joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1003a6b0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push esi
mov esi, ecx
push edi
mov edi, dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov ecx, dword [esi + 8]
test ecx, ecx
je 0x1003a6ea
mov eax, dword [0x1008b850]
mov dword [esi + 4], 0
mov dword [esi], 0
test eax, eax
je 0x1003a6dd
dec dword [eax + 0x370]
push ecx
call edi
add esp, 4
mov dword [esi + 8], 0
mov ecx, dword [esi + 0x14]
test ecx, ecx
je 0x1003a71b
mov eax, dword [0x1008b850]
mov dword [esi + 0x10], 0
mov dword [esi + 0xc], 0
test eax, eax
je 0x1003a70e
dec dword [eax + 0x370]
push ecx
call edi
add esp, 4
mov dword [esi + 0x14], 0
mov ecx, dword [esi + 0x20]
test ecx, ecx
je 0x1003a74c
mov eax, dword [0x1008b850]
mov dword [esi + 0x1c], 0
mov dword [esi + 0x18], 0
test eax, eax
je 0x1003a73f
dec dword [eax + 0x370]
push ecx
call edi
add esp, 4
mov dword [esi + 0x20], 0
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x34], 0
mov dword [esi + 0x38], 0
mov ecx, dword [esi + 0x44]
test ecx, ecx
je 0x1003a799
mov eax, dword [0x1008b850]
mov dword [esi + 0x40], 0
mov dword [esi + 0x3c], 0
test eax, eax
je 0x1003a78c
dec dword [eax + 0x370]
push ecx
call edi
add esp, 4
mov dword [esi + 0x44], 0
mov ecx, dword [esi + 0x50]
test ecx, ecx
je 0x1003a7ca
mov eax, dword [0x1008b850]
mov dword [esi + 0x4c], 0
mov dword [esi + 0x48], 0
test eax, eax
je 0x1003a7bd
dec dword [eax + 0x370]
push ecx
call edi
add esp, 4
mov dword [esi + 0x50], 0
mov ecx, dword [esi + 0x5c]
test ecx, ecx
je 0x1003a7fb
mov eax, dword [0x1008b850]
mov dword [esi + 0x58], 0
mov dword [esi + 0x54], 0
test eax, eax
je 0x1003a7ee
dec dword [eax + 0x370]
push ecx
call edi
add esp, 4
mov dword [esi + 0x5c], 0
pop edi
lea ecx, [esi + 0x78]
pop esi
jmp fcn.1003d700
Function at 0x100431e0
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x34
mov eax, dword [0x10089040]
xor eax, esp
mov dword [esp + 0x30], eax
push ebx
mov ebx, dword [0x1008b850]
lea eax, [esp + 0x10]
push esi
push edi
push eax
push dword [0x100bcb04]
xorps xmm0, xmm0
movups xmmword [esp + 0x20], xmm0
call dword [sym.imp.USER32.dll_GetClientRect]
mov eax, dword [esp + 0x20]
sub eax, dword [esp + 0x18]
movd xmm1, eax
mov eax, dword [esp + 0x24]
sub eax, dword [esp + 0x1c]
cvtdq2ps xmm1, xmm1
movd xmm0, eax
lea eax, [esp + 0x30]
cvtdq2ps xmm0, xmm0
push eax
movss dword [ebx + 0x10], xmm1
movss dword [ebx + 0x14], xmm0
xorps xmm0, xmm0
movlpd qword [esp + 0x34], xmm0
call dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov edi, dword [esp + 0x30]
mov ecx, edi
sub ecx, dword [0x100bcb08]
mov esi, dword [esp + 0x34]
mov edx, esi
sbb edx, dword [0x100bcb0c]
call fcn.10072ab0
mov edx, dword [0x100bcb14]
mov ecx, dword [0x100bcb10]
cvtsd2ss xmm0, xmm0
movss dword [esp + 0x28], xmm0
call fcn.10072ab0
movss xmm1, dword [esp + 0x28]
cvtsd2ss xmm0, xmm0
push 0x11
divss xmm1, xmm0
movss dword [ebx + 0x18], xmm1
mov dword [0x100bcb0c], esi
mov esi, dword [sym.imp.USER32.dll_GetKeyState]
mov dword [0x100bcb08], edi
call esi
shr eax, 0xf
and al, 1
push 0x10
mov byte [ebx + 0xfc], al
call esi
shr eax, 0xf
and al, 1
push 0x12
mov byte [ebx + 0xfd], al
call esi
mov esi, dword [0x1008b850]
shr eax, 0xf
and al, 1
mov byte [ebx + 0xff], 0
mov byte [ebx + 0xfe], al
cmp byte [esi + 0x357], 0
je 0x1004332d
cvttss2si eax, dword [esi + 0xe4]
mov dword [esp + 0x28], eax
cvttss2si eax, dword [esi + 0xe8]
mov dword [esp + 0x2c], eax
lea eax, [esp + 0x28]
push eax
push dword [0x100bcb04]
call dword [sym.imp.USER32.dll_ClientToScreen]
test eax, eax
je 0x1004332d
push dword [esp + 0x2c]
push dword [esp + 0x2c]
call dword [sym.imp.USER32.dll_SetCursorPos]
mov dword [esi + 0xe4], 0xff7fffff
mov dword [esi + 0xe8], 0xff7fffff
call dword [sym.imp.USER32.dll_GetForegroundWindow]
test eax, eax
je 0x100433a7
mov ecx, dword [0x100bcb04]
cmp eax, ecx
je 0x10043361
push ecx
push eax
call dword [sym.imp.USER32.dll_IsChild]
test eax, eax
je 0x100433a7
lea eax, [esp + 0x10]
push eax
call dword [sym.imp.USER32.dll_GetCursorPos]
test eax, eax
je 0x100433a7
lea eax, [esp + 0x10]
push eax
push dword [0x100bcb04]
call dword [sym.imp.USER32.dll_ScreenToClient]
test eax, eax
je 0x100433a7
movd xmm0, dword [esp + 0x10]
movd xmm1, dword [esp + 0x14]
cvtdq2ps xmm0, xmm0
cvtdq2ps xmm1, xmm1
movss dword [esi + 0xe4], xmm0
movss dword [esi + 0xe8], xmm1
cmp byte [ebx + 0xb0], 0
je 0x100433b5
or eax, 0xffffffff
jmp 0x100433c0
mov eax, dword [0x1008b850]
mov eax, dword [eax + 0x1e40]
cmp dword [0x100896c0], eax
je 0x100433d2
mov dword [0x100896c0], eax
call fcn.10042e10
call fcn.10042f40
mov ecx, dword [esp + 0x3c]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.100714c0
mov esp, ebp
pop ebp
ret
Function at 0x10067050
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x50
mov eax, dword [0x10089040]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
push 0x10077620
push 0x64
mov esi, edx
call fcn.10071cd0
mov edi, eax
add esp, 8
test edi, edi
je 0x10067255
push 0x64
push 0
push edi
call sub.VCRUNTIME140.dll_memset
lea eax, [edi + 4]
mov byte [edi], 1
add esp, 0xc
mov dword [eax + 4], 0
mov dword [eax + 8], 0
xorps xmm0, xmm0
movups xmmword [eax + 0xc], xmm0
movq qword [eax + 0x1c], xmm0
mov dword [eax + 0x24], 0
push 2
push eax
mov dword [eax + 0x28], 0
mov dword [eax + 0x2c], 0
call dword [sym.imp.MSVCP140.dll__Mtx_init_in_situ]
lea eax, [edi + 0x34]
push eax
call dword [sym.imp.MSVCP140.dll__Cnd_init_in_situ]
add esp, 0xc
mov dword [0x100bcb1c], edi
lea eax, [ebp - 0x48]
xorps xmm0, xmm0
movq qword [edi + 0x5c], xmm0
push 0x20
push eax
push 0xffffffffffffffff
push str.1000_7
push 0
push 0xfde9
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
xor edx, edx
lea ecx, [ebp - 0x48]
call fcn.10066090
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push 0x1008b8b0
mov dword [0x100c0f54], eax
call dword [sym.imp.MSVCP140.dll__Mtx_lock]
add esp, 4
test eax, eax
je 0x1006712c
push 5
call dword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
mov eax, dword [0x1008b8dc]
cmp eax, 0x7fffffff
jne 0x10067146
dec eax
push 6
mov dword [0x1008b8dc], eax
call dword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
test esi, esi
je 0x1006715b
movups xmm0, xmmword [esi]
movups xmmword [0x100bcd20], xmm0
movq xmm0, qword [esi + 0x10]
jmp 0x10067165
xorps xmm0, xmm0
movups xmmword [0x100bcd20], xmm0
movq qword [0x100bcd30], xmm0
xorps xmm0, xmm0
push 0x1008b8b0
movups xmmword [0x100bcf38], xmm0
movq qword [0x100bcf48], xmm0
call dword [sym.imp.MSVCP140.dll__Mtx_unlock]
add esp, 4
cmp dword [0x100c1058], 0
jne 0x1006725f
mov eax, str.1000_7
mov dword [0x100ac958], 0x100896e0
mov esi, 1
mov edx, 0x100ac968
sub esi, eax
lea ecx, [eax + esi]
cmp ecx, 0x40
jae 0x100671c8
mov cl, byte [eax]
inc eax
mov byte [edx], cl
inc edx
cmp byte [eax], 0
jne 0x100671b5
mov esi, dword [0x100bcb1c]
mov al, 1
mov byte [edx], 0
mov dword [0x100c1058], 0x100ac958
mov dword [0x100ac960], 0x10067690
mov dword [0x100ac964], 0x100676a0
xchg byte [esi], al
push 4
call fcn.100714d3
add esp, 4
lea ecx, [ebp - 0x4c]
mov dword [eax], esi
push ecx
push 0
push eax
push 0x10067ab0
push 0
push 0
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov ecx, eax
add esp, 0x18
mov dword [ebp - 0x50], ecx
test ecx, ecx
je 0x10067246
cmp dword [esi + 0x60], 0
je 0x1006722d
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_terminate]
mov eax, dword [ebp - 0x4c]
mov dword [esi + 0x5c], ecx
mov dword [esi + 0x60], eax
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100714c0
mov esp, ebp
pop ebp
ret
push 6
mov dword [ebp - 0x4c], 0
call dword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
mov dword [0x100bcb1c], 0
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.100714c0
mov esp, ebp
pop ebp
ret
Function at 0x100681c0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [0x10089040]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
mov esi, dword [ebp + 0xc]
push edi
mov edi, dword [0x100c1058]
push esi
push eax
mov dword [edi + 0x154], 1
lea eax, [edi + 0x15c]
lea ebx, [edi + 0x154]
push eax
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
mov dword [edi + 0x158], esi
add esi, 8
je 0x10068292
mov eax, dword [edi]
test eax, eax
je 0x10068241
mov eax, dword [eax + 4]
cmp eax, 0xffffffff
je 0x10068241
test ebx, ebx
je 0x10068241
push 0
lea ecx, [ebp - 8]
mov dword [ebp - 8], 0
push ecx
push esi
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
cmp eax, 1
jne 0x10068241
cmp dword [ebp - 8], esi
je 0x10068292
mov ecx, dword [edi + 0xc]
test ecx, ecx
je 0x10068261
mov eax, dword [edi + 4]
cmp eax, 3
je 0x10068255
cmp eax, 1
jne 0x10068261
lea eax, [edi + 0x54]
push eax
push dword [edi + 0x50]
call ecx
add esp, 8
mov esi, dword [edi]
push dword [esi + 4]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi + 4], 0xffffffff
xor al, al
mov byte [esi], 0
mov dword [edi + 4], 0
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100714c0
mov esp, ebp
pop ebp
ret 8
mov ecx, dword [ebp - 4]
mov al, 1
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.100714c0
mov esp, ebp
pop ebp
ret 8
Function at 0x1006e480
Capabilities:
Enumerate threads
Suspend thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x10089040]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, ecx
mov dword [ebp - 0x24], edx
push edi
push 0
push 4
mov dword [esi], 0
mov dword [esi + 4], 0
mov dword [esi + 8], 0
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov edi, eax
cmp edi, 0xffffffff
je 0x1006e57a
lea eax, [ebp - 0x20]
mov dword [ebp - 0x20], 0x1c
push eax
push edi
call dword [sym.imp.KERNEL32.dll_Thread32First]
test eax, eax
je 0x1006e573
mov ebx, dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
cmp dword [ebp - 0x20], 0x10
jb 0x1006e559
call ebx
cmp dword [ebp - 0x14], eax
jne 0x1006e559
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp dword [ebp - 0x18], eax
je 0x1006e559
mov edx, dword [esi]
test edx, edx
jne 0x1006e522
push 0x200
push edx
push dword [0x1008b880]
mov dword [esi + 4], 0x80
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov edx, eax
mov dword [esi], edx
test edx, edx
je 0x1006e573
jmp 0x1006e54d
mov eax, dword [esi + 4]
cmp dword [esi + 8], eax
jb 0x1006e54d
shl eax, 3
push eax
push edx
push 0
push dword [0x1008b880]
call dword [sym.imp.KERNEL32.dll_HeapReAlloc]
mov edx, eax
test edx, edx
je 0x1006e573
mov eax, dword [esi + 4]
add eax, eax
mov dword [esi], edx
mov dword [esi + 4], eax
mov ecx, dword [esi + 8]
mov eax, dword [ebp - 0x18]
mov dword [edx + ecx*4], eax
inc dword [esi + 8]
lea eax, [ebp - 0x20]
mov dword [ebp - 0x20], 0x1c
push eax
push edi
call dword [sym.imp.KERNEL32.dll_Thread32Next]
test eax, eax
jne 0x1006e4e1
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [esi], 0
je 0x1006e5bf
xor edi, edi
cmp dword [esi + 8], edi
jbe 0x1006e5bf
mov eax, dword [esi]
push dword [eax + edi*4]
push 0
push 0x5a
call dword [sym.imp.KERNEL32.dll_OpenThread]
mov ebx, eax
test ebx, ebx
je 0x1006e5b9
push ebx
call dword [sym.imp.KERNEL32.dll_SuspendThread]
push dword [ebp + 8]
mov edx, dword [ebp - 0x24]
mov ecx, ebx
call fcn.1006e310
add esp, 4
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
inc edi
cmp edi, dword [esi + 8]
jb 0x1006e586
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.100714c0
mov esp, ebp
pop ebp
ret

Function at 0x1006e5d0
Capabilities:
Resume thread

Disassembly:
push ebx
mov ebx, ecx
cmp dword [ebx], 0
je 0x1006e61c
push esi
xor esi, esi
cmp dword [ebx + 8], esi
jbe 0x1006e60b
push edi
mov eax, dword [ebx]
push dword [eax + esi*4]
push 0
push 0x5a
call dword [sym.imp.KERNEL32.dll_OpenThread]
mov edi, eax
test edi, edi
je 0x1006e604
push edi
call dword [sym.imp.KERNEL32.dll_ResumeThread]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
inc esi
cmp esi, dword [ebx + 8]
jb 0x1006e5e1
pop edi
push dword [ebx]
push 0
push dword [0x1008b880]
call dword [sym.imp.KERNEL32.dll_HeapFree]
pop esi
pop ebx
ret
Function at 0x1006e620
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [0x10089040]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
imul esi, ecx, 0x2c
push edi
add esi, dword [0x100c3660]
mov eax, dword [esi]
mov cl, byte [esi + 0x14]
and cl, 1
lea edi, [eax - 5]
cmove edi, eax
movzx eax, cl
lea ebx, [eax*2 + 5]
lea eax, [ebp - 8]
push eax
push 0x40
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x1006e67c
pop edi
pop esi
mov eax, 0xa
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100714c0
mov esp, ebp
pop ebp
ret
mov byte [edi], 0xe9
mov eax, dword [esi + 4]
sub eax, edi
sub eax, 5
mov dword [edi + 1], eax
test byte [esi + 0x14], 1
je 0x1006e697
mov eax, dword [esi]
mov word [eax], 0xf9eb
lea eax, [ebp - 8]
push eax
push dword [ebp - 8]
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_FlushInstructionCache]
or byte [esi + 0x14], 6
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.100714c0
mov esp, ebp
pop ebp
ret

Function at 0x1006e6d0
Capabilities:
Resume thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov ecx, dword [0x100c3668]
push ebx
push esi
xor ebx, ebx
xor esi, esi
mov dword [ebp - 4], ebx
test ecx, ecx
je 0x1006e7ad
mov eax, dword [0x100c3660]
add eax, 0x14
test byte [eax], 2
je 0x1006e70a
inc esi
add eax, 0x2c
cmp esi, ecx
jb 0x1006e6f5
pop esi
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret
cmp esi, 0xffffffff
je 0x1006e7ad
push edi
push 1
or edx, 0xffffffff
lea ecx, [ebp - 0x10]
call fcn.1006e480
mov ecx, dword [0x100c3668]
add esp, 4
cmp esi, ecx
jae 0x1006e75b
imul edi, esi, 0x2c
mov eax, dword [0x100c3660]
test byte [edi + eax + 0x14], 2
jne 0x1006e750
mov ecx, esi
call fcn.1006e620
mov ebx, eax
test ebx, ebx
jne 0x1006e758
mov ecx, dword [0x100c3668]
inc esi
add edi, 0x2c
cmp esi, ecx
jb 0x1006e731
mov dword [ebp - 4], ebx
mov eax, dword [ebp - 0x10]
test eax, eax
je 0x1006e7ac
xor esi, esi
cmp dword [ebp - 8], esi
jbe 0x1006e79d
mov ebx, eax
nop dword [eax + eax]
push dword [ebx + esi*4]
push 0
push 0x5a
call dword [sym.imp.KERNEL32.dll_OpenThread]
mov edi, eax
test edi, edi
je 0x1006e791
push edi
call dword [sym.imp.KERNEL32.dll_ResumeThread]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
inc esi
cmp esi, dword [ebp - 8]
jb 0x1006e770
mov ebx, dword [ebp - 4]
mov eax, dword [ebp - 0x10]
push eax
push 0
push dword [0x1008b880]
call dword [sym.imp.KERNEL32.dll_HeapFree]
pop edi
pop esi
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1006fb60
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10075dc5
mov eax, dword fs:[0]
push eax
sub esp, 0x24
push ebx
push esi
push edi
mov eax, dword [0x10089040]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov edx, dword [ebp + 0xc]
mov edi, dword [ebp + 8]
mov dword [ebp - 0x1c], edx
mov dword [ebp - 0x24], edi
movzx eax, byte [edx]
xor eax, 0x811c9dc5
imul ecx, eax, 0x1000193
movzx eax, byte [edx + 1]
xor ecx, eax
movzx eax, byte [edx + 2]
imul ecx, ecx, 0x1000193
xor ecx, eax
movzx eax, byte [edx + 3]
imul ecx, ecx, 0x1000193
xor ecx, eax
imul eax, ecx, 0x1000193
mov ecx, ebx
push eax
mov dword [ebp - 0x20], eax
lea eax, [ebp - 0x18]
push edx
push eax
call fcn.1006faf0
mov eax, dword [ebp - 0x14]
test eax, eax
je 0x1006fbea
mov dword [edi], eax
mov byte [edi + 4], 0
jmp 0x1006fd38
cmp dword [ebx + 8], 0xfffffff
jne 0x1006fbfe
push str.unordered_map_set_too_long
call dword [sym.imp.MSVCP140.dll_void___cdecl_std::_Xlength_error_char_const__]
lea eax, [ebx + 4]
mov dword [ebp - 0x2c], eax
mov dword [ebp - 4], 0
push 0x10
mov dword [ebp - 0x28], 0
call fcn.100714d3
mov ecx, dword [ebp - 0x1c]
mov esi, eax
add esp, 4
mov dword [ebp - 0x28], esi
mov ecx, dword [ecx]
mov dword [esi + 8], ecx
mov dword [esi + 0xc], 0
mov dword [ebp - 4], 1
mov eax, dword [ebx + 8]
inc eax
movss xmm3, dword [ebx]
movd xmm0, eax
cvtdq2pd xmm0, xmm0
shr eax, 0x1f
addsd xmm0, qword [eax*8 + 0x100827d0]
mov eax, dword [ebx + 0x1c]
cvtpd2ps xmm2, xmm0
movd xmm0, eax
cvtdq2pd xmm0, xmm0
shr eax, 0x1f
movaps xmm1, xmm2
addsd xmm0, qword [eax*8 + 0x100827d0]
cvtpd2ps xmm0, xmm0
divss xmm1, xmm0
comiss xmm1, xmm3
jbe 0x1006fceb
divss xmm2, xmm3
sub esp, 8
cvtps2pd xmm0, xmm2
movsd qword [ebp - 0x18], xmm0
fld qword [ebp - 0x18]
fstp qword [esp]
call sub.api_ms_win_crt_math_l1_1_0.dll_ceil
fstp qword [ebp - 0x18]
movsd xmm0, qword [ebp - 0x18]
add esp, 8
cvtpd2ps xmm0, xmm0
call fcn.10072940
mov ecx, 8
cmp eax, ecx
cmova ecx, eax
mov eax, dword [ebx + 0x1c]
cmp eax, ecx
jae 0x1006fccd
cmp eax, 0x200
jae 0x1006fccb
shl eax, 3
cmp eax, ecx
jae 0x1006fccd
mov eax, ecx
push eax
mov ecx, ebx
call fcn.10070090
push dword [ebp - 0x20]
lea eax, [esi + 8]
mov ecx, ebx
push eax
lea eax, [ebp - 0x18]
push eax
call fcn.1006faf0
mov edx, dword [eax]
jmp 0x1006fcee
mov edx, dword [ebp - 0x18]
mov eax, dword [edx + 4]
inc dword [ebx + 8]
mov edi, dword [ebp - 0x2c]
mov dword [esi + 4], eax
mov dword [esi], edx
mov dword [eax], esi
mov dword [edx + 4], esi
mov ecx, dword [ebx + 0xc]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebx + 0x18]
and eax, dword [ebp - 0x20]
mov ebx, dword [ecx + eax*8]
cmp ebx, dword [edi]
jne 0x1006fd19
mov dword [ecx + eax*8], esi
jmp 0x1006fd2b
cmp ebx, edx
jne 0x1006fd22
mov dword [ecx + eax*8], esi
jmp 0x1006fd2f
mov edx, dword [ebp - 0x1c]
cmp dword [ecx + eax*8 + 4], edx
jne 0x1006fd2f
mov dword [ecx + eax*8 + 4], esi
mov edi, dword [ebp - 0x24]
mov dword [edi], esi
mov byte [edi + 4], 1
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x10070090
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
mov ebx, ecx
mov eax, 0x1fffffff
bsr ecx, eax
push esi
push edi
mov edi, 1
mov dword [ebp - 8], ebx
mov eax, edi
shl eax, cl
mov ecx, dword [ebp + 8]
cmp ecx, eax
jbe 0x100700c1
push str.invalid_hash_bucket_count
call dword [sym.imp.MSVCP140.dll_void___cdecl_std::_Xlength_error_char_const__]
lea eax, [ecx - 1]
mov esi, dword [ebx + 4]
or eax, 1
mov dword [ebp - 0xc], esi
bsr ecx, eax
push esi
lea ecx, [ecx + 1]
shl edi, cl
lea ecx, [ebx + 0xc]
lea eax, [edi + edi]
push eax
call fcn.1006f9f0
lea eax, [edi - 1]
mov dword [ebx + 0x1c], edi
mov dword [ebx + 0x18], eax
mov eax, dword [ebx + 4]
mov eax, dword [eax]
mov ecx, eax
cmp eax, esi
je 0x100701cc
nop word [eax + eax]
movzx edx, byte [eax + 8]
xor edx, 0x811c9dc5
mov ecx, dword [ecx]
imul edi, edx, 0x1000193
movzx edx, byte [eax + 9]
xor edi, edx
movzx edx, byte [eax + 0xa]
imul edi, edi, 0x1000193
xor edi, edx
movzx edx, byte [eax + 0xb]
imul edi, edi, 0x1000193
xor edi, edx
mov edx, dword [ebx + 0xc]
imul edi, edi, 0x1000193
and edi, dword [ebx + 0x18]
lea edx, [edx + edi*8]
mov edi, dword [edx]
mov dword [ebp - 0x10], edx
cmp edi, esi
jne 0x1007014f
mov dword [edx], eax
mov dword [edx + 4], eax
jmp 0x100701c2
mov edx, dword [edx + 4]
mov ebx, dword [eax + 8]
cmp ebx, dword [edx + 8]
jne 0x10070189
mov edx, dword [edx]
mov dword [ebp - 4], edx
cmp edx, eax
je 0x10070181
mov ebx, dword [eax + 4]
mov esi, dword [ebp - 4]
mov dword [ebx], ecx
mov edi, dword [ecx + 4]
mov dword [edi], edx
mov edx, dword [edx + 4]
mov dword [edx], eax
mov dword [esi + 4], edi
mov esi, dword [ebp - 0xc]
mov dword [ecx + 4], ebx
mov dword [eax + 4], edx
mov edx, dword [ebp - 0x10]
mov dword [edx + 4], eax
jmp 0x100701bf
cmp edi, edx
je 0x1007019c
nop dword [eax]
mov edx, dword [edx + 4]
cmp ebx, dword [edx + 8]
je 0x100701d5
cmp edi, edx
jne 0x10070190
mov ebx, dword [eax + 4]
mov dword [ebp - 4], ebx
mov dword [ebx], ecx
mov ebx, dword [ecx + 4]
mov dword [ebx], edx
mov edi, dword [edx + 4]
mov dword [edi], eax
mov dword [edx + 4], ebx
mov edx, dword [ebp - 4]
mov dword [ecx + 4], edx
mov edx, dword [ebp - 0x10]
mov dword [eax + 4], edi
mov dword [edx], eax
mov ebx, dword [ebp - 8]
mov eax, ecx
cmp ecx, esi
jne 0x10070100
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
mov ebx, dword [eax + 4]
mov edx, dword [edx]
mov dword [ebp - 4], edx
mov esi, edx
mov dword [ebx], ecx
mov edi, dword [ecx + 4]
mov dword [edi], edx
mov edx, dword [edx + 4]
mov dword [edx], eax
mov dword [esi + 4], edi
mov esi, dword [ebp - 0xc]
mov dword [ecx + 4], ebx
mov dword [eax + 4], edx
jmp 0x100701bf
Function at 0x10070200
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1fffffff
sub esp, 0x10
bsr ecx, eax
push ebx
push esi
push edi
mov edi, 1
mov eax, edi
shl eax, cl
mov ecx, dword [ebp + 8]
cmp ecx, eax
jbe 0x1007022c
push str.invalid_hash_bucket_count
call dword [sym.imp.MSVCP140.dll_void___cdecl_std::_Xlength_error_char_const__]
lea eax, [ecx - 1]
mov esi, dword [0x100c362c]
or eax, 1
mov dword [ebp - 8], esi
bsr ecx, eax
push esi
lea ecx, [ecx + 1]
shl edi, cl
mov ecx, 0x100c3634
lea eax, [edi + edi]
push eax
call fcn.1006f9f0
mov eax, dword [0x100c362c]
lea ebx, [edi - 1]
mov dword [0x100c3640], ebx
mov dword [0x100c3644], edi
mov eax, dword [eax]
mov ecx, eax
cmp eax, esi
je 0x10070366
movzx edx, byte [eax + 8]
xor edx, 0x811c9dc5
mov ecx, dword [ecx]
imul edi, edx, 0x1000193
movzx edx, byte [eax + 9]
xor edi, edx
movzx edx, byte [eax + 0xa]
imul edi, edi, 0x1000193
xor edi, edx
movzx edx, byte [eax + 0xb]
imul edi, edi, 0x1000193
xor edi, edx
mov edx, dword [0x100c3634]
imul edi, edi, 0x1000193
and edi, ebx
mov ebx, dword [edx + edi*8]
lea edx, [edx + edi*8]
mov dword [ebp - 0xc], edx
cmp ebx, esi
jne 0x100702c4
mov dword [edx], eax
mov dword [edx + 4], eax
jmp 0x10070331
mov edx, dword [edx + 4]
mov edi, dword [eax + 8]
cmp edi, dword [edx + 8]
jne 0x100702fe
mov edx, dword [edx]
mov dword [ebp - 4], edx
cmp edx, eax
je 0x100702f6
mov ebx, dword [eax + 4]
mov esi, dword [ebp - 4]
mov dword [ebx], ecx
mov edi, dword [ecx + 4]
mov dword [edi], edx
mov edx, dword [edx + 4]
mov dword [edx], eax
mov dword [esi + 4], edi
mov esi, dword [ebp - 8]
mov dword [ecx + 4], ebx
mov dword [eax + 4], edx
mov edx, dword [ebp - 0xc]
mov dword [edx + 4], eax
jmp 0x10070331
cmp ebx, edx
je 0x1007030e
mov edx, dword [edx + 4]
cmp edi, dword [edx + 8]
je 0x10070342
cmp ebx, edx
jne 0x10070302
mov ebx, dword [eax + 4]
mov dword [ebp - 4], ebx
mov dword [ebx], ecx
mov ebx, dword [ecx + 4]
mov dword [ebx], edx
mov edi, dword [edx + 4]
mov dword [edi], eax
mov dword [edx + 4], ebx
mov edx, dword [ebp - 4]
mov dword [ecx + 4], edx
mov edx, dword [ebp - 0xc]
mov dword [eax + 4], edi
mov dword [edx], eax
mov eax, ecx
cmp ecx, esi
je 0x10070366
mov ebx, dword [0x100c3640]
jmp 0x10070272
mov ebx, dword [eax + 4]
mov edx, dword [edx]
mov dword [ebp - 4], edx
mov esi, edx
mov dword [ebx], ecx
mov edi, dword [ecx + 4]
mov dword [edi], edx
mov edx, dword [edx + 4]
mov dword [edx], eax
mov dword [esi + 4], edi
mov esi, dword [ebp - 8]
mov dword [ecx + 4], ebx
mov dword [eax + 4], edx
jmp 0x10070331
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x10070eff
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
push ecx
push 2
lea eax, [ebp - 4]
push eax
push 0x20000001
push str._x_sys_default_locale
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoEx]
xor ecx, ecx
test eax, eax
jne 0x10070f26
mov eax, ecx
mov dword [ebp - 4], eax
jmp 0x10070f29
mov eax, dword [ebp - 4]
push esi
mov esi, dword [ebp + 0xc]
push ecx
push ecx
push esi
push eax
push dword [ebp + 8]
push ecx
push 0x1300
call dword [sym.imp.KERNEL32.dll_FormatMessageA]
push eax
push dword [esi]
call fcn.10070edb
pop esi
leave
ret 8