joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10004e50
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
mov ebx, dword [ebp + 8]
movzx eax, bl
xor eax, 0x811c9dc5
mov dword [ebp - 4], ecx
imul edx, eax, 0x1000193
mov eax, ebx
shr eax, 8
movzx eax, al
push esi
push edi
xor edx, eax
lea edi, [ecx + 0x18]
imul ecx, edx, 0x1000193
mov eax, ebx
shr eax, 0x10
movzx eax, al
shr ebx, 0x18
xor ecx, eax
imul eax, ecx, 0x1000193
mov ecx, edi
xor eax, ebx
imul eax, eax, 0x1000193
push eax
lea eax, [ebp + 8]
push eax
lea eax, [ebp - 0xc]
push eax
call fcn.10005810
mov esi, dword [eax + 4]
test esi, esi
jne 0x10004eb5
mov esi, dword [edi + 4]
mov ebx, dword [ebp - 4]
cmp esi, dword [ebx + 0x1c]
je 0x10004f7d
mov edi, dword [esi + 0xc]
test edi, edi
je 0x10004eff
mov eax, dword [edi + 0x14]
test eax, eax
je 0x10004edf
push eax
call fcn.1009eb10
add esp, 4
mov dword [edi + 0x14], 0
mov eax, dword [edi + 0x18]
test eax, eax
je 0x10004ef4
push eax
call dword [sym.imp.bass.dll_BASS_StreamFree]
mov dword [edi + 0x18], 0
push 0x20
push edi
call fcn.100bb2c5
add esp, 8
movzx eax, byte [esi + 8]
xor eax, 0x811c9dc5
imul ecx, eax, 0x1000193
movzx eax, byte [esi + 9]
xor ecx, eax
movzx eax, byte [esi + 0xa]
imul ecx, ecx, 0x1000193
xor ecx, eax
movzx eax, byte [esi + 0xb]
imul ecx, ecx, 0x1000193
xor ecx, eax
imul eax, ecx, 0x1000193
mov ecx, dword [ebx + 0x30]
and ecx, eax
mov eax, dword [ebx + 0x24]
lea ecx, [eax + ecx*8]
mov eax, dword [ecx]
cmp dword [ecx + 4], esi
jne 0x10004f5a
cmp eax, esi
jne 0x10004f52
mov eax, dword [ebx + 0x1c]
mov dword [ecx], eax
mov dword [ecx + 4], eax
jmp 0x10004f62
mov eax, dword [esi + 4]
mov dword [ecx + 4], eax
jmp 0x10004f62
cmp eax, esi
jne 0x10004f62
mov eax, dword [esi]
mov dword [ecx], eax
mov ecx, dword [esi]
dec dword [ebx + 0x20]
mov eax, dword [esi + 4]
push 0x10
push esi
mov dword [eax], ecx
mov eax, dword [esi + 4]
mov dword [ecx + 4], eax
call fcn.100bb2c5
add esp, 8
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x10004f90
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x14
mov eax, ecx
push ebx
mov ebx, dword [ebp + 8]
mov dword [esp + 8], eax
push esi
push edi
lea edi, [eax + 0x18]
movzx eax, bl
xor eax, 0x811c9dc5
imul edx, eax, 0x1000193
movzx eax, byte [ebp + 9]
xor edx, eax
movzx eax, byte [ebp + 0xa]
imul ecx, edx, 0x1000193
xor ecx, eax
movzx eax, byte [ebp + 0xb]
imul ecx, ecx, 0x1000193
xor ecx, eax
imul eax, ecx, 0x1000193
mov ecx, edi
push eax
lea eax, [ebp + 8]
push eax
lea eax, [esp + 0x20]
push eax
call fcn.10005810
mov esi, dword [eax + 4]
test esi, esi
je 0x10005033
cmp esi, dword [edi + 4]
je 0x10005033
mov esi, dword [esi + 0xc]
mov eax, dword [esi + 0x18]
test eax, eax
je 0x1000500f
push eax
call dword [sym.imp.bass.dll_BASS_StreamFree]
mov dword [esi + 0x18], 0
push 0
push 0xffffffffffffffff
push 0
push dword [esi + 4]
push dword [esi]
call dword [sym.imp.bass.dll_BASS_StreamCreate]
mov dword [esi + 0x18], eax
mov dword [esi + 0x1c], 0xffffffff
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
push 0x20
call fcn.100bb295
mov esi, eax
add esp, 4
mov dword [esp + 0x18], esi
mov ecx, dword [esp + 0x10]
push 0
movups xmm0, xmmword [ecx + 4]
movups xmmword [esi], xmm0
mov ecx, dword [ecx + 0x14]
mov dword [esi + 0x10], ecx
push dword [esi + 4]
mov dword [esi + 0x14], 0
push dword [esi]
mov dword [esi + 0x18], 0
mov dword [esi + 0x1c], 0xffffffff
call fcn.1009e910
add esp, 0xc
mov dword [esi + 0x14], eax
push 0
push 0xffffffffffffffff
push 0
push dword [esi + 4]
push dword [esi]
call dword [sym.imp.bass.dll_BASS_StreamCreate]
mov dword [esi + 0x18], eax
mov ecx, dword [esi + 0x14]
test ecx, ecx
je 0x100050aa
test eax, eax
jne 0x100050d3
push ecx
call fcn.1009eb10
add esp, 4
mov dword [esi + 0x14], 0
mov eax, dword [esi + 0x18]
test eax, eax
je 0x100050bf
push eax
call dword [sym.imp.bass.dll_BASS_StreamFree]
mov dword [esi + 0x18], 0
push 0x20
push esi
call fcn.100bb2c5
add esp, 8
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
lea eax, [esp + 0x18]
mov dword [esp + 0x18], ebx
push eax
lea eax, [esp + 0x14]
mov dword [esp + 0x20], esi
push eax
mov ecx, edi
call fcn.100054a0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x10005190
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
sub esp, 0x18
mov edx, dword [ebp + 8]
push ebx
mov ebx, ecx
cmp edx, eax
je 0x100052e6
mov eax, dword [ebx + 4]
mov dword [ebp - 0x10], eax
mov eax, dword [edx + 4]
mov dword [ebp - 4], eax
movzx eax, byte [edx + 8]
xor eax, 0x811c9dc5
imul ecx, eax, 0x1000193
movzx eax, byte [edx + 9]
push esi
push edi
mov edi, dword [ebx + 0xc]
mov esi, edx
xor ecx, eax
mov dword [ebp - 0x18], edi
movzx eax, byte [edx + 0xa]
imul ecx, ecx, 0x1000193
xor ecx, eax
movzx eax, byte [edx + 0xb]
imul ecx, ecx, 0x1000193
xor ecx, eax
mov eax, dword [ebx + 0x18]
imul ecx, ecx, 0x1000193
and eax, ecx
mov ecx, dword [edi + eax*8]
mov dword [ebp - 0xc], ecx
lea eax, [edi + eax*8]
mov dword [ebp - 8], eax
mov eax, dword [eax + 4]
mov dword [ebp - 0x14], eax
mov eax, esi
mov edi, esi
mov esi, dword [esi]
push 0x10
push eax
call fcn.100bb2c5
dec dword [ebx + 8]
add esp, 8
cmp edi, dword [ebp - 0x14]
je 0x10005249
mov eax, dword [ebp + 0xc]
cmp esi, eax
jne 0x10005207
mov ecx, dword [ebp - 0xc]
cmp ecx, dword [ebp + 8]
jne 0x100052dc
mov edx, dword [ebp - 8]
mov ecx, dword [ebp - 4]
pop edi
mov dword [edx], esi
mov dword [ecx], esi
mov dword [esi + 4], ecx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
mov ecx, dword [ebp - 0xc]
mov edx, dword [ebp - 8]
cmp ecx, dword [ebp + 8]
jne 0x1000525d
mov eax, dword [ebp - 0x10]
mov ecx, eax
mov dword [edx], eax
jmp 0x10005260
mov ecx, dword [ebp - 4]
mov eax, dword [ebp + 0xc]
mov dword [edx + 4], ecx
cmp esi, eax
je 0x100052dc
nop word [eax + eax]
movzx eax, byte [esi + 8]
xor eax, 0x811c9dc5
imul ecx, eax, 0x1000193
movzx eax, byte [esi + 9]
xor ecx, eax
movzx eax, byte [esi + 0xa]
imul ecx, ecx, 0x1000193
xor ecx, eax
movzx eax, byte [esi + 0xb]
imul ecx, ecx, 0x1000193
xor ecx, eax
mov eax, dword [ebx + 0x18]
imul ecx, ecx, 0x1000193
and eax, ecx
mov ecx, dword [ebp - 0x18]
lea eax, [ecx + eax*8]
mov dword [ebp + 8], eax
mov eax, dword [eax + 4]
mov dword [ebp - 0x14], eax
mov eax, esi
mov edi, esi
mov esi, dword [esi]
push 0x10
push eax
call fcn.100bb2c5
dec dword [ebx + 8]
add esp, 8
mov eax, dword [ebp + 0xc]
cmp edi, dword [ebp - 0x14]
je 0x100052ed
cmp esi, eax
jne 0x100052b7
mov ecx, dword [ebp + 8]
mov dword [ecx], esi
mov ecx, dword [ebp - 4]
pop edi
mov dword [ecx], esi
mov dword [esi + 4], ecx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
mov ecx, dword [ebp + 8]
mov edx, dword [ebp - 0x10]
mov dword [ecx], edx
mov dword [ecx + 4], edx
cmp esi, eax
jne 0x10005270
mov ecx, dword [ebp - 4]
pop edi
mov dword [ecx], esi
mov dword [esi + 4], ecx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x100054a0
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100e5bf5
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push ebx
push esi
push edi
mov eax, dword [0x10112200]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov ebx, dword [ebp + 0xc]
movzx eax, byte [ebx]
xor eax, 0x811c9dc5
imul edx, eax, 0x1000193
movzx eax, byte [ebx + 1]
xor edx, eax
movzx eax, byte [ebx + 2]
imul edx, edx, 0x1000193
xor edx, eax
movzx eax, byte [ebx + 3]
imul ecx, edx, 0x1000193
xor ecx, eax
imul eax, ecx, 0x1000193
mov ecx, edi
push eax
mov dword [ebp + 0xc], eax
lea eax, [ebp - 0x1c]
push ebx
push eax
call fcn.10005810
mov ecx, dword [ebp - 0x18]
test ecx, ecx
je 0x10005533
mov eax, dword [ebp + 8]
mov dword [eax], ecx
mov byte [eax + 4], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
cmp dword [edi + 8], 0xfffffff
je 0x10005667
lea eax, [edi + 4]
mov dword [ebp - 0x14], eax
mov dword [ebp - 4], 0
push 0x10
mov dword [ebp - 0x10], 0
call fcn.100bb295
mov ecx, dword [ebx]
mov esi, eax
add esp, 4
mov dword [ebp - 0x10], esi
mov dword [esi + 8], ecx
mov ecx, dword [ebx + 4]
mov dword [esi + 0xc], ecx
mov dword [ebp - 4], 1
mov eax, dword [edi + 8]
mov ebx, dword [edi + 0x1c]
inc eax
movss xmm3, dword [edi]
movd xmm0, eax
cvtdq2pd xmm0, xmm0
shr eax, 0x1f
movd xmm1, ebx
addsd xmm0, qword [eax*8 + 0x10108980]
cvtdq2pd xmm1, xmm1
mov eax, ebx
shr eax, 0x1f
cvtpd2ps xmm0, xmm0
addsd xmm1, qword [eax*8 + 0x10108980]
movaps xmm2, xmm0
cvtpd2ps xmm1, xmm1
divss xmm2, xmm1
comiss xmm2, xmm3
jbe 0x10005609
divss xmm0, xmm3
call fcn.10004b10
call fcn.100bbd20
mov ecx, 8
cmp eax, ecx
cmova ecx, eax
cmp ebx, ecx
jae 0x100055eb
cmp ebx, 0x200
jae 0x100055e9
shl ebx, 3
cmp ebx, ecx
jae 0x100055eb
mov ebx, ecx
push ebx
mov ecx, edi
call fcn.100056a0
push dword [ebp + 0xc]
lea eax, [esi + 8]
mov ecx, edi
push eax
lea eax, [ebp - 0x1c]
push eax
call fcn.10005810
mov edx, dword [eax]
jmp 0x1000560c
mov edx, dword [ebp - 0x1c]
mov ebx, dword [edx + 4]
inc dword [edi + 8]
mov dword [esi], edx
mov dword [esi + 4], ebx
mov dword [ebx], esi
mov dword [edx + 4], esi
mov eax, dword [edi + 0x18]
and eax, dword [ebp + 0xc]
mov ecx, dword [edi + 0xc]
mov esi, dword [ebp - 0x14]
mov edi, dword [ecx + eax*8]
cmp edi, dword [esi]
mov esi, dword [ebp - 0x10]
jne 0x10005637
mov dword [ecx + eax*8], esi
jmp 0x10005646
cmp edi, edx
jne 0x10005640
mov dword [ecx + eax*8], esi
jmp 0x1000564a
cmp dword [ecx + eax*8 + 4], ebx
jne 0x1000564a
mov dword [ecx + eax*8 + 4], esi
mov eax, dword [ebp + 8]
mov dword [eax], esi
mov byte [eax + 4], 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
push str.unordered_map_set_too_long
call fcn.100ba07b
int3
Function at 0x100056a0
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov edx, dword [ebp + 8]
mov eax, 0x1fffffff
push ebx
mov ebx, ecx
bsr ecx, eax
push esi
push edi
mov edi, 1
mov dword [ebp - 4], ebx
mov eax, edi
shl eax, cl
cmp edx, eax
ja 0x100057fa
mov esi, dword [ebx + 4]
lea eax, [edx - 1]
or eax, edi
mov dword [ebp + 8], esi
bsr ecx, eax
push esi
lea ecx, [ecx + 1]
shl edi, cl
lea ecx, [ebx + 0xc]
lea eax, [edi + edi]
push eax
call fcn.10005320
lea eax, [edi - 1]
mov dword [ebx + 0x1c], edi
mov dword [ebx + 0x18], eax
mov eax, dword [ebx + 4]
mov eax, dword [eax]
mov ecx, eax
cmp eax, esi
je 0x100057cd
movzx edx, byte [eax + 8]
xor edx, 0x811c9dc5
mov ecx, dword [ecx]
imul edi, edx, 0x1000193
movzx edx, byte [eax + 9]
xor edi, edx
movzx edx, byte [eax + 0xa]
imul edi, edi, 0x1000193
xor edi, edx
movzx edx, byte [eax + 0xb]
imul edi, edi, 0x1000193
xor edi, edx
imul edx, edi, 0x1000193
mov edi, dword [ebx + 0x18]
and edi, edx
mov edx, dword [ebx + 0xc]
lea edx, [edx + edi*8]
mov edi, dword [edx]
mov dword [ebp - 8], edx
cmp edi, esi
jne 0x10005753
mov dword [edx], eax
mov dword [edx + 4], eax
jmp 0x100057c3
mov edx, dword [edx + 4]
mov ebx, dword [eax + 8]
cmp ebx, dword [edx + 8]
jne 0x1000578d
mov edx, dword [edx]
mov dword [ebp - 0xc], edx
cmp edx, eax
je 0x10005785
mov ebx, dword [eax + 4]
mov esi, dword [ebp - 0xc]
mov dword [ebx], ecx
mov edi, dword [ecx + 4]
mov dword [edi], edx
mov edx, dword [edx + 4]
mov dword [edx], eax
mov dword [esi + 4], edi
mov esi, dword [ebp + 8]
mov dword [ecx + 4], ebx
mov dword [eax + 4], edx
mov edx, dword [ebp - 8]
mov dword [edx + 4], eax
jmp 0x100057c0
cmp edi, edx
je 0x1000579d
mov edx, dword [edx + 4]
cmp ebx, dword [edx + 8]
je 0x100057d6
cmp edi, edx
jne 0x10005791
mov ebx, dword [eax + 4]
mov dword [ebp - 0xc], ebx
mov dword [ebx], ecx
mov ebx, dword [ecx + 4]
mov dword [ebx], edx
mov edi, dword [edx + 4]
mov dword [edi], eax
mov dword [edx + 4], ebx
mov edx, dword [ebp - 0xc]
mov dword [ecx + 4], edx
mov edx, dword [ebp - 8]
mov dword [eax + 4], edi
mov dword [edx], eax
mov ebx, dword [ebp - 4]
mov eax, ecx
cmp ecx, esi
jne 0x10005702
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
mov ebx, dword [eax + 4]
mov edx, dword [edx]
mov dword [ebp - 0xc], edx
mov esi, edx
mov dword [ebx], ecx
mov edi, dword [ecx + 4]
mov dword [edi], edx
mov edx, dword [edx + 4]
mov dword [edx], eax
mov dword [esi + 4], edi
mov esi, dword [ebp + 8]
mov dword [ecx + 4], ebx
mov dword [eax + 4], edx
jmp 0x100057c0
push str.invalid_hash_bucket_count
call fcn.100ba07b
int3
Function at 0x10005910
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100e5c2d
mov eax, dword fs:[0]
push eax
sub esp, 0x44
mov eax, dword [0x10112200]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [0x10112cc0]
test esi, esi
je 0x10005af9
cmp dword [0x10112fa8], 2
jb 0x10005af9
mov ecx, dword [0x10112fac]
mov eax, 0x10112f98
mov edx, dword [0x10112f98]
cmp ecx, 0xf
cmova eax, edx
cmp byte [eax], 0x2e
je 0x1000598f
cmp esi, 1
je 0x10005af9
cmp ecx, 0xf
mov eax, 0x10112f98
cmova eax, edx
cmp byte [eax], 0x2f
jne 0x10005af9
cmp ecx, 0xf
mov eax, 0x10112f98
cmova eax, edx
cmp byte [eax + 1], 0xd0
je 0x100059b5
cmp ecx, 0xf
mov eax, 0x10112f98
cmova eax, edx
cmp byte [eax + 1], 0xd1
jne 0x10005af9
push 0xfde9
mov edx, 0x10112f98
lea ecx, [ebp - 0x28]
call fcn.1001ed60
add esp, 4
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x28]
cmp dword [0x10112cc0], 1
lea esi, [ebp - 0x28]
mov edx, 0x20
mov bl, 1
sete bh
xor eax, eax
cmp dword [0x10112cc0], 2
cmove eax, edx
cmp dword [ebp - 0x14], 7
movzx edi, ax
cmova ecx, dword [ebp - 0x28]
mov eax, dword [ebp - 0x18]
cmova esi, dword [ebp - 0x28]
mov dword [ebp - 0x48], edi
lea eax, [ecx + eax*2]
mov dword [ebp - 0x44], eax
cmp esi, eax
je 0x10005aac
mov ecx, 0x10115260
nop dword [eax]
movzx edx, word [esi]
cmp dx, di
je 0x10005aac
test bh, bh
je 0x10005a53
lea eax, [edx - 0x410]
cmp ax, 0x3f
ja 0x10005a40
mov bl, 1
jmp 0x10005a53
lea eax, [edx - 0x41]
mov cx, 0x39
cmp cx, ax
mov ecx, 0x10115260
sbb al, al
and bl, al
test bl, bl
movzx eax, dl
mov edi, 0x10115280
cmove edi, ecx
xor eax, 0x811c9dc5
imul ecx, eax, 0x1000193
mov eax, edx
shr eax, 8
xor ecx, eax
imul eax, ecx, 0x1000193
mov ecx, edi
push eax
push esi
lea eax, [ebp - 0x50]
push eax
call fcn.10006280
mov eax, dword [eax + 4]
test eax, eax
je 0x10005a98
cmp eax, dword [edi + 4]
je 0x10005a98
mov ax, word [eax + 0xa]
mov word [esi], ax
mov edi, dword [ebp - 0x48]
add esi, 2
mov ecx, 0x10115260
cmp esi, dword [ebp - 0x44]
jne 0x10005a20
push 0xfde9
lea edx, [ebp - 0x28]
lea ecx, [ebp - 0x40]
call fcn.1001efb0
add esp, 4
mov ecx, 0x10112f98
push eax
call fcn.10005d30
lea ecx, [ebp - 0x40]
call fcn.10005ce0
cmp dword [0x10112cc0], 2
jne 0x10005af1
cmp dword [0x10112fac], 0xf
mov eax, 0x10112f98
cmova eax, dword [0x10112f98]
mov byte [eax], 0x2f
lea ecx, [ebp - 0x28]
call fcn.10005c80
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.100bb287
mov esp, ebp
pop ebp
ret
Function at 0x10005f20
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100e5cb5
mov eax, dword fs:[0]
push eax
sub esp, 0x24
push ebx
push esi
push edi
mov eax, dword [0x10112200]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov dword [ebp - 0x10], ebx
mov edi, dword [ebp + 8]
cmp edi, dword [ebp + 0xc]
je 0x100060db
nop dword [eax]
movzx eax, byte [edi]
xor eax, 0x811c9dc5
imul ecx, eax, 0x1000193
movzx eax, byte [edi + 1]
xor ecx, eax
imul eax, ecx, 0x1000193
mov ecx, ebx
push eax
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x20]
push edi
push eax
call fcn.10006280
cmp dword [ebp - 0x1c], 0
jne 0x100060cc
cmp dword [ebx + 8], 0x15555555
je 0x100060ef
lea eax, [ebx + 4]
mov dword [ebp - 0x28], eax
mov dword [ebp - 4], 0
push 0xc
mov dword [ebp - 0x24], 0
call fcn.100bb295
mov ecx, dword [edi]
mov esi, eax
add esp, 4
mov dword [ebp - 0x24], esi
mov dword [esi + 8], ecx
mov dword [ebp - 4], 1
mov ecx, dword [ebx + 8]
movss xmm3, dword [ebx]
inc ecx
mov ebx, dword [ebx + 0x1c]
mov eax, ebx
shr eax, 0x1f
movd xmm0, ecx
cvtdq2pd xmm0, xmm0
shr ecx, 0x1f
movd xmm1, ebx
addsd xmm0, qword [ecx*8 + 0x10108980]
cvtdq2pd xmm1, xmm1
cvtpd2ps xmm0, xmm0
addsd xmm1, qword [eax*8 + 0x10108980]
movaps xmm2, xmm0
cvtpd2ps xmm1, xmm1
divss xmm2, xmm1
comiss xmm2, xmm3
jbe 0x10006070
divss xmm0, xmm3
call fcn.10004b10
call fcn.100bbd20
mov ecx, 8
cmp eax, ecx
cmova ecx, eax
cmp ebx, ecx
jae 0x10006046
cmp ebx, 0x200
jae 0x10006044
shl ebx, 3
cmp ebx, ecx
jae 0x10006046
mov ebx, ecx
push ebx
mov ebx, dword [ebp - 0x10]
mov ecx, ebx
call fcn.10006120
push dword [ebp - 0x14]
lea eax, [esi + 8]
mov ecx, ebx
push eax
lea eax, [ebp - 0x30]
push eax
call fcn.10006280
mov edx, dword [eax]
mov eax, dword [eax + 4]
mov dword [ebp - 0x20], edx
mov dword [ebp - 0x1c], eax
jmp 0x10006076
mov edx, dword [ebp - 0x20]
mov ebx, dword [ebp - 0x10]
mov eax, dword [edx + 4]
inc dword [ebx + 8]
mov edi, dword [ebp - 0x28]
mov dword [esi + 4], eax
mov dword [esi], edx
mov dword [eax], esi
mov dword [edx + 4], esi
mov ecx, dword [ebx + 0xc]
mov dword [ebp - 0x18], eax
mov eax, dword [ebx + 0x18]
and eax, dword [ebp - 0x14]
mov dword [ebp - 0x24], 0
mov ebx, dword [ecx + eax*8]
cmp ebx, dword [edi]
mov edi, dword [ebp + 8]
mov ebx, dword [ebp - 0x10]
jne 0x100060ae
mov dword [ecx + eax*8], esi
jmp 0x100060c1
cmp dword [ecx + eax*8], edx
jne 0x100060b8
mov dword [ecx + eax*8], esi
jmp 0x100060c5
mov edx, dword [ebp - 0x18]
cmp dword [ecx + eax*8 + 4], edx
jne 0x100060c5
mov dword [ecx + eax*8 + 4], esi
mov dword [ebp - 4], 0xffffffff
add edi, 4
mov dword [ebp + 8], edi
cmp edi, dword [ebp + 0xc]
jne 0x10005f60
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
push str.unordered_map_set_too_long
call fcn.100ba07b
int3
Function at 0x10006120
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov edx, dword [ebp + 8]
mov eax, 0x1fffffff
push ebx
mov ebx, ecx
bsr ecx, eax
push esi
push edi
mov edi, 1
mov dword [ebp - 4], ebx
mov eax, edi
shl eax, cl
cmp edx, eax
ja 0x1000626a
mov esi, dword [ebx + 4]
lea eax, [edx - 1]
or eax, edi
mov dword [ebp + 8], esi
bsr ecx, eax
push esi
lea ecx, [ecx + 1]
shl edi, cl
lea ecx, [ebx + 0xc]
lea eax, [edi + edi]
push eax
call fcn.10005db0
lea eax, [edi - 1]
mov dword [ebx + 0x1c], edi
mov dword [ebx + 0x18], eax
mov eax, dword [ebx + 4]
mov eax, dword [eax]
mov ecx, eax
cmp eax, esi
je 0x1000623d
movzx edx, byte [eax + 8]
mov ecx, dword [ecx]
xor edx, 0x811c9dc5
imul edi, edx, 0x1000193
movzx edx, byte [eax + 9]
xor edi, edx
imul edx, edi, 0x1000193
mov edi, dword [ebx + 0x18]
and edi, edx
mov edx, dword [ebx + 0xc]
lea edx, [edx + edi*8]
mov edi, dword [edx]
mov dword [ebp - 8], edx
cmp edi, esi
jne 0x100061be
mov dword [edx], eax
mov dword [edx + 4], eax
jmp 0x10006233
mov edx, dword [edx + 4]
movzx ebx, word [eax + 8]
cmp bx, word [edx + 8]
jne 0x100061fa
mov edx, dword [edx]
mov dword [ebp - 0xc], edx
cmp edx, eax
je 0x100061f2
mov ebx, dword [eax + 4]
mov esi, dword [ebp - 0xc]
mov dword [ebx], ecx
mov edi, dword [ecx + 4]
mov dword [edi], edx
mov edx, dword [edx + 4]
mov dword [edx], eax
mov dword [esi + 4], edi
mov esi, dword [ebp + 8]
mov dword [ecx + 4], ebx
mov dword [eax + 4], edx
mov edx, dword [ebp - 8]
mov dword [edx + 4], eax
jmp 0x10006230
cmp edi, edx
je 0x1000620d
nop
mov edx, dword [edx + 4]
cmp bx, word [edx + 8]
je 0x10006246
cmp edi, edx
jne 0x10006200
mov ebx, dword [eax + 4]
mov dword [ebp - 0xc], ebx
mov dword [ebx], ecx
mov ebx, dword [ecx + 4]
mov dword [ebx], edx
mov edi, dword [edx + 4]
mov dword [edi], eax
mov dword [edx + 4], ebx
mov edx, dword [ebp - 0xc]
mov dword [ecx + 4], edx
mov edx, dword [ebp - 8]
mov dword [eax + 4], edi
mov dword [edx], eax
mov ebx, dword [ebp - 4]
mov eax, ecx
cmp ecx, esi
jne 0x10006182
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
mov ebx, dword [eax + 4]
mov edx, dword [edx]
mov dword [ebp - 0xc], edx
mov esi, edx
mov dword [ebx], ecx
mov edi, dword [ecx + 4]
mov dword [edi], edx
mov edx, dword [edx + 4]
mov dword [edx], eax
mov dword [esi + 4], edi
mov esi, dword [ebp + 8]
mov dword [ecx + 4], ebx
mov dword [eax + 4], edx
jmp 0x10006230
push str.invalid_hash_bucket_count
call fcn.100ba07b
int3
Function at 0x10006da0
Capabilities:
Create process on windows
Self delete

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
mov eax, dword [0x10112200]
xor eax, ebp
mov dword [ebp - 4], eax
push 2
call fcn.100292a0
add esp, 4
push eax
push 4
call fcn.10029400
push 0
push str.CTXMENU
call fcn.100386f0
add esp, 0x10
test al, al
je 0x10006fd9
cmp dword [0x10112f30], 0
je 0x10006e91
lea eax, [ebp - 0x2c]
mov dword [ebp - 0x2c], 0
push eax
push 0
push 0
push str.Open_URL
mov dword [ebp - 0x28], 0
call fcn.100525d0
add esp, 0x10
test al, al
je 0x10006e49
cmp dword [0x10112f34], 0xf
mov eax, 0x10112f20
push 1
cmova eax, dword [0x10112f20]
push 0
push 0
push eax
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
cmp eax, 0x20
jbe 0x10006e49
mov eax, dword [0x10112fd4]
push 6
push dword [eax + 0x1c]
call dword [sym.imp.USER32.dll_ShowWindow]
lea eax, [ebp - 0x2c]
mov dword [ebp - 0x2c], 0
push eax
push 0
push 0
push str.Copy_URL
mov dword [ebp - 0x28], 0
call fcn.100525d0
add esp, 0x10
test al, al
je 0x10006e8c
cmp dword [0x10112f34], 0xf
mov eax, 0x10112f20
cmova eax, dword [0x10112f20]
push eax
call fcn.1002b530
add esp, 4
call fcn.100436e0
lea eax, [ebp - 0x2c]
mov dword [ebp - 0x2c], 0
push eax
push 0
push 0
push str.Copy_text
mov dword [ebp - 0x28], 0
call fcn.100525d0
add esp, 0x10
test al, al
je 0x10006ed4
cmp dword [0x10112f18], 0xf
mov eax, 0x10112f04
cmova eax, dword [0x10112f04]
push eax
call fcn.1002b530
add esp, 4
lea eax, [ebp - 0x2c]
mov dword [ebp - 0x2c], 0
push eax
push 0
push 0
push str.Copy_color
mov dword [ebp - 0x28], 0
call fcn.100525d0
add esp, 0x10
test al, al
je 0x10006f23
mov eax, dword [0x10112f1c]
and eax, 0xffffff
push eax
lea eax, [ebp - 0x24]
push str._06X
push eax
call fcn.10006340
add esp, 0xc
lea eax, [ebp - 0x24]
push eax
call fcn.1002b530
add esp, 4
call fcn.100436e0
lea eax, [ebp - 0x2c]
mov dword [ebp - 0x2c], 0
push eax
push 0
push 0
push str.Delete
mov dword [ebp - 0x28], 0
call fcn.100525d0
add esp, 0x10
test al, al
je 0x10006f81
mov edx, dword [0x101152fc]
add edx, dword [0x101151a0]
mov eax, dword [0x101152f8]
mov ecx, edx
push dword [0x10112ee0]
dec eax
shr ecx, 2
and ecx, eax
and edx, 3
mov eax, dword [0x101152f4]
mov eax, dword [eax + ecx*4]
mov ecx, dword [eax + edx*4]
mov eax, dword [ecx]
call dword [eax + 0x2c]
lea eax, [ebp - 0x2c]
mov dword [ebp - 0x2c], 0
push eax
push 0
push 0
push str.Clear_chat
mov dword [ebp - 0x28], 0
call fcn.100525d0
add esp, 0x10
test al, al
je 0x10006fd4
mov edx, dword [0x101152fc]
add edx, dword [0x101151a0]
mov eax, dword [0x101152f8]
mov ecx, edx
dec eax
shr ecx, 2
and ecx, eax
and edx, 3
mov eax, dword [0x101152f4]
mov eax, dword [eax + ecx*4]
mov ecx, dword [eax + edx*4]
mov eax, dword [ecx]
call dword [eax + 0x24]
call fcn.10038760
push 1
call fcn.10029490
mov ecx, dword [ebp - 4]
add esp, 4
xor ecx, ebp
call fcn.100bb287
mov esp, ebp
pop ebp
ret
Function at 0x10007c40
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 0xc]
mov edx, 0x811c9dc5
push edi
mov edi, dword [ebp + 8]
mov ecx, 0
sub esi, edi
je 0x10007c71
nop dword [eax]
movzx eax, byte [edi + ecx]
inc ecx
xor eax, edx
imul edx, eax, 0x1000193
cmp ecx, esi
jb 0x10007c60
pop edi
mov eax, edx
pop esi
pop ebp
ret 8
Function at 0x10012390
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push 0
lea eax, [ebp - 4]
mov dword [ebp - 4], 0
push eax
push 0
push 0x2001f
push 0
push 0
push 0
push str.SoftwareSAMPci_chat
push closesocket
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x10012411
push 0x28
push 0x10112ca0
push 3
push eax
push str.config
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov ecx, dword [0x10112f78]
mov eax, 0x10112f68
inc ecx
cmp dword [0x10112f7c], 0xf
push ecx
cmova eax, dword [0x10112f68]
push eax
push 1
push 0
push str.fontpath
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov esp, ebp
pop ebp
ret