joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1002a7b0
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x2c
mov edx, ecx
mov ecx, dword [ebp + 8]
mov eax, dword [0x1038100c]
xor eax, ebp
mov dword [ebp - 0x10], eax
mov edi, dword [edx + 0x1278]
cmp dword [edi + 0x60], ecx
jbe 0x1002a7e7
mov eax, dword [edi + 0x64]
mov esi, dword [eax + ecx*4]
cmp esi, 0xffffffff
jne 0x1002a880
jmp 0x1002a897
mov dword [ebp - 0x30], edx
mov ebx, ecx
shr ebx, 0x10
mov esi, ecx
shr esi, 8
mov eax, 0xff
mov edx, ecx
and edx, eax
and esi, eax
and ebx, eax
mov eax, ecx
shr eax, 0x18
xor edx, 0x811c9dc5
imul edx, edx, 0x1000193
xor edx, esi
imul edx, edx, 0x1000193
xor edx, ebx
imul edx, edx, 0x1000193
xor edx, eax
imul eax, edx, 0x1000193
and eax, dword [edi + 0x80]
mov edx, dword [edi + 0x6c]
mov edi, dword [edi + 0x74]
shl ebx, 0x10
and ecx, 0xff0000ff
or ecx, ebx
mov dword [ebp - 0x38], edi
mov edi, dword [edi + eax*8]
add eax, eax
inc eax
mov dword [ebp - 0x34], eax
shl esi, 8
or ecx, esi
mov ebx, edi
cmp edx, edi
je 0x1002a865
mov eax, dword [ebp - 0x38]
mov esi, dword [ebp - 0x34]
mov eax, dword [eax + esi*4]
mov eax, dword [eax]
jmp 0x1002a867
mov eax, edi
xor esi, esi
cmp ebx, eax
je 0x1002a899
cmp dword [ebx + 8], ecx
je 0x1002a876
mov ebx, dword [ebx]
jmp 0x1002a854
cmp ebx, edx
je 0x1002a899
mov esi, dword [ebx + 0xc]
mov edx, dword [ebp - 0x30]
test esi, esi
je 0x1002a897
cmp dword [esi + 0x174], 0
je 0x1002a899
mov ecx, esi
push edx
call fcn.1005d010
jmp 0x1002a899
xor esi, esi
mov dword [ebp - 0x14], 0xf
mov dword [ebp - 0x18], 0
mov byte [ebp - 0x28], 0
mov ebx, dword [ebp + 0xc]
push ebx
call sub.api_ms_win_crt_string_l1_1_0.dll_strlen
add esp, 4
mov edi, eax
cmp eax, 0xf
jbe 0x1002a8d9
sub esp, 0xc
mov al, byte [ebp - 0x2c]
mov byte [esp + 4], al
mov dword [esp + 8], ebx
mov dword [esp], edi
lea ecx, [ebp - 0x28]
call fcn.10001080
jmp 0x1002a8ef
lea eax, [ebp - 0x28]
mov dword [eax + 0x10], edi
push edi
push ebx
push eax
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
mov byte [ebp + edi - 0x28], 0
lea edi, [ebp - 0x28]
mov ecx, esi
push edi
call fcn.1005ecb0
mov esi, eax
mov ecx, dword [edi + 0x14]
cmp ecx, 0x10
jb 0x1002a91a
mov eax, dword [ebp - 0x28]
inc ecx
cmp ecx, 0x1000
jae 0x1002a930
push eax
call dword [sym.imp.mozglue.dll_free]
add esp, 4
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1021e470
mov eax, esi
add esp, 0x2c
pop esi
pop edi
pop ebx
pop ebp
ret 8
mov ecx, dword [eax - 4]
add eax, 0xfffffffc
sub eax, ecx
cmp eax, 0x20
jae 0x1002a941
mov eax, ecx
jmp 0x1002a910
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
Function at 0x1002ac50
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0xc
mov eax, dword [ebp + 8]
mov edx, dword [ecx + 0x1278]
cmp dword [edx + 0x60], eax
mov dword [ebp - 0x10], ecx
jbe 0x1002acac
mov edx, dword [edx + 0x64]
mov ebx, dword [edx + eax*4]
xor esi, esi
cmp ebx, 0xffffffff
mov edi, ebx
cmove edi, esi
cmp byte [ecx + 0x1ed5], 0
setne dl
cmp dword [ebp + 0xc], 0x91b1
sete al
or al, dl
cmove edi, esi
cmp ebx, 0xffffffff
je 0x1002ad87
test al, al
mov edx, dword [ebp + 0xc]
je 0x1002ad93
jmp 0x1002adb3
mov esi, eax
shr esi, 0x10
mov edi, eax
shr edi, 8
mov ecx, 0xff
mov ebx, eax
and ebx, ecx
and edi, ecx
and esi, ecx
mov ecx, eax
shr ecx, 0x18
xor ebx, 0x811c9dc5
imul ebx, ebx, 0x1000193
xor ebx, edi
imul ebx, ebx, 0x1000193
xor ebx, esi
imul ebx, ebx, 0x1000193
xor ebx, ecx
imul ebx, ebx, 0x1000193
and ebx, dword [edx + 0x80]
mov ecx, dword [edx + 0x6c]
mov edx, dword [edx + 0x74]
shl esi, 0x10
and eax, 0xff0000ff
or eax, esi
mov dword [ebp - 0x18], edx
mov esi, ebx
mov ebx, dword [edx + ebx*8]
lea edx, [esi + esi]
inc edx
mov dword [ebp - 0x14], edx
shl edi, 8
or eax, edi
mov esi, ebx
cmp ecx, ebx
je 0x1002ad29
mov edx, dword [ebp - 0x18]
mov edi, dword [ebp - 0x14]
mov edx, dword [edx + edi*4]
mov edx, dword [edx]
jmp 0x1002ad2b
mov edx, ebx
xor edi, edi
cmp esi, edx
je 0x1002ad3d
cmp dword [esi + 8], eax
mov edx, dword [ebp + 0xc]
je 0x1002ad42
mov esi, dword [esi]
jmp 0x1002ad18
mov edx, dword [ebp + 0xc]
jmp 0x1002ad49
cmp esi, ecx
je 0x1002ad49
mov edi, dword [esi + 0xc]
cmp edx, 0x91b1
je 0x1002adb3
mov edx, dword [ebp - 0x10]
cmp byte [edx + 0x1ed5], 0
mov edx, dword [ebp + 0xc]
jne 0x1002adb3
mov esi, ebx
cmp ecx, ebx
je 0x1002ad73
mov edx, dword [ebp - 0x18]
mov edi, dword [ebp - 0x14]
mov edx, dword [edx + edi*4]
mov edx, dword [edx]
jmp 0x1002ad75
mov edx, ebx
xor edi, edi
cmp esi, edx
je 0x1002ad87
cmp dword [esi + 8], eax
mov edx, dword [ebp + 0xc]
je 0x1002ad8c
mov esi, dword [esi]
jmp 0x1002ad62
mov edx, dword [ebp + 0xc]
jmp 0x1002adb3
cmp esi, ecx
je 0x1002adb3
mov ebx, dword [esi + 0xc]
test ebx, ebx
je 0x1002adb1
cmp dword [ebx + 0x174], 0
je 0x1002adad
mov ecx, ebx
push dword [ebp - 0x10]
call fcn.1005d010
mov edx, dword [ebp + 0xc]
mov edi, ebx
jmp 0x1002adb3
xor edi, edi
push dword [ebp + 0x10]
push edx
push edi
push dword [ebp - 0x10]
call fcn.100af3a0
add esp, 0x1c
pop esi
pop edi
pop ebx
pop ebp
ret 0xc
Function at 0x1002ae10
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 8
mov eax, ecx
mov ecx, dword [ebp + 8]
mov esi, dword [eax + 0x1278]
cmp dword [esi + 0x60], ecx
jbe 0x1002ae36
shl ecx, 2
add ecx, dword [esi + 0x64]
mov edx, ecx
jmp 0x1002aec5
mov dword [ebp - 0x10], eax
mov ebx, ecx
shr ebx, 0x10
mov edi, ecx
shr edi, 8
mov eax, 0xff
mov edx, ecx
and edx, eax
and edi, eax
and ebx, eax
mov eax, ecx
shr eax, 0x18
xor edx, 0x811c9dc5
imul edx, edx, 0x1000193
xor edx, edi
imul edx, edx, 0x1000193
xor edx, ebx
imul edx, edx, 0x1000193
xor edx, eax
imul eax, edx, 0x1000193
and eax, dword [esi + 0x80]
mov edx, dword [esi + 0x6c]
mov esi, dword [esi + 0x74]
shl ebx, 0x10
and ecx, 0xff0000ff
or ecx, ebx
mov dword [ebp - 0x14], esi
mov esi, dword [esi + eax*8]
add eax, eax
inc eax
shl edi, 8
or ecx, edi
mov edi, esi
cmp edx, esi
je 0x1002aeae
mov ebx, dword [ebp - 0x14]
mov ebx, dword [ebx + eax*4]
mov ebx, dword [ebx]
jmp 0x1002aeb0
mov ebx, esi
cmp edi, ebx
je 0x1002aebf
cmp dword [edi + 8], ecx
je 0x1002aebd
mov edi, dword [edi]
jmp 0x1002aea0
mov edx, edi
add edx, 0xc
mov eax, dword [ebp - 0x10]
mov ebx, dword [ebp + 0x10]
mov edi, dword [ebp + 0xc]
mov esi, dword [edx]
cmp dword [esi + 0x174], 0
je 0x1002aede
mov ecx, esi
push eax
call fcn.1005d010
mov ecx, dword [esi + 0x100]
add ecx, 0x30
push dword [ebp + 0x14]
push ebx
push edi
call fcn.10057960
add esp, 8
pop esi
pop edi
pop ebx
pop ebp
ret 0x10

Function at 0x1002b120
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0xc
mov eax, dword [ebp + 8]
mov dword [ebp - 0x10], ecx
mov edx, dword [ecx + 0x1278]
cmp dword [edx + 0x60], eax
jbe 0x1002b14e
mov ecx, dword [edx + 0x64]
mov edi, dword [ecx + eax*4]
cmp edi, 0xffffffff
jne 0x1002b1e0
jmp 0x1002b1f9
mov ebx, eax
shr ebx, 0x10
mov edi, eax
shr edi, 8
mov ecx, 0xff
mov esi, eax
and esi, ecx
and edi, ecx
and ebx, ecx
mov ecx, eax
shr ecx, 0x18
xor esi, 0x811c9dc5
imul esi, esi, 0x1000193
xor esi, edi
imul esi, esi, 0x1000193
xor esi, ebx
imul esi, esi, 0x1000193
xor esi, ecx
imul esi, esi, 0x1000193
and esi, dword [edx + 0x80]
mov ecx, dword [edx + 0x6c]
mov edx, dword [edx + 0x74]
shl ebx, 0x10
and eax, 0xff0000ff
or eax, ebx
mov dword [ebp - 0x18], edx
mov edx, dword [edx + esi*8]
add esi, esi
inc esi
mov dword [ebp - 0x14], esi
shl edi, 8
or eax, edi
mov ebx, edx
cmp ecx, edx
je 0x1002b1c8
mov esi, dword [ebp - 0x18]
mov edi, dword [ebp - 0x14]
mov esi, dword [esi + edi*4]
mov esi, dword [esi]
jmp 0x1002b1ca
mov esi, edx
xor edi, edi
cmp ebx, esi
je 0x1002b1fb
cmp dword [ebx + 8], eax
je 0x1002b1d9
mov ebx, dword [ebx]
jmp 0x1002b1b7
cmp ebx, ecx
je 0x1002b1fb
mov edi, dword [ebx + 0xc]
test edi, edi
je 0x1002b1f9
cmp dword [edi + 0x174], 0
je 0x1002b1fb
mov ecx, edi
push dword [ebp - 0x10]
call fcn.1005d010
jmp 0x1002b1fb
xor edi, edi
mov ecx, edi
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp - 0x10]
call fcn.10061410
add esp, 0xc
pop esi
pop edi
pop ebx
pop ebp
ret 0xc
Function at 0x1002b220
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0xc
mov eax, dword [ebp + 8]
mov dword [ebp - 0x10], ecx
mov edx, dword [ecx + 0x1278]
cmp dword [edx + 0x60], eax
jbe 0x1002b24e
mov ecx, dword [edx + 0x64]
mov edi, dword [ecx + eax*4]
cmp edi, 0xffffffff
jne 0x1002b2e0
jmp 0x1002b2f9
mov ebx, eax
shr ebx, 0x10
mov edi, eax
shr edi, 8
mov ecx, 0xff
mov esi, eax
and esi, ecx
and edi, ecx
and ebx, ecx
mov ecx, eax
shr ecx, 0x18
xor esi, 0x811c9dc5
imul esi, esi, 0x1000193
xor esi, edi
imul esi, esi, 0x1000193
xor esi, ebx
imul esi, esi, 0x1000193
xor esi, ecx
imul esi, esi, 0x1000193
and esi, dword [edx + 0x80]
mov ecx, dword [edx + 0x6c]
mov edx, dword [edx + 0x74]
shl ebx, 0x10
and eax, 0xff0000ff
or eax, ebx
mov dword [ebp - 0x18], edx
mov edx, dword [edx + esi*8]
add esi, esi
inc esi
mov dword [ebp - 0x14], esi
shl edi, 8
or eax, edi
mov ebx, edx
cmp ecx, edx
je 0x1002b2c8
mov esi, dword [ebp - 0x18]
mov edi, dword [ebp - 0x14]
mov esi, dword [esi + edi*4]
mov esi, dword [esi]
jmp 0x1002b2ca
mov esi, edx
xor edi, edi
cmp ebx, esi
je 0x1002b2fb
cmp dword [ebx + 8], eax
je 0x1002b2d9
mov ebx, dword [ebx]
jmp 0x1002b2b7
cmp ebx, ecx
je 0x1002b2fb
mov edi, dword [ebx + 0xc]
test edi, edi
je 0x1002b2f9
cmp dword [edi + 0x174], 0
je 0x1002b2fb
mov ecx, edi
push dword [ebp - 0x10]
call fcn.1005d010
jmp 0x1002b2fb
xor edi, edi
mov ecx, edi
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp - 0x10]
call fcn.100616c0
add esp, 0xc
pop esi
pop edi
pop ebx
pop ebp
ret 0xc
Function at 0x1002b320
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x2c
mov edx, ecx
mov ecx, dword [ebp + 8]
mov eax, dword [0x1038100c]
xor eax, ebp
mov dword [ebp - 0x10], eax
mov edi, dword [edx + 0x1278]
cmp dword [edi + 0x60], ecx
jbe 0x1002b357
mov eax, dword [edi + 0x64]
mov esi, dword [eax + ecx*4]
cmp esi, 0xffffffff
jne 0x1002b3f0
jmp 0x1002b407
mov dword [ebp - 0x30], edx
mov ebx, ecx
shr ebx, 0x10
mov esi, ecx
shr esi, 8
mov eax, 0xff
mov edx, ecx
and edx, eax
and esi, eax
and ebx, eax
mov eax, ecx
shr eax, 0x18
xor edx, 0x811c9dc5
imul edx, edx, 0x1000193
xor edx, esi
imul edx, edx, 0x1000193
xor edx, ebx
imul edx, edx, 0x1000193
xor edx, eax
imul eax, edx, 0x1000193
and eax, dword [edi + 0x80]
mov edx, dword [edi + 0x6c]
mov edi, dword [edi + 0x74]
shl ebx, 0x10
and ecx, 0xff0000ff
or ecx, ebx
mov dword [ebp - 0x38], edi
mov edi, dword [edi + eax*8]
add eax, eax
inc eax
mov dword [ebp - 0x34], eax
shl esi, 8
or ecx, esi
mov ebx, edi
cmp edx, edi
je 0x1002b3d5
mov eax, dword [ebp - 0x38]
mov esi, dword [ebp - 0x34]
mov eax, dword [eax + esi*4]
mov eax, dword [eax]
jmp 0x1002b3d7
mov eax, edi
xor esi, esi
cmp ebx, eax
je 0x1002b409
cmp dword [ebx + 8], ecx
je 0x1002b3e6
mov ebx, dword [ebx]
jmp 0x1002b3c4
cmp ebx, edx
je 0x1002b409
mov esi, dword [ebx + 0xc]
mov edx, dword [ebp - 0x30]
test esi, esi
je 0x1002b407
cmp dword [esi + 0x174], 0
je 0x1002b409
mov ecx, esi
push edx
call fcn.1005d010
jmp 0x1002b409
xor esi, esi
mov dword [ebp - 0x14], 0xf
mov dword [ebp - 0x18], 0
mov byte [ebp - 0x28], 0
mov ebx, dword [ebp + 0xc]
push ebx
call sub.api_ms_win_crt_string_l1_1_0.dll_strlen
add esp, 4
mov edi, eax
cmp eax, 0xf
jbe 0x1002b449
sub esp, 0xc
mov al, byte [ebp - 0x2c]
mov byte [esp + 4], al
mov dword [esp + 8], ebx
mov dword [esp], edi
lea ecx, [ebp - 0x28]
call fcn.10001080
jmp 0x1002b45f
lea eax, [ebp - 0x28]
mov dword [eax + 0x10], edi
push edi
push ebx
push eax
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
mov byte [ebp + edi - 0x28], 0
lea edi, [ebp - 0x28]
lea ebx, [ebp - 0x2c]
mov ecx, esi
push edi
push ebx
call fcn.10060050
mov esi, dword [ebx]
mov ecx, dword [edi + 0x14]
cmp ecx, 0x10
jb 0x1002b48e
mov eax, dword [ebp - 0x28]
inc ecx
cmp ecx, 0x1000
jae 0x1002b4a4
push eax
call dword [sym.imp.mozglue.dll_free]
add esp, 4
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1021e470
mov eax, esi
add esp, 0x2c
pop esi
pop edi
pop ebx
pop ebp
ret 8
mov ecx, dword [eax - 4]
add eax, 0xfffffffc
sub eax, ecx
cmp eax, 0x20
jae 0x1002b4b5
mov eax, ecx
jmp 0x1002b484
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
Function at 0x1002b4c0
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 8
mov eax, dword [ebp + 8]
test eax, eax
je 0x1002b4ee
mov edx, dword [ecx + 0x1278]
cmp dword [edx + 0x60], eax
jbe 0x1002b4f5
mov ecx, dword [edx + 0x64]
mov eax, dword [ecx + eax*4]
xor edx, edx
cmp eax, 0xffffffff
cmovne edx, eax
jmp 0x1002b58a
xor eax, eax
jmp 0x1002b58f
mov edi, eax
shr edi, 0x10
mov esi, eax
shr esi, 8
mov ecx, 0xff
mov ebx, eax
and ebx, ecx
and esi, ecx
and edi, ecx
mov ecx, eax
shr ecx, 0x18
xor ebx, 0x811c9dc5
imul ebx, ebx, 0x1000193
xor ebx, esi
imul ebx, ebx, 0x1000193
xor ebx, edi
imul ebx, ebx, 0x1000193
xor ebx, ecx
imul ebx, ebx, 0x1000193
and ebx, dword [edx + 0x80]
mov ecx, dword [edx + 0x6c]
mov edx, dword [edx + 0x74]
shl edi, 0x10
and eax, 0xff0000ff
or eax, edi
mov dword [ebp - 0x14], edx
mov edi, ebx
mov ebx, dword [edx + ebx*8]
lea edx, [edi + edi]
inc edx
mov dword [ebp - 0x10], edx
shl esi, 8
or eax, esi
mov esi, ebx
cmp ecx, ebx
je 0x1002b572
mov edx, dword [ebp - 0x14]
mov edi, dword [ebp - 0x10]
mov edx, dword [edx + edi*4]
mov edi, dword [edx]
jmp 0x1002b574
mov edi, ebx
xor edx, edx
cmp esi, edi
je 0x1002b58a
cmp dword [esi + 8], eax
je 0x1002b583
mov esi, dword [esi]
jmp 0x1002b561
cmp esi, ecx
je 0x1002b58a
mov edx, dword [esi + 0xc]
test edx, edx
setne al
add esp, 8
pop esi
pop edi
pop ebx
pop ebp
ret 4

Function at 0x1002b5a0
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 8
mov eax, dword [ebp + 8]
test eax, eax
je 0x1002b5ce
mov edx, dword [ecx + 0x127c]
cmp dword [edx + 0x38], eax
jbe 0x1002b5d5
mov ecx, dword [edx + 0x3c]
mov eax, dword [ecx + eax*4]
xor edx, edx
cmp eax, 0xffffffff
cmovne edx, eax
jmp 0x1002b667
xor eax, eax
jmp 0x1002b66c
mov edi, eax
shr edi, 0x10
mov esi, eax
shr esi, 8
mov ecx, 0xff
mov ebx, eax
and ebx, ecx
and esi, ecx
and edi, ecx
mov ecx, eax
shr ecx, 0x18
xor ebx, 0x811c9dc5
imul ebx, ebx, 0x1000193
xor ebx, esi
imul ebx, ebx, 0x1000193
xor ebx, edi
imul ebx, ebx, 0x1000193
xor ebx, ecx
imul ebx, ebx, 0x1000193
and ebx, dword [edx + 0x58]
mov ecx, dword [edx + 0x44]
mov edx, dword [edx + 0x4c]
shl edi, 0x10
and eax, 0xff0000ff
or eax, edi
mov dword [ebp - 0x14], edx
mov edi, ebx
mov ebx, dword [edx + ebx*8]
lea edx, [edi + edi]
inc edx
mov dword [ebp - 0x10], edx
shl esi, 8
or eax, esi
mov esi, ebx
cmp ecx, ebx
je 0x1002b64f
mov edx, dword [ebp - 0x14]
mov edi, dword [ebp - 0x10]
mov edx, dword [edx + edi*4]
mov edi, dword [edx]
jmp 0x1002b651
mov edi, ebx
xor edx, edx
cmp esi, edi
je 0x1002b667
cmp dword [esi + 8], eax
je 0x1002b660
mov esi, dword [esi]
jmp 0x1002b63e
cmp esi, ecx
je 0x1002b667
mov edx, dword [esi + 0xc]
test edx, edx
setne al
add esp, 8
pop esi
pop edi
pop ebx
pop ebp
ret 4
Function at 0x1002b680
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0xc
mov esi, ecx
mov eax, dword [ebp + 8]
mov edx, dword [ecx + 0x1278]
cmp dword [edx + 0x60], eax
jbe 0x1002b6ac
mov ecx, dword [edx + 0x64]
mov eax, dword [ecx + eax*4]
xor edi, edi
cmp eax, 0xffffffff
cmovne edi, eax
jmp 0x1002b749
mov dword [ebp - 0x10], esi
mov ebx, eax
shr ebx, 0x10
mov edi, eax
shr edi, 8
mov ecx, 0xff
mov esi, eax
and esi, ecx
and edi, ecx
and ebx, ecx
mov ecx, eax
shr ecx, 0x18
xor esi, 0x811c9dc5
imul esi, esi, 0x1000193
xor esi, edi
imul esi, esi, 0x1000193
xor esi, ebx
imul esi, esi, 0x1000193
xor esi, ecx
imul esi, esi, 0x1000193
and esi, dword [edx + 0x80]
mov ecx, dword [edx + 0x6c]
mov edx, dword [edx + 0x74]
shl ebx, 0x10
and eax, 0xff0000ff
or eax, ebx
mov dword [ebp - 0x18], edx
mov edx, dword [edx + esi*8]
add esi, esi
inc esi
mov dword [ebp - 0x14], esi
shl edi, 8
or eax, edi
mov ebx, edx
cmp ecx, edx
je 0x1002b729
mov esi, dword [ebp - 0x18]
mov edi, dword [ebp - 0x14]
mov esi, dword [esi + edi*4]
mov esi, dword [esi]
jmp 0x1002b72b
mov esi, edx
xor edi, edi
cmp ebx, esi
je 0x1002b73a
cmp dword [ebx + 8], eax
je 0x1002b73f
mov ebx, dword [ebx]
jmp 0x1002b718
mov esi, dword [ebp - 0x10]
jmp 0x1002b749
cmp ebx, ecx
mov esi, dword [ebp - 0x10]
je 0x1002b749
mov edi, dword [ebx + 0xc]
mov ecx, edi
push esi
call fcn.10059c70
cmp eax, 1
je 0x1002b7a1
cmp dword [edi + 0x17c], 0
je 0x1002b7a1
cmp dword [edi + 0x174], 0
je 0x1002b770
mov ecx, edi
push esi
call fcn.1005d010
cmp byte [edi + 0x170], 0
je 0x1002b794
lea ecx, [esi + 8]
push edi
push esi
call fcn.10080350
cmp eax, 1
je 0x1002b7a1
add edi, 4
mov ecx, edi
push 8
call fcn.100544f0
lea ecx, [esi + 0x1ef8]
mov edx, esi
call fcn.1001d170
add esp, 0xc
pop esi
pop edi
pop ebx
pop ebp
ret 4
Function at 0x1002b7b0
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 8
mov edx, dword [ebp + 8]
mov edi, dword [ecx + 0x1278]
cmp dword [edi + 0x60], edx
jbe 0x1002b7fa
mov eax, dword [edi + 0x64]
mov eax, dword [eax + edx*4]
xor esi, esi
cmp eax, 0xffffffff
cmovne esi, eax
mov edi, dword [ebp + 0x10]
mov edx, dword [ebp + 0xc]
mov ecx, esi
mov ebx, dword [ebp + 0x14]
push ebx
push edx
call fcn.10059ad0
mov ecx, esi
push ebx
push edi
call fcn.10059ba0
add esp, 8
pop esi
pop edi
pop ebx
pop ebp
ret 0x10
mov eax, edx
shr eax, 0x10
mov esi, edx
shr esi, 8
mov ecx, 0xff
mov ebx, edx
and ebx, ecx
and esi, ecx
and eax, ecx
mov ecx, edx
shr ecx, 0x18
xor ebx, 0x811c9dc5
imul ebx, ebx, 0x1000193
xor ebx, esi
imul ebx, ebx, 0x1000193
xor ebx, eax
imul ebx, ebx, 0x1000193
xor ebx, ecx
imul ebx, ebx, 0x1000193
and ebx, dword [edi + 0x80]
mov ecx, dword [edi + 0x6c]
mov edi, dword [edi + 0x74]
shl eax, 0x10
and edx, 0xff0000ff
or edx, eax
mov dword [ebp - 0x14], edi
mov edi, dword [edi + ebx*8]
lea eax, [ebx + ebx]
inc eax
mov dword [ebp - 0x10], eax
shl esi, 8
or edx, esi
mov eax, edi
cmp ecx, edi
je 0x1002b876
mov esi, dword [ebp - 0x14]
mov ebx, dword [ebp - 0x10]
mov esi, dword [esi + ebx*4]
mov ebx, dword [esi]
jmp 0x1002b878
mov ebx, edi
xor esi, esi
cmp eax, ebx
je 0x1002b7d5
cmp dword [eax + 8], edx
je 0x1002b88b
mov eax, dword [eax]
jmp 0x1002b865
cmp eax, ecx
mov edi, dword [ebp + 0x10]
mov edx, dword [ebp + 0xc]
je 0x1002b7db
mov esi, dword [eax + 0xc]
jmp 0x1002b7db

Function at 0x1002b8b0
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 8
mov edx, dword [ebp + 8]
mov ebx, dword [ecx + 0x1278]
cmp dword [ebx + 0x60], edx
jbe 0x1002b8f8
mov eax, dword [ebx + 0x64]
mov eax, dword [eax + edx*4]
xor esi, esi
cmp eax, 0xffffffff
cmovne esi, eax
mov edi, dword [ebp + 0x10]
mov edx, dword [ebp + 0xc]
mov ecx, esi
push edi
push edx
call fcn.10059ad0
mov ecx, esi
push edi
push 0
call fcn.10059ba0
add esp, 8
pop esi
pop edi
pop ebx
pop ebp
ret 0xc
mov eax, edx
shr eax, 0x10
mov esi, edx
shr esi, 8
mov ecx, 0xff
mov edi, edx
and edi, ecx
and esi, ecx
and eax, ecx
mov ecx, edx
shr ecx, 0x18
xor edi, 0x811c9dc5
imul edi, edi, 0x1000193
xor edi, esi
imul edi, edi, 0x1000193
xor edi, eax
imul edi, edi, 0x1000193
xor edi, ecx
imul edi, edi, 0x1000193
and edi, dword [ebx + 0x80]
mov ecx, dword [ebx + 0x6c]
mov ebx, dword [ebx + 0x74]
shl eax, 0x10
and edx, 0xff0000ff
or edx, eax
mov dword [ebp - 0x14], ebx
mov ebx, dword [ebx + edi*8]
lea eax, [edi + edi]
inc eax
mov dword [ebp - 0x10], eax
shl esi, 8
or edx, esi
mov eax, ebx
cmp ecx, ebx
je 0x1002b974
mov esi, dword [ebp - 0x14]
mov edi, dword [ebp - 0x10]
mov esi, dword [esi + edi*4]
mov edi, dword [esi]
jmp 0x1002b976
mov edi, ebx
xor esi, esi
cmp eax, edi
je 0x1002b8d5
cmp dword [eax + 8], edx
je 0x1002b989
mov eax, dword [eax]
jmp 0x1002b963
cmp eax, ecx
mov edi, dword [ebp + 0x10]
mov edx, dword [ebp + 0xc]
je 0x1002b8db
mov esi, dword [eax + 0xc]
jmp 0x1002b8db
Function at 0x1002b9a0
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x2c
mov edx, ecx
mov ecx, dword [ebp + 8]
mov eax, dword [0x1038100c]
xor eax, ebp
mov dword [ebp - 0x10], eax
mov edi, dword [edx + 0x1278]
cmp dword [edi + 0x60], ecx
jbe 0x1002b9d7
mov eax, dword [edi + 0x64]
mov esi, dword [eax + ecx*4]
cmp esi, 0xffffffff
jne 0x1002ba70
jmp 0x1002ba87
mov dword [ebp - 0x30], edx
mov ebx, ecx
shr ebx, 0x10
mov esi, ecx
shr esi, 8
mov eax, 0xff
mov edx, ecx
and edx, eax
and esi, eax
and ebx, eax
mov eax, ecx
shr eax, 0x18
xor edx, 0x811c9dc5
imul edx, edx, 0x1000193
xor edx, esi
imul edx, edx, 0x1000193
xor edx, ebx
imul edx, edx, 0x1000193
xor edx, eax
imul eax, edx, 0x1000193
and eax, dword [edi + 0x80]
mov edx, dword [edi + 0x6c]
mov edi, dword [edi + 0x74]
shl ebx, 0x10
and ecx, 0xff0000ff
or ecx, ebx
mov dword [ebp - 0x38], edi
mov edi, dword [edi + eax*8]
add eax, eax
inc eax
mov dword [ebp - 0x34], eax
shl esi, 8
or ecx, esi
mov ebx, edi
cmp edx, edi
je 0x1002ba55
mov eax, dword [ebp - 0x38]
mov esi, dword [ebp - 0x34]
mov eax, dword [eax + esi*4]
mov eax, dword [eax]
jmp 0x1002ba57
mov eax, edi
xor esi, esi
cmp ebx, eax
je 0x1002ba89
cmp dword [ebx + 8], ecx
je 0x1002ba66
mov ebx, dword [ebx]
jmp 0x1002ba44
cmp ebx, edx
je 0x1002ba89
mov esi, dword [ebx + 0xc]
mov edx, dword [ebp - 0x30]
test esi, esi
je 0x1002ba87
cmp dword [esi + 0x174], 0
je 0x1002ba89
mov ecx, esi
push edx
call fcn.1005d010
jmp 0x1002ba89
xor esi, esi
mov dword [ebp - 0x14], 0xf
mov dword [ebp - 0x18], 0
mov byte [ebp - 0x28], 0
mov ebx, dword [ebp + 0xc]
push ebx
call sub.api_ms_win_crt_string_l1_1_0.dll_strlen
add esp, 4
mov edi, eax
cmp eax, 0xf
jbe 0x1002bac9
sub esp, 0xc
mov al, byte [ebp - 0x2c]
mov byte [esp + 4], al
mov dword [esp + 8], ebx
mov dword [esp], edi
lea ecx, [ebp - 0x28]
call fcn.10001080
jmp 0x1002badf
lea eax, [ebp - 0x28]
mov dword [eax + 0x10], edi
push edi
push ebx
push eax
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
mov byte [ebp + edi - 0x28], 0
lea edi, [ebp - 0x28]
mov ecx, esi
push edi
call fcn.1005fd40
mov esi, eax
mov ecx, dword [edi + 0x14]
cmp ecx, 0x10
jb 0x1002bb0a
mov eax, dword [ebp - 0x28]
inc ecx
cmp ecx, 0x1000
jae 0x1002bb20
push eax
call dword [sym.imp.mozglue.dll_free]
add esp, 4
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1021e470
mov eax, esi
add esp, 0x2c
pop esi
pop edi
pop ebx
pop ebp
ret 8
mov ecx, dword [eax - 4]
add eax, 0xfffffffc
sub eax, ecx
cmp eax, 0x20
jae 0x1002bb31
mov eax, ecx
jmp 0x1002bb00
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3