joyce8/EMBER2024-capa huggingface dataset:
Function at 0x50ee3c
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0xc
mov eax, dword [ebp + 0xc]
push ebx
push esi
mov esi, ecx
mov ecx, dword [eax]
mov eax, ecx
push edi
mov dword [esp + 0x14], esi
lea edi, [eax + 1]
lea esp, [esp]
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x50ee5c
sub eax, edi
add eax, ecx
mov edx, 0x811c9dc5
cmp ecx, eax
je 0x50ee80
movsx edi, byte [ecx]
imul edx, edx, 0x1000193
inc ecx
xor edx, edi
cmp ecx, eax
jne 0x50ee70
mov eax, dword [esi + 0x20]
mov ebx, eax
and ebx, edx
cmp dword [esi + 0x24], ebx
ja 0x50ee95
shr eax, 1
or ecx, 0xffffffff
sub ecx, eax
add ebx, ecx
mov eax, dword [esi + 0x10]
mov edi, dword [esi + 4]
mov ecx, dword [eax + ebx*8]
lea edx, [esi + 4]
lea eax, [eax + ebx*8]
mov dword [esp + 0x10], edx
cmp edi, ecx
je 0x50eee5
mov eax, dword [eax + 4]
mov edi, dword [eax]
cmp edi, ecx
je 0x50eee5
lea esp, [esp]
mov edi, dword [edi + 4]
mov eax, dword [edi + 8]
test eax, eax
je 0x50ef34
mov ecx, dword [ebp + 0xc]
mov ecx, dword [ecx]
push eax
push ecx
call fcn.0063539d
add esp, 8
test eax, eax
je 0x50ef2b
mov edx, dword [esi + 0x10]
cmp edi, dword [edx + ebx*8]
jne 0x50eebc
mov edx, dword [esp + 0x10]
mov ecx, dword [ebp + 0x10]
mov eax, dword [ecx]
cmp edi, eax
je 0x50ef08
push eax
push ecx
push edi
mov eax, 1
mov esi, edx
call fcn.0050e9ec
mov ecx, dword [ebp + 0x10]
mov esi, dword [esp + 0x14]
mov edx, dword [esp + 0x10]
mov eax, dword [edx]
mov edx, dword [esi + 0x10]
mov dword [esp + 0x14], eax
lea eax, [edx + ebx*8]
mov edx, dword [eax]
mov dword [esp + 0x10], ecx
cmp edx, dword [esp + 0x14]
jne 0x50ef77
mov dword [eax], ecx
mov eax, dword [esi + 0x10]
mov dword [eax + ebx*8 + 4], ecx
jmp 0x50ef9d
mov eax, dword [ebp + 0xc]
mov eax, dword [eax]
test eax, eax
jne 0x50ef3e
push 0x80004005
call fcn.004e165c
mov ecx, dword [edi + 8]
push eax
push ecx
call fcn.0063539d
add esp, 8
test eax, eax
je 0x50ef53
mov edi, dword [edi]
jmp 0x50eee1
mov ecx, dword [ebp + 0x10]
mov ebx, dword [esp + 0x10]
push ecx
lea edx, [esp + 0x18]
push edx
call fcn.0050e4cc
mov eax, dword [ebp + 8]
mov dword [eax], edi
mov byte [eax + 4], 0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
cmp edx, edi
jne 0x50ef7f
mov dword [eax], ecx
jmp 0x50ef9d
mov edx, dword [eax + 4]
mov ecx, dword [edx]
mov dword [eax + 4], ecx
cmp ecx, dword [esp + 0x10]
je 0x50ef9d
mov eax, dword [esi + 0x10]
mov ecx, dword [eax + ebx*8 + 4]
mov edx, dword [ecx + 4]
lea ebx, [eax + ebx*8 + 4]
mov dword [ebx], edx
mov edi, esi
call fcn.0050f3ec
mov eax, dword [ebp + 8]
mov ecx, dword [ebp + 0x10]
pop edi
pop esi
mov dword [eax], ecx
mov byte [eax + 4], 1
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x50efbc
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0xc
mov eax, dword [ebp + 0xc]
push ebx
push esi
mov esi, ecx
mov ecx, dword [eax]
mov eax, ecx
push edi
mov dword [esp + 0xc], esi
lea edi, [eax + 1]
lea esp, [esp]
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x50efdc
sub eax, edi
add eax, ecx
mov edx, 0x811c9dc5
cmp ecx, eax
je 0x50f000
movsx edi, byte [ecx]
imul edx, edx, 0x1000193
inc ecx
xor edx, edi
cmp ecx, eax
jne 0x50eff0
mov eax, dword [esi + 0x20]
mov ebx, eax
and ebx, edx
cmp dword [esi + 0x24], ebx
ja 0x50f015
shr eax, 1
or ecx, 0xffffffff
sub ecx, eax
add ebx, ecx
mov edx, dword [esi + 0x10]
mov ecx, dword [edx + ebx*8]
mov edi, dword [esi + 4]
lea eax, [edx + ebx*8]
lea edx, [esi + 4]
mov dword [esp + 0x14], edx
cmp edi, ecx
je 0x50f071
mov eax, dword [eax + 4]
mov eax, dword [eax]
mov edi, eax
mov dword [esp + 0x10], eax
cmp edi, ecx
je 0x50f071
nop
mov esi, dword [edi + 4]
mov eax, dword [esi + 8]
mov dword [esp + 0x10], esi
test eax, eax
je 0x50f0be
mov edi, dword [ebp + 0xc]
mov ecx, dword [edi]
push eax
push ecx
call fcn.0063539d
add esp, 8
test eax, eax
je 0x50f0b8
mov ecx, dword [esp + 0xc]
mov edx, dword [ecx + 0x10]
mov edi, esi
cmp esi, dword [edx + ebx*8]
jne 0x50f03c
mov esi, ecx
mov edx, dword [esp + 0x14]
mov ecx, dword [ebp + 0x10]
mov eax, dword [ecx]
cmp edi, eax
je 0x50f094
push eax
push ecx
push edi
mov eax, 1
mov esi, edx
call fcn.0050ea5c
mov ecx, dword [ebp + 0x10]
mov esi, dword [esp + 0xc]
mov edx, dword [esp + 0x14]
mov eax, dword [esi + 0x10]
mov esi, dword [eax + ebx*8]
lea eax, [eax + ebx*8]
mov dword [esp + 0x14], ecx
cmp esi, dword [edx]
jne 0x50f10a
mov dword [eax], ecx
mov ecx, dword [esp + 0xc]
mov edx, dword [ecx + 0x10]
mov eax, dword [esp + 0x14]
mov dword [edx + ebx*8 + 4], eax
jmp 0x50f134
mov eax, dword [edi]
test eax, eax
jne 0x50f0c8
push 0x80004005
call fcn.004e165c
mov ecx, dword [esi + 8]
push eax
push ecx
call fcn.0063539d
add esp, 8
test eax, eax
je 0x50f0e7
mov eax, dword [esi]
mov esi, dword [esp + 0xc]
mov dword [esp + 0x10], eax
mov edi, eax
jmp 0x50f06d
mov ecx, dword [ebp + 0x10]
mov edi, dword [esp + 0x14]
push ecx
lea ebx, [esp + 0x18]
call fcn.0050e51c
mov eax, dword [ebp + 8]
mov dword [eax], esi
mov byte [eax + 4], 0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
cmp esi, edi
jne 0x50f112
mov dword [eax], ecx
jmp 0x50f134
mov ecx, dword [eax + 4]
mov ecx, dword [ecx]
mov dword [eax + 4], ecx
cmp ecx, dword [esp + 0x14]
je 0x50f134
mov edx, dword [esp + 0xc]
mov eax, dword [edx + 0x10]
mov ecx, dword [eax + ebx*8 + 4]
mov edx, dword [ecx + 4]
lea ebx, [eax + ebx*8 + 4]
mov dword [ebx], edx
mov edi, dword [esp + 0xc]
call fcn.0050f4bc
mov eax, dword [ebp + 8]
mov ecx, dword [ebp + 0x10]
pop edi
pop esi
mov dword [eax], ecx
mov byte [eax + 4], 1
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x50f15c
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0xc
mov eax, dword [ebp + 0xc]
mov edx, ecx
mov ecx, dword [eax]
mov al, byte [ecx]
push ebx
push esi
push edi
mov dword [esp + 0x10], edx
mov esi, 0x811c9dc5
test al, al
je 0x50f19a
lea ebx, [eax - 0x41]
inc ecx
cmp bl, 0x19
ja 0x50f189
add al, 0x20
imul esi, esi, 0x1000193
movsx eax, al
xor esi, eax
mov al, byte [ecx]
test al, al
jne 0x50f17e
mov eax, dword [edx + 0x20]
mov ebx, eax
and ebx, esi
cmp dword [edx + 0x24], ebx
ja 0x50f1af
shr eax, 1
or ecx, 0xffffffff
sub ecx, eax
add ebx, ecx
mov eax, dword [edx + 0x10]
mov ecx, dword [eax + ebx*8]
mov esi, dword [edx + 4]
lea eax, [eax + ebx*8]
lea edi, [edx + 4]
cmp esi, ecx
je 0x50f1f4
mov eax, dword [eax + 4]
mov esi, dword [eax]
cmp esi, ecx
je 0x50f1f4
mov esi, dword [esi + 4]
mov eax, dword [esi + 8]
test eax, eax
je 0x50f23d
mov ecx, dword [ebp + 0xc]
mov ecx, dword [ecx]
push eax
push ecx
call fcn.00635058
add esp, 8
test eax, eax
je 0x50f234
mov edx, dword [esp + 0x10]
mov eax, dword [edx + 0x10]
cmp esi, dword [eax + ebx*8]
jne 0x50f1cb
mov ecx, dword [ebp + 0x10]
mov eax, dword [ecx]
cmp esi, eax
je 0x50f210
push eax
push ecx
push esi
mov ecx, edi
mov edx, edi
call fcn.0050f65c
mov ecx, dword [ebp + 0x10]
mov edx, dword [esp + 0x10]
mov eax, dword [edx + 0x10]
mov edx, dword [eax + ebx*8]
lea eax, [eax + ebx*8]
mov dword [esp + 0x14], ecx
cmp edx, dword [edi]
jne 0x50f27f
mov dword [eax], ecx
mov ecx, dword [esp + 0x10]
mov edx, dword [ecx + 0x10]
mov eax, dword [esp + 0x14]
mov dword [edx + ebx*8 + 4], eax
jmp 0x50f2a9
mov ecx, dword [ebp + 0xc]
mov eax, dword [ecx]
test eax, eax
jne 0x50f247
push 0x80004005
call fcn.004e165c
mov ecx, dword [esi + 8]
push eax
push ecx
call fcn.00635058
add esp, 8
test eax, eax
je 0x50f260
mov esi, dword [esi]
mov edx, dword [esp + 0x10]
jmp 0x50f1f4
mov edx, dword [ebp + 0x10]
push edx
lea ebx, [esp + 0x18]
call fcn.0050e56c
mov eax, dword [ebp + 8]
mov dword [eax], esi
mov byte [eax + 4], 0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
cmp edx, esi
jne 0x50f287
mov dword [eax], ecx
jmp 0x50f2a9
mov ecx, dword [eax + 4]
mov ecx, dword [ecx]
mov dword [eax + 4], ecx
cmp ecx, dword [esp + 0x14]
je 0x50f2a9
mov edx, dword [esp + 0x10]
mov eax, dword [edx + 0x10]
mov ecx, dword [eax + ebx*8 + 4]
mov edx, dword [ecx + 4]
lea ebx, [eax + ebx*8 + 4]
mov dword [ebx], edx
mov edi, dword [esp + 0x10]
call fcn.0050f58c
mov eax, dword [ebp + 8]
mov ecx, dword [ebp + 0x10]
pop edi
pop esi
mov dword [eax], ecx
mov byte [eax + 4], 1
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x51074c
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 0x24]
mov eax, dword [ebp + 0x1c]
push ebx
mov ebx, dword [ebp + 0x20]
push edi
mov edi, ebx
or edi, ecx
cdq
jne 0x5107bc
mov ebx, eax
mov ecx, edx
movzx edx, byte [ebp + 0xc]
xor eax, eax
cmp dword [ebp + 8], eax
mov dword [esi], 0
setne al
and edx, 7
mov edi, 2
add eax, eax
add eax, eax
add eax, eax
or eax, edx
movzx edx, byte [ebp + 0x10]
shl eax, 4
and edx, 0xf
or eax, edx
mov edx, dword [ebp + 0x14]
mov dword [esi], eax
xor eax, eax
test edx, edx
setne al
shl eax, 0xf
or dword [esi], eax
test ecx, ecx
ja 0x5107fe
jb 0x5107af
cmp ebx, 0x7e
jae 0x5107d4
movzx ecx, bl
and ecx, 0x7f
shl ecx, 8
or dword [esi], ecx
jmp 0x51082a
cmp ecx, edx
ja 0x510765
jb 0x5107c6
cmp ebx, eax
jae 0x510765
push 0x57
call dword [0x1017119c]
xor eax, eax
pop edi
pop ebx
pop ebp
ret
test ecx, ecx
ja 0x5107fe
jb 0x5107e2
cmp ebx, 0xffff
ja 0x5107fe
or dword [esi], 0x7e00
push ebx
call dword [0x10171324]
movzx edx, ax
shl edx, 0x10
or dword [esi], edx
mov edi, 4
jmp 0x510827
mov edi, dword [0x101712f8]
or dword [esi], 0x7f00
push ecx
call edi
push ebx
mov dword [ebp + 0x20], eax
call edi
xor ecx, ecx
or ecx, dword [ebp + 0x20]
mov edx, eax
xor eax, eax
or edx, eax
mov dword [esi + 2], ecx
mov dword [esi + 6], edx
lea edi, [eax + 0xa]
mov edx, dword [ebp + 0x14]
test edx, edx
je 0x510853
mov eax, dword [edx]
mov dword [edi + esi], eax
xor eax, eax
cmp dword [ebp + 0x1c], eax
jle 0x510850
mov edi, edi
mov ecx, eax
and ecx, 3
mov bl, byte [ecx + edx]
mov ecx, dword [ebp + 0x18]
xor byte [eax + ecx], bl
inc eax
cmp eax, dword [ebp + 0x1c]
jl 0x51083c
add edi, 4
mov eax, dword [ebp + 0x28]
mov edx, dword [ebp + 0x18]
mov ecx, dword [ebp + 0x1c]
mov dword [eax], edi
pop edi
mov dword [eax + 4], esi
mov dword [eax + 0xc], edx
mov dword [eax + 8], ecx
mov eax, 1
pop ebx
pop ebp
ret
Function at 0x510f1c
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [eax]
sub esp, 0xc
push ebx
push esi
push edi
mov edi, ecx
mov ecx, eax
lea esi, [ecx + 1]
mov dl, byte [ecx]
inc ecx
test dl, dl
jne 0x510f2e
sub ecx, esi
add ecx, eax
mov edx, eax
mov esi, 0x811c9dc5
cmp eax, ecx
je 0x510f5c
jmp 0x510f4c
movsx ebx, byte [edx]
imul esi, esi, 0x1000193
inc edx
xor esi, ebx
cmp edx, ecx
jne 0x510f4c
mov edx, dword [edi + 0x20]
mov ecx, edx
and ecx, esi
cmp dword [edi + 0x24], ecx
ja 0x510f71
shr edx, 1
or esi, 0xffffffff
sub esi, edx
add ecx, esi
mov edx, dword [edi + 0x10]
mov edi, dword [edi + 4]
lea ecx, [edx + ecx*8]
mov edx, dword [ecx]
mov esi, edx
mov dword [ebp - 8], ecx
mov dword [ebp - 0xc], edx
mov dword [ebp - 4], esi
jmp 0x510f8c
cmp edx, edi
jne 0x510f94
mov ecx, edi
jmp 0x510f99
mov ecx, dword [ecx + 4]
mov ecx, dword [ecx]
cmp esi, ecx
je 0x51103e
mov ecx, dword [esi + 8]
mov edx, eax
lea ebx, [ebx]
mov bl, byte [ecx]
cmp bl, byte [edx]
jne 0x510fcc
test bl, bl
je 0x510fc8
mov bl, byte [ecx + 1]
cmp bl, byte [edx + 1]
jne 0x510fcc
add ecx, 2
add edx, 2
test bl, bl
jne 0x510fac
xor ecx, ecx
jmp 0x510fd1
sbb ecx, ecx
sbb ecx, 0xffffffff
test ecx, ecx
je 0x510fdf
mov esi, dword [esi]
mov ecx, dword [ebp - 8]
mov edx, dword [ebp - 0xc]
jmp 0x510f8c
mov edx, dword [esi + 8]
mov dword [ebp - 4], esi
mov ecx, eax
jmp 0x510fec
mov bl, byte [ecx]
cmp bl, byte [edx]
jne 0x51100c
test bl, bl
je 0x511008
mov bl, byte [ecx + 1]
cmp bl, byte [edx + 1]
jne 0x51100c
add ecx, 2
add edx, 2
test bl, bl
jne 0x510fec
xor ecx, ecx
jmp 0x511011
sbb ecx, ecx
sbb ecx, 0xffffffff
test ecx, ecx
je 0x51102b
mov eax, dword [ebp + 8]
mov dword [ebp - 0xc], edi
pop edi
lea ecx, [ebp - 0xc]
mov edx, dword [ecx]
pop esi
mov dword [eax], edx
pop ebx
mov esp, ebp
pop ebp
ret 4
mov eax, dword [ebp + 8]
pop edi
lea ecx, [ebp - 4]
mov edx, dword [ecx]
pop esi
mov dword [eax], edx
pop ebx
mov esp, ebp
pop ebp
ret 4
mov eax, dword [ebp + 8]
mov dword [eax], edi
pop edi
mov dword [ebp - 4], esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x5110bc
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0xc
mov eax, dword [ebp + 0xc]
push ebx
push esi
mov esi, dword [eax]
push edi
mov edi, ecx
mov eax, esi
mov dword [esp + 0x14], edi
lea edx, [eax + 1]
lea esp, [esp]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x5110dc
sub eax, edx
add eax, esi
mov ecx, esi
mov edx, 0x811c9dc5
cmp esi, eax
je 0x511102
movsx ebx, byte [ecx]
imul edx, edx, 0x1000193
inc ecx
xor edx, ebx
cmp ecx, eax
jne 0x5110f2
mov eax, dword [edi + 0x20]
mov ecx, eax
and ecx, edx
mov dword [esp + 0x10], ecx
cmp dword [edi + 0x24], ecx
ja 0x51111f
shr eax, 1
or edx, 0xffffffff
sub edx, eax
add ecx, edx
mov dword [esp + 0x10], ecx
mov eax, dword [edi + 4]
lea edx, [edi + 4]
mov edi, dword [edi + 0x10]
lea ecx, [edi + ecx*8]
mov edi, dword [ecx]
mov dword [esp + 0xc], edx
cmp edi, eax
jne 0x511139
mov ebx, eax
jmp 0x51113e
mov eax, dword [ecx + 4]
mov ebx, dword [eax]
cmp ebx, edi
je 0x51117d
mov ebx, dword [ebx + 4]
mov ecx, dword [ebx + 8]
mov eax, esi
mov edi, edi
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x51116c
test dl, dl
je 0x511168
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x51116c
add eax, 2
add ecx, 2
test dl, dl
jne 0x51114c
xor eax, eax
jmp 0x511171
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x5111bc
cmp ebx, edi
jne 0x511142
mov edx, dword [esp + 0xc]
mov ecx, dword [ebp + 0x10]
mov eax, dword [ecx]
cmp ebx, eax
je 0x511197
push eax
push ecx
push ebx
mov ecx, edx
call fcn.0050f37c
mov ecx, dword [ebp + 0x10]
mov edx, dword [esp + 0xc]
mov esi, dword [edx]
mov edi, dword [esp + 0x14]
mov edx, dword [edi + 0x10]
mov eax, dword [esp + 0x10]
lea eax, [edx + eax*8]
mov edx, dword [eax]
cmp edx, esi
jne 0x511211
mov dword [eax], ecx
mov edx, dword [edi + 0x10]
mov eax, dword [esp + 0x10]
mov dword [edx + eax*8 + 4], ecx
jmp 0x511235
mov eax, dword [ebx + 8]
mov ecx, esi
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x5111e1
test dl, dl
je 0x5111dd
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x5111e1
add eax, 2
add ecx, 2
test dl, dl
jne 0x5111c1
xor eax, eax
jmp 0x5111e6
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x5111ee
mov ebx, dword [ebx]
jmp 0x511179
mov ecx, dword [ebp + 0x10]
mov esi, dword [esp + 0xc]
push ecx
lea edi, [esp + 0x18]
call fcn.0050e5bc
mov eax, dword [ebp + 8]
mov dword [eax], ebx
mov byte [eax + 4], 0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
cmp edx, ebx
je 0x511233
mov edx, dword [eax + 4]
mov edx, dword [edx]
mov dword [eax + 4], edx
cmp edx, ecx
je 0x511235
mov ecx, dword [esp + 0x10]
mov eax, dword [edi + 0x10]
mov edx, dword [eax + ecx*8 + 4]
lea eax, [eax + ecx*8 + 4]
mov ecx, dword [edx + 4]
mov dword [eax], ecx
call fcn.0051125c
mov eax, dword [ebp + 8]
mov edx, dword [ebp + 0x10]
pop edi
pop esi
mov dword [eax], edx
mov byte [eax + 4], 1
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x51363c
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, eax
mov eax, dword [esi + 0xc]
push edi
test eax, eax
je 0x51366e
lea ecx, [ebp - 4]
push ecx
push eax
call dword [0x10171084]
test eax, eax
je 0x51366e
xor eax, eax
cmp dword [ebp - 4], 0x103
sete al
test eax, eax
jne 0x51372c
mov eax, dword [esi + 0xc]
test eax, eax
je 0x51369e
push eax
call dword [0x1017118c]
xor eax, eax
mov dword [esi + 8], 0
mov dword [esi + 0xc], 0
mov dword [esi + 0x10], eax
mov dword [esi + 0x14], eax
mov dword [esi + 0x18], eax
mov dword [esi + 0x1c], eax
mov dword [esi + 0x20], eax
mov dword [esi + 0x24], eax
push 0x18
call fcn.00633480
add esp, 4
test eax, eax
je 0x5136c8
mov edx, dword [ebp + 8]
mov dword [eax], edx
mov ecx, dword [ebp + 0xc]
mov dword [eax + 8], ecx
mov edx, dword [ebp + 0x10]
mov dword [eax + 0xc], edx
mov dword [eax + 0x10], 0
mov edi, eax
jmp 0x5136ca
xor edi, edi
mov eax, dword [edi]
mov dword [esi + 0x10], eax
mov ecx, dword [edi + 4]
mov dword [esi + 0x14], ecx
mov edx, dword [edi + 8]
mov dword [esi + 0x18], edx
mov eax, dword [edi + 0xc]
mov dword [esi + 0x1c], eax
mov ecx, dword [edi + 0x10]
lea eax, [esi + 8]
push eax
push 0
push edi
push 0x10034b20
mov dword [esi + 0x20], ecx
mov edx, dword [edi + 0x14]
push 0
push 0
mov dword [esi + 0x24], edx
call fcn.006351fe
add esp, 0x18
mov dword [esi + 0xc], eax
test eax, eax
jne 0x513741
push 0x65f
call dword [0x1017119c]
push edi
xor esi, esi
call fcn.00633415
add esp, 4
mov eax, esi
pop edi
pop esi
mov esp, ebp
pop ebp
ret 0xc
push 0x139f
call dword [0x1017119c]
xor eax, eax
pop edi
pop esi
mov esp, ebp
pop ebp
ret 0xc
pop edi
mov eax, 1
pop esi
mov esp, ebp
pop ebp
ret 0xc
Function at 0x5197cc
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0x10]
mov ecx, dword [eax]
mov al, byte [ecx]
push ebx
push esi
push edi
mov esi, 0x811c9dc5
test al, al
je 0x5197fe
lea edx, [eax - 0x41]
inc ecx
cmp dl, 0x19
ja 0x5197ed
add al, 0x20
imul esi, esi, 0x1000193
movsx eax, al
xor esi, eax
mov al, byte [ecx]
test al, al
jne 0x5197e2
mov edx, dword [ebp + 8]
mov eax, dword [edx + 0x20]
mov ebx, eax
and ebx, esi
cmp dword [edx + 0x24], ebx
ja 0x519816
shr eax, 1
or ecx, 0xffffffff
sub ecx, eax
add ebx, ecx
mov eax, dword [edx + 0x10]
mov ecx, dword [eax + ebx*8]
mov esi, dword [edx + 4]
lea eax, [eax + ebx*8]
lea edi, [edx + 4]
cmp esi, ecx
je 0x51985a
mov eax, dword [eax + 4]
mov esi, dword [eax]
cmp esi, ecx
je 0x51985a
mov esi, dword [esi + 4]
mov eax, dword [esi + 8]
test eax, eax
je 0x51989f
mov ecx, dword [ebp + 0x10]
mov ecx, dword [ecx]
push eax
push ecx
call fcn.00635058
add esp, 8
test eax, eax
je 0x519896
mov edx, dword [ebp + 8]
mov eax, dword [edx + 0x10]
cmp esi, dword [eax + ebx*8]
jne 0x519832
mov ecx, dword [ebp + 0x14]
mov eax, dword [ecx]
cmp esi, eax
je 0x519875
push eax
push ecx
push esi
mov ecx, edi
mov edx, edi
call fcn.0052bd5c
mov ecx, dword [ebp + 0x14]
mov edx, dword [ebp + 8]
mov eax, dword [edx + 0x10]
mov edx, dword [eax + ebx*8]
lea eax, [eax + ebx*8]
mov dword [ebp + 0x10], ecx
cmp edx, dword [edi]
jne 0x5198dd
mov dword [eax], ecx
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 0x10]
mov eax, dword [ebp + 0x10]
mov dword [edx + ebx*8 + 4], eax
jmp 0x519905
mov ecx, dword [ebp + 0x10]
mov eax, dword [ecx]
test eax, eax
jne 0x5198a9
push 0x80004005
call fcn.004e165c
mov ecx, dword [esi + 8]
push eax
push ecx
call fcn.00635058
add esp, 8
test eax, eax
je 0x5198c1
mov esi, dword [esi]
mov edx, dword [ebp + 8]
jmp 0x51985a
mov edx, dword [ebp + 0x14]
push edx
lea ebx, [ebp + 8]
call fcn.005199dc
mov eax, dword [ebp + 0xc]
pop edi
mov dword [eax], esi
pop esi
mov byte [eax + 4], 0
pop ebx
pop ebp
ret 0x10
cmp edx, esi
jne 0x5198e5
mov dword [eax], ecx
jmp 0x519905
mov ecx, dword [eax + 4]
mov ecx, dword [ecx]
mov dword [eax + 4], ecx
cmp ecx, dword [ebp + 0x10]
je 0x519905
mov edx, dword [ebp + 8]
mov eax, dword [edx + 0x10]
mov ecx, dword [eax + ebx*8 + 4]
mov edx, dword [ecx + 4]
lea ebx, [eax + ebx*8 + 4]
mov dword [ebx], edx
mov eax, dword [ebp + 8]
push eax
call fcn.0051992c
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 0x14]
pop edi
pop esi
mov dword [eax], ecx
mov byte [eax + 4], 1
pop ebx
pop ebp
ret 0x10
Function at 0x51ae0c
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
mov ebx, dword [ebp + 8]
cmp dword [ebx + 0x14], 0
mov dword [ebp - 0xc], 1
mov dword [ebp - 8], 0
jbe 0x51af55
push esi
push edi
push 0
push 0
push ebx
push 0x1003cbd0
push 0
push 0
call fcn.006351fe
mov edi, eax
add esp, 0x18
mov dword [ebp - 4], edi
test edi, edi
je 0x51af38
mov eax, dword [ebx + 0x7c]
lea esi, [ebx + 0x78]
lea ecx, [ebp - 4]
cmp ecx, eax
jae 0x51aec2
mov edx, dword [esi]
cmp edx, ecx
ja 0x51aec2
mov edi, ecx
mov ecx, dword [esi + 8]
sub edi, edx
sar edi, 2
cmp eax, ecx
jne 0x51aeb2
sub eax, edx
sar eax, 2
cmp eax, 0x3ffffffe
ja 0x51af2e
sub ecx, edx
inc eax
sar ecx, 2
cmp eax, ecx
jbe 0x51aeb2
mov edx, ecx
shr edx, 1
mov ebx, 0x3fffffff
sub ebx, edx
cmp ebx, ecx
jae 0x51aea1
xor ecx, ecx
jmp 0x51aea3
add ecx, edx
cmp ecx, eax
jae 0x51aea9
mov ecx, eax
push ecx
call fcn.0051d57c
mov ebx, dword [ebp + 8]
mov eax, dword [esi + 4]
test eax, eax
je 0x51af0e
mov edx, dword [esi]
mov ecx, dword [edx + edi*4]
mov dword [eax], ecx
jmp 0x51af0e
mov ecx, dword [esi + 8]
cmp eax, ecx
jne 0x51af05
mov edx, dword [esi]
sub eax, edx
sar eax, 2
cmp eax, 0x3ffffffe
ja 0x51af2e
sub ecx, edx
inc eax
sar ecx, 2
cmp eax, ecx
jbe 0x51af05
mov edx, ecx
shr edx, 1
mov ebx, 0x3fffffff
sub ebx, edx
cmp ebx, ecx
jae 0x51aef4
xor ecx, ecx
jmp 0x51aef6
add ecx, edx
cmp ecx, eax
jae 0x51aefc
mov ecx, eax
push ecx
call fcn.0051d57c
mov ebx, dword [ebp + 8]
mov eax, dword [esi + 4]
test eax, eax
je 0x51af0e
mov dword [eax], edi
mov eax, dword [ebp - 8]
add dword [esi + 4], 4
inc eax
mov dword [ebp - 8], eax
cmp eax, dword [ebx + 0x14]
jb 0x51ae30
mov eax, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
push 0x101da834
call fcn.006333a7
call dword [0x101711a0]
push eax
mov dword [ebx + 0x58], 8
call dword [0x1017119c]
pop edi
mov dword [ebp - 0xc], 0
pop esi
mov eax, dword [ebp - 0xc]
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x51db8c
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
push ebx
push esi
mov esi, ecx
mov eax, dword [esi]
mov edx, dword [eax + 0xe4]
call edx
test eax, eax
je 0x51dcaf
lea ebx, [esi + 0x150]
call fcn.004e5dfc
mov eax, dword [esi + 0x50]
cmp eax, 3
jne 0x51dc97
push edi
xor edi, edi
mov dword [esi + 0x50], edi
mov dword [ebx], edi
mov edx, dword [esi]
mov eax, dword [edx + 0xe8]
mov ecx, esi
call eax
mov eax, 1
xor ecx, ecx
mov dword [esi + 0xc], eax
mov dword [esi + 0x18], eax
mov eax, dword [ebp + 0xc]
xor edx, edx
mov word [ebp - 0x20], cx
push eax
mov word [ebp - 0x3c], dx
mov edx, dword [ebp + 8]
lea ecx, [ebp - 0x20]
push ecx
mov ecx, dword [ebp + 0x14]
push edx
push esi
lea edx, [ebp - 0x3c]
mov dword [esi + 0x10], 5
mov dword [esi + 0x14], edi
mov dword [ebp - 4], edi
call fcn.0051decc
test eax, eax
je 0x51dcfd
mov ebx, dword [ebp + 0x18]
lea eax, [ebp - 0x20]
push eax
push esi
lea ecx, [ebp - 0x3c]
call fcn.0051e0ac
test eax, eax
je 0x51dcee
mov ebx, dword [0x1017119c]
push edi
call ebx
mov edx, dword [esi]
mov eax, dword [esi + 0x1c]
mov edx, dword [edx + 0xac]
push eax
mov ecx, esi
call edx
cmp eax, 2
je 0x51dcd6
mov eax, dword [ebp + 0x10]
push eax
lea eax, [ebp - 0x20]
call fcn.0051e18c
test eax, eax
je 0x51dcc7
lea ecx, [esi + 0x44]
push ecx
push edi
push esi
push 0x1003f280
push edi
push edi
call fcn.006351fe
add esp, 0x18
mov dword [esi + 0x40], eax
cmp eax, edi
je 0x51dcb9
mov edx, dword [esi + 4]
push edx
mov edi, 1
call dword [0x1017108c]
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x14
push 0x139f
mov dword [esi + 0x48], 1
call dword [0x1017119c]
mov dword [ebx], 0
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret 0x14
mov dword [esi + 0x48], 8
push 0x65f
jmp 0x51dd11
call dword [0x10171328]
mov dword [esi + 0x48], 0xb
jmp 0x51dd10
call dword [0x101711a0]
cmp eax, edi
jne 0x51dce5
mov eax, 0x4c7
mov dword [esi + 0x48], 5
jmp 0x51dd10
call dword [0x10171328]
mov dword [esi + 0x48], 4
jmp 0x51dd0a
call dword [0x10171328]
mov dword [esi + 0x48], 3
mov ebx, dword [0x1017119c]
push eax
call ebx
mov dword [esi + 0xc], edi
mov dword [esi + 0x10], 5
mov dword [esi + 0x14], edi
mov dword [esi + 0x18], 1
call dword [0x101711a0]
mov edi, eax
mov eax, dword [esi]
mov edx, dword [eax + 4]
mov ecx, esi
call edx
push edi
call ebx
mov edi, dword [ebp - 4]
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x14