joyce8/EMBER2024-capa huggingface dataset:
Function at 0x44e960
Capabilities:
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x549260
mov eax, dword fs:[0]
push eax
sub esp, 0x4c
mov eax, dword [0x5953ec]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
xor bl, bl
mov eax, esi
cmp dword [esi + 0x14], 8
jb 0x44e999
mov eax, dword [esi]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
test al, 4
je 0x44e9ab
mov bl, 1
jmp 0x44eaff
mov eax, dword [0x59f9e4]
test al, 1
jne 0x44e9c6
or eax, 1
mov dword [0x59fa00], 0
mov dword [0x59f9e4], eax
xorps xmm0, xmm0
mov byte [ebp - 0x51], 0
movlpd qword [ebp - 0x18], xmm0
lea eax, [ebp - 0x18]
mov dword [ebp - 4], 0
push eax
call fcn.00461c85
mov dword [ebp - 4], 1
lea eax, [ebp - 0x18]
mov dword [ebp - 0x20], eax
lea eax, [ebp - 0x51]
mov dword [ebp - 0x1c], eax
lea eax, [ebp - 0x20]
push eax
push 0x454c90
push 0x59fa00
call fcn.00461f6e
add esp, 0x10
test eax, eax
je 0x44eb1d
lea eax, [ebp - 0x18]
mov dword [ebp - 4], 2
push eax
call fcn.00461cbf
sub esp, 0x14
mov dword [ebp - 4], 0xffffffff
mov edx, esp
mov ecx, 0x59f514
xor eax, eax
mov dword [edx + 0x10], 0
lea edi, [ecx + 2]
mov dword [edx + 0x14], 7
mov word [edx], ax
nop word [eax + eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x44ea50
sub ecx, edi
sar ecx, 1
push ecx
push 0x59f514
mov ecx, edx
call fcn.00428650
lea ecx, [ebp - 0x50]
call fcn.0044ef80
add esp, 0x18
mov dword [ebp - 4], 5
lea ecx, [ebp - 0x50]
cmp dword [ebp - 0x3c], 8
mov eax, esi
cmovae ecx, dword [ebp - 0x50]
cmp dword [esi + 0x14], 8
jb 0x44ea93
mov eax, dword [esi]
push ecx
push eax
call dword [sym.imp.SHLWAPI.dll_StrStrIW]
test eax, eax
je 0x44eaa3
mov bl, 1
jmp 0x44eaf7
mov edx, esi
lea ecx, [ebp - 0x38]
call fcn.00450330
cmp dword [ebp - 0x28], 0
je 0x44eaef
mov esi, dword [0x59e474]
mov edi, dword [0x59e478]
cmp esi, edi
je 0x44eaef
cmp dword [esi + 0x14], 8
mov ecx, esi
jb 0x44eacd
mov ecx, dword [esi]
cmp dword [ebp - 0x24], 8
lea eax, [ebp - 0x38]
push ecx
cmovae eax, dword [ebp - 0x38]
push eax
call dword [sym.imp.SHLWAPI.dll_StrStrIW]
test eax, eax
jne 0x44eaed
add esi, 0x18
cmp esi, edi
jne 0x44eac3
jmp 0x44eaef
mov bl, 1
lea ecx, [ebp - 0x38]
call fcn.004282d0
lea ecx, [ebp - 0x50]
call fcn.004282d0
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004e059c
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x18]
mov byte [ebp - 4], 3
push eax
call fcn.00461ce0
add esp, 4
mov byte [ebp - 4], 1
test al, al
jne 0x44eb3a
call fcn.00461f86
sub esp, 8
lea eax, [ebp - 0x18]
mov ecx, esp
push eax
call fcn.00411740
call fcn.00411800
int3
Function at 0x44f550
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x5c
mov eax, dword [0x5953ec]
xor eax, ebp
mov dword [ebp - 4], eax
xor eax, eax
mov dword [ebp - 0x5c], 0x6e0075
push ebx
push esi
mov word [ebp - 8], ax
lea esi, [ebp - 0x5c]
mov eax, 0x59f270
mov dword [ebp - 0x58], 0x620061
push edi
mov dword [ebp - 0x54], 0x65006c
mov edx, 0x2b
mov dword [ebp - 0x50], 0x740020
sub esi, eax
mov dword [ebp - 0x4c], 0x20006f
mov dword [ebp - 0x48], 0x720063
mov dword [ebp - 0x44], 0x610065
mov dword [ebp - 0x40], 0x650074
mov dword [ebp - 0x3c], 0x490020
mov dword [ebp - 0x38], 0x6e004b
mov dword [ebp - 0x34], 0x77006f
mov dword [ebp - 0x30], 0x46006e
mov dword [ebp - 0x2c], 0x6c006f
mov dword [ebp - 0x28], 0x650064
mov dword [ebp - 0x24], 0x4d0072
mov dword [ebp - 0x20], 0x6e0061
mov dword [ebp - 0x1c], 0x670061
mov dword [ebp - 0x18], 0x720065
mov dword [ebp - 0x14], 0x20002e
mov dword [ebp - 0x10], 0x720068
mov dword [ebp - 0xc], 0x20003a
nop dword [eax + eax]
lea ecx, [edx + 0x7fffffd3]
test ecx, ecx
je 0x44f62e
movzx ecx, word [esi + eax]
test cx, cx
je 0x44f62e
mov word [eax], cx
add eax, 2
sub edx, 1
jne 0x44f610
test edx, edx
lea ecx, [eax - 2]
pop edi
cmovne ecx, eax
xor eax, eax
pop esi
pop ebx
mov word [ecx], ax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004e059c
mov esp, ebp
pop ebp
ret
Function at 0x44f6a0
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x549408
mov eax, dword fs:[0]
push eax
sub esp, 0x2c
mov eax, dword [0x5953ec]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, edx
mov esi, ecx
mov dword [ebp - 0x34], esi
xor eax, eax
mov dword [ebp - 0x34], esi
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 7
mov word [ebp - 0x28], ax
mov dword [ebp - 4], eax
cmp dword [edi + 0x10], eax
je 0x44f797
cmp dword [edi + 0x14], 8
mov dword [ebp - 0x2c], eax
mov eax, edi
jb 0x44f701
mov eax, dword [edi]
push 1
lea ecx, [ebp - 0x2c]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
mov dword [ebp - 0x34], eax
test eax, eax
je 0x44f797
xor ecx, ecx
inc eax
mov edx, 2
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
mov dword [ebp - 0x38], ecx
call fcn.004e0b6f
add esp, 4
mov dword [ebp - 0x30], eax
test eax, eax
je 0x44f755
push dword [ebp - 0x38]
push 0
push eax
call fcn.00519fc0
mov eax, dword [ebp - 0x30]
add esp, 0xc
xor ecx, ecx
mov word [eax], cx
jmp 0x44f75a
xor eax, eax
mov dword [ebp - 0x30], eax
cmp dword [edi + 0x14], 8
jb 0x44f762
mov edi, dword [edi]
push dword [ebp - 0x34]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
mov edi, dword [ebp - 0x30]
mov ecx, edi
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x44f775
sub ecx, edx
sar ecx, 1
push ecx
push edi
lea ecx, [ebp - 0x28]
call fcn.00428650
push edi
call fcn.004e0b9b
add esp, 4
movups xmm0, xmmword [ebp - 0x28]
mov dword [esi + 0x10], 0
lea ecx, [ebp - 0x28]
mov dword [esi + 0x14], 0
xor eax, eax
movups xmmword [esi], xmm0
mov word [ebp - 0x28], ax
movq xmm0, qword [ebp - 0x18]
movq qword [esi + 0x10], xmm0
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], 7
call fcn.004282d0
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004e059c
mov esp, ebp
pop ebp
ret
Function at 0x450a60
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5496f9
mov eax, dword fs:[0]
push eax
sub esp, 0x28
mov eax, dword [0x5953ec]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x14], esi
mov dword [ebp - 0x34], esi
xor eax, eax
mov dword [ebp - 0x18], 0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 7
mov word [esi], ax
mov dword [ebp - 4], eax
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x14]
push eax
push 0
push 0
push edx
mov dword [ebp - 0x18], 1
call dword [sym.imp.SHELL32.dll_SHGetKnownFolderPath]
test eax, eax
js 0x450b44
mov edx, dword [ebp - 0x14]
xor eax, eax
mov ecx, edx
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x1c], 7
mov word [ebp - 0x30], ax
lea edi, [ecx + 2]
nop dword [eax + eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x450af0
sub ecx, edi
sar ecx, 1
push ecx
push edx
lea ecx, [ebp - 0x30]
call fcn.00428650
lea eax, [ebp - 0x30]
cmp esi, eax
je 0x450b3c
mov ecx, esi
call fcn.004282d0
movups xmm0, xmmword [ebp - 0x30]
xor eax, eax
mov word [ebp - 0x30], ax
movups xmmword [esi], xmm0
movq xmm0, qword [ebp - 0x20]
movq qword [esi + 0x10], xmm0
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x1c], 7
lea ecx, [ebp - 0x30]
call fcn.004282d0
mov eax, dword [ebp - 0x14]
test eax, eax
je 0x450b52
push eax
call dword [sym.imp.ole32.dll_CoTaskMemFree]
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004e059c
mov esp, ebp
pop ebp
ret
Function at 0x451e50
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x14
cmp dword [ecx + 0x38], 0
push ebx
push esi
push edi
mov dword [esp + 0xc], ecx
je 0x451f3b
mov esi, dword [ebp + 0x10]
mov ebx, esi
mov edx, dword [ebp + 0xc]
mov edi, edx
mov eax, dword [ebp + 8]
mov dword [esp + 0x10], eax
test esi, esi
jl 0x451f2a
jg 0x451e90
test edx, edx
je 0x451f2a
nop dword [eax]
call fcn.00428a40
mov esi, eax
mov eax, edx
mov dword [esp + 0x14], eax
test eax, eax
jl 0x451ee7
jg 0x451ea7
test esi, esi
je 0x451ee7
cmp ebx, eax
jg 0x451eb7
jl 0x451eb1
cmp edi, esi
jae 0x451eb7
mov esi, edi
mov dword [esp + 0x14], ebx
mov eax, dword [esp + 0xc]
push esi
mov eax, dword [eax + 0x1c]
push dword [eax]
push dword [esp + 0x18]
call fcn.00519a40
mov ecx, dword [esp + 0x18]
add esp, 0xc
sub edi, esi
sbb ebx, dword [esp + 0x14]
mov eax, dword [ecx + 0x2c]
sub dword [eax], esi
mov eax, dword [ecx + 0x1c]
add dword [eax], esi
mov eax, dword [esp + 0x10]
jmp 0x451f0c
mov ecx, dword [esp + 0xc]
mov eax, dword [ecx]
call dword [eax + 0x1c]
mov ecx, eax
cmp ecx, 0xffffffff
je 0x451f24
mov eax, dword [esp + 0x10]
add edi, 0xffffffff
mov esi, 1
adc ebx, 0xffffffff
mov byte [eax], cl
mov ecx, dword [esp + 0xc]
add eax, esi
mov dword [esp + 0x10], eax
test ebx, ebx
jg 0x451e90
jl 0x451f24
test edi, edi
jne 0x451e90
mov edx, dword [ebp + 0xc]
mov esi, dword [ebp + 0x10]
sub edx, edi
mov eax, edx
sbb esi, ebx
mov edx, esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov eax, dword [ecx + 0x1c]
mov esi, dword [ebp + 0xc]
mov edi, dword [ebp + 0x10]
mov dword [esp + 0x18], esi
mov eax, dword [eax]
mov dword [esp + 0x1c], edi
mov dword [esp + 0x10], eax
test eax, eax
je 0x451f5d
mov eax, dword [ecx + 0x2c]
mov eax, dword [eax]
jmp 0x451f5f
xor eax, eax
cdq
mov ebx, eax
mov eax, edx
mov dword [esp + 0x14], eax
test edi, edi
jl 0x452015
jg 0x451f7a
test esi, esi
je 0x452015
test eax, eax
jl 0x451fc3
jg 0x451f84
test ebx, ebx
je 0x451fc3
cmp edi, eax
jg 0x451f94
jl 0x451f8e
cmp esi, ebx
jae 0x451f94
mov ebx, esi
mov dword [esp + 0x14], edi
push ebx
push dword [esp + 0x14]
push dword [ebp + 8]
call fcn.00519a40
mov ecx, dword [esp + 0x18]
add esp, 0xc
mov edx, dword [ebp + 8]
add edx, ebx
sub esi, ebx
mov dword [esp + 0x10], edx
mov eax, dword [ecx + 0x2c]
sbb edi, dword [esp + 0x14]
sub dword [eax], ebx
mov eax, dword [ecx + 0x1c]
add dword [eax], ebx
jmp 0x451fca
mov eax, dword [ebp + 8]
mov dword [esp + 0x10], eax
test edi, edi
jl 0x452015
jg 0x451fd4
test esi, esi
je 0x452015
mov edx, dword [ecx + 0x4c]
test edx, edx
je 0x452015
mov ebx, dword [ecx + 0xc]
lea eax, [ecx + 0x3c]
cmp dword [ebx], eax
jne 0x452000
mov edx, dword [ecx + 0x54]
mov ecx, dword [ecx + 0x50]
sub edx, ecx
mov dword [ebx], ecx
mov ebx, dword [esp + 0xc]
mov eax, dword [ebx + 0x1c]
mov dword [eax], ecx
mov eax, dword [ebx + 0x2c]
mov dword [eax], edx
mov edx, dword [ebx + 0x4c]
push edx
push esi
push 1
push dword [esp + 0x1c]
call fcn.00525169
add esp, 0x10
sub esi, eax
sbb edi, 0
mov eax, dword [esp + 0x18]
mov edx, dword [esp + 0x1c]
sub eax, esi
sbb edx, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x453410
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x546510
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x5953ec]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x10], edi
push 8
mov dword [edi], vtable.std::basic_streambuf_char__struct_std::char_traits_char__.0
call fcn.004e07b6
mov esi, eax
xorps xmm0, xmm0
movq qword [esi], xmm0
push 1
mov dword [ebp - 4], 0
call fcn.00462250
mov dword [esi + 4], eax
lea ecx, [edi + 8]
lea eax, [edi + 4]
mov dword [edi + 0x10], ecx
mov dword [edi + 0xc], eax
add esp, 8
lea eax, [edi + 0x14]
mov dword [edi + 0x34], esi
mov dword [edi + 0x1c], eax
lea eax, [edi + 0x18]
mov dword [edi + 0x20], eax
lea eax, [edi + 0x24]
mov dword [edi + 0x2c], eax
lea eax, [edi + 0x28]
mov dword [edi + 0x30], eax
mov dword [ecx], 0
mov ecx, edi
mov eax, dword [edi + 0x20]
push 0
push 0
mov dword [eax], 0
mov eax, dword [edi + 0x30]
mov dword [eax], 0
mov eax, dword [edi + 0xc]
mov dword [eax], 0
mov eax, dword [edi + 0x1c]
mov dword [eax], 0
mov eax, dword [edi + 0x2c]
mov dword [eax], 0
mov dword [edi], vtable.std::basic_filebuf_char__struct_std::char_traits_char__.0
call fcn.00453220
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4

Function at 0x454940
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 0xc]
mov ecx, 0
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, 0x811c9dc5
sub edx, edi
sar edx, 1
add edx, edx
je 0x454971
nop dword [eax]
movzx eax, byte [ecx + edi]
inc ecx
xor eax, esi
imul esi, eax, 0x1000193
cmp ecx, edx
jb 0x454960
pop edi
mov eax, esi
pop esi
pop ebp
ret 8
Function at 0x45c750
Capabilities:
Terminate thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x544630
mov eax, dword fs:[0]
push eax
push esi
push edi
mov eax, dword [0x5953ec]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
push esi
call fcn.00463a81
mov eax, dword [esi + 8]
add esp, 4
or eax, dword [esi + 0xc]
je 0x45c7ab
push 1
push dword [esi + 0x18]
push 0x578ea4
push dword [esi + 0x14]
push dword [esi + 0x10]
call dword [sym.imp.ADVAPI32.dll_ControlTraceW]
mov dword [esi + 8], 0
mov dword [esi + 0xc], 0
mov edx, dword [esi + 0x10]
mov eax, edx
mov ecx, dword [esi + 0x14]
or eax, ecx
je 0x45c7cd
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_CloseTrace]
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
lea edi, [esi + 0x1c8]
mov dword [ebp - 4], 0
mov ecx, dword [edi + 0x24]
test ecx, ecx
je 0x45c7f6
mov edx, dword [ecx]
cmp ecx, edi
setne al
movzx eax, al
push eax
call dword [edx + 0x10]
mov dword [edi + 0x24], 0
push esi
call fcn.00463a9d
mov edi, dword [esi + 0x1c0]
add esp, 4
mov dword [esi + 0x1c0], 0
push 0xbb8
push edi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0x102
jne 0x45c82b
push 1
push edi
call dword [sym.imp.KERNEL32.dll_TerminateThread]
mov al, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x45d740
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x54a080
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
push ebx
push esi
push edi
mov eax, dword [0x5953ec]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, dword [ebp + 8]
lea edx, [ecx + 0x200]
movzx eax, bl
xor eax, 0x811c9dc5
mov edi, dword [edx + 0xc]
imul ecx, eax, 0x1000193
mov eax, ebx
shr eax, 8
movzx eax, al
mov dword [ebp - 0x14], edx
mov dword [ebp - 0x1c], edi
xor ecx, eax
mov eax, ebx
imul ecx, ecx, 0x1000193
shr eax, 0x10
movzx eax, al
xor ecx, eax
mov eax, ebx
imul ecx, ecx, 0x1000193
shr eax, 0x18
xor ecx, eax
imul eax, ecx, 0x1000193
mov ecx, dword [edx + 0x18]
and ecx, eax
add edx, 4
mov dword [ebp - 0x18], edx
mov eax, dword [edi + ecx*8]
mov esi, eax
mov edx, dword [edx]
lea ecx, [ecx*8 + 4]
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x20], ecx
cmp eax, edx
jne 0x45d7dc
mov eax, edx
jmp 0x45d7e1
mov eax, dword [ecx + edi]
mov eax, dword [eax]
cmp esi, eax
je 0x45d826
cmp dword [esi + 8], ebx
je 0x45d7f1
mov esi, dword [esi]
mov eax, dword [ebp - 0x10]
jmp 0x45d7d4
mov ecx, esi
mov edi, esi
mov dword [ebp - 0x24], ecx
mov ecx, dword [ebp - 0x1c]
mov dword [ebp - 0x28], edi
mov edi, dword [ebp - 0x10]
cmp edi, edx
jne 0x45d809
mov eax, edx
jmp 0x45d811
mov eax, dword [ebp - 0x20]
mov eax, dword [eax + ecx]
mov eax, dword [eax]
cmp esi, eax
je 0x45d81e
cmp ebx, dword [esi + 8]
jne 0x45d81e
mov esi, dword [esi]
jmp 0x45d801
mov edi, dword [ebp - 0x28]
cmp dword [ebp - 0x24], esi
jne 0x45d82a
mov edi, edx
mov esi, edx
mov eax, edi
xor ebx, ebx
mov dword [ebp - 0x10], ebx
cmp eax, esi
je 0x45d83f
mov eax, dword [eax]
inc ebx
cmp eax, esi
jne 0x45d835
mov dword [ebp - 0x10], ebx
cmp edi, dword [edx]
jne 0x45d862
cmp esi, edx
jne 0x45d862
mov dword [ebp - 4], 0
mov ecx, dword [ebp - 0x18]
call fcn.00428de0
mov ecx, dword [ebp - 0x14]
push 8
call fcn.00428b20
jmp 0x45d885
cmp edi, esi
je 0x45d885
mov ebx, dword [ebp - 0x14]
nop dword [eax]
push edi
mov edi, dword [edi]
lea eax, [ebp - 0x18]
push eax
mov ecx, ebx
call fcn.0042c9f0
cmp edi, esi
jne 0x45d870
mov ebx, dword [ebp - 0x10]
test ebx, ebx
setne al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x45de90
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, ecx
movzx eax, byte [esi]
xor eax, 0x811c9dc5
imul edx, eax, 0x1000193
movzx eax, byte [esi + 1]
xor edx, eax
movzx eax, byte [esi + 2]
imul edx, edx, 0x1000193
xor edx, eax
movzx eax, byte [esi + 3]
imul ecx, edx, 0x1000193
xor ecx, eax
movzx eax, byte [esi + 4]
imul ecx, ecx, 0x1000193
xor ecx, eax
movzx eax, byte [esi + 5]
imul ecx, ecx, 0x1000193
xor ecx, eax
movzx eax, byte [esi + 6]
imul ecx, ecx, 0x1000193
xor ecx, eax
movzx eax, byte [esi + 7]
imul ecx, ecx, 0x1000193
xor ecx, eax
mov eax, dword [edi + 0x18]
imul ecx, ecx, 0x1000193
pop edi
pop esi
and eax, ecx
pop ebp
ret 4
Function at 0x45e520
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [0x5953ec]
xor eax, ebp
mov dword [ebp - 4], eax
mov edx, dword [ebp + 0xc]
push ebx
push esi
push edi
movzx eax, byte [edx]
mov edi, ecx
xor eax, 0x811c9dc5
mov ebx, dword [ebp + 8]
imul ecx, eax, 0x1000193
movzx eax, byte [edx + 1]
mov esi, dword [edi + 0x18]
mov dword [ebp - 0x20], edi
mov dword [ebp - 8], edx
xor ecx, eax
mov dword [ebp - 0x18], ebx
movzx eax, byte [edx + 2]
imul ecx, ecx, 0x1000193
xor ecx, eax
movzx eax, byte [edx + 3]
imul ecx, ecx, 0x1000193
xor ecx, eax
imul eax, ecx, 0x1000193
mov ecx, dword [edi + 4]
and esi, eax
mov eax, dword [edi + 0xc]
mov dword [ebp - 0x1c], esi
lea esi, [eax + esi*8]
mov eax, dword [esi]
cmp eax, ecx
jne 0x45e591
mov esi, ecx
jmp 0x45e596
mov esi, dword [esi + 4]
mov esi, dword [esi]
cmp esi, eax
je 0x45e5af
mov ecx, dword [edx]
nop dword [eax]
mov esi, dword [esi + 4]
cmp ecx, dword [esi + 8]
je 0x45e611
cmp esi, eax
jne 0x45e5a0
mov ecx, dword [edi + 4]
mov eax, dword [ecx]
mov dword [ebp - 0x10], eax
mov ecx, dword [eax + 4]
push ecx
push eax
mov dword [ebp - 0x14], ecx
call fcn.00432a90
mov edx, dword [ebp - 8]
mov dword [ebp - 0xc], eax
mov ecx, dword [edx]
mov dword [eax + 8], ecx
mov dword [eax + 0x1c], 0
mov dword [eax + 0x20], 0
movups xmm0, xmmword [edx + 4]
movups xmmword [eax + 0xc], xmm0
movq xmm0, qword [edx + 0x14]
movq qword [eax + 0x1c], xmm0
xor eax, eax
mov dword [edx + 0x14], 0
mov dword [edx + 0x18], 7
mov word [edx + 4], ax
mov eax, 0x71c71c6
mov ecx, dword [edi + 8]
sub eax, ecx
cmp eax, 1
jb 0x45e68c
jmp 0x45e619
mov dword [ebx], esi
mov byte [ebx + 4], 0
jmp 0x45e677
lea eax, [ecx + 1]
mov ecx, dword [ebp - 0x10]
mov dword [edi + 8], eax
mov eax, dword [ebp - 0xc]
mov dword [ecx + 4], eax
mov ecx, dword [ebp - 0x14]
mov dword [ecx], eax
mov edi, dword [edi + 4]
mov edi, dword [edi]
mov eax, dword [edi]
cmp esi, eax
je 0x45e65c
mov ecx, dword [edi + 4]
mov dword [ecx], eax
mov ecx, dword [eax + 4]
mov dword [ecx], esi
mov ecx, dword [esi + 4]
mov dword [ecx], edi
mov ebx, dword [esi + 4]
mov ecx, dword [eax + 4]
mov dword [esi + 4], ecx
mov edx, dword [edi + 4]
mov dword [eax + 4], edx
mov dword [edi + 4], ebx
mov ebx, dword [ebp - 0x18]
push dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x20]
push esi
push edi
call fcn.00435870
mov ecx, dword [ebp - 0x20]
call fcn.004357d0
mov dword [ebx], edi
mov byte [ebx + 4], 1
mov ecx, dword [ebp - 4]
mov eax, ebx
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004e059c
mov esp, ebp
pop ebp
ret 0xc
push str.list_T__too_long
call fcn.004626df
int3
Function at 0x464d20
Capabilities:
Check mutex on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x54a6ea
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x5953ec]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
mov dword [esi], vtable.LogUtils::LogAppender.0
lea edi, [esi + 0x14]
mov dword [esi + 4], 0
mov dword [esi + 8], 0
mov byte [esi + 0xc], 1
mov dword [esi + 0x10], 0
call fcn.00413510
mov ecx, eax
test ecx, ecx
je 0x464ee4
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [edi], eax
mov dword [ebp - 4], 0
lea ebx, [esi + 0x18]
call fcn.00413510
mov ecx, eax
test ecx, ecx
je 0x464eee
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebx], eax
mov byte [ebp - 4], 1
call fcn.00413510
mov ecx, eax
test ecx, ecx
je 0x464ef8
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [esi + 0x1c], eax
mov dword [esi + 0x20], 0xffffffff
lea eax, [esi + 0x24]
push eax
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov dword [esi + 0x3c], 0
mov dword [esi + 0x40], 0
mov dword [esi + 0x44], 0
mov edx, dword [ebp + 8]
mov eax, dword [ebp + 0x10]
mov byte [ebp - 4], 5
mov dword [esi + 0x10], eax
test edx, edx
jne 0x464e02
xor ecx, ecx
jmp 0x464e20
mov ecx, edx
lea eax, [ecx + 2]
mov dword [ebp + 0x10], eax
nop word [eax + eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x464e10
sub ecx, dword [ebp + 0x10]
sar ecx, 1
push ecx
push edx
mov ecx, edi
call fcn.00426490
push edi
mov ecx, ebx
call fcn.00426260
mov edx, dword [ebp + 0xc]
test edx, edx
jne 0x464e3c
xor ecx, ecx
jmp 0x464e54
mov ecx, edx
lea eax, [ecx + 2]
mov dword [ebp + 0x10], eax
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x464e44
sub ecx, dword [ebp + 0x10]
sar ecx, 1
push ecx
push edx
lea ecx, [esi + 0x1c]
call fcn.00426490
push ebx
lea eax, [ebp + 0x10]
mov ecx, esi
push eax
call fcn.004658b0
push eax
mov ecx, ebx
mov byte [ebp - 4], 6
call fcn.00426260
mov edx, dword [ebp + 0x10]
or eax, 0xffffffff
mov byte [ebp - 4], 5
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x464e95
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
push dword [ebx]
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov dword [esi + 4], eax
test eax, eax
je 0x464ece
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
je 0x464ece
cmp dword [esi + 0x10], 0
je 0x464ec5
push dword [edi]
call fcn.0052a3b4
add esp, 4
push dword [esi + 4]
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
push 0x80004005
call fcn.00412840
push 0x80004005
call fcn.00412840
push 0x80004005
call fcn.00412840
int3