joyce8/EMBER2024-capa huggingface dataset:
Function at 0x9f1acf
Capabilities:
Execute anti-debugging instructions

Disassembly:
bswap edx
lea esp, [esp + 3]
call fcn.009f1a07
sets dl
mov dl, 0x18
xchg edx, eax
mov ax, si
mov al, byte [esp + 0x2e]
jmp 0x9f1a68
mov dword [esp + 1], eax
xchg dword [esp + 0x29], edi
pushfd
std
setle dh
cld
jmp 0x9f1aa9
mov dx, 0x8ba2
pop edi
dec dl
btc eax, esi
mov al, cl
lea edx, [ecx*4]
jmp 0x9f1a52
lea eax, [esp + ecx]
not ax
clc
setg dh
jmp 0x9f1a1d
mov byte [esp + 5], bl
mov ax, bp
xchg di, dx
mov dword [esp + 0xa], esi
jmp 0x9f1abc
push word [esp + 4]
mov edi, 0xf229ab07
pop edi
xchg edi, eax
std
add di, dx
jmp 0x9f1a93
pop dword [esp + 0x12]
lea edi, [ebx + ebp]
pop dword [esp + 0xd]
xchg al, dl
call 0x9f1acf
or byte [eax - 0x73], bl
add al, 0x9d
add byte [eax], al
add byte [eax], al
jmp 0x9f1c3e
mov dx, sp
bswap edx
lea esp, [esp + 1]
rdtsc
mov dh, 0x24
jmp 0x9f1b59
xchg dword [esp + 0x13], edi
xchg word [esp + 0x23], di
neg edx
mov word [esp + 0x17], bx
neg al
push word [esp + 9]
jmp 0x9f1afc
bswap edx
mov eax, dword [esp + 0x1b]
mov word [esp + 0x15], sp
xchg al, dh
pop dword [esp + 0x11]
cmc
jmp 0x9f1b12
mov dl, byte [esp]
mov dl, cl
mov di, dx
sub edx, 0xc75c514
shl dh, cl
jmp 0x9f1ba1
push dword [esp + 0xe]
xchg dword [esp + 0x11], eax
push word [esp + 0x1d]
lea esp, [esp + 0x2d]
bsf di, bp
not edx
jmp 0x9f1b43
dec edx
mov eax, dword [esp + 0x22]
neg ax
xchg dword [esp + 0x11], eax
setb dl
mov dx, di
jmp 0x9f1b2f
xchg byte [esp + 5], al
mov al, byte [esp + 0x13]
pop word [esp + 0x16]
mov di, ax
jmp 0x9f1bf1
add esp, 0
mov dl, 0x29
xchg edi, edx
pushal
sub dx, 0x1f16
push word [esp + 0x19]
jmp 0x9f1b8b
not al
rol ah, 4
xchg dh, dl
bswap edx
btc ax, di
jmp 0x9f1c18
mov word [esp + 0x11], sp
lea eax, [ebp*4]
xchg dl, dh
sub esp, 2
bswap edx
mov dx, 0xff52
jmp 0x9f1bb5
add esp, 3
shr dh, cl
xchg di, ax
mov al, dh
sets al
xchg dx, ax
jmp 0x9f1bcb
mov di, 0xaf2
cmc
bsr edi, eax
xchg dword [esp + 8], edx
pop ax
bswap eax
jmp 0x9f1cf1
push dword [esp + 0x1b]
mov di, word [esp + 0x19]
cld
stc
lea edi, [0xb399c30e]
bswap edi
jmp 0x9f1c02
lea eax, [edx*4]
setnp dh
mov al, 0x24
bswap edx
xchg dx, di
bt eax, esp
jmp 0x9f1b77
mov edi, dword [esp]
push si
mov dh, 0x38
cld
lea edx, [edx + ebx]
call fcn.009f1cad
int1
ljmp 0xf74f
cld
dec di
neg edx
rdtsc
mov edi, dword [esp]
mov dh, byte [esp]
jmp 0x9f1c57
pushal
lea esp, [esp + 0x42]
sub dx, 0x7dc5
setl ah
lea edx, [ecx - 0x78be2c5d]
rcr di, 5
jmp 0x9f1c6d

Function at 0x9f2104
Capabilities:
Execute anti-debugging instructions

Disassembly:
jmp 0x9f2195
cmc
not edi
mov dx, bp
sub esp, 0x1b
add esp, 0x13
not eax
jmp 0x9f2143
mov dx, word [esp + 0x24]
mov byte [esp + 0x2a], al
push dword [esp + 0x2d]
mov edx, ecx
push dword [esp + 0x10]
lea esp, [esp + 0x44]
jmp 0x9f2159
Function at 0xad9058
Capabilities:
Decompress data using aplib

Disassembly:
call 0xad91a8
push ebx
mov ebx, esp
push ebx
mov esi, dword [ebx + 8]
mov edi, dword [ebx + 0x10]
cld
mov dl, 0x80
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
mov ebx, 2
add dl, dl
jne 0xad907e
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0xad906a
add dl, dl
jne 0xad9089
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0xad90dc
xor eax, eax
add dl, dl
jne 0xad9096
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0xad917d
add dl, dl
jne 0xad90a5
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xad90b0
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xad90bb
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xad90c6
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0xad90d2
push edi
mov eax, eax
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0xad9075
mov eax, 1
add dl, dl
jne 0xad90ea
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xad90f5
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0xad90e1
sub eax, ebx
mov ebx, 1
jne 0xad9128
mov ecx, 1
add dl, dl
jne 0xad910e
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0xad9119
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0xad9105
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0xad9075
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0xad913f
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0xad914a
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0xad9136
cmp eax, 0x7d00
jae 0xad916d
cmp eax, 0x500
jb 0xad9168
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0xad9075
cmp eax, 0x7f
ja 0xad9170
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0xad9075
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0xad919e
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0xad9075
pop ebx
sub edi, dword [ebx + 0x10]
mov eax, edi
pop ebx
ret 0x10

Function at 0x42e000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x42e00c
nop
pop eax
nop
nop
nop
nop
add eax, 0x403ac5
nop
sub eax, 0x403a6b
nop
nop
mov ebx, dword [eax]
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
xor dword [ebx], edx
nop
add ebx, 4
nop
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
nop
jl 0x42e030
nop
nop
add eax, 0xc
nop
nop
nop
cmp dword [eax], 0
nop
nop
nop
jne 0x42e01e
nop
nop
nop
nop
nop
nop
nop
nop
popal
nop
jmp fcn.00401219

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x1001d000
Capabilities:
Access peb ldr_data
Check for peb beingdebugged flag

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100e51f4
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x10114008]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
push 0x10
call fcn.100e38f8
push 8
mov byte [eax], 1
mov dword [eax + 4], 0
mov dword [eax + 8], 0x45
mov byte [eax + 0xc], 1
mov dword [edi], eax
call fcn.100e38f8
push 0x48
mov dword [eax], 1
mov dword [eax + 4], 0x1000101
mov dword [edi + 4], eax
call fcn.100e38f8
push 0x30
mov dword [eax], 1
mov dword [eax + 4], 1
mov dword [eax + 8], 1
mov dword [eax + 0xc], 1
mov dword [eax + 0x10], 1
mov dword [eax + 0x14], 1
mov dword [eax + 0x18], 1
mov dword [eax + 0x1c], 1
mov dword [eax + 0x20], 1
mov dword [eax + 0x24], 1
mov dword [eax + 0x28], 1
mov dword [eax + 0x2c], 1
mov dword [eax + 0x30], 5
mov dword [eax + 0x34], 4
mov dword [eax + 0x38], 2
mov dword [eax + 0x3c], 2
mov dword [eax + 0x40], 1
mov dword [eax + 0x44], 1
mov dword [edi + 8], eax
call fcn.100e38f8
mov esi, eax
mov dword [ebp - 0x10], esi
mov dword [ebp - 4], 0
push 0x10
mov dword [esi], 0x1010000
mov dword [esi + 4], 0
mov word [esi + 8], 1
mov byte [esi + 0xa], 0
mov dword [esi + 0xc], 0xb4
mov dword [esi + 0x10], 0
mov byte [esi + 0x14], 0
mov dword [esi + 0x18], 0xa
mov dword [esi + 0x1c], 0x48
mov dword [esi + 0x20], 0x2a
mov dword [esi + 0x24], 0x1010101
mov byte [esi + 0x28], 1
call fcn.100e38f8
vmovss xmm0, dword [0x10102d2c]
push 3
vmovss dword [eax + 4], xmm0
vmovss xmm0, dword [0x10102c68]
vmovss dword [eax + 8], xmm0
vmovss xmm0, dword [0x10102df4]
mov byte [eax], 0
vmovss dword [eax + 0xc], xmm0
mov dword [esi + 0x2c], eax
mov dword [ebp - 4], 0xffffffff
mov dword [edi + 0xc], esi
call fcn.100e38f8
push 0x30
mov word [eax], 1
mov byte [eax + 2], 1
mov dword [edi + 0x10], eax
call fcn.100e38f8
vmovss xmm0, dword [0x10102d4c]
add esp, 0x1c
vmovss dword [eax], xmm0
vmovss xmm0, dword [0x10102d3c]
vmovss dword [eax + 4], xmm0
vmovss xmm0, dword [0x10102cfc]
mov dword [eax + 8], 0x1010001
vmovss dword [eax + 0xc], xmm0
mov dword [eax + 0x10], 0x19
mov dword [eax + 0x14], 0
mov dword [eax + 0x18], 0
mov dword [eax + 0x1c], 0
mov dword [eax + 0x20], 0
mov byte [eax + 0x24], 0
mov dword [eax + 0x28], 0x78
mov dword [eax + 0x2c], 0x14
mov dword [edi + 0x14], eax
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x1001d220
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100e5233
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x10114008]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
vmovss xmm1, dword [0x10102c68]
vxorps xmm0, xmm0, xmm0
vmovss dword [esi + 0x28], xmm0
vmovss xmm0, dword [0x10102c90]
vmovss dword [esi + 0x2c], xmm0
vmovss xmm0, dword [0x10102d0c]
vmovss dword [esi + 0x38], xmm0
vmovss dword [esi + 0x44], xmm0
vmovss xmm0, dword [0x10102c38]
vmovss dword [esi + 0x4c], xmm0
vmovss xmm0, dword [0x10102c04]
vmovss dword [esi + 0x54], xmm0
vmovss xmm0, dword [0x10102c34]
vmovss dword [esi + 0x8c], xmm0
vmovss xmm0, dword [0x10102c7c]
lea ecx, [esi + 0xb0]
mov dword [esi], 0x78
mov dword [esi + 4], 0x78
mov dword [esi + 8], 0x1010101
mov byte [esi + 0xc], 1
mov dword [esi + 0x10], 0
mov byte [esi + 0x14], 0
mov dword [esi + 0x18], 0
mov dword [esi + 0x1c], 0
mov dword [esi + 0x20], 0
mov dword [esi + 0x24], 0
mov word [esi + 0x30], 0
mov byte [esi + 0x32], 0
vmovss dword [esi + 0x34], xmm1
mov word [esi + 0x3c], 0
vmovss dword [esi + 0x40], xmm1
mov word [esi + 0x48], 0
mov word [esi + 0x50], 0x100
mov byte [esi + 0x52], 0
mov word [esi + 0x58], 0
mov dword [esi + 0x5c], 0x5a
mov dword [esi + 0x60], 0
mov dword [esi + 0x64], 0
mov dword [esi + 0x68], 0
mov dword [esi + 0x6c], 0
mov byte [esi + 0x70], 0
mov dword [esi + 0x74], 0
vmovss dword [esi + 0x78], xmm1
mov word [esi + 0x7c], 0
mov byte [esi + 0x7e], 0
mov dword [esi + 0x80], 0
vmovss dword [esi + 0x84], xmm1
mov word [esi + 0x88], 0x100
mov dword [esi + 0x90], 0
mov byte [esi + 0x94], 0
vmovss dword [esi + 0x98], xmm0
mov byte [esi + 0x9c], 0
mov dword [esi + 0xa0], 0x50
mov dword [esi + 0xa4], 0x12c
mov dword [esi + 0xa8], 0x12c
mov dword [esi + 0xac], 0
push 0
push 0x100f8b6f
mov dword [ecx], 0
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 0
call fcn.10020620
mov dword [ebp - 4], 0
push 1
mov dword [esi + 0xc8], 0
mov word [esi + 0xcc], 0
mov dword [esi + 0xd0], 0x96
mov dword [esi + 0xd4], 8
mov dword [esi + 0xd8], 0
mov byte [esi + 0xdc], 0
mov dword [esi + 0xe0], 1
mov word [esi + 0xe4], 0
mov byte [esi + 0xe6], 0
call fcn.100e38f8
push 0x14
mov byte [eax], 1
mov dword [esi + 0xe8], eax
call fcn.100e38f8
mov byte [eax], 0
mov dword [eax + 4], 0
vmovss xmm0, dword [0x10102c38]
vmovss dword [eax + 0xc], xmm0
vmovss xmm0, dword [0x10102c90]
mov word [eax + 8], 0x101
vmovss dword [eax + 0x10], xmm0
push 0xc
mov dword [esi + 0xec], eax
call fcn.100e38f8
add esp, 0xc
mov byte [eax], 1
mov dword [eax + 4], 0
mov dword [eax + 8], 0x1010101
mov dword [esi + 0xf0], eax
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x1001d4c0
Capabilities:
Access peb ldr_data
Check for peb beingdebugged flag

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100e5282
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x10114008]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
push 0x14
mov word [edi], 0x101
mov byte [edi + 2], 1
mov dword [edi + 4], 0
mov word [edi + 8], 0x101
mov byte [edi + 0xa], 1
mov dword [edi + 0xc], 0
mov byte [edi + 0x10], 0
mov dword [edi + 0x14], 0
mov word [edi + 0x18], 0x101
mov byte [edi + 0x1a], 1
mov dword [edi + 0x1c], 0
mov byte [edi + 0x20], 1
call fcn.100e38f8
vmovss xmm0, dword [0x10102c38]
push 8
mov dword [eax], 0
vmovss dword [eax + 4], xmm0
mov dword [eax + 8], 0x15
mov dword [eax + 0xc], 0
mov dword [eax + 0x10], 0x1010101
mov dword [edi + 0x24], eax
call fcn.100e38f8
push 0x5c
mov byte [eax], 1
mov dword [eax + 4], 0
mov dword [edi + 0x28], eax
call fcn.100e38f8
vmovss xmm0, dword [0x10102c38]
push 0x2c
mov dword [eax], 0
vmovss dword [eax + 4], xmm0
mov byte [eax + 8], 0
mov dword [eax + 0xc], 0
mov dword [eax + 0x10], 0
mov dword [eax + 0x14], 0
mov dword [eax + 0x18], 0
mov dword [eax + 0x1c], 0
mov dword [eax + 0x20], 3
mov dword [eax + 0x24], 0xa
mov dword [eax + 0x28], 3
mov dword [eax + 0x2c], 0x4a
mov dword [eax + 0x30], 0x68
mov dword [eax + 0x34], 0
mov dword [eax + 0x38], 0
mov dword [eax + 0x3c], 3
mov dword [eax + 0x40], 0xa
mov dword [eax + 0x44], 3
mov dword [eax + 0x48], 0x4a
mov dword [eax + 0x4c], 0x68
mov dword [eax + 0x50], 0
mov byte [eax + 0x54], 0
mov dword [eax + 0x58], 0
mov dword [edi + 0x2c], eax
call fcn.100e38f8
mov esi, eax
mov dword [ebp - 0x10], esi
mov dword [ebp - 4], 0
push 3
mov byte [esi], 1
mov dword [esi + 4], 0
mov dword [esi + 8], 0
mov dword [esi + 0xc], 0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 2
mov dword [esi + 0x18], 0
mov dword [esi + 0x1c], 2
mov dword [esi + 0x20], 0x10001
mov byte [esi + 0x24], 0
call fcn.100e38f8
mov dword [ebp - 4], 0xffffffff
push 0x1c
mov word [eax], 0x101
mov byte [eax + 2], 0
mov dword [esi + 0x28], eax
mov dword [edi + 0x30], esi
call fcn.100e38f8
mov esi, eax
mov dword [ebp - 0x10], esi
mov dword [ebp - 4], 1
push 2
mov byte [esi], 1
mov dword [esi + 4], 0
mov byte [esi + 8], 0
mov dword [esi + 0xc], 0
mov dword [esi + 0x10], 0x1000101
mov byte [esi + 0x14], 0
call fcn.100e38f8
mov dword [ebp - 4], 0xffffffff
push 2
mov word [eax], 0x101
mov dword [esi + 0x18], eax
mov dword [edi + 0x34], esi
call fcn.100e38f8
push 8
mov word [eax], 0x101
mov dword [edi + 0x38], eax
call fcn.100e38f8
mov esi, eax
mov dword [ebp - 0x10], esi
mov dword [ebp - 4], 2
push 0x10
mov word [esi], 0
call fcn.100e38f8
add esp, 0x28
mov dword [eax], 0
mov dword [eax + 4], 0
mov dword [eax + 8], 0
mov dword [eax + 0xc], 0
mov dword [esi + 4], eax
mov eax, edi
mov dword [edi + 0x3c], esi
mov dword [edi + 0x40], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x1001f090
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_DisableThreadLibraryCalls]
cmp dword [ebp + 0xc], 1
jne 0x1001f0c3
push 0
push 0
push dword [ebp + 8]
push 0x1001eff0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
test eax, eax
je 0x1001f0c3
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 1
pop ebp
ret 0xc
Function at 0x1002af90
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
sub esp, 0x18
mov edx, dword [ebp + 8]
push ebx
mov ebx, ecx
cmp edx, eax
je 0x1002b0e6
mov eax, dword [ebx + 4]
mov dword [ebp - 0x14], eax
mov eax, dword [edx + 4]
mov dword [ebp - 8], eax
movzx eax, byte [edx + 8]
xor eax, 0x811c9dc5
imul ecx, eax, 0x1000193
movzx eax, byte [edx + 9]
push esi
push edi
mov edi, dword [ebx + 0xc]
mov esi, edx
xor ecx, eax
mov dword [ebp - 0x18], edi
movzx eax, byte [edx + 0xa]
imul ecx, ecx, 0x1000193
xor ecx, eax
movzx eax, byte [edx + 0xb]
imul ecx, ecx, 0x1000193
xor ecx, eax
mov eax, dword [ebx + 0x18]
imul ecx, ecx, 0x1000193
and eax, ecx
mov ecx, dword [edi + eax*8]
mov dword [ebp - 4], ecx
lea eax, [edi + eax*8]
mov dword [ebp - 0xc], eax
mov eax, dword [eax + 4]
mov dword [ebp - 0x10], eax
mov eax, esi
mov edi, esi
mov esi, dword [esi]
push 0x10
push eax
call fcn.100e3d5c
dec dword [ebx + 8]
add esp, 8
cmp edi, dword [ebp - 0x10]
je 0x1002b049
mov eax, dword [ebp + 0xc]
cmp esi, eax
jne 0x1002b007
mov ecx, dword [ebp - 4]
cmp ecx, dword [ebp + 8]
jne 0x1002b0dc
mov edx, dword [ebp - 0xc]
mov ecx, dword [ebp - 8]
pop edi
mov dword [edx], esi
mov dword [ecx], esi
mov dword [esi + 4], ecx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
mov ecx, dword [ebp - 4]
mov edx, dword [ebp - 0xc]
cmp ecx, dword [ebp + 8]
jne 0x1002b05d
mov eax, dword [ebp - 0x14]
mov ecx, eax
mov dword [edx], eax
jmp 0x1002b060
mov ecx, dword [ebp - 8]
mov eax, dword [ebp + 0xc]
mov dword [edx + 4], ecx
cmp esi, eax
je 0x1002b0dc
nop word [eax + eax]
movzx eax, byte [esi + 8]
xor eax, 0x811c9dc5
imul ecx, eax, 0x1000193
movzx eax, byte [esi + 9]
xor ecx, eax
movzx eax, byte [esi + 0xa]
imul ecx, ecx, 0x1000193
xor ecx, eax
movzx eax, byte [esi + 0xb]
imul ecx, ecx, 0x1000193
xor ecx, eax
imul eax, ecx, 0x1000193
mov ecx, dword [ebx + 0x18]
and ecx, eax
mov eax, dword [ebp - 0x18]
lea eax, [eax + ecx*8]
mov dword [ebp - 4], eax
mov eax, dword [eax + 4]
mov dword [ebp - 0x10], eax
mov eax, esi
mov edi, esi
mov esi, dword [esi]
push 0x10
push eax
call fcn.100e3d5c
dec dword [ebx + 8]
add esp, 8
mov eax, dword [ebp + 0xc]
cmp edi, dword [ebp - 0x10]
je 0x1002b0ed
cmp esi, eax
jne 0x1002b0b7
mov ecx, dword [ebp - 4]
mov dword [ecx], esi
mov ecx, dword [ebp - 8]
pop edi
mov dword [ecx], esi
mov dword [esi + 4], ecx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
mov ecx, dword [ebp - 4]
mov edx, dword [ebp - 0x14]
mov dword [ecx], edx
mov dword [ecx + 4], edx
cmp esi, eax
jne 0x1002b070
mov ecx, dword [ebp - 8]
pop edi
mov dword [ecx], esi
mov dword [esi + 4], ecx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x10033bc0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100e6c3f
mov eax, dword fs:[0]
push eax
sub esp, 8
push esi
mov eax, dword [0x10114008]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
mov dword [ebp - 0x14], esi
lea eax, [esi + 0x34]
push 0x30
push 0
push eax
mov dword [esi], 0xc8
mov dword [esi + 4], 0xc8
mov dword [esi + 8], 0x1f7
mov dword [esi + 0xc], 0x1ae
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
mov dword [esi + 0x18], 0
mov dword [esi + 0x1c], 0
mov byte [esi + 0x20], 0
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x2c], 0
mov dword [esi + 0x30], 0
call sub.VCRUNTIME140.dll_memset
push 0x30
mov dword [esi + 0x64], 0
mov dword [esi + 0x68], 0
mov dword [esi + 0x6c], 0
mov dword [esi + 0x70], 0
mov dword [esi + 0x74], 0
call fcn.100e38f8
vpxor xmm0, xmm0, xmm0
push 0x18
mov dword [eax], 0
vmovdqu xmmword [eax + 4], xmm0
vmovss dword [eax + 0x14], xmm0
vmovdqu xmmword [eax + 0x18], xmm0
vmovq qword [eax + 0x28], xmm0
mov dword [esi + 0x78], eax
mov byte [esi + 0x7c], 0
call fcn.100e38f8
vpxor xmm0, xmm0, xmm0
push 0x18
mov dword [eax], 0
vmovdqu xmmword [eax + 4], xmm0
vmovss dword [eax + 0x14], xmm0
mov dword [esi + 0x80], eax
call fcn.100e38f8
vpxor xmm0, xmm0, xmm0
push 0x24
mov dword [eax], 0
vmovdqu xmmword [eax + 4], xmm0
vmovss dword [eax + 0x14], xmm0
mov dword [esi + 0x84], eax
call fcn.100e38f8
vpxor xmm0, xmm0, xmm0
push 0x24
mov dword [eax + 4], 0
mov dword [eax + 8], 0
mov dword [eax + 0xc], 0
mov dword [eax], 0
vmovdqu xmmword [eax + 0x10], xmm0
vmovss dword [eax + 0x20], xmm0
mov dword [esi + 0x88], eax
call fcn.100e38f8
vpxor xmm0, xmm0, xmm0
add esp, 0x20
mov dword [eax + 4], 0
mov dword [eax + 8], 0
mov dword [eax + 0xc], 0
mov dword [eax], 0
vmovdqu xmmword [eax + 0x10], xmm0
vmovss dword [eax + 0x20], xmm0
mov dword [esi + 0x8c], eax
mov dword [esi + 0x90], 0
mov dword [esi + 0xa0], 0
mov dword [esi + 0xa4], 0xf
mov byte [esi + 0x90], 0
mov dword [ebp - 4], 1
mov dword [esi + 0xa8], 0
mov dword [esi + 0xac], 0
mov dword [esi + 0xb0], 0
mov dword [esi + 0xb4], 0
mov dword [esi + 0xb8], 0
mov byte [ebp - 4], 2
lea ecx, [esi + 0xc0]
mov word [esi + 0xbc], 0
push 0
push 0x100f8b6f
mov dword [ecx], 0
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 0
call fcn.10020620
lea ecx, [esi + 0xd8]
mov byte [ebp - 4], 3
push 0
push 0x100f8b6f
mov dword [ecx], 0
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 0
call fcn.10020620
mov dword [esi + 0xf0], 0
mov dword [esi + 0x100], 0
mov dword [esi + 0x104], 0xf
mov byte [esi + 0xf0], 0
mov dword [esi + 0x108], 0
mov dword [esi + 0x118], 0
mov eax, esi
mov dword [esi + 0x11c], 0xf
mov byte [esi + 0x108], 0
mov word [esi + 0x120], 0
mov dword [esi + 0x124], 0
mov dword [esi + 0x128], 0
mov dword [esi + 0x12c], 0
mov dword [esi + 0x130], 0
mov dword [esi + 0x134], 0
mov dword [esi + 0x138], 0
mov dword [esi + 0x13c], 0
mov dword [esi + 0x140], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x10036970
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100e7090
mov eax, dword fs:[0]
push eax
mov eax, dword [0x10114008]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edx, ecx
mov eax, dword [ebp + 8]
mov ecx, dword [ebp + 0xc]
mov al, byte [eax]
mov byte [edx], al
mov dword [edx + 4], 0
mov dword [edx + 0x14], 0
mov dword [edx + 0x18], 0
vmovdqu xmm0, xmmword [ecx]
vmovdqu xmmword [edx + 4], xmm0
vmovq xmm0, qword [ecx + 0x10]
vmovq qword [edx + 0x14], xmm0
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 0xf
mov byte [ecx], 0
mov dword [edx + 0x1c], 0
mov dword [edx + 0x2c], 0
mov dword [edx + 0x30], 0
vmovdqu xmm0, xmmword [ecx + 0x18]
vmovdqu xmmword [edx + 0x1c], xmm0
vmovq xmm0, qword [ecx + 0x28]
vmovq qword [edx + 0x2c], xmm0
mov dword [ecx + 0x28], 0
mov eax, edx
mov dword [ecx + 0x2c], 0xf
mov byte [ecx + 0x18], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret 8
Function at 0x10036a30
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100e70c5
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
push ebx
push esi
push edi
mov eax, dword [0x10114008]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, dword [ebp + 0xc]
mov edi, dword [ebp + 8]
mov dword [ebp - 0x14], edi
movzx eax, byte [ebx]
xor eax, 0x811c9dc5
imul ecx, eax, 0x1000193
movzx eax, byte [ebx + 1]
xor ecx, eax
movzx eax, byte [ebx + 2]
imul ecx, ecx, 0x1000193
xor ecx, eax
movzx eax, byte [ebx + 3]
imul ecx, ecx, 0x1000193
xor ecx, eax
imul eax, ecx, 0x1000193
push eax
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x1c]
push ebx
push eax
call fcn.10036da0
mov eax, dword [ebp - 0x18]
test eax, eax
je 0x10036ab3
mov dword [edi], eax
mov byte [edi + 4], 0
jmp 0x10036bf2
cmp dword [0x101195f8], 0xfffffff
jne 0x10036aca
push str.unordered_map_set_too_long
call dword [sym.imp.MSVCP140.dll_void___cdecl_std::_Xlength_error_char_const__]
mov dword [ebp - 0x24], 0x101195f4
mov dword [ebp - 4], 0
push 0x10
mov dword [ebp - 0x20], 0
call fcn.100e38f8
mov esi, eax
add esp, 4
mov dword [ebp - 0x20], esi
mov dword [ebp - 4], 1
mov ecx, dword [ebx]
mov dword [esi + 8], ecx
mov dword [esi + 0xc], 0
mov ecx, dword [0x101195f8]
mov ebx, dword [0x1011960c]
vmovss xmm1, dword [0x101195f0]
vxorps xmm0, xmm0, xmm0
lea eax, [ecx + 1]
vcvtsi2sd xmm0, xmm0, eax
shr eax, 0x1f
vaddsd xmm0, xmm0, qword [eax*8 + 0x10102fc0]
vcvtsd2ss xmm2, xmm0, xmm0
vxorps xmm0, xmm0, xmm0
mov eax, ebx
shr eax, 0x1f
vcvtsi2sd xmm0, xmm0, ebx
vaddsd xmm0, xmm0, qword [eax*8 + 0x10102fc0]
vcvtsd2ss xmm0, xmm0, xmm0
vdivss xmm0, xmm2, xmm0
vcomiss xmm0, xmm1
jbe 0x10036ba1
vdivss xmm0, xmm2, xmm1
call fcn.1002a130
call fcn.100e4d50
mov ecx, 8
cmp eax, ecx
cmova ecx, eax
cmp ebx, ecx
jae 0x10036b81
cmp ebx, 0x200
jae 0x10036b7f
shl ebx, 3
cmp ebx, ecx
jae 0x10036b81
mov ebx, ecx
push ebx
call fcn.10036c20
push dword [ebp - 0x10]
lea eax, [esi + 8]
push eax
lea eax, [ebp - 0x24]
push eax
call fcn.10036da0
mov ecx, dword [0x101195f8]
mov edx, dword [eax]
jmp 0x10036ba4
mov edx, dword [ebp - 0x1c]
mov ebx, dword [edx + 4]
inc ecx
mov dword [0x101195f8], ecx
mov dword [esi], edx
mov dword [esi + 4], ebx
mov dword [ebx], esi
mov dword [edx + 4], esi
mov eax, dword [0x10119608]
and eax, dword [ebp - 0x10]
mov ecx, dword [0x101195fc]
mov edi, dword [ecx + eax*8]
cmp edi, dword [0x101195f4]
jne 0x10036bd6
mov dword [ecx + eax*8], esi
jmp 0x10036be5
cmp edi, edx
jne 0x10036bdf
mov dword [ecx + eax*8], esi
jmp 0x10036be9
cmp dword [ecx + eax*8 + 4], ebx
jne 0x10036be9
mov dword [ecx + eax*8 + 4], esi
mov edi, dword [ebp - 0x14]
mov dword [edi], esi
mov byte [edi + 4], 1
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8