joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1001a0a0
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1005680d
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push esi
push edi
mov eax, dword [0x10072f40]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov eax, dword [edi + 0x210]
lea ecx, [edi + 0x210]
call dword [eax + 4]
push ecx
mov ecx, esp
mov dword [ebp - 0x14], esp
push str.DetectMgr_starting
call fcn.100114f0
mov dword [ebp - 4], 0
mov eax, dword [edi + 0x210]
mov dword [ebp - 4], 0xffffffff
lea ecx, [edi + 0x210]
call dword [eax + 8]
cmp byte [edi + 0x268], 0
mov dword [ebp - 0x14], 0x80004005
jne 0x1001a154
push dword [ebp - 0x14]
lea eax, [edi + 0x20]
push eax
push 0x10072080
push 0x10074228
push 0x10075a78
call fcn.10009300
add esp, 0x14
movzx eax, ax
mov ecx, edi
push 0
push eax
push 0
push 0
push 0
push str.DetectManager
push 0x10072030
push 0
call fcn.10019f50
jmp 0x1001a173
mov ecx, dword [edi + 0x250]
push 0
push str.DetectManager
push ecx
mov eax, esp
push 0
mov dword [eax], 0x10072030
mov eax, dword [ecx]
mov eax, dword [eax + 8]
call eax
mov esi, dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov dword [ebp - 0x10], eax
test eax, eax
je 0x1001a255
push str.RzKitty:_hWnd_ok
call esi
lea ecx, [edi + 0x98]
call fcn.10033600
mov ecx, edi
call fcn.10025480
mov ecx, edi
call fcn.10026440
mov ecx, edi
call fcn.10025fe0
mov ecx, edi
call fcn.10021210
mov ecx, edi
call fcn.10025d70
mov ecx, edi
call fcn.10025280
mov ecx, edi
call fcn.100256a0
mov ecx, edi
call fcn.100264e0
mov ecx, edi
call fcn.10021830
mov ecx, edi
call fcn.100214d0
mov ecx, edi
call fcn.10021680
lea eax, [ebp - 0x18]
mov dword [ebp - 0x18], 0
push eax
lea eax, [ebp - 0x20]
mov dword [ebp - 0x14], 0x26ce01a2
push eax
lea ecx, [edi + 0x1d4]
call fcn.1000c090
movups xmm0, xmmword [0x1005dcc8]
mov ecx, edi
mov eax, dword [eax]
movups xmmword [eax + 0x10], xmm0
movq xmm0, qword [0x1005dcd8]
movq qword [eax + 0x20], xmm0
call fcn.10024b10
push dword [ebp - 0x10]
mov ecx, edi
call fcn.10030330
mov dword [ebp - 0x14], eax
test eax, eax
js 0x1001a24e
push str.RzKitty:_RegisterDevNotify_ok
call esi
lea ecx, [edi + 0x30]
call fcn.100336b0
mov ecx, edi
call fcn.10020580
jmp 0x1001a25c
push str.RzKitty:_RegisterDevNotify_fail
jmp 0x1001a25a
push str.RzKitty:_hWnd_fail
call esi
push str.RzKitty:_DetectMgr_done_n
call esi
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x100214d0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100576bd
mov eax, dword fs:[0]
push eax
sub esp, 0x28
push ebx
push esi
push edi
mov eax, dword [0x10072f40]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
add ecx, 0x138
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x18], ecx
mov edi, 0x100742e8
nop dword [eax]
cmp dword [edi + 0x14], 8
mov ebx, edi
jb 0x1002151a
mov ebx, dword [edi]
mov edx, dword [edi + 0x10]
mov esi, 0x811c9dc5
mov ecx, 0
add edx, edx
je 0x10021541
nop dword [eax + eax]
movzx eax, byte [ecx + ebx]
inc ecx
xor eax, esi
imul esi, eax, 0x1000193
cmp ecx, edx
jb 0x10021530
mov ebx, dword [ebp - 0x18]
lea eax, [ebp - 0x24]
push esi
push edi
push eax
mov ecx, ebx
call fcn.1000b0c0
mov eax, dword [ebp - 0x20]
test eax, eax
jne 0x1002163b
cmp dword [ebx + 8], 0x71c71c7
je 0x1002166f
lea eax, [ebx + 4]
mov dword [ebp - 0x28], 0
mov dword [ebp - 0x2c], eax
mov dword [ebp - 4], 0
push 0x24
mov dword [ebp - 0x28], 0
call fcn.1005021f
add esp, 4
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x28], eax
add eax, 8
mov ecx, eax
mov dword [ebp - 0x1c], eax
push edi
call fcn.100121a0
mov byte [ebp - 4], 1
mov eax, dword [ebp - 0x10]
mov dword [eax + 0x20], 0
mov dword [ebp - 4], 3
mov eax, dword [ebx + 8]
inc eax
movd xmm0, eax
cvtdq2pd xmm0, xmm0
shr eax, 0x1f
addsd xmm0, qword [eax*8 + 0x10061760]
mov eax, dword [ebx + 0x1c]
cvtpd2ps xmm1, xmm0
movd xmm0, eax
cvtdq2pd xmm0, xmm0
shr eax, 0x1f
addsd xmm0, qword [eax*8 + 0x10061760]
cvtpd2ps xmm0, xmm0
divss xmm1, xmm0
comiss xmm1, dword [ebx]
jbe 0x1002161e
mov ecx, ebx
call fcn.100321b0
mov eax, dword [ebp - 0x10]
mov ecx, ebx
push esi
add eax, 8
push eax
lea eax, [ebp - 0x34]
push eax
call fcn.1000b0c0
mov ecx, dword [eax]
mov eax, dword [eax + 4]
mov dword [ebp - 0x24], ecx
mov dword [ebp - 0x20], eax
jmp 0x10021621
mov ecx, dword [ebp - 0x24]
push dword [ebp - 0x10]
mov dword [ebp - 0x28], 0
push ecx
push esi
mov ecx, ebx
call fcn.10031c70
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [edi + 0x18]
add edi, 0x34
mov dword [eax + 0x20], ecx
mov eax, dword [ebp - 0x14]
add eax, 0x34
mov dword [ebp - 0x14], eax
cmp eax, 0x270
jb 0x10021510
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push str.unordered_map_set_too_long
call sub.MSVCP140.dll_void___cdecl_std::_Xlength_error_char_const__
int3
Function at 0x10021680
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100576bd
mov eax, dword fs:[0]
push eax
sub esp, 0x28
push ebx
push esi
push edi
mov eax, dword [0x10072f40]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
add ecx, 0x158
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x18], ecx
mov edi, 0x10074304
nop dword [eax]
cmp dword [edi + 0x14], 8
mov ebx, edi
jb 0x100216ca
mov ebx, dword [edi]
mov edx, dword [edi + 0x10]
mov esi, 0x811c9dc5
mov ecx, 0
add edx, edx
je 0x100216f1
nop dword [eax + eax]
movzx eax, byte [ecx + ebx]
inc ecx
xor eax, esi
imul esi, eax, 0x1000193
cmp ecx, edx
jb 0x100216e0
mov ebx, dword [ebp - 0x18]
lea eax, [ebp - 0x24]
push esi
push edi
push eax
mov ecx, ebx
call fcn.1000b0c0
mov eax, dword [ebp - 0x20]
test eax, eax
jne 0x100217eb
cmp dword [ebx + 8], 0x71c71c7
je 0x1002181f
lea eax, [ebx + 4]
mov dword [ebp - 0x28], 0
mov dword [ebp - 0x2c], eax
mov dword [ebp - 4], 0
push 0x24
mov dword [ebp - 0x28], 0
call fcn.1005021f
add esp, 4
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x28], eax
add eax, 8
mov ecx, eax
mov dword [ebp - 0x1c], eax
push edi
call fcn.100121a0
mov byte [ebp - 4], 1
mov eax, dword [ebp - 0x10]
mov dword [eax + 0x20], 0
mov dword [ebp - 4], 3
mov eax, dword [ebx + 8]
inc eax
movd xmm0, eax
cvtdq2pd xmm0, xmm0
shr eax, 0x1f
addsd xmm0, qword [eax*8 + 0x10061760]
mov eax, dword [ebx + 0x1c]
cvtpd2ps xmm1, xmm0
movd xmm0, eax
cvtdq2pd xmm0, xmm0
shr eax, 0x1f
addsd xmm0, qword [eax*8 + 0x10061760]
cvtpd2ps xmm0, xmm0
divss xmm1, xmm0
comiss xmm1, dword [ebx]
jbe 0x100217ce
mov ecx, ebx
call fcn.100321b0
mov eax, dword [ebp - 0x10]
mov ecx, ebx
push esi
add eax, 8
push eax
lea eax, [ebp - 0x34]
push eax
call fcn.1000b0c0
mov ecx, dword [eax]
mov eax, dword [eax + 4]
mov dword [ebp - 0x24], ecx
mov dword [ebp - 0x20], eax
jmp 0x100217d1
mov ecx, dword [ebp - 0x24]
push dword [ebp - 0x10]
mov dword [ebp - 0x28], 0
push ecx
push esi
mov ecx, ebx
call fcn.10031c70
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [edi - 4]
add edi, 0x34
mov dword [eax + 0x20], ecx
mov eax, dword [ebp - 0x14]
add eax, 0x34
mov dword [ebp - 0x14], eax
cmp eax, 0x270
jb 0x100216c0
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push str.unordered_map_set_too_long
call sub.MSVCP140.dll_void___cdecl_std::_Xlength_error_char_const__
int3
Function at 0x10030780
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10059a05
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push esi
push edi
mov eax, dword [0x10072f40]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov dword [ebp - 0x18], ebx
push str.RzKitty:_UpdateDevicesEx_n
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
call fcn.100063f0
test eax, eax
je 0x10030904
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0xc]
lea esi, [eax + 0x10]
mov dword [ebp - 0x10], esi
mov dword [ebp - 4], 1
call fcn.100063f0
test eax, eax
je 0x10030904
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0xc]
add eax, 0x10
mov dword [ebp - 0x14], eax
mov byte [ebp - 4], 3
mov eax, dword [ebp + 0x10]
cmp eax, 1
jne 0x10030806
push str.Connect
jmp 0x10030810
cmp eax, 2
jne 0x1003081f
push str.Disconnect
lea eax, [ebp - 0x10]
push eax
call fcn.10021040
mov esi, dword [ebp - 0x10]
add esp, 8
mov edi, dword [ebp + 0xc]
lea eax, [ebp - 0x14]
push edi
push str.UpdateDevicesEx___PID_0x_.4x
push eax
call fcn.10019800
add esp, 0xc
lea ecx, [ebp - 0x14]
push dword [esi - 0xc]
push esi
call fcn.10019710
push ecx
lea eax, [ebp - 0x14]
mov dword [ebp + 0xc], esp
mov ecx, esp
push eax
call fcn.10011400
mov byte [ebp - 4], 4
mov eax, dword [ebx + 0x210]
mov byte [ebp - 4], 3
lea ecx, [ebx + 0x210]
call dword [eax + 8]
push dword [ebp + 0x10]
mov ecx, dword [ebp - 0x18]
push edi
push dword [ebp + 8]
call fcn.10020a80
mov ecx, dword [ebp - 0x18]
lea eax, [ebp + 0x10]
push eax
push 0
push 0
push 0
call fcn.10027b80
push ecx
mov ecx, esp
mov dword [ebp + 8], esp
push str.UpdateDevicesEx_done_
call fcn.100114f0
mov byte [ebp - 4], 5
mov eax, dword [ebx + 0x210]
mov byte [ebp - 4], 3
lea ecx, [ebx + 0x210]
call dword [eax + 8]
mov byte [ebp - 4], 1
or edi, 0xffffffff
mov edx, dword [ebp - 0x14]
mov eax, edi
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x100308cf
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov dword [ebp - 4], 0xffffffff
add esi, 0xfffffff0
lock xadd dword [esi + 0xc], edi
dec edi
test edi, edi
jg 0x100308eb
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
push 0x80004005
call fcn.10003510
int3
Function at 0x10031000
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x10072f40]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, ecx
cmp dword [esi + 0x38], 0
je 0x100310bc
cmp byte [esi + 0x3d], 0
je 0x100310bc
mov eax, dword [esi]
push edi
push 0xffffffffffffffff
call dword [eax + 0xc]
cmp eax, 0xffffffff
je 0x100310aa
mov ecx, dword [esi + 0x38]
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [esi + 0x40]
push eax
call dword [sym.imp.MSVCP140.dll_public:_int___thiscall_std::codecvt_char__char__struct__Mbstatet_::unshift_struct__Mbstatet___char___char___char___const]
sub eax, 0
je 0x10031071
sub eax, 1
je 0x10031075
sub eax, 2
jne 0x100310aa
mov byte [esi + 0x3d], al
mov al, 1
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1005078e
mov esp, ebp
pop ebp
ret
mov byte [esi + 0x3d], 0
mov edi, dword [ebp - 0x28]
lea eax, [ebp - 0x24]
sub edi, eax
je 0x10031093
push dword [esi + 0x4c]
push edi
push 1
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
add esp, 0x10
cmp edi, eax
jne 0x100310aa
cmp byte [esi + 0x3d], 0
pop edi
sete al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1005078e
mov esp, ebp
pop ebp
ret
pop edi
xor al, al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1005078e
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
mov al, 1
xor ecx, ebp
pop esi
call fcn.1005078e
mov esp, ebp
pop ebp
ret
Function at 0x10031400
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10059acd
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push esi
push edi
mov eax, dword [0x10072f40]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov dword [ebp - 0x14], ebx
mov eax, 0x1fffffff
mov edi, 1
bsr ecx, eax
mov eax, edi
shl eax, cl
mov ecx, dword [ebp + 8]
cmp ecx, eax
ja 0x100315a0
lea eax, [ecx - 1]
mov esi, dword [ebx + 4]
or eax, edi
bsr ecx, eax
push esi
lea ecx, [ecx + 1]
shl edi, cl
lea ecx, [ebx + 0xc]
lea eax, [edi + edi]
push eax
call fcn.10030cc0
lea eax, [edi - 1]
mov dword [ebx + 0x1c], edi
mov dword [ebx + 0x18], eax
mov dword [ebp - 0x18], ebx
mov dword [ebp - 4], 0
mov ecx, dword [ebx + 4]
mov ecx, dword [ecx]
mov edx, ecx
cmp ecx, esi
je 0x1003155c
nop dword [eax + eax]
movzx eax, byte [ecx + 8]
xor eax, 0x811c9dc5
mov edx, dword [edx]
imul edi, eax, 0x1000193
movzx eax, byte [ecx + 9]
xor edi, eax
movzx eax, byte [ecx + 0xa]
imul edi, edi, 0x1000193
xor edi, eax
movzx eax, byte [ecx + 0xb]
imul edi, edi, 0x1000193
xor edi, eax
imul eax, edi, 0x1000193
mov edi, dword [ebx + 0x18]
and edi, eax
mov eax, dword [ebx + 0xc]
mov ebx, dword [eax + edi*8]
lea eax, [eax + edi*8]
mov dword [ebp + 8], eax
cmp ebx, esi
jne 0x100314e1
mov dword [eax], ecx
mov dword [eax + 4], ecx
jmp 0x1003154f
mov eax, dword [eax + 4]
mov edi, dword [ecx + 8]
cmp edi, dword [eax + 8]
jne 0x10031518
mov eax, dword [eax]
cmp eax, ecx
je 0x10031510
mov ebx, dword [ecx + 4]
mov dword [ebp - 0x10], ebx
mov dword [ebx], edx
mov ebx, dword [edx + 4]
mov dword [ebx], eax
mov edi, dword [eax + 4]
mov dword [edi], ecx
mov dword [eax + 4], ebx
mov eax, dword [ebp - 0x10]
mov dword [edx + 4], eax
mov dword [ecx + 4], edi
mov eax, dword [ebp + 8]
mov dword [eax + 4], ecx
jmp 0x1003154f
cmp ebx, eax
je 0x1003152c
nop dword [eax]
mov eax, dword [eax + 4]
cmp edi, dword [eax + 8]
je 0x1003157e
cmp ebx, eax
jne 0x10031520
mov ebx, dword [ecx + 4]
mov dword [ebp - 0x10], ebx
mov dword [ebx], edx
mov ebx, dword [edx + 4]
mov dword [ebx], eax
mov edi, dword [eax + 4]
mov dword [edi], ecx
mov dword [eax + 4], ebx
mov eax, dword [ebp - 0x10]
mov dword [edx + 4], eax
mov eax, dword [ebp + 8]
mov dword [ecx + 4], edi
mov dword [eax], ecx
mov ebx, dword [ebp - 0x14]
mov ecx, edx
cmp edx, esi
jne 0x10031490
mov dword [ebp - 0x18], 0
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
mov ebx, dword [ecx + 4]
mov eax, dword [eax]
mov dword [ebp + 8], ebx
mov dword [ebx], edx
mov ebx, dword [edx + 4]
mov dword [ebx], eax
mov edi, dword [eax + 4]
mov dword [edi], ecx
mov dword [eax + 4], ebx
mov eax, dword [ebp + 8]
mov dword [edx + 4], eax
mov dword [ecx + 4], edi
jmp 0x1003154f
push str.invalid_hash_bucket_count
call sub.MSVCP140.dll_void___cdecl_std::_Xlength_error_char_const__
int3
Function at 0x100315b0
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10059afd
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push esi
push edi
mov eax, dword [0x10072f40]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov dword [ebp - 0x14], ebx
mov eax, 0x1fffffff
mov edi, 1
bsr ecx, eax
mov eax, edi
shl eax, cl
mov ecx, dword [ebp + 8]
cmp ecx, eax
ja 0x10031750
lea eax, [ecx - 1]
mov esi, dword [ebx + 4]
or eax, edi
bsr ecx, eax
push esi
lea ecx, [ecx + 1]
shl edi, cl
lea ecx, [ebx + 0xc]
lea eax, [edi + edi]
push eax
call fcn.10030cc0
lea eax, [edi - 1]
mov dword [ebx + 0x1c], edi
mov dword [ebx + 0x18], eax
mov dword [ebp - 0x18], ebx
mov dword [ebp - 4], 0
mov ecx, dword [ebx + 4]
mov ecx, dword [ecx]
mov edx, ecx
cmp ecx, esi
je 0x1003170c
nop dword [eax + eax]
movzx eax, byte [ecx + 8]
xor eax, 0x811c9dc5
mov edx, dword [edx]
imul edi, eax, 0x1000193
movzx eax, byte [ecx + 9]
xor edi, eax
movzx eax, byte [ecx + 0xa]
imul edi, edi, 0x1000193
xor edi, eax
movzx eax, byte [ecx + 0xb]
imul edi, edi, 0x1000193
xor edi, eax
imul eax, edi, 0x1000193
mov edi, dword [ebx + 0x18]
and edi, eax
mov eax, dword [ebx + 0xc]
mov ebx, dword [eax + edi*8]
lea eax, [eax + edi*8]
mov dword [ebp + 8], eax
cmp ebx, esi
jne 0x10031691
mov dword [eax], ecx
mov dword [eax + 4], ecx
jmp 0x100316ff
mov eax, dword [eax + 4]
mov edi, dword [ecx + 8]
cmp edi, dword [eax + 8]
jne 0x100316c8
mov eax, dword [eax]
cmp eax, ecx
je 0x100316c0
mov ebx, dword [ecx + 4]
mov dword [ebp - 0x10], ebx
mov dword [ebx], edx
mov ebx, dword [edx + 4]
mov dword [ebx], eax
mov edi, dword [eax + 4]
mov dword [edi], ecx
mov dword [eax + 4], ebx
mov eax, dword [ebp - 0x10]
mov dword [edx + 4], eax
mov dword [ecx + 4], edi
mov eax, dword [ebp + 8]
mov dword [eax + 4], ecx
jmp 0x100316ff
cmp ebx, eax
je 0x100316dc
nop dword [eax]
mov eax, dword [eax + 4]
cmp edi, dword [eax + 8]
je 0x1003172e
cmp ebx, eax
jne 0x100316d0
mov ebx, dword [ecx + 4]
mov dword [ebp - 0x10], ebx
mov dword [ebx], edx
mov ebx, dword [edx + 4]
mov dword [ebx], eax
mov edi, dword [eax + 4]
mov dword [edi], ecx
mov dword [eax + 4], ebx
mov eax, dword [ebp - 0x10]
mov dword [edx + 4], eax
mov eax, dword [ebp + 8]
mov dword [ecx + 4], edi
mov dword [eax], ecx
mov ebx, dword [ebp - 0x14]
mov ecx, edx
cmp edx, esi
jne 0x10031640
mov dword [ebp - 0x18], 0
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
mov ebx, dword [ecx + 4]
mov eax, dword [eax]
mov dword [ebp + 8], ebx
mov dword [ebx], edx
mov ebx, dword [edx + 4]
mov dword [ebx], eax
mov edi, dword [eax + 4]
mov dword [edi], ecx
mov dword [eax + 4], ebx
mov eax, dword [ebp + 8]
mov dword [edx + 4], eax
mov dword [ecx + 4], edi
jmp 0x100316ff
push str.invalid_hash_bucket_count
call sub.MSVCP140.dll_void___cdecl_std::_Xlength_error_char_const__
int3
Function at 0x10032530
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10059bed
mov eax, dword fs:[0]
push eax
sub esp, 0x28
push ebx
push esi
push edi
mov eax, dword [0x10072f40]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov dword [ebp - 0x10], ebx
mov esi, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
cmp edx, esi
je 0x100326ea
mov ecx, dword [ebx + 4]
lea eax, [ebx + 4]
mov dword [ebp - 0x1c], ecx
mov edi, edx
mov ecx, dword [ebx + 0xc]
mov dword [ebp - 0x34], eax
mov eax, dword [edx + 4]
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x2c], edi
mov dword [ebp - 4], 0
mov eax, dword [edx + 4]
mov dword [ebp - 0x24], eax
movzx eax, byte [edx + 8]
xor eax, 0x811c9dc5
imul ecx, eax, 0x1000193
movzx eax, byte [edx + 9]
xor ecx, eax
movzx eax, byte [edx + 0xa]
imul ecx, ecx, 0x1000193
xor ecx, eax
movzx eax, byte [edx + 0xb]
imul ecx, ecx, 0x1000193
xor ecx, eax
mov eax, dword [ebx + 0x18]
imul ecx, ecx, 0x1000193
and eax, ecx
mov ecx, dword [ebp - 0x18]
lea eax, [ecx + eax*8]
mov ecx, dword [eax]
mov dword [ebp + 0xc], eax
mov eax, dword [eax + 4]
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x20], eax
cmp edi, eax
mov eax, edi
mov edi, dword [edi]
push 0x10
push eax
sete bl
mov dword [ebp - 0x2c], edi
call fcn.1005024f
mov edx, dword [ebp - 0x10]
add esp, 8
dec dword [edx + 8]
test bl, bl
jne 0x10032622
mov eax, dword [ebp - 0x20]
cmp edi, esi
jne 0x100325e4
mov eax, dword [ebp - 0x14]
cmp eax, dword [ebp + 8]
jne 0x100326db
mov ecx, dword [ebp + 0xc]
mov dword [ecx], edi
jmp 0x100326db
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp + 0xc]
cmp eax, dword [ebp + 8]
jne 0x10032634
mov eax, dword [ebp - 0x1c]
mov dword [ecx], eax
jmp 0x10032637
mov eax, dword [ebp - 0x24]
mov dword [ecx + 4], eax
cmp edi, esi
je 0x100326db
nop dword [eax]
nop word [eax + eax]
movzx eax, byte [edi + 8]
xor eax, 0x811c9dc5
imul ecx, eax, 0x1000193
movzx eax, byte [edi + 9]
xor ecx, eax
movzx eax, byte [edi + 0xa]
imul ecx, ecx, 0x1000193
xor ecx, eax
movzx eax, byte [edi + 0xb]
imul ecx, ecx, 0x1000193
xor ecx, eax
imul eax, ecx, 0x1000193
mov ecx, dword [ebp - 0x18]
and eax, dword [edx + 0x18]
lea eax, [ecx + eax*8]
mov dword [ebp + 8], eax
mov eax, dword [eax + 4]
mov dword [ebp + 0xc], eax
cmp edi, eax
mov eax, edi
mov edi, dword [edi]
push 0x10
push eax
sete bl
mov dword [ebp - 0x2c], edi
call fcn.1005024f
mov eax, dword [ebp - 0x10]
add esp, 8
dec dword [eax + 8]
test bl, bl
jne 0x100326bf
cmp edi, esi
je 0x100326d6
mov eax, dword [ebp + 0xc]
jmp 0x10032695
mov eax, dword [ebp + 8]
mov edx, dword [ebp - 0x1c]
mov dword [eax], edx
mov dword [eax + 4], edx
cmp edi, esi
je 0x100326db
mov edx, dword [ebp - 0x10]
jmp 0x10032650
mov eax, dword [ebp + 8]
mov dword [eax], edi
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x28]
mov dword [eax], edi
mov dword [edi + 4], eax
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x10035960
Capabilities:
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1005a0bf
mov eax, dword fs:[0]
push eax
sub esp, 0x28c
mov eax, dword [0x10072f40]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 4], 0
mov esi, dword [ebp + 8]
mov dword [ebp - 0x298], esi
mov dword [ebp - 0x294], 0
mov dword [ebp - 4], 1
mov dword [esi], 0
mov dword [esi + 4], 0
mov dword [esi + 8], 0
push str._.
lea eax, [ebp + 0xc]
mov dword [ebp - 0x294], 1
push eax
lea eax, [ebp - 0x40]
push eax
call fcn.100091d0
add esp, 0xc
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x290]
cmp dword [ebp - 0x2c], 8
lea eax, [ebp - 0x40]
push ecx
cmovae eax, dword [ebp - 0x40]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov edi, eax
cmp edi, 0xffffffff
je 0x10035b0e
nop dword [eax]
test byte [ebp - 0x290], 0x10
je 0x10035af1
xorps xmm0, xmm0
mov dword [ebp - 0x18], 0
lea eax, [ebp - 0x264]
mov dword [ebp - 0x14], 0
movups xmmword [ebp - 0x28], xmm0
lea edx, [eax + 2]
nop dword [eax + eax]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x10035a40
sub eax, edx
lea ecx, [ebp - 0x28]
sar eax, 1
push eax
lea eax, [ebp - 0x264]
push eax
call fcn.10001e10
mov byte [ebp - 4], 3
mov eax, dword [esi + 4]
cmp eax, dword [esi + 8]
je 0x10035a97
movups xmm0, xmmword [ebp - 0x28]
xor ecx, ecx
movups xmmword [eax], xmm0
movq xmm0, qword [ebp - 0x18]
movq qword [eax + 0x10], xmm0
mov eax, 7
mov dword [ebp - 0x14], eax
add dword [esi + 4], 0x18
mov dword [ebp - 0x18], 0
mov word [ebp - 0x28], cx
jmp 0x10035aa6
lea ecx, [ebp - 0x28]
push ecx
push eax
mov ecx, esi
call fcn.1000a8b0
mov eax, dword [ebp - 0x14]
mov byte [ebp - 4], 2
cmp eax, 8
jb 0x10035add
mov edx, dword [ebp - 0x28]
lea ecx, [eax*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x10035ad3
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x10035b45
push ecx
push edx
call fcn.1005024f
add esp, 8
xor eax, eax
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 7
mov word [ebp - 0x28], ax
lea eax, [ebp - 0x290]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x10035a10
push edi
call dword [sym.imp.KERNEL32.dll_FindClose]
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x40]
call fcn.10002cb0
mov byte [ebp - 4], 0
lea ecx, [ebp + 0xc]
call fcn.10002cb0
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1005078e
mov esp, ebp
pop ebp
ret 0x1c
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3