joyce8/EMBER2024-capa huggingface dataset:
Function at 0x405cc9
Capabilities:
Delete directory
Delete file
Enumerate files on windows
Enumerate files recursively

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x148
push ebx
mov ebx, dword [ebp + 8]
push ebx
call fcn.004057fe
mov ecx, dword [ebp + 0xc]
mov dword [ebp - 8], eax
test cl, 8
je 0x405cfe
push ebx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
neg eax
sbb eax, eax
inc eax
add dword [0x423c88], eax
jmp 0x405e90
mov dword [ebp + 8], ecx
and dword [ebp + 8], 1
push esi
je 0x405d19
test eax, eax
je 0x405e3b
test cl, 2
je 0x405e3b
push edi
push ebx
mov esi, 0x422348
push esi
call fcn.0040565d
cmp dword [ebp + 8], 0
mov edi, dword [sym.imp.KERNEL32.dll_lstrcatA]
je 0x405d3c
push str..
push esi
call edi
jmp 0x405d42
push ebx
call fcn.004057d7
cmp byte [ebx], 0
jne 0x405d50
cmp byte [0x422348], 0x5c
jne 0x405d58
push 0x407290
push ebx
call edi
push ebx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov edi, eax
lea eax, [ebp - 0x148]
push eax
push esi
add edi, ebx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov dword [ebp - 4], eax
cmp eax, 0xffffffff
je 0x405e30
lea esi, [ebp - 0x11c]
push 0x3f
mov eax, esi
push eax
call fcn.004053f2
cmp byte [eax], 0
je 0x405d9b
cmp byte [ebp - 0x18], 0
je 0x405d9b
lea esi, [ebp - 0x18]
cmp byte [esi], 0x2e
jne 0x405db1
mov al, byte [esi + 1]
test al, al
je 0x405e0f
cmp al, 0x2e
jne 0x405db1
cmp byte [esi + 2], 0
je 0x405e0f
push esi
push edi
call fcn.0040565d
test byte [ebp - 0x148], 0x10
je 0x405dd6
mov eax, dword [ebp + 0xc]
and eax, 3
cmp al, 3
jne 0x405e0f
push dword [ebp + 0xc]
push ebx
call fcn.00405cc9
jmp 0x405e0f
push ebx
call fcn.004054ad
push ebx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
test eax, eax
jne 0x405e07
test byte [ebp + 0xc], 4
je 0x405dff
push ebx
push 0xfffffffffffffff1
call fcn.004046ef
push 0
push ebx
call fcn.00405b30
jmp 0x405e0f
inc dword [0x423c88]
jmp 0x405e0f
push ebx
push 0xfffffffffffffff2
call fcn.004046ef
lea eax, [ebp - 0x148]
push eax
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x405d7d
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_FindClose]
cmp dword [ebp + 8], 0
je 0x405e3a
mov byte [edi - 1], 0
pop edi
xor esi, esi
cmp dword [ebp + 8], esi
je 0x405e8f
cmp dword [ebp - 8], esi
je 0x405e7f
push ebx
call fcn.00405719
test eax, eax
je 0x405e8f
push ebx
call fcn.004057aa
push ebx
call fcn.004054ad
push ebx
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
test eax, eax
jne 0x405e87
test byte [ebp + 0xc], 4
je 0x405e7f
push ebx
push 0xfffffffffffffff1
call fcn.004046ef
push esi
push ebx
call fcn.00405b30
jmp 0x405e8f
inc dword [0x423c88]
jmp 0x405e8f
push ebx
push 0xffffffffffffffe5
call fcn.004046ef
pop esi
pop ebx
leave
ret 8
Function at 0x405e95
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
cmp dword [0x42274c], 0
jne 0x405ed3
xor ecx, ecx
push esi
push 8
mov eax, ecx
pop esi
mov edx, eax
and dl, 1
movzx edx, dl
neg edx
sbb edx, edx
and edx, 0xedb88320
shr eax, 1
xor eax, edx
dec esi
jne 0x405ea9
mov dword [ecx*4 + 0x422748], eax
inc ecx
cmp ecx, 0x100
jl 0x405ea4
pop esi
cmp dword [ebp + 0x10], 0
mov eax, dword [ebp + 8]
not eax
jbe 0x405f00
mov ecx, dword [ebp + 0xc]
movzx edx, byte [ecx]
dec dword [ebp + 0x10]
xor edx, eax
and edx, 0xff
shr eax, 8
xor eax, dword [edx*4 + 0x422748]
inc ecx
cmp dword [ebp + 0x10], 0
ja 0x405ee1
not eax
pop ebp
ret 0xc
Function at 0x1001224e
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
pushal
call 0x1001225d
pop dword [ebp - 0x38]
mov eax, 0x4420dfc0
sub eax, 0x341fbd63
sub dword [ebp - 0x38], eax
mov dword [ebp - 0x48], 0x1053ebc5
sub dword [ebp - 0x48], 0xc201a67a
mov dword [ebp - 0x44], 0x719cf706
add dword [ebp - 0x44], 0xc096553f
mov dword [ebp - 0x40], 0xdc1ced61
sub dword [ebp - 0x40], 0x8fd0a933
mov dword [ebp - 0x3c], 0x39bfed62
add dword [ebp - 0x3c], 0xc640129e
lea eax, [ebp - 0x48]
push eax
mov eax, 0xe2868796
add eax, 0x2d7ac902
add eax, dword [ebp - 0x38]
call dword [eax]
mov dword [ebp - 0x48], 0xc4117ff2
add dword [ebp - 0x48], 0xb060e964
mov dword [ebp - 0x44], 0x57358288
add dword [ebp - 0x44], 0xea36deed
mov dword [ebp - 0x40], 0x41ce11af
add dword [ebp - 0x40], 0x21a15abd
mov dword [ebp - 0x3c], 0xae9a7fbf
sub dword [ebp - 0x3c], 0xae9a7fbf
lea ebx, [ebp - 0x48]
push ebx
push eax
mov eax, 0xd5818cf0
sub eax, 0xc5803c54
add eax, dword [ebp - 0x38]
call dword [eax]
push 0x40
push 0x1000
push 0x3e18e
push 0
call eax
mov ecx, 0xb4e7d4a6
add ecx, 0x4b18896f
mov edx, eax
mov ebx, 0x4e7738d1
add ebx, 0xc18ce32f
add ebx, dword [ebp - 0x38]
mov esi, 0xf3034654
add dword [ebp - 0x2c], 0xad61294b
mov edi, dword [ebx]
sub edi, esi
xor dword [ebp - 0x14], esi
mov dword [edx], edi
add dword [ebp - 8], 0x7fb2ad18
add edx, 0x176bb3f
add edx, 0xfe8944c5
add ebx, 0x9c4e12e5
add ebx, 0x63b1ed1f
loop 0x10012379
add eax, 0x335806fa
sub eax, 0x33569bd3
mov ebx, eax
add eax, 0xc9e4ab16
add eax, 0x361b54ef
mov ecx, 0xbcf350a1
add ecx, 0x530caf5f
add ecx, dword [ebp - 0x38]
call ebx
leave
ret
Function at 0x10018120
Capabilities:
Access peb ldr_data
Check for peb beingdebugged flag

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100e2ae4
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x10111040]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
push 0x10
call fcn.100e12f9
push 8
mov byte [eax], 1
mov dword [eax + 4], 0
mov dword [eax + 8], 0x45
mov byte [eax + 0xc], 1
mov dword [edi], eax
call fcn.100e12f9
push 0x48
mov dword [eax], 1
mov dword [eax + 4], 0x1000101
mov dword [edi + 4], eax
call fcn.100e12f9
push 0x30
mov dword [eax], 1
mov dword [eax + 4], 1
mov dword [eax + 8], 1
mov dword [eax + 0xc], 1
mov dword [eax + 0x10], 1
mov dword [eax + 0x14], 1
mov dword [eax + 0x18], 1
mov dword [eax + 0x1c], 1
mov dword [eax + 0x20], 1
mov dword [eax + 0x24], 1
mov dword [eax + 0x28], 1
mov dword [eax + 0x2c], 1
mov dword [eax + 0x30], 5
mov dword [eax + 0x34], 4
mov dword [eax + 0x38], 2
mov dword [eax + 0x3c], 2
mov dword [eax + 0x40], 1
mov dword [eax + 0x44], 1
mov dword [edi + 8], eax
call fcn.100e12f9
mov esi, eax
mov dword [ebp - 0x10], esi
mov dword [ebp - 4], 0
push 0x10
mov dword [esi], 0x1010000
mov dword [esi + 4], 0
mov word [esi + 8], 1
mov byte [esi + 0xa], 0
mov dword [esi + 0xc], 0xb4
mov dword [esi + 0x10], 0
mov byte [esi + 0x14], 0
mov dword [esi + 0x18], 0xa
mov dword [esi + 0x1c], 0x48
mov dword [esi + 0x20], 0x2a
mov dword [esi + 0x24], 0x1010101
mov byte [esi + 0x28], 1
call fcn.100e12f9
vmovss xmm0, dword [0x10100484]
push 3
vmovss dword [eax + 4], xmm0
vmovss xmm0, dword [0x101003c0]
vmovss dword [eax + 8], xmm0
vmovss xmm0, dword [0x10100548]
mov byte [eax], 0
vmovss dword [eax + 0xc], xmm0
mov dword [esi + 0x2c], eax
mov dword [ebp - 4], 0xffffffff
mov dword [edi + 0xc], esi
call fcn.100e12f9
push 0x30
mov word [eax], 1
mov byte [eax + 2], 1
mov dword [edi + 0x10], eax
call fcn.100e12f9
vmovss xmm0, dword [0x101004a0]
add esp, 0x1c
vmovss dword [eax], xmm0
vmovss xmm0, dword [0x10100494]
vmovss dword [eax + 4], xmm0
vmovss xmm0, dword [0x10100454]
mov dword [eax + 8], 0x1010001
vmovss dword [eax + 0xc], xmm0
mov dword [eax + 0x10], 0x19
mov dword [eax + 0x14], 0
mov dword [eax + 0x18], 0
mov dword [eax + 0x1c], 0
mov dword [eax + 0x20], 0
mov byte [eax + 0x24], 0
mov dword [eax + 0x28], 0x78
mov dword [eax + 0x2c], 0x14
mov dword [edi + 0x14], eax
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x10018340
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100e2b23
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x10111040]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
vmovss xmm1, dword [0x101003c0]
vxorps xmm0, xmm0, xmm0
vmovss dword [esi + 0x28], xmm0
vmovss xmm0, dword [0x101003e8]
vmovss dword [esi + 0x2c], xmm0
vmovss xmm0, dword [0x10100464]
vmovss dword [esi + 0x3c], xmm0
vmovss dword [esi + 0x48], xmm0
vmovss xmm0, dword [0x1010038c]
vmovss dword [esi + 0x50], xmm0
vmovss xmm0, dword [0x1010035c]
vmovss dword [esi + 0x58], xmm0
vmovss xmm0, dword [0x10100388]
vmovss dword [esi + 0x90], xmm0
vmovss xmm0, dword [0x101003d4]
vmovss dword [esi + 0x9c], xmm0
lea ecx, [esi + 0xb4]
mov dword [esi], 0x78
mov dword [esi + 4], 0x78
mov dword [esi + 8], 0x1010101
mov byte [esi + 0xc], 1
mov dword [esi + 0x10], 0
mov byte [esi + 0x14], 0
mov dword [esi + 0x18], 0
mov dword [esi + 0x1c], 0
mov dword [esi + 0x20], 0
mov dword [esi + 0x24], 0
mov dword [esi + 0x30], 0x10100
mov word [esi + 0x34], 0
vmovss dword [esi + 0x38], xmm1
mov word [esi + 0x40], 0
vmovss dword [esi + 0x44], xmm1
mov word [esi + 0x4c], 0
mov word [esi + 0x54], 0x100
mov byte [esi + 0x56], 0
mov word [esi + 0x5c], 0
mov dword [esi + 0x60], 0x5a
mov dword [esi + 0x64], 0
mov dword [esi + 0x68], 0
mov dword [esi + 0x6c], 0
mov dword [esi + 0x70], 0
mov byte [esi + 0x74], 0
mov dword [esi + 0x78], 0
vmovss dword [esi + 0x7c], xmm1
mov word [esi + 0x80], 0
mov byte [esi + 0x82], 0
mov dword [esi + 0x84], 0
vmovss dword [esi + 0x88], xmm1
mov word [esi + 0x8c], 0x100
mov dword [esi + 0x94], 0
mov byte [esi + 0x98], 0
mov byte [esi + 0xa0], 0
mov dword [esi + 0xa4], 0x50
mov dword [esi + 0xa8], 0x12c
mov dword [esi + 0xac], 0x12c
mov dword [esi + 0xb0], 0
vpxor xmm0, xmm0, xmm0
push 0
vmovdqu xmmword [ecx], xmm0
push 0x100f6ab3
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 0
call fcn.1001b6c0
mov dword [ebp - 4], 0
push 1
mov dword [esi + 0xcc], 0
mov word [esi + 0xd0], 0
mov dword [esi + 0xd4], 0x96
mov dword [esi + 0xd8], 8
mov dword [esi + 0xdc], 0
mov byte [esi + 0xe0], 0
mov dword [esi + 0xe4], 1
mov word [esi + 0xe8], 0
mov byte [esi + 0xea], 0
call fcn.100e12f9
push 0x14
mov byte [eax], 1
mov dword [esi + 0xec], eax
call fcn.100e12f9
mov byte [eax], 0
vmovss xmm0, dword [0x1010038c]
vmovss dword [eax + 0xc], xmm0
vmovss xmm0, dword [0x101003e8]
mov dword [eax + 4], 0
mov word [eax + 8], 0x101
vmovss dword [eax + 0x10], xmm0
push 0xc
mov dword [esi + 0xf0], eax
call fcn.100e12f9
add esp, 0xc
mov byte [eax], 1
mov dword [eax + 4], 0
mov dword [eax + 8], 0x1010101
mov dword [esi + 0xf4], eax
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x100185e0
Capabilities:
Access peb ldr_data
Check for peb beingdebugged flag

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100e2b72
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x10111040]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
push 0x14
mov word [edi], 0x101
mov byte [edi + 2], 1
mov dword [edi + 4], 0
mov word [edi + 8], 0x101
mov byte [edi + 0xa], 1
mov dword [edi + 0xc], 0
mov byte [edi + 0x10], 0
mov dword [edi + 0x14], 0
mov word [edi + 0x18], 0x101
mov byte [edi + 0x1a], 1
mov dword [edi + 0x1c], 0
mov byte [edi + 0x20], 1
call fcn.100e12f9
vmovss xmm0, dword [0x1010038c]
push 8
mov dword [eax], 0
vmovss dword [eax + 4], xmm0
mov dword [eax + 8], 0x15
mov dword [eax + 0xc], 0
mov dword [eax + 0x10], 0x1010101
mov dword [edi + 0x24], eax
call fcn.100e12f9
push 0x5c
mov byte [eax], 1
mov dword [eax + 4], 0
mov dword [edi + 0x28], eax
call fcn.100e12f9
vmovss xmm0, dword [0x1010038c]
push 0x2c
mov dword [eax], 0
vmovss dword [eax + 4], xmm0
mov byte [eax + 8], 0
mov dword [eax + 0xc], 0
mov dword [eax + 0x10], 0
mov dword [eax + 0x14], 0
mov dword [eax + 0x18], 0
mov dword [eax + 0x1c], 0
mov dword [eax + 0x20], 3
mov dword [eax + 0x24], 0xa
mov dword [eax + 0x28], 3
mov dword [eax + 0x2c], 0x4a
mov dword [eax + 0x30], 0x68
mov dword [eax + 0x34], 0
mov dword [eax + 0x38], 0
mov dword [eax + 0x3c], 3
mov dword [eax + 0x40], 0xa
mov dword [eax + 0x44], 3
mov dword [eax + 0x48], 0x4a
mov dword [eax + 0x4c], 0x68
mov dword [eax + 0x50], 0
mov byte [eax + 0x54], 0
mov dword [eax + 0x58], 0
mov dword [edi + 0x2c], eax
call fcn.100e12f9
mov esi, eax
mov dword [ebp - 0x10], esi
mov dword [ebp - 4], 0
push 0xc
mov byte [esi], 1
mov dword [esi + 4], 0
mov dword [esi + 8], 0
mov dword [esi + 0xc], 0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 2
mov dword [esi + 0x18], 0
mov dword [esi + 0x1c], 2
mov dword [esi + 0x20], 0x10001
mov byte [esi + 0x24], 0
call fcn.100e12f9
mov dword [ebp - 4], 0xffffffff
push 0x1c
mov byte [eax], 1
mov dword [eax + 4], 2
mov word [eax + 8], 1
mov dword [esi + 0x28], eax
mov dword [edi + 0x30], esi
call fcn.100e12f9
mov esi, eax
mov dword [ebp - 0x10], esi
mov dword [ebp - 4], 1
push 0xc
mov byte [esi], 1
mov dword [esi + 4], 0
mov byte [esi + 8], 0
mov dword [esi + 0xc], 0
mov dword [esi + 0x10], 0x1000101
mov byte [esi + 0x14], 0
call fcn.100e12f9
mov dword [ebp - 4], 0xffffffff
push 2
mov byte [eax], 1
mov dword [eax + 4], 0
mov byte [eax + 8], 1
mov dword [esi + 0x18], eax
mov dword [edi + 0x34], esi
call fcn.100e12f9
push 8
mov word [eax], 0x101
mov dword [edi + 0x38], eax
call fcn.100e12f9
mov esi, eax
mov dword [ebp - 0x10], esi
mov dword [ebp - 4], 2
push 0x10
mov word [esi], 0
call fcn.100e12f9
add esp, 0x28
mov dword [eax], 0
mov dword [eax + 4], 0
mov dword [eax + 8], 0
mov dword [eax + 0xc], 0
mov dword [esi + 4], eax
mov eax, edi
mov dword [edi + 0x3c], esi
mov dword [edi + 0x40], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x1001a2a0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_DisableThreadLibraryCalls]
cmp dword [ebp + 0xc], 1
jne 0x1001a2d3
push 0
push 0
push dword [ebp + 8]
push 0x1001a200
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
test eax, eax
je 0x1001a2d3
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 1
pop ebp
ret 0xc
Function at 0x100261c0
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
sub esp, 0x18
mov edx, dword [ebp + 8]
push ebx
mov ebx, ecx
cmp edx, eax
je 0x10026316
mov eax, dword [ebx + 4]
mov dword [ebp - 0x14], eax
mov eax, dword [edx + 4]
mov dword [ebp - 8], eax
movzx eax, byte [edx + 8]
xor eax, 0x811c9dc5
imul ecx, eax, 0x1000193
movzx eax, byte [edx + 9]
push esi
push edi
mov edi, dword [ebx + 0xc]
mov esi, edx
xor ecx, eax
mov dword [ebp - 0x18], edi
movzx eax, byte [edx + 0xa]
imul ecx, ecx, 0x1000193
xor ecx, eax
movzx eax, byte [edx + 0xb]
imul ecx, ecx, 0x1000193
xor ecx, eax
mov eax, dword [ebx + 0x18]
imul ecx, ecx, 0x1000193
and eax, ecx
mov ecx, dword [edi + eax*8]
mov dword [ebp - 4], ecx
lea eax, [edi + eax*8]
mov dword [ebp - 0xc], eax
mov eax, dword [eax + 4]
mov dword [ebp - 0x10], eax
mov eax, esi
mov edi, esi
mov esi, dword [esi]
push 0x10
push eax
call fcn.100e175d
dec dword [ebx + 8]
add esp, 8
cmp edi, dword [ebp - 0x10]
je 0x10026279
mov eax, dword [ebp + 0xc]
cmp esi, eax
jne 0x10026237
mov ecx, dword [ebp - 4]
cmp ecx, dword [ebp + 8]
jne 0x1002630c
mov edx, dword [ebp - 0xc]
mov ecx, dword [ebp - 8]
pop edi
mov dword [edx], esi
mov dword [ecx], esi
mov dword [esi + 4], ecx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
mov ecx, dword [ebp - 4]
mov edx, dword [ebp - 0xc]
cmp ecx, dword [ebp + 8]
jne 0x1002628d
mov eax, dword [ebp - 0x14]
mov ecx, eax
mov dword [edx], eax
jmp 0x10026290
mov ecx, dword [ebp - 8]
mov eax, dword [ebp + 0xc]
mov dword [edx + 4], ecx
cmp esi, eax
je 0x1002630c
nop word [eax + eax]
movzx eax, byte [esi + 8]
xor eax, 0x811c9dc5
imul ecx, eax, 0x1000193
movzx eax, byte [esi + 9]
xor ecx, eax
movzx eax, byte [esi + 0xa]
imul ecx, ecx, 0x1000193
xor ecx, eax
movzx eax, byte [esi + 0xb]
imul ecx, ecx, 0x1000193
xor ecx, eax
mov eax, dword [ebx + 0x18]
imul ecx, ecx, 0x1000193
and eax, ecx
mov ecx, dword [ebp - 0x18]
lea eax, [ecx + eax*8]
mov dword [ebp - 4], eax
mov eax, dword [eax + 4]
mov dword [ebp - 0x10], eax
mov eax, esi
mov edi, esi
mov esi, dword [esi]
push 0x10
push eax
call fcn.100e175d
dec dword [ebx + 8]
add esp, 8
mov eax, dword [ebp + 0xc]
cmp edi, dword [ebp - 0x10]
je 0x1002631d
cmp esi, eax
jne 0x100262e7
mov ecx, dword [ebp - 4]
mov dword [ecx], esi
mov ecx, dword [ebp - 8]
pop edi
mov dword [ecx], esi
mov dword [esi + 4], ecx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
mov ecx, dword [ebp - 4]
mov edx, dword [ebp - 0x14]
mov dword [ecx], edx
mov dword [ecx + 4], edx
cmp esi, eax
jne 0x100262a0
mov ecx, dword [ebp - 8]
pop edi
mov dword [ecx], esi
mov dword [esi + 4], ecx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x1002eff0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100e44bf
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x10111040]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
vpxor xmm0, xmm0, xmm0
mov dword [esi], 0xc8
mov dword [esi + 4], 0xc8
mov dword [esi + 8], 0x1f7
mov dword [esi + 0xc], 0x1ae
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
mov dword [esi + 0x18], 0
mov dword [esi + 0x1c], 0
mov byte [esi + 0x20], 0
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x2c], 0
mov dword [esi + 0x30], 0
vmovups ymmword [esi + 0x34], ymm0
vmovdqu xmmword [esi + 0x54], xmm0
mov dword [esi + 0x64], 0
mov dword [esi + 0x68], 0
mov dword [esi + 0x6c], 0
mov dword [esi + 0x70], 0
mov dword [esi + 0x74], 0
push 0x30
vzeroupper
call fcn.100e12f9
vpxor xmm0, xmm0, xmm0
push 0x18
mov dword [eax], 0
vmovdqu xmmword [eax + 4], xmm0
vmovss dword [eax + 0x14], xmm0
vmovq qword [eax + 0x18], xmm0
mov dword [eax + 0x20], 0
vmovq qword [eax + 0x24], xmm0
mov dword [eax + 0x2c], 0
mov dword [esi + 0x78], eax
mov byte [esi + 0x7c], 0
call fcn.100e12f9
vpxor xmm0, xmm0, xmm0
push 0x18
mov dword [eax], 0
vmovdqu xmmword [eax + 4], xmm0
vmovss dword [eax + 0x14], xmm0
mov dword [esi + 0x80], eax
call fcn.100e12f9
vpxor xmm0, xmm0, xmm0
push 0x24
mov dword [eax], 0
vmovdqu xmmword [eax + 4], xmm0
vmovss dword [eax + 0x14], xmm0
mov dword [esi + 0x84], eax
call fcn.100e12f9
vpxor xmm0, xmm0, xmm0
push 0x24
mov dword [eax + 4], 0
mov dword [eax + 8], 0
mov dword [eax + 0xc], 0
mov dword [eax], 0
vmovdqu xmmword [eax + 0x10], xmm0
vmovss dword [eax + 0x20], xmm0
mov dword [esi + 0x88], eax
call fcn.100e12f9
vpxor xmm0, xmm0, xmm0
add esp, 0x14
mov dword [eax + 4], 0
mov dword [eax + 8], 0
mov dword [eax + 0xc], 0
mov dword [eax], 0
vmovdqu xmmword [eax + 0x10], xmm0
vmovss dword [eax + 0x20], xmm0
mov dword [esi + 0x8c], eax
vmovdqu xmmword [esi + 0x90], xmm0
mov dword [esi + 0xa0], 0
mov dword [esi + 0xa4], 0xf
mov byte [esi + 0x90], 0
mov dword [ebp - 4], 0
mov dword [esi + 0xa8], 0
mov dword [esi + 0xac], 0
mov dword [esi + 0xb0], 0
mov dword [esi + 0xb4], 0
mov dword [esi + 0xb8], 0
mov byte [ebp - 4], 1
lea ecx, [esi + 0xc0]
push 0x100f6ab3
mov word [esi + 0xbc], 0
call fcn.1001ad20
push 0x100f6ab3
lea ecx, [esi + 0xd8]
mov byte [ebp - 4], 2
call fcn.1001ad20
vpxor xmm0, xmm0, xmm0
vmovdqu xmmword [esi + 0xf0], xmm0
mov dword [esi + 0x100], 0
mov eax, esi
mov dword [esi + 0x104], 0xf
mov byte [esi + 0xf0], 0
vmovdqu xmmword [esi + 0x108], xmm0
mov dword [esi + 0x118], 0
mov dword [esi + 0x11c], 0xf
mov byte [esi + 0x108], 0
mov word [esi + 0x120], 0
mov dword [esi + 0x124], 0
mov dword [esi + 0x128], 0
mov dword [esi + 0x12c], 0
mov dword [esi + 0x130], 0
mov dword [esi + 0x134], 0
mov dword [esi + 0x138], 0
mov dword [esi + 0x13c], 0
mov dword [esi + 0x140], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x10035ed0
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [ebp + 0xc]
mov edx, ecx
push ebx
mov ebx, dword [ebp + 8]
mov dword [ebp - 0x14], edx
cmp ebx, eax
je 0x10036041
mov eax, dword [edx + 4]
mov dword [ebp - 0x18], eax
mov eax, dword [ebx + 4]
mov dword [ebp - 8], eax
movzx eax, byte [ebx + 8]
xor eax, 0x811c9dc5
imul ecx, eax, 0x1000193
movzx eax, byte [ebx + 9]
push esi
push edi
mov edi, dword [edx + 0xc]
mov esi, ebx
xor ecx, eax
mov dword [ebp - 0x1c], edi
movzx eax, byte [ebx + 0xa]
imul ecx, ecx, 0x1000193
xor ecx, eax
movzx eax, byte [ebx + 0xb]
imul ecx, ecx, 0x1000193
xor ecx, eax
mov eax, dword [edx + 0x18]
imul ecx, ecx, 0x1000193
and eax, ecx
mov ecx, dword [edi + eax*8]
mov dword [ebp - 4], ecx
lea eax, [edi + eax*8]
mov dword [ebp - 0xc], eax
mov eax, dword [eax + 4]
mov dword [ebp - 0x10], eax
nop word [eax + eax]
mov edi, esi
mov ebx, esi
mov esi, dword [esi]
lea ecx, [edi + 0xc]
call fcn.100332d0
push 0x18
push edi
call fcn.100e175d
mov edx, dword [ebp - 0x14]
add esp, 8
dec dword [edx + 8]
cmp ebx, dword [ebp - 0x10]
je 0x10035f9d
mov eax, dword [ebp + 0xc]
cmp esi, eax
jne 0x10035f50
mov ecx, dword [ebp - 4]
cmp ecx, dword [ebp + 8]
jne 0x10036037
mov edi, dword [ebp - 0xc]
mov ecx, dword [ebp - 8]
mov dword [edi], esi
mov dword [ecx], esi
pop edi
mov dword [esi + 4], ecx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
mov ecx, dword [ebp - 4]
mov edi, dword [ebp - 0xc]
cmp ecx, dword [ebp + 8]
jne 0x10035fb1
mov eax, dword [ebp - 0x18]
mov ecx, eax
mov dword [edi], eax
jmp 0x10035fb4
mov ecx, dword [ebp - 8]
mov eax, dword [ebp + 0xc]
mov dword [edi + 4], ecx
cmp esi, eax
je 0x10036037
nop
movzx eax, byte [esi + 8]
xor eax, 0x811c9dc5
imul ecx, eax, 0x1000193
movzx eax, byte [esi + 9]
xor ecx, eax
movzx eax, byte [esi + 0xa]
imul ecx, ecx, 0x1000193
xor ecx, eax
movzx eax, byte [esi + 0xb]
imul ecx, ecx, 0x1000193
xor ecx, eax
mov eax, dword [edx + 0x18]
imul ecx, ecx, 0x1000193
and eax, ecx
mov ecx, dword [ebp - 0x1c]
lea eax, [ecx + eax*8]
mov dword [ebp - 4], eax
mov eax, dword [eax + 4]
mov dword [ebp - 0x10], eax
mov edi, esi
mov ebx, esi
mov esi, dword [esi]
lea ecx, [edi + 0xc]
call fcn.100332d0
push 0x18
push edi
call fcn.100e175d
mov edx, dword [ebp - 0x14]
add esp, 8
mov eax, dword [ebp + 0xc]
dec dword [edx + 8]
cmp ebx, dword [ebp - 0x10]
je 0x10036048
cmp esi, eax
jne 0x10036007
mov ecx, dword [ebp - 4]
mov dword [ecx], esi
mov ecx, dword [ebp - 8]
pop edi
mov dword [ecx], esi
mov dword [esi + 4], ecx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
mov ecx, dword [ebp - 4]
mov ebx, dword [ebp - 0x18]
mov dword [ecx], ebx
mov dword [ecx + 4], ebx
cmp esi, eax
jne 0x10035fc0
mov ecx, dword [ebp - 8]
pop edi
mov dword [ecx], esi
mov dword [esi + 4], ecx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8