joyce8/EMBER2024-capa huggingface dataset:
Function at 0x44a6f0
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x57144b
mov eax, dword fs:[0]
push eax
sub esp, 0xc8
push esi
push edi
mov eax, dword [0x5cc6c0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov edx, dword [ebp + 8]
push 0x57fac4
push edx
mov eax, dword [edx]
call dword [eax + 8]
push eax
call dword [sym.imp.USER32.dll_SetWindowTextW]
push 0
lea ecx, [edi + 0x30]
mov byte [edi + 0x374], 1
call fcn.00493f90
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
call fcn.004674e0
push 1
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
mov ecx, eax
call edx
movzx eax, al
sub eax, 1
jne 0x44a881
push 0x3d
push str.d:jenkins.jenkinsworkspacepcstorepcstoremainmainwnd.cpp
lea ecx, [ebp - 0x3c]
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x28], 0xf
mov byte [ebp - 0x3c], al
call fcn.00406f00
push 3
push 0x57fd94
lea ecx, [ebp - 0x24]
mov dword [ebp - 4], 0
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x10], 0xf
mov byte [ebp - 0x24], 0
call fcn.00406f00
push 0x33
lea eax, [ebp - 0x3c]
mov byte [ebp - 4], 1
push eax
lea eax, [ebp - 0x24]
push eax
lea ecx, [ebp - 0xd4]
call fcn.0040a870
mov esi, eax
push str.WebWndReady
push esi
mov byte [ebp - 4], 2
call fcn.00409440
add esp, 8
call fcn.004674e0
push esi
mov ecx, eax
mov edx, dword [eax]
call dword [edx + 0x1c]
lea ecx, [ebp - 0xd4]
call fcn.0040b790
mov edx, dword [ebp - 0x10]
mov byte [ebp - 4], 0
cmp edx, 0x10
jb 0x44a826
mov ecx, dword [ebp - 0x24]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x44a81c
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x44a8d0
push edx
push ecx
call fcn.004f9e2c
add esp, 8
mov edx, dword [ebp - 0x28]
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x10], 0xf
mov byte [ebp - 0x24], 0
mov dword [ebp - 4], 0xffffffff
cmp edx, 0x10
jb 0x44a86f
mov ecx, dword [ebp - 0x3c]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x44a865
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x44a8d5
push edx
push ecx
call fcn.004f9e2c
add esp, 8
mov dword [ebp - 0x2c], 0
mov dword [ebp - 0x28], 0xf
mov byte [ebp - 0x3c], 0
lea esi, [edi - 0x318]
mov ecx, esi
call fcn.0044d6d0
mov ecx, esi
call fcn.00449650
movzx eax, al
mov ecx, esi
push eax
call fcn.0044d480
push 0
push 0
mov ecx, esi
call fcn.0044cd70
push 0
push 0
mov ecx, esi
call fcn.00443900
mov ecx, esi
call fcn.0044dd60
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4
call fcn.00542930
call fcn.00542930
int3
Function at 0x44d2c0
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5727ab
mov eax, dword fs:[0]
push eax
sub esp, 0xec
mov eax, dword [0x5cc6c0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
lea ecx, [esi + 0x348]
call fcn.00493f90
test eax, eax
jne 0x44d30c
push dword [esi + 4]
lea ecx, [esi + 0x348]
call fcn.00440d40
lea ecx, [esi + 0x348]
call fcn.00493f90
mov edi, eax
xorps xmm0, xmm0
lea eax, [ebp - 0x20]
push eax
push edi
movups xmmword [ebp - 0x20], xmm0
call dword [sym.imp.USER32.dll_GetWindowRect]
mov edx, dword [ebp - 0x14]
sub edx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x18]
sub eax, dword [ebp - 0x20]
push 1
push ecx
mov dword [esp], 0x3f800000
push edx
push eax
lea eax, [ebp - 0x60]
push eax
call fcn.0041a130
add esp, 0x14
mov ecx, esi
movups xmm0, xmmword [eax]
movups xmmword [ebp - 0x20], xmm0
call fcn.00449650
test al, al
je 0x44d395
push edi
call dword [sym.imp.USER32.dll_SetActiveWindow]
mov esi, dword [sym.imp.USER32.dll_SetWindowPos]
push 1
push 0xffffffffffffffff
push 0xffffffffffffffff
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push 0xffffffffffffffff
push edi
call esi
push 3
push 0
push 0
push 0
push 0
push 0
push edi
call esi
push 5
jmp 0x44d44f
call fcn.004674e0
push 1
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
mov ecx, eax
call edx
movzx eax, al
sub eax, 1
jne 0x44d44d
push 0x3d
push str.d:jenkins.jenkinsworkspacepcstorepcstoremainmainwnd.cpp
lea ecx, [ebp - 0x50]
mov dword [ebp - 0x40], eax
mov dword [ebp - 0x3c], 0xf
mov byte [ebp - 0x50], al
call fcn.00406f00
push 3
push 0x57fd94
lea ecx, [ebp - 0x38]
mov dword [ebp - 4], 0
mov dword [ebp - 0x28], 0
mov dword [ebp - 0x24], 0xf
mov byte [ebp - 0x38], 0
call fcn.00406f00
push 0x190
lea eax, [ebp - 0x50]
mov byte [ebp - 4], 1
push eax
lea eax, [ebp - 0x38]
push eax
lea ecx, [ebp - 0xf8]
call fcn.0040a870
mov esi, eax
push str.hide_loading_wnd
push esi
mov byte [ebp - 4], 2
call fcn.00409440
add esp, 8
call fcn.004674e0
push esi
mov ecx, eax
mov edx, dword [eax]
call dword [edx + 0x1c]
lea ecx, [ebp - 0xf8]
call fcn.0040b790
lea ecx, [ebp - 0x38]
call fcn.00406da0
lea ecx, [ebp - 0x50]
call fcn.00406da0
push 0
push edi
call dword [sym.imp.USER32.dll_ShowWindow]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004fa0d4
mov esp, ebp
pop ebp
ret
Function at 0x44d6d0
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x572833
mov eax, dword fs:[0]
push eax
sub esp, 0x7c
mov eax, dword [0x5cc6c0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push 0x30
lea eax, [ebp - 0x58]
push 0
push eax
call fcn.0053f0a0
add esp, 0xc
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov edx, eax
mov dword [ebp - 0x60], 0
mov ecx, edx
mov dword [ebp - 0x5c], 7
xor eax, eax
mov word [ebp - 0x70], ax
lea esi, [ecx + 2]
nop word [eax + eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x44d730
sub ecx, esi
sar ecx, 1
push ecx
push edx
lea ecx, [ebp - 0x70]
call fcn.00406a80
lea eax, [ebp - 0x70]
mov dword [ebp - 4], 0
push eax
lea ecx, [ebp - 0x58]
call fcn.0046b3b0
mov edx, dword [ebp - 0x5c]
mov byte [ebp - 4], 2
cmp edx, 8
jb 0x44d79a
mov ecx, dword [ebp - 0x70]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x44d790
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x44d91f
push edx
push ecx
call fcn.004f9e2c
add esp, 8
xor eax, eax
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 7
mov word [ebp - 0x28], ax
push 4
push str.from
lea ecx, [ebp - 0x88]
mov byte [ebp - 4], 3
mov dword [ebp - 0x78], eax
mov dword [ebp - 0x74], 7
mov word [ebp - 0x88], ax
call fcn.00406a80
lea eax, [ebp - 0x28]
mov byte [ebp - 4], 4
push eax
lea eax, [ebp - 0x88]
push eax
lea ecx, [ebp - 0x58]
call fcn.0046bb00
mov edx, dword [ebp - 0x74]
mov byte [ebp - 4], 3
cmp edx, 8
jb 0x44d82d
mov ecx, dword [ebp - 0x88]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x44d823
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x44d924
push edx
push ecx
call fcn.004f9e2c
add esp, 8
mov esi, dword [ebp - 0x14]
lea eax, [ebp - 0x28]
push 9
push str.startmenu
push dword [ebp - 0x18]
cmp esi, 8
cmovae eax, dword [ebp - 0x28]
push eax
call fcn.00441cf0
add esp, 0x10
test al, al
je 0x44d865
call fcn.0042f1b0
push 0
push 0
push 1
push 0
push str.open_menu
jmp 0x44d8ac
push 7
push str.desktop
push dword [ebp - 0x18]
cmp esi, 8
lea eax, [ebp - 0x28]
cmovae eax, dword [ebp - 0x28]
push eax
call fcn.00441cf0
add esp, 0x10
test al, al
je 0x44d89a
call fcn.0042f1b0
push 0
push 0
push 1
push 0
push str.open_lnk
jmp 0x44d8ac
call fcn.0042f1b0
push 0
push 0
push 1
push 0
push str.show_other
mov ecx, eax
call fcn.00468ca0
mov edx, dword [ebp - 0x14]
cmp edx, 8
jb 0x44d8e9
mov ecx, dword [ebp - 0x28]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x44d8df
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x44d929
push edx
push ecx
call fcn.004f9e2c
add esp, 8
xor eax, eax
mov dword [ebp - 0x18], 0
lea ecx, [ebp - 0x58]
mov dword [ebp - 0x14], 7
mov word [ebp - 0x28], ax
call fcn.0046b5d0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004fa0d4
mov esp, ebp
pop ebp
ret
call fcn.00542930
call fcn.00542930
call fcn.00542930
int3
Function at 0x450900
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x572b70
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
mov eax, dword [0x5cc6c0]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov eax, ecx
mov dword [ebp - 0x18], eax
mov edi, dword [ebp + 0xc]
mov esi, edi
mov ecx, dword [ebp + 8]
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x20], ecx
cmp dword [edi + 0x14], 0x10
mov ebx, dword [edi + 0x10]
mov dword [ebp - 4], 0
jb 0x450953
mov esi, dword [edi]
xor ecx, ecx
mov edx, 0x811c9dc5
test ebx, ebx
je 0x450974
nop
movzx eax, byte [ecx + esi]
inc ecx
xor eax, edx
imul edx, eax, 0x1000193
cmp ecx, ebx
jb 0x450960
mov eax, dword [ebp - 0x18]
mov ecx, dword [eax + 0x18]
mov eax, dword [eax + 0xc]
and ecx, edx
mov esi, dword [ebp - 0x18]
mov dword [ebp - 0x24], ecx
lea eax, [eax + ecx*8]
mov esi, dword [esi + 4]
mov dword [ebp - 0x1c], eax
cmp esi, dword [eax]
je 0x450a20
mov esi, dword [eax + 4]
mov esi, dword [esi]
cmp esi, dword [eax]
je 0x450a20
mov esi, dword [esi + 4]
cmp dword [esi + 0x1c], 0x10
lea eax, [esi + 8]
mov edx, dword [eax + 0x10]
jb 0x4509b1
mov eax, dword [eax]
cmp dword [edi + 0x14], 0x10
mov ecx, edi
jb 0x4509bb
mov ecx, dword [edi]
push edx
push eax
push ebx
push ecx
call fcn.0042baf0
add esp, 0x10
test al, al
mov eax, dword [ebp - 0x1c]
je 0x450998
mov edi, dword [ebp + 0x10]
mov ecx, dword [edi + 4]
mov eax, dword [edi]
mov dword [ecx], eax
mov ecx, dword [edi]
mov eax, dword [edi + 4]
mov dword [ecx + 4], eax
lea ecx, [edi + 8]
mov eax, dword [ebp - 0x18]
dec dword [eax + 8]
call fcn.004422d0
push 0x38
push edi
call fcn.004f9e2c
mov eax, dword [ebp - 0x20]
add esp, 8
mov dword [eax], esi
mov byte [eax + 4], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.004fa0d4
mov esp, ebp
pop ebp
ret 0xc
mov edi, dword [ebp + 0x10]
mov dword [ebp - 0x1c], edi
mov eax, dword [edi]
cmp esi, eax
je 0x450a4d
mov ecx, dword [edi + 4]
mov dword [ecx], eax
mov ecx, dword [eax + 4]
mov dword [ecx], esi
mov ecx, dword [esi + 4]
mov dword [ecx], edi
mov ecx, dword [eax + 4]
mov edx, dword [esi + 4]
mov dword [esi + 4], ecx
mov ecx, dword [edi + 4]
mov dword [eax + 4], ecx
mov dword [edi + 4], edx
push dword [ebp - 0x24]
mov ebx, dword [ebp - 0x18]
mov ecx, ebx
push esi
push edi
call fcn.00440360
mov ecx, ebx
mov dword [ebp - 4], 2
call fcn.00458010
mov eax, dword [ebp - 0x20]
mov dword [eax], edi
mov byte [eax + 4], 1
jmp 0x450a02
Function at 0x450aa0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x572ba0
mov eax, dword fs:[0]
push eax
sub esp, 0x14
mov eax, dword [0x5cc6c0]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov eax, ecx
mov dword [ebp - 0x18], eax
mov edi, dword [ebp + 0xc]
mov esi, edi
mov dword [ebp - 4], 0
cmp dword [edi + 0x14], 0x10
mov ebx, dword [edi + 0x10]
jb 0x450aea
mov esi, dword [edi]
xor ecx, ecx
mov edx, 0x811c9dc5
test ebx, ebx
je 0x450b09
movzx eax, byte [ecx + esi]
inc ecx
xor eax, edx
imul edx, eax, 0x1000193
cmp ecx, ebx
jb 0x450af5
mov eax, dword [ebp - 0x18]
mov ecx, dword [eax + 0x18]
mov eax, dword [eax + 0xc]
and ecx, edx
mov dword [ebp - 0x20], ecx
lea eax, [eax + ecx*8]
mov ecx, dword [ebp - 0x18]
mov dword [ebp - 0x1c], eax
mov esi, dword [ecx + 4]
cmp esi, dword [eax]
je 0x450b89
mov esi, dword [eax + 4]
mov esi, dword [esi]
nop dword [eax]
cmp esi, dword [eax]
je 0x450b89
mov esi, dword [esi + 4]
cmp dword [esi + 0x1c], 0x10
lea eax, [esi + 8]
mov edx, dword [eax + 0x10]
jb 0x450b45
mov eax, dword [eax]
cmp dword [edi + 0x14], 0x10
mov ecx, edi
jb 0x450b4f
mov ecx, dword [edi]
push edx
push eax
push ebx
push ecx
call fcn.0042baf0
add esp, 0x10
test al, al
mov eax, dword [ebp - 0x1c]
je 0x450b30
mov eax, dword [ebp + 8]
mov dword [eax], esi
mov byte [eax + 4], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.004fa0d4
mov esp, ebp
pop ebp
ret 0xc
mov eax, dword [ebp + 0x10]
mov edx, dword [ebp - 0x18]
mov ecx, dword [eax]
mov dword [eax], 0
mov eax, dword [edx + 4]
mov eax, dword [eax]
mov dword [ecx], eax
mov eax, dword [eax + 4]
mov dword [ecx + 4], eax
mov dword [eax], ecx
mov eax, dword [ecx]
mov dword [eax + 4], ecx
inc dword [edx + 8]
mov edi, dword [edx + 4]
mov edi, dword [edi]
mov dword [ebp - 0x1c], edi
mov eax, dword [edi]
cmp esi, eax
je 0x450be0
mov ecx, dword [edi + 4]
mov dword [ecx], eax
mov ecx, dword [eax + 4]
mov dword [ecx], esi
mov ecx, dword [esi + 4]
mov dword [ecx], edi
mov edx, dword [esi + 4]
mov ecx, dword [eax + 4]
mov dword [esi + 4], ecx
mov ecx, dword [edi + 4]
mov dword [eax + 4], ecx
mov dword [edi + 4], edx
mov edx, dword [ebp - 0x18]
push dword [ebp - 0x20]
mov ecx, edx
push esi
push edi
call fcn.00440360
mov ecx, dword [ebp - 0x18]
mov dword [ebp - 4], 2
call fcn.004580b0
mov eax, dword [ebp + 8]
mov dword [eax], edi
mov byte [eax + 4], 1
jmp 0x450b6b
Function at 0x450c30
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x572bd0
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
mov eax, dword [0x5cc6c0]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov eax, ecx
mov dword [ebp - 0x18], eax
mov edi, dword [ebp + 0xc]
mov esi, edi
mov ecx, dword [ebp + 8]
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x20], ecx
cmp dword [edi + 0x14], 0x10
mov ebx, dword [edi + 0x10]
mov dword [ebp - 4], 0
jb 0x450c83
mov esi, dword [edi]
xor ecx, ecx
mov edx, 0x811c9dc5
test ebx, ebx
je 0x450ca4
nop
movzx eax, byte [ecx + esi]
inc ecx
xor eax, edx
imul edx, eax, 0x1000193
cmp ecx, ebx
jb 0x450c90
mov eax, dword [ebp - 0x18]
mov ecx, dword [eax + 0x18]
mov eax, dword [eax + 0xc]
and ecx, edx
mov esi, dword [ebp - 0x18]
mov dword [ebp - 0x24], ecx
lea eax, [eax + ecx*8]
mov esi, dword [esi + 4]
mov dword [ebp - 0x1c], eax
cmp esi, dword [eax]
je 0x450d50
mov esi, dword [eax + 4]
mov esi, dword [esi]
cmp esi, dword [eax]
je 0x450d50
mov esi, dword [esi + 4]
cmp dword [esi + 0x1c], 0x10
lea eax, [esi + 8]
mov edx, dword [eax + 0x10]
jb 0x450ce1
mov eax, dword [eax]
cmp dword [edi + 0x14], 0x10
mov ecx, edi
jb 0x450ceb
mov ecx, dword [edi]
push edx
push eax
push ebx
push ecx
call fcn.0042baf0
add esp, 0x10
test al, al
mov eax, dword [ebp - 0x1c]
je 0x450cc8
mov edi, dword [ebp + 0x10]
mov ecx, dword [edi + 4]
mov eax, dword [edi]
mov dword [ecx], eax
mov ecx, dword [edi]
mov eax, dword [edi + 4]
mov dword [ecx + 4], eax
lea ecx, [edi + 8]
mov eax, dword [ebp - 0x18]
dec dword [eax + 8]
call fcn.00423d20
push 0x28
push edi
call fcn.004f9e2c
mov eax, dword [ebp - 0x20]
add esp, 8
mov dword [eax], esi
mov byte [eax + 4], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.004fa0d4
mov esp, ebp
pop ebp
ret 0xc
mov edi, dword [ebp + 0x10]
mov dword [ebp - 0x1c], edi
mov eax, dword [edi]
cmp esi, eax
je 0x450d7d
mov ecx, dword [edi + 4]
mov dword [ecx], eax
mov ecx, dword [eax + 4]
mov dword [ecx], esi
mov ecx, dword [esi + 4]
mov dword [ecx], edi
mov ecx, dword [eax + 4]
mov edx, dword [esi + 4]
mov dword [esi + 4], ecx
mov ecx, dword [edi + 4]
mov dword [eax + 4], ecx
mov dword [edi + 4], edx
push dword [ebp - 0x24]
mov ebx, dword [ebp - 0x18]
mov ecx, ebx
push esi
push edi
call fcn.00440360
mov ecx, ebx
mov dword [ebp - 4], 2
call fcn.004580b0
mov eax, dword [ebp - 0x20]
mov dword [eax], edi
mov byte [eax + 4], 1
jmp 0x450d32
Function at 0x450dd0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x572c00
mov eax, dword fs:[0]
push eax
sub esp, 0x18
mov eax, dword [0x5cc6c0]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov eax, ecx
mov dword [ebp - 0x18], eax
mov edi, dword [ebp + 0xc]
mov esi, edi
mov dword [ebp - 4], 0
cmp dword [edi + 0x14], 0x10
mov ebx, dword [edi + 0x10]
jb 0x450e1a
mov esi, dword [edi]
xor ecx, ecx
mov edx, 0x811c9dc5
test ebx, ebx
je 0x450e39
movzx eax, byte [ecx + esi]
inc ecx
xor eax, edx
imul edx, eax, 0x1000193
cmp ecx, ebx
jb 0x450e25
mov eax, dword [ebp - 0x18]
mov ecx, dword [eax + 0x18]
mov eax, dword [eax + 0xc]
and ecx, edx
mov esi, dword [ebp - 0x18]
mov dword [ebp - 0x24], ecx
lea eax, [eax + ecx*8]
mov esi, dword [esi + 4]
mov dword [ebp - 0x20], eax
cmp esi, dword [eax]
je 0x450eb9
mov esi, dword [eax + 4]
mov esi, dword [esi]
nop dword [eax]
cmp esi, dword [eax]
je 0x450eb9
mov esi, dword [esi + 4]
cmp dword [esi + 0x1c], 0x10
lea eax, [esi + 8]
mov edx, dword [eax + 0x10]
jb 0x450e75
mov eax, dword [eax]
cmp dword [edi + 0x14], 0x10
mov ecx, edi
jb 0x450e7f
mov ecx, dword [edi]
push edx
push eax
push ebx
push ecx
call fcn.0042baf0
add esp, 0x10
test al, al
mov eax, dword [ebp - 0x20]
je 0x450e60
mov eax, dword [ebp + 8]
mov dword [eax], esi
mov byte [eax + 4], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.004fa0d4
mov esp, ebp
pop ebp
ret 0xc
mov ebx, dword [ebp - 0x18]
mov eax, dword [ebx + 4]
lea ecx, [ebx + 4]
push edi
mov dword [ebp - 4], 0xffffffff
mov eax, dword [eax]
mov dword [ebp - 0x20], eax
mov edx, dword [eax + 4]
push edx
push eax
mov dword [ebp - 0x1c], edx
call fcn.00450300
mov edx, eax
mov ecx, 0x4924923
mov eax, dword [ebx + 8]
sub ecx, eax
cmp ecx, 1
jb 0x450f7d
inc eax
mov dword [ebx + 8], eax
mov eax, dword [ebp - 0x20]
mov dword [eax + 4], edx
mov eax, dword [ebp - 0x1c]
mov dword [eax], edx
mov edi, dword [ebx + 4]
mov edi, dword [edi]
mov dword [ebp - 0x1c], edi
mov eax, dword [edi]
cmp esi, eax
je 0x450f2f
mov ecx, dword [edi + 4]
mov dword [ecx], eax
mov ecx, dword [eax + 4]
mov dword [ecx], esi
mov ecx, dword [esi + 4]
mov dword [ecx], edi
mov ecx, dword [eax + 4]
mov edx, dword [esi + 4]
mov dword [esi + 4], ecx
mov ecx, dword [edi + 4]
mov dword [eax + 4], ecx
mov dword [edi + 4], edx
push dword [ebp - 0x24]
mov ecx, ebx
push esi
push edi
call fcn.00440360
mov ecx, ebx
mov dword [ebp - 4], 2
call fcn.00458010
mov eax, dword [ebp + 8]
mov dword [eax], edi
mov byte [eax + 4], 1
jmp 0x450e9b
push str.list_T__too_long
call fcn.00460730
int3
Function at 0x450f90
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
mov esi, edi
mov dword [ebp - 4], ecx
cmp dword [edi + 0x14], 0x10
mov ebx, dword [edi + 0x10]
jb 0x450fac
mov esi, dword [edi]
xor ecx, ecx
mov edx, 0x811c9dc5
test ebx, ebx
je 0x450fc8
movzx eax, byte [ecx + esi]
inc ecx
xor eax, edx
imul edx, eax, 0x1000193
cmp ecx, ebx
jb 0x450fb7
mov ebx, dword [ebp - 4]
mov eax, dword [ebx + 0x18]
mov ecx, dword [ebx + 0xc]
and eax, edx
mov ebx, dword [ebx + 4]
mov edx, dword [ecx + eax*8]
lea eax, [eax*8 + 4]
add eax, ecx
mov dword [ebp - 8], edx
mov esi, edx
mov dword [ebp - 0xc], eax
nop word [eax + eax]
cmp edx, ebx
jne 0x450ff8
mov eax, ebx
jmp 0x450ffc
mov eax, dword [eax]
mov eax, dword [eax]
cmp esi, eax
je 0x45106f
cmp dword [edi + 0x14], 0x10
lea eax, [esi + 8]
mov ecx, edi
jb 0x45100d
mov ecx, dword [edi]
mov edi, dword [eax + 0x14]
cmp edi, 0x10
mov edx, dword [eax + 0x10]
mov dword [ebp - 0x10], edi
mov edi, dword [ebp + 0xc]
mov dword [ebp - 0x14], edx
jb 0x451023
mov eax, dword [eax]
push dword [edi + 0x10]
push ecx
push edx
push eax
call fcn.0042baf0
add esp, 0x10
test al, al
jne 0x45103f
mov esi, dword [esi]
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 0xc]
jmp 0x450ff0
cmp dword [ebp - 0x10], 0x10
lea eax, [esi + 8]
jb 0x45104a
mov eax, dword [eax]
cmp dword [edi + 0x14], 0x10
mov ecx, edi
jb 0x451054
mov ecx, dword [edi]
push dword [ebp - 0x14]
push eax
push dword [edi + 0x10]
push ecx
call fcn.0042baf0
add esp, 0x10
mov ecx, ebx
test al, al
cmovne ecx, esi
mov eax, ecx
jmp 0x451073
mov ecx, ebx
mov eax, ebx
cmp eax, ebx
jne 0x4510d3
mov esi, dword [ebx]
lea eax, [ebp + 0xf]
mov ebx, dword [ebp - 4]
push eax
lea eax, [ebp - 0x14]
mov dword [ebp - 0x14], edi
mov edi, dword [esi + 4]
push eax
push 0x580fe0
push edi
push esi
lea ecx, [ebx + 4]
call fcn.00450260
mov edx, eax
mov ecx, 0x4924923
mov eax, dword [ebx + 8]
sub ecx, eax
cmp ecx, 1
jb 0x4510e5
inc eax
mov ecx, ebx
mov dword [ebx + 8], eax
mov dword [esi + 4], edx
mov esi, dword [ebp + 8]
mov dword [edi], edx
mov eax, dword [ebx + 4]
mov eax, dword [eax]
push eax
add eax, 8
push eax
push esi
call fcn.00450900
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
mov eax, dword [ebp + 8]
pop edi
pop esi
pop ebx
mov dword [eax], ecx
mov byte [eax + 4], 0
mov esp, ebp
pop ebp
ret 8
push str.list_T__too_long
call fcn.00460730
int3
Function at 0x4510f0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [ebp + 8]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 0xc]
cmp dword [eax + 0x1c], 0x10
push ebx
mov ebx, dword [eax + 0x18]
push esi
lea esi, [eax + 8]
mov dword [ebp - 4], ecx
push edi
jb 0x451113
mov esi, dword [esi]
xor edx, edx
mov edi, 0x811c9dc5
test ebx, ebx
je 0x451131
nop
movzx ecx, byte [edx + esi]
inc edx
xor ecx, edi
imul edi, ecx, 0x1000193
cmp edx, ebx
jb 0x451120
mov ebx, dword [ebp - 4]
mov ecx, dword [ebx + 0x18]
mov edx, dword [ebx + 0xc]
and ecx, edi
lea esi, [ecx*8]
mov ecx, dword [edx + esi]
add edx, esi
cmp dword [edx + 4], eax
jne 0x45116a
cmp ecx, eax
jne 0x451162
mov ecx, dword [ebx + 4]
mov dword [edx], ecx
mov edx, dword [ebx + 0xc]
mov ecx, dword [ebx + 4]
mov dword [esi + edx + 4], ecx
jmp 0x451172
mov ecx, dword [eax + 4]
mov dword [edx + 4], ecx
jmp 0x451172
cmp ecx, eax
jne 0x451172
mov ecx, dword [eax]
mov dword [edx], ecx
mov edx, dword [eax + 4]
lea ecx, [ebx + 4]
mov edi, dword [eax]
push eax
mov dword [edx], edi
mov esi, dword [eax]
mov edx, dword [eax + 4]
mov dword [esi + 4], edx
dec dword [ecx + 4]
call fcn.00458400
mov eax, dword [ebp - 8]
mov dword [eax], edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x4511a0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
mov dword [ebp - 4], ecx
mov dword [ebp - 8], eax
cmp dword [edi + 0x1c], 0x10
lea esi, [edi + 8]
mov ebx, dword [edi + 0x18]
jb 0x4511c4
mov esi, dword [edi + 8]
xor ecx, ecx
mov edx, 0x811c9dc5
test ebx, ebx
je 0x4511e1
nop
movzx eax, byte [ecx + esi]
inc ecx
xor eax, edx
imul edx, eax, 0x1000193
cmp ecx, ebx
jb 0x4511d0
mov ebx, dword [ebp - 4]
mov eax, dword [ebx + 0x18]
mov ecx, dword [ebx + 0xc]
and eax, edx
lea edx, [eax*8]
mov eax, dword [ecx + edx]
add ecx, edx
cmp dword [ecx + 4], edi
jne 0x45121a
cmp eax, edi
jne 0x451212
mov eax, dword [ebx + 4]
mov dword [ecx], eax
mov ecx, dword [ebx + 0xc]
mov eax, dword [ebx + 4]
mov dword [edx + ecx + 4], eax
jmp 0x451222
mov eax, dword [edi + 4]
mov dword [ecx + 4], eax
jmp 0x451222
cmp eax, edi
jne 0x451222
mov eax, dword [edi]
mov dword [ecx], eax
mov eax, dword [edi + 4]
lea ecx, [edi + 8]
mov esi, dword [edi]
mov dword [eax], esi
mov edx, dword [edi]
mov eax, dword [edi + 4]
mov dword [edx + 4], eax
dec dword [ebx + 8]
call fcn.004422d0
push 0x38
push edi
call fcn.004f9e2c
mov eax, dword [ebp - 8]
add esp, 8
pop edi
mov dword [eax], esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8