joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40f660
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x49d697
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
push ebx
mov ebx, ecx
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x10], 0
push esi
mov dword [ebx], 0x4d13f4
mov dword [ebx + 0x10], 0x4d1394
push edi
mov dword [ebx + 0x68], vtable.std::basic_ios_char__struct_std::char_traits_char__.0
push ecx
lea edi, [ebx + 0x18]
mov dword [ebp - 4], 0
push edi
mov dword [ebp - 0x10], 1
call fcn.00408670
mov dword [ebp - 4], 1
mov eax, dword [ebx]
push 8
mov eax, dword [eax + 4]
mov dword [ebx + eax], vtable.std::basic_stringstream_char__struct_std::char_traits_char___class_std::allocator_char__.0
mov eax, dword [ebx]
mov ecx, dword [eax + 4]
lea eax, [ecx - 0x68]
mov dword [ecx + ebx - 4], eax
mov dword [edi], vtable.std::basic_streambuf_char__struct_std::char_traits_char__.0
call fcn.00460943
add esp, 4
mov esi, eax
push 1
mov byte [ebp - 4], 2
call fcn.0045da39
mov dword [esi + 4], eax
lea ecx, [edi + 8]
lea eax, [edi + 4]
mov dword [edi + 0x34], esi
mov dword [edi + 0xc], eax
add esp, 4
lea eax, [edi + 0x14]
mov dword [edi + 0x10], ecx
mov dword [edi + 0x1c], eax
lea eax, [edi + 0x18]
mov dword [edi + 0x20], eax
lea eax, [edi + 0x24]
mov dword [edi + 0x2c], eax
lea eax, [edi + 0x28]
mov dword [edi + 0x30], eax
mov dword [ecx], 0
mov eax, dword [edi + 0x20]
mov ecx, dword [ebp - 0xc]
mov dword [eax], 0
mov eax, dword [edi + 0x30]
mov dword [eax], 0
mov eax, dword [edi + 0xc]
mov dword [eax], 0
mov eax, dword [edi + 0x1c]
mov dword [eax], 0
mov eax, dword [edi + 0x2c]
mov dword [eax], 0
mov eax, ebx
mov dword [edi], vtable.std::basic_stringbuf_char__struct_std::char_traits_char___class_std::allocator_char__.0
mov dword [edi + 0x38], 0
mov dword [edi + 0x3c], 0
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x410070
Capabilities:
Hash data using fnv

Disassembly:
push esi
mov esi, dword [esp + 8]
push edi
mov edi, ecx
movzx eax, byte [esi]
xor eax, 0x811c9dc5
imul edx, eax, 0x1000193
movzx eax, byte [esi + 1]
xor edx, eax
movzx eax, byte [esi + 2]
imul edx, edx, 0x1000193
xor edx, eax
movzx eax, byte [esi + 3]
imul ecx, edx, 0x1000193
xor ecx, eax
movzx eax, byte [esi + 4]
imul ecx, ecx, 0x1000193
xor ecx, eax
movzx eax, byte [esi + 5]
imul ecx, ecx, 0x1000193
xor ecx, eax
movzx eax, byte [esi + 6]
imul ecx, ecx, 0x1000193
xor ecx, eax
movzx eax, byte [esi + 7]
imul ecx, ecx, 0x1000193
xor ecx, eax
mov eax, dword [edi + 0x18]
imul ecx, ecx, 0x1000193
pop edi
pop esi
and eax, ecx
ret 4
Function at 0x412060
Capabilities:
Encode data using xor

Disassembly:
push ecx
push ebx
push ebp
mov eax, ecx
mov ebx, 1
push esi
mov esi, dword [esp + 0x18]
push edi
mov edi, dword [esp + 0x18]
lea ebp, [eax + 0x10]
mov dword [esp + 0x10], eax
mov dword [eax + 8], edi
mov dword [eax + 0xc], esi
push 0x5851f42d
xor eax, eax
mov ecx, esi
push 0x4c957f2d
shr ecx, 0x1e
xor eax, esi
xor ecx, edi
push eax
push ecx
call fcn.00461370
mov edi, eax
lea ebp, [ebp + 8]
mov eax, ebx
mov esi, edx
cdq
add edi, eax
mov dword [ebp - 8], edi
adc esi, edx
inc ebx
mov dword [ebp - 4], esi
cmp ebx, 0x138
jl 0x412081
mov eax, dword [esp + 0x10]
pop edi
pop esi
pop ebp
mov dword [eax], 0x138
pop ebx
pop ecx
ret 0x10
Function at 0x4181b0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push esi
mov esi, dword [esp + 0xc]
mov edx, 0x811c9dc5
push edi
mov edi, dword [esp + 0xc]
mov ecx, 0
sub esi, edi
je 0x4181d9
movzx eax, byte [ecx + edi]
inc ecx
xor eax, edx
imul edx, eax, 0x1000193
cmp ecx, esi
jb 0x4181c8
pop edi
mov eax, edx
pop esi
ret 8

Function at 0x419d50
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x49e020
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xc
push ebx
push esi
mov dword [ebp - 4], 0
push edi
mov edi, dword [ebp + 0xc]
mov esi, edi
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x18], 0x5d1850
cmp dword [edi + 0x14], 0x10
mov ebx, dword [edi + 0x10]
jb 0x419d8f
mov esi, dword [edi]
xor ecx, ecx
mov edx, 0x811c9dc5
test ebx, ebx
je 0x419db1
nop word [eax + eax]
movzx eax, byte [ecx + esi]
inc ecx
xor eax, edx
imul edx, eax, 0x1000193
cmp ecx, ebx
jb 0x419da0
and edx, dword [0x5d1868]
mov eax, dword [0x5d1854]
lea ecx, [edx*8]
mov edx, dword [0x5d185c]
mov dword [ebp + 0xc], ecx
mov dword [ebp - 0x14], edx
cmp dword [ecx + edx], eax
jne 0x419dd8
mov esi, eax
jmp 0x419de0
mov esi, dword [ecx + edx + 4]
mov esi, dword [esi]
nop
cmp esi, dword [ecx + edx]
je 0x419e4d
mov esi, dword [esi + 4]
cmp dword [esi + 0x1c], 0x10
lea eax, [esi + 8]
mov edx, dword [eax + 0x10]
jb 0x419df6
mov eax, dword [eax]
cmp dword [edi + 0x14], 0x10
mov ecx, edi
jb 0x419e00
mov ecx, dword [edi]
push edx
push eax
mov edx, ebx
call fcn.00419310
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp - 0x14]
test al, al
je 0x419de0
mov edx, dword [ebp + 0x10]
push edx
mov ecx, dword [edx + 4]
mov eax, dword [edx]
mov dword [ecx], eax
mov ecx, dword [edx]
mov eax, dword [edx + 4]
mov dword [ecx + 4], eax
dec dword [0x5d1858]
call fcn.00418140
mov eax, dword [ebp + 8]
mov dword [eax], esi
mov byte [eax + 4], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov edi, dword [ebp + 0x10]
mov dword [ebp - 0x14], edi
mov eax, dword [edi]
cmp esi, eax
je 0x419e83
mov ecx, dword [edi + 4]
mov dword [ecx], eax
mov ecx, dword [eax + 4]
mov dword [ecx], esi
mov ecx, dword [esi + 4]
mov dword [ecx], edi
mov edx, dword [esi + 4]
mov ecx, dword [eax + 4]
mov dword [esi + 4], ecx
mov ecx, dword [edi + 4]
mov dword [eax + 4], ecx
mov ecx, dword [ebp + 0xc]
mov dword [edi + 4], edx
mov edx, dword [0x5d185c]
mov eax, dword [ecx + edx]
cmp eax, dword [0x5d1854]
jne 0x419e9c
mov dword [ecx + edx], edi
mov eax, dword [0x5d185c]
mov dword [ecx + eax + 4], edi
jmp 0x419ec4
cmp eax, esi
jne 0x419ea5
mov dword [ecx + edx], edi
jmp 0x419ec4
mov eax, dword [ecx + edx + 4]
mov eax, dword [eax]
mov dword [ecx + edx + 4], eax
cmp eax, edi
je 0x419ec4
mov edx, dword [0x5d185c]
mov eax, dword [edx + ecx + 4]
mov eax, dword [eax + 4]
mov dword [edx + ecx + 4], eax
mov ecx, 0x5d1850
mov dword [ebp - 4], 2
call fcn.0041a0a0
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
mov dword [eax], edi
pop edi
pop esi
mov byte [eax + 4], 1
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x41b470
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x49e060
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xc
push ebx
push esi
push edi
mov dword [ebp - 4], 0
mov ebx, ecx
mov edi, dword [ebp + 0xc]
mov esi, edi
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x18], ebx
cmp dword [edi + 0x14], 0x10
jb 0x41b4aa
mov esi, dword [edi]
xor ecx, ecx
mov edx, 0x811c9dc5
cmp dword [edi + 0x10], ecx
jbe 0x41b4c8
movzx eax, byte [ecx + esi]
inc ecx
xor eax, edx
imul edx, eax, 0x1000193
cmp ecx, dword [edi + 0x10]
jb 0x41b4b6
mov eax, dword [ebx + 0x18]
mov esi, dword [ebx + 4]
and eax, edx
lea edx, [eax*8]
mov eax, dword [ebx + 0xc]
add eax, edx
mov dword [ebp - 0x14], edx
mov dword [ebp + 0xc], eax
cmp esi, dword [eax]
je 0x41b557
mov esi, dword [eax + 4]
mov esi, dword [esi]
nop dword [eax + eax]
cmp esi, dword [eax]
je 0x41b557
mov esi, dword [esi + 4]
cmp dword [esi + 0x1c], 0x10
lea eax, [esi + 8]
mov edx, dword [eax + 0x10]
jb 0x41b505
mov eax, dword [eax]
cmp dword [edi + 0x14], 0x10
mov ecx, edi
jb 0x41b50f
mov ecx, dword [edi]
push edx
mov edx, dword [edi + 0x10]
push eax
call fcn.00419310
test al, al
mov eax, dword [ebp + 0xc]
je 0x41b4f0
mov edx, dword [ebp + 0x10]
push edx
mov ecx, dword [edx + 4]
mov eax, dword [edx]
mov dword [ecx], eax
mov ecx, dword [edx]
mov eax, dword [edx + 4]
mov dword [ecx + 4], eax
dec dword [ebx + 8]
call fcn.00418140
mov eax, dword [ebp + 8]
mov dword [eax], esi
mov byte [eax + 4], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov edi, dword [ebp + 0x10]
mov dword [ebp + 0xc], edi
mov eax, dword [edi]
cmp esi, eax
je 0x41b584
mov ecx, dword [edi + 4]
mov dword [ecx], eax
mov ecx, dword [eax + 4]
mov dword [ecx], esi
mov ecx, dword [esi + 4]
mov dword [ecx], edi
mov ecx, dword [eax + 4]
mov edx, dword [esi + 4]
mov dword [esi + 4], ecx
mov ecx, dword [edi + 4]
mov dword [eax + 4], ecx
mov dword [edi + 4], edx
mov ecx, dword [ebx + 0xc]
mov edx, dword [ebp - 0x14]
add ecx, edx
mov eax, dword [ecx]
cmp eax, dword [ebx + 4]
jne 0x41b59e
mov dword [ecx], edi
mov eax, dword [ebx + 0xc]
mov dword [eax + edx + 4], edi
jmp 0x41b5c0
cmp eax, esi
jne 0x41b5a6
mov dword [ecx], edi
jmp 0x41b5c0
mov eax, dword [ecx + 4]
mov eax, dword [eax]
mov dword [ecx + 4], eax
cmp eax, edi
je 0x41b5c0
mov ecx, dword [ebx + 0xc]
mov eax, dword [ecx + edx + 4]
mov eax, dword [eax + 4]
mov dword [ecx + edx + 4], eax
mov ecx, ebx
mov dword [ebp - 4], 2
call fcn.0041a0a0
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
mov dword [eax], edi
pop edi
pop esi
mov byte [eax + 4], 1
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x428a30
Capabilities:
Hash data using fnv

Disassembly:
sub esp, 0x1c
push ebx
push ebp
mov ebp, ecx
push esi
push edi
mov edx, dword [ebp + 0x28]
mov dword [ebp + 0x89c], 0
test edx, edx
je 0x428c0c
mov eax, dword [ebp + 0x890]
xor ecx, ecx
mov dword [esp + 0x18], 0
mov dword [esp + 0x1c], ecx
mov eax, dword [eax + 0xc]
mov dword [esp + 0x20], eax
nop dword [eax]
mov eax, dword [ebp + 0x890]
add eax, ecx
mov dword [esp + 0x14], eax
mov ebx, dword [eax]
mov ecx, ebx
mov esi, dword [eax + 4]
mov eax, esi
shrd ecx, eax, 8
movzx eax, bl
xor eax, 0x811c9dc5
movzx ecx, cl
imul eax, eax, 0x1000193
mov dword [esp + 0x28], esi
mov dword [esp + 0x24], ebx
xor ecx, eax
mov eax, esi
imul edx, ecx, 0x1000193
mov ecx, ebx
shrd ecx, eax, 0x10
movzx eax, cl
xor edx, eax
mov eax, ebx
mov ebx, dword [esp + 0x34]
shrd eax, esi, 0x18
imul ecx, edx, 0x1000193
movzx eax, al
mov esi, dword [ebx + 4]
xor ecx, eax
imul eax, ecx, 0x1000193
mov ecx, dword [ebx + 0x18]
and ecx, eax
mov eax, dword [ebx + 0xc]
mov edi, dword [eax + ecx*8]
lea ebx, [eax + ecx*8]
mov edx, edi
cmp edi, esi
jne 0x428aed
mov eax, esi
jmp 0x428af2
mov eax, dword [ebx + 4]
mov eax, dword [eax]
cmp edx, eax
je 0x428b23
lea eax, [esp + 0x24]
push eax
lea eax, [edx + 8]
push eax
call fcn.00428200
test al, al
jne 0x428b0c
mov edx, dword [edx]
jmp 0x428ae5
lea eax, [edx + 8]
push eax
lea eax, [esp + 0x28]
push eax
call fcn.00428200
test al, al
mov ecx, esi
cmovne ecx, edx
jmp 0x428b25
mov ecx, esi
cmp ecx, esi
jne 0x428be1
mov ebx, dword [esp + 0x30]
mov eax, dword [esp + 0x14]
cmp dword [ebx + 8], 0
je 0x428bd3
mov edx, dword [eax]
movzx eax, dl
xor eax, 0x811c9dc5
mov esi, dword [ebx + 4]
imul ecx, eax, 0x1000193
movzx eax, dh
xor ecx, eax
movzx eax, byte [esp + 0x26]
imul ecx, ecx, 0x1000193
xor ecx, eax
movzx eax, byte [esp + 0x27]
imul ecx, ecx, 0x1000193
xor ecx, eax
imul eax, ecx, 0x1000193
mov ecx, dword [ebx + 0x18]
and ecx, eax
mov eax, dword [ebx + 0xc]
mov edi, dword [eax + ecx*8]
lea ebx, [eax + ecx*8]
mov edx, edi
cmp edi, esi
jne 0x428b8f
mov eax, esi
jmp 0x428b94
mov eax, dword [ebx + 4]
mov eax, dword [eax]
cmp edx, eax
je 0x428bca
lea eax, [esp + 0x24]
push eax
lea eax, [edx + 8]
push eax
call fcn.00428200
test al, al
jne 0x428bae
mov edx, dword [edx]
jmp 0x428b87
lea eax, [edx + 8]
push eax
lea eax, [esp + 0x28]
push eax
call fcn.00428200
test al, al
mov ecx, esi
cmovne ecx, edx
cmp ecx, esi
sete al
jmp 0x428bdd
mov ecx, esi
cmp ecx, esi
sete al
jmp 0x428bdd
mov ecx, dword [esp + 0x20]
cmp dword [eax + 0xc], ecx
setl al
test al, al
je 0x428bef
mov eax, dword [esp + 0x14]
or byte [eax + 6], 2
inc dword [ebp + 0x89c]
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x1c]
inc eax
add ecx, 0x18
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], ecx
cmp eax, dword [ebp + 0x28]
jb 0x428a70
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x1c
ret 8
Function at 0x42f6f0
Capabilities:
Access peb ldr_data
Get number of processors

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x49e80b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push esi
mov esi, ecx
mov dword [ebp - 0x10], esi
lea ecx, [esi + 0x14]
push 6
push str.syzygy
mov dword [esi], 1
mov dword [esi + 4], 0x2000000
mov byte [esi + 8], 1
mov dword [esi + 0xc], 0xfffffe0c
mov byte [esi + 0x10], 0
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 0xf
mov byte [ecx], 0
call fcn.00404920
mov dword [ebp - 4], 0
lea ecx, [esi + 0x44]
mov byte [esi + 0x2c], 1
mov dword [esi + 0x30], 4
mov dword [esi + 0x34], 0x64
mov dword [esi + 0x38], 1
mov dword [esi + 0x3c], 1
mov word [esi + 0x40], 1
push 0
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 0xf
push 0x4b0378
mov byte [ecx], 0
call fcn.00404920
mov ecx, dword [ebp - 0xc]
mov eax, esi
mov dword [esi + 0x5c], 0x1e
mov dword [esi + 0x60], 0xa
mov dword [esi + 0x64], 4
mov dword [esi + 0x68], 0x500
pop esi
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
Function at 0x43f560
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x49f610
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x14
mov dword [ebp - 4], 0
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
mov ebx, ecx
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x1c], ebx
movzx eax, byte [edi]
xor eax, 0x811c9dc5
mov esi, dword [ebx + 4]
imul edx, eax, 0x1000193
movzx eax, byte [edi + 1]
xor edx, eax
movzx eax, byte [edi + 2]
imul ecx, edx, 0x1000193
mov edx, dword [ebx + 0xc]
xor ecx, eax
movzx eax, byte [edi + 3]
imul ecx, ecx, 0x1000193
xor ecx, eax
imul eax, ecx, 0x1000193
mov ecx, dword [ebx + 0x18]
and ecx, eax
shl ecx, 3
add edx, ecx
mov dword [ebp + 0xc], ecx
cmp esi, dword [edx]
je 0x43f611
mov esi, dword [edx + 4]
mov esi, dword [esi]
nop
cmp esi, dword [edx]
je 0x43f611
mov esi, dword [esi + 4]
lea eax, [esi + 8]
push eax
push edi
call fcn.00428200
test al, al
je 0x43f5e0
mov eax, dword [ebp + 8]
mov dword [eax], esi
mov byte [eax + 4], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebx + 4]
push edi
mov eax, dword [eax]
mov dword [ebp - 0x14], eax
mov ecx, dword [eax + 4]
push ecx
push eax
mov dword [ebp - 0x18], ecx
call fcn.00410180
mov edx, eax
mov ecx, 0xffffffe
mov eax, dword [ebx + 8]
sub ecx, eax
cmp ecx, 1
jb 0x43f70e
inc eax
mov dword [ebx + 8], eax
mov eax, dword [ebp - 0x14]
mov dword [eax + 4], edx
mov eax, dword [ebp - 0x18]
mov dword [eax], edx
mov ecx, dword [ebx + 4]
mov edi, dword [ecx]
mov dword [ebp - 0x18], edi
mov eax, dword [edi]
cmp esi, eax
je 0x43f684
mov ecx, dword [edi + 4]
mov dword [ecx], eax
mov ecx, dword [eax + 4]
mov dword [ecx], esi
mov ecx, dword [esi + 4]
mov dword [ecx], edi
mov ecx, dword [eax + 4]
mov edx, dword [esi + 4]
mov dword [esi + 4], ecx
mov ecx, dword [edi + 4]
mov dword [eax + 4], ecx
mov dword [edi + 4], edx
mov ecx, dword [ebx + 4]
mov edx, dword [ebp + 0xc]
add edx, dword [ebx + 0xc]
mov eax, dword [edx]
cmp eax, ecx
jne 0x43f69e
mov ecx, dword [ebp + 0xc]
mov dword [edx], edi
mov eax, dword [ebx + 0xc]
mov dword [ecx + eax + 4], edi
jmp 0x43f6c1
cmp eax, esi
jne 0x43f6a6
mov dword [edx], edi
jmp 0x43f6c1
mov eax, dword [edx + 4]
mov eax, dword [eax]
mov dword [edx + 4], eax
cmp eax, edi
je 0x43f6c1
mov ecx, dword [ebp + 0xc]
add ecx, dword [ebx + 0xc]
mov eax, dword [ecx + 4]
mov eax, dword [eax + 4]
mov dword [ecx + 4], eax
mov ecx, ebx
mov dword [ebp - 4], 2
call fcn.0043f910
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
mov dword [eax], edi
pop edi
pop esi
mov byte [eax + 4], 1
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret 0xc
push str.list_T__too_long
call fcn.0045de8a
int3
Function at 0x43f9b0
Capabilities:
Hash data using fnv

Disassembly:
push ebx
push esi
push edi
mov edi, dword [esp + 0x14]
mov ebx, ecx
movzx eax, byte [edi + 8]
xor eax, 0x811c9dc5
imul edx, eax, 0x1000193
movzx eax, byte [edi + 9]
xor edx, eax
movzx eax, byte [edi + 0xa]
imul edx, edx, 0x1000193
xor edx, eax
movzx eax, byte [edi + 0xb]
imul ecx, edx, 0x1000193
xor ecx, eax
imul eax, ecx, 0x1000193
mov ecx, dword [ebx + 0x18]
and ecx, eax
lea edx, [ecx*8]
mov ecx, dword [ebx + 0xc]
add ecx, edx
mov eax, dword [ecx]
cmp dword [ecx + 4], edi
jne 0x43fa21
cmp eax, edi
jne 0x43fa19
mov eax, dword [ebx + 4]
mov dword [ecx], eax
mov ecx, dword [ebx + 0xc]
mov eax, dword [ebx + 4]
mov dword [edx + ecx + 4], eax
jmp 0x43fa29
mov eax, dword [edi + 4]
mov dword [ecx + 4], eax
jmp 0x43fa29
cmp eax, edi
jne 0x43fa2d
mov eax, dword [edi]
mov dword [ecx], eax
mov edi, dword [esp + 0x14]
mov eax, dword [edi + 4]
mov esi, dword [edi]
push 0x10
push edi
mov dword [eax], esi
mov ecx, dword [edi]
mov eax, dword [edi + 4]
mov dword [ecx + 4], eax
dec dword [ebx + 8]
call fcn.00460bf0
mov eax, dword [esp + 0x18]
add esp, 8
pop edi
mov dword [eax], esi
pop esi
pop ebx
ret 8
Function at 0x43fc70
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x49f630
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xc
mov dword [ebp - 4], 0
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
mov ebx, ecx
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x18], ebx
movzx eax, byte [edi]
xor eax, 0x811c9dc5
mov esi, dword [ebx + 4]
imul edx, eax, 0x1000193
movzx eax, byte [edi + 1]
xor edx, eax
movzx eax, byte [edi + 2]
imul ecx, edx, 0x1000193
mov edx, dword [ebx + 0xc]
xor ecx, eax
movzx eax, byte [edi + 3]
imul ecx, ecx, 0x1000193
xor ecx, eax
imul eax, ecx, 0x1000193
mov ecx, dword [ebx + 0x18]
and ecx, eax
shl ecx, 3
add edx, ecx
mov dword [ebp + 0xc], ecx
cmp esi, dword [edx]
je 0x43fd41
mov esi, dword [edx + 4]
mov esi, dword [esi]
nop
cmp esi, dword [edx]
je 0x43fd41
mov esi, dword [esi + 4]
lea eax, [esi + 8]
push eax
push edi
call fcn.00428200
test al, al
je 0x43fcf0
mov edx, dword [ebp + 0x10]
push 0x10
push edx
mov ecx, dword [edx + 4]
mov eax, dword [edx]
mov dword [ecx], eax
mov ecx, dword [edx]
mov eax, dword [edx + 4]
mov dword [ecx + 4], eax
dec dword [ebx + 8]
call fcn.00460bf0
mov eax, dword [ebp + 8]
add esp, 8
mov dword [eax], esi
mov byte [eax + 4], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov edi, dword [ebp + 0x10]
mov dword [ebp - 0x14], edi
mov eax, dword [edi]
cmp esi, eax
je 0x43fd6e
mov ecx, dword [edi + 4]
mov dword [ecx], eax
mov ecx, dword [eax + 4]
mov dword [ecx], esi
mov ecx, dword [esi + 4]
mov dword [ecx], edi
mov ecx, dword [eax + 4]
mov edx, dword [esi + 4]
mov dword [esi + 4], ecx
mov ecx, dword [edi + 4]
mov dword [eax + 4], ecx
mov dword [edi + 4], edx
mov ecx, dword [ebx + 0xc]
mov edx, dword [ebp + 0xc]
add ecx, edx
mov eax, dword [ecx]
cmp eax, dword [ebx + 4]
jne 0x43fd88
mov dword [ecx], edi
mov eax, dword [ebx + 0xc]
mov dword [edx + eax + 4], edi
jmp 0x43fdaa
cmp eax, esi
jne 0x43fd90
mov dword [ecx], edi
jmp 0x43fdaa
mov eax, dword [ecx + 4]
mov eax, dword [eax]
mov dword [ecx + 4], eax
cmp eax, edi
je 0x43fdaa
mov ecx, dword [ebx + 0xc]
mov eax, dword [ecx + edx + 4]
mov eax, dword [eax + 4]
mov dword [ecx + edx + 4], eax
mov ecx, ebx
mov dword [ebp - 4], 2
call fcn.0043f910
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
mov dword [eax], edi
pop edi
pop esi
mov byte [eax + 4], 1
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x45d0a0
Capabilities:
Create thread

Disassembly:
push ecx
push esi
mov esi, ecx
lea eax, [esi + 4]
mov dword [esi], vtable.ThreadControl.0
push eax
call fcn.0045fa45
lea eax, [esi + 0x2c]
push 2
push eax
call fcn.0045f175
mov eax, dword [esp + 0x18]
add esp, 0xc
mov dword [esi + 0x5c], 0
mov dword [esi], vtable.ThreadInfo.0
mov dword [esi + 0x60], 0
mov dword [esi + 0x68], eax
mov eax, dword [esp + 0x10]
mov dword [esi + 0x64], 0
mov dword [esi + 0x6c], 0
mov dword [esi + 0x70], eax
test eax, eax
jne 0x45d105
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov dword [esi + 0x6c], eax
mov eax, esi
pop esi
pop ecx
ret 8
lea eax, [esp + 4]
push eax
push 0
push esi
push 0x45cfd0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [esi + 0x6c], eax
mov eax, esi
pop esi
pop ecx
ret 8

Function at 0x4635f4
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateThread]
pop ebp
ret

Function at 0x48b5e2
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.0048b461

Function at 0x49291a
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.004925da
Function at 0x10026b10
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x54
pushal
call 0x10026b1f
pop dword [ebp - 0x44]
mov eax, 0x10026b1f
sub dword [ebp - 0x44], eax
mov dword [ebp - 0x54], 0x923179bc
add dword [ebp - 0x54], 0xbc20cb8f
mov dword [ebp - 0x50], 0xf23561df
sub dword [ebp - 0x50], 0xc002159a
mov dword [ebp - 0x4c], 0x9c5ffcfd
sub dword [ebp - 0x4c], 0x5013b8cf
mov dword [ebp - 0x48], 0x602327c3
sub dword [ebp - 0x48], 0x602327c3
lea eax, [ebp - 0x54]
push eax
mov eax, 0x124fcae9
sub eax, 0x24baab5
add eax, dword [ebp - 0x44]
call dword [eax]
mov dword [ebp - 0x54], 0x2d6c67a6
add dword [ebp - 0x54], 0x470601b0
mov dword [ebp - 0x50], 0x13c3e79f
sub dword [ebp - 0x50], 0xd257862a
mov dword [ebp - 0x4c], 0xab66ff77
add dword [ebp - 0x4c], 0xb8086cf5
mov dword [ebp - 0x48], 0xfdcd38b9
sub dword [ebp - 0x48], 0xfdcd38b9
lea ebx, [ebp - 0x54]
push ebx
push eax
mov eax, 0xf5725ea6
add eax, 0x1a91c1a6
add eax, dword [ebp - 0x44]
call dword [eax]
push 0x40
push 0x1000
push 0x44295
push 0
call eax
mov ecx, 0x39ba
mov ebx, eax
mov edi, 0x10057e00
add edi, dword [ebp - 0x44]
mov edx, 0x11c2a7c
sub edx, 0xafdbce28
mov esi, dword [edi]
xor dword [ebp - 0x2c], 0x17cd2b56
add esi, edx
xor dword [ebp - 0x40], 0x5f7246f8
mov dword [ebx], esi
add ebx, 4
add edi, 4
loop 0x10026c30
add eax, 0x76907cd8
add eax, 0x89705ce3
mov ebx, eax
add eax, 5
mov ecx, 0x8e44228b
sub ecx, 0x7e44228b
add ecx, dword [ebp - 0x44]
call ebx
leave
ret