joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1003a020
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10385229
mov eax, dword fs:[0]
push eax
sub esp, 0x38
push ebx
push esi
push edi
mov eax, dword [0x10444724]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
push 0
lea ecx, [ebp - 0x44]
mov dword [ebp - 4], 0
call fcn.10012240
mov edi, eax
push 0x10
mov byte [ebp - 4], 1
call fcn.1037dfb9
mov esi, eax
lea edx, [ebx + 0x30]
mov dword [ebp - 0x14], esi
lea ecx, [ebx + 8]
mov dword [esi + 4], 1
mov dword [esi], vtable.LottieImageProvider.0
mov dword [esi + 8], ecx
mov dword [esi + 0xc], edx
mov eax, esp
mov byte [ebp - 4], 2
mov ecx, edi
mov dword [ebp - 0x14], 0
mov dword [eax], esi
call fcn.10014940
mov ecx, dword [ebp + 8]
mov edi, eax
mov esi, dword [ecx + 4]
lea ecx, [ebp + 8]
call dword [sym.imp.Qt5Core.dll_public:_char____thiscall_QByteArray::data_void_]
push esi
push eax
lea eax, [ebp - 0x10]
mov ecx, edi
push eax
call fcn.10013640
mov edx, dword [ebx]
or edi, 0xffffffff
mov ecx, dword [eax]
mov dword [eax], 0
mov esi, dword [edx + 8]
mov dword [edx + 8], ecx
test esi, esi
je 0x1003a0ee
mov eax, edi
lock xadd dword [esi], eax
cmp eax, 1
jne 0x1003a0ee
mov ecx, esi
call sym.skottie.dll_public:_void___thiscall_skottie::Animation::destructor_void_
push 0x48
push esi
call fcn.1037dfe9
add esp, 8
mov esi, dword [ebp - 0x10]
test esi, esi
je 0x1003a110
lock xadd dword [esi], edi
cmp edi, 1
jne 0x1003a110
mov ecx, esi
call sym.skottie.dll_public:_void___thiscall_skottie::Animation::destructor_void_
push 0x48
push esi
call fcn.1037dfe9
add esp, 8
lea ecx, [ebp - 0x44]
call fcn.100125b0
lea ecx, [ebp + 8]
call dword [sym.imp.Qt5Core.dll_public:_void___thiscall_QByteArray::destructor_void_]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x1003a9d0
Capabilities:
Print debug messages

Disassembly:
sub esp, 0x808
mov eax, dword [0x10444724]
xor eax, esp
mov dword [esp + 0x804], eax
push ebp
push esi
push edi
mov edi, dword [esp + 0x818]
push 2
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov esi, eax
call fcn.10014b00
mov ebp, eax
lea eax, [esp + 0x820]
push eax
push 0
push edi
push esi
push dword [ebp + 4]
push dword [ebp]
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___stdio_common_vfprintf]
push 2
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fflush]
lea eax, [esp + 0x840]
push eax
push 0
push dword [esp + 0x844]
lea eax, [esp + 0x3c]
push 0x800
push eax
mov eax, dword [ebp]
push dword [ebp + 4]
or eax, 2
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___stdio_common_vsprintf]
add esp, 0x40
lea eax, [esp + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov ecx, dword [esp + 0x810]
pop edi
pop esi
pop ebp
xor ecx, esp
call fcn.1037e005
add esp, 0x808
ret
Function at 0x100423b0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x28
mov eax, dword [0x10444724]
xor eax, esp
mov dword [esp + 0x24], eax
push ebx
push ebp
push esi
mov esi, dword [esp + 0x3c]
push edi
mov edi, dword [esp + 0x3c]
cmp byte [esi + 0x78], 0
je 0x100424e1
cmp byte [esi + 0x14], 0
je 0x100424e1
call fcn.1009a800
push eax
push esi
call fcn.10099050
add esp, 8
test al, al
je 0x1004241a
call fcn.10042d20
test eax, eax
je 0x10042403
mov ecx, 1
lock xadd dword [eax], ecx
mov dword [edi], eax
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x24]
xor ecx, esp
call fcn.1037e005
add esp, 0x28
ret
lea eax, [esp + 0x10]
push eax
lea ebx, [esi + 0x7c]
push ebx
call fcn.10099310
add esp, 8
test al, al
je 0x100424e1
cmp dword [esi + 0x18], 0
jne 0x100424aa
cmp dword [esi + 0x38], 0
jne 0x100424aa
cmp dword [esi + 0x58], 0
jne 0x100424aa
lea edx, [esi + 0x1c]
mov ebp, 0x18
lea ebx, [esi + 0x3c]
mov ecx, edx
mov eax, dword [ecx]
cmp eax, dword [ebx]
jne 0x100424a7
add ecx, 4
add ebx, 4
sub ebp, 4
jae 0x10042452
lea ecx, [esi + 0x5c]
mov ebx, 0x18
nop dword [eax + eax]
mov eax, dword [edx]
cmp eax, dword [ecx]
jne 0x100424a7
add edx, 4
add ecx, 4
sub ebx, 4
jae 0x10042470
lea eax, [esi + 0x7c]
push eax
lea eax, [esi + 0x1c]
push eax
push edi
call fcn.10042500
add esp, 0xc
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x24]
xor ecx, esp
call fcn.1037e005
add esp, 0x28
ret
lea ebx, [esi + 0x7c]
call fcn.1009a7f0
push eax
push esi
call fcn.10099680
add esp, 8
test al, al
je 0x100424e1
push ebx
push 0x103885b0
push edi
call fcn.10042500
add esp, 0xc
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x24]
xor ecx, esp
call fcn.1037e005
add esp, 0x28
ret
mov ecx, dword [esp + 0x34]
mov eax, edi
mov dword [edi], 0
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.1037e005
add esp, 0x28
ret
Function at 0x1004fba0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push esi
push edi
push 0x80
call fcn.100afd90
mov esi, eax
add esp, 4
test esi, esi
je 0x1004fcae
mov ecx, dword [esp + 0x10]
mov edi, dword [esp + 0x14]
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov eax, dword [ecx + 0xc]
and eax, 7
test edi, edi
je 0x1004fbde
and eax, dword [edi + 0xc]
mov dword [esi + 0xc], eax
lea eax, [esi + 0x28]
mov dword [esi], 0x10388848
mov dword [esi + 4], 0x3c
mov dword [esi + 8], 0
mov dword [esi + 0x10], 0
movzx edx, byte [esi + 0x24]
mov dword [esi + 0x1c], 0
and dl, 0xfd
mov dword [esi + 0x18], 0
and dl, 0xfe
mov byte [esi + 0x24], dl
mov dword [esi + 0x20], 4
mov dword [esi + 0x18], eax
lea eax, [esi + 0x48]
movzx edx, byte [esi + 0x44]
movss xmm0, dword [esp + 0x18]
and dl, 0xfd
mov dword [esi + 0x3c], 0
and dl, 0xfe
mov dword [esi + 0x38], 0
mov dword [esi + 0x40], 1
mov byte [esi + 0x44], dl
mov dword [esi + 0x38], eax
mov dword [esi + 0x50], 0
mov dword [esi + 0x54], 0
mov dword [esi + 0x68], 0
mov dword [esi + 0x6c], 0xf
mov byte [esi + 0x58], 0
mov eax, dword [esi + 0x3c]
push ecx
mov dword [esi + 0x70], eax
mov eax, esp
mov dword [esi], 0x10388904
mov dword [esi + 0x74], 0xffffffff
movss dword [esi + 0x78], xmm0
mov dword [eax], ecx
mov ecx, esi
call fcn.100b1800
test edi, edi
je 0x1004fcb0
mov eax, dword [esi + 0x3c]
push ecx
mov dword [esi + 0x74], eax
mov ecx, esi
mov eax, esp
mov dword [eax], edi
call fcn.100b1800
jmp 0x1004fcb0
xor esi, esi
mov edi, dword [esp + 0xc]
mov ecx, dword [esp + 0x10]
mov dword [edi], esi
test ecx, ecx
je 0x1004fcc4
mov eax, dword [ecx]
push 1
call dword [eax]
mov ecx, dword [esp + 0x14]
test ecx, ecx
je 0x1004fcd2
mov edx, dword [ecx]
push 1
call dword [edx]
mov eax, edi
pop edi
pop esi
ret
Function at 0x10081d30
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
sub esp, 0xc
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0x24]
mov ebp, ecx
mov esi, edi
cmp dword [edi + 0x14], 0x10
mov ebx, dword [edi + 0x10]
jb 0x10081d4a
mov esi, dword [edi]
xor ecx, ecx
mov edx, 0x811c9dc5
test ebx, ebx
je 0x10081d66
movzx eax, byte [ecx + esi]
inc ecx
xor eax, edx
imul edx, eax, 0x1000193
cmp ecx, ebx
jb 0x10081d55
mov ebx, dword [ebp + 0x18]
lea eax, [ebp + 4]
mov ecx, dword [ebp + 0xc]
and ebx, edx
mov esi, dword [eax]
mov dword [esp + 0x24], eax
mov eax, dword [ecx + ebx*8]
cmp esi, eax
je 0x10081da2
mov esi, dword [ecx + ebx*8 + 4]
mov esi, dword [esi]
cmp esi, eax
je 0x10081da2
mov esi, dword [esi + 4]
mov ecx, edi
lea eax, [esi + 8]
push eax
call fcn.101177c0
test al, al
jne 0x10081de8
mov ecx, dword [ebp + 0xc]
cmp esi, dword [ecx + ebx*8]
jne 0x10081d88
mov edi, dword [esp + 0x28]
mov dword [esp + 0x10], edi
mov eax, dword [edi]
cmp esi, eax
je 0x10081dd4
mov ecx, dword [edi + 4]
mov dword [ecx], eax
mov ecx, dword [eax + 4]
mov dword [ecx], esi
mov ecx, dword [esi + 4]
mov dword [ecx], edi
mov ecx, dword [eax + 4]
mov edx, dword [esi + 4]
mov dword [esi + 4], ecx
mov ecx, dword [edi + 4]
mov dword [eax + 4], ecx
mov dword [edi + 4], edx
mov ecx, dword [ebp + 0xc]
mov eax, dword [ecx + ebx*8]
cmp eax, dword [ebp + 4]
jne 0x10081e1e
mov dword [ecx + ebx*8], edi
mov eax, dword [ebp + 0xc]
mov dword [eax + ebx*8 + 4], edi
jmp 0x10081e43
mov edi, dword [esp + 0x28]
push edi
mov edx, dword [edi + 4]
mov eax, dword [edi]
mov dword [edx], eax
mov edx, dword [edi]
mov eax, dword [edi + 4]
mov dword [edx + 4], eax
mov eax, dword [esp + 0x28]
mov ecx, eax
dec dword [eax + 4]
call fcn.100844c0
mov eax, dword [esp + 0x20]
pop edi
mov dword [eax], esi
pop esi
pop ebp
mov byte [eax + 4], 0
pop ebx
add esp, 0xc
ret 0xc
cmp eax, esi
jne 0x10081e27
mov dword [ecx + ebx*8], edi
jmp 0x10081e43
mov eax, dword [ecx + ebx*8 + 4]
mov eax, dword [eax]
mov dword [ecx + ebx*8 + 4], eax
cmp eax, edi
je 0x10081e43
mov ecx, dword [ebp + 0xc]
mov eax, dword [ecx + ebx*8 + 4]
mov eax, dword [eax + 4]
mov dword [ecx + ebx*8 + 4], eax
mov eax, dword [ebp + 8]
mov ecx, dword [ebp + 0x1c]
movd xmm0, eax
cvtdq2pd xmm0, xmm0
shr eax, 0x1f
addsd xmm0, qword [eax*8 + 0x10386860]
mov eax, ecx
shr eax, 0x1f
cvtpd2ps xmm1, xmm0
movd xmm0, ecx
cvtdq2pd xmm0, xmm0
addsd xmm0, qword [eax*8 + 0x10386860]
cvtpd2ps xmm0, xmm0
divss xmm1, xmm0
comiss xmm1, dword [ebp]
jbe 0x10081ed3
cmp ecx, 0x200
jae 0x10081e92
shl ecx, 3
jmp 0x10081e9c
cmp ecx, 0x1fffffff
jae 0x10081e9c
add ecx, ecx
push ecx
mov ecx, ebp
call fcn.10084520
mov eax, dword [ebp + 4]
lea ecx, [ebp + 4]
cmp dword [eax], eax
je 0x10081ed3
mov eax, dword [eax + 4]
mov edi, eax
mov esi, dword [ecx]
mov ecx, ebp
mov esi, dword [esi]
push esi
lea eax, [esi + 8]
push eax
lea eax, [esp + 0x1c]
push eax
call fcn.10081d30
lea ecx, [ebp + 4]
cmp esi, edi
jne 0x10081eb3
mov edi, dword [esp + 0x10]
mov eax, dword [esp + 0x20]
mov dword [eax], edi
pop edi
pop esi
pop ebp
mov byte [eax + 4], 1
pop ebx
add esp, 0xc
ret 0xc
Function at 0x1009fc20
Capabilities:
Hash data using murmur3

Disassembly:
sub esp, 0x18
push ebx
mov ebx, ecx
push ebp
push esi
lea ebp, [ebx + 8]
mov dword [esp + 0x10], ebx
mov eax, dword [ebx + 4]
xor esi, esi
push edi
mov edi, dword [esp + 0x2c]
mov dword [esp + 0x10], eax
mov dword [ebx], 0
mov dword [ebx + 4], edi
mov eax, dword [ebp]
mov dword [esp + 0x18], eax
xor eax, eax
mov dword [esp + 0x1c], ebp
mov dword [ebp], 0
test edi, edi
je 0x1009fc9e
xor ecx, ecx
mov eax, edi
mov edx, 0xc
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.1037e0f1
mov esi, eax
add esp, 4
test esi, esi
je 0x1009fc9a
mov ebx, esi
test edi, edi
je 0x1009fc94
mov ecx, ebx
call fcn.1000cac0
add ebx, 0xc
sub edi, 1
jne 0x1009fc85
mov ebx, dword [esp + 0x14]
jmp 0x1009fc9c
xor esi, esi
mov eax, esi
lea ecx, [esp + 0x24]
cmp ebp, ecx
je 0x1009fcb3
mov ecx, dword [ebp]
mov dword [ebp], eax
test ecx, ecx
je 0x1009fcc0
push ecx
jmp 0x1009fcb8
test eax, eax
je 0x1009fcc0
push esi
call fcn.100550c0
add esp, 4
cmp dword [esp + 0x10], 0
jle 0x1009fd78
mov edi, dword [esp + 0x18]
mov eax, dword [esp + 0x10]
cmp dword [edi + 8], 0
je 0x1009fd68
mov eax, dword [edi]
mov ebp, 1
shr eax, 0x10
xor eax, dword [edi]
imul ecx, eax, 0x85ebca6b
mov ebx, dword [ebx + 4]
mov eax, ecx
shr eax, 0xd
xor eax, ecx
imul edx, eax, 0xc2b2ae35
mov ecx, edx
shr ecx, 0x10
mov eax, ecx
xor eax, edx
cmp ecx, edx
cmovne ebp, eax
lea eax, [ebx - 1]
and eax, ebp
mov dword [esp + 0x2c], ebp
xor edx, edx
test ebx, ebx
jle 0x1009fd60
mov ecx, dword [esp + 0x1c]
mov esi, dword [ecx]
mov dword [esp + 0x20], esi
lea ecx, [eax + eax*2]
mov ebp, eax
lea ecx, [esi + ecx*4]
mov esi, dword [ecx + 8]
test esi, esi
je 0x1009fd93
cmp dword [esp + 0x2c], esi
jne 0x1009fd41
mov esi, dword [edi]
cmp esi, dword [ecx]
je 0x1009fd56
add eax, 0xffffffff
jns 0x1009fd4b
lea eax, [ebp - 1]
add eax, ebx
inc edx
cmp edx, ebx
jge 0x1009fd60
mov esi, dword [esp + 0x20]
jmp 0x1009fd26
mov eax, esi
mov dword [ecx], eax
mov eax, dword [edi + 4]
mov dword [ecx + 4], eax
mov ebx, dword [esp + 0x14]
mov eax, dword [esp + 0x10]
add edi, 0xc
sub eax, 1
mov dword [esp + 0x10], eax
jne 0x1009fcd3
mov eax, dword [esp + 0x18]
pop edi
pop esi
pop ebp
pop ebx
test eax, eax
je 0x1009fd8d
push eax
call fcn.100550c0
add esp, 4
add esp, 0x18
ret 4
mov eax, dword [edi]
mov ebx, dword [esp + 0x14]
mov dword [ecx], eax
mov eax, dword [edi + 4]
mov dword [ecx + 4], eax
mov eax, dword [esp + 0x2c]
mov dword [ecx + 8], eax
inc dword [ebx]
jmp 0x1009fd64
Function at 0x100b7fc0
Capabilities:
Get file size
Read file via mapping

Disassembly:
sub esp, 8
push dword [esp + 0xc]
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll__fileno]
add esp, 4
test eax, eax
jns 0x100b7fda
xor eax, eax
add esp, 8
ret
push esi
push edi
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll__get_osfhandle]
mov esi, eax
add esp, 4
cmp esi, 0xffffffff
je 0x100b8020
lea eax, [esp + 8]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
je 0x100b8020
xor ecx, ecx
cmp ecx, dword [esp + 0xc]
jne 0x100b8020
push ecx
push ecx
push ecx
push 2
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_CreateFileMappingA]
mov esi, eax
push 0
test esi, esi
jne 0x100b802a
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor edi, edi
mov eax, edi
pop edi
pop esi
add esp, 8
ret
push 0
push 0
push 4
push esi
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov edi, eax
push esi
test edi, edi
je 0x100b801a
mov ecx, dword [esp + 0x1c]
mov eax, dword [esp + 0xc]
mov dword [ecx], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, edi
pop edi
pop esi
add esp, 8
ret

Function at 0x100b8070
Capabilities:
Read file on windows

Disassembly:
sub esp, 0x18
push dword [esp + 0x1c]
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll__fileno]
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll__get_osfhandle]
add esp, 8
cmp dword [esp + 0x1c], 0xffffffff
je 0x100b80e4
mov ecx, dword [esp + 0x28]
xorps xmm0, xmm0
mov dword [esp + 0xc], ecx
lea ecx, [esp + 4]
push ecx
lea ecx, [esp + 4]
movlpd qword [esp + 8], xmm0
push ecx
push dword [esp + 0x2c]
mov dword [esp + 0x20], 0
push dword [esp + 0x2c]
mov dword [esp + 0x20], 0
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x100b80d3
mov eax, dword [esp]
add esp, 0x18
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x26
jne 0x100b80e4
xor eax, eax
add esp, 0x18
ret
or eax, 0xffffffff
add esp, 0x18
ret
Function at 0x100cbb20
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x1c
push esi
push edi
mov edi, dword [esp + 0x28]
mov ecx, edi
call sym.skottie.dll_public:_void___thiscall_skia::tracing_internals::ScopedTracer::constructor_void_
mov esi, dword [esp + 0x2c]
movss xmm2, dword [esp + 0x3c]
movss xmm0, dword [0x1038c704]
comiss xmm2, xmm0
mov dword [edi + 0x78], 0
mov dword [edi + 0x7c], 0
mov dword [edi + 0x80], 0
mov dword [edi + 0x84], 0x3f800000
movss xmm1, dword [esi + 4]
movss dword [esp + 0x28], xmm1
movaps xmm3, xmm1
movss dword [esp + 0x2c], xmm1
jbe 0x100cbbb6
divss xmm0, xmm2
sub esp, 8
mulss xmm0, xmm1
cvtps2pd xmm0, xmm0
movsd qword [esp + 0x10], xmm0
fld qword [esp + 0x10]
fstp qword [esp]
call sub.api_ms_win_crt_math_l1_1_0.dll_floor
movss xmm1, dword [esp + 0x30]
add esp, 8
fstp dword [esp + 0x2c]
movss xmm3, dword [esp + 0x2c]
movss dword [esp + 0x2c], xmm3
mov edx, dword [esi]
test edx, edx
je 0x100cbbcd
lea ecx, [edx + 4]
mov eax, 1
lock xadd dword [ecx], eax
movss xmm1, dword [esi + 4]
movzx eax, byte [esi + 0x10]
movss xmm0, dword [esi + 8]
mov byte [esp + 0x20], al
movzx eax, byte [esi + 0x11]
movss dword [esp + 0x18], xmm0
movss xmm0, dword [esi + 0xc]
mov byte [esp + 0x21], al
movzx eax, byte [esi + 0x12]
push ecx
lea ecx, [esp + 0x14]
mov dword [esp + 0x14], edx
movss dword [esp + 0x18], xmm1
movss dword [esp + 0x20], xmm0
mov byte [esp + 0x26], al
movss dword [esp], xmm3
call fcn.10060f90
push 0
lea ecx, [esp + 0x14]
call fcn.10060fc0
movss xmm0, dword [esp + 0x28]
divss xmm0, dword [esp + 0x2c]
movss dword [edi + 0x84], xmm0
call fcn.1003c3b0
push eax
push dword [esp + 0x3c]
lea eax, [esp + 0x18]
mov ecx, edi
push dword [esp + 0x3c]
push dword [esp + 0x3c]
push eax
call fcn.100cbe90
mov ecx, dword [esp + 0x10]
test ecx, ecx
je 0x100cbc6d
lea edx, [ecx + 4]
or esi, 0xffffffff
lock xadd dword [edx], esi
cmp esi, 1
jne 0x100cbc6d
mov edx, dword [ecx]
call dword [edx + 4]
mov eax, edi
pop edi
pop esi
add esp, 0x1c
ret
Function at 0x100de040
Capabilities:
Enumerate pe sections

Disassembly:
mov eax, dword fs:[0x2c]
mov ecx, dword [0x1044ad38]
mov ecx, dword [eax + ecx*4]
mov eax, dword [0x1044990c]
cmp eax, dword [ecx + 0xc]
jg 0x100de0d5
push ebx
mov ebx, dword [0x10449908]
push esi
mov esi, dword [esp + 0xc]
push edi
mov eax, dword [esi]
lea edi, [esi + 4]
cmp eax, edi
je 0x100de07b
push eax
call sym.skottie.dll_void___cdecl_sk_free_void__
add esp, 4
mov edx, dword [esp + 0x18]
or ebx, 0x1c0000
mov eax, dword [esp + 0x14]
mov dword [esi], edi
mov dword [edi + 4], ebx
mov dword [esi + 0x24], 0x1038d2a0
mov ecx, dword [esi]
mov dword [ecx + 8], eax
mov ecx, dword [esi]
mov eax, dword [edx]
mov dword [ecx + 0xc], eax
mov ecx, dword [esi]
mov eax, dword [edx + 4]
mov dword [ecx + 0x10], eax
mov ecx, dword [esi]
mov eax, dword [edx + 8]
mov dword [ecx + 0x14], eax
mov ecx, dword [esi]
mov eax, dword [edx + 0xc]
mov dword [ecx + 0x18], eax
mov esi, dword [esi]
movzx eax, word [esi + 6]
lea ecx, [esi + 4]
add eax, 0xfffffffc
push eax
push ecx
call fcn.1017f640
add esp, 8
mov dword [esi], eax
pop edi
pop esi
pop ebx
ret
push 0x1044990c
call fcn.1037e834
add esp, 4
cmp dword [0x1044990c], 0xffffffff
jne 0x100de05c
call fcn.1017f560
push 0x1044990c
mov dword [0x10449908], eax
call fcn.1037e7ea
add esp, 4
jmp 0x100de05c
Function at 0x100f6bb0
Capabilities:
Hash data using murmur3

Disassembly:
sub esp, 8
mov eax, dword [esp + 0xc]
push ebx
push ebp
push esi
mov ebp, dword [eax]
mov ebx, 1
mov eax, ebp
shr eax, 0x10
xor eax, ebp
imul edx, eax, 0x85ebca6b
push edi
mov edi, ecx
mov dword [esp + 0x10], edi
mov eax, edx
shr eax, 0xd
xor eax, edx
imul edx, eax, 0xc2b2ae35
mov ecx, edx
shr ecx, 0x10
mov eax, ecx
xor eax, edx
cmp ecx, edx
mov ecx, dword [edi + 4]
cmovne ebx, eax
xor esi, esi
lea eax, [ecx - 1]
mov dword [esp + 0x1c], eax
and eax, ebx
test ecx, ecx
jle 0x100f6c57
mov edx, dword [edi + 8]
mov dword [esp + 0x14], edx
nop dword [eax]
lea ecx, [eax + eax*4]
mov edi, eax
lea ecx, [edx + ecx*4]
mov edx, dword [ecx + 0x10]
test edx, edx
je 0x100f6c57
cmp ebx, edx
jne 0x100f6c27
cmp ebp, dword [ecx]
je 0x100f6c4a
lea ecx, [eax - 1]
mov eax, dword [esp + 0x1c]
test ecx, ecx
mov ecx, 0xffffffff
cmovns eax, ecx
mov ecx, dword [esp + 0x10]
inc esi
add eax, edi
cmp esi, dword [ecx + 4]
jge 0x100f6c57
mov edx, dword [esp + 0x14]
jmp 0x100f6c10
pop edi
pop esi
pop ebp
lea eax, [ecx + 4]
pop ebx
add esp, 8
ret 4
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 8
ret 4

Function at 0x100f6fe0
Capabilities:
Hash data using murmur3

Disassembly:
push ecx
mov eax, dword [esp + 8]
push ebx
push ebp
mov ebx, ecx
mov ebp, dword [eax]
mov eax, ebp
shr eax, 0x10
xor eax, ebp
mov dword [esp + 8], ebp
imul edx, eax, 0x85ebca6b
push esi
mov esi, dword [ebx + 4]
push edi
mov edi, 1
mov eax, edx
shr eax, 0xd
xor eax, edx
imul edx, eax, 0xc2b2ae35
mov ecx, edx
shr ecx, 0x10
mov eax, ecx
xor eax, edx
cmp ecx, edx
cmovne edi, eax
lea eax, [esi - 1]
and eax, edi
mov dword [esp + 0x18], edi
xor edx, edx
test esi, esi
jle 0x100f7091
mov esi, dword [ebx + 8]
lea ecx, [eax + eax*4]
mov ebp, dword [esp + 0x18]
mov edi, eax
cmp ebp, dword [esi + ecx*4 + 0x10]
mov esi, dword [ebx + 4]
mov ebp, dword [esp + 0x10]
jne 0x100f7054
mov esi, dword [ebx + 8]
cmp ebp, dword [esi + ecx*4]
mov esi, dword [ebx + 4]
je 0x100f706b
add eax, 0xffffffff
jns 0x100f705e
lea eax, [edi - 1]
add eax, esi
inc edx
cmp edx, esi
jl 0x100f7030
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret 4
push eax
mov ecx, ebx
call fcn.100f7360
mov ecx, dword [ebx]
mov eax, dword [ebx + 4]
shl ecx, 2
cmp ecx, eax
jg 0x100f7091
cmp eax, 4
jle 0x100f7091
cdq
mov ecx, ebx
sub eax, edx
sar eax, 1
push eax
call fcn.100f76f0
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret 4
Function at 0x100f7f4e
Capabilities:
Hash data using murmur3

Disassembly:
sub esp, 0xc
push ebx
push ebp
mov ebp, dword [esp + 0x18]
mov ebx, 1
push esi
mov esi, ecx
push edi
mov ebp, dword [ebp]
mov eax, ebp
shr eax, 0x10
xor eax, ebp
mov edi, dword [esi + 4]
imul edx, eax, 0x85ebca6b
mov dword [esp + 0x18], esi
mov eax, edx
shr eax, 0xd
xor eax, edx
imul edx, eax, 0xc2b2ae35
mov ecx, edx
shr ecx, 0x10
mov eax, ecx
xor eax, edx
cmp ecx, edx
cmovne ebx, eax
lea eax, [edi - 1]
and eax, ebx
mov dword [esp + 0x10], ebx
xor edx, edx
test edi, edi
jle 0x100f806d
mov esi, dword [esi + 8]
mov dword [esp + 0x14], esi
nop
lea ecx, [eax + eax*4]
mov ebx, eax
lea esi, [esi + ecx*4]
mov ecx, dword [esi + 0x10]
test ecx, ecx
je 0x100f8019
cmp dword [esp + 0x10], ecx
jne 0x100f7fb9
cmp ebp, dword [esi]
je 0x100f7fd2
add eax, 0xffffffff
jns 0x100f7fc3
lea eax, [edi - 1]
add eax, ebx
inc edx
cmp edx, edi
jge 0x100f806d
mov esi, dword [esp + 0x14]
jmp 0x100f7fa0
mov edi, dword [esp + 0x20]
lea ebx, [esi + 4]
add edi, 4
mov dword [esi], ebp
cmp ebx, edi
je 0x100f800d
mov ecx, ebx
call fcn.100f6a40
mov eax, dword [edi]
mov dword [ebx], eax
mov ecx, dword [edi + 4]
mov dword [ebx + 4], ecx
mov ecx, dword [edi + 8]
mov dword [ebx + 8], ecx
mov dword [edi], 0
mov dword [edi + 4], 0
mov dword [edi + 8], 0
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret 4
mov edi, dword [esp + 0x20]
lea ebx, [esi + 4]
add edi, 4
mov dword [esi], ebp
cmp ebx, edi
je 0x100f8054
mov ecx, ebx
call fcn.100f6a40
mov eax, dword [edi]
mov dword [ebx], eax
mov eax, dword [edi + 4]
mov dword [ebx + 4], eax
mov eax, dword [edi + 8]
mov dword [ebx + 8], eax
mov dword [edi], 0
mov dword [edi + 4], 0
mov dword [edi + 8], 0
mov eax, dword [esp + 0x10]
mov dword [esi + 0x10], eax
mov eax, dword [esp + 0x18]
pop edi
inc dword [eax]
mov eax, esi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret 4
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0xc
ret 4