joyce8/EMBER2024-capa huggingface dataset:
Function at 0x402e86
Capabilities:
Write file on windows

Disassembly:
sub esp, 0x28
push ebx
mov ebx, dword [esp + 0x30]
push esi
push edi
or edi, 0xffffffff
mov esi, ecx
cmp ebx, edi
jne 0x402ea0
xor eax, eax
jmp 0x402f70
mov eax, dword [esi + 0x20]
push ebp
mov ecx, dword [eax]
test ecx, ecx
je 0x402ece
mov edx, dword [esi + 0x30]
mov ebp, dword [edx]
lea eax, [ecx + ebp]
cmp ecx, eax
jae 0x402ece
lea ecx, [ebp - 1]
mov eax, ebx
mov dword [edx], ecx
mov edx, dword [esi + 0x20]
mov esi, dword [edx]
lea ecx, [esi + 1]
mov dword [edx], ecx
mov byte [esi], bl
jmp 0x402f6f
cmp dword [esi + 0x4c], 0
je 0x402f6d
mov ecx, esi
call fcn.004027f1
mov ecx, dword [esi + 0x38]
mov al, bl
test ecx, ecx
jne 0x402efa
push dword [esi + 0x4c]
push eax
call fcn.00401309
test al, al
pop ecx
pop ecx
cmovne edi, ebx
jmp 0x402f6d
mov byte [esp + 0x10], al
lea eax, [esp + 0x3c]
mov edx, dword [ecx]
push eax
lea eax, [esp + 0x3c]
push eax
lea eax, [esp + 0x20]
push eax
lea eax, [esp + 0x20]
push eax
lea eax, [esp + 0x21]
push eax
lea eax, [esp + 0x24]
push eax
lea eax, [esi + 0x40]
push eax
call dword [edx + 0x1c]
sub eax, 0
je 0x402f3e
sub eax, 1
je 0x402f3e
dec eax
sub eax, 1
jne 0x402f6d
push dword [esi + 0x4c]
push dword [esp + 0x14]
jmp 0x402eec
mov ebp, dword [esp + 0x3c]
lea eax, [esp + 0x18]
sub ebp, eax
je 0x402f5d
push dword [esi + 0x4c]
push ebp
push 1
push eax
call fcn.00409fe2
add esp, 0x10
cmp ebp, eax
jne 0x402f6d
lea eax, [esp + 0x10]
mov byte [esi + 0x3d], 1
cmp dword [esp + 0x14], eax
mov eax, ebx
jne 0x402f6f
mov eax, edi
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x28
ret 4

Function at 0x40368f
Capabilities:
Read file on windows

Disassembly:
push ebp
push esi
mov esi, dword [esp + 0x14]
mov ebp, ecx
push edi
mov edi, dword [esp + 0x14]
test esi, esi
jg 0x4036af
jl 0x4036a6
test edi, edi
jne 0x4036af
xor eax, eax
xor edx, edx
jmp 0x403776
cmp dword [ebp + 0x38], 0
je 0x4036c5
push esi
push edi
push dword [esp + 0x18]
call fcn.00403780
jmp 0x403776
mov eax, dword [ebp + 0x1c]
push ebx
mov ebx, edi
mov ecx, dword [eax]
test ecx, ecx
je 0x403709
mov eax, dword [ebp + 0x2c]
cmp dword [eax], 0
jbe 0x403709
cmp dword [eax], edi
mov esi, edi
mov ebx, dword [esp + 0x14]
cmovb esi, dword [eax]
push esi
push ecx
push ebx
call fcn.00407000
mov eax, dword [ebp + 0x2c]
add ebx, esi
mov dword [esp + 0x20], ebx
add esp, 0xc
mov ebx, edi
sub ebx, esi
sub dword [eax], esi
mov eax, dword [ebp + 0x1c]
add dword [eax], esi
mov esi, dword [esp + 0x1c]
jmp 0x403711
mov eax, dword [esp + 0x14]
mov dword [esp + 0x14], eax
cmp dword [ebp + 0x4c], 0
mov ecx, ebx
je 0x40376c
mov ecx, ebp
call fcn.004027f1
mov edx, dword [esp + 0x14]
mov ecx, ebx
jmp 0x40374c
push dword [ebp + 0x4c]
push eax
push 1
push edx
call fcn.0040995b
mov edx, dword [esp + 0x24]
sub ebx, eax
add edx, eax
add esp, 0x10
mov dword [esp + 0x14], edx
mov ecx, ebx
cmp eax, 0xfff
jne 0x40377c
mov eax, 0xfff
cmp ebx, eax
ja 0x403728
test ecx, ecx
je 0x40376c
push dword [ebp + 0x4c]
push ebx
push 1
push edx
call fcn.0040995b
mov ecx, ebx
add esp, 0x10
sub ecx, eax
sub edi, ecx
sbb esi, 0
mov eax, edi
mov edx, esi
pop ebx
pop edi
pop esi
pop ebp
ret 0xc
sub edi, ebx
jmp 0x40376e
Function at 0x403854
Capabilities:
Write file on windows

Disassembly:
push ecx
push ecx
push ebx
mov ebx, ecx
cmp dword [ebx + 0x38], 0
je 0x403875
push dword [esp + 0x18]
push dword [esp + 0x18]
push dword [esp + 0x18]
call fcn.0040392a
jmp 0x403924
mov eax, dword [ebx + 0x20]
push ebp
push esi
mov esi, dword [esp + 0x1c]
mov ecx, dword [eax]
mov dword [esp + 0xc], esi
push edi
mov edi, dword [esp + 0x24]
mov dword [esp + 0x14], edi
test ecx, ecx
je 0x403898
mov eax, dword [ebx + 0x30]
mov eax, dword [eax]
jmp 0x40389a
xor eax, eax
cdq
mov ebp, eax
mov eax, edx
mov dword [esp + 0x20], eax
test edi, edi
jl 0x403915
jg 0x4038ad
test esi, esi
je 0x403915
test eax, eax
jl 0x4038f7
jg 0x4038b7
test ebp, ebp
je 0x4038f7
cmp edi, eax
jg 0x4038c7
jl 0x4038c1
cmp esi, ebp
jae 0x4038c7
mov ebp, esi
mov dword [esp + 0x20], edi
push ebp
push dword [esp + 0x20]
push ecx
call fcn.00407000
mov eax, dword [ebx + 0x30]
add esp, 0xc
sub esi, ebp
sbb edi, dword [esp + 0x20]
sub dword [eax], ebp
mov eax, dword [ebx + 0x20]
add dword [eax], ebp
mov eax, dword [esp + 0x1c]
add eax, ebp
test edi, edi
jl 0x403915
jg 0x4038fb
test esi, esi
je 0x403915
jmp 0x4038fb
mov eax, dword [esp + 0x1c]
cmp dword [ebx + 0x4c], 0
je 0x403915
push dword [ebx + 0x4c]
push esi
push 1
push eax
call fcn.00409fe2
add esp, 0x10
sub esi, eax
sbb edi, 0
mov eax, dword [esp + 0x10]
mov edx, dword [esp + 0x14]
sub eax, esi
sbb edx, edi
pop edi
pop esi
pop ebp
pop ebx
pop ecx
pop ecx
ret 0xc
Function at 0x410dde
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.00410c54

Function at 0x430002
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
mov eax, section..text
nop
nop
mov ebx, 0x408ecc
mov ecx, 0x3f4b3849
nop
nop
nop
nop
nop
test eax, eax
nop
nop
je 0x43004e
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
inc eax
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
jne 0x430024
nop
nop
nop
mov eax, section..data
mov ebx, 0x42e1d0
nop
mov ecx, 0x26916775
nop
nop
nop
nop
test eax, eax
nop
je 0x430084
nop
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
add eax, 4
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
jne 0x43006c
nop
nop
nop
nop
nop
popal
nop
nop
nop
nop
jmp 0x401219
Function at 0x100180c0
Capabilities:
Access peb ldr_data
Check for peb beingdebugged flag

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100e3424
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x10112040]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
push 0x10
call fcn.100e1c3f
push 8
mov byte [eax], 1
mov dword [eax + 4], 0
mov dword [eax + 8], 0x45
mov byte [eax + 0xc], 1
mov dword [edi], eax
call fcn.100e1c3f
push 0x48
mov dword [eax], 1
mov dword [eax + 4], 0x1000101
mov dword [edi + 4], eax
call fcn.100e1c3f
push 0x30
mov dword [eax], 1
mov dword [eax + 4], 1
mov dword [eax + 8], 1
mov dword [eax + 0xc], 1
mov dword [eax + 0x10], 1
mov dword [eax + 0x14], 1
mov dword [eax + 0x18], 1
mov dword [eax + 0x1c], 1
mov dword [eax + 0x20], 1
mov dword [eax + 0x24], 1
mov dword [eax + 0x28], 1
mov dword [eax + 0x2c], 1
mov dword [eax + 0x30], 5
mov dword [eax + 0x34], 4
mov dword [eax + 0x38], 2
mov dword [eax + 0x3c], 2
mov dword [eax + 0x40], 1
mov dword [eax + 0x44], 1
mov dword [edi + 8], eax
call fcn.100e1c3f
mov esi, eax
mov dword [ebp - 0x10], esi
mov dword [ebp - 4], 0
push 0x10
mov dword [esi], 0x1010000
mov dword [esi + 4], 0
mov word [esi + 8], 1
mov byte [esi + 0xa], 0
mov dword [esi + 0xc], 0xb4
mov dword [esi + 0x10], 0
mov byte [esi + 0x14], 0
mov dword [esi + 0x18], 0xa
mov dword [esi + 0x1c], 0x48
mov dword [esi + 0x20], 0x2a
mov dword [esi + 0x24], 0x1010101
mov byte [esi + 0x28], 1
call fcn.100e1c3f
vmovss xmm0, dword [0x10100c94]
push 3
vmovss dword [eax + 4], xmm0
vmovss xmm0, dword [0x10100bd0]
vmovss dword [eax + 8], xmm0
vmovss xmm0, dword [0x10100d5c]
mov byte [eax], 0
vmovss dword [eax + 0xc], xmm0
mov dword [esi + 0x2c], eax
mov dword [ebp - 4], 0xffffffff
mov dword [edi + 0xc], esi
call fcn.100e1c3f
push 0x30
mov word [eax], 1
mov byte [eax + 2], 1
mov dword [edi + 0x10], eax
call fcn.100e1c3f
vmovss xmm0, dword [0x10100cb4]
add esp, 0x1c
vmovss dword [eax], xmm0
vmovss xmm0, dword [0x10100ca4]
vmovss dword [eax + 4], xmm0
vmovss xmm0, dword [0x10100c64]
mov dword [eax + 8], 0x1010001
vmovss dword [eax + 0xc], xmm0
mov dword [eax + 0x10], 0x19
mov dword [eax + 0x14], 0
mov dword [eax + 0x18], 0
mov dword [eax + 0x1c], 0
mov dword [eax + 0x20], 0
mov byte [eax + 0x24], 0
mov dword [eax + 0x28], 0x78
mov dword [eax + 0x2c], 0x14
mov dword [edi + 0x14], eax
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x100182e0
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100e3463
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x10112040]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
vmovss xmm1, dword [0x10100bd0]
vxorps xmm0, xmm0, xmm0
vmovss dword [esi + 0x28], xmm0
vmovss xmm0, dword [0x10100bf8]
vmovss dword [esi + 0x2c], xmm0
vmovss xmm0, dword [0x10100c74]
vmovss dword [esi + 0x38], xmm0
vmovss dword [esi + 0x44], xmm0
vmovss xmm0, dword [0x10100ba0]
vmovss dword [esi + 0x4c], xmm0
vmovss xmm0, dword [0x10100b6c]
vmovss dword [esi + 0x54], xmm0
vmovss xmm0, dword [0x10100b9c]
vmovss dword [esi + 0x8c], xmm0
vmovss xmm0, dword [0x10100be4]
vmovss dword [esi + 0x98], xmm0
lea ecx, [esi + 0xb0]
mov dword [esi], 0x78
mov dword [esi + 4], 0x78
mov dword [esi + 8], 0x1010101
mov byte [esi + 0xc], 1
mov dword [esi + 0x10], 0
mov byte [esi + 0x14], 0
mov dword [esi + 0x18], 0
mov dword [esi + 0x1c], 0
mov dword [esi + 0x20], 0
mov dword [esi + 0x24], 0
mov word [esi + 0x30], 0
mov byte [esi + 0x32], 0
vmovss dword [esi + 0x34], xmm1
mov word [esi + 0x3c], 0
vmovss dword [esi + 0x40], xmm1
mov word [esi + 0x48], 0
mov word [esi + 0x50], pe_nt_image_headers32
mov byte [esi + 0x52], 0
mov word [esi + 0x58], 0
mov dword [esi + 0x5c], 0x5a
mov dword [esi + 0x60], 0
mov dword [esi + 0x64], 0
mov dword [esi + 0x68], 0
mov dword [esi + 0x6c], 0
mov byte [esi + 0x70], 0
mov dword [esi + 0x74], 0
vmovss dword [esi + 0x78], xmm1
mov word [esi + 0x7c], 0
mov byte [esi + 0x7e], 0
mov dword [esi + 0x80], 0
vmovss dword [esi + 0x84], xmm1
mov word [esi + 0x88], pe_nt_image_headers32
mov dword [esi + 0x90], 0
mov byte [esi + 0x94], 0
mov byte [esi + 0x9c], 0
mov dword [esi + 0xa0], 0x50
mov dword [esi + 0xa4], 0x12c
mov dword [esi + 0xa8], 0x12c
mov dword [esi + 0xac], 0
vpxor xmm0, xmm0, xmm0
push 0
vmovdqu xmmword [ecx], xmm0
push 0x100f6ab3
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 0
call fcn.100193f0
mov dword [ebp - 4], 0
push 1
mov dword [esi + 0xc8], 0
mov word [esi + 0xcc], 0
mov dword [esi + 0xd0], 0x96
mov dword [esi + 0xd4], 8
mov dword [esi + 0xd8], 0
mov byte [esi + 0xdc], 0
mov dword [esi + 0xe0], 1
mov word [esi + 0xe4], 0
mov byte [esi + 0xe6], 0
call fcn.100e1c3f
push 0x14
mov byte [eax], 1
mov dword [esi + 0xe8], eax
call fcn.100e1c3f
mov byte [eax], 0
vmovss xmm0, dword [0x10100ba0]
vmovss dword [eax + 0xc], xmm0
vmovss xmm0, dword [0x10100bf8]
mov dword [eax + 4], 0
mov word [eax + 8], 0x101
vmovss dword [eax + 0x10], xmm0
push 0xc
mov dword [esi + 0xec], eax
call fcn.100e1c3f
add esp, 0xc
mov byte [eax], 1
mov dword [eax + 4], 0
mov dword [eax + 8], 0x1010101
mov dword [esi + 0xf0], eax
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x10018580
Capabilities:
Access peb ldr_data
Check for peb beingdebugged flag

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100e34b2
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x10112040]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
push 0x14
mov word [edi], 0x101
mov byte [edi + 2], 1
mov dword [edi + 4], 0
mov word [edi + 8], 0x101
mov byte [edi + 0xa], 1
mov dword [edi + 0xc], 0
mov byte [edi + 0x10], 0
mov dword [edi + 0x14], 0
mov word [edi + 0x18], 0x101
mov byte [edi + 0x1a], 1
mov dword [edi + 0x1c], 0
mov byte [edi + 0x20], 1
call fcn.100e1c3f
vmovss xmm0, dword [0x10100ba0]
push 8
mov dword [eax], 0
vmovss dword [eax + 4], xmm0
mov dword [eax + 8], 0x15
mov dword [eax + 0xc], 0
mov dword [eax + 0x10], 0x1010101
mov dword [edi + 0x24], eax
call fcn.100e1c3f
push 0x5c
mov byte [eax], 1
mov dword [eax + 4], 0
mov dword [edi + 0x28], eax
call fcn.100e1c3f
vmovss xmm0, dword [0x10100ba0]
push 0x2c
mov dword [eax], 0
vmovss dword [eax + 4], xmm0
mov byte [eax + 8], 0
mov dword [eax + 0xc], 0
mov dword [eax + 0x10], 0
mov dword [eax + 0x14], 0
mov dword [eax + 0x18], 0
mov dword [eax + 0x1c], 0
mov dword [eax + 0x20], 3
mov dword [eax + 0x24], 0xa
mov dword [eax + 0x28], 3
mov dword [eax + 0x2c], 0x4a
mov dword [eax + 0x30], 0x68
mov dword [eax + 0x34], 0
mov dword [eax + 0x38], 0
mov dword [eax + 0x3c], 3
mov dword [eax + 0x40], 0xa
mov dword [eax + 0x44], 3
mov dword [eax + 0x48], 0x4a
mov dword [eax + 0x4c], 0x68
mov dword [eax + 0x50], 0
mov byte [eax + 0x54], 0
mov dword [eax + 0x58], 0
mov dword [edi + 0x2c], eax
call fcn.100e1c3f
mov esi, eax
mov dword [ebp - 0x10], esi
mov dword [ebp - 4], 0
push 3
mov byte [esi], 1
mov dword [esi + 4], 0
mov dword [esi + 8], 0
mov dword [esi + 0xc], 0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 2
mov dword [esi + 0x18], 0
mov dword [esi + 0x1c], 2
mov dword [esi + 0x20], 0x10001
mov byte [esi + 0x24], 0
call fcn.100e1c3f
mov dword [ebp - 4], 0xffffffff
push 0x1c
mov word [eax], 0x101
mov byte [eax + 2], 0
mov dword [esi + 0x28], eax
mov dword [edi + 0x30], esi
call fcn.100e1c3f
mov esi, eax
mov dword [ebp - 0x10], esi
mov dword [ebp - 4], 1
push 2
mov byte [esi], 1
mov dword [esi + 4], 0
mov byte [esi + 8], 0
mov dword [esi + 0xc], 0
mov dword [esi + 0x10], 0x1000101
mov byte [esi + 0x14], 0
call fcn.100e1c3f
mov dword [ebp - 4], 0xffffffff
push 2
mov word [eax], 0x101
mov dword [esi + 0x18], eax
mov dword [edi + 0x34], esi
call fcn.100e1c3f
push 8
mov word [eax], 0x101
mov dword [edi + 0x38], eax
call fcn.100e1c3f
mov esi, eax
mov dword [ebp - 0x10], esi
mov dword [ebp - 4], 2
push 0x10
mov word [esi], 0
call fcn.100e1c3f
add esp, 0x28
mov dword [eax], 0
mov dword [eax + 4], 0
mov dword [eax + 8], 0
mov dword [eax + 0xc], 0
mov dword [esi + 4], eax
mov eax, edi
mov dword [edi + 0x3c], esi
mov dword [edi + 0x40], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x10026160
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
sub esp, 0x18
mov edx, dword [ebp + 8]
push ebx
mov ebx, ecx
cmp edx, eax
je 0x100262b6
mov eax, dword [ebx + 4]
mov dword [ebp - 0x14], eax
mov eax, dword [edx + 4]
mov dword [ebp - 8], eax
movzx eax, byte [edx + 8]
xor eax, 0x811c9dc5
imul ecx, eax, 0x1000193
movzx eax, byte [edx + 9]
push esi
push edi
mov edi, dword [ebx + 0xc]
mov esi, edx
xor ecx, eax
mov dword [ebp - 0x18], edi
movzx eax, byte [edx + 0xa]
imul ecx, ecx, 0x1000193
xor ecx, eax
movzx eax, byte [edx + 0xb]
imul ecx, ecx, 0x1000193
xor ecx, eax
mov eax, dword [ebx + 0x18]
imul ecx, ecx, 0x1000193
and eax, ecx
mov ecx, dword [edi + eax*8]
mov dword [ebp - 4], ecx
lea eax, [edi + eax*8]
mov dword [ebp - 0xc], eax
mov eax, dword [eax + 4]
mov dword [ebp - 0x10], eax
mov eax, esi
mov edi, esi
mov esi, dword [esi]
push 0x10
push eax
call fcn.100e20a3
dec dword [ebx + 8]
add esp, 8
cmp edi, dword [ebp - 0x10]
je 0x10026219
mov eax, dword [ebp + 0xc]
cmp esi, eax
jne 0x100261d7
mov ecx, dword [ebp - 4]
cmp ecx, dword [ebp + 8]
jne 0x100262ac
mov edx, dword [ebp - 0xc]
mov ecx, dword [ebp - 8]
pop edi
mov dword [edx], esi
mov dword [ecx], esi
mov dword [esi + 4], ecx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
mov ecx, dword [ebp - 4]
mov edx, dword [ebp - 0xc]
cmp ecx, dword [ebp + 8]
jne 0x1002622d
mov eax, dword [ebp - 0x14]
mov ecx, eax
mov dword [edx], eax
jmp 0x10026230
mov ecx, dword [ebp - 8]
mov eax, dword [ebp + 0xc]
mov dword [edx + 4], ecx
cmp esi, eax
je 0x100262ac
nop word [eax + eax]
movzx eax, byte [esi + 8]
xor eax, 0x811c9dc5
imul ecx, eax, 0x1000193
movzx eax, byte [esi + 9]
xor ecx, eax
movzx eax, byte [esi + 0xa]
imul ecx, ecx, 0x1000193
xor ecx, eax
movzx eax, byte [esi + 0xb]
imul ecx, ecx, 0x1000193
xor ecx, eax
mov eax, dword [ebx + 0x18]
imul ecx, ecx, 0x1000193
and eax, ecx
mov ecx, dword [ebp - 0x18]
lea eax, [ecx + eax*8]
mov dword [ebp - 4], eax
mov eax, dword [eax + 4]
mov dword [ebp - 0x10], eax
mov eax, esi
mov edi, esi
mov esi, dword [esi]
push 0x10
push eax
call fcn.100e20a3
dec dword [ebx + 8]
add esp, 8
mov eax, dword [ebp + 0xc]
cmp edi, dword [ebp - 0x10]
je 0x100262bd
cmp esi, eax
jne 0x10026287
mov ecx, dword [ebp - 4]
mov dword [ecx], esi
mov ecx, dword [ebp - 8]
pop edi
mov dword [ecx], esi
mov dword [esi + 4], ecx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
mov ecx, dword [ebp - 4]
mov edx, dword [ebp - 0x14]
mov dword [ecx], edx
mov dword [ecx + 4], edx
cmp esi, eax
jne 0x10026240
mov ecx, dword [ebp - 8]
pop edi
mov dword [ecx], esi
mov dword [esi + 4], ecx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x1002eec0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100e4e0f
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x10112040]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
vpxor xmm0, xmm0, xmm0
mov dword [esi], 0xc8
mov dword [esi + 4], 0xc8
mov dword [esi + 8], 0x1f7
mov dword [esi + 0xc], 0x1ae
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
mov dword [esi + 0x18], 0
mov dword [esi + 0x1c], 0
mov byte [esi + 0x20], 0
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x2c], 0
mov dword [esi + 0x30], 0
vmovups ymmword [esi + 0x34], ymm0
vmovdqu xmmword [esi + 0x54], xmm0
mov dword [esi + 0x64], 0
mov dword [esi + 0x68], 0
mov dword [esi + 0x6c], 0
mov dword [esi + 0x70], 0
mov dword [esi + 0x74], 0
push 0x30
vzeroupper
call fcn.100e1c3f
vpxor xmm0, xmm0, xmm0
push 0x18
mov dword [eax], 0
vmovdqu xmmword [eax + 4], xmm0
vmovss dword [eax + 0x14], xmm0
vmovq qword [eax + 0x18], xmm0
mov dword [eax + 0x20], 0
vmovq qword [eax + 0x24], xmm0
mov dword [eax + 0x2c], 0
mov dword [esi + 0x78], eax
mov byte [esi + 0x7c], 0
call fcn.100e1c3f
vpxor xmm0, xmm0, xmm0
push 0x18
mov dword [eax], 0
vmovdqu xmmword [eax + 4], xmm0
vmovss dword [eax + 0x14], xmm0
mov dword [esi + 0x80], eax
call fcn.100e1c3f
vpxor xmm0, xmm0, xmm0
push 0x24
mov dword [eax], 0
vmovdqu xmmword [eax + 4], xmm0
vmovss dword [eax + 0x14], xmm0
mov dword [esi + 0x84], eax
call fcn.100e1c3f
vpxor xmm0, xmm0, xmm0
push 0x24
mov dword [eax + 4], 0
mov dword [eax + 8], 0
mov dword [eax + 0xc], 0
mov dword [eax], 0
vmovdqu xmmword [eax + 0x10], xmm0
vmovss dword [eax + 0x20], xmm0
mov dword [esi + 0x88], eax
call fcn.100e1c3f
vpxor xmm0, xmm0, xmm0
add esp, 0x14
mov dword [eax + 4], 0
mov dword [eax + 8], 0
mov dword [eax + 0xc], 0
mov dword [eax], 0
vmovdqu xmmword [eax + 0x10], xmm0
vmovss dword [eax + 0x20], xmm0
mov dword [esi + 0x8c], eax
vmovdqu xmmword [esi + 0x90], xmm0
mov dword [esi + 0xa0], 0
mov dword [esi + 0xa4], 0xf
mov byte [esi + 0x90], 0
mov dword [ebp - 4], 0
mov dword [esi + 0xa8], 0
mov dword [esi + 0xac], 0
mov dword [esi + 0xb0], 0
mov dword [esi + 0xb4], 0
mov dword [esi + 0xb8], 0
mov byte [ebp - 4], 1
lea ecx, [esi + 0xc0]
push 0x100f6ab3
mov word [esi + 0xbc], 0
call fcn.1001ac70
push 0x100f6ab3
lea ecx, [esi + 0xd8]
mov byte [ebp - 4], 2
call fcn.1001ac70
vpxor xmm0, xmm0, xmm0
vmovdqu xmmword [esi + 0xf0], xmm0
mov dword [esi + 0x100], 0
mov eax, esi
mov dword [esi + 0x104], 0xf
mov byte [esi + 0xf0], 0
vmovdqu xmmword [esi + 0x108], xmm0
mov dword [esi + 0x118], 0
mov dword [esi + 0x11c], 0xf
mov byte [esi + 0x108], 0
mov word [esi + 0x120], 0
mov dword [esi + 0x124], 0
mov dword [esi + 0x128], 0
mov dword [esi + 0x12c], 0
mov dword [esi + 0x130], 0
mov dword [esi + 0x134], 0
mov dword [esi + 0x138], 0
mov dword [esi + 0x13c], 0
mov dword [esi + 0x140], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x10035d70
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [ebp + 0xc]
mov edx, ecx
push ebx
mov ebx, dword [ebp + 8]
mov dword [ebp - 0x14], edx
cmp ebx, eax
je 0x10035ee1
mov eax, dword [edx + 4]
mov dword [ebp - 0x18], eax
mov eax, dword [ebx + 4]
mov dword [ebp - 8], eax
movzx eax, byte [ebx + 8]
xor eax, 0x811c9dc5
imul ecx, eax, 0x1000193
movzx eax, byte [ebx + 9]
push esi
push edi
mov edi, dword [edx + 0xc]
mov esi, ebx
xor ecx, eax
mov dword [ebp - 0x1c], edi
movzx eax, byte [ebx + 0xa]
imul ecx, ecx, 0x1000193
xor ecx, eax
movzx eax, byte [ebx + 0xb]
imul ecx, ecx, 0x1000193
xor ecx, eax
mov eax, dword [edx + 0x18]
imul ecx, ecx, 0x1000193
and eax, ecx
mov ecx, dword [edi + eax*8]
mov dword [ebp - 4], ecx
lea eax, [edi + eax*8]
mov dword [ebp - 0xc], eax
mov eax, dword [eax + 4]
mov dword [ebp - 0x10], eax
nop word [eax + eax]
mov edi, esi
mov ebx, esi
mov esi, dword [esi]
lea ecx, [edi + 0xc]
call fcn.10033210
push 0x18
push edi
call fcn.100e20a3
mov edx, dword [ebp - 0x14]
add esp, 8
dec dword [edx + 8]
cmp ebx, dword [ebp - 0x10]
je 0x10035e3d
mov eax, dword [ebp + 0xc]
cmp esi, eax
jne 0x10035df0
mov ecx, dword [ebp - 4]
cmp ecx, dword [ebp + 8]
jne 0x10035ed7
mov edi, dword [ebp - 0xc]
mov ecx, dword [ebp - 8]
mov dword [edi], esi
mov dword [ecx], esi
pop edi
mov dword [esi + 4], ecx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
mov ecx, dword [ebp - 4]
mov edi, dword [ebp - 0xc]
cmp ecx, dword [ebp + 8]
jne 0x10035e51
mov eax, dword [ebp - 0x18]
mov ecx, eax
mov dword [edi], eax
jmp 0x10035e54
mov ecx, dword [ebp - 8]
mov eax, dword [ebp + 0xc]
mov dword [edi + 4], ecx
cmp esi, eax
je 0x10035ed7
nop
movzx eax, byte [esi + 8]
xor eax, 0x811c9dc5
imul ecx, eax, 0x1000193
movzx eax, byte [esi + 9]
xor ecx, eax
movzx eax, byte [esi + 0xa]
imul ecx, ecx, 0x1000193
xor ecx, eax
movzx eax, byte [esi + 0xb]
imul ecx, ecx, 0x1000193
xor ecx, eax
mov eax, dword [edx + 0x18]
imul ecx, ecx, 0x1000193
and eax, ecx
mov ecx, dword [ebp - 0x1c]
lea eax, [ecx + eax*8]
mov dword [ebp - 4], eax
mov eax, dword [eax + 4]
mov dword [ebp - 0x10], eax
mov edi, esi
mov ebx, esi
mov esi, dword [esi]
lea ecx, [edi + 0xc]
call fcn.10033210
push 0x18
push edi
call fcn.100e20a3
mov edx, dword [ebp - 0x14]
add esp, 8
mov eax, dword [ebp + 0xc]
dec dword [edx + 8]
cmp ebx, dword [ebp - 0x10]
je 0x10035ee8
cmp esi, eax
jne 0x10035ea7
mov ecx, dword [ebp - 4]
mov dword [ecx], esi
mov ecx, dword [ebp - 8]
pop edi
mov dword [ecx], esi
mov dword [esi + 4], ecx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
mov ecx, dword [ebp - 4]
mov ebx, dword [ebp - 0x18]
mov dword [ecx], ebx
mov dword [ecx + 4], ebx
cmp esi, eax
jne 0x10035e60
mov ecx, dword [ebp - 8]
pop edi
mov dword [ecx], esi
mov dword [esi + 4], ecx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8