joyce8/EMBER2024-capa huggingface dataset:
Function at 0x411260
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
mov eax, dword [0x4b1df0]
add eax, 0xffffffff
mov dword [0x4b1df0], eax
jns 0x4113a4
push ebx
push ebp
push esi
mov esi, 0x5bc6c8
push edi
mov edi, 0x5bc6c0
cmp eax, 0xffffffff
jge 0x4112b1
mov eax, 0x1105
mov ecx, 0x5bc6c4
mov dword [0x5bc6c0], eax
mov edx, 0x26f
nop word [eax + eax]
imul eax, eax, 0x10dcd
lea ecx, [ecx + 4]
mov dword [ecx - 4], eax
sub edx, 1
jne 0x4112a0
mov eax, dword [0x5bc6c0]
mov ebx, 0xe3
mov edx, dword [0x5bc6c4]
mov dword [0x4b1df0], 0x26f
mov dword [0x5bc6b8], 0x5bc6c4
mov ecx, edx
xor ecx, eax
and ecx, 0x7ffffffe
xor ecx, eax
mov eax, edx
and al, 1
shr ecx, 1
movzx eax, al
neg eax
sbb eax, eax
and eax, 0x9908b0df
xor ecx, eax
mov eax, edx
xor ecx, dword [esi + 0x62c]
mov dword [edi], ecx
add edi, 4
mov edx, dword [esi]
add esi, 4
sub ebx, 1
jne 0x4112d5
mov ebx, 0x5bc6c0
mov ebp, 0x18c
mov ecx, edx
lea ebx, [ebx + 4]
xor ecx, eax
lea edi, [edi + 4]
and ecx, 0x7ffffffe
lea esi, [esi + 4]
xor ecx, eax
mov eax, edx
and al, 1
shr ecx, 1
movzx eax, al
neg eax
sbb eax, eax
and eax, 0x9908b0df
xor ecx, eax
mov eax, edx
xor ecx, dword [ebx - 4]
mov dword [edi - 4], ecx
mov edx, dword [esi - 4]
sub ebp, 1
jne 0x411316
mov edx, dword [0x5bc6c0]
mov ecx, edx
xor ecx, eax
and ecx, 0x7ffffffe
xor ecx, eax
mov eax, edx
and al, 1
shr ecx, 1
movzx eax, al
neg eax
sbb eax, eax
and eax, 0x9908b0df
xor ecx, eax
mov eax, edx
xor ecx, dword [ebx]
shr eax, 0xb
xor edx, eax
mov dword [edi], ecx
mov eax, edx
and eax, 0xff3a58ad
shl eax, 7
xor edx, eax
mov eax, edx
and eax, 0xffffdf8c
shl eax, 0xf
xor edx, eax
pop edi
pop esi
mov eax, edx
shr eax, 0x12
pop ebp
xor eax, edx
pop ebx
ret
mov eax, dword [0x5bc6b8]
mov ecx, dword [eax]
add eax, 4
mov dword [0x5bc6b8], eax
mov eax, ecx
shr eax, 0xb
xor ecx, eax
mov eax, ecx
and eax, 0xff3a58ad
shl eax, 7
xor ecx, eax
mov eax, ecx
and eax, 0xffffdf8c
shl eax, 0xf
xor ecx, eax
mov eax, ecx
shr eax, 0x12
xor eax, ecx
ret

Function at 0x416760
Capabilities:
Encode data using xor

Disassembly:
push esi
push edi
lea eax, [ecx + 2]
mov edi, 4
nop word [eax + eax]
movzx ecx, byte [eax + 1]
lea eax, [eax + 4]
movzx edx, byte [eax - 5]
mov esi, dword [ecx*4 + 0x4b10d0]
movzx ecx, byte [eax - 4]
xor esi, dword [edx*4 + 0x4b04d0]
xor esi, dword [ecx*4 + 0x4af3d0]
movzx ecx, byte [eax - 6]
xor esi, dword [ecx*4 + 0x4b14d0]
mov dword [eax - 6], esi
sub edi, 1
jne 0x416770
pop edi
pop esi
ret
Function at 0x416f80
Capabilities:
Encode data using xor
Encrypt data using aes
Reference aes constants

Disassembly:
sub esp, 0x48
push ebp
mov ebp, ecx
mov al, dl
mov byte [esp + 7], al
test ebp, ebp
jne 0x416f9a
mov eax, 0xfffffffd
pop ebp
add esp, 0x48
ret
test al, al
je 0x416faa
cmp al, 1
je 0x416faa
or eax, 0xffffffff
pop ebp
add esp, 0x48
ret
mov byte [ebp], al
mov eax, dword [esp + 0x54]
mov dword [ebp + 1], 0x80
test eax, eax
je 0x417142
push esi
push edi
push 0x10
push eax
lea edi, [ebp + 5]
push edi
call fcn.00468510
mov eax, dword [ebp + 1]
add esp, 0xc
cdq
xor esi, esi
and edx, 7
mov dword [0x4b4304], 0xa
add eax, edx
sar eax, 3
test eax, eax
jle 0x416ffc
nop dword [eax]
mov cl, byte [edi + esi]
mov byte [esp + esi + 0x34], cl
inc esi
cmp esi, eax
jl 0x416ff0
xor ecx, ecx
nop
mov eax, dword [esp + ecx + 0x40]
mov dword [esp + ecx + 0x20], eax
sub ecx, 4
cmp ecx, 0xfffffff4
jge 0x417000
xor edi, edi
xor eax, eax
xor esi, esi
push ebx
nop word [eax + eax]
mov ebx, edi
cmp edi, 0xb
jge 0x417117
cmp esi, 4
jge 0x417047
cmp eax, 4
jge 0x417047
mov ecx, dword [esp + esi*4 + 0x18]
lea edx, [eax + edi*4]
inc esi
mov dword [ebp + edx*4 + 0x2a], ecx
inc eax
cmp esi, 4
jl 0x417030
mov ecx, eax
lea edi, [ebx + 1]
xor eax, eax
cmp ecx, 4
cmovne eax, ecx
cmovne edi, ebx
cmp esi, 4
jl 0x417020
cmp edi, 0xb
jge 0x417117
mov ebx, 0x49b850
nop word [eax + eax]
movzx ecx, byte [esp + 0x25]
lea ebx, [ebx + 4]
mov dl, byte [esp + 0x18]
xor dl, byte [ecx + str.cw]
movzx ecx, byte [esp + 0x26]
movzx ecx, byte [ecx + str.cw]
xor byte [esp + 0x19], cl
movzx ecx, byte [esp + 0x27]
movzx ecx, byte [ecx + str.cw]
xor byte [esp + 0x1a], cl
movzx ecx, byte [esp + 0x24]
movzx ecx, byte [ecx + str.cw]
xor byte [esp + 0x1b], cl
mov ecx, dword [ebx - 4]
xor dl, cl
mov byte [esp + 0x18], dl
mov edx, 1
mov ecx, dword [esp + edx*4 + 0x14]
xor dword [esp + edx*4 + 0x18], ecx
inc edx
cmp edx, 4
jl 0x4170c0
xor esi, esi
cmp edi, 0xb
jge 0x417117
cmp esi, 4
jge 0x4170f7
nop word [eax + eax]
cmp eax, 4
jge 0x4170f7
mov ecx, dword [esp + esi*4 + 0x18]
lea edx, [eax + edi*4]
inc esi
mov dword [ebp + edx*4 + 0x2a], ecx
inc eax
cmp esi, 4
jl 0x4170e0
mov ecx, eax
lea edx, [edi + 1]
xor eax, eax
cmp ecx, 4
cmovne edx, edi
cmovne eax, ecx
mov edi, edx
cmp esi, 4
jl 0x4170d0
cmp edx, 0xb
jl 0x417070
cmp byte [esp + 0x13], 1
pop ebx
jne 0x417136
lea esi, [ebp + 0x3a]
mov edi, 9
mov ecx, esi
call fcn.00416760
add esi, 0x10
sub edi, 1
jne 0x417127
pop edi
pop esi
mov eax, 1
pop ebp
add esp, 0x48
ret
mov eax, 0xfffffffe
pop ebp
add esp, 0x48
ret
Function at 0x417150
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
sub esp, 0xc
push ebx
push ebp
mov ebp, dword [0x4b1df0]
lea eax, [ecx + 1]
push esi
xor edx, edx
mov byte [ecx], 1
push edi
mov dword [esp + 0x14], edx
mov dword [esp + 0x18], eax
nop dword [eax]
add ebp, 0xffffffff
mov dword [0x4b1df0], ebp
jns 0x4172c2
mov edi, 0x5bc6c0
mov esi, 0x5bc6c8
cmp ebp, 0xffffffff
jge 0x4171b3
mov eax, 0x1105
mov ecx, 0x5bc6c4
mov dword [0x5bc6c0], eax
mov edx, 0x26f
imul eax, eax, 0x10dcd
lea ecx, [ecx + 4]
mov dword [ecx - 4], eax
sub edx, 1
jne 0x4171a2
mov ebx, dword [0x5bc6c0]
mov ebp, 0x26f
mov eax, dword [0x5bc6c4]
mov dword [0x4b1df0], ebp
mov dword [0x5bc6b8], 0x5bc6c4
mov dword [esp + 0x10], 0xe3
nop dword [eax + eax]
mov edx, eax
mov ecx, eax
xor edx, ebx
and cl, 1
and edx, 0x7ffffffe
movzx ecx, cl
xor edx, ebx
mov ebx, eax
shr edx, 1
neg ecx
sbb ecx, ecx
and ecx, 0x9908b0df
xor edx, ecx
xor edx, dword [esi + 0x62c]
mov dword [edi], edx
add edi, 4
mov eax, dword [esi]
add esi, 4
sub dword [esp + 0x10], 1
jne 0x4171e0
mov ebp, 0x5bc6c0
mov dword [esp + 0x10], 0x18c
mov edx, eax
lea ebp, [ebp + 4]
xor edx, ebx
lea edi, [edi + 4]
and edx, 0x7ffffffe
lea esi, [esi + 4]
xor edx, ebx
mov ecx, eax
and cl, 1
shr edx, 1
movzx ecx, cl
mov ebx, eax
neg ecx
sbb ecx, ecx
and ecx, 0x9908b0df
xor edx, ecx
xor edx, dword [ebp - 4]
sub dword [esp + 0x10], 1
mov dword [edi - 4], edx
mov eax, dword [esi - 4]
jne 0x417228
mov edx, dword [0x5bc6c0]
mov ecx, edx
xor ecx, ebx
mov eax, edx
and al, 1
and ecx, 0x7ffffffe
movzx eax, al
xor ecx, ebx
shr ecx, 1
neg eax
sbb eax, eax
and eax, 0x9908b0df
xor ecx, eax
mov eax, edx
xor ecx, dword [ebp]
shr eax, 0xb
xor edx, eax
mov ebp, dword [0x4b1df0]
mov eax, edx
mov dword [edi], ecx
and eax, 0xff3a58ad
shl eax, 7
xor edx, eax
mov eax, edx
and eax, 0xffffdf8c
shl eax, 0xf
xor edx, eax
mov eax, edx
shr eax, 0x12
xor eax, edx
mov edx, dword [esp + 0x14]
jmp 0x4172f7
mov eax, dword [0x5bc6b8]
mov ecx, dword [eax]
add eax, 4
mov dword [0x5bc6b8], eax
mov eax, ecx
shr eax, 0xb
xor ecx, eax
mov eax, ecx
and eax, 0xff3a58ad
shl eax, 7
xor ecx, eax
mov eax, ecx
and eax, 0xffffdf8c
shl eax, 0xf
xor ecx, eax
mov eax, ecx
shr eax, 0x12
xor eax, ecx
mov ecx, dword [esp + 0x18]
mov byte [ecx + edx], al
inc edx
mov dword [esp + 0x14], edx
cmp edx, 0x10
jl 0x417170
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0xc
ret
Function at 0x417b50
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x1008
call fcn.004622b0
push ebx
mov ebx, edx
mov dword [esp + 0xc], 0x505051f
push ebp
push esi
push edi
mov edi, ecx
mov byte [esp + 0x1c], 5
lea eax, [ebx + 1]
mov ecx, 4
cdq
xor esi, esi
idiv ecx
xor ecx, ecx
mov dword [esp + 0x14], edx
mov ebp, eax
xor dl, dl
test ebx, ebx
jle 0x417c1c
cmp ebx, 0x20
jb 0x417c10
movaps xmm3, xmmword [0x4a2bc0]
mov eax, ebx
and eax, 0xffffffe0
xorps xmm2, xmm2
xorps xmm1, xmm1
nop word [eax + eax]
movups xmm0, xmmword [ecx + edi]
pand xmm0, xmm3
pxor xmm2, xmm0
movups xmm0, xmmword [ecx + edi + 0x10]
add ecx, 0x20
pand xmm0, xmm3
pxor xmm1, xmm0
cmp ecx, eax
jl 0x417bb0
pxor xmm1, xmm2
movaps xmm0, xmm1
psrldq xmm0, 8
pxor xmm1, xmm0
movups xmm0, xmm1
psrldq xmm0, 4
pxor xmm1, xmm0
movups xmm0, xmm1
psrldq xmm0, 2
pxor xmm1, xmm0
movups xmm0, xmm1
psrldq xmm0, 1
pxor xmm1, xmm0
movd edx, xmm1
cmp ecx, ebx
jge 0x417c1c
nop dword [eax]
mov al, byte [ecx + edi]
inc ecx
and al, 0xaa
xor dl, al
cmp ecx, ebx
jl 0x417c10
push ebx
push edi
push 0x4d4311
mov byte [0x4d4310], dl
call fcn.00462e50
add esp, 0xc
xor ecx, ecx
test ebx, ebx
jle 0x417c69
mov edx, dword [esp + 0x101c]
nop
movzx eax, byte [ecx + 0x4d4311]
mov al, byte [eax + 0x49bcd0]
mov byte [ecx + 0x4d4311], al
test esi, esi
je 0x417c61
xor al, dl
xor al, 0xcc
mov byte [ecx + 0x4d4311], al
inc ecx
xor esi, 1
cmp ecx, ebx
jl 0x417c40
mov esi, 1
nop
call fcn.00468b86
and eax, reloc.WS2_32.dll_closesocket
jns 0x417c81
dec eax
or eax, 0xfffffffc
inc eax
mov ecx, 1
cmp esi, ecx
jle 0x417c9e
nop word [eax + eax]
movzx edx, byte [esp + ecx + 0x18]
cmp edx, eax
je 0x417c70
inc ecx
cmp ecx, esi
jl 0x417c90
mov byte [esp + esi + 0x18], al
inc esi
cmp esi, 5
jl 0x417c70
xor esi, esi
lea edi, [esp + 0x1d]
nop
movzx eax, byte [esp + esi + 0x19]
imul eax, ebp
push ebp
add eax, 0x4d4310
push eax
push edi
call fcn.00462e50
inc esi
add esp, 0xc
add edi, ebp
cmp esi, 4
jl 0x417cb0
mov eax, dword [esp + 0x14]
test eax, eax
jle 0x417cf1
push eax
lea eax, [ebp*4 + 0x4d4310]
push eax
lea eax, [esp + 0x25]
lea eax, [eax + ebp*4]
push eax
call fcn.00462e50
add esp, 0xc
add ebx, 6
xor ecx, ecx
test ebx, ebx
jle 0x417d7a
cmp ebx, 0x40
jb 0x417d70
mov eax, ebx
and eax, 0x8000003f
jns 0x417d11
dec eax
or eax, 0xffffffc0
inc eax
movaps xmm2, xmmword [0x4a2b90]
mov edx, ebx
sub edx, eax
nop dword [eax]
movups xmm0, xmmword [esp + ecx + 0x18]
movaps xmm1, xmm2
pxor xmm1, xmm0
movups xmmword [esp + ecx + 0x18], xmm1
movups xmm0, xmmword [esp + ecx + 0x28]
movaps xmm1, xmm2
pxor xmm0, xmm2
movups xmmword [esp + ecx + 0x28], xmm0
movups xmm0, xmmword [esp + ecx + 0x38]
pxor xmm0, xmm2
movups xmmword [esp + ecx + 0x38], xmm0
movups xmm0, xmmword [esp + ecx + 0x48]
pxor xmm1, xmm0
movups xmmword [esp + ecx + 0x48], xmm1
add ecx, 0x40
cmp ecx, edx
jl 0x417d20
cmp ecx, ebx
jge 0x417d7a
nop dword [eax]
xor byte [esp + ecx + 0x18], 4
inc ecx
cmp ecx, ebx
jl 0x417d70
push ebx
lea eax, [esp + 0x1c]
push eax
push 0x4d4310
call fcn.00462e50
add esp, 0xc
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x1008
ret
Function at 0x417da0
Capabilities:
Hash data using sha1

Disassembly:
test byte [esp + 4], 1
push esi
mov esi, ecx
mov dword [esi], vtable.CSHA1.0
mov dword [esi + 4], 0x67452301
mov dword [esi + 8], 0xefcdab89
mov dword [esi + 0xc], 0x98badcfe
mov dword [esi + 0x10], 0x10325476
mov dword [esi + 0x14], 0xc3d2e1f0
mov dword [esi + 0x18], 0
mov dword [esi + 0x1c], 0
je 0x417def
push 0xb4
push esi
call fcn.00461132
add esp, 8
mov eax, esi
pop esi
ret 4
Function at 0x4191a0
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x14
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
cmp edi, 0xffffffff
jne 0x4191bf
or eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x14
mov esi, dword [ebp + 0x18]
push esi
call dword [sym.imp.WS2_32.dll_htons]
cmp byte [0x4b4303], 0
mov word [esp + 0x12], ax
mov eax, dword [ebp + 0x14]
mov dword [esp + 0x14], eax
mov eax, 2
mov word [esp + 0x10], ax
jne 0x4191fe
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push eax
call fcn.00468ba7
add esp, 4
mov byte [0x4b4303], 1
push ecx
mov ecx, dword [ebp + 0xc]
movzx eax, si
mov esi, dword [ebp + 0x10]
mov edx, esi
push eax
call fcn.00417b50
add esp, 8
add esi, 6
mov dword [ebp + 0x10], esi
jmp 0x419223
mov esi, dword [ebp + 0x10]
mov ebx, dword [0x5bc698]
cmp byte [ebx + 0x1a], 0
je 0x41928c
cmp dword [ebx], 0xffffffff
je 0x41928c
add esi, 0xa
push esi
call fcn.004610f4
push dword [ebp + 0x10]
mov edi, eax
push 0x4d4310
lea ecx, [edi + 0xa]
push ecx
call fcn.00462e50
add esp, 0x10
mov dword [edi], 0x1000000
mov eax, dword [esp + 0x14]
mov dword [edi + 4], eax
mov ax, word [esp + 0x12]
push 0x10
mov word [edi + 8], ax
lea eax, [ebx + 4]
push eax
push 0
push esi
push edi
push dword [ebp + 8]
call dword [sym.imp.WS2_32.dll_sendto]
push edi
mov esi, eax
call fcn.004610fd
mov edi, dword [ebp + 8]
add esp, 4
jmp 0x4192a4
push 0x10
lea eax, [esp + 0x14]
push eax
push 0
push esi
push 0x4d4310
push edi
call dword [sym.imp.WS2_32.dll_sendto]
mov esi, eax
test esi, esi
je 0x419220
cmp esi, 0xffffffff
je 0x4192bc
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x14
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x14

Function at 0x4192d0
Capabilities:
Get hostname
Resolve dns

Disassembly:
sub esp, 0x50
lea eax, [esp]
push 0x50
push eax
call dword [sym.imp.WS2_32.dll_gethostname]
cmp eax, 0xffffffff
je 0x419340
push ebx
lea eax, [esp + 4]
push eax
call dword [sym.imp.WS2_32.dll_gethostbyname]
mov ebx, eax
test ebx, ebx
je 0x41933f
mov ecx, dword [ebx + 0xc]
cmp dword [ecx], 0
je 0x41933f
push ebp
mov ebp, dword [sym.imp.WS2_32.dll_inet_ntoa]
push esi
push edi
mov edi, dword [esp + 0x64]
xor esi, esi
nop dword [eax]
cmp esi, 0x28
jge 0x41933c
mov eax, dword [esi + ecx]
push dword [eax]
call ebp
mov edx, edi
sub edx, eax
mov cl, byte [eax]
lea eax, [eax + 1]
mov byte [edx + eax - 1], cl
test cl, cl
jne 0x419320
mov ecx, dword [ebx + 0xc]
add esi, 4
add edi, 0x10
cmp dword [esi + ecx], 0
jne 0x419310
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x50
ret 4
Function at 0x41a100
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x488aff
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push esi
mov esi, ecx
push 0
mov dword [ebp - 0x10], esi
call fcn.0045f8c6
mov dword [ebp - 4], 0
mov dword [esi + 4], 0
mov byte [esi + 8], 0
mov dword [esi + 0xc], 0
mov byte [esi + 0x10], 0
xor eax, eax
mov dword [esi + 0x14], 0
mov word [esi + 0x18], ax
mov dword [esi + 0x1c], eax
mov word [esi + 0x20], ax
mov dword [esi + 0x24], eax
mov byte [esi + 0x28], al
mov dword [esi + 0x2c], eax
mov byte [esi + 0x30], al
mov eax, dword [ebp + 8]
mov byte [ebp - 4], 6
test eax, eax
je 0x41a18b
push eax
push esi
call fcn.0045fba9
mov ecx, dword [ebp - 0xc]
add esp, 8
mov eax, esi
mov dword fs:[0], ecx
pop esi
mov esp, ebp
pop ebp
ret 4
push str.bad_locale_name
call fcn.0045f61a
int3
Function at 0x427390
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4886c0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
push ebx
mov eax, ecx
push esi
push edi
push 8
mov dword [ebp - 0x10], eax
mov dword [eax], vtable.std::basic_streambuf_char__struct_std::char_traits_char__.0
call fcn.00461102
mov esi, eax
push 1
mov dword [ebp - 4], 0
call fcn.0045faa9
mov dword [esi + 4], eax
add esp, 8
mov eax, dword [ebp - 0x10]
lea edi, [eax + 0x14]
lea ecx, [eax + 0x18]
lea edx, [eax + 0x24]
mov dword [eax + 0x34], esi
lea ebx, [eax + 4]
mov dword [eax + 0xc], ebx
lea esi, [eax + 8]
mov dword [eax + 0x10], esi
mov dword [eax + 0x1c], edi
mov dword [eax + 0x20], ecx
mov dword [eax + 0x2c], edx
add eax, 0x28
mov dword [ebp - 0x14], ebx
mov ebx, dword [ebp - 0x10]
mov dword [ebx + 0x30], eax
mov ebx, dword [ebp - 0x14]
mov dword [esi], 0
mov dword [ecx], 0
mov ecx, dword [ebp - 0xc]
mov dword [eax], 0
mov eax, dword [ebp - 0x10]
mov dword [ebx], 0
mov dword [edi], 0
pop edi
pop esi
mov dword [edx], 0
pop ebx
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret

Function at 0x42baa0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
mov eax, dword [ebp + 8]
xor ecx, ecx
push esi
push edi
mov edx, 0x811c9dc5
mov esi, dword [eax + 4]
mov edi, dword [eax]
test esi, esi
je 0x42bad1
nop dword [eax + eax]
movzx eax, byte [edi + ecx]
inc ecx
xor eax, edx
imul edx, eax, 0x1000193
cmp ecx, esi
jb 0x42bac0
pop edi
mov eax, edx
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x42fdc0
Capabilities:
Hash data using fnv

Disassembly:
push ebx
push esi
push edi
mov edi, dword [esp + 0x10]
push 0x15
mov esi, dword [edi + 4]
push esi
call dword [sym.imp.lua51.dll_lua_checkstack]
add esp, 8
test eax, eax
jne 0x42fdee
push str.not_enough_Lua_stack_space_to_push_this_reference_value
push str.stack_overflow___s_
push esi
call dword [sym.imp.lua51.dll_luaL_error]
add esp, 0xc
push dword [edi]
push 0xffffd8f0
push esi
call dword [sym.imp.lua51.dll_lua_rawgeti]
push 0xffffffffffffffff
push esi
call dword [sym.imp.lua51.dll_lua_type]
push 0xffffffffffffffff
push esi
call dword [sym.imp.lua51.dll_lua_topointer]
push 0xfffffffffffffffe
push esi
mov ebx, eax
call dword [sym.imp.lua51.dll_lua_settop]
movzx ecx, bl
add esp, 0x24
xor ecx, 0x811c9dc5
imul edx, ecx, 0x1000193
mov ecx, ebx
shr ecx, 8
movzx eax, cl
pop edi
pop esi
xor edx, eax
mov eax, ebx
shr eax, 0x10
imul ecx, edx, 0x1000193
movzx eax, al
shr ebx, 0x18
xor ecx, eax
imul eax, ecx, 0x1000193
xor eax, ebx
imul eax, eax, 0x1000193
pop ebx
ret 4

Function at 0x455460
Capabilities:
Create thread
Set console window title

Disassembly:
push ecx
call dword [sym.imp.KERNEL32.dll_AllocConsole]
cmp byte [0x5bd305], 0
je 0x45547f
push 0xb
call dword [sym.imp.KERNEL32.dll_GetConsoleWindow]
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
push esi
push edi
push 1
call fcn.004662bb
push 1
mov esi, eax
call fcn.004662bb
push esi
push 0x4a1a68
push str.CONOUT_
push eax
call fcn.0046a30d
add esp, 0x18
push 0x4e3
call dword [sym.imp.KERNEL32.dll_SetConsoleCP]
push 0x4e3
call dword [sym.imp.KERNEL32.dll_SetConsoleOutputCP]
mov edi, dword [sym.imp.KERNEL32.dll_GetStdHandle]
push 0xfffffffffffffff5
call edi
push 0x4000
push eax
call fcn.004701f9
push 0x4a1a68
push eax
call fcn.0046fc0d
push 1
mov esi, dword [eax]
call fcn.004662bb
add esp, 0x14
mov dword [eax], esi
push 0
push 4
push 0
push 1
call fcn.004662bb
add esp, 4
push eax
call fcn.0046fd43
add esp, 0x10
push 0xfffffffffffffff6
call edi
push 0x4000
push eax
call fcn.004701f9
push 0x49d8a8
push eax
call fcn.0046fc0d
push 0
mov esi, dword [eax]
call fcn.004662bb
add esp, 0x14
mov dword [eax], esi
push 0
push 4
push 0
push 0
call fcn.004662bb
add esp, 4
push eax
call fcn.0046fd43
add esp, 0x10
push 0xfffffffffffffff4
call edi
push 0x4000
push eax
call fcn.004701f9
push 0x4a1a68
push eax
call fcn.0046fc0d
push 2
mov esi, dword [eax]
call fcn.004662bb
add esp, 0x14
mov dword [eax], esi
push 0
push 4
push 0
push 2
call fcn.004662bb
add esp, 4
push eax
call fcn.0046fd43
add esp, 0x10
lea ecx, [esp + 8]
push 2
call fcn.0045f8c6
lea ecx, [esp + 8]
mov byte [0x4ad004], 1
call fcn.0045f91e
push str.RakSAMP_Lite
call dword [sym.imp.KERNEL32.dll_SetConsoleTitleA]
push 0
push 0
push 0
push 0x455380
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
push 1
push 0x455410
call dword [sym.imp.KERNEL32.dll_SetConsoleCtrlHandler]
pop edi
pop esi
pop ecx
ret
Function at 0x458730
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x11c
push ebx
push ebp
mov ebp, ecx
push esi
push edi
test edx, edx
je 0x45889d
push edx
push 0x49d584
lea eax, [esp + 0x2c]
push 0x104
push eax
call fcn.00456210
add esp, 0x10
lea edx, [esp + 0x10]
lea ecx, [esp + 0x24]
call fcn.00458420
lea edi, [esp + 0x10]
mov ebx, 5
mov dl, byte [edi]
mov ecx, 0x49c780
mov esi, 0x64
nop
xor dl, byte [ecx]
lea ecx, [ecx + 1]
xor dl, 0x2f
sub esi, 1
jne 0x458780
mov byte [edi], dl
inc edi
sub ebx, 1
jne 0x458772
lea edi, [esp + 0x15]
lea ebx, [esi + 5]
nop dword [eax]
mov dl, byte [edi]
mov ecx, 0x49c780
mov esi, 0x64
nop dword [eax]
xor dl, byte [ecx]
lea ecx, [ecx + 1]
xor dl, 0x45
sub esi, 1
jne 0x4587b0
mov byte [edi], dl
inc edi
sub ebx, 1
jne 0x4587a0
lea edi, [esp + 0x1a]
lea ebx, [esi + 5]
nop dword [eax]
mov dl, byte [edi]
mov ecx, 0x49c780
mov esi, 0x64
nop dword [eax]
xor dl, byte [ecx]
lea ecx, [ecx + 1]
xor dl, 0x6f
sub esi, 1
jne 0x4587e0
mov byte [edi], dl
inc edi
sub ebx, 1
jne 0x4587d0
lea edi, [esp + 0x1f]
lea ebx, [esi + 5]
nop dword [eax]
mov dl, byte [edi]
mov eax, 0x49c780
mov esi, 0x64
nop dword [eax]
xor dl, byte [eax]
lea eax, [eax + 1]
xor dl, 0xdb
sub esi, 1
jne 0x458810
mov byte [edi], dl
inc edi
sub ebx, 1
jne 0x458800
xor ecx, ecx
mov edx, 0x14
nop dword [eax]
mov al, byte [ecx + 0x49c760]
xor byte [esp + ecx + 0x10], al
inc ecx
sub edx, 1
jne 0x458830
xor ch, ch
lea esi, [esp + 0x10]
lea edi, [edx + 0x39]
nop dword [eax]
mov bl, byte [esi]
lea esi, [esi + 1]
mov dl, bl
shr dl, 4
movzx eax, dl
add eax, 0x30
cmp edi, eax
movzx eax, ch
sbb cl, cl
and bl, 0xf
and cl, 7
inc ch
add cl, 0x30
add cl, dl
mov byte [eax + ebp], cl
movzx eax, bl
add eax, 0x30
cmp edi, eax
movzx eax, ch
sbb cl, cl
inc ch
and cl, 7
add cl, 0x30
add cl, bl
mov byte [eax + ebp], cl
cmp ch, 0x28
jb 0x458850
movzx eax, ch
mov byte [eax + ebp], 0
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x11c
ret

Function at 0x458de0
Capabilities:
Set console window title

Disassembly:
cmp byte [0x5bd2fa], 0
je 0x458e2a
cmp byte [0x5bd300], 0
je 0x458e13
cmp dword [esp + 0x18], 0x10
lea ecx, [esp + 4]
push esi
cmovae ecx, dword [esp + 8]
lea esi, [esp + 8]
cmovae esi, dword [esp + 8]
push esi
push ecx
call dword [sym.imp.USER32.dll_CharToOemA]
pop esi
cmp dword [esp + 0x18], 0x10
lea eax, [esp + 4]
cmovae eax, dword [esp + 4]
push eax
call dword [sym.imp.KERNEL32.dll_SetConsoleTitleA]
jmp 0x458e45
cmp dword [esp + 0x18], 0x10
lea eax, [esp + 4]
cmovae eax, dword [esp + 4]
push eax
push dword [0x4d5870]
call dword [sym.imp.USER32.dll_SetWindowTextA]
mov ecx, dword [esp + 0x18]
cmp ecx, 0x10
jb 0x458e77
mov edx, dword [esp + 4]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x458e6d
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x458e78
push ecx
push edx
call fcn.00461132
add esp, 8
ret
call fcn.00468948
int3
Function at 0x459990
Capabilities:
Check for time delay via queryperformancecounter

Disassembly:
sub esp, 0x1c
push ebx
push edi
lea eax, [esp + 0x18]
mov edi, edx
push eax
mov ebx, ecx
call dword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
lea eax, [esp + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
lea eax, [esp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov ecx, dword [esp + 8]
sub ecx, dword [esp + 0x10]
mov eax, dword [esp + 0xc]
sbb eax, dword [esp + 0x14]
push 0
push 0xf4240
push eax
push ecx
call fcn.00461c80
push dword [esp + 0x1c]
push dword [esp + 0x1c]
push edx
push eax
call fcn.00485cd0
push eax
call fcn.00468ba7
add esp, 4
call fcn.00468b86
mov ecx, eax
sub edi, ebx
mov eax, 0x80010003
imul ecx
add edx, ecx
sar edx, 0xe
mov eax, edx
shr eax, 0x1f
add eax, edx
imul eax, edi
pop edi
add eax, ebx
pop ebx
add esp, 0x1c
ret