joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40ab48
Capabilities:
Delete registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x10], ebx
mov dword [ebp - 0x14], ebx
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov edi, eax
mov ebx, dword [ebp + 8]
xor eax, eax
push ebp
push 0x40ac16
push dword fs:[eax]
mov dword fs:[eax], esp
xor esi, esi
push 0
lea eax, [ebp - 0xc]
push eax
push 0
push 0xf003f
push 0
push 0x40ac28
push 0
mov eax, dword [ebp - 4]
push eax
push edi
call sub.advapi32.dll_RegCreateKeyExA
test eax, eax
jne 0x40abfb
test ebx, ebx
je 0x40abb7
lea eax, [ebp - 0x14]
mov edx, ebx
call fcn.00403908
mov eax, dword [ebp - 0x14]
lea edx, [ebp - 0x10]
call fcn.00408cb0
cmp dword [ebp - 0x10], 0
jne 0x40abcf
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegDeleteValueA
test eax, eax
jne 0x40abf2
mov esi, 1
jmp 0x40abf2
mov eax, ebx
call fcn.00408c80
push eax
push ebx
push 1
push 0
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegSetValueExA
test eax, eax
jne 0x40abf2
mov esi, 1
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegCloseKey_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40ac1d
lea eax, [ebp - 0x14]
mov edx, 2
call fcn.00403750
ret

Function at 0x40b124
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff00
push ebx
push esi
push edi
mov esi, dword [ebp + 0xc]
mov edi, dword [ebp + 8]
call sym.dwlGina3.dll_wlIsNTSystem
dec eax
jne 0x40b164
push edi
call sym.dwlGina3.dll_wlGetKeyState
cmp esi, eax
je 0x40b185
push 0
push 1
push 0x45
mov ebx, edi
push ebx
call sub.user32.dll_keybd_event
push 0
push 3
push 0x45
push ebx
call sub.user32.dll_keybd_event
jmp 0x40b185
lea eax, [ebp - 0x100]
push eax
call sub.user32.dll_GetKeyboardState
mov eax, esi
mov byte [ebp + edi - 0x100], al
lea eax, [ebp - 0x100]
push eax
call sub.user32.dll_SetKeyboardState
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x40b190
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffef8
push ebx
push esi
xor eax, eax
mov dword [ebp - 8], eax
mov ebx, dword [ebp + 8]
xor eax, eax
push ebp
push 0x40b2c3
push dword fs:[eax]
mov dword fs:[eax], esp
xor esi, esi
lea eax, [ebp - 4]
push eax
push 0xf003f
push 0
push 0x40b2d4
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA_1
test eax, eax
jne 0x40b2ad
mov eax, ebx
call fcn.00408c80
inc eax
push eax
push ebx
push 1
push 0
push 0x40b30c
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegSetValueExA
test eax, eax
jne 0x40b2a4
mov eax, ebx
call fcn.00408c80
inc eax
push eax
push ebx
push 1
push 0
push 0x40b320
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegSetValueExA
mov eax, dword [ebp + 0xc]
call fcn.00408c80
inc eax
push eax
mov eax, dword [ebp + 0xc]
push eax
push 1
push 0
push 0x40b330
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegSetValueExA
mov eax, dword [ebp + 0x14]
call fcn.00408c80
inc eax
push eax
mov eax, dword [ebp + 0x14]
push eax
push 1
push 0
push 0x40b340
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegSetValueExA
lea edx, [ebp - 0x108]
mov eax, dword [ebp + 0x10]
call fcn.004027c4
lea edx, [ebp - 0x108]
lea eax, [ebp - 8]
call fcn.00403974
mov eax, dword [ebp - 8]
call fcn.004039ac
inc eax
test eax, eax
jns 0x40b283
call fcn.00402cac
push eax
mov eax, dword [ebp - 8]
call fcn.00403bac
push eax
push 1
push 0
push 0x40b354
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegSetValueExA
mov esi, 1
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegCloseKey_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40b2ca
lea eax, [ebp - 8]
call fcn.0040372c
ret
Function at 0x40b4b0
Capabilities:
Delete registry value
Query or enumerate registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff004
push eax
add esp, 0xfffffff8
push ebx
push esi
push edi
mov esi, dword [ebp + 0xc]
mov ebx, dword [ebp + 8]
xor edi, edi
shl ebx, 0x10
and esi, 0xffff
test ebx, ebx
je 0x40b6ff
lea eax, [ebp - 0x1008]
mov edx, 0x1000
call fcn.00404da0
lea eax, [ebp - 4]
push eax
push 0xf003f
push 0
push 0x40b70c
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA_1
test eax, eax
jne 0x40b6ff
mov dword [ebp - 8], 0x1000
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x1008]
push eax
push 0
push 0
push 0x40b740
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
je 0x40b53c
cmp eax, 2
jne 0x40b6f6
cmp eax, 2
je 0x40b547
cmp dword [ebp - 8], 0
jne 0x40b569
xor eax, eax
mov dword [ebp - 0x1008], eax
xor eax, eax
mov dword [ebp - 0x1004], eax
mov dword [ebp - 0x1000], 1
xor eax, eax
mov dword [ebp - 0xffc], eax
xor eax, eax
mov dword [ebp - 8], eax
jmp 0x40b644
mov eax, dword [ebp - 8]
cmp eax, 0x3fc
jbe 0x40b582
call fcn.00402cac
mov edx, dword [ebp + eax*4 - 0xffc]
mov ecx, edx
and ecx, 0xffff0000
cmp ecx, ebx
jne 0x40b641
mov ecx, dword [ebp - 8]
cmp ecx, 0x3fc
jbe 0x40b5a9
call fcn.00402cac
mov edi, edx
shr edi, 0x10
mov edx, ebx
shr edx, 0x10
cmp esi, edx
jne 0x40b61f
mov edx, dword [ebp - 0x1000]
sub edx, 2
cmp edx, dword [ebp - 8]
jle 0x40b5f9
mov edx, dword [ebp - 0x1000]
sub edx, 2
cmp edx, 0x3fc
jbe 0x40b5db
call fcn.00402cac
mov edx, dword [ebp + edx*4 - 0xffc]
mov ecx, dword [ebp - 8]
cmp ecx, 0x3fc
jbe 0x40b5f2
call fcn.00402cac
mov dword [ebp + eax*4 - 0xffc], edx
mov eax, dword [ebp - 0x1000]
sub eax, 2
cmp eax, 0x3fc
jbe 0x40b60e
call fcn.00402cac
xor edx, edx
mov dword [ebp + eax*4 - 0xffc], edx
dec dword [ebp - 0x1000]
jmp 0x40b63a
mov edx, esi
or edx, ebx
mov ecx, dword [ebp - 8]
cmp ecx, 0x3fc
jbe 0x40b633
call fcn.00402cac
mov dword [ebp + eax*4 - 0xffc], edx
xor eax, eax
mov dword [ebp - 8], eax
jmp 0x40b654
inc dword [ebp - 8]
mov eax, dword [ebp - 0x1000]
dec eax
cmp eax, dword [ebp - 8]
jg 0x40b573
mov eax, dword [ebp - 0x1000]
dec eax
cmp eax, dword [ebp - 8]
jne 0x40b6a4
mov edx, ebx
shr edx, 0x10
cmp esi, edx
je 0x40b6a4
mov edi, ebx
shr edi, 0x10
or ebx, esi
cmp eax, 0x3fc
jbe 0x40b67c
call fcn.00402cac
mov dword [ebp + eax*4 - 0xffc], ebx
mov eax, dword [ebp - 0x1000]
cmp eax, 0x3fc
jbe 0x40b695
call fcn.00402cac
xor edx, edx
mov dword [ebp + eax*4 - 0xffc], edx
inc dword [ebp - 0x1000]
mov ebx, dword [ebp - 0x1000]
cmp ebx, 1
jle 0x40b6e2
mov eax, ebx
shl eax, 2
add eax, 0xc
test eax, eax
jns 0x40b6c0
call fcn.00402cac
push eax
lea eax, [ebp - 0x1008]
push eax
push 3
push 0
push 0x40b740
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegSetValueExA
test eax, eax
je 0x40b6f6
xor edi, edi
jmp 0x40b6f6
push 0x40b740
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegDeleteValueA
test eax, eax
je 0x40b6f6
xor edi, edi
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegCloseKey_1
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x40b854
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffc0
push ebx
xor eax, eax
mov dword [ebp - 0x40], eax
mov eax, dword [ebp + 0xc]
call fcn.00403b9c
mov eax, dword [ebp + 0x10]
call fcn.00403b9c
xor eax, eax
push ebp
push 0x40b932
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
lea eax, [ebp - 0x3c]
xor ecx, ecx
mov edx, 0x3c
call fcn.00402744
mov dword [ebp - 0x3c], 0x3c
mov eax, dword [ebp + 8]
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x38], 0x500
mov eax, 0x40b944
mov dword [ebp - 0x30], eax
mov eax, dword [ebp + 0xc]
call fcn.00403bac
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp + 0x10]
call fcn.00403bac
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x20], 1
lea eax, [ebp - 0x3c]
push eax
call sub.shell32.dll_ShellExecuteExA
test eax, eax
jne 0x40b90f
call sub.kernel32.dll_GetLastError
test eax, eax
jns 0x40b8e3
call fcn.00402cac
cmp eax, 0x4c7
je 0x40b90a
lea edx, [ebp - 0x40]
mov eax, 0x40a86c
call fcn.00404690
mov eax, dword [ebp - 0x40]
call fcn.00403bac
xor edx, edx
call fcn.0040a874
xor ebx, ebx
jmp 0x40b90f
mov ebx, 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40b939
lea eax, [ebp - 0x40]
call fcn.0040372c
lea eax, [ebp + 0xc]
mov edx, 2
call fcn.00403750
ret

Function at 0x40c1e4
Capabilities:
Find taskbar

Disassembly:
push 0
push 0x40c1f4
call sub.user32.dll_FindWindowA
ret

Function at 0x40c374
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
add esp, 0xffffffc0
dec eax
jne 0x40c464
cmp dword [0x4122f8], 0
jne 0x40c48c
mov eax, esp
mov edx, 0x30
call fcn.00404da0
mov dword [esp], 0x30
mov dword [esp + 8], 0x40c300
mov eax, dword [0x414660]
mov dword [esp + 0x14], eax
mov eax, 0x40c494
mov dword [esp + 0x28], eax
push 0x7f00
push 0
call sub.user32.dll_LoadCursorA
mov dword [esp + 0x1c], eax
push esp
call sub.user32.dll_RegisterClassExA
lea eax, [esp + 0x30]
push eax
call fcn.0040c2b0
push eax
call sub.user32.dll_GetClientRect
mov ebx, dword [esp + 0x30]
push ebx
mov esi, dword [esp + 0x38]
push esi
mov eax, dword [esp + 0x40]
sub eax, ebx
push eax
mov eax, dword [esp + 0x48]
sub eax, esi
push eax
call fcn.0040c2b0
push eax
push 0
mov eax, dword [0x414660]
push eax
push 0
mov edx, 0x40c494
mov eax, 0x40c494
mov ecx, 0x40000000
call fcn.00404db0
mov dword [0x4122f8], eax
push 0x40
mov ecx, dword [esp + 0x40]
mov edx, dword [esp + 0x38]
sub ecx, edx
push ecx
mov ecx, dword [esp + 0x40]
mov eax, dword [esp + 0x38]
sub ecx, eax
push ecx
push edx
push eax
push 0
mov eax, dword [0x4122f8]
push eax
call sub.user32.dll_SetWindowPos
push 5
mov eax, dword [0x4122f8]
push eax
call sub.user32.dll_ShowWindow
push 0
call fcn.0040c2b0
push eax
call sub.user32.dll_ShowWindow
jmp 0x40c48c
cmp dword [0x4122f8], 0
je 0x40c478
mov eax, dword [0x4122f8]
push eax
call sub.user32.dll_DestroyWindow
xor eax, eax
mov dword [0x4122f8], eax
push 5
call fcn.0040c2b0
push eax
call sub.user32.dll_ShowWindow
add esp, 0x40
pop esi
pop ebx
ret
Function at 0x40c564
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
cmp byte [ebp + 8], 0
je 0x40c5a6
push 0
call fcn.0040c224
push eax
call sub.user32.dll_ShowWindow
push 0
call fcn.0040c534
push eax
call sub.user32.dll_ShowWindow
call fcn.0040c204
test eax, eax
je 0x40c5dd
push 1
push 0xff
push 0
call fcn.0040c204
push eax
call sym.dwlGina3.dll_wlDisableKey
jmp 0x40c5dd
push 5
call fcn.0040c224
push eax
call sub.user32.dll_ShowWindow
push 5
call fcn.0040c534
push eax
call sub.user32.dll_ShowWindow
call fcn.0040c204
test eax, eax
je 0x40c5dd
push 0
push 0xff
push 0
call fcn.0040c204
push eax
call sym.dwlGina3.dll_wlDisableKey
pop ebp
ret 4

Function at 0x40c5e4
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
cmp byte [ebp + 8], 0
je 0x40c5fc
push 0
call fcn.0040c288
push eax
call sub.user32.dll_ShowWindow
jmp 0x40c609
push 5
call fcn.0040c288
push eax
call sub.user32.dll_ShowWindow
pop ebp
ret 4

Function at 0x40c610
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
cmp byte [ebp + 8], 0
je 0x40c628
push 0
call fcn.0040c2d8
push eax
call sub.user32.dll_ShowWindow
jmp 0x40c635
push 5
call fcn.0040c2d8
push eax
call sub.user32.dll_ShowWindow
pop ebp
ret 4

Function at 0x40c63c
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
call sym.dwlGina3.dll_wlWinVersion
cmp eax, 8
jl 0x40c673
push 0
push 0x40c698
call sub.user32.dll_FindWindowA
test eax, eax
je 0x40c673
test bl, bl
je 0x40c66b
push 0
push eax
call sub.user32.dll_ShowWindow
jmp 0x40c673
push 5
push eax
call sub.user32.dll_ShowWindow
test bl, bl
je 0x40c686
push 0
call fcn.0040c268
push eax
call sub.user32.dll_ShowWindow
jmp 0x40c693
push 5
call fcn.0040c268
push eax
call sub.user32.dll_ShowWindow
pop ebx
pop ebp
ret 4

Function at 0x40c6a0
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
push ebx
call fcn.0040c63c
test bl, bl
je 0x40c6c0
push 0
call fcn.0040c1e4
push eax
call sub.user32.dll_ShowWindow
jmp 0x40c6cd
push 5
call fcn.0040c1e4
push eax
call sub.user32.dll_ShowWindow
pop ebx
pop ebp
ret 4

Function at 0x40ce78
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov ebx, dword [ebp + 8]
xor esi, esi
test ebx, ebx
jne 0x40cebf
mov eax, dword [0x413270]
mov eax, dword [eax]
mov eax, dword [eax + 0x118]
test eax, eax
je 0x40cea5
push 0
mov edx, dword [0x413270]
push eax
call sub.user32.dll_ShowWindow
push 0
push 0xe
call sym.dwlGina3.dll_wlDisableItem
mov eax, dword [0x413270]
mov eax, dword [eax]
xor edx, edx
mov dword [eax + 0x118], edx
jmp 0x40ceda
push 1
push 0xe
call sym.dwlGina3.dll_wlDisableItem
mov eax, dword [0x413270]
mov eax, dword [eax]
mov dword [eax + 0x118], ebx
mov esi, 1
mov eax, esi
pop esi
pop ebx
pop ebp
ret 4
Function at 0x40dc50
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd4
push ebx
push esi
push edi
mov edi, ecx
mov dword [ebp - 4], edx
mov esi, eax
mov ebx, dword [ebp + 0xc]
test edi, edi
jne 0x40dd33
push esi
call sub.user32.dll_IsWindowVisible
cmp eax, 1
sbb eax, eax
inc eax
test al, al
je 0x40dcd0
push esi
call sub.user32.dll_SetForegroundWindow
cmp ebx, 0x1b
je 0x40dcaa
cmp ebx, 0x5b
je 0x40dcaa
cmp ebx, 0x5c
je 0x40dcaa
cmp ebx, 0xa4
je 0x40dcaa
cmp ebx, 0xa5
je 0x40dcaa
cmp ebx, 0x12
je 0x40dcaa
cmp ebx, 0x75
jne 0x40dcb4
push 0
push esi
call sub.user32.dll_ShowWindow
jmp 0x40dd33
cmp esi, dword [ebp - 4]
je 0x40dd33
mov eax, dword [ebp - 4]
push eax
call sub.user32.dll_GetParent
cmp esi, eax
je 0x40dd33
push 0
push esi
call sub.user32.dll_ShowWindow
jmp 0x40dd33
mov ecx, dword [ebp + 8]
mov edx, ebx
mov eax, edi
call fcn.0040dbbc
test al, al
je 0x40dd33
push 1
call sym.dwlGina3.dll_wlGetItemHandle
lea edx, [ebp - 0x1c]
push edx
push eax
call sub.user32.dll_GetWindowRect
lea eax, [ebp - 0x2c]
push eax
push esi
call sub.user32.dll_GetWindowRect
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0xc]
push eax
mov ecx, dword [ebp - 0x20]
sub ecx, dword [ebp - 0x28]
mov edx, dword [ebp - 0x24]
sub edx, dword [ebp - 0x2c]
lea eax, [ebp - 0x1c]
call fcn.0040dbec
push 0x51
push 0
push 0
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [ebp - 8]
push eax
push 0xffffffffffffffff
push esi
call sub.user32.dll_SetWindowPos
push esi
call sub.user32.dll_SetForegroundWindow
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x40e940
Capabilities:
Log keystrokes via application hook
Set global application hook

Disassembly:
push ebx
mov ebx, eax
cmp dword [0x41230c], 0
jne 0x40e978
push 0
mov eax, dword [0x414660]
push eax
push 0x40e4e0
push 0xd
call sub.user32.dll_SetWindowsHookExA
mov dword [0x41230c], eax
cmp dword [0x41230c], 0
je 0x40e978
mov eax, 0x40ea70
call fcn.00408fd8
cmp dword [0x41230c], 0
jne 0x40e9b6
cmp dword [0x412304], 0
jne 0x40e9b6
push 0
mov eax, dword [0x414660]
push eax
push 0x40e520
push 3
call sub.user32.dll_SetWindowsHookExA
mov dword [0x412304], eax
cmp dword [0x412304], 0
je 0x40e9b6
mov eax, 0x40ea98
call fcn.00408fd8
test bl, bl
je 0x40e9f8
cmp dword [0x412308], 0
jne 0x40e9f8
cmp dword [0x412304], 0
jne 0x40e9f8
push 0
mov eax, dword [0x414660]
push eax
push 0x40e800
push 3
call sub.user32.dll_SetWindowsHookExA
mov dword [0x412308], eax
cmp dword [0x412308], 0
je 0x40e9f8
mov eax, 0x40eac0
call fcn.00408fd8
cmp dword [0x412310], 0
jne 0x40ea65
call sym.dwlGina3.dll_wlWinVersion
cmp eax, 7
jle 0x40ea39
push 0
mov eax, dword [0x414660]
push eax
push 0x40e008
push 0xe
call sub.user32.dll_SetWindowsHookExA
mov dword [0x412310], eax
cmp dword [0x412310], 0
je 0x40ea65
mov eax, 0x40eae8
call fcn.00408fd8
jmp 0x40ea65
push 0
mov eax, dword [0x414660]
push eax
push 0x40dd3c
push 7
call sub.user32.dll_SetWindowsHookExA
mov dword [0x412310], eax
cmp dword [0x412310], 0
je 0x40ea65
mov eax, 0x40eb0c
call fcn.00408fd8
pop ebx
ret
Function at 0x410138
Capabilities:
Get keyboard layout
Log keystrokes via polling

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffee0
mov ebx, edx
mov esi, eax
push esi
mov esi, 0x4101bc
lea edi, [esp + 4]
mov ecx, 8
rep movsd dword es:[edi], dword [esi]
pop esi
push 0
call sub.user32.dll_GetKeyboardLayout
push eax
push 0
push esi
call sub.user32.dll_MapVirtualKeyExA
shl eax, 0x10
push 0x20
lea edx, [esp + 4]
push edx
push eax
call sub.user32.dll_GetKeyNameTextA
mov eax, ebx
mov edx, esp
mov ecx, 0x20
call fcn.00403980
cmp dword [ebx], 0
jne 0x4101b2
test esi, esi
jle 0x4101b2
lea edx, [esp + 0x20]
mov eax, esi
call fcn.004027c4
lea edx, [esp + 0x20]
mov eax, ebx
call fcn.00403974
mov ecx, dword [ebx]
mov eax, ebx
mov edx, 0x4101e4
call fcn.004039f8
add esp, 0x120
pop edi
pop esi
pop ebx
ret
Function at 0x41b393
Capabilities:
Hash data using fnv

Disassembly:
mov edx, dword [0x42a248]
test edi, edi
jne fcn.0041b3a1
test edx, edx
jne 0x41b401

Function at 0x41b3a1
Capabilities:
Hash data using fnv

Disassembly:
push ecx
push esi
mov esi, dword [0x42a1f8]
mov eax, edi
mov dword [esi], eax
mov edx, 0x811c9dc5
xor ecx, ecx
test eax, eax
je 0x41b3c6
xor dl, al
imul edx, edx, 0x1000193
inc ecx
shr eax, 8
jmp 0x41b3b4
or byte [0x42a4a1], 1
and dword [0x42a24c], 0
mov byte [0x42a4a0], 2
mov byte [0x42a4a2], 0
or byte [0x42a4a3], 1
or byte [0x42a4a4], 1
test ebx, ebx
jne 0x41b3fa
mov ebx, dword [0x42a244]
call fcn.0041bbed
pop esi
pop ecx
mov ebx, dword [edx + 0xc]
ret

Function at 0x41be11
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov byte [0x42a4a2], dl
test ebx, ebx
jne 0x41be21
mov ebx, dword [0x42a184]
mov esi, eax
mov edx, 0x811c9dc5
mov dword [0x42a270], ecx
mov ecx, 4
xor dl, al
imul edx, edx, 0x1000193
shr eax, 8
loop 0x41be33
mov eax, dword [0x42a270]
mov ecx, 4
xor dl, al
imul edx, edx, 0x1000193
shr eax, 8
loop 0x41be4a
mov ecx, dword [0x42a270]
mov byte [0x42a4a0], 3
or byte [0x42a4a3], 1
or byte [0x42a4a4], 1
call fcn.0041bbed
mov edi, dword [0x42a268]
ret

Function at 0x42457b
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
xor ecx, ecx
call fcn.0041ad6c
jb 0x42459b
cmp al, 0x1a
je 0x42459d
cmp al, 0x30
je 0x424674
cmp al, 0x23
jne 0x42459b
call fcn.0041b551
jae fcn.0042457b
stc
ret
inc esi
lodsd eax, dword [esi]
mov ebx, eax
mov ecx, dword [ebx]
mov eax, dword [ebx + ecx + 4]
mov dword [0x42a250], eax
mov eax, dword [ebx + ecx + 8]
mov dword [0x42a254], eax
xor ecx, ecx
call fcn.0041ad6c
jb 0x4245d8
cmp al, 0x23
jne 0x4245d8
call fcn.0041b551
jb 0x4245d8
call fcn.0041ad6c
jb 0x4245d8
cmp al, 0x1a
je 0x4245ff
cmp al, 0x30
je 0x4245ff
mov dword [0x42a27c], ebx
cmp ebx, dword [0x42a1f0]
je 0x4245ef
mov byte [0x42a4a1], 0
clc
ret
sub edi, ebx
sub edi, 4
mov dword [ebx], edi
mov byte [0x42a4a1], 1
clc
ret
mov edx, 0x42a1f0
cmp ebx, dword [edx]
je 0x42461f
mov edi, dword [edx]
add edi, 4
mov ecx, dword [ebx]
call fcn.0041a718
xchg esi, ebx
lodsd eax, dword [esi]
mov ecx, eax
rep movsb byte es:[edi], byte [esi]
mov esi, ebx
mov ebx, dword [edx]
lodsb al, byte [esi]
cmp al, 0x30
je 0x42468d
lodsd eax, dword [esi]
push ebx
push esi
mov esi, eax
mov ecx, dword [esi]
mov edx, 0x42a1f0
call fcn.0041a718
lodsd eax, dword [esi]
lea ebx, [esi + eax]
mov ecx, dword [0x42a250]
mov edx, dword [0x42a254]
xor eax, eax
lodsb al, byte [esi]
xor cl, al
xor dl, byte [eax + section..bss]
imul ecx, ecx, 0x1000193
imul edx, edx, 0x1000193
stosb byte es:[edi], al
cmp esi, ebx
jne 0x424647
mov dword [0x42a250], ecx
mov dword [0x42a254], edx
pop esi
pop ebx
jmp 0x4245b5
inc esi
mov ebx, dword [0x42a1f0]
lea edi, [ebx + 4]
mov eax, 0x811c9dc5
mov dword [0x42a250], eax
mov dword [0x42a254], eax
mov edx, esi
mov ecx, dword [edx]
lea esi, [esi + ecx + 4]
push ebx
push esi
push edi
call fcn.0041c9bf
pop edi
mov eax, edx
jmp 0x424627
Function at 0x426d51
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov edx, 0x811c9dc5
jecxz 0x426d6a
mov eax, ecx
xor dl, byte [esi]
inc esi
imul edx, edx, 0x1000193
loop 0x426d5a
mov ecx, eax
sub esi, ecx
ret
inc ecx
lodsb al, byte [esi]
xor dl, al
imul edx, edx, 0x1000193
test al, al
jne 0x426d6a
sub esi, ecx
ret

Function at 0x426e96
Capabilities:
Hash data using fnv

Disassembly:
mov ecx, dword [0x42a400]
shl ecx, 1
add ecx, 0x12
call fcn.004196bc
mov dword [0x42a404], eax
mov dword [0x42a408], ecx
add eax, ecx
sub eax, dword [0x42a3fc]
sub eax, dword [0x42a400]
mov dword [0x42a40c], eax
mov esi, dword [0x42a3fc]
mov edi, dword [0x42a404]
mov byte [0x42a4b2], 0xa
mov eax, dword [0x42a40c]
add eax, esi
sub eax, edi
cmp eax, 0x12
jae 0x426f2f
mov ecx, esi
sub ecx, dword [0x42a3fc]
mov eax, dword [0x42a400]
mul dword [0x42a408]
div ecx
mov ecx, eax
add ecx, 0x12
mov eax, dword [0x42a404]
call fcn.004196f0
sub edi, dword [0x42a404]
add edi, eax
mov dword [0x42a404], eax
mov dword [0x42a408], ecx
add eax, ecx
sub eax, dword [0x42a3fc]
sub eax, dword [0x42a400]
mov dword [0x42a40c], eax
movzx eax, byte [esi]
inc esi
mov ah, byte [eax + section..bss]
cmp ah, 0x20
je 0x426ff2
test ah, ah
jne 0x426f92
stosb byte es:[edi], al
mov byte [0x42a4b2], al
jmp 0x426ed7
mov dl, al
mov byte [edi], 0x22
mov byte [0x42a4b2], 0x22
add edi, 5
xor ecx, ecx
mov al, byte [esi]
cmp al, 0xd
je 0x426f81
cmp al, 0xa
je 0x426f81
cmp al, 0x1a
je 0x426f81
test al, al
je 0x426f81
inc esi
cmp al, dl
jne 0x426f7b
cmp byte [esi], al
jne 0x426f85
inc esi
mov byte [edi + ecx], al
inc ecx
jmp 0x426f5f
mov byte [edi - 5], 0x27
mov al, byte [edi - 5]
mov dword [edi - 4], ecx
add edi, ecx
jmp 0x426ed7
cmp al, 0x22
je 0x426f4e
cmp al, 0x27
je 0x426f4e
mov byte [edi], 0x1a
mov byte [0x42a4b2], 0x1a
add edi, 5
xor ebx, ebx
mov ecx, 0x811c9dc5
mov edx, ecx
mov byte [edi + ebx], al
inc ebx
xor cl, al
xor dl, ah
imul ecx, ecx, 0x1000193
imul edx, edx, 0x1000193
movzx eax, byte [esi]
inc esi
mov ah, byte [eax + section..bss]
cmp ah, 0x20
je 0x426fd7
test ah, ah
jne 0x426fb0
mov dword [edi - 4], ebx
add edi, ebx
mov dword [edi], ecx
mov dword [edi + 4], edx
xor ecx, ecx
mov dword [edi + 8], ecx
add edi, 0xc
cmp ah, 0x20
jne 0x426f46
cmp al, 0x20
je 0x427052
cmp al, 9
je 0x427052
cmp byte [0x42a4b2], 0x20
je 0x427004
inc edi
mov byte [edi - 1], 0xa
mov byte [0x42a4b2], 0xa
cmp al, 0xd
je 0x427034
cmp al, 0xa
je 0x427043
xor al, al
stosb byte es:[edi], al
mov ecx, edi
mov eax, dword [0x42a404]
sub ecx, eax
call fcn.004196f0
mov dword [0x42a404], eax
mov dword [0x42a408], ecx
ret
cmp byte [esi], 0xa
jne 0x426ed7
inc esi
jmp 0x426ed7
cmp byte [esi], 0xd
jne 0x426ed7
inc esi
jmp 0x426ed7
cmp byte [0x42a4b2], 0xa
je 0x426ed7
cmp byte [0x42a4b2], 0x20
je 0x426ed7
mov al, 0x20
stosb byte es:[edi], al
mov byte [0x42a4b2], al
jmp 0x426ed7