joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1001c050
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push esi
mov esi, ecx
push edi
cmp byte [esi + 0x30], 0
je 0x1001c0be
mov edi, dword [esi + 0xc]
lea eax, [ebp - 4]
push eax
push 0x40
lea eax, [ebp - 8]
mov dword [ebp - 0xc], edi
push eax
lea eax, [ebp - 0xc]
mov dword [ebp - 8], 0x14
push eax
push 0xffffffffffffffff
mov dword [ebp - 4], 0
call dword [sym.imp.ntdll.dll_NtProtectVirtualMemory]
test eax, eax
js 0x1001c0be
movups xmm0, xmmword [esi + 0x1c]
movups xmmword [edi], xmm0
mov eax, dword [esi + 0x2c]
mov dword [edi + 0x10], eax
lea eax, [ebp - 4]
push eax
push dword [ebp - 4]
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0xc]
push eax
push 0xffffffffffffffff
call dword [sym.imp.ntdll.dll_NtProtectVirtualMemory]
pop edi
mov byte [esi + 0x30], 0
mov al, 1
pop esi
mov esp, ebp
pop ebp
ret
pop edi
xor al, al
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x1001c980
Capabilities:
Access peb ldr_data
Encode data using xor
Get process heap force flags
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
push ebx
push esi
push edi
push 0x44
lea eax, [ebp - 0x48]
push 0
push eax
call fcn.10067060
add esp, 0xc
mov dword [ebp - 4], 0x20
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x48]
push eax
call dword [0x100b12f0]
mov eax, dword fs:[0x18]
lea edi, [ebp - 0x24]
xor ecx, ecx
push ebx
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x64]
mov dword [ebp - 0x28], eax
xor eax, eax
cpuid
mov esi, ebx
pop ebx
mov dword [edi], eax
mov eax, 1
mov dword [edi + 4], esi
mov dword [edi + 8], ecx
xor ecx, ecx
mov dword [edi + 0xc], edx
lea edi, [ebp - 0x14]
push ebx
cpuid
mov esi, ebx
pop ebx
mov dword [edi], eax
or eax, 0xffffffff
mov dword [edi + 4], esi
mov dword [edi + 8], ecx
mov dword [edi + 0xc], edx
xor edx, edx
pop edi
pop esi
mov dword [ebp - 0x10], 0x224
mov dword [ebp - 0xc], 0x1029
pop ebx
movzx ecx, byte [ebp + edx - 0x48]
xor ecx, eax
shr eax, 8
movzx ecx, cl
xor eax, dword [ecx*4 + 0x1009bfa0]
movzx ecx, byte [ebp + edx - 0x47]
xor ecx, eax
shr eax, 8
movzx ecx, cl
xor eax, dword [ecx*4 + 0x1009bfa0]
movzx ecx, byte [ebp + edx - 0x46]
xor ecx, eax
shr eax, 8
movzx ecx, cl
xor eax, dword [ecx*4 + 0x1009bfa0]
movzx ecx, byte [ebp + edx - 0x45]
add edx, 4
xor ecx, eax
shr eax, 8
movzx ecx, cl
xor eax, dword [ecx*4 + 0x1009bfa0]
cmp edx, 0x44
jb 0x1001ca06
not eax
mov esp, ebp
pop ebp
ret

Function at 0x1001cfc0
Capabilities:
Reference the vmware io port

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100a5700
push 0x10087d68
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xc
push ebx
push esi
push edi
mov dword [ebp - 0x18], esp
mov dword [ebp - 4], 0
push edx
push ecx
push ebx
mov eax, 0x564d5868
mov ebx, 0
mov ecx, 0xa
mov edx, 0x5658
in eax, dx
cmp ebx, 0x564d5868
sete byte [ebp - 0x19]
pop ebx
pop ecx
pop edx
mov al, byte [ebp - 0x19]
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1001d8e0
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push esi
push edi
mov edi, dword [ebp + 8]
lea eax, [ebp + 8]
push eax
push 0x40
lea eax, [ebp - 4]
mov dword [ebp - 0xc], edx
push eax
lea eax, [ebp - 8]
mov dword [ebp - 4], edi
push eax
mov esi, ecx
mov dword [ebp + 8], 0
push 0xffffffffffffffff
mov dword [ebp - 8], esi
call dword [sym.imp.ntdll.dll_NtProtectVirtualMemory]
test eax, eax
js 0x1001d943
push edi
push dword [ebp - 0xc]
push esi
call fcn.10066560
add esp, 0xc
lea eax, [ebp + 8]
push eax
push dword [ebp + 8]
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 8]
push eax
push 0xffffffffffffffff
call dword [sym.imp.ntdll.dll_NtProtectVirtualMemory]
pop edi
mov al, 1
pop esi
mov esp, ebp
pop ebp
ret
pop edi
xor al, al
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x1001db60
Capabilities:
Encode data using base64
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100885f9
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x5c
push ebx
mov ebx, ecx
xor ecx, ecx
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x1c], 0
movaps xmm0, xmmword [0x100a0fb0]
movups xmmword [ebp - 0x66], xmm0
push esi
movaps xmm0, xmmword [0x100a1170]
movups xmmword [ebp - 0x56], xmm0
push edi
movaps xmm0, xmmword [0x100a12a0]
movups xmmword [ebp - 0x46], xmm0
mov word [ebp - 0x26], 0x2f
movaps xmm0, xmmword [0x100a0d80]
movups xmmword [ebp - 0x36], xmm0
nop
mov al, byte [ebp - 0x66]
xor byte [ebp + ecx - 0x65], al
inc ecx
cmp ecx, 0x40
jl 0x1001dbc0
mov dword [ebx + 0x10], 0
mov dword [ebx + 0x14], 0xf
mov byte [ebp - 0x25], 0
mov byte [ebx], 0
mov dword [ebp - 4], 0
xor esi, esi
mov edi, dword [ebp + 8]
mov dword [ebp - 0x1c], 1
test edi, edi
je 0x1001dd34
nop dword [eax]
mov al, byte [edx]
dec edi
mov byte [ebp + esi - 0x14], al
inc edx
mov ch, byte [ebp - 0x12]
inc esi
mov ah, byte [ebp - 0x13]
mov cl, byte [ebp - 0x14]
mov dword [ebp - 0x20], edx
mov byte [ebp - 0xe], ch
mov byte [ebp + 0xb], ah
mov byte [ebp - 0xd], cl
cmp esi, 3
jne 0x1001dc86
mov al, cl
and cl, 3
shr al, 2
mov byte [ebp - 0x18], al
mov al, ah
shl cl, 4
shr al, 4
add cl, al
mov al, ch
mov byte [ebp - 0x17], cl
mov cl, ah
and cl, 0xf
shr al, 6
shl cl, 2
add cl, al
mov al, ch
and al, 0x3f
mov byte [ebp - 0x16], cl
mov byte [ebp - 0x15], al
xor esi, esi
nop word [eax + eax]
movzx eax, byte [ebp + esi - 0x18]
mov ecx, ebx
movzx eax, byte [ebp + eax - 0x65]
push eax
call fcn.1001f120
inc esi
cmp esi, 4
jl 0x1001dc60
mov edx, dword [ebp - 0x20]
xor esi, esi
mov ah, byte [ebp + 0xb]
mov cl, byte [ebp - 0xd]
mov ch, byte [ebp - 0xe]
test edi, edi
jne 0x1001dc00
mov dword [ebp + 8], esi
test esi, esi
je 0x1001dd34
cmp esi, 3
jge 0x1001dcc3
mov ecx, 3
lea edi, [ebp - 0x14]
sub ecx, esi
xor eax, eax
mov edx, ecx
add edi, esi
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
mov ch, byte [ebp - 0x12]
mov ah, byte [ebp - 0x13]
mov cl, byte [ebp - 0x14]
mov al, cl
xor edi, edi
shr al, 2
and cl, 3
mov byte [ebp - 0x18], al
mov al, ah
shr al, 4
and ah, 0xf
shl cl, 4
add cl, al
shl ah, 2
mov al, ch
mov byte [ebp - 0x17], cl
shr al, 6
and ch, 0x3f
add ah, al
mov byte [ebp - 0x15], ch
mov byte [ebp - 0x16], ah
lea eax, [esi + 1]
mov dword [ebp - 0x20], eax
test eax, eax
jle 0x1001dd1a
mov esi, eax
nop
movzx eax, byte [ebp + edi - 0x18]
mov ecx, ebx
movzx eax, byte [ebp + eax - 0x65]
push eax
call fcn.1001f120
inc edi
cmp edi, esi
jl 0x1001dd00
mov esi, dword [ebp + 8]
cmp esi, 3
jge 0x1001dd34
mov edi, 3
sub edi, esi
push 0x3d
mov ecx, ebx
call fcn.1001f120
sub edi, 1
jne 0x1001dd26
mov ecx, dword [ebp - 0xc]
mov eax, ebx
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
Function at 0x100259c0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 0xc]
mov edx, 0x811c9dc5
push edi
mov edi, dword [ebp + 8]
mov ecx, 0
sub esi, edi
je 0x100259f1
nop dword [eax]
movzx eax, byte [ecx + edi]
inc ecx
xor eax, edx
imul edx, eax, 0x1000193
cmp ecx, esi
jb 0x100259e0
pop edi
mov eax, edx
pop esi
pop ebp
ret 8
Function at 0x10027be0
Capabilities:
Parse credit card information

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, ecx
xor cl, cl
push edi
mov eax, dword [esi + 0x4c]
cmp eax, 0xffffffff
je 0x10027dfd
cmp eax, 0x7c
je 0x10027dfd
cmp eax, 0x29
jne 0x10027c1c
cmp dword [esi + 0x10], 0
jne 0x10027dfd
test dword [esi + 0x50], 0x10000000
je 0x10027e14
cmp eax, 0x2e
jne 0x10027c30
lea ecx, [esi + 0x24]
push 5
call fcn.10027e70
jmp 0x10027de1
cmp eax, 0x5c
jne 0x10027c95
mov ecx, esi
call fcn.10027b80
mov eax, dword [esi + 0x50]
and eax, 0x80
je 0x10027c62
cmp byte [esi + 0x48], 0x62
jne 0x10027c62
lea ecx, [esi + 0x24]
push 4
call fcn.10027e70
mov ecx, esi
call fcn.10027b80
jmp 0x10027def
test eax, eax
je 0x10027c89
cmp byte [esi + 0x48], 0x42
jne 0x10027c89
lea ecx, [esi + 0x24]
push 4
call fcn.10027e70
mov eax, dword [esi + 0x28]
mov ecx, esi
xor dword [eax + 8], 1
call fcn.10027b80
jmp 0x10027def
mov ecx, esi
call fcn.10028630
jmp 0x10027de8
cmp eax, 0x5b
jne 0x10027d48
mov ecx, esi
call fcn.10027b80
lea ecx, [esi + 0x24]
call fcn.10029500
mov eax, dword [esi + 0x4c]
cmp eax, 0x5e
jne 0x10027cc6
mov eax, dword [esi + 0x28]
mov ecx, esi
xor dword [eax + 8], 1
call fcn.10027b80
mov eax, dword [esi + 0x4c]
test dword [esi + 0x50], 0x20000000
je 0x10027d32
cmp eax, 0x5d
jne 0x10027d32
test dword [esi + 0x2c], 0x100
mov bl, al
je 0x10027cf0
mov eax, dword [esi + 0x30]
push 0x5d
mov ecx, dword [eax + 4]
mov eax, dword [ecx]
mov eax, dword [eax + 0x10]
call eax
mov bl, al
mov edi, dword [esi + 0x28]
mov ecx, dword [edi + 0x18]
test ecx, ecx
jne 0x10027d16
push 0x20
call fcn.1004ee77
xorps xmm0, xmm0
mov dword [ebp - 4], eax
add esp, 4
mov ecx, eax
movups xmmword [eax], xmm0
movups xmmword [eax + 0x10], xmm0
mov dword [edi + 0x18], eax
movzx edx, bl
mov eax, edx
and edx, 7
shr eax, 3
add ecx, eax
movzx eax, byte [ecx]
bts eax, edx
mov byte [ecx], al
mov ecx, esi
call fcn.10027b80
mov ecx, esi
call fcn.10028f60
cmp dword [esi + 0x4c], 0x5d
jne 0x10027e0d
jmp 0x10027de1
cmp eax, 0x28
jne 0x10027d74
mov ecx, esi
call fcn.10027b80
mov ecx, esi
call fcn.100287c0
cmp dword [esi + 0x4c], 0x29
mov bl, al
jne 0x10027e14
mov ecx, esi
call fcn.10027b80
test bl, bl
je 0x10027def
jmp 0x10027de8
cmp eax, 0x5e
jne 0x10027d8c
lea ecx, [esi + 0x24]
push 2
call fcn.10027e70
mov ecx, esi
call fcn.10027b80
jmp 0x10027def
cmp eax, 0x24
jne 0x10027da4
lea ecx, [esi + 0x24]
push 3
call fcn.10027e70
mov ecx, esi
call fcn.10027b80
jmp 0x10027def
cmp eax, 0x2a
je 0x10027e06
cmp eax, 0x2b
je 0x10027e06
cmp eax, 0x3f
je 0x10027e06
cmp eax, 0x7b
je 0x10027e06
cmp eax, 0x7d
jne 0x10027dc6
test dword [esi + 0x50], 0x10000000
je 0x10027e1b
cmp eax, 0x5d
jne 0x10027dd4
test dword [esi + 0x50], 0x10000000
je 0x10027e0d
movzx eax, byte [esi + 0x48]
lea ecx, [esi + 0x24]
push eax
call fcn.10028a20
mov ecx, esi
call fcn.10027b80
mov ecx, esi
call fcn.100288c0
mov eax, dword [esi + 0x4c]
mov cl, 1
cmp eax, 0xffffffff
jne 0x10027bf7
pop edi
pop esi
mov al, cl
pop ebx
mov esp, ebp
pop ebp
ret
push 0xa
call fcn.10026e00
push 4
call fcn.10026e00
push 5
call fcn.10026e00
push 6
call fcn.10026e00
int3
Function at 0x1002a880
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10088baa
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x10
push esi
mov esi, ecx
push 0
mov dword [ebp - 0x10], esi
call fcn.1004c910
mov dword [ebp - 4], 0
mov dword [esi + 4], 0
mov byte [esi + 8], 0
mov dword [esi + 0xc], 0
mov byte [esi + 0x10], 0
xor eax, eax
mov dword [esi + 0x14], 0
mov word [esi + 0x18], ax
mov dword [esi + 0x1c], eax
mov word [esi + 0x20], ax
mov dword [esi + 0x24], eax
mov byte [esi + 0x28], al
mov dword [esi + 0x2c], eax
mov byte [esi + 0x30], al
mov eax, dword [ebp + 8]
mov byte [ebp - 4], 6
test eax, eax
je 0x1002a90d
push eax
push esi
call fcn.1004c7ce
mov ecx, dword [ebp - 0xc]
add esp, 8
mov eax, esi
mov dword fs:[0], ecx
pop esi
mov esp, ebp
pop ebp
ret 4
push str.bad_locale_name
lea ecx, [ebp - 0x1c]
call fcn.1002afd0
push 0x100a9a68
lea eax, [ebp - 0x1c]
push eax
call fcn.100664e5
int3

Function at 0x1002b2a0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [0x100b11c8]
push ebx
push esi
mov esi, edx
push edi
cmp eax, 0xb
je 0x1002b2e2
cmp eax, 0xc
je 0x1002b2e2
lea ebx, [ecx + 4]
xor dl, dl
xor ecx, ecx
add esi, 0xfffffffa
je 0x1002b308
mov edi, dword [ebp + 8]
mov eax, ecx
and eax, 0x1f
mov al, byte [eax + edi]
xor al, byte [ecx + ebx]
xor al, dl
mov byte [ecx + ebx], al
mov dl, al
inc ecx
cmp ecx, esi
jb 0x1002b2c6
pop edi
pop esi
pop ebx
pop ebp
ret
lea ebx, [ecx + 5]
xor dl, dl
xor ecx, ecx
add esi, 0xfffffff9
je 0x1002b308
mov edi, dword [ebp + 8]
mov eax, ecx
and eax, 0x1f
mov al, byte [eax + edi]
xor al, byte [ecx + ebx]
xor al, dl
mov byte [ecx + ebx], al
mov dl, al
inc ecx
cmp ecx, esi
jb 0x1002b2f1
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x1002b310
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10088c2b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x488
push ebx
push esi
mov esi, edx
mov dword [ebp - 0x20], ecx
push edi
mov edi, dword [esi + 0x10]
mov dword [ebp - 0x18], edi
shr edi, 4
lea ebx, [edi + 1]
shl ebx, 4
mov dword [ebp - 0x1c], ebx
lea eax, [ebx + 1]
push eax
mov dword [ebp - 0x14], eax
call fcn.1004eea7
lea ecx, [ebx + 1]
mov dword [ebp - 0x10], eax
push ecx
push 0
push eax
call fcn.10067060
add esp, 0x10
mov edx, esi
cmp dword [esi + 0x14], 0x10
jb 0x1002b372
mov edx, dword [esi]
mov esi, edx
lea ecx, [esi + 1]
mov al, byte [esi]
inc esi
test al, al
jne 0x1002b375
sub esi, ecx
push edx
lea eax, [esi + 1]
mov esi, dword [ebp - 0x10]
push eax
push esi
call fcn.10073f40
mov eax, dword [ebp - 0x18]
mov edx, 0x10
and eax, 0xf
add esp, 0xc
sub edx, eax
test edx, edx
jle 0x1002b3c5
shl edi, 4
mov ecx, edx
add edi, eax
mov al, dl
add edi, esi
movzx eax, al
mov esi, ecx
imul eax, eax, 0x1010101
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, esi
mov esi, dword [ebp - 0x10]
and ecx, 3
rep stosb byte es:[edi], al
mov byte [ebx + esi], 0
mov ebx, dword [ebp - 0x14]
push ebx
call fcn.1004eea7
push ebx
mov edi, eax
push 0
push edi
mov dword [ebp - 0x18], edi
call fcn.10067060
mov dword [ebp - method.AES.virtual_0], vtable.AES.0
mov byte [ebp - 0x490], 0
mov dword [ebp - 0xcc], 0
mov dword [ebp - 0xc8], 0
mov dword [ebp - 0xc4], 0
mov dword [ebp - 4], 0
mov ecx, 0x100adf84
cmp dword [0x100adf98], 0x10
mov eax, 0x100adf6c
cmovae ecx, dword [0x100adf84]
cmp dword [0x100adf80], 0x10
cmovae eax, dword [0x100adf6c]
add esp, 8
push ecx
push eax
lea ecx, [ebp - 0x494]
call fcn.100148f0
mov bl, byte [ebp - 0x490]
test bl, bl
je 0x1002b4f5
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x1002b4f5
mov ecx, dword [ebp - 0xc8]
xor edx, edx
div ecx
test edx, edx
jne 0x1002b4f5
mov dword [ebp - 0x14], edx
test eax, eax
je 0x1002b4ef
nop
lea edx, [ebp - 0xa0]
test bl, bl
je 0x1002b4a2
xor eax, eax
test ecx, ecx
jle 0x1002b4a2
mov cl, byte [eax + esi]
lea edx, [edx + 1]
xor byte [edx - 1], cl
inc eax
cmp eax, dword [ebp - 0xc8]
jl 0x1002b490
push edi
lea eax, [ebp - 0xa0]
push eax
lea ecx, [ebp - 0x494]
call fcn.10014640
push dword [ebp - 0xc8]
lea eax, [ebp - 0xa0]
push edi
push eax
call fcn.10066560
mov ecx, dword [ebp - 0xc8]
xor edx, edx
mov eax, dword [ebp - 0x1c]
add esp, 0xc
div ecx
mov ebx, dword [ebp - 0x14]
add esi, ecx
inc ebx
add edi, ecx
mov dword [ebp - 0x14], ebx
cmp ebx, eax
jae 0x1002b4ef
mov bl, byte [ebp - 0x490]
jmp 0x1002b480
mov esi, dword [ebp - 0x10]
mov edi, dword [ebp - 0x18]
push dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x20]
mov edx, edi
call fcn.1001db60
push esi
call fcn.1004eeb0
push edi
call fcn.1004eeb0
mov ecx, dword [ebp - 0xc]
add esp, 0xc
mov eax, dword [ebp - 0x20]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10039cb0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x14c
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
movzx edx, byte [eax + 8]
movzx ecx, byte [eax + 4]
mov ebx, edx
mov edi, dword [0x100b12a8]
shl ebx, 0x10
add ebx, ecx
mov dword [esp + 0x24], ecx
movzx eax, bl
xor eax, 0x811c9dc5
mov dword [esp + 0x14], edx
mov edx, dword [edi + 0x1068]
imul ecx, eax, 0x26027a69
mov eax, ebx
shr eax, 0x10
mov dword [esp + 0xc], ebx
mov dword [esp + 0x10], edi
xor ecx, eax
imul eax, ecx, 0x26027a69
mov ecx, dword [edi + 0x1074]
mov edi, dword [edi + 0x1060]
and ecx, eax
mov esi, dword [edx + ecx*8]
lea edx, [edx + ecx*8]
add edx, 4
mov dword [esp + 0x18], esi
mov eax, esi
mov dword [esp + 0x1c], edx
nop dword [eax]
cmp esi, edi
jne 0x10039d38
mov ecx, edi
jmp 0x10039d3c
mov ecx, dword [edx]
mov ecx, dword [ecx]
cmp eax, ecx
je 0x10039d7a
cmp dword [eax + 8], ebx
je 0x10039d49
mov eax, dword [eax]
jmp 0x10039d30
mov ecx, eax
mov esi, eax
mov dword [esp + 0x20], ecx
mov ecx, dword [esp + 0x18]
cmp ecx, edi
jne 0x10039d5d
mov edx, edi
jmp 0x10039d61
mov edx, dword [edx]
mov edx, dword [edx]
cmp eax, edx
je 0x10039d72
cmp ebx, dword [eax + 8]
jne 0x10039d72
mov eax, dword [eax]
mov edx, dword [esp + 0x1c]
jmp 0x10039d55
mov ecx, dword [esp + 0x20]
cmp esi, eax
jne 0x10039d7e
mov ecx, edi
mov eax, edi
xor edx, edx
cmp ecx, eax
je 0x10039dae
mov ecx, dword [ecx]
inc edx
cmp ecx, eax
jne 0x10039d84
test edx, edx
je 0x10039dae
mov ecx, dword [esp + 0x10]
lea eax, [esp + 0xc]
push eax
add ecx, 0x105c
call fcn.1003efe0
mov eax, dword [eax]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
push 0x104
lea eax, [esp + 0x54]
push 0
push eax
call fcn.10067060
movaps xmm0, xmmword [0x100a1860]
add esp, 0xc
movups xmmword [esp + 0x28], xmm0
xor ecx, ecx
mov dword [esp + 0x48], 0x8ec485ff
movaps xmm0, xmmword [0x100a1850]
movups xmmword [esp + 0x38], xmm0
mov dword [esp + 0x4c], 0xd392c4
nop dword [eax]
mov al, byte [esp + 0x28]
xor byte [esp + ecx + 0x29], al
inc ecx
cmp ecx, 0x26
jl 0x10039df0
push dword [esp + 0x24]
lea eax, [esp + 0x2d]
mov byte [esp + 0x53], 0
push dword [esp + 0x18]
push eax
lea eax, [esp + 0x5c]
push eax
call fcn.10041a20
mov eax, dword [0x100b1104]
lea ecx, [esp + 0x60]
add esp, 0x10
cmp dword [0x100b11c8], 1
jne 0x10039e37
push ecx
call eax
add esp, 4
jmp 0x10039e3f
push 1
push ecx
call eax
add esp, 8
mov esi, eax
test esi, esi
je 0x10039e5b
mov ecx, dword [esp + 0x10]
lea eax, [esp + 0xc]
push eax
add ecx, 0x105c
call fcn.1003efe0
mov dword [eax], esi
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x1003efe0
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, ecx
mov dword [ebp - 8], esi
movzx eax, byte [edi]
xor eax, 0x811c9dc5
imul edx, eax, 0x1000193
movzx eax, byte [edi + 1]
xor edx, eax
movzx eax, byte [edi + 2]
imul edx, edx, 0x1000193
xor edx, eax
movzx eax, byte [edi + 3]
imul ecx, edx, 0x1000193
mov edx, dword [esi + 0xc]
xor ecx, eax
imul eax, ecx, 0x1000193
mov ecx, dword [esi + 0x18]
mov esi, dword [esi + 4]
and ecx, eax
mov ebx, dword [edx + ecx*8]
mov eax, ebx
lea edx, [edx + ecx*8]
cmp ebx, esi
jne 0x1003f03e
mov ecx, esi
jmp 0x1003f043
mov ecx, dword [edx + 4]
mov ecx, dword [ecx]
cmp eax, ecx
je 0x1003f056
mov ecx, dword [eax + 8]
cmp ecx, dword [edi]
je 0x1003f052
mov eax, dword [eax]
jmp 0x1003f036
cmp eax, esi
jne 0x1003f0a0
mov esi, dword [esi]
lea eax, [ebp + 8]
push ecx
push eax
push ecx
mov dword [ebp + 8], edi
mov edi, dword [esi + 4]
push edi
push esi
call fcn.100439e0
mov ebx, dword [ebp - 8]
mov edx, eax
mov ecx, 0xffffffe
mov eax, dword [ebx + 8]
sub ecx, eax
cmp ecx, 1
jb 0x1003f0ac
inc eax
mov ecx, ebx
mov dword [ebx + 8], eax
mov dword [esi + 4], edx
mov dword [edi], edx
mov eax, dword [ebx + 4]
mov eax, dword [eax]
push eax
add eax, 8
push eax
lea eax, [ebp - 0xc]
push eax
call fcn.100435c0
mov eax, dword [ebp - 0xc]
pop edi
pop esi
add eax, 0xc
pop ebx
mov esp, ebp
pop ebp
ret 4
push str.list_T__too_long
call fcn.1004b974
int3

Function at 0x1003f150
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, ecx
movzx eax, byte [esi]
xor eax, 0x811c9dc5
imul edx, eax, 0x1000193
movzx eax, byte [esi + 1]
xor edx, eax
movzx eax, byte [esi + 2]
imul edx, edx, 0x1000193
xor edx, eax
movzx eax, byte [esi + 3]
imul ecx, edx, 0x1000193
mov edx, dword [edi + 0xc]
xor ecx, eax
imul eax, ecx, 0x1000193
mov ecx, dword [edi + 0x18]
mov edi, dword [edi + 4]
and ecx, eax
mov ebx, dword [edx + ecx*8]
lea edx, [edx + ecx*8]
add edx, 4
mov dword [ebp + 8], ebx
mov eax, ebx
mov dword [ebp - 4], edx
nop dword [eax]
cmp ebx, edi
jne 0x1003f1b8
mov ecx, edi
jmp 0x1003f1bc
mov ecx, dword [edx]
mov ecx, dword [ecx]
cmp eax, ecx
je 0x1003f1fb
mov ebx, dword [esi]
cmp dword [eax + 8], ebx
je 0x1003f1ce
mov eax, dword [eax]
mov ebx, dword [ebp + 8]
jmp 0x1003f1b0
mov ecx, eax
mov esi, eax
mov dword [ebp - 8], ecx
mov ecx, dword [ebp + 8]
cmp ecx, edi
jne 0x1003f1e0
mov edx, edi
jmp 0x1003f1e4
mov edx, dword [edx]
mov edx, dword [edx]
cmp eax, edx
je 0x1003f1f4
cmp ebx, dword [eax + 8]
jne 0x1003f1f4
mov eax, dword [eax]
mov edx, dword [ebp - 4]
jmp 0x1003f1d8
mov ecx, dword [ebp - 8]
cmp esi, eax
jne 0x1003f1ff
mov ecx, edi
mov eax, edi
pop edi
xor edx, edx
pop esi
pop ebx
cmp ecx, eax
je 0x1003f20f
mov ecx, dword [ecx]
inc edx
cmp ecx, eax
jne 0x1003f208
mov eax, edx
mov esp, ebp
pop ebp
ret 4
Function at 0x1003f240
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, ecx
mov dword [ebp - 4], esi
movzx eax, byte [edi]
xor eax, 0x811c9dc5
imul edx, eax, 0x1000193
movzx eax, byte [edi + 1]
xor edx, eax
movzx eax, byte [edi + 2]
imul edx, edx, 0x1000193
xor edx, eax
movzx eax, byte [edi + 3]
imul ecx, edx, 0x1000193
mov edx, dword [esi + 0xc]
xor ecx, eax
imul eax, ecx, 0x1000193
mov ecx, dword [esi + 0x18]
mov esi, dword [esi + 4]
and ecx, eax
mov ebx, dword [edx + ecx*8]
mov eax, ebx
lea edx, [edx + ecx*8]
cmp ebx, esi
jne 0x1003f29e
mov ecx, esi
jmp 0x1003f2a3
mov ecx, dword [edx + 4]
mov ecx, dword [ecx]
cmp eax, ecx
je 0x1003f2b6
mov ecx, dword [eax + 8]
cmp ecx, dword [edi]
je 0x1003f2b2
mov eax, dword [eax]
jmp 0x1003f296
cmp eax, esi
jne 0x1003f300
mov esi, dword [esi]
lea eax, [ebp + 8]
push ecx
push eax
push ecx
mov dword [ebp + 8], edi
mov edi, dword [esi + 4]
push edi
push esi
call fcn.10043ac0
mov ebx, dword [ebp - 4]
mov edx, eax
mov ecx, 0x2762761
mov eax, dword [ebx + 8]
sub ecx, eax
cmp ecx, 1
jb 0x1003f30c
inc eax
mov ecx, ebx
mov dword [ebx + 8], eax
mov dword [esi + 4], edx
mov dword [edi], edx
mov eax, dword [ebx + 4]
mov eax, dword [eax]
push eax
add eax, 8
push eax
lea eax, [ebp - 8]
push eax
call fcn.100437d0
mov eax, dword [ebp - 8]
pop edi
pop esi
add eax, 0xc
pop ebx
mov esp, ebp
pop ebp
ret 4
push str.list_T__too_long
call fcn.1004b974
int3