joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10050f90
Capabilities:
Enumerate pe sections

Disassembly:
sub esp, 0x10c
push ebx
push ebp
push esi
mov esi, dword [esp + 0x11c]
push edi
movss dword [esp + 0x10], xmm3
mov dword [esp + 0x14], ecx
movzx ebx, byte [esi + 8]
movzx eax, byte [esi + 9]
shl ebx, 8
add ebx, eax
movzx eax, byte [esi + 0xa]
shl ebx, 8
add ebx, eax
movzx eax, byte [esi + 0xb]
shl ebx, 8
add ebx, eax
mov eax, dword [0x10132b9c]
test eax, eax
je 0x10050fd9
inc dword [eax + 0x370]
push ebx
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
movzx edx, byte [esi]
add esp, 4
movzx ecx, byte [esi + 1]
mov ebp, eax
shl edx, 8
add edx, ecx
movzx ecx, byte [esi + 2]
shl edx, 8
add edx, ecx
movzx ecx, byte [esi + 3]
shl edx, 8
add edx, ecx
cmp edx, 0x57bc0000
jne 0x10051088
movzx ecx, byte [esi + 4]
movzx eax, byte [esi + 5]
shl ecx, 8
add ecx, eax
movzx eax, byte [esi + 6]
shl ecx, 8
add ecx, eax
movzx eax, byte [esi + 7]
shl ecx, 8
add ecx, eax
jne 0x10051088
movzx ecx, byte [esi + 8]
movzx eax, byte [esi + 9]
movzx edi, byte [esi + 0xb]
shl ecx, 8
add ecx, eax
mov dword [0x10132ef8], esi
movzx eax, byte [esi + 0xa]
add esi, 0x10
shl ecx, 8
add ecx, eax
mov dword [0x10132f00], ebp
shl ecx, 8
add ecx, ebp
mov dword [0x10132f04], ebp
add edi, ecx
mov ecx, esi
mov dword [0x10132efc], edi
call fcn.10053810
cmp eax, esi
je 0x10051088
cmp dword [0x10132f04], edi
ja 0x10051088
mov ecx, eax
mov esi, eax
call fcn.10053810
cmp eax, esi
jne 0x10051073
mov esi, dword [esp + 0x128]
test esi, esi
je 0x100510a0
mov ecx, 0x20
lea edi, [esp + 0x18]
rep movsd dword es:[edi], dword [esi]
jmp 0x100510eb
push 0x80
lea eax, [esp + 0x1c]
push 0
push eax
call sub.VCRUNTIME140.dll_memset
mov eax, 0xffff
mov byte [esp + 0x2c], 1
add esp, 0xc
mov dword [esp + 0x2c], 3
mov dword [esp + 0x30], 1
mov dword [esp + 0x50], 0x7f7fffff
mov dword [esp + 0x68], 0
mov dword [esp + 0x5c], 0x3f800000
mov word [esp + 0x60], ax
movss xmm0, dword [esp + 0x10]
lea esi, [esp + 0x18]
comiss xmm0, dword [0x1012c718]
mov ecx, 0x20
lea edi, [esp + 0x98]
rep movsd dword es:[edi], dword [esi]
mov ecx, 0x20
mov byte [esp + 0xa0], 1
lea esi, [esp + 0x98]
lea edi, [esp + 0x18]
rep movsd dword es:[edi], dword [esi]
mov dword [esp + 0x18], ebp
mov dword [esp + 0x1c], ebx
jbe 0x10051134
movss dword [esp + 0x28], xmm0
mov eax, dword [esp + 0x12c]
test eax, eax
mov ecx, dword [esp + 0x48]
cmovne ecx, eax
lea eax, [esp + 0x18]
mov dword [esp + 0x48], ecx
mov ecx, dword [esp + 0x14]
push eax
call fcn.10050c40
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10c
ret 0x10
Function at 0x10054d50
Capabilities:
Log keystrokes via polling

Disassembly:
sub esp, 0x2c
push ebx
mov ebx, dword [0x10132b9c]
push ebp
push esi
push edi
test ebx, ebx
je 0x10054d69
mov ebp, dword [ebx + 0xc4]
jmp 0x10054d6b
xor ebp, ebp
lea eax, [esp + 0x28]
xorps xmm0, xmm0
push eax
movups xmmword [esp + 0x2c], xmm0
push dword [ebp]
call dword [sym.imp.USER32.dll_GetClientRect]
mov eax, dword [esp + 0x30]
sub eax, dword [esp + 0x28]
movd xmm1, eax
mov eax, dword [esp + 0x34]
sub eax, dword [esp + 0x2c]
cvtdq2ps xmm1, xmm1
movd xmm0, eax
lea eax, [esp + 0x18]
cvtdq2ps xmm0, xmm0
push eax
movss dword [ebx + 0x10], xmm1
movss dword [ebx + 0x14], xmm0
xorps xmm0, xmm0
movlpd qword [esp + 0x1c], xmm0
call dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov edi, dword [esp + 0x18]
mov ecx, edi
sub ecx, dword [ebp + 8]
mov esi, dword [esp + 0x1c]
mov edx, esi
sbb edx, dword [ebp + 0xc]
call fcn.100d7f80
mov edx, dword [ebp + 0x14]
mov ecx, dword [ebp + 0x10]
cvtsd2ss xmm0, xmm0
movss dword [esp + 0x10], xmm0
call fcn.100d7f80
movss xmm1, dword [esp + 0x10]
cvtsd2ss xmm0, xmm0
push 0x11
divss xmm1, xmm0
movss dword [ebx + 0x18], xmm1
mov dword [ebp + 0xc], esi
mov esi, dword [sym.imp.USER32.dll_GetKeyState]
mov dword [ebp + 8], edi
call esi
shr eax, 0xf
and al, 1
push 0x10
mov byte [ebx + 0xfc], al
call esi
shr eax, 0xf
and al, 1
push 0x12
mov byte [ebx + 0xfd], al
call esi
mov esi, dword [0x10132b9c]
shr eax, 0xf
and al, 1
mov byte [ebx + 0xff], 0
mov byte [ebx + 0xfe], al
test esi, esi
je 0x10054e4e
mov edi, dword [esi + 0xc4]
jmp 0x10054e50
xor edi, edi
cmp byte [esi + 0x357], 0
je 0x10054e90
cvttss2si eax, dword [esi + 0xe4]
mov dword [esp + 0x10], eax
cvttss2si eax, dword [esi + 0xe8]
mov dword [esp + 0x14], eax
lea eax, [esp + 0x10]
push eax
push dword [edi]
call dword [sym.imp.USER32.dll_ClientToScreen]
test eax, eax
je 0x10054e90
push dword [esp + 0x14]
push dword [esp + 0x14]
call dword [sym.imp.USER32.dll_SetCursorPos]
mov dword [esi + 0xe4], 0xff7fffff
mov dword [esi + 0xe8], 0xff7fffff
call dword [sym.imp.USER32.dll_GetForegroundWindow]
test eax, eax
je 0x10054f02
mov ecx, dword [edi]
cmp eax, ecx
je 0x10054ec0
push ecx
push eax
call dword [sym.imp.USER32.dll_IsChild]
test eax, eax
je 0x10054f02
lea eax, [esp + 0x20]
push eax
call dword [sym.imp.USER32.dll_GetCursorPos]
test eax, eax
je 0x10054f02
lea eax, [esp + 0x20]
push eax
push dword [edi]
call dword [sym.imp.USER32.dll_ScreenToClient]
test eax, eax
je 0x10054f02
movd xmm0, dword [esp + 0x20]
movd xmm1, dword [esp + 0x24]
cvtdq2ps xmm0, xmm0
cvtdq2ps xmm1, xmm1
movss dword [esi + 0xe4], xmm0
movss dword [esi + 0xe8], xmm1
cmp byte [ebx + 0xb0], 0
je 0x10054f10
or eax, 0xffffffff
jmp 0x10054f1b
mov eax, dword [0x10132b9c]
mov eax, dword [eax + 0x1e84]
cmp dword [ebp + 0x18], eax
je 0x10054f28
mov dword [ebp + 0x18], eax
call fcn.100549b0
call fcn.10054ae0
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x2c
ret
Function at 0x10068490
Capabilities:
Hash data with crc32

Disassembly:
test dword [ecx + 0xc], 0x100000
push esi
push edi
mov edi, edx
je 0x10068500
mov cl, byte [edi]
lea esi, [edi + 1]
or eax, 0xffffffff
test cl, cl
je 0x100684d8
or edi, 0xffffffff
nop dword [eax]
cmp cl, 0x23
jne 0x100684bf
cmp byte [esi], cl
jne 0x100684bf
cmp byte [esi + 1], cl
cmove eax, edi
movzx edx, al
movzx ecx, cl
xor edx, ecx
shr eax, 8
mov cl, byte [esi]
inc esi
xor eax, dword [edx*4 + 0x1011be58]
test cl, cl
jne 0x100684b0
mov ecx, dword [0x10132b9c]
not eax
cmp dword [ecx + 0x1be0], eax
jne 0x100684ee
mov dword [ecx + 0x1be4], eax
cmp dword [ecx + 0x1c1c], eax
jne 0x10068545
pop edi
mov byte [ecx + 0x1c20], 1
pop esi
ret
mov esi, dword [0x10132b9c]
xor edx, edx
mov eax, dword [esi + 0x1bac]
mov ecx, dword [eax + 0xe4]
mov eax, dword [eax + 0xec]
push dword [eax + ecx*4 - 4]
mov ecx, edi
call fcn.10037830
add esp, 4
cmp dword [esi + 0x1be0], eax
jne 0x10068536
mov dword [esi + 0x1be4], eax
cmp dword [esi + 0x1c1c], eax
jne 0x10068545
mov byte [esi + 0x1c20], 1
pop edi
pop esi
ret
Function at 0x1006f640
Capabilities:
Enumerate threads
Suspend thread

Disassembly:
sub esp, 0x20
push ebx
push ebp
push esi
mov esi, ecx
mov dword [esp + 0xc], edx
push edi
push 0
push 4
mov dword [esi], 0
mov dword [esi + 4], 0
mov dword [esi + 8], 0
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov edi, eax
cmp edi, 0xffffffff
je 0x1006f73e
lea eax, [esp + 0x14]
mov dword [esp + 0x14], 0x1c
push eax
push edi
call dword [sym.imp.KERNEL32.dll_Thread32First]
test eax, eax
je 0x1006f737
mov ebx, dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov ebp, dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
nop
cmp dword [esp + 0x14], 0x10
jb 0x1006f71b
call ebx
cmp dword [esp + 0x20], eax
jne 0x1006f71b
call ebp
cmp dword [esp + 0x1c], eax
je 0x1006f71b
mov edx, dword [esi]
test edx, edx
jne 0x1006f6e0
push 0x200
push edx
push dword [0x10132ba8]
mov dword [esi + 4], 0x80
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov edx, eax
mov dword [esi], edx
test edx, edx
je 0x1006f737
jmp 0x1006f70b
mov eax, dword [esi + 4]
cmp dword [esi + 8], eax
jb 0x1006f70b
shl eax, 3
push eax
push edx
push 0
push dword [0x10132ba8]
call dword [sym.imp.KERNEL32.dll_HeapReAlloc]
mov edx, eax
test edx, edx
je 0x1006f737
mov eax, dword [esi + 4]
add eax, eax
mov dword [esi], edx
mov dword [esi + 4], eax
mov ecx, dword [esi + 8]
mov eax, dword [esp + 0x1c]
mov dword [edx + ecx*4], eax
lea eax, [ecx + 1]
mov dword [esi + 8], eax
lea eax, [esp + 0x14]
mov dword [esp + 0x14], 0x1c
push eax
push edi
call dword [sym.imp.KERNEL32.dll_Thread32Next]
test eax, eax
jne 0x1006f6a0
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [esi], 0
je 0x1006f788
xor edi, edi
cmp dword [esi + 8], edi
jbe 0x1006f788
mov ebp, dword [esp + 0x34]
nop
mov eax, dword [esi]
push dword [eax + edi*4]
push 0
push 0x5a
call dword [sym.imp.KERNEL32.dll_OpenThread]
mov ebx, eax
test ebx, ebx
je 0x1006f782
push ebx
call dword [sym.imp.KERNEL32.dll_SuspendThread]
mov edx, dword [esp + 0x10]
mov ecx, ebx
push ebp
call fcn.1006f4f0
add esp, 4
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
inc edi
cmp edi, dword [esi + 8]
jb 0x1006f750
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x20
ret

Function at 0x1006f790
Capabilities:
Resume thread

Disassembly:
push ebx
mov ebx, ecx
cmp dword [ebx], 0
je 0x1006f7e0
push esi
xor esi, esi
cmp dword [ebx + 8], esi
jbe 0x1006f7cf
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_ResumeThread]
push edi
mov eax, dword [ebx]
push dword [eax + esi*4]
push 0
push 0x5a
call dword [sym.imp.KERNEL32.dll_OpenThread]
mov edi, eax
test edi, edi
je 0x1006f7c7
push edi
call ebp
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
inc esi
cmp esi, dword [ebx + 8]
jb 0x1006f7a8
pop edi
pop ebp
push dword [ebx]
push 0
push dword [0x10132ba8]
call dword [sym.imp.KERNEL32.dll_HeapFree]
pop esi
pop ebx
ret
Function at 0x1006f7f0
Capabilities:
Allocate or change rwx memory

Disassembly:
push ecx
push ebx
push ebp
push esi
imul esi, ecx, 0x2c
mov ebx, edx
push edi
add esi, dword [0x101388f0]
mov eax, dword [esi]
mov cl, byte [esi + 0x14]
and cl, 1
lea edi, [eax - 5]
cmove edi, eax
movzx eax, cl
lea ebp, [eax*2 + 5]
lea eax, [esp + 0x10]
push eax
push 0x40
push ebp
push edi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x1006f836
pop edi
pop esi
pop ebp
mov eax, 0xa
pop ebx
pop ecx
ret
test ebx, ebx
je 0x1006f857
mov byte [edi], 0xe9
mov eax, dword [esi + 4]
sub eax, edi
sub eax, 5
mov dword [edi + 1], eax
test byte [esi + 0x14], 1
je 0x1006f878
mov eax, dword [esi]
mov word [eax], 0xf9eb
jmp 0x1006f878
mov eax, dword [esi + 0xc]
test byte [esi + 0x14], 1
mov dword [edi], eax
je 0x1006f872
mov ax, word [esi + 0x10]
mov word [edi + 4], ax
mov al, byte [esi + 0x12]
mov byte [edi + 6], al
jmp 0x1006f878
mov al, byte [esi + 0x10]
mov byte [edi + 4], al
lea eax, [esp + 0x10]
push eax
push dword [esp + 0x14]
push ebp
push edi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
push ebp
push edi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_FlushInstructionCache]
mov cl, bl
shl bl, 2
add cl, cl
xor cl, byte [esi + 0x14]
and cl, 2
xor cl, byte [esi + 0x14]
xor bl, cl
and bl, 4
xor bl, cl
xor eax, eax
pop edi
mov byte [esi + 0x14], bl
pop esi
pop ebp
pop ebx
pop ecx
ret

Function at 0x1006f8c0
Capabilities:
Resume thread

Disassembly:
mov edx, dword [0x101388f8]
sub esp, 0xc
push ebx
push ebp
push esi
xor ebp, ebp
xor esi, esi
mov ebx, ecx
test edx, edx
je 0x1006f9a8
mov eax, dword [0x101388f0]
add eax, 0x14
movzx ecx, byte [eax]
shr ecx, 1
and ecx, 1
cmp ecx, ebx
jne 0x1006f8ff
inc esi
add eax, 0x2c
cmp esi, edx
jb 0x1006f8e2
pop esi
mov eax, ebp
pop ebp
pop ebx
add esp, 0xc
ret
cmp esi, 0xffffffff
je 0x1006f9a8
xor eax, eax
lea ecx, [esp + 0xc]
test ebx, ebx
push edi
setne al
or edx, 0xffffffff
push eax
call fcn.1006f640
mov ecx, dword [0x101388f8]
add esp, 4
cmp esi, ecx
jae 0x1006f960
imul edi, esi, 0x2c
nop dword [eax]
mov eax, dword [0x101388f0]
movzx eax, byte [edi + eax + 0x14]
shr eax, 1
and eax, 1
cmp eax, ebx
je 0x1006f958
mov edx, ebx
mov ecx, esi
call fcn.1006f7f0
mov ebp, eax
test ebp, ebp
jne 0x1006f960
mov ecx, dword [0x101388f8]
inc esi
add edi, 0x2c
cmp esi, ecx
jb 0x1006f930
mov ebx, dword [esp + 0x10]
test ebx, ebx
je 0x1006f9a7
xor esi, esi
cmp dword [esp + 0x18], esi
jbe 0x1006f998
push dword [ebx + esi*4]
push 0
push 0x5a
call dword [sym.imp.KERNEL32.dll_OpenThread]
mov edi, eax
test edi, edi
je 0x1006f991
push edi
call dword [sym.imp.KERNEL32.dll_ResumeThread]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
inc esi
cmp esi, dword [esp + 0x18]
jb 0x1006f970
push ebx
push 0
push dword [0x10132ba8]
call dword [sym.imp.KERNEL32.dll_HeapFree]
pop edi
pop esi
mov eax, ebp
pop ebp
pop ebx
add esp, 0xc
ret
Function at 0x1006fcb0
Capabilities:
Allocate or change rwx memory

Disassembly:
sub esp, 0x14
push ebp
push esi
push edi
xor edi, edi
call fcn.1006f9c0
cmp dword [0x10132ba8], edi
je 0x1006fe3f
mov ecx, dword [0x101388f8]
xor esi, esi
test ecx, ecx
je 0x1006fcec
mov edx, dword [0x101388f0]
mov eax, edx
nop dword [eax]
cmp dword [eax], edi
je 0x1006fcf6
inc esi
add eax, 0x2c
cmp esi, ecx
jb 0x1006fce0
mov edi, 4
jmp 0x1006fe44
cmp esi, 0xffffffff
je 0x1006fcec
imul ebp, esi, 0x2c
test byte [edx + ebp + 0x14], 2
je 0x1006fdbb
push ebx
push 0
mov edx, esi
lea ecx, [esp + 0x1c]
call fcn.1006f640
mov edi, dword [0x101388f0]
add esp, 4
add edi, ebp
mov eax, dword [edi]
mov cl, byte [edi + 0x14]
and cl, 1
lea ebx, [eax - 5]
cmove ebx, eax
movzx eax, cl
lea ecx, [esp + 0x10]
push ecx
push 0x40
lea eax, [eax*2 + 5]
push eax
push ebx
mov dword [esp + 0x24], eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x1006fd56
lea edi, [eax + 0xa]
jmp 0x1006fda3
mov eax, dword [edi + 0xc]
test byte [edi + 0x14], 1
mov dword [ebx], eax
je 0x1006fd71
mov ax, word [edi + 0x10]
mov word [ebx + 4], ax
mov al, byte [edi + 0x12]
mov byte [ebx + 6], al
jmp 0x1006fd77
mov al, byte [edi + 0x10]
mov byte [ebx + 4], al
lea eax, [esp + 0x10]
push eax
push dword [esp + 0x14]
push dword [esp + 0x1c]
push ebx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
push dword [esp + 0x14]
push ebx
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_FlushInstructionCache]
and byte [edi + 0x14], 0xf9
xor edi, edi
lea ecx, [esp + 0x18]
call fcn.1006f790
pop ebx
test edi, edi
jne 0x1006fe44
mov edx, dword [0x101388f0]
mov ecx, dword [edx + ebp + 8]
call fcn.1006ece0
mov eax, dword [0x101388f8]
lea edx, [eax - 1]
cmp esi, edx
jae 0x1006fe00
mov ecx, dword [0x101388f0]
imul eax, eax, 0x2c
movups xmm0, xmmword [eax + ecx - 0x2c]
movups xmmword [ecx + ebp], xmm0
movups xmm0, xmmword [eax + ecx - 0x1c]
movups xmmword [ecx + ebp + 0x10], xmm0
movq xmm0, qword [eax + ecx - 0xc]
movq qword [ecx + ebp + 0x20], xmm0
mov eax, dword [eax + ecx - 4]
mov dword [ecx + ebp + 0x28], eax
mov eax, dword [0x101388f4]
shr eax, 1
mov dword [0x101388f8], edx
cmp eax, 0x20
jb 0x1006fe44
cmp eax, edx
jb 0x1006fe44
imul eax, eax, 0x2c
push eax
push dword [0x101388f0]
push 0
push dword [0x10132ba8]
call dword [sym.imp.KERNEL32.dll_HeapReAlloc]
test eax, eax
je 0x1006fe44
shr dword [0x101388f4], 1
mov dword [0x101388f0], eax
jmp 0x1006fe44
mov edi, 2
xor ecx, ecx
mov eax, 0x10132ba4
xchg dword [eax], ecx
mov eax, edi
pop edi
pop esi
pop ebp
add esp, 0x14
ret
Function at 0x1007ba30
Capabilities:
Hash data using fnv

Disassembly:
sub esp, 0xc
push ebx
mov ebx, dword [esp + 0x18]
push ebp
push esi
push edi
movzx eax, byte [ebx]
mov edi, ecx
xor eax, 0x811c9dc5
imul edx, eax, 0x1000193
movzx eax, byte [ebx + 1]
xor edx, eax
movzx eax, byte [ebx + 2]
imul edx, edx, 0x1000193
xor edx, eax
movzx eax, byte [ebx + 3]
imul ecx, edx, 0x1000193
xor ecx, eax
lea eax, [esp + 0x10]
imul ebp, ecx, 0x1000193
mov ecx, edi
push ebp
push ebx
push eax
call fcn.1007b9c0
mov ecx, dword [esp + 0x14]
test ecx, ecx
je 0x1007ba99
mov eax, dword [esp + 0x20]
mov dword [eax], ecx
mov byte [eax + 4], 0
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret 8
cmp dword [edi + 8], 0xfffffff
jne 0x1007baad
push str.unordered_map_set_too_long
call dword [sym.imp.MSVCP140.dll_void___cdecl_std::_Xlength_error_char_const__]
push 0x10
call fcn.100d6b73
mov ecx, dword [ebx]
mov esi, eax
add esp, 4
mov dword [esi + 8], ecx
mov dword [esi + 0xc], 0
mov eax, dword [edi + 8]
mov ebx, dword [edi + 0x1c]
inc eax
movss xmm3, dword [edi]
movd xmm0, eax
cvtdq2pd xmm0, xmm0
shr eax, 0x1f
addsd xmm0, qword [eax*8 + 0x1012cb50]
mov eax, ebx
shr eax, 0x1f
cvtpd2ps xmm2, xmm0
movd xmm0, ebx
cvtdq2pd xmm0, xmm0
movaps xmm1, xmm2
addsd xmm0, qword [eax*8 + 0x1012cb50]
cvtpd2ps xmm0, xmm0
divss xmm1, xmm0
comiss xmm1, xmm3
jbe 0x1007bb75
divss xmm2, xmm3
sub esp, 8
movss dword [esp + 0x2c], xmm2
fld dword [esp + 0x2c]
fstp qword [esp]
call sub.api_ms_win_crt_math_l1_1_0.dll_ceil
add esp, 8
fstp dword [esp + 0x24]
movss xmm0, dword [esp + 0x24]
call fcn.100d7e10
mov ecx, 8
cmp eax, ecx
cmova ecx, eax
cmp ebx, ecx
jae 0x1007bb58
cmp ebx, 0x200
jae 0x1007bb56
shl ebx, 3
cmp ebx, ecx
jae 0x1007bb58
mov ebx, ecx
push ebx
mov ecx, edi
call fcn.1007be70
push ebp
lea eax, [esi + 8]
mov ecx, edi
push eax
lea eax, [esp + 0x18]
push eax
call fcn.1007b9c0
mov edx, dword [eax]
jmp 0x1007bb79
mov edx, dword [esp + 0x10]
mov ebx, dword [edx + 4]
inc dword [edi + 8]
mov dword [esi], edx
mov dword [esi + 4], ebx
mov dword [ebx], esi
mov dword [edx + 4], esi
mov eax, dword [edi + 0x18]
mov ecx, dword [edi + 0xc]
and eax, ebp
mov ebp, dword [ecx + eax*8]
cmp ebp, dword [edi + 4]
jne 0x1007bb9e
mov dword [ecx + eax*8], esi
jmp 0x1007bbbf
cmp ebp, edx
jne 0x1007bbb9
mov dword [ecx + eax*8], esi
mov eax, dword [esp + 0x20]
mov dword [eax], esi
mov byte [eax + 4], 1
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret 8
cmp dword [ecx + eax*8 + 4], ebx
jne 0x1007bbc3
mov dword [ecx + eax*8 + 4], esi
mov eax, dword [esp + 0x20]
pop edi
mov dword [eax], esi
pop esi
pop ebp
mov byte [eax + 4], 1
pop ebx
add esp, 0xc
ret 8
Function at 0x1007bc50
Capabilities:
Hash data using fnv

Disassembly:
sub esp, 0xc
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0x24]
movzx eax, byte [edi]
xor eax, 0x811c9dc5
imul ecx, eax, 0x1000193
movzx eax, byte [edi + 1]
xor ecx, eax
movzx eax, byte [edi + 2]
imul ecx, ecx, 0x1000193
xor ecx, eax
movzx eax, byte [edi + 3]
imul ecx, ecx, 0x1000193
xor ecx, eax
lea eax, [esp + 0x10]
imul ebx, ecx, 0x1000193
push ebx
push edi
push eax
call fcn.1007bbe0
mov ecx, dword [esp + 0x14]
test ecx, ecx
je 0x1007bcb5
mov eax, dword [esp + 0x20]
mov dword [eax], ecx
mov byte [eax + 4], 0
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret 8
cmp dword [0x101388c0], 0x5d1745d
jne 0x1007bccc
push str.unordered_map_set_too_long
call dword [sym.imp.MSVCP140.dll_void___cdecl_std::_Xlength_error_char_const__]
push 0x2c
call fcn.100d6b73
mov ecx, dword [edi]
mov esi, eax
lea ebp, [esi + 8]
add esp, 4
mov dword [ebp], ecx
mov dword [ebp + 4], 0
mov dword [ebp + 8], 0
push 0x10
mov dword [ebp + 0xc], 0
call fcn.100d6b73
add esp, 4
lea ecx, [ebp + 0x10]
mov dword [eax], eax
mov dword [eax + 4], eax
mov dword [ebp + 8], eax
mov dword [ecx], 0
mov dword [ecx + 4], 0
mov dword [ecx + 8], 0
mov dword [ebp + 0x1c], 7
mov dword [ebp + 0x20], 8
mov dword [ebp + 4], 0x3f800000
push dword [ebp + 8]
push 0x10
call fcn.10004310
mov ecx, dword [0x101388c0]
mov edi, dword [0x101388d4]
lea eax, [ecx + 1]
movd xmm0, eax
cvtdq2pd xmm0, xmm0
shr eax, 0x1f
addsd xmm0, qword [eax*8 + 0x1012cb50]
mov eax, edi
shr eax, 0x1f
cvtpd2ps xmm2, xmm0
movd xmm0, edi
cvtdq2pd xmm0, xmm0
movaps xmm1, xmm2
addsd xmm0, qword [eax*8 + 0x1012cb50]
cvtpd2ps xmm0, xmm0
divss xmm1, xmm0
movss xmm0, dword [0x101388b8]
comiss xmm1, xmm0
jbe 0x1007bdf8
divss xmm2, xmm0
sub esp, 8
movss dword [esp + 0x2c], xmm2
fld dword [esp + 0x2c]
fstp qword [esp]
call sub.api_ms_win_crt_math_l1_1_0.dll_ceil
add esp, 8
fstp dword [esp + 0x24]
movss xmm0, dword [esp + 0x24]
call fcn.100d7e10
mov ecx, 8
cmp eax, ecx
cmova ecx, eax
cmp edi, ecx
jae 0x1007bddc
cmp edi, 0x200
jae 0x1007bdda
shl edi, 3
cmp edi, ecx
jae 0x1007bddc
mov edi, ecx
push edi
call fcn.1007bff0
push ebx
push ebp
lea eax, [esp + 0x18]
push eax
call fcn.1007bbe0
mov ecx, dword [0x101388c0]
mov edx, dword [eax]
jmp 0x1007bdfc
mov edx, dword [esp + 0x10]
mov edi, dword [edx + 4]
inc ecx
mov dword [0x101388c0], ecx
mov dword [esi], edx
mov dword [esi + 4], edi
mov dword [edi], esi
mov dword [edx + 4], esi
mov eax, dword [0x101388d0]
mov ecx, dword [0x101388c4]
and eax, ebx
mov ebx, dword [ecx + eax*8]
cmp ebx, dword [0x101388bc]
jne 0x1007be2d
mov dword [ecx + eax*8], esi
jmp 0x1007be4e
cmp ebx, edx
jne 0x1007be48
mov dword [ecx + eax*8], esi
mov eax, dword [esp + 0x20]
mov dword [eax], esi
mov byte [eax + 4], 1
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret 8
cmp dword [ecx + eax*8 + 4], edi
jne 0x1007be52
mov dword [ecx + eax*8 + 4], esi
mov eax, dword [esp + 0x20]
pop edi
mov dword [eax], esi
pop esi
pop ebp
mov byte [eax + 4], 1
pop ebx
add esp, 0xc
ret 8
Function at 0x1007be70
Capabilities:
Hash data using fnv

Disassembly:
sub esp, 8
mov edx, dword [esp + 0xc]
mov eax, 0x1fffffff
push ebx
mov ebx, ecx
bsr ecx, eax
push ebp
push esi
push edi
mov edi, 1
mov dword [esp + 0x14], ebx
mov eax, edi
shl eax, cl
cmp edx, eax
jbe 0x1007bea1
push str.invalid_hash_bucket_count
call dword [sym.imp.MSVCP140.dll_void___cdecl_std::_Xlength_error_char_const__]
mov esi, dword [ebx + 4]
lea eax, [edx - 1]
or eax, 1
lea ebp, [ebx + 0xc]
bsr ecx, eax
push esi
lea ecx, [ecx + 1]
shl edi, cl
mov ecx, ebp
lea eax, [edi + edi]
push eax
call fcn.10004310
lea eax, [edi - 1]
mov dword [ebx + 0x1c], edi
mov dword [ebx + 0x18], eax
mov ecx, dword [ebx + 4]
mov ecx, dword [ecx]
mov edx, ecx
cmp ecx, esi
je 0x1007bfac
nop dword [eax]
movzx eax, byte [ecx + 8]
xor eax, 0x811c9dc5
mov edx, dword [edx]
imul edi, eax, 0x1000193
movzx eax, byte [ecx + 9]
xor edi, eax
movzx eax, byte [ecx + 0xa]
imul edi, edi, 0x1000193
xor edi, eax
movzx eax, byte [ecx + 0xb]
imul edi, edi, 0x1000193
xor edi, eax
imul eax, edi, 0x1000193
mov edi, dword [ebx + 0x18]
and edi, eax
mov eax, dword [ebp]
mov ebx, dword [eax + edi*8]
lea eax, [eax + edi*8]
mov dword [esp + 0x1c], eax
cmp ebx, esi
jne 0x1007bf32
mov dword [eax], ecx
mov dword [eax + 4], ecx
jmp 0x1007bf9b
mov eax, dword [eax + 4]
mov edi, dword [ecx + 8]
cmp edi, dword [eax + 8]
jne 0x1007bf65
mov eax, dword [eax]
cmp eax, ecx
je 0x1007bf5c
mov ebp, dword [ecx + 4]
mov dword [ebp], edx
mov ebx, dword [edx + 4]
mov dword [ebx], eax
mov edi, dword [eax + 4]
mov dword [edi], ecx
mov dword [eax + 4], ebx
mov dword [edx + 4], ebp
mov dword [ecx + 4], edi
mov eax, dword [esp + 0x1c]
mov dword [eax + 4], ecx
jmp 0x1007bf9b
cmp ebx, eax
je 0x1007bf7c
nop dword [eax]
mov eax, dword [eax + 4]
cmp edi, dword [eax + 8]
je 0x1007bfb6
cmp ebx, eax
jne 0x1007bf70
mov ebp, dword [ecx + 4]
mov dword [ebp], edx
mov ebx, dword [edx + 4]
mov dword [ebx], eax
mov edi, dword [eax + 4]
mov dword [edi], ecx
mov dword [eax + 4], ebx
mov eax, dword [esp + 0x1c]
mov dword [edx + 4], ebp
mov dword [ecx + 4], edi
mov dword [eax], ecx
mov ebx, dword [esp + 0x14]
mov ecx, edx
lea ebp, [ebx + 0xc]
cmp edx, esi
jne 0x1007bee0
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret 4
mov ebx, dword [ecx + 4]
mov ebp, dword [eax]
mov dword [ebx], edx
mov edi, dword [edx + 4]
mov dword [edi], ebp
mov eax, dword [ebp + 4]
mov dword [eax], ecx
mov dword [ebp + 4], edi
mov dword [edx + 4], ebx
mov dword [ecx + 4], eax
jmp 0x1007bf9b