joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100d0690
Capabilities:
Hash data using fnv

Disassembly:
sub esp, 0x18
push ebx
mov ebx, dword [esp + 0x20]
mov edx, ecx
push ebp
mov ebp, dword [esp + 0x28]
mov dword [esp + 0xc], edx
cmp ebx, ebp
je 0x100d083d
mov eax, dword [edx + 4]
mov dword [esp + 0x10], eax
mov eax, dword [ebx + 4]
mov dword [esp + 0x14], eax
movzx eax, byte [ebx + 8]
xor eax, 0x811c9dc5
imul ecx, eax, 0x1000193
movzx eax, byte [ebx + 9]
push esi
push edi
mov edi, dword [edx + 0xc]
mov esi, ebx
xor ecx, eax
mov dword [esp + 0x24], edi
movzx eax, byte [ebx + 0xa]
imul ecx, ecx, 0x1000193
xor ecx, eax
movzx eax, byte [ebx + 0xb]
imul ecx, ecx, 0x1000193
xor ecx, eax
mov eax, dword [edx + 0x18]
imul ecx, ecx, 0x1000193
and eax, ecx
mov ecx, dword [edi + eax*8]
mov dword [esp + 0x10], ecx
lea eax, [edi + eax*8]
mov dword [esp + 0x30], eax
mov eax, dword [eax + 4]
mov dword [esp + 0x20], eax
mov edi, esi
mov ebx, esi
mov esi, dword [esi]
lea ecx, [edi + 0x1c]
call fcn.10002cd0
mov edx, dword [edi + 0x14]
call fcn.100d1030
push 0x24
push dword [edi + 0x14]
call fcn.1011808f
push 0x30
push edi
call fcn.1011808f
mov edx, dword [esp + 0x24]
add esp, 0x10
dec dword [edx + 8]
cmp ebx, dword [esp + 0x20]
je 0x100d0776
cmp esi, ebp
jne 0x100d0711
mov eax, dword [esp + 0x10]
cmp eax, dword [esp + 0x2c]
jne 0x100d0832
mov eax, dword [esp + 0x1c]
mov ecx, dword [esp + 0x30]
pop edi
mov dword [ecx], esi
mov dword [eax], esi
mov dword [esi + 4], eax
mov eax, ebp
pop esi
pop ebp
pop ebx
add esp, 0x18
ret 8
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x30]
cmp eax, dword [esp + 0x2c]
jne 0x100d078c
mov eax, dword [esp + 0x18]
mov dword [ecx], eax
jmp 0x100d0790
mov eax, dword [esp + 0x1c]
mov dword [ecx + 4], eax
cmp esi, ebp
je 0x100d0832
nop dword [eax + eax]
movzx eax, byte [esi + 8]
xor eax, 0x811c9dc5
imul ecx, eax, 0x1000193
movzx eax, byte [esi + 9]
xor ecx, eax
movzx eax, byte [esi + 0xa]
imul ecx, ecx, 0x1000193
xor ecx, eax
movzx eax, byte [esi + 0xb]
imul ecx, ecx, 0x1000193
xor ecx, eax
mov eax, dword [edx + 0x18]
imul ecx, ecx, 0x1000193
and eax, ecx
mov ecx, dword [esp + 0x24]
lea eax, [ecx + eax*8]
mov dword [esp + 0x2c], eax
mov eax, dword [eax + 4]
mov dword [esp + 0x30], eax
nop word [eax + eax]
mov edi, esi
mov ebx, esi
mov esi, dword [esi]
lea ecx, [edi + 0x1c]
call fcn.10002cd0
mov edx, dword [edi + 0x14]
call fcn.100d1030
push 0x24
push dword [edi + 0x14]
call fcn.1011808f
push 0x30
push edi
call fcn.1011808f
mov edx, dword [esp + 0x24]
add esp, 0x10
dec dword [edx + 8]
cmp ebx, dword [esp + 0x30]
je 0x100d0847
cmp esi, ebp
jne 0x100d07f0
mov eax, dword [esp + 0x2c]
mov dword [eax], esi
mov eax, dword [esp + 0x1c]
pop edi
mov dword [eax], esi
mov dword [esi + 4], eax
pop esi
mov eax, ebp
pop ebp
pop ebx
add esp, 0x18
ret 8
mov eax, dword [esp + 0x2c]
mov ebx, dword [esp + 0x18]
mov dword [eax], ebx
mov dword [eax + 4], ebx
cmp esi, ebp
jne 0x100d07a0
mov eax, dword [esp + 0x1c]
pop edi
mov dword [eax], esi
mov dword [esi + 4], eax
mov eax, ebp
pop esi
pop ebp
pop ebx
add esp, 0x18
ret 8
Function at 0x100d0880
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
sub esp, 0x18
push ebx
mov ebx, dword [esp + 0x20]
push ebp
mov ebp, dword [esp + 0x28]
push edi
mov edi, ecx
cmp ebx, ebp
je 0x100d0a36
cmp dword [ebx + 0x1c], 0xf
lea edx, [ebx + 8]
mov eax, dword [edi + 4]
mov dword [esp + 0x18], eax
mov eax, dword [edi + 0xc]
mov dword [esp + 0x14], eax
mov eax, dword [ebx + 4]
mov dword [esp + 0x1c], eax
mov eax, dword [edx + 0x10]
jbe 0x100d08bb
mov edx, dword [edx]
xor ecx, ecx
push esi
mov esi, 0x811c9dc5
test eax, eax
je 0x100d08e5
mov ebp, eax
nop dword [eax]
movzx eax, byte [edx + ecx]
inc ecx
xor eax, esi
imul esi, eax, 0x1000193
cmp ecx, ebp
jb 0x100d08d0
mov ebp, dword [esp + 0x30]
mov eax, dword [edi + 0x18]
mov edx, ebx
mov ecx, dword [esp + 0x18]
and eax, esi
mov esi, dword [ebx]
lea eax, [ecx + eax*8]
mov ecx, dword [eax]
mov dword [esp + 0x2c], eax
mov eax, dword [eax + 4]
mov dword [esp + 0x14], ecx
mov dword [esp + 0x10], eax
call fcn.100d10a0
dec dword [edi + 8]
cmp ebx, dword [esp + 0x10]
je 0x100d0932
mov dword [esp + 0x24], esi
cmp esi, ebp
je 0x100d0944
mov edx, esi
mov esi, dword [esi]
call fcn.100d10a0
dec dword [edi + 8]
mov eax, dword [esp + 0x10]
cmp dword [esp + 0x24], eax
jne 0x100d0914
mov ecx, dword [esp + 0x2c]
cmp dword [esp + 0x14], ebx
jne 0x100d0969
mov eax, dword [esp + 0x1c]
mov dword [ecx], eax
jmp 0x100d096d
cmp dword [esp + 0x14], ebx
jne 0x100d0a2c
mov eax, dword [esp + 0x20]
mov ecx, dword [esp + 0x2c]
mov dword [ecx], esi
mov dword [eax], esi
mov dword [esi + 4], eax
mov eax, ebp
pop esi
pop edi
pop ebp
pop ebx
add esp, 0x18
ret 8
mov eax, dword [esp + 0x20]
mov dword [ecx + 4], eax
cmp esi, ebp
je 0x100d0a2c
nop dword [eax + eax]
cmp dword [esi + 0x1c], 0xf
lea edx, [esi + 8]
mov eax, dword [edx + 0x10]
mov dword [esp + 0x24], esi
mov dword [esp + 0x2c], eax
jbe 0x100d0996
mov edx, dword [edx]
xor ecx, ecx
mov ebx, 0x811c9dc5
test eax, eax
je 0x100d09ba
mov ebp, dword [esp + 0x2c]
movzx eax, byte [ecx + edx]
inc ecx
xor eax, ebx
imul ebx, eax, 0x1000193
cmp ecx, ebp
jb 0x100d09a5
mov ebp, dword [esp + 0x30]
mov eax, dword [edi + 0x18]
mov edx, esi
mov ecx, dword [esp + 0x18]
and eax, ebx
mov ebx, dword [ecx + eax*8 + 4]
mov esi, dword [esi]
mov dword [esp + 0x14], ebx
lea eax, [ecx + eax*8]
mov dword [esp + 0x2c], eax
call fcn.100d10a0
dec dword [edi + 8]
cmp dword [esp + 0x24], ebx
je 0x100d09fc
mov ebx, esi
cmp esi, ebp
je 0x100d0a26
mov edx, esi
mov esi, dword [esi]
call fcn.100d10a0
dec dword [edi + 8]
cmp ebx, dword [esp + 0x14]
jne 0x100d09e4
mov eax, dword [esp + 0x2c]
mov ebx, dword [esp + 0x1c]
mov dword [eax], ebx
mov dword [eax + 4], ebx
cmp esi, ebp
jne 0x100d0980
mov eax, dword [esp + 0x20]
mov dword [eax], esi
mov dword [esi + 4], eax
mov eax, ebp
pop esi
pop edi
pop ebp
pop ebx
add esp, 0x18
ret 8
mov eax, dword [esp + 0x2c]
mov dword [eax], esi
mov eax, dword [esp + 0x20]
mov dword [eax], esi
mov dword [esi + 4], eax
pop esi
pop edi
mov eax, ebp
pop ebp
pop ebx
add esp, 0x18
ret 8
Function at 0x100d0b30
Capabilities:
Hash data using fnv

Disassembly:
sub esp, 0xc
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0x24]
movzx eax, byte [edi]
xor eax, 0x811c9dc5
imul ecx, eax, 0x1000193
movzx eax, byte [edi + 1]
xor ecx, eax
movzx eax, byte [edi + 2]
imul ecx, ecx, 0x1000193
xor ecx, eax
movzx eax, byte [edi + 3]
imul ecx, ecx, 0x1000193
xor ecx, eax
lea eax, [esp + 0x10]
imul ebx, ecx, 0x1000193
push ebx
push edi
push eax
call fcn.100d1740
mov ecx, dword [esp + 0x14]
test ecx, ecx
je 0x100d0b95
mov eax, dword [esp + 0x20]
mov dword [eax], ecx
mov byte [eax + 4], 0
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret 8
cmp dword [0x1027eb64], 0x5555555
je 0x100d0cfc
push 0x30
call fcn.101180ab
mov ecx, dword [edi]
mov esi, eax
lea ebp, [esi + 8]
xorps xmm0, xmm0
mov dword [ebp], ecx
add esp, 4
movups xmmword [ebp + 4], xmm0
lea ecx, [ebp + 8]
movups xmmword [ebp + 0x14], xmm0
mov dword [ebp + 0x24], 0
call fcn.100d05c0
mov ecx, dword [0x1027eb64]
mov edi, dword [0x1027eb78]
lea eax, [ecx + 1]
movd xmm0, eax
cvtdq2pd xmm0, xmm0
shr eax, 0x1f
addsd xmm0, qword [eax*8 + 0x10184e90]
mov eax, edi
shr eax, 0x1f
cvtpd2ps xmm2, xmm0
movd xmm0, edi
cvtdq2pd xmm0, xmm0
movaps xmm1, xmm2
addsd xmm0, qword [eax*8 + 0x10184e90]
cvtpd2ps xmm0, xmm0
divss xmm1, xmm0
movss xmm0, dword [0x1027eb5c]
comiss xmm1, xmm0
jbe 0x100d0c8e
divss xmm2, xmm0
sub esp, 8
movss dword [esp + 0x2c], xmm2
fld dword [esp + 0x2c]
fstp qword [esp]
call fcn.10132d80
add esp, 8
fstp dword [esp + 0x24]
movss xmm0, dword [esp + 0x24]
call fcn.10148630
mov ecx, 8
cmp eax, ecx
cmova ecx, eax
cmp edi, ecx
jae 0x100d0c72
cmp edi, 0x200
jae 0x100d0c70
shl edi, 3
cmp edi, ecx
jae 0x100d0c72
mov edi, ecx
push edi
call fcn.100d1100
push ebx
push ebp
lea eax, [esp + 0x18]
push eax
call fcn.100d1740
mov ecx, dword [0x1027eb64]
mov edx, dword [eax]
jmp 0x100d0c92
mov edx, dword [esp + 0x10]
mov edi, dword [edx + 4]
inc ecx
mov dword [0x1027eb64], ecx
mov dword [esi], edx
mov dword [esi + 4], edi
mov dword [edi], esi
mov dword [edx + 4], esi
mov eax, dword [0x1027eb74]
mov ecx, dword [0x1027eb68]
and eax, ebx
mov ebx, dword [ecx + eax*8]
cmp ebx, dword [0x1027eb60]
jne 0x100d0cc3
mov dword [ecx + eax*8], esi
jmp 0x100d0ce4
cmp ebx, edx
jne 0x100d0cde
mov dword [ecx + eax*8], esi
mov eax, dword [esp + 0x20]
mov dword [eax], esi
mov byte [eax + 4], 1
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret 8
cmp dword [ecx + eax*8 + 4], edi
jne 0x100d0ce8
mov dword [ecx + eax*8 + 4], esi
mov eax, dword [esp + 0x20]
pop edi
mov dword [eax], esi
pop esi
pop ebp
mov byte [eax + 4], 1
pop ebx
add esp, 0xc
ret 8
push str.unordered_map_set_too_long
call fcn.101193d3
int3
Function at 0x100d0d10
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
sub esp, 0xc
push ebx
push ebp
mov ebp, dword [esp + 0x1c]
mov ebx, ecx
push esi
push edi
mov edx, ebp
cmp dword [ebp + 0x14], 0xf
mov edi, dword [ebp + 0x10]
jbe 0x100d0d2b
mov edx, dword [ebp]
xor ecx, ecx
mov esi, 0x811c9dc5
test edi, edi
je 0x100d0d47
movzx eax, byte [edx + ecx]
inc ecx
xor eax, esi
imul esi, eax, 0x1000193
cmp ecx, edi
jb 0x100d0d36
push esi
push ebp
lea eax, [esp + 0x18]
mov ecx, ebx
push eax
call fcn.10027470
mov ecx, dword [esp + 0x14]
test ecx, ecx
je 0x100d0d71
mov eax, dword [esp + 0x20]
mov dword [eax], ecx
mov byte [eax + 4], 0
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret 8
cmp dword [ebx + 8], 0x71c71c7
je 0x100d0ead
push 0x24
call fcn.101180ab
add esp, 4
mov edi, eax
lea ecx, [edi + 8]
push ebp
call fcn.1001a510
mov dword [edi + 0x20], 0
mov eax, dword [ebx + 8]
mov ebp, dword [ebx + 0x1c]
inc eax
movss xmm3, dword [ebx]
movd xmm0, eax
cvtdq2pd xmm0, xmm0
shr eax, 0x1f
addsd xmm0, qword [eax*8 + 0x10184e90]
mov eax, ebp
shr eax, 0x1f
cvtpd2ps xmm2, xmm0
movd xmm0, ebp
cvtdq2pd xmm0, xmm0
movaps xmm1, xmm2
addsd xmm0, qword [eax*8 + 0x10184e90]
cvtpd2ps xmm0, xmm0
divss xmm1, xmm0
comiss xmm1, xmm3
jbe 0x100d0e4a
divss xmm2, xmm3
sub esp, 8
movss dword [esp + 0x2c], xmm2
fld dword [esp + 0x2c]
fstp qword [esp]
call fcn.10132d80
add esp, 8
fstp dword [esp + 0x24]
movss xmm0, dword [esp + 0x24]
call fcn.10148630
mov ecx, 8
cmp eax, ecx
cmova ecx, eax
cmp ebp, ecx
jae 0x100d0e2d
cmp ebp, 0x200
jae 0x100d0e2b
shl ebp, 3
cmp ebp, ecx
jae 0x100d0e2d
mov ebp, ecx
push ebp
mov ecx, ebx
call fcn.1002b150
push esi
lea eax, [edi + 8]
mov ecx, ebx
push eax
lea eax, [esp + 0x18]
push eax
call fcn.10027470
mov edx, dword [eax]
jmp 0x100d0e4e
mov edx, dword [esp + 0x10]
mov ebp, dword [edx + 4]
inc dword [ebx + 8]
mov dword [edi], edx
mov dword [edi + 4], ebp
mov dword [ebp], edi
mov dword [edx + 4], edi
mov eax, dword [ebx + 0x18]
mov ecx, dword [ebx + 0xc]
and eax, esi
mov esi, dword [ecx + eax*8]
cmp esi, dword [ebx + 4]
jne 0x100d0e74
mov dword [ecx + eax*8], edi
jmp 0x100d0e95
cmp esi, edx
jne 0x100d0e8f
mov dword [ecx + eax*8], edi
mov eax, dword [esp + 0x20]
mov dword [eax], edi
mov byte [eax + 4], 1
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret 8
cmp dword [ecx + eax*8 + 4], ebp
jne 0x100d0e99
mov dword [ecx + eax*8 + 4], edi
mov eax, dword [esp + 0x20]
mov dword [eax], edi
pop edi
pop esi
pop ebp
mov byte [eax + 4], 1
pop ebx
add esp, 0xc
ret 8
push str.unordered_map_set_too_long
call fcn.101193d3
int3
Function at 0x100d1100
Capabilities:
Hash data using fnv

Disassembly:
mov eax, 0x1fffffff
bsr ecx, eax
push ebx
push ebp
push esi
push edi
mov edi, 1
mov eax, edi
shl eax, cl
mov ecx, dword [esp + 0x14]
cmp ecx, eax
ja 0x100d124f
lea eax, [ecx - 1]
mov esi, dword [0x1027eb60]
or eax, edi
bsr ecx, eax
push esi
lea ecx, [ecx + 1]
shl edi, cl
mov ecx, 0x1027eb68
lea eax, [edi + edi]
push eax
call fcn.100d0a50
mov ecx, dword [0x1027eb60]
lea ebx, [edi - 1]
mov dword [0x1027eb74], ebx
mov dword [0x1027eb78], edi
mov ecx, dword [ecx]
mov edx, ecx
cmp ecx, esi
je 0x100d1248
movzx eax, byte [ecx + 8]
xor eax, 0x811c9dc5
mov edx, dword [edx]
imul edi, eax, 0x1000193
movzx eax, byte [ecx + 9]
xor edi, eax
movzx eax, byte [ecx + 0xa]
imul edi, edi, 0x1000193
xor edi, eax
movzx eax, byte [ecx + 0xb]
imul edi, edi, 0x1000193
xor edi, eax
mov eax, dword [0x1027eb68]
imul edi, edi, 0x1000193
and edi, ebx
mov ebx, dword [eax + edi*8]
lea eax, [eax + edi*8]
mov dword [esp + 0x14], eax
cmp ebx, esi
jne 0x100d11b5
mov dword [eax], ecx
mov dword [eax + 4], ecx
jmp 0x100d121b
mov eax, dword [eax + 4]
mov edi, dword [ecx + 8]
cmp edi, dword [eax + 8]
jne 0x100d11e8
mov eax, dword [eax]
cmp eax, ecx
je 0x100d11df
mov ebp, dword [ecx + 4]
mov dword [ebp], edx
mov ebx, dword [edx + 4]
mov dword [ebx], eax
mov edi, dword [eax + 4]
mov dword [edi], ecx
mov dword [eax + 4], ebx
mov dword [edx + 4], ebp
mov dword [ecx + 4], edi
mov eax, dword [esp + 0x14]
mov dword [eax + 4], ecx
jmp 0x100d121b
cmp ebx, eax
je 0x100d11fc
nop dword [eax]
mov eax, dword [eax + 4]
cmp edi, dword [eax + 8]
je 0x100d122c
cmp ebx, eax
jne 0x100d11f0
mov ebp, dword [ecx + 4]
mov dword [ebp], edx
mov ebx, dword [edx + 4]
mov dword [ebx], eax
mov edi, dword [eax + 4]
mov dword [edi], ecx
mov dword [eax + 4], ebx
mov eax, dword [esp + 0x14]
mov dword [edx + 4], ebp
mov dword [ecx + 4], edi
mov dword [eax], ecx
mov ecx, edx
cmp edx, esi
je 0x100d1248
mov ebx, dword [0x1027eb74]
jmp 0x100d1164
mov ebx, dword [ecx + 4]
mov ebp, dword [eax]
mov dword [ebx], edx
mov edi, dword [edx + 4]
mov dword [edi], ebp
mov eax, dword [ebp + 4]
mov dword [eax], ecx
mov dword [ebp + 4], edi
mov dword [edx + 4], ebx
mov dword [ecx + 4], eax
jmp 0x100d121b
pop edi
pop esi
pop ebp
pop ebx
ret 4
push str.invalid_hash_bucket_count
call fcn.101193d3
int3

Function at 0x100d1e00
Capabilities:
Hash data with crc32

Disassembly:
push ebx
mov ebx, ecx
or eax, 0xffffffff
push esi
push edi
mov edi, 4
lea esi, [ebx + 4]
jmp dword [edi*4 + 0x100d3048]
Function at 0x100dce00
Capabilities:
Hash data with crc32

Disassembly:
push ebx
mov ebx, dword [esp + 8]
push esi
push edi
mov edi, edx
not ebx
mov esi, ecx
mov eax, ebx
test edi, edi
je 0x100dce60
mov cl, byte [esi]
lea esi, [esi + 1]
dec edi
cmp cl, 0x23
jne 0x100dce42
cmp edi, 2
jb 0x100dce42
cmp byte [esi], cl
jne 0x100dce42
cmp byte [esi + 1], cl
jne 0x100dce42
mov eax, ebx
movzx ecx, cl
movzx edx, al
xor edx, ecx
shr eax, 8
xor eax, dword [edx*4 + 0x1017e258]
jmp 0x100dce13
movzx edx, al
movzx ecx, cl
xor edx, ecx
shr eax, 8
xor eax, dword [edx*4 + 0x1017e258]
test edi, edi
jne 0x100dce13
pop edi
pop esi
not eax
pop ebx
ret 4
mov cl, byte [esi]
inc esi
test cl, cl
je 0x100dce8f
cmp cl, 0x23
jne 0x100dce76
cmp byte [esi], cl
jne 0x100dce76
cmp byte [esi + 1], cl
cmove eax, ebx
movzx edx, al
movzx ecx, cl
xor edx, ecx
shr eax, 8
mov cl, byte [esi]
inc esi
xor eax, dword [edx*4 + 0x1017e258]
test cl, cl
jne 0x100dce67
pop edi
pop esi
not eax
pop ebx
ret 4

Function at 0x100dcf70
Capabilities:
Read file on windows

Disassembly:
push ebx
push ebp
mov ebp, dword [esp + 0xc]
push esi
push edi
test ebp, ebp
je 0x100dcf83
mov dword [ebp], 0
call fcn.100dcea0
mov esi, eax
test esi, esi
je 0x100dd07b
push esi
call fcn.10130d2e
mov ebx, eax
add esp, 4
cmp ebx, 0xffffffff
je 0x100dd072
push 2
push 0
push esi
call fcn.1012c7f6
add esp, 0xc
test eax, eax
jne 0x100dd072
push esi
call fcn.10130d2e
mov edi, eax
add esp, 4
cmp edi, 0xffffffff
je 0x100dd072
push 0
push ebx
push esi
call fcn.1012c7f6
add esp, 0xc
test eax, eax
jne 0x100dd072
mov eax, dword [0x1019eea4]
test eax, eax
je 0x100dcff2
inc dword [eax + 0x370]
mov eax, dword [esp + 0x18]
add eax, edi
push eax
call fcn.1012cec5
mov ebx, eax
add esp, 4
test ebx, ebx
je 0x100dd072
push esi
push edi
push 1
push ebx
call fcn.1012c419
add esp, 0x10
cmp eax, edi
je 0x100dd042
push esi
call fcn.1012877d
mov eax, dword [0x1019eea4]
add esp, 4
test eax, eax
je 0x100dd030
dec dword [eax + 0x370]
push ebx
call fcn.1012bf89
add esp, 4
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
ret 8
mov eax, dword [esp + 0x18]
test eax, eax
jle 0x100dd059
push eax
lea eax, [edi + ebx]
push 0
push eax
call fcn.10120e50
add esp, 0xc
push esi
call fcn.1012877d
add esp, 4
test ebp, ebp
je 0x100dd069
mov dword [ebp], edi
mov eax, ebx
pop edi
pop esi
pop ebp
pop ebx
ret 8
push esi
call fcn.1012877d
add esp, 4
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
ret 8

Function at 0x100df4e0
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
mov edx, dword [ecx + 0xc0]
mov eax, dword [ecx + 0xc8]
push esi
push edi
lea esi, [esp + 0xc]
mov edi, 4
mov eax, dword [eax + edx*4 - 4]
not eax
nop dword [eax]
movzx ecx, byte [esi]
lea esi, [esi + 1]
movzx edx, al
xor edx, ecx
shr eax, 8
xor eax, dword [edx*4 + 0x1017e258]
sub edi, 1
jne 0x100df500
mov ecx, dword [0x1019eea4]
not eax
pop edi
pop esi
cmp dword [ecx + 0x1bc8], eax
jne 0x100df532
mov dword [ecx + 0x1bcc], eax
cmp dword [ecx + 0x1c04], eax
jne 0x100df541
mov byte [ecx + 0x1c08], 1
ret 4
Function at 0x100df550
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
sub esp, 0x10
mov edx, dword [esp + 0x14]
push esi
mov esi, ecx
push edi
movss xmm0, dword [edx]
mov edi, 0x10
subss xmm0, dword [esi + 0xc]
mov ecx, dword [esi + 0xc0]
cvttss2si eax, xmm0
movss xmm0, dword [edx + 4]
subss xmm0, dword [esi + 0x10]
mov dword [esp + 8], eax
cvttss2si eax, xmm0
movss xmm0, dword [edx + 8]
subss xmm0, dword [esi + 0xc]
mov dword [esp + 0xc], eax
cvttss2si eax, xmm0
movss xmm0, dword [edx + 0xc]
subss xmm0, dword [esi + 0x10]
mov dword [esp + 0x10], eax
cvttss2si eax, xmm0
mov dword [esp + 0x14], eax
mov eax, dword [esi + 0xc8]
lea esi, [esp + 8]
mov edx, dword [eax + ecx*4 - 4]
not edx
nop dword [eax]
movzx eax, byte [esi]
lea esi, [esi + 1]
movzx ecx, dl
xor ecx, eax
shr edx, 8
xor edx, dword [ecx*4 + 0x1017e258]
sub edi, 1
jne 0x100df5c0
mov eax, dword [0x1019eea4]
not edx
pop edi
pop esi
cmp dword [eax + 0x1bc8], edx
jne 0x100df5f1
mov dword [eax + 0x1bcc], edx
cmp dword [eax + 0x1c04], edx
jne 0x100df600
mov byte [eax + 0x1c08], 1
mov eax, edx
add esp, 0x10
ret 4
Function at 0x100e8830
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ecx
mov eax, dword [0x1019eea4]
lea edx, [esp]
push ebx
push ebp
push esi
push edi
mov edi, dword [eax + 0x1b94]
mov esi, 4
add edi, 0xc0
mov dword [esp + 0x10], ecx
mov ebp, dword [edi]
mov ebx, dword [edi + 8]
mov ebx, dword [ebx + ebp*4 - 4]
not ebx
nop dword [eax]
movzx eax, byte [edx]
lea edx, [edx + 1]
movzx ecx, bl
xor ecx, eax
shr ebx, 8
xor ebx, dword [ecx*4 + 0x1017e258]
sub esi, 1
jne 0x100e8860
mov esi, dword [edi + 4]
not ebx
cmp ebp, esi
jne 0x100e88a7
lea ecx, [ebp + 1]
test esi, esi
je 0x100e8895
mov eax, esi
cdq
sub eax, edx
sar eax, 1
add eax, esi
jmp 0x100e889a
mov eax, 8
cmp eax, ecx
cmovg ecx, eax
push ecx
mov ecx, edi
call fcn.100a1ad0
mov ecx, dword [edi]
mov eax, dword [edi + 8]
mov dword [eax + ecx*4], ebx
inc dword [edi]
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
Function at 0x100ed380
Capabilities:
Hash data with crc32

Disassembly:
movss xmm0, dword [0x10184720]
sub esp, 0x14
push ebx
push ebp
push esi
push edi
mov edi, dword [0x1019eea4]
comiss xmm0, dword [edi + 0x1e0c]
ja 0x100ed5f7
cmp dword [edi + 0x1e08], 0
jne 0x100ed3ee
or edx, 0xffffffff
mov esi, 0x1017e05d
mov al, 0x23
or ebx, 0xffffffff
cmp al, 0x23
jne 0x100ed3c6
cmp byte [esi], al
jne 0x100ed3c6
cmp byte [esi + 1], al
cmove edx, ebx
movzx ecx, dl
movzx eax, al
xor ecx, eax
shr edx, 8
mov al, byte [esi]
inc esi
xor edx, dword [ecx*4 + 0x1017e258]
test al, al
jne 0x100ed3b8
not edx
mov ecx, edx
call fcn.100e3a00
mov dword [edi + 0x1e08], eax
mov eax, dword [edi + 0x1cf4]
lea edx, [esp + 0x10]
mov dword [esp + 0x18], 0x7f7fffff
mov dword [esp + 0x1c], 0x7f7fffff
mov ecx, dword [eax]
mov eax, dword [edi + 0x1c18]
or eax, 0x10
movss xmm2, dword [ecx + 0xc]
movss xmm1, dword [ecx + 0x10]
mulss xmm1, dword [0x10184734]
mov dword [edi + 0x1c18], eax
or eax, 1
mulss xmm2, dword [0x10184734]
mov dword [edi + 0x1c64], 0
movss dword [esp + 0x14], xmm1
mov dword [edi + 0x1c68], 0
movss dword [esp + 0x10], xmm2
movups xmm0, xmmword [esp + 0x10]
movups xmmword [edi + 0x1c54], xmm0
movss xmm1, dword [ecx + 0x10]
movss xmm2, dword [ecx + 0xc]
mulss xmm1, dword [0x10184794]
mulss xmm2, dword [0x10184794]
addss xmm1, dword [ecx + 8]
addss xmm2, dword [ecx + 4]
mov dword [edi + 0x1c18], eax
mov ecx, 1
mov dword [edi + 0x1c30], 0x3f000000
movss dword [edi + 0x1c2c], xmm1
mov dword [edi + 0x1c34], 0x3f000000
movss dword [edi + 0x1c28], xmm2
mov dword [edi + 0x1c1c], 1
movss xmm1, dword [edi + 0x151c]
movss xmm0, dword [edi + 0x1520]
addss xmm1, xmm1
addss xmm0, xmm0
movss dword [esp + 0x10], xmm1
movss dword [esp + 0x14], xmm0
call fcn.100ddda0
push 0xc1347
xor edx, edx
mov ecx, str.NavWindowingList
call fcn.100e5cb0
mov ebp, dword [edi + 0x1b60]
sub ebp, 1
js 0x100ed5e1
nop dword [eax + eax]
mov eax, dword [edi + 0x1b68]
mov esi, dword [eax + ebp*4]
cmp byte [esi + 0x8b], 0
je 0x100ed5d8
cmp esi, dword [esi + 0x320]
jne 0x100ed5d8
test dword [esi + 8], 0x80000
jne 0x100ed5d8
mov ecx, dword [esi]
mov edx, ecx
cmp ecx, 0xffffffff
jae 0x100ed562
mov bl, byte [edx]
test bl, bl
je 0x100ed55e
cmp bl, 0x23
jne 0x100ed558
cmp byte [edx + 1], bl
je 0x100ed55e
inc edx
cmp edx, 0xffffffff
jb 0x100ed548
cmp ecx, edx
jne 0x100ed5b3
mov eax, dword [esi + 8]
test eax, 0x4000000
je 0x100ed573
mov ecx, str._Popup_
jmp 0x100ed5b3
test eax, 0x400
je 0x100ed5ae
mov eax, str.MainMenuBar
nop
mov dl, byte [ecx]
cmp dl, byte [eax]
jne 0x100ed5a0
test dl, dl
je 0x100ed59c
mov dl, byte [ecx + 1]
cmp dl, byte [eax + 1]
jne 0x100ed5a0
add ecx, 2
add eax, 2
test dl, dl
jne 0x100ed580
xor eax, eax
jmp 0x100ed5a5
sbb eax, eax
or eax, 1
mov ecx, str._Main_menu_bar_
test eax, eax
je 0x100ed5b3
mov ecx, str._Untitled_
cmp dword [edi + 0x1e00], esi
lea eax, [esp + 0x10]
push eax
push 0
sete dl
mov dword [esp + 0x18], 0
mov dword [esp + 0x1c], 0
call fcn.10108ed0
sub ebp, 1
jns 0x100ed510
call fcn.100e7f00
mov ecx, 1
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x14
jmp fcn.100dde20
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x14
ret