joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100a10e0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
test ebx, ebx
je 0x100a1288
mov eax, dword [ebx]
mov ecx, ebx
mov eax, dword [eax + 0x280]
call eax
test al, al
je 0x100a1288
mov eax, dword [0x1022601c]
cmp dword [eax + 0x174], 0xffffffff
je 0x100a1288
cmp byte [0x1014bfec], 0
je 0x100a112a
mov byte [0x1013e204], 1
mov eax, dword [0x1022631c]
add eax, 0xffffff88
xor eax, 0xe4f8a393
cmp dword [eax + ebx], 0
mov eax, dword [0x102262e4]
setle cl
add eax, 0xffffff96
xor eax, 0xe4f8a385
xor edi, edi
mov byte [eax + ebx], cl
mov eax, dword [0x102262d8]
add eax, 0xffffff99
xor eax, 0xe4f8a382
mov dword [eax + ebx + 0xc], 0
mov eax, dword [0x102262dc]
add eax, 0xffffff98
xor eax, 0xe4f8a383
mov dword [eax + ebx + 0xc], 0
mov ecx, dword [0x102262e0]
lea eax, [ecx - 0x69]
xor eax, 0xe4f8a384
mov edx, dword [eax + ebx + 0xc]
mov dword [ebp - 4], edx
test edx, edx
je 0x100a11de
lea eax, [ecx - 0x69]
xor eax, 0xe4f8a384
mov eax, dword [eax + ebx]
mov esi, dword [eax + edi*4]
lea ebx, [eax + edi*4]
test esi, esi
je 0x100a11d6
or eax, 0xffffffff
lock xadd dword [esi + 4], eax
jne 0x100a11ca
mov eax, dword [esi]
mov ecx, esi
mov eax, dword [eax + 4]
call eax
test al, al
je 0x100a11c7
mov eax, dword [esi]
mov ecx, esi
push 1
call dword [eax]
mov edx, dword [ebp - 4]
mov dword [ebx], 0
mov ecx, dword [0x102262e0]
mov ebx, dword [ebp + 8]
inc edi
cmp edi, edx
jb 0x100a1193
lea eax, [ecx - 0x69]
xor eax, 0xe4f8a384
lea ecx, [ebx + 8]
push 0
mov dword [eax + ebx + 0xc], 0
mov eax, dword [ebx + 8]
mov eax, dword [eax + 0x1c]
call eax
mov eax, dword [ebx + 8]
lea ecx, [ebx + 8]
push 0
mov eax, dword [eax + 0x14]
call eax
mov ecx, dword [0x10226034]
xor ebx, ebx
mov dword [ebp - 4], ecx
mov eax, dword [ecx + 0x28]
mov dword [ebp - 8], eax
test eax, eax
je 0x100a1272
nop dword [eax]
mov eax, dword [ecx + 0x1c]
mov ecx, dword [eax + ebx*4]
mov eax, dword [ecx]
mov eax, dword [eax + 0x30]
call eax
mov esi, eax
mov edi, 0x811c9dc5
xor ecx, ecx
inc ecx
cmp byte [esi + ecx], 0
jne 0x100a1236
xor edx, edx
test ecx, ecx
je 0x100a125c
movsx eax, byte [esi + edx]
inc edx
xor eax, edi
imul edi, eax, 0x1000193
cmp edx, ecx
jb 0x100a1243
cmp edi, 0x79705c5e
je 0x100a1267
inc ebx
cmp ebx, dword [ebp - 8]
jae 0x100a1272
mov ecx, dword [ebp - 4]
jmp 0x100a1220
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x1c]
mov ecx, dword [eax + ebx*4]
jmp 0x100a1274
xor ecx, ecx
push 0
push dword [ebp + 8]
push 0
call dword [0x1022612c]
mov byte [0x1013e204], 0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x100a5b10
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10115f2d
mov eax, dword fs:[0]
push eax
push ebx
sub esp, 0x28
mov eax, dword [0x10139040]
xor eax, ebp
mov dword [ebp - 0x14], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [0x1022601c]
mov edi, dword [esi + 0x174]
test edi, edi
jle 0x100a5b81
mov edx, dword [esi + 0x4cb0]
mov ecx, dword [0x10225fbc]
add edx, dword [esi + 0x4cac]
push edx
push dword [esi + 0x4cb4]
mov eax, dword [ecx]
push 1
push edi
mov eax, dword [eax + 0xc]
call eax
cmp byte [0x1022b664], 0
jne 0x100a5c54
push 0x22
xorps xmm0, xmm0
mov dword [ebp - 0x24], 0
push str.B8_________3B_F0_0F_4F_F0_89_5D_FC
lea ecx, [ebp - 0x34]
mov dword [ebp - 0x20], 0
movups xmmword [ebp - 0x34], xmm0
call fcn.1002e020
mov dword [ebp - 4], 0
mov eax, dword [0x10225f74]
test eax, eax
je 0x100a5bc7
mov edx, dword [eax + 0x50]
jmp 0x100a5bc9
xor edx, edx
mov eax, dword [0x10225f6c]
test eax, eax
je 0x100a5bd7
mov eax, dword [eax + 0x18]
jmp 0x100a5bd9
xor eax, eax
lea ecx, [ebp - 0x34]
push ecx
push eax
lea ecx, [ebp - 0x1c]
call fcn.10025cd0
mov edi, dword [ebp - 0x1c]
add esp, 8
mov ecx, dword [ebp - 0x20]
inc edi
cmp ecx, 0xf
jbe 0x100a5c23
mov edx, dword [ebp - 0x34]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x100a5c19
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x100a5c19
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push ecx
push edx
call fcn.1010b98a
add esp, 8
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [ebp - 0x18]
push eax
push 0x40
push 4
push edi
mov dword [ebp - 0x18], 0
call esi
lea eax, [ebp - 0x18]
mov dword [edi], 0x3e
push eax
push dword [ebp - 0x18]
push 4
push edi
call esi
mov byte [0x1022b664], 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.1010b45c
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret 4
Function at 0x100a5fe0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, ecx
mov dl, byte [esi]
xor dl, byte [edi]
and dl, 1
xor dl, byte [edi]
mov byte [edi], dl
mov cl, byte [esi]
xor cl, dl
and cl, 2
xor cl, dl
mov byte [edi], cl
movzx eax, byte [esi]
xor al, cl
and al, 4
xor al, cl
mov byte [edi], al
mov eax, dword [esi + 4]
mov dword [edi + 4], eax
mov eax, dword [esi + 8]
mov dword [edi + 8], eax
movq xmm0, qword [esi + 0xc]
movq qword [edi + 0xc], xmm0
mov eax, dword [esi + 0x14]
mov dword [edi + 0x14], eax
movq xmm0, qword [esi + 0x18]
movq qword [edi + 0x18], xmm0
mov eax, dword [esi + 0x20]
mov dword [edi + 0x20], eax
mov eax, dword [esi + 0x24]
mov dword [edi + 0x24], eax
mov eax, dword [esi + 0x28]
mov dword [edi + 0x28], eax
mov eax, dword [esi + 0x2c]
mov dword [edi + 0x2c], eax
mov eax, dword [esi + 0x30]
mov dword [edi + 0x30], eax
mov eax, dword [esi + 0x34]
mov dword [edi + 0x34], eax
mov eax, dword [esi + 0x38]
mov dword [edi + 0x38], eax
mov eax, dword [esi + 0x3c]
mov dword [edi + 0x3c], eax
movq xmm0, qword [esi + 0x40]
movq qword [edi + 0x40], xmm0
mov eax, dword [esi + 0x48]
mov dword [edi + 0x48], eax
movq xmm0, qword [esi + 0x4c]
movq qword [edi + 0x4c], xmm0
mov eax, dword [esi + 0x54]
mov dword [edi + 0x54], eax
mov eax, dword [esi + 0x58]
mov dword [edi + 0x58], eax
movq xmm0, qword [esi + 0x5c]
movq qword [edi + 0x5c], xmm0
mov eax, dword [esi + 0x64]
mov dword [edi + 0x64], eax
movq xmm0, qword [esi + 0x68]
movq qword [edi + 0x68], xmm0
mov eax, dword [esi + 0x70]
mov dword [edi + 0x70], eax
mov eax, dword [esi + 0x74]
mov dword [edi + 0x74], eax
movq xmm0, qword [esi + 0x78]
movq qword [edi + 0x78], xmm0
mov eax, dword [esi + 0x80]
mov dword [edi + 0x80], eax
movq xmm0, qword [esi + 0x84]
movq qword [edi + 0x84], xmm0
mov eax, dword [esi + 0x8c]
mov dword [edi + 0x8c], eax
movq xmm0, qword [esi + 0x90]
movq qword [edi + 0x90], xmm0
mov eax, dword [esi + 0x98]
mov dword [edi + 0x98], eax
mov eax, dword [esi + 0x9c]
mov dword [edi + 0x9c], eax
mov eax, dword [esi + 0xa0]
mov dword [edi + 0xa0], eax
mov eax, dword [esi + 0xa4]
mov dword [edi + 0xa4], eax
movzx eax, byte [esi + 0xa8]
mov byte [edi + 0xa8], al
movq xmm0, qword [esi + 0xac]
movq qword [edi + 0xac], xmm0
mov eax, dword [esi + 0xb4]
mov dword [edi + 0xb4], eax
mov eax, edi
pop edi
pop esi
pop ebp
ret 4
Function at 0x100af470
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [0x10139040]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push ebx
push esi
push edi
mov edi, ecx
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp + 8]
mov ebx, edx
mov esi, ebx
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0xc], esi
lea eax, [ecx - 1]
mov dword [ebp - 0x1c], eax
sar eax, 1
mov dword [ebp - 0x14], eax
cmp ebx, eax
jge 0x100af4e3
lea esi, [edx + edx]
lea ecx, [edi + 0x10]
lea ecx, [ecx + esi*8]
lea eax, [ecx - 8]
push eax
push ecx
lea ecx, [ebp + 0x10]
call fcn.100a9f30
movzx edx, al
xor edx, 1
inc edx
add edx, esi
mov eax, dword [edi + edx*8]
mov ecx, dword [edi + edx*8 + 4]
mov dword [edi + ebx*8], eax
mov eax, dword [ebp - 0x14]
mov dword [edi + ebx*8 + 4], ecx
mov ebx, edx
cmp edx, eax
jl 0x100af4a7
mov esi, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x18]
mov ebx, edx
cmp edx, eax
jne 0x100af500
test cl, 1
jne 0x100af500
mov eax, dword [edi + ecx*8 - 8]
mov ecx, dword [edi + ecx*8 - 4]
mov ebx, dword [ebp - 0x1c]
mov dword [edi + edx*8], eax
mov dword [edi + edx*8 + 4], ecx
mov al, byte [ebp + 0x10]
mov byte [ebp - 8], al
cmp esi, ebx
jge 0x100af53d
nop word [eax + eax]
push dword [ebp - 0x10]
lea esi, [ebx - 1]
sar esi, 1
lea ecx, [ebp - 8]
lea eax, [edi + esi*8]
push eax
call fcn.100a9f30
test al, al
je 0x100af53d
mov eax, dword [edi + esi*8]
mov ecx, dword [edi + esi*8 + 4]
mov dword [edi + ebx*8], eax
mov dword [edi + ebx*8 + 4], ecx
mov ebx, esi
cmp dword [ebp - 0xc], esi
jl 0x100af510
mov ecx, dword [ebp - 0x10]
mov eax, dword [ecx]
mov ecx, dword [ecx + 4]
mov dword [edi + ebx*8 + 4], ecx
mov ecx, dword [ebp - 4]
mov dword [edi + ebx*8], eax
xor ecx, ebp
pop edi
pop esi
pop ebx
call fcn.1010b45c
mov esp, ebp
pop ebp
ret
Function at 0x100b7de0
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push esi
mov esi, dword [ebp + 8]
mov dword [ebp - 4], esi
mov edx, dword [ebp + 0xc]
movzx eax, dl
xor eax, 0x811c9dc5
imul ecx, eax, 0x1000193
mov eax, edx
sar eax, 8
movzx eax, al
xor ecx, eax
mov eax, edx
imul ecx, ecx, 0x1000193
sar eax, 0x10
movzx eax, al
sar edx, 0x18
xor ecx, eax
movzx eax, dl
imul ecx, ecx, 0x1000193
xor ecx, eax
imul eax, ecx, 0x1000193
mov ecx, 0x1022b4e4
push eax
lea eax, [ebp + 0xc]
push eax
lea eax, [ebp - 8]
push eax
call fcn.100bd470
mov edx, dword [0x1022b4e8]
xorps xmm0, xmm0
mov eax, dword [eax + 4]
test eax, eax
cmovne edx, eax
cmp edx, dword [0x1022b4e8]
movups xmmword [esi], xmm0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
je 0x100b7e7f
lea ecx, [edx + 0xc]
push 1
push ecx
mov ecx, esi
call fcn.1002e020
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret 8
push 0
push 0x101258fa
mov ecx, esi
call fcn.1002e020
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret 8
Function at 0x100bcbc0
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 8]
sub esp, 8
movzx eax, byte [edx]
push ebx
push esi
xor eax, 0x811c9dc5
push edi
mov edi, ecx
imul ecx, eax, 0x1000193
movzx eax, byte [edx + 1]
xor ecx, eax
movzx eax, byte [edx + 2]
imul ecx, ecx, 0x1000193
xor ecx, eax
movzx eax, byte [edx + 3]
imul ecx, ecx, 0x1000193
xor ecx, eax
lea eax, [ebp - 8]
imul ebx, ecx, 0x1000193
mov ecx, edi
push ebx
push edx
push eax
call fcn.100bd470
mov esi, dword [eax + 4]
test esi, esi
je 0x100bcc75
mov ecx, dword [edi + 0x18]
mov eax, dword [edi + 0xc]
and ecx, ebx
lea ecx, [eax + ecx*8]
mov eax, dword [ecx]
cmp dword [ecx + 4], esi
jne 0x100bcc3c
cmp eax, esi
jne 0x100bcc34
mov eax, dword [edi + 4]
mov dword [ecx], eax
mov dword [ecx + 4], eax
jmp 0x100bcc44
mov eax, dword [esi + 4]
mov dword [ecx + 4], eax
jmp 0x100bcc44
cmp eax, esi
jne 0x100bcc44
mov eax, dword [esi]
mov dword [ecx], eax
mov ecx, dword [esi]
dec dword [edi + 8]
mov eax, dword [esi + 4]
mov dword [eax], ecx
mov eax, dword [esi + 4]
mov dword [ecx + 4], eax
lea ecx, [esi + 0x50]
call fcn.1002d7a0
push 0x5c
push esi
call fcn.1010b98a
add esp, 8
mov eax, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x100bcd60
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [ebp + 0xc]
mov edx, ecx
push ebx
mov ebx, dword [ebp + 8]
mov dword [ebp - 0x14], edx
cmp ebx, eax
je 0x100bcecf
mov eax, dword [edx + 4]
mov dword [ebp - 0x18], eax
mov eax, dword [ebx + 4]
mov dword [ebp - 8], eax
movzx eax, byte [ebx + 8]
xor eax, 0x811c9dc5
imul ecx, eax, 0x1000193
movzx eax, byte [ebx + 9]
push esi
push edi
mov edi, dword [edx + 0xc]
mov esi, ebx
xor ecx, eax
mov dword [ebp - 0x1c], edi
movzx eax, byte [ebx + 0xa]
imul ecx, ecx, 0x1000193
xor ecx, eax
movzx eax, byte [ebx + 0xb]
imul ecx, ecx, 0x1000193
xor ecx, eax
mov eax, dword [edx + 0x18]
imul ecx, ecx, 0x1000193
and eax, ecx
mov ecx, dword [edi + eax*8]
mov dword [ebp - 4], ecx
lea eax, [edi + eax*8]
mov dword [ebp - 0xc], eax
mov eax, dword [eax + 4]
mov dword [ebp - 0x10], eax
nop word [eax + eax]
mov edi, esi
mov ebx, esi
mov esi, dword [esi]
lea ecx, [edi + 0x50]
call fcn.1002d7a0
push 0x5c
push edi
call fcn.1010b98a
mov edx, dword [ebp - 0x14]
add esp, 8
dec dword [edx + 8]
cmp ebx, dword [ebp - 0x10]
je 0x100bce2d
mov eax, dword [ebp + 0xc]
cmp esi, eax
jne 0x100bcde0
mov ecx, dword [ebp - 4]
cmp ecx, dword [ebp + 8]
jne 0x100bcec5
mov edi, dword [ebp - 0xc]
mov ecx, dword [ebp - 8]
mov dword [edi], esi
mov dword [ecx], esi
pop edi
mov dword [esi + 4], ecx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
mov ecx, dword [ebp - 4]
mov edi, dword [ebp - 0xc]
cmp ecx, dword [ebp + 8]
jne 0x100bce41
mov eax, dword [ebp - 0x18]
mov ecx, eax
mov dword [edi], eax
jmp 0x100bce44
mov ecx, dword [ebp - 8]
mov eax, dword [ebp + 0xc]
mov dword [edi + 4], ecx
cmp esi, eax
je 0x100bcec5
nop
movzx eax, byte [esi + 8]
xor eax, 0x811c9dc5
imul ecx, eax, 0x1000193
movzx eax, byte [esi + 9]
xor ecx, eax
movzx eax, byte [esi + 0xa]
imul ecx, ecx, 0x1000193
xor ecx, eax
movzx eax, byte [esi + 0xb]
imul ecx, ecx, 0x1000193
xor ecx, eax
imul eax, ecx, 0x1000193
mov ecx, dword [ebp - 0x1c]
and eax, dword [edx + 0x18]
lea eax, [ecx + eax*8]
mov dword [ebp - 4], eax
mov eax, dword [eax + 4]
mov dword [ebp - 0x10], eax
mov edi, esi
mov ebx, esi
mov esi, dword [esi]
lea ecx, [edi + 0x50]
call fcn.1002d7a0
push 0x5c
push edi
call fcn.1010b98a
mov edx, dword [ebp - 0x14]
add esp, 8
mov eax, dword [ebp + 0xc]
dec dword [edx + 8]
cmp ebx, dword [ebp - 0x10]
je 0x100bced6
cmp esi, eax
jne 0x100bce95
mov ecx, dword [ebp - 4]
mov dword [ecx], esi
mov ecx, dword [ebp - 8]
pop edi
mov dword [ecx], esi
mov dword [esi + 4], ecx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
mov ecx, dword [ebp - 4]
mov ebx, dword [ebp - 0x18]
mov dword [ecx], ebx
mov dword [ecx + 4], ebx
cmp esi, eax
jne 0x100bce50
mov ecx, dword [ebp - 8]
pop edi
mov dword [ecx], esi
mov dword [esi + 4], ecx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x100bd4e0
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10116ac5
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
push ebx
push esi
push edi
mov eax, dword [0x10139040]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov edx, dword [ebp + 0xc]
mov edi, dword [ebp + 8]
mov dword [ebp - 0x10], edx
mov dword [ebp - 0x20], edi
movzx eax, byte [edx]
xor eax, 0x811c9dc5
imul ecx, eax, 0x1000193
movzx eax, byte [edx + 1]
xor ecx, eax
movzx eax, byte [edx + 2]
imul ecx, ecx, 0x1000193
xor ecx, eax
movzx eax, byte [edx + 3]
imul ecx, ecx, 0x1000193
xor ecx, eax
imul eax, ecx, 0x1000193
mov ecx, ebx
push eax
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x1c]
push edx
push eax
call fcn.100bd470
mov eax, dword [ebp - 0x18]
test eax, eax
je 0x100bd56a
mov dword [edi], eax
mov byte [edi + 4], 0
jmp 0x100bd6b0
cmp dword [ebx + 8], 0xfffffff
jne 0x100bd57e
push str.unordered_map_set_too_long
call dword [sym.imp.MSVCP140.dll_void___cdecl_std::_Xlength_error_char_const__]
lea eax, [ebx + 4]
mov dword [ebp - 0x28], eax
mov dword [ebp - 4], 0
push 0x10
mov dword [ebp - 0x24], 0
call fcn.1010b478
mov ecx, dword [ebp - 0x10]
mov esi, eax
add esp, 4
mov dword [ebp - 0x24], esi
mov ecx, dword [ecx]
mov dword [esi + 8], ecx
mov byte [esi + 0xc], 0
mov dword [ebp - 4], 1
mov eax, dword [ebx + 8]
mov ecx, dword [ebx + 0x1c]
inc eax
movss xmm3, dword [ebx]
movd xmm0, eax
cvtdq2pd xmm0, xmm0
shr eax, 0x1f
addsd xmm0, qword [eax*8 + 0x1012d270]
mov eax, ecx
shr eax, 0x1f
cvtpd2ps xmm2, xmm0
movd xmm0, ecx
cvtdq2pd xmm0, xmm0
movaps xmm1, xmm2
addsd xmm0, qword [eax*8 + 0x1012d270]
cvtpd2ps xmm0, xmm0
divss xmm1, xmm0
comiss xmm1, xmm3
jbe 0x100bd663
divss xmm2, xmm3
sub esp, 8
movss dword [ebp - 0x10], xmm2
fld dword [ebp - 0x10]
fstp qword [esp]
call sub.api_ms_win_crt_math_l1_1_0.dll_ceil
add esp, 8
fstp dword [ebp - 0x10]
movss xmm0, dword [ebp - 0x10]
call fcn.1010c090
mov ecx, 8
cmp eax, ecx
cmova ecx, eax
mov eax, dword [ebx + 0x1c]
cmp eax, ecx
jae 0x100bd645
cmp eax, 0x200
jae 0x100bd643
shl eax, 3
cmp eax, ecx
jae 0x100bd645
mov eax, ecx
push eax
mov ecx, ebx
call fcn.100862b0
push dword [ebp - 0x14]
lea eax, [esi + 8]
mov ecx, ebx
push eax
lea eax, [ebp - 0x1c]
push eax
call fcn.100bd470
mov edx, dword [eax]
jmp 0x100bd666
mov edx, dword [ebp - 0x1c]
mov eax, dword [edx + 4]
inc dword [ebx + 8]
mov edi, dword [ebp - 0x28]
mov dword [esi + 4], eax
mov dword [esi], edx
mov dword [eax], esi
mov dword [edx + 4], esi
mov ecx, dword [ebx + 0xc]
mov dword [ebp - 0x10], eax
mov eax, dword [ebx + 0x18]
and eax, dword [ebp - 0x14]
mov ebx, dword [ecx + eax*8]
cmp ebx, dword [edi]
jne 0x100bd691
mov dword [ecx + eax*8], esi
jmp 0x100bd6a3
cmp ebx, edx
jne 0x100bd69a
mov dword [ecx + eax*8], esi
jmp 0x100bd6a7
mov edx, dword [ebp - 0x10]
cmp dword [ecx + eax*8 + 4], edx
jne 0x100bd6a7
mov dword [ecx + eax*8 + 4], esi
mov edi, dword [ebp - 0x20]
mov dword [edi], esi
mov byte [edi + 4], 1
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x100bdbb0
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10116ac5
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
push ebx
push esi
push edi
mov eax, dword [0x10139040]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov edx, dword [ebp + 0xc]
mov edi, dword [ebp + 8]
mov dword [ebp - 0x10], edx
mov dword [ebp - 0x20], edi
movzx eax, byte [edx]
xor eax, 0x811c9dc5
imul ecx, eax, 0x1000193
movzx eax, byte [edx + 1]
xor ecx, eax
movzx eax, byte [edx + 2]
imul ecx, ecx, 0x1000193
xor ecx, eax
movzx eax, byte [edx + 3]
imul ecx, ecx, 0x1000193
xor ecx, eax
imul eax, ecx, 0x1000193
mov ecx, ebx
push eax
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x1c]
push edx
push eax
call fcn.100bd470
mov eax, dword [ebp - 0x18]
test eax, eax
je 0x100bdc3a
mov dword [edi], eax
mov byte [edi + 4], 0
jmp 0x100bdd82
cmp dword [ebx + 8], 0xfffffff
jne 0x100bdc4e
push str.unordered_map_set_too_long
call dword [sym.imp.MSVCP140.dll_void___cdecl_std::_Xlength_error_char_const__]
lea eax, [ebx + 4]
mov dword [ebp - 0x28], eax
mov dword [ebp - 4], 0
push 0x10
mov dword [ebp - 0x24], 0
call fcn.1010b478
mov edx, dword [ebp - 0x10]
mov esi, eax
add esp, 4
mov dword [ebp - 0x24], esi
mov ecx, dword [edx]
mov edx, dword [edx + 4]
mov dword [esi + 8], ecx
mov dword [esi + 0xc], edx
mov dword [ebp - 4], 1
mov eax, dword [ebx + 8]
mov ecx, dword [ebx + 0x1c]
inc eax
movss xmm3, dword [ebx]
movd xmm0, eax
cvtdq2pd xmm0, xmm0
shr eax, 0x1f
addsd xmm0, qword [eax*8 + 0x1012d270]
mov eax, ecx
shr eax, 0x1f
cvtpd2ps xmm2, xmm0
movd xmm0, ecx
cvtdq2pd xmm0, xmm0
movaps xmm1, xmm2
addsd xmm0, qword [eax*8 + 0x1012d270]
cvtpd2ps xmm0, xmm0
divss xmm1, xmm0
comiss xmm1, xmm3
jbe 0x100bdd35
divss xmm2, xmm3
sub esp, 8
movss dword [ebp - 0x10], xmm2
fld dword [ebp - 0x10]
fstp qword [esp]
call sub.api_ms_win_crt_math_l1_1_0.dll_ceil
add esp, 8
fstp dword [ebp - 0x10]
movss xmm0, dword [ebp - 0x10]
call fcn.1010c090
mov ecx, 8
cmp eax, ecx
cmova ecx, eax
mov eax, dword [ebx + 0x1c]
cmp eax, ecx
jae 0x100bdd17
cmp eax, 0x200
jae 0x100bdd15
shl eax, 3
cmp eax, ecx
jae 0x100bdd17
mov eax, ecx
push eax
mov ecx, ebx
call fcn.100862b0
push dword [ebp - 0x14]
lea eax, [esi + 8]
mov ecx, ebx
push eax
lea eax, [ebp - 0x1c]
push eax
call fcn.100bd470
mov edx, dword [eax]
jmp 0x100bdd38
mov edx, dword [ebp - 0x1c]
mov eax, dword [edx + 4]
inc dword [ebx + 8]
mov edi, dword [ebp - 0x28]
mov dword [esi + 4], eax
mov dword [esi], edx
mov dword [eax], esi
mov dword [edx + 4], esi
mov ecx, dword [ebx + 0xc]
mov dword [ebp - 0x10], eax
mov eax, dword [ebx + 0x18]
and eax, dword [ebp - 0x14]
mov ebx, dword [ecx + eax*8]
cmp ebx, dword [edi]
jne 0x100bdd63
mov dword [ecx + eax*8], esi
jmp 0x100bdd75
cmp ebx, edx
jne 0x100bdd6c
mov dword [ecx + eax*8], esi
jmp 0x100bdd79
mov edx, dword [ebp - 0x10]
cmp dword [ecx + eax*8 + 4], edx
jne 0x100bdd79
mov dword [ecx + eax*8 + 4], esi
mov edi, dword [ebp - 0x20]
mov dword [edi], esi
mov byte [edi + 4], 1
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x100c8ed0
Capabilities:
Encode data using xor
Hash data using djb2

Disassembly:
sub esp, 0x18
mov eax, dword [0x10139040]
xor eax, esp
mov dword [esp + 0x14], eax
push esi
mov esi, dword [esp + 0x20]
test esi, esi
je 0x100c8f9b
lea eax, [esp + 4]
push eax
push esi
push 2
call fcn.100e4b70
add esp, 0xc
test eax, eax
jne 0x100c8f9b
lea eax, [esp + 8]
push eax
push esi
push 0x17
call fcn.100e4b70
add esp, 0xc
test eax, eax
jne 0x100c8f9b
push ebx
push edi
mov edi, esi
xor ebx, ebx
lea ecx, [edi + 1]
mov al, byte [edi]
inc edi
test al, al
jne 0x100c8f24
sub edi, ecx
push edi
push 0x2e
push esi
call fcn.100e4b40
add esp, 0xc
test eax, eax
je 0x100c8f58
sub eax, esi
push eax
push 0x2e
push esi
call fcn.100e4b40
mov ebx, eax
add esp, 0xc
test ebx, ebx
je 0x100c8f5a
inc ebx
mov ecx, esi
sub ecx, ebx
add edi, ecx
test ebx, ebx
cmovne esi, ebx
mov ebx, 0x1505
add edi, esi
cmp esi, edi
jae 0x100c8f86
mov al, byte [esi]
push eax
call fcn.100d7ca0
movsx ecx, al
inc esi
mov eax, ebx
add esp, 4
shl eax, 5
add eax, ebx
xor ecx, eax
mov ebx, ecx
cmp esi, edi
jb 0x100c8f68
pop edi
movzx eax, bl
pop ebx
pop esi
mov ecx, dword [esp + 0x14]
xor ecx, esp
call fcn.1010b45c
add esp, 0x18
ret
mov ecx, dword [esp + 0x18]
xor eax, eax
pop esi
xor ecx, esp
call fcn.1010b45c
add esp, 0x18
ret