joyce8/EMBER2024-capa huggingface dataset:
Function at 0x421720
Capabilities:
Check if file exists
Get file attributes
Move file

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 8]
call fcn.0041f010
test al, al
jne 0x421747
mov ecx, dword [ebp + 0xc]
call fcn.0041f010
test al, al
jne 0x421747
mov edx, dword [ebp + 0xc]
mov ecx, dword [ebp + 8]
pop ebp
jmp fcn.00420670
xor al, al
pop ebp
ret

Function at 0x421750
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
mov ebx, edx
mov esi, ecx
push edi
test ebx, ebx
je 0x421777
cmp dword [ebx + 0x14], 0x10
mov dword [ebx + 0x10], 0
jb 0x421772
mov eax, dword [ebx]
jmp 0x421774
mov eax, ebx
mov byte [eax], 0
call fcn.0041f010
test al, al
je 0x421789
xor al, al
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov ecx, esi
call fcn.00420440
mov edi, eax
mov dword [ebp - 0xc], edi
test edi, edi
je 0x421780
push 0x10000
call fcn.00466c82
add esp, 4
mov dword [ebp - 8], 0
mov esi, eax
push edi
push 0x10000
push 1
push esi
call fcn.004741b1
mov edi, eax
add esp, 0x10
test edi, edi
je 0x421816
mov eax, dword [ebp + 8]
nop dword [eax]
test ebx, ebx
je 0x4217ec
mov ecx, eax
mov eax, edi
sub ecx, dword [ebp - 8]
cmp ecx, edi
cmovb eax, ecx
mov ecx, ebx
push eax
push esi
call fcn.00404e50
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 8]
sub eax, ecx
cmp eax, edi
jb 0x42182c
push dword [ebp - 0xc]
add ecx, edi
push 0x10000
push 1
push esi
mov dword [ebp - 8], ecx
call fcn.004741b1
mov edi, eax
add esp, 0x10
mov eax, dword [ebp + 8]
test edi, edi
jne 0x4217d0
mov ebx, dword [ebp - 0xc]
push ebx
call fcn.00473810
add esp, 4
test eax, eax
jne 0x42182f
mov byte [ebp - 1], 1
jmp 0x421833
mov ebx, dword [ebp - 0xc]
mov byte [ebp - 1], 0
push ebx
call fcn.004738b1
add esp, 4
test esi, esi
je 0x421849
push esi
call fcn.00466c8b
add esp, 4
mov al, byte [ebp - 1]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x421880
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
push ebp
mov ebp, esp
xor edx, edx
mov ecx, dword [ebp + 8]
pop ebp
jmp fcn.00420300
Function at 0x422270
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x24
mov eax, dword [0x4a00a0]
xor eax, esp
mov dword [esp + 0x20], eax
push ebx
push esi
push edi
mov edi, ecx
cmp dword [edi + 0x38], 0
je 0x4223ab
cmp byte [edi + 0x3d], 0
je 0x4223ab
mov eax, dword [edi]
push 0xffffffffffffffff
call dword [eax + 0xc]
cmp eax, 0xffffffff
jne 0x4222bd
xor al, al
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x20]
xor ecx, esp
call fcn.00466c90
mov esp, ebp
pop ebp
ret
mov ecx, 0xf
mov byte [esp + 0x14], 0
xorps xmm0, xmm0
mov dword [esp + 0x28], ecx
cmp ecx, 0x10
movq qword [esp + 0x14], xmm0
lea eax, [esp + 0x14]
mov dword [esp + 0x24], 8
cmovae eax, dword [esp + 0x14]
mov byte [eax + 8], 0
mov edx, dword [esp + 0x14]
mov ecx, dword [esp + 0x28]
mov eax, dword [edi + 0x38]
lea ebx, [esp + 0x14]
cmp ecx, 0x10
lea esi, [esp + 0x14]
cmovae ebx, edx
cmovae esi, edx
mov eax, dword [eax]
mov dword [esp + 0x10], eax
cmp eax, vtable.std::codecvt_char__char__struct__Mbstatet_.0
jne 0x4223bf
mov dword [esp + 0xc], esi
xor eax, eax
sub eax, 0
je 0x422332
sub eax, 1
je 0x422336
sub eax, 2
je 0x422384
xor bl, bl
jmp 0x422386
mov byte [edi + 0x3d], 0
cmp ecx, 0x10
lea eax, [esp + 0x14]
cmovae eax, edx
sub esi, eax
je 0x422369
push dword [edi + 0x4c]
cmp ecx, 0x10
lea eax, [esp + 0x18]
push esi
cmovae eax, edx
push 1
push eax
call fcn.00472220
mov ecx, dword [esp + 0x38]
add esp, 0x10
mov edx, dword [esp + 0x14]
cmp esi, eax
jne 0x42232e
cmp byte [edi + 0x3d], 0
je 0x422384
test esi, esi
jne 0x4222f4
push esi
push 8
lea ecx, [esp + 0x1c]
call fcn.0040e380
jmp 0x4222ec
mov bl, 1
cmp ecx, 0x10
jb 0x422397
inc ecx
push ecx
push edx
lea ecx, [esp + 0x1c]
call fcn.00405140
mov al, bl
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x20]
xor ecx, esp
call fcn.00466c90
mov esp, ebp
pop ebp
ret
mov ecx, dword [esp + 0x2c]
mov al, 1
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.00466c90
mov esp, ebp
pop ebp
ret
mov ecx, dword [edi + 0x38]
lea eax, [esp + 0xc]
push eax
mov eax, dword [esp + 0x28]
add eax, ebx
push eax
push esi
lea eax, [edi + 0x40]
push eax
mov eax, dword [esp + 0x20]
call dword [eax + 0x20]
mov ecx, dword [esp + 0x28]
mov edx, dword [esp + 0x14]
mov esi, dword [esp + 0xc]
jmp 0x42231f
Function at 0x4238e0
Capabilities:
Check for time delay via queryperformancecounter
Execute anti-debugging instructions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
movsd xmm0, qword [0x4a3180]
xorps xmm1, xmm1
ucomisd xmm0, xmm1
push ebx
push esi
push edi
mov dword [ebp - 4], 0
lahf
test ah, 0x44
jp 0x423a1f
mov esi, dword [sym.imp.KERNEL32.dll_GetCurrentThread]
call esi
push eax
call dword [sym.imp.KERNEL32.dll_GetThreadPriority]
push 2
mov dword [ebp - 4], eax
call esi
push eax
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
mov ecx, dword [0x4a4508]
test cl, 1
jne 0x423947
rdtsc
or ecx, 1
mov dword [0x4a44f8], eax
mov dword [0x4a4508], ecx
mov dword [0x4a44fc], edx
test cl, 2
jne 0x423977
lea eax, [ebp - 0x10]
or ecx, 2
xorps xmm0, xmm0
mov dword [0x4a4508], ecx
push eax
movq qword [ebp - 0x10], xmm0
call dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov eax, dword [ebp - 0x10]
mov dword [0x4a4500], eax
mov eax, dword [ebp - 0xc]
mov dword [0x4a4504], eax
rdtsc
mov edi, eax
xorps xmm0, xmm0
lea eax, [ebp - 0x10]
movq qword [ebp - 0x10], xmm0
push eax
mov ebx, edx
call dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
push dword [ebp - 4]
call esi
push eax
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
lea eax, [ebp - 0x18]
xorps xmm0, xmm0
push eax
movq qword [ebp - 0x18], xmm0
call dword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
mov ecx, dword [ebp - 0x10]
sub ecx, dword [0x4a4500]
mov edx, dword [ebp - 0xc]
sbb edx, dword [0x4a4504]
call fcn.004672e0
mov edx, dword [ebp - 0x14]
movaps xmm1, xmm0
mov ecx, dword [ebp - 0x18]
movsd qword [ebp - 0x10], xmm1
call fcn.00467320
movsd xmm2, qword [ebp - 0x10]
divsd xmm2, xmm0
movsd xmm1, qword [0x49c7b0]
comisd xmm1, xmm2
movsd qword [ebp - 0x10], xmm2
jbe 0x4239fd
xorps xmm0, xmm0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
sub edi, dword [0x4a44f8]
mov ecx, edi
sbb ebx, dword [0x4a44fc]
mov edx, ebx
call fcn.004672e0
divsd xmm0, qword [ebp - 0x10]
movsd qword [0x4a3180], xmm0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x423ea0
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x1c
push ebx
mov ebx, dword [ebp + 8]
push esi
mov dword [esp + 0x10], 0
push edi
mov edi, ecx
mov dword [edi + 4], 0x499f8c
mov dword [edi], 0x499f84
mov dword [edi + 4], 0x499fb0
mov dword [edi + 8], ebx
mov dword [edi + 0xc], 0
mov dword [edi + 0x10], 0
mov eax, dword [ebx + 0x244]
mov dword [edi + 0x14], eax
call fcn.0043a3e0
push dword [eax]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov esi, eax
push 0x14
mov dword [esp + 0x18], esi
call fcn.00466a4b
add esp, 4
mov ecx, eax
push edi
call fcn.00438360
mov edx, dword [esi + 0x5c]
lea ecx, [esi + 0x58]
mov esi, dword [ecx]
mov dword [esp + 0x10], eax
cmp esi, edx
je 0x423f2f
nop dword [eax]
cmp dword [esi], eax
je 0x423f2b
add esi, 4
cmp esi, edx
jne 0x423f20
cmp esi, edx
jne 0x423f39
lea eax, [esp + 0x10]
push eax
call fcn.004115c0
call fcn.0044b940
push dword [eax]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov esi, dword [eax]
test esi, esi
je 0x423f58
mov ecx, 1
lea eax, [esi + 4]
lock xadd dword [eax], ecx
mov eax, dword [0x4a4428]
test eax, eax
jne 0x423f66
call fcn.00449b50
lea ecx, [esp + 0x18]
mov dword [esp + 0x18], 0
push ecx
push ecx
mov ecx, esp
mov byte [esp + 0x24], 1
push str.ThreadLocalEventBuffer
mov dword [ecx], esi
lea ecx, [edi + 4]
push ecx
mov ecx, eax
call fcn.00448e50
lea esi, [ebx + 4]
push esi
call dword [sym.imp.KERNEL32.dll_AcquireSRWLockExclusive]
push dword [esp + 0x14]
lea eax, [esp + 0x18]
push eax
lea eax, [esp + 0x28]
push eax
lea ecx, [ebx + 0x210]
call fcn.00429a00
push esi
call dword [sym.imp.KERNEL32.dll_ReleaseSRWLockExclusive]
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x4243d0
Capabilities:
Allocate thread local storage
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x10
mov dword [esp + 4], 0
push esi
mov esi, ecx
push edi
push 0x20
mov dword [esi], 0x499fa4
mov dword [esi + 4], 0
mov dword [esi + 8], 0
mov dword [esi + 0xc], 0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
mov dword [esi + 0x18], 0
mov dword [esi + 0x1c], 0
mov dword [esi + 0x20], 0
mov dword [esi + 0x24], 0
mov byte [esi + 0x28], 0
mov dword [esi + 0x2c], 0
mov dword [esi + 0x30], 0
mov dword [esi + 0x34], 0
mov dword [esi + 0x38], 0
mov dword [esi + 0x3c], 0
call fcn.00466a4b
add esp, 4
test eax, eax
je 0x424461
mov dword [eax], eax
lea ecx, [eax + 4]
test ecx, ecx
je 0x42446a
mov dword [ecx], eax
lea ecx, [eax + 8]
test ecx, ecx
je 0x424473
mov dword [ecx], eax
mov word [eax + 0xc], 0x101
lea ecx, [esi + 0x58]
mov dword [esi + 0x38], eax
mov dword [esi + 0x54], 0xf
mov dword [esi + 0x50], 0
mov byte [esi + 0x40], 0
call fcn.00427600
lea ecx, [esi + 0x7c]
mov dword [esi + 0x78], 0
push ecx
lea eax, [esp + 0x10]
mov dword [esp + 0x10], 0
push eax
call fcn.00427fb0
lea ecx, [esi + 0x9c]
call fcn.00427600
lea ecx, [esi + 0xbc]
call fcn.00427360
lea ecx, [esi + 0xdc]
call fcn.00427600
mov dword [esi + 0x100], 0
lea ecx, [esi + 0x14c]
mov dword [esi + 0x104], 0
mov dword [esi + 0x108], 0
mov dword [esi + 0x10c], 0
mov dword [esi + 0x110], 0
mov dword [esi + 0x118], 0
mov dword [esi + 0x11c], 0
mov dword [esi + 0x120], 0
mov dword [esi + 0x124], 0
mov dword [esi + 0x13c], 0xf
mov dword [esi + 0x138], 0
mov byte [esi + 0x128], 0
mov dword [esi + 0x140], 1
mov dword [esi + 0x144], 0
mov dword [esi + 0x148], 0
call fcn.00446f40
lea ecx, [esi + 0x1a8]
call fcn.00446f40
mov edi, dword [sym.imp.KERNEL32.dll_TlsAlloc]
mov dword [esi + 0x204], 0
call edi
mov dword [esi + 0x204], eax
cmp eax, 0xffffffff
jne 0x4245a1
mov byte [0], 0
mov dword [esi + 0x208], 0
call edi
mov dword [esi + 0x208], eax
cmp eax, 0xffffffff
jne 0x4245bf
mov byte [0], 0
mov dword [esi + 0x20c], 0
call edi
mov dword [esi + 0x20c], eax
cmp eax, 0xffffffff
jne 0x4245dd
mov byte [0], 0
lea ecx, [esi + 0x210]
call fcn.004275a0
mov dword [esi + 0x230], 0
mov dword [esi + 0x234], 0
mov dword [esi + 0x238], 0
mov dword [esi + 0x23c], 0
mov dword [esi + 0x240], 0
mov dword [esi + 0x244], 0
mov byte [esi + 0x248], 0
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [esi + 0x110], eax
push 0x100
cdq
push 0x1b3
xor edx, 0xcbf29ce4
xor eax, 0x84222325
push edx
push eax
call fcn.00467630
mov ecx, esi
mov dword [esi + 0x108], eax
mov dword [esi + 0x10c], edx
call fcn.00427170
mov ecx, dword [esi + 0x14]
mov dword [esi + 0x14], eax
test ecx, ecx
je 0x424677
mov eax, dword [ecx]
push 1
call dword [eax]
mov eax, dword [0x4a4428]
test eax, eax
jne 0x424685
call fcn.00449b50
lea ecx, [esp + 0x10]
mov dword [esp + 0x10], 0
push ecx
push ecx
mov ecx, esp
mov byte [esp + 0x1c], 1
push str.TraceLog
push esi
mov dword [ecx], 0
mov ecx, eax
call fcn.00448e50
pop edi
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x424a00
Capabilities:
Get thread local storage value

Disassembly:
push ecx
push esi
mov esi, ecx
push edi
mov edi, dword [sym.imp.KERNEL32.dll_TlsGetValue]
push dword [esi + 0x208]
call edi
test eax, eax
jne 0x424aa7
call fcn.0043a3e0
push dword [eax]
call edi
test eax, eax
je 0x424aa7
cmp dword [0x4a440c], 0
je 0x424a42
mov eax, dword [0x4a440c]
test eax, eax
je 0x424a42
call fcn.00445bb0
inc dword [eax + 0x1c]
push dword [esi + 0x204]
call edi
mov edx, eax
test edx, edx
je 0x424a64
mov ecx, dword [edx + 0x14]
cmp ecx, dword [esi + 0x244]
je 0x424a85
mov eax, dword [edx]
mov ecx, edx
push 1
call dword [eax + 4]
push 0x18
call fcn.00466a4b
add esp, 4
mov ecx, eax
push esi
call fcn.00423ea0
push eax
push dword [esi + 0x204]
call fcn.00444640
add esp, 8
cmp dword [0x4a440c], 0
je 0x424aa7
mov eax, dword [0x4a440c]
test eax, eax
je 0x424aa7
call fcn.00445bb0
mov ecx, dword [eax + 0x1c]
test ecx, ecx
je 0x424aa7
dec ecx
mov dword [eax + 0x1c], ecx
pop edi
pop esi
pop ecx
ret
Function at 0x4270b0
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 8
cmp dword [ebp + 0xc], 0
push esi
push edi
mov edi, ecx
mov dword [esp + 0xc], 0
jne 0x4270d5
xor eax, eax
pop edi
pop esi
mov esp, ebp
pop ebp
ret 0xc
push dword [edi + 0x204]
mov esi, dword [sym.imp.KERNEL32.dll_TlsGetValue]
call esi
test eax, eax
je 0x427100
push dword [edi + 0x204]
call esi
push dword [ebp + 0x10]
mov ecx, eax
push dword [ebp + 0xc]
call fcn.00423e40
test eax, eax
jne 0x427162
mov esi, dword [ebp + 8]
test esi, esi
je 0x427119
cmp byte [esi + 4], 0
jne 0x427119
push dword [esi]
call dword [sym.imp.KERNEL32.dll_AcquireSRWLockExclusive]
mov byte [esi + 4], 1
mov ecx, dword [edi + 0x230]
mov edx, dword [ebp + 0x10]
test ecx, ecx
je 0x427156
mov eax, edx
and eax, 0x3ffffff
cmp eax, dword [edi + 0x234]
jne 0x427156
mov eax, dword [ebp + 0xc]
cmp eax, dword [ecx + 0x1e08]
jne 0x4270cb
shr edx, 0x1a
mov eax, edx
shl eax, 4
sub eax, edx
inc eax
lea eax, [ecx + eax*8]
pop edi
pop esi
mov esp, ebp
pop ebp
ret 0xc
mov ecx, dword [edi + 0x14]
push edx
push dword [ebp + 0xc]
mov eax, dword [ecx]
call dword [eax + 0x18]
pop edi
pop esi
mov esp, ebp
pop ebp
ret 0xc

Function at 0x427990
Capabilities:
Allocate thread local storage

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 8
mov eax, dword [0x4a42f0]
mov dword [esp + 4], 0
test eax, 0xfffffffe
jne 0x4279e9
push 0x4a42f0
call int.004445f0
add esp, 4
test al, al
je 0x4279e9
mov dword [0x4a42f4], 0
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
mov dword [0x4a42f4], eax
cmp eax, 0xffffffff
jne 0x4279df
mov byte [0], 0
mov dword [0x4a42f0], 0x4a42f4
mov eax, dword [0x4a42f0]
mov esp, ebp
pop ebp
ret

Function at 0x427b90
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 0xc]
push esi
push edi
mov edi, ecx
movzx eax, byte [ebx]
xor eax, 0x811c9dc5
imul edx, eax, 0x1000193
movzx eax, byte [ebx + 1]
mov esi, dword [edi + 0xc]
xor edx, eax
movzx eax, byte [ebx + 2]
imul edx, edx, 0x1000193
xor edx, eax
movzx eax, byte [ebx + 3]
imul ecx, edx, 0x1000193
mov edx, dword [edi + 4]
xor ecx, eax
imul eax, ecx, 0x1000193
mov ecx, dword [edi + 0x18]
and ecx, eax
mov eax, dword [esi + ecx*8]
add ecx, ecx
mov ebx, dword [esi + ecx*4]
lea edi, [esi + ecx*4]
mov esi, dword [ebp + 0xc]
cmp ebx, edx
jne 0x427bee
mov ecx, edx
jmp 0x427bf3
mov ecx, dword [edi + 4]
mov ecx, dword [ecx]
cmp eax, ecx
je 0x427c42
mov ecx, dword [eax + 8]
cmp ecx, dword [esi]
je 0x427c02
mov eax, dword [eax]
jmp 0x427be6
mov esi, dword [esi]
mov ecx, eax
mov dword [ebp + 0xc], esi
nop dword [eax]
cmp ebx, edx
jne 0x427c18
mov esi, edx
jmp 0x427c1d
mov esi, dword [edi + 4]
mov esi, dword [esi]
cmp eax, esi
je 0x427c2d
mov esi, dword [ebp + 0xc]
cmp esi, dword [eax + 8]
jne 0x427c2d
mov eax, dword [eax]
jmp 0x427c10
cmp ecx, eax
je 0x427c42
mov edx, dword [ebp + 8]
pop edi
pop esi
pop ebx
mov dword [edx + 4], eax
mov eax, edx
mov dword [edx], ecx
pop ebp
ret 8
mov eax, dword [ebp + 8]
pop edi
pop esi
pop ebx
mov dword [eax], edx
mov dword [eax + 4], edx
pop ebp
ret 8
Function at 0x427e80
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
mov esi, ecx
movzx eax, byte [edi]
xor eax, 0x811c9dc5
imul edx, eax, 0x1000193
movzx eax, byte [edi + 1]
xor edx, eax
movzx eax, byte [edi + 2]
imul edx, edx, 0x1000193
xor edx, eax
movzx eax, byte [edi + 3]
imul ecx, edx, 0x1000193
mov edx, dword [esi + 0xc]
xor ecx, eax
imul eax, ecx, 0x1000193
mov ecx, dword [esi + 0x18]
mov esi, dword [esi + 4]
and ecx, eax
mov eax, dword [edx + ecx*8]
add ecx, ecx
mov ebx, dword [edx + ecx*4]
lea edx, [edx + ecx*4]
cmp ebx, esi
jne 0x427edb
mov ecx, esi
jmp 0x427ee0
mov ecx, dword [edx + 4]
mov ecx, dword [ecx]
cmp eax, ecx
je 0x427f05
mov ecx, dword [eax + 8]
cmp ecx, dword [edi]
je 0x427eef
mov eax, dword [eax]
jmp 0x427ed3
mov ecx, dword [edi]
cmp ecx, dword [eax + 8]
mov ecx, dword [ebp + 8]
cmovne eax, esi
pop edi
pop esi
mov dword [ecx], eax
mov eax, ecx
pop ebx
pop ebp
ret 8
mov eax, dword [ebp + 8]
pop edi
mov dword [eax], esi
pop esi
pop ebx
pop ebp
ret 8

Function at 0x4283d0
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
mov ebx, ecx
movzx eax, byte [edi + 8]
xor eax, 0x811c9dc5
imul edx, eax, 0x1000193
movzx eax, byte [edi + 9]
xor edx, eax
movzx eax, byte [edi + 0xa]
imul edx, edx, 0x1000193
xor edx, eax
movzx eax, byte [edi + 0xb]
imul ecx, edx, 0x1000193
xor ecx, eax
imul eax, ecx, 0x1000193
mov ecx, dword [ebx + 0x18]
and ecx, eax
lea edx, [ecx*8]
mov ecx, dword [ebx + 0xc]
add ecx, edx
cmp dword [ecx + 4], edi
jne 0x428441
cmp dword [ecx], edi
jne 0x428439
mov eax, dword [ebx + 4]
mov dword [ecx], eax
mov ecx, dword [ebx + 0xc]
mov eax, dword [ebx + 4]
mov dword [edx + ecx + 4], eax
jmp 0x428449
mov eax, dword [edi + 4]
mov dword [ecx + 4], eax
jmp 0x428449
cmp dword [ecx], edi
jne 0x42844c
mov eax, dword [edi]
mov dword [ecx], eax
mov edi, dword [ebp + 0xc]
mov eax, dword [edi + 4]
mov esi, dword [edi]
push edi
mov dword [eax], esi
mov ecx, dword [edi]
mov eax, dword [edi + 4]
mov dword [ecx + 4], eax
dec dword [ebx + 8]
call fcn.00466a7e
mov eax, dword [ebp + 8]
add esp, 4
pop edi
mov dword [eax], esi
pop esi
pop ebx
pop ebp
ret 8
Function at 0x429a00
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
mov ebx, ecx
movzx eax, byte [edi]
xor eax, 0x811c9dc5
mov esi, dword [ebx + 4]
imul edx, eax, 0x1000193
movzx eax, byte [edi + 1]
xor edx, eax
movzx eax, byte [edi + 2]
imul edx, edx, 0x1000193
xor edx, eax
movzx eax, byte [edi + 3]
imul ecx, edx, 0x1000193
xor ecx, eax
imul eax, ecx, 0x1000193
mov ecx, dword [ebx + 0x18]
and ecx, eax
shl ecx, 3
mov dword [ebp - 8], ecx
add ecx, dword [ebx + 0xc]
mov eax, dword [ecx]
cmp esi, eax
je 0x429a6e
mov esi, dword [ecx + 4]
mov esi, dword [esi]
cmp esi, eax
je 0x429a6e
mov ecx, dword [edi]
mov esi, dword [esi + 4]
cmp ecx, dword [esi + 8]
je 0x429ab8
cmp esi, eax
jne 0x429a62
mov eax, dword [ebx + 4]
push 0xc
mov edi, dword [eax]
mov eax, dword [edi + 4]
mov dword [ebp - 4], eax
call fcn.00466a4b
mov ecx, eax
add esp, 4
test ecx, ecx
je 0x429a8b
mov dword [ecx], edi
lea edx, [ecx + 4]
test edx, edx
je 0x429a97
mov eax, dword [ebp - 4]
mov dword [edx], eax
lea eax, [ecx + 8]
test eax, eax
je 0x429aa6
mov eax, dword [ebp + 0xc]
mov eax, dword [eax]
mov dword [ecx + 8], eax
mov eax, 0x15555554
sub eax, dword [ebx + 8]
cmp eax, 1
jae 0x429aca
jmp 0x429b55
mov eax, dword [ebp + 8]
mov dword [eax], esi
mov byte [eax + 4], 0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
inc dword [ebx + 8]
mov dword [edi + 4], ecx
mov eax, dword [edx]
mov dword [eax], ecx
mov edi, dword [ebx + 4]
mov edi, dword [edi]
mov eax, dword [edi]
cmp esi, eax
je 0x429b00
mov ecx, dword [edi + 4]
mov dword [ecx], eax
mov ecx, dword [eax + 4]
mov dword [ecx], esi
mov ecx, dword [esi + 4]
mov dword [ecx], edi
mov ecx, dword [eax + 4]
mov edx, dword [esi + 4]
mov dword [esi + 4], ecx
mov ecx, dword [edi + 4]
mov dword [eax + 4], ecx
mov dword [edi + 4], edx
mov ecx, dword [ebx + 0xc]
mov edx, dword [ebp - 8]
add ecx, edx
mov eax, dword [ecx]
cmp eax, dword [ebx + 4]
jne 0x429b1a
mov dword [ecx], edi
mov eax, dword [ebx + 0xc]
mov dword [edx + eax + 4], edi
jmp 0x429b3c
cmp eax, esi
jne 0x429b22
mov dword [ecx], edi
jmp 0x429b3c
mov eax, dword [ecx + 4]
mov eax, dword [eax]
mov dword [ecx + 4], eax
cmp eax, edi
je 0x429b3c
mov ecx, dword [ebx + 0xc]
mov eax, dword [ecx + edx + 4]
mov eax, dword [eax + 4]
mov dword [ecx + edx + 4], eax
mov ecx, ebx
call fcn.00429d20
mov eax, dword [ebp + 8]
mov dword [eax], edi
pop edi
pop esi
mov byte [eax + 4], 1
pop ebx
mov esp, ebp
pop ebp
ret 0xc
push str.list_T__too_long
call fcn.004658f9
int3
Function at 0x429ef0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
mov ebx, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 8], ecx
cmp dword [ebx + 0x14], 0x10
mov edi, dword [ebx + 0x10]
mov dword [ebp - 4], edi
jb 0x429f0f
mov esi, dword [ebx]
jmp 0x429f11
mov esi, ebx
xor ecx, ecx
mov edx, 0x811c9dc5
test edi, edi
je 0x429f31
nop dword [eax]
movzx eax, byte [esi + ecx]
inc ecx
xor eax, edx
imul edx, eax, 0x1000193
cmp ecx, edi
jb 0x429f20
mov esi, dword [ebp - 8]
mov eax, dword [esi + 0x18]
mov edi, dword [esi + 4]
and eax, edx
lea edx, [eax*8]
mov eax, dword [esi + 0xc]
add esi, 4
mov dword [ebp - 0x14], edx
mov dword [ebp - 0x10], esi
mov ecx, dword [eax + edx]
mov dword [ebp - 0xc], ecx
cmp edi, ecx
je 0x42a02a
mov edi, dword [eax + edx + 4]
mov edi, dword [edi]
cmp edi, ecx
je 0x42a02a
nop dword [eax + eax]
mov edi, dword [edi + 4]
cmp dword [edi + 0x1c], 0x10
jb 0x429f7e
mov esi, dword [edi + 8]
jmp 0x429f81
lea esi, [edi + 8]
cmp dword [ebx + 0x14], 0x10
jb 0x429f8b
mov edx, dword [ebx]
jmp 0x429f8d
mov edx, ebx
mov ebx, dword [edi + 0x18]
mov eax, ebx
mov ecx, dword [ebp - 4]
cmp ecx, ebx
cmovb eax, ecx
test eax, eax
je 0x429ff6
sub eax, 4
jb 0x429fb4
mov ecx, dword [edx]
cmp ecx, dword [esi]
jne 0x429fb9
add edx, 4
add esi, 4
sub eax, 4
jae 0x429fa3
cmp eax, 0xfffffffc
je 0x429fed
mov cl, byte [edx]
cmp cl, byte [esi]
jne 0x429fe6
cmp eax, 0xfffffffd
je 0x429fed
mov cl, byte [edx + 1]
cmp cl, byte [esi + 1]
jne 0x429fe6
cmp eax, 0xfffffffe
je 0x429fed
mov cl, byte [edx + 2]
cmp cl, byte [esi + 2]
jne 0x429fe6
cmp eax, 0xffffffff
je 0x429fed
mov al, byte [edx + 3]
cmp al, byte [esi + 3]
je 0x429fed
sbb eax, eax
or eax, 1
jmp 0x429fef
xor eax, eax
test eax, eax
jne 0x429ffc
mov ecx, dword [ebp - 4]
cmp ecx, ebx
jb 0x429ffc
jbe 0x42a009
cmp edi, dword [ebp - 0xc]
je 0x42a02a
mov ebx, dword [ebp + 0xc]
jmp 0x429f70
push dword [ebp + 0x10]
mov ecx, dword [ebp - 0x10]
lea eax, [ebp + 0xc]
push eax
call fcn.00429dc0
mov eax, dword [ebp + 8]
mov dword [eax], edi
pop edi
pop esi
mov byte [eax + 4], 0
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov esi, dword [ebp + 0x10]
mov eax, dword [esi]
cmp edi, eax
je 0x42a054
mov ecx, dword [esi + 4]
mov dword [ecx], eax
mov ecx, dword [eax + 4]
mov dword [ecx], edi
mov ecx, dword [edi + 4]
mov dword [ecx], esi
mov ecx, dword [eax + 4]
mov edx, dword [edi + 4]
mov dword [edi + 4], ecx
mov ecx, dword [esi + 4]
mov dword [eax + 4], ecx
mov dword [esi + 4], edx
mov edx, dword [ebp - 8]
mov ebx, dword [ebp - 0x14]
mov ecx, dword [edx + 0xc]
add ecx, ebx
mov eax, dword [ecx]
cmp eax, dword [edx + 4]
jne 0x42a071
mov dword [ecx], esi
mov eax, dword [edx + 0xc]
mov dword [eax + ebx + 4], esi
jmp 0x42a093
cmp eax, edi
jne 0x42a079
mov dword [ecx], esi
jmp 0x42a093
mov eax, dword [ecx + 4]
mov eax, dword [eax]
mov dword [ecx + 4], eax
cmp eax, esi
je 0x42a093
mov ecx, dword [edx + 0xc]
mov eax, dword [ecx + ebx + 4]
mov eax, dword [eax + 4]
mov dword [ecx + ebx + 4], eax
mov ecx, edx
call fcn.00429c80
mov eax, dword [ebp + 8]
pop edi
mov dword [eax], esi
pop esi
mov byte [eax + 4], 1
pop ebx
mov esp, ebp
pop ebp
ret 0xc