joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4723b0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
push 0
push dword [ebp + 0xc]
lea ecx, [ebp - 0x14]
mov dword [ebp - 0x14], vtable.CPathString.0
mov dword [ebp - 0xc], 0
call fcn.004713c0
push dword [ebp - 0x10]
lea ecx, [ebp - 4]
mov dword [ebp - 4], 0
call fcn.0046ad50
push dword [ebp - 4]
call fcn.00469490
mov eax, dword [ebp - 4]
mov ecx, esp
mov dword [ecx], eax
call fcn.00470c40
mov ebx, dword [sym.imp.KERNEL32.dll_GetLastError]
add esp, 4
xor esi, esi
push 0
push 0x80
push 2
push 0
push 0
push 0x40000000
lea ecx, [ebp - 0x14]
call fcn.004711f0
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
cmp edi, 0xffffffff
jne 0x472464
call ebx
cmp eax, 0x20
jne 0x472460
push 0xa
call fcn.004817e0
inc esi
add esp, 4
cmp esi, 0xa
jl 0x472405
push str.INVALID_HANDLE_VALUE:_ERROR_SHARING_VIOLATION
push 0x8b0
push str.c:_buildslave_steam_rel_client_win32_build_src_tier1_fileio.cpp
call fcn.004767e0
add esp, 0xc
test al, al
jne 0x472460
int3
xor bl, bl
jmp 0x47249e
mov esi, dword [ebp + 8]
lea eax, [ebp - 8]
push 0
push eax
mov dword [ebp - 8], 0
push dword [esi + 0x14]
push dword [esi + 4]
push edi
call dword [sym.imp.KERNEL32.dll_WriteFile]
test byte [ebp + 0x10], 1
je 0x47248e
push edi
call dword [sym.imp.KERNEL32.dll_FlushFileBuffers]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [esi + 0x14]
cmp eax, dword [ebp - 8]
sete bl
call fcn.0047f350
push 0
push dword [ebp - 4]
mov ecx, eax
mov edx, dword [eax]
call dword [edx + 0x1c]
mov eax, dword [ebp - 0xc]
test eax, eax
je 0x4724bf
push eax
call fcn.0056acf4
add esp, 4
mov eax, dword [ebp - 0x10]
test eax, eax
je 0x4724cf
push eax
call fcn.0056acf4
add esp, 4
pop edi
pop esi
mov al, bl
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x472750
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push 0
push dword [ebp + 8]
lea ecx, [ebp - 0xc]
mov dword [ebp - 0xc], vtable.CPathString.0
mov dword [ebp - 4], 0
call fcn.004713c0
lea ecx, [ebp - 0xc]
call fcn.004711f0
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
mov eax, dword [ebp - 4]
setne bl
test eax, eax
je 0x472796
push eax
call fcn.0056acf4
add esp, 4
mov ecx, dword [ebp - 8]
test ecx, ecx
je 0x4727a6
push ecx
call fcn.0056acf4
add esp, 4
mov al, bl
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x475ab0
Capabilities:
Encode data using xor
Hash data using murmur3

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 8]
mov edx, dword [ebp + 0x10]
push ebx
push esi
mov esi, dword [ebp + 0xc]
mov ecx, esi
push edi
movzx edi, byte [ebp + 0x14]
shr ecx, 2
dec edi
mov dword [ebp - 4], ecx
or edi, 0xdfdfdfdf
lea ebx, [eax + ecx*4]
neg ecx
mov dword [ebp + 0x14], ebx
je 0x475b6e
test bl, 3
jne 0x475b19
jmp 0x475af0
mov eax, dword [ebx + ecx*4]
and eax, edi
imul eax, eax, 0xcc9e2d51
rol eax, 0xf
imul eax, eax, 0x1b873593
xor edx, eax
rol edx, 0xd
add edx, 0xfaddaf14
lea edx, [edx + edx*4]
add ecx, 1
jne 0x475af0
jmp 0x475b6e
lea esi, [ebx + 2]
mov ebx, dword [ebp - 4]
lea esi, [esi + ecx*4]
movzx ecx, byte [esi + 1]
lea esi, [esi + 4]
movzx eax, byte [esi - 4]
shl ecx, 8
or ecx, eax
movzx eax, byte [esi - 5]
shl ecx, 8
or ecx, eax
movzx eax, byte [esi - 6]
shl ecx, 8
or ecx, eax
and ecx, edi
imul eax, ecx, 0xcc9e2d51
rol eax, 0xf
imul eax, eax, 0x1b873593
xor edx, eax
rol edx, 0xd
add edx, 0xfaddaf14
lea edx, [edx + edx*4]
sub ebx, 1
jne 0x475b22
mov ebx, dword [ebp + 0x14]
mov esi, dword [ebp + 0xc]
mov eax, esi
xor ecx, ecx
and eax, 3
sub eax, 1
je 0x475b94
sub eax, 1
je 0x475b8b
sub eax, 1
jne 0x475bac
movzx ecx, byte [ebx + 2]
shl ecx, 0x10
movzx eax, byte [ebx + 1]
shl eax, 8
xor ecx, eax
movzx eax, byte [ebx]
xor eax, ecx
and eax, edi
imul eax, eax, 0xcc9e2d51
rol eax, 0xf
imul eax, eax, 0x1b873593
xor edx, eax
xor edx, esi
mov eax, edx
shr eax, 0x10
xor eax, edx
imul ecx, eax, 0x85ebca6b
pop edi
pop esi
pop ebx
mov eax, ecx
shr eax, 0xd
xor eax, ecx
imul ecx, eax, 0xc2b2ae35
mov eax, ecx
shr eax, 0x10
xor eax, ecx
mov esp, ebp
pop ebp
ret
Function at 0x4761e0
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
cmp dword [0x65ea68], 0
jne 0x47630c
push ebx
lea eax, [ebp - 4]
mov dword [ebp - 4], 0
push eax
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
push eax
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
mov ebx, eax
mov dword [ebp - 0x18], ebx
test ebx, ebx
je 0x47630b
mov ecx, dword [ebp - 4]
push esi
xor esi, esi
push edi
lea edi, [ecx*4 + 8]
test ecx, ecx
jle 0x47625c
jmp 0x476230
push 0
push 0
push 0
push 0
push 0xffffffffffffffff
push dword [ebx + esi*4]
push 0
push 0xfde9
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
test eax, eax
mov ecx, 1
cmovg ecx, eax
inc esi
add edi, ecx
cmp esi, dword [ebp - 4]
jl 0x476230
lea eax, [edi + 1]
push eax
push 0x40
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov ecx, dword [ebp - 4]
mov dword [ebp - 0x1c], eax
mov dword [ebp - 8], 0
mov dword [eax], ecx
add eax, 4
mov ecx, dword [ebp - 4]
mov dword [ebp - 0x10], eax
lea esi, [ecx + 1]
lea esi, [eax + esi*4]
test ecx, ecx
jle 0x4762e9
mov edx, ebx
mov dword [ebp - 0xc], eax
sub edx, eax
lea ecx, [eax + edi]
mov dword [ebp - 0x14], edx
mov ebx, eax
lea esp, [esp]
cmp esi, ecx
jae 0x4762e6
push 0
push 0
sub eax, esi
add eax, edi
push eax
push esi
push 0xffffffffffffffff
push dword [edx + ebx]
push 0
push 0xfde9
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov edx, dword [ebp - 8]
test eax, eax
mov ecx, 1
mov dword [ebx], esi
cmovg ecx, eax
mov eax, dword [ebp - 0x10]
inc edx
add esi, ecx
add ebx, 4
mov dword [ebp - 8], edx
cmp edx, dword [ebp - 4]
mov edx, dword [ebp - 0x14]
lea ecx, [eax + edi]
jl 0x4762a0
mov ebx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_LocalFree]
push ebx
call esi
mov edx, dword [ebp - 0x1c]
mov edi, 0x65ea68
mov ecx, edx
xor eax, eax
lock cmpxchg dword [edi], ecx
test eax, eax
je 0x476309
push edx
call esi
pop edi
pop esi
pop ebx
mov eax, dword [0x65ea68]
mov ecx, dword [eax]
mov eax, dword [ebp + 8]
mov dword [eax], ecx
mov eax, dword [0x65ea68]
add eax, 4
mov esp, ebp
pop ebp
ret

Function at 0x476370
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1000
call fcn.0056acc0
lea eax, [ebp + 0xc]
push eax
push 0
push dword [ebp + 8]
lea eax, [ebp - 0x1000]
push 0x1000
push eax
call fcn.00459f60
mov ecx, dword [eax]
push dword [eax + 4]
or ecx, 1
push ecx
call fcn.0057895e
or ecx, 0xffffffff
add esp, 0x1c
test eax, eax
cmovs eax, ecx
test eax, eax
jg 0x4763d0
push str.len___0
push 0x2be
push str.c:_buildslave_steam_rel_client_win32_build_src_tier0platform.cpp
call fcn.004767e0
add esp, 0xc
test al, al
jne 0x4763d0
int3
lea eax, [ebp - 0x1000]
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov esp, ebp
pop ebp
ret
Function at 0x476400
Capabilities:
Generate random numbers via rtlgenrandom

Disassembly:
push ebp
mov ebp, esp
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x590451
push eax
mov dword fs:[0], esp
mov eax, dword fs:[0x2c]
mov ecx, dword [0x6aac10]
mov ecx, dword [eax + ecx*4]
mov eax, dword [0x65ea84]
cmp eax, dword [ecx + 4]
jg 0x476473
mov eax, dword [0x65ea80]
test eax, eax
je 0x476449
push dword [ebp + 0xc]
push dword [ebp + 8]
call eax
cmp al, 1
je 0x476465
push str.bRtlGenRandomOK
push 0x8000035b
push str.c:_buildslave_steam_rel_client_win32_build_src_tier0platform.cpp
call fcn.004767e0
add esp, 0xc
test al, al
jne 0x476465
int3
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
push 0x65ea84
call fcn.0056b07e
add esp, 4
cmp dword [0x65ea84], 0xffffffff
jne 0x476434
mov dword [ebp - 4], 0
push str.SystemFunction036
push str.advapi32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x65ea80], eax
mov dword [ebp - 4], 0xffffffff
push 0x65ea84
call fcn.0056b034
add esp, 4
jmp 0x476434

Function at 0x4767e0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
pop ebp
jmp fcn.00476b90
Function at 0x478e70
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
movzx eax, byte [esi]
xor eax, 0x811c9dc5
imul ecx, eax, 0x1000193
movzx eax, byte [esi + 1]
xor ecx, eax
movzx eax, byte [esi + 2]
imul ecx, ecx, 0x1000193
xor ecx, eax
movzx eax, byte [esi + 3]
imul ecx, ecx, 0x1000193
xor ecx, eax
movzx eax, byte [esi + 4]
xor eax, 0x811c9dc5
imul edx, ecx, 0x1000193
imul ecx, eax, 0x1000193
movzx eax, byte [esi + 5]
xor ecx, eax
movzx eax, byte [esi + 6]
imul ecx, ecx, 0x1000193
xor ecx, eax
movzx eax, byte [esi + 7]
imul ecx, ecx, 0x1000193
pop esi
xor ecx, eax
imul eax, ecx, 0x1000193
add eax, eax
xor eax, edx
pop ebp
ret 4
Function at 0x479df0
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5908cd
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x1c
push ebx
mov ebx, dword [ebp + 0xc]
push esi
push edi
mov edi, ecx
movzx eax, byte [ebx]
xor eax, 0x811c9dc5
imul edx, eax, 0x1000193
movzx eax, byte [ebx + 1]
xor edx, eax
movzx eax, byte [ebx + 2]
imul edx, edx, 0x1000193
xor edx, eax
movzx eax, byte [ebx + 3]
imul ecx, edx, 0x1000193
xor ecx, eax
imul eax, ecx, 0x1000193
mov ecx, edi
push eax
mov dword [ebp + 0xc], eax
lea eax, [ebp - 0x28]
push ebx
push eax
call fcn.004792b0
mov ecx, dword [ebp - 0x24]
test ecx, ecx
je 0x479e78
mov eax, dword [ebp + 8]
mov dword [eax], ecx
mov byte [eax + 4], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
cmp dword [edi + 8], 0x9249249
je 0x479f9e
lea eax, [edi + 4]
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x20], eax
mov dword [ebp - 4], 0
push 0x1c
mov dword [ebp - 0x1c], 0
call fcn.0056ac25
mov ecx, dword [ebx]
mov esi, eax
add esp, 4
mov dword [ebp - 0x18], esi
mov dword [ebp - 0x1c], esi
mov dword [esi + 8], ecx
xor ecx, ecx
mov dword [esi + 0xc], ecx
mov dword [esi + 0x10], ecx
mov dword [esi + 0x14], ecx
mov dword [esi + 0x18], ecx
mov dword [ebp - 4], 1
fld dword [edi]
mov ecx, dword [edi + 8]
fstp dword [ebp - 0x10]
fld dword [ebp - 0x10]
add ecx, 1
mov dword [ebp - 0x10], ecx
fild dword [ebp - 0x10]
jns 0x479eeb
fadd dword [0x5b22a8]
fstp dword [ebp - 0x10]
fld dword [ebp - 0x10]
mov eax, dword [edi + 0x1c]
fild dword [edi + 0x1c]
test eax, eax
jns 0x479f01
fadd dword [0x5b22a8]
fstp dword [ebp - 0x10]
fdiv dword [ebp - 0x10]
fcompi st(1)
fstp st(0)
jbe 0x479f33
push ecx
mov ecx, edi
call fcn.0047eae0
push eax
mov ecx, edi
call fcn.0047eb70
push dword [ebp + 0xc]
lea eax, [esi + 8]
mov ecx, edi
push eax
lea eax, [ebp - 0x28]
push eax
call fcn.004792b0
mov edx, dword [eax]
jmp 0x479f36
mov edx, dword [ebp - 0x28]
mov ebx, dword [edx + 4]
inc dword [edi + 8]
mov dword [esi], edx
mov dword [esi + 4], ebx
mov dword [ebx], esi
mov dword [edx + 4], esi
mov eax, dword [edi + 0x18]
and eax, dword [ebp + 0xc]
mov ecx, dword [edi + 0xc]
mov esi, dword [ebp - 0x14]
mov dword [ebp - 0x1c], 0
mov edi, dword [ecx + eax*8]
cmp edi, dword [esi]
mov esi, dword [ebp - 0x18]
jne 0x479f68
mov dword [ecx + eax*8], esi
jmp 0x479f77
cmp edi, edx
jne 0x479f71
mov dword [ecx + eax*8], esi
jmp 0x479f7b
cmp dword [ecx + eax*8 + 4], ebx
jne 0x479f7b
mov dword [ecx + eax*8 + 4], esi
mov eax, dword [ebp + 8]
mov dword [eax], esi
mov byte [eax + 4], 1
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret 8
push str.unordered_map_set_too_long
call fcn.0056ab88
int3
Function at 0x47d9b0
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push edi
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov edx, eax
mov edi, 0x660f70
cmp edx, dword [0x660f70]
je 0x47d9e4
mov ecx, edx
xor eax, eax
lock cmpxchg dword [edi], ecx
test eax, eax
je 0x47d9e4
pause
push edx
mov ecx, edi
call fcn.00480cf0
jmp 0x47d9eb
lock inc dword [0x660f74]
mov edx, dword [ebp + 8]
movzx eax, dl
xor eax, 0x811c9dc5
imul ecx, eax, 0x1000193
movzx eax, dh
push esi
xor ecx, eax
movzx eax, byte [ebp + 0xa]
imul ecx, ecx, 0x1000193
xor ecx, eax
movzx eax, byte [ebp + 0xb]
imul ecx, ecx, 0x1000193
xor ecx, eax
imul eax, ecx, 0x1000193
mov ecx, 0x660f50
push eax
lea eax, [ebp + 8]
push eax
lea eax, [ebp - 8]
push eax
call fcn.004792b0
mov esi, dword [0x660f54]
mov ecx, dword [eax + 4]
test ecx, ecx
mov eax, esi
cmovne eax, ecx
cmp eax, esi
je 0x47dad0
movzx ecx, byte [eax + 8]
xor ecx, 0x811c9dc5
imul edx, ecx, 0x1000193
movzx ecx, byte [eax + 9]
xor edx, ecx
movzx ecx, byte [eax + 0xa]
imul edx, edx, 0x1000193
xor edx, ecx
movzx ecx, byte [eax + 0xb]
imul edx, edx, 0x1000193
xor edx, ecx
imul ecx, edx, 0x1000193
mov edx, dword [0x660f68]
and edx, ecx
mov ecx, dword [0x660f5c]
lea edx, [ecx + edx*8]
mov ecx, dword [edx]
cmp dword [edx + 4], eax
jne 0x47daaa
cmp ecx, eax
jne 0x47daa2
mov dword [edx], esi
mov dword [edx + 4], esi
jmp 0x47dab2
mov esi, dword [eax + 4]
mov dword [edx + 4], esi
jmp 0x47dab2
cmp ecx, eax
jne 0x47dab2
mov ecx, dword [eax]
mov dword [edx], ecx
mov edx, dword [eax]
dec dword [0x660f58]
mov ecx, dword [eax + 4]
push 0x1c
push eax
mov dword [ecx], edx
mov ecx, dword [eax + 4]
mov dword [edx + 4], ecx
call fcn.0056ac55
add esp, 8
lock dec dword [0x660f74]
cmp dword [0x660f74], 0
pop esi
jne 0x47dae5
xor eax, eax
xchg dword [edi], eax
pop edi
mov esp, ebp
pop ebp
ret

Function at 0x47e0d0
Capabilities:
Print debug messages
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x100
push esi
mov esi, dword [ebp + 8]
mov dword [ecx + 0x592c], esi
call fcn.00477190
test al, al
je 0x47e0ed
int3
push 0
push esi
push str._OUT_OF_MEMORY__attempted_allocation_size:__llu__n
lea eax, [ebp - 0x100]
push 0x100
push eax
call fcn.00463b80
add esp, 0x14
mov byte [ebp - 1], 0
lea eax, [ebp - 0x100]
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
call fcn.00477190
pop esi
test al, al
jne 0x47e151
lea eax, [ebp - 0x100]
push eax
push 0x80000bd2
push str.c:_buildslave_steam_rel_client_win32_build_src_tier0memstd.cpp
call fcn.004767e0
add esp, 0xc
test al, al
jne 0x47e142
int3
push 1
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov esp, ebp
pop ebp
ret 4
Function at 0x47eb70
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x590d7d
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xc
push ebx
mov ebx, ecx
mov eax, 0x1fffffff
bsr ecx, eax
push esi
push edi
mov edi, 1
mov dword [ebp - 0x14], ebx
mov eax, edi
shl eax, cl
mov ecx, dword [ebp + 8]
cmp ecx, eax
ja 0x47ecff
lea eax, [ecx - 1]
mov esi, dword [ebx + 4]
or eax, edi
bsr ecx, eax
push esi
lea ecx, [ecx + 1]
shl edi, cl
lea ecx, [ebx + 0xc]
lea eax, [edi + edi]
push eax
call fcn.0047e970
lea eax, [edi - 1]
mov dword [ebx + 0x1c], edi
mov dword [ebx + 0x18], eax
mov dword [ebp - 0x18], ebx
mov dword [ebp - 4], 0
mov ecx, dword [ebx + 4]
mov ecx, dword [ecx]
mov edx, ecx
cmp ecx, esi
je 0x47ecbc
mov edi, edi
movzx eax, byte [ecx + 8]
xor eax, 0x811c9dc5
mov edx, dword [edx]
imul edi, eax, 0x1000193
movzx eax, byte [ecx + 9]
xor edi, eax
movzx eax, byte [ecx + 0xa]
imul edi, edi, 0x1000193
xor edi, eax
movzx eax, byte [ecx + 0xb]
imul edi, edi, 0x1000193
xor edi, eax
imul eax, edi, 0x1000193
mov edi, dword [ebx + 0x18]
and edi, eax
mov eax, dword [ebx + 0xc]
mov ebx, dword [eax + edi*8]
lea eax, [eax + edi*8]
mov dword [ebp + 8], eax
cmp ebx, esi
jne 0x47ec41
mov dword [eax], ecx
mov dword [eax + 4], ecx
jmp 0x47ecaf
mov eax, dword [eax + 4]
mov edi, dword [ecx + 8]
cmp edi, dword [eax + 8]
jne 0x47ec78
mov eax, dword [eax]
cmp eax, ecx
je 0x47ec70
mov ebx, dword [ecx + 4]
mov dword [ebp - 0x10], ebx
mov dword [ebx], edx
mov ebx, dword [edx + 4]
mov dword [ebx], eax
mov edi, dword [eax + 4]
mov dword [edi], ecx
mov dword [eax + 4], ebx
mov eax, dword [ebp - 0x10]
mov dword [edx + 4], eax
mov dword [ecx + 4], edi
mov eax, dword [ebp + 8]
mov dword [eax + 4], ecx
jmp 0x47ecaf
cmp ebx, eax
je 0x47ec8c
lea esp, [esp]
mov eax, dword [eax + 4]
cmp edi, dword [eax + 8]
je 0x47ecdd
cmp ebx, eax
jne 0x47ec80
mov ebx, dword [ecx + 4]
mov dword [ebp - 0x10], ebx
mov dword [ebx], edx
mov ebx, dword [edx + 4]
mov dword [ebx], eax
mov edi, dword [eax + 4]
mov dword [edi], ecx
mov dword [eax + 4], ebx
mov eax, dword [ebp - 0x10]
mov dword [edx + 4], eax
mov eax, dword [ebp + 8]
mov dword [ecx + 4], edi
mov dword [eax], ecx
mov ebx, dword [ebp - 0x14]
mov ecx, edx
cmp edx, esi
jne 0x47ebf0
mov dword [ebp - 0x18], 0
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 4
mov ebx, dword [ecx + 4]
mov eax, dword [eax]
mov dword [ebp + 8], ebx
mov dword [ebx], edx
mov ebx, dword [edx + 4]
mov dword [ebx], eax
mov edi, dword [eax + 4]
mov dword [edi], ecx
mov dword [eax + 4], ebx
mov eax, dword [ebp + 8]
mov dword [edx + 4], eax
mov dword [ecx + 4], edi
jmp 0x47ecaf
push str.invalid_hash_bucket_count
call fcn.0056ab88
int3
Function at 0x47ef80
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x590dcd
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x28
mov edx, dword [ebp + 8]
push ebx
push esi
mov esi, dword [ebp + 0xc]
mov ebx, ecx
mov dword [ebp - 0x10], ebx
cmp edx, esi
je 0x47f12b
mov ecx, dword [ebx + 4]
lea eax, [ebx + 4]
mov dword [ebp - 0x1c], ecx
mov ecx, dword [ebx + 0xc]
mov dword [ebp - 0x34], eax
mov eax, dword [edx + 4]
push edi
mov edi, edx
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x2c], edi
mov dword [ebp - 4], 0
mov eax, dword [edx + 4]
mov dword [ebp - 0x24], eax
movzx eax, byte [edx + 8]
xor eax, 0x811c9dc5
imul ecx, eax, 0x1000193
movzx eax, byte [edx + 9]
xor ecx, eax
movzx eax, byte [edx + 0xa]
imul ecx, ecx, 0x1000193
xor ecx, eax
movzx eax, byte [edx + 0xb]
imul ecx, ecx, 0x1000193
xor ecx, eax
mov eax, dword [ebx + 0x18]
imul ecx, ecx, 0x1000193
and eax, ecx
mov ecx, dword [ebp - 0x18]
lea eax, [ecx + eax*8]
mov ecx, dword [eax]
mov dword [ebp + 0xc], eax
mov eax, dword [eax + 4]
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x20], eax
lea ebx, [ebx]
cmp edi, eax
mov eax, edi
mov edi, dword [edi]
push 0x1c
push eax
sete bl
mov dword [ebp - 0x2c], edi
call fcn.0056ac55
mov edx, dword [ebp - 0x10]
add esp, 8
dec dword [edx + 8]
test bl, bl
jne 0x47f06e
mov eax, dword [ebp - 0x20]
cmp edi, esi
jne 0x47f030
mov eax, dword [ebp - 0x14]
cmp eax, dword [ebp + 8]
jne 0x47f11b
mov ecx, dword [ebp + 0xc]
mov dword [ecx], edi
jmp 0x47f11b
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp + 0xc]
cmp eax, dword [ebp + 8]
jne 0x47f080
mov eax, dword [ebp - 0x1c]
mov dword [ecx], eax
jmp 0x47f083
mov eax, dword [ebp - 0x24]
mov dword [ecx + 4], eax
cmp edi, esi
je 0x47f11b
mov edi, edi
movzx eax, byte [edi + 8]
xor eax, 0x811c9dc5
imul ecx, eax, 0x1000193
movzx eax, byte [edi + 9]
xor ecx, eax
movzx eax, byte [edi + 0xa]
imul ecx, ecx, 0x1000193
xor ecx, eax
movzx eax, byte [edi + 0xb]
imul ecx, ecx, 0x1000193
xor ecx, eax
imul eax, ecx, 0x1000193
mov ecx, dword [ebp - 0x18]
and eax, dword [edx + 0x18]
lea eax, [ecx + eax*8]
mov dword [ebp + 8], eax
mov eax, dword [eax + 4]
mov dword [ebp + 0xc], eax
cmp edi, eax
mov eax, edi
mov edi, dword [edi]
push 0x1c
push eax
sete bl
mov dword [ebp - 0x2c], edi
call fcn.0056ac55
mov eax, dword [ebp - 0x10]
add esp, 8
dec dword [eax + 8]
test bl, bl
jne 0x47f0ff
cmp edi, esi
je 0x47f116
mov eax, dword [ebp + 0xc]
jmp 0x47f0d5
mov eax, dword [ebp + 8]
mov edx, dword [ebp - 0x1c]
mov dword [eax], edx
mov dword [eax + 4], edx
cmp edi, esi
je 0x47f11b
mov edx, dword [ebp - 0x10]
jmp 0x47f090
mov eax, dword [ebp + 8]
mov dword [eax], edi
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x28]
mov dword [eax], edi
mov dword [edi + 4], eax
pop edi
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 8
Function at 0x47f350
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x590e4a
push eax
mov dword fs:[0], esp
sub esp, 0x20c
mov eax, dword fs:[0x2c]
mov ecx, dword [0x6aac10]
mov ecx, dword [eax + ecx*4]
mov eax, dword [0x666918]
cmp eax, dword [ecx + 4]
jg 0x47f39d
mov ecx, dword [ebp - 0xc]
mov eax, 0x660f90
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
push 0x666918
call fcn.0056b07e
add esp, 4
cmp dword [0x666918], 0xffffffff
jne 0x47f38a
mov dword [ebp - 4], 0
push 0x47a400
push 0x47a1e0
push 0x26
push 0x38
mov dword [0x660f90], 0x5b7cb4
push 0x661398
mov dword [0x660f90], 0x5b7db0
mov dword [ebp - 0x10], 0x660f98
call fcn.0056b732
mov byte [ebp - 4], 1
mov dword [0x661be8], 0x6a6980
mov byte [ebp - 4], 2
push 0x47a400
push 0x47a1e0
push 0x3a
push 0x38
push 0x665bf0
mov dword [ebp - 0x14], 0x661bf0
call fcn.0056b732
mov byte [ebp - 4], 3
mov dword [0x6668a0], 0x666970
mov byte [ebp - 4], 4
mov ecx, 0x6668c8
mov dword [0x6668a8], 4
mov dword [0x6668ac], 0
mov dword [0x6668b0], 0
mov dword [0x6668b8], 0x47b690
mov dword [0x6668bc], 0
mov dword [0x6668c0], 0
mov dword [ebp - 0x18], 0x6668c0
mov dword [0x6668c4], 0
call fcn.004808a0
mov byte [ebp - 4], 6
mov byte [0x6668e0], 0
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
test eax, eax
je 0x47f4e4
push 0x200
push eax
lea eax, [ebp - 0x218]
push eax
call fcn.00482380
lea eax, [ebp - 0x218]
push eax
call fcn.0057c70c
lea eax, [ebp - 0x218]
push str._RESERVELOWMEM
push eax
call fcn.0056d1b0
add esp, 0x18
push 1
push 0x2000
push 1
push 0xffeeffee
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
jmp 0x47f4e4
push 8
push 8
mov dword [0x6668e4], 0
mov dword [0x6668e8], 0
mov dword [0x6668ec], 0
mov dword [0x6668f0], 0
mov dword [0x6668f4], 0
mov dword [0x6668f8], 0
mov dword [0x6668fc], 0
mov dword [0x666900], 0
mov dword [0x666904], 0
mov dword [0x66690c], 0
mov dword [0x666910], 0
call fcn.0057c4fa
add esp, 8
mov dword [0x6668b4], eax
test al, 7
je 0x47f585
push str.__size_t__m_nLogicalBytesAllocated____8___0
push 0x7e3
push str.c:_buildslave_steam_rel_client_win32_build_src_tier0memstd.cpp
call fcn.004767e0
add esp, 0xc
test al, al
jne 0x47f585
int3
mov eax, dword [0x6668b4]
mov dword [eax], 0
mov dword [eax + 4], 0
mov byte [ebp - 4], 0
push 0x5917a0
call fcn.0056af35
mov dword [ebp - 4], 0xffffffff
push 0x666918
call fcn.0056b034
add esp, 8
jmp 0x47f38a