joyce8/EMBER2024-capa huggingface dataset:
Function at 0x41ae90
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x606818
mov eax, dword fs:[0]
push eax
sub esp, 0x18
push ebx
push esi
push edi
mov eax, dword [0x6ab0d4]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
lea eax, [ebx + 0xfc]
push eax
push dword [ebx + 0x4b0]
call dword [sym.imp.WS2_32.dll___WSAFDIsSet]
test eax, eax
jne 0x41aee3
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebx + 0x440]
mov esi, dword [ebx + 0x434]
mov edi, dword [ebx + 0x430]
sub esi, ecx
push esi
add edi, ecx
push 0
push edi
call fcn.005d2630
add esp, 0xc
push 0
push esi
push edi
push dword [ebx + 0x4b0]
call dword [sym.imp.WS2_32.dll_recv]
mov esi, eax
test esi, esi
jg 0x41af91
cmp byte [0x6b2b20], 0
je 0x41af7c
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov edx, eax
lea ecx, [ebp - 0x24]
call fcn.00402750
mov dword [ebp - 4], 0
cmp dword [eax + 0x14], 0x10
jb 0x41af43
mov eax, dword [eax]
add ebx, 0x400
cmp dword [ebx + 0x14], 0x10
jb 0x41af51
mov ebx, dword [ebx]
push eax
push ebx
push str._s_recv_failed__s_
push 3
push 0x6b2b20
call fcn.004030c0
mov eax, dword [ebp - 0x10]
add esp, 0x14
cmp eax, 0x10
jb 0x41af7c
inc eax
lea ecx, [ebp - 0x24]
push eax
push dword [ebp - 0x24]
call fcn.00408cd0
or eax, 0xffffffff
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
cmp byte [0x6b2b20], 0
je 0x41afbe
add ebx, 0x400
cmp dword [ebx + 0x14], 0x10
jb 0x41afa8
mov ebx, dword [ebx]
push esi
push ebx
push str._s_recv_len_d
push 1
push 0x6b2b20
call fcn.004030c0
add esp, 0x14
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x41afe0
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x6075d8
mov eax, dword fs:[0]
push eax
sub esp, 0x18
push esi
mov eax, dword [0x6ab0d4]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
cmp byte [0x6b2b20], 0
je 0x41b03a
cmp dword [esi + 0x414], 0x10
lea eax, [esi + 0x400]
jb 0x41b022
mov eax, dword [eax]
push dword [ebp + 0xc]
push eax
push str._s_send_len_u
push 1
push 0x6b2b20
call fcn.004030c0
add esp, 0x14
push 0
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [esi + 0x4b0]
call dword [sym.imp.WS2_32.dll_send]
cmp eax, 0xffffffff
jne 0x41b0cd
cmp byte [0x6b2b20], 0
je 0x41b0b9
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov edx, eax
lea ecx, [ebp - 0x24]
call fcn.00402750
mov ecx, eax
mov dword [ebp - 4], 0
cmp dword [ecx + 0x14], 0x10
jb 0x41b07d
mov ecx, dword [ecx]
cmp dword [esi + 0x414], 0x10
lea eax, [esi + 0x400]
jb 0x41b08e
mov eax, dword [eax]
push ecx
push eax
push str._s_send_failed__s_
push 3
push 0x6b2b20
call fcn.004030c0
mov eax, dword [ebp - 0x10]
add esp, 0x14
cmp eax, 0x10
jb 0x41b0b9
inc eax
lea ecx, [ebp - 0x24]
push eax
push dword [ebp - 0x24]
call fcn.00408cd0
xor al, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret 8
mov al, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret 8
Function at 0x41b0f0
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x606818
mov eax, dword fs:[0]
push eax
sub esp, 0x18
push ebx
push esi
push edi
mov eax, dword [0x6ab0d4]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov edx, dword [esi + 0x450]
mov edi, dword [esi + 0x43c]
mov ebx, dword [esi + 0x438]
sub edi, edx
push edi
add ebx, edx
push 0
push ebx
call fcn.005d2630
mov ecx, dword [esi + 0x4b4]
add esp, 0xc
cmp ecx, 0xffffffff
je 0x41b236
lea eax, [esi + 0xfc]
push eax
push ecx
call dword [sym.imp.WS2_32.dll___WSAFDIsSet]
test eax, eax
je 0x41b236
push 0
push edi
push ebx
push dword [esi + 0x4b4]
call dword [sym.imp.WS2_32.dll_recv]
mov edi, eax
test edi, edi
jg 0x41b1f2
cmp byte [0x6b2b20], 0
je 0x41b1dd
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov edx, eax
lea ecx, [ebp - 0x24]
call fcn.00402750
mov ecx, eax
mov dword [ebp - 4], 0
cmp dword [ecx + 0x14], 0x10
jb 0x41b1a1
mov ecx, dword [ecx]
cmp dword [esi + 0x42c], 0x10
lea eax, [esi + 0x418]
jb 0x41b1b2
mov eax, dword [eax]
push ecx
push eax
push str._s_recv_failed__s_
push 3
push 0x6b2b20
call fcn.004030c0
mov eax, dword [ebp - 0x10]
add esp, 0x14
cmp eax, 0x10
jb 0x41b1dd
inc eax
lea ecx, [ebp - 0x24]
push eax
push dword [ebp - 0x24]
call fcn.00408cd0
or eax, 0xffffffff
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
cmp byte [0x6b2b20], 0
je 0x41b222
cmp dword [esi + 0x42c], 0x10
lea eax, [esi + 0x418]
jb 0x41b20c
mov eax, dword [eax]
push edi
push eax
push str._s_recv_len_d
push 1
push 0x6b2b20
call fcn.004030c0
add esp, 0x14
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x41b250
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x6075d8
mov eax, dword fs:[0]
push eax
sub esp, 0x18
push esi
mov eax, dword [0x6ab0d4]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
cmp byte [0x6b2b20], 0
je 0x41b2aa
cmp dword [esi + 0x42c], 0x10
lea eax, [esi + 0x418]
jb 0x41b292
mov eax, dword [eax]
push dword [ebp + 0xc]
push eax
push str._s_send_len_u
push 1
push 0x6b2b20
call fcn.004030c0
add esp, 0x14
push 0
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [esi + 0x4b4]
call dword [sym.imp.WS2_32.dll_send]
cmp eax, 0xffffffff
jne 0x41b33d
cmp byte [0x6b2b20], 0
je 0x41b329
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov edx, eax
lea ecx, [ebp - 0x24]
call fcn.00402750
mov ecx, eax
mov dword [ebp - 4], 0
cmp dword [ecx + 0x14], 0x10
jb 0x41b2ed
mov ecx, dword [ecx]
cmp dword [esi + 0x42c], 0x10
lea eax, [esi + 0x418]
jb 0x41b2fe
mov eax, dword [eax]
push ecx
push eax
push str._s_send_failed__s_
push 3
push 0x6b2b20
call fcn.004030c0
mov eax, dword [ebp - 0x10]
add esp, 0x14
cmp eax, 0x10
jb 0x41b329
inc eax
lea ecx, [ebp - 0x24]
push eax
push dword [ebp - 0x24]
call fcn.00408cd0
xor al, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret 8
mov al, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret 8
Function at 0x41b5f0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
mov ebx, dword [sym.imp.WS2_32.dll_ntohs]
push esi
push edi
mov edi, dword [ebp + 8]
movzx eax, word [edi]
push eax
call ebx
movzx edx, ax
movzx eax, dl
xor eax, 0x811c9dc5
imul ecx, eax, 0x1000193
movzx eax, dh
xor ecx, eax
imul eax, ecx, 0x1000193
movzx ecx, word [edi]
mov dword [ebp - 4], eax
cmp ecx, 2
jne 0x41b6a4
push dword [edi + 4]
call dword [sym.imp.WS2_32.dll_ntohl]
movzx ecx, al
xor ecx, 0x811c9dc5
mov dword [ebp + 8], eax
imul ecx, ecx, 0x1000193
movzx eax, ah
xor ecx, eax
movzx eax, byte [ebp + 0xa]
imul ecx, ecx, 0x1000193
xor ecx, eax
movzx eax, byte [ebp + 0xb]
imul ecx, ecx, 0x1000193
xor ecx, eax
movzx eax, word [edi + 2]
push eax
imul esi, ecx, 0x1000193
call ebx
movzx edx, ax
movzx eax, dl
xor eax, 0x811c9dc5
imul ecx, eax, 0x1000193
movzx eax, dh
pop edi
xor ecx, eax
imul eax, ecx, 0x1000193
add eax, eax
xor eax, esi
add eax, eax
xor eax, dword [ebp - 4]
pop esi
add eax, eax
pop ebx
mov esp, ebp
pop ebp
ret 4
cmp ecx, 0x17
jne 0x41b7ab
movzx eax, word [edi + 2]
push eax
call ebx
push dword [edi + 4]
mov esi, dword [sym.imp.WS2_32.dll_ntohl]
movzx edx, ax
movzx eax, dl
xor eax, 0x811c9dc5
imul ecx, eax, 0x1000193
movzx eax, dh
xor ecx, eax
imul eax, ecx, 0x1000193
mov dword [ebp - 0xc], eax
call esi
movzx ecx, al
xor ecx, 0x811c9dc5
mov dword [ebp + 8], eax
imul ecx, ecx, 0x1000193
push dword [edi + 0x18]
movzx eax, ah
xor ecx, eax
movzx eax, byte [ebp + 0xa]
imul ecx, ecx, 0x1000193
xor ecx, eax
movzx eax, byte [ebp + 0xb]
imul ecx, ecx, 0x1000193
xor ecx, eax
imul eax, ecx, 0x1000193
mov dword [ebp - 8], eax
call esi
movzx ecx, al
xor ebx, ebx
xor ecx, 0x811c9dc5
mov dword [ebp + 8], eax
imul ecx, ecx, 0x1000193
xor esi, esi
movzx eax, ah
xor ecx, eax
movzx eax, byte [ebp + 0xa]
imul ecx, ecx, 0x1000193
xor ecx, eax
movzx eax, byte [ebp + 0xb]
imul ecx, ecx, 0x1000193
xor ecx, eax
imul eax, ecx, 0x1000193
add edi, 8
mov dword [ebp + 8], eax
nop word [eax + eax]
movzx eax, word [edi]
push eax
call dword [sym.imp.WS2_32.dll_ntohs]
movzx edx, ax
lea edi, [edi + 2]
movzx eax, dl
xor eax, 0x811c9dc5
imul ecx, eax, 0x1000193
movzx eax, dh
xor ecx, eax
imul eax, ecx, 0x1000193
lea ecx, [esi + 5]
inc esi
shl eax, cl
xor ebx, eax
cmp esi, 8
jb 0x41b760
lea eax, [ebx + ebx]
xor eax, dword [ebp + 8]
add eax, eax
xor eax, dword [ebp - 8]
add eax, eax
xor eax, dword [ebp - 0xc]
add eax, eax
xor eax, dword [ebp - 4]
pop edi
pop esi
add eax, eax
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x41be20
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x606428
mov eax, dword fs:[0]
push eax
sub esp, 0x18
push esi
mov eax, dword [0x6ab0d4]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
push 0
push 0
push esi
push 0x41bee0
push 0
push 0
call fcn.005df4bd
add esp, 0x18
mov dword [esi + 0x30], eax
cmp eax, 0xffffffff
jne 0x41beca
cmp byte [0x6b2b20], 0
je 0x41beb8
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea ecx, [ebp - 0x24]
call fcn.004029b0
mov dword [ebp - 4], 0
cmp dword [eax + 0x14], 8
jb 0x41be8e
mov eax, dword [eax]
push eax
push str.session_traffic_statistics__create_thread_failed__s_
push 3
push 0x6b2b20
call fcn.00403570
mov eax, dword [ebp - 0x10]
add esp, 0x10
cmp eax, 8
jb 0x41beb8
inc eax
lea ecx, [ebp - 0x24]
push eax
push dword [ebp - 0x24]
call fcn.00408960
xor al, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
mov al, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x41efe0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x6ab0d4]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
mov ebx, ecx
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], edi
cmp dword [edi + 0x14], 0x10
mov eax, dword [edi + 0x10]
mov dword [ebp - 8], eax
jb 0x41f011
mov esi, dword [edi]
jmp 0x41f013
mov esi, edi
xor ecx, ecx
mov edx, 0x811c9dc5
test eax, eax
je 0x41f034
mov edi, eax
movzx eax, byte [esi + ecx]
inc ecx
xor eax, edx
imul edx, eax, 0x1000193
cmp ecx, edi
jb 0x41f020
mov edi, dword [ebp - 0xc]
mov eax, dword [ebx + 0x18]
mov ecx, dword [ebx + 0xc]
and eax, edx
mov ebx, dword [ebx + 4]
mov esi, dword [ecx + eax*8]
add eax, eax
mov edx, dword [ecx + eax*4]
inc eax
mov dword [ebp - 0xc], edx
lea eax, [ecx + eax*4]
mov dword [ebp - 0x14], eax
cmp edx, ebx
jne 0x41f059
mov eax, ebx
jmp 0x41f05d
mov eax, dword [eax]
mov eax, dword [eax]
cmp esi, eax
je 0x41f0da
cmp dword [edi + 0x14], 0x10
lea ecx, [esi + 8]
jb 0x41f06e
mov eax, dword [edi]
jmp 0x41f070
mov eax, edi
cmp dword [ecx + 0x14], 0x10
lea edx, [ecx + 0x10]
jb 0x41f07b
mov ecx, dword [ecx]
push dword [ebp - 8]
mov edx, dword [edx]
push eax
call fcn.0041f100
add esp, 8
test eax, eax
je 0x41f097
mov esi, dword [esi]
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 0x14]
jmp 0x41f051
cmp dword [esi + 0x1c], 0x10
lea eax, [esi + 8]
lea ecx, [eax + 0x10]
jb 0x41f0a5
mov eax, dword [eax]
cmp dword [edi + 0x14], 0x10
jb 0x41f0ad
mov edi, dword [edi]
push dword [ecx]
mov edx, dword [ebp - 8]
mov ecx, edi
push eax
call fcn.0041f100
add esp, 8
test eax, eax
mov eax, dword [ebp - 0x10]
cmovne esi, ebx
pop edi
mov dword [eax], esi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.005697c8
mov esp, ebp
pop ebp
ret 8
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 4]
pop edi
pop esi
mov dword [eax], ebx
xor ecx, ebp
pop ebx
call fcn.005697c8
mov esp, ebp
pop ebp
ret 8
Function at 0x4233c0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x608440
mov eax, dword fs:[0]
push eax
sub esp, 0x20
mov eax, dword [0x6ab0d4]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov eax, ecx
mov dword [ebp - 0x20], eax
mov ebx, dword [ebp + 0xc]
mov dword [ebp - 4], 0
mov dword [ebp - 0x28], eax
mov eax, dword [ebp + 8]
cmp dword [ebx + 0x14], 0x10
mov edi, dword [ebx + 0x10]
mov dword [ebp - 0x24], eax
jb 0x423413
mov esi, dword [ebx]
jmp 0x423415
mov esi, ebx
xor ecx, ecx
mov edx, 0x811c9dc5
test edi, edi
je 0x423431
movzx eax, byte [esi + ecx]
inc ecx
xor eax, edx
imul edx, eax, 0x1000193
cmp ecx, edi
jb 0x423420
mov ecx, dword [ebp - 0x20]
mov eax, dword [ecx + 0x18]
and eax, edx
lea edx, [ecx + 4]
lea esi, [eax*8]
mov dword [ebp - 0x18], edx
mov eax, dword [ecx + 0xc]
mov dword [ebp - 0x1c], esi
mov edi, dword [eax + esi]
cmp edi, dword [edx]
jne 0x423457
mov esi, dword [edx]
jmp 0x42345d
mov esi, dword [eax + esi + 4]
mov esi, dword [esi]
cmp esi, edi
je 0x42349a
mov esi, dword [esi + 4]
cmp dword [esi + 0x1c], 0x10
lea eax, [esi + 8]
lea ecx, [eax + 0x10]
mov dword [ebp - 0x2c], ecx
jb 0x423475
mov eax, dword [eax]
cmp dword [ebx + 0x14], 0x10
jb 0x42347f
mov ecx, dword [ebx]
jmp 0x423481
mov ecx, ebx
mov edx, dword [ebp - 0x2c]
push dword [edx]
mov edx, dword [ebx + 0x10]
push eax
call fcn.0041f100
add esp, 8
test eax, eax
je 0x4234e5
cmp esi, edi
jne 0x423461
mov edi, dword [ebp + 0x10]
mov dword [ebp - 0x18], edi
mov eax, dword [edi]
cmp esi, eax
je 0x4234c7
mov ecx, dword [edi + 4]
mov dword [ecx], eax
mov ecx, dword [eax + 4]
mov dword [ecx], esi
mov ecx, dword [esi + 4]
mov dword [ecx], edi
mov ecx, dword [eax + 4]
mov edx, dword [esi + 4]
mov dword [esi + 4], ecx
mov ecx, dword [edi + 4]
mov dword [eax + 4], ecx
mov dword [edi + 4], edx
mov ebx, dword [ebp - 0x20]
mov ecx, dword [ebp - 0x1c]
add ecx, dword [ebx + 0xc]
mov eax, dword [ecx]
cmp eax, dword [ebx + 4]
jne 0x42351b
mov dword [ecx], edi
mov eax, dword [ebx + 0xc]
mov ecx, dword [ebp - 0x1c]
mov dword [eax + ecx + 4], edi
jmp 0x423540
push dword [ebp + 0x10]
mov ecx, dword [ebp - 0x18]
lea eax, [ebp - 0x28]
push eax
call fcn.00423860
mov eax, dword [ebp - 0x24]
mov dword [eax], esi
mov byte [eax + 4], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.005697c8
mov esp, ebp
pop ebp
ret 0xc
cmp eax, esi
jne 0x423523
mov dword [ecx], edi
jmp 0x423540
mov eax, dword [ecx + 4]
mov eax, dword [eax]
mov dword [ecx + 4], eax
cmp eax, edi
je 0x423540
mov edx, dword [ebx + 0xc]
mov ecx, dword [ebp - 0x1c]
mov eax, dword [edx + ecx + 4]
mov eax, dword [eax + 4]
mov dword [edx + ecx + 4], eax
mov ecx, ebx
mov dword [ebp - 4], 2
call fcn.004236e0
mov eax, dword [ebp - 0x24]
mov dword [eax], edi
mov byte [eax + 4], 1
jmp 0x4234fd
Function at 0x423780
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [0x6ab0d4]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 0xc]
cmp dword [eax + 0x1c], 0x10
push ebx
mov ebx, dword [eax + 0x18]
push esi
lea esi, [eax + 8]
mov dword [ebp - 8], ecx
jb 0x4237ac
mov esi, dword [esi]
xor edx, edx
push edi
mov edi, 0x811c9dc5
test ebx, ebx
je 0x4237c9
movzx ecx, byte [esi + edx]
inc edx
xor ecx, edi
imul edi, ecx, 0x1000193
cmp edx, ebx
jb 0x4237b8
mov ebx, dword [ebp - 8]
mov ecx, dword [ebx + 0x18]
mov edx, dword [ebx + 0xc]
and ecx, edi
pop edi
lea esi, [ecx*8]
add edx, esi
cmp dword [edx + 4], eax
jne 0x423800
cmp dword [edx], eax
jne 0x4237f8
mov eax, dword [ebx + 4]
mov dword [edx], eax
mov ecx, dword [ebx + 0xc]
mov eax, dword [ebx + 4]
mov dword [ecx + esi + 4], eax
jmp 0x423808
mov eax, dword [eax + 4]
mov dword [edx + 4], eax
jmp 0x423808
cmp dword [edx], eax
jne 0x42380b
mov ecx, dword [eax]
mov dword [edx], ecx
mov eax, dword [ebp + 0xc]
mov esi, dword [ebp - 0xc]
lea ecx, [ebx + 4]
push eax
push esi
call fcn.00423860
mov ecx, dword [ebp - 4]
mov eax, esi
pop esi
xor ecx, ebp
pop ebx
call fcn.005697c8
mov esp, ebp
pop ebp
ret 8

Function at 0x423e80
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x608539
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x6ab0d4]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov dword [ebp - 0x10], ebx
mov dword [ebx + 0x10], 0
mov dword [ebx + 0x14], 0
mov dword [ebx + 0x14], 0xf
cmp dword [ebx + 0x14], 0x10
mov dword [ebx + 0x10], 0
jb 0x423ed1
mov eax, dword [ebx]
jmp 0x423ed3
mov eax, ebx
push 0xffffffffffffffff
push 0
push dword [ebp + 8]
mov byte [eax], 0
call fcn.00408490
lea ecx, [ebx + 0x18]
mov dword [ebp - 4], 0
mov dword [ecx + 0x14], 0xf
mov dword [ecx + 0x10], 0
cmp dword [ecx + 0x14], 0x10
jb 0x423f04
mov eax, dword [ecx]
jmp 0x423f06
mov eax, ecx
push 0xffffffffffffffff
push 0
push dword [ebp + 0xc]
mov byte [eax], 0
call fcn.00408490
mov edi, dword [ebp + 0x10]
add ebx, 0x30
mov byte [ebp - 4], 1
lea esi, [ebx + 4]
mov dword [ebp + 8], ebx
push 0
mov eax, dword [edi]
mov dword [ebx], eax
push 0
mov dword [ebp + 0xc], esi
mov dword [esi], 0
mov dword [esi + 4], 0
call fcn.004288c0
mov dword [esi], eax
mov dword [ebx + 0xc], 0
mov dword [ebx + 0x10], 0
mov dword [ebx + 0x14], 0
push edi
mov ecx, ebx
mov byte [ebp - 4], 3
call fcn.00426ea0
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x427d10
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x608bc0
mov eax, dword fs:[0]
push eax
sub esp, 0x20
mov eax, dword [0x6ab0d4]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov eax, ecx
mov dword [ebp - 0x20], eax
mov ebx, dword [ebp + 0xc]
mov dword [ebp - 4], 0
mov dword [ebp - 0x28], eax
mov eax, dword [ebp + 8]
cmp dword [ebx + 0x14], 0x10
mov edi, dword [ebx + 0x10]
mov dword [ebp - 0x24], eax
jb 0x427d63
mov esi, dword [ebx]
jmp 0x427d65
mov esi, ebx
xor ecx, ecx
mov edx, 0x811c9dc5
test edi, edi
je 0x427d81
movzx eax, byte [esi + ecx]
inc ecx
xor eax, edx
imul edx, eax, 0x1000193
cmp ecx, edi
jb 0x427d70
mov ecx, dword [ebp - 0x20]
mov eax, dword [ecx + 0x18]
and eax, edx
lea edx, [ecx + 4]
lea esi, [eax*8]
mov dword [ebp - 0x18], edx
mov eax, dword [ecx + 0xc]
mov dword [ebp - 0x1c], esi
mov edi, dword [eax + esi]
cmp edi, dword [edx]
jne 0x427da7
mov esi, dword [edx]
jmp 0x427dad
mov esi, dword [eax + esi + 4]
mov esi, dword [esi]
cmp esi, edi
je 0x427dea
mov esi, dword [esi + 4]
cmp dword [esi + 0x1c], 0x10
lea eax, [esi + 8]
lea ecx, [eax + 0x10]
mov dword [ebp - 0x2c], ecx
jb 0x427dc5
mov eax, dword [eax]
cmp dword [ebx + 0x14], 0x10
jb 0x427dcf
mov ecx, dword [ebx]
jmp 0x427dd1
mov ecx, ebx
mov edx, dword [ebp - 0x2c]
push dword [edx]
mov edx, dword [ebx + 0x10]
push eax
call fcn.0041f100
add esp, 8
test eax, eax
je 0x427e35
cmp esi, edi
jne 0x427db1
mov edi, dword [ebp + 0x10]
mov dword [ebp - 0x18], edi
mov eax, dword [edi]
cmp esi, eax
je 0x427e17
mov ecx, dword [edi + 4]
mov dword [ecx], eax
mov ecx, dword [eax + 4]
mov dword [ecx], esi
mov ecx, dword [esi + 4]
mov dword [ecx], edi
mov ecx, dword [eax + 4]
mov edx, dword [esi + 4]
mov dword [esi + 4], ecx
mov ecx, dword [edi + 4]
mov dword [eax + 4], ecx
mov dword [edi + 4], edx
mov ebx, dword [ebp - 0x20]
mov ecx, dword [ebp - 0x1c]
add ecx, dword [ebx + 0xc]
mov eax, dword [ecx]
cmp eax, dword [ebx + 4]
jne 0x427e6b
mov dword [ecx], edi
mov eax, dword [ebx + 0xc]
mov ecx, dword [ebp - 0x1c]
mov dword [eax + ecx + 4], edi
jmp 0x427e90
push dword [ebp + 0x10]
mov ecx, dword [ebp - 0x18]
lea eax, [ebp - 0x28]
push eax
call fcn.00428800
mov eax, dword [ebp - 0x24]
mov dword [eax], esi
mov byte [eax + 4], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.005697c8
mov esp, ebp
pop ebp
ret 0xc
cmp eax, esi
jne 0x427e73
mov dword [ecx], edi
jmp 0x427e90
mov eax, dword [ecx + 4]
mov eax, dword [eax]
mov dword [ecx + 4], eax
cmp eax, edi
je 0x427e90
mov edx, dword [ebx + 0xc]
mov ecx, dword [ebp - 0x1c]
mov eax, dword [edx + ecx + 4]
mov eax, dword [eax + 4]
mov dword [edx + ecx + 4], eax
mov ecx, ebx
mov dword [ebp - 4], 2
call fcn.00428250
mov eax, dword [ebp - 0x24]
mov dword [eax], edi
mov byte [eax + 4], 1
jmp 0x427e4d
Function at 0x427ed0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x608bf0
mov eax, dword fs:[0]
push eax
sub esp, 0x20
mov eax, dword [0x6ab0d4]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov eax, ecx
mov dword [ebp - 0x20], eax
mov ebx, dword [ebp + 0xc]
mov dword [ebp - 4], 0
mov dword [ebp - 0x28], eax
mov eax, dword [ebp + 8]
cmp dword [ebx + 0x14], 0x10
mov edi, dword [ebx + 0x10]
mov dword [ebp - 0x24], eax
jb 0x427f23
mov esi, dword [ebx]
jmp 0x427f25
mov esi, ebx
xor ecx, ecx
mov edx, 0x811c9dc5
test edi, edi
je 0x427f41
movzx eax, byte [esi + ecx]
inc ecx
xor eax, edx
imul edx, eax, 0x1000193
cmp ecx, edi
jb 0x427f30
mov ecx, dword [ebp - 0x20]
mov eax, dword [ecx + 0x18]
and eax, edx
lea edx, [ecx + 4]
lea esi, [eax*8]
mov dword [ebp - 0x18], edx
mov eax, dword [ecx + 0xc]
mov dword [ebp - 0x1c], esi
mov edi, dword [eax + esi]
cmp edi, dword [edx]
jne 0x427f67
mov esi, dword [edx]
jmp 0x427f6d
mov esi, dword [eax + esi + 4]
mov esi, dword [esi]
cmp esi, edi
je 0x427faa
mov esi, dword [esi + 4]
cmp dword [esi + 0x1c], 0x10
lea eax, [esi + 8]
lea ecx, [eax + 0x10]
mov dword [ebp - 0x2c], ecx
jb 0x427f85
mov eax, dword [eax]
cmp dword [ebx + 0x14], 0x10
jb 0x427f8f
mov ecx, dword [ebx]
jmp 0x427f91
mov ecx, ebx
mov edx, dword [ebp - 0x2c]
push dword [edx]
mov edx, dword [ebx + 0x10]
push eax
call fcn.0041f100
add esp, 8
test eax, eax
je 0x427ff5
cmp esi, edi
jne 0x427f71
mov edi, dword [ebp + 0x10]
mov dword [ebp - 0x18], edi
mov eax, dword [edi]
cmp esi, eax
je 0x427fd7
mov ecx, dword [edi + 4]
mov dword [ecx], eax
mov ecx, dword [eax + 4]
mov dword [ecx], esi
mov ecx, dword [esi + 4]
mov dword [ecx], edi
mov ecx, dword [eax + 4]
mov edx, dword [esi + 4]
mov dword [esi + 4], ecx
mov ecx, dword [edi + 4]
mov dword [eax + 4], ecx
mov dword [edi + 4], edx
mov ebx, dword [ebp - 0x20]
mov ecx, dword [ebp - 0x1c]
add ecx, dword [ebx + 0xc]
mov eax, dword [ecx]
cmp eax, dword [ebx + 4]
jne 0x42802b
mov dword [ecx], edi
mov eax, dword [ebx + 0xc]
mov ecx, dword [ebp - 0x1c]
mov dword [eax + ecx + 4], edi
jmp 0x428050
push dword [ebp + 0x10]
mov ecx, dword [ebp - 0x18]
lea eax, [ebp - 0x28]
push eax
call fcn.004288f0
mov eax, dword [ebp - 0x24]
mov dword [eax], esi
mov byte [eax + 4], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.005697c8
mov esp, ebp
pop ebp
ret 0xc
cmp eax, esi
jne 0x428033
mov dword [ecx], edi
jmp 0x428050
mov eax, dword [ecx + 4]
mov eax, dword [eax]
mov dword [ecx + 4], eax
cmp eax, edi
je 0x428050
mov edx, dword [ebx + 0xc]
mov ecx, dword [ebp - 0x1c]
mov eax, dword [edx + ecx + 4]
mov eax, dword [eax + 4]
mov dword [edx + ecx + 4], eax
mov ecx, ebx
mov dword [ebp - 4], 2
call fcn.00428530
mov eax, dword [ebp - 0x24]
mov dword [eax], edi
mov byte [eax + 4], 1
jmp 0x42800d