joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100206f0
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1fffffff
sub esp, 8
bsr ecx, eax
push ebx
push esi
push edi
mov edi, 1
mov eax, edi
shl eax, cl
mov ecx, dword [ebp + 8]
cmp ecx, eax
ja 0x10020864
lea eax, [ecx - 1]
mov esi, dword [0x101f4c44]
or eax, edi
mov dword [ebp - 4], esi
bsr ecx, eax
push esi
lea ecx, [ecx + 1]
shl edi, cl
mov ecx, 0x101f4c4c
lea eax, [edi + edi]
push eax
call fcn.10007d90
mov ecx, dword [0x101f4c44]
lea ebx, [edi - 1]
mov dword [0x101f4c58], ebx
mov dword [0x101f4c5c], edi
mov ecx, dword [ecx]
mov edx, ecx
cmp ecx, esi
je 0x1002085b
nop dword [eax + eax]
movzx eax, byte [ecx + 8]
xor eax, 0x811c9dc5
mov edx, dword [edx]
imul edi, eax, 0x1000193
movzx eax, byte [ecx + 9]
xor edi, eax
movzx eax, byte [ecx + 0xa]
imul edi, edi, 0x1000193
xor edi, eax
movzx eax, byte [ecx + 0xb]
imul edi, edi, 0x1000193
xor edi, eax
mov eax, dword [0x101f4c4c]
imul edi, edi, 0x1000193
and edi, ebx
mov ebx, dword [eax + edi*8]
mov dword [ebp + 8], ebx
lea eax, [eax + edi*8]
mov dword [ebp - 8], eax
cmp ebx, esi
jne 0x100207b3
mov dword [eax], ecx
mov dword [eax + 4], ecx
jmp 0x10020826
mov eax, dword [eax + 4]
mov ebx, dword [ecx + 8]
cmp ebx, dword [eax + 8]
jne 0x100207ed
mov eax, dword [eax]
mov dword [ebp + 8], eax
cmp eax, ecx
je 0x100207e5
mov ebx, dword [ecx + 4]
mov esi, dword [ebp + 8]
mov dword [ebx], edx
mov edi, dword [edx + 4]
mov dword [edi], eax
mov eax, dword [eax + 4]
mov dword [eax], ecx
mov dword [esi + 4], edi
mov esi, dword [ebp - 4]
mov dword [edx + 4], ebx
mov dword [ecx + 4], eax
mov eax, dword [ebp - 8]
mov dword [eax + 4], ecx
jmp 0x10020826
mov edi, eax
cmp dword [ebp + 8], eax
je 0x10020803
mov eax, dword [eax + 4]
mov edi, eax
cmp ebx, dword [eax + 8]
je 0x10020837
cmp dword [ebp + 8], eax
jne 0x100207f4
mov eax, dword [ecx + 4]
mov dword [ebp + 8], eax
mov dword [eax], edx
mov ebx, dword [edx + 4]
mov dword [ebx], edi
mov eax, dword [edi + 4]
mov dword [eax], ecx
mov dword [edi + 4], ebx
mov edi, dword [ebp + 8]
mov dword [edx + 4], edi
mov dword [ecx + 4], eax
mov eax, dword [ebp - 8]
mov dword [eax], ecx
mov ecx, edx
cmp edx, esi
je 0x1002085b
mov ebx, dword [0x101f4c58]
jmp 0x10020760
mov ebx, dword [ecx + 4]
mov eax, dword [eax]
mov dword [ebp + 8], eax
mov esi, eax
mov dword [ebx], edx
mov edi, dword [edx + 4]
mov dword [edi], eax
mov eax, dword [eax + 4]
mov dword [eax], ecx
mov dword [esi + 4], edi
mov esi, dword [ebp - 4]
mov dword [edx + 4], ebx
mov dword [ecx + 4], eax
jmp 0x10020826
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
push str.invalid_hash_bucket_count
call fcn.1007a7df
int3
Function at 0x100217b0
Capabilities:
Delete file
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x17c
mov eax, dword [0x1009400c]
xor eax, esp
mov dword [esp + 0x178], eax
mov ecx, dword [0x101da43c]
mov eax, 0x7fffffff
push ebx
sub eax, ecx
push esi
push edi
cmp eax, 5
jb 0x10021958
cmp dword [0x101da440], 0x10
mov eax, 0x101da42c
push 5
cmovae eax, dword [0x101da42c]
push str..sys
push ecx
push eax
push ecx
push dword [esp + 0x20]
lea ecx, [esp + 0x28]
call fcn.10008d20
cmp dword [esp + 0x24], 0x10
lea ecx, [esp + 0x40]
lea eax, [esp + 0x10]
cmovae eax, dword [esp + 0x10]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov edx, dword [esp + 0x24]
mov edi, eax
cmp edx, 0x10
jb 0x10021861
mov ecx, dword [esp + 0x10]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x10021857
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x10021857
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push edx
push ecx
call fcn.1004d7a1
add esp, 8
mov dword [esp + 0x20], 0
mov dword [esp + 0x24], 0xf
mov byte [esp + 0x10], 0
cmp edi, 0xffffffff
je 0x10021943
mov ebx, dword [sym.imp.KERNEL32.dll_FindNextFileA]
test byte [esp + 0x40], 0x10
jne 0x1002192c
mov edx, dword [0x101da43c]
lea eax, [esp + 0x6c]
lea esi, [eax + 1]
nop dword [eax]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x100218a0
mov ecx, 0x7fffffff
sub eax, esi
sub ecx, edx
cmp ecx, eax
jb 0x10021958
cmp dword [0x101da440], 0x10
mov ecx, 0x101da42c
push eax
cmovae ecx, dword [0x101da42c]
lea eax, [esp + 0x70]
push eax
push edx
push ecx
push ecx
push dword [esp + 0x20]
lea ecx, [esp + 0x40]
call fcn.10008d20
cmp dword [esp + 0x3c], 0x10
lea eax, [esp + 0x28]
cmovae eax, dword [esp + 0x28]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov edx, dword [esp + 0x3c]
cmp edx, 0x10
jb 0x1002192c
mov ecx, dword [esp + 0x28]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x10021922
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x10021851
push edx
push ecx
call fcn.1004d7a1
add esp, 8
lea eax, [esp + 0x40]
push eax
push edi
call ebx
test eax, eax
jne 0x10021885
push edi
call dword [sym.imp.KERNEL32.dll_FindClose]
mov ecx, dword [esp + 0x184]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.1004d763
mov esp, ebp
pop ebp
ret
call fcn.10002c90
int3
Function at 0x10021bf0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x14
cmp dword [ecx + 0x38], 0
push ebx
push esi
push edi
mov dword [esp + 0xc], ecx
je 0x10021cd6
mov esi, dword [ebp + 0x10]
mov ebx, esi
mov edx, dword [ebp + 0xc]
mov edi, edx
mov eax, dword [ebp + 8]
mov dword [esp + 0x10], eax
test esi, esi
jl 0x10021cc5
jg 0x10021c30
test edx, edx
je 0x10021cc5
nop dword [eax]
call fcn.10008e30
mov esi, eax
mov eax, edx
mov dword [esp + 0x14], eax
test eax, eax
jl 0x10021c84
jg 0x10021c47
test esi, esi
je 0x10021c84
cmp ebx, eax
jg 0x10021c57
jl 0x10021c51
cmp edi, esi
jae 0x10021c57
mov esi, edi
mov dword [esp + 0x14], ebx
mov ecx, dword [esp + 0xc]
mov eax, dword [esp + 0x10]
push esi
push eax
mov eax, dword [ecx + 0x20]
push dword [eax]
call sub.VCRUNTIME140.dll_memcpy
mov ecx, dword [esp + 0x18]
add esp, 0xc
sub edi, esi
sbb ebx, dword [esp + 0x14]
mov eax, dword [ecx + 0x30]
sub dword [eax], esi
mov eax, dword [ecx + 0x20]
add dword [eax], esi
jmp 0x10021ca9
mov ecx, dword [esp + 0xc]
mov eax, dword [esp + 0x10]
mov edx, dword [ecx]
movzx eax, byte [eax]
push eax
call dword [edx + 0xc]
cmp eax, 0xffffffff
je 0x10021cbf
mov ecx, dword [esp + 0xc]
add edi, 0xffffffff
mov esi, 1
adc ebx, 0xffffffff
add dword [esp + 0x10], esi
test ebx, ebx
jg 0x10021c30
jl 0x10021cbf
test edi, edi
jne 0x10021c30
mov edx, dword [ebp + 0xc]
mov esi, dword [ebp + 0x10]
sub edx, edi
mov eax, edx
sbb esi, ebx
mov edx, esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov eax, dword [ecx + 0x20]
mov esi, dword [ebp + 0xc]
mov edi, dword [ebp + 0x10]
mov dword [esp + 0x18], esi
mov eax, dword [eax]
mov dword [esp + 0x1c], edi
mov dword [esp + 0x10], eax
test eax, eax
je 0x10021cf8
mov eax, dword [ecx + 0x30]
mov eax, dword [eax]
jmp 0x10021cfa
xor eax, eax
cdq
mov ebx, eax
mov eax, edx
mov dword [esp + 0x14], eax
test edi, edi
jl 0x10021d79
jg 0x10021d0d
test esi, esi
je 0x10021d79
test eax, eax
jl 0x10021d5c
jg 0x10021d17
test ebx, ebx
je 0x10021d5c
cmp edi, eax
jg 0x10021d27
jl 0x10021d21
cmp esi, ebx
jae 0x10021d27
mov ebx, esi
mov dword [esp + 0x14], edi
push ebx
push dword [ebp + 8]
push dword [esp + 0x18]
call sub.VCRUNTIME140.dll_memcpy
mov ecx, dword [esp + 0x18]
add esp, 0xc
mov edx, dword [ebp + 8]
sub esi, ebx
sbb edi, dword [esp + 0x14]
add edx, ebx
mov eax, dword [ecx + 0x30]
sub dword [eax], ebx
mov eax, dword [ecx + 0x20]
add dword [eax], ebx
test edi, edi
jl 0x10021d79
jg 0x10021d5f
test esi, esi
je 0x10021d79
jmp 0x10021d5f
mov edx, dword [ebp + 8]
mov eax, dword [ecx + 0x4c]
test eax, eax
je 0x10021d79
push eax
push esi
push 1
push edx
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
add esp, 0x10
sub esi, eax
sbb edi, 0
mov eax, dword [esp + 0x18]
mov edx, dword [esp + 0x1c]
sub eax, esi
sbb edx, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x100222e0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
mov eax, dword [0x1009400c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, ecx
cmp ebx, 0xffffffff
jne 0x10022310
pop esi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1004d763
mov esp, ebp
pop ebp
ret 4
mov eax, dword [esi + 0x20]
push edi
mov ecx, dword [eax]
test ecx, ecx
je 0x1002234c
mov edx, dword [esi + 0x30]
mov edi, dword [edx]
lea eax, [edi + ecx]
cmp ecx, eax
jae 0x1002234c
lea ecx, [edi - 1]
mov dword [edx], ecx
mov edx, dword [esi + 0x20]
mov esi, dword [edx]
lea ecx, [esi + 1]
mov dword [edx], ecx
mov byte [esi], bl
pop edi
pop esi
mov eax, ebx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1004d763
mov esp, ebp
pop ebp
ret 4
cmp dword [esi + 0x4c], 0
je 0x1002240f
mov edi, dword [esi + 0xc]
lea eax, [esi + 0x3c]
cmp dword [edi], eax
jne 0x10022374
mov edx, dword [esi + 0x54]
mov ecx, dword [esi + 0x50]
sub edx, ecx
mov dword [edi], ecx
mov eax, dword [esi + 0x1c]
mov dword [eax], ecx
mov eax, dword [esi + 0x2c]
mov dword [eax], edx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x10022380
movsx eax, bl
jmp 0x100223b7
lea eax, [ebp - 0x2c]
mov byte [ebp - 0x25], bl
mov edx, dword [ecx]
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x25]
push eax
lea eax, [esi + 0x40]
push eax
call dword [edx + 0x1c]
sub eax, 0
je 0x100223e1
sub eax, 1
je 0x100223e1
sub eax, 2
jne 0x1002240f
movsx eax, byte [ebp - 0x25]
push dword [esi + 0x4c]
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
add esp, 8
or ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, ebx
pop edi
pop esi
mov eax, ecx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1004d763
mov esp, ebp
pop ebp
ret 4
mov edi, dword [ebp - 0x2c]
lea eax, [ebp - 0x24]
sub edi, eax
je 0x100223ff
push dword [esi + 0x4c]
push edi
push 1
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
add esp, 0x10
cmp edi, eax
jne 0x1002240f
lea eax, [ebp - 0x25]
mov byte [esi + 0x3d], 1
cmp dword [ebp - 0x30], eax
jne 0x10022337
mov ecx, dword [ebp - 4]
or eax, 0xffffffff
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1004d763
mov esp, ebp
pop ebp
ret 4
Function at 0x10022660
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x1009400c]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, ecx
cmp dword [esi + 0x38], 0
je 0x1002271b
cmp byte [esi + 0x3d], 0
je 0x1002271b
mov eax, dword [esi]
push edi
push 0xffffffffffffffff
call dword [eax + 0xc]
cmp eax, 0xffffffff
je 0x10022709
mov ecx, dword [esi + 0x38]
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 4]
push eax
mov edx, dword [ecx]
lea eax, [ebp - 0x24]
push eax
lea eax, [esi + 0x40]
push eax
call dword [edx + 0x20]
sub eax, 0
je 0x100226d0
sub eax, 1
je 0x100226d4
sub eax, 2
jne 0x10022709
mov byte [esi + 0x3d], al
mov al, 1
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1004d763
mov esp, ebp
pop ebp
ret
mov byte [esi + 0x3d], 0
mov edi, dword [ebp - 0x28]
lea eax, [ebp - 0x24]
sub edi, eax
je 0x100226f2
push dword [esi + 0x4c]
push edi
push 1
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
add esp, 0x10
cmp edi, eax
jne 0x10022709
cmp byte [esi + 0x3d], 0
pop edi
sete al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1004d763
mov esp, ebp
pop ebp
ret
pop edi
xor al, al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1004d763
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
mov al, 1
xor ecx, ebp
pop esi
call fcn.1004d763
mov esp, ebp
pop ebp
ret
Function at 0x10022f40
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1007d6dd
mov eax, dword fs:[0]
push eax
sub esp, 0x30
push esi
mov eax, dword [0x1009400c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [0x101db670]
add eax, 0x14baf0
push 0x104
mov dword [0x101db674], eax
call fcn.1004dd05
add esp, 4
mov esi, eax
push esi
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
mov ecx, esi
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x10022f95
sub ecx, edx
push ecx
push esi
mov ecx, 0x101da42c
call fcn.10004a90
call fcn.1000dce0
push 0xb
mov dword [ebp - 0x24], 0
lea ecx, [ebp - 0x24]
push str._rcdeltapos
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x10], 0xf
mov byte [ebp - 0x24], 0
call fcn.10004a90
lea eax, [ebp - 0x24]
mov dword [ebp - 4], 0
push eax
call fcn.1002f620
mov dword [ebp - 4], 0xffffffff
mov dword [eax], 0x10022ca0
mov edx, dword [ebp - 0x10]
cmp edx, 0x10
jb 0x1002302a
mov ecx, dword [ebp - 0x24]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x10023020
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x10023020
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push edx
push ecx
call fcn.1004d7a1
add esp, 8
push 0xb
mov dword [ebp - 0x24], 0
lea ecx, [ebp - 0x24]
push str._rcdeltaori
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x10], 0xf
mov byte [ebp - 0x24], 0
call fcn.10004a90
lea eax, [ebp - 0x24]
mov dword [ebp - 4], 1
push eax
call fcn.1002f620
mov dword [ebp - 4], 0xffffffff
mov dword [eax], 0x10022d70
mov edx, dword [ebp - 0x10]
cmp edx, 0x10
jb 0x100230a5
mov ecx, dword [ebp - 0x24]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x1002309b
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x1002309b
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push edx
push ecx
call fcn.1004d7a1
add esp, 8
push 0xc
mov dword [ebp - 0x3c], 0
lea ecx, [ebp - 0x3c]
push str._autoturrets
mov dword [ebp - 0x2c], 0
mov dword [ebp - 0x28], 0xf
mov byte [ebp - 0x3c], 0
call fcn.10004a90
lea eax, [ebp - 0x3c]
mov dword [ebp - 4], 2
push eax
call fcn.1002f620
mov dword [eax], 0x10022e40
mov edx, dword [ebp - 0x28]
cmp edx, 0x10
jb 0x10023119
mov ecx, dword [ebp - 0x3c]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x1002310f
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x1002310f
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push edx
push ecx
call fcn.1004d7a1
add esp, 8
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x10025c20
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
mov ebx, dword [ebp + 8]
movzx eax, byte [ebx + 0xb0]
push esi
push edi
lea edi, [ebx + 0xb0]
mov esi, dword [0x101f4498]
xor eax, 0x811c9dc5
mov dword [ebp - 4], esi
imul ecx, eax, 0x1000193
movzx eax, byte [edi + 1]
xor ecx, eax
movzx eax, byte [edi + 2]
imul ecx, ecx, 0x1000193
xor ecx, eax
movzx eax, byte [edi + 3]
imul ecx, ecx, 0x1000193
xor ecx, eax
imul eax, ecx, 0x1000193
mov ecx, 0x101f4494
push eax
push edi
lea eax, [ebp - 0x10]
push eax
call fcn.10020aa0
lea ecx, [ebp - 8]
mov eax, dword [eax + 4]
test eax, eax
cmovne esi, eax
lea eax, [ebp - 4]
push eax
mov dword [ebp - 8], esi
call fcn.100261c0
test al, al
je 0x10025cde
push edi
call fcn.1001c520
mov eax, dword [eax]
push eax
mov dword [ebp + 8], eax
call dword [sym.imp.Common.dll_void___cdecl_AnimDB::Rem_int_]
add esp, 4
mov eax, dword [sym.imp.DALib.dll_struct_IAnimation2__DALib::Anim]
mov eax, dword [eax]
mov edx, dword [eax]
mov ecx, dword [ebp + 8]
push ecx
push eax
call dword [edx + 0x38]
mov eax, dword [sym.imp.DALib.dll_struct_IAnimation2__DALib::Anim]
mov eax, dword [eax]
mov ecx, dword [eax]
mov edx, dword [ebp + 8]
push edx
push eax
call dword [ecx + 0x28]
mov ecx, 0x101f4494
push edi
call fcn.10026390
mov ecx, dword [0x101db514]
test ecx, ecx
je 0x10025d03
mov eax, dword [ecx]
call dword [eax + 0x150]
mov edx, dword [0x101db514]
xor esi, esi
cmp ebx, eax
cmove edx, esi
mov dword [0x101db514], edx
mov ecx, ebx
call dword [sym.imp.Common.dll_public:_unsigned_int_const____thiscall_CSimple::get_id_void_const]
push eax
mov ecx, 0x101f4474
call fcn.10026280
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x10025e20
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
push ecx
cmp byte [0x101db647], 0
je 0x10025f48
push ebx
push esi
push edi
push 0x303
call dword [sym.imp.Common.dll_public:_static_struct_CObject____cdecl_CObject::FindFirst_enum_CObject::Class_]
mov ebx, dword [ebp + 0xc]
add esp, 4
test eax, eax
je 0x10025e64
mov esi, dword [sym.imp.Common.dll_public:_static_struct_CObject____cdecl_CObject::FindNext_void_]
nop
mov eax, dword [eax + 0xb0]
cmp eax, dword [ebx]
je 0x10025ef1
call esi
test eax, eax
jne 0x10025e50
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov word [ebp + 0xc], 0x840f
lea edi, [eax + 0x148b57]
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
push 0
push 0x38
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
lea eax, [ebp - 4]
push eax
push 0x40
push 2
push edi
push esi
call dword [sym.imp.KERNEL32.dll_VirtualProtectEx]
push 0
push 2
lea eax, [ebp + 0xc]
push eax
push edi
push esi
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
movss xmm0, dword [ebx + 0x10]
subss xmm0, dword [0x101db69c]
pop edi
pop esi
movss dword [ebx + 0x10], xmm0
movss xmm0, dword [ebx + 0x14]
subss xmm0, dword [0x101db6a0]
movss dword [ebx + 0x14], xmm0
movss xmm0, dword [ebx + 0x18]
subss xmm0, dword [0x101db6a4]
movss dword [ebx + 0x18], xmm0
pop ebx
mov esp, ebp
pop ebp
ret 8
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov word [ebp + 0xc], 0xe990
lea edi, [eax + 0x148b57]
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
push 0
push 0x38
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
lea eax, [ebp - 4]
push eax
push 0x40
push 2
push edi
push esi
call dword [sym.imp.KERNEL32.dll_VirtualProtectEx]
push 0
push 2
lea eax, [ebp + 0xc]
push eax
push edi
push esi
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
mov dword [0x101db6a4], 0
mov dword [0x101db6a0], 0
mov dword [0x101db69c], 0
mov esp, ebp
pop ebp
ret 8
Function at 0x10029c10
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push edi
mov edi, edx
mov edx, ecx
mov dword [ebp - 4], edx
cmp edx, 0xf4240
jb 0x10029c93
push esi
movzx eax, dl
xor eax, 0x811c9dc5
imul esi, eax, 0x1000193
mov eax, edx
shr eax, 8
movzx eax, al
xor esi, eax
mov eax, edx
shr eax, 0x10
movzx eax, al
imul ecx, esi, 0x1000193
shr edx, 0x18
xor ecx, eax
imul eax, ecx, 0x1000193
xor eax, edx
imul eax, eax, 0x1000193
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0xc]
push eax
call fcn.1002b3c0
pop esi
mov eax, dword [eax + 4]
test eax, eax
je 0x10029c93
cmp eax, dword [0x101f4c68]
je 0x10029c93
cmp dword [eax + 0x20], 8
lea ecx, [eax + 0xc]
jb 0x10029c89
mov ecx, dword [ecx]
mov eax, dword [eax + 0x1c]
mov dword [edi], ecx
pop edi
mov esp, ebp
pop ebp
ret
or eax, 0xffffffff
pop edi
mov esp, ebp
pop ebp
ret
Function at 0x1002a950
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1007dc25
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push ebx
push esi
push edi
mov eax, dword [0x1009400c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, dword [ebp + 0xc]
mov edi, ebx
cmp dword [ebx + 0x14], 8
jb 0x1002a985
mov edi, dword [ebx]
mov edx, dword [ebx + 0x10]
mov esi, 0x811c9dc5
mov ecx, 0
add edx, edx
je 0x1002a9a7
movzx eax, byte [ecx + edi]
inc ecx
xor eax, esi
imul esi, eax, 0x1000193
cmp ecx, edx
jb 0x1002a996
push esi
push ebx
lea eax, [ebp - 0x14]
mov ecx, 0x101f44dc
push eax
call fcn.1002b310
mov ecx, dword [ebp - 0x10]
test ecx, ecx
je 0x1002a9db
mov eax, dword [ebp + 8]
mov dword [eax], ecx
mov byte [eax + 4], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
cmp dword [0x101f44e4], 0x71c71c7
je 0x1002ab40
mov dword [ebp - 0x1c], 0x101f44e0
mov dword [ebp - 4], 0
push 0x24
mov dword [ebp - 0x18], 0
call fcn.1004d771
mov edi, eax
add esp, 4
mov dword [ebp - 0x18], edi
lea ecx, [edi + 8]
push ebx
call fcn.1002b430
mov dword [edi + 0x20], 0
mov dword [ebp - 4], 1
mov ecx, dword [0x101f44e4]
mov ebx, dword [0x101f44f8]
lea eax, [ecx + 1]
movd xmm0, eax
cvtdq2pd xmm0, xmm0
shr eax, 0x1f
addsd xmm0, qword [eax*8 + 0x1008bb80]
mov eax, ebx
shr eax, 0x1f
cvtpd2ps xmm2, xmm0
movd xmm0, ebx
cvtdq2pd xmm0, xmm0
movaps xmm1, xmm2
addsd xmm0, qword [eax*8 + 0x1008bb80]
cvtpd2ps xmm0, xmm0
divss xmm1, xmm0
movss xmm0, dword [0x101f44dc]
comiss xmm1, xmm0
jbe 0x1002aadc
divss xmm2, xmm0
push ecx
movss dword [esp], xmm2
call fcn.10004f40
add esp, 4
fstp dword [ebp + 0xc]
movss xmm0, dword [ebp + 0xc]
call fcn.1007b560
mov ecx, 8
cmp eax, ecx
cmova ecx, eax
cmp ebx, ecx
jae 0x1002aab9
cmp ebx, 0x200
jae 0x1002aab7
shl ebx, 3
cmp ebx, ecx
jae 0x1002aab9
mov ebx, ecx
push ebx
call fcn.1002af60
push esi
lea eax, [edi + 8]
mov ecx, 0x101f44dc
push eax
lea eax, [ebp - 0x1c]
push eax
call fcn.1002b310
mov ecx, dword [0x101f44e4]
mov edx, dword [eax]
jmp 0x1002aadf
mov edx, dword [ebp - 0x14]
mov ebx, dword [edx + 4]
inc ecx
mov dword [0x101f44e4], ecx
mov dword [edi], edx
mov dword [edi + 4], ebx
mov dword [ebx], edi
mov dword [edx + 4], edi
mov eax, dword [0x101f44f4]
mov ecx, dword [0x101f44e8]
and eax, esi
mov esi, dword [ecx + eax*8]
cmp esi, dword [0x101f44e0]
jne 0x1002ab10
mov dword [ecx + eax*8], edi
jmp 0x1002ab1f
cmp esi, edx
jne 0x1002ab19
mov dword [ecx + eax*8], edi
jmp 0x1002ab23
cmp dword [ecx + eax*8 + 4], ebx
jne 0x1002ab23
mov dword [ecx + eax*8 + 4], edi
mov eax, dword [ebp + 8]
mov dword [eax], edi
mov byte [eax + 4], 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
push str.unordered_map_set_too_long
call fcn.1007a7df
int3