joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10037960
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
mov ebx, ecx
mov eax, 0x1fffffff
bsr ecx, eax
push esi
push edi
mov edi, 1
mov dword [ebp - 8], ebx
mov eax, edi
shl eax, cl
mov ecx, dword [ebp + 8]
cmp ecx, eax
jbe 0x10037991
push str.invalid_hash_bucket_count
call dword [sym.imp.MSVCP140D.dll_void___cdecl_std::_Xlength_error_char_const__]
lea eax, [ecx - 1]
mov esi, dword [ebx + 8]
or eax, 1
mov dword [ebp - 0xc], esi
bsr ecx, eax
push esi
lea ecx, [ecx + 1]
shl edi, cl
lea ecx, [ebx + 0x10]
lea eax, [edi + edi]
push eax
call fcn.10036390
lea eax, [edi - 1]
mov dword [ebx + 0x24], edi
mov dword [ebx + 0x20], eax
mov eax, dword [ebx + 8]
mov eax, dword [eax]
mov ecx, eax
cmp eax, esi
je 0x10037a9c
nop word [eax + eax]
movzx edx, byte [eax + 8]
xor edx, 0x811c9dc5
mov ecx, dword [ecx]
imul edi, edx, 0x1000193
movzx edx, byte [eax + 9]
xor edi, edx
movzx edx, byte [eax + 0xa]
imul edi, edi, 0x1000193
xor edi, edx
movzx edx, byte [eax + 0xb]
imul edi, edi, 0x1000193
xor edi, edx
imul edx, edi, 0x1000193
mov edi, dword [ebx + 0x20]
and edi, edx
mov edx, dword [ebx + 0x14]
lea edx, [edx + edi*8]
mov edi, dword [edx]
mov dword [ebp - 0x10], edx
cmp edi, esi
jne 0x10037a21
mov dword [edx], eax
mov dword [edx + 4], eax
jmp 0x10037a92
mov edx, dword [edx + 4]
mov ebx, dword [eax + 8]
cmp ebx, dword [edx + 8]
jne 0x10037a5b
mov edx, dword [edx]
mov dword [ebp - 4], edx
cmp edx, eax
je 0x10037a53
mov ebx, dword [eax + 4]
mov esi, dword [ebp - 4]
mov dword [ebx], ecx
mov edi, dword [ecx + 4]
mov dword [edi], edx
mov edx, dword [edx + 4]
mov dword [edx], eax
mov dword [esi + 4], edi
mov esi, dword [ebp - 0xc]
mov dword [ecx + 4], ebx
mov dword [eax + 4], edx
mov edx, dword [ebp - 0x10]
mov dword [edx + 4], eax
jmp 0x10037a8f
cmp edi, edx
je 0x10037a6c
nop
mov edx, dword [edx + 4]
cmp ebx, dword [edx + 8]
je 0x10037aa5
cmp edi, edx
jne 0x10037a60
mov ebx, dword [eax + 4]
mov dword [ebp - 4], ebx
mov dword [ebx], ecx
mov ebx, dword [ecx + 4]
mov dword [ebx], edx
mov edi, dword [edx + 4]
mov dword [edi], eax
mov dword [edx + 4], ebx
mov edx, dword [ebp - 4]
mov dword [ecx + 4], edx
mov edx, dword [ebp - 0x10]
mov dword [eax + 4], edi
mov dword [edx], eax
mov ebx, dword [ebp - 8]
mov eax, ecx
cmp ecx, esi
jne 0x100379d0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
mov ebx, dword [eax + 4]
mov edx, dword [edx]
mov dword [ebp - 4], edx
mov esi, edx
mov dword [ebx], ecx
mov edi, dword [ecx + 4]
mov dword [edi], edx
mov edx, dword [edx + 4]
mov dword [edx], eax
mov dword [esi + 4], edi
mov esi, dword [ebp - 0xc]
mov dword [ecx + 4], ebx
mov dword [eax + 4], edx
jmp 0x10037a8f
Function at 0x100441e0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [ebp + 8]
push ebx
push esi
mov dword [ebp - 0x10], eax
mov ebx, ecx
dec eax
push edi
mov edi, edx
mov dword [ebp - 0x14], eax
mov edx, dword [ebp + 0xc]
mov esi, edi
sar eax, 1
mov ecx, edi
mov dword [ebp - 4], edx
mov dword [ebp - 8], esi
mov dword [ebp - 0xc], eax
cmp edi, eax
jge 0x10044243
nop dword [eax]
lea esi, [ecx + ecx]
lea edx, [ebx + 8]
lea edx, [edx + esi*4]
lea eax, [edx - 4]
push eax
call fcn.10044000
movzx ecx, al
add esp, 4
xor ecx, 1
inc ecx
add ecx, esi
mov eax, dword [ebx + ecx*4]
mov dword [ebx + edi*4], eax
mov edi, ecx
mov eax, dword [ebp - 0xc]
cmp ecx, eax
jl 0x10044210
mov edx, dword [ebp - 4]
mov esi, dword [ebp - 8]
mov edi, ecx
cmp ecx, eax
jne 0x1004425a
mov eax, dword [ebp - 0x10]
test al, 1
jne 0x1004425a
mov eax, dword [ebx + eax*4 - 4]
mov edi, dword [ebp - 0x14]
mov dword [ebx + ecx*4], eax
cmp esi, edi
jge 0x100442a4
nop
lea esi, [edi - 1]
sar esi, 1
push edx
lea eax, [ebx + esi*4]
mov edx, eax
call fcn.10044000
add esp, 4
test al, al
je 0x10044295
mov eax, dword [ebx + esi*4]
mov edx, dword [ebp - 4]
mov dword [ebx + edi*4], eax
mov edi, esi
cmp dword [ebp - 8], esi
jl 0x10044260
mov eax, edx
mov eax, dword [eax]
mov dword [ebx + edi*4], eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 4]
mov eax, dword [eax]
mov dword [ebx + edi*4], eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [edx]
mov dword [ebx + edi*4], eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x100456a0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
cmp byte [0x10161c97], 0
push ebx
push esi
push edi
je 0x1004582e
mov ecx, dword [0x101c340c]
mov eax, dword [ecx]
mov eax, dword [eax + 0x68]
call eax
test al, al
je 0x1004582e
mov ecx, dword [0x101c3494]
xor ebx, ebx
mov dword [ebp - 4], ecx
mov eax, dword [ecx + 0x28]
mov dword [ebp - 8], eax
test eax, eax
je 0x1004582e
mov eax, dword [ecx + 0x1c]
mov ecx, dword [eax + ebx*4]
mov eax, dword [ecx]
mov eax, dword [eax + 0x30]
call eax
mov esi, eax
mov edi, 0x811c9dc5
xor ecx, ecx
nop word [eax + eax]
inc ecx
cmp byte [esi + ecx], 0
jne 0x10045700
xor edx, edx
test ecx, ecx
je 0x10045729
nop dword [eax]
movsx eax, byte [esi + edx]
inc edx
xor eax, edi
imul edi, eax, 0x1000193
cmp edx, ecx
jb 0x10045710
cmp edi, 0x5ff56dc5
je 0x10045738
inc ebx
cmp ebx, dword [ebp - 8]
jae 0x1004582e
mov ecx, dword [ebp - 4]
jmp 0x100456e4
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x1c]
mov edi, dword [eax + ebx*4]
test edi, edi
je 0x1004582e
mov edx, dword [edi + 0x88]
test edx, edx
je 0x1004582e
movss xmm1, dword [0x100e0a38]
xor ebx, ebx
cmp edx, 4
jl 0x100457fb
mov ecx, dword [edi + 0x7c]
lea esi, [edx - 4]
shr esi, 2
add ecx, 0x1078
inc esi
lea ebx, [esi*4]
movss xmm0, dword [ecx - 0xc60]
ucomiss xmm0, xmm1
lahf
test ah, 0x44
jp 0x1004579c
mov dword [ecx - 0xc60], 0x7f7fffff
movss xmm0, dword [ecx - 0x840]
ucomiss xmm0, xmm1
lahf
test ah, 0x44
jp 0x100457b7
mov dword [ecx - 0x840], 0x7f7fffff
movss xmm0, dword [ecx - 0x420]
ucomiss xmm0, xmm1
lahf
test ah, 0x44
jp 0x100457d2
mov dword [ecx - 0x420], 0x7f7fffff
movss xmm0, dword [ecx]
ucomiss xmm0, xmm1
lahf
test ah, 0x44
jp 0x100457e5
mov dword [ecx], 0x7f7fffff
add ecx, 0x1080
sub esi, 1
jne 0x10045781
cmp ebx, edx
jl 0x100457ff
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
test edx, edx
jle 0x1004582e
imul ecx, ebx, 0x420
add ecx, 0x418
add ecx, dword [edi + 0x7c]
sub edx, ebx
movss xmm0, dword [ecx]
ucomiss xmm0, xmm1
lahf
test ah, 0x44
jp 0x10045823
mov dword [ecx], 0x7f7fffff
add ecx, 0x420
sub edx, 1
jne 0x10045810
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10046ee0
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, ecx
push edi
call fcn.10045ba0
mov ecx, edi
call fcn.10044f50
cmp byte [esi + 4], 0
je 0x1004712a
push 0
call fcn.10045db0
mov ecx, esi
call fcn.10046090
push edi
mov ecx, esi
call fcn.10046af0
push 1
call fcn.10045db0
cmp byte [0x101c97bc], 0
mov eax, dword [0x101c3424]
mov byte [eax + 8], 0
mov eax, dword [0x101c35b4]
mov dword [eax], 0xffffffff
mov eax, dword [0x101c346c]
movss xmm0, dword [0x10172da8]
mov dword [0x101c35b8], 0
movss dword [eax + 0x10], xmm0
mov eax, dword [0x101c346c]
movss xmm0, dword [0x10172dac]
movss dword [eax + 0x14], xmm0
jne 0x1004712a
push ebx
push dword [0x10161f00]
call dword [sym.imp.USER32.dll_GetKeyState]
mov bl, byte [0x10161f12]
test ax, ax
setne byte [0x10172cd8]
test ax, ax
jne 0x10046fb6
cmp byte [0x101c9818], al
je 0x10047129
pop ebx
pop edi
mov dword [0x1022d168], 0
mov dword [0x101c97b8], 0x10
pop esi
pop ebp
ret 4
cmp byte [0x101c9818], 0
jne 0x10047045
mov eax, dword [0x101c346c]
movss xmm1, dword [0x100e09e0]
mov ecx, dword [0x1022d168]
divss xmm1, dword [eax + 0x20]
addss xmm1, dword [0x100e09e0]
cvttss2si eax, xmm1
cmp ecx, eax
jle 0x10046ff7
mov dword [0x1022d16c], 0x10
jmp 0x10047045
cmp dword [0x101bf1a4], 0
jne 0x10047007
inc ecx
mov dword [0x1022d168], ecx
mov ecx, dword [0x101621ec]
test byte [ecx + 0x30], 1
je 0x10047045
cmp byte [0x10162190], 0
je 0x10047045
mov dword [0x1022d168], 0
test bl, bl
je 0x10047045
mov eax, dword [0x10162040]
sub eax, 0
je 0x10047040
sub eax, 1
jne 0x10047045
call fcn.10060920
jmp 0x10047045
call fcn.100ac580
mov esi, dword [0x10168ec0]
cmp esi, 0xffffffff
je 0x100470bd
cmp esi, 0x100
jb 0x1004709e
push str.array_subscript_out_of_range
push 0x100d5f90
push 0
push 0x215
push 0x100d67f0
push 2
call dword [sym.imp.ucrtbased.dll__CrtDbgReport]
add esp, 0x18
cmp eax, 1
jne 0x1004707f
int3
push 0
push 0x215
push str.C:Program_FilesMicrosoft_Visual_Studio2022CommunityVCToolsMSVC14.40.33807include_array
push 0x100d60c4
push str._array_subscript_out_of_range_
call dword [sym.imp.ucrtbased.dll__invalid_parameter]
add esp, 0x14
lea eax, [esi + esi*2]
mov al, byte [eax*4 + 0x101c3918]
test al, al
je 0x100470bd
mov dword [0x1022d168], 0
mov byte [0x101c9818], 0
mov ecx, dword [0x101621ec]
test byte [ecx + 0x30], 1
je 0x10047116
cmp byte [0x10162190], 0
je 0x10047116
cmp byte [0x101c9818], 0
je 0x1004711f
mov dword [0x1022d168], 0
mov dword [0x101c97b8], 0xe
test bl, bl
je 0x1004710e
mov eax, dword [0x10162040]
sub eax, 0
je 0x10047109
sub eax, 1
jne 0x1004710e
call fcn.10060920
jmp 0x1004710e
call fcn.100ac580
mov eax, dword [0x101621c0]
mov byte [eax], 0
cmp byte [0x101c9818], 0
jne 0x10047129
mov dword [0x101c97f4], 0
pop ebx
pop edi
pop esi
pop ebp
ret 4
Function at 0x10047a90
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100cad05
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push ebx
push esi
push edi
mov eax, dword [0x100ed380]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
movzx eax, byte [esi]
xor eax, 0x811c9dc5
imul ecx, eax, 0x1000193
movzx eax, byte [esi + 1]
xor ecx, eax
movzx eax, byte [esi + 2]
imul ecx, ecx, 0x1000193
xor ecx, eax
movzx eax, byte [esi + 3]
imul ecx, ecx, 0x1000193
xor ecx, eax
lea eax, [ebp - 0x14]
imul edi, ecx, 0x1000193
push edi
push esi
push eax
call fcn.10048f30
mov eax, dword [ebp - 0x10]
test eax, eax
jne 0x10047bbb
cmp dword [0x101c9754], 0xfffffff
jne 0x10047b1a
push str.unordered_map_set_too_long
call dword [sym.imp.MSVCP140D.dll_void___cdecl_std::_Xlength_error_char_const__]
mov dword [ebp - 0x1c], 0x101c974c
mov dword [ebp - 4], 0
push 0x10
mov dword [ebp - 0x18], 0
call fcn.100c6d80
mov ebx, eax
add esp, 4
mov eax, dword [esi]
mov dword [ebp - 0x18], ebx
mov dword [ebx + 8], eax
mov dword [ebx + 0xc], 0
mov dword [ebp - 4], 1
mov eax, dword [0x101c9754]
inc eax
movd xmm0, eax
cvtdq2pd xmm0, xmm0
shr eax, 0x1f
addsd xmm0, qword [eax*8 + 0x100e0dd0]
mov eax, dword [0x101c976c]
cvtpd2ps xmm1, xmm0
movd xmm0, eax
cvtdq2pd xmm0, xmm0
shr eax, 0x1f
addsd xmm0, qword [eax*8 + 0x100e0dd0]
cvtpd2ps xmm0, xmm0
divss xmm1, xmm0
comiss xmm1, dword [0x101c9748]
jbe 0x10047bb0
call fcn.10048cd0
push edi
lea eax, [ebx + 8]
push eax
lea eax, [ebp - 0x1c]
push eax
call fcn.10048f30
mov ecx, dword [eax]
jmp 0x10047bb3
mov ecx, dword [ebp - 0x14]
push ebx
push ecx
push edi
call fcn.10048d50
add eax, 0xc
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x10048dc0
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1fffffff
sub esp, 0x10
bsr ecx, eax
push ebx
push esi
push edi
mov edi, 1
mov eax, edi
shl eax, cl
mov ecx, dword [ebp + 8]
cmp ecx, eax
jbe 0x10048dec
push str.invalid_hash_bucket_count
call dword [sym.imp.MSVCP140D.dll_void___cdecl_std::_Xlength_error_char_const__]
lea eax, [ecx - 1]
mov esi, dword [0x101c9750]
or eax, 1
mov dword [ebp - 8], esi
bsr ecx, eax
push esi
lea ecx, [ecx + 1]
shl edi, cl
mov ecx, 0x101c9758
lea eax, [edi + edi]
push eax
call fcn.10036390
mov eax, dword [0x101c9750]
lea ebx, [edi - 1]
mov dword [0x101c9768], ebx
mov dword [0x101c976c], edi
mov eax, dword [eax]
mov ecx, eax
cmp eax, esi
je 0x10048f26
movzx edx, byte [eax + 8]
xor edx, 0x811c9dc5
mov ecx, dword [ecx]
imul edi, edx, 0x1000193
movzx edx, byte [eax + 9]
xor edi, edx
movzx edx, byte [eax + 0xa]
imul edi, edi, 0x1000193
xor edi, edx
movzx edx, byte [eax + 0xb]
imul edi, edi, 0x1000193
xor edi, edx
mov edx, dword [0x101c975c]
imul edi, edi, 0x1000193
and edi, ebx
mov ebx, dword [edx + edi*8]
lea edx, [edx + edi*8]
mov dword [ebp - 0xc], edx
cmp ebx, esi
jne 0x10048e84
mov dword [edx], eax
mov dword [edx + 4], eax
jmp 0x10048ef1
mov edx, dword [edx + 4]
mov edi, dword [eax + 8]
cmp edi, dword [edx + 8]
jne 0x10048ebe
mov edx, dword [edx]
mov dword [ebp - 4], edx
cmp edx, eax
je 0x10048eb6
mov ebx, dword [eax + 4]
mov esi, dword [ebp - 4]
mov dword [ebx], ecx
mov edi, dword [ecx + 4]
mov dword [edi], edx
mov edx, dword [edx + 4]
mov dword [edx], eax
mov dword [esi + 4], edi
mov esi, dword [ebp - 8]
mov dword [ecx + 4], ebx
mov dword [eax + 4], edx
mov edx, dword [ebp - 0xc]
mov dword [edx + 4], eax
jmp 0x10048ef1
cmp ebx, edx
je 0x10048ece
mov edx, dword [edx + 4]
cmp edi, dword [edx + 8]
je 0x10048f02
cmp ebx, edx
jne 0x10048ec2
mov ebx, dword [eax + 4]
mov dword [ebp - 4], ebx
mov dword [ebx], ecx
mov ebx, dword [ecx + 4]
mov dword [ebx], edx
mov edi, dword [edx + 4]
mov dword [edi], eax
mov dword [edx + 4], ebx
mov edx, dword [ebp - 4]
mov dword [ecx + 4], edx
mov edx, dword [ebp - 0xc]
mov dword [eax + 4], edi
mov dword [edx], eax
mov eax, ecx
cmp ecx, esi
je 0x10048f26
mov ebx, dword [0x101c9768]
jmp 0x10048e32
mov ebx, dword [eax + 4]
mov edx, dword [edx]
mov dword [ebp - 4], edx
mov esi, edx
mov dword [ebx], ecx
mov edi, dword [ecx + 4]
mov dword [edi], edx
mov edx, dword [edx + 4]
mov dword [edx], eax
mov dword [esi + 4], edi
mov esi, dword [ebp - 8]
mov dword [ecx + 4], ebx
mov dword [eax + 4], edx
jmp 0x10048ef1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x10052ec0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100cb8e5
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
push ebx
push esi
push edi
mov eax, dword [0x100ed380]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x1c], edi
mov ebx, dword [edi + 4]
mov esi, dword [ebp + 8]
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x20], esi
mov ecx, dword [ebx + 4]
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x14], 0
cmp byte [ecx + 0xd], 0
jne 0x10052fa7
mov esi, ecx
lea edi, [esi + 0x10]
mov dword [ebp - 0x18], esi
push eax
mov ecx, edi
call fcn.1004ebe0
shr eax, 0x1f
test al, al
je 0x10052f89
mov ecx, dword [ebp - 0x10]
push edi
call fcn.1004ebe0
test eax, eax
jns 0x10052f7d
push str.invalid_comparator
push 0x100d5f90
push 0
push 0x5e1
push 0x100d6df8
push 2
call dword [sym.imp.ucrtbased.dll__CrtDbgReport]
add esp, 0x18
cmp eax, 1
jne 0x10052f5e
int3
push 0
push 0x5e1
push str.C:Program_FilesMicrosoft_Visual_Studio2022CommunityVCToolsMSVC14.40.33807includexutility
push 0x100d60c4
push str._invalid_comparator_
call dword [sym.imp.ucrtbased.dll__invalid_parameter]
add esp, 0x14
mov esi, dword [esi + 8]
mov dword [ebp - 0x14], 0
jmp 0x10052f94
mov ebx, esi
mov dword [ebp - 0x14], 1
mov esi, dword [esi]
cmp byte [esi + 0xd], 0
mov eax, dword [ebp - 0x10]
je 0x10052f15
mov esi, dword [ebp - 0x20]
mov edi, dword [ebp - 0x1c]
cmp byte [ebx + 0xd], 0
jne 0x10052fda
lea ecx, [ebx + 0x10]
mov edx, eax
push ecx
call fcn.100561f0
add esp, 4
test al, al
jne 0x10052fda
mov byte [esi + 4], al
mov eax, esi
mov dword [esi], ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
cmp dword [edi + 8], 0x3ffffff
je 0x1005305d
mov ebx, dword [edi + 4]
mov dword [ebp - 0x28], edi
mov dword [ebp - 4], 0
push 0x40
mov dword [ebp - 0x24], 0
call fcn.100c6d80
mov edi, eax
add esp, 4
mov dword [ebp - 0x24], edi
push dword [ebp - 0x10]
lea ecx, [edi + 0x10]
mov dword [ebp - 4], 1
call fcn.10027b30
push ecx
lea ecx, [edi + 0x30]
call fcn.1004ead0
mov ecx, dword [ebp - 0x1c]
push edi
push dword [ebp - 0x14]
mov dword [edi], ebx
push dword [ebp - 0x18]
mov dword [edi + 4], ebx
mov dword [edi + 8], ebx
mov word [edi + 0xc], 0
call fcn.10053240
mov ecx, dword [ebp - 0x20]
mov dword [ecx], eax
mov eax, ecx
mov byte [ecx + 4], 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
call fcn.10049bc0
int3
Function at 0x10058b40
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [0x100ed380]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov edi, dword fs:[0x30]
mov ebx, ecx
test edi, edi
jne 0x10058b73
xor al, al
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100c6d50
mov esp, ebp
pop ebp
ret
mov edi, dword [edi + 0xc]
add edi, 0x14
mov esi, dword [edi]
cmp esi, edi
je 0x10058bc5
mov ecx, 0x5a4d
lea edx, [esi - 8]
test edx, edx
je 0x10058bbf
mov eax, dword [edx + 0x18]
test eax, eax
je 0x10058bbf
cmp word [eax], cx
jne 0x10058bbf
mov ecx, dword [eax + 0x3c]
add ecx, eax
je 0x10058bba
cmp dword [ecx], 0x4550
jne 0x10058bba
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0x10]
mov dword [ebp - 8], ecx
mov ecx, ebx
push eax
mov dword [ebp - 0x10], edx
call fcn.1005f1d0
mov ecx, 0x5a4d
mov esi, dword [esi]
cmp esi, edi
jne 0x10058b84
mov eax, dword [ebx + 4]
cmp eax, dword [ebx + 8]
mov ecx, dword [ebp - 4]
pop edi
setne al
xor ecx, ebp
pop esi
pop ebx
call fcn.100c6d50
mov esp, ebp
pop ebp
ret
Function at 0x10059f20
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
cmp dword [eax + 0x18], 0xf
lea esi, [eax + 4]
mov edi, dword [eax + 0x14]
mov ebx, ecx
mov dword [ebp - 4], edx
jbe 0x10059f3d
mov esi, dword [esi]
xor ecx, ecx
mov edx, 0x811c9dc5
test edi, edi
je 0x10059f59
movzx eax, byte [esi + ecx]
inc ecx
xor eax, edx
imul edx, eax, 0x1000193
cmp ecx, edi
jb 0x10059f48
push edx
mov edx, dword [ebp - 4]
mov ecx, ebx
call fcn.10059810
add esp, 4
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x1005f080
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100cc7f5
mov eax, dword fs:[0]
push eax
sub esp, 0x18
push ebx
push esi
push edi
mov eax, dword [0x100ed380]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
movzx eax, byte [esi]
xor eax, 0x811c9dc5
imul ecx, eax, 0x1000193
movzx eax, byte [esi + 1]
xor ecx, eax
movzx eax, byte [esi + 2]
imul ecx, ecx, 0x1000193
xor ecx, eax
movzx eax, byte [esi + 3]
imul ecx, ecx, 0x1000193
xor ecx, eax
lea eax, [ebp - 0x18]
imul edi, ecx, 0x1000193
push edi
push esi
push eax
call fcn.10048f30
mov eax, dword [ebp - 0x14]
test eax, eax
jne 0x1005f1ab
cmp dword [0x101c9754], 0xfffffff
jne 0x1005f10a
push str.unordered_map_set_too_long
call dword [sym.imp.MSVCP140D.dll_void___cdecl_std::_Xlength_error_char_const__]
mov dword [ebp - 0x20], 0x101c974c
mov dword [ebp - 4], 0
push 0x10
mov dword [ebp - 0x1c], 0
call fcn.100c6d80
mov ebx, eax
add esp, 4
mov eax, dword [esi]
mov dword [ebp - 0x1c], ebx
mov dword [ebx + 8], eax
mov dword [ebx + 0xc], 0
mov dword [ebp - 4], 1
mov eax, dword [0x101c9754]
inc eax
movd xmm0, eax
cvtdq2pd xmm0, xmm0
shr eax, 0x1f
addsd xmm0, qword [eax*8 + 0x100e0dd0]
mov eax, dword [0x101c976c]
cvtpd2ps xmm1, xmm0
movd xmm0, eax
cvtdq2pd xmm0, xmm0
shr eax, 0x1f
addsd xmm0, qword [eax*8 + 0x100e0dd0]
cvtpd2ps xmm0, xmm0
divss xmm1, xmm0
comiss xmm1, dword [0x101c9748]
jbe 0x1005f1a0
call fcn.10048cd0
push edi
lea eax, [ebx + 8]
push eax
lea eax, [ebp - 0x20]
push eax
call fcn.10048f30
mov ecx, dword [eax]
jmp 0x1005f1a3
mov ecx, dword [ebp - 0x18]
push ebx
push ecx
push edi
call fcn.10048d50
add eax, 0xc
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x10060c00
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
lea eax, [ecx + 4]
cmp dword [ecx + 0x18], 0xf
push ebx
push esi
push edi
mov edi, edx
jbe 0x10060c16
mov eax, dword [eax]
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov esi, eax
test esi, esi
je 0x10060cd0
mov eax, 0x5a4d
cmp word [esi], ax
jne 0x10060cd0
mov eax, dword [esi + 0x3c]
cmp dword [eax + esi], 0x4550
jne 0x10060cd0
mov eax, dword [eax + esi + 0x50]
lea ecx, [edi + 4]
mov edi, dword [edi + 0x18]
add eax, esi
xor ebx, ebx
mov dword [ebp - 0x10], eax
mov dword [ebp - 8], ecx
mov edx, ecx
mov dword [ebp - 0xc], edi
cmp edi, 0xf
jbe 0x10060c65
mov edx, dword [ecx]
cmp esi, eax
jae 0x10060cd0
mov ecx, 0x3f3f
nop
mov al, byte [edx]
mov byte [ebp - 1], al
cmp al, 0x3f
je 0x10060cde
movzx ecx, al
sub al, 0x30
cmp al, 9
ja 0x10060c87
add ecx, 0xffffffd0
jmp 0x10060c8d
and ecx, 0xffffffdf
sub ecx, 0x37
mov al, byte [edx + 1]
movzx edi, al
sub al, 0x30
cmp al, 9
ja 0x10060c9e
add edi, 0xffffffd0
jmp 0x10060ca4
and edi, 0xffffffdf
sub edi, 0x37
movzx eax, byte [esi]
shl ecx, 4
or ecx, edi
cmp eax, ecx
je 0x10060cd9
test ebx, ebx
je 0x10060cc5
cmp dword [ebp - 0xc], 0xf
mov esi, ebx
mov ecx, dword [ebp - 8]
mov edx, ecx
jbe 0x10060cc3
mov edx, dword [ecx]
xor ebx, ebx
mov ecx, 0x3f3f
inc esi
cmp esi, dword [ebp - 0x10]
jb 0x10060c70
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
mov ecx, 0x3f3f
test ebx, ebx
mov eax, esi
cmovne eax, ebx
cmp byte [edx + 2], 0
mov ebx, eax
je 0x10060d09
cmp word [edx], cx
je 0x10060cfd
cmp byte [ebp - 1], 0x3f
mov eax, 2
je 0x10060d02
mov eax, 3
add edx, eax
cmp byte [edx], 0
jne 0x10060cca
pop edi
pop esi
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10064d60
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x98
mov eax, dword [0x100ed380]
xor eax, esp
mov dword [esp + 0x94], eax
mov eax, dword [ebp + 0x20]
lea edx, [esp]
movaps xmm0, xmmword [0x100e0d70]
mov ecx, eax
movups xmmword [esp + 0x3c], xmm0
shr ecx, 0x18
mov dword [esp + 0x7c], 0
mov dword [esp + 0x80], 0
mov dword [esp + 0x84], 0
movd xmm0, ecx
cvtdq2ps xmm0, xmm0
movzx ecx, al
mov dword [esp + 0x38], 0
mov dword [esp + 0x34], 0xffffffff
mov dword [esp], 0
mov dword [esp + 0x30], str.sprites_purplelaser1.vmt
movss dword [esp + 0x54], xmm0
movd xmm0, ecx
mov ecx, eax
cvtdq2ps xmm0, xmm0
shr ecx, 8
movzx ecx, cl
shr eax, 0x10
movzx eax, al
mov dword [esp + 0x2c], 0xffffffff
movss dword [esp + 0x64], xmm0
movd xmm0, ecx
cvtdq2ps xmm0, xmm0
mov ecx, dword [0x101c349c]
mov dword [esp + 0x4c], 0
mov dword [esp + 0x50], 0x40000000
mov dword [esp + 0x58], 0x3e4ccccd
mov dword [esp + 0x5c], 0
movss dword [esp + 0x68], xmm0
movd xmm0, eax
cvtdq2ps xmm0, xmm0
mov dword [esp + 0x60], 0
mov dword [esp + 0x74], 2
mov byte [esp + 0x70], 1
mov dword [esp + 0x78], 0
push edx
movss dword [esp + 0x70], xmm0
movss xmm0, dword [ebp + 8]
movss dword [esp + 0x18], xmm0
movss xmm0, dword [ebp + 0xc]
movss dword [esp + 0x1c], xmm0
movss xmm0, dword [ebp + 0x10]
movss dword [esp + 0x20], xmm0
movss xmm0, dword [ebp + 0x14]
movss dword [esp + 0x24], xmm0
movss xmm0, dword [ebp + 0x18]
movss dword [esp + 0x28], xmm0
movss xmm0, dword [ebp + 0x1c]
movss dword [esp + 0x2c], xmm0
mov eax, dword [ecx]
mov eax, dword [eax + 0x30]
call eax
mov edx, eax
test edx, edx
je 0x10064ebc
mov ecx, dword [0x101c349c]
push edx
mov eax, dword [ecx]
mov eax, dword [eax + 0x10]
call eax
mov ecx, dword [esp + 0x94]
xor ecx, esp
call fcn.100c6d50
mov esp, ebp
pop ebp
ret