joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4b9210
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
mov dword [ebp - 8], ecx
mov esi, ebx
cmp dword [ebx + 0x14], 0x10
mov edi, dword [ebx + 0x10]
mov dword [ebp - 4], edi
jb 0x4b922f
mov esi, dword [ebx]
xor ecx, ecx
mov edx, 0x811c9dc5
test edi, edi
je 0x4b9251
nop word [eax + eax]
movzx eax, byte [ecx + esi]
inc ecx
xor eax, edx
imul edx, eax, 0x1000193
cmp ecx, edi
jb 0x4b9240
mov edi, dword [ebp - 8]
mov eax, dword [edi + 0x12c]
mov ecx, dword [edi + 0x120]
and eax, edx
mov edi, dword [edi + 0x118]
mov dword [ebp - 0xc], edi
mov esi, dword [ecx + eax*8]
add eax, eax
mov edx, dword [ecx + eax*4]
inc eax
mov dword [ebp - 0x10], edx
lea eax, [ecx + eax*4]
mov dword [ebp - 0x14], eax
nop dword [eax]
cmp edx, edi
jne 0x4b9288
mov eax, edi
jmp 0x4b928c
mov eax, dword [eax]
mov eax, dword [eax]
cmp esi, eax
je 0x4b92f9
cmp dword [ebx + 0x14], 0x10
mov edx, ebx
jb 0x4b929a
mov edx, dword [ebx]
mov edi, dword [esi + 0x1c]
lea ecx, [esi + 8]
mov dword [ebp - 0x18], edi
cmp edi, 0x10
mov edi, dword [ebp - 0xc]
jb 0x4b92ae
mov ecx, dword [esi + 8]
push dword [ebp - 4]
mov eax, dword [esi + 0x18]
push edx
mov edx, eax
mov dword [ebp - 0x1c], eax
call fcn.0040a610
add esp, 8
test al, al
jne 0x4b92d0
mov esi, dword [esi]
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x14]
jmp 0x4b9280
cmp dword [ebp - 0x18], 0x10
lea eax, [esi + 8]
jb 0x4b92db
mov eax, dword [eax]
cmp dword [ebx + 0x14], 0x10
jb 0x4b92e3
mov ebx, dword [ebx]
push dword [ebp - 0x1c]
mov edx, dword [ebp - 4]
mov ecx, ebx
push eax
call fcn.0040a610
add esp, 8
test al, al
cmovne edi, esi
mov ecx, dword [ebp - 8]
cmp edi, dword [ecx + 0x118]
je 0x4b9310
mov eax, dword [edi + 0x20]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x4bb2f0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 4], ecx
mov esi, ebx
cmp dword [ebx + 0x14], 0x10
mov edi, dword [ebx + 0x10]
mov dword [ebp - 0xc], eax
jb 0x4bb312
mov esi, dword [ebx]
xor ecx, ecx
mov edx, 0x811c9dc5
test edi, edi
je 0x4bb331
nop dword [eax]
movzx eax, byte [ecx + esi]
inc ecx
xor eax, edx
imul edx, eax, 0x1000193
cmp ecx, edi
jb 0x4bb320
mov edi, dword [ebp - 4]
mov eax, dword [edi + 0x18]
mov ecx, dword [edi + 0xc]
and eax, edx
mov edi, dword [edi + 4]
mov dword [ebp - 0x10], edi
mov esi, dword [ecx + eax*8]
add eax, eax
mov edx, dword [ecx + eax*4]
inc eax
mov dword [ebp - 0x14], edx
lea eax, [ecx + eax*4]
mov dword [ebp - 0x18], eax
cmp edx, edi
jne 0x4bb35c
mov eax, edi
jmp 0x4bb360
mov eax, dword [eax]
mov eax, dword [eax]
cmp esi, eax
je 0x4bb3e2
cmp dword [ebx + 0x14], 0x10
mov edx, ebx
jb 0x4bb36e
mov edx, dword [ebx]
mov edi, dword [esi + 0x1c]
lea ecx, [esi + 8]
mov dword [ebp - 0x1c], edi
cmp edi, 0x10
mov edi, dword [ebp - 0x10]
jb 0x4bb382
mov ecx, dword [esi + 8]
push dword [ebx + 0x10]
mov eax, dword [esi + 0x18]
push edx
mov edx, eax
mov dword [ebp - 8], eax
call fcn.0040a610
add esp, 8
test al, al
jne 0x4bb3a4
mov esi, dword [esi]
mov edx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x18]
jmp 0x4bb354
cmp dword [ebp - 0x1c], 0x10
lea eax, [esi + 8]
jb 0x4bb3af
mov eax, dword [eax]
cmp dword [ebx + 0x14], 0x10
mov ecx, ebx
jb 0x4bb3b9
mov ecx, dword [ebx]
push dword [ebp - 8]
mov edx, dword [ebx + 0x10]
push eax
call fcn.0040a610
add esp, 8
test al, al
jne 0x4bb3d5
test al, al
mov ecx, edi
cmovne edi, esi
jmp 0x4bb3e4
mov ecx, dword [ebp - 4]
test al, al
cmovne edi, esi
mov ecx, dword [ecx + 4]
jmp 0x4bb3e4
mov ecx, edi
mov eax, edi
cmp edi, ecx
jne 0x4bb43e
mov esi, dword [ecx]
lea eax, [ebp - 8]
push ecx
push eax
push ecx
mov edi, dword [esi + 4]
push edi
push esi
mov dword [ebp - 8], ebx
call fcn.004bb6b0
mov ebx, dword [ebp - 4]
mov ecx, eax
mov eax, 0x71c71c6
mov edx, dword [ebx + 8]
sub eax, edx
cmp eax, 1
jb 0x4bb452
lea eax, [edx + 1]
mov dword [ebx + 8], eax
mov dword [esi + 4], ecx
mov esi, dword [ebp - 0xc]
mov dword [edi], ecx
mov ecx, ebx
mov edx, dword [ebx + 4]
mov edx, dword [edx]
push edx
add edx, 8
push edx
push esi
call fcn.004bb460
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov dword [ecx], eax
mov eax, ecx
mov byte [ecx + 4], 0
mov esp, ebp
pop ebp
ret 8
push str.list_T__too_long
call fcn.00509daf
int3
Function at 0x4bb730
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [ebp + 8]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 0xc]
cmp dword [eax + 0x1c], 0x10
push ebx
mov ebx, dword [eax + 0x18]
push esi
lea esi, [eax + 8]
mov dword [ebp - 4], ecx
jb 0x4bb752
mov esi, dword [esi]
xor edx, edx
push edi
mov edi, 0x811c9dc5
test ebx, ebx
je 0x4bb771
nop
movzx ecx, byte [edx + esi]
inc edx
xor ecx, edi
imul edi, ecx, 0x1000193
cmp edx, ebx
jb 0x4bb760
mov ebx, dword [ebp - 4]
mov ecx, dword [ebx + 0x18]
mov edx, dword [ebx + 0xc]
and ecx, edi
pop edi
lea esi, [ecx*8]
mov ecx, dword [edx + esi]
add edx, esi
cmp dword [edx + 4], eax
jne 0x4bb7ab
cmp ecx, eax
jne 0x4bb7a3
mov ecx, dword [ebx + 4]
mov dword [edx], ecx
mov edx, dword [ebx + 0xc]
mov ecx, dword [ebx + 4]
mov dword [esi + edx + 4], ecx
jmp 0x4bb7b3
mov ecx, dword [eax + 4]
mov dword [edx + 4], ecx
jmp 0x4bb7b3
cmp ecx, eax
jne 0x4bb7b3
mov ecx, dword [eax]
mov dword [edx], ecx
mov ecx, dword [eax + 4]
mov esi, dword [eax]
push eax
mov dword [ecx], esi
mov edx, dword [eax]
mov ecx, dword [eax + 4]
mov dword [edx + 4], ecx
dec dword [ebx + 8]
call fcn.004bb0f0
mov eax, dword [ebp - 8]
mov dword [eax], esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x4bd190
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x55bfa8
mov eax, dword fs:[0]
push eax
sub esp, 0x3c
push ebx
push esi
push edi
mov eax, dword [0x5b706c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], ecx
mov ebx, dword [ebp + 8]
mov esi, ebx
cmp dword [ebx + 0x14], 0x10
mov edi, dword [ebx + 0x10]
jb 0x4bd1cb
mov esi, dword [ebx]
xor ecx, ecx
mov edx, 0x811c9dc5
test edi, edi
je 0x4bd1e7
movzx eax, byte [ecx + esi]
inc ecx
xor eax, edx
imul edx, eax, 0x1000193
cmp ecx, edi
jb 0x4bd1d6
mov edi, dword [ebp - 0x10]
mov eax, dword [edi + 0x1c]
mov ecx, dword [edi + 0x10]
and eax, edx
mov edi, dword [edi + 8]
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x14], edi
mov esi, dword [ecx + eax*8]
add eax, eax
lea edx, [eax*4 + 4]
mov eax, dword [ecx + eax*4]
mov dword [ebp - 0x20], edx
mov dword [ebp - 0x1c], eax
cmp eax, edi
jne 0x4bd218
mov eax, edi
jmp 0x4bd21d
mov eax, dword [edx + ecx]
mov eax, dword [eax]
cmp esi, eax
je 0x4bd28d
cmp dword [ebx + 0x14], 0x10
mov edx, ebx
jb 0x4bd22b
mov edx, dword [ebx]
mov edi, dword [esi + 0x1c]
lea ecx, [esi + 8]
mov dword [ebp - 0x24], edi
cmp edi, 0x10
mov edi, dword [ebp - 0x14]
jb 0x4bd23f
mov ecx, dword [esi + 8]
push dword [ebx + 0x10]
mov eax, dword [esi + 0x18]
push edx
mov edx, eax
mov dword [ebp - 0x28], eax
call fcn.0040a610
add esp, 8
test al, al
jne 0x4bd264
mov esi, dword [esi]
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x1c]
mov edx, dword [ebp - 0x20]
jmp 0x4bd210
cmp dword [ebp - 0x24], 0x10
lea eax, [esi + 8]
jb 0x4bd26f
mov eax, dword [eax]
cmp dword [ebx + 0x14], 0x10
mov ecx, ebx
jb 0x4bd279
mov ecx, dword [ebx]
push dword [ebp - 0x28]
mov edx, dword [ebx + 0x10]
push eax
call fcn.0040a610
add esp, 8
test al, al
cmovne edi, esi
mov esi, dword [ebp - 0x10]
cmp dword [esi + 8], edi
je 0x4bd2ab
xor al, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
push ebx
lea ecx, [ebp - 0x48]
call fcn.00409180
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x30], eax
mov dword [ebp - 4], 0
mov eax, dword [esi + 8]
mov edi, dword [eax]
lea eax, [ebp - 0x48]
push eax
mov ebx, dword [edi + 4]
push ebx
push edi
call fcn.004bd400
mov edx, eax
mov ecx, 0x71c71c6
mov eax, dword [esi + 0xc]
sub ecx, eax
cmp ecx, 1
jb 0x4bd34a
inc eax
lea ecx, [esi + 4]
mov dword [esi + 0xc], eax
mov dword [edi + 4], edx
mov dword [ebx], edx
mov eax, dword [esi + 8]
mov eax, dword [eax]
push eax
add eax, 8
push eax
lea eax, [ebp - 0x2c]
push eax
call fcn.004bb460
mov edx, dword [ebp - 0x34]
cmp edx, 0x10
jb 0x4bd334
mov ecx, dword [ebp - 0x48]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x4bd32a
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4bd354
push edx
push ecx
call fcn.0051ec14
add esp, 8
mov al, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
push str.list_T__too_long
call fcn.00509daf
call fcn.00528129
int3
Function at 0x4be030
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x55c101
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
mov eax, dword [0x5b706c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x20], edi
mov eax, dword [ebp + 8]
mov dword [ebp - 0x28], edi
mov dword [ebp - 0x24], eax
mov dword [ebp - 4], 0
mov dword [edi], vtable.res::ResourceManagerArch.0
mov dword [edi + 4], 0
mov byte [ebp - 4], 1
lea esi, [edi + 8]
mov dword [ebp - 0x20], esi
mov dword [esi], 0
mov dword [esi + 4], 0
call fcn.004be870
mov dword [esi], eax
lea eax, [edi + 0x10]
mov byte [ebp - 4], 2
push eax
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
xorps xmm0, xmm0
mov dword [ebp - 0x14], 0
movq qword [ebp - 0x1c], xmm0
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x14], 0
mov esi, dword [ebp - 0x24]
push 0xa
push 0x14a
mov byte [ebp - 4], 4
push esi
mov dword [ebp - 0x18], 0
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov dword [ebp - 0x20], eax
test eax, eax
je 0x4be149
push eax
push esi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
push dword [ebp - 0x20]
mov esi, eax
push dword [ebp - 0x24]
call dword [sym.imp.KERNEL32.dll_LoadResource]
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ecx, eax
mov dword [ebp - 0x20], ecx
test ecx, ecx
je 0x4be149
test esi, esi
je 0x4be149
mov eax, dword [ebp - 0x14]
sub eax, dword [ebp - 0x1c]
cmp esi, eax
jbe 0x4be134
cmp esi, 0x7fffffff
ja 0x4be223
push esi
lea ecx, [ebp - 0x1c]
call fcn.00403c70
mov ecx, dword [ebp - 0x20]
lea eax, [ebp - 0x1c]
mov edx, ecx
push eax
lea eax, [ecx + esi]
push eax
lea ecx, [ebp - 0x20]
call fcn.00404ad0
add esp, 8
push 0x14
call fcn.0051ebe4
mov esi, eax
xorps xmm0, xmm0
mov dword [ebp - 0x20], esi
lea edx, [esi + 8]
lea eax, [ebp - 0x1c]
add esp, 4
movups xmmword [esi], xmm0
mov dword [esi + 0x10], 0
mov dword [esi], vtable.ar::memory.0
mov dword [esi + 4], 0
mov dword [edx], 0
mov dword [edx + 4], 0
mov dword [edx + 8], 0
cmp edx, eax
je 0x4be1b4
mov eax, dword [ebp - 0x1c]
mov dword [edx], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x1c], 0
mov ecx, dword [edx + 4]
mov dword [edx + 4], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x18], ecx
mov ecx, dword [edx + 8]
mov dword [edx + 8], eax
mov dword [ebp - 0x14], ecx
mov ecx, dword [edi + 4]
mov dword [edi + 4], esi
test ecx, ecx
je 0x4be1cd
mov byte [ebp - 4], 5
mov eax, dword [ecx]
push 1
call dword [eax + 0x18]
mov byte [ebp - 4], 4
mov ecx, edi
call fcn.004bdcf0
mov ecx, dword [ebp - 0x1c]
test ecx, ecx
je 0x4be204
mov edx, dword [ebp - 0x14]
mov eax, ecx
sub edx, ecx
cmp edx, 0x1000
jb 0x4be1fa
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4be228
push edx
push ecx
call fcn.0051ec14
add esp, 8
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0051e9d8
mov esp, ebp
pop ebp
ret 8
call fcn.00403c60
call fcn.00528129
int3
Function at 0x4c1240
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [ebp + 0x10]
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
mov dword [ebp - 8], ecx
mov esi, ebx
cmp dword [ebx + 0x14], 0x10
mov edi, dword [ebx + 0x10]
mov dword [ebp - 0x20], eax
mov dword [ebp - 4], edi
jb 0x4c1265
mov esi, dword [ebx]
xor ecx, ecx
mov edx, 0x811c9dc5
test edi, edi
je 0x4c1281
movzx eax, byte [ecx + esi]
inc ecx
xor eax, edx
imul edx, eax, 0x1000193
cmp ecx, edi
jb 0x4c1270
mov esi, dword [ebp - 8]
mov eax, dword [esi + 0x18]
mov ecx, dword [esi + 0xc]
and eax, edx
mov esi, dword [esi + 4]
mov dword [ebp - 0xc], esi
mov edi, dword [ecx + eax*8]
add eax, eax
mov edx, dword [ecx + eax*4]
inc eax
mov dword [ebp - 0x10], edx
lea eax, [ecx + eax*4]
mov dword [ebp - 0x14], eax
cmp edx, esi
jne 0x4c12ac
mov eax, esi
jmp 0x4c12b0
mov eax, dword [eax]
mov eax, dword [eax]
cmp edi, eax
je 0x4c1332
cmp dword [ebx + 0x14], 0x10
mov edx, ebx
jb 0x4c12be
mov edx, dword [ebx]
mov esi, dword [edi + 0x1c]
lea ecx, [edi + 8]
mov dword [ebp - 0x18], esi
cmp esi, 0x10
mov esi, dword [ebp - 0xc]
jb 0x4c12d2
mov ecx, dword [edi + 8]
push dword [ebp - 4]
mov eax, dword [edi + 0x18]
push edx
mov edx, eax
mov dword [ebp - 0x1c], eax
call fcn.0040a610
add esp, 8
test al, al
jne 0x4c12f4
mov edi, dword [edi]
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x14]
jmp 0x4c12a4
cmp dword [ebp - 0x18], 0x10
lea eax, [edi + 8]
jb 0x4c12ff
mov eax, dword [eax]
cmp dword [ebx + 0x14], 0x10
jb 0x4c1307
mov ebx, dword [ebx]
push dword [ebp - 0x1c]
mov edx, dword [ebp - 4]
mov ecx, ebx
push eax
call fcn.0040a610
add esp, 8
test al, al
jne 0x4c1325
test al, al
mov ecx, esi
cmovne esi, edi
jmp 0x4c1334
mov ecx, dword [ebp - 8]
test al, al
cmovne esi, edi
mov ecx, dword [ecx + 4]
jmp 0x4c1334
mov ecx, esi
cmp ecx, esi
je 0x4c1369
mov eax, dword [esi + 0x20]
cmp eax, dword [ebp + 0xc]
je 0x4c136b
mov ecx, dword [ebp - 0x20]
lea edx, [esi + 0x24]
cmp ecx, edx
je 0x4c136b
cmp dword [edx + 0x14], 8
mov eax, edx
jb 0x4c1354
mov eax, dword [edx]
push dword [edx + 0x10]
push eax
call fcn.00403df0
mov eax, dword [esi + 0x20]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x4c1380
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x55c330
mov eax, dword fs:[0]
push eax
sub esp, 0x68
mov eax, dword [0x5b706c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x34], ecx
mov eax, dword [ebp + 8]
mov edi, dword [ebp + 0xc]
mov dword [ebp - 0x40], eax
xor eax, eax
mov dword [ebp - 0x2c], 0
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 7
mov word [ebp - 0x28], ax
mov dword [ebp - 4], eax
mov edx, 0x811c9dc5
cmp dword [edi + 0x14], 8
mov esi, edi
mov dword [ebp - 0x30], edx
jb 0x4c13e6
mov esi, dword [edi]
mov ecx, dword [edi + 0x14]
mov eax, edi
cmp ecx, 8
jb 0x4c13f2
mov eax, dword [edi]
mov edx, dword [edi + 0x10]
mov dword [ebp - 0x3c], edx
lea eax, [eax + edx*2]
mov edx, dword [ebp - 0x30]
cmp esi, eax
je 0x4c1422
movzx eax, word [esi]
push eax
call fcn.005367ec
movzx eax, ax
add esp, 4
xor eax, dword [ebp - 0x30]
imul edx, eax, 0x1000193
add esi, 2
mov dword [ebp - 0x30], edx
jmp 0x4c13e6
lea eax, [ebp - 0x28]
mov dword [ebp - 0x2c], edx
cmp eax, edi
je 0x4c1445
cmp ecx, 8
jb 0x4c1433
mov edi, dword [edi]
push dword [ebp - 0x3c]
lea ecx, [ebp - 0x28]
push edi
call fcn.00403df0
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x30], eax
push dword [ebp - 0x40]
lea ecx, [ebp - 0x74]
call fcn.00409180
movups xmm0, xmmword [ebp - 0x28]
mov ecx, dword [ebp - 0x30]
xor eax, eax
mov dword [ebp - 0x5c], ecx
movups xmmword [ebp - 0x58], xmm0
mov word [ebp - 0x28], ax
movq xmm0, qword [ebp - 0x18]
movq qword [ebp - 0x48], xmm0
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 7
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x74]
mov edi, dword [ebp - 0x34]
push ecx
mov eax, dword [edi + 4]
mov esi, dword [eax]
mov eax, dword [esi + 4]
push eax
push esi
mov dword [ebp - 0x34], eax
call fcn.004c1a40
mov edx, eax
mov ecx, 0x4444443
mov eax, dword [edi + 8]
sub ecx, eax
cmp ecx, 1
jb 0x4c1528
inc eax
mov ecx, edi
mov dword [edi + 8], eax
mov eax, dword [ebp - 0x34]
mov dword [esi + 4], edx
mov dword [eax], edx
mov eax, dword [edi + 4]
mov eax, dword [eax]
push eax
add eax, 8
push eax
lea eax, [ebp - 0x38]
push eax
call fcn.004c17c0
lea ecx, [ebp - 0x58]
call fcn.00403d90
mov edx, dword [ebp - 0x60]
cmp edx, 0x10
jb 0x4c1503
mov ecx, dword [ebp - 0x74]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x4c14f9
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4c1532
push edx
push ecx
call fcn.0051ec14
add esp, 8
lea ecx, [ebp - 0x28]
call fcn.00403d90
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0051e9d8
mov esp, ebp
pop ebp
ret 8
push str.list_T__too_long
call fcn.00509daf
call fcn.00528129
int3
Function at 0x4c1ad0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [ebp + 8]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 0xc]
cmp dword [eax + 0x1c], 0x10
push ebx
mov ebx, dword [eax + 0x18]
push esi
lea esi, [eax + 8]
mov dword [ebp - 4], ecx
jb 0x4c1af2
mov esi, dword [esi]
xor edx, edx
push edi
mov edi, 0x811c9dc5
test ebx, ebx
je 0x4c1b11
nop
movzx ecx, byte [edx + esi]
inc edx
xor ecx, edi
imul edi, ecx, 0x1000193
cmp edx, ebx
jb 0x4c1b00
mov ebx, dword [ebp - 4]
mov ecx, dword [ebx + 0x18]
mov edx, dword [ebx + 0xc]
and ecx, edi
pop edi
lea esi, [ecx*8]
mov ecx, dword [edx + esi]
add edx, esi
cmp dword [edx + 4], eax
jne 0x4c1b4b
cmp ecx, eax
jne 0x4c1b43
mov ecx, dword [ebx + 4]
mov dword [edx], ecx
mov edx, dword [ebx + 0xc]
mov ecx, dword [ebx + 4]
mov dword [esi + edx + 4], ecx
jmp 0x4c1b53
mov ecx, dword [eax + 4]
mov dword [edx + 4], ecx
jmp 0x4c1b53
cmp ecx, eax
jne 0x4c1b53
mov ecx, dword [eax]
mov dword [edx], ecx
mov ecx, dword [eax + 4]
mov esi, dword [eax]
push eax
mov dword [ecx], esi
mov edx, dword [eax]
mov ecx, dword [eax + 4]
mov dword [edx + 4], ecx
dec dword [ebx + 8]
call fcn.004c1750
mov eax, dword [ebp - 8]
mov dword [eax], esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x4c9fd0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x55cb80
mov eax, dword fs:[0]
push eax
sub esp, 0x44
mov eax, dword [0x5b706c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x30], ecx
mov ecx, dword [ebp + 8]
lea edx, [ebp - 0x28]
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x48], eax
push edx
mov eax, dword [ecx]
mov dword [ebp - 0x4c], ecx
call dword [eax]
mov dword [ebp - 4], 0
mov dword [ebp - 0x2c], 0
mov byte [ebp - 4], 1
lea esi, [ebp - 0x28]
cmp dword [ebp - 0x14], 0x10
mov edx, 0x811c9dc5
mov ebx, dword [ebp - 0x28]
mov edi, dword [ebp - 0x18]
cmovae esi, ebx
xor ecx, ecx
test edi, edi
je 0x4ca051
nop
movzx eax, byte [ecx + esi]
inc ecx
xor eax, edx
imul edx, eax, 0x1000193
cmp ecx, edi
jb 0x4ca040
mov edi, dword [ebp - 0x30]
mov eax, dword [edi + 0x1c]
mov ecx, dword [edi + 0x10]
and eax, edx
mov edi, dword [edi + 8]
mov dword [ebp - 0x34], edi
mov esi, dword [ecx + eax*8]
add eax, eax
mov edx, dword [ecx + eax*4]
inc eax
mov dword [ebp - 0x38], edx
lea eax, [ecx + eax*4]
mov dword [ebp - 0x3c], eax
cmp edx, edi
jne 0x4ca07c
mov eax, edi
jmp 0x4ca080
mov eax, dword [eax]
mov eax, dword [eax]
cmp esi, eax
je 0x4ca0ed
cmp dword [ebp - 0x14], 0x10
lea edx, [ebp - 0x28]
mov edi, dword [esi + 0x1c]
lea ecx, [esi + 8]
cmovae edx, ebx
mov dword [ebp - 0x40], edi
cmp edi, 0x10
mov edi, dword [ebp - 0x34]
jb 0x4ca0a2
mov ecx, dword [esi + 8]
push dword [ebp - 0x18]
mov eax, dword [esi + 0x18]
push edx
mov edx, eax
mov dword [ebp - 0x44], eax
call fcn.0040a610
add esp, 8
test al, al
jne 0x4ca0c4
mov esi, dword [esi]
mov edx, dword [ebp - 0x38]
mov eax, dword [ebp - 0x3c]
jmp 0x4ca074
cmp dword [ebp - 0x40], 0x10
lea eax, [esi + 8]
jb 0x4ca0cf
mov eax, dword [eax]
cmp dword [ebp - 0x14], 0x10
lea ecx, [ebp - 0x28]
push dword [ebp - 0x44]
mov edx, dword [ebp - 0x18]
cmovae ecx, ebx
push eax
call fcn.0040a610
add esp, 8
test al, al
cmovne edi, esi
mov ecx, dword [ebp - 0x30]
cmp dword [ecx + 8], edi
je 0x4ca12a
mov ecx, dword [edi + 0x44]
test ecx, ecx
je 0x4ca18d
mov eax, dword [ecx]
call dword [eax + 8]
mov esi, eax
mov dword [ebp - 0x2c], esi
test esi, esi
je 0x4ca125
mov eax, dword [esi]
mov ecx, esi
push dword [ebp - 0x48]
push dword [ebp - 0x4c]
mov eax, dword [eax + 0x2c]
call eax
test al, al
je 0x4ca125
mov edi, esi
jmp 0x4ca13b
mov ebx, dword [ebp - 0x28]
jmp 0x4ca12c
xor esi, esi
xor edi, edi
test esi, esi
je 0x4ca13e
mov eax, dword [esi]
mov ecx, esi
push 1
call dword [eax + 0x28]
mov ebx, dword [ebp - 0x28]
mov eax, dword [ebp - 0x14]
cmp eax, 0x10
jb 0x4ca16d
lea ecx, [eax + 1]
mov eax, ebx
cmp ecx, 0x1000
jb 0x4ca163
mov ebx, dword [ebx - 4]
add ecx, 0x23
sub eax, ebx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4ca192
push ecx
push ebx
call fcn.0051ec14
add esp, 8
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0051e9d8
mov esp, ebp
pop ebp
ret 8
call fcn.00509d72
call fcn.00528129
int3
Function at 0x4cabd0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 4], ecx
mov esi, ebx
cmp dword [ebx + 0x14], 0x10
mov edi, dword [ebx + 0x10]
mov dword [ebp - 0xc], eax
jb 0x4cabf2
mov esi, dword [ebx]
xor ecx, ecx
mov edx, 0x811c9dc5
test edi, edi
je 0x4cac11
nop dword [eax]
movzx eax, byte [ecx + esi]
inc ecx
xor eax, edx
imul edx, eax, 0x1000193
cmp ecx, edi
jb 0x4cac00
mov edi, dword [ebp - 4]
mov eax, dword [edi + 0x18]
mov ecx, dword [edi + 0xc]
and eax, edx
mov edi, dword [edi + 4]
mov dword [ebp - 0x10], edi
mov esi, dword [ecx + eax*8]
add eax, eax
mov edx, dword [ecx + eax*4]
inc eax
mov dword [ebp - 0x14], edx
lea eax, [ecx + eax*4]
mov dword [ebp - 0x18], eax
cmp edx, edi
jne 0x4cac3c
mov eax, edi
jmp 0x4cac40
mov eax, dword [eax]
mov eax, dword [eax]
cmp esi, eax
je 0x4cacc2
cmp dword [ebx + 0x14], 0x10
mov edx, ebx
jb 0x4cac4e
mov edx, dword [ebx]
mov edi, dword [esi + 0x1c]
lea ecx, [esi + 8]
mov dword [ebp - 0x1c], edi
cmp edi, 0x10
mov edi, dword [ebp - 0x10]
jb 0x4cac62
mov ecx, dword [esi + 8]
push dword [ebx + 0x10]
mov eax, dword [esi + 0x18]
push edx
mov edx, eax
mov dword [ebp - 8], eax
call fcn.0040a610
add esp, 8
test al, al
jne 0x4cac84
mov esi, dword [esi]
mov edx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x18]
jmp 0x4cac34
cmp dword [ebp - 0x1c], 0x10
lea eax, [esi + 8]
jb 0x4cac8f
mov eax, dword [eax]
cmp dword [ebx + 0x14], 0x10
mov ecx, ebx
jb 0x4cac99
mov ecx, dword [ebx]
push dword [ebp - 8]
mov edx, dword [ebx + 0x10]
push eax
call fcn.0040a610
add esp, 8
test al, al
jne 0x4cacb5
test al, al
mov ecx, edi
cmovne edi, esi
jmp 0x4cacc4
mov ecx, dword [ebp - 4]
test al, al
cmovne edi, esi
mov ecx, dword [ecx + 4]
jmp 0x4cacc4
mov ecx, edi
mov eax, edi
cmp edi, ecx
jne 0x4cad1e
mov esi, dword [ecx]
lea eax, [ebp - 8]
push ecx
push eax
push ecx
mov edi, dword [esi + 4]
push edi
push esi
mov dword [ebp - 8], ebx
call fcn.004cbcc0
mov ebx, dword [ebp - 4]
mov ecx, eax
mov eax, 0x38e38e2
mov edx, dword [ebx + 8]
sub eax, edx
cmp eax, 1
jb 0x4cad32
lea eax, [edx + 1]
mov dword [ebx + 8], eax
mov dword [esi + 4], ecx
mov esi, dword [ebp - 0xc]
mov dword [edi], ecx
mov ecx, ebx
mov edx, dword [ebx + 4]
mov edx, dword [edx]
push edx
add edx, 8
push edx
push esi
call fcn.004cba70
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov dword [ecx], eax
mov eax, ecx
mov byte [ecx + 4], 0
mov esp, ebp
pop ebp
ret 8
push str.list_T__too_long
call fcn.00509daf
int3