joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1002bfa0
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x101dceb5
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push ebx
push esi
push edi
mov eax, dword [0x102924c0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
movzx eax, byte [esi]
xor eax, 0x811c9dc5
imul ecx, eax, 0x1000193
movzx eax, byte [esi + 1]
xor ecx, eax
movzx eax, byte [esi + 2]
imul ecx, ecx, 0x1000193
xor ecx, eax
movzx eax, byte [esi + 3]
imul ecx, ecx, 0x1000193
xor ecx, eax
lea eax, [ebp - 0x14]
imul edi, ecx, 0x1000193
push edi
push esi
push eax
call fcn.1002fd00
mov eax, dword [ebp - 0x10]
test eax, eax
jne 0x1002c0f7
cmp dword [0x103c8b10], 0xfffffff
je 0x1002c10e
mov dword [ebp - 0x1c], 0x103c8b0c
mov dword [ebp - 4], eax
push 0x10
mov dword [ebp - 0x18], eax
call fcn.101aaedc
mov ebx, eax
add esp, 4
mov eax, dword [esi]
mov dword [ebp - 0x18], ebx
mov dword [ebx + 8], eax
mov dword [ebx + 0xc], 0
mov dword [ebp - 4], 1
mov eax, dword [0x103c8b10]
mov esi, dword [0x103c8b24]
inc eax
movd xmm0, eax
cvtdq2pd xmm0, xmm0
shr eax, 0x1f
addsd xmm0, qword [eax*8 + 0x102785a0]
mov eax, esi
shr eax, 0x1f
cvtpd2ps xmm3, xmm0
movd xmm0, esi
cvtdq2pd xmm0, xmm0
movaps xmm2, xmm3
addsd xmm0, qword [eax*8 + 0x102785a0]
cvtpd2ps xmm1, xmm0
movss xmm0, dword [0x103c8b08]
divss xmm2, xmm1
comiss xmm2, xmm0
jbe 0x1002c0ec
divss xmm3, xmm0
movaps xmm0, xmm3
call fcn.10006260
call fcn.101d4f20
mov ecx, 8
cmp eax, ecx
cmova ecx, eax
cmp esi, ecx
jae 0x1002c0d4
cmp esi, 0x200
jae 0x1002c0d2
shl esi, 3
cmp esi, ecx
jae 0x1002c0d4
mov esi, ecx
push esi
call fcn.1002f940
push edi
lea eax, [ebx + 8]
push eax
lea eax, [ebp - 0x1c]
push eax
call fcn.1002fd00
mov ecx, dword [eax]
jmp 0x1002c0ef
mov ecx, dword [ebp - 0x14]
push ebx
push ecx
push edi
call fcn.1002f6e0
add eax, 0xc
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
push str.unordered_map_set_too_long
call fcn.101a9c13
int3
Function at 0x1002f940
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1fffffff
sub esp, 0x10
bsr ecx, eax
push ebx
push esi
push edi
mov edi, 1
mov eax, edi
shl eax, cl
mov ecx, dword [ebp + 8]
cmp ecx, eax
ja 0x1002faad
lea eax, [ecx - 1]
mov esi, dword [0x103c8b0c]
or eax, edi
mov dword [ebp - 8], esi
bsr ecx, eax
push esi
lea ecx, [ecx + 1]
shl edi, cl
mov ecx, 0x103c8b14
lea eax, [edi + edi]
push eax
call fcn.100175e0
mov eax, dword [0x103c8b0c]
lea ebx, [edi - 1]
mov dword [0x103c8b20], ebx
mov dword [0x103c8b24], edi
mov eax, dword [eax]
mov ecx, eax
cmp eax, esi
je 0x1002faa4
nop word [eax + eax]
movzx edx, byte [eax + 8]
xor edx, 0x811c9dc5
mov ecx, dword [ecx]
imul edi, edx, 0x1000193
movzx edx, byte [eax + 9]
xor edi, edx
movzx edx, byte [eax + 0xa]
imul edi, edi, 0x1000193
xor edi, edx
movzx edx, byte [eax + 0xb]
imul edi, edi, 0x1000193
xor edi, edx
mov edx, dword [0x103c8b14]
imul edi, edi, 0x1000193
and edi, ebx
mov ebx, dword [edx + edi*8]
lea edx, [edx + edi*8]
mov dword [ebp - 0xc], edx
cmp ebx, esi
jne 0x1002fa02
mov dword [edx], eax
mov dword [edx + 4], eax
jmp 0x1002fa6f
mov edx, dword [edx + 4]
mov edi, dword [eax + 8]
cmp edi, dword [edx + 8]
jne 0x1002fa3c
mov edx, dword [edx]
mov dword [ebp - 4], edx
cmp edx, eax
je 0x1002fa34
mov ebx, dword [eax + 4]
mov esi, dword [ebp - 4]
mov dword [ebx], ecx
mov edi, dword [ecx + 4]
mov dword [edi], edx
mov edx, dword [edx + 4]
mov dword [edx], eax
mov dword [esi + 4], edi
mov esi, dword [ebp - 8]
mov dword [ecx + 4], ebx
mov dword [eax + 4], edx
mov edx, dword [ebp - 0xc]
mov dword [edx + 4], eax
jmp 0x1002fa6f
cmp ebx, edx
je 0x1002fa4c
mov edx, dword [edx + 4]
cmp edi, dword [edx + 8]
je 0x1002fa80
cmp ebx, edx
jne 0x1002fa40
mov ebx, dword [eax + 4]
mov dword [ebp - 4], ebx
mov dword [ebx], ecx
mov ebx, dword [ecx + 4]
mov dword [ebx], edx
mov edi, dword [edx + 4]
mov dword [edi], eax
mov dword [edx + 4], ebx
mov edx, dword [ebp - 4]
mov dword [ecx + 4], edx
mov edx, dword [ebp - 0xc]
mov dword [eax + 4], edi
mov dword [edx], eax
mov eax, ecx
cmp ecx, esi
je 0x1002faa4
mov ebx, dword [0x103c8b20]
jmp 0x1002f9b0
mov ebx, dword [eax + 4]
mov edx, dword [edx]
mov dword [ebp - 4], edx
mov esi, edx
mov dword [ebx], ecx
mov edi, dword [ecx + 4]
mov dword [edi], edx
mov edx, dword [edx + 4]
mov dword [edx], eax
mov dword [esi + 4], edi
mov esi, dword [ebp - 8]
mov dword [ecx + 4], ebx
mov dword [eax + 4], edx
jmp 0x1002fa6f
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
push str.invalid_hash_bucket_count
call fcn.101a9c13
int3
Function at 0x10030ef0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x3c
mov eax, dword [0x102924c0]
xor eax, esp
mov dword [esp + 0x38], eax
push ebx
push esi
mov esi, ecx
mov dword [esp + 0x28], edx
push edi
mov dword [esp + 0x10], esi
mov eax, dword [esi + 0x44]
mov ecx, dword [esi + 0x40]
sub eax, ecx
sar eax, 3
lea edx, [eax - 1]
cmp edx, eax
jae 0x10030f2a
lea eax, [ecx + edx*8]
test eax, eax
jne 0x10030f2f
mov eax, 0x10213028
mov ecx, 0xfff8
cmp word [eax + 6], cx
jne 0x10031097
mov eax, dword [eax]
mov dword [esp + 0x18], eax
test eax, eax
je 0x10031097
mov edi, dword [eax + 0x14]
mov ecx, esi
push 1
mov edx, edi
call fcn.10035a50
mov ecx, esi
add esp, 4
mov eax, dword [ecx + 0x44]
mov edx, dword [eax - 8]
mov eax, dword [esp + 0x18]
mov dword [esp + 0x40], edx
mov esi, dword [edx + 0x14]
mov dword [esp + 0x34], esi
mov dword [esp + 0x38], esi
lea ebx, [esi + edi]
lea edi, [eax + 0x1c]
mov dword [esp + 0x3c], ebx
mov eax, dword [eax + 0x14]
add eax, edi
mov dword [esp + 0x24], edi
mov dword [esp + 0x18], edi
or edi, 0xffffffff
mov dword [esp + 0x20], eax
or eax, edi
mov dword [esp + 0x14], edx
nop dword [eax]
mov dword [esp + 0x30], edi
mov edi, eax
mov eax, dword [esp + 0x20]
mov dword [esp + 0x1c], 0xffffffff
cmp dword [esp + 0x18], eax
jae 0x10030fec
lea ecx, [esp + 0x28]
push ecx
push eax
push dword [esp + 0x2c]
lea edx, [esp + 0x24]
call fcn.100309c0
mov ecx, dword [esp + 0x1c]
add esp, 0xc
test eax, eax
je 0x100310aa
mov eax, dword [esp + 0x28]
mov edx, dword [esp + 0x14]
mov dword [esp + 0x1c], eax
test edi, edi
js 0x10030fa0
jmp 0x10030ff0
test edi, edi
js 0x10031061
sub ebx, esi
cmp ebx, 0x38
jae 0x1003102f
sub esi, dword [esp + 0x38]
mov eax, esi
shr eax, 2
lea ebx, [esi + 0x78]
add ebx, eax
cmp ebx, esi
jb 0x100310b9
push ebx
call fcn.10052110
mov ecx, dword [esp + 0x18]
add esp, 4
mov ecx, dword [ecx + 0x14]
mov dword [esp + 0x38], ecx
lea eax, [ecx + esi]
mov dword [esp + 0x34], eax
lea eax, [ecx + ebx]
mov dword [esp + 0x3c], eax
push dword [esp + 0x2c]
lea edx, [esp + 0x38]
push dword [esp + 0x20]
push dword [esp + 0x38]
push edi
call fcn.10030d50
mov edx, dword [esp + 0x50]
add esp, 0x10
mov ebx, dword [esp + 0x3c]
mov esi, dword [esp + 0x34]
mov eax, dword [esp + 0x1c]
mov ecx, dword [esp + 0x10]
jmp 0x10030f98
sub esi, dword [esp + 0x38]
push esi
call fcn.10052110
mov ecx, dword [esp + 0x14]
add esp, 4
call fcn.10034aa0
mov ecx, dword [esp + 0x10]
mov edx, 0xfffffffe
call fcn.10033940
mov ecx, dword [esp + 0x44]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.101aaebb
mov esp, ebp
pop ebp
ret
push str.string
push 0xffffffffffffffff
push 0x85e
mov ecx, esi
call fcn.10030740
push 0x11a
mov edx, str.C:Users_naizeDesktopBLECKduk_unicode_support.c
call fcn.10030780
push str.buffer_too_long
push 0x47
mov edx, str.C:Users_naizeDesktopBLECKduk_util_bufwriter.c
call fcn.100307e0
int3
Function at 0x10073b60
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [0x102924c0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword fs:[0x30]
push esi
push edi
mov edi, ecx
test ebx, ebx
jne 0x10073b93
xor al, al
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.101aaebb
mov esp, ebp
pop ebp
ret
mov ebx, dword [ebx + 0xc]
add ebx, 0x14
mov esi, dword [ebx]
cmp esi, ebx
je 0x10073c00
mov ecx, 0x5a4d
lea edx, [esi - 8]
test edx, edx
je 0x10073bfa
mov eax, dword [edx + 0x18]
test eax, eax
je 0x10073bfa
cmp word [eax], cx
jne 0x10073bfa
mov ecx, dword [eax + 0x3c]
add ecx, eax
je 0x10073bf5
cmp dword [ecx], 0x4550
jne 0x10073bf5
mov dword [ebp - 0xc], eax
mov eax, dword [edi + 4]
mov dword [ebp - 0x10], edx
mov dword [ebp - 8], ecx
cmp eax, dword [edi + 8]
je 0x10073be9
movq xmm0, qword [ebp - 0x10]
movq qword [eax], xmm0
mov dword [eax + 8], ecx
add dword [edi + 4], 0xc
jmp 0x10073bf5
lea ecx, [ebp - 0x10]
push ecx
push eax
mov ecx, edi
call fcn.1001b150
mov ecx, 0x5a4d
mov esi, dword [esi]
cmp esi, ebx
jne 0x10073ba4
mov eax, dword [edi]
cmp eax, dword [edi + 4]
mov ecx, dword [ebp - 4]
pop edi
setne al
xor ecx, ebp
pop esi
pop ebx
call fcn.101aaebb
mov esp, ebp
pop ebp
ret
Function at 0x10074ca0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, dword [ebp + 8]
mov eax, edx
push edi
mov dword [ebp - 4], eax
mov ebx, ecx
cmp dword [esi + 0x14], 0xf
mov edi, dword [esi + 0x10]
jbe 0x10074cbc
mov esi, dword [esi]
xor ecx, ecx
mov edx, 0x811c9dc5
test edi, edi
je 0x10074cdb
movzx eax, byte [esi + ecx]
inc ecx
xor eax, edx
imul edx, eax, 0x1000193
cmp ecx, edi
jb 0x10074cc7
mov eax, dword [ebp - 4]
push edx
mov edx, eax
mov ecx, ebx
call fcn.100745a0
add esp, 4
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1007fda0
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [ebp + 0xc]
mov edx, ecx
push ebx
mov ebx, dword [ebp + 8]
mov dword [ebp - 0x14], edx
cmp ebx, eax
je 0x1007ff0f
mov eax, dword [edx + 4]
mov dword [ebp - 0x18], eax
mov eax, dword [ebx + 4]
mov dword [ebp - 8], eax
movzx eax, byte [ebx + 8]
xor eax, 0x811c9dc5
imul ecx, eax, 0x1000193
movzx eax, byte [ebx + 9]
push esi
push edi
mov edi, dword [edx + 0xc]
mov esi, ebx
xor ecx, eax
mov dword [ebp - 0x1c], edi
movzx eax, byte [ebx + 0xa]
imul ecx, ecx, 0x1000193
xor ecx, eax
movzx eax, byte [ebx + 0xb]
imul ecx, ecx, 0x1000193
xor ecx, eax
mov eax, dword [edx + 0x18]
imul ecx, ecx, 0x1000193
and eax, ecx
mov ecx, dword [edi + eax*8]
mov dword [ebp - 4], ecx
lea eax, [edi + eax*8]
mov dword [ebp - 0xc], eax
mov eax, dword [eax + 4]
mov dword [ebp - 0x10], eax
nop word [eax + eax]
mov edi, esi
mov ebx, esi
mov esi, dword [esi]
lea ecx, [edi + 0x50]
call fcn.100158c0
push 0x5c
push edi
call fcn.101ab3ee
mov edx, dword [ebp - 0x14]
add esp, 8
dec dword [edx + 8]
cmp ebx, dword [ebp - 0x10]
je 0x1007fe6d
mov eax, dword [ebp + 0xc]
cmp esi, eax
jne 0x1007fe20
mov ecx, dword [ebp - 4]
cmp ecx, dword [ebp + 8]
jne 0x1007ff05
mov edi, dword [ebp - 0xc]
mov ecx, dword [ebp - 8]
mov dword [edi], esi
mov dword [ecx], esi
pop edi
mov dword [esi + 4], ecx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
mov ecx, dword [ebp - 4]
mov edi, dword [ebp - 0xc]
cmp ecx, dword [ebp + 8]
jne 0x1007fe81
mov eax, dword [ebp - 0x18]
mov ecx, eax
mov dword [edi], eax
jmp 0x1007fe84
mov ecx, dword [ebp - 8]
mov eax, dword [ebp + 0xc]
mov dword [edi + 4], ecx
cmp esi, eax
je 0x1007ff05
nop
movzx eax, byte [esi + 8]
xor eax, 0x811c9dc5
imul ecx, eax, 0x1000193
movzx eax, byte [esi + 9]
xor ecx, eax
movzx eax, byte [esi + 0xa]
imul ecx, ecx, 0x1000193
xor ecx, eax
movzx eax, byte [esi + 0xb]
imul ecx, ecx, 0x1000193
xor ecx, eax
imul eax, ecx, 0x1000193
mov ecx, dword [ebp - 0x1c]
and eax, dword [edx + 0x18]
lea eax, [ecx + eax*8]
mov dword [ebp - 4], eax
mov eax, dword [eax + 4]
mov dword [ebp - 0x10], eax
mov edi, esi
mov ebx, esi
mov esi, dword [esi]
lea ecx, [edi + 0x50]
call fcn.100158c0
push 0x5c
push edi
call fcn.101ab3ee
mov edx, dword [ebp - 0x14]
add esp, 8
mov eax, dword [ebp + 0xc]
dec dword [edx + 8]
cmp ebx, dword [ebp - 0x10]
je 0x1007ff16
cmp esi, eax
jne 0x1007fed5
mov ecx, dword [ebp - 4]
mov dword [ecx], esi
mov ecx, dword [ebp - 8]
pop edi
mov dword [ecx], esi
mov dword [esi + 4], ecx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
mov ecx, dword [ebp - 4]
mov ebx, dword [ebp - 0x18]
mov dword [ecx], ebx
mov dword [ecx + 4], ebx
cmp esi, eax
jne 0x1007fe90
mov ecx, dword [ebp - 8]
pop edi
mov dword [ecx], esi
mov dword [esi + 4], ecx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x1007ff50
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [ebp + 0xc]
mov edx, ecx
push ebx
mov ebx, dword [ebp + 8]
mov dword [ebp - 0x14], edx
cmp ebx, eax
je 0x100800c1
mov eax, dword [edx + 4]
mov dword [ebp - 0x18], eax
mov eax, dword [ebx + 4]
mov dword [ebp - 8], eax
movzx eax, byte [ebx + 8]
xor eax, 0x811c9dc5
imul ecx, eax, 0x1000193
movzx eax, byte [ebx + 9]
push esi
push edi
mov edi, dword [edx + 0xc]
mov esi, ebx
xor ecx, eax
mov dword [ebp - 0x1c], edi
movzx eax, byte [ebx + 0xa]
imul ecx, ecx, 0x1000193
xor ecx, eax
movzx eax, byte [ebx + 0xb]
imul ecx, ecx, 0x1000193
xor ecx, eax
mov eax, dword [edx + 0x18]
imul ecx, ecx, 0x1000193
and eax, ecx
mov ecx, dword [edi + eax*8]
mov dword [ebp - 4], ecx
lea eax, [edi + eax*8]
mov dword [ebp - 0xc], eax
mov eax, dword [eax + 4]
mov dword [ebp - 0x10], eax
nop word [eax + eax]
mov edi, esi
mov ebx, esi
mov esi, dword [esi]
lea ecx, [edi + 0xc]
call fcn.10080b00
push 0x2c
push edi
call fcn.101ab3ee
mov edx, dword [ebp - 0x14]
add esp, 8
dec dword [edx + 8]
cmp ebx, dword [ebp - 0x10]
je 0x1008001d
mov eax, dword [ebp + 0xc]
cmp esi, eax
jne 0x1007ffd0
mov ecx, dword [ebp - 4]
cmp ecx, dword [ebp + 8]
jne 0x100800b7
mov edi, dword [ebp - 0xc]
mov ecx, dword [ebp - 8]
mov dword [edi], esi
mov dword [ecx], esi
pop edi
mov dword [esi + 4], ecx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
mov ecx, dword [ebp - 4]
mov edi, dword [ebp - 0xc]
cmp ecx, dword [ebp + 8]
jne 0x10080031
mov eax, dword [ebp - 0x18]
mov ecx, eax
mov dword [edi], eax
jmp 0x10080034
mov ecx, dword [ebp - 8]
mov eax, dword [ebp + 0xc]
mov dword [edi + 4], ecx
cmp esi, eax
je 0x100800b7
nop
movzx eax, byte [esi + 8]
xor eax, 0x811c9dc5
imul ecx, eax, 0x1000193
movzx eax, byte [esi + 9]
xor ecx, eax
movzx eax, byte [esi + 0xa]
imul ecx, ecx, 0x1000193
xor ecx, eax
movzx eax, byte [esi + 0xb]
imul ecx, ecx, 0x1000193
xor ecx, eax
mov eax, dword [edx + 0x18]
imul ecx, ecx, 0x1000193
and eax, ecx
mov ecx, dword [ebp - 0x1c]
lea eax, [ecx + eax*8]
mov dword [ebp - 4], eax
mov eax, dword [eax + 4]
mov dword [ebp - 0x10], eax
mov edi, esi
mov ebx, esi
mov esi, dword [esi]
lea ecx, [edi + 0xc]
call fcn.10080b00
push 0x2c
push edi
call fcn.101ab3ee
mov edx, dword [ebp - 0x14]
add esp, 8
mov eax, dword [ebp + 0xc]
dec dword [edx + 8]
cmp ebx, dword [ebp - 0x10]
je 0x100800c8
cmp esi, eax
jne 0x10080087
mov ecx, dword [ebp - 4]
mov dword [ecx], esi
mov ecx, dword [ebp - 8]
pop edi
mov dword [ecx], esi
mov dword [esi + 4], ecx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
mov ecx, dword [ebp - 4]
mov ebx, dword [ebp - 0x18]
mov dword [ecx], ebx
mov dword [ecx + 4], ebx
cmp esi, eax
jne 0x10080040
mov ecx, dword [ebp - 8]
pop edi
mov dword [ecx], esi
mov dword [esi + 4], ecx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x10080370
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x101ddf35
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
push ebx
push esi
push edi
mov eax, dword [0x102924c0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov edx, dword [ebp + 0xc]
mov edi, dword [ebp + 8]
mov dword [ebp - 0x10], edx
mov dword [ebp - 0x20], edi
movzx eax, byte [edx]
xor eax, 0x811c9dc5
imul ecx, eax, 0x1000193
movzx eax, byte [edx + 1]
xor ecx, eax
movzx eax, byte [edx + 2]
imul ecx, ecx, 0x1000193
xor ecx, eax
movzx eax, byte [edx + 3]
imul ecx, ecx, 0x1000193
xor ecx, eax
imul eax, ecx, 0x1000193
mov ecx, ebx
push eax
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x1c]
push edx
push eax
call fcn.1001b310
mov eax, dword [ebp - 0x18]
test eax, eax
je 0x100803fa
mov dword [edi], eax
mov byte [edi + 4], 0
jmp 0x1008052c
cmp dword [ebx + 8], 0xaaaaaaa
je 0x10080542
lea eax, [ebx + 4]
mov dword [ebp - 0x28], eax
mov dword [ebp - 4], 0
push 0x18
mov dword [ebp - 0x24], 0
call fcn.101aaedc
mov ecx, dword [ebp - 0x10]
mov esi, eax
add esp, 4
mov dword [ebp - 0x24], esi
mov ecx, dword [ecx]
mov dword [esi + 8], ecx
mov byte [esi + 0xc], 0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
mov dword [ebp - 4], 1
mov eax, dword [ebx + 8]
inc eax
movss xmm3, dword [ebx]
movd xmm0, eax
cvtdq2pd xmm0, xmm0
shr eax, 0x1f
addsd xmm0, qword [eax*8 + 0x102785a0]
mov eax, dword [ebx + 0x1c]
movd xmm1, eax
cvtdq2pd xmm1, xmm1
shr eax, 0x1f
cvtpd2ps xmm0, xmm0
addsd xmm1, qword [eax*8 + 0x102785a0]
movaps xmm2, xmm0
cvtpd2ps xmm1, xmm1
divss xmm2, xmm1
comiss xmm2, xmm3
jbe 0x100804df
divss xmm0, xmm3
call fcn.10006260
call fcn.101d4f20
mov ecx, 8
cmp eax, ecx
cmova ecx, eax
mov eax, dword [ebx + 0x1c]
cmp eax, ecx
jae 0x100804c1
cmp eax, 0x200
jae 0x100804bf
shl eax, 3
cmp eax, ecx
jae 0x100804c1
mov eax, ecx
push eax
mov ecx, ebx
call fcn.10080940
push dword [ebp - 0x14]
lea eax, [esi + 8]
mov ecx, ebx
push eax
lea eax, [ebp - 0x1c]
push eax
call fcn.1001b310
mov edx, dword [eax]
jmp 0x100804e2
mov edx, dword [ebp - 0x1c]
mov eax, dword [edx + 4]
inc dword [ebx + 8]
mov edi, dword [ebp - 0x28]
mov dword [esi + 4], eax
mov dword [esi], edx
mov dword [eax], esi
mov dword [edx + 4], esi
mov ecx, dword [ebx + 0xc]
mov dword [ebp - 0x10], eax
mov eax, dword [ebx + 0x18]
and eax, dword [ebp - 0x14]
mov ebx, dword [ecx + eax*8]
cmp ebx, dword [edi]
jne 0x1008050d
mov dword [ecx + eax*8], esi
jmp 0x1008051f
cmp ebx, edx
jne 0x10080516
mov dword [ecx + eax*8], esi
jmp 0x10080523
mov edx, dword [ebp - 0x10]
cmp dword [ecx + eax*8 + 4], edx
jne 0x10080523
mov dword [ecx + eax*8 + 4], esi
mov edi, dword [ebp - 0x20]
mov dword [edi], esi
mov byte [edi + 4], 1
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
push str.unordered_map_set_too_long
call fcn.101a9c13
int3
Function at 0x10080940
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
mov ebx, ecx
mov eax, 0x1fffffff
bsr ecx, eax
push esi
push edi
mov edi, 1
mov dword [ebp - 8], ebx
mov eax, edi
shl eax, cl
mov ecx, dword [ebp + 8]
cmp ecx, eax
ja 0x10080a9a
lea eax, [ecx - 1]
mov esi, dword [ebx + 4]
or eax, edi
mov dword [ebp - 0xc], esi
bsr ecx, eax
push esi
lea ecx, [ecx + 1]
shl edi, cl
lea ecx, [ebx + 0xc]
lea eax, [edi + edi]
push eax
call fcn.100175e0
lea eax, [edi - 1]
mov dword [ebx + 0x1c], edi
mov dword [ebx + 0x18], eax
mov eax, dword [ebx + 4]
mov eax, dword [eax]
mov ecx, eax
cmp eax, esi
je 0x10080a6d
movzx edx, byte [eax + 8]
xor edx, 0x811c9dc5
mov ecx, dword [ecx]
imul edi, edx, 0x1000193
movzx edx, byte [eax + 9]
xor edi, edx
movzx edx, byte [eax + 0xa]
imul edi, edi, 0x1000193
xor edi, edx
movzx edx, byte [eax + 0xb]
imul edi, edi, 0x1000193
xor edi, edx
imul edx, edi, 0x1000193
mov edi, dword [ebx + 0x18]
and edi, edx
mov edx, dword [ebx + 0xc]
lea edx, [edx + edi*8]
mov edi, dword [edx]
mov dword [ebp - 0x10], edx
cmp edi, esi
jne 0x100809f3
mov dword [edx], eax
mov dword [edx + 4], eax
jmp 0x10080a63
mov edx, dword [edx + 4]
mov ebx, dword [eax + 8]
cmp ebx, dword [edx + 8]
jne 0x10080a2d
mov edx, dword [edx]
mov dword [ebp - 4], edx
cmp edx, eax
je 0x10080a25
mov ebx, dword [eax + 4]
mov esi, dword [ebp - 4]
mov dword [ebx], ecx
mov edi, dword [ecx + 4]
mov dword [edi], edx
mov edx, dword [edx + 4]
mov dword [edx], eax
mov dword [esi + 4], edi
mov esi, dword [ebp - 0xc]
mov dword [ecx + 4], ebx
mov dword [eax + 4], edx
mov edx, dword [ebp - 0x10]
mov dword [edx + 4], eax
jmp 0x10080a60
cmp edi, edx
je 0x10080a3d
mov edx, dword [edx + 4]
cmp ebx, dword [edx + 8]
je 0x10080a76
cmp edi, edx
jne 0x10080a31
mov ebx, dword [eax + 4]
mov dword [ebp - 4], ebx
mov dword [ebx], ecx
mov ebx, dword [ecx + 4]
mov dword [ebx], edx
mov edi, dword [edx + 4]
mov dword [edi], eax
mov dword [edx + 4], ebx
mov edx, dword [ebp - 4]
mov dword [ecx + 4], edx
mov edx, dword [ebp - 0x10]
mov dword [eax + 4], edi
mov dword [edx], eax
mov ebx, dword [ebp - 8]
mov eax, ecx
cmp ecx, esi
jne 0x100809a2
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
mov ebx, dword [eax + 4]
mov edx, dword [edx]
mov dword [ebp - 4], edx
mov esi, edx
mov dword [ebx], ecx
mov edi, dword [ecx + 4]
mov dword [edi], edx
mov edx, dword [edx + 4]
mov dword [edx], eax
mov dword [esi + 4], edi
mov esi, dword [ebp - 0xc]
mov dword [ecx + 4], ebx
mov dword [eax + 4], edx
jmp 0x10080a60
push str.invalid_hash_bucket_count
call fcn.101a9c13
int3
Function at 0x1008b360
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x101defe5
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
push ebx
push esi
push edi
mov eax, dword [0x102924c0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
lea edi, [ecx + 0xc28]
mov dword [ebp - 4], 0
push str.style
lea edx, [ebp + 8]
lea ecx, [ebp - 0x24]
call fcn.100c4710
add esp, 4
push eax
mov ecx, edi
mov byte [ebp - 4], 1
call fcn.10015b90
mov esi, dword [eax]
mov byte [ebp - 4], 0
mov ecx, dword [ebp - 0x10]
cmp ecx, 0xf
jbe 0x1008b3ee
mov edx, dword [ebp - 0x24]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x1008b3e4
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x1008b4ab
push ecx
push edx
call fcn.101ab3ee
add esp, 8
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x10], 0xf
mov byte [ebp - 0x24], 0
cmp esi, 3
ja case.0x1008b405.0
jmp dword [esi*4 + 0x1008b4b0]
lea eax, [ebp + 8]
mov ecx, edi
push eax
call fcn.100c3ca0
push dword [eax]
call dword [sym.imp.USER32.dll_GetKeyState]
cwde
shr eax, 0x10
test eax, eax
setne bl
jmp 0x1008b465
lea eax, [ebp + 8]
mov ecx, edi
push eax
call fcn.100c3ca0
push dword [eax]
call dword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
setne bl
jmp 0x1008b465
lea eax, [ebp + 8]
mov ecx, edi
push eax
call fcn.100c3ca0
push dword [eax]
call dword [sym.imp.USER32.dll_GetKeyState]
cwde
shr eax, 0x10
test eax, eax
sete bl
jmp 0x1008b465
mov bl, 1
mov ecx, dword [ebp + 0x1c]
cmp ecx, 0xf
jbe 0x1008b495
mov edx, dword [ebp + 8]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x1008b48b
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x1008b4ab
push ecx
push edx
call fcn.101ab3ee
add esp, 8
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x18
call fcn.101b237e
arpl word [eax + ecx + 0x8b40c10], si
adc byte [edx], ch
mov ah, 8
adc byte [ebp - 0x4c], al
or byte [eax], dl
int3