joyce8/EMBER2024-capa huggingface dataset:
Function at 0x404217
Capabilities:
Parse pe header

Disassembly:
add esp, 4
add eax, 0x145da
pop eax
imul edx, dword [ebp - 0x1064], 0x138
add edx, 0x55f3663b
imul eax, dword [ebp - 0x1064], 0x138
sub edx, eax
xor edx, 0xabe912
imul edx, dword [ebp - 0x1064]
imul ecx, dword [ebp - 0x1064], 0x138
sub edx, ecx
mov dword [ebp - 0x1068], edx
push eax
push ebx
add esp, 4
add eax, 0x5b4a
call 0x404275
add byte [ebp + 0x48], al
dec edx
xor eax, dword [edx + 0x4d]
cmp eax, 0x4c4833f
jmp 0x404280
pop eax
push ebx
or ebx, 0x6ccd
jmp 0x40428d
pop ebx
mov dword [ebp - 0x10], 1
push ebx
add ebx, 0x16c02
pop ebx
push ecx
push edi
add esp, 4
call 0x4042b1
add byte [eax], bh
xor al, 0x45
dec edi
cmp byte [esi + 0x32], cl
inc edx
dec edx
add esp, 4
sub ecx, 0x11ea1
and ecx, 0xd505
or ecx, 0x9e62
pop ecx
imul edx, dword [ebp - 0x10], 0x138
add edx, 0x55f3663b
imul eax, dword [ebp - 0x10], 0x138
sub edx, eax
xor edx, 0x153c
imul edx, dword [ebp - 0x10]
imul ecx, dword [ebp - 0x10], 0x138
sub edx, ecx
mov dword [ebp - 0x14], edx
push esi
push eax
add esp, 4
add esi, 0xbd71
sub esi, 0xfaab
pop esi
push eax
and eax, 0x3bef
pop eax
push edx
add edx, 0x6f3
call 0x404321
add byte [edx], dh
dec ebp
dec edx
cmp al, 0x4d
dec ecx
dec ecx
add esp, 4
pop edx
push edx
add edx, 0xa964
add edx, 0xa267
add edx, 0x6f30
or edx, 0xd721
pop edx
push edx
push eax
add esp, 4
add edx, 0x59a4
xor edx, 0x9b93
or edx, 0x121b1
pop edx
mov dword [ebp - 0x2c], 1
push esi
push ecx
add esp, 4
jmp 0x40436a
xor esi, 0xba54
jmp 0x404375
pop esi
push edx
or edx, 0x16324
or edx, 0x12a1
pop edx
push edi
push edx
add esp, 4
and edi, 0x72b8
pop edi
imul edx, dword [ebp - 0x2c], 0x138
add edx, 0x55f3663b
imul eax, dword [ebp - 0x2c], 0x138
sub edx, eax
xor edx, 0
imul edx, dword [ebp - 0x2c]
imul ecx, dword [ebp - 0x2c], 0x138
sub edx, ecx
mov dword [ebp - 0x30], edx
jmp 0x404571
mov ecx, dword [ebp - 0x1068]
mov edx, dword [ebp - 0x1064]
mov dword [ebp - 0x163c], ecx
mov dword [ebp - 0x1638], edx
push esi
xor esi, 0x2024
pop esi
push eax
sub eax, 0xd086
or eax, 0x5967
pop eax
push edi
push edx
add esp, 4
add edi, 0xab3d
call 0x4045b7
add byte [esi], bh
aas
cmp ecx, dword [edx + 0x37]
xor eax, 0x4c4833f
pop edi
push esi
push ecx
add esp, 4
or esi, 0x9576
pop esi
push edi
xor edi, 0x1246b
or edi, 0x1846d
or edi, 0xbeef
or edi, 0x10acf
pop edi
push edx
push ecx
add esp, 4
or edx, 0x15110
pop edx
mov eax, dword [ebp - 0x30]
add eax, 0x138
imul ecx, dword [ebp - 0x2c], 0x138
add ecx, 0x55f3663b
imul edx, dword [ebp - 0x2c], 0x138
sub ecx, edx
xor eax, ecx
imul eax, dword [ebp - 0x2c]
mov dword [ebp - 0x1e64], eax
push esi
push ecx
add esp, 4
call 0x404629
add byte [edi], bh
cmp dword [edi + 0x42], eax
dec esp
xor al, byte [esi - 0x7d]
les eax, [ecx + eax*4]
invalid
Function at 0x404275
Capabilities:
Parse pe header

Disassembly:
add esp, 4
add eax, 0x145da
pop eax
imul edx, dword [ebp - 0x1064], 0x138
add edx, 0x55f3663b
imul eax, dword [ebp - 0x1064], 0x138
sub edx, eax
xor edx, 0xabe912
imul edx, dword [ebp - 0x1064]
imul ecx, dword [ebp - 0x1064], 0x138
sub edx, ecx
mov dword [ebp - 0x1068], edx
push eax
push ebx
add esp, 4
add eax, 0x5b4a
call 0x404275
add byte [ebp + 0x48], al
dec edx
xor eax, dword [edx + 0x4d]
cmp eax, 0x4c4833f
jmp 0x404280
pop eax
push ebx
or ebx, 0x6ccd
jmp 0x40428d
pop ebx
mov dword [ebp - 0x10], 1
push ebx
add ebx, 0x16c02
pop ebx
push ecx
push edi
add esp, 4
call 0x4042b1
add byte [eax], bh
xor al, 0x45
dec edi
cmp byte [esi + 0x32], cl
inc edx
dec edx
add esp, 4
sub ecx, 0x11ea1
and ecx, 0xd505
or ecx, 0x9e62
pop ecx
imul edx, dword [ebp - 0x10], 0x138
add edx, 0x55f3663b
imul eax, dword [ebp - 0x10], 0x138
sub edx, eax
xor edx, 0x153c
imul edx, dword [ebp - 0x10]
imul ecx, dword [ebp - 0x10], 0x138
sub edx, ecx
mov dword [ebp - 0x14], edx
push esi
push eax
add esp, 4
add esi, 0xbd71
sub esi, 0xfaab
pop esi
push eax
and eax, 0x3bef
pop eax
push edx
add edx, 0x6f3
call 0x404321
add byte [edx], dh
dec ebp
dec edx
cmp al, 0x4d
dec ecx
dec ecx
add esp, 4
pop edx
push edx
add edx, 0xa964
add edx, 0xa267
add edx, 0x6f30
or edx, 0xd721
pop edx
push edx
push eax
add esp, 4
add edx, 0x59a4
xor edx, 0x9b93
or edx, 0x121b1
pop edx
mov dword [ebp - 0x2c], 1
push esi
push ecx
add esp, 4
jmp 0x40436a
xor esi, 0xba54
jmp 0x404375
pop esi
push edx
or edx, 0x16324
or edx, 0x12a1
pop edx
push edi
push edx
add esp, 4
and edi, 0x72b8
pop edi
imul edx, dword [ebp - 0x2c], 0x138
add edx, 0x55f3663b
imul eax, dword [ebp - 0x2c], 0x138
sub edx, eax
xor edx, 0
imul edx, dword [ebp - 0x2c]
imul ecx, dword [ebp - 0x2c], 0x138
sub edx, ecx
mov dword [ebp - 0x30], edx
jmp 0x404571
mov ecx, dword [ebp - 0x1068]
mov edx, dword [ebp - 0x1064]
mov dword [ebp - 0x163c], ecx
mov dword [ebp - 0x1638], edx
push esi
xor esi, 0x2024
pop esi
push eax
sub eax, 0xd086
or eax, 0x5967
pop eax
push edi
push edx
add esp, 4
add edi, 0xab3d
call 0x4045b7
add byte [esi], bh
aas
cmp ecx, dword [edx + 0x37]
xor eax, 0x4c4833f
pop edi
push esi
push ecx
add esp, 4
or esi, 0x9576
pop esi
push edi
xor edi, 0x1246b
or edi, 0x1846d
or edi, 0xbeef
or edi, 0x10acf
pop edi
push edx
push ecx
add esp, 4
or edx, 0x15110
pop edx
mov eax, dword [ebp - 0x30]
add eax, 0x138
imul ecx, dword [ebp - 0x2c], 0x138
add ecx, 0x55f3663b
imul edx, dword [ebp - 0x2c], 0x138
sub ecx, edx
xor eax, ecx
imul eax, dword [ebp - 0x2c]
mov dword [ebp - 0x1e64], eax
push esi
push ecx
add esp, 4
call 0x404629
add byte [edi], bh
cmp dword [edi + 0x42], eax
dec esp
xor al, byte [esi - 0x7d]
les eax, [ecx + eax*4]
invalid
Function at 0x4042b1
Capabilities:
Parse pe header

Disassembly:
add esp, 4
add eax, 0x145da
pop eax
imul edx, dword [ebp - 0x1064], 0x138
add edx, 0x55f3663b
imul eax, dword [ebp - 0x1064], 0x138
sub edx, eax
xor edx, 0xabe912
imul edx, dword [ebp - 0x1064]
imul ecx, dword [ebp - 0x1064], 0x138
sub edx, ecx
mov dword [ebp - 0x1068], edx
push eax
push ebx
add esp, 4
add eax, 0x5b4a
call 0x404275
add byte [ebp + 0x48], al
dec edx
xor eax, dword [edx + 0x4d]
cmp eax, 0x4c4833f
jmp 0x404280
pop eax
push ebx
or ebx, 0x6ccd
jmp 0x40428d
pop ebx
mov dword [ebp - 0x10], 1
push ebx
add ebx, 0x16c02
pop ebx
push ecx
push edi
add esp, 4
call 0x4042b1
add byte [eax], bh
xor al, 0x45
dec edi
cmp byte [esi + 0x32], cl
inc edx
dec edx
add esp, 4
sub ecx, 0x11ea1
and ecx, 0xd505
or ecx, 0x9e62
pop ecx
imul edx, dword [ebp - 0x10], 0x138
add edx, 0x55f3663b
imul eax, dword [ebp - 0x10], 0x138
sub edx, eax
xor edx, 0x153c
imul edx, dword [ebp - 0x10]
imul ecx, dword [ebp - 0x10], 0x138
sub edx, ecx
mov dword [ebp - 0x14], edx
push esi
push eax
add esp, 4
add esi, 0xbd71
sub esi, 0xfaab
pop esi
push eax
and eax, 0x3bef
pop eax
push edx
add edx, 0x6f3
call 0x404321
add byte [edx], dh
dec ebp
dec edx
cmp al, 0x4d
dec ecx
dec ecx
add esp, 4
pop edx
push edx
add edx, 0xa964
add edx, 0xa267
add edx, 0x6f30
or edx, 0xd721
pop edx
push edx
push eax
add esp, 4
add edx, 0x59a4
xor edx, 0x9b93
or edx, 0x121b1
pop edx
mov dword [ebp - 0x2c], 1
push esi
push ecx
add esp, 4
jmp 0x40436a
xor esi, 0xba54
jmp 0x404375
pop esi
push edx
or edx, 0x16324
or edx, 0x12a1
pop edx
push edi
push edx
add esp, 4
and edi, 0x72b8
pop edi
imul edx, dword [ebp - 0x2c], 0x138
add edx, 0x55f3663b
imul eax, dword [ebp - 0x2c], 0x138
sub edx, eax
xor edx, 0
imul edx, dword [ebp - 0x2c]
imul ecx, dword [ebp - 0x2c], 0x138
sub edx, ecx
mov dword [ebp - 0x30], edx
jmp 0x404571
mov ecx, dword [ebp - 0x1068]
mov edx, dword [ebp - 0x1064]
mov dword [ebp - 0x163c], ecx
mov dword [ebp - 0x1638], edx
push esi
xor esi, 0x2024
pop esi
push eax
sub eax, 0xd086
or eax, 0x5967
pop eax
push edi
push edx
add esp, 4
add edi, 0xab3d
call 0x4045b7
add byte [esi], bh
aas
cmp ecx, dword [edx + 0x37]
xor eax, 0x4c4833f
pop edi
push esi
push ecx
add esp, 4
or esi, 0x9576
pop esi
push edi
xor edi, 0x1246b
or edi, 0x1846d
or edi, 0xbeef
or edi, 0x10acf
pop edi
push edx
push ecx
add esp, 4
or edx, 0x15110
pop edx
mov eax, dword [ebp - 0x30]
add eax, 0x138
imul ecx, dword [ebp - 0x2c], 0x138
add ecx, 0x55f3663b
imul edx, dword [ebp - 0x2c], 0x138
sub ecx, edx
xor eax, ecx
imul eax, dword [ebp - 0x2c]
mov dword [ebp - 0x1e64], eax
push esi
push ecx
add esp, 4
call 0x404629
add byte [edi], bh
cmp dword [edi + 0x42], eax
dec esp
xor al, byte [esi - 0x7d]
les eax, [ecx + eax*4]
invalid
Function at 0x4083ab
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
push esi
and esi, 0x8fa
xor esi, 0x157de
pop esi
push edx
push ebx
add esp, 4
sub edx, 0x111ae
pop edx
push edi
push ebx
add esp, 4
xor edi, 0x14827
pop edi
push esi
push eax
add esp, 4
and esi, 0x2b64
pop esi
lea ecx, [ebp - 0x1740]
mov dword [ebp - 0xc98], ecx
mov edx, dword [ebp - 0x508]
mov eax, dword [edx + 0x30]
mov dword [ebp - 0xc94], eax
xor ecx, ecx
mov word [ebp - 0x210], cx
xor edx, edx
mov word [ebp - 0x10c], dx
push edi
push edx
add esp, 4
xor edi, 0x81e7
add edi, 0x16a62
jmp 0x408399
pop edi
push esi
push ecx
add esp, 4
call fcn.004083ab
add byte [ebp + 0x36], cl
inc edx
inc ebp
xor al, 0x83
add esp, 4
xor esi, 0x12951
add esp, 4
xor esi, 0x12951
pop esi
mov eax, dword [ebp - 0xc94]
mov cx, word [eax]
mov word [ebp - 0x1036], cx
mov edx, dword [ebp - 0xc94]
add edx, 2
mov dword [ebp - 0xc94], edx
mov ax, word [ebp - 0x1036]
mov word [ebp - 0x210], ax
mov ecx, dword [ebp - 0xc98]
mov dx, word [ecx]
mov word [ebp - 0x1038], dx
mov eax, dword [ebp - 0xc98]
add eax, 2
mov dword [ebp - 0xc98], eax
mov cx, word [ebp - 0x1038]
mov word [ebp - 0x10c], cx
push esi
add esi, 0xa6a6
pop esi
push eax
add eax, 0x6ca7
call 0x40842b
add byte [edi], dh
dec edi
xor al, 0x3d
inc esp
aas
add esp, 4
pop eax
push eax
push ebx
add esp, 4
xor eax, 0x1281b
sub eax, 0x16fe7
pop eax
movzx edx, word [ebp - 0x10c]
test edx, edx
jne 0x408464
movzx eax, word [ebp - 0x210]
movzx ecx, word [ebp - 0x10c]
sub eax, ecx
mov dword [ebp - 0x15e8], eax
jmp 0x4084c7
movzx edx, word [ebp - 0x210]
movzx eax, word [ebp - 0x10c]
cmp edx, eax
je 0x408383
movzx ecx, word [ebp - 0x210]
xor ecx, 0x20
movzx edx, word [ebp - 0x10c]
cmp ecx, edx
je 0x408383
movzx eax, word [ebp - 0x210]
movzx ecx, word [ebp - 0x10c]
cmp eax, ecx
jge 0x4084b1
mov dword [ebp - 0x15e4], 0xffffffff
jmp 0x4084bb
mov dword [ebp - 0x15e4], 1
mov edx, dword [ebp - 0x15e4]
mov dword [ebp - 0x15e8], edx
cmp dword [ebp - 0x15e8], 0
jne 0x408510
push edi
push edx
add esp, 4
add edi, 0xf863
xor edi, 0x1705a
or edi, 0x13859
pop edi
push edi
push esi
add esp, 4
add edi, 0x133db
and edi, 0x13680
pop edi
push edx
add edx, 0xb892
pop edx
mov eax, dword [ebp - 0x508]
mov dword [ebp - 0x2d4], eax
jmp 0x408578
push ecx
xor ecx, 0xe8a8
xor ecx, 0x71e9
add ecx, 0x1476f
pop ecx
push edx
jmp 0x40852a
pop edx
push eax
push ebx
add esp, 4
jmp 0x408535
pop eax
push edx
push esi
add esp, 4
sub edx, 0x1b00
pop edx
mov ecx, dword [ebp - 0x508]
mov edx, dword [ecx]
mov dword [ebp - 0x508], edx
mov eax, dword [ebp - 0x508]
cmp eax, dword [ebp - 0xc9c]
je 0x40856e
mov ecx, dword [ebp - 0x508]
cmp dword [ecx + 0x30], 0
jne 0x408324
mov dword [ebp - 0x2d4], 0
Function at 0x40842b
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
push esi
and esi, 0x8fa
xor esi, 0x157de
pop esi
push edx
push ebx
add esp, 4
sub edx, 0x111ae
pop edx
push edi
push ebx
add esp, 4
xor edi, 0x14827
pop edi
push esi
push eax
add esp, 4
and esi, 0x2b64
pop esi
lea ecx, [ebp - 0x1740]
mov dword [ebp - 0xc98], ecx
mov edx, dword [ebp - 0x508]
mov eax, dword [edx + 0x30]
mov dword [ebp - 0xc94], eax
xor ecx, ecx
mov word [ebp - 0x210], cx
xor edx, edx
mov word [ebp - 0x10c], dx
push edi
push edx
add esp, 4
xor edi, 0x81e7
add edi, 0x16a62
jmp 0x408399
pop edi
push esi
push ecx
add esp, 4
call fcn.004083ab
add byte [ebp + 0x36], cl
inc edx
inc ebp
xor al, 0x83
add esp, 4
xor esi, 0x12951
add esp, 4
xor esi, 0x12951
pop esi
mov eax, dword [ebp - 0xc94]
mov cx, word [eax]
mov word [ebp - 0x1036], cx
mov edx, dword [ebp - 0xc94]
add edx, 2
mov dword [ebp - 0xc94], edx
mov ax, word [ebp - 0x1036]
mov word [ebp - 0x210], ax
mov ecx, dword [ebp - 0xc98]
mov dx, word [ecx]
mov word [ebp - 0x1038], dx
mov eax, dword [ebp - 0xc98]
add eax, 2
mov dword [ebp - 0xc98], eax
mov cx, word [ebp - 0x1038]
mov word [ebp - 0x10c], cx
push esi
add esi, 0xa6a6
pop esi
push eax
add eax, 0x6ca7
call 0x40842b
add byte [edi], dh
dec edi
xor al, 0x3d
inc esp
aas
add esp, 4
pop eax
push eax
push ebx
add esp, 4
xor eax, 0x1281b
sub eax, 0x16fe7
pop eax
movzx edx, word [ebp - 0x10c]
test edx, edx
jne 0x408464
movzx eax, word [ebp - 0x210]
movzx ecx, word [ebp - 0x10c]
sub eax, ecx
mov dword [ebp - 0x15e8], eax
jmp 0x4084c7
movzx edx, word [ebp - 0x210]
movzx eax, word [ebp - 0x10c]
cmp edx, eax
je 0x408383
movzx ecx, word [ebp - 0x210]
xor ecx, 0x20
movzx edx, word [ebp - 0x10c]
cmp ecx, edx
je 0x408383
movzx eax, word [ebp - 0x210]
movzx ecx, word [ebp - 0x10c]
cmp eax, ecx
jge 0x4084b1
mov dword [ebp - 0x15e4], 0xffffffff
jmp 0x4084bb
mov dword [ebp - 0x15e4], 1
mov edx, dword [ebp - 0x15e4]
mov dword [ebp - 0x15e8], edx
cmp dword [ebp - 0x15e8], 0
jne 0x408510
push edi
push edx
add esp, 4
add edi, 0xf863
xor edi, 0x1705a
or edi, 0x13859
pop edi
push edi
push esi
add esp, 4
add edi, 0x133db
and edi, 0x13680
pop edi
push edx
add edx, 0xb892
pop edx
mov eax, dword [ebp - 0x508]
mov dword [ebp - 0x2d4], eax
jmp 0x408578
push ecx
xor ecx, 0xe8a8
xor ecx, 0x71e9
add ecx, 0x1476f
pop ecx
push edx
jmp 0x40852a
pop edx
push eax
push ebx
add esp, 4
jmp 0x408535
pop eax
push edx
push esi
add esp, 4
sub edx, 0x1b00
pop edx
mov ecx, dword [ebp - 0x508]
mov edx, dword [ecx]
mov dword [ebp - 0x508], edx
mov eax, dword [ebp - 0x508]
cmp eax, dword [ebp - 0xc9c]
je 0x40856e
mov ecx, dword [ebp - 0x508]
cmp dword [ecx + 0x30], 0
jne 0x408324
mov dword [ebp - 0x2d4], 0
Function at 0x408ea5
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
add esp, 4
or edi, 0x5df9
jmp 0x408eb3
pop edi
mov dword [ebp - 0x7a0], 0
jmp 0x4095ad
Function at 0x42e670
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
mov ebx, ecx
mov eax, 0x1fffffff
bsr ecx, eax
push esi
push edi
mov edi, 1
mov dword [ebp - 0x14], ebx
mov eax, edi
shl eax, cl
mov ecx, dword [ebp + 8]
cmp ecx, eax
ja 0x42e7bd
lea eax, [ecx - 1]
mov esi, dword [ebx + 4]
or eax, edi
mov dword [ebp - 0x10], esi
bsr ecx, eax
push esi
lea ecx, [ecx + 1]
shl edi, cl
lea ecx, [ebx + 0xc]
lea eax, [edi + edi]
push eax
call fcn.00426bd0
mov ecx, dword [ebx + 4]
lea eax, [edi - 1]
mov dword [ebx + 0x18], eax
mov dword [ebx + 0x1c], edi
mov ecx, dword [ecx]
mov edx, ecx
cmp ecx, esi
je 0x42e790
movzx eax, byte [ecx + 8]
mov edi, dword [ebx + 0x18]
xor eax, 0x811c9dc5
mov edx, dword [edx]
imul eax, eax, 0x1000193
and edi, eax
mov eax, dword [ebx + 0xc]
mov ebx, dword [eax + edi*8]
mov dword [ebp - 8], ebx
lea eax, [eax + edi*8]
mov dword [ebp - 0xc], eax
cmp ebx, esi
jne 0x42e705
mov dword [eax], ecx
mov dword [eax + 4], ecx
jmp 0x42e77f
mov eax, dword [eax + 4]
mov bl, byte [ecx + 8]
cmp bl, byte [eax + 8]
mov ebx, dword [ebp - 8]
jne 0x42e742
mov eax, dword [eax]
mov dword [ebp - 8], eax
cmp eax, ecx
je 0x42e73a
mov ebx, dword [ecx + 4]
mov esi, dword [ebp - 8]
mov dword [ebx], edx
mov edi, dword [edx + 4]
mov dword [edi], eax
mov eax, dword [eax + 4]
mov dword [eax], ecx
mov dword [esi + 4], edi
mov esi, dword [ebp - 0x10]
mov dword [edx + 4], ebx
mov dword [ecx + 4], eax
mov eax, dword [ebp - 0xc]
mov dword [eax + 4], ecx
jmp 0x42e77f
mov edi, eax
cmp ebx, eax
je 0x42e75c
mov eax, dword [eax + 4]
mov edi, eax
mov bl, byte [ecx + 8]
cmp bl, byte [eax + 8]
mov ebx, dword [ebp - 8]
je 0x42e799
cmp ebx, eax
jne 0x42e748
mov eax, dword [ecx + 4]
mov dword [ebp - 8], eax
mov dword [eax], edx
mov ebx, dword [edx + 4]
mov dword [ebx], edi
mov eax, dword [edi + 4]
mov dword [eax], ecx
mov dword [edi + 4], ebx
mov edi, dword [ebp - 8]
mov dword [edx + 4], edi
mov dword [ecx + 4], eax
mov eax, dword [ebp - 0xc]
mov dword [eax], ecx
mov ebx, dword [ebp - 0x14]
mov ecx, edx
cmp edx, esi
jne 0x42e6d2
nop dword [eax]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
mov ebx, dword [ecx + 4]
mov eax, dword [eax]
mov dword [ebp - 0xc], eax
mov esi, eax
mov dword [ebx], edx
mov edi, dword [edx + 4]
mov dword [edi], eax
mov eax, dword [eax + 4]
mov dword [eax], ecx
mov dword [esi + 4], edi
mov esi, dword [ebp - 0x10]
mov dword [edx + 4], ebx
mov dword [ecx + 4], eax
jmp 0x42e77f
push str.invalid_hash_bucket_count
call fcn.00431706
int3
Function at 0x42e860
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
mov ebx, ecx
mov eax, 0x1fffffff
bsr ecx, eax
push esi
mov esi, 1
mov dword [ebp - 0x18], ebx
mov eax, esi
shl eax, cl
mov ecx, dword [ebp + 8]
push edi
cmp ecx, eax
ja 0x42e9f0
lea eax, [ecx - 1]
or eax, esi
bsr ecx, eax
mov eax, dword [ebx + 4]
push eax
mov dword [ebp - 0xc], eax
lea ecx, [ecx + 1]
shl esi, cl
lea ecx, [ebx + 0xc]
lea eax, [esi + esi]
push eax
call fcn.00426bd0
mov edi, dword [ebx + 4]
lea eax, [esi - 1]
mov ecx, dword [ebp - 0xc]
mov dword [ebx + 0x18], eax
mov dword [ebx + 0x1c], esi
mov edi, dword [edi]
mov eax, edi
cmp edi, ecx
je 0x42e9c8
cmp dword [edi + 0x1c], 0x10
lea ebx, [edi + 8]
mov eax, dword [eax]
mov dword [ebp - 8], eax
mov dword [ebp - 0x10], ebx
jb 0x42e8db
mov edx, dword [ebx]
mov dword [ebp - 0x10], edx
mov esi, dword [ebx + 0x10]
xor edx, edx
mov dword [ebp - 4], 0x811c9dc5
mov dword [ebp - 0x14], esi
test esi, esi
je 0x42e913
mov ecx, dword [ebp - 4]
mov eax, esi
mov ebx, dword [ebp - 0x10]
movzx esi, byte [edx + ebx]
inc edx
xor esi, ecx
imul ecx, esi, 0x1000193
cmp edx, eax
jb 0x42e8f6
mov eax, dword [ebp - 8]
lea ebx, [edi + 8]
mov dword [ebp - 4], ecx
mov ecx, dword [ebp - 0xc]
mov edx, dword [ebp - 0x18]
mov esi, dword [edx + 0x18]
and esi, dword [ebp - 4]
mov edx, dword [edx + 0xc]
lea edx, [edx + esi*8]
mov esi, dword [edx]
mov dword [ebp - 4], edx
mov dword [ebp - 0x10], esi
cmp esi, ecx
jne 0x42e938
mov dword [edx], edi
mov dword [edx + 4], edi
jmp 0x42e9be
mov esi, dword [edx + 4]
lea eax, [esi + 8]
push eax
push ebx
call fcn.0042eaf0
test al, al
jne 0x42e972
mov ebx, dword [esi]
mov eax, dword [ebp - 8]
cmp ebx, edi
je 0x42e96a
mov esi, dword [edi + 4]
mov dword [esi], eax
mov edx, dword [eax + 4]
mov dword [edx], ebx
mov ecx, dword [ebx + 4]
mov dword [ecx], edi
mov dword [ebx + 4], edx
mov dword [eax + 4], esi
mov dword [edi + 4], ecx
mov ecx, dword [ebp - 4]
mov dword [ecx + 4], edi
jmp 0x42e9bb
mov ebx, esi
cmp dword [ebp - 0x10], esi
je 0x42e99b
nop dword [eax]
mov esi, dword [esi + 4]
mov ebx, esi
lea eax, [ebx + 8]
push eax
lea eax, [edi + 8]
push eax
call fcn.0042eaf0
test al, al
je 0x42e9d1
cmp dword [ebp - 0x10], esi
jne 0x42e980
mov esi, dword [edi + 4]
mov eax, dword [ebp - 8]
mov dword [esi], eax
mov edx, dword [eax + 4]
mov dword [edx], ebx
mov ecx, dword [ebx + 4]
mov dword [ecx], edi
mov dword [ebx + 4], edx
mov dword [eax + 4], esi
mov dword [edi + 4], ecx
mov ecx, dword [ebp - 4]
mov dword [ecx], edi
mov ecx, dword [ebp - 0xc]
mov edi, eax
cmp eax, ecx
jne 0x42e8c5
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
mov ebx, dword [esi]
mov esi, dword [edi + 4]
mov eax, dword [ebp - 8]
mov dword [esi], eax
mov edx, dword [eax + 4]
mov dword [edx], ebx
mov ecx, dword [ebx + 4]
mov dword [ecx], edi
mov dword [ebx + 4], edx
mov dword [eax + 4], esi
mov dword [edi + 4], ecx
jmp 0x42e9bb
push str.invalid_hash_bucket_count
call fcn.00431706
int3
Function at 0x4436bd
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x45ae74
push 0x45ae6c
push str.FlsAlloc
push 0x1e
call fcn.004434ea
mov esi, eax
add esp, 0x10
test esi, esi
je 0x4436f1
push dword [ebp + 8]
mov ecx, esi
call dword [0x45725c]
call esi
jmp 0x4436f7
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
pop esi
pop ebp
ret 4

Function at 0x44373b
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x45ae84
push 0x45ae7c
push str.FlsGetValue
push 0x20
call fcn.004434ea
mov esi, eax
add esp, 0x10
test esi, esi
je 0x443772
push dword [ebp + 8]
mov ecx, esi
call dword [0x45725c]
call esi
pop esi
pop ebp
ret 4
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsGetValue]
Function at 0x44ab17
Capabilities:
Enumerate files on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x264
mov eax, dword [0x46e014]
xor eax, ebp
mov dword [ebp - 4], eax
mov edx, dword [ebp + 0xc]
mov ecx, dword [ebp + 0x10]
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov dword [ebp - 0x25c], ecx
cmp edx, edi
je 0x44ab62
movzx eax, word [edx]
lea ecx, [ebp - 0x255]
push eax
call fcn.0044acb6
test al, al
jne 0x44ab5c
sub edx, 2
cmp edx, edi
jne 0x44ab42
mov ecx, dword [ebp - 0x25c]
movzx esi, word [edx]
cmp esi, 0x3a
jne 0x44ab84
lea eax, [edi + 2]
cmp edx, eax
je 0x44ab84
push ecx
xor ebx, ebx
push ebx
push ebx
push edi
call fcn.0044aa63
add esp, 0x10
jmp 0x44ac7e
push esi
lea ecx, [ebp - 0x255]
call fcn.0044acb6
sub edx, edi
movzx eax, al
sar edx, 1
inc edx
neg eax
sbb eax, eax
xor ebx, ebx
push ebx
push ebx
and eax, edx
push ebx
mov dword [ebp - 0x260], eax
lea eax, [ebp - 0x254]
push eax
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_FindFirstFileExW]
mov esi, eax
cmp esi, 0xffffffff
jne 0x44abc7
push dword [ebp - 0x25c]
jmp 0x44ab74
mov ebx, dword [ebp - 0x25c]
push 0x2e
mov eax, dword [ebx + 4]
sub eax, dword [ebx]
sar eax, 2
mov dword [ebp - 0x25c], eax
pop eax
cmp word [ebp - 0x228], ax
jne 0x44ac04
cmp word [ebp - 0x226], 0
je 0x44ac25
cmp word [ebp - 0x226], ax
jne 0x44ac04
cmp word [ebp - 0x224], 0
je 0x44ac25
push ebx
push dword [ebp - 0x260]
lea eax, [ebp - 0x228]
push edi
push eax
call fcn.0044aa63
add esp, 0x10
mov dword [ebp - 0x264], eax
test eax, eax
jne 0x44ac71
lea eax, [ebp - 0x254]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
push 0x2e
test eax, eax
pop eax
jne 0x44abde
mov eax, dword [ebx + 4]
mov edx, dword [ebx]
sub eax, edx
mov ecx, dword [ebp - 0x25c]
sar eax, 2
cmp ecx, eax
jne 0x44ac59
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
xor eax, eax
jmp 0x44ac7e
push 0x44a893
sub eax, ecx
push 4
push eax
lea eax, [edx + ecx*4]
push eax
call fcn.00451ca0
add esp, 0x10
jmp 0x44ac4e
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
mov eax, dword [ebp - 0x264]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0043264d
leave
ret

Function at 0x44b589
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
jne 0x44b59a
pop esi
ret
push ebx
push edi
push esi
call fcn.0044b552
mov ebx, eax
sub ebx, esi
and ebx, 0xfffffffe
push ebx
call fcn.0044514e
mov edi, eax
pop ecx
pop ecx
test edi, edi
je 0x44b5c2
push ebx
push esi
push edi
call fcn.00433fc0
add esp, 0xc
push 0
call fcn.0044320f
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, edi
pop edi
pop ebx
pop esi
ret

Function at 0x44b986
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.0044b5d7