joyce8/EMBER2024-capa huggingface dataset:
Function at 0x44ece0
Capabilities:
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push esi
mov esi, ecx
mov dword [ebp - 0x10], 0
call fcn.00454a40
test al, al
jne 0x44ed00
pop esi
mov esp, ebp
pop ebp
ret 4
cmp byte [esi + 0x18], 0
mov ecx, 0x1000002
push ebx
push 0
push 0
mov eax, 2
cmovne eax, ecx
mov ecx, esi
push 0
push eax
push 0
call fcn.00469a80
push eax
call dword [sym.imp.KERNEL32.DLL_CreateFileMappingW]
push eax
lea ecx, [esi + 0x14]
call fcn.0041297a
mov eax, dword [esi + 0x14]
test eax, eax
je 0x44ee38
cmp eax, 0xffffffff
je 0x44ee38
mov ebx, dword [ebp + 8]
mov ecx, ebx
push edi
xor edi, edi
mov dword [ebp - 8], 0
push 0x4d70f0
mov dword [ebp - 0x10], 0
mov dword [ebp - 4], edi
call fcn.0044eb30
test al, al
je 0x44ed96
mov ecx, esi
call fcn.00454880
mov ecx, eax
add eax, 0xffffffff
adc edx, 0xffffffff
test edx, edx
ja 0x44ee2d
jb 0x44ed91
cmp eax, 0x7ffffffe
ja 0x44ee2d
mov dword [esi + 0x10], ecx
jmp 0x44edff
lea eax, [ebp - 4]
xorps xmm0, xmm0
push eax
lea eax, [ebp - 0x14]
movlpd qword [ebp - 0xc], xmm0
push eax
lea eax, [ebp - 0xc]
movlpd qword [ebp - 0x14], xmm0
push eax
push dword [ebx + 0xc]
push dword [ebx + 8]
push dword [ebx + 4]
push dword [ebx]
call fcn.0044eb60
mov eax, dword [ebp - 4]
add esp, 0x1c
cdq
mov edi, eax
mov eax, dword [ebp - 8]
add edi, dword [ebx + 8]
mov dword [ebp - 0x10], eax
adc edx, dword [ebx + 0xc]
test eax, eax
jl 0x44ee2d
mov eax, dword [ebp - 0xc]
mov dword [ebp - 8], eax
jg 0x44ede4
test eax, eax
jb 0x44ee2d
test edx, edx
jl 0x44ee2d
jg 0x44edf0
test edi, edi
jb 0x44ee2d
test edx, edx
ja 0x44ee2d
jb 0x44edf9
cmp edi, 0xffffffff
ja 0x44ee2d
mov eax, dword [ebx + 8]
mov dword [esi + 0x10], eax
push edi
push dword [ebp - 8]
push dword [ebp - 0x10]
push 4
push dword [esi + 0x14]
call dword [sym.imp.KERNEL32.DLL_MapViewOfFile]
mov ecx, eax
mov dword [esi + 0xc], ecx
test ecx, ecx
je 0x44ee2d
mov eax, dword [ebp - 4]
pop edi
add eax, ecx
mov dword [esi + 0xc], eax
mov al, 1
pop ebx
pop esi
mov esp, ebp
pop ebp
ret 4
pop edi
pop ebx
xor al, al
pop esi
mov esp, ebp
pop ebp
ret 4
pop ebx
xor al, al
pop esi
mov esp, ebp
pop ebp
ret 4

Function at 0x453a90
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, dword [ebp + 8]
mov dword [ebp - 4], 0
push edi
test esi, esi
je 0x453ab8
call fcn.0044d690
cmp eax, 1
jl 0x453ab8
mov dword [ebp - 4], 0x10000
jmp 0x453aba
xor esi, esi
push 8
call fcn.00483600
mov ecx, dword [ebp + 0xc]
add esp, 4
mov edi, dword [ebp + 0x10]
mov ebx, eax
test edi, edi
push 0
push dword [ebp - 4]
mov dword [ebx], ecx
setne cl
push ebx
push 0x453da0
push esi
push 0
mov byte [ebx + 4], cl
call dword [sym.imp.KERNEL32.DLL_CreateThread]
test eax, eax
jne 0x453b00
push ebx
call fcn.004835e0
add esp, 4
xor al, al
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
test edi, edi
je 0x453b16
mov dword [edi], eax
mov al, 1
mov dword [edi + 4], 0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push eax
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
pop edi
pop esi
mov al, 1
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4548b0
Capabilities:
Inspect section memory permissions

Disassembly:
push ebp
mov ebp, esp
push ecx
xor eax, eax
mov dword [ebp - 4], 0
push ebx
mov ebx, dword [ebp + 0xc]
test bl, 1
push esi
mov esi, ecx
mov ecx, 3
cmovne eax, ecx
test bl, 2
mov ecx, 1
cmovne eax, ecx
mov ecx, ebx
and ecx, 4
mov dword [ebp - 4], ecx
mov ecx, 4
cmovne eax, ecx
test bl, 8
mov ecx, 2
cmovne eax, ecx
mov dword [ebp + 0xc], eax
test bl, 0x10
je 0x454906
mov dword [ebp + 0xc], 5
jmp 0x45490e
test eax, eax
je 0x454a2d
xor edx, edx
mov eax, 4
test bl, 0x40
push edi
mov edi, 0x40000000
cmovne edx, edi
test bl, 0x80
cmovne edx, eax
test bl, 0x20
je 0x454932
or edx, 0x80000000
test ebx, 0x4000
je 0x454940
or edx, 0x100
test ebx, 0x40000
je 0x45494e
or edx, 0x20000000
mov ecx, ebx
shr ecx, 8
not ecx
and ecx, 1
test ebx, 0x200
jne 0x454963
or ecx, 2
test ebx, 0x8000
je 0x45496d
or ecx, eax
xor eax, eax
test ebx, 0x400
cmovne eax, edi
test ebx, 0x800
je 0x454985
or eax, 0x100
test ebx, 0x1000
je 0x454990
or eax, 2
test ebx, 0x2000
je 0x45499d
or eax, 0x4000000
test ebx, 0x20000
je 0x4549aa
or eax, 0x2000000
mov edi, dword [ebp + 8]
cmp dword [edi + 0x14], 8
jb 0x4549b5
mov edi, dword [edi]
push 0
push eax
push dword [ebp + 0xc]
push 0
push ecx
push edx
push edi
call dword [sym.imp.KERNEL32.DLL_CreateFileW]
push eax
mov ecx, esi
call fcn.0041297a
mov eax, dword [esi]
pop edi
test eax, eax
je 0x454a1b
cmp eax, 0xffffffff
je 0x454a1b
mov eax, ebx
mov dword [esi + 4], 0
shr eax, 0xa
and al, 1
cmp dword [ebp - 4], 0
mov byte [esi + 9], al
je 0x454a0a
call dword [sym.imp.KERNEL32.DLL_GetLastError]
cmp eax, 0xb7
setne al
mov byte [esi + 8], al
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
test bl, 0xa
je 0x454a2d
mov byte [esi + 8], 1
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
call dword [sym.imp.KERNEL32.DLL_GetLastError]
push eax
call fcn.00454a60
add esp, 4
mov dword [esi + 4], eax
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x4584a0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push dword [ebp + 0xc]
mov dword [ebp - 4], 0
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.DLL_TerminateProcess]
test eax, eax
setne bl
test bl, bl
je 0x4584d5
cmp byte [ebp + 0x10], 0
je 0x4584d5
push 0xea60
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.DLL_WaitForSingleObject]
mov al, bl
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x45d540
Capabilities:
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xb4
push ebx
push dword [ebp + 0xc]
xor ebx, ebx
push dword [ebp + 8]
mov dword [ebp - 4], ebx
call dword [sym.imp.KERNEL32.DLL_TlsSetValue]
test eax, eax
jne 0x45d5a3
call fcn.00438e90
cmp eax, 3
jg 0x45d593
push 3
push 0x23
push str.c:_buildbot_slaveworkdir_reposlar6desktop_2013_3chromium_src_base_threading_thread_local_win.cc
lea ecx, [ebp - 0xb4]
mov ebx, 1
call fcn.00438400
add eax, 8
push str.Failed_to_TlsSetValue__.
push eax
call fcn.00404c5e
add esp, 8
test bl, 1
je 0x45d5a3
lea ecx, [ebp - 0xb4]
call fcn.00438510
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x45d7b0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
pop ebp
jmp fcn.0046a1d0
Function at 0x461260
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
mov ebx, ecx
movzx eax, byte [edi]
xor eax, 0x811c9dc5
imul edx, eax, 0x1000193
movzx eax, byte [edi + 1]
xor edx, eax
movzx eax, byte [edi + 2]
imul edx, edx, 0x1000193
xor edx, eax
movzx eax, byte [edi + 3]
imul ecx, edx, 0x1000193
mov edx, dword [ebx + 0x14]
xor ecx, eax
imul ecx, ecx, 0x1000193
and ecx, edx
cmp dword [ebx + 0x18], ecx
ja 0x4612b0
shr edx, 1
or eax, 0xffffffff
sub eax, edx
add ecx, eax
mov esi, dword [ebx]
lea edx, [ecx*8]
mov ecx, dword [ebx + 8]
mov dword [ebp + 0xc], edx
mov eax, dword [ecx + edx]
cmp esi, eax
je 0x4612de
mov esi, dword [ecx + edx + 4]
mov esi, dword [esi]
cmp esi, eax
je 0x4612de
mov ecx, dword [edi]
mov esi, dword [esi + 4]
cmp dword [esi + 8], ecx
je 0x461321
cmp esi, eax
jne 0x4612d2
mov edi, dword [ebp + 0x10]
mov eax, dword [edi]
cmp esi, eax
je 0x46130b
mov ecx, dword [edi + 4]
mov dword [ecx], eax
mov ecx, dword [eax + 4]
mov dword [ecx], esi
mov ecx, dword [esi + 4]
mov dword [ecx], edi
mov edx, dword [esi + 4]
mov ecx, dword [eax + 4]
mov dword [esi + 4], ecx
mov ecx, dword [edi + 4]
mov dword [eax + 4], ecx
mov dword [edi + 4], edx
mov edx, dword [ebp + 0xc]
mov ecx, dword [ebx + 8]
add ecx, edx
mov eax, dword [ecx]
cmp eax, dword [ebx]
jne 0x46133b
mov dword [ecx], edi
mov eax, dword [ebx + 8]
mov dword [eax + edx + 4], edi
jmp 0x46135d
push dword [ebp + 0x10]
mov ecx, ebx
call fcn.00467670
mov eax, dword [ebp + 8]
pop edi
mov dword [eax], esi
pop esi
mov byte [eax + 4], 0
pop ebx
pop ebp
ret 0xc
cmp eax, esi
jne 0x461343
mov dword [ecx], edi
jmp 0x46135d
mov eax, dword [ecx + 4]
mov eax, dword [eax]
mov dword [ecx + 4], eax
cmp eax, edi
je 0x46135d
mov ecx, dword [ebx + 8]
mov eax, dword [ecx + edx + 4]
mov eax, dword [eax + 4]
mov dword [ecx + edx + 4], eax
mov ecx, ebx
call fcn.00467370
mov eax, dword [ebp + 8]
mov dword [eax], edi
pop edi
pop esi
mov byte [eax + 4], 1
pop ebx
pop ebp
ret 0xc
Function at 0x461380
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
mov ebx, ecx
movzx eax, byte [edi]
xor eax, 0x811c9dc5
imul edx, eax, 0x1000193
movzx eax, byte [edi + 1]
xor edx, eax
movzx eax, byte [edi + 2]
imul edx, edx, 0x1000193
xor edx, eax
movzx eax, byte [edi + 3]
imul ecx, edx, 0x1000193
mov edx, dword [ebx + 0x14]
xor ecx, eax
imul ecx, ecx, 0x1000193
and ecx, edx
cmp dword [ebx + 0x18], ecx
ja 0x4613d0
shr edx, 1
or eax, 0xffffffff
sub eax, edx
add ecx, eax
mov esi, dword [ebx]
lea edx, [ecx*8]
mov ecx, dword [ebx + 8]
mov dword [ebp + 0xc], edx
mov eax, dword [ecx + edx]
cmp esi, eax
je 0x4613fe
mov esi, dword [ecx + edx + 4]
mov esi, dword [esi]
cmp esi, eax
je 0x4613fe
mov ecx, dword [edi]
mov esi, dword [esi + 4]
cmp dword [esi + 8], ecx
je 0x461441
cmp esi, eax
jne 0x4613f2
mov edi, dword [ebp + 0x10]
mov eax, dword [edi]
cmp esi, eax
je 0x46142b
mov ecx, dword [edi + 4]
mov dword [ecx], eax
mov ecx, dword [eax + 4]
mov dword [ecx], esi
mov ecx, dword [esi + 4]
mov dword [ecx], edi
mov edx, dword [esi + 4]
mov ecx, dword [eax + 4]
mov dword [esi + 4], ecx
mov ecx, dword [edi + 4]
mov dword [eax + 4], ecx
mov dword [edi + 4], edx
mov edx, dword [ebp + 0xc]
mov ecx, dword [ebx + 8]
add ecx, edx
mov eax, dword [ecx]
cmp eax, dword [ebx]
jne 0x46145b
mov dword [ecx], edi
mov eax, dword [ebx + 8]
mov dword [eax + edx + 4], edi
jmp 0x46147d
push dword [ebp + 0x10]
mov ecx, ebx
call fcn.004676c0
mov eax, dword [ebp + 8]
pop edi
mov dword [eax], esi
pop esi
mov byte [eax + 4], 0
pop ebx
pop ebp
ret 0xc
cmp eax, esi
jne 0x461463
mov dword [ecx], edi
jmp 0x46147d
mov eax, dword [ecx + 4]
mov eax, dword [eax]
mov dword [ecx + 4], eax
cmp eax, edi
je 0x46147d
mov ecx, dword [ebx + 8]
mov eax, dword [ecx + edx + 4]
mov eax, dword [eax + 4]
mov dword [ecx + edx + 4], eax
mov ecx, ebx
call fcn.00467430
mov eax, dword [ebp + 8]
mov dword [eax], edi
pop edi
pop esi
mov byte [eax + 4], 1
pop ebx
pop ebp
ret 0xc
Function at 0x461690
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
mov ebx, ecx
movzx eax, byte [edi]
xor eax, 0x811c9dc5
imul edx, eax, 0x1000193
movzx eax, byte [edi + 1]
xor edx, eax
movzx eax, byte [edi + 2]
imul edx, edx, 0x1000193
xor edx, eax
movzx eax, byte [edi + 3]
imul ecx, edx, 0x1000193
mov edx, dword [ebx + 0x14]
xor ecx, eax
imul eax, ecx, 0x1000193
mov ecx, edx
and ecx, eax
cmp dword [ebx + 0x18], ecx
ja 0x4616e2
shr edx, 1
or eax, 0xffffffff
sub eax, edx
add ecx, eax
mov esi, dword [ebx + 8]
mov edx, dword [ebx]
shl ecx, 3
mov dword [ebp + 0xc], ecx
mov eax, dword [esi + ecx]
cmp eax, edx
jne 0x4616f8
mov esi, edx
jmp 0x4616fe
mov esi, dword [esi + ecx + 4]
mov esi, dword [esi]
cmp esi, eax
je 0x461710
mov ecx, dword [edi]
mov esi, dword [esi + 4]
cmp dword [esi + 8], ecx
je 0x46175e
cmp esi, eax
jne 0x461704
push edi
push dword [edx]
mov ecx, ebx
call fcn.004ab410
mov edi, dword [ebx]
mov edi, dword [edi]
mov eax, dword [edi]
cmp esi, eax
je 0x461745
mov ecx, dword [edi + 4]
mov dword [ecx], eax
mov ecx, dword [eax + 4]
mov dword [ecx], esi
mov ecx, dword [esi + 4]
mov dword [ecx], edi
mov ecx, dword [eax + 4]
mov edx, dword [esi + 4]
mov dword [esi + 4], ecx
mov ecx, dword [edi + 4]
mov dword [eax + 4], ecx
mov dword [edi + 4], edx
mov ecx, dword [ebx + 8]
mov edx, dword [ebp + 0xc]
add ecx, edx
mov eax, dword [ecx]
cmp eax, dword [ebx]
jne 0x46176e
mov dword [ecx], edi
mov eax, dword [ebx + 8]
mov dword [edx + eax + 4], edi
jmp 0x461790
mov eax, dword [ebp + 8]
pop edi
mov dword [eax], esi
pop esi
mov byte [eax + 4], 0
pop ebx
pop ebp
ret 0xc
cmp eax, esi
jne 0x461776
mov dword [ecx], edi
jmp 0x461790
mov eax, dword [ecx + 4]
mov eax, dword [eax]
mov dword [ecx + 4], eax
cmp eax, edi
je 0x461790
mov ecx, dword [ebx + 8]
mov eax, dword [ecx + edx + 4]
mov eax, dword [eax + 4]
mov dword [ecx + edx + 4], eax
mov ecx, ebx
call fcn.004675b0
mov eax, dword [ebp + 8]
mov dword [eax], edi
pop edi
pop esi
mov byte [eax + 4], 1
pop ebx
pop ebp
ret 0xc
Function at 0x4617b0
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
mov ebx, ecx
movzx eax, byte [edi]
xor eax, 0x811c9dc5
imul edx, eax, 0x1000193
movzx eax, byte [edi + 1]
xor edx, eax
movzx eax, byte [edi + 2]
imul edx, edx, 0x1000193
xor edx, eax
movzx eax, byte [edi + 3]
imul ecx, edx, 0x1000193
mov edx, dword [ebx + 0x14]
xor ecx, eax
imul eax, ecx, 0x1000193
mov ecx, edx
and ecx, eax
cmp dword [ebx + 0x18], ecx
ja 0x461802
shr edx, 1
or eax, 0xffffffff
sub eax, edx
add ecx, eax
mov esi, dword [ebx]
lea edx, [ecx*8]
mov ecx, dword [ebx + 8]
mov dword [ebp + 0xc], edx
mov eax, dword [ecx + edx]
cmp esi, eax
je 0x461830
mov esi, dword [ecx + edx + 4]
mov esi, dword [esi]
cmp esi, eax
je 0x461830
mov ecx, dword [edi]
mov esi, dword [esi + 4]
cmp dword [esi + 8], ecx
je 0x461873
cmp esi, eax
jne 0x461824
mov edi, dword [ebp + 0x10]
mov eax, dword [edi]
cmp esi, eax
je 0x46185d
mov ecx, dword [edi + 4]
mov dword [ecx], eax
mov ecx, dword [eax + 4]
mov dword [ecx], esi
mov ecx, dword [esi + 4]
mov dword [ecx], edi
mov edx, dword [esi + 4]
mov ecx, dword [eax + 4]
mov dword [esi + 4], ecx
mov ecx, dword [edi + 4]
mov dword [eax + 4], ecx
mov dword [edi + 4], edx
mov edx, dword [ebp + 0xc]
mov ecx, dword [ebx + 8]
add ecx, edx
mov eax, dword [ecx]
cmp eax, dword [ebx]
jne 0x4618a1
mov dword [ecx], edi
mov eax, dword [ebx + 8]
mov dword [eax + edx + 4], edi
jmp 0x4618c3
mov edx, dword [ebp + 0x10]
push edx
mov ecx, dword [edx + 4]
mov eax, dword [edx]
mov dword [ecx], eax
mov ecx, dword [edx]
mov eax, dword [edx + 4]
mov dword [ecx + 4], eax
dec dword [ebx + 4]
call fcn.004835e0
mov eax, dword [ebp + 8]
add esp, 4
pop edi
mov dword [eax], esi
pop esi
mov byte [eax + 4], 0
pop ebx
pop ebp
ret 0xc
cmp eax, esi
jne 0x4618a9
mov dword [ecx], edi
jmp 0x4618c3
mov eax, dword [ecx + 4]
mov eax, dword [eax]
mov dword [ecx + 4], eax
cmp eax, edi
je 0x4618c3
mov ecx, dword [ebx + 8]
mov eax, dword [ecx + edx + 4]
mov eax, dword [eax + 4]
mov dword [ecx + edx + 4], eax
mov ecx, ebx
call fcn.004675b0
mov eax, dword [ebp + 8]
mov dword [eax], edi
pop edi
pop esi
mov byte [eax + 4], 1
pop ebx
pop ebp
ret 0xc
Function at 0x467b20
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov ebx, dword [ebp + 0xc]
push esi
mov esi, ecx
push edi
movzx eax, byte [ebx]
xor eax, 0x811c9dc5
imul edx, eax, 0x1000193
movzx eax, byte [ebx + 1]
xor edx, eax
movzx eax, byte [ebx + 2]
imul edx, edx, 0x1000193
xor edx, eax
movzx eax, byte [ebx + 3]
imul ecx, edx, 0x1000193
mov edx, dword [esi + 0x14]
xor ecx, eax
imul eax, ecx, 0x1000193
mov ecx, edx
and ecx, eax
cmp dword [esi + 0x18], ecx
ja 0x467b73
shr edx, 1
or eax, 0xffffffff
sub eax, edx
add ecx, eax
mov edx, dword [esi + 8]
mov esi, dword [esi]
mov eax, dword [edx + ecx*8]
add ecx, ecx
mov edi, dword [edx + ecx*4]
inc ecx
lea ecx, [edx + ecx*4]
mov dword [ebp + 0xc], ecx
cmp edi, esi
jne 0x467b8f
mov ecx, esi
jmp 0x467b93
mov ecx, dword [ecx]
mov ecx, dword [ecx]
cmp eax, ecx
je 0x467be3
mov ecx, dword [eax + 8]
cmp ecx, dword [ebx]
je 0x467ba5
mov eax, dword [eax]
mov ecx, dword [ebp + 0xc]
jmp 0x467b87
mov ecx, dword [ebx]
mov edx, eax
mov ebx, dword [ebp + 0xc]
mov dword [ebp - 4], ecx
nop
cmp edi, esi
jne 0x467bb8
mov ecx, esi
jmp 0x467bbc
mov ecx, dword [ebx]
mov ecx, dword [ecx]
cmp eax, ecx
je 0x467bcc
mov ecx, dword [ebp - 4]
cmp ecx, dword [eax + 8]
jne 0x467bcc
mov eax, dword [eax]
jmp 0x467bb0
cmp edx, eax
je 0x467be3
mov ecx, dword [ebp + 8]
pop edi
pop esi
pop ebx
mov dword [ecx + 4], eax
mov eax, ecx
mov dword [ecx], edx
mov esp, ebp
pop ebp
ret 8
mov eax, dword [ebp + 8]
pop edi
mov dword [eax], esi
mov dword [eax + 4], esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x467c60
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
mov ebx, ecx
movzx eax, byte [edi + 8]
xor eax, 0x811c9dc5
imul edx, eax, 0x1000193
movzx eax, byte [edi + 9]
xor edx, eax
movzx eax, byte [edi + 0xa]
imul edx, edx, 0x1000193
xor edx, eax
movzx eax, byte [edi + 0xb]
imul ecx, edx, 0x1000193
mov edx, dword [ebx + 0x14]
xor ecx, eax
imul eax, ecx, 0x1000193
mov ecx, edx
and ecx, eax
cmp dword [ebx + 0x18], ecx
ja 0x467cb3
shr edx, 1
or eax, 0xffffffff
sub eax, edx
add ecx, eax
lea edx, [ecx*8]
mov ecx, dword [ebx + 8]
add ecx, edx
cmp dword [ecx + 4], edi
jne 0x467cdf
cmp dword [ecx], edi
jne 0x467cd7
mov eax, dword [ebx]
mov dword [ecx], eax
mov ecx, dword [ebx + 8]
mov eax, dword [ebx]
mov dword [ecx + edx + 4], eax
jmp 0x467ce7
mov eax, dword [edi + 4]
mov dword [ecx + 4], eax
jmp 0x467ce7
cmp dword [ecx], edi
jne 0x467cea
mov eax, dword [edi]
mov dword [ecx], eax
mov edi, dword [ebp + 0xc]
mov eax, dword [edi + 4]
mov esi, dword [edi]
push edi
mov dword [eax], esi
mov ecx, dword [edi]
mov eax, dword [edi + 4]
mov dword [ecx + 4], eax
dec dword [ebx + 4]
call fcn.004835e0
mov eax, dword [ebp + 8]
add esp, 4
pop edi
mov dword [eax], esi
pop esi
pop ebx
pop ebp
ret 8
Function at 0x467ed0
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
mov esi, ecx
movzx eax, byte [edi]
xor eax, 0x811c9dc5
imul edx, eax, 0x1000193
movzx eax, byte [edi + 1]
xor edx, eax
movzx eax, byte [edi + 2]
imul edx, edx, 0x1000193
xor edx, eax
movzx eax, byte [edi + 3]
imul ecx, edx, 0x1000193
mov edx, dword [esi + 0x14]
xor ecx, eax
imul eax, ecx, 0x1000193
mov ecx, edx
and ecx, eax
cmp dword [esi + 0x18], ecx
ja 0x467f22
shr edx, 1
or eax, 0xffffffff
sub eax, edx
add ecx, eax
mov edx, dword [esi + 8]
mov esi, dword [esi]
mov eax, dword [edx + ecx*8]
add ecx, ecx
mov ebx, dword [edx + ecx*4]
lea edx, [edx + ecx*4]
cmp ebx, esi
jne 0x467f3a
mov ecx, esi
jmp 0x467f3f
mov ecx, dword [edx + 4]
mov ecx, dword [ecx]
cmp eax, ecx
je 0x467f6c
mov ecx, dword [eax + 8]
cmp ecx, dword [edi]
je 0x467f4e
mov eax, dword [eax]
jmp 0x467f32
mov ecx, dword [edi]
cmp ecx, dword [eax + 8]
lea ecx, [ebp + 0xc]
mov dword [ebp + 0xc], esi
jne 0x467f5e
mov dword [ebp + 0xc], eax
mov eax, dword [ebp + 8]
mov ecx, dword [ecx]
pop edi
pop esi
mov dword [eax], ecx
pop ebx
pop ebp
ret 8
mov eax, dword [ebp + 8]
pop edi
mov dword [eax], esi
pop esi
pop ebx
pop ebp
ret 8
Function at 0x467f80
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [ebp + 0xc]
push ebx
push esi
mov ebx, ecx
mov ecx, dword [eax + 0x14]
mov dword [ebp - 8], ecx
push edi
mov edi, dword [eax + 0x10]
mov dword [ebp - 4], edi
cmp ecx, 0x10
jb 0x467fa3
mov esi, dword [eax]
jmp 0x467fa5
mov esi, eax
xor ecx, ecx
mov edx, 0x811c9dc5
test edi, edi
je 0x467fc1
movzx eax, byte [esi + ecx]
inc ecx
xor eax, edx
imul edx, eax, 0x1000193
cmp ecx, edi
jb 0x467fb0
mov ecx, dword [ebx + 0x14]
mov edi, ecx
and edi, edx
cmp dword [ebx + 0x18], edi
ja 0x467fd6
shr ecx, 1
or eax, 0xffffffff
sub eax, ecx
add edi, eax
mov ecx, dword [ebx + 8]
lea eax, [edi + edi]
mov edx, dword [ebx]
lea eax, [eax + 1]
mov ebx, dword [ebp - 4]
mov dword [ebp - 0xc], edx
mov esi, dword [ecx + edi*8]
mov edi, dword [ecx + eax*4 - 4]
lea eax, [ecx + eax*4]
mov dword [ebp - 0x10], edi
mov dword [ebp - 0x14], eax
cmp edi, edx
jne 0x467fff
mov eax, edx
jmp 0x468003
mov eax, dword [eax]
mov eax, dword [eax]
cmp esi, eax
je 0x468123
cmp dword [ebp - 8], 0x10
lea ecx, [esi + 8]
jb 0x46801b
mov eax, dword [ebp + 0xc]
mov edi, dword [eax]
jmp 0x46801e
mov edi, dword [ebp + 0xc]
cmp dword [ecx + 0x14], 0x10
mov eax, dword [ecx + 0x10]
mov dword [ebp - 4], eax
jb 0x46802c
mov ecx, dword [ecx]
cmp eax, ebx
mov edx, ebx
cmovb edx, eax
test edx, edx
je 0x468093
sub edx, 4
jb 0x468051
lea esp, [esp]
mov eax, dword [ecx]
cmp eax, dword [edi]
jne 0x468056
add ecx, 4
add edi, 4
sub edx, 4
jae 0x468040
cmp edx, 0xfffffffc
je 0x46808a
mov al, byte [ecx]
cmp al, byte [edi]
jne 0x468083
cmp edx, 0xfffffffd
je 0x46808a
mov al, byte [ecx + 1]
cmp al, byte [edi + 1]
jne 0x468083
cmp edx, 0xfffffffe
je 0x46808a
mov al, byte [ecx + 2]
cmp al, byte [edi + 2]
jne 0x468083
cmp edx, 0xffffffff
je 0x46808a
mov al, byte [ecx + 3]
cmp al, byte [edi + 3]
je 0x46808a
sbb eax, eax
or eax, 1
jmp 0x46808c
xor eax, eax
test eax, eax
jne 0x4680a3
mov eax, dword [ebp - 4]
cmp eax, ebx
jb 0x4680a3
xor eax, eax
cmp dword [ebp - 4], ebx
setne al
test eax, eax
je 0x4680b3
mov esi, dword [esi]
mov edx, dword [ebp - 0xc]
mov edi, dword [ebp - 0x10]
mov eax, dword [ebp - 0x14]
jmp 0x467ff7
cmp dword [esi + 0x1c], 0x10
lea ecx, [esi + 8]
mov edi, dword [ecx + 0x10]
jb 0x4680c1
mov ecx, dword [ecx]
cmp dword [ebp - 8], 0x10
jb 0x4680cf
mov eax, dword [ebp + 0xc]
mov eax, dword [eax]
mov dword [ebp + 0xc], eax
cmp ebx, edi
mov eax, edi
cmovb eax, ebx
push eax
push ecx
push dword [ebp + 0xc]
call fcn.00415a6a
add esp, 0xc
test eax, eax
jne 0x46810a
cmp ebx, edi
jb 0x46810a
cmp ebx, edi
setne al
test eax, eax
jne 0x46810a
mov eax, dword [ebp + 8]
lea ecx, [ebp + 0xc]
pop edi
mov dword [ebp + 0xc], esi
mov ecx, dword [ecx]
pop esi
mov dword [eax], ecx
pop ebx
mov esp, ebp
pop ebp
ret 8
mov eax, dword [ebp - 0xc]
lea ecx, [ebp + 0xc]
mov dword [ebp + 0xc], eax
mov eax, dword [ebp + 8]
mov ecx, dword [ecx]
pop edi
pop esi
mov dword [eax], ecx
pop ebx
mov esp, ebp
pop ebp
ret 8
mov eax, dword [ebp + 8]
pop edi
pop esi
pop ebx
mov dword [eax], edx
mov esp, ebp
pop ebp
ret 8
Function at 0x469bb0
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
push ecx
push edi
mov edi, dword [ecx]
mov ecx, dword [ecx + 4]
sub ecx, edi
sar ecx, 2
test ecx, ecx
je 0x469c1e
push ebx
push esi
mov ebx, ecx
mov eax, dword [edi]
lea edi, [edi + 4]
movzx esi, cl
movzx edx, al
xor esi, edx
shr ecx, 8
mov dword [ebp - 4], eax
movzx eax, ah
xor ecx, dword [esi*4 + 0x4b8e58]
movzx edx, cl
xor edx, eax
shr ecx, 8
movzx eax, byte [ebp - 2]
xor ecx, dword [edx*4 + 0x4b8e58]
movzx edx, cl
xor edx, eax
shr ecx, 8
movzx eax, byte [ebp - 1]
xor ecx, dword [edx*4 + 0x4b8e58]
movzx edx, cl
xor edx, eax
shr ecx, 8
xor ecx, dword [edx*4 + 0x4b8e58]
dec ebx
jne 0x469bc7
pop esi
pop ebx
mov eax, ecx
pop edi
mov esp, ebp
pop ebp
ret