joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10028cb0
Capabilities:
Get number of processors
Get process heap flags
Get process heap force flags

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100fc0d0
mov eax, dword fs:[0]
push eax
push esi
push edi
mov eax, dword [0x1015f1d4]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
lea ecx, [esi + 0x14]
call fcn.1004ddc0
lea ecx, [esi + 0x18]
call fcn.1004ddc0
lea ecx, [esi + 0x1c]
call fcn.1004ddc0
lea ecx, [esi + 0x20]
call fcn.1004ddc0
lea ecx, [esi + 0x24]
call fcn.1004ddc0
lea ecx, [esi + 0x28]
call fcn.1004ddc0
lea ecx, [esi + 0x2c]
call fcn.1004ddc0
lea ecx, [esi + 0x30]
call fcn.1004ddc0
lea ecx, [esi + 0x34]
call fcn.1004ddc0
lea ecx, [esi + 0x38]
call fcn.1004ddc0
lea ecx, [esi + 0x3c]
call fcn.1004ddc0
lea ecx, [esi + 0x40]
call fcn.1004ddc0
lea ecx, [esi + 0x44]
call fcn.1004ddc0
lea ecx, [esi + 0x48]
call fcn.1004ddc0
lea ecx, [esi + 0x4c]
call fcn.1004ddc0
lea ecx, [esi + 0x50]
call fcn.1004ddc0
lea ecx, [esi + 0x54]
call fcn.1004ddc0
lea ecx, [esi + 0x58]
call fcn.1004ddc0
lea ecx, [esi + 0x5c]
call fcn.1004ddc0
lea ecx, [esi + 0x60]
call fcn.1004ddc0
lea ecx, [esi + 0x64]
call fcn.1004ddc0
lea ecx, [esi + 0x68]
call fcn.1004ddc0
cmp esi, 0x101395c8
je 0x10028e27
mov edi, dword [esi + 0x6c]
test edi, edi
je 0x10028dab
mov ecx, edi
call fcn.100277f0
push 0x28
push edi
call fcn.1004716b
add esp, 8
mov edi, dword [esi + 0x70]
test edi, edi
je 0x10028dc4
mov ecx, edi
call fcn.100277f0
push 0x28
push edi
call fcn.1004716b
add esp, 8
mov esi, dword [esi + 0x74]
test esi, esi
je 0x10028e27
mov dword [esi], vtable.tutorial::ClientLogon_ClientSecret.0
test byte [esi + 4], 1
mov dword [ebp - 4], 1
je 0x10028de8
lea ecx, [esi + 4]
call fcn.10024020
jmp 0x10028dee
mov eax, dword [esi + 4]
and eax, 0xfffffffc
test eax, eax
jne 0x10028dfa
lea ecx, [esi + 0x10]
call fcn.1004ddc0
mov edi, dword [esi + 4]
mov eax, edi
shr eax, 1
test al, 1
je 0x10028e1c
add edi, 0xfffffffe
je 0x10028e1c
mov ecx, edi
call fcn.1004d1d0
push 0x18
push edi
call fcn.1004716b
add esp, 8
push 0x30
push esi
call fcn.1004716b
add esp, 8
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x1003a880
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub dword [ebp + 0xc], 1
jne 0x1003a8e2
mov eax, dword [ebp + 8]
push str.LdrLoadDll
push str.ntdll.dll
mov dword [0x10164718], eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x1003a5f0
push 0x10164724
mov dword [0x10164724], eax
call fcn.1003ba80
add esp, 8
cmp eax, 1
jne 0x1003a8d1
push str._autologin__hook_LdrLoadDll_is_success_n
call fcn.10044570
add esp, 4
push 0
push 0
push 0x1003a830
call fcn.100e2593
add esp, 0xc
mov eax, 1
pop ebp
ret 0xc
Function at 0x1003c530
Capabilities:
Resume thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetCurrentThread]
call edi
push eax
call dword [sym.imp.KERNEL32.dll_GetThreadPriority]
push 0xf
mov dword [ebp - 4], eax
call edi
push eax
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
xor esi, esi
cmp dword [0x10164770], esi
jbe 0x1003c586
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_ResumeThread]
mov eax, dword [0x1016476c]
push dword [eax + esi*4]
call ebx
mov eax, dword [0x1016476c]
push dword [eax + esi*4]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
inc esi
cmp esi, dword [0x10164770]
jb 0x1003c564
pop ebx
push dword [0x1016476c]
call fcn.100e13b3
add esp, 4
mov dword [0x1016476c], 0
mov dword [0x10164770], 0
push dword [ebp - 4]
call edi
push eax
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x10040040
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push esi
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x10040099
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x10040099
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [ebp + 0x10]
lea edx, [esi + eax]
and ecx, 0xf
jbe 0x1004008a
cmp esi, edx
jae 0x10040099
movzx eax, word [esi]
lea esi, [esi + eax*2]
add esi, 2
sub ecx, 1
jne 0x10040078
cmp esi, edx
jae 0x10040099
cmp word [esi], 0
je 0x10040099
mov eax, esi
pop esi
pop ebp
ret
xor eax, eax
pop esi
pop ebp
ret
Function at 0x10041c40
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [ebp + 0x10]
push ebx
mov ebx, ecx
mov ecx, dword [ebp + 0xc]
push edi
mov edi, dword [ebp + 8]
mov dword [ebp - 4], edi
test eax, eax
jg 0x10041c6c
jl 0x10041c60
test ecx, ecx
jne 0x10041c6c
pop edi
xor eax, eax
xor edx, edx
pop ebx
mov esp, ebp
pop ebp
ret 0xc
cmp dword [ebx + 0x38], 0
push esi
je 0x10041d1e
mov dword [ebp - 8], ecx
mov dword [ebp - 4], eax
nop dword [eax]
mov ecx, ebx
call fcn.10010aff
mov esi, eax
mov eax, edx
mov dword [ebp - 0xc], eax
test eax, eax
jl 0x10041cd3
jg 0x10041c98
test esi, esi
je 0x10041cd3
mov ecx, dword [ebp - 4]
cmp ecx, eax
jg 0x10041cad
mov eax, dword [ebp - 8]
jl 0x10041ca8
cmp eax, esi
jae 0x10041cad
mov esi, eax
mov dword [ebp - 0xc], ecx
mov eax, dword [ebx + 0x1c]
push esi
push dword [eax]
push edi
call fcn.100ce860
mov eax, dword [ebx + 0x2c]
add esp, 0xc
mov ecx, dword [ebp - 8]
mov edx, dword [ebp - 4]
sub ecx, esi
sbb edx, dword [ebp - 0xc]
sub dword [eax], esi
mov eax, dword [ebx + 0x1c]
add dword [eax], esi
jmp 0x10041cf2
mov eax, dword [ebx]
mov ecx, ebx
call dword [eax + 0x1c]
mov edx, dword [ebp - 4]
cmp eax, 0xffffffff
je 0x10041d08
mov ecx, dword [ebp - 8]
mov esi, 1
add ecx, 0xffffffff
mov byte [edi], al
adc edx, 0xffffffff
add edi, esi
mov dword [ebp - 4], edx
mov dword [ebp - 8], ecx
test edx, edx
jg 0x10041c80
jl 0x10041d08
test ecx, ecx
jne 0x10041c80
mov eax, dword [ebp + 0xc]
sub eax, dword [ebp - 8]
mov ecx, dword [ebp + 0x10]
pop esi
sbb ecx, edx
pop edi
mov edx, ecx
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov eax, dword [ebx + 0x1c]
mov edi, ecx
mov edx, dword [eax]
test edx, edx
je 0x10041d55
mov eax, dword [ebx + 0x2c]
mov eax, dword [eax]
test eax, eax
je 0x10041d55
cmp eax, ecx
mov esi, ecx
cmovb esi, eax
push esi
push edx
push dword [ebp - 4]
call fcn.100ce860
mov eax, dword [ebx + 0x2c]
add esp, 0xc
add dword [ebp - 4], esi
sub edi, esi
sub dword [eax], esi
mov eax, dword [ebx + 0x1c]
add dword [eax], esi
cmp dword [ebx + 0x4c], 0
mov ecx, edi
je 0x10041dcb
mov esi, dword [ebx + 0xc]
lea eax, [ebx + 0x3c]
cmp dword [esi], eax
jne 0x10041d7b
mov edx, dword [ebx + 0x54]
mov ecx, dword [ebx + 0x50]
sub edx, ecx
mov dword [esi], ecx
mov eax, dword [ebx + 0x1c]
mov dword [eax], ecx
mov eax, dword [ebx + 0x2c]
mov dword [eax], edx
mov esi, dword [ebp - 4]
mov ecx, edi
cmp edi, 0xfff
jbe 0x10041db4
nop dword [eax + eax]
push dword [ebx + 0x4c]
push 0xfff
push 1
push esi
call fcn.100e3241
sub edi, eax
add esp, 0x10
add esi, eax
mov ecx, edi
cmp eax, 0xfff
jne 0x10041ddf
cmp edi, eax
ja 0x10041d90
test ecx, ecx
je 0x10041dcb
push dword [ebx + 0x4c]
push edi
push 1
push esi
call fcn.100e3241
mov ecx, edi
add esp, 0x10
sub ecx, eax
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 0x10]
sub eax, ecx
pop esi
pop edi
sbb edx, 0
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 0x10]
sub eax, edi
pop esi
pop edi
sbb edx, 0
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x10044570
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1004
call fcn.100476c0
mov eax, dword [0x1015f1d4]
xor eax, ebp
mov dword [ebp - 4], eax
push 0x1000
lea eax, [ebp - 0x1004]
push 0
push eax
call fcn.100cede0
add esp, 0xc
lea eax, [ebp + 0xc]
push eax
push 0
push dword [ebp + 8]
lea eax, [ebp - 0x1004]
push 0x800
push 0x1000
push eax
call fcn.100150e8
push dword [eax + 4]
push dword [eax]
call fcn.100de6d8
or ecx, 0xffffffff
add esp, 0x20
test eax, eax
cmovs eax, ecx
test eax, eax
jle 0x100445fe
cmp byte [ebp + eax - 0x1005], 0xa
je 0x100445f1
push 0x101253f8
lea eax, [ebp - 0x1004]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatA]
lea eax, [ebp - 0x1004]
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100476aa
mov esp, ebp
pop ebp
ret

Function at 0x10044b20
Capabilities:
64-bit execution via heavens gate

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a0
mov eax, dword [0x1015f1d4]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
call fcn.100450e0
mov esi, eax
mov dword [ebp - 0x130], edx
mov dword [ebp - 0x12c], esi
test esi, esi
jne 0x10044b55
test edx, edx
je 0x100450c1
lea eax, [ebp - 0x1a0]
mov dword [ebp - 0x114], esi
mov dword [ebp - 0x124], eax
mov dword [ebp - 0x110], edx
push 0x33
call 0x10044b74
add dword [esp], 5
retf
mov ecx, dword [ebp - 4]
xor eax, eax
pop edi
pop esi
xor ecx, ebp
xor edx, edx
pop ebx
call fcn.100476aa
mov esp, ebp
pop ebp
ret

Function at 0x100450e0
Capabilities:
64-bit execution via heavens gate

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x5d0
mov eax, dword [0x1015f1d4]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [0x10165070]
mov edx, dword [0x10165074]
push ebx
push esi
push edi
test eax, eax
jne 0x100453f0
test edx, edx
jne 0x100453f0
xorps xmm0, xmm0
movlpd qword [ebp - 0x24], xmm0
push 0x33
call 0x10045120
add dword [esp], 5
retf
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.100476aa
mov esp, ebp
pop ebp
ret

Function at 0x10045420
Capabilities:
64-bit execution via heavens gate

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x5d0
mov eax, dword [0x1015f1d4]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
xorps xmm0, xmm0
push ebx
push esi
push edi
mov dword [ebp - 0x24], eax
movlpd qword [ebp - 0x10], xmm0
push 0x33
call 0x1004544b
add dword [esp], 5
retf
Function at 0x10045800
Capabilities:
64-bit execution via heavens gate

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40
cmp dword [0x1015f170], 0
push ebx
push esi
push edi
jne 0x1004581d
xor eax, eax
xor edx, edx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov edx, dword [ebp + 0x10]
lea esi, [ebp + 0x14]
test edx, edx
jle 0x1004583c
mov eax, dword [ebp + 0x14]
lea esi, [ebp + 0x1c]
mov ecx, dword [ebp + 0x18]
dec edx
mov dword [ebp + 0x10], edx
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], ecx
jmp 0x10045844
xorps xmm0, xmm0
movlpd qword [ebp - 0x10], xmm0
test edx, edx
jle 0x1004585d
dec edx
add esi, 8
mov dword [ebp + 0x10], edx
mov eax, dword [esi - 8]
mov ecx, dword [esi - 4]
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], ecx
jmp 0x10045865
xorps xmm0, xmm0
movlpd qword [ebp - 0x18], xmm0
test edx, edx
jle 0x1004587e
dec edx
add esi, 8
mov dword [ebp + 0x10], edx
mov eax, dword [esi - 8]
mov ecx, dword [esi - 4]
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x1c], ecx
jmp 0x10045886
xorps xmm0, xmm0
movlpd qword [ebp - 0x20], xmm0
test edx, edx
jle 0x1004589f
dec edx
add esi, 8
mov dword [ebp + 0x10], edx
mov eax, dword [esi - 8]
mov ecx, dword [esi - 4]
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x24], ecx
jmp 0x100458a7
xorps xmm0, xmm0
movlpd qword [ebp - 0x28], xmm0
mov eax, edx
mov dword [ebp - 0x40], esi
cdq
xorps xmm0, xmm0
movlpd qword [ebp - 0x38], xmm0
mov dword [ebp - 0x3c], 0
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x2c], edx
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
mov word [ebp - 8], fs
mov eax, 0x2b
mov fs, ax
mov dword [ebp - 4], esp
and esp, 0xfffffff0
push 0x33
call 0x100458e9
add dword [esp], 5
retf

Function at 0x100488d0
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 0xc]
sub esp, 8
movzx eax, byte [edx]
xor eax, 0x811c9dc5
imul ecx, eax, 0x1000193
movzx eax, byte [edx + 1]
push esi
mov esi, dword [ebp + 8]
xor ecx, eax
movzx eax, byte [edx + 2]
imul ecx, ecx, 0x1000193
xor ecx, eax
movzx eax, byte [edx + 3]
imul ecx, ecx, 0x1000193
xor ecx, eax
imul eax, ecx, 0x1000193
mov ecx, esi
push eax
push edx
lea eax, [ebp - 8]
push eax
call fcn.10048b40
mov eax, dword [eax + 4]
test eax, eax
je 0x10048930
cmp eax, dword [esi + 4]
je 0x10048930
mov eax, dword [eax + 0xc]
pop esi
mov esp, ebp
pop ebp
ret
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x10048eb0
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100fcf15
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push ebx
push esi
push edi
mov eax, dword [0x1015f1d4]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov ebx, dword [ebp + 0xc]
movzx eax, byte [ebx]
xor eax, 0x811c9dc5
imul edx, eax, 0x1000193
movzx eax, byte [ebx + 1]
xor edx, eax
movzx eax, byte [ebx + 2]
imul edx, edx, 0x1000193
xor edx, eax
movzx eax, byte [ebx + 3]
imul ecx, edx, 0x1000193
xor ecx, eax
imul eax, ecx, 0x1000193
mov ecx, edi
push eax
mov dword [ebp + 0xc], eax
lea eax, [ebp - 0x1c]
push ebx
push eax
call fcn.10048b40
mov ecx, dword [ebp - 0x18]
test ecx, ecx
je 0x10048f43
mov eax, dword [ebp + 8]
mov dword [eax], ecx
mov byte [eax + 4], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
cmp dword [edi + 8], 0xfffffff
je 0x1004909f
lea eax, [edi + 4]
mov dword [ebp - 0x14], eax
push 0x10
mov dword [ebp - 4], 0
mov dword [ebp - 0x10], 0
call fcn.1004713b
mov ecx, dword [ebx]
mov esi, eax
mov edx, dword [ebx + 4]
add esp, 4
mov dword [ebp - 0x10], esi
mov dword [esi + 8], ecx
mov dword [esi + 0xc], edx
mov ecx, dword [edi + 8]
mov ebx, dword [edi + 0x1c]
movss xmm3, dword [edi]
mov dword [ebp - 4], 1
lea eax, [ecx + 1]
movd xmm0, eax
cvtdq2pd xmm0, xmm0
shr eax, 0x1f
addsd xmm0, qword [eax*8 + 0x10125870]
mov eax, ebx
shr eax, 0x1f
cvtpd2ps xmm2, xmm0
movd xmm0, ebx
cvtdq2pd xmm0, xmm0
movaps xmm1, xmm2
addsd xmm0, qword [eax*8 + 0x10125870]
cvtpd2ps xmm0, xmm0
divss xmm1, xmm0
comiss xmm1, xmm3
jbe 0x1004903e
divss xmm2, xmm3
sub esp, 8
cvtps2pd xmm0, xmm2
movsd qword [ebp - 0x1c], xmm0
fld qword [ebp - 0x1c]
fstp qword [esp]
call fcn.100e3d00
fstp qword [ebp - 0x1c]
movsd xmm0, qword [ebp - 0x1c]
add esp, 8
cvtpd2ps xmm0, xmm0
call fcn.10047ad0
mov ecx, 8
cmp eax, ecx
cmova ecx, eax
cmp ebx, ecx
jae 0x1004901d
cmp ebx, 0x200
jae 0x1004901b
shl ebx, 3
cmp ebx, ecx
jae 0x1004901d
mov ebx, ecx
push ebx
mov ecx, edi
call fcn.1004b1b0
push dword [ebp + 0xc]
lea eax, [esi + 8]
mov ecx, edi
push eax
lea eax, [ebp - 0x1c]
push eax
call fcn.10048b40
mov ecx, dword [edi + 8]
mov edx, dword [eax]
jmp 0x10049041
mov edx, dword [ebp - 0x1c]
mov ebx, dword [edx + 4]
lea eax, [ecx + 1]
mov dword [edi + 8], eax
mov dword [esi], edx
mov dword [esi + 4], ebx
mov dword [ebx], esi
mov dword [edx + 4], esi
mov eax, dword [edi + 0x18]
and eax, dword [ebp + 0xc]
mov ecx, dword [edi + 0xc]
mov esi, dword [ebp - 0x14]
mov edi, dword [ecx + eax*8]
cmp edi, dword [esi]
mov esi, dword [ebp - 0x10]
jne 0x1004906f
mov dword [ecx + eax*8], esi
jmp 0x1004907e
cmp edi, edx
jne 0x10049078
mov dword [ecx + eax*8], esi
jmp 0x10049082
cmp dword [ecx + eax*8 + 4], ebx
jne 0x10049082
mov dword [ecx + eax*8 + 4], esi
mov eax, dword [ebp + 8]
mov dword [eax], esi
mov byte [eax + 4], 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
push str.unordered_map_set_too_long
call fcn.10045c71
int3
Function at 0x1004b1b0
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov edx, dword [ebp + 8]
mov eax, 0x1fffffff
push ebx
mov ebx, ecx
bsr ecx, eax
push esi
push edi
mov edi, 1
mov dword [ebp - 0xc], ebx
mov eax, edi
shl eax, cl
cmp edx, eax
ja 0x1004b313
mov esi, dword [ebx + 4]
lea eax, [edx - 1]
or eax, edi
mov dword [ebp - 4], esi
bsr ecx, eax
push esi
lea ecx, [ecx + 1]
shl edi, cl
lea ecx, [ebx + 0xc]
lea eax, [edi + edi]
push eax
call fcn.1004b0b0
mov ecx, dword [ebx + 4]
lea eax, [edi - 1]
mov dword [ebx + 0x18], eax
mov dword [ebx + 0x1c], edi
mov ecx, dword [ecx]
mov edx, ecx
cmp ecx, esi
je 0x1004b2e6
movzx eax, byte [ecx + 8]
xor eax, 0x811c9dc5
mov edx, dword [edx]
imul edi, eax, 0x1000193
movzx eax, byte [ecx + 9]
xor edi, eax
movzx eax, byte [ecx + 0xa]
imul edi, edi, 0x1000193
xor edi, eax
movzx eax, byte [ecx + 0xb]
imul edi, edi, 0x1000193
xor edi, eax
imul eax, edi, 0x1000193
mov edi, dword [ebx + 0x18]
and edi, eax
mov eax, dword [ebx + 0xc]
mov ebx, dword [eax + edi*8]
mov dword [ebp + 8], ebx
lea eax, [eax + edi*8]
mov dword [ebp - 8], eax
cmp ebx, esi
jne 0x1004b266
mov dword [eax], ecx
mov dword [eax + 4], ecx
jmp 0x1004b2d9
mov eax, dword [eax + 4]
mov ebx, dword [ecx + 8]
cmp ebx, dword [eax + 8]
jne 0x1004b2a0
mov eax, dword [eax]
mov dword [ebp + 8], eax
cmp eax, ecx
je 0x1004b298
mov ebx, dword [ecx + 4]
mov esi, dword [ebp + 8]
mov dword [ebx], edx
mov edi, dword [edx + 4]
mov dword [edi], eax
mov eax, dword [eax + 4]
mov dword [eax], ecx
mov dword [esi + 4], edi
mov esi, dword [ebp - 4]
mov dword [edx + 4], ebx
mov dword [ecx + 4], eax
mov eax, dword [ebp - 8]
mov dword [eax + 4], ecx
jmp 0x1004b2d9
mov edi, eax
cmp dword [ebp + 8], eax
je 0x1004b2b6
mov eax, dword [eax + 4]
mov edi, eax
cmp ebx, dword [eax + 8]
je 0x1004b2ef
cmp dword [ebp + 8], eax
jne 0x1004b2a7
mov eax, dword [ecx + 4]
mov dword [ebp + 8], eax
mov dword [eax], edx
mov ebx, dword [edx + 4]
mov dword [ebx], edi
mov eax, dword [edi + 4]
mov dword [eax], ecx
mov dword [edi + 4], ebx
mov edi, dword [ebp + 8]
mov dword [edx + 4], edi
mov dword [ecx + 4], eax
mov eax, dword [ebp - 8]
mov dword [eax], ecx
mov ebx, dword [ebp - 0xc]
mov ecx, edx
cmp edx, esi
jne 0x1004b212
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
mov ebx, dword [ecx + 4]
mov eax, dword [eax]
mov dword [ebp + 8], eax
mov esi, eax
mov dword [ebx], edx
mov edi, dword [edx + 4]
mov dword [edi], eax
mov eax, dword [eax + 4]
mov dword [eax], ecx
mov dword [esi + 4], edi
mov esi, dword [ebp - 4]
mov dword [edx + 4], ebx
mov dword [ecx + 4], eax
jmp 0x1004b2d9
push str.invalid_hash_bucket_count
call fcn.10045c71
int3
Function at 0x10068220
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
push esi
push edi
mov esi, eax
cmp dword [eax + 0x14], 0x10
jb 0x10068232
mov esi, dword [eax]
mov edi, dword [eax + 0x10]
xor ecx, ecx
mov edx, 0x811c9dc5
test edi, edi
je 0x10068251
movzx eax, byte [ecx + esi]
inc ecx
xor eax, edx
imul edx, eax, 0x1000193
cmp ecx, edi
jb 0x10068240
pop edi
mov eax, edx
pop esi
pop ebp
ret 4

Function at 0x1006b400
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
xor ecx, ecx
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
mov edi, dword [ebp + 0xc]
mov edx, dword [edi + 4]
mov esi, dword [edi + 8]
add esi, edx
cmp edx, esi
jae 0x1006b42d
nop dword [eax]
movsx eax, byte [edx]
lea ecx, [ecx + ecx*4]
inc edx
add ecx, eax
cmp edx, esi
jb 0x1006b420
imul eax, dword [edi], 0x1000193
xor eax, ecx
mov ecx, ebx
push eax
push edi
lea eax, [ebp - 8]
push eax
call fcn.1006c950
mov eax, dword [eax + 4]
test eax, eax
je 0x1006b458
cmp eax, dword [ebx + 4]
je 0x1006b458
mov eax, dword [eax + 0x14]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x1006d8b0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov ecx, dword [ebp + 0x10]
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, dword [ebp + 0xc]
lea eax, [ecx - 1]
mov dword [ebp - 8], eax
mov edx, esi
sar eax, 1
mov dword [ebp - 4], eax
push edi
mov edi, esi
mov dword [ebp + 0xc], edi
cmp esi, eax
jge 0x1006d921
nop dword [eax + eax]
lea edi, [edx + edx]
push dword [ebx + edi*8 + 0xc]
push dword [ebx + edi*8 + 8]
push dword [ebx + edi*8 + 0x14]
push dword [ebx + edi*8 + 0x10]
call fcn.10071a20
movzx edx, al
add esp, 0x10
xor edx, 1
inc edx
add edx, edi
mov eax, dword [ebx + edx*8]
mov ecx, dword [ebx + edx*8 + 4]
mov dword [ebx + esi*8], eax
mov eax, dword [ebp - 4]
mov dword [ebx + esi*8 + 4], ecx
mov esi, edx
cmp edx, eax
jl 0x1006d8e0
mov edi, dword [ebp + 0xc]
mov ecx, dword [ebp + 0x10]
cmp edx, eax
jne 0x1006d93c
test cl, 1
jne 0x1006d93c
mov eax, dword [ebx + ecx*8 - 8]
mov ecx, dword [ebx + ecx*8 - 4]
mov dword [ebx + esi*8], eax
mov dword [ebx + esi*8 + 4], ecx
mov esi, dword [ebp - 8]
cmp edi, esi
jge 0x1006d975
mov eax, dword [ebp + 0x14]
lea edi, [esi - 1]
sar edi, 1
push dword [eax + 4]
push dword [eax]
push dword [ebx + edi*8 + 4]
push dword [ebx + edi*8]
call fcn.10071a20
add esp, 0x10
test al, al
je 0x1006d975
mov eax, dword [ebx + edi*8]
mov ecx, dword [ebx + edi*8 + 4]
mov dword [ebx + esi*8], eax
mov dword [ebx + esi*8 + 4], ecx
mov esi, edi
cmp dword [ebp + 0xc], edi
jl 0x1006d940
mov ecx, dword [ebp + 0x14]
pop edi
mov eax, dword [ecx]
mov ecx, dword [ecx + 4]
mov dword [ebx + esi*8], eax
mov dword [ebx + esi*8 + 4], ecx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1006e460
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100fedc5
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push ebx
push esi
push edi
mov eax, dword [0x1015f1d4]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov ecx, dword [ebp + 0xc]
xor edx, edx
mov esi, dword [ecx + 4]
mov edi, dword [ecx + 8]
add edi, esi
cmp esi, edi
jae 0x1006e4ad
nop dword [eax + eax]
movsx eax, byte [esi]
lea edx, [edx + edx*4]
inc esi
add edx, eax
cmp esi, edi
jb 0x1006e4a0
imul eax, dword [ecx], 0x1000193
xor eax, edx
push eax
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x18]
push ecx
push eax
mov ecx, ebx
call fcn.1006c950
mov ecx, dword [ebp - 0x14]
test ecx, ecx
je 0x1006e4e9
mov eax, dword [ebp + 8]
mov dword [eax], ecx
mov byte [eax + 4], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
cmp dword [ebx + 8], 0xaaaaaaa
je 0x1006e653
lea eax, [ebx + 4]
mov dword [ebp - 0x20], eax
push 0x18
mov dword [ebp - 4], 0
mov dword [ebp - 0x1c], 0
call fcn.1004713b
mov ecx, dword [ebp + 0xc]
mov esi, eax
add esp, 4
mov dword [ebp - 0x1c], esi
movq xmm0, qword [ecx]
movq qword [esi + 8], xmm0
mov ecx, dword [ecx + 8]
mov dword [esi + 0x10], ecx
mov dword [esi + 0x14], 0
mov eax, dword [ebx + 8]
mov edi, dword [ebx + 0x1c]
inc eax
movss xmm3, dword [ebx]
mov dword [ebp - 4], 1
movd xmm0, eax
cvtdq2pd xmm0, xmm0
shr eax, 0x1f
addsd xmm0, qword [eax*8 + 0x10125870]
mov eax, edi
shr eax, 0x1f
cvtpd2ps xmm2, xmm0
movd xmm0, edi
cvtdq2pd xmm0, xmm0
movaps xmm1, xmm2
addsd xmm0, qword [eax*8 + 0x10125870]
cvtpd2ps xmm0, xmm0
divss xmm1, xmm0
comiss xmm1, xmm3
jbe 0x1006e5ee
divss xmm2, xmm3
sub esp, 8
cvtps2pd xmm0, xmm2
movsd qword [ebp - 0x18], xmm0
fld qword [ebp - 0x18]
fstp qword [esp]
call fcn.100e3d00
fstp qword [ebp - 0x18]
movsd xmm0, qword [ebp - 0x18]
add esp, 8
cvtpd2ps xmm0, xmm0
call fcn.10047ad0
mov ecx, 8
cmp eax, ecx
cmova ecx, eax
cmp edi, ecx
jae 0x1006e5cf
cmp edi, 0x200
jae 0x1006e5cd
shl edi, 3
cmp edi, ecx
jae 0x1006e5cf
mov edi, ecx
push edi
mov ecx, ebx
call fcn.100943d0
mov edi, dword [ebp - 0x10]
lea eax, [esi + 8]
push edi
push eax
lea eax, [ebp - 0x20]
mov ecx, ebx
push eax
call fcn.1006c950
mov edx, dword [eax]
jmp 0x1006e5f4
mov edx, dword [ebp - 0x18]
mov edi, dword [ebp - 0x10]
mov eax, dword [ebx + 8]
mov ecx, dword [edx + 4]
inc eax
mov dword [ebx + 8], eax
mov dword [esi], edx
mov dword [esi + 4], ecx
mov dword [ecx], esi
mov dword [edx + 4], esi
mov eax, dword [ebx + 0x18]
mov dword [ebp + 0xc], ecx
and eax, edi
mov ecx, dword [ebx + 0xc]
mov edi, dword [ecx + eax*8]
cmp edi, dword [ebx + 4]
jne 0x1006e620
mov dword [ecx + eax*8], esi
jmp 0x1006e632
cmp edi, edx
jne 0x1006e629
mov dword [ecx + eax*8], esi
jmp 0x1006e636
mov edx, dword [ebp + 0xc]
cmp dword [ecx + eax*8 + 4], edx
jne 0x1006e636
mov dword [ecx + eax*8 + 4], esi
mov eax, dword [ebp + 8]
mov dword [eax], esi
mov byte [eax + 4], 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
push str.unordered_map_set_too_long
call fcn.10045c71
int3