joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10140960
Capabilities:
Hash data using fnv

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10164f65
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ebx
sub esp, 0x18
push esi
push edi
mov edi, dword [ebx + 0xc]
movzx eax, byte [edi]
xor eax, 0x811c9dc5
imul ecx, eax, 0x1000193
movzx eax, byte [edi + 1]
xor ecx, eax
movzx eax, byte [edi + 2]
imul ecx, ecx, 0x1000193
xor ecx, eax
movzx eax, byte [edi + 3]
imul ecx, ecx, 0x1000193
xor ecx, eax
imul eax, ecx, 0x1000193
push eax
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x1c]
push edi
push eax
call fcn.10141080
mov ecx, dword [ebp - 0x18]
test ecx, ecx
je 0x101409e9
mov eax, dword [ebx + 8]
mov dword [eax], ecx
mov byte [eax + 4], 0
jmp 0x10140b33
cmp dword [0x1028b31c], 0x9249249
jne 0x10140a00
push str.unordered_map_set_too_long
call dword [sym.imp.MSVCP140.dll_void___cdecl_std::_Xlength_error_char_const__]
mov dword [ebp - 0x24], 0x1028b318
mov dword [ebp - 4], 0
push 0x1c
mov dword [ebp - 0x20], 0
call fcn.1015b6a6
mov ecx, dword [edi]
mov esi, eax
vpxor xmm0, xmm0, xmm0
add esp, 4
mov dword [ebp - 0x20], esi
mov dword [esi + 8], ecx
vmovdqu xmmword [esi + 0xc], xmm0
vmovups xmmword [esi + 0xc], xmm0
mov dword [ebp - 4], 1
mov ecx, dword [0x1028b31c]
mov edi, dword [0x1028b330]
vmovss xmm1, dword [0x1028b314]
vxorps xmm0, xmm0, xmm0
lea eax, [ecx + 1]
vcvtsi2sd xmm0, xmm0, eax
shr eax, 0x1f
vaddsd xmm0, xmm0, qword [eax*8 + 0x10279850]
vcvtsd2ss xmm2, xmm0, xmm0
vxorps xmm0, xmm0, xmm0
mov eax, edi
shr eax, 0x1f
vcvtsi2sd xmm0, xmm0, edi
vaddsd xmm0, xmm0, qword [eax*8 + 0x10279850]
vcvtsd2ss xmm0, xmm0, xmm0
vdivss xmm0, xmm2, xmm0
vcomiss xmm0, xmm1
jbe 0x10140ade
vdivss xmm0, xmm2, xmm1
call fcn.1005c280
call fcn.1015d610
mov ecx, 8
cmp eax, ecx
cmova ecx, eax
cmp edi, ecx
jae 0x10140abe
cmp edi, 0x200
jae 0x10140abc
shl edi, 3
cmp edi, ecx
jae 0x10140abe
mov edi, ecx
push edi
call fcn.10140b70
push dword [ebp - 0x14]
lea eax, [esi + 8]
push eax
lea eax, [ebp - 0x1c]
push eax
call fcn.10141080
mov ecx, dword [0x1028b31c]
mov edx, dword [eax]
jmp 0x10140ae1
mov edx, dword [ebp - 0x1c]
mov edi, dword [edx + 4]
inc ecx
mov dword [0x1028b31c], ecx
mov dword [esi], edx
mov dword [esi + 4], edi
mov dword [edi], esi
mov dword [edx + 4], esi
mov eax, dword [0x1028b32c]
and eax, dword [ebp - 0x14]
mov ecx, dword [0x1028b320]
mov esi, dword [ecx + eax*8]
cmp esi, dword [0x1028b318]
mov esi, dword [ebp - 0x20]
jne 0x10140b16
mov dword [ecx + eax*8], esi
jmp 0x10140b26
cmp dword [ecx + eax*8], edx
jne 0x10140b20
mov dword [ecx + eax*8], esi
jmp 0x10140b2a
cmp dword [ecx + eax*8 + 4], edi
jne 0x10140b2a
mov dword [ecx + eax*8 + 4], esi
mov eax, dword [ebx + 8]
mov dword [eax], esi
mov byte [eax + 4], 1
mov ecx, dword [ebp - 0xc]
pop edi
mov dword fs:[0], ecx
pop esi
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret 8
Function at 0x10140d80
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
sub esp, 0x18
mov edx, dword [ebp + 8]
push ebx
mov ebx, ecx
cmp edx, eax
je 0x10140ed6
mov eax, dword [ebx + 4]
mov dword [ebp - 0x10], eax
mov eax, dword [edx + 4]
mov dword [ebp - 4], eax
movzx eax, byte [edx + 8]
xor eax, 0x811c9dc5
imul ecx, eax, 0x1000193
movzx eax, byte [edx + 9]
push esi
push edi
mov edi, dword [ebx + 0xc]
mov esi, edx
xor ecx, eax
mov dword [ebp - 0x18], edi
movzx eax, byte [edx + 0xa]
imul ecx, ecx, 0x1000193
xor ecx, eax
movzx eax, byte [edx + 0xb]
imul ecx, ecx, 0x1000193
xor ecx, eax
mov eax, dword [ebx + 0x18]
imul ecx, ecx, 0x1000193
and eax, ecx
mov ecx, dword [edi + eax*8]
mov dword [ebp - 0xc], ecx
lea eax, [edi + eax*8]
mov dword [ebp - 8], eax
mov eax, dword [eax + 4]
mov dword [ebp - 0x14], eax
mov eax, esi
mov edi, esi
mov esi, dword [esi]
push 0x1c
push eax
call fcn.1015b698
dec dword [ebx + 8]
add esp, 8
cmp edi, dword [ebp - 0x14]
je 0x10140e39
mov eax, dword [ebp + 0xc]
cmp esi, eax
jne 0x10140df7
mov ecx, dword [ebp - 0xc]
cmp ecx, dword [ebp + 8]
jne 0x10140ecc
mov edx, dword [ebp - 8]
mov ecx, dword [ebp - 4]
pop edi
mov dword [edx], esi
mov dword [ecx], esi
mov dword [esi + 4], ecx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
mov ecx, dword [ebp - 0xc]
mov edx, dword [ebp - 8]
cmp ecx, dword [ebp + 8]
jne 0x10140e4d
mov eax, dword [ebp - 0x10]
mov ecx, eax
mov dword [edx], eax
jmp 0x10140e50
mov ecx, dword [ebp - 4]
mov eax, dword [ebp + 0xc]
mov dword [edx + 4], ecx
cmp esi, eax
je 0x10140ecc
nop word [eax + eax]
movzx eax, byte [esi + 8]
xor eax, 0x811c9dc5
imul ecx, eax, 0x1000193
movzx eax, byte [esi + 9]
xor ecx, eax
movzx eax, byte [esi + 0xa]
imul ecx, ecx, 0x1000193
xor ecx, eax
movzx eax, byte [esi + 0xb]
imul ecx, ecx, 0x1000193
xor ecx, eax
mov eax, dword [ebx + 0x18]
imul ecx, ecx, 0x1000193
and eax, ecx
mov ecx, dword [ebp - 0x18]
lea eax, [ecx + eax*8]
mov dword [ebp + 8], eax
mov eax, dword [eax + 4]
mov dword [ebp - 0x14], eax
mov eax, esi
mov edi, esi
mov esi, dword [esi]
push 0x1c
push eax
call fcn.1015b698
dec dword [ebx + 8]
add esp, 8
mov eax, dword [ebp + 0xc]
cmp edi, dword [ebp - 0x14]
je 0x10140edd
cmp esi, eax
jne 0x10140ea7
mov ecx, dword [ebp + 8]
mov dword [ecx], esi
mov ecx, dword [ebp - 4]
pop edi
mov dword [ecx], esi
mov dword [esi + 4], ecx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
mov ecx, dword [ebp + 8]
mov edx, dword [ebp - 0x10]
mov dword [ecx], edx
mov dword [ecx + 4], edx
cmp esi, eax
jne 0x10140e60
mov ecx, dword [ebp - 4]
pop edi
mov dword [ecx], esi
mov dword [esi + 4], ecx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x10142270
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10165095
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x10
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
movzx eax, byte [edi]
xor eax, 0x811c9dc5
imul ecx, eax, 0x1000193
movzx eax, byte [edi + 1]
xor ecx, eax
movzx eax, byte [edi + 2]
imul ecx, ecx, 0x1000193
xor ecx, eax
movzx eax, byte [edi + 3]
imul ecx, ecx, 0x1000193
xor ecx, eax
lea eax, [ebp - 0x14]
imul ebx, ecx, 0x1000193
push ebx
push edi
push eax
call fcn.101425f0
mov ecx, dword [ebp - 0x10]
test ecx, ecx
je 0x101422f1
mov eax, dword [ebp + 8]
mov dword [eax], ecx
mov byte [eax + 4], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
cmp dword [0x1028a744], 0x7ffffff
jne 0x10142308
push str.unordered_map_set_too_long
call dword [sym.imp.MSVCP140.dll_void___cdecl_std::_Xlength_error_char_const__]
mov dword [ebp - 0x1c], 0x1028a740
mov dword [ebp - 4], 0
push 0x20
mov dword [ebp - 0x18], 0
call fcn.1015b6a6
mov ecx, dword [edi]
mov esi, eax
mov dword [ebp - 0x18], esi
add esp, 4
vxorps xmm0, xmm0, xmm0
mov dword [esi + 8], ecx
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
mov dword [esi + 0x18], 0
mov dword [esi + 0x1c], 0
vmovss dword [esi + 0x14], xmm0
vmovss dword [esi + 0x10], xmm0
vmovss dword [esi + 0xc], xmm0
mov dword [ebp - 4], 1
mov ecx, dword [0x1028a744]
mov edi, dword [0x1028a758]
vmovss xmm1, dword [0x1028a73c]
vxorps xmm0, xmm0, xmm0
lea eax, [ecx + 1]
vcvtsi2sd xmm0, xmm0, eax
shr eax, 0x1f
vaddsd xmm0, xmm0, qword [eax*8 + 0x10279850]
vcvtsd2ss xmm2, xmm0, xmm0
vxorps xmm0, xmm0, xmm0
mov eax, edi
shr eax, 0x1f
vcvtsi2sd xmm0, xmm0, edi
vaddsd xmm0, xmm0, qword [eax*8 + 0x10279850]
vcvtsd2ss xmm0, xmm0, xmm0
vdivss xmm0, xmm2, xmm0
vcomiss xmm0, xmm1
jbe 0x10142405
vdivss xmm0, xmm2, xmm1
call fcn.1005c280
call fcn.1015d610
mov ecx, 8
cmp eax, ecx
cmova ecx, eax
cmp edi, ecx
jae 0x101423e7
cmp edi, 0x200
jae 0x101423e5
shl edi, 3
cmp edi, ecx
jae 0x101423e7
mov edi, ecx
push edi
call fcn.10142470
push ebx
lea eax, [esi + 8]
push eax
lea eax, [ebp - 0x1c]
push eax
call fcn.101425f0
mov ecx, dword [0x1028a744]
mov edx, dword [eax]
jmp 0x10142408
mov edx, dword [ebp - 0x14]
mov edi, dword [edx + 4]
inc ecx
mov dword [0x1028a744], ecx
mov dword [esi], edx
mov dword [esi + 4], edi
mov dword [edi], esi
mov dword [edx + 4], esi
mov eax, dword [0x1028a754]
mov ecx, dword [0x1028a748]
and eax, ebx
mov ebx, dword [ecx + eax*8]
cmp ebx, dword [0x1028a740]
jne 0x10142439
mov dword [ecx + eax*8], esi
jmp 0x10142448
cmp ebx, edx
jne 0x10142442
mov dword [ecx + eax*8], esi
jmp 0x1014244c
cmp dword [ecx + eax*8 + 4], edi
jne 0x1014244c
mov dword [ecx + eax*8 + 4], esi
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
pop edi
mov dword [eax], esi
pop esi
mov byte [eax + 4], 1
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x10147a90
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov ebx, ecx
mov edx, ebx
push esi
push edi
mov edi, 0x811c9dc5
xor esi, esi
lea ecx, [edx + 1]
mov al, byte [edx]
inc edx
test al, al
jne 0x10147aa5
sub edx, ecx
je 0x10147acf
movsx eax, byte [esi + ebx]
mov ecx, ebx
xor eax, edi
imul edi, eax, 0x1000193
inc esi
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x10147ac2
sub ecx, edx
cmp esi, ecx
jb 0x10147ab0
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10148380
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10165c45
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x10
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
movzx eax, byte [edi]
xor eax, 0x811c9dc5
imul ecx, eax, 0x1000193
movzx eax, byte [edi + 1]
xor ecx, eax
movzx eax, byte [edi + 2]
imul ecx, ecx, 0x1000193
xor ecx, eax
movzx eax, byte [edi + 3]
imul ecx, ecx, 0x1000193
xor ecx, eax
lea eax, [ebp - 0x14]
imul ebx, ecx, 0x1000193
push ebx
push edi
push eax
call fcn.101486e0
mov ecx, dword [ebp - 0x10]
test ecx, ecx
je 0x10148401
mov eax, dword [ebp + 8]
mov dword [eax], ecx
mov byte [eax + 4], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
cmp dword [0x10339ca8], 0xccccccc
jne 0x10148418
push str.unordered_map_set_too_long
call dword [sym.imp.MSVCP140.dll_void___cdecl_std::_Xlength_error_char_const__]
mov dword [ebp - 0x1c], 0x10339ca4
mov dword [ebp - 4], 0
push 0x14
mov dword [ebp - 0x18], 0
call fcn.1015b6a6
mov ecx, dword [edi]
mov esi, eax
vxorps xmm0, xmm0, xmm0
add esp, 4
mov dword [ebp - 0x18], esi
mov dword [esi + 8], ecx
mov dword [esi + 0xc], 0
vmovss dword [esi + 0x10], xmm0
mov dword [ebp - 4], 1
mov ecx, dword [0x10339ca8]
mov edi, dword [0x10339cbc]
vmovss xmm1, dword [0x10339ca0]
vxorps xmm0, xmm0, xmm0
lea eax, [ecx + 1]
vcvtsi2sd xmm0, xmm0, eax
shr eax, 0x1f
vaddsd xmm0, xmm0, qword [eax*8 + 0x10279850]
vcvtsd2ss xmm2, xmm0, xmm0
vxorps xmm0, xmm0, xmm0
mov eax, edi
shr eax, 0x1f
vcvtsi2sd xmm0, xmm0, edi
vaddsd xmm0, xmm0, qword [eax*8 + 0x10279850]
vcvtsd2ss xmm0, xmm0, xmm0
vdivss xmm0, xmm2, xmm0
vcomiss xmm0, xmm1
jbe 0x101484f6
vdivss xmm0, xmm2, xmm1
call fcn.1005c280
call fcn.1015d610
mov ecx, 8
cmp eax, ecx
cmova ecx, eax
cmp edi, ecx
jae 0x101484d8
cmp edi, 0x200
jae 0x101484d6
shl edi, 3
cmp edi, ecx
jae 0x101484d8
mov edi, ecx
push edi
call fcn.10148560
push ebx
lea eax, [esi + 8]
push eax
lea eax, [ebp - 0x1c]
push eax
call fcn.101486e0
mov ecx, dword [0x10339ca8]
mov edx, dword [eax]
jmp 0x101484f9
mov edx, dword [ebp - 0x14]
mov edi, dword [edx + 4]
inc ecx
mov dword [0x10339ca8], ecx
mov dword [esi], edx
mov dword [esi + 4], edi
mov dword [edi], esi
mov dword [edx + 4], esi
mov eax, dword [0x10339cb8]
mov ecx, dword [0x10339cac]
and eax, ebx
mov ebx, dword [ecx + eax*8]
cmp ebx, dword [0x10339ca4]
jne 0x1014852a
mov dword [ecx + eax*8], esi
jmp 0x10148539
cmp ebx, edx
jne 0x10148533
mov dword [ecx + eax*8], esi
jmp 0x1014853d
cmp dword [ecx + eax*8 + 4], edi
jne 0x1014853d
mov dword [ecx + eax*8 + 4], esi
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
pop edi
mov dword [eax], esi
pop esi
mov byte [eax + 4], 1
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x1014cf50
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x10163215
push eax
mov dword fs:[0], esp
sub esp, 0x10
push ebx
mov ebx, dword [ebp + 0xc]
mov edx, ebx
push esi
push edi
cmp dword [ebx + 0x14], 0x10
mov edi, dword [ebx + 0x10]
jb 0x1014cf7e
mov edx, dword [ebx]
xor ecx, ecx
mov esi, 0x811c9dc5
test edi, edi
je 0x1014cfa1
nop dword [eax]
movzx eax, byte [ecx + edx]
inc ecx
xor eax, esi
imul esi, eax, 0x1000193
cmp ecx, edi
jb 0x1014cf90
push esi
push ebx
lea eax, [ebp - 0x14]
push eax
call fcn.1014d310
mov ecx, dword [ebp - 0x10]
test ecx, ecx
je 0x1014cfcf
mov eax, dword [ebp + 8]
mov dword [eax], ecx
mov byte [eax + 4], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
cmp dword [0x1031ee80], 0x71c71c7
jne 0x1014cfe6
push str.unordered_map_set_too_long
call dword [sym.imp.MSVCP140.dll_void___cdecl_std::_Xlength_error_char_const__]
mov dword [ebp - 0x1c], 0x1031ee7c
mov dword [ebp - 4], 0
push 0x24
mov dword [ebp - 0x18], 0
call fcn.1015b6a6
mov edi, eax
add esp, 4
mov dword [ebp - 0x18], edi
lea ecx, [edi + 8]
push ebx
call fcn.10094910
mov ecx, dword [ebx + 0x18]
mov dword [edi + 0x20], ecx
mov dword [ebp - 4], 1
mov ecx, dword [0x1031ee80]
mov ebx, dword [0x1031ee94]
vmovss xmm1, dword [0x1031ee78]
vxorps xmm0, xmm0, xmm0
lea eax, [ecx + 1]
vcvtsi2sd xmm0, xmm0, eax
shr eax, 0x1f
vaddsd xmm0, xmm0, qword [eax*8 + 0x10279850]
vcvtsd2ss xmm2, xmm0, xmm0
vxorps xmm0, xmm0, xmm0
mov eax, ebx
shr eax, 0x1f
vcvtsi2sd xmm0, xmm0, ebx
vaddsd xmm0, xmm0, qword [eax*8 + 0x10279850]
vcvtsd2ss xmm0, xmm0, xmm0
vdivss xmm0, xmm2, xmm0
vcomiss xmm0, xmm1
jbe 0x1014d0be
vdivss xmm0, xmm2, xmm1
call fcn.1005c280
call fcn.1015d610
mov ecx, 8
cmp eax, ecx
cmova ecx, eax
cmp ebx, ecx
jae 0x1014d0a0
cmp ebx, 0x200
jae 0x1014d09e
shl ebx, 3
cmp ebx, ecx
jae 0x1014d0a0
mov ebx, ecx
push ebx
call fcn.1014d130
push esi
lea eax, [edi + 8]
push eax
lea eax, [ebp - 0x1c]
push eax
call fcn.1014d310
mov ecx, dword [0x1031ee80]
mov edx, dword [eax]
jmp 0x1014d0c1
mov edx, dword [ebp - 0x14]
mov ebx, dword [edx + 4]
inc ecx
mov dword [0x1031ee80], ecx
mov dword [edi], edx
mov dword [edi + 4], ebx
mov dword [ebx], edi
mov dword [edx + 4], edi
mov eax, dword [0x1031ee90]
mov ecx, dword [0x1031ee84]
and eax, esi
mov esi, dword [ecx + eax*8]
cmp esi, dword [0x1031ee7c]
jne 0x1014d0f2
mov dword [ecx + eax*8], edi
jmp 0x1014d101
cmp esi, edx
jne 0x1014d0fb
mov dword [ecx + eax*8], edi
jmp 0x1014d105
cmp dword [ecx + eax*8 + 4], ebx
jne 0x1014d105
mov dword [ecx + eax*8 + 4], edi
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
mov dword [eax], edi
pop edi
pop esi
mov byte [eax + 4], 1
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x1014f7a0
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10166dab
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
push ebx
mov ebx, ecx
mov dword [ebp - 0x10], ebx
push esi
push edi
mov dword [ebx + 4], 0
mov dword [ebx + 8], 0
mov dword [ebx + 0xc], 0
mov dword [ebp - 4], 0
mov dword [ebx + 0x10], 0
mov dword [ebx + 0x14], 0
mov dword [ebx + 0x18], 0
mov byte [ebp - 4], 1
lea ecx, [ebx + 0x10]
mov eax, dword [ebp + 8]
push dword [ebp + 0xc]
mov dword [ebx + 0x1c], 0
mov byte [ebx + 0x20], 0
mov dword [ebx], eax
call fcn.1014fc70
mov edi, dword [ebx + 0x14]
sub edi, dword [ebx + 0x10]
mov dword [ebx + 0x1c], edi
mov eax, dword [ebx + 8]
mov ecx, eax
mov edx, dword [ebx + 4]
sub ecx, edx
mov dword [ebp + 8], eax
cmp edi, ecx
jae 0x1014f832
lea eax, [edx + edi]
jmp 0x1014f85e
jbe 0x1014f861
mov eax, dword [ebx + 0xc]
sub eax, edx
cmp edi, eax
jbe 0x1014f849
push ecx
push edi
lea ecx, [ebx + 4]
call fcn.1014fe10
jmp 0x1014f861
sub edi, ecx
push edi
push 0
push dword [ebp + 8]
call sub.VCRUNTIME140.dll_memset
mov eax, dword [ebp + 8]
add esp, 0xc
add eax, edi
mov dword [ebx + 8], eax
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [ebp + 0xc]
push eax
push 0x40
push dword [ebx + 0x1c]
push dword [ebx]
call esi
push dword [ebx + 0x1c]
push dword [ebx]
push dword [ebx + 4]
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
lea eax, [ebp - 0x14]
push eax
push dword [ebp + 0xc]
push dword [ebx + 0x1c]
push dword [ebx]
call esi
call fcn.1014f750
mov dword [ebp + 8], ebx
mov ecx, dword [eax + 4]
cmp ecx, dword [eax + 8]
je 0x1014f8aa
mov dword [ecx], ebx
add dword [eax + 4], 4
jmp 0x1014f8b6
lea edx, [ebp + 8]
push edx
push ecx
mov ecx, eax
call fcn.1013b4e0
mov ecx, dword [ebp - 0xc]
mov eax, ebx
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 8
Function at 0x101572b0
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x14
push ebx
push esi
mov esi, dword [ebp + 8]
lea ebx, [ecx + 0x48]
push edi
mov al, byte [esi]
test al, al
jne 0x101572cf
mov eax, 0x811c9dc5
jmp 0x101572e5
movsx eax, al
lea ecx, [esi + 1]
xor eax, 0x811c9dc5
imul edx, eax, 0x1000193
call fcn.100dba40
mov dword [esp + 0x10], eax
mov ecx, ebx
lea eax, [esp + 0x10]
push eax
lea eax, [esp + 0x1c]
push eax
call fcn.101573a0
mov eax, dword [eax]
cmp dword [eax + 0xc], 0
jne 0x10157353
mov ecx, dword [0x10339cfc]
push esi
mov eax, dword [ecx]
call dword [eax + 0x34]
mov cl, byte [esi]
mov dword [esp + 0x10], eax
test cl, cl
jne 0x1015731f
mov eax, 0x811c9dc5
jmp 0x10157335
movsx eax, cl
lea ecx, [esi + 1]
xor eax, 0x811c9dc5
imul edx, eax, 0x1000193
call fcn.100dba40
mov dword [esp + 0x14], eax
mov ecx, ebx
lea eax, [esp + 0x14]
push eax
lea eax, [esp + 0x1c]
push eax
call fcn.101573a0
mov ecx, dword [esp + 0x10]
mov eax, dword [eax]
mov dword [eax + 0xc], ecx
mov al, byte [esi]
test al, al
jne 0x10157360
mov eax, 0x811c9dc5
jmp 0x10157376
movsx eax, al
lea ecx, [esi + 1]
xor eax, 0x811c9dc5
imul edx, eax, 0x1000193
call fcn.100dba40
mov dword [esp + 0x14], eax
mov ecx, ebx
lea eax, [esp + 0x14]
push eax
lea eax, [esp + 0x1c]
push eax
call fcn.101573a0
pop edi
pop esi
pop ebx
mov eax, dword [eax]
mov eax, dword [eax + 0xc]
mov esp, ebp
pop ebp
ret 4
Function at 0x101573a0
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10167715
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x10
push ebx
mov ebx, dword [ebp + 0xc]
push esi
push edi
mov edi, ecx
movzx eax, byte [ebx]
xor eax, 0x811c9dc5
imul edx, eax, 0x1000193
movzx eax, byte [ebx + 1]
xor edx, eax
movzx eax, byte [ebx + 2]
imul edx, edx, 0x1000193
xor edx, eax
movzx eax, byte [ebx + 3]
imul ecx, edx, 0x1000193
xor ecx, eax
imul eax, ecx, 0x1000193
mov ecx, edi
push eax
mov dword [ebp + 0xc], eax
lea eax, [ebp - 0x1c]
push ebx
push eax
call fcn.100975f0
mov ecx, dword [ebp - 0x18]
test ecx, ecx
je 0x10157428
mov eax, dword [ebp + 8]
mov dword [eax], ecx
mov byte [eax + 4], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
cmp dword [edi + 8], 0xfffffff
jne 0x1015743c
push str.unordered_map_set_too_long
call dword [sym.imp.MSVCP140.dll_void___cdecl_std::_Xlength_error_char_const__]
lea eax, [edi + 4]
mov dword [ebp - 0x14], eax
mov dword [ebp - 4], 0
push 0x10
mov dword [ebp - 0x10], 0
call fcn.1015b6a6
mov ecx, dword [ebx]
mov esi, eax
add esp, 4
mov dword [ebp - 0x10], esi
mov dword [esi + 8], ecx
mov dword [esi + 0xc], 0
mov dword [ebp - 4], 1
mov eax, dword [edi + 8]
mov ebx, dword [edi + 0x1c]
inc eax
vmovss xmm1, dword [edi]
vxorps xmm0, xmm0, xmm0
vcvtsi2sd xmm0, xmm0, eax
shr eax, 0x1f
vaddsd xmm0, xmm0, qword [eax*8 + 0x10279850]
vcvtsd2ss xmm2, xmm0, xmm0
vxorps xmm0, xmm0, xmm0
mov eax, ebx
shr eax, 0x1f
vcvtsi2sd xmm0, xmm0, ebx
vaddsd xmm0, xmm0, qword [eax*8 + 0x10279850]
vcvtsd2ss xmm0, xmm0, xmm0
vdivss xmm0, xmm2, xmm0
vcomiss xmm0, xmm1
jbe 0x10157504
vdivss xmm0, xmm2, xmm1
call fcn.1005c280
call fcn.1015d610
mov ecx, 8
cmp eax, ecx
cmova ecx, eax
cmp ebx, ecx
jae 0x101574e6
cmp ebx, 0x200
jae 0x101574e4
shl ebx, 3
cmp ebx, ecx
jae 0x101574e6
mov ebx, ecx
push ebx
mov ecx, edi
call fcn.100b7070
push dword [ebp + 0xc]
lea eax, [esi + 8]
mov ecx, edi
push eax
lea eax, [ebp - 0x1c]
push eax
call fcn.100975f0
mov edx, dword [eax]
jmp 0x10157507
mov edx, dword [ebp - 0x1c]
mov ebx, dword [edx + 4]
inc dword [edi + 8]
mov dword [esi], edx
mov dword [esi + 4], ebx
mov dword [ebx], esi
mov dword [edx + 4], esi
mov eax, dword [edi + 0x18]
and eax, dword [ebp + 0xc]
mov ecx, dword [edi + 0xc]
mov esi, dword [ebp - 0x14]
mov edi, dword [ecx + eax*8]
cmp edi, dword [esi]
mov esi, dword [ebp - 0x10]
jne 0x10157532
mov dword [ecx + eax*8], esi
jmp 0x10157541
cmp edi, edx
jne 0x1015753b
mov dword [ecx + eax*8], esi
jmp 0x10157545
cmp dword [ecx + eax*8 + 4], ebx
jne 0x10157545
mov dword [ecx + eax*8 + 4], esi
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
pop edi
mov dword [eax], esi
pop esi
mov byte [eax + 4], 1
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x101582c0
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 8]
movzx eax, byte [edx]
xor eax, 0x811c9dc5
imul ecx, eax, 0x1000193
movzx eax, byte [edx + 1]
xor ecx, eax
movzx eax, byte [edx + 2]
imul ecx, ecx, 0x1000193
xor ecx, eax
movzx eax, byte [edx + 3]
imul ecx, ecx, 0x1000193
xor ecx, eax
movzx eax, byte [edx + 4]
imul ecx, ecx, 0x1000193
xor ecx, eax
movzx eax, byte [edx + 5]
imul ecx, ecx, 0x1000193
xor ecx, eax
movzx eax, byte [edx + 6]
imul ecx, ecx, 0x1000193
xor ecx, eax
movzx eax, byte [edx + 7]
imul ecx, ecx, 0x1000193
xor ecx, eax
imul eax, ecx, 0x1000193
pop ebp
ret 4
Function at 0x1015a6e0
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, ecx
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, edx
mov eax, dword [ebx]
nop
cmp edi, 7
ja case.default.0x1015a6f5
jmp dword [edi*4 + 0x1015a88c]
mov ecx, esi
and ecx, 3
sub edi, ecx
sub ecx, 1
je 0x1015a738
sub ecx, 1
je 0x1015a725
sub ecx, 1
jne 0x1015a74b
movzx edx, byte [esi]
movzx ecx, al
xor edx, ecx
shr eax, 8
xor eax, dword [edx*4 + 0x102614c0]
inc esi
movzx edx, byte [esi]
movzx ecx, al
xor edx, ecx
shr eax, 8
xor eax, dword [edx*4 + 0x102614c0]
inc esi
movzx edx, byte [esi]
movzx ecx, al
xor edx, ecx
shr eax, 8
xor eax, dword [edx*4 + 0x102614c0]
inc esi
mov edx, edi
sar edx, 3
test edx, edx
je 0x1015a7cd
xor eax, dword [esi]
movzx ecx, al
shr eax, 8
xor eax, dword [ecx*4 + 0x102614c0]
movzx ecx, al
shr eax, 8
xor eax, dword [ecx*4 + 0x102614c0]
movzx ecx, al
shr eax, 8
xor eax, dword [ecx*4 + 0x102614c0]
mov ecx, eax
movzx eax, cl
shr ecx, 8
mov eax, dword [eax*4 + 0x102614c0]
xor eax, dword [esi + 4]
add esi, 8
xor eax, ecx
movzx ecx, al
shr eax, 8
xor eax, dword [ecx*4 + 0x102614c0]
movzx ecx, al
shr eax, 8
xor eax, dword [ecx*4 + 0x102614c0]
movzx ecx, al
shr eax, 8
xor eax, dword [ecx*4 + 0x102614c0]
movzx ecx, al
shr eax, 8
xor eax, dword [ecx*4 + 0x102614c0]
sub edx, 1
jne 0x1015a754
and edi, 7
jmp 0x1015a6f0
movzx edx, byte [esi]
movzx ecx, al
xor edx, ecx
shr eax, 8
xor eax, dword [edx*4 + 0x102614c0]
inc esi
movzx edx, byte [esi]
movzx ecx, al
xor edx, ecx
shr eax, 8
xor eax, dword [edx*4 + 0x102614c0]
inc esi
movzx edx, byte [esi]
movzx ecx, al
xor edx, ecx
shr eax, 8
xor eax, dword [edx*4 + 0x102614c0]
inc esi
xor eax, dword [esi]
movzx ecx, al
shr eax, 8
pop edi
pop esi
xor eax, dword [ecx*4 + 0x102614c0]
movzx ecx, al
shr eax, 8
xor eax, dword [ecx*4 + 0x102614c0]
movzx ecx, al
shr eax, 8
xor eax, dword [ecx*4 + 0x102614c0]
movzx ecx, al
shr eax, 8
xor eax, dword [ecx*4 + 0x102614c0]
mov dword [ebx], eax
pop ebx
pop ebp
ret
movzx edx, byte [esi]
movzx ecx, al
xor edx, ecx
shr eax, 8
xor eax, dword [edx*4 + 0x102614c0]
inc esi
movzx edx, byte [esi]
movzx ecx, al
xor edx, ecx
shr eax, 8
xor eax, dword [edx*4 + 0x102614c0]
inc esi
movzx edx, byte [esi]
movzx ecx, al
xor edx, ecx
shr eax, 8
xor eax, dword [edx*4 + 0x102614c0]
pop edi
pop esi
mov dword [ebx], eax
pop ebx
pop ebp
ret