joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4cb100
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov edx, dword [ebp + 8]
mov eax, 0x1fffffff
push ebx
mov ebx, ecx
bsr ecx, eax
push esi
mov esi, 1
mov dword [ebp - 0x14], ebx
mov eax, esi
shl eax, cl
push edi
cmp edx, eax
ja 0x4cb293
lea eax, [edx - 1]
or eax, esi
bsr ecx, eax
mov eax, dword [ebx + 4]
push eax
mov dword [ebp - 4], eax
lea ecx, [ecx + 1]
shl esi, cl
lea ecx, [ebx + 0xc]
lea eax, [esi + esi]
push eax
call fcn.0049a5e0
mov ecx, dword [ebp - 4]
lea eax, [esi - 1]
mov dword [ebx + 0x18], eax
mov dword [ebx + 0x1c], esi
mov edi, dword [ebx + 4]
mov edi, dword [edi]
mov eax, edi
cmp edi, ecx
je 0x4cb26b
cmp dword [edi + 0x1c], 0x10
lea ebx, [edi + 8]
mov eax, dword [eax]
mov esi, dword [ebx + 0x10]
mov dword [ebp + 8], eax
mov dword [ebp - 0x10], esi
mov dword [ebp - 0xc], ebx
jb 0x4cb181
mov edx, dword [ebx]
mov dword [ebp - 0xc], edx
xor edx, edx
mov dword [ebp - 8], 0x811c9dc5
test esi, esi
je 0x4cb1b4
mov ecx, dword [ebp - 8]
mov ebx, dword [ebp - 0xc]
mov eax, dword [ebp - 0x10]
movzx esi, byte [edx + ebx]
inc edx
xor esi, ecx
imul ecx, esi, 0x1000193
cmp edx, eax
jb 0x4cb197
mov eax, dword [ebp + 8]
lea ebx, [edi + 8]
mov dword [ebp - 8], ecx
mov ecx, dword [ebp - 4]
mov edx, dword [ebp - 0x14]
mov esi, dword [edx + 0x18]
and esi, dword [ebp - 8]
mov edx, dword [edx + 0xc]
lea edx, [edx + esi*8]
mov esi, dword [edx]
mov dword [ebp - 8], edx
mov dword [ebp - 0xc], esi
cmp esi, ecx
jne 0x4cb1d9
mov dword [edx], edi
mov dword [edx + 4], edi
jmp 0x4cb261
mov esi, dword [edx + 4]
lea eax, [esi + 8]
push eax
push ebx
call fcn.00475f10
add esp, 8
test al, al
je 0x4cb216
mov ebx, dword [esi]
mov eax, dword [ebp + 8]
cmp ebx, edi
je 0x4cb20e
mov esi, dword [edi + 4]
mov dword [esi], eax
mov edx, dword [eax + 4]
mov dword [edx], ebx
mov ecx, dword [ebx + 4]
mov dword [ecx], edi
mov dword [ebx + 4], edx
mov dword [eax + 4], esi
mov dword [edi + 4], ecx
mov ecx, dword [ebp - 8]
mov dword [ecx + 4], edi
jmp 0x4cb25e
mov ebx, esi
cmp dword [ebp - 0xc], esi
je 0x4cb23e
nop dword [eax]
mov esi, dword [esi + 4]
mov ebx, esi
lea eax, [ebx + 8]
push eax
lea eax, [edi + 8]
push eax
call fcn.00475f10
add esp, 8
test al, al
jne 0x4cb274
cmp dword [ebp - 0xc], esi
jne 0x4cb220
mov esi, dword [edi + 4]
mov eax, dword [ebp + 8]
mov dword [esi], eax
mov edx, dword [eax + 4]
mov dword [edx], ebx
mov ecx, dword [ebx + 4]
mov dword [ecx], edi
mov dword [ebx + 4], edx
mov dword [eax + 4], esi
mov dword [edi + 4], ecx
mov ecx, dword [ebp - 8]
mov dword [ecx], edi
mov ecx, dword [ebp - 4]
mov edi, eax
cmp eax, ecx
jne 0x4cb165
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
mov ebx, dword [esi]
mov esi, dword [edi + 4]
mov eax, dword [ebp + 8]
mov dword [esi], eax
mov edx, dword [eax + 4]
mov dword [edx], ebx
mov ecx, dword [ebx + 4]
mov dword [ecx], edi
mov dword [ebx + 4], edx
mov dword [eax + 4], esi
mov dword [edi + 4], ecx
jmp 0x4cb25e
push str.invalid_hash_bucket_count
call fcn.006ab32d
int3
Function at 0x4d82a0
Capabilities:
Execute anti-debugging instructions

Disassembly:
push ebx
call fcn.004d8770
mov ebx, eax
push ebx
call fcn.006abda0
add esp, 4
test eax, eax
jne 0x4d8559
cmp byte [0x7efdb0], al
je 0x4d854e
push esi
mov esi, dword [0x7efdac]
push 0x161ef0
push eax
push esi
mov byte [0x7efdb0], al
call fcn.006c2360
add esp, 0xc
lea eax, [esi + 0x89dcc]
mov ecx, 0x161ef0
xchg dword [eax], ecx
mov esi, dword [0x7efdac]
mov ecx, 0x30
lea eax, [esi + 0x738]
nop
mov byte [eax], 0
lea eax, [eax + 0x5c]
sub ecx, 1
jne 0x4d8300
lea eax, [esi + 0x2f8]
mov ecx, 0x10
nop word [eax + eax]
mov byte [eax - 0x40], 0
lea eax, [eax + 0x48]
mov dword [eax - 0x48], 0
mov dword [eax - 0x44], 0
sub ecx, 1
jne 0x4d8320
mov dword [esi + 0x2b8], 0x61666564
lea eax, [esi + 0x1888]
mov dword [esi + 0x2bc], 0x746c75
mov ecx, 0x400
mov dword [esi + 8], 1
mov byte [eax], 0
lea eax, [eax + 0x60]
sub ecx, 1
jne 0x4d8360
mov dword [esi + 4], ecx
mov dword [esi + 0x30], ecx
mov dword [esi + 0x34], ecx
mov dword [esi + 0x38], ecx
mov dword [esi + 0x48], ecx
mov dword [esi + 0x4c], ecx
mov dword [esi + 0x50], ecx
mov dword [esi + 0x54], ecx
mov dword [esi + 0x68], ecx
mov dword [esi + 0x60], ecx
mov dword [esi + 0x64], ecx
mov dword [esi], ecx
mov dword [esi + 0x2c], 0x16
mov dword [esi + 0x6c], 1
mov dword [esi + 0x10], 0x3c
rdtsc
mov dword [esi + 0x20], eax
mov dword [esi + 0x24], edx
mov dword [esi + 0x88978], ecx
mov dword [esi + 0x8897c], ecx
mov dword [esi + 0x88d88], ecx
mov dword [esi + 0x88d8c], ecx
mov dword [esi + 0x89198], ecx
mov dword [esi + 0x8919c], ecx
mov dword [esi + 0x895a8], ecx
mov dword [esi + 0x895ac], ecx
mov dword [esi + 0x899b8], ecx
mov dword [esi + 0x899bc], ecx
lea ecx, [esi + 0x89dec]
push edi
mov dword [esi + 0x88], 1
mov edi, 0x200
mov dword [esi + 0x2b0], 0x420551ec
mov dword [esi + 0x2b4], 0x3cf5c8d9
rdtsc
mov dword [ecx - 4], 0
lea ecx, [ecx + 0x250]
mov dword [ecx - 0x250], 0
mov dword [ecx - 0x24c], 0
mov dword [ecx - 0x248], 0
mov dword [ecx - 0x244], 0
mov dword [ecx - 0x240], 0
mov dword [ecx - 0x23c], eax
mov dword [ecx - 0x238], edx
mov dword [ecx - 0x234], 0
mov dword [ecx - 0x230], 0
mov dword [ecx - 0x22c], 0xffffffff
mov word [ecx - 0xc], 0
mov dword [ecx - 0x28], 0
mov dword [ecx - 0x20], 0
mov dword [ecx - 0x24], 0
mov dword [ecx - 0x1c], 0
mov dword [ecx - 0x18], 0
mov dword [ecx - 0x14], 0
mov dword [ecx - 0x10], 0
sub edi, 1
jne 0x4d8413
mov dword [esi + 0xdfea8], edi
lea eax, [esi + 0x15feb0]
mov ecx, 0x200
pop edi
nop
mov dword [eax + 0x1000], 0xffffffff
lea eax, [eax + 8]
mov dword [eax + 0xffc], 0x7fffffff
mov dword [eax - 8], 0
mov dword [eax - 4], 0x80000000
sub ecx, 1
jne 0x4d84d0
push 2
push 0x71eeec
mov dword [esi + 0x161eb0], 0xffffffff
call fcn.004d04b0
mov dword [0x8134d4], eax
add esp, 8
mov dword [eax + 0x20], 1
mov dword [eax + 0x24], 0
mov eax, dword [0x7efdac]
pop esi
mov byte [eax + 0x161ee4], 0
mov dword [eax + 0x161ee8], 0
mov dword [eax + 0x9c], 0
mov byte [eax + 0xd7e80], 0
push ebx
call fcn.006abdfb
add esp, 4
pop ebx
ret
push eax
call fcn.006ac15c
int3
Function at 0x4d9dc0
Capabilities:
Check for time delay via queryperformancecounter
Execute anti-debugging instructions

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [0x98d498]
sub esp, 0x24
mov edx, dword [0x98d49c]
mov eax, ecx
or eax, edx
jne 0x4d9e75
push ebx
push esi
lea eax, [ebp - 0x24]
push eax
call dword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
mov esi, dword [sym.imp.KERNEL32.dll_Sleep]
push 1
call esi
rdtsc
mov dword [ebp - 4], eax
lea eax, [ebp - 0x1c]
push eax
mov dword [ebp - 8], edx
call dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
push 5
call esi
rdtsc
mov ebx, eax
mov esi, edx
lea eax, [ebp - 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
sub ebx, dword [ebp - 4]
mov ecx, ebx
sbb esi, dword [ebp - 8]
mov edx, esi
call fcn.006c0310
mov ecx, dword [ebp - 0x14]
sub ecx, dword [ebp - 0x1c]
mov edx, dword [ebp - 0x10]
sbb edx, dword [ebp - 0x18]
movsd qword [ebp - 0xc], xmm0
call fcn.006c0370
mov edx, dword [ebp - 0x20]
mov ecx, dword [ebp - 0x24]
movsd qword [ebp - 0x1c], xmm0
call fcn.006c0370
movsd xmm1, qword [ebp - 0x1c]
divsd xmm1, xmm0
movsd xmm0, qword [ebp - 0xc]
divsd xmm0, xmm1
call fcn.006c0260
pop esi
mov dword [0x98d498], eax
mov dword [0x98d49c], edx
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, ecx
mov esp, ebp
pop ebp
ret
Function at 0x4e5330
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
mov eax, dword fs:[0]
xorps xmm0, xmm0
push 0xffffffffffffffff
push 0x701a3d
push eax
mov dword fs:[0], esp
push esi
mov esi, dword [ebp + 0xc]
push edi
mov edi, dword [ebp + 8]
lea eax, [edi + 4]
push eax
mov dword [edi], vtable.std::exception.0
movq qword [eax], xmm0
lea eax, [esi + 4]
push eax
call fcn.006c1937
add esp, 8
mov dword [edi], vtable.boost::system::system_error.0
mov eax, dword [esi + 0xc]
mov ecx, dword [esi + 0x10]
mov dword [edi + 0xc], eax
lea eax, [esi + 0x14]
mov dword [edi + 0x10], ecx
lea ecx, [edi + 0x14]
push eax
mov dword [ebp - 4], 0
call fcn.00470690
mov ecx, dword [ebp - 0xc]
mov eax, edi
mov dword [edi + 0x2c], vtable.boost::exception.0
mov dword [edi + 0x30], 0
mov dword [edi + 0x34], 0
mov dword [edi + 0x38], 0
mov dword [edi + 0x3c], 0xffffffff
mov dword [edi], vtable.boost::exception_detail::error_info_injector_class_boost::thread_resource_error_.0
mov dword [edi + 0x2c], vtable.boost::exception_detail::error_info_injector_class_boost::thread_resource_error_.1.0
pop edi
mov dword fs:[0], ecx
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x4e5e20
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x701c25
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push esi
mov esi, ecx
xorps xmm0, xmm0
push edi
mov edi, dword [ebp + 8]
lea eax, [esi + 4]
mov dword [ebp - 0x10], esi
mov dword [esi], vtable.std::exception.0
push eax
movq qword [eax], xmm0
lea eax, [edi + 4]
push eax
call fcn.006c1937
add esp, 8
mov dword [esi], vtable.boost::system::system_error.0
mov eax, dword [edi + 0xc]
mov ecx, dword [edi + 0x10]
mov dword [esi + 0xc], eax
lea eax, [edi + 0x14]
mov dword [esi + 0x10], ecx
lea ecx, [esi + 0x14]
push eax
mov dword [ebp - 4], 0
call fcn.00470690
mov dword [esi], vtable.boost::thread_resource_error.0
mov dword [esi + 0x2c], vtable.boost::exception.0
mov ecx, dword [edi + 0x30]
mov dword [ebp - 4], 1
mov dword [esi + 0x30], ecx
test ecx, ecx
je 0x4e5ea8
mov eax, dword [ecx]
call dword [eax + 0xc]
mov eax, dword [edi + 0x34]
mov ecx, dword [ebp - 0xc]
mov dword [esi + 0x34], eax
mov eax, dword [edi + 0x38]
mov dword [esi + 0x38], eax
mov eax, dword [edi + 0x3c]
mov dword [esi + 0x3c], eax
mov eax, esi
mov dword [esi], vtable.boost::exception_detail::error_info_injector_class_boost::thread_resource_error_.0
mov dword [esi + 0x2c], vtable.boost::exception_detail::error_info_injector_class_boost::thread_resource_error_.1.0
pop edi
pop esi
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 4
Function at 0x4eaac0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
push ebx
mov ebx, dword [ebp + 0xc]
xorps xmm0, xmm0
push esi
push edi
xor edi, edi
mov dword [ebp - 4], ecx
movups xmmword [ebp - 0x24], xmm0
movups xmmword [ebp - 0x14], xmm0
test ebx, ebx
je 0x4eab17
mov eax, dword [ebp + 8]
lea esi, [ebp - 0x24]
xor ecx, ecx
movzx edx, byte [eax + edi]
mov eax, edx
and edx, 0x3f
shr eax, 6
lea esi, [esi + eax*8]
xor eax, eax
bts eax, edx
cmp edx, 0x20
cmovae ecx, eax
xor eax, ecx
cmp edx, 0x40
cmovae ecx, eax
or dword [esi], eax
or dword [esi + 4], ecx
inc edi
cmp edi, ebx
jne 0x4eaae0
mov ecx, dword [ebp - 4]
mov ebx, dword [ecx + 4]
mov eax, dword [ebp + 0x10]
cmp ebx, eax
cmovb eax, ebx
cmp eax, ebx
je 0x4eab67
mov ecx, dword [ecx]
mov dword [ebp + 0x10], ecx
nop dword [eax + eax]
movzx edi, byte [ecx + eax]
xor esi, esi
mov ecx, edi
xor edx, edx
and ecx, 0x3f
bts esi, ecx
cmp ecx, 0x20
cmovae edx, esi
xor esi, edx
cmp ecx, 0x40
cmovae edx, esi
shr edi, 6
and esi, dword [ebp + edi*8 - 0x24]
and edx, dword [ebp + edi*8 - 0x20]
or esi, edx
je 0x4eab6a
inc eax
cmp eax, ebx
je 0x4eab67
mov ecx, dword [ebp + 0x10]
jmp 0x4eab30
or eax, 0xffffffff
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc

Function at 0x4eab80
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
push ebx
mov ebx, dword [ebp + 0xc]
xorps xmm0, xmm0
push esi
push edi
mov edx, ecx
xor edi, edi
mov dword [ebp - 4], edx
movups xmmword [ebp - 0x24], xmm0
movups xmmword [ebp - 0x14], xmm0
test ebx, ebx
je 0x4eabd9
mov eax, dword [ebp + 8]
lea esi, [ebp - 0x24]
xor ecx, ecx
movzx edx, byte [eax + edi]
mov eax, edx
and edx, 0x3f
shr eax, 6
lea esi, [esi + eax*8]
xor eax, eax
bts eax, edx
cmp edx, 0x20
cmovae ecx, eax
xor eax, ecx
cmp edx, 0x40
cmovae ecx, eax
or dword [esi], eax
or dword [esi + 4], ecx
inc edi
cmp edi, ebx
jne 0x4eaba2
mov edx, dword [ebp - 4]
mov eax, dword [ebp + 0x10]
cmp dword [edx + 4], eax
cmovb eax, dword [edx + 4]
dec eax
cmp eax, 0xffffffff
je 0x4eac23
mov ebx, dword [edx]
nop dword [eax + eax]
movzx edi, byte [ebx + eax]
xor esi, esi
mov ecx, edi
xor edx, edx
and ecx, 0x3f
bts esi, ecx
cmp ecx, 0x20
cmovae edx, esi
xor esi, edx
cmp ecx, 0x40
cmovae edx, esi
shr edi, 6
and esi, dword [ebp + edi*8 - 0x24]
and edx, dword [ebp + edi*8 - 0x20]
or esi, edx
je 0x4eac26
dec eax
cmp eax, 0xffffffff
jne 0x4eabf0
or eax, 0xffffffff
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x4ebf30
Capabilities:
Get system information on windows

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff0
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
sub esp, 0x4c
push esi
push 0x800
push 0
push 0x746288
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
test eax, eax
je 0x4ebfcb
push str.IsWow64Process2
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, eax
test esi, esi
je 0x4ebfcb
lea eax, [ebp - 4]
mov dword [ebp - 8], 0
push eax
lea eax, [ebp - 8]
mov dword [ebp - 4], 0
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call esi
test eax, eax
je 0x4ebfc1
movzx ecx, word [ebp - 4]
cmp ecx, 0x14c
je 0x4ec016
cmp ecx, 0x8664
je 0x4ec009
xor edx, edx
mov eax, 3
cmp ecx, 0xaa64
cmovne eax, edx
pop esi
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret
xor eax, eax
pop esi
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret
xorps xmm0, xmm0
mov dword [ebp - 0x20], 0
lea eax, [ebp - 0x40]
movaps xmmword [ebp - 0x40], xmm0
push eax
movaps xmmword [ebp - 0x30], xmm0
call dword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
movzx ecx, word [ebp - 0x40]
test ecx, ecx
je 0x4ec016
cmp ecx, 9
je 0x4ec009
xor edx, edx
mov eax, 3
cmp ecx, 0xc
cmovne eax, edx
pop esi
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret
mov eax, 2
pop esi
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret
mov eax, 1
pop esi
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret

Function at 0x4ec0b0
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
push esi
push 0x800
push 0
push 0x746288
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
test eax, eax
je 0x4ec12c
push str.IsWow64Process2
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, eax
test esi, esi
je 0x4ec12c
lea eax, [ebp - 4]
mov dword [ebp - 8], 0
push eax
lea eax, [ebp - 8]
mov dword [ebp - 4], 0
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call esi
test eax, eax
je 0x4ec128
movzx ecx, word [ebp - 4]
cmp ecx, 0x14c
je 0x4ec16b
cmp ecx, 0x8664
je 0x4ec164
xor edx, edx
mov eax, 3
cmp ecx, 0xaa64
cmovne eax, edx
jmp 0x4ec170
xor eax, eax
jmp 0x4ec170
xorps xmm0, xmm0
mov dword [ebp - 0xc], 0
lea eax, [ebp - 0x2c]
push eax
movups xmmword [ebp - 0x2c], xmm0
movups xmmword [ebp - 0x1c], xmm0
call dword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
movzx ecx, word [ebp - 0x2c]
test ecx, ecx
je 0x4ec16b
cmp ecx, 9
je 0x4ec164
xor edx, edx
mov eax, 3
cmp ecx, 0xc
cmovne eax, edx
jmp 0x4ec170
mov eax, 2
jmp 0x4ec170
mov eax, 1
mov ecx, dword [ebp + 8]
pop esi
cmp eax, ecx
je 0x4ec1ca
cmp ecx, 2
jne 0x4ec1c4
cmp eax, 3
jne 0x4ec1c4
push 0x800
push 0
push 0x746288
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
test eax, eax
je 0x4ec1c4
push str.GetMachineTypeAttributes
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x4ec1c4
lea ecx, [ebp + 8]
mov dword [ebp + 8], 0
push ecx
push 0x8664
call eax
test eax, eax
jne 0x4ec1c4
test byte [ebp + 8], 3
jne 0x4ec1ca
xor al, al
mov esp, ebp
pop ebp
ret
mov al, 1
mov esp, ebp
pop ebp
ret
Function at 0x4f6290
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x7023b5
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x10
push ebx
mov ebx, dword [ebp + 0xc]
push edi
mov edi, ecx
movzx eax, byte [ebx]
xor eax, 0x811c9dc5
imul edx, eax, 0x1000193
movzx eax, byte [ebx + 1]
xor edx, eax
movzx eax, byte [ebx + 2]
imul edx, edx, 0x1000193
xor edx, eax
movzx eax, byte [ebx + 3]
imul ecx, edx, 0x1000193
xor ecx, eax
imul eax, ecx, 0x1000193
mov ecx, edi
push eax
mov dword [ebp + 0xc], eax
lea eax, [ebp - 0x1c]
push ebx
push eax
call fcn.004bf2f0
mov ecx, dword [ebp - 0x18]
test ecx, ecx
je 0x4f6316
mov eax, dword [ebp + 8]
pop edi
pop ebx
mov dword [eax], ecx
mov byte [eax + 4], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 8
cmp dword [edi + 8], 0x15555555
je 0x4f646c
lea eax, [edi + 4]
push esi
mov dword [ebp - 0x14], eax
push 0xc
mov dword [ebp - 4], 0
mov dword [ebp - 0x10], 0
call fcn.004e7f70
mov ecx, dword [ebx]
mov esi, eax
add esp, 4
mov dword [ebp - 0x10], esi
mov dword [esi + 8], ecx
mov ecx, dword [edi + 8]
mov ebx, dword [edi + 0x1c]
movss xmm3, dword [edi]
mov dword [ebp - 4], 1
lea eax, [ecx + 1]
movd xmm0, eax
cvtdq2pd xmm0, xmm0
shr eax, 0x1f
addsd xmm0, qword [eax*8 + 0x715c60]
mov eax, ebx
shr eax, 0x1f
cvtpd2ps xmm2, xmm0
movd xmm0, ebx
cvtdq2pd xmm0, xmm0
movaps xmm1, xmm2
addsd xmm0, qword [eax*8 + 0x715c60]
cvtpd2ps xmm0, xmm0
divss xmm1, xmm0
comiss xmm1, xmm3
jbe 0x4f640c
divss xmm2, xmm3
sub esp, 8
cvtps2pd xmm0, xmm2
movsd qword [ebp - 0x1c], xmm0
fld qword [ebp - 0x1c]
fstp qword [esp]
call fcn.006d2120
fstp qword [ebp - 0x1c]
movsd xmm0, qword [ebp - 0x1c]
add esp, 8
cvtpd2ps xmm0, xmm0
call fcn.006c0070
mov ecx, 8
cmp eax, ecx
cmova ecx, eax
cmp ebx, ecx
jae 0x4f63eb
cmp ebx, 0x200
jae 0x4f63e9
shl ebx, 3
cmp ebx, ecx
jae 0x4f63eb
mov ebx, ecx
push ebx
mov ecx, edi
call fcn.004f6bb0
push dword [ebp + 0xc]
lea eax, [esi + 8]
mov ecx, edi
push eax
lea eax, [ebp - 0x1c]
push eax
call fcn.004bf2f0
mov ecx, dword [edi + 8]
mov edx, dword [eax]
jmp 0x4f640f
mov edx, dword [ebp - 0x1c]
mov ebx, dword [edx + 4]
lea eax, [ecx + 1]
mov dword [edi + 8], eax
mov dword [esi], edx
mov dword [esi + 4], ebx
mov dword [ebx], esi
mov dword [edx + 4], esi
mov eax, dword [edi + 0x18]
and eax, dword [ebp + 0xc]
mov ecx, dword [edi + 0xc]
mov esi, dword [ebp - 0x14]
mov edi, dword [ecx + eax*8]
cmp edi, dword [esi]
mov esi, dword [ebp - 0x10]
jne 0x4f643d
mov dword [ecx + eax*8], esi
jmp 0x4f644c
cmp edi, edx
jne 0x4f6446
mov dword [ecx + eax*8], esi
jmp 0x4f6450
cmp dword [ecx + eax*8 + 4], ebx
jne 0x4f6450
mov dword [ecx + eax*8 + 4], esi
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
mov dword [eax], esi
pop esi
pop edi
mov byte [eax + 4], 1
pop ebx
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 8
push str.unordered_map_set_too_long
call fcn.006ab32d
int3
Function at 0x4f6bb0
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov edx, dword [ebp + 8]
mov eax, 0x1fffffff
push ebx
push esi
push edi
mov edi, ecx
mov esi, 1
bsr ecx, eax
mov eax, esi
mov dword [ebp - 4], edi
shl eax, cl
cmp edx, eax
ja 0x4f6d05
mov ebx, dword [edi + 4]
lea eax, [edx - 1]
or eax, esi
mov dword [ebp - 8], ebx
bsr ecx, eax
push ebx
lea ecx, [ecx + 1]
shl esi, cl
lea ecx, [edi + 0xc]
lea eax, [esi + esi]
push eax
call fcn.00481400
lea eax, [esi - 1]
mov dword [edi + 0x1c], esi
mov dword [edi + 0x18], eax
mov edx, dword [edi + 4]
mov edx, dword [edx]
cmp edx, ebx
je 0x4f6ce0
mov ecx, edx
movzx eax, byte [ecx + 8]
xor eax, 0x811c9dc5
mov edx, dword [edx]
imul esi, eax, 0x1000193
movzx eax, byte [ecx + 9]
xor esi, eax
movzx eax, byte [ecx + 0xa]
imul esi, esi, 0x1000193
xor esi, eax
movzx eax, byte [ecx + 0xb]
imul esi, esi, 0x1000193
xor esi, eax
imul eax, esi, 0x1000193
mov esi, dword [edi + 0x18]
and esi, eax
mov eax, dword [edi + 0xc]
lea ebx, [eax + esi*8]
mov eax, dword [ebp - 8]
mov dword [ebp + 8], ebx
cmp dword [ebx], eax
jne 0x4f6c63
mov dword [ebx], ecx
mov dword [ebx + 4], ecx
jmp 0x4f6cd0
mov eax, dword [ebx + 4]
mov edi, dword [ecx + 8]
cmp edi, dword [eax + 8]
jne 0x4f6c9a
mov eax, dword [eax]
mov dword [ebp - 0xc], eax
cmp eax, ecx
je 0x4f6c95
mov edi, dword [ecx + 4]
mov ebx, dword [ebp - 0xc]
mov dword [edi], edx
mov esi, dword [edx + 4]
mov dword [esi], eax
mov eax, dword [eax + 4]
mov dword [eax], ecx
mov dword [ebx + 4], esi
mov ebx, dword [ebp + 8]
mov dword [edx + 4], edi
mov dword [ecx + 4], eax
mov dword [ebx + 4], ecx
jmp 0x4f6ccd
mov ebx, dword [ebx]
mov esi, eax
cmp ebx, eax
je 0x4f6cb0
mov eax, dword [eax + 4]
mov esi, eax
cmp edi, dword [eax + 8]
je 0x4f6ce9
cmp ebx, eax
jne 0x4f6ca2
mov ebx, dword [ecx + 4]
mov dword [ebx], edx
mov edi, dword [edx + 4]
mov dword [edi], esi
mov eax, dword [esi + 4]
mov dword [eax], ecx
mov dword [esi + 4], edi
mov dword [edx + 4], ebx
mov dword [ecx + 4], eax
mov eax, dword [ebp + 8]
mov dword [eax], ecx
mov edi, dword [ebp - 4]
mov ecx, edx
cmp edx, dword [ebp - 8]
jne 0x4f6c12
nop dword [eax + eax]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
mov edi, dword [ecx + 4]
mov ebx, dword [eax]
mov dword [edi], edx
mov esi, dword [edx + 4]
mov dword [esi], ebx
mov eax, dword [ebx + 4]
mov dword [eax], ecx
mov dword [ebx + 4], esi
mov dword [edx + 4], edi
mov dword [ecx + 4], eax
jmp 0x4f6ccd
push str.invalid_hash_bucket_count
call fcn.006ab32d
int3
Function at 0x4f8f70
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
mov eax, dword fs:[0]
mov edx, dword [ebp + 0xc]
push 0xffffffffffffffff
push 0x7004b5
push eax
mov dword fs:[0], esp
sub esp, 0x10
cmp dword [edx + 0x14], 0x10
push ebx
push esi
push edi
mov ebx, ecx
mov edi, edx
jb 0x4f8f9d
mov edi, dword [edx]
xor ecx, ecx
mov esi, 0x811c9dc5
cmp dword [edx + 0x10], ecx
jbe 0x4f8fc2
nop dword [eax]
movzx eax, byte [ecx + edi]
inc ecx
xor eax, esi
imul esi, eax, 0x1000193
cmp ecx, dword [edx + 0x10]
jb 0x4f8fb0
push esi
push edx
lea eax, [ebp - 0x14]
mov ecx, ebx
push eax
call fcn.00476960
mov ecx, dword [ebp - 0x10]
test ecx, ecx
je 0x4f8ff2
mov eax, dword [ebp + 8]
mov dword [eax], ecx
mov byte [eax + 4], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
cmp dword [ebx + 8], 0x71c71c7
je 0x4f914b
lea eax, [ebx + 4]
mov dword [ebp - 0x1c], eax
push 0x24
mov dword [ebp - 4], 0
mov dword [ebp - 0x18], 0
call fcn.004e7f70
add esp, 4
mov edi, eax
mov dword [ebp - 0x18], edi
push dword [ebp + 0xc]
lea ecx, [edi + 8]
call fcn.00470690
mov byte [edi + 0x20], 0
mov eax, dword [ebx + 8]
inc eax
movss xmm3, dword [ebx]
mov dword [ebp - 4], 1
movd xmm0, eax
cvtdq2pd xmm0, xmm0
shr eax, 0x1f
addsd xmm0, qword [eax*8 + 0x715c60]
mov eax, dword [ebx + 0x1c]
cvtpd2ps xmm2, xmm0
movd xmm0, eax
cvtdq2pd xmm0, xmm0
shr eax, 0x1f
movaps xmm1, xmm2
addsd xmm0, qword [eax*8 + 0x715c60]
cvtpd2ps xmm0, xmm0
divss xmm1, xmm0
comiss xmm1, xmm3
jbe 0x4f90ea
divss xmm2, xmm3
sub esp, 8
cvtps2pd xmm0, xmm2
movsd qword [ebp - 0x14], xmm0
fld qword [ebp - 0x14]
fstp qword [esp]
call fcn.006d2120
fstp qword [ebp - 0x14]
movsd xmm0, qword [ebp - 0x14]
add esp, 8
cvtpd2ps xmm0, xmm0
call fcn.006c0070
mov ecx, 8
cmp eax, ecx
cmova ecx, eax
mov eax, dword [ebx + 0x1c]
cmp eax, ecx
jae 0x4f90ce
cmp eax, 0x200
jae 0x4f90cc
shl eax, 3
cmp eax, ecx
jae 0x4f90ce
mov eax, ecx
push eax
mov ecx, ebx
call fcn.004816b0
push esi
lea eax, [edi + 8]
mov ecx, ebx
push eax
lea eax, [ebp - 0x1c]
push eax
call fcn.00476960
mov edx, dword [eax]
jmp 0x4f90ed
mov edx, dword [ebp - 0x14]
mov eax, dword [ebx + 8]
mov ecx, dword [edx + 4]
inc eax
mov dword [ebx + 8], eax
mov dword [edi], edx
mov dword [edi + 4], ecx
mov dword [ecx], edi
mov dword [edx + 4], edi
mov eax, dword [ebx + 0x18]
mov dword [ebp + 0xc], ecx
and eax, esi
mov ecx, dword [ebx + 0xc]
mov esi, dword [ecx + eax*8]
cmp esi, dword [ebx + 4]
jne 0x4f9119
mov dword [ecx + eax*8], edi
jmp 0x4f912b
cmp esi, edx
jne 0x4f9122
mov dword [ecx + eax*8], edi
jmp 0x4f912f
mov edx, dword [ebp + 0xc]
cmp dword [ecx + eax*8 + 4], edx
jne 0x4f912f
mov dword [ecx + eax*8 + 4], edi
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
mov dword [eax], edi
pop edi
pop esi
mov byte [eax + 4], 1
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret 8
push str.unordered_map_set_too_long
call fcn.006ab32d
int3