joyce8/EMBER2024-capa huggingface dataset:
Function at 0x42b860
Capabilities:
Initialize winhttp library

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 8], 0
mov dword [ebp - 4], 0
mov dword [0x43ef74], 0x100
push 0
push 0
push 0
push 0
push str.UserAgent_1.0
call dword [sym.imp.WINHTTP.dll_WinHttpOpen]
mov ecx, dword [ebp + 8]
mov dword [ecx], eax
mov edx, dword [ebp + 8]
cmp dword [edx], 0
jne 0x42b8b3
mov dword [ebp - 8], 0xffffffff
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 4], eax
jmp 0x42b9fa
cmp dword [ebp + 0x10], 0
je 0x42b8cd
push 4
lea eax, [ebp + 0x10]
push eax
push 3
mov ecx, dword [ebp + 8]
mov edx, dword [ecx]
push edx
call dword [sym.imp.WINHTTP.dll_WinHttpSetOption]
mov eax, dword [ebp + 8]
mov dword [eax + 0xc], 0x3c
mov ecx, dword [ebp + 8]
add ecx, 0x48
mov edx, dword [ebp + 8]
mov dword [edx + 0x1c], ecx
mov eax, dword [ebp + 8]
mov dword [eax + 0x20], 0x100
mov ecx, dword [ebp + 8]
add ecx, 0x248
mov edx, dword [ebp + 8]
mov dword [edx + 0x38], ecx
mov eax, dword [ebp + 8]
mov dword [eax + 0x3c], 0x800
mov ecx, dword [ebp + 8]
add ecx, 0xc
push ecx
push 0
mov edx, dword [ebp + 0xc]
push edx
call dword [sym.imp.KERNEL32.dll_lstrlenW]
push eax
mov eax, dword [ebp + 0xc]
push eax
call dword [sym.imp.WINHTTP.dll_WinHttpCrackUrl]
test eax, eax
jne 0x42b93d
mov dword [ebp - 8], 0xfffffffe
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 4], eax
jmp 0x42b9fa
mov ecx, dword [ebp + 8]
cmp dword [ecx + 0x18], 2
jne 0x42b973
mov dword [ebp - 0xc], 0xa00
push 4
lea edx, [ebp - 0xc]
push edx
push 0x54
mov eax, dword [ebp + 8]
mov ecx, dword [eax]
push ecx
call dword [sym.imp.WINHTTP.dll_WinHttpSetOption]
mov edx, dword [0x43ef74]
or edx, 0x800000
mov dword [0x43ef74], edx
mov dword [0x456a9c], 1
mov eax, dword [ebp + 8]
add eax, 0x48
mov dword [0x457770], eax
mov ecx, dword [ebp + 8]
add ecx, 0x248
mov dword [0x457774], ecx
mov edx, dword [ebp + 8]
movzx eax, word [edx + 0x24]
mov dword [0x4500e0], eax
push 0
mov ecx, dword [ebp + 8]
movzx edx, word [ecx + 0x24]
push edx
mov eax, dword [ebp + 8]
add eax, 0x48
push eax
mov ecx, dword [ebp + 8]
mov edx, dword [ecx]
push edx
call dword [sym.imp.WINHTTP.dll_WinHttpConnect]
mov ecx, dword [ebp + 8]
mov dword [ecx + 4], eax
mov edx, dword [ebp + 8]
cmp dword [edx + 4], 0
jne 0x42b9f3
mov dword [ebp - 8], 0xfffffffd
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 4], eax
mov dword [0x456a9c], 0
mov dword [0x457774], 0
jmp 0x42b9fa
mov eax, dword [ebp - 8]
mov esp, ebp
pop ebp
ret 0xc
Function at 0x42d4c0
Capabilities:
Get common file path
Get program files directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x10], 0
mov dword [ebp - 8], 0
mov dword [ebp - 4], 0
push 0
call dword [sym.imp.ole32.dll_CoInitialize]
test eax, eax
jge 0x42d50f
mov dword [ebp - 0x18], 0xffffffff
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x14], eax
jmp 0x42d64c
lea eax, [ebp - 0xc]
push eax
call dword [sym.imp.SHELL32.dll_SHGetMalloc]
test eax, eax
jge 0x42d532
mov dword [ebp - 0x18], 0xfffffffe
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x14], eax
jmp 0x42d646
lea ecx, [ebp - 0x10]
push ecx
push 0
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderLocation]
test eax, eax
jge 0x42d55e
mov dword [ebp - 0x18], 0xfffffffd
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x14], eax
jmp 0x42d5e9
lea edx, [ebp - 8]
push edx
push 5
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderLocation]
test eax, eax
jge 0x42d584
mov dword [ebp - 0x18], 0xfffffffc
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x14], eax
jmp 0x42d5e9
lea eax, [ebp - 4]
push eax
push 0x26
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderLocation]
test eax, eax
jge 0x42d5aa
mov dword [ebp - 0x18], 0xfffffffb
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x14], eax
jmp 0x42d5e9
cmp dword [ebp - 0x10], 0
je 0x42d5bf
push 0x4573a0
mov ecx, dword [ebp - 0x10]
push ecx
call dword [sym.imp.SHELL32.dll_SHGetPathFromIDListW]
cmp dword [ebp - 8], 0
je 0x42d5d4
push 0x4574a0
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.SHELL32.dll_SHGetPathFromIDListW]
cmp dword [ebp - 4], 0
je 0x42d5e9
push 0x4575a0
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.SHELL32.dll_SHGetPathFromIDListW]
cmp dword [ebp - 4], 0
je 0x42d601
mov ecx, dword [ebp - 4]
push ecx
mov edx, dword [ebp - 0xc]
mov eax, dword [edx]
mov ecx, dword [ebp - 0xc]
push ecx
mov edx, dword [eax + 0x14]
call edx
cmp dword [ebp - 8], 0
je 0x42d619
mov eax, dword [ebp - 8]
push eax
mov ecx, dword [ebp - 0xc]
mov edx, dword [ecx]
mov eax, dword [ebp - 0xc]
push eax
mov ecx, dword [edx + 0x14]
call ecx
cmp dword [ebp - 0x10], 0
je 0x42d631
mov edx, dword [ebp - 0x10]
push edx
mov eax, dword [ebp - 0xc]
mov ecx, dword [eax]
mov edx, dword [ebp - 0xc]
push edx
mov eax, dword [ecx + 0x14]
call eax
mov ecx, dword [ebp - 0xc]
mov edx, dword [ecx]
mov eax, dword [ebp - 0xc]
push eax
mov ecx, dword [edx + 8]
call ecx
jmp 0x42d646
call dword [sym.imp.ole32.dll_CoUninitialize]
mov eax, dword [ebp - 0x18]
mov esp, ebp
pop ebp
ret 4
Function at 0x42eb10
Capabilities:
Get user security identifier

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x218
mov eax, dword [0x43e2a0]
xor eax, ebp
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x214], 0x100
mov dword [ebp - 0x218], 0
lea eax, [ebp - 8]
push eax
lea ecx, [ebp - 0x214]
push ecx
lea edx, [ebp - 0x210]
push edx
lea eax, [ebp - 0x218]
push eax
push 0
mov ecx, dword [ebp + 0xc]
push ecx
push 0
call dword [sym.imp.ADVAPI32.dll_LookupAccountNameW]
mov edx, dword [ebp - 0x218]
push edx
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, dword [ebp + 0x10]
mov dword [ecx], eax
mov edx, dword [ebp + 0x10]
cmp dword [edx], 0
jne 0x42eb8a
mov dword [ebp - 4], 0
jmp 0x42ebd3
lea eax, [ebp - 8]
push eax
lea ecx, [ebp - 0x214]
push ecx
lea edx, [ebp - 0x210]
push edx
lea eax, [ebp - 0x218]
push eax
mov ecx, dword [ebp + 0x10]
mov edx, dword [ecx]
push edx
mov eax, dword [ebp + 0xc]
push eax
push 0
call dword [sym.imp.ADVAPI32.dll_LookupAccountNameW]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x42ebd3
mov ecx, dword [ebp + 0x10]
mov edx, dword [ecx]
push edx
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 0xc]
xor ecx, ebp
call fcn.00402850
mov esp, ebp
pop ebp
ret 0xc
Function at 0x42eea0
Capabilities:
Get session user name

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x21c
mov eax, dword [0x43e2a0]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x114], 1
mov dword [ebp - 0x110], 0x7c
call dword [sym.imp.KERNEL32.dll_GetUserDefaultLCID]
mov dword [0x43f03c], eax
push 0x100
push 0
lea eax, [ebp - 0x108]
push eax
call fcn.00402860
add esp, 0xc
push 0x100
push 0
lea ecx, [ebp - 0x218]
push ecx
call fcn.00402860
add esp, 0xc
lea edx, [ebp - 0x110]
push edx
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.ADVAPI32.dll_GetUserNameW]
test eax, eax
je 0x42eff6
lea ecx, [ebp - 0x108]
push ecx
lea edx, [ebp - 0x218]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
mov dword [ebp - 0x21c], 0
jmp 0x42ef49
mov eax, dword [ebp - 0x21c]
add eax, 1
mov dword [ebp - 0x21c], eax
mov ecx, dword [ebp - 0x21c]
movzx edx, word [ebp + ecx*2 - 0x218]
test edx, edx
je 0x42efa2
mov eax, dword [ebp - 0x21c]
movzx ecx, word [ebp + eax*2 - 0x218]
cmp ecx, 0x61
jl 0x42efa0
mov edx, dword [ebp - 0x21c]
movzx eax, word [ebp + edx*2 - 0x218]
cmp eax, 0x7a
jg 0x42efa0
mov ecx, dword [ebp - 0x21c]
movzx edx, word [ebp + ecx*2 - 0x218]
sub edx, 0x20
mov eax, dword [ebp - 0x21c]
mov word [ebp + eax*2 - 0x218], dx
jmp 0x42ef3a
lea ecx, [ebp - 0x218]
push ecx
push str.ADMINISTRATOR
call dword [sym.imp.KERNEL32.dll_lstrcmpW]
test eax, eax
jne 0x42efc3
xor edx, edx
mov word [0x456aa0], dx
jmp 0x42eff6
lea eax, [ebp - 0x218]
push eax
push 0x43b164
call dword [sym.imp.KERNEL32.dll_lstrcmpW]
test eax, eax
jne 0x42efe4
xor ecx, ecx
mov word [0x456aa0], cx
jmp 0x42eff6
lea edx, [ebp - 0x108]
push edx
push 0x456aa0
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
mov eax, dword [ebp + 8]
push eax
call fcn.0042ebf0
push 0x43b174
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov dword [ebp - 0x10c], eax
cmp dword [ebp - 0x10c], 0
jne 0x42f03f
push 0x43b190
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov dword [ebp - 0x10c], eax
cmp dword [ebp - 0x10c], 0
jne 0x42f03f
mov dword [0x43f840], 2
jmp 0x42f079
cmp dword [ebp - 0x10c], 0
je 0x42f072
push str.AddAccessAllowedAceEx
mov ecx, dword [ebp - 0x10c]
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x43f840], eax
cmp dword [0x43f840], 0
jne 0x42f072
mov dword [0x43f840], 3
jmp 0x42f079
mov eax, dword [ebp - 0x114]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00402850
mov esp, ebp
pop ebp
ret 4
Function at 0x41eb47
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 0xc]
mov ecx, dword [eax]
mov al, byte [ecx]
push esi
push edi
mov esi, 0x811c9dc5
test al, al
je 0x41eb79
lea edx, [eax - 0x41]
inc ecx
cmp dl, 0x19
ja 0x41eb68
add al, 0x20
imul esi, esi, 0x1000193
movsx eax, al
xor esi, eax
mov al, byte [ecx]
test al, al
jne 0x41eb5d
mov eax, dword [ebx + 0x20]
mov edi, eax
and edi, esi
cmp dword [ebx + 0x24], edi
ja 0x41eb8e
shr eax, 1
or ecx, 0xffffffff
sub ecx, eax
add edi, ecx
mov edx, dword [ebx + 0x10]
mov esi, dword [edx + edi*8]
lea ecx, [ecx]
mov eax, dword [ebx + 0x10]
mov ecx, dword [ebx + 4]
cmp dword [eax + edi*8], ecx
lea eax, [eax + edi*8]
je 0x41ebaa
mov ecx, dword [eax + 4]
mov ecx, dword [ecx]
cmp esi, ecx
je 0x41ec25
mov edx, dword [ebp + 0xc]
mov eax, dword [edx]
test eax, eax
je 0x41ebcc
mov ecx, dword [esi + 8]
push eax
push ecx
call fcn.0051a11c
add esp, 8
test eax, eax
je 0x41ebd6
mov esi, dword [esi]
jmp 0x41eb97
push 0x80004005
call fcn.00421a67
mov dword [ebp - 4], esi
mov eax, dword [ebx + 0x10]
mov ecx, dword [ebx + 4]
cmp dword [eax + edi*8], ecx
lea eax, [eax + edi*8]
je 0x41ebec
mov ecx, dword [eax + 4]
mov ecx, dword [ecx]
cmp esi, ecx
je 0x41ec0e
mov eax, dword [esi + 8]
test eax, eax
je 0x41ebcc
mov edx, dword [ebp + 0xc]
mov ecx, dword [edx]
push eax
push ecx
call fcn.0051a11c
add esp, 8
test eax, eax
jne 0x41ec0e
mov esi, dword [esi]
jmp 0x41ebd9
mov ecx, dword [ebp - 4]
cmp ecx, esi
je 0x41ec25
mov eax, dword [ebp + 8]
pop edi
mov dword [eax + 4], esi
mov dword [eax], ecx
pop esi
mov esp, ebp
pop ebp
ret 8
mov eax, dword [ebx + 4]
mov ecx, dword [ebp + 8]
pop edi
mov dword [ecx], eax
mov dword [ecx + 4], eax
mov eax, ecx
pop esi
mov esp, ebp
pop ebp
ret 8
Function at 0x41ede7
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10127dd2
mov eax, dword fs:[0]
push eax
push ebx
push esi
push edi
mov eax, dword [0x1019efd0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
mov eax, dword [ebp + 0xc]
lea edx, [ebp + 0xa]
mov dword [esi + 8], eax
lea eax, [esi + 0x30]
push edx
xor edi, edi
push eax
mov dword [esi], edi
mov dword [esi + 4], edi
mov dword [esi + 0xc], ecx
call fcn.0041f437
lea ecx, [ebp + 0xa]
lea eax, [esi + 0x5c]
push ecx
push eax
mov dword [ebp - 4], edi
call fcn.0041f437
mov byte [ebp - 4], 1
mov edx, dword [0x1019eb58]
mov eax, dword [edx + 0xc]
mov ecx, 0x1019eb58
call eax
add eax, 0x10
mov dword [esi + 0x88], eax
mov byte [ebp - 4], 2
mov edx, dword [0x1019eb58]
mov eax, dword [edx + 0xc]
mov ecx, 0x1019eb58
call eax
add eax, 0x10
mov dword [esi + 0x8c], eax
mov byte [ebp - 4], 3
mov eax, dword [esi]
mov ecx, eax
neg ecx
sbb ecx, ecx
and ecx, 0xffff0001
add ecx, 0xffff
mov word [esi + 0x90], cx
mov dword [esi + 0x94], edi
mov dword [esi + 0x98], edi
mov dword [esi + 0x9c], edi
mov dword [esi + 0xa0], edi
cmp eax, edi
je 0x41eede
push 0x20
call fcn.00517f70
add esp, 4
cmp eax, edi
je 0x41ef05
push 0x100184e0
push 0x10018520
push 7
lea edi, [eax + 4]
push 4
push edi
mov dword [eax], 7
call fcn.00519ec0
jmp 0x41ef05
push 4
call fcn.00518025
mov ebx, eax
add esp, 4
cmp ebx, edi
je 0x41ef05
mov edx, dword [0x1019eb58]
mov eax, dword [edx + 0xc]
mov ecx, 0x1019eb58
call eax
add eax, 0x10
mov dword [ebx], eax
mov edi, ebx
mov eax, esi
mov dword [esi + 0x94], edi
call fcn.0041ef37
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x41f247
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 0xc]
mov ecx, dword [eax]
mov al, byte [ecx]
push esi
push edi
mov esi, 0x811c9dc5
test al, al
je 0x41f279
lea edx, [eax - 0x41]
inc ecx
cmp dl, 0x19
ja 0x41f268
add al, 0x20
imul esi, esi, 0x1000193
movsx eax, al
xor esi, eax
mov al, byte [ecx]
test al, al
jne 0x41f25d
mov eax, dword [ebx + 0x20]
mov edi, eax
and edi, esi
cmp dword [ebx + 0x24], edi
ja 0x41f28e
shr eax, 1
or ecx, 0xffffffff
sub ecx, eax
add edi, ecx
mov edx, dword [ebx + 0x10]
mov esi, dword [edx + edi*8]
mov dword [ebp - 4], esi
mov eax, dword [ebx + 0x10]
mov ecx, dword [ebx + 4]
cmp dword [eax + edi*8], ecx
lea eax, [eax + edi*8]
je 0x41f2aa
mov ecx, dword [eax + 4]
mov ecx, dword [ecx]
cmp esi, ecx
je 0x41f32a
mov edx, dword [ebp + 0xc]
mov eax, dword [edx]
test eax, eax
je 0x41f2cc
mov ecx, dword [esi + 8]
push eax
push ecx
call fcn.0051a11c
add esp, 8
test eax, eax
je 0x41f2d9
mov esi, dword [esi]
jmp 0x41f297
push 0x80004005
mov dword [ebp - 4], esi
call fcn.00421a67
mov eax, dword [esi + 8]
mov dword [ebp - 4], esi
test eax, eax
jne 0x41f2ed
push 0x80004005
call fcn.00421a67
mov ecx, dword [ebp + 0xc]
mov ecx, dword [ecx]
push eax
push ecx
call fcn.0051a11c
add esp, 8
test eax, eax
je 0x41f318
mov edx, dword [ebx + 4]
lea eax, [ebp + 0xc]
mov dword [ebp + 0xc], edx
mov ecx, dword [eax]
mov eax, dword [ebp + 8]
pop edi
mov dword [eax], ecx
pop esi
mov esp, ebp
pop ebp
ret 8
lea eax, [ebp - 4]
mov ecx, dword [eax]
mov eax, dword [ebp + 8]
pop edi
mov dword [eax], ecx
pop esi
mov esp, ebp
pop ebp
ret 8
mov edx, dword [ebx + 4]
mov eax, dword [ebp + 8]
pop edi
mov dword [ebp - 4], esi
mov dword [eax], edx
pop esi
mov esp, ebp
pop ebp
ret 8
Function at 0x420a17
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 0xc]
mov ecx, dword [eax]
push esi
mov eax, ecx
push edi
lea esi, [eax + 1]
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x420a27
sub eax, esi
add eax, ecx
mov edx, 0x811c9dc5
cmp ecx, eax
je 0x420a4b
movsx esi, byte [ecx]
imul edx, edx, 0x1000193
inc ecx
xor edx, esi
cmp ecx, eax
jne 0x420a3b
mov eax, dword [ebx + 0x20]
mov edi, eax
and edi, edx
cmp dword [ebx + 0x24], edi
ja 0x420a60
shr eax, 1
or ecx, 0xffffffff
sub ecx, eax
add edi, ecx
mov edx, dword [ebx + 0x10]
mov esi, dword [edx + edi*8]
nop
mov eax, dword [ebx + 0x10]
mov ecx, dword [ebx + 4]
cmp dword [eax + edi*8], ecx
lea eax, [eax + edi*8]
je 0x420a7a
mov ecx, dword [eax + 4]
mov ecx, dword [ecx]
cmp esi, ecx
je 0x420af5
mov edx, dword [ebp + 0xc]
mov eax, dword [edx]
test eax, eax
je 0x420a9c
mov ecx, dword [esi + 8]
push eax
push ecx
call fcn.00519dfc
add esp, 8
test eax, eax
je 0x420aa6
mov esi, dword [esi]
jmp 0x420a67
push 0x80004005
call fcn.00421a67
mov dword [ebp - 4], esi
mov eax, dword [ebx + 0x10]
mov ecx, dword [ebx + 4]
cmp dword [eax + edi*8], ecx
lea eax, [eax + edi*8]
je 0x420abc
mov ecx, dword [eax + 4]
mov ecx, dword [ecx]
cmp esi, ecx
je 0x420ade
mov eax, dword [esi + 8]
test eax, eax
je 0x420a9c
mov edx, dword [ebp + 0xc]
mov ecx, dword [edx]
push eax
push ecx
call fcn.00519dfc
add esp, 8
test eax, eax
jne 0x420ade
mov esi, dword [esi]
jmp 0x420aa9
mov ecx, dword [ebp - 4]
cmp ecx, esi
je 0x420af5
mov eax, dword [ebp + 8]
pop edi
mov dword [eax + 4], esi
mov dword [eax], ecx
pop esi
mov esp, ebp
pop ebp
ret 8
mov eax, dword [ebx + 4]
mov ecx, dword [ebp + 8]
pop edi
mov dword [ecx], eax
mov dword [ecx + 4], eax
mov eax, ecx
pop esi
mov esp, ebp
pop ebp
ret 8

Function at 0x420b97
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 0xc]
mov ecx, dword [ebx + 8]
mov eax, ecx
push edi
lea edi, [eax + 1]
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x420ba7
sub eax, edi
add eax, ecx
mov edx, 0x811c9dc5
cmp ecx, eax
je 0x420bcb
movsx edi, byte [ecx]
imul edx, edx, 0x1000193
inc ecx
xor edx, edi
cmp ecx, eax
jne 0x420bbb
mov ecx, dword [esi + 0x20]
mov eax, ecx
and eax, edx
cmp dword [esi + 0x24], eax
ja 0x420be0
shr ecx, 1
or edx, 0xffffffff
sub edx, ecx
add eax, edx
mov ecx, dword [esi + 0x10]
cmp dword [ecx + eax*8 + 4], ebx
lea ecx, [ecx + eax*8]
jne 0x420c09
cmp dword [ecx], ebx
jne 0x420c01
mov edx, dword [esi + 4]
mov dword [ecx], edx
mov ecx, dword [esi + 0x10]
mov edx, dword [esi + 4]
mov dword [ecx + eax*8 + 4], edx
jmp 0x420c11
mov eax, dword [ebx + 4]
mov dword [ecx + 4], eax
jmp 0x420c11
cmp dword [ecx], ebx
jne 0x420c14
mov edx, dword [ebx]
mov dword [ecx], edx
mov ebx, dword [ebp + 0xc]
push ebx
mov ebx, dword [ebp + 8]
lea edi, [esi + 4]
call fcn.00420c37
pop edi
mov eax, ebx
pop ebx
pop ebp
ret 8
Function at 0x420cd7
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push ecx
mov eax, dword [ebp + 0xc]
push ebx
push esi
push edi
mov edi, ecx
mov ecx, dword [eax]
mov al, byte [ecx]
mov esi, 0x811c9dc5
test al, al
je 0x420d13
lea esp, [esp]
lea edx, [eax - 0x41]
inc ecx
cmp dl, 0x19
ja 0x420d02
add al, 0x20
imul esi, esi, 0x1000193
movsx eax, al
xor esi, eax
mov al, byte [ecx]
test al, al
jne 0x420cf7
mov eax, dword [edi + 0x20]
mov ebx, eax
and ebx, esi
cmp dword [edi + 0x24], ebx
ja 0x420d28
shr eax, 1
or ecx, 0xffffffff
sub ecx, eax
add ebx, ecx
mov edx, dword [edi + 0x10]
mov ecx, dword [edx + ebx*8]
mov esi, dword [edi + 4]
lea eax, [edx + ebx*8]
cmp esi, ecx
je 0x420d74
mov eax, dword [eax + 4]
mov esi, dword [eax]
cmp esi, ecx
je 0x420d74
mov esi, dword [esi + 4]
mov eax, dword [esi + 8]
test eax, eax
je 0x420d68
mov ecx, dword [ebp + 0xc]
mov ecx, dword [ecx]
push eax
push ecx
call fcn.0051a11c
add esp, 8
test eax, eax
je 0x420d72
mov edx, dword [edi + 0x10]
cmp esi, dword [edx + ebx*8]
jne 0x420d41
jmp 0x420d74
push 0x80004005
call fcn.00421a67
mov esi, dword [esi]
mov eax, dword [ebp + 0x10]
mov ecx, dword [eax]
cmp esi, ecx
je 0x420d8d
push ecx
push eax
lea ecx, [edi + 4]
push esi
mov edx, ecx
call fcn.00421037
mov eax, dword [ebp + 0x10]
mov dword [esp + 0xc], eax
mov eax, dword [edi + 0x10]
mov ecx, dword [eax + ebx*8]
lea eax, [eax + ebx*8]
cmp ecx, dword [edi + 4]
jne 0x420db1
mov ecx, dword [ebp + 0x10]
mov dword [eax], ecx
mov edx, dword [edi + 0x10]
mov eax, dword [esp + 0xc]
mov dword [edx + ebx*8 + 4], eax
jmp 0x420dda
cmp ecx, esi
jne 0x420dbc
mov ecx, dword [ebp + 0x10]
mov dword [eax], ecx
jmp 0x420dda
mov edx, dword [eax + 4]
mov ecx, dword [edx]
mov dword [eax + 4], ecx
cmp ecx, dword [esp + 0xc]
je 0x420dda
mov eax, dword [edi + 0x10]
mov ecx, dword [eax + ebx*8 + 4]
mov edx, dword [ecx + 4]
lea eax, [eax + ebx*8 + 4]
mov dword [eax], edx
call fcn.00420f67
mov eax, dword [ebp + 8]
mov ecx, dword [ebp + 0x10]
pop edi
pop esi
mov dword [eax], ecx
mov byte [eax + 4], 1
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x420df7
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0xc
mov eax, dword [ebp + 0xc]
push ebx
push esi
push edi
mov edi, ecx
mov ecx, dword [eax]
mov eax, ecx
mov dword [esp + 0x10], edi
lea esi, [eax + 1]
lea esp, [esp]
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x420e17
sub eax, esi
add eax, ecx
mov edx, 0x811c9dc5
cmp ecx, eax
je 0x420e3b
movsx esi, byte [ecx]
imul edx, edx, 0x1000193
inc ecx
xor edx, esi
cmp ecx, eax
jne 0x420e2b
mov eax, dword [edi + 0x20]
mov ebx, eax
and ebx, edx
cmp dword [edi + 0x24], ebx
ja 0x420e50
shr eax, 1
or ecx, 0xffffffff
sub ecx, eax
add ebx, ecx
mov edx, dword [edi + 0x10]
mov ecx, dword [edx + ebx*8]
mov esi, dword [edi + 4]
add edi, 4
lea eax, [edx + ebx*8]
cmp esi, ecx
je 0x420e95
mov eax, dword [eax + 4]
mov esi, dword [eax]
cmp esi, ecx
je 0x420e95
mov esi, dword [esi + 4]
mov eax, dword [esi + 8]
test eax, eax
je 0x420edd
mov ecx, dword [ebp + 0xc]
mov ecx, dword [ecx]
push eax
push ecx
call fcn.00519dfc
add esp, 8
test eax, eax
je 0x420ed4
mov edx, dword [esp + 0x10]
mov eax, dword [edx + 0x10]
cmp esi, dword [eax + ebx*8]
jne 0x420e6c
mov ecx, dword [ebp + 0x10]
mov eax, dword [ecx]
cmp esi, eax
je 0x420ead
push eax
push ecx
push esi
mov ecx, edi
mov edx, edi
call fcn.00421037
mov ecx, dword [ebp + 0x10]
mov eax, dword [esp + 0x10]
mov edx, dword [eax + 0x10]
lea eax, [edx + ebx*8]
mov edx, dword [eax]
mov dword [esp + 0x14], ecx
cmp edx, dword [edi]
jne 0x420f1b
mov edx, dword [esp + 0x14]
mov dword [eax], ecx
mov eax, dword [esp + 0x10]
mov ecx, dword [eax + 0x10]
mov dword [ecx + ebx*8 + 4], edx
jmp 0x420f45
mov ecx, dword [ebp + 0xc]
mov eax, dword [ecx]
test eax, eax
jne 0x420ee7
push 0x80004005
call fcn.00421a67
mov ecx, dword [esi + 8]
push eax
push ecx
call fcn.00519dfc
add esp, 8
test eax, eax
je 0x420efc
mov esi, dword [esi]
jmp 0x420e95
mov edx, dword [ebp + 0x10]
push edx
lea ebx, [esp + 0x18]
call fcn.00420c37
mov eax, dword [ebp + 8]
mov dword [eax], esi
mov byte [eax + 4], 0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
cmp edx, esi
jne 0x420f23
mov dword [eax], ecx
jmp 0x420f45
mov ecx, dword [eax + 4]
mov ecx, dword [ecx]
mov dword [eax + 4], ecx
cmp ecx, dword [esp + 0x14]
je 0x420f45
mov edx, dword [esp + 0x10]
mov eax, dword [edx + 0x10]
mov ecx, dword [eax + ebx*8 + 4]
mov edx, dword [ecx + 4]
lea ebx, [eax + ebx*8 + 4]
mov dword [ebx], edx
mov edi, dword [esp + 0x10]
call fcn.004210a7
mov eax, dword [ebp + 8]
mov ecx, dword [ebp + 0x10]
pop edi
pop esi
mov dword [eax], ecx
mov byte [eax + 4], 1
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x4258c7
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10129c08
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
mov eax, dword [0x1019efd0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
lea eax, [ebp - 0x10]
push eax
call fcn.004218f7
lea ecx, [ebp - 0x10]
push ecx
lea edx, [ebp - 0x14]
push edx
lea ebx, [edi + 0x30]
mov dword [ebp - 4], 0
call fcn.0041f247
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x10]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x425933
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [ebp - 0x14]
cmp eax, dword [edi + 0x34]
je 0x42595a
mov ecx, dword [eax + 0xc]
mov edx, dword [ebp + 8]
mov dword [edx], ecx
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop ebx
mov esp, ebp
pop ebp
ret 4
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop ebx
mov esp, ebp
pop ebp
ret 4