joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10013dd0
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
mov ebx, dword [ebp + 0xc]
movzx eax, bl
xor eax, 0x811c9dc5
imul edx, eax, 0x1000193
mov eax, ebx
shr eax, 8
movzx eax, al
push esi
push edi
xor edx, eax
mov edi, ecx
mov eax, ebx
imul ecx, edx, 0x1000193
shr eax, 0x10
movzx eax, al
shr ebx, 0x18
mov dword [ebp - 4], edi
xor ecx, eax
imul eax, ecx, 0x1000193
lea ecx, [edi + 0x50]
xor eax, ebx
imul ebx, eax, 0x1000193
lea eax, [ebp + 0xc]
push ebx
push eax
lea eax, [ebp - 0xc]
push eax
call fcn.1000f5c0
mov edx, dword [eax + 4]
test edx, edx
je 0x10013e7d
mov ecx, dword [edi + 0x68]
mov eax, dword [edi + 0x5c]
and ecx, ebx
lea ecx, [eax + ecx*8]
mov eax, dword [ecx]
cmp dword [ecx + 4], edx
jne 0x10013e5a
cmp eax, edx
jne 0x10013e52
mov eax, dword [edi + 0x54]
mov dword [ecx], eax
mov dword [ecx + 4], eax
jmp 0x10013e62
mov eax, dword [edx + 4]
mov dword [ecx + 4], eax
jmp 0x10013e62
cmp eax, edx
jne 0x10013e62
mov eax, dword [edx]
mov dword [ecx], eax
mov ecx, dword [edx]
dec dword [edi + 0x58]
mov eax, dword [edx + 4]
push 0xc
push edx
mov dword [eax], ecx
mov eax, dword [edx + 4]
mov dword [ecx + 4], eax
call fcn.100bc017
add esp, 8
mov edx, dword [ebp + 8]
lea esi, [edi + 0x10]
movzx eax, dl
xor eax, 0x811c9dc5
imul ecx, eax, 0x1000193
movzx eax, dh
xor ecx, eax
movzx eax, byte [ebp + 0xa]
imul ecx, ecx, 0x1000193
xor ecx, eax
movzx eax, byte [ebp + 0xb]
imul ecx, ecx, 0x1000193
xor ecx, eax
lea eax, [ebp + 8]
imul edi, ecx, 0x1000193
mov ecx, esi
push edi
push eax
lea eax, [ebp - 0xc]
push eax
call fcn.1000f5c0
mov ecx, dword [eax + 4]
test ecx, ecx
jne 0x10013ece
mov ecx, dword [esi + 4]
mov eax, dword [ebp - 4]
cmp ecx, dword [eax + 0x14]
je 0x10013f4d
mov eax, dword [ecx + 0x10]
cmp eax, 1
jne 0x10013f49
push edi
lea eax, [ebp + 8]
mov ecx, esi
push eax
lea eax, [ebp - 0x14]
push eax
call fcn.1000f5c0
mov edx, dword [eax + 4]
test edx, edx
je 0x10013f4d
mov ecx, dword [esi + 0x18]
mov eax, dword [esi + 0xc]
and ecx, edi
lea ecx, [eax + ecx*8]
mov eax, dword [ecx]
cmp dword [ecx + 4], edx
jne 0x10013f1d
cmp eax, edx
jne 0x10013f15
mov eax, dword [esi + 4]
mov dword [ecx], eax
mov dword [ecx + 4], eax
jmp 0x10013f25
mov eax, dword [edx + 4]
mov dword [ecx + 4], eax
jmp 0x10013f25
cmp eax, edx
jne 0x10013f25
mov eax, dword [edx]
mov dword [ecx], eax
mov ecx, dword [edx]
dec dword [esi + 8]
mov eax, dword [edx + 4]
push 0x14
push edx
mov dword [eax], ecx
mov eax, dword [edx + 4]
mov dword [ecx + 4], eax
call fcn.100bc017
add esp, 8
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
dec eax
mov dword [ecx + 0x10], eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x10014580
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push esi
mov esi, dword [ebp + 0xc]
mov edx, dword [esi + 4]
test edx, edx
jne 0x1001459d
mov edx, dword [ecx + 0xc]
lea eax, [edx + 1]
mov dword [ecx + 0xc], eax
mov dword [esi + 4], edx
lea esi, [ecx + 0x10]
movzx eax, dl
xor eax, 0x811c9dc5
mov dword [ebp + 0xc], edx
imul ecx, eax, 0x1000193
mov eax, edx
shr eax, 8
movzx eax, al
xor ecx, eax
mov eax, edx
shr eax, 0x10
imul ecx, ecx, 0x1000193
movzx eax, al
shr edx, 0x18
xor ecx, eax
imul eax, ecx, 0x1000193
mov ecx, esi
xor eax, edx
imul eax, eax, 0x1000193
push eax
lea eax, [ebp + 0xc]
push eax
lea eax, [ebp - 8]
push eax
call fcn.1000f5c0
mov ecx, dword [eax + 4]
test ecx, ecx
je 0x10014609
cmp ecx, dword [esi + 4]
je 0x10014609
mov eax, dword [ebp + 8]
mov ecx, dword [ecx + 0xc]
pop esi
mov dword [eax], ecx
mov al, 1
mov esp, ebp
pop ebp
ret 8
xor al, al
pop esi
mov esp, ebp
pop ebp
ret 8

Function at 0x100147b0
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100eb255
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push ebx
push esi
push edi
mov eax, dword [0x101eb100]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov ebx, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
movzx eax, byte [ebx]
xor eax, 0x811c9dc5
imul edx, eax, 0x1000193
movzx eax, byte [ebx + 1]
xor edx, eax
movzx eax, byte [ebx + 2]
imul ecx, edx, 0x1000193
xor ecx, eax
movzx eax, byte [ebx + 3]
imul ecx, ecx, 0x1000193
xor ecx, eax
imul eax, ecx, 0x1000193
mov ecx, edi
push eax
mov dword [ebp + 8], eax
lea eax, [ebp - 0x14]
push ebx
push eax
call fcn.1000f5c0
mov eax, dword [ebp - 0x10]
test eax, eax
je 0x10014832
mov dword [esi], eax
xor al, al
jmp 0x100148e4
cmp dword [edi + 8], 0x15555555
je 0x10014904
lea eax, [edi + 4]
mov dword [ebp - 0x1c], eax
push 0xc
mov dword [ebp - 4], 0
mov dword [ebp - 0x18], 0
call fcn.100bbfe7
mov dword [ebp - 0x18], eax
add esp, 4
lea ecx, [eax + 8]
mov eax, dword [ebx]
mov dword [ebp + 0xc], ecx
mov dword [ecx], eax
mov eax, dword [edi + 8]
inc eax
mov dword [ebp - 4], 1
movd xmm0, eax
cvtdq2pd xmm0, xmm0
shr eax, 0x1f
addsd xmm0, qword [eax*8 + 0x100f1ba0]
mov eax, dword [edi + 0x1c]
cvtpd2ps xmm1, xmm0
movd xmm0, eax
cvtdq2pd xmm0, xmm0
shr eax, 0x1f
addsd xmm0, qword [eax*8 + 0x100f1ba0]
cvtpd2ps xmm0, xmm0
divss xmm1, xmm0
comiss xmm1, dword [edi]
jbe 0x100148ce
mov ecx, edi
call fcn.10012930
mov ebx, dword [ebp + 8]
lea eax, [ebp - 0x14]
push ebx
push dword [ebp + 0xc]
mov ecx, edi
push eax
call fcn.1000f5c0
mov ecx, dword [eax]
jmp 0x100148d4
mov ecx, dword [ebp - 0x14]
mov ebx, dword [ebp + 8]
push dword [ebp - 0x18]
push ecx
push ebx
mov ecx, edi
call fcn.10012840
mov dword [esi], eax
mov al, 1
mov edx, 4
mov ecx, esi
mov byte [ecx + edx], al
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
push str.unordered_map_set_too_long
call fcn.100baafd
int3
Function at 0x1001c340
Capabilities:
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
or edx, 0xffffffff
mov al, 0x23
push ebx
push esi
push edi
mov edi, dword [0x101ee94c]
mov esi, 0x100f7c4d
or ebx, 0xffffffff
nop dword [eax]
cmp al, 0x23
jne 0x1001c36e
cmp byte [esi], al
jne 0x1001c36e
cmp byte [esi + 1], al
cmove edx, ebx
movzx ecx, dl
movzx eax, al
xor ecx, eax
shr edx, 8
mov al, byte [esi]
inc esi
xor edx, dword [ecx*4 + 0x100f1bb8]
test al, al
jne 0x1001c360
not edx
push edx
call fcn.10021700
add esp, 4
cmp byte [edi + 0xc8], 0
je 0x1001c3ac
test eax, eax
je 0x1001c3ac
cmp byte [eax + 0xbb], 0
je 0x1001c3ac
mov bl, 1
jmp 0x1001c3ae
xor bl, bl
movss xmm2, dword [0x100f91b8]
lea eax, [ebp - 0x24]
movss xmm0, dword [edi + 0x39f8]
lea ecx, [edi + 0x4a60]
movss xmm1, dword [0x100f9170]
movaps xmm3, xmm2
subss xmm3, xmm0
mov dword [ebp - 0x24], 4
xorps xmm4, xmm4
push eax
mulss xmm3, xmm1
addss xmm3, xmm0
movss xmm0, dword [edi + 0x39fc]
subss xmm4, xmm0
movss dword [ebp - 4], xmm3
xorps xmm3, xmm3
mulss xmm4, xmm1
addss xmm4, xmm0
movss xmm0, dword [edi + 0x3a00]
subss xmm3, xmm0
movss dword [ebp - 8], xmm4
mulss xmm3, xmm1
addss xmm3, xmm0
movss xmm0, dword [edi + 0x3a04]
subss xmm2, xmm0
movss dword [ebp - 0xc], xmm3
mulss xmm2, xmm1
addss xmm2, xmm0
movups xmm0, xmmword [edi + 0x39f8]
movups xmmword [ebp - 0x20], xmm0
movss dword [ebp - 0x10], xmm2
call fcn.100349a0
cmp dword [edi + 0x4a5c], 4
je 0x1001c489
movss xmm0, dword [ebp - 4]
movss dword [edi + 0x39f8], xmm0
movss xmm0, dword [ebp - 8]
movss dword [edi + 0x39fc], xmm0
movss xmm0, dword [ebp - 0xc]
movss dword [edi + 0x3a00], xmm0
movss xmm0, dword [ebp - 0x10]
movss dword [edi + 0x3a04], xmm0
test bl, bl
je 0x1001c4d0
mov edx, dword [0x101ee94c]
or dword [edx + 0x49f0], 1
mov eax, dword [edi + 0x5174]
mov ecx, dword [edi + 0x5178]
mov dword [edx + 0x4a00], eax
mov dword [edx + 0x4a04], ecx
mov dword [edx + 0x4a08], 0
mov dword [edx + 0x4a0c], 0
mov dword [edx + 0x49f4], 1
push 0x200016f
push 0
push str.Tooltip_Error
call fcn.10019710
push 1
mov bl, al
call fcn.1002b940
add esp, 0x10
test bl, bl
je 0x1001c552
mov ecx, dword [edi + 0x4004]
cmp word [ecx + 0xc8], 1
jne 0x1001c557
push str.MESSAGE_FROM_DEAR_IMGUI
call fcn.1004d000
push dword [edi + 0x4004]
call fcn.1001c880
push dword [edi + 0x4004]
call fcn.1001c9d0
mov eax, dword [0x101ee94c]
add esp, 0xc
mov eax, dword [eax + 0x4004]
movss xmm0, dword [eax + 0x18]
movss xmm1, dword [eax + 0x1c]
mov al, bl
movss dword [edi + 0x5174], xmm0
movss dword [edi + 0x5178], xmm1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
call fcn.1001f700
pop edi
pop esi
mov al, bl
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x100220a0
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, ecx
cmp dword [edi + 0xf4], 0
jg 0x100220c8
push 0x832
push str.D:CheatAbuserMTA_SexcutorClientmodsdeathmatchAbuserMTAMenuImGuiimgui.h
push str.Size___0
call fcn.100c31de
add esp, 0xc
mov eax, dword [edi + 0xf4]
lea edx, [ebp + 8]
mov ebx, dword [edi + 0xfc]
mov esi, 4
mov ebx, dword [ebx + eax*4 - 4]
not ebx
movzx eax, byte [edx]
lea edx, [edx + 1]
movzx ecx, bl
xor ecx, eax
shr ebx, 8
xor ebx, dword [ecx*4 + 0x100f1bb8]
sub esi, 1
jne 0x100220e2
mov eax, dword [edi]
not ebx
cmp dword [eax + 0x4044], ebx
jne 0x10022117
push esi
push dword [ebp + 8]
push 4
push ebx
call fcn.1001ed80
add esp, 0x10
pop edi
pop esi
mov eax, ebx
pop ebx
pop ebp
ret 4

Function at 0x10023300
Capabilities:
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 0x10]
push esi
mov esi, dword [ebp + 8]
not ebx
push edi
mov edi, dword [ebp + 0xc]
mov eax, ebx
test edi, edi
je 0x10023363
mov cl, byte [esi]
lea esi, [esi + 1]
dec edi
cmp cl, 0x23
jne 0x10023346
cmp edi, 2
jb 0x10023346
cmp byte [esi], cl
jne 0x10023346
cmp byte [esi + 1], cl
jne 0x10023346
mov eax, ebx
movzx ecx, cl
movzx edx, al
xor edx, ecx
shr eax, 8
xor eax, dword [edx*4 + 0x100f1bb8]
jmp 0x10023317
movzx edx, al
movzx ecx, cl
xor edx, ecx
shr eax, 8
xor eax, dword [edx*4 + 0x100f1bb8]
test edi, edi
jne 0x10023317
pop edi
pop esi
not eax
pop ebx
pop ebp
ret
mov cl, byte [esi]
inc esi
test cl, cl
je 0x10023398
nop word [eax + eax]
cmp cl, 0x23
jne 0x1002337f
cmp byte [esi], cl
jne 0x1002337f
cmp byte [esi + 1], cl
cmove eax, ebx
movzx edx, al
movzx ecx, cl
xor edx, ecx
shr eax, 8
mov cl, byte [esi]
inc esi
xor eax, dword [edx*4 + 0x100f1bb8]
test cl, cl
jne 0x10023370
pop edi
pop esi
not eax
pop ebx
pop ebp
ret
Function at 0x1003d870
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push esi
mov esi, ecx
mov eax, dword [esi + 8]
test eax, eax
je 0x1003d897
push eax
mov dword [esi + 4], 0
mov dword [esi], 0
call fcn.10025b50
add esp, 4
mov dword [esi + 8], 0
mov eax, dword [esi + 0x14]
test eax, eax
je 0x1003d8bc
push eax
mov dword [esi + 0x10], 0
mov dword [esi + 0xc], 0
call fcn.10025b50
add esp, 4
mov dword [esi + 0x14], 0
mov eax, dword [esi + 0x20]
test eax, eax
je 0x1003d8e1
push eax
mov dword [esi + 0x1c], 0
mov dword [esi + 0x18], 0
call fcn.10025b50
add esp, 4
mov dword [esi + 0x20], 0
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x30], 0
mov dword [esi + 0x34], 0
mov eax, dword [esi + 0x78]
test eax, eax
je 0x1003d922
push eax
mov dword [esi + 0x74], 0
mov dword [esi + 0x70], 0
call fcn.10025b50
add esp, 4
mov dword [esi + 0x78], 0
mov eax, dword [esi + 0x84]
test eax, eax
je 0x1003d950
push eax
mov dword [esi + 0x80], 0
mov dword [esi + 0x7c], 0
call fcn.10025b50
add esp, 4
mov dword [esi + 0x84], 0
mov eax, dword [esi + 0x40]
test eax, eax
je 0x1003d975
push eax
mov dword [esi + 0x3c], 0
mov dword [esi + 0x38], 0
call fcn.10025b50
add esp, 4
mov dword [esi + 0x40], 0
lea ecx, [esi + 0x5c]
pop esi
jmp fcn.10038620
Function at 0x10047050
Capabilities:
Get geographical location
Get keyboard layout

Disassembly:
push esi
call fcn.10021f90
test eax, eax
je 0x10047064
call fcn.100221a0
mov esi, dword [eax + 0x70]
jmp 0x10047066
xor esi, esi
push 0
call dword [sym.imp.USER32.dll_GetKeyboardLayout]
push 4
add esi, 0x24
shr eax, 0x10
push esi
push 0x20001004
push eax
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
test eax, eax
jne 0x10047089
mov dword [esi], eax
pop esi
ret
Function at 0x10052f60
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100ebd75
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push esi
push edi
mov eax, dword [0x101eb100]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x10], edi
mov edx, dword [ebp + 0xc]
mov dword [ebp - 0x14], edx
cmp dword [edx + 0x14], 0xf
jbe 0x10052f9d
mov eax, dword [edx]
mov dword [ebp - 0x14], eax
xor ecx, ecx
mov esi, 0x811c9dc5
cmp dword [edx + 0x10], ecx
jbe 0x10052fc5
mov edi, dword [ebp - 0x14]
nop dword [eax]
movzx eax, byte [edi + ecx]
inc ecx
xor eax, esi
imul esi, eax, 0x1000193
cmp ecx, dword [edx + 0x10]
jb 0x10052fb0
mov edi, dword [ebp - 0x10]
push esi
push edx
lea eax, [ebp - 0x18]
mov ecx, edi
push eax
call fcn.10051850
mov ecx, dword [ebp - 0x14]
test ecx, ecx
je 0x10052ff5
mov eax, dword [ebp + 8]
mov dword [eax], ecx
mov byte [eax + 4], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 8
cmp dword [edi + 8], 0x7ffffff
je 0x1005313b
lea eax, [edi + 4]
mov dword [ebp - 0x20], eax
push 0x20
mov dword [ebp - 4], 0
mov dword [ebp - 0x1c], 0
call fcn.100bbfe7
mov edi, eax
xorps xmm0, xmm0
mov eax, dword [ebp + 0xc]
add esp, 4
mov dword [ebp - 0x1c], edi
movups xmmword [edi + 8], xmm0
mov dword [edi + 0x18], 0
mov dword [edi + 0x1c], 0
movups xmm0, xmmword [eax]
movups xmmword [edi + 8], xmm0
movq xmm0, qword [eax + 0x10]
movq qword [edi + 0x18], xmm0
mov dword [eax + 0x10], 0
mov dword [eax + 0x14], 0xf
mov byte [eax], 0
mov ecx, dword [ebp - 0x10]
mov dword [ebp - 4], 1
mov edx, dword [ecx + 8]
inc edx
mov eax, edx
shr eax, 0x1f
movd xmm0, edx
cvtdq2pd xmm0, xmm0
addsd xmm0, qword [eax*8 + 0x100f1ba0]
mov eax, dword [ecx + 0x1c]
cvtpd2ps xmm1, xmm0
movd xmm0, eax
cvtdq2pd xmm0, xmm0
shr eax, 0x1f
addsd xmm0, qword [eax*8 + 0x100f1ba0]
cvtpd2ps xmm0, xmm0
divss xmm1, xmm0
comiss xmm1, dword [ecx]
jbe 0x100530d8
push edx
call fcn.10061700
mov ecx, dword [ebp - 0x10]
push eax
call fcn.10062500
mov ecx, dword [ebp - 0x10]
lea eax, [edi + 8]
push esi
push eax
lea eax, [ebp - 0x18]
push eax
call fcn.10051850
mov ecx, dword [ebp - 0x10]
mov edx, dword [eax]
mov eax, dword [eax + 4]
mov dword [ebp - 0x14], eax
jmp 0x100530db
mov edx, dword [ebp - 0x18]
mov eax, dword [edx + 4]
inc dword [ecx + 8]
mov dword [edi + 4], eax
mov dword [edi], edx
mov dword [eax], edi
mov dword [edx + 4], edi
mov dword [ebp - 0x14], eax
mov eax, dword [ecx + 0x18]
and eax, esi
mov dword [ebp + 0xc], edx
mov edx, dword [ecx + 0xc]
mov esi, dword [ebp - 0x20]
mov ecx, dword [edx + eax*8]
cmp ecx, dword [esi]
jne 0x10053108
mov dword [edx + eax*8], edi
jmp 0x1005311b
cmp ecx, dword [ebp + 0xc]
jne 0x10053112
mov dword [edx + eax*8], edi
jmp 0x1005311f
mov ecx, dword [ebp - 0x14]
cmp dword [edx + eax*8 + 4], ecx
jne 0x1005311f
mov dword [edx + eax*8 + 4], edi
mov eax, dword [ebp + 8]
mov dword [eax], edi
mov byte [eax + 4], 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 8
push str.unordered_map_set_too_long
call fcn.100baafd
int3
Function at 0x10062370
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov edx, dword [ebp + 8]
mov eax, 0x1fffffff
push ebx
mov ebx, ecx
bsr ecx, eax
push esi
mov esi, 1
mov dword [ebp - 0x10], ebx
mov eax, esi
shl eax, cl
push edi
cmp edx, eax
ja 0x100624ed
lea eax, [edx - 1]
or eax, esi
bsr ecx, eax
mov eax, dword [ebx + 4]
push eax
mov dword [ebp + 8], eax
lea ecx, [ecx + 1]
shl esi, cl
lea ecx, [ebx + 0xc]
lea eax, [esi + esi]
push eax
call fcn.10012280
lea eax, [esi - 1]
mov dword [ebx + 0x1c], esi
mov dword [ebx + 0x18], eax
mov esi, dword [ebx + 4]
mov eax, dword [ebp + 8]
mov esi, dword [esi]
mov edi, esi
cmp esi, eax
je 0x100624c8
cmp dword [esi + 0x1c], 0xf
lea ecx, [esi + 8]
mov edi, dword [edi]
mov edx, dword [ecx + 0x10]
mov dword [ebp - 0xc], edi
mov dword [ebp - 8], edx
mov dword [ebp - 4], ecx
jbe 0x100623f1
mov edx, dword [ecx]
mov dword [ebp - 4], edx
xor edx, edx
mov ebx, 0x811c9dc5
cmp dword [ecx + 0x10], edx
jbe 0x1006241a
mov eax, dword [ebp - 4]
mov edi, dword [ebp - 8]
movzx ecx, byte [eax + edx]
inc edx
xor ecx, ebx
imul ebx, ecx, 0x1000193
cmp edx, edi
jb 0x10062403
mov edi, dword [ebp - 0xc]
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0x10]
mov edx, dword [ecx + 0x18]
mov ecx, dword [ecx + 0xc]
and edx, ebx
lea ecx, [ecx + edx*8]
mov dword [ebp - 4], ecx
cmp dword [ecx], eax
jne 0x10062439
mov dword [ecx], esi
mov dword [ecx + 4], esi
jmp 0x100624be
mov ebx, dword [ecx + 4]
lea eax, [ebx + 8]
push eax
lea eax, [esi + 8]
push eax
call fcn.1004daf0
add esp, 8
test al, al
je 0x10062476
mov ebx, dword [ebx]
cmp ebx, esi
je 0x1006246e
mov edx, dword [esi + 4]
mov dword [edx], edi
mov ecx, dword [edi + 4]
mov dword [ecx], ebx
mov eax, dword [ebx + 4]
mov dword [eax], esi
mov dword [ebx + 4], ecx
mov dword [edi + 4], edx
mov dword [esi + 4], eax
mov eax, dword [ebp - 4]
mov dword [eax + 4], esi
jmp 0x100624bb
mov eax, dword [ebp - 4]
cmp dword [eax], ebx
je 0x1006249e
nop dword [eax]
mov ebx, dword [ebx + 4]
lea eax, [ebx + 8]
push eax
lea eax, [esi + 8]
push eax
call fcn.1004daf0
add esp, 8
test al, al
jne 0x100624d1
mov eax, dword [ebp - 4]
cmp dword [eax], ebx
jne 0x10062480
mov edx, dword [esi + 4]
mov dword [edx], edi
mov ecx, dword [edi + 4]
mov dword [ecx], ebx
mov eax, dword [ebx + 4]
mov dword [eax], esi
mov dword [ebx + 4], ecx
mov dword [edi + 4], edx
mov dword [esi + 4], eax
mov eax, dword [ebp - 4]
mov dword [eax], esi
mov eax, dword [ebp + 8]
mov esi, edi
cmp edi, eax
jne 0x100623d5
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
mov edx, dword [esi + 4]
mov ebx, dword [ebx]
mov dword [edx], edi
mov ecx, dword [edi + 4]
mov dword [ecx], ebx
mov eax, dword [ebx + 4]
mov dword [eax], esi
mov dword [ebx + 4], ecx
mov dword [edi + 4], edx
mov dword [esi + 4], eax
jmp 0x100624bb
push str.invalid_hash_bucket_count
call fcn.100baafd
int3
Function at 0x10062500
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov edx, dword [ebp + 8]
mov eax, 0x1fffffff
push ebx
push esi
push edi
mov edi, ecx
mov esi, 1
bsr ecx, eax
mov eax, esi
mov dword [ebp - 0xc], edi
shl eax, cl
cmp edx, eax
ja 0x1006266b
mov ebx, dword [edi + 4]
lea eax, [edx - 1]
or eax, esi
mov dword [ebp - 4], ebx
bsr ecx, eax
push ebx
lea ecx, [ecx + 1]
shl esi, cl
lea ecx, [edi + 0xc]
lea eax, [esi + esi]
push eax
call fcn.10012280
lea eax, [esi - 1]
mov dword [edi + 0x1c], esi
mov dword [edi + 0x18], eax
mov edi, dword [edi + 4]
mov edi, dword [edi]
cmp edi, ebx
je 0x10062646
mov esi, edi
cmp dword [esi + 0x1c], 0xf
lea ebx, [esi + 8]
mov edi, dword [edi]
mov ecx, dword [esi + 0x18]
mov dword [ebp - 8], edi
mov dword [ebp + 8], ecx
jbe 0x10062579
mov ebx, dword [esi + 8]
xor ecx, ecx
mov edx, 0x811c9dc5
cmp dword [esi + 0x18], ecx
jbe 0x1006259c
mov edi, dword [ebp + 8]
movzx eax, byte [ebx + ecx]
inc ecx
xor eax, edx
imul edx, eax, 0x1000193
cmp ecx, edi
jb 0x10062588
mov edi, dword [ebp - 8]
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 4]
and edx, dword [eax + 0x18]
mov eax, dword [eax + 0xc]
lea eax, [eax + edx*8]
mov dword [ebp + 8], eax
cmp dword [eax], ecx
jne 0x100625bc
mov dword [eax], esi
mov dword [eax + 4], esi
jmp 0x1006263b
mov ebx, dword [eax + 4]
lea eax, [ebx + 8]
push eax
lea eax, [esi + 8]
push eax
call fcn.1004daf0
add esp, 8
test al, al
je 0x100625f9
mov ebx, dword [ebx]
cmp ebx, esi
je 0x100625f1
mov edx, dword [esi + 4]
mov dword [edx], edi
mov ecx, dword [edi + 4]
mov dword [ecx], ebx
mov eax, dword [ebx + 4]
mov dword [eax], esi
mov dword [ebx + 4], ecx
mov dword [edi + 4], edx
mov dword [esi + 4], eax
mov eax, dword [ebp + 8]
mov dword [eax + 4], esi
jmp 0x1006263b
mov eax, dword [ebp + 8]
cmp dword [eax], ebx
je 0x1006261e
mov ebx, dword [ebx + 4]
lea eax, [ebx + 8]
push eax
lea eax, [esi + 8]
push eax
call fcn.1004daf0
add esp, 8
test al, al
jne 0x1006264f
mov eax, dword [ebp + 8]
cmp dword [eax], ebx
jne 0x10062600
mov edx, dword [esi + 4]
mov dword [edx], edi
mov ecx, dword [edi + 4]
mov dword [ecx], ebx
mov eax, dword [ebx + 4]
mov dword [eax], esi
mov dword [ebx + 4], ecx
mov dword [edi + 4], edx
mov dword [esi + 4], eax
mov eax, dword [ebp + 8]
mov dword [eax], esi
mov esi, edi
cmp edi, dword [ebp - 4]
jne 0x10062562
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
mov edx, dword [esi + 4]
mov ebx, dword [ebx]
mov dword [edx], edi
mov ecx, dword [edi + 4]
mov dword [ecx], ebx
mov eax, dword [ebx + 4]
mov dword [eax], esi
mov dword [ebx + 4], ecx
mov dword [edi + 4], edx
mov dword [esi + 4], eax
jmp 0x1006263b
push str.invalid_hash_bucket_count
call fcn.100baafd
int3
Function at 0x10064250
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 0xc]
mov edx, 0x811c9dc5
push edi
mov edi, dword [ebp + 8]
mov ecx, 0
sub esi, edi
je 0x10064281
nop dword [eax]
movzx eax, byte [edi + ecx]
inc ecx
xor eax, edx
imul edx, eax, 0x1000193
cmp ecx, esi
jb 0x10064270
pop edi
mov eax, edx
pop esi
pop ebp
ret 8

Function at 0x10066800
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100ecc5d
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x101eb100]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
push 4
call fcn.100bbfe7
add esp, 4
test eax, eax
je 0x1006683c
mov ecx, dword [ebp + 8]
mov dword [eax], ecx
jmp 0x1006683e
xor eax, eax
mov dword [ebp + 8], eax
lea edi, [esi + 4]
mov dword [ebp - 4], 0
push edi
push 0
push eax
push 0x10066890
push 0
push 0
call fcn.100d20b8
add esp, 0x18
mov dword [esi], eax
test eax, eax
je 0x1006687b
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4
push 6
mov dword [edi], 0
call fcn.100bb790
int3