joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4a1cd1
Capabilities:
Delete file
Download and write a file
Read data from internet
Receive and write data from server to client
Receive data
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x13c
mov eax, dword [0x4c6644]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x13c], ecx
mov byte [ebp - 0x108], 0
push 0xff
push 0
lea eax, [ebp - 0x107]
push eax
call fcn.00467660
add esp, 0xc
mov ecx, dword [ebp - 0x13c]
add ecx, 0x38
call fcn.004010f3
push eax
call fcn.0049cf8f
pop ecx
mov dword [ebp - 0x10c], eax
mov dword [ebp - 0x110], 1
cmp dword [ebp - 0x10c], 0xffffffff
jne 0x4a1d3c
xor eax, eax
jmp 0x4a1e50
push 0x28
push 0
lea eax, [ebp - 0x138]
push eax
call fcn.00467660
add esp, 0xc
mov dword [ebp - 0x138], 0x28
lea eax, [ebp - 0x108]
mov dword [ebp - 0x124], eax
mov dword [ebp - 0x120], 0xff
push 2
push 0
lea eax, [ebp - 0x138]
push eax
mov eax, dword [ebp - 0x13c]
push dword [eax + 0x5c]
call dword [sym.imp.WININET.dll_InternetReadFileExA]
test eax, eax
jne 0x4a1db6
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x3e5
jne 0x4a1dad
push 0xffffffffffffffff
mov eax, dword [ebp - 0x13c]
push dword [eax + 0x70]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
jmp 0x4a1db6
and dword [ebp - 0x110], 0
jmp 0x4a1e19
mov eax, dword [ebp - 0x120]
mov byte [ebp + eax - 0x108], 0
cmp dword [ebp - 0x120], 0
jne 0x4a1dda
mov eax, dword [ebp - 0x13c]
mov dword [eax + 0x74], 1
push 0
lea eax, [ebp - 0x120]
push eax
push dword [ebp - 0x120]
lea eax, [ebp - 0x108]
push eax
push dword [ebp - 0x10c]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x4a1e09
and dword [ebp - 0x110], 0
jmp 0x4a1e19
mov eax, dword [ebp - 0x13c]
cmp dword [eax + 0x74], 0
je 0x4a1d3c
cmp dword [ebp - 0x110], 0
je 0x4a1e34
mov ecx, dword [ebp - 0x13c]
call fcn.004a14f0
cmp eax, 0xc8
je 0x4a1e4d
mov ecx, dword [ebp - 0x13c]
add ecx, 0x38
call fcn.004010f3
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
xor eax, eax
jmp 0x4a1e50
xor eax, eax
inc eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00467392
leave
ret

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x403930
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov ebx, ecx
xor eax, eax
nop dword [eax + eax]
mov edx, eax
mov ecx, eax
sar edx, 5
or ecx, 0x1f
cmp ecx, 0x68
lea edi, [ebx + edx*4]
mov ecx, 9
mov esi, 0x20
cmovge esi, ecx
xor edx, edx
bts edx, esi
xor ecx, ecx
cmp esi, 0x20
cmovae ecx, edx
add eax, 0x20
xor edx, ecx
dec edx
or dword [edi], edx
cmp eax, 0x68
jle 0x403940
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4056a0
Capabilities:
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
mov edi, edx
not ebx
mov esi, ecx
mov eax, ebx
test edi, edi
je 0x405701
mov cl, byte [esi]
lea esi, [esi + 1]
dec edi
cmp cl, 0x23
jne 0x4056e4
cmp edi, 2
jb 0x4056e4
cmp byte [esi], cl
jne 0x4056e4
cmp byte [esi + 1], cl
jne 0x4056e4
mov eax, ebx
movzx ecx, cl
movzx edx, al
xor edx, ecx
shr eax, 8
xor eax, dword [edx*4 + 0x447b78]
jmp 0x4056b5
movzx edx, al
movzx ecx, cl
xor edx, ecx
shr eax, 8
xor eax, dword [edx*4 + 0x447b78]
test edi, edi
jne 0x4056b5
pop edi
pop esi
not eax
pop ebx
pop ebp
ret
mov cl, byte [esi]
inc esi
test cl, cl
je 0x405730
cmp cl, 0x23
jne 0x405717
cmp byte [esi], cl
jne 0x405717
cmp byte [esi + 1], cl
cmove eax, ebx
movzx edx, al
movzx ecx, cl
xor edx, ecx
shr eax, 8
mov cl, byte [esi]
inc esi
xor eax, dword [edx*4 + 0x447b78]
test cl, cl
jne 0x405708
pop edi
pop esi
not eax
pop ebx
pop ebp
ret
Function at 0x405840
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
test ebx, ebx
je 0x405854
mov dword [ebx], 0
mov edx, 0x4477ec
call fcn.00405740
mov esi, eax
test esi, esi
je 0x405942
mov edi, dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_ftell]
push esi
call edi
add esp, 4
mov dword [ebp - 4], eax
cmp eax, 0xffffffff
je 0x405938
push 2
push 0
push esi
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fseek]
add esp, 0xc
test eax, eax
jne 0x405938
push esi
call edi
mov edi, eax
add esp, 4
mov dword [ebp + 8], edi
cmp edi, 0xffffffff
je 0x405938
push 0
push dword [ebp - 4]
push esi
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fseek]
add esp, 0xc
test eax, eax
jne 0x405938
mov eax, dword [0x451660]
test eax, eax
je 0x4058cc
inc dword [eax + 0xa8]
push edi
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov edi, eax
add esp, 4
test edi, edi
je 0x405938
push esi
push dword [ebp + 8]
push 1
push edi
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
add esp, 0x10
push esi
cmp eax, dword [ebp + 8]
je 0x40591d
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
mov eax, dword [0x451660]
add esp, 4
test eax, eax
je 0x40590a
dec dword [eax + 0xa8]
push edi
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
add esp, 4
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
add esp, 4
test ebx, ebx
je 0x40592f
mov eax, dword [ebp + 8]
mov dword [ebx], eax
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push esi
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
add esp, 4
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x40c220
Capabilities:
Hash data with crc32

Disassembly:
mov eax, ecx
or ecx, 0xffffffff
push ebx
push esi
mov bl, byte [eax]
lea esi, [eax + 1]
test bl, bl
je 0x40c25d
push edi
or edi, 0xffffffff
cmp bl, 0x23
jne 0x40c243
cmp byte [esi], bl
jne 0x40c243
cmp byte [esi + 1], bl
cmove ecx, edi
movzx edx, cl
movzx eax, bl
mov bl, byte [esi]
xor edx, eax
shr ecx, 8
inc esi
xor ecx, dword [edx*4 + 0x447b78]
test bl, bl
jne 0x40c234
pop edi
pop esi
not ecx
pop ebx
jmp fcn.0040c1c0
Function at 0x416ab0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push ecx
push ebx
push esi
push edi
mov edi, ecx
mov ebx, edx
cmp dword [edi + 0x5250], 0
lea esi, [edi + 0x5254]
je 0x416b32
mov ecx, dword [esi + 4]
test ecx, ecx
jns 0x416aec
mov eax, ecx
cdq
sub eax, edx
sar eax, 1
add eax, ecx
xor ecx, ecx
test eax, eax
cmovg ecx, eax
push ecx
mov ecx, esi
call fcn.004185b0
push dword [ebp + 8]
mov ecx, esi
mov dword [esi], 0
push ebx
call fcn.00405ad0
mov edx, dword [esi]
mov ecx, 0x45165c
push dword [edi + 0x5250]
lea eax, [edx - 1]
neg edx
sbb edx, edx
and edx, eax
mov eax, dword [edi + 0x525c]
test eax, eax
push edx
cmovne ecx, eax
push 1
push ecx
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
add esp, 0x10
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push dword [ebp + 8]
mov ecx, esi
push ebx
call fcn.00405ad0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x416f50
Capabilities:
Hash data with crc32

Disassembly:
push ebx
mov bl, byte [ecx]
or eax, 0xffffffff
push esi
lea esi, [ecx + 1]
push edi
mov edi, dword [0x451660]
test bl, bl
je 0x416f96
or edi, 0xffffffff
cmp bl, 0x23
jne 0x416f77
cmp byte [esi], bl
jne 0x416f77
cmp byte [esi + 1], bl
cmove eax, edi
movzx edx, al
movzx ecx, bl
mov bl, byte [esi]
xor edx, ecx
shr eax, 8
inc esi
xor eax, dword [edx*4 + 0x447b78]
test bl, bl
jne 0x416f68
mov edi, dword [0x451660]
mov esi, dword [edi + 0x5214]
xor ecx, ecx
not eax
test esi, esi
jle 0x416fbc
mov edi, dword [edi + 0x521c]
lea edx, [edi + 4]
nop dword [eax]
cmp dword [edx], eax
je 0x416fc2
inc ecx
add edx, 0x24
cmp ecx, esi
jl 0x416fb0
pop edi
pop esi
xor eax, eax
pop ebx
ret
lea eax, [ecx + ecx*8]
lea eax, [edi + eax*4]
pop edi
pop esi
pop ebx
ret
Function at 0x420900
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push esi
mov esi, ecx
push edi
mov edi, dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov ecx, dword [esi + 8]
test ecx, ecx
je 0x42093a
mov eax, dword [0x451660]
mov dword [esi + 4], 0
mov dword [esi], 0
test eax, eax
je 0x42092d
dec dword [eax + 0xa8]
push ecx
call edi
add esp, 4
mov dword [esi + 8], 0
mov ecx, dword [esi + 0x14]
test ecx, ecx
je 0x42096b
mov eax, dword [0x451660]
mov dword [esi + 0x10], 0
mov dword [esi + 0xc], 0
test eax, eax
je 0x42095e
dec dword [eax + 0xa8]
push ecx
call edi
add esp, 4
mov dword [esi + 0x14], 0
mov ecx, dword [esi + 0x20]
test ecx, ecx
je 0x42099c
mov eax, dword [0x451660]
mov dword [esi + 0x1c], 0
mov dword [esi + 0x18], 0
test eax, eax
je 0x42098f
dec dword [eax + 0xa8]
push ecx
call edi
add esp, 4
mov dword [esi + 0x20], 0
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x34], 0
mov dword [esi + 0x38], 0
mov ecx, dword [esi + 0x44]
test ecx, ecx
je 0x4209e9
mov eax, dword [0x451660]
mov dword [esi + 0x40], 0
mov dword [esi + 0x3c], 0
test eax, eax
je 0x4209dc
dec dword [eax + 0xa8]
push ecx
call edi
add esp, 4
mov dword [esi + 0x44], 0
mov ecx, dword [esi + 0x50]
test ecx, ecx
je 0x420a1a
mov eax, dword [0x451660]
mov dword [esi + 0x4c], 0
mov dword [esi + 0x48], 0
test eax, eax
je 0x420a0d
dec dword [eax + 0xa8]
push ecx
call edi
add esp, 4
mov dword [esi + 0x50], 0
mov ecx, dword [esi + 0x5c]
test ecx, ecx
je 0x420a4b
mov eax, dword [0x451660]
mov dword [esi + 0x58], 0
mov dword [esi + 0x54], 0
test eax, eax
je 0x420a3e
dec dword [eax + 0xa8]
push ecx
call edi
add esp, 4
mov dword [esi + 0x5c], 0
pop edi
lea ecx, [esi + 0x78]
pop esi
jmp fcn.004231f0
Function at 0x4355d0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 0xc]
mov edx, 0x811c9dc5
push edi
mov edi, dword [ebp + 8]
mov ecx, 0
sub esi, edi
je 0x435601
nop dword [eax]
movzx eax, byte [ecx + edi]
inc ecx
xor eax, edx
imul edx, eax, 0x1000193
cmp ecx, esi
jb 0x4355f0
pop edi
mov eax, edx
pop esi
pop ebp
ret 8

Function at 0x436050
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
mov eax, 0x1fffffff
mov esi, 1
push edi
mov edi, ecx
bsr ecx, eax
mov eax, esi
mov dword [ebp - 4], edi
shl eax, cl
mov ecx, dword [ebp + 8]
cmp ecx, eax
jbe 0x436081
push str.invalid_hash_bucket_count
call dword [sym.imp.MSVCP140.dll_void___cdecl_std::_Xlength_error_char_const__]
lea eax, [ecx - 1]
mov ebx, dword [edi + 4]
or eax, 1
mov dword [ebp - 0xc], ebx
bsr ecx, eax
push ebx
lea ecx, [ecx + 1]
shl esi, cl
lea ecx, [edi + 0xc]
lea eax, [esi + esi]
push eax
call fcn.00435e90
lea eax, [esi - 1]
mov dword [edi + 0x1c], esi
mov dword [edi + 0x18], eax
mov ecx, dword [edi + 4]
mov ecx, dword [ecx]
cmp ecx, ebx
je 0x436187
mov eax, ecx
nop word [eax + eax]
movzx edx, byte [eax + 8]
xor edx, 0x811c9dc5
mov ecx, dword [ecx]
imul esi, edx, 0x1000193
movzx edx, byte [eax + 9]
xor esi, edx
movzx edx, byte [eax + 0xa]
imul esi, esi, 0x1000193
xor esi, edx
movzx edx, byte [eax + 0xb]
imul esi, esi, 0x1000193
xor esi, edx
imul edx, esi, 0x1000193
mov esi, dword [edi + 0x18]
and esi, edx
mov edx, dword [edi + 0xc]
lea ebx, [edx + esi*8]
mov esi, dword [ebx]
mov dword [ebp - 8], ebx
cmp esi, dword [ebp - 0xc]
jne 0x436112
mov dword [ebx], eax
mov dword [ebx + 4], eax
jmp 0x43617c
mov edx, dword [ebx + 4]
mov edi, dword [eax + 8]
cmp edi, dword [edx + 8]
jne 0x436149
mov edx, dword [edx]
mov dword [ebp - 0x10], edx
cmp edx, eax
je 0x436144
mov edi, dword [eax + 4]
mov ebx, dword [ebp - 0x10]
mov dword [edi], ecx
mov esi, dword [ecx + 4]
mov dword [esi], edx
mov edx, dword [edx + 4]
mov dword [edx], eax
mov dword [ebx + 4], esi
mov ebx, dword [ebp - 8]
mov dword [ecx + 4], edi
mov dword [eax + 4], edx
mov dword [ebx + 4], eax
jmp 0x436179
cmp esi, edx
je 0x43615c
nop dword [eax]
mov edx, dword [edx + 4]
cmp edi, dword [edx + 8]
je 0x436190
cmp esi, edx
jne 0x436150
mov ebx, dword [eax + 4]
mov dword [ebx], ecx
mov edi, dword [ecx + 4]
mov dword [edi], edx
mov esi, dword [edx + 4]
mov dword [esi], eax
mov dword [edx + 4], edi
mov edx, dword [ebp - 8]
mov dword [ecx + 4], ebx
mov dword [eax + 4], esi
mov dword [edx], eax
mov edi, dword [ebp - 4]
mov eax, ecx
cmp ecx, dword [ebp - 0xc]
jne 0x4360c0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
mov edi, dword [eax + 4]
mov ebx, dword [edx]
mov dword [edi], ecx
mov esi, dword [ecx + 4]
mov dword [esi], ebx
mov edx, dword [ebx + 4]
mov dword [edx], eax
mov dword [ebx + 4], esi
mov dword [ecx + 4], edi
mov dword [eax + 4], edx
jmp 0x436179
Function at 0x4361b0
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
sub esp, 0x18
mov edx, dword [ebp + 8]
push ebx
mov ebx, ecx
cmp edx, eax
je 0x436306
mov eax, dword [ebx + 4]
mov dword [ebp - 0x14], eax
mov eax, dword [edx + 4]
mov dword [ebp - 8], eax
movzx eax, byte [edx + 8]
xor eax, 0x811c9dc5
imul ecx, eax, 0x1000193
movzx eax, byte [edx + 9]
push esi
push edi
mov edi, dword [ebx + 0xc]
mov esi, edx
xor ecx, eax
mov dword [ebp - 0x18], edi
movzx eax, byte [edx + 0xa]
imul ecx, ecx, 0x1000193
xor ecx, eax
movzx eax, byte [edx + 0xb]
imul ecx, ecx, 0x1000193
xor ecx, eax
mov eax, dword [ebx + 0x18]
imul ecx, ecx, 0x1000193
and eax, ecx
mov ecx, dword [edi + eax*8]
mov dword [ebp - 4], ecx
lea eax, [edi + eax*8]
mov dword [ebp - 0xc], eax
mov eax, dword [eax + 4]
mov dword [ebp - 0x10], eax
mov eax, esi
mov edi, esi
mov esi, dword [esi]
push 0xc
push eax
call fcn.00443cf6
dec dword [ebx + 8]
add esp, 8
cmp edi, dword [ebp - 0x10]
je 0x436269
mov eax, dword [ebp + 0xc]
cmp esi, eax
jne 0x436227
mov ecx, dword [ebp - 4]
cmp ecx, dword [ebp + 8]
jne 0x4362fc
mov edx, dword [ebp - 0xc]
mov ecx, dword [ebp - 8]
pop edi
mov dword [edx], esi
mov dword [ecx], esi
mov dword [esi + 4], ecx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
mov ecx, dword [ebp - 4]
mov edx, dword [ebp - 0xc]
cmp ecx, dword [ebp + 8]
jne 0x43627d
mov eax, dword [ebp - 0x14]
mov ecx, eax
mov dword [edx], eax
jmp 0x436280
mov ecx, dword [ebp - 8]
mov eax, dword [ebp + 0xc]
mov dword [edx + 4], ecx
cmp esi, eax
je 0x4362fc
nop word [eax + eax]
movzx eax, byte [esi + 8]
xor eax, 0x811c9dc5
imul ecx, eax, 0x1000193
movzx eax, byte [esi + 9]
xor ecx, eax
movzx eax, byte [esi + 0xa]
imul ecx, ecx, 0x1000193
xor ecx, eax
movzx eax, byte [esi + 0xb]
imul ecx, ecx, 0x1000193
xor ecx, eax
mov eax, dword [ebx + 0x18]
imul ecx, ecx, 0x1000193
and eax, ecx
mov ecx, dword [ebp - 0x18]
lea eax, [ecx + eax*8]
mov dword [ebp - 4], eax
mov eax, dword [eax + 4]
mov dword [ebp - 0x10], eax
mov eax, esi
mov edi, esi
mov esi, dword [esi]
push 0xc
push eax
call fcn.00443cf6
dec dword [ebx + 8]
add esp, 8
mov eax, dword [ebp + 0xc]
cmp edi, dword [ebp - 0x10]
je 0x43630d
cmp esi, eax
jne 0x4362d7
mov ecx, dword [ebp - 4]
mov dword [ecx], esi
mov ecx, dword [ebp - 8]
pop edi
mov dword [ecx], esi
mov dword [esi + 4], ecx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
mov ecx, dword [ebp - 4]
mov edx, dword [ebp - 0x14]
mov dword [ecx], edx
mov dword [ecx + 4], edx
cmp esi, eax
jne 0x436290
mov ecx, dword [ebp - 8]
pop edi
mov dword [ecx], esi
mov dword [esi + 4], ecx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x436340
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
mov ebx, ecx
mov eax, 0x1fffffff
bsr ecx, eax
push esi
mov esi, 1
mov dword [ebp - 0xc], ebx
mov eax, esi
shl eax, cl
mov ecx, dword [ebp + 8]
push edi
cmp ecx, eax
jbe 0x436371
push str.invalid_hash_bucket_count
call dword [sym.imp.MSVCP140.dll_void___cdecl_std::_Xlength_error_char_const__]
lea eax, [ecx - 1]
or eax, 1
bsr ecx, eax
mov eax, dword [ebx + 4]
push eax
mov dword [ebp - 8], eax
lea ecx, [ecx + 1]
shl esi, cl
lea ecx, [ebx + 0xc]
lea eax, [esi + esi]
push eax
call fcn.00435e90
lea eax, [esi - 1]
mov dword [ebx + 0x1c], esi
mov dword [ebx + 0x18], eax
mov esi, dword [ebx + 4]
mov eax, dword [ebp - 8]
mov esi, dword [esi]
mov edi, esi
cmp esi, eax
je 0x436495
nop dword [eax]
cmp dword [esi + 0x1c], 0x10
lea ecx, [esi + 8]
mov edi, dword [edi]
mov edx, dword [ecx + 0x10]
mov dword [ebp - 0x14], edi
mov dword [ebp - 0x10], edx
mov dword [ebp - 4], ecx
jb 0x4363cc
mov edx, dword [ecx]
mov dword [ebp - 4], edx
xor edx, edx
mov ebx, 0x811c9dc5
cmp dword [ecx + 0x10], edx
jbe 0x4363f7
mov eax, dword [ebp - 4]
mov edi, dword [ebp - 0x10]
nop
movzx ecx, byte [edx + eax]
inc edx
xor ecx, ebx
imul ebx, ecx, 0x1000193
cmp edx, edi
jb 0x4363e0
mov edi, dword [ebp - 0x14]
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 0xc]
mov edx, dword [ecx + 0x18]
mov ecx, dword [ecx + 0xc]
and edx, ebx
lea ecx, [ecx + edx*8]
mov dword [ebp - 4], ecx
cmp dword [ecx], eax
jne 0x436413
mov dword [ecx], esi
mov dword [ecx + 4], esi
jmp 0x43648b
mov ebx, dword [ecx + 4]
lea ecx, [esi + 8]
lea edx, [ebx + 8]
call fcn.00438690
test al, al
je 0x43644b
mov ebx, dword [ebx]
cmp ebx, esi
je 0x436443
mov edx, dword [esi + 4]
mov dword [edx], edi
mov ecx, dword [edi + 4]
mov dword [ecx], ebx
mov eax, dword [ebx + 4]
mov dword [eax], esi
mov dword [ebx + 4], ecx
mov dword [edi + 4], edx
mov dword [esi + 4], eax
mov eax, dword [ebp - 4]
mov dword [eax + 4], esi
jmp 0x436488
mov eax, dword [ebp - 4]
cmp dword [eax], ebx
je 0x43646b
mov ebx, dword [ebx + 4]
lea ecx, [esi + 8]
lea edx, [ebx + 8]
call fcn.00438690
test al, al
jne 0x4364ad
mov eax, dword [ebp - 4]
cmp dword [eax], ebx
jne 0x436452
mov edx, dword [esi + 4]
mov dword [edx], edi
mov ecx, dword [edi + 4]
mov dword [ecx], ebx
mov eax, dword [ebx + 4]
mov dword [eax], esi
mov dword [ebx + 4], ecx
mov dword [edi + 4], edx
mov dword [esi + 4], eax
mov eax, dword [ebp - 4]
mov dword [eax], esi
mov eax, dword [ebp - 8]
mov esi, edi
cmp edi, eax
jne 0x4363b0
lea ecx, [ebp - 0xc]
mov dword [ebp - 0xc], 0
call fcn.00435d10
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
mov edx, dword [esi + 4]
mov ebx, dword [ebx]
mov dword [edx], edi
mov ecx, dword [edi + 4]
mov dword [ecx], ebx
mov eax, dword [ebx + 4]
mov dword [eax], esi
mov dword [ebx + 4], ecx
mov dword [edi + 4], edx
mov dword [esi + 4], eax
jmp 0x436488
Function at 0x4364d0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
mov eax, 0x1fffffff
mov esi, 1
push edi
mov edi, ecx
bsr ecx, eax
mov eax, esi
mov dword [ebp - 0x10], edi
shl eax, cl
mov ecx, dword [ebp + 8]
cmp ecx, eax
jbe 0x436501
push str.invalid_hash_bucket_count
call dword [sym.imp.MSVCP140.dll_void___cdecl_std::_Xlength_error_char_const__]
lea eax, [ecx - 1]
mov ebx, dword [edi + 4]
or eax, 1
mov dword [ebp - 8], ebx
bsr ecx, eax
push ebx
lea ecx, [ecx + 1]
shl esi, cl
lea ecx, [edi + 0xc]
lea eax, [esi + esi]
push eax
call fcn.00435e90
lea eax, [esi - 1]
mov dword [edi + 0x1c], esi
mov dword [edi + 0x18], eax
mov edi, dword [edi + 4]
mov edi, dword [edi]
cmp edi, ebx
je 0x436621
mov esi, edi
nop word [eax + eax]
cmp dword [esi + 0x1c], 0x10
lea ebx, [esi + 8]
mov edi, dword [edi]
mov ecx, dword [esi + 0x18]
mov dword [ebp - 0xc], edi
mov dword [ebp - 4], ecx
jb 0x436557
mov ebx, dword [esi + 8]
xor ecx, ecx
mov edx, 0x811c9dc5
cmp dword [esi + 0x18], ecx
jbe 0x43657a
mov edi, dword [ebp - 4]
movzx eax, byte [ecx + ebx]
inc ecx
xor eax, edx
imul edx, eax, 0x1000193
cmp ecx, edi
jb 0x436566
mov edi, dword [ebp - 0xc]
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax + 0x18]
mov eax, dword [eax + 0xc]
and ecx, edx
lea eax, [eax + ecx*8]
mov ecx, dword [ebp - 8]
mov dword [ebp - 4], eax
cmp dword [eax], ecx
jne 0x436599
mov dword [eax], esi
mov dword [eax + 4], esi
jmp 0x436616
mov ebx, dword [eax + 4]
lea ecx, [esi + 8]
lea edx, [ebx + 8]
call fcn.00438690
test al, al
je 0x4365d1
mov ebx, dword [ebx]
cmp ebx, esi
je 0x4365c9
mov edx, dword [esi + 4]
mov dword [edx], edi
mov ecx, dword [edi + 4]
mov dword [ecx], ebx
mov eax, dword [ebx + 4]
mov dword [eax], esi
mov dword [ebx + 4], ecx
mov dword [edi + 4], edx
mov dword [esi + 4], eax
mov eax, dword [ebp - 4]
mov dword [eax + 4], esi
jmp 0x436616
mov eax, dword [ebp - 4]
cmp dword [eax], ebx
je 0x4365f9
nop dword [eax + eax]
mov ebx, dword [ebx + 4]
lea ecx, [esi + 8]
lea edx, [ebx + 8]
call fcn.00438690
test al, al
jne 0x43662a
mov eax, dword [ebp - 4]
cmp dword [eax], ebx
jne 0x4365e0
mov edx, dword [esi + 4]
mov dword [edx], edi
mov ecx, dword [edi + 4]
mov dword [ecx], ebx
mov eax, dword [ebx + 4]
mov dword [eax], esi
mov dword [ebx + 4], ecx
mov dword [edi + 4], edx
mov dword [esi + 4], eax
mov eax, dword [ebp - 4]
mov dword [eax], esi
mov esi, edi
cmp edi, dword [ebp - 8]
jne 0x436540
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
mov edx, dword [esi + 4]
mov ebx, dword [ebx]
mov dword [edx], edi
mov ecx, dword [edi + 4]
mov dword [ecx], ebx
mov eax, dword [ebx + 4]
mov dword [eax], esi
mov dword [ebx + 4], ecx
mov dword [edi + 4], edx
mov dword [esi + 4], eax
jmp 0x436616
Function at 0x436650
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
mov dword [ebp - 8], ecx
cmp edx, eax
je 0x4367ec
cmp dword [edx + 0x1c], 0x10
mov eax, dword [ecx + 4]
push esi
mov dword [ebp - 0x1c], eax
mov esi, edx
mov eax, dword [ecx + 0xc]
push edi
mov dword [ebp - 0x18], eax
lea edi, [edx + 8]
mov eax, dword [edx + 4]
mov dword [ebp - 0xc], eax
mov eax, dword [edi + 0x10]
jb 0x43668b
mov edi, dword [edi]
xor edx, edx
push ebx
mov ebx, 0x811c9dc5
test eax, eax
je 0x4366b4
mov ecx, eax
nop dword [eax]
movzx eax, byte [edx + edi]
inc edx
xor eax, ebx
imul ebx, eax, 0x1000193
cmp edx, ecx
jb 0x4366a0
mov ecx, dword [ebp - 8]
mov eax, dword [ecx + 0x18]
mov ecx, dword [ebp - 0x18]
and eax, ebx
lea eax, [ecx + eax*8]
mov ecx, dword [eax]
mov dword [ebp - 0x10], eax
mov eax, dword [eax + 4]
mov dword [ebp - 4], ecx
mov dword [ebp - 0x14], eax
nop dword [eax]
mov edi, esi
mov ebx, esi
mov esi, dword [esi]
lea edx, [edi + 8]
call fcn.004398e0
push 0x40
push edi
call fcn.00443cf6
mov eax, dword [ebp - 8]
add esp, 8
dec dword [eax + 8]
cmp ebx, dword [ebp - 0x14]
je 0x436719
mov eax, dword [ebp + 0xc]
cmp esi, eax
jne 0x4366d0
mov ecx, dword [ebp - 4]
cmp ecx, dword [ebp + 8]
jne 0x436708
mov edx, dword [ebp - 0x10]
mov dword [edx], esi
mov ecx, dword [ebp - 0xc]
pop ebx
pop edi
mov dword [ecx], esi
mov dword [esi + 4], ecx
pop esi
mov esp, ebp
pop ebp
ret 8
mov ecx, dword [ebp - 4]
mov edx, dword [ebp - 0x10]
cmp ecx, dword [ebp + 8]
jne 0x43672b
mov ecx, dword [ebp - 0x1c]
mov dword [edx], ecx
jmp 0x43672e
mov ecx, dword [ebp - 0xc]
mov dword [edx + 4], ecx
mov ecx, dword [ebp + 0xc]
cmp esi, ecx
je 0x4367df
nop dword [eax]
cmp dword [esi + 0x1c], 0x10
lea edx, [esi + 8]
mov ebx, dword [edx + 0x10]
jb 0x43674e
mov edx, dword [edx]
xor ecx, ecx
mov edi, 0x811c9dc5
test ebx, ebx
je 0x436774
nop dword [eax]
movzx eax, byte [ecx + edx]
inc ecx
xor eax, edi
imul edi, eax, 0x1000193
cmp ecx, ebx
jb 0x436760
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x18]
mov ecx, dword [ebp - 0x18]
and eax, edi
lea eax, [ecx + eax*8]
mov dword [ebp - 4], eax
mov eax, dword [eax + 4]
mov dword [ebp - 0x14], eax
mov edi, esi
mov ebx, esi
mov esi, dword [esi]
lea edx, [edi + 8]
call fcn.004398e0
push 0x40
push edi
call fcn.00443cf6
mov eax, dword [ebp - 8]
add esp, 8
dec dword [eax + 8]
cmp ebx, dword [ebp - 0x14]
je 0x4367c9
mov eax, dword [ebp + 0xc]
cmp esi, eax
jne 0x436788
mov ecx, dword [ebp - 4]
pop ebx
pop edi
mov dword [ecx], esi
mov ecx, dword [ebp - 0xc]
mov dword [ecx], esi
mov dword [esi + 4], ecx
pop esi
mov esp, ebp
pop ebp
ret 8
mov ecx, dword [ebp - 4]
mov edi, dword [ebp - 0x1c]
mov dword [ecx], edi
mov dword [ecx + 4], edi
mov ecx, dword [ebp + 0xc]
cmp esi, ecx
jne 0x436740
mov eax, dword [ebp - 0xc]
pop ebx
pop edi
mov dword [eax], esi
mov dword [esi + 4], eax
mov eax, ecx
pop esi
mov esp, ebp
pop ebp
ret 8