joyce8/EMBER2024-capa huggingface dataset:
Function at 0x425890
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov ebx, ecx
mov dword [ebp - 4], 0
push edi
mov edi, edx
test ebx, ebx
je 0x4258f2
cmp dword [0x495f18], 0
jne 0x4258df
push 0x4c
call fcn.0045a053
add esp, 4
mov ecx, eax
call fcn.004136c0
mov edx, eax
mov esi, 0x495f18
mov ecx, edx
xor eax, eax
lock cmpxchg dword [esi], ecx
test eax, eax
je 0x4258df
test edx, edx
je 0x4258df
push ecx
mov ecx, edx
call fcn.00413680
mov eax, dword [0x495f18]
cmp dword [eax], 1
jl 0x4258f2
mov dword [ebp - 4], 0x10000
jmp 0x4258f4
xor ebx, ebx
push 0xc
call fcn.0045a053
add esp, 4
mov esi, eax
push 0
push dword [ebp - 4]
mov dword [esi], edi
mov edi, dword [ebp + 8]
test edi, edi
push esi
push 0x4257d0
setne cl
push ebx
mov byte [esi + 4], cl
mov ecx, dword [ebp + 0xc]
push 0
mov dword [esi + 8], ecx
call dword [sym.imp.KERNEL32.dll_CreateThread]
test eax, eax
jne 0x42593d
push esi
call fcn.0045a086
add esp, 4
xor al, al
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
test edi, edi
je 0x42594c
mov dword [edi], eax
mov al, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
mov al, 1
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x42c590
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
mov eax, dword [0x492250]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 0xc]
push esi
push edi
mov edi, dword [ebp + 8]
push 0
push 0
sub esp, 8
mov edx, esp
mov dword [edx], edi
test edi, edi
jne 0x42c5bc
xor ecx, ecx
jmp 0x42c5d9
cmp byte [edi], 0
jne 0x42c5c5
xor ecx, ecx
jmp 0x42c5d9
mov ecx, edi
lea esi, [ecx + 1]
nop word [eax + eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x42c5d0
sub ecx, esi
lea eax, [ebp - 0x1c]
mov dword [edx + 4], ecx
push eax
call fcn.00416490
add esp, 0xc
cmp dword [eax + 0x14], 8
jb 0x42c5f0
mov eax, dword [eax]
push eax
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
mov ecx, dword [ebp - 8]
mov esi, eax
mov dword [ebp - 0x38], esi
cmp ecx, 8
jb 0x42c611
inc ecx
push ecx
push dword [ebp - 0x1c]
lea ecx, [ebp - 0x1c]
call fcn.0040b1a0
test esi, esi
jne 0x42c62a
xor al, al
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0045a313
mov esp, ebp
pop ebp
ret 8
test ebx, ebx
je 0x42c740
xor ecx, ecx
mov eax, esi
mov edx, 2
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.0045a324
add esp, 4
mov esi, eax
push dword [ebp - 0x38]
push esi
sub esp, 8
mov edx, esp
mov dword [edx], edi
test edi, edi
je 0x42c679
cmp byte [edi], 0
jne 0x42c667
xor edi, edi
jmp 0x42c679
lea ecx, [edi + 1]
nop word [eax + eax]
mov al, byte [edi]
inc edi
test al, al
jne 0x42c670
sub edi, ecx
lea eax, [ebp - 0x1c]
mov dword [edx + 4], edi
push eax
call fcn.00416490
add esp, 0xc
cmp dword [eax + 0x14], 8
jb 0x42c690
mov eax, dword [eax]
push eax
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
mov eax, dword [ebp - 8]
cmp eax, 8
jb 0x42c6ac
inc eax
lea ecx, [ebp - 0x1c]
push eax
push dword [ebp - 0x1c]
call fcn.0040b1a0
push esi
lea ecx, [ebp - 0x1c]
call fcn.004086a0
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x34]
push eax
call fcn.00416380
mov edi, eax
add esp, 8
cmp ebx, edi
je 0x42c6f7
mov ecx, dword [ebx + 0x14]
cmp ecx, 0x10
jb 0x42c6de
inc ecx
push ecx
push dword [ebx]
mov ecx, ebx
call fcn.0040a4f0
mov dword [ebx + 0x14], 0xf
mov ecx, ebx
mov dword [ebx + 0x10], 0
push edi
mov byte [ebx], 0
call fcn.0040a3a0
mov eax, dword [ebp - 0x20]
cmp eax, 0x10
jb 0x42c70c
inc eax
lea ecx, [ebp - 0x34]
push eax
push dword [ebp - 0x34]
call fcn.0040a4f0
mov eax, dword [ebp - 8]
mov dword [ebp - 0x20], 0xf
mov dword [ebp - 0x24], 0
mov byte [ebp - 0x34], 0
cmp eax, 8
jb 0x42c733
inc eax
lea ecx, [ebp - 0x1c]
push eax
push dword [ebp - 0x1c]
call fcn.0040b1a0
test esi, esi
je 0x42c740
push esi
call fcn.0045a32d
add esp, 4
mov ecx, dword [ebp - 4]
mov al, 1
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0045a313
mov esp, ebp
pop ebp
ret 8
Function at 0x42c9b0
Capabilities:
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
mov esi, ecx
mov dword [ebp - 8], 0
push edi
mov ecx, dword [esi]
test ecx, ecx
je 0x42cab2
cmp ecx, 0xffffffff
je 0x42cab2
cmp byte [esi + 0x34], 0
mov edx, 0x1000002
push 0
push 0
push 0
mov eax, 2
cmovne eax, edx
push eax
push 0
push ecx
call dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
push eax
lea ecx, [esi + 0x30]
call fcn.0040f570
mov eax, dword [esi + 0x30]
test eax, eax
je 0x42ca0b
cmp eax, 0xffffffff
jne 0x42ca1f
cmp byte [esi + 0x26], 0
je 0x42ca1f
cmp byte [0x494ee8], 0
jne 0x42cabd
int3
test eax, eax
je 0x42cab2
cmp eax, 0xffffffff
je 0x42cab2
xorps xmm0, xmm0
mov ecx, esi
movq qword [ebp - 0xc], xmm0
call fcn.00423bf0
mov edi, edx
mov ebx, eax
test edi, edi
jl 0x42ca5b
jg 0x42ca5b
test ebx, ebx
je 0x42ca5b
test edi, edi
jl 0x42ca66
jg 0x42ca5b
cmp ebx, 0x7fffffff
jbe 0x42ca66
cmp byte [esi + 0x26], 0
je 0x42ca66
call fcn.0041ad50
mov eax, ebx
add eax, 0xffffffff
adc edi, 0xffffffff
test edi, edi
ja 0x42cab2
jb 0x42ca7b
cmp eax, 0x7ffffffe
ja 0x42cab2
push 0
push dword [ebp - 0xc]
mov dword [esi + 0x2c], ebx
push dword [ebp - 8]
push 4
push dword [esi + 0x30]
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov dword [esi + 0x28], eax
test eax, eax
jne 0x42caa2
cmp byte [esi + 0x26], al
je 0x42caa2
call fcn.0041ad50
cmp dword [esi + 0x28], 0
setne al
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
pop edi
pop esi
xor al, al
pop ebx
mov esp, ebp
pop ebp
ret 4
push 1
call fcn.0046515c
int3

Function at 0x42e2a0
Capabilities:
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0xb8
mov eax, dword [ebp + 8]
push ebx
push esi
mov esi, ecx
xor ebx, ebx
push eax
mov dword [esp + 0x10], ebx
mov dword [esi], eax
push dword [eax]
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
test eax, eax
jne 0x42e305
cmp dword [0x494e44], 3
jg 0x42e2f7
push 3
push 0x23
push str.d:webapps_b_build_slave_repo_build_src_base_threading_thread_local_win.cc
lea ecx, [esp + 0x1c]
lea ebx, [eax + 2]
call fcn.00413f50
add eax, 8
push str.Failed_to_TlsSetValue__.
push eax
call fcn.0040b370
add esp, 8
test bl, 2
je 0x42e305
lea ecx, [esp + 0x10]
call fcn.00414010
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x42e310
Capabilities:
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0xb4
mov eax, dword [ecx]
push ebx
xor ebx, ebx
push ebx
push dword [eax]
mov dword [esp + 0xc], ebx
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
test eax, eax
jne 0x42e36f
cmp dword [0x494e44], 3
jg 0x42e361
push 3
push 0x23
push str.d:webapps_b_build_slave_repo_build_src_base_threading_thread_local_win.cc
lea ecx, [esp + 0x14]
lea ebx, [eax + 1]
call fcn.00413f50
add eax, 8
push str.Failed_to_TlsSetValue__.
push eax
call fcn.0040b370
add esp, 8
test bl, 1
je 0x42e36f
lea ecx, [esp + 8]
call fcn.00414010
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x42e3e0
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
mov dword [ebp - 0xc], 0
mov ebx, dword [ebp + 8]
push esi
push edi
mov edi, ecx
mov dword [edi + 4], 0x48c7d8
mov dword [edi], 0x48c7d0
mov dword [edi + 4], 0x48c7f4
mov dword [edi + 8], ebx
mov dword [edi + 0xc], 0
mov dword [edi + 0x10], 0
mov eax, dword [ebx + 0x288]
mov dword [edi + 0x14], eax
mov eax, dword [0x494ed4]
test eax, 0xfffffffe
jne 0x42e45f
push 0x494ed4
call fcn.004168e0
add esp, 4
test al, al
je 0x42e45f
mov ecx, 0x494ed8
call fcn.004212c0
push 0
push 0x494ed4
push eax
push 0x494ed4
call fcn.00416930
add esp, 0x10
mov eax, dword [0x494ed4]
push dword [eax]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov edx, dword [eax + 0x5c]
mov dword [ebp - 0xc], eax
mov dword [ebp + 8], edi
lea ecx, [eax + 0x58]
mov eax, dword [ecx]
cmp eax, edx
je 0x42e48f
nop
cmp dword [eax], edi
je 0x42e48b
add eax, 4
cmp eax, edx
jne 0x42e480
cmp eax, edx
jne 0x42e498
lea eax, [ebp + 8]
push eax
call fcn.00419920
mov esi, dword [0x495ef0]
test esi, esi
jne 0x42e4a9
call fcn.0043ef20
mov esi, eax
lea ecx, [ebp - 8]
call fcn.00435ca0
push eax
push str.ThreadLocalEventBuffer
lea eax, [edi + 4]
mov ecx, esi
push eax
call fcn.0043e490
mov eax, dword [ebp - 8]
test eax, eax
je 0x42e4f9
lea ecx, [eax + 4]
or eax, 0xffffffff
lock xadd dword [ecx], eax
sub eax, 1
setne al
test al, al
jne 0x42e4f9
test ecx, ecx
je 0x42e4e6
add ecx, 0xfffffffc
jmp 0x42e4e8
xor ecx, ecx
mov eax, dword [ecx]
mov edx, dword [eax + 0xc]
cmp eax, 0x48c550
jne 0x42e52b
push 1
call dword [eax + 8]
lea esi, [ebx + 4]
push esi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
push dword [ebp + 8]
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x14]
push eax
lea ecx, [ebx + 0x21c]
call fcn.00432080
push esi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
call edx
jmp 0x42e4f9
Function at 0x42e560
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0xcc
push ebx
mov ebx, ecx
mov dword [esp + 8], 0
push esi
lea esi, [ebx + 4]
mov dword [esi], 0x48c7f4
mov dword [ebx], 0x48c7d0
mov eax, dword [0x494ed4]
push edi
test eax, 0xfffffffe
jne 0x42e5c4
push 0x494ed4
call fcn.004168e0
add esp, 4
test al, al
je 0x42e5c4
mov ecx, 0x494ed8
call fcn.004212c0
push 0
push 0x494ed4
push eax
push 0x494ed4
call fcn.00416930
add esp, 0x10
mov eax, dword [0x494ed4]
mov edi, dword [sym.imp.KERNEL32.dll_TlsGetValue]
push dword [eax]
call edi
push ebx
lea ecx, [eax + 0x54]
call fcn.00421960
mov eax, dword [0x495ef0]
test eax, eax
jne 0x42e5ea
call fcn.0043ef20
push ecx
push esi
mov ecx, eax
call fcn.0043e610
mov esi, dword [ebx + 8]
add esi, 4
push esi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [ebx + 0xc], 0
je 0x42e631
mov eax, dword [ebx + 8]
mov eax, dword [eax + 0x288]
cmp dword [ebx + 0x14], eax
jne 0x42e631
mov eax, dword [ebx + 8]
mov ecx, dword [eax + 0x3c]
mov eax, dword [ebx + 0xc]
push ecx
mov edx, esp
mov dword [ebx + 0xc], 0
mov dword [edx], eax
mov eax, dword [ecx]
push dword [ebx + 0x10]
call dword [eax + 8]
mov eax, dword [0x494ed4]
test eax, 0xfffffffe
jne 0x42e66d
push 0x494ed4
call fcn.004168e0
add esp, 4
test al, al
je 0x42e66d
mov ecx, 0x494ed8
call fcn.004212c0
push 0
push 0x494ed4
push eax
push 0x494ed4
call fcn.00416930
add esp, 0x10
mov eax, dword [0x494ed4]
push dword [eax]
call edi
mov dword [esp + 0x14], eax
lea ecx, [esp + 0x14]
mov eax, dword [ebx + 8]
push ecx
add eax, 0x21c
lea ecx, [esp + 0x20]
push ecx
mov ecx, eax
mov dword [esp + 0x20], eax
call fcn.004313c0
mov edi, dword [esp + 0x1c]
mov eax, edi
mov edx, dword [esp + 0x20]
cmp edi, edx
je 0x42e6ab
mov eax, dword [eax]
cmp eax, edx
jne 0x42e6a5
mov ecx, dword [esp + 0x18]
lea eax, [esp + 0x24]
push edx
push edi
push eax
call fcn.00431490
push esi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov eax, dword [ebx + 8]
push 0
push dword [eax + 0x210]
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
test eax, eax
jne 0x42e71b
cmp dword [0x494e44], 3
jg 0x42e70b
push 3
push 0x23
push str.d:webapps_b_build_slave_repo_build_src_base_threading_thread_local_win.cc
lea ecx, [esp + 0x34]
mov dword [esp + 0x1c], 4
call fcn.00413f50
add eax, 8
push str.Failed_to_TlsSetValue__.
push eax
call fcn.0040b370
add esp, 8
test byte [esp + 0x10], 4
je 0x42e71b
lea ecx, [esp + 0x28]
call fcn.00414010
mov esi, dword [ebx + 0xc]
mov dword [ebx + 0xc], 0
test esi, esi
je 0x42e739
mov ecx, esi
call fcn.0043c390
push esi
call fcn.0045a086
add esp, 4
pop edi
pop esi
mov dword [ebx], method.std::_Facet_base.virtual_4
mov dword [ebx + 4], 0x48c7d8
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x42f1e0
Capabilities:
Get thread local storage value

Disassembly:
push ecx
push ebx
push esi
mov esi, ecx
push dword [esi + 0x214]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
jne 0x42f242
call fcn.0041f780
test eax, eax
je 0x42f242
push dword [esi + 0x210]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov edx, eax
test edx, edx
je 0x42f224
mov ecx, dword [edx + 0x14]
cmp ecx, dword [esi + 0x288]
je 0x42f242
mov eax, dword [edx]
mov ecx, edx
push 1
call dword [eax + 4]
push 0x18
call fcn.0045a053
add esp, 4
mov ecx, eax
push esi
call fcn.0042e3e0
push eax
lea ecx, [esi + 0x210]
call fcn.00421200
pop esi
pop ebx
pop ecx
ret
Function at 0x430ef0
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 8
cmp dword [ebp + 0xc], 0
push esi
push edi
mov esi, ecx
mov dword [esp + 0xc], 0
jne 0x430f15
xor eax, eax
pop edi
pop esi
mov esp, ebp
pop ebp
ret 0xc
push dword [esi + 0x210]
mov edi, dword [sym.imp.KERNEL32.dll_TlsGetValue]
call edi
test eax, eax
je 0x430f40
push dword [esi + 0x210]
call edi
push dword [ebp + 0x10]
mov ecx, eax
push dword [ebp + 0xc]
call fcn.0042e380
test eax, eax
jne 0x430fa9
mov edi, dword [ebp + 8]
test edi, edi
je 0x430f59
cmp byte [edi + 4], 0
jne 0x430f59
push dword [edi]
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov byte [edi + 4], 1
cmp dword [esi + 0x23c], 0
mov edx, dword [ebp + 0x10]
je 0x430f9d
mov eax, edx
and eax, 0x3ffffff
cmp eax, dword [esi + 0x240]
jne 0x430f9d
mov ecx, dword [esi + 0x23c]
mov eax, dword [ebp + 0xc]
cmp eax, dword [ecx + 0x1e08]
jne 0x430f0b
shr edx, 0x1a
mov eax, edx
shl eax, 4
sub eax, edx
add ecx, 8
lea eax, [ecx + eax*8]
pop edi
pop esi
mov esp, ebp
pop ebp
ret 0xc
mov ecx, dword [esi + 0x3c]
push edx
push dword [ebp + 0xc]
mov eax, dword [ecx]
call dword [eax + 0x18]
pop edi
pop esi
mov esp, ebp
pop ebp
ret 0xc

Function at 0x4313c0
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 0xc]
push esi
mov esi, ecx
push edi
movzx eax, byte [ebx]
xor eax, 0x811c9dc5
imul edx, eax, 0x1000193
movzx eax, byte [ebx + 1]
xor edx, eax
movzx eax, byte [ebx + 2]
imul edx, edx, 0x1000193
xor edx, eax
movzx eax, byte [ebx + 3]
imul ecx, edx, 0x1000193
mov edx, dword [esi + 0xc]
xor ecx, eax
imul eax, ecx, 0x1000193
mov ecx, dword [esi + 0x18]
mov esi, dword [esi + 4]
and ecx, eax
mov eax, dword [edx + ecx*8]
add ecx, ecx
mov edi, dword [edx + ecx*4]
lea ebx, [edx + ecx*4]
mov edx, dword [ebp + 0xc]
cmp edi, esi
jne 0x43141e
mov ecx, esi
jmp 0x431423
mov ecx, dword [ebx + 4]
mov ecx, dword [ecx]
cmp eax, ecx
je 0x431472
mov ecx, dword [eax + 8]
cmp ecx, dword [edx]
je 0x431432
mov eax, dword [eax]
jmp 0x431416
mov ecx, dword [ebp + 0xc]
mov edx, eax
mov ecx, dword [ecx]
mov dword [ebp + 0xc], ecx
nop dword [eax]
cmp edi, esi
jne 0x431448
mov ecx, esi
jmp 0x43144d
mov ecx, dword [ebx + 4]
mov ecx, dword [ecx]
cmp eax, ecx
je 0x43145d
mov ecx, dword [ebp + 0xc]
cmp ecx, dword [eax + 8]
jne 0x43145d
mov eax, dword [eax]
jmp 0x431440
cmp edx, eax
je 0x431472
mov ecx, dword [ebp + 8]
pop edi
pop esi
pop ebx
mov dword [ecx + 4], eax
mov eax, ecx
mov dword [ecx], edx
pop ebp
ret 8
mov eax, dword [ebp + 8]
pop edi
mov dword [eax], esi
mov dword [eax + 4], esi
pop esi
pop ebx
pop ebp
ret 8
Function at 0x4319b0
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
mov ebx, ecx
movzx eax, byte [edi + 8]
xor eax, 0x811c9dc5
imul edx, eax, 0x1000193
movzx eax, byte [edi + 9]
xor edx, eax
movzx eax, byte [edi + 0xa]
imul edx, edx, 0x1000193
xor edx, eax
movzx eax, byte [edi + 0xb]
imul ecx, edx, 0x1000193
xor ecx, eax
imul eax, ecx, 0x1000193
mov ecx, dword [ebx + 0x18]
and ecx, eax
lea edx, [ecx*8]
mov ecx, dword [ebx + 0xc]
add ecx, edx
cmp dword [ecx + 4], edi
jne 0x431a21
cmp dword [ecx], edi
jne 0x431a19
mov eax, dword [ebx + 4]
mov dword [ecx], eax
mov ecx, dword [ebx + 0xc]
mov eax, dword [ebx + 4]
mov dword [edx + ecx + 4], eax
jmp 0x431a29
mov eax, dword [edi + 4]
mov dword [ecx + 4], eax
jmp 0x431a29
cmp dword [ecx], edi
jne 0x431a2c
mov eax, dword [edi]
mov dword [ecx], eax
mov edi, dword [ebp + 0xc]
mov eax, dword [edi + 4]
mov esi, dword [edi]
push edi
mov dword [eax], esi
mov ecx, dword [edi]
mov eax, dword [edi + 4]
mov dword [ecx + 4], eax
dec dword [ebx + 8]
call fcn.0045a086
mov eax, dword [ebp + 8]
add esp, 4
pop edi
mov dword [eax], esi
pop esi
pop ebx
pop ebp
ret 8
Function at 0x432080
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, dword [ebp + 0xc]
mov ebx, ecx
push edi
movzx eax, byte [esi]
xor eax, 0x811c9dc5
imul edx, eax, 0x1000193
movzx eax, byte [esi + 1]
xor edx, eax
movzx eax, byte [esi + 2]
imul edx, edx, 0x1000193
xor edx, eax
movzx eax, byte [esi + 3]
mov esi, dword [ebx + 4]
imul ecx, edx, 0x1000193
xor ecx, eax
imul eax, ecx, 0x1000193
mov ecx, dword [ebx + 0x18]
and ecx, eax
shl ecx, 3
mov dword [ebp - 4], ecx
add ecx, dword [ebx + 0xc]
mov eax, dword [ecx]
cmp esi, eax
je 0x432103
mov esi, dword [ecx + 4]
mov esi, dword [esi]
cmp esi, eax
je 0x432103
mov edx, dword [ebp + 0xc]
mov ecx, dword [edx]
mov esi, dword [esi + 4]
cmp ecx, dword [esi + 8]
je 0x4320f1
cmp esi, eax
jne 0x4320e3
jmp 0x432106
mov eax, dword [ebp + 8]
mov dword [eax], esi
mov byte [eax + 4], 0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov edx, dword [ebp + 0xc]
mov eax, dword [ebx + 4]
lea ecx, [ebx + 4]
push edx
push dword [eax]
call fcn.0042d400
mov edi, dword [ebx + 4]
mov edi, dword [edi]
mov eax, dword [edi]
cmp esi, eax
je 0x432140
mov ecx, dword [edi + 4]
mov dword [ecx], eax
mov ecx, dword [eax + 4]
mov dword [ecx], esi
mov ecx, dword [esi + 4]
mov dword [ecx], edi
mov ecx, dword [eax + 4]
mov edx, dword [esi + 4]
mov dword [esi + 4], ecx
mov ecx, dword [edi + 4]
mov dword [eax + 4], ecx
mov dword [edi + 4], edx
mov ecx, dword [ebx + 0xc]
mov edx, dword [ebp - 4]
add ecx, edx
mov eax, dword [ecx]
cmp eax, dword [ebx + 4]
jne 0x43215a
mov dword [ecx], edi
mov eax, dword [ebx + 0xc]
mov dword [edx + eax + 4], edi
jmp 0x43217c
cmp eax, esi
jne 0x432162
mov dword [ecx], edi
jmp 0x43217c
mov eax, dword [ecx + 4]
mov eax, dword [eax]
mov dword [ecx + 4], eax
cmp eax, edi
je 0x43217c
mov ecx, dword [ebx + 0xc]
mov eax, dword [ecx + edx + 4]
mov eax, dword [eax + 4]
mov dword [ecx + edx + 4], eax
mov ecx, ebx
call fcn.004321a0
mov eax, dword [ebp + 8]
mov dword [eax], edi
pop edi
pop esi
mov byte [eax + 4], 1
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x432450
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0xc
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
mov ebx, ecx
mov dword [esp + 0x10], ebx
movzx eax, byte [edi]
xor eax, 0x811c9dc5
mov esi, dword [ebx + 4]
imul edx, eax, 0x1000193
movzx eax, byte [edi + 1]
xor edx, eax
movzx eax, byte [edi + 2]
imul edx, edx, 0x1000193
xor edx, eax
movzx eax, byte [edi + 3]
imul ecx, edx, 0x1000193
xor ecx, eax
imul eax, ecx, 0x1000193
mov ecx, dword [ebx + 0x18]
and ecx, eax
lea edx, [ecx*8]
mov ecx, dword [ebx + 0xc]
mov dword [esp + 0x14], edx
mov eax, dword [ecx + edx]
cmp esi, eax
je 0x4324cc
mov esi, dword [ecx + edx + 4]
mov esi, dword [esi]
cmp esi, eax
je 0x4324cc
mov ecx, dword [edi]
mov esi, dword [esi + 4]
cmp ecx, dword [esi + 8]
je 0x432511
cmp esi, eax
jne 0x4324c0
mov edi, dword [ebp + 0x10]
mov eax, dword [edi]
cmp esi, eax
je 0x4324fa
mov ecx, dword [edi + 4]
mov dword [ecx], eax
mov ecx, dword [eax + 4]
mov dword [ecx], esi
mov ecx, dword [esi + 4]
mov dword [ecx], edi
mov edx, dword [esi + 4]
mov ecx, dword [eax + 4]
mov dword [esi + 4], ecx
mov ecx, dword [edi + 4]
mov dword [eax + 4], ecx
mov dword [edi + 4], edx
mov edx, dword [esp + 0x14]
mov ecx, dword [ebx + 0xc]
add ecx, edx
mov eax, dword [ecx]
cmp eax, dword [ebx + 4]
jne 0x43255f
mov dword [ecx], edi
mov eax, dword [ebx + 0xc]
mov dword [edx + eax + 4], edi
jmp 0x432581
mov ebx, dword [ebp + 0x10]
mov ecx, dword [ebx + 4]
mov eax, dword [ebx]
mov dword [ecx], eax
mov ecx, dword [ebx]
mov eax, dword [ebx + 4]
mov dword [ecx + 4], eax
lea ecx, [ebx + 0xc]
mov eax, dword [esp + 0x10]
dec dword [eax + 8]
call fcn.00432c00
push dword [ebx + 0xc]
call fcn.0045a086
add esp, 4
mov dword [ebx + 0xc], 0
push ebx
call fcn.0045a086
mov eax, dword [ebp + 8]
add esp, 4
mov dword [eax], esi
mov byte [eax + 4], 0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
cmp eax, esi
jne 0x432567
mov dword [ecx], edi
jmp 0x432581
mov eax, dword [ecx + 4]
mov eax, dword [eax]
mov dword [ecx + 4], eax
cmp eax, edi
je 0x432581
mov ecx, dword [ebx + 0xc]
mov eax, dword [ecx + edx + 4]
mov eax, dword [eax + 4]
mov dword [ecx + edx + 4], eax
mov ecx, ebx
call fcn.004328c0
mov eax, dword [ebp + 8]
mov dword [eax], edi
pop edi
pop esi
mov byte [eax + 4], 1
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x4325a0
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push ecx
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
mov ebx, ecx
movzx eax, byte [edi]
xor eax, 0x811c9dc5
mov esi, dword [ebx + 4]
imul edx, eax, 0x1000193
movzx eax, byte [edi + 1]
xor edx, eax
movzx eax, byte [edi + 2]
imul edx, edx, 0x1000193
xor edx, eax
movzx eax, byte [edi + 3]
imul ecx, edx, 0x1000193
xor ecx, eax
imul eax, ecx, 0x1000193
mov ecx, dword [ebx + 0x18]
and ecx, eax
lea edx, [ecx*8]
mov ecx, dword [ebx + 0xc]
mov dword [esp + 0xc], edx
mov eax, dword [ecx + edx]
cmp esi, eax
je 0x43261c
mov esi, dword [ecx + edx + 4]
mov esi, dword [esi]
cmp esi, eax
je 0x43261c
mov ecx, dword [edi]
nop word [eax + eax]
mov esi, dword [esi + 4]
cmp ecx, dword [esi + 8]
je 0x432664
cmp esi, eax
jne 0x432610
mov edi, dword [ebp + 0x10]
mov eax, dword [edi]
cmp esi, eax
je 0x43264a
mov ecx, dword [edi + 4]
mov dword [ecx], eax
mov ecx, dword [eax + 4]
mov dword [ecx], esi
mov ecx, dword [esi + 4]
mov dword [ecx], edi
mov edx, dword [esi + 4]
mov ecx, dword [eax + 4]
mov dword [esi + 4], ecx
mov ecx, dword [edi + 4]
mov dword [eax + 4], ecx
mov dword [edi + 4], edx
mov edx, dword [esp + 0xc]
mov ecx, dword [ebx + 0xc]
add ecx, edx
mov eax, dword [ecx]
cmp eax, dword [ebx + 4]
jne 0x4326c3
mov dword [ecx], edi
mov eax, dword [ebx + 0xc]
mov dword [edx + eax + 4], edi
jmp 0x4326e5
mov edx, dword [ebp + 0x10]
lea edi, [edx + 0xc]
mov dword [esp + 0xc], edx
mov ecx, dword [edx + 4]
mov eax, dword [edx]
mov dword [ecx], eax
mov ecx, dword [edx]
mov eax, dword [edx + 4]
mov dword [ecx + 4], eax
dec dword [ebx + 8]
mov eax, dword [edi + 0x14]
cmp eax, 0x10
jb 0x432697
inc eax
mov ecx, edi
push eax
push dword [edi]
call fcn.0040a4f0
mov edx, dword [esp + 0xc]
mov dword [edi + 0x14], 0xf
mov dword [edi + 0x10], 0
push edx
mov byte [edi], 0
call fcn.0045a086
mov eax, dword [ebp + 8]
add esp, 4
mov dword [eax], esi
mov byte [eax + 4], 0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
cmp eax, esi
jne 0x4326cb
mov dword [ecx], edi
jmp 0x4326e5
mov eax, dword [ecx + 4]
mov eax, dword [eax]
mov dword [ecx + 4], eax
cmp eax, edi
je 0x4326e5
mov ecx, dword [ebx + 0xc]
mov eax, dword [ecx + edx + 4]
mov eax, dword [eax + 4]
mov dword [ecx + edx + 4], eax
mov ecx, ebx
call fcn.00432960
mov eax, dword [ebp + 8]
mov dword [eax], edi
pop edi
pop esi
mov byte [eax + 4], 1
pop ebx
mov esp, ebp
pop ebp
ret 0xc