joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10067de0
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x12c
mov eax, dword [0x1009f004]
xor eax, esp
mov dword [esp + 0x128], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [ebp + 0xc]
push esi
push edi
push eax
mov dword [esp + 0x18], edx
mov edi, ecx
mov dword [esp + 0x14], ebx
call dword [sym.imp.api_ms_win_crt_environment_l1_1_0.dll_getenv]
add esp, 4
test eax, eax
jne 0x10067e6d
test ebx, ebx
jne 0x10067e2e
mov eax, dword [edi + 8]
mov dword [eax + 8], ebx
add dword [edi + 8], 0x10
jmp 0x10067ec1
lea ecx, [ebx + 1]
mov al, byte [ebx]
inc ebx
test al, al
jne 0x10067e31
sub ebx, ecx
mov ecx, dword [edi + 0x10]
mov eax, dword [ecx + 0x44]
cmp eax, dword [ecx + 0x40]
jb 0x10067e4c
mov ecx, edi
call fcn.100621c0
mov edx, dword [esp + 0x10]
mov ecx, edi
mov esi, dword [edi + 8]
push ebx
call fcn.1006e260
add esp, 4
mov dword [esi], eax
mov dword [esi + 8], 4
add dword [edi + 8], 0x10
jmp 0x10067ec1
push 0x10097f80
push 0x10097f84
mov edx, eax
mov ecx, edi
call fcn.10057930
push ebx
push 0x10097f88
mov edx, eax
mov ecx, edi
call fcn.10057930
mov eax, dword [edi + 8]
add esp, 0x10
lea edx, [eax - 0x10]
cmp edx, eax
jae 0x10067ebb
nop dword [eax]
mov eax, dword [edx]
mov ecx, dword [edx + 4]
mov dword [edx - 0x10], eax
mov dword [edx - 0xc], ecx
mov eax, dword [edx + 8]
mov dword [edx - 8], eax
add edx, 0x10
mov eax, dword [edi + 8]
cmp edx, eax
jb 0x10067ea0
add eax, 0xfffffff0
mov dword [edi + 8], eax
push 0x105
lea eax, [esp + 0x2c]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
je 0x10067f47
cmp eax, 0x105
je 0x10067f47
lea eax, [esp + 0x28]
push 0x5c
push eax
call dword [sym.imp.VCRUNTIME140.dll_strrchr]
add esp, 8
test eax, eax
je 0x10067f47
mov byte [eax], 0
or edx, 0xffffffff
lea eax, [esp + 0x28]
mov ecx, edi
push eax
push 0x10097dc0
push 0
call fcn.10056370
add esp, 4
mov edx, eax
mov ecx, edi
call fcn.10057930
mov ecx, dword [edi + 8]
add esp, 8
lea eax, [ecx - 0x10]
cmp eax, ecx
jae 0x10067f3f
mov ecx, dword [eax]
mov edx, dword [eax + 4]
mov dword [eax - 0x10], ecx
mov dword [eax - 0xc], edx
mov ecx, dword [eax + 8]
mov dword [eax - 8], ecx
add eax, 0x10
mov ecx, dword [edi + 8]
cmp eax, ecx
jb 0x10067f24
add ecx, 0xfffffff0
mov dword [edi + 8], ecx
jmp 0x10067f58
push str.unable_to_get_ModuleFileName
push edi
call fcn.10056e60
mov ecx, dword [edi + 8]
add esp, 8
mov ebx, dword [esp + 0x14]
lea esi, [ecx - 0x20]
mov ecx, ebx
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x10067f64
sub ecx, edx
mov edx, ebx
push ecx
mov ecx, edi
call fcn.1006e260
mov dword [esp + 0x1c], eax
add esp, 4
mov eax, dword [edi + 8]
mov edx, esi
sub eax, 0x10
mov dword [esp + 0x20], 4
mov ecx, edi
push eax
lea eax, [esp + 0x1c]
push eax
call fcn.100740c0
add dword [edi + 8], 0xfffffff0
add esp, 8
mov ecx, dword [esp + 0x134]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.100928e8
mov esp, ebp
pop ebp
ret
Function at 0x1006e260
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0xc
push ebx
push esi
push edi
mov dword [esp + 0x10], edx
mov edx, dword [ebp + 8]
mov ebx, edx
mov edi, edx
mov dword [esp + 0xc], ecx
shr edi, 5
mov esi, edx
inc edi
cmp edx, edi
jb 0x1006e2ae
mov edx, dword [esp + 0x10]
nop dword [eax]
movzx ecx, byte [edx + esi - 1]
mov eax, ebx
shl eax, 5
sub esi, edi
add ecx, eax
mov eax, ebx
shr eax, 2
add ecx, eax
xor ebx, ecx
cmp esi, edi
jae 0x1006e290
mov edx, dword [ebp + 8]
mov esi, dword [esp + 0xc]
mov eax, dword [esi + 0x10]
mov dword [esp + 0x14], eax
mov ecx, dword [eax + 8]
mov eax, dword [eax]
dec ecx
and ecx, ebx
mov edi, dword [eax + ecx*4]
test edi, edi
je 0x1006e344
cmp dword [edi + 0xc], edx
jne 0x1006e33a
mov esi, dword [ebp + 8]
lea eax, [edi + 0x10]
mov edx, dword [esp + 0x10]
sub esi, 4
jb 0x1006e2f1
nop dword [eax]
mov ecx, dword [edx]
cmp ecx, dword [eax]
jne 0x1006e2fa
add edx, 4
add eax, 4
sub esi, 4
jae 0x1006e2e0
cmp esi, 0xfffffffc
je 0x1006e3ea
mov cl, byte [edx]
cmp cl, byte [eax]
jne 0x1006e337
cmp esi, 0xfffffffd
je 0x1006e3ea
mov cl, byte [edx + 1]
cmp cl, byte [eax + 1]
jne 0x1006e337
cmp esi, 0xfffffffe
je 0x1006e3ea
mov cl, byte [edx + 2]
cmp cl, byte [eax + 2]
jne 0x1006e337
cmp esi, 0xffffffff
je 0x1006e3ea
mov cl, byte [edx + 3]
cmp cl, byte [eax + 3]
je 0x1006e3ea
mov edx, dword [ebp + 8]
mov edi, dword [edi]
test edi, edi
jne 0x1006e2c8
mov esi, dword [esp + 0xc]
lea eax, [edx + 1]
cmp eax, 0xffffffed
jbe 0x1006e35d
push str.memory_allocation_error:_block_too_big
push esi
call fcn.1005f9e0
mov edx, dword [ebp + 8]
add esp, 8
lea eax, [edx + 0x11]
mov ecx, esi
push eax
push 0
xor edx, edx
call fcn.10066630
mov ecx, dword [esp + 0x14]
mov edi, eax
mov esi, dword [ebp + 8]
push esi
push dword [esp + 0x1c]
mov dword [edi + 0xc], esi
lea eax, [edi + 0x10]
mov dword [edi + 8], ebx
mov ecx, dword [ecx + 0x10]
push eax
mov cl, byte [ecx + 0x14]
and cl, 3
mov byte [edi + 4], 4
mov byte [edi + 5], cl
mov byte [edi + 6], 0
call sub.VCRUNTIME140.dll_memcpy
mov byte [edi + esi + 0x10], 0
add esp, 0x14
mov esi, dword [esp + 0xc]
mov edx, dword [esi + 0x10]
mov eax, dword [edx + 8]
dec eax
and eax, ebx
lea ecx, [eax*4]
mov eax, dword [edx]
mov eax, dword [ecx + eax]
mov dword [edi], eax
mov eax, dword [edx]
mov dword [ecx + eax], edi
inc dword [edx + 4]
mov eax, dword [edx + 8]
cmp dword [edx + 4], eax
jbe 0x1006e3e1
cmp eax, 0x3ffffffe
jg 0x1006e3e1
lea edx, [eax + eax]
mov ecx, esi
call fcn.1006e180
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov ecx, dword [esp + 0x14]
mov al, byte [edi + 5]
movzx edx, byte [ecx + 0x14]
not edx
movzx ecx, al
and edx, ecx
test dl, 3
je 0x1006e3e1
xor al, 3
mov byte [edi + 5], al
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1007a0a0
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [0x1009f004]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
mov edi, dword [ebp + 8]
lea eax, [ebp - 8]
push eax
push 0x40
mov esi, ecx
mov dword [ebp - 0xc], edx
push edi
push esi
mov dword [ebp - 8], 0
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
je 0x1007a0ef
push edi
push dword [ebp - 0xc]
push esi
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
lea eax, [ebp - 8]
push eax
push dword [ebp - 8]
push edi
push esi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.100928e8
mov esp, ebp
pop ebp
ret

Function at 0x1007a6b0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x1c
push ebx
mov ebx, ecx
push esi
push edi
cmp dword [ebx + 0x38], 0
je 0x1007a6dc
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____thiscall_std::basic_streambuf_char__struct_std::char_traits_char__::xsputn_char_const___long_long___int64__]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov eax, dword [ebx + 0x20]
mov esi, dword [ebp + 0xc]
mov edi, dword [ebp + 0x10]
mov dword [esp + 0x20], esi
mov ecx, dword [eax]
lea eax, [ebx + 0x30]
mov dword [esp + 0x24], edi
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x18], eax
test ecx, ecx
je 0x1007a704
mov eax, dword [eax]
mov ecx, dword [eax]
jmp 0x1007a70a
xor ecx, ecx
mov dword [esp + 0x18], eax
mov eax, ecx
cdq
mov dword [esp + 0x10], eax
mov ecx, edx
mov dword [esp + 0x14], ecx
test edi, edi
jl 0x1007a772
jg 0x1007a721
test esi, esi
je 0x1007a772
test ecx, ecx
jl 0x1007a76d
jg 0x1007a72b
test eax, eax
je 0x1007a76d
cmp edi, ecx
jg 0x1007a73f
jl 0x1007a735
cmp esi, eax
jae 0x1007a73f
mov eax, esi
mov dword [esp + 0x10], esi
mov dword [esp + 0x14], edi
push eax
push dword [ebp + 8]
push dword [esp + 0x24]
call sub.VCRUNTIME140.dll_memcpy
mov eax, dword [esp + 0x24]
add esp, 0xc
mov edx, dword [esp + 0x10]
mov ecx, dword [ebp + 8]
add ecx, edx
sub esi, edx
mov eax, dword [eax]
sbb edi, dword [esp + 0x14]
sub dword [eax], edx
mov eax, dword [ebx + 0x20]
add dword [eax], edx
jmp 0x1007a775
mov ecx, dword [ebp + 8]
jmp 0x1007a77f
mov ecx, dword [ebp + 8]
test edi, edi
jl 0x1007a799
jg 0x1007a77f
test esi, esi
je 0x1007a799
mov eax, dword [ebx + 0x4c]
test eax, eax
je 0x1007a799
push eax
push esi
push 1
push ecx
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
add esp, 0x10
sub esi, eax
sbb edi, 0
mov eax, dword [esp + 0x20]
mov edx, dword [esp + 0x24]
sub eax, esi
sbb edx, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x1007a7b0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [ebp + 0x10]
push ebx
mov ebx, ecx
mov ecx, dword [ebp + 0xc]
push esi
mov esi, dword [ebp + 8]
mov dword [ebp - 4], esi
test eax, eax
jg 0x1007a7dc
jl 0x1007a7d0
test ecx, ecx
jne 0x1007a7dc
pop esi
xor eax, eax
xor edx, edx
pop ebx
mov esp, ebp
pop ebp
ret 0xc
cmp dword [ebx + 0x38], 0
je 0x1007a7f5
push eax
push ecx
push esi
mov ecx, ebx
call dword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____thiscall_std::basic_streambuf_char__struct_std::char_traits_char__::xsgetn_char___long_long___int64__]
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov eax, dword [ebx + 0x1c]
push edi
mov edi, ecx
mov eax, dword [eax]
mov dword [ebp - 8], eax
test eax, eax
je 0x1007a843
mov eax, dword [ebx + 0x2c]
lea edx, [ebx + 0x2c]
mov dword [ebp - 0xc], edx
mov eax, dword [eax]
test eax, eax
je 0x1007a849
mov edi, dword [ebp - 4]
cmp eax, ecx
mov esi, ecx
cmovb esi, eax
push esi
push dword [ebp - 8]
push edi
call sub.VCRUNTIME140.dll_memcpy
mov eax, dword [ebx + 0x2c]
add edi, esi
mov dword [ebp - 4], edi
add esp, 0xc
mov edi, dword [ebp + 0xc]
sub edi, esi
sub dword [eax], esi
mov eax, dword [ebx + 0x1c]
add dword [eax], esi
mov esi, dword [ebp - 4]
jmp 0x1007a849
lea eax, [ebx + 0x2c]
mov dword [ebp - 0xc], eax
cmp dword [ebx + 0x4c], 0
je 0x1007a8b6
mov ecx, dword [ebx + 0xc]
lea eax, [ebx + 0x3c]
cmp dword [ecx], eax
jne 0x1007a872
mov eax, dword [ebx + 0xc]
mov edx, dword [ebx + 0x54]
mov ecx, dword [ebx + 0x50]
sub edx, ecx
mov dword [eax], ecx
mov eax, dword [ebx + 0x1c]
mov dword [eax], ecx
mov eax, dword [ebp - 0xc]
mov eax, dword [eax]
mov dword [eax], edx
mov eax, dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
cmp edi, 0xfff
jbe 0x1007a8a4
nop
push dword [ebx + 0x4c]
push 0xfff
push 1
push esi
call eax
add esp, 0x10
add esi, eax
sub edi, eax
cmp eax, 0xfff
jne 0x1007a8b6
cmp edi, eax
mov eax, dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
ja 0x1007a880
test edi, edi
je 0x1007a8b6
push dword [ebx + 0x4c]
push edi
push 1
push esi
call eax
add esp, 0x10
sub edi, eax
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 0x10]
sub eax, edi
pop edi
pop esi
sbb edx, 0
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x1007ac30
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
mov eax, dword [0x1009f004]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, ecx
cmp ebx, 0xffffffff
jne 0x1007ac60
pop esi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100928e8
mov esp, ebp
pop ebp
ret 4
mov eax, dword [esi + 0x20]
mov eax, dword [eax]
test eax, eax
je 0x1007ac90
mov edx, dword [esi + 0x30]
mov edx, dword [edx]
add edx, eax
cmp eax, edx
jae 0x1007ac90
call dword [sym.imp.MSVCP140.dll_protected:_char____thiscall_std::basic_streambuf_char__struct_std::char_traits_char__::_Pninc_void_]
pop esi
mov byte [eax], bl
mov eax, ebx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100928e8
mov esp, ebp
pop ebp
ret 4
cmp dword [esi + 0x4c], 0
push edi
je 0x1007ad68
mov edi, dword [esi + 0xc]
lea eax, [esi + 0x3c]
cmp dword [edi], eax
jne 0x1007acb9
mov edx, dword [esi + 0x54]
mov ecx, dword [esi + 0x50]
sub edx, ecx
mov dword [edi], ecx
mov eax, dword [esi + 0x1c]
mov dword [eax], ecx
mov eax, dword [esi + 0x2c]
mov dword [eax], edx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x1007acc5
movsx eax, bl
jmp 0x1007acfd
lea eax, [ebp - 0x2c]
mov byte [ebp - 0x25], bl
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x25]
push eax
lea eax, [esi + 0x40]
push eax
call dword [sym.imp.MSVCP140.dll_public:_int___thiscall_std::codecvt_char__char__struct__Mbstatet_::out_struct__Mbstatet___char_const___char_const___char_const____char___char___char___const]
sub eax, 0
je 0x1007ad27
sub eax, 1
je 0x1007ad27
sub eax, 2
jne 0x1007ad68
movsx eax, byte [ebp - 0x25]
push dword [esi + 0x4c]
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
add esp, 8
or ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, ebx
pop edi
pop esi
mov eax, ecx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100928e8
mov esp, ebp
pop ebp
ret 4
mov edi, dword [ebp - 0x2c]
lea eax, [ebp - 0x24]
sub edi, eax
je 0x1007ad45
push dword [esi + 0x4c]
push edi
push 1
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
add esp, 0x10
cmp edi, eax
jne 0x1007ad68
lea ecx, [ebp - 0x25]
mov byte [esi + 0x3d], 1
or eax, 0xffffffff
cmp dword [ebp - 0x30], ecx
pop edi
pop esi
cmovne eax, ebx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100928e8
mov esp, ebp
pop ebp
ret 4
mov ecx, dword [ebp - 4]
or eax, 0xffffffff
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.100928e8
mov esp, ebp
pop ebp
ret 4
Function at 0x1007b100
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 8]
sub esp, 8
movzx eax, byte [edx]
push ebx
push esi
xor eax, 0x811c9dc5
push edi
mov edi, ecx
imul ecx, eax, 0x1000193
movzx eax, byte [edx + 1]
xor ecx, eax
movzx eax, byte [edx + 2]
imul ecx, ecx, 0x1000193
xor ecx, eax
movzx eax, byte [edx + 3]
imul ecx, ecx, 0x1000193
xor ecx, eax
lea eax, [ebp - 8]
imul ebx, ecx, 0x1000193
mov ecx, edi
push ebx
push edx
push eax
call fcn.1007d130
mov esi, dword [eax + 4]
test esi, esi
je 0x1007b1b5
mov ecx, dword [edi + 0x18]
mov eax, dword [edi + 0xc]
and ecx, ebx
lea ecx, [eax + ecx*8]
mov eax, dword [ecx]
cmp dword [ecx + 4], esi
jne 0x1007b17c
cmp eax, esi
jne 0x1007b174
mov eax, dword [edi + 4]
mov dword [ecx], eax
mov dword [ecx + 4], eax
jmp 0x1007b184
mov eax, dword [esi + 4]
mov dword [ecx + 4], eax
jmp 0x1007b184
cmp eax, esi
jne 0x1007b184
mov eax, dword [esi]
mov dword [ecx], eax
mov ecx, dword [esi]
dec dword [edi + 8]
mov eax, dword [esi + 4]
mov dword [eax], ecx
mov eax, dword [esi + 4]
mov dword [ecx + 4], eax
lea ecx, [esi + 0xc]
call fcn.100560c0
push 0x2c
push esi
call fcn.10092926
add esp, 8
mov eax, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x1007bd20
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x1009f004]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, ecx
cmp dword [esi + 0x38], 0
je 0x1007bddc
cmp byte [esi + 0x3d], 0
je 0x1007bddc
mov eax, dword [esi]
push edi
push 0xffffffffffffffff
call dword [eax + 0xc]
cmp eax, 0xffffffff
je 0x1007bdca
mov ecx, dword [esi + 0x38]
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [esi + 0x40]
push eax
call dword [sym.imp.MSVCP140.dll_public:_int___thiscall_std::codecvt_char__char__struct__Mbstatet_::unshift_struct__Mbstatet___char___char___char___const]
sub eax, 0
je 0x1007bd91
sub eax, 1
je 0x1007bd95
sub eax, 2
jne 0x1007bdca
mov byte [esi + 0x3d], al
mov al, 1
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100928e8
mov esp, ebp
pop ebp
ret
mov byte [esi + 0x3d], 0
mov edi, dword [ebp - 0x28]
lea eax, [ebp - 0x24]
sub edi, eax
je 0x1007bdb3
push dword [esi + 0x4c]
push edi
push 1
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
add esp, 0x10
cmp edi, eax
jne 0x1007bdca
cmp byte [esi + 0x3d], 0
pop edi
sete al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100928e8
mov esp, ebp
pop ebp
ret
pop edi
xor al, al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100928e8
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
mov al, 1
xor ecx, ebp
pop esi
call fcn.100928e8
mov esp, ebp
pop ebp
ret
Function at 0x1007bfb0
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
sub esp, 0x18
mov edx, dword [ebp + 8]
push ebx
mov ebx, ecx
cmp edx, eax
je 0x1007c104
mov eax, dword [ebx + 4]
mov dword [ebp - 0x14], eax
mov eax, dword [edx + 4]
mov dword [ebp - 8], eax
movzx eax, byte [edx + 8]
xor eax, 0x811c9dc5
imul ecx, eax, 0x1000193
movzx eax, byte [edx + 9]
push esi
push edi
mov edi, dword [ebx + 0xc]
mov esi, edx
xor ecx, eax
mov dword [ebp - 0x18], edi
movzx eax, byte [edx + 0xa]
imul ecx, ecx, 0x1000193
xor ecx, eax
movzx eax, byte [edx + 0xb]
imul ecx, ecx, 0x1000193
xor ecx, eax
mov eax, dword [ebx + 0x18]
imul ecx, ecx, 0x1000193
and eax, ecx
mov ecx, dword [edi + eax*8]
mov dword [ebp - 4], ecx
lea eax, [edi + eax*8]
mov dword [ebp - 0xc], eax
mov eax, dword [eax + 4]
mov dword [ebp - 0x10], eax
mov eax, esi
mov edi, esi
mov esi, dword [esi]
push 0x18
push eax
call fcn.10092926
dec dword [ebx + 8]
add esp, 8
cmp edi, dword [ebp - 0x10]
je 0x1007c069
mov eax, dword [ebp + 0xc]
cmp esi, eax
jne 0x1007c027
mov ecx, dword [ebp - 4]
cmp ecx, dword [ebp + 8]
jne 0x1007c0fa
mov edx, dword [ebp - 0xc]
mov ecx, dword [ebp - 8]
pop edi
mov dword [edx], esi
mov dword [ecx], esi
mov dword [esi + 4], ecx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
mov ecx, dword [ebp - 4]
mov edx, dword [ebp - 0xc]
cmp ecx, dword [ebp + 8]
jne 0x1007c07d
mov eax, dword [ebp - 0x14]
mov ecx, eax
mov dword [edx], eax
jmp 0x1007c080
mov ecx, dword [ebp - 8]
mov eax, dword [ebp + 0xc]
mov dword [edx + 4], ecx
cmp esi, eax
je 0x1007c0fa
nop word [eax + eax]
movzx eax, byte [esi + 8]
xor eax, 0x811c9dc5
imul ecx, eax, 0x1000193
movzx eax, byte [esi + 9]
xor ecx, eax
movzx eax, byte [esi + 0xa]
imul ecx, ecx, 0x1000193
xor ecx, eax
movzx eax, byte [esi + 0xb]
imul ecx, ecx, 0x1000193
xor ecx, eax
imul eax, ecx, 0x1000193
mov ecx, dword [ebp - 0x18]
and eax, dword [ebx + 0x18]
lea eax, [ecx + eax*8]
mov dword [ebp - 4], eax
mov eax, dword [eax + 4]
mov dword [ebp - 0x10], eax
mov eax, esi
mov edi, esi
mov esi, dword [esi]
push 0x18
push eax
call fcn.10092926
dec dword [ebx + 8]
add esp, 8
mov eax, dword [ebp + 0xc]
cmp edi, dword [ebp - 0x10]
je 0x1007c10b
cmp esi, eax
jne 0x1007c0d5
mov ecx, dword [ebp - 4]
mov dword [ecx], esi
mov ecx, dword [ebp - 8]
pop edi
mov dword [ecx], esi
mov dword [esi + 4], ecx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
mov ecx, dword [ebp - 4]
mov edx, dword [ebp - 0x14]
mov dword [ecx], edx
mov dword [ecx + 4], edx
cmp esi, eax
jne 0x1007c090
mov ecx, dword [ebp - 8]
pop edi
mov dword [ecx], esi
mov dword [esi + 4], ecx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x1007cfc0
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
mov ebx, ecx
mov eax, 0x1fffffff
bsr ecx, eax
push esi
push edi
mov edi, 1
mov dword [ebp - 0x10], ebx
mov eax, edi
shl eax, cl
mov ecx, dword [ebp + 8]
cmp ecx, eax
jbe 0x1007cff1
push str.invalid_hash_bucket_count
call dword [sym.imp.MSVCP140.dll_void___cdecl_std::_Xlength_error_char_const__]
lea eax, [ecx - 1]
mov esi, dword [ebx + 4]
or eax, 1
mov dword [ebp - 8], esi
bsr ecx, eax
push esi
lea ecx, [ecx + 1]
shl edi, cl
lea ecx, [ebx + 0xc]
lea eax, [edi + edi]
push eax
call fcn.1007c130
lea eax, [edi - 1]
mov dword [ebx + 0x1c], edi
mov dword [ebx + 0x18], eax
mov eax, dword [ebx + 4]
mov eax, dword [eax]
mov ecx, eax
cmp eax, esi
je 0x1007d0fc
nop word [eax + eax]
movzx edx, byte [eax + 8]
xor edx, 0x811c9dc5
mov ecx, dword [ecx]
imul edi, edx, 0x1000193
movzx edx, byte [eax + 9]
xor edi, edx
movzx edx, byte [eax + 0xa]
imul edi, edi, 0x1000193
xor edi, edx
movzx edx, byte [eax + 0xb]
imul edi, edi, 0x1000193
xor edi, edx
mov edx, dword [ebx + 0xc]
imul edi, edi, 0x1000193
and edi, dword [ebx + 0x18]
mov ebx, dword [edx + edi*8]
lea edx, [edx + edi*8]
mov dword [ebp - 0xc], edx
cmp ebx, esi
jne 0x1007d080
mov dword [edx], eax
mov dword [edx + 4], eax
jmp 0x1007d0ef
mov edx, dword [edx + 4]
mov edi, dword [eax + 8]
cmp edi, dword [edx + 8]
jne 0x1007d0ba
mov edx, dword [edx]
mov dword [ebp - 4], edx
cmp edx, eax
je 0x1007d0b2
mov ebx, dword [eax + 4]
mov esi, dword [ebp - 4]
mov dword [ebx], ecx
mov edi, dword [ecx + 4]
mov dword [edi], edx
mov edx, dword [edx + 4]
mov dword [edx], eax
mov dword [esi + 4], edi
mov esi, dword [ebp - 8]
mov dword [ecx + 4], ebx
mov dword [eax + 4], edx
mov edx, dword [ebp - 0xc]
mov dword [edx + 4], eax
jmp 0x1007d0ef
cmp ebx, edx
je 0x1007d0cc
nop
mov edx, dword [edx + 4]
cmp edi, dword [edx + 8]
je 0x1007d105
cmp ebx, edx
jne 0x1007d0c0
mov ebx, dword [eax + 4]
mov dword [ebp - 4], ebx
mov dword [ebx], ecx
mov ebx, dword [ecx + 4]
mov dword [ebx], edx
mov edi, dword [edx + 4]
mov dword [edi], eax
mov dword [edx + 4], ebx
mov edx, dword [ebp - 4]
mov dword [ecx + 4], edx
mov edx, dword [ebp - 0xc]
mov dword [eax + 4], edi
mov dword [edx], eax
mov ebx, dword [ebp - 0x10]
mov eax, ecx
cmp ecx, esi
jne 0x1007d030
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
mov ebx, dword [eax + 4]
mov edx, dword [edx]
mov dword [ebp - 4], edx
mov esi, edx
mov dword [ebx], ecx
mov edi, dword [ecx + 4]
mov dword [edi], edx
mov edx, dword [edx + 4]
mov dword [edx], eax
mov dword [esi + 4], edi
mov esi, dword [ebp - 8]
mov dword [ecx + 4], ebx
mov dword [eax + 4], edx
jmp 0x1007d0ef
Function at 0x1007e2d0
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x24
mov eax, dword [0x1009f004]
xor eax, esp
mov dword [esp + 0x20], eax
push ebx
push esi
push edi
lea eax, [esp + 0x24]
mov dword [esp + 0x24], 0
push eax
mov esi, 0x47b3c0
mov byte [esp + 0x23], 0
mov ebx, ecx
call esi
lea eax, [esp + 0x1f]
mov ecx, ebx
push eax
lea eax, [esi - 0x80]
call eax
mov eax, dword [esp + 0x24]
cmp eax, 0x1000
ja 0x1007e48c
xor edi, edi
test eax, eax
jle 0x1007e469
nop word [eax + eax]
lea eax, [esp + 0x18]
mov dword [esp + 0x18], 0
push eax
mov ecx, ebx
mov dword [esp + 0x24], 0
call esi
lea eax, [esp + 0x20]
mov ecx, ebx
push eax
call esi
mov edx, dword [esp + 0x18]
movzx eax, dl
xor eax, 0x811c9dc5
mov dword [esp + 0x28], edx
imul ecx, eax, 0x1000193
mov eax, edx
shr eax, 8
movzx eax, al
xor ecx, eax
mov eax, edx
shr eax, 0x10
movzx eax, al
imul ecx, ecx, 0x1000193
shr edx, 0x18
xor ecx, eax
imul eax, ecx, 0x1000193
xor eax, edx
imul eax, eax, 0x1000193
push eax
lea eax, [esp + 0x2c]
push eax
lea eax, [esp + 0x18]
push eax
call fcn.1007fab0
mov esi, dword [0x100cd588]
mov eax, dword [eax + 4]
test eax, eax
cmovne esi, eax
cmp esi, dword [0x100cd588]
je 0x1007e455
mov esi, dword [esi + 0xc]
test esi, esi
je 0x1007e455
mov eax, dword [esp + 0x20]
cmp eax, 0x10000
ja 0x1007e425
cmp eax, dword [esi + 4]
jne 0x1007e425
mov ecx, dword [esi + 0x18]
test ecx, ecx
je 0x1007e3f4
push ecx
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov dword [esi + 0x18], 0
add esp, 4
mov eax, dword [esp + 0x20]
test eax, eax
jle 0x1007e414
push dword [esi + 4]
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
add esp, 4
mov dword [esi + 0x18], eax
mov ecx, ebx
push dword [esi + 4]
push eax
mov eax, 0x47b560
call eax
inc edi
cmp edi, dword [esp + 0x24]
jge 0x1007e469
mov esi, 0x47b3c0
jmp 0x1007e330
call fcn.10079c50
test al, al
je 0x1007e4a6
push dword [esp + 0x20]
push dword [esp + 0x1c]
push str.Server_sent_container_data_with_id_of__d_and_size_of__d_but_the_size_did_not_match_what_was_declared_earlier_
call fcn.10079e60
add esp, 0xc
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x20]
xor ecx, esp
call fcn.100928e8
mov esp, ebp
pop ebp
ret
call fcn.10079c50
test al, al
je 0x1007e4a6
push dword [esp + 0x18]
push str.Server_sent_container_data_with_id_of__d_but_did_not_declare_it_beforehand_
jmp 0x1007e49e
cmp byte [esp + 0x1f], 0
je 0x1007e4a6
call fcn.1007dbb0
call fcn.1007e4f0
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x20]
xor ecx, esp
call fcn.100928e8
mov esp, ebp
pop ebp
ret
call fcn.10079c50
test al, al
je 0x1007e4a6
push dword [esp + 0x24]
push str.Server_sent_container_data_with_count_of__d_
call fcn.10079e60
add esp, 8
mov ecx, dword [esp + 0x2c]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.100928e8
mov esp, ebp
pop ebp
ret