joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40f250
Capabilities:
Enumerate threads
Suspend thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push ebx
push esi
mov esi, ecx
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [esi], 0
mov dword [esi + 4], 0x4a
mov dword [esi + 8], 0
mov dword [esi + 0xc], 0
mov dword [esi + 0x10], 0x46e1e4
mov dword [esi + 0x14], 0
mov dword [esi + 0x18], 0
mov dword [esi + 0x20], 0
mov dword [esi + 0x24], 0x4b
call edi
mov ebx, dword [ebp + 8]
xor edx, edx
cmp ebx, eax
mov ecx, ebx
cmove ecx, edx
push ecx
push 4
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov cl, byte [ebp + 0x14]
mov dword [esi + 0x28], eax
mov dword [esi + 0x2c], ebx
mov byte [esi + 0x30], 0
mov byte [esi + 0x31], cl
cmp eax, 0xffffffff
je 0x40f3b4
test ebx, ebx
je 0x40f2dc
call edi
mov byte [ebp + 0x17], 0
cmp ebx, eax
jne 0x40f2e0
mov byte [ebp + 0x17], 1
lea eax, [ebp - 0x1c]
mov dword [ebp - 0x1c], 0x1c
push eax
push dword [esi + 0x28]
call sub.KERNEL32.dll_Thread32First
test eax, eax
je 0x40f374
cmp dword [ebp - 0x1c], 0x10
jb 0x40f35d
cmp dword [ebp - 0x10], ebx
jne 0x40f35d
push dword [ebp - 0x14]
mov eax, dword [ebp + 0xc]
push 0
or eax, 2
push eax
call dword [sym.imp.KERNEL32.dll_OpenThread]
mov edi, eax
test edi, edi
je 0x40f35d
cmp byte [ebp + 0x17], 0
je 0x40f32b
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp dword [ebp - 0x14], eax
je 0x40f35d
mov ebx, dword [esi + 8]
mov eax, dword [esi + 0xc]
shr eax, 1
lea ecx, [ebx + 1]
cmp ecx, eax
jbe 0x40f344
mov ecx, esi
call fcn.00407ae0
lea ecx, [ebx + 1]
mov eax, dword [esi]
mov dword [esi + 8], ecx
lea ecx, [esi + 0x10]
mov dword [eax + ebx*4], edi
lea eax, [ebp - 0x14]
push eax
call fcn.0040f5e0
mov ebx, dword [ebp + 8]
mov dword [eax], edi
lea eax, [ebp - 0x1c]
mov dword [ebp - 0x1c], 0x1c
push eax
push dword [esi + 0x28]
call sub.KERNEL32.dll_Thread32Next
test eax, eax
jne 0x40f2f7
cmp byte [ebp + 0x10], 0
je 0x40f3b4
cmp dword [esi + 0x28], 0xffffffff
je 0x40f3b4
cmp byte [esi + 0x30], 0
jne 0x40f3b4
mov edi, dword [esi]
mov eax, dword [esi + 8]
lea eax, [edi + eax*4]
cmp edi, eax
je 0x40f3b4
mov ebx, dword [sym.imp.KERNEL32.dll_SuspendThread]
push dword [edi]
call ebx
cmp eax, 0xffffffff
setne al
add edi, 4
or byte [esi + 0x30], al
mov ecx, dword [esi + 8]
mov eax, dword [esi]
lea eax, [eax + ecx*4]
cmp edi, eax
jne 0x40f398
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
Function at 0x40f4a0
Capabilities:
Resume thread

Disassembly:
push esi
mov esi, ecx
cmp dword [esi + 0x28], 0xffffffff
je 0x40f520
mov dl, byte [esi + 0x30]
push ebx
push edi
test dl, dl
je 0x40f4f4
cmp byte [esi + 0x31], 0
je 0x40f4f4
mov edi, dword [esi]
mov eax, dword [esi + 8]
lea eax, [edi + eax*4]
cmp edi, eax
je 0x40f4f1
mov ebx, dword [sym.imp.KERNEL32.dll_ResumeThread]
nop word [eax + eax]
push dword [edi]
call ebx
mov dl, byte [esi + 0x30]
cmp eax, 0xffffffff
sete al
add edi, 4
or dl, al
mov byte [esi + 0x30], dl
mov ecx, dword [esi + 8]
mov eax, dword [esi]
lea eax, [eax + ecx*4]
cmp edi, eax
jne 0x40f4d0
mov byte [esi + 0x31], dl
mov edi, dword [esi]
mov eax, dword [esi + 8]
mov ebx, dword [sym.imp.KERNEL32.dll_CloseHandle]
lea eax, [edi + eax*4]
cmp edi, eax
je 0x40f519
push dword [edi]
call ebx
mov ecx, dword [esi + 8]
add edi, 4
mov eax, dword [esi]
lea eax, [eax + ecx*4]
cmp edi, eax
jne 0x40f506
push dword [esi + 0x28]
call ebx
pop edi
pop ebx
mov eax, dword [esi + 0x10]
cmp eax, 0x46e1e4
je 0x40f540
push 0x2d7
push str.C:_buildslaveunity_buildRuntime_Core_Containers_hash_set.h
push dword [esi + 0x24]
push eax
call fcn.00401cb0
add esp, 0x10
mov ecx, esi
pop esi
jmp fcn.00406d80

Function at 0x40fbc0
Capabilities:
Resume thread
Suspend thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2d4
push esi
push edi
mov dword [ebp - 8], ecx
cmp dword [ebp + 0x18], 0
jne 0x40fc73
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
cmp dword [ebp + 0x14], eax
jne 0x40fc21
mov edx, dword [ebp + 0x14]
push edx
call dword [sym.imp.KERNEL32.dll_SuspendThread]
push 0x2cc
push 0
lea eax, [ebp - 0x2d4]
push eax
call fcn.00438530
add esp, 0xc
mov dword [ebp - 0x2d4], 0x10007
lea ecx, [ebp - 0x2d4]
push ecx
mov edx, dword [ebp + 0x14]
push edx
call dword [sym.imp.KERNEL32.dll_GetThreadContext]
test eax, eax
jne 0x40fc71
mov eax, dword [ebp + 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_ResumeThread]
xor eax, eax
jmp 0x40fd00
mov ecx, 0xb3
mov esi, dword [ebp + 0x18]
lea edi, [ebp - 0x2d4]
rep movsd dword es:[edi], dword [esi]
Function at 0x410c70
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x6a8
push ebx
push esi
push edi
push dword [ebp + 0xc]
mov dword [ebp - 4], ecx
call fcn.00440467
push dword [ebp + 0x10]
mov edi, eax
call fcn.00440467
add esp, 8
mov esi, eax
xor ebx, ebx
mov dword [ebp - 0x1c], esi
test edi, edi
je 0x410cc8
test esi, esi
je 0x410cc8
push dword [ebp + 0x1c]
mov ecx, dword [ebp - 4]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
mov eax, dword [ecx + 0x30]
push esi
push edi
push ebx
push dword [ebp + 8]
call eax
or eax, edx
jne 0x410ccd
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
jmp 0x410ccd
mov ebx, 8
mov eax, dword [ebp - 4]
xorps xmm0, xmm0
movlpd qword [ebp - 0x14], xmm0
mov eax, dword [eax]
test eax, eax
je 0x410e14
test edi, edi
je 0x410e21
test byte [eax + 0x18], 8
je 0x410d69
lea eax, [ebp - 0x18]
mov dword [ebp - 0xc], 0
push eax
push edi
call sub.VERSION.dll_GetFileVersionInfoSizeA
mov dword [ebp - 8], eax
test eax, eax
je 0x410d69
push eax
call fcn.004404da
mov esi, eax
add esp, 4
test esi, esi
je 0x410d69
push esi
push dword [ebp - 8]
push dword [ebp - 0x18]
push edi
call sub.VERSION.dll_GetFileVersionInfoA
test eax, eax
je 0x410d60
mov eax, 0x5c
mov word [ebp - 8], ax
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push esi
call sub.VERSION.dll_VerQueryValueA
test eax, eax
jne 0x410d4c
mov dword [ebp - 0xc], eax
jmp 0x410d60
mov eax, dword [ebp - 0xc]
xor edx, edx
add edx, dword [eax + 0xc]
mov ecx, dword [eax + 8]
adc ecx, 0
mov dword [ebp - 0x14], edx
mov dword [ebp - 0x10], ecx
push esi
call fcn.004404bd
add esp, 4
mov ecx, dword [ebp - 4]
lea eax, [ebp - 0x6a8]
push eax
push dword [ebp + 0x18]
mov esi, 0x46e7a4
push dword [ebp + 0x14]
push dword [ebp + 8]
call fcn.0040ff50
test eax, eax
je case.default.0x410d95
mov eax, dword [ebp - 0x688]
cmp eax, 8
ja case.default.0x410d95
jmp dword [eax*4 + 0x410e3c]
mov esi, str._nosymbols_
jmp case.default.0x410d95
mov esi, str.COFF
jmp case.default.0x410d95
mov esi, 0x46e7c4
jmp case.default.0x410d95
mov esi, 0x46e7c8
jmp case.default.0x410d95
mov esi, str._exported_
jmp case.default.0x410d95
mov esi, str._deferred_
jmp case.default.0x410d95
mov esi, 0x46e7e4
jmp case.default.0x410d95
mov esi, 0x46e7e8
jmp case.default.0x410d95
mov esi, str.Virtual
push dword [ebp - 0x10]
cmp byte [ebp - 0x464], 0
lea ecx, [ebp - 0x564]
push dword [ebp - 0x14]
lea eax, [ebp - 0x464]
cmove eax, ecx
mov ecx, dword [ebp - 4]
push eax
push esi
push ebx
push dword [ebp + 0x1c]
mov ecx, dword [ecx]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
mov edx, dword [ecx]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call dword [edx + 8]
mov esi, dword [ebp - 0x1c]
test edi, edi
je 0x410e21
push edi
call fcn.004404bd
add esp, 4
test esi, esi
je 0x410e2e
push esi
call fcn.004404bd
add esp, 4
pop edi
pop esi
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret 0x18
Function at 0x411d00
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xe0
push esi
push dword [ebp + 0xc]
lea eax, [ebp - 0xe0]
mov dword [ebp - 0xe0], 0
push dword [ebp + 8]
mov dword [ebp - 0xdc], 0
push eax
mov dword [ebp - 0xd8], 0x67452301
mov dword [ebp - 0xd4], 0xefcdab89
mov dword [ebp - 0xd0], 0x98badcfe
mov dword [ebp - 0xcc], 0x10325476
call fcn.00412680
mov eax, dword [ebp - 0xdc]
mov esi, dword [ebp - 0xe0]
lea edx, [eax*8]
mov eax, esi
shr eax, 0x1d
lea ecx, [esi*8]
or edx, eax
mov byte [ebp - 8], cl
mov eax, ecx
mov byte [ebp - 4], dl
shr eax, 8
and esi, 0x3f
mov byte [ebp - 7], al
mov eax, ecx
shr eax, 0x10
mov byte [ebp - 6], al
mov eax, edx
shr eax, 8
mov byte [ebp - 3], al
mov eax, edx
shr eax, 0x10
shr ecx, 0x18
mov byte [ebp - 2], al
mov eax, 0x38
mov byte [ebp - 5], cl
sub eax, esi
shr edx, 0x18
mov ecx, 0x78
sub ecx, esi
mov byte [ebp - 1], dl
cmp esi, 0x38
cmovae eax, ecx
push eax
lea eax, [ebp - 0xe0]
push 0x46eb90
push eax
call fcn.00412680
push 8
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0xe0]
push eax
call fcn.00412680
mov edx, dword [ebp + 0x10]
add esp, 0x24
mov ecx, dword [ebp - 0xd8]
mov eax, ecx
shr eax, 8
mov byte [edx + 1], al
mov eax, ecx
shr eax, 0x10
mov byte [edx], cl
shr ecx, 0x18
mov byte [edx + 2], al
mov byte [edx + 3], cl
mov ecx, dword [ebp - 0xd4]
mov eax, ecx
shr eax, 8
mov byte [edx + 5], al
mov eax, ecx
mov byte [edx + 4], cl
shr ecx, 0x18
shr eax, 0x10
mov byte [edx + 6], al
mov byte [edx + 7], cl
mov ecx, dword [ebp - 0xd0]
mov eax, ecx
mov byte [edx + 8], cl
shr eax, 8
mov byte [edx + 9], al
mov eax, ecx
shr eax, 0x10
shr ecx, 0x18
mov byte [edx + 0xa], al
mov byte [edx + 0xb], cl
mov ecx, dword [ebp - 0xcc]
mov eax, ecx
shr eax, 8
mov byte [edx + 0xd], al
mov eax, ecx
shr eax, 0x10
mov byte [edx + 0xc], cl
shr ecx, 0x18
mov byte [edx + 0xe], al
mov byte [edx + 0xf], cl
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x419280
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
lea eax, [ebp - 0x20c]
push esi
push eax
push 0x105
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
mov esi, dword [ebp + 8]
lea ecx, [ebp - 0x20c]
xor eax, eax
lea edx, [ecx + 2]
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 7
mov word [esi], ax
nop dword [eax + eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x4192c0
sub ecx, edx
lea eax, [ebp - 0x20c]
sar ecx, 1
push ecx
push eax
mov ecx, esi
call fcn.00422fd0
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x41a190
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0x1c]
lea ecx, [ebp + 0xc]
sub esp, 0x1c
push ebx
mov ebx, dword [ebp + 0xc]
push esi
push edi
mov edi, dword [ebp + 0x20]
cmp edi, 8
cmovae ecx, ebx
lea eax, [ecx + eax*2]
lea ecx, [ebp + 0xc]
mov esi, eax
cmovae ecx, ebx
xor edx, edx
sub esi, ecx
inc esi
shr esi, 1
cmp ecx, eax
cmova esi, edx
test esi, esi
je 0x41a1e7
lea eax, [edx + 0x5c]
nop dword [eax]
cmp word [ecx], 0x2f
jne 0x41a1d9
mov word [ecx], ax
inc edx
add ecx, 2
cmp edx, esi
jne 0x41a1d0
mov edi, dword [ebp + 0x20]
mov ebx, dword [ebp + 0xc]
cmp edi, 8
lea esi, [ebp + 0xc]
push 0x5c
cmovae esi, ebx
push esi
call fcn.00438b9b
add esp, 8
test eax, eax
je 0x41a204
add eax, 2
jmp 0x41a206
mov eax, esi
push eax
push 0x46e454
push dword [ebp + 0x24]
lea eax, [ebp - 0x1c]
push eax
call fcn.00412a60
mov esi, dword [ebp + 8]
add esp, 0xc
push eax
push esi
call fcn.004129f0
mov edx, dword [ebp - 8]
add esp, 0xc
cmp edx, 8
jb 0x41a25e
mov ecx, dword [ebp - 0x1c]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x41a254
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x41a2c0
push edx
push ecx
call fcn.00433b05
add esp, 8
cmp dword [esi + 0x14], 8
mov eax, esi
jb 0x41a268
mov eax, dword [esi]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x41a281
test al, 0x10
jne 0x41a281
push esi
call fcn.0041a2d0
add esp, 4
mov edx, dword [ebp + 0x20]
cmp edx, 8
jb 0x41a2b7
mov ecx, dword [ebp + 0xc]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x41a2ad
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x41a2c5
push edx
push ecx
call fcn.00433b05
add esp, 8
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
call fcn.0043f9ea
call fcn.0043f9ea
int3
Function at 0x41a980
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
push edi
push 0
push 0x80
push 3
push 0
push 0
push 0x80000000
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
je 0x41aa0b
test esi, esi
je 0x41aa0b
lea eax, [ebp - 4]
mov dword [ebp - 4], 0
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
cmp dword [ebp - 4], 0
mov dword [ebp - 0xc], eax
jne 0x41aa0b
mov edi, dword [ebp + 0xc]
mov ecx, edi
push edi
mov ebx, dword [edi + 4]
sub ebx, dword [edi]
add eax, ebx
push eax
call fcn.004148f0
mov eax, dword [edi]
lea ecx, [ebp - 8]
push 0
push ecx
push dword [ebp - 0xc]
add eax, ebx
mov dword [ebp - 8], 0
push eax
push esi
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x41aa26
mov eax, dword [ebp - 8]
mov ecx, edi
push edi
add eax, ebx
push eax
call fcn.004148f0
xor bl, bl
cmp esi, 0xffffffff
je 0x41aa1d
test esi, esi
je 0x41aa1d
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
mov al, bl
pop ebx
mov esp, ebp
pop ebp
ret
mov bl, 1
jmp 0x41aa0d
Function at 0x41cb70
Capabilities:
Parse credit card information

Disassembly:
push esi
mov esi, ecx
xor cl, cl
mov eax, dword [esi + 0x4c]
cmp eax, 0xffffffff
je 0x41cd85
push ebx
push edi
cmp eax, 0x7c
je 0x41cd83
cmp eax, 0x29
jne 0x41cbb1
cmp dword [esi + 0x10], 0
jne 0x41cd83
cmp eax, eax
jne 0x41cbb1
test dword [esi + 0x50], 0x10000000
je 0x41cd92
jmp 0x41cd3c
cmp eax, 0x2e
jne 0x41cc0b
push 5
lea ecx, [esi + 0x24]
call fcn.00421ca0
mov eax, dword [esi]
mov edx, dword [esi + 8]
cmp eax, edx
je 0x41cbff
cmp byte [eax], 0x5c
jne 0x41cbfc
lea ecx, [eax + 1]
cmp ecx, edx
je 0x41cbfc
mov edx, dword [esi + 0x50]
test dl, 8
jne 0x41cbe9
mov bl, byte [ecx]
cmp bl, 0x28
je 0x41cbfa
cmp bl, 0x29
je 0x41cbfa
test dl, 0x10
jne 0x41cbfc
mov dl, byte [ecx]
cmp dl, 0x7b
je 0x41cbfa
cmp dl, 0x7d
jne 0x41cbfc
mov eax, ecx
inc eax
mov dword [esi], eax
mov ecx, esi
call fcn.00422710
jmp 0x41cd6e
cmp eax, 0x5c
jne 0x41cc67
mov ecx, esi
call fcn.00421d10
test byte [esi + 0x50], 0x80
je 0x41cc5b
mov al, byte [esi + 0x48]
cmp al, 0x62
jne 0x41cc3a
push 4
lea ecx, [esi + 0x24]
call fcn.00421ca0
mov ecx, esi
call fcn.00421d10
jmp 0x41cd75
cmp al, 0x42
jne 0x41cc5b
push 4
lea ecx, [esi + 0x24]
call fcn.00421ca0
mov eax, dword [esi + 0x28]
mov ecx, esi
xor dword [eax + 8], 1
call fcn.00421d10
jmp 0x41cd75
mov ecx, esi
call fcn.0041d040
jmp 0x41cd6e
cmp eax, 0x5b
jne 0x41ccc8
mov ecx, esi
call fcn.00421d10
lea ecx, [esi + 0x24]
call fcn.0041b9f0
mov eax, dword [esi + 0x4c]
cmp eax, 0x5e
jne 0x41cc94
mov eax, dword [esi + 0x28]
mov ecx, esi
xor dword [eax + 8], 1
call fcn.00421d10
mov eax, dword [esi + 0x4c]
test dword [esi + 0x50], 0x20000000
je 0x41ccb2
cmp eax, 0x5d
jne 0x41ccb2
push eax
lea ecx, [esi + 0x24]
call fcn.0041b900
mov ecx, esi
call fcn.00421d10
mov ecx, esi
call fcn.0041e2b0
cmp dword [esi + 0x4c], 0x5d
jne 0x41cd9b
jmp 0x41cd67
cmp eax, 0x28
jne 0x41ccf8
mov ecx, esi
call fcn.00421d10
mov ecx, esi
call fcn.00422b50
cmp dword [esi + 0x4c], 0x29
mov bl, al
jne 0x41cd92
mov ecx, esi
call fcn.00421d10
test bl, bl
je 0x41cd75
jmp 0x41cd6e
cmp eax, 0x5e
jne 0x41cd10
push 2
lea ecx, [esi + 0x24]
call fcn.00421ca0
mov ecx, esi
call fcn.00421d10
jmp 0x41cd75
cmp eax, 0x24
jne 0x41cd28
push 3
lea ecx, [esi + 0x24]
call fcn.00421ca0
mov ecx, esi
call fcn.00421d10
jmp 0x41cd75
cmp eax, 0x2a
je 0x41cd89
cmp eax, 0x2b
je 0x41cd89
cmp eax, 0x3f
je 0x41cd89
cmp eax, 0x7b
je 0x41cd89
cmp eax, 0x7d
jne 0x41cd4c
test dword [esi + 0x50], 0x10000000
je 0x41cda4
jmp 0x41cd5a
cmp eax, 0x5d
jne 0x41cd5a
test dword [esi + 0x50], 0x10000000
je 0x41cd9b
movzx eax, byte [esi + 0x48]
lea ecx, [esi + 0x24]
push eax
call fcn.0041b660
mov ecx, esi
call fcn.00421d10
mov ecx, esi
call fcn.00421e60
mov eax, dword [esi + 0x4c]
mov cl, 1
cmp eax, 0xffffffff
jne 0x41cb83
pop edi
pop ebx
mov al, cl
pop esi
ret
push 0xa
mov ecx, esi
call fcn.00420c90
push 5
mov ecx, esi
call fcn.00420c90
push 4
mov ecx, esi
call fcn.00420c90
push 6
mov ecx, esi
call fcn.00420c90
int3
Function at 0x423360
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 0xc]
mov edx, 0x811c9dc5
push edi
mov edi, dword [ebp + 8]
mov ecx, 0
sub esi, edi
je 0x423391
nop dword [eax]
movzx eax, byte [ecx + edi]
inc ecx
xor eax, edx
imul edx, eax, 0x1000193
cmp ecx, esi
jb 0x423380
pop edi
mov eax, edx
pop esi
pop ebp
ret 8

Function at 0x4233a0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 0xc]
mov ecx, 0
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, 0x811c9dc5
sub edx, edi
sar edx, 1
add edx, edx
je 0x4233d1
nop dword [eax]
movzx eax, byte [ecx + edi]
inc ecx
xor eax, esi
imul esi, eax, 0x1000193
cmp ecx, edx
jb 0x4233c0
pop edi
mov eax, esi
pop esi
pop ebp
ret 8
Function at 0x426ca0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
mov esi, edi
mov dword [ebp - 4], ecx
cmp dword [edi + 0x14], 0x10
mov ebx, dword [edi + 0x10]
jb 0x426cbc
mov esi, dword [edi]
xor ecx, ecx
mov edx, 0x811c9dc5
test ebx, ebx
je 0x426cd8
movzx eax, byte [ecx + esi]
inc ecx
xor eax, edx
imul edx, eax, 0x1000193
cmp ecx, ebx
jb 0x426cc7
mov ebx, dword [ebp - 4]
mov eax, dword [ebx + 0x18]
mov ecx, dword [ebx + 0xc]
and eax, edx
mov ebx, dword [ebx + 4]
mov edx, dword [ecx + eax*8]
lea eax, [eax*8 + 4]
add eax, ecx
mov dword [ebp - 8], edx
mov esi, edx
mov dword [ebp - 0xc], eax
nop word [eax + eax]
cmp edx, ebx
jne 0x426d08
mov eax, ebx
jmp 0x426d0c
mov eax, dword [eax]
mov eax, dword [eax]
cmp esi, eax
je 0x426d7d
cmp dword [edi + 0x14], 0x10
lea eax, [esi + 8]
mov ecx, edi
jb 0x426d1d
mov ecx, dword [edi]
mov edi, dword [eax + 0x14]
cmp edi, 0x10
mov edx, dword [eax + 0x10]
mov dword [ebp - 0x10], edi
mov edi, dword [ebp + 0xc]
mov dword [ebp - 0x14], edx
jb 0x426d33
mov eax, dword [eax]
push dword [edi + 0x10]
push ecx
push edx
push eax
call fcn.00415250
add esp, 0x10
test al, al
jne 0x426d4f
mov esi, dword [esi]
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 0xc]
jmp 0x426d00
cmp dword [ebp - 0x10], 0x10
lea eax, [esi + 8]
jb 0x426d5a
mov eax, dword [eax]
cmp dword [edi + 0x14], 0x10
mov ecx, edi
jb 0x426d64
mov ecx, dword [edi]
push dword [ebp - 0x14]
push eax
push dword [edi + 0x10]
push ecx
call fcn.00415250
add esp, 0x10
mov ecx, ebx
test al, al
cmovne ecx, esi
jmp 0x426d7f
mov ecx, ebx
cmp ecx, ebx
jne 0x426ddf
mov esi, dword [ebx]
lea eax, [ebp + 0xf]
mov ebx, dword [ebp - 4]
push eax
lea eax, [ebp - 0x14]
mov dword [ebp - 0x14], edi
mov edi, dword [esi + 4]
push eax
push 0x46e1ec
push edi
push esi
lea ecx, [ebx + 4]
call fcn.00425530
mov edx, eax
mov ecx, 0x4924923
mov eax, dword [ebx + 8]
sub ecx, eax
cmp ecx, 1
jb 0x426df1
inc eax
mov ecx, ebx
mov dword [ebx + 8], eax
mov dword [esi + 4], edx
mov esi, dword [ebp + 8]
mov dword [edi], edx
mov eax, dword [ebx + 4]
mov eax, dword [eax]
push eax
add eax, 8
push eax
push esi
call fcn.00425e80
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
mov eax, dword [ebp + 8]
pop edi
pop esi
pop ebx
mov dword [eax], ecx
mov byte [eax + 4], 0
mov esp, ebp
pop ebp
ret 8
push str.list_T__too_long
call fcn.00434eed
int3
Function at 0x426f40
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
mov dword [ebp - 4], ecx
cmp dword [edi + 0x1c], 0x10
lea esi, [edi + 8]
mov ebx, dword [edi + 0x18]
jb 0x426f5c
mov esi, dword [edi + 8]
xor ecx, ecx
mov edx, 0x811c9dc5
test ebx, ebx
je 0x426f78
movzx eax, byte [ecx + esi]
inc ecx
xor eax, edx
imul edx, eax, 0x1000193
cmp ecx, ebx
jb 0x426f67
mov ebx, dword [ebp - 4]
mov eax, dword [ebx + 0x18]
mov ecx, dword [ebx + 0xc]
and eax, edx
lea edx, [eax*8]
mov eax, dword [ecx + edx]
add ecx, edx
cmp dword [ecx + 4], edi
jne 0x426fb1
cmp eax, edi
jne 0x426fa9
mov eax, dword [ebx + 4]
mov dword [ecx], eax
mov ecx, dword [ebx + 0xc]
mov eax, dword [ebx + 4]
mov dword [edx + ecx + 4], eax
jmp 0x426fb9
mov eax, dword [edi + 4]
mov dword [ecx + 4], eax
jmp 0x426fb9
cmp eax, edi
jne 0x426fb9
mov eax, dword [edi]
mov dword [ecx], eax
mov eax, dword [edi + 4]
lea ecx, [edi + 8]
mov esi, dword [edi]
mov dword [eax], esi
mov edx, dword [edi]
mov eax, dword [edi + 4]
mov dword [edx + 4], eax
dec dword [ebx + 8]
call fcn.00416960
push 0x38
push edi
call fcn.00433b05
mov eax, dword [ebp + 8]
add esp, 8
pop edi
mov dword [eax], esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x4274c0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
push esi
mov esi, ecx
mov dword [esi], eax
mov eax, dword [ebp + 0xc]
mov dword [esi + 8], eax
lea eax, [esi + 0xc]
mov dword [esi + 4], 0
push eax
mov byte [esi + 0x24], 0
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
push 0
push 0
push esi
push 0x428500
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [esi + 4], eax
mov eax, esi
pop esi
pop ebp
ret 8
Function at 0x4278e0
Capabilities:
Terminate thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_CloseHandle]
push edi
mov edi, ecx
mov eax, dword [edi]
cmp eax, 0xffffffff
je 0x427903
push eax
call ebx
mov dword [edi], 0xffffffff
or eax, 0xffffffff
cmp dword [edi + 4], 0xffffffff
je 0x4279f5
push esi
push eax
call dword [sym.imp.KERNEL32.dll_FlushFileBuffers]
push dword [edi]
mov byte [edi + 0x24], 1
call ebx
push str.Kernel32.dll
mov dword [edi], 0xffffffff
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov esi, eax
push str.CancelSynchronousIo
push esi
mov dword [ebp - 4], esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ebx, eax
test ebx, ebx
je 0x42799a
mov esi, dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
nop dword [eax + eax]
push dword [edi + 4]
call ebx
test eax, eax
jne 0x42797d
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x42797d
push 0
push dword [edi + 4]
call esi
cmp eax, 0x102
jne 0x42797d
push 0x3e8
push dword [edi + 4]
call esi
jmp 0x427950
push 0xffffffffffffffff
push dword [edi + 4]
call esi
lea eax, [ebp - 8]
mov dword [ebp - 8], 0
push eax
push dword [edi + 4]
call dword [sym.imp.KERNEL32.dll_GetExitCodeThread]
jmp 0x4279db
push 0x3e8
push dword [edi + 4]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
jne 0x4279bf
mov dword [ebp - 4], eax
lea eax, [ebp - 4]
push eax
push dword [edi + 4]
call dword [sym.imp.KERNEL32.dll_GetExitCodeThread]
push esi
jmp 0x4279de
lea esi, [edi + 0xc]
push esi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
push 0
push dword [edi + 4]
call dword [sym.imp.KERNEL32.dll_TerminateThread]
push esi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
push dword [edi + 4]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [edi + 4], 0xffffffff
pop esi
lea eax, [edi + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteCriticalSection]
pop edi
pop ebx
mov esp, ebp
pop ebp
ret