joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1016cbc0
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1fffffff
sub esp, 8
bsr ecx, eax
push ebx
push esi
push edi
mov edi, 1
mov eax, edi
shl eax, cl
mov ecx, dword [ebp + 8]
cmp ecx, eax
ja 0x1016cd2e
lea eax, [ecx - 1]
mov esi, dword [0x102b206c]
or eax, edi
mov dword [ebp - 8], esi
bsr ecx, eax
push esi
lea ecx, [ecx + 1]
shl edi, cl
mov ecx, 0x102b2074
lea eax, [edi + edi]
push eax
call fcn.10003810
mov ecx, dword [0x102b206c]
lea ebx, [edi - 1]
mov dword [0x102b2080], ebx
mov dword [0x102b2084], edi
mov ecx, dword [ecx]
mov edx, ecx
cmp ecx, esi
je 0x1016cd25
nop dword [eax + eax]
movzx eax, byte [ecx + 8]
xor eax, 0x811c9dc5
mov edx, dword [edx]
imul edi, eax, 0x1000193
movzx eax, byte [ecx + 9]
xor edi, eax
movzx eax, byte [ecx + 0xa]
imul edi, edi, 0x1000193
xor edi, eax
movzx eax, byte [ecx + 0xb]
imul edi, edi, 0x1000193
xor edi, eax
mov eax, dword [0x102b2074]
imul edi, edi, 0x1000193
and edi, ebx
mov ebx, dword [eax + edi*8]
lea eax, [eax + edi*8]
mov dword [ebp + 8], eax
cmp ebx, esi
jne 0x1016cc80
mov dword [eax], ecx
mov dword [eax + 4], ecx
jmp 0x1016ccef
mov eax, dword [eax + 4]
mov edi, dword [ecx + 8]
cmp edi, dword [eax + 8]
jne 0x1016ccb7
mov eax, dword [eax]
cmp eax, ecx
je 0x1016ccaf
mov ebx, dword [ecx + 4]
mov dword [ebp - 4], ebx
mov dword [ebx], edx
mov ebx, dword [edx + 4]
mov dword [ebx], eax
mov edi, dword [eax + 4]
mov dword [edi], ecx
mov dword [eax + 4], ebx
mov eax, dword [ebp - 4]
mov dword [edx + 4], eax
mov dword [ecx + 4], edi
mov eax, dword [ebp + 8]
mov dword [eax + 4], ecx
jmp 0x1016ccef
cmp ebx, eax
je 0x1016cccc
nop dword [eax + eax]
mov eax, dword [eax + 4]
cmp edi, dword [eax + 8]
je 0x1016cd00
cmp ebx, eax
jne 0x1016ccc0
mov ebx, dword [ecx + 4]
mov dword [ebp - 4], ebx
mov dword [ebx], edx
mov ebx, dword [edx + 4]
mov dword [ebx], eax
mov edi, dword [eax + 4]
mov dword [edi], ecx
mov dword [eax + 4], ebx
mov eax, dword [ebp - 4]
mov dword [edx + 4], eax
mov eax, dword [ebp + 8]
mov dword [ecx + 4], edi
mov dword [eax], ecx
mov ecx, edx
cmp edx, esi
je 0x1016cd25
mov ebx, dword [0x102b2080]
jmp 0x1016cc30
mov ebx, dword [ecx + 4]
mov eax, dword [eax]
mov dword [ebp + 8], eax
mov esi, dword [ebp + 8]
mov dword [ebx], edx
mov edi, dword [edx + 4]
mov dword [edi], eax
mov eax, dword [eax + 4]
mov dword [eax], ecx
mov dword [esi + 4], edi
mov esi, dword [ebp - 8]
mov dword [edx + 4], ebx
mov dword [ecx + 4], eax
jmp 0x1016ccef
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
push str.invalid_hash_bucket_count
call fcn.101dfec8
int3
Function at 0x1016cf90
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
mov ebx, dword [ebp + 0xc]
push esi
push edi
mov edi, ecx
movzx eax, byte [ebx]
xor eax, 0x811c9dc5
imul edx, eax, 0x1000193
movzx eax, byte [ebx + 1]
xor edx, eax
movzx eax, byte [ebx + 2]
imul edx, edx, 0x1000193
xor edx, eax
movzx eax, byte [ebx + 3]
imul ecx, edx, 0x1000193
xor ecx, eax
imul eax, ecx, 0x1000193
mov ecx, edi
push eax
mov dword [ebp + 0xc], eax
lea eax, [ebp - 0xc]
push ebx
push eax
call fcn.10006b20
mov ecx, dword [ebp - 8]
test ecx, ecx
je 0x1016cff9
mov eax, dword [ebp + 8]
mov dword [eax], ecx
mov byte [eax + 4], 0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
cmp dword [edi + 8], 0xfffffff
je 0x1016d0e3
push 0x10
call fcn.101e2257
mov ecx, dword [ebx]
mov esi, eax
mov edx, dword [ebx + 4]
add esp, 4
mov dword [ebp - 4], esi
mov dword [esi + 8], ecx
mov dword [esi + 0xc], edx
mov ecx, dword [edi + 8]
mov eax, dword [edi + 0x1c]
inc ecx
movd xmm0, ecx
cvtdq2pd xmm0, xmm0
shr ecx, 0x1f
addsd xmm0, qword [ecx*8 + 0x1026c3b0]
cvtpd2ps xmm1, xmm0
movd xmm0, eax
cvtdq2pd xmm0, xmm0
shr eax, 0x1f
addsd xmm0, qword [eax*8 + 0x1026c3b0]
cvtpd2ps xmm0, xmm0
divss xmm1, xmm0
comiss xmm1, dword [edi]
jbe 0x1016d07d
mov ecx, edi
call fcn.10082a10
push dword [ebp + 0xc]
lea eax, [esi + 8]
mov ecx, edi
push eax
lea eax, [ebp - 0xc]
push eax
call fcn.10006b20
mov edx, dword [eax]
jmp 0x1016d080
mov edx, dword [ebp - 0xc]
mov eax, dword [edi + 8]
mov ebx, dword [edx + 4]
inc eax
mov dword [edi + 8], eax
mov dword [esi], edx
mov dword [esi + 4], ebx
mov dword [ebx], esi
mov dword [edx + 4], esi
mov eax, dword [edi + 0x18]
and eax, dword [ebp + 0xc]
mov ecx, dword [edi + 0xc]
mov esi, dword [ecx + eax*8]
cmp esi, dword [edi + 4]
mov esi, dword [ebp - 4]
jne 0x1016d0ad
mov dword [ecx + eax*8], esi
jmp 0x1016d0cd
cmp dword [ecx + eax*8], edx
jne 0x1016d0c7
mov dword [ecx + eax*8], esi
mov eax, dword [ebp + 8]
mov dword [eax], esi
mov byte [eax + 4], 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
cmp dword [ecx + eax*8 + 4], ebx
jne 0x1016d0d1
mov dword [ecx + eax*8 + 4], esi
mov eax, dword [ebp + 8]
pop edi
mov dword [eax], esi
pop esi
mov byte [eax + 4], 1
pop ebx
mov esp, ebp
pop ebp
ret 8
push str.unordered_map_set_too_long
call fcn.101dfec8
int3
Function at 0x1016e320
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
mov ebx, dword [ebp + 0xc]
push esi
push edi
mov edi, ecx
movzx eax, byte [ebx]
xor eax, 0x811c9dc5
imul edx, eax, 0x1000193
movzx eax, byte [ebx + 1]
xor edx, eax
movzx eax, byte [ebx + 2]
imul edx, edx, 0x1000193
xor edx, eax
movzx eax, byte [ebx + 3]
imul ecx, edx, 0x1000193
xor ecx, eax
imul eax, ecx, 0x1000193
mov ecx, edi
push eax
mov dword [ebp + 0xc], eax
lea eax, [ebp - 0x10]
push ebx
push eax
call fcn.10006b20
mov ecx, dword [ebp - 0xc]
test ecx, ecx
je 0x1016e389
mov eax, dword [ebp + 8]
mov dword [eax], ecx
mov byte [eax + 4], 0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
cmp dword [edi + 8], 0xaaaaaaa
je 0x1016e4dd
push 0x18
call fcn.101e2257
mov ecx, dword [ebx]
mov esi, eax
add esp, 4
mov dword [ebp - 4], esi
mov dword [esi + 8], ecx
mov dword [esi + 0xc], 0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
mov ecx, dword [edi + 8]
mov ebx, dword [edi + 0x1c]
movss xmm3, dword [edi]
lea eax, [ecx + 1]
movd xmm0, eax
cvtdq2pd xmm0, xmm0
shr eax, 0x1f
addsd xmm0, qword [eax*8 + 0x1026c3b0]
mov eax, ebx
shr eax, 0x1f
cvtpd2ps xmm2, xmm0
movd xmm0, ebx
cvtdq2pd xmm0, xmm0
movaps xmm1, xmm2
addsd xmm0, qword [eax*8 + 0x1026c3b0]
cvtpd2ps xmm0, xmm0
divss xmm1, xmm0
comiss xmm1, xmm3
jbe 0x1016e478
divss xmm2, xmm3
sub esp, 8
cvtps2pd xmm0, xmm2
movsd qword [ebp - 0x10], xmm0
fld qword [ebp - 0x10]
fstp qword [esp]
call fcn.10207f20
fstp qword [ebp - 0x10]
movsd xmm0, qword [ebp - 0x10]
add esp, 8
cvtpd2ps xmm0, xmm0
call fcn.10209560
mov ecx, 8
cmp eax, ecx
cmova ecx, eax
cmp ebx, ecx
jae 0x1016e457
cmp ebx, 0x200
jae 0x1016e455
shl ebx, 3
cmp ebx, ecx
jae 0x1016e457
mov ebx, ecx
push ebx
mov ecx, edi
call fcn.100582d0
push dword [ebp + 0xc]
lea eax, [esi + 8]
mov ecx, edi
push eax
lea eax, [ebp - 0x10]
push eax
call fcn.10006b20
mov ecx, dword [edi + 8]
mov edx, dword [eax]
jmp 0x1016e47b
mov edx, dword [ebp - 0x10]
mov ebx, dword [edx + 4]
lea eax, [ecx + 1]
mov dword [edi + 8], eax
mov dword [esi], edx
mov dword [esi + 4], ebx
mov dword [ebx], esi
mov dword [edx + 4], esi
mov eax, dword [edi + 0x18]
and eax, dword [ebp + 0xc]
mov ecx, dword [edi + 0xc]
mov esi, dword [ecx + eax*8]
cmp esi, dword [edi + 4]
mov esi, dword [ebp - 4]
jne 0x1016e4a7
mov dword [ecx + eax*8], esi
jmp 0x1016e4c7
cmp dword [ecx + eax*8], edx
jne 0x1016e4c1
mov dword [ecx + eax*8], esi
mov eax, dword [ebp + 8]
mov dword [eax], esi
mov byte [eax + 4], 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
cmp dword [ecx + eax*8 + 4], ebx
jne 0x1016e4cb
mov dword [ecx + eax*8 + 4], esi
mov eax, dword [ebp + 8]
pop edi
mov dword [eax], esi
pop esi
mov byte [eax + 4], 1
pop ebx
mov esp, ebp
pop ebp
ret 8
push str.unordered_map_set_too_long
call fcn.101dfec8
int3
Function at 0x1016e900
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x34
push ebx
push esi
push edi
push ecx
call fcn.1016e4f0
push 0xfce2b6a0
call fcn.10007000
mov esi, dword [eax + 0x18]
add esi, 6
je 0x1016e926
mov esi, dword [esi]
mov ecx, dword [0x102999e4]
xor edx, edx
mov eax, dword fs:[0x2c]
mov dword [esp + 0x28], 0x433d134e
mov dword [esp + 0x2c], 0x6002d5a3
mov dword [esp + 0x30], 0xd3636959
lea eax, [eax + ecx*4]
mov dword [esp + 0x34], 0x57014847
mov dword [esp + 0x38], 0x38334ea9
mov dword [esp + 0x3c], 0x93b13262
mov dword [esp + 0x10], edx
mov dword [esp + 0x14], eax
nop
mov ebx, dword [esi + edx*8]
test ebx, ebx
je 0x1016ea6e
cmp byte [ebx], 0
je 0x1016ea6e
mov ecx, ebx
mov edi, 0x811c9dc5
lea edx, [ecx + 1]
nop
mov al, byte [ecx]
inc ecx
test al, al
jne 0x1016e990
sub ecx, edx
mov edx, 0
je 0x1016e9b1
movsx eax, byte [edx + ebx]
inc edx
xor eax, edi
imul edi, eax, 0x1000193
cmp edx, ecx
jb 0x1016e9a0
lea eax, [esp + 0x28]
cmp dword [eax], edi
je 0x1016e9c9
add eax, 4
lea ecx, [esp + 0x40]
cmp eax, ecx
jne 0x1016e9b5
jmp 0x1016ea6a
mov eax, dword [esp + 0x14]
mov edi, dword [0x1029a45c]
mov ecx, dword [eax]
mov eax, dword [0x102b62c4]
cmp eax, dword [ecx + 4]
jle 0x1016ea2b
push 0x102b62c4
call fcn.101e23b9
add esp, 4
cmp dword [0x102b62c4], 0xffffffff
jne 0x1016ea2b
lea eax, [esp + 0x18]
mov dword [esp + 0x18], str.ButtonCodeToVirtualKey
push eax
lea eax, [esp + 0x24]
mov ecx, 0x102a5794
push eax
call fcn.10006340
push 0x102b62c4
mov eax, dword [eax]
mov eax, dword [eax + 0xc]
mov dword [0x102b62bc], eax
call fcn.101e236f
add esp, 4
mov edx, dword [edi]
mov ecx, edi
mov eax, dword [0x102b62bc]
push dword [esp + 0x10]
mov eax, dword [edx + eax*4]
call eax
mov ecx, dword [0x102b20b0]
mov dword [esp + 0x1c], eax
cmp ecx, dword [0x102b20b4]
je 0x1016ea5a
mov dword [ecx], eax
add dword [0x102b20b0], 4
jmp 0x1016ea6a
lea eax, [esp + 0x1c]
push eax
push ecx
mov ecx, 0x102b20ac
call fcn.10029610
mov edx, dword [esp + 0x10]
inc edx
mov dword [esp + 0x10], edx
cmp edx, 0x132
jl 0x1016e970
mov esi, dword [sym.imp.USER32.dll_FindWindowA]
push 0
push str.Valve001
call esi
mov dword [0x102b2180], eax
test eax, eax
jne 0x1016eab9
mov edi, dword [sym.imp.KERNEL32.dll_Sleep]
nop dword [eax]
push 0xc8
call edi
push 0
push str.Valve001
call esi
mov dword [0x102b2180], eax
test eax, eax
je 0x1016eaa0
push 0x1016e580
push 0xfffffffffffffffc
push eax
call dword [sym.imp.USER32.dll_SetWindowLongA]
pop edi
pop esi
mov dword [0x102b2184], eax
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1016f350
Capabilities:
Encode data using xor
Hash data using fnv
Parse pe header
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov ecx, dword [ecx + 4]
mov dword [ebp - 8], ecx
push ebx
push esi
push edi
test ecx, ecx
je 0x1016f41e
mov eax, 0x5a4d
cmp word [ecx], ax
jne 0x1016f41e
mov eax, dword [ecx + 0x3c]
add eax, ecx
je 0x1016f41e
cmp dword [eax], 0x4550
jne 0x1016f41e
mov eax, dword [eax + 0x78]
test eax, eax
je 0x1016f41e
add eax, ecx
je 0x1016f41e
mov esi, dword [eax + 0x1c]
xor ebx, ebx
mov edi, dword [eax + 0x20]
add esi, ecx
mov edx, dword [eax + 0x18]
add edi, ecx
mov dword [ebp - 0x10], esi
mov dword [ebp - 0x14], edi
mov dword [ebp - 0xc], edx
test edx, edx
je 0x1016f41e
mov edx, dword [eax + 0x24]
add edx, ecx
mov dword [ebp - 4], edx
movzx eax, word [edx]
mov edi, dword [edi + ebx*4]
mov eax, dword [esi + eax*4]
mov esi, 0x811c9dc5
add eax, ecx
mov dword [ebp - 0x18], eax
add edi, ecx
je 0x1016f407
mov eax, edi
lea edx, [eax + 1]
nop
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x1016f3e0
sub eax, edx
mov edx, 0
je 0x1016f401
movsx ecx, byte [edx + edi]
inc edx
xor ecx, esi
imul esi, ecx, 0x1000193
cmp edx, eax
jb 0x1016f3f0
mov ecx, dword [ebp - 8]
mov edx, dword [ebp - 4]
cmp esi, dword [ebp + 0xc]
je 0x1016f430
mov esi, dword [ebp - 0x10]
inc ebx
mov edi, dword [ebp - 0x14]
add edx, 2
mov dword [ebp - 4], edx
cmp ebx, dword [ebp - 0xc]
jb 0x1016f3c3
mov eax, dword [ebp + 8]
pop edi
pop esi
pop ebx
mov dword [eax], 0
mov esp, ebp
pop ebp
ret 0xc
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0x18]
pop edi
pop esi
mov dword [eax], ecx
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x1016fc50
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
mov ebx, ecx
movzx eax, bl
xor eax, 0x811c9dc5
mov dword [ebp - 4], ebx
imul edx, eax, 0x1000193
mov eax, ebx
shr eax, 8
movzx eax, al
xor edx, eax
mov eax, ebx
shr eax, 0x10
movzx eax, al
imul ecx, edx, 0x1000193
shr ebx, 0x18
xor ecx, eax
imul eax, ecx, 0x1000193
xor eax, ebx
imul eax, eax, 0x1000193
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0xc]
push eax
call fcn.101700c0
mov eax, dword [eax + 4]
test eax, eax
je 0x1016fcc0
cmp eax, dword [0x102b2594]
je 0x1016fcc0
lea eax, [ebp - 4]
push eax
call fcn.1016fcd0
pop ebx
mov esp, ebp
pop ebp
ret
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1016fd30
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
movzx eax, byte [edi]
xor eax, 0x811c9dc5
imul ecx, eax, 0x1000193
movzx eax, byte [edi + 1]
xor ecx, eax
movzx eax, byte [edi + 2]
imul ecx, ecx, 0x1000193
xor ecx, eax
movzx eax, byte [edi + 3]
imul ecx, ecx, 0x1000193
xor ecx, eax
lea eax, [ebp - 8]
imul ebx, ecx, 0x1000193
push ebx
push edi
push eax
call fcn.101700c0
mov ecx, dword [ebp - 4]
test ecx, ecx
je 0x1016fd92
mov eax, dword [ebp + 8]
mov dword [eax], ecx
mov byte [eax + 4], 0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
cmp dword [0x102b2598], 0x4444444
je 0x1016feed
push 0x3c
call fcn.101e2257
mov cl, byte [0x102383a2]
mov esi, eax
push ecx
mov byte [ebp + 0xc], cl
mov ecx, esp
push dword [ebp + 0xc]
mov dword [ecx], edi
lea ecx, [esi + 8]
call fcn.101702a0
mov ecx, dword [0x102b2598]
mov edi, dword [0x102b25ac]
lea eax, [ecx + 1]
movd xmm0, eax
cvtdq2pd xmm0, xmm0
shr eax, 0x1f
addsd xmm0, qword [eax*8 + 0x1026c3b0]
mov eax, edi
shr eax, 0x1f
cvtpd2ps xmm2, xmm0
movd xmm0, edi
cvtdq2pd xmm0, xmm0
movaps xmm1, xmm2
addsd xmm0, qword [eax*8 + 0x1026c3b0]
cvtpd2ps xmm0, xmm0
divss xmm1, xmm0
movss xmm0, dword [0x102b2590]
comiss xmm1, xmm0
jbe 0x1016fe84
divss xmm2, xmm0
sub esp, 8
cvtps2pd xmm0, xmm2
movsd qword [ebp - 8], xmm0
fld qword [ebp - 8]
fstp qword [esp]
call fcn.10207f20
fstp qword [ebp - 8]
movsd xmm0, qword [ebp - 8]
add esp, 8
cvtpd2ps xmm0, xmm0
call fcn.10209560
mov ecx, 8
cmp eax, ecx
cmova ecx, eax
cmp edi, ecx
jae 0x1016fe66
cmp edi, 0x200
jae 0x1016fe64
shl edi, 3
cmp edi, ecx
jae 0x1016fe66
mov edi, ecx
push edi
call fcn.1016ff40
push ebx
lea eax, [esi + 8]
push eax
lea eax, [ebp - 8]
push eax
call fcn.101700c0
mov ecx, dword [0x102b2598]
mov edx, dword [eax]
jmp 0x1016fe87
mov edx, dword [ebp - 8]
mov edi, dword [edx + 4]
inc ecx
mov dword [0x102b2598], ecx
mov dword [esi], edx
mov dword [esi + 4], edi
mov dword [edi], esi
mov dword [edx + 4], esi
mov eax, dword [0x102b25a8]
mov ecx, dword [0x102b259c]
and eax, ebx
mov ebx, dword [ecx + eax*8]
cmp ebx, dword [0x102b2594]
jne 0x1016feb8
mov dword [ecx + eax*8], esi
jmp 0x1016fed7
cmp ebx, edx
jne 0x1016fed1
mov dword [ecx + eax*8], esi
mov eax, dword [ebp + 8]
mov dword [eax], esi
mov byte [eax + 4], 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
cmp dword [ecx + eax*8 + 4], edi
jne 0x1016fedb
mov dword [ecx + eax*8 + 4], esi
mov eax, dword [ebp + 8]
pop edi
mov dword [eax], esi
pop esi
mov byte [eax + 4], 1
pop ebx
mov esp, ebp
pop ebp
ret 8
push str.unordered_map_set_too_long
call fcn.101dfec8
int3
Function at 0x1016ff40
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1fffffff
sub esp, 8
bsr ecx, eax
push ebx
push esi
push edi
mov edi, 1
mov eax, edi
shl eax, cl
mov ecx, dword [ebp + 8]
cmp ecx, eax
ja 0x101700ae
lea eax, [ecx - 1]
mov esi, dword [0x102b2594]
or eax, edi
mov dword [ebp - 8], esi
bsr ecx, eax
push esi
lea ecx, [ecx + 1]
shl edi, cl
mov ecx, 0x102b259c
lea eax, [edi + edi]
push eax
call fcn.10003810
mov ecx, dword [0x102b2594]
lea ebx, [edi - 1]
mov dword [0x102b25a8], ebx
mov dword [0x102b25ac], edi
mov ecx, dword [ecx]
mov edx, ecx
cmp ecx, esi
je 0x101700a5
nop dword [eax + eax]
movzx eax, byte [ecx + 8]
xor eax, 0x811c9dc5
mov edx, dword [edx]
imul edi, eax, 0x1000193
movzx eax, byte [ecx + 9]
xor edi, eax
movzx eax, byte [ecx + 0xa]
imul edi, edi, 0x1000193
xor edi, eax
movzx eax, byte [ecx + 0xb]
imul edi, edi, 0x1000193
xor edi, eax
mov eax, dword [0x102b259c]
imul edi, edi, 0x1000193
and edi, ebx
mov ebx, dword [eax + edi*8]
lea eax, [eax + edi*8]
mov dword [ebp + 8], eax
cmp ebx, esi
jne 0x10170000
mov dword [eax], ecx
mov dword [eax + 4], ecx
jmp 0x1017006f
mov eax, dword [eax + 4]
mov edi, dword [ecx + 8]
cmp edi, dword [eax + 8]
jne 0x10170037
mov eax, dword [eax]
cmp eax, ecx
je 0x1017002f
mov ebx, dword [ecx + 4]
mov dword [ebp - 4], ebx
mov dword [ebx], edx
mov ebx, dword [edx + 4]
mov dword [ebx], eax
mov edi, dword [eax + 4]
mov dword [edi], ecx
mov dword [eax + 4], ebx
mov eax, dword [ebp - 4]
mov dword [edx + 4], eax
mov dword [ecx + 4], edi
mov eax, dword [ebp + 8]
mov dword [eax + 4], ecx
jmp 0x1017006f
cmp ebx, eax
je 0x1017004c
nop dword [eax + eax]
mov eax, dword [eax + 4]
cmp edi, dword [eax + 8]
je 0x10170080
cmp ebx, eax
jne 0x10170040
mov ebx, dword [ecx + 4]
mov dword [ebp - 4], ebx
mov dword [ebx], edx
mov ebx, dword [edx + 4]
mov dword [ebx], eax
mov edi, dword [eax + 4]
mov dword [edi], ecx
mov dword [eax + 4], ebx
mov eax, dword [ebp - 4]
mov dword [edx + 4], eax
mov eax, dword [ebp + 8]
mov dword [ecx + 4], edi
mov dword [eax], ecx
mov ecx, edx
cmp edx, esi
je 0x101700a5
mov ebx, dword [0x102b25a8]
jmp 0x1016ffb0
mov ebx, dword [ecx + 4]
mov eax, dword [eax]
mov dword [ebp + 8], eax
mov esi, dword [ebp + 8]
mov dword [ebx], edx
mov edi, dword [edx + 4]
mov dword [edi], eax
mov eax, dword [eax + 4]
mov dword [eax], ecx
mov dword [esi + 4], edi
mov esi, dword [ebp - 8]
mov dword [edx + 4], ebx
mov dword [ecx + 4], eax
jmp 0x1017006f
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
push str.invalid_hash_bucket_count
call fcn.101dfec8
int3
Function at 0x10170790
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov edx, dword [ebp + 0xc]
mov eax, dword [ebp + 8]
push edi
mov edi, ecx
mov dword [edi + 0xc], 0
mov dword [edi + 0x10], 0
mov dword [edi + 0x18], 0
mov dword [edi + 0x1c], 0
mov dword [edi + 0x20], 0
mov dword [edi + 0x24], 0
mov dword [edi + 0x28], 0
mov dword [edi + 0x2c], 0
mov dword [edi], eax
mov dword [edi + 4], edx
mov dword [edi + 0x14], 0
mov dword [edi + 8], edx
mov ecx, dword [edx + 0x3c]
add ecx, edx
xor edx, edx
mov dword [edi + 0xc], ecx
mov dword [ebp + 8], edx
mov eax, dword [ecx + 0x50]
mov dword [edi + 0x14], eax
lea eax, [ecx + 0xf8]
mov dword [edi + 0x10], eax
xor eax, eax
cmp ax, word [ecx + 6]
jae 0x101708a5
push ebx
push esi
movzx eax, dx
mov esi, 0x811c9dc5
lea ecx, [eax + eax*4]
mov eax, dword [edi + 0x10]
lea ebx, [eax + ecx*8]
mov eax, dword [ebx + 0x10]
mov dword [ebp - 4], eax
mov eax, dword [ebx + 0xc]
add eax, dword [edi + 8]
mov dword [ebp + 0xc], eax
mov eax, ebx
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x10170835
sub eax, edx
mov edx, 0
je 0x10170856
movsx ecx, byte [edx + ebx]
inc edx
xor ecx, esi
imul esi, ecx, 0x1000193
cmp edx, eax
jb 0x10170845
mov eax, dword [ebp + 0xc]
mov ecx, dword [edi + 0x28]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 4]
mov dword [ebp - 0x10], esi
mov dword [ebp - 8], eax
cmp ecx, dword [edi + 0x2c]
je 0x10170882
movq xmm0, qword [ebp - 0x10]
movq qword [ecx], xmm0
mov eax, dword [ebp - 8]
mov dword [ecx + 8], eax
add dword [edi + 0x28], 0xc
jmp 0x1017088f
lea eax, [ebp - 0x10]
push eax
push ecx
lea ecx, [edi + 0x24]
call fcn.10170560
mov edx, dword [ebp + 8]
mov eax, dword [edi + 0xc]
inc edx
mov dword [ebp + 8], edx
cmp dx, word [eax + 6]
jb 0x10170810
pop esi
pop ebx
mov eax, edi
pop edi
mov esp, ebp
pop ebp
ret 8
Function at 0x10170b40
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
mov ebx, ecx
mov eax, edx
push esi
push edi
mov dword [ebp - 8], eax
mov ecx, dword [ebx + 0x10]
mov edi, dword [ebx + 0xc]
mov dword [ebp - 0xc], ebx
mov dword [ebp - 4], ecx
cmp edi, ecx
je 0x10170bab
mov eax, dword [edi]
mov esi, 0x811c9dc5
mov ebx, dword [eax]
test ebx, ebx
je 0x10170b96
mov ecx, ebx
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x10170b72
sub ecx, edx
mov edx, 0
je 0x10170b93
movsx eax, byte [edx + ebx]
inc edx
xor eax, esi
imul esi, eax, 0x1000193
cmp edx, ecx
jb 0x10170b82
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 8]
cmp esi, eax
je 0x10170c39
add edi, 4
cmp edi, ecx
jne 0x10170b60
mov ebx, dword [ebp - 0xc]
mov ecx, dword [ebx + 0x1c]
mov esi, dword [ebx + 0x18]
mov dword [ebp - 4], ecx
cmp esi, ecx
je 0x10170bdf
mov edi, ecx
nop word [eax + eax]
mov edx, eax
mov ecx, esi
call fcn.10170b40
mov ecx, eax
test ecx, ecx
jne 0x10170c4b
mov eax, dword [ebp - 8]
add esi, 0x24
cmp esi, edi
jne 0x10170bc0
mov ecx, dword [ebx + 0x1c]
mov dword [ebp - 4], ecx
mov edi, dword [ebx + 0x18]
cmp edi, ecx
je 0x10170c30
mov eax, dword [edi + 4]
mov esi, 0x811c9dc5
mov ebx, dword [eax]
test ebx, ebx
je 0x10170c24
mov ecx, ebx
lea edx, [ecx + 1]
nop dword [eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x10170c00
sub ecx, edx
mov edx, 0
je 0x10170c21
movsx eax, byte [edx + ebx]
inc edx
xor eax, esi
imul esi, eax, 0x1000193
cmp edx, ecx
jb 0x10170c10
mov ecx, dword [ebp - 4]
cmp esi, dword [ebp - 8]
je 0x10170c57
add edi, 0x24
cmp edi, ecx
jne 0x10170be6
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [edi]
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov eax, dword [eax + 0x2c]
add eax, dword [ecx + 8]
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [ebx + 8]
pop edi
pop esi
add eax, ecx
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [edi + 8]
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
add eax, dword [ecx + 8]
mov esp, ebp
pop ebp
ret