joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1000a3f0
Capabilities:
Parse credit card information

Disassembly:
cmp byte [0x100e20b5], 0
push esi
mov esi, edx
je 0x1000a421
vmovss xmm0, dword [esi + 0x40]
vucomiss xmm0, dword [0x100d5f54]
lahf
test ah, 0x44
jnp 0x1000a421
vucomiss xmm0, dword [0x100d5f94]
lahf
test ah, 0x44
jp 0x1000a4a4
cmp dword [ecx + 0x44], 3
jne 0x1000a4a4
push ecx
call dword [0x100e23b8]
add esp, 4
test eax, eax
je 0x1000a4a4
mov ecx, dword [esi + 0x2c]
cmp ecx, dword [eax + 0xa4]
jge 0x1000a4a4
imul ecx, ecx, 0xb0
add ecx, dword [eax + 0xa8]
mov ecx, dword [ecx + eax + 0x28]
cmp ecx, 0x24
je 0x1000a49d
cmp ecx, 0x25
je 0x1000a49d
cmp ecx, 0x26
je 0x1000a49d
cmp ecx, 0x27
je 0x1000a49d
cmp ecx, 0x42
je 0x1000a49d
cmp ecx, 0x43
je 0x1000a49d
cmp ecx, 0x44
je 0x1000a49d
cmp ecx, 0x45
je 0x1000a49d
cmp ecx, 0x28
je 0x1000a496
cmp ecx, 0x29
je 0x1000a496
cmp ecx, 0x2a
je 0x1000a496
xor edx, edx
mov eax, 2
cmp ecx, 0x2b
pop esi
cmovne eax, edx
ret
mov eax, 2
pop esi
ret
mov eax, 1
pop esi
ret
xor eax, eax
pop esi
ret
Function at 0x1000c330
Capabilities:
Check for software breakpoints

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x14
cmp dword [0x100e2138], 0
push ebx
push esi
push edi
jne 0x1000c518
mov edi, dword [ebp + 0x1c]
mov eax, dword [edi + 0x10]
cmp eax, dword [edi + 4]
ja 0x1000c518
mov ebx, dword [ebp + 0xc]
lea eax, [esp + 0xc]
push eax
lea eax, [esp + 0x18]
mov dword [esp + 0x10], ebx
push eax
lea ecx, [edi + 0xc]
call fcn.1000da50
mov eax, dword [esp + 0x1c]
cmp byte [eax + 0xd], 0
jne 0x1000c389
cmp ebx, dword [eax + 0x10]
jb 0x1000c389
cmp eax, dword [edi + 0xc]
jne 0x1000c518
lea eax, [ebp + 0xc]
push eax
lea eax, [esp + 0x18]
push eax
lea ecx, [edi + 0xc]
call fcn.1000d6d0
mov ebx, dword [ebp + 8]
cmp dword [ebx], 0x24c
jne 0x1000c40d
mov ecx, dword [ebx + 0xe4]
cmp byte [ecx + 0x90], 1
jne 0x1000c40d
cmp dword [ecx + 0x98], 2
jne 0x1000c40d
mov ecx, dword [ecx + 0xa0]
mov edx, dword [0x100e256c]
cmp ecx, edx
jbe 0x1000c40d
mov eax, dword [0x100e2588]
add eax, edx
cmp ecx, eax
jae 0x1000c40d
mov edx, str.Too_many_attachments_on__s_n
mov esi, 0x17
mov eax, dword [ecx]
cmp eax, dword [edx]
jne 0x1000c40d
add ecx, 4
add edx, 4
sub esi, 4
jae 0x1000c3e2
mov ax, word [ecx]
cmp ax, word [edx]
jne 0x1000c40d
mov al, byte [ecx + 2]
cmp al, byte [edx + 2]
jne 0x1000c40d
mov eax, dword [edi + 0x28]
mov dword [0x100e2118], eax
jmp 0x1000c412
mov eax, dword [0x100e2118]
test eax, eax
jne 0x1000c518
mov eax, dword [ebx]
cmp eax, 0x108
je 0x1000c43b
mov ecx, eax
cmp eax, 0xfd
jb 0x1000c4fc
cmp eax, 0x110
ja 0x1000c4fc
mov edx, dword [ebx + 0xe4]
mov ecx, eax
cmp byte [edx + 0x90], 1
jne 0x1000c4fc
cmp dword [edx + 0x98], 2
jne 0x1000c4fc
mov eax, dword [edx + 0xa0]
lea ecx, [edi + 0x14]
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], eax
lea eax, [esp + 0xc]
push eax
lea eax, [esp + 0x18]
push eax
call fcn.1000da50
mov eax, dword [esp + 0x1c]
cmp byte [eax + 0xd], 0
jne 0x1000c495
mov ecx, dword [esp + 0x10]
cmp ecx, dword [eax + 0x10]
jb 0x1000c495
cmp eax, dword [edi + 0x14]
jne 0x1000c4f2
lea eax, [esp + 0xc]
push eax
lea eax, [esp + 0x18]
push eax
lea ecx, [edi + 0x14]
call fcn.1000d7c0
mov edx, dword [ebp + 0x18]
inc edx
cmp edx, dword [edi + 8]
jge 0x1000c4f2
mov ecx, dword [edi + 0x20]
mov dword [esp + 0x10], edx
mov dword [esp + 0x14], 0x300
cmp ecx, dword [edi + 0x24]
je 0x1000c4da
mov eax, dword [esp + 0xc]
mov dword [ecx], eax
mov dword [ecx + 4], 0x300
mov dword [ecx + 8], edx
add dword [edi + 0x20], 0xc
jmp 0x1000c4f2
lea eax, [esp + 0x10]
push eax
lea eax, [esp + 0x18]
push eax
lea eax, [esp + 0x14]
push eax
push ecx
lea ecx, [edi + 0x1c]
call fcn.1000d890
mov ecx, dword [ebx]
cmp ecx, 0x108
je 0x1000c518
mov eax, dword [ebp + 0xc]
cmp byte [eax], 0xcc
je 0x1000c518
xor eax, eax
cmp ecx, 0x93
sete al
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x18
pop edi
pop esi
mov eax, 1
pop ebx
mov esp, ebp
pop ebp
ret 0x18
Function at 0x1000e400
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100b06c2
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push esi
push edi
mov eax, dword [0x100dc280]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov dword [ebp - 0x14], ebx
mov dword [ebx], 0xffffffff
mov dword [ebx + 0x24], 0
mov dword [ebx + 0x28], 0
mov dword [ebx + 0x2c], 0
mov dword [ebp - 4], 0
mov dword [ebx + 0x30], 0
mov dword [ebx + 0x34], 0
mov dword [ebx + 0x38], 0
mov dword [ebx + 0x3c], 0
mov dword [ebx + 0x40], 0
mov dword [ebx + 0x44], 0
mov dword [ebx + 0x48], 0
mov dword [ebx + 0x4c], 0
mov dword [ebx + 0x50], 0
mov dword [ebx + 0x54], 0
mov dword [ebx + 0x58], 0
mov dword [ebx + 0x5c], 0
mov byte [ebp - 4], 4
lea edi, [ebx + 0x2060]
mov dword [ebp - 0x18], edi
vxorps xmm0, xmm0, xmm0
vmovss dword [edi], xmm0
push 0x24
mov dword [edi + 4], 0
mov dword [edi + 8], 0
call fcn.1008d9d0
add esp, 4
mov dword [eax], eax
mov dword [eax + 4], eax
mov dword [edi + 4], eax
mov dword [edi + 0xc], 0
mov dword [edi + 0x10], 0
mov dword [edi + 0x14], 0
mov byte [ebp - 4], 6
mov edx, eax
vmovss xmm0, dword [0x100d5f94]
mov dword [edi + 0x18], 7
mov dword [edi + 0x1c], 8
vmovss dword [edi], xmm0
mov ecx, dword [edi + 0x10]
mov eax, ecx
sar eax, 2
mov dword [ebp - 0x10], edx
cmp eax, 0x10
jae 0x1000e581
push 0x40
call fcn.1008d9d0
mov ecx, dword [edi + 0x14]
mov esi, eax
mov eax, dword [edi + 0xc]
add esp, 4
sub ecx, eax
sar ecx, 2
test ecx, ecx
je 0x1000e563
shl ecx, 2
cmp ecx, 0x1000
jb 0x1000e559
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x1000e6a1
mov eax, edx
push ecx
push eax
call fcn.1008dd1a
add esp, 8
lea eax, [esi + 0x40]
mov dword [edi + 0xc], esi
mov dword [edi + 0x10], eax
mov dword [edi + 0x14], eax
cmp esi, eax
je 0x1000e591
mov ecx, dword [ebp - 0x10]
mov dword [esi], ecx
add esi, 4
cmp esi, eax
jne 0x1000e576
jmp 0x1000e591
add ecx, 3
shr ecx, 2
test ecx, ecx
je 0x1000e591
mov eax, edx
xor edi, edi
rep stosd dword es:[edi], eax
mov dword [ebx + 0x2080], 0
mov eax, ebx
mov dword [ebx + 0x2084], 0
mov dword [ebx + 0x2088], 0
mov dword [ebx + 0x208c], 0
mov dword [ebx + 0x2090], 0
mov dword [ebx + 0x2094], 0
mov dword [ebx + 0x2098], 0
mov dword [ebx + 0x209c], 0
mov dword [ebx + 0x20a0], 0
mov dword [ebx + 0x20a4], 0
mov dword [ebx + 0x20a8], 0
mov dword [ebx + 0x20ac], 0
mov dword [ebx + 0x20b0], 0
mov dword [ebx + 0x20b4], 0
mov dword [ebx + 0x20b8], 0
mov dword [ebx + 0x20bc], 0
mov dword [ebx + 0x20c0], 0
mov dword [ebx + 0x20c4], 0
vxorps xmm0, xmm0, xmm0
mov dword [ebx + 4], 0xffffffff
mov dword [ebx + 8], 0xffffffff
mov dword [ebx + 0x18], 0
mov dword [ebx + 0x1c], 0
mov dword [ebx + 0x20], 0
mov dword [ebx + 0xc], 0xffffffff
vmovss dword [ebx + 0x10], xmm0
vmovss dword [ebx + 0x14], xmm0
vmovups xmmword [ebx + 0x20c8], xmm0
vmovss dword [ebx + 0x20d8], xmm0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
call fcn.1009245f
int3
Function at 0x1000f580
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, 0x5397829d
push esi
mov esi, dword [ebp + 8]
push edi
mov ecx, dword [esi + 0xb94]
sub ecx, dword [0x100e20c8]
imul ecx
sar edx, 7
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
js 0x1000f65d
mov eax, dword [0x100e20e4]
cmp ecx, dword [eax]
jge 0x1000f65d
mov eax, dword [0x100e26f8]
mov edi, dword [eax + ecx*4]
test edi, edi
je 0x1000f65d
movzx eax, byte [esi]
xor eax, 0x811c9dc5
imul ecx, eax, 0x1000193
movzx eax, byte [esi + 1]
xor ecx, eax
movzx eax, byte [esi + 2]
imul ecx, ecx, 0x1000193
xor ecx, eax
movzx eax, byte [esi + 3]
imul ecx, ecx, 0x1000193
xor ecx, eax
imul eax, ecx, 0x1000193
mov ecx, 0x100e26cc
push eax
push esi
lea eax, [ebp - 0xc]
push eax
call fcn.10008b00
mov ecx, dword [0x100e26d0]
mov eax, dword [eax + 4]
test eax, eax
cmovne ecx, eax
cmp ecx, dword [0x100e26d0]
jne 0x1000f672
cmp esi, dword [0x100e2170]
je 0x1000f641
mov eax, dword [esi + 0x308]
cmp eax, 7
je 0x1000f63b
cmp eax, 0xd
jne 0x1000f641
mov byte [ebp + 8], 1
jmp 0x1000f645
mov byte [ebp + 8], 0
push dword [ebp + 8]
push edi
push dword [0x100e2704]
push esi
call fcn.1000f1c0
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4
mov eax, dword [0x100e2594]
push str.CreateBrushModel:_Invalid_model_index_n
mov eax, dword [eax + 0x98]
call eax
add esp, 4
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x10019950
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100b0950
mov eax, dword fs:[0]
push eax
push ebx
push esi
push edi
mov eax, dword [0x100dc280]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ecx, dword [ebp + 0xc]
mov eax, dword [ecx]
mov edi, dword [eax + 0xc]
test edi, edi
je 0x10019ab9
mov edx, dword [edi + 4]
test edx, edx
je 0x100199cb
mov ecx, dword [0x100e26a0]
push edx
mov eax, dword [ecx]
call dword [eax + 0x5c]
mov eax, dword [edi + 4]
mov ecx, dword [eax + 0x244]
test ecx, ecx
je 0x100199ab
mov eax, dword [ecx]
push 1
call dword [eax]
mov eax, dword [edi + 4]
mov ecx, dword [eax + 0xcc]
test ecx, ecx
je 0x100199be
mov eax, dword [ecx]
push 1
call dword [eax]
mov ecx, dword [edi + 4]
test ecx, ecx
je 0x100199cb
mov eax, dword [ecx]
push 1
call dword [eax]
mov esi, dword [edi + 8]
test esi, esi
je 0x10019a3d
cmp byte [esi + 0x18], 0
je 0x10019a3d
mov ecx, dword [esi + 0xc]
test ecx, ecx
je 0x10019a2b
mov eax, dword [esi + 0x14]
sub eax, ecx
sar eax, 3
lea edx, [eax*8]
cmp edx, 0x1000
jb 0x10019a0c
mov ebx, dword [ecx - 4]
add edx, 0x23
sub ecx, ebx
lea eax, [ecx - 4]
cmp eax, 0x1f
ja 0x10019b66
mov ecx, ebx
push edx
push ecx
call fcn.1008dd1a
mov dword [esi + 0xc], 0
add esp, 8
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
mov ecx, esi
call fcn.10006c60
push 0x1c
push esi
call fcn.1008dd1a
add esp, 8
mov esi, dword [edi + 0xc]
test esi, esi
je 0x10019aa6
cmp byte [esi + 0xc], 0
je 0x10019aa6
mov ecx, dword [esi]
test ecx, ecx
je 0x10019a9b
mov eax, dword [esi + 8]
sub eax, ecx
sar eax, 2
lea edx, [eax*4]
cmp edx, 0x1000
jb 0x10019a7d
mov ebx, dword [ecx - 4]
add edx, 0x23
sub ecx, ebx
lea eax, [ecx - 4]
cmp eax, 0x1f
ja 0x10019b66
mov ecx, ebx
push edx
push ecx
call fcn.1008dd1a
mov dword [esi], 0
add esp, 8
mov dword [esi + 4], 0
mov dword [esi + 8], 0
push 0x10
push esi
call fcn.1008dd1a
add esp, 8
push edi
mov dword [ebp - 4], 0
call fcn.10072240
mov ecx, dword [ebp + 0xc]
add esp, 4
mov eax, dword [ecx]
mov dword [eax + 0xc], 0
mov eax, dword [ecx]
movzx ecx, byte [eax + 8]
xor ecx, 0x811c9dc5
imul edx, ecx, 0x1000193
movzx ecx, byte [eax + 9]
xor edx, ecx
movzx ecx, byte [eax + 0xa]
imul edx, edx, 0x1000193
xor edx, ecx
movzx ecx, byte [eax + 0xb]
imul edx, edx, 0x1000193
xor edx, ecx
mov ecx, dword [0x100e26d8]
imul edx, edx, 0x1000193
and edx, dword [0x100e26e4]
lea edx, [ecx + edx*8]
mov ecx, dword [edx]
cmp dword [edx + 4], eax
jne 0x10019b27
cmp ecx, eax
jne 0x10019b1f
mov ecx, dword [0x100e26d0]
mov dword [edx], ecx
mov dword [edx + 4], ecx
jmp 0x10019b2f
mov ecx, dword [eax + 4]
mov dword [edx + 4], ecx
jmp 0x10019b2f
cmp ecx, eax
jne 0x10019b2f
mov ecx, dword [eax]
mov dword [edx], ecx
mov esi, dword [eax]
dec dword [0x100e26d4]
mov ecx, dword [eax + 4]
push 0x10
push eax
mov dword [ecx], esi
mov ecx, dword [eax + 4]
mov dword [esi + 4], ecx
call fcn.1008dd1a
mov eax, dword [ebp + 8]
add esp, 8
mov dword [eax], esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
call fcn.1009245f
int3
Function at 0x10019b80
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov edx, dword [ebp + 8]
movzx eax, dl
xor eax, 0x811c9dc5
imul ecx, eax, 0x1000193
mov eax, edx
sar eax, 8
movzx eax, al
xor ecx, eax
mov eax, edx
imul ecx, ecx, 0x1000193
sar eax, 0x10
movzx eax, al
sar edx, 0x18
xor ecx, eax
movzx eax, dl
imul ecx, ecx, 0x1000193
xor ecx, eax
imul eax, ecx, 0x1000193
mov ecx, 0x100e26ac
push eax
lea eax, [ebp + 8]
push eax
lea eax, [ebp - 0xc]
push eax
call fcn.10008b00
mov ecx, dword [0x100e26b0]
mov eax, dword [eax + 4]
test eax, eax
cmovne ecx, eax
mov dword [ebp + 8], ecx
cmp ecx, dword [0x100e26b0]
jne 0x10019c05
push str.RemoveRagdollEx:_not_found_n
call dword [0x100e2218]
add esp, 4
mov esp, ebp
pop ebp
ret 4
lea eax, [ebp + 8]
push eax
lea eax, [ebp - 4]
push eax
call fcn.10019200
mov esp, ebp
pop ebp
ret 4
Function at 0x10019c20
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff0
mov edx, dword [ebp + 0xc]
sub esp, 0x30
movzx eax, dl
xor eax, 0x811c9dc5
imul ecx, eax, 0x1000193
mov eax, edx
sar eax, 8
movzx eax, al
xor ecx, eax
mov eax, edx
imul ecx, ecx, 0x1000193
sar eax, 0x10
movzx eax, al
sar edx, 0x18
xor ecx, eax
movzx eax, dl
imul ecx, ecx, 0x1000193
xor ecx, eax
imul eax, ecx, 0x1000193
mov ecx, 0x100e26ac
push eax
lea eax, [ebp + 0xc]
push eax
lea eax, [esp + 0x20]
push eax
call fcn.10008b00
mov edx, dword [0x100e26b0]
mov eax, dword [eax + 4]
test eax, eax
cmovne edx, eax
cmp edx, dword [0x100e26b0]
je 0x10019ddd
mov eax, dword [edx + 0xc]
mov ecx, dword [eax + 0x24]
mov eax, dword [eax + 0x28]
sub eax, ecx
test eax, 0xfffffffc
je 0x10019ddd
mov ecx, dword [ecx]
mov eax, dword [ecx + 0x18]
vmovdqu xmm5, xmmword [ecx + 0x80]
vshufps xmm4, xmm5, xmm5, 0x55
vshufps xmm3, xmm5, xmm5, 0xaa
vmovdqu xmm2, xmmword [eax + 0x10]
vmovdqu xmm0, xmmword [eax + 0x30]
vmovdqu xmm6, xmmword [eax + 0x20]
vmovdqu xmm7, xmmword [eax + 0x40]
mov eax, dword [0x100e20dc]
vmovdqa xmmword [esp + 0x20], xmm0
vmulss xmm0, xmm5, xmm2
vshufps xmm1, xmm2, xmm2, 0x55
vfmadd213ss xmm1, xmm4, xmm0
vmulss xmm0, xmm5, xmm6
vshufps xmm2, xmm2, xmm2, 0xaa
vfmadd213ss xmm2, xmm3, xmm1
vshufps xmm1, xmm6, xmm6, 0x55
vfmadd213ss xmm1, xmm4, xmm0
vshufps xmm6, xmm6, xmm6, 0xaa
vfmadd213ss xmm6, xmm3, xmm1
vmovdqa xmmword [esp], xmm7
vaddss xmm7, xmm2, xmm7
vaddss xmm2, xmm6, dword [esp + 4]
vmovdqa xmm6, xmmword [esp + 0x20]
vmulss xmm0, xmm5, xmm6
vshufps xmm1, xmm6, xmm6, 0x55
vfmadd213ss xmm1, xmm4, xmm0
vshufps xmm6, xmm6, xmm6, 0xaa
vfmadd213ss xmm6, xmm3, xmm1
vaddss xmm0, xmm6, dword [esp + 8]
vaddss xmm0, xmm0, dword [0x100d6008]
vmovss dword [eax + 0x21c], xmm7
vmovss dword [eax + 0x22c], xmm2
vmovss dword [eax + 0x23c], xmm0
vmovss dword [eax + 0x24c], xmm7
vmovss dword [eax + 0x25c], xmm2
vmovss dword [eax + 0x26c], xmm0
vmovss dword [eax + 0x27c], xmm7
vmovss dword [eax + 0x28c], xmm2
vmovss dword [eax + 0x29c], xmm0
vmovss dword [eax + 0x2ac], xmm7
vmovss dword [eax + 0x2bc], xmm2
vmovss dword [eax + 0x2cc], xmm0
vmovss dword [eax + 0x2dc], xmm7
vmovss dword [eax + 0x2ec], xmm2
vmovss dword [eax + 0x2fc], xmm0
vmovss dword [eax + 0x30c], xmm7
vmovss dword [eax + 0x31c], xmm2
vmovss dword [eax + 0x32c], xmm0
mov esp, ebp
pop ebp
ret 8
Function at 0x10019df0
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff0
sub esp, 0x58
mov edx, dword [0x100e23a0]
mov eax, edx
shr eax, 8
movzx ecx, al
movzx eax, dl
xor eax, 0x811c9dc5
mov dword [esp + 0xc], edx
imul eax, eax, 0x1000193
push esi
push edi
xor ecx, eax
mov eax, edx
shr eax, 0x10
imul ecx, ecx, 0x1000193
movzx eax, al
shr edx, 0x18
xor ecx, eax
imul eax, ecx, 0x1000193
mov ecx, 0x100e26ac
xor eax, edx
imul eax, eax, 0x1000193
push eax
lea eax, [esp + 0x18]
push eax
lea eax, [esp + 0x60]
push eax
call fcn.10008b00
mov edx, dword [0x100e26b0]
mov eax, dword [eax + 4]
test eax, eax
cmovne edx, eax
cmp edx, dword [0x100e26b0]
jne 0x10019e76
xor al, al
vzeroupper
pop edi
pop esi
mov esp, ebp
pop ebp
ret 8
mov eax, dword [edx + 0xc]
mov dword [esp + 0x14], eax
mov edx, dword [eax + 0x2064]
mov ecx, dword [edx]
cmp ecx, edx
je 0x1001a012
vxorps xmm5, xmm5, xmm5
mov edi, dword [ecx + 0x20]
mov eax, dword [edi + 0x18]
mov esi, dword [eax + 0x244]
mov eax, dword [edi + 0x30]
and al, 3
cmp al, 1
jne 0x10019f6e
mov eax, dword [esp + 0x14]
vmovss xmm0, dword [eax + 0x14]
vucomiss xmm0, xmm5
lahf
test ah, 0x44
jp 0x10019f6e
mov eax, dword [edi + 0x2c]
vmovdqu xmm1, xmmword [esi + 0x10]
vmovdqu xmm2, xmmword [esi + 0x20]
vmovdqu xmm4, xmmword [esi + 0x40]
vmovdqu xmm3, xmmword [esi + 0x30]
lea eax, [eax + eax*2]
shl eax, 4
add eax, dword [0x100e20dc]
vmovss dword [esp + 0x18], xmm1
vextractps dword [esp + 0x1c], xmm1, 1
vextractps dword [esp + 0x20], xmm1, 2
vmovss dword [esp + 0x24], xmm4
vmovss dword [esp + 0x28], xmm2
vextractps dword [esp + 0x2c], xmm2, 1
vextractps dword [esp + 0x30], xmm2, 2
vextractps dword [esp + 0x34], xmm4, 1
vmovdqu ymm1, ymmword [esp + 0x18]
vmovdqu ymmword [eax], ymm1
vmovss dword [esp + 0x38], xmm3
vextractps dword [esp + 0x3c], xmm3, 1
vextractps dword [esp + 0x40], xmm3, 2
vextractps dword [esp + 0x44], xmm4, 2
vmovdqu xmm0, xmmword [esp + 0x38]
vmovdqu xmmword [eax + 0x20], xmm0
mov eax, dword [edi + 0x2c]
lea eax, [eax + eax*2]
shl eax, 4
add eax, dword [0x100e2158]
vmovdqu ymmword [eax], ymm1
vmovdqu xmmword [eax + 0x20], xmm0
jmp 0x1001a008
mov eax, dword [edi + 0x2c]
lea eax, [eax + eax*2]
shl eax, 4
add eax, dword [0x100e20dc]
vmovdqu ymm1, ymmword [eax]
vmovdqu xmm2, xmmword [eax + 0x20]
vmovaps xmm0, xmm1
vextractps dword [esi + 0x14], xmm0, 1
vextractps dword [esi + 0x18], xmm0, 2
vextractf128 xmm0, ymm1, 1
vmovss dword [esi + 0x20], xmm0
vextractf128 xmm0, ymm1, 1
vextractps dword [esi + 0x24], xmm0, 1
vextractf128 xmm0, ymm1, 1
vextractps dword [esi + 0x28], xmm0, 2
vmovaps xmm0, xmm1
vextractps dword [esi + 0x40], xmm0, 3
vextractf128 xmm0, ymm1, 1
vmovss dword [esi + 0x10], xmm1
vmovss dword [esi + 0x1c], xmm5
vmovss dword [esi + 0x2c], xmm5
vmovss dword [esi + 0x30], xmm2
vextractps dword [esi + 0x34], xmm2, 1
vextractps dword [esi + 0x38], xmm2, 2
vmovss dword [esi + 0x3c], xmm5
vextractps dword [esi + 0x44], xmm0, 3
vextractps dword [esi + 0x48], xmm2, 3
vmovss dword [esi + 0x4c], xmm5
mov ecx, dword [ecx]
cmp ecx, edx
jne 0x10019e91
mov al, 1
vzeroupper
pop edi
pop esi
mov esp, ebp
pop ebp
ret 8
Function at 0x1001a530
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 0xc]
sub esp, 8
movzx eax, dl
xor eax, 0x811c9dc5
imul ecx, eax, 0x1000193
mov eax, edx
sar eax, 8
movzx eax, al
xor ecx, eax
mov eax, edx
imul ecx, ecx, 0x1000193
sar eax, 0x10
movzx eax, al
sar edx, 0x18
xor ecx, eax
movzx eax, dl
imul ecx, ecx, 0x1000193
xor ecx, eax
imul eax, ecx, 0x1000193
mov ecx, 0x100e26ac
push eax
lea eax, [ebp + 0xc]
push eax
lea eax, [ebp - 8]
push eax
call fcn.10008b00
mov ecx, dword [0x100e26b0]
mov eax, dword [eax + 4]
test eax, eax
cmovne ecx, eax
mov eax, dword [ebp + 8]
mov dword [eax], ecx
mov esp, ebp
pop ebp
ret 8

Function at 0x1001a5b0
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x18
push esi
push edi
push dword [ebp + 8]
lea eax, [esp + 0x10]
push eax
call fcn.1001a530
mov edi, dword [0x100e26b0]
mov esi, dword [esp + 0xc]
cmp esi, edi
je 0x1001a677
mov edx, dword [ebp + 0xc]
movzx eax, dl
xor eax, 0x811c9dc5
mov dword [esp + 0xc], edx
imul ecx, eax, 0x1000193
mov eax, edx
shr eax, 8
movzx eax, al
xor ecx, eax
mov eax, edx
shr eax, 0x10
imul ecx, ecx, 0x1000193
movzx eax, al
shr edx, 0x18
xor ecx, eax
imul eax, ecx, 0x1000193
mov ecx, 0x100e26ac
xor eax, edx
imul eax, eax, 0x1000193
push eax
lea eax, [esp + 0x10]
push eax
lea eax, [esp + 0x20]
push eax
call fcn.10008b00
mov eax, dword [eax + 4]
test eax, eax
cmove eax, edi
cmp eax, edi
jne 0x1001a677
mov edi, dword [esi + 0xc]
lea eax, [esp + 0x10]
push esi
push eax
mov ecx, 0x100e26ac
call fcn.1001d0b0
lea eax, [esp + 0xc]
mov ecx, 0x100e26ac
push eax
lea eax, [esp + 0x14]
push eax
call fcn.1001d150
mov eax, dword [eax]
mov dword [eax + 0xc], edi
mov eax, dword [esp + 0xc]
mov dword [edi], eax
mov al, 1
pop edi
pop esi
mov esp, ebp
pop ebp
ret 8
pop edi
xor al, al
pop esi
mov esp, ebp
pop ebp
ret 8
Function at 0x1001d010
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov edx, dword [ebp + 0xc]
mov eax, ecx
push ebx
push esi
push edi
cmp dword [edx + 0x14], 0xf
mov edi, edx
mov dword [ebp - 4], eax
jbe 0x1001d02b
mov edi, dword [edx]
mov ebx, dword [edx + 0x10]
xor ecx, ecx
mov esi, 0x811c9dc5
test ebx, ebx
je 0x1001d054
nop dword [eax]
movzx eax, byte [ecx + edi]
inc ecx
xor eax, esi
imul esi, eax, 0x1000193
cmp ecx, ebx
jb 0x1001d040
mov eax, dword [ebp - 4]
push esi
push edx
lea ecx, [ebp - 0xc]
push ecx
mov ecx, eax
call fcn.1001f6b0
pop edi
pop esi
pop ebx
mov ecx, dword [eax + 4]
mov eax, dword [ebp + 8]
test ecx, ecx
jne 0x1001d074
mov ecx, dword [ebp - 4]
mov ecx, dword [ecx + 4]
mov dword [eax], ecx
mov esp, ebp
pop ebp
ret 8

Function at 0x1001d0b0
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
push esi
push edi
mov edi, ecx
movzx edx, byte [eax + 8]
movzx ecx, byte [eax + 0xb]
xor edx, 0x811c9dc5
imul esi, edx, 0x1000193
movzx edx, byte [eax + 9]
xor esi, edx
movzx edx, byte [eax + 0xa]
imul esi, esi, 0x1000193
xor esi, edx
imul edx, esi, 0x1000193
xor edx, ecx
imul ecx, edx, 0x1000193
mov edx, dword [edi + 0x18]
and edx, ecx
mov ecx, dword [edi + 0xc]
mov esi, dword [ecx + edx*8]
cmp dword [ecx + edx*8 + 4], eax
jne 0x1001d118
cmp esi, eax
jne 0x1001d10f
mov eax, dword [edi + 4]
mov dword [ecx + edx*8], eax
mov dword [ecx + edx*8 + 4], eax
jmp 0x1001d121
mov eax, dword [eax + 4]
mov dword [ecx + edx*8 + 4], eax
jmp 0x1001d121
cmp esi, eax
jne 0x1001d124
mov eax, dword [eax]
mov dword [ecx + edx*8], eax
mov eax, dword [ebp + 0xc]
mov esi, dword [eax]
dec dword [edi + 8]
mov ecx, dword [eax + 4]
push 0x10
mov dword [ecx], esi
mov eax, dword [eax + 4]
mov dword [esi + 4], eax
push dword [ebp + 0xc]
call fcn.1008dd1a
mov eax, dword [ebp + 8]
add esp, 8
pop edi
mov dword [eax], esi
pop esi
pop ebp
ret 8