joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100dbeb0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x1014d665
push eax
mov dword fs:[0], esp
sub esp, 0x10
push ebx
mov ebx, dword [ebp + 0xc]
mov edx, ebx
push esi
push edi
cmp dword [ebx + 0x14], 0x10
mov edi, dword [ebx + 0x10]
jb 0x100dbede
mov edx, dword [ebx]
xor ecx, ecx
mov esi, 0x811c9dc5
test edi, edi
je 0x100dbf01
nop dword [eax]
movzx eax, byte [ecx + edx]
inc ecx
xor eax, esi
imul esi, eax, 0x1000193
cmp ecx, edi
jb 0x100dbef0
push esi
push ebx
lea eax, [ebp - 0x14]
push eax
call fcn.100dc370
mov ecx, dword [ebp - 0x10]
test ecx, ecx
je 0x100dbf2f
mov eax, dword [ebp + 8]
mov dword [eax], ecx
mov byte [eax + 4], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
cmp dword [0x10245de8], 0x38e38e3
jne 0x100dbf46
push str.unordered_map_set_too_long
call dword [sym.imp.MSVCP140.dll_void___cdecl_std::_Xlength_error_char_const__]
mov dword [ebp - 0x1c], 0x10245de4
mov dword [ebp - 4], 0
push 0x48
mov dword [ebp - 0x18], 0
call fcn.10148596
mov edi, eax
add esp, 4
mov dword [ebp - 0x18], edi
lea ecx, [edi + 8]
push ebx
call fcn.10098a10
mov dword [edi + 0x44], 0
mov dword [ebp - 4], 1
mov edx, dword [0x10245de8]
mov ebx, dword [0x10245dfc]
lea eax, [edx + 1]
movd xmm0, eax
cvtdq2pd xmm0, xmm0
shr eax, 0x1f
addsd xmm0, qword [eax*8 + 0x102352b0]
mov eax, ebx
shr eax, 0x1f
cvtpd2ps xmm3, xmm0
movd xmm0, ebx
cvtdq2pd xmm0, xmm0
movaps xmm2, xmm3
addsd xmm0, qword [eax*8 + 0x102352b0]
cvtpd2ps xmm1, xmm0
movss xmm0, dword [0x10245de0]
divss xmm2, xmm1
comiss xmm2, xmm0
jbe 0x100dc024
divss xmm3, xmm0
movaps xmm0, xmm3
call fcn.1005ee70
call fcn.1014a430
mov ecx, 8
cmp eax, ecx
cmova ecx, eax
cmp ebx, ecx
jae 0x100dc006
cmp ebx, 0x200
jae 0x100dc004
shl ebx, 3
cmp ebx, ecx
jae 0x100dc006
mov ebx, ecx
push ebx
call fcn.100dc190
push esi
lea eax, [edi + 8]
push eax
lea eax, [ebp - 0x1c]
push eax
call fcn.100dc370
mov edx, dword [0x10245de8]
mov ecx, dword [eax]
jmp 0x100dc027
mov ecx, dword [ebp - 0x14]
mov ebx, dword [ecx + 4]
inc edx
mov dword [0x10245de8], edx
mov dword [edi], ecx
mov dword [edi + 4], ebx
mov dword [ebx], edi
mov dword [ecx + 4], edi
and esi, dword [0x10245df8]
mov eax, dword [0x10245dec]
mov edx, dword [eax + esi*8]
cmp edx, dword [0x10245de4]
jne 0x100dc056
mov dword [eax + esi*8], edi
jmp 0x100dc065
cmp edx, ecx
jne 0x100dc05f
mov dword [eax + esi*8], edi
jmp 0x100dc069
cmp dword [eax + esi*8 + 4], ebx
jne 0x100dc069
mov dword [eax + esi*8 + 4], edi
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
mov dword [eax], edi
pop edi
pop esi
mov byte [eax + 4], 1
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x100dd3d0
Capabilities:
Hash data using fnv

Disassembly:
mov al, byte [ecx]
test al, al
jne 0x100dd3d9
mov eax, edx
ret
movsx eax, al
xor eax, edx
imul edx, eax, 0x1000193
inc ecx
jmp fcn.100dd3d0

Function at 0x100dd4c0
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, dword [0x1024626c]
mov dword [ebp - 4], esi
test esi, esi
jne 0x100dd4db
xor al, al
pop esi
mov esp, ebp
pop ebp
ret 8
mov ecx, dword [ebp + 8]
push ebx
push edi
call fcn.1013dbb0
mov ecx, dword [esi + 8]
mov ebx, eax
and ebx, 0x7fffffff
mov edx, dword [ecx + 0x24]
lea ecx, [esi + 8]
call edx
mov ecx, dword [0x102efe50]
mov esi, eax
mov edx, dword [ecx]
mov edx, dword [edx + 0x30]
call edx
mov ecx, dword [ebp - 4]
mov edi, eax
shl esi, 8
or edi, esi
mov edx, dword [ecx]
mov edx, dword [edx + 0x528]
call edx
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ecx, edi
shl ecx, 8
cmp eax, 2
mov eax, dword fs:[0x2c]
cmovne ecx, edi
mov edi, dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
xor ecx, ebx
mov dword [ebp + 8], ecx
mov ecx, dword [0x10248784]
mov ebx, dword [eax + ecx*4]
mov eax, dword [0x102f0144]
cmp eax, dword [ebx + 4]
jle 0x100dd58a
push 0x102f0144
call fcn.1014866a
add esp, 4
cmp dword [0x102f0144], 0xffffffff
jne 0x100dd58a
push str.RandomSeed
push str.vstdlib.dll
call edi
push eax
call esi
push 0x102f0144
mov dword [0x102f012c], eax
call fcn.10148619
add esp, 4
push dword [ebp + 8]
call dword [0x102f012c]
mov eax, dword [0x102f0128]
add esp, 4
cmp eax, dword [ebx + 4]
jle 0x100dd5da
push 0x102f0128
call fcn.1014866a
add esp, 4
cmp dword [0x102f0128], 0xffffffff
jne 0x100dd5da
push str.RandomInt
push str.vstdlib.dll
call edi
push eax
call esi
push 0x102f0128
mov dword [0x102f0120], eax
call fcn.10148619
add esp, 4
mov eax, dword [0x102f0120]
push 0x270f
push 0
call eax
add esp, 8
mov ecx, eax
xor eax, eax
pop edi
pop ebx
cmp byte [ebp + 0xc], al
je 0x100dd603
cmp ecx, 0x64
pop esi
setl al
mov esp, ebp
pop ebp
ret 8
cmp ecx, 0x1770
pop esi
setg al
mov esp, ebp
pop ebp
ret 8
Function at 0x100eb5a0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x1c
push ebx
mov ebx, ecx
push esi
push edi
cmp dword [ebx + 0x38], 0
je 0x100eb5cc
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____thiscall_std::basic_streambuf_char__struct_std::char_traits_char__::xsputn_char_const___long_long___int64__]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov eax, dword [ebx + 0x20]
mov esi, dword [ebp + 0xc]
mov edi, dword [ebp + 0x10]
mov dword [esp + 0x20], esi
mov ecx, dword [eax]
lea eax, [ebx + 0x30]
mov dword [esp + 0x24], edi
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x18], eax
test ecx, ecx
je 0x100eb5f4
mov eax, dword [eax]
mov ecx, dword [eax]
jmp 0x100eb5fa
xor ecx, ecx
mov dword [esp + 0x18], eax
mov eax, ecx
cdq
mov dword [esp + 0x10], eax
mov ecx, edx
mov dword [esp + 0x14], ecx
test edi, edi
jl 0x100eb662
jg 0x100eb611
test esi, esi
je 0x100eb662
test ecx, ecx
jl 0x100eb65d
jg 0x100eb61b
test eax, eax
je 0x100eb65d
cmp edi, ecx
jg 0x100eb62f
jl 0x100eb625
cmp esi, eax
jae 0x100eb62f
mov eax, esi
mov dword [esp + 0x10], esi
mov dword [esp + 0x14], edi
push eax
push dword [ebp + 8]
push dword [esp + 0x24]
call sub.VCRUNTIME140.dll_memcpy
mov eax, dword [esp + 0x24]
add esp, 0xc
mov edx, dword [esp + 0x10]
mov ecx, dword [ebp + 8]
add ecx, edx
sub esi, edx
mov eax, dword [eax]
sbb edi, dword [esp + 0x14]
sub dword [eax], edx
mov eax, dword [ebx + 0x20]
add dword [eax], edx
jmp 0x100eb665
mov ecx, dword [ebp + 8]
jmp 0x100eb66f
mov ecx, dword [ebp + 8]
test edi, edi
jl 0x100eb689
jg 0x100eb66f
test esi, esi
je 0x100eb689
mov eax, dword [ebx + 0x4c]
test eax, eax
je 0x100eb689
push eax
push esi
push 1
push ecx
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
add esp, 0x10
sub esi, eax
sbb edi, 0
mov eax, dword [esp + 0x20]
mov edx, dword [esp + 0x24]
sub eax, esi
sbb edx, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x100eb6a0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0x10]
sub esp, 8
push ebx
mov ebx, ecx
mov ecx, dword [ebp + 0xc]
test eax, eax
jg 0x100eb6c4
jl 0x100eb6b9
test ecx, ecx
jne 0x100eb6c4
xor eax, eax
xor edx, edx
pop ebx
mov esp, ebp
pop ebp
ret 0xc
cmp dword [ebx + 0x38], 0
je 0x100eb6de
push eax
push ecx
push dword [ebp + 8]
mov ecx, ebx
call dword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____thiscall_std::basic_streambuf_char__struct_std::char_traits_char__::xsgetn_char___long_long___int64__]
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov eax, dword [ebx + 0x1c]
push esi
push edi
mov edi, ecx
mov eax, dword [eax]
mov dword [ebp - 8], eax
test eax, eax
je 0x100eb724
mov eax, dword [ebx + 0x2c]
lea edx, [ebx + 0x2c]
mov dword [ebp - 4], edx
mov eax, dword [eax]
test eax, eax
je 0x100eb72a
cmp eax, ecx
mov esi, ecx
cmovb esi, eax
push esi
push dword [ebp - 8]
push dword [ebp + 8]
call sub.VCRUNTIME140.dll_memcpy
mov eax, dword [ebx + 0x2c]
add esp, 0xc
add dword [ebp + 8], esi
sub edi, esi
sub dword [eax], esi
mov eax, dword [ebx + 0x1c]
add dword [eax], esi
jmp 0x100eb72a
lea eax, [ebx + 0x2c]
mov dword [ebp - 4], eax
cmp dword [ebx + 0x4c], 0
mov esi, dword [ebp + 8]
je 0x100eb799
mov ecx, dword [ebx + 0xc]
lea eax, [ebx + 0x3c]
cmp dword [ecx], eax
jne 0x100eb756
mov eax, dword [ebx + 0xc]
mov edx, dword [ebx + 0x54]
mov ecx, dword [ebx + 0x50]
sub edx, ecx
mov dword [eax], ecx
mov eax, dword [ebx + 0x1c]
mov dword [eax], ecx
mov eax, dword [ebp - 4]
mov eax, dword [eax]
mov dword [eax], edx
mov eax, dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
cmp edi, 0xfff
jbe 0x100eb787
push dword [ebx + 0x4c]
push 0xfff
push 1
push esi
call eax
add esp, 0x10
add esi, eax
sub edi, eax
cmp eax, 0xfff
jne 0x100eb799
cmp edi, eax
mov eax, dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
ja 0x100eb763
test edi, edi
je 0x100eb799
push dword [ebx + 0x4c]
push edi
push 1
push esi
call eax
add esp, 0x10
sub edi, eax
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 0x10]
sub eax, edi
pop edi
pop esi
sbb edx, 0
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x100ebbf0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, ecx
cmp ebx, 0xffffffff
jne 0x100ebc0c
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret 4
mov eax, dword [esi + 0x20]
push edi
mov ecx, dword [eax]
test ecx, ecx
je 0x100ebc3e
mov edx, dword [esi + 0x30]
mov edi, dword [edx]
lea eax, [edi + ecx]
cmp ecx, eax
jae 0x100ebc3e
lea ecx, [edi - 1]
mov eax, ebx
mov dword [edx], ecx
mov edx, dword [esi + 0x20]
pop edi
mov esi, dword [edx]
lea ecx, [esi + 1]
mov dword [edx], ecx
mov byte [esi], bl
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
cmp dword [esi + 0x4c], 0
je 0x100ebd01
mov edi, dword [esi + 0xc]
lea eax, [esi + 0x3c]
cmp dword [edi], eax
jne 0x100ebc66
mov edx, dword [esi + 0x54]
mov ecx, dword [esi + 0x50]
sub edx, ecx
mov dword [edi], ecx
mov eax, dword [esi + 0x1c]
mov dword [eax], ecx
mov eax, dword [esi + 0x2c]
mov dword [eax], edx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x100ebc72
movsx eax, bl
jmp 0x100ebcaa
lea eax, [ebp + 8]
mov byte [ebp - 1], bl
push eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp]
push eax
lea eax, [ebp - 1]
push eax
lea eax, [esi + 0x40]
push eax
call dword [sym.imp.MSVCP140.dll_public:_int___thiscall_std::codecvt_char__char__struct__Mbstatet_::out_struct__Mbstatet___char_const___char_const___char_const____char___char___char___const]
sub eax, 0
je 0x100ebcca
sub eax, 1
je 0x100ebcca
sub eax, 2
jne 0x100ebd01
movsx eax, byte [ebp - 1]
push dword [esi + 0x4c]
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
add esp, 8
or ecx, 0xffffffff
cmp eax, ecx
cmove ebx, ecx
pop edi
pop esi
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret 4
mov edi, dword [ebp + 8]
lea eax, [ebp - 0x28]
sub edi, eax
je 0x100ebce8
push dword [esi + 0x4c]
push edi
push 1
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
add esp, 0x10
cmp edi, eax
jne 0x100ebd01
lea ecx, [ebp - 1]
mov byte [esi + 0x3d], 1
or eax, 0xffffffff
cmp dword [ebp - 8], ecx
pop edi
pop esi
cmovne eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret 4
pop edi
pop esi
or eax, 0xffffffff
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x100ebfe0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
push esi
mov esi, ecx
cmp dword [esi + 0x38], 0
je 0x100ec06c
cmp byte [esi + 0x3d], 0
je 0x100ec06c
mov eax, dword [esi]
push edi
push 0xffffffffffffffff
call dword [eax + 0xc]
cmp eax, 0xffffffff
je 0x100ec064
mov ecx, dword [esi + 0x38]
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [esi + 0x40]
push eax
call dword [sym.imp.MSVCP140.dll_public:_int___thiscall_std::codecvt_char__char__struct__Mbstatet_::unshift_struct__Mbstatet___char___char___char___const]
sub eax, 0
je 0x100ec035
sub eax, 1
je 0x100ec039
sub eax, 2
jne 0x100ec064
mov byte [esi + 0x3d], al
mov al, 1
pop edi
pop esi
mov esp, ebp
pop ebp
ret
mov byte [esi + 0x3d], 0
mov edi, dword [ebp - 4]
lea eax, [ebp - 0x24]
sub edi, eax
je 0x100ec057
push dword [esi + 0x4c]
push edi
push 1
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
add esp, 0x10
cmp edi, eax
jne 0x100ec064
cmp byte [esi + 0x3d], 0
pop edi
sete al
pop esi
mov esp, ebp
pop ebp
ret
pop edi
xor al, al
pop esi
mov esp, ebp
pop ebp
ret
mov al, 1
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x100f0e60
Capabilities:
Access peb ldr_data
Get process heap force flags

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1014eb8f
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ebx
sub esp, 0x10
mov eax, dword [ebx + 8]
xorps xmm0, xmm0
mov dword [ebp - 0x14], ecx
movups xmmword [ecx], xmm0
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 0
movups xmm0, xmmword [eax]
push esi
push edi
movups xmmword [ecx], xmm0
movq xmm0, qword [eax + 0x10]
movq qword [ecx + 0x10], xmm0
mov dword [eax + 0x10], 0
mov dword [eax + 0x14], 0xf
mov byte [eax], 0
lea esi, [eax + 0x18]
mov dword [ebp - 4], 0
add ecx, 0x18
push esi
mov dword [ebp - 0x18], ecx
call fcn.10098a10
push 0x10
mov byte [ebp - 4], 1
call fcn.10148596
mov edi, eax
mov dword [ebp - 0x1c], edi
mov byte [ebp - 4], 2
mov esi, dword [esi + 0x18]
push 0x48
call fcn.10148596
add esp, 8
mov dword [edi + 4], eax
mov byte [ebp - 4], 3
mov ecx, edi
push esi
mov dword [edi + 0xc], 0
call fcn.100ec2a0
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0xc]
mov dword [eax + 0x30], edi
pop edi
mov dword fs:[0], ecx
pop esi
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret 4
Function at 0x10107150
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x1014f735
push eax
mov dword fs:[0], esp
sub esp, 0x14
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov edx, edi
cmp dword [edi + 0x14], 0x10
mov ebx, dword [edi + 0x10]
jb 0x1010717e
mov edx, dword [edi]
xor ecx, ecx
mov esi, 0x811c9dc5
test ebx, ebx
je 0x101071a1
nop dword [eax]
movzx eax, byte [ecx + edx]
inc ecx
xor eax, esi
imul esi, eax, 0x1000193
cmp ecx, ebx
jb 0x10107190
push esi
push edi
lea eax, [ebp - 0x18]
push eax
call fcn.101089e0
mov eax, dword [ebp - 0x14]
test eax, eax
jne 0x101072ae
cmp dword [0x102efdd0], 0x71c71c7
jne 0x101071ce
push str.unordered_map_set_too_long
call dword [sym.imp.MSVCP140.dll_void___cdecl_std::_Xlength_error_char_const__]
mov dword [ebp - 0x20], 0x102efdcc
mov dword [ebp - 4], 0
push 0x24
mov dword [ebp - 0x1c], 0
call fcn.10148596
mov ebx, eax
add esp, 4
mov dword [ebp - 0x1c], ebx
lea ecx, [ebx + 8]
push edi
call fcn.10098a10
mov dword [ebx + 0x20], 0
mov dword [ebp - 4], 1
mov eax, dword [0x102efdd0]
mov edi, dword [0x102efde4]
inc eax
movd xmm0, eax
cvtdq2pd xmm0, xmm0
shr eax, 0x1f
addsd xmm0, qword [eax*8 + 0x102352b0]
mov eax, edi
shr eax, 0x1f
cvtpd2ps xmm3, xmm0
movd xmm0, edi
cvtdq2pd xmm0, xmm0
movaps xmm2, xmm3
addsd xmm0, qword [eax*8 + 0x102352b0]
cvtpd2ps xmm1, xmm0
movss xmm0, dword [0x102efdc8]
divss xmm2, xmm1
comiss xmm2, xmm0
jbe 0x101072a3
divss xmm3, xmm0
movaps xmm0, xmm3
call fcn.1005ee70
call fcn.1014a430
mov ecx, 8
cmp eax, ecx
cmova ecx, eax
cmp edi, ecx
jae 0x1010728b
cmp edi, 0x200
jae 0x10107289
shl edi, 3
cmp edi, ecx
jae 0x1010728b
mov edi, ecx
push edi
call fcn.10108280
push esi
lea eax, [ebx + 8]
push eax
lea eax, [ebp - 0x20]
push eax
call fcn.101089e0
mov ecx, dword [eax]
jmp 0x101072a6
mov ecx, dword [ebp - 0x18]
push ebx
push ecx
push esi
call fcn.101080a0
mov ecx, dword [ebp - 0xc]
add eax, 0x20
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x10107890
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1014be15
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x10
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
movzx eax, byte [edi]
xor eax, 0x811c9dc5
imul ecx, eax, 0x1000193
movzx eax, byte [edi + 1]
xor ecx, eax
movzx eax, byte [edi + 2]
imul ecx, ecx, 0x1000193
xor ecx, eax
movzx eax, byte [edi + 3]
imul ecx, ecx, 0x1000193
xor ecx, eax
lea eax, [ebp - 0x14]
imul ebx, ecx, 0x1000193
push ebx
push edi
push eax
call fcn.10108970
mov ecx, dword [ebp - 0x10]
test ecx, ecx
je 0x10107911
mov eax, dword [ebp + 8]
mov dword [eax], ecx
mov byte [eax + 4], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
cmp dword [0x102efdb0], 0xfffffff
jne 0x10107928
push str.unordered_map_set_too_long
call dword [sym.imp.MSVCP140.dll_void___cdecl_std::_Xlength_error_char_const__]
mov dword [ebp - 0x1c], 0x102efdac
mov dword [ebp - 4], 0
push 0x10
mov dword [ebp - 0x18], 0
call fcn.10148596
mov ecx, dword [edi]
mov esi, eax
add esp, 4
mov dword [ebp - 0x18], esi
mov dword [esi + 8], ecx
mov dword [esi + 0xc], 0
mov dword [ebp - 4], 1
mov ecx, dword [0x102efdb0]
mov edi, dword [0x102efdc4]
lea eax, [ecx + 1]
movd xmm0, eax
cvtdq2pd xmm0, xmm0
shr eax, 0x1f
addsd xmm0, qword [eax*8 + 0x102352b0]
mov eax, edi
shr eax, 0x1f
cvtpd2ps xmm3, xmm0
movd xmm0, edi
cvtdq2pd xmm0, xmm0
movaps xmm2, xmm3
addsd xmm0, qword [eax*8 + 0x102352b0]
cvtpd2ps xmm1, xmm0
movss xmm0, dword [0x102efda8]
divss xmm2, xmm1
comiss xmm2, xmm0
jbe 0x10107a02
divss xmm3, xmm0
movaps xmm0, xmm3
call fcn.1005ee70
call fcn.1014a430
mov ecx, 8
cmp eax, ecx
cmova ecx, eax
cmp edi, ecx
jae 0x101079e4
cmp edi, 0x200
jae 0x101079e2
shl edi, 3
cmp edi, ecx
jae 0x101079e4
mov edi, ecx
push edi
call fcn.10108110
push ebx
lea eax, [esi + 8]
push eax
lea eax, [ebp - 0x1c]
push eax
call fcn.10108970
mov ecx, dword [0x102efdb0]
mov edx, dword [eax]
jmp 0x10107a05
mov edx, dword [ebp - 0x14]
mov edi, dword [edx + 4]
inc ecx
mov dword [0x102efdb0], ecx
mov dword [esi], edx
mov dword [esi + 4], edi
mov dword [edi], esi
mov dword [edx + 4], esi
mov eax, dword [0x102efdc0]
mov ecx, dword [0x102efdb4]
and eax, ebx
mov ebx, dword [ecx + eax*8]
cmp ebx, dword [0x102efdac]
jne 0x10107a36
mov dword [ecx + eax*8], esi
jmp 0x10107a45
cmp ebx, edx
jne 0x10107a3f
mov dword [ecx + eax*8], esi
jmp 0x10107a49
cmp dword [ecx + eax*8 + 4], edi
jne 0x10107a49
mov dword [ecx + eax*8 + 4], esi
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
pop edi
mov dword [eax], esi
pop esi
mov byte [eax + 4], 1
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x10107a70
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x1014f765
push eax
mov dword fs:[0], esp
push ebx
sub esp, 0x18
push esi
push edi
mov edi, dword [ebx + 0xc]
mov edx, edi
cmp dword [edi + 0x14], 0x10
jb 0x10107aae
mov edx, dword [edi]
xor ecx, ecx
mov esi, 0x811c9dc5
cmp dword [edi + 0x10], ecx
jbe 0x10107ad2
nop word [eax + eax]
movzx eax, byte [ecx + edx]
inc ecx
xor eax, esi
imul esi, eax, 0x1000193
cmp ecx, dword [edi + 0x10]
jb 0x10107ac0
push esi
push edi
lea eax, [ebp - 0x1c]
push eax
call fcn.101089e0
mov ecx, dword [ebp - 0x18]
test ecx, ecx
je 0x10107af2
mov eax, dword [ebx + 8]
mov dword [eax], ecx
mov byte [eax + 4], 0
jmp 0x10107c29
cmp dword [0x102efdd0], 0x71c71c7
jne 0x10107b09
push str.unordered_map_set_too_long
call dword [sym.imp.MSVCP140.dll_void___cdecl_std::_Xlength_error_char_const__]
mov dword [ebp - 0x24], 0x102efdcc
mov dword [ebp - 4], 0
push 0x24
mov dword [ebp - 0x20], 0
call fcn.10148596
xorps xmm0, xmm0
mov dword [ebp - 0x20], eax
add esp, 4
mov dword [ebp - 0x14], eax
movups xmmword [eax + 8], xmm0
mov dword [eax + 0x18], 0
mov dword [eax + 0x1c], 0
movups xmm0, xmmword [edi]
movups xmmword [eax + 8], xmm0
movq xmm0, qword [edi + 0x10]
movq qword [eax + 0x18], xmm0
mov dword [edi + 0x10], 0
mov dword [edi + 0x14], 0xf
mov byte [edi], 0
mov dword [eax + 0x20], 0
mov dword [ebp - 4], 1
mov eax, dword [0x102efdd0]
mov edi, dword [0x102efde4]
inc eax
movd xmm0, eax
cvtdq2pd xmm0, xmm0
shr eax, 0x1f
addsd xmm0, qword [eax*8 + 0x102352b0]
mov eax, edi
shr eax, 0x1f
cvtpd2ps xmm3, xmm0
movd xmm0, edi
cvtdq2pd xmm0, xmm0
movaps xmm2, xmm3
addsd xmm0, qword [eax*8 + 0x102352b0]
cvtpd2ps xmm1, xmm0
movss xmm0, dword [0x102efdc8]
divss xmm2, xmm1
comiss xmm2, xmm0
jbe 0x10107c10
divss xmm3, xmm0
movaps xmm0, xmm3
call fcn.1005ee70
call fcn.1014a430
mov ecx, 8
cmp eax, ecx
cmova ecx, eax
cmp edi, ecx
jae 0x10107bf5
cmp edi, 0x200
jae 0x10107bf3
shl edi, 3
cmp edi, ecx
jae 0x10107bf5
mov edi, ecx
push edi
call fcn.10108280
mov edi, dword [ebp - 0x14]
push esi
lea eax, [edi + 8]
push eax
lea eax, [ebp - 0x24]
push eax
call fcn.101089e0
mov ecx, dword [eax]
jmp 0x10107c16
mov ecx, dword [ebp - 0x1c]
mov edi, dword [ebp - 0x14]
push edi
push ecx
push esi
call fcn.101080a0
mov ecx, dword [ebx + 8]
mov dword [ecx], eax
mov eax, ecx
mov byte [ecx + 4], 1
mov ecx, dword [ebp - 0xc]
pop edi
mov dword fs:[0], ecx
pop esi
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret 8
Function at 0x10108110
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1fffffff
sub esp, 8
bsr ecx, eax
push ebx
push esi
push edi
mov edi, 1
mov eax, edi
shl eax, cl
mov ecx, dword [ebp + 8]
cmp ecx, eax
jbe 0x1010813c
push str.invalid_hash_bucket_count
call dword [sym.imp.MSVCP140.dll_void___cdecl_std::_Xlength_error_char_const__]
lea eax, [ecx - 1]
mov esi, dword [0x102efdac]
or eax, 1
mov dword [ebp + 8], esi
bsr ecx, eax
push esi
lea ecx, [ecx + 1]
shl edi, cl
mov ecx, 0x102efdb4
lea eax, [edi + edi]
push eax
call fcn.10107700
mov eax, dword [0x102efdac]
lea ebx, [edi - 1]
mov dword [0x102efdc0], ebx
mov dword [0x102efdc4], edi
mov eax, dword [eax]
mov ecx, eax
cmp eax, esi
je 0x10108276
movzx edx, byte [eax + 8]
xor edx, 0x811c9dc5
mov ecx, dword [ecx]
imul edi, edx, 0x1000193
movzx edx, byte [eax + 9]
xor edi, edx
movzx edx, byte [eax + 0xa]
imul edi, edi, 0x1000193
xor edi, edx
movzx edx, byte [eax + 0xb]
imul edi, edi, 0x1000193
xor edi, edx
mov edx, dword [0x102efdb4]
imul edi, edi, 0x1000193
and edi, ebx
mov ebx, dword [edx + edi*8]
lea edx, [edx + edi*8]
mov dword [ebp - 4], edx
cmp ebx, esi
jne 0x101081d4
mov dword [edx], eax
mov dword [edx + 4], eax
jmp 0x10108241
mov edx, dword [edx + 4]
mov edi, dword [eax + 8]
cmp edi, dword [edx + 8]
jne 0x1010820e
mov edx, dword [edx]
mov dword [ebp - 8], edx
cmp edx, eax
je 0x10108206
mov ebx, dword [eax + 4]
mov esi, dword [ebp - 8]
mov dword [ebx], ecx
mov edi, dword [ecx + 4]
mov dword [edi], edx
mov edx, dword [edx + 4]
mov dword [edx], eax
mov dword [esi + 4], edi
mov esi, dword [ebp + 8]
mov dword [ecx + 4], ebx
mov dword [eax + 4], edx
mov edx, dword [ebp - 4]
mov dword [edx + 4], eax
jmp 0x10108241
cmp ebx, edx
je 0x1010821e
mov edx, dword [edx + 4]
cmp edi, dword [edx + 8]
je 0x10108252
cmp ebx, edx
jne 0x10108212
mov ebx, dword [eax + 4]
mov dword [ebp - 8], ebx
mov dword [ebx], ecx
mov ebx, dword [ecx + 4]
mov dword [ebx], edx
mov edi, dword [edx + 4]
mov dword [edi], eax
mov dword [edx + 4], ebx
mov edx, dword [ebp - 8]
mov dword [ecx + 4], edx
mov edx, dword [ebp - 4]
mov dword [eax + 4], edi
mov dword [edx], eax
mov eax, ecx
cmp ecx, esi
je 0x10108276
mov ebx, dword [0x102efdc0]
jmp 0x10108182
mov ebx, dword [eax + 4]
mov edx, dword [edx]
mov dword [ebp - 8], edx
mov esi, edx
mov dword [ebx], ecx
mov edi, dword [ecx + 4]
mov dword [edi], edx
mov edx, dword [edx + 4]
mov dword [edx], eax
mov dword [esi + 4], edi
mov esi, dword [ebp + 8]
mov dword [ecx + 4], ebx
mov dword [eax + 4], edx
jmp 0x10108241
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x10110310
Capabilities:
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push esi
push edi
mov dword [ebp - 8], ecx
lea esi, [ebp - 8]
mov dword [ebp - 0xc], 0
mov edi, 4
or eax, 0xffffffff
nop dword [eax]
jmp dword [edi*4 + 0x101105c4]