joyce8/EMBER2024-capa huggingface dataset:
Function at 0x41d572
Capabilities:
Create pipe

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 8
mov ecx, dword [0x519058]
mov eax, dword [ebp + 8]
mov edx, dword [ebp + 0x2c]
mov esi, 5
xor ecx, ebp
cmp eax, 3
mov dword [ebp - 0x10], ecx
mov dword [edx], 0xffffffff
jne 0x41d60a
mov edi, dword [ebp + 0x10]
mov esi, dword [ebp + 0x28]
mov edx, dword [ebp + 0x24]
mov ecx, dword [ebp + 0x18]
mov eax, dword [ebp + 0x14]
mov ebx, dword [ebp + 0xc]
cmp dword [edi + 0x14], 7
jbe 0x41d5b6
mov edi, dword [edi]
mov ebx, dword [ebx]
push 0
push esi
push edx
push dword [ebp + 0x20]
push dword [ebp + 0x1c]
push ecx
push eax
push edi
call dword [sym.imp.KERNEL32.dll_CreateNamedPipeW]
cmp eax, 0xffffffff
je 0x41d5f7
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
xor edi, edi
lea ecx, [ebp - 0x14]
push 3
push edi
push edi
push ecx
push ebx
push esi
push eax
call dword [sym.imp.KERNEL32.dll_DuplicateHandle]
cmp eax, 1
lea eax, [ebp - 0x14]
sbb edi, edi
or edi, dword [eax]
jmp 0x41d5fa
xor edi, edi
dec edi
mov eax, dword [ebp + 0x2c]
mov dword [eax], edi
xor eax, eax
cmp edi, 0xffffffff
sete al
lea esi, [eax + eax*4]
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0049a81b
mov eax, esi
add esp, 8
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x41d934
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x54
mov ecx, dword [ebp + 8]
mov eax, dword [0x519058]
mov edi, 5
add ecx, 0xfffffffb
xor eax, ebp
cmp ecx, 1
mov dword [ebp - 0x10], eax
ja 0x41da88
mov eax, dword [ebp + 0x14]
xor edi, edi
mov ecx, 7
mov esi, dword [ebp + 0x18]
mov dword [ebp - 0x4c], edi
mov dword [ebp - 0x50], edi
mov dword [ebp - 0x44], edi
mov dword [ebp - 0x48], edi
mov dword [ebp - 0x3c], edi
mov dword [ebp - 0x40], edi
mov dword [ebp - 0x34], edi
mov dword [ebp - 0x38], edi
mov dword [ebp - 0x2c], edi
mov dword [ebp - 0x30], edi
mov dword [ebp - 0x24], edi
mov dword [ebp - 0x28], edi
mov dword [ebp - 0x1c], edi
mov dword [ebp - 0x20], edi
mov dword [ebp - 0x14], edi
mov dword [ebp - 0x18], edi
mov dword [ebp - 0x54], 0x44
cmp dword [eax + 0x14], ecx
jbe 0x41d9a6
mov eax, dword [eax]
mov ebx, dword [ebp + 0x10]
push eax
call fcn.004abd7b
add esp, 4
mov edx, 7
mov ecx, dword [esi + 0x10]
cmp dword [esi + 0x14], edx
jbe 0x41d9c1
mov esi, dword [esi]
test ecx, ecx
mov edx, dword [ebp + 0x1c]
cmove esi, ecx
mov ecx, 7
cmp dword [ebx + 0x14], ecx
mov ecx, dword [ebp + 0xc]
jbe 0x41d9d8
mov ebx, dword [ebx]
mov ecx, dword [ecx]
mov dword [ebp - 0x5c], ecx
lea ecx, [ebp - 0x54]
push edx
push ecx
push esi
push edi
push edi
push edi
push edi
push edi
mov dword [ebp - 0x58], eax
push eax
push ebx
mov esi, edx
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
mov edi, 5
test eax, eax
je 0x41da78
mov eax, dword [ebp + 8]
mov ebx, 0x101c01
cmp eax, 6
mov eax, 0x1fffff
cmove ebx, eax
mov eax, dword [esi]
mov dword [ebp - 0x60], eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push 1
push 0
push ebx
push esi
push dword [ebp - 0x5c]
push dword [ebp - 0x60]
push eax
call dword [sym.imp.KERNEL32.dll_DuplicateHandle]
mov ebx, dword [esi + 4]
test eax, eax
je 0x41da71
mov eax, esi
mov esi, 0x100c43
mov ecx, 0x1fffff
add eax, 4
cmp dword [ebp + 8], 6
mov edi, eax
cmove esi, ecx
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push 1
push 0
push esi
push edi
push dword [ebp - 0x5c]
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_DuplicateHandle]
xor ecx, ecx
test eax, eax
sete cl
lea edi, [ecx + ecx*4]
jmp 0x41da78
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x58]
test eax, eax
je 0x41da88
push eax
call fcn.004a4a28
add esp, 4
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0049a81b
mov eax, edi
add esp, 0x54
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x41da9c
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0xc
mov ecx, dword [ebp + 0xc]
mov ebx, dword [ebp + 0x20]
mov eax, dword [ebp + 8]
mov dword [ebp - 0x18], ecx
mov ecx, dword [ebp + 0x10]
mov dword [ebp - 0x14], ecx
xor ecx, ecx
mov edi, dword [ebp + 0x1c]
mov edx, dword [ebp + 0x14]
mov esi, dword [ebp + 0x18]
mov dword [ebp - 0x10], ebx
mov dword [ebx], ecx
xor ebx, ebx
push edi
mov edi, eax
push esi
push edx
push dword [ebp - 0x14]
push dword [ebp - 0x18]
push ebx
push dword [eax]
call dword [sym.imp.KERNEL32.dll_CreateRemoteThread]
test eax, eax
je 0x41db0d
mov edi, dword [edi]
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push 3
push ebx
push ebx
push dword [ebp - 0x10]
push edi
push esi
push eax
call dword [sym.imp.KERNEL32.dll_DuplicateHandle]
xor ecx, ecx
test eax, eax
sete cl
lea eax, [ecx + ecx*4]
add esp, 0xc
pop esi
pop edi
pop ebx
pop ebp
ret
add esp, 0xc
pop esi
pop edi
pop ebx
pop ebp
jmp dword [sym.imp.KERNEL32.dll_GetLastError]
Function at 0x41fa3c
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0xd8
mov edx, dword [0x519058]
mov al, byte [ebp + 8]
mov ebx, ecx
xor edx, ebp
test al, al
mov dword [esp + 0xd0], edx
je 0x41fa96
xor esi, esi
mov edi, 0x4e451c
mov ecx, ebx
inc esi
push 0
push 0x4362d8
push esi
push str.NtMapViewOfSection
push edi
call fcn.0041f5ca
mov ecx, ebx
push esi
push 0x436494
push esi
push str.NtUnmapViewOfSection
push edi
call fcn.0041f5ca
jmp 0x41faa0
cmp dword [ebx + 8], 0
je 0x41fbc3
mov eax, dword [ebx]
mov edi, dword [eax]
push 1
push 0x2000
push 0x10000
push 0
push edi
call dword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov esi, dword [ebx + 8]
mov dword [esp + 4], eax
shl esi, 6
lea eax, [esi + 0x50]
mov dword [esp + 8], eax
push eax
call fcn.0041f46c
add esp, 4
mov dword [esp + 0xc], ebx
mov ebx, eax
mov eax, 0xfffff000
add esi, 0x104f
mov ecx, ebx
and ebx, 0xfff
and esi, eax
and ecx, eax
add ecx, dword [esp + 4]
push 0x40
push 0x1000
push esi
push ecx
mov dword [esp + 0x14], edi
push edi
call dword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov edi, eax
test eax, eax
jne 0x41fb2f
lea esi, [esp + 0x18]
mov ecx, esi
push str.thunk_base
push 0x188
push str..._.._sandbox_win_src_interception.cc
call fcn.0040a140
mov ecx, esi
call fcn.0040a280
add edi, ebx
mov ebx, dword [esp + 8]
lea esi, [esp + 0x18]
xor eax, eax
mov dword [esi], ebx
mov dword [esi + 0xc], eax
mov dword [esi + 4], 0x10
push 0xa8
push eax
push 0x51baa4
call fcn.004a19e0
add esp, 0xc
mov ecx, dword [esp + 0xc]
push esi
push ebx
push edi
call fcn.0041fdb0
mov ebx, eax
test eax, eax
jne 0x41fbc5
lea eax, [esp + 0x14]
push eax
push 0x10
push esi
push edi
push dword [esp + 0x14]
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
test eax, eax
mov ebx, 0x2a
je 0x41fbc5
cmp dword [esp + 0x14], 0x10
jne 0x41fbc5
lea eax, [esp + 0x10]
push eax
push 0x20
push dword [esp + 0x10]
push edi
push dword [esp + 0x14]
call dword [sym.imp.KERNEL32.dll_VirtualProtectEx]
mov eax, dword [esp + 0xc]
mov ecx, dword [eax]
push 0xa8
push 0x51baa4
push str.g_originals
call fcn.00409b16
mov ebx, eax
jmp 0x41fbc5
xor ebx, ebx
mov ecx, dword [esp + 0xd0]
xor ecx, ebp
call fcn.0049a81b
mov eax, ebx
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret 4
Function at 0x4219e0
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x28
mov eax, dword [0x519058]
mov edi, dword [ebp + 8]
mov esi, ecx
lea ebx, [ebp - 0x20]
xor eax, ebp
mov dword [ebp - 0x10], eax
lea eax, [ecx + 4]
mov dword [ecx], 0x4e58fc
mov dword [ecx + 4], 0x4e5904
mov dword [ecx + 8], edi
mov dword [ecx + 0xc], 0
mov dword [ecx + 0x10], 0
mov dword [ebp - 0x2c], eax
mov eax, dword [edi + 0x228]
mov dword [ecx + 0x14], eax
push ebx
call fcn.00438ff0
add esp, 4
mov ecx, ebx
mov dword [ebp - 0x34], esi
push esi
call fcn.00439020
call fcn.00439050
mov ebx, eax
mov dword [ebp - 0x28], esp
sub esp, 0xc
mov esi, esp
call fcn.00439a30
mov eax, dword [eax]
test eax, eax
mov dword [esi + 8], eax
je 0x421a5d
lock inc dword [eax + 4]
mov eax, dword [ebp - 0x2c]
mov ecx, ebx
mov dword [esi], eax
mov dword [esi + 4], str.ThreadLocalEventBuffer
call fcn.004391c0
mov esp, dword [ebp - 0x28]
call fcn.00406a70
lea esi, [edi + 4]
mov ebx, eax
mov dword [ebp - 0x24], eax
mov ecx, esi
call fcn.0042a4b0
mov dword [ebp - 0x28], esp
push eax
mov edi, esp
call fcn.00439a30
mov eax, dword [eax]
mov dword [ebp - 0x30], edi
mov dword [ebp - 0x2c], esi
test eax, eax
mov dword [edi], eax
je 0x421ab2
lock inc dword [eax + 4]
mov bl, byte [ebp - 0x24]
mov bh, byte [ebp - 0x23]
mov al, byte [ebp - 0x22]
mov cl, byte [ebp - 0x21]
jmp 0x421abc
mov eax, ebx
mov ecx, ebx
shr eax, 0x10
shr ecx, 0x18
movzx edx, bl
movzx esi, bh
movzx eax, al
mov edi, ecx
mov ecx, dword [ebp + 8]
xor edx, 0x811c9dc5
imul edx, edx, 0x1000193
xor esi, edx
imul edx, esi, 0x1000193
mov ebx, dword [ecx + 0x1fc]
xor eax, edx
imul edx, eax, 0x1000193
mov eax, edi
mov edi, dword [ecx + 0x1f4]
movzx eax, al
xor eax, edx
imul esi, eax, 0x1000193
and esi, dword [ecx + 0x208]
mov eax, dword [ebx + esi*8]
cmp edi, eax
je 0x421b38
mov edx, dword [ebp - 0x24]
cmp dword [eax + 8], edx
je 0x421b2b
add esi, esi
shl esi, 2
or esi, 4
mov esi, dword [ebx + esi]
nop
cmp eax, esi
je 0x421b38
mov eax, dword [eax]
cmp dword [eax + 8], edx
jne 0x421b20
cmp eax, edi
je 0x421b38
mov dword [ebp - 0x20], eax
mov byte [ebp - 0x1c], 0
jmp 0x421b5d
lea eax, [ebp - 0x24]
add ecx, 0x1f0
lea edx, [ebp - 0x18]
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x14]
push eax
push edx
push 0x4e5ae7
lea eax, [ebp - 0x20]
push eax
call fcn.00425830
mov eax, dword [ebp - 0x20]
mov ebx, dword [ebp - 0x30]
mov ecx, dword [eax + 0xc]
mov esi, dword [ebp - 0x34]
mov edi, dword [ebp - 0x28]
mov edx, dword [ebx]
test ecx, ecx
mov dword [eax + 0xc], edx
mov dword [ebx], ecx
je 0x421b89
lock dec dword [ecx + 4]
jne 0x421b89
add ecx, 4
add ecx, 0xfffffffc
push ecx
call fcn.00432a50
add esp, 4
mov esp, edi
push dword [ebp - 0x2c]
call dword [sym.imp.KERNEL32.dll_ReleaseSRWLockExclusive]
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0049a81b
mov eax, esi
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret 4
Function at 0x421cc0
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x10
mov edx, dword [ebp + 8]
mov edi, dword [ecx + 0xc]
movzx eax, byte [edx]
movzx esi, byte [edx + 1]
xor eax, 0x811c9dc5
imul eax, eax, 0x1000193
xor esi, eax
imul eax, esi, 0x1000193
movzx esi, byte [edx + 2]
xor esi, eax
imul eax, esi, 0x1000193
movzx esi, byte [edx + 3]
xor esi, eax
imul ebx, esi, 0x1000193
mov esi, dword [ecx + 4]
and ebx, dword [ecx + 0x18]
mov eax, dword [edi + ebx*8]
cmp esi, eax
je 0x421d52
mov dword [ebp - 0x1c], esi
mov esi, dword [edx]
add ebx, ebx
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x10], edi
mov ecx, ebx
or ebx, 1
mov edx, dword [edi + ebx*4]
mov edi, eax
mov dword [ebp - 0x14], ebx
cmp dword [eax + 8], esi
je 0x421d3b
mov edi, eax
nop
cmp edx, edi
je 0x421d52
mov edi, dword [edi]
cmp dword [edi + 8], esi
jne 0x421d30
cmp edx, edi
je 0x421d56
mov esi, dword [ebp - 0x18]
cmp edi, eax
jne 0x421d76
mov eax, dword [edi]
mov ebx, dword [ebp - 0x10]
mov edx, ecx
mov dword [ebx + edx*4], eax
jmp 0x421d76
xor eax, eax
jmp 0x421db4
mov esi, dword [ebp - 0x18]
cmp edi, eax
je 0x421d65
mov ecx, dword [edx + 4]
mov eax, dword [ebp - 0x10]
jmp 0x421d70
mov ebx, ecx
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x1c]
mov dword [eax + ebx*4], ecx
mov edx, dword [ebp - 0x14]
mov dword [eax + edx*4], ecx
mov eax, dword [edi]
mov ecx, dword [edi + 4]
mov dword [ecx], eax
mov eax, dword [edi]
mov ecx, dword [edi + 4]
mov dword [eax + 4], ecx
mov eax, dword [edi + 0xc]
test eax, eax
je 0x421da1
lock dec dword [eax + 4]
jne 0x421da1
add eax, 4
add eax, 0xfffffffc
push eax
call fcn.00432a50
add esp, 4
push 0x10
push edi
call fcn.0049a588
add esp, 8
dec dword [esi + 8]
mov eax, 1
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret 4
Function at 0x425830
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x18
mov eax, dword [0x519058]
mov ebx, dword [ebp + 0x10]
mov edi, ecx
xor eax, ebp
mov dword [ebp - 0x10], eax
lea eax, [ecx + 4]
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], 0
push 0x10
call fcn.0049a550
add esp, 4
mov ecx, dword [ebx]
lea esi, [ebp - 0x18]
mov ecx, dword [ecx]
mov dword [ebp - 0x14], eax
movzx edx, cl
movzx ebx, ch
mov dword [eax + 8], ecx
mov dword [eax + 0xc], 0
add eax, 8
xor edx, 0x811c9dc5
imul edx, edx, 0x1000193
xor ebx, edx
imul edx, ebx, 0x1000193
mov ebx, ecx
shr ecx, 0x18
shr ebx, 0x10
movzx ebx, bl
xor ebx, edx
imul edx, ebx, 0x1000193
lea ebx, [ebp - 0x24]
xor ecx, edx
imul edx, ecx, 0x1000193
mov ecx, edi
push ebx
push esi
mov esi, dword [ebp + 8]
push eax
push edx
lea eax, [ebp - 0x20]
push eax
call fcn.00425920
mov eax, dword [ebp - 0x20]
mov dword [esi], eax
mov al, byte [ebp - 0x1c]
mov byte [esi + 4], al
mov eax, dword [ebp - 0x14]
test eax, eax
je 0x4258fb
mov eax, dword [eax + 0xc]
test eax, eax
je 0x4258ee
lock dec dword [eax + 4]
jne 0x4258ee
add eax, 4
add eax, 0xfffffffc
push eax
call fcn.00432a50
add esp, 4
push 0x10
push dword [ebp - 0x14]
call fcn.0049a588
add esp, 8
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0049a81b
mov eax, esi
add esp, 0x18
pop esi
pop edi
pop ebx
pop ebp
ret 0x10
Function at 0x426470
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x18
mov eax, dword [0x519058]
mov ebx, dword [ebp + 0x10]
mov edi, ecx
xor eax, ebp
mov dword [ebp - 0x10], eax
lea eax, [ecx + 4]
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], 0
push 0x24
call fcn.0049a550
add esp, 4
mov ecx, dword [ebx]
lea esi, [ebp - 0x18]
mov ecx, dword [ecx]
mov dword [ebp - 0x14], eax
movzx edx, cl
movzx ebx, ch
mov dword [eax + 8], ecx
mov dword [eax + 0x20], 0xf
mov dword [eax + 0x1c], 0
mov byte [eax + 0xc], 0
add eax, 8
xor edx, 0x811c9dc5
imul edx, edx, 0x1000193
xor ebx, edx
imul edx, ebx, 0x1000193
mov ebx, ecx
shr ecx, 0x18
shr ebx, 0x10
movzx ebx, bl
xor ebx, edx
imul edx, ebx, 0x1000193
lea ebx, [ebp - 0x24]
xor ecx, edx
imul edx, ecx, 0x1000193
mov ecx, edi
push ebx
push esi
mov esi, dword [ebp + 8]
push eax
push edx
lea eax, [ebp - 0x20]
push eax
call fcn.00426590
mov edi, dword [ebp - 0x14]
mov eax, dword [ebp - 0x20]
mov cl, byte [ebp - 0x1c]
test edi, edi
mov dword [esi], eax
mov byte [esi + 4], cl
je 0x426573
mov eax, dword [edi + 0x20]
mov ecx, edi
cmp eax, 0x10
jb 0x426556
mov ecx, dword [edi + 0xc]
lea ebx, [eax + 1]
cmp ebx, 0x1000
jb 0x426549
mov edx, dword [ecx - 4]
add ecx, 0xfffffffc
sub ecx, edx
cmp ecx, 0x20
jae 0x426589
add eax, 0x24
mov ecx, edx
mov ebx, eax
push ebx
push ecx
call fcn.0049a588
add esp, 8
mov ecx, dword [ebp - 0x14]
mov dword [edi + 0x1c], 0
mov dword [edi + 0x20], 0xf
mov byte [edi + 0xc], 0
push 0x24
push ecx
call fcn.0049a588
add esp, 8
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0049a81b
mov eax, esi
add esp, 0x18
pop esi
pop edi
pop ebx
pop ebp
ret 0x10
call fcn.004a49d8
int3

Function at 0x426860
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x18
mov eax, dword [0x519058]
mov ebx, dword [ebp + 0x10]
mov edi, ecx
xor eax, ebp
mov dword [ebp - 0x10], eax
lea eax, [ecx + 4]
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], 0
push 0x1c
call fcn.0049a550
add esp, 4
mov ecx, dword [ebx]
lea esi, [ebp - 0x18]
mov ecx, dword [ecx]
mov dword [ebp - 0x14], eax
movzx edx, cl
movzx ebx, ch
mov dword [eax + 8], ecx
mov dword [eax + 0x10], 0
mov dword [eax + 0xc], 0
mov dword [eax + 0x18], 0
mov dword [eax + 0x14], 0
add eax, 8
xor edx, 0x811c9dc5
imul edx, edx, 0x1000193
xor ebx, edx
imul edx, ebx, 0x1000193
mov ebx, ecx
shr ecx, 0x18
shr ebx, 0x10
movzx ebx, bl
xor ebx, edx
imul edx, ebx, 0x1000193
lea ebx, [ebp - 0x24]
xor ecx, edx
imul edx, ecx, 0x1000193
mov ecx, edi
push ebx
push esi
mov esi, dword [ebp + 8]
push eax
push edx
lea eax, [ebp - 0x20]
push eax
call fcn.00426960
mov edi, dword [ebp - 0x14]
mov eax, dword [ebp - 0x20]
mov cl, byte [ebp - 0x1c]
test edi, edi
mov dword [esi], eax
mov byte [esi + 4], cl
je 0x42693d
lea ecx, [edi + 0xc]
push dword [edi + 0x18]
push dword [edi + 0x14]
call fcn.00425620
push dword [edi + 0xc]
call fcn.004a4a28
add esp, 4
push 0x1c
push dword [ebp - 0x14]
call fcn.0049a588
add esp, 8
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0049a81b
mov eax, esi
add esp, 0x18
pop esi
pop edi
pop ebx
pop ebp
ret 0x10
Function at 0x427260
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x18
mov eax, dword [0x519058]
mov edx, dword [ebp + 0xc]
xor eax, ebp
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x1c], edx
mov esi, dword [edx + 0x10]
cmp dword [edx + 0x14], 0xf
jbe 0x427287
mov eax, dword [edx]
mov dword [ebp - 0x1c], eax
mov eax, 0x811c9dc5
test esi, esi
je 0x4272af
mov ebx, dword [ebp - 0x1c]
mov edx, esi
nop word cs:[eax + eax]
nop
movzx edi, byte [ebx]
inc ebx
xor edi, eax
imul eax, edi, 0x1000193
dec edx
jne 0x4272a0
mov edx, dword [ecx + 4]
and eax, dword [ecx + 0x18]
mov dword [ebp - 0x24], ecx
mov ecx, dword [ecx + 0xc]
mov edi, dword [ecx + eax*8]
mov dword [ebp - 0x20], edx
cmp edx, edi
je 0x427321
add eax, eax
shl eax, 2
or eax, 4
mov ebx, dword [ecx + eax]
cmp dword [edi + 0x18], esi
jne 0x427304
nop word cs:[eax + eax]
nop
cmp dword [edi + 0x1c], 0xf
jbe 0x4272f0
mov eax, dword [edi + 8]
jmp 0x4272f3
lea eax, [edi + 8]
push esi
push dword [ebp - 0x1c]
push eax
call fcn.004a1d28
add esp, 0xc
test eax, eax
je 0x427311
cmp edi, ebx
je 0x427321
mov edi, dword [edi]
cmp dword [edi + 0x18], esi
je 0x4272e0
jmp 0x427304
cmp dword [ebp - 0x20], edi
je 0x427321
mov esi, dword [ebp + 8]
mov dword [esi], edi
mov byte [esi + 4], 0
jmp 0x427340
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp - 0x24]
lea edx, [ebp - 0x18]
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x14]
push eax
push edx
push 0x4e5ae7
mov esi, dword [ebp + 8]
push esi
call fcn.00427360
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0049a81b
mov eax, esi
add esp, 0x18
pop esi
pop edi
pop ebx
pop ebp
ret 8
Function at 0x427360
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x24
mov eax, dword [0x519058]
mov esi, dword [ebp + 0x10]
xor eax, ebp
mov dword [ebp - 0x10], eax
lea eax, [ecx + 4]
mov dword [ebp - 0x30], ecx
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], 0
push 0x24
call fcn.0049a550
add esp, 4
mov ecx, dword [esi]
mov dword [eax + 0x18], 0
mov dword [eax + 0x1c], 0
mov edi, eax
mov esi, dword [ecx + 0x10]
cmp dword [ecx + 0x14], 0xf
jbe 0x4273ad
mov ecx, dword [ecx]
mov eax, edi
add eax, 8
cmp esi, 0xf
ja 0x4273d0
movsd xmm0, qword [ecx]
movsd xmm1, qword [ecx + 8]
mov ebx, 0xf
movsd qword [eax + 8], xmm1
movsd qword [eax], xmm0
jmp 0x42742e
mov dword [ebp - 0x2c], ecx
mov ecx, esi
mov ebx, 0x7fffffff
mov dword [ebp - 0x28], eax
or ecx, 0xf
cmp ecx, 0x7fffffff
cmovb ebx, ecx
cmp ebx, 0xfff
jb 0x42740a
lea eax, [ebx + 0x24]
push eax
call fcn.0049a550
add esp, 4
mov ecx, eax
add eax, 0x23
and eax, 0xffffffe0
mov dword [eax - 4], ecx
jmp 0x427416
lea eax, [ebx + 1]
push eax
call fcn.0049a550
add esp, 4
mov ecx, dword [ebp - 0x28]
mov dword [ecx], eax
lea ecx, [esi + 1]
push ecx
push dword [ebp - 0x2c]
push eax
call fcn.004a1460
mov eax, dword [ebp - 0x28]
add esp, 0xc
cmp ebx, 0xf
mov ecx, eax
mov dword [edi + 0x18], esi
mov dword [edi + 0x1c], ebx
mov dword [edi + 0x20], 0
mov dword [ebp - 0x14], edi
jbe 0x427448
mov ecx, dword [edi + 8]
mov edi, eax
mov eax, 0x811c9dc5
test esi, esi
je 0x42746f
nop word cs:[eax + eax]
nop dword [eax]
movzx edx, byte [ecx]
inc ecx
xor edx, eax
imul eax, edx, 0x1000193
dec esi
jne 0x427460
mov ecx, dword [ebp - 0x30]
lea edx, [ebp - 0x24]
lea esi, [ebp - 0x18]
lea ebx, [ebp - 0x20]
push edx
push esi
push edi
push eax
push ebx
call fcn.00427510
mov esi, dword [ebp - 0x14]
mov eax, dword [ebp - 0x20]
mov edi, dword [ebp + 8]
mov cl, byte [ebp - 0x1c]
test esi, esi
mov dword [edi], eax
mov byte [edi + 4], cl
je 0x4274f0
mov eax, dword [esi + 0x1c]
mov ecx, esi
cmp eax, 0x10
jb 0x4274d3
mov ecx, dword [esi + 8]
lea ebx, [eax + 1]
cmp ebx, 0x1000
jb 0x4274c6
mov edx, dword [ecx - 4]
add ecx, 0xfffffffc
sub ecx, edx
cmp ecx, 0x20
jae 0x427506
add eax, 0x24
mov ecx, edx
mov ebx, eax
push ebx
push ecx
call fcn.0049a588
add esp, 8
mov ecx, dword [ebp - 0x14]
mov dword [esi + 0x18], 0
mov dword [esi + 0x1c], 0xf
mov byte [esi + 8], 0
push 0x24
push ecx
call fcn.0049a588
add esp, 8
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0049a81b
mov eax, edi
add esp, 0x24
pop esi
pop edi
pop ebx
pop ebp
ret 0x10
call fcn.004a49d8
int3
Function at 0x428208
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
mov ecx, dword [ecx + 4]
mov eax, dword [ecx + 0x3c]
movzx edx, word [ecx + eax + 6]
test edx, edx
je 0x428253
add eax, ecx
xor ebx, ebx
movzx esi, word [eax + 0x14]
lea edi, [eax + esi + 0x18]
xor esi, esi
test edi, edi
je 0x428253
mov eax, dword [edi + ebx + 0xc]
test eax, eax
je 0x428240
add eax, ecx
cmp eax, dword [ebp + 8]
jbe 0x428242
jmp 0x42824b
xor eax, eax
add eax, dword [edi + ebx + 8]
cmp eax, dword [ebp + 8]
ja 0x42825c
inc esi
add ebx, 0x28
cmp esi, edx
jb 0x42822b
xor eax, eax
pop esi
pop edi
pop ebx
pop ebp
ret 4
add edi, ebx
mov eax, edi
jmp 0x428255

Function at 0x4282fc
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x10
mov edi, dword [ebp + 0xc]
test edi, edi
je 0x4283db
mov eax, dword [ecx + 4]
mov ebx, ecx
mov edx, dword [eax + 0x3c]
cmp dword [eax + edx + 0x74], 0
je 0x4283db
cmp word [eax + edx + 0x14], 0x68
jb 0x4283db
mov esi, dword [ebx]
mov ecx, ebx
push dword [eax + edx + 0x78]
call dword [esi + 4]
test eax, eax
je 0x4283db
mov esi, eax
mov eax, dword [ebp + 8]
cmp eax, 0xffff
ja 0x428356
mov word [edi], ax
jmp 0x428408
mov eax, dword [ebx]
mov ecx, ebx
push dword [esi + 0x20]
call dword [eax + 4]
mov edx, eax
mov eax, dword [esi + 0x18]
lea ecx, [eax*4]
test ecx, ecx
je 0x4283db
mov dword [ebp - 0x18], esi
lea esi, [edx + eax*4]
mov eax, dword [ebp + 8]
mov dword [ebp - 0x10], ebx
mov ebx, edx
mov dword [ebp - 0x14], edx
inc eax
mov dword [ebp - 0x1c], eax
mov edi, esi
mov ecx, dword [ebp - 0x10]
sub edi, ebx
mov eax, edi
shr edi, 0x1f
sar eax, 2
add edi, eax
mov eax, dword [ecx]
and edi, 0xfffffffe
push dword [ebx + edi*2]
call dword [eax + 4]
mov ecx, dword [ebp + 8]
mov cl, byte [ecx]
test cl, cl
je 0x4283b9
mov edx, dword [ebp - 0x1c]
cmp cl, byte [eax]
jne 0x4283bb
mov cl, byte [edx]
inc eax
inc edx
test cl, cl
jne 0x4283ad
xor ecx, ecx
movzx eax, byte [eax]
movzx ecx, cl
lea edi, [ebx + edi*2]
sub ecx, eax
je 0x4283e7
test ecx, ecx
lea eax, [edi + 4]
cmovle esi, edi
cmovg ebx, eax
xor eax, eax
cmp ebx, esi
jne 0x428385
jmp 0x4283dd
xor eax, eax
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret 8
mov ecx, dword [ebp - 0x10]
mov esi, dword [ebp - 0x18]
mov eax, dword [ecx]
push dword [esi + 0x24]
call dword [eax + 4]
sub edi, dword [ebp - 0x14]
mov ecx, dword [ebp + 0xc]
sar edi, 1
movzx eax, word [eax + edi]
add ax, word [esi + 0x10]
mov word [ecx], ax
mov al, 1
jmp 0x4283dd