joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40d29e
Capabilities:
Link many functions at runtime
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x419440]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_EncodePointer]
push esi
push edi
mov dword [ebp - 0x1c], eax
xor esi, esi
mov eax, dword [ebp + 0xc]
push esi
mov dword [ebp - 0x20], eax
call ebx
mov edi, eax
mov dword [ebp - 0x18], edi
call fcn.00407cfb
mov dword [ebp - 0x14], eax
cmp dword [0x453fb8], esi
jne 0x40d391
push 0x800
push esi
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
jne 0x40d31e
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x57
jne 0x40d471
push esi
push esi
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
je 0x40d471
push str.MessageBoxW
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x40d471
push eax
call ebx
push str.GetActiveWindow
push edi
mov dword [0x453fb8], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetLastActivePopup
push edi
mov dword [0x453fbc], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetUserObjectInformationW
push edi
mov dword [0x453fc0], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x453fc8], eax
test eax, eax
je 0x40d38e
push str.GetProcessWindowStation
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x453fc4], eax
mov edi, dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x40d3b6
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x40d3a9
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp dword [ebp - 0x14], esi
je 0x40d3cb
push 4
pop eax
jmp 0x40d473
cmp dword [ebp - 0x14], esi
je 0x40d3cb
push dword [0x453fb8]
call dword [sym.imp.KERNEL32.dll_DecodePointer]
push 3
jmp 0x40d3b0
mov eax, dword [0x453fc4]
mov ebx, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, edi
je 0x40d429
cmp dword [0x453fc8], edi
je 0x40d429
push eax
call ebx
push dword [0x453fc8]
mov dword [ebp - 0x14], eax
call ebx
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
test ecx, ecx
je 0x40d429
test eax, eax
je 0x40d429
call ecx
test eax, eax
je 0x40d41e
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call dword [ebp - 0x18]
test eax, eax
je 0x40d41e
test byte [ebp - 8], 1
jne 0x40d429
mov edi, dword [ebp + 0x10]
or edi, 0x200000
jmp 0x40d459
mov eax, dword [0x453fbc]
cmp eax, edi
je 0x40d456
push eax
call ebx
test eax, eax
je 0x40d456
call eax
mov esi, eax
test esi, esi
je 0x40d456
mov eax, dword [0x453fc0]
cmp eax, edi
je 0x40d456
push eax
call ebx
test eax, eax
je 0x40d456
push esi
call eax
mov esi, eax
mov edi, dword [ebp + 0x10]
push dword [0x453fb8]
call ebx
test eax, eax
je 0x40d471
push edi
push dword [ebp - 0x20]
push dword [ebp - 0x1c]
push esi
call eax
jmp 0x40d473
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0040440e
mov esp, ebp
pop ebp
ret
Function at 0x4997b0
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x7c000]
push edi
or ebp, 0xffffffff
jmp 0x4997d2
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x4997d9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4997c8
mov eax, 1
add ebx, ebx
jne 0x4997eb
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x4997fc
jne 0x49981b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x49981b
dec eax
add ebx, ebx
jne 0x499808
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x4997e0
add ebx, ebx
jne 0x499817
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x49986d
xor ecx, ecx
sub eax, 3
jb 0x499833
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x4998a2
sar eax, 1
mov ebp, eax
jmp 0x49983e
add ebx, ebx
jne 0x49983e
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x49980c
inc ecx
add ebx, ebx
jne 0x49984c
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x49980c
add ebx, ebx
jne 0x499859
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x49984e
jne 0x49986a
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x49984e
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x49988c
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x49987e
jmp 0x4997ce
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x49988c
add edi, ecx
jmp 0x4997ce
pop esi
mov edi, esi
mov ecx, 0x333
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x4998aa
cmp byte [edi], 7
jne 0x4998aa
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x4998af
lea edi, [esi + 0x97000]
mov eax, dword [edi]
or eax, eax
je 0x499927
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x99964]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x999a0]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x4998dc
mov ecx, edi
jns 0x49990b
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x999a4]
or eax, eax
je 0x499921
mov dword [ebx], eax
add ebx, 4
jmp 0x4998f9
call dword [esi + 0x999ac]
mov ebp, dword [esi + 0x999a8]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x1e7]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x49995b
sub esp, 0xffffff80
jmp 0x402dcc
Function at 0x402c05
Capabilities:
Encode data using xor

Disassembly:
push es
add dword [0x2300705], eax
xchg byte [edi], ch
push 0x3a707474
das
das
arpl word [ebx + 0x63], si
xor ebp, dword [0x30313032]
sub eax, 0x2e616961
jbe 0x402c8a
jb 0x402c90
jae 0x402c92
outsb dx, byte [si]
arpl word cs:[edi + 0x6d], bp
insd dword es:[edi], dx
das
inc ebx
push ebx
inc ebx
xor ebp, dword [0x30313032]
arpl word cs:[ebp + 0x72], sp
xor byte [edi], bl
push es
add edx, dword [ebp + 0x1d]
and eax, dword [eax + ebx]
xor byte [esi], dl
adc byte [edi + ecx*8], 0x99
test eax, 0xf4267bea
dec ebx
leave
mov cs, word [edi + 0x2605f0d7]
out dx, eax
jecxz 0x402c2e
cmpsd dword [esi], dword es:[edi]
popfd
xor byte [ecx], dl
push es
or dword [eax - 0x7a], esp
dec eax
add dword [esi + 0x10142f8], eax
add al, 4
add eax, dword [edx]
add al, 0x10
xor byte [esi], dl
push es
or ch, byte [ebx]
push es
add dword [ecx + eax], eax
xor byte [edi], 2
add dword [ebx], ebx
add al, 8
xor byte [esi], al
add dword [ecx], eax
add byte [ecx], al
add edi, edi
xor byte [0x862a0906], cl
or eax, 0x862a0906
dec eax
xchg bh, dh
or eax, 0x5050101
add byte [ebx], al
add byte [ecx], 1
add byte [ebx - 0x36], ch
sar byte [ecx + 0x58], 1
xchg esp, eax
mov bl, 0x54
xor al, 0x93
invalid
scasd eax, dword es:[edi]
jb 0x402c77
invalid
Function at 0x40c9b4
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, dword [ebp + 0xc]
push edi
mov edi, dword [ebp + 8]
test edi, edi
je 0x40caee
test esi, esi
je 0x40caee
movzx edx, word [edi + 2]
mov eax, 0x800
mov ecx, edx
and ecx, eax
cmp cx, ax
je 0x40ca6a
movzx ecx, word [esi + 2]
mov ebx, ecx
and ebx, eax
cmp bx, ax
je 0x40ca6a
xor cl, dl
test cl, 0x10
jne 0x40ca6a
mov al, byte [edi]
cmp al, byte [esi]
jne 0x40ca6a
push dword [esi + 8]
push dword [edi + 8]
call fcn.0040c9b4
pop ecx
pop ecx
test eax, eax
jne 0x40ca6a
push dword [esi + 0xc]
push dword [edi + 0xc]
call fcn.0040c9b4
pop ecx
pop ecx
test eax, eax
jne 0x40ca6a
mov ebx, dword [esi + 0x10]
mov edi, dword [edi + 0x10]
call fcn.004067a4
test eax, eax
jne 0x40ca6a
mov edi, dword [ebp + 8]
mov eax, dword [edi + 0x18]
cmp eax, dword [esi + 0x18]
jne 0x40ca6a
mov ax, word [edi + 0x1c]
cmp ax, word [esi + 0x1c]
jne 0x40ca6a
movzx eax, word [edi + 2]
mov ecx, 0x400
and eax, ecx
cmp ax, cx
jne 0x40ca72
mov ax, word [esi + 2]
and ax, cx
cmp ax, cx
jne 0x40ca6a
mov eax, dword [edi + 4]
cmp eax, dword [esi + 4]
je 0x40cac1
push 2
pop eax
jmp 0x40caf9
mov al, byte [edi]
cmp al, 0x98
je 0x40cac1
cmp al, 0x9a
je 0x40cac1
mov ebx, dword [edi + 4]
test ebx, ebx
je 0x40cac1
mov ax, word [esi + 2]
and ax, cx
cmp ax, cx
je 0x40ca6a
mov edx, dword [esi + 4]
test edx, edx
je 0x40ca6a
mov ecx, ebx
mov bl, byte [ecx]
cmp bl, byte [edx]
jne 0x40cab8
test bl, bl
je 0x40cab4
mov bl, byte [ecx + 1]
cmp bl, byte [edx + 1]
jne 0x40cab8
add ecx, 2
add edx, 2
test bl, bl
jne 0x40ca98
xor ecx, ecx
jmp 0x40cabd
sbb ecx, ecx
sbb ecx, 0xffffffff
test ecx, ecx
jne 0x40ca6a
movzx edx, word [edi + 2]
mov ax, word [esi + 2]
mov ecx, 0x100
and edx, ecx
and ax, cx
cmp dx, ax
je 0x40cadd
xor eax, eax
inc eax
jmp 0x40caf9
test dx, dx
je 0x40caea
mov eax, dword [edi + 0x14]
cmp eax, dword [esi + 0x14]
jne 0x40ca6a
xor eax, eax
jmp 0x40caf9
mov eax, esi
sub eax, edi
neg eax
sbb eax, eax
and eax, 2
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x421580
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
mov ebx, dword [ebp + 8]
mov edx, dword [ebx + 0x3c]
push edi
xor edi, edi
mov dword [ebp - 4], edi
cmp dword [edx], edi
jne 0x4215ba
mov eax, dword [ebx + 0x78]
mov ecx, dword [ebx]
or eax, 0x1e
push edi
and eax, 0x87f7f
push eax
push edx
push edi
push ecx
call dword [ecx + 0x18]
add esp, 0x14
mov dword [ebp - 4], eax
cmp eax, edi
jne 0x4216ac
mov ecx, dword [ebx + 0x18]
cmp ecx, dword [ebx + 0x24]
jbe 0x4215f0
mov eax, dword [ebx + 0x80]
push edi
cdq
push ecx
push edx
push eax
call fcn.004850b0
mov dword [ebp - 0x10], edx
lea edx, [ebp - 0x14]
push edx
mov dword [ebp - 0x14], eax
mov eax, dword [ebx + 0x3c]
mov ecx, dword [eax]
push 5
push eax
call dword [ecx + 0x28]
mov eax, dword [ebx + 0x18]
add esp, 0xc
mov dword [ebx + 0x24], eax
push esi
jmp 0x4215f5
xor edi, edi
mov esi, dword [ebp + 0xc]
cmp esi, edi
je 0x4216ab
mov edi, dword [esi + 0x14]
mov dword [ebp - 0xc], edi
cmp edi, dword [ebx + 0x18]
ja 0x42169b
test byte [esi + 0x18], 0x20
jne 0x42169b
mov eax, dword [ebx + 0x80]
cdq
push edx
push eax
lea ecx, [edi - 1]
push 0
push ecx
call fcn.004850b0
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x10], edx
cmp edi, 1
jne 0x42163d
call fcn.00404499
push dword [ebp - 0x10]
mov eax, dword [esi + 4]
push dword [ebp - 0x14]
mov dword [ebp - 8], eax
push dword [ebx + 0x80]
push eax
mov eax, dword [ebx + 0x3c]
call fcn.004015bf
add esp, 0x10
mov dword [ebp - 4], eax
cmp edi, 1
jne 0x421676
mov esi, dword [ebp - 8]
add esi, 0x18
lea edi, [ebx + 0x64]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov esi, dword [ebp + 0xc]
mov edi, dword [ebp - 0xc]
cmp edi, dword [ebx + 0x20]
jbe 0x42167e
mov dword [ebx + 0x20], edi
inc dword [ebx + 0xa8]
mov eax, dword [ebp + 8]
push dword [esi + 4]
mov eax, dword [eax + 0x58]
mov ebx, edi
call fcn.0041b1bc
mov ebx, dword [ebp + 8]
mov esi, dword [ebp + 0xc]
pop ecx
cmp dword [ebp - 4], 0
mov eax, dword [esi + 0xc]
mov dword [ebp + 0xc], eax
je 0x4215f3
pop esi
mov eax, dword [ebp - 4]
pop edi
pop ebx
leave
ret
Function at 0x4493e0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4a6478
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push ebx
push esi
push edi
mov eax, dword [0x4c93e0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, ecx
mov dword [ebp - 0x10], eax
push ecx
lea ecx, [ebp - 0x20]
push ecx
mov ecx, eax
call fcn.0044a5e0
cmp dword [ebp - 0x20], 0
mov esi, dword [ebp - 0x1c]
setne bl
or edi, 0xffffffff
test esi, esi
je 0x44944d
lea eax, [esi + 4]
mov ecx, edi
lock xadd dword [eax], ecx
jne 0x44944d
mov eax, dword [esi]
mov ecx, esi
call dword [eax]
lea eax, [esi + 8]
mov edx, edi
lock xadd dword [eax], edx
jne 0x44944d
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 4]
test bl, bl
je 0x44945a
push ecx
mov ecx, dword [ebp - 0x10]
call fcn.00449f80
push dword [ebp + 0xc]
lea ecx, [ebp - 0x18]
call fcn.0044a070
add esp, 4
push 0x4ce960
mov ecx, 0x4cb8cc
mov dword [ebp - 4], 0
call fcn.0048273a
mov esi, eax
lea eax, [esi + 1]
mov dl, byte [esi]
inc esi
test dl, dl
jne 0x449483
push 0x4ce960
mov ecx, 0x4cb8cc
sub esi, eax
call fcn.0048273a
xor edx, edx
mov ebx, eax
mov eax, 0x811c9dc5
test esi, esi
je 0x4494b9
movzx ecx, byte [edx + ebx]
inc edx
xor ecx, eax
imul eax, ecx, 0x1000193
cmp edx, esi
jb 0x4494a8
mov ecx, dword [ebp - 0x10]
mov dword [ebp + 0xc], eax
lea eax, [ebp + 0xc]
push 0x4ca58c
push eax
lea ecx, [ecx + 4]
call fcn.00449a20
mov ecx, eax
call fcn.00449b50
mov ebx, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x18]
mov dword [ebp - 0x10], ecx
test ebx, ebx
je 0x4494f3
lea ecx, [ebx + 4]
mov edx, 1
lock xadd dword [ecx], edx
mov ecx, dword [ebp - 0x10]
mov esi, dword [eax + 4]
mov dword [eax + 4], ebx
mov dword [eax], ecx
test esi, esi
je 0x449522
lea eax, [esi + 4]
mov ecx, edi
lock xadd dword [eax], ecx
jne 0x449522
mov eax, dword [esi]
mov ecx, esi
call dword [eax]
lea eax, [esi + 8]
mov edx, edi
lock xadd dword [eax], edx
jne 0x449522
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 4]
mov dword [ebp - 4], 0xffffffff
mov esi, dword [ebp - 0x14]
test esi, esi
je 0x449552
lea eax, [esi + 4]
mov ecx, edi
lock xadd dword [eax], ecx
jne 0x449552
mov eax, dword [esi]
mov ecx, esi
call dword [eax]
lea eax, [esi + 8]
lock xadd dword [eax], edi
dec edi
jne 0x449552
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 4]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x449570
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4a6478
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push ebx
push esi
push edi
mov eax, dword [0x4c93e0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, ecx
mov dword [ebp - 0x10], eax
push ecx
lea ecx, [ebp - 0x20]
push ecx
mov ecx, eax
call fcn.0044a7e0
cmp dword [ebp - 0x20], 0
mov esi, dword [ebp - 0x1c]
setne bl
or edi, 0xffffffff
test esi, esi
je 0x4495dd
lea eax, [esi + 4]
mov ecx, edi
lock xadd dword [eax], ecx
jne 0x4495dd
mov eax, dword [esi]
mov ecx, esi
call dword [eax]
lea eax, [esi + 8]
mov edx, edi
lock xadd dword [eax], edx
jne 0x4495dd
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 4]
test bl, bl
je 0x4495ea
push ecx
mov ecx, dword [ebp - 0x10]
call fcn.0044a0f0
push dword [ebp + 0xc]
lea ecx, [ebp - 0x18]
call fcn.0044a1e0
add esp, 4
push 0x4ce960
mov ecx, 0x4cb8ac
mov dword [ebp - 4], 0
call fcn.0048273a
mov esi, eax
lea eax, [esi + 1]
mov dl, byte [esi]
inc esi
test dl, dl
jne 0x449613
push 0x4ce960
mov ecx, 0x4cb8ac
sub esi, eax
call fcn.0048273a
xor edx, edx
mov ebx, eax
mov eax, 0x811c9dc5
test esi, esi
je 0x449649
movzx ecx, byte [edx + ebx]
inc edx
xor ecx, eax
imul eax, ecx, 0x1000193
cmp edx, esi
jb 0x449638
mov ecx, dword [ebp - 0x10]
mov dword [ebp + 0xc], eax
lea eax, [ebp + 0xc]
push 0x4ca58c
push eax
lea ecx, [ecx + 4]
call fcn.00449a20
mov ecx, eax
call fcn.00449b50
mov ebx, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x18]
mov dword [ebp - 0x10], ecx
test ebx, ebx
je 0x449683
lea ecx, [ebx + 4]
mov edx, 1
lock xadd dword [ecx], edx
mov ecx, dword [ebp - 0x10]
mov esi, dword [eax + 4]
mov dword [eax + 4], ebx
mov dword [eax], ecx
test esi, esi
je 0x4496b2
lea eax, [esi + 4]
mov ecx, edi
lock xadd dword [eax], ecx
jne 0x4496b2
mov eax, dword [esi]
mov ecx, esi
call dword [eax]
lea eax, [esi + 8]
mov edx, edi
lock xadd dword [eax], edx
jne 0x4496b2
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 4]
mov dword [ebp - 4], 0xffffffff
mov esi, dword [ebp - 0x14]
test esi, esi
je 0x4496e2
lea eax, [esi + 4]
mov ecx, edi
lock xadd dword [eax], ecx
jne 0x4496e2
mov eax, dword [esi]
mov ecx, esi
call dword [eax]
lea eax, [esi + 8]
lock xadd dword [eax], edi
dec edi
jne 0x4496e2
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 4]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x449700
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4a6478
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push ebx
push esi
push edi
mov eax, dword [0x4c93e0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, ecx
mov dword [ebp - 0x10], eax
push ecx
lea ecx, [ebp - 0x20]
push ecx
mov ecx, eax
call fcn.0044a9e0
cmp dword [ebp - 0x20], 0
mov esi, dword [ebp - 0x1c]
setne bl
or edi, 0xffffffff
test esi, esi
je 0x44976d
lea eax, [esi + 4]
mov ecx, edi
lock xadd dword [eax], ecx
jne 0x44976d
mov eax, dword [esi]
mov ecx, esi
call dword [eax]
lea eax, [esi + 8]
mov edx, edi
lock xadd dword [eax], edx
jne 0x44976d
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 4]
test bl, bl
je 0x44977a
push ecx
mov ecx, dword [ebp - 0x10]
call fcn.0044a260
push dword [ebp + 0xc]
lea ecx, [ebp - 0x18]
call fcn.0044a350
add esp, 4
push 0x4ce960
mov ecx, 0x4cb88c
mov dword [ebp - 4], 0
call fcn.0048273a
mov esi, eax
lea eax, [esi + 1]
mov dl, byte [esi]
inc esi
test dl, dl
jne 0x4497a3
push 0x4ce960
mov ecx, 0x4cb88c
sub esi, eax
call fcn.0048273a
xor edx, edx
mov ebx, eax
mov eax, 0x811c9dc5
test esi, esi
je 0x4497d9
movzx ecx, byte [edx + ebx]
inc edx
xor ecx, eax
imul eax, ecx, 0x1000193
cmp edx, esi
jb 0x4497c8
mov ecx, dword [ebp - 0x10]
mov dword [ebp + 0xc], eax
lea eax, [ebp + 0xc]
push 0x4ca58c
push eax
lea ecx, [ecx + 4]
call fcn.00449a20
mov ecx, eax
call fcn.00449b50
mov ebx, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x18]
mov dword [ebp - 0x10], ecx
test ebx, ebx
je 0x449813
lea ecx, [ebx + 4]
mov edx, 1
lock xadd dword [ecx], edx
mov ecx, dword [ebp - 0x10]
mov esi, dword [eax + 4]
mov dword [eax + 4], ebx
mov dword [eax], ecx
test esi, esi
je 0x449842
lea eax, [esi + 4]
mov ecx, edi
lock xadd dword [eax], ecx
jne 0x449842
mov eax, dword [esi]
mov ecx, esi
call dword [eax]
lea eax, [esi + 8]
mov edx, edi
lock xadd dword [eax], edx
jne 0x449842
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 4]
mov dword [ebp - 4], 0xffffffff
mov esi, dword [ebp - 0x14]
test esi, esi
je 0x449872
lea eax, [esi + 4]
mov ecx, edi
lock xadd dword [eax], ecx
jne 0x449872
mov eax, dword [esi]
mov ecx, esi
call dword [eax]
lea eax, [esi + 8]
lock xadd dword [eax], edi
dec edi
jne 0x449872
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 4]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x449890
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4a6478
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push ebx
push esi
push edi
mov eax, dword [0x4c93e0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, ecx
mov dword [ebp - 0x10], eax
push ecx
lea ecx, [ebp - 0x20]
push ecx
mov ecx, eax
call fcn.0044abe0
cmp dword [ebp - 0x20], 0
mov esi, dword [ebp - 0x1c]
setne bl
or edi, 0xffffffff
test esi, esi
je 0x4498fd
lea eax, [esi + 4]
mov ecx, edi
lock xadd dword [eax], ecx
jne 0x4498fd
mov eax, dword [esi]
mov ecx, esi
call dword [eax]
lea eax, [esi + 8]
mov edx, edi
lock xadd dword [eax], edx
jne 0x4498fd
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 4]
test bl, bl
je 0x44990a
push ecx
mov ecx, dword [ebp - 0x10]
call fcn.0044a3d0
push dword [ebp + 0xc]
lea ecx, [ebp - 0x18]
call fcn.0044a4c0
add esp, 4
push 0x4ce960
mov ecx, 0x4cb86c
mov dword [ebp - 4], 0
call fcn.0048273a
mov esi, eax
lea eax, [esi + 1]
mov dl, byte [esi]
inc esi
test dl, dl
jne 0x449933
push 0x4ce960
mov ecx, 0x4cb86c
sub esi, eax
call fcn.0048273a
xor edx, edx
mov ebx, eax
mov eax, 0x811c9dc5
test esi, esi
je 0x449969
movzx ecx, byte [edx + ebx]
inc edx
xor ecx, eax
imul eax, ecx, 0x1000193
cmp edx, esi
jb 0x449958
mov ecx, dword [ebp - 0x10]
mov dword [ebp + 0xc], eax
lea eax, [ebp + 0xc]
push 0x4ca58c
push eax
lea ecx, [ecx + 4]
call fcn.00449a20
mov ecx, eax
call fcn.00449b50
mov ebx, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x18]
mov dword [ebp - 0x10], ecx
test ebx, ebx
je 0x4499a3
lea ecx, [ebx + 4]
mov edx, 1
lock xadd dword [ecx], edx
mov ecx, dword [ebp - 0x10]
mov esi, dword [eax + 4]
mov dword [eax + 4], ebx
mov dword [eax], ecx
test esi, esi
je 0x4499d2
lea eax, [esi + 4]
mov ecx, edi
lock xadd dword [eax], ecx
jne 0x4499d2
mov eax, dword [esi]
mov ecx, esi
call dword [eax]
lea eax, [esi + 8]
mov edx, edi
lock xadd dword [eax], edx
jne 0x4499d2
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 4]
mov dword [ebp - 4], 0xffffffff
mov esi, dword [ebp - 0x14]
test esi, esi
je 0x449a02
lea eax, [esi + 4]
mov ecx, edi
lock xadd dword [eax], ecx
jne 0x449a02
mov eax, dword [esi]
mov ecx, esi
call dword [eax]
lea eax, [esi + 8]
lock xadd dword [eax], edi
dec edi
jne 0x449a02
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 4]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8