joyce8/EMBER2024-capa huggingface dataset:
Function at 0x449e50
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x60
mov eax, dword [0x5ea6c0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov eax, 0x5f6698
mov dword [ebp - 0x60], 0x5c005c
lea esi, [ebp - 0x60]
mov dword [ebp - 0x5c], 0x5c002e
push edi
mov dword [ebp - 0x58], 0x490050
mov edx, 0x2e
mov dword [ebp - 0x54], 0x450050
sub esi, eax
mov dword [ebp - 0x50], 0x34005c
mov dword [ebp - 0x4c], 0x360043
mov dword [ebp - 0x48], 0x360042
mov dword [ebp - 0x44], 0x440042
mov dword [ebp - 0x40], 0x2d0043
mov dword [ebp - 0x3c], 0x340041
mov dword [ebp - 0x38], 0x440037
mov dword [ebp - 0x34], 0x36002d
mov dword [ebp - 0x30], 0x340042
mov dword [ebp - 0x2c], 0x2d0034
mov dword [ebp - 0x28], 0x360045
mov dword [ebp - 0x24], 0x370038
mov dword [ebp - 0x20], 0x32002d
mov dword [ebp - 0x1c], 0x420043
mov dword [ebp - 0x18], 0x430036
mov dword [ebp - 0x14], 0x320045
mov dword [ebp - 0x10], 0x300046
mov dword [ebp - 0xc], 0x350046
mov dword [ebp - 8], 0x39
lea ecx, [edx + 0x7fffffd0]
test ecx, ecx
je 0x449f31
movzx ecx, word [esi + eax]
test cx, cx
je 0x449f31
mov word [eax], cx
add eax, 2
sub edx, 1
jne 0x449f13
test edx, edx
lea ecx, [eax - 2]
pop edi
cmovne ecx, eax
xor eax, eax
pop esi
pop ebx
mov word [ecx], ax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00512634
mov esp, ebp
pop ebp
ret

Function at 0x449f50
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x60
mov eax, dword [0x5ea6c0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov eax, 0x5f6630
mov dword [ebp - 0x60], 0x5c005c
lea esi, [ebp - 0x60]
mov dword [ebp - 0x5c], 0x5c002e
push edi
mov dword [ebp - 0x58], 0x490050
mov edx, 0x2e
mov dword [ebp - 0x54], 0x450050
sub esi, eax
mov dword [ebp - 0x50], 0x30005c
mov dword [ebp - 0x4c], 0x370037
mov dword [ebp - 0x48], 0x360031
mov dword [ebp - 0x44], 0x420030
mov dword [ebp - 0x40], 0x2d0037
mov dword [ebp - 0x3c], 0x310037
mov dword [ebp - 0x38], 0x360041
mov dword [ebp - 0x34], 0x39002d
mov dword [ebp - 0x30], 0x430033
mov dword [ebp - 0x2c], 0x2d0044
mov dword [ebp - 0x28], 0x440037
mov dword [ebp - 0x24], 0x350037
mov dword [ebp - 0x20], 0x38002d
mov dword [ebp - 0x1c], 0x320034
mov dword [ebp - 0x18], 0x430035
mov dword [ebp - 0x14], 0x430037
mov dword [ebp - 0x10], 0x350044
mov dword [ebp - 0xc], 0x320030
mov dword [ebp - 8], 0x43
lea ecx, [edx + 0x7fffffd0]
test ecx, ecx
je 0x44a031
movzx ecx, word [esi + eax]
test cx, cx
je 0x44a031
mov word [eax], cx
add eax, 2
sub edx, 1
jne 0x44a013
test edx, edx
lea ecx, [eax - 2]
pop edi
cmovne ecx, eax
xor eax, eax
pop esi
pop ebx
mov word [ecx], ax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00512634
mov esp, ebp
pop ebp
ret
Function at 0x44a130
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x60
mov eax, dword [0x5ea6c0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov eax, 0x5f6428
mov dword [ebp - 0x60], 0x5c005c
lea esi, [ebp - 0x60]
mov dword [ebp - 0x5c], 0x5c002e
push edi
mov dword [ebp - 0x58], 0x490050
mov edx, 0x2e
mov dword [ebp - 0x54], 0x450050
sub esi, eax
mov dword [ebp - 0x50], 0x44005c
mov dword [ebp - 0x4c], 0x300037
mov dword [ebp - 0x48], 0x440038
mov dword [ebp - 0x44], 0x430039
mov dword [ebp - 0x40], 0x2d0033
mov dword [ebp - 0x3c], 0x410042
mov dword [ebp - 0x38], 0x370044
mov dword [ebp - 0x34], 0x34002d
mov dword [ebp - 0x30], 0x300045
mov dword [ebp - 0x2c], 0x2d0039
mov dword [ebp - 0x28], 0x340038
mov dword [ebp - 0x24], 0x300042
mov dword [ebp - 0x20], 0x32002d
mov dword [ebp - 0x1c], 0x460038
mov dword [ebp - 0x18], 0x410039
mov dword [ebp - 0x14], 0x410035
mov dword [ebp - 0x10], 0x330033
mov dword [ebp - 0xc], 0x330034
mov dword [ebp - 8], 0x34
lea ecx, [edx + 0x7fffffd0]
test ecx, ecx
je 0x44a211
movzx ecx, word [esi + eax]
test cx, cx
je 0x44a211
mov word [eax], cx
add eax, 2
sub edx, 1
jne 0x44a1f3
test edx, edx
lea ecx, [eax - 2]
pop edi
cmovne ecx, eax
xor eax, eax
pop esi
pop ebx
mov word [ecx], ax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00512634
mov esp, ebp
pop ebp
ret
Function at 0x44a650
Capabilities:
Get process heap force flags

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x583750
mov eax, dword fs:[0]
push eax
push esi
push edi
mov eax, dword [0x5ea6c0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
lea esi, [edi + 0x334]
mov dword [edi], vtable.LoadingWnd.0
mov ecx, esi
mov dword [edi + 0x14], vtable.LoadingWnd.1.0
mov dword [edi + 0x24], vtable.LoadingWnd.2.0
mov dword [edi + 0x28], vtable.LoadingWnd.3.0
mov dword [edi + 0x2c], vtable.LoadingWnd.4.0
call fcn.004391b0
mov ecx, esi
mov dword [ebp - 4], 0
call fcn.004391b0
lea eax, [esi + 0x4c]
push eax
call fcn.004770a6
lea eax, [esi + 0x1c]
push eax
call fcn.00476d7f
add esp, 8
lea ecx, [esi + 8]
call fcn.00438220
mov ecx, esi
call fcn.0043ce80
push 0x10
push dword [esi]
call fcn.0051238c
add esp, 8
mov dword [edi], vtable.DuiLib::WindowImplBase.0
lea ecx, [edi + 0x30]
mov dword [edi + 0x14], vtable.DuiLib::WindowImplBase.1.0
mov dword [edi + 0x24], vtable.DuiLib::WindowImplBase.2.0
mov dword [edi + 0x28], vtable.DuiLib::WindowImplBase.3.0
mov dword [edi + 0x2c], vtable.DuiLib::WindowImplBase.4.0
call fcn.0049c310
lea ecx, [edi + 0x18]
call fcn.004a31e0
mov ecx, edi
call fcn.004a4af0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x44ac10
Capabilities:
Get process heap force flags

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5885b0
mov eax, dword fs:[0]
push eax
push esi
push edi
mov eax, dword [0x5ea6c0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
lea esi, [edi + 0x334]
mov dword [ebp - 4], 0
mov ecx, esi
mov dword [edi], vtable.LoadingWnd.0
mov dword [edi + 0x14], vtable.LoadingWnd.1.0
mov dword [edi + 0x24], vtable.LoadingWnd.2.0
mov dword [edi + 0x28], vtable.LoadingWnd.3.0
mov dword [edi + 0x2c], vtable.LoadingWnd.4.0
call fcn.004391b0
mov ecx, esi
mov byte [ebp - 4], 1
call fcn.004391b0
lea eax, [esi + 0x4c]
push eax
call fcn.004770a6
lea eax, [esi + 0x1c]
push eax
call fcn.00476d7f
add esp, 8
lea ecx, [esi + 8]
call fcn.00438220
mov ecx, esi
call fcn.0043ce80
push 0x10
push dword [esi]
call fcn.0051238c
add esp, 8
mov dword [edi], vtable.DuiLib::WindowImplBase.0
lea ecx, [edi + 0x30]
mov dword [edi + 0x14], vtable.DuiLib::WindowImplBase.1.0
mov dword [edi + 0x24], vtable.DuiLib::WindowImplBase.2.0
mov dword [edi + 0x28], vtable.DuiLib::WindowImplBase.3.0
mov dword [edi + 0x2c], vtable.DuiLib::WindowImplBase.4.0
call fcn.0049c310
lea ecx, [edi + 0x18]
call fcn.004a31e0
mov ecx, edi
call fcn.004a4af0
test byte [ebp + 8], 1
je 0x44acf4
push 0x3c4
push edi
call fcn.0051238c
add esp, 8
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x44eaa0
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x588bc0
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push esi
push edi
mov eax, dword [0x5ea6c0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov ebx, ecx
mov dword [ebp - 0x18], ebx
mov edi, dword [ebp + 0xc]
mov esi, dword [ebx + 4]
mov dword [ebp - 4], 0
movzx eax, byte [edi]
xor eax, 0x811c9dc5
imul edx, eax, 0x1000193
movzx eax, byte [edi + 1]
xor edx, eax
movzx eax, byte [edi + 2]
imul ecx, edx, 0x1000193
xor ecx, eax
movzx eax, byte [edi + 3]
imul ecx, ecx, 0x1000193
xor ecx, eax
imul eax, ecx, 0x1000193
mov ecx, dword [ebx + 0x18]
and ecx, eax
lea edx, [ecx*8]
mov ecx, dword [ebx + 0xc]
mov dword [ebp + 0xc], edx
mov eax, dword [ecx + edx]
cmp esi, eax
je 0x44eb65
mov esi, dword [ecx + edx + 4]
mov esi, dword [esi]
nop
cmp esi, eax
je 0x44eb65
mov esi, dword [esi + 4]
mov ecx, dword [edi]
cmp ecx, dword [esi + 8]
jne 0x44eb30
push dword [ebp + 0x10]
mov ecx, ebx
call fcn.0046a490
mov eax, dword [ebp + 8]
mov dword [eax], esi
mov byte [eax + 4], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov edi, dword [ebp + 0x10]
mov dword [ebp - 0x14], edi
mov eax, dword [edi]
cmp esi, eax
je 0x44eb95
mov ecx, dword [edi + 4]
mov dword [ecx], eax
mov ecx, dword [eax + 4]
mov dword [ecx], esi
mov ecx, dword [esi + 4]
mov dword [ecx], edi
mov edx, dword [esi + 4]
mov ecx, dword [eax + 4]
mov dword [esi + 4], ecx
mov ecx, dword [edi + 4]
mov dword [eax + 4], ecx
mov dword [edi + 4], edx
mov edx, dword [ebp + 0xc]
mov ecx, dword [ebx + 0xc]
add ecx, edx
mov eax, dword [ecx]
cmp eax, dword [ebx + 4]
jne 0x44ebac
mov dword [ecx], edi
mov eax, dword [ebx + 0xc]
mov dword [edx + eax + 4], edi
jmp 0x44ebce
cmp eax, esi
jne 0x44ebb4
mov dword [ecx], edi
jmp 0x44ebce
mov eax, dword [ecx + 4]
mov eax, dword [eax]
mov dword [ecx + 4], eax
cmp eax, edi
je 0x44ebce
mov ecx, dword [ebx + 0xc]
mov eax, dword [ecx + edx + 4]
mov eax, dword [eax + 4]
mov dword [ecx + edx + 4], eax
mov ecx, ebx
mov dword [ebp - 4], 2
call fcn.00469a50
mov eax, dword [ebp + 8]
mov dword [eax], edi
mov byte [eax + 4], 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x44ec20
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x588be0
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push ebx
push esi
push edi
mov eax, dword [0x5ea6c0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov ebx, ecx
mov dword [ebp - 0x1c], ebx
mov edi, dword [ebp + 0xc]
mov esi, dword [ebx + 0xc]
mov dword [ebp - 4], 0
movzx eax, byte [edi]
xor eax, 0x811c9dc5
imul edx, eax, 0x1000193
movzx eax, byte [edi + 1]
xor edx, eax
movzx eax, byte [edi + 2]
imul ecx, edx, 0x1000193
mov edx, dword [ebx + 4]
xor ecx, eax
movzx eax, byte [edi + 3]
imul ecx, ecx, 0x1000193
xor ecx, eax
imul eax, ecx, 0x1000193
mov ecx, dword [ebx + 0x18]
and ecx, eax
shl ecx, 3
mov dword [ebp + 0xc], ecx
mov eax, dword [esi + ecx]
cmp eax, edx
jne 0x44eca8
mov esi, edx
jmp 0x44ecb0
mov esi, dword [esi + ecx + 4]
mov esi, dword [esi]
nop
cmp esi, eax
je 0x44ecdb
mov esi, dword [esi + 4]
mov ecx, dword [edi]
cmp ecx, dword [esi + 8]
jne 0x44ecb0
mov eax, dword [ebp + 8]
mov dword [eax], esi
mov byte [eax + 4], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov eax, dword [edx]
push edi
mov dword [ebp - 4], 0xffffffff
mov dword [ebp - 0x14], eax
mov ecx, dword [eax + 4]
push ecx
mov dword [ebp - 0x18], ecx
lea ecx, [ebx + 4]
push eax
call fcn.0044d6c0
mov edx, eax
mov ecx, 0x4924923
mov eax, dword [ebx + 8]
sub ecx, eax
cmp ecx, 1
jb 0x44eddc
inc eax
mov dword [ebx + 8], eax
mov eax, dword [ebp - 0x14]
mov dword [eax + 4], edx
mov eax, dword [ebp - 0x18]
mov dword [eax], edx
mov edx, dword [ebx + 4]
mov edi, dword [edx]
mov dword [ebp - 0x18], edi
mov eax, dword [edi]
cmp esi, eax
je 0x44ed4e
mov ecx, dword [edi + 4]
mov dword [ecx], eax
mov ecx, dword [eax + 4]
mov dword [ecx], esi
mov ecx, dword [esi + 4]
mov dword [ecx], edi
mov edx, dword [esi + 4]
mov ecx, dword [eax + 4]
mov dword [esi + 4], ecx
mov ecx, dword [edi + 4]
mov dword [eax + 4], ecx
mov dword [edi + 4], edx
mov edx, dword [ebx + 4]
mov ecx, dword [ebp + 0xc]
add ecx, dword [ebx + 0xc]
mov eax, dword [ecx]
cmp eax, edx
jne 0x44ed68
mov dword [ecx], edi
mov eax, dword [ebx + 0xc]
mov ecx, dword [ebp + 0xc]
mov dword [ecx + eax + 4], edi
jmp 0x44ed8b
cmp eax, esi
jne 0x44ed70
mov dword [ecx], edi
jmp 0x44ed8b
mov eax, dword [ecx + 4]
mov eax, dword [eax]
mov dword [ecx + 4], eax
cmp eax, edi
je 0x44ed8b
mov ecx, dword [ebp + 0xc]
add ecx, dword [ebx + 0xc]
mov eax, dword [ecx + 4]
mov eax, dword [eax + 4]
mov dword [ecx + 4], eax
mov ecx, ebx
mov dword [ebp - 4], 2
call fcn.00469a50
mov eax, dword [ebp + 8]
mov dword [eax], edi
mov byte [eax + 4], 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
push str.list_T__too_long
call fcn.0047549f
int3
Function at 0x44f010
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
mov esi, edi
mov dword [ebp - 4], ecx
cmp dword [edi + 0x14], 8
mov eax, dword [edi + 0x10]
jb 0x44f02c
mov esi, dword [edi]
lea ebx, [eax + eax]
xor ecx, ecx
mov edx, 0x811c9dc5
test ebx, ebx
je 0x44f051
nop word [eax + eax]
movzx eax, byte [ecx + esi]
inc ecx
xor eax, edx
imul edx, eax, 0x1000193
cmp ecx, ebx
jb 0x44f040
mov ebx, dword [ebp - 4]
mov eax, dword [ebx + 0x18]
mov ecx, dword [ebx + 0xc]
and eax, edx
mov ebx, dword [ebx + 4]
mov edx, dword [ecx + eax*8]
lea eax, [eax*8 + 4]
add eax, ecx
mov dword [ebp - 8], edx
mov esi, edx
mov dword [ebp - 0xc], eax
cmp edx, ebx
jne 0x44f07b
mov eax, ebx
jmp 0x44f07f
mov eax, dword [eax]
mov eax, dword [eax]
cmp esi, eax
je 0x44f0f6
cmp dword [edi + 0x14], 8
lea eax, [esi + 8]
mov ecx, edi
jb 0x44f090
mov ecx, dword [edi]
mov edi, dword [eax + 0x14]
cmp edi, 8
mov edx, dword [eax + 0x10]
mov dword [ebp - 0x10], edi
mov edi, dword [ebp + 0xc]
mov dword [ebp - 0x14], edx
jb 0x44f0a6
mov eax, dword [eax]
cmp edx, dword [edi + 0x10]
jne 0x44f0ba
push edx
push ecx
push eax
call fcn.0041e030
add esp, 0xc
test eax, eax
je 0x44f0c4
mov esi, dword [esi]
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 0xc]
jmp 0x44f073
cmp dword [ebp - 0x10], 8
lea eax, [esi + 8]
jb 0x44f0cf
mov eax, dword [eax]
cmp dword [edi + 0x14], 8
mov ecx, edi
jb 0x44f0d9
mov ecx, dword [edi]
mov edx, dword [edi + 0x10]
cmp edx, dword [ebp - 0x14]
jne 0x44f0f0
push edx
push eax
push ecx
call fcn.0041e030
add esp, 0xc
test eax, eax
je 0x44f0f2
mov esi, ebx
mov eax, esi
jmp 0x44f0fa
mov esi, ebx
mov eax, ebx
cmp eax, ebx
jne 0x44f15a
mov esi, dword [ebx]
lea eax, [ebp + 0xf]
mov ebx, dword [ebp - 4]
push eax
lea eax, [ebp - 0x14]
mov dword [ebp - 0x14], edi
mov edi, dword [esi + 4]
push eax
push 0x59c510
push edi
push esi
lea ecx, [ebx + 4]
call fcn.0044d5e0
mov edx, eax
mov ecx, 0x38e38e2
mov eax, dword [ebx + 8]
sub ecx, eax
cmp ecx, 1
jb 0x44f16c
inc eax
mov ecx, ebx
mov dword [ebx + 8], eax
mov dword [esi + 4], edx
mov esi, dword [ebp + 8]
mov dword [edi], edx
mov eax, dword [ebx + 4]
mov eax, dword [eax]
push eax
add eax, 8
push eax
push esi
call fcn.0044e840
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
mov eax, dword [ebp + 8]
pop edi
mov dword [eax], esi
pop esi
mov byte [eax + 4], 0
pop ebx
mov esp, ebp
pop ebp
ret 8
push str.list_T__too_long
call fcn.0047549f
int3
Function at 0x44f6a0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
mov dword [ebp - 4], ecx
cmp dword [edi + 0x1c], 0x10
lea esi, [edi + 8]
mov ebx, dword [edi + 0x18]
jb 0x44f6bc
mov esi, dword [edi + 8]
xor ecx, ecx
mov edx, 0x811c9dc5
test ebx, ebx
je 0x44f6d8
movzx eax, byte [ecx + esi]
inc ecx
xor eax, edx
imul edx, eax, 0x1000193
cmp ecx, ebx
jb 0x44f6c7
mov ebx, dword [ebp - 4]
mov eax, dword [ebx + 0x18]
mov ecx, dword [ebx + 0xc]
and eax, edx
lea edx, [eax*8]
mov eax, dword [ecx + edx]
add ecx, edx
cmp dword [ecx + 4], edi
jne 0x44f711
cmp eax, edi
jne 0x44f709
mov eax, dword [ebx + 4]
mov dword [ecx], eax
mov ecx, dword [ebx + 0xc]
mov eax, dword [ebx + 4]
mov dword [edx + ecx + 4], eax
jmp 0x44f719
mov eax, dword [edi + 4]
mov dword [ecx + 4], eax
jmp 0x44f719
cmp eax, edi
jne 0x44f719
mov eax, dword [edi]
mov dword [ecx], eax
mov eax, dword [edi + 4]
lea edx, [ebx + 4]
mov esi, dword [edi]
mov dword [eax], esi
mov ecx, dword [edi]
mov eax, dword [edi + 4]
mov dword [ecx + 4], eax
lea eax, [edi + 8]
dec dword [edx + 4]
push eax
push edx
call fcn.0044f450
push 0x38
push edi
call fcn.0051238c
mov eax, dword [ebp + 8]
add esp, 0x10
pop edi
mov dword [eax], esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x44f780
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
mov dword [ebp - 4], ecx
cmp dword [edi + 0x1c], 8
lea esi, [edi + 8]
mov ebx, dword [edi + 0x18]
jb 0x44f79c
mov esi, dword [edi + 8]
xor ecx, ecx
mov edx, 0x811c9dc5
add ebx, ebx
je 0x44f7b8
movzx eax, byte [ecx + esi]
inc ecx
xor eax, edx
imul edx, eax, 0x1000193
cmp ecx, ebx
jb 0x44f7a7
mov ebx, dword [ebp - 4]
mov eax, dword [ebx + 0x18]
mov ecx, dword [ebx + 0xc]
and eax, edx
lea edx, [eax*8]
mov eax, dword [ecx + edx]
add ecx, edx
cmp dword [ecx + 4], edi
jne 0x44f7f1
cmp eax, edi
jne 0x44f7e9
mov eax, dword [ebx + 4]
mov dword [ecx], eax
mov ecx, dword [ebx + 0xc]
mov eax, dword [ebx + 4]
mov dword [edx + ecx + 4], eax
jmp 0x44f7f9
mov eax, dword [edi + 4]
mov dword [ecx + 4], eax
jmp 0x44f7f9
cmp eax, edi
jne 0x44f7f9
mov eax, dword [edi]
mov dword [ecx], eax
mov eax, dword [edi + 4]
lea ecx, [edi + 8]
mov esi, dword [edi]
mov dword [eax], esi
mov edx, dword [edi]
mov eax, dword [edi + 4]
mov dword [edx + 4], eax
dec dword [ebx + 8]
call fcn.00450af0
push 0x48
push edi
call fcn.0051238c
mov eax, dword [ebp + 8]
add esp, 8
pop edi
mov dword [eax], esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x454340
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x88
mov eax, dword [0x5ea6c0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 8]
xor eax, eax
push edi
push 0x3f
mov ecx, esi
mov dword [ebp - 0x88], esi
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 7
mov word [esi], ax
lea eax, [ebp - 0x84]
push eax
mov dword [ebp - 0x84], 0x4f0053
mov dword [ebp - 0x80], 0x540046
mov dword [ebp - 0x7c], 0x410057
mov dword [ebp - 0x78], 0x450052
mov dword [ebp - 0x74], 0x4d005c
mov dword [ebp - 0x70], 0x630069
mov dword [ebp - 0x6c], 0x6f0072
mov dword [ebp - 0x68], 0x6f0073
mov dword [ebp - 0x64], 0x740066
mov dword [ebp - 0x60], 0x57005c
mov dword [ebp - 0x5c], 0x6e0069
mov dword [ebp - 0x58], 0x6f0064
mov dword [ebp - 0x54], 0x730077
mov dword [ebp - 0x50], 0x43005c
mov dword [ebp - 0x4c], 0x720075
mov dword [ebp - 0x48], 0x650072
mov dword [ebp - 0x44], 0x74006e
mov dword [ebp - 0x40], 0x650056
mov dword [ebp - 0x3c], 0x730072
mov dword [ebp - 0x38], 0x6f0069
mov dword [ebp - 0x34], 0x5c006e
mov dword [ebp - 0x30], 0x700041
mov dword [ebp - 0x2c], 0x200070
mov dword [ebp - 0x28], 0x610050
mov dword [ebp - 0x24], 0x680074
mov dword [ebp - 0x20], 0x5c0073
mov dword [ebp - 0x1c], 0x360033
mov dword [ebp - 0x18], 0x730030
mov dword [ebp - 0x14], 0x660061
mov dword [ebp - 0x10], 0x2e0065
mov dword [ebp - 0xc], 0x780065
mov dword [ebp - 8], 0x65
call fcn.00414120
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00512634
mov esp, ebp
pop ebp
ret 4

Function at 0x455260
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
mov eax, dword [0x5ea6c0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 8]
xor eax, eax
push edi
mov word [ebp - 8], ax
mov ecx, esi
push 0x18
mov dword [esi + 0x10], eax
mov dword [esi + 0x14], 7
mov word [esi], ax
lea eax, [ebp - 0x38]
push eax
mov dword [ebp - 0x3c], esi
mov dword [ebp - 0x38], 0x6e0049
mov dword [ebp - 0x34], 0x740069
mov dword [ebp - 0x30], 0x670020
mov dword [ebp - 0x2c], 0x6f006c
mov dword [ebp - 0x28], 0x610062
mov dword [ebp - 0x24], 0x20006c
mov dword [ebp - 0x20], 0x6f0063
mov dword [ebp - 0x1c], 0x66006e
mov dword [ebp - 0x18], 0x670069
mov dword [ebp - 0x14], 0x660020
mov dword [ebp - 0x10], 0x690061
mov dword [ebp - 0xc], 0x2e006c
call fcn.00414120
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00512634
mov esp, ebp
pop ebp
ret 4
Function at 0x46f210
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
mov ebx, ecx
movzx eax, byte [edi + 8]
xor eax, 0x811c9dc5
imul edx, eax, 0x1000193
movzx eax, byte [edi + 9]
xor edx, eax
movzx eax, byte [edi + 0xa]
imul edx, edx, 0x1000193
xor edx, eax
movzx eax, byte [edi + 0xb]
imul ecx, edx, 0x1000193
xor ecx, eax
imul eax, ecx, 0x1000193
mov ecx, dword [ebx + 0x18]
and ecx, eax
lea edx, [ecx*8]
mov ecx, dword [ebx + 0xc]
add ecx, edx
mov eax, dword [ecx]
cmp dword [ecx + 4], edi
jne 0x46f283
cmp eax, edi
jne 0x46f27b
mov eax, dword [ebx + 4]
mov dword [ecx], eax
mov ecx, dword [ebx + 0xc]
mov eax, dword [ebx + 4]
mov dword [edx + ecx + 4], eax
jmp 0x46f28b
mov eax, dword [edi + 4]
mov dword [ecx + 4], eax
jmp 0x46f28b
cmp eax, edi
jne 0x46f28e
mov eax, dword [edi]
mov dword [ecx], eax
mov edi, dword [ebp + 0xc]
mov eax, dword [edi + 4]
mov esi, dword [edi]
mov dword [eax], esi
mov ecx, dword [edi]
mov eax, dword [edi + 4]
mov dword [ecx + 4], eax
dec dword [ebx + 8]
lea ebx, [edi + 0x10]
mov ecx, dword [ebx + 0x24]
test ecx, ecx
je 0x46f2bf
mov edx, dword [ecx]
cmp ecx, ebx
setne al
movzx eax, al
push eax
call dword [edx + 0x10]
mov dword [ebx + 0x24], 0
push 0x38
push edi
call fcn.0051238c
mov eax, dword [ebp + 8]
add esp, 8
pop edi
mov dword [eax], esi
pop esi
pop ebx
pop ebp
ret 8
Function at 0x46f510
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
cmp dword [edi + 0x1c], 0x10
lea edx, [edi + 8]
mov ebx, dword [edx + 0x10]
mov dword [ebp - 4], ecx
jb 0x46f52b
mov edx, dword [edx]
xor ecx, ecx
mov esi, 0x811c9dc5
test ebx, ebx
je 0x46f547
movzx eax, byte [ecx + edx]
inc ecx
xor eax, esi
imul esi, eax, 0x1000193
cmp ecx, ebx
jb 0x46f536
mov edx, dword [ebp - 4]
mov eax, dword [edx + 0x18]
mov ecx, dword [edx + 0xc]
and eax, esi
lea esi, [eax*8]
mov eax, dword [ecx + esi]
add ecx, esi
cmp dword [ecx + 4], edi
jne 0x46f580
cmp eax, edi
jne 0x46f578
mov eax, dword [edx + 4]
mov dword [ecx], eax
mov ecx, dword [edx + 0xc]
mov eax, dword [edx + 4]
mov dword [esi + ecx + 4], eax
jmp 0x46f588
mov eax, dword [edi + 4]
mov dword [ecx + 4], eax
jmp 0x46f588
cmp eax, edi
jne 0x46f58b
mov eax, dword [edi]
mov dword [ecx], eax
mov edi, dword [ebp + 0xc]
mov eax, dword [edi + 4]
mov esi, dword [edi]
mov dword [eax], esi
mov ecx, dword [edi]
mov eax, dword [edi + 4]
mov dword [ecx + 4], eax
lea ecx, [edi + 8]
dec dword [edx + 8]
call fcn.00408d90
push 0x28
push edi
call fcn.0051238c
mov eax, dword [ebp + 8]
add esp, 8
pop edi
mov dword [eax], esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8