joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1022c2c0
Capabilities:
Hash data using fnv

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0xc
mov ebx, dword [esp + 0x20]
movzx eax, byte [ebx]
xor eax, 0x811c9dc5
imul eax, eax, 0x1000193
movzx edx, byte [ebx + 1]
xor edx, eax
imul eax, edx, 0x1000193
movzx edx, byte [ebx + 2]
xor edx, eax
imul eax, edx, 0x1000193
movzx edx, byte [ebx + 3]
xor edx, eax
imul esi, edx, 0x1000193
and esi, dword [ecx + 0x18]
mov edx, dword [ecx + 4]
mov dword [esp], ecx
mov ecx, dword [ecx + 0xc]
lea edi, [esi + esi]
mov ebp, dword [ecx + edi*4 + 4]
xor eax, eax
mov dword [esp + 8], edx
cmp ebp, edx
je 0x1022c3d2
lea edx, [esi + esi]
add edx, 1
mov dword [esp + 4], edi
mov esi, dword [ecx + edi*4]
mov edi, dword [ebx]
cmp edi, dword [ebp + 8]
jne 0x1022c33e
cmp esi, ebp
je 0x1022c36e
mov eax, dword [ebp + 4]
mov dword [ecx + edx*4], eax
jmp 0x1022c37e
mov ebx, ebp
cmp ebx, esi
je 0x1022c3d2
mov ebx, dword [ebx + 4]
cmp edi, dword [ebx + 8]
jne 0x1022c340
cmp ebp, ebx
je 0x1022c36a
mov ebp, ebx
cmp esi, ebx
mov edx, dword [esp]
jne 0x1022c381
mov eax, dword [esi]
mov edi, dword [esp + 4]
mov dword [ecx + edi*4], eax
mov ebp, esi
jmp 0x1022c381
cmp esi, ebx
jne 0x1022c336
mov eax, dword [esp + 4]
mov esi, edx
mov edx, dword [esp + 8]
mov dword [ecx + eax*4], edx
mov dword [ecx + esi*4], edx
mov edx, dword [esp]
mov eax, dword [ebp]
add dword [edx + 8], 0xffffffff
mov ecx, dword [ebp + 4]
mov dword [ecx], eax
mov ecx, dword [ebp + 4]
mov dword [eax + 4], ecx
mov ecx, dword [ebp + 0x54]
test ecx, ecx
je 0x1022c3c2
mov eax, dword [ebp + 0x5c]
sub eax, ecx
cmp eax, 0x1000
jb 0x1022c3b8
mov edx, dword [ecx - 4]
sub ecx, edx
add ecx, 0xfffffffc
cmp ecx, 0x20
jae 0x1022c3dc
add eax, 0x23
mov ecx, edx
push eax
push ecx
call fcn.102e53ef
add esp, 8
push 0x60
push ebp
call fcn.102e53ef
add esp, 8
mov eax, 1
add esp, 0xc
pop esi
pop edi
pop ebx
pop ebp
ret 4
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
Function at 0x1022cd70
Capabilities:
Hash data using fnv

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0xc
mov esi, ecx
mov ecx, dword [ecx]
mov eax, dword [esi + 4]
sub eax, ecx
sar eax, 2
imul ebp, eax, 0xb6db6db7
add ebp, 1
mov eax, dword [esi + 8]
mov dword [esp], ecx
sub eax, ecx
sar eax, 2
imul ecx, eax, 0xb6db6db7
mov eax, ecx
shr eax, 1
mov edx, 0x9249249
mov edi, 0x9249249
sub edi, eax
add eax, ecx
cmp eax, ebp
cmovb eax, ebp
cmp ecx, edi
cmova eax, edx
cmp eax, 0x924924a
jae 0x1022ced5
lea ecx, [eax + eax*8]
lea ebx, [ecx + ecx*2]
add ebx, eax
cmp ebx, 0x1000
mov dword [esp + 8], ebp
jb 0x1022cdf8
cmp ebx, 0xffffffdd
jae 0x1022ced5
lea eax, [ebx + 0x23]
push eax
call fcn.102e53ba
add esp, 4
lea edi, [eax + 0x23]
and edi, 0xffffffe0
mov dword [edi - 4], eax
jmp 0x1022ce0b
test eax, eax
je 0x1022ce09
push ebx
call fcn.102e53ba
add esp, 4
mov edi, eax
jmp 0x1022ce0b
xor edi, edi
mov eax, dword [esp + 0x24]
mov ebp, dword [esp + 0x20]
mov ecx, ebp
sub ecx, dword [esp]
sar ecx, 2
imul ecx, ecx, 0xb6db6db7
lea edx, [ecx + ecx*8]
lea edx, [edx + edx*2]
add edx, ecx
lea ecx, [edi + edx]
movups xmm0, xmmword [eax]
movups xmm1, xmmword [eax + 0xc]
movups xmmword [edi + edx + 0xc], xmm1
movups xmmword [edi + edx], xmm0
cmp dword [esi + 4], ebp
mov dword [esp], ecx
je 0x1022ce67
lea eax, [ecx + 0x1c]
mov dword [esp + 4], eax
mov eax, dword [esi]
mov ecx, ebp
sub ecx, eax
push ecx
push eax
push edi
call sub.VCRUNTIME140.dll_memmove
mov edx, dword [esp + 0x10]
add esp, 0xc
mov ecx, dword [esi + 4]
mov eax, ebp
jmp 0x1022ce6f
mov eax, dword [esi]
mov ecx, ebp
mov ebp, eax
mov edx, edi
sub ecx, eax
push ecx
push ebp
push edx
call sub.VCRUNTIME140.dll_memmove
add esp, 0xc
mov ecx, dword [esi]
test ecx, ecx
mov ebp, dword [esp + 8]
je 0x1022ceae
mov eax, dword [esi + 8]
sub eax, ecx
cmp eax, 0x1000
jb 0x1022cea4
mov edx, dword [ecx - 4]
add ecx, 0xfffffffc
sub ecx, edx
cmp ecx, 0x20
jae 0x1022ceda
add eax, 0x23
mov ecx, edx
push eax
push ecx
call fcn.102e53ef
add esp, 8
mov dword [esi], edi
lea eax, [ebp*8]
add eax, ebp
lea eax, [eax + eax*2]
add eax, ebp
add eax, edi
mov dword [esi + 4], eax
add ebx, edi
mov dword [esi + 8], ebx
mov eax, dword [esp]
add esp, 0xc
pop esi
pop edi
pop ebx
pop ebp
ret 8
call fcn.10023ce0
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
Function at 0x102345c0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
push eax
mov ecx, dword [0x104106f0]
mov eax, dword [ecx]
call dword [eax + 0x68]
test al, al
je 0x1023468f
mov esi, dword [0x1042ba24]
test esi, esi
je 0x1023468f
mov eax, dword [0x1042ba58]
test eax, eax
je 0x102345fd
cmp dword [eax + esi], 0
jne 0x1023468f
jmp 0x1023461c
mov ecx, dword [0x1042ba28]
mov eax, dword [ecx]
push 0xb895b8fc
push 0xead80de8
call dword [eax]
mov dword [0x1042ba58], eax
cmp dword [eax + esi], 0
jne 0x1023468f
mov eax, dword [0x1042ba5c]
test eax, eax
jne 0x1023463e
mov ecx, dword [0x1042ba28]
mov eax, dword [ecx]
push 0x1f102f20
push 0xead80de8
call dword [eax]
mov dword [0x1042ba5c], eax
cmp dword [eax + esi], 0
jle 0x1023468f
mov ebx, esp
mov ecx, dword [ebp + 0xc]
mov esi, dword [0x104106e8]
push eax
mov edi, esp
mov eax, dword [0x1042dd54]
test eax, eax
jne 0x10234677
mov ecx, dword [0x1042ba28]
mov eax, dword [ecx]
push 0x12fa9ba8
push 0x91241cc0
call dword [eax]
mov ecx, dword [ebp + 0xc]
mov dword [0x1042dd54], eax
mov eax, dword [eax + ecx]
mov dword [edi], eax
mov eax, dword [esi]
mov edi, ecx
mov ecx, esi
call dword [eax + 0x10]
mov esp, ebx
cmp eax, dword [0x1042ba24]
je 0x10234697
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
mov ebx, edi
mov ecx, dword [0x1042dd58]
test ecx, ecx
jne 0x102346be
mov ecx, dword [0x1042ba28]
mov eax, dword [ecx]
push 0xfbd7bb8
push 0x91241cc0
call dword [eax]
mov ecx, eax
mov dword [0x1042dd58], eax
add ecx, ebx
call fcn.10088750
test eax, eax
je 0x1023468f
mov dword [ebp - 0x10], esp
mov esi, dword [0x104106e8]
push eax
mov edi, esp
mov eax, dword [0x1042dd58]
test eax, eax
jne 0x102346f7
mov ecx, dword [0x1042ba28]
mov eax, dword [ecx]
push 0xfbd7bb8
push 0x91241cc0
call dword [eax]
mov dword [0x1042dd58], eax
mov eax, dword [eax + ebx]
mov dword [edi], eax
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0x10]
mov esp, dword [ebp - 0x10]
test eax, eax
je 0x1023468f
movsx ecx, word [eax + 0x2fba]
cmp ecx, 0x1f3
jle 0x102347b1
add ecx, 0xfffffe0c
cmp cx, 0x19
ja 0x1023468f
movzx ecx, cx
mov edx, 0x2ffd3e9
bt edx, ecx
jae 0x1023468f
add eax, 0x2fba
mov ecx, 0x1042bb64
push eax
call fcn.10234ba0
cmp eax, dword [0x1042bb64]
je 0x1023468f
mov esi, dword [ebp + 8]
mov ecx, dword [esi + 8]
mov eax, dword [eax + 0x14]
mov bl, byte [eax]
test bl, bl
je 0x10234797
add eax, 1
mov edx, 0x1848fcdd
nop word cs:[eax + eax]
nop dword [eax + eax]
movsx edi, bl
xor edi, edx
imul edx, edi, 0xbffbcccc
movzx ebx, byte [eax]
add eax, 1
test bl, bl
jne 0x10234780
jmp 0x1023479c
mov edx, 0x1848fcdd
sub esp, 4
push ecx
push edx
call fcn.102343e0
add esp, 0xc
mov dword [esi + 8], eax
jmp 0x1023468f
lea edx, [ecx - 0x29]
cmp dx, 2
jb 0x1023473e
cmp cx, 0x3b
je 0x1023473e
cmp cx, 0x50
je 0x1023473e
jmp 0x1023468f
Function at 0x10237c10
Capabilities:
Read file on windows

Disassembly:
push ebp
push ebx
push edi
push esi
push eax
mov ebp, dword [esp + 0x20]
mov ecx, dword [esp + 0x1c]
mov eax, dword [esp + 0x18]
test ebp, ebp
je 0x10237c2c
mov dword [ebp], 0
push ecx
push eax
call fcn.102378e0
add esp, 8
xor esi, esi
test eax, eax
je 0x10237c5a
mov edi, eax
push 2
push 0
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fseek]
add esp, 0xc
test eax, eax
je 0x10237c64
push edi
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
add esp, 4
mov eax, esi
add esp, 4
pop esi
pop edi
pop ebx
pop ebp
ret
push edi
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_ftell]
add esp, 4
cmp eax, 0xffffffff
je 0x10237c50
mov ebx, eax
push 0
push 0
push edi
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fseek]
add esp, 0xc
test eax, eax
jne 0x10237c50
mov eax, dword [esp + 0x24]
add eax, ebx
mov ecx, dword [0x1042dd60]
test ecx, ecx
je 0x10237c9e
add dword [ecx + 0x374], 1
push dword [0x1042dd68]
push eax
call dword [0x103c556c]
add esp, 8
test eax, eax
je 0x10237c50
push edi
push ebx
push 1
mov dword [esp + 0xc], eax
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
add esp, 0x10
cmp eax, ebx
jne 0x10237cfa
mov ecx, dword [esp + 0x24]
test ecx, ecx
jle 0x10237ce1
mov eax, dword [esp]
add eax, ebx
push ecx
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
push edi
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
add esp, 4
test ebp, ebp
je 0x10237cf2
mov dword [ebp], ebx
mov esi, dword [esp]
jmp 0x10237c5a
push edi
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
add esp, 4
mov eax, dword [0x1042dd60]
test eax, eax
je 0x10237d14
add dword [eax + 0x374], 0xffffffff
push dword [0x1042dd68]
push dword [esp + 4]
call dword [0x103c5570]
add esp, 8
jmp 0x10237c5a
Function at 0x1023bd40
Capabilities:
Hash data with crc32

Disassembly:
push ebx
push edi
push esi
mov eax, dword [esp + 0x14]
mov edx, dword [esp + 0x10]
mov esi, dword [ecx + 0x1c4]
mov ecx, dword [ecx + 0x1cc]
mov edi, dword [ecx + esi*4 - 4]
not edi
test eax, eax
je 0x1023bdb7
mov ecx, eax
sub ecx, edx
je 0x1023bdb7
mov esi, edx
not esi
add esi, eax
add edx, 2
mov ebx, edi
jmp 0x1023bd9b
mov eax, ebx
shr eax, 8
movzx ebx, bl
xor ebx, ecx
xor eax, dword [ebx*4 + 0x10359ccc]
add edx, 1
mov ebx, eax
add esi, 0xffffffff
jae 0x1023be08
movzx ecx, byte [edx - 2]
cmp ecx, 0x23
jne 0x1023bd80
cmp esi, 2
jb 0x1023bd80
cmp byte [edx - 1], 0x23
jne 0x1023bd80
cmp byte [edx], 0x23
cmove ebx, edi
jmp 0x1023bd80
mov bl, byte [edx]
test bl, bl
je 0x1023be06
add edx, 2
mov ecx, edi
jmp 0x1023bdef
movzx esi, bl
mov eax, ecx
shr eax, 8
movzx ecx, cl
xor ecx, esi
xor eax, dword [ecx*4 + 0x10359ccc]
add edx, 1
mov bl, bh
mov ecx, eax
test bh, bh
je 0x1023be08
mov bh, byte [edx - 1]
cmp bl, 0x23
jne 0x1023bdd0
cmp bh, 0x23
jne 0x1023bdd0
cmp byte [edx], 0x23
cmove ecx, edi
mov bh, 0x23
jmp 0x1023bdd0
mov eax, edi
not eax
mov ecx, dword [0x1042dd60]
cmp dword [ecx + 0x19f0], eax
jne 0x1023be1e
mov dword [ecx + 0x19f4], eax
cmp dword [ecx + 0x1a1c], eax
jne 0x1023be2d
mov byte [ecx + 0x1a20], 1
pop esi
pop edi
pop ebx
ret 8

Function at 0x1023c200
Capabilities:
Hash data with crc32

Disassembly:
push ebx
push edi
push esi
mov eax, dword [esp + 0x14]
mov edx, dword [esp + 0x10]
mov esi, dword [ecx + 0x1c4]
mov ecx, dword [ecx + 0x1cc]
mov edi, dword [ecx + esi*4 - 4]
not edi
test eax, eax
je 0x1023c277
mov ecx, eax
sub ecx, edx
je 0x1023c277
mov esi, edx
not esi
add esi, eax
add edx, 2
mov ebx, edi
jmp 0x1023c25b
mov eax, ebx
shr eax, 8
movzx ebx, bl
xor ebx, ecx
xor eax, dword [ebx*4 + 0x10359ccc]
add edx, 1
mov ebx, eax
add esi, 0xffffffff
jae 0x1023c2c8
movzx ecx, byte [edx - 2]
cmp ecx, 0x23
jne 0x1023c240
cmp esi, 2
jb 0x1023c240
cmp byte [edx - 1], 0x23
jne 0x1023c240
cmp byte [edx], 0x23
cmove ebx, edi
jmp 0x1023c240
mov bl, byte [edx]
test bl, bl
je 0x1023c2c6
add edx, 2
mov ecx, edi
jmp 0x1023c2af
movzx esi, bl
mov eax, ecx
shr eax, 8
movzx ecx, cl
xor ecx, esi
xor eax, dword [ecx*4 + 0x10359ccc]
add edx, 1
mov bl, bh
mov ecx, eax
test bh, bh
je 0x1023c2c8
mov bh, byte [edx - 1]
cmp bl, 0x23
jne 0x1023c290
cmp bh, 0x23
jne 0x1023c290
cmp byte [edx], 0x23
cmove ecx, edi
mov bh, 0x23
jmp 0x1023c290
mov eax, edi
not eax
pop esi
pop edi
pop ebx
ret 8
Function at 0x1023c3b0
Capabilities:
Hash data with crc32

Disassembly:
push ebx
push edi
push esi
mov eax, dword [esp + 0x10]
mov edx, dword [ecx + 0x1cc]
mov esi, dword [ecx + 0x1c4]
mov edx, dword [edx + esi*4 - 4]
movss xmm2, dword [eax]
movss xmm1, dword [ecx + 0xc]
movss xmm0, dword [ecx + 0x10]
subss xmm2, xmm1
cvttss2si ecx, xmm2
not edx
mov ebx, edx
xor edx, ecx
mov esi, ecx
shr ebx, 8
movzx edx, dl
xor ebx, dword [edx*4 + 0x10359ccc]
shr esi, 8
mov edx, ebx
xor ebx, esi
mov esi, ecx
mov edi, ecx
movss xmm2, dword [eax + 4]
shr esi, 0x10
shr edx, 8
movzx ecx, bl
xor edx, dword [ecx*4 + 0x10359ccc]
subss xmm2, xmm0
mov ecx, edx
xor edx, esi
cvttss2si esi, xmm2
shr ecx, 8
movzx edx, dl
xor ecx, dword [edx*4 + 0x10359ccc]
shr edi, 0x18
movzx edx, cl
shr ecx, 8
xor edx, edi
xor ecx, dword [edx*4 + 0x10359ccc]
mov edx, ecx
xor ecx, esi
mov edi, esi
shr edi, 8
shr edx, 8
movzx ecx, cl
xor edx, dword [ecx*4 + 0x10359ccc]
mov ecx, edx
xor edx, edi
mov edi, esi
shr edi, 0x10
shr ecx, 8
movzx edx, dl
xor ecx, dword [edx*4 + 0x10359ccc]
mov edx, ecx
xor ecx, edi
shr esi, 0x18
movss xmm2, dword [eax + 8]
subss xmm2, xmm1
shr edx, 8
movzx ecx, cl
xor edx, dword [ecx*4 + 0x10359ccc]
cvttss2si ecx, xmm2
movss xmm1, dword [eax + 0xc]
movzx eax, dl
shr edx, 8
xor eax, esi
xor edx, dword [eax*4 + 0x10359ccc]
mov eax, edx
xor edx, ecx
mov esi, ecx
shr esi, 8
shr eax, 8
movzx edx, dl
xor eax, dword [edx*4 + 0x10359ccc]
mov edx, eax
xor eax, esi
mov esi, ecx
mov edi, ecx
shr esi, 0x10
shr edi, 0x18
subss xmm1, xmm0
shr edx, 8
movzx eax, al
xor edx, dword [eax*4 + 0x10359ccc]
mov eax, edx
xor edx, esi
cvttss2si ecx, xmm1
shr eax, 8
movzx edx, dl
xor eax, dword [edx*4 + 0x10359ccc]
movzx edx, al
xor edx, edi
shr eax, 8
xor eax, dword [edx*4 + 0x10359ccc]
mov edx, eax
shr edx, 8
xor eax, ecx
movzx eax, al
xor edx, dword [eax*4 + 0x10359ccc]
mov eax, ecx
shr eax, 8
xor eax, edx
shr edx, 8
movzx eax, al
xor edx, dword [eax*4 + 0x10359ccc]
mov ebx, ecx
shr ebx, 0x10
xor ebx, edx
mov eax, edx
shr eax, 8
movzx edx, bl
xor eax, dword [edx*4 + 0x10359ccc]
movzx edx, al
shr ecx, 0x18
xor ecx, edx
shr eax, 8
xor eax, dword [ecx*4 + 0x10359ccc]
not eax
mov ecx, dword [0x1042dd60]
cmp dword [ecx + 0x19f0], eax
jne 0x1023c55a
mov dword [ecx + 0x19f4], eax
cmp dword [ecx + 0x1a1c], eax
jne 0x1023c569
mov byte [ecx + 0x1a20], 1
pop esi
pop edi
pop ebx
ret 4
Function at 0x1023d510
Capabilities:
Hash data with crc32

Disassembly:
push ebp
push ebx
push edi
push esi
mov eax, 0xffffffff
mov dl, 0x57
mov ecx, 0x103a515c
mov edi, dword [esp + 0x14]
mov ebx, 0xffffffff
jmp 0x1023d54b
movzx esi, dl
movzx ebp, bl
shr ebx, 8
xor ebp, esi
xor ebx, dword [ebp*4 + 0x10359ccc]
add ecx, 1
mov dl, dh
test dh, dh
je 0x1023d562
mov dh, byte [ecx - 1]
cmp dl, 0x23
jne 0x1023d530
cmp dh, 0x23
jne 0x1023d530
cmp byte [ecx], 0x23
cmove ebx, eax
mov dh, 0x23
jmp 0x1023d530
mov eax, dword [edi + 0x2d28]
cmp eax, dword [edi + 0x2d2c]
jne 0x1023d625
lea ebp, [eax + 1]
test eax, eax
je 0x1023d588
mov ecx, eax
shr ecx, 0x1f
add ecx, eax
sar ecx, 1
add ecx, eax
jmp 0x1023d58d
mov ecx, 8
cmp ecx, ebp
cmovg ebp, ecx
cmp eax, ebp
jge 0x1023d625
lea eax, [ebp*8]
lea eax, [eax + eax*2]
mov ecx, dword [0x1042dd60]
test ecx, ecx
je 0x1023d5b5
add dword [ecx + 0x374], 1
push dword [0x1042dd68]
push eax
call dword [0x103c556c]
add esp, 8
mov esi, eax
mov eax, dword [edi + 0x2d30]
test eax, eax
je 0x1023d613
mov ecx, dword [edi + 0x2d28]
shl ecx, 3
lea ecx, [ecx + ecx*2]
push ecx
push eax
push esi
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
mov eax, dword [edi + 0x2d30]
test eax, eax
je 0x1023d603
mov ecx, dword [0x1042dd60]
test ecx, ecx
je 0x1023d603
add dword [ecx + 0x374], 0xffffffff
push dword [0x1042dd68]
push eax
call dword [0x103c5570]
add esp, 8
mov dword [edi + 0x2d30], esi
mov dword [edi + 0x2d2c], ebp
mov eax, dword [edi + 0x2d28]
not ebx
mov ecx, dword [edi + 0x2d30]
lea eax, [eax + eax*2]
mov dword [ecx + eax*8], 0x103a515a
mov dword [ecx + eax*8 + 4], ebx
mov dword [ecx + eax*8 + 8], 0x10245bf0
mov dword [ecx + eax*8 + 0xc], 0x10245c80
mov dword [ecx + eax*8 + 0x10], 0x10245d30
mov dword [ecx + eax*8 + 0x14], 0
add dword [edi + 0x2d28], 1
mov byte [edi], 1
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x10247c60
Capabilities:
Hash data with crc32

Disassembly:
push ebp
push ebx
push edi
push esi
mov edi, dword [esp + 0x14]
mov ecx, dword [0x1042dd60]
mov eax, dword [ecx + 0x19b4]
mov byte [eax + 0x7c], 1
mov eax, dword [ecx + 0x19b4]
mov edx, dword [eax + 0x1c4]
mov eax, dword [eax + 0x1cc]
mov esi, dword [eax + edx*4 - 4]
not esi
mov bl, byte [edi]
test bl, bl
je 0x10247cd6
add edi, 2
mov eax, esi
jmp 0x10247cbf
movzx ebp, bl
mov edx, eax
shr edx, 8
movzx eax, al
xor eax, ebp
xor edx, dword [eax*4 + 0x10359ccc]
add edi, 1
mov bl, bh
mov eax, edx
test bh, bh
je 0x10247cd8
mov bh, byte [edi - 1]
cmp bl, 0x23
jne 0x10247ca0
cmp bh, 0x23
jne 0x10247ca0
cmp byte [edi], 0x23
cmove eax, esi
mov bh, 0x23
jmp 0x10247ca0
mov edx, esi
not edx
cmp dword [ecx + 0x19f0], edx
jne 0x10247ce8
mov dword [ecx + 0x19f4], edx
mov esi, dword [esp + 0x20]
mov bl, byte [esp + 0x1c]
mov eax, dword [esp + 0x18]
cmp dword [ecx + 0x1a1c], edx
jne 0x10247d03
mov byte [ecx + 0x1a20], 1
movzx edi, bl
mov ecx, dword [esp + 0x14]
push esi
push edi
push eax
call fcn.10247d20
add esp, 0xc
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x10248ad0
Capabilities:
Hash data with crc32

Disassembly:
push ebp
push ebx
push edi
push esi
mov eax, dword [esp + 0x14]
mov bl, byte [eax]
test bl, bl
je 0x10248b26
add eax, 2
mov edx, 0xffffffff
mov ecx, 0xffffffff
jmp 0x10248b0b
movzx esi, bl
movzx edi, cl
shr ecx, 8
xor edi, esi
xor ecx, dword [edi*4 + 0x10359ccc]
add eax, 1
mov bl, bh
test bh, bh
je 0x10248b22
mov bh, byte [eax - 1]
cmp bl, 0x23
jne 0x10248af0
cmp bh, 0x23
jne 0x10248af0
cmp byte [eax], 0x23
cmove ecx, edx
mov bh, 0x23
jmp 0x10248af0
not ecx
jmp 0x10248b28
xor ecx, ecx
mov edx, dword [0x1042dd60]
mov eax, dword [edx + 0x19a4]
mov esi, dword [edx + 0x19ac]
mov edx, esi
test eax, eax
je 0x10248b6d
mov edx, esi
mov edi, eax
nop word cs:[eax + eax]
nop
mov ebx, edi
shr ebx, 1
mov ebp, ebx
not ebp
add ebp, edi
cmp dword [edx + ebx*8], ecx
cmovae ebp, ebx
lea edi, [edx + ebx*8 + 8]
cmovb edx, edi
mov edi, ebp
test ebp, ebp
jne 0x10248b50
lea esi, [esi + eax*8]
xor eax, eax
cmp edx, esi
je 0x10248b7d
cmp dword [edx], ecx
jne 0x10248b7d
mov eax, dword [edx + 4]
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x10250de0
Capabilities:
Hash data with crc32

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0xc
mov edx, dword [esp + 0x20]
mov eax, dword [0x1042dd60]
mov dword [esp + 8], eax
mov eax, dword [eax + 0x19b4]
mov esi, dword [eax + 0x1c4]
mov dword [esp + 4], eax
mov eax, dword [eax + 0x1cc]
mov dword [esp], eax
mov ebp, dword [eax + esi*4 - 4]
not ebp
mov cl, byte [edx]
test cl, cl
je 0x10250e56
add edx, 2
mov eax, ebp
jmp 0x10250e3f
movzx edi, cl
mov ebx, eax
shr ebx, 8
movzx eax, al
xor eax, edi
xor ebx, dword [eax*4 + 0x10359ccc]
add edx, 1
mov cl, ch
mov eax, ebx
test ch, ch
je 0x10250e58
mov ch, byte [edx - 1]
cmp cl, 0x23
jne 0x10250e20
cmp ch, 0x23
jne 0x10250e20
cmp byte [edx], 0x23
cmove eax, ebp
mov ch, 0x23
jmp 0x10250e20
mov ebx, ebp
mov ecx, dword [esp + 4]
cmp esi, dword [ecx + 0x1c8]
jne 0x10250e78
lea ebp, [esi + 1]
test esi, esi
je 0x10250e80
mov edx, esi
shr edx, 0x1f
add edx, esi
sar edx, 1
add edx, esi
jmp 0x10250e85
mov eax, dword [esp]
jmp 0x10250f24
mov edx, 8
mov eax, dword [esp]
cmp edx, ebp
cmovg ebp, edx
cmp esi, ebp
jge 0x10250f24
lea eax, [ebp*4]
mov ecx, dword [esp + 8]
test ecx, ecx
je 0x10250eab
add dword [ecx + 0x374], 1
push dword [0x1042dd68]
push eax
call dword [0x103c556c]
add esp, 8
mov ecx, dword [esp + 4]
mov edx, dword [ecx + 0x1cc]
test edx, edx
je 0x10250f12
mov esi, ecx
mov ecx, dword [ecx + 0x1c4]
shl ecx, 2
push ecx
push edx
mov edi, eax
push eax
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
mov eax, dword [esi + 0x1cc]
test eax, eax
je 0x10250efc
mov ecx, dword [0x1042dd60]
test ecx, ecx
je 0x10250efc
add dword [ecx + 0x374], 0xffffffff
push dword [0x1042dd68]
push eax
call dword [0x103c5570]
add esp, 8
mov ecx, dword [esp + 4]
mov eax, edi
mov dword [ecx + 0x1cc], eax
mov dword [ecx + 0x1c8], ebp
mov esi, dword [ecx + 0x1c4]
not ebx
mov dword [eax + esi*4], ebx
add dword [ecx + 0x1c4], 1
add esp, 0xc
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x102510f0
Capabilities:
Hash data with crc32

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 8
mov ebp, dword [esp + 0x1c]
mov eax, dword [0x1042dd60]
mov edi, dword [eax + 0x19b4]
mov ecx, dword [edi + 0x1c4]
mov edx, dword [edi + 0x1cc]
mov dword [esp], edx
mov ebx, dword [edx + ecx*4 - 4]
not ebx
mov esi, ebx
shr esi, 8
xor ebx, ebp
movzx ebx, bl
xor esi, dword [ebx*4 + 0x10359ccc]
mov ebx, ebp
shr ebx, 8
xor ebx, esi
shr esi, 8
movzx ebx, bl
xor esi, dword [ebx*4 + 0x10359ccc]
mov edx, ebp
shr edx, 0x10
xor edx, esi
mov ebx, esi
shr ebx, 8
movzx edx, dl
xor ebx, dword [edx*4 + 0x10359ccc]
movzx edx, bl
shr ebp, 0x18
xor ebp, edx
mov ebp, dword [ebp*4 + 0x10359ccc]
cmp ecx, dword [edi + 0x1c8]
jne 0x10251185
mov dword [esp + 4], eax
lea esi, [ecx + 1]
test ecx, ecx
je 0x1025118d
mov edx, ecx
shr edx, 0x1f
add edx, ecx
sar edx, 1
add edx, ecx
jmp 0x10251192
mov eax, dword [esp]
jmp 0x10251226
mov edx, 8
cmp edx, esi
cmovg esi, edx
cmp ecx, esi
mov eax, dword [esp]
jge 0x10251226
lea eax, [esi*4]
mov ecx, dword [esp + 4]
add dword [ecx + 0x374], 1
push dword [0x1042dd68]
push eax
call dword [0x103c556c]
add esp, 8
mov edx, dword [edi + 0x1cc]
test edx, edx
je 0x10251214
mov ecx, dword [edi + 0x1c4]
shl ecx, 2
push ecx
push edx
mov dword [esp + 8], eax
push eax
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
mov eax, dword [edi + 0x1cc]
test eax, eax
je 0x10251201
mov ecx, dword [0x1042dd60]
test ecx, ecx
je 0x10251201
add dword [ecx + 0x374], 0xffffffff
push dword [0x1042dd68]
push eax
call dword [0x103c5570]
add esp, 8
mov eax, dword [esp]
mov dword [edi + 0x1cc], eax
mov dword [edi + 0x1c8], esi
mov ecx, dword [edi + 0x1c4]
shr ebx, 8
xor ebp, ebx
not ebp
mov dword [eax + ecx*4], ebp
add dword [edi + 0x1c4], 1
add esp, 8
pop esi
pop edi
pop ebx
pop ebp
ret