joyce8/EMBER2024-capa huggingface dataset:
Function at 0x46cd84
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
xor edx, edx
push ebp
push 0x46cdde
push dword fs:[edx]
mov dword fs:[edx], esp
mov eax, dword [eax + 0x30]
call fcn.0046cd74
mov ebx, eax
lea edx, [ebp - 4]
mov eax, edi
call fcn.0045c400
mov edx, dword [ebp - 4]
mov eax, dword [ebx + 0xc]
call fcn.0045c000
mov edx, dword [esi + 8]
mov eax, dword [ebx + 0x10]
mov ecx, dword [eax]
call dword [ecx + 8]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x46cde5
lea eax, [ebp - 4]
call fcn.00404604
ret

Function at 0x470694
Capabilities:
Create process on windows
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe90
push ebx
push esi
xor eax, eax
mov dword [ebp - 0x170], eax
mov dword [ebp - 0x164], eax
mov dword [ebp - 0x16c], eax
mov dword [ebp - 0x168], eax
mov dword [ebp - 8], eax
mov dword [ebp - 0xc], eax
xor eax, eax
push ebp
push 0x470885
push dword fs:[eax]
mov dword fs:[eax], esp
call fcn.00402a54
test eax, eax
jne 0x47085a
xor edx, edx
push ebp
push 0x470842
push dword fs:[edx]
mov dword fs:[edx], esp
lea eax, [ebp - 0x160]
push eax
push 0x104
call sub.KERNEL32.DLL_GetTempPathA
lea edx, [ebp - 0x168]
xor eax, eax
call fcn.00402ab4
mov eax, dword [ebp - 0x168]
lea edx, [ebp - 0x164]
call fcn.00408e38
push dword [ebp - 0x164]
push 0x4708a0
lea eax, [ebp - 0x16c]
call fcn.00471074
push dword [ebp - 0x16c]
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.00404984
lea edx, [ebp - 8]
xor eax, eax
call fcn.00402ab4
push 0x40
mov ecx, dword [ebp - 8]
mov dl, 1
mov eax, dword [0x412cf8]
call fcn.00417760
mov ebx, eax
push 0xffff
mov ecx, dword [ebp - 0xc]
mov dl, 1
mov eax, dword [0x412cf8]
call fcn.00417760
mov esi, eax
push 0
push 0
mov edx, ebx
mov eax, esi
call fcn.00417548
call fcn.00402b14
mov eax, ebx
mov edx, dword [eax]
call dword [edx]
sub eax, 0x64
sbb edx, 0
call fcn.004030e8
cdq
push edx
push eax
mov eax, ebx
call fcn.004172cc
mov eax, ebx
mov edx, dword [eax]
call dword [edx]
push edx
push eax
mov eax, ebx
call fcn.004172ac
sub dword [esp], eax
sbb dword [esp + 4], edx
pop eax
pop edx
call fcn.004030e8
cdq
push edx
push eax
mov edx, ebx
mov eax, esi
call fcn.00417548
mov eax, ebx
call fcn.00403830
mov eax, esi
call fcn.00403830
lea eax, [ebp - 0x50]
xor ecx, ecx
mov edx, 0x44
call fcn.004030c8
mov dword [ebp - 0x50], 0x44
mov dword [ebp - 0x24], 1
mov word [ebp - 0x20], 1
lea eax, [ebp - 0x60]
push eax
lea eax, [ebp - 0x50]
push eax
push 0
push 0
push 0x20
push 0xffffffffffffffff
push 0
push 0
lea eax, [ebp - 0x170]
mov ecx, 0x4708ac
mov edx, dword [ebp - 0xc]
call fcn.00404910
mov eax, dword [ebp - 0x170]
call fcn.00404ac4
push eax
push 0
call sub.KERNEL32.DLL_CreateProcessA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x470849
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x47088c
lea eax, [ebp - 0x170]
mov edx, 4
call fcn.00404628
lea eax, [ebp - 0xc]
mov edx, 2
call fcn.00404628
ret
Function at 0x1000d480
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x18
mov esi, dword [ebp + 0x10]
lea eax, [ecx + 8]
mov dword [ebp - 0x24], eax
mov edi, dword [ecx + 0x1364]
mov dword [ebp - 0x10], ecx
mov eax, dword [ecx + 0x1d14]
mov dword [ebp - 0x20], eax
cmp dword [edi + 0x2c], esi
mov dword [ebp - 0x1c], edi
jbe 0x1000d4c2
mov eax, dword [edi + 0x30]
mov ecx, esi
mov ebx, dword [eax + esi*4]
cmp ebx, 0xffffffff
jne 0x1000d551
jmp 0x1000d555
mov edx, esi
shr edx, 0x18
mov eax, esi
shr eax, 0x10
mov ecx, esi
mov ebx, esi
shr ebx, 8
mov esi, 0xff
and ecx, esi
and ebx, esi
and eax, esi
mov dword [ebp - 0x18], ecx
mov esi, ecx
xor esi, 0x811c9dc5
imul esi, esi, 0x1000193
xor esi, ebx
imul esi, esi, 0x1000193
xor esi, eax
imul esi, esi, 0x1000193
xor esi, edx
imul esi, esi, 0x1000193
and esi, dword [edi + 0x4c]
mov ecx, dword [edi + 0x38]
mov edi, dword [edi + 0x40]
mov edx, dword [edi + esi*8 + 4]
mov dword [ebp - 0x14], ecx
cmp edx, ecx
je 0x1000d555
mov ecx, edi
mov edi, dword [ebp + 0x10]
and edi, 0xff000000
shl eax, 0x10
or eax, edi
shl ebx, 8
or ebx, eax
add ebx, dword [ebp - 0x18]
cmp ebx, dword [edx + 8]
je 0x1000d549
add esi, esi
mov eax, dword [ecx + esi*4]
cmp edx, eax
je 0x1000d555
mov edx, dword [edx + 4]
cmp ebx, dword [edx + 8]
jne 0x1000d53d
cmp edx, dword [ebp - 0x14]
je 0x1000d555
mov ebx, dword [edx + 0xc]
test ebx, ebx
jne 0x1000d56e
mov eax, dword [ebp + 0x10]
test eax, eax
je 0x1000d56c
mov ecx, dword [ebp - 0x1c]
push eax
push dword [ebp - 0x20]
call fcn.1002d660
mov ebx, eax
jmp 0x1000d56e
xor ebx, ebx
mov al, byte [ebp + 8]
movzx esi, al
mov ecx, dword [ebp - 0x24]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push ebx
push dword [ebp + 0xc]
push esi
push dword [ebp - 0x10]
call fcn.10087950
cmp eax, 1
je 0x1000d5fc
cmp byte [ebp + 8], 1
je 0x1000d5b0
cmp esi, 9
je 0x1000d5c1
cmp esi, 0xc
jne 0x1000d5ea
mov ecx, dword [ebp + 0xc]
shl ecx, 4
mov esi, dword [ebp - 0x10]
add ecx, dword [esi + 0x2180]
jmp 0x1000d5d0
mov ecx, dword [ebp + 0xc]
shl ecx, 4
mov esi, dword [ebp - 0x10]
add ecx, dword [esi + 0x218c]
jmp 0x1000d5d0
mov ecx, dword [ebp + 0xc]
shl ecx, 4
mov esi, dword [ebp - 0x10]
add ecx, dword [esi + 0x2198]
lea eax, [ebx + 0x20]
test ebx, ebx
cmove eax, ebx
push eax
call fcn.1004f290
mov dword [esi + 0x2000], 1
jmp 0x1000d5fc
xor eax, eax
inc eax
mov ecx, dword [ebp - 0x10]
mov dword [ecx + 0x2000], eax
mov dword [ecx + 0x2004], eax
add esp, 0x18
pop esi
pop edi
pop ebx
pop ebp
ret 0x14
Function at 0x10013a50
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x10
mov edx, dword [ebp + 8]
mov eax, dword [ecx + 0x1368]
cmp dword [eax + 0x54], edx
jbe 0x10013a7a
mov eax, dword [eax + 0x58]
mov ecx, dword [eax + edx*4]
xor eax, eax
cmp ecx, 0xffffffff
cmovne eax, ecx
jmp 0x10013b10
mov ebx, edx
shr ebx, 0x10
mov ecx, edx
shr ecx, 8
mov esi, 0xff
mov edi, edx
and edi, esi
and ecx, esi
and ebx, esi
mov esi, edx
shr esi, 0x18
mov dword [ebp - 0x1c], edi
xor edi, 0x811c9dc5
imul edi, edi, 0x1000193
xor edi, ecx
imul edi, edi, 0x1000193
xor edi, ebx
imul edi, edi, 0x1000193
xor edi, esi
imul esi, edi, 0x1000193
and esi, dword [eax + 0x74]
mov edi, dword [eax + 0x60]
mov eax, dword [eax + 0x68]
mov dword [ebp - 0x14], esi
mov dword [ebp - 0x10], eax
mov esi, dword [eax + esi*8 + 4]
xor eax, eax
mov dword [ebp - 0x18], edi
cmp esi, edi
je 0x10013b10
and edx, 0xff000000
shl ebx, 0x10
or ebx, edx
shl ecx, 8
or ecx, ebx
add ecx, dword [ebp - 0x1c]
cmp ecx, dword [esi + 8]
je 0x10013b08
mov edx, dword [ebp - 0x14]
add edx, edx
mov edi, dword [ebp - 0x10]
mov edx, dword [edi + edx*4]
cmp esi, edx
je 0x10013b10
mov esi, dword [esi + 4]
cmp ecx, dword [esi + 8]
jne 0x10013afc
cmp esi, dword [ebp - 0x18]
je 0x10013b10
mov eax, dword [esi + 0xc]
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret 4
Function at 0x10013bd0
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x10
mov ebx, ecx
mov esi, dword [ebp + 8]
mov ecx, dword [ecx + 0x136c]
cmp dword [ecx + 0x2c], esi
jbe 0x10013c08
mov eax, dword [ecx + 0x30]
mov edx, dword [eax + esi*4]
lea eax, [edx + 1]
cmp eax, 2
jb 0x10013d1e
xor eax, eax
cmp edx, 0xffffffff
cmovne eax, edx
jmp 0x10013cd1
mov dword [ebp - 0x10], ebx
mov edx, esi
shr edx, 0x18
mov ebx, esi
shr ebx, 0x10
mov eax, esi
shr eax, 8
mov edi, 0xff
and esi, edi
and eax, edi
and ebx, edi
mov dword [ebp - 0x14], esi
xor esi, 0x811c9dc5
imul esi, esi, 0x1000193
xor esi, eax
imul esi, esi, 0x1000193
xor esi, ebx
imul esi, esi, 0x1000193
xor esi, edx
imul edi, esi, 0x1000193
and edi, dword [ecx + 0x4c]
mov esi, dword [ecx + 0x38]
mov edx, dword [ecx + 0x40]
mov dword [ebp - 0x1c], edx
mov edx, dword [edx + edi*8 + 4]
mov dword [ebp - 0x18], esi
cmp edx, esi
je 0x10013cc7
add edi, edi
mov esi, dword [ebp - 0x1c]
mov edi, dword [esi + edi*4]
mov esi, dword [ebp + 8]
and esi, 0xff000000
shl ebx, 0x10
or ebx, esi
shl eax, 8
or eax, ebx
add eax, dword [ebp - 0x14]
mov esi, dword [edx + 8]
mov ebx, edx
cmp eax, esi
je 0x10013c98
mov ebx, edx
cmp ebx, edi
je 0x10013cc7
mov ebx, dword [ebx + 4]
cmp eax, dword [ebx + 8]
jne 0x10013c8c
cmp ebx, dword [ebp - 0x18]
je 0x10013cc7
mov dword [ebp - 0x14], esi
cmp dword [ebx + 0xc], 0
mov ebx, dword [ebp - 0x10]
mov esi, dword [ebp + 8]
je 0x10013d1e
cmp eax, dword [ebp - 0x14]
je 0x10013cbd
cmp edx, edi
je 0x10013ccf
mov edx, dword [edx + 4]
cmp eax, dword [edx + 8]
jne 0x10013cb1
cmp edx, dword [ebp - 0x18]
je 0x10013ccf
mov eax, dword [edx + 0xc]
jmp 0x10013cd1
mov ebx, dword [ebp - 0x10]
mov esi, dword [ebp + 8]
jmp 0x10013d1e
xor eax, eax
mov edi, dword [ebx + 0x21b0]
mov dword [ebp - 0x10], ebx
mov esi, dword [ebx + 0x21b4]
cmp edi, esi
je 0x10013d01
lea ebx, [eax + 0x18]
test eax, eax
cmove ebx, eax
cmp dword [edi + 0xc], ebx
jne 0x10013cfa
mov ecx, edi
push 0
call fcn.1004f290
add edi, 0x10
cmp edi, esi
jne 0x10013cec
mov ebx, dword [ebp - 0x10]
lea ecx, [ebx + 8]
lea eax, [ebx + 0x1e00]
mov esi, dword [ebp + 8]
push esi
push eax
push ebx
call fcn.100860b0
mov ecx, dword [ebx + 0x136c]
push esi
push ebx
call fcn.10079da0
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret 4
Function at 0x100141b0
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0xc
mov esi, dword [ebp + 8]
cmp dword [ecx + 0x1ef0], esi
jbe 0x100141da
mov eax, dword [ecx + 0x1ef4]
mov ecx, dword [eax + esi*4]
xor eax, eax
cmp ecx, 0xffffffff
cmovne eax, ecx
jmp 0x1001427b
mov ebx, esi
shr ebx, 0x10
mov edx, esi
shr edx, 8
mov eax, 0xff
mov edi, esi
and edi, eax
and edx, eax
and ebx, eax
mov eax, esi
shr eax, 0x18
mov dword [ebp - 0x18], edi
xor edi, 0x811c9dc5
imul edi, edi, 0x1000193
xor edi, edx
imul edi, edi, 0x1000193
xor edi, ebx
imul edi, edi, 0x1000193
xor edi, eax
imul eax, edi, 0x1000193
and eax, dword [ecx + 0x1f10]
mov edi, dword [ecx + 0x1efc]
mov ecx, dword [ecx + 0x1f04]
mov dword [ebp - 0x10], ecx
mov ecx, dword [ecx + eax*8 + 4]
mov dword [ebp - 0x14], edi
cmp ecx, edi
je 0x10014259
and esi, 0xff000000
shl ebx, 0x10
or ebx, esi
shl edx, 8
or edx, ebx
add edx, dword [ebp - 0x18]
cmp edx, dword [ecx + 8]
jne 0x1001425d
xor eax, eax
jmp 0x10014273
xor eax, eax
jmp 0x1001427b
add eax, eax
mov esi, dword [ebp - 0x10]
mov esi, dword [esi + eax*4]
xor eax, eax
cmp ecx, esi
je 0x1001427b
mov ecx, dword [ecx + 4]
cmp edx, dword [ecx + 8]
jne 0x10014267
cmp ecx, dword [ebp - 0x14]
je 0x1001427b
mov eax, dword [ecx + 0xc]
add esp, 0xc
pop esi
pop edi
pop ebx
pop ebp
ret 4

Function at 0x10014290
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0xc
mov esi, dword [ebp + 8]
cmp dword [ecx + 0x1f3c], esi
jbe 0x100142ba
mov eax, dword [ecx + 0x1f40]
mov ecx, dword [eax + esi*4]
xor eax, eax
cmp ecx, 0xffffffff
cmovne eax, ecx
jmp 0x1001435b
mov ebx, esi
shr ebx, 0x10
mov edx, esi
shr edx, 8
mov eax, 0xff
mov edi, esi
and edi, eax
and edx, eax
and ebx, eax
mov eax, esi
shr eax, 0x18
mov dword [ebp - 0x18], edi
xor edi, 0x811c9dc5
imul edi, edi, 0x1000193
xor edi, edx
imul edi, edi, 0x1000193
xor edi, ebx
imul edi, edi, 0x1000193
xor edi, eax
imul eax, edi, 0x1000193
and eax, dword [ecx + 0x1f5c]
mov edi, dword [ecx + 0x1f48]
mov ecx, dword [ecx + 0x1f50]
mov dword [ebp - 0x10], ecx
mov ecx, dword [ecx + eax*8 + 4]
mov dword [ebp - 0x14], edi
cmp ecx, edi
je 0x10014339
and esi, 0xff000000
shl ebx, 0x10
or ebx, esi
shl edx, 8
or edx, ebx
add edx, dword [ebp - 0x18]
cmp edx, dword [ecx + 8]
jne 0x1001433d
xor eax, eax
jmp 0x10014353
xor eax, eax
jmp 0x1001435b
add eax, eax
mov esi, dword [ebp - 0x10]
mov esi, dword [esi + eax*4]
xor eax, eax
cmp ecx, esi
je 0x1001435b
mov ecx, dword [ecx + 4]
cmp edx, dword [ecx + 8]
jne 0x10014347
cmp ecx, dword [ebp - 0x14]
je 0x1001435b
mov eax, dword [ecx + 0xc]
add esp, 0xc
pop esi
pop edi
pop ebx
pop ebp
ret 4
Function at 0x100148a0
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0xc
mov esi, dword [ebp + 8]
cmp dword [ecx + 0x1ea4], esi
jbe 0x100148ca
mov eax, dword [ecx + 0x1ea8]
mov ecx, dword [eax + esi*4]
xor eax, eax
cmp ecx, 0xffffffff
cmovne eax, ecx
jmp 0x1001496b
mov ebx, esi
shr ebx, 0x10
mov edx, esi
shr edx, 8
mov eax, 0xff
mov edi, esi
and edi, eax
and edx, eax
and ebx, eax
mov eax, esi
shr eax, 0x18
mov dword [ebp - 0x18], edi
xor edi, 0x811c9dc5
imul edi, edi, 0x1000193
xor edi, edx
imul edi, edi, 0x1000193
xor edi, ebx
imul edi, edi, 0x1000193
xor edi, eax
imul eax, edi, 0x1000193
and eax, dword [ecx + 0x1ec4]
mov edi, dword [ecx + 0x1eb0]
mov ecx, dword [ecx + 0x1eb8]
mov dword [ebp - 0x10], ecx
mov ecx, dword [ecx + eax*8 + 4]
mov dword [ebp - 0x14], edi
cmp ecx, edi
je 0x10014949
and esi, 0xff000000
shl ebx, 0x10
or ebx, esi
shl edx, 8
or edx, ebx
add edx, dword [ebp - 0x18]
cmp edx, dword [ecx + 8]
jne 0x1001494d
xor eax, eax
jmp 0x10014963
xor eax, eax
jmp 0x1001496b
add eax, eax
mov esi, dword [ebp - 0x10]
mov esi, dword [esi + eax*4]
xor eax, eax
cmp ecx, esi
je 0x1001496b
mov ecx, dword [ecx + 4]
cmp edx, dword [ecx + 8]
jne 0x10014957
cmp ecx, dword [ebp - 0x14]
je 0x1001496b
mov eax, dword [ecx + 0xc]
add esp, 0xc
pop esi
pop edi
pop ebx
pop ebp
ret 4
Function at 0x10015b90
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x14
mov esi, ecx
mov edx, dword [ebp + 0xc]
mov edi, dword [ebp + 8]
mov eax, dword [ecx + 0x136c]
cmp dword [eax + 0x2c], edx
jbe 0x10015bbf
mov eax, dword [eax + 0x30]
mov eax, dword [eax + edx*4]
xor ebx, ebx
cmp eax, 0xffffffff
cmovne ebx, eax
jmp 0x10015c47
mov dword [ebp - 0x10], esi
mov esi, edx
shr esi, 0x10
mov ecx, edx
shr ecx, 8
mov ebx, 0xff
mov edi, edx
and edi, ebx
and ecx, ebx
and esi, ebx
mov ebx, edx
shr ebx, 0x18
mov dword [ebp - 0x20], edi
xor edi, 0x811c9dc5
imul edi, edi, 0x1000193
xor edi, ecx
imul edi, edi, 0x1000193
xor edi, esi
imul edi, edi, 0x1000193
xor edi, ebx
imul ebx, edi, 0x1000193
and ebx, dword [eax + 0x4c]
mov edi, dword [eax + 0x38]
mov eax, dword [eax + 0x40]
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x18], eax
mov eax, dword [eax + ebx*8 + 4]
xor ebx, ebx
cmp eax, edi
je 0x10015c41
and edx, 0xff000000
shl esi, 0x10
or esi, edx
shl ecx, 8
or ecx, esi
add ecx, dword [ebp - 0x20]
cmp ecx, dword [eax + 8]
mov dword [ebp - 0x14], edi
jne 0x10015c87
mov esi, dword [ebp - 0x10]
mov edi, dword [ebp + 8]
jmp 0x10015ca4
mov esi, dword [ebp - 0x10]
mov edi, dword [ebp + 8]
mov edx, dword [ebp + 0x10]
lea ecx, [esi + 8]
movzx eax, byte [ebp + 0x14]
push dword [ebp + 0x20]
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push eax
push edx
push ebx
push edi
push esi
call fcn.10089f90
shl edi, 4
add edi, dword [esi + 0x21b0]
lea eax, [ebx + 0x18]
test ebx, ebx
cmove eax, ebx
mov ecx, edi
push eax
call fcn.1004f290
add esp, 0x14
pop esi
pop edi
pop ebx
pop ebp
ret 0x1c
mov edx, dword [ebp - 0x1c]
add edx, edx
mov esi, dword [ebp - 0x18]
mov edx, dword [esi + edx*4]
mov esi, dword [ebp - 0x10]
mov edi, dword [ebp + 8]
cmp eax, edx
je 0x10015c47
mov eax, dword [eax + 4]
cmp ecx, dword [eax + 8]
jne 0x10015c98
cmp eax, dword [ebp - 0x14]
mov edx, dword [ebp + 0x10]
je 0x10015c4a
mov ebx, dword [eax + 0xc]
jmp 0x10015c4a
Function at 0x10015cc0
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x14
mov esi, ecx
mov ecx, dword [ebp + 8]
lea edi, [esi + 8]
mov edx, dword [esi + 0x1368]
cmp dword [edx + 0x54], ecx
jbe 0x10015cf0
mov eax, dword [edx + 0x58]
mov ebx, dword [eax + ecx*4]
cmp ebx, 0xffffffff
jne 0x10015d9e
jmp 0x10015db5
mov dword [ebp - 0x10], edi
mov dword [ebp - 0x14], esi
mov edi, ecx
shr edi, 0x10
mov eax, ecx
shr eax, 8
mov esi, 0xff
mov ebx, ecx
and ebx, esi
and eax, esi
and edi, esi
mov esi, ecx
shr esi, 0x18
mov dword [ebp - 0x20], ebx
xor ebx, 0x811c9dc5
imul ebx, ebx, 0x1000193
xor ebx, eax
imul ebx, ebx, 0x1000193
xor ebx, edi
imul ebx, ebx, 0x1000193
xor ebx, esi
imul esi, ebx, 0x1000193
and esi, dword [edx + 0x74]
mov ebx, dword [edx + 0x60]
mov edx, dword [edx + 0x68]
mov dword [ebp - 0x18], edx
mov edx, dword [edx + esi*8 + 4]
mov dword [ebp - 0x1c], ebx
cmp edx, ebx
je 0x10015d72
and ecx, 0xff000000
shl edi, 0x10
or edi, ecx
shl eax, 8
or eax, edi
add eax, dword [ebp - 0x20]
cmp eax, dword [edx + 8]
jne 0x10015d7a
mov esi, dword [ebp - 0x14]
mov edi, dword [ebp - 0x10]
xor ebx, ebx
jmp 0x10015d96
mov esi, dword [ebp - 0x14]
mov edi, dword [ebp - 0x10]
jmp 0x10015db5
add esi, esi
mov ecx, dword [ebp - 0x18]
mov ecx, dword [ecx + esi*4]
mov esi, dword [ebp - 0x14]
mov edi, dword [ebp - 0x10]
xor ebx, ebx
cmp edx, ecx
je 0x10015db7
mov edx, dword [edx + 4]
cmp eax, dword [edx + 8]
jne 0x10015d8a
cmp edx, dword [ebp - 0x1c]
je 0x10015db7
mov ebx, dword [edx + 0xc]
test ebx, ebx
je 0x10015db5
cmp dword [ebx + 0x158], 0
je 0x10015db7
mov ecx, ebx
push esi
call fcn.100599c0
jmp 0x10015db7
xor ebx, ebx
mov ecx, edi
push ebx
push esi
call fcn.10086c30
cmp eax, 1
je 0x10015dd2
lea ecx, [esi + 0x1fe0]
mov edx, esi
call fcn.10015de0
add esp, 0x14
pop esi
pop edi
pop ebx
pop ebp
ret 4
Function at 0x10016010
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0xc
mov esi, ecx
mov edx, dword [ebp + 0x10]
mov ebx, dword [ebp + 0xc]
mov edi, dword [ecx + 0x1368]
cmp dword [edi + 0x54], edx
jbe 0x1001603f
mov eax, dword [edi + 0x58]
mov eax, dword [eax + edx*4]
xor ecx, ecx
cmp eax, 0xffffffff
cmovne ecx, eax
jmp 0x100160c3
mov dword [ebp - 0x10], esi
mov eax, edx
shr eax, 0x10
mov ecx, edx
shr ecx, 8
mov esi, 0xff
mov ebx, edx
and ebx, esi
and ecx, esi
and eax, esi
mov esi, edx
shr esi, 0x18
mov dword [ebp - 0x18], ebx
xor ebx, 0x811c9dc5
imul ebx, ebx, 0x1000193
xor ebx, ecx
imul ebx, ebx, 0x1000193
xor ebx, eax
imul ebx, ebx, 0x1000193
xor ebx, esi
imul esi, ebx, 0x1000193
and esi, dword [edi + 0x74]
mov ebx, dword [edi + 0x60]
mov edi, dword [edi + 0x68]
mov dword [ebp - 0x14], edi
mov edi, dword [edi + esi*8 + 4]
cmp edi, ebx
je 0x100160bb
and edx, 0xff000000
shl eax, 0x10
or eax, edx
shl ecx, 8
or ecx, eax
add ecx, dword [ebp - 0x18]
cmp ecx, dword [edi + 8]
jne 0x100160f1
mov edx, ebx
mov esi, dword [ebp - 0x10]
mov ebx, dword [ebp + 0xc]
jmp 0x1001610d
mov esi, dword [ebp - 0x10]
xor ecx, ecx
mov ebx, dword [ebp + 0xc]
mov eax, dword [ebp + 8]
mov edi, ecx
mov ecx, dword [esi + 0x1380]
mov edx, dword [esi + 0x1d14]
push eax
call fcn.10016130
add esp, 4
mov ecx, eax
push edi
push ebx
push esi
call fcn.10073fb0
add esp, 0xc
pop esi
pop edi
pop ebx
pop ebp
ret 0xc
mov edx, ebx
add esi, esi
mov eax, dword [ebp - 0x14]
mov eax, dword [eax + esi*4]
mov esi, dword [ebp - 0x10]
mov ebx, dword [ebp + 0xc]
cmp edi, eax
je 0x1001611e
mov edi, dword [edi + 4]
cmp ecx, dword [edi + 8]
jne 0x10016101
cmp edi, edx
mov eax, dword [ebp + 8]
mov ecx, 0
je 0x100160c6
mov ecx, dword [edi + 0xc]
jmp 0x100160c6
mov eax, dword [ebp + 8]
xor ecx, ecx
jmp 0x100160c6
Function at 0x100163c0
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x24
mov esi, edx
mov edi, ecx
mov eax, dword [0x1038000c]
xor eax, ebp
mov dword [ebp - 0x10], eax
cmp dword [ecx + 0x1f3c], edx
jbe 0x100163f6
mov eax, dword [edi + 0x1f40]
mov ebx, dword [eax + esi*4]
cmp ebx, 0xffffffff
jne 0x100164a5
jmp 0x100164ad
mov eax, esi
shr eax, 0x18
mov dword [ebp - 0x20], eax
mov ebx, esi
shr ebx, 0x10
mov eax, esi
shr eax, 8
mov edx, esi
mov ecx, 0xff
and edx, ecx
and eax, ecx
and ebx, ecx
mov dword [ebp - 0x2c], edx
xor edx, 0x811c9dc5
imul edx, edx, 0x1000193
xor edx, eax
imul edx, edx, 0x1000193
xor edx, ebx
imul edx, edx, 0x1000193
xor edx, dword [ebp - 0x20]
imul ecx, edx, 0x1000193
and ecx, dword [edi + 0x1f5c]
mov edx, dword [edi + 0x1f48]
mov dword [ebp - 0x20], edx
mov edx, dword [edi + 0x1f50]
mov dword [ebp - 0x28], ecx
mov dword [ebp - 0x30], edx
mov ecx, dword [edx + ecx*8 + 4]
cmp ecx, dword [ebp - 0x20]
je 0x100164ad
mov dword [ebp - 0x24], edi
mov edi, esi
and edi, 0xff000000
shl ebx, 0x10
or ebx, edi
shl eax, 8
or eax, ebx
add eax, dword [ebp - 0x2c]
cmp eax, dword [ecx + 8]
jne 0x10016483
mov edi, dword [ebp - 0x24]
jmp 0x1001649d
mov edx, dword [ebp - 0x28]
add edx, edx
mov edi, dword [ebp - 0x30]
mov edx, dword [edi + edx*4]
mov edi, dword [ebp - 0x24]
cmp ecx, edx
je 0x100164ad
mov ecx, dword [ecx + 4]
cmp eax, dword [ecx + 8]
jne 0x10016491
cmp ecx, dword [ebp - 0x20]
je 0x100164ad
mov ebx, dword [ecx + 0xc]
test ebx, ebx
jne 0x100165ab
push 0x58
call dword [sym.imp.mozglue.dll_moz_xmalloc]
add esp, 4
mov ebx, eax
lea eax, [edi + 0x28]
mov ecx, ebx
push eax
push esi
push dword [edi + 0x1d14]
call fcn.10092560
inc dword [ebx + 4]
mov dword [ebp - 0x1c], esi
cmp esi, 0x3fff
ja 0x1001658b
mov eax, dword [edi + 0x1f3c]
cmp eax, esi
ja 0x10016580
mov ecx, edi
mov edi, eax
add eax, eax
cmp edi, esi
jbe 0x100164ee
mov dword [ebp - 0x24], ecx
mov eax, dword [ecx + 0x1f40]
mov dword [ebp - 0x20], eax
lea eax, [edi*4]
xor ecx, ecx
dec ecx
cmp edi, 0x40000000
cmovb ecx, eax
push ecx
call dword [sym.imp.mozglue.dll_moz_xmalloc]
add esp, 4
mov dword [ebp - 0x2c], eax
mov ecx, dword [ebp - 0x24]
mov dword [ecx + 0x1f40], eax
mov ecx, dword [ecx + 0x1f3c]
lea edx, [eax + ecx*4]
mov eax, ecx
mov dword [ebp - 0x28], ecx
mov ecx, edi
sub ecx, eax
shl ecx, 2
push ecx
push 0xff
push edx
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
mov eax, dword [ebp - 0x28]
shl eax, 2
push eax
push dword [ebp - 0x20]
push dword [ebp - 0x2c]
call sub.VCRUNTIME140.dll_memcpy
mov eax, dword [ebp - 0x20]
add esp, 0xc
mov ecx, dword [ebp - 0x24]
mov dword [ecx + 0x1f3c], edi
mov edi, ecx
test eax, eax
je 0x10016580
push eax
call dword [sym.imp.mozglue.dll_free]
add esp, 4
shl esi, 2
add esi, dword [edi + 0x1f40]
jmp 0x100165a9
add edi, 0x1f44
lea eax, [ebp - 0x1c]
lea esi, [ebp - 0x18]
mov ecx, edi
mov edx, esi
push eax
call fcn.1002ddc0
add esp, 4
mov esi, dword [esi]
add esi, 0xc
mov dword [esi], ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.10212780
mov eax, ebx
add esp, 0x24
pop esi
pop edi
pop ebx
pop ebp
ret