joyce8/EMBER2024-capa huggingface dataset:
Function at 0x46438e
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, dword [ebp + 0xc]
mov ecx, dword [esi + 8]
mov eax, ecx
lea ebx, [eax + 1]
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x46439f
sub eax, ebx
add eax, ecx
mov edx, 0x811c9dc5
cmp ecx, eax
je 0x4643c3
movsx ebx, byte [ecx]
imul edx, edx, 0x1000193
inc ecx
xor edx, ebx
cmp ecx, eax
jne 0x4643b3
mov ecx, dword [edi + 0x20]
mov eax, ecx
and eax, edx
cmp dword [edi + 0x24], eax
ja 0x4643d8
shr ecx, 1
or edx, 0xffffffff
sub edx, ecx
add eax, edx
mov ecx, dword [edi + 0x10]
cmp dword [ecx + eax*8 + 4], esi
lea ecx, [ecx + eax*8]
jne 0x464401
cmp dword [ecx], esi
jne 0x4643f9
mov edx, dword [edi + 4]
mov dword [ecx], edx
mov ecx, dword [edi + 4]
mov edx, dword [edi + 0x10]
mov dword [edx + eax*8 + 4], ecx
jmp 0x464409
mov eax, dword [esi + 4]
mov dword [ecx + 4], eax
jmp 0x464409
cmp dword [ecx], esi
jne 0x46440c
mov edx, dword [esi]
mov dword [ecx], edx
mov esi, dword [ebp + 0xc]
mov ecx, dword [esi]
mov dword [ebp - 4], ecx
mov ebx, esi
cmp esi, dword [edi + 4]
je 0x46443c
mov edx, dword [esi + 4]
mov dword [edx], ecx
mov edx, dword [esi + 4]
mov ecx, dword [ebx]
lea esi, [ebx + 8]
mov dword [ecx + 4], edx
call fcn.0045235e
push ebx
call fcn.00551067
mov ecx, dword [ebp - 4]
add esp, 4
dec dword [edi + 8]
mov eax, dword [ebp + 8]
pop esi
mov dword [eax], ecx
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x4644de
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
mov edi, dword [ebp + 0xc]
mov ecx, dword [edi + 8]
mov eax, ecx
lea ebx, [eax + 1]
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x4644ee
sub eax, ebx
add eax, ecx
mov edx, 0x811c9dc5
cmp ecx, eax
je 0x464512
movsx ebx, byte [ecx]
imul edx, edx, 0x1000193
inc ecx
xor edx, ebx
cmp ecx, eax
jne 0x464502
mov ecx, dword [esi + 0x20]
mov eax, ecx
and eax, edx
cmp dword [esi + 0x24], eax
ja 0x464527
shr ecx, 1
or edx, 0xffffffff
sub edx, ecx
add eax, edx
mov ecx, dword [esi + 0x10]
cmp dword [ecx + eax*8 + 4], edi
lea ecx, [ecx + eax*8]
jne 0x464550
cmp dword [ecx], edi
jne 0x464548
mov edx, dword [esi + 4]
mov dword [ecx], edx
mov ecx, dword [esi + 0x10]
mov edx, dword [esi + 4]
mov dword [ecx + eax*8 + 4], edx
jmp 0x464558
mov eax, dword [edi + 4]
mov dword [ecx + 4], eax
jmp 0x464558
cmp dword [ecx], edi
jne 0x46455b
mov edx, dword [edi]
mov dword [ecx], edx
mov edi, dword [ebp + 0xc]
mov ebx, dword [edi]
cmp edi, dword [esi + 4]
je 0x464582
mov ecx, dword [edi + 4]
mov dword [ecx], ebx
mov eax, dword [edi + 4]
mov edx, dword [edi]
mov dword [edx + 4], eax
mov eax, edi
call fcn.00464e1e
push edi
call fcn.00551067
add esp, 4
dec dword [esi + 8]
mov eax, dword [ebp + 8]
pop edi
mov dword [eax], ebx
pop ebx
pop ebp
ret 8
Function at 0x46458e
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
mov edi, dword [ebp + 0xc]
mov ecx, dword [edi + 8]
mov al, byte [ecx]
mov edx, 0x811c9dc5
test al, al
je 0x4645c0
lea ebx, [eax - 0x41]
inc ecx
cmp bl, 0x19
ja 0x4645af
add al, 0x20
imul edx, edx, 0x1000193
movsx eax, al
xor edx, eax
mov al, byte [ecx]
test al, al
jne 0x4645a4
mov ecx, dword [esi + 0x20]
mov eax, ecx
and eax, edx
cmp dword [esi + 0x24], eax
ja 0x4645d5
shr ecx, 1
or edx, 0xffffffff
sub edx, ecx
add eax, edx
mov ecx, dword [esi + 0x10]
cmp dword [ecx + eax*8 + 4], edi
lea ecx, [ecx + eax*8]
jne 0x4645fe
cmp dword [ecx], edi
jne 0x4645f6
mov edx, dword [esi + 4]
mov dword [ecx], edx
mov ecx, dword [esi + 0x10]
mov edx, dword [esi + 4]
mov dword [ecx + eax*8 + 4], edx
jmp 0x464606
mov eax, dword [edi + 4]
mov dword [ecx + 4], eax
jmp 0x464606
cmp dword [ecx], edi
jne 0x464609
mov edx, dword [edi]
mov dword [ecx], edx
mov edi, dword [ebp + 0xc]
mov ebx, dword [edi]
cmp edi, dword [esi + 4]
je 0x464630
mov ecx, dword [edi + 4]
mov dword [ecx], ebx
mov eax, dword [edi + 4]
mov edx, dword [edi]
mov dword [edx + 4], eax
mov eax, edi
call fcn.00464e7e
push edi
call fcn.00551067
add esp, 4
dec dword [esi + 8]
mov eax, dword [ebp + 8]
pop edi
mov dword [eax], ebx
pop ebx
pop ebp
ret 8
Function at 0x46507e
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0xc
mov eax, dword [ebp + 0xc]
push ebx
push esi
mov esi, ecx
mov ecx, dword [eax]
mov eax, ecx
push edi
mov dword [esp + 0x14], esi
lea edi, [eax + 1]
lea esp, [esp]
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x46509e
sub eax, edi
add eax, ecx
mov edx, 0x811c9dc5
cmp ecx, eax
je 0x4650c2
movsx edi, byte [ecx]
imul edx, edx, 0x1000193
inc ecx
xor edx, edi
cmp ecx, eax
jne 0x4650b2
mov eax, dword [esi + 0x20]
mov ebx, eax
and ebx, edx
cmp dword [esi + 0x24], ebx
ja 0x4650d7
shr eax, 1
or ecx, 0xffffffff
sub ecx, eax
add ebx, ecx
mov eax, dword [esi + 0x10]
mov edi, dword [esi + 4]
mov ecx, dword [eax + ebx*8]
lea edx, [esi + 4]
lea eax, [eax + ebx*8]
mov dword [esp + 0x10], edx
cmp edi, ecx
je 0x465127
mov eax, dword [eax + 4]
mov edi, dword [eax]
cmp edi, ecx
je 0x465127
lea esp, [esp]
mov edi, dword [edi + 4]
mov eax, dword [edi + 8]
test eax, eax
je 0x465176
mov ecx, dword [ebp + 0xc]
mov ecx, dword [ecx]
push eax
push ecx
call fcn.00552fee
add esp, 8
test eax, eax
je 0x46516d
mov edx, dword [esi + 0x10]
cmp edi, dword [edx + ebx*8]
jne 0x4650fe
mov edx, dword [esp + 0x10]
mov ecx, dword [ebp + 0x10]
mov eax, dword [ecx]
cmp edi, eax
je 0x46514a
push eax
push ecx
push edi
mov eax, 1
mov esi, edx
call fcn.00464c2e
mov ecx, dword [ebp + 0x10]
mov esi, dword [esp + 0x14]
mov edx, dword [esp + 0x10]
mov eax, dword [edx]
mov edx, dword [esi + 0x10]
mov dword [esp + 0x14], eax
lea eax, [edx + ebx*8]
mov edx, dword [eax]
mov dword [esp + 0x10], ecx
cmp edx, dword [esp + 0x14]
jne 0x4651b9
mov dword [eax], ecx
mov eax, dword [esi + 0x10]
mov dword [eax + ebx*8 + 4], ecx
jmp 0x4651df
mov eax, dword [ebp + 0xc]
mov eax, dword [eax]
test eax, eax
jne 0x465180
push 0x80004005
call fcn.00438cae
mov ecx, dword [edi + 8]
push eax
push ecx
call fcn.00552fee
add esp, 8
test eax, eax
je 0x465195
mov edi, dword [edi]
jmp 0x465123
mov ecx, dword [ebp + 0x10]
mov ebx, dword [esp + 0x10]
push ecx
lea edx, [esp + 0x18]
push edx
call fcn.0046493e
mov eax, dword [ebp + 8]
mov dword [eax], edi
mov byte [eax + 4], 0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
cmp edx, edi
jne 0x4651c1
mov dword [eax], ecx
jmp 0x4651df
mov edx, dword [eax + 4]
mov ecx, dword [edx]
mov dword [eax + 4], ecx
cmp ecx, dword [esp + 0x10]
je 0x4651df
mov eax, dword [esi + 0x10]
mov ecx, dword [eax + ebx*8 + 4]
mov edx, dword [ecx + 4]
lea ebx, [eax + ebx*8 + 4]
mov dword [ebx], edx
mov edi, esi
call fcn.0046566e
mov eax, dword [ebp + 8]
mov ecx, dword [ebp + 0x10]
pop edi
pop esi
mov dword [eax], ecx
mov byte [eax + 4], 1
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x4651fe
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0xc
mov eax, dword [ebp + 0xc]
push ebx
push esi
mov esi, ecx
mov ecx, dword [eax]
mov eax, ecx
push edi
mov dword [esp + 0xc], esi
lea edi, [eax + 1]
lea esp, [esp]
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x46521e
sub eax, edi
add eax, ecx
mov edx, 0x811c9dc5
cmp ecx, eax
je 0x465242
movsx edi, byte [ecx]
imul edx, edx, 0x1000193
inc ecx
xor edx, edi
cmp ecx, eax
jne 0x465232
mov eax, dword [esi + 0x20]
mov ebx, eax
and ebx, edx
cmp dword [esi + 0x24], ebx
ja 0x465257
shr eax, 1
or ecx, 0xffffffff
sub ecx, eax
add ebx, ecx
mov edx, dword [esi + 0x10]
mov ecx, dword [edx + ebx*8]
mov edi, dword [esi + 4]
lea eax, [edx + ebx*8]
lea edx, [esi + 4]
mov dword [esp + 0x14], edx
cmp edi, ecx
je 0x4652b3
mov eax, dword [eax + 4]
mov eax, dword [eax]
mov edi, eax
mov dword [esp + 0x10], eax
cmp edi, ecx
je 0x4652b3
nop
mov esi, dword [edi + 4]
mov eax, dword [esi + 8]
mov dword [esp + 0x10], esi
test eax, eax
je 0x465300
mov edi, dword [ebp + 0xc]
mov ecx, dword [edi]
push eax
push ecx
call fcn.00552fee
add esp, 8
test eax, eax
je 0x4652fa
mov ecx, dword [esp + 0xc]
mov edx, dword [ecx + 0x10]
mov edi, esi
cmp esi, dword [edx + ebx*8]
jne 0x46527e
mov esi, ecx
mov edx, dword [esp + 0x14]
mov ecx, dword [ebp + 0x10]
mov eax, dword [ecx]
cmp edi, eax
je 0x4652d6
push eax
push ecx
push edi
mov eax, 1
mov esi, edx
call fcn.00464c9e
mov ecx, dword [ebp + 0x10]
mov esi, dword [esp + 0xc]
mov edx, dword [esp + 0x14]
mov eax, dword [esi + 0x10]
mov esi, dword [eax + ebx*8]
lea eax, [eax + ebx*8]
mov dword [esp + 0x14], ecx
cmp esi, dword [edx]
jne 0x46534c
mov dword [eax], ecx
mov ecx, dword [esp + 0xc]
mov edx, dword [ecx + 0x10]
mov eax, dword [esp + 0x14]
mov dword [edx + ebx*8 + 4], eax
jmp 0x465376
mov eax, dword [edi]
test eax, eax
jne 0x46530a
push 0x80004005
call fcn.00438cae
mov ecx, dword [esi + 8]
push eax
push ecx
call fcn.00552fee
add esp, 8
test eax, eax
je 0x465329
mov eax, dword [esi]
mov esi, dword [esp + 0xc]
mov dword [esp + 0x10], eax
mov edi, eax
jmp 0x4652af
mov ecx, dword [ebp + 0x10]
mov edi, dword [esp + 0x14]
push ecx
lea ebx, [esp + 0x18]
call fcn.0046498e
mov eax, dword [ebp + 8]
mov dword [eax], esi
mov byte [eax + 4], 0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
cmp esi, edi
jne 0x465354
mov dword [eax], ecx
jmp 0x465376
mov ecx, dword [eax + 4]
mov ecx, dword [ecx]
mov dword [eax + 4], ecx
cmp ecx, dword [esp + 0x14]
je 0x465376
mov edx, dword [esp + 0xc]
mov eax, dword [edx + 0x10]
mov ecx, dword [eax + ebx*8 + 4]
mov edx, dword [ecx + 4]
lea ebx, [eax + ebx*8 + 4]
mov dword [ebx], edx
mov edi, dword [esp + 0xc]
call fcn.0046573e
mov eax, dword [ebp + 8]
mov ecx, dword [ebp + 0x10]
pop edi
pop esi
mov dword [eax], ecx
mov byte [eax + 4], 1
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x46539e
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0xc
mov eax, dword [ebp + 0xc]
mov edx, ecx
mov ecx, dword [eax]
mov al, byte [ecx]
push ebx
push esi
push edi
mov dword [esp + 0x10], edx
mov esi, 0x811c9dc5
test al, al
je 0x4653dc
lea ebx, [eax - 0x41]
inc ecx
cmp bl, 0x19
ja 0x4653cb
add al, 0x20
imul esi, esi, 0x1000193
movsx eax, al
xor esi, eax
mov al, byte [ecx]
test al, al
jne 0x4653c0
mov eax, dword [edx + 0x20]
mov ebx, eax
and ebx, esi
cmp dword [edx + 0x24], ebx
ja 0x4653f1
shr eax, 1
or ecx, 0xffffffff
sub ecx, eax
add ebx, ecx
mov eax, dword [edx + 0x10]
mov ecx, dword [eax + ebx*8]
mov esi, dword [edx + 4]
lea eax, [eax + ebx*8]
lea edi, [edx + 4]
cmp esi, ecx
je 0x465436
mov eax, dword [eax + 4]
mov esi, dword [eax]
cmp esi, ecx
je 0x465436
mov esi, dword [esi + 4]
mov eax, dword [esi + 8]
test eax, eax
je 0x46547f
mov ecx, dword [ebp + 0xc]
mov ecx, dword [ecx]
push eax
push ecx
call fcn.00552ca9
add esp, 8
test eax, eax
je 0x465476
mov edx, dword [esp + 0x10]
mov eax, dword [edx + 0x10]
cmp esi, dword [eax + ebx*8]
jne 0x46540d
mov ecx, dword [ebp + 0x10]
mov eax, dword [ecx]
cmp esi, eax
je 0x465452
push eax
push ecx
push esi
mov ecx, edi
mov edx, edi
call fcn.004658de
mov ecx, dword [ebp + 0x10]
mov edx, dword [esp + 0x10]
mov eax, dword [edx + 0x10]
mov edx, dword [eax + ebx*8]
lea eax, [eax + ebx*8]
mov dword [esp + 0x14], ecx
cmp edx, dword [edi]
jne 0x4654c1
mov dword [eax], ecx
mov ecx, dword [esp + 0x10]
mov edx, dword [ecx + 0x10]
mov eax, dword [esp + 0x14]
mov dword [edx + ebx*8 + 4], eax
jmp 0x4654eb
mov ecx, dword [ebp + 0xc]
mov eax, dword [ecx]
test eax, eax
jne 0x465489
push 0x80004005
call fcn.00438cae
mov ecx, dword [esi + 8]
push eax
push ecx
call fcn.00552ca9
add esp, 8
test eax, eax
je 0x4654a2
mov esi, dword [esi]
mov edx, dword [esp + 0x10]
jmp 0x465436
mov edx, dword [ebp + 0x10]
push edx
lea ebx, [esp + 0x18]
call fcn.004649de
mov eax, dword [ebp + 8]
mov dword [eax], esi
mov byte [eax + 4], 0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
cmp edx, esi
jne 0x4654c9
mov dword [eax], ecx
jmp 0x4654eb
mov ecx, dword [eax + 4]
mov ecx, dword [ecx]
mov dword [eax + 4], ecx
cmp ecx, dword [esp + 0x14]
je 0x4654eb
mov edx, dword [esp + 0x10]
mov eax, dword [edx + 0x10]
mov ecx, dword [eax + ebx*8 + 4]
mov edx, dword [ecx + 4]
lea ebx, [eax + ebx*8 + 4]
mov dword [ebx], edx
mov edi, dword [esp + 0x10]
call fcn.0046580e
mov eax, dword [ebp + 8]
mov ecx, dword [ebp + 0x10]
pop edi
pop esi
mov dword [eax], ecx
mov byte [eax + 4], 1
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x4668fe
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 0x24]
mov eax, dword [ebp + 0x1c]
push ebx
mov ebx, dword [ebp + 0x20]
push edi
mov edi, ebx
or edi, ecx
cdq
jne 0x46696e
mov ebx, eax
mov ecx, edx
movzx edx, byte [ebp + 0xc]
xor eax, eax
cmp dword [ebp + 8], eax
mov dword [esi], 0
setne al
and edx, 7
mov edi, 2
add eax, eax
add eax, eax
add eax, eax
or eax, edx
movzx edx, byte [ebp + 0x10]
shl eax, 4
and edx, 0xf
or eax, edx
mov edx, dword [ebp + 0x14]
mov dword [esi], eax
xor eax, eax
test edx, edx
setne al
shl eax, 0xf
or dword [esi], eax
test ecx, ecx
ja 0x4669b0
jb 0x466961
cmp ebx, 0x7e
jae 0x466986
movzx ecx, bl
and ecx, 0x7f
shl ecx, 8
or dword [esi], ecx
jmp 0x4669dc
cmp ecx, edx
ja 0x466917
jb 0x466978
cmp ebx, eax
jae 0x466917
push 0x57
call dword [0x101371a0]
xor eax, eax
pop edi
pop ebx
pop ebp
ret
test ecx, ecx
ja 0x4669b0
jb 0x466994
cmp ebx, 0xffff
ja 0x4669b0
or dword [esi], 0x7e00
push ebx
call dword [0x10137324]
movzx edx, ax
shl edx, 0x10
or dword [esi], edx
mov edi, 4
jmp 0x4669d9
mov edi, dword [0x101372fc]
or dword [esi], 0x7f00
push ecx
call edi
push ebx
mov dword [ebp + 0x20], eax
call edi
xor ecx, ecx
or ecx, dword [ebp + 0x20]
mov edx, eax
xor eax, eax
or edx, eax
mov dword [esi + 2], ecx
mov dword [esi + 6], edx
lea edi, [eax + 0xa]
mov edx, dword [ebp + 0x14]
test edx, edx
je 0x466a05
mov eax, dword [edx]
mov dword [edi + esi], eax
xor eax, eax
cmp dword [ebp + 0x1c], eax
jle 0x466a02
mov edi, edi
mov ecx, eax
and ecx, 3
mov bl, byte [ecx + edx]
mov ecx, dword [ebp + 0x18]
xor byte [eax + ecx], bl
inc eax
cmp eax, dword [ebp + 0x1c]
jl 0x4669ee
add edi, 4
mov eax, dword [ebp + 0x28]
mov edx, dword [ebp + 0x18]
mov ecx, dword [ebp + 0x1c]
mov dword [eax], edi
pop edi
mov dword [eax + 4], esi
mov dword [eax + 0xc], edx
mov dword [eax + 8], ecx
mov eax, 1
pop ebx
pop ebp
ret
Function at 0x46703e
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [eax]
sub esp, 0xc
push ebx
push esi
push edi
mov edi, ecx
mov ecx, eax
lea esi, [ecx + 1]
mov dl, byte [ecx]
inc ecx
test dl, dl
jne 0x467050
sub ecx, esi
add ecx, eax
mov edx, eax
mov esi, 0x811c9dc5
cmp eax, ecx
je 0x46707e
jmp 0x46706e
movsx ebx, byte [edx]
imul esi, esi, 0x1000193
inc edx
xor esi, ebx
cmp edx, ecx
jne 0x46706e
mov edx, dword [edi + 0x20]
mov ecx, edx
and ecx, esi
cmp dword [edi + 0x24], ecx
ja 0x467093
shr edx, 1
or esi, 0xffffffff
sub esi, edx
add ecx, esi
mov edx, dword [edi + 0x10]
mov edi, dword [edi + 4]
lea ecx, [edx + ecx*8]
mov edx, dword [ecx]
mov esi, edx
mov dword [ebp - 8], ecx
mov dword [ebp - 0xc], edx
mov dword [ebp - 4], esi
jmp 0x4670ae
cmp edx, edi
jne 0x4670b6
mov ecx, edi
jmp 0x4670bb
mov ecx, dword [ecx + 4]
mov ecx, dword [ecx]
cmp esi, ecx
je 0x467160
mov ecx, dword [esi + 8]
mov edx, eax
lea ebx, [ebx]
mov bl, byte [ecx]
cmp bl, byte [edx]
jne 0x4670ee
test bl, bl
je 0x4670ea
mov bl, byte [ecx + 1]
cmp bl, byte [edx + 1]
jne 0x4670ee
add ecx, 2
add edx, 2
test bl, bl
jne 0x4670ce
xor ecx, ecx
jmp 0x4670f3
sbb ecx, ecx
sbb ecx, 0xffffffff
test ecx, ecx
je 0x467101
mov esi, dword [esi]
mov ecx, dword [ebp - 8]
mov edx, dword [ebp - 0xc]
jmp 0x4670ae
mov edx, dword [esi + 8]
mov dword [ebp - 4], esi
mov ecx, eax
jmp 0x46710e
mov bl, byte [ecx]
cmp bl, byte [edx]
jne 0x46712e
test bl, bl
je 0x46712a
mov bl, byte [ecx + 1]
cmp bl, byte [edx + 1]
jne 0x46712e
add ecx, 2
add edx, 2
test bl, bl
jne 0x46710e
xor ecx, ecx
jmp 0x467133
sbb ecx, ecx
sbb ecx, 0xffffffff
test ecx, ecx
je 0x46714d
mov eax, dword [ebp + 8]
mov dword [ebp - 0xc], edi
pop edi
lea ecx, [ebp - 0xc]
mov edx, dword [ecx]
pop esi
mov dword [eax], edx
pop ebx
mov esp, ebp
pop ebp
ret 4
mov eax, dword [ebp + 8]
pop edi
lea ecx, [ebp - 4]
mov edx, dword [ecx]
pop esi
mov dword [eax], edx
pop ebx
mov esp, ebp
pop ebp
ret 4
mov eax, dword [ebp + 8]
mov dword [eax], edi
pop edi
mov dword [ebp - 4], esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x46717e
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0xc
mov eax, dword [ebp + 0xc]
push ebx
push esi
mov esi, dword [eax]
push edi
mov edi, ecx
mov eax, esi
mov dword [esp + 0x14], edi
lea edx, [eax + 1]
lea esp, [esp]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x46719e
sub eax, edx
add eax, esi
mov ecx, esi
mov edx, 0x811c9dc5
cmp esi, eax
je 0x4671c4
movsx ebx, byte [ecx]
imul edx, edx, 0x1000193
inc ecx
xor edx, ebx
cmp ecx, eax
jne 0x4671b4
mov eax, dword [edi + 0x20]
mov ecx, eax
and ecx, edx
mov dword [esp + 0x10], ecx
cmp dword [edi + 0x24], ecx
ja 0x4671e1
shr eax, 1
or edx, 0xffffffff
sub edx, eax
add ecx, edx
mov dword [esp + 0x10], ecx
mov eax, dword [edi + 4]
lea edx, [edi + 4]
mov edi, dword [edi + 0x10]
lea ecx, [edi + ecx*8]
mov edi, dword [ecx]
mov dword [esp + 0xc], edx
cmp edi, eax
jne 0x4671fb
mov ebx, eax
jmp 0x467200
mov eax, dword [ecx + 4]
mov ebx, dword [eax]
cmp ebx, edi
je 0x46723f
mov ebx, dword [ebx + 4]
mov ecx, dword [ebx + 8]
mov eax, esi
mov edi, edi
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x46722e
test dl, dl
je 0x46722a
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x46722e
add eax, 2
add ecx, 2
test dl, dl
jne 0x46720e
xor eax, eax
jmp 0x467233
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x46727e
cmp ebx, edi
jne 0x467204
mov edx, dword [esp + 0xc]
mov ecx, dword [ebp + 0x10]
mov eax, dword [ecx]
cmp ebx, eax
je 0x467259
push eax
push ecx
push ebx
mov ecx, edx
call fcn.004655fe
mov ecx, dword [ebp + 0x10]
mov edx, dword [esp + 0xc]
mov esi, dword [edx]
mov edi, dword [esp + 0x14]
mov edx, dword [edi + 0x10]
mov eax, dword [esp + 0x10]
lea eax, [edx + eax*8]
mov edx, dword [eax]
cmp edx, esi
jne 0x4672d3
mov dword [eax], ecx
mov edx, dword [edi + 0x10]
mov eax, dword [esp + 0x10]
mov dword [edx + eax*8 + 4], ecx
jmp 0x4672f7
mov eax, dword [ebx + 8]
mov ecx, esi
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x4672a3
test dl, dl
je 0x46729f
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x4672a3
add eax, 2
add ecx, 2
test dl, dl
jne 0x467283
xor eax, eax
jmp 0x4672a8
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x4672b0
mov ebx, dword [ebx]
jmp 0x46723b
mov ecx, dword [ebp + 0x10]
mov esi, dword [esp + 0xc]
push ecx
lea edi, [esp + 0x18]
call fcn.004655be
mov eax, dword [ebp + 8]
mov dword [eax], ebx
mov byte [eax + 4], 0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
cmp edx, ebx
je 0x4672f5
mov edx, dword [eax + 4]
mov edx, dword [edx]
mov dword [eax + 4], edx
cmp edx, ecx
je 0x4672f7
mov ecx, dword [esp + 0x10]
mov eax, dword [edi + 0x10]
mov edx, dword [eax + ecx*8 + 4]
lea eax, [eax + ecx*8 + 4]
mov ecx, dword [edx + 4]
mov dword [eax], ecx
call fcn.0046731e
mov eax, dword [ebp + 8]
mov edx, dword [ebp + 0x10]
pop edi
pop esi
mov dword [eax], edx
mov byte [eax + 4], 1
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x4695ae
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, eax
mov eax, dword [esi + 0xc]
push edi
test eax, eax
je 0x4695e0
lea ecx, [ebp - 4]
push ecx
push eax
call dword [0x10137090]
test eax, eax
je 0x4695e0
xor eax, eax
cmp dword [ebp - 4], 0x103
sete al
test eax, eax
jne 0x46969e
mov eax, dword [esi + 0xc]
test eax, eax
je 0x469610
push eax
call dword [0x10137190]
xor eax, eax
mov dword [esi + 8], 0
mov dword [esi + 0xc], 0
mov dword [esi + 0x10], eax
mov dword [esi + 0x14], eax
mov dword [esi + 0x18], eax
mov dword [esi + 0x1c], eax
mov dword [esi + 0x20], eax
mov dword [esi + 0x24], eax
push 0x18
call fcn.005510d2
add esp, 4
test eax, eax
je 0x46963a
mov edx, dword [ebp + 8]
mov dword [eax], edx
mov ecx, dword [ebp + 0xc]
mov dword [eax + 8], ecx
mov edx, dword [ebp + 0x10]
mov dword [eax + 0xc], edx
mov dword [eax + 0x10], 0
mov edi, eax
jmp 0x46963c
xor edi, edi
mov eax, dword [edi]
mov dword [esi + 0x10], eax
mov ecx, dword [edi + 4]
mov dword [esi + 0x14], ecx
mov edx, dword [edi + 8]
mov dword [esi + 0x18], edx
mov eax, dword [edi + 0xc]
mov dword [esi + 0x1c], eax
mov ecx, dword [edi + 0x10]
lea eax, [esi + 8]
push eax
push 0
push edi
push 0x10033450
mov dword [esi + 0x20], ecx
mov edx, dword [edi + 0x14]
push 0
push 0
mov dword [esi + 0x24], edx
call fcn.00552e4f
add esp, 0x18
mov dword [esi + 0xc], eax
test eax, eax
jne 0x4696b3
push 0x65f
call dword [0x101371a0]
push edi
xor esi, esi
call fcn.00551067
add esp, 4
mov eax, esi
pop edi
pop esi
mov esp, ebp
pop ebp
ret 0xc
push 0x139f
call dword [0x101371a0]
xor eax, eax
pop edi
pop esi
mov esp, ebp
pop ebp
ret 0xc
pop edi
mov eax, 1
pop esi
mov esp, ebp
pop ebp
ret 0xc
Function at 0x46f53e
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
mov ebx, dword [ebp + 8]
cmp dword [ebx + 0x10], 0
mov dword [ebp - 0xc], 1
mov dword [ebp - 8], 0
jbe 0x46f687
push esi
push edi
push 0
push 0
push ebx
push 0x10039fb0
push 0
push 0
call fcn.00552e4f
mov edi, eax
add esp, 0x18
mov dword [ebp - 4], edi
test edi, edi
je 0x46f66a
mov eax, dword [ebx + 0x78]
lea esi, [ebx + 0x74]
lea ecx, [ebp - 4]
cmp ecx, eax
jae 0x46f5f4
mov edx, dword [esi]
cmp edx, ecx
ja 0x46f5f4
mov edi, ecx
mov ecx, dword [esi + 8]
sub edi, edx
sar edi, 2
cmp eax, ecx
jne 0x46f5e4
sub eax, edx
sar eax, 2
cmp eax, 0x3ffffffe
ja 0x46f660
sub ecx, edx
inc eax
sar ecx, 2
cmp eax, ecx
jbe 0x46f5e4
mov edx, ecx
shr edx, 1
mov ebx, 0x3fffffff
sub ebx, edx
cmp ebx, ecx
jae 0x46f5d3
xor ecx, ecx
jmp 0x46f5d5
add ecx, edx
cmp ecx, eax
jae 0x46f5db
mov ecx, eax
push ecx
call fcn.00471fee
mov ebx, dword [ebp + 8]
mov eax, dword [esi + 4]
test eax, eax
je 0x46f640
mov edx, dword [esi]
mov ecx, dword [edx + edi*4]
mov dword [eax], ecx
jmp 0x46f640
mov ecx, dword [esi + 8]
cmp eax, ecx
jne 0x46f637
mov edx, dword [esi]
sub eax, edx
sar eax, 2
cmp eax, 0x3ffffffe
ja 0x46f660
sub ecx, edx
inc eax
sar ecx, 2
cmp eax, ecx
jbe 0x46f637
mov edx, ecx
shr edx, 1
mov ebx, 0x3fffffff
sub ebx, edx
cmp ebx, ecx
jae 0x46f626
xor ecx, ecx
jmp 0x46f628
add ecx, edx
cmp ecx, eax
jae 0x46f62e
mov ecx, eax
push ecx
call fcn.00471fee
mov ebx, dword [ebp + 8]
mov eax, dword [esi + 4]
test eax, eax
je 0x46f640
mov dword [eax], edi
mov eax, dword [ebp - 8]
add dword [esi + 4], 4
inc eax
mov dword [ebp - 8], eax
cmp eax, dword [ebx + 0x10]
jb 0x46f562
mov eax, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
push 0x101894b0
call fcn.00550ff9
call dword [0x101371a4]
push eax
mov dword [ebx + 0x54], 8
call dword [0x101371a0]
pop edi
mov dword [ebp - 0xc], 0
pop esi
mov eax, dword [ebp - 0xc]
pop ebx
mov esp, ebp
pop ebp
ret 4