joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1002e0b0
Capabilities:
Encode data using xor

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100ea166
mov eax, dword fs:[0]
push eax
push ebx
sub esp, 0x40
mov eax, dword [0x101040b4]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [0x10140864]
mov dword [ebp - 0x38], ecx
test al, 1
jne 0x1002e20b
or eax, 1
mov dword [0x10140864], eax
mov dword [ebp - 4], 0
mov eax, 0x10
movaps xmm0, xmmword [0x100f8660]
pxor xmm0, xmmword [0x100f84a0]
mov dword [ebp - 0x20], 0x3136003
mov dword [ebp - 0x1c], 0x12036513
mov dword [ebp - 0x18], 0x151b0312
mov byte [ebp - 0x14], 0x23
movups xmmword [ebp - 0x30], xmm0
nop dword [eax]
xor byte [ebp + eax - 0x30], 0x23
inc eax
cmp eax, 0x1d
jb 0x1002e140
lea ecx, [ebp - 0x30]
mov dword [ebp - 0x40], 0
mov dword [ebp - 0x3c], 0xf
lea edx, [ecx + 1]
mov byte [ebp - 0x50], 0
mov al, byte [ecx]
inc ecx
test al, al
jne 0x1002e163
sub ecx, edx
lea eax, [ebp - 0x30]
push ecx
push eax
lea ecx, [ebp - 0x50]
call fcn.10025140
mov byte [ebp - 4], 1
mov edx, dword [0x1013b464]
test edx, edx
je 0x1002e18c
mov edx, dword [edx + 0x50]
jmp 0x1002e18e
xor edx, edx
mov eax, dword [0x1013b45c]
test eax, eax
je 0x1002e19c
mov eax, dword [eax + 0x18]
jmp 0x1002e19e
xor eax, eax
lea ecx, [ebp - 0x50]
push ecx
push eax
lea ecx, [ebp - 0x34]
call fcn.1001ec40
mov eax, dword [ebp - 0x34]
add esp, 8
test eax, eax
je 0x1002e1c5
mov ecx, dword [eax + 1]
test ecx, ecx
jne 0x1002e1c0
xor eax, eax
jmp 0x1002e1c5
add eax, 5
add eax, ecx
mov byte [ebp - 4], 0
mov edx, dword [ebp - 0x3c]
mov dword [0x10140870], eax
cmp edx, 0x10
jb 0x1002e204
mov ecx, dword [ebp - 0x50]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x1002e1fa
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x1002e1fa
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push edx
push ecx
call fcn.100e7cba
add esp, 8
mov dword [ebp - 4], 0xffffffff
cmp dword [0x10140870], 0
je 0x1002e229
push 0
mov ecx, dword [ebp - 0x38]
movss xmm1, dword [ebx + 0xc]
movss xmm2, dword [ebx + 8]
call dword [0x10140870]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret
Function at 0x1002e240
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100ea190
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push ebx
push esi
push edi
mov eax, dword [0x101040b4]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 4], 0
mov eax, dword [0x101407cc]
mov ecx, dword [eax]
mov dword [eax], eax
mov eax, dword [0x101407cc]
mov dword [eax + 4], eax
mov dword [0x101407d0], 0
cmp ecx, dword [0x101407cc]
je 0x1002e2a9
mov esi, dword [ecx]
push 0x10
push ecx
call fcn.100e7cba
add esp, 8
mov ecx, esi
cmp esi, dword [0x101407cc]
jne 0x1002e292
push 8
mov ecx, 0x101407c8
call fcn.10025320
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [0x1013b4a4]
test ecx, ecx
je 0x1002e407
mov eax, dword [ecx]
mov eax, dword [eax + 0x20]
call eax
mov edi, eax
test edi, edi
je 0x1002e407
nop dword [eax + eax]
mov eax, dword [edi + 0x14]
mov ebx, 0x811c9dc5
mov esi, dword [edi + 8]
mov dword [ebp - 0x18], eax
xor eax, eax
inc eax
cmp byte [eax + esi], 0
jne 0x1002e2f0
xor edx, edx
test eax, eax
je 0x1002e311
nop dword [eax]
movsx ecx, byte [edx + esi]
inc edx
xor ecx, ebx
imul ebx, ecx, 0x1000193
cmp edx, eax
jb 0x1002e300
movzx eax, bl
xor eax, 0x811c9dc5
mov dword [ebp - 0x14], ebx
imul ecx, eax, 0x1000193
mov eax, ebx
shr eax, 8
movzx eax, al
xor ecx, eax
mov eax, ebx
imul ecx, ecx, 0x1000193
shr eax, 0x10
movzx eax, al
xor ecx, eax
mov eax, ebx
imul ecx, ecx, 0x1000193
shr eax, 0x18
xor ecx, eax
imul edx, ecx, 0x1000193
mov ecx, dword [0x101407d4]
and edx, dword [0x101407e0]
mov esi, dword [ecx + edx*8]
lea ecx, [ecx + edx*8]
mov edx, dword [0x101407cc]
add ecx, 4
mov eax, esi
mov dword [ebp - 0x10], ecx
nop
cmp esi, edx
jne 0x1002e378
mov ecx, edx
jmp 0x1002e37c
mov ecx, dword [ecx]
mov ecx, dword [ecx]
cmp eax, ecx
je 0x1002e390
cmp dword [eax + 8], ebx
je 0x1002e38c
mov eax, dword [eax]
mov ecx, dword [ebp - 0x10]
jmp 0x1002e370
mov ecx, eax
jmp 0x1002e394
mov eax, edx
mov ecx, edx
cmp ecx, edx
jne 0x1002e3ef
mov esi, dword [edx]
lea eax, [ebp - 0x14]
push ecx
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x10]
push eax
mov ebx, dword [esi + 4]
push ecx
push ebx
push esi
call fcn.10033a00
mov edx, dword [0x101407d0]
mov ecx, 0xffffffe
sub ecx, edx
cmp ecx, 1
jb 0x1002e419
lea ecx, [edx + 1]
mov dword [0x101407d0], ecx
mov ecx, 0x101407c8
mov dword [esi + 4], eax
mov dword [ebx], eax
mov eax, dword [0x101407cc]
mov eax, dword [eax]
push eax
add eax, 8
push eax
lea eax, [ebp - 0x20]
push eax
call fcn.100337e0
mov eax, dword [ebp - 0x20]
jmp 0x1002e3f6
mov dword [ebp - 0x20], eax
mov byte [ebp - 0x1c], 0
mov ecx, dword [ebp - 0x18]
mov dword [eax + 0xc], ecx
mov edi, dword [edi + 0x10]
test edi, edi
jne 0x1002e2e0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push str.list_T__too_long
call dword [sym.imp.MSVCP140.dll_void___cdecl_std::_Xlength_error_char_const__]
int3
Function at 0x1002f4c0
Capabilities:
Encode data using xor

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100ea3b1
mov eax, dword fs:[0]
push eax
push ebx
sub esp, 0x40
mov eax, dword [0x101040b4]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 4], 0
mov eax, dword [0x10140964]
test al, 1
jne 0x1002f604
or eax, 1
mov dword [0x10140964], eax
mov byte [ebp - 4], 1
mov eax, 0x10
movaps xmm0, xmmword [0x100f8660]
pxor xmm0, xmmword [0x100f85b0]
mov dword [ebp - 0x3c], 0x1a650361
mov dword [ebp - 0x38], 0x3656503
mov word [ebp - 0x34], 0x1612
mov byte [ebp - 0x32], 0x23
movups xmmword [ebp - 0x4c], xmm0
nop dword [eax]
xor byte [ebp + eax - 0x4c], 0x23
inc eax
cmp eax, 0x1b
jb 0x1002f550
lea ecx, [ebp - 0x4c]
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x1c], 0xf
lea edx, [ecx + 1]
mov byte [ebp - 0x30], 0
mov al, byte [ecx]
inc ecx
test al, al
jne 0x1002f573
sub ecx, edx
lea eax, [ebp - 0x4c]
push ecx
push eax
lea ecx, [ebp - 0x30]
call fcn.10025140
mov byte [ebp - 4], 2
mov edx, dword [0x1013b470]
test edx, edx
je 0x1002f59c
mov edx, dword [edx + 0x50]
jmp 0x1002f59e
xor edx, edx
mov eax, dword [0x1013b468]
test eax, eax
je 0x1002f5ac
mov eax, dword [eax + 0x18]
jmp 0x1002f5ae
xor eax, eax
lea ecx, [ebp - 0x30]
push ecx
push eax
lea ecx, [ebp - 0x18]
call fcn.1001ec40
mov eax, dword [ebp - 0x18]
add esp, 8
mov byte [ebp - 4], 1
mov edx, dword [ebp - 0x1c]
mov dword [0x10140930], eax
cmp edx, 0x10
jb 0x1002f600
mov ecx, dword [ebp - 0x30]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x1002f5f6
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x1002f5f6
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push edx
push ecx
call fcn.100e7cba
add esp, 8
mov byte [ebp - 4], 0
cmp dword [ebx + 0x1c], 0x10
lea ecx, [ebx + 8]
mov eax, dword [0x10140930]
lea edx, [ebp - 0x18]
cmovae ecx, dword [ebx + 8]
mov dword [ebp - 0x18], 0x6963756c
mov word [ebp - 0x14], 0x64
call eax
mov edx, dword [ebx + 0x1c]
cmp edx, 0x10
jb 0x1002f65c
mov ecx, dword [ebx + 8]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x1002f652
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x1002f652
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push edx
push ecx
call fcn.100e7cba
add esp, 8
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret 0x18
Function at 0x10033a30
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
push ebx
push esi
push edi
movzx edx, byte [eax + 8]
mov edi, ecx
movzx ecx, byte [eax + 9]
xor edx, 0x811c9dc5
imul edx, edx, 0x1000193
mov ebx, dword [ebp + 8]
xor edx, ecx
movzx ecx, byte [eax + 0xa]
imul edx, edx, 0x1000193
xor edx, ecx
movzx ecx, byte [eax + 0xb]
imul edx, edx, 0x1000193
xor edx, ecx
imul ecx, edx, 0x1000193
mov edx, dword [edi + 0x18]
and edx, ecx
lea esi, [edx*8]
mov edx, dword [edi + 0xc]
add edx, esi
mov ecx, dword [edx]
cmp dword [edx + 4], eax
jne 0x10033aa7
cmp ecx, eax
jne 0x10033a9f
mov ecx, dword [edi + 4]
mov dword [edx], ecx
mov edx, dword [edi + 0xc]
mov ecx, dword [edi + 4]
mov dword [esi + edx + 4], ecx
jmp 0x10033aaf
mov ecx, dword [eax + 4]
mov dword [edx + 4], ecx
jmp 0x10033aaf
cmp ecx, eax
jne 0x10033aaf
mov ecx, dword [eax]
mov dword [edx], ecx
mov ecx, dword [eax + 4]
mov esi, dword [eax]
push 0x10
push eax
mov dword [ecx], esi
mov edx, dword [eax]
mov ecx, dword [eax + 4]
mov dword [edx + 4], ecx
dec dword [edi + 8]
call fcn.100e7cba
add esp, 8
mov dword [ebx], esi
mov eax, ebx
pop edi
pop esi
pop ebx
pop ebp
ret 8
Function at 0x1003db60
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100eb490
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x101040b4]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
call fcn.1003dea0
mov ecx, dword [ebp + 0xc]
mov esi, eax
mov dword [ebp - 4], 0
mov dword [ebp - 0x14], esi
mov word [esi + 0xc], 0
push dword [ecx]
lea ecx, [esi + 0x10]
call fcn.10029280
mov byte [ebp - 4], 1
lea ecx, [esi + 0x30]
push 0
mov byte [esi + 0x28], 0
call fcn.1003a1a0
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc

Function at 0x1003f0c0
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [0x101040b4]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword fs:[0x30]
push esi
push edi
mov edi, ecx
test ebx, ebx
jne 0x1003f0f3
xor al, al
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100e7827
mov esp, ebp
pop ebp
ret
mov ebx, dword [ebx + 0xc]
add ebx, 0x14
mov esi, dword [ebx]
cmp esi, ebx
je 0x1003f160
mov ecx, 0x5a4d
lea edx, [esi - 8]
test edx, edx
je 0x1003f15a
mov eax, dword [edx + 0x18]
test eax, eax
je 0x1003f15a
cmp word [eax], cx
jne 0x1003f15a
mov ecx, dword [eax + 0x3c]
add ecx, eax
je 0x1003f155
cmp dword [ecx], 0x4550
jne 0x1003f155
mov dword [ebp - 0xc], eax
mov eax, dword [edi + 4]
mov dword [ebp - 0x10], edx
mov dword [ebp - 8], ecx
cmp dword [edi + 8], eax
je 0x1003f149
movq xmm0, qword [ebp - 0x10]
movq qword [eax], xmm0
mov dword [eax + 8], ecx
add dword [edi + 4], 0xc
jmp 0x1003f155
lea ecx, [ebp - 0x10]
push ecx
push eax
mov ecx, edi
call fcn.10044630
mov ecx, 0x5a4d
mov esi, dword [esi]
cmp esi, ebx
jne 0x1003f104
mov eax, dword [edi]
cmp eax, dword [edi + 4]
mov ecx, dword [ebp - 4]
pop edi
setne al
xor ecx, ebp
pop esi
pop ebx
call fcn.100e7827
mov esp, ebp
pop ebp
ret
Function at 0x10040080
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, dword [ebp + 8]
mov eax, edx
push edi
mov dword [ebp - 4], eax
mov ebx, ecx
cmp dword [esi + 0x14], 0x10
mov edi, dword [esi + 0x10]
jb 0x1004009c
mov esi, dword [esi]
xor ecx, ecx
mov edx, 0x811c9dc5
test edi, edi
je 0x100400bb
movzx eax, byte [ecx + esi]
inc ecx
xor eax, edx
imul edx, eax, 0x1000193
cmp ecx, edi
jb 0x100400a7
mov eax, dword [ebp - 4]
push edx
mov edx, eax
mov ecx, ebx
call fcn.1003fb50
add esp, 4
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10043960
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
movzx eax, byte [esi]
xor eax, 0x811c9dc5
imul ecx, eax, 0x1000193
movzx eax, byte [esi + 1]
xor ecx, eax
movzx eax, byte [esi + 2]
imul ecx, ecx, 0x1000193
xor ecx, eax
movzx eax, byte [esi + 3]
imul ecx, ecx, 0x1000193
xor ecx, eax
imul edx, ecx, 0x1000193
mov ecx, dword [0x101407d4]
and edx, dword [0x101407e0]
mov edi, dword [ecx + edx*8]
lea ebx, [ecx + edx*8]
mov edx, dword [0x101407cc]
mov eax, edi
cmp edi, edx
jne 0x100439c0
mov ecx, edx
jmp 0x100439c5
mov ecx, dword [ebx + 4]
mov ecx, dword [ecx]
cmp eax, ecx
je 0x100439d8
mov ecx, dword [eax + 8]
cmp ecx, dword [esi]
je 0x100439d4
mov eax, dword [eax]
jmp 0x100439b8
mov ecx, eax
jmp 0x100439dc
mov eax, edx
mov ecx, edx
cmp ecx, edx
jne 0x10043a3b
push ecx
mov dword [ebp - 4], esi
lea eax, [ebp - 4]
mov esi, dword [edx]
push eax
push ecx
mov edi, dword [esi + 4]
push edi
push esi
call fcn.10033a00
mov edx, eax
mov ecx, 0xffffffe
mov eax, dword [0x101407d0]
sub ecx, eax
cmp ecx, 1
jae 0x10043a13
push str.list_T__too_long
call dword [sym.imp.MSVCP140.dll_void___cdecl_std::_Xlength_error_char_const__]
inc eax
mov ecx, 0x101407c8
mov dword [0x101407d0], eax
mov dword [esi + 4], edx
mov dword [edi], edx
mov eax, dword [0x101407cc]
mov eax, dword [eax]
push eax
add eax, 8
push eax
lea eax, [ebp - 8]
push eax
call fcn.100337e0
mov eax, dword [ebp - 8]
pop edi
pop esi
add eax, 0xc
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x10044af0
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, dword [ebp + 0xc]
push edi
mov edi, dword [ebp + 8]
movzx eax, byte [esi]
xor eax, 0x811c9dc5
imul ecx, eax, 0x1000193
movzx eax, byte [esi + 1]
xor ecx, eax
movzx eax, byte [esi + 2]
imul ecx, ecx, 0x1000193
xor ecx, eax
movzx eax, byte [esi + 3]
imul ecx, ecx, 0x1000193
xor ecx, eax
imul edx, ecx, 0x1000193
mov ecx, dword [0x101407d4]
and edx, dword [0x101407e0]
mov ebx, dword [ecx + edx*8]
lea ecx, [ecx + edx*8]
mov edx, dword [0x101407cc]
add ecx, 4
mov eax, ebx
mov dword [ebp - 4], ecx
nop
cmp ebx, edx
jne 0x10044b58
mov ecx, edx
jmp 0x10044b5c
mov ecx, dword [ecx]
mov ecx, dword [ecx]
cmp eax, ecx
je 0x10044b72
mov ecx, dword [eax + 8]
cmp ecx, dword [esi]
je 0x10044b6e
mov eax, dword [eax]
mov ecx, dword [ebp - 4]
jmp 0x10044b50
mov ecx, eax
jmp 0x10044b76
mov eax, edx
mov ecx, edx
cmp ecx, edx
jne 0x10044bde
push ecx
mov dword [ebp - 4], esi
lea eax, [ebp - 4]
mov esi, dword [edx]
push eax
push ecx
mov ebx, dword [esi + 4]
push ebx
push esi
call fcn.10033a00
mov ecx, dword [0x101407d0]
mov edx, eax
mov eax, 0xffffffe
sub eax, ecx
cmp eax, 1
jae 0x10044bae
push str.list_T__too_long
call dword [sym.imp.MSVCP140.dll_void___cdecl_std::_Xlength_error_char_const__]
lea eax, [ecx + 1]
mov dword [0x101407d0], eax
mov dword [esi + 4], edx
mov dword [ebx], edx
mov ecx, dword [0x101407cc]
mov ecx, dword [ecx]
push ecx
add ecx, 8
push ecx
push edi
mov ecx, 0x101407c8
call fcn.100337e0
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
mov dword [edi], eax
mov eax, edi
mov byte [edi + 4], 0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x10044d90
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100ebad0
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x101040b4]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
call fcn.10045070
mov ecx, dword [ebp + 0xc]
mov esi, eax
mov dword [ebp - 4], 0
mov dword [ebp - 0x14], esi
mov word [esi + 0xc], 0
push dword [ecx]
lea ecx, [esi + 0x10]
call fcn.10029280
mov dword [esi + 0x28], 0
mov eax, esi
mov dword [esi + 0x2c], 0
mov dword [esi + 0x30], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x100460d0
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100ebbb0
mov eax, dword fs:[0]
push eax
sub esp, 0x20
mov eax, dword [0x101040b4]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edx, ecx
mov dword [ebp - 0x1c], edx
mov edi, dword [ebp + 8]
mov ebx, dword [edx + 0xc]
mov dword [ebp - 0x14], ebx
movzx eax, byte [edi]
xor eax, 0x811c9dc5
imul ecx, eax, 0x1000193
movzx eax, byte [edi + 1]
xor ecx, eax
movzx eax, byte [edi + 2]
imul ecx, ecx, 0x1000193
xor ecx, eax
movzx eax, byte [edi + 3]
imul ecx, ecx, 0x1000193
xor ecx, eax
imul eax, ecx, 0x1000193
mov ecx, dword [edx + 0x18]
and ecx, eax
add edx, 4
mov dword [ebp - 0x20], edx
mov eax, dword [ebx + ecx*8]
mov esi, eax
mov edx, dword [edx]
lea ecx, [ecx*8 + 4]
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x24], ecx
nop word [eax + eax]
cmp eax, edx
jne 0x10046168
mov eax, edx
jmp 0x1004616d
mov eax, dword [ecx + ebx]
mov eax, dword [eax]
cmp esi, eax
je 0x100461b7
mov ebx, dword [edi]
cmp dword [esi + 8], ebx
je 0x10046182
mov esi, dword [esi]
mov eax, dword [ebp - 0x18]
mov ebx, dword [ebp - 0x14]
jmp 0x10046160
mov ecx, esi
mov edi, esi
mov dword [ebp - 0x28], ecx
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x2c], edi
mov edi, dword [ebp - 0x18]
cmp edi, edx
jne 0x1004619a
mov eax, edx
jmp 0x100461a2
mov eax, dword [ebp - 0x24]
mov eax, dword [eax + ecx]
mov eax, dword [eax]
cmp esi, eax
je 0x100461af
cmp ebx, dword [esi + 8]
jne 0x100461af
mov esi, dword [esi]
jmp 0x10046192
mov edi, dword [ebp - 0x2c]
cmp dword [ebp - 0x28], esi
jne 0x100461bb
mov edi, edx
mov esi, edx
mov eax, edi
xor ebx, ebx
mov dword [ebp - 0x14], ebx
cmp eax, esi
je 0x100461d0
mov eax, dword [eax]
inc ebx
cmp eax, esi
jne 0x100461c6
mov dword [ebp - 0x14], ebx
cmp edi, dword [edx]
jne 0x10046211
cmp esi, edx
jne 0x10046211
mov dword [ebp - 4], 0
mov ecx, dword [ebp - 0x20]
call fcn.10025290
mov ecx, dword [ebp - 0x1c]
push 8
call fcn.10025320
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.100e7827
mov esp, ebp
pop ebp
ret 4
cmp edi, esi
je 0x100461f1
mov ebx, dword [ebp - 0x1c]
push edi
mov edi, dword [edi]
lea eax, [ebp - 0x20]
push eax
mov ecx, ebx
call fcn.100462f0
cmp edi, esi
jne 0x10046218
mov eax, dword [ebp - 0x14]
jmp 0x100461f3
Function at 0x10046230
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [0x101040b4]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 0xc]
mov edx, ecx
push esi
push edi
mov edi, dword [ebp + 8]
movzx eax, byte [ebx]
xor eax, 0x811c9dc5
mov esi, dword [edx + 0xc]
imul ecx, eax, 0x1000193
movzx eax, byte [ebx + 1]
xor ecx, eax
movzx eax, byte [ebx + 2]
imul ecx, ecx, 0x1000193
xor ecx, eax
movzx eax, byte [ebx + 3]
imul ecx, ecx, 0x1000193
xor ecx, eax
imul eax, ecx, 0x1000193
mov ecx, dword [edx + 0x18]
mov edx, dword [edx + 4]
and ecx, eax
mov eax, dword [esi + ecx*8]
lea ecx, [ecx*8 + 4]
add ecx, esi
mov esi, eax
mov dword [ebp - 0xc], ecx
nop dword [eax]
cmp esi, edx
jne 0x100462a8
mov ecx, edx
jmp 0x100462ac
mov ecx, dword [ecx]
mov ecx, dword [ecx]
cmp eax, ecx
je 0x100462c2
mov ecx, dword [eax + 8]
cmp ecx, dword [ebx]
je 0x100462be
mov eax, dword [eax]
mov ecx, dword [ebp - 0xc]
jmp 0x100462a0
mov dword [edi], eax
jmp 0x100462c4
mov dword [edi], edx
mov ecx, dword [ebp - 4]
mov eax, edi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.100e7827
mov esp, ebp
pop ebp
ret 8

Function at 0x100462f0
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [0x101040b4]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
mov dword [ebp - 8], eax
mov ebx, ecx
push edi
mov edi, dword [ebp + 0xc]
movzx eax, byte [edi + 8]
xor eax, 0x811c9dc5
imul edx, eax, 0x1000193
movzx eax, byte [edi + 9]
xor edx, eax
movzx eax, byte [edi + 0xa]
imul ecx, edx, 0x1000193
xor ecx, eax
movzx eax, byte [edi + 0xb]
imul ecx, ecx, 0x1000193
xor ecx, eax
imul eax, ecx, 0x1000193
mov ecx, dword [ebx + 0x18]
and ecx, eax
lea edx, [ecx*8]
mov ecx, dword [ebx + 0xc]
add ecx, edx
mov eax, dword [ecx]
cmp dword [ecx + 4], edi
jne 0x10046376
cmp eax, edi
jne 0x1004636e
mov eax, dword [ebx + 4]
mov dword [ecx], eax
mov ecx, dword [ebx + 0xc]
mov eax, dword [ebx + 4]
mov dword [edx + ecx + 4], eax
jmp 0x1004637e
mov eax, dword [edi + 4]
mov dword [ecx + 4], eax
jmp 0x1004637e
cmp eax, edi
jne 0x10046381
mov eax, dword [edi]
mov dword [ecx], eax
mov edi, dword [ebp + 0xc]
mov ecx, dword [edi + 4]
mov esi, dword [edi]
push edi
mov dword [ecx], esi
mov edx, dword [edi]
mov ecx, dword [edi + 4]
mov dword [edx + 4], ecx
dec dword [ebx + 8]
call fcn.10025530
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
mov dword [eax], esi
pop esi
pop ebx
call fcn.100e7827
mov esp, ebp
pop ebp
ret 8
Function at 0x1004ae10
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x1c
mov eax, dword [0x101040b4]
xor eax, esp
mov dword [esp + 0x18], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [ebp + 0xc]
push esi
cmp dword [eax + 0x14], 0x10
mov esi, eax
push edi
mov edi, dword [eax + 0x10]
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], ebx
jb 0x1004ae42
mov esi, dword [eax]
xor ecx, ecx
mov edx, 0x811c9dc5
test edi, edi
je 0x1004ae61
nop dword [eax]
movzx eax, byte [ecx + esi]
inc ecx
xor eax, edx
imul edx, eax, 0x1000193
cmp ecx, edi
jb 0x1004ae50
cmp dword [ebx + 4], 0
mov dword [esp + 0x1c], edx
mov dword [esp + 0xc], 0
jle 0x1004af77
xor ecx, ecx
mov dword [esp + 0x10], ecx
nop dword [eax]
mov ebx, dword [ebx]
add ebx, ecx
mov ecx, dword [ebx + 0x28]
test ecx, ecx
je 0x1004aea7
cmp dword [ecx + 4], 0
jle 0x1004aea7
mov eax, dword [ebx + 0x2c]
add eax, dword [ebp + 0x10]
push eax
push ecx
push dword [esp + 0x1c]
mov ecx, 0x101407c8
call fcn.1004ae10
mov esi, dword [ebx]
mov edi, 0x811c9dc5
xor eax, eax
inc eax
cmp byte [eax + esi], 0
jne 0x1004aeb0
xor edx, edx
test eax, eax
je 0x1004aed1
nop dword [eax]
movsx ecx, byte [edx + esi]
inc edx
xor ecx, edi
imul edi, ecx, 0x1000193
cmp edx, eax
jb 0x1004aec0
lea eax, [esp + 0x1c]
mov dword [esp + 0x20], edi
push eax
mov ecx, 0x101407e8
call fcn.100b6800
lea ecx, [esp + 0x20]
push ecx
mov ecx, eax
call fcn.100b68e0
cmp dword [eax + 8], 0
jne 0x1004af56
lea eax, [esp + 0x1c]
mov ecx, 0x101407e8
push eax
call fcn.100b6800
lea ecx, [esp + 0x20]
push ecx
mov ecx, eax
call fcn.100b68e0
mov ecx, 0x101407e8
mov byte [eax], 0
lea eax, [esp + 0x1c]
push eax
call fcn.100b6800
lea ecx, [esp + 0x20]
push ecx
mov ecx, eax
call fcn.100b68e0
mov ecx, 0x101407e8
mov dword [eax + 4], ebx
lea eax, [esp + 0x1c]
mov esi, dword [ebx + 0x2c]
add esi, dword [ebp + 0x10]
push eax
call fcn.100b6800
lea ecx, [esp + 0x20]
push ecx
mov ecx, eax
call fcn.100b68e0
mov dword [eax + 8], esi
mov eax, dword [esp + 0xc]
mov ebx, dword [esp + 0x18]
inc eax
mov ecx, dword [esp + 0x10]
add ecx, 0x3c
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], ecx
cmp eax, dword [ebx + 4]
jl 0x1004ae80
mov ecx, dword [esp + 0x24]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.100e7827
mov esp, ebp
pop ebp
ret 0xc