joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4197e0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x50f830
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x10
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
mov eax, ecx
mov dword [ebp - 0x10], esp
mov esi, edi
mov dword [ebp - 0x14], eax
mov dword [ebp - 4], 0
cmp dword [edi + 0x14], 0x10
mov ebx, dword [edi + 0x10]
jb 0x41981d
mov esi, dword [edi]
xor ecx, ecx
mov edx, 0x811c9dc5
test ebx, ebx
je 0x41983c
movzx eax, byte [ecx + esi]
inc ecx
xor eax, edx
imul edx, eax, 0x1000193
cmp ecx, ebx
jb 0x419828
mov eax, dword [ebp - 0x14]
mov eax, dword [eax + 0x18]
mov esi, dword [ebp - 0x14]
and eax, edx
lea ecx, [eax*8]
mov eax, dword [esi + 0xc]
mov esi, dword [esi + 4]
add eax, ecx
mov dword [ebp + 0xc], ecx
mov dword [ebp - 0x18], eax
cmp esi, dword [eax]
je 0x4198b0
mov esi, dword [eax + 4]
mov esi, dword [esi]
cmp esi, dword [eax]
je 0x4198b0
mov esi, dword [esi + 4]
cmp dword [esi + 0x1c], 0x10
lea eax, [esi + 8]
mov edx, dword [eax + 0x10]
jb 0x419877
mov eax, dword [eax]
cmp dword [edi + 0x14], 0x10
mov ecx, edi
jb 0x419881
mov ecx, dword [edi]
push edx
push eax
push ebx
push ecx
call fcn.00404640
add esp, 0x10
test al, al
mov eax, dword [ebp - 0x18]
je 0x419862
mov eax, dword [ebp + 8]
mov dword [eax], esi
mov byte [eax + 4], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov ebx, dword [ebp - 0x14]
mov eax, dword [ebx + 4]
lea ecx, [ebx + 4]
push edi
mov dword [ebp - 4], 0xffffffff
mov eax, dword [eax]
mov dword [ebp - 0x18], eax
mov edx, dword [eax + 4]
push edx
push eax
mov dword [ebp - 0x1c], edx
call fcn.00419110
mov edx, eax
mov ecx, 0x71c71c6
mov eax, dword [ebx + 8]
sub ecx, eax
cmp ecx, 1
jb 0x4199b6
inc eax
mov dword [ebx + 8], eax
mov eax, dword [ebp - 0x18]
mov dword [eax + 4], edx
mov eax, dword [ebp - 0x1c]
mov dword [eax], edx
mov edx, dword [ebx + 4]
mov edi, dword [edx]
mov dword [ebp - 0x1c], edi
mov eax, dword [edi]
cmp esi, eax
je 0x419929
mov ecx, dword [edi + 4]
mov dword [ecx], eax
mov ecx, dword [eax + 4]
mov dword [ecx], esi
mov ecx, dword [esi + 4]
mov dword [ecx], edi
mov edx, dword [esi + 4]
mov ecx, dword [eax + 4]
mov dword [esi + 4], ecx
mov ecx, dword [edi + 4]
mov dword [eax + 4], ecx
mov dword [edi + 4], edx
mov edx, dword [ebx + 4]
mov ecx, dword [ebp + 0xc]
add ecx, dword [ebx + 0xc]
mov eax, dword [ecx]
cmp eax, edx
jne 0x419943
mov dword [ecx], edi
mov eax, dword [ebx + 0xc]
mov ecx, dword [ebp + 0xc]
mov dword [eax + ecx + 4], edi
jmp 0x419966
cmp eax, esi
jne 0x41994b
mov dword [ecx], edi
jmp 0x419966
mov eax, dword [ecx + 4]
mov eax, dword [eax]
mov dword [ecx + 4], eax
cmp eax, edi
je 0x419966
mov ecx, dword [ebp + 0xc]
add ecx, dword [ebx + 0xc]
mov eax, dword [ecx + 4]
mov eax, dword [eax + 4]
mov dword [ecx + 4], eax
mov ecx, ebx
mov dword [ebp - 4], 2
call fcn.0041cde0
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
mov dword [eax], edi
pop edi
pop esi
mov byte [eax + 4], 1
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret 0xc
push 0x51c4dc
call fcn.004ca32a
int3
Function at 0x41a4d0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 0xc]
cmp dword [eax + 0x1c], 0x10
push ebx
mov ebx, dword [eax + 0x18]
push esi
lea esi, [eax + 8]
mov dword [ebp - 4], ecx
push edi
jb 0x41a4eb
mov esi, dword [esi]
xor edx, edx
mov edi, 0x811c9dc5
test ebx, ebx
je 0x41a507
movzx ecx, byte [edx + esi]
inc edx
xor ecx, edi
imul edi, ecx, 0x1000193
cmp edx, ebx
jb 0x41a4f6
mov ebx, dword [ebp - 4]
mov ecx, dword [ebx + 0x18]
mov edx, dword [ebx + 0xc]
and ecx, edi
lea esi, [ecx*8]
mov ecx, dword [edx + esi]
add edx, esi
cmp dword [edx + 4], eax
jne 0x41a540
cmp ecx, eax
jne 0x41a538
mov ecx, dword [ebx + 4]
mov dword [edx], ecx
mov edx, dword [ebx + 0xc]
mov ecx, dword [ebx + 4]
mov dword [esi + edx + 4], ecx
jmp 0x41a548
mov ecx, dword [eax + 4]
mov dword [edx + 4], ecx
jmp 0x41a548
cmp ecx, eax
jne 0x41a548
mov ecx, dword [eax]
mov dword [edx], ecx
mov edx, dword [eax + 4]
lea ecx, [ebx + 4]
mov edi, dword [eax]
push eax
mov dword [edx], edi
mov esi, dword [eax]
mov edx, dword [eax + 4]
mov dword [esi + 4], edx
dec dword [ecx + 4]
call fcn.0041d530
mov eax, dword [ebp + 8]
mov dword [eax], edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x41ead0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
mov esi, edi
mov dword [ebp - 8], ecx
cmp dword [edi + 0x14], 0x10
mov ebx, dword [edi + 0x10]
mov dword [ebp - 4], ebx
jb 0x41eaef
mov esi, dword [edi]
xor ecx, ecx
mov edx, 0x811c9dc5
test ebx, ebx
je 0x41eb11
nop word [eax + eax]
movzx eax, byte [ecx + esi]
inc ecx
xor eax, edx
imul edx, eax, 0x1000193
cmp ecx, ebx
jb 0x41eb00
mov ebx, dword [ebp - 8]
mov eax, dword [ebx + 0x18]
mov ecx, dword [ebx + 0xc]
and eax, edx
mov ebx, dword [ebx + 4]
mov edx, dword [ecx + eax*8]
lea eax, [eax*8 + 4]
add eax, ecx
mov dword [ebp - 8], edx
mov esi, edx
mov dword [ebp - 0xc], eax
cmp edx, ebx
jne 0x41eb3b
mov eax, ebx
jmp 0x41eb3f
mov eax, dword [eax]
mov eax, dword [eax]
cmp esi, eax
je 0x41ebaa
cmp dword [edi + 0x14], 0x10
lea eax, [esi + 8]
mov ecx, edi
jb 0x41eb50
mov ecx, dword [edi]
mov edi, dword [eax + 0x14]
cmp edi, 0x10
mov edx, dword [eax + 0x10]
mov dword [ebp - 0x10], edi
mov edi, dword [ebp + 0xc]
mov dword [ebp - 0x14], edx
jb 0x41eb66
mov eax, dword [eax]
push dword [ebp - 4]
push ecx
push edx
push eax
call fcn.00404640
add esp, 0x10
test al, al
jne 0x41eb82
mov esi, dword [esi]
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 0xc]
jmp 0x41eb33
cmp dword [ebp - 0x10], 0x10
lea eax, [esi + 8]
jb 0x41eb8d
mov eax, dword [eax]
cmp dword [edi + 0x14], 0x10
jb 0x41eb95
mov edi, dword [edi]
push dword [ebp - 0x14]
push eax
push dword [ebp - 4]
push edi
call fcn.00404640
add esp, 0x10
test al, al
cmovne ebx, esi
mov eax, dword [ebp + 8]
pop edi
pop esi
mov dword [eax], ebx
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x425890
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
mov esi, edi
mov dword [ebp - 4], ecx
cmp dword [edi + 0x14], 0x10
mov ebx, dword [edi + 0x10]
jb 0x4258ac
mov esi, dword [edi]
xor ecx, ecx
mov edx, 0x811c9dc5
test ebx, ebx
je 0x4258c8
movzx eax, byte [ecx + esi]
inc ecx
xor eax, edx
imul edx, eax, 0x1000193
cmp ecx, ebx
jb 0x4258b7
mov ebx, dword [ebp - 4]
mov eax, dword [ebx + 0x18]
mov ecx, dword [ebx + 0xc]
and eax, edx
mov ebx, dword [ebx + 4]
mov edx, dword [ecx + eax*8]
lea eax, [eax*8 + 4]
add eax, ecx
mov dword [ebp - 8], edx
mov esi, edx
mov dword [ebp - 0xc], eax
nop word [eax + eax]
cmp edx, ebx
jne 0x4258f8
mov eax, ebx
jmp 0x4258fc
mov eax, dword [eax]
mov eax, dword [eax]
cmp esi, eax
je 0x42596f
cmp dword [edi + 0x14], 0x10
lea eax, [esi + 8]
mov ecx, edi
jb 0x42590d
mov ecx, dword [edi]
mov edi, dword [eax + 0x14]
cmp edi, 0x10
mov edx, dword [eax + 0x10]
mov dword [ebp - 0x10], edi
mov edi, dword [ebp + 0xc]
mov dword [ebp - 0x14], edx
jb 0x425923
mov eax, dword [eax]
push dword [edi + 0x10]
push ecx
push edx
push eax
call fcn.00404640
add esp, 0x10
test al, al
jne 0x42593f
mov esi, dword [esi]
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 0xc]
jmp 0x4258f0
cmp dword [ebp - 0x10], 0x10
lea eax, [esi + 8]
jb 0x42594a
mov eax, dword [eax]
cmp dword [edi + 0x14], 0x10
mov ecx, edi
jb 0x425954
mov ecx, dword [edi]
push dword [ebp - 0x14]
push eax
push dword [edi + 0x10]
push ecx
call fcn.00404640
add esp, 0x10
mov ecx, ebx
test al, al
cmovne ecx, esi
mov eax, ecx
jmp 0x425973
mov ecx, ebx
mov eax, ebx
cmp eax, ebx
jne 0x4259d3
mov esi, dword [ebx]
lea eax, [ebp + 0xf]
mov ebx, dword [ebp - 4]
push eax
lea eax, [ebp - 0x14]
mov dword [ebp - 0x14], edi
mov edi, dword [esi + 4]
push eax
push 0x51dce3
push edi
push esi
lea ecx, [ebx + 4]
call fcn.004255b0
mov edx, eax
mov ecx, 0x2aaaaa9
mov eax, dword [ebx + 8]
sub ecx, eax
cmp ecx, 1
jb 0x4259e5
inc eax
mov ecx, ebx
mov dword [ebx + 8], eax
mov dword [esi + 4], edx
mov esi, dword [ebp + 8]
mov dword [edi], edx
mov eax, dword [ebx + 4]
mov eax, dword [eax]
push eax
add eax, 8
push eax
push esi
call fcn.00425660
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
mov eax, dword [ebp + 8]
pop edi
pop esi
pop ebx
mov dword [eax], ecx
mov byte [eax + 4], 0
mov esp, ebp
pop ebp
ret 8
push 0x51c4dc
call fcn.004ca32a
int3
Function at 0x4259f0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 0xc]
cmp dword [eax + 0x1c], 0x10
push ebx
mov ebx, dword [eax + 0x18]
push esi
lea esi, [eax + 8]
mov dword [ebp - 4], ecx
push edi
jb 0x425a0b
mov esi, dword [esi]
xor edx, edx
mov edi, 0x811c9dc5
test ebx, ebx
je 0x425a27
movzx ecx, byte [edx + esi]
inc edx
xor ecx, edi
imul edi, ecx, 0x1000193
cmp edx, ebx
jb 0x425a16
mov ebx, dword [ebp - 4]
mov ecx, dword [ebx + 0x18]
mov edx, dword [ebx + 0xc]
and ecx, edi
lea esi, [ecx*8]
mov ecx, dword [edx + esi]
add edx, esi
cmp dword [edx + 4], eax
jne 0x425a60
cmp ecx, eax
jne 0x425a58
mov ecx, dword [ebx + 4]
mov dword [edx], ecx
mov edx, dword [ebx + 0xc]
mov ecx, dword [ebx + 4]
mov dword [esi + edx + 4], ecx
jmp 0x425a68
mov ecx, dword [eax + 4]
mov dword [edx + 4], ecx
jmp 0x425a68
cmp ecx, eax
jne 0x425a68
mov ecx, dword [eax]
mov dword [edx], ecx
mov edx, dword [eax + 4]
lea ecx, [ebx + 4]
mov edi, dword [eax]
push eax
mov dword [edx], edi
mov esi, dword [eax]
mov edx, dword [eax + 4]
mov dword [esi + 4], edx
dec dword [ecx + 4]
call fcn.0040f7f0
mov eax, dword [ebp + 8]
mov dword [eax], edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x427580
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
mov esi, edi
mov dword [ebp - 4], ecx
cmp dword [edi + 0x14], 0x10
mov ebx, dword [edi + 0x10]
mov dword [ebp - 8], ebx
jb 0x42759f
mov esi, dword [edi]
xor ecx, ecx
mov edx, 0x811c9dc5
test ebx, ebx
je 0x4275c1
nop word [eax + eax]
movzx eax, byte [ecx + esi]
inc ecx
xor eax, edx
imul edx, eax, 0x1000193
cmp ecx, ebx
jb 0x4275b0
mov ebx, dword [ebp - 4]
mov eax, dword [ebx + 0x18]
mov ecx, dword [ebx + 0xc]
and eax, edx
mov ebx, dword [ebx + 4]
mov edx, dword [ecx + eax*8]
lea eax, [eax*8 + 4]
add eax, ecx
mov dword [ebp - 0xc], edx
mov esi, edx
mov dword [ebp - 0x10], eax
cmp edx, ebx
jne 0x4275eb
mov eax, ebx
jmp 0x4275ef
mov eax, dword [eax]
mov eax, dword [eax]
cmp esi, eax
je 0x42769b
cmp dword [edi + 0x14], 0x10
lea ecx, [esi + 8]
mov edx, edi
jb 0x427604
mov edx, dword [edi]
cmp dword [ecx + 0x14], 0x10
mov edi, dword [ecx + 0x10]
jb 0x42760f
mov ecx, dword [ecx]
cmp edi, dword [ebp - 8]
jne 0x427670
sub edi, 4
jb 0x427631
nop dword [eax]
mov eax, dword [ecx]
cmp eax, dword [edx]
jne 0x427636
add ecx, 4
add edx, 4
sub edi, 4
jae 0x427620
cmp edi, 0xfffffffc
je 0x42766a
mov al, byte [ecx]
cmp al, byte [edx]
jne 0x427663
cmp edi, 0xfffffffd
je 0x42766a
mov al, byte [ecx + 1]
cmp al, byte [edx + 1]
jne 0x427663
cmp edi, 0xfffffffe
je 0x42766a
mov al, byte [ecx + 2]
cmp al, byte [edx + 2]
jne 0x427663
cmp edi, 0xffffffff
je 0x42766a
mov al, byte [ecx + 3]
cmp al, byte [edx + 3]
je 0x42766a
sbb eax, eax
or eax, 1
jmp 0x42766c
xor eax, eax
test eax, eax
je 0x427680
mov esi, dword [esi]
mov edi, dword [ebp + 0xc]
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 0x10]
jmp 0x4275e3
mov edi, dword [ebp + 0xc]
lea eax, [esi + 8]
mov ecx, dword [ebp - 4]
push eax
push edi
call fcn.00408730
test al, al
mov ecx, ebx
cmove ecx, esi
mov eax, ecx
jmp 0x42769f
mov ecx, ebx
mov eax, ebx
cmp eax, ebx
jne 0x4276ff
mov esi, dword [ebx]
lea eax, [ebp + 0xf]
mov ebx, dword [ebp - 4]
push eax
lea eax, [ebp - 0x10]
mov dword [ebp - 0x10], edi
mov edi, dword [esi + 4]
push eax
push 0x51dce3
push edi
push esi
lea ecx, [ebx + 4]
call fcn.004270b0
mov edx, eax
mov ecx, 0x4ec4ec3
mov eax, dword [ebx + 8]
sub ecx, eax
cmp ecx, 1
jb 0x427711
inc eax
mov ecx, ebx
mov dword [ebx + 8], eax
mov dword [esi + 4], edx
mov esi, dword [ebp + 8]
mov dword [edi], edx
mov eax, dword [ebx + 4]
mov eax, dword [eax]
push eax
add eax, 8
push eax
push esi
call fcn.00427260
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
mov eax, dword [ebp + 8]
pop edi
pop esi
pop ebx
mov dword [eax], ecx
mov byte [eax + 4], 0
mov esp, ebp
pop ebp
ret 8
push 0x51c4dc
call fcn.004ca32a
int3
Function at 0x427c20
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 0xc]
cmp dword [eax + 0x1c], 0x10
push ebx
mov ebx, dword [eax + 0x18]
push esi
lea esi, [eax + 8]
mov dword [ebp - 4], ecx
push edi
jb 0x427c3b
mov esi, dword [esi]
xor edx, edx
mov edi, 0x811c9dc5
test ebx, ebx
je 0x427c57
movzx ecx, byte [edx + esi]
inc edx
xor ecx, edi
imul edi, ecx, 0x1000193
cmp edx, ebx
jb 0x427c46
mov ebx, dword [ebp - 4]
mov ecx, dword [ebx + 0x18]
mov edx, dword [ebx + 0xc]
and ecx, edi
lea esi, [ecx*8]
mov ecx, dword [edx + esi]
add edx, esi
cmp dword [edx + 4], eax
jne 0x427c90
cmp ecx, eax
jne 0x427c88
mov ecx, dword [ebx + 4]
mov dword [edx], ecx
mov edx, dword [ebx + 0xc]
mov ecx, dword [ebx + 4]
mov dword [esi + edx + 4], ecx
jmp 0x427c98
mov ecx, dword [eax + 4]
mov dword [edx + 4], ecx
jmp 0x427c98
cmp ecx, eax
jne 0x427c98
mov ecx, dword [eax]
mov dword [edx], ecx
mov edx, dword [eax + 4]
lea ecx, [ebx + 4]
mov edi, dword [eax]
push eax
mov dword [edx], edi
mov esi, dword [eax]
mov edx, dword [eax + 4]
mov dword [esi + 4], edx
dec dword [ecx + 4]
call fcn.0042aff0
mov eax, dword [ebp + 8]
mov dword [eax], edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x430c80
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x51104c
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebx
mov dword [ebp - 0x10], 0
push esi
mov esi, dword [ebp + 8]
push edi
mov dword [esi + 0x28], 0x525df4
mov dword [esi + 0x30], 0x519e60
mov edi, dword [ebp + 0xc]
lea eax, [esi + 4]
xorps xmm0, xmm0
mov dword [esi], 0x519de8
push eax
movq qword [eax], xmm0
lea eax, [edi + 4]
mov dword [ebp - 0x10], 2
push eax
call fcn.004e43eb
mov dword [esi], 0x51fcf0
add esp, 8
mov eax, dword [edi + 0xc]
mov dword [esi + 0xc], eax
mov eax, dword [edi + 0x10]
mov dword [esi + 0x10], eax
lea ebx, [esi + 0x14]
mov dword [ebp - 4], 1
mov dword [ebx], 0x519e58
mov ecx, dword [edi + 0x18]
mov dword [ebx + 4], ecx
test ecx, ecx
je 0x430d0c
mov eax, dword [ecx]
call dword [eax + 0xc]
mov eax, dword [edi + 0x1c]
mov dword [ebx + 8], eax
mov eax, dword [edi + 0x20]
mov dword [ebx + 0xc], eax
mov eax, dword [edi + 0x24]
mov dword [ebx + 0x10], eax
mov eax, dword [esi + 0x28]
mov dword [esi], 0x525dd4
mov dword [ebx], 0x525de0
mov dword [ebp - 4], 2
mov eax, dword [eax + 4]
mov dword [eax + esi + 0x28], 0x525de8
lea eax, [edi + 0x14]
mov ecx, dword [esi + 0x28]
push eax
push ebx
mov edx, dword [ecx + 4]
lea ecx, [edx - 8]
mov dword [edx + esi + 0x24], ecx
call fcn.00410d40
mov ecx, dword [ebp - 0xc]
add esp, 8
mov eax, esi
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x430ef0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
mov eax, dword fs:[0]
xorps xmm0, xmm0
push 0xffffffffffffffff
push 0x50e528
push eax
mov dword fs:[0], esp
push esi
mov esi, dword [ebp + 0xc]
push edi
mov edi, dword [ebp + 8]
lea eax, [edi + 4]
push eax
mov dword [edi], 0x519de8
movq qword [eax], xmm0
lea eax, [esi + 4]
push eax
call fcn.004e43eb
add esp, 8
mov dword [edi], 0x519f9c
lea ecx, [edi + 0x14]
mov eax, dword [esi + 0xc]
mov dword [edi + 0xc], eax
mov eax, dword [esi + 0x10]
mov dword [edi + 0x10], eax
lea eax, [esi + 0x14]
push eax
mov dword [ebp - 4], 0
call fcn.00405900
mov ecx, dword [ebp - 0xc]
mov eax, edi
mov dword [edi + 0x2c], 0x519e58
mov dword [edi + 0x30], 0
mov dword [edi + 0x34], 0
mov dword [edi + 0x38], 0
mov dword [edi + 0x3c], 0xffffffff
mov dword [edi], 0x525d28
mov dword [edi + 0x2c], 0x525d34
pop edi
mov dword fs:[0], ecx
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x432150
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x511380
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push esi
mov esi, ecx
xorps xmm0, xmm0
push edi
mov edi, dword [ebp + 8]
lea eax, [esi + 4]
mov dword [ebp - 0x10], esi
mov dword [esi], 0x519de8
push eax
movq qword [eax], xmm0
lea eax, [edi + 4]
push eax
call fcn.004e43eb
add esp, 8
mov dword [esi], 0x519f9c
lea ecx, [esi + 0x14]
mov eax, dword [edi + 0xc]
mov dword [esi + 0xc], eax
mov eax, dword [edi + 0x10]
mov dword [esi + 0x10], eax
lea eax, [edi + 0x14]
push eax
mov dword [ebp - 4], 0
call fcn.00405900
mov dword [esi], 0x51fb50
mov dword [esi + 0x2c], 0x519e58
mov ecx, dword [edi + 0x30]
mov dword [ebp - 4], 1
mov dword [esi + 0x30], ecx
test ecx, ecx
je 0x4321d8
mov eax, dword [ecx]
call dword [eax + 0xc]
mov eax, dword [edi + 0x34]
mov ecx, dword [ebp - 0xc]
mov dword [esi + 0x34], eax
mov eax, dword [edi + 0x38]
mov dword [esi + 0x38], eax
mov eax, dword [edi + 0x3c]
mov dword [esi + 0x3c], eax
mov eax, esi
mov dword [esi], 0x525d28
mov dword [esi + 0x2c], 0x525d34
pop edi
pop esi
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 4
Function at 0x433820
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x511724
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x34
push esi
push edi
mov edi, ecx
mov dword [ebp - 0x10], edi
mov dword [edi], 0x51fb7c
mov dword [edi + 4], 0
mov dword [edi + 8], 0
lea esi, [edi + 0x10]
mov dword [edi + 0xc], 0
mov ecx, esi
mov dword [ebp - 4], 0
mov dword [ebp - 0x14], esi
mov dword [esi], 0
mov dword [esi + 4], 0
call fcn.0043d030
mov dword [esi], eax
mov dword [edi + 0x18], 0
mov dword [edi + 0x1c], 0
mov dword [edi + 0x20], 0
mov dword [edi + 0x24], 0
mov dword [edi + 0x28], 0
mov dword [edi + 0x2c], 0
mov dword [edi + 0x30], 0
push 0
push 0
push 1
push 0
mov byte [ebp - 4], 3
call dword [0x5193b8]
test eax, eax
je 0x4338e0
mov ecx, dword [ebp - 0xc]
mov dword [edi + 0x34], eax
mov eax, edi
mov byte [edi + 0x38], 1
pop edi
pop esi
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
lea ecx, [ebp - 0x40]
call fcn.00406c40
push eax
mov byte [ebp - 4], 4
call fcn.00405200
int3

Function at 0x444fa0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 8]
mov edx, ecx
push ebx
push esi
push edi
mov esi, dword [ecx + 0x14]
cmp esi, 0x10
jb 0x444fb5
mov edx, dword [ecx]
mov eax, dword [ecx + 0x10]
add eax, edx
cmp esi, 0x10
jb 0x444fc1
mov ecx, dword [ecx]
mov edx, eax
xor esi, esi
sub edx, ecx
xor edi, edi
xor ebx, ebx
cmp ecx, eax
cmova edx, esi
mov dword [ebp + 8], edx
test edx, edx
je 0x444ff9
movsx edx, byte [ecx]
lea ecx, [ecx + 1]
mov esi, edi
mov eax, edi
shl esi, 6
add edx, 0x9e3779b9
shr eax, 2
inc ebx
add esi, eax
add edx, esi
xor edi, edx
cmp ebx, dword [ebp + 8]
jne 0x444fd7
mov eax, edi
pop edi
pop esi
pop ebx
pop ebp
ret 4
Function at 0x456950
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x513b30
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xc
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
mov ebx, ecx
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x18], ebx
mov dword [ebp - 4], 0
movzx eax, byte [edi]
xor eax, 0x811c9dc5
mov esi, dword [ebx + 4]
imul edx, eax, 0x1000193
movzx eax, byte [edi + 1]
xor edx, eax
movzx eax, byte [edi + 2]
imul ecx, edx, 0x1000193
xor ecx, eax
movzx eax, byte [edi + 3]
imul ecx, ecx, 0x1000193
xor ecx, eax
imul eax, ecx, 0x1000193
mov ecx, dword [ebx + 0x18]
and ecx, eax
lea edx, [ecx*8]
mov ecx, dword [ebx + 0xc]
mov dword [ebp + 0xc], edx
mov eax, dword [ecx + edx]
cmp esi, eax
je 0x456a1e
mov esi, dword [ecx + edx + 4]
mov esi, dword [esi]
cmp esi, eax
je 0x456a1e
mov esi, dword [esi + 4]
mov ecx, dword [edi]
cmp ecx, dword [esi + 8]
jne 0x4569d4
mov edx, dword [ebp + 0x10]
push 0xc
push edx
mov ecx, dword [edx + 4]
mov eax, dword [edx]
mov dword [ecx], eax
mov ecx, dword [edx]
mov eax, dword [edx + 4]
mov dword [ecx + 4], eax
dec dword [ebx + 8]
call fcn.004cd104
mov eax, dword [ebp + 8]
add esp, 8
mov dword [eax], esi
mov byte [eax + 4], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov edi, dword [ebp + 0x10]
mov dword [ebp - 0x14], edi
mov eax, dword [edi]
cmp esi, eax
je 0x456a4e
mov ecx, dword [edi + 4]
mov dword [ecx], eax
mov ecx, dword [eax + 4]
mov dword [ecx], esi
mov ecx, dword [esi + 4]
mov dword [ecx], edi
mov edx, dword [esi + 4]
mov ecx, dword [eax + 4]
mov dword [esi + 4], ecx
mov ecx, dword [edi + 4]
mov dword [eax + 4], ecx
mov dword [edi + 4], edx
mov edx, dword [ebp + 0xc]
mov ecx, dword [ebx + 0xc]
add ecx, edx
mov eax, dword [ecx]
cmp eax, dword [ebx + 4]
jne 0x456a65
mov dword [ecx], edi
mov eax, dword [ebx + 0xc]
mov dword [edx + eax + 4], edi
jmp 0x456a87
cmp eax, esi
jne 0x456a6d
mov dword [ecx], edi
jmp 0x456a87
mov eax, dword [ecx + 4]
mov eax, dword [eax]
mov dword [ecx + 4], eax
cmp eax, edi
je 0x456a87
mov ecx, dword [ebx + 0xc]
mov eax, dword [ecx + edx + 4]
mov eax, dword [eax + 4]
mov dword [ecx + edx + 4], eax
mov ecx, ebx
mov dword [ebp - 4], 2
call fcn.004597e0
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
mov dword [eax], edi
pop edi
pop esi
mov byte [eax + 4], 1
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x4575c0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 0xc]
cmp dword [eax + 0x1c], 0x10
push ebx
mov ebx, dword [eax + 0x18]
push esi
lea esi, [eax + 8]
mov dword [ebp - 4], ecx
push edi
jb 0x4575db
mov esi, dword [esi]
xor edx, edx
mov edi, 0x811c9dc5
test ebx, ebx
je 0x4575f7
movzx ecx, byte [edx + esi]
inc edx
xor ecx, edi
imul edi, ecx, 0x1000193
cmp edx, ebx
jb 0x4575e6
mov ebx, dword [ebp - 4]
mov ecx, dword [ebx + 0x18]
mov edx, dword [ebx + 0xc]
and ecx, edi
lea esi, [ecx*8]
mov ecx, dword [edx + esi]
add edx, esi
cmp dword [edx + 4], eax
jne 0x457630
cmp ecx, eax
jne 0x457628
mov ecx, dword [ebx + 4]
mov dword [edx], ecx
mov edx, dword [ebx + 0xc]
mov ecx, dword [ebx + 4]
mov dword [esi + edx + 4], ecx
jmp 0x457638
mov ecx, dword [eax + 4]
mov dword [edx + 4], ecx
jmp 0x457638
cmp ecx, eax
jne 0x457638
mov ecx, dword [eax]
mov dword [edx], ecx
mov edx, dword [eax + 4]
lea ecx, [ebx + 4]
mov edi, dword [eax]
push eax
mov dword [edx], edi
mov esi, dword [eax]
mov edx, dword [eax + 4]
mov dword [esi + 4], edx
dec dword [ecx + 4]
call fcn.00459880
mov eax, dword [ebp + 8]
mov dword [eax], edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x457670
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
mov ebx, ecx
movzx eax, byte [edi + 8]
xor eax, 0x811c9dc5
imul edx, eax, 0x1000193
movzx eax, byte [edi + 9]
xor edx, eax
movzx eax, byte [edi + 0xa]
imul ecx, edx, 0x1000193
xor ecx, eax
movzx eax, byte [edi + 0xb]
imul ecx, ecx, 0x1000193
xor ecx, eax
imul eax, ecx, 0x1000193
mov ecx, dword [ebx + 0x18]
and ecx, eax
lea edx, [ecx*8]
mov ecx, dword [ebx + 0xc]
add ecx, edx
mov eax, dword [ecx]
cmp dword [ecx + 4], edi
jne 0x4576e3
cmp eax, edi
jne 0x4576db
mov eax, dword [ebx + 4]
mov dword [ecx], eax
mov ecx, dword [ebx + 0xc]
mov eax, dword [ebx + 4]
mov dword [edx + ecx + 4], eax
jmp 0x4576eb
mov eax, dword [edi + 4]
mov dword [ecx + 4], eax
jmp 0x4576eb
cmp eax, edi
jne 0x4576eb
mov eax, dword [edi]
mov dword [ecx], eax
mov eax, dword [edi + 4]
mov esi, dword [edi]
mov dword [eax], esi
mov ecx, dword [edi]
mov eax, dword [edi + 4]
mov dword [ecx + 4], eax
lea ecx, [edi + 0xc]
dec dword [ebx + 8]
call fcn.00458360
push 0x54
push edi
call fcn.004cd104
mov eax, dword [ebp + 8]
add esp, 8
pop edi
mov dword [eax], esi
pop esi
pop ebx
pop ebp
ret 8