joyce8/EMBER2024-capa huggingface dataset:
Function at 0x46c855
Capabilities:
Capture webcam image

Disassembly:
sub esp, 0x44
push ebx
push ebp
push esi
mov esi, ecx
push edi
mov eax, dword [esi + 0x3c]
test eax, eax
je 0x46c96d
push eax
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x46c96d
mov eax, dword [esi + 0x3c]
push eax
call fcn.00486c8e
mov esi, eax
test esi, esi
je 0x46c96d
mov ebx, dword [esp + 0x58]
mov ecx, dword [esi + 0x1c]
mov ebp, dword [sym.imp.USER32.dll_SendMessageA]
push 0
push ebx
push 0x419
push ecx
call ebp
mov edi, eax
test edi, edi
jl 0x46c96d
mov ecx, esi
call fcn.0046c7e0
cmp edi, eax
jge 0x46c96d
mov eax, dword [esi + 0xc4]
mov edx, dword [esi + 0xc0]
mov dword [esp + 0x2c], eax
mov eax, dword [esp + 0x5c]
xor ecx, ecx
mov dword [esp + 0x28], edx
cmp eax, ecx
mov dword [esp + 0x30], eax
mov dword [esp + 0x34], ecx
mov dword [esp + 0x4c], ecx
mov dword [esp + 0x50], ecx
mov dword [esp + 0x38], edi
jne 0x46c8f3
mov dword [esp + 0x34], 1
jmp 0x46c94e
mov edx, dword [esi + 0x1c]
lea ecx, [esp + 0x18]
push ecx
push ebx
push 0x433
push edx
call ebp
test eax, eax
je 0x46c96d
mov eax, dword [esp + 0x60]
mov ecx, dword [esp + 0x18]
mov edx, dword [esp + 0x24]
mov dword [esp + 0x10], ecx
mov dword [eax], 0
mov ecx, dword [esi + 0x1c]
lea eax, [esp + 0x10]
add edx, 2
push eax
push ecx
mov dword [esp + 0x1c], edx
call dword [sym.imp.USER32.dll_ClientToScreen]
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 0x14]
mov dword [esp + 0x34], 3
mov dword [esp + 0x3c], edx
mov dword [esp + 0x40], eax
xor ecx, ecx
push ecx
lea ecx, [esp + 0x2c]
push ecx
push 0x7d8
call fcn.0046bd50
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x44
ret 0xc
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x44
ret 0xc

Function at 0x487631
Capabilities:
Get graphical window text

Disassembly:
push esi
mov esi, ecx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x487669
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
lea ecx, [eax + 1]
push ecx
mov ecx, dword [esp + 0xc]
push eax
call fcn.004856e5
push eax
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov ecx, dword [esp + 8]
push 0xffffffffffffffff
call fcn.004856bd
jmp 0x487675
mov eax, dword [ecx]
push dword [esp + 8]
call dword [eax + 0x88]
pop esi
ret 4

Function at 0x488d28
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
push edi
xor edi, edi
cmp dword [esp + 0x10], edi
mov ebx, ecx
je 0x488d6a
call fcn.0048e8dd
mov esi, dword [eax + 0xc]
push 0xf0
push dword [esp + 0x14]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
cmp eax, edi
je 0x488d6a
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp eax, edi
jne 0x488d61
xor eax, eax
jmp 0x488d72
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
push edi
mov ecx, ebx
call fcn.00488d78
pop edi
pop esi
pop ebx
ret 4
Function at 0x48ee0d
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
mov esi, ecx
lea ebx, [esi + 0x1c]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [esp + 0x10], 0
jne 0x48ee3b
push dword [esi]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x48ee59
push dword [esp + 0xc]
mov ecx, esi
push eax
call fcn.0048ed73
jmp 0x48ee59
mov eax, dword [esi + 0x14]
test eax, eax
je 0x48ee59
push edi
push dword [esp + 0x10]
mov edi, dword [eax + 4]
mov ecx, esi
push eax
call fcn.0048ed73
test edi, edi
mov eax, edi
jne 0x48ee43
pop edi
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop esi
pop ebx
ret 8
Function at 0x4746b0
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push ebx
mov ebx, ecx
mov ecx, dword [ebx + 8]
test ecx, ecx
je 0x474758
mov eax, dword [ebx + 0x1c]
shr eax, 3
push esi
cmp eax, ecx
jbe 0x474800
mov eax, dword [ebx + 4]
mov dword [ebp - 4], eax
mov edx, dword [eax]
mov dword [ebp - 0x14], edx
cmp edx, eax
je 0x474757
mov eax, dword [edx + 4]
mov esi, edx
mov dword [ebp - 8], eax
movzx eax, byte [edx + 8]
xor eax, 0x811c9dc5
imul ecx, eax, 0x1000193
movzx eax, byte [edx + 9]
push edi
mov edi, dword [ebx + 0xc]
mov dword [ebp - 0x1c], edi
xor ecx, eax
mov eax, dword [ebx + 0x18]
imul ecx, ecx, 0x1000193
and eax, ecx
mov ecx, dword [edi + eax*8]
mov dword [ebp - 0x10], ecx
lea eax, [edi + eax*8]
mov dword [ebp - 0xc], eax
mov eax, dword [eax + 4]
mov dword [ebp - 0x18], eax
mov eax, esi
mov edi, esi
mov esi, dword [esi]
push 0x10
push eax
call fcn.004be4f6
dec dword [ebx + 8]
add esp, 8
cmp edi, dword [ebp - 0x18]
je 0x47475d
cmp esi, dword [ebp - 4]
jne 0x474723
mov eax, dword [ebp - 0x10]
cmp eax, dword [ebp - 0x14]
jne 0x47474e
mov ecx, dword [ebp - 0xc]
mov dword [ecx], esi
mov eax, dword [ebp - 8]
pop edi
mov dword [eax], esi
mov dword [esi + 4], eax
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 0x10]
mov edx, dword [ebp - 4]
mov ecx, dword [ebp - 0xc]
cmp eax, dword [ebp - 0x14]
jne 0x474771
mov dword [ecx], edx
mov eax, edx
jmp 0x474774
mov eax, dword [ebp - 8]
mov dword [ecx + 4], eax
cmp esi, edx
je 0x47474e
nop dword [eax + eax]
movzx eax, byte [esi + 8]
xor eax, 0x811c9dc5
imul ecx, eax, 0x1000193
movzx eax, byte [esi + 9]
xor ecx, eax
imul eax, ecx, 0x1000193
mov ecx, dword [ebp - 0x1c]
and eax, dword [ebx + 0x18]
lea eax, [ecx + eax*8]
mov dword [ebp - 0x14], eax
mov eax, dword [eax + 4]
mov dword [ebp - 0x18], eax
nop dword [eax]
mov eax, esi
mov edi, esi
mov esi, dword [esi]
push 0x10
push eax
call fcn.004be4f6
dec dword [ebx + 8]
add esp, 8
cmp edi, dword [ebp - 0x18]
je 0x4747e2
cmp esi, dword [ebp - 4]
jne 0x4747b0
mov eax, dword [ebp - 0x14]
pop edi
mov dword [eax], esi
mov eax, dword [ebp - 8]
mov dword [eax], esi
mov dword [esi + 4], eax
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 0x14]
mov edx, dword [ebp - 4]
mov dword [eax], edx
mov dword [eax + 4], edx
cmp esi, edx
jne 0x474780
mov eax, dword [ebp - 8]
pop edi
mov dword [eax], esi
mov dword [esi + 4], eax
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebx + 4]
mov eax, dword [ecx + 4]
mov dword [eax], 0
mov eax, dword [ecx]
test eax, eax
je 0x474825
mov esi, dword [eax]
push 0x10
push eax
call fcn.004be4f6
add esp, 8
mov eax, esi
test esi, esi
jne 0x474812
mov eax, dword [ebx + 4]
mov dword [eax], eax
mov eax, dword [ebx + 4]
mov dword [eax + 4], eax
mov dword [ebx + 8], 0
mov eax, dword [ebx + 4]
mov edx, dword [ebx + 0x10]
mov ecx, dword [ebx + 0xc]
mov dword [ebp - 0x1c], eax
lea eax, [ebp - 0x1c]
push eax
call fcn.0048fde0
add esp, 4
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x475f70
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
mov ebx, dword [ebp + 8]
movzx eax, bl
xor eax, 0x811c9dc5
mov dword [ebp - 0x10], ebx
imul edx, eax, 0x1000193
mov eax, ebx
shr eax, 8
movzx eax, al
push esi
push edi
xor edx, eax
mov dword [ebp + 8], ebx
mov edi, ecx
mov eax, ebx
shr eax, 0x10
movzx eax, al
imul ecx, edx, 0x1000193
lea esi, [edi + 0x590]
mov dword [ebp - 0xc], edi
mov dword [ebp - 4], esi
xor ecx, eax
mov eax, ebx
imul ecx, ecx, 0x1000193
shr eax, 0x18
xor ecx, eax
imul eax, ecx, 0x1000193
mov ecx, esi
push eax
mov dword [ebp - 8], eax
lea eax, [ebp + 8]
push eax
lea eax, [ebp - 0x18]
push eax
call fcn.00499430
or ebx, 0xffffffff
mov esi, dword [eax + 4]
test esi, esi
je 0x476060
mov edx, dword [ebp - 4]
mov ecx, dword [edx + 0x18]
and ecx, dword [ebp - 8]
mov eax, dword [edx + 0xc]
lea ecx, [eax + ecx*8]
mov eax, dword [ecx]
cmp dword [ecx + 4], esi
jne 0x476014
cmp eax, esi
jne 0x47600c
mov eax, dword [edx + 4]
mov dword [ecx], eax
mov dword [ecx + 4], eax
jmp 0x47601c
mov eax, dword [esi + 4]
mov dword [ecx + 4], eax
jmp 0x47601c
cmp eax, esi
jne 0x47601c
mov eax, dword [esi]
mov dword [ecx], eax
mov ecx, dword [esi]
dec dword [edx + 8]
mov eax, dword [esi + 4]
mov dword [eax], ecx
mov eax, dword [esi + 4]
mov dword [ecx + 4], eax
mov edi, dword [esi + 0x10]
test edi, edi
je 0x476052
mov eax, ebx
lock xadd dword [edi + 4], eax
jne 0x476052
mov eax, dword [edi]
mov ecx, edi
call dword [eax]
mov eax, ebx
lock xadd dword [edi + 8], eax
jne 0x476052
mov eax, dword [edi]
mov ecx, edi
call dword [eax + 4]
push 0x14
push esi
call fcn.004be4f6
mov edi, dword [ebp - 0xc]
add esp, 8
cmp byte [edi + 0x5bc], 0
je 0x4760bd
mov eax, dword [edi]
mov ecx, edi
push dword [ebp - 0x10]
call dword [eax + 0x1c]
mov ecx, dword [edi + 0x5b4]
mov edx, dword [edi + 0x5b0]
sub ecx, edx
sar ecx, 3
cmp ecx, eax
jbe 0x4760bd
mov esi, dword [edx + eax*8 + 4]
mov dword [edx + eax*8], 0
mov dword [edx + eax*8 + 4], 0
test esi, esi
je 0x4760bd
mov eax, ebx
lock xadd dword [esi + 4], eax
jne 0x4760bd
mov eax, dword [esi]
mov ecx, esi
call dword [eax]
lock xadd dword [esi + 8], ebx
dec ebx
jne 0x4760bd
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x4762f0
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 0xc]
sub esp, 0xc
push esi
mov esi, ecx
mov eax, dword [esi + 0x5b4]
mov ecx, dword [esi + 0x5b0]
cmp ecx, eax
je 0x476352
sub eax, ecx
sar eax, 3
cmp edx, eax
jae 0x476352
mov eax, dword [esi]
mov ecx, esi
push edx
call dword [eax + 0x1c]
mov ecx, dword [esi + 0x5b0]
lea edx, [ecx + eax*8]
mov eax, dword [ebp + 8]
mov dword [eax], 0
mov dword [eax + 4], 0
mov ecx, dword [edx + 4]
test ecx, ecx
je 0x476341
lock inc dword [ecx + 4]
mov ecx, dword [edx]
mov dword [eax], ecx
mov ecx, dword [edx + 4]
mov dword [eax + 4], ecx
pop esi
mov esp, ebp
pop ebp
ret 8
movzx eax, dl
xor eax, 0x811c9dc5
mov dword [ebp + 0xc], edx
imul ecx, eax, 0x1000193
mov eax, edx
shr eax, 8
movzx eax, al
push edi
xor ecx, eax
mov eax, edx
shr eax, 0x10
imul ecx, ecx, 0x1000193
movzx eax, al
shr edx, 0x18
xor ecx, eax
imul eax, ecx, 0x1000193
lea ecx, [esi + 0x590]
xor eax, edx
imul eax, eax, 0x1000193
push eax
lea eax, [ebp + 0xc]
push eax
lea eax, [ebp - 0xc]
push eax
call fcn.00499430
mov edx, dword [eax + 4]
test edx, edx
jne 0x4763b0
mov edx, dword [esi + 0x594]
mov ecx, dword [ebp + 8]
cmp edx, dword [esi + 0x594]
pop edi
mov dword [ecx], 0
je 0x4763e8
mov dword [ecx + 4], 0
mov eax, dword [edx + 0x10]
test eax, eax
je 0x4763d4
lock inc dword [eax + 4]
mov eax, dword [edx + 0xc]
mov dword [ecx], eax
mov eax, dword [edx + 0x10]
mov dword [ecx + 4], eax
mov eax, ecx
pop esi
mov esp, ebp
pop ebp
ret 8
xor eax, eax
mov dword [ecx + 4], eax
mov eax, ecx
pop esi
mov esp, ebp
pop ebp
ret 8

Function at 0x476470
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 8]
sub esp, 8
movzx eax, dl
xor eax, 0x811c9dc5
push ebx
push esi
push edi
lea edi, [ecx + 0x590]
imul ecx, eax, 0x1000193
mov eax, edx
shr eax, 8
movzx eax, al
xor ecx, eax
mov eax, edx
shr eax, 0x10
imul ecx, ecx, 0x1000193
movzx eax, al
shr edx, 0x18
xor ecx, eax
imul eax, ecx, 0x1000193
mov ecx, edi
xor eax, edx
imul ebx, eax, 0x1000193
lea eax, [ebp + 8]
push ebx
push eax
lea eax, [ebp - 8]
push eax
call fcn.00499430
mov esi, dword [eax + 4]
test esi, esi
je 0x476545
mov ecx, dword [edi + 0x18]
mov eax, dword [edi + 0xc]
and ecx, ebx
lea ecx, [eax + ecx*8]
mov eax, dword [ecx]
cmp dword [ecx + 4], esi
jne 0x4764fa
cmp eax, esi
jne 0x4764f2
mov eax, dword [edi + 4]
mov dword [ecx], eax
mov dword [ecx + 4], eax
jmp 0x476502
mov eax, dword [esi + 4]
mov dword [ecx + 4], eax
jmp 0x476502
cmp eax, esi
jne 0x476502
mov eax, dword [esi]
mov dword [ecx], eax
mov ecx, dword [esi]
dec dword [edi + 8]
mov eax, dword [esi + 4]
mov dword [eax], ecx
mov eax, dword [esi + 4]
mov dword [ecx + 4], eax
mov edi, dword [esi + 0x10]
test edi, edi
je 0x47653a
or ebx, 0xffffffff
mov eax, ebx
lock xadd dword [edi + 4], eax
jne 0x47653a
mov eax, dword [edi]
mov ecx, edi
call dword [eax]
lock xadd dword [edi + 8], ebx
dec ebx
jne 0x47653a
mov eax, dword [edi]
mov ecx, edi
call dword [eax + 4]
push 0x14
push esi
call fcn.004be4f6
add esp, 8
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x476610
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
mov ebx, dword [ebp + 0xc]
mov eax, ecx
mov dword [ebp - 4], eax
push esi
push edi
lea edi, [eax + 0x590]
movzx eax, bl
xor eax, 0x811c9dc5
imul edx, eax, 0x1000193
mov eax, ebx
shr eax, 8
movzx eax, al
xor edx, eax
mov eax, ebx
shr eax, 0x10
movzx eax, al
imul ecx, edx, 0x1000193
shr ebx, 0x18
xor ecx, eax
imul eax, ecx, 0x1000193
mov ecx, edi
xor eax, ebx
imul eax, eax, 0x1000193
push eax
lea eax, [ebp + 0xc]
push eax
lea eax, [ebp - 0xc]
push eax
call fcn.00499430
mov esi, dword [eax + 4]
test esi, esi
jne 0x47667a
mov esi, dword [edi + 4]
mov eax, dword [ebp - 4]
mov edx, dword [ebp + 8]
mov eax, dword [eax + 0x594]
mov dword [edx], 0
mov dword [edx + 4], 0
cmp esi, eax
je 0x4766ad
mov eax, dword [esi + 0x10]
test eax, eax
je 0x4766a2
lock inc dword [eax + 4]
mov ecx, dword [esi + 0xc]
mov dword [edx], ecx
mov ecx, dword [esi + 0x10]
mov dword [edx + 4], ecx
pop edi
pop esi
mov eax, edx
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x476aa0
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
mov ebx, dword [ebp + 8]
push esi
movzx eax, bx
mov dword [ebp + 8], eax
push edi
mov edi, ecx
movzx eax, bl
xor eax, 0x811c9dc5
mov dword [ebp - 0xc], edi
imul ecx, eax, 0x1000193
movzx eax, bx
shr eax, 8
lea edx, [edi + 0x590]
mov dword [ebp - 0x10], ebx
mov dword [ebp - 4], edx
xor ecx, eax
imul eax, ecx, 0x1000193
mov ecx, edx
push eax
mov dword [ebp - 8], eax
lea eax, [ebp + 8]
push eax
lea eax, [ebp - 0x18]
push eax
call fcn.00499c20
or ebx, 0xffffffff
mov esi, dword [eax + 4]
test esi, esi
je 0x476b74
mov edx, dword [ebp - 4]
mov ecx, dword [edx + 0x18]
and ecx, dword [ebp - 8]
mov eax, dword [edx + 0xc]
lea ecx, [eax + ecx*8]
mov eax, dword [ecx]
cmp dword [ecx + 4], esi
jne 0x476b28
cmp eax, esi
jne 0x476b20
mov eax, dword [edx + 4]
mov dword [ecx], eax
mov dword [ecx + 4], eax
jmp 0x476b30
mov eax, dword [esi + 4]
mov dword [ecx + 4], eax
jmp 0x476b30
cmp eax, esi
jne 0x476b30
mov eax, dword [esi]
mov dword [ecx], eax
mov ecx, dword [esi]
dec dword [edx + 8]
mov eax, dword [esi + 4]
mov dword [eax], ecx
mov eax, dword [esi + 4]
mov dword [ecx + 4], eax
mov edi, dword [esi + 0x10]
test edi, edi
je 0x476b66
mov eax, ebx
lock xadd dword [edi + 4], eax
jne 0x476b66
mov eax, dword [edi]
mov ecx, edi
call dword [eax]
mov eax, ebx
lock xadd dword [edi + 8], eax
jne 0x476b66
mov eax, dword [edi]
mov ecx, edi
call dword [eax + 4]
push 0x14
push esi
call fcn.004be4f6
mov edi, dword [ebp - 0xc]
add esp, 8
cmp byte [edi + 0x5bc], 0
je 0x476bd1
mov eax, dword [edi]
mov ecx, edi
push dword [ebp - 0x10]
call dword [eax + 0x1c]
mov ecx, dword [edi + 0x5b4]
mov edx, dword [edi + 0x5b0]
sub ecx, edx
sar ecx, 3
cmp ecx, eax
jbe 0x476bd1
mov esi, dword [edx + eax*8 + 4]
mov dword [edx + eax*8], 0
mov dword [edx + eax*8 + 4], 0
test esi, esi
je 0x476bd1
mov eax, ebx
lock xadd dword [esi + 4], eax
jne 0x476bd1
mov eax, dword [esi]
mov ecx, esi
call dword [eax]
lock xadd dword [esi + 8], ebx
dec ebx
jne 0x476bd1
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x476e00
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
mov ebx, dword [ebp + 0xc]
push esi
mov esi, ecx
mov edx, dword [esi + 0x5b4]
mov eax, dword [esi + 0x5b0]
cmp eax, edx
je 0x476e65
sub edx, eax
movzx eax, bx
sar edx, 3
cmp eax, edx
jae 0x476e65
mov eax, dword [esi]
push ebx
call dword [eax + 0x1c]
mov ecx, dword [esi + 0x5b0]
lea edx, [ecx + eax*8]
mov eax, dword [ebp + 8]
mov dword [eax], 0
mov dword [eax + 4], 0
mov ecx, dword [edx + 4]
test ecx, ecx
je 0x476e53
lock inc dword [ecx + 4]
mov ecx, dword [edx]
mov dword [eax], ecx
mov ecx, dword [edx + 4]
pop esi
mov dword [eax + 4], ecx
pop ebx
mov esp, ebp
pop ebp
ret 8
movzx eax, bx
mov dword [ebp + 0xc], eax
movzx eax, bl
xor eax, 0x811c9dc5
imul ecx, eax, 0x1000193
movzx eax, bx
shr eax, 8
push edi
xor ecx, eax
imul eax, ecx, 0x1000193
lea ecx, [esi + 0x590]
push eax
lea eax, [ebp + 0xc]
push eax
lea eax, [ebp - 0xc]
push eax
call fcn.00499c20
mov edx, dword [eax + 4]
test edx, edx
jne 0x476ea9
mov edx, dword [esi + 0x594]
mov ecx, dword [ebp + 8]
cmp edx, dword [esi + 0x594]
pop edi
mov dword [ecx], 0
je 0x476ee2
mov dword [ecx + 4], 0
mov eax, dword [edx + 0x10]
test eax, eax
je 0x476ecd
lock inc dword [eax + 4]
mov eax, dword [edx + 0xc]
mov dword [ecx], eax
mov eax, dword [edx + 0x10]
pop esi
mov dword [ecx + 4], eax
mov eax, ecx
pop ebx
mov esp, ebp
pop ebp
ret 8
xor eax, eax
pop esi
mov dword [ecx + 4], eax
mov eax, ecx
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x476f00
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
push edi
lea edi, [ecx + 0x590]
mov cx, word [ebp + 8]
movzx eax, cl
xor eax, 0x811c9dc5
imul edx, eax, 0x1000193
movzx eax, cx
mov ecx, edi
shr eax, 8
xor edx, eax
lea eax, [ebp + 8]
imul ebx, edx, 0x1000193
push ebx
push eax
lea eax, [ebp - 8]
push eax
call fcn.00499c20
mov esi, dword [eax + 4]
test esi, esi
je 0x476fb9
mov ecx, dword [edi + 0x18]
mov eax, dword [edi + 0xc]
and ecx, ebx
lea ecx, [eax + ecx*8]
mov eax, dword [ecx]
cmp dword [ecx + 4], esi
jne 0x476f6e
cmp eax, esi
jne 0x476f66
mov eax, dword [edi + 4]
mov dword [ecx], eax
mov dword [ecx + 4], eax
jmp 0x476f76
mov eax, dword [esi + 4]
mov dword [ecx + 4], eax
jmp 0x476f76
cmp eax, esi
jne 0x476f76
mov eax, dword [esi]
mov dword [ecx], eax
mov ecx, dword [esi]
dec dword [edi + 8]
mov eax, dword [esi + 4]
mov dword [eax], ecx
mov eax, dword [esi + 4]
mov dword [ecx + 4], eax
mov edi, dword [esi + 0x10]
test edi, edi
je 0x476fae
or ebx, 0xffffffff
mov eax, ebx
lock xadd dword [edi + 4], eax
jne 0x476fae
mov eax, dword [edi]
mov ecx, edi
call dword [eax]
lock xadd dword [edi + 8], ebx
dec ebx
jne 0x476fae
mov eax, dword [edi]
mov ecx, edi
call dword [eax + 4]
push 0x14
push esi
call fcn.004be4f6
add esp, 8
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x477090
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
mov dx, word [ebp + 0xc]
sub esp, 8
movzx eax, dl
xor eax, 0x811c9dc5
push ebx
push esi
imul esi, eax, 0x1000193
mov ebx, ecx
movzx eax, dx
shr eax, 8
push edi
lea ecx, [ebx + 0x590]
xor esi, eax
imul eax, esi, 0x1000193
push eax
lea eax, [ebp + 0xc]
push eax
lea eax, [ebp - 8]
push eax
call fcn.00499c20
mov esi, dword [eax + 4]
test esi, esi
jne 0x4770dc
mov esi, dword [ebx + 0x594]
mov edx, dword [ebp + 8]
mov eax, dword [ebx + 0x594]
mov dword [edx], 0
mov dword [edx + 4], 0
cmp esi, eax
je 0x47710c
mov eax, dword [esi + 0x10]
test eax, eax
je 0x477101
lock inc dword [eax + 4]
mov ecx, dword [esi + 0xc]
mov dword [edx], ecx
mov ecx, dword [esi + 0x10]
mov dword [edx + 4], ecx
pop edi
pop esi
mov eax, edx
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x479f10
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
sub esp, 0x18
mov edx, dword [ebp + 8]
push ebx
mov ebx, ecx
cmp edx, eax
je 0x47a066
mov eax, dword [ebx + 4]
mov dword [ebp - 0x10], eax
mov eax, dword [edx + 4]
mov dword [ebp - 4], eax
movzx eax, byte [edx + 8]
xor eax, 0x811c9dc5
imul ecx, eax, 0x1000193
movzx eax, byte [edx + 9]
push esi
push edi
mov edi, dword [ebx + 0xc]
mov esi, edx
xor ecx, eax
mov dword [ebp - 0x18], edi
movzx eax, byte [edx + 0xa]
imul ecx, ecx, 0x1000193
xor ecx, eax
movzx eax, byte [edx + 0xb]
imul ecx, ecx, 0x1000193
xor ecx, eax
mov eax, dword [ebx + 0x18]
imul ecx, ecx, 0x1000193
and eax, ecx
mov ecx, dword [edi + eax*8]
mov dword [ebp - 0xc], ecx
lea eax, [edi + eax*8]
mov dword [ebp - 8], eax
mov eax, dword [eax + 4]
mov dword [ebp - 0x14], eax
mov eax, esi
mov edi, esi
mov esi, dword [esi]
push 0x10
push eax
call fcn.004be4f6
dec dword [ebx + 8]
add esp, 8
cmp edi, dword [ebp - 0x14]
je 0x479fc9
mov eax, dword [ebp + 0xc]
cmp esi, eax
jne 0x479f87
mov ecx, dword [ebp - 0xc]
cmp ecx, dword [ebp + 8]
jne 0x47a05c
mov edx, dword [ebp - 8]
mov ecx, dword [ebp - 4]
pop edi
mov dword [edx], esi
mov dword [ecx], esi
mov dword [esi + 4], ecx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
mov ecx, dword [ebp - 0xc]
mov edx, dword [ebp - 8]
cmp ecx, dword [ebp + 8]
jne 0x479fdd
mov eax, dword [ebp - 0x10]
mov ecx, eax
mov dword [edx], eax
jmp 0x479fe0
mov ecx, dword [ebp - 4]
mov eax, dword [ebp + 0xc]
mov dword [edx + 4], ecx
cmp esi, eax
je 0x47a05c
nop word [eax + eax]
movzx eax, byte [esi + 8]
xor eax, 0x811c9dc5
imul ecx, eax, 0x1000193
movzx eax, byte [esi + 9]
xor ecx, eax
movzx eax, byte [esi + 0xa]
imul ecx, ecx, 0x1000193
xor ecx, eax
movzx eax, byte [esi + 0xb]
imul ecx, ecx, 0x1000193
xor ecx, eax
imul eax, ecx, 0x1000193
mov ecx, dword [ebx + 0x18]
and ecx, eax
mov eax, dword [ebp - 0x18]
lea eax, [eax + ecx*8]
mov dword [ebp + 8], eax
mov eax, dword [eax + 4]
mov dword [ebp - 0x14], eax
mov eax, esi
mov edi, esi
mov esi, dword [esi]
push 0x10
push eax
call fcn.004be4f6
dec dword [ebx + 8]
add esp, 8
mov eax, dword [ebp + 0xc]
cmp edi, dword [ebp - 0x14]
je 0x47a06d
cmp esi, eax
jne 0x47a037
mov ecx, dword [ebp + 8]
mov dword [ecx], esi
mov ecx, dword [ebp - 4]
pop edi
mov dword [ecx], esi
mov dword [esi + 4], ecx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
mov ecx, dword [ebp + 8]
mov edx, dword [ebp - 0x10]
mov dword [ecx], edx
mov dword [ecx + 4], edx
cmp esi, eax
jne 0x479ff0
mov ecx, dword [ebp - 4]
pop edi
mov dword [ecx], esi
mov dword [esi + 4], ecx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x47a0a0
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
sub esp, 0x18
mov edx, dword [ebp + 8]
push ebx
mov ebx, ecx
cmp edx, eax
je 0x47a1f6
mov eax, dword [ebx + 4]
mov dword [ebp - 0x10], eax
mov eax, dword [edx + 4]
mov dword [ebp - 4], eax
movzx eax, byte [edx + 8]
xor eax, 0x811c9dc5
imul ecx, eax, 0x1000193
movzx eax, byte [edx + 9]
push esi
push edi
mov edi, dword [ebx + 0xc]
mov esi, edx
xor ecx, eax
mov dword [ebp - 0x18], edi
movzx eax, byte [edx + 0xa]
imul ecx, ecx, 0x1000193
xor ecx, eax
movzx eax, byte [edx + 0xb]
imul ecx, ecx, 0x1000193
xor ecx, eax
mov eax, dword [ebx + 0x18]
imul ecx, ecx, 0x1000193
and eax, ecx
mov ecx, dword [edi + eax*8]
mov dword [ebp - 0xc], ecx
lea eax, [edi + eax*8]
mov dword [ebp - 8], eax
mov eax, dword [eax + 4]
mov dword [ebp - 0x14], eax
mov eax, esi
mov edi, esi
mov esi, dword [esi]
push 0x24
push eax
call fcn.004be4f6
dec dword [ebx + 8]
add esp, 8
cmp edi, dword [ebp - 0x14]
je 0x47a159
mov eax, dword [ebp + 0xc]
cmp esi, eax
jne 0x47a117
mov ecx, dword [ebp - 0xc]
cmp ecx, dword [ebp + 8]
jne 0x47a1ec
mov edx, dword [ebp - 8]
mov ecx, dword [ebp - 4]
pop edi
mov dword [edx], esi
mov dword [ecx], esi
mov dword [esi + 4], ecx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
mov ecx, dword [ebp - 0xc]
mov edx, dword [ebp - 8]
cmp ecx, dword [ebp + 8]
jne 0x47a16d
mov eax, dword [ebp - 0x10]
mov ecx, eax
mov dword [edx], eax
jmp 0x47a170
mov ecx, dword [ebp - 4]
mov eax, dword [ebp + 0xc]
mov dword [edx + 4], ecx
cmp esi, eax
je 0x47a1ec
nop word [eax + eax]
movzx eax, byte [esi + 8]
xor eax, 0x811c9dc5
imul ecx, eax, 0x1000193
movzx eax, byte [esi + 9]
xor ecx, eax
movzx eax, byte [esi + 0xa]
imul ecx, ecx, 0x1000193
xor ecx, eax
movzx eax, byte [esi + 0xb]
imul ecx, ecx, 0x1000193
xor ecx, eax
imul eax, ecx, 0x1000193
mov ecx, dword [ebx + 0x18]
and ecx, eax
mov eax, dword [ebp - 0x18]
lea eax, [eax + ecx*8]
mov dword [ebp + 8], eax
mov eax, dword [eax + 4]
mov dword [ebp - 0x14], eax
mov eax, esi
mov edi, esi
mov esi, dword [esi]
push 0x24
push eax
call fcn.004be4f6
dec dword [ebx + 8]
add esp, 8
mov eax, dword [ebp + 0xc]
cmp edi, dword [ebp - 0x14]
je 0x47a1fd
cmp esi, eax
jne 0x47a1c7
mov ecx, dword [ebp + 8]
mov dword [ecx], esi
mov ecx, dword [ebp - 4]
pop edi
mov dword [ecx], esi
mov dword [esi + 4], ecx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
mov ecx, dword [ebp + 8]
mov edx, dword [ebp - 0x10]
mov dword [ecx], edx
mov dword [ecx + 4], edx
cmp esi, eax
jne 0x47a180
mov ecx, dword [ebp - 4]
pop edi
mov dword [ecx], esi
mov dword [esi + 4], ecx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8