joyce8/EMBER2024-capa huggingface dataset:
Function at 0x477988
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push ecx
mov ecx, 4
push 0
push 0
dec ecx
jne 0x477991
push ecx
xchg dword [ebp - 4], ecx
push ebx
push esi
push edi
mov byte [ebp - 5], cl
mov esi, edx
mov dword [ebp - 4], eax
mov ebx, dword [ebp + 8]
xor eax, eax
push ebp
push 0x477b57
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.00477ce4
xor eax, eax
push ebp
push 0x477b28
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
test byte [eax + 0x1c], 8
je 0x4779e1
call fcn.00404a90
jmp 0x477b2f
mov eax, dword [ebp - 4]
test byte [eax + 0x30], 8
je 0x477ab6
mov eax, dword [ebp - 4]
test byte [eax + 0x30], 1
je 0x477a36
mov eax, dword [ebp - 4]
cmp word [eax + 0x3a], 0
je 0x477a36
lea edx, [ebp - 0x10]
mov eax, dword [ebp - 4]
call fcn.00477930
push dword [ebp - 0x10]
mov eax, dword [ebp - 4]
push dword [eax + 0x50]
push ebx
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.004053f4
mov eax, dword [ebp - 0xc]
push eax
mov edi, dword [ebp - 4]
movzx ecx, byte [ebp - 5]
mov edx, esi
mov eax, dword [edi + 0x3c]
call dword [edi + 0x38]
mov eax, dword [ebp - 4]
test byte [eax + 0x30], 4
je 0x477a75
lea edx, [ebp - 0x18]
mov eax, dword [ebp - 4]
call fcn.00477930
push dword [ebp - 0x18]
mov eax, dword [ebp - 4]
push dword [eax + 0x50]
push ebx
lea eax, [ebp - 0x14]
mov edx, 3
call fcn.004053f4
mov esi, dword [ebp - 0x14]
mov dword [ebp - 0x1c], esi
mov eax, dword [ebp - 0x1c]
call fcn.004054f0
push eax
call sub.kernel32.dll_OutputDebugStringA
mov eax, dword [ebp - 4]
test byte [eax + 0x30], 2
je 0x477b12
lea edx, [ebp - 0x24]
mov eax, dword [ebp - 4]
call fcn.00477930
push dword [ebp - 0x24]
mov eax, dword [ebp - 4]
push dword [eax + 0x50]
push ebx
push 0x477b70
lea eax, [ebp - 0x20]
mov edx, 4
call fcn.004053f4
mov edx, dword [ebp - 0x20]
mov eax, dword [ebp - 4]
call fcn.00477954
jmp 0x477b12
mov eax, dword [ebp - 4]
test byte [eax + 0x30], 1
je 0x477ad9
mov eax, dword [ebp - 4]
cmp word [eax + 0x3a], 0
je 0x477ad9
push ebx
mov edi, dword [ebp - 4]
movzx ecx, byte [ebp - 5]
mov edx, esi
mov eax, dword [edi + 0x3c]
call dword [edi + 0x38]
mov eax, dword [ebp - 4]
test byte [eax + 0x30], 4
je 0x477aef
mov eax, ebx
call fcn.004054f0
push eax
call sub.kernel32.dll_OutputDebugStringA
mov eax, dword [ebp - 4]
test byte [eax + 0x30], 2
je 0x477b12
lea eax, [ebp - 0x28]
mov ecx, 0x477b70
mov edx, ebx
call fcn.00405378
mov edx, dword [ebp - 0x28]
mov eax, dword [ebp - 4]
call fcn.00477954
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x477b2f
mov eax, dword [ebp - 4]
call fcn.00477cf4
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x477b5e
lea eax, [ebp - 0x28]
mov edx, 3
call fcn.00405074
lea eax, [ebp - 0x18]
mov edx, 4
call fcn.00405074
ret

Function at 0x47c6f0
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffdc
lea eax, [ebp - 0x24]
push eax
call sub.kernel32.dll_GetSystemInfo
mov eax, dword [ebp - 0x10]
mov esp, ebp
pop ebp
ret
Function at 0x47c708
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
push edi
mov esi, eax
mov byte [ebp - 1], 0
xor eax, eax
mov dword [ebp - 8], eax
xor eax, eax
mov dword [ebp - 0xc], eax
mov edi, 1
jmp 0x47c729
inc edi
mov eax, esi
call fcn.00405320
cmp edi, eax
jg 0x47c73b
cmp byte [esi + edi - 1], 0x20
je 0x47c728
mov eax, esi
test eax, eax
je 0x47c746
sub eax, 4
mov eax, dword [eax]
cmp eax, edi
jl 0x47c806
cmp byte [esi + edi - 1], 0x2e
je 0x47c828
jmp 0x47c806
cmp byte [esi + edi - 1], 0x2e
jne 0x47c7b5
inc dword [ebp - 8]
cmp dword [ebp - 8], 3
jg 0x47c828
cmp dword [ebp - 0xc], 0xff
jg 0x47c828
xor eax, eax
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x10], esi
cmp dword [ebp - 0x10], 0
je 0x47c798
mov eax, dword [ebp - 0x10]
sub eax, 4
mov eax, dword [eax]
mov dword [ebp - 0x10], eax
cmp edi, dword [ebp - 0x10]
jl 0x47c7a1
mov bl, 1
jmp 0x47c7af
movzx eax, byte [esi + edi]
add al, 0xd0
sub al, 0xa
setb bl
xor bl, 1
test bl, bl
jne 0x47c828
jmp 0x47c805
movzx eax, byte [esi + edi - 1]
add al, 0xd0
sub al, 0xa
jae 0x47c7d8
mov eax, dword [ebp - 0xc]
add eax, eax
lea eax, [eax + eax*4]
movzx edx, byte [esi + edi - 1]
add eax, edx
sub eax, 0x30
mov dword [ebp - 0xc], eax
jmp 0x47c805
inc edi
mov eax, esi
call fcn.00405320
cmp edi, eax
jg 0x47c7ea
cmp byte [esi + edi - 1], 0x20
je 0x47c7d7
mov dword [ebp - 0x14], esi
cmp dword [ebp - 0x14], 0
je 0x47c7fe
mov eax, dword [ebp - 0x14]
sub eax, 4
mov eax, dword [eax]
mov dword [ebp - 0x14], eax
cmp edi, dword [ebp - 0x14]
jle 0x47c828
jmp 0x47c815
inc edi
mov eax, esi
call fcn.00405320
cmp edi, eax
jle 0x47c75e
cmp dword [ebp - 8], 3
jne 0x47c828
cmp dword [ebp - 0xc], 0xff
jg 0x47c828
mov byte [ebp - 1], 1
movzx eax, byte [ebp - 1]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x48ad18
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffda0
push ebx
mov ebx, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.004054e0
xor eax, eax
push ebp
push 0x48ae02
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x209]
mov edx, dword [ebp - 4]
call fcn.0040a36c
lea eax, [ebp - 0x250]
xor ecx, ecx
mov edx, 0x44
call fcn.00403928
mov dword [ebp - 0x250], 0x44
mov dword [ebp - 0x224], 1
test bl, bl
je 0x48ad7c
mov eax, 1
jmp 0x48ad7e
xor eax, eax
mov word [ebp - 0x220], ax
lea eax, [ebp - 0x260]
push eax
lea eax, [ebp - 0x250]
push eax
push 0
push 0
push 0x30
push 0
push 0
push 0
lea eax, [ebp - 0x209]
push eax
push 0
call sub.kernel32.dll_CreateProcessA
test eax, eax
jne 0x48adcb
mov ecx, 0x48ae18
mov dl, 1
mov eax, dword [0x408530]
call fcn.0040dc70
call fcn.004049e4
xor ebx, ebx
jmp 0x48adec
push 0xffffffffffffffff
mov eax, dword [ebp - 0x260]
push eax
call sub.kernel32.dll_WaitForSingleObject
lea eax, [ebp - 8]
push eax
mov eax, dword [ebp - 0x260]
push eax
call sub.kernel32.dll_GetExitCodeProcess
mov ebx, dword [ebp - 8]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x48ae09
lea eax, [ebp - 4]
call fcn.00405050
ret
Function at 0x496624
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
mov byte [0x4c3160], 0
mov eax, dword [0x4c67b0]
cmp dword [eax], 2
jne 0x496801
mov eax, dword [0x4c62c0]
cmp dword [eax], 5
jl 0x496801
call fcn.0048e260
test al, al
jne 0x496658
call fcn.0048e26c
call fcn.0048e258
mov dword [0x4c3168], eax
push 0x496804
mov eax, dword [0x4c3168]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x4c312c], eax
cmp dword [0x4c312c], 0
jne 0x4966b3
mov edx, 0x8000
mov eax, 0x496818
call fcn.0040f9e8
mov dword [0x4c3164], eax
mov eax, dword [0x4c3164]
mov dword [0x4c3168], eax
push 0x496804
mov eax, dword [0x4c3168]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x4c312c], eax
cmp dword [0x4c312c], 0
je 0x4967fc
push 0x496824
mov eax, dword [0x4c3168]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x4c3130], eax
cmp dword [0x4c3130], 0
je 0x4967fc
push 0x496830
mov eax, dword [0x4c3168]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x4c3134], eax
cmp dword [0x4c3134], 0
je 0x4967fc
mov byte [0x4c3160], 1
push 0x496840
mov eax, dword [0x4c3168]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x4c3138], eax
push 0x49684c
mov eax, dword [0x4c3168]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x4c313c], eax
push 0x496858
mov eax, dword [0x4c3168]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x4c3140], eax
push 0x496868
mov eax, dword [0x4c3168]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x4c3144], eax
push 0x496878
mov eax, dword [0x4c3168]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x4c3148], eax
mov edx, 0x8000
mov eax, 0x496890
call fcn.0040f9e8
mov dword [0x4c316c], eax
cmp dword [0x4c316c], 0
je 0x496801
push 0x4968a0
mov eax, dword [0x4c316c]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x4c314c], eax
push 0x4968bc
mov eax, dword [0x4c316c]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x4c3150], eax
push 0x4968dc
mov eax, dword [0x4c316c]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x4c3154], eax
push 0x4968f8
mov eax, dword [0x4c316c]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x4c3158], eax
push 0x496910
mov eax, dword [0x4c316c]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x4c315c], eax
pop ebp
ret
call fcn.004965a0
pop ebp
ret
Function at 0x4ab55c
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
xor edx, edx
mov dword [ebp - 8], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x4ab5d6
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, ebx
mov edx, 0x104
call fcn.00405780
mov eax, dword [ebx]
mov dword [ebp - 4], eax
mov esi, dword [ebp - 4]
test esi, esi
je 0x4ab596
sub esi, 4
mov esi, dword [esi]
mov eax, dword [ebx]
call fcn.004054f0
push eax
push esi
call sub.kernel32.dll_GetTempPathA
mov edx, ebx
xchg edx, eax
call fcn.00405780
lea edx, [ebp - 8]
mov eax, dword [ebx]
call fcn.0048d4e0
mov edx, dword [ebp - 8]
mov eax, ebx
call fcn.004050a4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4ab5dd
lea eax, [ebp - 8]
call fcn.00405050
ret
Function at 0x4b9e80
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0xc], ebx
mov edi, ecx
mov dword [ebp - 4], edx
mov esi, eax
mov ebx, dword [ebp + 8]
xor eax, eax
push ebp
push 0x4b9f92
push dword fs:[eax]
mov dword fs:[eax], esp
test bl, bl
je 0x4b9eb5
mov eax, esi
call fcn.004b9d68
test al, al
jne 0x4b9eb9
xor eax, eax
jmp 0x4b9ebb
mov al, 1
mov ebx, eax
cmp byte [ebp + 0xc], 0
je 0x4b9ee7
test bl, bl
jne 0x4b9ee7
mov eax, edi
call fcn.004054f0
push eax
call sub.kernel32.dll_DeleteFileA
mov ecx, edi
mov dl, 1
mov eax, dword [0x48b744]
call fcn.0048bd2c
mov dword [ebp - 8], eax
jmp 0x4b9f43
movzx eax, byte [ebp + 0xc]
xor al, 1
test al, bl
je 0x4b9f04
mov ecx, edi
mov dl, 1
mov eax, dword [0x48b644]
call fcn.0048bd6c
mov dword [ebp - 8], eax
jmp 0x4b9f43
mov eax, edi
call fcn.00409d24
test al, al
jne 0x4b9f22
mov ecx, edi
mov dl, 1
mov eax, dword [0x48b744]
call fcn.0048bd2c
mov dword [ebp - 8], eax
jmp 0x4b9f43
lea edx, [ebp - 0xc]
mov eax, dword [0x4c6638]
call fcn.00407070
mov ecx, dword [ebp - 0xc]
mov dl, 1
mov eax, dword [0x4b8f9c]
call fcn.0048b234
call fcn.004049e4
xor eax, eax
push ebp
push 0x4b9f75
push dword fs:[eax]
mov dword fs:[eax], esp
push ebx
mov ecx, dword [ebp - 8]
mov edx, dword [ebp - 4]
mov eax, esi
call fcn.004b9dd0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4b9f7c
lea eax, [ebp - 8]
call fcn.0040f91c
ret
Function at 0x1002dc20
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100be5a1
mov eax, dword fs:[0]
push eax
push ecx
mov eax, dword [0x100db040]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [edx]
xorps xmm0, xmm0
mov dword [ecx + 0xc], 0
mov dword [ecx + 0x14], 0
mov dword [ecx + 0x30], 0
mov dword [ecx + 0x34], 0
mov dword [ecx + 0x38], 0
mov dword [ecx + 0x3c], 0
mov dword [ecx + 0x40], 0
mov dword [ecx + 0x44], 0
mov dword [ecx + 0x48], 0
mov dword [ecx + 0x4c], 0
mov dword [ecx + 0x50], 0
mov dword [ecx + 0x54], 0
mov dword [ecx + 0x58], 0
mov dword [ecx + 0x5c], 0
mov dword [ecx + 0x60], 0
mov dword [ecx + 0x64], 0
mov dword [ecx + 0x68], 0
mov dword [ecx + 0x70], 0
mov dword [ecx + 0x74], 0
mov dword [ecx + 0x78], 0
mov dword [ecx + 0x7c], 0
mov dword [ecx + 0x80], 0
mov dword [ecx + 0x84], 0
movups xmmword [ecx + 0x90], xmm0
mov dword [ecx + 0xa0], 0
mov dword [ecx + 0xa4], 0xf
mov dword [ebp - 0x10], ecx
mov byte [ecx + 0x90], 0
mov dword [ebp - 4], 0
movups xmmword [ecx + 0xa8], xmm0
mov dword [ecx + 0xb8], 0
mov dword [ecx + 0xbc], 0xf
mov byte [ecx + 0xa8], 0
mov byte [ebp - 4], 1
mov word [ecx + 0xc1], 0
mov byte [ecx + 0xc3], 0
mov dword [ecx + 0xc0], 0
mov dword [ecx + 0x400], 0
mov dword [ecx + 0x404], 0
mov dword [ecx + 0x408], 0
mov dword [ecx + 0x40c], 0
mov dword [ecx + 0x410], 0
mov dword [ecx + 0x414], 0
mov dword [ecx + 0x418], 0
mov dword [ecx + 0x41c], 0
mov byte [ecx + 0x420], 0
push eax
mov byte [ecx + 0x3424], 0
mov dword [ecx + 0x3428], 0
mov dword [ecx + 0x342c], 0
mov dword [ecx + 0x3430], 0
mov dword [ecx + 0x3434], 0
mov dword [ecx + 0x3438], 0
mov dword [ecx + 0x343c], 0
mov byte [ecx + 0x344d], 0
mov byte [ecx + 0x3458], 0
mov byte [ecx + 0x3744], 0
mov dword [ecx + 0x3748], 0
mov dword [ecx + 0x374c], 0
mov dword [ecx + 0x3750], 0
mov dword [ecx + 0x3754], 0
mov dword [ecx + 0x3758], 0
mov dword [ecx + 0x375c], 0
mov byte [ecx + 0x3764], 0
mov dword [ecx + 0x3774], 0
mov byte [ecx + 0x377a], 0
mov dword [ecx + 0x377c], 0
mov dword [ecx + 0x3780], 0
call fcn.10024900
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
Function at 0x1002e1f0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [ebp + 8]
push ebx
push esi
mov dword [ebp - 0x10], eax
mov ebx, ecx
dec eax
push edi
mov edi, edx
mov dword [ebp - 0x14], eax
mov edx, dword [ebp + 0xc]
mov esi, edi
sar eax, 1
mov ecx, edi
mov dword [ebp - 4], edx
mov dword [ebp - 8], esi
mov dword [ebp - 0xc], eax
cmp edi, eax
jge 0x1002e24e
nop dword [eax]
lea esi, [ecx + ecx]
push dword [ebx + esi*4 + 4]
push dword [ebx + esi*4 + 8]
call fcn.100275c0
movzx ecx, al
xor ecx, 1
inc ecx
add ecx, esi
mov eax, dword [ebx + ecx*4]
mov dword [ebx + edi*4], eax
mov edi, ecx
mov eax, dword [ebp - 0xc]
cmp ecx, eax
jl 0x1002e220
mov edx, dword [ebp - 4]
mov esi, dword [ebp - 8]
mov edi, ecx
cmp ecx, eax
jne 0x1002e265
mov eax, dword [ebp - 0x10]
test al, 1
jne 0x1002e265
mov eax, dword [ebx + eax*4 - 4]
mov edi, dword [ebp - 0x14]
mov dword [ebx + ecx*4], eax
cmp esi, edi
jge 0x1002e2b0
nop dword [eax]
push dword [edx]
lea esi, [edi - 1]
sar esi, 1
push dword [ebx + esi*4]
call fcn.100275c0
test al, al
je 0x1002e2a1
mov eax, dword [ebx + esi*4]
mov edx, dword [ebp - 4]
mov dword [ebx + edi*4], eax
mov edi, esi
cmp dword [ebp - 8], esi
jl 0x1002e270
mov eax, edx
mov eax, dword [eax]
mov dword [ebx + edi*4], eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 4]
mov eax, dword [eax]
mov dword [ebx + edi*4], eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [edx]
mov dword [ebx + edi*4], eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10035a60
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x100db040]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, ecx
cmp dword [esi + 0x38], 0
je 0x10035b1c
cmp byte [esi + 0x3d], 0
je 0x10035b1c
mov eax, dword [esi]
push edi
push 0xffffffffffffffff
call dword [eax + 0xc]
cmp eax, 0xffffffff
je 0x10035b0a
mov ecx, dword [esi + 0x38]
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [esi + 0x40]
push eax
call dword [sym.imp.MSVCP140.dll_public:_int___thiscall_std::codecvt_char__char__struct__Mbstatet_::unshift_struct__Mbstatet___char___char___char___const]
sub eax, 0
je 0x10035ad1
sub eax, 1
je 0x10035ad5
sub eax, 2
jne 0x10035b0a
mov byte [esi + 0x3d], al
mov al, 1
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100bbbac
mov esp, ebp
pop ebp
ret
mov byte [esi + 0x3d], 0
mov edi, dword [ebp - 0x28]
lea eax, [ebp - 0x24]
sub edi, eax
je 0x10035af3
push dword [esi + 0x4c]
push edi
push 1
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
add esp, 0x10
cmp edi, eax
jne 0x10035b0a
cmp byte [esi + 0x3d], 0
pop edi
sete al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100bbbac
mov esp, ebp
pop ebp
ret
pop edi
xor al, al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100bbbac
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
mov al, 1
xor ecx, ebp
pop esi
call fcn.100bbbac
mov esp, ebp
pop ebp
ret
Function at 0x10038930
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
cmp byte [0x100f43cc], 0
push ebx
push esi
push edi
je 0x10038abe
mov ecx, dword [0x10165664]
mov eax, dword [ecx]
mov eax, dword [eax + 0x68]
call eax
test al, al
je 0x10038abe
mov ecx, dword [0x101656ec]
xor ebx, ebx
mov dword [ebp - 4], ecx
mov eax, dword [ecx + 0x28]
mov dword [ebp - 8], eax
test eax, eax
je 0x10038abe
mov eax, dword [ecx + 0x1c]
mov ecx, dword [eax + ebx*4]
mov eax, dword [ecx]
mov eax, dword [eax + 0x30]
call eax
mov esi, eax
mov edi, 0x811c9dc5
xor ecx, ecx
nop word [eax + eax]
inc ecx
cmp byte [esi + ecx], 0
jne 0x10038990
xor edx, edx
test ecx, ecx
je 0x100389b9
nop dword [eax]
movsx eax, byte [esi + edx]
inc edx
xor eax, edi
imul edi, eax, 0x1000193
cmp edx, ecx
jb 0x100389a0
cmp edi, 0x5ff56dc5
je 0x100389c8
inc ebx
cmp ebx, dword [ebp - 8]
jae 0x10038abe
mov ecx, dword [ebp - 4]
jmp 0x10038974
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x1c]
mov edi, dword [eax + ebx*4]
test edi, edi
je 0x10038abe
mov edx, dword [edi + 0x88]
test edx, edx
je 0x10038abe
movss xmm1, dword [0x100cff80]
xor ebx, ebx
cmp edx, 4
jl 0x10038a8b
mov ecx, dword [edi + 0x7c]
lea esi, [edx - 4]
shr esi, 2
add ecx, 0x1078
inc esi
lea ebx, [esi*4]
movss xmm0, dword [ecx - 0xc60]
ucomiss xmm0, xmm1
lahf
test ah, 0x44
jp 0x10038a2c
mov dword [ecx - 0xc60], 0x7f7fffff
movss xmm0, dword [ecx - 0x840]
ucomiss xmm0, xmm1
lahf
test ah, 0x44
jp 0x10038a47
mov dword [ecx - 0x840], 0x7f7fffff
movss xmm0, dword [ecx - 0x420]
ucomiss xmm0, xmm1
lahf
test ah, 0x44
jp 0x10038a62
mov dword [ecx - 0x420], 0x7f7fffff
movss xmm0, dword [ecx]
ucomiss xmm0, xmm1
lahf
test ah, 0x44
jp 0x10038a75
mov dword [ecx], 0x7f7fffff
add ecx, 0x1080
sub esi, 1
jne 0x10038a11
cmp ebx, edx
jl 0x10038a8f
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
test edx, edx
jle 0x10038abe
imul ecx, ebx, 0x420
add ecx, 0x418
add ecx, dword [edi + 0x7c]
sub edx, ebx
movss xmm0, dword [ecx]
ucomiss xmm0, xmm1
lahf
test ah, 0x44
jp 0x10038ab3
mov dword [ecx], 0x7f7fffff
add ecx, 0x420
sub edx, 1
jne 0x10038aa0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10038e50
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [0x1016acac]
sub esp, 0xc
push ebx
push esi
push edi
test al, 1
jne 0x10038ed1
or eax, 1
mov dword [0x1016acac], eax
mov ebx, dword [0x10165660]
mov ebx, dword [ebx + 0x30]
test ebx, ebx
je 0x10038ec9
nop word [eax + eax]
mov edi, dword [ebx + 0xc]
mov esi, 0x811c9dc5
xor ecx, ecx
nop word [eax + eax]
inc ecx
cmp byte [edi + ecx], 0
jne 0x10038e90
xor edx, edx
test ecx, ecx
je 0x10038ebd
nop dword [eax]
movsx eax, byte [edi + edx]
inc edx
xor eax, esi
imul esi, eax, 0x1000193
cmp edx, ecx
jb 0x10038ea0
cmp esi, 0xa9bf35
je 0x10038f53
mov ebx, dword [ebx + 4]
test ebx, ebx
jne 0x10038e80
mov eax, dword [0x1016acac]
xor ebx, ebx
mov dword [0x1016ac94], ebx
test al, 2
jne 0x10038f3d
or eax, 2
mov dword [0x1016acac], eax
mov ecx, dword [0x10165660]
mov ebx, dword [ecx + 0x30]
test ebx, ebx
je 0x10038f35
nop word [eax + eax]
mov edi, dword [ebx + 0xc]
mov esi, 0x811c9dc5
xor ecx, ecx
nop word [eax + eax]
inc ecx
cmp byte [edi + ecx], 0
jne 0x10038f00
xor edx, edx
test ecx, ecx
je 0x10038f29
nop dword [eax]
movsx eax, byte [edi + edx]
inc edx
xor eax, esi
imul esi, eax, 0x1000193
cmp edx, ecx
jb 0x10038f10
cmp esi, 0xe5abc68c
je 0x10038f5d
mov ebx, dword [ebx + 4]
test ebx, ebx
jne 0x10038ef0
mov eax, dword [0x1016acac]
xor ebx, ebx
mov dword [0x1016ac88], ebx
test al, 4
jne 0x10038fa8
or eax, 4
mov dword [0x1016acac], eax
mov eax, dword [0x10165660]
mov ebx, dword [eax + 0x30]
jmp 0x10038f9c
mov eax, dword [0x1016acac]
jmp 0x10038ecb
mov eax, dword [0x1016acac]
jmp 0x10038f37
mov edi, dword [ebx + 0xc]
mov esi, 0x811c9dc5
xor ecx, ecx
nop
inc ecx
cmp byte [edi + ecx], 0
jne 0x10038f70
xor edx, edx
test ecx, ecx
je 0x10038f99
nop dword [eax]
movsx eax, byte [edi + edx]
inc edx
xor eax, esi
imul esi, eax, 0x1000193
cmp edx, ecx
jb 0x10038f80
cmp esi, 0xadc3dc05
je 0x10038fa0
mov ebx, dword [ebx + 4]
test ebx, ebx
jne 0x10038f64
mov dword [0x1016ac80], ebx
jmp 0x10038fae
mov ebx, dword [0x1016ac80]
mov eax, dword [ebx]
mov ecx, ebx
mov eax, dword [eax + 0x30]
call eax
mov ecx, dword [0x1016ac88]
fstp dword [ebp - 8]
mov eax, dword [ecx]
mov eax, dword [eax + 0x30]
mov dword [ebp - 4], eax
call dword [ebp - 4]
mov ecx, dword [0x1016ac94]
fstp dword [ebp - 0xc]
mov eax, dword [ecx]
mov eax, dword [eax + 0x30]
mov dword [ebp - 4], eax
call dword [ebp - 4]
movss xmm0, dword [ebp - 8]
sub esp, 8
divss xmm0, dword [ebp - 0xc]
fstp dword [ebp - 4]
movss dword [esp + 4], xmm0
movss xmm0, dword [ebp - 4]
movss dword [esp], xmm0
call dword [sym.imp.api_ms_win_crt_math_l1_1_0.dll_fmaxf]
add esp, 8
fstp dword [0x100de978]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1003a300
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100bed45
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push ebx
push esi
push edi
mov eax, dword [0x100db040]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
movzx eax, byte [esi]
xor eax, 0x811c9dc5
imul ecx, eax, 0x1000193
movzx eax, byte [esi + 1]
xor ecx, eax
movzx eax, byte [esi + 2]
imul ecx, ecx, 0x1000193
xor ecx, eax
movzx eax, byte [esi + 3]
imul ecx, ecx, 0x1000193
xor ecx, eax
lea eax, [ebp - 0x14]
imul edi, ecx, 0x1000193
push edi
push esi
push eax
call fcn.1003b570
mov eax, dword [ebp - 0x10]
test eax, eax
jne 0x1003a42b
cmp dword [0x1016ab18], 0xfffffff
jne 0x1003a38a
push str.unordered_map_set_too_long
call dword [sym.imp.MSVCP140.dll_void___cdecl_std::_Xlength_error_char_const__]
mov dword [ebp - 0x1c], 0x1016ab14
mov dword [ebp - 4], 0
push 0x10
mov dword [ebp - 0x18], 0
call fcn.100bbbc8
mov ebx, eax
add esp, 4
mov eax, dword [esi]
mov dword [ebp - 0x18], ebx
mov dword [ebx + 8], eax
mov dword [ebx + 0xc], 0
mov dword [ebp - 4], 1
mov eax, dword [0x1016ab18]
inc eax
movd xmm0, eax
cvtdq2pd xmm0, xmm0
shr eax, 0x1f
addsd xmm0, qword [eax*8 + 0x100d0240]
mov eax, dword [0x1016ab2c]
cvtpd2ps xmm1, xmm0
movd xmm0, eax
cvtdq2pd xmm0, xmm0
shr eax, 0x1f
addsd xmm0, qword [eax*8 + 0x100d0240]
cvtpd2ps xmm0, xmm0
divss xmm1, xmm0
comiss xmm1, dword [0x1016ab10]
jbe 0x1003a420
call fcn.1003b310
push edi
lea eax, [ebx + 8]
push eax
lea eax, [ebp - 0x1c]
push eax
call fcn.1003b570
mov ecx, dword [eax]
jmp 0x1003a423
mov ecx, dword [ebp - 0x14]
push ebx
push ecx
push edi
call fcn.1003b390
add eax, 0xc
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4