joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1002bb40
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x2c
mov edx, ecx
mov ecx, dword [ebp + 8]
mov eax, dword [0x1038100c]
xor eax, ebp
mov dword [ebp - 0x10], eax
mov edi, dword [edx + 0x1278]
cmp dword [edi + 0x60], ecx
jbe 0x1002bb77
mov eax, dword [edi + 0x64]
mov esi, dword [eax + ecx*4]
cmp esi, 0xffffffff
jne 0x1002bc10
jmp 0x1002bc27
mov dword [ebp - 0x30], edx
mov ebx, ecx
shr ebx, 0x10
mov esi, ecx
shr esi, 8
mov eax, 0xff
mov edx, ecx
and edx, eax
and esi, eax
and ebx, eax
mov eax, ecx
shr eax, 0x18
xor edx, 0x811c9dc5
imul edx, edx, 0x1000193
xor edx, esi
imul edx, edx, 0x1000193
xor edx, ebx
imul edx, edx, 0x1000193
xor edx, eax
imul eax, edx, 0x1000193
and eax, dword [edi + 0x80]
mov edx, dword [edi + 0x6c]
mov edi, dword [edi + 0x74]
shl ebx, 0x10
and ecx, 0xff0000ff
or ecx, ebx
mov dword [ebp - 0x38], edi
mov edi, dword [edi + eax*8]
add eax, eax
inc eax
mov dword [ebp - 0x34], eax
shl esi, 8
or ecx, esi
mov ebx, edi
cmp edx, edi
je 0x1002bbf5
mov eax, dword [ebp - 0x38]
mov esi, dword [ebp - 0x34]
mov eax, dword [eax + esi*4]
mov eax, dword [eax]
jmp 0x1002bbf7
mov eax, edi
xor esi, esi
cmp ebx, eax
je 0x1002bc29
cmp dword [ebx + 8], ecx
je 0x1002bc06
mov ebx, dword [ebx]
jmp 0x1002bbe4
cmp ebx, edx
je 0x1002bc29
mov esi, dword [ebx + 0xc]
mov edx, dword [ebp - 0x30]
test esi, esi
je 0x1002bc27
cmp dword [esi + 0x174], 0
je 0x1002bc29
mov ecx, esi
push edx
call fcn.1005d010
jmp 0x1002bc29
xor esi, esi
mov dword [ebp - 0x14], 0xf
mov dword [ebp - 0x18], 0
mov byte [ebp - 0x28], 0
mov ebx, dword [ebp + 0x10]
push ebx
call sub.api_ms_win_crt_string_l1_1_0.dll_strlen
add esp, 4
mov edi, eax
cmp eax, 0xf
jbe 0x1002bc69
sub esp, 0xc
mov al, byte [ebp - 0x2c]
mov byte [esp + 4], al
mov dword [esp + 8], ebx
mov dword [esp], edi
lea ecx, [ebp - 0x28]
call fcn.10001080
jmp 0x1002bc7f
lea eax, [ebp - 0x28]
mov dword [eax + 0x10], edi
push edi
push ebx
push eax
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
mov byte [ebp + edi - 0x28], 0
lea edi, [ebp - 0x28]
mov ecx, esi
push edi
call fcn.1005fd40
mov esi, eax
mov ecx, dword [edi + 0x14]
cmp ecx, 0x10
jb 0x1002bcaa
mov eax, dword [ebp - 0x28]
inc ecx
cmp ecx, 0x1000
jae 0x1002bcc0
push eax
call dword [sym.imp.mozglue.dll_free]
add esp, 4
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1021e470
mov eax, esi
add esp, 0x2c
pop esi
pop edi
pop ebx
pop ebp
ret 0xc
mov ecx, dword [eax - 4]
add eax, 0xfffffffc
sub eax, ecx
cmp eax, 0x20
jae 0x1002bcd1
mov eax, ecx
jmp 0x1002bca0
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
Function at 0x1002c600
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0xc
mov eax, dword [ebp + 8]
mov dword [ebp - 0x10], ecx
mov edx, dword [ecx + 0x1278]
cmp dword [edx + 0x60], eax
jbe 0x1002c62e
mov ecx, dword [edx + 0x64]
mov edi, dword [ecx + eax*4]
cmp edi, 0xffffffff
jne 0x1002c6c0
jmp 0x1002c6d9
mov ebx, eax
shr ebx, 0x10
mov edi, eax
shr edi, 8
mov ecx, 0xff
mov esi, eax
and esi, ecx
and edi, ecx
and ebx, ecx
mov ecx, eax
shr ecx, 0x18
xor esi, 0x811c9dc5
imul esi, esi, 0x1000193
xor esi, edi
imul esi, esi, 0x1000193
xor esi, ebx
imul esi, esi, 0x1000193
xor esi, ecx
imul esi, esi, 0x1000193
and esi, dword [edx + 0x80]
mov ecx, dword [edx + 0x6c]
mov edx, dword [edx + 0x74]
shl ebx, 0x10
and eax, 0xff0000ff
or eax, ebx
mov dword [ebp - 0x18], edx
mov edx, dword [edx + esi*8]
add esi, esi
inc esi
mov dword [ebp - 0x14], esi
shl edi, 8
or eax, edi
mov ebx, edx
cmp ecx, edx
je 0x1002c6a8
mov esi, dword [ebp - 0x18]
mov edi, dword [ebp - 0x14]
mov esi, dword [esi + edi*4]
mov esi, dword [esi]
jmp 0x1002c6aa
mov esi, edx
xor edi, edi
cmp ebx, esi
je 0x1002c6db
cmp dword [ebx + 8], eax
je 0x1002c6b9
mov ebx, dword [ebx]
jmp 0x1002c697
cmp ebx, ecx
je 0x1002c6db
mov edi, dword [ebx + 0xc]
test edi, edi
je 0x1002c6d9
cmp dword [edi + 0x174], 0
je 0x1002c6db
mov ecx, edi
push dword [ebp - 0x10]
call fcn.1005d010
jmp 0x1002c6db
xor edi, edi
mov eax, dword [ebp - 0x10]
add eax, 0x20
mov ecx, edi
push eax
call fcn.10061c10
add esp, 0xc
pop esi
pop edi
pop ebx
pop ebp
ret 4

Function at 0x1002c700
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0xc
mov eax, dword [ebp + 8]
mov dword [ebp - 0x10], ecx
mov edx, dword [ecx + 0x1278]
cmp dword [edx + 0x60], eax
jbe 0x1002c72e
mov ecx, dword [edx + 0x64]
mov edi, dword [ecx + eax*4]
cmp edi, 0xffffffff
jne 0x1002c7c0
jmp 0x1002c7d9
mov ebx, eax
shr ebx, 0x10
mov edi, eax
shr edi, 8
mov ecx, 0xff
mov esi, eax
and esi, ecx
and edi, ecx
and ebx, ecx
mov ecx, eax
shr ecx, 0x18
xor esi, 0x811c9dc5
imul esi, esi, 0x1000193
xor esi, edi
imul esi, esi, 0x1000193
xor esi, ebx
imul esi, esi, 0x1000193
xor esi, ecx
imul esi, esi, 0x1000193
and esi, dword [edx + 0x80]
mov ecx, dword [edx + 0x6c]
mov edx, dword [edx + 0x74]
shl ebx, 0x10
and eax, 0xff0000ff
or eax, ebx
mov dword [ebp - 0x18], edx
mov edx, dword [edx + esi*8]
add esi, esi
inc esi
mov dword [ebp - 0x14], esi
shl edi, 8
or eax, edi
mov ebx, edx
cmp ecx, edx
je 0x1002c7a8
mov esi, dword [ebp - 0x18]
mov edi, dword [ebp - 0x14]
mov esi, dword [esi + edi*4]
mov esi, dword [esi]
jmp 0x1002c7aa
mov esi, edx
xor edi, edi
cmp ebx, esi
je 0x1002c7db
cmp dword [ebx + 8], eax
je 0x1002c7b9
mov ebx, dword [ebx]
jmp 0x1002c797
cmp ebx, ecx
je 0x1002c7db
mov edi, dword [ebx + 0xc]
test edi, edi
je 0x1002c7d9
cmp dword [edi + 0x174], 0
je 0x1002c7db
mov ecx, edi
push dword [ebp - 0x10]
call fcn.1005d010
jmp 0x1002c7db
xor edi, edi
mov ecx, edi
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp - 0x10]
call fcn.1005e1c0
add esp, 0xc
pop esi
pop edi
pop ebx
pop ebp
ret 0x14
Function at 0x1002c800
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0xc
mov esi, ecx
mov eax, dword [ebp + 8]
mov edx, dword [ecx + 0x1278]
cmp dword [edx + 0x60], eax
jbe 0x1002c82d
mov ecx, dword [edx + 0x64]
mov edi, dword [ecx + eax*4]
cmp edi, 0xffffffff
jne 0x1002c8ca
jmp 0x1002c8e1
mov dword [ebp - 0x10], esi
mov ebx, eax
shr ebx, 0x10
mov edi, eax
shr edi, 8
mov ecx, 0xff
mov esi, eax
and esi, ecx
and edi, ecx
and ebx, ecx
mov ecx, eax
shr ecx, 0x18
xor esi, 0x811c9dc5
imul esi, esi, 0x1000193
xor esi, edi
imul esi, esi, 0x1000193
xor esi, ebx
imul esi, esi, 0x1000193
xor esi, ecx
imul esi, esi, 0x1000193
and esi, dword [edx + 0x80]
mov ecx, dword [edx + 0x6c]
mov edx, dword [edx + 0x74]
shl ebx, 0x10
and eax, 0xff0000ff
or eax, ebx
mov dword [ebp - 0x18], edx
mov edx, dword [edx + esi*8]
add esi, esi
inc esi
mov dword [ebp - 0x14], esi
shl edi, 8
or eax, edi
mov ebx, edx
cmp ecx, edx
je 0x1002c8aa
mov esi, dword [ebp - 0x18]
mov edi, dword [ebp - 0x14]
mov esi, dword [esi + edi*4]
mov esi, dword [esi]
jmp 0x1002c8ac
mov esi, edx
xor edi, edi
cmp ebx, esi
je 0x1002c8bb
cmp dword [ebx + 8], eax
je 0x1002c8c0
mov ebx, dword [ebx]
jmp 0x1002c899
mov esi, dword [ebp - 0x10]
jmp 0x1002c8e3
cmp ebx, ecx
mov esi, dword [ebp - 0x10]
je 0x1002c8e3
mov edi, dword [ebx + 0xc]
test edi, edi
je 0x1002c8e1
cmp dword [edi + 0x174], 0
je 0x1002c8e3
mov ecx, edi
push esi
call fcn.1005d010
jmp 0x1002c8e3
xor edi, edi
mov ecx, edi
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push esi
call fcn.1005d5e0
cmp eax, 1
je 0x1002c944
cmp dword [edi + 0x17c], 0
je 0x1002c944
cmp dword [edi + 0x174], 0
je 0x1002c913
mov ecx, edi
push esi
call fcn.1005d010
cmp byte [edi + 0x170], 0
je 0x1002c937
lea ecx, [esi + 8]
push edi
push esi
call fcn.10080350
cmp eax, 1
je 0x1002c944
add edi, 4
mov ecx, edi
push 8
call fcn.100544f0
lea ecx, [esi + 0x1ef8]
mov edx, esi
call fcn.1001d170
add esp, 0xc
pop esi
pop edi
pop ebx
pop ebp
ret 0x10
Function at 0x1002d090
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
push eax
mov eax, dword [ebp + 8]
cmp dword [ecx + 0x1d9c], eax
jbe 0x1002d0b1
mov ecx, dword [ecx + 0x1da0]
cmp dword [ecx + eax*4], 0xffffffff
jmp 0x1002d13e
mov edi, eax
shr edi, 0x10
mov esi, eax
shr esi, 8
mov edx, 0xff
mov ebx, eax
and ebx, edx
and esi, edx
and edi, edx
mov edx, eax
shr edx, 0x18
xor ebx, 0x811c9dc5
imul ebx, ebx, 0x1000193
xor ebx, esi
imul ebx, ebx, 0x1000193
xor ebx, edi
imul ebx, ebx, 0x1000193
xor ebx, edx
imul ebx, ebx, 0x1000193
and ebx, dword [ecx + 0x1dbc]
mov edx, dword [ecx + 0x1da8]
mov ecx, dword [ecx + 0x1db0]
shl edi, 0x10
and eax, 0xff0000ff
or eax, edi
mov dword [ebp - 0x10], ecx
mov ecx, dword [ecx + ebx*8]
add ebx, ebx
inc ebx
shl esi, 8
or eax, esi
mov esi, ecx
cmp edx, ecx
je 0x1002d12b
mov edi, dword [ebp - 0x10]
mov edi, dword [edi + ebx*4]
mov edi, dword [edi]
jmp 0x1002d12d
mov edi, ecx
cmp esi, edi
je 0x1002d13a
cmp dword [esi + 8], eax
je 0x1002d13c
mov esi, dword [esi]
jmp 0x1002d11d
mov esi, edx
cmp esi, edx
setne al
add esp, 4
pop esi
pop edi
pop ebx
pop ebp
ret 4

Function at 0x1002d150
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 8
mov eax, dword [ebp + 8]
cmp dword [ecx + 0x1d9c], eax
jbe 0x1002d17a
mov ecx, dword [ecx + 0x1da0]
mov eax, dword [ecx + eax*4]
xor ecx, ecx
cmp eax, 0xffffffff
cmovne ecx, eax
jmp 0x1002d215
mov edi, eax
shr edi, 0x10
mov esi, eax
shr esi, 8
mov edx, 0xff
mov ebx, eax
and ebx, edx
and esi, edx
and edi, edx
mov edx, eax
shr edx, 0x18
xor ebx, 0x811c9dc5
imul ebx, ebx, 0x1000193
xor ebx, esi
imul ebx, ebx, 0x1000193
xor ebx, edi
imul ebx, ebx, 0x1000193
xor ebx, edx
imul ebx, ebx, 0x1000193
and ebx, dword [ecx + 0x1dbc]
mov edx, dword [ecx + 0x1da8]
mov ecx, dword [ecx + 0x1db0]
shl edi, 0x10
and eax, 0xff0000ff
or eax, edi
mov dword [ebp - 0x14], ecx
mov edi, ebx
mov ebx, dword [ecx + ebx*8]
lea ecx, [edi + edi]
inc ecx
mov dword [ebp - 0x10], ecx
shl esi, 8
or eax, esi
mov esi, ebx
cmp edx, ebx
je 0x1002d1fd
mov ecx, dword [ebp - 0x14]
mov edi, dword [ebp - 0x10]
mov ecx, dword [ecx + edi*4]
mov edi, dword [ecx]
jmp 0x1002d1ff
mov edi, ebx
xor ecx, ecx
cmp esi, edi
je 0x1002d215
cmp dword [esi + 8], eax
je 0x1002d20e
mov esi, dword [esi]
jmp 0x1002d1ec
cmp esi, edx
je 0x1002d215
mov ecx, dword [esi + 0xc]
test ecx, ecx
setne al
add esp, 8
pop esi
pop edi
pop ebx
pop ebp
ret 4
Function at 0x1002d7d0
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 8
mov eax, dword [ebp + 8]
test eax, eax
je 0x1002d7fe
cmp dword [ecx + 0x1df4], eax
jbe 0x1002d805
mov ecx, dword [ecx + 0x1df8]
mov eax, dword [ecx + eax*4]
xor ecx, ecx
cmp eax, 0xffffffff
cmovne ecx, eax
jmp 0x1002d8a0
xor eax, eax
jmp 0x1002d8a5
mov edi, eax
shr edi, 0x10
mov esi, eax
shr esi, 8
mov edx, 0xff
mov ebx, eax
and ebx, edx
and esi, edx
and edi, edx
mov edx, eax
shr edx, 0x18
xor ebx, 0x811c9dc5
imul ebx, ebx, 0x1000193
xor ebx, esi
imul ebx, ebx, 0x1000193
xor ebx, edi
imul ebx, ebx, 0x1000193
xor ebx, edx
imul ebx, ebx, 0x1000193
and ebx, dword [ecx + 0x1e14]
mov edx, dword [ecx + 0x1e00]
mov ecx, dword [ecx + 0x1e08]
shl edi, 0x10
and eax, 0xff0000ff
or eax, edi
mov dword [ebp - 0x14], ecx
mov edi, ebx
mov ebx, dword [ecx + ebx*8]
lea ecx, [edi + edi]
inc ecx
mov dword [ebp - 0x10], ecx
shl esi, 8
or eax, esi
mov esi, ebx
cmp edx, ebx
je 0x1002d888
mov ecx, dword [ebp - 0x14]
mov edi, dword [ebp - 0x10]
mov ecx, dword [ecx + edi*4]
mov edi, dword [ecx]
jmp 0x1002d88a
mov edi, ebx
xor ecx, ecx
cmp esi, edi
je 0x1002d8a0
cmp dword [esi + 8], eax
je 0x1002d899
mov esi, dword [esi]
jmp 0x1002d877
cmp esi, edx
je 0x1002d8a0
mov ecx, dword [esi + 0xc]
test ecx, ecx
setne al
add esp, 8
pop esi
pop edi
pop ebx
pop ebp
ret 4

Function at 0x1002d910
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0xc
mov ebx, ecx
mov edx, dword [ebp + 0xc]
mov ecx, dword [ebp + 8]
mov edi, dword [ebx + 0x1278]
cmp dword [edi + 0x60], ecx
jbe 0x1002d940
mov eax, dword [edi + 0x64]
mov esi, dword [eax + ecx*4]
cmp esi, 0xffffffff
jne 0x1002d9e1
jmp 0x1002d9fc
mov dword [ebp - 0x10], ebx
mov ebx, ecx
shr ebx, 0x10
mov esi, ecx
shr esi, 8
mov eax, 0xff
mov edx, ecx
and edx, eax
and esi, eax
and ebx, eax
mov eax, ecx
shr eax, 0x18
xor edx, 0x811c9dc5
imul edx, edx, 0x1000193
xor edx, esi
imul edx, edx, 0x1000193
xor edx, ebx
imul edx, edx, 0x1000193
xor edx, eax
imul eax, edx, 0x1000193
and eax, dword [edi + 0x80]
mov edx, dword [edi + 0x6c]
mov edi, dword [edi + 0x74]
shl ebx, 0x10
and ecx, 0xff0000ff
or ecx, ebx
mov dword [ebp - 0x18], edi
mov edi, dword [edi + eax*8]
add eax, eax
inc eax
mov dword [ebp - 0x14], eax
shl esi, 8
or ecx, esi
mov ebx, edi
cmp edx, edi
je 0x1002d9be
mov eax, dword [ebp - 0x18]
mov esi, dword [ebp - 0x14]
mov eax, dword [eax + esi*4]
mov eax, dword [eax]
jmp 0x1002d9c0
mov eax, edi
xor esi, esi
cmp ebx, eax
je 0x1002d9cf
cmp dword [ebx + 8], ecx
je 0x1002d9d4
mov ebx, dword [ebx]
jmp 0x1002d9ad
mov edx, dword [ebp + 0xc]
jmp 0x1002d9fe
cmp ebx, edx
mov edx, dword [ebp + 0xc]
je 0x1002d9fe
mov esi, dword [ebx + 0xc]
mov ebx, dword [ebp - 0x10]
test esi, esi
je 0x1002d9fc
cmp dword [esi + 0x174], 0
je 0x1002d9fe
mov ecx, esi
push ebx
mov edi, edx
call fcn.1005d010
mov edx, edi
jmp 0x1002d9fe
xor esi, esi
mov ecx, esi
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push edx
call fcn.10062280
add esp, 0xc
pop esi
pop edi
pop ebx
pop ebp
ret 0x10
Function at 0x1002da20
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0xc
mov ebx, ecx
mov edx, dword [ebp + 0xc]
mov ecx, dword [ebp + 8]
mov edi, dword [ebx + 0x1278]
cmp dword [edi + 0x60], ecx
jbe 0x1002da50
mov eax, dword [edi + 0x64]
mov esi, dword [eax + ecx*4]
cmp esi, 0xffffffff
jne 0x1002daf1
jmp 0x1002db0c
mov dword [ebp - 0x10], ebx
mov ebx, ecx
shr ebx, 0x10
mov esi, ecx
shr esi, 8
mov eax, 0xff
mov edx, ecx
and edx, eax
and esi, eax
and ebx, eax
mov eax, ecx
shr eax, 0x18
xor edx, 0x811c9dc5
imul edx, edx, 0x1000193
xor edx, esi
imul edx, edx, 0x1000193
xor edx, ebx
imul edx, edx, 0x1000193
xor edx, eax
imul eax, edx, 0x1000193
and eax, dword [edi + 0x80]
mov edx, dword [edi + 0x6c]
mov edi, dword [edi + 0x74]
shl ebx, 0x10
and ecx, 0xff0000ff
or ecx, ebx
mov dword [ebp - 0x18], edi
mov edi, dword [edi + eax*8]
add eax, eax
inc eax
mov dword [ebp - 0x14], eax
shl esi, 8
or ecx, esi
mov ebx, edi
cmp edx, edi
je 0x1002dace
mov eax, dword [ebp - 0x18]
mov esi, dword [ebp - 0x14]
mov eax, dword [eax + esi*4]
mov eax, dword [eax]
jmp 0x1002dad0
mov eax, edi
xor esi, esi
cmp ebx, eax
je 0x1002dadf
cmp dword [ebx + 8], ecx
je 0x1002dae4
mov ebx, dword [ebx]
jmp 0x1002dabd
mov edx, dword [ebp + 0xc]
jmp 0x1002db0e
cmp ebx, edx
mov edx, dword [ebp + 0xc]
je 0x1002db0e
mov esi, dword [ebx + 0xc]
mov ebx, dword [ebp - 0x10]
test esi, esi
je 0x1002db0c
cmp dword [esi + 0x174], 0
je 0x1002db0e
mov ecx, esi
push ebx
mov edi, edx
call fcn.1005d010
mov edx, edi
jmp 0x1002db0e
xor esi, esi
mov ecx, esi
push dword [ebp + 0x20]
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push edx
call fcn.10062350
add esp, 0xc
pop esi
pop edi
pop ebx
pop ebp
ret 0x1c
Function at 0x1002ded0
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 8
mov eax, dword [ebp + 8]
test eax, eax
je 0x1002defe
cmp dword [ecx + 0x1e4c], eax
jbe 0x1002df05
mov ecx, dword [ecx + 0x1e50]
mov eax, dword [ecx + eax*4]
xor ecx, ecx
cmp eax, 0xffffffff
cmovne ecx, eax
jmp 0x1002dfa0
xor eax, eax
jmp 0x1002dfa5
mov edi, eax
shr edi, 0x10
mov esi, eax
shr esi, 8
mov edx, 0xff
mov ebx, eax
and ebx, edx
and esi, edx
and edi, edx
mov edx, eax
shr edx, 0x18
xor ebx, 0x811c9dc5
imul ebx, ebx, 0x1000193
xor ebx, esi
imul ebx, ebx, 0x1000193
xor ebx, edi
imul ebx, ebx, 0x1000193
xor ebx, edx
imul ebx, ebx, 0x1000193
and ebx, dword [ecx + 0x1e6c]
mov edx, dword [ecx + 0x1e58]
mov ecx, dword [ecx + 0x1e60]
shl edi, 0x10
and eax, 0xff0000ff
or eax, edi
mov dword [ebp - 0x14], ecx
mov edi, ebx
mov ebx, dword [ecx + ebx*8]
lea ecx, [edi + edi]
inc ecx
mov dword [ebp - 0x10], ecx
shl esi, 8
or eax, esi
mov esi, ebx
cmp edx, ebx
je 0x1002df88
mov ecx, dword [ebp - 0x14]
mov edi, dword [ebp - 0x10]
mov ecx, dword [ecx + edi*4]
mov edi, dword [ecx]
jmp 0x1002df8a
mov edi, ebx
xor ecx, ecx
cmp esi, edi
je 0x1002dfa0
cmp dword [esi + 8], eax
je 0x1002df99
mov esi, dword [esi]
jmp 0x1002df77
cmp esi, edx
je 0x1002dfa0
mov ecx, dword [esi + 0xc]
test ecx, ecx
setne al
add esp, 8
pop esi
pop edi
pop ebx
pop ebp
ret 4

Function at 0x1002e070
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0xc
mov eax, dword [ebp + 8]
mov dword [ebp - 0x10], ecx
mov edx, dword [ecx + 0x1278]
cmp dword [edx + 0x60], eax
jbe 0x1002e09e
mov ecx, dword [edx + 0x64]
mov edi, dword [ecx + eax*4]
cmp edi, 0xffffffff
jne 0x1002e130
jmp 0x1002e149
mov ebx, eax
shr ebx, 0x10
mov edi, eax
shr edi, 8
mov ecx, 0xff
mov esi, eax
and esi, ecx
and edi, ecx
and ebx, ecx
mov ecx, eax
shr ecx, 0x18
xor esi, 0x811c9dc5
imul esi, esi, 0x1000193
xor esi, edi
imul esi, esi, 0x1000193
xor esi, ebx
imul esi, esi, 0x1000193
xor esi, ecx
imul esi, esi, 0x1000193
and esi, dword [edx + 0x80]
mov ecx, dword [edx + 0x6c]
mov edx, dword [edx + 0x74]
shl ebx, 0x10
and eax, 0xff0000ff
or eax, ebx
mov dword [ebp - 0x18], edx
mov edx, dword [edx + esi*8]
add esi, esi
inc esi
mov dword [ebp - 0x14], esi
shl edi, 8
or eax, edi
mov ebx, edx
cmp ecx, edx
je 0x1002e118
mov esi, dword [ebp - 0x18]
mov edi, dword [ebp - 0x14]
mov esi, dword [esi + edi*4]
mov esi, dword [esi]
jmp 0x1002e11a
mov esi, edx
xor edi, edi
cmp ebx, esi
je 0x1002e14b
cmp dword [ebx + 8], eax
je 0x1002e129
mov ebx, dword [ebx]
jmp 0x1002e107
cmp ebx, ecx
je 0x1002e14b
mov edi, dword [ebx + 0xc]
test edi, edi
je 0x1002e149
cmp dword [edi + 0x174], 0
je 0x1002e14b
mov ecx, edi
push dword [ebp - 0x10]
call fcn.1005d010
jmp 0x1002e14b
xor edi, edi
mov ecx, edi
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp - 0x10]
call fcn.10061930
add esp, 0xc
pop esi
pop edi
pop ebx
pop ebp
ret 0xc
Function at 0x1002e170
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x2c
mov edx, ecx
mov ecx, dword [ebp + 8]
mov eax, dword [0x1038100c]
xor eax, ebp
mov dword [ebp - 0x10], eax
mov edi, dword [edx + 0x1278]
cmp dword [edi + 0x60], ecx
jbe 0x1002e1a7
mov eax, dword [edi + 0x64]
mov esi, dword [eax + ecx*4]
cmp esi, 0xffffffff
jne 0x1002e240
jmp 0x1002e257
mov dword [ebp - 0x30], edx
mov ebx, ecx
shr ebx, 0x10
mov esi, ecx
shr esi, 8
mov eax, 0xff
mov edx, ecx
and edx, eax
and esi, eax
and ebx, eax
mov eax, ecx
shr eax, 0x18
xor edx, 0x811c9dc5
imul edx, edx, 0x1000193
xor edx, esi
imul edx, edx, 0x1000193
xor edx, ebx
imul edx, edx, 0x1000193
xor edx, eax
imul eax, edx, 0x1000193
and eax, dword [edi + 0x80]
mov edx, dword [edi + 0x6c]
mov edi, dword [edi + 0x74]
shl ebx, 0x10
and ecx, 0xff0000ff
or ecx, ebx
mov dword [ebp - 0x38], edi
mov edi, dword [edi + eax*8]
add eax, eax
inc eax
mov dword [ebp - 0x34], eax
shl esi, 8
or ecx, esi
mov ebx, edi
cmp edx, edi
je 0x1002e225
mov eax, dword [ebp - 0x38]
mov esi, dword [ebp - 0x34]
mov eax, dword [eax + esi*4]
mov eax, dword [eax]
jmp 0x1002e227
mov eax, edi
xor esi, esi
cmp ebx, eax
je 0x1002e259
cmp dword [ebx + 8], ecx
je 0x1002e236
mov ebx, dword [ebx]
jmp 0x1002e214
cmp ebx, edx
je 0x1002e259
mov esi, dword [ebx + 0xc]
mov edx, dword [ebp - 0x30]
test esi, esi
je 0x1002e257
cmp dword [esi + 0x174], 0
je 0x1002e259
mov ecx, esi
push edx
call fcn.1005d010
jmp 0x1002e259
xor esi, esi
mov dword [ebp - 0x14], 0xf
mov dword [ebp - 0x18], 0
mov byte [ebp - 0x28], 0
mov ebx, dword [ebp + 0xc]
push ebx
call sub.api_ms_win_crt_string_l1_1_0.dll_strlen
add esp, 4
mov edi, eax
cmp eax, 0xf
jbe 0x1002e299
sub esp, 0xc
mov al, byte [ebp - 0x2c]
mov byte [esp + 4], al
mov dword [esp + 8], ebx
mov dword [esp], edi
lea ecx, [ebp - 0x28]
call fcn.10001080
jmp 0x1002e2af
lea eax, [ebp - 0x28]
mov dword [eax + 0x10], edi
push edi
push ebx
push eax
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
mov byte [ebp + edi - 0x28], 0
lea edi, [ebp - 0x28]
mov ecx, esi
push edi
call fcn.1005fbd0
mov esi, eax
mov ecx, dword [edi + 0x14]
cmp ecx, 0x10
jb 0x1002e2da
mov eax, dword [ebp - 0x28]
inc ecx
cmp ecx, 0x1000
jae 0x1002e2f0
push eax
call dword [sym.imp.mozglue.dll_free]
add esp, 4
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1021e470
mov eax, esi
add esp, 0x2c
pop esi
pop edi
pop ebx
pop ebp
ret 8
mov ecx, dword [eax - 4]
add eax, 0xfffffffc
sub eax, ecx
cmp eax, 0x20
jae 0x1002e301
mov eax, ecx
jmp 0x1002e2d0
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
Function at 0x1002e310
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x28
mov edi, ecx
mov ecx, dword [ebp + 8]
mov eax, dword [0x1038100c]
xor eax, ebp
mov dword [ebp - 0x10], eax
mov esi, dword [edi + 0x1278]
cmp dword [esi + 0x60], ecx
jbe 0x1002e340
shl ecx, 2
add ecx, dword [esi + 0x64]
mov edx, ecx
jmp 0x1002e3cf
mov dword [ebp - 0x34], edi
mov ebx, ecx
shr ebx, 0x10
mov edi, ecx
shr edi, 8
mov eax, 0xff
mov edx, ecx
and edx, eax
and edi, eax
and ebx, eax
mov eax, ecx
shr eax, 0x18
xor edx, 0x811c9dc5
imul edx, edx, 0x1000193
xor edx, edi
imul edx, edx, 0x1000193
xor edx, ebx
imul edx, edx, 0x1000193
xor edx, eax
imul eax, edx, 0x1000193
and eax, dword [esi + 0x80]
mov edx, dword [esi + 0x6c]
mov esi, dword [esi + 0x74]
shl ebx, 0x10
and ecx, 0xff0000ff
or ecx, ebx
mov dword [ebp - 0x30], esi
mov esi, dword [esi + eax*8]
add eax, eax
inc eax
shl edi, 8
or ecx, edi
mov edi, esi
cmp edx, esi
je 0x1002e3b8
mov ebx, dword [ebp - 0x30]
mov ebx, dword [ebx + eax*4]
mov ebx, dword [ebx]
jmp 0x1002e3ba
mov ebx, esi
cmp edi, ebx
je 0x1002e3c9
cmp dword [edi + 8], ecx
je 0x1002e3c7
mov edi, dword [edi]
jmp 0x1002e3aa
mov edx, edi
add edx, 0xc
mov edi, dword [ebp - 0x34]
mov esi, dword [edx]
cmp dword [esi + 0x174], 0
je 0x1002e3e2
mov ecx, esi
push edi
call fcn.1005d010
mov eax, dword [ebp + 0xc]
cmp byte [esi + 0x170], 0
je 0x1002e4ab
test eax, eax
jle 0x1002e4c3
add esi, 0x40
xor edi, edi
mov dword [ebp - 0x30], esi
mov eax, dword [ebp + 0x10]
mov esi, dword [eax + edi*4]
mov dword [ebp - 0x14], 0xf
mov dword [ebp - 0x18], 0
mov byte [ebp - 0x28], 0
push esi
call sub.api_ms_win_crt_string_l1_1_0.dll_strlen
add esp, 4
mov ebx, eax
cmp eax, 0xf
jbe 0x1002e447
sub esp, 0xc
mov al, byte [ebp - 0x2c]
mov byte [esp + 4], al
mov dword [esp + 8], esi
mov dword [esp], ebx
lea ebx, [ebp - 0x28]
mov ecx, ebx
call fcn.10001080
jmp 0x1002e45f
mov dword [ebp - 0x18], ebx
push ebx
push esi
lea esi, [ebp - 0x28]
push esi
call sub.VCRUNTIME140.dll_memmove
add esp, 0xc
mov byte [ebp + ebx - 0x28], 0
mov ebx, esi
mov ecx, dword [ebp - 0x30]
push ebx
call fcn.10058540
mov ecx, dword [ebp + 0x14]
mov dword [ecx + edi*4], eax
mov ecx, dword [ebp - 0x14]
cmp ecx, 0x10
jb 0x1002e48c
mov eax, dword [ebp - 0x28]
inc ecx
cmp ecx, 0x1000
jae 0x1002e49a
push eax
call dword [sym.imp.mozglue.dll_free]
add esp, 4
inc edi
mov eax, dword [ebp + 0xc]
cmp eax, edi
jne 0x1002e402
jmp 0x1002e4c3
mov ecx, dword [eax - 4]
add eax, 0xfffffffc
sub eax, ecx
cmp eax, 0x20
jae 0x1002e4d7
mov eax, ecx
jmp 0x1002e482
test eax, eax
jle 0x1002e4c3
shl eax, 2
push eax
push 0xff
push dword [ebp + 0x14]
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1021e470
add esp, 0x28
pop esi
pop edi
pop ebx
pop ebp
ret 0x10
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3