joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4097c8
Capabilities:
Allocate or change rwx memory
Get system information on windows

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xffffffbc
mov edi, eax
lea esi, [esp + 0x28]
lea eax, [esp + 4]
push eax
call sub.kernel32.dll_GetSystemInfo
mov ebx, edi
push 0x1c
push esi
push ebx
call sub.kernel32.dll_VirtualQuery
test eax, eax
je 0x40987c
jmp 0x409871
cmp dword [esi + 0x10], 0x1000
jne 0x40985d
test byte [esi + 0x15], 1
jne 0x40985d
xor ebx, ebx
mov eax, dword [esi + 0x14]
cmp eax, 1
je 0x40981c
cmp eax, 2
je 0x40981c
cmp eax, 0x10
je 0x40981c
cmp eax, 0x20
jne 0x409831
push esp
push 0x40
mov eax, dword [esi + 0xc]
push eax
mov eax, dword [esi]
push eax
call sub.kernel32.dll_VirtualProtect
test eax, eax
je 0x409831
mov bl, 1
xor ebp, ebp
jmp 0x409842
mov eax, dword [esi]
add eax, ebp
call fcn.004097c0
add ebp, dword [esp + 8]
cmp ebp, dword [esi + 0xc]
jb 0x409835
test bl, bl
je 0x40985d
push esp
mov eax, dword [esp + 4]
push eax
mov eax, dword [esi + 0xc]
push eax
mov eax, dword [esi]
push eax
call sub.kernel32.dll_VirtualProtect
mov eax, dword [esi]
add eax, dword [esi + 0xc]
mov ebx, eax
push 0x1c
push esi
push ebx
call sub.kernel32.dll_VirtualQuery
test eax, eax
je 0x40987c
mov eax, dword [esi + 4]
cmp eax, edi
je 0x4097f4
add esp, 0x44
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x431005
Capabilities:
Encode data using xor

Disassembly:
pushal
call 0x43100c
nop
nop
nop
pop eax
nop
nop
add eax, 0x403e6a
nop
nop
sub eax, 0x403e10
nop
nop
nop
nop
mov ebx, dword [eax]
nop
nop
mov ecx, dword [eax + 4]
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
xor dword [ebx], edx
nop
nop
nop
nop
nop
nop
add ebx, 4
nop
nop
nop
nop
cmp ebx, ecx
jl 0x431030
nop
nop
nop
nop
nop
nop
add eax, 0xc
nop
nop
cmp dword [eax], 0
nop
nop
nop
nop
nop
nop
jne 0x43101e
nop
nop
nop
nop
nop
popal
jmp fcn.00401219
Function at 0x40adff
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x43cd78]
jne 0x40ae09
repz ret
jmp fcn.0040da2c

Function at 0x40d443
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x43cd78]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.00406494
and dword [ebp - 0x14], 0
cmp dword [0x440744], 0
mov dword [ebp - 0x18], eax
jne 0x40d4f6
push 0x402c4c
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x40d59e
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x402c40
push ebx
call edi
test eax, eax
je 0x40d59e
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push 0x402c30
push ebx
mov dword [0x440744], eax
call edi
push eax
call esi
push 0x402c1c
push ebx
mov dword [0x440748], eax
call edi
push eax
call esi
push 0x402c00
push ebx
mov dword [0x44074c], eax
call edi
push eax
call esi
mov dword [0x440754], eax
test eax, eax
je 0x40d4f6
push 0x402be8
push ebx
call edi
push eax
call esi
mov dword [0x440750], eax
mov eax, dword [0x440750]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x40d54f
cmp dword [0x440754], ecx
je 0x40d54f
push eax
call esi
push dword [0x440754]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x40d54f
test ebx, ebx
je 0x40d54f
call edi
test eax, eax
je 0x40d546
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x40d546
test byte [ebp - 8], 1
jne 0x40d54f
or dword [ebp + 0x10], 0x200000
jmp 0x40d582
mov eax, dword [0x440748]
cmp eax, dword [ebp - 0x18]
je 0x40d582
push eax
call esi
test eax, eax
je 0x40d582
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x40d582
mov eax, dword [0x44074c]
cmp eax, dword [ebp - 0x18]
je 0x40d582
push eax
call esi
test eax, eax
je 0x40d582
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x440744]
call esi
test eax, eax
je 0x40d59e
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x40d5a0
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0040adff
leave
ret
Function at 0x4239e0
Capabilities:
Accept command line arguments
Delete directory
Get common file path

Disassembly:
mov eax, 0x1420
call fcn.0040e9b0
cmp dword [0x22826c4], 0x37
jne 0x423a97
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
push 0x403430
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
push 0
call dword [sym.imp.KERNEL32.dll_FlushFileBuffers]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_AddConsoleAliasA]
push 0
lea eax, [esp + 0x824]
push eax
push 0x403448
call dword [sym.imp.KERNEL32.dll_GetShortPathNameA]
push 0
lea ecx, [esp + 0x24]
push ecx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
lea edx, [esp + 4]
push edx
push 0
lea eax, [esp + 0x14]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_PeekConsoleInputW]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_EnumTimeFormatsW]
lea ecx, [esp + 8]
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_GetCompressedFileSizeW]
lea edx, [esp + 0xc20]
push edx
push 0
push 0x4034a0
push 0x4034b8
call dword [sym.imp.KERNEL32.dll_GetTempFileNameW]
push 0
push 0x403558
push 0x403618
call dword [sym.imp.KERNEL32.dll_CreateHardLinkW]
mov eax, dword [0x22826c8]
mov dword [esp], eax
mov eax, 0x5d1
add dword [esp], eax
mov ecx, dword [esp]
mov dl, byte [ecx + esi]
mov eax, dword [0x445854]
mov byte [eax + esi], dl
add esp, 0x1420
ret

Function at 0x423ad0
Capabilities:
Manipulate console buffer

Disassembly:
sub esp, 0x64
mov ecx, dword [esp + 0x68]
mov eax, dword [ecx]
mov edx, dword [0x43d380]
push ebx
push ebp
mov ebp, dword [0x43d37c]
push esi
mov esi, dword [ecx + 4]
mov ecx, dword [0x43d378]
mov dword [esp + 0x24], ecx
mov ecx, dword [0x43d384]
mov ebx, 0xc6ef3720
push edi
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], ebx
mov dword [esp + 0x24], edx
mov dword [esp + 0x20], ecx
mov dword [esp + 0x1c], 0x20
jmp 0x423b24
mov eax, dword [esp + 0x14]
mov edx, eax
mov ecx, eax
shr edx, 5
add edx, dword [esp + 0x20]
shl ecx, 4
add ecx, dword [esp + 0x24]
add eax, ebx
xor edx, ecx
xor edx, eax
sub esi, edx
mov ecx, esi
shl ecx, 4
mov dword [0x2278674], 0
mov dword [esp + 0x10], ecx
mov eax, dword [esp + 0x28]
add dword [esp + 0x10], eax
cmp dword [0x22826c4], 0x1be
lea edi, [ebx + esi]
jne 0x423b79
lea edx, [esp + 0x2c]
push edx
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WriteConsoleInputW]
mov eax, esi
shr eax, 5
add eax, ebp
xor eax, edi
xor dword [esp + 0x10], eax
mov dword [0x2278678], 0xff6b3619
mov dword [0x227867c], 0xffffffff
mov eax, dword [esp + 0x10]
sub dword [esp + 0x14], eax
mov ecx, dword [0x22826c4]
cmp ecx, 0x93
je 0x423bbd
lea eax, [esp + 0x18]
call fcn.00423ac0
mov ebx, dword [esp + 0x18]
dec dword [esp + 0x1c]
jne 0x423b20
cmp ecx, 0x8d4
jne 0x423bf1
lea ecx, [esp + 0x30]
push ecx
call dword [sym.imp.KERNEL32.dll_GetStartupInfoW]
mov eax, dword [esp + 0x78]
mov edx, dword [esp + 0x14]
pop edi
mov dword [eax + 4], esi
pop esi
pop ebp
mov dword [eax], edx
pop ebx
add esp, 0x64
ret 4
mov eax, dword [esp + 0x78]
mov ecx, dword [esp + 0x14]
pop edi
mov dword [eax + 4], esi
pop esi
pop ebp
mov dword [eax], ecx
pop ebx
add esp, 0x64
ret 4
Function at 0x423c10
Capabilities:
Manipulate console buffer

Disassembly:
push ecx
mov eax, dword [0x22826c4]
shr eax, 3
push esi
mov esi, dword [0x445854]
test eax, eax
je 0x423c54
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_WriteConsoleInputW]
push edi
mov edi, eax
mov edi, edi
cmp dword [0x22826c4], 0x1c
jne 0x423c46
lea eax, [esp + 0xc]
push eax
push 0
push 0
push 0
call ebx
push esi
call fcn.00423ad0
add esi, 8
dec edi
jne 0x423c30
pop edi
pop ebx
pop esi
pop ecx
ret
Function at 0x408948
Capabilities:
Encode data using xor

Disassembly:
mov ecx, 0x4085d8
inc edx
push 0x5182bd73
pop edi
call fcn.00408969
dec edi
xor dword [ebx], ecx
add ebx, 1
or edi, edx
cmp ebx, esi
jne fcn.00408948
ret
Function at 0x40c750
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
pushal
call 0x40c75f
pop dword [ebp - 0x2c]
mov eax, 0x40c75f
sub dword [ebp - 0x2c], eax
mov dword [ebp - 0x3c], 0x703bb42a
add dword [ebp - 0x3c], 0xde169121
mov dword [ebp - 0x38], 0xabf069f0
add dword [ebp - 0x38], 0x8642e255
mov dword [ebp - 0x34], 0x245a3b38
sub dword [ebp - 0x34], 0xd80df70a
mov dword [ebp - 0x30], 0x78d7d8d2
add dword [ebp - 0x30], 0x8728272e
lea eax, [ebp - 0x3c]
push eax
mov eax, 0x1b824df4
add eax, 0xe4c74260
add eax, dword [ebp - 0x2c]
call dword [eax]
mov dword [ebp - 0x3c], 0x37f2c8b
add dword [ebp - 0x3c], 0x70f33ccb
mov dword [ebp - 0x38], 0xd28d75bc
sub dword [ebp - 0x38], 0x91211447
mov dword [ebp - 0x34], 0x737b25b0
sub dword [ebp - 0x34], 0x100bb944
mov dword [ebp - 0x30], 0x2cfbb3aa
sub dword [ebp - 0x30], 0x2cfbb3aa
lea ebx, [ebp - 0x3c]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x2c]
call dword [eax]
push 0x40
push 0x1000
push 0x6ab88
push 0
call eax
mov ecx, 0x7e574d45
add ecx, 0x81a8ee90
xor esi, esi
add esi, eax
mov edi, 0xd47cd1de
sub edi, 0xd43073de
add edi, dword [ebp - 0x2c]
mov ebx, 0x8fb8fbb3
sub dword [ebp - 0x28], esi
mov edx, dword [edi]
xor dword [ebp - 0xc], edi
xor edx, ebx
xor dword [ebp - 0x1c], ebx
mov dword [esi], edx
xor dword [ebp - 0x18], 0x77356c24
add esi, 0x5efac104
sub esi, 0x5efac100
add edi, 0x171ac481
sub edi, 0x171ac47d
loop 0x40c873
add eax, 0x323f6a6a
add eax, 0xcdc177bd
mov ebx, eax
add eax, 0x6d73feee
add eax, 0x928c0117
mov ecx, 0x400000
add ecx, dword [ebp - 0x2c]
call ebx
leave
ret

Function at 0x40df10
Capabilities:
Check if file exists
Create directory

Disassembly:
push esi
mov esi, ecx
mov eax, esi
cmp dword [esi + 0x14], 8
jb 0x40df1d
mov eax, dword [esi]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
mov ecx, dword [esi + 0x14]
test eax, eax
je 0x40df40
cmp ecx, 8
jb 0x40df32
mov esi, dword [esi]
push esi
call dword [sym.imp.SHLWAPI.dll_PathIsDirectoryW]
test eax, eax
pop esi
setne al
ret
cmp ecx, 8
jb 0x40df47
mov esi, dword [esi]
push 0
push esi
push 0
call dword [sym.imp.SHELL32.dll_SHCreateDirectoryExW]
mov esi, eax
test esi, esi
je 0x40dfb0
mov eax, dword [0x4be6ac]
test eax, eax
je 0x40df89
push esi
push 0x4b0948
push 0x4aeee0
push 0x4aeee0
push str.FileUtils
push str.OOBEUtils
push 0x32
call eax
add esp, 0x1c
test esi, esi
sete al
pop esi
ret
mov ecx, dword [0x4be6b0]
test ecx, ecx
je 0x40dfae
mov eax, dword [ecx]
push esi
push 0x4b0948
push str.FileUtils
push 0x4aeee0
push 0x32
push ecx
call dword [eax + 0x34]
add esp, 0x18
test esi, esi
sete al
pop esi
ret
Function at 0x40dfc0
Capabilities:
Check if file exists
Delete file

Disassembly:
push edi
mov edi, ecx
mov eax, edi
cmp dword [edi + 0x14], 8
jb 0x40dfcd
mov eax, dword [edi]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x40e089
cmp dword [edi + 0x14], 8
mov eax, edi
jb 0x40dfe6
mov eax, dword [edi]
push eax
call dword [sym.imp.SHLWAPI.dll_PathIsDirectoryW]
cmp dword [edi + 0x14], 8
mov eax, edi
jb 0x40dff7
mov eax, dword [edi]
push ebx
push eax
call dword [sym.imp.kernel32.dll_DeleteFileW]
cmp eax, 1
sete bl
je 0x40e084
cmp dword [0x4be6ac], 0
je 0x40e049
cmp dword [edi + 0x14], 8
jb 0x40e018
mov edi, dword [edi]
call dword [sym.imp.kernel32.dll_GetLastError]
push eax
push edi
push str.Failed_to_delete_file:__s_LastError:_d
push 0x4aeee0
push 0x4aeee0
push str.FileUtils
push str.OOBEUtils
push 0x32
call dword [0x4be6ac]
add esp, 0x20
mov al, bl
pop ebx
pop edi
ret
push esi
mov esi, dword [0x4be6b0]
test esi, esi
je 0x40e083
cmp dword [edi + 0x14], 8
jb 0x40e05c
mov edi, dword [edi]
mov esi, dword [esi]
call dword [sym.imp.kernel32.dll_GetLastError]
push eax
push edi
push str.Failed_to_delete_file:__s_LastError:_d
push str.FileUtils
push 0x4aeee0
push 0x32
push dword [0x4be6b0]
call dword [esi + 0x34]
add esp, 0x1c
pop esi
mov al, bl
pop ebx
pop edi
ret
mov al, 1
pop edi
ret
Function at 0x10013f80
Capabilities:
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x1c
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov eax, ecx
push edi
push ecx
push str.Enabled
mov ebx, edx
mov dword [esp + 0x1c], eax
call fcn.10024f60
add esp, 4
mov edx, ebx
mov ecx, eax
call fcn.10025190
lea eax, [edi + 1]
push eax
push ecx
mov ecx, dword [esp + 0x18]
push str.Only_During_Freeze_Time
call fcn.10024f60
add esp, 4
lea edx, [ebx + 1]
mov ecx, eax
call fcn.10025190
lea eax, [edi + 2]
push eax
push ecx
mov ecx, dword [esp + 0x18]
push str.Show_Prices
call fcn.10024f60
add esp, 4
lea edx, [ebx + 2]
mov ecx, eax
call fcn.10025190
lea eax, [edi + 3]
push eax
push ecx
mov ecx, dword [esp + 0x18]
push str.No_Title_Bar
call fcn.10024f60
add esp, 4
lea edx, [ebx + 3]
mov ecx, eax
call fcn.10025190
mov ecx, dword [esp + 0x10]
push str.Mode
call fcn.10024f60
mov esi, dword [ebx + 0xc]
mov dword [esp + 0x14], eax
cmp esi, dword [edi + 0xc]
je 0x10014079
mov byte [esp + 0x18], 0
lea ecx, [esp + 0x20]
push dword [esp + 0x18]
xorps xmm0, xmm0
movq qword [esp + 0x24], xmm0
call fcn.10022780
mov ebx, dword [esp + 0x14]
mov eax, esi
cdq
mov cl, byte [ebx]
mov byte [ebx], 5
mov esi, dword [ebx + 0xc]
mov byte [esp + 0x14], cl
push dword [esp + 0x14]
mov byte [esp + 0x1c], cl
mov ecx, dword [ebx + 8]
mov dword [esp + 0x24], ecx
lea ecx, [esp + 0x24]
mov dword [ebx + 8], eax
mov dword [ebx + 0xc], edx
mov dword [esp + 0x28], esi
call fcn.10022780
or ecx, 0xffffffff
mov esi, 0x101db729
mov al, 0x50
or edi, 0xffffffff
cmp al, 0x23
jne 0x10014094
cmp byte [esi], al
jne 0x10014094
cmp byte [esi + 1], al
cmove ecx, edi
movzx edx, cl
movzx eax, al
xor edx, eax
shr ecx, 8
mov al, byte [esi]
inc esi
xor ecx, dword [edx*4 + 0x101faf38]
test al, al
jne 0x10014086
not ecx
call fcn.1015cb10
test eax, eax
je 0x1001410e
add eax, 0x10
lea ecx, [esp + 0x18]
push eax
call fcn.100267c0
mov ecx, dword [esp + 0x10]
push 0x101dac5c
call fcn.10024f60
mov cl, byte [esp + 0x18]
mov edi, eax
mov eax, dword [esp + 0x20]
mov dl, byte [edi]
mov byte [edi], cl
mov esi, dword [edi + 0xc]
mov ecx, dword [esp + 0x24]
mov byte [esp + 0x14], dl
push dword [esp + 0x14]
mov byte [esp + 0x1c], dl
mov edx, dword [edi + 8]
mov dword [edi + 0xc], ecx
lea ecx, [esp + 0x24]
mov dword [edi + 8], eax
mov dword [esp + 0x24], edx
mov dword [esp + 0x28], esi
call fcn.10022780
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x10014120
Capabilities:
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x14
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov eax, ecx
push edi
push ecx
push str.Enabled
mov ebx, edx
mov dword [esp + 0x18], eax
call fcn.10024f60
add esp, 4
mov edx, ebx
mov ecx, eax
call fcn.10025190
lea eax, [edi + 1]
push eax
push ecx
mov ecx, dword [esp + 0x14]
push str.Steam_ID
call fcn.10024f60
add esp, 4
lea edx, [ebx + 1]
mov ecx, eax
call fcn.10025190
lea eax, [edi + 2]
push eax
push ecx
mov ecx, dword [esp + 0x14]
push str.Rank
call fcn.10024f60
add esp, 4
lea edx, [ebx + 2]
mov ecx, eax
call fcn.10025190
lea eax, [edi + 3]
push eax
push ecx
mov ecx, dword [esp + 0x14]
push str.Wins
call fcn.10024f60
add esp, 4
lea edx, [ebx + 3]
mov ecx, eax
call fcn.10025190
lea eax, [edi + 4]
push eax
push ecx
mov ecx, dword [esp + 0x14]
push str.Money
call fcn.10024f60
add esp, 4
lea edx, [ebx + 4]
mov ecx, eax
call fcn.10025190
lea eax, [edi + 5]
push eax
push ecx
mov ecx, dword [esp + 0x14]
push str.Health
call fcn.10024f60
add esp, 4
lea edx, [ebx + 5]
mov ecx, eax
call fcn.10025190
lea eax, [edi + 6]
push eax
push ecx
lea esi, [ebx + 6]
mov ebx, dword [esp + 0x14]
push str.Armor
mov ecx, ebx
call fcn.10024f60
add esp, 4
mov edx, esi
mov ecx, eax
call fcn.10025190
or ecx, 0xffffffff
mov esi, 0x101db745
mov al, 0x50
or edi, 0xffffffff
cmp al, 0x23
jne 0x1001422e
cmp byte [esi], al
jne 0x1001422e
cmp byte [esi + 1], al
cmove ecx, edi
movzx edx, cl
movzx eax, al
xor edx, eax
shr ecx, 8
mov al, byte [esi]
inc esi
xor ecx, dword [edx*4 + 0x101faf38]
test al, al
jne 0x10014220
not ecx
call fcn.1015cb10
test eax, eax
je 0x100142a6
add eax, 0x10
lea ecx, [esp + 0x10]
push eax
call fcn.100267c0
push 0x101dac5c
mov ecx, ebx
call fcn.10024f60
mov cl, byte [esp + 0x10]
mov edi, eax
mov eax, dword [esp + 0x18]
mov dl, byte [edi]
mov byte [edi], cl
mov esi, dword [edi + 0xc]
mov ecx, dword [esp + 0x1c]
mov byte [esp + 0xc], dl
push dword [esp + 0xc]
mov byte [esp + 0x14], dl
mov edx, dword [edi + 8]
mov dword [edi + 0xc], ecx
lea ecx, [esp + 0x1c]
mov dword [edi + 8], eax
mov dword [esp + 0x1c], edx
mov dword [esp + 0x20], esi
call fcn.10022780
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x10023f00
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
sub esp, 0x18
push ebx
mov ebx, dword [esp + 0x20]
push ebp
mov ebp, dword [esp + 0x28]
push edi
mov edi, ecx
cmp ebx, ebp
je 0x100240b6
cmp dword [ebx + 0x1c], 0x10
lea edx, [ebx + 8]
mov eax, dword [edi + 4]
mov dword [esp + 0x18], eax
mov eax, dword [edi + 0xc]
mov dword [esp + 0x14], eax
mov eax, dword [ebx + 4]
mov dword [esp + 0x1c], eax
mov eax, dword [edx + 0x10]
jb 0x10023f3b
mov edx, dword [edx]
xor ecx, ecx
push esi
mov esi, 0x811c9dc5
test eax, eax
je 0x10023f65
mov ebp, eax
nop dword [eax]
movzx eax, byte [ecx + edx]
inc ecx
xor eax, esi
imul esi, eax, 0x1000193
cmp ecx, ebp
jb 0x10023f50
mov ebp, dword [esp + 0x30]
mov eax, dword [edi + 0x18]
mov edx, ebx
mov ecx, dword [esp + 0x18]
and eax, esi
mov esi, dword [ebx]
lea eax, [ecx + eax*8]
mov ecx, dword [eax]
mov dword [esp + 0x2c], eax
mov eax, dword [eax + 4]
mov dword [esp + 0x14], ecx
mov dword [esp + 0x10], eax
call fcn.10003400
dec dword [edi + 8]
cmp ebx, dword [esp + 0x10]
je 0x10023fb2
mov dword [esp + 0x24], esi
cmp esi, ebp
je 0x10023fc4
mov edx, esi
mov esi, dword [esi]
call fcn.10003400
dec dword [edi + 8]
mov eax, dword [esp + 0x10]
cmp dword [esp + 0x24], eax
jne 0x10023f94
mov ecx, dword [esp + 0x2c]
cmp dword [esp + 0x14], ebx
jne 0x10023fe9
mov eax, dword [esp + 0x1c]
mov dword [ecx], eax
jmp 0x10023fed
cmp dword [esp + 0x14], ebx
jne 0x100240ac
mov eax, dword [esp + 0x20]
mov ecx, dword [esp + 0x2c]
mov dword [ecx], esi
mov dword [eax], esi
mov dword [esi + 4], eax
mov eax, ebp
pop esi
pop edi
pop ebp
pop ebx
add esp, 0x18
ret 8
mov eax, dword [esp + 0x20]
mov dword [ecx + 4], eax
cmp esi, ebp
je 0x100240ac
nop dword [eax + eax]
cmp dword [esi + 0x1c], 0x10
lea edx, [esi + 8]
mov eax, dword [edx + 0x10]
mov dword [esp + 0x24], esi
mov dword [esp + 0x2c], eax
jb 0x10024016
mov edx, dword [edx]
xor ecx, ecx
mov ebx, 0x811c9dc5
test eax, eax
je 0x1002403a
mov ebp, dword [esp + 0x2c]
movzx eax, byte [ecx + edx]
inc ecx
xor eax, ebx
imul ebx, eax, 0x1000193
cmp ecx, ebp
jb 0x10024025
mov ebp, dword [esp + 0x30]
mov eax, dword [edi + 0x18]
mov edx, esi
mov ecx, dword [esp + 0x18]
and eax, ebx
mov ebx, dword [ecx + eax*8 + 4]
mov esi, dword [esi]
mov dword [esp + 0x14], ebx
lea eax, [ecx + eax*8]
mov dword [esp + 0x2c], eax
call fcn.10003400
dec dword [edi + 8]
cmp dword [esp + 0x24], ebx
je 0x1002407c
mov ebx, esi
cmp esi, ebp
je 0x100240a6
mov edx, esi
mov esi, dword [esi]
call fcn.10003400
dec dword [edi + 8]
cmp ebx, dword [esp + 0x14]
jne 0x10024064
mov eax, dword [esp + 0x2c]
mov ebx, dword [esp + 0x1c]
mov dword [eax], ebx
mov dword [eax + 4], ebx
cmp esi, ebp
jne 0x10024000
mov eax, dword [esp + 0x20]
mov dword [eax], esi
mov dword [esi + 4], eax
mov eax, ebp
pop esi
pop edi
pop ebp
pop ebx
add esp, 0x18
ret 8
mov eax, dword [esp + 0x2c]
mov dword [eax], esi
mov eax, dword [esp + 0x20]
mov dword [eax], esi
mov dword [esi + 4], eax
pop esi
pop edi
mov eax, ebp
pop ebp
pop ebx
add esp, 0x18
ret 8
Function at 0x100276a0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
sub esp, 8
push ebx
push ebp
mov ebp, dword [esp + 0x18]
mov ebx, ecx
push esi
push edi
mov edx, ebp
cmp dword [ebp + 0x14], 0x10
mov edi, dword [ebp + 0x10]
jb 0x100276bb
mov edx, dword [ebp]
xor ecx, ecx
mov esi, 0x811c9dc5
test edi, edi
je 0x100276d7
movzx eax, byte [ecx + edx]
inc ecx
xor eax, esi
imul esi, eax, 0x1000193
cmp ecx, edi
jb 0x100276c6
push esi
push ebp
lea eax, [esp + 0x18]
mov ecx, ebx
push eax
call fcn.1002cb30
mov ecx, dword [esp + 0x14]
test ecx, ecx
je 0x10027701
mov eax, dword [esp + 0x1c]
mov dword [eax], ecx
mov byte [eax + 4], 0
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret 0xc
cmp dword [ebx + 8], 0x5d1745d
je 0x10027850
push 0x2c
call fcn.101a044f
add esp, 4
mov edi, eax
lea ecx, [edi + 8]
push ebp
call fcn.10020b00
mov eax, dword [esp + 0x24]
movq xmm0, qword [eax]
mov eax, dword [eax + 8]
movq qword [edi + 0x20], xmm0
mov dword [edi + 0x28], eax
mov eax, dword [ebx + 8]
mov ebp, dword [ebx + 0x1c]
inc eax
movss xmm3, dword [ebx]
movd xmm0, eax
cvtdq2pd xmm0, xmm0
shr eax, 0x1f
addsd xmm0, qword [eax*8 + 0x10202a70]
mov eax, ebp
shr eax, 0x1f
cvtpd2ps xmm2, xmm0
movd xmm0, ebp
cvtdq2pd xmm0, xmm0
movaps xmm1, xmm2
addsd xmm0, qword [eax*8 + 0x10202a70]
cvtpd2ps xmm0, xmm0
divss xmm1, xmm0
comiss xmm1, xmm3
jbe 0x100277ed
divss xmm2, xmm3
sub esp, 8
cvtps2pd xmm0, xmm2
movsd qword [esp + 0x18], xmm0
fld qword [esp + 0x18]
fstp qword [esp]
call fcn.101c5b60
fstp qword [esp + 0x18]
movsd xmm0, qword [esp + 0x18]
add esp, 8
cvtpd2ps xmm0, xmm0
call fcn.101c72d0
mov ecx, 8
cmp eax, ecx
cmova ecx, eax
cmp ebp, ecx
jae 0x100277d0
cmp ebp, 0x200
jae 0x100277ce
shl ebp, 3
cmp ebp, ecx
jae 0x100277d0
mov ebp, ecx
push ebp
mov ecx, ebx
call fcn.1002a770
push esi
lea eax, [edi + 8]
mov ecx, ebx
push eax
lea eax, [esp + 0x18]
push eax
call fcn.1002cb30
mov edx, dword [eax]
jmp 0x100277f1
mov edx, dword [esp + 0x10]
mov ebp, dword [edx + 4]
inc dword [ebx + 8]
mov dword [edi], edx
mov dword [edi + 4], ebp
mov dword [ebp], edi
mov dword [edx + 4], edi
mov eax, dword [ebx + 0x18]
mov ecx, dword [ebx + 0xc]
and eax, esi
mov esi, dword [ecx + eax*8]
cmp esi, dword [ebx + 4]
jne 0x10027817
mov dword [ecx + eax*8], edi
jmp 0x10027838
cmp esi, edx
jne 0x10027832
mov dword [ecx + eax*8], edi
mov eax, dword [esp + 0x1c]
mov dword [eax], edi
mov byte [eax + 4], 1
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret 0xc
cmp dword [ecx + eax*8 + 4], ebp
jne 0x1002783c
mov dword [ecx + eax*8 + 4], edi
mov eax, dword [esp + 0x1c]
mov dword [eax], edi
pop edi
pop esi
pop ebp
mov byte [eax + 4], 1
pop ebx
add esp, 8
ret 0xc
push str.unordered_map_set_too_long
call fcn.1019ecc1
int3