joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100456e0
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov edx, dword [0x100fe72c]
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
movzx eax, byte [esi]
xor eax, 0x811c9dc5
imul ecx, eax, 0x1000193
movzx eax, byte [esi + 1]
xor ecx, eax
movzx eax, byte [esi + 2]
imul ecx, ecx, 0x1000193
xor ecx, eax
movzx eax, byte [esi + 3]
imul ecx, ecx, 0x1000193
xor ecx, eax
imul ecx, ecx, 0x1000193
and ecx, dword [0x100fe738]
mov eax, dword [edx + ecx*8]
add ecx, ecx
mov edi, dword [edx + ecx*4]
lea ebx, [edx + ecx*4]
mov edx, dword [0x100fe724]
nop dword [eax + eax]
cmp edi, edx
jne 0x10045748
mov ecx, edx
jmp 0x1004574d
mov ecx, dword [ebx + 4]
mov ecx, dword [ecx]
cmp eax, ecx
je 0x10045760
mov ecx, dword [eax + 8]
cmp ecx, dword [esi]
je 0x1004575c
mov eax, dword [eax]
jmp 0x10045740
mov ecx, eax
jmp 0x10045764
mov eax, edx
mov ecx, edx
cmp ecx, edx
jne 0x100457b8
push ecx
mov dword [ebp + 8], esi
lea eax, [ebp + 8]
mov esi, dword [edx]
push eax
push ecx
mov edi, dword [esi + 4]
push edi
push esi
call fcn.10018d00
mov edx, eax
mov ecx, 0xffffffe
mov eax, dword [0x100fe728]
sub ecx, eax
cmp ecx, 1
jb 0x100457c4
inc eax
mov ecx, 0x100fe720
mov dword [0x100fe728], eax
mov dword [esi + 4], edx
mov dword [edi], edx
mov eax, dword [0x100fe724]
mov eax, dword [eax]
push eax
add eax, 8
push eax
lea eax, [ebp - 8]
push eax
call fcn.100188b0
mov eax, dword [ebp - 8]
pop edi
pop esi
add eax, 0xc
pop ebx
mov esp, ebp
pop ebp
ret 4
push str.list_T__too_long
call fcn.1006df8f
int3

Function at 0x10047350
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov edx, dword [0x100fe32c]
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
movzx eax, byte [esi]
xor eax, 0x811c9dc5
imul ecx, eax, 0x1000193
movzx eax, byte [esi + 1]
xor ecx, eax
movzx eax, byte [esi + 2]
imul ecx, ecx, 0x1000193
xor ecx, eax
movzx eax, byte [esi + 3]
imul ecx, ecx, 0x1000193
xor ecx, eax
imul ecx, ecx, 0x1000193
and ecx, dword [0x100fe338]
mov eax, dword [edx + ecx*8]
add ecx, ecx
mov edi, dword [edx + ecx*4]
lea ebx, [edx + ecx*4]
mov edx, dword [0x100fe324]
nop dword [eax + eax]
cmp edi, edx
jne 0x100473b8
mov ecx, edx
jmp 0x100473bd
mov ecx, dword [ebx + 4]
mov ecx, dword [ecx]
cmp eax, ecx
je 0x100473d0
mov ecx, dword [eax + 8]
cmp ecx, dword [esi]
je 0x100473cc
mov eax, dword [eax]
jmp 0x100473b0
mov ecx, eax
jmp 0x100473d4
mov eax, edx
mov ecx, edx
cmp ecx, edx
jne 0x10047428
push ecx
mov dword [ebp + 8], esi
lea eax, [ebp + 8]
mov esi, dword [edx]
push eax
push ecx
mov edi, dword [esi + 4]
push edi
push esi
call fcn.100477e0
mov edx, eax
mov ecx, 0x5d1745c
mov eax, dword [0x100fe328]
sub ecx, eax
cmp ecx, 1
jb 0x10047434
inc eax
mov ecx, 0x100fe320
mov dword [0x100fe328], eax
mov dword [esi + 4], edx
mov dword [edi], edx
mov eax, dword [0x100fe324]
mov eax, dword [eax]
push eax
add eax, 8
push eax
lea eax, [ebp - 8]
push eax
call fcn.100475d0
mov eax, dword [ebp - 8]
pop edi
pop esi
add eax, 0xc
pop ebx
mov esp, ebp
pop ebp
ret 4
push str.list_T__too_long
call fcn.1006df8f
int3
Function at 0x10047440
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov edx, dword [0x100fe40c]
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
movzx eax, byte [esi]
xor eax, 0x811c9dc5
imul ecx, eax, 0x1000193
movzx eax, byte [esi + 1]
xor ecx, eax
movzx eax, byte [esi + 2]
imul ecx, ecx, 0x1000193
xor ecx, eax
movzx eax, byte [esi + 3]
imul ecx, ecx, 0x1000193
xor ecx, eax
imul ecx, ecx, 0x1000193
and ecx, dword [0x100fe418]
mov eax, dword [edx + ecx*8]
add ecx, ecx
mov edi, dword [edx + ecx*4]
lea ebx, [edx + ecx*4]
mov edx, dword [0x100fe404]
nop dword [eax + eax]
cmp edi, edx
jne 0x100474a8
mov ecx, edx
jmp 0x100474ad
mov ecx, dword [ebx + 4]
mov ecx, dword [ecx]
cmp eax, ecx
je 0x100474c0
mov ecx, dword [eax + 8]
cmp ecx, dword [esi]
je 0x100474bc
mov eax, dword [eax]
jmp 0x100474a0
mov ecx, eax
jmp 0x100474c4
mov eax, edx
mov ecx, edx
cmp ecx, edx
jne 0x10047518
push ecx
mov dword [ebp + 8], esi
lea eax, [ebp + 8]
mov esi, dword [edx]
push eax
push ecx
mov edi, dword [esi + 4]
push edi
push esi
call fcn.1000ea00
mov edx, eax
mov ecx, 0xffffffe
mov eax, dword [0x100fe408]
sub ecx, eax
cmp ecx, 1
jb 0x10047524
inc eax
mov ecx, 0x100fe400
mov dword [0x100fe408], eax
mov dword [esi + 4], edx
mov dword [edi], edx
mov eax, dword [0x100fe404]
mov eax, dword [eax]
push eax
add eax, 8
push eax
lea eax, [ebp - 8]
push eax
call fcn.1003efb0
mov eax, dword [ebp - 8]
pop edi
pop esi
add eax, 0xc
pop ebx
mov esp, ebp
pop ebp
ret 4
push str.list_T__too_long
call fcn.1006df8f
int3

Function at 0x10047530
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, dword [ebp + 0xc]
mov edx, dword [0x100fe40c]
push edi
movzx eax, byte [esi]
xor eax, 0x811c9dc5
imul ecx, eax, 0x1000193
movzx eax, byte [esi + 1]
xor ecx, eax
movzx eax, byte [esi + 2]
imul ecx, ecx, 0x1000193
xor ecx, eax
movzx eax, byte [esi + 3]
imul ecx, ecx, 0x1000193
xor ecx, eax
imul eax, ecx, 0x1000193
mov ecx, dword [0x100fe418]
and ecx, eax
mov eax, dword [edx + ecx*8]
add ecx, ecx
mov edi, dword [edx + ecx*4]
lea ebx, [edx + ecx*4]
mov edx, dword [0x100fe404]
nop word [eax + eax]
cmp edi, edx
jne 0x10047598
mov ecx, edx
jmp 0x1004759d
mov ecx, dword [ebx + 4]
mov ecx, dword [ecx]
cmp eax, ecx
je 0x100475ba
mov ecx, dword [eax + 8]
cmp ecx, dword [esi]
je 0x100475ac
mov eax, dword [eax]
jmp 0x10047590
mov ecx, dword [ebp + 8]
pop edi
pop esi
pop ebx
mov dword [ecx], eax
mov eax, ecx
pop ebp
ret 8
mov eax, dword [ebp + 8]
pop edi
pop esi
pop ebx
mov dword [eax], edx
pop ebp
ret 8
Function at 0x10047810
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
push esi
push edi
mov edi, ecx
movzx edx, byte [eax + 8]
movzx ecx, byte [eax + 0xa]
xor edx, 0x811c9dc5
imul esi, edx, 0x1000193
movzx edx, byte [eax + 9]
xor esi, edx
imul edx, esi, 0x1000193
xor edx, ecx
movzx ecx, byte [eax + 0xb]
imul edx, edx, 0x1000193
xor edx, ecx
imul ecx, edx, 0x1000193
mov edx, dword [edi + 0x18]
and edx, ecx
lea esi, [edx*8]
mov edx, dword [edi + 0xc]
add edx, esi
mov ecx, dword [edx]
cmp dword [edx + 4], eax
jne 0x10047883
cmp ecx, eax
jne 0x1004787b
mov ecx, dword [edi + 4]
mov dword [edx], ecx
mov edx, dword [edi + 0xc]
mov ecx, dword [edi + 4]
mov dword [esi + edx + 4], ecx
jmp 0x1004788b
mov ecx, dword [eax + 4]
mov dword [edx + 4], ecx
jmp 0x1004788b
cmp ecx, eax
jne 0x1004788b
mov ecx, dword [eax]
mov dword [edx], ecx
mov ecx, dword [eax + 4]
mov esi, dword [eax]
push 0x2c
push eax
mov dword [ecx], esi
mov edx, dword [eax]
mov ecx, dword [eax + 4]
mov dword [edx + 4], ecx
dec dword [edi + 8]
call fcn.1006cd71
mov eax, dword [ebp + 8]
add esp, 8
pop edi
mov dword [eax], esi
pop esi
pop ebp
ret 8

Function at 0x10047ea0
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push esi
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [ebp - 8]
push eax
push 4
push 1
push 0x6a5302
mov byte [ebp - 1], 8
call esi
test eax, eax
je 0x10047eda
mov al, byte [ebp - 1]
mov ecx, 0x6a5302
mov byte [ecx], al
lea eax, [ebp - 8]
push eax
push dword [ebp - 8]
push 1
push ecx
call esi
lea eax, [ebp - 8]
push eax
push 0x40
push 8
push 0x6a539e
call esi
test eax, eax
je 0x10047f0f
mov eax, 0x6a539e
mov dword [eax], 0x90909090
mov dword [eax + 4], 0x90909090
lea eax, [ebp - 8]
push eax
push dword [ebp - 8]
push 8
push 0x6a539e
call esi
push str.Avatar_Blue_limit_is_patched_succesfully__n
call fcn.1000eb40
add esp, 4
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x10048c20
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [ebp - 4]
push eax
push 0x40
push 8
push 0x4142e2
call esi
test eax, eax
je 0x10048c60
mov eax, 0x4142e2
mov dword [eax], 0x90909090
mov dword [eax + 4], 0x90909090
lea eax, [ebp - 4]
push eax
push dword [ebp - 4]
push 8
push 0x4142e2
call esi
lea eax, [ebp - 4]
push eax
push 0x40
push 5
push 0x41474d
call esi
test eax, eax
je 0x10048c92
mov eax, 0x41474d
mov dword [eax], 0x90909090
mov byte [eax + 4], 0x90
lea eax, [ebp - 4]
push eax
push dword [ebp - 4]
push 5
push 0x41474d
call esi
push str.Green_Book_is_patched_succesfully__n
call fcn.1000eb40
add esp, 4
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x10048e50
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
push ecx
lea eax, [ebp - 4]
push eax
push 0x40
push 0x13
push 0x5805c8
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
je 0x10048e9b
mov eax, 0x5805c8
mov ecx, 0x90909090
mov dword [eax], ecx
mov dword [eax + 4], ecx
mov dword [eax + 8], ecx
mov dword [eax + 0xc], ecx
mov word [eax + 0x10], cx
mov byte [eax + 0x12], cl
lea eax, [ebp - 4]
push eax
push dword [ebp - 4]
push 0x13
push 0x5805c8
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
push str.QuestRaise_is_patched_succesfully__n
call fcn.1000eb40
add esp, 4
mov esp, ebp
pop ebp
ret

Function at 0x10048eb0
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
lea eax, [ebp - 8]
push esi
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
push eax
push 0x40
push 0xf
push 0x964060
call esi
test eax, eax
je 0x10048ef9
mov eax, 0x964060
mov ecx, 0x90909090
mov dword [eax], ecx
mov dword [eax + 4], ecx
mov dword [eax + 8], ecx
mov word [eax + 0xc], cx
mov byte [eax + 0xe], cl
lea eax, [ebp - 8]
push eax
push dword [ebp - 8]
push 0xf
push 0x964060
call esi
lea eax, [ebp - 8]
push eax
push 0x40
push 0xf
push 0x95c4e0
call esi
test eax, eax
je 0x10048f35
mov eax, 0x95c4e0
mov ecx, 0x90909090
mov dword [eax], ecx
mov dword [eax + 4], ecx
mov dword [eax + 8], ecx
mov word [eax + 0xc], cx
mov byte [eax + 0xe], cl
lea eax, [ebp - 8]
push eax
push dword [ebp - 8]
push 0xf
push 0x95c4e0
call esi
lea eax, [ebp - 8]
mov byte [ebp - 1], 0xc3
push eax
push 4
push 1
push 0x96406f
call esi
test eax, eax
je 0x10048f62
mov al, byte [ebp - 1]
mov ecx, 0x96406f
mov byte [ecx], al
lea eax, [ebp - 8]
push eax
push dword [ebp - 8]
push 1
push ecx
call esi
lea eax, [ebp - 8]
push eax
push 4
push 1
push 0x95c4ef
call esi
test eax, eax
je 0x10048f8b
mov al, byte [ebp - 1]
mov ecx, 0x95c4ef
mov byte [ecx], al
lea eax, [ebp - 8]
push eax
push dword [ebp - 8]
push 1
push ecx
call esi
push str.Dump_creation_is_patched_succesfully__n
call fcn.1000eb40
add esp, 4
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x10049060
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
lea eax, [ebp - 4]
mov dword [ebp - 4], 0
push eax
mov ebx, ecx
mov esi, edx
push 0x40
push 4
lea edi, [ebx + 1]
push edi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
je 0x1004909d
push 0
push dword [ebp - 4]
sub esi, ebx
push 4
sub esi, 5
push edi
mov dword [edi], esi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x100490b0
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
lea eax, [ebp - 4]
mov esi, ecx
push eax
push 0x40
push 4
push esi
mov ebx, edx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
je 0x100490dd
push 0
push dword [ebp - 4]
mov dword [esi], ebx
push 4
push esi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1004b070
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x100c3368
push eax
mov dword fs:[0], esp
sub esp, 0x34
cmp dword [0x100fe6a8], 0
jne 0x1004b0a6
xor al, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 4
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
mov ecx, dword [eax + 0x2246]
mov eax, dword [eax + 0x2252]
mov dword [ebp - 0x20], ecx
mov eax, dword [eax + 0x34]
mov edi, dword [eax + 0x18]
add edi, 0x14
mov esi, edi
mov ebx, dword [edi + 0x10]
mov dword [ebp + 8], ebx
cmp dword [edi + 0x14], 0x10
jb 0x1004b0d4
mov esi, dword [edi]
xor ecx, ecx
mov edx, 0x811c9dc5
test ebx, ebx
je 0x1004b0f1
nop
movzx eax, byte [ecx + esi]
inc ecx
xor eax, edx
imul edx, eax, 0x1000193
cmp ecx, ebx
jb 0x1004b0e0
and edx, dword [0x100fe6b8]
mov ecx, dword [0x100fe6ac]
mov ebx, dword [0x100fe6a4]
lea eax, [edx + edx]
mov esi, dword [ecx + edx*8]
lea edx, [eax*4 + 4]
mov eax, dword [ecx + eax*4]
mov dword [ebp - 0x14], edx
mov dword [ebp - 0x10], eax
nop dword [eax]
cmp eax, ebx
jne 0x1004b128
mov eax, ebx
jmp 0x1004b12d
mov eax, dword [edx + ecx]
mov eax, dword [eax]
cmp esi, eax
je 0x1004b1a5
cmp dword [edi + 0x14], 0x10
mov edx, edi
jb 0x1004b13b
mov edx, dword [edi]
mov ebx, dword [esi + 0x1c]
lea ecx, [esi + 8]
mov dword [ebp - 0x18], ebx
cmp ebx, 0x10
mov ebx, dword [0x100fe6a4]
jb 0x1004b152
mov ecx, dword [esi + 8]
push dword [ebp + 8]
mov eax, dword [esi + 0x18]
push edx
mov edx, eax
mov dword [ebp - 0x1c], eax
call fcn.1000ba70
add esp, 8
test al, al
jne 0x1004b17a
mov esi, dword [esi]
mov ecx, dword [0x100fe6ac]
mov eax, dword [ebp - 0x10]
mov edx, dword [ebp - 0x14]
jmp 0x1004b120
cmp dword [ebp - 0x18], 0x10
lea eax, [esi + 8]
jb 0x1004b185
mov eax, dword [eax]
cmp dword [edi + 0x14], 0x10
jb 0x1004b18d
mov edi, dword [edi]
push dword [ebp - 0x1c]
mov edx, dword [ebp + 8]
mov ecx, edi
push eax
call fcn.1000ba70
add esp, 8
test al, al
cmove esi, ebx
jmp 0x1004b1a7
mov esi, ebx
cmp esi, ebx
jne 0x1004b1c0
pop edi
pop esi
xor al, al
pop ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 4
mov eax, dword [ebp - 0x20]
lea ecx, [ebp - 0x40]
add esi, 0x20
push esi
mov eax, dword [eax + 0x34]
mov al, byte [eax + 0x2c]
inc al
mov byte [ebp + 0xb], al
call fcn.1002c700
mov dword [ebp - 4], 0
mov bl, byte [ebp + 0xb]
mov edx, dword [ebp - 0x34]
movzx eax, bl
xor eax, 0x811c9dc5
imul ecx, eax, 0x1000193
and ecx, dword [ebp - 0x28]
mov eax, dword [edx + ecx*8]
add ecx, ecx
mov esi, dword [edx + ecx*4]
lea edi, [edx + ecx*4]
mov edx, dword [ebp - 0x3c]
cmp esi, edx
jne 0x1004b20e
mov ecx, edx
jmp 0x1004b213
mov ecx, dword [edi + 4]
mov ecx, dword [ecx]
cmp eax, ecx
je 0x1004b23b
cmp byte [eax + 8], bl
je 0x1004b220
mov eax, dword [eax]
jmp 0x1004b206
cmp eax, edx
je 0x1004b23b
lea eax, [ebp + 0xb]
push eax
lea ecx, [ebp - 0x40]
call fcn.100287e0
mov bl, 1
mov eax, dword [eax]
mov dword [0x100fe064], eax
jmp 0x1004b23d
xor bl, bl
lea ecx, [ebp - 0x40]
call fcn.10021bc0
mov ecx, dword [ebp - 0xc]
mov al, bl
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 4
Function at 0x1004b260
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x100c3368
push eax
mov dword fs:[0], esp
sub esp, 0x34
cmp dword [0x100fe3e8], 0
jne 0x1004b296
xor al, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 4
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
mov ecx, dword [eax + 0x2246]
mov eax, dword [eax + 0x226a]
mov dword [ebp - 0x20], ecx
mov eax, dword [eax + 0x34]
mov edi, dword [eax + 0x18]
add edi, 0x14
mov esi, edi
mov ebx, dword [edi + 0x10]
mov dword [ebp + 8], ebx
cmp dword [edi + 0x14], 0x10
jb 0x1004b2c4
mov esi, dword [edi]
xor ecx, ecx
mov edx, 0x811c9dc5
test ebx, ebx
je 0x1004b2e1
nop
movzx eax, byte [ecx + esi]
inc ecx
xor eax, edx
imul edx, eax, 0x1000193
cmp ecx, ebx
jb 0x1004b2d0
and edx, dword [0x100fe3f8]
mov ecx, dword [0x100fe3ec]
mov ebx, dword [0x100fe3e4]
lea eax, [edx + edx]
mov esi, dword [ecx + edx*8]
lea edx, [eax*4 + 4]
mov eax, dword [ecx + eax*4]
mov dword [ebp - 0x14], edx
mov dword [ebp - 0x10], eax
nop dword [eax]
cmp eax, ebx
jne 0x1004b318
mov eax, ebx
jmp 0x1004b31d
mov eax, dword [edx + ecx]
mov eax, dword [eax]
cmp esi, eax
je 0x1004b395
cmp dword [edi + 0x14], 0x10
mov edx, edi
jb 0x1004b32b
mov edx, dword [edi]
mov ebx, dword [esi + 0x1c]
lea ecx, [esi + 8]
mov dword [ebp - 0x18], ebx
cmp ebx, 0x10
mov ebx, dword [0x100fe3e4]
jb 0x1004b342
mov ecx, dword [esi + 8]
push dword [ebp + 8]
mov eax, dword [esi + 0x18]
push edx
mov edx, eax
mov dword [ebp - 0x1c], eax
call fcn.1000ba70
add esp, 8
test al, al
jne 0x1004b36a
mov esi, dword [esi]
mov ecx, dword [0x100fe3ec]
mov eax, dword [ebp - 0x10]
mov edx, dword [ebp - 0x14]
jmp 0x1004b310
cmp dword [ebp - 0x18], 0x10
lea eax, [esi + 8]
jb 0x1004b375
mov eax, dword [eax]
cmp dword [edi + 0x14], 0x10
jb 0x1004b37d
mov edi, dword [edi]
push dword [ebp - 0x1c]
mov edx, dword [ebp + 8]
mov ecx, edi
push eax
call fcn.1000ba70
add esp, 8
test al, al
cmove esi, ebx
jmp 0x1004b397
mov esi, ebx
cmp esi, ebx
jne 0x1004b3b0
pop edi
pop esi
xor al, al
pop ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 4
mov eax, dword [ebp - 0x20]
lea ecx, [ebp - 0x40]
add esi, 0x20
push esi
mov eax, dword [eax + 0x34]
mov al, byte [eax + 0x2c]
inc al
mov byte [ebp + 0xb], al
call fcn.1002c700
mov dword [ebp - 4], 0
mov bl, byte [ebp + 0xb]
mov edx, dword [ebp - 0x34]
movzx eax, bl
xor eax, 0x811c9dc5
imul ecx, eax, 0x1000193
and ecx, dword [ebp - 0x28]
mov eax, dword [edx + ecx*8]
add ecx, ecx
mov esi, dword [edx + ecx*4]
lea edi, [edx + ecx*4]
mov edx, dword [ebp - 0x3c]
cmp esi, edx
jne 0x1004b3fe
mov ecx, edx
jmp 0x1004b403
mov ecx, dword [edi + 4]
mov ecx, dword [ecx]
cmp eax, ecx
je 0x1004b42b
cmp byte [eax + 8], bl
je 0x1004b410
mov eax, dword [eax]
jmp 0x1004b3f6
cmp eax, edx
je 0x1004b42b
lea eax, [ebp + 0xb]
push eax
lea ecx, [ebp - 0x40]
call fcn.100287e0
mov bl, 1
mov eax, dword [eax]
mov dword [0x100fe094], eax
jmp 0x1004b42d
xor bl, bl
lea ecx, [ebp - 0x40]
call fcn.10021bc0
mov ecx, dword [ebp - 0xc]
mov al, bl
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 4
Function at 0x1004c730
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
sub esp, 0x14
push ebx
push esi
push edi
test eax, eax
je 0x1004c849
mov edx, dword [eax + 0x34]
movzx eax, byte [edx + 0x20]
xor eax, 0x811c9dc5
imul ecx, eax, 0x1000193
movzx eax, byte [edx + 0x21]
xor ecx, eax
movzx eax, byte [edx + 0x22]
imul ecx, ecx, 0x1000193
xor ecx, eax
movzx eax, byte [edx + 0x23]
imul ecx, ecx, 0x1000193
xor ecx, eax
imul eax, ecx, 0x1000193
mov ecx, dword [0x100fe72c]
and eax, dword [0x100fe738]
mov esi, dword [ecx + eax*8]
add eax, eax
mov edi, dword [ecx + eax*4]
lea ebx, [ecx + eax*4]
mov ecx, dword [0x100fe724]
cmp edi, ecx
jne 0x1004c79f
mov eax, ecx
jmp 0x1004c7a4
mov eax, dword [ebx + 4]
mov eax, dword [eax]
cmp esi, eax
je 0x1004c849
mov eax, dword [esi + 8]
cmp eax, dword [edx + 0x20]
je 0x1004c7b8
mov esi, dword [esi]
jmp 0x1004c797
cmp esi, ecx
je 0x1004c849
push 0x30cf
mov eax, 0x430a00
call eax
mov dword [ebp - 8], eax
add esp, 4
lea eax, [ebp - 4]
mov byte [ebp - 4], 0xcd
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x10], 0x404090
mov edx, dword [ebp - 0xc]
push edx
mov eax, 1
mov ecx, dword [ebp - 8]
call dword [ebp - 0x10]
mov ecx, dword [ebp + 8]
mov dword [ebp - 0x14], 0x404090
mov eax, dword [ecx + 8]
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x10]
mov dword [ebp - 0xc], eax
mov edx, dword [ebp - 0xc]
push edx
mov eax, 4
mov ecx, dword [ebp - 8]
call dword [ebp - 0x14]
mov al, byte [esi + 0xc]
mov byte [ebp - 4], al
lea eax, [ebp - 4]
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x10], 0x404090
mov edx, dword [ebp - 0x14]
push edx
mov eax, 1
mov ecx, dword [ebp - 8]
call dword [ebp - 0x10]
mov dword [ebp - 0x14], 0x484d90
mov esi, dword [ebp + 8]
mov edi, dword [ebp - 8]
call dword [ebp - 0x14]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x1004c860
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
test ebx, ebx
je 0x1004c99a
mov eax, dword [ebp + 0xc]
test eax, eax
je 0x1004c99a
cmp dword [eax + 0x1cc4], 0
je 0x1004c99a
mov edx, dword [eax + 0x34]
movzx eax, byte [edx + 0x20]
xor eax, 0x811c9dc5
imul ecx, eax, 0x1000193
movzx eax, byte [edx + 0x21]
xor ecx, eax
movzx eax, byte [edx + 0x22]
imul ecx, ecx, 0x1000193
xor ecx, eax
movzx eax, byte [edx + 0x23]
imul ecx, ecx, 0x1000193
xor ecx, eax
imul eax, ecx, 0x1000193
mov ecx, dword [0x100fe72c]
and eax, dword [0x100fe738]
mov esi, dword [ecx + eax*8]
add eax, eax
mov edi, dword [ecx + eax*4]
add ecx, 4
lea eax, [ecx + eax*4]
mov ecx, dword [0x100fe724]
mov dword [ebp + 8], eax
cmp edi, ecx
jne 0x1004c8ed
mov eax, ecx
jmp 0x1004c8f1
mov eax, dword [eax]
mov eax, dword [eax]
cmp esi, eax
je 0x1004c99a
mov eax, dword [esi + 8]
cmp eax, dword [edx + 0x20]
je 0x1004c908
mov esi, dword [esi]
mov eax, dword [ebp + 8]
jmp 0x1004c8e5
cmp esi, ecx
je 0x1004c99a
mov eax, dword [ebx]
mov ecx, ebx
push 0x30cf
mov eax, dword [eax + 0x278]
call eax
mov edi, eax
mov byte [ebp + 8], 0xcd
lea eax, [ebp + 8]
mov dword [ebp - 4], edi
mov dword [ebp - 8], eax
mov dword [ebp - 0xc], 0x404090
mov edx, dword [ebp - 8]
push edx
mov eax, 1
mov ecx, dword [ebp - 4]
call dword [ebp - 0xc]
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0xc], 0x404090
mov ecx, dword [eax + 8]
lea eax, [ebp + 0xc]
mov dword [ebp + 0xc], ecx
mov dword [ebp + 8], eax
mov edx, dword [ebp + 8]
push edx
mov eax, 4
mov ecx, dword [ebp - 4]
call dword [ebp - 0xc]
mov al, byte [esi + 0xc]
mov byte [ebp + 0xc], al
lea eax, [ebp + 0xc]
mov dword [ebp + 8], eax
mov dword [ebp - 0xc], 0x404090
mov edx, dword [ebp + 8]
push edx
mov eax, 1
mov ecx, dword [ebp - 4]
call dword [ebp - 0xc]
mov eax, dword [ebx]
mov ecx, ebx
push edi
mov eax, dword [eax + 0x27c]
call eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x10051480
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov edx, dword [0x100feb6c]
push ebx
push esi
movzx ebx, word [eax + 0x78]
movzx eax, bl
xor eax, 0x811c9dc5
imul ecx, eax, 0x1000193
mov eax, ebx
shr eax, 8
push edi
xor ecx, eax
imul ecx, ecx, 0x3ee6b34b
and ecx, dword [0x100feb78]
mov eax, dword [edx + ecx*8]
add ecx, ecx
mov esi, dword [edx + ecx*4]
lea edi, [edx + ecx*4]
mov edx, dword [0x100feb64]
cmp esi, edx
jne 0x100514cd
mov ecx, edx
jmp 0x100514d2
mov ecx, dword [edi + 4]
mov ecx, dword [ecx]
cmp eax, ecx
je 0x100514e3
cmp dword [eax + 8], ebx
je 0x100514df
mov eax, dword [eax]
jmp 0x100514c5
cmp eax, edx
jne 0x1005155e
mov eax, dword [ebp + 8]
mov edi, dword [0x100feb6c]
movsx ebx, word [eax + 0x84]
mov eax, ebx
shr eax, 8
movzx ecx, al
movzx eax, bl
xor eax, 0x811c9dc5
imul eax, eax, 0x1000193
xor ecx, eax
mov eax, ebx
imul ecx, ecx, 0x1000193
shr eax, 0x10
movzx eax, al
xor ecx, eax
mov eax, ebx
imul ecx, ecx, 0x1000193
shr eax, 0x18
xor ecx, eax
imul ecx, ecx, 0x1000193
and ecx, dword [0x100feb78]
mov eax, dword [edi + ecx*8]
add ecx, ecx
mov esi, dword [edi + ecx*4]
lea edi, [edi + ecx*4]
nop
cmp esi, edx
jne 0x10051548
mov ecx, edx
jmp 0x1005154d
mov ecx, dword [edi + 4]
mov ecx, dword [ecx]
cmp eax, ecx
je 0x10051567
cmp dword [eax + 8], ebx
je 0x1005155a
mov eax, dword [eax]
jmp 0x10051540
cmp eax, edx
je 0x10051567
pop edi
pop esi
mov al, 1
pop ebx
pop ebp
ret 4
pop edi
pop esi
xor al, al
pop ebx
pop ebp
ret 4