joyce8/EMBER2024-capa huggingface dataset:
Function at 0x3f004340
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
mov al, byte [ebp + 8]
push ebx
push esi
mov esi, ecx
mov cl, byte [ebp + 0xc]
mov byte [esi], al
mov byte [esi + 1], cl
cmp cl, al
jbe 0x3f00435b
mov byte [esi + 1], al
mov cl, al
xor edx, edx
movzx eax, al
movzx ecx, cl
div ecx
mov dl, 8
mov cl, 0x80
dec al
jmp 0x3f004370
test al, cl
jne 0x3f00437a
dec dl
shr cl, 1
jne 0x3f004370
mov bl, byte [esi + 1]
mov cl, 8
mov byte [esi + 2], dl
dec bl
mov al, 0x80
test bl, al
jne 0x3f004390
dec cl
shr al, 1
jne 0x3f004386
mov al, 8
mov byte [esi + 4], cl
sub al, cl
or bl, 0xff
sub al, dl
movzx ecx, cl
mov byte [esi + 6], al
movzx eax, dl
or dl, 0xff
add ecx, eax
shl dl, cl
mov ecx, eax
shl bl, cl
mov al, bl
mov byte [esi + 7], dl
not bl
xor al, dl
mov byte [esi + 3], bl
mov byte [esi + 5], al
pop esi
pop ebx
pop ebp
ret 8

Function at 0x3f004820
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
pop ebp
jmp sym.tier0_s.dll_AssertMsgImplementationPreformatted

Function at 0x3f004870
Capabilities:
Encode data using xor

Disassembly:
push ebx
mov ebx, dword [ecx + 0xa0]
push edi
xor edi, edi
mov dword [ecx + 0xa8], 0
mov dword [ecx + 0xac], 0
test ebx, ebx
jle 0x3f0048da
push esi
jmp 0x3f0048a0
mov esi, dword [ecx + 0xa8]
mov edx, dword [ecx + 0xac]
shld edx, esi, 2
shl esi, 2
mov dword [ecx + 0xa8], esi
mov dword [ecx + 0xac], edx
xor esi, dword [ecx + edi*8]
mov eax, dword [ecx + edi*8 + 4]
inc edi
xor eax, edx
mov dword [ecx + 0xa8], esi
mov dword [ecx + 0xac], eax
cmp edi, ebx
jl 0x3f0048a0
pop esi
pop edi
pop ebx
ret
Function at 0x3f006bd0
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push ebx
mov ebx, dword [ebp + 0xc]
push edi
mov edi, ecx
movzx eax, byte [ebx]
xor eax, 0x811c9dc5
imul edx, eax, 0x1000193
movzx eax, byte [ebx + 1]
xor edx, eax
movzx eax, byte [ebx + 2]
imul edx, edx, 0x1000193
xor edx, eax
movzx eax, byte [ebx + 3]
imul ecx, edx, 0x1000193
xor ecx, eax
imul eax, ecx, 0x1000193
mov ecx, edi
push eax
mov dword [ebp - 4], eax
lea eax, [ebp - 0x14]
push ebx
push eax
call fcn.3f006b60
mov ecx, dword [ebp - 0x10]
test ecx, ecx
je 0x3f006c37
mov eax, dword [ebp + 8]
pop edi
pop ebx
mov dword [eax], ecx
mov byte [eax + 4], 0
mov esp, ebp
pop ebp
ret 8
cmp dword [edi + 8], 0xfffffff
je 0x3f006d77
push esi
push 0x10
call fcn.3f01a46b
mov ecx, dword [ebx]
mov esi, eax
add esp, 4
mov dword [ebp - 0xc], esi
mov dword [esi + 8], ecx
mov ecx, dword [ebx + 4]
mov dword [esi + 0xc], ecx
mov eax, dword [edi + 8]
fld dword [edi]
lea ecx, [eax + 1]
mov dword [ebp + 0xc], ecx
fild dword [ebp + 0xc]
test ecx, ecx
jns 0x3f006c77
fadd dword [0x3f0370a0]
fstp dword [ebp + 0xc]
fld dword [ebp + 0xc]
mov ebx, dword [edi + 0x1c]
fild dword [edi + 0x1c]
test ebx, ebx
jns 0x3f006c8d
fadd dword [0x3f0370a0]
fstp dword [ebp + 0xc]
fld dword [ebp + 0xc]
fdivr st(1)
fcompi st(2)
ja 0x3f006ca2
mov edx, dword [ebp - 0x14]
fstp st(0)
fstp st(0)
jmp 0x3f006d17
fdivrp st(1)
sub esp, 8
fstp dword [ebp + 0xc]
fld dword [ebp + 0xc]
fstp qword [esp]
call fcn.3f021680
fstp dword [ebp + 0xc]
fld dword [ebp + 0xc]
mov ecx, 8
fnstcw word [ebp + 0xe]
movzx eax, word [ebp + 0xe]
add esp, 8
or eax, 0xc00
mov dword [ebp - 8], eax
fldcw word [ebp - 8]
fistp qword [ebp - 0x14]
mov eax, dword [ebp - 0x14]
cmp eax, ecx
cmova ecx, eax
fldcw word [ebp + 0xe]
cmp ebx, ecx
jae 0x3f006cf8
cmp ebx, 0x200
jae 0x3f006cf6
shl ebx, 3
cmp ebx, ecx
jae 0x3f006cf8
mov ebx, ecx
push ebx
mov ecx, edi
call fcn.3f007110
push dword [ebp - 4]
lea eax, [esi + 8]
mov ecx, edi
push eax
lea eax, [ebp - 0x1c]
push eax
call fcn.3f006b60
mov edx, dword [eax]
mov eax, dword [edi + 8]
mov ebx, dword [edx + 4]
inc eax
mov dword [edi + 8], eax
mov dword [esi], edx
mov dword [esi + 4], ebx
mov dword [ebx], esi
mov dword [edx + 4], esi
mov eax, dword [edi + 0x18]
and eax, dword [ebp - 4]
mov ecx, dword [edi + 0xc]
mov esi, dword [ecx + eax*8]
cmp esi, dword [edi + 4]
mov esi, dword [ebp - 0xc]
jne 0x3f006d41
mov dword [ecx + eax*8], esi
jmp 0x3f006d61
cmp dword [ecx + eax*8], edx
jne 0x3f006d5b
mov dword [ecx + eax*8], esi
mov eax, dword [ebp + 8]
mov dword [eax], esi
pop esi
pop edi
mov byte [eax + 4], 1
pop ebx
mov esp, ebp
pop ebp
ret 8
cmp dword [ecx + eax*8 + 4], ebx
jne 0x3f006d65
mov dword [ecx + eax*8 + 4], esi
mov eax, dword [ebp + 8]
mov dword [eax], esi
pop esi
pop edi
mov byte [eax + 4], 1
pop ebx
mov esp, ebp
pop ebp
ret 8
push 0x3f037068
call fcn.3f01a43e
int3
Function at 0x3f006e90
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
mov eax, dword fs:[0x2c]
sub esp, 0x18
mov edx, dword [0x3f0924ac]
push esi
mov edx, dword [eax + edx*4]
mov eax, dword [0x3f04ec34]
push edi
mov edi, ecx
cmp eax, dword [edx + 0x408]
jg 0x3f006fcb
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov edx, eax
mov esi, 0x3f04ec14
cmp edx, dword [0x3f04ec14]
je 0x3f006ee7
mov ecx, edx
xor eax, eax
lock cmpxchg dword [esi], ecx
test eax, eax
je 0x3f006ee7
pause
push edx
mov ecx, esi
call sym.tier0_s.dll_private:_void___thiscall_CThreadSpinLock::Lock_unsigned_int_volatile
jmp 0x3f006eee
lock inc dword [0x3f04ec18]
push ebx
mov ebx, dword [ebp + 8]
cmp ebx, dword [edi + 0x20]
je 0x3f006fab
movzx eax, bl
xor eax, 0x811c9dc5
mov dword [edi + 0x20], ebx
imul ecx, eax, 0x1000193
mov eax, ebx
shr eax, 8
movzx eax, al
mov dword [ebp + 8], ebx
xor ecx, eax
mov eax, ebx
imul ecx, ecx, 0x1000193
shr eax, 0x10
movzx eax, al
xor ecx, eax
mov eax, ebx
imul ecx, ecx, 0x1000193
shr eax, 0x18
xor ecx, eax
imul eax, ecx, 0x1000193
mov ecx, edi
push eax
lea eax, [ebp + 8]
push eax
lea eax, [ebp - 0x10]
push eax
call fcn.3f006b60
mov eax, dword [eax + 4]
test eax, eax
je 0x3f006f58
mov ecx, dword [edi + 4]
jmp 0x3f006f5d
mov eax, dword [edi + 4]
mov ecx, eax
cmp eax, ecx
je 0x3f006f69
mov eax, dword [eax + 0xc]
mov dword [edi + 0x24], eax
jmp 0x3f006fae
mov esi, ebx
lea ecx, [esi + 1]
mov edi, edi
mov al, byte [esi]
inc esi
test al, al
jne 0x3f006f70
sub esi, ecx
inc esi
push esi
call fcn.3f0203a0
push esi
push ebx
push eax
mov dword [edi + 0x24], eax
call fcn.3f01bbf0
mov eax, dword [edi + 0x24]
add esp, 0x10
mov dword [ebp - 4], eax
mov ecx, edi
lea eax, [ebp - 8]
mov dword [ebp - 8], ebx
push eax
lea eax, [ebp - 0x18]
push eax
call fcn.3f006bd0
mov esi, 0x3f04ec14
mov eax, dword [edi + 0x24]
lock dec dword [0x3f04ec18]
cmp dword [0x3f04ec18], 0
pop ebx
jne 0x3f006fc3
xor ecx, ecx
xchg dword [esi], ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4
push 0x3f04ec34
call fcn.3f01a5dc
add esp, 4
cmp dword [0x3f04ec34], 0xffffffff
jne 0x3f006eba
mov ecx, 0x3f04ec1c
call sym.tier0_s.dll_public:_void___thiscall_CThreadMutex::constructor_void_
push 0x3f035c80
call fcn.3f01aa47
push 0x3f04ec34
call fcn.3f01a592
add esp, 8
jmp 0x3f006eba
Function at 0x3f007110
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov edx, dword [ebp + 8]
mov eax, 0x1fffffff
push ebx
mov ebx, ecx
bsr ecx, eax
push esi
push edi
mov edi, 1
mov dword [ebp - 0xc], ebx
mov eax, edi
shl eax, cl
cmp edx, eax
ja 0x3f00726e
mov esi, dword [ebx + 4]
lea eax, [edx - 1]
or eax, edi
mov dword [ebp - 8], esi
bsr ecx, eax
push esi
lea ecx, [ecx + 1]
shl edi, cl
lea ecx, [ebx + 0xc]
lea eax, [edi + edi]
push eax
call fcn.3f007010
lea eax, [edi - 1]
mov dword [ebx + 0x1c], edi
mov dword [ebx + 0x18], eax
mov ecx, dword [ebx + 4]
mov ecx, dword [ecx]
mov edx, ecx
cmp ecx, esi
je 0x3f007240
movzx eax, byte [ecx + 8]
xor eax, 0x811c9dc5
mov edx, dword [edx]
imul edi, eax, 0x1000193
movzx eax, byte [ecx + 9]
xor edi, eax
movzx eax, byte [ecx + 0xa]
imul edi, edi, 0x1000193
xor edi, eax
movzx eax, byte [ecx + 0xb]
imul edi, edi, 0x1000193
xor edi, eax
imul eax, edi, 0x1000193
mov edi, dword [ebx + 0x18]
and edi, eax
mov eax, dword [ebx + 0xc]
mov ebx, dword [eax + edi*8]
lea eax, [eax + edi*8]
mov dword [ebp + 8], eax
cmp ebx, esi
jne 0x3f0071c3
mov dword [eax], ecx
mov dword [eax + 4], ecx
jmp 0x3f00722f
mov eax, dword [eax + 4]
mov edi, dword [ecx + 8]
cmp edi, dword [eax + 8]
jne 0x3f0071fa
mov eax, dword [eax]
cmp eax, ecx
je 0x3f0071f2
mov ebx, dword [ecx + 4]
mov dword [ebp - 4], ebx
mov dword [ebx], edx
mov ebx, dword [edx + 4]
mov dword [ebx], eax
mov edi, dword [eax + 4]
mov dword [edi], ecx
mov dword [eax + 4], ebx
mov eax, dword [ebp - 4]
mov dword [edx + 4], eax
mov dword [ecx + 4], edi
mov eax, dword [ebp + 8]
mov dword [eax + 4], ecx
jmp 0x3f00722f
cmp ebx, eax
je 0x3f00720c
mov edi, edi
mov eax, dword [eax + 4]
cmp edi, dword [eax + 8]
je 0x3f007249
cmp ebx, eax
jne 0x3f007200
mov ebx, dword [ecx + 4]
mov dword [ebp - 4], ebx
mov dword [ebx], edx
mov ebx, dword [edx + 4]
mov dword [ebx], eax
mov edi, dword [eax + 4]
mov dword [edi], ecx
mov dword [eax + 4], ebx
mov eax, dword [ebp - 4]
mov dword [edx + 4], eax
mov eax, dword [ebp + 8]
mov dword [ecx + 4], edi
mov dword [eax], ecx
mov ebx, dword [ebp - 0xc]
mov ecx, edx
cmp edx, esi
jne 0x3f007172
lea esp, [esp]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
mov ebx, dword [ecx + 4]
mov eax, dword [eax]
mov dword [ebp + 8], eax
mov esi, dword [ebp + 8]
mov dword [ebx], edx
mov edi, dword [edx + 4]
mov dword [edi], eax
mov eax, dword [eax + 4]
mov dword [eax], ecx
mov dword [esi + 4], edi
mov esi, dword [ebp - 8]
mov dword [edx + 4], ebx
mov dword [ecx + 4], eax
jmp 0x3f00722f
push str.invalid_hash_bucket_count
call fcn.3f01a43e
int3
Function at 0x3f0079e0
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
movzx eax, byte [esi]
xor eax, 0x811c9dc5
imul ecx, eax, 0x1000193
movzx eax, byte [esi + 1]
xor ecx, eax
movzx eax, byte [esi + 2]
imul ecx, ecx, 0x1000193
xor ecx, eax
movzx eax, byte [esi + 3]
imul ecx, ecx, 0x1000193
xor ecx, eax
movzx eax, byte [esi + 4]
xor eax, 0x811c9dc5
imul edx, ecx, 0x1000193
imul ecx, eax, 0x1000193
movzx eax, byte [esi + 5]
xor ecx, eax
movzx eax, byte [esi + 6]
imul ecx, ecx, 0x1000193
xor ecx, eax
movzx eax, byte [esi + 7]
imul ecx, ecx, 0x1000193
pop esi
xor ecx, eax
imul eax, ecx, 0x1000193
add eax, eax
xor eax, edx
pop ebp
ret 4
Function at 0x3f00b8c0
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push edi
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov edx, eax
mov edi, 0x3f04ec94
cmp edx, dword [0x3f04ec94]
je 0x3f00b8f4
mov ecx, edx
xor eax, eax
lock cmpxchg dword [edi], ecx
test eax, eax
je 0x3f00b8f4
pause
push edx
mov ecx, edi
call sym.tier0_s.dll_private:_void___thiscall_CThreadSpinLock::Lock_unsigned_int_volatile
jmp 0x3f00b8fb
lock inc dword [0x3f04ec98]
mov edx, dword [ebp + 8]
movzx eax, dl
xor eax, 0x811c9dc5
imul ecx, eax, 0x1000193
movzx eax, dh
xor ecx, eax
movzx eax, byte [ebp + 0xa]
imul ecx, ecx, 0x1000193
xor ecx, eax
movzx eax, byte [ebp + 0xb]
imul ecx, ecx, 0x1000193
xor ecx, eax
imul eax, ecx, 0x1000193
mov ecx, 0x3f04ecb4
push eax
lea eax, [ebp + 8]
push eax
lea eax, [ebp - 8]
push eax
call fcn.3f006b60
mov eax, dword [eax + 4]
test eax, eax
je 0x3f00b9e2
push esi
mov esi, dword [0x3f04ecb8]
cmp eax, esi
je 0x3f00b9e1
movzx ecx, byte [eax + 8]
xor ecx, 0x811c9dc5
imul edx, ecx, 0x1000193
movzx ecx, byte [eax + 9]
xor edx, ecx
movzx ecx, byte [eax + 0xa]
imul edx, edx, 0x1000193
xor edx, ecx
movzx ecx, byte [eax + 0xb]
imul edx, edx, 0x1000193
xor edx, ecx
imul ecx, edx, 0x1000193
mov edx, dword [0x3f04eccc]
and edx, ecx
mov ecx, dword [0x3f04ecc0]
lea edx, [ecx + edx*8]
mov ecx, dword [edx]
cmp dword [edx + 4], eax
jne 0x3f00b9bb
cmp ecx, eax
jne 0x3f00b9b3
mov dword [edx], esi
mov dword [edx + 4], esi
jmp 0x3f00b9c3
mov esi, dword [eax + 4]
mov dword [edx + 4], esi
jmp 0x3f00b9c3
cmp ecx, eax
jne 0x3f00b9c3
mov ecx, dword [eax]
mov dword [edx], ecx
mov edx, dword [eax]
dec dword [0x3f04ecbc]
mov ecx, dword [eax + 4]
push 0x1c
push eax
mov dword [ecx], edx
mov ecx, dword [eax + 4]
mov dword [edx + 4], ecx
call fcn.3f01a49b
add esp, 8
pop esi
lock dec dword [0x3f04ec98]
cmp dword [0x3f04ec98], 0
jne 0x3f00b9f6
xor eax, eax
xchg dword [edi], eax
pop edi
mov esp, ebp
pop ebp
ret

Function at 0x3f00bfe0
Capabilities:
Print debug messages
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x100
push esi
mov esi, dword [ebp + 8]
mov dword [ecx + 0x592c], esi
call sym.tier0_s.dll_Plat_IsInDebugSession
test al, al
je 0x3f00bffd
int3
push 0
push esi
push str._OUT_OF_MEMORY__attempted_allocation_size:__llu__n
lea eax, [ebp - 0x100]
push 0x100
push eax
call fcn.3f001b50
add esp, 0x14
mov byte [ebp - 1], 0
lea eax, [ebp - 0x100]
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
call sym.tier0_s.dll_Plat_IsInDebugSession
pop esi
test al, al
jne 0x3f00c061
lea eax, [ebp - 0x100]
push eax
push 0x80000bd2
push str.c:_buildslave_steam_rel_client_hotfix_win32_build_src_tier0memstd.cpp
call sym.tier0_s.dll_public:_static_bool___cdecl_AssertMsgHelper_1_::AssertFailed_char_const___unsigned_int__char_const__
add esp, 0xc
test al, al
jne 0x3f00c052
int3
push 1
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov esp, ebp
pop ebp
ret 4
Function at 0x3f00c920
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov edx, dword [ebp + 8]
mov eax, 0x1fffffff
push ebx
mov ebx, ecx
bsr ecx, eax
push esi
push edi
mov edi, 1
mov dword [ebp - 0xc], ebx
mov eax, edi
shl eax, cl
cmp edx, eax
ja 0x3f00ca7a
mov esi, dword [ebx + 4]
lea eax, [edx - 1]
or eax, edi
mov dword [ebp - 8], esi
bsr ecx, eax
push esi
lea ecx, [ecx + 1]
shl edi, cl
lea ecx, [ebx + 0xc]
lea eax, [edi + edi]
push eax
call fcn.3f007010
lea eax, [edi - 1]
mov dword [ebx + 0x1c], edi
mov dword [ebx + 0x18], eax
mov ecx, dword [ebx + 4]
mov ecx, dword [ecx]
mov edx, ecx
cmp ecx, esi
je 0x3f00ca4c
movzx eax, byte [ecx + 8]
xor eax, 0x811c9dc5
mov edx, dword [edx]
imul edi, eax, 0x1000193
movzx eax, byte [ecx + 9]
xor edi, eax
movzx eax, byte [ecx + 0xa]
imul edi, edi, 0x1000193
xor edi, eax
movzx eax, byte [ecx + 0xb]
imul edi, edi, 0x1000193
xor edi, eax
imul eax, edi, 0x1000193
mov edi, dword [ebx + 0x18]
and edi, eax
mov eax, dword [ebx + 0xc]
mov ebx, dword [eax + edi*8]
lea eax, [eax + edi*8]
mov dword [ebp + 8], eax
cmp ebx, esi
jne 0x3f00c9d3
mov dword [eax], ecx
mov dword [eax + 4], ecx
jmp 0x3f00ca3f
mov eax, dword [eax + 4]
mov edi, dword [ecx + 8]
cmp edi, dword [eax + 8]
jne 0x3f00ca0a
mov eax, dword [eax]
cmp eax, ecx
je 0x3f00ca02
mov ebx, dword [ecx + 4]
mov dword [ebp - 4], ebx
mov dword [ebx], edx
mov ebx, dword [edx + 4]
mov dword [ebx], eax
mov edi, dword [eax + 4]
mov dword [edi], ecx
mov dword [eax + 4], ebx
mov eax, dword [ebp - 4]
mov dword [edx + 4], eax
mov dword [ecx + 4], edi
mov eax, dword [ebp + 8]
mov dword [eax + 4], ecx
jmp 0x3f00ca3f
cmp ebx, eax
je 0x3f00ca1c
mov edi, edi
mov eax, dword [eax + 4]
cmp edi, dword [eax + 8]
je 0x3f00ca55
cmp ebx, eax
jne 0x3f00ca10
mov ebx, dword [ecx + 4]
mov dword [ebp - 4], ebx
mov dword [ebx], edx
mov ebx, dword [edx + 4]
mov dword [ebx], eax
mov edi, dword [eax + 4]
mov dword [edi], ecx
mov dword [eax + 4], ebx
mov eax, dword [ebp - 4]
mov dword [edx + 4], eax
mov eax, dword [ebp + 8]
mov dword [ecx + 4], edi
mov dword [eax], ecx
mov ebx, dword [ebp - 0xc]
mov ecx, edx
cmp edx, esi
jne 0x3f00c982
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
mov ebx, dword [ecx + 4]
mov eax, dword [eax]
mov dword [ebp + 8], eax
mov esi, dword [ebp + 8]
mov dword [ebx], edx
mov edi, dword [edx + 4]
mov dword [edi], eax
mov eax, dword [eax + 4]
mov dword [eax], ecx
mov dword [esi + 4], edi
mov esi, dword [ebp - 8]
mov dword [edx + 4], ebx
mov dword [ecx + 4], eax
jmp 0x3f00ca3f
push str.invalid_hash_bucket_count
call fcn.3f01a43e
int3
Function at 0x3f00cc00
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
sub esp, 0x18
mov edx, dword [ebp + 8]
push ebx
mov ebx, ecx
cmp edx, eax
je 0x3f00cd57
mov eax, dword [ebx + 4]
mov dword [ebp - 0xc], eax
mov eax, dword [edx + 4]
mov dword [ebp - 0x10], eax
movzx eax, byte [edx + 8]
xor eax, 0x811c9dc5
imul ecx, eax, 0x1000193
movzx eax, byte [edx + 9]
push esi
push edi
mov edi, dword [ebx + 0xc]
mov esi, edx
xor ecx, eax
mov dword [ebp - 0x18], edi
movzx eax, byte [edx + 0xa]
imul ecx, ecx, 0x1000193
xor ecx, eax
movzx eax, byte [edx + 0xb]
imul ecx, ecx, 0x1000193
xor ecx, eax
mov eax, dword [ebx + 0x18]
imul ecx, ecx, 0x1000193
and eax, ecx
mov ecx, dword [edi + eax*8]
mov dword [ebp - 8], ecx
lea eax, [edi + eax*8]
mov dword [ebp - 4], eax
mov eax, dword [eax + 4]
mov dword [ebp - 0x14], eax
mov eax, esi
mov edi, esi
mov esi, dword [esi]
push 0x1c
push eax
call fcn.3f01a49b
dec dword [ebx + 8]
add esp, 8
cmp edi, dword [ebp - 0x14]
je 0x3f00ccba
cmp esi, dword [ebp + 0xc]
jne 0x3f00cc77
mov eax, dword [ebp - 8]
cmp eax, dword [ebp + 8]
jne 0x3f00cd4a
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 4]
pop edi
mov dword [ecx], esi
mov dword [eax], esi
mov dword [esi + 4], eax
mov eax, dword [ebp + 0xc]
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 4]
cmp eax, dword [ebp + 8]
jne 0x3f00cccc
mov eax, dword [ebp - 0xc]
mov dword [ecx], eax
jmp 0x3f00cccf
mov eax, dword [ebp - 0x10]
mov dword [ecx + 4], eax
cmp esi, dword [ebp + 0xc]
je 0x3f00cd4a
jmp 0x3f00cce0
movzx eax, byte [esi + 8]
xor eax, 0x811c9dc5
imul ecx, eax, 0x1000193
movzx eax, byte [esi + 9]
xor ecx, eax
movzx eax, byte [esi + 0xa]
imul ecx, ecx, 0x1000193
xor ecx, eax
movzx eax, byte [esi + 0xb]
imul ecx, ecx, 0x1000193
xor ecx, eax
imul eax, ecx, 0x1000193
mov ecx, dword [ebx + 0x18]
and ecx, eax
mov eax, dword [ebp - 0x18]
lea eax, [eax + ecx*8]
mov dword [ebp + 8], eax
mov eax, dword [eax + 4]
mov dword [ebp - 0x14], eax
mov eax, esi
mov edi, esi
mov esi, dword [esi]
push 0x1c
push eax
call fcn.3f01a49b
dec dword [ebx + 8]
add esp, 8
cmp edi, dword [ebp - 0x14]
je 0x3f00cd5e
cmp esi, dword [ebp + 0xc]
jne 0x3f00cd27
mov eax, dword [ebp + 8]
mov dword [eax], esi
mov eax, dword [ebp - 0x10]
pop edi
mov dword [eax], esi
mov dword [esi + 4], eax
mov eax, dword [ebp + 0xc]
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
mov eax, dword [ebp + 8]
mov edx, dword [ebp - 0xc]
mov dword [eax], edx
mov dword [eax + 4], edx
cmp esi, dword [ebp + 0xc]
jne 0x3f00cce0
mov eax, dword [ebp - 0x10]
pop edi
mov dword [eax], esi
mov dword [esi + 4], eax
mov eax, dword [ebp + 0xc]
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x3f00e860
Capabilities:
Get hostname

Disassembly:
push ebp
mov ebp, esp
mov eax, dword fs:[0x2c]
sub esp, 0x204
mov ecx, dword [0x3f0924ac]
mov ecx, dword [eax + ecx*4]
mov eax, dword [0x3f090190]
cmp eax, dword [ecx + 0x408]
jg 0x3f00e921
cmp byte [0x3f090078], 0
jne 0x3f00e908
push 0x3f090178
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp byte [0x3f090078], 0
jne 0x3f00e8fd
lea eax, [ebp - 4]
mov dword [ebp - 4], 0x100
push eax
lea eax, [ebp - 0x204]
push eax
push 3
call dword [sym.imp.KERNEL32.dll_GetComputerNameExW]
test eax, eax
je 0x3f00e8ec
push 0
push 0
push 0x100
push 0x3f090078
push 0xffffffffffffffff
lea eax, [ebp - 0x204]
push eax
push 0
push 0xfde9
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
test eax, eax
jne 0x3f00e8fd
push 0x3f090178
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
xor al, al
mov esp, ebp
pop ebp
ret
push 0x3f090178
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
push dword [ebp + 0xc]
push 0x3f090078
push dword [ebp + 8]
call fcn.3f012ef0
add esp, 0xc
mov al, 1
mov esp, ebp
pop ebp
ret
push 0x3f090190
call fcn.3f01a5dc
add esp, 4
cmp dword [0x3f090190], 0xffffffff
jne 0x3f00e889
mov ecx, 0x3f090178
call sym.tier0_s.dll_public:_void___thiscall_CThreadMutex::constructor_void_
push 0x3f035e00
call fcn.3f01aa47
push 0x3f090190
call fcn.3f01a592
add esp, 8
jmp 0x3f00e889

Function at 0x3f00e970
Capabilities:
Get memory capacity

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40
push 0x40
lea eax, [ebp - 0x40]
push 0
push eax
call fcn.3f01b7f0
add esp, 0xc
mov dword [ebp - 0x40], 0x40
lea eax, [ebp - 0x40]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalMemoryStatusEx]
test eax, eax
je 0x3f00e9ab
mov ecx, dword [ebp - 0x30]
mov eax, dword [ebp - 0x2c]
shrd ecx, eax, 0x14
mov eax, ecx
mov esp, ebp
pop ebp
ret
xor eax, eax
mov esp, ebp
pop ebp
ret

Function at 0x3f00e9d0
Capabilities:
Get memory capacity

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40
push 0x40
lea eax, [ebp - 0x40]
push 0
push eax
call fcn.3f01b7f0
add esp, 0xc
mov dword [ebp - 0x40], 0x40
lea eax, [ebp - 0x40]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalMemoryStatusEx]
test eax, eax
je 0x3f00ea0b
mov ecx, dword [ebp - 0x38]
mov eax, dword [ebp - 0x34]
shrd ecx, eax, 0x14
mov eax, ecx
mov esp, ebp
pop ebp
ret
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x3f00ea20
Capabilities:
Get hostname

Disassembly:
push ebp
mov ebp, esp
mov eax, dword fs:[0x2c]
sub esp, 0x84
mov ecx, dword [0x3f0924ac]
mov ecx, dword [eax + ecx*4]
mov eax, dword [0x3f0902b0]
cmp eax, dword [ecx + 0x408]
jg 0x3f00ead8
cmp byte [0x3f090198], 0
jne 0x3f00eacf
push 0x3f090298
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp byte [0x3f090198], 0
jne 0x3f00eac4
lea eax, [ebp - 4]
mov dword [ebp - 4], 0x40
push eax
lea eax, [ebp - 0x84]
push eax
push 5
call dword [sym.imp.KERNEL32.dll_GetComputerNameExW]
test eax, eax
je 0x3f00eaac
push 0
push 0
push 0x100
push 0x3f090198
push 0xffffffffffffffff
lea eax, [ebp - 0x84]
push eax
push 0
push 0xfde9
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
test eax, eax
jne 0x3f00eac4
push esi
push edi
mov ecx, 7
mov esi, str._unable_to_get_local_hostname_
mov edi, 0x3f090198
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
pop edi
pop esi
push 0x3f090298
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov eax, 0x3f090198
mov esp, ebp
pop ebp
ret
push 0x3f0902b0
call fcn.3f01a5dc
add esp, 4
cmp dword [0x3f0902b0], 0xffffffff
jne 0x3f00ea49
mov ecx, 0x3f090298
call sym.tier0_s.dll_public:_void___thiscall_CThreadMutex::constructor_void_
push 0x3f035e10
call fcn.3f01aa47
push 0x3f0902b0
call fcn.3f01a592
add esp, 8
jmp 0x3f00ea49