joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10004f90
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push esi
push 0x1013def0
push 0x64
call fcn.100d04fa
mov esi, eax
add esp, 8
test esi, esi
je 0x10005128
push 0x64
push 0
push esi
call fcn.100ed000
mov byte [esi], 1
lea eax, [esi + 0x34]
xorps xmm0, xmm0
movups xmmword [esi + 0x10], xmm0
push eax
movq qword [esi + 0x20], xmm0
mov dword [esi + 0x28], 0
mov dword [esi + 8], 0
mov dword [esi + 0xc], 0
mov dword [esi + 0x2c], 0xffffffff
mov dword [esi + 4], 2
mov dword [esi + 0x30], 0
call fcn.100d206a
xorps xmm0, xmm0
mov dword [0x1018492c], esi
add esp, 0x10
movq qword [esi + 0x5c], xmm0
cmp dword [ebp + 0x10], 0
mov esi, dword [ebp + 8]
je 0x10005036
mov eax, dword [ebp + 0x14]
test eax, eax
je 0x1000502b
cmp byte [eax], 0
je 0x1000502b
push eax
push esi
call fcn.100033e0
jmp 0x10005033
push 0
push esi
call fcn.10003360
add esp, 8
call sub.KERNEL32.dll_GetCurrentProcessId
push 0x1015a038
mov dword [0x10184928], eax
call fcn.100d1ebe
add esp, 4
test eax, eax
jne 0x10005137
cmp dword [0x1015a064], 0x7fffffff
je 0x1000513e
mov eax, dword [ebp + 0xc]
test eax, eax
je 0x1000507d
movups xmm0, xmmword [eax]
movups xmmword [0x101802d8], xmm0
movq xmm0, qword [eax + 0x10]
jmp 0x10005087
xorps xmm0, xmm0
movups xmmword [0x101802d8], xmm0
movq qword [0x101802e8], xmm0
xorps xmm0, xmm0
push 0x1015a038
movups xmmword [0x101802f0], xmm0
movq qword [0x10180300], xmm0
call fcn.100d1ecf
add esp, 4
cmp dword [0x101802d4], 0
jne 0x10005132
push esi
call fcn.100064f0
mov dword [0x101802d4], eax
mov dword [eax + 8], 0x100034e0
mov eax, dword [0x101802d4]
mov dword [eax + 0xc], 0x10003500
mov al, 1
mov esi, dword [0x1018492c]
xchg byte [esi], al
push 4
call fcn.100d04bc
add esp, 8
test eax, eax
je 0x100050f1
mov dword [eax], esi
jmp 0x100050f3
xor eax, eax
lea ecx, [ebp - 4]
push ecx
push 0
push eax
push 0x10003550
push 0
push 0
call fcn.100f0646
mov ecx, eax
add esp, 0x18
mov dword [ebp - 8], ecx
test ecx, ecx
je 0x10005154
cmp dword [esi + 0x60], 0
jne 0x1000514f
mov eax, dword [ebp - 4]
mov dword [esi + 0x5c], ecx
mov dword [esi + 0x60], eax
pop esi
mov esp, ebp
pop ebp
ret
mov dword [0x1018492c], 0
pop esi
mov esp, ebp
pop ebp
ret
push 5
call fcn.100d2574
push 6
mov dword [0x1015a064], 0x7ffffffe
call fcn.100d2574
call fcn.100f0445
push 6
mov dword [ebp - 4], 0
call fcn.100d2574
int3
Function at 0x1003dd60
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1011b919
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push ebx
push esi
push edi
mov eax, dword [0x1015bc40]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
mov ebx, dword [ebp + 8]
test ebx, ebx
jne 0x1003ddaa
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
movzx eax, bl
xor eax, 0x811c9dc5
imul ecx, eax, 0x1000193
mov eax, ebx
sar eax, 8
movzx eax, al
xor ecx, eax
mov eax, ebx
sar eax, 0x10
imul ecx, ecx, 0x1000193
movzx eax, al
xor ecx, eax
mov eax, ebx
imul ecx, ecx, 0x1000193
sar eax, 0x18
movzx eax, al
xor ecx, eax
imul eax, ecx, 0x1000193
lea ecx, [esi + 0x108]
push eax
lea eax, [ebp + 8]
push eax
lea eax, [ebp - 0x1c]
push eax
call fcn.1003df40
mov eax, dword [eax + 4]
test eax, eax
jne 0x1003de09
mov eax, dword [esi + 0x10c]
cmp eax, dword [esi + 0x10c]
je 0x1003de31
mov eax, dword [eax + 0xc]
lea ecx, [eax - 4]
neg eax
sbb eax, eax
and eax, ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
mov ecx, dword [ebp + 0xc]
mov edx, 0x1013dea8
mov esi, 0xc
nop
mov eax, dword [ecx]
cmp eax, dword [edx]
jne 0x1003deb7
add ecx, 4
add edx, 4
sub esi, 4
jae 0x1003de40
push 0x10
call fcn.100d04bc
mov edi, eax
add esp, 4
mov dword [ebp + 0xc], edi
mov dword [ebp - 4], 0
test edi, edi
je 0x1003df1f
mov ecx, dword [ebp - 0x10]
lea esi, [edi + 4]
mov ecx, dword [ecx + 4]
mov dword [esi], vtable.AddressLookupTableObject.0
lea eax, [ebp + 8]
mov dword [edi + 0xc], ecx
push eax
mov dword [edi], vtable.m_IDirect3DSurface9.0
lea eax, [ebp - 0x1c]
mov dword [esi], vtable.m_IDirect3DSurface9.1.0
mov dword [edi + 8], ebx
mov ecx, dword [ecx + 0x1c8]
push eax
add ecx, 0x108
mov byte [ebp - 4], 1
mov dword [ebp + 8], ebx
call fcn.1003dfb0
mov eax, dword [eax]
mov dword [eax + 0xc], esi
jmp 0x1003df21
push 0x14
call fcn.100d04bc
mov edi, eax
add esp, 4
mov dword [ebp - 0x18], edi
mov dword [ebp - 4], 2
test edi, edi
je 0x1003df1f
mov ecx, dword [ebp - 0x10]
lea esi, [edi + 4]
mov ecx, dword [ecx + 4]
mov dword [esi], vtable.AddressLookupTableObject.0
mov eax, dword [ebp + 0xc]
mov dword [edi + 0x10], eax
lea eax, [ebp + 8]
mov dword [edi + 0xc], ecx
push eax
mov dword [edi], vtable.m_IDirect3DSwapChain9Ex.0
lea eax, [ebp - 0x14]
mov dword [esi], vtable.m_IDirect3DSwapChain9Ex.1.0
mov dword [edi + 8], ebx
mov ecx, dword [ecx + 0x1c8]
push eax
add ecx, 0x128
mov byte [ebp - 4], 3
mov dword [ebp + 8], ebx
call fcn.1003dfb0
mov eax, dword [eax]
mov dword [eax + 0xc], esi
jmp 0x1003df21
xor edi, edi
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x1003fe90
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
mov ebx, dword [ebp + 0xc]
push esi
mov esi, dword [ebp + 8]
push edi
push ebx
mov ecx, dword [esi + 4]
push ecx
mov eax, dword [ecx]
call dword [eax + 0xf4]
mov edi, eax
test edi, edi
js 0x1003fffd
test ebx, ebx
je 0x1003fffd
mov ebx, dword [ebx]
mov esi, dword [esi + 0x1c8]
mov dword [ebp + 8], esi
mov dword [ebp - 4], ebx
test ebx, ebx
jne 0x1003fee2
mov eax, dword [ebp + 0xc]
xor esi, esi
mov dword [eax], esi
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
movzx eax, bl
xor eax, 0x811c9dc5
imul ecx, eax, 0x1000193
mov eax, ebx
shr eax, 8
movzx eax, al
xor ecx, eax
mov eax, ebx
imul ecx, ecx, 0x1000193
shr eax, 0x10
movzx eax, al
xor ecx, eax
mov eax, ebx
imul ecx, ecx, 0x1000193
shr eax, 0x18
xor ecx, eax
imul eax, ecx, 0x1000193
lea ecx, [esi + 0xe8]
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0xc]
push eax
call fcn.1003df40
mov eax, dword [eax + 4]
test eax, eax
jne 0x1003ff3e
mov eax, dword [esi + 0xec]
cmp eax, dword [esi + 0xec]
je 0x1003ff62
mov esi, dword [eax + 0xc]
lea eax, [esi - 4]
neg esi
sbb esi, esi
and esi, eax
mov eax, dword [ebp + 0xc]
mov dword [eax], esi
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
mov ecx, 0x1013dea8
mov esi, 0xc
mov edx, ecx
nop
mov eax, dword [ecx]
cmp eax, dword [edx]
jne 0x1003ffe6
add ecx, 4
add edx, 4
sub esi, 4
jae 0x1003ff70
push 0x10
call fcn.100d04bc
mov esi, eax
add esp, 4
test esi, esi
je 0x1003fed0
mov ecx, dword [ebp + 8]
mov dword [ebp + 8], ebx
mov eax, dword [ecx + 4]
mov dword [esi], vtable.m_IDirect3DStateBlock9.0
mov dword [esi + 4], vtable.m_IDirect3DStateBlock9.1.0
mov dword [esi + 8], ebx
mov dword [esi + 0xc], eax
mov ecx, dword [eax + 0x1c8]
test ebx, ebx
je 0x1003fff6
lea eax, [ebp + 8]
add ecx, 0xe8
push eax
lea eax, [ebp - 0xc]
push eax
call fcn.1003dfb0
lea ecx, [esi + 4]
mov eax, dword [eax]
mov dword [eax + 0xc], ecx
mov eax, dword [ebp + 0xc]
mov dword [eax], esi
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
mov ecx, dword [ebp + 8]
push 0x1013dea8
push ebx
call fcn.1003f410
mov esi, eax
mov eax, dword [ebp + 0xc]
mov dword [eax], esi
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x100404c0
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
mov ebx, dword [ebp + 0xc]
push esi
mov esi, dword [ebp + 8]
push edi
push ebx
mov ecx, dword [esi + 4]
push ecx
mov eax, dword [ecx]
call dword [eax + 0x1a4]
mov edi, eax
test edi, edi
js 0x1004062d
test ebx, ebx
je 0x1004062d
mov ebx, dword [ebx]
mov esi, dword [esi + 0x1c8]
mov dword [ebp + 8], esi
mov dword [ebp - 4], ebx
test ebx, ebx
jne 0x10040512
mov eax, dword [ebp + 0xc]
xor esi, esi
mov dword [eax], esi
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
movzx eax, bl
xor eax, 0x811c9dc5
imul ecx, eax, 0x1000193
mov eax, ebx
shr eax, 8
movzx eax, al
xor ecx, eax
mov eax, ebx
imul ecx, ecx, 0x1000193
shr eax, 0x10
movzx eax, al
xor ecx, eax
mov eax, ebx
imul ecx, ecx, 0x1000193
shr eax, 0x18
xor ecx, eax
imul eax, ecx, 0x1000193
lea ecx, [esi + 0x88]
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0xc]
push eax
call fcn.1003df40
mov eax, dword [eax + 4]
test eax, eax
jne 0x1004056e
mov eax, dword [esi + 0x8c]
cmp eax, dword [esi + 0x8c]
je 0x10040592
mov esi, dword [eax + 0xc]
lea eax, [esi - 4]
neg esi
sbb esi, esi
and esi, eax
mov eax, dword [ebp + 0xc]
mov dword [eax], esi
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
mov ecx, 0x1013dea8
mov esi, 0xc
mov edx, ecx
nop
mov eax, dword [ecx]
cmp eax, dword [edx]
jne 0x10040616
add ecx, 4
add edx, 4
sub esi, 4
jae 0x100405a0
push 0x10
call fcn.100d04bc
mov esi, eax
add esp, 4
test esi, esi
je 0x10040500
mov ecx, dword [ebp + 8]
mov dword [ebp + 8], ebx
mov eax, dword [ecx + 4]
mov dword [esi], vtable.m_IDirect3DIndexBuffer9.0
mov dword [esi + 4], vtable.m_IDirect3DIndexBuffer9.1.0
mov dword [esi + 8], ebx
mov dword [esi + 0xc], eax
mov ecx, dword [eax + 0x1c8]
test ebx, ebx
je 0x10040626
lea eax, [ebp + 8]
add ecx, 0x88
push eax
lea eax, [ebp - 0xc]
push eax
call fcn.1003dfb0
lea ecx, [esi + 4]
mov eax, dword [eax]
mov dword [eax + 0xc], ecx
mov eax, dword [ebp + 0xc]
mov dword [eax], esi
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
mov ecx, dword [ebp + 8]
push 0x1013dea8
push ebx
call fcn.1003f410
mov esi, eax
mov eax, dword [ebp + 0xc]
mov dword [eax], esi
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x10040720
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
mov ebx, dword [ebp + 0xc]
push esi
mov esi, dword [ebp + 8]
push edi
push ebx
mov ecx, dword [esi + 4]
push ecx
mov eax, dword [ecx]
call dword [eax + 0x1b0]
mov edi, eax
test edi, edi
js 0x1004088d
test ebx, ebx
je 0x1004088d
mov ebx, dword [ebx]
mov esi, dword [esi + 0x1c8]
mov dword [ebp + 8], esi
mov dword [ebp - 4], ebx
test ebx, ebx
jne 0x10040772
mov eax, dword [ebp + 0xc]
xor esi, esi
mov dword [eax], esi
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
movzx eax, bl
xor eax, 0x811c9dc5
imul ecx, eax, 0x1000193
mov eax, ebx
shr eax, 8
movzx eax, al
xor ecx, eax
mov eax, ebx
imul ecx, ecx, 0x1000193
shr eax, 0x10
movzx eax, al
xor ecx, eax
mov eax, ebx
imul ecx, ecx, 0x1000193
shr eax, 0x18
xor ecx, eax
imul eax, ecx, 0x1000193
lea ecx, [esi + 0xa8]
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0xc]
push eax
call fcn.1003df40
mov eax, dword [eax + 4]
test eax, eax
jne 0x100407ce
mov eax, dword [esi + 0xac]
cmp eax, dword [esi + 0xac]
je 0x100407f2
mov esi, dword [eax + 0xc]
lea eax, [esi - 4]
neg esi
sbb esi, esi
and esi, eax
mov eax, dword [ebp + 0xc]
mov dword [eax], esi
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
mov ecx, 0x1013dea8
mov esi, 0xc
mov edx, ecx
nop
mov eax, dword [ecx]
cmp eax, dword [edx]
jne 0x10040876
add ecx, 4
add edx, 4
sub esi, 4
jae 0x10040800
push 0x10
call fcn.100d04bc
mov esi, eax
add esp, 4
test esi, esi
je 0x10040760
mov ecx, dword [ebp + 8]
mov dword [ebp + 8], ebx
mov eax, dword [ecx + 4]
mov dword [esi], vtable.m_IDirect3DPixelShader9.0
mov dword [esi + 4], vtable.m_IDirect3DPixelShader9.1.0
mov dword [esi + 8], ebx
mov dword [esi + 0xc], eax
mov ecx, dword [eax + 0x1c8]
test ebx, ebx
je 0x10040886
lea eax, [ebp + 8]
add ecx, 0xa8
push eax
lea eax, [ebp - 0xc]
push eax
call fcn.1003dfb0
lea ecx, [esi + 4]
mov eax, dword [eax]
mov dword [eax + 0xc], ecx
mov eax, dword [ebp + 0xc]
mov dword [eax], esi
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
mov ecx, dword [ebp + 8]
push 0x1013dea8
push ebx
call fcn.1003f410
mov esi, eax
mov eax, dword [ebp + 0xc]
mov dword [eax], esi
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x10040a00
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
mov ebx, dword [ebp + 0x10]
push esi
mov esi, dword [ebp + 8]
push edi
push dword [ebp + 0x18]
push dword [ebp + 0x14]
mov ecx, dword [esi + 4]
push ebx
push dword [ebp + 0xc]
mov eax, dword [ecx]
push ecx
call dword [eax + 0x194]
mov edi, eax
test edi, edi
js 0x10040b74
test ebx, ebx
je 0x10040b74
mov ebx, dword [ebx]
mov esi, dword [esi + 0x1c8]
mov dword [ebp + 8], esi
mov dword [ebp + 0x18], ebx
test ebx, ebx
jne 0x10040a5b
mov eax, dword [ebp + 0x10]
xor esi, esi
mov dword [eax], esi
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x14
movzx eax, bl
xor eax, 0x811c9dc5
imul ecx, eax, 0x1000193
mov eax, ebx
shr eax, 8
movzx eax, al
xor ecx, eax
mov eax, ebx
imul ecx, ecx, 0x1000193
shr eax, 0x10
movzx eax, al
xor ecx, eax
mov eax, ebx
imul ecx, ecx, 0x1000193
shr eax, 0x18
xor ecx, eax
imul eax, ecx, 0x1000193
lea ecx, [esi + 0x168]
push eax
lea eax, [ebp + 0x18]
push eax
lea eax, [ebp - 8]
push eax
call fcn.1003df40
mov eax, dword [eax + 4]
test eax, eax
jne 0x10040ab7
mov eax, dword [esi + 0x16c]
cmp eax, dword [esi + 0x16c]
je 0x10040adb
mov esi, dword [eax + 0xc]
lea eax, [esi - 4]
neg esi
sbb esi, esi
and esi, eax
mov eax, dword [ebp + 0x10]
mov dword [eax], esi
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x14
mov ecx, 0x1013dea8
mov esi, 0xc
mov edx, ecx
mov eax, dword [ecx]
cmp eax, dword [edx]
jne 0x10040b5d
add ecx, 4
add edx, 4
sub esi, 4
jae 0x10040ae7
push 0x10
call fcn.100d04bc
mov esi, eax
add esp, 4
test esi, esi
je 0x10040a49
mov ecx, dword [ebp + 8]
mov dword [ebp + 8], ebx
mov eax, dword [ecx + 4]
mov dword [esi], vtable.m_IDirect3DVertexBuffer9.0
mov dword [esi + 4], vtable.m_IDirect3DVertexBuffer9.1.0
mov dword [esi + 8], ebx
mov dword [esi + 0xc], eax
mov ecx, dword [eax + 0x1c8]
test ebx, ebx
je 0x10040b6d
lea eax, [ebp + 8]
add ecx, 0x168
push eax
lea eax, [ebp - 8]
push eax
call fcn.1003dfb0
lea ecx, [esi + 4]
mov eax, dword [eax]
mov dword [eax + 0xc], ecx
mov eax, dword [ebp + 0x10]
mov dword [eax], esi
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x14
mov ecx, dword [ebp + 8]
push 0x1013dea8
push ebx
call fcn.1003f410
mov esi, eax
mov eax, dword [ebp + 0x10]
mov dword [eax], esi
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x14
Function at 0x10040ba0
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
mov ebx, dword [ebp + 0x10]
push esi
mov esi, dword [ebp + 8]
push edi
push ebx
push dword [ebp + 0xc]
mov ecx, dword [esi + 4]
push ecx
mov eax, dword [ecx]
call dword [eax + 0x38]
mov edi, eax
test edi, edi
js 0x10040d14
test ebx, ebx
je 0x10040d14
mov ebx, dword [ebx]
mov esi, dword [esi + 0x1c8]
mov dword [ebp + 8], esi
mov dword [ebp + 0xc], ebx
test ebx, ebx
jne 0x10040bf2
mov eax, dword [ebp + 0x10]
xor esi, esi
mov dword [eax], esi
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
movzx eax, bl
xor eax, 0x811c9dc5
imul ecx, eax, 0x1000193
mov eax, ebx
shr eax, 8
movzx eax, al
xor ecx, eax
mov eax, ebx
imul ecx, ecx, 0x1000193
shr eax, 0x10
movzx eax, al
xor ecx, eax
mov eax, ebx
imul ecx, ecx, 0x1000193
shr eax, 0x18
xor ecx, eax
imul eax, ecx, 0x1000193
lea ecx, [esi + 0x128]
push eax
lea eax, [ebp + 0xc]
push eax
lea eax, [ebp - 8]
push eax
call fcn.1003df40
mov eax, dword [eax + 4]
test eax, eax
jne 0x10040c4e
mov eax, dword [esi + 0x12c]
cmp eax, dword [esi + 0x12c]
je 0x10040c72
mov esi, dword [eax + 0xc]
lea eax, [esi - 4]
neg esi
sbb esi, esi
and esi, eax
mov eax, dword [ebp + 0x10]
mov dword [eax], esi
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov ecx, 0x1013dea8
mov esi, 0xc
mov edx, ecx
nop
mov eax, dword [ecx]
cmp eax, dword [edx]
jne 0x10040cfd
add ecx, 4
add edx, 4
sub esi, 4
jae 0x10040c80
push 0x14
call fcn.100d04bc
mov esi, eax
add esp, 4
test esi, esi
je 0x10040be0
mov ecx, dword [ebp + 8]
mov dword [ebp + 8], ebx
mov eax, dword [ecx + 4]
mov dword [esi], vtable.m_IDirect3DSwapChain9Ex.0
mov dword [esi + 4], vtable.m_IDirect3DSwapChain9Ex.1.0
mov dword [esi + 8], ebx
mov dword [esi + 0xc], eax
mov dword [esi + 0x10], 0x1012a970
mov ecx, dword [eax + 0x1c8]
test ebx, ebx
je 0x10040d0d
lea eax, [ebp + 8]
add ecx, 0x128
push eax
lea eax, [ebp - 8]
push eax
call fcn.1003dfb0
lea ecx, [esi + 4]
mov eax, dword [eax]
mov dword [eax + 0xc], ecx
mov eax, dword [ebp + 0x10]
mov dword [eax], esi
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov ecx, dword [ebp + 8]
push 0x1013dea8
push ebx
call fcn.1003f410
mov esi, eax
mov eax, dword [ebp + 0x10]
mov dword [eax], esi
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x100411a0
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
mov ebx, dword [ebp + 0xc]
push esi
mov esi, dword [ebp + 8]
push edi
push ebx
mov ecx, dword [esi + 4]
push ecx
mov eax, dword [ecx]
call dword [eax + 0x160]
mov edi, eax
test edi, edi
js 0x1004130d
test ebx, ebx
je 0x1004130d
mov ebx, dword [ebx]
mov esi, dword [esi + 0x1c8]
mov dword [ebp + 8], esi
mov dword [ebp - 4], ebx
test ebx, ebx
jne 0x100411f2
mov eax, dword [ebp + 0xc]
xor esi, esi
mov dword [eax], esi
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
movzx eax, bl
xor eax, 0x811c9dc5
imul ecx, eax, 0x1000193
mov eax, ebx
shr eax, 8
movzx eax, al
xor ecx, eax
mov eax, ebx
imul ecx, ecx, 0x1000193
shr eax, 0x10
movzx eax, al
xor ecx, eax
mov eax, ebx
imul ecx, ecx, 0x1000193
shr eax, 0x18
xor ecx, eax
imul eax, ecx, 0x1000193
lea ecx, [esi + 0x188]
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0xc]
push eax
call fcn.1003df40
mov eax, dword [eax + 4]
test eax, eax
jne 0x1004124e
mov eax, dword [esi + 0x18c]
cmp eax, dword [esi + 0x18c]
je 0x10041272
mov esi, dword [eax + 0xc]
lea eax, [esi - 4]
neg esi
sbb esi, esi
and esi, eax
mov eax, dword [ebp + 0xc]
mov dword [eax], esi
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
mov ecx, 0x1013dea8
mov esi, 0xc
mov edx, ecx
nop
mov eax, dword [ecx]
cmp eax, dword [edx]
jne 0x100412f6
add ecx, 4
add edx, 4
sub esi, 4
jae 0x10041280
push 0x10
call fcn.100d04bc
mov esi, eax
add esp, 4
test esi, esi
je 0x100411e0
mov ecx, dword [ebp + 8]
mov dword [ebp + 8], ebx
mov eax, dword [ecx + 4]
mov dword [esi], vtable.m_IDirect3DVertexDeclaration9.0
mov dword [esi + 4], vtable.m_IDirect3DVertexDeclaration9.1.0
mov dword [esi + 8], ebx
mov dword [esi + 0xc], eax
mov ecx, dword [eax + 0x1c8]
test ebx, ebx
je 0x10041306
lea eax, [ebp + 8]
add ecx, 0x188
push eax
lea eax, [ebp - 0xc]
push eax
call fcn.1003dfb0
lea ecx, [esi + 4]
mov eax, dword [eax]
mov dword [eax + 0xc], ecx
mov eax, dword [ebp + 0xc]
mov dword [eax], esi
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
mov ecx, dword [ebp + 8]
push 0x1013dea8
push ebx
call fcn.1003f410
mov esi, eax
mov eax, dword [ebp + 0xc]
mov dword [eax], esi
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x10041320
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
mov ebx, dword [ebp + 0xc]
push esi
mov esi, dword [ebp + 8]
push edi
push ebx
mov ecx, dword [esi + 4]
push ecx
mov eax, dword [ecx]
call dword [eax + 0x174]
mov edi, eax
test edi, edi
js 0x1004148d
test ebx, ebx
je 0x1004148d
mov ebx, dword [ebx]
mov esi, dword [esi + 0x1c8]
mov dword [ebp + 8], esi
mov dword [ebp - 4], ebx
test ebx, ebx
jne 0x10041372
mov eax, dword [ebp + 0xc]
xor esi, esi
mov dword [eax], esi
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
movzx eax, bl
xor eax, 0x811c9dc5
imul ecx, eax, 0x1000193
mov eax, ebx
shr eax, 8
movzx eax, al
xor ecx, eax
mov eax, ebx
imul ecx, ecx, 0x1000193
shr eax, 0x10
movzx eax, al
xor ecx, eax
mov eax, ebx
imul ecx, ecx, 0x1000193
shr eax, 0x18
xor ecx, eax
imul eax, ecx, 0x1000193
lea ecx, [esi + 0x1a8]
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0xc]
push eax
call fcn.1003df40
mov eax, dword [eax + 4]
test eax, eax
jne 0x100413ce
mov eax, dword [esi + 0x1ac]
cmp eax, dword [esi + 0x1ac]
je 0x100413f2
mov esi, dword [eax + 0xc]
lea eax, [esi - 4]
neg esi
sbb esi, esi
and esi, eax
mov eax, dword [ebp + 0xc]
mov dword [eax], esi
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
mov ecx, 0x1013dea8
mov esi, 0xc
mov edx, ecx
nop
mov eax, dword [ecx]
cmp eax, dword [edx]
jne 0x10041476
add ecx, 4
add edx, 4
sub esi, 4
jae 0x10041400
push 0x10
call fcn.100d04bc
mov esi, eax
add esp, 4
test esi, esi
je 0x10041360
mov ecx, dword [ebp + 8]
mov dword [ebp + 8], ebx
mov eax, dword [ecx + 4]
mov dword [esi], vtable.m_IDirect3DVertexShader9.0
mov dword [esi + 4], vtable.m_IDirect3DVertexShader9.1.0
mov dword [esi + 8], ebx
mov dword [esi + 0xc], eax
mov ecx, dword [eax + 0x1c8]
test ebx, ebx
je 0x10041486
lea eax, [ebp + 8]
add ecx, 0x1a8
push eax
lea eax, [ebp - 0xc]
push eax
call fcn.1003dfb0
lea ecx, [esi + 4]
mov eax, dword [eax]
mov dword [eax + 0xc], ecx
mov eax, dword [ebp + 0xc]
mov dword [eax], esi
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
mov ecx, dword [ebp + 8]
push 0x1013dea8
push ebx
call fcn.1003f410
mov esi, eax
mov eax, dword [ebp + 0xc]
mov dword [eax], esi
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x10043490
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1011b919
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push ebx
push esi
push edi
mov eax, dword [0x1015bc40]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
mov ebx, dword [ebp + 8]
test ebx, ebx
jne 0x100434da
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
movzx eax, bl
xor eax, 0x811c9dc5
imul ecx, eax, 0x1000193
mov eax, ebx
sar eax, 8
movzx eax, al
xor ecx, eax
mov eax, ebx
sar eax, 0x10
imul ecx, ecx, 0x1000193
movzx eax, al
xor ecx, eax
mov eax, ebx
imul ecx, ecx, 0x1000193
sar eax, 0x18
movzx eax, al
xor ecx, eax
imul eax, ecx, 0x1000193
lea ecx, [esi + 0x1c8]
push eax
lea eax, [ebp + 8]
push eax
lea eax, [ebp - 0x1c]
push eax
call fcn.1003df40
mov eax, dword [eax + 4]
test eax, eax
jne 0x10043539
mov eax, dword [esi + 0x1cc]
cmp eax, dword [esi + 0x1cc]
je 0x10043561
mov eax, dword [eax + 0xc]
lea ecx, [eax - 4]
neg eax
sbb eax, eax
and eax, ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
mov ecx, dword [ebp + 0xc]
mov edx, 0x1013dea8
mov esi, 0xc
nop
mov eax, dword [ecx]
cmp eax, dword [edx]
jne 0x100435e7
add ecx, 4
add edx, 4
sub esi, 4
jae 0x10043570
push 0x10
call fcn.100d04bc
mov edi, eax
add esp, 4
mov dword [ebp + 0xc], edi
mov dword [ebp - 4], 0
test edi, edi
je 0x1004364f
mov ecx, dword [ebp - 0x10]
lea esi, [edi + 4]
mov ecx, dword [ecx + 4]
mov dword [esi], vtable.AddressLookupTableObject.0
lea eax, [ebp + 8]
mov dword [edi + 0xc], ecx
push eax
mov dword [edi], vtable.m_IDirect3DVolume9.0
lea eax, [ebp - 0x1c]
mov dword [esi], vtable.m_IDirect3DVolume9.1.0
mov dword [edi + 8], ebx
mov ecx, dword [ecx + 0x1c8]
push eax
add ecx, 0x1c8
mov byte [ebp - 4], 1
mov dword [ebp + 8], ebx
call fcn.1003dfb0
mov eax, dword [eax]
mov dword [eax + 0xc], esi
jmp 0x10043651
push 0x14
call fcn.100d04bc
mov edi, eax
add esp, 4
mov dword [ebp - 0x18], edi
mov dword [ebp - 4], 2
test edi, edi
je 0x1004364f
mov ecx, dword [ebp - 0x10]
lea esi, [edi + 4]
mov ecx, dword [ecx + 4]
mov dword [esi], vtable.AddressLookupTableObject.0
mov eax, dword [ebp + 0xc]
mov dword [edi + 0x10], eax
lea eax, [ebp + 8]
mov dword [edi + 0xc], ecx
push eax
mov dword [edi], vtable.m_IDirect3DSwapChain9Ex.0
lea eax, [ebp - 0x14]
mov dword [esi], vtable.m_IDirect3DSwapChain9Ex.1.0
mov dword [edi + 8], ebx
mov ecx, dword [ecx + 0x1c8]
push eax
add ecx, 0x128
mov byte [ebp - 4], 3
mov dword [ebp + 8], ebx
call fcn.1003dfb0
mov eax, dword [eax]
mov dword [eax + 0xc], esi
jmp 0x10043651
xor edi, edi
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8