joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10020390
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
sub esp, 0xc
lea eax, [esp + 4]
push eax
push 0
push 0
push str.SoftwareGPT_RE_BOOT_UpdateChecker
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x100203dc
push 0
lea eax, [esp + 8]
push eax
push 0
push 0xf003f
push 0
push 0
push 0
push str.SoftwareGPT_RE_BOOT_UpdateChecker
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x100204e6
cmp dword [0x100881bc], 8
lea ecx, [esp + 8]
push ecx
lea ecx, [esp + 7]
mov byte [esp + 7], 0
push ecx
push 0
push 8
mov eax, 0x100881a8
mov dword [esp + 0x18], 1
cmovae eax, dword [0x100881a8]
push eax
push 0
push dword [esp + 0x1c]
call dword [sym.imp.ADVAPI32.dll_RegGetValueW]
test eax, eax
je 0x10020500
cmp eax, 0xea
je 0x100204e6
cmp eax, 2
jne 0x100204d2
push 0
push 0x41
push 0x10079a1c
push str._fT_T_ue
push 0
call dword [sym.imp.USER32.dll_MessageBoxExW]
cmp eax, 1
jne 0x10020481
cmp dword [0x100881bc], 8
lea ecx, [esp + 3]
push 1
push ecx
mov byte [esp + 0xb], al
mov eax, 0x100881a8
cmovae eax, dword [0x100881a8]
push 3
push 0
push eax
push dword [esp + 0x18]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
je 0x100204fa
jmp 0x100204e6
cmp eax, 2
jne 0x100204d2
cmp dword [0x100881bc], 8
lea ecx, [esp + 3]
push 1
push ecx
push 3
mov eax, 0x100881a8
mov byte [esp + 0xf], 0
cmovae eax, dword [0x100881a8]
push 0
push eax
push dword [esp + 0x18]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
je 0x10020507
push 0x30
push 0x10079a08
push 0x10079a10
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
xor al, al
add esp, 0xc
ret
push 0x30
push 0x10079a08
push 0x10079a10
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
push 0x30
push 0x10079a08
push 0x10079a10
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
mov al, 1
add esp, 0xc
ret
cmp byte [esp + 3], 0
jne 0x100204fa
xor al, al
add esp, 0xc
ret
Function at 0x10021ac0
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push 0xfffffffffffffffe
push 0x10083a70
push fcn.1005de90
mov eax, dword fs:[0]
push eax
sub esp, 0x24
push ebx
push esi
push edi
mov eax, dword [0x10088064]
xor dword [ebp - 8], eax
xor eax, ebp
push eax
lea eax, [ebp - 0x10]
mov dword fs:[0], eax
mov dword [ebp - 0x18], esp
mov edi, edx
push 0x1c
lea eax, [ebp - 0x34]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
mov dword [ebp - 4], 0
mov eax, 0x5a4d
mov ecx, dword [ebp - 0x30]
cmp word [ecx], ax
jne 0x10021b70
mov edx, dword [ecx + 0x3c]
cmp dword [edx + ecx], 0x4550
jne 0x10021b70
mov esi, dword [edx + ecx + 0xd8]
lea eax, [esi + ecx]
cmp edi, eax
jb 0x10021b70
mov eax, dword [edx + ecx + 0xdc]
add eax, esi
add eax, ecx
cmp edi, eax
jae 0x10021b70
mov dword [ebp - 4], 0xfffffffe
mov al, 1
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov dword [ebp - 4], 0xfffffffe
xor al, al
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x10021ea0
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
sub esp, 0x1c
push ebx
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov ebx, edx
push esi
mov esi, ecx
push edi
lea ecx, [esi - 0x10000]
movzx eax, cx
mov edi, ecx
sub edi, eax
test eax, eax
cmove edi, ecx
cmp edi, ebx
jbe 0x10021f5e
nop dword [eax + eax]
lea eax, [edi - 0x70000000]
cmp eax, 0x10000000
ja 0x10021ee5
sub edi, 0x8000000
jmp 0x10021f56
push 0x1c
lea eax, [esp + 0x14]
mov dword [esp + 0x2c], 0
xorps xmm0, xmm0
push eax
push edi
movups xmmword [esp + 0x1c], xmm0
movq qword [esp + 0x2c], xmm0
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
je 0x10021f5e
cmp dword [esp + 0x20], 0x10000
jne 0x10021f40
cmp dword [esp + 0x1c], 0x10000
jb 0x10021f40
push 0x40
push 0x3000
push 0x10000
push edi
call ebp
test eax, eax
jne 0x1002200a
sub edi, 0x10000
jmp 0x10021f56
mov ecx, dword [esp + 0x14]
add ecx, 0xffff0000
mov edi, ecx
movzx eax, di
sub edi, eax
test eax, eax
cmove edi, ecx
cmp edi, ebx
ja 0x10021ed0
movzx eax, si
test eax, eax
je 0x10021f6d
sub esi, eax
add esi, 0x10000
mov edi, dword [esp + 0x30]
cmp esi, edi
jae 0x10022008
mov ebx, dword [sym.imp.KERNEL32.dll_VirtualQuery]
nop
lea eax, [esi - 0x70000000]
cmp eax, 0x10000000
ja 0x10021f95
add esi, 0x8000000
jmp 0x10022000
push 0x1c
lea eax, [esp + 0x14]
mov dword [esp + 0x2c], 0
xorps xmm0, xmm0
push eax
push esi
movups xmmword [esp + 0x1c], xmm0
movq qword [esp + 0x2c], xmm0
call ebx
test eax, eax
je 0x10022008
cmp dword [esp + 0x20], 0x10000
mov ecx, dword [esp + 0x1c]
jne 0x10021fea
cmp ecx, 0x10000
jb 0x10021fea
push 0x40
push 0x3000
push 0x10000
push esi
call ebp
test eax, eax
jne 0x1002200a
add esi, 0x10000
jmp 0x10022000
mov esi, dword [esp + 0x10]
add esi, ecx
movzx ecx, si
test ecx, ecx
je 0x10022000
mov eax, 0x10000
sub eax, ecx
add esi, eax
cmp esi, edi
jb 0x10021f80
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x1c
ret
Function at 0x100220c0
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ecx
cmp dword [0x1008a51c], 0
jne 0x10022136
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov ecx, eax
mov edx, 0x1008a51c
xor eax, eax
lock cmpxchg dword [edx], ecx
test eax, eax
jne 0x10022136
push esi
mov esi, dword [0x1008a528]
mov dword [0x1008a530], eax
mov dword [0x1008a52c], eax
mov dword [0x1008a524], eax
push edi
test esi, esi
je 0x1002211c
mov edi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [esp + 8]
push eax
push 0x40
push 0x10000
push esi
call edi
test eax, eax
je 0x10022127
mov esi, dword [esi + 4]
test esi, esi
jne 0x10022102
xor eax, eax
pop edi
mov dword [0x1008a518], eax
pop esi
pop ecx
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
pop edi
mov dword [0x1008a518], eax
pop esi
pop ecx
ret
mov eax, 0x10dd
pop ecx
ret
Function at 0x10022580
Capabilities:
Suspend thread

Disassembly:
mov eax, dword [0x1008a518]
push esi
mov esi, ecx
test eax, eax
jne 0x100225ee
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
cmp esi, eax
jne 0x1002259a
xor eax, eax
pop esi
ret
push edi
push 8
call fcn.1005ca4f
add esp, 4
mov edi, eax
push esi
call dword [sym.imp.KERNEL32.dll_SuspendThread]
cmp eax, 0xffffffff
jne 0x100225db
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
push 8
push edi
call fcn.1005cd99
add esp, 8
mov dword [0x1008a518], esi
mov eax, esi
mov dword [0x1008a524], 0
pop edi
pop esi
ret
mov eax, dword [0x1008a52c]
mov dword [edi], eax
xor eax, eax
mov dword [edi + 4], esi
mov dword [0x1008a52c], edi
pop edi
pop esi
ret
Function at 0x10022b00
Capabilities:
Allocate or change rwx memory

Disassembly:
sub esp, 0x1c
push ebx
push esi
push edi
mov ebx, edx
mov esi, ecx
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edi, eax
mov dword [esp + 0x24], 0
push 0x1c
lea eax, [esp + 0x10]
xorps xmm0, xmm0
push eax
push esi
push edi
movups xmmword [esp + 0x1c], xmm0
movq qword [esp + 0x2c], xmm0
call dword [sym.imp.KERNEL32.dll_VirtualQueryEx]
test eax, eax
jne 0x10022b44
pop edi
pop esi
pop ebx
add esp, 0x1c
ret 8
push dword [esp + 0x30]
test byte [esp + 0x24], 0xf0
mov ecx, 0x40
mov eax, 4
cmovne eax, ecx
push eax
push ebx
push esi
push edi
call dword [sym.imp.KERNEL32.dll_VirtualProtectEx]
pop edi
pop esi
pop ebx
add esp, 0x1c
ret 8

Function at 0x10022b70
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push 0xfffffffffffffffe
push 0x10083a90
push fcn.1005de90
mov eax, dword fs:[0]
push eax
sub esp, 0x24
push ebx
push esi
push edi
mov eax, dword [0x10088064]
xor dword [ebp - 8], eax
xor eax, ebp
push eax
lea eax, [ebp - 0x10]
mov dword fs:[0], eax
mov dword [ebp - 0x18], esp
lea esi, [ecx + 0x10000]
xorps xmm0, xmm0
movups xmmword [ebp - 0x34], xmm0
movq qword [ebp - 0x24], xmm0
mov dword [ebp - 0x1c], 0
mov edi, 0x5a4d
push 0x1c
lea eax, [ebp - 0x34]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
jne 0x10022be4
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
cmp dword [ebp - 0x24], 0x1000
jne 0x10022c6a
cmp byte [ebp - 0x20], 1
je 0x10022c6a
test dword [ebp - 0x20], 0x100
jne 0x10022c6a
mov dword [ebp - 4], 0
cmp word [esi], di
jne 0x10022c1e
mov eax, dword [esi + 0x3c]
cmp eax, dword [ebp - 0x28]
ja 0x10022c1e
cmp eax, 0x40
jb 0x10022c1e
cmp dword [eax + esi], 0x4550
je 0x10022c2d
mov dword [ebp - 4], 0xfffffffe
mov esi, dword [ebp - 0x28]
add esi, dword [ebp - 0x34]
jmp 0x10022bc1
mov dword [ebp - 4], 0xfffffffe
mov eax, esi
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov esi, dword [ebp - 0x28]
add esi, dword [ebp - 0x34]
jmp 0x10022bc1
Function at 0x10022c80
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push 0xfffffffffffffffe
push 0x10083ab0
push fcn.1005de90
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push ebx
push esi
push edi
mov eax, dword [0x10088064]
xor dword [ebp - 8], eax
xor eax, ebp
push eax
lea eax, [ebp - 0x10]
mov dword fs:[0], eax
mov dword [ebp - 0x18], esp
mov eax, ecx
mov dword [ebp - 0x1c], ecx
test eax, eax
jne 0x10022cc6
push ecx
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov dword [ebp - 0x1c], eax
mov dword [ebp - 4], 0
mov ecx, 0x5a4d
cmp word [eax], cx
je 0x10022ce1
push 0xc1
jmp 0x10022dcb
mov ebx, dword [eax + 0x3c]
add ebx, eax
cmp dword [ebx], 0x4550
je 0x10022cf8
push 0xbf
jmp 0x10022dcb
movzx eax, word [ebx + 0x14]
test ax, ax
je 0x10022dc6
lea ecx, [ebx + 0x18]
add ecx, eax
mov dword [ebp - 0x24], ecx
xor esi, esi
mov dword [ebp - 0x20], esi
movzx eax, word [ebx + 6]
cmp esi, eax
jae 0x10022dc6
lea eax, [esi + esi*4]
lea edi, [ecx + eax*8]
mov ecx, str..detour
mov eax, edi
nop dword [eax + eax]
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x10022d50
test dl, dl
je 0x10022d4c
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x10022d50
add eax, 2
add ecx, 2
test dl, dl
jne 0x10022d30
xor eax, eax
jmp 0x10022d55
sbb eax, eax
or eax, 1
test eax, eax
jne 0x10022da7
mov eax, dword [edi + 0xc]
test eax, eax
je 0x10022dc6
cmp dword [edi + 0x10], 0
je 0x10022dc6
mov esi, dword [ebp - 0x1c]
add esi, eax
mov eax, dword [esi]
cmp eax, 0x40
jb 0x10022dc6
cmp dword [esi + 4], 0x727444
jne 0x10022dc6
cmp dword [esi + 8], 0
jne 0x10022d84
mov dword [esi + 8], eax
push 0
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov dword [ebp - 4], 0xfffffffe
mov eax, esi
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
inc esi
mov ecx, dword [ebp - 0x24]
jmp 0x10022d0f
push 0xc0
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov dword [ebp - 4], 0xfffffffe
xor eax, eax
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10024b80
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1006e0f0
mov eax, dword fs:[0]
push eax
sub esp, 0x24
push ebx
push esi
push edi
mov eax, dword [0x10088064]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x1c], edx
mov edi, ecx
mov dword [ebp - 0x18], edi
mov dword [ebp - 4], 0
mov eax, dword [0x1008a544]
mov esi, dword [eax]
cmp esi, eax
je 0x10024c88
cmp dword [edi + 0x14], 8
mov ebx, edi
mov eax, dword [edi + 0x10]
mov dword [ebp - 0x14], eax
jb 0x10024bd9
mov ebx, dword [edi]
lea ecx, [eax + eax]
mov edx, 0x811c9dc5
xor eax, eax
test ecx, ecx
je 0x10024c01
movzx ecx, byte [eax + ebx]
inc eax
mov edi, dword [ebp - 0x14]
xor ecx, edx
imul edx, ecx, 0x1000193
lea ecx, [edi + edi]
mov edi, dword [ebp - 0x18]
cmp eax, ecx
jb 0x10024be7
mov ebx, dword [esi + 0x20]
lea eax, [ebp - 0x24]
push edx
push edi
push eax
lea ecx, [ebx + 4]
call fcn.10026c80
mov eax, dword [eax + 4]
test eax, eax
jne 0x10024c1c
mov eax, dword [ebx + 8]
cmp eax, dword [ebx + 8]
lea ecx, [ebx + 4]
je 0x10024c7c
push edi
call fcn.100255f0
sub esp, 0xc
mov ecx, eax
push dword [ebp - 0x1c]
call fcn.10026f00
mov al, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov esi, dword [esi]
mov eax, dword [0x1008a544]
jmp 0x10024bc1
xor al, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10025430
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1006e1c5
mov eax, dword fs:[0]
push eax
sub esp, 0x18
push ebx
push esi
push edi
mov eax, dword [0x10088064]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, dword [ebp + 8]
mov edx, ebx
cmp dword [ebx + 0x14], 0x10
mov esi, dword [ebx + 0x10]
jb 0x10025468
mov edx, dword [ebx]
xor ecx, ecx
mov edi, 0x811c9dc5
test esi, esi
je 0x10025484
movzx eax, byte [ecx + edx]
inc ecx
xor eax, edi
imul edi, eax, 0x1000193
cmp ecx, esi
jb 0x10025473
push edi
push ebx
lea eax, [ebp - 0x14]
push eax
call fcn.10026d00
mov eax, dword [ebp - 0x10]
test eax, eax
jne 0x10025550
cmp dword [0x1008a548], 0x71c71c7
je 0x10025567
mov dword [ebp - 0x1c], 0x1008a544
mov dword [ebp - 4], eax
push 0x24
mov dword [ebp - 0x18], eax
call fcn.1005ca4f
add esp, 4
mov dword [ebp + 8], eax
mov dword [ebp - 0x18], eax
lea esi, [eax + 8]
push ebx
mov ecx, esi
call fcn.1000b140
mov dword [ebp - 4], 1
mov dword [esi + 0x18], 0
mov eax, dword [0x1008a548]
inc eax
movd xmm0, eax
cvtdq2pd xmm0, xmm0
shr eax, 0x1f
addsd xmm0, qword [eax*8 + 0x1007ddf0]
mov eax, dword [0x1008a55c]
cvtpd2ps xmm1, xmm0
movd xmm0, eax
cvtdq2pd xmm0, xmm0
shr eax, 0x1f
addsd xmm0, qword [eax*8 + 0x1007ddf0]
cvtpd2ps xmm0, xmm0
divss xmm1, xmm0
comiss xmm1, dword [0x1008a540]
jbe 0x10025542
call fcn.10026640
mov esi, dword [ebp + 8]
push edi
lea eax, [esi + 8]
push eax
lea eax, [ebp - 0x24]
push eax
call fcn.10026d00
mov ecx, dword [eax]
jmp 0x10025548
mov ecx, dword [ebp - 0x14]
mov esi, dword [ebp + 8]
push esi
push ecx
push edi
call fcn.100266d0
add eax, 0x20
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
push str.unordered_map_set_too_long
call fcn.100474bf
int3
Function at 0x10025e70
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1006e245
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push ebx
push esi
push edi
mov eax, dword [0x10088064]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov edx, dword [ebp + 0xc]
mov edi, edx
cmp dword [edx + 0x14], 8
mov eax, dword [edx + 0x10]
jb 0x10025eaa
mov edi, dword [edx]
xor ecx, ecx
mov esi, 0x811c9dc5
add eax, eax
je 0x10025ecb
mov edx, eax
movzx eax, byte [ecx + edi]
inc ecx
xor eax, esi
imul esi, eax, 0x1000193
cmp ecx, edx
jb 0x10025eb7
mov edx, dword [ebp + 0xc]
push esi
push edx
lea eax, [ebp - 0x14]
mov ecx, ebx
push eax
call fcn.10026c80
mov ecx, dword [ebp - 0x10]
test ecx, ecx
je 0x10025efc
mov eax, dword [ebp + 8]
mov dword [eax], ecx
mov byte [eax + 4], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
cmp dword [ebx + 8], 0x2222222
je 0x10025ffb
lea eax, [ebx + 4]
mov dword [ebp - 0x1c], eax
mov dword [ebp - 4], 0
push 0x78
mov dword [ebp - 0x18], 0
call fcn.1005ca4f
add esp, 4
mov edi, eax
mov dword [ebp - 0x18], edi
push dword [ebp + 0xc]
lea ecx, [edi + 8]
call fcn.10026da0
mov dword [ebp - 4], 4
mov eax, dword [ebx + 8]
inc eax
movd xmm0, eax
cvtdq2pd xmm0, xmm0
shr eax, 0x1f
addsd xmm0, qword [eax*8 + 0x1007ddf0]
mov eax, dword [ebx + 0x1c]
cvtpd2ps xmm1, xmm0
movd xmm0, eax
cvtdq2pd xmm0, xmm0
shr eax, 0x1f
addsd xmm0, qword [eax*8 + 0x1007ddf0]
cvtpd2ps xmm0, xmm0
divss xmm1, xmm0
comiss xmm1, dword [ebx]
jbe 0x10025f99
mov ecx, ebx
call fcn.10026740
push esi
lea eax, [edi + 8]
mov ecx, ebx
push eax
lea eax, [ebp - 0x1c]
push eax
call fcn.10026c80
mov edx, dword [eax]
jmp 0x10025f9c
mov edx, dword [ebp - 0x14]
mov eax, dword [ebx + 8]
mov ecx, dword [edx + 4]
inc eax
mov dword [ebx + 8], eax
mov dword [edi], edx
mov dword [edi + 4], ecx
mov dword [ecx], edi
mov dword [edx + 4], edi
mov eax, dword [ebx + 0x18]
mov dword [ebp + 0xc], ecx
and eax, esi
mov ecx, dword [ebx + 0xc]
mov esi, dword [ecx + eax*8]
cmp esi, dword [ebx + 4]
jne 0x10025fc8
mov dword [ecx + eax*8], edi
jmp 0x10025fda
cmp esi, edx
jne 0x10025fd1
mov dword [ecx + eax*8], edi
jmp 0x10025fde
mov edx, dword [ebp + 0xc]
cmp dword [ecx + eax*8 + 4], edx
jne 0x10025fde
mov dword [ecx + eax*8 + 4], edi
mov eax, dword [ebp + 8]
mov dword [eax], edi
mov byte [eax + 4], 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
push str.unordered_map_set_too_long
call fcn.100474bf
int3
Function at 0x10026010
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1006e285
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push esi
push edi
mov eax, dword [0x10088064]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, dword [ebp + 0xc]
mov edx, edi
cmp dword [edi + 0x14], 0x10
jb 0x10026044
mov edx, dword [edi]
xor ecx, ecx
mov esi, 0x811c9dc5
cmp dword [edi + 0x10], ecx
jbe 0x10026062
movzx eax, byte [ecx + edx]
inc ecx
xor eax, esi
imul esi, eax, 0x1000193
cmp ecx, dword [edi + 0x10]
jb 0x10026050
push esi
push edi
lea eax, [ebp - 0x14]
push eax
call fcn.10026d00
mov ecx, dword [ebp - 0x10]
test ecx, ecx
je 0x10026090
mov eax, dword [ebp + 8]
mov dword [eax], ecx
mov byte [eax + 4], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 8
cmp dword [0x1008a548], 0x71c71c7
je 0x10026199
mov dword [ebp - 0x1c], 0x1008a544
mov dword [ebp - 4], 0
push 0x24
mov dword [ebp - 0x18], 0
call fcn.1005ca4f
mov ecx, eax
add esp, 4
mov dword [ebp + 0xc], ecx
mov dword [ebp - 0x18], ecx
mov dword [ecx + 8], 0
mov dword [ecx + 0x18], 0
mov dword [ecx + 0x1c], 0
movups xmm0, xmmword [edi]
movups xmmword [ecx + 8], xmm0
movq xmm0, qword [edi + 0x10]
movq qword [ecx + 0x18], xmm0
mov dword [edi + 0x10], 0
mov dword [edi + 0x14], 0xf
mov byte [edi], 0
mov dword [ebp - 4], 5
mov eax, dword [edi + 0x18]
mov dword [ecx + 0x20], eax
mov eax, dword [0x1008a548]
inc eax
movd xmm0, eax
cvtdq2pd xmm0, xmm0
shr eax, 0x1f
addsd xmm0, qword [eax*8 + 0x1007ddf0]
mov eax, dword [0x1008a55c]
cvtpd2ps xmm1, xmm0
movd xmm0, eax
cvtdq2pd xmm0, xmm0
shr eax, 0x1f
addsd xmm0, qword [eax*8 + 0x1007ddf0]
cvtpd2ps xmm0, xmm0
divss xmm1, xmm0
comiss xmm1, dword [0x1008a540]
jbe 0x10026170
call fcn.10026640
mov eax, dword [ebp + 0xc]
push esi
add eax, 8
push eax
lea eax, [ebp - 0x1c]
push eax
call fcn.10026d00
mov ecx, dword [ebp + 0xc]
mov edx, dword [eax]
jmp 0x10026173
mov edx, dword [ebp - 0x14]
push ecx
push edx
push esi
call fcn.100266d0
mov ecx, dword [ebp + 8]
mov dword [ecx], eax
mov eax, ecx
mov byte [ecx + 4], 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 8
push str.unordered_map_set_too_long
call fcn.100474bf
int3
Function at 0x10026210
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1006e2c5
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push ebx
push esi
push edi
mov eax, dword [0x10088064]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov edx, dword [ebp + 0xc]
mov edi, edx
cmp dword [edx + 0x14], 8
mov eax, dword [edx + 0x10]
jb 0x1002624a
mov edi, dword [edx]
xor ecx, ecx
mov esi, 0x811c9dc5
add eax, eax
je 0x1002626b
mov edx, eax
movzx eax, byte [ecx + edi]
inc ecx
xor eax, esi
imul esi, eax, 0x1000193
cmp ecx, edx
jb 0x10026257
mov edx, dword [ebp + 0xc]
push esi
push edx
lea eax, [ebp - 0x14]
mov ecx, ebx
push eax
call fcn.10026c80
mov ecx, dword [ebp - 0x10]
test ecx, ecx
je 0x1002629c
mov eax, dword [ebp + 8]
mov dword [eax], ecx
mov byte [eax + 4], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
cmp dword [ebx + 8], 0x2222222
je 0x100263a3
lea eax, [ebx + 4]
mov dword [ebp - 0x1c], eax
mov dword [ebp - 4], 0
push 0x78
mov dword [ebp - 0x18], 0
call fcn.1005ca4f
add esp, 4
mov edi, eax
mov dword [ebp - 0x18], edi
push dword [ebp + 0xc]
lea ecx, [edi + 8]
call fcn.10019610
lea ecx, [edi + 0x20]
call fcn.10026e60
mov dword [ebp - 4], 1
mov eax, dword [ebx + 8]
inc eax
movd xmm0, eax
cvtdq2pd xmm0, xmm0
shr eax, 0x1f
addsd xmm0, qword [eax*8 + 0x1007ddf0]
mov eax, dword [ebx + 0x1c]
cvtpd2ps xmm1, xmm0
movd xmm0, eax
cvtdq2pd xmm0, xmm0
shr eax, 0x1f
addsd xmm0, qword [eax*8 + 0x1007ddf0]
cvtpd2ps xmm0, xmm0
divss xmm1, xmm0
comiss xmm1, dword [ebx]
jbe 0x10026341
mov ecx, ebx
call fcn.10026740
push esi
lea eax, [edi + 8]
mov ecx, ebx
push eax
lea eax, [ebp - 0x1c]
push eax
call fcn.10026c80
mov edx, dword [eax]
jmp 0x10026344
mov edx, dword [ebp - 0x14]
mov eax, dword [ebx + 8]
mov ecx, dword [edx + 4]
inc eax
mov dword [ebx + 8], eax
mov dword [edi], edx
mov dword [edi + 4], ecx
mov dword [ecx], edi
mov dword [edx + 4], edi
mov eax, dword [ebx + 0x18]
mov dword [ebp + 0xc], ecx
and eax, esi
mov ecx, dword [ebx + 0xc]
mov esi, dword [ecx + eax*8]
cmp esi, dword [ebx + 4]
jne 0x10026370
mov dword [ecx + eax*8], edi
jmp 0x10026382
cmp esi, edx
jne 0x10026379
mov dword [ecx + eax*8], edi
jmp 0x10026386
mov edx, dword [ebp + 0xc]
cmp dword [ecx + eax*8 + 4], edx
jne 0x10026386
mov dword [ecx + eax*8 + 4], edi
mov eax, dword [ebp + 8]
mov dword [eax], edi
mov byte [eax + 4], 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
push str.unordered_map_set_too_long
call fcn.100474bf
int3