joyce8/EMBER2024-capa huggingface dataset:
Function at 0x404380
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push esi
push edi
call dword [sym.imp.USER32.DLL_GetFocus]
test eax, eax
mov edi, dword [sym.imp.USER32.DLL_GetPropA]
mov dword [ebp - 4], eax
je 0x40440b
mov esi, dword [sym.imp.USER32.DLL_GetKeyState]
push 9
call esi
test al, al
jns 0x4043fd
push 0x11
call esi
test al, al
js 0x4043fd
push 0x10
call esi
test al, al
js 0x4043fd
push 0x12
call esi
test al, al
js 0x4043fd
push 5
lea eax, [ebp - 0xc]
push eax
push dword [ebp - 4]
call dword [sym.imp.USER32.DLL_GetClassNameA]
push 4
lea eax, [ebp - 0xc]
push str.Rich
push eax
call sub.MSVCRT.dll_strncmp
add esp, 0xc
test eax, eax
jne 0x4043fd
push eax
push eax
push 0x44e
push dword [ebp - 4]
call dword [sym.imp.USER32.DLL_SendMessageA]
test ax, 0x800
je 0x40442b
push str.PB_Hotkey
push dword [ebp - 4]
call edi
test eax, eax
jne 0x40442b
push str.PB_WindowID
push dword [ebp + 8]
call edi
test eax, eax
je 0x40442b
dec eax
push eax
push dword [0x408ff8]
call fcn.004050f0
mov eax, dword [eax + 8]
jmp 0x40442d
xor eax, eax
pop edi
pop esi
leave
ret 4

Function at 0x4046f1
Capabilities:
Check os version

Disassembly:
push ebp
lea ebp, [esp - 0x78]
sub esp, 0x94
push edi
push str.msimg32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
xor edi, edi
cmp eax, edi
mov dword [0x408f64], eax
je 0x404724
push str.AlphaBlend
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x408f68], eax
lea eax, [ebp - 0x1c]
push eax
mov dword [0x408f60], 1
mov dword [ebp - 0x1c], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
test eax, eax
je 0x404762
cmp dword [ebp - 0xc], 1
je 0x404773
cmp dword [ebp - 0xc], 2
jne 0x404762
cmp dword [ebp - 0x18], 5
jb 0x404773
jne 0x404762
cmp dword [ebp - 0x14], edi
jne 0x404762
mov dword [0x408f60], edi
cmp dword [0x408f60], edi
je 0x404779
call fcn.00404638
test eax, eax
jne 0x404779
mov dword [0x408f60], edi
pop edi
add ebp, 0x78
leave
ret
Function at 0x420250
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5c8670
mov eax, dword fs:[0]
push eax
push esi
push edi
mov eax, dword [0x6540c0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
push 8
mov dword [edi], vtable.std::basic_streambuf_char__struct_std::char_traits_char__.0
mov dword [edi + 4], 0
mov dword [edi + 8], 0
mov dword [edi + 0xc], 0
mov dword [edi + 0x10], 0
mov dword [edi + 0x14], 0
mov dword [edi + 0x18], 0
mov dword [edi + 0x1c], 0
mov dword [edi + 0x20], 0
mov dword [edi + 0x24], 0
mov dword [edi + 0x28], 0
mov dword [edi + 0x2c], 0
mov dword [edi + 0x30], 0
call fcn.00439298
mov esi, eax
push 1
mov dword [ebp - 4], 0
call fcn.00437fe7
add esp, 8
mov dword [esi + 4], eax
mov ecx, edi
mov dword [edi + 0x34], esi
call fcn.004201f0
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x4206d0
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x104
mov eax, dword [0x6540c0]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push 0x100
lea eax, [ebp - 0x104]
mov esi, ecx
push 0
push eax
call fcn.0048fce0
push esi
lea eax, [ebp - 0x104]
push 0xff
push eax
call fcn.00421d00
add esp, 0x18
lea eax, [ebp - 0x104]
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.0043928a
mov esp, ebp
pop ebp
ret

Function at 0x420730
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x204
mov eax, dword [0x6540c0]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push 0x200
lea eax, [ebp - 0x204]
mov esi, ecx
push 0
push eax
call fcn.0048fce0
push esi
lea eax, [ebp - 0x204]
push 0xff
push eax
call fcn.00421d20
add esp, 0x18
lea eax, [ebp - 0x204]
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.0043928a
mov esp, ebp
pop ebp
ret

Function at 0x420790
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x204
mov eax, dword [0x6540c0]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push 0x200
lea eax, [ebp - 0x204]
mov esi, edx
push 0
push eax
call fcn.0048fce0
push dword [esi]
lea eax, [ebp - 0x204]
push 0x647098
push 0xff
push eax
call fcn.00421d20
add esp, 0x1c
lea eax, [ebp - 0x204]
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.0043928a
mov esp, ebp
pop ebp
ret
Function at 0x100223b0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1009ccbe
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push esi
push edi
mov eax, dword [0x100b9008]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, edx
mov dword [ebp - 0x10], ecx
push 0x748
call fcn.1009b356
mov ebx, eax
add esp, 4
mov dword [ebp - 0x14], ebx
mov dword [ebp - 4], 0
lea edi, [ebx + 0xc]
mov dword [ebx + 4], 1
mov dword [ebx + 8], 1
mov dword [ebx], 0x100a8104
mov eax, dword [esi]
mov dword [edi + 0xc], 0
mov dword [edi + 0x24], 0
mov dword [edi + 0x28], 0
mov dword [edi + 0x2c], 0
mov dword [edi + 0x30], 0
mov dword [edi + 0x34], 0
mov dword [edi + 0x38], 0
mov dword [edi + 0x3c], 0
mov dword [edi + 0x40], 0
mov dword [edi + 0x44], 0
mov dword [edi + 0x48], 0
mov dword [edi + 0x4c], 0
mov dword [edi + 0x50], 0
mov dword [edi + 0x54], 0
mov dword [edi + 0x58], 0
mov dword [edi + 0x5c], 0
mov dword [edi + 0x60], 0
mov dword [edi + 0x64], 0
mov dword [edi + 0x68], 0
mov dword [edi + 0x6c], 0
mov dword [edi + 0x70], 0
mov dword [edi + 0x74], 0
mov dword [edi + 0x694], 0
mov dword [edi + 0x698], 0
mov dword [edi + 0x69c], 0
mov byte [edi + 0x6a8], 0
mov dword [edi + 0x6ac], 0
mov byte [edi + 0x6b4], 0
mov dword [edi + 0x6b8], 0
mov dword [edi + 0x6bc], 0
mov dword [edi + 0x6c0], 0
mov dword [edi + 0x6c4], 0
mov dword [edi + 0x6c8], 0
mov dword [edi + 0x6cc], 0
mov dword [edi + 0x6e8], 0
mov dword [edi + 0x6ec], 0xf
mov dword [ebp - 0x18], edi
mov byte [edi + 0x6d8], 0
mov dword [edi + 0x700], 0
mov dword [edi + 0x704], 0xf
mov byte [edi + 0x6f0], 0
mov byte [ebp - 4], 2
mov ecx, edi
mov word [edi + 0x709], 0
mov byte [edi + 0x70b], 0
mov dword [edi + 0x708], 0
push eax
mov dword [edi + 0x710], 0
call fcn.1001ae00
mov eax, dword [ebp - 0x10]
xorps xmm0, xmm0
movq qword [eax], xmm0
mov dword [eax], edi
mov dword [eax + 4], ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1002ab90
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x100b9008]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, ecx
push edi
cmp dword [esi + 0x38], 0
je 0x1002ac33
cmp byte [esi + 0x3d], 0
je 0x1002ac33
mov eax, dword [esi]
push 0xffffffffffffffff
call dword [eax + 0xc]
cmp eax, 0xffffffff
je 0x1002abe8
mov ecx, dword [esi + 0x38]
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [esi + 0x40]
push eax
call dword [sym.imp.MSVCP140.dll_public:_int___thiscall_std::codecvt_char__char__struct__Mbstatet_::unshift_struct__Mbstatet___char___char___char___const]
sub eax, 0
je 0x1002abfa
sub eax, 1
je 0x1002abfe
sub eax, 2
je 0x1002ac33
pop edi
xor al, al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1009b337
mov esp, ebp
pop ebp
ret
mov byte [esi + 0x3d], 0
mov edi, dword [ebp - 0x28]
lea eax, [ebp - 0x24]
sub edi, eax
je 0x1002ac1c
push dword [esi + 0x4c]
push edi
push 1
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
add esp, 0x10
cmp edi, eax
jne 0x1002abe8
cmp byte [esi + 0x3d], 0
pop edi
sete al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1009b337
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
mov al, 1
pop edi
xor ecx, ebp
pop esi
call fcn.1009b337
mov esp, ebp
pop ebp
ret
Function at 0x1002c780
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1009d310
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push ebx
push esi
push edi
mov eax, dword [0x100b9008]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 4], 0
mov eax, dword [0x10117c44]
mov ecx, dword [eax]
mov dword [eax], eax
mov eax, dword [0x10117c44]
mov dword [eax + 4], eax
mov dword [0x10117c48], 0
cmp ecx, dword [0x10117c44]
je 0x1002c7e9
mov esi, dword [ecx]
push 0x10
push ecx
call fcn.1009b7cf
add esp, 8
mov ecx, esi
cmp esi, dword [0x10117c44]
jne 0x1002c7d2
push 8
mov ecx, 0x10117c40
call fcn.10021f30
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [0x10112020]
test ecx, ecx
je 0x1002c947
mov eax, dword [ecx]
mov eax, dword [eax + 0x20]
call eax
mov edi, eax
test edi, edi
je 0x1002c947
nop dword [eax + eax]
mov eax, dword [edi + 0x14]
mov ebx, 0x811c9dc5
mov esi, dword [edi + 8]
mov dword [ebp - 0x18], eax
xor eax, eax
inc eax
cmp byte [eax + esi], 0
jne 0x1002c830
xor edx, edx
test eax, eax
je 0x1002c851
nop dword [eax]
movsx ecx, byte [edx + esi]
inc edx
xor ecx, ebx
imul ebx, ecx, 0x1000193
cmp edx, eax
jb 0x1002c840
movzx eax, bl
xor eax, 0x811c9dc5
mov dword [ebp - 0x14], ebx
imul ecx, eax, 0x1000193
mov eax, ebx
shr eax, 8
movzx eax, al
xor ecx, eax
mov eax, ebx
imul ecx, ecx, 0x1000193
shr eax, 0x10
movzx eax, al
xor ecx, eax
mov eax, ebx
imul ecx, ecx, 0x1000193
shr eax, 0x18
xor ecx, eax
imul edx, ecx, 0x1000193
mov ecx, dword [0x10117c4c]
and edx, dword [0x10117c58]
mov esi, dword [ecx + edx*8]
lea ecx, [ecx + edx*8]
mov edx, dword [0x10117c44]
add ecx, 4
mov eax, esi
mov dword [ebp - 0x10], ecx
nop
cmp esi, edx
jne 0x1002c8b8
mov ecx, edx
jmp 0x1002c8bc
mov ecx, dword [ecx]
mov ecx, dword [ecx]
cmp eax, ecx
je 0x1002c8d0
cmp dword [eax + 8], ebx
je 0x1002c8cc
mov eax, dword [eax]
mov ecx, dword [ebp - 0x10]
jmp 0x1002c8b0
mov ecx, eax
jmp 0x1002c8d4
mov eax, edx
mov ecx, edx
cmp ecx, edx
jne 0x1002c92f
mov esi, dword [edx]
lea eax, [ebp - 0x14]
push ecx
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x10]
push eax
mov ebx, dword [esi + 4]
push ecx
push ebx
push esi
call fcn.10030eb0
mov edx, dword [0x10117c48]
mov ecx, 0xffffffe
sub ecx, edx
cmp ecx, 1
jb 0x1002c959
lea ecx, [edx + 1]
mov dword [0x10117c48], ecx
mov ecx, 0x10117c40
mov dword [esi + 4], eax
mov dword [ebx], eax
mov eax, dword [0x10117c44]
mov eax, dword [eax]
push eax
add eax, 8
push eax
lea eax, [ebp - 0x20]
push eax
call fcn.10030c90
mov eax, dword [ebp - 0x20]
jmp 0x1002c936
mov dword [ebp - 0x20], eax
mov byte [ebp - 0x1c], 0
mov ecx, dword [ebp - 0x18]
mov dword [eax + 0xc], ecx
mov edi, dword [edi + 0x10]
test edi, edi
jne 0x1002c820
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push str.list_T__too_long
call dword [sym.imp.MSVCP140.dll_void___cdecl_std::_Xlength_error_char_const__]
int3
Function at 0x1002dbf0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
mov ecx, dword [0x10112028]
sub esp, 0xc
mov eax, dword [ecx]
push ebx
push esi
push edi
mov eax, dword [eax + 0x14]
push 0x100b99dc
push 0x100b99d8
call eax
call fcn.100911c0
call fcn.100712b0
call fcn.1002c970
cmp byte [0x100cb508], 0
je 0x1002dda5
mov ecx, dword [0x10112028]
mov eax, dword [ecx]
mov eax, dword [eax + 0x68]
call eax
test al, al
je 0x1002dda5
mov ecx, dword [0x101120ac]
xor ebx, ebx
mov dword [esp + 0x10], ecx
mov eax, dword [ecx + 0x28]
mov dword [esp + 0x14], eax
test eax, eax
je 0x1002dda5
nop
mov eax, dword [ecx + 0x1c]
mov ecx, dword [eax + ebx*4]
mov eax, dword [ecx]
mov eax, dword [eax + 0x30]
call eax
mov esi, eax
mov edi, 0x811c9dc5
xor ecx, ecx
inc ecx
cmp byte [ecx + esi], 0
jne 0x1002dc76
xor edx, edx
test ecx, ecx
je 0x1002dc9c
movsx eax, byte [edx + esi]
inc edx
xor eax, edi
imul edi, eax, 0x1000193
cmp edx, ecx
jb 0x1002dc83
cmp edi, 0x5ff56dc5
je 0x1002dcad
inc ebx
cmp ebx, dword [esp + 0x14]
jae 0x1002dda5
mov ecx, dword [esp + 0x10]
jmp 0x1002dc60
mov eax, dword [esp + 0x10]
mov eax, dword [eax + 0x1c]
mov ebx, dword [eax + ebx*4]
test ebx, ebx
je 0x1002dda5
mov esi, dword [ebx + 0x88]
test esi, esi
je 0x1002dda5
movss xmm1, dword [0x100ad760]
xor edx, edx
cmp esi, 4
jl 0x1002dd72
mov eax, dword [ebx + 0x7c]
lea edi, [esi - 4]
shr edi, 2
inc edi
lea ecx, [eax + 0x838]
lea edx, [eax + 0x1078]
lea eax, [edi*4]
mov dword [esp + 0x14], eax
movss xmm0, dword [ecx - 0x420]
ucomiss xmm0, xmm1
lahf
test ah, 0x44
jp 0x1002dd1c
mov dword [ecx - 0x420], 0x7f7fffff
movss xmm0, dword [ecx]
ucomiss xmm0, xmm1
lahf
test ah, 0x44
jp 0x1002dd2f
mov dword [ecx], 0x7f7fffff
movss xmm0, dword [edx - 0x420]
ucomiss xmm0, xmm1
lahf
test ah, 0x44
jp 0x1002dd4a
mov dword [edx - 0x420], 0x7f7fffff
movss xmm0, dword [edx]
ucomiss xmm0, xmm1
lahf
test ah, 0x44
jp 0x1002dd5d
mov dword [edx], 0x7f7fffff
add ecx, 0x1080
add edx, 0x1080
sub edi, 1
jne 0x1002dd01
mov edx, dword [esp + 0x14]
cmp edx, esi
jge 0x1002dda5
imul ecx, edx, 0x420
add ecx, 0x418
add ecx, dword [ebx + 0x7c]
sub esi, edx
movss xmm0, dword [ecx]
ucomiss xmm0, xmm1
lahf
test ah, 0x44
jp 0x1002dd9a
mov dword [ecx], 0x7f7fffff
add ecx, 0x420
sub esi, 1
jne 0x1002dd87
call fcn.1002cf80
call fcn.10072ee0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10030ee0
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
push ebx
push esi
push edi
movzx edx, byte [eax + 8]
mov edi, ecx
movzx ecx, byte [eax + 9]
xor edx, 0x811c9dc5
imul edx, edx, 0x1000193
mov ebx, dword [ebp + 8]
xor edx, ecx
movzx ecx, byte [eax + 0xa]
imul edx, edx, 0x1000193
xor edx, ecx
movzx ecx, byte [eax + 0xb]
imul edx, edx, 0x1000193
xor edx, ecx
imul ecx, edx, 0x1000193
mov edx, dword [edi + 0x18]
and edx, ecx
lea esi, [edx*8]
mov edx, dword [edi + 0xc]
add edx, esi
mov ecx, dword [edx]
cmp dword [edx + 4], eax
jne 0x10030f57
cmp ecx, eax
jne 0x10030f4f
mov ecx, dword [edi + 4]
mov dword [edx], ecx
mov edx, dword [edi + 0xc]
mov ecx, dword [edi + 4]
mov dword [esi + edx + 4], ecx
jmp 0x10030f5f
mov ecx, dword [eax + 4]
mov dword [edx + 4], ecx
jmp 0x10030f5f
cmp ecx, eax
jne 0x10030f5f
mov ecx, dword [eax]
mov dword [edx], ecx
mov ecx, dword [eax + 4]
mov esi, dword [eax]
push 0x10
push eax
mov dword [ecx], esi
mov edx, dword [eax]
mov ecx, dword [eax + 4]
mov dword [edx + 4], ecx
dec dword [edi + 8]
call fcn.1009b7cf
add esp, 8
mov dword [ebx], esi
mov eax, ebx
pop edi
pop esi
pop ebx
pop ebp
ret 8
Function at 0x1003d2c0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1009e650
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x100b9008]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
call fcn.1003d600
mov ecx, dword [ebp + 0xc]
mov esi, eax
mov dword [ebp - 4], 0
mov dword [ebp - 0x14], esi
mov word [esi + 0xc], 0
push dword [ecx]
lea ecx, [esi + 0x10]
call fcn.10027510
mov byte [ebp - 4], 1
lea ecx, [esi + 0x30]
push 0
mov byte [esi + 0x28], 0
call fcn.100394b0
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc

Function at 0x1003e440
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
mov esi, ecx
push edi
mov edi, dword [ebp + 8]
mov dword [ebp - 0xc], esi
mov edx, dword [esi + 0xc]
movzx eax, byte [edi]
xor eax, 0x811c9dc5
imul ecx, eax, 0x1000193
movzx eax, byte [edi + 1]
xor ecx, eax
movzx eax, byte [edi + 2]
imul ecx, ecx, 0x1000193
xor ecx, eax
movzx eax, byte [edi + 3]
imul ecx, ecx, 0x1000193
xor ecx, eax
imul eax, ecx, 0x1000193
mov ecx, dword [esi + 0x18]
mov esi, dword [esi + 4]
and ecx, eax
mov ebx, dword [edx + ecx*8]
mov eax, ebx
lea edx, [edx + ecx*8]
cmp ebx, esi
jne 0x1003e49e
mov ecx, esi
jmp 0x1003e4a3
mov ecx, dword [edx + 4]
mov ecx, dword [ecx]
cmp eax, ecx
je 0x1003e4b6
mov ecx, dword [eax + 8]
cmp ecx, dword [edi]
je 0x1003e4b2
mov eax, dword [eax]
jmp 0x1003e496
cmp eax, esi
jne 0x1003e50b
mov esi, dword [esi]
lea eax, [ebp - 8]
push ecx
push eax
push ecx
mov dword [ebp - 8], edi
mov edi, dword [esi + 4]
push edi
push esi
call fcn.1003ed60
mov edx, dword [ebp - 0xc]
mov ebx, eax
mov ecx, 0x5d1745c
mov eax, dword [edx + 8]
sub ecx, eax
cmp ecx, 1
jae 0x1003e4ea
push str.list_T__too_long
call dword [sym.imp.MSVCP140.dll_void___cdecl_std::_Xlength_error_char_const__]
inc eax
mov ecx, edx
mov dword [edx + 8], eax
mov dword [esi + 4], ebx
mov dword [edi], ebx
mov eax, dword [edx + 4]
mov eax, dword [eax]
push eax
add eax, 8
push eax
lea eax, [ebp - 0x10]
push eax
call fcn.1003e920
mov eax, dword [ebp - 0x10]
pop edi
pop esi
add eax, 0xc
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x1003e520
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
mov esi, ecx
push edi
mov edi, dword [ebp + 8]
mov dword [ebp - 0xc], esi
mov edx, dword [esi + 0xc]
movzx eax, byte [edi]
xor eax, 0x811c9dc5
imul ecx, eax, 0x1000193
movzx eax, byte [edi + 1]
xor ecx, eax
movzx eax, byte [edi + 2]
imul ecx, ecx, 0x1000193
xor ecx, eax
movzx eax, byte [edi + 3]
imul ecx, ecx, 0x1000193
xor ecx, eax
imul eax, ecx, 0x1000193
mov ecx, dword [esi + 0x18]
mov esi, dword [esi + 4]
and ecx, eax
mov ebx, dword [edx + ecx*8]
mov eax, ebx
lea edx, [edx + ecx*8]
cmp ebx, esi
jne 0x1003e57e
mov ecx, esi
jmp 0x1003e583
mov ecx, dword [edx + 4]
mov ecx, dword [ecx]
cmp eax, ecx
je 0x1003e596
mov ecx, dword [eax + 8]
cmp ecx, dword [edi]
je 0x1003e592
mov eax, dword [eax]
jmp 0x1003e576
cmp eax, esi
jne 0x1003e5eb
mov esi, dword [esi]
lea eax, [ebp - 8]
push ecx
push eax
push ecx
mov dword [ebp - 8], edi
mov edi, dword [esi + 4]
push edi
push esi
call fcn.1003eee0
mov edx, dword [ebp - 0xc]
mov ebx, eax
mov ecx, 0xaaaaaa9
mov eax, dword [edx + 8]
sub ecx, eax
cmp ecx, 1
jae 0x1003e5ca
push str.list_T__too_long
call dword [sym.imp.MSVCP140.dll_void___cdecl_std::_Xlength_error_char_const__]
inc eax
mov ecx, edx
mov dword [edx + 8], eax
mov dword [esi + 4], ebx
mov dword [edi], ebx
mov eax, dword [edx + 4]
mov eax, dword [eax]
push eax
add eax, 8
push eax
lea eax, [ebp - 0x10]
push eax
call fcn.1003eb40
mov eax, dword [ebp - 0x10]
pop edi
pop esi
add eax, 0xc
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x1003e6f0
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
mov esi, ecx
mov ebx, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0xc]
mov dword [ebp - 8], esi
mov edx, dword [esi + 0xc]
movzx eax, byte [edi]
xor eax, 0x811c9dc5
imul ecx, eax, 0x1000193
movzx eax, byte [edi + 1]
xor ecx, eax
movzx eax, byte [edi + 2]
imul ecx, ecx, 0x1000193
xor ecx, eax
movzx eax, byte [edi + 3]
imul ecx, ecx, 0x1000193
xor ecx, eax
imul eax, ecx, 0x1000193
mov ecx, dword [esi + 0x18]
mov esi, dword [esi + 4]
and ecx, eax
mov eax, dword [edx + ecx*8]
lea ecx, [ecx*8 + 4]
add ecx, edx
mov edx, eax
mov dword [ebp - 4], ecx
cmp edx, esi
jne 0x1003e75a
mov ecx, esi
jmp 0x1003e75e
mov ecx, dword [ecx]
mov ecx, dword [ecx]
cmp eax, ecx
je 0x1003e785
mov ecx, dword [eax + 8]
cmp ecx, dword [edi]
je 0x1003e770
mov eax, dword [eax]
mov ecx, dword [ebp - 4]
jmp 0x1003e752
cmp eax, esi
je 0x1003e785
pop edi
mov dword [ebx], eax
mov eax, ebx
pop esi
mov byte [ebx + 4], 0
pop ebx
mov esp, ebp
pop ebp
ret 8
mov esi, dword [esi]
lea eax, [ebp - 4]
push ecx
push eax
push ecx
mov dword [ebp - 4], edi
mov edi, dword [esi + 4]
push edi
push esi
call fcn.1003ed60
mov edx, eax
mov ecx, 0x5d1745c
mov eax, dword [ebp - 8]
mov eax, dword [eax + 8]
sub ecx, eax
cmp ecx, 1
jae 0x1003e7b9
push str.list_T__too_long
call dword [sym.imp.MSVCP140.dll_void___cdecl_std::_Xlength_error_char_const__]
mov ecx, dword [ebp - 8]
inc eax
mov dword [ecx + 8], eax
mov dword [esi + 4], edx
mov dword [edi], edx
mov eax, dword [ecx + 4]
mov eax, dword [eax]
push eax
add eax, 8
push eax
push ebx
call fcn.1003e920
pop edi
pop esi
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x1003e7e0
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
mov esi, ecx
mov ebx, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0xc]
mov dword [ebp - 8], esi
mov edx, dword [esi + 0xc]
movzx eax, byte [edi]
xor eax, 0x811c9dc5
imul ecx, eax, 0x1000193
movzx eax, byte [edi + 1]
xor ecx, eax
movzx eax, byte [edi + 2]
imul ecx, ecx, 0x1000193
xor ecx, eax
movzx eax, byte [edi + 3]
imul ecx, ecx, 0x1000193
xor ecx, eax
imul eax, ecx, 0x1000193
mov ecx, dword [esi + 0x18]
mov esi, dword [esi + 4]
and ecx, eax
mov eax, dword [edx + ecx*8]
lea ecx, [ecx*8 + 4]
add ecx, edx
mov edx, eax
mov dword [ebp - 4], ecx
cmp edx, esi
jne 0x1003e84a
mov ecx, esi
jmp 0x1003e84e
mov ecx, dword [ecx]
mov ecx, dword [ecx]
cmp eax, ecx
je 0x1003e875
mov ecx, dword [eax + 8]
cmp ecx, dword [edi]
je 0x1003e860
mov eax, dword [eax]
mov ecx, dword [ebp - 4]
jmp 0x1003e842
cmp eax, esi
je 0x1003e875
pop edi
mov dword [ebx], eax
mov eax, ebx
pop esi
mov byte [ebx + 4], 0
pop ebx
mov esp, ebp
pop ebp
ret 8
mov esi, dword [esi]
lea eax, [ebp - 4]
push ecx
push eax
push ecx
mov dword [ebp - 4], edi
mov edi, dword [esi + 4]
push edi
push esi
call fcn.1003eee0
mov edx, eax
mov ecx, 0xaaaaaa9
mov eax, dword [ebp - 8]
mov eax, dword [eax + 8]
sub ecx, eax
cmp ecx, 1
jae 0x1003e8a9
push str.list_T__too_long
call dword [sym.imp.MSVCP140.dll_void___cdecl_std::_Xlength_error_char_const__]
mov ecx, dword [ebp - 8]
inc eax
mov dword [ecx + 8], eax
mov dword [esi + 4], edx
mov dword [edi], edx
mov eax, dword [ecx + 4]
mov eax, dword [eax]
push eax
add eax, 8
push eax
push ebx
call fcn.1003eb40
pop edi
pop esi
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x1003ee30
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
mov edx, ecx
mov ebx, dword [ebp + 8]
movzx eax, byte [edi + 8]
xor eax, 0x811c9dc5
imul ecx, eax, 0x1000193
movzx eax, byte [edi + 9]
xor ecx, eax
movzx eax, byte [edi + 0xa]
imul ecx, ecx, 0x1000193
xor ecx, eax
movzx eax, byte [edi + 0xb]
imul ecx, ecx, 0x1000193
xor ecx, eax
imul eax, ecx, 0x1000193
mov ecx, dword [edx + 0x18]
and ecx, eax
lea esi, [ecx*8]
mov ecx, dword [edx + 0xc]
add ecx, esi
mov eax, dword [ecx]
cmp dword [ecx + 4], edi
jne 0x1003eea6
cmp eax, edi
jne 0x1003ee9e
mov eax, dword [edx + 4]
mov dword [ecx], eax
mov ecx, dword [edx + 0xc]
mov eax, dword [edx + 4]
mov dword [esi + ecx + 4], eax
jmp 0x1003eeae
mov eax, dword [edi + 4]
mov dword [ecx + 4], eax
jmp 0x1003eeae
cmp eax, edi
jne 0x1003eeae
mov eax, dword [edi]
mov dword [ecx], eax
mov eax, dword [edi + 4]
mov esi, dword [edi]
mov dword [eax], esi
mov ecx, dword [edi]
mov eax, dword [edi + 4]
mov dword [ecx + 4], eax
lea ecx, [edi + 0xc]
dec dword [edx + 8]
call fcn.1003e600
push 0x2c
push edi
call fcn.1009b7cf
add esp, 8
mov dword [ebx], esi
mov eax, ebx
pop edi
pop esi
pop ebx
pop ebp
ret 8

Function at 0x1003ef10
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
push ebx
push esi
push edi
movzx edx, byte [eax + 8]
mov edi, ecx
movzx ecx, byte [eax + 9]
xor edx, 0x811c9dc5
imul edx, edx, 0x1000193
mov ebx, dword [ebp + 8]
xor edx, ecx
movzx ecx, byte [eax + 0xa]
imul edx, edx, 0x1000193
xor edx, ecx
movzx ecx, byte [eax + 0xb]
imul edx, edx, 0x1000193
xor edx, ecx
imul ecx, edx, 0x1000193
mov edx, dword [edi + 0x18]
and edx, ecx
lea esi, [edx*8]
mov edx, dword [edi + 0xc]
add edx, esi
mov ecx, dword [edx]
cmp dword [edx + 4], eax
jne 0x1003ef87
cmp ecx, eax
jne 0x1003ef7f
mov ecx, dword [edi + 4]
mov dword [edx], ecx
mov edx, dword [edi + 0xc]
mov ecx, dword [edi + 4]
mov dword [esi + edx + 4], ecx
jmp 0x1003ef8f
mov ecx, dword [eax + 4]
mov dword [edx + 4], ecx
jmp 0x1003ef8f
cmp ecx, eax
jne 0x1003ef8f
mov ecx, dword [eax]
mov dword [edx], ecx
mov ecx, dword [eax + 4]
mov esi, dword [eax]
push 0x18
push eax
mov dword [ecx], esi
mov edx, dword [eax]
mov ecx, dword [eax + 4]
mov dword [edx + 4], ecx
dec dword [edi + 8]
call fcn.1009b7cf
add esp, 8
mov dword [ebx], esi
mov eax, ebx
pop edi
pop esi
pop ebx
pop ebp
ret 8