joyce8/EMBER2024-capa huggingface dataset:
Function at 0x44b500
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x519c16
mov eax, dword fs:[0]
push eax
sub esp, 0x424
mov eax, dword [0x5ba11c]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov eax, dword [ebp + 0xc]
mov edi, dword [ebp + 8]
mov dword [ebp - 0x420], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x41c], eax
mov dword [ebp - 0x430], 0
mov dword [ebp - 4], 0
mov dword [ebp - 0x428], ecx
mov dword [ebp - 0x42c], 0
mov dword [ebp - 0x418], 0
push 0x60
push 0
mov byte [ebp - 4], 1
mov ebx, dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
push edi
call ebx
mov esi, eax
mov dword [ebp - 0x424], esi
test esi, esi
jne 0x44b5ac
push 2
push eax
push edi
call ebx
mov esi, eax
mov dword [ebp - 0x424], eax
test esi, esi
jne 0x44b5ac
call fcn.0044a970
mov edi, eax
jmp 0x44b6cb
push dword [ebp - 0x41c]
push dword [ebp - 0x420]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov edi, eax
test edi, edi
jne 0x44b5cf
call fcn.0044a970
jmp 0x44b6be
push edi
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov ebx, eax
mov dword [ebp - 0x420], ebx
test ebx, ebx
jne 0x44b5ed
call fcn.0044a970
jmp 0x44b6be
push edi
push esi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov edi, eax
mov dword [ebp - 0x41c], edi
lea eax, [edi + 1]
cmp eax, edi
jae 0x44b60e
mov edi, 0x8007000e
jmp 0x44b6c0
mov ecx, 2
mov byte [ebp - 4], 2
mul ecx
test edx, edx
ja 0x44b704
jb 0x44b62c
cmp eax, 0xffffffff
ja 0x44b704
cmp eax, 0x400
jbe 0x44b641
push eax
lea ecx, [ebp - 0x418]
call fcn.00453850
jmp 0x44b667
lea eax, [ebp - 0x414]
mov dword [ebp - 0x418], eax
jmp 0x44b667
mov dword [ebp - 4], 1
cmp dword [ebp - 0x418], 0
jne 0x44b67e
mov edi, 0x8007000e
jmp 0x44b6c0
push edi
push dword [ebp - 0x418]
push edi
push ebx
push 0
push 3
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov ecx, eax
test ecx, ecx
jne 0x44b69e
call fcn.0044a970
jmp 0x44b6be
mov eax, dword [ebp - 0x418]
xor edx, edx
push dword [ebp + 0x14]
mov word [eax + ecx*2], dx
lea ecx, [ebp - 0x42c]
push dword [ebp - 0x418]
call fcn.0044c2c0
mov edi, eax
test esi, esi
je 0x44b6cb
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
lea eax, [ebp - 0x414]
cmp dword [ebp - 0x418], eax
je 0x44b6e4
lea ecx, [ebp - 0x418]
call fcn.00453600
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.004eabba
mov esp, ebp
pop ebp
ret 0x10
push 0x80070216
call fcn.0044a700
int3
Function at 0x44f450
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x519b40
mov eax, dword fs:[0]
push eax
sub esp, 8
push esi
mov eax, dword [0x5ba11c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov eax, dword [esi]
test eax, eax
jne 0x44f495
sub esp, 8
mov edx, 0x9d
mov ecx, str.ATL::CAtlFile::Write
call fcn.0044d7e0
mov eax, dword [esi]
add esp, 8
push 0
lea ecx, [ebp - 0x10]
push ecx
push dword [ebp + 0xc]
push dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x44f4c3
call fcn.0044a970
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret 0xc
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret 0xc
Function at 0x454110
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov ebx, ecx
push edi
push dword [ebx]
call dword [sym.imp.USER32.dll_GetWindowTextLengthW]
lea edi, [eax + 1]
test edi, edi
js 0x45418d
mov esi, dword [ebp + 8]
mov ecx, 1
mov edx, dword [esi]
mov eax, dword [edx - 8]
sub ecx, dword [edx - 4]
sub eax, edi
or ecx, eax
jge 0x454147
push edi
mov ecx, esi
call fcn.004536f0
mov edx, dword [esi]
push edi
push edx
push dword [ebx]
call dword [sym.imp.USER32.dll_GetWindowTextW]
mov edi, eax
mov ecx, edi
cmp edi, 0xffffffff
jne 0x45416e
mov ecx, dword [esi]
test ecx, ecx
je 0x454172
push dword [ecx - 8]
push ecx
call fcn.004f5e70
add esp, 8
mov ecx, eax
test ecx, ecx
js 0x45418d
mov eax, dword [esi]
cmp ecx, dword [eax - 8]
jg 0x45418d
mov dword [eax - 0xc], ecx
xor edx, edx
mov eax, dword [esi]
mov word [eax + ecx*2], dx
mov eax, edi
pop edi
pop esi
pop ebx
pop ebp
ret 4
push 0x80070057
call fcn.0044a700
int3

Function at 0x4541a0
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
push ebx
push dword [ebp + 8]
push dword [ecx]
call dword [sym.imp.USER32.dll_GetDlgItem]
mov ebx, eax
test ebx, ebx
je 0x45422a
push esi
push edi
push ebx
call dword [sym.imp.USER32.dll_GetWindowTextLengthW]
lea edi, [eax + 1]
test edi, edi
js 0x454239
mov esi, dword [ebp + 0xc]
mov ecx, 1
mov edx, dword [esi]
mov eax, dword [edx - 8]
sub ecx, dword [edx - 4]
sub eax, edi
or ecx, eax
jge 0x4541e5
push edi
mov ecx, esi
call fcn.004536f0
mov edx, dword [esi]
push edi
push edx
push ebx
call dword [sym.imp.USER32.dll_GetWindowTextW]
mov edi, eax
mov ecx, edi
cmp edi, 0xffffffff
jne 0x45420b
mov ecx, dword [esi]
test ecx, ecx
je 0x45420f
push dword [ecx - 8]
push ecx
call fcn.004f5e70
add esp, 8
mov ecx, eax
test ecx, ecx
js 0x454239
mov eax, dword [esi]
cmp ecx, dword [eax - 8]
jg 0x454239
mov dword [eax - 0xc], ecx
xor edx, edx
mov eax, dword [esi]
mov word [eax + ecx*2], dx
mov eax, edi
pop edi
pop esi
pop ebx
pop ebp
ret 8
mov ecx, dword [ebp + 0xc]
call fcn.00452cf0
xor eax, eax
pop ebx
pop ebp
ret 8
push 0x80070057
call fcn.0044a700
int3

Function at 0x4544b0
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, dword [ebp + 0x10]
mov edx, 1
push edi
mov ebx, ecx
mov edi, dword [esi]
mov eax, dword [edi - 8]
sub edx, dword [edi - 4]
sub eax, 0x400
or edx, eax
jge 0x4544df
push 0x400
mov ecx, esi
call fcn.004536f0
mov edi, dword [esi]
push ebx
push 0x400
push edi
push dword [ebp + 0x14]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
xor ecx, ecx
cmp ecx, eax
sbb edi, edi
neg edi
cmp ecx, eax
sbb edx, edx
test eax, eax
je 0x45451d
mov eax, dword [esi]
test eax, eax
jne 0x45450f
xor edx, edx
jmp 0x454521
push dword [eax - 8]
push eax
call fcn.004f5e70
add esp, 8
mov edx, eax
test edx, edx
js 0x45453c
mov ecx, dword [esi]
cmp edx, dword [ecx - 8]
jg 0x45453c
mov dword [ecx - 0xc], edx
xor eax, eax
mov ecx, dword [esi]
mov word [ecx + edx*2], ax
mov eax, edi
pop edi
pop esi
pop ebx
pop ebp
ret 0x10
push 0x80070057
call fcn.0044a700
int3
Function at 0x460ea0
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x51f1a8
mov eax, dword fs:[0]
push eax
sub esp, 0x34
push ebx
push esi
push edi
mov eax, dword [0x5ba11c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov dword [ebp - 4], 0
call fcn.0044d220
mov ecx, eax
test ecx, ecx
je 0x460fb8
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x10], eax
push dword [ebp + 8]
lea eax, [ebp - 0x10]
mov dword [ebp - 4], 1
push str.Column_dWidth
push eax
call fcn.00453b60
mov esi, dword [ebp - 0x10]
add esp, 0xc
push dword [ebx + 4]
push 0x78
push esi
push str.ListView
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
mov edi, eax
cmp edi, 0x3c
jge 0x460f28
mov edi, 0x3c
jmp 0x460f35
cmp edi, 0x1f4
jle 0x460f35
mov edi, 0x1f4
add esi, 0xfffffff0
mov dword [ebp - 4], 2
or eax, 0xffffffff
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x460f54
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
mov eax, dword [ebp + 0xc]
lea ecx, [ebp - 0x3c]
mov dword [ebp - 0x30], eax
xorps xmm0, xmm0
mov eax, dword [ebp + 8]
push ecx
push eax
mov dword [ebp - 0x28], eax
mov eax, dword [ebx]
push 0x1061
mov dword [ebp - 0x2c], 0
movlpd qword [ebp - 0x24], xmm0
movlpd qword [ebp - 0x18], xmm0
mov dword [ebp - 0x3c], 0x4f
mov dword [ebp - 0x38], 0
mov dword [ebp - 0x34], edi
mov dword [ebp - 0x1c], 0x3c
push dword [eax + 0xc8]
call dword [sym.imp.USER32.dll_SendMessageW]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
push 0x80004005
call fcn.0044a700
int3
Function at 0x46a4f0
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
mov ebx, dword [ebp + 8]
movzx eax, bl
xor eax, 0x811c9dc5
mov dword [ebp - 8], ecx
imul edx, eax, 0x1000193
mov eax, ebx
shr eax, 8
movzx eax, al
push esi
push edi
xor edx, eax
mov eax, ebx
imul ecx, edx, 0x1000193
shr eax, 0x10
movzx eax, al
xor ecx, eax
mov eax, ebx
imul ecx, ecx, 0x1000193
shr eax, 0x18
xor ecx, eax
imul eax, ecx, 0x1000193
mov ecx, dword [0x5c44d4]
and eax, dword [0x5c44e0]
lea edx, [eax*8]
mov esi, dword [edx + ecx]
lea edi, [edx + ecx]
mov edx, dword [0x5c44cc]
mov eax, esi
nop dword [eax + eax]
cmp esi, edx
jne 0x46a568
mov ecx, edx
jmp 0x46a56d
mov ecx, dword [edi + 4]
mov ecx, dword [ecx]
cmp eax, ecx
je 0x46a58a
cmp dword [eax + 8], ebx
je 0x46a57a
mov eax, dword [eax]
jmp 0x46a560
cmp eax, edx
je 0x46a58a
mov eax, dword [eax + 0xc]
mov dword [ebp - 0x10], eax
mov byte [ebp - 0xc], 1
jmp 0x46a592
xorps xmm0, xmm0
movlpd qword [ebp - 0x10], xmm0
mov edx, dword [ebp - 8]
lea ecx, [ebp - 0x10]
mov eax, dword [ecx]
pop edi
pop esi
mov dword [edx + 0xe4], eax
mov eax, dword [ecx + 4]
mov dword [edx + 0xe8], eax
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x46c990
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, ecx
movzx eax, byte [esi]
xor eax, 0x811c9dc5
imul edx, eax, 0x1000193
movzx eax, byte [esi + 1]
xor edx, eax
movzx eax, byte [esi + 2]
imul edx, edx, 0x1000193
xor edx, eax
movzx eax, byte [esi + 3]
imul ecx, edx, 0x1000193
mov edx, dword [edi + 0xc]
xor ecx, eax
imul eax, ecx, 0x1000193
mov ecx, dword [edi + 0x18]
mov edi, dword [edi + 4]
and ecx, eax
mov ebx, dword [edx + ecx*8]
lea edx, [edx + ecx*8]
add edx, 4
mov dword [ebp + 8], ebx
mov eax, ebx
mov dword [ebp - 4], edx
nop dword [eax]
cmp ebx, edi
jne 0x46c9f8
mov ecx, edi
jmp 0x46c9fc
mov ecx, dword [edx]
mov ecx, dword [ecx]
cmp eax, ecx
je 0x46ca3b
mov ebx, dword [esi]
cmp dword [eax + 8], ebx
je 0x46ca0e
mov eax, dword [eax]
mov ebx, dword [ebp + 8]
jmp 0x46c9f0
mov ecx, eax
mov esi, eax
mov dword [ebp - 8], ecx
mov ecx, dword [ebp + 8]
cmp ecx, edi
jne 0x46ca20
mov edx, edi
jmp 0x46ca24
mov edx, dword [edx]
mov edx, dword [edx]
cmp eax, edx
je 0x46ca34
cmp ebx, dword [eax + 8]
jne 0x46ca34
mov eax, dword [eax]
mov edx, dword [ebp - 4]
jmp 0x46ca18
mov ecx, dword [ebp - 8]
cmp esi, eax
jne 0x46ca3f
mov ecx, edi
mov eax, edi
xor edx, edx
cmp ecx, eax
je 0x46ca4c
mov ecx, dword [ecx]
inc edx
cmp ecx, eax
jne 0x46ca45
pop edi
pop esi
mov eax, edx
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x46faa0
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x520478
mov eax, dword fs:[0]
push eax
sub esp, 0x2c
mov eax, dword [0x5ba11c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov esi, dword [ebp + 0x14]
lea eax, [ebx - 0x24]
mov ecx, 4
test ebx, ebx
xorps xmm0, xmm0
cmove eax, ecx
lea ecx, [ebp - 0x20]
push ecx
movups xmmword [ebp - 0x20], xmm0
push dword [eax]
call dword [sym.imp.USER32.dll_GetWindowRect]
mov eax, dword [ebp - 0x18]
sub eax, dword [ebp - 0x20]
mov ecx, dword [ebx + 0x28]
mov dword [ebx + 0x20], eax
mov eax, dword [ebp - 0x14]
sub eax, dword [ebp - 0x1c]
mov dword [ebx + 0x24], eax
test ecx, ecx
je 0x46fbe5
mov eax, dword [ebx + 0x2c]
test eax, eax
je 0x46fbe5
mov dword [ebp - 0x34], 0
mov dword [ebp - 0x30], 0
mov dword [ebp - 0x2c], 0
push 0
push ecx
push 0x2001f
sub esp, 8
mov dword [ebp - 4], 0
push eax
push ecx
lea ecx, [ebp - 0x34]
call fcn.0044ad50
mov edi, dword [ebp - 0x34]
test eax, eax
jne 0x46fbda
mov eax, dword [ebx + 0x20]
mov dword [ebp - 0x24], eax
lea eax, [ebp - 0x28]
push eax
call fcn.0046fca0
push 4
lea ecx, [ebp - 0x24]
push ecx
push 4
push 0
push dword [eax]
push edi
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov edx, dword [ebp - 0x28]
add edx, 0xfffffff0
mov byte [ebp - 4], 1
or eax, 0xffffffff
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x46fb95
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov byte [ebp - 4], 0
mov eax, dword [ebx + 0x24]
mov dword [ebp - 0x28], eax
lea eax, [ebp - 0x24]
push eax
call fcn.0046fc10
push 4
lea ecx, [ebp - 0x28]
push ecx
push 4
push 0
push dword [eax]
push edi
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov edx, dword [ebp - 0x24]
add edx, 0xfffffff0
mov byte [ebp - 4], 2
or eax, 0xffffffff
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x46fbda
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
test edi, edi
je 0x46fbe5
push edi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
mov dword [esi], eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004eabba
mov esp, ebp
pop ebp
ret 0x10
Function at 0x470c90
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x51ba80
mov eax, dword fs:[0]
push eax
push esi
push edi
mov eax, dword [0x5ba11c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
push 8
mov dword [edi], vtable.std::basic_streambuf_char__struct_std::char_traits_char__.0
call fcn.004eb06d
mov esi, eax
push 1
mov dword [ebp - 4], 0
call fcn.004d16e6
mov dword [esi + 4], eax
lea ecx, [edi + 8]
lea eax, [edi + 4]
mov dword [edi + 0x34], esi
mov dword [edi + 0xc], eax
add esp, 8
lea eax, [edi + 0x14]
mov dword [edi + 0x10], ecx
mov dword [edi + 0x1c], eax
lea eax, [edi + 0x18]
mov dword [edi + 0x20], eax
lea eax, [edi + 0x24]
mov dword [edi + 0x2c], eax
lea eax, [edi + 0x28]
mov dword [edi + 0x30], eax
mov dword [ecx], 0
mov eax, dword [edi + 0x20]
mov dword [eax], 0
mov eax, dword [edi + 0x30]
mov dword [eax], 0
mov eax, dword [edi + 0xc]
mov dword [eax], 0
mov eax, dword [edi + 0x1c]
mov dword [eax], 0
mov eax, dword [edi + 0x2c]
mov dword [eax], 0
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x470ed0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 0xc]
mov ecx, 0
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, 0x811c9dc5
sub edx, edi
sar edx, 1
add edx, edx
je 0x470f01
nop dword [eax]
movzx eax, byte [ecx + edi]
inc ecx
xor eax, esi
imul esi, eax, 0x1000193
cmp ecx, edx
jb 0x470ef0
pop edi
mov eax, esi
pop esi
pop ebp
ret 8
Function at 0x473ec0
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x52086e
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x5ba11c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x10], edi
mov esi, dword [ebp + 8]
movzx eax, byte [esi]
mov byte [edi], al
movzx eax, byte [esi + 1]
mov byte [edi + 1], al
mov eax, dword [esi + 4]
mov dword [edi + 4], eax
mov ecx, dword [esi + 8]
sub ecx, 0x10
call fcn.00453690
add eax, 0x10
mov dword [edi + 8], eax
mov dword [ebp - 4], 0
mov ecx, dword [esi + 0xc]
sub ecx, 0x10
call fcn.00453690
add eax, 0x10
mov dword [edi + 0xc], eax
mov byte [ebp - 4], 1
mov ecx, dword [esi + 0x10]
sub ecx, 0x10
call fcn.00453690
add eax, 0x10
mov dword [edi + 0x10], eax
mov byte [ebp - 4], 2
mov ecx, dword [esi + 0x14]
sub ecx, 0x10
call fcn.00453690
add eax, 0x10
mov dword [edi + 0x14], eax
mov byte [ebp - 4], 3
mov ecx, dword [esi + 0x18]
sub ecx, 0x10
call fcn.00453690
add eax, 0x10
mov dword [edi + 0x18], eax
mov byte [ebp - 4], 4
mov ecx, dword [esi + 0x1c]
sub ecx, 0x10
call fcn.00453690
add eax, 0x10
mov dword [edi + 0x1c], eax
mov byte [ebp - 4], 5
mov ecx, dword [esi + 0x20]
sub ecx, 0x10
call fcn.00453690
add eax, 0x10
mov dword [edi + 0x20], eax
mov byte [ebp - 4], 6
mov ecx, dword [esi + 0x24]
sub ecx, 0x10
call fcn.00453690
add eax, 0x10
mov dword [edi + 0x24], eax
mov byte [ebp - 4], 7
mov ecx, dword [esi + 0x28]
sub ecx, 0x10
call fcn.00453690
add eax, 0x10
mov dword [edi + 0x28], eax
mov byte [ebp - 4], 8
mov eax, dword [esi + 0x2c]
mov dword [edi + 0x2c], eax
mov ecx, dword [esi + 0x30]
sub ecx, 0x10
call fcn.00453690
add eax, 0x10
mov dword [edi + 0x30], eax
mov byte [ebp - 4], 9
mov ecx, dword [esi + 0x34]
sub ecx, 0x10
call fcn.00453690
add eax, 0x10
mov dword [edi + 0x34], eax
mov eax, dword [esi + 0x38]
mov dword [edi + 0x38], eax
mov eax, dword [esi + 0x3c]
mov dword [edi + 0x3c], eax
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x474db0
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x520a10
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push ebx
push esi
push edi
mov eax, dword [0x5ba11c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov ebx, ecx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 4], 0
mov edi, dword [ebp + 0xc]
mov esi, dword [ebx + 0xc]
movzx eax, byte [edi]
xor eax, 0x811c9dc5
imul edx, eax, 0x1000193
movzx eax, byte [edi + 1]
xor edx, eax
movzx eax, byte [edi + 2]
imul ecx, edx, 0x1000193
mov edx, dword [ebx + 4]
xor ecx, eax
movzx eax, byte [edi + 3]
imul ecx, ecx, 0x1000193
xor ecx, eax
imul eax, ecx, 0x1000193
mov ecx, dword [ebx + 0x18]
and ecx, eax
shl ecx, 3
mov dword [ebp + 0xc], ecx
mov eax, dword [esi + ecx]
cmp eax, edx
jne 0x474e38
mov esi, edx
jmp 0x474e40
mov esi, dword [esi + ecx + 4]
mov esi, dword [esi]
nop
cmp esi, eax
je 0x474e6b
mov esi, dword [esi + 4]
mov ecx, dword [edi]
cmp ecx, dword [esi + 8]
jne 0x474e40
mov eax, dword [ebp + 8]
mov dword [eax], esi
mov byte [eax + 4], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov dword [ebp - 4], 0xffffffff
mov eax, dword [edx]
push edi
mov dword [ebp - 0x14], eax
mov ecx, dword [eax + 4]
push ecx
push eax
mov dword [ebp - 0x18], ecx
call fcn.0047c150
mov edx, eax
mov ecx, 0x15555554
mov eax, dword [ebx + 8]
sub ecx, eax
cmp ecx, 1
jb 0x474f66
inc eax
mov dword [ebx + 8], eax
mov eax, dword [ebp - 0x14]
mov dword [eax + 4], edx
mov eax, dword [ebp - 0x18]
mov dword [eax], edx
mov ecx, dword [ebx + 4]
mov edi, dword [ecx]
mov dword [ebp - 0x18], edi
mov eax, dword [edi]
cmp esi, eax
je 0x474edb
mov ecx, dword [edi + 4]
mov dword [ecx], eax
mov ecx, dword [eax + 4]
mov dword [ecx], esi
mov ecx, dword [esi + 4]
mov dword [ecx], edi
mov ecx, dword [eax + 4]
mov edx, dword [esi + 4]
mov dword [esi + 4], ecx
mov ecx, dword [edi + 4]
mov dword [eax + 4], ecx
mov dword [edi + 4], edx
mov ecx, dword [ebx + 4]
mov edx, dword [ebp + 0xc]
add edx, dword [ebx + 0xc]
mov eax, dword [edx]
cmp eax, ecx
jne 0x474ef5
mov ecx, dword [ebp + 0xc]
mov dword [edx], edi
mov eax, dword [ebx + 0xc]
mov dword [ecx + eax + 4], edi
jmp 0x474f18
cmp eax, esi
jne 0x474efd
mov dword [edx], edi
jmp 0x474f18
mov eax, dword [edx + 4]
mov eax, dword [eax]
mov dword [edx + 4], eax
cmp eax, edi
je 0x474f18
mov ecx, dword [ebp + 0xc]
add ecx, dword [ebx + 0xc]
mov eax, dword [ecx + 4]
mov eax, dword [eax + 4]
mov dword [ecx + 4], eax
mov ecx, ebx
mov dword [ebp - 4], 2
call fcn.00475a00
mov eax, dword [ebp + 8]
mov dword [eax], edi
mov byte [eax + 4], 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
push 0x583568
call fcn.004d1b13
int3
Function at 0x4758f0
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x520ace
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x5ba11c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
mov dword [esi + 4], 0
mov dword [esi + 8], 0
mov dword [esi + 0xc], 0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
mov dword [esi + 0x18], 0
mov dword [esi + 0x1c], 0
mov dword [ebp - 4], 0
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x2c], 0
mov dword [esi + 0x30], 0
mov dword [esi + 0x34], 0
mov dword [esi + 0x38], 0
mov dword [esi + 0x3c], 0
lea ecx, [esi + 0x40]
mov dword [ecx], 0
mov dword [ecx + 4], 0
mov dword [ecx + 8], 0
mov eax, dword [ebp + 0xc]
mov edi, dword [ebp + 0x14]
mov edx, dword [ebp + 0x20]
mov byte [ebp - 4], 2
mov dword [esi + 0x50], eax
mov eax, dword [ebp + 8]
mov dword [esi + 0x54], eax
mov eax, dword [ebp + 0x1c]
mov dword [esi + 0x5c], eax
mov eax, dword [ebp + 0x18]
mov dword [esi + 0x58], edi
mov dword [esi + 0x60], edx
mov byte [esi + 0x64], 0
mov dword [esi + 0x68], eax
test byte [edi + 8], 8
je 0x4759d5
test dl, 0x10
jne 0x4759d5
mov al, 1
jmp 0x4759d7
xor al, al
mov byte [esi + 0x6c], al
mov eax, dword [ebp + 0x10]
push ecx
mov dword [esi + 0x70], eax
push dword [edi + 0x18]
call fcn.00477ce0
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 0x1c

Function at 0x475aa0
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
mov ebx, ecx
movzx eax, byte [edi + 8]
xor eax, 0x811c9dc5
imul edx, eax, 0x1000193
movzx eax, byte [edi + 9]
xor edx, eax
movzx eax, byte [edi + 0xa]
imul edx, edx, 0x1000193
xor edx, eax
movzx eax, byte [edi + 0xb]
imul ecx, edx, 0x1000193
xor ecx, eax
imul eax, ecx, 0x1000193
mov ecx, dword [ebx + 0x18]
and ecx, eax
lea edx, [ecx*8]
mov ecx, dword [ebx + 0xc]
add ecx, edx
mov eax, dword [ecx]
cmp dword [ecx + 4], edi
jne 0x475b13
cmp eax, edi
jne 0x475b0b
mov eax, dword [ebx + 4]
mov dword [ecx], eax
mov ecx, dword [ebx + 0xc]
mov eax, dword [ebx + 4]
mov dword [edx + ecx + 4], eax
jmp 0x475b1b
mov eax, dword [edi + 4]
mov dword [ecx + 4], eax
jmp 0x475b1b
cmp eax, edi
jne 0x475b1e
mov eax, dword [edi]
mov dword [ecx], eax
mov edi, dword [ebp + 0xc]
mov eax, dword [edi + 4]
mov esi, dword [edi]
push 0xc
push edi
mov dword [eax], esi
mov ecx, dword [edi]
mov eax, dword [edi + 4]
mov dword [ecx + 4], eax
dec dword [ebx + 8]
call fcn.004eb418
mov eax, dword [ebp + 8]
add esp, 8
pop edi
mov dword [eax], esi
pop esi
pop ebx
pop ebp
ret 8