joyce8/EMBER2024-capa huggingface dataset:
Function at 0x584310
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
mov dword [ebp - 4], ecx
cmp edx, eax
je 0x584483
cmp dword [edx + 0x1c], 0x10
mov eax, dword [ecx + 4]
push esi
mov dword [ebp - 0x18], eax
mov esi, edx
mov eax, dword [ecx + 0xc]
push edi
mov dword [ebp - 0x14], eax
lea edi, [edx + 8]
mov eax, dword [edx + 4]
mov dword [ebp - 8], eax
mov eax, dword [edi + 0x10]
jb 0x58434b
mov edi, dword [edi]
xor edx, edx
push ebx
mov ebx, 0x811c9dc5
test eax, eax
je 0x584374
mov ecx, eax
nop dword [eax]
movzx eax, byte [edx + edi]
inc edx
xor eax, ebx
imul ebx, eax, 0x1000193
cmp edx, ecx
jb 0x584360
mov ecx, dword [ebp - 4]
mov eax, dword [ecx + 0x18]
mov ecx, dword [ebp - 0x14]
and eax, ebx
lea eax, [ecx + eax*8]
mov ecx, dword [eax]
mov dword [ebp - 0xc], eax
mov eax, dword [eax + 4]
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0x1c], eax
nop dword [eax]
mov edi, esi
mov ebx, esi
mov esi, dword [esi]
lea ecx, [edi + 8]
call fcn.00578f10
push 0x44
push edi
call fcn.00503df0
mov eax, dword [ebp - 4]
add esp, 8
dec dword [eax + 8]
cmp ebx, dword [ebp - 0x1c]
je 0x5843dd
mov eax, dword [ebp + 0xc]
cmp esi, eax
jne 0x584390
mov ecx, dword [ebp - 0x10]
cmp ecx, dword [ebp + 8]
jne 0x584478
mov ecx, dword [ebp - 0xc]
pop ebx
pop edi
mov dword [ecx], esi
mov ecx, dword [ebp - 8]
mov dword [ecx], esi
mov dword [esi + 4], ecx
pop esi
mov esp, ebp
pop ebp
ret 8
mov ecx, dword [ebp - 0x10]
cmp ecx, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
jne 0x5843ef
mov eax, dword [ebp - 0x18]
mov dword [ecx], eax
jmp 0x5843f2
mov eax, dword [ebp - 8]
mov dword [ecx + 4], eax
mov eax, dword [ebp + 0xc]
cmp esi, eax
je 0x584478
nop dword [eax]
cmp dword [esi + 0x1c], 0x10
lea edx, [esi + 8]
mov ebx, dword [edx + 0x10]
jb 0x58440e
mov edx, dword [edx]
xor ecx, ecx
mov edi, 0x811c9dc5
test ebx, ebx
je 0x584431
nop dword [eax]
movzx eax, byte [ecx + edx]
inc ecx
xor eax, edi
imul edi, eax, 0x1000193
cmp ecx, ebx
jb 0x584420
mov ecx, dword [ebp - 4]
mov eax, dword [ecx + 0x18]
mov ecx, dword [ebp - 0x14]
and eax, edi
lea eax, [ecx + eax*8]
mov dword [ebp + 8], eax
mov eax, dword [eax + 4]
mov dword [ebp - 0x1c], eax
mov edi, esi
mov ebx, esi
mov esi, dword [esi]
lea ecx, [edi + 8]
call fcn.00578f10
push 0x44
push edi
call fcn.00503df0
mov ecx, dword [ebp - 4]
add esp, 8
mov eax, dword [ebp + 0xc]
dec dword [ecx + 8]
cmp ebx, dword [ebp - 0x1c]
je 0x584489
cmp esi, eax
jne 0x584448
mov ecx, dword [ebp + 8]
mov dword [ecx], esi
mov ecx, dword [ebp - 8]
pop ebx
pop edi
mov dword [ecx], esi
mov dword [esi + 4], ecx
pop esi
mov esp, ebp
pop ebp
ret 8
mov ecx, dword [ebp + 8]
mov edi, dword [ebp - 0x18]
mov dword [ecx], edi
mov dword [ecx + 4], edi
cmp esi, eax
jne 0x584400
mov ecx, dword [ebp - 8]
pop ebx
pop edi
mov dword [ecx], esi
mov dword [esi + 4], ecx
pop esi
mov esp, ebp
pop ebp
ret 8
Function at 0x586ea0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x73d255
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x40
mov eax, ecx
push ebx
mov dword [ebp - 0x14], eax
add eax, 0x30
push esi
mov esi, dword [ebp + 8]
mov ecx, esi
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x34]
push edi
push eax
call fcn.00589840
mov ebx, eax
mov edi, ebx
cmp dword [ebx + 0x14], 0x10
jb 0x586ee3
mov edi, dword [ebx]
xor ecx, ecx
mov edx, 0x811c9dc5
cmp dword [ebx + 0x10], ecx
jbe 0x586f02
nop
movzx eax, byte [ecx + edi]
inc ecx
xor eax, edx
imul edx, eax, 0x1000193
cmp ecx, dword [ebx + 0x10]
jb 0x586ef0
push edx
push ebx
mov ebx, dword [ebp - 0x10]
lea eax, [ebp - 0x1c]
push eax
mov ecx, ebx
call fcn.004a9a60
mov edi, dword [eax + 4]
test edi, edi
jne 0x586f1c
mov edi, dword [ebx + 4]
mov ebx, dword [ebp - 0x14]
mov edx, dword [ebp - 0x20]
mov ebx, dword [ebx + 0x34]
cmp edx, 0x10
jb 0x586f56
mov ecx, dword [ebp - 0x34]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x586f4c
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x587060
push edx
push ecx
call fcn.00503df0
add esp, 8
cmp edi, ebx
jne 0x586ff1
lea eax, [ebp - 0x34]
mov ecx, esi
push eax
call fcn.00589840
mov ebx, dword [ebp - 0x10]
mov ecx, ebx
push eax
lea eax, [ebp - 0x1c]
mov dword [ebp - 4], 0
push eax
call fcn.00582710
mov edi, dword [eax]
add edi, 0x20
cmp edi, esi
je 0x586f9d
cmp dword [esi + 0x14], 0x10
mov eax, esi
jb 0x586f92
mov eax, dword [esi]
push dword [esi + 0x10]
mov ecx, edi
push eax
call fcn.0047e790
lea eax, [esi + 0x18]
lea ecx, [edi + 0x18]
cmp ecx, eax
je 0x586fb4
push dword [ebp + 8]
push dword [eax + 4]
push dword [eax]
call fcn.00581bb0
mov edx, dword [ebp - 0x20]
mov dword [ebp - 4], 0xffffffff
cmp edx, 0x10
jb 0x586ff4
mov ecx, dword [ebp - 0x34]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x586fe5
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x587065
push edx
push ecx
call fcn.00503df0
add esp, 8
jmp 0x586ff4
mov ebx, dword [ebp - 0x10]
lea eax, [ebp - 0x4c]
mov ecx, esi
push eax
call fcn.00589840
push eax
lea eax, [ebp - 0x1c]
mov dword [ebp - 4], 1
push eax
mov ecx, ebx
call fcn.00582710
push esi
mov ecx, dword [eax]
add ecx, 0x20
call fcn.00589940
mov edx, dword [ebp - 0x38]
pop edi
pop esi
pop ebx
cmp edx, 0x10
jb 0x587050
mov ecx, dword [ebp - 0x4c]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x587046
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x58706a
push edx
push ecx
call fcn.00503df0
add esp, 8
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 4
call fcn.006fee64
call fcn.006fee64
call fcn.006fee64
int3
Function at 0x5870d0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
cmp byte [0xa82632], 0
mov eax, ecx
mov dword [ebp - 8], eax
je 0x5870f1
cmp byte [0x8e2498], 0
jne 0x5871a2
push ebx
push esi
mov esi, dword [ebp + 8]
add eax, 0x184
add esi, 0x18
mov dword [ebp - 4], eax
push edi
mov edi, esi
cmp dword [esi + 0x14], 0x10
mov ebx, dword [esi + 0x10]
jb 0x58710f
mov edi, dword [esi]
xor ecx, ecx
mov edx, 0x811c9dc5
test ebx, ebx
je 0x587131
nop word [eax + eax]
movzx eax, byte [ecx + edi]
inc ecx
xor eax, edx
imul edx, eax, 0x1000193
cmp ecx, ebx
jb 0x587120
mov ebx, dword [ebp - 4]
lea eax, [ebp - 0x10]
push edx
push esi
push eax
mov ecx, ebx
call fcn.004a9a60
mov eax, dword [eax + 4]
test eax, eax
jne 0x58714b
mov eax, dword [ebx + 4]
mov edi, dword [ebp - 8]
cmp eax, dword [edi + 0x188]
jne 0x58717e
push esi
lea eax, [ebp - 0x10]
mov ecx, ebx
push eax
call fcn.005824c0
mov ecx, dword [eax]
add ecx, 0x30
cmp ecx, esi
je 0x58717e
cmp dword [esi + 0x14], 0x10
mov eax, esi
jb 0x587175
mov eax, dword [esi]
push dword [esi + 0x10]
push eax
call fcn.0047e790
push esi
lea eax, [ebp - 0x10]
mov ecx, ebx
push eax
call fcn.005824c0
push dword [ebp + 0xc]
push dword [ebp + 8]
mov eax, dword [eax]
add eax, 0x20
push eax
push edi
call fcn.00582fb0
add esp, 0x10
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x58ad40
Capabilities:
Hash data using murmur3

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
push ebx
push esi
lea ebx, [edx + eax]
mov dword [ebp - 4], ebx
cmp eax, 0x10
jl 0x58ade6
mov esi, dword [ebp + 0x10]
lea eax, [ebx - 0x10]
push edi
mov dword [ebp + 8], eax
lea edi, [esi + 0x24234428]
lea ebx, [esi - 0x7a143589]
lea eax, [esi + 0x61c8864f]
nop word [eax + eax]
imul ecx, dword [edx], 0x7a143589
sub edi, ecx
imul ecx, dword [edx + 4], 0x7a143589
rol edi, 0xd
imul edi, edi, 0x9e3779b1
sub ebx, ecx
imul ecx, dword [edx + 8], 0x7a143589
rol ebx, 0xd
imul ebx, ebx, 0x9e3779b1
sub esi, ecx
imul ecx, dword [edx + 0xc], 0x7a143589
rol esi, 0xd
add edx, 0x10
imul esi, esi, 0x9e3779b1
sub eax, ecx
rol eax, 0xd
imul eax, eax, 0x9e3779b1
cmp edx, dword [ebp + 8]
jbe 0x58ad80
rol eax, 0x12
rol esi, 0xc
rol ebx, 7
add eax, esi
add eax, ebx
rol edi, 1
mov ebx, dword [ebp - 4]
add eax, edi
pop edi
jmp 0x58adee
mov eax, dword [ebp + 0x10]
add eax, 0x165667b1
add eax, dword [ebp + 0xc]
lea esi, [ebx - 4]
cmp edx, esi
ja 0x58ae18
nop dword [eax + eax]
imul ecx, dword [edx], 0x3d4d51c3
add edx, 4
sub eax, ecx
rol eax, 0x11
imul eax, eax, 0x27d4eb2f
cmp edx, esi
jbe 0x58ae00
cmp edx, ebx
jae 0x58ae39
nop dword [eax]
movzx ecx, byte [edx]
inc edx
imul ecx, ecx, 0x165667b1
add ecx, eax
rol ecx, 0xb
imul eax, ecx, 0x9e3779b1
cmp edx, ebx
jb 0x58ae20
mov ecx, eax
shr ecx, 0xf
xor ecx, eax
imul ecx, ecx, 0x85ebca77
pop esi
pop ebx
mov eax, ecx
shr eax, 0xd
xor eax, ecx
imul ecx, eax, 0xc2b2ae3d
mov eax, ecx
shr eax, 0x10
xor eax, ecx
mov esp, ebp
pop ebp
ret

Function at 0x58b050
Capabilities:
Hash data using murmur3

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov ebx, dword [edi + 0x18]
lea esi, [edi + 0x20]
add esi, dword [edi + 0x30]
lea edx, [edi + 0x20]
cmp dword [edi + 0x1c], 0
ja 0x58b079
cmp ebx, 0x10
jae 0x58b079
mov eax, dword [edi]
add eax, 0x165667b1
jmp 0x58b096
mov eax, dword [edi + 0x10]
mov ecx, dword [edi + 0xc]
rol ecx, 0xc
rol eax, 0x12
add eax, ecx
mov ecx, dword [edi + 8]
rol ecx, 7
add eax, ecx
mov ecx, dword [edi + 4]
rol ecx, 1
add eax, ecx
add eax, ebx
lea ebx, [esi - 4]
cmp edx, ebx
ja 0x58b0b8
nop
imul ecx, dword [edx], 0x3d4d51c3
add edx, 4
sub eax, ecx
rol eax, 0x11
imul eax, eax, 0x27d4eb2f
cmp edx, ebx
jbe 0x58b0a0
cmp edx, esi
jae 0x58b0d9
nop dword [eax]
movzx ecx, byte [edx]
inc edx
imul ecx, ecx, 0x165667b1
add ecx, eax
rol ecx, 0xb
imul eax, ecx, 0x9e3779b1
cmp edx, esi
jb 0x58b0c0
mov ecx, eax
shr ecx, 0xf
xor ecx, eax
imul ecx, ecx, 0x85ebca77
push edi
mov eax, ecx
shr eax, 0xd
xor eax, ecx
imul esi, eax, 0xc2b2ae3d
call fcn.00703abc
add esp, 4
mov eax, esi
shr eax, 0x10
xor eax, esi
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x594410
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, ecx
cmp dword [esi + 0xc], 0
je 0x59442e
push str.handle__nullptr
push str.RBX::Runtime___panic
call fcn.00512c00
add esp, 8
mov eax, dword [ebp + 8]
push 0
push 0x10000
mov dword [esi], eax
mov eax, dword [ebp + 0xc]
push esi
mov dword [esi + 4], eax
mov eax, dword [ebp + 0x10]
push 0x5942c0
mov dword [esi + 8], eax
push dword [0x8e25f0]
push 0
call fcn.00704e7b
add esp, 0x18
mov dword [esi + 0xc], eax
pop esi
test eax, eax
jne 0x594476
push str.handle___nullptr
push str.RBX::Runtime___panic
call fcn.00512c00
add esp, 8
pop ebp
ret 0xc

Function at 0x594480
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, dword fs:[0x2c]
sub esp, 0x24
mov ecx, dword [0x1551db0]
push esi
mov ecx, dword [eax + ecx*4]
mov eax, dword [0x150e88c]
mov esi, dword [ebp + 8]
push edi
cmp eax, dword [ecx + 0x78c]
jg 0x5944f1
mov edi, dword [0x150e888]
test esi, esi
je 0x5944c1
lea eax, [edi - 1]
test esi, eax
je 0x5944c3
dec esi
not eax
add esi, edi
and esi, eax
jmp 0x5944c3
mov esi, edi
push 1
push 0x2000
lea eax, [edi + esi]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
test eax, eax
je 0x5944eb
push 4
push 0x1000
push esi
add eax, edi
push eax
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
pop edi
pop esi
mov esp, ebp
pop ebp
ret
push 0x150e88c
call fcn.006f2701
add esp, 4
cmp dword [0x150e88c], 0xffffffff
jne 0x5944a7
lea eax, [ebp - 0x24]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [ebp - 0x20]
push 0x150e88c
mov dword [0x150e888], eax
call fcn.006f26b7
add esp, 4
jmp 0x5944a7

Function at 0x5945c0
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, dword fs:[0x2c]
sub esp, 0x24
mov ecx, dword [0x1551db0]
push esi
mov ecx, dword [eax + ecx*4]
mov eax, dword [0x150e894]
mov esi, dword [ebp + 8]
push edi
cmp eax, dword [ecx + 0x78c]
jg 0x594631
mov edi, dword [0x150e890]
test esi, esi
je 0x594601
lea eax, [edi - 1]
test esi, eax
je 0x594603
dec esi
not eax
add esi, edi
and esi, eax
jmp 0x594603
mov esi, edi
push 1
push 0x2000
lea eax, [edi + esi]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
test eax, eax
je 0x59462b
push 4
push 0x1000
push esi
add eax, edi
push eax
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
pop edi
pop esi
mov esp, ebp
pop ebp
ret
push 0x150e894
call fcn.006f2701
add esp, 4
cmp dword [0x150e894], 0xffffffff
jne 0x5945e7
lea eax, [ebp - 0x24]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [ebp - 0x20]
push 0x150e894
mov dword [0x150e890], eax
call fcn.006f26b7
add esp, 4
jmp 0x5945e7
Function at 0x594860
Capabilities:
Hash data using murmur3

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x72eb70
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebx
push esi
push edi
call fcn.00594800
mov edi, eax
mov dword [ebp - 0x10], edi
push edi
mov dword [ebp - 4], 0
call dword [sym.imp.KERNEL32.dll_AcquireSRWLockShared]
mov ebx, dword [ebp + 8]
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebx]
cmp edx, dword [ecx]
jne 0x594908
mov eax, ebx
shr eax, 0x10
xor eax, ebx
imul ecx, eax, 0x85ebca6b
mov eax, ecx
shr eax, 0xd
xor eax, ecx
imul eax, eax, 0xc2b2ae35
mov ecx, eax
shr ecx, 0x10
xor ecx, eax
xor esi, esi
mov dword [ebp + 8], ecx
nop word [eax + eax]
lea eax, [esi + ecx]
and eax, 0x3fff
lea edi, [edi + eax*8]
add edi, 8
mov edx, dword [edi]
test edx, edx
je 0x5948e9
cmp edx, 0xffffffff
jne 0x5948f8
mov ecx, ebx
mov eax, edx
lock cmpxchg dword [edi], ecx
cmp eax, edx
je 0x594920
mov ecx, dword [ebp + 8]
cmp edx, ebx
je 0x594920
mov edi, dword [ebp - 0x10]
inc esi
cmp esi, 0x4000
jb 0x5948d0
push edi
call dword [sym.imp.KERNEL32.dll_ReleaseSRWLockShared]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
lock inc dword [edi + 4]
mov esi, dword [ebp - 0x10]
push esi
call dword [sym.imp.KERNEL32.dll_ReleaseSRWLockShared]
mov eax, dword [esi + 4]
mov ecx, dword [0x1551db0]
mov dword [ebp + 8], eax
mov eax, dword fs:[0x2c]
mov ecx, dword [eax + ecx*4]
mov eax, dword [0x150e8a4]
cmp eax, dword [ecx + 0x78c]
jg 0x59496f
push 0
push 0
push ebx
push dword [ebp + 8]
call dword [0x150e8a0]
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
push 0x150e8a4
call fcn.006f2701
add esp, 4
cmp dword [0x150e8a4], 0xffffffff
jne 0x594950
push str.ntdll.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
push str.NtWaitForKeyedEvent
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push edi
mov esi, eax
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
push 0x150e8a4
mov dword [0x150e8a0], esi
call fcn.006f26b7
add esp, 4
jmp 0x594950
Function at 0x5949d0
Capabilities:
Hash data using murmur3

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x72eb70
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xc
push ebx
push esi
push edi
call fcn.00594800
mov ebx, eax
mov dword [ebp - 0x14], ebx
push ebx
mov dword [ebp - 4], 0
call dword [sym.imp.KERNEL32.dll_AcquireSRWLockExclusive]
mov esi, dword [ebp + 8]
mov ecx, esi
shr ecx, 0x10
xor ecx, esi
imul ecx, ecx, 0x85ebca6b
mov eax, ecx
shr eax, 0xd
xor eax, ecx
imul eax, eax, 0xc2b2ae35
mov edi, eax
shr edi, 0x10
xor edi, eax
xor ecx, ecx
nop dword [eax]
lea eax, [ecx + edi]
and eax, 0x3fff
lea edx, [ebx + eax*8]
mov eax, dword [edx + 8]
test eax, eax
je 0x594a4f
cmp eax, esi
je 0x594a67
inc ecx
cmp ecx, 0x4000
jb 0x594a30
push ebx
call dword [sym.imp.KERNEL32.dll_ReleaseSRWLockExclusive]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
cmp byte [ebp + 0xc], 0
mov edi, 1
mov eax, dword [edx + 0xc]
mov dword [ebp - 0x10], edi
je 0x594a7d
mov edi, eax
mov dword [ebp - 0x10], edi
sub eax, edi
mov dword [edx + 0xc], eax
jne 0x594a8b
mov dword [edx + 8], 0xffffffff
push ebx
call dword [sym.imp.KERNEL32.dll_ReleaseSRWLockExclusive]
test edi, edi
je 0x594a56
mov ecx, dword [0x1551db0]
mov eax, dword fs:[0x2c]
mov ecx, dword [eax + ecx*4]
mov dword [ebp - 0x18], ecx
nop dword [eax + eax]
mov eax, dword [0x150e8ac]
mov ebx, dword [ebx + 4]
cmp eax, dword [ecx + 0x78c]
jg 0x594aed
push 0
push 0
push esi
push ebx
call dword [0x150e8a8]
mov ebx, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x18]
test eax, eax
js 0x594ab0
sub dword [ebp - 0x10], 1
jne 0x594ab0
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
push 0x150e8ac
call fcn.006f2701
add esp, 4
cmp dword [0x150e8ac], 0xffffffff
jne 0x594ac0
push str.ntdll.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
push str.NtReleaseKeyedEvent
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push edi
mov esi, eax
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
push 0x150e8ac
mov dword [0x150e8a8], esi
call fcn.006f26b7
mov esi, dword [ebp + 8]
add esp, 4
jmp 0x594ac0
Function at 0x594cb0
Capabilities:
Hash data using murmur3

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x72eb70
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebx
push esi
push edi
call fcn.00594c50
mov edi, eax
mov dword [ebp - 0x10], edi
push edi
mov dword [ebp - 4], 0
call dword [sym.imp.KERNEL32.dll_AcquireSRWLockShared]
mov ebx, dword [ebp + 8]
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebx]
cmp edx, dword [ecx]
jne 0x594d58
mov eax, ebx
shr eax, 0x10
xor eax, ebx
imul ecx, eax, 0x85ebca6b
mov eax, ecx
shr eax, 0xd
xor eax, ecx
imul eax, eax, 0xc2b2ae35
mov ecx, eax
shr ecx, 0x10
xor ecx, eax
xor esi, esi
mov dword [ebp + 8], ecx
nop word [eax + eax]
lea eax, [esi + ecx]
and eax, 0x3fff
lea edi, [edi + eax*8]
add edi, 8
mov edx, dword [edi]
test edx, edx
je 0x594d39
cmp edx, 0xffffffff
jne 0x594d48
mov ecx, ebx
mov eax, edx
lock cmpxchg dword [edi], ecx
cmp eax, edx
je 0x594d70
mov ecx, dword [ebp + 8]
cmp edx, ebx
je 0x594d70
mov edi, dword [ebp - 0x10]
inc esi
cmp esi, 0x4000
jb 0x594d20
push edi
call dword [sym.imp.KERNEL32.dll_ReleaseSRWLockShared]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
lock inc dword [edi + 4]
mov esi, dword [ebp - 0x10]
push esi
call dword [sym.imp.KERNEL32.dll_ReleaseSRWLockShared]
mov eax, dword [esi + 4]
mov ecx, dword [0x1551db0]
mov dword [ebp + 8], eax
mov eax, dword fs:[0x2c]
mov ecx, dword [eax + ecx*4]
mov eax, dword [0x152e8cc]
cmp eax, dword [ecx + 0x78c]
jg 0x594dbf
push 0
push 0
push ebx
push dword [ebp + 8]
call dword [0x152e8c8]
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
push 0x152e8cc
call fcn.006f2701
add esp, 4
cmp dword [0x152e8cc], 0xffffffff
jne 0x594da0
push str.ntdll.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
push str.NtWaitForKeyedEvent
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push edi
mov esi, eax
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
push 0x152e8cc
mov dword [0x152e8c8], esi
call fcn.006f26b7
add esp, 4
jmp 0x594da0
Function at 0x594e20
Capabilities:
Hash data using murmur3

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x72eb70
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xc
push ebx
push esi
push edi
call fcn.00594c50
mov ebx, eax
mov dword [ebp - 0x14], ebx
push ebx
mov dword [ebp - 4], 0
call dword [sym.imp.KERNEL32.dll_AcquireSRWLockExclusive]
mov esi, dword [ebp + 8]
mov ecx, esi
shr ecx, 0x10
xor ecx, esi
imul ecx, ecx, 0x85ebca6b
mov eax, ecx
shr eax, 0xd
xor eax, ecx
imul eax, eax, 0xc2b2ae35
mov edi, eax
shr edi, 0x10
xor edi, eax
xor ecx, ecx
nop dword [eax]
lea eax, [ecx + edi]
and eax, 0x3fff
lea edx, [ebx + eax*8]
mov eax, dword [edx + 8]
test eax, eax
je 0x594e9f
cmp eax, esi
je 0x594eb7
inc ecx
cmp ecx, 0x4000
jb 0x594e80
push ebx
call dword [sym.imp.KERNEL32.dll_ReleaseSRWLockExclusive]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
cmp byte [ebp + 0xc], 0
mov edi, 1
mov eax, dword [edx + 0xc]
mov dword [ebp - 0x10], edi
je 0x594ecd
mov edi, eax
mov dword [ebp - 0x10], edi
sub eax, edi
mov dword [edx + 0xc], eax
jne 0x594edb
mov dword [edx + 8], 0xffffffff
push ebx
call dword [sym.imp.KERNEL32.dll_ReleaseSRWLockExclusive]
test edi, edi
je 0x594ea6
mov ecx, dword [0x1551db0]
mov eax, dword fs:[0x2c]
mov ecx, dword [eax + ecx*4]
mov dword [ebp - 0x18], ecx
nop dword [eax + eax]
mov eax, dword [0x152e8d4]
mov ebx, dword [ebx + 4]
cmp eax, dword [ecx + 0x78c]
jg 0x594f3d
push 0
push 0
push esi
push ebx
call dword [0x152e8d0]
mov ebx, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x18]
test eax, eax
js 0x594f00
sub dword [ebp - 0x10], 1
jne 0x594f00
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
push 0x152e8d4
call fcn.006f2701
add esp, 4
cmp dword [0x152e8d4], 0xffffffff
jne 0x594f10
push str.ntdll.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
push str.NtReleaseKeyedEvent
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push edi
mov esi, eax
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
push 0x152e8d4
mov dword [0x152e8d0], esi
call fcn.006f26b7
mov esi, dword [ebp + 8]
add esp, 4
jmp 0x594f10
Function at 0x59e2b0
Capabilities:
Encode data using xor
Hash data using djb2

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
test esi, esi
je 0x59e365
push esi
call fcn.005af0f0
add esp, 4
test al, al
jne 0x59e365
push ebx
push edi
mov edi, esi
xor ebx, ebx
lea ecx, [edi + 1]
nop dword [eax]
mov al, byte [edi]
inc edi
test al, al
jne 0x59e2e0
sub edi, ecx
push edi
push 0x2e
push esi
call fcn.005bb670
add esp, 0xc
test eax, eax
je 0x59e314
sub eax, esi
push eax
push 0x2e
push esi
call fcn.005bb670
mov ebx, eax
add esp, 0xc
test ebx, ebx
je 0x59e316
inc ebx
mov ecx, esi
sub ecx, ebx
add edi, ecx
test ebx, ebx
cmovne esi, ebx
lea ebx, [esi + edi]
mov edi, 0x1505
cmp esi, ebx
jae 0x59e343
mov al, byte [esi]
push eax
call fcn.005b1730
movsx ecx, al
inc esi
mov eax, edi
add esp, 4
shl eax, 5
add eax, edi
xor ecx, eax
mov edi, ecx
cmp esi, ebx
jb 0x59e325
mov eax, 0x4104105
mov esi, edi
mul edi
sub esi, edx
shr esi, 1
add esi, edx
shr esi, 5
mov ecx, esi
shl ecx, 6
sub ecx, esi
sub edi, ecx
mov eax, edi
pop edi
pop ebx
pop esi
pop ebp
ret
xor eax, eax
pop esi
pop ebp
ret