joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10097820
Capabilities:
Hash data using fnv

Disassembly:
mov eax, 0x1fffffff
bsr ecx, eax
push ebx
push ebp
push esi
push edi
mov edi, 1
mov eax, edi
shl eax, cl
mov ecx, dword [esp + 0x14]
cmp ecx, eax
ja 0x1009796f
lea eax, [ecx - 1]
mov esi, dword [0x1013d280]
or eax, edi
bsr ecx, eax
push esi
lea ecx, [ecx + 1]
shl edi, cl
mov ecx, 0x1013d288
lea eax, [edi + edi]
push eax
call fcn.10016340
mov ecx, dword [0x1013d280]
lea ebx, [edi - 1]
mov dword [0x1013d294], ebx
mov dword [0x1013d298], edi
mov ecx, dword [ecx]
mov edx, ecx
cmp ecx, esi
je 0x10097968
movzx eax, byte [ecx + 8]
xor eax, 0x811c9dc5
mov edx, dword [edx]
imul edi, eax, 0x1000193
movzx eax, byte [ecx + 9]
xor edi, eax
movzx eax, byte [ecx + 0xa]
imul edi, edi, 0x1000193
xor edi, eax
movzx eax, byte [ecx + 0xb]
imul edi, edi, 0x1000193
xor edi, eax
mov eax, dword [0x1013d288]
imul edi, edi, 0x1000193
and edi, ebx
mov ebx, dword [eax + edi*8]
lea eax, [eax + edi*8]
mov dword [esp + 0x14], eax
cmp ebx, esi
jne 0x100978d5
mov dword [eax], ecx
mov dword [eax + 4], ecx
jmp 0x1009793b
mov eax, dword [eax + 4]
mov edi, dword [ecx + 8]
cmp edi, dword [eax + 8]
jne 0x10097908
mov eax, dword [eax]
cmp eax, ecx
je 0x100978ff
mov ebp, dword [ecx + 4]
mov dword [ebp], edx
mov ebx, dword [edx + 4]
mov dword [ebx], eax
mov edi, dword [eax + 4]
mov dword [edi], ecx
mov dword [eax + 4], ebx
mov dword [edx + 4], ebp
mov dword [ecx + 4], edi
mov eax, dword [esp + 0x14]
mov dword [eax + 4], ecx
jmp 0x1009793b
cmp ebx, eax
je 0x1009791c
nop dword [eax]
mov eax, dword [eax + 4]
cmp edi, dword [eax + 8]
je 0x1009794c
cmp ebx, eax
jne 0x10097910
mov ebp, dword [ecx + 4]
mov dword [ebp], edx
mov ebx, dword [edx + 4]
mov dword [ebx], eax
mov edi, dword [eax + 4]
mov dword [edi], ecx
mov dword [eax + 4], ebx
mov eax, dword [esp + 0x14]
mov dword [edx + 4], ebp
mov dword [ecx + 4], edi
mov dword [eax], ecx
mov ecx, edx
cmp edx, esi
je 0x10097968
mov ebx, dword [0x1013d294]
jmp 0x10097884
mov ebx, dword [ecx + 4]
mov ebp, dword [eax]
mov dword [ebx], edx
mov edi, dword [edx + 4]
mov dword [edi], ebp
mov eax, dword [ebp + 4]
mov dword [eax], ecx
mov dword [ebp + 4], edi
mov dword [edx + 4], ebx
mov dword [ecx + 4], eax
jmp 0x1009793b
pop edi
pop esi
pop ebp
pop ebx
ret 4
push str.invalid_hash_bucket_count
call fcn.100e7eaa
int3
Function at 0x10099d00
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x5c
push esi
push 0x40
lea eax, [esp + 0x24]
mov esi, ecx
push 0
push eax
call fcn.100eae50
mov eax, 0x20
mov dword [esp + 0x14], 0x67452301
mov dword [esp + 0x24], eax
lea ecx, [esp + 0x2c]
shr eax, 3
mov edx, 0x3f
and eax, 0x3f
mov dword [esp + 0x18], 0xefcdab89
add ecx, eax
mov dword [esp + 0x1c], 0x98badcfe
mov dword [esp + 0x20], 0x10325476
sub edx, eax
mov dword [esp + 0x28], 0
add esp, 0xc
mov dword [esp + 0x20], esi
mov byte [ecx], 0x80
inc ecx
cmp edx, 8
jae 0x10099d92
push edx
push 0
push ecx
call fcn.100eae50
add esp, 0xc
lea edx, [esp + 0x20]
lea ecx, [esp + 8]
call fcn.10099660
push 0x38
push 0
lea eax, [esp + 0x28]
push eax
jmp 0x10099d99
lea eax, [edx - 8]
push eax
push 0
push ecx
call fcn.100eae50
mov eax, dword [esp + 0x24]
lea edx, [esp + 0x2c]
add esp, 0xc
mov dword [esp + 0x58], eax
mov eax, dword [esp + 0x1c]
lea ecx, [esp + 8]
mov dword [esp + 0x5c], eax
call fcn.10099660
mov eax, dword [esp + 0xe]
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x100a4640
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
and esp, 0xffffffc0
sub esp, 0x34
mov edx, dword [ebp + 0xc]
push ebx
push esi
mov esi, ecx
mov ebx, edx
cmp dword [edx + 0x14], 0x10
push edi
mov dword [esp + 0x34], esi
jb 0x100a465f
mov ebx, dword [edx]
xor ecx, ecx
mov edi, 0x811c9dc5
cmp dword [edx + 0x10], ecx
jbe 0x100a4682
nop dword [eax + eax]
movzx eax, byte [ecx + ebx]
inc ecx
xor eax, edi
imul edi, eax, 0x1000193
cmp ecx, dword [edx + 0x10]
jb 0x100a4670
push edi
push edx
lea eax, [esp + 0x40]
mov ecx, esi
push eax
call fcn.1001f950
mov ecx, dword [esp + 0x3c]
test ecx, ecx
je 0x100a46aa
mov eax, dword [ebp + 8]
mov dword [eax], ecx
mov byte [eax + 4], 0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
cmp dword [esi + 8], 0x2108421
je 0x100a4830
push 0x7c
call fcn.100e91db
mov ebx, eax
xorps xmm0, xmm0
mov eax, dword [ebp + 0xc]
add esp, 4
movups xmmword [ebx + 8], xmm0
mov dword [ebx + 0x18], 0
lea esi, [ebx + 0x20]
mov dword [ebx + 0x1c], 0
movups xmm0, xmmword [eax]
push 0x5c
push 0
movups xmmword [ebx + 8], xmm0
push esi
movq xmm0, qword [eax + 0x10]
movq qword [ebx + 0x18], xmm0
mov dword [eax + 0x10], 0
mov dword [eax + 0x14], 0xf
mov byte [eax], 0
call fcn.100eae50
add esp, 0xc
mov ecx, esi
call fcn.10027280
mov esi, dword [esp + 0x34]
mov eax, dword [esi + 8]
mov ecx, dword [esi + 0x1c]
inc eax
movss xmm3, dword [esi]
movd xmm0, eax
cvtdq2pd xmm0, xmm0
shr eax, 0x1f
addsd xmm0, qword [eax*8 + 0x1012b250]
mov eax, ecx
shr eax, 0x1f
cvtpd2ps xmm2, xmm0
movd xmm0, ecx
cvtdq2pd xmm0, xmm0
movaps xmm1, xmm2
addsd xmm0, qword [eax*8 + 0x1012b250]
cvtpd2ps xmm0, xmm0
divss xmm1, xmm0
comiss xmm1, xmm3
jbe 0x100a47ca
divss xmm2, xmm3
sub esp, 8
movss dword [esp + 0x3c], xmm2
fld dword [esp + 0x3c]
fstp qword [esp]
call fcn.1010a4b0
add esp, 8
fstp dword [esp + 0x34]
movss xmm0, dword [esp + 0x34]
call fcn.1010c6a0
mov ecx, 8
cmp eax, ecx
cmova ecx, eax
mov eax, dword [esi + 0x1c]
cmp eax, ecx
jae 0x100a47ad
cmp eax, 0x200
jae 0x100a47ab
shl eax, 3
cmp eax, ecx
jae 0x100a47ad
mov eax, ecx
push eax
mov ecx, esi
call fcn.1001d340
push edi
lea eax, [ebx + 8]
mov ecx, esi
push eax
lea eax, [esp + 0x40]
push eax
call fcn.1001f950
mov edx, dword [eax]
jmp 0x100a47ce
mov edx, dword [esp + 0x38]
mov eax, dword [edx + 4]
inc dword [esi + 8]
mov dword [ebx + 4], eax
mov dword [ebx], edx
mov dword [eax], ebx
mov dword [edx + 4], ebx
mov ecx, dword [esi + 0xc]
mov dword [esp + 0x34], eax
mov eax, dword [esi + 0x18]
and eax, edi
mov edi, dword [ecx + eax*8]
cmp edi, dword [esi + 4]
jne 0x100a47f7
mov dword [ecx + eax*8], ebx
jmp 0x100a481a
cmp edi, edx
jne 0x100a4810
mov dword [ecx + eax*8], ebx
mov eax, dword [ebp + 8]
mov dword [eax], ebx
mov byte [eax + 4], 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
mov edx, dword [esp + 0x34]
cmp dword [ecx + eax*8 + 4], edx
jne 0x100a481e
mov dword [ecx + eax*8 + 4], ebx
mov eax, dword [ebp + 8]
pop edi
pop esi
mov dword [eax], ebx
mov byte [eax + 4], 1
pop ebx
mov esp, ebp
pop ebp
ret 8
push str.unordered_map_set_too_long
call fcn.100e7eaa
int3
Function at 0x100a4840
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
and esp, 0xffffffc0
sub esp, 0x34
mov edx, dword [ebp + 0xc]
push ebx
push esi
mov esi, ecx
mov ebx, edx
cmp dword [edx + 0x14], 0x10
push edi
mov dword [esp + 0x34], esi
jb 0x100a485f
mov ebx, dword [edx]
xor ecx, ecx
mov edi, 0x811c9dc5
cmp dword [edx + 0x10], ecx
jbe 0x100a4882
nop dword [eax + eax]
movzx eax, byte [ecx + ebx]
inc ecx
xor eax, edi
imul edi, eax, 0x1000193
cmp ecx, dword [edx + 0x10]
jb 0x100a4870
push edi
push edx
lea eax, [esp + 0x40]
mov ecx, esi
push eax
call fcn.1001f950
mov ecx, dword [esp + 0x3c]
test ecx, ecx
je 0x100a48aa
mov eax, dword [ebp + 8]
mov dword [eax], ecx
mov byte [eax + 4], 0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
cmp dword [esi + 8], 0x2762762
je 0x100a4a30
push 0x68
call fcn.100e91db
mov ebx, eax
xorps xmm0, xmm0
mov eax, dword [ebp + 0xc]
add esp, 4
movups xmmword [ebx + 8], xmm0
mov dword [ebx + 0x18], 0
lea esi, [ebx + 0x20]
mov dword [ebx + 0x1c], 0
movups xmm0, xmmword [eax]
push 0x45
push 0
movups xmmword [ebx + 8], xmm0
push esi
movq xmm0, qword [eax + 0x10]
movq qword [ebx + 0x18], xmm0
mov dword [eax + 0x10], 0
mov dword [eax + 0x14], 0xf
mov byte [eax], 0
call fcn.100eae50
add esp, 0xc
mov ecx, esi
call fcn.10027340
mov esi, dword [esp + 0x34]
mov eax, dword [esi + 8]
mov ecx, dword [esi + 0x1c]
inc eax
movss xmm3, dword [esi]
movd xmm0, eax
cvtdq2pd xmm0, xmm0
shr eax, 0x1f
addsd xmm0, qword [eax*8 + 0x1012b250]
mov eax, ecx
shr eax, 0x1f
cvtpd2ps xmm2, xmm0
movd xmm0, ecx
cvtdq2pd xmm0, xmm0
movaps xmm1, xmm2
addsd xmm0, qword [eax*8 + 0x1012b250]
cvtpd2ps xmm0, xmm0
divss xmm1, xmm0
comiss xmm1, xmm3
jbe 0x100a49ca
divss xmm2, xmm3
sub esp, 8
movss dword [esp + 0x3c], xmm2
fld dword [esp + 0x3c]
fstp qword [esp]
call fcn.1010a4b0
add esp, 8
fstp dword [esp + 0x34]
movss xmm0, dword [esp + 0x34]
call fcn.1010c6a0
mov ecx, 8
cmp eax, ecx
cmova ecx, eax
mov eax, dword [esi + 0x1c]
cmp eax, ecx
jae 0x100a49ad
cmp eax, 0x200
jae 0x100a49ab
shl eax, 3
cmp eax, ecx
jae 0x100a49ad
mov eax, ecx
push eax
mov ecx, esi
call fcn.1001d340
push edi
lea eax, [ebx + 8]
mov ecx, esi
push eax
lea eax, [esp + 0x40]
push eax
call fcn.1001f950
mov edx, dword [eax]
jmp 0x100a49ce
mov edx, dword [esp + 0x38]
mov eax, dword [edx + 4]
inc dword [esi + 8]
mov dword [ebx + 4], eax
mov dword [ebx], edx
mov dword [eax], ebx
mov dword [edx + 4], ebx
mov ecx, dword [esi + 0xc]
mov dword [esp + 0x34], eax
mov eax, dword [esi + 0x18]
and eax, edi
mov edi, dword [ecx + eax*8]
cmp edi, dword [esi + 4]
jne 0x100a49f7
mov dword [ecx + eax*8], ebx
jmp 0x100a4a1a
cmp edi, edx
jne 0x100a4a10
mov dword [ecx + eax*8], ebx
mov eax, dword [ebp + 8]
mov dword [eax], ebx
mov byte [eax + 4], 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
mov edx, dword [esp + 0x34]
cmp dword [ecx + eax*8 + 4], edx
jne 0x100a4a1e
mov dword [ecx + eax*8 + 4], ebx
mov eax, dword [ebp + 8]
pop edi
pop esi
mov dword [eax], ebx
mov byte [eax + 4], 1
pop ebx
mov esp, ebp
pop ebp
ret 8
push str.unordered_map_set_too_long
call fcn.100e7eaa
int3
Function at 0x100aff90
Capabilities:
Hash data with crc32

Disassembly:
push ebx
mov ebx, dword [esp + 8]
push esi
push edi
mov edi, edx
not ebx
mov esi, ecx
mov eax, ebx
test edi, edi
je 0x100afff0
mov cl, byte [esi]
lea esi, [esi + 1]
dec edi
cmp cl, 0x23
jne 0x100affd2
cmp edi, 2
jb 0x100affd2
cmp byte [esi], cl
jne 0x100affd2
cmp byte [esi + 1], cl
jne 0x100affd2
mov eax, ebx
movzx ecx, cl
movzx edx, al
xor edx, ecx
shr eax, 8
xor eax, dword [edx*4 + 0x10124db8]
jmp 0x100affa3
movzx edx, al
movzx ecx, cl
xor edx, ecx
shr eax, 8
xor eax, dword [edx*4 + 0x10124db8]
test edi, edi
jne 0x100affa3
pop edi
pop esi
not eax
pop ebx
ret 4
mov cl, byte [esi]
inc esi
test cl, cl
je 0x100b001f
cmp cl, 0x23
jne 0x100b0006
cmp byte [esi], cl
jne 0x100b0006
cmp byte [esi + 1], cl
cmove eax, ebx
movzx edx, al
movzx ecx, cl
xor edx, ecx
shr eax, 8
mov cl, byte [esi]
inc esi
xor eax, dword [edx*4 + 0x10124db8]
test cl, cl
jne 0x100afff7
pop edi
pop esi
not eax
pop ebx
ret 4

Function at 0x100b0100
Capabilities:
Read file on windows

Disassembly:
push ebx
push ebp
mov ebp, dword [esp + 0xc]
push esi
push edi
test ebp, ebp
je 0x100b0113
mov dword [ebp], 0
call fcn.100b0030
mov esi, eax
test esi, esi
je 0x100b020b
push esi
call fcn.100f9611
mov ebx, eax
add esp, 4
cmp ebx, 0xffffffff
je 0x100b0202
push 2
push 0
push esi
call fcn.100f6014
add esp, 0xc
test eax, eax
jne 0x100b0202
push esi
call fcn.100f9611
mov edi, eax
add esp, 4
cmp edi, 0xffffffff
je 0x100b0202
push 0
push ebx
push esi
call fcn.100f6014
add esp, 0xc
test eax, eax
jne 0x100b0202
mov eax, dword [0x1013a848]
test eax, eax
je 0x100b0182
inc dword [eax + 0x370]
mov eax, dword [esp + 0x18]
add eax, edi
push eax
call fcn.100f6549
mov ebx, eax
add esp, 4
test ebx, ebx
je 0x100b0202
push esi
push edi
push 1
push ebx
call fcn.100f5c37
add esp, 0x10
cmp eax, edi
je 0x100b01d2
push esi
call fcn.100f2103
mov eax, dword [0x1013a848]
add esp, 4
test eax, eax
je 0x100b01c0
dec dword [eax + 0x370]
push ebx
call fcn.100f57a7
add esp, 4
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
ret 8
mov eax, dword [esp + 0x18]
test eax, eax
jle 0x100b01e9
push eax
lea eax, [edi + ebx]
push 0
push eax
call fcn.100eae50
add esp, 0xc
push esi
call fcn.100f2103
add esp, 4
test ebp, ebp
je 0x100b01f9
mov dword [ebp], edi
mov eax, ebx
pop edi
pop esi
pop ebp
pop ebx
ret 8
push esi
call fcn.100f2103
add esp, 4
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
ret 8
Function at 0x100b2730
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
mov edx, dword [ecx + 0xc0]
mov eax, dword [ecx + 0xc8]
push esi
push edi
lea esi, [esp + 0xc]
mov edi, 4
mov eax, dword [eax + edx*4 - 4]
not eax
nop dword [eax]
movzx ecx, byte [esi]
lea esi, [esi + 1]
movzx edx, al
xor edx, ecx
shr eax, 8
xor eax, dword [edx*4 + 0x10124db8]
sub edi, 1
jne 0x100b2750
mov ecx, dword [0x1013a848]
not eax
pop edi
pop esi
cmp dword [ecx + 0x1bc8], eax
jne 0x100b2782
mov dword [ecx + 0x1bcc], eax
cmp dword [ecx + 0x1c04], eax
jne 0x100b2791
mov byte [ecx + 0x1c08], 1
ret 4

Function at 0x100b27a0
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
sub esp, 0x10
mov edx, dword [esp + 0x14]
push esi
mov esi, ecx
push edi
movss xmm0, dword [edx]
mov edi, 0x10
subss xmm0, dword [esi + 0xc]
mov ecx, dword [esi + 0xc0]
cvttss2si eax, xmm0
movss xmm0, dword [edx + 4]
subss xmm0, dword [esi + 0x10]
mov dword [esp + 8], eax
cvttss2si eax, xmm0
movss xmm0, dword [edx + 8]
subss xmm0, dword [esi + 0xc]
mov dword [esp + 0xc], eax
cvttss2si eax, xmm0
movss xmm0, dword [edx + 0xc]
subss xmm0, dword [esi + 0x10]
mov dword [esp + 0x10], eax
cvttss2si eax, xmm0
mov dword [esp + 0x14], eax
mov eax, dword [esi + 0xc8]
lea esi, [esp + 8]
mov edx, dword [eax + ecx*4 - 4]
not edx
nop dword [eax]
movzx eax, byte [esi]
lea esi, [esi + 1]
movzx ecx, dl
xor ecx, eax
shr edx, 8
xor edx, dword [ecx*4 + 0x10124db8]
sub edi, 1
jne 0x100b2810
mov eax, dword [0x1013a848]
not edx
pop edi
pop esi
cmp dword [eax + 0x1bc8], edx
jne 0x100b2841
mov dword [eax + 0x1bcc], edx
cmp dword [eax + 0x1c04], edx
jne 0x100b2850
mov byte [eax + 0x1c08], 1
mov eax, edx
add esp, 0x10
ret 4
Function at 0x100bba70
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ecx
mov eax, dword [0x1013a848]
lea edx, [esp]
push ebx
push ebp
push esi
push edi
mov edi, dword [eax + 0x1b94]
mov esi, 4
add edi, 0xc0
mov dword [esp + 0x10], ecx
mov ebp, dword [edi]
mov ebx, dword [edi + 8]
mov ebx, dword [ebx + ebp*4 - 4]
not ebx
nop dword [eax]
movzx eax, byte [edx]
lea edx, [edx + 1]
movzx ecx, bl
xor ecx, eax
shr ebx, 8
xor ebx, dword [ecx*4 + 0x10124db8]
sub esi, 1
jne 0x100bbaa0
mov esi, dword [edi + 4]
not ebx
cmp ebp, esi
jne 0x100bbae7
lea ecx, [ebp + 1]
test esi, esi
je 0x100bbad5
mov eax, esi
cdq
sub eax, edx
sar eax, 1
add eax, esi
jmp 0x100bbada
mov eax, 8
cmp eax, ecx
cmovg ecx, eax
push ecx
mov ecx, edi
call fcn.100897b0
mov ecx, dword [edi]
mov eax, dword [edi + 8]
mov dword [eax + ecx*4], ebx
inc dword [edi]
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
Function at 0x100c0580
Capabilities:
Hash data with crc32

Disassembly:
movss xmm0, dword [0x1012ac80]
sub esp, 0x14
push ebx
push ebp
push esi
push edi
mov edi, dword [0x1013a848]
comiss xmm0, dword [edi + 0x1e0c]
ja 0x100c07f7
cmp dword [edi + 0x1e08], 0
jne 0x100c05ee
or edx, 0xffffffff
mov esi, 0x10124b91
mov al, 0x23
or ebx, 0xffffffff
cmp al, 0x23
jne 0x100c05c6
cmp byte [esi], al
jne 0x100c05c6
cmp byte [esi + 1], al
cmove edx, ebx
movzx ecx, dl
movzx eax, al
xor ecx, eax
shr edx, 8
mov al, byte [esi]
inc esi
xor edx, dword [ecx*4 + 0x10124db8]
test al, al
jne 0x100c05b8
not edx
mov ecx, edx
call fcn.100b6ce0
mov dword [edi + 0x1e08], eax
mov eax, dword [edi + 0x1cf4]
lea edx, [esp + 0x10]
mov dword [esp + 0x18], 0x7f7fffff
mov dword [esp + 0x1c], 0x7f7fffff
mov ecx, dword [eax]
mov eax, dword [edi + 0x1c18]
or eax, 0x10
movss xmm2, dword [ecx + 0xc]
movss xmm1, dword [ecx + 0x10]
mulss xmm1, dword [0x1012ac94]
mov dword [edi + 0x1c18], eax
or eax, 1
mulss xmm2, dword [0x1012ac94]
mov dword [edi + 0x1c64], 0
movss dword [esp + 0x14], xmm1
mov dword [edi + 0x1c68], 0
movss dword [esp + 0x10], xmm2
movups xmm0, xmmword [esp + 0x10]
movups xmmword [edi + 0x1c54], xmm0
movss xmm1, dword [ecx + 0x10]
movss xmm2, dword [ecx + 0xc]
mulss xmm1, dword [0x1012acd8]
mulss xmm2, dword [0x1012acd8]
addss xmm1, dword [ecx + 8]
addss xmm2, dword [ecx + 4]
mov dword [edi + 0x1c18], eax
mov ecx, 1
mov dword [edi + 0x1c30], 0x3f000000
movss dword [edi + 0x1c2c], xmm1
mov dword [edi + 0x1c34], 0x3f000000
movss dword [edi + 0x1c28], xmm2
mov dword [edi + 0x1c1c], 1
movss xmm1, dword [edi + 0x151c]
movss xmm0, dword [edi + 0x1520]
addss xmm1, xmm1
addss xmm0, xmm0
movss dword [esp + 0x10], xmm1
movss dword [esp + 0x14], xmm0
call fcn.100b0f90
push 0xc1347
xor edx, edx
mov ecx, str.NavWindowingList
call fcn.100b8f90
mov ebp, dword [edi + 0x1b60]
sub ebp, 1
js 0x100c07e1
nop dword [eax + eax]
mov eax, dword [edi + 0x1b68]
mov esi, dword [eax + ebp*4]
cmp byte [esi + 0x8b], 0
je 0x100c07d8
cmp esi, dword [esi + 0x320]
jne 0x100c07d8
test dword [esi + 8], 0x80000
jne 0x100c07d8
mov ecx, dword [esi]
mov edx, ecx
cmp ecx, 0xffffffff
jae 0x100c0762
mov bl, byte [edx]
test bl, bl
je 0x100c075e
cmp bl, 0x23
jne 0x100c0758
cmp byte [edx + 1], bl
je 0x100c075e
inc edx
cmp edx, 0xffffffff
jb 0x100c0748
cmp ecx, edx
jne 0x100c07b3
mov eax, dword [esi + 8]
test eax, 0x4000000
je 0x100c0773
mov ecx, str._Popup_
jmp 0x100c07b3
test eax, 0x400
je 0x100c07ae
mov eax, str.MainMenuBar
nop
mov dl, byte [ecx]
cmp dl, byte [eax]
jne 0x100c07a0
test dl, dl
je 0x100c079c
mov dl, byte [ecx + 1]
cmp dl, byte [eax + 1]
jne 0x100c07a0
add ecx, 2
add eax, 2
test dl, dl
jne 0x100c0780
xor eax, eax
jmp 0x100c07a5
sbb eax, eax
or eax, 1
mov ecx, str._Main_menu_bar_
test eax, eax
je 0x100c07b3
mov ecx, str._Untitled_
cmp dword [edi + 0x1e00], esi
lea eax, [esp + 0x10]
push eax
push 0
sete dl
mov dword [esp + 0x18], 0
mov dword [esp + 0x1c], 0
call fcn.100dc020
sub ebp, 1
jns 0x100c0710
call fcn.100bb1d0
mov ecx, 1
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x14
jmp fcn.100b1010
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x14
ret
Function at 0x100c08e0
Capabilities:
Hash data with crc32

Disassembly:
sub esp, 0x14
mov edx, dword [0x1013a848]
mov eax, ecx
push ebx
push ebp
push esi
push edi
mov edi, edx
mov dword [esp + 0x1c], eax
xor esi, esi
mov dword [esp + 0x18], esi
mov ebp, dword [edi + 0x1b94]
test al, 0x10
jne 0x100c0a41
mov ebx, dword [ebp + 0x118]
test ebx, ebx
je 0x100c0941
cmp dword [edi + 0x1bc8], ebx
jne 0x100c0a37
mov esi, dword [edi + 0x1c00]
xor eax, eax
cmp esi, 0xffffffff
cmove esi, eax
cmp byte [esi + edi + 0xec], al
je 0x100c0a37
xor al, al
jmp 0x100c09cb
cmp byte [edi + 0xec], 0
je 0x100c0a37
test al, 8
je 0x100c0a37
test byte [ebp + 0x11c], 1
jne 0x100c0977
cmp dword [edi + 0x1bc8], esi
je 0x100c0a37
cmp dword [edi + 0x1bf8], ebp
jne 0x100c0a37
lea esi, [ebp + 0x120]
mov ecx, ebp
push esi
call fcn.100b27a0
mov ebx, eax
mov ecx, esi
mov edx, ebx
mov dword [ebp + 0x118], ebx
call fcn.100b2ab0
mov byte [esp + 0x17], al
test al, al
je 0x100c09bb
cmp byte [edi + 0x3d8], 0
je 0x100c09bb
mov edx, ebp
mov ecx, ebx
call fcn.100b2860
mov ecx, ebp
call fcn.100bb2d0
mov al, byte [esp + 0x17]
cmp dword [edi + 0x1bc8], ebx
jne 0x100c0a37
mov edx, dword [0x1013a848]
xor esi, esi
mov byte [edi + 0x1bd5], al
cmp byte [edx + esi + 0xec], 0
mov ecx, dword [ebp + 0xc0]
mov eax, dword [ebp + 0xc8]
mov eax, dword [eax + ecx*4 - 4]
mov dword [esp + 0x18], eax
jne 0x100c09f3
xor al, al
jmp 0x100c0a0b
movss xmm1, dword [edx + 0x30]
movss xmm0, dword [edx + esi*4 + 0x444]
mulss xmm1, xmm1
comiss xmm0, xmm1
setae al
mov dword [edi + 0x1bdc], 0xffffffff
mov dword [edi + 0x1be0], 0xffffffff
mov dword [edi + 0x1be8], 0xffffffff
mov dword [edi + 0x1bec], 0xffffffff
test al, al
jne 0x100c0a7b
xor al, al
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x14
ret
xor ebp, ebp
or ebx, 0xffffffff
mov edx, 0x10124ba5
mov al, 0x23
or esi, 0xffffffff
cmp al, 0x23
jne 0x100c0a5e
cmp byte [edx], al
jne 0x100c0a5e
cmp byte [edx + 1], al
cmove ebx, esi
movzx ecx, bl
movzx eax, al
xor ecx, eax
shr ebx, 8
mov al, byte [edx]
inc edx
xor ebx, dword [ecx*4 + 0x10124db8]
test al, al
jne 0x100c0a50
not ebx
mov esi, ebp
cmp byte [edi + 0x1e3c], 0
jne 0x100c0abf
call fcn.100c0800
mov eax, dword [esp + 0x18]
mov dword [edi + 0x1e58], eax
mov eax, dword [esp + 0x1c]
mov dword [edi + 0x1e54], ebx
mov byte [edi + 0x1e3c], 1
mov dword [edi + 0x1e40], eax
mov dword [edi + 0x1e48], esi
cmp ebx, dword [edi + 0x1bc8]
jne 0x100c0abf
mov byte [edi + 0x1bd6], 1
mov ebx, dword [esp + 0x1c]
mov eax, dword [edi + 0x1b38]
mov dword [edi + 0x1e44], eax
mov byte [edi + 0x1e3d], 1
test bl, 1
jne 0x100c0b0d
xor edx, edx
xor ecx, ecx
call fcn.100bcb40
cmp dword [edi + 0x1ea4], 0
je 0x100c0b0d
test dword [edi + 0x1e98], 0x1000
je 0x100c0b0d
mov eax, dword [edi + 0x1b94]
mov byte [eax + 0x8f], 1
mov byte [eax + 0xa8], 1
test bl, 0x12
jne 0x100c0b19
and dword [ebp + 0x11c], 0xfffffffe
pop edi
pop esi
pop ebp
mov al, 1
pop ebx
add esp, 0x14
ret
Function at 0x100c30b0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push esi
mov esi, ecx
mov ecx, dword [esi + 8]
test ecx, ecx
je 0x100c30e6
mov eax, dword [0x1013a848]
mov dword [esi + 4], 0
mov dword [esi], 0
test eax, eax
je 0x100c30d6
dec dword [eax + 0x370]
push ecx
call fcn.100f57a7
add esp, 4
mov dword [esi + 8], 0
mov ecx, dword [esi + 0x14]
test ecx, ecx
je 0x100c311a
mov eax, dword [0x1013a848]
mov dword [esi + 0x10], 0
mov dword [esi + 0xc], 0
test eax, eax
je 0x100c310a
dec dword [eax + 0x370]
push ecx
call fcn.100f57a7
add esp, 4
mov dword [esi + 0x14], 0
mov ecx, dword [esi + 0x20]
test ecx, ecx
je 0x100c314e
mov eax, dword [0x1013a848]
mov dword [esi + 0x1c], 0
mov dword [esi + 0x18], 0
test eax, eax
je 0x100c313e
dec dword [eax + 0x370]
push ecx
call fcn.100f57a7
add esp, 4
mov dword [esi + 0x20], 0
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x34], 0
mov dword [esi + 0x38], 0
mov ecx, dword [esi + 0x44]
test ecx, ecx
je 0x100c319e
mov eax, dword [0x1013a848]
mov dword [esi + 0x40], 0
mov dword [esi + 0x3c], 0
test eax, eax
je 0x100c318e
dec dword [eax + 0x370]
push ecx
call fcn.100f57a7
add esp, 4
mov dword [esi + 0x44], 0
mov ecx, dword [esi + 0x50]
test ecx, ecx
je 0x100c31d2
mov eax, dword [0x1013a848]
mov dword [esi + 0x4c], 0
mov dword [esi + 0x48], 0
test eax, eax
je 0x100c31c2
dec dword [eax + 0x370]
push ecx
call fcn.100f57a7
add esp, 4
mov dword [esi + 0x50], 0
mov ecx, dword [esi + 0x5c]
test ecx, ecx
je 0x100c3206
mov eax, dword [0x1013a848]
mov dword [esi + 0x58], 0
mov dword [esi + 0x54], 0
test eax, eax
je 0x100c31f6
dec dword [eax + 0x370]
push ecx
call fcn.100f57a7
add esp, 4
mov dword [esi + 0x5c], 0
lea ecx, [esi + 0x78]
pop esi
jmp fcn.100c5cd0