joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100042f0
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [ebp + 0xc]
mov edx, ecx
push ebx
mov ebx, dword [ebp + 8]
mov dword [ebp - 0x10], edx
cmp ebx, eax
je 0x10004461
mov eax, dword [edx + 4]
mov dword [ebp - 0x14], eax
mov eax, dword [ebx + 4]
mov dword [ebp - 4], eax
movzx eax, byte [ebx + 8]
xor eax, 0x811c9dc5
imul ecx, eax, 0x1000193
movzx eax, byte [ebx + 9]
push esi
push edi
mov edi, dword [edx + 0xc]
mov esi, ebx
xor ecx, eax
mov dword [ebp - 0x1c], edi
movzx eax, byte [ebx + 0xa]
imul ecx, ecx, 0x1000193
xor ecx, eax
movzx eax, byte [ebx + 0xb]
imul ecx, ecx, 0x1000193
xor ecx, eax
mov eax, dword [edx + 0x18]
imul ecx, ecx, 0x1000193
and eax, ecx
mov ecx, dword [edi + eax*8]
mov dword [ebp - 0xc], ecx
lea eax, [edi + eax*8]
mov dword [ebp - 8], eax
mov eax, dword [eax + 4]
mov dword [ebp - 0x18], eax
nop word [eax + eax]
mov edi, esi
mov ebx, esi
mov esi, dword [esi]
lea ecx, [edi + 0xc]
call fcn.10005010
push 0x2c
push edi
call fcn.1006ccbf
mov edx, dword [ebp - 0x10]
add esp, 8
dec dword [edx + 8]
cmp ebx, dword [ebp - 0x18]
je 0x100043bd
mov eax, dword [ebp + 0xc]
cmp esi, eax
jne 0x10004370
mov ecx, dword [ebp - 0xc]
cmp ecx, dword [ebp + 8]
jne 0x10004457
mov edi, dword [ebp - 8]
mov ecx, dword [ebp - 4]
mov dword [edi], esi
mov dword [ecx], esi
pop edi
mov dword [esi + 4], ecx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
mov ecx, dword [ebp - 0xc]
mov edi, dword [ebp - 8]
cmp ecx, dword [ebp + 8]
jne 0x100043d1
mov eax, dword [ebp - 0x14]
mov ecx, eax
mov dword [edi], eax
jmp 0x100043d4
mov ecx, dword [ebp - 4]
mov eax, dword [ebp + 0xc]
mov dword [edi + 4], ecx
cmp esi, eax
je 0x10004457
nop
movzx eax, byte [esi + 8]
xor eax, 0x811c9dc5
imul ecx, eax, 0x1000193
movzx eax, byte [esi + 9]
xor ecx, eax
movzx eax, byte [esi + 0xa]
imul ecx, ecx, 0x1000193
xor ecx, eax
movzx eax, byte [esi + 0xb]
imul ecx, ecx, 0x1000193
xor ecx, eax
mov eax, dword [edx + 0x18]
imul ecx, ecx, 0x1000193
and eax, ecx
mov ecx, dword [ebp - 0x1c]
lea eax, [ecx + eax*8]
mov dword [ebp + 8], eax
mov eax, dword [eax + 4]
mov dword [ebp - 0x18], eax
mov edi, esi
mov ebx, esi
mov esi, dword [esi]
lea ecx, [edi + 0xc]
call fcn.10005010
push 0x2c
push edi
call fcn.1006ccbf
mov edx, dword [ebp - 0x10]
add esp, 8
mov eax, dword [ebp + 0xc]
dec dword [edx + 8]
cmp ebx, dword [ebp - 0x18]
je 0x10004468
cmp esi, eax
jne 0x10004427
mov ecx, dword [ebp + 8]
mov dword [ecx], esi
mov ecx, dword [ebp - 4]
pop edi
mov dword [ecx], esi
mov dword [esi + 4], ecx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
mov ecx, dword [ebp + 8]
mov ebx, dword [ebp - 0x14]
mov dword [ecx], ebx
mov dword [ecx + 4], ebx
cmp esi, eax
jne 0x100043e0
mov ecx, dword [ebp - 4]
pop edi
mov dword [ecx], esi
mov dword [esi + 4], ecx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x100074c0
Capabilities:
Hash data using fnv

Disassembly:
mov al, byte [ecx]
test al, al
jne 0x100074c9
mov eax, edx
ret
movsx eax, al
xor eax, edx
imul edx, eax, 0x1000193
inc ecx
jmp fcn.100074c0
Function at 0x100076a0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov eax, dword fs:[0x2c]
sub esp, 0x34
mov edx, dword [0x101e66ac]
push esi
mov edx, dword [eax + edx*4]
mov esi, ecx
mov eax, dword [0x101e66f4]
push edi
cmp eax, dword [edx + 4]
jg 0x100076f2
mov eax, dword [0x101ee120]
mov edi, dword [0x101e6710]
cmp dword [eax + esi], 0
jne 0x100076e5
mov eax, dword [0x101ee194]
mov ecx, esi
call eax
mov eax, dword [0x101ee120]
push dword [eax + esi]
mov ecx, esi
call edi
pop edi
pop esi
mov esp, ebp
pop ebp
ret
push 0x101e66f4
call fcn.1006d20f
add esp, 4
cmp dword [0x101e66f4], 0xffffffff
jne 0x100076c6
movaps xmm0, xmmword [0x1017fed0]
xor eax, eax
movaps xmm2, xmmword [0x1017fe80]
movups xmmword [ebp - 0x32], xmm0
mov dword [ebp - 0x12], 0xf490e0f4
movaps xmm0, xmmword [0x101800f0]
movups xmmword [ebp - 0x22], xmm0
mov word [ebp - 0xe], 0xe092
mov byte [ebp - 0xc], 0xd4
jmp 0x10007740
movups xmm0, xmmword [ebp + eax - 0x32]
movaps xmm1, xmm2
xorps xmm1, xmm0
movups xmmword [ebp + eax - 0x32], xmm1
add eax, 0x10
cmp eax, 0x20
jb 0x10007740
cmp eax, 0x27
jae 0x1000776d
jmp 0x10007760
xor byte [ebp + eax - 0x32], 0xd4
inc eax
cmp eax, 0x27
jb 0x10007760
jmp 0x1000776d
mov dword [ebp - 0xb], 0xb1bdb8b7
xor eax, eax
mov dword [ebp - 7], 0xb0faa0ba
mov word [ebp - 3], 0xb8b8
mov byte [ebp - 1], 0xd4
jmp 0x10007790
xor byte [ebp + eax - 0xb], 0xd4
inc eax
cmp eax, 0xb
jb 0x10007790
lea edx, [ebp - 0x32]
lea ecx, [ebp - 0xb]
call fcn.100c52b0
push 0x101e66f4
mov dword [0x101e6710], eax
call fcn.1006d1be
add esp, 4
jmp 0x100076c6
Function at 0x10008b70
Capabilities:
Access peb ldr_data
Get process heap flags
Get process heap force flags

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10144c6a
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
push esi
push edi
mov edi, ecx
mov dword [ebp - 0x10], edi
push 0x18
mov dword [edi], 0
mov dword [edi + 4], 0
call fcn.1006cc8f
mov dword [eax], eax
mov dword [eax + 4], eax
mov dword [eax + 8], eax
mov word [eax + 0xc], 0x101
mov dword [edi], eax
lea esi, [edi + 8]
mov dword [ebp - 4], 0
push 0x18
mov dword [ebp - 0x14], esi
mov dword [esi], 0
mov dword [esi + 4], 0
call fcn.1006cc8f
mov dword [eax], eax
mov dword [eax + 4], eax
mov dword [eax + 8], eax
mov word [eax + 0xc], 0x101
mov dword [esi], eax
lea esi, [edi + 0x10]
mov byte [ebp - 4], 1
push 0x18
mov dword [ebp - 0x14], esi
mov dword [esi], 0
mov dword [esi + 4], 0
call fcn.1006cc8f
mov dword [eax], eax
mov dword [eax + 4], eax
mov dword [eax + 8], eax
mov word [eax + 0xc], 0x101
mov dword [esi], eax
lea esi, [edi + 0x18]
mov byte [ebp - 4], 2
push 0x18
mov dword [ebp - 0x14], esi
mov dword [esi], 0
mov dword [esi + 4], 0
call fcn.1006cc8f
mov dword [eax], eax
mov dword [eax + 4], eax
mov dword [eax + 8], eax
mov word [eax + 0xc], 0x101
mov dword [esi], eax
lea esi, [edi + 0x20]
mov byte [ebp - 4], 3
push 0x18
mov dword [ebp - 0x14], esi
mov dword [esi], 0
mov dword [esi + 4], 0
call fcn.1006cc8f
mov dword [eax], eax
mov dword [eax + 4], eax
mov dword [eax + 8], eax
mov word [eax + 0xc], 0x101
mov dword [esi], eax
lea esi, [edi + 0x28]
mov byte [ebp - 4], 4
push 0x18
mov dword [ebp - 0x14], esi
mov dword [esi], 0
mov dword [esi + 4], 0
call fcn.1006cc8f
mov dword [eax], eax
mov dword [eax + 4], eax
mov dword [eax + 8], eax
mov word [eax + 0xc], 0x101
mov dword [esi], eax
mov byte [ebp - 4], 5
lea esi, [edi + 0x30]
push 0x20
mov dword [ebp - 0x14], esi
mov dword [esi], 0
mov dword [esi + 4], 0
call fcn.1006cc8f
mov dword [eax], eax
mov dword [eax + 4], eax
mov dword [eax + 8], eax
mov word [eax + 0xc], 0x101
mov dword [esi], eax
lea esi, [edi + 0x38]
mov byte [ebp - 4], 6
push 0x18
mov dword [ebp - 0x14], esi
mov dword [esi], 0
mov dword [esi + 4], 0
call fcn.1006cc8f
mov dword [eax], eax
mov dword [eax + 4], eax
mov dword [eax + 8], eax
mov word [eax + 0xc], 0x101
mov dword [esi], eax
lea esi, [edi + 0x40]
mov byte [ebp - 4], 7
push 0x18
mov dword [ebp - 0x14], esi
mov dword [esi], 0
mov dword [esi + 4], 0
call fcn.1006cc8f
mov ecx, dword [ebp - 0xc]
add esp, 0x24
mov dword [eax], eax
mov dword [eax + 4], eax
mov dword [eax + 8], eax
mov word [eax + 0xc], 0x101
mov dword [esi], eax
mov eax, edi
pop edi
pop esi
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
Function at 0x1000b6f0
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10144e25
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x10
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, ecx
movzx eax, byte [edi]
xor eax, 0x811c9dc5
imul edx, eax, 0x1000193
movzx eax, byte [edi + 1]
xor edx, eax
movzx eax, byte [edi + 2]
imul edx, edx, 0x1000193
xor edx, eax
movzx eax, byte [edi + 3]
imul ecx, edx, 0x1000193
xor ecx, eax
lea eax, [ebp - 0x14]
imul ebx, ecx, 0x1000193
mov ecx, esi
push ebx
push edi
push eax
call fcn.1000c220
mov eax, dword [ebp - 0x10]
test eax, eax
jne 0x1000b810
cmp dword [esi + 8], 0xfffffff
jne 0x1000b771
push str.unordered_map_set_too_long
call dword [sym.imp.MSVCP140.dll_void___cdecl_std::_Xlength_error_char_const__]
lea eax, [esi + 4]
mov dword [ebp - 0x1c], eax
mov dword [ebp - 4], 0
push 0x10
mov dword [ebp - 0x18], 0
call fcn.1006cc8f
mov dword [ebp - 0x18], eax
add esp, 4
lea ecx, [eax + 8]
mov eax, dword [edi]
mov dword [ebp + 8], ecx
mov dword [ecx], eax
mov byte [ecx + 4], 0
mov dword [ebp - 4], 1
mov eax, dword [esi + 8]
inc eax
movd xmm0, eax
cvtdq2pd xmm0, xmm0
shr eax, 0x1f
addsd xmm0, qword [eax*8 + 0x1017f9d0]
mov eax, dword [esi + 0x1c]
cvtpd2ps xmm1, xmm0
movd xmm0, eax
cvtdq2pd xmm0, xmm0
shr eax, 0x1f
addsd xmm0, qword [eax*8 + 0x1017f9d0]
cvtpd2ps xmm0, xmm0
divss xmm1, xmm0
comiss xmm1, dword [esi]
jbe 0x1000b801
mov ecx, esi
call fcn.1000c140
push ebx
push dword [ebp + 8]
lea eax, [ebp - 0x14]
mov ecx, esi
push eax
call fcn.1000c220
mov ecx, dword [eax]
jmp 0x1000b804
mov ecx, dword [ebp - 0x14]
push dword [ebp - 0x18]
push ecx
push ebx
mov ecx, esi
call fcn.1000c1a0
mov ecx, dword [ebp - 0xc]
add eax, 0xc
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x1000bda0
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
sub esp, 0x18
mov edx, dword [ebp + 8]
push ebx
mov ebx, ecx
cmp edx, eax
je 0x1000bef6
mov eax, dword [ebx + 4]
mov dword [ebp - 0x10], eax
mov eax, dword [edx + 4]
mov dword [ebp - 4], eax
movzx eax, byte [edx + 8]
xor eax, 0x811c9dc5
imul ecx, eax, 0x1000193
movzx eax, byte [edx + 9]
push esi
push edi
mov edi, dword [ebx + 0xc]
mov esi, edx
xor ecx, eax
mov dword [ebp - 0x18], edi
movzx eax, byte [edx + 0xa]
imul ecx, ecx, 0x1000193
xor ecx, eax
movzx eax, byte [edx + 0xb]
imul ecx, ecx, 0x1000193
xor ecx, eax
mov eax, dword [ebx + 0x18]
imul ecx, ecx, 0x1000193
and eax, ecx
mov ecx, dword [edi + eax*8]
mov dword [ebp - 0xc], ecx
lea eax, [edi + eax*8]
mov dword [ebp - 8], eax
mov eax, dword [eax + 4]
mov dword [ebp - 0x14], eax
mov eax, esi
mov edi, esi
mov esi, dword [esi]
push 0x10
push eax
call fcn.1006ccbf
dec dword [ebx + 8]
add esp, 8
cmp edi, dword [ebp - 0x14]
je 0x1000be59
mov eax, dword [ebp + 0xc]
cmp esi, eax
jne 0x1000be17
mov ecx, dword [ebp - 0xc]
cmp ecx, dword [ebp + 8]
jne 0x1000beec
mov edx, dword [ebp - 8]
mov ecx, dword [ebp - 4]
pop edi
mov dword [edx], esi
mov dword [ecx], esi
mov dword [esi + 4], ecx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
mov ecx, dword [ebp - 0xc]
mov edx, dword [ebp - 8]
cmp ecx, dword [ebp + 8]
jne 0x1000be6d
mov eax, dword [ebp - 0x10]
mov ecx, eax
mov dword [edx], eax
jmp 0x1000be70
mov ecx, dword [ebp - 4]
mov eax, dword [ebp + 0xc]
mov dword [edx + 4], ecx
cmp esi, eax
je 0x1000beec
nop word [eax + eax]
movzx eax, byte [esi + 8]
xor eax, 0x811c9dc5
imul ecx, eax, 0x1000193
movzx eax, byte [esi + 9]
xor ecx, eax
movzx eax, byte [esi + 0xa]
imul ecx, ecx, 0x1000193
xor ecx, eax
movzx eax, byte [esi + 0xb]
imul ecx, ecx, 0x1000193
xor ecx, eax
mov eax, dword [ebx + 0x18]
imul ecx, ecx, 0x1000193
and eax, ecx
mov ecx, dword [ebp - 0x18]
lea eax, [ecx + eax*8]
mov dword [ebp + 8], eax
mov eax, dword [eax + 4]
mov dword [ebp - 0x14], eax
mov eax, esi
mov edi, esi
mov esi, dword [esi]
push 0x10
push eax
call fcn.1006ccbf
dec dword [ebx + 8]
add esp, 8
mov eax, dword [ebp + 0xc]
cmp edi, dword [ebp - 0x14]
je 0x1000befd
cmp esi, eax
jne 0x1000bec7
mov ecx, dword [ebp + 8]
mov dword [ecx], esi
mov ecx, dword [ebp - 4]
pop edi
mov dword [ecx], esi
mov dword [esi + 4], ecx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
mov ecx, dword [ebp + 8]
mov edx, dword [ebp - 0x10]
mov dword [ecx], edx
mov dword [ecx + 4], edx
cmp esi, eax
jne 0x1000be80
mov ecx, dword [ebp - 4]
pop edi
mov dword [ecx], esi
mov dword [esi + 4], ecx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x1000cb70
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
xorps xmm0, xmm0
mov dword [0x101e6c80], 0
movq qword [0x101e6c88], xmm0
xor eax, eax
movups xmmword [0x101e6cac], xmm0
mov dword [0x101e6c84], 0
movq qword [0x101e6cbc], xmm0
movq qword [0x101e6d14], xmm0
movaps xmmword [0x101e6d20], xmm0
movaps xmmword [0x101e6d40], xmm0
movaps xmm0, xmmword [0x1017fad0]
movups xmmword [ebp - 0x38], xmm0
mov dword [0x101e6c90], 0
movaps xmm0, xmmword [0x10180180]
mov dword [0x101e6c9c], 0
mov dword [0x101e6c98], 0
mov dword [0x101e6c94], 0
mov dword [0x101e6ca8], 0
mov dword [0x101e6ca4], 0
mov dword [0x101e6ca0], 0
mov dword [0x101e6cc4], 0
mov dword [0x101e6cd0], 0
mov dword [0x101e6ccc], 0
mov dword [0x101e6cc8], 0
mov dword [0x101e6cdc], 0
mov dword [0x101e6cd8], 0
mov dword [0x101e6cd4], 0
mov dword [0x101e6ce8], 0
mov dword [0x101e6ce4], 0
mov dword [0x101e6ce0], 0
mov dword [0x101e6cec], 0
mov dword [0x101e6cf8], 0
mov dword [0x101e6cf4], 0
mov dword [0x101e6cf0], 0
mov dword [0x101e6d04], 0
mov dword [0x101e6d00], 0
mov dword [0x101e6cfc], 0
mov dword [0x101e6d10], 0
mov dword [0x101e6d0c], 0
mov dword [0x101e6d08], 0
mov dword [0x101e6d1c], 0
mov dword [0x101e6d30], 0
mov dword [0x101e6d3c], 0
mov dword [0x101e6d38], 0
mov dword [0x101e6d34], 0
mov dword [0x101e6d50], 0
mov dword [0x101e6d54], 0
mov dword [0x101e6d58], 0
mov dword [0x101e6d5c], 0
mov dword [0x101e6d60], 0
mov dword [0x101e6d64], 0
mov dword [0x101e6d68], 0
mov dword [0x101e6d6c], 0
mov dword [0x101e6d70], 0
mov dword [0x101e6d74], 0
mov dword [0x101e6d78], 0
movups xmmword [ebp - 0x28], xmm0
mov dword [ebp - 0x18], 0xf4ebf4eb
mov dword [ebp - 0x14], 0x97f4e7ec
mov dword [ebp - 0x10], 0xe0e4f4e0
mov byte [ebp - 0xc], 0xd4
nop dword [eax]
movups xmm0, xmmword [ebp + eax - 0x38]
movaps xmm1, xmmword [0x1017fe80]
xorps xmm1, xmm0
movups xmmword [ebp + eax - 0x38], xmm1
add eax, 0x10
cmp eax, 0x20
jb 0x1000cda0
cmp eax, 0x2d
jae 0x1000cdcc
xor byte [ebp + eax - 0x38], 0xd4
inc eax
cmp eax, 0x2d
jb 0x1000cdc1
mov dword [ebp - 0xb], 0xb1bdb8b7
xor eax, eax
mov dword [ebp - 7], 0xb0faa0ba
mov word [ebp - 3], 0xb8b8
mov byte [ebp - 1], 0xd4
xor byte [ebp + eax - 0xb], 0xd4
inc eax
cmp eax, 0xb
jb 0x1000cde6
lea edx, [ebp - 0x38]
lea ecx, [ebp - 0xb]
call fcn.100c52b0
movaps xmm0, xmmword [0x1017ffb0]
xorps xmm0, xmmword [0x1017fe80]
mov dword [ebp - 0x18], 0xf492e4f4
mov eax, dword [eax + 2]
mov dword [0x101e6c80], eax
mov eax, 0x10
mov dword [ebp - 0x14], 0xe0f4e4e5
mov dword [ebp - 0x10], 0xe4e6f4ec
mov byte [ebp - 0xc], 0xd4
movups xmmword [ebp - 0x28], xmm0
xor byte [ebp + eax - 0x28], 0xd4
inc eax
cmp eax, 0x1d
jb 0x1000ce34
mov dword [ebp - 0xb], 0xb1bdb8b7
xor eax, eax
mov dword [ebp - 7], 0xb0faa0ba
mov word [ebp - 3], 0xb8b8
mov byte [ebp - 1], 0xd4
nop dword [eax]
xor byte [ebp + eax - 0xb], 0xd4
inc eax
cmp eax, 0xb
jb 0x1000ce60
lea edx, [ebp - 0x28]
lea ecx, [ebp - 0xb]
call fcn.100c52b0
mov eax, dword [eax + 2]
mov dword [0x101e6c84], eax
mov eax, 0x101e6c80
mov esp, ebp
pop ebp
ret
Function at 0x1000dda0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
push esi
mov esi, ecx
push edi
test esi, esi
je 0x1000de0a
mov eax, dword [esi + 8]
lea ecx, [esi + 8]
call dword [eax + 0x28]
test eax, eax
je 0x1000de0a
mov eax, dword fs:[0x2c]
mov ecx, dword [0x101e66ac]
mov ecx, dword [eax + ecx*4]
mov eax, dword [0x101edf08]
cmp eax, dword [ecx + 4]
jg 0x1000de12
mov eax, dword [esi + 8]
lea ecx, [esi + 8]
call dword [eax + 8]
mov eax, dword [eax + 8]
cmp byte [eax], 0x43
jne 0x1000ddfb
mov al, byte [eax + 7]
cmp al, 0x74
je 0x1000ddf3
cmp al, 0x62
jne 0x1000ddfb
pop edi
mov al, 1
pop esi
mov esp, ebp
pop ebp
ret
mov eax, dword [0x101edf0c]
mov ecx, esi
call eax
pop edi
pop esi
mov esp, ebp
pop ebp
ret
pop edi
xor al, al
pop esi
mov esp, ebp
pop ebp
ret
push 0x101edf08
call fcn.1006d20f
add esp, 4
cmp dword [0x101edf08], 0xffffffff
jne 0x1000ddd7
movaps xmm0, xmmword [0x10180080]
xor eax, eax
movaps xmm2, xmmword [0x1017fe80]
movups xmmword [ebp - 0x2c], xmm0
mov byte [ebp - 0xc], 0xd4
movaps xmm0, xmmword [0x10180040]
movups xmmword [ebp - 0x1c], xmm0
jmp 0x1000de50
movups xmm0, xmmword [ebp + eax - 0x2c]
movaps xmm1, xmm2
xorps xmm1, xmm0
movups xmmword [ebp + eax - 0x2c], xmm1
add eax, 0x10
cmp eax, 0x20
jb 0x1000de50
cmp eax, 0x21
jae 0x1000de7d
jmp 0x1000de70
xor byte [ebp + eax - 0x2c], 0xd4
inc eax
cmp eax, 0x21
jb 0x1000de70
jmp 0x1000de7d
mov dword [ebp - 0xb], 0xb1bdb8b7
xor eax, eax
mov dword [ebp - 7], 0xb0faa0ba
mov word [ebp - 3], 0xb8b8
mov byte [ebp - 1], 0xd4
jmp 0x1000dea0
xor byte [ebp + eax - 0xb], 0xd4
inc eax
cmp eax, 0xb
jb 0x1000dea0
lea edx, [ebp - 0x2c]
lea ecx, [ebp - 0xb]
call fcn.100c52b0
push 0x101edf08
mov dword [0x101edf0c], eax
call fcn.1006d1be
add esp, 4
jmp 0x1000ddd7
Function at 0x1000f110
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
push 0x10171a68
push dword [ebp + 8]
mov edi, ecx
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fopen]
mov esi, eax
add esp, 8
test esi, esi
je 0x1000f1fd
push 2
push 0
push esi
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fseek]
add esp, 0xc
push esi
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_ftell]
add esp, 4
mov dword [ebp - 4], eax
test eax, eax
je 0x1000f1fd
mov ecx, dword [ebp + 0xc]
cmp ecx, 1
jne 0x1000f164
lea ebx, [ecx + 1]
jmp 0x1000f170
xor ebx, ebx
mov edx, 1
test ecx, ecx
cmove ebx, edx
add eax, ebx
push eax
call fcn.1006d273
add esp, 4
mov dword [ebp + 8], eax
push 0
push 0
push esi
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fseek]
add esp, 0xc
push esi
push dword [ebp - 4]
push 1
push dword [ebp + 8]
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
mov ecx, dword [ebp - 4]
add esp, 0x10
cmp eax, ecx
jne 0x1000f1fd
test ebx, ebx
je 0x1000f1bd
push ebx
mov ebx, dword [ebp + 8]
push 0
lea eax, [ebx + ecx]
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
jmp 0x1000f1c0
mov ebx, dword [ebp + 8]
push esi
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
add esp, 4
mov ecx, edi
push dword [ebp + 0xc]
push ebx
call fcn.1000f330
push ebx
call fcn.1006d27c
mov eax, dword [edi + 0x28]
add esp, 4
mov ecx, dword [eax]
test ecx, ecx
je 0x1000f1f6
cmp ecx, 0x20
jne 0x1000f208
mov ecx, dword [eax + 4]
add eax, 4
test ecx, ecx
jne 0x1000f1e7
mov dword [edi + 0x2c], 0
xor al, al
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
mov dword [edi + 0x2c], eax
test eax, eax
je 0x1000f1fd
push 0x20
call fcn.1006cc8f
xorps xmm0, xmm0
mov dword [ebp + 0xc], eax
add esp, 4
movq qword [eax], xmm0
lea ecx, [eax + 0xc]
mov dword [eax + 8], 0
mov dword [eax + 4], 1
mov dword [eax + 8], 1
mov dword [eax], vtable.std::_Ref_count_obj2_class_valve_parser::Node_.0
mov dword [ecx], vtable.valve_parser::Node.0
mov dword [ecx + 8], 0
mov dword [ecx + 0xc], 0
mov dword [ecx + 0x10], 0
mov dword [ecx + 4], edi
mov esi, dword [edi + 0x34]
mov dword [edi + 0x30], ecx
mov dword [edi + 0x34], eax
test esi, esi
je 0x1000f28d
or ebx, 0xffffffff
mov eax, ebx
lock xadd dword [esi + 4], eax
jne 0x1000f28d
mov eax, dword [esi]
mov ecx, esi
call dword [eax]
lock xadd dword [esi + 8], ebx
dec ebx
jne 0x1000f28d
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 4]
mov ecx, dword [edi + 0x30]
mov eax, dword [ecx]
mov eax, dword [eax]
call eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x1000fda0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10144fe5
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ebx
sub esp, 0x18
push esi
push edi
mov edi, dword [ebx + 8]
mov edx, ecx
mov dword [ebp - 0x14], edx
mov dword [ebp - 0x18], edi
cmp dword [edi + 0x14], 0xf
jbe 0x1000fde7
mov eax, dword [edi]
mov dword [ebp - 0x18], eax
xor ecx, ecx
mov esi, 0x811c9dc5
cmp dword [edi + 0x10], ecx
jbe 0x1000fe0b
mov edx, dword [ebp - 0x18]
movzx eax, byte [edx + ecx]
inc ecx
xor eax, esi
imul esi, eax, 0x1000193
cmp ecx, dword [edi + 0x10]
jb 0x1000fdf6
mov edx, dword [ebp - 0x14]
push esi
push edi
lea eax, [ebp - 0x24]
mov ecx, edx
push eax
call fcn.10010ff0
mov eax, dword [ebp - 0x20]
test eax, eax
jne 0x1000fef8
mov eax, dword [ebp - 0x14]
cmp dword [eax + 8], 0x4924924
jne 0x1000fe3a
push str.unordered_map_set_too_long
call dword [sym.imp.MSVCP140.dll_void___cdecl_std::_Xlength_error_char_const__]
add eax, 4
mov dword [ebp - 0x1c], eax
mov dword [ebp - 4], 0
push 0x38
mov dword [ebp - 0x18], 0
call fcn.1006cc8f
mov ecx, eax
add esp, 4
mov dword [ebp - 0x18], ecx
push edi
lea edi, [ecx + 8]
mov ecx, edi
call fcn.10002ed0
xorps xmm0, xmm0
movups xmmword [edi + 0x18], xmm0
mov dword [edi + 0x28], 0
mov dword [edi + 0x2c], 0xf
mov byte [edi + 0x18], 0
mov edi, dword [ebp - 0x14]
mov dword [ebp - 4], 1
mov eax, dword [edi + 8]
inc eax
movd xmm0, eax
cvtdq2pd xmm0, xmm0
shr eax, 0x1f
addsd xmm0, qword [eax*8 + 0x1017f9d0]
mov eax, dword [edi + 0x1c]
cvtpd2ps xmm1, xmm0
movd xmm0, eax
cvtdq2pd xmm0, xmm0
shr eax, 0x1f
addsd xmm0, qword [eax*8 + 0x1017f9d0]
cvtpd2ps xmm0, xmm0
divss xmm1, xmm0
comiss xmm1, dword [edi]
jbe 0x1000fee9
mov ecx, edi
call fcn.10011860
mov eax, dword [ebp - 0x18]
mov ecx, edi
push esi
add eax, 8
push eax
lea eax, [ebp - 0x24]
push eax
call fcn.10010ff0
mov ecx, dword [eax]
jmp 0x1000feec
mov ecx, dword [ebp - 0x24]
push dword [ebp - 0x18]
push ecx
push esi
mov ecx, edi
call fcn.1000c1a0
mov ecx, dword [ebp - 0xc]
add eax, 0x20
pop edi
mov dword fs:[0], ecx
pop esi
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret 4