joyce8/EMBER2024-capa huggingface dataset:
Function at 0x401000
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x41b008]
jne 0x40100a
repz ret
jmp fcn.00401d08

Function at 0x405b0a
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.00403331
and dword [ebp - 4], 0
cmp dword [0x41d134], 0
mov ebx, eax
jne 0x405bbb
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x405c6c
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x405c6c
push eax
call fcn.004032bf
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x41d134], eax
call esi
push eax
call fcn.004032bf
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x41d138], eax
call esi
push eax
call fcn.004032bf
mov dword [esp], 0x41896c
push edi
mov dword [0x41d13c], eax
call esi
push eax
call fcn.004032bf
pop ecx
mov dword [0x41d144], eax
test eax, eax
je 0x405bbb
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.004032bf
pop ecx
mov dword [0x41d140], eax
mov eax, dword [0x41d140]
cmp eax, ebx
je 0x405c13
cmp dword [0x41d144], ebx
je 0x405c13
push eax
call fcn.0040333a
push dword [0x41d144]
mov esi, eax
call fcn.0040333a
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x405c13
test edi, edi
je 0x405c13
call esi
test eax, eax
je 0x405c0a
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x405c0a
test byte [ebp - 0xc], 1
jne 0x405c13
or dword [ebp + 0x10], 0x200000
jmp 0x405c4c
mov eax, dword [0x41d138]
cmp eax, ebx
je 0x405c4c
push eax
call fcn.0040333a
pop ecx
test eax, eax
je 0x405c4c
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x405c4c
mov eax, dword [0x41d13c]
cmp eax, ebx
je 0x405c4c
push eax
call fcn.0040333a
pop ecx
test eax, eax
je 0x405c4c
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x41d134]
call fcn.0040333a
pop ecx
test eax, eax
je 0x405c6c
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x405c6e
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x416d70
Capabilities:
Get hostname

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x102c
call fcn.00407230
mov eax, dword [0x41b008]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x100c], eax
cmp ebx, 0x182
jne 0x416da9
lea ecx, [ebp - 0x102c]
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_BuildCommDCBA]
jmp 0x416db9
cmp ebx, 0x19f
jne 0x416db9
push 0
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsA]
push edi
xor edi, edi
test ebx, ebx
jle 0x416e3d
push esi
jmp 0x416dd0
lea esi, [ebp - 0x1008]
mov dword [ebp - 0x1008], 0
call fcn.00416d60
mov dl, byte [ebp - 0x1008]
mov eax, dword [ebp - 0x100c]
xor byte [eax + edi], dl
cmp ebx, 0xf
jne 0x416e37
lea eax, [ebp - 0x1010]
push eax
lea ecx, [ebp - 0x1004]
push ecx
call dword [sym.imp.KERNEL32.dll_GetComputerNameW]
push str.dihitevoxiniw
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetCalendarInfoW]
push 0
lea edx, [ebp - 0x804]
push edx
push 0
call dword [sym.imp.KERNEL32.dll_GetShortPathNameW]
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
inc edi
cmp edi, ebx
jl 0x416dd0
pop esi
pop edi
cmp ebx, 0x2d
jne 0x416e57
mov dword [0x512e20], 0xa62e7790
mov dword [0x512e24], 0xffffffff
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00401000
mov esp, ebp
pop ebp
ret

Function at 0x416e70
Capabilities:
Get disk information

Disassembly:
mov eax, dword [0x512cec]
push ebx
push esi
mov esi, dword [0x512b34]
mov ebx, eax
cmp eax, 0x5dd
jne 0x416e92
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_QueryDosDeviceW]
mov eax, dword [0x41bef0]
call fcn.00416d30
cmp dword [0x512cec], 0x2f
jne 0x416ead
push 0
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsA]
push esi
call fcn.00416d70
add esp, 4
cmp dword [0x512cec], 0x568
pop esi
pop ebx
jne 0x416eda
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_HeapCreate]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetNumaProcessorNode]
ret
Function at 0x40bee0
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], ecx
mov eax, dword [ebp - 4]
mov byte [eax + 0x68], 0
mov ecx, 4
shl ecx, 0
mov edx, dword [ebp - 4]
mov dword [edx + ecx + 0x10], 0
mov eax, 4
imul ecx, eax, 0
mov edx, dword [ebp - 4]
mov dword [edx + ecx + 0x10], 0
mov eax, 4
imul ecx, eax, 0
mov edx, dword [ebp - 4]
mov dword [edx + ecx], 0x67452301
mov eax, 4
shl eax, 0
mov ecx, dword [ebp - 4]
mov dword [ecx + eax], 0xefcdab89
mov edx, 4
shl edx, 1
mov eax, dword [ebp - 4]
mov dword [eax + edx], 0x98badcfe
mov ecx, 4
imul edx, ecx, 3
mov eax, dword [ebp - 4]
mov dword [eax + edx], 0x10325476
mov esp, ebp
pop ebp
ret

Function at 0x414bc0
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x78d6b1
mov eax, dword fs:[0]
push eax
sub esp, 0x30
mov eax, dword [0x866204]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x2c], ecx
mov dword [ebp - 0x30], 0
mov ecx, dword [ebp - 0x2c]
call fcn.00403680
mov dword [ebp - 4], 0
mov ecx, dword [ebp - 0x2c]
add ecx, 0x18
call fcn.00403680
mov byte [ebp - 4], 1
mov ecx, dword [ebp - 0x2c]
add ecx, 0x30
call fcn.00403680
mov byte [ebp - 4], 2
mov ecx, dword [ebp - 0x2c]
add ecx, 0x48
call fcn.00403680
mov byte [ebp - 4], 3
mov ecx, dword [ebp - 0x2c]
add ecx, 0x60
call fcn.00403680
mov byte [ebp - 4], 4
push 0x64
call fcn.00742089
add esp, 4
mov dword [ebp - 0x34], eax
mov byte [ebp - 4], 5
cmp dword [ebp - 0x34], 0
je 0x414c87
push 0x844b7f
lea ecx, [ebp - 0x28]
call fcn.00403560
mov byte [ebp - 4], 6
mov eax, dword [ebp - 0x30]
or eax, 1
mov dword [ebp - 0x30], eax
lea ecx, [ebp - 0x28]
push ecx
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 0x34]
call fcn.00413f50
mov dword [ebp - 0x38], eax
jmp 0x414c8e
mov dword [ebp - 0x38], 0
mov ecx, dword [ebp - 0x38]
mov dword [ebp - 0x3c], ecx
mov dword [ebp - 4], 7
mov edx, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x3c]
mov dword [edx + 0x78], eax
mov dword [ebp - 4], 4
mov ecx, dword [ebp - 0x30]
and ecx, 1
je 0x414cbf
and dword [ebp - 0x30], 0xfffffffe
lea ecx, [ebp - 0x28]
call fcn.004034e0
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x2c]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00742073
mov esp, ebp
pop ebp
ret 8
Function at 0x41d0a0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x78d0c6
mov eax, dword fs:[0]
push eax
push ecx
mov eax, dword [0x866204]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], ecx
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp + 8]
mov edx, dword [ecx]
mov dword [eax], edx
mov eax, dword [ebp + 8]
add eax, 8
mov ecx, dword [ebp - 0x10]
add ecx, 8
mov edx, dword [eax]
mov dword [ecx], edx
mov edx, dword [eax + 4]
mov dword [ecx + 4], edx
mov edx, dword [eax + 8]
mov dword [ecx + 8], edx
mov eax, dword [eax + 0xc]
mov dword [ecx + 0xc], eax
mov ecx, dword [ebp + 8]
add ecx, 0x18
push ecx
mov ecx, dword [ebp - 0x10]
add ecx, 0x18
call fcn.004036c0
mov dword [ebp - 4], 0
mov edx, dword [ebp + 8]
add edx, 0x30
push edx
mov ecx, dword [ebp - 0x10]
add ecx, 0x30
call fcn.00416380
mov byte [ebp - 4], 1
mov eax, dword [ebp + 8]
add eax, 0x3c
push eax
mov ecx, dword [ebp - 0x10]
add ecx, 0x3c
call fcn.00416200
mov byte [ebp - 4], 2
mov ecx, dword [ebp + 8]
add ecx, 0x48
push ecx
mov ecx, dword [ebp - 0x10]
add ecx, 0x48
call fcn.00413400
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret 4

Function at 0x435f70
Capabilities:
Hash data using djb2

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
mov edi, dword [ebp + 8]
xor esi, esi
mov ecx, 0x1505
test edi, edi
jne 0x435f89
pop edi
xor eax, eax
pop esi
pop ebp
ret
push ebx
mov bl, byte [edi]
test bl, bl
je 0x435fb0
mov eax, ecx
lea edi, [edi + 1]
mov edx, esi
shld esi, ecx, 5
shl ecx, 5
add ecx, eax
movzx eax, bl
mov bl, byte [edi]
adc esi, edx
cdq
add ecx, eax
adc esi, edx
test bl, bl
jne 0x435f90
pop ebx
pop edi
mov eax, ecx
pop esi
pop ebp
ret

Function at 0x4372a0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
xor edx, edx
push edi
xor edi, edi
bts edi, eax
cmp eax, 0x20
cmovae edx, edi
xor edi, edx
cmp eax, 0x40
mov eax, dword [ebp + 0xc]
cmovae edx, edi
test eax, eax
js 0x4372ec
push ebx
push esi
lea ebx, [ebp + 0xc]
xor ecx, ecx
lea ebx, [ebx + 4]
bts ecx, eax
xor esi, esi
cmp eax, 0x20
cmovae esi, ecx
xor ecx, esi
cmp eax, 0x40
mov eax, dword [ebx]
cmovae esi, ecx
or edi, ecx
or edx, esi
test eax, eax
jns 0x4372c8
pop esi
pop ebx
mov eax, edi
pop edi
pop ebp
ret
Function at 0x43e540
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
cmp dword [ebp + 0x18], 0
xorps xmm0, xmm0
movlpd qword [ebp - 0x10], xmm0
jb 0x43e601
ja 0x43e564
cmp dword [ebp + 0x14], 0
jbe 0x43e601
mov eax, dword [ebp - 0xc]
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, dword [ebp - 0x10]
push edi
movzx ecx, word [ebx + 8]
mov edi, dword [ebp + 0xc]
mov dword [ebp - 8], eax
nop word [eax + eax]
mov eax, dword [ebp + 0x10]
mov al, byte [esi + eax]
test edi, edi
je 0x43e5a0
movzx edx, cx
or edx, 2
mov ecx, edx
xor ecx, 1
imul ecx, edx
shr ecx, 8
xor al, cl
mov byte [esi + edi], al
mov byte [ebp - 4], al
lea eax, [ebp - 4]
push 1
push eax
mov eax, dword [ebx]
not eax
push eax
call fcn.004414b0
not eax
mov dword [ebx], eax
movzx eax, al
add eax, dword [ebx + 4]
imul eax, eax, 0x8088405
push 1
inc eax
mov dword [ebx + 4], eax
shr eax, 0x18
mov byte [ebp - 4], al
lea eax, [ebp - 4]
push eax
mov eax, dword [ebx + 8]
not eax
push eax
call fcn.004414b0
mov edx, dword [ebp - 8]
add esi, 1
not eax
adc edx, 0
mov dword [ebx + 8], eax
mov dword [ebp - 8], edx
movzx ecx, ax
cmp edx, dword [ebp + 0x18]
jb 0x43e580
ja 0x43e5fe
cmp esi, dword [ebp + 0x14]
jb 0x43e580
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x43e610
Capabilities:
Encode data using xor
Generate random numbers using the delphi lcg

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
cmp dword [ebp + 0x18], 0
xorps xmm0, xmm0
push esi
mov esi, dword [ebp + 8]
movlpd qword [ebp - 0xc], xmm0
jb 0x43e753
push ebx
mov ebx, dword [ebp + 0x14]
ja 0x43e63a
test ebx, ebx
je 0x43e752
cmp dword [ebp + 0xc], 0
push edi
je 0x43e6e3
mov eax, dword [ebp - 8]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 8], eax
mov ecx, dword [ebp + 0x10]
push 1
mov bl, byte [eax + ecx]
mov ax, word [esi + 8]
or ax, 2
mov byte [ebp - 4], bl
movzx edi, ax
lea eax, [ebp - 4]
push eax
mov eax, dword [esi]
not eax
push eax
call fcn.004414b0
not eax
mov dword [esi], eax
movzx eax, al
add eax, dword [esi + 4]
imul eax, eax, 0x8088405
push 1
inc eax
mov dword [esi + 4], eax
shr eax, 0x18
mov byte [ebp - 4], al
lea eax, [ebp - 4]
push eax
mov eax, dword [esi + 8]
not eax
push eax
call fcn.004414b0
mov edx, dword [ebp + 0xc]
not eax
mov dword [esi + 8], eax
mov eax, edi
mov ecx, edi
xor ecx, 1
imul ecx, eax
mov eax, dword [ebp - 8]
shr ecx, 8
xor cl, bl
mov byte [eax + edx], cl
add eax, 1
mov ecx, dword [ebp - 0x10]
adc ecx, 0
mov dword [ebp - 8], eax
mov dword [ebp - 0x10], ecx
cmp ecx, dword [ebp + 0x18]
jb 0x43e651
ja 0x43e751
cmp eax, dword [ebp + 0x14]
jb 0x43e651
pop edi
pop ebx
pop esi
mov esp, ebp
pop ebp
ret
movlpd qword [ebp - 0xc], xmm0
mov eax, dword [ebp - 8]
mov edi, dword [ebp - 0xc]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 0x10]
push 1
mov al, byte [edi + eax]
mov byte [ebp - 4], al
lea eax, [ebp - 4]
push eax
mov eax, dword [esi]
not eax
push eax
call fcn.004414b0
not eax
mov dword [esi], eax
movzx eax, al
add eax, dword [esi + 4]
imul eax, eax, 0x8088405
push 1
inc eax
mov dword [esi + 4], eax
shr eax, 0x18
mov byte [ebp - 4], al
lea eax, [ebp - 4]
push eax
mov eax, dword [esi + 8]
not eax
push eax
call fcn.004414b0
not eax
add edi, 1
mov dword [esi + 8], eax
mov eax, dword [ebp - 0x10]
adc eax, 0
mov dword [ebp - 0x10], eax
cmp eax, dword [ebp + 0x18]
jb 0x43e6f1
ja 0x43e751
cmp edi, ebx
jb 0x43e6f1
pop edi
pop ebx
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x4414b0
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
pop ebp
jmp fcn.004414c0

Function at 0x4417e0
Capabilities:
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 8]
movzx eax, dl
shr edx, 8
xor edx, dword [eax*4 + 0x79b5f0]
movzx eax, dl
shr edx, 8
xor edx, dword [eax*4 + 0x79b5f0]
movzx ecx, dl
shr edx, 8
xor edx, dword [ecx*4 + 0x79b5f0]
movzx ecx, dl
shr edx, 8
xor edx, dword [ecx*4 + 0x79b5f0]
mov eax, edx
pop ebp
ret

Function at 0x444dd0
Capabilities:
Compute adler32 checksum

Disassembly:
push ebp
mov ebp, esp
pop ebp
jmp fcn.00444de0
Function at 0x445060
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x24
mov edx, dword [esp + 0x38]
mov ecx, dword [esp + 0x3c]
mov eax, dword [edx + 0x78]
mov ebx, dword [edx + 0x8c]
cmp eax, ebx
mov eax, dword [edx + 0x34]
mov ebx, dword [edx + 0x7c]
jl 0x445085
shr ebx, 2
dec ebx
shl ebx, 0x10
or ebx, eax
mov dword [esp], ebx
mov eax, dword [edx + 0x90]
mov ebx, dword [edx + 0x74]
cmp ebx, eax
jl 0x44509d
mov ebx, eax
mov dword [esp + 0x18], ebx
mov esi, dword [edx + 0x38]
mov dword [esp + 4], esi
mov ebp, dword [edx + 0x6c]
lea edi, [esi + ebp]
mov dword [esp + 0x20], edi
mov eax, edi
neg eax
and eax, 3
mov dword [esp + 0x14], eax
mov eax, dword [edx + 0x2c]
sub eax, 0x106
sub ebp, eax
jg 0x4450cb
xor ebp, ebp
mov eax, dword [edx + 0x78]
mov dword [esp + 0x1c], eax
add esi, eax
mov dword [esp + 8], esi
movzx ebx, word [edi]
mov dword [esp + 0x10], ebx
movzx ebx, word [edi + eax - 1]
mov dword [esp + 0xc], ebx
mov edi, dword [edx + 0x40]
mov edx, dword [esp]
jmp 0x44510a
and ecx, edx
movzx ecx, word [edi + ecx*2]
cmp ecx, ebp
jbe 0x4451de
sub edx, 0x10000
js 0x4451de
movzx eax, word [esi + ecx - 1]
cmp eax, ebx
jne 0x4450f0
mov eax, dword [esp + 4]
movzx eax, word [eax + ecx]
cmp eax, dword [esp + 0x10]
jne 0x4450f0
mov dword [esp], edx
mov esi, dword [esp + 4]
mov edi, dword [esp + 0x20]
add esi, ecx
mov eax, dword [esp + 0x14]
mov edx, 0xfffffef8
lea edi, [edi + eax + 0x108]
lea esi, [esi + eax + 0x108]
mov eax, dword [esi + edx]
xor eax, dword [edi + edx]
jne 0x445161
mov eax, dword [esi + edx + 4]
xor eax, dword [edi + edx + 4]
jne 0x44515e
add edx, 8
jne 0x445145
jmp 0x4451cf
add edx, 4
test eax, 0xffff
jne 0x44516e
add edx, 2
shr eax, 0x10
sub al, 1
adc edx, 0
lea eax, [edi + edx]
mov edi, dword [esp + 0x20]
sub eax, edi
cmp eax, 0x102
jge 0x4451cf
mov edx, dword [esp + 0x38]
mov ebx, dword [esp + 0x1c]
cmp eax, ebx
jg 0x4451a2
mov esi, dword [esp + 8]
mov edi, dword [edx + 0x40]
mov ebx, dword [esp + 0xc]
mov edx, dword [esp]
jmp 0x4450f0
mov ebx, dword [esp + 0x18]
mov dword [esp + 0x1c], eax
mov dword [edx + 0x70], ecx
cmp eax, ebx
jge 0x4451de
mov esi, dword [esp + 4]
add esi, eax
mov dword [esp + 8], esi
movzx ebx, word [edi + eax - 1]
mov edi, dword [edx + 0x40]
mov dword [esp + 0xc], ebx
mov edx, dword [esp]
jmp 0x4450f0
mov edx, dword [esp + 0x38]
mov dword [esp + 0x1c], 0x102
mov dword [edx + 0x70], ecx
mov edx, dword [esp + 0x38]
mov ebx, dword [esp + 0x1c]
mov eax, dword [edx + 0x74]
cmp ebx, eax
jg 0x4451ef
mov eax, ebx
add esp, 0x24
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x45abd0
Capabilities:
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
mov eax, 4
imul ecx, eax, 0
movsx edx, byte [ebp + 0xc]
mov eax, dword [ebp + 8]
xor edx, dword [eax + ecx]
and edx, 0xff
mov ecx, 4
imul eax, ecx, 0
mov ecx, dword [ebp + 8]
mov eax, dword [ecx + eax]
shr eax, 8
xor eax, dword [edx*4 + 0x79fe68]
mov ecx, 4
imul edx, ecx, 0
mov ecx, dword [ebp + 8]
mov dword [ecx + edx], eax
mov edx, 4
shl edx, 0
mov eax, 4
imul ecx, eax, 0
mov eax, dword [ebp + 8]
mov ecx, dword [eax + ecx]
and ecx, 0xff
mov eax, dword [ebp + 8]
add ecx, dword [eax + edx]
mov edx, 4
shl edx, 0
mov eax, dword [ebp + 8]
mov dword [eax + edx], ecx
mov ecx, 4
shl ecx, 0
mov edx, dword [ebp + 8]
imul eax, dword [edx + ecx], 0x8088405
add eax, 1
mov ecx, 4
shl ecx, 0
mov edx, dword [ebp + 8]
mov dword [edx + ecx], eax
mov eax, 4
shl eax, 1
mov ecx, 4
shl ecx, 0
mov edx, dword [ebp + 8]
mov ecx, dword [edx + ecx]
shr ecx, 0x18
mov edx, dword [ebp + 8]
xor ecx, dword [edx + eax]
and ecx, 0xff
mov eax, 4
shl eax, 1
mov edx, dword [ebp + 8]
mov eax, dword [edx + eax]
shr eax, 8
xor eax, dword [ecx*4 + 0x79fe68]
mov ecx, 4
shl ecx, 1
mov edx, dword [ebp + 8]
mov dword [edx + ecx], eax
pop ebp
ret
Function at 0x45f7e8
Capabilities:
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
cmp dword [ebp + 0xc], 0
jne 0x45f7e0
xor eax, eax
jmp 0x45f97d
mov eax, dword [ebp + 8]
xor eax, 0xffffffff
mov dword [ebp + 8], eax
cmp dword [ebp + 0x10], 8
jb 0x45f93e
mov ecx, dword [ebp + 0xc]
movzx edx, byte [ecx]
xor edx, dword [ebp + 8]
and edx, 0xff
mov eax, dword [ebp + 8]
shr eax, 8
xor eax, dword [edx*4 + 0x79fe68]
mov dword [ebp + 8], eax
mov ecx, dword [ebp + 0xc]
add ecx, 1
mov dword [ebp + 0xc], ecx
mov edx, dword [ebp + 0xc]
movzx eax, byte [edx]
xor eax, dword [ebp + 8]
and eax, 0xff
mov ecx, dword [ebp + 8]
shr ecx, 8
xor ecx, dword [eax*4 + 0x79fe68]
mov dword [ebp + 8], ecx
mov edx, dword [ebp + 0xc]
add edx, 1
mov dword [ebp + 0xc], edx
mov eax, dword [ebp + 0xc]
movzx ecx, byte [eax]
xor ecx, dword [ebp + 8]
and ecx, 0xff
mov edx, dword [ebp + 8]
shr edx, 8
xor edx, dword [ecx*4 + 0x79fe68]
mov dword [ebp + 8], edx
mov eax, dword [ebp + 0xc]
add eax, 1
mov dword [ebp + 0xc], eax
mov ecx, dword [ebp + 0xc]
movzx edx, byte [ecx]
xor edx, dword [ebp + 8]
and edx, 0xff
mov eax, dword [ebp + 8]
shr eax, 8
xor eax, dword [edx*4 + 0x79fe68]
mov dword [ebp + 8], eax
mov ecx, dword [ebp + 0xc]
add ecx, 1
mov dword [ebp + 0xc], ecx
mov edx, dword [ebp + 0xc]
movzx eax, byte [edx]
xor eax, dword [ebp + 8]
and eax, 0xff
mov ecx, dword [ebp + 8]
shr ecx, 8
xor ecx, dword [eax*4 + 0x79fe68]
mov dword [ebp + 8], ecx
mov edx, dword [ebp + 0xc]
add edx, 1
mov dword [ebp + 0xc], edx
mov eax, dword [ebp + 0xc]
movzx ecx, byte [eax]
xor ecx, dword [ebp + 8]
and ecx, 0xff
mov edx, dword [ebp + 8]
shr edx, 8
xor edx, dword [ecx*4 + 0x79fe68]
mov dword [ebp + 8], edx
mov eax, dword [ebp + 0xc]
add eax, 1
mov dword [ebp + 0xc], eax
mov ecx, dword [ebp + 0xc]
movzx edx, byte [ecx]
xor edx, dword [ebp + 8]
and edx, 0xff
mov eax, dword [ebp + 8]
shr eax, 8
xor eax, dword [edx*4 + 0x79fe68]
mov dword [ebp + 8], eax
mov ecx, dword [ebp + 0xc]
add ecx, 1
mov dword [ebp + 0xc], ecx
mov edx, dword [ebp + 0xc]
movzx eax, byte [edx]
xor eax, dword [ebp + 8]
and eax, 0xff
mov ecx, dword [ebp + 8]
shr ecx, 8
xor ecx, dword [eax*4 + 0x79fe68]
mov dword [ebp + 8], ecx
mov edx, dword [ebp + 0xc]
add edx, 1
mov dword [ebp + 0xc], edx
mov eax, dword [ebp + 0x10]
sub eax, 8
mov dword [ebp + 0x10], eax
jmp 0x45f7e9
cmp dword [ebp + 0x10], 0
je 0x45f977
mov ecx, dword [ebp + 0xc]
movzx edx, byte [ecx]
xor edx, dword [ebp + 8]
and edx, 0xff
mov eax, dword [ebp + 8]
shr eax, 8
xor eax, dword [edx*4 + 0x79fe68]
mov dword [ebp + 8], eax
mov ecx, dword [ebp + 0xc]
add ecx, 1
mov dword [ebp + 0xc], ecx
mov edx, dword [ebp + 0x10]
sub edx, 1
mov dword [ebp + 0x10], edx
jne 0x45f944
mov eax, dword [ebp + 8]
xor eax, 0xffffffff
pop ebp
ret
Function at 0x45f82a
Capabilities:
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
cmp dword [ebp + 0xc], 0
jne 0x45f7e0
xor eax, eax
jmp 0x45f97d
mov eax, dword [ebp + 8]
xor eax, 0xffffffff
mov dword [ebp + 8], eax
cmp dword [ebp + 0x10], 8
jb 0x45f93e
mov ecx, dword [ebp + 0xc]
movzx edx, byte [ecx]
xor edx, dword [ebp + 8]
and edx, 0xff
mov eax, dword [ebp + 8]
shr eax, 8
xor eax, dword [edx*4 + 0x79fe68]
mov dword [ebp + 8], eax
mov ecx, dword [ebp + 0xc]
add ecx, 1
mov dword [ebp + 0xc], ecx
mov edx, dword [ebp + 0xc]
movzx eax, byte [edx]
xor eax, dword [ebp + 8]
and eax, 0xff
mov ecx, dword [ebp + 8]
shr ecx, 8
xor ecx, dword [eax*4 + 0x79fe68]
mov dword [ebp + 8], ecx
mov edx, dword [ebp + 0xc]
add edx, 1
mov dword [ebp + 0xc], edx
mov eax, dword [ebp + 0xc]
movzx ecx, byte [eax]
xor ecx, dword [ebp + 8]
and ecx, 0xff
mov edx, dword [ebp + 8]
shr edx, 8
xor edx, dword [ecx*4 + 0x79fe68]
mov dword [ebp + 8], edx
mov eax, dword [ebp + 0xc]
add eax, 1
mov dword [ebp + 0xc], eax
mov ecx, dword [ebp + 0xc]
movzx edx, byte [ecx]
xor edx, dword [ebp + 8]
and edx, 0xff
mov eax, dword [ebp + 8]
shr eax, 8
xor eax, dword [edx*4 + 0x79fe68]
mov dword [ebp + 8], eax
mov ecx, dword [ebp + 0xc]
add ecx, 1
mov dword [ebp + 0xc], ecx
mov edx, dword [ebp + 0xc]
movzx eax, byte [edx]
xor eax, dword [ebp + 8]
and eax, 0xff
mov ecx, dword [ebp + 8]
shr ecx, 8
xor ecx, dword [eax*4 + 0x79fe68]
mov dword [ebp + 8], ecx
mov edx, dword [ebp + 0xc]
add edx, 1
mov dword [ebp + 0xc], edx
mov eax, dword [ebp + 0xc]
movzx ecx, byte [eax]
xor ecx, dword [ebp + 8]
and ecx, 0xff
mov edx, dword [ebp + 8]
shr edx, 8
xor edx, dword [ecx*4 + 0x79fe68]
mov dword [ebp + 8], edx
mov eax, dword [ebp + 0xc]
add eax, 1
mov dword [ebp + 0xc], eax
mov ecx, dword [ebp + 0xc]
movzx edx, byte [ecx]
xor edx, dword [ebp + 8]
and edx, 0xff
mov eax, dword [ebp + 8]
shr eax, 8
xor eax, dword [edx*4 + 0x79fe68]
mov dword [ebp + 8], eax
mov ecx, dword [ebp + 0xc]
add ecx, 1
mov dword [ebp + 0xc], ecx
mov edx, dword [ebp + 0xc]
movzx eax, byte [edx]
xor eax, dword [ebp + 8]
and eax, 0xff
mov ecx, dword [ebp + 8]
shr ecx, 8
xor ecx, dword [eax*4 + 0x79fe68]
mov dword [ebp + 8], ecx
mov edx, dword [ebp + 0xc]
add edx, 1
mov dword [ebp + 0xc], edx
mov eax, dword [ebp + 0x10]
sub eax, 8
mov dword [ebp + 0x10], eax
jmp 0x45f7e9
cmp dword [ebp + 0x10], 0
je 0x45f977
mov ecx, dword [ebp + 0xc]
movzx edx, byte [ecx]
xor edx, dword [ebp + 8]
and edx, 0xff
mov eax, dword [ebp + 8]
shr eax, 8
xor eax, dword [edx*4 + 0x79fe68]
mov dword [ebp + 8], eax
mov ecx, dword [ebp + 0xc]
add ecx, 1
mov dword [ebp + 0xc], ecx
mov edx, dword [ebp + 0x10]
sub edx, 1
mov dword [ebp + 0x10], edx
jne 0x45f944
mov eax, dword [ebp + 8]
xor eax, 0xffffffff
pop ebp
ret