joyce8/EMBER2024-capa huggingface dataset:
Function at 0x45f8c0
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5e7d25
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push ebx
push esi
push edi
mov eax, dword [0x670440]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov ebx, dword [ebp + 0xc]
movzx eax, byte [ebx]
xor eax, 0x811c9dc5
imul edx, eax, 0x1000193
movzx eax, byte [ebx + 1]
xor edx, eax
movzx eax, byte [ebx + 2]
imul edx, edx, 0x1000193
xor edx, eax
movzx eax, byte [ebx + 3]
imul ecx, edx, 0x1000193
xor ecx, eax
imul eax, ecx, 0x1000193
mov ecx, edi
push eax
mov dword [ebp + 0xc], eax
lea eax, [ebp - 0x1c]
push ebx
push eax
call fcn.00458b00
mov ecx, dword [ebp - 0x18]
test ecx, ecx
je 0x45f953
mov eax, dword [ebp + 8]
mov dword [eax], ecx
mov byte [eax + 4], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
cmp dword [edi + 8], 0x15555555
je 0x45fa81
lea eax, [edi + 4]
mov dword [ebp - 0x14], eax
mov dword [ebp - 4], 0
push 0xc
mov dword [ebp - 0x10], 0
call fcn.00502e30
mov ecx, dword [ebx]
mov esi, eax
add esp, 4
mov dword [ebp - 0x10], esi
mov dword [esi + 8], ecx
mov dword [ebp - 4], 1
mov eax, dword [edi + 8]
mov ebx, dword [edi + 0x1c]
inc eax
movss xmm3, dword [edi]
movd xmm0, eax
cvtdq2pd xmm0, xmm0
shr eax, 0x1f
movd xmm1, ebx
addsd xmm0, qword [eax*8 + 0x6602a0]
cvtdq2pd xmm1, xmm1
mov eax, ebx
shr eax, 0x1f
cvtpd2ps xmm0, xmm0
addsd xmm1, qword [eax*8 + 0x6602a0]
movaps xmm2, xmm0
cvtpd2ps xmm1, xmm1
divss xmm2, xmm1
comiss xmm2, xmm3
jbe 0x45fa23
divss xmm0, xmm3
call fcn.00454eb0
call fcn.00503830
mov ecx, 8
cmp eax, ecx
cmova ecx, eax
cmp ebx, ecx
jae 0x45fa05
cmp ebx, 0x200
jae 0x45fa03
shl ebx, 3
cmp ebx, ecx
jae 0x45fa05
mov ebx, ecx
push ebx
mov ecx, edi
call fcn.0045fec0
push dword [ebp + 0xc]
lea eax, [esi + 8]
mov ecx, edi
push eax
lea eax, [ebp - 0x1c]
push eax
call fcn.00458b00
mov edx, dword [eax]
jmp 0x45fa26
mov edx, dword [ebp - 0x1c]
mov ebx, dword [edx + 4]
inc dword [edi + 8]
mov dword [esi], edx
mov dword [esi + 4], ebx
mov dword [ebx], esi
mov dword [edx + 4], esi
mov eax, dword [edi + 0x18]
and eax, dword [ebp + 0xc]
mov ecx, dword [edi + 0xc]
mov esi, dword [ebp - 0x14]
mov edi, dword [ecx + eax*8]
cmp edi, dword [esi]
mov esi, dword [ebp - 0x10]
jne 0x45fa51
mov dword [ecx + eax*8], esi
jmp 0x45fa60
cmp edi, edx
jne 0x45fa5a
mov dword [ecx + eax*8], esi
jmp 0x45fa64
cmp dword [ecx + eax*8 + 4], ebx
jne 0x45fa64
mov dword [ecx + eax*8 + 4], esi
mov eax, dword [ebp + 8]
mov dword [eax], esi
mov byte [eax + 4], 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
push str.unordered_map_set_too_long
call fcn.004eb99c
int3
Function at 0x45fec0
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov edx, dword [ebp + 8]
mov eax, 0x1fffffff
push ebx
push esi
push edi
mov edi, ecx
mov esi, 1
bsr ecx, eax
mov eax, esi
mov dword [ebp - 4], edi
shl eax, cl
cmp edx, eax
ja 0x46000c
mov ebx, dword [edi + 4]
lea eax, [edx - 1]
or eax, esi
mov dword [ebp - 8], ebx
bsr ecx, eax
push ebx
lea ecx, [ecx + 1]
shl esi, cl
lea ecx, [edi + 0xc]
lea eax, [esi + esi]
push eax
call fcn.00456800
lea eax, [esi - 1]
mov dword [edi + 0x1c], esi
mov dword [edi + 0x18], eax
mov ecx, dword [edi + 4]
mov ecx, dword [ecx]
cmp ecx, ebx
je 0x45ffe7
mov eax, ecx
movzx edx, byte [eax + 8]
xor edx, 0x811c9dc5
mov ecx, dword [ecx]
imul esi, edx, 0x1000193
movzx edx, byte [eax + 9]
xor esi, edx
movzx edx, byte [eax + 0xa]
imul esi, esi, 0x1000193
xor esi, edx
movzx edx, byte [eax + 0xb]
imul esi, esi, 0x1000193
xor esi, edx
mov edx, dword [edi + 0xc]
imul esi, esi, 0x1000193
and esi, dword [edi + 0x18]
lea ebx, [edx + esi*8]
mov esi, dword [ebx]
mov dword [ebp + 8], ebx
cmp esi, dword [ebp - 8]
jne 0x45ff72
mov dword [ebx], eax
mov dword [ebx + 4], eax
jmp 0x45ffdc
mov edx, dword [ebx + 4]
mov edi, dword [eax + 8]
cmp edi, dword [edx + 8]
jne 0x45ffa9
mov edx, dword [edx]
mov dword [ebp - 0xc], edx
cmp edx, eax
je 0x45ffa4
mov edi, dword [eax + 4]
mov ebx, dword [ebp - 0xc]
mov dword [edi], ecx
mov esi, dword [ecx + 4]
mov dword [esi], edx
mov edx, dword [edx + 4]
mov dword [edx], eax
mov dword [ebx + 4], esi
mov ebx, dword [ebp + 8]
mov dword [ecx + 4], edi
mov dword [eax + 4], edx
mov dword [ebx + 4], eax
jmp 0x45ffd9
cmp esi, edx
je 0x45ffbc
nop dword [eax]
mov edx, dword [edx + 4]
cmp edi, dword [edx + 8]
je 0x45fff0
cmp esi, edx
jne 0x45ffb0
mov ebx, dword [eax + 4]
mov dword [ebx], ecx
mov edi, dword [ecx + 4]
mov dword [edi], edx
mov esi, dword [edx + 4]
mov dword [esi], eax
mov dword [edx + 4], edi
mov edx, dword [ebp + 8]
mov dword [ecx + 4], ebx
mov dword [eax + 4], esi
mov dword [edx], eax
mov edi, dword [ebp - 4]
mov eax, ecx
cmp ecx, dword [ebp - 8]
jne 0x45ff22
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
mov edi, dword [eax + 4]
mov ebx, dword [edx]
mov dword [edi], ecx
mov esi, dword [ecx + 4]
mov dword [esi], ebx
mov edx, dword [ebx + 4]
mov dword [edx], eax
mov dword [ebx + 4], esi
mov dword [ecx + 4], edi
mov dword [eax + 4], edx
jmp 0x45ffd9
push str.invalid_hash_bucket_count
call fcn.004eb99c
int3
Function at 0x460020
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5e7d95
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push ebx
push esi
push edi
mov eax, dword [0x670440]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov ebx, dword [ebp + 0xc]
movzx eax, byte [ebx]
xor eax, 0x811c9dc5
imul edx, eax, 0x1000193
movzx eax, byte [ebx + 1]
xor edx, eax
movzx eax, byte [ebx + 2]
imul edx, edx, 0x1000193
xor edx, eax
movzx eax, byte [ebx + 3]
imul ecx, edx, 0x1000193
xor ecx, eax
imul eax, ecx, 0x1000193
mov ecx, edi
push eax
mov dword [ebp + 0xc], eax
lea eax, [ebp - 0x1c]
push ebx
push eax
call fcn.00458b00
mov ecx, dword [ebp - 0x18]
test ecx, ecx
je 0x4600b3
mov eax, dword [ebp + 8]
mov dword [eax], ecx
mov byte [eax + 4], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
cmp dword [edi + 8], 0x1745d17
je 0x4601ef
lea eax, [edi + 4]
mov dword [ebp - 0x14], eax
mov dword [ebp - 4], 0
push 0xb0
mov dword [ebp - 0x10], 0
call fcn.00502e30
mov ecx, dword [ebx]
mov esi, eax
add esp, 4
mov dword [ebp - 0x10], esi
mov dword [esi + 8], ecx
lea ecx, [esi + 0xc]
push dword [ebx + 4]
call fcn.004844b0
mov dword [ebp - 4], 1
mov eax, dword [edi + 8]
mov ebx, dword [edi + 0x1c]
inc eax
movss xmm3, dword [edi]
movd xmm0, eax
cvtdq2pd xmm0, xmm0
shr eax, 0x1f
movd xmm1, ebx
addsd xmm0, qword [eax*8 + 0x6602a0]
cvtdq2pd xmm1, xmm1
mov eax, ebx
shr eax, 0x1f
cvtpd2ps xmm0, xmm0
addsd xmm1, qword [eax*8 + 0x6602a0]
movaps xmm2, xmm0
cvtpd2ps xmm1, xmm1
divss xmm2, xmm1
comiss xmm2, xmm3
jbe 0x460191
divss xmm0, xmm3
call fcn.00454eb0
call fcn.00503830
mov ecx, 8
cmp eax, ecx
cmova ecx, eax
cmp ebx, ecx
jae 0x460173
cmp ebx, 0x200
jae 0x460171
shl ebx, 3
cmp ebx, ecx
jae 0x460173
mov ebx, ecx
push ebx
mov ecx, edi
call fcn.00458920
push dword [ebp + 0xc]
lea eax, [esi + 8]
mov ecx, edi
push eax
lea eax, [ebp - 0x1c]
push eax
call fcn.00458b00
mov edx, dword [eax]
jmp 0x460194
mov edx, dword [ebp - 0x1c]
mov ebx, dword [edx + 4]
inc dword [edi + 8]
mov dword [esi], edx
mov dword [esi + 4], ebx
mov dword [ebx], esi
mov dword [edx + 4], esi
mov eax, dword [edi + 0x18]
and eax, dword [ebp + 0xc]
mov ecx, dword [edi + 0xc]
mov esi, dword [ebp - 0x14]
mov edi, dword [ecx + eax*8]
cmp edi, dword [esi]
mov esi, dword [ebp - 0x10]
jne 0x4601bf
mov dword [ecx + eax*8], esi
jmp 0x4601ce
cmp edi, edx
jne 0x4601c8
mov dword [ecx + eax*8], esi
jmp 0x4601d2
cmp dword [ecx + eax*8 + 4], ebx
jne 0x4601d2
mov dword [ecx + eax*8 + 4], esi
mov eax, dword [ebp + 8]
mov dword [eax], esi
mov byte [eax + 4], 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
push str.unordered_map_set_too_long
call fcn.004eb99c
int3
Function at 0x460200
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5e7ddd
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
push ebx
push esi
push edi
mov eax, dword [0x670440]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
mov edx, dword [ebp + 0xc]
mov ebx, edx
cmp dword [edx + 0x14], 0xf
jbe 0x46023a
mov ebx, dword [edx]
xor ecx, ecx
mov edi, 0x811c9dc5
cmp dword [edx + 0x10], ecx
jbe 0x460258
movzx eax, byte [ebx + ecx]
inc ecx
xor eax, edi
imul edi, eax, 0x1000193
cmp ecx, dword [edx + 0x10]
jb 0x460246
push edi
push edx
lea eax, [ebp - 0x1c]
mov ecx, esi
push eax
call fcn.00457220
mov ecx, dword [ebp - 0x18]
test ecx, ecx
je 0x460289
mov eax, dword [ebp + 8]
mov dword [eax], ecx
mov byte [eax + 4], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
cmp dword [esi + 8], 0x4924924
je 0x4603d8
lea eax, [esi + 4]
mov dword [ebp - 0x24], eax
mov dword [ebp - 4], 0
push 0x38
mov dword [ebp - 0x20], 0
call fcn.00502e30
mov ebx, eax
add esp, 4
mov dword [ebp - 0x20], ebx
push dword [ebp + 0xc]
lea esi, [ebx + 8]
mov ecx, esi
mov dword [ebp - 0x14], esi
call fcn.0044aa70
mov eax, dword [ebp + 0xc]
lea ecx, [esi + 0x18]
add eax, 0x18
mov byte [ebp - 4], 1
push eax
call fcn.0044aa70
mov esi, dword [ebp - 0x10]
mov dword [ebp - 4], 2
mov eax, dword [esi + 8]
inc eax
movss xmm3, dword [esi]
movd xmm0, eax
cvtdq2pd xmm0, xmm0
shr eax, 0x1f
addsd xmm0, qword [eax*8 + 0x6602a0]
mov eax, dword [esi + 0x1c]
movd xmm1, eax
cvtdq2pd xmm1, xmm1
shr eax, 0x1f
cvtpd2ps xmm0, xmm0
addsd xmm1, qword [eax*8 + 0x6602a0]
movaps xmm2, xmm0
cvtpd2ps xmm1, xmm1
divss xmm2, xmm1
comiss xmm2, xmm3
jbe 0x460378
divss xmm0, xmm3
call fcn.00454eb0
call fcn.00503830
mov ecx, 8
cmp eax, ecx
cmova ecx, eax
mov eax, dword [esi + 0x1c]
cmp eax, ecx
jae 0x46035c
cmp eax, 0x200
jae 0x46035a
shl eax, 3
cmp eax, ecx
jae 0x46035c
mov eax, ecx
push eax
mov ecx, esi
call fcn.004607b0
push edi
lea eax, [ebx + 8]
mov ecx, esi
push eax
lea eax, [ebp - 0x1c]
push eax
call fcn.00457220
mov edx, dword [eax]
jmp 0x46037b
mov edx, dword [ebp - 0x1c]
mov eax, dword [edx + 4]
inc dword [esi + 8]
mov dword [ebx + 4], eax
mov dword [ebx], edx
mov dword [eax], ebx
mov dword [edx + 4], ebx
mov ecx, dword [esi + 0xc]
mov dword [ebp + 0xc], eax
mov eax, dword [esi + 0x18]
and eax, edi
mov edi, dword [ebp - 0x24]
mov esi, dword [ecx + eax*8]
cmp esi, dword [edi]
jne 0x4603a5
mov dword [ecx + eax*8], ebx
jmp 0x4603b7
cmp esi, edx
jne 0x4603ae
mov dword [ecx + eax*8], ebx
jmp 0x4603bb
mov edx, dword [ebp + 0xc]
cmp dword [ecx + eax*8 + 4], edx
jne 0x4603bb
mov dword [ecx + eax*8 + 4], ebx
mov eax, dword [ebp + 8]
mov dword [eax], ebx
mov byte [eax + 4], 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
push str.unordered_map_set_too_long
call fcn.004eb99c
int3
Function at 0x4630bb
Capabilities:
Get number of processors
Parse pe header
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1fbc
push ebx
push esi
push edi
push ebx
push ecx
add esp, 4
add ebx, 0x107ac
or ebx, 0x1330
pop ebx
push edi
xor edi, 0x9ba3
xor edi, 0xafc9
add edi, 0x8c3
pop edi
push eax
push eax
add esp, 4
sub eax, 0x138d0
pop eax
mov eax, 0x4d
mov word [ebp - 0x1ef4], ax
mov ecx, 0x42
mov word [ebp - 0x1ef2], cx
mov edx, 0x53
mov word [ebp - 0x1ef0], dx
mov eax, 0x65
mov word [ebp - 0x1eee], ax
mov ecx, 0x72
mov word [ebp - 0x1eec], cx
mov edx, 0x76
mov word [ebp - 0x1eea], dx
mov eax, 0x69
mov word [ebp - 0x1ee8], ax
mov ecx, 0x63
mov word [ebp - 0x1ee6], cx
mov edx, 0x65
mov word [ebp - 0x1ee4], dx
mov eax, 0x2e
mov word [ebp - 0x1ee2], ax
mov ecx, 0x65
mov word [ebp - 0x1ee0], cx
mov edx, 0x78
mov word [ebp - 0x1ede], dx
mov eax, 0x65
mov word [ebp - 0x1edc], ax
xor ecx, ecx
mov word [ebp - 0x1eda], cx
mov dword [ebp - 0xfac], 1
push ebx
push eax
add esp, 4
xor ebx, 0x876
pop ebx
push edi
sub edi, 0x18298
jmp 0x4631c1
pop edi
push ebx
push eax
add esp, 4
sub ebx, 0x16074
add ebx, 0x6bf4
or ebx, 0x13539
pop ebx
imul edx, dword [ebp - 0xfac], 0x138
add edx, 0x44f3644b
imul eax, dword [ebp - 0xfac], 0x138
sub edx, eax
xor edx, 0xabe912
imul edx, dword [ebp - 0xfac]
imul ecx, dword [ebp - 0xfac], 0x138
sub edx, ecx
mov dword [ebp - 0xfb0], edx
push ecx
and ecx, 0x13f8f
jmp 0x463222
or ecx, 0x10fdb
xor ecx, 0x2559
pop ecx
push edx
push edi
add esp, 4
or edx, 0x191c
sub edx, 0xc9f9
sub edx, 0x13533
pop edx
mov dword [ebp - 0x10], 1
push ebx
push edi
add esp, 4
sub ebx, 0x7605
jmp 0x46325f
xor ebx, 0x10b27
and ebx, 0x8703
pop ebx
push edi
and edi, 0xb552
or edi, 0xd243
or edi, 0x1373b
pop edi
imul edx, dword [ebp - 0x10], 0x138
add edx, 0x44f3644b
imul eax, dword [ebp - 0x10], 0x138
sub edx, eax
xor edx, 0x153c
imul edx, dword [ebp - 0x10]
imul ecx, dword [ebp - 0x10], 0x138
sub edx, ecx
mov dword [ebp - 0x14], edx
push edx
xor edx, 0x100fe
jmp 0x4632b9
pop edx
push eax
and eax, 0x8f32
xor eax, 0x96e1
call fcn.004632d4
add byte [ebx + 0x4c], al
dec eax
aaa
cmp al, 0x3b
add esp, 4
add esp, 4
Function at 0x46793b
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
add esp, 4
sub eax, 0x4a68
pop eax
push edi
add edi, 0x13d8c
pop edi
mov ecx, dword [ebp - 0x4d8]
mov dword [ebp - 0x6ec], ecx
jmp 0x4679c3
Function at 0x468141
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
add esp, 4
jmp 0x468149
jmp 0x46814f
pop edi
mov ecx, dword [ebp - 0x4dc]
mov dword [ebp - 0x2e0], ecx
jmp 0x4681c6
Function at 0x4694ee
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebx
and ebx, 0xb0e8
pop ebx
push edx
push esi
add esp, 4
xor edx, 0x65f5
pop edx
push edx
xor edx, 0x1205c
xor edx, 0x10d77
call 0x4694ee
add byte [esi + 0x41], al
inc ecx
xor esi, dword [0xc4834050]
add al, 0x5a
lea eax, [ebp - 0x1628]
mov dword [ebp - 0xc64], eax
mov ecx, dword [ebp - 0x4ec]
mov edx, dword [ecx + 0x30]
mov dword [ebp - 0xc60], edx
xor eax, eax
mov word [ebp - 0x20c], ax
xor ecx, ecx
mov word [ebp - 0x40], cx
push edx
push ecx
add esp, 4
or edx, 0x1688a
pop edx
push ecx
and ecx, 0x89ed
sub ecx, 0x1676b
add ecx, 0x8c4b
pop ecx
push edi
push edx
add esp, 4
sub edi, 0x12199
add edi, 0x16148
pop edi
mov edx, dword [ebp - 0xc60]
mov ax, word [edx]
mov word [ebp - 0xf92], ax
mov ecx, dword [ebp - 0xc60]
add ecx, 2
mov dword [ebp - 0xc60], ecx
mov dx, word [ebp - 0xf92]
mov word [ebp - 0x20c], dx
mov eax, dword [ebp - 0xc64]
mov cx, word [eax]
mov word [ebp - 0xf94], cx
mov edx, dword [ebp - 0xc64]
add edx, 2
mov dword [ebp - 0xc64], edx
mov ax, word [ebp - 0xf94]
mov word [ebp - 0x40], ax
push edx
push edi
add esp, 4
add edx, 0x362e
or edx, 0x17e42
or edx, 0x4577
jmp 0x4695c2
pop edx
push esi
xor esi, 0x11baa
pop esi
push edi
push esi
add esp, 4
or edi, 0x2356
pop edi
movzx ecx, word [ebp - 0x40]
test ecx, ecx
jne 0x4695f4
movzx edx, word [ebp - 0x20c]
movzx eax, word [ebp - 0x40]
sub edx, eax
mov dword [ebp - 0x157c], edx
jmp 0x46964e
movzx ecx, word [ebp - 0x20c]
movzx edx, word [ebp - 0x40]
cmp ecx, edx
je 0x46951c
movzx eax, word [ebp - 0x20c]
xor eax, 0x20
movzx ecx, word [ebp - 0x40]
cmp eax, ecx
je 0x46951c
movzx edx, word [ebp - 0x20c]
movzx eax, word [ebp - 0x40]
cmp edx, eax
jge 0x469638
mov dword [ebp - 0x1578], 0xffffffff
jmp 0x469642
mov dword [ebp - 0x1578], 1
mov ecx, dword [ebp - 0x1578]
mov dword [ebp - 0x157c], ecx
cmp dword [ebp - 0x157c], 0
jne 0x469697
push ecx
push ecx
add esp, 4
or ecx, 0xf62f
jmp 0x469668
or ecx, 0x6b02
or ecx, 0x15c58
pop ecx
push esi
sub esi, 0xbfa9
add esi, 0x658a
or esi, 0x17da3
pop esi
mov edx, dword [ebp - 0x4ec]
mov dword [ebp - 0x2a8], edx
jmp 0x4696ff
push ecx
push ecx
add esp, 4
sub ecx, 0x13569
sub ecx, 0x13aeb
or ecx, 0x16992
add ecx, 0xab68
push 0x590000ab
push edx
push ecx
add esp, 4
jmp 0x4696c2
or edx, 0x44c6
pop edx
mov eax, dword [ebp - 0x4ec]
mov ecx, dword [eax]
mov dword [ebp - 0x4ec], ecx
mov edx, dword [ebp - 0x4ec]
cmp edx, dword [ebp - 0xc68]
je 0x4696f5
mov eax, dword [ebp - 0x4ec]
cmp dword [eax + 0x30], 0
jne 0x4694c0
mov dword [ebp - 0x2a8], 0
push eax
push ebx
add esp, 4
and eax, 0xf70c
sub eax, 0x39c7
and eax, 0xc1b0
or eax, 0x11bc5
pop eax
push edi
add edi, 0xf508
pop edi
push ecx
push eax
add esp, 4
or ecx, 0x673c
pop ecx
mov ecx, dword [ebp - 0x2a8]
mov edx, dword [ecx + 0x18]
mov dword [ebp - 0x304], edx
Function at 0x4695b0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebx
and ebx, 0xb0e8
pop ebx
push edx
push esi
add esp, 4
xor edx, 0x65f5
pop edx
push edx
xor edx, 0x1205c
xor edx, 0x10d77
call 0x4694ee
add byte [esi + 0x41], al
inc ecx
xor esi, dword [0xc4834050]
add al, 0x5a
lea eax, [ebp - 0x1628]
mov dword [ebp - 0xc64], eax
mov ecx, dword [ebp - 0x4ec]
mov edx, dword [ecx + 0x30]
mov dword [ebp - 0xc60], edx
xor eax, eax
mov word [ebp - 0x20c], ax
xor ecx, ecx
mov word [ebp - 0x40], cx
push edx
push ecx
add esp, 4
or edx, 0x1688a
pop edx
push ecx
and ecx, 0x89ed
sub ecx, 0x1676b
add ecx, 0x8c4b
pop ecx
push edi
push edx
add esp, 4
sub edi, 0x12199
add edi, 0x16148
pop edi
mov edx, dword [ebp - 0xc60]
mov ax, word [edx]
mov word [ebp - 0xf92], ax
mov ecx, dword [ebp - 0xc60]
add ecx, 2
mov dword [ebp - 0xc60], ecx
mov dx, word [ebp - 0xf92]
mov word [ebp - 0x20c], dx
mov eax, dword [ebp - 0xc64]
mov cx, word [eax]
mov word [ebp - 0xf94], cx
mov edx, dword [ebp - 0xc64]
add edx, 2
mov dword [ebp - 0xc64], edx
mov ax, word [ebp - 0xf94]
mov word [ebp - 0x40], ax
push edx
push edi
add esp, 4
add edx, 0x362e
or edx, 0x17e42
or edx, 0x4577
jmp 0x4695c2
pop edx
push esi
xor esi, 0x11baa
pop esi
push edi
push esi
add esp, 4
or edi, 0x2356
pop edi
movzx ecx, word [ebp - 0x40]
test ecx, ecx
jne 0x4695f4
movzx edx, word [ebp - 0x20c]
movzx eax, word [ebp - 0x40]
sub edx, eax
mov dword [ebp - 0x157c], edx
jmp 0x46964e
movzx ecx, word [ebp - 0x20c]
movzx edx, word [ebp - 0x40]
cmp ecx, edx
je 0x46951c
movzx eax, word [ebp - 0x20c]
xor eax, 0x20
movzx ecx, word [ebp - 0x40]
cmp eax, ecx
je 0x46951c
movzx edx, word [ebp - 0x20c]
movzx eax, word [ebp - 0x40]
cmp edx, eax
jge 0x469638
mov dword [ebp - 0x1578], 0xffffffff
jmp 0x469642
mov dword [ebp - 0x1578], 1
mov ecx, dword [ebp - 0x1578]
mov dword [ebp - 0x157c], ecx
cmp dword [ebp - 0x157c], 0
jne 0x469697
push ecx
push ecx
add esp, 4
or ecx, 0xf62f
jmp 0x469668
or ecx, 0x6b02
or ecx, 0x15c58
pop ecx
push esi
sub esi, 0xbfa9
add esi, 0x658a
or esi, 0x17da3
pop esi
mov edx, dword [ebp - 0x4ec]
mov dword [ebp - 0x2a8], edx
jmp 0x4696ff
push ecx
push ecx
add esp, 4
sub ecx, 0x13569
sub ecx, 0x13aeb
or ecx, 0x16992
add ecx, 0xab68
push 0x590000ab
push edx
push ecx
add esp, 4
jmp 0x4696c2
or edx, 0x44c6
pop edx
mov eax, dword [ebp - 0x4ec]
mov ecx, dword [eax]
mov dword [ebp - 0x4ec], ecx
mov edx, dword [ebp - 0x4ec]
cmp edx, dword [ebp - 0xc68]
je 0x4696f5
mov eax, dword [ebp - 0x4ec]
cmp dword [eax + 0x30], 0
jne 0x4694c0
mov dword [ebp - 0x2a8], 0
push eax
push ebx
add esp, 4
and eax, 0xf70c
sub eax, 0x39c7
and eax, 0xc1b0
or eax, 0x11bc5
pop eax
push edi
add edi, 0xf508
pop edi
push ecx
push eax
add esp, 4
or ecx, 0x673c
pop ecx
mov ecx, dword [ebp - 0x2a8]
mov edx, dword [ecx + 0x18]
mov dword [ebp - 0x304], edx
Function at 0x481800
Capabilities:
Get memory capacity

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x48
mov eax, dword [0x670440]
xor eax, esp
mov dword [esp + 0x44], eax
push 0x38
lea eax, [esp + 0xc]
mov dword [esp + 4], 0x40
push 0
push eax
mov dword [esp + 0x10], 0
call fcn.005b9800
add esp, 0xc
lea eax, [esp]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalMemoryStatusEx]
mov ecx, dword [esp + 0x44]
mov eax, dword [esp + 8]
xor ecx, esp
mov edx, dword [esp + 0xc]
call fcn.00502d42
mov esp, ebp
pop ebp
ret
Function at 0x487900
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
mov ebx, ecx
movzx eax, bl
xor eax, 0x811c9dc5
mov dword [ebp - 4], ebx
imul edx, eax, 0x1000193
mov eax, ebx
shr eax, 8
movzx eax, al
push esi
mov dword [ebx], vtable.CLauncherWnd.0
xor edx, eax
mov eax, ebx
shr eax, 0x10
imul ecx, edx, 0x1000193
movzx eax, al
xor ecx, eax
mov eax, ebx
imul ecx, ecx, 0x1000193
shr eax, 0x18
xor ecx, eax
lea eax, [ebp - 4]
imul esi, ecx, 0x1000193
push esi
push eax
lea eax, [ebp - 0xc]
push eax
call fcn.00488350
mov edx, dword [eax + 4]
test edx, edx
je 0x4879b8
mov ecx, dword [0x67bcfc]
mov eax, dword [0x67bcf0]
and ecx, esi
lea ecx, [eax + ecx*8]
mov eax, dword [ecx]
cmp dword [ecx + 4], edx
jne 0x487992
cmp eax, edx
jne 0x48798a
mov eax, dword [0x67bce8]
mov dword [ecx], eax
mov dword [ecx + 4], eax
jmp 0x48799a
mov eax, dword [edx + 4]
mov dword [ecx + 4], eax
jmp 0x48799a
cmp eax, edx
jne 0x48799a
mov eax, dword [edx]
mov dword [ecx], eax
mov ecx, dword [edx]
dec dword [0x67bcec]
mov eax, dword [edx + 4]
push 0xc
push edx
mov dword [eax], ecx
mov eax, dword [edx + 4]
mov dword [ecx + 4], eax
call fcn.005030b1
add esp, 8
mov edx, dword [ebx + 4]
or eax, 0xffffffff
sub edx, 0x10
lock xadd dword [edx + 0xc], eax
dec eax
pop esi
pop ebx
test eax, eax
jg 0x4879d5
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov esp, ebp
pop ebp
ret

Function at 0x4879e0
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
test ebx, ebx
jne 0x4879fb
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
movzx eax, bl
xor eax, 0x811c9dc5
mov dword [ebp + 8], ebx
imul ecx, eax, 0x1000193
mov eax, ebx
shr eax, 8
movzx eax, al
xor ecx, eax
mov eax, ebx
shr eax, 0x10
imul ecx, ecx, 0x1000193
movzx eax, al
xor ecx, eax
mov eax, ebx
imul ecx, ecx, 0x1000193
shr eax, 0x18
xor ecx, eax
imul eax, ecx, 0x1000193
push eax
lea eax, [ebp + 8]
push eax
lea eax, [ebp - 0xc]
push eax
call fcn.004883c0
mov ecx, dword [eax + 4]
test ecx, ecx
mov eax, dword [0x67bd0c]
cmovne eax, ecx
cmp eax, dword [0x67bd0c]
je 0x487a68
mov eax, dword [eax + 0xc]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
push ebx
push 0
call dword [sym.imp.USER32.dll_LoadCursorW]
mov esi, eax
test esi, esi
je 0x487a9a
lea eax, [ebp + 8]
mov dword [ebp + 8], ebx
push eax
lea eax, [ebp - 0xc]
push eax
call fcn.00487c10
mov edi, dword [eax]
mov eax, dword [edi + 0xc]
test eax, eax
je 0x487a97
push eax
call dword [sym.imp.GDI32.dll_DeleteObject]
mov dword [edi + 0xc], esi
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4