joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1010e190
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1014e6dd
mov eax, dword fs:[0]
push eax
sub esp, 0x18
push ebx
push esi
push edi
mov eax, dword [0x1030e040]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov dword [ebp - 0x14], ebx
mov eax, 0x1fffffff
mov edi, 1
bsr ecx, eax
mov eax, edi
shl eax, cl
mov ecx, dword [ebp + 8]
cmp ecx, eax
jbe 0x1010e1e0
push str.invalid_hash_bucket_count
call dword [sym.imp.MSVCP140.dll_void___cdecl_std::_Xlength_error_char_const__]
lea eax, [ecx - 1]
mov esi, dword [ebx + 4]
or eax, 1
mov dword [ebp - 0x18], esi
bsr ecx, eax
push esi
lea ecx, [ecx + 1]
shl edi, cl
lea ecx, [ebx + 0xc]
lea eax, [edi + edi]
push eax
call fcn.1003e530
lea eax, [edi - 1]
mov dword [ebx + 0x1c], edi
mov dword [ebx + 0x18], eax
mov dword [ebp - 0x20], ebx
mov dword [ebp - 4], 0
mov eax, dword [ebx + 4]
mov eax, dword [eax]
mov ecx, eax
cmp eax, esi
je 0x1010e2ee
movzx edx, byte [eax + 8]
xor edx, 0x811c9dc5
mov ecx, dword [ecx]
imul edi, edx, 0x1000193
movzx edx, byte [eax + 9]
xor edi, edx
movzx edx, byte [eax + 0xa]
imul edi, edi, 0x1000193
xor edi, edx
movzx edx, byte [eax + 0xb]
imul edi, edi, 0x1000193
xor edi, edx
imul edx, edi, 0x1000193
mov edi, dword [ebx + 0x18]
and edi, edx
mov edx, dword [ebx + 0xc]
lea edx, [edx + edi*8]
mov edi, dword [edx]
mov dword [ebp - 0x1c], edx
cmp edi, esi
jne 0x1010e274
mov dword [edx], eax
mov dword [edx + 4], eax
jmp 0x1010e2e4
mov edx, dword [edx + 4]
mov ebx, dword [eax + 8]
cmp ebx, dword [edx + 8]
jne 0x1010e2ae
mov edx, dword [edx]
mov dword [ebp - 0x10], edx
cmp edx, eax
je 0x1010e2a6
mov ebx, dword [eax + 4]
mov esi, dword [ebp - 0x10]
mov dword [ebx], ecx
mov edi, dword [ecx + 4]
mov dword [edi], edx
mov edx, dword [edx + 4]
mov dword [edx], eax
mov dword [esi + 4], edi
mov esi, dword [ebp - 0x18]
mov dword [ecx + 4], ebx
mov dword [eax + 4], edx
mov edx, dword [ebp - 0x1c]
mov dword [edx + 4], eax
jmp 0x1010e2e1
cmp edi, edx
je 0x1010e2be
mov edx, dword [edx + 4]
cmp ebx, dword [edx + 8]
je 0x1010e310
cmp edi, edx
jne 0x1010e2b2
mov ebx, dword [eax + 4]
mov dword [ebp - 0x10], ebx
mov dword [ebx], ecx
mov ebx, dword [ecx + 4]
mov dword [ebx], edx
mov edi, dword [edx + 4]
mov dword [edi], eax
mov dword [edx + 4], ebx
mov edx, dword [ebp - 0x10]
mov dword [ecx + 4], edx
mov edx, dword [ebp - 0x1c]
mov dword [eax + 4], edi
mov dword [edx], eax
mov ebx, dword [ebp - 0x14]
mov eax, ecx
cmp ecx, esi
jne 0x1010e223
mov dword [ebp - 0x20], 0
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
mov ebx, dword [eax + 4]
mov edx, dword [edx]
mov dword [ebp - 0x10], edx
mov esi, edx
mov dword [ebx], ecx
mov edi, dword [ecx + 4]
mov dword [edi], edx
mov edx, dword [edx + 4]
mov dword [edx], eax
mov dword [esi + 4], edi
mov esi, dword [ebp - 0x18]
mov dword [ecx + 4], ebx
mov dword [eax + 4], edx
jmp 0x1010e2e1
Function at 0x10119be0
Capabilities:
Hash data using fnv

Disassembly:
mov ecx, 0x1017be54
call fcn.10137310
mov ecx, 0x1021a654
jmp fcn.10137310

Function at 0x1011b890
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1014f416
mov eax, dword fs:[0]
push eax
sub esp, 0x14
mov eax, dword [0x1030e040]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x18], 0
lea edx, [esi + 0x38]
mov al, 1
xchg byte [edx], al
mov dword [ebp - 0x14], 0
mov dword [ebp - 4], 0
push 4
call fcn.1013cffa
lea ecx, [ebp - 0x1c]
mov dword [ebp - 0x14], eax
push ecx
push 0
push eax
push 0x1011da30
push 0
push 0
mov dword [eax], esi
mov dword [ebp - 0x18], 1
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
add esp, 0x1c
mov dword [ebp - 0x20], eax
test eax, eax
je 0x1011b960
mov eax, 1
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x18], eax
and eax, 0xfffffffe
mov dword [ebp - 0x18], eax
mov dword [ebp - 4], 1
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x1011b958
push eax
push dword [ebp - 0x20]
call dword [sym.imp.MSVCP140.dll__Thrd_detach]
add esp, 8
test eax, eax
jne 0x1011b958
xorps xmm0, xmm0
movlpd qword [ebp - 0x20], xmm0
mov dword [ebp - 4], 0xffffffff
cmp dword [ebp - 0x1c], eax
je 0x1011b96f
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_terminate]
push 1
call dword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
push 6
mov dword [ebp - 0x1c], 0
call dword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1013cfec
mov esp, ebp
pop ebp
ret
Function at 0x1011cb40
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
movzx eax, byte [esi]
xor eax, 0x811c9dc5
imul ecx, eax, 0x1000193
movzx eax, byte [esi + 1]
xor ecx, eax
movzx eax, byte [esi + 2]
imul ecx, ecx, 0x1000193
xor ecx, eax
movzx eax, byte [esi + 3]
imul ecx, ecx, 0x1000193
xor ecx, eax
movzx eax, byte [esi + 4]
xor eax, 0x811c9dc5
imul edx, ecx, 0x1000193
imul ecx, eax, 0x1000193
movzx eax, byte [esi + 5]
xor ecx, eax
movzx eax, byte [esi + 6]
imul ecx, ecx, 0x1000193
xor ecx, eax
movzx eax, byte [esi + 7]
imul ecx, ecx, 0x1000193
pop esi
xor ecx, eax
imul eax, ecx, 0x1000193
add eax, eax
xor eax, edx
pop ebp
ret 4
Function at 0x1012ef70
Capabilities:
Access peb ldr_data
Get process heap flags
Get process heap force flags

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x101510cd
mov eax, dword fs:[0]
push eax
sub esp, 0x28
push esi
push edi
mov eax, dword [0x1030e040]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov eax, dword [ebp + 8]
cmp byte [eax], 1
jne 0x1012f0fe
push dword [edi + 0x34]
push dword [edi + 0x30]
sub esp, 0x10
mov ecx, esp
mov dword [ebp - 0x10], esp
push eax
call fcn.10104140
mov dword [ebp - 4], 0
mov dword [ebp - 4], 0xffffffff
mov ecx, edi
call fcn.1012f6b0
add esp, 0x18
push dword [edi + 0x3c]
push dword [edi + 0x38]
sub esp, 0x10
mov ecx, esp
mov dword [ebp - 0x14], esp
push dword [ebp + 8]
call fcn.10104140
mov dword [ebp - 4], 1
mov dword [ebp - 4], 0xffffffff
lea ecx, [edi + 4]
call fcn.1012f770
add esp, 0x18
push dword [edi + 0x44]
push dword [edi + 0x40]
sub esp, 0x10
mov ecx, esp
mov dword [ebp - 0x18], esp
push dword [ebp + 8]
call fcn.10104140
mov dword [ebp - 4], 2
mov dword [ebp - 4], 0xffffffff
lea ecx, [edi + 8]
call fcn.1012f770
add esp, 0x18
push dword [edi + 0x4c]
push dword [edi + 0x48]
sub esp, 0x10
mov ecx, esp
mov dword [ebp - 0x1c], esp
push dword [ebp + 8]
call fcn.10104140
mov dword [ebp - 4], 3
mov dword [ebp - 4], 0xffffffff
lea ecx, [edi + 0xc]
call fcn.1012f770
add esp, 0x18
push dword [edi + 0x54]
push dword [edi + 0x50]
sub esp, 0x10
mov ecx, esp
mov dword [ebp - 0x20], esp
push dword [ebp + 8]
call fcn.10104140
mov dword [ebp - 4], 4
mov dword [ebp - 4], 0xffffffff
lea ecx, [edi + 0x10]
call fcn.1012f770
add esp, 0x18
push dword [edi + 0x5c]
push dword [edi + 0x58]
sub esp, 0x10
mov ecx, esp
mov dword [ebp - 0x24], esp
push dword [ebp + 8]
call fcn.10104140
mov dword [ebp - 4], 5
mov dword [ebp - 4], 0xffffffff
lea ecx, [edi + 0x14]
call fcn.1012f770
add esp, 0x18
push dword [edi + 0x64]
push dword [edi + 0x60]
sub esp, 0x10
mov ecx, esp
mov dword [ebp - 0x28], esp
push dword [ebp + 8]
call fcn.10104140
mov dword [ebp - 4], 6
mov dword [ebp - 4], 0xffffffff
lea ecx, [edi + 0x18]
call fcn.1012f7f0
add esp, 0x18
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4
push str.Failed_to_deserialize_preferences_configuration:_root_node_is_not_an_object
lea ecx, [ebp - 0x34]
call fcn.100125e0
push 0x1030acd4
lea eax, [ebp - 0x34]
push eax
call sub.VCRUNTIME140.dll__CxxThrowException
int3
Function at 0x10130ed0
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x101518ba
mov eax, dword fs:[0]
push eax
sub esp, 0x74
mov eax, dword [0x1030e040]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x30], edi
mov dword [ebp - 0x38], edi
push str.APPDATA
mov dword [ebp - 0x2c], 0
call dword [sym.imp.api_ms_win_crt_environment_l1_1_0.dll_getenv]
mov edx, eax
add esp, 4
lea eax, [ebp - 0x28]
mov dword [ebp - 0x34], eax
mov dword [ebp - 4], 1
mov eax, edx
lea esi, [eax + 1]
nop dword [eax + eax]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x10130f30
sub eax, esi
mov byte [ebp - 4], 2
push eax
push edx
call fcn.1013c56e
mov edx, eax
lea ecx, [ebp - 0x28]
call fcn.100277b0
mov esi, 4
mov dword [ebp - 0x2c], 4
mov dword [ebp - 0x2c], esi
add esp, 8
and esi, 0xfffffffb
mov dword [ebp - 0x2c], esi
mov dword [ebp - 4], 1
or esi, 2
mov dword [ebp - 0x2c], esi
mov byte [ebp - 4], 0
and esi, 0xfffffffd
mov dword [ebp - 0x2c], esi
mov dword [ebp - 4], 3
lea eax, [ebp - 0x68]
mov dword [ebp - 0x34], eax
mov byte [ebp - 4], 4
mov byte [ebp - 4], 5
push 0xa
push str.ffmpeg.exe
call fcn.1013c56e
mov edx, eax
lea ecx, [ebp - 0x68]
call fcn.100277b0
or esi, 0x10
add esp, 8
mov dword [ebp - 0x2c], esi
and esi, 0xffffffef
mov dword [ebp - 0x2c], esi
mov dword [ebp - 4], 4
or esi, 8
mov dword [ebp - 0x2c], esi
mov byte [ebp - 4], 3
and esi, 0xfffffff7
mov dword [ebp - 0x2c], esi
mov byte [ebp - 4], 6
lea eax, [ebp - 0x50]
mov dword [ebp - 0x30], eax
mov byte [ebp - 4], 7
mov byte [ebp - 4], 8
push 0xf
push str.codmvm_launcher
call fcn.1013c56e
mov edx, eax
lea ecx, [ebp - 0x50]
call fcn.100277b0
or esi, 0x40
mov dword [ebp - 0x2c], esi
and esi, 0xffffffbf
mov dword [ebp - 0x2c], esi
mov dword [ebp - 4], 7
or esi, 0x20
mov dword [ebp - 0x2c], esi
mov byte [ebp - 4], 6
and esi, 0xffffffdf
mov dword [ebp - 0x2c], esi
mov byte [ebp - 4], 9
lea eax, [ebp - 0x50]
push eax
lea edx, [ebp - 0x28]
lea ecx, [ebp - 0x80]
call fcn.1002bb70
add esp, 0xc
mov byte [ebp - 4], 0xb
push eax
mov ecx, edi
call fcn.1002b390
mov dword [ebp - 4], 0xb
lea eax, [ebp - 0x68]
or esi, 0x100
mov ecx, edi
push eax
mov dword [ebp - 0x2c], esi
call fcn.1002ba00
and esi, 0xfffffeff
mov dword [ebp - 0x2c], esi
mov dword [ebp - 4], 0xa
or esi, 1
mov dword [ebp - 0x2c], esi
mov byte [ebp - 4], 9
lea ecx, [ebp - 0x80]
call fcn.1002bbe0
mov byte [ebp - 4], 6
lea ecx, [ebp - 0x50]
call fcn.1002bbe0
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x68]
call fcn.1002bbe0
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x28]
call fcn.1002bbe0
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1013cfec
mov esp, ebp
pop ebp
ret
Function at 0x101358c0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10152625
mov eax, dword fs:[0]
push eax
push ebx
sub esp, 0x68
mov eax, dword [0x1030e040]
xor eax, ebp
mov dword [ebp - 0x14], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ecx, dword [0x1031731c]
lea edx, [ebp - 0x78]
push edx
mov eax, dword [ecx]
mov eax, dword [eax + 0x28]
call eax
mov dword [ebp - 4], 0
movups xmm0, xmmword [eax]
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x18], 0
movups xmmword [ebp - 0x2c], xmm0
movups xmmword [ebp - 0x40], xmm0
movq xmm0, qword [eax + 0x10]
movq qword [ebp - 0x1c], xmm0
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x60]
mov dword [eax + 0x10], 0
mov dword [eax + 0x14], 0xf
mov byte [eax], 0
call fcn.100126b0
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x78]
call fcn.100126b0
cmp dword [ebp - 0x18], 0xf
lea edx, [ebp - 0x2c]
mov edi, dword [ebp - 0x1c]
mov esi, 0x811c9dc5
cmova edx, dword [ebp - 0x40]
xor ecx, ecx
test edi, edi
je 0x10135991
nop dword [eax + eax]
movzx eax, byte [edx + ecx]
inc ecx
xor eax, esi
imul esi, eax, 0x1000193
cmp ecx, edi
jb 0x10135980
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x2c]
call fcn.100126b0
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.1013cfec
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret
Function at 0x10137310
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10152960
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
mov eax, dword [0x1030e040]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov dword [ebp - 4], 0
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x18], ecx
mov edx, 0x811c9dc5
xor ecx, ecx
mov dword [ebp - 0x1c], edx
mov dword [ebp - 0x20], ecx
cmp ecx, 4
jae 0x10137374
movzx eax, byte [ebp + ecx - 0x18]
xor edx, eax
mov dword [ebp - 0x1c], edx
imul edx, edx, 0x1000193
inc ecx
jmp 0x10137356
push edx
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x28]
push eax
call fcn.10137ab0
mov esi, dword [eax + 4]
mov eax, dword [0x103175f8]
test esi, esi
je 0x101373ce
mov dword [ebp - 0x18], esi
mov dword [ebp - 0x18], eax
cmp esi, eax
je 0x101373ab
mov eax, dword [esi + 0x14]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
push esi
lea eax, [ebp - 0x18]
push eax
call fcn.10137460
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.1013cfec
mov esp, ebp
pop ebp
ret
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x18], eax
jmp 0x101373ab

Function at 0x10137460
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1013e740
mov eax, dword fs:[0]
push eax
push esi
push edi
mov eax, dword [0x1030e040]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 0xc]
mov edi, dword [ebp + 8]
movzx ecx, byte [eax + 8]
xor ecx, 0x811c9dc5
imul edx, ecx, 0x1000193
movzx ecx, byte [eax + 9]
xor edx, ecx
movzx ecx, byte [eax + 0xa]
imul edx, edx, 0x1000193
xor edx, ecx
movzx ecx, byte [eax + 0xb]
imul edx, edx, 0x1000193
xor edx, ecx
imul ecx, edx, 0x1000193
mov edx, dword [0x1031760c]
and edx, ecx
mov ecx, dword [0x10317600]
mov esi, dword [ecx + edx*8]
cmp dword [ecx + edx*8 + 4], eax
jne 0x101374f0
cmp esi, eax
jne 0x101374e7
mov eax, dword [0x103175f8]
mov dword [ecx + edx*8], eax
mov dword [ecx + edx*8 + 4], eax
jmp 0x101374f9
mov eax, dword [eax + 4]
mov dword [ecx + edx*8 + 4], eax
jmp 0x101374f9
cmp esi, eax
jne 0x101374fc
mov eax, dword [eax]
mov dword [ecx + edx*8], eax
mov eax, dword [ebp + 0xc]
mov esi, dword [eax]
dec dword [0x103175fc]
mov ecx, dword [eax + 4]
push 0x18
mov dword [ecx], esi
mov ecx, dword [eax + 4]
mov dword [esi + 4], ecx
push dword [ebp + 0xc]
call fcn.1013d04d
add esp, 8
mov dword [edi], esi
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 8
Function at 0x10137640
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1015299d
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push ebx
push esi
push edi
mov eax, dword [0x1030e040]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, 0x1fffffff
mov edi, 1
bsr ecx, eax
mov eax, edi
shl eax, cl
mov ecx, dword [ebp + 8]
cmp ecx, eax
jbe 0x1013768b
push str.invalid_hash_bucket_count
call dword [sym.imp.MSVCP140.dll_void___cdecl_std::_Xlength_error_char_const__]
lea eax, [ecx - 1]
mov esi, dword [0x103175f8]
or eax, 1
mov dword [ebp - 0x14], esi
bsr ecx, eax
push esi
lea ecx, [ecx + 1]
shl edi, cl
mov ecx, 0x10317600
lea eax, [edi + edi]
push eax
call fcn.1003e530
lea eax, [edi - 1]
mov dword [0x10317610], edi
mov dword [0x1031760c], eax
mov dword [ebp - 0x1c], 0x103175f4
mov dword [ebp - 4], 0
mov eax, dword [0x103175f8]
mov eax, dword [eax]
mov ecx, eax
cmp eax, esi
je 0x101377ac
nop
movzx edx, byte [eax + 8]
xor edx, 0x811c9dc5
mov ecx, dword [ecx]
imul edi, edx, 0x1000193
movzx edx, byte [eax + 9]
xor edi, edx
movzx edx, byte [eax + 0xa]
imul edi, edi, 0x1000193
xor edi, edx
movzx edx, byte [eax + 0xb]
imul edi, edi, 0x1000193
xor edi, edx
mov edx, dword [0x10317600]
imul edi, edi, 0x1000193
and edi, dword [0x1031760c]
lea edx, [edx + edi*8]
mov edi, dword [edx]
mov dword [ebp - 0x18], edx
cmp edi, esi
jne 0x10137735
mov dword [edx], eax
mov dword [edx + 4], eax
jmp 0x101377a2
mov edx, dword [edx + 4]
mov ebx, dword [eax + 8]
cmp ebx, dword [edx + 8]
jne 0x1013776f
mov edx, dword [edx]
mov dword [ebp - 0x10], edx
cmp edx, eax
je 0x10137767
mov ebx, dword [eax + 4]
mov esi, dword [ebp - 0x10]
mov dword [ebx], ecx
mov edi, dword [ecx + 4]
mov dword [edi], edx
mov edx, dword [edx + 4]
mov dword [edx], eax
mov dword [esi + 4], edi
mov esi, dword [ebp - 0x14]
mov dword [ecx + 4], ebx
mov dword [eax + 4], edx
mov edx, dword [ebp - 0x18]
mov dword [edx + 4], eax
jmp 0x101377a2
cmp edi, edx
je 0x1013777f
mov edx, dword [edx + 4]
cmp ebx, dword [edx + 8]
je 0x101377ce
cmp edi, edx
jne 0x10137773
mov ebx, dword [eax + 4]
mov dword [ebp - 0x10], ebx
mov dword [ebx], ecx
mov ebx, dword [ecx + 4]
mov dword [ebx], edx
mov edi, dword [edx + 4]
mov dword [edi], eax
mov dword [edx + 4], ebx
mov edx, dword [ebp - 0x10]
mov dword [ecx + 4], edx
mov edx, dword [ebp - 0x18]
mov dword [eax + 4], edi
mov dword [edx], eax
mov eax, ecx
cmp ecx, esi
jne 0x101376e0
mov dword [ebp - 0x1c], 0
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
mov ebx, dword [eax + 4]
mov edx, dword [edx]
mov dword [ebp - 0x10], edx
mov esi, edx
mov dword [ebx], ecx
mov edi, dword [ecx + 4]
mov dword [edi], edx
mov edx, dword [edx + 4]
mov dword [edx], eax
mov dword [esi + 4], edi
mov esi, dword [ebp - 0x14]
mov dword [ecx + 4], ebx
mov dword [eax + 4], edx
jmp 0x101377a2
Function at 0x1013a810
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10152f7d
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
push ebx
push esi
push edi
mov eax, dword [0x1030e040]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edx, dword [ebp + 0xc]
mov edi, edx
mov ebx, dword [ebp + 8]
mov dword [ebp - 0x1c], edx
cmp dword [edx + 0x14], 0xf
jbe 0x1013a84b
mov edi, dword [edx]
xor ecx, ecx
mov esi, 0x811c9dc5
cmp dword [edx + 0x10], ecx
jbe 0x1013a869
movzx eax, byte [edi + ecx]
inc ecx
xor eax, esi
imul esi, eax, 0x1000193
cmp ecx, dword [edx + 0x10]
jb 0x1013a857
push esi
push edx
lea eax, [ebp - 0x18]
push eax
call fcn.1013af90
mov eax, dword [ebp - 0x14]
test eax, eax
je 0x1013a886
mov dword [ebx], eax
mov byte [ebx + 4], 0
jmp 0x1013a9fc
cmp dword [0x1031761c], 0x7ffffff
jne 0x1013a89d
push str.unordered_map_set_too_long
call dword [sym.imp.MSVCP140.dll_void___cdecl_std::_Xlength_error_char_const__]
mov dword [ebp - 0x24], 0x10317618
mov dword [ebp - 0x20], 0
mov dword [ebp - 4], 0
push 0x20
mov dword [ebp - 0x20], 0
call fcn.1013cffa
add esp, 4
mov edi, eax
mov dword [ebp - 0x20], edi
push dword [ebp - 0x1c]
lea ecx, [edi + 8]
call fcn.10012020
mov dword [ebp - 4], 1
mov ecx, dword [0x1031761c]
lea eax, [ecx + 1]
movd xmm0, eax
cvtdq2pd xmm0, xmm0
shr eax, 0x1f
addsd xmm0, qword [eax*8 + 0x102f3ed0]
mov eax, dword [0x10317630]
cvtpd2ps xmm2, xmm0
movd xmm0, eax
cvtdq2pd xmm0, xmm0
shr eax, 0x1f
movaps xmm1, xmm2
addsd xmm0, qword [eax*8 + 0x102f3ed0]
cvtpd2ps xmm0, xmm0
divss xmm1, xmm0
movss xmm0, dword [0x10317614]
comiss xmm1, xmm0
jbe 0x1013a99b
divss xmm2, xmm0
sub esp, 8
cvtps2pd xmm0, xmm2
movsd qword [ebp - 0x18], xmm0
fld qword [ebp - 0x18]
fstp qword [esp]
call sub.api_ms_win_crt_math_l1_1_0.dll_ceil
fstp qword [ebp - 0x18]
movsd xmm0, qword [ebp - 0x18]
add esp, 8
cvtpd2ps xmm0, xmm0
call fcn.1013e3a0
mov ecx, 8
cmp eax, ecx
cmova ecx, eax
mov eax, dword [0x10317630]
cmp eax, ecx
jae 0x1013a97d
cmp eax, 0x200
jae 0x1013a97b
shl eax, 3
cmp eax, ecx
jae 0x1013a97d
mov eax, ecx
push eax
call fcn.1013aa90
push esi
lea eax, [edi + 8]
push eax
lea eax, [ebp - 0x18]
push eax
call fcn.1013af90
mov ecx, dword [0x1031761c]
mov edx, dword [eax]
jmp 0x1013a99e
mov edx, dword [ebp - 0x18]
mov eax, dword [edx + 4]
inc ecx
mov dword [0x1031761c], ecx
mov dword [edi + 4], eax
mov dword [edi], edx
mov dword [eax], edi
mov dword [edx + 4], edi
mov ecx, dword [0x10317620]
mov dword [ebp - 0x1c], eax
mov eax, dword [0x1031762c]
and eax, esi
mov dword [ebp - 0x20], 0
mov esi, dword [ecx + eax*8]
cmp esi, dword [0x10317618]
jne 0x1013a9d9
mov dword [ecx + eax*8], edi
jmp 0x1013a9eb
cmp esi, edx
jne 0x1013a9e2
mov dword [ecx + eax*8], edi
jmp 0x1013a9ef
mov edx, dword [ebp - 0x1c]
cmp dword [ecx + eax*8 + 4], edx
jne 0x1013a9ef
mov dword [ecx + eax*8 + 4], edi
mov dword [ebx], edi
mov byte [ebx + 4], 1
mov dword [ebp - 4], 0xffffffff
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x1013be10
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x101531fe
mov eax, dword fs:[0]
push eax
sub esp, 0xa4
push esi
push edi
mov eax, dword [0x1030e040]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov ecx, dword [0x1031731c]
lea edx, [ebp - 0xb0]
mov eax, dword [esi + 4]
mov dword [ebp - 0x20], eax
push edx
mov eax, dword [ecx]
mov eax, dword [eax + 0x28]
call eax
mov dword [ebp - 4], 0
mov edx, dword [eax + 0x30]
mov eax, dword [esi + 0xc]
mov ecx, dword [esi + 8]
mov dword [ebp - 0x78], ecx
mov eax, dword [eax]
movss xmm0, dword [eax]
movss xmm1, dword [eax + 4]
movss xmm2, dword [eax + 8]
mov eax, 1
movss dword [ebp - 0x3c], xmm0
movss dword [ebp - 0x38], xmm1
movss dword [ebp - 0x34], xmm2
lock xadd dword [0x10318838], eax
inc eax
movups xmm0, xmmword [ebp - 0x3c]
mov esi, dword [esi + 8]
dec eax
mov dword [ebp - 0x74], eax
sub esp, 0xc
mov eax, dword [ebp - 0x24]
mov ecx, esp
movups xmmword [ebp - 0x6c], xmm0
mov edi, dword [esi + 0x10]
movq xmm0, qword [ebp - 0x2c]
mov dword [ebp - 0x54], eax
mov eax, dword [esi]
movq qword [ebp - 0x5c], xmm0
mov dword [ebp - 0x10], eax
mov eax, dword [esi + 4]
mov dword [ebp - 0x70], edx
lea edx, [ebp - 0x48]
movups xmm0, xmmword [ebp - 0x78]
mov dword [ebp - 0x14], eax
mov eax, dword [esi + 8]
mov dword [ebp - 0x18], eax
mov eax, dword [esi + 0xc]
mov esi, dword [esi + 0x14]
movups xmmword [ebp - 0x48], xmm0
mov dword [ebp - 0x4c], esp
movups xmm0, xmmword [ebp - 0x68]
mov dword [ebp - 0x1c], eax
lea eax, [ebp - 0x20]
push ecx
movups xmmword [ebp - 0x38], xmm0
push eax
movq xmm0, qword [ebp - 0x58]
push edx
movq qword [ebp - 0x28], xmm0
call fcn.1010d160
mov byte [ebp - 4], 1
sub esp, 0x18
mov edx, dword [ebp - 0x14]
mov eax, esp
mov ecx, dword [ebp - 0x10]
mov dword [eax + 4], edx
mov edx, dword [ebp - 0x18]
mov dword [eax + 8], edx
mov edx, dword [ebp - 0x1c]
mov dword [eax], ecx
mov dword [eax + 0xc], edx
mov dword [eax + 0x10], edi
mov dword [eax + 0x14], esi
mov byte [ebp - 4], 0
mov ecx, dword [ebp - 0x20]
call fcn.1010b220
mov dword [ebp - 4], 2
lea ecx, [ebp - 0x98]
call fcn.100126b0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xb0]
call fcn.100126b0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret