joyce8/EMBER2024-capa huggingface dataset:
Function at 0x417180
Capabilities:
Encode data using xor
Encrypt data using aes
Reference aes constants

Disassembly:
sub esp, 0x48
push ebp
mov ebp, ecx
mov al, dl
mov byte [esp + 7], al
test ebp, ebp
jne 0x41719a
mov eax, 0xfffffffd
pop ebp
add esp, 0x48
ret
test al, al
je 0x4171aa
cmp al, 1
je 0x4171aa
or eax, 0xffffffff
pop ebp
add esp, 0x48
ret
mov byte [ebp], al
mov eax, dword [esp + 0x54]
mov dword [ebp + 1], 0x80
test eax, eax
je 0x417342
push esi
push edi
push 0x10
push eax
lea edi, [ebp + 5]
push edi
call fcn.00480d20
mov eax, dword [ebp + 1]
add esp, 0xc
cdq
xor esi, esi
and edx, 7
mov dword [0x4d4d14], 0xa
add eax, edx
sar eax, 3
test eax, eax
jle 0x4171fc
nop dword [eax]
mov cl, byte [edi + esi]
mov byte [esp + esi + 0x34], cl
inc esi
cmp esi, eax
jl 0x4171f0
xor ecx, ecx
nop
mov eax, dword [esp + ecx + 0x40]
mov dword [esp + ecx + 0x20], eax
sub ecx, 4
cmp ecx, 0xfffffff4
jge 0x417200
xor edi, edi
xor eax, eax
xor esi, esi
push ebx
nop word [eax + eax]
mov ebx, edi
cmp edi, 0xb
jge 0x417317
cmp esi, 4
jge 0x417247
cmp eax, 4
jge 0x417247
mov ecx, dword [esp + esi*4 + 0x18]
lea edx, [eax + edi*4]
inc esi
mov dword [ebp + edx*4 + 0x2a], ecx
inc eax
cmp esi, 4
jl 0x417230
mov ecx, eax
lea edi, [ebx + 1]
xor eax, eax
cmp ecx, 4
cmovne eax, ecx
cmovne edi, ebx
cmp esi, 4
jl 0x417220
cmp edi, 0xb
jge 0x417317
mov ebx, 0x4b8ea0
nop word [eax + eax]
movzx ecx, byte [esp + 0x25]
lea ebx, [ebx + 4]
mov dl, byte [esp + 0x18]
xor dl, byte [ecx + str.cw]
movzx ecx, byte [esp + 0x26]
movzx ecx, byte [ecx + str.cw]
xor byte [esp + 0x19], cl
movzx ecx, byte [esp + 0x27]
movzx ecx, byte [ecx + str.cw]
xor byte [esp + 0x1a], cl
movzx ecx, byte [esp + 0x24]
movzx ecx, byte [ecx + str.cw]
xor byte [esp + 0x1b], cl
mov ecx, dword [ebx - 4]
xor dl, cl
mov byte [esp + 0x18], dl
mov edx, 1
mov ecx, dword [esp + edx*4 + 0x14]
xor dword [esp + edx*4 + 0x18], ecx
inc edx
cmp edx, 4
jl 0x4172c0
xor esi, esi
cmp edi, 0xb
jge 0x417317
cmp esi, 4
jge 0x4172f7
nop word [eax + eax]
cmp eax, 4
jge 0x4172f7
mov ecx, dword [esp + esi*4 + 0x18]
lea edx, [eax + edi*4]
inc esi
mov dword [ebp + edx*4 + 0x2a], ecx
inc eax
cmp esi, 4
jl 0x4172e0
mov ecx, eax
lea edx, [edi + 1]
xor eax, eax
cmp ecx, 4
cmovne edx, edi
cmovne eax, ecx
mov edi, edx
cmp esi, 4
jl 0x4172d0
cmp edx, 0xb
jl 0x417270
cmp byte [esp + 0x13], 1
pop ebx
jne 0x417336
lea esi, [ebp + 0x3a]
mov edi, 9
mov ecx, esi
call fcn.00416960
add esi, 0x10
sub edi, 1
jne 0x417327
pop edi
pop esi
mov eax, 1
pop ebp
add esp, 0x48
ret
mov eax, 0xfffffffe
pop ebp
add esp, 0x48
ret
Function at 0x417350
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
sub esp, 0xc
push ebx
push ebp
mov ebp, dword [0x4d1de0]
lea eax, [ecx + 1]
push esi
xor edx, edx
mov byte [ecx], 1
push edi
mov dword [esp + 0x14], edx
mov dword [esp + 0x18], eax
nop dword [eax]
add ebp, 0xffffffff
mov dword [0x4d1de0], ebp
jns 0x4174c2
mov edi, 0x5e6950
mov esi, 0x5e6958
cmp ebp, 0xffffffff
jge 0x4173b3
mov eax, 0x1105
mov ecx, 0x5e6954
mov dword [0x5e6950], eax
mov edx, 0x26f
imul eax, eax, 0x10dcd
lea ecx, [ecx + 4]
mov dword [ecx - 4], eax
sub edx, 1
jne 0x4173a2
mov ebx, dword [0x5e6950]
mov ebp, 0x26f
mov eax, dword [0x5e6954]
mov dword [0x4d1de0], ebp
mov dword [0x5e7314], 0x5e6954
mov dword [esp + 0x10], 0xe3
nop dword [eax + eax]
mov edx, eax
mov ecx, eax
xor edx, ebx
and cl, 1
and edx, 0x7ffffffe
movzx ecx, cl
xor edx, ebx
mov ebx, eax
shr edx, 1
neg ecx
sbb ecx, ecx
and ecx, 0x9908b0df
xor edx, ecx
xor edx, dword [esi + 0x62c]
mov dword [edi], edx
add edi, 4
mov eax, dword [esi]
add esi, 4
sub dword [esp + 0x10], 1
jne 0x4173e0
mov ebp, 0x5e6950
mov dword [esp + 0x10], 0x18c
mov edx, eax
lea ebp, [ebp + 4]
xor edx, ebx
lea edi, [edi + 4]
and edx, 0x7ffffffe
lea esi, [esi + 4]
xor edx, ebx
mov ecx, eax
and cl, 1
shr edx, 1
movzx ecx, cl
mov ebx, eax
neg ecx
sbb ecx, ecx
and ecx, 0x9908b0df
xor edx, ecx
xor edx, dword [ebp - 4]
sub dword [esp + 0x10], 1
mov dword [edi - 4], edx
mov eax, dword [esi - 4]
jne 0x417428
mov edx, dword [0x5e6950]
mov ecx, edx
xor ecx, ebx
mov eax, edx
and al, 1
and ecx, 0x7ffffffe
movzx eax, al
xor ecx, ebx
shr ecx, 1
neg eax
sbb eax, eax
and eax, 0x9908b0df
xor ecx, eax
mov eax, edx
xor ecx, dword [ebp]
shr eax, 0xb
xor edx, eax
mov ebp, dword [0x4d1de0]
mov eax, edx
mov dword [edi], ecx
and eax, 0xff3a58ad
shl eax, 7
xor edx, eax
mov eax, edx
and eax, 0xffffdf8c
shl eax, 0xf
xor edx, eax
mov eax, edx
shr eax, 0x12
xor eax, edx
mov edx, dword [esp + 0x14]
jmp 0x4174f7
mov eax, dword [0x5e7314]
mov ecx, dword [eax]
add eax, 4
mov dword [0x5e7314], eax
mov eax, ecx
shr eax, 0xb
xor ecx, eax
mov eax, ecx
and eax, 0xff3a58ad
shl eax, 7
xor ecx, eax
mov eax, ecx
and eax, 0xffffdf8c
shl eax, 0xf
xor ecx, eax
mov eax, ecx
shr eax, 0x12
xor eax, ecx
mov ecx, dword [esp + 0x18]
mov byte [ecx + edx], al
inc edx
mov dword [esp + 0x14], edx
cmp edx, 0x10
jl 0x417370
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0xc
ret
Function at 0x417d50
Capabilities:
Hash data using sha1

Disassembly:
test byte [esp + 4], 1
push esi
mov esi, ecx
mov dword [esi], vtable.CSHA1.0
mov dword [esi + 4], 0x67452301
mov dword [esi + 8], 0xefcdab89
mov dword [esi + 0xc], 0x98badcfe
mov dword [esi + 0x10], 0x10325476
mov dword [esi + 0x14], 0xc3d2e1f0
mov dword [esi + 0x18], 0
mov dword [esi + 0x1c], 0
je 0x417d9f
push 0xb4
push esi
call fcn.00478b59
add esp, 8
mov eax, esi
pop esi
ret 4
Function at 0x419280
Capabilities:
Encode data using xor
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x1c
cmp dword [ebp + 8], 0xffffffff
push ebx
push esi
mov esi, dword [ebp + 0x10]
push edi
jne 0x4192a1
or eax, 0xffffffff
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x14
push dword [ebp + 0x18]
call dword [sym.imp.WS2_32.dll_htons]
mov edx, dword [ebp + 0xc]
xor edi, edi
mov word [esp + 0x1a], ax
xor bl, bl
mov eax, dword [ebp + 0x14]
mov dword [esp + 0x1c], eax
mov eax, 2
mov word [esp + 0x18], ax
xor eax, eax
test esi, esi
jle 0x41935d
cmp esi, 0x20
jb 0x419350
movaps xmm3, xmmword [0x4c03e0]
mov ecx, esi
and ecx, 0xffffffe0
xorps xmm2, xmm2
xorps xmm1, xmm1
nop dword [eax + eax]
movups xmm0, xmmword [eax + edx]
pand xmm0, xmm3
pxor xmm2, xmm0
movups xmm0, xmmword [eax + edx + 0x10]
add eax, 0x20
pand xmm0, xmm3
pxor xmm1, xmm0
cmp eax, ecx
jl 0x4192f0
pxor xmm1, xmm2
movaps xmm0, xmm1
psrldq xmm0, 8
pxor xmm1, xmm0
movups xmm0, xmm1
psrldq xmm0, 4
pxor xmm1, xmm0
movups xmm0, xmm1
psrldq xmm0, 2
pxor xmm1, xmm0
movups xmm0, xmm1
psrldq xmm0, 1
pxor xmm1, xmm0
movd ebx, xmm1
cmp eax, esi
jge 0x41935d
nop dword [eax]
mov cl, byte [eax + edx]
inc eax
and cl, 0xaa
xor bl, cl
cmp eax, esi
jl 0x419350
push esi
push edx
push 0x4f4d21
mov byte [0x4f4d20], bl
call fcn.0047a8c0
add esp, 0xc
xor ecx, ecx
test esi, esi
jle 0x4193a9
mov edx, dword [ebp + 0x18]
nop dword [eax + eax]
movzx eax, byte [ecx + 0x4f4d21]
mov al, byte [eax + 0x4b9320]
mov byte [ecx + 0x4f4d21], al
test edi, edi
je 0x4193a1
xor al, dl
xor al, 0xcc
mov byte [ecx + 0x4f4d21], al
inc ecx
xor edi, 1
cmp ecx, esi
jl 0x419380
lea eax, [esi + 1]
mov dword [esp + 0x14], eax
mov ebx, dword [0x5e692c]
cmp byte [ebx + 0x1a], 0
je 0x419417
cmp dword [ebx], 0xffffffff
je 0x419417
lea esi, [eax + 0xa]
push esi
call fcn.00478b1b
push dword [esp + 0x18]
mov edi, eax
push 0x4f4d20
lea ecx, [edi + 0xa]
push ecx
call fcn.0047a8c0
add esp, 0x10
mov dword [edi], 0x1000000
mov eax, dword [esp + 0x1c]
mov dword [edi + 4], eax
mov ax, word [esp + 0x1a]
push 0x10
mov word [edi + 8], ax
lea eax, [ebx + 4]
push eax
push 0
push esi
push edi
push dword [ebp + 8]
call dword [sym.imp.WS2_32.dll_sendto]
push edi
mov esi, eax
call fcn.00478b24
add esp, 4
jmp 0x419431
push 0x10
lea ecx, [esp + 0x1c]
push ecx
push 0
push eax
push 0x4f4d20
push dword [ebp + 8]
call dword [sym.imp.WS2_32.dll_sendto]
mov esi, eax
mov eax, dword [esp + 0x14]
test esi, esi
je 0x4193b0
cmp esi, 0xffffffff
je 0x41944d
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x14
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x14
Function at 0x419460
Capabilities:
Get hostname
Resolve dns

Disassembly:
sub esp, 0x50
lea eax, [esp]
push 0x50
push eax
call dword [sym.imp.WS2_32.dll_gethostname]
cmp eax, 0xffffffff
je 0x4194d0
push ebx
lea eax, [esp + 4]
push eax
call dword [sym.imp.WS2_32.dll_gethostbyname]
mov ebx, eax
test ebx, ebx
je 0x4194cf
mov ecx, dword [ebx + 0xc]
cmp dword [ecx], 0
je 0x4194cf
push ebp
mov ebp, dword [sym.imp.WS2_32.dll_inet_ntoa]
push esi
push edi
mov edi, dword [esp + 0x64]
xor esi, esi
nop dword [eax]
cmp esi, 0x28
jge 0x4194cc
mov eax, dword [esi + ecx]
push dword [eax]
call ebp
mov edx, edi
sub edx, eax
mov cl, byte [eax]
lea eax, [eax + 1]
mov byte [edx + eax - 1], cl
test cl, cl
jne 0x4194b0
mov ecx, dword [ebx + 0xc]
add esi, 4
add edi, 0x10
cmp dword [esi + ecx], 0
jne 0x4194a0
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x50
ret 4

Function at 0x419a90
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push esi
mov esi, dword [esp + 0x10]
xor ecx, ecx
test esi, esi
je 0x419aba
mov edx, dword [esp + 8]
push edi
mov edi, dword [esp + 0x10]
movzx eax, byte [ecx + edi]
inc ecx
xor eax, edx
imul edx, eax, 0x1000193
cmp ecx, esi
jb 0x419aa4
pop edi
mov eax, edx
pop esi
ret
mov eax, dword [esp + 8]
pop esi
ret

Function at 0x41a310
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4a46af
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push esi
mov esi, ecx
push 0
mov dword [ebp - 0x10], esi
call fcn.00460fdc
mov dword [ebp - 4], 0
mov dword [esi + 4], 0
mov byte [esi + 8], 0
mov dword [esi + 0xc], 0
mov byte [esi + 0x10], 0
xor eax, eax
mov dword [esi + 0x14], 0
mov word [esi + 0x18], ax
mov dword [esi + 0x1c], eax
mov word [esi + 0x20], ax
mov dword [esi + 0x24], eax
mov byte [esi + 0x28], al
mov dword [esi + 0x2c], eax
mov byte [esi + 0x30], al
mov eax, dword [ebp + 8]
mov byte [ebp - 4], 6
test eax, eax
je 0x41a39b
push eax
push esi
call fcn.0046126b
mov ecx, dword [ebp - 0xc]
add esp, 8
mov eax, esi
mov dword fs:[0], ecx
pop esi
mov esp, ebp
pop ebp
ret 4
push str.bad_locale_name
call fcn.00460d07
int3
Function at 0x428080
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4a4270
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
push ebx
mov eax, ecx
push esi
push edi
push 8
mov dword [ebp - 0x10], eax
mov dword [eax], vtable.std::basic_streambuf_char__struct_std::char_traits_char__.0
call fcn.00478b29
mov esi, eax
push 1
mov dword [ebp - 4], 0
call fcn.0046116b
mov dword [esi + 4], eax
add esp, 8
mov eax, dword [ebp - 0x10]
lea edi, [eax + 0x14]
lea ecx, [eax + 0x18]
lea edx, [eax + 0x24]
mov dword [eax + 0x34], esi
lea ebx, [eax + 4]
mov dword [eax + 0xc], ebx
lea esi, [eax + 8]
mov dword [eax + 0x10], esi
mov dword [eax + 0x1c], edi
mov dword [eax + 0x20], ecx
mov dword [eax + 0x2c], edx
add eax, 0x28
mov dword [ebp - 0x14], ebx
mov ebx, dword [ebp - 0x10]
mov dword [ebx + 0x30], eax
mov ebx, dword [ebp - 0x14]
mov dword [esi], 0
mov dword [ecx], 0
mov ecx, dword [ebp - 0xc]
mov dword [eax], 0
mov eax, dword [ebp - 0x10]
mov dword [ebx], 0
mov dword [edi], 0
pop edi
pop esi
mov dword [edx], 0
pop ebx
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret

Function at 0x42bbd0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
mov eax, dword [ebp + 8]
xor ecx, ecx
push esi
push edi
mov edx, 0x811c9dc5
mov esi, dword [eax + 4]
mov edi, dword [eax]
test esi, esi
je 0x42bc01
nop dword [eax + eax]
movzx eax, byte [edi + ecx]
inc ecx
xor eax, edx
imul edx, eax, 0x1000193
cmp ecx, esi
jb 0x42bbf0
pop edi
mov eax, edx
pop esi
mov esp, ebp
pop ebp
ret 4

Function at 0x42e9f0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x10
mov eax, ecx
mov edx, 0x811c9dc5
mov ecx, dword [ebp + 0xc]
push esi
push edi
mov dword [esp + 0xc], eax
mov esi, dword [ecx + 4]
mov edi, dword [ecx]
xor ecx, ecx
test esi, esi
je 0x42ea29
movzx eax, byte [edi + ecx]
inc ecx
xor eax, edx
imul edx, eax, 0x1000193
cmp ecx, esi
jb 0x42ea14
mov eax, dword [esp + 0xc]
push edx
push dword [ebp + 0xc]
lea ecx, [esp + 0x18]
push ecx
mov ecx, eax
call fcn.0042e900
mov ecx, dword [eax + 4]
mov eax, dword [ebp + 8]
test ecx, ecx
jne 0x42ea4a
mov ecx, dword [esp + 0xc]
mov ecx, dword [ecx + 4]
pop edi
mov dword [eax], ecx
pop esi
mov esp, ebp
pop ebp
ret 8
Function at 0x430ce0
Capabilities:
Hash data using fnv

Disassembly:
push ebx
push esi
push edi
mov edi, dword [esp + 0x10]
push 0x15
mov esi, dword [edi + 4]
push esi
call dword [sym.imp.lua51.dll_lua_checkstack]
add esp, 8
test eax, eax
jne 0x430d0e
push str.not_enough_Lua_stack_space_to_push_this_reference_value
push str.stack_overflow___s_
push esi
call dword [sym.imp.lua51.dll_luaL_error]
add esp, 0xc
push dword [edi]
push 0xffffd8f0
push esi
call dword [sym.imp.lua51.dll_lua_rawgeti]
push 0xffffffffffffffff
push esi
call dword [sym.imp.lua51.dll_lua_type]
push 0xffffffffffffffff
push esi
call dword [sym.imp.lua51.dll_lua_topointer]
push 0xfffffffffffffffe
push esi
mov ebx, eax
call dword [sym.imp.lua51.dll_lua_settop]
movzx ecx, bl
add esp, 0x24
xor ecx, 0x811c9dc5
imul edx, ecx, 0x1000193
mov ecx, ebx
shr ecx, 8
movzx eax, cl
pop edi
pop esi
xor edx, eax
mov eax, ebx
shr eax, 0x10
imul ecx, edx, 0x1000193
movzx eax, al
shr ebx, 0x18
xor ecx, eax
imul eax, ecx, 0x1000193
xor eax, ebx
imul eax, eax, 0x1000193
pop ebx
ret 4

Function at 0x432df0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x14
push ebx
push esi
push edi
mov esi, ecx
mov edi, edx
push 2
push esi
mov dword [esp + 0x18], esi
call dword [sym.imp.lua51.dll_lua_type]
add esp, 8
cmp eax, 4
jne 0x432e99
push ecx
mov edx, esi
lea ecx, [esp + 0x1c]
call fcn.00432f50
mov ebx, dword [esp + 0x20]
lea eax, [edi + 0x18]
add esp, 4
xor ecx, ecx
mov edx, 0x811c9dc5
test ebx, ebx
je 0x432e58
mov esi, dword [esp + 0x18]
nop
movzx eax, byte [ecx + esi]
inc ecx
xor eax, edx
imul edx, eax, 0x1000193
cmp ecx, ebx
jb 0x432e40
mov esi, dword [esp + 0x10]
lea eax, [edi + 0x18]
push edx
lea ecx, [esp + 0x1c]
push ecx
lea ecx, [esp + 0x18]
push ecx
mov ecx, eax
call fcn.0042e900
mov eax, dword [eax + 4]
test eax, eax
jne 0x432e74
mov eax, dword [edi + 0x1c]
xor edx, edx
lea ecx, [eax + 0x10]
cmp eax, dword [edi + 0x1c]
cmove ecx, edx
test ecx, ecx
je 0x432f28
push dword [ecx + 8]
mov eax, dword [ecx]
push esi
call eax
add esp, 8
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
test eax, eax
je 0x432f28
cmp eax, 0xffffffff
je 0x432f28
lea eax, [esp + 0x18]
mov dword [esp + 0x18], 2
push eax
lea ecx, [esp + 0x14]
mov dword [esp + 0x20], esi
call fcn.00432d10
lea eax, [esp + 0x10]
push eax
call fcn.00430ce0
push eax
lea eax, [esp + 0x14]
push eax
lea eax, [esp + 0x20]
push eax
lea ecx, [edi + 0x38]
call fcn.00430fb0
mov ebx, dword [eax + 4]
test ebx, ebx
jne 0x432eeb
mov ebx, dword [edi + 0x3c]
mov eax, dword [esp + 0x14]
test eax, eax
je 0x432f0c
mov ecx, dword [esp + 0x10]
cmp ecx, 0xfffffffe
je 0x432f0c
push ecx
push 0xffffd8f0
push eax
call dword [sym.imp.lua51.dll_luaL_unref]
add esp, 0xc
xor eax, eax
lea ecx, [ebx + 0x10]
cmp ebx, dword [edi + 0x3c]
cmove ecx, eax
test ecx, ecx
je 0x432f28
push esi
call fcn.00427c00
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push dword [edi + 0xa8]
mov eax, dword [edi + 0xa0]
push esi
call eax
add esp, 8
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x433010
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x1c
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
push 2
push edi
mov dword [esp + 0x18], edi
call dword [sym.imp.lua51.dll_lua_type]
add esp, 8
cmp eax, 4
jne 0x4330ba
push ecx
mov edx, edi
lea ecx, [esp + 0x1c]
call fcn.00432f50
mov ebx, dword [esp + 0x20]
lea eax, [esi + 0x18]
add esp, 4
xor ecx, ecx
mov edx, 0x811c9dc5
test ebx, ebx
je 0x433078
mov edi, dword [esp + 0x18]
nop
movzx eax, byte [ecx + edi]
inc ecx
xor eax, edx
imul edx, eax, 0x1000193
cmp ecx, ebx
jb 0x433060
mov edi, dword [esp + 0x10]
lea eax, [esi + 0x18]
push edx
lea ecx, [esp + 0x1c]
push ecx
lea ecx, [esp + 0x18]
push ecx
mov ecx, eax
call fcn.0042e900
mov eax, dword [eax + 4]
test eax, eax
jne 0x433094
mov eax, dword [esi + 0x1c]
xor edx, edx
lea ecx, [eax + 0x10]
cmp eax, dword [esi + 0x1c]
cmove ecx, edx
test ecx, ecx
je 0x433186
push dword [ecx + 8]
mov eax, dword [ecx + 4]
push edi
call eax
add esp, 8
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
test eax, eax
je 0x433186
cmp eax, 0xffffffff
je 0x433186
lea eax, [esp + 0x10]
mov dword [esp + 0x10], 2
push eax
lea ecx, [esp + 0x1c]
mov dword [esp + 0x18], edi
call fcn.00432d10
lea eax, [esp + 0x18]
push eax
call fcn.00430ce0
push eax
lea eax, [esp + 0x1c]
push eax
lea eax, [esp + 0x28]
push eax
lea ecx, [esi + 0x38]
call fcn.00430fb0
mov ebx, dword [eax + 4]
mov dword [esp + 0x10], ebx
test ebx, ebx
jne 0x433114
mov ebx, dword [esi + 0x3c]
mov dword [esp + 0x10], ebx
mov eax, dword [esp + 0x1c]
test eax, eax
je 0x433135
mov ecx, dword [esp + 0x18]
cmp ecx, 0xfffffffe
je 0x433135
push ecx
push 0xffffd8f0
push eax
call dword [sym.imp.lua51.dll_luaL_unref]
add esp, 0xc
mov eax, dword [esp + 0x10]
add ebx, 0x10
xor ecx, ecx
cmp eax, dword [esi + 0x3c]
cmove ebx, ecx
test ebx, ebx
je 0x433186
push 3
push edi
lea ecx, [esp + 0x20]
call fcn.00426b50
push eax
mov ecx, ebx
call fcn.00426a00
mov ecx, dword [esp + 0x1c]
test ecx, ecx
je 0x43317d
mov eax, dword [esp + 0x18]
cmp eax, 0xfffffffe
je 0x43317d
push eax
push 0xffffd8f0
push ecx
call dword [sym.imp.lua51.dll_luaL_unref]
add esp, 0xc
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push dword [esi + 0xac]
mov eax, dword [esi + 0xa4]
push edi
call eax
add esp, 8
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4331a0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x14
push ebx
push esi
push edi
mov esi, ecx
mov edi, edx
push 2
push esi
mov dword [esp + 0x18], esi
call dword [sym.imp.lua51.dll_lua_type]
add esp, 8
cmp eax, 4
jne 0x433249
push ecx
mov edx, esi
lea ecx, [esp + 0x1c]
call fcn.00432f50
mov ebx, dword [esp + 0x20]
lea eax, [edi + 0x18]
add esp, 4
xor ecx, ecx
mov edx, 0x811c9dc5
test ebx, ebx
je 0x433208
mov esi, dword [esp + 0x18]
nop
movzx eax, byte [ecx + esi]
inc ecx
xor eax, edx
imul edx, eax, 0x1000193
cmp ecx, ebx
jb 0x4331f0
mov esi, dword [esp + 0x10]
lea eax, [edi + 0x18]
push edx
lea ecx, [esp + 0x1c]
push ecx
lea ecx, [esp + 0x18]
push ecx
mov ecx, eax
call fcn.0042e900
mov eax, dword [eax + 4]
test eax, eax
jne 0x433224
mov eax, dword [edi + 0x1c]
xor edx, edx
lea ecx, [eax + 0x10]
cmp eax, dword [edi + 0x1c]
cmove ecx, edx
test ecx, ecx
je 0x4332d8
push dword [ecx + 8]
mov eax, dword [ecx]
push esi
call eax
add esp, 8
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
test eax, eax
je 0x4332d8
cmp eax, 0xffffffff
je 0x4332d8
lea eax, [esp + 0x18]
mov dword [esp + 0x18], 2
push eax
lea ecx, [esp + 0x14]
mov dword [esp + 0x20], esi
call fcn.00432d10
lea eax, [esp + 0x10]
push eax
call fcn.00430ce0
push eax
lea eax, [esp + 0x14]
push eax
lea eax, [esp + 0x20]
push eax
lea ecx, [edi + 0x38]
call fcn.00430fb0
mov ebx, dword [eax + 4]
test ebx, ebx
jne 0x43329b
mov ebx, dword [edi + 0x3c]
mov eax, dword [esp + 0x14]
test eax, eax
je 0x4332bc
mov ecx, dword [esp + 0x10]
cmp ecx, 0xfffffffe
je 0x4332bc
push ecx
push 0xffffd8f0
push eax
call dword [sym.imp.lua51.dll_luaL_unref]
add esp, 0xc
xor eax, eax
lea ecx, [ebx + 0x10]
cmp ebx, dword [edi + 0x3c]
cmove ecx, eax
test ecx, ecx
je 0x4332d8
push esi
call fcn.00427c00
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push dword [edi + 0xb8]
mov eax, dword [edi + 0xb0]
push esi
call eax
add esp, 8
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x433300
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x1c
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
push 2
push edi
mov dword [esp + 0x18], edi
call dword [sym.imp.lua51.dll_lua_type]
add esp, 8
cmp eax, 4
jne 0x4333aa
push ecx
mov edx, edi
lea ecx, [esp + 0x1c]
call fcn.00432f50
mov ebx, dword [esp + 0x20]
lea eax, [esi + 0x18]
add esp, 4
xor ecx, ecx
mov edx, 0x811c9dc5
test ebx, ebx
je 0x433368
mov edi, dword [esp + 0x18]
nop
movzx eax, byte [ecx + edi]
inc ecx
xor eax, edx
imul edx, eax, 0x1000193
cmp ecx, ebx
jb 0x433350
mov edi, dword [esp + 0x10]
lea eax, [esi + 0x18]
push edx
lea ecx, [esp + 0x1c]
push ecx
lea ecx, [esp + 0x18]
push ecx
mov ecx, eax
call fcn.0042e900
mov eax, dword [eax + 4]
test eax, eax
jne 0x433384
mov eax, dword [esi + 0x1c]
xor edx, edx
lea ecx, [eax + 0x10]
cmp eax, dword [esi + 0x1c]
cmove ecx, edx
test ecx, ecx
je 0x433476
push dword [ecx + 8]
mov eax, dword [ecx + 4]
push edi
call eax
add esp, 8
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
test eax, eax
je 0x433476
cmp eax, 0xffffffff
je 0x433476
lea eax, [esp + 0x10]
mov dword [esp + 0x10], 2
push eax
lea ecx, [esp + 0x1c]
mov dword [esp + 0x18], edi
call fcn.00432d10
lea eax, [esp + 0x18]
push eax
call fcn.00430ce0
push eax
lea eax, [esp + 0x1c]
push eax
lea eax, [esp + 0x28]
push eax
lea ecx, [esi + 0x38]
call fcn.00430fb0
mov ebx, dword [eax + 4]
mov dword [esp + 0x10], ebx
test ebx, ebx
jne 0x433404
mov ebx, dword [esi + 0x3c]
mov dword [esp + 0x10], ebx
mov eax, dword [esp + 0x1c]
test eax, eax
je 0x433425
mov ecx, dword [esp + 0x18]
cmp ecx, 0xfffffffe
je 0x433425
push ecx
push 0xffffd8f0
push eax
call dword [sym.imp.lua51.dll_luaL_unref]
add esp, 0xc
mov eax, dword [esp + 0x10]
add ebx, 0x10
xor ecx, ecx
cmp eax, dword [esi + 0x3c]
cmove ebx, ecx
test ebx, ebx
je 0x433476
push 3
push edi
lea ecx, [esp + 0x20]
call fcn.00426b50
push eax
mov ecx, ebx
call fcn.00426a00
mov ecx, dword [esp + 0x1c]
test ecx, ecx
je 0x43346d
mov eax, dword [esp + 0x18]
cmp eax, 0xfffffffe
je 0x43346d
push eax
push 0xffffd8f0
push ecx
call dword [sym.imp.lua51.dll_luaL_unref]
add esp, 0xc
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push dword [esi + 0xbc]
mov eax, dword [esi + 0xb4]
push edi
call eax
add esp, 8
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x456680
Capabilities:
Create thread
Set console window title

Disassembly:
push ecx
call dword [sym.imp.KERNEL32.dll_AllocConsole]
cmp byte [0x5e75a9], 0
je 0x45669f
push 0xb
call dword [sym.imp.KERNEL32.dll_GetConsoleWindow]
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
push esi
push edi
push 1
call fcn.0047dd2b
push 1
mov esi, eax
call fcn.0047dd2b
push esi
push 0x4bb460
push str.CONOUT_
push eax
call fcn.00482d5d
add esp, 0x18
push 0x4e3
call dword [sym.imp.KERNEL32.dll_SetConsoleCP]
push 0x4e3
call dword [sym.imp.KERNEL32.dll_SetConsoleOutputCP]
mov edi, dword [sym.imp.KERNEL32.dll_GetStdHandle]
push 0xfffffffffffffff5
call edi
push 0x4000
push eax
call fcn.00488330
push 0x4bb460
push eax
call fcn.00487cf3
push 1
mov esi, dword [eax]
call fcn.0047dd2b
add esp, 0x14
mov dword [eax], esi
push 0
push 4
push 0
push 1
call fcn.0047dd2b
add esp, 4
push eax
call fcn.00487ec2
add esp, 0x10
push 0xfffffffffffffff6
call edi
push 0x4000
push eax
call fcn.00488330
push 0x4bae04
push eax
call fcn.00487cf3
push 0
mov esi, dword [eax]
call fcn.0047dd2b
add esp, 0x14
mov dword [eax], esi
push 0
push 4
push 0
push 0
call fcn.0047dd2b
add esp, 4
push eax
call fcn.00487ec2
add esp, 0x10
push 0xfffffffffffffff4
call edi
push 0x4000
push eax
call fcn.00488330
push 0x4bb460
push eax
call fcn.00487cf3
push 2
mov esi, dword [eax]
call fcn.0047dd2b
add esp, 0x14
mov dword [eax], esi
push 0
push 4
push 0
push 2
call fcn.0047dd2b
add esp, 4
push eax
call fcn.00487ec2
add esp, 0x10
lea ecx, [esp + 8]
push 2
call fcn.00460fdc
lea ecx, [esp + 8]
mov byte [0x4cd004], 1
call fcn.00461034
push str.RakSAMP_Lite__v0.9.1_Beta__Build_at_May_15_2024_23:06:25_
call dword [sym.imp.KERNEL32.dll_SetConsoleTitleA]
push 0
push 0
push 0
push 0x4565a0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
push 1
push 0x456630
call dword [sym.imp.KERNEL32.dll_SetConsoleCtrlHandler]
pop edi
pop esi
pop ecx
ret