joyce8/EMBER2024-capa huggingface dataset:
Function at 0x46d3a0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10c
mov eax, dword [0x55b0a0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
mov edi, ecx
mov dword [ebp - 0x58], eax
mov eax, dword [ebp + 0x10]
lea esi, [edi + 0x1d8]
push dword [esi]
mov dword [ebp - 0x54], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x50], eax
mov dword [ebp - 0x44], 0
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
jne 0x46d58c
push esi
push dword [esi]
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
test eax, eax
jne 0x46d3fc
call fcn.00461250
lea eax, [ebp - 0x40]
mov ecx, edi
push eax
call fcn.00468e30
test byte [ebx], 1
mov dword [ebp - 8], 0xf
mov dword [ebp - 0xc], 0
mov byte [ebp - 0x1c], 0
je 0x46d52b
push dword [ebp - 0x50]
lea eax, [edi + 4]
mov byte [ebp - 0x48], 0
push dword [ebp - 0x54]
mov dword [ebp - 0x4c], eax
mov ecx, edi
lea eax, [ebp - 0x4c]
push eax
call fcn.0046dbf0
mov edx, eax
test edx, edx
je 0x46d467
mov ecx, dword [ebp - 0x40]
sub ecx, dword [edx]
mov eax, dword [ebp - 0x3c]
sbb eax, dword [edx + 4]
mov dword [edx + 0x14], eax
mov dword [edx + 0x10], ecx
mov ecx, dword [edx + 8]
mov eax, dword [edx + 0xc]
neg ecx
mov dword [edx + 0x18], ecx
adc eax, 0
neg eax
mov dword [edx + 0x1c], eax
mov eax, dword [edi + 0x154]
test al, 8
je 0x46d49d
push edx
lea eax, [ebp - 0x40]
mov ecx, edi
push eax
push 0x45
lea eax, [ebp - 0x34]
push eax
call fcn.0046cc50
push eax
lea ecx, [ebp - 0x1c]
call fcn.00418fe0
cmp dword [ebp - 0x20], 0x10
jb 0x46d49d
push dword [ebp - 0x34]
call fcn.004d8fe0
add esp, 4
cmp byte [ebp - 0x48], 0
je 0x46d4ac
push dword [ebp - 0x4c]
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
cmp dword [ebp - 0xc], 0
je 0x46d52b
cmp dword [0x55f498], 2
jg 0x46d51a
push 1
push 2
lea ecx, [ebp - 0x100]
mov dword [ebp - 0x44], 2
mov dword [ebp - 0x108], 2
call fcn.00407db0
mov dword [ebp - 0x64], str.d:work_codeliebaocodesliebao_46_src_import_base_trace_event_trace_log.cc
mov dword [ebp - 0x60], 0x5d4
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 0x5d4
push str.d:work_codeliebaocodesliebao_46_src_import_base_trace_event_trace_log.cc
lea ecx, [ebp - 0x108]
mov dword [ebp - 0x5c], eax
call fcn.00427870
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x100]
push eax
call fcn.004131b0
add esp, 8
test byte [ebp - 0x44], 2
je 0x46d52b
lea ecx, [ebp - 0x108]
call fcn.00427630
test byte [ebx], 4
je 0x46d556
mov eax, dword [edi + 0x40]
test eax, eax
je 0x46d556
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push dword [ebp - 0x58]
push ebx
push 0x45
push dword [ebp - 0x3c]
push dword [ebp - 0x40]
call eax
add esp, 0x30
cmp dword [ebp - 8], 0x10
jb 0x46d567
push dword [ebp - 0x1c]
call fcn.004d8fe0
add esp, 4
push 0
push dword [esi]
mov dword [ebp - 8], 0xf
mov dword [ebp - 0xc], 0
mov byte [ebp - 0x1c], 0
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
test eax, eax
jne 0x46d58c
call fcn.00461250
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004d9c43
mov esp, ebp
pop ebp
ret 0x10
Function at 0x46dbf0
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 8
cmp dword [ebp + 0xc], 0
push esi
push edi
mov edi, ecx
mov dword [esp + 0xc], 0
jne 0x46dc15
xor eax, eax
pop edi
pop esi
mov esp, ebp
pop ebp
ret 0xc
push dword [edi + 0x1d0]
mov esi, dword [sym.imp.KERNEL32.dll_TlsGetValue]
call esi
test eax, eax
je 0x46dc40
push dword [edi + 0x1d0]
call esi
push dword [ebp + 0x10]
mov ecx, eax
push dword [ebp + 0xc]
call fcn.00469240
test eax, eax
jne 0x46dca2
mov esi, dword [ebp + 8]
test esi, esi
je 0x46dc59
cmp byte [esi + 4], 0
jne 0x46dc59
push dword [esi]
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov byte [esi + 4], 1
mov ecx, dword [edi + 0x1fc]
mov edx, dword [ebp + 0x10]
test ecx, ecx
je 0x46dc96
mov eax, edx
and eax, 0x3ffffff
cmp eax, dword [edi + 0x200]
jne 0x46dc96
mov eax, dword [ebp + 0xc]
cmp eax, dword [ecx + 0x1e08]
jne 0x46dc0b
shr edx, 0x1a
mov eax, edx
shl eax, 4
sub eax, edx
inc eax
lea eax, [ecx + eax*8]
pop edi
pop esi
mov esp, ebp
pop ebp
ret 0xc
mov ecx, dword [edi + 0x3c]
push edx
push dword [ebp + 0xc]
mov eax, dword [ecx]
call dword [eax + 0x18]
pop edi
pop esi
mov esp, ebp
pop ebp
ret 0xc

Function at 0x46e930
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
mov ebx, ecx
movzx eax, byte [edi + 8]
xor eax, 0x811c9dc5
imul edx, eax, 0x1000193
movzx eax, byte [edi + 9]
xor edx, eax
movzx eax, byte [edi + 0xa]
imul edx, edx, 0x1000193
xor edx, eax
movzx eax, byte [edi + 0xb]
imul ecx, edx, 0x1000193
mov edx, dword [ebx + 0x14]
xor ecx, eax
imul eax, ecx, 0x1000193
mov ecx, edx
and ecx, eax
cmp dword [ebx + 0x18], ecx
ja 0x46e983
shr edx, 1
or eax, 0xffffffff
sub eax, edx
add ecx, eax
lea edx, [ecx*8]
mov ecx, dword [ebx + 8]
add ecx, edx
cmp dword [ecx + 4], edi
jne 0x46e9af
cmp dword [ecx], edi
jne 0x46e9a7
mov eax, dword [ebx]
mov dword [ecx], eax
mov ecx, dword [ebx + 8]
mov eax, dword [ebx]
mov dword [edx + ecx + 4], eax
jmp 0x46e9b7
mov eax, dword [edi + 4]
mov dword [ecx + 4], eax
jmp 0x46e9b7
cmp dword [ecx], edi
jne 0x46e9ba
mov eax, dword [edi]
mov dword [ecx], eax
mov edi, dword [ebp + 0xc]
mov eax, dword [edi + 4]
mov esi, dword [edi]
mov dword [eax], esi
mov ecx, dword [edi]
mov eax, dword [edi + 4]
mov dword [ecx + 4], eax
dec dword [ebx + 4]
cmp dword [edi + 0x20], 0x10
jb 0x46e9dd
push dword [edi + 0xc]
call fcn.004d8fe0
add esp, 4
mov dword [edi + 0x20], 0xf
mov dword [edi + 0x1c], 0
push edi
mov byte [edi + 0xc], 0
call fcn.004d8fe0
mov eax, dword [ebp + 8]
add esp, 4
pop edi
mov dword [eax], esi
pop esi
pop ebx
pop ebp
ret 8
Function at 0x46f8a0
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
mov esi, ecx
movzx eax, byte [edi]
xor eax, 0x811c9dc5
imul edx, eax, 0x1000193
movzx eax, byte [edi + 1]
xor edx, eax
movzx eax, byte [edi + 2]
imul edx, edx, 0x1000193
xor edx, eax
movzx eax, byte [edi + 3]
imul ecx, edx, 0x1000193
mov edx, dword [esi + 0x14]
xor ecx, eax
imul eax, ecx, 0x1000193
mov ecx, edx
and ecx, eax
cmp dword [esi + 0x18], ecx
ja 0x46f8f2
shr edx, 1
or eax, 0xffffffff
sub eax, edx
add ecx, eax
mov edx, dword [esi + 8]
mov esi, dword [esi]
mov eax, dword [edx + ecx*8]
add ecx, ecx
mov ebx, dword [edx + ecx*4]
lea edx, [edx + ecx*4]
cmp ebx, esi
jne 0x46f90a
mov ecx, esi
jmp 0x46f90f
mov ecx, dword [edx + 4]
mov ecx, dword [ecx]
cmp eax, ecx
je 0x46f93c
mov ecx, dword [eax + 8]
cmp ecx, dword [edi]
je 0x46f91e
mov eax, dword [eax]
jmp 0x46f902
mov ecx, dword [edi]
cmp ecx, dword [eax + 8]
lea ecx, [ebp + 0xc]
mov dword [ebp + 0xc], esi
jne 0x46f92e
mov dword [ebp + 0xc], eax
mov eax, dword [ebp + 8]
mov ecx, dword [ecx]
pop edi
pop esi
mov dword [eax], ecx
pop ebx
pop ebp
ret 8
mov eax, dword [ebp + 8]
pop edi
mov dword [eax], esi
pop esi
pop ebx
pop ebp
ret 8

Function at 0x46fb80
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
mov esi, ecx
movzx eax, byte [edi]
xor eax, 0x811c9dc5
imul edx, eax, 0x1000193
movzx eax, byte [edi + 1]
xor edx, eax
movzx eax, byte [edi + 2]
imul edx, edx, 0x1000193
xor edx, eax
movzx eax, byte [edi + 3]
imul ecx, edx, 0x1000193
mov edx, dword [esi + 0x14]
xor ecx, eax
imul eax, ecx, 0x1000193
mov ecx, edx
and ecx, eax
cmp dword [esi + 0x18], ecx
ja 0x46fbd2
shr edx, 1
or eax, 0xffffffff
sub eax, edx
add ecx, eax
mov edx, dword [esi + 8]
mov esi, dword [esi]
mov eax, dword [edx + ecx*8]
add ecx, ecx
mov ebx, dword [edx + ecx*4]
lea edx, [edx + ecx*4]
cmp ebx, esi
jne 0x46fbea
mov ecx, esi
jmp 0x46fbef
mov ecx, dword [edx + 4]
mov ecx, dword [ecx]
cmp eax, ecx
je 0x46fc1c
mov ecx, dword [eax + 8]
cmp ecx, dword [edi]
je 0x46fbfe
mov eax, dword [eax]
jmp 0x46fbe2
mov ecx, dword [edi]
cmp ecx, dword [eax + 8]
lea ecx, [ebp + 0xc]
mov dword [ebp + 0xc], esi
jne 0x46fc0e
mov dword [ebp + 0xc], eax
mov eax, dword [ebp + 8]
mov ecx, dword [ecx]
pop edi
pop esi
mov dword [eax], ecx
pop ebx
pop ebp
ret 8
mov eax, dword [ebp + 8]
pop edi
mov dword [eax], esi
pop esi
pop ebx
pop ebp
ret 8
Function at 0x46fd60
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
mov esi, ecx
movzx eax, byte [edi]
xor eax, 0x811c9dc5
imul edx, eax, 0x1000193
movzx eax, byte [edi + 1]
xor edx, eax
movzx eax, byte [edi + 2]
imul edx, edx, 0x1000193
xor edx, eax
movzx eax, byte [edi + 3]
imul ecx, edx, 0x1000193
mov edx, dword [esi + 0x14]
xor ecx, eax
imul eax, ecx, 0x1000193
mov ecx, edx
and ecx, eax
cmp dword [esi + 0x18], ecx
ja 0x46fdb2
shr edx, 1
or eax, 0xffffffff
sub eax, edx
add ecx, eax
mov edx, dword [esi + 8]
mov esi, dword [esi]
mov eax, dword [edx + ecx*8]
add ecx, ecx
mov ebx, dword [edx + ecx*4]
lea edx, [edx + ecx*4]
cmp ebx, esi
jne 0x46fdca
mov ecx, esi
jmp 0x46fdcf
mov ecx, dword [edx + 4]
mov ecx, dword [ecx]
cmp eax, ecx
je 0x46fdfc
mov ecx, dword [eax + 8]
cmp ecx, dword [edi]
je 0x46fdde
mov eax, dword [eax]
jmp 0x46fdc2
mov ecx, dword [edi]
cmp ecx, dword [eax + 8]
lea ecx, [ebp + 0xc]
mov dword [ebp + 0xc], esi
jne 0x46fdee
mov dword [ebp + 0xc], eax
mov eax, dword [ebp + 8]
mov ecx, dword [ecx]
pop edi
pop esi
mov dword [eax], ecx
pop ebx
pop ebp
ret 8
mov eax, dword [ebp + 8]
pop edi
mov dword [eax], esi
pop esi
pop ebx
pop ebp
ret 8
Function at 0x46ff10
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [ebp + 0xc]
push ebx
mov ebx, ecx
push esi
mov ecx, dword [eax + 0x14]
mov dword [ebp - 8], ebx
mov dword [ebp - 4], ecx
push edi
mov edi, dword [eax + 0x10]
cmp ecx, 0x10
jb 0x46ff33
mov esi, dword [eax]
jmp 0x46ff35
mov esi, eax
xor ecx, ecx
mov edx, 0x811c9dc5
test edi, edi
je 0x46ff51
movzx eax, byte [esi + ecx]
inc ecx
xor eax, edx
imul edx, eax, 0x1000193
cmp ecx, edi
jb 0x46ff40
mov ecx, dword [ebx + 0x14]
mov ebx, ecx
and ebx, edx
mov edx, dword [ebp - 8]
cmp dword [edx + 0x18], ebx
ja 0x46ff69
shr ecx, 1
or eax, 0xffffffff
sub eax, ecx
add ebx, eax
mov ecx, dword [edx + 8]
lea eax, [ebx + ebx]
mov edx, dword [edx]
lea eax, [eax + 1]
mov dword [ebp - 8], edx
mov esi, dword [ecx + ebx*8]
mov ebx, dword [ecx + eax*4 - 4]
lea eax, [ecx + eax*4]
mov dword [ebp - 0xc], ebx
mov dword [ebp - 0x10], eax
cmp ebx, edx
jne 0x46ff8f
mov eax, edx
jmp 0x46ff93
mov eax, dword [eax]
mov eax, dword [eax]
cmp esi, eax
je 0x470059
cmp dword [ebp - 4], 0x10
lea ecx, [esi + 8]
jb 0x46ffab
mov eax, dword [ebp + 0xc]
mov edx, dword [eax]
jmp 0x46ffae
mov edx, dword [ebp + 0xc]
cmp dword [ecx + 0x14], 0x10
mov ebx, dword [ecx + 0x10]
jb 0x46ffb9
mov ecx, dword [ecx]
cmp ebx, edi
mov eax, edi
cmovb eax, ebx
push eax
push edx
push ecx
call fcn.00413630
add esp, 0xc
test eax, eax
jne 0x46ffdc
cmp ebx, edi
jb 0x46ffdc
cmp ebx, edi
setne al
test eax, eax
je 0x46ffe9
mov esi, dword [esi]
mov edx, dword [ebp - 8]
mov ebx, dword [ebp - 0xc]
mov eax, dword [ebp - 0x10]
jmp 0x46ff87
cmp dword [esi + 0x1c], 0x10
lea ecx, [esi + 8]
mov ebx, dword [ecx + 0x10]
jb 0x46fff7
mov ecx, dword [ecx]
cmp dword [ebp - 4], 0x10
jb 0x470005
mov eax, dword [ebp + 0xc]
mov eax, dword [eax]
mov dword [ebp + 0xc], eax
cmp edi, ebx
mov eax, ebx
cmovb eax, edi
push eax
push ecx
push dword [ebp + 0xc]
call fcn.00413630
add esp, 0xc
test eax, eax
jne 0x470040
cmp edi, ebx
jb 0x470040
cmp edi, ebx
setne al
test eax, eax
jne 0x470040
mov eax, dword [ebp + 8]
lea ecx, [ebp + 0xc]
pop edi
mov dword [ebp + 0xc], esi
mov ecx, dword [ecx]
pop esi
mov dword [eax], ecx
pop ebx
mov esp, ebp
pop ebp
ret 8
mov eax, dword [ebp - 8]
lea ecx, [ebp + 0xc]
mov dword [ebp + 0xc], eax
mov eax, dword [ebp + 8]
mov ecx, dword [ecx]
pop edi
pop esi
mov dword [eax], ecx
pop ebx
mov esp, ebp
pop ebp
ret 8
mov eax, dword [ebp + 8]
pop edi
pop esi
pop ebx
mov dword [eax], edx
mov esp, ebp
pop ebp
ret 8
Function at 0x470280
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov ebx, dword [ebp + 0xc]
push esi
mov esi, ecx
push edi
movzx eax, byte [ebx]
xor eax, 0x811c9dc5
imul edx, eax, 0x1000193
movzx eax, byte [ebx + 1]
xor edx, eax
movzx eax, byte [ebx + 2]
imul edx, edx, 0x1000193
xor edx, eax
movzx eax, byte [ebx + 3]
imul ecx, edx, 0x1000193
mov edx, dword [esi + 0x14]
xor ecx, eax
imul eax, ecx, 0x1000193
mov ecx, edx
and ecx, eax
cmp dword [esi + 0x18], ecx
ja 0x4702d3
shr edx, 1
or eax, 0xffffffff
sub eax, edx
add ecx, eax
mov edx, dword [esi + 8]
mov esi, dword [esi]
mov eax, dword [edx + ecx*8]
add ecx, ecx
mov edi, dword [edx + ecx*4]
inc ecx
lea ecx, [edx + ecx*4]
mov dword [ebp + 0xc], ecx
cmp edi, esi
jne 0x4702ef
mov ecx, esi
jmp 0x4702f3
mov ecx, dword [ecx]
mov ecx, dword [ecx]
cmp eax, ecx
je 0x470343
mov ecx, dword [eax + 8]
cmp ecx, dword [ebx]
je 0x470305
mov eax, dword [eax]
mov ecx, dword [ebp + 0xc]
jmp 0x4702e7
mov ecx, dword [ebx]
mov edx, eax
mov ebx, dword [ebp + 0xc]
mov dword [ebp - 4], ecx
nop
cmp edi, esi
jne 0x470318
mov ecx, esi
jmp 0x47031c
mov ecx, dword [ebx]
mov ecx, dword [ecx]
cmp eax, ecx
je 0x47032c
mov ecx, dword [ebp - 4]
cmp ecx, dword [eax + 8]
jne 0x47032c
mov eax, dword [eax]
jmp 0x470310
cmp edx, eax
je 0x470343
mov ecx, dword [ebp + 8]
pop edi
pop esi
pop ebx
mov dword [ecx + 4], eax
mov eax, ecx
mov dword [ecx], edx
mov esp, ebp
pop ebp
ret 8
mov eax, dword [ebp + 8]
pop edi
mov dword [eax], esi
mov dword [eax + 4], esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x471550
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
mov ebx, ecx
movzx eax, byte [edi + 8]
xor eax, 0x811c9dc5
imul edx, eax, 0x1000193
movzx eax, byte [edi + 9]
xor edx, eax
movzx eax, byte [edi + 0xa]
imul edx, edx, 0x1000193
xor edx, eax
movzx eax, byte [edi + 0xb]
imul ecx, edx, 0x1000193
mov edx, dword [ebx + 0x14]
xor ecx, eax
imul eax, ecx, 0x1000193
mov ecx, edx
and ecx, eax
cmp dword [ebx + 0x18], ecx
ja 0x4715a3
shr edx, 1
or eax, 0xffffffff
sub eax, edx
add ecx, eax
lea edx, [ecx*8]
mov ecx, dword [ebx + 8]
add ecx, edx
cmp dword [ecx + 4], edi
jne 0x4715cf
cmp dword [ecx], edi
jne 0x4715c7
mov eax, dword [ebx]
mov dword [ecx], eax
mov ecx, dword [ebx + 8]
mov eax, dword [ebx]
mov dword [ecx + edx + 4], eax
jmp 0x4715d7
mov eax, dword [edi + 4]
mov dword [ecx + 4], eax
jmp 0x4715d7
cmp dword [ecx], edi
jne 0x4715da
mov eax, dword [edi]
mov dword [ecx], eax
mov edi, dword [ebp + 0xc]
mov eax, dword [edi + 4]
mov esi, dword [edi]
push edi
mov dword [eax], esi
mov ecx, dword [edi]
mov eax, dword [edi + 4]
mov dword [ecx + 4], eax
dec dword [ebx + 4]
call fcn.004d8fe0
mov eax, dword [ebp + 8]
add esp, 4
pop edi
mov dword [eax], esi
pop esi
pop ebx
pop ebp
ret 8
Function at 0x475bc0
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
mov ebx, ecx
movzx eax, byte [edi]
xor eax, 0x811c9dc5
imul edx, eax, 0x1000193
movzx eax, byte [edi + 1]
xor edx, eax
movzx eax, byte [edi + 2]
imul edx, edx, 0x1000193
xor edx, eax
movzx eax, byte [edi + 3]
imul ecx, edx, 0x1000193
mov edx, dword [ebx + 0x14]
xor ecx, eax
imul eax, ecx, 0x1000193
mov ecx, edx
and ecx, eax
cmp dword [ebx + 0x18], ecx
ja 0x475c12
shr edx, 1
or eax, 0xffffffff
sub eax, edx
add ecx, eax
mov esi, dword [ebx + 8]
mov edx, dword [ebx]
shl ecx, 3
mov dword [ebp + 0xc], ecx
mov eax, dword [esi + ecx]
cmp eax, edx
jne 0x475c28
mov esi, edx
jmp 0x475c2e
mov esi, dword [esi + ecx + 4]
mov esi, dword [esi]
cmp esi, eax
je 0x475c40
mov ecx, dword [edi]
mov esi, dword [esi + 4]
cmp dword [esi + 8], ecx
je 0x475c8e
cmp esi, eax
jne 0x475c34
push edi
push dword [edx]
mov ecx, ebx
call fcn.0047a4a0
mov edi, dword [ebx]
mov edi, dword [edi]
mov eax, dword [edi]
cmp esi, eax
je 0x475c75
mov ecx, dword [edi + 4]
mov dword [ecx], eax
mov ecx, dword [eax + 4]
mov dword [ecx], esi
mov ecx, dword [esi + 4]
mov dword [ecx], edi
mov ecx, dword [eax + 4]
mov edx, dword [esi + 4]
mov dword [esi + 4], ecx
mov ecx, dword [edi + 4]
mov dword [eax + 4], ecx
mov dword [edi + 4], edx
mov ecx, dword [ebx + 8]
mov edx, dword [ebp + 0xc]
add ecx, edx
mov eax, dword [ecx]
cmp eax, dword [ebx]
jne 0x475c9e
mov dword [ecx], edi
mov eax, dword [ebx + 8]
mov dword [edx + eax + 4], edi
jmp 0x475cc0
mov eax, dword [ebp + 8]
mov dword [eax], esi
mov byte [eax + 4], 0
pop edi
pop esi
pop ebx
pop ebp
ret 0xc
cmp eax, esi
jne 0x475ca6
mov dword [ecx], edi
jmp 0x475cc0
mov eax, dword [ecx + 4]
mov eax, dword [eax]
mov dword [ecx + 4], eax
cmp eax, edi
je 0x475cc0
mov ecx, dword [ebx + 8]
mov eax, dword [ecx + edx + 4]
mov eax, dword [eax + 4]
mov dword [ecx + edx + 4], eax
mov ecx, ebx
call fcn.004769c0
mov eax, dword [ebp + 8]
mov dword [eax], edi
pop edi
pop esi
mov byte [eax + 4], 1
pop ebx
pop ebp
ret 0xc
Function at 0x4777d0
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push ecx
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
mov ebx, ecx
movzx eax, byte [edi]
xor eax, 0x811c9dc5
imul edx, eax, 0x1000193
movzx eax, byte [edi + 1]
xor edx, eax
movzx eax, byte [edi + 2]
imul edx, edx, 0x1000193
xor edx, eax
movzx eax, byte [edi + 3]
imul ecx, edx, 0x1000193
mov edx, dword [ebx + 0x14]
xor ecx, eax
imul ecx, ecx, 0x1000193
and ecx, edx
cmp dword [ebx + 0x18], ecx
ja 0x477824
shr edx, 1
or eax, 0xffffffff
sub eax, edx
add ecx, eax
mov esi, dword [ebx]
lea edx, [ecx*8]
mov ecx, dword [ebx + 8]
mov dword [esp + 0xc], edx
mov eax, dword [ecx + edx]
cmp esi, eax
je 0x477853
mov esi, dword [ecx + edx + 4]
mov esi, dword [esi]
cmp esi, eax
je 0x477853
mov ecx, dword [edi]
mov esi, dword [esi + 4]
cmp dword [esi + 8], ecx
je 0x477897
cmp esi, eax
jne 0x477847
mov edi, dword [ebp + 0x10]
mov eax, dword [edi]
cmp esi, eax
je 0x477881
mov ecx, dword [edi + 4]
mov dword [ecx], eax
mov ecx, dword [eax + 4]
mov dword [ecx], esi
mov ecx, dword [esi + 4]
mov dword [ecx], edi
mov edx, dword [esi + 4]
mov ecx, dword [eax + 4]
mov dword [esi + 4], ecx
mov ecx, dword [edi + 4]
mov dword [eax + 4], ecx
mov dword [edi + 4], edx
mov edx, dword [esp + 0xc]
mov ecx, dword [ebx + 8]
add ecx, edx
mov eax, dword [ecx]
cmp eax, dword [ebx]
jne 0x4778b3
mov dword [ecx], edi
mov eax, dword [ebx + 8]
mov dword [eax + edx + 4], edi
jmp 0x4778d5
push dword [ebp + 0x10]
mov ecx, ebx
call fcn.004789e0
mov eax, dword [ebp + 8]
mov dword [eax], esi
mov byte [eax + 4], 0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
cmp eax, esi
jne 0x4778bb
mov dword [ecx], edi
jmp 0x4778d5
mov eax, dword [ecx + 4]
mov eax, dword [eax]
mov dword [ecx + 4], eax
cmp eax, edi
je 0x4778d5
mov ecx, dword [ebx + 8]
mov eax, dword [ecx + edx + 4]
mov eax, dword [eax + 4]
mov dword [ecx + edx + 4], eax
mov ecx, ebx
call fcn.00478a90
mov eax, dword [ebp + 8]
mov dword [eax], edi
pop edi
pop esi
mov byte [eax + 4], 1
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x477930
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
mov ebx, ecx
movzx eax, byte [edi]
xor eax, 0x811c9dc5
imul edx, eax, 0x1000193
movzx eax, byte [edi + 1]
xor edx, eax
movzx eax, byte [edi + 2]
imul edx, edx, 0x1000193
xor edx, eax
movzx eax, byte [edi + 3]
imul ecx, edx, 0x1000193
mov edx, dword [ebx + 0x14]
xor ecx, eax
imul eax, ecx, 0x1000193
mov ecx, edx
and ecx, eax
cmp dword [ebx + 0x18], ecx
ja 0x477982
shr edx, 1
or eax, 0xffffffff
sub eax, edx
add ecx, eax
mov esi, dword [ebx]
lea edx, [ecx*8]
mov ecx, dword [ebx + 8]
mov dword [ebp + 0xc], edx
mov eax, dword [ecx + edx]
cmp esi, eax
je 0x4779b0
mov esi, dword [ecx + edx + 4]
mov esi, dword [esi]
cmp esi, eax
je 0x4779b0
mov ecx, dword [edi]
mov esi, dword [esi + 4]
cmp dword [esi + 8], ecx
je 0x4779f3
cmp esi, eax
jne 0x4779a4
mov edi, dword [ebp + 0x10]
mov eax, dword [edi]
cmp esi, eax
je 0x4779dd
mov ecx, dword [edi + 4]
mov dword [ecx], eax
mov ecx, dword [eax + 4]
mov dword [ecx], esi
mov ecx, dword [esi + 4]
mov dword [ecx], edi
mov edx, dword [esi + 4]
mov ecx, dword [eax + 4]
mov dword [esi + 4], ecx
mov ecx, dword [edi + 4]
mov dword [eax + 4], ecx
mov dword [edi + 4], edx
mov edx, dword [ebp + 0xc]
mov ecx, dword [ebx + 8]
add ecx, edx
mov eax, dword [ecx]
cmp eax, dword [ebx]
jne 0x477a21
mov dword [ecx], edi
mov eax, dword [ebx + 8]
mov dword [eax + edx + 4], edi
jmp 0x477a43
mov edx, dword [ebp + 0x10]
push edx
mov ecx, dword [edx + 4]
mov eax, dword [edx]
mov dword [ecx], eax
mov ecx, dword [edx]
mov eax, dword [edx + 4]
mov dword [ecx + 4], eax
dec dword [ebx + 4]
call fcn.004d8fe0
mov eax, dword [ebp + 8]
add esp, 4
pop edi
mov dword [eax], esi
pop esi
mov byte [eax + 4], 0
pop ebx
pop ebp
ret 0xc
cmp eax, esi
jne 0x477a29
mov dword [ecx], edi
jmp 0x477a43
mov eax, dword [ecx + 4]
mov eax, dword [eax]
mov dword [ecx + 4], eax
cmp eax, edi
je 0x477a43
mov ecx, dword [ebx + 8]
mov eax, dword [ecx + edx + 4]
mov eax, dword [eax + 4]
mov dword [ecx + edx + 4], eax
mov ecx, ebx
call fcn.00478c30
mov eax, dword [ebp + 8]
mov dword [eax], edi
pop edi
pop esi
mov byte [eax + 4], 1
pop ebx
pop ebp
ret 0xc
Function at 0x477a80
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push ecx
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
mov ebx, ecx
movzx eax, byte [edi]
xor eax, 0x811c9dc5
imul edx, eax, 0x1000193
movzx eax, byte [edi + 1]
xor edx, eax
movzx eax, byte [edi + 2]
imul edx, edx, 0x1000193
xor edx, eax
movzx eax, byte [edi + 3]
imul ecx, edx, 0x1000193
mov edx, dword [ebx + 0x14]
xor ecx, eax
imul ecx, ecx, 0x1000193
and ecx, edx
cmp dword [ebx + 0x18], ecx
ja 0x477ad4
shr edx, 1
or eax, 0xffffffff
sub eax, edx
add ecx, eax
mov esi, dword [ebx]
lea edx, [ecx*8]
mov ecx, dword [ebx + 8]
mov dword [esp + 0xc], edx
mov eax, dword [ecx + edx]
cmp esi, eax
je 0x477b03
mov esi, dword [ecx + edx + 4]
mov esi, dword [esi]
cmp esi, eax
je 0x477b03
mov ecx, dword [edi]
mov esi, dword [esi + 4]
cmp dword [esi + 8], ecx
je 0x477b47
cmp esi, eax
jne 0x477af7
mov edi, dword [ebp + 0x10]
mov eax, dword [edi]
cmp esi, eax
je 0x477b31
mov ecx, dword [edi + 4]
mov dword [ecx], eax
mov ecx, dword [eax + 4]
mov dword [ecx], esi
mov ecx, dword [esi + 4]
mov dword [ecx], edi
mov edx, dword [esi + 4]
mov ecx, dword [eax + 4]
mov dword [esi + 4], ecx
mov ecx, dword [edi + 4]
mov dword [eax + 4], ecx
mov dword [edi + 4], edx
mov edx, dword [esp + 0xc]
mov ecx, dword [ebx + 8]
add ecx, edx
mov eax, dword [ecx]
cmp eax, dword [ebx]
jne 0x477b63
mov dword [ecx], edi
mov eax, dword [ebx + 8]
mov dword [eax + edx + 4], edi
jmp 0x477b85
push dword [ebp + 0x10]
mov ecx, ebx
call fcn.00478d40
mov eax, dword [ebp + 8]
mov dword [eax], esi
mov byte [eax + 4], 0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
cmp eax, esi
jne 0x477b6b
mov dword [ecx], edi
jmp 0x477b85
mov eax, dword [ecx + 4]
mov eax, dword [eax]
mov dword [ecx + 4], eax
cmp eax, edi
je 0x477b85
mov ecx, dword [ebx + 8]
mov eax, dword [ecx + edx + 4]
mov eax, dword [eax + 4]
mov dword [ecx + edx + 4], eax
mov ecx, ebx
call fcn.00478de0
mov eax, dword [ebp + 8]
mov dword [eax], edi
pop edi
pop esi
mov byte [eax + 4], 1
pop ebx
mov esp, ebp
pop ebp
ret 0xc