joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1004b9d0
Capabilities:
Access peb ldr_data

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x101dd609
mov eax, dword fs:[0]
push eax
push ebx
sub esp, 0x128
mov eax, dword [0x1026ebc4]
xor eax, ebp
mov dword [ebp - 0x14], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push ecx
mov dword [ebp - 4], 2
lea ecx, [ebp - 0x138]
push dword [ebx + 0x34]
call fcn.1004d080
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x134]
push dword [ebx + 0x10]
push dword [ebx + 0x14]
call fcn.100a1f70
mov eax, dword [ebp - 0x134]
lea ecx, [ebp - 0x134]
mov esi, dword [ebx + 0x24]
mov edi, dword [eax + 0x44]
mov eax, dword [eax + 0x20]
call eax
push eax
push esi
lea ecx, [ebp - 0x134]
call edi
test al, al
je 0x1004baf0
lea ecx, [ebp - 0x138]
call fcn.1004d120
mov byte [ebp - 4], 5
mov eax, dword [ebx + 0xc]
mov ecx, dword [ebx + 0x10]
cmp eax, ecx
mov edx, dword [ebx + 0x14]
mov edi, edx
cmovb ecx, eax
xor al, al
rep stosb byte es:[edi], al
push edx
call sub.api_ms_win_crt_heap_l1_1_0.dll_free
mov byte [ebp - 4], 6
mov eax, dword [ebx + 0x1c]
mov ecx, dword [ebx + 0x20]
cmp eax, ecx
mov edx, dword [ebx + 0x24]
mov edi, edx
cmovb ecx, eax
xor al, al
rep stosb byte es:[edi], al
push edx
call sub.api_ms_win_crt_heap_l1_1_0.dll_free
mov dword [ebp - 4], 7
mov eax, dword [ebx + 0x2c]
mov ecx, dword [ebx + 0x30]
cmp eax, ecx
mov edx, dword [ebx + 0x34]
mov edi, edx
cmovb ecx, eax
xor al, al
rep stosb byte es:[edi], al
push edx
call sub.api_ms_win_crt_heap_l1_1_0.dll_free
add esp, 0xc
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.101d9510
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret 0x30
push str.MAC_check_failed_
lea ecx, [ebp - 0x2c]
call fcn.1004ede0
lea eax, [ebp - 0x2c]
mov byte [ebp - 4], 4
push eax
lea ecx, [ebp - 0x50]
call fcn.1004bec0
push 0x10267348
lea eax, [ebp - 0x50]
push eax
call sub.VCRUNTIME140.dll__CxxThrowException
int3
Function at 0x1004bdc0
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x101dd6d5
mov eax, dword fs:[0]
push eax
sub esp, 0x64
mov eax, dword [0x1026ebc4]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp dword [ecx + 0x30], 0x10
lea esi, [ecx + 0x1c]
mov edi, dword [esi + 0x10]
mov eax, esi
jb 0x1004bdfa
mov eax, dword [esi]
push 3
push 0x10255734
push edi
push eax
call fcn.100533c0
movzx eax, al
add esp, 0x10
shl eax, 4
add eax, 0x40
cmp dword [ebp + 8], eax
jb 0x1004be59
cmp dword [esi + 0x14], 0x10
jb 0x1004be21
mov esi, dword [esi]
push 3
push 0x10255734
push edi
push esi
call fcn.100533c0
add esp, 0x10
test al, al
je 0x1004be3c
test byte [ebp + 8], 0xf
jne 0x1004be87
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.101d9510
mov esp, ebp
pop ebp
ret 4
push str.Invalid_data_size_
lea ecx, [ebp - 0x28]
call fcn.1004ede0
lea eax, [ebp - 0x28]
mov dword [ebp - 4], 0
push eax
lea ecx, [ebp - 0x4c]
call fcn.1004bec0
push 0x10267348
lea eax, [ebp - 0x4c]
push eax
call sub.VCRUNTIME140.dll__CxxThrowException
push str.Invalid_data_size_
lea ecx, [ebp - 0x28]
call fcn.1004ede0
lea eax, [ebp - 0x28]
mov dword [ebp - 4], 1
push eax
lea ecx, [ebp - 0x70]
call fcn.1004bec0
push 0x10267348
lea eax, [ebp - 0x70]
push eax
call sub.VCRUNTIME140.dll__CxxThrowException
int3

Function at 0x1004d7b0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 0xc]
mov edx, 0x811c9dc5
push edi
mov edi, dword [ebp + 8]
mov ecx, 0
sub esi, edi
je 0x1004d7e1
nop dword [eax]
movzx eax, byte [ecx + edi]
inc ecx
xor eax, edx
imul edx, eax, 0x1000193
cmp ecx, esi
jb 0x1004d7d0
pop edi
mov eax, edx
pop esi
pop ebp
ret 8
Function at 0x1004dc80
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x1c
push ebx
mov ebx, ecx
push esi
push edi
cmp dword [ebx + 0x38], 0
je 0x1004dcac
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____thiscall_std::basic_streambuf_char__struct_std::char_traits_char__::xsputn_char_const___long_long___int64__]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov eax, dword [ebx + 0x20]
mov esi, dword [ebp + 0xc]
mov edi, dword [ebp + 0x10]
mov dword [esp + 0x20], esi
mov ecx, dword [eax]
lea eax, [ebx + 0x30]
mov dword [esp + 0x24], edi
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x18], eax
test ecx, ecx
je 0x1004dcd4
mov eax, dword [eax]
mov ecx, dword [eax]
jmp 0x1004dcda
xor ecx, ecx
mov dword [esp + 0x18], eax
mov eax, ecx
cdq
mov dword [esp + 0x10], eax
mov ecx, edx
mov dword [esp + 0x14], ecx
test edi, edi
jl 0x1004dd42
jg 0x1004dcf1
test esi, esi
je 0x1004dd42
test ecx, ecx
jl 0x1004dd3d
jg 0x1004dcfb
test eax, eax
je 0x1004dd3d
cmp edi, ecx
jg 0x1004dd0f
jl 0x1004dd05
cmp esi, eax
jae 0x1004dd0f
mov eax, esi
mov dword [esp + 0x10], esi
mov dword [esp + 0x14], edi
push eax
push dword [ebp + 8]
push dword [esp + 0x24]
call sub.VCRUNTIME140.dll_memcpy
mov eax, dword [esp + 0x24]
add esp, 0xc
mov edx, dword [esp + 0x10]
mov ecx, dword [ebp + 8]
add ecx, edx
sub esi, edx
mov eax, dword [eax]
sbb edi, dword [esp + 0x14]
sub dword [eax], edx
mov eax, dword [ebx + 0x20]
add dword [eax], edx
jmp 0x1004dd45
mov ecx, dword [ebp + 8]
jmp 0x1004dd4f
mov ecx, dword [ebp + 8]
test edi, edi
jl 0x1004dd69
jg 0x1004dd4f
test esi, esi
je 0x1004dd69
mov eax, dword [ebx + 0x4c]
test eax, eax
je 0x1004dd69
push eax
push esi
push 1
push ecx
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
add esp, 0x10
sub esi, eax
sbb edi, 0
mov eax, dword [esp + 0x20]
mov edx, dword [esp + 0x24]
sub eax, esi
sbb edx, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x1004dd80
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
mov eax, dword [ebp + 0x10]
sub esp, 0xc
push ebx
mov ebx, ecx
mov ecx, dword [ebp + 0xc]
push esi
push edi
test eax, eax
jg 0x1004ddab
jl 0x1004dd9e
test ecx, ecx
jne 0x1004ddab
xor eax, eax
xor edx, edx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
cmp dword [ebx + 0x38], 0
je 0x1004ddc7
push eax
push ecx
push dword [ebp + 8]
mov ecx, ebx
call dword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____thiscall_std::basic_streambuf_char__struct_std::char_traits_char__::xsgetn_char___long_long___int64__]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov eax, dword [ebx + 0x1c]
mov edi, ecx
mov eax, dword [eax]
mov dword [esp + 0x14], eax
test eax, eax
je 0x1004de18
mov eax, dword [ebx + 0x2c]
lea edx, [ebx + 0x2c]
mov dword [esp + 0x10], edx
mov eax, dword [eax]
test eax, eax
je 0x1004de1f
cmp eax, ecx
mov esi, ecx
cmovb esi, eax
push esi
push dword [esp + 0x18]
push dword [ebp + 8]
call sub.VCRUNTIME140.dll_memcpy
mov eax, dword [ebp + 8]
sub edi, esi
add eax, esi
add esp, 0xc
mov dword [esp + 0x14], eax
mov eax, dword [ebx + 0x2c]
sub dword [eax], esi
mov eax, dword [ebx + 0x1c]
add dword [eax], esi
mov esi, dword [esp + 0x14]
jmp 0x1004de22
lea eax, [ebx + 0x2c]
mov dword [esp + 0x10], eax
mov esi, dword [ebp + 8]
cmp dword [ebx + 0x4c], 0
je 0x1004de96
mov ecx, dword [ebx + 0xc]
lea eax, [ebx + 0x3c]
cmp dword [ecx], eax
jne 0x1004de4c
mov eax, dword [ebx + 0xc]
mov edx, dword [ebx + 0x54]
mov ecx, dword [ebx + 0x50]
sub edx, ecx
mov dword [eax], ecx
mov eax, dword [ebx + 0x1c]
mov dword [eax], ecx
mov eax, dword [esp + 0x10]
mov eax, dword [eax]
mov dword [eax], edx
mov eax, dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
cmp edi, 0xfff
jbe 0x1004de84
nop dword [eax]
push dword [ebx + 0x4c]
push 0xfff
push 1
push esi
call eax
add esp, 0x10
add esi, eax
sub edi, eax
cmp eax, 0xfff
jne 0x1004de96
cmp edi, eax
mov eax, dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
ja 0x1004de60
test edi, edi
je 0x1004de96
push dword [ebx + 0x4c]
push edi
push 1
push esi
call eax
add esp, 0x10
sub edi, eax
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 0x10]
sub eax, edi
pop edi
pop esi
sbb edx, 0
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x1004e2f0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
mov eax, dword [0x1026ebc4]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, ecx
cmp ebx, 0xffffffff
jne 0x1004e320
pop esi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.101d9510
mov esp, ebp
pop ebp
ret 4
mov eax, dword [esi + 0x20]
mov eax, dword [eax]
test eax, eax
je 0x1004e350
mov edx, dword [esi + 0x30]
mov edx, dword [edx]
add edx, eax
cmp eax, edx
jae 0x1004e350
call dword [sym.imp.MSVCP140.dll_protected:_char____thiscall_std::basic_streambuf_char__struct_std::char_traits_char__::_Pninc_void_]
pop esi
mov byte [eax], bl
mov eax, ebx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.101d9510
mov esp, ebp
pop ebp
ret 4
cmp dword [esi + 0x4c], 0
push edi
je 0x1004e428
mov edi, dword [esi + 0xc]
lea eax, [esi + 0x3c]
cmp dword [edi], eax
jne 0x1004e379
mov edx, dword [esi + 0x54]
mov ecx, dword [esi + 0x50]
sub edx, ecx
mov dword [edi], ecx
mov eax, dword [esi + 0x1c]
mov dword [eax], ecx
mov eax, dword [esi + 0x2c]
mov dword [eax], edx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x1004e385
movsx eax, bl
jmp 0x1004e3bd
lea eax, [ebp - 0x2c]
mov byte [ebp - 0x25], bl
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x25]
push eax
lea eax, [esi + 0x40]
push eax
call dword [sym.imp.MSVCP140.dll_public:_int___thiscall_std::codecvt_char__char__struct__Mbstatet_::out_struct__Mbstatet___char_const___char_const___char_const____char___char___char___const]
sub eax, 0
je 0x1004e3e7
sub eax, 1
je 0x1004e3e7
sub eax, 2
jne 0x1004e428
movsx eax, byte [ebp - 0x25]
push dword [esi + 0x4c]
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
add esp, 8
or ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, ebx
pop edi
pop esi
mov eax, ecx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.101d9510
mov esp, ebp
pop ebp
ret 4
mov edi, dword [ebp - 0x2c]
lea eax, [ebp - 0x24]
sub edi, eax
je 0x1004e405
push dword [esi + 0x4c]
push edi
push 1
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
add esp, 0x10
cmp edi, eax
jne 0x1004e428
lea ecx, [ebp - 0x25]
mov byte [esi + 0x3d], 1
or eax, 0xffffffff
cmp dword [ebp - 0x30], ecx
pop edi
pop esi
cmovne eax, ebx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.101d9510
mov esp, ebp
pop ebp
ret 4
mov ecx, dword [ebp - 4]
or eax, 0xffffffff
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.101d9510
mov esp, ebp
pop ebp
ret 4
Function at 0x100501a0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x1026ebc4]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, ecx
cmp dword [esi + 0x38], 0
je 0x1005025c
cmp byte [esi + 0x3d], 0
je 0x1005025c
mov eax, dword [esi]
push edi
push 0xffffffffffffffff
call dword [eax + 0xc]
cmp eax, 0xffffffff
je 0x1005024a
mov ecx, dword [esi + 0x38]
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [esi + 0x40]
push eax
call dword [sym.imp.MSVCP140.dll_public:_int___thiscall_std::codecvt_char__char__struct__Mbstatet_::unshift_struct__Mbstatet___char___char___char___const]
sub eax, 0
je 0x10050211
sub eax, 1
je 0x10050215
sub eax, 2
jne 0x1005024a
mov byte [esi + 0x3d], al
mov al, 1
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.101d9510
mov esp, ebp
pop ebp
ret
mov byte [esi + 0x3d], 0
mov edi, dword [ebp - 0x28]
lea eax, [ebp - 0x24]
sub edi, eax
je 0x10050233
push dword [esi + 0x4c]
push edi
push 1
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
add esp, 0x10
cmp edi, eax
jne 0x1005024a
cmp byte [esi + 0x3d], 0
pop edi
sete al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.101d9510
mov esp, ebp
pop ebp
ret
pop edi
xor al, al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.101d9510
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
mov al, 1
xor ecx, ebp
pop esi
call fcn.101d9510
mov esp, ebp
pop ebp
ret
Function at 0x1005ab70
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x54
mov eax, dword [0x1026ebc4]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push 0x10253608
push 0x64
mov edi, edx
mov esi, ecx
call fcn.101d99cb
mov ebx, eax
add esp, 8
test ebx, ebx
je 0x1005ad32
push 0x63
lea ecx, [ebx + 1]
push 0
push ecx
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
mov byte [ebx], 1
lea eax, [ebx + 4]
push 2
push eax
call dword [sym.imp.MSVCP140.dll__Mtx_init_in_situ]
lea eax, [ebx + 0x34]
push eax
call dword [sym.imp.MSVCP140.dll__Cnd_init_in_situ]
add esp, 0xc
mov dword [0x1029a30c], ebx
lea eax, [ebp - 0x48]
xorps xmm0, xmm0
movq qword [ebx + 0x5c], xmm0
push 0x20
push eax
push 0xffffffffffffffff
push esi
push 0
push 0xfde9
call dword [sym.imp.KERNEL32.DLL_MultiByteToWideChar]
xor edx, edx
lea ecx, [ebp - 0x48]
call fcn.100597a0
call dword [sym.imp.KERNEL32.DLL_GetCurrentProcessId]
push 0x10278c30
mov dword [0x102ae884], eax
call dword [sym.imp.MSVCP140.dll__Mtx_lock]
add esp, 4
test eax, eax
je 0x1005ac1e
push eax
call dword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_C_error_int_]
test edi, edi
je 0x1005ac33
movups xmm0, xmmword [edi]
movups xmmword [0x1029a2f4], xmm0
movq xmm0, qword [edi + 0x10]
jmp 0x1005ac3d
xorps xmm0, xmm0
movups xmmword [0x1029a2f4], xmm0
movq qword [0x1029a304], xmm0
xorps xmm0, xmm0
push 0x10278c30
movups xmmword [0x102aa468], xmm0
movq qword [0x102aa478], xmm0
call dword [sym.imp.MSVCP140.dll__Mtx_unlock]
add esp, 4
cmp dword [0x102ae888], 0
jne 0x1005ad3c
mov dword [0x1029a310], 0x1026ec7c
test esi, esi
je 0x1005aca7
cmp byte [esi], 0
mov ecx, 0x1029a320
je 0x1005aca4
mov edx, 1
sub edx, esi
lea eax, [esi + edx]
cmp eax, 0x40
jae 0x1005aca4
mov al, byte [esi]
inc esi
mov byte [ecx], al
inc ecx
cmp byte [esi], 0
jne 0x1005ac91
mov byte [ecx], 0
mov esi, dword [0x1029a30c]
mov al, 1
mov dword [0x102ae888], 0x1029a310
mov dword [0x1029a318], 0x1005b1e0
mov dword [0x1029a31c], 0x1005b1f0
xchg byte [esi], al
push 4
call fcn.101d9536
add esp, 4
lea ecx, [ebp - 0x4c]
mov dword [eax], esi
push ecx
push 0
push eax
push 0x1005b810
push 0
push 0
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov ecx, eax
add esp, 0x18
mov dword [ebp - 0x50], ecx
test ecx, ecx
je 0x1005ad23
cmp dword [esi + 0x60], 0
je 0x1005ad09
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_terminate]
mov eax, dword [ebp - 0x4c]
mov dword [esi + 0x5c], ecx
mov dword [esi + 0x60], eax
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.101d9510
mov esp, ebp
pop ebp
ret
push 6
mov dword [ebp - 0x4c], 0
call dword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
mov dword [0x1029a30c], 0
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.101d9510
mov esp, ebp
pop ebp
ret
Function at 0x1005beb0
Capabilities:
Create thread
Get common file path
Hide graphical window
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x101de770
mov eax, dword fs:[0]
push eax
sub esp, 0x10c
mov eax, dword [0x1026ebc4]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 0xc]
sub eax, 0
je 0x1005c093
sub eax, 1
jne 0x1005c09f
push 0x104
lea eax, [ebp - 0x114]
push eax
call dword [sym.imp.KERNEL32.DLL_GetSystemDirectoryA]
push 0x10256bec
lea eax, [ebp - 0x114]
push 0x104
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strcat_s]
add esp, 0xc
mov dword [ebp - 4], 0
mov eax, dword [0x10299fe8]
test eax, eax
je 0x1005bf5a
mov edx, str.Loading
mov ecx, 0x10299f98
call fcn.100522d0
mov eax, dword [0x10299fe8]
test eax, eax
je 0x1005bf5a
lea edx, [ebp - 0x114]
mov ecx, 0x10299f98
call fcn.100522d0
mov eax, dword [0x10299fe8]
mov dword [ebp - 4], 1
test eax, eax
je 0x1005bf75
push 0x100524f0
mov ecx, 0x10299f98
call dword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______thiscall_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char_______cdecl___class_std::basic_ostream_char__struct_std::char_traits_char_____]
lea eax, [ebp - 0x114]
push eax
call dword [sym.imp.KERNEL32.DLL_LoadLibraryA]
mov esi, dword [sym.imp.KERNEL32.DLL_GetProcAddress]
push 0x10256c04
push eax
mov dword [0x102aeb40], eax
call esi
push 0x10256c18
push dword [0x102aeb40]
mov dword [0x10278be4], eax
call esi
push 0x10256c30
push dword [0x102aeb40]
mov dword [0x10278bd4], eax
call esi
push 0x10256c48
push dword [0x102aeb40]
mov dword [0x10278bcc], eax
call esi
push 0x10256c58
push dword [0x102aeb40]
mov dword [0x10278bdc], eax
call esi
push 0x10256c6c
push dword [0x102aeb40]
mov dword [0x10278be0], eax
call esi
push 0x10256c88
push dword [0x102aeb40]
mov dword [0x10278bd0], eax
call esi
push 0x10256ca8
push dword [0x102aeb40]
mov dword [0x10278bc0], eax
call esi
push 0x10256cc8
push dword [0x102aeb40]
mov dword [0x10278bc4], eax
call esi
push 0x10256cd4
push dword [0x102aeb40]
mov dword [0x10278bc8], eax
call esi
push 0x10256cf0
push dword [0x102aeb40]
mov dword [0x10278bec], eax
call esi
push 0x10256d04
push dword [0x102aeb40]
mov dword [0x10278bd8], eax
call esi
mov dword [0x10278be8], eax
call dword [sym.imp.KERNEL32.DLL_AllocConsole]
push 0
push str.ConsoleWindowClass
call dword [sym.imp.USER32.dll_FindWindowA]
push 0
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
push 0
push 0
push 0
push 0x1006d510
push 0
push 0
call dword [sym.imp.KERNEL32.DLL_CreateThread]
jmp 0x1005c09f
push dword [0x102aeb40]
call dword [sym.imp.KERNEL32.DLL_FreeLibrary]
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.101d9510
mov esp, ebp
pop ebp
ret 0xc
Function at 0x1005c840
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
push esi
push edi
mov edi, ecx
movzx edx, byte [eax + 8]
movzx ecx, byte [eax + 0xb]
xor edx, 0x811c9dc5
imul esi, edx, 0x1000193
movzx edx, byte [eax + 9]
xor esi, edx
movzx edx, byte [eax + 0xa]
imul esi, esi, 0x1000193
xor esi, edx
imul edx, esi, 0x1000193
xor edx, ecx
imul ecx, edx, 0x1000193
mov edx, dword [edi + 0x18]
and edx, ecx
mov ecx, dword [edi + 0xc]
mov esi, dword [ecx + edx*8]
cmp dword [ecx + edx*8 + 4], eax
jne 0x1005c8a8
cmp esi, eax
jne 0x1005c89f
mov eax, dword [edi + 4]
mov dword [ecx + edx*8], eax
mov dword [ecx + edx*8 + 4], eax
jmp 0x1005c8b1
mov eax, dword [eax + 4]
mov dword [ecx + edx*8 + 4], eax
jmp 0x1005c8b1
cmp esi, eax
jne 0x1005c8b4
mov eax, dword [eax]
mov dword [ecx + edx*8], eax
mov eax, dword [ebp + 0xc]
mov esi, dword [eax]
dec dword [edi + 8]
mov ecx, dword [eax + 4]
push 0x10
mov dword [ecx], esi
mov eax, dword [eax + 4]
mov dword [esi + 4], eax
push dword [ebp + 0xc]
call fcn.101d999a
mov eax, dword [ebp + 8]
add esp, 8
pop edi
mov dword [eax], esi
pop esi
pop ebp
ret 8
Function at 0x1005c8e0
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x101de7f5
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
push ebx
push esi
push edi
mov eax, dword [0x1026ebc4]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov ebx, dword [ebp + 0xc]
movzx eax, byte [ebx]
xor eax, 0x811c9dc5
imul edx, eax, 0x1000193
movzx eax, byte [ebx + 1]
xor edx, eax
movzx eax, byte [ebx + 2]
imul edx, edx, 0x1000193
xor edx, eax
movzx eax, byte [ebx + 3]
imul ecx, edx, 0x1000193
xor ecx, eax
imul eax, ecx, 0x1000193
mov ecx, edi
push eax
mov dword [ebp + 0xc], eax
lea eax, [ebp - 0x20]
push ebx
push eax
call fcn.1005cc70
mov ecx, dword [ebp - 0x1c]
test ecx, ecx
je 0x1005c973
mov eax, dword [ebp + 8]
mov dword [eax], ecx
mov byte [eax + 4], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
cmp dword [edi + 8], 0xfffffff
jne 0x1005c987
push str.unordered_map_set_too_long
call dword [sym.imp.MSVCP140.dll_void___cdecl_std::_Xlength_error_char_const__]
lea eax, [edi + 4]
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x28], eax
mov dword [ebp - 4], 0
push 0x10
mov dword [ebp - 0x24], 0
call fcn.101d9536
mov esi, eax
add esp, 4
mov dword [ebp - 0x14], esi
mov dword [ebp - 0x24], esi
mov dword [ebp - 4], 1
mov ecx, dword [ebx]
mov dword [esi + 8], ecx
mov dword [esi + 0xc], 0
mov eax, dword [edi + 8]
mov ebx, dword [edi + 0x1c]
inc eax
movss xmm3, dword [edi]
movd xmm0, eax
cvtdq2pd xmm0, xmm0
shr eax, 0x1f
addsd xmm0, qword [eax*8 + 0x1025c220]
mov eax, ebx
shr eax, 0x1f
cvtpd2ps xmm2, xmm0
movd xmm0, ebx
cvtdq2pd xmm0, xmm0
movaps xmm1, xmm2
addsd xmm0, qword [eax*8 + 0x1025c220]
cvtpd2ps xmm0, xmm0
divss xmm1, xmm0
comiss xmm1, xmm3
jbe 0x1005ca77
divss xmm2, xmm3
sub esp, 8
cvtps2pd xmm0, xmm2
movsd qword [ebp - 0x20], xmm0
fld qword [ebp - 0x20]
fstp qword [esp]
call sub.api_ms_win_crt_math_l1_1_0.dll_ceil
fstp qword [ebp - 0x20]
movsd xmm0, qword [ebp - 0x20]
add esp, 8
cvtpd2ps xmm0, xmm0
call fcn.101da2c0
mov ecx, 8
cmp eax, ecx
cmova ecx, eax
cmp ebx, ecx
jae 0x1005ca59
cmp ebx, 0x200
jae 0x1005ca57
shl ebx, 3
cmp ebx, ecx
jae 0x1005ca59
mov ebx, ecx
push ebx
mov ecx, edi
call fcn.1005cb00
push dword [ebp + 0xc]
lea eax, [esi + 8]
mov ecx, edi
push eax
lea eax, [ebp - 0x28]
push eax
call fcn.1005cc70
mov edx, dword [eax]
jmp 0x1005ca7a
mov edx, dword [ebp - 0x20]
mov ebx, dword [edx + 4]
inc dword [edi + 8]
mov dword [esi], edx
mov dword [esi + 4], ebx
mov dword [ebx], esi
mov dword [edx + 4], esi
mov eax, dword [edi + 0x18]
and eax, dword [ebp + 0xc]
mov ecx, dword [edi + 0xc]
mov esi, dword [ebp - 0x10]
mov edi, dword [ecx + eax*8]
cmp edi, dword [esi]
mov esi, dword [ebp - 0x14]
jne 0x1005caa5
mov dword [ecx + eax*8], esi
jmp 0x1005cab4
cmp edi, edx
jne 0x1005caae
mov dword [ecx + eax*8], esi
jmp 0x1005cab8
cmp dword [ecx + eax*8 + 4], ebx
jne 0x1005cab8
mov dword [ecx + eax*8 + 4], esi
mov eax, dword [ebp + 8]
mov dword [eax], esi
mov byte [eax + 4], 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8