joyce8/EMBER2024-capa huggingface dataset:
Function at 0x409af0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [ebp + 8]
mov dword [ebp - 8], eax
mov dword [ebp - 0xc], 0
mov eax, dword [ebp - 8]
lea ecx, [eax + 0x2c]
mov dword [esp + 0x14], ecx
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], 0
mov dword [esp + 8], 0x4097f0
mov dword [esp + 4], 0
mov dword [esp], 0
call fcn.00417f93
mov dword [ebp - 0xc], eax
mov dword [ebp - 4], eax
mov dword [ebp - 0x10], 0x5f57f5ca
jmp 0x409b50
mov dword [ebp - 0x10], 0x9a5c84ce
nop
nop
nop
nop
nop
mov eax, dword [ebp - 0x10]
cmp eax, 0x77b28cca
jg 0x409b90
cmp eax, 0x5f57f5c9
jg 0x409ba0
cmp eax, 0x42b88083
jg 0x409bbc
cmp eax, 0x9a5c84cd
jg 0x409bc8
cmp eax, 0x8a68218d
jne 0x409b50
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
sub esp, 4
mov dword [ebp - 0x10], 0x9a5c84ce
jmp 0x409b50
cmp eax, 0x77b28ccb
jne 0x409b50
jmp 0x409b44
cmp eax, 0x5f57f5ca
jne 0x409b50
mov eax, 0x8b21bfd
cmp dword [ebp - 4], 0
je 0x409bb7
mov eax, 0xb47d1ba5
mov dword [ebp - 0x10], eax
jmp 0x409b50
cmp eax, 0x42b88084
jne 0x409b50
jmp 0x409ccd
cmp eax, 0xb47d1ba4
jg 0x409bf5
cmp eax, 0x9a5c84ce
jne 0x409b50
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
sub esp, 4
mov dword [ebp - 0x10], 0xa627576
jmp 0x409b50
cmp eax, 0xcee53d51
jg 0x409c2a
cmp eax, 0xb47d1ba5
jne 0x409b50
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
mov dword [esp + 4], 0xffffffff
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
sub esp, 8
mov dword [ebp - 0x10], 0xf83f8baf
jmp 0x409b50
cmp eax, 0xf83f8bae
jg 0x409c48
cmp eax, 0xcee53d52
jne 0x409b50
mov dword [ebp - 0x10], 0x14a72b7d
jmp 0x409b50
cmp eax, 0x8b21bfc
jg 0x409c72
cmp eax, 0xf83f8baf
jne 0x409b50
mov eax, 0x77b28ccb
cmp dword [ebp - 0xc], 0
jne 0x409c6a
mov eax, 0x42b88084
mov dword [ebp - 0x10], eax
jmp 0x409b50
cmp eax, 0xa627575
jg 0x409c90
cmp eax, 0x8b21bfd
jne 0x409b50
mov dword [ebp - 0x10], 0x14a72b7d
jmp 0x409b50
cmp eax, 0xa627576
je 0x409caa
cmp eax, 0x14a72b7d
jne 0x409cb6
mov dword [ebp - 0x10], 0x14ca67ac
jmp 0x409b50
mov dword [ebp - 0x10], 0x42b88084
jmp 0x409b50
cmp eax, 0x14ca67ac
jne 0x409b50
mov dword [ebp - 0x10], 0xf83f8baf
jmp 0x409b50
add esp, 0x28
pop ebp
ret
Function at 0x40e4f0
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
sub esp, 0x1c
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x18], 0
mov eax, dword [0x40fac8]
mov dword [ebp - 0x1c], eax
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov dword [ebp - 0x14], eax
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x20], 0xea143915
jmp 0x40e540
mov dword [ebp - 0x10], 0
mov dword [ebp - 0x20], 0x983a1e88
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, dword [ebp - 0x20]
cmp eax, 0x7f7ce1f3
jg 0x40e5b0
cmp eax, 0x983a1e87
jg 0x40e5c0
cmp eax, 0x81ab4532
jne 0x40e540
mov dword [esp], 0
call fcn.0040e6b0
mov dword [esp], eax
call fcn.00417a22
mov eax, dword [ebp - 0x14]
movzx esi, word [eax]
mov dword [esp], eax
call fcn.00404bf0
mov ecx, dword [ebp - 0x14]
movzx edi, word [ecx + eax*2 - 2]
add edi, esi
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
add eax, edi
mov dword [ebp - 0x18], eax
mov ecx, 0xcae9fb0d
cmp eax, dword [ebp - 0x1c]
je 0x40e59e
mov ecx, 0xc04fdeff
mov dword [ebp - 0x20], ecx
jmp 0x40e540
cmp eax, 0x7f7ce1f4
jne 0x40e540
jmp 0x40e523
cmp eax, 0xf78c2191
jg 0x40e5f3
cmp eax, 0xea143914
jg 0x40e611
cmp eax, 0xd9cf7017
jg 0x40e634
cmp eax, 0xa387e679
jg 0x40e641
cmp eax, 0x983a1e88
jne 0x40e540
mov dword [ebp - 0x20], 0xd9cf7018
jmp 0x40e540
cmp eax, 0xf78c2192
jne 0x40e540
mov dword [ebp - 0x10], 0
mov dword [ebp - 0x20], 0x7f7ce1f4
jmp 0x40e540
cmp eax, 0xea143915
jne 0x40e540
mov eax, 0xa387e67a
cmp dword [ebp - 0xc], 0
je 0x40e62c
mov eax, 0x81ab4532
mov dword [ebp - 0x20], eax
jmp 0x40e540
cmp eax, 0xd9cf7018
jne 0x40e540
jmp 0x40e698
cmp eax, 0xa387e67a
je 0x40e65b
cmp eax, 0xc04fdeff
jne 0x40e66e
mov dword [ebp - 0x20], 0x7f7ce1f4
jmp 0x40e540
mov dword [ebp - 0x10], 0
mov dword [ebp - 0x20], 0xd9cf7018
jmp 0x40e540
cmp eax, 0xcae9fb0d
jne 0x40e540
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [0x4b40f8], eax
call fcn.004179ff
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x20], 0xd9cf7018
jmp 0x40e540
mov eax, dword [ebp - 0x10]
add esp, 0x1c
pop esi
pop edi
pop ebp
ret
Function at 0x41fa5a
Capabilities:
Link many functions at runtime
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x4c73e0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_EncodePointer]
push esi
push edi
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp + 0xc]
xor edi, edi
push edi
mov dword [ebp - 0x20], eax
call ebx
mov esi, eax
mov dword [ebp - 0x18], esi
call fcn.0041c8a3
mov dword [ebp - 0x14], eax
cmp dword [0x4c8c7c], edi
jne 0x41fb4b
push 0x800
push edi
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov esi, eax
test esi, esi
jne 0x41fad8
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x57
jne 0x41fc2b
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov esi, eax
test esi, esi
je 0x41fc2b
push str.MessageBoxW
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x41fc2b
push eax
call ebx
push str.GetActiveWindow
push esi
mov dword [0x4c8c7c], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetLastActivePopup
push esi
mov dword [0x4c8c80], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetUserObjectInformationW
push esi
mov dword [0x4c8c84], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x4c8c8c], eax
test eax, eax
je 0x41fb48
push str.GetProcessWindowStation
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x4c8c88], eax
mov esi, dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x41fb70
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x41fb63
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp dword [ebp - 0x14], edi
je 0x41fb85
push 4
pop eax
jmp 0x41fc2d
cmp dword [ebp - 0x14], edi
je 0x41fb85
push dword [0x4c8c7c]
call dword [sym.imp.KERNEL32.dll_DecodePointer]
push 3
jmp 0x41fb6a
mov eax, dword [0x4c8c88]
mov ebx, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, esi
je 0x41fbe3
cmp dword [0x4c8c8c], esi
je 0x41fbe3
push eax
call ebx
push dword [0x4c8c8c]
mov dword [ebp - 0x14], eax
call ebx
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
test ecx, ecx
je 0x41fbe3
test eax, eax
je 0x41fbe3
call ecx
test eax, eax
je 0x41fbd8
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call dword [ebp - 0x18]
test eax, eax
je 0x41fbd8
test byte [ebp - 8], 1
jne 0x41fbe3
mov esi, dword [ebp + 0x10]
or esi, 0x200000
jmp 0x41fc13
mov eax, dword [0x4c8c80]
cmp eax, esi
je 0x41fc10
push eax
call ebx
test eax, eax
je 0x41fc10
call eax
mov edi, eax
test edi, edi
je 0x41fc10
mov eax, dword [0x4c8c84]
cmp eax, esi
je 0x41fc10
push eax
call ebx
test eax, eax
je 0x41fc10
push edi
call eax
mov edi, eax
mov esi, dword [ebp + 0x10]
push dword [0x4c8c7c]
call ebx
test eax, eax
je 0x41fc2b
push esi
push dword [ebp - 0x20]
push dword [ebp - 0x1c]
push edi
call eax
jmp 0x41fc2d
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004199a9
leave
ret
Function at 0x10004450
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100e3ca5
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push ebx
push esi
push edi
mov eax, dword [0x10116f80]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov edi, dword [ebp + 8]
movzx eax, byte [edi]
xor eax, 0x811c9dc5
imul edx, eax, 0x1000193
movzx eax, byte [edi + 1]
xor edx, eax
movzx eax, byte [edi + 2]
imul edx, edx, 0x1000193
xor edx, eax
movzx eax, byte [edi + 3]
imul ecx, edx, 0x1000193
xor ecx, eax
lea eax, [ebp - 0x1c]
imul ebx, ecx, 0x1000193
mov ecx, esi
push ebx
push edi
push eax
call fcn.100037c0
mov eax, dword [ebp - 0x18]
test eax, eax
jne 0x1000457f
cmp dword [esi + 8], 0xccccccc
je 0x10004596
lea eax, [esi + 4]
mov dword [ebp - 0x14], eax
push 0x14
mov dword [ebp - 4], 0
mov dword [ebp - 0x10], 0
call fcn.100b905a
mov dword [ebp - 0x10], eax
add esp, 4
lea ecx, [eax + 8]
mov eax, dword [edi]
mov dword [ecx], eax
mov dword [ecx + 4], 0
mov dword [ecx + 8], 0
mov eax, dword [esi + 8]
inc eax
mov dword [ebp - 4], 1
movd xmm0, eax
cvtdq2pd xmm0, xmm0
shr eax, 0x1f
addsd xmm0, qword [eax*8 + 0x100ef7a0]
mov eax, dword [esi + 0x1c]
cvtpd2ps xmm1, xmm0
movd xmm0, eax
cvtdq2pd xmm0, xmm0
shr eax, 0x1f
addsd xmm0, qword [eax*8 + 0x100ef7a0]
cvtpd2ps xmm0, xmm0
divss xmm1, xmm0
comiss xmm1, dword [esi]
jbe 0x1000456f
mov ecx, esi
call fcn.10006ce0
mov edi, dword [ebp - 0x10]
mov ecx, esi
push ebx
lea eax, [edi + 8]
push eax
lea eax, [ebp - 0x1c]
push eax
call fcn.100037c0
mov ecx, dword [eax]
jmp 0x10004575
mov ecx, dword [ebp - 0x1c]
mov edi, dword [ebp - 0x10]
push edi
push ecx
push ebx
mov ecx, esi
call fcn.10006a30
add eax, 0xc
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
push str.unordered_map_set_too_long
call fcn.100a1a69
int3

Function at 0x100046b0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x214
mov eax, dword [0x10116f80]
xor eax, ebp
mov dword [ebp - 4], eax
push 0x1f4
xorps xmm0, xmm0
mov dword [ebp - 0x204], 0
lea eax, [ebp - 0x1f8]
mov dword [ebp - 0x200], 0xf
push 0
movups xmmword [ebp - 0x214], xmm0
push eax
mov byte [ebp - 0x214], 0
mov dword [ebp - 0x1fc], 0
call fcn.100ba870
push 0x1f3
lea eax, [ebp - 0x214]
push eax
lea eax, [ebp - 0x1f8]
push 0x1f4
push eax
call fcn.100c5836
mov ecx, dword [ebp - 0x200]
add esp, 0x1c
cmp ecx, 0xf
jbe 0x1000475b
mov edx, dword [ebp - 0x214]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x10004751
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x100047b3
push ecx
push edx
call fcn.100b908a
add esp, 8
lea eax, [ebp + 0xc]
push eax
push 0
push dword [ebp + 8]
lea eax, [ebp - 0x1f8]
push 0x1f4
push eax
call fcn.10007f10
mov ecx, dword [eax]
push dword [eax + 4]
or ecx, 2
push ecx
call fcn.100ca2c1
add esp, 0x1c
lea eax, [ebp - 0x1fc]
push 0
push 0x1011ca10
push 0x1f8
push eax
push dword [0x10116278]
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100b93b2
mov esp, ebp
pop ebp
ret
call fcn.100c526f
int3
Function at 0x10004830
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x10116f80]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebp + 0xc]
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, dword [0x1011c9a0]
push edi
push eax
push ecx
push esi
mov dword [ebp - 0x24], ebx
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov edi, eax
test edi, edi
jne 0x1000489c
xorps xmm0, xmm0
mov eax, ebx
movups xmmword [ebx], xmm0
mov dword [ebx + 0x10], 0
mov dword [ebx + 0x14], 0
mov dword [ebx + 0x10], 0
pop edi
mov dword [ebx + 0x14], 0xf
pop esi
mov byte [ebx], 0
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100b93b2
mov esp, ebp
pop ebp
ret
push edi
push esi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
push edi
push esi
mov dword [ebp - 0x20], eax
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov dword [ebp - 0x24], eax
test eax, eax
je 0x10004864
push dword [ebp - 0x20]
push 0
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov edi, eax
push edi
call dword [sym.imp.KERNEL32.dll_GlobalLock]
push dword [ebp - 0x20]
mov esi, eax
push dword [ebp - 0x24]
push esi
call fcn.100bac30
add esp, 0xc
mov dword [ebp - 0xc], 0
xorps xmm0, xmm0
mov dword [ebp - 8], 0
lea ecx, [ebp - 0x1c]
movups xmmword [ebp - 0x1c], xmm0
push dword [ebp - 0x20]
push esi
call fcn.10003730
push edi
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
push edi
call dword [sym.imp.KERNEL32.dll_GlobalFree]
push dword [ebp - 0x24]
call dword [sym.imp.KERNEL32.dll_FreeResource]
mov ecx, dword [ebp - 4]
xorps xmm0, xmm0
movups xmmword [ebx], xmm0
mov dword [ebx + 0x10], 0
mov eax, ebx
movups xmm0, xmmword [ebp - 0x1c]
mov dword [ebx + 0x14], 0
xor ecx, ebp
pop edi
movups xmmword [ebx], xmm0
pop esi
movq xmm0, qword [ebp - 0xc]
movq qword [ebx + 0x10], xmm0
pop ebx
call fcn.100b93b2
mov esp, ebp
pop ebp
ret
Function at 0x10004ee0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100e3db5
mov eax, dword fs:[0]
push eax
sub esp, 0x430
mov eax, dword [0x10116f80]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
mov edi, dword [ebp + 0xc]
mov dword [ebp - 0x43c], esi
mov edx, dword [esi + 0x5f8]
mov eax, edx
mov ecx, dword [esi + 0x5fc]
or eax, ecx
je 0x10004f3f
push dword [esi + 4]
push dword [esi]
push ecx
push edx
push str._p____p
call fcn.100046b0
add esp, 0x14
mov eax, dword [0x1011c9b0]
inc eax
mov dword [0x1011c9b0], eax
cmp eax, 0x9c4
jl 0x10004f65
push str.too_many_hooks:_cant_insert
call fcn.100046b0
add esp, 4
xor al, al
jmp 0x100050e1
test edi, edi
je 0x10004f82
cmp byte [edi], 0
je 0x10004f82
push 0x3b
push edi
lea eax, [esi + 0x1d0]
push 0x3c
push eax
call fcn.100c5836
add esp, 0x10
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
sub esp, 0xa08
lea eax, [ebp - 0x28]
mov edi, esp
mov ecx, 0x282
rep movsd dword es:[edi], dword [esi]
push eax
call fcn.10082790
mov ecx, eax
add esp, 0xa10
cmp dword [ecx + 0x14], 7
jbe 0x10004fb1
mov ecx, dword [ecx]
mov esi, dword [ebp - 0x43c]
push ecx
push 0x1f4
lea eax, [esi + 0x20c]
push eax
call fcn.100c5370
add esp, 0xc
lea ecx, [ebp - 0x28]
call fcn.10004170
imul eax, dword [0x1011c9b0], 0xac8
sub esp, 0xa08
mov edi, esp
mov ecx, 0x282
rep movsd dword es:[edi], dword [esi]
add eax, dword [0x1011c9ac]
mov ecx, eax
call fcn.100084a0
test al, al
jne 0x10005078
mov eax, dword [ebp - 0x43c]
lea ecx, [ebp - 0x28]
add eax, 0x20c
push eax
call fcn.10003cd0
push 0xfde9
lea eax, [ebp - 0x28]
mov dword [ebp - 4], 0
push eax
lea eax, [ebp - 0x40]
push eax
call fcn.10080ca0
add esp, 0xc
cmp dword [eax + 0x14], 0xf
mov byte [ebp - 4], 1
jbe 0x1000503a
mov eax, dword [eax]
push eax
push str.failed_to_insert_hook__s
call fcn.100046b0
add esp, 8
lea ecx, [ebp - 0x40]
call fcn.10004120
lea ecx, [ebp - 0x28]
mov dword [ebp - 4], 0xffffffff
call fcn.10004170
imul ecx, dword [0x1011c9b0], 0xac8
add ecx, dword [0x1011c9ac]
call fcn.10008250
xor al, al
jmp 0x100050e1
mov edx, dword [ebp - 0x43c]
lea esi, [ebp - 0x428]
mov dword [ebp - 0x438], 4
mov ecx, dword [edx + 4]
mov eax, dword [edx]
mov dword [ebp - 0x42c], ecx
lea ecx, [edx + 0x20c]
mov dword [ebp - 0x430], eax
sub esi, ecx
nop word [eax + eax]
movzx eax, word [ecx]
lea ecx, [ecx + 2]
mov word [esi + ecx - 2], ax
test ax, ax
jne 0x100050b0
push 0
push 0x1011ca10
push 0x3f8
lea eax, [ebp - 0x438]
push eax
push dword [0x10116278]
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov al, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.100b93b2
mov esp, ebp
pop ebp
ret
Function at 0x100053b0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0x10]
sub esp, 0x10
test eax, eax
je 0x100053cb
push eax
push str.removing_hook:__s
call fcn.100046b0
add esp, 8
mov eax, dword [ebp + 8]
mov ecx, dword [ebp + 0xc]
push 0
push 0x1011ca10
mov dword [ebp - 8], eax
lea eax, [ebp - 0x10]
push 0x10
push eax
push dword [0x10116278]
mov dword [ebp - 0x10], 3
mov dword [ebp - 4], ecx
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov esp, ebp
pop ebp
ret
Function at 0x100062f0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x282
mov edx, dword [ebp + 0x10]
push esi
mov esi, dword [ebp + 0xc]
movups xmm0, xmmword [eax]
push edi
push 0
movups xmmword [edx], xmm0
push 0x1011ca10
movups xmm0, xmmword [eax + 0x10]
mov eax, dword [ebp + 0x14]
lea edi, [edx + 0x20]
add eax, 0xa30
push eax
movups xmmword [edx + 0x10], xmm0
push edx
rep movsd dword es:[edi], dword [esi]
push dword [0x10116278]
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop edi
pop esi
pop ebp
ret

Function at 0x10006750
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov edx, dword [ebp + 8]
mov eax, 0x1fffffff
push ebx
mov ebx, ecx
bsr ecx, eax
push esi
push edi
mov edi, 1
mov dword [ebp - 4], ebx
mov eax, edi
shl eax, cl
cmp edx, eax
ja 0x100068a9
mov esi, dword [ebx + 4]
lea eax, [edx - 1]
or eax, edi
mov dword [ebp + 8], esi
bsr ecx, eax
push esi
lea ecx, [ecx + 1]
shl edi, cl
lea ecx, [ebx + 0xc]
lea eax, [edi + edi]
push eax
call fcn.100034a0
lea eax, [edi - 1]
mov dword [ebx + 0x1c], edi
mov dword [ebx + 0x18], eax
mov eax, dword [ebx + 4]
mov eax, dword [eax]
mov ecx, eax
cmp eax, esi
je 0x1000687c
movzx edx, byte [eax + 8]
xor edx, 0x811c9dc5
mov ecx, dword [ecx]
imul edi, edx, 0x1000193
movzx edx, byte [eax + 9]
xor edi, edx
movzx edx, byte [eax + 0xa]
imul edi, edi, 0x1000193
xor edi, edx
movzx edx, byte [eax + 0xb]
imul edi, edi, 0x1000193
xor edi, edx
mov edx, dword [ebx + 0xc]
imul edi, edi, 0x1000193
and edi, dword [ebx + 0x18]
lea edx, [edx + edi*8]
mov edi, dword [edx]
mov dword [ebp - 8], edx
cmp edi, esi
jne 0x10006801
mov dword [edx], eax
mov dword [edx + 4], eax
jmp 0x10006872
mov edx, dword [edx + 4]
mov ebx, dword [eax + 8]
cmp ebx, dword [edx + 8]
jne 0x1000683b
mov edx, dword [edx]
mov dword [ebp - 0xc], edx
cmp edx, eax
je 0x10006833
mov ebx, dword [eax + 4]
mov esi, dword [ebp - 0xc]
mov dword [ebx], ecx
mov edi, dword [ecx + 4]
mov dword [edi], edx
mov edx, dword [edx + 4]
mov dword [edx], eax
mov dword [esi + 4], edi
mov esi, dword [ebp + 8]
mov dword [ecx + 4], ebx
mov dword [eax + 4], edx
mov edx, dword [ebp - 8]
mov dword [edx + 4], eax
jmp 0x1000686f
cmp edi, edx
je 0x1000684c
nop
mov edx, dword [edx + 4]
cmp ebx, dword [edx + 8]
je 0x10006885
cmp edi, edx
jne 0x10006840
mov ebx, dword [eax + 4]
mov dword [ebp - 0xc], ebx
mov dword [ebx], ecx
mov ebx, dword [ecx + 4]
mov dword [ebx], edx
mov edi, dword [edx + 4]
mov dword [edi], eax
mov dword [edx + 4], ebx
mov edx, dword [ebp - 0xc]
mov dword [ecx + 4], edx
mov edx, dword [ebp - 8]
mov dword [eax + 4], edi
mov dword [edx], eax
mov ebx, dword [ebp - 4]
mov eax, ecx
cmp ecx, esi
jne 0x100067b2
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
mov ebx, dword [eax + 4]
mov edx, dword [edx]
mov dword [ebp - 0xc], edx
mov esi, edx
mov dword [ebx], ecx
mov edi, dword [ecx + 4]
mov dword [edi], edx
mov edx, dword [edx + 4]
mov dword [edx], eax
mov dword [esi + 4], edi
mov esi, dword [ebp + 8]
mov dword [ecx + 4], ebx
mov dword [eax + 4], edx
jmp 0x1000686f
push str.invalid_hash_bucket_count
call fcn.100a1a69
int3
Function at 0x100068c0
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov edx, dword [ebp + 8]
mov eax, 0x1fffffff
push ebx
mov ebx, ecx
bsr ecx, eax
push esi
push edi
mov edi, 1
mov dword [ebp - 4], ebx
mov eax, edi
shl eax, cl
cmp edx, eax
ja 0x10006a1a
mov esi, dword [ebx + 4]
lea eax, [edx - 1]
or eax, edi
mov dword [ebp + 8], esi
bsr ecx, eax
push esi
lea ecx, [ecx + 1]
shl edi, cl
lea ecx, [ebx + 0xc]
lea eax, [edi + edi]
push eax
call fcn.10006340
lea eax, [edi - 1]
mov dword [ebx + 0x1c], edi
mov dword [ebx + 0x18], eax
mov eax, dword [ebx + 4]
mov eax, dword [eax]
mov ecx, eax
cmp eax, esi
je 0x100069ed
movzx edx, byte [eax + 8]
xor edx, 0x811c9dc5
mov ecx, dword [ecx]
imul edi, edx, 0x1000193
movzx edx, byte [eax + 9]
xor edi, edx
movzx edx, byte [eax + 0xa]
imul edi, edi, 0x1000193
xor edi, edx
movzx edx, byte [eax + 0xb]
imul edi, edi, 0x1000193
xor edi, edx
imul edx, edi, 0x1000193
mov edi, dword [ebx + 0x18]
and edi, edx
mov edx, dword [ebx + 0xc]
lea edx, [edx + edi*8]
mov edi, dword [edx]
mov dword [ebp - 8], edx
cmp edi, esi
jne 0x10006973
mov dword [edx], eax
mov dword [edx + 4], eax
jmp 0x100069e3
mov edx, dword [edx + 4]
mov ebx, dword [eax + 8]
cmp ebx, dword [edx + 8]
jne 0x100069ad
mov edx, dword [edx]
mov dword [ebp - 0xc], edx
cmp edx, eax
je 0x100069a5
mov ebx, dword [eax + 4]
mov esi, dword [ebp - 0xc]
mov dword [ebx], ecx
mov edi, dword [ecx + 4]
mov dword [edi], edx
mov edx, dword [edx + 4]
mov dword [edx], eax
mov dword [esi + 4], edi
mov esi, dword [ebp + 8]
mov dword [ecx + 4], ebx
mov dword [eax + 4], edx
mov edx, dword [ebp - 8]
mov dword [edx + 4], eax
jmp 0x100069e0
cmp edi, edx
je 0x100069bd
mov edx, dword [edx + 4]
cmp ebx, dword [edx + 8]
je 0x100069f6
cmp edi, edx
jne 0x100069b1
mov ebx, dword [eax + 4]
mov dword [ebp - 0xc], ebx
mov dword [ebx], ecx
mov ebx, dword [ecx + 4]
mov dword [ebx], edx
mov edi, dword [edx + 4]
mov dword [edi], eax
mov dword [edx + 4], ebx
mov edx, dword [ebp - 0xc]
mov dword [ecx + 4], edx
mov edx, dword [ebp - 8]
mov dword [eax + 4], edi
mov dword [edx], eax
mov ebx, dword [ebp - 4]
mov eax, ecx
cmp ecx, esi
jne 0x10006922
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
mov ebx, dword [eax + 4]
mov edx, dword [edx]
mov dword [ebp - 0xc], edx
mov esi, edx
mov dword [ebx], ecx
mov edi, dword [ecx + 4]
mov dword [edi], edx
mov edx, dword [edx + 4]
mov dword [edx], eax
mov dword [esi + 4], edi
mov esi, dword [ebp + 8]
mov dword [ecx + 4], ebx
mov dword [eax + 4], edx
jmp 0x100069e0
push str.invalid_hash_bucket_count
call fcn.100a1a69
int3
Function at 0x100079d0
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100e3fb0
mov eax, dword fs:[0]
push eax
sub esp, 0x224
mov eax, dword [0x10116f80]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
push 0x1011c9d8
mov dword [ebp - 0x21c], eax
mov dword [ebp - 0x230], 0x1011c9d8
mov byte [ebp - 0x22c], 0
call fcn.100a1aef
add esp, 4
test eax, eax
jne 0x10007ba2
cmp dword [0x1011ca04], 0x7fffffff
je 0x10007ba9
mov byte [ebp - 0x22c], 1
mov dword [ebp - 0x228], 0x1011c9b8
mov ebx, dword [ebp - 0x21c]
mov dword [ebp - 4], eax
movzx eax, bl
xor eax, 0x811c9dc5
imul ecx, eax, 0x1000193
movzx eax, byte [ebp - 0x21b]
xor ecx, eax
movzx eax, byte [ebp - 0x21a]
imul ecx, ecx, 0x1000193
xor ecx, eax
movzx eax, byte [ebp - 0x219]
imul ecx, ecx, 0x1000193
xor ecx, eax
lea eax, [ebp - 0x21c]
imul edi, ecx, 0x1000193
mov ecx, 0x1011c9b8
push edi
push eax
lea eax, [ebp - 0x224]
push eax
call fcn.100037c0
mov edx, dword [0x1011c9bc]
mov eax, dword [eax + 4]
test eax, eax
cmovne edx, eax
cmp edx, dword [0x1011c9bc]
je 0x10007aed
push edi
lea eax, [ebp - 0x21c]
mov ecx, 0x1011c9b8
push eax
lea eax, [ebp - 0x224]
push eax
call fcn.100037c0
mov esi, dword [ebp - 0x220]
test esi, esi
je 0x10007bba
jmp 0x10007b74
push 0x104
lea eax, [ebp - 0x218]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test eax, eax
je 0x10007b33
lea eax, [ebp - 0x218]
push 0x5c
push eax
call fcn.100bab88
add esp, 8
mov ecx, 0x1011c9b8
lea esi, [eax + 2]
lea eax, [ebp - 0x21c]
push eax
lea eax, [ebp - 0x224]
push eax
call fcn.10003920
push esi
jmp 0x10007b50
lea eax, [ebp - 0x21c]
mov ecx, 0x1011c9b8
push eax
lea eax, [ebp - 0x224]
push eax
call fcn.10003920
push 0x100ef550
mov ecx, dword [eax]
add ecx, 0xc
call fcn.10004330
lea eax, [ebp - 0x21c]
mov ecx, 0x1011c9b8
push eax
lea eax, [ebp - 0x224]
push eax
call fcn.10003920
mov esi, dword [eax]
push 0x1011c9d8
add esi, 0xc
call fcn.100a1b00
add esp, 4
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.100b93b2
mov esp, ebp
pop ebp
ret
push 5
call fcn.100a1e29
push 6
mov dword [0x1011ca04], 0x7ffffffe
call fcn.100a1e29
push str.invalid_unordered_map_K__T__key
call fcn.100a1a89
int3