joyce8/EMBER2024-capa huggingface dataset:
Function at 0x402740
Capabilities:
Bypass mark of the web
Check mutex and terminate process on windows
Check mutex on windows
Create thread
Delete file
Initialize winsock library
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x6b4
push 0x7d0
call dword [sym.imp.KERNEL32.dll_Sleep]
push str.7w7w7twr
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
mov dword [ebp - 0x6b4], eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x40277e
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
mov dword [ebp - 0x20c], 0
push 0x104
lea eax, [ebp - 0x208]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea ecx, [ebp - 0x208]
push ecx
push str._s:Zone.Identifier
lea edx, [ebp - 0x520]
push edx
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
lea eax, [ebp - 0x520]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
lea ecx, [ebp - 0x6b0]
push ecx
push 0x202
call dword [sym.imp.WS2_32.dll_WSAStartup]
call fcn.00401760
movzx edx, al
test edx, edx
jne 0x4027eb
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0x406058
call section..text
add esp, 4
push eax
push 0x404e30
lea eax, [ebp - 0x318]
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
push 0
push 0
lea ecx, [ebp - 0x318]
push ecx
push 0x402450
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov edx, 1
test edx, edx
je 0x402846
push 0x6ddd00
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x402830
xor eax, eax
mov esp, ebp
pop ebp
ret 0x10
Function at 0x4097e0
Capabilities:
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [ebp + 8]
mov dword [ebp - 4], eax
mov dword [ebp - 8], 0xffffffff
mov dword [ebp - 0xc], 0
jmp 0x409805
mov ecx, dword [ebp - 0xc]
add ecx, 1
mov dword [ebp - 0xc], ecx
mov edx, dword [ebp - 0xc]
cmp edx, dword [ebp + 0xc]
jae 0x409878
mov eax, dword [ebp - 4]
add eax, dword [ebp - 0xc]
movzx ecx, byte [eax]
movzx edx, byte [ebp - 8]
xor ecx, edx
mov dword [ebp - 0x10], ecx
mov eax, dword [ebp - 8]
shr eax, 8
mov dword [ebp - 8], eax
mov dword [ebp - 0x14], 0
jmp 0x40983a
mov ecx, dword [ebp - 0x14]
add ecx, 1
mov dword [ebp - 0x14], ecx
cmp dword [ebp - 0x14], 8
jge 0x40986d
mov edx, dword [ebp - 0x10]
and edx, 1
neg edx
sbb edx, edx
neg edx
mov byte [ebp - 0x15], dl
mov eax, dword [ebp - 0x10]
shr eax, 1
mov dword [ebp - 0x10], eax
movzx ecx, byte [ebp - 0x15]
test ecx, ecx
je 0x40986b
mov edx, dword [ebp - 0x10]
xor edx, 0xedb88320
mov dword [ebp - 0x10], edx
jmp 0x409831
mov eax, dword [ebp - 8]
xor eax, dword [ebp - 0x10]
mov dword [ebp - 8], eax
jmp 0x4097fc
mov eax, dword [ebp - 8]
not eax
mov esp, ebp
pop ebp
ret
Function at 0x10013074
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x50
pushal
call 0x10013083
pop dword [ebp - 0x40]
mov eax, 0x6b237c31
add eax, 0xa4ddb452
sub dword [ebp - 0x40], eax
mov dword [ebp - 0x50], 0xd7fd931a
add dword [ebp - 0x50], 0x7654b231
mov dword [ebp - 0x4c], 0x51fb41ee
add dword [ebp - 0x4c], 0xe0380a57
mov dword [ebp - 0x48], 0xfc39c51b
add dword [ebp - 0x48], 0x50127f13
mov dword [ebp - 0x44], 0x281572f8
sub dword [ebp - 0x44], 0x281572f8
lea eax, [ebp - 0x50]
push eax
mov eax, 0x6405b227
sub eax, 0x5404618f
add eax, dword [ebp - 0x40]
call dword [eax]
mov dword [ebp - 0x50], 0x29839360
sub dword [ebp - 0x50], 0xb5112a0a
mov dword [ebp - 0x4c], 0xd3af2e2d
add dword [ebp - 0x4c], 0x6dbd3348
mov dword [ebp - 0x48], 0x7acd9b9a
add dword [ebp - 0x48], 0xe8a1d0d2
mov dword [ebp - 0x44], 0x5d75eddd
sub dword [ebp - 0x44], 0x5d75eddd
lea ebx, [ebp - 0x50]
push ebx
push eax
mov eax, 0x3de1acf3
sub eax, 0x2de05c57
add eax, dword [ebp - 0x40]
call dword [eax]
push 0x40
push 0x1000
push 0x39628
push 0
call eax
mov ecx, 0xd690d3fe
sub ecx, 0xd6908900
mov esi, eax
mov edx, 0x92c165bf
sub edx, 0x82bd49bf
add edx, dword [ebp - 0x40]
mov ebx, 0x11dd1a2c
xor dword [ebp - 0x28], edi
mov edi, dword [edx]
xor dword [ebp - 0x20], edi
add edi, ebx
xor dword [ebp - 0x20], 0x35b692a3
mov dword [esi], edi
sub dword [ebp - 4], eax
add esi, 0x13c747f3
add esi, 0xec38b811
add edx, 0xb9d90ab8
sub edx, 0xb9d90ab4
loop 0x1001319f
add eax, 0xf99a5ff0
add eax, 0x666bedb
mov ebx, eax
add eax, 5
mov ecx, 0x5559b305
add ecx, 0xbaa64cfb
add ecx, dword [ebp - 0x40]
call ebx
leave
ret
Function at 0x44a644
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov eax, dword [0x48b644]
cmp byte [eax + 0xc], 0
je 0x44a7b1
push 0x8000
call sub.kernel32.dll_SetErrorMode
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x44a7aa
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [0x48cbf0], 0
jne 0x44a698
push 0x44a7b8
call sub.kernel32.dll_GetModuleHandleA_2
mov ebx, eax
push 0x44a7c0
push ebx
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x48cbf0], eax
cmp dword [0x48ac78], 0
jne 0x44a793
push 0x44a7d0
call sub.kernel32.dll_LoadLibraryA
mov dword [0x48ac78], eax
cmp dword [0x48ac78], 0
je 0x44a793
push 0x44a7dc
mov eax, dword [0x48ac78]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x48cbf4], eax
push 0x44a7ec
mov eax, dword [0x48ac78]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x48cbf8], eax
push 0x44a800
mov eax, dword [0x48ac78]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x48cbfc], eax
push 0x44a818
mov eax, dword [0x48ac78]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x48cc00], eax
push 0x44a830
mov eax, dword [0x48ac78]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x48cc04], eax
push 0x44a844
mov eax, dword [0x48ac78]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x48cc08], eax
push 0x44a85c
mov eax, dword [0x48ac78]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x48cc0c], eax
push 0x44a874
mov eax, dword [0x48ac78]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x48cc10], eax
push 0x44a890
mov eax, dword [0x48ac78]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x48cc14], eax
push 0x44a89c
mov eax, dword [0x48ac78]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x48cc18], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x44a7b1
mov eax, dword [ebp - 4]
push eax
call sub.kernel32.dll_SetErrorMode
ret
pop ebx
pop ecx
pop ebp
ret

Function at 0x456fc8
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
push esi
mov esi, eax
mov bl, byte [0x457018]
test si, 4
je 0x456fdc
or bl, 1
test si, 8
je 0x456fe6
or bl, 4
test si, 1
je 0x456ff0
or bl, 8
test si, 2
je 0x456ffa
or bl, 0x10
test si, 0x10
je 0x457004
or bl, 0x20
push 0x12
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x457013
or bl, 2
mov eax, ebx
pop esi
pop ebx
ret

Function at 0x45701c
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
push esi
mov esi, eax
mov bl, byte [0x457054]
push 0x10
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x457035
or bl, 1
push 0x11
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x457044
or bl, 4
test esi, 0x20000000
je 0x45704f
or bl, 2
mov eax, ebx
pop esi
pop ebx
ret
Function at 0x45c0d4
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
push esi
mov esi, edx
mov ebx, eax
push 0x12
call sub.user32.dll_GetKeyState
test ax, ax
jl 0x45c178
mov ax, word [esi + 4]
sub ax, 9
je 0x45c0ff
add eax, 0xffffffe4
sub ax, 4
jb 0x45c131
jmp 0x45c178
push 0x11
call sub.user32.dll_GetKeyState
test ax, ax
jl 0x45c178
push 1
push 0x10
call sub.user32.dll_GetKeyState
test ax, ax
setge cl
mov edx, dword [ebx + 0x220]
mov eax, ebx
call fcn.00446310
mov dword [esi + 0xc], 1
pop esi
pop ebx
ret
mov eax, dword [ebx + 0x220]
test eax, eax
je 0x45c181
cmp dword [ebx + 0xc], 0x115c
je 0x45c181
cmp dword [eax + 0xc], 0x115c
je 0x45c181
push 0
mov dx, word [esi + 4]
cmp dx, 0x27
je 0x45c163
cmp dx, 0x28
je 0x45c163
xor ecx, ecx
jmp 0x45c165
mov cl, 1
mov edx, dword [eax + 0x30]
xchg edx, eax
call fcn.00446310
mov dword [esi + 0xc], 1
pop esi
pop ebx
ret
mov edx, esi
mov eax, ebx
call fcn.004452a4
pop esi
pop ebx
ret

Function at 0x45d810
Capabilities:
Get keyboard layout

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
test dl, dl
je 0x45d822
add esp, 0xfffffff0
call fcn.00403858
mov byte [ebp - 1], dl
mov ebx, eax
xor edx, edx
mov eax, ebx
call fcn.004220a0
mov eax, dword [0x48b2e8]
mov dword [eax + 4], ebx
mov dword [eax], 0x45dbb4
mov eax, dword [0x48b2f4]
mov dword [eax + 4], ebx
mov dword [eax], 0x45dbc0
mov eax, ebx
call fcn.0045dbcc
push 0
call sub.user32.dll_GetKeyboardLayout
mov dword [ebx + 0x3c], eax
mov dl, 1
mov eax, dword [0x417a70]
call fcn.004034c4
mov dword [ebx + 0x4c], eax
mov dl, 1
mov eax, dword [0x417a70]
call fcn.004034c4
mov dword [ebx + 0x50], eax
mov dl, 1
mov eax, dword [0x417a70]
call fcn.004034c4
mov dword [ebx + 0x54], eax
mov dl, 1
mov eax, dword [0x417a70]
call fcn.004034c4
mov dword [ebx + 0x58], eax
mov dl, 1
mov eax, dword [0x417a70]
call fcn.004034c4
mov dword [ebx + 0x7c], eax
push 0
call sub.user32.dll_GetDC
mov esi, eax
push 0x5a
push esi
call sub.gdi32.dll_GetDeviceCaps
mov dword [ebx + 0x40], eax
push esi
push 0
call sub.user32.dll_ReleaseDC
mov eax, dword [ebx + 0x58]
push eax
mov eax, 0x459fe4
push eax
push 0
push 0
mov eax, dword [0x48b43c]
mov eax, dword [eax]
call eax
mov dl, 1
mov eax, dword [0x423aec]
call fcn.00425200
mov dword [ebx + 0x84], eax
mov dl, 1
mov eax, dword [0x423aec]
call fcn.00425200
mov dword [ebx + 0x88], eax
mov dl, 1
mov eax, dword [0x423aec]
call fcn.00425200
mov dword [ebx + 0x80], eax
mov eax, ebx
call fcn.0045e034
mov eax, dword [ebx + 0x84]
mov dword [eax + 0xc], ebx
mov dword [eax + 8], 0x45df10
mov eax, dword [ebx + 0x88]
mov dword [eax + 0xc], ebx
mov dword [eax + 8], 0x45df10
mov eax, dword [ebx + 0x80]
mov dword [eax + 0xc], ebx
mov dword [eax + 8], 0x45df10
mov eax, ebx
cmp byte [ebp - 1], 0
je 0x45d95f
call fcn.004038b0
pop dword fs:[0]
add esp, 0xc
mov eax, ebx
pop esi
pop ebx
pop ecx
pop ebp
ret
Function at 0x1c12af0
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, 0x1860015
lea edi, [esi - 0x145f015]
push edi
jmp 0x1c12b0a
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x1c12b11
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x1c12b00
mov eax, 1
add ebx, ebx
jne 0x1c12b23
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x1c12b34
jne 0x1c12b53
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x1c12b53
dec eax
add ebx, ebx
jne 0x1c12b40
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x1c12b18
add ebx, ebx
jne 0x1c12b4f
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x1c12ba5
xor ecx, ecx
sub eax, 3
jb 0x1c12b6b
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x1c12bda
sar eax, 1
mov ebp, eax
jmp 0x1c12b76
add ebx, ebx
jne 0x1c12b76
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x1c12b44
inc ecx
add ebx, ebx
jne 0x1c12b84
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x1c12b44
add ebx, ebx
jne 0x1c12b91
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x1c12b86
jne 0x1c12ba2
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x1c12b86
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x1c12bc4
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x1c12bb6
jmp 0x1c12b06
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x1c12bc4
add edi, ecx
jmp 0x1c12b06
pop esi
mov edi, esi
mov ecx, 0x712c33
mov al, 0xe8
repne scasb al, byte es:[edi]
jne 0x1c12bff
cmp byte [edi], 0x17
jne 0x1c12be4
mov eax, dword [edi]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
add eax, esi
stosd dword es:[edi], eax
jmp 0x1c12be2
lea edi, [esi + 0x17f5000]
mov eax, dword [edi]
or eax, eax
je 0x1c12c47
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x1823328]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x18234e8]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x1c12c05
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x18234f0]
or eax, eax
je 0x1c12c41
mov dword [ebx], eax
add ebx, 4
jmp 0x1c12c22
call dword [esi + 0x18234ec]
mov ebp, dword [esi + 0x18234f4]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x19f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x1c12c7b
sub esp, 0xffffff80
jmp 0xb57168
Function at 0x10005e20
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10020763
mov eax, dword fs:[0]
push eax
sub esp, 0x28
push ebx
push esi
push edi
mov eax, dword [0x100344c0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov dword [ebp - 0x10], ebx
mov esi, dword [ebp + 8]
lea edi, [ebx + 4]
push 0x48
mov dword [ebp - 0x14], edi
mov eax, dword [esi]
mov dword [ebx], eax
mov dword [edi], 0
mov dword [edi + 4], 0
call fcn.10016a0d
add esp, 4
mov dword [eax], eax
mov dword [eax + 4], eax
mov dword [edi], eax
lea ecx, [ebx + 0xc]
mov dword [ebp - 4], 0
mov dword [ecx], 0
mov dword [ecx + 4], 0
mov dword [ecx + 8], 0
mov eax, dword [esi + 0x18]
mov dword [ebx + 0x18], eax
mov eax, dword [esi + 0x1c]
mov dword [ebx + 0x1c], eax
mov eax, dword [esi + 0x10]
sub eax, dword [esi + 0xc]
push dword [edi]
sar eax, 2
push eax
mov byte [ebp - 4], 1
call fcn.1000aad0
mov eax, dword [esi + 4]
mov dword [ebp - 0x1c], eax
mov esi, dword [eax]
cmp esi, eax
je 0x10006007
nop word [eax + eax]
cmp dword [esi + 0x1c], 7
lea ebx, [esi + 8]
mov eax, dword [ebx + 0x10]
mov edx, ebx
jbe 0x10005ee0
mov edx, dword [ebx]
xor ecx, ecx
mov edi, 0x811c9dc5
add eax, eax
mov dword [ebp + 8], eax
je 0x10005f04
mov ebx, eax
movzx eax, byte [ecx + edx]
inc ecx
xor eax, edi
imul edi, eax, 0x1000193
cmp ecx, ebx
jb 0x10005ef0
lea ebx, [esi + 8]
mov ecx, dword [ebp - 0x10]
lea eax, [ebp - 0x24]
push edi
push ebx
push eax
call fcn.100079d0
cmp dword [ebp - 0x20], 0
jne 0x10005ff9
mov eax, dword [ebp - 0x10]
cmp dword [eax + 8], 0x38e38e3
je 0x1000601d
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x2c], eax
push 0x48
mov byte [ebp - 4], 2
mov dword [ebp - 0x28], 0
call fcn.10016a0d
add esp, 4
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x28], eax
add eax, 8
mov ecx, eax
mov dword [ebp + 8], eax
push ebx
call fcn.10008760
mov ecx, dword [ebp + 8]
lea eax, [ebx + 0x18]
add ecx, 0x18
mov byte [ebp - 4], 3
push eax
call fcn.10008620
mov ebx, dword [ebp - 0x10]
mov byte [ebp - 4], 4
mov eax, dword [ebx + 8]
inc eax
movd xmm0, eax
cvtdq2pd xmm0, xmm0
shr eax, 0x1f
addsd xmm0, qword [eax*8 + 0x10025970]
mov eax, dword [ebx + 0x1c]
cvtpd2ps xmm1, xmm0
movd xmm0, eax
cvtdq2pd xmm0, xmm0
shr eax, 0x1f
addsd xmm0, qword [eax*8 + 0x10025970]
cvtpd2ps xmm0, xmm0
divss xmm1, xmm0
comiss xmm1, dword [ebx]
seta al
test al, al
je 0x10005fdd
mov ecx, ebx
call fcn.1000b130
push edi
push dword [ebp + 8]
lea eax, [ebp - 0x34]
mov ecx, ebx
push eax
call fcn.100079d0
mov ecx, dword [eax]
mov eax, dword [eax + 4]
mov dword [ebp - 0x24], ecx
mov dword [ebp - 0x20], eax
jmp 0x10005fe0
mov ecx, dword [ebp - 0x24]
push dword [ebp - 0x18]
mov dword [ebp - 0x28], 0
push ecx
push edi
mov ecx, ebx
call fcn.1000b0d0
mov byte [ebp - 4], 1
jmp 0x10005ffc
mov ebx, dword [ebp - 0x10]
mov esi, dword [esi]
cmp esi, dword [ebp - 0x1c]
jne 0x10005ed0
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
push str.unordered_map_set_too_long
call fcn.10014c68
int3
Function at 0x10009360
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push esi
mov esi, ecx
push edi
mov edi, dword [ebp + 8]
test esi, esi
je 0x100093cd
cmp byte [esi + 0x20], 6
jne 0x100093cd
cmp dword [ebp + 0x1c], 7
mov ecx, 0x811c9dc5
mov eax, dword [ebp + 0x18]
push ebx
lea ebx, [ebp + 8]
mov dword [ebp - 4], esi
cmova ebx, edi
xor edx, edx
add eax, eax
je 0x100093ac
mov dword [ebp - 4], esi
mov edi, eax
movzx eax, byte [edx + ebx]
inc edx
xor eax, ecx
imul ecx, eax, 0x1000193
cmp edx, edi
jb 0x10009398
mov edi, dword [ebp + 8]
push ecx
mov ecx, dword [ebp - 4]
lea eax, [ebp + 8]
push eax
lea eax, [ebp - 0xc]
push eax
call fcn.100079d0
pop ebx
mov eax, dword [eax + 4]
test eax, eax
je 0x100093cd
cmp eax, dword [esi + 4]
lea esi, [eax + 0x20]
jne 0x100093d2
mov esi, 0x10034d30
mov eax, dword [ebp + 0x1c]
cmp eax, 7
jbe 0x10009405
lea ecx, [eax*2 + 2]
mov eax, edi
cmp ecx, 0x1000
jb 0x100093fb
mov edi, dword [eax - 4]
add ecx, 0x23
sub eax, edi
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x1000940f
push ecx
push edi
call fcn.10016a3d
add esp, 8
pop edi
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret 0x18
call fcn.10018300
int3
Function at 0x1000b260
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
mov dword [ebp - 4], ecx
cmp edx, eax
je 0x1000b3fc
cmp dword [edx + 0x1c], 7
mov eax, dword [ecx + 4]
push esi
mov dword [ebp - 0x18], eax
mov esi, edx
mov eax, dword [ecx + 0xc]
push edi
mov dword [ebp - 0x14], eax
lea edi, [edx + 8]
mov eax, dword [edx + 4]
mov dword [ebp - 8], eax
mov eax, dword [edi + 0x10]
jbe 0x1000b29b
mov edi, dword [edi]
xor edx, edx
push ebx
mov ebx, 0x811c9dc5
add eax, eax
je 0x1000b2c4
mov ecx, eax
nop dword [eax]
movzx eax, byte [edx + edi]
inc edx
xor eax, ebx
imul ebx, eax, 0x1000193
cmp edx, ecx
jb 0x1000b2b0
mov ecx, dword [ebp - 4]
mov eax, dword [ecx + 0x18]
mov ecx, dword [ebp - 0x14]
and eax, ebx
lea eax, [ecx + eax*8]
mov ecx, dword [eax]
mov dword [ebp - 0xc], eax
mov eax, dword [eax + 4]
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0x1c], eax
nop dword [eax]
mov edi, esi
mov ebx, esi
mov esi, dword [esi]
lea ecx, [edi + 8]
call fcn.10008fd0
push 0x48
push edi
call fcn.10016a3d
mov eax, dword [ebp - 4]
add esp, 8
dec dword [eax + 8]
cmp ebx, dword [ebp - 0x1c]
je 0x1000b329
mov eax, dword [ebp + 0xc]
cmp esi, eax
jne 0x1000b2e0
mov ecx, dword [ebp - 0x10]
cmp ecx, dword [ebp + 8]
jne 0x1000b318
mov edx, dword [ebp - 0xc]
mov dword [edx], esi
mov ecx, dword [ebp - 8]
pop ebx
pop edi
mov dword [ecx], esi
mov dword [esi + 4], ecx
pop esi
mov esp, ebp
pop ebp
ret 8
mov ecx, dword [ebp - 0x10]
mov edx, dword [ebp - 0xc]
cmp ecx, dword [ebp + 8]
jne 0x1000b33b
mov ecx, dword [ebp - 0x18]
mov dword [edx], ecx
jmp 0x1000b33e
mov ecx, dword [ebp - 8]
mov dword [edx + 4], ecx
mov ecx, dword [ebp + 0xc]
cmp esi, ecx
je 0x1000b3ef
nop dword [eax]
cmp dword [esi + 0x1c], 7
lea edx, [esi + 8]
mov ebx, dword [edx + 0x10]
jbe 0x1000b35e
mov edx, dword [edx]
xor ecx, ecx
mov edi, 0x811c9dc5
add ebx, ebx
je 0x1000b384
nop dword [eax]
movzx eax, byte [ecx + edx]
inc ecx
xor eax, edi
imul edi, eax, 0x1000193
cmp ecx, ebx
jb 0x1000b370
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x18]
mov ecx, dword [ebp - 0x14]
and eax, edi
lea eax, [ecx + eax*8]
mov dword [ebp + 8], eax
mov eax, dword [eax + 4]
mov dword [ebp - 0x1c], eax
mov edi, esi
mov ebx, esi
mov esi, dword [esi]
lea ecx, [edi + 8]
call fcn.10008fd0
push 0x48
push edi
call fcn.10016a3d
mov eax, dword [ebp - 4]
add esp, 8
dec dword [eax + 8]
cmp ebx, dword [ebp - 0x1c]
je 0x1000b3d9
mov eax, dword [ebp + 0xc]
cmp esi, eax
jne 0x1000b398
mov ecx, dword [ebp + 8]
pop ebx
pop edi
mov dword [ecx], esi
mov ecx, dword [ebp - 8]
mov dword [ecx], esi
mov dword [esi + 4], ecx
pop esi
mov esp, ebp
pop ebp
ret 8
mov ecx, dword [ebp + 8]
mov edi, dword [ebp - 0x18]
mov dword [ecx], edi
mov dword [ecx + 4], edi
mov ecx, dword [ebp + 0xc]
cmp esi, ecx
jne 0x1000b350
mov eax, dword [ebp - 8]
pop ebx
pop edi
mov dword [eax], esi
mov dword [esi + 4], eax
mov eax, ecx
pop esi
mov esp, ebp
pop ebp
ret 8
Function at 0x1000b850
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov edx, dword [ebp + 8]
mov eax, ecx
push ebx
push esi
push edi
cmp dword [edx + 0x14], 7
mov edi, edx
mov ebx, dword [edx + 0x10]
mov dword [ebp - 4], eax
jbe 0x1000b86e
mov edi, dword [edx]
xor ecx, ecx
mov esi, 0x811c9dc5
add ebx, ebx
je 0x1000b894
nop dword [eax]
movzx eax, byte [ecx + edi]
inc ecx
xor eax, esi
imul esi, eax, 0x1000193
cmp ecx, ebx
jb 0x1000b880
mov eax, dword [ebp - 4]
push esi
push edx
lea ecx, [ebp - 8]
push ecx
mov ecx, eax
call fcn.100079d0
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
test eax, eax
je 0x1000b8b4
add eax, 0x20
mov esp, ebp
pop ebp
ret 4
push str.invalid_unordered_map_K__T__key
call fcn.10014c88
int3
Function at 0x1000d590
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10022315
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push esi
push edi
mov eax, dword [0x100344c0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edx, ecx
mov dword [ebp - 0x10], edx
mov edi, dword [ebp + 0xc]
mov dword [ebp - 0x14], edi
cmp dword [edi + 0x14], 7
mov ecx, dword [edi + 0x10]
jbe 0x1000d5d0
mov eax, dword [edi]
mov dword [ebp - 0x14], eax
lea eax, [ecx + ecx]
mov esi, 0x811c9dc5
xor ecx, ecx
test eax, eax
je 0x1000d5fa
mov edx, dword [ebp - 0x14]
mov edi, eax
movzx eax, byte [ecx + edx]
inc ecx
xor eax, esi
imul esi, eax, 0x1000193
cmp ecx, edi
jb 0x1000d5e3
mov edi, dword [ebp + 0xc]
mov edx, dword [ebp - 0x10]
push esi
push edi
lea eax, [ebp - 0x18]
mov ecx, edx
push eax
call fcn.100079d0
mov ecx, dword [ebp - 0x14]
test ecx, ecx
je 0x1000d62a
mov eax, dword [ebp + 8]
mov dword [eax], ecx
mov byte [eax + 4], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 0xc
mov eax, dword [ebp - 0x10]
cmp dword [eax + 8], 0x4924924
je 0x1000d75f
add eax, 4
mov dword [ebp - 0x20], eax
push 0x38
mov dword [ebp - 4], 0
mov dword [ebp - 0x1c], 0
call fcn.10016a0d
xorps xmm0, xmm0
mov dword [ebp - 0x1c], eax
movups xmmword [eax + 8], xmm0
mov dword [eax + 0x18], 0
add esp, 4
mov dword [eax + 0x1c], 0
lea ecx, [eax + 8]
movups xmm0, xmmword [edi]
xor eax, eax
movups xmmword [ecx], xmm0
movq xmm0, qword [edi + 0x10]
movq qword [ecx + 0x10], xmm0
xorps xmm0, xmm0
mov word [edi], ax
mov dword [edi + 0x10], 0
mov dword [edi + 0x14], 7
movups xmmword [ecx + 0x18], xmm0
mov dword [ecx + 0x28], eax
mov dword [ecx + 0x2c], eax
mov eax, dword [ebp + 0x10]
movups xmm0, xmmword [eax]
movups xmmword [ecx + 0x18], xmm0
movq xmm0, qword [eax + 0x10]
movq qword [ecx + 0x28], xmm0
xor ecx, ecx
mov dword [eax + 0x10], 0
mov dword [eax + 0x14], 7
mov word [eax], cx
mov edi, dword [ebp - 0x10]
mov dword [ebp - 4], 1
mov eax, dword [edi + 8]
inc eax
movd xmm0, eax
cvtdq2pd xmm0, xmm0
shr eax, 0x1f
addsd xmm0, qword [eax*8 + 0x10025970]
mov eax, dword [edi + 0x1c]
cvtpd2ps xmm1, xmm0
movd xmm0, eax
cvtdq2pd xmm0, xmm0
shr eax, 0x1f
addsd xmm0, qword [eax*8 + 0x10025970]
cvtpd2ps xmm0, xmm0
divss xmm1, xmm0
comiss xmm1, dword [edi]
jbe 0x1000d732
mov ecx, edi
call fcn.10012240
mov eax, dword [ebp - 0x1c]
mov ecx, edi
push esi
add eax, 8
push eax
lea eax, [ebp - 0x18]
push eax
call fcn.100079d0
mov ecx, dword [eax]
jmp 0x1000d735
mov ecx, dword [ebp - 0x18]
push dword [ebp - 0x1c]
push ecx
push esi
mov ecx, edi
call fcn.1000b0d0
mov ecx, dword [ebp + 8]
mov dword [ecx], eax
mov eax, ecx
mov byte [ecx + 4], 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 0xc
push str.unordered_map_set_too_long
call fcn.10014c68
int3