joyce8/EMBER2024-capa huggingface dataset:
Function at 0x539a70
Capabilities:
Open clipboard
Read clipboard data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x6a6310
mov eax, dword fs:[0]
push eax
sub esp, 0x82c
mov eax, dword [0x73a280]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, ecx
mov dword [ebp - 0x838], eax
cmp byte [eax + 0x20], 0
je 0x539c8f
push 0
call dword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je 0x539c8f
push 1
call dword [sym.imp.USER32.dll_GetClipboardData]
mov esi, eax
mov dword [ebp - 0x834], esi
test esi, esi
je 0x539aed
push esi
call dword [sym.imp.KERNEL32.dll_GlobalLock]
mov edi, eax
mov dword [ebp - 0x830], edi
test edi, edi
jne 0x539af8
push esi
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
call dword [sym.imp.USER32.dll_CloseClipboard]
jmp 0x539c8f
mov esi, edi
mov dword [ebp - 0x818], 0
xorps xmm0, xmm0
mov dword [ebp - 0x814], 0
movups xmmword [ebp - 0x828], xmm0
lea ecx, [esi + 1]
nop dword [eax + eax]
mov al, byte [esi]
inc esi
test al, al
jne 0x539b20
sub esi, ecx
cmp esi, 0x7fffffff
ja 0x539caa
cmp esi, 0xf
ja 0x539b62
push esi
lea eax, [ebp - 0x828]
mov dword [ebp - 0x818], esi
push edi
push eax
mov dword [ebp - 0x814], 0xf
call fcn.00643a30
mov byte [ebp + esi - 0x828], 0
jmp 0x539bd9
mov edi, esi
or edi, 0xf
cmp edi, 0x7fffffff
jbe 0x539b81
mov eax, bind
mov edi, bind
push eax
call fcn.0043e900
jmp 0x539ba7
mov eax, 0x16
cmp edi, eax
cmovb edi, eax
lea eax, [edi + 1]
test eax, eax
je 0x539baa
cmp eax, 0x1000
jb 0x539ba1
push eax
call fcn.0043e900
jmp 0x539ba7
push eax
call fcn.005c8dfe
add esp, 4
push esi
push dword [ebp - 0x830]
mov dword [ebp - 0x82c], eax
push eax
mov dword [ebp - 0x828], eax
mov dword [ebp - 0x818], esi
mov dword [ebp - 0x814], edi
call fcn.00643a30
mov eax, dword [ebp - 0x82c]
mov byte [eax + esi], 0
add esp, 0xc
push dword [ebp - 0x834]
mov dword [ebp - 4], 0
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
call dword [sym.imp.USER32.dll_CloseClipboard]
mov eax, dword [ebp - 0x818]
test eax, eax
je 0x539c59
cmp dword [ebp - 0x814], 0xf
lea ecx, [ebp - 0x828]
push 0x400
cmova ecx, dword [ebp - 0x828]
lea edx, [ebp - 0x810]
push edx
add eax, ecx
sub eax, ecx
push eax
push ecx
push 0
push dword [0x7823d4]
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
test eax, eax
jle 0x539c59
mov ecx, dword [ebp - 0x838]
push eax
lea eax, [ebp - 0x810]
push eax
call fcn.00539420
mov ecx, dword [0x781bb8]
test ecx, ecx
je 0x539c59
mov eax, dword [ecx]
call dword [eax + 4]
mov ecx, dword [ebp - 0x814]
cmp ecx, 0xf
jbe 0x539c8f
mov edx, dword [ebp - 0x828]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x539c85
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x539caf
push ecx
push edx
call fcn.005c8a85
add esp, 8
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.005c8a4d
mov esp, ebp
pop ebp
ret
call fcn.00444010
call fcn.0064e36a
int3
Function at 0x53c410
Capabilities:
Resolve dns

Disassembly:
push ebp
mov ebp, esp
push esi
push dword [ebp + 8]
mov esi, ecx
call sub.WS2_32.dll_gethostbyname
test eax, eax
jne 0x53c429
xor al, al
pop esi
pop ebp
ret 4
mov eax, dword [eax + 0xc]
mov eax, dword [eax]
mov eax, dword [eax]
mov dword [esi + 4], eax
mov al, 1
pop esi
pop ebp
ret 4
Function at 0x541c50
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x6a6805
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push ebx
push esi
push edi
mov eax, dword [0x73a280]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x14], esi
mov edi, dword [ebp + 0xc]
mov edx, edi
cmp dword [edi + 0x14], 0xf
jbe 0x541c8a
mov edx, dword [edi]
mov ecx, dword [edi + 0x10]
xor ebx, ebx
add ecx, edx
mov dword [ebp + 0xc], ebx
cmp edx, ecx
jae 0x541cb3
nop dword [eax + eax]
movzx eax, byte [edx]
inc edx
imul ebx, ebx, 0x1000193
xor ebx, eax
cmp edx, ecx
jb 0x541ca0
mov dword [ebp + 0xc], ebx
movzx ecx, byte [esi]
and ecx, 1
inc ecx
add ecx, esi
lea eax, [ecx + 1]
neg ecx
sbb ecx, ecx
and ecx, eax
push ecx
push edi
push ebx
mov ecx, esi
call fcn.00541e90
mov ecx, eax
test ecx, ecx
je 0x541cf2
mov eax, dword [ebp + 8]
mov dword [eax], ecx
mov byte [eax + 4], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
lea ebx, [esi + 3]
mov dword [ebp - 0x18], 0
lea eax, [ebx + 1]
neg ebx
sbb ebx, ebx
and ebx, eax
mov dword [ebp - 0x1c], ebx
lea ecx, [ebp - 0x1c]
mov dword [ebp - 4], 0
call fcn.005436c0
mov edi, dword [ebp - 0x18]
mov esi, dword [ebp + 0x10]
push esi
lea ecx, [edi + 8]
call fcn.0043ee60
mov eax, dword [esi + 0x18]
lea ecx, [ebp - 0x1c]
mov dword [edi + 0x20], eax
mov dword [ebp - 0x18], 0
call fcn.005420b0
mov esi, edi
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x18], esi
mov ebx, dword [ebp - 0x14]
mov dword [ebp - 4], 1
cmp dword [ebx + 0x14], 0
mov eax, dword [ebx + 8]
lea edi, [eax + 1]
jne 0x541d73
push edi
mov ecx, ebx
call fcn.00543920
mov ecx, dword [ebx + 4]
cmp ecx, eax
cmovb ecx, eax
push ecx
mov ecx, ebx
call fcn.00543560
jmp 0x541da0
cmp edi, dword [ebx + 0x10]
jbe 0x541da0
mov ecx, eax
mov edx, 1
shr ecx, 1
add eax, ecx
cmp edi, eax
cmovb edx, ecx
mov ecx, ebx
add edx, dword [ebx + 8]
push edx
call fcn.00543920
cmp eax, dword [ebx + 4]
je 0x541da0
push eax
mov ecx, ebx
call fcn.00543a80
mov eax, dword [ebp + 0xc]
xor edx, edx
div dword [ebx + 4]
mov eax, dword [ebx + 0x14]
mov dword [ebp - 0x18], 0
lea edi, [eax + edx*4]
and edx, 0x7fffffff
mov dword [esi + 4], edx
mov eax, dword [edi]
test eax, eax
jne 0x541de8
mov eax, dword [ebx + 4]
mov edx, dword [ebx + 0x14]
lea ecx, [edx + eax*4]
mov eax, dword [ecx]
test eax, eax
je 0x541dde
mov eax, dword [eax + 4]
and eax, 0x7fffffff
mov dword [edx + eax*4], esi
mov dword [edi], ecx
mov eax, dword [ecx]
mov dword [esi], eax
mov dword [ecx], esi
jmp 0x541df0
mov eax, dword [eax]
mov dword [esi], eax
mov eax, dword [edi]
mov dword [eax], esi
inc dword [ebx + 8]
lea ecx, [ebp - 0x1c]
call fcn.005420d0
mov eax, dword [ebp + 8]
mov dword [eax], esi
mov byte [eax + 4], 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x543740
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push ecx
movzx eax, byte [ecx]
push ebx
mov ebx, dword [ebp + 0xc]
and eax, 1
push esi
push edi
lea edi, [ecx + 1]
mov dword [ebp - 4], ecx
add edi, eax
mov ecx, ebx
lea eax, [edi + 1]
neg edi
sbb edi, edi
and edi, eax
cmp dword [ebx + 0x14], 0xf
jbe 0x54376b
mov ecx, dword [ebx]
mov esi, dword [ebx + 0x10]
xor edx, edx
add esi, ecx
cmp ecx, esi
jae 0x543786
movzx eax, byte [ecx]
inc ecx
imul edx, edx, 0x1000193
xor edx, eax
cmp ecx, esi
jb 0x543776
mov ecx, dword [ebp - 4]
push edi
push ebx
push edx
call fcn.00541e90
mov ecx, dword [ebp + 8]
pop edi
pop esi
pop ebx
mov dword [ecx], eax
mov eax, ecx
mov esp, ebp
pop ebp
ret 8

Function at 0x543a80
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push edi
push dword [ebp + 8]
mov esi, ecx
mov dword [ebp - 4], esi
call fcn.00543560
mov ecx, dword [esi + 4]
mov eax, dword [esi + 0x14]
lea edi, [eax + ecx*4]
mov dword [ebp + 8], edi
mov edi, dword [edi]
test edi, edi
je 0x543b4f
push ebx
nop word [eax + eax]
cmp dword [edi + 0x1c], 0xf
lea eax, [edi + 8]
mov esi, edi
jbe 0x543abe
mov eax, dword [edi + 8]
mov ebx, dword [edi + 0x18]
xor edx, edx
add ebx, eax
cmp eax, ebx
jae 0x543ae0
nop dword [eax]
movzx ecx, byte [eax]
inc eax
imul edx, edx, 0x1000193
xor edx, ecx
cmp eax, ebx
jb 0x543ad0
mov ebx, dword [ebp - 4]
mov eax, edx
xor edx, edx
div dword [ebx + 4]
mov eax, edx
and eax, 0x7fffffff
mov dword [edi + 4], eax
mov eax, dword [edi]
test eax, eax
je 0x543b20
nop word [eax + eax]
mov ecx, dword [eax + 4]
shr ecx, 0x1f
not ecx
test cl, 1
jne 0x543b20
mov ecx, edx
mov esi, eax
or ecx, 0x80000000
mov dword [eax + 4], ecx
mov eax, dword [eax]
test eax, eax
jne 0x543b00
mov eax, dword [ebx + 0x14]
lea ecx, [eax + edx*4]
mov edx, dword [ebp + 8]
mov eax, dword [ecx]
test eax, eax
jne 0x543b38
mov dword [ecx], edx
mov edi, dword [esi]
mov dword [ebp + 8], esi
jmp 0x543b46
mov eax, dword [eax]
mov edi, dword [esi]
mov dword [esi], eax
mov ecx, dword [ecx]
mov eax, dword [edx]
mov dword [ecx], eax
mov dword [edx], edi
test edi, edi
jne 0x543ab0
pop ebx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x544c90
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x6a6bb5
mov eax, dword fs:[0]
push eax
sub esp, 0x24
mov eax, dword [0x73a280]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x2c], esi
xorps xmm0, xmm0
mov dword [ebp - 0x30], esi
push 0x40
movups xmmword [ebp - 0x28], xmm0
call fcn.005c8dfe
movups xmm0, xmmword [str.BufferedTransformation:_this_object_doesnt_allow_input]
mov ecx, eax
mov dword [ebp - 0x18], 0x37
add esp, 4
mov dword [ebp - 0x28], ecx
mov dword [ebp - 0x14], 0x3f
movups xmmword [ecx], xmm0
movups xmm0, xmmword [0x6ce0f0]
movups xmmword [ecx + 0x10], xmm0
movups xmm0, xmmword [0x6ce100]
movups xmmword [ecx + 0x20], xmm0
mov eax, dword [0x6ce110]
mov dword [ecx + 0x30], eax
mov ax, word [0x6ce114]
mov word [ecx + 0x34], ax
mov al, byte [0x6ce116]
mov byte [ecx + 0x36], al
mov byte [ecx + 0x37], 0
xorps xmm0, xmm0
mov dword [ebp - 4], 0
movq qword [esi + 4], xmm0
lea eax, [ebp - 0x28]
mov byte [ebp - 4], 1
push eax
lea ecx, [esi + 0x10]
mov dword [esi], vtable.CryptoPP::Exception.0
mov dword [esi + 0xc], 0
call fcn.0043ee60
mov ecx, dword [ebp - 0x14]
mov dword [esi], vtable.CryptoPP::NotImplemented.0
cmp ecx, 0xf
jbe 0x544d85
mov edx, dword [ebp - 0x28]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x544d7b
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x544da7
push ecx
push edx
call fcn.005c8a85
add esp, 8
mov dword [esi], vtable.CryptoPP::InputRejecting_class_CryptoPP::BufferedTransformation_::InputRejected.0
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.005c8a4d
mov esp, ebp
pop ebp
ret
call fcn.0064e36a
int3
Function at 0x544e40
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x6a6bb5
mov eax, dword fs:[0]
push eax
sub esp, 0x24
mov eax, dword [0x73a280]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x2c], esi
xorps xmm0, xmm0
mov dword [ebp - 0x30], esi
push 0x40
movups xmmword [ebp - 0x28], xmm0
call fcn.005c8dfe
movups xmm0, xmmword [str.BufferedTransformation:_this_object_doesnt_allow_input]
mov ecx, eax
mov dword [ebp - 0x18], 0x37
add esp, 4
mov dword [ebp - 0x28], ecx
mov dword [ebp - 0x14], 0x3f
movups xmmword [ecx], xmm0
movups xmm0, xmmword [0x6ce0f0]
movups xmmword [ecx + 0x10], xmm0
movups xmm0, xmmword [0x6ce100]
movups xmmword [ecx + 0x20], xmm0
mov eax, dword [0x6ce110]
mov dword [ecx + 0x30], eax
mov ax, word [0x6ce114]
mov word [ecx + 0x34], ax
mov al, byte [0x6ce116]
mov byte [ecx + 0x36], al
mov byte [ecx + 0x37], 0
xorps xmm0, xmm0
mov dword [ebp - 4], 0
movq qword [esi + 4], xmm0
lea eax, [ebp - 0x28]
mov byte [ebp - 4], 1
push eax
lea ecx, [esi + 0x10]
mov dword [esi], vtable.CryptoPP::Exception.0
mov dword [esi + 0xc], 0
call fcn.0043ee60
mov ecx, dword [ebp - 0x14]
mov dword [esi], vtable.CryptoPP::NotImplemented.0
cmp ecx, 0xf
jbe 0x544f35
mov edx, dword [ebp - 0x28]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x544f2b
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x544f57
push ecx
push edx
call fcn.005c8a85
add esp, 8
mov dword [esi], vtable.CryptoPP::InputRejecting_class_CryptoPP::Filter_::InputRejected.0
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.005c8a4d
mov esp, ebp
pop ebp
ret
call fcn.0064e36a
int3

Function at 0x547310
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, ecx
cmp dword [esi + 0x13e4], 0x20
je 0x547326
xor al, al
pop esi
pop ebp
ret 4
cmp byte [esi + 0x365], 0
jne 0x547362
push edi
lea edi, [esi + 0x13d4]
xor ecx, ecx
cmp dword [edi + 0x14], 0xf
jbe 0x547340
mov edi, dword [edi]
mov edx, dword [ebp + 8]
xor dword [edi + ecx*4], edx
inc ecx
mov eax, dword [esi + 0x13e4]
add edx, 0x1000193
shr eax, 2
cmp ecx, eax
jne 0x547343
pop edi
mov byte [esi + 0x365], 1
mov al, 1
pop esi
pop ebp
ret 4
Function at 0x54cfc0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x6a7485
mov eax, dword fs:[0]
push eax
sub esp, 0x50
mov eax, dword [0x73a280]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x4c], ecx
mov ecx, dword [ebp + 0xc]
mov eax, dword [ebp + 8]
mov dword [ebp - 0x50], ecx
mov ecx, dword [ebp + 0x10]
mov dword [ebp - 0x54], ecx
mov ecx, dword [ebp + 0x14]
mov dword [ebp - 0x58], ecx
lea ecx, [ebp - 0x40]
push eax
call fcn.0043ee60
lea eax, [ebp - 0x40]
mov dword [ebp - 4], 0
push eax
call fcn.0050a060
lea eax, [ebp - 0x40]
push eax
lea eax, [ebp - 0x28]
push eax
call fcn.0054cf00
add esp, 0xc
cmp dword [ebp - 0x14], 0xf
lea eax, [ebp - 0x28]
mov edi, dword [ebp - 0x28]
mov esi, dword [ebp - 0x18]
cmova eax, edi
add esi, eax
mov byte [ebp - 4], 1
xor edx, edx
cmp eax, esi
jae 0x54d060
nop word [eax + eax]
movzx ecx, byte [eax]
inc eax
imul edx, edx, 0x1000193
xor edx, ecx
cmp eax, esi
jb 0x54d050
mov ecx, dword [ebp - 0x4c]
lea eax, [ebp - 0x48]
push eax
lea eax, [ebp - 0x5c]
mov dword [ebp - 0x48], edx
push eax
call fcn.00543700
mov esi, dword [eax]
test esi, esi
jne 0x54d07f
mov byte [ebp - 0x41], 0
jmp 0x54d0e4
cmp dword [ebp - 0x2c], 0xf
lea eax, [ebp - 0x40]
push dword [ebp - 0x30]
cmova eax, dword [ebp - 0x40]
push eax
call fcn.0050c580
mov edi, eax
mov byte [ebp - 0x41], 1
mov eax, 0xaaaaaaab
add esp, 8
mul edi
movd xmm0, edi
pshufd xmm2, xmm0, 0
movaps xmm1, xmm2
mov eax, dword [ebp - 0x50]
shr edx, 1
lea ecx, [edx + edx*2]
sub edi, ecx
mov ecx, dword [ebp - 0x58]
mov dword [eax], edi
movups xmm0, xmmword [esi + 0xc]
mov eax, dword [ebp - 0x54]
mov edi, dword [ebp - 0x28]
movups xmmword [eax], xmm0
movups xmm0, xmmword [esi + 0x1c]
movups xmmword [ecx], xmm0
movups xmm0, xmmword [eax]
xorps xmm1, xmm0
movups xmmword [eax], xmm1
movups xmm0, xmmword [ecx]
xorps xmm2, xmm0
movups xmmword [ecx], xmm2
mov eax, dword [ebp - 0x14]
cmp eax, 0xf
jbe 0x54d113
lea ecx, [eax + 1]
mov eax, edi
cmp ecx, 0x1000
jb 0x54d109
mov edi, dword [eax - 4]
add ecx, 0x23
sub eax, edi
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x54d175
push ecx
push edi
call fcn.005c8a85
add esp, 8
mov ecx, dword [ebp - 0x2c]
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0xf
mov byte [ebp - 0x28], 0
cmp ecx, 0xf
jbe 0x54d155
mov edx, dword [ebp - 0x40]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x54d14b
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x54d175
push ecx
push edx
call fcn.005c8a85
add esp, 8
mov al, byte [ebp - 0x41]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.005c8a4d
mov esp, ebp
pop ebp
ret 0x10
call fcn.0064e36a
int3
Function at 0x54d180
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x6a127d
mov eax, dword fs:[0]
push eax
sub esp, 0x2c
mov eax, dword [0x73a280]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x30], ecx
mov ecx, dword [ebp + 0x10]
mov eax, dword [ebp + 8]
mov ebx, dword [ebp + 0xc]
mov dword [ebp - 0x34], ecx
lea ecx, [ebp - 0x28]
push eax
call fcn.0043ee60
lea eax, [ebp - 0x28]
mov dword [ebp - 4], 0
push eax
call fcn.0050a060
mov esi, dword [ebp - 0x28]
lea ecx, [ebp - 0x28]
mov edi, dword [ebp - 0x18]
add esp, 4
cmp dword [ebp - 0x14], 0xf
cmova ecx, esi
xor edx, edx
add edi, ecx
cmp ecx, edi
jae 0x54d200
nop
movzx eax, byte [ecx]
inc ecx
imul edx, edx, 0x1000193
xor edx, eax
cmp ecx, edi
jb 0x54d1f0
mov ecx, dword [ebp - 0x30]
lea eax, [ebp - 0x2c]
push eax
lea eax, [ebp - 0x38]
mov dword [ebp - 0x2c], edx
push eax
add ecx, 0x18
call fcn.00543700
mov eax, dword [eax]
test eax, eax
je 0x54d231
mov ecx, dword [eax + 0x28]
mov edx, dword [ebp - 0x34]
sub ecx, dword [eax + 0x24]
mov dword [edx], ecx
test ecx, ecx
jg 0x54d25a
mov dword [ebx], 0
xor bl, bl
mov eax, dword [ebp - 0x14]
cmp eax, 0xf
jbe 0x54d26d
lea ecx, [eax + 1]
mov eax, esi
cmp ecx, 0x1000
jb 0x54d263
mov esi, dword [eax - 4]
add ecx, 0x23
sub eax, esi
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x54d28d
jmp 0x54d263
mov eax, dword [eax + 0x24]
mov dword [ebx], eax
mov bl, 1
jmp 0x54d233
push ecx
push esi
call fcn.005c8a85
add esp, 8
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.005c8a4d
mov esp, ebp
pop ebp
ret 0xc
call fcn.0064e36a
int3
Function at 0x577840
Capabilities:
Hash data using djb2

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
mov ecx, ebx
push esi
push edi
lea edx, [ecx + 1]
nop
mov al, byte [ecx]
inc ecx
test al, al
jne 0x577850
mov edi, 0x1505
mov esi, 0
sub ecx, edx
je 0x577877
movsx edx, byte [ebx + esi]
mov eax, edi
shl eax, 5
inc esi
add edi, eax
add edi, edx
cmp esi, ecx
jb 0x577865
mov eax, edi
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x587d60
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x6a96df
mov eax, dword fs:[0]
push eax
sub esp, 8
push esi
push edi
mov eax, dword [0x73a280]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x10], edi
mov dword [edi], vtable.CRaceData.0
xorps xmm0, xmm0
movups xmmword [edi + 0x20], xmm0
mov dword [edi + 0x30], 0
mov dword [edi + 0x34], 0xf
mov byte [edi + 0x20], 0
movups xmmword [edi + 0x38], xmm0
mov dword [edi + 0x48], 0
mov dword [edi + 0x4c], 0xf
mov dword [ebp - 4], 0
mov byte [edi + 0x38], 0
movups xmmword [edi + 0x50], xmm0
mov dword [edi + 0x60], 0
mov dword [edi + 0x64], 0xf
mov byte [edi + 0x50], 0
movups xmmword [edi + 0x68], xmm0
mov dword [edi + 0x78], 0
mov dword [edi + 0x7c], 0xf
mov byte [edi + 0x68], 0
movups xmmword [edi + 0x80], xmm0
mov dword [edi + 0x90], 0
mov dword [edi + 0x94], 0xf
mov byte [edi + 0x80], 0
lea esi, [edi + 0x98]
mov byte [ebp - 4], 4
push 0x20
mov dword [ebp - 0x14], esi
mov dword [esi], 0
mov dword [esi + 4], 0
call fcn.005c8dfe
mov dword [eax], eax
mov dword [eax + 4], eax
mov dword [eax + 8], eax
mov word [eax + 0xc], 0x101
mov dword [esi], eax
lea esi, [edi + 0xa0]
mov byte [ebp - 4], 5
push 0x18
mov dword [ebp - 0x14], esi
mov dword [esi], 0
mov dword [esi + 4], 0
call fcn.005c8dfe
mov dword [eax], eax
mov dword [eax + 4], eax
mov dword [eax + 8], eax
mov word [eax + 0xc], 0x101
mov dword [esi], eax
lea esi, [edi + 0xa8]
mov byte [ebp - 4], 6
push 0x2c
mov dword [ebp - 0x14], esi
mov dword [esi], 0
mov dword [esi + 4], 0
call fcn.005c8dfe
mov dword [eax], eax
mov dword [eax + 4], eax
mov dword [eax + 8], eax
mov word [eax + 0xc], 0x101
mov dword [esi], eax
lea esi, [edi + 0xb0]
mov byte [ebp - 4], 7
push 0x20
mov dword [ebp - 0x14], esi
mov dword [esi], 0
mov dword [esi + 4], 0
call fcn.005c8dfe
mov dword [eax], eax
mov dword [eax + 4], eax
mov dword [eax + 8], eax
mov word [eax + 0xc], 0x101
mov dword [esi], eax
mov byte [ebp - 4], 8
lea esi, [edi + 0xb8]
mov dword [esi], 0
push 0x18
mov dword [ebp - 0x14], esi
mov dword [esi + 4], 0
call fcn.005c8dfe
mov dword [eax], eax
mov dword [eax + 4], eax
mov dword [eax + 8], eax
mov word [eax + 0xc], 0x101
mov dword [esi], eax
lea esi, [edi + 0xc0]
mov byte [ebp - 4], 9
push 0x38
mov dword [ebp - 0x14], esi
mov dword [esi], 0
mov dword [esi + 4], 0
call fcn.005c8dfe
mov dword [eax], eax
mov dword [eax + 4], eax
mov dword [eax + 8], eax
mov word [eax + 0xc], 0x101
mov dword [esi], eax
lea esi, [edi + 0xc8]
mov byte [ebp - 4], 0xa
push 0x38
mov dword [ebp - 0x14], esi
mov dword [esi], 0
mov dword [esi + 4], 0
call fcn.005c8dfe
add esp, 0x1c
mov dword [eax], eax
mov dword [eax + 4], eax
mov dword [eax + 8], eax
mov word [eax + 0xc], 0x101
mov dword [esi], eax
mov dword [edi + 0xd0], 0
mov dword [edi + 0xd4], 0
mov dword [edi + 0xd8], 0
mov ecx, edi
mov byte [ebp - 4], 0xc
call fcn.0058a9c0
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x58ad70
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x6a99f3
mov eax, dword fs:[0]
push eax
sub esp, 8
push esi
push edi
mov eax, dword [0x73a280]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x10], edi
mov dword [0x748c80], edi
lea esi, [edi + 4]
mov dword [edi], vtable.CRaceManager.0
push 0x18
mov dword [ebp - 4], 0
mov dword [ebp - 0x14], esi
mov dword [esi], 0
mov dword [esi + 4], 0
call fcn.005c8dfe
mov dword [eax], eax
mov dword [eax + 4], eax
mov dword [eax + 8], eax
mov word [eax + 0xc], 0x101
mov dword [esi], eax
lea esi, [edi + 0xc]
mov byte [ebp - 4], 1
push 0x40
mov dword [ebp - 0x14], esi
mov dword [esi], 0
mov dword [esi + 4], 0
call fcn.005c8dfe
mov dword [eax], eax
mov dword [eax + 4], eax
mov dword [eax + 8], eax
mov word [eax + 0xc], 0x101
mov dword [esi], eax
lea esi, [edi + 0x14]
mov byte [ebp - 4], 2
push 0x2c
mov dword [ebp - 0x14], esi
mov dword [esi], 0
mov dword [esi + 4], 0
call fcn.005c8dfe
xorps xmm0, xmm0
add esp, 0xc
mov ecx, edi
mov dword [eax], eax
mov dword [eax + 4], eax
mov dword [eax + 8], eax
mov word [eax + 0xc], 0x101
mov dword [esi], eax
movups xmmword [edi + 0x1c], xmm0
mov dword [edi + 0x2c], 0
mov dword [edi + 0x30], 0xf
mov byte [edi + 0x1c], 0
call fcn.0058c260
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x590ee0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x6aa023
mov eax, dword fs:[0]
push eax
sub esp, 8
push esi
push edi
mov eax, dword [0x73a280]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x10], edi
xorps xmm0, xmm0
movups xmmword [edi], xmm0
mov dword [edi + 0x10], 0
mov dword [edi + 0x14], 0
mov dword [edi + 0x10], 0
mov dword [edi + 0x14], 0xf
mov byte [edi], 0
movups xmmword [edi + 0x18], xmm0
mov dword [edi + 0x28], 0
mov dword [edi + 0x2c], 0xf
mov dword [ebp - 4], 0
mov byte [edi + 0x18], 0
lea esi, [edi + 0x38]
mov dword [edi + 0x30], 0
mov dword [edi + 0x34], 0
push 0x34
mov byte [ebp - 4], 1
mov dword [ebp - 0x14], esi
mov dword [esi], 0
mov dword [esi + 4], 0
call fcn.005c8dfe
add esp, 4
mov dword [eax], eax
mov dword [eax + 4], eax
mov dword [eax + 8], eax
mov word [eax + 0xc], 0x101
mov dword [esi], eax
mov edx, dword [ebp + 8]
mov eax, edx
mov byte [ebp - 4], 2
lea esi, [eax + 1]
nop dword [eax]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x590fa0
sub eax, esi
mov ecx, edi
push eax
push edx
call fcn.00445140
push edi
call fcn.00506330
add esp, 4
mov eax, edi
cmp dword [edi + 0x14], 0xf
jbe 0x590fc5
mov eax, dword [edi]
push 0x2f
push eax
call fcn.00644280
add esp, 8
mov dword [edi + 0x30], eax
test eax, eax
jne 0x590fe3
cmp dword [edi + 0x14], 0xf
mov eax, edi
jbe 0x590fe4
mov eax, dword [edi]
jmp 0x590fe4
inc eax
mov dword [edi + 0x30], eax
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4