joyce8/EMBER2024-capa huggingface dataset:
Function at 0x401a95
Capabilities:
Create process on windows
Create process suspended

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x198
mov dword [esp + 8], 0x104
lea eax, [ebp - 0x110]
mov dword [esp + 4], eax
mov dword [esp], 0
call sym._GetModuleFileNameA_12
sub esp, 0xc
mov dword [esp + 8], 0x44
mov dword [esp + 4], 0
lea eax, [ebp - 0x154]
mov dword [esp], eax
call sym._memset
mov dword [esp + 8], 0x10
mov dword [esp + 4], 0
lea eax, [ebp - 0x164]
mov dword [esp], eax
call sym._memset
mov dword [ebp - 0x154], 0x44
lea eax, [ebp - 0x164]
mov dword [esp + 0x24], eax
lea eax, [ebp - 0x154]
mov dword [esp + 0x20], eax
mov dword [esp + 0x1c], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
lea eax, [ebp - 0x110]
mov dword [esp + 4], eax
mov dword [esp], 0
call sym._CreateProcessA_40
sub esp, 0x28
mov eax, dword [ebp - 0x164]
mov dword [esp + 4], 0xffffffff
mov dword [esp], eax
call sym._WaitForSingleObject_8
sub esp, 8
mov eax, dword [ebp - 0x164]
mov dword [esp], eax
call sym._CloseHandle_4
sub esp, 4
mov eax, dword [ebp - 0x160]
mov dword [esp], eax
call sym._CloseHandle_4
sub esp, 4
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], pe_nt_image_headers32
mov dword [esp + 0x10], 3
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 0x40000000
lea eax, [ebp - 0x110]
mov dword [esp], eax
call sym._CreateFileA_28
sub esp, 0x1c
mov dword [ebp - 0xc], eax
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 0
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
call sym._SetFilePointer_16
sub esp, 0x10
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
call sym._SetEndOfFile_4
sub esp, 4
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
call sym._CloseHandle_4
sub esp, 4
nop
leave
ret
Function at 0x402490
Capabilities:
Get thread local storage value

Disassembly:
push esi
push ebx
sub esp, 0x14
mov dword [esp], 0x408044
call sym._EnterCriticalSection_4
mov ebx, dword [0x40803c]
sub esp, 4
test ebx, ebx
je 0x4024db
nop
mov eax, dword [ebx]
mov dword [esp], eax
call sym._TlsGetValue_4
sub esp, 4
mov esi, eax
call sym._GetLastError_0
test eax, eax
jne 0x4024d4
test esi, esi
je 0x4024d4
mov eax, dword [ebx + 4]
mov dword [esp], esi
call eax
mov ebx, dword [ebx + 8]
test ebx, ebx
jne 0x4024b0
mov dword [esp], 0x408044
call sym._LeaveCriticalSection_4
sub esp, 4
add esp, 0x14
pop ebx
pop esi
ret

Function at 0x4026c0
Capabilities:
Write file on windows

Disassembly:
push esi
push ebx
sub esp, 0x14
mov eax, dword [sym.imp.msvcrt.dll__iob]
mov dword [esp + 8], 0x17
mov dword [esp + 4], 1
lea esi, [esp + 0x24]
mov dword [esp], str.Mingw_runtime_failure:_n
lea ebx, [eax + 0x40]
mov dword [esp + 0xc], ebx
call sym._fwrite
mov eax, dword [esp + 0x20]
mov dword [esp + 8], esi
mov dword [esp], ebx
mov dword [esp + 4], eax
call sym._vfprintf
call sym._abort
lea esi, [esi]

Function at 0x402710
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
push edi
mov edi, ecx
push esi
push ebx
mov ebx, eax
mov esi, edx
sub esp, 0x4c
lea eax, [esp + 0x24]
mov dword [esp + 8], 0x1c
mov dword [esp], ebx
mov dword [esp + 4], eax
call sym._VirtualQuery_12
sub esp, 0xc
test eax, eax
je 0x4027e8
mov eax, dword [esp + 0x38]
cmp eax, 0x40
je 0x40274e
cmp eax, 4
jne 0x402770
mov dword [esp + 8], edi
mov dword [esp + 4], esi
mov dword [esp], ebx
call sym._memcpy
add esp, 0x4c
pop ebx
pop esi
pop edi
pop ebp
ret
mov eax, dword [esp + 0x30]
lea ebp, [esp + 0x20]
mov dword [esp + 8], 0x40
mov dword [esp + 0xc], ebp
mov dword [esp + 4], eax
mov eax, dword [esp + 0x24]
mov dword [esp], eax
call sym._VirtualProtect_16
sub esp, 0x10
mov edx, dword [esp + 0x38]
mov dword [esp + 8], edi
mov dword [esp + 4], esi
mov dword [esp], ebx
mov dword [esp + 0x1c], edx
call sym._memcpy
mov edx, dword [esp + 0x1c]
cmp edx, 0x40
je 0x40275e
cmp edx, 4
je 0x40275e
mov eax, dword [esp + 0x20]
mov dword [esp + 0xc], ebp
mov dword [esp + 8], eax
mov eax, dword [esp + 0x30]
mov dword [esp + 4], eax
mov eax, dword [esp + 0x24]
mov dword [esp], eax
call sym._VirtualProtect_16
sub esp, 0x10
add esp, 0x4c
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp + 8], ebx
mov dword [esp + 4], 0x1c
mov dword [esp], str.__VirtualQuery_failed_for__d_bytes_at_address__p
call fcn.004026c0
Function at 0x433001
Capabilities:
Encode data using xor

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
push 4
nop
nop
nop
nop
nop
pop edi
nop
nop
nop
nop
nop
nop
cmp eax, 0
nop
nop
je 0x433072
nop
nop
nop
mov ebx, 0x40de38
nop
nop
nop
nop
mov ecx, ebx
nop
nop
nop
nop
sub ecx, eax
nop
nop
xor edx, edx
nop
nop
nop
nop
push eax
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
nop
nop
div edi
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
pop eax
nop
nop
nop
mov esi, 0x317f6d19
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
nop
add eax, edi
nop
nop
loop 0x433060
nop
nop
nop
nop
mov eax, section..data
nop
nop
nop
nop
cmp eax, 0
nop
je 0x4330d2
nop
nop
nop
mov ebx, 0x4304d8
nop
nop
nop
nop
mov ecx, ebx
nop
nop
nop
sub ecx, eax
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
push eax
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
nop
nop
nop
div edi
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
pop eax
nop
nop
nop
nop
mov esi, 0x62d7649a
xor dword [eax], esi
nop
nop
nop
nop
add eax, edi
nop
nop
nop
nop
nop
nop
loop 0x4330c0
nop
nop
popal
nop
nop
nop
nop
nop
jmp 0x431219
Function at 0x421bf0
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x41c
mov eax, dword [0x42914c]
xor eax, esp
mov dword [esp + 0x418], eax
mov eax, dword [ebp + 8]
push ebx
push esi
xor esi, esi
push edi
mov dword [esp + 0xc], eax
cmp dword [ebp + 0xc], esi
jle 0x421ccb
mov edi, dword [sym.imp.KERNEL32.dll_IsBadStringPtrA]
mov ebx, dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringA]
cmp dword [ebp + 0xc], 0x2d
jne 0x421c58
push 0
push str.wilebamigehuteyebayo_mumajuzokirigulonusu_zuhokinuligoloy_visusanedefubiluyikipukewafeju_seroz
call edi
push str.rowozemunuloc_jin
push str.cimuzenaherepixekojicodofunibug
push str.netigeyonakozodosunobe_tonocekacawuruzowajuxipunud_votocorumuxehis
push str.vevonaluvodupamajicepeloponebe_wixereyobetiliverofeyayutoru_jetob_tufuhavojofefegodatuwud_sadusarilatedabuyoyumulipib
call ebx
push 0
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsA]
call fcn.00421b40
mov ecx, dword [esp + 0xc]
xor byte [ecx + esi], al
cmp dword [ebp + 0xc], 0xf
jne 0x421cc1
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
xor eax, eax
push eax
lea edx, [esp + 0x24]
push edx
push 0x426f90
mov dword [esp + 0x1e], eax
mov dword [esp + 0x22], eax
mov dword [esp + 0x26], eax
mov word [esp + 0x2a], ax
xor ecx, ecx
lea eax, [esp + 0x1c]
push eax
push ecx
push ecx
mov word [esp + 0x28], cx
call dword [sym.imp.KERNEL32.dll_GetTimeFormatA]
push 0x426f94
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetCalendarInfoW]
call dword [sym.imp.KERNEL32.dll_GetConsoleAliasExesLengthA]
inc esi
cmp esi, dword [ebp + 0xc]
jl 0x421c2b
cmp dword [ebp + 0xc], 0x2d
jne 0x421ce5
mov dword [0x42c8d0], 0xa62e7790
mov dword [0x42c8d4], 0xffffffff
mov ecx, dword [esp + 0x424]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.00401a6c
mov esp, ebp
pop ebp
ret
Function at 0x4220c0
Capabilities:
Access the windows event log
Manipulate console buffer
Set file attributes

Disassembly:
sub esp, 0x14
mov eax, dword [0x42c8c4]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_WriteConsoleOutputCharacterA]
push esi
mov dword [esp + 0x10], 0x1540b5
mov esi, dword [esp + 0x10]
push edi
mov edi, dword [esp + 0x14]
cmp eax, 0xcc1
jne 0x4220fa
call dword [sym.imp.KERNEL32.dll_GetConsoleOutputCP]
mov eax, dword [0x42c8c4]
mov dword [0x42c52c], 0x8e468c60
cmp eax, 0x3dc
jne 0x422159
push 0
push str.dafesatalosolovatuboboyuhiseheyu
call ebx
xor eax, eax
lea edx, [esp + 0x18]
push edx
push eax
push eax
push eax
push eax
mov dword [esp + 0x24], eax
call ebp
push 0
lea ecx, [esp + 0x20]
push ecx
lea edx, [esp + 0x28]
push edx
push esi
push 0
push 0
push edi
push 0
push 0
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_AccessCheckByTypeResultList]
push str.fudagugoholixihufeloko
push 0
push 0
call dword [sym.imp.KERNEL32.dll_OpenWaitableTimerA]
mov eax, dword [0x42c8c4]
dec dword [esp + 0x14]
jne 0x4220e8
mov edi, dword [sym.imp.ADVAPI32.dll_OpenEventLogW]
xor esi, esi
mov ebp, 0xec58acac
or ebx, 0xffffffff
nop
cmp eax, 0x997
jne 0x422182
push 0
push 0
call edi
mov eax, dword [0x42c8c4]
cmp esi, 0x846373
jne 0x422199
mov eax, dword [0x42aad0]
add eax, 0xa231
mov dword [0x42c8c4], eax
cmp eax, 0x141
jne 0x4221ac
mov dword [0x42bd18], ebp
mov dword [0x42bd1c], ebx
inc esi
cmp esi, 0x123c962
jl 0x422170
call fcn.00421d40
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x14
ret 0x10

Function at 0x8003b13
Capabilities:
Accept command line arguments
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
mov dword [0x800438c], 0x30
mov dword [0x8004394], 0x8003424
mov dword [0x8004390], 2
mov dword [0x8004398], 0
mov dword [0x800439c], 0
push 0
call dword [sym.imp.kernel32.dll_GetModuleHandleA]
jmp 0x8003b56
mov dword [0x80043a0], eax
mov dword [0x80043b4], 0x80041cc
mov dword [0x80043ac], 0xf
mov dword [0x80040ee], eax
push 0x7f00
push 0
call dword [sym.imp.user32.dll_LoadIconA]
mov dword [0x80043a4], eax
mov dword [0x80043b8], eax
push 0x7f00
push 0
call dword [sym.imp.user32.dll_LoadCursorA]
mov dword [0x80040f6], ebp
mov dword [0x80043a8], eax
push 0x800438c
call dword [sym.imp.user32.dll_RegisterClassExA]
call dword [sym.imp.kernel32.dll_GetCommandLineA]
mov dword [0x800440c], eax
push 0
push dword [0x80040ee]
push 0
push 0
push 0x1ef
push 0x21c
push 0xffffe688
push 0xfffff524
push 0xcf0000
push str.uno_momento
push str.verba
push 0
call dword [sym.imp.user32.dll_CreateWindowExA]
mov dword [0x8004404], eax
push 1
push dword [0x8004404]
call dword [sym.imp.user32.dll_ShowWindow]
push dword [0x8004404]
call dword [sym.imp.user32.dll_UpdateWindow]
jmp 0x8003c14
xor edi, edi
lea ebx, [0x80043bc]
jmp 0x8003c2c
push ebx
call dword [sym.imp.user32.dll_TranslateMessage]
push ebx
call dword [sym.imp.user32.dll_DispatchMessageA]
push edi
push edi
push edi
push ebx
call dword [sym.imp.user32.dll_GetMessageA]
test al, al
jne 0x8003c1e
jmp 0x8003c40
mov eax, dword [0x80043c4]
call 0x8002b1f
ret
Function at 0x100097a0
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100859d5
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push esi
push edi
mov eax, dword [0x100ca4b0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
cmp dword [edi + 8], 0x9249249
je 0x10009974
lea eax, [edi + 4]
mov dword [ebp - 0x1c], eax
push 0x1c
mov dword [ebp - 4], 0
mov dword [ebp - 0x18], 0
call fcn.1005cc37
mov ecx, dword [ebp + 0xc]
mov esi, eax
add esp, 4
mov dword [ebp - 0x18], esi
movups xmm0, xmmword [ecx]
movups xmmword [esi + 8], xmm0
mov ecx, dword [ecx + 0x10]
mov dword [esi + 0x18], ecx
movzx eax, byte [esi + 8]
xor eax, 0x811c9dc5
movss xmm3, dword [edi]
imul ecx, eax, 0x1000193
movzx eax, byte [esi + 9]
mov dword [ebp - 4], 1
xor ecx, eax
movzx eax, byte [esi + 0xa]
imul ecx, ecx, 0x1000193
xor ecx, eax
movzx eax, byte [esi + 0xb]
imul ecx, ecx, 0x1000193
xor ecx, eax
imul eax, ecx, 0x1000193
mov dword [ebp + 0xc], eax
mov eax, dword [edi + 8]
inc eax
movd xmm0, eax
cvtdq2pd xmm0, xmm0
shr eax, 0x1f
addsd xmm0, qword [eax*8 + 0x1008d7b0]
mov eax, dword [edi + 0x1c]
cvtpd2ps xmm2, xmm0
movd xmm0, eax
cvtdq2pd xmm0, xmm0
shr eax, 0x1f
movaps xmm1, xmm2
addsd xmm0, qword [eax*8 + 0x1008d7b0]
cvtpd2ps xmm0, xmm0
divss xmm1, xmm0
comiss xmm1, xmm3
jbe 0x100098e4
divss xmm2, xmm3
sub esp, 8
cvtps2pd xmm0, xmm2
movsd qword [ebp - 0x14], xmm0
fld qword [ebp - 0x14]
fstp qword [esp]
call fcn.10068660
fstp qword [ebp - 0x14]
movsd xmm0, qword [ebp - 0x14]
add esp, 8
cvtpd2ps xmm0, xmm0
call fcn.1005d110
mov ecx, 8
cmp eax, ecx
cmova ecx, eax
mov eax, dword [edi + 0x1c]
cmp eax, ecx
jae 0x100098dc
cmp eax, 0x200
jae 0x100098da
shl eax, 3
cmp eax, ecx
jae 0x100098dc
mov eax, ecx
push eax
mov ecx, edi
call fcn.10018c40
mov ecx, dword [edi + 0x18]
and ecx, dword [ebp + 0xc]
mov eax, dword [edi + 0xc]
mov edx, dword [edi + 4]
mov eax, dword [eax + ecx*8 + 4]
cmp eax, edx
je 0x10009914
mov edx, dword [edi + 0xc]
mov edx, dword [edx + ecx*8]
mov ecx, dword [esi + 8]
cmp ecx, dword [eax + 8]
je 0x10009912
cmp eax, edx
je 0x10009942
mov eax, dword [eax + 4]
cmp ecx, dword [eax + 8]
jne 0x10009906
mov edx, dword [eax]
mov eax, dword [edx + 4]
inc dword [edi + 8]
mov dword [esi + 4], eax
mov dword [esi], edx
mov dword [eax], esi
mov dword [edx + 4], esi
mov ecx, dword [edi + 0xc]
mov esi, dword [ebp - 0x1c]
mov dword [ebp - 0x10], eax
mov eax, dword [edi + 0x18]
and eax, dword [ebp + 0xc]
mov edi, dword [ecx + eax*8]
cmp edi, dword [esi]
mov esi, dword [ebp - 0x18]
jne 0x10009946
mov dword [ecx + eax*8], esi
jmp 0x10009958
mov edx, eax
jmp 0x10009914
cmp edi, edx
jne 0x1000994f
mov dword [ecx + eax*8], esi
jmp 0x1000995c
mov edx, dword [ebp - 0x10]
cmp dword [ecx + eax*8 + 4], edx
jne 0x1000995c
mov dword [ecx + eax*8 + 4], esi
mov eax, dword [ebp + 8]
mov dword [eax], esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 8
push str.unordered_map_set_too_long
call fcn.10044f28
int3
Function at 0x10013530
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1008618b
mov eax, dword fs:[0]
push eax
sub esp, 0x18
push ebx
push esi
push edi
mov eax, dword [0x100ca4b0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
mov dword [ebp - 0x14], esi
mov dword [esi], vtable.Xbyak::CodeArray.0
push 0x18
mov dword [esi + 4], 0
mov dword [esi + 8], 0
call fcn.1005cc37
add esp, 4
mov dword [eax], eax
mov dword [eax + 4], eax
mov dword [esi + 4], eax
mov edi, dword [ebp + 0xc]
mov dword [ebp - 4], 0
cmp edi, 1
jne 0x1001359a
lea ecx, [edi + 2]
jmp 0x100135ad
test edi, edi
je 0x100135a8
mov ecx, 1
cmp edi, 2
jne 0x100135ad
mov ecx, 2
lea ebx, [esi + 0x10]
mov dword [esi + 0xc], ecx
mov dword [ebx], vtable.Xbyak::Allocator.0
mov eax, dword [ebp + 0x10]
test eax, eax
mov edx, dword [ebp + 8]
cmovne ebx, eax
mov byte [ebp - 4], 1
mov dword [esi + 0x14], ebx
mov dword [esi + 0x18], edx
cmp ecx, 1
jne 0x100135d7
mov eax, edi
jmp 0x100135e8
mov eax, dword [ebx]
mov ecx, 1
cmp edx, ecx
cmovb edx, ecx
mov ecx, ebx
push edx
call dword [eax]
cmp dword [esi + 0x18], 0
mov dword [esi + 0x1c], eax
mov dword [esi + 0x20], 0
mov byte [esi + 0x24], 0
jbe 0x10013600
test eax, eax
je 0x10013654
cmp dword [esi + 0xc], 2
jne 0x1001363e
cmp edi, 2
je 0x1001363e
mov ecx, dword [esi + 0x14]
mov eax, dword [ecx]
mov eax, dword [eax + 0xc]
call eax
test al, al
je 0x1001363e
lea eax, [ebp - 0x10]
push eax
push 0x40
push dword [esi + 0x18]
push dword [esi + 0x1c]
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x1001363e
mov ecx, dword [esi + 0x14]
push dword [esi + 0x1c]
mov eax, dword [ecx]
call dword [eax + 4]
push 0xe
jmp 0x10013656
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
push 0x16
lea ecx, [ebp - 0x24]
call fcn.10014120
push 0x100c3578
lea eax, [ebp - 0x24]
push eax
call fcn.1005e305
int3
Function at 0x10014160
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10086253
mov eax, dword fs:[0]
push eax
sub esp, 8
push esi
push edi
mov eax, dword [0x100ca4b0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x10], edi
push 0x48
mov dword [edi + 4], 0
mov dword [edi + 8], 0
call fcn.1005cc37
mov dword [eax], eax
mov dword [eax + 4], eax
mov dword [edi + 4], eax
lea esi, [edi + 0x10]
mov dword [ebp - 4], 0
mov dword [ebp - 0x14], esi
mov dword [esi], 0
push 0x14
mov dword [esi + 4], 0
mov dword [esi + 8], 0
call fcn.1005cc37
add esp, 8
mov dword [eax], eax
mov dword [eax + 4], eax
mov dword [esi + 4], eax
lea ecx, [esi + 0xc]
mov dword [ecx], 0
mov dword [ecx + 4], 0
mov dword [ecx + 8], 0
mov dword [esi + 0x18], 7
mov dword [esi + 0x1c], 8
mov dword [esi], 0x3f800000
push dword [esi + 4]
mov byte [ebp - 4], 2
push 0x10
call fcn.10018800
lea esi, [edi + 0x30]
mov byte [ebp - 4], 3
mov dword [ebp - 0x14], esi
mov dword [esi], 0
push 0x1c
mov dword [esi + 4], 0
mov dword [esi + 8], 0
call fcn.1005cc37
add esp, 4
mov dword [eax], eax
mov dword [eax + 4], eax
mov dword [esi + 4], eax
lea ecx, [esi + 0xc]
mov dword [ecx], 0
mov dword [ecx + 4], 0
mov dword [ecx + 8], 0
mov dword [esi + 0x18], 7
mov dword [esi + 0x1c], 8
mov dword [esi], 0x3f800000
push dword [esi + 4]
mov byte [ebp - 4], 5
push 0x10
call fcn.10018800
lea esi, [edi + 0x50]
mov byte [ebp - 4], 6
mov dword [ebp - 0x14], esi
mov dword [esi], 0
push 0xc
mov dword [esi + 4], 0
mov dword [esi + 8], 0
call fcn.1005cc37
add esp, 4
mov dword [eax], eax
mov dword [eax + 4], eax
mov dword [esi + 4], eax
lea ecx, [esi + 0xc]
mov dword [ecx], 0
mov dword [ecx + 4], 0
mov dword [ecx + 8], 0
mov byte [ebp - 4], 8
mov dword [esi + 0x18], 7
mov dword [esi + 0x1c], 8
mov dword [esi], 0x3f800000
push dword [esi + 4]
push 0x10
call fcn.10018800
mov ecx, edi
mov byte [ebp - 4], 9
call fcn.100202a0
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x10014310
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100862a9
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x100ca4b0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x10], edi
mov ebx, dword [ebp + 8]
push 0x24
mov dword [ebp - 0x14], edi
mov eax, dword [ebx]
mov dword [edi], eax
mov dword [edi + 4], 0
mov dword [edi + 8], 0
call fcn.1005cc37
add esp, 4
mov dword [eax], eax
mov dword [eax + 4], eax
mov dword [edi + 4], eax
mov dword [ebp - 4], 0
mov dword [edi + 0xc], 0
mov dword [edi + 0x10], 0
mov dword [edi + 0x14], 0
push eax
push 0x10
lea ecx, [edi + 0xc]
mov byte [ebp - 4], 1
call fcn.10018800
mov ecx, dword [edi + 4]
mov eax, dword [ebx + 4]
mov dword [edi + 4], eax
mov eax, dword [ebx + 8]
mov dword [ebx + 4], ecx
mov ecx, dword [edi + 8]
mov dword [edi + 8], eax
mov eax, dword [ebx + 0xc]
mov dword [ebx + 8], ecx
mov ecx, dword [edi + 0xc]
mov dword [edi + 0xc], eax
mov eax, dword [ebx + 0x10]
mov dword [ebx + 0xc], ecx
mov ecx, dword [edi + 0x10]
mov dword [edi + 0x10], eax
mov eax, dword [ebx + 0x14]
mov dword [ebx + 0x10], ecx
mov ecx, dword [edi + 0x14]
mov dword [edi + 0x14], eax
mov eax, dword [ebx + 0x18]
mov dword [ebx + 0x14], ecx
mov dword [ebx + 0x18], 7
mov dword [edi + 0x18], eax
mov eax, dword [ebx + 0x1c]
mov dword [ebx + 0x1c], 8
mov dword [edi + 0x1c], eax
mov eax, dword [ebx + 0x20]
add edi, 0x20
push 0x30
mov dword [ebp - 4], 2
mov dword [ebp + 8], edi
mov dword [edi], eax
mov dword [edi + 4], 0
mov dword [edi + 8], 0
call fcn.1005cc37
add esp, 4
mov dword [eax], eax
mov dword [eax + 4], eax
mov dword [edi + 4], eax
mov dword [edi + 0xc], 0
mov dword [edi + 0x10], 0
mov dword [edi + 0x14], 0
push eax
push 0x10
lea ecx, [edi + 0xc]
mov byte [ebp - 4], 4
call fcn.10018800
mov ecx, dword [edi + 4]
mov eax, dword [ebx + 0x24]
mov dword [edi + 4], eax
mov eax, dword [ebx + 0x28]
mov dword [ebx + 0x24], ecx
mov ecx, dword [edi + 8]
mov dword [edi + 8], eax
mov dword [ebx + 0x28], ecx
mov ecx, dword [edi + 0xc]
mov eax, dword [ebx + 0x2c]
mov dword [edi + 0xc], eax
mov eax, dword [ebx + 0x30]
mov dword [ebx + 0x2c], ecx
mov ecx, dword [edi + 0x10]
mov dword [edi + 0x10], eax
mov eax, dword [ebx + 0x34]
mov dword [ebx + 0x30], ecx
mov ecx, dword [edi + 0x14]
mov dword [edi + 0x14], eax
mov eax, dword [ebx + 0x38]
mov dword [ebx + 0x34], ecx
mov dword [ebx + 0x38], 7
mov dword [edi + 0x18], eax
mov eax, dword [ebx + 0x3c]
mov dword [ebx + 0x3c], 8
mov dword [edi + 0x1c], eax
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x10018af0
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov edx, dword [ebp + 8]
mov eax, 0x1fffffff
push ebx
mov ebx, ecx
bsr ecx, eax
push esi
push edi
mov edi, 1
mov dword [ebp - 8], ebx
mov eax, edi
shl eax, cl
cmp edx, eax
ja 0x10018c2a
mov esi, dword [ebx + 4]
lea eax, [edx - 1]
or eax, edi
mov dword [ebp + 8], esi
bsr ecx, eax
push esi
lea ecx, [ecx + 1]
shl edi, cl
lea ecx, [ebx + 0xc]
mov dword [ebp - 0xc], ecx
lea eax, [edi + edi]
push eax
call fcn.10018800
lea eax, [edi - 1]
mov dword [ebx + 0x1c], edi
mov dword [ebx + 0x18], eax
mov eax, dword [ebx + 4]
mov eax, dword [eax]
mov ecx, eax
cmp eax, esi
je 0x10018bfd
mov bl, byte [eax + 8]
mov edi, dword [ebp - 8]
mov ecx, dword [ecx]
movzx edx, bl
xor edx, 0x811c9dc5
mov edi, dword [edi + 0x18]
imul edx, edx, 0x1000193
and edi, edx
mov edx, dword [ebp - 0xc]
mov edx, dword [edx]
lea edx, [edx + edi*8]
mov edi, dword [edx]
mov dword [ebp - 4], edx
cmp edi, esi
jne 0x10018b89
mov dword [edx], eax
mov dword [edx + 4], eax
jmp 0x10018bf3
mov edx, dword [edx + 4]
cmp bl, byte [edx + 8]
jne 0x10018bc0
mov edx, dword [edx]
mov dword [ebp - 0x10], edx
cmp edx, eax
je 0x10018bb8
mov ebx, dword [eax + 4]
mov esi, dword [ebp - 0x10]
mov dword [ebx], ecx
mov edi, dword [ecx + 4]
mov dword [edi], edx
mov edx, dword [edx + 4]
mov dword [edx], eax
mov dword [esi + 4], edi
mov esi, dword [ebp + 8]
mov dword [ecx + 4], ebx
mov dword [eax + 4], edx
mov edx, dword [ebp - 4]
mov dword [edx + 4], eax
jmp 0x10018bf3
cmp edi, edx
je 0x10018bd0
mov edx, dword [edx + 4]
cmp bl, byte [edx + 8]
je 0x10018c06
cmp edi, edx
jne 0x10018bc4
mov ebx, dword [eax + 4]
mov dword [ebp - 0x10], ebx
mov dword [ebx], ecx
mov ebx, dword [ecx + 4]
mov dword [ebx], edx
mov edi, dword [edx + 4]
mov dword [edi], eax
mov dword [edx + 4], ebx
mov edx, dword [ebp - 0x10]
mov dword [ecx + 4], edx
mov edx, dword [ebp - 4]
mov dword [eax + 4], edi
mov dword [edx], eax
mov eax, ecx
cmp ecx, esi
jne 0x10018b55
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
mov ebx, dword [eax + 4]
mov edx, dword [edx]
mov dword [ebp - 0x10], edx
mov esi, edx
mov dword [ebx], ecx
mov edi, dword [ecx + 4]
mov dword [edi], edx
mov edx, dword [edx + 4]
mov dword [edx], eax
mov dword [esi + 4], edi
mov esi, dword [ebp + 8]
mov dword [ecx + 4], ebx
mov dword [eax + 4], edx
jmp 0x10018bf3
push str.invalid_hash_bucket_count
call fcn.10044f28
int3