joyce8/EMBER2024-capa huggingface dataset:
Function at 0x462b60
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
movd xmm0, dword [esp + 8]
pinsrw xmm0, ebx, 4
pshufhw xmm0, xmm0, 0
movdqa xmm1, xmm0
pxor xmm0, xmmword [0x91e240]
aesenc xmm0, xmm0
cmp ebx, 0x10
jb 0x46132b
je 0x46137e
cmp ebx, 0x20
jbe 0x461384
cmp ebx, 0x40
jbe 0x4613ca
jmp 0x46146b
test ebx, ebx
je 0x461374
add eax, 0x10
test ax, 0xff0
je 0x461360
movdqu xmm1, xmmword [eax - 0x10]
add ebx, ebx
pand xmm1, xmmword [ebx*8 + 0x749fe0]
pxor xmm1, xmm0
aesenc xmm1, xmm1
aesenc xmm1, xmm1
aesenc xmm1, xmm1
movd dword [edx], xmm1
ret
movdqu xmm1, xmmword [eax + ebx - 0x20]
add ebx, ebx
pshufb xmm1, xmmword [ebx*8 + 0x74a1e0]
jmp 0x461348
aesenc xmm0, xmm0
movd dword [edx], xmm0
ret
movdqu xmm1, xmmword [eax]
jmp 0x461348
pxor xmm1, xmmword [0x91e250]
aesenc xmm1, xmm1
movdqu xmm2, xmmword [eax]
movdqu xmm3, xmmword [eax + ebx - 0x10]
pxor xmm2, xmm0
pxor xmm3, xmm1
aesenc xmm2, xmm2
aesenc xmm3, xmm3
aesenc xmm2, xmm2
aesenc xmm3, xmm3
aesenc xmm2, xmm2
aesenc xmm3, xmm3
pxor xmm2, xmm3
movd dword [edx], xmm2
ret
movdqa xmm2, xmm1
movdqa xmm3, xmm1
pxor xmm1, xmmword [0x91e250]
pxor xmm2, xmmword [0x91e260]
pxor xmm3, xmmword [0x91e270]
aesenc xmm1, xmm1
aesenc xmm2, xmm2
aesenc xmm3, xmm3
movdqu xmm4, xmmword [eax]
movdqu xmm5, xmmword [eax + 0x10]
movdqu xmm6, xmmword [eax + ebx - 0x20]
movdqu xmm7, xmmword [eax + ebx - 0x10]
pxor xmm4, xmm0
pxor xmm5, xmm1
pxor xmm6, xmm2
pxor xmm7, xmm3
aesenc xmm4, xmm4
aesenc xmm5, xmm5
aesenc xmm6, xmm6
aesenc xmm7, xmm7
aesenc xmm4, xmm4
aesenc xmm5, xmm5
aesenc xmm6, xmm6
aesenc xmm7, xmm7
aesenc xmm4, xmm4
aesenc xmm5, xmm5
aesenc xmm6, xmm6
aesenc xmm7, xmm7
pxor xmm4, xmm6
pxor xmm5, xmm7
pxor xmm4, xmm5
movd dword [edx], xmm4
ret
movdqa xmm2, xmm1
movdqa xmm3, xmm1
pxor xmm1, xmmword [0x91e250]
pxor xmm2, xmmword [0x91e260]
pxor xmm3, xmmword [0x91e270]
aesenc xmm1, xmm1
aesenc xmm2, xmm2
aesenc xmm3, xmm3
movdqu xmm4, xmmword [eax + ebx - 0x40]
movdqu xmm5, xmmword [eax + ebx - 0x30]
movdqu xmm6, xmmword [eax + ebx - 0x20]
movdqu xmm7, xmmword [eax + ebx - 0x10]
aesenc xmm4, xmm0
aesenc xmm5, xmm1
aesenc xmm6, xmm2
aesenc xmm7, xmm3
dec ebx
shr ebx, 6
movdqu xmm0, xmmword [eax]
movdqu xmm1, xmmword [eax + 0x10]
movdqu xmm2, xmmword [eax + 0x20]
movdqu xmm3, xmmword [eax + 0x30]
aesenc xmm4, xmm0
aesenc xmm5, xmm1
aesenc xmm6, xmm2
aesenc xmm7, xmm3
aesenc xmm4, xmm4
aesenc xmm5, xmm5
aesenc xmm6, xmm6
aesenc xmm7, xmm7
add eax, 0x40
dec ebx
jne 0x4614ca
aesenc xmm4, xmm4
aesenc xmm5, xmm5
aesenc xmm6, xmm6
aesenc xmm7, xmm7
aesenc xmm4, xmm4
aesenc xmm5, xmm5
aesenc xmm6, xmm6
aesenc xmm7, xmm7
aesenc xmm4, xmm4
aesenc xmm5, xmm5
aesenc xmm6, xmm6
aesenc xmm7, xmm7
pxor xmm4, xmm6
pxor xmm5, xmm7
pxor xmm4, xmm5
movd dword [edx], xmm4
ret
cmp byte [0x91dcbb], 0
je 0x462b7a
mov eax, dword [esp + 4]
mov ebx, dword [esp + 0xc]
lea edx, [esp + 0x10]
jmp 0x4612f0
jmp fcn.00408140
Function at 0x10031c58
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
and dword [ebp - 4], 0
lea eax, [ebp + 8]
push eax
push 1
lea eax, [ebp - 0x10]
push eax
push 0x2cef
push 0x33a3
call fcn.100319e4
add esp, 0x14
mov eax, dword [ebp - 0x10]
movzx eax, word [eax]
cmp eax, 0x5a4d
je 0x10031c92
xor eax, eax
jmp 0x10031df1
lea eax, [ebp - 0x10]
push eax
push 1
push 0x5bf1
lea eax, [ebp + 8]
push eax
lea eax, [ebp - 8]
push eax
push 0x6e7a
call fcn.10031a65
add esp, 0x18
mov eax, dword [ebp - 8]
cmp dword [eax], 0x4550
je 0x10031cc4
xor eax, eax
jmp 0x10031df1
push dword [ebp - 8]
lea eax, [ebp - 0xc]
push eax
push 0x2cc9
push 0x127c
push 1
call fcn.1002f920
add esp, 0x14
cmp dword [ebp - 0xc], 0
jne 0x10031cec
xor eax, eax
jmp 0x10031df1
lea eax, [ebp - 0x24]
push eax
push dword [ebp - 8]
push 1
push dword [ebp - 0x10]
push 0x6168
lea eax, [ebp - 4]
push eax
push 0x2602
lea eax, [ebp - 0xc]
push eax
call fcn.1003184a
add esp, 0x20
lea eax, [ebp + 8]
push eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 4]
push eax
push 1
push 0x7b2a
call fcn.10031af7
add esp, 0x14
push 0x13fa
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 8]
push eax
push 0x5e19
lea eax, [ebp - 0xc]
push eax
push 0x3ec3
push 1
call fcn.10031b6c
add esp, 0x1c
cmp dword [ebp - 0x14], 0
je 0x10031d6f
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 4]
push eax
push 1
push 0x5e0d
call fcn.10031bf0
add esp, 0x10
push dword [ebp - 4]
call fcn.1002f803
pop ecx
test eax, eax
jne 0x10031d80
xor eax, eax
jmp 0x10031df1
push dword [ebp - 4]
push 0x2c96
push 0
push 0x847
call fcn.1002fb55
add esp, 0x10
mov eax, dword [ebp - 4]
mov eax, dword [eax]
cmp dword [eax + 0x28], 0
je 0x10031dd9
mov eax, dword [ebp - 4]
mov eax, dword [eax]
mov ecx, dword [ebp - 0xc]
add ecx, dword [eax + 0x28]
mov dword [ebp - 0x18], ecx
jne 0x10031db6
xor eax, eax
jmp 0x10031df1
push 0
push 1
push 0xdeadbeef
call dword [ebp - 0x18]
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0
jne 0x10031dcf
xor eax, eax
jmp 0x10031df1
mov eax, dword [ebp - 4]
mov dword [eax + 0x10], 1
mov eax, dword [ebp - 4]
cmp dword [eax + 0x10], 0
je 0x10031dea
mov eax, dword [ebp - 4]
mov dword [ebp - 0x1c], eax
jmp 0x10031dee
and dword [ebp - 0x1c], 0
mov eax, dword [ebp - 0x1c]
mov esp, ebp
pop ebp
ret
Function at 0x4093a0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push esi
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x4093f9
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x4093f9
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [ebp + 0x10]
lea edx, [esi + eax]
and ecx, 0xf
jbe 0x4093ea
cmp esi, edx
jae 0x4093f9
movzx eax, word [esi]
lea esi, [esi + eax*2]
add esi, 2
sub ecx, 1
jne 0x4093d8
cmp esi, edx
jae 0x4093f9
cmp word [esi], 0
je 0x4093f9
mov eax, esi
pop esi
pop ebp
ret
xor eax, eax
pop esi
pop ebp
ret

Function at 0x40bb90
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x579ed8
mov eax, dword fs:[0]
push eax
sub esp, 0x24
push esi
push edi
mov eax, dword [0x5c8a30]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
push 8
mov dword [esi + 0x30], 0
mov dword [esi + 8], 0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0x201
mov dword [esi + 0x18], 6
mov dword [esi + 0x1c], 0
mov dword [esi + 0x20], 0
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x2c], 0
mov dword [esi + 0xc], 0
call fcn.00441bf3
mov edi, eax
add esp, 4
test edi, edi
je 0x40bc33
xorps xmm0, xmm0
movq qword [edi], xmm0
push 1
mov dword [ebp - 4], 0
call fcn.00435abc
add esp, 4
mov dword [edi + 4], eax
jmp 0x40bc35
xor edi, edi
mov eax, dword [ebp + 8]
mov dword [esi + 0x30], edi
mov dword [esi + 0x38], eax
mov dword [esi + 0x3c], 0
mov ecx, dword [edi + 4]
mov dword [ebp - 4], 1
mov dword [ebp - 0x10], ecx
mov eax, dword [ecx]
call dword [eax + 4]
lea eax, [ebp - 0x14]
mov dword [ebp - 4], 2
push eax
call fcn.00404280
add esp, 4
mov ecx, eax
mov edx, dword [eax]
push 0x20
call dword [edx + 0x30]
movzx edi, ax
mov ecx, dword [ebp - 0x10]
mov dword [ebp - 4], 3
test ecx, ecx
je 0x40bc95
mov eax, dword [ecx]
call dword [eax + 8]
test eax, eax
je 0x40bc95
mov edx, dword [eax]
mov ecx, eax
push 1
call dword [edx]
cmp dword [esi + 0x38], 0
mov dword [ebp - 4], 0xffffffff
mov word [esi + 0x40], di
jne 0x40bcb9
mov eax, dword [esi + 0xc]
mov ecx, dword [esi + 0x10]
and eax, 0x13
or eax, 4
mov dword [esi + 0xc], eax
and ecx, eax
jne 0x40bcdb
cmp byte [ebp + 0xc], 0
je 0x40bcc8
push esi
call fcn.0043601d
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 8
test cl, 4
je 0x40bce7
mov esi, str.ios_base::badbit_set
jmp 0x40bcf7
test cl, 2
mov esi, str.ios_base::failbit_set
mov eax, str.ios_base::eofbit_set
cmove esi, eax
lea eax, [ebp - 0x1c]
push 1
push eax
call fcn.0040bd20
add esp, 8
lea ecx, [ebp - 0x30]
push eax
push esi
call fcn.00405130
push 0x5b6018
lea eax, [ebp - 0x30]
push eax
call fcn.00545cdd
int3
Function at 0x4108d0
Capabilities:
Check if file exists
Get file attributes
Get file system object information

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x57a626
mov eax, dword fs:[0]
push eax
sub esp, 0x308
mov eax, dword [0x5c8a30]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
mov eax, esi
mov edi, dword [ebp + 0xc]
cmp dword [esi + 0x14], 8
jb 0x41090e
mov eax, dword [esi]
mov ebx, dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
push eax
call ebx
cmp eax, 0xffffffff
jne 0x410923
xor al, al
jmp 0x410a21
cmp dword [edi + 0x14], 8
mov eax, edi
jb 0x41092d
mov eax, dword [edi]
push eax
call ebx
cmp eax, 0xffffffff
setne cl
jne 0x410a1f
xorps xmm0, xmm0
mov dword [ebp - 0x2d0], 0
movups xmmword [ebp - 0x2e4], xmm0
mov dword [ebp - 0x2cc], 0x18
mov dword [ebp - 0x2d4], 0x400
lea eax, [ebp - 0x2fc]
mov dword [ebp - 4], 0
push eax
mov ecx, esi
call fcn.004511d0
mov esi, eax
cmp dword [esi + 0x14], 8
jb 0x410983
mov esi, dword [esi]
push 0x2b4
lea eax, [ebp - 0x2c4]
push 0
push eax
call fcn.00546c00
add esp, 0xc
lea eax, [ebp - 0x2c4]
xor ebx, ebx
push 0x100
push 0x2b4
push eax
push ebx
push esi
call dword [sym.imp.SHELL32.dll_SHGetFileInfoW]
mov esi, dword [ebp - 0x2c4]
test eax, eax
je 0x4109d6
mov dword [ebp - 0x2dc], ebx
mov ebx, esi
mov dword [ebp - 0x2e4], esi
mov dword [ebp - 0x2e0], 0x20
lea ecx, [ebp - 0x2fc]
call fcn.00405550
lea eax, [ebp - 0x314]
mov ecx, edi
push eax
call fcn.004511d0
push eax
push esi
mov byte [ebp - 4], 1
call fcn.00412bf0
add esp, 8
mov byte [ebp - 0x2c5], al
lea ecx, [ebp - 0x314]
call fcn.00405550
test ebx, ebx
je 0x410a19
push ebx
call dword [sym.imp.USER32.dll_DestroyIcon]
mov cl, byte [ebp - 0x2c5]
mov al, cl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00441ed9
mov esp, ebp
pop ebp
ret
Function at 0x410a40
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x57a680
mov eax, dword fs:[0]
push eax
sub esp, 0x34
mov eax, dword [0x5c8a30]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, dword [ebp + 8]
mov dword [ebp - 0x28], edi
call fcn.00407a70
mov ecx, eax
test ecx, ecx
je 0x410c52
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x1c], eax
push 0x589114
lea ecx, [ebp - 0x1c]
mov dword [ebp - 4], 0
call fcn.004068f0
test al, al
jne 0x410ab2
push 1
push 0x589114
lea ecx, [ebp - 0x1c]
call fcn.00409260
push 0x14000
mov dword [ebp - 4], 1
mov dword [ebp - 0x18], 1
call fcn.00441f15
mov esi, eax
mov dword [ebp - 0x14], 0xa000
add esp, 4
test esi, esi
jne 0x410b1e
push eax
mov dword [edi + 0x10], eax
mov ecx, edi
mov dword [edi + 0x14], 0xf
push 0x5887a4
mov byte [edi], al
call fcn.0040abd0
mov esi, dword [ebp - 0x1c]
or eax, 0xffffffff
mov dword [ebp - 4], 0xffffffff
add esi, 0xfffffff0
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x410c34
mov ecx, dword [esi]
push esi
mov edx, dword [ecx]
call dword [edx + 4]
jmp 0x410c34
lea eax, [ebp - 0x14]
push eax
push esi
lea eax, [ebp - 0x18]
push eax
push 0x589118
push str.SOFTWAREComMaster
push 0x80000002
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
or ebx, 0xffffffff
test eax, eax
jne 0x410c00
lea eax, [ebp - 0x40]
push eax
call fcn.004114c0
add esp, 4
cmp dword [eax + 0x14], 8
mov byte [ebp - 4], 2
jb 0x410b5f
mov eax, dword [eax]
push eax
lea ecx, [ebp - 0x24]
call fcn.0040ea20
push esi
lea ecx, [ebp - 0x20]
mov byte [ebp - 4], 3
call fcn.0040ea20
lea eax, [ebp - 0x24]
mov byte [ebp - 4], 4
push eax
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x28]
push eax
call fcn.0043af70
add esp, 0xc
push eax
lea ecx, [ebp - 0x1c]
mov byte [ebp - 4], 5
call fcn.0040f8c0
mov edx, dword [ebp - 0x28]
mov eax, ebx
mov byte [ebp - 4], 4
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x410bb8
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov edx, dword [ebp - 0x20]
mov eax, ebx
mov byte [ebp - 4], 3
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x410bd6
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov edx, dword [ebp - 0x24]
mov eax, ebx
mov byte [ebp - 4], 2
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x410bf4
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
lea ecx, [ebp - 0x40]
mov byte [ebp - 4], 1
call fcn.00405550
push esi
call fcn.00441f1e
mov esi, dword [ebp - 0x1c]
push 0xfde9
push esi
push edi
call fcn.0043b800
add esp, 0x10
mov dword [ebp - 4], 0xffffffff
add esi, 0xfffffff0
lock xadd dword [esi + 0xc], ebx
dec ebx
test ebx, ebx
jg 0x410c34
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00441ed9
mov esp, ebp
pop ebp
ret
push 0x80004005
call fcn.004068d0
int3
Function at 0x4114c0
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x57a822
mov eax, dword fs:[0]
push eax
sub esp, 0x424
mov eax, dword [0x5c8a30]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
xor eax, eax
mov dword [ebp - 0x430], esi
mov dword [ebp - 0x42c], 0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 7
mov word [esi], ax
push 0x208
push eax
mov dword [ebp - 4], eax
lea eax, [ebp - 0x218]
push eax
mov dword [ebp - 0x42c], 1
mov dword [ebp - 0x424], 0x104
call fcn.00546c00
add esp, 0xc
mov dword [ebp - 0x428], 1
lea eax, [ebp - 0x424]
push eax
lea eax, [ebp - 0x218]
push eax
lea eax, [ebp - 0x428]
push eax
push str.local_m2
push str.SOFTWAREComMaster
push 0x80000002
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
test eax, eax
jne 0x41159e
lea ecx, [ebp - 0x218]
lea edx, [ecx + 2]
nop
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x411580
sub ecx, edx
lea eax, [ebp - 0x218]
sar ecx, 1
push ecx
push eax
mov ecx, esi
call fcn.0040acd0
cmp dword [esi + 0x10], 0
jne 0x41161a
push 0x208
lea eax, [ebp - 0x420]
push 0
push eax
call fcn.00546c00
add esp, 0xc
lea eax, [ebp - 0x420]
push 0x104
push eax
call fcn.00467390
lea ecx, [ebp - 0x420]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x4115d4
sub ecx, edx
lea eax, [ebp - 0x420]
sar ecx, 1
push ecx
push eax
mov ecx, esi
call fcn.0040acd0
cmp dword [esi + 0x14], 8
mov eax, esi
mov ecx, dword [esi + 0x10]
jb 0x4115ff
mov eax, dword [esi]
add ecx, ecx
push ecx
push eax
push 1
push str.local_m2
push str.SOFTWAREComMaster
push 0x80000002
call dword [sym.imp.SHLWAPI.dll_SHSetValueW]
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00441ed9
mov esp, ebp
pop ebp
ret
Function at 0x412bd0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
cmp dword [eax + 0x14], 8
jb 0x412bde
mov eax, dword [eax]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
setne al
pop ebp
ret
Function at 0x413830
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x57ac20
mov eax, dword fs:[0]
push eax
push esi
push edi
mov eax, dword [0x5c8a30]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
push 8
mov dword [esi + 0x30], 0
mov dword [esi + 8], 0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0x201
mov dword [esi + 0x18], 6
mov dword [esi + 0x1c], 0
mov dword [esi + 0x20], 0
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x2c], 0
mov dword [esi + 0xc], 0
call fcn.00441bf3
mov edi, eax
add esp, 4
test edi, edi
je 0x4138e2
xorps xmm0, xmm0
movq qword [edi], xmm0
push 1
mov dword [ebp - 4], 0
call fcn.00435abc
mov dword [edi + 4], eax
add esp, 4
mov dword [esi + 0x30], edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
mov dword [esi + 0x30], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x4208b0
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [0x5c8a30]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 0xc]
push esi
push edi
mov edi, dword [ebp + 8]
test edi, edi
je 0x420937
test ebx, ebx
je 0x420937
mov esi, dword [ebp + 0x10]
test esi, esi
je 0x420937
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_IsBadReadPtr]
test eax, eax
jne 0x420937
mov dword [ebp - 8], eax
lea eax, [ebp - 8]
push eax
push 0x40
push esi
push edi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
je 0x420931
push esi
push ebx
push edi
call fcn.00546100
add esp, 0xc
mov dword [ebp - 0xc], 0
lea eax, [ebp - 0xc]
push eax
push dword [ebp - 8]
push esi
push edi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
je 0x420931
pop edi
pop esi
mov al, 1
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00441ed9
mov esp, ebp
pop ebp
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [ebp - 4]
xor al, al
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00441ed9
mov esp, ebp
pop ebp
ret
Function at 0x4277f0
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x57cdc0
mov eax, dword fs:[0]
push eax
sub esp, 0x18
mov eax, dword [0x5c8a30]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov edx, ecx
mov dword [ebp - 0x24], edx
mov edi, dword [ebp + 0xc]
mov esi, dword [edx + 4]
mov ebx, dword [ebp + 8]
mov dword [ebp - 0x20], edx
movzx eax, byte [edi]
xor eax, 0x811c9dc5
mov dword [ebp - 4], 0
imul ecx, eax, 0x1000193
movzx eax, byte [edi + 1]
xor ecx, eax
movzx eax, byte [edi + 2]
imul ecx, ecx, 0x1000193
xor ecx, eax
movzx eax, byte [edi + 3]
imul ecx, ecx, 0x1000193
xor ecx, eax
imul eax, ecx, 0x1000193
mov ecx, dword [edx + 0x18]
and ecx, eax
lea eax, [edx + 4]
mov dword [ebp - 0x1c], eax
mov eax, dword [edx + 0xc]
mov dword [ebp - 0x18], ecx
mov ecx, dword [eax + ecx*8]
cmp esi, ecx
je 0x4278d3
mov esi, dword [ebp - 0x18]
mov esi, dword [eax + esi*8 + 4]
mov esi, dword [esi]
nop dword [eax]
cmp esi, ecx
je 0x4278d3
mov esi, dword [esi + 4]
mov eax, dword [edi]
cmp eax, dword [esi + 8]
jne 0x427890
push dword [ebp + 0x10]
mov ecx, dword [ebp - 0x1c]
lea eax, [ebp - 0x20]
push eax
call fcn.0042a750
mov dword [ebx], esi
mov byte [ebx + 4], 0
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.00441ed9
mov esp, ebp
pop ebp
ret 0xc
mov edi, dword [ebp + 0x10]
mov dword [ebp - 0x1c], edi
mov eax, dword [edi]
cmp esi, eax
je 0x427903
mov ecx, dword [edi + 4]
mov dword [ecx], eax
mov ecx, dword [eax + 4]
mov dword [ecx], esi
mov ecx, dword [esi + 4]
mov dword [ecx], edi
mov edx, dword [esi + 4]
mov ecx, dword [eax + 4]
mov dword [esi + 4], ecx
mov ecx, dword [edi + 4]
mov dword [eax + 4], ecx
mov dword [edi + 4], edx
mov edx, dword [ebp - 0x24]
mov eax, dword [edx + 0xc]
mov ecx, dword [ebp - 0x18]
lea ecx, [eax + ecx*8]
mov eax, dword [ecx]
cmp eax, dword [edx + 4]
jne 0x427921
mov dword [ecx], edi
mov eax, dword [edx + 0xc]
mov ecx, dword [ebp - 0x18]
mov dword [eax + ecx*8 + 4], edi
jmp 0x42794a
cmp eax, esi
jne 0x427929
mov dword [ecx], edi
jmp 0x42794a
mov eax, dword [ecx + 4]
mov eax, dword [eax]
mov dword [ecx + 4], eax
cmp eax, edi
je 0x42794a
mov eax, dword [edx + 0xc]
mov ecx, dword [ebp - 0x18]
lea edx, [eax + ecx*8]
mov eax, dword [edx + 4]
mov eax, dword [eax + 4]
mov dword [edx + 4], eax
mov edx, dword [ebp - 0x24]
mov ecx, edx
mov dword [ebp - 4], 2
call fcn.00429e90
mov dword [ebx], edi
mov byte [ebx + 4], 1
jmp 0x4278b3
Function at 0x427990
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x57cdf0
mov eax, dword fs:[0]
push eax
sub esp, 0x20
mov eax, dword [0x5c8a30]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov edi, ecx
mov dword [ebp - 0x18], edi
mov edx, dword [ebp + 0xc]
mov esi, dword [edi + 0x18]
mov ebx, dword [ebp + 8]
mov dword [ebp - 0x2c], edi
movzx eax, byte [edx]
xor eax, 0x811c9dc5
mov dword [ebp - 4], 0
imul ecx, eax, 0x1000193
movzx eax, byte [edx + 1]
xor ecx, eax
movzx eax, byte [edx + 2]
imul ecx, ecx, 0x1000193
xor ecx, eax
movzx eax, byte [edx + 3]
imul ecx, ecx, 0x1000193
xor ecx, eax
imul eax, ecx, 0x1000193
mov ecx, dword [edi + 4]
mov dword [ebp - 0x20], ecx
and esi, eax
mov eax, dword [edi + 0xc]
mov dword [ebp - 0x1c], esi
lea esi, [eax + esi*8]
mov eax, dword [esi]
cmp eax, ecx
jne 0x427a23
mov esi, ecx
jmp 0x427a28
mov esi, dword [esi + 4]
mov esi, dword [esi]
cmp esi, eax
je 0x427a5c
mov esi, dword [esi + 4]
mov ecx, dword [edx]
cmp ecx, dword [esi + 8]
jne 0x427a28
mov dword [ebx], esi
mov byte [ebx + 4], 0
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.00441ed9
mov esp, ebp
pop ebp
ret 0xc
mov eax, dword [ebp - 0x20]
add edi, 4
push edx
mov dword [ebp - 4], 0xffffffff
mov dword [ebp - 0x28], edi
mov eax, dword [eax]
mov dword [ebp - 0x20], eax
mov ecx, dword [eax + 4]
push ecx
mov dword [ebp - 0x24], ecx
mov ecx, edi
push eax
call fcn.00427720
mov edx, eax
mov ecx, 0xccccccb
mov eax, dword [edi + 4]
sub ecx, eax
cmp ecx, 1
jb 0x427b64
inc eax
mov dword [edi + 4], eax
mov eax, dword [ebp - 0x20]
mov dword [eax + 4], edx
mov eax, dword [ebp - 0x24]
mov dword [eax], edx
mov ecx, dword [edi]
mov edi, dword [ecx]
mov dword [ebp - 0x24], edi
mov eax, dword [edi]
cmp esi, eax
je 0x427ad8
mov ecx, dword [edi + 4]
mov dword [ecx], eax
mov ecx, dword [eax + 4]
mov dword [ecx], esi
mov ecx, dword [esi + 4]
mov dword [ecx], edi
mov ecx, dword [eax + 4]
mov edx, dword [esi + 4]
mov dword [esi + 4], ecx
mov ecx, dword [edi + 4]
mov dword [eax + 4], ecx
mov ecx, dword [ebp - 0x28]
mov dword [edi + 4], edx
mov ecx, dword [ecx]
mov eax, dword [ebp - 0x18]
mov edx, dword [ebp - 0x1c]
mov eax, dword [eax + 0xc]
lea edx, [eax + edx*8]
mov eax, dword [edx]
cmp eax, ecx
jne 0x427afb
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x1c]
mov dword [edx], edi
mov eax, dword [eax + 0xc]
mov dword [eax + ecx*8 + 4], edi
jmp 0x427b24
cmp eax, esi
jne 0x427b03
mov dword [edx], edi
jmp 0x427b24
mov eax, dword [edx + 4]
mov eax, dword [eax]
mov dword [edx + 4], eax
cmp eax, edi
je 0x427b24
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x1c]
mov eax, dword [eax + 0xc]
lea edx, [eax + ecx*8]
mov eax, dword [edx + 4]
mov eax, dword [eax + 4]
mov dword [edx + 4], eax
mov ecx, dword [ebp - 0x18]
mov dword [ebp - 4], 2
call fcn.00429e90
mov dword [ebx], edi
mov byte [ebx + 4], 1
jmp 0x427a3c
push str.list_T__too_long
call fcn.004353ed
int3