joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10018720
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
push ecx
mov edx, esp
mov dword [ebp - 4], ecx
mov dword [edx], eax
call fcn.10018620
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x10]
mov ebx, dword [sym.imp.KERNEL32.dll_VirtualProtect]
add esp, 4
mov dword [ebp - 0x14], 1
mov dword [ebp - 0x18], esi
push eax
push 0x40
push 1
push esi
call ebx
test eax, eax
setne byte [ebp - 0xc]
mov byte [esi], 0xe9
test eax, eax
je 0x1001877a
mov eax, dword [ebp - 0x10]
lea ecx, [ebp - 8]
push ecx
push eax
push dword [ebp - 0x14]
mov dword [ebp - 8], eax
push dword [ebp - 0x18]
call ebx
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x10]
mov edi, dword [ebp + 0xc]
inc esi
push eax
push 0x40
push 4
sub edi, esi
mov dword [ebp - 0x14], 4
push esi
sub edi, 4
mov dword [ebp - 0x18], esi
call ebx
test eax, eax
setne byte [ebp - 0xc]
mov dword [esi], edi
test eax, eax
je 0x100187ba
mov eax, dword [ebp - 0x10]
lea ecx, [ebp - 8]
push ecx
push eax
push dword [ebp - 0x14]
mov dword [ebp - 8], eax
push dword [ebp - 0x18]
call ebx
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x100187d0
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
push ecx
mov edx, esp
mov dword [ebp - 4], ecx
mov dword [edx], eax
call fcn.10018620
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x10]
mov ebx, dword [sym.imp.KERNEL32.dll_VirtualProtect]
add esp, 4
mov dword [ebp - 0x14], 1
mov dword [ebp - 0x18], esi
push eax
push 0x40
push 1
push esi
call ebx
test eax, eax
setne byte [ebp - 0xc]
mov byte [esi], 0xe8
test eax, eax
je 0x1001882a
mov eax, dword [ebp - 0x10]
lea ecx, [ebp - 8]
push ecx
push eax
push dword [ebp - 0x14]
mov dword [ebp - 8], eax
push dword [ebp - 0x18]
call ebx
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x10]
mov edi, dword [ebp + 0xc]
inc esi
push eax
push 0x40
push 4
sub edi, esi
mov dword [ebp - 0x14], 4
push esi
sub edi, 4
mov dword [ebp - 0x18], esi
call ebx
test eax, eax
setne byte [ebp - 0xc]
mov dword [esi], edi
test eax, eax
je 0x1001886a
mov eax, dword [ebp - 0x10]
lea ecx, [ebp - 8]
push ecx
push eax
push dword [ebp - 0x14]
mov dword [ebp - 8], eax
push dword [ebp - 0x18]
call ebx
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1002e710
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
movzx eax, cl
xor edx, edx
shl eax, 2
mov dword [ebp - 0x18], edx
push esi
mov esi, dword [ebp + 8]
test eax, eax
jne 0x1002e72d
xor al, al
jmp 0x1002e749
lea ecx, [ebp - 0x10]
mov dword [ebp - 0x14], eax
push ecx
push 0x40
push eax
push esi
mov dword [ebp - 0x18], esi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov edx, dword [ebp - 0x18]
test eax, eax
setne al
mov byte [ebp - 0xc], al
mov esi, dword [esi]
test al, al
je 0x1002e767
mov ecx, dword [ebp - 0x10]
lea eax, [ebp - 8]
push eax
push ecx
push dword [ebp - 0x14]
mov dword [ebp - 8], ecx
push edx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x1002e770
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push esi
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x10]
push edi
push eax
push 0x40
push 4
push esi
mov edi, ecx
mov dword [ebp - 0x14], 4
mov dword [ebp - 0x18], esi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
setne byte [ebp - 0xc]
mov dword [esi], edi
test eax, eax
je 0x1002e7b9
mov eax, dword [ebp - 0x10]
lea ecx, [ebp - 8]
push ecx
push eax
push dword [ebp - 0x14]
mov dword [ebp - 8], eax
push dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x1002e7c0
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push ebx
push esi
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x10]
push eax
push 0x40
push 1
push esi
mov dword [ebp - 0x14], 1
mov dword [ebp - 0x18], esi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
setne byte [ebp - 0xc]
mov bl, byte [esi]
test eax, eax
je 0x1002e807
mov ecx, dword [ebp - 0x10]
lea eax, [ebp - 8]
push eax
push ecx
push dword [ebp - 0x14]
mov dword [ebp - 8], ecx
push dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
pop esi
mov al, bl
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x1002e810
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push ebx
push esi
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x10]
push eax
push 0x40
push 1
push esi
mov bl, cl
mov dword [ebp - 0x14], 1
mov dword [ebp - 0x18], esi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
setne byte [ebp - 0xc]
mov byte [esi], bl
test eax, eax
je 0x1002e859
mov eax, dword [ebp - 0x10]
lea ecx, [ebp - 8]
push ecx
push eax
push dword [ebp - 0x14]
mov dword [ebp - 8], eax
push dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1002e860
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push esi
mov esi, dword [ebp + 8]
lea eax, [ebp - 0xc]
push eax
push 0x40
push 4
push esi
mov dword [ebp - 0x10], 4
mov dword [ebp - 0x14], esi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
setne byte [ebp - 8]
mov esi, dword [esi]
test eax, eax
je 0x1002e8a6
mov ecx, dword [ebp - 0xc]
lea eax, [ebp - 4]
push eax
push ecx
push dword [ebp - 0x10]
mov dword [ebp - 4], ecx
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x10045390
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100f2760
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x1012c208]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, ecx
mov dword [ebp - 0x10], eax
push 8
mov dword [eax], vtable.std::basic_streambuf_char__struct_std::char_traits_char__.0
call fcn.100bfff8
mov esi, eax
push 1
mov dword [ebp - 4], 0
call fcn.100a9b0c
mov dword [esi + 4], eax
add esp, 8
mov eax, dword [ebp - 0x10]
lea edi, [eax + 0x14]
lea ecx, [eax + 0x18]
lea edx, [eax + 0x24]
mov dword [eax + 0x34], esi
lea ebx, [eax + 4]
mov dword [eax + 0xc], ebx
lea esi, [eax + 8]
mov dword [eax + 0x10], esi
mov dword [eax + 0x1c], edi
mov dword [eax + 0x20], ecx
mov dword [eax + 0x2c], edx
add eax, 0x28
mov dword [ebp - 0x14], ebx
mov ebx, dword [ebp - 0x10]
mov dword [ebx + 0x30], eax
mov ebx, dword [ebp - 0x14]
mov dword [esi], 0
mov dword [ecx], 0
mov dword [eax], 0
mov eax, dword [ebp - 0x10]
mov dword [ebx], 0
mov dword [edi], 0
mov dword [edx], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10062e40
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x104
mov eax, dword [0x1012c208]
xor eax, ebp
mov dword [ebp - 4], eax
call fcn.100a86a0
mov eax, dword [eax]
test eax, eax
je 0x10063000
cmp dword [eax + 0x14e0], 0
je 0x10063000
cmp byte [0x11d2e61c], 0
jne 0x10062e83
mov byte [0x11d2e61c], 1
mov al, 1
jmp 0x10062e88
mov al, byte [0x116e8f76]
movaps xmm0, xmmword [0x10115220]
xor edx, edx
movups xmmword [ebp - 0x104], xmm0
movzx ecx, al
movaps xmm0, xmmword [0x10115230]
mov eax, dword [0x116ee2d0]
cmp eax, dword [0xb7cb84]
movups xmmword [ebp - 0xf4], xmm0
cmovb ecx, edx
mov dword [ebp - 0xb4], 0xbc
movaps xmm0, xmmword [0x10115240]
movups xmmword [ebp - 0xe4], xmm0
mov byte [0x116e8f76], cl
mov ecx, 0x10
movaps xmm0, xmmword [0x10115290]
movups xmmword [ebp - 0xd4], xmm0
mov dword [ebp - 0xb0], 0xbe
movaps xmm0, xmmword [0x101152a0]
movups xmmword [ebp - 0xc4], xmm0
mov dword [ebp - 0xac], 0xbf
movaps xmm0, xmmword [0x10115250]
movups xmmword [ebp - 0xa8], xmm0
movaps xmm0, xmmword [0x10115260]
movups xmmword [ebp - 0x98], xmm0
movaps xmm0, xmmword [0x10115270]
movups xmmword [ebp - 0x88], xmm0
movaps xmm0, xmmword [0x10115280]
movups xmmword [ebp - 0x78], xmm0
nop
lea eax, [ecx + 0x41]
mov dword [ebp + ecx*4 - 0xa8], eax
inc ecx
cmp ecx, 0x1a
jl 0x10062f40
push esi
xor eax, eax
push edi
lea ecx, [eax + 0x63]
lea edx, [eax + 0x62]
movd xmm3, ecx
lea esi, [eax + 0x61]
movd xmm0, edx
lea edi, [eax + 0x60]
movd xmm1, esi
movd xmm2, edi
punpckldq xmm2, xmm0
punpckldq xmm1, xmm3
punpckldq xmm2, xmm1
movups xmmword [ebp + eax*4 - 0x40], xmm2
add eax, 4
cmp eax, 0xc
jl 0x10062f54
cmp eax, 0xf
jge 0x10062fa0
lea ecx, [eax + 0x60]
lea eax, [ebp + eax*4 - 0x40]
mov dword [eax], ecx
inc ecx
add eax, 4
cmp ecx, 0x6f
jl 0x10062f95
mov edi, dword [sym.imp.USER32.dll_GetKeyState]
lea esi, [ebp - 0x104]
nop dword [eax]
push dword [esi]
call edi
shr eax, 0xf
test al, 1
jne 0x10062fda
add esi, 4
lea eax, [ebp - 4]
cmp esi, eax
jne 0x10062fb0
mov al, byte [0x116e8f76]
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100bfded
mov esp, ebp
pop ebp
ret
mov eax, dword [0xb7cb84]
add eax, 0x9c4
mov dword [0x116ee2d0], eax
mov al, 1
pop edi
mov byte [0x116e8f76], al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100bfded
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor al, al
xor ecx, ebp
mov byte [0x11d2e61c], 0
mov byte [0x116e8f76], 0
call fcn.100bfded
mov esp, ebp
pop ebp
ret
Function at 0x10071970
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push edi
push 0x24
push 1
call fcn.100d3085
mov edi, eax
add esp, 8
test edi, edi
jne 0x1007198e
pop edi
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp + 0xc]
push ebx
mov ebx, dword [ebp + 8]
push esi
mov dword [edi + 8], eax
mov eax, dword [ebp + 0x10]
push 5
mov dword [edi + 4], ebx
mov dword [edi + 0xc], eax
mov dword [edi + 0x18], 5
mov dword [edi + 0x1c], 0x19
call fcn.100d3458
mov esi, eax
add esp, 4
mov dword [edi + 0x10], esi
test esi, esi
je 0x10071ae6
mov ecx, dword [ebx]
lea eax, [ebp - 0x10]
push eax
push 0x40
mov dword [esi], ecx
mov cl, byte [ebx + 4]
push 5
push ebx
mov byte [esi + 4], cl
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
je 0x10071ae6
push 0x40
push 0x3000
push 0x19
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov dword [ebp - 4], eax
mov dword [edi + 0x14], eax
test eax, eax
je 0x10071add
mov eax, dword [0x116ee314]
lea edx, [edi + 0x20]
xor esi, esi
mov ecx, sym.myhome_samp.asi_subhook_disasm
test eax, eax
cmovne ecx, eax
mov dword [ebp - 0xc], ecx
test edx, edx
jne 0x10071a43
push 0x194
push str.D:Serverplugin_projectclient_handlingclient_handlingEarShot_subhook_0.8.2_subhook_x86.c
push str.trampoline_len___NULL
call fcn.100cfc8a
mov ecx, dword [ebp - 0xc]
add esp, 0xc
jmp 0x10071a43
mov ebx, dword [ebp + 8]
lea edx, [ebp - 8]
mov dword [ebp - 8], 0
lea eax, [esi + ebx]
push edx
push eax
mov dword [ebp - 0x10], eax
call ecx
mov ebx, eax
add esp, 8
test ebx, ebx
je 0x10071ab3
mov ecx, dword [ebp - 4]
push ebx
push dword [ebp - 0x10]
add ecx, esi
push ecx
call fcn.100c2e00
mov eax, dword [ebp - 8]
add esp, 0xc
mov edx, dword [ebp - 4]
test eax, eax
jle 0x10071a87
lea ecx, [edx + eax]
mov eax, dword [ebp + 8]
sub eax, edx
add dword [ecx + esi], eax
mov ecx, dword [ebp - 0xc]
add esi, ebx
cmp esi, 5
jb 0x10071a40
lea eax, [esi + 5]
mov dword [edi + 0x20], eax
lea ecx, [edx + esi]
mov eax, dword [ebp + 8]
sub esi, ecx
add eax, 0xfffffffb
mov byte [ecx], 0xe9
add eax, esi
pop esi
mov dword [ecx + 1], eax
mov eax, edi
pop ebx
pop edi
mov esp, ebp
pop ebp
ret
mov eax, dword [edi + 0x14]
test eax, eax
je 0x10071ac8
push 0x8000
push 0
push eax
call dword [sym.imp.KERNEL32.dll_VirtualFree]
mov dword [edi + 0x14], 0
mov dword [edi + 0x1c], 0
mov dword [edi + 0x20], 0
pop esi
pop ebx
mov eax, edi
pop edi
mov esp, ebp
pop ebp
ret
mov eax, dword [edi + 0x14]
test eax, eax
je 0x10071afb
push 0x8000
push 0
push eax
call dword [sym.imp.KERNEL32.dll_VirtualFree]
push esi
call fcn.100d22ae
push edi
call fcn.100d22ae
add esp, 8
xor eax, eax
pop esi
pop ebx
pop edi
mov esp, ebp
pop ebp
ret
Function at 0x10073010
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
movzx eax, byte [ebp + 8]
sub esp, 0x14
push ebx
mov ebx, edx
push esi
push edi
sub eax, 1
je 0x100730cb
sub eax, 1
je 0x10073046
sub eax, 2
jne 0x100730d4
push ecx
call fcn.1009f920
add esp, 4
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
call fcn.1009fde0
mov ecx, dword [0x11d2e254]
mov edi, eax
test cl, 1
jne 0x10073084
or ecx, 1
mov dword [0x11d2e414], 0x1010dc70
mov dword [0x11d2e254], ecx
mov dword [0x11d2e41c], 0
mov dword [0x11d2e418], 0
call fcn.10018880
lea eax, [ebp - 8]
movzx esi, bx
mov ebx, dword [sym.imp.KERNEL32.dll_VirtualProtect]
push eax
push 0x40
push 2
push edi
mov dword [ebp - 0xc], 2
mov dword [ebp - 0x10], edi
call ebx
test eax, eax
setne byte [ebp - 4]
mov word [edi], si
cmp byte [ebp - 4], 0
je 0x100730d4
mov eax, dword [ebp - 8]
lea ecx, [ebp + 8]
push ecx
push eax
push dword [ebp - 0xc]
mov dword [ebp + 8], eax
push dword [ebp - 0x10]
call ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push ecx
call fcn.1009f7f0
add esp, 4
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x10075600
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push esi
call fcn.1009fde0
mov ecx, dword [0x11d2e254]
mov esi, eax
test cl, 1
jne 0x10075645
or ecx, 1
mov dword [0x11d2e414], 0x1010dc70
mov dword [0x11d2e254], ecx
mov dword [0x11d2e41c], 0
mov dword [0x11d2e418], 0
call fcn.10018880
lea eax, [ebp - 0x10]
mov dword [ebp - 0x14], 4
push eax
push 0x40
push 4
push esi
mov dword [ebp - 0x18], esi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
setne byte [ebp - 0xc]
mov dword [esi], 0x7a120
cmp byte [ebp - 0xc], 0
je 0x10075687
mov eax, dword [ebp - 0x10]
lea ecx, [ebp - 8]
push ecx
push eax
push dword [ebp - 0x14]
mov dword [ebp - 8], eax
push dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x10084c50
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 0xc]
mov edx, 0x811c9dc5
push edi
mov edi, dword [ebp + 8]
mov ecx, 0
sub esi, edi
je 0x10084c81
nop dword [eax]
movzx eax, byte [ecx + edi]
inc ecx
xor eax, edx
imul edx, eax, 0x1000193
cmp ecx, esi
jb 0x10084c70
pop edi
mov eax, edx
pop esi
pop ebp
ret 8
Function at 0x1008a3b0
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
lea eax, [ebp - 4]
mov esi, ecx
push eax
push 0x40
push 1
push esi
mov ebx, edx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
je 0x1008a3db
mov cl, bl
movzx eax, cl
shl cx, 8
or cx, ax
mov byte [esi], cl
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x1008a3f0
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
lea eax, [ebp - 4]
mov esi, edx
push eax
push 0x40
push 5
push 0x541df5
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
je 0x1008a41d
mov eax, dword [esi]
mov ecx, 0x541df5
mov dword [ecx], eax
mov al, byte [esi + 4]
mov byte [ecx + 4], al
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x10095a60
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push esi
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [ebp - 8]
push edi
push eax
push 0x40
push 5
push 0x589650
call esi
mov eax, fcn.100240f0
mov byte [0x589650], 0xe8
sub eax, 0x589655
mov dword [0x589651], eax
lea eax, [ebp - 4]
push eax
push dword [ebp - 8]
push 5
push 0x589650
call esi
lea eax, [ebp - 8]
push eax
push 0x40
push 5
push 0x58b6e0
call esi
mov eax, fcn.100240f0
mov byte [0x58b6e0], 0xe8
sub eax, 0x58b6e5
mov dword [0x58b6e1], eax
lea eax, [ebp - 4]
push eax
push dword [ebp - 8]
push 5
push 0x58b6e0
call esi
push ecx
mov eax, esp
mov ecx, 0x589270
mov dword [eax], 0x10095330
call fcn.1009fde0
push ecx
mov ecx, dword [0x11d2e254]
mov esi, eax
mov edi, esp
test cl, 1
jne 0x10095b27
or ecx, 1
mov dword [0x11d2e414], 0x1010dc70
mov dword [0x11d2e254], ecx
mov dword [0x11d2e41c], 0
mov dword [0x11d2e418], 0
call fcn.10018880
lea ecx, [ebp - 4]
mov dword [edi], esi
call fcn.10018720
add esp, 8
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x100971b0
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, ecx
test dword [edi + 8], 0x1c00000
jne 0x10097382
mov eax, dword [edi + 0x18]
test eax, eax
jne 0x1009721f
mov ecx, dword [edi + 8]
mov eax, ecx
movups xmm0, xmmword [edi + 4]
shr eax, 0x14
movups xmmword [ebp - 0x14], xmm0
test al, 1
je 0x10097203
test dword [edi + 4], 0x1ff8000
jne 0x10097203
cmp dword [edi + 0xc], 2
jne 0x10097203
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0xc], 1
movups xmm0, xmmword [ebp - 0x14]
push ecx
push dword [ebp + 0xc]
lea eax, [ebp - 0x14]
mov ecx, esi
push eax
movups xmmword [ebp - 0x14], xmm0
call fcn.10096fd0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x14
cmp eax, 2
je 0x1009722d
cmp eax, 3
jne 0x10097379
push 5
push dword [ebp + 0xc]
push 0
call fcn.10096f70
mov ecx, dword [edi + 0x14]
mov ebx, dword [edi + 0x10]
mov dword [ebp + 0xc], ecx
test ecx, ecx
je 0x1009734d
sub ebx, dword [ebp + 0x10]
cmp dword [esi + 0xc], 3
jne 0x10097268
mov eax, dword [esi + 0x20]
add eax, 0x10
cmp eax, dword [esi + 0x18]
jb 0x10097268
mov ecx, esi
call fcn.10096060
mov ecx, dword [ebp + 0xc]
mov edx, dword [ecx + 4]
test edx, edx
jne 0x1009727b
mov edx, dword [esi + 0x34]
lea eax, [edx + 1]
mov dword [esi + 0x34], eax
mov dword [ecx + 4], edx
movzx eax, dl
xor eax, 0x811c9dc5
mov edi, dword [esi + 0x3c]
imul ecx, eax, 0x1000193
mov eax, edx
shr eax, 8
movzx eax, al
xor ecx, eax
mov eax, edx
imul ecx, ecx, 0x1000193
shr eax, 0x10
movzx eax, al
xor ecx, eax
mov eax, edx
imul ecx, ecx, 0x1000193
shr eax, 0x18
xor ecx, eax
imul eax, ecx, 0x1000193
mov ecx, dword [esi + 0x50]
and ecx, eax
mov eax, dword [esi + 0x44]
lea ecx, [eax + ecx*8]
mov eax, dword [ecx + 4]
cmp eax, edi
je 0x10097307
mov ecx, dword [ecx]
cmp edx, dword [eax + 8]
je 0x100972de
cmp eax, ecx
je 0x10097307
mov eax, dword [eax + 4]
cmp edx, dword [eax + 8]
jne 0x100972d2
test eax, eax
cmove eax, edi
cmp eax, edi
je 0x10097307
sub ebx, dword [esi + 0x20]
mov ecx, esi
mov eax, dword [eax + 0xc]
add ebx, 0xfffffffc
push 4
add eax, ebx
push 0
push eax
call fcn.10096250
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x14
push 4
push 0
push 0
mov ecx, esi
call fcn.10096250
mov ecx, dword [ebp + 0xc]
mov dword [ebp - 0x10], 4
mov dword [ebp - 0xc], 0
mov dword [ebp - 8], ebx
mov eax, dword [ecx + 4]
lea ecx, [esi + 0x58]
mov dword [ebp - 0x18], eax
mov eax, dword [esi + 0x20]
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp + 0xc]
push eax
call fcn.10099c60
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x14
cmp dword [edi + 0x18], 3
jne 0x1009736d
cmp dword [esi + 0xc], 3
jne 0x1009735d
push 0x2a
jmp 0x10097384
mov eax, 0xfffffffc
sub eax, dword [esi + 0x20]
sub eax, dword [esi + 0x1c]
sub eax, dword [ebp + 0x10]
add ebx, eax
push 4
push 0
push ebx
mov ecx, esi
call fcn.10096250
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x14
push 0x1b
lea ecx, [ebp - 0x14]
call fcn.10095ba0
push 0x1012a558
mov eax, ecx
push eax
call fcn.100c3374
int3
Function at 0x100994a0
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
sub esp, 0x18
mov edx, dword [ebp + 8]
push ebx
mov ebx, ecx
cmp edx, eax
je 0x100995f6
mov eax, dword [ebx + 4]
mov dword [ebp - 0x10], eax
mov eax, dword [edx + 4]
mov dword [ebp - 4], eax
movzx eax, byte [edx + 8]
xor eax, 0x811c9dc5
imul ecx, eax, 0x1000193
movzx eax, byte [edx + 9]
push esi
push edi
mov edi, dword [ebx + 0xc]
mov esi, edx
xor ecx, eax
mov dword [ebp - 0x18], edi
movzx eax, byte [edx + 0xa]
imul ecx, ecx, 0x1000193
xor ecx, eax
movzx eax, byte [edx + 0xb]
imul ecx, ecx, 0x1000193
xor ecx, eax
mov eax, dword [ebx + 0x18]
imul ecx, ecx, 0x1000193
and eax, ecx
mov ecx, dword [edi + eax*8]
mov dword [ebp - 0xc], ecx
lea eax, [edi + eax*8]
mov dword [ebp - 8], eax
mov eax, dword [eax + 4]
mov dword [ebp - 0x14], eax
mov eax, esi
mov edi, esi
mov esi, dword [esi]
push 0xc
push eax
call fcn.100c0347
dec dword [ebx + 8]
add esp, 8
cmp edi, dword [ebp - 0x14]
je 0x10099559
mov eax, dword [ebp + 0xc]
cmp esi, eax
jne 0x10099517
mov ecx, dword [ebp - 0xc]
cmp ecx, dword [ebp + 8]
jne 0x100995ec
mov edx, dword [ebp - 8]
mov ecx, dword [ebp - 4]
pop edi
mov dword [edx], esi
mov dword [ecx], esi
mov dword [esi + 4], ecx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
mov ecx, dword [ebp - 0xc]
mov edx, dword [ebp - 8]
cmp ecx, dword [ebp + 8]
jne 0x1009956d
mov eax, dword [ebp - 0x10]
mov ecx, eax
mov dword [edx], eax
jmp 0x10099570
mov ecx, dword [ebp - 4]
mov eax, dword [ebp + 0xc]
mov dword [edx + 4], ecx
cmp esi, eax
je 0x100995ec
nop word [eax + eax]
movzx eax, byte [esi + 8]
xor eax, 0x811c9dc5
imul ecx, eax, 0x1000193
movzx eax, byte [esi + 9]
xor ecx, eax
movzx eax, byte [esi + 0xa]
imul ecx, ecx, 0x1000193
xor ecx, eax
movzx eax, byte [esi + 0xb]
imul ecx, ecx, 0x1000193
xor ecx, eax
imul eax, ecx, 0x1000193
mov ecx, dword [ebx + 0x18]
and ecx, eax
mov eax, dword [ebp - 0x18]
lea eax, [eax + ecx*8]
mov dword [ebp + 8], eax
mov eax, dword [eax + 4]
mov dword [ebp - 0x14], eax
mov eax, esi
mov edi, esi
mov esi, dword [esi]
push 0xc
push eax
call fcn.100c0347
dec dword [ebx + 8]
add esp, 8
mov eax, dword [ebp + 0xc]
cmp edi, dword [ebp - 0x14]
je 0x100995fd
cmp esi, eax
jne 0x100995c7
mov ecx, dword [ebp + 8]
mov dword [ecx], esi
mov ecx, dword [ebp - 4]
pop edi
mov dword [ecx], esi
mov dword [esi + 4], ecx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
mov ecx, dword [ebp + 8]
mov edx, dword [ebp - 0x10]
mov dword [ecx], edx
mov dword [ecx + 4], edx
cmp esi, eax
jne 0x10099580
mov ecx, dword [ebp - 4]
pop edi
mov dword [ecx], esi
mov dword [esi + 4], ecx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8