14
pop esi
pop edi
pop ebx
pop ebp
ret 8
mov eax, dword [ebp + 8]
mov dword [eax], edi
jmp 0x42d351

Function at 0x430270
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
push ebx
push edi
push esi
mov ebp, dword [ecx]
mov edx, dword [ecx + 4]
sub edx, ebp
je 0x4302e6
sar edx, 2
xor esi, esi
mov ebx, edx
nop word cs:[eax + eax]
nop
mov edi, dword [ebp + esi*4]
inc esi
mov eax, edi
xor eax, ebx
shr ebx, 8
movzx eax, al
xor ebx, dword [eax*4 + 0x567734]
mov eax, edi
shr eax, 8
xor eax, ebx
shr ebx, 8
movzx eax, al
xor ebx, dword [eax*4 + 0x567734]
mov eax, edi
shr edi, 0x18
shr eax, 0x10
xor eax, ebx
shr ebx, 8
movzx eax, al
xor ebx, dword [eax*4 + 0x567734]
movzx eax, bl
shr ebx, 8
xor edi, eax
xor ebx, dword [edi*4 + 0x567734]
cmp esi, edx
jb 0x430290
jmp 0x4302e8
xor ebx, ebx
cmp ebx, dword [ecx + 0xc]
sete al
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x430300
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
push ebx
push edi
push esi
mov ebp, dword [ecx]
mov edx, dword [ecx + 4]
sub edx, ebp
je 0x430376
sar edx, 2
xor esi, esi
mov ebx, edx
nop word cs:[eax + eax]
nop
mov edi, dword [ebp + esi*4]
inc esi
mov eax, edi
xor eax, ebx
shr ebx, 8
movzx eax, al
xor ebx, dword [eax*4 + 0x567734]
mov eax, edi
shr eax, 8
xor eax, ebx
shr ebx, 8
movzx eax, al
xor ebx, dword [eax*4 + 0x567734]
mov eax, edi
shr edi, 0x18
shr eax, 0x10
xor eax, ebx
shr ebx, 8
movzx eax, al
xor ebx, dword [eax*4 + 0x567734]
movzx eax, bl
shr ebx, 8
xor edi, eax
xor ebx, dword [edi*4 + 0x567734]
cmp esi, edx
jb 0x430320
jmp 0x430378
xor ebx, ebx
mov dword [ecx + 0xc], ebx
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x433bc0
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x20
mov eax, dword [0x5ce16c]
mov esi, dword [ebp + 8]
mov edi, ecx
xor eax, ebp
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x18], edi
movzx eax, byte [esi]
movzx edx, byte [esi + 1]
xor eax, 0x811c9dc5
imul eax, eax, 0x1000193
xor edx, eax
imul eax, edx, 0x1000193
movzx edx, byte [esi + 2]
xor edx, eax
imul eax, edx, 0x1000193
movzx edx, byte [esi + 3]
xor edx, eax
mov eax, dword [ecx + 0xc]
imul edx, edx, 0x1000193
and edx, dword [ecx + 0x18]
mov dword [ebp - 0x24], eax
mov ecx, dword [eax + edx*8]
lea ebx, [edx + edx + 1]
mov edx, dword [esi]
mov esi, dword [edi + 4]
xor edi, edi
mov dword [ebp - 0x20], ebx
mov ebx, ecx
mov dword [ebp - 0x28], edx
jmp 0x433c32
mov ebx, dword [ebx]
mov eax, esi
cmp ecx, esi
mov esi, ecx
je 0x433c45
mov edx, dword [ebp - 0x24]
mov esi, dword [ebp - 0x20]
mov edx, dword [edx + esi*4]
mov esi, dword [edx]
cmp esi, ebx
je 0x433ca2
mov edx, dword [ebp - 0x28]
mov esi, eax
cmp dword [ebx + 8], edx
jne 0x433c30
mov al, 1
mov dword [ebp - 0x2c], ecx
mov dword [ebp - 0x1c], eax
mov eax, ebx
jmp 0x433c64
mov edx, dword [edx]
mov eax, edx
cmp ecx, esi
mov edx, ecx
je 0x433c78
mov edx, dword [ebp - 0x24]
mov ecx, dword [ebp - 0x20]
mov edx, dword [edx + ecx*4]
mov ecx, dword [ebp - 0x2c]
mov edx, dword [edx]
cmp edx, eax
mov edx, eax
je 0x433c86
mov eax, dword [ebp - 0x28]
cmp eax, dword [edx + 8]
je 0x433c60
cmp ebx, edx
je 0x433caf
xor edi, edi
mov eax, ebx
nop
mov eax, dword [eax]
inc edi
cmp edx, eax
jne 0x433c90
mov eax, ebx
mov dword [ebp - 0x1c], 0
jmp 0x433cb5
mov cl, 1
mov esi, eax
mov ebx, eax
mov edx, eax
mov dword [ebp - 0x1c], ecx
jmp 0x433cb5
mov ebx, esi
mov edx, esi
mov eax, esi
mov ecx, dword [ebp - 0x18]
cmp dword [esi], eax
jne 0x433cc7
cmp edx, esi
jne 0x433cc7
call fcn.00435ae0
jmp 0x433ce9
cmp byte [ebp - 0x1c], 0
jne 0x433ce9
nop dword [eax]
mov ebx, dword [ebx]
push eax
lea eax, [ebp - 0x14]
push eax
mov esi, edx
call fcn.00437d80
mov ecx, dword [ebp - 0x18]
mov edx, esi
cmp esi, ebx
mov eax, ebx
jne 0x433cd0
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004dd9ae
mov eax, edi
add esp, 0x20
pop esi
pop edi
pop ebx
pop ebp
ret 4
Function at 0x437a20
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 8
mov esi, dword [ebp + 0xc]
mov dword [ebp - 0x10], ecx
movzx eax, byte [esi]
movzx edx, byte [esi + 1]
xor eax, 0x811c9dc5
imul eax, eax, 0x1000193
xor edx, eax
imul eax, edx, 0x1000193
movzx edx, byte [esi + 2]
xor edx, eax
imul eax, edx, 0x1000193
movzx edx, byte [esi + 3]
mov esi, dword [esi]
xor edx, eax
imul eax, edx, 0x1000193
mov edx, dword [ecx + 0xc]
and eax, dword [ecx + 0x18]
mov ebx, dword [edx + eax*8]
lea eax, [eax + eax + 1]
mov dword [ebp - 0x14], eax
mov eax, dword [ecx + 4]
mov ecx, ebx
jmp 0x437a82
mov ecx, dword [ecx]
cmp ebx, eax
mov edi, ebx
je 0x437a90
mov edi, dword [ebp - 0x14]
mov edi, dword [edx + edi*4]
mov edi, dword [edi]
cmp edi, ecx
je 0x437aa8
cmp dword [ecx + 8], esi
jne 0x437a80
cmp ecx, eax
je 0x437aa8
mov eax, dword [ebp + 8]
mov dword [eax], ecx
mov byte [eax + 4], 0
jmp 0x437b03
mov edi, dword [eax]
mov ebx, dword [edi + 4]
push 0x10
call fcn.004dd435
add esp, 4
test edi, edi
mov ecx, edi
cmove ecx, eax
mov dword [eax], ecx
mov ecx, ebx
cmove ecx, eax
mov dword [eax + 4], ecx
mov ecx, dword [ebp + 0xc]
mov ecx, dword [ecx]
mov dword [eax + 8], ecx
mov ecx, dword [ebp - 0x10]
mov dword [eax + 0xc], 0
mov edx, dword [ecx + 8]
cmp edx, 0xffffffe
je 0x437b0d
inc edx
mov dword [ecx + 8], edx
mov dword [edi + 4], eax
mov dword [ebx], eax
mov eax, dword [ecx + 4]
mov eax, dword [eax]
push eax
add eax, 8
push eax
mov esi, dword [ebp + 8]
push esi
call fcn.00437b20
mov eax, esi
add esp, 8
pop esi
pop edi
pop ebx
pop ebp
ret 8
push str.list_T__too_long
call fcn.004c951a
int3
Function at 0x437d80
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
push eax
mov edi, dword [ebp + 0xc]
mov esi, dword [ecx + 0xc]
movzx eax, byte [edi + 8]
movzx edx, byte [edi + 9]
xor eax, 0x811c9dc5
imul eax, eax, 0x1000193
xor edx, eax
imul eax, edx, 0x1000193
movzx edx, byte [edi + 0xa]
xor edx, eax
imul eax, edx, 0x1000193
movzx edx, byte [edi + 0xb]
xor edx, eax
imul edx, edx, 0x1000193
and edx, dword [ecx + 0x18]
lea ebx, [edx + edx]
lea eax, [esi + edx*8]
mov dword [ebp - 0x10], eax
cmp dword [esi + ebx*4 + 4], edi
mov eax, dword [esi + edx*8]
je 0x437de0
cmp eax, edi
jne 0x437e08
mov esi, dword [ebp - 0x10]
mov edx, edi
jmp 0x437e04
cmp eax, edi
je 0x437ded
lea esi, [esi + ebx*4 + 4]
lea edx, [edi + 4]
jmp 0x437e04
mov eax, dword [ecx + 4]
mov esi, dword [ebp - 0x10]
mov dword [esi], eax
lea esi, [edx + edx + 1]
lea edx, [ecx + 4]
shl esi, 2
add esi, dword [ecx + 0xc]
mov esi, esi
mov eax, dword [edx]
mov dword [esi], eax
mov ebx, dword [edi]
mov eax, dword [edi + 4]
mov dword [eax], ebx
mov eax, dword [edi]
mov edx, dword [edi + 4]
mov dword [eax + 4], edx
dec dword [ecx + 8]
mov eax, dword [edi + 0xc]
test eax, eax
je 0x437e36
lock dec dword [eax + 4]
jne 0x437e36
add eax, 4
add eax, 0xfffffffc
push eax
call fcn.00433860
add esp, 4
push 0x10
push edi
call fcn.004dd465
add esp, 8
mov eax, dword [ebp + 8]
mov dword [eax], ebx
add esp, 4
pop esi
pop edi
pop ebx
pop ebp
ret 8

Function at 0x4381e0
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 8
mov esi, dword [ebp + 0xc]
mov dword [ebp - 0x10], ecx
movzx eax, byte [esi]
movzx edx, byte [esi + 1]
xor eax, 0x811c9dc5
imul eax, eax, 0x1000193
xor edx, eax
imul eax, edx, 0x1000193
movzx edx, byte [esi + 2]
xor edx, eax
imul eax, edx, 0x1000193
movzx edx, byte [esi + 3]
mov esi, dword [esi]
xor edx, eax
imul eax, edx, 0x1000193
mov edx, dword [ecx + 0xc]
and eax, dword [ecx + 0x18]
mov ebx, dword [edx + eax*8]
lea eax, [eax + eax + 1]
mov dword [ebp - 0x14], eax
mov eax, dword [ecx + 4]
mov ecx, ebx
jmp 0x438242
mov ecx, dword [ecx]
cmp ebx, eax
mov edi, ebx
je 0x438250
mov edi, dword [ebp - 0x14]
mov edi, dword [edx + edi*4]
mov edi, dword [edi]
cmp edi, ecx
je 0x438268
cmp dword [ecx + 8], esi
jne 0x438240
cmp ecx, eax
je 0x438268
mov eax, dword [ebp + 8]
mov dword [eax], ecx
mov byte [eax + 4], 0
jmp 0x4382ce
mov edi, dword [eax]
mov ebx, dword [edi + 4]
push 0x24
call fcn.004dd435
add esp, 4
test edi, edi
mov ecx, edi
cmove ecx, eax
mov dword [eax], ecx
mov ecx, ebx
cmove ecx, eax
mov dword [eax + 4], ecx
mov ecx, dword [ebp + 0xc]
mov ecx, dword [ecx]
mov dword [eax + 8], ecx
mov ecx, dword [ebp - 0x10]
mov dword [eax + 0x20], 0xf
mov dword [eax + 0x1c], 0
mov byte [eax + 0xc], 0
mov edx, dword [ecx + 8]
cmp edx, 0x71c71c6
je 0x4382d8
inc edx
mov dword [ecx + 8], edx
mov dword [edi + 4], eax
mov dword [ebx], eax
mov eax, dword [ecx + 4]
mov eax, dword [eax]
push eax
add eax, 8
push eax
mov esi, dword [ebp + 8]
push esi
call fcn.004382f0
mov eax, esi
add esp, 8
pop esi
pop edi
pop ebx
pop ebp
ret 8
push str.list_T__too_long
call fcn.004c951a
int3
Function at 0x438560
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 8
mov esi, dword [ebp + 0xc]
mov dword [ebp - 0x10], ecx
movzx eax, byte [esi]
movzx edx, byte [esi + 1]
xor eax, 0x811c9dc5
imul eax, eax, 0x1000193
xor edx, eax
imul eax, edx, 0x1000193
movzx edx, byte [esi + 2]
xor edx, eax
imul eax, edx, 0x1000193
movzx edx, byte [esi + 3]
mov esi, dword [esi]
xor edx, eax
imul eax, edx, 0x1000193
mov edx, dword [ecx + 0xc]
and eax, dword [ecx + 0x18]
mov ebx, dword [edx + eax*8]
lea eax, [eax + eax + 1]
mov dword [ebp - 0x14], eax
mov eax, dword [ecx + 4]
mov ecx, ebx
jmp 0x4385c2
mov ecx, dword [ecx]
cmp ebx, eax
mov edi, ebx
je 0x4385d0
mov edi, dword [ebp - 0x14]
mov edi, dword [edx + edi*4]
mov edi, dword [edi]
cmp edi, ecx
je 0x4385e8
cmp dword [ecx + 8], esi
jne 0x4385c0
cmp ecx, eax
je 0x4385e8
mov eax, dword [ebp + 8]
mov dword [eax], ecx
mov byte [eax + 4], 0
jmp 0x438658
mov edi, dword [eax]
mov ebx, dword [edi + 4]
push 0x1c
call fcn.004dd435
add esp, 4
test edi, edi
mov ecx, edi
cmove ecx, eax
mov dword [eax], ecx
mov ecx, ebx
cmove ecx, eax
mov dword [eax + 4], ecx
mov ecx, dword [ebp + 0xc]
mov ecx, dword [ecx]
mov dword [eax + 8], ecx
mov ecx, dword [ebp - 0x10]
mov dword [eax + 0x10], 0
mov dword [eax + 0xc], 0
mov dword [eax + 0x18], 0
mov dword [eax + 0x14], 0
mov edx, dword [ecx + 8]
cmp edx, 0x9249248
je 0x438662
inc edx
mov dword [ecx + 8], edx
mov dword [edi + 4], eax
mov dword [ebx], eax
mov eax, dword [ecx + 4]
mov eax, dword [eax]
push eax
add eax, 8
push eax
mov esi, dword [ebp + 8]
push esi
call fcn.00438670
mov eax, esi
add esp, 8
pop esi
pop edi
pop ebx
pop ebp
ret 8
push str.list_T__too_long
call fcn.004c951a
int3