joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100f4300
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10123c55
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x10
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
movzx eax, byte [edi]
xor eax, 0x811c9dc5
imul ecx, eax, 0x1000193
movzx eax, byte [edi + 1]
xor ecx, eax
movzx eax, byte [edi + 2]
imul ecx, ecx, 0x1000193
xor ecx, eax
movzx eax, byte [edi + 3]
imul ecx, ecx, 0x1000193
xor ecx, eax
lea eax, [ebp - 0x14]
imul ebx, ecx, 0x1000193
push ebx
push edi
push eax
call fcn.100f4650
mov ecx, dword [ebp - 0x10]
test ecx, ecx
je 0x100f4381
mov eax, dword [ebp + 8]
mov dword [eax], ecx
mov byte [eax + 4], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
cmp dword [0x101cd3e8], 0xfffffff
jne 0x100f4398
push str.unordered_map_set_too_long
call dword [sym.imp.MSVCP140.dll_void___cdecl_std::_Xlength_error_char_const__]
mov dword [ebp - 0x1c], 0x101cd3e4
mov dword [ebp - 4], 0
push 0x10
mov dword [ebp - 0x18], 0
call fcn.10121fbe
mov ecx, dword [edi]
mov esi, eax
add esp, 4
mov dword [ebp - 0x18], esi
mov dword [esi + 8], ecx
mov dword [esi + 0xc], 0
mov dword [ebp - 4], 1
mov ecx, dword [0x101cd3e8]
mov edi, dword [0x101cd3fc]
lea eax, [ecx + 1]
movd xmm0, eax
cvtdq2pd xmm0, xmm0
shr eax, 0x1f
addsd xmm0, qword [eax*8 + 0x10197f30]
mov eax, edi
shr eax, 0x1f
cvtpd2ps xmm3, xmm0
movd xmm0, edi
cvtdq2pd xmm0, xmm0
movaps xmm2, xmm3
addsd xmm0, qword [eax*8 + 0x10197f30]
cvtpd2ps xmm1, xmm0
movss xmm0, dword [0x101cd3e0]
divss xmm2, xmm1
comiss xmm2, xmm0
jbe 0x100f4472
divss xmm3, xmm0
movaps xmm0, xmm3
call fcn.1000f8a0
call fcn.10123350
mov ecx, 8
cmp eax, ecx
cmova ecx, eax
cmp edi, ecx
jae 0x100f4454
cmp edi, 0x200
jae 0x100f4452
shl edi, 3
cmp edi, ecx
jae 0x100f4454
mov edi, ecx
push edi
call fcn.100f44e0
push ebx
lea eax, [esi + 8]
push eax
lea eax, [ebp - 0x1c]
push eax
call fcn.100f4650
mov ecx, dword [0x101cd3e8]
mov edx, dword [eax]
jmp 0x100f4475
mov edx, dword [ebp - 0x14]
mov edi, dword [edx + 4]
inc ecx
mov dword [0x101cd3e8], ecx
mov dword [esi], edx
mov dword [esi + 4], edi
mov dword [edi], esi
mov dword [edx + 4], esi
mov eax, dword [0x101cd3f8]
mov ecx, dword [0x101cd3ec]
and eax, ebx
mov ebx, dword [ecx + eax*8]
cmp ebx, dword [0x101cd3e4]
jne 0x100f44a6
mov dword [ecx + eax*8], esi
jmp 0x100f44b5
cmp ebx, edx
jne 0x100f44af
mov dword [ecx + eax*8], esi
jmp 0x100f44b9
cmp dword [ecx + eax*8 + 4], edi
jne 0x100f44b9
mov dword [ecx + eax*8 + 4], esi
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
pop edi
mov dword [eax], esi
pop esi
mov byte [eax + 4], 1
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x100f44e0
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1fffffff
sub esp, 8
bsr ecx, eax
push ebx
push esi
push edi
mov edi, 1
mov eax, edi
shl eax, cl
mov ecx, dword [ebp + 8]
cmp ecx, eax
jbe 0x100f450c
push str.invalid_hash_bucket_count
call dword [sym.imp.MSVCP140.dll_void___cdecl_std::_Xlength_error_char_const__]
lea eax, [ecx - 1]
mov esi, dword [0x101cd3e4]
or eax, 1
mov dword [ebp + 8], esi
bsr ecx, eax
push esi
lea ecx, [ecx + 1]
shl edi, cl
mov ecx, 0x101cd3ec
lea eax, [edi + edi]
push eax
call fcn.10014500
mov eax, dword [0x101cd3e4]
lea ebx, [edi - 1]
mov dword [0x101cd3f8], ebx
mov dword [0x101cd3fc], edi
mov eax, dword [eax]
mov ecx, eax
cmp eax, esi
je 0x100f4646
movzx edx, byte [eax + 8]
xor edx, 0x811c9dc5
mov ecx, dword [ecx]
imul edi, edx, 0x1000193
movzx edx, byte [eax + 9]
xor edi, edx
movzx edx, byte [eax + 0xa]
imul edi, edi, 0x1000193
xor edi, edx
movzx edx, byte [eax + 0xb]
imul edi, edi, 0x1000193
xor edi, edx
mov edx, dword [0x101cd3ec]
imul edi, edi, 0x1000193
and edi, ebx
mov ebx, dword [edx + edi*8]
lea edx, [edx + edi*8]
mov dword [ebp - 4], edx
cmp ebx, esi
jne 0x100f45a4
mov dword [edx], eax
mov dword [edx + 4], eax
jmp 0x100f4611
mov edx, dword [edx + 4]
mov edi, dword [eax + 8]
cmp edi, dword [edx + 8]
jne 0x100f45de
mov edx, dword [edx]
mov dword [ebp - 8], edx
cmp edx, eax
je 0x100f45d6
mov ebx, dword [eax + 4]
mov esi, dword [ebp - 8]
mov dword [ebx], ecx
mov edi, dword [ecx + 4]
mov dword [edi], edx
mov edx, dword [edx + 4]
mov dword [edx], eax
mov dword [esi + 4], edi
mov esi, dword [ebp + 8]
mov dword [ecx + 4], ebx
mov dword [eax + 4], edx
mov edx, dword [ebp - 4]
mov dword [edx + 4], eax
jmp 0x100f4611
cmp ebx, edx
je 0x100f45ee
mov edx, dword [edx + 4]
cmp edi, dword [edx + 8]
je 0x100f4622
cmp ebx, edx
jne 0x100f45e2
mov ebx, dword [eax + 4]
mov dword [ebp - 8], ebx
mov dword [ebx], ecx
mov ebx, dword [ecx + 4]
mov dword [ebx], edx
mov edi, dword [edx + 4]
mov dword [edi], eax
mov dword [edx + 4], ebx
mov edx, dword [ebp - 8]
mov dword [ecx + 4], edx
mov edx, dword [ebp - 4]
mov dword [eax + 4], edi
mov dword [edx], eax
mov eax, ecx
cmp ecx, esi
je 0x100f4646
mov ebx, dword [0x101cd3f8]
jmp 0x100f4552
mov ebx, dword [eax + 4]
mov edx, dword [edx]
mov dword [ebp - 8], edx
mov esi, edx
mov dword [ebx], ecx
mov edi, dword [ecx + 4]
mov dword [edi], edx
mov edx, dword [edx + 4]
mov dword [edx], eax
mov dword [esi + 4], edi
mov esi, dword [ebp + 8]
mov dword [ecx + 4], ebx
mov dword [eax + 4], edx
jmp 0x100f4611
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x100f7a60
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
cmp byte [0x102b769a], 0
je 0x100f7a8a
cmp byte [0x102b78c4], 0
je 0x100f7a8a
mov ecx, dword [0x101cf52c]
push str.lastdisguise
mov eax, dword [ecx]
mov eax, dword [eax + 0x1a8]
call eax
push ebx
mov ebx, dword [0x101c93ac]
push edi
mov edi, dword [0x101c93a8]
mov byte [0x102b7401], 0
mov byte [0x102b78c4], 0
test edi, edi
je 0x100f7c1b
test ebx, ebx
je 0x100f7c1b
cmp byte [0x102b7691], 0
je 0x100f7c1b
mov eax, dword fs:[0x2c]
mov ecx, dword [0x101cf110]
mov ecx, dword [eax + ecx*4]
mov eax, dword [0x102ba150]
cmp eax, dword [ecx + 4]
jle 0x100f7b16
push 0x102ba150
call fcn.10121ee8
add esp, 4
cmp dword [0x102ba150], 0xffffffff
jne 0x100f7b16
push 0x102ba150
mov dword [0x102ba158], 0
mov dword [0x102ba154], 0x101a72d0
call fcn.10121e9e
add esp, 4
mov eax, dword [0x101a72d0]
test eax, eax
je 0x100f7b5f
mov ecx, dword [0x102ba154]
mov ecx, dword [ecx]
test ecx, ecx
jne 0x100f7b35
mov dword [0x102ba158], ecx
xor dl, dl
jmp 0x100f7b53
push ecx
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
movzx edx, ax
mov eax, dword [0x101a72d0]
shr edx, 0xf
and dl, 1
movzx ecx, dl
mov dword [0x102ba158], ecx
test dl, dl
jne 0x100f7b5f
test eax, eax
jne 0x100f7c1b
mov ecx, dword [0x101cf5b8]
mov eax, dword [ecx]
mov eax, dword [eax + 8]
call eax
test al, al
jne 0x100f7c1b
mov ecx, dword [0x101cf678]
mov eax, dword [ecx]
mov eax, dword [eax + 0xd4]
call eax
test al, al
jne 0x100f7c1b
cmp byte [0x101cf550], al
jne 0x100f7c1b
push esi
mov esi, dword [ebp + 8]
push esi
push ecx
push edi
call fcn.100f5ec0
cmp byte [0x102b7699], 0
je 0x100f7c02
cmp byte [0x101cf6b0], 0
je 0x100f7c02
mov eax, dword [ebx]
mov ecx, ebx
mov eax, dword [eax + 0x5f4]
call eax
cmp eax, 7
jne 0x100f7c02
cmp byte [0x102b7697], 0
push esi
push ecx
push edi
mov ecx, 0x102b78bc
je 0x100f7bdf
call fcn.100f6b10
jmp 0x100f7be4
call fcn.100f67e0
test byte [esi + 0x24], 1
mov ecx, 1
movzx eax, byte [0x101cf589]
cmovne eax, ecx
mov byte [0x102b7401], cl
mov byte [0x101cf589], al
push esi
push ecx
push edi
call fcn.100442e0
push esi
push ebx
push edi
call fcn.10042c70
push esi
push ebx
push edi
call fcn.100463f0
pop esi
pop edi
pop ebx
pop ebp
ret 4
Function at 0x100fd900
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10129d85
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x10
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
movzx eax, byte [edi]
xor eax, 0x811c9dc5
imul ecx, eax, 0x1000193
movzx eax, byte [edi + 1]
xor ecx, eax
movzx eax, byte [edi + 2]
imul ecx, ecx, 0x1000193
xor ecx, eax
movzx eax, byte [edi + 3]
imul ecx, ecx, 0x1000193
xor ecx, eax
lea eax, [ebp - 0x14]
imul ebx, ecx, 0x1000193
push ebx
push edi
push eax
call fcn.100fdc50
mov ecx, dword [ebp - 0x10]
test ecx, ecx
je 0x100fd981
mov eax, dword [ebp + 8]
mov dword [eax], ecx
mov byte [eax + 4], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
cmp dword [0x102b2cb0], 0xccccccc
jne 0x100fd998
push str.unordered_map_set_too_long
call dword [sym.imp.MSVCP140.dll_void___cdecl_std::_Xlength_error_char_const__]
mov dword [ebp - 0x1c], 0x102b2cac
mov dword [ebp - 4], 0
push 0x14
mov dword [ebp - 0x18], 0
call fcn.10121fbe
mov ecx, dword [edi]
mov esi, eax
add esp, 4
mov dword [ebp - 0x18], esi
mov dword [esi + 8], ecx
mov dword [esi + 0xc], 0
mov dword [esi + 0x10], 0
mov dword [ebp - 4], 1
mov ecx, dword [0x102b2cb0]
mov edi, dword [0x102b2cc4]
lea eax, [ecx + 1]
movd xmm0, eax
cvtdq2pd xmm0, xmm0
shr eax, 0x1f
addsd xmm0, qword [eax*8 + 0x10197f30]
mov eax, edi
shr eax, 0x1f
cvtpd2ps xmm3, xmm0
movd xmm0, edi
cvtdq2pd xmm0, xmm0
movaps xmm2, xmm3
addsd xmm0, qword [eax*8 + 0x10197f30]
cvtpd2ps xmm1, xmm0
movss xmm0, dword [0x102b2ca8]
divss xmm2, xmm1
comiss xmm2, xmm0
jbe 0x100fda79
divss xmm3, xmm0
movaps xmm0, xmm3
call fcn.1000f8a0
call fcn.10123350
mov ecx, 8
cmp eax, ecx
cmova ecx, eax
cmp edi, ecx
jae 0x100fda5b
cmp edi, 0x200
jae 0x100fda59
shl edi, 3
cmp edi, ecx
jae 0x100fda5b
mov edi, ecx
push edi
call fcn.100fdae0
push ebx
lea eax, [esi + 8]
push eax
lea eax, [ebp - 0x1c]
push eax
call fcn.100fdc50
mov ecx, dword [0x102b2cb0]
mov edx, dword [eax]
jmp 0x100fda7c
mov edx, dword [ebp - 0x14]
mov edi, dword [edx + 4]
inc ecx
mov dword [0x102b2cb0], ecx
mov dword [esi], edx
mov dword [esi + 4], edi
mov dword [edi], esi
mov dword [edx + 4], esi
mov eax, dword [0x102b2cc0]
mov ecx, dword [0x102b2cb4]
and eax, ebx
mov ebx, dword [ecx + eax*8]
cmp ebx, dword [0x102b2cac]
jne 0x100fdaad
mov dword [ecx + eax*8], esi
jmp 0x100fdabc
cmp ebx, edx
jne 0x100fdab6
mov dword [ecx + eax*8], esi
jmp 0x100fdac0
cmp dword [ecx + eax*8 + 4], edi
jne 0x100fdac0
mov dword [ecx + eax*8 + 4], esi
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
pop edi
mov dword [eax], esi
pop esi
mov byte [eax + 4], 1
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x100fdae0
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1fffffff
sub esp, 8
bsr ecx, eax
push ebx
push esi
push edi
mov edi, 1
mov eax, edi
shl eax, cl
mov ecx, dword [ebp + 8]
cmp ecx, eax
jbe 0x100fdb0c
push str.invalid_hash_bucket_count
call dword [sym.imp.MSVCP140.dll_void___cdecl_std::_Xlength_error_char_const__]
lea eax, [ecx - 1]
mov esi, dword [0x102b2cac]
or eax, 1
mov dword [ebp + 8], esi
bsr ecx, eax
push esi
lea ecx, [ecx + 1]
shl edi, cl
mov ecx, 0x102b2cb4
lea eax, [edi + edi]
push eax
call fcn.10014500
mov eax, dword [0x102b2cac]
lea ebx, [edi - 1]
mov dword [0x102b2cc0], ebx
mov dword [0x102b2cc4], edi
mov eax, dword [eax]
mov ecx, eax
cmp eax, esi
je 0x100fdc46
movzx edx, byte [eax + 8]
xor edx, 0x811c9dc5
mov ecx, dword [ecx]
imul edi, edx, 0x1000193
movzx edx, byte [eax + 9]
xor edi, edx
movzx edx, byte [eax + 0xa]
imul edi, edi, 0x1000193
xor edi, edx
movzx edx, byte [eax + 0xb]
imul edi, edi, 0x1000193
xor edi, edx
mov edx, dword [0x102b2cb4]
imul edi, edi, 0x1000193
and edi, ebx
mov ebx, dword [edx + edi*8]
lea edx, [edx + edi*8]
mov dword [ebp - 4], edx
cmp ebx, esi
jne 0x100fdba4
mov dword [edx], eax
mov dword [edx + 4], eax
jmp 0x100fdc11
mov edx, dword [edx + 4]
mov edi, dword [eax + 8]
cmp edi, dword [edx + 8]
jne 0x100fdbde
mov edx, dword [edx]
mov dword [ebp - 8], edx
cmp edx, eax
je 0x100fdbd6
mov ebx, dword [eax + 4]
mov esi, dword [ebp - 8]
mov dword [ebx], ecx
mov edi, dword [ecx + 4]
mov dword [edi], edx
mov edx, dword [edx + 4]
mov dword [edx], eax
mov dword [esi + 4], edi
mov esi, dword [ebp + 8]
mov dword [ecx + 4], ebx
mov dword [eax + 4], edx
mov edx, dword [ebp - 4]
mov dword [edx + 4], eax
jmp 0x100fdc11
cmp ebx, edx
je 0x100fdbee
mov edx, dword [edx + 4]
cmp edi, dword [edx + 8]
je 0x100fdc22
cmp ebx, edx
jne 0x100fdbe2
mov ebx, dword [eax + 4]
mov dword [ebp - 8], ebx
mov dword [ebx], ecx
mov ebx, dword [ecx + 4]
mov dword [ebx], edx
mov edi, dword [edx + 4]
mov dword [edi], eax
mov dword [edx + 4], ebx
mov edx, dword [ebp - 8]
mov dword [ecx + 4], edx
mov edx, dword [ebp - 4]
mov dword [eax + 4], edi
mov dword [edx], eax
mov eax, ecx
cmp ecx, esi
je 0x100fdc46
mov ebx, dword [0x102b2cc0]
jmp 0x100fdb52
mov ebx, dword [eax + 4]
mov edx, dword [edx]
mov dword [ebp - 8], edx
mov esi, edx
mov dword [ebx], ecx
mov edi, dword [ecx + 4]
mov dword [edi], edx
mov edx, dword [edx + 4]
mov dword [edx], eax
mov dword [esi + 4], edi
mov esi, dword [ebp + 8]
mov dword [ecx + 4], ebx
mov dword [eax + 4], edx
jmp 0x100fdc11
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x100ffbc0
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1012a155
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x10
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
movzx eax, byte [edi]
xor eax, 0x811c9dc5
imul ecx, eax, 0x1000193
movzx eax, byte [edi + 1]
xor ecx, eax
movzx eax, byte [edi + 2]
imul ecx, ecx, 0x1000193
xor ecx, eax
movzx eax, byte [edi + 3]
imul ecx, ecx, 0x1000193
xor ecx, eax
lea eax, [ebp - 0x14]
imul ebx, ecx, 0x1000193
push ebx
push edi
push eax
call fcn.100fff30
mov ecx, dword [ebp - 0x10]
test ecx, ecx
je 0x100ffc41
mov eax, dword [ebp + 8]
mov dword [eax], ecx
mov byte [eax + 4], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
cmp dword [0x101c9194], 0x7ffffff
jne 0x100ffc58
push str.unordered_map_set_too_long
call dword [sym.imp.MSVCP140.dll_void___cdecl_std::_Xlength_error_char_const__]
mov dword [ebp - 0x1c], 0x101c9190
mov dword [ebp - 4], 0
push 0x20
mov dword [ebp - 0x18], 0
call fcn.10121fbe
mov ecx, dword [edi]
mov esi, eax
mov dword [ebp - 0x18], esi
add esp, 4
mov dword [esi + 8], ecx
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
mov dword [esi + 0x18], 0
mov dword [esi + 0x1c], 0
mov dword [esi + 0x14], 0
mov dword [esi + 0x10], 0
mov dword [esi + 0xc], 0
mov dword [ebp - 4], 1
mov ecx, dword [0x101c9194]
mov edi, dword [0x101c91a8]
lea eax, [ecx + 1]
movd xmm0, eax
cvtdq2pd xmm0, xmm0
shr eax, 0x1f
addsd xmm0, qword [eax*8 + 0x10197f30]
mov eax, edi
shr eax, 0x1f
cvtpd2ps xmm3, xmm0
movd xmm0, edi
cvtdq2pd xmm0, xmm0
movaps xmm2, xmm3
addsd xmm0, qword [eax*8 + 0x10197f30]
cvtpd2ps xmm1, xmm0
movss xmm0, dword [0x101c918c]
divss xmm2, xmm1
comiss xmm2, xmm0
jbe 0x100ffd5c
divss xmm3, xmm0
movaps xmm0, xmm3
call fcn.1000f8a0
call fcn.10123350
mov ecx, 8
cmp eax, ecx
cmova ecx, eax
cmp edi, ecx
jae 0x100ffd3e
cmp edi, 0x200
jae 0x100ffd3c
shl edi, 3
cmp edi, ecx
jae 0x100ffd3e
mov edi, ecx
push edi
call fcn.100ffdc0
push ebx
lea eax, [esi + 8]
push eax
lea eax, [ebp - 0x1c]
push eax
call fcn.100fff30
mov ecx, dword [0x101c9194]
mov edx, dword [eax]
jmp 0x100ffd5f
mov edx, dword [ebp - 0x14]
mov edi, dword [edx + 4]
inc ecx
mov dword [0x101c9194], ecx
mov dword [esi], edx
mov dword [esi + 4], edi
mov dword [edi], esi
mov dword [edx + 4], esi
mov eax, dword [0x101c91a4]
mov ecx, dword [0x101c9198]
and eax, ebx
mov ebx, dword [ecx + eax*8]
cmp ebx, dword [0x101c9190]
jne 0x100ffd90
mov dword [ecx + eax*8], esi
jmp 0x100ffd9f
cmp ebx, edx
jne 0x100ffd99
mov dword [ecx + eax*8], esi
jmp 0x100ffda3
cmp dword [ecx + eax*8 + 4], edi
jne 0x100ffda3
mov dword [ecx + eax*8 + 4], esi
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
pop edi
mov dword [eax], esi
pop esi
mov byte [eax + 4], 1
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x100ffdc0
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1fffffff
sub esp, 8
bsr ecx, eax
push ebx
push esi
push edi
mov edi, 1
mov eax, edi
shl eax, cl
mov ecx, dword [ebp + 8]
cmp ecx, eax
jbe 0x100ffdec
push str.invalid_hash_bucket_count
call dword [sym.imp.MSVCP140.dll_void___cdecl_std::_Xlength_error_char_const__]
lea eax, [ecx - 1]
mov esi, dword [0x101c9190]
or eax, 1
mov dword [ebp + 8], esi
bsr ecx, eax
push esi
lea ecx, [ecx + 1]
shl edi, cl
mov ecx, 0x101c9198
lea eax, [edi + edi]
push eax
call fcn.10014500
mov eax, dword [0x101c9190]
lea ebx, [edi - 1]
mov dword [0x101c91a4], ebx
mov dword [0x101c91a8], edi
mov eax, dword [eax]
mov ecx, eax
cmp eax, esi
je 0x100fff26
movzx edx, byte [eax + 8]
xor edx, 0x811c9dc5
mov ecx, dword [ecx]
imul edi, edx, 0x1000193
movzx edx, byte [eax + 9]
xor edi, edx
movzx edx, byte [eax + 0xa]
imul edi, edi, 0x1000193
xor edi, edx
movzx edx, byte [eax + 0xb]
imul edi, edi, 0x1000193
xor edi, edx
mov edx, dword [0x101c9198]
imul edi, edi, 0x1000193
and edi, ebx
mov ebx, dword [edx + edi*8]
lea edx, [edx + edi*8]
mov dword [ebp - 4], edx
cmp ebx, esi
jne 0x100ffe84
mov dword [edx], eax
mov dword [edx + 4], eax
jmp 0x100ffef1
mov edx, dword [edx + 4]
mov edi, dword [eax + 8]
cmp edi, dword [edx + 8]
jne 0x100ffebe
mov edx, dword [edx]
mov dword [ebp - 8], edx
cmp edx, eax
je 0x100ffeb6
mov ebx, dword [eax + 4]
mov esi, dword [ebp - 8]
mov dword [ebx], ecx
mov edi, dword [ecx + 4]
mov dword [edi], edx
mov edx, dword [edx + 4]
mov dword [edx], eax
mov dword [esi + 4], edi
mov esi, dword [ebp + 8]
mov dword [ecx + 4], ebx
mov dword [eax + 4], edx
mov edx, dword [ebp - 4]
mov dword [edx + 4], eax
jmp 0x100ffef1
cmp ebx, edx
je 0x100ffece
mov edx, dword [edx + 4]
cmp edi, dword [edx + 8]
je 0x100fff02
cmp ebx, edx
jne 0x100ffec2
mov ebx, dword [eax + 4]
mov dword [ebp - 8], ebx
mov dword [ebx], ecx
mov ebx, dword [ecx + 4]
mov dword [ebx], edx
mov edi, dword [edx + 4]
mov dword [edi], eax
mov dword [edx + 4], ebx
mov edx, dword [ebp - 8]
mov dword [ecx + 4], edx
mov edx, dword [ebp - 4]
mov dword [eax + 4], edi
mov dword [edx], eax
mov eax, ecx
cmp ecx, esi
je 0x100fff26
mov ebx, dword [0x101c91a4]
jmp 0x100ffe32
mov ebx, dword [eax + 4]
mov edx, dword [edx]
mov dword [ebp - 8], edx
mov esi, edx
mov dword [ebx], ecx
mov edi, dword [ecx + 4]
mov dword [edi], edx
mov edx, dword [edx + 4]
mov dword [edx], eax
mov dword [esi + 4], edi
mov esi, dword [ebp + 8]
mov dword [ecx + 4], ebx
mov dword [eax + 4], edx
jmp 0x100ffef1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x10107730
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov ebx, ecx
mov edx, ebx
push esi
push edi
mov edi, 0x811c9dc5
xor esi, esi
lea ecx, [edx + 1]
mov al, byte [edx]
inc edx
test al, al
jne 0x10107745
sub edx, ecx
je 0x1010776f
movsx eax, byte [esi + ebx]
mov ecx, ebx
xor eax, edi
imul edi, eax, 0x1000193
inc esi
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x10107762
sub ecx, edx
cmp esi, ecx
jb 0x10107750
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1010aa30
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
mov eax, dword fs:[0]
mov edx, dword [ebp + 0xc]
push 0xffffffffffffffff
push 0x1012b625
push eax
mov dword fs:[0], esp
sub esp, 0x10
cmp dword [edx + 0x14], 0x10
push ebx
push esi
push edi
mov ebx, ecx
mov edi, edx
jb 0x1010aa5d
mov edi, dword [edx]
xor ecx, ecx
mov esi, 0x811c9dc5
cmp dword [edx + 0x10], ecx
jbe 0x1010aa82
nop dword [eax]
movzx eax, byte [ecx + edi]
inc ecx
xor eax, esi
imul esi, eax, 0x1000193
cmp ecx, dword [edx + 0x10]
jb 0x1010aa70
push esi
push edx
lea eax, [ebp - 0x14]
mov ecx, ebx
push eax
call fcn.10016130
mov ecx, dword [ebp - 0x10]
test ecx, ecx
je 0x1010aab2
mov eax, dword [ebp + 8]
mov dword [eax], ecx
mov byte [eax + 4], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
cmp dword [ebx + 8], 0x71c71c7
jne 0x1010aac6
push str.unordered_map_set_too_long
call dword [sym.imp.MSVCP140.dll_void___cdecl_std::_Xlength_error_char_const__]
lea eax, [ebx + 4]
mov dword [ebp - 0x1c], eax
mov dword [ebp - 4], 0
push 0x24
mov dword [ebp - 0x18], 0
call fcn.10121fbe
add esp, 4
mov edi, eax
mov dword [ebp - 0x18], edi
push dword [ebp + 0xc]
lea ecx, [edi + 8]
call fcn.10020b40
mov dword [edi + 0x20], 0
mov dword [ebp - 4], 1
mov eax, dword [ebx + 8]
inc eax
movss xmm3, dword [ebx]
movd xmm0, eax
cvtdq2pd xmm0, xmm0
shr eax, 0x1f
addsd xmm0, qword [eax*8 + 0x10197f30]
mov eax, dword [ebx + 0x1c]
movd xmm1, eax
cvtdq2pd xmm1, xmm1
shr eax, 0x1f
cvtpd2ps xmm0, xmm0
addsd xmm1, qword [eax*8 + 0x10197f30]
movaps xmm2, xmm0
cvtpd2ps xmm1, xmm1
divss xmm2, xmm1
comiss xmm2, xmm3
jbe 0x1010ab94
divss xmm0, xmm3
call fcn.1000f8a0
call fcn.10123350
mov ecx, 8
cmp eax, ecx
cmova ecx, eax
mov eax, dword [ebx + 0x1c]
cmp eax, ecx
jae 0x1010ab78
cmp eax, 0x200
jae 0x1010ab76
shl eax, 3
cmp eax, ecx
jae 0x1010ab78
mov eax, ecx
push eax
mov ecx, ebx
call fcn.1001f240
push esi
lea eax, [edi + 8]
mov ecx, ebx
push eax
lea eax, [ebp - 0x1c]
push eax
call fcn.10016130
mov edx, dword [eax]
jmp 0x1010ab97
mov edx, dword [ebp - 0x14]
mov eax, dword [edx + 4]
inc dword [ebx + 8]
mov dword [edi + 4], eax
mov dword [edi], edx
mov dword [eax], edi
mov dword [edx + 4], edi
mov ecx, dword [ebx + 0xc]
mov dword [ebp + 0xc], eax
mov eax, dword [ebx + 0x18]
and eax, esi
mov esi, dword [ecx + eax*8]
cmp esi, dword [ebx + 4]
jne 0x1010abbf
mov dword [ecx + eax*8], edi
jmp 0x1010abd1
cmp esi, edx
jne 0x1010abc8
mov dword [ecx + eax*8], edi
jmp 0x1010abd5
mov edx, dword [ebp + 0xc]
cmp dword [ecx + eax*8 + 4], edx
jne 0x1010abd5
mov dword [ecx + eax*8 + 4], edi
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
mov dword [eax], edi
pop edi
pop esi
mov byte [eax + 4], 1
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x1010ae70
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov ebx, dword [ebp + 0x18]
lea eax, [ebp - 4]
push edi
mov edi, dword [ebp + 8]
push eax
push 0x40
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
push ebx
push dword [ebp + 0xc]
push edi
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
lea eax, [ebp + 0x18]
push eax
push dword [ebp - 4]
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov edx, dword [ebp + 0xc]
pop edi
pop ebx
test edx, edx
je 0x1010aede
mov ecx, dword [ebp + 0x14]
mov eax, edx
sub ecx, edx
cmp ecx, 0x1000
jb 0x1010aed4
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x1010aed4
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push ecx
push edx
call fcn.10122308
add esp, 8
mov esp, ebp
pop ebp
ret 0x14