joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100383a0
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
mov ebx, dword [ebp + 0xc]
push esi
mov esi, dword [ebp + 8]
push edi
push ebx
mov ecx, dword [esi + 4]
push ecx
mov eax, dword [ecx]
call dword [eax + 0xf4]
mov edi, eax
test edi, edi
js 0x1003850a
test ebx, ebx
je 0x1003850a
mov ebx, dword [ebx]
mov esi, dword [esi + 0x10]
mov dword [ebp + 8], esi
mov dword [ebp - 4], ebx
test ebx, ebx
jne 0x100383ef
mov eax, dword [ebp + 0xc]
xor esi, esi
mov dword [eax], esi
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
movzx eax, bl
xor eax, 0x811c9dc5
imul ecx, eax, 0x1000193
mov eax, ebx
shr eax, 8
movzx eax, al
xor ecx, eax
mov eax, ebx
imul ecx, ecx, 0x1000193
shr eax, 0x10
movzx eax, al
xor ecx, eax
mov eax, ebx
imul ecx, ecx, 0x1000193
shr eax, 0x18
xor ecx, eax
imul eax, ecx, 0x1000193
lea ecx, [esi + 0xe8]
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x10]
push eax
call fcn.100367e0
mov eax, dword [eax + 4]
test eax, eax
jne 0x1003844b
mov eax, dword [esi + 0xec]
cmp eax, dword [esi + 0xec]
je 0x1003846f
mov esi, dword [eax + 0xc]
lea eax, [esi - 4]
neg esi
sbb esi, esi
and esi, eax
mov eax, dword [ebp + 0xc]
mov dword [eax], esi
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
mov ecx, 0x1011cf30
mov esi, 0xc
mov edx, ecx
nop dword [eax + eax]
mov eax, dword [ecx]
cmp eax, dword [edx]
jne 0x100384f3
add ecx, 4
add edx, 4
sub esi, 4
jae 0x10038480
push 0x10
call fcn.100b64b2
mov esi, eax
add esp, 4
test esi, esi
je 0x100383dd
mov ecx, dword [ebp + 8]
mov dword [ebp + 8], ebx
mov eax, dword [ecx + 4]
mov dword [esi], vtable.m_IDirect3DStateBlock9.0
mov dword [esi + 4], vtable.m_IDirect3DStateBlock9.1.0
mov dword [esi + 8], ebx
mov dword [esi + 0xc], eax
mov ecx, dword [eax + 0x10]
test ebx, ebx
je 0x10038503
lea eax, [ebp + 8]
add ecx, 0xe8
push eax
lea eax, [ebp - 8]
push eax
call fcn.10036850
lea ecx, [esi + 4]
mov eax, dword [eax]
mov dword [eax + 0xc], ecx
mov eax, dword [ebp + 0xc]
mov dword [eax], esi
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
mov ecx, dword [ebp + 8]
push 0x1011cf30
push ebx
call fcn.10037a10
mov esi, eax
mov eax, dword [ebp + 0xc]
mov dword [eax], esi
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x10038710
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
mov ebx, dword [ebp + 0xc]
push esi
mov esi, dword [ebp + 8]
push edi
push ebx
mov ecx, dword [esi + 4]
push ecx
mov eax, dword [ecx]
call dword [eax + 0x1a4]
mov edi, eax
test edi, edi
js 0x1003887a
test ebx, ebx
je 0x1003887a
mov ebx, dword [ebx]
mov esi, dword [esi + 0x10]
mov dword [ebp + 8], esi
mov dword [ebp - 4], ebx
test ebx, ebx
jne 0x1003875f
mov eax, dword [ebp + 0xc]
xor esi, esi
mov dword [eax], esi
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
movzx eax, bl
xor eax, 0x811c9dc5
imul ecx, eax, 0x1000193
mov eax, ebx
shr eax, 8
movzx eax, al
xor ecx, eax
mov eax, ebx
imul ecx, ecx, 0x1000193
shr eax, 0x10
movzx eax, al
xor ecx, eax
mov eax, ebx
imul ecx, ecx, 0x1000193
shr eax, 0x18
xor ecx, eax
imul eax, ecx, 0x1000193
lea ecx, [esi + 0x88]
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x10]
push eax
call fcn.100367e0
mov eax, dword [eax + 4]
test eax, eax
jne 0x100387bb
mov eax, dword [esi + 0x8c]
cmp eax, dword [esi + 0x8c]
je 0x100387df
mov esi, dword [eax + 0xc]
lea eax, [esi - 4]
neg esi
sbb esi, esi
and esi, eax
mov eax, dword [ebp + 0xc]
mov dword [eax], esi
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
mov ecx, 0x1011cf30
mov esi, 0xc
mov edx, ecx
nop dword [eax + eax]
mov eax, dword [ecx]
cmp eax, dword [edx]
jne 0x10038863
add ecx, 4
add edx, 4
sub esi, 4
jae 0x100387f0
push 0x10
call fcn.100b64b2
mov esi, eax
add esp, 4
test esi, esi
je 0x1003874d
mov ecx, dword [ebp + 8]
mov dword [ebp + 8], ebx
mov eax, dword [ecx + 4]
mov dword [esi], vtable.m_IDirect3DIndexBuffer9.0
mov dword [esi + 4], vtable.m_IDirect3DIndexBuffer9.1.0
mov dword [esi + 8], ebx
mov dword [esi + 0xc], eax
mov ecx, dword [eax + 0x10]
test ebx, ebx
je 0x10038873
lea eax, [ebp + 8]
add ecx, 0x88
push eax
lea eax, [ebp - 8]
push eax
call fcn.10036850
lea ecx, [esi + 4]
mov eax, dword [eax]
mov dword [eax + 0xc], ecx
mov eax, dword [ebp + 0xc]
mov dword [eax], esi
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
mov ecx, dword [ebp + 8]
push 0x1011cf30
push ebx
call fcn.10037a10
mov esi, eax
mov eax, dword [ebp + 0xc]
mov dword [eax], esi
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x10038970
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
mov ebx, dword [ebp + 0xc]
push esi
mov esi, dword [ebp + 8]
push edi
push ebx
mov ecx, dword [esi + 4]
push ecx
mov eax, dword [ecx]
call dword [eax + 0x1b0]
mov edi, eax
test edi, edi
js 0x10038ada
test ebx, ebx
je 0x10038ada
mov ebx, dword [ebx]
mov esi, dword [esi + 0x10]
mov dword [ebp + 8], esi
mov dword [ebp - 4], ebx
test ebx, ebx
jne 0x100389bf
mov eax, dword [ebp + 0xc]
xor esi, esi
mov dword [eax], esi
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
movzx eax, bl
xor eax, 0x811c9dc5
imul ecx, eax, 0x1000193
mov eax, ebx
shr eax, 8
movzx eax, al
xor ecx, eax
mov eax, ebx
imul ecx, ecx, 0x1000193
shr eax, 0x10
movzx eax, al
xor ecx, eax
mov eax, ebx
imul ecx, ecx, 0x1000193
shr eax, 0x18
xor ecx, eax
imul eax, ecx, 0x1000193
lea ecx, [esi + 0xa8]
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x10]
push eax
call fcn.100367e0
mov eax, dword [eax + 4]
test eax, eax
jne 0x10038a1b
mov eax, dword [esi + 0xac]
cmp eax, dword [esi + 0xac]
je 0x10038a3f
mov esi, dword [eax + 0xc]
lea eax, [esi - 4]
neg esi
sbb esi, esi
and esi, eax
mov eax, dword [ebp + 0xc]
mov dword [eax], esi
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
mov ecx, 0x1011cf30
mov esi, 0xc
mov edx, ecx
nop dword [eax + eax]
mov eax, dword [ecx]
cmp eax, dword [edx]
jne 0x10038ac3
add ecx, 4
add edx, 4
sub esi, 4
jae 0x10038a50
push 0x10
call fcn.100b64b2
mov esi, eax
add esp, 4
test esi, esi
je 0x100389ad
mov ecx, dword [ebp + 8]
mov dword [ebp + 8], ebx
mov eax, dword [ecx + 4]
mov dword [esi], vtable.m_IDirect3DPixelShader9.0
mov dword [esi + 4], vtable.m_IDirect3DPixelShader9.1.0
mov dword [esi + 8], ebx
mov dword [esi + 0xc], eax
mov ecx, dword [eax + 0x10]
test ebx, ebx
je 0x10038ad3
lea eax, [ebp + 8]
add ecx, 0xa8
push eax
lea eax, [ebp - 8]
push eax
call fcn.10036850
lea ecx, [esi + 4]
mov eax, dword [eax]
mov dword [eax + 0xc], ecx
mov eax, dword [ebp + 0xc]
mov dword [eax], esi
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
mov ecx, dword [ebp + 8]
push 0x1011cf30
push ebx
call fcn.10037a10
mov esi, eax
mov eax, dword [ebp + 0xc]
mov dword [eax], esi
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x10038c40
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
mov ebx, dword [ebp + 0x10]
push esi
mov esi, dword [ebp + 8]
push edi
push dword [ebp + 0x18]
push dword [ebp + 0x14]
mov ecx, dword [esi + 4]
push ebx
push dword [ebp + 0xc]
mov eax, dword [ecx]
push ecx
call dword [eax + 0x194]
mov edi, eax
test edi, edi
js 0x10038dae
test ebx, ebx
je 0x10038dae
mov ebx, dword [ebx]
mov esi, dword [esi + 0x10]
mov dword [ebp + 8], esi
mov dword [ebp + 0x18], ebx
test ebx, ebx
jne 0x10038c98
mov eax, dword [ebp + 0x10]
xor esi, esi
mov dword [eax], esi
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x14
movzx eax, bl
xor eax, 0x811c9dc5
imul ecx, eax, 0x1000193
mov eax, ebx
shr eax, 8
movzx eax, al
xor ecx, eax
mov eax, ebx
imul ecx, ecx, 0x1000193
shr eax, 0x10
movzx eax, al
xor ecx, eax
mov eax, ebx
imul ecx, ecx, 0x1000193
shr eax, 0x18
xor ecx, eax
imul eax, ecx, 0x1000193
lea ecx, [esi + 0x168]
push eax
lea eax, [ebp + 0x18]
push eax
lea eax, [ebp - 8]
push eax
call fcn.100367e0
mov eax, dword [eax + 4]
test eax, eax
jne 0x10038cf4
mov eax, dword [esi + 0x16c]
cmp eax, dword [esi + 0x16c]
je 0x10038d18
mov esi, dword [eax + 0xc]
lea eax, [esi - 4]
neg esi
sbb esi, esi
and esi, eax
mov eax, dword [ebp + 0x10]
mov dword [eax], esi
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x14
mov ecx, 0x1011cf30
mov esi, 0xc
mov edx, ecx
mov eax, dword [ecx]
cmp eax, dword [edx]
jne 0x10038d97
add ecx, 4
add edx, 4
sub esi, 4
jae 0x10038d24
push 0x10
call fcn.100b64b2
mov esi, eax
add esp, 4
test esi, esi
je 0x10038c86
mov ecx, dword [ebp + 8]
mov dword [ebp + 8], ebx
mov eax, dword [ecx + 4]
mov dword [esi], vtable.m_IDirect3DVertexBuffer9.0
mov dword [esi + 4], vtable.m_IDirect3DVertexBuffer9.1.0
mov dword [esi + 8], ebx
mov dword [esi + 0xc], eax
mov ecx, dword [eax + 0x10]
test ebx, ebx
je 0x10038da7
lea eax, [ebp + 8]
add ecx, 0x168
push eax
lea eax, [ebp - 0x10]
push eax
call fcn.10036850
lea ecx, [esi + 4]
mov eax, dword [eax]
mov dword [eax + 0xc], ecx
mov eax, dword [ebp + 0x10]
mov dword [eax], esi
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x14
mov ecx, dword [ebp + 8]
push 0x1011cf30
push ebx
call fcn.10037a10
mov esi, eax
mov eax, dword [ebp + 0x10]
mov dword [eax], esi
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x14
Function at 0x10038de0
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
mov ebx, dword [ebp + 0x10]
push esi
mov esi, dword [ebp + 8]
push edi
push ebx
push dword [ebp + 0xc]
mov ecx, dword [esi + 4]
push ecx
mov eax, dword [ecx]
call dword [eax + 0x38]
mov edi, eax
test edi, edi
js 0x10038f51
test ebx, ebx
je 0x10038f51
mov ebx, dword [ebx]
mov esi, dword [esi + 0x10]
mov dword [ebp + 8], esi
mov dword [ebp + 0xc], ebx
test ebx, ebx
jne 0x10038e2f
mov eax, dword [ebp + 0x10]
xor esi, esi
mov dword [eax], esi
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
movzx eax, bl
xor eax, 0x811c9dc5
imul ecx, eax, 0x1000193
mov eax, ebx
shr eax, 8
movzx eax, al
xor ecx, eax
mov eax, ebx
imul ecx, ecx, 0x1000193
shr eax, 0x10
movzx eax, al
xor ecx, eax
mov eax, ebx
imul ecx, ecx, 0x1000193
shr eax, 0x18
xor ecx, eax
imul eax, ecx, 0x1000193
lea ecx, [esi + 0x128]
push eax
lea eax, [ebp + 0xc]
push eax
lea eax, [ebp - 8]
push eax
call fcn.100367e0
mov eax, dword [eax + 4]
test eax, eax
jne 0x10038e8b
mov eax, dword [esi + 0x12c]
cmp eax, dword [esi + 0x12c]
je 0x10038eaf
mov esi, dword [eax + 0xc]
lea eax, [esi - 4]
neg esi
sbb esi, esi
and esi, eax
mov eax, dword [ebp + 0x10]
mov dword [eax], esi
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov ecx, 0x1011cf30
mov esi, 0xc
mov edx, ecx
nop dword [eax + eax]
mov eax, dword [ecx]
cmp eax, dword [edx]
jne 0x10038f3a
add ecx, 4
add edx, 4
sub esi, 4
jae 0x10038ec0
push 0x14
call fcn.100b64b2
mov esi, eax
add esp, 4
test esi, esi
je 0x10038e1d
mov ecx, dword [ebp + 8]
mov dword [ebp + 8], ebx
mov eax, dword [ecx + 4]
mov dword [esi], vtable.m_IDirect3DSwapChain9Ex.0
mov dword [esi + 4], vtable.m_IDirect3DSwapChain9Ex.1.0
mov dword [esi + 8], ebx
mov dword [esi + 0xc], eax
mov dword [esi + 0x10], 0x1010c4f0
mov ecx, dword [eax + 0x10]
test ebx, ebx
je 0x10038f4a
lea eax, [ebp + 8]
add ecx, 0x128
push eax
lea eax, [ebp - 0x10]
push eax
call fcn.10036850
lea ecx, [esi + 4]
mov eax, dword [eax]
mov dword [eax + 0xc], ecx
mov eax, dword [ebp + 0x10]
mov dword [eax], esi
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov ecx, dword [ebp + 8]
push 0x1011cf30
push ebx
call fcn.10037a10
mov esi, eax
mov eax, dword [ebp + 0x10]
mov dword [eax], esi
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x100393c0
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
mov ebx, dword [ebp + 0xc]
push esi
mov esi, dword [ebp + 8]
push edi
push ebx
mov ecx, dword [esi + 4]
push ecx
mov eax, dword [ecx]
call dword [eax + 0x160]
mov edi, eax
test edi, edi
js 0x1003952a
test ebx, ebx
je 0x1003952a
mov ebx, dword [ebx]
mov esi, dword [esi + 0x10]
mov dword [ebp + 8], esi
mov dword [ebp - 4], ebx
test ebx, ebx
jne 0x1003940f
mov eax, dword [ebp + 0xc]
xor esi, esi
mov dword [eax], esi
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
movzx eax, bl
xor eax, 0x811c9dc5
imul ecx, eax, 0x1000193
mov eax, ebx
shr eax, 8
movzx eax, al
xor ecx, eax
mov eax, ebx
imul ecx, ecx, 0x1000193
shr eax, 0x10
movzx eax, al
xor ecx, eax
mov eax, ebx
imul ecx, ecx, 0x1000193
shr eax, 0x18
xor ecx, eax
imul eax, ecx, 0x1000193
lea ecx, [esi + 0x188]
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x10]
push eax
call fcn.100367e0
mov eax, dword [eax + 4]
test eax, eax
jne 0x1003946b
mov eax, dword [esi + 0x18c]
cmp eax, dword [esi + 0x18c]
je 0x1003948f
mov esi, dword [eax + 0xc]
lea eax, [esi - 4]
neg esi
sbb esi, esi
and esi, eax
mov eax, dword [ebp + 0xc]
mov dword [eax], esi
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
mov ecx, 0x1011cf30
mov esi, 0xc
mov edx, ecx
nop dword [eax + eax]
mov eax, dword [ecx]
cmp eax, dword [edx]
jne 0x10039513
add ecx, 4
add edx, 4
sub esi, 4
jae 0x100394a0
push 0x10
call fcn.100b64b2
mov esi, eax
add esp, 4
test esi, esi
je 0x100393fd
mov ecx, dword [ebp + 8]
mov dword [ebp + 8], ebx
mov eax, dword [ecx + 4]
mov dword [esi], vtable.m_IDirect3DVertexDeclaration9.0
mov dword [esi + 4], vtable.m_IDirect3DVertexDeclaration9.1.0
mov dword [esi + 8], ebx
mov dword [esi + 0xc], eax
mov ecx, dword [eax + 0x10]
test ebx, ebx
je 0x10039523
lea eax, [ebp + 8]
add ecx, 0x188
push eax
lea eax, [ebp - 8]
push eax
call fcn.10036850
lea ecx, [esi + 4]
mov eax, dword [eax]
mov dword [eax + 0xc], ecx
mov eax, dword [ebp + 0xc]
mov dword [eax], esi
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
mov ecx, dword [ebp + 8]
push 0x1011cf30
push ebx
call fcn.10037a10
mov esi, eax
mov eax, dword [ebp + 0xc]
mov dword [eax], esi
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x10039540
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
mov ebx, dword [ebp + 0xc]
push esi
mov esi, dword [ebp + 8]
push edi
push ebx
mov ecx, dword [esi + 4]
push ecx
mov eax, dword [ecx]
call dword [eax + 0x174]
mov edi, eax
test edi, edi
js 0x100396aa
test ebx, ebx
je 0x100396aa
mov ebx, dword [ebx]
mov esi, dword [esi + 0x10]
mov dword [ebp + 8], esi
mov dword [ebp - 4], ebx
test ebx, ebx
jne 0x1003958f
mov eax, dword [ebp + 0xc]
xor esi, esi
mov dword [eax], esi
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
movzx eax, bl
xor eax, 0x811c9dc5
imul ecx, eax, 0x1000193
mov eax, ebx
shr eax, 8
movzx eax, al
xor ecx, eax
mov eax, ebx
imul ecx, ecx, 0x1000193
shr eax, 0x10
movzx eax, al
xor ecx, eax
mov eax, ebx
imul ecx, ecx, 0x1000193
shr eax, 0x18
xor ecx, eax
imul eax, ecx, 0x1000193
lea ecx, [esi + 0x1a8]
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x10]
push eax
call fcn.100367e0
mov eax, dword [eax + 4]
test eax, eax
jne 0x100395eb
mov eax, dword [esi + 0x1ac]
cmp eax, dword [esi + 0x1ac]
je 0x1003960f
mov esi, dword [eax + 0xc]
lea eax, [esi - 4]
neg esi
sbb esi, esi
and esi, eax
mov eax, dword [ebp + 0xc]
mov dword [eax], esi
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
mov ecx, 0x1011cf30
mov esi, 0xc
mov edx, ecx
nop dword [eax + eax]
mov eax, dword [ecx]
cmp eax, dword [edx]
jne 0x10039693
add ecx, 4
add edx, 4
sub esi, 4
jae 0x10039620
push 0x10
call fcn.100b64b2
mov esi, eax
add esp, 4
test esi, esi
je 0x1003957d
mov ecx, dword [ebp + 8]
mov dword [ebp + 8], ebx
mov eax, dword [ecx + 4]
mov dword [esi], vtable.m_IDirect3DVertexShader9.0
mov dword [esi + 4], vtable.m_IDirect3DVertexShader9.1.0
mov dword [esi + 8], ebx
mov dword [esi + 0xc], eax
mov ecx, dword [eax + 0x10]
test ebx, ebx
je 0x100396a3
lea eax, [ebp + 8]
add ecx, 0x1a8
push eax
lea eax, [ebp - 8]
push eax
call fcn.10036850
lea ecx, [esi + 4]
mov eax, dword [eax]
mov dword [eax + 0xc], ecx
mov eax, dword [ebp + 0xc]
mov dword [eax], esi
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
mov ecx, dword [ebp + 8]
push 0x1011cf30
push ebx
call fcn.10037a10
mov esi, eax
mov eax, dword [ebp + 0xc]
mov dword [eax], esi
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x1003a990
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10100689
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push ebx
push esi
push edi
mov eax, dword [0x101385c0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
mov ebx, dword [ebp + 8]
test ebx, ebx
jne 0x1003a9da
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
movzx eax, bl
xor eax, 0x811c9dc5
imul ecx, eax, 0x1000193
mov eax, ebx
sar eax, 8
movzx eax, al
xor ecx, eax
mov eax, ebx
sar eax, 0x10
imul ecx, ecx, 0x1000193
movzx eax, al
xor ecx, eax
mov eax, ebx
imul ecx, ecx, 0x1000193
sar eax, 0x18
movzx eax, al
xor ecx, eax
imul eax, ecx, 0x1000193
lea ecx, [esi + 0x1c8]
push eax
lea eax, [ebp + 8]
push eax
lea eax, [ebp - 0x1c]
push eax
call fcn.100367e0
mov eax, dword [eax + 4]
test eax, eax
jne 0x1003aa39
mov eax, dword [esi + 0x1cc]
cmp eax, dword [esi + 0x1cc]
je 0x1003aa61
mov eax, dword [eax + 0xc]
lea ecx, [eax - 4]
neg eax
sbb eax, eax
and eax, ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
mov ecx, dword [ebp + 0xc]
mov edx, 0x1011cf30
mov esi, 0xc
nop
mov eax, dword [ecx]
cmp eax, dword [edx]
jne 0x1003aae4
add ecx, 4
add edx, 4
sub esi, 4
jae 0x1003aa70
push 0x10
call fcn.100b64b2
mov edi, eax
add esp, 4
mov dword [ebp + 0xc], edi
mov dword [ebp - 4], 0
test edi, edi
je 0x1003ab49
mov ecx, dword [ebp - 0x10]
lea esi, [edi + 4]
mov ecx, dword [ecx + 4]
mov dword [esi], vtable.AddressLookupTableObject.0
lea eax, [ebp + 8]
mov dword [edi + 0xc], ecx
push eax
mov dword [edi], vtable.m_IDirect3DVolume9.0
lea eax, [ebp - 0x1c]
mov dword [esi], vtable.m_IDirect3DVolume9.1.0
mov dword [edi + 8], ebx
mov ecx, dword [ecx + 0x10]
push eax
add ecx, 0x1c8
mov byte [ebp - 4], 1
mov dword [ebp + 8], ebx
call fcn.10036850
mov eax, dword [eax]
mov dword [eax + 0xc], esi
jmp 0x1003ab4b
push 0x14
call fcn.100b64b2
mov edi, eax
add esp, 4
mov dword [ebp - 0x18], edi
mov dword [ebp - 4], 2
test edi, edi
je 0x1003ab49
mov ecx, dword [ebp - 0x10]
lea esi, [edi + 4]
mov ecx, dword [ecx + 4]
mov dword [esi], vtable.AddressLookupTableObject.0
mov eax, dword [ebp + 0xc]
mov dword [edi + 0x10], eax
lea eax, [ebp + 8]
mov dword [edi + 0xc], ecx
push eax
mov dword [edi], vtable.m_IDirect3DSwapChain9Ex.0
lea eax, [ebp - 0x14]
mov dword [esi], vtable.m_IDirect3DSwapChain9Ex.1.0
mov dword [edi + 8], ebx
mov ecx, dword [ecx + 0x10]
push eax
add ecx, 0x128
mov byte [ebp - 4], 3
mov dword [ebp + 8], ebx
call fcn.10036850
mov eax, dword [eax]
mov dword [eax + 0xc], esi
jmp 0x1003ab4b
xor edi, edi
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x1003e2b0
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, dword [ecx]
push edi
mov dword [ebp - 4], esi
mov eax, dword [esi]
cmp eax, 0x270
jne 0x1003e30d
lea edx, [esi + 8]
mov edi, eax
nop dword [eax]
mov ecx, dword [edx]
lea edx, [edx + 4]
xor ecx, dword [edx - 8]
and ecx, 0x7fffffff
xor ecx, dword [edx - 8]
mov eax, ecx
and al, 1
movzx eax, al
neg eax
sbb eax, eax
shr ecx, 1
and eax, 0x9908b0df
xor eax, dword [edx + 0x62c]
xor eax, ecx
mov dword [edx + 0x9b8], eax
sub edi, 1
jne 0x1003e2d0
mov eax, dword [esi]
jmp 0x1003e3e7
cmp eax, 0x4e0
jb 0x1003e3e7
lea edi, [esi + 0x9c4]
mov esi, 0xe3
push ebx
mov ebx, dword [edi]
mov eax, ebx
lea edi, [edi + 4]
mov ebx, dword [edi]
mov ecx, eax
xor ecx, ebx
and ecx, 0x7fffffff
xor ecx, eax
mov eax, ecx
and al, 1
movzx eax, al
neg eax
sbb eax, eax
shr ecx, 1
and eax, 0x9908b0df
xor eax, dword [edi + 0x630]
xor eax, ecx
mov dword [edi - 0x9c4], eax
sub esi, 1
jne 0x1003e326
mov edi, dword [ebp - 4]
mov esi, 0x18c
add edi, 0xd50
mov ebx, dword [edi]
nop
mov eax, ebx
lea edi, [edi + 4]
mov ebx, dword [edi]
mov ecx, eax
xor ecx, ebx
and ecx, 0x7fffffff
xor ecx, eax
mov eax, ecx
and al, 1
movzx eax, al
neg eax
sbb eax, eax
shr ecx, 1
and eax, 0x9908b0df
xor eax, dword [edi - 0xd50]
xor eax, ecx
mov dword [edi - 0x9c4], eax
sub esi, 1
jne 0x1003e370
mov esi, dword [ebp - 4]
pop ebx
mov eax, dword [esi + 0x1380]
mov ecx, dword [esi + 4]
xor ecx, eax
and ecx, 0x7fffffff
xor ecx, eax
mov eax, ecx
and al, 1
movzx eax, al
neg eax
sbb eax, eax
shr ecx, 1
and eax, 0x9908b0df
xor eax, dword [esi + 0x634]
xor eax, ecx
mov dword [esi + 0x9c0], eax
xor eax, eax
mov dword [esi], 0
mov edx, dword [esi + eax*4 + 4]
inc eax
mov dword [esi], eax
mov ecx, edx
mov eax, dword [esi + 0x1384]
shr ecx, 0xb
and eax, ecx
xor edx, eax
mov eax, edx
and eax, 0xff3a58ad
shl eax, 7
xor edx, eax
mov eax, edx
and eax, 0xffffdf8c
shl eax, 0xf
xor edx, eax
mov eax, edx
shr eax, 0x12
pop edi
xor eax, edx
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x100453b0
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x101009f0
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x101385c0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
lea ebx, [esi + 4]
mov dword [esi], vtable.std::basic_streambuf_char__struct_std::char_traits_char__.0
push 8
mov dword [ebx], 0
mov dword [esi + 8], 0
mov dword [esi + 0xc], 0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
mov dword [esi + 0x18], 0
mov dword [esi + 0x1c], 0
mov dword [esi + 0x20], 0
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x2c], 0
mov dword [esi + 0x30], 0
call fcn.100b64b2
mov edi, eax
add esp, 4
test edi, edi
je 0x1004545d
push 1
mov dword [ebp - 4], 0
call fcn.100b8020
add esp, 4
mov dword [edi + 4], eax
jmp 0x1004545f
xor edi, edi
mov ecx, esi
mov dword [esi + 0x34], edi
call fcn.10049c40
mov dword [esi + 0xc], ebx
lea eax, [esi + 8]
mov dword [esi + 0x10], eax
lea ecx, [esi + 0x14]
mov dword [esi], vtable.std::basic_filebuf_char__struct_std::char_traits_char__.0
lea edx, [esi + 0x18]
mov byte [esi + 0x48], 0
lea edi, [esi + 0x24]
mov byte [esi + 0x3d], 0
lea ebx, [esi + 0x28]
mov dword [esi + 0x1c], ecx
mov dword [esi + 0x20], edx
mov dword [esi + 0x2c], edi
mov dword [esi + 0x30], ebx
mov dword [eax], 0
mov dword [edx], 0
mov dword [esi + 0x28], 0
mov dword [esi + 4], 0
mov dword [ecx], 0
mov dword [edi], 0
mov dword [esi + 0x4c], 0
mov eax, dword [0x1013ae50]
mov ecx, dword [0x1013ae54]
mov dword [esi + 0x40], eax
mov eax, esi
mov dword [esi + 0x44], ecx
mov dword [esi + 0x38], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret