joyce8/EMBER2024-capa huggingface dataset:
Function at 0x469390
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
mov dword [ebp - 0xc], 0
mov ebx, dword [ebp + 8]
push esi
push edi
mov edi, ecx
mov dword [edi + 4], 0x54e7c8
mov dword [edi], 0x54e7a4
mov dword [edi + 4], 0x54e7ac
mov dword [edi + 8], ebx
mov dword [edi + 0xc], 0
mov dword [edi + 0x10], 0
mov dword [edi + 0x14], 0
mov dword [edi + 0x18], 0
mov dword [edi + 0x1c], 0
mov eax, dword [ebx + 0x218]
mov dword [edi + 0x20], eax
call fcn.00440690
mov esi, dword [sym.imp.KERNEL32.dll_TlsGetValue]
push dword [eax]
call esi
mov dword [ebp - 0xc], eax
mov dword [ebp + 8], edi
mov edx, dword [eax + 0x5c]
lea ecx, [eax + 0x58]
mov eax, dword [ecx]
cmp eax, edx
je 0x46941f
lea esp, [esp]
cmp dword [eax], edi
je 0x46941b
add eax, 4
cmp eax, edx
jne 0x469410
cmp eax, edx
jne 0x469428
lea eax, [ebp + 8]
push eax
call fcn.00442780
call fcn.004604f0
push dword [eax]
call esi
mov esi, dword [eax]
mov dword [ebp - 8], esi
test esi, esi
je 0x469446
mov ecx, 1
lea eax, [esi + 4]
lock xadd dword [eax], ecx
mov eax, dword [0x56372c]
test eax, eax
jne 0x469454
call fcn.00498660
lea ecx, [ebp - 8]
push ecx
lea ecx, [edi + 4]
push ecx
mov ecx, eax
call fcn.00497160
test esi, esi
je 0x469489
lea ecx, [esi + 4]
or eax, 0xffffffff
lock xadd dword [ecx], eax
dec eax
setne al
test al, al
jne 0x469489
test ecx, ecx
je 0x469482
add ecx, 0xfffffffc
jmp 0x469484
xor ecx, ecx
mov eax, dword [ecx]
call dword [eax + 0xc]
lea esi, [ebx + 4]
push esi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
movzx eax, byte [0x563584]
lea ecx, [ebx + 0x1dc]
push eax
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x14]
push eax
call fcn.00475c90
push esi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x469500
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x1c
push ebx
mov ebx, ecx
mov dword [esp + 8], 0
push esi
lea esi, [ebx + 4]
mov dword [esi], 0x54e7ac
push edi
mov dword [ebx], 0x54e7a4
call fcn.00440690
mov edi, dword [sym.imp.KERNEL32.dll_TlsGetValue]
push dword [eax]
call edi
push ebx
lea ecx, [eax + 0x54]
call fcn.00441ab0
mov eax, dword [0x56372c]
test eax, eax
jne 0x46954b
call fcn.00498660
push esi
mov ecx, eax
call fcn.00497220
mov esi, dword [ebx + 0x14]
test esi, esi
je 0x4695be
mov ecx, dword [ebx + 0x18]
mov edx, dword [ebx + 0x1c]
cmp ecx, 0xffffffff
jne 0x469577
cmp edx, 0x7fffffff
jne 0x469577
movsd xmm0, qword [0x55f4c8]
jmp 0x469584
call fcn.004de21f
divsd xmm0, qword [0x552050]
movd xmm1, esi
cvtdq2pd xmm1, xmm1
divsd xmm0, xmm1
movsd qword [esp + 0x10], xmm0
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov esi, eax
mov ecx, ebx
lea eax, [esp + 0x10]
push eax
sub esp, 0xc
push 0
call fcn.00469690
add esp, 4
mov edx, esi
mov ecx, eax
call fcn.004752a0
add esp, 0xc
mov esi, dword [ebx + 8]
add esi, 4
push esi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [ebx + 0xc], 0
je 0x4695fc
mov eax, dword [ebx + 8]
mov eax, dword [eax + 0x218]
cmp dword [ebx + 0x20], eax
jne 0x4695fc
mov eax, dword [ebx + 8]
mov ecx, dword [eax + 0x3c]
mov eax, dword [ebx + 0xc]
push ecx
mov edx, esp
mov dword [ebx + 0xc], 0
mov dword [edx], eax
mov eax, dword [ecx]
push dword [ebx + 0x10]
call dword [eax + 8]
call fcn.00440690
push dword [eax]
call edi
mov dword [esp + 0xc], eax
lea ecx, [esp + 0xc]
mov eax, dword [ebx + 8]
push ecx
add eax, 0x1dc
lea ecx, [esp + 0x24]
push ecx
mov ecx, eax
mov dword [esp + 0x18], eax
call fcn.00470350
mov edi, dword [esp + 0x20]
mov eax, edi
mov edx, dword [esp + 0x24]
cmp edi, edx
je 0x46963a
mov eax, dword [eax]
cmp eax, edx
jne 0x469634
mov ecx, dword [esp + 0x10]
lea eax, [esp + 0x1c]
push edx
push edi
push eax
call fcn.004702f0
push esi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov eax, dword [ebx + 8]
push 0
push dword [eax + 0x1d0]
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
test eax, eax
jne 0x46966b
call fcn.00461320
mov ecx, dword [ebx + 0xc]
test ecx, ecx
je 0x469678
push ecx
call fcn.00470b90
pop edi
pop esi
mov dword [ebx], method.ATL::CAcl::CAce.virtual_4
mov dword [ebx + 4], 0x54e7c8
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x46a350
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ecx
push esi
mov esi, ecx
push edi
mov edi, dword [sym.imp.KERNEL32.dll_TlsGetValue]
push dword [esi + 0x1d4]
call edi
test eax, eax
jne 0x46a3c6
call fcn.00440690
push dword [eax]
call edi
test eax, eax
je 0x46a3c6
push dword [esi + 0x1d0]
call edi
mov edx, eax
test edx, edx
je 0x46a396
mov ecx, dword [edx + 0x20]
cmp ecx, dword [esi + 0x218]
je 0x46a3c6
mov eax, dword [edx]
mov ecx, edx
push 1
call dword [eax + 4]
push 0x28
call fcn.004dbda6
add esp, 4
test eax, eax
je 0x46a3ae
push esi
mov ecx, eax
call fcn.00469390
jmp 0x46a3b0
xor eax, eax
push eax
push dword [esi + 0x1d0]
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
test eax, eax
jne 0x46a3c6
call fcn.00461320
pop edi
pop esi
pop ecx
ret
Function at 0x46ada0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4c
push ebx
mov ebx, ecx
mov dword [ebp - 8], 0
push esi
push edi
mov dword [ebp - 4], ebx
lea esi, [ebx + 4]
mov dword [ebp - 0x14], 0
push esi
mov dword [ebp - 0x10], 0
mov dword [ebp - 0xc], 0
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov edi, dword [ebp + 8]
push edi
call fcn.0046b0c0
mov ecx, dword [ebx + 0x154]
cmp dword [ebx + 0x34], 0
mov dword [ebp + 8], eax
je 0x46ae0f
push edi
lea ecx, [ebx + 0x160]
call fcn.00494600
mov ecx, ebx
call fcn.0046a570
push esi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
cmp byte [ebx + 0x44], 0
je 0x46ae25
push esi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
mov dword [ebx + 0x34], 1
cmp eax, ecx
je 0x46ae3d
mov ecx, ebx
mov dword [ebx + 0x154], eax
call fcn.0046c550
inc dword [ebx + 0x38]
lea ecx, [ebp - 0x4c]
push edi
call fcn.00493e70
push eax
lea ecx, [ebx + 0x160]
call fcn.004940f0
lea ecx, [ebp - 0x4c]
call fcn.00494000
mov ecx, ebx
call fcn.0046a570
mov ecx, ebx
call fcn.0046a620
test byte [ebp + 8], 4
je 0x46af6c
push 0x1c
call fcn.004dbda6
add esp, 4
test eax, eax
je 0x46ae8e
mov ecx, eax
call fcn.00493030
mov edi, eax
jmp 0x46ae90
xor edi, edi
mov ecx, dword [ebx + 0x158]
mov dword [ebx + 0x158], 0
test ecx, ecx
je 0x46aeab
mov eax, dword [ecx]
push 1
call dword [eax + 4]
sub esp, 8
mov dword [ebx + 0x158], edi
mov ecx, esp
call fcn.00475370
push str.bucket0
push 0x562e90
mov ecx, edi
call fcn.004932f0
mov edi, dword [ebx + 0x158]
sub esp, 8
mov ecx, esp
call fcn.00475370
push str.bucket1
push 0x562e94
mov ecx, edi
call fcn.004932f0
mov edi, dword [ebx + 0x158]
sub esp, 8
mov ecx, esp
call fcn.00475370
push str.bucket2
push 0x562e98
mov ecx, edi
call fcn.004932f0
mov edi, dword [ebx + 0x158]
push 0xc
call fcn.004dbda6
add esp, 4
mov dword [ebp + 8], eax
mov dword [eax], edi
lea edi, [ebx + 0x15c]
push 0
push 0
push eax
push 0x436a90
test edi, edi
mov dword [eax + 8], 1
push 0
setne cl
push 0
mov byte [eax + 4], cl
call dword [sym.imp.KERNEL32.dll_CreateThread]
test eax, eax
jne 0x46af5d
push dword [ebp + 8]
call fcn.004daf7e
add esp, 4
jmp 0x46af6c
test edi, edi
je 0x46af65
mov dword [edi], eax
jmp 0x46af6c
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea eax, [ebx + 0x48]
mov byte [ebx + 0x44], 1
push eax
lea ecx, [ebp - 0x14]
call fcn.0046e700
push esi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov eax, dword [ebp - 0x10]
xor edi, edi
sub eax, dword [ebp - 0x14]
sar eax, 2
test eax, eax
je 0x46afaa
mov ebx, dword [ebp - 0x14]
mov esi, eax
mov ecx, dword [ebx + edi*4]
mov eax, dword [ecx]
call dword [eax + 4]
inc edi
cmp edi, esi
jb 0x46af97
mov ebx, dword [ebp - 4]
lea esi, [ebx + 4]
push esi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
push esi
mov byte [ebx + 0x44], 0
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov eax, dword [ebp - 0x14]
test eax, eax
je 0x46afcc
push eax
call fcn.004daf7e
add esp, 4
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x46d470
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10c
mov eax, dword [0x55e0a0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
mov edi, ecx
mov dword [ebp - 0x58], eax
mov eax, dword [ebp + 0x10]
lea esi, [edi + 0x1d8]
push dword [esi]
mov dword [ebp - 0x54], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x50], eax
mov dword [ebp - 0x44], 0
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
jne 0x46d65c
push esi
push dword [esi]
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
test eax, eax
jne 0x46d4cc
call fcn.00461320
lea eax, [ebp - 0x40]
mov ecx, edi
push eax
call fcn.00468f00
test byte [ebx], 1
mov dword [ebp - 8], 0xf
mov dword [ebp - 0xc], 0
mov byte [ebp - 0x1c], 0
je 0x46d5fb
push dword [ebp - 0x50]
lea eax, [edi + 4]
mov byte [ebp - 0x48], 0
push dword [ebp - 0x54]
mov dword [ebp - 0x4c], eax
mov ecx, edi
lea eax, [ebp - 0x4c]
push eax
call fcn.0046dcc0
mov edx, eax
test edx, edx
je 0x46d537
mov ecx, dword [ebp - 0x40]
sub ecx, dword [edx]
mov eax, dword [ebp - 0x3c]
sbb eax, dword [edx + 4]
mov dword [edx + 0x14], eax
mov dword [edx + 0x10], ecx
mov ecx, dword [edx + 8]
mov eax, dword [edx + 0xc]
neg ecx
mov dword [edx + 0x18], ecx
adc eax, 0
neg eax
mov dword [edx + 0x1c], eax
mov eax, dword [edi + 0x154]
test al, 8
je 0x46d56d
push edx
lea eax, [ebp - 0x40]
mov ecx, edi
push eax
push 0x45
lea eax, [ebp - 0x34]
push eax
call fcn.0046cd20
push eax
lea ecx, [ebp - 0x1c]
call fcn.00419060
cmp dword [ebp - 0x20], 0x10
jb 0x46d56d
push dword [ebp - 0x34]
call fcn.004daf7e
add esp, 4
cmp byte [ebp - 0x48], 0
je 0x46d57c
push dword [ebp - 0x4c]
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
cmp dword [ebp - 0xc], 0
je 0x46d5fb
cmp dword [0x5624b8], 2
jg 0x46d5ea
push 1
push 2
lea ecx, [ebp - 0x100]
mov dword [ebp - 0x44], 2
mov dword [ebp - 0x108], 2
call fcn.00407dc0
mov dword [ebp - 0x64], str.d:work_codeliebaocodesliebao_46_src_import_base_trace_event_trace_log.cc
mov dword [ebp - 0x60], 0x5d4
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 0x5d4
push str.d:work_codeliebaocodesliebao_46_src_import_base_trace_event_trace_log.cc
lea ecx, [ebp - 0x108]
mov dword [ebp - 0x5c], eax
call fcn.00427900
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x100]
push eax
call fcn.00413230
add esp, 8
test byte [ebp - 0x44], 2
je 0x46d5fb
lea ecx, [ebp - 0x108]
call fcn.004276c0
test byte [ebx], 4
je 0x46d626
mov eax, dword [edi + 0x40]
test eax, eax
je 0x46d626
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push dword [ebp - 0x58]
push ebx
push 0x45
push dword [ebp - 0x3c]
push dword [ebp - 0x40]
call eax
add esp, 0x30
cmp dword [ebp - 8], 0x10
jb 0x46d637
push dword [ebp - 0x1c]
call fcn.004daf7e
add esp, 4
push 0
push dword [esi]
mov dword [ebp - 8], 0xf
mov dword [ebp - 0xc], 0
mov byte [ebp - 0x1c], 0
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
test eax, eax
jne 0x46d65c
call fcn.00461320
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004dbbe3
mov esp, ebp
pop ebp
ret 0x10
Function at 0x46dcc0
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 8
cmp dword [ebp + 0xc], 0
push esi
push edi
mov edi, ecx
mov dword [esp + 0xc], 0
jne 0x46dce5
xor eax, eax
pop edi
pop esi
mov esp, ebp
pop ebp
ret 0xc
push dword [edi + 0x1d0]
mov esi, dword [sym.imp.KERNEL32.dll_TlsGetValue]
call esi
test eax, eax
je 0x46dd10
push dword [edi + 0x1d0]
call esi
push dword [ebp + 0x10]
mov ecx, eax
push dword [ebp + 0xc]
call fcn.00469310
test eax, eax
jne 0x46dd72
mov esi, dword [ebp + 8]
test esi, esi
je 0x46dd29
cmp byte [esi + 4], 0
jne 0x46dd29
push dword [esi]
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov byte [esi + 4], 1
mov ecx, dword [edi + 0x1fc]
mov edx, dword [ebp + 0x10]
test ecx, ecx
je 0x46dd66
mov eax, edx
and eax, 0x3ffffff
cmp eax, dword [edi + 0x200]
jne 0x46dd66
mov eax, dword [ebp + 0xc]
cmp eax, dword [ecx + 0x1e08]
jne 0x46dcdb
shr edx, 0x1a
mov eax, edx
shl eax, 4
sub eax, edx
inc eax
lea eax, [ecx + eax*8]
pop edi
pop esi
mov esp, ebp
pop ebp
ret 0xc
mov ecx, dword [edi + 0x3c]
push edx
push dword [ebp + 0xc]
mov eax, dword [ecx]
call dword [eax + 0x18]
pop edi
pop esi
mov esp, ebp
pop ebp
ret 0xc

Function at 0x46ea00
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
mov ebx, ecx
movzx eax, byte [edi + 8]
xor eax, 0x811c9dc5
imul edx, eax, 0x1000193
movzx eax, byte [edi + 9]
xor edx, eax
movzx eax, byte [edi + 0xa]
imul edx, edx, 0x1000193
xor edx, eax
movzx eax, byte [edi + 0xb]
imul ecx, edx, 0x1000193
mov edx, dword [ebx + 0x14]
xor ecx, eax
imul eax, ecx, 0x1000193
mov ecx, edx
and ecx, eax
cmp dword [ebx + 0x18], ecx
ja 0x46ea53
shr edx, 1
or eax, 0xffffffff
sub eax, edx
add ecx, eax
lea edx, [ecx*8]
mov ecx, dword [ebx + 8]
add ecx, edx
cmp dword [ecx + 4], edi
jne 0x46ea7f
cmp dword [ecx], edi
jne 0x46ea77
mov eax, dword [ebx]
mov dword [ecx], eax
mov ecx, dword [ebx + 8]
mov eax, dword [ebx]
mov dword [edx + ecx + 4], eax
jmp 0x46ea87
mov eax, dword [edi + 4]
mov dword [ecx + 4], eax
jmp 0x46ea87
cmp dword [ecx], edi
jne 0x46ea8a
mov eax, dword [edi]
mov dword [ecx], eax
mov edi, dword [ebp + 0xc]
mov eax, dword [edi + 4]
mov esi, dword [edi]
mov dword [eax], esi
mov ecx, dword [edi]
mov eax, dword [edi + 4]
mov dword [ecx + 4], eax
dec dword [ebx + 4]
cmp dword [edi + 0x20], 0x10
jb 0x46eaad
push dword [edi + 0xc]
call fcn.004daf7e
add esp, 4
mov dword [edi + 0x20], 0xf
mov dword [edi + 0x1c], 0
push edi
mov byte [edi + 0xc], 0
call fcn.004daf7e
mov eax, dword [ebp + 8]
add esp, 4
pop edi
mov dword [eax], esi
pop esi
pop ebx
pop ebp
ret 8
Function at 0x46f970
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
mov esi, ecx
movzx eax, byte [edi]
xor eax, 0x811c9dc5
imul edx, eax, 0x1000193
movzx eax, byte [edi + 1]
xor edx, eax
movzx eax, byte [edi + 2]
imul edx, edx, 0x1000193
xor edx, eax
movzx eax, byte [edi + 3]
imul ecx, edx, 0x1000193
mov edx, dword [esi + 0x14]
xor ecx, eax
imul eax, ecx, 0x1000193
mov ecx, edx
and ecx, eax
cmp dword [esi + 0x18], ecx
ja 0x46f9c2
shr edx, 1
or eax, 0xffffffff
sub eax, edx
add ecx, eax
mov edx, dword [esi + 8]
mov esi, dword [esi]
mov eax, dword [edx + ecx*8]
add ecx, ecx
mov ebx, dword [edx + ecx*4]
lea edx, [edx + ecx*4]
cmp ebx, esi
jne 0x46f9da
mov ecx, esi
jmp 0x46f9df
mov ecx, dword [edx + 4]
mov ecx, dword [ecx]
cmp eax, ecx
je 0x46fa0c
mov ecx, dword [eax + 8]
cmp ecx, dword [edi]
je 0x46f9ee
mov eax, dword [eax]
jmp 0x46f9d2
mov ecx, dword [edi]
cmp ecx, dword [eax + 8]
lea ecx, [ebp + 0xc]
mov dword [ebp + 0xc], esi
jne 0x46f9fe
mov dword [ebp + 0xc], eax
mov eax, dword [ebp + 8]
mov ecx, dword [ecx]
pop edi
pop esi
mov dword [eax], ecx
pop ebx
pop ebp
ret 8
mov eax, dword [ebp + 8]
pop edi
mov dword [eax], esi
pop esi
pop ebx
pop ebp
ret 8

Function at 0x46fc50
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
mov esi, ecx
movzx eax, byte [edi]
xor eax, 0x811c9dc5
imul edx, eax, 0x1000193
movzx eax, byte [edi + 1]
xor edx, eax
movzx eax, byte [edi + 2]
imul edx, edx, 0x1000193
xor edx, eax
movzx eax, byte [edi + 3]
imul ecx, edx, 0x1000193
mov edx, dword [esi + 0x14]
xor ecx, eax
imul eax, ecx, 0x1000193
mov ecx, edx
and ecx, eax
cmp dword [esi + 0x18], ecx
ja 0x46fca2
shr edx, 1
or eax, 0xffffffff
sub eax, edx
add ecx, eax
mov edx, dword [esi + 8]
mov esi, dword [esi]
mov eax, dword [edx + ecx*8]
add ecx, ecx
mov ebx, dword [edx + ecx*4]
lea edx, [edx + ecx*4]
cmp ebx, esi
jne 0x46fcba
mov ecx, esi
jmp 0x46fcbf
mov ecx, dword [edx + 4]
mov ecx, dword [ecx]
cmp eax, ecx
je 0x46fcec
mov ecx, dword [eax + 8]
cmp ecx, dword [edi]
je 0x46fcce
mov eax, dword [eax]
jmp 0x46fcb2
mov ecx, dword [edi]
cmp ecx, dword [eax + 8]
lea ecx, [ebp + 0xc]
mov dword [ebp + 0xc], esi
jne 0x46fcde
mov dword [ebp + 0xc], eax
mov eax, dword [ebp + 8]
mov ecx, dword [ecx]
pop edi
pop esi
mov dword [eax], ecx
pop ebx
pop ebp
ret 8
mov eax, dword [ebp + 8]
pop edi
mov dword [eax], esi
pop esi
pop ebx
pop ebp
ret 8
Function at 0x46fe30
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
mov esi, ecx
movzx eax, byte [edi]
xor eax, 0x811c9dc5
imul edx, eax, 0x1000193
movzx eax, byte [edi + 1]
xor edx, eax
movzx eax, byte [edi + 2]
imul edx, edx, 0x1000193
xor edx, eax
movzx eax, byte [edi + 3]
imul ecx, edx, 0x1000193
mov edx, dword [esi + 0x14]
xor ecx, eax
imul eax, ecx, 0x1000193
mov ecx, edx
and ecx, eax
cmp dword [esi + 0x18], ecx
ja 0x46fe82
shr edx, 1
or eax, 0xffffffff
sub eax, edx
add ecx, eax
mov edx, dword [esi + 8]
mov esi, dword [esi]
mov eax, dword [edx + ecx*8]
add ecx, ecx
mov ebx, dword [edx + ecx*4]
lea edx, [edx + ecx*4]
cmp ebx, esi
jne 0x46fe9a
mov ecx, esi
jmp 0x46fe9f
mov ecx, dword [edx + 4]
mov ecx, dword [ecx]
cmp eax, ecx
je 0x46fecc
mov ecx, dword [eax + 8]
cmp ecx, dword [edi]
je 0x46feae
mov eax, dword [eax]
jmp 0x46fe92
mov ecx, dword [edi]
cmp ecx, dword [eax + 8]
lea ecx, [ebp + 0xc]
mov dword [ebp + 0xc], esi
jne 0x46febe
mov dword [ebp + 0xc], eax
mov eax, dword [ebp + 8]
mov ecx, dword [ecx]
pop edi
pop esi
mov dword [eax], ecx
pop ebx
pop ebp
ret 8
mov eax, dword [ebp + 8]
pop edi
mov dword [eax], esi
pop esi
pop ebx
pop ebp
ret 8
Function at 0x46ffe0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [ebp + 0xc]
push ebx
mov ebx, ecx
push esi
mov ecx, dword [eax + 0x14]
mov dword [ebp - 8], ebx
mov dword [ebp - 4], ecx
push edi
mov edi, dword [eax + 0x10]
cmp ecx, 0x10
jb 0x470003
mov esi, dword [eax]
jmp 0x470005
mov esi, eax
xor ecx, ecx
mov edx, 0x811c9dc5
test edi, edi
je 0x470021
movzx eax, byte [esi + ecx]
inc ecx
xor eax, edx
imul edx, eax, 0x1000193
cmp ecx, edi
jb 0x470010
mov ecx, dword [ebx + 0x14]
mov ebx, ecx
and ebx, edx
mov edx, dword [ebp - 8]
cmp dword [edx + 0x18], ebx
ja 0x470039
shr ecx, 1
or eax, 0xffffffff
sub eax, ecx
add ebx, eax
mov ecx, dword [edx + 8]
lea eax, [ebx + ebx]
mov edx, dword [edx]
lea eax, [eax + 1]
mov dword [ebp - 8], edx
mov esi, dword [ecx + ebx*8]
mov ebx, dword [ecx + eax*4 - 4]
lea eax, [ecx + eax*4]
mov dword [ebp - 0xc], ebx
mov dword [ebp - 0x10], eax
cmp ebx, edx
jne 0x47005f
mov eax, edx
jmp 0x470063
mov eax, dword [eax]
mov eax, dword [eax]
cmp esi, eax
je 0x470129
cmp dword [ebp - 4], 0x10
lea ecx, [esi + 8]
jb 0x47007b
mov eax, dword [ebp + 0xc]
mov edx, dword [eax]
jmp 0x47007e
mov edx, dword [ebp + 0xc]
cmp dword [ecx + 0x14], 0x10
mov ebx, dword [ecx + 0x10]
jb 0x470089
mov ecx, dword [ecx]
cmp ebx, edi
mov eax, edi
cmovb eax, ebx
push eax
push edx
push ecx
call fcn.004136b0
add esp, 0xc
test eax, eax
jne 0x4700ac
cmp ebx, edi
jb 0x4700ac
cmp ebx, edi
setne al
test eax, eax
je 0x4700b9
mov esi, dword [esi]
mov edx, dword [ebp - 8]
mov ebx, dword [ebp - 0xc]
mov eax, dword [ebp - 0x10]
jmp 0x470057
cmp dword [esi + 0x1c], 0x10
lea ecx, [esi + 8]
mov ebx, dword [ecx + 0x10]
jb 0x4700c7
mov ecx, dword [ecx]
cmp dword [ebp - 4], 0x10
jb 0x4700d5
mov eax, dword [ebp + 0xc]
mov eax, dword [eax]
mov dword [ebp + 0xc], eax
cmp edi, ebx
mov eax, ebx
cmovb eax, edi
push eax
push ecx
push dword [ebp + 0xc]
call fcn.004136b0
add esp, 0xc
test eax, eax
jne 0x470110
cmp edi, ebx
jb 0x470110
cmp edi, ebx
setne al
test eax, eax
jne 0x470110
mov eax, dword [ebp + 8]
lea ecx, [ebp + 0xc]
pop edi
mov dword [ebp + 0xc], esi
mov ecx, dword [ecx]
pop esi
mov dword [eax], ecx
pop ebx
mov esp, ebp
pop ebp
ret 8
mov eax, dword [ebp - 8]
lea ecx, [ebp + 0xc]
mov dword [ebp + 0xc], eax
mov eax, dword [ebp + 8]
mov ecx, dword [ecx]
pop edi
pop esi
mov dword [eax], ecx
pop ebx
mov esp, ebp
pop ebp
ret 8
mov eax, dword [ebp + 8]
pop edi
pop esi
pop ebx
mov dword [eax], edx
mov esp, ebp
pop ebp
ret 8
Function at 0x470350
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov ebx, dword [ebp + 0xc]
push esi
mov esi, ecx
push edi
movzx eax, byte [ebx]
xor eax, 0x811c9dc5
imul edx, eax, 0x1000193
movzx eax, byte [ebx + 1]
xor edx, eax
movzx eax, byte [ebx + 2]
imul edx, edx, 0x1000193
xor edx, eax
movzx eax, byte [ebx + 3]
imul ecx, edx, 0x1000193
mov edx, dword [esi + 0x14]
xor ecx, eax
imul eax, ecx, 0x1000193
mov ecx, edx
and ecx, eax
cmp dword [esi + 0x18], ecx
ja 0x4703a3
shr edx, 1
or eax, 0xffffffff
sub eax, edx
add ecx, eax
mov edx, dword [esi + 8]
mov esi, dword [esi]
mov eax, dword [edx + ecx*8]
add ecx, ecx
mov edi, dword [edx + ecx*4]
inc ecx
lea ecx, [edx + ecx*4]
mov dword [ebp + 0xc], ecx
cmp edi, esi
jne 0x4703bf
mov ecx, esi
jmp 0x4703c3
mov ecx, dword [ecx]
mov ecx, dword [ecx]
cmp eax, ecx
je 0x470413
mov ecx, dword [eax + 8]
cmp ecx, dword [ebx]
je 0x4703d5
mov eax, dword [eax]
mov ecx, dword [ebp + 0xc]
jmp 0x4703b7
mov ecx, dword [ebx]
mov edx, eax
mov ebx, dword [ebp + 0xc]
mov dword [ebp - 4], ecx
nop
cmp edi, esi
jne 0x4703e8
mov ecx, esi
jmp 0x4703ec
mov ecx, dword [ebx]
mov ecx, dword [ecx]
cmp eax, ecx
je 0x4703fc
mov ecx, dword [ebp - 4]
cmp ecx, dword [eax + 8]
jne 0x4703fc
mov eax, dword [eax]
jmp 0x4703e0
cmp edx, eax
je 0x470413
mov ecx, dword [ebp + 8]
pop edi
pop esi
pop ebx
mov dword [ecx + 4], eax
mov eax, ecx
mov dword [ecx], edx
mov esp, ebp
pop ebp
ret 8
mov eax, dword [ebp + 8]
pop edi
mov dword [eax], esi
mov dword [eax + 4], esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x471620
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
mov ebx, ecx
movzx eax, byte [edi + 8]
xor eax, 0x811c9dc5
imul edx, eax, 0x1000193
movzx eax, byte [edi + 9]
xor edx, eax
movzx eax, byte [edi + 0xa]
imul edx, edx, 0x1000193
xor edx, eax
movzx eax, byte [edi + 0xb]
imul ecx, edx, 0x1000193
mov edx, dword [ebx + 0x14]
xor ecx, eax
imul eax, ecx, 0x1000193
mov ecx, edx
and ecx, eax
cmp dword [ebx + 0x18], ecx
ja 0x471673
shr edx, 1
or eax, 0xffffffff
sub eax, edx
add ecx, eax
lea edx, [ecx*8]
mov ecx, dword [ebx + 8]
add ecx, edx
cmp dword [ecx + 4], edi
jne 0x47169f
cmp dword [ecx], edi
jne 0x471697
mov eax, dword [ebx]
mov dword [ecx], eax
mov ecx, dword [ebx + 8]
mov eax, dword [ebx]
mov dword [ecx + edx + 4], eax
jmp 0x4716a7
mov eax, dword [edi + 4]
mov dword [ecx + 4], eax
jmp 0x4716a7
cmp dword [ecx], edi
jne 0x4716aa
mov eax, dword [edi]
mov dword [ecx], eax
mov edi, dword [ebp + 0xc]
mov eax, dword [edi + 4]
mov esi, dword [edi]
push edi
mov dword [eax], esi
mov ecx, dword [edi]
mov eax, dword [edi + 4]
mov dword [ecx + 4], eax
dec dword [ebx + 4]
call fcn.004daf7e
mov eax, dword [ebp + 8]
add esp, 4
pop edi
mov dword [eax], esi
pop esi
pop ebx
pop ebp
ret 8