joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4383c9
Capabilities:
Check if file exists
Set current directory

Disassembly:
mov eax, 0x4c8d20
call fcn.00493f50
sub esp, 0x1c
push ebx
push esi
push edi
mov esi, ecx
push dword [ebp + 8]
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x438407
push dword [ebp + 8]
lea eax, [ebp - 0x10]
push eax
call fcn.0041a626
pop ecx
pop ecx
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
lea ecx, [ebp - 0x10]
call fcn.004b3d3e
lea eax, [ebp - 0x14]
push eax
call fcn.0041c60e
pop ecx
mov eax, dword [eax]
and dword [ebp - 4], 0
push 1
push 1
push eax
lea ecx, [ebp - 0x28]
call fcn.00419b38
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 2
call fcn.004b3d3e
push dword [ebp + 8]
lea edi, [esi + 0x18]
mov ecx, edi
call fcn.004b3ed5
push dword [ebp + 0x10]
mov eax, esi
neg eax
push dword [ebp - 0x24]
lea ecx, [esi + 0x10]
sbb eax, eax
and eax, ecx
mov ecx, esi
push eax
call fcn.004381a6
test eax, eax
je 0x43845e
mov esi, eax
jmp 0x438493
push dword [ebp + 0x10]
mov ebx, dword [ebp + 0xc]
mov eax, dword [esi]
mov ecx, esi
push ebx
push dword [ebp - 0x24]
call dword [eax + 0x24]
test eax, eax
je 0x438478
or esi, 0xffffffff
jmp 0x438493
mov edi, dword [edi]
mov eax, dword [esi]
push edi
push ebx
mov ecx, esi
call dword [eax + 0x28]
or esi, 0xffffffff
cmp eax, esi
je 0x438493
mov eax, dword [ebx]
mov ecx, ebx
call dword [eax + 0xc]
xor esi, esi
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x28]
call fcn.00419ba5
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret 0xc
Function at 0x43cb10
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x4c9038
push eax
mov dword fs:[0], esp
sub esp, 0x1c
push ebx
push ebp
push esi
mov esi, dword [esp + 0x38]
push edi
mov edi, dword [esp + 0x44]
push esi
mov ebx, ecx
push edi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
push esi
push edi
mov ebp, eax
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x43cb92
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
test eax, eax
je 0x43cbb7
push ebp
push eax
lea ecx, [esp + 0x18]
call fcn.004426a0
mov eax, dword [esp + 0x40]
lea ecx, [esp + 0x10]
push eax
push ecx
mov ecx, ebx
mov dword [esp + 0x3c], 0
call fcn.0043ccc0
lea ecx, [esp + 0x10]
mov bl, al
mov dword [esp + 0x34], 0xffffffff
call fcn.004426f0
mov al, bl
jmp 0x43cbb9
mov edi, str.Unable_to_load_resource_
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebx + 0x44]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
xor al, al
mov ecx, dword [esp + 0x2c]
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x28
ret 0xc
Function at 0x446590
Capabilities:
Enumerate pe sections

Disassembly:
sub esp, 0x14
push ebx
push ebp
push esi
mov esi, dword [esp + 0x28]
mov ebp, ecx
push edi
mov dword [esp + 0x1c], ebp
call fcn.00439870
xor ecx, ecx
xor edx, edx
mov cx, word [esi + 2]
mov dx, word [esi + 6]
sub eax, ecx
sub eax, edx
jns 0x4465c2
mov dword [esp + 0x2c], 0
jmp 0x4465dd
mov ecx, ebp
call fcn.00439870
xor ecx, ecx
xor edx, edx
mov cx, word [esi + 2]
mov dx, word [esi + 6]
sub eax, ecx
sub eax, edx
mov dword [esp + 0x2c], eax
mov ecx, ebp
call fcn.00439870
xor edi, edi
mov ebx, eax
mov di, word [esi]
xor ecx, ecx
mov cx, word [esi + 4]
xor edx, edx
xor eax, eax
mov dx, di
mov ax, word [esi + 2]
sub ebx, eax
lea esi, [ecx + edx]
mov ecx, ebp
mov dword [esp + 0x20], ebx
call fcn.00439880
cmp eax, esi
jae 0x44661d
mov ecx, ebp
call fcn.00439880
mov dword [esp + 0x10], eax
jmp 0x446621
mov dword [esp + 0x10], esi
mov ecx, dword [esp + 0x28]
call fcn.004396a0
mov ebp, dword [esp + 0x2c]
mov dword [esp + 0x18], eax
cmp ebp, ebx
jge 0x44668d
mov eax, dword [esp + 0x10]
mov esi, edi
cmp edi, eax
jge 0x446688
mov eax, dword [esp + 0x2c]
mov ebx, ebp
sub ebx, eax
mov ecx, dword [esp + 0x28]
mov eax, esi
sub eax, edi
push ebx
push eax
call fcn.0043ab20
mov edx, dword [esp + 0x18]
mov byte [esp + 0x14], al
mov eax, dword [esp + 0x14]
mov ecx, eax
and ecx, 0xff
cmp ecx, edx
je 0x44667b
mov ecx, dword [esp + 0x1c]
push eax
push ebp
push esi
call fcn.0043af90
mov eax, dword [esp + 0x10]
inc esi
cmp esi, eax
jl 0x446648
mov ebx, dword [esp + 0x20]
inc ebp
cmp ebp, ebx
jl 0x446636
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x14
ret 8
Function at 0x4739a0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x58
push ebx
push esi
xor esi, esi
push edi
mov dword [ebp - 8], esi
mov eax, dword [ebp + 0x18]
mov ecx, dword [ebp + 0x1c]
push eax
push ecx
push 1
call fcn.00475390
add esp, 0xc
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
cmp eax, esi
jne 0x4739d3
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov edx, dword [ebp - 4]
mov eax, 0xf4240
mov dword [edx + 0x258], eax
mov ecx, dword [ebp - 4]
push 0x40
mov dword [ecx + 0x25c], eax
push fcn.00497344
mov edx, dword [ebp - 4]
push edx
call fcn.00471d50
push esi
push eax
call fcn.004973c0
add esp, 0x14
test eax, eax
je 0x473a0f
push esi
call dword [sym.imp.KERNEL32.dll_ExitProcess]
mov eax, dword [ebp + 0x20]
mov ecx, dword [ebp + 0x1c]
mov edx, dword [ebp + 0x18]
push eax
push ecx
push edx
mov eax, dword [ebp - 4]
push eax
call fcn.004755b0
mov ecx, dword [ebp + 0x14]
mov edx, dword [ebp + 0x10]
mov eax, dword [ebp + 0xc]
push ecx
push edx
push eax
mov ecx, dword [ebp - 4]
push ecx
call fcn.00471e10
mov edi, dword [ebp + 8]
add esp, 0x20
cmp edi, esi
mov ebx, 0x20000
je 0x473a79
push 0
call fcn.00472540
mov dl, byte [esi + edi]
mov cl, byte [eax + esi]
add esp, 4
cmp dl, cl
je 0x473a67
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0x70]
or ecx, ebx
mov dword [eax + 0x70], ecx
push 0
call fcn.00472540
mov al, byte [eax + esi]
add esp, 4
inc esi
test al, al
jne 0x473a48
mov ecx, dword [ebp - 4]
mov eax, dword [ecx + 0x70]
test ebx, eax
je 0x473af1
test edi, edi
je 0x473aea
mov bl, byte [edi]
push 0
call fcn.00472540
mov cl, byte [eax]
add esp, 4
cmp bl, cl
jne 0x473abd
cmp bl, 0x31
jne 0x473ab2
push 0
call fcn.00472540
mov dl, byte [edi + 2]
mov cl, byte [eax + 2]
add esp, 4
cmp dl, cl
jne 0x473abd
cmp byte [edi], 0x30
jne 0x473af1
cmp byte [edi + 2], 0x39
jge 0x473af1
test edi, edi
je 0x473aea
push 0
call fcn.00472540
push eax
push edi
push str.Application_built_with_libpng__.20s_but_running_with__.20s
lea eax, [ebp - 0x58]
push 0x50
push eax
call fcn.004977d2
lea ecx, [ebp - 0x58]
push ecx
mov edx, dword [ebp - 4]
push edx
call fcn.00471b70
add esp, 0x20
mov dword [ebp - 8], 1
mov eax, dword [ebp - 4]
mov dword [eax + 0xb4], 0x2000
mov eax, dword [ebp - 8]
test eax, eax
jne 0x473b3f
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 0xb4]
push edx
mov eax, dword [ebp - 4]
push eax
call fcn.00475580
add esp, 8
mov ecx, dword [ebp - 4]
mov dword [ecx + 0xb0], eax
mov edx, dword [ebp - 4]
mov eax, dword [edx + 0xb0]
test eax, eax
jne 0x473b38
mov dword [ebp - 8], 1
mov eax, dword [ebp - 8]
test eax, eax
je 0x473b7c
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0xb0]
push ecx
mov edx, dword [ebp - 4]
push edx
call fcn.00475530
mov eax, dword [ebp - 4]
mov ecx, dword [ebp + 0x18]
mov edx, dword [ebp + 0x20]
push ecx
mov dword [eax + 0xb0], 0
push edx
mov eax, dword [ebp - 4]
push eax
call fcn.00475430
add esp, 0x14
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 0
push 0
push 0
mov ecx, dword [ebp - 4]
push ecx
call fcn.00475310
mov edx, dword [ebp - 4]
push edx
call fcn.004740a0
add esp, 0x14
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x495276
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push dword [esp + 4]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x495296
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.00497dbe
pop ecx
or eax, 0xffffffff
ret
test al, 1
je 0x4952b9
test byte [esp + 8], 2
je 0x4952b9
call fcn.00497e31
mov dword [eax], 0xd
call fcn.00497e3a
mov dword [eax], 5
jmp 0x495292
xor eax, eax
ret
Function at 0x4abeb0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov eax, dword [esp + 8]
sub esp, 4
push ebx
push esi
mov esi, dword [esp + 0x10]
push edi
push ebp
push 2
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov edi, eax
test edi, edi
jne 0x4abedb
xor eax, eax
pop ebp
pop edi
pop esi
pop ebx
add esp, 4
ret 0x20
push edi
push esi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ebx, eax
push edi
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov esi, eax
test esi, esi
jne 0x4abeff
xor eax, eax
pop ebp
pop edi
pop esi
pop ebx
add esp, 4
ret 0x20
push ebx
push 0x40
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov ebp, eax
test ebp, ebp
jne 0x4abf1a
xor eax, eax
pop ebp
pop edi
pop esi
pop ebx
add esp, 4
ret 0x20
mov edi, ebp
mov ecx, ebx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov eax, dword [esp + 0x20]
xor ecx, ecx
mov cl, ah
mov edx, eax
mov dword [esp + 0x10], 0
shl ecx, 8
shr edx, 0x10
mov byte [esp + 0x10], dl
xor edx, edx
or ecx, dword [esp + 0x10]
mov dl, al
shl edx, 0x10
mov eax, dword [esp + 0x28]
or ecx, edx
mov edx, eax
shr edx, 0x10
mov dword [ebp + 0x28], ecx
mov dword [esp + 0x10], 0
xor ecx, ecx
mov byte [esp + 0x10], dl
mov cl, ah
xor edx, edx
shl ecx, 8
mov dl, al
shl edx, 0x10
or ecx, dword [esp + 0x10]
or ecx, edx
mov eax, dword [esp + 0x24]
mov edx, eax
mov dword [ebp + 0x44], ecx
shr edx, 0x10
xor ecx, ecx
mov dword [esp + 0x10], 0
mov cl, ah
mov byte [esp + 0x10], dl
shl ecx, 8
xor edx, edx
or ecx, dword [esp + 0x10]
mov dl, al
shl edx, 0x10
mov eax, dword [esp + 0x2c]
or ecx, edx
xor edx, edx
mov dl, al
mov dword [ebp + 0x48], ecx
shl edx, 0x10
xor ecx, ecx
mov cl, ah
shl ecx, 8
shr eax, 0x10
or ecx, edx
xor edx, edx
mov dl, al
mov eax, dword [esp + 0x30]
or ecx, edx
xor edx, edx
mov dl, al
mov dword [ebp + 0x64], ecx
shl edx, 0x10
xor ecx, ecx
mov cl, ah
shl ecx, 8
shr eax, 0x10
or ecx, edx
xor edx, edx
mov dl, al
mov eax, dword [esp + 0x34]
or ecx, edx
xor edx, edx
mov dl, al
mov dword [ebp + 0x54], ecx
shl edx, 0x10
xor ecx, ecx
mov cl, ah
shl ecx, 8
push 0
shr eax, 0x10
or ecx, edx
xor edx, edx
mov dl, al
or ecx, edx
mov dword [ebp + 0x50], ecx
call dword [sym.imp.USER32.dll_GetDC]
mov edi, eax
push 0
push ebp
lea ecx, [ebp + 0x68]
push ecx
push 4
push ebp
push edi
call dword [sym.imp.GDI32.dll_CreateDIBitmap]
mov esi, eax
push edi
push 0
call dword [sym.imp.USER32.dll_ReleaseDC]
push ebp
call dword [sym.imp.KERNEL32.dll_GlobalFree]
mov eax, esi
pop ebp
pop edi
pop esi
pop ebx
add esp, 4
ret 0x20

Function at 0x4b0d4f
Capabilities:
Get graphical window text

Disassembly:
push esi
mov esi, ecx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x4b0d87
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextLengthW]
lea ecx, [eax + 1]
push ecx
mov ecx, dword [esp + 0xc]
push eax
call fcn.004b41fc
push eax
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextW]
mov ecx, dword [esp + 8]
push 0xffffffffffffffff
call fcn.004b41d3
jmp 0x4b0d93
mov eax, dword [ecx]
push dword [esp + 8]
call dword [eax + 0x88]
pop esi
ret 4
Function at 0x4b2695
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
push edi
xor edi, edi
cmp dword [esp + 0x10], edi
mov ebx, ecx
je 0x4b26d7
call fcn.004c2dcb
mov esi, dword [eax + 0xc]
push 0xf0
push dword [esp + 0x14]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
cmp eax, edi
je 0x4b26d7
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp eax, edi
jne 0x4b26ce
xor eax, eax
jmp 0x4b26df
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
push edi
mov ecx, ebx
call fcn.004b26e5
pop edi
pop esi
pop ebx
ret 4
Function at 0x406ad0
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x450940
mov eax, dword fs:[0]
push eax
push esi
push edi
mov eax, dword [0x46b080]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
push 8
mov dword [edi], vtable.std::basic_streambuf_char__struct_std::char_traits_char__.0
mov dword [edi + 4], 0
mov dword [edi + 8], 0
mov dword [edi + 0xc], 0
mov dword [edi + 0x10], 0
mov dword [edi + 0x14], 0
mov dword [edi + 0x18], 0
mov dword [edi + 0x1c], 0
mov dword [edi + 0x20], 0
mov dword [edi + 0x24], 0
mov dword [edi + 0x28], 0
mov dword [edi + 0x2c], 0
mov dword [edi + 0x30], 0
call fcn.0042ae5d
mov esi, eax
push 1
mov dword [ebp - 4], 0
call fcn.00429ddc
add esp, 8
mov dword [esi + 4], eax
mov ecx, edi
mov dword [edi + 0x34], esi
call fcn.00407040
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x4086d0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x450c4d
mov eax, dword fs:[0]
push eax
push ecx
mov eax, dword [0x46b080]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edx, ecx
mov dword [ebp - 0x10], edx
mov dword [edx], 0x467a0000
xorps xmm0, xmm0
mov dword [edx + 4], 0x41200000
mov dword [edx + 8], 0x41c80000
mov dword [edx + 0xc], 0x37fba882
mov dword [edx + 0x10], 0x3f7851ec
mov byte [edx + 0x14], 1
movups xmmword [edx + 0x18], xmm0
mov dword [edx + 0x28], 5
mov dword [edx + 0x2c], 0xf
mov eax, dword [str.povey]
mov dword [edx + 0x18], eax
mov al, byte [0x45c944]
mov byte [edx + 0x1c], al
mov byte [edx + 0x1d], 0
mov byte [edx + 0x30], 1
mov dword [edx + 0x34], 0x3ed70a3d
mov byte [edx + 0x38], 1
lea ecx, [edx + 0x3c]
mov dword [ebp - 0x10], ecx
mov dword [ecx], 0x19
mov dword [ecx + 4], 0x41a00000
mov dword [ecx + 8], 0
mov dword [ecx + 0xc], 0x42c80000
mov dword [ecx + 0x10], 0xc3fa0000
mov word [ecx + 0x14], 0
mov byte [ecx + 0x16], 0
movups xmmword [ecx + 0x18], xmm0
mov dword [ecx + 0x28], 6
mov dword [ecx + 0x2c], 0xf
mov eax, dword [str.slaney]
mov dword [ecx + 0x18], eax
mov ax, word [0x45c94c]
mov word [ecx + 0x1c], ax
mov eax, edx
mov byte [ecx + 0x1e], 0
mov byte [edx + 0x6c], 0
mov dword [edx + 0x70], 0
mov dword [edx + 0x74], 0x1010001
mov dword [ecx], 0x17
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
Function at 0x408830
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x450c4d
mov eax, dword fs:[0]
push eax
push ecx
mov eax, dword [0x46b080]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edx, ecx
mov dword [ebp - 0x10], edx
mov dword [edx], 0x467a0000
xorps xmm0, xmm0
mov dword [edx + 4], 0x41200000
mov dword [edx + 8], 0x41c80000
mov dword [edx + 0xc], 0x37fba882
mov dword [edx + 0x10], 0x3f7851ec
mov byte [edx + 0x14], 1
movups xmmword [edx + 0x18], xmm0
mov dword [edx + 0x28], 5
mov dword [edx + 0x2c], 0xf
mov eax, dword [str.povey]
mov dword [edx + 0x18], eax
mov al, byte [0x45c944]
mov byte [edx + 0x1c], al
mov byte [edx + 0x1d], 0
mov byte [edx + 0x30], 1
mov dword [edx + 0x34], 0x3ed70a3d
mov byte [edx + 0x38], 1
lea ecx, [edx + 0x3c]
mov dword [ebp - 0x10], ecx
mov dword [ecx], 0x19
mov dword [ecx + 4], 0x41a00000
mov dword [ecx + 8], 0
mov dword [ecx + 0xc], 0x42c80000
mov dword [ecx + 0x10], 0xc3fa0000
mov word [ecx + 0x14], 0
mov byte [ecx + 0x16], 0
movups xmmword [ecx + 0x18], xmm0
mov dword [ecx + 0x28], 6
mov dword [ecx + 0x2c], 0xf
mov eax, dword [str.slaney]
mov dword [ecx + 0x18], eax
mov ax, word [0x45c94c]
mov word [ecx + 0x1c], ax
mov eax, edx
mov byte [ecx + 0x1e], 0
mov dword [edx + 0x6c], 0xd
mov byte [edx + 0x70], 1
mov dword [edx + 0x74], 0
mov byte [edx + 0x78], 1
mov dword [edx + 0x7c], 0x41b00000
mov byte [edx + 0x80], 0
mov dword [ecx], 0x17
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
Function at 0x411210
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x45153d
mov eax, dword fs:[0]
push eax
sub esp, 0x34
mov eax, dword [0x46b080]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov dword [ebp - 0x30], ebx
mov eax, dword [ebp + 0xc]
lea ecx, [ebp - 0x28]
mov esi, dword [ebp + 8]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp + 0x10]
push esi
mov dword [ebp - 0x34], eax
call fcn.00405520
lea eax, [ebp - 0x28]
mov dword [ebp - 4], 0
push eax
call fcn.0040fb50
cmp dword [ebp - 0x14], 0xf
lea edi, [ebp - 0x28]
lea eax, [ebx + 0xe0]
mov edx, 0x811c9dc5
cmova edi, dword [ebp - 0x28]
xor ecx, ecx
mov ebx, dword [ebp - 0x18]
mov dword [ebp - 0x2c], eax
test ebx, ebx
je 0x4112a4
nop word [eax + eax]
movzx eax, byte [edi + ecx]
inc ecx
xor eax, edx
imul edx, eax, 0x1000193
cmp ecx, ebx
jb 0x411290
mov eax, dword [ebp - 0x2c]
push edx
lea ecx, [ebp - 0x28]
push ecx
lea ecx, [ebp - 0x40]
push ecx
mov ecx, eax
call fcn.00411930
mov eax, dword [eax + 4]
test eax, eax
jne 0x4112c1
mov eax, dword [ebp - 0x2c]
mov eax, dword [eax + 4]
mov ecx, dword [ebp - 0x30]
cmp eax, dword [ecx + 0xe4]
je 0x41132b
push 0x65
push str.RegisterCommon
push str.D:_a_sherpa_onnx_sherpa_onnx_sherpa_onnxcsrcparse_options.cc
push str._s:_s:_d
push 2
call fcn.0042fe80
add esp, 4
push eax
call fcn.004010b0
add esp, 0x14
cmp dword [esi + 0x14], 0xf
jbe 0x4112f8
mov esi, dword [esi]
push 2
call fcn.0042fe80
add esp, 4
push esi
push str.Registering_option_twice__ignoring_second_time:__s
push eax
call fcn.004010b0
add esp, 0xc
push 0x45c670
push 2
call fcn.0042fe80
add esp, 4
push eax
call fcn.004010b0
add esp, 8
jmp 0x41133e
push dword [ebp + 0x14]
lea eax, [ebp - 0x28]
push dword [ebp - 0x34]
push dword [ebp - 0x38]
push eax
push esi
call fcn.0040dae0
mov ecx, dword [ebp - 0x14]
cmp ecx, 0xf
jbe 0x41136e
mov edx, dword [ebp - 0x28]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x411364
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x41138c
push ecx
push edx
call fcn.0042ae8d
add esp, 8
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0042ae4f
mov esp, ebp
pop ebp
ret 0x10
call fcn.00432a40
int3
Function at 0x4113a0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x45153d
mov eax, dword fs:[0]
push eax
sub esp, 0x34
mov eax, dword [0x46b080]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov dword [ebp - 0x30], ebx
mov eax, dword [ebp + 0xc]
lea ecx, [ebp - 0x28]
mov esi, dword [ebp + 8]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp + 0x10]
push esi
mov dword [ebp - 0x34], eax
call fcn.00405520
lea eax, [ebp - 0x28]
mov dword [ebp - 4], 0
push eax
call fcn.0040fb50
cmp dword [ebp - 0x14], 0xf
lea edi, [ebp - 0x28]
lea eax, [ebx + 0xe0]
mov edx, 0x811c9dc5
cmova edi, dword [ebp - 0x28]
xor ecx, ecx
mov ebx, dword [ebp - 0x18]
mov dword [ebp - 0x2c], eax
test ebx, ebx
je 0x411434
nop word [eax + eax]
movzx eax, byte [edi + ecx]
inc ecx
xor eax, edx
imul edx, eax, 0x1000193
cmp ecx, ebx
jb 0x411420
mov eax, dword [ebp - 0x2c]
push edx
lea ecx, [ebp - 0x28]
push ecx
lea ecx, [ebp - 0x40]
push ecx
mov ecx, eax
call fcn.00411930
mov eax, dword [eax + 4]
test eax, eax
jne 0x411451
mov eax, dword [ebp - 0x2c]
mov eax, dword [eax + 4]
mov ecx, dword [ebp - 0x30]
cmp eax, dword [ecx + 0xe4]
je 0x4114bb
push 0x65
push str.RegisterCommon
push str.D:_a_sherpa_onnx_sherpa_onnx_sherpa_onnxcsrcparse_options.cc
push str._s:_s:_d
push 2
call fcn.0042fe80
add esp, 4
push eax
call fcn.004010b0
add esp, 0x14
cmp dword [esi + 0x14], 0xf
jbe 0x411488
mov esi, dword [esi]
push 2
call fcn.0042fe80
add esp, 4
push esi
push str.Registering_option_twice__ignoring_second_time:__s
push eax
call fcn.004010b0
add esp, 0xc
push 0x45c670
push 2
call fcn.0042fe80
add esp, 4
push eax
call fcn.004010b0
add esp, 8
jmp 0x4114cc
push ecx
push dword [ebp - 0x34]
lea eax, [ebp - 0x28]
push dword [ebp - 0x38]
push eax
push esi
call fcn.0040dda0
mov ecx, dword [ebp - 0x14]
cmp ecx, 0xf
jbe 0x4114fc
mov edx, dword [ebp - 0x28]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x4114f2
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x41151a
push ecx
push edx
call fcn.0042ae8d
add esp, 8
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0042ae4f
mov esp, ebp
pop ebp
ret 0x10
call fcn.00432a40
int3
Function at 0x411520
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x45153d
mov eax, dword fs:[0]
push eax
sub esp, 0x34
mov eax, dword [0x46b080]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov dword [ebp - 0x30], ebx
mov eax, dword [ebp + 0xc]
lea ecx, [ebp - 0x28]
mov esi, dword [ebp + 8]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp + 0x10]
push esi
mov dword [ebp - 0x34], eax
call fcn.00405520
lea eax, [ebp - 0x28]
mov dword [ebp - 4], 0
push eax
call fcn.0040fb50
cmp dword [ebp - 0x14], 0xf
lea edi, [ebp - 0x28]
lea eax, [ebx + 0xe0]
mov edx, 0x811c9dc5
cmova edi, dword [ebp - 0x28]
xor ecx, ecx
mov ebx, dword [ebp - 0x18]
mov dword [ebp - 0x2c], eax
test ebx, ebx
je 0x4115b4
nop word [eax + eax]
movzx eax, byte [edi + ecx]
inc ecx
xor eax, edx
imul edx, eax, 0x1000193
cmp ecx, ebx
jb 0x4115a0
mov eax, dword [ebp - 0x2c]
push edx
lea ecx, [ebp - 0x28]
push ecx
lea ecx, [ebp - 0x40]
push ecx
mov ecx, eax
call fcn.00411930
mov eax, dword [eax + 4]
test eax, eax
jne 0x4115d1
mov eax, dword [ebp - 0x2c]
mov eax, dword [eax + 4]
mov ecx, dword [ebp - 0x30]
cmp eax, dword [ecx + 0xe4]
je 0x41163b
push 0x65
push str.RegisterCommon
push str.D:_a_sherpa_onnx_sherpa_onnx_sherpa_onnxcsrcparse_options.cc
push str._s:_s:_d
push 2
call fcn.0042fe80
add esp, 4
push eax
call fcn.004010b0
add esp, 0x14
cmp dword [esi + 0x14], 0xf
jbe 0x411608
mov esi, dword [esi]
push 2
call fcn.0042fe80
add esp, 4
push esi
push str.Registering_option_twice__ignoring_second_time:__s
push eax
call fcn.004010b0
add esp, 0xc
push 0x45c670
push 2
call fcn.0042fe80
add esp, 4
push eax
call fcn.004010b0
add esp, 8
jmp 0x41164e
push dword [ebp + 0x14]
lea eax, [ebp - 0x28]
push dword [ebp - 0x34]
push dword [ebp - 0x38]
push eax
push esi
call fcn.0040df80
mov ecx, dword [ebp - 0x14]
cmp ecx, 0xf
jbe 0x41167e
mov edx, dword [ebp - 0x28]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x411674
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x41169c
push ecx
push edx
call fcn.0042ae8d
add esp, 8
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0042ae4f
mov esp, ebp
pop ebp
ret 0x10
call fcn.00432a40
int3