joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4329a0
Capabilities:
Write file on windows

Disassembly:
sub esp, 0x2c
push ebx
mov ebx, dword [esp + 0x34]
push esi
mov esi, ecx
cmp ebx, 0xffffffff
jne 0x4329ba
pop esi
xor eax, eax
pop ebx
add esp, 0x2c
ret 4
mov eax, dword [esi + 0x20]
push edi
mov ecx, dword [eax]
test ecx, ecx
je 0x4329ec
mov edx, dword [esi + 0x30]
mov edi, dword [edx]
lea eax, [edi + ecx]
cmp ecx, eax
jae 0x4329ec
lea ecx, [edi - 1]
mov eax, ebx
mov dword [edx], ecx
mov edx, dword [esi + 0x20]
pop edi
mov esi, dword [edx]
lea ecx, [esi + 1]
mov dword [edx], ecx
mov byte [esi], bl
pop esi
pop ebx
add esp, 0x2c
ret 4
cmp dword [esi + 0x4c], 0
je 0x432abb
mov edi, dword [esi + 0xc]
lea eax, [esi + 0x3c]
cmp dword [edi], eax
jne 0x432a14
mov edx, dword [esi + 0x54]
mov ecx, dword [esi + 0x50]
sub edx, ecx
mov dword [edi], ecx
mov eax, dword [esi + 0x1c]
mov dword [eax], ecx
mov eax, dword [esi + 0x2c]
mov dword [eax], edx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x432a20
movsx eax, bl
jmp 0x432a60
lea eax, [esp + 0x10]
mov byte [esp + 0xf], bl
push eax
lea eax, [esp + 0x3c]
push eax
lea eax, [esp + 0x20]
push eax
lea eax, [esp + 0x20]
push eax
lea eax, [esp + 0x20]
push eax
lea eax, [esp + 0x23]
push eax
lea eax, [esi + 0x40]
push eax
call dword [sym.imp.MSVCP140.dll_public:_int___thiscall_std::codecvt_char__char__struct__Mbstatet_::out_struct__Mbstatet___char_const___char_const___char_const____char___char___char___const]
sub eax, 0
je 0x432a80
sub eax, 1
je 0x432a80
sub eax, 2
jne 0x432abb
movsx eax, byte [esp + 0xf]
push dword [esi + 0x4c]
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
add esp, 8
or ecx, 0xffffffff
cmp eax, ecx
cmove ebx, ecx
pop edi
pop esi
mov eax, ebx
pop ebx
add esp, 0x2c
ret 4
mov edi, dword [esp + 0x10]
lea eax, [esp + 0x18]
sub edi, eax
je 0x432aa0
push dword [esi + 0x4c]
push edi
push 1
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
add esp, 0x10
cmp edi, eax
jne 0x432abb
lea ecx, [esp + 0xf]
mov byte [esi + 0x3d], 1
or eax, 0xffffffff
cmp dword [esp + 0x14], ecx
pop edi
pop esi
cmovne eax, ebx
pop ebx
add esp, 0x2c
ret 4
pop edi
pop esi
or eax, 0xffffffff
pop ebx
add esp, 0x2c
ret 4

Function at 0x432ca0
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
mov edx, dword [esp + 4]
push esi
push edi
mov dword [ecx + 0x1384], 0xffffffff
lea edi, [ecx + 8]
mov dword [ecx + 4], edx
mov esi, 1
nop dword [eax + eax]
mov eax, edx
lea edi, [edi + 4]
shr eax, 0x1e
xor eax, edx
imul edx, eax, 0x6c078965
add edx, esi
inc esi
mov dword [edi - 4], edx
cmp esi, 0x270
jb 0x432cc0
pop edi
pop esi
mov dword [ecx], 0x270
mov eax, ecx
ret 4
Function at 0x4332c0
Capabilities:
Write file on windows

Disassembly:
sub esp, 0x24
push edi
mov edi, ecx
cmp dword [edi + 0x38], 0
je 0x433362
cmp byte [edi + 0x3d], 0
je 0x433362
mov eax, dword [edi]
push esi
push 0xffffffffffffffff
mov esi, dword [eax + 0xc]
mov ecx, esi
call dword [0x49f5b4]
mov ecx, edi
call esi
cmp eax, 0xffffffff
je 0x43335a
mov ecx, dword [edi + 0x38]
lea eax, [esp + 8]
push eax
lea eax, [esp + 0x30]
push eax
lea eax, [esp + 0x14]
push eax
lea eax, [edi + 0x40]
push eax
call dword [sym.imp.MSVCP140.dll_public:_int___thiscall_std::codecvt_char__char__struct__Mbstatet_::unshift_struct__Mbstatet___char___char___char___const]
sub eax, 0
je 0x433329
sub eax, 1
je 0x43332d
sub eax, 2
jne 0x43335a
mov byte [edi + 0x3d], al
mov al, 1
pop esi
pop edi
add esp, 0x24
ret
mov byte [edi + 0x3d], 0
mov esi, dword [esp + 8]
lea eax, [esp + 0xc]
sub esi, eax
je 0x43334d
push dword [edi + 0x4c]
push esi
push 1
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
add esp, 0x10
cmp esi, eax
jne 0x43335a
cmp byte [edi + 0x3d], 0
pop esi
sete al
pop edi
add esp, 0x24
ret
pop esi
xor al, al
pop edi
add esp, 0x24
ret
mov al, 1
pop edi
add esp, 0x24
ret
Function at 0x436290
Capabilities:
Hash data using fnv

Disassembly:
sub esp, 0x10
mov edx, dword [esp + 0x14]
mov eax, 0x1fffffff
push ebx
mov ebx, ecx
bsr ecx, eax
push ebp
push esi
mov esi, 1
mov dword [esp + 0x10], ebx
mov eax, esi
shl eax, cl
push edi
cmp edx, eax
jbe 0x4362c1
push str.invalid_hash_bucket_count
call dword [sym.imp.MSVCP140.dll_void___cdecl_std::_Xlength_error_char_const__]
mov ebp, dword [ebx + 4]
lea eax, [edx - 1]
or eax, 1
mov dword [esp + 0x1c], ebp
bsr ecx, eax
lea edi, [ebx + 0xc]
push ebp
mov dword [esp + 0x1c], edi
lea ecx, [ecx + 1]
shl esi, cl
mov ecx, edi
lea eax, [esi + esi]
push eax
call fcn.004337d0
lea eax, [esi - 1]
mov dword [ebx + 0x1c], esi
mov dword [ebx + 0x18], eax
mov ecx, dword [ebx + 4]
mov ecx, dword [ecx]
cmp ecx, ebp
je 0x4363bf
mov eax, ecx
movzx edx, byte [eax + 8]
xor edx, 0x811c9dc5
mov ecx, dword [ecx]
imul esi, edx, 0x1000193
movzx edx, byte [eax + 9]
xor esi, edx
movzx edx, byte [eax + 0xa]
imul esi, esi, 0x1000193
xor esi, edx
movzx edx, byte [eax + 0xb]
imul esi, esi, 0x1000193
xor esi, edx
imul edx, esi, 0x1000193
mov esi, dword [ebx + 0x18]
and esi, edx
mov edx, dword [edi]
lea ebp, [edx + esi*8]
mov esi, dword [ebp]
cmp esi, dword [esp + 0x1c]
jne 0x436352
mov dword [ebp], eax
mov dword [ebp + 4], eax
jmp 0x4363b3
mov edx, dword [ebp + 4]
mov edi, dword [eax + 8]
cmp edi, dword [edx + 8]
jne 0x436380
mov ebx, dword [edx]
cmp ebx, eax
je 0x43637b
mov edi, dword [eax + 4]
mov dword [edi], ecx
mov esi, dword [ecx + 4]
mov dword [esi], ebx
mov edx, dword [ebx + 4]
mov dword [edx], eax
mov dword [ebx + 4], esi
mov dword [ecx + 4], edi
mov dword [eax + 4], edx
mov dword [ebp + 4], eax
jmp 0x4363ab
cmp esi, edx
je 0x436390
mov edx, dword [edx + 4]
cmp edi, dword [edx + 8]
je 0x4363c9
cmp esi, edx
jne 0x436384
mov ebx, dword [eax + 4]
mov dword [ebx], ecx
mov edi, dword [ecx + 4]
mov dword [edi], edx
mov esi, dword [edx + 4]
mov dword [esi], eax
mov dword [edx + 4], edi
mov dword [ecx + 4], ebx
mov dword [eax + 4], esi
mov dword [ebp], eax
mov ebx, dword [esp + 0x14]
mov edi, dword [esp + 0x18]
mov eax, ecx
cmp ecx, dword [esp + 0x1c]
jne 0x436301
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret 4
mov edi, dword [eax + 4]
mov ebx, dword [edx]
mov dword [edi], ecx
mov esi, dword [ecx + 4]
mov dword [esi], ebx
mov edx, dword [ebx + 4]
mov dword [edx], eax
mov dword [ebx + 4], esi
mov dword [ecx + 4], edi
mov dword [eax + 4], edx
jmp 0x4363ab
Function at 0x4363f0
Capabilities:
Hash data using fnv

Disassembly:
sub esp, 0x10
mov edx, dword [esp + 0x14]
mov eax, 0x1fffffff
push ebx
mov ebx, ecx
bsr ecx, eax
push ebp
push esi
push edi
mov edi, 1
mov dword [esp + 0x14], ebx
mov eax, edi
shl eax, cl
cmp edx, eax
jbe 0x436421
push str.invalid_hash_bucket_count
call dword [sym.imp.MSVCP140.dll_void___cdecl_std::_Xlength_error_char_const__]
mov esi, dword [ebx + 4]
lea eax, [edx - 1]
or eax, 1
lea ebp, [ebx + 0xc]
bsr ecx, eax
push esi
lea ecx, [ecx + 1]
shl edi, cl
mov ecx, ebp
lea eax, [edi + edi]
push eax
call fcn.004337d0
lea eax, [edi - 1]
mov dword [ebx + 0x1c], edi
mov dword [ebx + 0x18], eax
mov eax, dword [ebx + 4]
mov eax, dword [eax]
mov ecx, eax
cmp eax, esi
je 0x43652c
nop dword [eax]
movzx edx, byte [eax + 8]
xor edx, 0x811c9dc5
mov ecx, dword [ecx]
imul edi, edx, 0x1000193
movzx edx, byte [eax + 9]
xor edi, edx
movzx edx, byte [eax + 0xa]
imul edi, edi, 0x1000193
xor edi, edx
movzx edx, byte [eax + 0xb]
imul edi, edi, 0x1000193
xor edi, edx
mov edx, dword [ebp]
imul edi, edi, 0x1000193
and edi, dword [ebx + 0x18]
lea ebp, [edx + edi*8]
mov edi, dword [ebp]
mov dword [esp + 0x18], ebp
cmp edi, esi
jne 0x4364b2
mov dword [ebp], eax
mov dword [ebp + 4], eax
jmp 0x43651f
mov edx, dword [ebp + 4]
mov ebx, dword [eax + 8]
cmp ebx, dword [edx + 8]
jne 0x4364ec
mov edx, dword [edx]
mov dword [esp + 0x1c], edx
cmp edx, eax
je 0x4364e7
mov ebx, dword [eax + 4]
mov ebp, dword [esp + 0x1c]
mov dword [ebx], ecx
mov edi, dword [ecx + 4]
mov dword [edi], edx
mov edx, dword [edx + 4]
mov dword [edx], eax
mov dword [ebp + 4], edi
mov ebp, dword [esp + 0x18]
mov dword [ecx + 4], ebx
mov dword [eax + 4], edx
mov dword [ebp + 4], eax
jmp 0x43651b
cmp edi, edx
je 0x4364fc
mov edx, dword [edx + 4]
cmp ebx, dword [edx + 8]
je 0x436536
cmp edi, edx
jne 0x4364f0
mov ebp, dword [eax + 4]
mov dword [ebp], ecx
mov ebx, dword [ecx + 4]
mov dword [ebx], edx
mov edi, dword [edx + 4]
mov dword [edi], eax
mov dword [edx + 4], ebx
mov edx, dword [esp + 0x18]
mov dword [ecx + 4], ebp
mov dword [eax + 4], edi
mov dword [edx], eax
mov ebx, dword [esp + 0x14]
lea ebp, [ebx + 0xc]
mov eax, ecx
cmp ecx, esi
jne 0x436460
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret 4
mov ebx, dword [eax + 4]
mov ebp, dword [edx]
mov dword [ebx], ecx
mov edi, dword [ecx + 4]
mov dword [edi], ebp
mov edx, dword [ebp + 4]
mov dword [edx], eax
mov dword [ebp + 4], edi
mov dword [ecx + 4], ebx
mov dword [eax + 4], edx
jmp 0x43651b
Function at 0x436b40
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push esi
mov esi, ecx
push edi
mov eax, dword [esi]
cmp eax, 0x270
jne 0x436b8f
lea edx, [esi + 8]
mov edi, eax
mov ecx, dword [edx]
lea edx, [edx + 4]
xor ecx, dword [edx - 8]
and ecx, 0x7fffffff
xor ecx, dword [edx - 8]
mov eax, ecx
and al, 1
movzx eax, al
neg eax
sbb eax, eax
shr ecx, 1
and eax, 0x9908b0df
xor eax, dword [edx + 0x62c]
xor eax, ecx
mov dword [edx + 0x9b8], eax
sub edi, 1
jne 0x436b52
mov eax, dword [esi]
jmp 0x436c78
cmp eax, 0x4e0
jb 0x436c78
push ebx
mov ebx, dword [esi + 0x9c4]
lea edi, [esi + 0x9c4]
push ebp
mov ebp, 0xe3
nop dword [eax]
lea edx, [edi]
mov eax, ebx
mov ebx, dword [edx + 4]
lea edi, [edx + 4]
mov ecx, ebx
xor ecx, eax
and ecx, 0x7fffffff
xor ecx, eax
mov eax, ecx
and al, 1
movzx eax, al
neg eax
sbb eax, eax
shr ecx, 1
and eax, 0x9908b0df
xor eax, dword [edx + 0x634]
xor eax, ecx
mov dword [edx - 0x9c0], eax
sub ebp, 1
jne 0x436bb0
mov ebx, dword [esi + 0xd50]
lea edi, [esi + 0xd50]
mov ebp, 0x18c
nop dword [eax]
mov eax, ebx
lea edx, [edi]
mov ebx, dword [edx + 4]
lea edi, [edx + 4]
mov ecx, eax
xor ecx, ebx
and ecx, 0x7fffffff
xor ecx, eax
mov eax, ecx
and al, 1
movzx eax, al
neg eax
sbb eax, eax
shr ecx, 1
and eax, 0x9908b0df
xor eax, dword [edx - 0xd4c]
xor eax, ecx
mov dword [edx - 0x9c0], eax
sub ebp, 1
jne 0x436c00
mov eax, dword [esi + 0x1380]
mov ecx, dword [esi + 4]
xor ecx, eax
and ecx, 0x7fffffff
xor ecx, eax
mov eax, ecx
and al, 1
movzx eax, al
neg eax
pop ebp
sbb eax, eax
shr ecx, 1
and eax, 0x9908b0df
xor eax, dword [esi + 0x634]
xor eax, ecx
mov dword [esi + 0x9c0], eax
xor eax, eax
pop ebx
mov dword [esi], 0
mov edx, dword [esi + eax*4 + 4]
inc eax
mov dword [esi], eax
mov ecx, edx
mov eax, dword [esi + 0x1384]
shr ecx, 0xb
and eax, ecx
xor edx, eax
mov eax, edx
and eax, 0xff3a58ad
shl eax, 7
xor edx, eax
mov eax, edx
and eax, 0xffffdf8c
shl eax, 0xf
xor edx, eax
mov eax, edx
shr eax, 0x12
pop edi
xor eax, edx
pop esi
ret
Function at 0x43a780
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x49cc00
push eax
mov dword fs:[0], esp
sub esp, 0xb8
cmp byte [ebp + 8], 0
push esi
push edi
mov edi, edx
mov esi, ecx
je 0x43a882
sub esp, 0xc
lea ecx, [ebp - 0xc4]
push 0x4a46c8
call fcn.00433400
mov dword [ebp - 4], 0
cmp dword [ebp - 0x74], 0
je 0x43a867
cmp dword [esi + 0x14], 0xf
mov eax, dword [esi + 0x10]
jbe 0x43a7dd
mov esi, dword [esi]
push eax
mov edx, esi
lea ecx, [ebp - 0xc4]
call fcn.004365e0
add esp, 4
mov ecx, eax
push 0x433ba0
call dword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______thiscall_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char_______cdecl___class_std::basic_ostream_char__struct_std::char_traits_char_____]
cmp dword [edi + 0x14], 0xf
mov eax, dword [edi + 0x10]
jbe 0x43a806
mov edi, dword [edi]
push eax
mov edx, edi
lea ecx, [ebp - 0xc4]
call fcn.004365e0
add esp, 4
mov ecx, eax
push 0x433ba0
call dword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______thiscall_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char_______cdecl___class_std::basic_ostream_char__struct_std::char_traits_char_____]
push dword [ebp + 8]
lea ecx, [ebp - 0xc4]
call dword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______thiscall_std::basic_ostream_char__struct_std::char_traits_char__::operator___bool_]
push 0x433ba0
mov ecx, eax
call dword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______thiscall_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char_______cdecl___class_std::basic_ostream_char__struct_std::char_traits_char_____]
lea ecx, [ebp - 0xc0]
call fcn.00433370
test eax, eax
jne 0x43a867
push eax
mov eax, dword [ebp - 0xc4]
lea ecx, [ebp - 0xc4]
push 2
add ecx, dword [eax + 4]
call dword [sym.imp.MSVCP140.dll_public:_void___thiscall_std::basic_ios_char__struct_std::char_traits_char__::setstate_int__bool_]
lea ecx, [ebp - 0xc4]
call fcn.00426960
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
push 0x4a46d4
call dword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll_remove]
mov ecx, dword [ebp - 0xc]
add esp, 4
mov dword fs:[0], ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x43e210
Capabilities:
Check for debugger via api

Disassembly:
sub esp, 0x28
push esi
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
jne 0x43e302
mov dword [esp + 0xc], eax
lea eax, [esp + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_CheckRemoteDebuggerPresent]
test eax, eax
je 0x43e247
cmp dword [esp + 0xc], 0
jne 0x43e302
mov eax, dword fs:[0x2c]
mov ecx, dword [eax]
mov eax, dword [0x639770]
cmp eax, dword [ecx + 4]
jle 0x43e29b
push 0x639770
call fcn.0049a967
add esp, 4
cmp dword [0x639770], 0xffffffff
jne 0x43e29b
push str.NtQueryInformationProcess
push 0x4a650c
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x639770
mov dword [0x630e90], eax
call fcn.0049a916
add esp, 4
mov esi, dword [0x630e90]
test esi, esi
je 0x43e2fb
push 0
push 0x18
lea eax, [esp + 0x18]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
mov ecx, esi
call dword [0x49f5b4]
call esi
test eax, eax
js 0x43e2fb
mov eax, dword [esp + 0x14]
test eax, eax
je 0x43e2fb
push 0
push 1
lea ecx, [esp + 0x13]
mov byte [esp + 0x13], 0
push ecx
add eax, 2
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
test eax, eax
je 0x43e2fb
mov al, byte [esp + 0xb]
and al, 1
pop esi
add esp, 0x28
ret
xor al, al
pop esi
add esp, 0x28
ret
mov al, 1
pop esi
add esp, 0x28
ret

Function at 0x43eca0
Capabilities:
Enumerate processes

Disassembly:
sub esp, 0x22c
push esi
push edi
push 0
push 2
mov edi, ecx
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov esi, eax
cmp esi, 0xffffffff
je 0x43ecfd
lea eax, [esp + 8]
mov dword [esp + 8], 0x22c
push eax
push esi
call dword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x43ecf6
lea eax, [esp + 0x2c]
push edi
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsicmp]
add esp, 8
test eax, eax
je 0x43ed08
lea eax, [esp + 8]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x43ecd3
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
xor al, al
pop esi
add esp, 0x22c
ret
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
mov al, 1
pop esi
add esp, 0x22c
ret
Function at 0x43f8b0
Capabilities:
Hide graphical window

Disassembly:
call dword [sym.imp.KERNEL32.dll_GetConsoleWindow]
test eax, eax
je 0x43f8c9
push 0
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
jmp dword [sym.imp.KERNEL32.dll_FreeConsole]
ret
Function at 0x445870
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x49d58e
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
mov dword [ebp - 0x10], 0
xorps xmm0, xmm0
push esi
push edi
mov edi, dword [ebp + 8]
mov eax, ecx
xor ecx, ecx
mov dword [ebp - 0x14], eax
movups xmmword [edi], xmm0
mov dword [edi + 0x10], 0
mov dword [edi + 0x14], 0
mov dword [edi + 0x10], 0
mov dword [edi + 0x14], 7
mov word [edi], cx
mov dword [ebp - 4], ecx
xor esi, esi
mov dword [ebp - 0x10], 1
mov edx, 0xff
mov cx, word [eax + 0xc]
and cx, dx
xor cx, word [eax + esi*2]
movzx ecx, cx
push ecx
mov ecx, edi
call fcn.0043c000
mov eax, dword [ebp - 0x14]
inc esi
mov edx, 0xff
cmp esi, 5
jb 0x4458d4
mov ecx, dword [ebp - 0xc]
mov eax, edi
pop edi
pop esi
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 4

Function at 0x446f30
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x49d58e
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
mov dword [ebp - 0x10], 0
xorps xmm0, xmm0
push esi
push edi
mov edi, dword [ebp + 8]
mov eax, ecx
xor ecx, ecx
mov dword [ebp - 0x14], eax
movups xmmword [edi], xmm0
mov dword [edi + 0x10], 0
mov dword [edi + 0x14], 0
mov dword [edi + 0x10], 0
mov dword [edi + 0x14], 7
mov word [edi], cx
mov dword [ebp - 4], ecx
xor esi, esi
mov dword [ebp - 0x10], 1
mov edx, 0xff
mov cx, word [eax + 0x10]
and cx, dx
xor cx, word [eax + esi*2]
movzx ecx, cx
push ecx
mov ecx, edi
call fcn.0043c000
mov eax, dword [ebp - 0x14]
inc esi
mov edx, 0xff
cmp esi, 8
jb 0x446f94
mov ecx, dword [ebp - 0xc]
mov eax, edi
pop edi
pop esi
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 4

Function at 0x4473b0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push esi
mov esi, dword [esp + 0xc]
mov edx, 0x811c9dc5
push edi
mov edi, dword [esp + 0xc]
mov ecx, 0
sub esi, edi
je 0x4473d9
movzx eax, byte [edi + ecx]
inc ecx
xor eax, edx
imul edx, eax, 0x1000193
cmp ecx, esi
jb 0x4473c8
pop edi
mov eax, edx
pop esi
ret 8
Function at 0x44c250
Capabilities:
Access peb ldr_data
Check for peb beingdebugged flag
Get kernel32 base address
Get number of processors

Disassembly:
sub esp, 0x14
push ebx
push ebp
mov ebx, 0xff
push esi
push edi
mov edi, ecx
mov dword [esp + 0x14], edi
and bx, word [edi + 0x54]
mov eax, ebx
mov dword [esp + 0x18], ebx
xor eax, 0x43
mov esi, ebx
mov word [edi], ax
xor esi, 0x6e
mov eax, ebx
mov word [edi + 0xc], si
xor eax, 0x6f
movzx ebp, ax
mov word [edi + 2], ax
mov eax, ebx
xor eax, 0x75
mov word [edi + 0xe], bp
mov word [edi + 4], ax
mov eax, ebx
xor eax, 0x6c
mov word [edi + 6], ax
mov eax, ebx
xor eax, 0x64
movzx ecx, ax
mov word [edi + 8], ax
mov eax, ebx
xor eax, 0x20
movzx edx, ax
mov word [edi + 0xa], ax
mov eax, ebx
xor eax, 0x74
mov dword [esp + 0x1c], edx
mov edx, dword [esp + 0x14]
xor ebx, 0x61
movzx edi, ax
mov dword [esp + 0x20], ebx
mov word [edx + 0x10], ax
mov eax, dword [esp + 0x14]
mov edx, dword [esp + 0x1c]
mov word [eax + 0x12], dx
mov word [eax + 0x16], cx
mov word [eax + 0x18], cx
mov word [eax + 0x1a], dx
mov edx, dword [esp + 0x14]
mov word [eax + 0x14], bx
mov ebx, dword [esp + 0x14]
mov word [eax + 0x1c], di
mov eax, dword [esp + 0x18]
mov ecx, eax
xor eax, 0x65
xor ecx, 0x68
mov word [ebx + 0x20], ax
mov word [edx + 0x1e], cx
movzx edx, ax
mov eax, dword [esp + 0x1c]
mov word [ebx + 0x22], ax
mov eax, dword [esp + 0x18]
xor eax, 0x69
mov word [ebx + 0x24], ax
mov eax, dword [esp + 0x18]
xor eax, 0x63
mov word [ebx + 0x26], ax
mov eax, ebx
mov word [eax + 0x2a], si
mov esi, dword [esp + 0x1c]
mov word [eax + 0x28], bp
mov word [eax + 0x30], bp
mov ebp, dword [esp + 0x18]
mov word [eax + 0x2c], si
mov word [eax + 0x2e], di
mov word [eax + 0x32], si
mov word [eax + 0x34], di
mov word [eax + 0x36], cx
mov word [eax + 0x38], dx
mov word [eax + 0x3a], si
mov eax, ebp
xor eax, 0x73
mov ecx, ebx
mov word [ebx + 0x40], ax
mov word [ecx + 0x3c], ax
mov eax, ebx
mov ecx, ebp
xor ecx, 0x79
mov word [ebx + 0x3e], cx
mov word [eax + 0x44], dx
mov edx, ebx
mov ebx, dword [esp + 0x20]
mov word [eax + 0x42], di
mov eax, ebp
xor eax, 0x6d
xor ebp, 0x72
mov word [edx + 0x46], ax
mov eax, dword fs:[0x2c]
mov word [edx + 0x4a], di
mov word [edx + 0x48], si
mov word [edx + 0x4c], bp
mov edi, dword [eax]
mov word [edx + 0x4e], bx
mov word [edx + 0x50], cx
mov eax, dword [0x639768]
cmp eax, dword [edi + 4]
jle 0x44c3eb
push 0x639768
call fcn.0049a967
add esp, 4
cmp dword [0x639768], 0xffffffff
jne 0x44c3eb
push 0x29
mov ecx, 0x630e98
call fcn.00432ca0
push 0x639768
call fcn.0049a916
add esp, 4
mov ecx, 0x630e98
call fcn.00436b40
mov ecx, dword [0x62d3ec]
mov esi, eax
cmp ecx, dword [edi + 4]
jle 0x44c434
push 0x62d3ec
call fcn.0049a967
add esp, 4
cmp dword [0x62d3ec], 0xffffffff
jne 0x44c434
push 0x52
mov ecx, 0x6335b0
call fcn.00432ca0
push 0x62d3ec
call fcn.0049a916
add esp, 4
mov ecx, 0x6335b0
call fcn.00436b40
mov ecx, dword [esp + 0x14]
shl eax, 0x10
pop edi
xor eax, esi
pop esi
pop ebp
mov dword [ecx + 0x54], eax
mov eax, ecx
pop ebx
add esp, 0x14
ret 8
Function at 0x44cbf0
Capabilities:
Hash data using fnv

Disassembly:
sub esp, 0x10
mov edx, dword [esp + 0x14]
mov eax, 0x1fffffff
push ebx
mov ebx, ecx
bsr ecx, eax
push ebp
push esi
push edi
mov edi, 1
mov dword [esp + 0x14], ebx
mov eax, edi
shl eax, cl
cmp edx, eax
jbe 0x44cc21
push str.invalid_hash_bucket_count
call dword [sym.imp.MSVCP140.dll_void___cdecl_std::_Xlength_error_char_const__]
mov esi, dword [ebx + 4]
lea eax, [edx - 1]
or eax, 1
lea ebp, [ebx + 0xc]
bsr ecx, eax
push esi
lea ecx, [ecx + 1]
shl edi, cl
mov ecx, ebp
lea eax, [edi + edi]
push eax
call fcn.004337d0
lea eax, [edi - 1]
mov dword [ebx + 0x1c], edi
mov dword [ebx + 0x18], eax
mov eax, dword [ebx + 4]
mov eax, dword [eax]
mov ecx, eax
cmp eax, esi
je 0x44cd2e
nop dword [eax]
movzx edx, byte [eax + 8]
xor edx, 0x811c9dc5
mov ecx, dword [ecx]
imul edi, edx, 0x1000193
movzx edx, byte [eax + 9]
xor edi, edx
movzx edx, byte [eax + 0xa]
imul edi, edi, 0x1000193
xor edi, edx
movzx edx, byte [eax + 0xb]
imul edi, edi, 0x1000193
xor edi, edx
imul edx, edi, 0x1000193
mov edi, dword [ebx + 0x18]
and edi, edx
mov edx, dword [ebp]
lea ebp, [edx + edi*8]
mov edi, dword [ebp]
mov dword [esp + 0x18], ebp
cmp edi, esi
jne 0x44ccb4
mov dword [ebp], eax
mov dword [ebp + 4], eax
jmp 0x44cd21
mov edx, dword [ebp + 4]
mov ebx, dword [eax + 8]
cmp ebx, dword [edx + 8]
jne 0x44ccee
mov edx, dword [edx]
mov dword [esp + 0x1c], edx
cmp edx, eax
je 0x44cce9
mov ebx, dword [eax + 4]
mov ebp, dword [esp + 0x1c]
mov dword [ebx], ecx
mov edi, dword [ecx + 4]
mov dword [edi], edx
mov edx, dword [edx + 4]
mov dword [edx], eax
mov dword [ebp + 4], edi
mov ebp, dword [esp + 0x18]
mov dword [ecx + 4], ebx
mov dword [eax + 4], edx
mov dword [ebp + 4], eax
jmp 0x44cd1d
cmp edi, edx
je 0x44ccfe
mov edx, dword [edx + 4]
cmp ebx, dword [edx + 8]
je 0x44cd38
cmp edi, edx
jne 0x44ccf2
mov ebp, dword [eax + 4]
mov dword [ebp], ecx
mov ebx, dword [ecx + 4]
mov dword [ebx], edx
mov edi, dword [edx + 4]
mov dword [edi], eax
mov dword [edx + 4], ebx
mov edx, dword [esp + 0x18]
mov dword [ecx + 4], ebp
mov dword [eax + 4], edi
mov dword [edx], eax
mov ebx, dword [esp + 0x14]
lea ebp, [ebx + 0xc]
mov eax, ecx
cmp ecx, esi
jne 0x44cc60
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret 4
mov ebx, dword [eax + 4]
mov ebp, dword [edx]
mov dword [ebx], ecx
mov edi, dword [ecx + 4]
mov dword [edi], ebp
mov edx, dword [ebp + 4]
mov dword [edx], eax
mov dword [ebp + 4], edi
mov dword [ecx + 4], ebx
mov dword [eax + 4], edx
jmp 0x44cd1d