joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10035b30
Capabilities:
Reference sql statements

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100771e5
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push ebx
push esi
push edi
mov eax, dword [0x100c0040]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, edx
mov edi, ecx
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x1c], 0
mov dword [ebp - 4], 0
push 0x208
push 0x40
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
push dword [ebp + 8]
mov ebx, eax
mov dword [ebp - 0x20], 0x104
push esi
push str.SELECT__Attributes__FROM__Control__WHERE__Dialog_____s_AND__Control____s
push 0x104
push ebx
mov dword [ebp - 0x1c], ebx
call fcn.1002e6f0
add esp, 0x14
mov dword [ebp - 0x10], 0
mov byte [ebp - 4], 1
mov eax, dword [ebp - 0x10]
test eax, eax
je 0x10035bba
push eax
call dword [sym.imp.msi.dll_MsiConfigureFeatureFromDescriptorA]
push edi
mov dword [ebp - 0x10], 0
call dword [sym.imp.msi.dll_MsiGetFeatureCostA]
mov esi, eax
mov dword [ebp - 0x18], esi
mov byte [ebp - 4], 2
test ebx, ebx
je 0x10035bfc
cmp word [ebx], 0
je 0x10035bfc
lea eax, [ebp - 0x10]
push eax
push ebx
push esi
call dword [sym.imp.msi.dll_MsiEnumClientsA]
test eax, eax
jle 0x10035bf5
movzx eax, ax
or eax, 0x80070000
test eax, eax
jns 0x10035c56
call fcn.10035290
mov byte [ebp - 4], 1
test esi, esi
je 0x10035c0b
push esi
call dword [sym.imp.msi.dll_MsiConfigureFeatureFromDescriptorA]
mov esi, SysReAllocString
mov byte [ebp - 4], 0
mov eax, dword [ebp - 0x10]
test eax, eax
je 0x10035c22
push eax
call dword [sym.imp.msi.dll_MsiConfigureFeatureFromDescriptorA]
mov dword [ebp - 4], 0xffffffff
test ebx, ebx
je 0x10035c34
push ebx
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov dword [ebp - 0x1c], 0
mov eax, esi
mov dword [ebp - 0x20], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 0
push dword [ebp - 0x10]
call dword [sym.imp.msi.dll_MsiViewModify]
mov edi, eax
test edi, edi
jle 0x10035c72
movzx edi, di
or edi, 0x80070000
test edi, edi
jns 0x10035c79
call fcn.10035290
mov byte [ebp - 4], 1
test esi, esi
je 0x10035c88
push esi
call dword [sym.imp.msi.dll_MsiConfigureFeatureFromDescriptorA]
test edi, edi
jne 0x10035c0b
mov dword [ebp - 0x14], edi
mov byte [ebp - 4], 3
mov eax, dword [ebp - 0x14]
test eax, eax
je 0x10035ca5
push eax
call dword [sym.imp.msi.dll_MsiConfigureFeatureFromDescriptorA]
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x14], 0
test eax, eax
je 0x10035cda
lea ecx, [ebp - 0x14]
push ecx
push eax
call dword [sym.imp.msi.dll_MsiDatabaseIsTablePersistentA]
test eax, eax
jle 0x10035ccc
movzx eax, ax
or eax, 0x80070000
test eax, eax
jns 0x10035cfa
cmp eax, 0x80070103
je 0x10035cda
call fcn.10035290
mov esi, SysReAllocString
mov byte [ebp - 4], 1
mov eax, dword [ebp - 0x14]
test eax, eax
je 0x10035c10
push eax
call dword [sym.imp.msi.dll_MsiConfigureFeatureFromDescriptorA]
jmp 0x10035c10
test eax, eax
jne 0x10035cda
push 1
push dword [ebp - 0x14]
call dword [sym.imp.msi.dll_MsiRecordReadStream]
mov esi, eax
jmp 0x10035cdf
Function at 0x10036690
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1007551d
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push esi
push edi
mov eax, dword [0x100c0040]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0
mov dword [ebp - 4], 0
lea eax, [ebp - 0x10]
push eax
push 0x100a416c
xor edi, edi
push str.MsiLogFileLocation
push dword [ebp + 8]
mov dword [ebp - 0x14], edi
mov dword [ebp - 0x18], edi
mov dword [ebp - 0x10], edi
call dword [sym.imp.msi.dll_MsiGetSummaryInformationW]
cmp eax, 0xea
jne 0x10036747
mov esi, dword [ebp - 0x10]
xor ecx, ecx
inc esi
mov edx, 2
mov eax, esi
mov dword [ebp - 0x10], esi
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
push 0x40
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov edi, eax
lea eax, [ebp - 0x10]
push eax
push edi
push str.MsiLogFileLocation
push dword [ebp + 8]
mov dword [ebp - 0x14], edi
mov dword [ebp - 0x18], esi
call dword [sym.imp.msi.dll_MsiGetSummaryInformationW]
test esi, esi
je 0x10036747
push 5
push 0
push 0
push edi
push 0
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
mov dword [ebp - 4], 0xffffffff
test edi, edi
je 0x10036759
push edi
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov dword [ebp - 0x14], 0
xor eax, eax
mov dword [ebp - 0x18], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x10038b10
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1007851d
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push ebx
push esi
push edi
mov eax, dword [0x100c0040]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov edx, dword [ebp + 0xc]
mov edi, edx
cmp dword [edx + 0x14], 7
mov eax, dword [edx + 0x10]
jbe 0x10038b4a
mov edi, dword [edx]
xor ecx, ecx
mov esi, 0x811c9dc5
add eax, eax
je 0x10038b6b
mov edx, eax
movzx eax, byte [edi + ecx]
inc ecx
xor eax, esi
imul esi, eax, 0x1000193
cmp ecx, edx
jb 0x10038b57
mov edx, dword [ebp + 0xc]
push esi
push edx
lea eax, [ebp - 0x14]
mov ecx, ebx
push eax
call fcn.10012af0
mov ecx, dword [ebp - 0x10]
test ecx, ecx
je 0x10038b9c
mov eax, dword [ebp + 8]
mov dword [eax], ecx
mov byte [eax + 4], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
cmp dword [ebx + 8], 0x7ffffff
je 0x10038ce9
lea eax, [ebx + 4]
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x1c], eax
mov dword [ebp - 4], 0
push 0x20
push 0x40
mov dword [ebp - 0x18], 0
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
push dword [ebp + 0xc]
mov edi, eax
mov dword [ebp - 0x18], edi
lea ecx, [edi + 8]
call fcn.100057f0
mov dword [ebp - 4], 1
mov ecx, dword [ebx + 8]
mov eax, dword [ebx + 0x1c]
inc ecx
movss xmm3, dword [ebx]
movd xmm0, ecx
cvtdq2pd xmm0, xmm0
shr ecx, 0x1f
movd xmm1, eax
addsd xmm0, qword [ecx*8 + 0x100adcb0]
cvtdq2pd xmm1, xmm1
shr eax, 0x1f
cvtpd2ps xmm0, xmm0
addsd xmm1, qword [eax*8 + 0x100adcb0]
movaps xmm2, xmm0
cvtpd2ps xmm1, xmm1
divss xmm2, xmm1
comiss xmm2, xmm3
jbe 0x10038c7d
divss xmm0, xmm3
call fcn.10013920
call fcn.1006dc90
mov ecx, 8
cmp eax, ecx
cmova ecx, eax
mov eax, dword [ebx + 0x1c]
cmp eax, ecx
jae 0x10038c5b
cmp eax, 0x200
jae 0x10038c59
shl eax, 3
cmp eax, ecx
jae 0x10038c5b
mov eax, ecx
push eax
mov ecx, ebx
call fcn.10038d80
push esi
lea eax, [edi + 8]
mov ecx, ebx
push eax
lea eax, [ebp - 0x14]
push eax
call fcn.10012af0
mov edx, dword [eax]
mov eax, dword [eax + 4]
mov dword [ebp - 0x10], eax
jmp 0x10038c80
mov edx, dword [ebp - 0x14]
mov eax, dword [edx + 4]
inc dword [ebx + 8]
mov dword [edi + 4], eax
mov dword [edi], edx
mov dword [eax], edi
mov dword [edx + 4], edi
mov ecx, dword [ebx + 0xc]
mov dword [ebp - 0x10], eax
mov eax, dword [ebx + 0x18]
and eax, esi
mov dword [ebp - 0x18], 0
mov esi, dword [ecx + eax*8]
cmp esi, dword [ebx + 4]
jne 0x10038caf
mov dword [ecx + eax*8], edi
jmp 0x10038cc1
cmp esi, edx
jne 0x10038cb8
mov dword [ecx + eax*8], edi
jmp 0x10038cc5
mov edx, dword [ebp - 0x10]
cmp dword [ecx + eax*8 + 4], edx
jne 0x10038cc5
mov dword [ecx + eax*8 + 4], edi
mov eax, dword [ebp + 8]
mov dword [eax], edi
mov byte [eax + 4], 1
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
push str.unordered_map_set_too_long
call fcn.10052dba
int3
Function at 0x10039530
Capabilities:
Get process heap flags

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100786b3
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push esi
mov eax, dword [0x100c0040]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
mov eax, dword [ebp + 8]
xorps xmm0, xmm0
movups xmmword [esi], xmm0
mov dword [esi + 0x10], 0
xor ecx, ecx
mov dword [esi + 0x14], 0
movups xmm0, xmmword [eax]
movups xmmword [esi], xmm0
movq xmm0, qword [eax + 0x10]
movq qword [esi + 0x10], xmm0
mov dword [eax + 0x10], 0
mov dword [eax + 0x14], 7
mov word [eax], cx
mov dword [ebp - 4], ecx
lea ecx, [esi + 0x18]
mov dword [ebp - 0x14], ecx
mov byte [ecx + 0x18], 0xff
mov byte [ebp - 4], 2
movsx edx, byte [eax + 0x30]
inc edx
sub edx, 0
je 0x10039605
sub edx, 1
je 0x100395c2
movups xmm0, xmmword [eax + 0x18]
movups xmmword [ecx], xmm0
mov byte [ecx + 0x18], 1
jmp 0x10039605
xorps xmm0, xmm0
mov dword [ebp - 0x18], ecx
movups xmmword [ecx], xmm0
mov dword [ecx + 0x10], 0
xor edx, edx
mov dword [ecx + 0x14], 0
movups xmm0, xmmword [eax + 0x18]
movups xmmword [ecx], xmm0
movq xmm0, qword [eax + 0x28]
movq qword [ecx + 0x10], xmm0
mov dword [eax + 0x28], 0
mov dword [eax + 0x2c], 7
mov word [eax + 0x18], dx
mov byte [ebp - 4], 2
mov byte [ecx + 0x18], dl
mov byte [ebp - 4], 8
lea ecx, [esi + 0x34]
mov dword [ebp - 0x18], ecx
mov byte [ecx + 0x18], 0xff
mov byte [ebp - 4], 0xa
movsx edx, byte [eax + 0x4c]
inc edx
sub edx, 0
je 0x10039676
sub edx, 1
je 0x10039633
movups xmm0, xmmword [eax + 0x34]
movups xmmword [ecx], xmm0
mov byte [ecx + 0x18], 1
jmp 0x10039676
xorps xmm0, xmm0
mov dword [ebp - 0x14], ecx
movups xmmword [ecx], xmm0
mov dword [ecx + 0x10], 0
xor edx, edx
mov dword [ecx + 0x14], 0
movups xmm0, xmmword [eax + 0x34]
movups xmmword [ecx], xmm0
movq xmm0, qword [eax + 0x44]
movq qword [ecx + 0x10], xmm0
mov dword [eax + 0x44], 0
mov dword [eax + 0x48], 7
mov word [eax + 0x34], dx
mov byte [ebp - 4], 0xa
mov byte [ecx + 0x18], dl
mov dword [ebp - 4], 0xffffffff
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x1003b5c0
Capabilities:
Delete directory

Disassembly:
sub esp, 0xd0
mov eax, dword [0x100c0040]
xor eax, esp
mov dword [esp + 0xcc], eax
lea eax, [esp]
mov dword [esp], 0x64
push eax
lea eax, [esp + 8]
push eax
push 0x100a6c10
push dword [esp + 0xe0]
call dword [sym.imp.msi.dll_MsiGetSummaryInformationW]
test eax, eax
jne 0x1003b605
lea eax, [esp + 4]
push eax
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
mov ecx, dword [esp + 0xcc]
xor eax, eax
xor ecx, esp
call fcn.10053e7d
add esp, 0xd0
ret 4
Function at 0x1003b620
Capabilities:
Enumerate files on windows

Disassembly:
push ebp
lea ebp, [esp - 0x6e4]
sub esp, 0x6e4
push 0xffffffffffffffff
push 0x1007894d
mov eax, dword fs:[0]
push eax
sub esp, 0xc
mov eax, dword [0x100c0040]
xor eax, ebp
mov dword [ebp + 0x6e0], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, dword [ebp + 0x6ec]
push ebx
call dword [sym.imp.msi.dll_MsiGetFeatureCostA]
mov dword [ebp - 0x18], eax
mov dword [ebp - 4], 0
test eax, eax
jne 0x1003b67e
mov esi, 0x643
jmp 0x1003b816
push str.AI_SH_DIR
mov edx, str.ComboBox
mov ecx, ebx
call fcn.100347d0
add esp, 4
mov dword [ebp - 0x10], 0x104
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp + 0x458]
push eax
push str.ProgramMenuFolder
push ebx
call dword [sym.imp.msi.dll_MsiGetSummaryInformationW]
test eax, eax
jne 0x1003b814
lea eax, [ebp - 0x10]
mov dword [ebp - 0x10], 0x40
push eax
lea eax, [ebp + 0x660]
push eax
push 0x100a9b0c
push ebx
call dword [sym.imp.msi.dll_MsiGetSummaryInformationW]
test eax, eax
jne 0x1003b814
xor ecx, ecx
lea eax, [ebp + 0x458]
cmp word [ebp + 0x458], cx
je 0x1003b6fa
nop
lea eax, [eax + 2]
inc ecx
cmp word [eax], 0
jne 0x1003b6f0
lea eax, [ebp + 0x458]
mov edx, 0x100a6a3c
lea eax, [eax + ecx*2]
mov ecx, 0x2a
sub edx, eax
nop
mov word [eax], cx
lea eax, [eax + 2]
movzx ecx, word [edx + eax]
test cx, cx
jne 0x1003b710
xor ecx, ecx
push 0x250
mov word [eax], cx
lea eax, [ebp]
push ecx
push eax
call fcn.10055bd0
add esp, 0xc
lea eax, [ebp]
push eax
lea eax, [ebp + 0x458]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov edi, eax
mov dword [ebp - 0x14], edi
cmp edi, 0xffffffff
je 0x1003b814
lea eax, [ebp]
mov esi, 2
push eax
push edi
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test byte [ebp], 0x10
je 0x1003b7f9
mov cx, word [ebp + 0x2c]
cmp cx, 0x2e
jne 0x1003b78e
mov ax, word [ebp + 0x2e]
test ax, ax
je 0x1003b7f9
cmp ax, cx
jne 0x1003b78e
cmp word [ebp + 0x30], 0
je 0x1003b7f9
lea eax, [ebp + 0x250]
test cx, cx
je 0x1003b7b5
mov edi, eax
movzx ecx, cx
lea edx, [ebp + 0x2c]
sub edx, edi
mov edi, dword [ebp - 0x14]
mov word [eax], cx
add eax, 2
movzx ecx, word [edx + eax]
test cx, cx
jne 0x1003b7a6
xor ecx, ecx
mov word [eax], cx
lea eax, [ebp + 0x660]
push eax
lea eax, [ebp + 0x250]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x1003b7f9
push 0x100a416c
lea eax, [ebp + 0x250]
mov edx, ebx
push eax
push eax
push esi
push str.AI_SH_DIR
mov ecx, str.ComboBox
call fcn.100342a0
add esp, 0x14
test eax, eax
je 0x1003b7f9
inc esi
lea eax, [ebp]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
cmp eax, 1
je 0x1003b765
push edi
call dword [sym.imp.KERNEL32.dll_FindClose]
xor esi, esi
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x18]
test eax, eax
je 0x1003b82b
push eax
call dword [sym.imp.msi.dll_MsiConfigureFeatureFromDescriptorA]
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x6e0]
xor ecx, ebp
call fcn.10053e7d
lea esp, [ebp + 0x6e4]
pop ebp
ret 4
Function at 0x1003de30
Capabilities:
Get disk size

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10078da5
mov eax, dword fs:[0]
push eax
sub esp, 0x20
push ebx
push esi
push edi
mov eax, dword [0x100c0040]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x2c], 0
mov dword [ebp - 0x28], 0
mov dword [ebp - 4], 0
lea eax, [ebp - 0x10]
mov ebx, dword [ebp + 8]
xor edi, edi
push eax
push 0x100a416c
mov dword [ebp - 0x28], edi
xor esi, esi
push 0x100a6c10
mov dword [ebp - 0x2c], esi
push ebx
mov dword [ebp - 0x10], esi
call dword [sym.imp.msi.dll_MsiGetSummaryInformationW]
cmp eax, 0xea
jne 0x1003ded4
mov esi, dword [ebp - 0x10]
xor ecx, ecx
inc esi
mov edx, 2
mov eax, esi
mov dword [ebp - 0x10], esi
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
push 0x40
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov edi, eax
lea eax, [ebp - 0x10]
push eax
push edi
push 0x100a6c10
mov dword [ebp - 0x28], edi
push ebx
mov dword [ebp - 0x2c], esi
call dword [sym.imp.msi.dll_MsiGetSummaryInformationW]
test esi, esi
je 0x1003df9f
cmp esi, 2
jne 0x1003deec
mov eax, 0x3a
mov word [edi + 2], ax
jmp 0x1003def1
cmp esi, 3
jne 0x1003defa
mov eax, 0x5c
mov word [edi + 4], ax
lea eax, [ebp - 0x24]
mov dword [ebp - 0x1c], 0
push eax
lea eax, [ebp - 0x20]
mov dword [ebp - 0x18], 0
push eax
lea eax, [ebp - 0x18]
mov dword [ebp - 0x20], 0
push eax
lea eax, [ebp - 0x1c]
mov dword [ebp - 0x24], 0
push eax
push edi
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceW]
test eax, eax
je 0x1003df9f
mov esi, dword [ebp - 0x18]
imul esi, dword [ebp - 0x1c]
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x10], 0
shr esi, 0xa
imul esi, dword [ebp - 0x20]
shr esi, 0xa
mov byte [ebp - 4], 1
push 0x16
push 0x40
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov ebx, eax
mov dword [ebp - 0x14], 0xb
mov edx, ebx
mov dword [ebp - 0x10], ebx
mov ecx, esi
call fcn.1002e8f0
push ebx
push str.AI_FREE_DISK_SPACE
push dword [ebp + 8]
call dword [sym.imp.msi.dll_MsiSummaryInfoGetPropertyCount]
mov byte [ebp - 4], 0
test ebx, ebx
je 0x1003df91
push ebx
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov dword [ebp - 0x10], 0
mov dword [ebp - 0x14], 0
mov dword [ebp - 4], 0xffffffff
test edi, edi
je 0x1003dfb1
push edi
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov dword [ebp - 0x28], 0
xor eax, eax
mov dword [ebp - 0x2c], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x1003e290
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10079024
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push ebx
push esi
push edi
mov eax, dword [0x100c0040]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, edx
mov ebx, ecx
mov dword [ebp - 0x18], ebx
mov edx, dword [ebp + 8]
mov eax, edx
shr eax, 8
movzx esi, al
movzx eax, dl
xor eax, 0x811c9dc5
mov dword [ebp - 0x10], 0
imul eax, eax, 0x1000193
mov dword [ebp - 0x14], edx
xor esi, eax
mov eax, edx
shr eax, 0x10
movzx eax, al
imul ecx, esi, 0x1000193
xor ecx, eax
mov eax, edx
imul ecx, ecx, 0x1000193
shr eax, 0x18
xor ecx, eax
imul eax, ecx, 0x1000193
push eax
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x20]
push eax
call fcn.10040ad0
mov eax, dword [eax + 4]
test eax, eax
je 0x1003e3b2
cmp eax, dword [0x100c1fe8]
je 0x1003e3b2
push dword [eax + 0x10]
mov edx, edi
lea ecx, [ebp - 0x14]
push dword [eax + 0x14]
call fcn.1003e070
add esp, 8
mov dword [ebp - 4], 1
lea esi, [ebx + 4]
mov dword [ebp - 0x1c], esi
mov ecx, dword [eax]
sub ecx, 0x10
call fcn.1000a470
add eax, 0x10
mov dword [esi], eax
mov byte [ebp - 4], 3
mov eax, dword [ebp + 8]
mov dword [ebx + 8], eax
mov byte [ebp - 4], 1
mov dword [ebp - 0x10], 1
mov dword [ebp - 4], 0
or eax, 0xffffffff
mov ecx, dword [ebp - 0x14]
add ecx, 0xfffffff0
lock xadd dword [ecx + 0xc], eax
dec eax
test eax, eax
jg 0x1003e3fc
mov edi, dword [ecx]
push ecx
mov eax, dword [edi]
mov esi, dword [eax + 4]
mov ecx, esi
call dword [0x1007d584]
mov ecx, edi
call esi
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea eax, [ebx + 4]
mov dword [ebx], 0
mov dword [ebp - 0x1c], eax
call fcn.1000a960
mov edi, eax
test edi, edi
je 0x1003e410
mov eax, dword [edi]
mov esi, dword [eax + 0xc]
mov ecx, esi
call dword [0x1007d584]
mov ecx, edi
call esi
add eax, 0x10
mov dword [ebx + 4], eax
mov dword [ebp - 4], 6
mov dword [ebx + 8], 0
mov dword [ebp - 4], 0
mov dword [ebp - 0x10], 1
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 0x80004005
call fcn.10005390
int3
Function at 0x100403e0
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1007957d
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push ebx
push esi
push edi
mov eax, dword [0x100c0040]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, dword [ebp + 0xc]
movzx eax, byte [edi]
xor eax, 0x811c9dc5
imul ecx, eax, 0x1000193
movzx eax, byte [edi + 1]
xor ecx, eax
movzx eax, byte [edi + 2]
imul ecx, ecx, 0x1000193
xor ecx, eax
movzx eax, byte [edi + 3]
imul ecx, ecx, 0x1000193
xor ecx, eax
lea eax, [ebp - 0x1c]
imul ebx, ecx, 0x1000193
push ebx
push edi
push eax
call fcn.10040ad0
mov ecx, dword [ebp - 0x18]
test ecx, ecx
je 0x1004046c
mov eax, dword [ebp + 8]
mov dword [eax], ecx
mov byte [eax + 4], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
cmp dword [0x100c1fec], 0xaaaaaaa
je 0x100405da
mov dword [ebp - 0x14], 0x100c1fe8
mov dword [ebp - 0x10], 0
mov dword [ebp - 4], 0
push 0x18
push 0x40
mov dword [ebp - 0x10], 0
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov ecx, dword [edi]
mov esi, eax
mov dword [ebp - 0x10], esi
mov dword [esi + 8], ecx
mov ecx, dword [edi + 4]
mov dword [esi + 0xc], ecx
mov eax, dword [edi + 8]
mov dword [esi + 0x10], eax
mov eax, dword [edi + 0xc]
mov dword [esi + 0x14], eax
mov dword [ebp - 4], 1
mov ecx, dword [0x100c1fec]
mov edi, dword [0x100c2000]
lea eax, [ecx + 1]
movd xmm0, eax
cvtdq2pd xmm0, xmm0
shr eax, 0x1f
addsd xmm0, qword [eax*8 + 0x100adcb0]
mov eax, edi
shr eax, 0x1f
cvtpd2ps xmm3, xmm0
movd xmm0, edi
cvtdq2pd xmm0, xmm0
movaps xmm2, xmm3
addsd xmm0, qword [eax*8 + 0x100adcb0]
cvtpd2ps xmm1, xmm0
movss xmm0, dword [0x100c1fe4]
divss xmm2, xmm1
comiss xmm2, xmm0
jbe 0x10040568
divss xmm3, xmm0
movaps xmm0, xmm3
call fcn.10013920
call fcn.1006dc90
mov ecx, 8
cmp eax, ecx
cmova ecx, eax
cmp edi, ecx
jae 0x1004054a
cmp edi, 0x200
jae 0x10040548
shl edi, 3
cmp edi, ecx
jae 0x1004054a
mov edi, ecx
push edi
call fcn.10040670
push ebx
lea eax, [esi + 8]
push eax
lea eax, [ebp - 0x1c]
push eax
call fcn.10040ad0
mov ecx, dword [0x100c1fec]
mov edx, dword [eax]
jmp 0x1004056b
mov edx, dword [ebp - 0x1c]
mov edi, dword [edx + 4]
inc ecx
mov dword [0x100c1fec], ecx
mov dword [esi], edx
mov dword [esi + 4], edi
mov dword [edi], esi
mov dword [edx + 4], esi
mov eax, dword [0x100c1ffc]
mov ecx, dword [0x100c1ff0]
and eax, ebx
mov dword [ebp - 0x10], 0
mov ebx, dword [ecx + eax*8]
cmp ebx, dword [0x100c1fe8]
jne 0x100405a3
mov dword [ecx + eax*8], esi
jmp 0x100405b2
cmp ebx, edx
jne 0x100405ac
mov dword [ecx + eax*8], esi
jmp 0x100405b6
cmp dword [ecx + eax*8 + 4], edi
jne 0x100405b6
mov dword [ecx + eax*8 + 4], esi
mov eax, dword [ebp + 8]
mov dword [eax], esi
mov byte [eax + 4], 1
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
push str.unordered_map_set_too_long
call fcn.10052dba
int3
Function at 0x10040670
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100795ad
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push ebx
push esi
push edi
mov eax, dword [0x100c0040]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, 0x1fffffff
mov edi, 1
bsr ecx, eax
mov eax, edi
shl eax, cl
mov ecx, dword [ebp + 8]
cmp ecx, eax
ja 0x10040810
lea eax, [ecx - 1]
mov esi, dword [0x100c1fe8]
or eax, edi
bsr ecx, eax
push esi
lea ecx, [ecx + 1]
shl edi, cl
mov ecx, 0x100c1ff0
lea eax, [edi + edi]
push eax
call fcn.10010660
lea eax, [edi - 1]
mov dword [0x100c2000], edi
mov dword [0x100c1ffc], eax
mov dword [ebp - 0x18], 0x100c1fe4
mov dword [ebp - 4], 0
mov ecx, dword [0x100c1fe8]
mov ecx, dword [ecx]
mov edx, ecx
cmp ecx, esi
je 0x100407cc
movzx eax, byte [ecx + 8]
xor eax, 0x811c9dc5
mov edx, dword [edx]
imul edi, eax, 0x1000193
movzx eax, byte [ecx + 9]
xor edi, eax
movzx eax, byte [ecx + 0xa]
imul edi, edi, 0x1000193
xor edi, eax
movzx eax, byte [ecx + 0xb]
imul edi, edi, 0x1000193
xor edi, eax
mov eax, dword [0x100c1ff0]
imul edi, edi, 0x1000193
and edi, dword [0x100c1ffc]
mov ebx, dword [eax + edi*8]
lea eax, [eax + edi*8]
mov dword [ebp - 0x10], eax
cmp ebx, esi
jne 0x10040758
mov dword [eax], ecx
mov dword [eax + 4], ecx
jmp 0x100407c2
mov eax, dword [eax + 4]
mov edi, dword [ecx + 8]
cmp edi, dword [eax + 8]
jne 0x1004078f
mov eax, dword [eax]
cmp eax, ecx
je 0x10040787
mov ebx, dword [ecx + 4]
mov dword [ebp - 0x14], ebx
mov dword [ebx], edx
mov ebx, dword [edx + 4]
mov dword [ebx], eax
mov edi, dword [eax + 4]
mov dword [edi], ecx
mov dword [eax + 4], ebx
mov eax, dword [ebp - 0x14]
mov dword [edx + 4], eax
mov dword [ecx + 4], edi
mov eax, dword [ebp - 0x10]
mov dword [eax + 4], ecx
jmp 0x100407c2
cmp ebx, eax
je 0x1004079f
mov eax, dword [eax + 4]
cmp edi, dword [eax + 8]
je 0x100407ee
cmp ebx, eax
jne 0x10040793
mov ebx, dword [ecx + 4]
mov dword [ebp - 0x14], ebx
mov dword [ebx], edx
mov ebx, dword [edx + 4]
mov dword [ebx], eax
mov edi, dword [eax + 4]
mov dword [edi], ecx
mov dword [eax + 4], ebx
mov eax, dword [ebp - 0x14]
mov dword [edx + 4], eax
mov eax, dword [ebp - 0x10]
mov dword [ecx + 4], edi
mov dword [eax], ecx
mov ecx, edx
cmp edx, esi
jne 0x10040704
mov dword [ebp - 0x18], 0
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
mov ebx, dword [ecx + 4]
mov eax, dword [eax]
mov dword [ebp - 0x14], ebx
mov dword [ebx], edx
mov ebx, dword [edx + 4]
mov dword [ebx], eax
mov edi, dword [eax + 4]
mov dword [edi], ecx
mov dword [eax + 4], ebx
mov eax, dword [ebp - 0x14]
mov dword [edx + 4], eax
mov dword [ecx + 4], edi
jmp 0x100407c2
push str.invalid_hash_bucket_count
call fcn.10052dba
int3