joyce8/EMBER2024-capa huggingface dataset:
Function at 0x46a280
Capabilities:
Access peb ldr_data

Disassembly:
sub esp, 0x34
mov eax, dword [esp + 0x38]
test eax, eax
je 0x46a380
mov eax, dword [0x1898054]
mov eax, dword fs:[eax]
mov eax, dword [eax]
mov eax, dword [eax + 0x18]
mov dword [esp + 0x28], eax
mov ecx, dword [eax + 0x98]
mov edx, dword [eax + 0x9c]
lea ebx, [eax + 0x1d0]
mov dword [esp + 0x30], ebx
lea ebp, [eax + 0x318]
mov dword [esp + 0x2c], ebp
add ecx, 1
mov dword [eax + 0x98], ecx
adc edx, 0
mov dword [eax + 0x9c], edx
mov ecx, dword [eax + 0xa8]
mov dword [ecx], 0
call fcn.00470140
mov eax, dword [esp + 0x28]
mov dword [esp], eax
call fcn.00438a90
mov eax, dword [esp + 0x28]
mov byte [eax + 0x8c], 1
inc dword [eax + 0xa0]
mov ecx, dword [esp + 0x38]
mov dword [esp], ecx
mov edx, dword [esp + 0x3c]
mov dword [esp + 4], edx
call fcn.00476790
mov eax, dword [esp + 8]
mov dword [esp + 0x24], eax
mov ecx, dword [esp + 0x28]
mov byte [ecx + 0x8c], 0
dec dword [ecx + 0xa0]
nop
mov edx, dword [esp + 0x2c]
mov dword [esp], edx
mov dword [esp + 4], 0
call fcn.0047d1f0
lea edi, [esp + 0xc]
mov esi, dword [esp + 0x30]
call fcn.004772a4
call fcn.004702f0
mov eax, dword [0x1898054]
mov eax, dword fs:[eax]
mov eax, dword [eax]
mov eax, dword [eax + 0x18]
test byte [eax], al
lea edi, [eax + 0x1d0]
lea esi, [esp + 0xc]
call fcn.004772a4
mov eax, dword [esp + 0x24]
mov dword [esp + 0x40], eax
add esp, 0x34
ret
lea eax, [0xea0129]
mov dword [esp], eax
mov dword [esp + 4], 0xb
call fcn.0046fe20
nop
int3
Function at 0x472fe0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov ecx, dword [0x1898054]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x47315a
sub esp, 0x10
mov ecx, dword [esp + 0x18]
test ecx, ecx
jbe 0x473150
mov edx, dword [esp + 0x14]
movzx ebx, byte [edx]
test ebx, ebx
jne 0x47303a
movzx ebp, byte [esp + 0x28]
xchg ebp, eax
test al, al
xchg ebp, eax
jne 0x47303a
mov dword [esp + 0x2c], 0
mov dword [esp + 0x30], 0
mov dword [esp + 0x34], 0
mov byte [esp + 0x38], 0
add esp, 0x10
ret
test ebx, 0x80
je 0x47304d
xor eax, eax
xor ebx, ebx
xor ebp, ebp
jmp 0x473127
mov eax, 1
mov ebp, ebx
and ebx, 1
neg ebx
shr ebp, 1
xor ebx, ebp
mov ebp, dword [esp + 0x24]
add dword [ebp], ebx
cmp ecx, eax
jb 0x47311b
sub ecx, eax
mov ebx, dword [esp + 0x1c]
sub ebx, eax
mov ebp, ebx
neg ebx
sar ebx, 0x1f
and eax, ebx
lea ebx, [edx + eax]
test ecx, ecx
jbe 0x473112
movzx edx, byte [edx + eax]
test edx, 0x80
je 0x4730a0
mov dword [esp + 0xc], ecx
xor eax, eax
xor edx, edx
xor esi, esi
jmp 0x4730e3
mov eax, 1
cmp eax, ecx
ja 0x4730d7
mov esi, dword [esp + 0x20]
add dword [esi], edx
sub ebp, eax
sub ecx, eax
mov edx, ebp
xchg ebp, ebx
neg ebx
xchg ebp, ebx
sar ebp, 0x1f
and eax, ebp
add eax, ebx
mov dword [esp + 0x2c], eax
mov dword [esp + 0x30], ecx
mov dword [esp + 0x34], edx
mov byte [esp + 0x38], 1
add esp, 0x10
ret
call fcn.00476bf0
lea esi, [ecx + 7]
mov ecx, dword [esp + 0xc]
cmp eax, ecx
jae 0x47310d
movzx edi, byte [eax + ebx]
xchg edi, eax
mov byte [esp + 0xb], al
xchg edi, eax
and edi, 0x7f
mov ecx, esi
shl edi, cl
inc eax
or edx, edi
movzx edi, byte [esp + 0xb]
xchg edi, eax
test al, 0x80
xchg edi, eax
jne 0x4730dc
mov ecx, dword [esp + 0xc]
jmp 0x4730a5
call fcn.00476b90
xor eax, eax
mov ecx, eax
call fcn.00476b80
call fcn.00476bf0
lea ebp, [ecx + 7]
mov ecx, dword [esp + 0x18]
cmp ecx, eax
jbe 0x47314b
movzx esi, byte [eax + edx]
mov edi, esi
and esi, 0x7f
mov ecx, ebp
shl esi, cl
inc eax
or ebx, esi
xchg edi, eax
test al, 0x80
xchg edi, eax
jne 0x473120
mov ecx, dword [esp + 0x18]
jmp 0x473052
call fcn.00476b90
xor eax, eax
mov ecx, eax
call fcn.00476b80
nop
call fcn.00475700
jmp fcn.00472fe0
Function at 0x4749b0
Capabilities:
Access peb ldr_data

Disassembly:
mov ecx, dword [0x1898054]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x474a4b
sub esp, 0x30
lea ecx, [esp + 0x34]
mov dword [esp + 4], ecx
mov edx, dword [0x1898054]
mov edx, dword fs:[edx]
mov edx, dword [edx]
mov dword [esp + 8], 0
lea edi, [esp + 0xc]
xor eax, eax
call fcn.00476dc7
lea ecx, [0x45dfb0]
mov dword [esp + 0xc], ecx
mov ecx, dword [esp + 0x30]
mov dword [esp + 0x10], ecx
mov ecx, dword [esp + 4]
mov dword [esp + 0x14], ecx
mov dword [esp + 0x18], edx
lea ecx, [esp + 8]
mov dword [esp + 0x1c], ecx
mov ecx, dword [esp + 0x34]
mov dword [esp + 0x20], ecx
mov ecx, dword [esp + 0x3c]
mov dword [esp + 0x28], ecx
mov ecx, dword [esp + 0x40]
mov dword [esp + 0x2c], ecx
mov ecx, dword [esp + 0x38]
mov dword [esp + 0x24], ecx
lea ecx, [esp + 0xc]
mov dword [esp], ecx
call fcn.00475610
mov ecx, dword [esp + 8]
mov dword [esp + 0x44], ecx
add esp, 0x30
ret
call fcn.00475700
jmp fcn.004749b0
Function at 0x4769b0
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
movd xmm0, dword [esp + 8]
pinsrw xmm0, ebx, 4
pshufhw xmm0, xmm0, 0
movdqa xmm1, xmm0
pxor xmm0, xmmword [0x1898ac0]
aesenc xmm0, xmm0
cmp ebx, 0x10
jb 0x47513b
je 0x47518e
cmp ebx, 0x20
jbe 0x475194
cmp ebx, 0x40
jbe 0x4751da
jmp 0x47527b
test ebx, ebx
je 0x475184
add eax, 0x10
test ax, 0xff0
je 0x475170
movdqu xmm1, xmmword [eax - 0x10]
add ebx, ebx
pand xmm1, xmmword [ebx*8 + 0x116c640]
pxor xmm1, xmm0
aesenc xmm1, xmm1
aesenc xmm1, xmm1
aesenc xmm1, xmm1
movd dword [edx], xmm1
ret
movdqu xmm1, xmmword [eax + ebx - 0x20]
add ebx, ebx
pshufb xmm1, xmmword [ebx*8 + 0x116c740]
jmp 0x475158
aesenc xmm0, xmm0
movd dword [edx], xmm0
ret
movdqu xmm1, xmmword [eax]
jmp 0x475158
pxor xmm1, xmmword [0x1898ad0]
aesenc xmm1, xmm1
movdqu xmm2, xmmword [eax]
movdqu xmm3, xmmword [eax + ebx - 0x10]
pxor xmm2, xmm0
pxor xmm3, xmm1
aesenc xmm2, xmm2
aesenc xmm3, xmm3
aesenc xmm2, xmm2
aesenc xmm3, xmm3
aesenc xmm2, xmm2
aesenc xmm3, xmm3
pxor xmm2, xmm3
movd dword [edx], xmm2
ret
movdqa xmm2, xmm1
movdqa xmm3, xmm1
pxor xmm1, xmmword [0x1898ad0]
pxor xmm2, xmmword [0x1898ae0]
pxor xmm3, xmmword [0x1898af0]
aesenc xmm1, xmm1
aesenc xmm2, xmm2
aesenc xmm3, xmm3
movdqu xmm4, xmmword [eax]
movdqu xmm5, xmmword [eax + 0x10]
movdqu xmm6, xmmword [eax + ebx - 0x20]
movdqu xmm7, xmmword [eax + ebx - 0x10]
pxor xmm4, xmm0
pxor xmm5, xmm1
pxor xmm6, xmm2
pxor xmm7, xmm3
aesenc xmm4, xmm4
aesenc xmm5, xmm5
aesenc xmm6, xmm6
aesenc xmm7, xmm7
aesenc xmm4, xmm4
aesenc xmm5, xmm5
aesenc xmm6, xmm6
aesenc xmm7, xmm7
aesenc xmm4, xmm4
aesenc xmm5, xmm5
aesenc xmm6, xmm6
aesenc xmm7, xmm7
pxor xmm4, xmm6
pxor xmm5, xmm7
pxor xmm4, xmm5
movd dword [edx], xmm4
ret
movdqa xmm2, xmm1
movdqa xmm3, xmm1
pxor xmm1, xmmword [0x1898ad0]
pxor xmm2, xmmword [0x1898ae0]
pxor xmm3, xmmword [0x1898af0]
aesenc xmm1, xmm1
aesenc xmm2, xmm2
aesenc xmm3, xmm3
movdqu xmm4, xmmword [eax + ebx - 0x40]
movdqu xmm5, xmmword [eax + ebx - 0x30]
movdqu xmm6, xmmword [eax + ebx - 0x20]
movdqu xmm7, xmmword [eax + ebx - 0x10]
aesenc xmm4, xmm0
aesenc xmm5, xmm1
aesenc xmm6, xmm2
aesenc xmm7, xmm3
dec ebx
shr ebx, 6
movdqu xmm0, xmmword [eax]
movdqu xmm1, xmmword [eax + 0x10]
movdqu xmm2, xmmword [eax + 0x20]
movdqu xmm3, xmmword [eax + 0x30]
aesenc xmm4, xmm0
aesenc xmm5, xmm1
aesenc xmm6, xmm2
aesenc xmm7, xmm3
aesenc xmm4, xmm4
aesenc xmm5, xmm5
aesenc xmm6, xmm6
aesenc xmm7, xmm7
add eax, 0x40
dec ebx
jne 0x4752da
aesenc xmm4, xmm4
aesenc xmm5, xmm5
aesenc xmm6, xmm6
aesenc xmm7, xmm7
aesenc xmm4, xmm4
aesenc xmm5, xmm5
aesenc xmm6, xmm6
aesenc xmm7, xmm7
aesenc xmm4, xmm4
aesenc xmm5, xmm5
aesenc xmm6, xmm6
aesenc xmm7, xmm7
pxor xmm4, xmm6
pxor xmm5, xmm7
pxor xmm4, xmm5
movd dword [edx], xmm4
ret
cmp byte [0x1897d89], 0
je 0x4769ca
mov eax, dword [esp + 4]
mov ebx, dword [esp + 0xc]
lea edx, [esp + 0x10]
jmp 0x475100
jmp fcn.0040c950
Function at 0x4ca070
Capabilities:
Get geographical location

Disassembly:
mov ecx, dword [0x1898054]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
lea eax, [esp - 0x24]
cmp eax, dword [ecx + 8]
jbe 0x4ca236
sub esp, 0xa4
lea eax, [0xd6b120]
mov dword [esp], eax
call fcn.0040f770
mov eax, dword [esp + 4]
mov dword [esp + 0xa0], eax
nop
mov dword [esp], 1
mov dword [esp + 8], 5
mov dword [esp + 0xc], 5
call fcn.004749b0
mov ecx, dword [esp + 0x10]
cmp ecx, 5
ja 0x4ca22b
mov dword [esp + 0x38], ecx
lea eax, [0xe04fc0]
mov dword [esp], eax
call fcn.0040f770
mov eax, dword [esp + 4]
mov ecx, dword [esp + 0x38]
mov dword [eax + 4], ecx
mov dword [eax + 8], 5
mov ecx, dword [0x1898608]
lea edx, [eax + 0x1c]
test ecx, ecx
jne 0x4ca10b
mov ecx, dword [esp + 0xa0]
jmp 0x4ca11c
call fcn.00476b10
mov ecx, dword [esp + 0xa0]
mov dword [edi], ecx
mov dword [edi + 4], edx
mov dword [esp + 0x44], eax
mov dword [eax], ecx
mov dword [eax + 0x14], 0
mov dword [eax + 0x18], 2
mov dword [eax + 0x10], edx
lea edi, [esp + 0x48]
xor eax, eax
call fcn.00476dc5
jmp 0x4ca142
xor eax, eax
lea edi, [esp + 0x74]
call fcn.00476dc5
mov ecx, dword [esp + 0x44]
mov dword [esp], ecx
call fcn.00455de0
movzx ecx, byte [esp + 0x30]
mov byte [esp + 0x37], cl
lea edi, [esp + 0x74]
lea esi, [esp + 4]
call fcn.00477272
lea edi, [esp + 0x48]
lea esi, [esp + 0x74]
call fcn.00477272
mov ecx, dword [esp + 0x54]
mov edx, dword [esp + 0x50]
cmp ecx, 0xe
jg 0x4ca18b
xor eax, eax
jmp 0x4ca1ba
mov dword [esp + 0x3c], ecx
mov dword [esp + 0x40], edx
mov dword [esp], edx
lea eax, [0xea4764]
mov dword [esp + 4], eax
mov dword [esp + 8], 0xe
call fcn.004066c0
movzx eax, byte [esp + 0xc]
mov ecx, dword [esp + 0x3c]
mov edx, dword [esp + 0x40]
test al, al
je 0x4ca1de
cmp ecx, 0xe
jb 0x4ca221
je 0x4ca1de
lea ebx, [ecx - 0xe]
neg ebx
sar ebx, 0x1f
and ebx, 0xe
movzx ebx, byte [edx + ebx]
cmp bl, 0x41
jb 0x4ca1de
cmp bl, 0x5a
jbe 0x4ca1ed
movzx ecx, byte [esp + 0x37]
test cl, cl
jne 0x4ca140
jmp 0x4ca202
mov dword [esp + 0xa8], edx
mov dword [esp + 0xac], ecx
add esp, 0xa4
ret
lea eax, [0xea4772]
mov dword [esp + 0xa8], eax
mov dword [esp + 0xac], 0xe
add esp, 0xa4
ret
mov eax, 0xe
call fcn.00476be0
mov edx, 5
call fcn.00476ba0
nop
call fcn.00475700
jmp fcn.004ca070
Function at 0x4d3590
Capabilities:
Get geographical location

Disassembly:
mov ecx, dword [0x1898054]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x4d3662
sub esp, 0x24
mov eax, dword [esp + 0x30]
test eax, 0x1f
je 0x4d364c
test eax, eax
je 0x4d35cd
test eax, 0x200
jne 0x4d35cd
lea eax, [0x116be94]
mov ecx, dword [esp + 0x28]
jmp 0x4d35ed
mov ecx, dword [esp + 0x28]
mov dword [esp], ecx
mov ecx, dword [esp + 0x2c]
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
call fcn.004d38c0
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 0x10]
mov eax, dword [eax + 0x94]
mov dword [esp], ecx
call eax
mov eax, dword [esp + 4]
mov ecx, dword [esp + 8]
mov dword [esp], 0
lea edx, [0x115ce28]
mov dword [esp + 4], edx
mov dword [esp + 8], 1
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], ecx
lea eax, [0xe9a9e9]
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], 7
call fcn.00454cf0
mov eax, dword [esp + 0x1c]
mov ecx, dword [esp + 0x20]
mov dword [esp + 0x34], eax
mov dword [esp + 0x38], ecx
add esp, 0x24
ret
lea eax, [0xea5d1d]
mov dword [esp + 0x34], eax
mov dword [esp + 0x38], 0xf
add esp, 0x24
ret
call fcn.00475700
jmp fcn.004d3590
Function at 0x402780
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, ecx
push edi
cmp byte [ebx], 0
mov dword [ebp - 0xc], esi
je 0x4027ea
mov bl, byte [ebx + 1]
mov ecx, dword [esi + 0x18]
movzx eax, bl
xor eax, 0x811c9dc5
imul eax, eax, 0x1000193
and ecx, eax
mov eax, dword [esi + 0xc]
mov esi, dword [esi + 4]
mov edi, dword [eax + ecx*8]
mov edx, edi
lea ecx, [eax + ecx*8]
nop word [eax + eax]
cmp edi, esi
jne 0x4027c8
mov eax, esi
jmp 0x4027cd
mov eax, dword [ecx + 4]
mov eax, dword [eax]
cmp edx, eax
je 0x4027da
cmp byte [edx + 8], bl
je 0x4027dc
mov edx, dword [edx]
jmp 0x4027c0
mov edx, esi
pop edi
cmp edx, esi
pop esi
setne al
pop ebx
mov esp, ebp
pop ebp
ret 4
mov edi, dword [ebx + 0x14]
add ebx, 4
mov dword [ebp - 8], edi
mov esi, ebx
cmp dword [ebx + 0x14], 0x10
jb 0x4027fd
mov esi, dword [ebx]
xor ecx, ecx
mov edx, 0x811c9dc5
test edi, edi
je 0x402819
movzx eax, byte [ecx + esi]
inc ecx
xor eax, edx
imul edx, eax, 0x1000193
cmp ecx, edi
jb 0x402808
mov edi, dword [ebp - 0xc]
mov eax, dword [edi + 0x38]
mov ecx, dword [edi + 0x2c]
and eax, edx
mov edi, dword [edi + 0x24]
mov edx, dword [ecx + eax*8]
lea eax, [eax*8 + 4]
add eax, ecx
mov dword [ebp - 0x10], edx
mov esi, edx
mov dword [ebp - 0x14], eax
nop dword [eax + eax]
cmp edx, edi
jne 0x402848
mov eax, edi
jmp 0x40284c
mov eax, dword [eax]
mov eax, dword [eax]
cmp esi, eax
je 0x4028b6
cmp dword [ebx + 0x14], 0x10
lea ecx, [esi + 8]
mov eax, ebx
jb 0x40285d
mov eax, dword [ebx]
mov edx, dword [ecx + 0x10]
mov dword [ebp - 4], edx
mov edx, dword [ecx + 0x14]
mov dword [ebp - 0x18], edx
cmp edx, 0x10
jb 0x402870
mov ecx, dword [ecx]
push dword [ebp - 8]
mov edx, dword [ebp - 4]
push eax
call fcn.004137a0
add esp, 8
test al, al
jne 0x40288d
mov esi, dword [esi]
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x14]
jmp 0x402840
cmp dword [ebp - 0x18], 0x10
lea eax, [esi + 8]
jb 0x402898
mov eax, dword [eax]
cmp dword [ebx + 0x14], 0x10
jb 0x4028a0
mov ebx, dword [ebx]
push dword [ebp - 4]
mov edx, dword [ebp - 8]
mov ecx, ebx
push eax
call fcn.004137a0
add esp, 8
test al, al
cmovne edi, esi
mov eax, dword [ebp - 0xc]
cmp edi, dword [eax + 0x24]
pop edi
pop esi
setne al
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x404980
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x46db4b
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x48b084]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
push dword [ebp + 8]
lea ecx, [esi + 0xc]
mov dword [esi], vtable..17.0
mov dword [esi + 4], 0
mov byte [esi + 8], 0
call fcn.0040af10
mov dword [ebp - 4], 0
mov dword [esi], vtable.W.0
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x2c], 0
lea edi, [esi + 0x30]
mov dword [edi + 0x24], 0
mov dword [ebp + 8], edi
mov eax, dword [ebp + 0xc]
mov byte [ebp - 4], 2
mov ecx, dword [eax + 0x24]
test ecx, ecx
je 0x404a0b
mov eax, dword [ecx]
push edi
call dword [eax]
mov dword [edi + 0x24], eax
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 0xc

Function at 0x405230
Capabilities:
Get number of processors

Disassembly:
mov edx, dword [ecx]
mov eax, dword [ecx + 0x88]
push esi
lea esi, [ecx + 8]
lea ecx, [esi + 0x64]
mov dword [edx + 0x11c], eax
call fcn.0040c040
lea ecx, [esi + 0x58]
call fcn.0040c040
mov ecx, esi
pop esi
jmp fcn.00404a20
Function at 0x40cd50
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x46d570
mov eax, dword fs:[0]
push eax
push esi
push edi
mov eax, dword [0x48b084]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
push 8
mov dword [edi], 0x4723a4
call fcn.004470ea
mov esi, eax
xorps xmm0, xmm0
movq qword [esi], xmm0
push 1
mov dword [ebp - 4], 0
call fcn.0042ec38
mov dword [esi + 4], eax
lea ecx, [edi + 8]
lea eax, [edi + 4]
mov dword [edi + 0x34], esi
mov dword [edi + 0xc], eax
add esp, 8
lea eax, [edi + 0x14]
mov dword [edi + 0x10], ecx
mov dword [edi + 0x1c], eax
lea eax, [edi + 0x18]
mov dword [edi + 0x20], eax
lea eax, [edi + 0x24]
mov dword [edi + 0x2c], eax
lea eax, [edi + 0x28]
mov dword [edi + 0x30], eax
mov dword [ecx], 0
mov eax, dword [edi + 0x20]
mov dword [eax], 0
mov eax, dword [edi + 0x30]
mov dword [eax], 0
mov eax, dword [edi + 0xc]
mov dword [eax], 0
mov eax, dword [edi + 0x1c]
mov dword [eax], 0
mov eax, dword [edi + 0x2c]
mov dword [eax], 0
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x410e20
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x46ec90
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
mov eax, dword [0x48b084]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov eax, ecx
mov dword [ebp - 0x1c], eax
mov edi, dword [ebp + 0xc]
mov esi, edi
mov ebx, dword [ebp + 8]
mov dword [ebp - 4], 0
mov dword [ebp - 0x28], eax
cmp dword [edi + 0x14], 0x10
jb 0x410e6d
mov esi, dword [edi]
xor ecx, ecx
mov edx, 0x811c9dc5
cmp dword [edi + 0x10], ecx
jbe 0x410e95
nop dword [eax]
movzx eax, byte [ecx + esi]
inc ecx
xor eax, edx
imul edx, eax, 0x1000193
cmp ecx, dword [edi + 0x10]
jb 0x410e80
mov eax, dword [ebp - 0x1c]
mov ecx, dword [eax + 0x18]
mov eax, dword [eax + 0xc]
and ecx, edx
mov dword [ebp - 0x24], ecx
lea ecx, [eax + ecx*8]
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x20], ecx
mov esi, dword [eax + 4]
cmp esi, dword [ecx]
je 0x410f0e
mov esi, dword [ecx + 4]
mov esi, dword [esi]
cmp esi, dword [ecx]
je 0x410f0e
mov esi, dword [esi + 4]
cmp dword [esi + 0x1c], 0x10
lea eax, [esi + 8]
mov edx, dword [eax + 0x10]
jb 0x410eca
mov eax, dword [eax]
cmp dword [edi + 0x14], 0x10
mov ecx, edi
jb 0x410ed4
mov ecx, dword [edi]
push edx
mov edx, dword [edi + 0x10]
push eax
call fcn.004137a0
mov ecx, dword [ebp - 0x20]
add esp, 8
test al, al
je 0x410eb5
mov dword [ebx], esi
mov byte [ebx + 4], 0
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.00446e47
mov esp, ebp
pop ebp
ret 0xc
mov ecx, dword [ebp - 0x1c]
mov dword [ebp - 4], 0xffffffff
push edi
mov eax, dword [ecx + 4]
mov eax, dword [eax]
mov dword [ebp - 0x20], eax
mov ecx, dword [eax + 4]
push ecx
push eax
mov dword [ebp - 0x18], ecx
call fcn.00414d20
mov edx, dword [ebp - 0x1c]
mov edi, eax
mov ecx, 0x7fffffe
mov eax, dword [edx + 8]
sub ecx, eax
cmp ecx, 1
jb 0x410fd0
inc eax
mov dword [edx + 8], eax
mov eax, dword [ebp - 0x20]
mov dword [eax + 4], edi
mov eax, dword [ebp - 0x18]
mov dword [eax], edi
mov edi, dword [edx + 4]
mov edi, dword [edi]
mov dword [ebp - 0x18], edi
mov eax, dword [edi]
cmp esi, eax
je 0x410f87
mov ecx, dword [edi + 4]
mov dword [ecx], eax
mov ecx, dword [eax + 4]
mov dword [ecx], esi
mov ecx, dword [esi + 4]
mov dword [ecx], edi
mov edx, dword [esi + 4]
mov ecx, dword [eax + 4]
mov dword [esi + 4], ecx
mov ecx, dword [edi + 4]
mov dword [eax + 4], ecx
mov dword [edi + 4], edx
mov edx, dword [ebp - 0x1c]
push dword [ebp - 0x24]
mov ecx, edx
push esi
push edi
call fcn.00413a90
mov ecx, dword [ebp - 0x1c]
mov dword [ebp - 4], 2
call fcn.00413bc0
mov dword [ebx], edi
mov byte [ebx + 4], 1
jmp 0x410eee
push str.list_T__too_long
call fcn.0042efae
int3
Function at 0x410fe0
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x46ecc0
mov eax, dword fs:[0]
push eax
sub esp, 0x20
mov eax, dword [0x48b084]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov edi, ecx
mov dword [ebp - 0x20], edi
mov eax, dword [ebp + 0xc]
mov ebx, dword [ebp + 8]
mov dword [ebp - 4], 0
mov edx, dword [edi + 0x18]
mov cl, byte [eax]
mov dword [ebp - 0x24], eax
movzx eax, cl
xor eax, 0x811c9dc5
mov dword [ebp - 0x2c], edi
imul eax, eax, 0x1000193
and edx, eax
mov eax, dword [edi + 0xc]
mov dword [ebp - 0x1c], edx
lea esi, [eax + edx*8]
mov edx, dword [edi + 4]
mov eax, dword [esi]
cmp eax, edx
jne 0x411051
mov esi, edx
jmp 0x411056
mov esi, dword [esi + 4]
mov esi, dword [esi]
cmp esi, eax
je 0x411088
mov esi, dword [esi + 4]
cmp cl, byte [esi + 8]
jne 0x411056
mov dword [ebx], esi
mov byte [ebx + 4], 0
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.00446e47
mov esp, ebp
pop ebp
ret 0xc
push dword [ebp - 0x24]
mov dword [ebp - 4], 0xffffffff
mov eax, dword [edx]
mov dword [ebp - 0x28], eax
mov ecx, dword [eax + 4]
push ecx
push eax
mov dword [ebp - 0x18], ecx
call fcn.00414d00
mov edx, eax
mov ecx, 0x15555554
mov eax, dword [edi + 8]
sub ecx, eax
cmp ecx, 1
jb 0x411142
inc eax
mov dword [edi + 8], eax
mov eax, dword [ebp - 0x28]
mov dword [eax + 4], edx
mov eax, dword [ebp - 0x18]
mov dword [eax], edx
mov edi, dword [edi + 4]
mov edi, dword [edi]
mov dword [ebp - 0x18], edi
mov eax, dword [edi]
cmp esi, eax
je 0x4110f7
mov ecx, dword [edi + 4]
mov dword [ecx], eax
mov ecx, dword [eax + 4]
mov dword [ecx], esi
mov ecx, dword [esi + 4]
mov dword [ecx], edi
mov ecx, dword [eax + 4]
mov edx, dword [esi + 4]
mov dword [esi + 4], ecx
mov ecx, dword [edi + 4]
mov dword [eax + 4], ecx
mov dword [edi + 4], edx
push dword [ebp - 0x1c]
push esi
mov esi, dword [ebp - 0x20]
mov ecx, esi
push edi
call fcn.00413a90
mov ecx, esi
mov dword [ebp - 4], 2
call fcn.004139f0
mov dword [ebx], edi
mov byte [ebx + 4], 1
jmp 0x411068
push str.list_T__too_long
call fcn.0042efae
int3
Function at 0x413c60
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [0x48b084]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
cmp dword [edi + 0x1c], 0x10
lea edx, [edi + 8]
mov ebx, dword [edx + 0x10]
mov dword [ebp - 8], ecx
mov dword [ebp - 0xc], eax
jb 0x413c8d
mov edx, dword [edx]
xor ecx, ecx
mov esi, 0x811c9dc5
test ebx, ebx
je 0x413ca9
movzx eax, byte [ecx + edx]
inc ecx
xor eax, esi
imul esi, eax, 0x1000193
cmp ecx, ebx
jb 0x413c98
mov ebx, dword [ebp - 8]
mov eax, dword [ebx + 0x18]
mov ecx, dword [ebx + 0xc]
and eax, esi
lea edx, [eax*8]
mov eax, dword [ecx + edx]
add ecx, edx
cmp dword [ecx + 4], edi
jne 0x413ce2
cmp eax, edi
jne 0x413cda
mov eax, dword [ebx + 4]
mov dword [ecx], eax
mov ecx, dword [ebx + 0xc]
mov eax, dword [ebx + 4]
mov dword [edx + ecx + 4], eax
jmp 0x413cea
mov eax, dword [edi + 4]
mov dword [ecx + 4], eax
jmp 0x413cea
cmp eax, edi
jne 0x413ced
mov eax, dword [edi]
mov dword [ecx], eax
mov edi, dword [ebp + 0xc]
mov ecx, dword [edi + 4]
mov esi, dword [edi]
push edi
mov dword [ecx], esi
mov edx, dword [edi]
mov ecx, dword [edi + 4]
mov dword [edx + 4], ecx
dec dword [ebx + 8]
call fcn.0040d070
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
mov dword [eax], esi
pop esi
pop ebx
call fcn.00446e47
mov esp, ebp
pop ebp
ret 8
Function at 0x414970
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x46f080
mov eax, dword fs:[0]
push eax
sub esp, 0x18
mov eax, dword [0x48b084]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov edx, ecx
mov dword [ebp - 0x1c], edx
mov eax, dword [ebp + 0xc]
mov ebx, dword [ebp + 8]
mov dword [ebp - 4], 0
mov esi, dword [edx + 0x18]
mov cl, byte [eax]
movzx eax, cl
xor eax, 0x811c9dc5
mov dword [ebp - 0x24], edx
imul eax, eax, 0x1000193
and esi, eax
mov eax, dword [edx + 0xc]
mov dword [ebp - 0x20], esi
lea edi, [eax + esi*8]
mov esi, dword [edx + 4]
mov eax, dword [edi]
cmp esi, eax
je 0x414a35
mov esi, dword [edi + 4]
mov esi, dword [esi]
nop
cmp esi, eax
je 0x414a35
mov esi, dword [esi + 4]
cmp cl, byte [esi + 8]
jne 0x4149e0
mov edi, dword [ebp + 0x10]
push 0xc
push edi
mov ecx, dword [edi + 4]
mov eax, dword [edi]
mov dword [ecx], eax
mov edx, dword [edi]
mov ecx, dword [edi + 4]
mov dword [edx + 4], ecx
mov ecx, dword [ebp - 0x1c]
dec dword [ecx + 8]
call fcn.00447495
add esp, 8
mov dword [ebx], esi
mov byte [ebx + 4], 0
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.00446e47
mov esp, ebp
pop ebp
ret 0xc
mov edi, dword [ebp + 0x10]
mov dword [ebp - 0x18], edi
mov eax, dword [edi]
cmp esi, eax
je 0x414a65
mov ecx, dword [edi + 4]
mov dword [ecx], eax
mov ecx, dword [eax + 4]
mov dword [ecx], esi
mov ecx, dword [esi + 4]
mov dword [ecx], edi
mov edx, dword [esi + 4]
mov ecx, dword [eax + 4]
mov dword [esi + 4], ecx
mov ecx, dword [edi + 4]
mov dword [eax + 4], ecx
mov dword [edi + 4], edx
mov edx, dword [ebp - 0x1c]
push dword [ebp - 0x20]
mov ecx, edx
push esi
push edi
call fcn.00413a90
mov ecx, dword [ebp - 0x1c]
mov dword [ebp - 4], 2
call fcn.004139f0
mov dword [ebx], edi
mov byte [ebx + 4], 1
jmp 0x414a15