joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4428b0
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x523520
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push esi
push edi
mov eax, dword [0x56d484]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov ebx, ecx
mov dword [ebp - 0x14], ebx
mov edi, dword [ebp + 0xc]
xor edx, edx
mov dword [ebp - 4], 0
mov esi, dword [edi + 4]
mov al, byte [esi]
test al, al
je 0x442906
movsx eax, al
lea edx, [edx + edx*4]
add edx, eax
lea esi, [esi + 1]
mov al, byte [esi]
test al, al
jne 0x4428f5
imul eax, dword [edi], 0x1000193
mov ecx, dword [ebx + 0xc]
mov esi, dword [ebx + 4]
xor eax, edx
and eax, dword [ebx + 0x18]
lea edx, [eax*8]
mov eax, dword [ecx + edx]
mov dword [ebp + 0xc], edx
cmp eax, esi
je 0x44292e
mov esi, dword [ecx + edx + 4]
mov esi, dword [esi]
mov ecx, dword [edi]
cmp esi, eax
je 0x4429ad
mov esi, dword [esi + 4]
cmp ecx, dword [esi + 8]
jne 0x442930
mov ecx, dword [esi + 0xc]
mov edx, dword [edi + 4]
mov bl, byte [edx]
cmp bl, byte [ecx]
jne 0x442962
test bl, bl
je 0x44295e
mov bl, byte [edx + 1]
cmp bl, byte [ecx + 1]
jne 0x442962
add edx, 2
add ecx, 2
test bl, bl
jne 0x442942
xor ecx, ecx
jmp 0x442967
sbb ecx, ecx
or ecx, 1
test ecx, ecx
mov ecx, dword [edi]
jne 0x442930
mov edx, dword [ebp + 0x10]
push 0x14
push edx
mov ecx, dword [edx + 4]
mov eax, dword [edx]
mov dword [ecx], eax
mov ecx, dword [edx]
mov eax, dword [edx + 4]
mov dword [ecx + 4], eax
mov eax, dword [ebp - 0x14]
dec dword [eax + 8]
call fcn.004dc9b6
mov eax, dword [ebp + 8]
add esp, 8
mov dword [eax], esi
mov byte [eax + 4], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov edi, dword [ebp + 0x10]
mov dword [ebp - 0x18], edi
mov eax, dword [edi]
cmp esi, eax
je 0x4429da
mov ecx, dword [edi + 4]
mov dword [ecx], eax
mov ecx, dword [eax + 4]
mov dword [ecx], esi
mov ecx, dword [esi + 4]
mov dword [ecx], edi
mov ecx, dword [eax + 4]
mov edx, dword [esi + 4]
mov dword [esi + 4], ecx
mov ecx, dword [edi + 4]
mov dword [eax + 4], ecx
mov dword [edi + 4], edx
mov ebx, dword [ebp - 0x14]
mov edx, dword [ebp + 0xc]
mov ecx, dword [ebx + 0xc]
add ecx, edx
mov eax, dword [ecx]
cmp eax, dword [ebx + 4]
jne 0x4429f7
mov dword [ecx], edi
mov eax, dword [ebx + 0xc]
mov dword [edx + eax + 4], edi
jmp 0x442a19
cmp eax, esi
jne 0x4429ff
mov dword [ecx], edi
jmp 0x442a19
mov eax, dword [ecx + 4]
mov eax, dword [eax]
mov dword [ecx + 4], eax
cmp eax, edi
je 0x442a19
mov ecx, dword [ebx + 0xc]
mov eax, dword [ecx + edx + 4]
mov eax, dword [eax + 4]
mov dword [ecx + edx + 4], eax
mov ecx, ebx
mov dword [ebp - 4], 2
call fcn.004642f0
mov eax, dword [ebp + 8]
mov dword [eax], edi
mov byte [eax + 4], 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x442a70
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x523540
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push esi
push edi
mov eax, dword [0x56d484]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov ebx, ecx
mov dword [ebp - 0x14], ebx
mov edi, dword [ebp + 0xc]
xor edx, edx
mov dword [ebp - 4], 0
mov esi, dword [edi + 4]
mov al, byte [esi]
test al, al
je 0x442ac6
movsx eax, al
lea edx, [edx + edx*4]
add edx, eax
lea esi, [esi + 1]
mov al, byte [esi]
test al, al
jne 0x442ab5
imul eax, dword [edi], 0x1000193
mov ecx, dword [ebx + 0xc]
mov esi, dword [ebx + 4]
xor eax, edx
and eax, dword [ebx + 0x18]
lea edx, [eax*8]
mov eax, dword [ecx + edx]
mov dword [ebp + 0xc], edx
cmp eax, esi
je 0x442aee
mov esi, dword [ecx + edx + 4]
mov esi, dword [esi]
mov ecx, dword [edi]
cmp esi, eax
je 0x442b6d
mov esi, dword [esi + 4]
cmp ecx, dword [esi + 8]
jne 0x442af0
mov ecx, dword [esi + 0xc]
mov edx, dword [edi + 4]
mov bl, byte [edx]
cmp bl, byte [ecx]
jne 0x442b22
test bl, bl
je 0x442b1e
mov bl, byte [edx + 1]
cmp bl, byte [ecx + 1]
jne 0x442b22
add edx, 2
add ecx, 2
test bl, bl
jne 0x442b02
xor ecx, ecx
jmp 0x442b27
sbb ecx, ecx
or ecx, 1
test ecx, ecx
mov ecx, dword [edi]
jne 0x442af0
mov edx, dword [ebp + 0x10]
push 0x18
push edx
mov ecx, dword [edx + 4]
mov eax, dword [edx]
mov dword [ecx], eax
mov ecx, dword [edx]
mov eax, dword [edx + 4]
mov dword [ecx + 4], eax
mov eax, dword [ebp - 0x14]
dec dword [eax + 8]
call fcn.004dc9b6
mov eax, dword [ebp + 8]
add esp, 8
mov dword [eax], esi
mov byte [eax + 4], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov edi, dword [ebp + 0x10]
mov dword [ebp - 0x18], edi
mov eax, dword [edi]
cmp esi, eax
je 0x442b9a
mov ecx, dword [edi + 4]
mov dword [ecx], eax
mov ecx, dword [eax + 4]
mov dword [ecx], esi
mov ecx, dword [esi + 4]
mov dword [ecx], edi
mov ecx, dword [eax + 4]
mov edx, dword [esi + 4]
mov dword [esi + 4], ecx
mov ecx, dword [edi + 4]
mov dword [eax + 4], ecx
mov dword [edi + 4], edx
mov ebx, dword [ebp - 0x14]
mov edx, dword [ebp + 0xc]
mov ecx, dword [ebx + 0xc]
add ecx, edx
mov eax, dword [ecx]
cmp eax, dword [ebx + 4]
jne 0x442bb7
mov dword [ecx], edi
mov eax, dword [ebx + 0xc]
mov dword [edx + eax + 4], edi
jmp 0x442bd9
cmp eax, esi
jne 0x442bbf
mov dword [ecx], edi
jmp 0x442bd9
mov eax, dword [ecx + 4]
mov eax, dword [eax]
mov dword [ecx + 4], eax
cmp eax, edi
je 0x442bd9
mov ecx, dword [ebx + 0xc]
mov eax, dword [ecx + edx + 4]
mov eax, dword [eax + 4]
mov dword [ecx + edx + 4], eax
mov ecx, ebx
mov dword [ebp - 4], 2
call fcn.00464370
mov eax, dword [ebp + 8]
mov dword [eax], edi
mov byte [eax + 4], 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x4431e0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5235c0
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push esi
push edi
mov eax, dword [0x56d484]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x14], ecx
mov ecx, dword [ebp + 0xc]
xor edi, edi
mov dword [ebp - 4], 0
mov eax, 0x811c9dc5
mov esi, ecx
lea edx, [ecx + 4]
cmp edx, ecx
sbb ebx, ebx
and ebx, 0xfffffffc
add ebx, 4
mov dword [ebp - 0x18], ebx
mov ebx, dword [ebp - 0x14]
cmp ecx, edx
ja 0x443259
mov ebx, dword [ebp - 0x18]
nop dword [eax + eax]
movzx ecx, byte [esi]
lea esi, [esi + 1]
xor ecx, eax
inc edi
imul eax, ecx, 0x1000193
cmp edi, ebx
jne 0x443240
mov ebx, dword [ebp - 0x14]
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebx + 0x18]
mov esi, dword [ebx + 4]
and edx, eax
mov eax, dword [ebx + 0xc]
mov dword [ebp + 0xc], edx
lea eax, [eax + edx*8]
mov edx, dword [eax]
cmp esi, edx
je 0x4432c0
mov esi, dword [eax + 4]
mov esi, dword [esi]
cmp esi, edx
je 0x4432c0
mov esi, dword [esi + 4]
mov eax, dword [ecx]
cmp eax, dword [esi + 8]
jne 0x443275
mov edx, dword [ebp + 0x10]
push 0xc
push edx
mov ecx, dword [edx + 4]
mov eax, dword [edx]
mov dword [ecx], eax
mov ecx, dword [edx]
mov eax, dword [edx + 4]
mov dword [ecx + 4], eax
dec dword [ebx + 8]
call fcn.004dc9b6
mov eax, dword [ebp + 8]
add esp, 8
mov dword [eax], esi
mov byte [eax + 4], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov edi, dword [ebp + 0x10]
mov dword [ebp - 0x18], edi
mov eax, dword [edi]
cmp esi, eax
je 0x4432ed
mov ecx, dword [edi + 4]
mov dword [ecx], eax
mov ecx, dword [eax + 4]
mov dword [ecx], esi
mov ecx, dword [esi + 4]
mov dword [ecx], edi
mov ecx, dword [eax + 4]
mov edx, dword [esi + 4]
mov dword [esi + 4], ecx
mov ecx, dword [edi + 4]
mov dword [eax + 4], ecx
mov dword [edi + 4], edx
mov eax, dword [ebx + 0xc]
mov edx, dword [ebp + 0xc]
lea ecx, [eax + edx*8]
mov eax, dword [ecx]
cmp eax, dword [ebx + 4]
jne 0x443308
mov dword [ecx], edi
mov eax, dword [ebx + 0xc]
mov dword [eax + edx*8 + 4], edi
jmp 0x44332b
cmp eax, esi
jne 0x443310
mov dword [ecx], edi
jmp 0x44332b
mov eax, dword [ecx + 4]
mov eax, dword [eax]
mov dword [ecx + 4], eax
cmp eax, edi
je 0x44332b
mov eax, dword [ebx + 0xc]
lea ecx, [eax + edx*8]
mov eax, dword [ecx + 4]
mov eax, dword [eax + 4]
mov dword [ecx + 4], eax
mov ecx, ebx
mov dword [ebp - 4], 2
call fcn.004643f0
mov eax, dword [ebp + 8]
mov dword [eax], edi
mov byte [eax + 4], 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x443380
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5235e0
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push ebx
push esi
push edi
mov eax, dword [0x56d484]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov ebx, ecx
mov dword [ebp - 0x1c], ebx
mov ecx, dword [ebp + 0xc]
mov dword [ebp - 4], 0
mov edi, dword [ecx]
imul esi, dword [ecx + 4], 0x1000193
imul eax, edi, 0x100011b
xor esi, eax
mov eax, dword [ebx + 0xc]
and esi, dword [ebx + 0x18]
mov dword [ebp + 0xc], esi
mov edx, dword [eax + esi*8]
cmp edx, dword [ebx + 4]
jne 0x4433e1
mov esi, dword [ebx + 4]
jmp 0x4433e7
mov esi, dword [eax + esi*8 + 4]
mov esi, dword [esi]
cmp esi, edx
je 0x443418
mov esi, dword [esi + 4]
cmp edi, dword [esi + 8]
jne 0x4433e7
mov eax, dword [ecx + 4]
cmp eax, dword [esi + 0xc]
jne 0x4433e7
mov eax, dword [ebp + 8]
mov dword [eax], esi
mov byte [eax + 4], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov eax, dword [ebx + 4]
push ecx
lea ecx, [ebx + 4]
mov dword [ebp - 4], 0xffffffff
mov eax, dword [eax]
mov dword [ebp - 0x14], eax
mov edx, dword [eax + 4]
push edx
push eax
mov dword [ebp - 0x18], edx
call fcn.00441ad0
mov edx, eax
mov ecx, 0xccccccb
mov eax, dword [ebx + 8]
sub ecx, eax
cmp ecx, 1
jb 0x443522
inc eax
mov dword [ebx + 8], eax
mov eax, dword [ebp - 0x14]
mov dword [eax + 4], edx
mov eax, dword [ebp - 0x18]
mov dword [eax], edx
mov ecx, dword [ebx + 4]
mov edi, dword [ecx]
mov dword [ebp - 0x18], edi
mov eax, dword [edi]
cmp esi, eax
je 0x44348e
mov ecx, dword [edi + 4]
mov dword [ecx], eax
mov ecx, dword [eax + 4]
mov dword [ecx], esi
mov ecx, dword [esi + 4]
mov dword [ecx], edi
mov ecx, dword [eax + 4]
mov edx, dword [esi + 4]
mov dword [esi + 4], ecx
mov ecx, dword [edi + 4]
mov dword [eax + 4], ecx
mov dword [edi + 4], edx
mov ecx, dword [ebx + 4]
mov eax, dword [ebx + 0xc]
mov edx, dword [ebp + 0xc]
lea edx, [eax + edx*8]
mov eax, dword [edx]
cmp eax, ecx
jne 0x4434ab
mov ecx, dword [ebp + 0xc]
mov dword [edx], edi
mov eax, dword [ebx + 0xc]
mov dword [eax + ecx*8 + 4], edi
jmp 0x4434d1
cmp eax, esi
jne 0x4434b3
mov dword [edx], edi
jmp 0x4434d1
mov eax, dword [edx + 4]
mov eax, dword [eax]
mov dword [edx + 4], eax
cmp eax, edi
je 0x4434d1
mov eax, dword [ebx + 0xc]
mov ecx, dword [ebp + 0xc]
lea ecx, [eax + ecx*8]
mov eax, dword [ecx + 4]
mov eax, dword [eax + 4]
mov dword [ecx + 4], eax
mov ecx, ebx
mov dword [ebp - 4], 2
call fcn.00464270
mov eax, dword [ebp + 8]
mov dword [eax], edi
mov byte [eax + 4], 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
push str.list_T__too_long
call fcn.004c4fa6
int3
Function at 0x443530
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x523600
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push ebx
push esi
push edi
mov eax, dword [0x56d484]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov ebx, ecx
mov dword [ebp - 0x18], ebx
mov edi, dword [ebp + 0xc]
xor edx, edx
mov dword [ebp - 4], 0
mov esi, dword [edi + 4]
mov al, byte [esi]
test al, al
je 0x443586
movsx eax, al
lea edx, [edx + edx*4]
add edx, eax
lea esi, [esi + 1]
mov al, byte [esi]
test al, al
jne 0x443575
imul eax, dword [edi], 0x1000193
mov esi, dword [ebx + 4]
xor eax, edx
and eax, dword [ebx + 0x18]
lea ecx, [eax*8]
mov dword [ebp - 0x14], ecx
add ecx, dword [ebx + 0xc]
mov eax, dword [ecx]
cmp eax, esi
je 0x4435ac
mov esi, dword [ecx + 4]
mov esi, dword [esi]
mov ecx, dword [edi]
nop
cmp esi, eax
je 0x44360a
mov esi, dword [esi + 4]
cmp ecx, dword [esi + 8]
jne 0x4435b0
mov ecx, dword [esi + 0xc]
mov edx, dword [edi + 4]
mov bl, byte [edx]
cmp bl, byte [ecx]
jne 0x4435e2
test bl, bl
je 0x4435de
mov bl, byte [edx + 1]
cmp bl, byte [ecx + 1]
jne 0x4435e2
add edx, 2
add ecx, 2
test bl, bl
jne 0x4435c2
xor ecx, ecx
jmp 0x4435e7
sbb ecx, ecx
or ecx, 1
test ecx, ecx
mov ecx, dword [edi]
jne 0x4435b0
mov eax, dword [ebp + 8]
mov dword [eax], esi
mov byte [eax + 4], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov ebx, dword [ebp - 0x18]
push dword [ebp + 0xc]
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebx + 4]
lea ecx, [ebx + 4]
mov edi, dword [eax]
mov eax, dword [edi + 4]
push eax
push edi
mov dword [ebp - 0x1c], eax
call fcn.00441ad0
mov edx, eax
mov ecx, 0xccccccb
mov eax, dword [ebx + 8]
sub ecx, eax
cmp ecx, 1
jb 0x44370d
inc eax
mov dword [ebx + 8], eax
mov eax, dword [ebp - 0x1c]
mov dword [edi + 4], edx
mov dword [eax], edx
mov ecx, dword [ebx + 4]
mov edi, dword [ecx]
mov dword [ebp + 0xc], edi
mov eax, dword [edi]
cmp esi, eax
je 0x44367f
mov ecx, dword [edi + 4]
mov dword [ecx], eax
mov ecx, dword [eax + 4]
mov dword [ecx], esi
mov ecx, dword [esi + 4]
mov dword [ecx], edi
mov ecx, dword [eax + 4]
mov edx, dword [esi + 4]
mov dword [esi + 4], ecx
mov ecx, dword [edi + 4]
mov dword [eax + 4], ecx
mov dword [edi + 4], edx
mov ecx, dword [ebx + 4]
mov edx, dword [ebp - 0x14]
add edx, dword [ebx + 0xc]
mov eax, dword [edx]
cmp eax, ecx
jne 0x443699
mov ecx, dword [ebp - 0x14]
mov dword [edx], edi
mov eax, dword [ebx + 0xc]
mov dword [ecx + eax + 4], edi
jmp 0x4436bc
cmp eax, esi
jne 0x4436a1
mov dword [edx], edi
jmp 0x4436bc
mov eax, dword [edx + 4]
mov eax, dword [eax]
mov dword [edx + 4], eax
cmp eax, edi
je 0x4436bc
mov ecx, dword [ebp - 0x14]
add ecx, dword [ebx + 0xc]
mov eax, dword [ecx + 4]
mov eax, dword [eax + 4]
mov dword [ecx + 4], eax
mov ecx, ebx
mov dword [ebp - 4], 2
call fcn.004642f0
mov eax, dword [ebp + 8]
mov dword [eax], edi
mov byte [eax + 4], 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
push str.list_T__too_long
call fcn.004c4fa6
int3
Function at 0x443720
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x523620
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push ebx
push esi
push edi
mov eax, dword [0x56d484]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov ebx, ecx
mov dword [ebp - 0x18], ebx
mov edi, dword [ebp + 0xc]
xor edx, edx
mov dword [ebp - 4], 0
mov esi, dword [edi + 4]
mov al, byte [esi]
test al, al
je 0x443776
movsx eax, al
lea edx, [edx + edx*4]
add edx, eax
lea esi, [esi + 1]
mov al, byte [esi]
test al, al
jne 0x443765
imul eax, dword [edi], 0x1000193
mov esi, dword [ebx + 4]
xor eax, edx
and eax, dword [ebx + 0x18]
lea ecx, [eax*8]
mov dword [ebp - 0x14], ecx
add ecx, dword [ebx + 0xc]
mov eax, dword [ecx]
cmp eax, esi
je 0x44379c
mov esi, dword [ecx + 4]
mov esi, dword [esi]
mov ecx, dword [edi]
nop
cmp esi, eax
je 0x4437fa
mov esi, dword [esi + 4]
cmp ecx, dword [esi + 8]
jne 0x4437a0
mov ecx, dword [esi + 0xc]
mov edx, dword [edi + 4]
mov bl, byte [edx]
cmp bl, byte [ecx]
jne 0x4437d2
test bl, bl
je 0x4437ce
mov bl, byte [edx + 1]
cmp bl, byte [ecx + 1]
jne 0x4437d2
add edx, 2
add ecx, 2
test bl, bl
jne 0x4437b2
xor ecx, ecx
jmp 0x4437d7
sbb ecx, ecx
or ecx, 1
test ecx, ecx
mov ecx, dword [edi]
jne 0x4437a0
mov eax, dword [ebp + 8]
mov dword [eax], esi
mov byte [eax + 4], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov ebx, dword [ebp - 0x18]
push dword [ebp + 0xc]
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebx + 4]
lea ecx, [ebx + 4]
mov edi, dword [eax]
mov eax, dword [edi + 4]
push eax
push edi
mov dword [ebp - 0x1c], eax
call fcn.00441b30
mov edx, eax
mov ecx, 0xaaaaaa9
mov eax, dword [ebx + 8]
sub ecx, eax
cmp ecx, 1
jb 0x4438fd
inc eax
mov dword [ebx + 8], eax
mov eax, dword [ebp - 0x1c]
mov dword [edi + 4], edx
mov dword [eax], edx
mov ecx, dword [ebx + 4]
mov edi, dword [ecx]
mov dword [ebp + 0xc], edi
mov eax, dword [edi]
cmp esi, eax
je 0x44386f
mov ecx, dword [edi + 4]
mov dword [ecx], eax
mov ecx, dword [eax + 4]
mov dword [ecx], esi
mov ecx, dword [esi + 4]
mov dword [ecx], edi
mov ecx, dword [eax + 4]
mov edx, dword [esi + 4]
mov dword [esi + 4], ecx
mov ecx, dword [edi + 4]
mov dword [eax + 4], ecx
mov dword [edi + 4], edx
mov ecx, dword [ebx + 4]
mov edx, dword [ebp - 0x14]
add edx, dword [ebx + 0xc]
mov eax, dword [edx]
cmp eax, ecx
jne 0x443889
mov ecx, dword [ebp - 0x14]
mov dword [edx], edi
mov eax, dword [ebx + 0xc]
mov dword [ecx + eax + 4], edi
jmp 0x4438ac
cmp eax, esi
jne 0x443891
mov dword [edx], edi
jmp 0x4438ac
mov eax, dword [edx + 4]
mov eax, dword [eax]
mov dword [edx + 4], eax
cmp eax, edi
je 0x4438ac
mov ecx, dword [ebp - 0x14]
add ecx, dword [ebx + 0xc]
mov eax, dword [ecx + 4]
mov eax, dword [eax + 4]
mov dword [ecx + 4], eax
mov ecx, ebx
mov dword [ebp - 4], 2
call fcn.00464370
mov eax, dword [ebp + 8]
mov dword [eax], edi
mov byte [eax + 4], 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
push str.list_T__too_long
call fcn.004c4fa6
int3
Function at 0x443ed0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5236a0
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push esi
push edi
mov eax, dword [0x56d484]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x14], ecx
mov ebx, dword [ebp + 0xc]
mov edx, ebx
mov dword [ebp - 4], 0
cmp dword [ebx + 0x14], 0x10
mov edi, dword [ebx + 0x10]
jb 0x443f15
mov edx, dword [ebx]
lea ecx, [edx + edi]
xor esi, esi
cmp edx, ecx
mov eax, 0x811c9dc5
cmova edi, esi
test edi, edi
je 0x443f3b
movzx ecx, byte [edx]
lea edx, [edx + 1]
xor ecx, eax
inc esi
imul eax, ecx, 0x1000193
cmp esi, edi
jne 0x443f28
mov edx, dword [ebp - 0x14]
mov ecx, dword [edx + 0x18]
mov esi, dword [edx + 4]
and ecx, eax
mov eax, dword [edx + 0xc]
shl ecx, 3
mov dword [ebp + 0xc], ecx
mov edi, dword [ecx + eax]
cmp esi, edi
je 0x443fcf
mov esi, dword [ecx + eax + 4]
mov esi, dword [esi]
nop dword [eax]
cmp esi, edi
je 0x443fcf
mov esi, dword [esi + 4]
cmp dword [esi + 0x1c], 0x10
lea edx, [esi + 8]
jb 0x443f73
mov edx, dword [esi + 8]
cmp dword [ebx + 0x14], 0x10
mov ecx, ebx
jb 0x443f7d
mov ecx, dword [ebx]
push dword [esi + 0x18]
push edx
push dword [ebx + 0x10]
push ecx
call fcn.004118e6
add esp, 0x10
test al, al
je 0x443f60
mov edi, dword [ebp + 0x10]
mov ecx, dword [ebp - 0x14]
add ecx, 4
push edi
mov edx, dword [edi + 4]
mov eax, dword [edi]
mov dword [edx], eax
mov edx, dword [edi]
mov eax, dword [edi + 4]
mov dword [edx + 4], eax
dec dword [ecx + 4]
call fcn.00464990
mov eax, dword [ebp + 8]
mov dword [eax], esi
mov byte [eax + 4], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov edi, dword [ebp + 0x10]
mov dword [ebp - 0x18], edi
mov eax, dword [edi]
cmp esi, eax
je 0x443ffc
mov ecx, dword [edi + 4]
mov dword [ecx], eax
mov ecx, dword [eax + 4]
mov dword [ecx], esi
mov ecx, dword [esi + 4]
mov dword [ecx], edi
mov ecx, dword [eax + 4]
mov edx, dword [esi + 4]
mov dword [esi + 4], ecx
mov ecx, dword [edi + 4]
mov dword [eax + 4], ecx
mov dword [edi + 4], edx
mov edx, dword [ebp - 0x14]
mov ebx, dword [ebp + 0xc]
mov ecx, dword [edx + 0xc]
add ecx, ebx
mov eax, dword [ecx]
cmp eax, dword [edx + 4]
jne 0x444019
mov dword [ecx], edi
mov eax, dword [edx + 0xc]
mov dword [ebx + eax + 4], edi
jmp 0x44403b
cmp eax, esi
jne 0x444021
mov dword [ecx], edi
jmp 0x44403b
mov eax, dword [ecx + 4]
mov eax, dword [eax]
mov dword [ecx + 4], eax
cmp eax, edi
je 0x44403b
mov ecx, dword [edx + 0xc]
mov eax, dword [ecx + ebx + 4]
mov eax, dword [eax + 4]
mov dword [ecx + ebx + 4], eax
mov ecx, edx
mov dword [ebp - 4], 2
call fcn.00464470
mov eax, dword [ebp + 8]
mov dword [eax], edi
mov byte [eax + 4], 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x446b30
Capabilities:
Hash data using fnv

Disassembly:
mov eax, dword [esp + 8]
push esi
push edi
mov edi, ecx
imul edx, dword [eax + 8], 0x100011b
imul esi, dword [eax + 0xc], 0x1000193
mov ecx, dword [edi + 0xc]
xor esi, edx
and esi, dword [edi + 0x18]
lea edx, [ecx + esi*8]
mov ecx, dword [edx]
cmp dword [edx + 4], eax
jne 0x446b75
cmp ecx, eax
jne 0x446b6d
mov ecx, dword [edi + 4]
mov dword [edx], ecx
mov edx, dword [edi + 0xc]
mov ecx, dword [edi + 4]
mov dword [edx + esi*8 + 4], ecx
jmp 0x446b7d
mov ecx, dword [eax + 4]
mov dword [edx + 4], ecx
jmp 0x446b7d
cmp ecx, eax
jne 0x446b7d
mov ecx, dword [eax]
mov dword [edx], ecx
mov ecx, dword [eax + 4]
mov esi, dword [eax]
push 0x14
push eax
mov dword [ecx], esi
mov edx, dword [eax]
mov ecx, dword [eax + 4]
mov dword [edx + 4], ecx
dec dword [edi + 8]
call fcn.004dc9b6
mov eax, dword [esp + 0x14]
add esp, 8
pop edi
mov dword [eax], esi
pop esi
ret 8

Function at 0x446bb0
Capabilities:
Hash data using fnv

Disassembly:
mov eax, dword [esp + 8]
xor edx, edx
push ebx
push esi
push edi
mov esi, dword [eax + 0xc]
mov edi, ecx
mov bl, byte [esi]
test bl, bl
je 0x446bd5
movsx ecx, bl
lea esi, [esi + 1]
mov bl, byte [esi]
lea edx, [edx + edx*4]
add edx, ecx
test bl, bl
jne 0x446bc4
imul ecx, dword [eax + 8], 0x1000193
xor ecx, edx
mov edx, dword [edi + 0xc]
and ecx, dword [edi + 0x18]
lea esi, [ecx*8]
mov ecx, dword [edx + esi]
add edx, esi
cmp dword [edx + 4], eax
jne 0x446c12
cmp ecx, eax
jne 0x446c0a
mov ecx, dword [edi + 4]
mov dword [edx], ecx
mov edx, dword [edi + 0xc]
mov ecx, dword [edi + 4]
mov dword [esi + edx + 4], ecx
jmp 0x446c1a
mov ecx, dword [eax + 4]
mov dword [edx + 4], ecx
jmp 0x446c1a
cmp ecx, eax
jne 0x446c1a
mov ecx, dword [eax]
mov dword [edx], ecx
mov ecx, dword [eax + 4]
mov esi, dword [eax]
push 0x14
push eax
mov dword [ecx], esi
mov edx, dword [eax]
mov ecx, dword [eax + 4]
mov dword [edx + 4], ecx
dec dword [edi + 8]
call fcn.004dc9b6
mov eax, dword [esp + 0x18]
add esp, 8
pop edi
mov dword [eax], esi
pop esi
pop ebx
ret 8

Function at 0x446c50
Capabilities:
Hash data using fnv

Disassembly:
mov eax, dword [esp + 8]
xor edx, edx
push ebx
push esi
push edi
mov esi, dword [eax + 0xc]
mov edi, ecx
mov bl, byte [esi]
test bl, bl
je 0x446c75
movsx ecx, bl
lea esi, [esi + 1]
mov bl, byte [esi]
lea edx, [edx + edx*4]
add edx, ecx
test bl, bl
jne 0x446c64
imul ecx, dword [eax + 8], 0x1000193
xor ecx, edx
mov edx, dword [edi + 0xc]
and ecx, dword [edi + 0x18]
lea esi, [ecx*8]
mov ecx, dword [edx + esi]
add edx, esi
cmp dword [edx + 4], eax
jne 0x446cb2
cmp ecx, eax
jne 0x446caa
mov ecx, dword [edi + 4]
mov dword [edx], ecx
mov edx, dword [edi + 0xc]
mov ecx, dword [edi + 4]
mov dword [esi + edx + 4], ecx
jmp 0x446cba
mov ecx, dword [eax + 4]
mov dword [edx + 4], ecx
jmp 0x446cba
cmp ecx, eax
jne 0x446cba
mov ecx, dword [eax]
mov dword [edx], ecx
mov ecx, dword [eax + 4]
mov esi, dword [eax]
push 0x18
push eax
mov dword [ecx], esi
mov edx, dword [eax]
mov ecx, dword [eax + 4]
mov dword [edx + 4], ecx
dec dword [edi + 8]
call fcn.004dc9b6
mov eax, dword [esp + 0x18]
add esp, 8
pop edi
mov dword [eax], esi
pop esi
pop ebx
ret 8