joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100fe640
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov edx, 0xcbf29ce4
xor esi, esi
mov dword [ebp - 4], edx
mov ecx, 0x84222325
cmp byte [edi], 0
je 0x100fe667
nop
inc esi
cmp byte [esi + edi], 0
jne 0x100fe660
xor ebx, ebx
test esi, esi
je 0x100fe695
nop dword [eax]
movsx eax, byte [ebx + edi]
push 0x100
cdq
xor edx, dword [ebp - 4]
xor eax, ecx
push 0x1b3
push edx
push eax
call fcn.10155b50
inc ebx
mov dword [ebp - 4], edx
mov ecx, eax
cmp ebx, esi
jb 0x100fe670
pop edi
pop esi
mov eax, ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10105a60
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
cmp byte [0x1020a005], 0
mov dword [ebp - 4], ecx
je 0x10105beb
mov ecx, dword [ebp + 8]
push ebx
push esi
push edi
mov eax, dword [ecx]
call dword [eax + 4]
mov ebx, eax
xor esi, esi
mov ecx, 0x84222325
mov edi, 0xcbf29ce4
cmp byte [ebx], 0
je 0x10105a9b
inc esi
cmp byte [esi + ebx], 0
jne 0x10105a94
xor eax, eax
mov dword [ebp - 8], eax
test esi, esi
je 0x10105be8
nop dword [eax + eax]
movsx eax, byte [eax + ebx]
push 0x100
cdq
push 0x1b3
xor edx, edi
xor eax, ecx
push edx
push eax
call fcn.10155b50
mov ecx, eax
mov edi, edx
mov eax, dword [ebp - 8]
inc eax
mov dword [ebp - 8], eax
cmp eax, esi
jb 0x10105ab0
cmp edi, 0x3943e50e
ja 0x10105bcd
jb 0x10105af3
cmp ecx, 0x2bb2e9fe
ja 0x10105bcd
cmp ecx, 0x2bb2e9fe
jne 0x10105b85
cmp edi, 0x3943e50e
jne 0x10105b85
mov ecx, dword [0x1020a080]
test ecx, ecx
je 0x10105be8
mov eax, dword [0x10332e40]
test al, 1
jne 0x10105b32
or eax, 1
mov dword [0x10332e40], eax
mov eax, dword [0x10332e34]
mov dword [0x10332e3c], eax
jmp 0x10105b37
mov eax, dword [0x10332e3c]
cmp dword [eax + ecx], 0
jne 0x10105be8
mov eax, dword [0x10332e48]
test al, 1
jne 0x10105b5e
or eax, 1
mov dword [0x10332e48], eax
mov eax, dword [0x10332e30]
mov dword [0x10332e44], eax
jmp 0x10105b63
mov eax, dword [0x10332e44]
cmp dword [eax + ecx], 0
jle 0x10105be8
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 8]
cmp ecx, dword [eax + 0xc]
je 0x10105be8
cmp byte [ecx], 0
jne 0x10105be8
pop edi
pop esi
mov byte [ecx], 1
pop ebx
mov esp, ebp
pop ebp
ret 4
cmp ecx, 0x5de24d68
jne 0x10105ba9
cmp edi, 0x4251ee7
jne 0x10105ba9
push dword [ebp + 8]
mov ecx, dword [ebp - 4]
call fcn.10105580
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
cmp ecx, 0xedb6640
jne 0x10105be8
cmp edi, 0x1baa64fb
jne 0x10105be8
push dword [ebp + 8]
mov ecx, dword [ebp - 4]
call fcn.10106d80
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
cmp ecx, 0xb118f470
jne 0x10105be8
cmp edi, 0xd089c265
jne 0x10105be8
push dword [ebp + 8]
mov ecx, dword [ebp - 4]
call fcn.10106620
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x10106d80
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
mov eax, dword [0x10331c40]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, ecx
push edi
mov dword [ebp - 0x24], ebx
lea edi, [ebx + 0x13fc]
lea eax, [edi + 0x104]
cmp eax, edi
sbb ecx, ecx
and ecx, 0xffffffbf
add ecx, 0x41
cmp edi, eax
ja 0x10106db5
xor eax, eax
rep stosd dword es:[edi], eax
lea ecx, [ebx + 0xb0]
lea edx, [ecx + 0x134c]
cmp ecx, edx
je 0x10106e67
add ecx, 0x44
nop dword [eax]
mov eax, dword [ecx - 0x40]
cmp eax, dword [ecx - 0x3c]
je 0x10106ddb
mov dword [ecx - 0x3c], eax
cmp byte [ecx - 0x34], 0
je 0x10106e4c
mov dword [ecx - 0x34], 0
mov word [ecx - 0x30], 0
mov byte [ecx - 0x2e], 0
mov dword [ecx - 0x2c], 0xffffffff
mov dword [ecx - 0x28], 0
mov dword [ecx - 0x24], 0
mov dword [ecx - 0x18], 0
mov dword [ecx - 0x20], 0
mov dword [ecx - 0x1c], 0
mov dword [ecx - 0x14], 0
mov dword [ecx - 0x10], 0
mov dword [ecx - 0xc], 0
mov dword [ecx - 8], 0
mov dword [ecx + 4], 0
mov dword [ecx], 0
mov dword [ecx - 4], 0
cmp dword [ecx - 0x44], 0
je 0x10106e59
mov dword [ecx - 0x44], 0
add ecx, 0x4c
lea eax, [ecx - 0x44]
cmp eax, edx
jne 0x10106dd0
cmp byte [0x1020a012], 0
jne 0x10106e77
mov byte [0x1020a012], 1
test byte [0x10326198], 4
push esi
je 0x10106f90
cmp byte [0x1032fd28], 0
mov edi, dword [0x1033743c]
je 0x10106ef1
cmp byte [0x1032fd29], 0
jne 0x10106f35
mov byte [0x1032fd29], 1
xor esi, esi
nop word [eax + eax]
xor edx, edx
mov ebx, esi
xor edx, dword [0x1032fd64]
xor ebx, dword [0x1032fd60]
xor edx, 0xd28f2c5
xor ebx, 0x1de26cd5
mov ecx, edx
mov eax, ebx
shld ecx, eax, 0xd
shl eax, 0xd
xor edx, ecx
xor ebx, eax
mov eax, ebx
shrd eax, edx, 7
xor al, bl
xor byte [esi + 0x1032fd2a], al
inc esi
cmp esi, 0x30
jb 0x10106eb0
jmp 0x10106f32
xor esi, esi
xor edx, edx
mov ebx, esi
xor edx, dword [0x1032fd64]
xor ebx, dword [0x1032fd60]
xor edx, 0xd28f2c5
xor ebx, 0x1de26cd5
mov ecx, edx
mov eax, ebx
shld ecx, eax, 0xd
shl eax, 0xd
xor edx, ecx
xor ebx, eax
mov eax, ebx
shrd eax, edx, 7
xor al, bl
xor byte [esi + 0x1032fd2a], al
inc esi
cmp esi, 0x30
jb 0x10106ef3
mov ebx, dword [ebp - 0x24]
lea eax, [ebp - 0x1d]
push eax
push 0x1032fd59
push 0x1032fd2a
lea ecx, [ebp - 0x1c]
call fcn.10054040
push 1
push 0xffffffffffffffff
lea eax, [ebp - 0x1c]
mov ecx, edi
push eax
call fcn.10124f90
mov ecx, dword [ebp - 8]
cmp ecx, 0xf
jbe 0x10106f90
mov edx, dword [ebp - 0x1c]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x10106f86
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x10106f86
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push ecx
push edx
call fcn.1015539a
add esp, 8
mov eax, dword [ebx + 8]
lea esi, [ebx + 8]
mov ecx, dword [esi + 4]
cmp eax, ecx
je 0x10106fad
push esi
push ecx
push eax
call fcn.10103cb0
mov eax, dword [esi]
add esp, 0xc
mov dword [esi + 4], eax
mov ecx, dword [ebp - 4]
pop esi
pop edi
xor ecx, ebp
pop ebx
call fcn.101556c2
mov esp, ebp
pop ebp
ret 4
Function at 0x10127440
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
mov ebx, dword [ebp + 0xc]
push esi
push edi
mov edi, ecx
movzx eax, byte [ebx]
xor eax, 0x811c9dc5
imul edx, eax, 0x1000193
movzx eax, byte [ebx + 1]
xor edx, eax
movzx eax, byte [ebx + 2]
imul edx, edx, 0x1000193
xor edx, eax
movzx eax, byte [ebx + 3]
imul ecx, edx, 0x1000193
xor ecx, eax
imul eax, ecx, 0x1000193
mov ecx, edi
push eax
mov dword [ebp + 0xc], eax
lea eax, [ebp - 8]
push ebx
push eax
call fcn.1005f250
mov ecx, dword [ebp - 4]
test ecx, ecx
je 0x101274a9
mov eax, dword [ebp + 8]
mov dword [eax], ecx
mov byte [eax + 4], 0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
cmp dword [edi + 8], 0x9249249
je 0x101275f5
push 0x1c
call fcn.1015536a
mov ecx, dword [ebx]
mov esi, eax
add esp, 4
mov dword [ebp - 0xc], esi
mov dword [esi + 8], ecx
mov dword [esi + 0xc], 0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
mov dword [esi + 0x18], 0
mov eax, dword [edi + 8]
mov ebx, dword [edi + 0x1c]
inc eax
movss xmm3, dword [edi]
movd xmm0, eax
cvtdq2pd xmm0, xmm0
shr eax, 0x1f
addsd xmm0, qword [eax*8 + 0x101bba20]
mov eax, ebx
shr eax, 0x1f
cvtpd2ps xmm2, xmm0
movd xmm0, ebx
cvtdq2pd xmm0, xmm0
movaps xmm1, xmm2
addsd xmm0, qword [eax*8 + 0x101bba20]
cvtpd2ps xmm0, xmm0
divss xmm1, xmm0
comiss xmm1, xmm3
jbe 0x10127593
divss xmm2, xmm3
sub esp, 8
movss dword [ebp - 4], xmm2
fld dword [ebp - 4]
fstp qword [esp]
call sub.api_ms_win_crt_math_l1_1_0.dll_ceil
add esp, 8
fstp dword [ebp - 4]
movss xmm0, dword [ebp - 4]
call fcn.10155750
mov ecx, 8
cmp eax, ecx
cmova ecx, eax
cmp ebx, ecx
jae 0x10127575
cmp ebx, 0x200
jae 0x10127573
shl ebx, 3
cmp ebx, ecx
jae 0x10127575
mov ebx, ecx
push ebx
mov ecx, edi
call fcn.1005fb30
push dword [ebp + 0xc]
lea eax, [esi + 8]
mov ecx, edi
push eax
lea eax, [ebp - 8]
push eax
call fcn.1005f250
mov edx, dword [eax]
jmp 0x10127596
mov edx, dword [ebp - 8]
mov ebx, dword [edx + 4]
inc dword [edi + 8]
mov dword [esi], edx
mov dword [esi + 4], ebx
mov dword [ebx], esi
mov dword [edx + 4], esi
mov eax, dword [edi + 0x18]
and eax, dword [ebp + 0xc]
mov ecx, dword [edi + 0xc]
mov esi, dword [ecx + eax*8]
cmp esi, dword [edi + 4]
mov esi, dword [ebp - 0xc]
jne 0x101275bf
mov dword [ecx + eax*8], esi
jmp 0x101275df
cmp dword [ecx + eax*8], edx
jne 0x101275d9
mov dword [ecx + eax*8], esi
mov eax, dword [ebp + 8]
mov dword [eax], esi
mov byte [eax + 4], 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
cmp dword [ecx + eax*8 + 4], ebx
jne 0x101275e3
mov dword [ecx + eax*8 + 4], esi
mov eax, dword [ebp + 8]
pop edi
mov dword [eax], esi
pop esi
mov byte [eax + 4], 1
pop ebx
mov esp, ebp
pop ebp
ret 8
push str.unordered_map_set_too_long
call sub.MSVCP140.dll_void___cdecl_std::_Xlength_error_char_const__
int3
Function at 0x10127840
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xb8
mov eax, dword [0x10331c40]
xor eax, ebp
mov dword [ebp - 4], eax
cmp byte [0x10331388], 0
xorps xmm0, xmm0
push ebx
push esi
movups xmmword [ebp - 0xb4], xmm0
mov dword [ebp - 0x2c], 0
movups xmmword [ebp - 0x3c], xmm0
mov dword [ebp - 0x80], 0
mov dword [ebp - 0x84], 0xffffffff
mov dword [ebp - 0xb8], 0
je 0x101278e5
cmp byte [0x10331389], 0
jne 0x1012792f
mov byte [0x10331389], 1
xor esi, esi
xor edx, edx
mov ebx, esi
xor edx, dword [0x103313ac]
xor ebx, dword [0x103313a8]
xor edx, 0xd28f2c5
xor ebx, 0x1de26cd5
mov ecx, edx
mov eax, ebx
shld ecx, eax, 0xd
shl eax, 0xd
xor edx, ecx
xor ebx, eax
mov eax, ebx
shrd eax, edx, 7
xor al, bl
xor byte [esi + 0x1033138a], al
inc esi
cmp esi, 0x19
jb 0x101278a4
jmp 0x1012792f
xor esi, esi
nop word [eax + eax]
xor edx, edx
mov ebx, esi
xor edx, dword [0x103313ac]
xor ebx, dword [0x103313a8]
xor edx, 0xd28f2c5
xor ebx, 0x1de26cd5
mov ecx, edx
mov eax, ebx
shld ecx, eax, 0xd
shl eax, 0xd
xor edx, ecx
xor ebx, eax
mov eax, ebx
shrd eax, edx, 7
xor al, bl
xor byte [esi + 0x1033138a], al
inc esi
cmp esi, 0x19
jb 0x101278f0
lea eax, [ebp - 0x1d]
push eax
push 0x103313a2
push 0x1033138a
lea ecx, [ebp - 0x1c]
call fcn.10054040
mov edx, dword [ebp - 8]
lea eax, [ebp - 0x1c]
mov ecx, dword [ebp - 0x1c]
cmp edx, 0xf
pop esi
cmova eax, ecx
mov dword [ebp - 0x88], eax
pop ebx
jbe 0x10127989
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x1012797f
mov ecx, dword [eax - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x1012797f
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push edx
push ecx
call fcn.1015539a
add esp, 8
mov eax, dword [ebp + 0x10]
lea edx, [ebp - 0xb8]
movq xmm0, qword [ebp + 8]
movq qword [ebp - 0xa4], xmm0
movq xmm0, qword [ebp + 0x14]
mov dword [ebp - 0x9c], eax
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0x90], eax
movzx eax, byte [ebp + 0x23]
movq qword [ebp - 0x98], xmm0
mov dword [ebp - 0x8c], 0xffffffff
mov dword [ebp - 0x78], 0x40400000
movd xmm0, eax
mov eax, dword [ebp + 0x20]
cvtdq2ps xmm0, xmm0
movzx ecx, al
movzx eax, ah
mov dword [ebp - 0x6c], 0x3dcccccd
mov dword [ebp - 0x7c], 0
mov dword [ebp - 0x68], 0x3f800000
movss dword [ebp - 0x64], xmm0
movd xmm0, ecx
mov ecx, dword [0x10332cd0]
cvtdq2ps xmm0, xmm0
mov dword [ebp - 0x44], 2
mov byte [ebp - 0x48], 1
mov dword [ebp - 0x60], 0x3f800000
mov dword [ebp - 0x5c], 0
mov dword [ebp - 0x58], 0
movss dword [ebp - 0x54], xmm0
movd xmm0, eax
movzx eax, byte [ebp + 0x22]
cvtdq2ps xmm0, xmm0
mov dword [ebp - 0x74], 0x40400000
mov dword [ebp - 0x70], 0x40400000
mov dword [ebp - 0x40], 0x304
push edx
movss dword [ebp - 0x50], xmm0
movd xmm0, eax
cvtdq2ps xmm0, xmm0
movss dword [ebp - 0x4c], xmm0
mov eax, dword [ecx]
call dword [eax + 0x30]
test eax, eax
je 0x10127a73
mov ecx, dword [0x10332cd0]
push eax
mov edx, dword [ecx]
call dword [edx + 0x18]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.101556c2
mov esp, ebp
pop ebp
ret
Function at 0x1012b240
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
mov ebx, dword [ebp + 0xc]
push esi
push edi
mov edi, ecx
movzx eax, byte [ebx]
xor eax, 0x811c9dc5
imul edx, eax, 0x1000193
movzx eax, byte [ebx + 1]
xor edx, eax
movzx eax, byte [ebx + 2]
imul edx, edx, 0x1000193
xor edx, eax
movzx eax, byte [ebx + 3]
imul ecx, edx, 0x1000193
xor ecx, eax
imul eax, ecx, 0x1000193
mov ecx, edi
push eax
mov dword [ebp + 0xc], eax
lea eax, [ebp - 8]
push ebx
push eax
call fcn.1005f250
mov ecx, dword [ebp - 4]
test ecx, ecx
je 0x1012b2a9
mov eax, dword [ebp + 8]
mov dword [eax], ecx
mov byte [eax + 4], 0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
cmp dword [edi + 8], 0xfffffff
je 0x1012b3e0
push 0x10
call fcn.1015536a
mov ecx, dword [ebx]
mov esi, eax
add esp, 4
mov dword [ebp - 0xc], esi
mov dword [esi + 8], ecx
mov dword [esi + 0xc], 0
mov ecx, dword [edi + 8]
mov ebx, dword [edi + 0x1c]
inc ecx
mov eax, ebx
movss xmm3, dword [edi]
shr eax, 0x1f
movd xmm0, ecx
cvtdq2pd xmm0, xmm0
shr ecx, 0x1f
addsd xmm0, qword [ecx*8 + 0x101bba20]
cvtpd2ps xmm2, xmm0
movd xmm0, ebx
cvtdq2pd xmm0, xmm0
movaps xmm1, xmm2
addsd xmm0, qword [eax*8 + 0x101bba20]
cvtpd2ps xmm0, xmm0
divss xmm1, xmm0
comiss xmm1, xmm3
jbe 0x1012b37e
divss xmm2, xmm3
sub esp, 8
movss dword [ebp - 4], xmm2
fld dword [ebp - 4]
fstp qword [esp]
call sub.api_ms_win_crt_math_l1_1_0.dll_ceil
add esp, 8
fstp dword [ebp - 4]
movss xmm0, dword [ebp - 4]
call fcn.10155750
mov ecx, 8
cmp eax, ecx
cmova ecx, eax
cmp ebx, ecx
jae 0x1012b360
cmp ebx, 0x200
jae 0x1012b35e
shl ebx, 3
cmp ebx, ecx
jae 0x1012b360
mov ebx, ecx
push ebx
mov ecx, edi
call fcn.1012b600
push dword [ebp + 0xc]
lea eax, [esi + 8]
mov ecx, edi
push eax
lea eax, [ebp - 8]
push eax
call fcn.1005f250
mov edx, dword [eax]
jmp 0x1012b381
mov edx, dword [ebp - 8]
mov ebx, dword [edx + 4]
inc dword [edi + 8]
mov dword [esi], edx
mov dword [esi + 4], ebx
mov dword [ebx], esi
mov dword [edx + 4], esi
mov eax, dword [edi + 0x18]
and eax, dword [ebp + 0xc]
mov ecx, dword [edi + 0xc]
mov esi, dword [ecx + eax*8]
cmp esi, dword [edi + 4]
mov esi, dword [ebp - 0xc]
jne 0x1012b3aa
mov dword [ecx + eax*8], esi
jmp 0x1012b3ca
cmp dword [ecx + eax*8], edx
jne 0x1012b3c4
mov dword [ecx + eax*8], esi
mov eax, dword [ebp + 8]
mov dword [eax], esi
mov byte [eax + 4], 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
cmp dword [ecx + eax*8 + 4], ebx
jne 0x1012b3ce
mov dword [ecx + eax*8 + 4], esi
mov eax, dword [ebp + 8]
pop edi
mov dword [eax], esi
pop esi
mov byte [eax + 4], 1
pop ebx
mov esp, ebp
pop ebp
ret 8
push str.unordered_map_set_too_long
call sub.MSVCP140.dll_void___cdecl_std::_Xlength_error_char_const__
int3
Function at 0x1012b8a0
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [ebp + 0xc]
mov edx, ecx
push ebx
mov ebx, dword [ebp + 8]
mov dword [ebp - 0xc], edx
cmp ebx, eax
je 0x1012ba15
mov eax, dword [edx + 4]
mov dword [ebp - 0x10], eax
mov eax, dword [ebx + 4]
mov dword [ebp - 0x14], eax
movzx eax, byte [ebx + 8]
xor eax, 0x811c9dc5
imul ecx, eax, 0x1000193
movzx eax, byte [ebx + 9]
push esi
push edi
mov edi, dword [edx + 0xc]
mov esi, ebx
xor ecx, eax
mov dword [ebp - 0x1c], edi
movzx eax, byte [ebx + 0xa]
imul ecx, ecx, 0x1000193
xor ecx, eax
movzx eax, byte [ebx + 0xb]
imul ecx, ecx, 0x1000193
xor ecx, eax
mov eax, dword [edx + 0x18]
imul ecx, ecx, 0x1000193
and eax, ecx
mov ecx, dword [edi + eax*8]
mov dword [ebp - 8], ecx
lea eax, [edi + eax*8]
mov dword [ebp - 4], eax
mov eax, dword [eax + 4]
mov dword [ebp - 0x18], eax
nop word [eax + eax]
mov edi, esi
mov ebx, esi
mov esi, dword [esi]
lea ecx, [edi + 0xc]
call fcn.10081b40
push 0x98
push edi
call fcn.1015539a
mov edx, dword [ebp - 0xc]
add esp, 8
dec dword [edx + 8]
cmp ebx, dword [ebp - 0x18]
je 0x1012b971
cmp esi, dword [ebp + 0xc]
jne 0x1012b920
mov eax, dword [ebp - 8]
cmp eax, dword [ebp + 8]
jne 0x1012ba08
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 4]
pop edi
mov dword [ecx], esi
mov dword [eax], esi
mov dword [esi + 4], eax
mov eax, dword [ebp + 0xc]
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 4]
cmp eax, dword [ebp + 8]
jne 0x1012b983
mov eax, dword [ebp - 0x10]
mov dword [ecx], eax
jmp 0x1012b986
mov eax, dword [ebp - 0x14]
mov dword [ecx + 4], eax
cmp esi, dword [ebp + 0xc]
je 0x1012ba08
nop
movzx eax, byte [esi + 8]
xor eax, 0x811c9dc5
imul ecx, eax, 0x1000193
movzx eax, byte [esi + 9]
xor ecx, eax
movzx eax, byte [esi + 0xa]
imul ecx, ecx, 0x1000193
xor ecx, eax
movzx eax, byte [esi + 0xb]
imul ecx, ecx, 0x1000193
xor ecx, eax
mov eax, dword [edx + 0x18]
imul ecx, ecx, 0x1000193
and eax, ecx
mov ecx, dword [ebp - 0x1c]
lea eax, [ecx + eax*8]
mov dword [ebp + 8], eax
mov eax, dword [eax + 4]
mov dword [ebp - 0x18], eax
mov edi, esi
mov ebx, esi
mov esi, dword [esi]
lea ecx, [edi + 0xc]
call fcn.10081b40
push 0x98
push edi
call fcn.1015539a
mov edx, dword [ebp - 0xc]
add esp, 8
dec dword [edx + 8]
cmp ebx, dword [ebp - 0x18]
je 0x1012ba1c
cmp esi, dword [ebp + 0xc]
jne 0x1012b9d7
mov eax, dword [ebp + 8]
mov dword [eax], esi
mov eax, dword [ebp - 0x14]
pop edi
mov dword [eax], esi
mov dword [esi + 4], eax
mov eax, dword [ebp + 0xc]
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
mov eax, dword [ebp + 8]
mov ebx, dword [ebp - 0x10]
mov dword [eax], ebx
mov dword [eax + 4], ebx
cmp esi, dword [ebp + 0xc]
jne 0x1012b990
mov eax, dword [ebp - 0x14]
pop edi
mov dword [eax], esi
mov dword [esi + 4], eax
mov eax, dword [ebp + 0xc]
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x1012ba50
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, ecx
movzx eax, byte [esi]
xor eax, 0x811c9dc5
imul edx, eax, 0x1000193
movzx eax, byte [esi + 1]
xor edx, eax
movzx eax, byte [esi + 2]
imul edx, edx, 0x1000193
xor edx, eax
movzx eax, byte [esi + 3]
imul ecx, edx, 0x1000193
xor ecx, eax
imul eax, ecx, 0x1000193
mov ecx, edi
push eax
push esi
lea eax, [ebp - 8]
push eax
call fcn.1005f250
mov eax, dword [ebp - 4]
pop edi
pop esi
test eax, eax
je 0x1012baae
add eax, 0xc
mov esp, ebp
pop ebp
ret 4
push str.invalid_unordered_map_K__T__key
call sub.MSVCP140.dll_void___cdecl_std::_Xout_of_range_char_const__
int3
Function at 0x1012d1a0
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, ecx
movzx eax, byte [esi]
xor eax, 0x811c9dc5
imul edx, eax, 0x1000193
movzx eax, byte [esi + 1]
xor edx, eax
movzx eax, byte [esi + 2]
imul edx, edx, 0x1000193
xor edx, eax
movzx eax, byte [esi + 3]
imul ecx, edx, 0x1000193
xor ecx, eax
lea eax, [ebp - 8]
imul ebx, ecx, 0x1000193
mov ecx, edi
push ebx
push esi
push eax
call fcn.1005f250
mov esi, dword [eax + 4]
test esi, esi
je 0x1012d258
mov ecx, dword [edi + 0x18]
mov eax, dword [edi + 0xc]
and ecx, ebx
lea ecx, [eax + ecx*8]
mov eax, dword [ecx]
cmp dword [ecx + 4], esi
jne 0x1012d21c
cmp eax, esi
jne 0x1012d214
mov eax, dword [edi + 4]
mov dword [ecx], eax
mov dword [ecx + 4], eax
jmp 0x1012d224
mov eax, dword [esi + 4]
mov dword [ecx + 4], eax
jmp 0x1012d224
cmp eax, esi
jne 0x1012d224
mov eax, dword [esi]
mov dword [ecx], eax
mov ecx, dword [esi]
dec dword [edi + 8]
mov eax, dword [esi + 4]
mov dword [eax], ecx
mov eax, dword [esi + 4]
mov dword [ecx + 4], eax
lea ecx, [esi + 0xc]
call fcn.10081b40
push 0x98
push esi
call fcn.1015539a
add esp, 8
mov eax, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x10138a10
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [0x10331c40]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
mov edi, dword [ebp + 0x10]
mov esi, 1
push ebx
mov dword [ebp - 0xc], eax
call fcn.10134ac0
add esp, 4
sub eax, edi
je 0x10138b00
dec eax
push edi
push ebx
mov dword [ebp - 0x10], eax
call fcn.10135c40
add esp, 8
cmp eax, 3
jne 0x10138ad0
push edi
push ebx
call fcn.10134c00
add esp, 8
push 0
push edi
push ebx
test eax, eax
je 0x10138a83
call fcn.10135a00
push edx
push eax
push str._lld
push dword [ebp - 0xc]
call fcn.10131e60
add esp, 0x1c
jmp 0x10138a9e
call fcn.10135b10
add esp, 4
fstp qword [esp]
push str._.14g
push dword [ebp - 0xc]
call fcn.10131e60
add esp, 0x10
test esi, esi
je 0x10138aa6
test eax, eax
jg 0x10138af9
xor esi, esi
mov eax, dword [ebp - 0x10]
inc edi
test eax, eax
jne 0x10138a45
test esi, esi
jne 0x10138b00
push esi
push esi
push ebx
call fcn.10132670
add esp, 0xc
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.101556c2
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 8]
push eax
push edi
push ebx
call fcn.10132270
add esp, 0xc
test esi, esi
je 0x10138aa6
push dword [ebp - 0xc]
push dword [ebp - 8]
push 1
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
add esp, 0x10
cmp eax, dword [ebp - 8]
jne 0x10138aa6
mov esi, 1
jmp 0x10138aa8
mov ecx, dword [ebp - 4]
mov eax, 1
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.101556c2
mov esp, ebp
pop ebp
ret
Function at 0x101400b0
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x114
mov eax, dword [0x10331c40]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push ebx
push esi
mov esi, dword [ebp + 0x10]
push edi
mov edi, dword [ebp + 8]
push str._5_3
push esi
mov dword [ebp - 0x114], eax
mov eax, dword [ebp + 0x14]
push str._s_s
push edi
mov dword [ebp - 0x110], eax
call fcn.10134fa0
push eax
call dword [sym.imp.api_ms_win_crt_environment_l1_1_0.dll_getenv]
mov ebx, eax
add esp, 0x14
test ebx, ebx
jne 0x1014010f
push esi
call dword [sym.imp.api_ms_win_crt_environment_l1_1_0.dll_getenv]
mov ebx, eax
add esp, 4
test ebx, ebx
je 0x10140172
push str.LUA_NOENV
push 0xfff0b9d8
push edi
call fcn.101348f0
push 0xffffffffffffffff
push edi
call fcn.101359d0
push 0xfffffffffffffffe
push edi
mov esi, eax
call fcn.101357e0
add esp, 0x1c
test esi, esi
jne 0x10140172
push 0x101ea7c4
push 0x101ea7c8
push ebx
push edi
call fcn.101327c0
push dword [ebp - 0x110]
push 0x101ea7cc
push eax
push edi
call fcn.101327c0
push 0xffffffffffffffff
push 0xfffffffffffffffe
push edi
call fcn.101354f0
push 0xfffffffffffffffe
push edi
call fcn.101357e0
add esp, 0x34
jmp 0x10140181
push dword [ebp - 0x110]
push edi
call fcn.101350d0
add esp, 8
push 0x105
lea eax, [ebp - 0x10c]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
je 0x101401ef
cmp eax, 0x105
je 0x101401ef
lea eax, [ebp - 0x10c]
push 0x5c
push eax
call sub.VCRUNTIME140.dll_strrchr
add esp, 8
test eax, eax
je 0x101401ef
mov byte [eax], 0
lea eax, [ebp - 0x10c]
push eax
push 0x101ea790
push 0
push 0xffffffffffffffff
push edi
call fcn.10135a80
add esp, 0xc
push eax
push edi
call fcn.101327c0
push 0xffffffffffffffff
push 0xfffffffffffffffe
push edi
call fcn.101354f0
push 0xfffffffffffffffe
push edi
call fcn.101357e0
add esp, 0x24
jmp 0x101401fd
push str.unable_to_get_ModuleFileName
push edi
call fcn.10132550
add esp, 8
push dword [ebp - 0x114]
push 0xfffffffffffffffd
push edi
call fcn.10135590
push 0xfffffffffffffffe
push edi
call fcn.101357e0
mov ecx, dword [ebp - 4]
add esp, 0x14
xor ecx, ebp
pop edi
pop esi
pop ebx
call fcn.101556c2
mov esp, ebp
pop ebp
ret