joyce8/EMBER2024-capa huggingface dataset:
Function at 0x444460
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5feee0
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push esi
push edi
mov eax, dword [0x6ba394]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov ebx, ecx
mov dword [ebp - 0x18], ebx
mov dword [ebp - 4], 0
mov eax, dword [ebp + 0xc]
cmp dword [eax + 0x14], 8
mov edi, dword [eax + 0x10]
jb 0x4444a7
mov esi, dword [eax]
jmp 0x4444a9
mov esi, eax
xor ecx, ecx
mov edx, 0x811c9dc5
add edi, edi
je 0x4444c5
movzx eax, byte [esi + ecx]
inc ecx
xor eax, edx
imul edx, eax, 0x1000193
cmp ecx, edi
jb 0x4444b4
mov eax, dword [ebx + 0x18]
and eax, edx
lea ecx, [eax*8]
mov eax, dword [ebx + 0xc]
mov dword [ebp - 0x14], ecx
mov edi, dword [eax + ecx]
cmp edi, dword [ebx + 4]
jne 0x4444e4
mov esi, dword [ebx + 4]
jmp 0x4444ea
mov esi, dword [eax + ecx + 4]
mov esi, dword [esi]
cmp esi, edi
je 0x444507
nop
mov esi, dword [esi + 4]
lea eax, [esi + 8]
push eax
push dword [ebp + 0xc]
call fcn.00422bf0
test al, al
jne 0x44454e
cmp esi, edi
jne 0x4444f0
mov edi, dword [ebp + 0x10]
mov dword [ebp + 0xc], edi
mov eax, dword [edi]
cmp esi, eax
je 0x444534
mov ecx, dword [edi + 4]
mov dword [ecx], eax
mov ecx, dword [eax + 4]
mov dword [ecx], esi
mov ecx, dword [esi + 4]
mov dword [ecx], edi
mov ecx, dword [eax + 4]
mov edx, dword [esi + 4]
mov dword [esi + 4], ecx
mov ecx, dword [edi + 4]
mov dword [eax + 4], ecx
mov dword [edi + 4], edx
mov ecx, dword [ebx + 0xc]
mov edx, dword [ebp - 0x14]
add ecx, edx
mov eax, dword [ecx]
cmp eax, dword [ebx + 4]
jne 0x444591
mov dword [ecx], edi
mov eax, dword [ebx + 0xc]
mov dword [eax + edx + 4], edi
jmp 0x4445b3
mov edi, dword [ebp + 0x10]
mov ecx, dword [edi + 4]
mov eax, dword [edi]
mov dword [ecx], eax
mov ecx, dword [edi]
mov eax, dword [edi + 4]
mov dword [ecx + 4], eax
lea ecx, [edi + 8]
dec dword [ebx + 8]
call fcn.0043ee20
push edi
call fcn.005b1685
mov eax, dword [ebp + 8]
add esp, 4
mov dword [eax], esi
mov byte [eax + 4], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
cmp eax, esi
jne 0x444599
mov dword [ecx], edi
jmp 0x4445b3
mov eax, dword [ecx + 4]
mov eax, dword [eax]
mov dword [ecx + 4], eax
cmp eax, edi
je 0x4445b3
mov ecx, dword [ebx + 0xc]
mov eax, dword [ecx + edx + 4]
mov eax, dword [eax + 4]
mov dword [ecx + edx + 4], eax
mov ecx, ebx
mov dword [ebp - 4], 2
call fcn.00444b70
mov eax, dword [ebp + 8]
mov dword [eax], edi
mov byte [eax + 4], 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x4448e0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5fef50
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push esi
push edi
mov eax, dword [0x6ba394]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov ebx, ecx
mov dword [ebp - 0x18], ebx
mov dword [ebp - 4], 0
mov eax, dword [ebp + 0xc]
cmp dword [eax + 0x14], 8
mov edi, dword [eax + 0x10]
jb 0x444927
mov esi, dword [eax]
jmp 0x444929
mov esi, eax
xor ecx, ecx
mov edx, 0x811c9dc5
add edi, edi
je 0x444945
movzx eax, byte [esi + ecx]
inc ecx
xor eax, edx
imul edx, eax, 0x1000193
cmp ecx, edi
jb 0x444934
mov eax, dword [ebx + 0x18]
and eax, edx
lea ecx, [eax*8]
mov eax, dword [ebx + 0xc]
mov dword [ebp - 0x14], ecx
mov edi, dword [eax + ecx]
cmp edi, dword [ebx + 4]
jne 0x444964
mov esi, dword [ebx + 4]
jmp 0x44496a
mov esi, dword [eax + ecx + 4]
mov esi, dword [esi]
cmp esi, edi
je 0x444987
nop
mov esi, dword [esi + 4]
lea eax, [esi + 8]
push eax
push dword [ebp + 0xc]
call fcn.00422bf0
test al, al
jne 0x4449ce
cmp esi, edi
jne 0x444970
mov edi, dword [ebp + 0x10]
mov dword [ebp + 0xc], edi
mov eax, dword [edi]
cmp esi, eax
je 0x4449b4
mov ecx, dword [edi + 4]
mov dword [ecx], eax
mov ecx, dword [eax + 4]
mov dword [ecx], esi
mov ecx, dword [esi + 4]
mov dword [ecx], edi
mov ecx, dword [eax + 4]
mov edx, dword [esi + 4]
mov dword [esi + 4], ecx
mov ecx, dword [edi + 4]
mov dword [eax + 4], ecx
mov dword [edi + 4], edx
mov ecx, dword [ebx + 0xc]
mov edx, dword [ebp - 0x14]
add ecx, edx
mov eax, dword [ecx]
cmp eax, dword [ebx + 4]
jne 0x444a11
mov dword [ecx], edi
mov eax, dword [ebx + 0xc]
mov dword [eax + edx + 4], edi
jmp 0x444a33
mov edi, dword [ebp + 0x10]
mov ecx, dword [edi + 4]
mov eax, dword [edi]
mov dword [ecx], eax
mov ecx, dword [edi]
mov eax, dword [edi + 4]
mov dword [ecx + 4], eax
lea ecx, [edi + 8]
dec dword [ebx + 8]
call fcn.00412ac0
push edi
call fcn.005b1685
mov eax, dword [ebp + 8]
add esp, 4
mov dword [eax], esi
mov byte [eax + 4], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
cmp eax, esi
jne 0x444a19
mov dword [ecx], edi
jmp 0x444a33
mov eax, dword [ecx + 4]
mov eax, dword [eax]
mov dword [ecx + 4], eax
cmp eax, edi
je 0x444a33
mov ecx, dword [ebx + 0xc]
mov eax, dword [ecx + edx + 4]
mov eax, dword [eax + 4]
mov dword [ecx + edx + 4], eax
mov ecx, ebx
mov dword [ebp - 4], 2
call fcn.00444d20
mov eax, dword [ebp + 8]
mov dword [eax], edi
mov byte [eax + 4], 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x444c10
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
cmp dword [edi + 0x1c], 8
lea edx, [edi + 8]
mov ebx, dword [edx + 0x10]
mov dword [ebp - 4], ecx
jb 0x444c2b
mov edx, dword [edx]
xor ecx, ecx
mov esi, 0x811c9dc5
add ebx, ebx
je 0x444c47
movzx eax, byte [edx + ecx]
inc ecx
xor eax, esi
imul esi, eax, 0x1000193
cmp ecx, ebx
jb 0x444c36
mov edx, dword [ebp - 4]
mov eax, dword [edx + 0x18]
mov ecx, dword [edx + 0xc]
and eax, esi
lea esi, [eax*8]
add ecx, esi
cmp dword [ecx + 4], edi
jne 0x444c7d
cmp dword [ecx], edi
jne 0x444c75
mov eax, dword [edx + 4]
mov dword [ecx], eax
mov ecx, dword [edx + 0xc]
mov eax, dword [edx + 4]
mov dword [esi + ecx + 4], eax
jmp 0x444c85
mov eax, dword [edi + 4]
mov dword [ecx + 4], eax
jmp 0x444c85
cmp dword [ecx], edi
jne 0x444c88
mov eax, dword [edi]
mov dword [ecx], eax
mov edi, dword [ebp + 0xc]
mov eax, dword [edi + 4]
mov esi, dword [edi]
mov dword [eax], esi
mov ecx, dword [edi]
mov eax, dword [edi + 4]
mov dword [ecx + 4], eax
lea ecx, [edi + 8]
dec dword [edx + 8]
call fcn.0043ee20
push edi
call fcn.005b1685
mov eax, dword [ebp + 8]
add esp, 4
pop edi
mov dword [eax], esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x444dc0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
cmp dword [edi + 0x1c], 8
lea edx, [edi + 8]
mov ebx, dword [edx + 0x10]
mov dword [ebp - 4], ecx
jb 0x444ddb
mov edx, dword [edx]
xor ecx, ecx
mov esi, 0x811c9dc5
add ebx, ebx
je 0x444df7
movzx eax, byte [edx + ecx]
inc ecx
xor eax, esi
imul esi, eax, 0x1000193
cmp ecx, ebx
jb 0x444de6
mov edx, dword [ebp - 4]
mov eax, dword [edx + 0x18]
mov ecx, dword [edx + 0xc]
and eax, esi
lea esi, [eax*8]
add ecx, esi
cmp dword [ecx + 4], edi
jne 0x444e2d
cmp dword [ecx], edi
jne 0x444e25
mov eax, dword [edx + 4]
mov dword [ecx], eax
mov ecx, dword [edx + 0xc]
mov eax, dword [edx + 4]
mov dword [esi + ecx + 4], eax
jmp 0x444e35
mov eax, dword [edi + 4]
mov dword [ecx + 4], eax
jmp 0x444e35
cmp dword [ecx], edi
jne 0x444e38
mov eax, dword [edi]
mov dword [ecx], eax
mov edi, dword [ebp + 0xc]
mov eax, dword [edi + 4]
mov esi, dword [edi]
mov dword [eax], esi
mov ecx, dword [edi]
mov eax, dword [edi + 4]
mov dword [ecx + 4], eax
lea ecx, [edi + 8]
dec dword [edx + 8]
call fcn.00412ac0
push edi
call fcn.005b1685
mov eax, dword [ebp + 8]
add esp, 4
pop edi
mov dword [eax], esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x4457f0
Capabilities:
Parse credit card information

Disassembly:
push ecx
push ebx
push esi
mov esi, ecx
xor cl, cl
cmp dword [esi + 0x4c], 0xffffffff
je 0x4459c6
mov eax, dword [esi + 0x4c]
cmp eax, 0x7c
je 0x4459c6
cmp eax, 0x29
jne 0x445829
cmp dword [esi + 0x10], 0
jne 0x4459c6
test dword [esi + 0x50], 0x10000000
je 0x4459d3
cmp eax, 0x2e
jne 0x445886
push 5
lea ecx, [esi + 0x24]
call fcn.00445b80
mov eax, dword [esi]
mov ecx, dword [esi + 8]
cmp eax, ecx
je 0x44587a
cmp word [eax], 0x5c
jne 0x445877
add eax, 2
cmp eax, ecx
je 0x445877
mov ecx, dword [esi + 0x50]
test cl, 8
jne 0x445863
movzx edx, word [eax]
cmp edx, 0x28
je 0x445875
cmp edx, 0x29
je 0x445875
test cl, 0x10
jne 0x445877
movzx ecx, word [eax]
cmp ecx, 0x7b
je 0x445875
cmp ecx, 0x7d
jne 0x445877
mov dword [esi], eax
add dword [esi], 2
mov ecx, esi
call fcn.00443920
jmp 0x4459b3
cmp eax, 0x5c
jne 0x4458ed
mov ecx, esi
call fcn.004457a0
mov eax, dword [esi + 0x50]
and eax, 0x80
je 0x4458b9
cmp word [esi + 0x48], 0x62
jne 0x4458b9
push 4
lea ecx, [esi + 0x24]
call fcn.00445b80
mov ecx, esi
call fcn.004457a0
jmp 0x4459ba
test eax, eax
je 0x4458e1
cmp word [esi + 0x48], 0x42
jne 0x4458e1
push 4
lea ecx, [esi + 0x24]
call fcn.00445b80
mov eax, dword [esi + 0x28]
mov ecx, esi
xor dword [eax + 8], 1
call fcn.004457a0
jmp 0x4459ba
mov ecx, esi
call fcn.004479d0
jmp 0x4459b3
cmp eax, 0x5b
jne 0x44590f
mov ecx, esi
call fcn.004457a0
mov ecx, esi
call fcn.00447920
cmp dword [esi + 0x4c], 0x5d
je 0x4459ac
jmp 0x4459cc
cmp eax, 0x28
jne 0x44593f
mov ecx, esi
call fcn.004457a0
mov ecx, esi
call fcn.00447b80
cmp dword [esi + 0x4c], 0x29
mov bl, al
jne 0x4459d3
mov ecx, esi
call fcn.004457a0
test bl, bl
je 0x4459ba
jmp 0x4459b3
cmp eax, 0x5e
jne 0x445957
push 2
lea ecx, [esi + 0x24]
call fcn.00445b80
mov ecx, esi
call fcn.004457a0
jmp 0x4459ba
cmp eax, 0x24
jne 0x44596f
push 3
lea ecx, [esi + 0x24]
call fcn.00445b80
mov ecx, esi
call fcn.004457a0
jmp 0x4459ba
cmp eax, 0x2a
je 0x4459e1
cmp eax, 0x2b
je 0x4459e1
cmp eax, 0x3f
je 0x4459e1
cmp eax, 0x7b
je 0x4459e1
cmp eax, 0x7d
jne 0x445991
test dword [esi + 0x50], 0x10000000
je 0x4459da
cmp eax, 0x5d
jne 0x44599f
test dword [esi + 0x50], 0x10000000
je 0x4459cc
movzx eax, word [esi + 0x48]
lea ecx, [esi + 0x24]
push eax
call fcn.00447d80
mov ecx, esi
call fcn.004457a0
mov ecx, esi
call fcn.00447c40
cmp dword [esi + 0x4c], 0xffffffff
mov cl, 1
jne 0x445801
pop esi
mov al, cl
pop ebx
pop ecx
ret
push 4
call fcn.0059dd53
push 5
call fcn.0059dd53
push 6
call fcn.0059dd53
push 0xa
call fcn.0059dd53
int3
Function at 0x4507b0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5ffe50
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push esi
push edi
mov eax, dword [0x6ba394]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov edi, ecx
mov dword [ebp - 0x18], edi
mov dword [ebp - 4], 0
mov ebx, dword [ebp + 0xc]
cmp dword [ebx + 0x14], 8
mov eax, dword [ebx + 0x10]
jb 0x4507f7
mov esi, dword [ebx]
jmp 0x4507f9
mov esi, ebx
xor ecx, ecx
mov edx, 0x811c9dc5
add eax, eax
je 0x45081a
mov ebx, eax
movzx eax, byte [esi + ecx]
inc ecx
xor eax, edx
imul edx, eax, 0x1000193
cmp ecx, ebx
jb 0x450806
mov ebx, dword [ebp + 0xc]
mov eax, dword [edi + 0x18]
lea ecx, [edi + 4]
and eax, edx
mov dword [ebp - 0x14], ecx
lea edx, [eax*8]
mov eax, dword [edi + 0xc]
mov dword [ebp + 0xc], edx
mov edi, dword [eax + edx]
cmp edi, dword [ecx]
jne 0x45083d
mov esi, dword [ecx]
jmp 0x450843
mov esi, dword [eax + edx + 4]
mov esi, dword [esi]
cmp esi, edi
je 0x45085f
mov esi, dword [esi + 4]
lea eax, [esi + 8]
push eax
push ebx
call fcn.00422bf0
test al, al
jne 0x450892
cmp esi, edi
jne 0x450847
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ecx]
push ebx
mov ebx, dword [ebp - 0x14]
mov ecx, ebx
mov edi, dword [eax]
push dword [edi + 4]
push edi
call fcn.00451670
mov ecx, 0x7fffffe
mov edx, eax
sub ecx, dword [ebx + 4]
cmp ecx, 1
jae 0x4508af
push str.list_T__too_long
call fcn.0059dd13
mov eax, dword [ebp + 8]
mov dword [eax], esi
mov byte [eax + 4], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
inc dword [ebx + 4]
mov dword [edi + 4], edx
mov eax, dword [edx + 4]
mov dword [eax], edx
mov edi, dword [ebx]
mov edi, dword [edi]
mov dword [ebp - 0x14], edi
mov eax, dword [edi]
cmp esi, eax
je 0x4508e8
mov ecx, dword [edi + 4]
mov dword [ecx], eax
mov ecx, dword [eax + 4]
mov dword [ecx], esi
mov ecx, dword [esi + 4]
mov dword [ecx], edi
mov ecx, dword [eax + 4]
mov edx, dword [esi + 4]
mov dword [esi + 4], ecx
mov ecx, dword [edi + 4]
mov dword [eax + 4], ecx
mov dword [edi + 4], edx
mov edx, dword [ebp - 0x18]
mov ecx, dword [ebp + 0xc]
add ecx, dword [edx + 0xc]
mov eax, dword [ecx]
cmp eax, dword [ebx]
jne 0x450905
mov dword [ecx], edi
mov eax, dword [edx + 0xc]
mov ecx, dword [ebp + 0xc]
mov dword [eax + ecx + 4], edi
jmp 0x450928
cmp eax, esi
jne 0x45090d
mov dword [ecx], edi
jmp 0x450928
mov eax, dword [ecx + 4]
mov eax, dword [eax]
mov dword [ecx + 4], eax
cmp eax, edi
je 0x450928
mov ecx, dword [ebp + 0xc]
add ecx, dword [edx + 0xc]
mov eax, dword [ecx + 4]
mov eax, dword [eax + 4]
mov dword [ecx + 4], eax
mov ecx, edx
mov dword [ebp - 4], 2
call fcn.004427b0
mov eax, dword [ebp + 8]
mov dword [eax], edi
mov byte [eax + 4], 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x450ed0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5ffeb0
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push esi
push edi
mov eax, dword [0x6ba394]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov esi, ecx
mov dword [ebp - 0x14], esi
mov dword [ebp - 4], 0
mov ebx, dword [ebp + 0xc]
cmp dword [ebx + 0x14], 8
mov eax, dword [ebx + 0x10]
jb 0x450f17
mov edi, dword [ebx]
jmp 0x450f19
mov edi, ebx
xor ecx, ecx
mov edx, 0x811c9dc5
add eax, eax
je 0x450f3a
mov ebx, eax
movzx eax, byte [edi + ecx]
inc ecx
xor eax, edx
imul edx, eax, 0x1000193
cmp ecx, ebx
jb 0x450f26
mov ebx, dword [ebp + 0xc]
mov eax, dword [esi + 0x18]
lea ecx, [esi + 4]
and eax, edx
mov dword [ebp - 0x18], ecx
lea edx, [eax*8]
mov eax, dword [esi + 0xc]
mov dword [ebp + 0xc], edx
mov edi, dword [eax + edx]
cmp edi, dword [ecx]
jne 0x450f5d
mov esi, dword [ecx]
jmp 0x450f63
mov esi, dword [eax + edx + 4]
mov esi, dword [esi]
cmp esi, edi
je 0x450f7c
mov esi, dword [esi + 4]
lea eax, [esi + 8]
push eax
push ebx
call fcn.00422bf0
test al, al
jne 0x450fc7
cmp esi, edi
jne 0x450f67
mov edi, dword [ebp + 0x10]
mov dword [ebp - 0x18], edi
mov eax, dword [edi]
cmp esi, eax
je 0x450fa9
mov ecx, dword [edi + 4]
mov dword [ecx], eax
mov ecx, dword [eax + 4]
mov dword [ecx], esi
mov ecx, dword [esi + 4]
mov dword [ecx], edi
mov ecx, dword [eax + 4]
mov edx, dword [esi + 4]
mov dword [esi + 4], ecx
mov ecx, dword [edi + 4]
mov dword [eax + 4], ecx
mov dword [edi + 4], edx
mov edx, dword [ebp - 0x14]
mov ecx, dword [edx + 0xc]
add ecx, dword [ebp + 0xc]
mov ebx, dword [ecx]
cmp ebx, dword [edx + 4]
mov ebx, dword [ebp + 0xc]
jne 0x450ff3
mov dword [ecx], edi
mov eax, dword [edx + 0xc]
mov dword [eax + ebx + 4], edi
jmp 0x451015
push dword [ebp + 0x10]
mov ecx, dword [ebp - 0x18]
lea eax, [ebp + 0xc]
push eax
call fcn.004511f0
mov eax, dword [ebp + 8]
mov dword [eax], esi
mov byte [eax + 4], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
cmp dword [ecx], esi
jne 0x450ffb
mov dword [ecx], edi
jmp 0x451015
mov eax, dword [ecx + 4]
mov eax, dword [eax]
mov dword [ecx + 4], eax
cmp eax, edi
je 0x451015
mov ecx, dword [edx + 0xc]
mov eax, dword [ecx + ebx + 4]
mov eax, dword [eax + 4]
mov dword [ecx + ebx + 4], eax
mov ecx, edx
mov dword [ebp - 4], 2
call fcn.004510c0
mov eax, dword [ebp + 8]
mov dword [eax], edi
mov byte [eax + 4], 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x451160
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 0xc]
cmp dword [eax + 0x1c], 8
push ebx
mov ebx, dword [eax + 0x18]
push esi
lea esi, [eax + 8]
mov dword [ebp - 4], ecx
push edi
jb 0x45117b
mov esi, dword [esi]
xor edx, edx
mov edi, 0x811c9dc5
add ebx, ebx
je 0x451197
movzx ecx, byte [esi + edx]
inc edx
xor ecx, edi
imul edi, ecx, 0x1000193
cmp edx, ebx
jb 0x451186
mov edx, dword [ebp - 4]
mov ecx, dword [edx + 0x18]
and ecx, edi
lea esi, [ecx*8]
mov ecx, dword [edx + 0xc]
add ecx, esi
cmp dword [ecx + 4], eax
jne 0x4511cd
cmp dword [ecx], eax
jne 0x4511c5
mov eax, dword [edx + 4]
mov dword [ecx], eax
mov ecx, dword [edx + 0xc]
mov eax, dword [edx + 4]
mov dword [esi + ecx + 4], eax
jmp 0x4511d5
mov eax, dword [eax + 4]
mov dword [ecx + 4], eax
jmp 0x4511d5
cmp dword [ecx], eax
jne 0x4511d8
mov eax, dword [eax]
mov dword [ecx], eax
mov eax, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
lea ecx, [edx + 4]
push eax
push esi
call fcn.004511f0
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x45c0e0
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x6014f8
mov eax, dword fs:[0]
push eax
sub esp, 0x60
push esi
mov eax, dword [0x6ba394]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov ecx, dword [ebp + 0xc]
mov eax, ecx
mov edx, dword [ebp + 0x10]
or eax, edx
jne 0x45c198
mov esi, dword [ebp + 8]
push 0x40
push eax
push esi
call fcn.005ca820
add esp, 0xc
mov dword [esi], 0
mov dword [esi + 4], 0
mov eax, esi
mov dword [esi + 8], 0
mov dword [esi + 0xc], 0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
mov dword [esi + 0x18], 0
mov dword [esi + 0x1c], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x2c], 0
mov dword [esi + 0x30], 0
mov dword [esi + 0x34], 0
mov word [esi + 0x38], 0
mov byte [esi + 0x3a], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret 0x14
push edx
push ecx
mov ecx, dword [esi + 0xf0]
push str._Ps_ID
call fcn.0059b952
push dword [ebp + 0x18]
mov ecx, dword [esi + 0xf0]
push dword [ebp + 0x14]
push str._Time
call fcn.0059b952
mov ecx, dword [esi + 0xf0]
lea eax, [ebp - 0x28]
push eax
call fcn.0059bf76
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x28]
xorps xmm0, xmm0
mov word [ebp - 0x34], 0
movlpd qword [ebp - 0x6c], xmm0
movlpd qword [ebp - 0x64], xmm0
movlpd qword [ebp - 0x5c], xmm0
movlpd qword [ebp - 0x54], xmm0
movlpd qword [ebp - 0x44], xmm0
movlpd qword [ebp - 0x3c], xmm0
mov byte [ebp - 0x32], 0
call fcn.0059bbbd
test al, al
jne 0x45c269
push 0
push 0
push str.CreationTime
lea ecx, [ebp - 0x28]
call fcn.0059c286
push 0
push 0
push str.SrcSocket_ID
lea ecx, [ebp - 0x28]
mov dword [ebp - 0x5c], eax
mov dword [ebp - 0x58], edx
call fcn.0059c286
push 0
push 0
push str.DstSocket_ID
lea ecx, [ebp - 0x28]
mov dword [ebp - 0x6c], eax
mov dword [ebp - 0x68], edx
call fcn.0059c286
push 0
push 0
push str.IANAProtocolID
lea ecx, [ebp - 0x28]
mov dword [ebp - 0x64], eax
mov dword [ebp - 0x60], edx
call fcn.0059c286
mov dword [ebp - 0x4c], eax
mov dword [ebp - 0x48], edx
mov ecx, dword [esi + 0xf0]
call fcn.0059c461
mov esi, dword [ebp + 8]
lea ecx, [ebp - 0x28]
movups xmm0, xmmword [ebp - 0x6c]
movups xmmword [esi], xmm0
movups xmm0, xmmword [ebp - 0x5c]
movups xmmword [esi + 0x10], xmm0
movups xmm0, xmmword [ebp - 0x4c]
movups xmmword [esi + 0x20], xmm0
movups xmm0, xmmword [ebp - 0x3c]
movups xmmword [esi + 0x30], xmm0
call fcn.0059b53b
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret 0x14
Function at 0x4664c0
Capabilities:
Get process heap flags

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5fb148
mov eax, dword fs:[0]
push eax
sub esp, 8
push esi
mov eax, dword [0x6ba394]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
mov dword [esi + 0x14], 7
cmp dword [esi + 0x14], 8
mov dword [esi + 0x10], 0
jb 0x466511
mov eax, dword [esi]
jmp 0x466513
mov eax, esi
xor ecx, ecx
push 0xffffffffffffffff
push ecx
push dword [ebp + 0x10]
mov word [eax], cx
mov ecx, esi
call fcn.00434d60
xor eax, eax
mov dword [ebp - 4], 0
push 0xffffffffffffffff
lea ecx, [esi + 0x18]
mov dword [ecx + 0x14], 7
push eax
push dword [ebp + 0xc]
mov dword [ecx + 0x10], 0
mov dword [ebp + 0x10], ecx
mov word [ecx], ax
call fcn.00434d60
push dword [ebp + 8]
lea ecx, [esi + 0x30]
xor eax, eax
mov dword [ecx + 0x14], 7
mov dword [ecx + 0x10], 0
mov word [ecx], ax
call fcn.00434450
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret 0xc
Function at 0x468e90
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x6022e0
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push esi
push edi
mov eax, dword [0x6ba394]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov ebx, ecx
mov dword [ebp - 0x18], ebx
mov dword [ebp - 4], 0
mov eax, dword [ebp + 0xc]
cmp dword [eax + 0x14], 8
mov edi, dword [eax + 0x10]
jb 0x468ed7
mov esi, dword [eax]
jmp 0x468ed9
mov esi, eax
xor ecx, ecx
mov edx, 0x811c9dc5
add edi, edi
je 0x468ef5
movzx eax, byte [esi + ecx]
inc ecx
xor eax, edx
imul edx, eax, 0x1000193
cmp ecx, edi
jb 0x468ee4
mov eax, dword [ebx + 0x18]
and eax, edx
lea ecx, [eax*8]
mov eax, dword [ebx + 0xc]
mov dword [ebp - 0x14], ecx
mov edi, dword [eax + ecx]
cmp edi, dword [ebx + 4]
jne 0x468f14
mov esi, dword [ebx + 4]
jmp 0x468f1a
mov esi, dword [eax + ecx + 4]
mov esi, dword [esi]
cmp esi, edi
je 0x468f37
nop
mov esi, dword [esi + 4]
lea eax, [esi + 8]
push eax
push dword [ebp + 0xc]
call fcn.00422bf0
test al, al
jne 0x468f7e
cmp esi, edi
jne 0x468f20
mov edi, dword [ebp + 0x10]
mov dword [ebp + 0xc], edi
mov eax, dword [edi]
cmp esi, eax
je 0x468f64
mov ecx, dword [edi + 4]
mov dword [ecx], eax
mov ecx, dword [eax + 4]
mov dword [ecx], esi
mov ecx, dword [esi + 4]
mov dword [ecx], edi
mov ecx, dword [eax + 4]
mov edx, dword [esi + 4]
mov dword [esi + 4], ecx
mov ecx, dword [edi + 4]
mov dword [eax + 4], ecx
mov dword [edi + 4], edx
mov ecx, dword [ebx + 0xc]
mov edx, dword [ebp - 0x14]
add ecx, edx
mov eax, dword [ecx]
cmp eax, dword [ebx + 4]
jne 0x468fc1
mov dword [ecx], edi
mov eax, dword [ebx + 0xc]
mov dword [eax + edx + 4], edi
jmp 0x468fe3
mov edi, dword [ebp + 0x10]
mov ecx, dword [edi + 4]
mov eax, dword [edi]
mov dword [ecx], eax
mov ecx, dword [edi]
mov eax, dword [edi + 4]
mov dword [ecx + 4], eax
lea ecx, [edi + 8]
dec dword [ebx + 8]
call fcn.00439690
push edi
call fcn.005b1685
mov eax, dword [ebp + 8]
add esp, 4
mov dword [eax], esi
mov byte [eax + 4], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
cmp eax, esi
jne 0x468fc9
mov dword [ecx], edi
jmp 0x468fe3
mov eax, dword [ecx + 4]
mov eax, dword [eax]
mov dword [ecx + 4], eax
cmp eax, edi
je 0x468fe3
mov ecx, dword [ebx + 0xc]
mov eax, dword [ecx + edx + 4]
mov eax, dword [eax + 4]
mov dword [ecx + edx + 4], eax
mov ecx, ebx
mov dword [ebp - 4], 2
call fcn.00469d10
mov eax, dword [ebp + 8]
mov dword [eax], edi
mov byte [eax + 4], 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc