joyce8/EMBER2024-capa huggingface dataset:
Function at 0x401e56
Capabilities:
Parse pe header
Terminate process

Disassembly:
push 0x74
push 0x403190
call fcn.004020c4
xor ebx, ebx
mov dword [ebp - 0x20], ebx
push ebx
mov edi, dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
call edi
cmp word [eax], 0x5a4d
jne 0x401e96
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x401e96
movzx eax, word [ecx + 0x18]
cmp eax, 0x10b
je 0x401eae
cmp eax, 0x20b
je 0x401e9b
mov dword [ebp - 0x1c], ebx
jmp 0x401ec2
cmp dword [ecx + 0x84], 0xe
jbe 0x401e96
xor eax, eax
cmp dword [ecx + 0xf8], ebx
jmp 0x401ebc
cmp dword [ecx + 0x74], 0xe
jbe 0x401e96
xor eax, eax
cmp dword [ecx + 0xe8], ebx
setne al
mov dword [ebp - 0x1c], eax
mov dword [ebp - 4], ebx
push 2
call dword [sym.imp.MSVCR71.dll___set_app_type]
pop ecx
or dword [0x404be0], 0xffffffff
or dword [0x404be4], 0xffffffff
call dword [sym.imp.MSVCR71.dll___p__fmode]
mov ecx, dword [0x404bd8]
mov dword [eax], ecx
call dword [sym.imp.MSVCR71.dll___p__commode]
mov ecx, dword [0x404bd4]
mov dword [eax], ecx
mov eax, dword [sym.imp.MSVCR71.dll__adjust_fdiv]
mov eax, dword [eax]
mov dword [0x404bdc], eax
call fcn.0040217e
call fcn.00402227
cmp dword [0x404064], ebx
jne 0x401f22
push 0x402224
call dword [sym.imp.MSVCR71.dll___setusermatherr]
pop ecx
call fcn.0040220c
push 0x404010
push 0x40400c
call sub.MSVCR71.dll__initterm
push 0x4021c2
call fcn.0040216c
mov eax, dword [0x404bd0]
mov dword [ebp - 0x28], eax
lea eax, [ebp - 0x28]
push eax
push dword [0x404bcc]
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 0x34]
push eax
lea eax, [ebp - 0x38]
push eax
call dword [sym.imp.MSVCR71.dll___getmainargs]
add esp, 0x20
mov dword [ebp - 0x3c], eax
cmp eax, ebx
jge 0x401f76
push 8
call sub.MSVCR71.dll__amsg_exit
pop ecx
push 0x404008
push section..data
call sub.MSVCR71.dll__initterm
pop ecx
pop ecx
mov eax, dword [sym.imp.MSVCR71.dll__acmdln]
mov esi, dword [eax]
mov dword [ebp - 0x24], esi
mov al, byte [esi]
cmp al, 0x20
ja 0x401ff4
cmp al, bl
je 0x401fa0
cmp dword [ebp - 0x20], ebx
jne 0x401ff4
mov al, byte [esi]
cmp al, bl
je 0x401fb0
cmp al, 0x20
ja 0x401fb0
inc esi
mov dword [ebp - 0x24], esi
jmp 0x401fa0
mov dword [ebp - 0x58], ebx
lea eax, [ebp - 0x84]
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoA]
test byte [ebp - 0x58], 1
je 0x401fcc
movzx eax, word [ebp - 0x54]
jmp 0x401fcf
push 0xa
pop eax
push eax
push esi
push ebx
push ebx
call edi
push eax
call section..text
mov esi, eax
mov dword [ebp - 0x40], esi
cmp dword [ebp - 0x1c], ebx
jne 0x401fec
push esi
call dword [sym.imp.MSVCR71.dll_exit]
call dword [sym.imp.MSVCR71.dll__cexit]
jmp 0x402049
cmp al, 0x22
jne 0x402003
xor ecx, ecx
cmp dword [ebp - 0x20], ebx
sete cl
mov dword [ebp - 0x20], ecx
movzx eax, al
push eax
call dword [sym.imp.MSVCR71.dll__ismbblead]
pop ecx
test eax, eax
je 0x402016
inc esi
mov dword [ebp - 0x24], esi
inc esi
jmp 0x401f8e
or dword [ebp - 4], 0xffffffff
mov eax, esi
call fcn.004020ff
ret
Function at 0x42e000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..rdata
nop
mov ebx, 0x407ef8
nop
nop
mov ecx, 0x69c908e3
test eax, eax
nop
nop
nop
nop
nop
nop
je 0x42e04e
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
cmp eax, ebx
nop
nop
nop
nop
nop
nop
nop
jne 0x42e024
nop
nop
mov eax, section..data
mov ebx, 0x42cd70
nop
nop
mov ecx, 0x57fb6277
nop
nop
nop
test eax, eax
nop
nop
nop
nop
je 0x42e084
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
add eax, 4
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
jne 0x42e06c
nop
nop
popal
nop
nop
nop
jmp 0x401219
Function at 0x4a1b2e
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, 0x101c
call fcn.00401edd
mov eax, dword [0x4e1768]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x14]
push ebx
push dword [ebp + 8]
mov dword [ebp - 0x100c], eax
call fcn.00406582
pop ecx
mov ecx, dword [ebp + 8]
mov ebx, eax
cmp dword [ecx + 8], 0
jne 0x4a1b70
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 0x10]
jmp 0x4a1ccc
mov eax, dword [ecx]
sub eax, dword [ecx + 4]
push esi
push edi
push 0
cdq
push 2
push edx
push eax
call fcn.004066fe
push dword [ebp - 0x100c]
mov ecx, ebx
mov dword [ebp - 0x1008], eax
mov esi, ebx
mov dword [ebp - 0x1018], edx
and ecx, 0x3f
sar esi, 6
imul edi, ecx, 0x38
push 0
mov eax, dword [esi*4 + 0x4e55d0]
push dword [edi + eax + 0x24]
push dword [edi + eax + 0x20]
push ebx
call fcn.00403567
mov ecx, dword [esi*4 + 0x4e55d0]
add esp, 0x14
mov dword [ebp - 0x1010], eax
mov eax, edx
mov edx, dword [ebp - 0x1010]
mov dword [ebp - 0x101c], eax
cmp edx, dword [edi + ecx + 0x20]
jne 0x4a1cc5
cmp eax, dword [edi + ecx + 0x24]
jne 0x4a1cc5
push 0
lea eax, [ebp - 0x1014]
push eax
push 0x1000
lea eax, [ebp - 0x1004]
push eax
push dword [edi + ecx + 0x18]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x4a1cc5
push dword [ebp - 0x100c]
push 0
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push ebx
call fcn.00403567
add esp, 0x14
test edx, edx
jl 0x4a1cc5
jg 0x4a1c3b
test eax, eax
jb 0x4a1cc5
mov ebx, dword [ebp - 0x1018]
mov eax, dword [ebp - 0x1014]
test ebx, ebx
jg 0x4a1cc5
jl 0x4a1c55
cmp dword [ebp - 0x1008], eax
ja 0x4a1cc5
lea edi, [ebp - 0x1004]
xor edx, edx
add edi, eax
lea ecx, [ebp - 0x1004]
xor esi, esi
cmp dword [ebp - 0x1008], edx
jne 0x4a1c73
test ebx, ebx
je 0x4a1cac
cmp ecx, edi
jae 0x4a1cac
mov al, byte [ecx]
cmp al, 0xd
jne 0x4a1c8d
lea eax, [edi - 1]
cmp ecx, eax
jae 0x4a1c99
cmp byte [ecx + 1], 0xa
jne 0x4a1c99
inc ecx
jmp 0x4a1c99
movzx eax, al
movsx eax, byte [eax + 0x4e1a90]
add ecx, eax
add esi, 1
adc edx, 0
inc ecx
cmp esi, dword [ebp - 0x1008]
jne 0x4a1c73
cmp edx, ebx
jne 0x4a1c73
lea eax, [ebp - 0x1004]
sub ecx, eax
mov eax, ecx
cdq
add eax, dword [ebp - 0x1010]
adc edx, dword [ebp - 0x101c]
jmp 0x4a1cca
or edx, 0xffffffff
mov eax, edx
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop ebx
call fcn.00403323
leave
ret
Function at 0x4a240b
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [ebp + 8]
mov ecx, eax
push ebx
mov ebx, dword [ebp + 0xc]
and eax, 0x3f
sar ecx, 6
push esi
push edi
imul edi, eax, 0x38
mov eax, dword [ecx*4 + 0x4e55d0]
mov dword [ebp - 0x10], ecx
mov ecx, dword [eax + edi + 0x18]
mov dword [ebp - 0x14], ecx
mov ecx, dword [ebp + 0x10]
test ecx, ecx
je 0x4a244b
cmp byte [ebx], 0xa
jne 0x4a244b
or byte [eax + edi + 0x28], 4
jmp 0x4a2450
and byte [eax + edi + 0x28], 0xfb
add ecx, ebx
mov edx, ebx
mov dword [ebp - 0xc], ecx
mov esi, ebx
cmp ebx, ecx
jae 0x4a254e
mov al, byte [edx]
cmp al, 0x1a
je 0x4a2530
lea ecx, [edx + 1]
mov dword [ebp - 8], ecx
mov ecx, dword [ebp - 0xc]
cmp al, 0xd
je 0x4a247f
mov edx, dword [ebp - 8]
mov byte [esi], al
jmp 0x4a24a4
mov eax, dword [ebp - 8]
cmp eax, ecx
jae 0x4a24ae
mov cl, byte [eax]
xor eax, eax
cmp cl, 0xa
sete al
inc eax
add edx, eax
cmp cl, 0xa
sete al
dec al
and al, 3
add al, 0xa
mov byte [esi], al
mov ecx, dword [ebp - 0xc]
inc esi
cmp edx, ecx
jb 0x4a2461
jmp 0x4a254e
push 0
lea eax, [ebp - 0xc]
push eax
push 1
lea eax, [ebp - 1]
push eax
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x4a252b
cmp dword [ebp - 0xc], 0
je 0x4a252b
mov ecx, dword [ebp - 0x10]
mov eax, dword [ecx*4 + 0x4e55d0]
test byte [eax + edi + 0x28], 0x48
je 0x4a2505
mov dl, byte [ebp - 1]
lea eax, [esi + 1]
mov dword [ebp - 0x14], eax
cmp dl, 0xa
jne 0x4a24f0
mov byte [esi], dl
jmp 0x4a2501
mov byte [esi], 0xd
mov eax, dword [ecx*4 + 0x4e55d0]
mov byte [eax + edi + 0x2a], dl
mov eax, dword [ebp - 0x14]
mov esi, eax
jmp 0x4a254e
cmp byte [ebp - 1], 0xa
jne 0x4a2514
cmp esi, ebx
jne 0x4a2514
mov byte [esi], 0xa
jmp 0x4a254d
push 1
push 0xffffffffffffffff
push 0xffffffffffffffff
push dword [ebp + 8]
call fcn.00401a0a
add esp, 0x10
cmp byte [ebp - 1], 0xa
je 0x4a254e
mov byte [esi], 0xd
jmp 0x4a254d
mov ecx, dword [ebp - 0x10]
mov ecx, dword [ecx*4 + 0x4e55d0]
mov al, byte [ecx + edi + 0x28]
test al, 0x40
jne 0x4a254a
or al, 2
mov byte [ecx + edi + 0x28], al
jmp 0x4a254e
mov byte [esi], 0x1a
inc esi
sub esi, ebx
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret
Function at 0x4a25aa
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [ebp + 8]
push ebx
push esi
mov esi, dword [ebp + 0xc]
mov ebx, eax
and eax, 0x3f
sar ebx, 6
push edi
imul edi, eax, 0x38
push 0xa
mov eax, dword [ebx*4 + 0x4e55d0]
pop edx
mov dword [ebp - 0x14], edx
mov ecx, dword [edi + eax + 0x18]
mov dword [ebp - 0x18], ecx
mov ecx, dword [ebp + 0x10]
test ecx, ecx
je 0x4a25ed
cmp word [esi], dx
jne 0x4a25ed
or byte [edi + eax + 0x28], 4
jmp 0x4a25f2
and byte [edi + eax + 0x28], 0xfb
lea edx, [esi + ecx*2]
mov eax, esi
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
cmp eax, edx
jae 0x4a2745
mov dword [ebp - 0xc], 0xd
movzx ecx, word [eax]
mov edx, ecx
mov dword [ebp - 0x10], edx
push 0x1a
pop edx
cmp cx, dx
mov edx, dword [ebp - 8]
je 0x4a2725
add eax, 2
cmp cx, word [ebp - 0xc]
je 0x4a2634
mov dword [ebp - 4], eax
mov word [esi], cx
jmp 0x4a266a
cmp eax, edx
jae 0x4a2676
movzx eax, word [eax]
xor ecx, ecx
cmp ax, word [ebp - 0x14]
mov edx, eax
push 0xa
sete cl
xor eax, eax
lea ecx, [ecx*2 + 2]
add dword [ebp - 4], ecx
pop ecx
cmp dx, cx
mov edx, dword [ebp - 8]
sete al
dec eax
and eax, 3
add eax, ecx
mov word [esi], ax
mov eax, dword [ebp - 4]
add esi, 2
cmp eax, edx
jb 0x4a260c
jmp 0x4a2745
push 0
lea eax, [ebp - 0x14]
push eax
push 2
lea eax, [ebp - 4]
push eax
push dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x4a2721
cmp dword [ebp - 0x14], 0
je 0x4a2721
mov eax, dword [ebx*4 + 0x4e55d0]
push 0xa
test byte [edi + eax + 0x28], 0x48
je 0x4a26f9
mov dx, word [ebp - 4]
lea eax, [esi + 2]
pop ecx
mov dword [ebp - 0x18], eax
cmp dx, cx
jne 0x4a26c2
mov word [esi], cx
jmp 0x4a26f5
push 0xd
pop eax
mov word [esi], ax
mov eax, dword [ebx*4 + 0x4e55d0]
movzx ecx, dx
shr ecx, 8
push 0xa
mov byte [edi + eax + 0x2a], dl
mov eax, dword [ebx*4 + 0x4e55d0]
mov byte [edi + eax + 0x2b], cl
mov eax, dword [ebx*4 + 0x4e55d0]
pop ecx
mov byte [edi + eax + 0x2c], cl
mov eax, dword [ebp - 0x18]
mov esi, eax
jmp 0x4a2745
pop ebx
cmp word [ebp - 4], bx
jne 0x4a270a
cmp esi, dword [ebp + 0xc]
jne 0x4a270a
mov word [esi], bx
jmp 0x4a2742
push 1
push 0xffffffffffffffff
push 0xfffffffffffffffe
push dword [ebp + 8]
call fcn.00401a0a
add esp, 0x10
cmp word [ebp - 4], bx
je 0x4a2745
push 0xd
jmp 0x4a273e
mov ecx, dword [ebx*4 + 0x4e55d0]
mov al, byte [ecx + edi + 0x28]
test al, 0x40
jne 0x4a273c
or al, 2
mov byte [ecx + edi + 0x28], al
jmp 0x4a2745
push 0x1a
pop eax
mov word [esi], ax
add esi, 2
sub esi, dword [ebp + 0xc]
and esi, 0xfffffffe
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret
Function at 0x4a9511
Capabilities:
Enumerate files on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x264
mov eax, dword [0x4e1768]
xor eax, ebp
mov dword [ebp - 4], eax
mov edx, dword [ebp + 0xc]
mov ecx, dword [ebp + 0x10]
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov dword [ebp - 0x25c], ecx
cmp edx, edi
je 0x4a955c
movzx eax, word [edx]
lea ecx, [ebp - 0x255]
push eax
call fcn.004a99d3
test al, al
jne 0x4a9556
sub edx, 2
cmp edx, edi
jne 0x4a953c
mov ecx, dword [ebp - 0x25c]
movzx esi, word [edx]
cmp esi, 0x3a
jne 0x4a957e
lea eax, [edi + 2]
cmp edx, eax
je 0x4a957e
push ecx
xor ebx, ebx
push ebx
push ebx
push edi
call fcn.004a910a
add esp, 0x10
jmp 0x4a9678
push esi
lea ecx, [ebp - 0x255]
call fcn.004a99d3
sub edx, edi
movzx eax, al
sar edx, 1
inc edx
neg eax
sbb eax, eax
xor ebx, ebx
push ebx
push ebx
and eax, edx
push ebx
mov dword [ebp - 0x260], eax
lea eax, [ebp - 0x254]
push eax
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_FindFirstFileExW]
mov esi, eax
cmp esi, 0xffffffff
jne 0x4a95c1
push dword [ebp - 0x25c]
jmp 0x4a956e
mov ebx, dword [ebp - 0x25c]
push 0x2e
mov eax, dword [ebx + 4]
sub eax, dword [ebx]
sar eax, 2
mov dword [ebp - 0x25c], eax
pop eax
cmp word [ebp - 0x228], ax
jne 0x4a95fe
cmp word [ebp - 0x226], 0
je 0x4a961f
cmp word [ebp - 0x226], ax
jne 0x4a95fe
cmp word [ebp - 0x224], 0
je 0x4a961f
push ebx
push dword [ebp - 0x260]
lea eax, [ebp - 0x228]
push edi
push eax
call fcn.004a910a
add esp, 0x10
mov dword [ebp - 0x264], eax
test eax, eax
jne 0x4a966b
lea eax, [ebp - 0x254]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
push 0x2e
test eax, eax
pop eax
jne 0x4a95d8
mov eax, dword [ebx + 4]
mov edx, dword [ebx]
sub eax, edx
mov ecx, dword [ebp - 0x25c]
sar eax, 2
cmp ecx, eax
jne 0x4a9653
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
xor eax, eax
jmp 0x4a9678
push 0x4a8af2
sub eax, ecx
push 4
push eax
lea eax, [edx + ecx*4]
push eax
call fcn.00405b6e
add esp, 0x10
jmp 0x4a9648
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
mov eax, dword [ebp - 0x264]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00403323
leave
ret
Function at 0x403fa0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [ebp + 0xc]
push ebx
push esi
push edi
mov ebx, dword [eax + 0x10]
mov edi, ecx
mov ecx, dword [eax + 0x14]
mov dword [ebp - 0x10], ecx
cmp ecx, 0x10
jb 0x403fc0
mov esi, dword [eax]
jmp 0x403fc2
mov esi, eax
xor ecx, ecx
mov edx, 0x811c9dc5
test ebx, ebx
je 0x403fe1
nop dword [eax]
movzx eax, byte [esi + ecx]
inc ecx
xor eax, edx
imul edx, eax, 0x1000193
cmp ecx, ebx
jb 0x403fd0
mov eax, dword [edi + 0x18]
mov ecx, dword [edi + 0xc]
and eax, edx
mov edi, dword [edi + 4]
mov esi, dword [ecx + eax*8]
add eax, eax
mov edx, dword [ecx + eax*4]
inc eax
mov dword [ebp - 8], edx
lea eax, [ecx + eax*4]
mov dword [ebp - 0xc], eax
nop
cmp edx, edi
jne 0x404008
mov eax, edi
jmp 0x40400c
mov eax, dword [eax]
mov eax, dword [eax]
cmp esi, eax
je 0x4040dd
cmp dword [ebp - 0x10], 0x10
lea ecx, [esi + 8]
mov eax, dword [ebp + 0xc]
jb 0x404022
mov eax, dword [eax]
cmp dword [ecx + 0x14], 0x10
mov dword [ebp - 4], eax
lea eax, [ecx + 0x10]
mov dword [ebp - 0x14], eax
jb 0x404033
mov ecx, dword [ecx]
mov edx, dword [eax]
cmp edx, ebx
mov eax, ebx
cmovb eax, edx
push eax
push dword [ebp - 4]
push ecx
call fcn.004030d0
add esp, 0xc
test eax, eax
jne 0x404058
mov ecx, dword [ebp - 0x14]
mov eax, dword [ecx]
cmp eax, ebx
jb 0x404058
jbe 0x404062
mov esi, dword [esi]
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 0xc]
jmp 0x404000
mov eax, esi
mov dword [ebp - 0x18], eax
cmp dword [ebp - 8], edi
jne 0x404070
mov eax, edi
jmp 0x404077
mov eax, dword [ebp - 0xc]
mov eax, dword [eax]
mov eax, dword [eax]
cmp esi, eax
je 0x4040c3
cmp dword [esi + 0x1c], 0x10
lea ecx, [esi + 8]
lea edx, [ecx + 0x10]
mov dword [ebp - 0x14], edx
jb 0x40408c
mov ecx, dword [ecx]
cmp dword [ebp - 0x10], 0x10
mov eax, dword [ebp + 0xc]
jb 0x404097
mov eax, dword [eax]
mov edx, dword [edx]
cmp ebx, edx
mov dword [ebp - 4], eax
mov eax, edx
cmovb eax, ebx
push eax
push ecx
push dword [ebp - 4]
call fcn.004030d0
add esp, 0xc
test eax, eax
jne 0x4040c3
mov ecx, dword [ebp - 0x14]
mov eax, dword [ecx]
cmp ebx, eax
jb 0x4040c3
ja 0x4040c3
mov esi, dword [esi]
jmp 0x404067
mov eax, dword [ebp - 0x18]
cmp eax, esi
je 0x4040dd
mov ecx, dword [ebp + 8]
pop edi
mov dword [ecx + 4], esi
pop esi
mov dword [ecx], eax
mov eax, ecx
pop ebx
mov esp, ebp
pop ebp
ret 8
mov eax, dword [ebp + 8]
mov dword [eax], edi
mov dword [eax + 4], edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x4040f0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov edx, dword [ebp + 0xc]
push ebx
push esi
push edi
mov eax, dword [edx + 0x14]
mov edi, dword [edx + 0x10]
mov dword [ebp - 4], ecx
mov dword [ebp - 0x14], eax
cmp eax, 0x10
jb 0x404111
mov ebx, dword [edx]
jmp 0x404113
mov ebx, edx
xor ecx, ecx
mov esi, 0x811c9dc5
test edi, edi
je 0x404131
nop
movzx eax, byte [ebx + ecx]
inc ecx
xor eax, esi
imul esi, eax, 0x1000193
cmp ecx, edi
jb 0x404120
mov ebx, dword [ebp - 4]
mov eax, dword [ebx + 0x18]
mov ecx, dword [ebx + 0xc]
and eax, esi
mov ebx, dword [ebx + 4]
mov dword [ebp - 0xc], ebx
mov esi, dword [ecx + eax*8]
add eax, eax
mov edx, dword [ecx + eax*4]
inc eax
mov dword [ebp - 8], edx
lea eax, [ecx + eax*4]
mov dword [ebp - 0x10], eax
mov edx, dword [ebp + 0xc]
cmp dword [ebp - 8], ebx
jne 0x404160
mov eax, ebx
jmp 0x404164
mov eax, dword [eax]
mov eax, dword [eax]
cmp esi, eax
je 0x4041f5
cmp dword [edx + 0x14], 0x10
lea ecx, [esi + 8]
jb 0x404177
mov edx, dword [edx]
cmp dword [ecx + 0x14], 0x10
lea ebx, [ecx + 0x10]
jb 0x404182
mov ecx, dword [ecx]
mov ebx, dword [ebx]
mov eax, edi
cmp ebx, edi
cmovb eax, ebx
push eax
push edx
push ecx
call fcn.004030d0
add esp, 0xc
test eax, eax
jne 0x4041a0
cmp ebx, edi
jb 0x4041a0
jbe 0x4041aa
mov esi, dword [esi]
mov ebx, dword [ebp - 0xc]
mov eax, dword [ebp - 0x10]
jmp 0x404154
cmp dword [esi + 0x1c], 0x10
lea edx, [esi + 8]
lea ebx, [edx + 0x10]
jb 0x4041b8
mov edx, dword [edx]
cmp dword [ebp - 0x14], 0x10
mov ecx, dword [ebp + 0xc]
jb 0x4041c3
mov ecx, dword [ecx]
mov ebx, dword [ebx]
cmp edi, ebx
mov eax, ebx
cmovb eax, edi
push eax
push edx
push ecx
call fcn.004030d0
add esp, 0xc
test eax, eax
jne 0x4041e1
cmp edi, ebx
jb 0x4041e1
jbe 0x4041e7
mov ecx, dword [ebp - 4]
mov esi, dword [ecx + 4]
mov eax, dword [ebp + 8]
pop edi
mov dword [eax], esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
mov eax, dword [ebp + 8]
pop edi
pop esi
mov dword [eax], ebx
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x4054c0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
cmp dword [edi + 0x1c], 0x10
lea edx, [edi + 8]
mov ebx, dword [edx + 0x10]
mov dword [ebp - 4], ecx
jb 0x4054db
mov edx, dword [edx]
xor ecx, ecx
mov esi, 0x811c9dc5
test ebx, ebx
je 0x4054f7
movzx eax, byte [edx + ecx]
inc ecx
xor eax, esi
imul esi, eax, 0x1000193
cmp ecx, ebx
jb 0x4054e6
mov edx, dword [ebp - 4]
mov eax, dword [edx + 0x18]
mov ecx, dword [edx + 0xc]
and eax, esi
lea esi, [eax*8]
add ecx, esi
cmp dword [ecx + 4], edi
jne 0x40552d
cmp dword [ecx], edi
jne 0x405525
mov eax, dword [edx + 4]
mov dword [ecx], eax
mov ecx, dword [edx + 0xc]
mov eax, dword [edx + 4]
mov dword [ecx + esi + 4], eax
jmp 0x405535
mov eax, dword [edi + 4]
mov dword [ecx + 4], eax
jmp 0x405535
cmp dword [ecx], edi
jne 0x405538
mov eax, dword [edi]
mov dword [ecx], eax
mov edi, dword [ebp + 0xc]
mov eax, dword [edi + 4]
mov esi, dword [edi]
mov dword [eax], esi
mov ecx, dword [edi]
mov eax, dword [edi + 4]
mov dword [ecx + 4], eax
lea ecx, [edi + 8]
dec dword [edx + 8]
call fcn.004057a0
push edi
call fcn.004539d0
mov eax, dword [ebp + 8]
add esp, 4
pop edi
mov dword [eax], esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x405610
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
cmp dword [edi + 0x1c], 0x10
lea edx, [edi + 8]
mov ebx, dword [edx + 0x10]
mov dword [ebp - 4], ecx
jb 0x40562b
mov edx, dword [edx]
xor ecx, ecx
mov esi, 0x811c9dc5
test ebx, ebx
je 0x405647
movzx eax, byte [edx + ecx]
inc ecx
xor eax, esi
imul esi, eax, 0x1000193
cmp ecx, ebx
jb 0x405636
mov edx, dword [ebp - 4]
mov eax, dword [edx + 0x18]
mov ecx, dword [edx + 0xc]
and eax, esi
lea esi, [eax*8]
add ecx, esi
cmp dword [ecx + 4], edi
jne 0x40567d
cmp dword [ecx], edi
jne 0x405675
mov eax, dword [edx + 4]
mov dword [ecx], eax
mov ecx, dword [edx + 0xc]
mov eax, dword [edx + 4]
mov dword [esi + ecx + 4], eax
jmp 0x405685
mov eax, dword [edi + 4]
mov dword [ecx + 4], eax
jmp 0x405685
cmp dword [ecx], edi
jne 0x405688
mov eax, dword [edi]
mov dword [ecx], eax
mov edi, dword [ebp + 0xc]
mov eax, dword [edi + 4]
lea ebx, [edi + 8]
mov esi, dword [edi]
mov dword [eax], esi
mov ecx, dword [edi]
mov eax, dword [edi + 4]
mov dword [ecx + 4], eax
dec dword [edx + 8]
mov eax, dword [ebx + 0x14]
cmp eax, 0x10
jb 0x4056b0
inc eax
mov ecx, ebx
push eax
push dword [ebx]
call fcn.004046a0
mov dword [ebx + 0x14], 0xf
cmp dword [ebx + 0x14], 0x10
mov dword [ebx + 0x10], 0
jb 0x4056c6
mov ebx, dword [ebx]
push edi
mov byte [ebx], 0
call fcn.004539d0
mov eax, dword [ebp + 8]
add esp, 4
pop edi
mov dword [eax], esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x406030
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
cmp dword [edi + 0x1c], 0x10
lea edx, [edi + 8]
mov ebx, dword [edx + 0x10]
mov dword [ebp - 4], ecx
jb 0x40604b
mov edx, dword [edx]
xor ecx, ecx
mov esi, 0x811c9dc5
test ebx, ebx
je 0x406067
movzx eax, byte [edx + ecx]
inc ecx
xor eax, esi
imul esi, eax, 0x1000193
cmp ecx, ebx
jb 0x406056
mov edx, dword [ebp - 4]
mov eax, dword [edx + 0x18]
mov ecx, dword [edx + 0xc]
and eax, esi
lea esi, [eax*8]
add ecx, esi
cmp dword [ecx + 4], edi
jne 0x40609d
cmp dword [ecx], edi
jne 0x406095
mov eax, dword [edx + 4]
mov dword [ecx], eax
mov ecx, dword [edx + 0xc]
mov eax, dword [edx + 4]
mov dword [ecx + esi + 4], eax
jmp 0x4060a5
mov eax, dword [edi + 4]
mov dword [ecx + 4], eax
jmp 0x4060a5
cmp dword [ecx], edi
jne 0x4060a8
mov eax, dword [edi]
mov dword [ecx], eax
mov edi, dword [ebp + 0xc]
mov eax, dword [edi + 4]
mov esi, dword [edi]
mov dword [eax], esi
mov ecx, dword [edi]
mov eax, dword [edi + 4]
mov dword [ecx + 4], eax
lea ecx, [edi + 8]
dec dword [edx + 8]
call fcn.00405830
push edi
call fcn.004539d0
mov eax, dword [ebp + 8]
add esp, 4
pop edi
mov dword [eax], esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x406180
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
cmp dword [edi + 0x1c], 0x10
lea edx, [edi + 8]
mov ebx, dword [edx + 0x10]
mov dword [ebp - 4], ecx
jb 0x40619b
mov edx, dword [edx]
xor ecx, ecx
mov esi, 0x811c9dc5
test ebx, ebx
je 0x4061b7
movzx eax, byte [edx + ecx]
inc ecx
xor eax, esi
imul esi, eax, 0x1000193
cmp ecx, ebx
jb 0x4061a6
mov edx, dword [ebp - 4]
mov eax, dword [edx + 0x18]
mov ecx, dword [edx + 0xc]
and eax, esi
lea esi, [eax*8]
add ecx, esi
cmp dword [ecx + 4], edi
jne 0x4061ed
cmp dword [ecx], edi
jne 0x4061e5
mov eax, dword [edx + 4]
mov dword [ecx], eax
mov ecx, dword [edx + 0xc]
mov eax, dword [edx + 4]
mov dword [ecx + esi + 4], eax
jmp 0x4061f5
mov eax, dword [edi + 4]
mov dword [ecx + 4], eax
jmp 0x4061f5
cmp dword [ecx], edi
jne 0x4061f8
mov eax, dword [edi]
mov dword [ecx], eax
mov edi, dword [ebp + 0xc]
mov eax, dword [edi + 4]
mov esi, dword [edi]
mov dword [eax], esi
mov ecx, dword [edi]
mov eax, dword [edi + 4]
mov dword [ecx + 4], eax
lea ecx, [edi + 8]
dec dword [edx + 8]
call fcn.004058a0
push edi
call fcn.004539d0
mov eax, dword [ebp + 8]
add esp, 4
pop edi
mov dword [eax], esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8