joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100721a0
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov edx, dword [ebp + 8]
mov eax, 0x1fffffff
push ebx
mov ebx, ecx
bsr ecx, eax
push esi
push edi
mov edi, 1
mov dword [ebp - 0xc], ebx
mov eax, edi
shl eax, cl
cmp edx, eax
ja 0x10072303
mov esi, dword [ebx + 4]
lea eax, [edx - 1]
or eax, edi
mov dword [ebp - 4], esi
bsr ecx, eax
push esi
lea ecx, [ecx + 1]
shl edi, cl
lea ecx, [ebx + 0xc]
lea eax, [edi + edi]
push eax
call fcn.100720a0
mov ecx, dword [ebx + 4]
lea eax, [edi - 1]
mov dword [ebx + 0x18], eax
mov dword [ebx + 0x1c], edi
mov ecx, dword [ecx]
mov edx, ecx
cmp ecx, esi
je 0x100722d6
movzx eax, byte [ecx + 8]
xor eax, 0x811c9dc5
mov edx, dword [edx]
imul edi, eax, 0x1000193
movzx eax, byte [ecx + 9]
xor edi, eax
movzx eax, byte [ecx + 0xa]
imul edi, edi, 0x1000193
xor edi, eax
movzx eax, byte [ecx + 0xb]
imul edi, edi, 0x1000193
xor edi, eax
imul eax, edi, 0x1000193
mov edi, dword [ebx + 0x18]
and edi, eax
mov eax, dword [ebx + 0xc]
mov ebx, dword [eax + edi*8]
mov dword [ebp + 8], ebx
lea eax, [eax + edi*8]
mov dword [ebp - 8], eax
cmp ebx, esi
jne 0x10072256
mov dword [eax], ecx
mov dword [eax + 4], ecx
jmp 0x100722c9
mov eax, dword [eax + 4]
mov ebx, dword [ecx + 8]
cmp ebx, dword [eax + 8]
jne 0x10072290
mov eax, dword [eax]
mov dword [ebp + 8], eax
cmp eax, ecx
je 0x10072288
mov ebx, dword [ecx + 4]
mov esi, dword [ebp + 8]
mov dword [ebx], edx
mov edi, dword [edx + 4]
mov dword [edi], eax
mov eax, dword [eax + 4]
mov dword [eax], ecx
mov dword [esi + 4], edi
mov esi, dword [ebp - 4]
mov dword [edx + 4], ebx
mov dword [ecx + 4], eax
mov eax, dword [ebp - 8]
mov dword [eax + 4], ecx
jmp 0x100722c9
mov edi, eax
cmp dword [ebp + 8], eax
je 0x100722a6
mov eax, dword [eax + 4]
mov edi, eax
cmp ebx, dword [eax + 8]
je 0x100722df
cmp dword [ebp + 8], eax
jne 0x10072297
mov eax, dword [ecx + 4]
mov dword [ebp + 8], eax
mov dword [eax], edx
mov ebx, dword [edx + 4]
mov dword [ebx], edi
mov eax, dword [edi + 4]
mov dword [eax], ecx
mov dword [edi + 4], ebx
mov edi, dword [ebp + 8]
mov dword [edx + 4], edi
mov dword [ecx + 4], eax
mov eax, dword [ebp - 8]
mov dword [eax], ecx
mov ebx, dword [ebp - 0xc]
mov ecx, edx
cmp edx, esi
jne 0x10072202
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
mov ebx, dword [ecx + 4]
mov eax, dword [eax]
mov dword [ebp + 8], eax
mov esi, eax
mov dword [ebx], edx
mov edi, dword [edx + 4]
mov dword [edi], eax
mov eax, dword [eax + 4]
mov dword [eax], ecx
mov dword [esi + 4], edi
mov esi, dword [ebp - 4]
mov dword [edx + 4], ebx
mov dword [ecx + 4], eax
jmp 0x100722c9
push str.invalid_hash_bucket_count
call fcn.1006cb20
int3
Function at 0x100920c0
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
xor ecx, ecx
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
mov edi, dword [ebp + 0xc]
mov edx, dword [edi + 4]
mov esi, dword [edi + 8]
add esi, edx
cmp edx, esi
jae 0x100920ed
nop dword [eax]
movsx eax, byte [edx]
lea ecx, [ecx + ecx*4]
inc edx
add ecx, eax
cmp edx, esi
jb 0x100920e0
imul eax, dword [edi], 0x1000193
xor eax, ecx
mov ecx, ebx
push eax
push edi
lea eax, [ebp - 8]
push eax
call fcn.10093610
mov eax, dword [eax + 4]
test eax, eax
je 0x10092118
cmp eax, dword [ebx + 4]
je 0x10092118
mov eax, dword [eax + 0x14]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x10094570
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov ecx, dword [ebp + 0x10]
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, dword [ebp + 0xc]
lea eax, [ecx - 1]
mov dword [ebp - 8], eax
mov edx, esi
sar eax, 1
mov dword [ebp - 4], eax
push edi
mov edi, esi
mov dword [ebp + 0xc], edi
cmp esi, eax
jge 0x100945e1
nop dword [eax + eax]
lea edi, [edx + edx]
push dword [ebx + edi*8 + 0xc]
push dword [ebx + edi*8 + 8]
push dword [ebx + edi*8 + 0x14]
push dword [ebx + edi*8 + 0x10]
call fcn.100986c0
movzx edx, al
add esp, 0x10
xor edx, 1
inc edx
add edx, edi
mov eax, dword [ebx + edx*8]
mov ecx, dword [ebx + edx*8 + 4]
mov dword [ebx + esi*8], eax
mov eax, dword [ebp - 4]
mov dword [ebx + esi*8 + 4], ecx
mov esi, edx
cmp edx, eax
jl 0x100945a0
mov edi, dword [ebp + 0xc]
mov ecx, dword [ebp + 0x10]
cmp edx, eax
jne 0x100945fc
test cl, 1
jne 0x100945fc
mov eax, dword [ebx + ecx*8 - 8]
mov ecx, dword [ebx + ecx*8 - 4]
mov dword [ebx + esi*8], eax
mov dword [ebx + esi*8 + 4], ecx
mov esi, dword [ebp - 8]
cmp edi, esi
jge 0x10094635
mov eax, dword [ebp + 0x14]
lea edi, [esi - 1]
sar edi, 1
push dword [eax + 4]
push dword [eax]
push dword [ebx + edi*8 + 4]
push dword [ebx + edi*8]
call fcn.100986c0
add esp, 0x10
test al, al
je 0x10094635
mov eax, dword [ebx + edi*8]
mov ecx, dword [ebx + edi*8 + 4]
mov dword [ebx + esi*8], eax
mov dword [ebx + esi*8 + 4], ecx
mov esi, edi
cmp dword [ebp + 0xc], edi
jl 0x10094600
mov ecx, dword [ebp + 0x14]
pop edi
mov eax, dword [ecx]
mov ecx, dword [ecx + 4]
mov dword [ebx + esi*8], eax
mov dword [ebx + esi*8 + 4], ecx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10095120
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10123d35
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push ebx
push esi
push edi
mov eax, dword [0x1019a784]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov ecx, dword [ebp + 0xc]
xor edx, edx
mov esi, dword [ecx + 4]
mov edi, dword [ecx + 8]
add edi, esi
cmp esi, edi
jae 0x1009516d
nop dword [eax + eax]
movsx eax, byte [esi]
lea edx, [edx + edx*4]
inc esi
add edx, eax
cmp esi, edi
jb 0x10095160
imul eax, dword [ecx], 0x1000193
xor eax, edx
push eax
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x18]
push ecx
push eax
mov ecx, ebx
call fcn.10093610
mov ecx, dword [ebp - 0x14]
test ecx, ecx
je 0x100951a9
mov eax, dword [ebp + 8]
mov dword [eax], ecx
mov byte [eax + 4], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
cmp dword [ebx + 8], 0xaaaaaaa
je 0x10095313
lea eax, [ebx + 4]
mov dword [ebp - 0x20], eax
push 0x18
mov dword [ebp - 4], 0
mov dword [ebp - 0x1c], 0
call fcn.1006dff1
mov ecx, dword [ebp + 0xc]
mov esi, eax
add esp, 4
mov dword [ebp - 0x1c], esi
movq xmm0, qword [ecx]
movq qword [esi + 8], xmm0
mov ecx, dword [ecx + 8]
mov dword [esi + 0x10], ecx
mov dword [esi + 0x14], 0
mov eax, dword [ebx + 8]
mov edi, dword [ebx + 0x1c]
inc eax
movss xmm3, dword [ebx]
mov dword [ebp - 4], 1
movd xmm0, eax
cvtdq2pd xmm0, xmm0
shr eax, 0x1f
addsd xmm0, qword [eax*8 + 0x1014ce70]
mov eax, edi
shr eax, 0x1f
cvtpd2ps xmm2, xmm0
movd xmm0, edi
cvtdq2pd xmm0, xmm0
movaps xmm1, xmm2
addsd xmm0, qword [eax*8 + 0x1014ce70]
cvtpd2ps xmm0, xmm0
divss xmm1, xmm0
comiss xmm1, xmm3
jbe 0x100952ae
divss xmm2, xmm3
sub esp, 8
cvtps2pd xmm0, xmm2
movsd qword [ebp - 0x18], xmm0
fld qword [ebp - 0x18]
fstp qword [esp]
call fcn.10108a40
fstp qword [ebp - 0x18]
movsd xmm0, qword [ebp - 0x18]
add esp, 8
cvtpd2ps xmm0, xmm0
call fcn.1006e980
mov ecx, 8
cmp eax, ecx
cmova ecx, eax
cmp edi, ecx
jae 0x1009528f
cmp edi, 0x200
jae 0x1009528d
shl edi, 3
cmp edi, ecx
jae 0x1009528f
mov edi, ecx
push edi
mov ecx, ebx
call fcn.100bb070
mov edi, dword [ebp - 0x10]
lea eax, [esi + 8]
push edi
push eax
lea eax, [ebp - 0x20]
mov ecx, ebx
push eax
call fcn.10093610
mov edx, dword [eax]
jmp 0x100952b4
mov edx, dword [ebp - 0x18]
mov edi, dword [ebp - 0x10]
mov eax, dword [ebx + 8]
mov ecx, dword [edx + 4]
inc eax
mov dword [ebx + 8], eax
mov dword [esi], edx
mov dword [esi + 4], ecx
mov dword [ecx], esi
mov dword [edx + 4], esi
mov eax, dword [ebx + 0x18]
mov dword [ebp + 0xc], ecx
and eax, edi
mov ecx, dword [ebx + 0xc]
mov edi, dword [ecx + eax*8]
cmp edi, dword [ebx + 4]
jne 0x100952e0
mov dword [ecx + eax*8], esi
jmp 0x100952f2
cmp edi, edx
jne 0x100952e9
mov dword [ecx + eax*8], esi
jmp 0x100952f6
mov edx, dword [ebp + 0xc]
cmp dword [ecx + eax*8 + 4], edx
jne 0x100952f6
mov dword [ecx + eax*8 + 4], esi
mov eax, dword [ebp + 8]
mov dword [eax], esi
mov byte [eax + 4], 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
push str.unordered_map_set_too_long
call fcn.1006cb20
int3
Function at 0x100956a0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov edx, dword [ebp + 8]
mov eax, ecx
push ebx
push esi
push edi
cmp dword [edx + 0x14], 0x10
mov edi, edx
mov dword [ebp - 4], eax
jb 0x100956bb
mov edi, dword [edx]
mov ebx, dword [edx + 0x10]
xor ecx, ecx
mov esi, 0x811c9dc5
test ebx, ebx
je 0x100956e4
nop dword [eax]
movzx eax, byte [ecx + edi]
inc ecx
xor eax, esi
imul esi, eax, 0x1000193
cmp ecx, ebx
jb 0x100956d0
mov eax, dword [ebp - 4]
push esi
push edx
lea ecx, [ebp - 8]
push ecx
mov ecx, eax
call fcn.100936a0
xor ecx, ecx
pop edi
pop esi
cmp dword [eax + 4], ecx
pop ebx
setne cl
mov eax, ecx
mov esp, ebp
pop ebp
ret 4
Function at 0x10095b40
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10123df5
mov eax, dword fs:[0]
push eax
sub esp, 0x20
push ebx
push esi
push edi
mov eax, dword [0x1019a784]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov ecx, dword [ebp + 0xc]
lea eax, [ebp - 0x2c]
push eax
call fcn.100bd160
mov ebx, eax
xor ecx, ecx
mov edx, dword [ebx + 4]
mov esi, dword [ebx + 8]
add esi, edx
cmp edx, esi
jae 0x10095b93
movsx eax, byte [edx]
lea ecx, [ecx + ecx*4]
inc edx
add ecx, eax
cmp edx, esi
jb 0x10095b86
imul eax, dword [ebx], 0x1000193
mov ebx, dword [ebp + 0xc]
xor eax, ecx
mov ecx, edi
push eax
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x18]
push ebx
push eax
call fcn.10093930
mov ecx, dword [ebp - 0x14]
test ecx, ecx
je 0x10095bd2
mov eax, dword [ebp + 8]
mov dword [eax], ecx
mov byte [eax + 4], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
cmp dword [edi + 8], 0x15555555
je 0x10095d2a
lea eax, [edi + 4]
mov dword [ebp - 0x20], eax
push 0xc
mov dword [ebp - 4], 0
mov dword [ebp - 0x1c], 0
call fcn.1006dff1
mov ecx, dword [ebx]
mov esi, eax
add esp, 4
mov dword [ebp - 0x1c], esi
mov dword [esi + 8], ecx
mov eax, dword [edi + 8]
mov ebx, dword [edi + 0x1c]
inc eax
movss xmm3, dword [edi]
mov dword [ebp - 4], 1
movd xmm0, eax
cvtdq2pd xmm0, xmm0
shr eax, 0x1f
addsd xmm0, qword [eax*8 + 0x1014ce70]
mov eax, ebx
shr eax, 0x1f
cvtpd2ps xmm2, xmm0
movd xmm0, ebx
cvtdq2pd xmm0, xmm0
movaps xmm1, xmm2
addsd xmm0, qword [eax*8 + 0x1014ce70]
cvtpd2ps xmm0, xmm0
divss xmm1, xmm0
comiss xmm1, xmm3
jbe 0x10095cc3
divss xmm2, xmm3
sub esp, 8
cvtps2pd xmm0, xmm2
movsd qword [ebp - 0x18], xmm0
fld qword [ebp - 0x18]
fstp qword [esp]
call fcn.10108a40
fstp qword [ebp - 0x18]
movsd xmm0, qword [ebp - 0x18]
add esp, 8
cvtpd2ps xmm0, xmm0
call fcn.1006e980
mov ecx, 8
cmp eax, ecx
cmova ecx, eax
cmp ebx, ecx
jae 0x10095ca4
cmp ebx, 0x200
jae 0x10095ca2
shl ebx, 3
cmp ebx, ecx
jae 0x10095ca4
mov ebx, ecx
push ebx
mov ecx, edi
call fcn.100bbb40
mov ebx, dword [ebp - 0x10]
lea eax, [esi + 8]
push ebx
push eax
lea eax, [ebp - 0x18]
mov ecx, edi
push eax
call fcn.10093930
mov edx, dword [eax]
jmp 0x10095cc9
mov edx, dword [ebp - 0x18]
mov ebx, dword [ebp - 0x10]
mov eax, dword [edi + 8]
mov ecx, dword [edx + 4]
inc eax
mov dword [edi + 8], eax
mov dword [esi], edx
mov dword [esi + 4], ecx
mov dword [ecx], esi
mov dword [edx + 4], esi
mov eax, dword [edi + 0x18]
and eax, ebx
mov dword [ebp + 0xc], ecx
mov ecx, dword [edi + 0xc]
mov ebx, dword [ebp - 0x20]
mov edi, dword [ecx + eax*8]
cmp edi, dword [ebx]
jne 0x10095cf7
mov dword [ecx + eax*8], esi
jmp 0x10095d09
cmp edi, edx
jne 0x10095d00
mov dword [ecx + eax*8], esi
jmp 0x10095d0d
mov edx, dword [ebp + 0xc]
cmp dword [ecx + eax*8 + 4], edx
jne 0x10095d0d
mov dword [ecx + eax*8 + 4], esi
mov eax, dword [ebp + 8]
mov dword [eax], esi
mov byte [eax + 4], 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
push str.unordered_map_set_too_long
call fcn.1006cb20
int3
Function at 0x10095d40
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10123db5
mov eax, dword fs:[0]
push eax
sub esp, 0x18
push ebx
push esi
push edi
mov eax, dword [0x1019a784]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov ebx, dword [ebp + 0xc]
lea eax, [ebp - 0x24]
push eax
mov ecx, ebx
call fcn.100bd3d0
imul ecx, dword [eax + 4], 0x1000193
imul eax, dword [eax], 0x100011b
xor ecx, eax
lea eax, [ebp - 0x14]
push ecx
push ebx
mov dword [ebp + 0xc], ecx
mov ecx, edi
push eax
call fcn.100937d0
mov ecx, dword [ebp - 0x10]
test ecx, ecx
je 0x10095dbb
mov eax, dword [ebp + 8]
mov dword [eax], ecx
mov byte [eax + 4], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
cmp dword [edi + 8], 0x15555555
je 0x10095f13
lea eax, [edi + 4]
mov dword [ebp - 0x1c], eax
push 0xc
mov dword [ebp - 4], 0
mov dword [ebp - 0x18], 0
call fcn.1006dff1
mov ecx, dword [ebx]
mov esi, eax
add esp, 4
mov dword [ebp - 0x18], esi
mov dword [esi + 8], ecx
mov ecx, dword [edi + 8]
mov ebx, dword [edi + 0x1c]
inc ecx
mov eax, ebx
movss xmm3, dword [edi]
shr eax, 0x1f
mov dword [ebp - 4], 1
movd xmm0, ecx
cvtdq2pd xmm0, xmm0
shr ecx, 0x1f
addsd xmm0, qword [ecx*8 + 0x1014ce70]
cvtpd2ps xmm2, xmm0
movd xmm0, ebx
cvtdq2pd xmm0, xmm0
movaps xmm1, xmm2
addsd xmm0, qword [eax*8 + 0x1014ce70]
cvtpd2ps xmm0, xmm0
divss xmm1, xmm0
comiss xmm1, xmm3
jbe 0x10095eac
divss xmm2, xmm3
sub esp, 8
cvtps2pd xmm0, xmm2
movsd qword [ebp - 0x14], xmm0
fld qword [ebp - 0x14]
fstp qword [esp]
call fcn.10108a40
fstp qword [ebp - 0x14]
movsd xmm0, qword [ebp - 0x14]
add esp, 8
cvtpd2ps xmm0, xmm0
call fcn.1006e980
mov ecx, 8
cmp eax, ecx
cmova ecx, eax
cmp ebx, ecx
jae 0x10095e8d
cmp ebx, 0x200
jae 0x10095e8b
shl ebx, 3
cmp ebx, ecx
jae 0x10095e8d
mov ebx, ecx
push ebx
mov ecx, edi
call fcn.100bb760
mov ebx, dword [ebp + 0xc]
lea eax, [esi + 8]
push ebx
push eax
lea eax, [ebp - 0x14]
mov ecx, edi
push eax
call fcn.100937d0
mov edx, dword [eax]
jmp 0x10095eb2
mov edx, dword [ebp - 0x14]
mov ebx, dword [ebp + 0xc]
mov eax, dword [edi + 8]
mov ecx, dword [edx + 4]
inc eax
mov dword [edi + 8], eax
mov dword [esi], edx
mov dword [esi + 4], ecx
mov dword [ecx], esi
mov dword [edx + 4], esi
mov eax, dword [edi + 0x18]
and eax, ebx
mov dword [ebp + 0xc], ecx
mov ecx, dword [edi + 0xc]
mov ebx, dword [ebp - 0x1c]
mov edi, dword [ecx + eax*8]
cmp edi, dword [ebx]
jne 0x10095ee0
mov dword [ecx + eax*8], esi
jmp 0x10095ef2
cmp edi, edx
jne 0x10095ee9
mov dword [ecx + eax*8], esi
jmp 0x10095ef6
mov edx, dword [ebp + 0xc]
cmp dword [ecx + eax*8 + 4], edx
jne 0x10095ef6
mov dword [ecx + eax*8 + 4], esi
mov eax, dword [ebp + 8]
mov dword [eax], esi
mov byte [eax + 4], 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
push str.unordered_map_set_too_long
call fcn.1006cb20
int3
Function at 0x10096770
Capabilities:
Access peb ldr_data
Get number of processors
Get process heap flags
Get process heap force flags

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10123fad
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x1019a784]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x10], edi
mov eax, dword [ebp + 8]
mov dword [edi], eax
mov eax, dword [ebp + 0xc]
mov dword [edi + 4], eax
mov eax, dword [ebp + 0x10]
mov dword [edi + 8], eax
mov dword [edi + 0xc], 0
mov dword [edi + 0x10], 0
mov dword [edi + 0x14], 0
mov byte [edi + 0x18], 0
mov dword [edi + 0x1c], 0
mov dword [ebp - 4], 0
mov dword [edi + 0x2c], 0
mov dword [edi + 0x30], 0xf
mov byte [edi + 0x1c], 0
lea esi, [edi + 0x3c]
mov byte [ebp - 4], 1
mov dword [ebp + 8], esi
push 0x14
mov dword [esi], 0
mov dword [esi + 4], 0
call fcn.1006dff1
mov dword [eax], eax
mov dword [eax + 4], eax
mov dword [eax + 8], eax
mov word [eax + 0xc], 0x101
mov dword [esi], eax
lea esi, [edi + 0x44]
mov byte [ebp - 4], 2
mov dword [ebp + 8], esi
mov dword [esi], 0
push 0x18
mov dword [esi + 4], 0
mov dword [esi + 8], 0
call fcn.1006dff1
add esp, 8
mov dword [eax], eax
mov dword [eax + 4], eax
mov dword [esi + 4], eax
lea ecx, [esi + 0xc]
mov dword [ecx], 0
mov dword [ecx + 4], 0
mov dword [ecx + 8], 0
push dword [esi + 4]
mov byte [ebp - 4], 4
push 0x10
mov dword [esi + 0x18], 7
mov dword [esi + 0x1c], 8
mov dword [esi], 0x3f800000
call fcn.100720a0
lea esi, [edi + 0x64]
mov byte [ebp - 4], 5
mov dword [ebp + 8], esi
push 0x14
mov dword [esi], 0
mov dword [esi + 4], 0
call fcn.1006dff1
add esp, 4
mov dword [eax], eax
mov dword [eax + 4], eax
mov dword [eax + 8], eax
mov word [eax + 0xc], 0x101
mov dword [esi], eax
mov dword [edi + 0x6c], 0
mov dword [edi + 0x70], 0
mov dword [edi + 0x80], 0
mov dword [edi + 0x84], 0xf
mov byte [edi + 0x70], 0
mov dword [edi + 0x88], 0
mov dword [edi + 0x9c], 0xf
mov dword [edi + 0x98], 0
mov byte [edi + 0x88], 0
mov dword [edi + 0xa0], 0x20
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 0xc
Function at 0x10096920
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1012402a
mov eax, dword fs:[0]
push eax
sub esp, 8
push esi
push edi
mov eax, dword [0x1019a784]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x10], edi
mov dword [edi], 0
push 0xc
mov dword [ebp - 0x14], edi
mov dword [edi + 4], 0
mov dword [edi + 8], 0
call fcn.1006dff1
add esp, 4
mov dword [eax], eax
mov dword [eax + 4], eax
mov dword [edi + 4], eax
lea ecx, [edi + 0xc]
mov dword [ebp - 4], 0
mov dword [ecx], 0
mov dword [ecx + 4], 0
mov dword [ecx + 8], 0
push dword [edi + 4]
mov byte [ebp - 4], 1
push 0x10
mov dword [edi + 0x18], 7
mov dword [edi + 0x1c], 8
mov dword [edi], 0x3f800000
call fcn.100720a0
mov dword [edi + 0x20], 0
lea ecx, [edi + 0x30]
mov dword [edi + 0x24], 0
mov dword [edi + 0x28], 0
mov dword [ebp - 4], 2
mov dword [edi + 0x2c], 0
call fcn.10096620
lea ecx, [edi + 0x50]
mov byte [ebp - 4], 3
call fcn.10096620
lea ecx, [edi + 0x70]
mov byte [ebp - 4], 4
call fcn.10096620
lea esi, [edi + 0x94]
mov dword [edi + 0x90], 0
mov dword [ebp - 0x14], esi
mov dword [esi], 0
push 0x24
mov byte [ebp - 4], 5
mov dword [esi + 4], 0
mov dword [esi + 8], 0
call fcn.1006dff1
add esp, 4
mov dword [eax], eax
mov dword [eax + 4], eax
mov dword [esi + 4], eax
lea ecx, [esi + 0xc]
mov dword [ecx], 0
mov dword [ecx + 4], 0
mov dword [ecx + 8], 0
push dword [esi + 4]
mov byte [ebp - 4], 7
push 0x10
mov dword [esi + 0x18], 7
mov dword [esi + 0x1c], 8
mov dword [esi], 0x3f800000
call fcn.100720a0
push 0x30
lea eax, [edi + 0xb8]
mov dword [edi + 0xb4], 0
push 0
push eax
call fcn.100f5810
add esp, 0xc
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x100acb50
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [ebp + 8]
push ebx
push esi
mov esi, dword [ebp + 0xc]
mov ebx, dword [eax + 0x18]
push edi
mov dword [ebp - 4], ecx
mov edi, dword [ebx + 4]
cmp edi, esi
jg 0x100acba0
movsx eax, word [eax + 2]
cdq
mov dword [ebp + 0xc], eax
mov ecx, edx
mov eax, edi
cdq
add dword [ebp + 0xc], eax
mov eax, esi
adc ecx, edx
cdq
cmp edx, ecx
jg 0x100acb9d
jl 0x100acb8c
cmp eax, dword [ebp + 0xc]
ja 0x100acb9d
sub esi, edi
pop edi
lea eax, [esi + esi*4]
pop esi
lea eax, [ebx + eax*4]
pop ebx
mov esp, ebp
pop ebp
ret 8
mov eax, dword [ebp + 8]
mov dword [ebp - 0x18], eax
lea ecx, [ebp + 8]
lea eax, [ebp - 0x24]
mov dword [ebp - 0x14], esi
mov esi, dword [ebp - 4]
mov dword [ebp + 8], eax
lea eax, [ebp - 8]
push eax
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x1c], 0
mov byte [ebp - 0x24], 0xb
call fcn.100bd3d0
imul ecx, dword [eax + 4], 0x1000193
imul eax, dword [eax], 0x100011b
xor ecx, eax
lea eax, [ebp + 8]
push ecx
push eax
lea eax, [ebp - 0x10]
push eax
lea ecx, [esi + 0x50]
call fcn.100937d0
mov eax, dword [eax + 4]
test eax, eax
jne 0x100acbf7
mov eax, dword [esi + 0x54]
cmp eax, dword [esi + 0x54]
je 0x100acc15
mov eax, dword [eax + 8]
mov cl, byte [eax]
cmp cl, 5
je 0x100acc17
cmp cl, 6
jne 0x100acc15
pop edi
pop esi
dec eax
pop ebx
mov esp, ebp
pop ebp
ret 8
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x100ad700
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 0xc]
sub esp, 0x24
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, ecx
test esi, esi
je 0x100ad737
cmp edx, 1
jl 0x100ad737
movzx eax, word [esi + 2]
cmp edx, eax
jg 0x100ad737
mov eax, dword [esi + 0x18]
lea ecx, [edx + edx*2]
shl ecx, 4
add eax, 0xffffffd0
pop edi
add eax, ecx
pop esi
mov esp, ebp
pop ebp
ret 8
lea eax, [ebp - 0x24]
mov dword [ebp - 0x20], 0
mov dword [ebp + 8], eax
lea ecx, [ebp + 8]
lea eax, [ebp - 8]
mov dword [ebp - 0x1c], 0
push eax
mov dword [ebp - 0x18], esi
mov dword [ebp - 0x14], edx
mov byte [ebp - 0x24], 0xb
call fcn.100bd3d0
imul ecx, dword [eax + 4], 0x1000193
imul eax, dword [eax], 0x100011b
xor ecx, eax
lea eax, [ebp + 8]
push ecx
push eax
lea eax, [ebp - 0x10]
push eax
lea ecx, [edi + 0x30]
call fcn.100937d0
mov eax, dword [eax + 4]
test eax, eax
jne 0x100ad78b
mov eax, dword [edi + 0x34]
cmp eax, dword [edi + 0x34]
jne 0x100ad79a
pop edi
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret 8
mov eax, dword [eax + 8]
xor ecx, ecx
pop edi
pop esi
cmp byte [eax], 2
cmovne eax, ecx
mov esp, ebp
pop ebp
ret 8

Function at 0x100ad9d0
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [ebp + 0x10]
mov edx, dword [ebp + 0x14]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp + 0xc]
push ebx
mov dword [ebp - 0x1c], eax
lea eax, [ebp - 0x28]
push esi
push edi
mov dword [ebp + 0xc], eax
mov edi, ecx
lea eax, [ebp - 0x14]
mov dword [ebp - 0x20], edx
push eax
lea ecx, [ebp + 0xc]
mov byte [ebp - 0x28], 0xb
call fcn.100bd160
mov ebx, eax
xor ecx, ecx
mov edx, dword [ebx + 4]
mov esi, dword [ebx + 8]
add esi, edx
cmp edx, esi
jae 0x100ada20
movsx eax, byte [edx]
lea ecx, [ecx + ecx*4]
inc edx
add ecx, eax
cmp edx, esi
jb 0x100ada13
imul eax, dword [ebx], 0x1000193
xor eax, ecx
mov ecx, edi
push eax
lea eax, [ebp + 0xc]
push eax
lea eax, [ebp - 8]
push eax
call fcn.10093930
mov ecx, dword [eax + 4]
test ecx, ecx
je 0x100ada55
cmp ecx, dword [edi + 4]
je 0x100ada55
mov eax, dword [ebp + 8]
mov ecx, dword [ecx + 8]
pop edi
pop esi
mov dword [eax], ecx
pop ebx
mov esp, ebp
pop ebp
ret 0x10
mov eax, dword [ebp + 8]
pop edi
pop esi
pop ebx
mov dword [eax], 0x101374ac
mov esp, ebp
pop ebp
ret 0x10