joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40adc0
Capabilities:
Clear file content

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1014
call fcn.00404730
push ebx
push esi
push edi
mov ebx, dword [ebp + 8]
mov dword [ebp - 4], 0
mov eax, dword [0x4170bc]
cmp ebx, eax
jae 0x40adfb
mov eax, ebx
and eax, 0x1f
mov edx, ebx
sar edx, 5
mov edx, dword [edx*4 + 0x4170c0]
test byte [edx + eax*8 + 4], 1
jne 0x40ae0d
mov dword [0x415c84], 9
or eax, 0xffffffff
jmp 0x40af32
push 1
push 0
push ebx
call fcn.00409fd0
add esp, 0xc
mov dword [ebp - 0xc], eax
cmp eax, 0xffffffff
je 0x40ae37
push 2
push 0
push ebx
call fcn.00409fd0
add esp, 0xc
mov dword [ebp - 8], eax
cmp eax, 0xffffffff
jne 0x40ae3f
or eax, 0xffffffff
jmp 0x40af32
mov eax, dword [ebp + 0xc]
mov esi, eax
sub esi, dword [ebp - 8]
test esi, esi
jle 0x40aee4
lea edx, [ebp - 0x1010]
mov ecx, 0x1000
xor eax, eax
push edi
mov edi, edx
rep stosb byte es:[edi], al
pop edi
mov eax, edx
push 0x8000
push ebx
call fcn.0040b330
add esp, 8
mov dword [ebp - 0x10], eax
mov eax, esi
cmp eax, 0x1000
jb 0x40ae8a
mov dword [ebp - 0x1014], 0x1000
jmp 0x40ae92
mov eax, esi
mov dword [ebp - 0x1014], eax
mov eax, dword [ebp - 0x1014]
push eax
lea eax, [ebp - 0x1010]
push eax
push ebx
call fcn.004086d0
add esp, 0xc
mov edi, eax
cmp eax, 0xffffffff
jne 0x40aecb
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 5
jne 0x40aec5
mov dword [0x415c84], 0xd
or dword [ebp - 4], 0xffffffff
jmp 0x40aed5
mov eax, esi
sub eax, edi
mov esi, eax
test eax, eax
jg 0x40ae75
mov eax, dword [ebp - 0x10]
push eax
push ebx
call fcn.0040b330
add esp, 8
jmp 0x40af20
test esi, esi
jge 0x40af20
push 0
mov eax, dword [ebp + 0xc]
push eax
push ebx
call fcn.00409fd0
add esp, 0xc
push ebx
call fcn.00408b00
pop ecx
push eax
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
test eax, eax
setne al
and eax, 1
dec eax
mov dword [ebp - 4], eax
cmp eax, 0xffffffff
jne 0x40af20
mov dword [0x415c84], 0xd
push 0
mov eax, dword [ebp - 0xc]
push eax
push ebx
call fcn.00409fd0
add esp, 0xc
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..text
mov ebx, 0x408ecc
nop
mov ecx, 0x48585c6d
nop
nop
test eax, eax
nop
nop
nop
nop
nop
nop
je 0x43004e
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
cmp eax, ebx
nop
nop
nop
nop
nop
jne 0x430024
nop
nop
mov eax, section..rdata
nop
nop
mov ebx, 0x42e1d0
nop
mov ecx, 0x11ba2234
nop
test eax, eax
nop
nop
nop
nop
nop
nop
nop
je 0x430084
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
add eax, 4
nop
nop
nop
nop
cmp eax, ebx
nop
jne 0x43006c
nop
nop
nop
nop
popal
nop
nop
nop
nop
nop
jmp 0x401219
Function at 0x100180c0
Capabilities:
Access peb ldr_data
Check for peb beingdebugged flag

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100e3164
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x10112040]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
push 0x10
call fcn.100e1979
push 8
mov byte [eax], 1
mov dword [eax + 4], 0
mov dword [eax + 8], 0x45
mov byte [eax + 0xc], 1
mov dword [edi], eax
call fcn.100e1979
push 0x48
mov dword [eax], 1
mov dword [eax + 4], 0x1000101
mov dword [edi + 4], eax
call fcn.100e1979
push 0x30
mov dword [eax], 1
mov dword [eax + 4], 1
mov dword [eax + 8], 1
mov dword [eax + 0xc], 1
mov dword [eax + 0x10], 1
mov dword [eax + 0x14], 1
mov dword [eax + 0x18], 1
mov dword [eax + 0x1c], 1
mov dword [eax + 0x20], 1
mov dword [eax + 0x24], 1
mov dword [eax + 0x28], 1
mov dword [eax + 0x2c], 1
mov dword [eax + 0x30], 5
mov dword [eax + 0x34], 4
mov dword [eax + 0x38], 2
mov dword [eax + 0x3c], 2
mov dword [eax + 0x40], 1
mov dword [eax + 0x44], 1
mov dword [edi + 8], eax
call fcn.100e1979
mov esi, eax
mov dword [ebp - 0x10], esi
mov dword [ebp - 4], 0
push 0x10
mov dword [esi], 0x1010000
mov dword [esi + 4], 0
mov word [esi + 8], 1
mov byte [esi + 0xa], 0
mov dword [esi + 0xc], 0xb4
mov dword [esi + 0x10], 0
mov byte [esi + 0x14], 0
mov dword [esi + 0x18], 0xa
mov dword [esi + 0x1c], 0x48
mov dword [esi + 0x20], 0x2a
mov dword [esi + 0x24], 0x1010101
mov byte [esi + 0x28], 1
call fcn.100e1979
vmovss xmm0, dword [0x10100c8c]
push 3
vmovss dword [eax + 4], xmm0
vmovss xmm0, dword [0x10100bc8]
vmovss dword [eax + 8], xmm0
vmovss xmm0, dword [0x10100d54]
mov byte [eax], 0
vmovss dword [eax + 0xc], xmm0
mov dword [esi + 0x2c], eax
mov dword [ebp - 4], 0xffffffff
mov dword [edi + 0xc], esi
call fcn.100e1979
push 0x30
mov word [eax], 1
mov byte [eax + 2], 1
mov dword [edi + 0x10], eax
call fcn.100e1979
vmovss xmm0, dword [0x10100cac]
add esp, 0x1c
vmovss dword [eax], xmm0
vmovss xmm0, dword [0x10100c9c]
vmovss dword [eax + 4], xmm0
vmovss xmm0, dword [0x10100c5c]
mov dword [eax + 8], 0x1010001
vmovss dword [eax + 0xc], xmm0
mov dword [eax + 0x10], 0x19
mov dword [eax + 0x14], 0
mov dword [eax + 0x18], 0
mov dword [eax + 0x1c], 0
mov dword [eax + 0x20], 0
mov byte [eax + 0x24], 0
mov dword [eax + 0x28], 0x78
mov dword [eax + 0x2c], 0x14
mov dword [edi + 0x14], eax
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x100182e0
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100e31a3
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x10112040]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
vmovss xmm1, dword [0x10100bc8]
vxorps xmm0, xmm0, xmm0
vmovss dword [esi + 0x28], xmm0
vmovss xmm0, dword [0x10100bf0]
vmovss dword [esi + 0x2c], xmm0
vmovss xmm0, dword [0x10100c6c]
vmovss dword [esi + 0x38], xmm0
vmovss dword [esi + 0x44], xmm0
vmovss xmm0, dword [0x10100b98]
vmovss dword [esi + 0x4c], xmm0
vmovss xmm0, dword [0x10100b64]
vmovss dword [esi + 0x54], xmm0
vmovss xmm0, dword [0x10100b94]
vmovss dword [esi + 0x8c], xmm0
vmovss xmm0, dword [0x10100bdc]
vmovss dword [esi + 0x98], xmm0
lea ecx, [esi + 0xb0]
mov dword [esi], 0x78
mov dword [esi + 4], 0x78
mov dword [esi + 8], 0x1010101
mov byte [esi + 0xc], 1
mov dword [esi + 0x10], 0
mov byte [esi + 0x14], 0
mov dword [esi + 0x18], 0
mov dword [esi + 0x1c], 0
mov dword [esi + 0x20], 0
mov dword [esi + 0x24], 0
mov word [esi + 0x30], 0
mov byte [esi + 0x32], 0
vmovss dword [esi + 0x34], xmm1
mov word [esi + 0x3c], 0
vmovss dword [esi + 0x40], xmm1
mov word [esi + 0x48], 0
mov word [esi + 0x50], 0x100
mov byte [esi + 0x52], 0
mov word [esi + 0x58], 0
mov dword [esi + 0x5c], 0x5a
mov dword [esi + 0x60], 0
mov dword [esi + 0x64], 0
mov dword [esi + 0x68], 0
mov dword [esi + 0x6c], 0
mov byte [esi + 0x70], 0
mov dword [esi + 0x74], 0
vmovss dword [esi + 0x78], xmm1
mov word [esi + 0x7c], 0
mov byte [esi + 0x7e], 0
mov dword [esi + 0x80], 0
vmovss dword [esi + 0x84], xmm1
mov word [esi + 0x88], 0x100
mov dword [esi + 0x90], 0
mov byte [esi + 0x94], 0
mov byte [esi + 0x9c], 0
mov dword [esi + 0xa0], 0x50
mov dword [esi + 0xa4], 0x12c
mov dword [esi + 0xa8], 0x12c
mov dword [esi + 0xac], 0
vpxor xmm0, xmm0, xmm0
push 0
vmovdqu xmmword [ecx], xmm0
push 0x100f6ad3
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 0
call fcn.1001b660
mov dword [ebp - 4], 0
push 1
mov dword [esi + 0xc8], 0
mov word [esi + 0xcc], 0
mov dword [esi + 0xd0], 0x96
mov dword [esi + 0xd4], 8
mov dword [esi + 0xd8], 0
mov byte [esi + 0xdc], 0
mov dword [esi + 0xe0], 1
mov word [esi + 0xe4], 0
mov byte [esi + 0xe6], 0
call fcn.100e1979
push 0x14
mov byte [eax], 1
mov dword [esi + 0xe8], eax
call fcn.100e1979
mov byte [eax], 0
vmovss xmm0, dword [0x10100b98]
vmovss dword [eax + 0xc], xmm0
vmovss xmm0, dword [0x10100bf0]
mov dword [eax + 4], 0
mov word [eax + 8], 0x101
vmovss dword [eax + 0x10], xmm0
push 0xc
mov dword [esi + 0xec], eax
call fcn.100e1979
add esp, 0xc
mov byte [eax], 1
mov dword [eax + 4], 0
mov dword [eax + 8], 0x1010101
mov dword [esi + 0xf0], eax
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x10018580
Capabilities:
Access peb ldr_data
Check for peb beingdebugged flag

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100e31f2
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x10112040]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
push 0x14
mov word [edi], 0x101
mov byte [edi + 2], 1
mov dword [edi + 4], 0
mov word [edi + 8], 0x101
mov byte [edi + 0xa], 1
mov dword [edi + 0xc], 0
mov byte [edi + 0x10], 0
mov dword [edi + 0x14], 0
mov word [edi + 0x18], 0x101
mov byte [edi + 0x1a], 1
mov dword [edi + 0x1c], 0
mov byte [edi + 0x20], 1
call fcn.100e1979
vmovss xmm0, dword [0x10100b98]
push 8
mov dword [eax], 0
vmovss dword [eax + 4], xmm0
mov dword [eax + 8], 0x15
mov dword [eax + 0xc], 0
mov dword [eax + 0x10], 0x1010101
mov dword [edi + 0x24], eax
call fcn.100e1979
push 0x5c
mov byte [eax], 1
mov dword [eax + 4], 0
mov dword [edi + 0x28], eax
call fcn.100e1979
vmovss xmm0, dword [0x10100b98]
push 0x2c
mov dword [eax], 0
vmovss dword [eax + 4], xmm0
mov byte [eax + 8], 0
mov dword [eax + 0xc], 0
mov dword [eax + 0x10], 0
mov dword [eax + 0x14], 0
mov dword [eax + 0x18], 0
mov dword [eax + 0x1c], 0
mov dword [eax + 0x20], 3
mov dword [eax + 0x24], 0xa
mov dword [eax + 0x28], 3
mov dword [eax + 0x2c], 0x4a
mov dword [eax + 0x30], 0x68
mov dword [eax + 0x34], 0
mov dword [eax + 0x38], 0
mov dword [eax + 0x3c], 3
mov dword [eax + 0x40], 0xa
mov dword [eax + 0x44], 3
mov dword [eax + 0x48], 0x4a
mov dword [eax + 0x4c], 0x68
mov dword [eax + 0x50], 0
mov byte [eax + 0x54], 0
mov dword [eax + 0x58], 0
mov dword [edi + 0x2c], eax
call fcn.100e1979
mov esi, eax
mov dword [ebp - 0x10], esi
mov dword [ebp - 4], 0
push 3
mov byte [esi], 1
mov dword [esi + 4], 0
mov dword [esi + 8], 0
mov dword [esi + 0xc], 0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 2
mov dword [esi + 0x18], 0
mov dword [esi + 0x1c], 2
mov dword [esi + 0x20], 0x10001
mov byte [esi + 0x24], 0
call fcn.100e1979
mov dword [ebp - 4], 0xffffffff
push 0x1c
mov word [eax], 0x101
mov byte [eax + 2], 0
mov dword [esi + 0x28], eax
mov dword [edi + 0x30], esi
call fcn.100e1979
mov esi, eax
mov dword [ebp - 0x10], esi
mov dword [ebp - 4], 1
push 2
mov byte [esi], 1
mov dword [esi + 4], 0
mov byte [esi + 8], 0
mov dword [esi + 0xc], 0
mov dword [esi + 0x10], 0x1000101
mov byte [esi + 0x14], 0
call fcn.100e1979
mov dword [ebp - 4], 0xffffffff
push 2
mov word [eax], 0x101
mov dword [esi + 0x18], eax
mov dword [edi + 0x34], esi
call fcn.100e1979
push 8
mov word [eax], 0x101
mov dword [edi + 0x38], eax
call fcn.100e1979
mov esi, eax
mov dword [ebp - 0x10], esi
mov dword [ebp - 4], 2
push 0x10
mov word [esi], 0
call fcn.100e1979
add esp, 0x28
mov dword [eax], 0
mov dword [eax + 4], 0
mov dword [eax + 8], 0
mov dword [eax + 0xc], 0
mov dword [esi + 4], eax
mov eax, edi
mov dword [edi + 0x3c], esi
mov dword [edi + 0x40], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x1001a180
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_DisableThreadLibraryCalls]
cmp dword [ebp + 0xc], 1
jne 0x1001a1b3
push 0
push 0
push dword [ebp + 8]
push 0x1001a0e0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
test eax, eax
je 0x1001a1b3
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 1
pop ebp
ret 0xc
Function at 0x10026140
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
sub esp, 0x18
mov edx, dword [ebp + 8]
push ebx
mov ebx, ecx
cmp edx, eax
je 0x10026296
mov eax, dword [ebx + 4]
mov dword [ebp - 0x14], eax
mov eax, dword [edx + 4]
mov dword [ebp - 8], eax
movzx eax, byte [edx + 8]
xor eax, 0x811c9dc5
imul ecx, eax, 0x1000193
movzx eax, byte [edx + 9]
push esi
push edi
mov edi, dword [ebx + 0xc]
mov esi, edx
xor ecx, eax
mov dword [ebp - 0x18], edi
movzx eax, byte [edx + 0xa]
imul ecx, ecx, 0x1000193
xor ecx, eax
movzx eax, byte [edx + 0xb]
imul ecx, ecx, 0x1000193
xor ecx, eax
mov eax, dword [ebx + 0x18]
imul ecx, ecx, 0x1000193
and eax, ecx
mov ecx, dword [edi + eax*8]
mov dword [ebp - 4], ecx
lea eax, [edi + eax*8]
mov dword [ebp - 0xc], eax
mov eax, dword [eax + 4]
mov dword [ebp - 0x10], eax
mov eax, esi
mov edi, esi
mov esi, dword [esi]
push 0x10
push eax
call fcn.100e1ddd
dec dword [ebx + 8]
add esp, 8
cmp edi, dword [ebp - 0x10]
je 0x100261f9
mov eax, dword [ebp + 0xc]
cmp esi, eax
jne 0x100261b7
mov ecx, dword [ebp - 4]
cmp ecx, dword [ebp + 8]
jne 0x1002628c
mov edx, dword [ebp - 0xc]
mov ecx, dword [ebp - 8]
pop edi
mov dword [edx], esi
mov dword [ecx], esi
mov dword [esi + 4], ecx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
mov ecx, dword [ebp - 4]
mov edx, dword [ebp - 0xc]
cmp ecx, dword [ebp + 8]
jne 0x1002620d
mov eax, dword [ebp - 0x14]
mov ecx, eax
mov dword [edx], eax
jmp 0x10026210
mov ecx, dword [ebp - 8]
mov eax, dword [ebp + 0xc]
mov dword [edx + 4], ecx
cmp esi, eax
je 0x1002628c
nop word [eax + eax]
movzx eax, byte [esi + 8]
xor eax, 0x811c9dc5
imul ecx, eax, 0x1000193
movzx eax, byte [esi + 9]
xor ecx, eax
movzx eax, byte [esi + 0xa]
imul ecx, ecx, 0x1000193
xor ecx, eax
movzx eax, byte [esi + 0xb]
imul ecx, ecx, 0x1000193
xor ecx, eax
mov eax, dword [ebx + 0x18]
imul ecx, ecx, 0x1000193
and eax, ecx
mov ecx, dword [ebp - 0x18]
lea eax, [ecx + eax*8]
mov dword [ebp - 4], eax
mov eax, dword [eax + 4]
mov dword [ebp - 0x10], eax
mov eax, esi
mov edi, esi
mov esi, dword [esi]
push 0x10
push eax
call fcn.100e1ddd
dec dword [ebx + 8]
add esp, 8
mov eax, dword [ebp + 0xc]
cmp edi, dword [ebp - 0x10]
je 0x1002629d
cmp esi, eax
jne 0x10026267
mov ecx, dword [ebp - 4]
mov dword [ecx], esi
mov ecx, dword [ebp - 8]
pop edi
mov dword [ecx], esi
mov dword [esi + 4], ecx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
mov ecx, dword [ebp - 4]
mov edx, dword [ebp - 0x14]
mov dword [ecx], edx
mov dword [ecx + 4], edx
cmp esi, eax
jne 0x10026220
mov ecx, dword [ebp - 8]
pop edi
mov dword [ecx], esi
mov dword [esi + 4], ecx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x1002eec0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100e4b3f
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x10112040]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
vpxor xmm0, xmm0, xmm0
mov dword [esi], 0xc8
mov dword [esi + 4], 0xc8
mov dword [esi + 8], 0x1f7
mov dword [esi + 0xc], 0x1ae
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
mov dword [esi + 0x18], 0
mov dword [esi + 0x1c], 0
mov byte [esi + 0x20], 0
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x2c], 0
mov dword [esi + 0x30], 0
vmovups ymmword [esi + 0x34], ymm0
vmovdqu xmmword [esi + 0x54], xmm0
mov dword [esi + 0x64], 0
mov dword [esi + 0x68], 0
mov dword [esi + 0x6c], 0
mov dword [esi + 0x70], 0
mov dword [esi + 0x74], 0
push 0x30
vzeroupper
call fcn.100e1979
vpxor xmm0, xmm0, xmm0
push 0x18
mov dword [eax], 0
vmovdqu xmmword [eax + 4], xmm0
vmovss dword [eax + 0x14], xmm0
vmovq qword [eax + 0x18], xmm0
mov dword [eax + 0x20], 0
vmovq qword [eax + 0x24], xmm0
mov dword [eax + 0x2c], 0
mov dword [esi + 0x78], eax
mov byte [esi + 0x7c], 0
call fcn.100e1979
vpxor xmm0, xmm0, xmm0
push 0x18
mov dword [eax], 0
vmovdqu xmmword [eax + 4], xmm0
vmovss dword [eax + 0x14], xmm0
mov dword [esi + 0x80], eax
call fcn.100e1979
vpxor xmm0, xmm0, xmm0
push 0x24
mov dword [eax], 0
vmovdqu xmmword [eax + 4], xmm0
vmovss dword [eax + 0x14], xmm0
mov dword [esi + 0x84], eax
call fcn.100e1979
vpxor xmm0, xmm0, xmm0
push 0x24
mov dword [eax + 4], 0
mov dword [eax + 8], 0
mov dword [eax + 0xc], 0
mov dword [eax], 0
vmovdqu xmmword [eax + 0x10], xmm0
vmovss dword [eax + 0x20], xmm0
mov dword [esi + 0x88], eax
call fcn.100e1979
vpxor xmm0, xmm0, xmm0
add esp, 0x14
mov dword [eax + 4], 0
mov dword [eax + 8], 0
mov dword [eax + 0xc], 0
mov dword [eax], 0
vmovdqu xmmword [eax + 0x10], xmm0
vmovss dword [eax + 0x20], xmm0
mov dword [esi + 0x8c], eax
vmovdqu xmmword [esi + 0x90], xmm0
mov dword [esi + 0xa0], 0
mov dword [esi + 0xa4], 0xf
mov byte [esi + 0x90], 0
mov dword [ebp - 4], 0
mov dword [esi + 0xa8], 0
mov dword [esi + 0xac], 0
mov dword [esi + 0xb0], 0
mov dword [esi + 0xb4], 0
mov dword [esi + 0xb8], 0
mov byte [ebp - 4], 1
lea ecx, [esi + 0xc0]
push 0x100f6ad3
mov word [esi + 0xbc], 0
call fcn.1001acc0
push 0x100f6ad3
lea ecx, [esi + 0xd8]
mov byte [ebp - 4], 2
call fcn.1001acc0
vpxor xmm0, xmm0, xmm0
vmovdqu xmmword [esi + 0xf0], xmm0
mov dword [esi + 0x100], 0
mov eax, esi
mov dword [esi + 0x104], 0xf
mov byte [esi + 0xf0], 0
vmovdqu xmmword [esi + 0x108], xmm0
mov dword [esi + 0x118], 0
mov dword [esi + 0x11c], 0xf
mov byte [esi + 0x108], 0
mov word [esi + 0x120], 0
mov dword [esi + 0x124], 0
mov dword [esi + 0x128], 0
mov dword [esi + 0x12c], 0
mov dword [esi + 0x130], 0
mov dword [esi + 0x134], 0
mov dword [esi + 0x138], 0
mov dword [esi + 0x13c], 0
mov dword [esi + 0x140], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x10035d80
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [ebp + 0xc]
mov edx, ecx
push ebx
mov ebx, dword [ebp + 8]
mov dword [ebp - 0x14], edx
cmp ebx, eax
je 0x10035ef1
mov eax, dword [edx + 4]
mov dword [ebp - 0x18], eax
mov eax, dword [ebx + 4]
mov dword [ebp - 8], eax
movzx eax, byte [ebx + 8]
xor eax, 0x811c9dc5
imul ecx, eax, 0x1000193
movzx eax, byte [ebx + 9]
push esi
push edi
mov edi, dword [edx + 0xc]
mov esi, ebx
xor ecx, eax
mov dword [ebp - 0x1c], edi
movzx eax, byte [ebx + 0xa]
imul ecx, ecx, 0x1000193
xor ecx, eax
movzx eax, byte [ebx + 0xb]
imul ecx, ecx, 0x1000193
xor ecx, eax
mov eax, dword [edx + 0x18]
imul ecx, ecx, 0x1000193
and eax, ecx
mov ecx, dword [edi + eax*8]
mov dword [ebp - 4], ecx
lea eax, [edi + eax*8]
mov dword [ebp - 0xc], eax
mov eax, dword [eax + 4]
mov dword [ebp - 0x10], eax
nop word [eax + eax]
mov edi, esi
mov ebx, esi
mov esi, dword [esi]
lea ecx, [edi + 0xc]
call fcn.10033220
push 0x18
push edi
call fcn.100e1ddd
mov edx, dword [ebp - 0x14]
add esp, 8
dec dword [edx + 8]
cmp ebx, dword [ebp - 0x10]
je 0x10035e4d
mov eax, dword [ebp + 0xc]
cmp esi, eax
jne 0x10035e00
mov ecx, dword [ebp - 4]
cmp ecx, dword [ebp + 8]
jne 0x10035ee7
mov edi, dword [ebp - 0xc]
mov ecx, dword [ebp - 8]
mov dword [edi], esi
mov dword [ecx], esi
pop edi
mov dword [esi + 4], ecx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
mov ecx, dword [ebp - 4]
mov edi, dword [ebp - 0xc]
cmp ecx, dword [ebp + 8]
jne 0x10035e61
mov eax, dword [ebp - 0x18]
mov ecx, eax
mov dword [edi], eax
jmp 0x10035e64
mov ecx, dword [ebp - 8]
mov eax, dword [ebp + 0xc]
mov dword [edi + 4], ecx
cmp esi, eax
je 0x10035ee7
nop
movzx eax, byte [esi + 8]
xor eax, 0x811c9dc5
imul ecx, eax, 0x1000193
movzx eax, byte [esi + 9]
xor ecx, eax
movzx eax, byte [esi + 0xa]
imul ecx, ecx, 0x1000193
xor ecx, eax
movzx eax, byte [esi + 0xb]
imul ecx, ecx, 0x1000193
xor ecx, eax
mov eax, dword [edx + 0x18]
imul ecx, ecx, 0x1000193
and eax, ecx
mov ecx, dword [ebp - 0x1c]
lea eax, [ecx + eax*8]
mov dword [ebp - 4], eax
mov eax, dword [eax + 4]
mov dword [ebp - 0x10], eax
mov edi, esi
mov ebx, esi
mov esi, dword [esi]
lea ecx, [edi + 0xc]
call fcn.10033220
push 0x18
push edi
call fcn.100e1ddd
mov edx, dword [ebp - 0x14]
add esp, 8
mov eax, dword [ebp + 0xc]
dec dword [edx + 8]
cmp ebx, dword [ebp - 0x10]
je 0x10035ef8
cmp esi, eax
jne 0x10035eb7
mov ecx, dword [ebp - 4]
mov dword [ecx], esi
mov ecx, dword [ebp - 8]
pop edi
mov dword [ecx], esi
mov dword [esi + 4], ecx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
mov ecx, dword [ebp - 4]
mov ebx, dword [ebp - 0x18]
mov dword [ecx], ebx
mov dword [ecx + 4], ebx
cmp esi, eax
jne 0x10035e70
mov ecx, dword [ebp - 8]
pop edi
mov dword [ecx], esi
mov dword [esi + 4], ecx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x10045f90
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100e5d95
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
push ebx
push esi
push edi
mov eax, dword [0x10112040]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov edx, dword [ebp + 0xc]
mov edi, dword [ebp + 8]
mov dword [ebp - 0x10], edx
mov dword [ebp - 0x20], edi
movzx eax, byte [edx]
xor eax, 0x811c9dc5
imul ecx, eax, 0x1000193
movzx eax, byte [edx + 1]
xor ecx, eax
movzx eax, byte [edx + 2]
imul ecx, ecx, 0x1000193
xor ecx, eax
movzx eax, byte [edx + 3]
imul ecx, ecx, 0x1000193
xor ecx, eax
imul eax, ecx, 0x1000193
mov ecx, ebx
push eax
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x1c]
push edx
push eax
call fcn.10046a30
mov eax, dword [ebp - 0x18]
test eax, eax
je 0x1004601a
mov dword [edi], eax
mov byte [edi + 4], 0
jmp 0x10046143
cmp dword [ebx + 8], 0xfffffff
jne 0x1004602e
push str.unordered_map_set_too_long
call dword [sym.imp.MSVCP140.dll_void___cdecl_std::_Xlength_error_char_const__]
lea eax, [ebx + 4]
mov dword [ebp - 0x28], eax
mov dword [ebp - 4], 0
push 0x10
mov dword [ebp - 0x24], 0
call fcn.100e1979
mov ecx, dword [ebp - 0x10]
mov esi, eax
add esp, 4
mov dword [ebp - 0x24], esi
mov ecx, dword [ecx]
mov dword [esi + 8], ecx
mov byte [esi + 0xc], 0
mov dword [ebp - 4], 1
mov eax, dword [ebx + 8]
vmovss xmm1, dword [ebx]
vxorps xmm0, xmm0, xmm0
inc eax
vcvtsi2sd xmm0, xmm0, eax
shr eax, 0x1f
vaddsd xmm0, xmm0, qword [eax*8 + 0x10100f20]
mov eax, dword [ebx + 0x1c]
vcvtsd2ss xmm2, xmm0, xmm0
vxorps xmm0, xmm0, xmm0
vcvtsi2sd xmm0, xmm0, eax
shr eax, 0x1f
vaddsd xmm0, xmm0, qword [eax*8 + 0x10100f20]
vcvtsd2ss xmm0, xmm0, xmm0
vdivss xmm0, xmm2, xmm0
vcomiss xmm0, xmm1
jbe 0x100460f6
vdivss xmm0, xmm2, xmm1
call fcn.100252f0
call fcn.100e2cd0
mov ecx, 8
cmp eax, ecx
cmova ecx, eax
mov eax, dword [ebx + 0x1c]
cmp eax, ecx
jae 0x100460d8
cmp eax, 0x200
jae 0x100460d6
shl eax, 3
cmp eax, ecx
jae 0x100460d8
mov eax, ecx
push eax
mov ecx, ebx
call fcn.10040ea0
push dword [ebp - 0x14]
lea eax, [esi + 8]
mov ecx, ebx
push eax
lea eax, [ebp - 0x1c]
push eax
call fcn.10046a30
mov edx, dword [eax]
jmp 0x100460f9
mov edx, dword [ebp - 0x1c]
mov eax, dword [edx + 4]
inc dword [ebx + 8]
mov edi, dword [ebp - 0x28]
mov dword [esi + 4], eax
mov dword [esi], edx
mov dword [eax], esi
mov dword [edx + 4], esi
mov ecx, dword [ebx + 0xc]
mov dword [ebp - 0x10], eax
mov eax, dword [ebx + 0x18]
and eax, dword [ebp - 0x14]
mov ebx, dword [ecx + eax*8]
cmp ebx, dword [edi]
jne 0x10046124
mov dword [ecx + eax*8], esi
jmp 0x10046136
cmp ebx, edx
jne 0x1004612d
mov dword [ecx + eax*8], esi
jmp 0x1004613a
mov edx, dword [ebp - 0x10]
cmp dword [ecx + eax*8 + 4], edx
jne 0x1004613a
mov dword [ecx + eax*8 + 4], esi
mov edi, dword [ebp - 0x20]
mov dword [edi], esi
mov byte [edi + 4], 1
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8