joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100ae920
Capabilities:
Hash data using fnv

Disassembly:
sub esp, 0x1c
push ebx
push ebp
mov ebp, ecx
mov eax, 3
mov ecx, 0x1e
push esi
push edi
cmp byte [ebp + 0x18ac], 0
cmovne ecx, eax
mov eax, dword [ebp + 0x50]
mov dword [esp + 0x10], ecx
mov esi, dword [eax]
cmp esi, eax
je 0x100aea11
nop
mov ebx, dword [esi + 8]
cmp byte [ebx + 0x25], 0
je 0x100ae9ef
movzx edx, bl
mov ecx, esi
xor edx, 0x811c9dc5
imul edi, edx, 0x1000193
mov edx, ebx
shr edx, 8
movzx edx, dl
xor edi, edx
mov edx, ebx
imul edi, edi, 0x1000193
shr edx, 0x10
movzx edx, dl
xor edi, edx
mov edx, ebx
imul edi, edi, 0x1000193
shr edx, 0x18
xor edi, edx
imul edx, edi, 0x1000193
mov edi, dword [ebp + 0x64]
and edi, edx
mov edx, dword [ebp + 0x58]
cmp dword [edx + edi*8 + 4], esi
jne 0x100ae9c0
cmp dword [edx + edi*8], esi
jne 0x100ae9b7
mov dword [edx + edi*8], eax
mov dword [edx + edi*8 + 4], eax
jmp 0x100ae9ca
mov eax, dword [esi + 4]
mov dword [edx + edi*8 + 4], eax
jmp 0x100ae9ca
cmp dword [edx + edi*8], esi
jne 0x100ae9ca
mov eax, dword [esi]
mov dword [edx + edi*8], eax
mov esi, dword [ecx]
dec dword [ebp + 0x54]
mov eax, dword [ecx + 4]
push 0xc
push ecx
mov dword [eax], esi
mov eax, dword [ecx + 4]
mov dword [esi + 4], eax
call fcn.100cd0a2
mov eax, dword [ebx]
add esp, 8
mov ecx, ebx
push 1
call dword [eax]
jmp 0x100aea02
mov esi, dword [esi]
inc dword [ebx + 0x1c]
cmp dword [ebx + 0x1c], ecx
jle 0x100aea06
push ebx
lea ecx, [ebp + 0x4c]
call fcn.100b05e0
mov ecx, dword [esp + 0x10]
mov eax, dword [ebp + 0x50]
cmp esi, eax
jne 0x100ae950
lea edi, [ebp + 0x18b0]
mov byte [ebp + 0x18ac], 0
mov ecx, 2
mov dword [esp + 0x10], edi
mov dword [esp + 0x18], ecx
nop dword [eax + eax]
mov eax, dword [edi]
mov esi, edi
mov dword [esp + 0x14], esi
movzx eax, word [eax + 4]
mov word [esp + 0x20], ax
test ax, ax
je 0x100aeafa
nop word [eax + eax]
mov ecx, dword [esi]
movzx ebx, ax
mov ebp, dword [ecx + ebx*8]
mov ecx, dword [ebp + 0x1c]
test ecx, ecx
jle 0x100aea63
mov byte [ebp + 0x24], 0
inc ecx
mov dword [ebp + 0x1c], ecx
cmp ecx, 0x190
jle 0x100aeae1
mov esi, dword [edi]
movzx edx, word [esi + ebx*8 + 6]
lea edi, [esi + ebx*8]
mov ecx, dword [esp + 0x20]
mov dword [esp + 0x28], ecx
movzx ecx, word [edi + 4]
mov word [esi + edx*8 + 4], cx
movzx esi, word [edi + 4]
mov edx, dword [esp + 0x10]
movzx ecx, word [edi + 6]
mov edi, dword [esp + 0x10]
push 1
mov edx, dword [edx]
mov word [edx + esi*8 + 6], cx
mov ecx, 0xffff
add word [edi + 6], cx
mov ecx, dword [edi + 8]
movzx edx, word [edi + 6]
mov esi, dword [esp + 0x18]
mov dword [esp + 0x18], esi
mov word [ecx + edx*2], ax
mov ecx, ebp
mov eax, dword [esi]
movzx eax, word [eax + ebx*8 + 4]
mov word [esp + 0x2c], ax
mov eax, dword [esp + 0x2c]
mov dword [esp + 0x24], eax
mov eax, dword [ebp]
call dword [eax]
mov ax, word [esp + 0x20]
jmp 0x100aeaed
mov eax, dword [esi]
mov ax, word [eax + ebx*8 + 4]
mov word [esp + 0x20], ax
test ax, ax
jne 0x100aea50
mov ecx, dword [esp + 0x18]
add edi, 0xc
sub ecx, 1
mov dword [esp + 0x10], edi
mov dword [esp + 0x18], ecx
jne 0x100aea30
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x1c
ret
Function at 0x100af650
Capabilities:
Access peb ldr_data

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1016fec3
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ebx
sub esp, 8
mov eax, dword [ebx + 8]
push esi
mov esi, ecx
mov dword [ebp - 0x14], esi
or dword [esi + 0xc], 0x3fff
push edi
mov dword [esi + 4], eax
lea edi, [esi + 0xc]
mov eax, dword [ebx + 0x14]
mov dword [esi + 8], 0
mov dword [esi + 0x1c], 0
mov dword [esi + 0x20], eax
mov word [esi + 0x24], 0
mov dword [ebp - 4], 0
mov dword [esi], 0x1019d468
mov dword [esi + 0x30], 0
mov dword [esi + 0x34], 0
mov ecx, dword [ebx + 0xc]
xor eax, eax
cmp byte [ebx + 0x18], 0
mov byte [ebp - 4], 1
mov dword [esi + 0x38], 0
movd xmm0, eax
punpckldq xmm0, xmm0
movups xmmword [esi + 0x840], xmm0
mov word [esi + 0x850], ax
mov dword [esi + 0x854], eax
mov dword [esi + 0x858], eax
mov eax, dword [ecx]
mov dword [esi + 0x85c], eax
mov eax, dword [ecx + 4]
mov dword [esi + 0x860], eax
mov eax, dword [ecx]
mov dword [edi], eax
mov eax, dword [ecx + 4]
mov ecx, dword [ebx + 0x10]
mov dword [edi + 4], eax
mov eax, dword [ecx]
mov dword [esi + 0x14], eax
mov eax, dword [ecx + 4]
mov dword [esi + 0x18], eax
je 0x100af746
mov dword [esi + 0x28], 0
mov dword [esi + 0x2c], 0
mov byte [esi + 0x852], 0
jmp 0x100af86f
push 0x38
lea eax, [esi + 0x864]
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
lea eax, [esi + 0x3c]
push 0x800
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
push 0x20
push 0x30
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll__aligned_malloc]
mov dword [esi + 0x28], eax
add esp, 8
mov dword [esi + 0x2c], 0
mov edx, dword [edi]
mov eax, edx
and eax, 0xfc000
cmp eax, 0x8000
jae 0x100af818
mov eax, edx
and eax, 0x3f00000
cmp eax, 0x1300000
jne 0x100af7dd
and edx, 0x3c000000
cmp edx, 0x1c000000
ja 0x100af7d9
mov eax, dword [edi + 4]
mov ecx, dword [edi]
and eax, 3
and ecx, 0xc0000000
cmp eax, 1
ja 0x100af7d9
jb 0x100af80f
cmp ecx, 0x80000000
ja 0x100af7d9
mov byte [esi + 0x852], 0
jmp 0x100af854
mov al, 1
jmp 0x100af835
cmp eax, 0x1400000
jne 0x100af818
and edx, 0x3c000000
cmp edx, 0x1c000000
ja 0x100af7d9
mov eax, dword [edi + 4]
mov ecx, dword [edi]
and eax, 3
and ecx, 0xc0000000
cmp eax, 1
ja 0x100af7d9
jb 0x100af80f
cmp ecx, 0xc0000000
ja 0x100af7d9
mov byte [esi + 0x852], 0
jmp 0x100af854
mov ecx, edx
mov eax, 1
shr ecx, 0x1a
and ecx, 0xf
shr edx, 8
shl eax, cl
and edx, 0xfc0
cmp edx, eax
setb al
mov byte [esi + 0x852], al
test al, al
je 0x100af854
mov ecx, dword [ebx + 8]
push edi
lea ecx, [ecx + 0xa60]
call fcn.100640a0
mov dword [esi + 0x854], eax
mov eax, dword [esi + 4]
push edi
mov eax, dword [eax + 0x2f00]
mov ecx, dword [eax + 0xb8]
call fcn.100692f0
mov dword [esi + 0xc9c], eax
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop edi
mov dword fs:[0], ecx
pop esi
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret 0x14
Function at 0x100b05e0
Capabilities:
Hash data using fnv

Disassembly:
sub esp, 0x10
push ebx
mov ebx, dword [esp + 0x18]
movzx eax, bl
xor eax, 0x811c9dc5
mov dword [esp + 0x10], ebx
imul edx, eax, 0x1000193
mov eax, ebx
sar eax, 8
movzx eax, al
push esi
mov esi, ecx
xor edx, eax
mov eax, ebx
sar eax, 0x10
movzx eax, al
imul ecx, edx, 0x1000193
push edi
xor ecx, eax
mov eax, ebx
imul ecx, ecx, 0x1000193
sar eax, 0x18
movzx eax, al
xor ecx, eax
lea eax, [esp + 0x20]
imul edi, ecx, 0x1000193
mov ecx, esi
push edi
push eax
lea eax, [esp + 0x18]
push eax
call fcn.1006f3c0
mov edx, dword [eax + 4]
test edx, edx
je 0x100b0692
mov ecx, dword [esi + 0x18]
mov eax, dword [esi + 0xc]
and ecx, edi
lea ecx, [eax + ecx*8]
mov eax, dword [ecx]
cmp dword [ecx + 4], edx
jne 0x100b066f
cmp eax, edx
jne 0x100b0667
mov eax, dword [esi + 4]
mov dword [ecx], eax
mov dword [ecx + 4], eax
jmp 0x100b0677
mov eax, dword [edx + 4]
mov dword [ecx + 4], eax
jmp 0x100b0677
cmp eax, edx
jne 0x100b0677
mov eax, dword [edx]
mov dword [ecx], eax
mov ecx, dword [edx]
dec dword [esi + 8]
mov eax, dword [edx + 4]
push 0xc
push edx
mov dword [eax], ecx
mov eax, dword [edx + 4]
mov dword [ecx + 4], eax
call fcn.100cd0a2
add esp, 8
cmp byte [ebx + 0x850], 0
je 0x100b06f3
mov ecx, dword [ebx + 0xc]
shr ecx, 5
and ecx, 0x1ff
movzx ebx, word [ebx + ecx*2 + 0x89c]
lea eax, [ecx + ecx*2]
mov edx, dword [esi + eax*4 + 0x20]
lea edi, [esi + eax*4]
movzx ecx, word [edx + ebx*8 + 6]
lea esi, [edx + ebx*8]
movzx eax, word [esi + 4]
mov word [edx + ecx*8 + 4], ax
movzx edx, word [esi + 4]
mov ecx, dword [edi + 0x20]
movzx eax, word [esi + 6]
mov word [ecx + edx*8 + 6], ax
mov eax, 0xffff
add word [edi + 0x26], ax
movzx ecx, word [edi + 0x26]
mov eax, dword [edi + 0x28]
mov word [eax + ecx*2], bx
jmp 0x100b079c
xor ecx, ecx
add ebx, 0x89c
add esi, 0x20
mov dword [esp + 0x10], ecx
mov dword [esp + 0xc], ebx
mov dword [esp + 0x20], esi
push ebp
nop dword [eax + eax]
mov eax, dword [esp + 0x1c]
mov eax, dword [eax + 0xc9c]
mov eax, dword [ecx + eax]
test eax, eax
je 0x100b077a
bsf edx, eax
je 0x100b077a
movzx ebp, word [ebx + edx*2]
lea ecx, [edx + edx*2]
lea ebx, [esi + ecx*4]
mov esi, dword [ebx]
btc eax, edx
movzx edx, word [esi + ebp*8 + 6]
lea edi, [esi + ebp*8]
movzx ecx, word [edi + 4]
mov word [esi + edx*8 + 4], cx
movzx esi, word [edi + 4]
mov edx, dword [ebx]
movzx ecx, word [edi + 6]
mov word [edx + esi*8 + 6], cx
mov ecx, 0xffff
add word [ebx + 6], cx
movzx edx, word [ebx + 6]
mov ecx, dword [ebx + 8]
mov ebx, dword [esp + 0x10]
mov esi, dword [esp + 0x24]
mov word [ecx + edx*2], bp
bsf edx, eax
jne 0x100b0726
mov ecx, dword [esp + 0x14]
add ecx, 4
add esi, 0x180
add ebx, 0x40
mov dword [esp + 0x14], ecx
mov dword [esp + 0x24], esi
mov dword [esp + 0x10], ebx
cmp ecx, 0x40
jb 0x100b0710
pop ebp
mov ecx, dword [esp + 0x18]
pop edi
pop esi
pop ebx
mov eax, dword [ecx]
add esp, 0x10
mov dword [esp + 4], 1
jmp dword [eax]
Function at 0x100b0f90
Capabilities:
Hash data using fnv

Disassembly:
mov edx, dword [esp + 4]
sub esp, 0x14
push ebx
push ebp
mov ebp, dword [esp + 0x24]
mov ebx, ecx
cmp edx, ebp
je 0x100b10ff
mov eax, dword [ebx + 4]
mov dword [esp + 0x10], eax
mov eax, dword [edx + 4]
mov dword [esp + 0x24], eax
movzx eax, byte [edx + 8]
xor eax, 0x811c9dc5
imul ecx, eax, 0x1000193
movzx eax, byte [edx + 9]
push esi
push edi
mov edi, dword [ebx + 0xc]
mov esi, edx
xor ecx, eax
mov dword [esp + 0x20], edi
movzx eax, byte [edx + 0xa]
imul ecx, ecx, 0x1000193
xor ecx, eax
movzx eax, byte [edx + 0xb]
imul ecx, ecx, 0x1000193
xor ecx, eax
mov eax, dword [ebx + 0x18]
imul ecx, ecx, 0x1000193
and eax, ecx
mov ecx, dword [edi + eax*8]
mov dword [esp + 0x14], ecx
lea eax, [edi + eax*8]
mov dword [esp + 0x10], eax
mov eax, dword [eax + 4]
mov dword [esp + 0x1c], eax
nop dword [eax]
mov eax, esi
mov edi, esi
mov esi, dword [esi]
push 0xc
push eax
call fcn.100cd0a2
dec dword [ebx + 8]
add esp, 8
cmp edi, dword [esp + 0x1c]
je 0x100b1057
cmp esi, ebp
jne 0x100b1010
mov eax, dword [esp + 0x14]
cmp eax, dword [esp + 0x28]
jne 0x100b10f4
mov eax, dword [esp + 0x2c]
mov ecx, dword [esp + 0x10]
pop edi
mov dword [ecx], esi
mov dword [eax], esi
mov dword [esi + 4], eax
mov eax, ebp
pop esi
pop ebp
pop ebx
add esp, 0x14
ret 8
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x10]
cmp eax, dword [esp + 0x28]
jne 0x100b106d
mov eax, dword [esp + 0x18]
mov dword [ecx], eax
jmp 0x100b1071
mov eax, dword [esp + 0x2c]
mov dword [ecx + 4], eax
cmp esi, ebp
je 0x100b10f4
nop dword [eax]
movzx eax, byte [esi + 8]
xor eax, 0x811c9dc5
imul ecx, eax, 0x1000193
movzx eax, byte [esi + 9]
xor ecx, eax
movzx eax, byte [esi + 0xa]
imul ecx, ecx, 0x1000193
xor ecx, eax
movzx eax, byte [esi + 0xb]
imul ecx, ecx, 0x1000193
xor ecx, eax
imul eax, ecx, 0x1000193
mov ecx, dword [ebx + 0x18]
and ecx, eax
mov eax, dword [esp + 0x20]
lea eax, [eax + ecx*8]
mov dword [esp + 0x28], eax
mov eax, dword [eax + 4]
mov dword [esp + 0x1c], eax
nop word [eax + eax]
mov eax, esi
mov edi, esi
mov esi, dword [esi]
push 0xc
push eax
call fcn.100cd0a2
dec dword [ebx + 8]
add esp, 8
cmp edi, dword [esp + 0x1c]
je 0x100b1109
cmp esi, ebp
jne 0x100b10d0
mov eax, dword [esp + 0x28]
mov dword [eax], esi
mov eax, dword [esp + 0x2c]
pop edi
mov dword [eax], esi
mov dword [esi + 4], eax
pop esi
mov eax, ebp
pop ebp
pop ebx
add esp, 0x14
ret 8
mov eax, dword [esp + 0x28]
mov edx, dword [esp + 0x18]
mov dword [eax], edx
mov dword [eax + 4], edx
cmp esi, ebp
jne 0x100b1080
mov eax, dword [esp + 0x2c]
pop edi
mov dword [eax], esi
mov dword [esi + 4], eax
mov eax, ebp
pop esi
pop ebp
pop ebx
add esp, 0x14
ret 8
Function at 0x100b1470
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [esp + 4]
xor ecx, ecx
push ebx
push esi
push edi
movzx ebx, word [eax + 4]
xor edi, edi
mov esi, dword [eax]
mov eax, 0xe45b2797
cmp cx, bx
jae 0x100b15ae
nop
add eax, 0x58b1152d
movzx edx, di
add edi, 0x10
mov ecx, dword [esi + edx*4]
add ecx, 0x2015deb
xor eax, ecx
mov ecx, dword [esi + edx*4 + 4]
sub eax, 0x1ba4d869
add ecx, 0x2d6bccb
xor eax, ecx
mov ecx, dword [esi + edx*4 + 8]
sub eax, 0x25df543f
add ecx, 0x2264e8bb
xor eax, ecx
mov ecx, dword [esi + edx*4 + 0xc]
add eax, 0x2015deb
sub ecx, 0x2fe3183d
xor eax, ecx
mov ecx, dword [esi + edx*4 + 0x10]
add eax, 0x2e5bdbb7
sub ecx, 0x3b3d93e7
xor eax, ecx
mov ecx, dword [esi + edx*4 + 0x14]
sub eax, 0x10697ced
sub ecx, 0x66f901b
xor eax, ecx
mov ecx, dword [esi + edx*4 + 0x18]
sub eax, 0x316e16a7
sub ecx, 0x4a98da95
xor eax, ecx
mov ecx, dword [esi + edx*4 + 0x1c]
sub eax, 0x2fb67ba1
sub ecx, 0x32d8ce65
xor eax, ecx
mov ecx, dword [esi + edx*4 + 0x20]
sub eax, 0x336fab1d
sub ecx, 0x7ec81f9b
xor eax, ecx
mov ecx, dword [esi + edx*4 + 0x24]
add eax, 0x5da1770f
sub ecx, 0x353acfb1
xor eax, ecx
mov ecx, dword [esi + edx*4 + 0x28]
add eax, 0x3bc33467
add ecx, 0x4d19b597
xor eax, ecx
mov ecx, dword [esi + edx*4 + 0x2c]
add eax, 0x20dd6aed
sub ecx, 0x689d3549
xor eax, ecx
mov ecx, dword [esi + edx*4 + 0x30]
sub eax, 0x1f5a0385
add ecx, 0xa2121d3
xor eax, ecx
mov ecx, dword [esi + edx*4 + 0x34]
add eax, 0x3366e29f
sub ecx, 0x52bbbabb
xor eax, ecx
mov ecx, dword [esi + edx*4 + 0x38]
sub eax, 0x335f52e7
sub ecx, 0x39c6d13
xor eax, ecx
mov ecx, dword [esi + edx*4 + 0x3c]
sub eax, 0x60506cbd
sub ecx, 0x5de61e01
xor eax, ecx
cmp di, bx
jb 0x100b1490
pop edi
pop esi
pop ebx
ret 4
Function at 0x100b2b50
Capabilities:
Hash data using fnv

Disassembly:
sub esp, 0x10
push ebx
mov ebx, ecx
push esi
mov dword [esp + 0xc], ebx
mov eax, dword [ebx + 0xc]
mov esi, dword [eax]
cmp esi, eax
je 0x100b2ca3
push ebp
push edi
nop word [eax + eax]
mov edi, dword [esi + 8]
inc dword [edi + 0x24]
cmp dword [edi + 0x24], 0xa
jbe 0x100b2c96
movzx ecx, byte [esi + 8]
mov eax, esi
xor ecx, 0x811c9dc5
imul edx, ecx, 0x1000193
movzx ecx, byte [esi + 9]
xor edx, ecx
movzx ecx, byte [esi + 0xa]
imul edx, edx, 0x1000193
xor edx, ecx
movzx ecx, byte [esi + 0xb]
imul edx, edx, 0x1000193
xor edx, ecx
imul ecx, edx, 0x1000193
mov edx, dword [ebx + 0x20]
and edx, ecx
mov ecx, dword [ebx + 0x14]
lea edx, [ecx + edx*8]
mov ecx, dword [edx]
cmp dword [edx + 4], esi
jne 0x100b2bde
cmp ecx, esi
jne 0x100b2bd6
mov ecx, dword [ebx + 0xc]
mov dword [edx], ecx
mov dword [edx + 4], ecx
jmp 0x100b2be6
mov ecx, dword [esi + 4]
mov dword [edx + 4], ecx
jmp 0x100b2be6
cmp ecx, esi
jne 0x100b2be6
mov ecx, dword [esi]
mov dword [edx], ecx
mov esi, dword [eax]
dec dword [ebx + 0x10]
mov ecx, dword [eax + 4]
push 0xc
push eax
mov dword [esp + 0x24], esi
mov dword [ecx], esi
mov ecx, dword [eax + 4]
mov dword [esi + 4], ecx
call fcn.100cd0a2
mov ecx, dword [edi + 0xc70]
add esp, 8
mov dword [esp + 0x10], ecx
mov ecx, dword [ecx]
cmp ecx, 0xffffffff
je 0x100b2c8c
mov esi, dword [esp + 0x14]
nop word [eax + eax]
lea eax, [ecx + ecx*2]
mov edx, dword [esi + eax*4 + 0x28]
lea ebp, [esi + eax*4]
movzx eax, word [edi + ecx*2 + 0x830]
mov dword [esp + 0x18], eax
movzx eax, ax
movzx ecx, word [edx + eax*8 + 6]
lea ebx, [edx + eax*8]
movzx eax, word [ebx + 4]
mov word [edx + ecx*8 + 4], ax
movzx edx, word [ebx + 4]
mov ecx, dword [ebp + 0x28]
movzx eax, word [ebx + 6]
mov word [ecx + edx*8 + 6], ax
mov eax, 0xffff
add word [ebp + 0x2e], ax
movzx ecx, word [ebp + 0x2e]
mov eax, dword [ebp + 0x30]
mov edx, dword [esp + 0x18]
mov word [eax + ecx*2], dx
mov eax, dword [esp + 0x10]
add eax, 4
mov dword [esp + 0x10], eax
mov ecx, dword [eax]
cmp ecx, 0xffffffff
jne 0x100b2c20
mov esi, dword [esp + 0x1c]
mov ebx, dword [esp + 0x14]
mov eax, dword [edi]
mov ecx, edi
push 1
call dword [eax]
jmp 0x100b2c98
mov esi, dword [esi]
cmp esi, dword [ebx + 0xc]
jne 0x100b2b70
pop edi
pop ebp
pop esi
pop ebx
add esp, 0x10
ret
Function at 0x100b4de0
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10170040
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x10
push ebx
mov ebx, dword [ebp + 0xc]
push esi
push edi
mov edi, ecx
movzx eax, byte [ebx]
xor eax, 0x811c9dc5
imul edx, eax, 0x1000193
movzx eax, byte [ebx + 1]
xor edx, eax
movzx eax, byte [ebx + 2]
imul edx, edx, 0x1000193
xor edx, eax
movzx eax, byte [ebx + 3]
imul ecx, edx, 0x1000193
xor ecx, eax
imul eax, ecx, 0x1000193
mov ecx, edi
push eax
mov dword [ebp + 0xc], eax
lea eax, [ebp - 0x14]
push ebx
push eax
call fcn.1006f3c0
mov ecx, dword [ebp - 0x10]
test ecx, ecx
je 0x100b4e68
mov eax, dword [ebp + 8]
mov dword [eax], ecx
mov byte [eax + 4], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
cmp dword [edi + 8], 0xfffffff
jne 0x100b4e7c
push str.unordered_map_set_too_long
call dword [sym.imp.MSVCP140.dll_void___cdecl_std::_Xlength_error_char_const__]
lea eax, [edi + 4]
mov dword [ebp - 0x1c], eax
mov dword [ebp - 4], 0
push 0x10
mov dword [ebp - 0x18], 0
call fcn.100cd0b0
mov ecx, dword [ebx]
mov esi, eax
add esp, 4
mov dword [ebp - 0x18], esi
mov dword [esi + 8], ecx
mov dword [esi + 0xc], 0
mov dword [ebp - 4], 1
mov ecx, dword [edi + 8]
mov ebx, dword [edi + 0x1c]
movss xmm3, dword [edi]
lea eax, [ecx + 1]
movd xmm0, eax
cvtdq2pd xmm0, xmm0
shr eax, 0x1f
addsd xmm0, qword [eax*8 + 0x101a5340]
mov eax, ebx
shr eax, 0x1f
cvtpd2ps xmm2, xmm0
movd xmm0, ebx
cvtdq2pd xmm0, xmm0
movaps xmm1, xmm2
addsd xmm0, qword [eax*8 + 0x101a5340]
cvtpd2ps xmm0, xmm0
divss xmm1, xmm0
comiss xmm1, xmm3
seta al
test al, al
je 0x100b4f69
divss xmm2, xmm3
sub esp, 8
movss dword [ebp - 0x10], xmm2
fld dword [ebp - 0x10]
fstp qword [esp]
call sub.api_ms_win_crt_math_l1_1_0.dll_ceil
add esp, 8
fstp dword [ebp - 0x10]
movss xmm0, dword [ebp - 0x10]
call fcn.1016c380
mov ecx, 8
cmp eax, ecx
cmova ecx, eax
cmp ebx, ecx
jae 0x100b4f48
cmp ebx, 0x200
jae 0x100b4f46
shl ebx, 3
cmp ebx, ecx
jae 0x100b4f48
mov ebx, ecx
push ebx
mov ecx, edi
call fcn.10043690
push dword [ebp + 0xc]
lea eax, [esi + 8]
mov ecx, edi
push eax
lea eax, [ebp - 0x14]
push eax
call fcn.1006f3c0
mov ecx, dword [edi + 8]
mov edx, dword [eax]
jmp 0x100b4f6c
mov edx, dword [ebp - 0x14]
mov ebx, dword [edx + 4]
lea eax, [ecx + 1]
mov dword [edi + 8], eax
mov dword [esi], edx
mov dword [esi + 4], ebx
mov dword [ebx], esi
mov dword [edx + 4], esi
mov eax, dword [edi + 0x18]
and eax, dword [ebp + 0xc]
mov ecx, dword [edi + 0xc]
mov esi, dword [ebp - 0x1c]
mov edi, dword [ecx + eax*8]
cmp edi, dword [esi]
mov esi, dword [ebp - 0x18]
jne 0x100b4f9a
mov dword [ecx + eax*8], esi
jmp 0x100b4fa9
cmp edi, edx
jne 0x100b4fa3
mov dword [ecx + eax*8], esi
jmp 0x100b4fad
cmp dword [ecx + eax*8 + 4], ebx
jne 0x100b4fad
mov dword [ecx + eax*8 + 4], esi
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
pop edi
mov dword [eax], esi
pop esi
mov byte [eax + 4], 1
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x100b51a0
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10170080
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x10
push ebx
mov ebx, dword [ebp + 0xc]
push esi
push edi
mov edi, ecx
movzx eax, byte [ebx]
xor eax, 0x811c9dc5
imul edx, eax, 0x1000193
movzx eax, byte [ebx + 1]
xor edx, eax
movzx eax, byte [ebx + 2]
imul edx, edx, 0x1000193
xor edx, eax
movzx eax, byte [ebx + 3]
imul ecx, edx, 0x1000193
xor ecx, eax
imul eax, ecx, 0x1000193
mov ecx, edi
push eax
mov dword [ebp + 0xc], eax
lea eax, [ebp - 0x14]
push ebx
push eax
call fcn.1006f3c0
mov ecx, dword [ebp - 0x10]
test ecx, ecx
je 0x100b5228
mov eax, dword [ebp + 8]
mov dword [eax], ecx
mov byte [eax + 4], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
cmp dword [edi + 8], 0xccccccc
jne 0x100b523c
push str.unordered_map_set_too_long
call dword [sym.imp.MSVCP140.dll_void___cdecl_std::_Xlength_error_char_const__]
lea eax, [edi + 4]
mov dword [ebp - 0x1c], eax
mov dword [ebp - 4], 0
push 0x14
mov dword [ebp - 0x18], 0
call fcn.100cd0b0
mov ecx, dword [ebx]
mov esi, eax
xorps xmm0, xmm0
mov dword [ebp - 0x18], esi
add esp, 4
mov dword [esi + 8], ecx
movq qword [esi + 0xc], xmm0
mov dword [esi + 0x10], 0
mov dword [ebp - 4], 1
mov ecx, dword [edi + 8]
mov ebx, dword [edi + 0x1c]
movss xmm3, dword [edi]
lea eax, [ecx + 1]
movd xmm0, eax
cvtdq2pd xmm0, xmm0
shr eax, 0x1f
addsd xmm0, qword [eax*8 + 0x101a5340]
mov eax, ebx
shr eax, 0x1f
cvtpd2ps xmm2, xmm0
movd xmm0, ebx
cvtdq2pd xmm0, xmm0
movaps xmm1, xmm2
addsd xmm0, qword [eax*8 + 0x101a5340]
cvtpd2ps xmm0, xmm0
divss xmm1, xmm0
comiss xmm1, xmm3
seta al
test al, al
je 0x100b5331
divss xmm2, xmm3
sub esp, 8
movss dword [ebp - 0x10], xmm2
fld dword [ebp - 0x10]
fstp qword [esp]
call sub.api_ms_win_crt_math_l1_1_0.dll_ceil
add esp, 8
fstp dword [ebp - 0x10]
movss xmm0, dword [ebp - 0x10]
call fcn.1016c380
mov ecx, 8
cmp eax, ecx
cmova ecx, eax
cmp ebx, ecx
jae 0x100b5310
cmp ebx, 0x200
jae 0x100b530e
shl ebx, 3
cmp ebx, ecx
jae 0x100b5310
mov ebx, ecx
push ebx
mov ecx, edi
call fcn.10043690
push dword [ebp + 0xc]
lea eax, [esi + 8]
mov ecx, edi
push eax
lea eax, [ebp - 0x14]
push eax
call fcn.1006f3c0
mov ecx, dword [edi + 8]
mov edx, dword [eax]
jmp 0x100b5334
mov edx, dword [ebp - 0x14]
mov ebx, dword [edx + 4]
lea eax, [ecx + 1]
mov dword [edi + 8], eax
mov dword [esi], edx
mov dword [esi + 4], ebx
mov dword [ebx], esi
mov dword [edx + 4], esi
mov eax, dword [edi + 0x18]
and eax, dword [ebp + 0xc]
mov ecx, dword [edi + 0xc]
mov esi, dword [ebp - 0x1c]
mov edi, dword [ecx + eax*8]
cmp edi, dword [esi]
mov esi, dword [ebp - 0x18]
jne 0x100b5362
mov dword [ecx + eax*8], esi
jmp 0x100b5371
cmp edi, edx
jne 0x100b536b
mov dword [ecx + eax*8], esi
jmp 0x100b5375
cmp dword [ecx + eax*8 + 4], ebx
jne 0x100b5375
mov dword [ecx + eax*8 + 4], esi
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
pop edi
mov dword [eax], esi
pop esi
mov byte [eax + 4], 1
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x100b57b0
Capabilities:
Create process on windows

Disassembly:
push ecx
call fcn.1002b0a0
test al, al
je 0x100b57e2
mov eax, dword [0x101b8c04]
mov dword [0x101b8c00], 0
test eax, eax
je 0x100b57d4
push eax
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov dword [0x101b8c04], 0
mov al, 1
pop ecx
ret
call fcn.1002a9c0
test al, al
jne 0x100b5829
push str.Cannot_find_d3dcompiler_43.dll_n
call fcn.10021eb0
add esp, 4
push 4
push 0x1017573c
push str.You_need_to_update_some_DirectX_libraries__would_you_like_to_do_it_now_
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
cmp eax, 6
jne 0x100b5829
push 1
push 0
push 0
push str.https:__www.microsoft.com_en_us_download_details.aspx_id8109
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
xor al, al
pop ecx
ret
Function at 0x100c0050
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov ecx, dword [0x107646dc]
jmp fcn.100ca750

Function at 0x100c0060
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov ecx, dword [0x107646dc]
rdtsc
mov dword [ecx + 0x820], eax
mov eax, dword [ecx + 0x700]
or eax, dword [ecx + 0x704]
mov dword [ecx + 0x824], edx
jne 0x100c0096
mov eax, dword [ecx + 0x820]
mov dword [ecx + 0x700], eax
mov eax, edx
mov dword [ecx + 0x704], eax
mov eax, dword [ecx + 0x460]
push esi
mov esi, eax
and eax, 0x7fffffff
shr esi, 0x1f
not esi
shl esi, 0x1f
or esi, eax
mov dword [ecx + 0x460], esi
test edx, edx
ja 0x100c00c1
cmp dword [ecx + 0x820], 0
jbe 0x100c00ef
rdtsc
sub eax, dword [ecx + 0x820]
mov dword [ecx + 0x820], 0
sbb edx, dword [ecx + 0x824]
add dword [ecx + 0x790], eax
mov dword [ecx + 0x824], 0
adc dword [ecx + 0x794], edx
mov eax, esi
pop esi
ret