joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40ccbf
Capabilities:
Inspect section memory permissions

Disassembly:
mov edi, dword [ebp - 0x88]
mov eax, dword [ebp + 0xc]
cmp ax, word [edi + 6]
jne 0x40cc59
mov edx, dword [ebp - 0xb4]
xor ecx, ecx
mov edi, 0x60000000
jmp 0x40cc77
movzx eax, ax
lea eax, [eax + eax*4]
mov ecx, dword [edi + eax*8 + 0x104]
mov edx, dword [edi + eax*8 + 0x108]
lea eax, [edi + eax*8 + 0xf8]
mov edi, dword [eax + 0x24]
lea eax, [edx + ecx - 1]
xor edx, edx
div dword [ebp - 0xac]
xor edx, edx
mov dword [ebp - 0x44], eax
mov eax, ecx
div dword [ebp - 0xac]
cmp eax, dword [ebp - 0x44]
ja 0x40ccd5
mov edx, edi
mov dword [ebp + 8], edi
and dword [ebp + 8], 0x40000000
mov dword [ebp + 0x10], edi
and edx, 0x20000000
and dword [ebp + 0x10], 0x80000000
mov ecx, dword [ebp + 0x18]
cmp edx, ebx
je 0x40ccbc
or byte [eax + ecx], 1
cmp dword [ebp + 8], ebx
je 0x40ccc5
or byte [eax + ecx], 2
cmp dword [ebp + 0x10], ebx
je 0x40cccf
add ecx, eax
or byte [ecx], 4
inc eax
cmp eax, dword [ebp - 0x44]
jbe 0x40ccb1
inc dword [ebp + 0xc]
mov eax, dword [ebp - 0x88]
mov cx, word [ebp + 0xc]
cmp cx, word [eax + 6]
jbe 0x40cc3b
mov dword [ebp + 8], esi
xor edi, edi
mov eax, dword [ebp + 0x18]
push 2
pop ecx
movzx eax, byte [edi + eax]
sub eax, ecx
je 0x40cd22
dec eax
je 0x40cd19
sub eax, 3
je 0x40cd10
mov dword [ebp - 4], 0x40
jmp 0x40cd3f
mov dword [ebp - 4], 4
jmp 0x40cd25
mov dword [ebp - 4], 0x20
jmp 0x40cd25
mov dword [ebp - 4], ecx
lea eax, [ebp - 4]
push eax
push dword [ebp - 4]
push dword [ebp - 0xac]
push dword [ebp + 8]
call dword [ebp - 0xbc]
test eax, eax
je 0x40cd71
mov eax, dword [ebp - 0xac]
add dword [ebp + 8], eax
inc edi
cmp edi, dword [ebp - 0x8c]
jbe 0x40ccf1
mov eax, dword [ebp - 0x88]
mov edi, dword [eax + 0x28]
add edi, esi
call fcn.0040c582
adc al, byte [edx]
inc edi
cmpsb byte [esi], byte es:[edi]
push dword [ebp + 0x14]
push 1
push esi
call edi
mov eax, esi
jmp 0x40cd7d
push 0x8000
push ebx
push esi
call dword [ebp - 8]
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x401b10
Capabilities:
Act as tcp client
Connect socket
Connect tcp socket
Connect udp socket
Create tcp socket
Create udp socket

Disassembly:
push ebp
xor edx, edx
mov ecx, 2
movzx eax, ax
mov ebp, esp
push esi
push ebx
sub esp, 0x1c
mov word [ebp - 0xa], dx
mov word [ebp - 0x18], cx
mov dword [ebp - 0x16], 0
mov dword [ebp - 0x12], 0
mov dword [ebp - 0xe], 0
mov dword [esp], eax
call dword [sym.imp.ws2_32.dll_htons]
sub esp, 4
mov word [ebp - 0x16], ax
mov dword [esp], str.127.0.0.1
call dword [sym.imp.ws2_32.dll_inet_addr]
sub esp, 4
mov dword [ebp - 0x14], eax
mov dword [esp + 8], 0
mov dword [esp + 4], 1
mov dword [esp], 2
call dword [sym.imp.ws2_32.dll_socket]
sub esp, 0xc
mov ebx, eax
lea eax, [ebp - 0x18]
mov dword [esp], ebx
mov dword [esp + 8], 0x10
mov dword [esp + 4], eax
call dword [sym.imp.ws2_32.dll_connect]
sub esp, 0xc
mov esi, eax
call fcn.0040ded0
mov dword [eax], 0x412056
mov dword [eax + 4], 0x50
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x34]
mov dword [esp + 4], str.Failed_to_connect_socket__error__lu._n
mov dword [esp + 8], eax
xor eax, eax
test esi, esi
sete al
mov dword [esp], eax
call fcn.00401af0
lea esp, [ebp - 8]
mov eax, ebx
pop ebx
pop esi
pop ebp
ret

Function at 0x401be0
Capabilities:
Receive data
Receive data on socket
Send http response

Disassembly:
push edi
lea edi, [esp + 8]
and esp, 0xfffffff8
push dword [edi - 4]
push ebp
mov ebp, esp
push edi
push esi
mov esi, eax
xor eax, eax
push ebx
sub esp, 0x950
mov dword [ebp - 0x92c], ecx
mov ebx, dword [edi]
mov ecx, 0x46
lea edi, [ebp - 0x928]
mov dword [ebp - 0x930], edx
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x928]
mov dword [ebp - 0x91c], str.Im_a_teapot
mov dword [ebp - 0x920], 0xc01a2
mov dword [esp + 0x28], 0
mov dword [esp + 0x24], 0
mov dword [esp + 0x20], 0
mov dword [esp + 0x1c], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], 0
mov edx, dword [ebp - 0x92c]
mov eax, dword [ebp - 0x930]
mov dword [esp], esi
mov dword [esp + 8], edx
mov dword [esp + 4], eax
call dword [sym.imp.httpapi.dll_HttpSendHttpResponse]
sub esp, 0x2c
mov esi, eax
call fcn.0040ded0
mov dword [eax], 0x412056
mov dword [eax + 4], 0x5f
xor eax, eax
test esi, esi
sete al
mov dword [esp + 8], esi
mov dword [esp], eax
mov dword [esp + 4], str.Got_error__u._n
call fcn.00401af0
lea eax, [ebp - 0x810]
mov dword [esp], ebx
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0x800
mov dword [esp + 4], eax
call dword [sym.imp.ws2_32.dll_recv]
sub esp, 0x10
mov ebx, eax
call fcn.0040ded0
mov dword [eax], 0x412056
mov dword [eax + 4], 0x61
xor eax, eax
test ebx, ebx
setg al
mov dword [esp + 4], str.recv___failed._n
mov dword [esp], eax
call fcn.00401af0
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
lea esp, [edi - 8]
pop edi
ret
Function at 0x401d20
Capabilities:
Register http server url

Disassembly:
push ebp
mov ebp, esp
push edi
mov edi, 0xc350
push esi
lea esi, [ebp - 0x70]
push ebx
sub esp, 0x7c
mov dword [ebp - 0x74], eax
mov eax, esi
shr eax, 0x10
mov dword [ebp - 0x78], eax
jmp 0x401d9d
mov dword [esp + 4], 0xffffffff
mov dword [esp], esi
call dword [sym.imp.kernel32.dll_IsBadStringPtrW]
mov edx, eax
sub esp, 8
mov eax, str._invalid_
test edx, edx
jne 0x401d66
mov eax, esi
call fcn.004011b0
cmp ebx, 0x20
mov dword [esp + 8], eax
sete al
cmp ebx, 0xb7
mov dword [esp + 0xc], ebx
sete dl
mov dword [esp + 4], str.Failed_to_add__s__error__u._n
add edi, 1
or eax, edx
movzx eax, al
mov dword [esp], eax
call fcn.00401af0
cmp edi, 0xc738
je 0x401e1a
mov dword [esp + 0xc], edi
mov dword [esp + 8], 0x4121d4
mov dword [esp + 4], 0x32
mov dword [esp], esi
call fcn.00401400
mov dword [esp + 8], 0
mov dword [esp + 4], esi
mov eax, dword [ebp - 0x74]
mov dword [esp], eax
call dword [sym.imp.httpapi.dll_HttpAddUrl]
sub esp, 0xc
mov ebx, eax
test eax, eax
je 0x401e10
call fcn.0040ded0
mov edx, dword [ebp - 0x78]
mov dword [eax], 0x412056
mov dword [eax + 4], 0x6f
test edx, edx
jne 0x401d40
movzx eax, si
mov dword [esp], str._04x
mov dword [esp + 4], eax
call fcn.00401000
jmp 0x401d66
lea esp, [ebp - 0xc]
mov eax, edi
pop ebx
pop esi
pop edi
pop ebp
ret
call fcn.0040ded0
mov dword [eax], 0x412056
mov dword [eax + 4], 0x71
mov eax, dword [ebp - 0x78]
test eax, eax
je 0x401e7f
mov dword [esp + 4], 0xffffffff
mov dword [esp], esi
call dword [sym.imp.kernel32.dll_IsBadStringPtrW]
mov edx, eax
sub esp, 8
mov eax, str._invalid_
test edx, edx
jne 0x401e59
mov eax, esi
call fcn.004011b0
mov dword [esp + 0xc], ebx
mov dword [esp + 8], eax
mov dword [esp + 4], str.Failed_to_add_url__s__error__u._n
mov dword [esp], 0
call fcn.00401af0
lea esp, [ebp - 0xc]
xor eax, eax
pop ebx
pop esi
pop edi
pop ebp
ret
movzx esi, si
mov dword [esp], str._04x
mov dword [esp + 4], esi
call fcn.00401000
jmp 0x401e59
Function at 0x40f520
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
lea eax, [ebp - 4]
mov dword [ebp - 4], 0
mov dword [esp + 0x10], eax
lea eax, [ebp - 8]
mov dword [esp + 8], eax
lea eax, [ebp - 0xc]
mov dword [esp + 4], eax
lea eax, [ebp - 0x10]
mov dword [esp], eax
mov dword [esp + 0xc], 0
call sub.msvcrt.dll___getmainargs
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 8]
mov edx, dword [eax + 0x3c]
cmp word [eax + edx + 0x5c], 2
sete al
movzx eax, al
add eax, 1
mov dword [esp], eax
call sub.msvcrt.dll___set_app_type
mov eax, dword [ebp - 8]
mov dword [esp + 8], eax
mov eax, dword [ebp - 0xc]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x10]
mov dword [esp], eax
call fcn.0040f610
mov dword [esp], eax
call sub.msvcrt.dll_exit
nop
nop
nop
nop
push ebp
mov ebp, esp
call sub.msvcrt.dll___iob_func
mov edx, dword [ebp + 8]
pop ebp
shl edx, 5
add eax, edx
ret
Function at 0x10037790
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [ebp + 8]
push ebx
push esi
mov dword [ebp - 0x10], eax
mov ebx, ecx
dec eax
push edi
mov edi, edx
mov dword [ebp - 0x14], eax
mov edx, dword [ebp + 0xc]
mov esi, edi
sar eax, 1
mov ecx, edi
mov dword [ebp - 4], edx
mov dword [ebp - 8], esi
mov dword [ebp - 0xc], eax
cmp edi, eax
jge 0x100377ee
nop dword [eax]
lea esi, [ecx + ecx]
push dword [ebx + esi*4 + 4]
push dword [ebx + esi*4 + 8]
call fcn.10031760
movzx ecx, al
xor ecx, 1
inc ecx
add ecx, esi
mov eax, dword [ebx + ecx*4]
mov dword [ebx + edi*4], eax
mov edi, ecx
mov eax, dword [ebp - 0xc]
cmp ecx, eax
jl 0x100377c0
mov edx, dword [ebp - 4]
mov esi, dword [ebp - 8]
mov edi, ecx
cmp ecx, eax
jne 0x10037805
mov eax, dword [ebp - 0x10]
test al, 1
jne 0x10037805
mov eax, dword [ebx + eax*4 - 4]
mov edi, dword [ebp - 0x14]
mov dword [ebx + ecx*4], eax
cmp esi, edi
jge 0x10037850
nop dword [eax]
push dword [edx]
lea esi, [edi - 1]
sar esi, 1
push dword [ebx + esi*4]
call fcn.10031760
test al, al
je 0x10037841
mov eax, dword [ebx + esi*4]
mov edx, dword [ebp - 4]
mov dword [ebx + edi*4], eax
mov edi, esi
cmp dword [ebp - 8], esi
jl 0x10037810
mov eax, edx
mov eax, dword [eax]
mov dword [ebx + edi*4], eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 4]
mov eax, dword [eax]
mov dword [ebx + edi*4], eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [edx]
mov dword [ebx + edi*4], eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10043540
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x100f6040]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, ecx
cmp dword [esi + 0x38], 0
je 0x100435fc
cmp byte [esi + 0x3d], 0
je 0x100435fc
mov eax, dword [esi]
push edi
push 0xffffffffffffffff
call dword [eax + 0xc]
cmp eax, 0xffffffff
je 0x100435ea
mov ecx, dword [esi + 0x38]
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [esi + 0x40]
push eax
call dword [sym.imp.MSVCP140.dll_public:_int___thiscall_std::codecvt_char__char__struct__Mbstatet_::unshift_struct__Mbstatet___char___char___char___const]
sub eax, 0
je 0x100435b1
sub eax, 1
je 0x100435b5
sub eax, 2
jne 0x100435ea
mov byte [esi + 0x3d], al
mov al, 1
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100d02b9
mov esp, ebp
pop ebp
ret
mov byte [esi + 0x3d], 0
mov edi, dword [ebp - 0x28]
lea eax, [ebp - 0x24]
sub edi, eax
je 0x100435d3
push dword [esi + 0x4c]
push edi
push 1
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
add esp, 0x10
cmp edi, eax
jne 0x100435ea
cmp byte [esi + 0x3d], 0
pop edi
sete al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100d02b9
mov esp, ebp
pop ebp
ret
pop edi
xor al, al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100d02b9
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
mov al, 1
xor ecx, ebp
pop esi
call fcn.100d02b9
mov esp, ebp
pop ebp
ret
Function at 0x10045c60
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
cmp byte [0x102d45a8], 0
push ebx
push esi
push edi
je 0x10045dfd
mov ecx, dword [0x1044f5b4]
mov eax, dword [ecx]
mov eax, dword [eax + 0x68]
call eax
test al, al
je 0x10045dfd
mov ecx, dword [0x1044f63c]
xor ebx, ebx
mov dword [ebp - 4], ecx
mov eax, dword [ecx + 0x28]
mov dword [ebp - 8], eax
test eax, eax
je 0x10045dfd
mov eax, dword [ecx + 0x1c]
mov ecx, dword [eax + ebx*4]
mov eax, dword [ecx]
mov eax, dword [eax + 0x30]
call eax
mov esi, eax
mov edi, 0x811c9dc5
xor ecx, ecx
nop word [eax + eax]
inc ecx
cmp byte [esi + ecx], 0
jne 0x10045cc0
xor edx, edx
test ecx, ecx
je 0x10045ce9
nop dword [eax]
movsx eax, byte [esi + edx]
inc edx
xor eax, edi
imul edi, eax, 0x1000193
cmp edx, ecx
jb 0x10045cd0
cmp edi, 0x5ff56dc5
je 0x10045cf8
inc ebx
cmp ebx, dword [ebp - 8]
jae 0x10045dfd
mov ecx, dword [ebp - 4]
jmp 0x10045ca4
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x1c]
mov edi, dword [eax + ebx*4]
test edi, edi
je 0x10045dfd
mov edx, dword [edi + 0x88]
test edx, edx
je 0x10045dfd
vmovss xmm2, dword [0x100ea0e8]
vmovss xmm1, dword [0x100ea278]
xor ebx, ebx
cmp edx, 4
jl 0x10045dc6
mov ecx, dword [edi + 0x7c]
lea esi, [edx - 4]
shr esi, 2
add ecx, 0x1078
inc esi
lea ebx, [esi*4]
nop dword [eax]
vmovss xmm0, dword [ecx - 0xc60]
vucomiss xmm0, xmm2
lahf
test ah, 0x44
jp 0x10045d6a
vmovss dword [ecx - 0xc60], xmm1
vmovss xmm0, dword [ecx - 0x840]
vucomiss xmm0, xmm2
lahf
test ah, 0x44
jp 0x10045d84
vmovss dword [ecx - 0x840], xmm1
vmovss xmm0, dword [ecx - 0x420]
vucomiss xmm0, xmm2
lahf
test ah, 0x44
jp 0x10045d9e
vmovss dword [ecx - 0x420], xmm1
vmovss xmm0, dword [ecx]
vucomiss xmm0, xmm2
lahf
test ah, 0x44
jp 0x10045db0
vmovss dword [ecx], xmm1
add ecx, 0x1080
sub esi, 1
jne 0x10045d50
cmp ebx, edx
jl 0x10045dca
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
test edx, edx
jle 0x10045dfd
imul ecx, ebx, 0x420
add ecx, 0x418
add ecx, dword [edi + 0x7c]
sub edx, ebx
nop dword [eax + eax]
vmovss xmm0, dword [ecx]
vucomiss xmm0, xmm2
lahf
test ah, 0x44
jp 0x10045df2
vmovss dword [ecx], xmm1
add ecx, 0x420
sub edx, 1
jne 0x10045de0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10047fc0
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100d2a25
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push ebx
push esi
push edi
mov eax, dword [0x100f6040]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
movzx eax, byte [esi]
xor eax, 0x811c9dc5
imul ecx, eax, 0x1000193
movzx eax, byte [esi + 1]
xor ecx, eax
movzx eax, byte [esi + 2]
imul ecx, ecx, 0x1000193
xor ecx, eax
movzx eax, byte [esi + 3]
imul ecx, ecx, 0x1000193
xor ecx, eax
lea eax, [ebp - 0x18]
imul edi, ecx, 0x1000193
push edi
push esi
push eax
call fcn.10049640
mov eax, dword [ebp - 0x14]
test eax, eax
jne 0x1004814a
cmp dword [0x10457198], 0xfffffff
jne 0x1004804a
push str.unordered_map_set_too_long
call dword [sym.imp.MSVCP140.dll_void___cdecl_std::_Xlength_error_char_const__]
mov dword [ebp - 0x20], 0x10457194
mov dword [ebp - 4], 0
push 0x10
mov dword [ebp - 0x1c], 0
call fcn.100d02d5
mov ebx, eax
add esp, 4
mov eax, dword [esi]
mov dword [ebp - 0x1c], ebx
mov dword [ebx + 8], eax
mov dword [ebx + 0xc], 0
mov dword [ebp - 4], 1
mov eax, dword [0x10457198]
mov esi, dword [0x104571ac]
inc eax
vmovss xmm1, dword [0x10457190]
vxorps xmm0, xmm0, xmm0
vcvtsi2sd xmm0, xmm0, eax
shr eax, 0x1f
vaddsd xmm0, xmm0, qword [eax*8 + 0x100ea3e0]
vcvtsd2ss xmm2, xmm0, xmm0
vxorps xmm0, xmm0, xmm0
mov eax, esi
shr eax, 0x1f
vcvtsi2sd xmm0, xmm0, esi
vaddsd xmm0, xmm0, qword [eax*8 + 0x100ea3e0]
vcvtsd2ss xmm0, xmm0, xmm0
vdivss xmm0, xmm2, xmm0
vcomiss xmm0, xmm1
jbe 0x1004813f
vdivss xmm0, xmm2, xmm1
vcvtss2sd xmm0, xmm0, xmm0
vmovsd qword [ebp - 0x18], xmm0
fld qword [ebp - 0x18]
vxorpd xmm0, xmm0, xmm0
fstp qword [ebp - 0x18]
vroundsd xmm0, xmm0, qword [ebp - 0x18], 2
vmovsd qword [ebp - 0x18], xmm0
fld qword [ebp - 0x18]
fstp qword [ebp - 0x18]
vmovsd xmm0, qword [ebp - 0x18]
vcvtpd2ps xmm0, xmm0
call fcn.100d16a0
mov ecx, 8
cmp eax, ecx
cmova ecx, eax
cmp esi, ecx
jae 0x10048127
cmp esi, 0x200
jae 0x10048125
shl esi, 3
cmp esi, ecx
jae 0x10048127
mov esi, ecx
push esi
call fcn.100493f0
push edi
lea eax, [ebx + 8]
push eax
lea eax, [ebp - 0x20]
push eax
call fcn.10049640
mov ecx, dword [eax]
jmp 0x10048142
mov ecx, dword [ebp - 0x18]
push ebx
push ecx
push edi
call fcn.10049380
add eax, 0xc
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x10048610
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
sub esp, 0x18
mov edx, dword [ebp + 8]
push ebx
mov ebx, ecx
cmp edx, eax
je 0x10048766
mov eax, dword [ebx + 4]
mov dword [ebp - 0x14], eax
mov eax, dword [edx + 4]
mov dword [ebp - 8], eax
movzx eax, byte [edx + 8]
xor eax, 0x811c9dc5
imul ecx, eax, 0x1000193
movzx eax, byte [edx + 9]
push esi
push edi
mov edi, dword [ebx + 0xc]
mov esi, edx
xor ecx, eax
mov dword [ebp - 0x18], edi
movzx eax, byte [edx + 0xa]
imul ecx, ecx, 0x1000193
xor ecx, eax
movzx eax, byte [edx + 0xb]
imul ecx, ecx, 0x1000193
xor ecx, eax
mov eax, dword [ebx + 0x18]
imul ecx, ecx, 0x1000193
and eax, ecx
mov ecx, dword [edi + eax*8]
mov dword [ebp - 4], ecx
lea eax, [edi + eax*8]
mov dword [ebp - 0xc], eax
mov eax, dword [eax + 4]
mov dword [ebp - 0x10], eax
mov eax, esi
mov edi, esi
mov esi, dword [esi]
push 0x10
push eax
call fcn.100d0734
dec dword [ebx + 8]
add esp, 8
cmp edi, dword [ebp - 0x10]
je 0x100486c9
mov eax, dword [ebp + 0xc]
cmp esi, eax
jne 0x10048687
mov ecx, dword [ebp - 4]
cmp ecx, dword [ebp + 8]
jne 0x1004875c
mov edx, dword [ebp - 0xc]
mov ecx, dword [ebp - 8]
pop edi
mov dword [edx], esi
mov dword [ecx], esi
mov dword [esi + 4], ecx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
mov ecx, dword [ebp - 4]
mov edx, dword [ebp - 0xc]
cmp ecx, dword [ebp + 8]
jne 0x100486dd
mov eax, dword [ebp - 0x14]
mov ecx, eax
mov dword [edx], eax
jmp 0x100486e0
mov ecx, dword [ebp - 8]
mov eax, dword [ebp + 0xc]
mov dword [edx + 4], ecx
cmp esi, eax
je 0x1004875c
nop word [eax + eax]
movzx eax, byte [esi + 8]
xor eax, 0x811c9dc5
imul ecx, eax, 0x1000193
movzx eax, byte [esi + 9]
xor ecx, eax
movzx eax, byte [esi + 0xa]
imul ecx, ecx, 0x1000193
xor ecx, eax
movzx eax, byte [esi + 0xb]
imul ecx, ecx, 0x1000193
xor ecx, eax
mov eax, dword [ebx + 0x18]
imul ecx, ecx, 0x1000193
and eax, ecx
mov ecx, dword [ebp - 0x18]
lea eax, [ecx + eax*8]
mov dword [ebp - 4], eax
mov eax, dword [eax + 4]
mov dword [ebp - 0x10], eax
mov eax, esi
mov edi, esi
mov esi, dword [esi]
push 0x10
push eax
call fcn.100d0734
dec dword [ebx + 8]
add esp, 8
mov eax, dword [ebp + 0xc]
cmp edi, dword [ebp - 0x10]
je 0x1004876d
cmp esi, eax
jne 0x10048737
mov ecx, dword [ebp - 4]
mov dword [ecx], esi
mov ecx, dword [ebp - 8]
pop edi
mov dword [ecx], esi
mov dword [esi + 4], ecx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
mov ecx, dword [ebp - 4]
mov edx, dword [ebp - 0x14]
mov dword [ecx], edx
mov dword [ecx + 4], edx
cmp esi, eax
jne 0x100486f0
mov ecx, dword [ebp - 8]
pop edi
mov dword [ecx], esi
mov dword [esi + 4], ecx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x10055430
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [ebp + 0xc]
mov edx, ecx
push ebx
mov ebx, dword [ebp + 8]
mov dword [ebp - 0x14], edx
cmp ebx, eax
je 0x100555a1
mov eax, dword [edx + 4]
mov dword [ebp - 0x18], eax
mov eax, dword [ebx + 4]
mov dword [ebp - 8], eax
movzx eax, byte [ebx + 8]
xor eax, 0x811c9dc5
imul ecx, eax, 0x1000193
movzx eax, byte [ebx + 9]
push esi
push edi
mov edi, dword [edx + 0xc]
mov esi, ebx
xor ecx, eax
mov dword [ebp - 0x1c], edi
movzx eax, byte [ebx + 0xa]
imul ecx, ecx, 0x1000193
xor ecx, eax
movzx eax, byte [ebx + 0xb]
imul ecx, ecx, 0x1000193
xor ecx, eax
mov eax, dword [edx + 0x18]
imul ecx, ecx, 0x1000193
and eax, ecx
mov ecx, dword [edi + eax*8]
mov dword [ebp - 4], ecx
lea eax, [edi + eax*8]
mov dword [ebp - 0xc], eax
mov eax, dword [eax + 4]
mov dword [ebp - 0x10], eax
nop word [eax + eax]
mov edi, esi
mov ebx, esi
mov esi, dword [esi]
lea ecx, [edi + 0xc]
call fcn.10055d40
push 0x2c
push edi
call fcn.100d0734
mov edx, dword [ebp - 0x14]
add esp, 8
dec dword [edx + 8]
cmp ebx, dword [ebp - 0x10]
je 0x100554fd
mov eax, dword [ebp + 0xc]
cmp esi, eax
jne 0x100554b0
mov ecx, dword [ebp - 4]
cmp ecx, dword [ebp + 8]
jne 0x10055597
mov edi, dword [ebp - 0xc]
mov ecx, dword [ebp - 8]
mov dword [edi], esi
mov dword [ecx], esi
pop edi
mov dword [esi + 4], ecx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
mov ecx, dword [ebp - 4]
mov edi, dword [ebp - 0xc]
cmp ecx, dword [ebp + 8]
jne 0x10055511
mov eax, dword [ebp - 0x18]
mov ecx, eax
mov dword [edi], eax
jmp 0x10055514
mov ecx, dword [ebp - 8]
mov eax, dword [ebp + 0xc]
mov dword [edi + 4], ecx
cmp esi, eax
je 0x10055597
nop
movzx eax, byte [esi + 8]
xor eax, 0x811c9dc5
imul ecx, eax, 0x1000193
movzx eax, byte [esi + 9]
xor ecx, eax
movzx eax, byte [esi + 0xa]
imul ecx, ecx, 0x1000193
xor ecx, eax
movzx eax, byte [esi + 0xb]
imul ecx, ecx, 0x1000193
xor ecx, eax
mov eax, dword [edx + 0x18]
imul ecx, ecx, 0x1000193
and eax, ecx
mov ecx, dword [ebp - 0x1c]
lea eax, [ecx + eax*8]
mov dword [ebp - 4], eax
mov eax, dword [eax + 4]
mov dword [ebp - 0x10], eax
mov edi, esi
mov ebx, esi
mov esi, dword [esi]
lea ecx, [edi + 0xc]
call fcn.10055d40
push 0x2c
push edi
call fcn.100d0734
mov edx, dword [ebp - 0x14]
add esp, 8
mov eax, dword [ebp + 0xc]
dec dword [edx + 8]
cmp ebx, dword [ebp - 0x10]
je 0x100555a8
cmp esi, eax
jne 0x10055567
mov ecx, dword [ebp - 4]
mov dword [ecx], esi
mov ecx, dword [ebp - 8]
pop edi
mov dword [ecx], esi
mov dword [esi + 4], ecx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
mov ecx, dword [ebp - 4]
mov ebx, dword [ebp - 0x18]
mov dword [ecx], ebx
mov dword [ecx + 4], ebx
cmp esi, eax
jne 0x10055520
mov ecx, dword [ebp - 8]
pop edi
mov dword [ecx], esi
mov dword [esi + 4], ecx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x10055dd0
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
cmp dword [ecx + 0x14], 0xf
push esi
push edi
mov edi, edx
mov dword [ebp - 8], edi
jbe 0x10055de5
mov ecx, dword [ecx]
push ecx
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov esi, eax
test esi, esi
jne 0x10055dfa
pop edi
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret
mov eax, 0x5a4d
cmp word [esi], ax
jne 0x10055df2
mov eax, dword [esi + 0x3c]
cmp dword [eax + esi], 0x4550
jne 0x10055df2
mov eax, dword [eax + esi + 0x50]
mov edx, edi
push ebx
add eax, esi
xor ebx, ebx
cmp dword [edi + 0x14], 0xf
mov dword [ebp - 0xc], eax
jbe 0x10055e26
mov edx, dword [edi]
cmp esi, eax
jae 0x10055e90
mov ecx, 0x3f3f
nop
mov al, byte [edx]
mov byte [ebp - 1], al
cmp al, 0x3f
je 0x10055e9e
movzx ecx, al
sub al, 0x30
cmp al, 9
ja 0x10055e47
add ecx, 0xffffffd0
jmp 0x10055e4d
and ecx, 0xffffffdf
sub ecx, 0x37
mov al, byte [edx + 1]
movzx edi, al
sub al, 0x30
cmp al, 9
ja 0x10055e5e
add edi, 0xffffffd0
jmp 0x10055e64
and edi, 0xffffffdf
sub edi, 0x37
movzx eax, byte [esi]
shl ecx, 4
or ecx, edi
cmp eax, ecx
je 0x10055e99
test ebx, ebx
je 0x10055e85
mov edi, dword [ebp - 8]
mov esi, ebx
mov edx, edi
cmp dword [edi + 0x14], 0xf
jbe 0x10055e83
mov edx, dword [edi]
xor ebx, ebx
mov ecx, 0x3f3f
inc esi
cmp esi, dword [ebp - 0xc]
jb 0x10055e30
pop ebx
pop edi
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret
mov ecx, 0x3f3f
test ebx, ebx
mov eax, esi
cmovne eax, ebx
cmp byte [edx + 2], 0
mov ebx, eax
je 0x10055ec9
cmp word [edx], cx
je 0x10055ebd
cmp byte [ebp - 1], 0x3f
mov eax, 2
je 0x10055ec2
mov eax, 3
add edx, eax
cmp byte [edx], 0
jne 0x10055e8a
mov eax, ebx
pop ebx
pop edi
pop esi
mov esp, ebp
pop ebp
ret