joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40689a
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x23c
push esi
mov esi, 0x104
lea eax, [ebp - 0x23c]
push esi
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
cmp eax, esi
pop esi
jbe 0x4068be
xor eax, eax
test eax, eax
je 0x4068d1
cmp word [ebp + eax*2 - 0x23e], 0x5c
je 0x4068d1
xor ecx, ecx
jmp 0x4068d4
xor ecx, ecx
inc ecx
push dword [ebp + 8]
lea ecx, [ecx*2 + 0x40a014]
lea eax, [ebp + eax*2 - 0x23c]
push ecx
push str._s_S.dll
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x10
lea eax, [ebp - 0x23c]
push 8
push 0
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
leave
ret 4

Function at 0x4069f7
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
cmp dword [0x46990c], 0
push esi
jne 0x406a2e
xor ecx, ecx
push 8
mov eax, ecx
pop esi
mov edx, eax
and dl, 1
neg dl
sbb edx, edx
and edx, 0xedb88320
shr eax, 1
xor eax, edx
dec esi
jne 0x406a08
mov dword [ecx*4 + 0x469908], eax
inc ecx
cmp ecx, 0x100
jl 0x406a03
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 8]
test edx, edx
not eax
jbe 0x406a5f
mov ecx, dword [esp + 0xc]
push edi
movzx edi, byte [ecx]
mov esi, eax
and esi, 0xff
xor esi, edi
shr eax, 8
mov esi, dword [esi*4 + 0x469908]
xor eax, esi
inc ecx
dec edx
jne 0x406a41
pop edi
not eax
pop esi
ret 0xc

Function at 0x29a0e233
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
pushal
call 0x29a0e242
pop dword [ebp - 0x28]
mov eax, 0x29a0e242
sub dword [ebp - 0x28], eax
mov dword [ebp - 0x38], 0xf6de720c
add dword [ebp - 0x38], 0x5773d33f
mov dword [ebp - 0x34], 0x434e2680
add dword [ebp - 0x34], 0xeee525c5
mov dword [ebp - 0x30], 0xd98cb3e7
sub dword [ebp - 0x30], 0x8d406fb9
mov dword [ebp - 0x2c], 0x15eecb7b
sub dword [ebp - 0x2c], 0x15eecb7b
lea eax, [ebp - 0x38]
push eax
mov eax, sym.imp.kernel32.dll_GetModuleHandleA
add eax, dword [ebp - 0x28]
call dword [eax]
mov dword [ebp - 0x38], 0xcc7d68
sub dword [ebp - 0x38], 0x8c5a1412
mov dword [ebp - 0x34], 0x628bc8b2
sub dword [ebp - 0x34], 0x211f673d
mov dword [ebp - 0x30], 0x722439e1
sub dword [ebp - 0x30], 0xeb4cd75
mov dword [ebp - 0x2c], 0xd35f1b91
add dword [ebp - 0x2c], 0x2ca0e46f
lea ebx, [ebp - 0x38]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x28]
call dword [eax]
push 0x40
push 0x1000
push 0x38cc8
push 0
call eax
mov ecx, 0x1bb2acf6
add ecx, 0xe44d9502
mov esi, eax
mov edi, 0x29a22000
add edi, dword [ebp - 0x28]
mov edx, 0x53b50bb1
xor dword [ebp - 0x20], edx
mov ebx, dword [edi]
add dword [ebp - 0x24], 0x924a186
add ebx, edx
xor dword [ebp - 0x10], edx
mov dword [esi], ebx
add dword [ebp - 0x20], edi
add esi, 4
add edi, 0x57416be8
sub edi, 0x57416be4
loop 0x29a0e349
add eax, 0xfab3
xor ebx, ebx
add ebx, eax
add eax, 0xb7ba99e5
add eax, 0x48456620
mov ecx, 0x3a9316a
add ecx, 0x25f6ce96
add ecx, dword [ebp - 0x28]
call ebx
leave
ret
Function at 0x9e4058
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.009e41a8
push ebx
mov ebx, esp
push ebx
mov esi, dword [ebx + 8]
mov edi, dword [ebx + 0x10]
cld
mov dl, 0x80
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
mov ebx, 2
add dl, dl
jne 0x9e407e
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x9e406a
add dl, dl
jne 0x9e4089
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x9e40dc
xor eax, eax
add dl, dl
jne 0x9e4096
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x9e417d
add dl, dl
jne 0x9e40a5
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x9e40b0
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x9e40bb
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x9e40c6
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0x9e40d2
push edi
mov eax, eax
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0x9e4075
mov eax, 1
add dl, dl
jne 0x9e40ea
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x9e40f5
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x9e40e1
sub eax, ebx
mov ebx, 1
jne 0x9e4128
mov ecx, 1
add dl, dl
jne 0x9e410e
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x9e4119
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x9e4105
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x9e4075
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x9e413f
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x9e414a
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x9e4136
cmp eax, 0x7d00
jae 0x9e416d
cmp eax, 0x500
jb 0x9e4168
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x9e4075
cmp eax, 0x7f
ja 0x9e4170
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x9e4075
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0x9e419e
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0x9e4075
pop ebx
sub edi, dword [ebx + 0x10]
mov eax, edi
pop ebx
ret 0x10
Function at 0xa1e058
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.00a1e1a8
push ebx
mov ebx, esp
push ebx
mov esi, dword [ebx + 8]
mov edi, dword [ebx + 0x10]
cld
mov dl, pe_nt_image_headers32
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
mov ebx, 2
add dl, dl
jne 0xa1e07e
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0xa1e06a
add dl, dl
jne 0xa1e089
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0xa1e0dc
xor eax, eax
add dl, dl
jne 0xa1e096
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0xa1e17d
add dl, dl
jne 0xa1e0a5
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xa1e0b0
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xa1e0bb
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xa1e0c6
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0xa1e0d2
push edi
mov eax, eax
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0xa1e075
mov eax, 1
add dl, dl
jne 0xa1e0ea
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xa1e0f5
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0xa1e0e1
sub eax, ebx
mov ebx, 1
jne 0xa1e128
mov ecx, 1
add dl, dl
jne 0xa1e10e
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0xa1e119
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0xa1e105
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0xa1e075
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0xa1e13f
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0xa1e14a
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0xa1e136
cmp eax, 0x7d00
jae 0xa1e16d
cmp eax, 0x500
jb 0xa1e168
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0xa1e075
cmp eax, 0x7f
ja 0xa1e170
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0xa1e075
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0xa1e19e
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0xa1e075
pop ebx
sub edi, dword [ebx + 0x10]
mov eax, edi
pop ebx
ret 0x10
Function at 0x4050e0
Capabilities:
Check for software breakpoints

Disassembly:
push ebx
push esi
push edi
mov ax, word [0x409170]
cmp ax, 0xcb
je 0x4051dc
cmp ax, 0xcc
je 0x4051dc
mov edx, dword [0x40c5a0]
test edx, edx
je 0x405112
mov eax, dword [0x40c440]
call edx
mov ebx, eax
jmp 0x405117
mov ebx, 0x40c444
cmp word [0x40c430], 0
jle 0x40513a
mov eax, 0x40c410
call fcn.00405350
mov eax, ebx
call fcn.00404cc0
mov eax, ebx
call fcn.00404d30
mov edi, dword [ebx]
jmp 0x40515a
mov esi, dword [edi + 4]
mov eax, dword [edi]
and eax, 1
jne 0x405155
mov edx, edi
mov eax, ebx
call fcn.00404190
jmp 0x405158
and dword [edi], 0xfffffffe
mov edi, esi
test edi, edi
jne 0x405140
mov dword [ebx], 0
mov dword [ebx + 0x88], 0
cmp word [0x40c430], 0
jle 0x4051dc
mov edx, 0x40c350
mov eax, ebx
call fcn.004042c0
mov edi, eax
test edi, edi
je 0x4051af
mov eax, dword [0x40c3e4]
mov dword [edi + 0xc], eax
cmp dword [0x40c3e4], 0
je 0x4051a4
mov eax, dword [0x40c3e4]
mov dword [eax + 8], edi
mov eax, dword [ebx + 0x94]
mov dword [0x40c3e4], eax
sub word [0x40c430], 1
cmp word [0x40c430], 0
sete bl
mov eax, 0x40c410
call fcn.00405360
test bl, bl
je 0x4051dc
mov eax, 0x40c410
call fcn.00405340
pop edi
pop esi
pop ebx
ret
Function at 0x406bf0
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
lea esp, [esp - 0x114]
push ebx
push esi
push edi
mov dword [ebp - 0x114], 0
mov dword [0x40c250], 0
mov dword [ebp - 4], 0
push 0x104
lea eax, [ebp - 0x108]
push eax
push 0
call sub.kernel32.dll_GetModuleFileNameA
mov byte [ebp + eax - 0x108], 0
mov dword [ebp - 0x110], eax
mov ecx, dword [ebp - 0x110]
mov eax, ebp
mov edx, 0
call fcn.00406dd0
mov eax, dword [ebp - 0x110]
lea ecx, [eax + 1]
mov eax, dword [0x40c250]
mov edx, dword [eax]
lea eax, [ebp - 0x108]
call fcn.00402010
call sub.kernel32.dll_GetCommandLineA
mov dword [0x4091e0], eax
mov esi, dword [0x4091e0]
jmp 0x406d90
add esi, 1
movzx eax, byte [esi]
sub eax, 1
cmp eax, 0x20
jb 0x406c80
cmp byte [esi], 0
je 0x406d99
mov byte [ebp - 0x10c], 0
mov edi, esi
mov dword [ebp - 0x110], 0
jmp 0x406cf5
mov al, byte [esi]
cmp al, 1
jb 0x406ceb
sub al, 0x20
jbe 0x406cbc
sub al, 2
je 0x406ccf
jmp 0x406ceb
mov al, byte [ebp - 0x10c]
test al, al
je 0x406cfa
add dword [ebp - 0x110], 1
jmp 0x406cf2
cmp byte [esi + 1], 0x22
je 0x406ce6
mov al, byte [ebp - 0x10c]
test al, al
sete byte [ebp - 0x10c]
jmp 0x406cf2
add esi, 1
jmp 0x406cf2
add dword [ebp - 0x110], 1
add esi, 1
cmp byte [esi], 0
jne 0x406cac
test dword [ebp - 0x114], 0xffffffff
je 0x406d89
mov ecx, dword [ebp - 0x110]
mov edx, dword [ebp - 0x114]
mov eax, ebp
call fcn.00406dd0
mov byte [ebp - 0x10c], 0
mov esi, edi
mov eax, dword [0x40c250]
mov edx, dword [ebp - 0x114]
mov ebx, dword [eax + edx*4]
jmp 0x406d81
mov al, byte [esi]
cmp al, 1
jb 0x406d77
sub al, 0x20
jbe 0x406d48
sub al, 2
je 0x406d5b
jmp 0x406d77
mov al, byte [ebp - 0x10c]
test al, al
je 0x406d86
mov al, byte [esi]
mov byte [ebx], al
add ebx, 1
jmp 0x406d7e
cmp byte [esi + 1], 0x22
je 0x406d72
mov al, byte [ebp - 0x10c]
test al, al
sete byte [ebp - 0x10c]
jmp 0x406d7e
add esi, 1
jmp 0x406d7e
mov al, byte [esi]
mov byte [ebx], al
add ebx, 1
add esi, 1
cmp byte [esi], 0
jne 0x406d38
mov byte [ebx], 0
add dword [ebp - 0x114], 1
cmp byte [esi], 0
jne 0x406c83
mov ebx, dword [ebp - 0x114]
mov dword [0x40c240], ebx
lea edx, [ebx + 1]
shl edx, 2
mov eax, 0x40c250
call fcn.00404f40
mov eax, dword [0x40c250]
mov dword [eax + ebx*4], 0
pop edi
pop esi
pop ebx
leave
ret
Function at 0x4082d0
Capabilities:
Manipulate console buffer

Disassembly:
push ebp
mov ebp, esp
lea esp, [esp - 0x10]
mov byte [ebp - 4], al
cmp al, 7
jb 0x408327
sub al, 7
je 0x408386
sub al, 1
je 0x40830f
sub al, 2
je 0x4082f4
sub al, 3
je 0x408300
jmp 0x408327
add dword [0x40cbf0], 1
jmp 0x408386
mov eax, dword [0x40cb40]
mov dword [0x40cbe0], eax
jmp 0x408386
mov eax, dword [0x40cbe0]
cmp eax, dword [0x40cb40]
jbe 0x408386
sub dword [0x40cbe0], 1
jmp 0x408386
mov eax, dword [0x40cbe0]
sub eax, 1
mov word [ebp - 8], ax
mov eax, dword [0x40cbf0]
sub eax, 1
mov word [ebp - 6], ax
lea eax, [ebp - 0xc]
push eax
push dword [ebp - 8]
push 1
lea eax, [ebp - 4]
push eax
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteConsoleOutputCharacterA
movzx ax, byte [0x4094b0]
mov word [ebp - 0x10], ax
lea eax, [ebp - 0xc]
push eax
push dword [ebp - 8]
push 1
lea eax, [ebp - 0x10]
push eax
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteConsoleOutputAttribute
add dword [0x40cbe0], 1
mov eax, dword [0x40cbe0]
cmp eax, dword [0x40cb50]
jbe 0x4083b9
mov eax, dword [0x40cb40]
mov dword [0x40cbe0], eax
add dword [0x40cbf0], 1
jmp 0x4083b9
mov eax, 1
call fcn.00408230
sub dword [0x40cbf0], 1
mov eax, dword [0x40cbf0]
cmp eax, dword [0x40cb70]
ja 0x4083a8
leave
ret

Function at 0x4083d0
Capabilities:
Manipulate console buffer

Disassembly:
push ebp
mov ebp, esp
lea esp, [esp - 0xc]
push ebx
push esi
push edi
mov edi, eax
mov eax, dword [0x40cbe0]
sub eax, 2
mov word [ebp - 4], ax
mov eax, dword [0x40cbf0]
sub eax, 1
mov word [ebp - 2], ax
movzx ax, byte [0x4094b0]
mov word [ebp - 0xc], ax
movzx ax, byte [edi]
mov si, ax
mov bx, 1
cmp si, bx
jl 0x4084cb
sub bx, 1
lea esi, [esi]
add bx, 1
add word [ebp - 4], 1
lea eax, [ebp - 8]
push eax
push dword [ebp - 4]
push 1
mov al, bl
and eax, 0xff
lea eax, [edi + eax]
push eax
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteConsoleOutputCharacterA
lea eax, [ebp - 8]
push eax
push dword [ebp - 4]
push 1
lea eax, [ebp - 0xc]
push eax
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteConsoleOutputAttribute
add dword [0x40cbe0], 1
mov eax, dword [0x40cbe0]
cmp eax, dword [0x40cb50]
jbe 0x4084c2
mov eax, dword [0x40cb40]
mov dword [0x40cbe0], eax
add dword [0x40cbf0], 1
jmp 0x40849d
mov eax, 1
call fcn.00408230
sub dword [0x40cbf0], 1
mov eax, dword [0x40cbf0]
cmp eax, dword [0x40cb70]
ja 0x40848c
mov eax, dword [0x40cbe0]
sub eax, 2
mov word [ebp - 4], ax
mov eax, dword [0x40cbf0]
sub eax, 1
mov word [ebp - 2], ax
cmp si, bx
jg 0x40841c
pop edi
pop esi
pop ebx
leave
ret
Function at 0x10042210
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x100f1040]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, ecx
cmp dword [esi + 0x38], 0
je 0x100422cc
cmp byte [esi + 0x3d], 0
je 0x100422cc
mov eax, dword [esi]
push edi
push 0xffffffffffffffff
call dword [eax + 0xc]
cmp eax, 0xffffffff
je 0x100422ba
mov ecx, dword [esi + 0x38]
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [esi + 0x40]
push eax
call dword [sym.imp.MSVCP140.dll_public:_int___thiscall_std::codecvt_char__char__struct__Mbstatet_::unshift_struct__Mbstatet___char___char___char___const]
sub eax, 0
je 0x10042281
sub eax, 1
je 0x10042285
sub eax, 2
jne 0x100422ba
mov byte [esi + 0x3d], al
mov al, 1
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100cb6f9
mov esp, ebp
pop ebp
ret
mov byte [esi + 0x3d], 0
mov edi, dword [ebp - 0x28]
lea eax, [ebp - 0x24]
sub edi, eax
je 0x100422a3
push dword [esi + 0x4c]
push edi
push 1
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
add esp, 0x10
cmp edi, eax
jne 0x100422ba
cmp byte [esi + 0x3d], 0
pop edi
sete al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100cb6f9
mov esp, ebp
pop ebp
ret
pop edi
xor al, al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100cb6f9
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
mov al, 1
xor ecx, ebp
pop esi
call fcn.100cb6f9
mov esp, ebp
pop ebp
ret
Function at 0x100445d0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
cmp byte [0x102cf48c], 0
push ebx
push esi
push edi
je 0x1004476d
mov ecx, dword [0x1044a844]
mov eax, dword [ecx]
mov eax, dword [eax + 0x68]
call eax
test al, al
je 0x1004476d
mov ecx, dword [0x1044a8cc]
xor ebx, ebx
mov dword [ebp - 4], ecx
mov eax, dword [ecx + 0x28]
mov dword [ebp - 8], eax
test eax, eax
je 0x1004476d
mov eax, dword [ecx + 0x1c]
mov ecx, dword [eax + ebx*4]
mov eax, dword [ecx]
mov eax, dword [eax + 0x30]
call eax
mov esi, eax
mov edi, 0x811c9dc5
xor ecx, ecx
nop word [eax + eax]
inc ecx
cmp byte [esi + ecx], 0
jne 0x10044630
xor edx, edx
test ecx, ecx
je 0x10044659
nop dword [eax]
movsx eax, byte [esi + edx]
inc edx
xor eax, edi
imul edi, eax, 0x1000193
cmp edx, ecx
jb 0x10044640
cmp edi, 0x5ff56dc5
je 0x10044668
inc ebx
cmp ebx, dword [ebp - 8]
jae 0x1004476d
mov ecx, dword [ebp - 4]
jmp 0x10044614
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x1c]
mov edi, dword [eax + ebx*4]
test edi, edi
je 0x1004476d
mov edx, dword [edi + 0x88]
test edx, edx
je 0x1004476d
vmovss xmm2, dword [0x100e5240]
vmovss xmm1, dword [0x100e53c0]
xor ebx, ebx
cmp edx, 4
jl 0x10044736
mov ecx, dword [edi + 0x7c]
lea esi, [edx - 4]
shr esi, 2
add ecx, 0x1078
inc esi
lea ebx, [esi*4]
nop dword [eax]
vmovss xmm0, dword [ecx - 0xc60]
vucomiss xmm0, xmm2
lahf
test ah, 0x44
jp 0x100446da
vmovss dword [ecx - 0xc60], xmm1
vmovss xmm0, dword [ecx - 0x840]
vucomiss xmm0, xmm2
lahf
test ah, 0x44
jp 0x100446f4
vmovss dword [ecx - 0x840], xmm1
vmovss xmm0, dword [ecx - 0x420]
vucomiss xmm0, xmm2
lahf
test ah, 0x44
jp 0x1004470e
vmovss dword [ecx - 0x420], xmm1
vmovss xmm0, dword [ecx]
vucomiss xmm0, xmm2
lahf
test ah, 0x44
jp 0x10044720
vmovss dword [ecx], xmm1
add ecx, 0x1080
sub esi, 1
jne 0x100446c0
cmp ebx, edx
jl 0x1004473a
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
test edx, edx
jle 0x1004476d
imul ecx, ebx, 0x420
add ecx, 0x418
add ecx, dword [edi + 0x7c]
sub edx, ebx
nop dword [eax + eax]
vmovss xmm0, dword [ecx]
vucomiss xmm0, xmm2
lahf
test ah, 0x44
jp 0x10044762
vmovss dword [ecx], xmm1
add ecx, 0x420
sub edx, 1
jne 0x10044750
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10046bc0
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100cdcb5
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push ebx
push esi
push edi
mov eax, dword [0x100f1040]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
movzx eax, byte [esi]
xor eax, 0x811c9dc5
imul ecx, eax, 0x1000193
movzx eax, byte [esi + 1]
xor ecx, eax
movzx eax, byte [esi + 2]
imul ecx, ecx, 0x1000193
xor ecx, eax
movzx eax, byte [esi + 3]
imul ecx, ecx, 0x1000193
xor ecx, eax
lea eax, [ebp - 0x18]
imul edi, ecx, 0x1000193
push edi
push esi
push eax
call fcn.10048420
mov eax, dword [ebp - 0x14]
test eax, eax
jne 0x10046d4a
cmp dword [0x1044e750], 0xfffffff
jne 0x10046c4a
push str.unordered_map_set_too_long
call dword [sym.imp.MSVCP140.dll_void___cdecl_std::_Xlength_error_char_const__]
mov dword [ebp - 0x20], 0x1044e74c
mov dword [ebp - 4], 0
push 0x10
mov dword [ebp - 0x1c], 0
call fcn.100cb715
mov ebx, eax
add esp, 4
mov eax, dword [esi]
mov dword [ebp - 0x1c], ebx
mov dword [ebx + 8], eax
mov dword [ebx + 0xc], 0
mov dword [ebp - 4], 1
mov eax, dword [0x1044e750]
mov esi, dword [0x1044e764]
inc eax
vmovss xmm1, dword [0x1044e748]
vxorps xmm0, xmm0, xmm0
vcvtsi2sd xmm0, xmm0, eax
shr eax, 0x1f
vaddsd xmm0, xmm0, qword [eax*8 + 0x100e5530]
vcvtsd2ss xmm2, xmm0, xmm0
vxorps xmm0, xmm0, xmm0
mov eax, esi
shr eax, 0x1f
vcvtsi2sd xmm0, xmm0, esi
vaddsd xmm0, xmm0, qword [eax*8 + 0x100e5530]
vcvtsd2ss xmm0, xmm0, xmm0
vdivss xmm0, xmm2, xmm0
vcomiss xmm0, xmm1
jbe 0x10046d3f
vdivss xmm0, xmm2, xmm1
vcvtss2sd xmm0, xmm0, xmm0
vmovsd qword [ebp - 0x18], xmm0
fld qword [ebp - 0x18]
vxorpd xmm0, xmm0, xmm0
fstp qword [ebp - 0x18]
vroundsd xmm0, xmm0, qword [ebp - 0x18], 2
vmovsd qword [ebp - 0x18], xmm0
fld qword [ebp - 0x18]
fstp qword [ebp - 0x18]
vmovsd xmm0, qword [ebp - 0x18]
vcvtpd2ps xmm0, xmm0
call fcn.100cc980
mov ecx, 8
cmp eax, ecx
cmova ecx, eax
cmp esi, ecx
jae 0x10046d27
cmp esi, 0x200
jae 0x10046d25
shl esi, 3
cmp esi, ecx
jae 0x10046d27
mov esi, ecx
push esi
call fcn.100481d0
push edi
lea eax, [ebx + 8]
push eax
lea eax, [ebp - 0x20]
push eax
call fcn.10048420
mov ecx, dword [eax]
jmp 0x10046d42
mov ecx, dword [ebp - 0x18]
push ebx
push ecx
push edi
call fcn.10048160
add eax, 0xc
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x10047200
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
sub esp, 0x18
mov edx, dword [ebp + 8]
push ebx
mov ebx, ecx
cmp edx, eax
je 0x10047356
mov eax, dword [ebx + 4]
mov dword [ebp - 0x14], eax
mov eax, dword [edx + 4]
mov dword [ebp - 8], eax
movzx eax, byte [edx + 8]
xor eax, 0x811c9dc5
imul ecx, eax, 0x1000193
movzx eax, byte [edx + 9]
push esi
push edi
mov edi, dword [ebx + 0xc]
mov esi, edx
xor ecx, eax
mov dword [ebp - 0x18], edi
movzx eax, byte [edx + 0xa]
imul ecx, ecx, 0x1000193
xor ecx, eax
movzx eax, byte [edx + 0xb]
imul ecx, ecx, 0x1000193
xor ecx, eax
mov eax, dword [ebx + 0x18]
imul ecx, ecx, 0x1000193
and eax, ecx
mov ecx, dword [edi + eax*8]
mov dword [ebp - 4], ecx
lea eax, [edi + eax*8]
mov dword [ebp - 0xc], eax
mov eax, dword [eax + 4]
mov dword [ebp - 0x10], eax
mov eax, esi
mov edi, esi
mov esi, dword [esi]
push 0x10
push eax
call fcn.100cbb79
dec dword [ebx + 8]
add esp, 8
cmp edi, dword [ebp - 0x10]
je 0x100472b9
mov eax, dword [ebp + 0xc]
cmp esi, eax
jne 0x10047277
mov ecx, dword [ebp - 4]
cmp ecx, dword [ebp + 8]
jne 0x1004734c
mov edx, dword [ebp - 0xc]
mov ecx, dword [ebp - 8]
pop edi
mov dword [edx], esi
mov dword [ecx], esi
mov dword [esi + 4], ecx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
mov ecx, dword [ebp - 4]
mov edx, dword [ebp - 0xc]
cmp ecx, dword [ebp + 8]
jne 0x100472cd
mov eax, dword [ebp - 0x14]
mov ecx, eax
mov dword [edx], eax
jmp 0x100472d0
mov ecx, dword [ebp - 8]
mov eax, dword [ebp + 0xc]
mov dword [edx + 4], ecx
cmp esi, eax
je 0x1004734c
nop word [eax + eax]
movzx eax, byte [esi + 8]
xor eax, 0x811c9dc5
imul ecx, eax, 0x1000193
movzx eax, byte [esi + 9]
xor ecx, eax
movzx eax, byte [esi + 0xa]
imul ecx, ecx, 0x1000193
xor ecx, eax
movzx eax, byte [esi + 0xb]
imul ecx, ecx, 0x1000193
xor ecx, eax
mov eax, dword [ebx + 0x18]
imul ecx, ecx, 0x1000193
and eax, ecx
mov ecx, dword [ebp - 0x18]
lea eax, [ecx + eax*8]
mov dword [ebp - 4], eax
mov eax, dword [eax + 4]
mov dword [ebp - 0x10], eax
mov eax, esi
mov edi, esi
mov esi, dword [esi]
push 0x10
push eax
call fcn.100cbb79
dec dword [ebx + 8]
add esp, 8
mov eax, dword [ebp + 0xc]
cmp edi, dword [ebp - 0x10]
je 0x1004735d
cmp esi, eax
jne 0x10047327
mov ecx, dword [ebp - 4]
mov dword [ecx], esi
mov ecx, dword [ebp - 8]
pop edi
mov dword [ecx], esi
mov dword [esi + 4], ecx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
mov ecx, dword [ebp - 4]
mov edx, dword [ebp - 0x14]
mov dword [ecx], edx
mov dword [ecx + 4], edx
cmp esi, eax
jne 0x100472e0
mov ecx, dword [ebp - 8]
pop edi
mov dword [ecx], esi
mov dword [esi + 4], ecx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8