joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4292b0
Capabilities:
List tcp connections and listeners

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5ba9ad
mov eax, dword fs:[0]
push eax
sub esp, 0x34
mov eax, dword [0x624040]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov ebx, ecx
mov dword [ebp - 0x28], ebx
mov dword [ebp - 4], 0
mov eax, dword [ebx + 0x58]
mov dword [ebp - 0x24], 0
mov dword [ebp - 0x20], eax
call fcn.004297d0
nop dword [eax]
push 0
push 7
push 2
push 0
lea eax, [ebp - 0x20]
push eax
push dword [ebx + 0x50]
lea edi, [ebx + 0x50]
call dword [sym.imp.IPHLPAPI.DLL_GetExtendedTcpTable]
cmp eax, 0x7a
jne 0x42936b
mov eax, dword [ebp - 0x20]
lea ebx, [eax + eax]
push ebx
mov dword [ebp - 0x20], ebx
call fcn.0048339c
add esp, 4
mov esi, eax
push ebx
push 0
push esi
call fcn.00591a40
or dword [ebp - 0x24], 1
lea eax, [ebp - 0x3c]
add esp, 0xc
cmp edi, eax
je 0x429353
mov eax, dword [edi]
mov dword [edi], esi
test eax, eax
je 0x429360
push eax
jmp 0x429358
test esi, esi
je 0x429360
push esi
call fcn.00483a6b
add esp, 4
mov ebx, dword [ebp - 0x28]
mov eax, dword [ebp - 0x20]
mov dword [ebx + 0x58], eax
jmp 0x429300
test eax, eax
jne 0x42946b
mov ecx, dword [edi]
xor edi, edi
mov dword [ebp - 0x24], ecx
nop word [eax + eax]
cmp edi, dword [ecx]
jae 0x429467
lea ebx, [edi + edi*4]
xorps xmm0, xmm0
shl ebx, 5
add ebx, ecx
movlpd qword [ebp - 0x1c], xmm0
lea eax, [ebx + 8]
push eax
lea eax, [ebp - 0x1c]
push eax
call fcn.004299c0
mov byte [ebp - 4], 1
cmp dword [ebp - 0x1c], 0
je 0x42942c
movzx eax, word [ebx + 0x18]
push eax
call dword [sym.imp.WS2_32.dll_ntohs]
movzx esi, ax
movzx eax, word [ebx + 0x10]
push eax
call dword [sym.imp.WS2_32.dll_ntohs]
mov ecx, dword [ebx + 0xc]
movzx edx, ax
mov eax, dword [ebx + 0x14]
mov dword [ebp - 0x30], eax
lea eax, [ebp - 0x38]
mov dword [ebp - 0x38], ecx
mov ecx, dword [ebp - 0x28]
push eax
mov word [ebp - 0x34], dx
mov word [ebp - 0x2c], si
call fcn.004297b0
mov ecx, dword [ebp - 0x1c]
mov edx, dword [ebp - 0x18]
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x18], 0
mov esi, dword [eax + 4]
mov dword [eax], ecx
mov dword [eax + 4], edx
test esi, esi
je 0x42942c
or eax, 0xffffffff
lock xadd dword [esi + 4], eax
jne 0x42942c
mov eax, dword [esi]
mov ecx, esi
call dword [eax]
or eax, 0xffffffff
lock xadd dword [esi + 8], eax
jne 0x42942c
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 4]
mov byte [ebp - 4], 0
mov esi, dword [ebp - 0x18]
test esi, esi
je 0x429458
or eax, 0xffffffff
lock xadd dword [esi + 4], eax
jne 0x429458
mov eax, dword [esi]
mov ecx, esi
call dword [eax]
or eax, 0xffffffff
lock xadd dword [esi + 8], eax
jne 0x429458
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 4]
mov ecx, dword [ebp - 0x24]
inc edi
jmp 0x429380
mov al, 1
jmp 0x42946d
xor al, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.004830fa
mov esp, ebp
pop ebp
ret
Function at 0x42a3c0
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, dword [ebp + 8]
lea eax, [esi + 8]
push eax
call fcn.0042a740
push esi
mov ebx, eax
call fcn.0042a740
movzx ecx, word [esi + 0xc]
xor ebx, eax
xor ebx, ecx
movzx ecx, word [esi + 4]
xor ebx, ecx
movzx eax, bl
xor eax, 0x811c9dc5
imul ecx, eax, 0x1000193
mov eax, ebx
shr eax, 8
movzx eax, al
pop esi
xor ecx, eax
mov eax, ebx
imul ecx, ecx, 0x1000193
shr eax, 0x10
movzx eax, al
shr ebx, 0x18
xor ecx, eax
imul eax, ecx, 0x1000193
xor eax, ebx
imul eax, eax, 0x1000193
pop ebx
pop ebp
ret 4

Function at 0x42a740
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
mov edx, dword [esi]
movzx eax, dl
xor eax, 0x811c9dc5
imul ecx, eax, 0x1000193
mov eax, edx
shr eax, 8
movzx eax, al
xor ecx, eax
mov eax, edx
shr eax, 0x10
movzx eax, al
imul ecx, ecx, 0x1000193
shr edx, 0x18
xor ecx, eax
imul eax, ecx, 0x1000193
xor eax, edx
movzx edx, word [esi + 4]
imul eax, eax, 0x1000193
pop esi
xor edx, eax
movzx eax, dl
xor eax, 0x811c9dc5
imul ecx, eax, 0x1000193
mov eax, edx
shr eax, 8
movzx eax, al
xor ecx, eax
mov eax, edx
imul ecx, ecx, 0x1000193
shr eax, 0x10
movzx eax, al
shr edx, 0x18
xor ecx, eax
imul eax, ecx, 0x1000193
xor eax, edx
imul eax, eax, 0x1000193
pop ebp
ret 4
Function at 0x42b730
Capabilities:
Check for time delay via queryperformancecounter

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x24
mov eax, dword [0x624040]
xor eax, esp
mov dword [esp + 0x20], eax
push ebx
mov ebx, dword [ebp + 0xc]
push esi
push edi
mov edi, ecx
push ebx
push dword [ebp + 8]
lea ecx, [edi + 0x8a0]
call fcn.0041c630
lea eax, [esp + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
test eax, eax
je 0x42b775
lea eax, [esp + 0x18]
push eax
call dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
lea eax, [edi + 0x894]
push eax
call fcn.0048577b
add esp, 4
lea ecx, [ebp + 8]
push ecx
lea ecx, [esp + 0x1c]
push ecx
lea ecx, [edi + 0x898]
call fcn.00420680
mov esi, dword [esp + 0x20]
cmp byte [esi + 0xd], 0
jne 0x42b82a
cmp ebx, dword [esi + 0x14]
jb 0x42b82a
ja 0x42b7b5
mov eax, dword [ebp + 8]
cmp eax, dword [esi + 0x10]
jb 0x42b82a
cmp esi, dword [edi + 0x898]
je 0x42b82a
lea eax, [edi + 0x888]
push eax
call fcn.0048577b
add esp, 4
mov dword [esp + 0x10], 0
lea eax, [esi + 0x18]
lea ecx, [edi + 0x88c]
push eax
lea eax, [esp + 0x14]
push eax
call fcn.0041edc0
mov eax, dword [esp + 0x10]
lea ecx, [edi + 0x88c]
cmp eax, dword [ecx]
je 0x42b807
push eax
call fcn.00420190
push 0x58
push eax
call fcn.0048335e
add esp, 8
push esi
lea ecx, [edi + 0x898]
call fcn.00420190
push 0x58
push eax
call fcn.0048335e
lea eax, [edi + 0x888]
push eax
call fcn.00485797
add esp, 0xc
lea eax, [edi + 0x894]
push eax
call fcn.00485797
add esp, 4
lea esi, [edi + 0x960]
push esi
call fcn.0048577b
add esp, 4
lea eax, [ebp + 8]
lea ecx, [edi + 0x964]
push eax
lea eax, [esp + 0x1c]
push eax
call fcn.00420680
mov eax, dword [esp + 0x20]
cmp byte [eax + 0xd], 0
jne 0x42b894
cmp ebx, dword [eax + 0x14]
jb 0x42b894
ja 0x42b875
mov ecx, dword [ebp + 8]
cmp ecx, dword [eax + 0x10]
jb 0x42b894
cmp eax, dword [edi + 0x964]
je 0x42b894
push eax
lea ecx, [edi + 0x964]
call fcn.00420190
push 0x20
push eax
call fcn.0048335e
add esp, 8
push esi
call fcn.00485797
add esp, 4
lea eax, [esp + 0x18]
push eax
call dword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
test eax, eax
je 0x42b8b7
lea eax, [esp + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov ecx, dword [esp + 0x2c]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.004830fa
mov esp, ebp
pop ebp
ret 8
Function at 0x42d950
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5baf58
mov eax, dword fs:[0]
push eax
sub esp, 8
push esi
push edi
mov eax, dword [0x624040]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x10], edi
mov dword [edi], 0
lea esi, [edi + 0xc]
mov byte [edi + 4], 0
mov dword [edi + 8], 0
mov dword [ebp - 0x14], esi
mov dword [esi], 0
push 0x24
mov dword [esi + 4], 0
mov dword [esi + 8], 0
call fcn.0048336c
add esp, 4
mov dword [eax], eax
mov dword [eax + 4], eax
mov dword [esi + 4], eax
lea ecx, [esi + 0xc]
mov dword [ebp - 4], 0
mov dword [ecx], 0
mov dword [ecx + 4], 0
mov dword [ecx + 8], 0
mov byte [ebp - 4], 1
mov dword [esi + 0x18], 7
mov dword [esi + 0x1c], 8
mov dword [esi], 0x3f800000
push dword [esi + 4]
push 0x10
call fcn.00407f70
mov dword [ebp - 4], 2
mov dword [edi + 0x2c], 0
mov dword [edi + 0x30], 0
mov dword [edi + 0x34], 0
mov byte [ebp - 4], 3
lea esi, [edi + 0x38]
mov dword [ebp - 0x14], esi
push 0x34
mov dword [esi], 0
mov dword [esi + 4], 0
call fcn.0048336c
mov dword [eax], eax
mov dword [eax + 4], eax
mov dword [eax + 8], eax
mov word [eax + 0xc], 0x101
mov dword [esi], eax
mov byte [ebp - 4], 4
lea esi, [edi + 0x40]
mov dword [ebp - 0x14], esi
push 0x34
mov dword [esi], 0
mov dword [esi + 4], 0
call fcn.0048336c
add esp, 8
mov dword [eax], eax
mov dword [eax + 4], eax
mov dword [eax + 8], eax
mov word [eax + 0xc], 0x101
mov dword [esi], eax
lea ecx, [edi + 0x48]
mov byte [ebp - 4], 5
call fcn.00431e70
mov byte [ebp - 4], 6
lea esi, [edi + 0x68]
mov dword [ebp - 0x14], esi
push 0x34
mov dword [esi], 0
mov dword [esi + 4], 0
call fcn.0048336c
add esp, 4
mov dword [eax], eax
mov dword [eax + 4], eax
mov dword [eax + 8], eax
mov word [eax + 0xc], 0x101
mov dword [esi], eax
mov dword [edi + 0x70], 0
mov dword [edi + 0x74], 0
mov dword [edi + 0x78], 0
mov byte [ebp - 4], 8
lea ecx, [edi + 0x80]
mov dword [edi + 0x7c], 0
call fcn.00431cf0
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x42db50
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5bafb1
mov eax, dword fs:[0]
push eax
sub esp, 8
push esi
push edi
mov eax, dword [0x624040]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x10], edi
xorps xmm0, xmm0
xor eax, eax
movups xmmword [edi + 0x10], xmm0
mov dword [edi + 0x20], 0
mov dword [edi + 0x24], 7
mov word [edi + 0x10], ax
mov dword [ebp - 4], eax
mov dword [edi + 0x28], eax
mov dword [edi + 0x2c], eax
mov dword [edi + 0x30], eax
lea esi, [edi + 0x34]
mov byte [ebp - 4], 1
push 0x28
mov dword [ebp - 0x14], esi
mov dword [esi], eax
mov dword [esi + 4], eax
call fcn.0048336c
mov dword [eax], eax
mov dword [eax + 4], eax
mov dword [eax + 8], eax
mov word [eax + 0xc], 0x101
mov dword [esi], eax
lea esi, [edi + 0x3c]
mov byte [ebp - 4], 2
push 0x28
mov dword [ebp - 0x14], esi
mov dword [esi], 0
mov dword [esi + 4], 0
call fcn.0048336c
mov dword [eax], eax
mov dword [eax + 4], eax
mov dword [eax + 8], eax
mov word [eax + 0xc], 0x101
mov dword [esi], eax
lea esi, [edi + 0x44]
mov byte [ebp - 4], 3
push 0x28
mov dword [ebp - 0x14], esi
mov dword [esi], 0
mov dword [esi + 4], 0
call fcn.0048336c
add esp, 0xc
mov dword [eax], eax
mov dword [eax + 4], eax
mov dword [eax + 8], eax
mov word [eax + 0xc], 0x101
mov dword [esi], eax
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x42e9d0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5bb075
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
mov eax, dword [0x624040]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
xor bl, bl
mov eax, 1
mov ecx, 0x62e37c
xchg dword [ecx], eax
test eax, eax
jne 0x42ea26
push 1
push eax
push 0x42cc80
push eax
push 0x2710
call dword [sym.imp.WINMM.dll_timeSetEvent]
mov dword [0x62e36c], eax
cmp dword [0x628170], 7
mov edi, 0x62815c
mov esi, dword [sym.imp.KERNEL32.dll_CreateSemaphoreW]
cmova edi, dword [0x62815c]
push 0
push 0xf4240
push 0
push 0
call esi
mov dword [0x62e360], eax
test eax, eax
je 0x42ebb6
push 0
push 0xf4240
push 0
push 0
call esi
mov dword [0x62e364], eax
test eax, eax
je 0x42ebb6
push 0
push 0xf4240
push 0
push 0
call esi
mov dword [0x62e374], eax
test eax, eax
je 0x42ebb6
mov esi, dword [sym.imp.KERNEL32.dll_CreateEventW]
push 0
push 0
push 0
push 0
call esi
mov dword [0x62e384], eax
test eax, eax
je 0x42ebb6
push 0
push 0
push 0
push 0
call esi
mov dword [0x62e368], eax
test eax, eax
je 0x42ebb6
push 0
push 0
push 1
push 0
call esi
mov dword [0x62e378], eax
test eax, eax
je 0x42ebb6
push edi
push 0
push 0
push 0
call esi
mov dword [0x62e380], eax
test eax, eax
jne 0x42eb00
push edi
push eax
push eax
call dword [sym.imp.KERNEL32.dll_OpenEventW]
mov dword [0x62e380], eax
test eax, eax
je 0x42ebb6
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push 1
mov dword [0x62eb90], eax
call fcn.0048336c
add esp, 4
mov dword [ebp - 0x14], eax
lea ecx, [ebp - 0x20]
mov dword [ebp - 4], 0
push ecx
push 0
push eax
push 0x432b80
push 0
push 0
call fcn.00595613
mov ecx, eax
add esp, 0x18
mov dword [ebp - 0x24], ecx
test ecx, ecx
je 0x42ebf1
mov dword [ebp - 4], 0xffffffff
cmp dword [0x62e3e8], 0
jne 0x42ebd9
mov eax, dword [ebp - 0x20]
push 1
mov dword [0x62e3e4], ecx
mov dword [0x62e3e8], eax
call fcn.0048336c
add esp, 4
mov dword [ebp - 0x14], eax
lea ecx, [ebp - 0x18]
mov dword [ebp - 4], 1
push ecx
push 0
push eax
push 0x432c30
push 0
push 0
call fcn.00595613
mov ecx, eax
add esp, 0x18
mov dword [ebp - 0x1c], ecx
test ecx, ecx
je 0x42ebe3
cmp dword [0x62e404], 0
jne 0x42ebde
mov eax, dword [ebp - 0x18]
mov bl, 1
mov dword [0x62e400], ecx
mov dword [0x62e404], eax
jmp 0x42ebbb
call fcn.0042e840
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004830fa
mov esp, ebp
pop ebp
ret
call fcn.005956c4
call fcn.005956c4
push 6
mov dword [ebp - 0x18], 0
call fcn.00484dcd
push 6
mov dword [ebp - 0x20], 0
call fcn.00484dcd
int3
Function at 0x42ec00
Capabilities:
Check for time delay via queryperformancecounter

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff0
sub esp, 0x68
mov eax, dword [0x624040]
xor eax, esp
mov dword [esp + 0x64], eax
push esi
push edi
mov edi, dword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
lea eax, [esp + 0x40]
push eax
call edi
mov esi, dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
test eax, eax
je 0x42ec61
lea eax, [esp + 0x38]
push eax
call esi
test eax, eax
je 0x42ec61
push 0
push 0x3e8
push dword [esp + 0x4c]
push dword [esp + 0x4c]
call fcn.005b83b0
push edx
push eax
push dword [esp + 0x44]
push dword [esp + 0x44]
call fcn.005b83b0
mov dword [esp + 0x40], edx
jmp 0x42ec76
xorps xmm0, xmm0
movlpd qword [esp + 0x38], xmm0
mov eax, dword [esp + 0x3c]
mov dword [esp + 0x40], eax
mov eax, dword [esp + 0x38]
mov dword [esp + 0x38], eax
nop word [eax + eax]
lea eax, [esp + 0x50]
push eax
call edi
test eax, eax
je 0x42ecbb
lea eax, [esp + 0x58]
push eax
call esi
test eax, eax
je 0x42ecbb
push 0
push 0x3e8
push dword [esp + 0x5c]
push dword [esp + 0x5c]
call fcn.005b83b0
push edx
push eax
push dword [esp + 0x64]
push dword [esp + 0x64]
call fcn.005b83b0
jmp 0x42eccc
xorps xmm0, xmm0
movlpd qword [esp + 0x48], xmm0
mov edx, dword [esp + 0x4c]
mov eax, dword [esp + 0x48]
sub eax, dword [esp + 0x38]
mov ecx, dword [0x62e358]
sbb edx, dword [esp + 0x40]
mov dword [esp + 0x4c], edx
jne 0x42ed00
jb 0x42ece9
cmp eax, 0x7d0
ja 0x42ed00
cmp ecx, 3
je 0x42ed0e
cmp ecx, 4
je 0x42ed00
push 0x1f4
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x42ec80
cmp ecx, 3
je 0x42ed0e
cmp ecx, 4
jne 0x42edbc
mov eax, dword [0x62e380]
mov dword [esp + 0x64], eax
mov eax, dword [0x62e378]
mov dword [esp + 0x68], eax
jmp 0x42ed28
mov edi, dword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
lea eax, [esp + 0x48]
push eax
call edi
test eax, eax
je 0x42ed3a
lea eax, [esp + 0x58]
push eax
call esi
push 0x7d0
push 0
lea eax, [esp + 0x6c]
push eax
push 2
call dword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
mov edi, eax
lea eax, [esp + 0x50]
push eax
call dword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
test eax, eax
je 0x42ed66
lea eax, [esp + 0x40]
push eax
call esi
test edi, edi
je 0x42ed22
cmp edi, 1
je 0x42edd0
cmp edi, 0x102
jne 0x42edbc
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
push 0
push 0x1000
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
test esi, esi
je 0x42edbc
push 0
push 0x18
lea eax, [esp + 0x18]
xorps xmm0, xmm0
push eax
push 0
push esi
movaps xmmword [esp + 0x24], xmm0
movq qword [esp + 0x34], xmm0
call dword [sym.imp.ntdll.dll_NtQueryInformationProcess]
test eax, eax
je 0x42edbc
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor edx, edx
lea ecx, [edx + 2]
call fcn.0042e6f0
xor edx, edx
lea ecx, [edx + 3]
call fcn.0042e6f0
mov ecx, dword [esp + 0x6c]
pop edi
pop esi
xor ecx, esp
call fcn.004830fa
mov esp, ebp
pop ebp
ret
Function at 0x439da0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x1c
push ebx
mov ebx, ecx
push esi
push edi
mov esi, dword [ebx + 4]
mov dword [esp + 0x18], esi
cmp esi, 1
jne 0x439de3
push 8
mov dword [ebx + 0xc], 8
mov dword [ebx + 4], 8
call fcn.00433f50
mov dword [ebx + 0x10], eax
mov eax, ebx
shr eax, 4
mov dword [ebx + 8], eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
mov eax, dword [ebp + 8]
mov edi, dword [ebx + 0x10]
push eax
mov dword [esp + 0x20], edi
mov dword [ebx + 4], eax
call fcn.00433f50
mov ecx, dword [ebx + 0xc]
mov dword [ebx + 0x10], eax
mov eax, dword [ebx + 4]
mov dword [esp + 0x14], ecx
mov dword [ebx + 0xc], eax
cmp ecx, esi
jae 0x439e9f
nop
mov eax, dword [edi + ecx*4]
mov dl, al
test eax, eax
je 0x439e7b
mov cl, al
not cl
test cl, 1
je 0x439e77
mov ecx, dword [eax + 8]
mov edi, dword [eax]
push eax
lea eax, [esp + 0x24]
mov dword [esp + 0x24], ecx
push eax
lea ecx, [esp + 0x1b]
mov dword [esp + 0x2c], 0
call fcn.00418650
mov ecx, eax
mov eax, 0x9e3779b9
xor ecx, dword [ebx + 8]
mul ecx
mov esi, eax
mov eax, 0x7f4a7c15
mul ecx
mov ecx, dword [ebx + 4]
dec ecx
add esi, edx
and esi, ecx
mov ecx, ebx
push esi
call fcn.00439b70
mov eax, edi
test edi, edi
jne 0x439e22
mov esi, dword [esp + 0x18]
mov edi, dword [esp + 0x1c]
jmp 0x439e8e
mov ecx, dword [esp + 0x14]
test dl, 1
je 0x439e92
push 0x439ec0
dec eax
mov ecx, ebx
push eax
call fcn.004b6110
mov ecx, dword [esp + 0x14]
inc ecx
mov dword [esp + 0x14], ecx
cmp ecx, esi
jb 0x439e10
cmp dword [ebx + 0x14], 0
jne 0x439eb6
lea eax, [esi*4]
push eax
push edi
call fcn.0048335e
add esp, 8
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x43a130
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5bb700
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x624040]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
test esi, esi
jne 0x43a179
push 0x34
call fcn.0048336c
add esp, 4
mov dword [ebp - 0x10], eax
mov dword [eax + 4], esi
mov dword [eax], vtable.proxy::game::regionlock::report::ReportData.0
mov dword [eax + 0x14], esi
mov dword [eax + 0x24], esi
jmp 0x43a191
push 0x38
mov ecx, esi
call fcn.004b8410
mov dword [eax + 4], esi
mov dword [eax], vtable.proxy::game::regionlock::report::ReportData.0
mov dword [eax + 0x14], esi
mov dword [eax + 0x24], esi
mov dword [eax + 8], 0
xorps xmm0, xmm0
mov dword [eax + 0xc], 0
mov dword [eax + 0x10], 1
mov dword [eax + 0x18], 0
mov dword [eax + 0x1c], 0
mov dword [eax + 0x20], 1
mov dword [eax + 0x30], 0
movq qword [eax + 0x28], xmm0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x43cfa0
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [ebp + 0xc]
mov edx, ecx
push ebx
mov ebx, dword [ebp + 8]
mov dword [ebp - 0x14], edx
cmp ebx, eax
je 0x43d10f
mov eax, dword [edx + 4]
mov dword [ebp - 0x18], eax
mov eax, dword [ebx + 4]
mov dword [ebp - 8], eax
movzx eax, byte [ebx + 8]
xor eax, 0x811c9dc5
imul ecx, eax, 0x1000193
movzx eax, byte [ebx + 9]
push esi
push edi
mov edi, dword [edx + 0xc]
mov esi, ebx
xor ecx, eax
mov dword [ebp - 0x1c], edi
movzx eax, byte [ebx + 0xa]
imul ecx, ecx, 0x1000193
xor ecx, eax
movzx eax, byte [ebx + 0xb]
imul ecx, ecx, 0x1000193
xor ecx, eax
mov eax, dword [edx + 0x18]
imul ecx, ecx, 0x1000193
and eax, ecx
mov ecx, dword [edi + eax*8]
mov dword [ebp - 4], ecx
lea eax, [edi + eax*8]
mov dword [ebp - 0xc], eax
mov eax, dword [eax + 4]
mov dword [ebp - 0x10], eax
nop word [eax + eax]
mov edi, esi
mov ebx, esi
mov esi, dword [esi]
lea ecx, [edi + 0xc]
call fcn.004320e0
push 0x18
push edi
call fcn.0048335e
mov edx, dword [ebp - 0x14]
add esp, 8
dec dword [edx + 8]
cmp ebx, dword [ebp - 0x10]
je 0x43d06d
mov eax, dword [ebp + 0xc]
cmp esi, eax
jne 0x43d020
mov ecx, dword [ebp - 4]
cmp ecx, dword [ebp + 8]
jne 0x43d105
mov edi, dword [ebp - 0xc]
mov ecx, dword [ebp - 8]
mov dword [edi], esi
mov dword [ecx], esi
pop edi
mov dword [esi + 4], ecx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
mov ecx, dword [ebp - 4]
mov edi, dword [ebp - 0xc]
cmp ecx, dword [ebp + 8]
jne 0x43d081
mov eax, dword [ebp - 0x18]
mov ecx, eax
mov dword [edi], eax
jmp 0x43d084
mov ecx, dword [ebp - 8]
mov eax, dword [ebp + 0xc]
mov dword [edi + 4], ecx
cmp esi, eax
je 0x43d105
nop
movzx eax, byte [esi + 8]
xor eax, 0x811c9dc5
imul ecx, eax, 0x1000193
movzx eax, byte [esi + 9]
xor ecx, eax
movzx eax, byte [esi + 0xa]
imul ecx, ecx, 0x1000193
xor ecx, eax
movzx eax, byte [esi + 0xb]
imul ecx, ecx, 0x1000193
xor ecx, eax
imul eax, ecx, 0x1000193
mov ecx, dword [ebp - 0x1c]
and eax, dword [edx + 0x18]
lea eax, [ecx + eax*8]
mov dword [ebp - 4], eax
mov eax, dword [eax + 4]
mov dword [ebp - 0x10], eax
mov edi, esi
mov ebx, esi
mov esi, dword [esi]
lea ecx, [edi + 0xc]
call fcn.004320e0
push 0x18
push edi
call fcn.0048335e
mov edx, dword [ebp - 0x14]
add esp, 8
mov eax, dword [ebp + 0xc]
dec dword [edx + 8]
cmp ebx, dword [ebp - 0x10]
je 0x43d116
cmp esi, eax
jne 0x43d0d5
mov ecx, dword [ebp - 4]
mov dword [ecx], esi
mov ecx, dword [ebp - 8]
pop edi
mov dword [ecx], esi
mov dword [esi + 4], ecx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
mov ecx, dword [ebp - 4]
mov ebx, dword [ebp - 0x18]
mov dword [ecx], ebx
mov dword [ecx + 4], ebx
cmp esi, eax
jne 0x43d090
mov ecx, dword [ebp - 8]
pop edi
mov dword [ecx], esi
mov dword [esi + 4], ecx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x43d140
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
mov dword [ebp - 8], ecx
cmp edx, eax
je 0x43d2dc
cmp dword [edx + 0x1c], 0xf
mov eax, dword [ecx + 4]
push esi
mov dword [ebp - 0x1c], eax
mov esi, edx
mov eax, dword [ecx + 0xc]
push edi
mov dword [ebp - 0x18], eax
lea edi, [edx + 8]
mov eax, dword [edx + 4]
mov dword [ebp - 0xc], eax
mov eax, dword [edi + 0x10]
jbe 0x43d17b
mov edi, dword [edi]
xor edx, edx
push ebx
mov ebx, 0x811c9dc5
test eax, eax
je 0x43d1a4
mov ecx, eax
nop dword [eax]
movzx eax, byte [edi + edx]
inc edx
xor eax, ebx
imul ebx, eax, 0x1000193
cmp edx, ecx
jb 0x43d190
mov ecx, dword [ebp - 8]
mov eax, dword [ecx + 0x18]
mov ecx, dword [ebp - 0x18]
and eax, ebx
lea eax, [ecx + eax*8]
mov ecx, dword [eax]
mov dword [ebp - 0x10], eax
mov eax, dword [eax + 4]
mov dword [ebp - 4], ecx
mov dword [ebp - 0x14], eax
nop dword [eax]
mov edi, esi
mov ebx, esi
mov esi, dword [esi]
lea ecx, [edi + 8]
call fcn.00433110
push 0x2c
push edi
call fcn.0048335e
mov eax, dword [ebp - 8]
add esp, 8
dec dword [eax + 8]
cmp ebx, dword [ebp - 0x14]
je 0x43d209
mov eax, dword [ebp + 0xc]
cmp esi, eax
jne 0x43d1c0
mov ecx, dword [ebp - 4]
cmp ecx, dword [ebp + 8]
jne 0x43d1f8
mov edx, dword [ebp - 0x10]
mov dword [edx], esi
mov ecx, dword [ebp - 0xc]
pop ebx
pop edi
mov dword [ecx], esi
mov dword [esi + 4], ecx
pop esi
mov esp, ebp
pop ebp
ret 8
mov ecx, dword [ebp - 4]
mov edx, dword [ebp - 0x10]
cmp ecx, dword [ebp + 8]
jne 0x43d21b
mov ecx, dword [ebp - 0x1c]
mov dword [edx], ecx
jmp 0x43d21e
mov ecx, dword [ebp - 0xc]
mov dword [edx + 4], ecx
mov ecx, dword [ebp + 0xc]
cmp esi, ecx
je 0x43d2cf
nop dword [eax]
cmp dword [esi + 0x1c], 0xf
lea edx, [esi + 8]
mov ebx, dword [edx + 0x10]
jbe 0x43d23e
mov edx, dword [edx]
xor ecx, ecx
mov edi, 0x811c9dc5
test ebx, ebx
je 0x43d264
nop dword [eax]
movzx eax, byte [edx + ecx]
inc ecx
xor eax, edi
imul edi, eax, 0x1000193
cmp ecx, ebx
jb 0x43d250
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x18]
mov ecx, dword [ebp - 0x18]
and eax, edi
lea eax, [ecx + eax*8]
mov dword [ebp - 4], eax
mov eax, dword [eax + 4]
mov dword [ebp - 0x14], eax
mov edi, esi
mov ebx, esi
mov esi, dword [esi]
lea ecx, [edi + 8]
call fcn.00433110
push 0x2c
push edi
call fcn.0048335e
mov eax, dword [ebp - 8]
add esp, 8
dec dword [eax + 8]
cmp ebx, dword [ebp - 0x14]
je 0x43d2b9
mov eax, dword [ebp + 0xc]
cmp esi, eax
jne 0x43d278
mov ecx, dword [ebp - 4]
pop ebx
pop edi
mov dword [ecx], esi
mov ecx, dword [ebp - 0xc]
mov dword [ecx], esi
mov dword [esi + 4], ecx
pop esi
mov esp, ebp
pop ebp
ret 8
mov ecx, dword [ebp - 4]
mov edi, dword [ebp - 0x1c]
mov dword [ecx], edi
mov dword [ecx + 4], edi
mov ecx, dword [ebp + 0xc]
cmp esi, ecx
jne 0x43d230
mov eax, dword [ebp - 0xc]
pop ebx
pop edi
mov dword [eax], esi
mov dword [esi + 4], eax
mov eax, ecx
pop esi
mov esp, ebp
pop ebp
ret 8