joyce8/EMBER2024-capa huggingface dataset:
Function at 0x491760
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x69def6
mov eax, dword fs:[0]
push eax
sub esp, 0x424
mov eax, dword [0x7adbc4]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov eax, dword [ebp + 0xc]
mov edi, dword [ebp + 8]
mov dword [ebp - 0x420], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x41c], eax
mov dword [ebp - 0x430], 0
mov dword [ebp - 4], 0
mov dword [ebp - 0x428], ecx
mov dword [ebp - 0x42c], 0
mov dword [ebp - 0x418], 0
push 0x60
push 0
mov byte [ebp - 4], 1
mov ebx, dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
push edi
call ebx
mov esi, eax
mov dword [ebp - 0x424], esi
test esi, esi
jne 0x49180c
push 2
push eax
push edi
call ebx
mov esi, eax
mov dword [ebp - 0x424], eax
test esi, esi
jne 0x49180c
call fcn.00490bd0
mov edi, eax
jmp 0x49192b
push dword [ebp - 0x41c]
push dword [ebp - 0x420]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov edi, eax
test edi, edi
jne 0x49182f
call fcn.00490bd0
jmp 0x49191e
push edi
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov ebx, eax
mov dword [ebp - 0x420], ebx
test ebx, ebx
jne 0x49184d
call fcn.00490bd0
jmp 0x49191e
push edi
push esi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov edi, eax
mov dword [ebp - 0x41c], edi
lea eax, [edi + 1]
cmp eax, edi
jae 0x49186e
mov edi, 0x8007000e
jmp 0x491920
mov ecx, 2
mov byte [ebp - 4], 2
mul ecx
test edx, edx
ja 0x491964
jb 0x49188c
cmp eax, 0xffffffff
ja 0x491964
cmp eax, 0x400
jbe 0x4918a1
push eax
lea ecx, [ebp - 0x418]
call fcn.00499ab0
jmp 0x4918c7
lea eax, [ebp - 0x414]
mov dword [ebp - 0x418], eax
jmp 0x4918c7
mov dword [ebp - 4], 1
cmp dword [ebp - 0x418], 0
jne 0x4918de
mov edi, 0x8007000e
jmp 0x491920
push edi
push dword [ebp - 0x418]
push edi
push ebx
push 0
push 3
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov ecx, eax
test ecx, ecx
jne 0x4918fe
call fcn.00490bd0
jmp 0x49191e
mov eax, dword [ebp - 0x418]
xor edx, edx
push dword [ebp + 0x14]
mov word [eax + ecx*2], dx
lea ecx, [ebp - 0x42c]
push dword [ebp - 0x418]
call fcn.00492520
mov edi, eax
test esi, esi
je 0x49192b
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
lea eax, [ebp - 0x414]
cmp dword [ebp - 0x418], eax
je 0x491944
lea ecx, [ebp - 0x418]
call fcn.00499860
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.00669a8a
mov esp, ebp
pop ebp
ret 0x10
push 0x80070216
call fcn.00490960
int3
Function at 0x4956b0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x69de20
mov eax, dword fs:[0]
push eax
sub esp, 8
push esi
mov eax, dword [0x7adbc4]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov eax, dword [esi]
test eax, eax
jne 0x4956f5
sub esp, 8
mov edx, 0x9d
mov ecx, str.ATL::CAtlFile::Write
call fcn.00493a40
mov eax, dword [esi]
add esp, 8
push 0
lea ecx, [ebp - 0x10]
push ecx
push dword [ebp + 0xc]
push dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x495723
call fcn.00490bd0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret 0xc
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret 0xc
Function at 0x49a360
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov ebx, ecx
push edi
push dword [ebx]
call dword [sym.imp.USER32.dll_GetWindowTextLengthW]
lea edi, [eax + 1]
test edi, edi
js 0x49a3dd
mov esi, dword [ebp + 8]
mov ecx, 1
mov edx, dword [esi]
mov eax, dword [edx - 8]
sub ecx, dword [edx - 4]
sub eax, edi
or ecx, eax
jge 0x49a397
push edi
mov ecx, esi
call fcn.00499950
mov edx, dword [esi]
push edi
push edx
push dword [ebx]
call dword [sym.imp.USER32.dll_GetWindowTextW]
mov edi, eax
mov ecx, edi
cmp edi, 0xffffffff
jne 0x49a3be
mov ecx, dword [esi]
test ecx, ecx
je 0x49a3c2
push dword [ecx - 8]
push ecx
call fcn.00675480
add esp, 8
mov ecx, eax
test ecx, ecx
js 0x49a3dd
mov eax, dword [esi]
cmp ecx, dword [eax - 8]
jg 0x49a3dd
mov dword [eax - 0xc], ecx
xor edx, edx
mov eax, dword [esi]
mov word [eax + ecx*2], dx
mov eax, edi
pop edi
pop esi
pop ebx
pop ebp
ret 4
push 0x80070057
call fcn.00490960
int3

Function at 0x49a3f0
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
push ebx
push dword [ebp + 8]
push dword [ecx]
call dword [sym.imp.USER32.dll_GetDlgItem]
mov ebx, eax
test ebx, ebx
je 0x49a47a
push esi
push edi
push ebx
call dword [sym.imp.USER32.dll_GetWindowTextLengthW]
lea edi, [eax + 1]
test edi, edi
js 0x49a489
mov esi, dword [ebp + 0xc]
mov ecx, 1
mov edx, dword [esi]
mov eax, dword [edx - 8]
sub ecx, dword [edx - 4]
sub eax, edi
or ecx, eax
jge 0x49a435
push edi
mov ecx, esi
call fcn.00499950
mov edx, dword [esi]
push edi
push edx
push ebx
call dword [sym.imp.USER32.dll_GetWindowTextW]
mov edi, eax
mov ecx, edi
cmp edi, 0xffffffff
jne 0x49a45b
mov ecx, dword [esi]
test ecx, ecx
je 0x49a45f
push dword [ecx - 8]
push ecx
call fcn.00675480
add esp, 8
mov ecx, eax
test ecx, ecx
js 0x49a489
mov eax, dword [esi]
cmp ecx, dword [eax - 8]
jg 0x49a489
mov dword [eax - 0xc], ecx
xor edx, edx
mov eax, dword [esi]
mov word [eax + ecx*2], dx
mov eax, edi
pop edi
pop esi
pop ebx
pop ebp
ret 8
mov ecx, dword [ebp + 0xc]
call fcn.00498f50
xor eax, eax
pop ebx
pop ebp
ret 8
push 0x80070057
call fcn.00490960
int3

Function at 0x49a700
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, dword [ebp + 0x10]
mov edx, 1
push edi
mov ebx, ecx
mov edi, dword [esi]
mov eax, dword [edi - 8]
sub edx, dword [edi - 4]
sub eax, 0x400
or edx, eax
jge 0x49a72f
push 0x400
mov ecx, esi
call fcn.00499950
mov edi, dword [esi]
push ebx
push 0x400
push edi
push dword [ebp + 0x14]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
xor ecx, ecx
cmp ecx, eax
sbb edi, edi
neg edi
cmp ecx, eax
sbb edx, edx
test eax, eax
je 0x49a76d
mov eax, dword [esi]
test eax, eax
jne 0x49a75f
xor edx, edx
jmp 0x49a771
push dword [eax - 8]
push eax
call fcn.00675480
add esp, 8
mov edx, eax
test edx, edx
js 0x49a78c
mov ecx, dword [esi]
cmp edx, dword [ecx - 8]
jg 0x49a78c
mov dword [ecx - 0xc], edx
xor eax, eax
mov ecx, dword [esi]
mov word [ecx + edx*2], ax
mov eax, edi
pop edi
pop esi
pop ebx
pop ebp
ret 0x10
push 0x80070057
call fcn.00490960
int3
Function at 0x4a70e0
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x6a3488
mov eax, dword fs:[0]
push eax
sub esp, 0x34
push ebx
push esi
push edi
mov eax, dword [0x7adbc4]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov dword [ebp - 4], 0
call fcn.00493480
mov ecx, eax
test ecx, ecx
je 0x4a71f8
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x10], eax
push dword [ebp + 8]
lea eax, [ebp - 0x10]
mov dword [ebp - 4], 1
push str.Column_dWidth
push eax
call fcn.00499dc0
mov esi, dword [ebp - 0x10]
add esp, 0xc
push dword [ebx + 4]
push 0x78
push esi
push str.ListView
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
mov edi, eax
cmp edi, 0x3c
jge 0x4a7168
mov edi, 0x3c
jmp 0x4a7175
cmp edi, 0x1f4
jle 0x4a7175
mov edi, 0x1f4
add esi, 0xfffffff0
mov dword [ebp - 4], 2
or eax, 0xffffffff
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x4a7194
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
mov eax, dword [ebp + 0xc]
lea ecx, [ebp - 0x3c]
mov dword [ebp - 0x30], eax
xorps xmm0, xmm0
mov eax, dword [ebp + 8]
push ecx
push eax
mov dword [ebp - 0x28], eax
mov eax, dword [ebx]
push 0x1061
mov dword [ebp - 0x2c], 0
movlpd qword [ebp - 0x24], xmm0
movlpd qword [ebp - 0x18], xmm0
mov dword [ebp - 0x3c], 0x4f
mov dword [ebp - 0x38], 0
mov dword [ebp - 0x34], edi
mov dword [ebp - 0x1c], 0x3c
push dword [eax + 0xc8]
call dword [sym.imp.USER32.dll_SendMessageW]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
push 0x80004005
call fcn.00490960
int3
Function at 0x4b0730
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
mov ebx, dword [ebp + 8]
movzx eax, bl
xor eax, 0x811c9dc5
mov dword [ebp - 8], ecx
imul edx, eax, 0x1000193
mov eax, ebx
shr eax, 8
movzx eax, al
push esi
push edi
xor edx, eax
mov eax, ebx
imul ecx, edx, 0x1000193
shr eax, 0x10
movzx eax, al
xor ecx, eax
mov eax, ebx
imul ecx, ecx, 0x1000193
shr eax, 0x18
xor ecx, eax
imul eax, ecx, 0x1000193
mov ecx, dword [0x7bad90]
and eax, dword [0x7bad9c]
lea edx, [eax*8]
mov esi, dword [edx + ecx]
lea edi, [edx + ecx]
mov edx, dword [0x7bad88]
mov eax, esi
nop dword [eax + eax]
cmp esi, edx
jne 0x4b07a8
mov ecx, edx
jmp 0x4b07ad
mov ecx, dword [edi + 4]
mov ecx, dword [ecx]
cmp eax, ecx
je 0x4b07ca
cmp dword [eax + 8], ebx
je 0x4b07ba
mov eax, dword [eax]
jmp 0x4b07a0
cmp eax, edx
je 0x4b07ca
mov eax, dword [eax + 0xc]
mov dword [ebp - 0x10], eax
mov byte [ebp - 0xc], 1
jmp 0x4b07d2
xorps xmm0, xmm0
movlpd qword [ebp - 0x10], xmm0
mov edx, dword [ebp - 8]
lea ecx, [ebp - 0x10]
mov eax, dword [ecx]
pop edi
pop esi
mov dword [edx + 0xe4], eax
mov eax, dword [ecx + 4]
mov dword [edx + 0xe8], eax
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x4b2bd0
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, ecx
movzx eax, byte [esi]
xor eax, 0x811c9dc5
imul edx, eax, 0x1000193
movzx eax, byte [esi + 1]
xor edx, eax
movzx eax, byte [esi + 2]
imul edx, edx, 0x1000193
xor edx, eax
movzx eax, byte [esi + 3]
imul ecx, edx, 0x1000193
mov edx, dword [edi + 0xc]
xor ecx, eax
imul eax, ecx, 0x1000193
mov ecx, dword [edi + 0x18]
mov edi, dword [edi + 4]
and ecx, eax
mov ebx, dword [edx + ecx*8]
lea edx, [edx + ecx*8]
add edx, 4
mov dword [ebp + 8], ebx
mov eax, ebx
mov dword [ebp - 4], edx
nop dword [eax]
cmp ebx, edi
jne 0x4b2c38
mov ecx, edi
jmp 0x4b2c3c
mov ecx, dword [edx]
mov ecx, dword [ecx]
cmp eax, ecx
je 0x4b2c7b
mov ebx, dword [esi]
cmp dword [eax + 8], ebx
je 0x4b2c4e
mov eax, dword [eax]
mov ebx, dword [ebp + 8]
jmp 0x4b2c30
mov ecx, eax
mov esi, eax
mov dword [ebp - 8], ecx
mov ecx, dword [ebp + 8]
cmp ecx, edi
jne 0x4b2c60
mov edx, edi
jmp 0x4b2c64
mov edx, dword [edx]
mov edx, dword [edx]
cmp eax, edx
je 0x4b2c74
cmp ebx, dword [eax + 8]
jne 0x4b2c74
mov eax, dword [eax]
mov edx, dword [ebp - 4]
jmp 0x4b2c58
mov ecx, dword [ebp - 8]
cmp esi, eax
jne 0x4b2c7f
mov ecx, edi
mov eax, edi
xor edx, edx
cmp ecx, eax
je 0x4b2c8c
mov ecx, dword [ecx]
inc edx
cmp ecx, eax
jne 0x4b2c85
pop edi
pop esi
mov eax, edx
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x4b5ce0
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x6a4758
mov eax, dword fs:[0]
push eax
sub esp, 0x2c
mov eax, dword [0x7adbc4]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov esi, dword [ebp + 0x14]
lea eax, [ebx - 0x24]
mov ecx, 4
test ebx, ebx
xorps xmm0, xmm0
cmove eax, ecx
lea ecx, [ebp - 0x20]
push ecx
movups xmmword [ebp - 0x20], xmm0
push dword [eax]
call dword [sym.imp.USER32.dll_GetWindowRect]
mov eax, dword [ebp - 0x18]
sub eax, dword [ebp - 0x20]
mov ecx, dword [ebx + 0x28]
mov dword [ebx + 0x20], eax
mov eax, dword [ebp - 0x14]
sub eax, dword [ebp - 0x1c]
mov dword [ebx + 0x24], eax
test ecx, ecx
je 0x4b5e25
mov eax, dword [ebx + 0x2c]
test eax, eax
je 0x4b5e25
mov dword [ebp - 0x34], 0
mov dword [ebp - 0x30], 0
mov dword [ebp - 0x2c], 0
push 0
push ecx
push 0x2001f
sub esp, 8
mov dword [ebp - 4], 0
push eax
push ecx
lea ecx, [ebp - 0x34]
call fcn.00490fb0
mov edi, dword [ebp - 0x34]
test eax, eax
jne 0x4b5e1a
mov eax, dword [ebx + 0x20]
mov dword [ebp - 0x24], eax
lea eax, [ebp - 0x28]
push eax
call fcn.004b5ee0
push 4
lea ecx, [ebp - 0x24]
push ecx
push 4
push 0
push dword [eax]
push edi
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov edx, dword [ebp - 0x28]
add edx, 0xfffffff0
mov byte [ebp - 4], 1
or eax, 0xffffffff
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x4b5dd5
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov byte [ebp - 4], 0
mov eax, dword [ebx + 0x24]
mov dword [ebp - 0x28], eax
lea eax, [ebp - 0x24]
push eax
call fcn.004b5e50
push 4
lea ecx, [ebp - 0x28]
push ecx
push 4
push 0
push dword [eax]
push edi
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov edx, dword [ebp - 0x24]
add edx, 0xfffffff0
mov byte [ebp - 4], 2
or eax, 0xffffffff
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x4b5e1a
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
test edi, edi
je 0x4b5e25
push edi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
mov dword [esi], eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00669a8a
mov esp, ebp
pop ebp
ret 0x10
Function at 0x4b6ed0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x69fd60
mov eax, dword fs:[0]
push eax
push esi
push edi
mov eax, dword [0x7adbc4]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
push 8
mov dword [edi], vtable.std::basic_streambuf_char__struct_std::char_traits_char__.0
call fcn.00669f3d
mov esi, eax
push 1
mov dword [ebp - 4], 0
call fcn.006505b6
mov dword [esi + 4], eax
lea ecx, [edi + 8]
lea eax, [edi + 4]
mov dword [edi + 0x34], esi
mov dword [edi + 0xc], eax
add esp, 8
lea eax, [edi + 0x14]
mov dword [edi + 0x10], ecx
mov dword [edi + 0x1c], eax
lea eax, [edi + 0x18]
mov dword [edi + 0x20], eax
lea eax, [edi + 0x24]
mov dword [edi + 0x2c], eax
lea eax, [edi + 0x28]
mov dword [edi + 0x30], eax
mov dword [ecx], 0
mov eax, dword [edi + 0x20]
mov dword [eax], 0
mov eax, dword [edi + 0x30]
mov dword [eax], 0
mov eax, dword [edi + 0xc]
mov dword [eax], 0
mov eax, dword [edi + 0x1c]
mov dword [eax], 0
mov eax, dword [edi + 0x2c]
mov dword [eax], 0
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x4b7110
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 0xc]
mov ecx, 0
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, 0x811c9dc5
sub edx, edi
sar edx, 1
add edx, edx
je 0x4b7141
nop dword [eax]
movzx eax, byte [ecx + edi]
inc ecx
xor eax, esi
imul esi, eax, 0x1000193
cmp ecx, edx
jb 0x4b7130
pop edi
mov eax, esi
pop esi
pop ebp
ret 8
Function at 0x4ba100
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x6a4b4e
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x7adbc4]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x10], edi
mov esi, dword [ebp + 8]
movzx eax, byte [esi]
mov byte [edi], al
movzx eax, byte [esi + 1]
mov byte [edi + 1], al
mov eax, dword [esi + 4]
mov dword [edi + 4], eax
mov ecx, dword [esi + 8]
sub ecx, 0x10
call fcn.004998f0
add eax, 0x10
mov dword [edi + 8], eax
mov dword [ebp - 4], 0
mov ecx, dword [esi + 0xc]
sub ecx, 0x10
call fcn.004998f0
add eax, 0x10
mov dword [edi + 0xc], eax
mov byte [ebp - 4], 1
mov ecx, dword [esi + 0x10]
sub ecx, 0x10
call fcn.004998f0
add eax, 0x10
mov dword [edi + 0x10], eax
mov byte [ebp - 4], 2
mov ecx, dword [esi + 0x14]
sub ecx, 0x10
call fcn.004998f0
add eax, 0x10
mov dword [edi + 0x14], eax
mov byte [ebp - 4], 3
mov ecx, dword [esi + 0x18]
sub ecx, 0x10
call fcn.004998f0
add eax, 0x10
mov dword [edi + 0x18], eax
mov byte [ebp - 4], 4
mov ecx, dword [esi + 0x1c]
sub ecx, 0x10
call fcn.004998f0
add eax, 0x10
mov dword [edi + 0x1c], eax
mov byte [ebp - 4], 5
mov ecx, dword [esi + 0x20]
sub ecx, 0x10
call fcn.004998f0
add eax, 0x10
mov dword [edi + 0x20], eax
mov byte [ebp - 4], 6
mov ecx, dword [esi + 0x24]
sub ecx, 0x10
call fcn.004998f0
add eax, 0x10
mov dword [edi + 0x24], eax
mov byte [ebp - 4], 7
mov ecx, dword [esi + 0x28]
sub ecx, 0x10
call fcn.004998f0
add eax, 0x10
mov dword [edi + 0x28], eax
mov byte [ebp - 4], 8
mov eax, dword [esi + 0x2c]
mov dword [edi + 0x2c], eax
mov ecx, dword [esi + 0x30]
sub ecx, 0x10
call fcn.004998f0
add eax, 0x10
mov dword [edi + 0x30], eax
mov byte [ebp - 4], 9
mov ecx, dword [esi + 0x34]
sub ecx, 0x10
call fcn.004998f0
add eax, 0x10
mov dword [edi + 0x34], eax
mov eax, dword [esi + 0x38]
mov dword [edi + 0x38], eax
mov eax, dword [esi + 0x3c]
mov dword [edi + 0x3c], eax
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x4baff0
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x6a4cf0
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push ebx
push esi
push edi
mov eax, dword [0x7adbc4]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov ebx, ecx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 4], 0
mov edi, dword [ebp + 0xc]
mov esi, dword [ebx + 0xc]
movzx eax, byte [edi]
xor eax, 0x811c9dc5
imul edx, eax, 0x1000193
movzx eax, byte [edi + 1]
xor edx, eax
movzx eax, byte [edi + 2]
imul ecx, edx, 0x1000193
mov edx, dword [ebx + 4]
xor ecx, eax
movzx eax, byte [edi + 3]
imul ecx, ecx, 0x1000193
xor ecx, eax
imul eax, ecx, 0x1000193
mov ecx, dword [ebx + 0x18]
and ecx, eax
shl ecx, 3
mov dword [ebp + 0xc], ecx
mov eax, dword [esi + ecx]
cmp eax, edx
jne 0x4bb078
mov esi, edx
jmp 0x4bb080
mov esi, dword [esi + ecx + 4]
mov esi, dword [esi]
nop
cmp esi, eax
je 0x4bb0ab
mov esi, dword [esi + 4]
mov ecx, dword [edi]
cmp ecx, dword [esi + 8]
jne 0x4bb080
mov eax, dword [ebp + 8]
mov dword [eax], esi
mov byte [eax + 4], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov dword [ebp - 4], 0xffffffff
mov eax, dword [edx]
push edi
mov dword [ebp - 0x14], eax
mov ecx, dword [eax + 4]
push ecx
push eax
mov dword [ebp - 0x18], ecx
call fcn.004c2390
mov edx, eax
mov ecx, 0x15555554
mov eax, dword [ebx + 8]
sub ecx, eax
cmp ecx, 1
jb 0x4bb1a6
inc eax
mov dword [ebx + 8], eax
mov eax, dword [ebp - 0x14]
mov dword [eax + 4], edx
mov eax, dword [ebp - 0x18]
mov dword [eax], edx
mov ecx, dword [ebx + 4]
mov edi, dword [ecx]
mov dword [ebp - 0x18], edi
mov eax, dword [edi]
cmp esi, eax
je 0x4bb11b
mov ecx, dword [edi + 4]
mov dword [ecx], eax
mov ecx, dword [eax + 4]
mov dword [ecx], esi
mov ecx, dword [esi + 4]
mov dword [ecx], edi
mov ecx, dword [eax + 4]
mov edx, dword [esi + 4]
mov dword [esi + 4], ecx
mov ecx, dword [edi + 4]
mov dword [eax + 4], ecx
mov dword [edi + 4], edx
mov ecx, dword [ebx + 4]
mov edx, dword [ebp + 0xc]
add edx, dword [ebx + 0xc]
mov eax, dword [edx]
cmp eax, ecx
jne 0x4bb135
mov ecx, dword [ebp + 0xc]
mov dword [edx], edi
mov eax, dword [ebx + 0xc]
mov dword [ecx + eax + 4], edi
jmp 0x4bb158
cmp eax, esi
jne 0x4bb13d
mov dword [edx], edi
jmp 0x4bb158
mov eax, dword [edx + 4]
mov eax, dword [eax]
mov dword [edx + 4], eax
cmp eax, edi
je 0x4bb158
mov ecx, dword [ebp + 0xc]
add ecx, dword [ebx + 0xc]
mov eax, dword [ecx + 4]
mov eax, dword [eax + 4]
mov dword [ecx + 4], eax
mov ecx, ebx
mov dword [ebp - 4], 2
call fcn.004bbc40
mov eax, dword [ebp + 8]
mov dword [eax], edi
mov byte [eax + 4], 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
push str.list_T__too_long
call fcn.006509e3
int3
Function at 0x4bbb30
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x6a4dae
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x7adbc4]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
mov dword [esi + 4], 0
mov dword [esi + 8], 0
mov dword [esi + 0xc], 0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
mov dword [esi + 0x18], 0
mov dword [esi + 0x1c], 0
mov dword [ebp - 4], 0
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x2c], 0
mov dword [esi + 0x30], 0
mov dword [esi + 0x34], 0
mov dword [esi + 0x38], 0
mov dword [esi + 0x3c], 0
lea ecx, [esi + 0x40]
mov dword [ecx], 0
mov dword [ecx + 4], 0
mov dword [ecx + 8], 0
mov eax, dword [ebp + 0xc]
mov edi, dword [ebp + 0x14]
mov edx, dword [ebp + 0x20]
mov byte [ebp - 4], 2
mov dword [esi + 0x50], eax
mov eax, dword [ebp + 8]
mov dword [esi + 0x54], eax
mov eax, dword [ebp + 0x1c]
mov dword [esi + 0x5c], eax
mov eax, dword [ebp + 0x18]
mov dword [esi + 0x58], edi
mov dword [esi + 0x60], edx
mov byte [esi + 0x64], 0
mov dword [esi + 0x68], eax
test byte [edi + 8], 8
je 0x4bbc15
test dl, 0x10
jne 0x4bbc15
mov al, 1
jmp 0x4bbc17
xor al, al
mov byte [esi + 0x6c], al
mov eax, dword [ebp + 0x10]
push ecx
mov dword [esi + 0x70], eax
push dword [edi + 0x18]
call fcn.004bdf20
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 0x1c

Function at 0x4bbce0
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
mov ebx, ecx
movzx eax, byte [edi + 8]
xor eax, 0x811c9dc5
imul edx, eax, 0x1000193
movzx eax, byte [edi + 9]
xor edx, eax
movzx eax, byte [edi + 0xa]
imul edx, edx, 0x1000193
xor edx, eax
movzx eax, byte [edi + 0xb]
imul ecx, edx, 0x1000193
xor ecx, eax
imul eax, ecx, 0x1000193
mov ecx, dword [ebx + 0x18]
and ecx, eax
lea edx, [ecx*8]
mov ecx, dword [ebx + 0xc]
add ecx, edx
mov eax, dword [ecx]
cmp dword [ecx + 4], edi
jne 0x4bbd53
cmp eax, edi
jne 0x4bbd4b
mov eax, dword [ebx + 4]
mov dword [ecx], eax
mov ecx, dword [ebx + 0xc]
mov eax, dword [ebx + 4]
mov dword [edx + ecx + 4], eax
jmp 0x4bbd5b
mov eax, dword [edi + 4]
mov dword [ecx + 4], eax
jmp 0x4bbd5b
cmp eax, edi
jne 0x4bbd5e
mov eax, dword [edi]
mov dword [ecx], eax
mov edi, dword [ebp + 0xc]
mov eax, dword [edi + 4]
mov esi, dword [edi]
push 0xc
push edi
mov dword [eax], esi
mov ecx, dword [edi]
mov eax, dword [edi + 4]
mov dword [ecx + 4], eax
dec dword [ebx + 8]
call fcn.0066a2e8
mov eax, dword [ebp + 8]
add esp, 8
pop edi
mov dword [eax], esi
pop esi
pop ebx
pop ebp
ret 8