joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10068300
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1fffffff
sub esp, 0x10
bsr ecx, eax
push ebx
push esi
push edi
mov edi, 1
mov eax, edi
shl eax, cl
mov ecx, dword [ebp + 8]
cmp ecx, eax
jbe 0x1006832c
push str.invalid_hash_bucket_count
call dword [sym.imp.MSVCP140.dll_void___cdecl_std::_Xlength_error_char_const__]
lea eax, [ecx - 1]
mov esi, dword [0x100a2fd0]
or eax, 1
mov dword [ebp - 8], esi
bsr ecx, eax
push esi
lea ecx, [ecx + 1]
shl edi, cl
mov ecx, 0x100a2fd8
lea eax, [edi + edi]
push eax
call fcn.100051b0
mov eax, dword [0x100a2fd0]
lea ebx, [edi - 1]
mov dword [0x100a2fe4], ebx
mov dword [0x100a2fe8], edi
mov eax, dword [eax]
mov ecx, eax
cmp eax, esi
je 0x10068466
movzx edx, byte [eax + 8]
xor edx, 0x811c9dc5
mov ecx, dword [ecx]
imul edi, edx, 0x1000193
movzx edx, byte [eax + 9]
xor edi, edx
movzx edx, byte [eax + 0xa]
imul edi, edi, 0x1000193
xor edi, edx
movzx edx, byte [eax + 0xb]
imul edi, edi, 0x1000193
xor edi, edx
mov edx, dword [0x100a2fd8]
imul edi, edi, 0x1000193
and edi, ebx
mov ebx, dword [edx + edi*8]
lea edx, [edx + edi*8]
mov dword [ebp - 0xc], edx
cmp ebx, esi
jne 0x100683c4
mov dword [edx], eax
mov dword [edx + 4], eax
jmp 0x10068431
mov edx, dword [edx + 4]
mov edi, dword [eax + 8]
cmp edi, dword [edx + 8]
jne 0x100683fe
mov edx, dword [edx]
mov dword [ebp - 4], edx
cmp edx, eax
je 0x100683f6
mov ebx, dword [eax + 4]
mov esi, dword [ebp - 4]
mov dword [ebx], ecx
mov edi, dword [ecx + 4]
mov dword [edi], edx
mov edx, dword [edx + 4]
mov dword [edx], eax
mov dword [esi + 4], edi
mov esi, dword [ebp - 8]
mov dword [ecx + 4], ebx
mov dword [eax + 4], edx
mov edx, dword [ebp - 0xc]
mov dword [edx + 4], eax
jmp 0x10068431
cmp ebx, edx
je 0x1006840e
mov edx, dword [edx + 4]
cmp edi, dword [edx + 8]
je 0x10068442
cmp ebx, edx
jne 0x10068402
mov ebx, dword [eax + 4]
mov dword [ebp - 4], ebx
mov dword [ebx], ecx
mov ebx, dword [ecx + 4]
mov dword [ebx], edx
mov edi, dword [edx + 4]
mov dword [edi], eax
mov dword [edx + 4], ebx
mov edx, dword [ebp - 4]
mov dword [ecx + 4], edx
mov edx, dword [ebp - 0xc]
mov dword [eax + 4], edi
mov dword [edx], eax
mov eax, ecx
cmp ecx, esi
je 0x10068466
mov ebx, dword [0x100a2fe4]
jmp 0x10068372
mov ebx, dword [eax + 4]
mov edx, dword [edx]
mov dword [ebp - 4], edx
mov esi, edx
mov dword [ebx], ecx
mov edi, dword [ecx + 4]
mov dword [edi], edx
mov edx, dword [edx + 4]
mov dword [edx], eax
mov dword [esi + 4], edi
mov esi, dword [ebp - 8]
mov dword [ecx + 4], ebx
mov dword [eax + 4], edx
jmp 0x10068431
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x100689b0
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10085735
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push ebx
push esi
push edi
mov eax, dword [0x1009e040]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
movzx eax, byte [esi]
xor eax, 0x811c9dc5
imul ecx, eax, 0x1000193
movzx eax, byte [esi + 1]
xor ecx, eax
movzx eax, byte [esi + 2]
imul ecx, ecx, 0x1000193
xor ecx, eax
movzx eax, byte [esi + 3]
imul ecx, ecx, 0x1000193
xor ecx, eax
lea eax, [ebp - 0x14]
imul edi, ecx, 0x1000193
push edi
push esi
push eax
call fcn.10068d70
mov eax, dword [ebp - 0x10]
test eax, eax
jne 0x10068adb
cmp dword [0x100a2ff4], 0xfffffff
jne 0x10068a3a
push str.unordered_map_set_too_long
call dword [sym.imp.MSVCP140.dll_void___cdecl_std::_Xlength_error_char_const__]
mov dword [ebp - 0x1c], 0x100a2ff0
mov dword [ebp - 4], 0
push 0x10
mov dword [ebp - 0x18], 0
call fcn.100828b8
mov ebx, eax
add esp, 4
mov eax, dword [esi]
mov dword [ebp - 0x18], ebx
mov dword [ebx + 8], eax
mov dword [ebx + 0xc], 0
mov dword [ebp - 4], 1
mov eax, dword [0x100a2ff4]
inc eax
movd xmm0, eax
cvtdq2pd xmm0, xmm0
shr eax, 0x1f
addsd xmm0, qword [eax*8 + 0x10097390]
mov eax, dword [0x100a3008]
cvtpd2ps xmm1, xmm0
movd xmm0, eax
cvtdq2pd xmm0, xmm0
shr eax, 0x1f
addsd xmm0, qword [eax*8 + 0x10097390]
cvtpd2ps xmm0, xmm0
divss xmm1, xmm0
comiss xmm1, dword [0x100a2fec]
jbe 0x10068ad0
call fcn.10068b00
push edi
lea eax, [ebx + 8]
push eax
lea eax, [ebp - 0x1c]
push eax
call fcn.10068d70
mov ecx, dword [eax]
jmp 0x10068ad3
mov ecx, dword [ebp - 0x14]
push ebx
push ecx
push edi
call fcn.10068b90
add eax, 0xc
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x10068c00
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1fffffff
sub esp, 0x10
bsr ecx, eax
push ebx
push esi
push edi
mov edi, 1
mov eax, edi
shl eax, cl
mov ecx, dword [ebp + 8]
cmp ecx, eax
jbe 0x10068c2c
push str.invalid_hash_bucket_count
call dword [sym.imp.MSVCP140.dll_void___cdecl_std::_Xlength_error_char_const__]
lea eax, [ecx - 1]
mov esi, dword [0x100a2ff0]
or eax, 1
mov dword [ebp - 8], esi
bsr ecx, eax
push esi
lea ecx, [ecx + 1]
shl edi, cl
mov ecx, 0x100a2ff8
lea eax, [edi + edi]
push eax
call fcn.100051b0
mov eax, dword [0x100a2ff0]
lea ebx, [edi - 1]
mov dword [0x100a3004], ebx
mov dword [0x100a3008], edi
mov eax, dword [eax]
mov ecx, eax
cmp eax, esi
je 0x10068d66
movzx edx, byte [eax + 8]
xor edx, 0x811c9dc5
mov ecx, dword [ecx]
imul edi, edx, 0x1000193
movzx edx, byte [eax + 9]
xor edi, edx
movzx edx, byte [eax + 0xa]
imul edi, edi, 0x1000193
xor edi, edx
movzx edx, byte [eax + 0xb]
imul edi, edi, 0x1000193
xor edi, edx
mov edx, dword [0x100a2ff8]
imul edi, edi, 0x1000193
and edi, ebx
mov ebx, dword [edx + edi*8]
lea edx, [edx + edi*8]
mov dword [ebp - 0xc], edx
cmp ebx, esi
jne 0x10068cc4
mov dword [edx], eax
mov dword [edx + 4], eax
jmp 0x10068d31
mov edx, dword [edx + 4]
mov edi, dword [eax + 8]
cmp edi, dword [edx + 8]
jne 0x10068cfe
mov edx, dword [edx]
mov dword [ebp - 4], edx
cmp edx, eax
je 0x10068cf6
mov ebx, dword [eax + 4]
mov esi, dword [ebp - 4]
mov dword [ebx], ecx
mov edi, dword [ecx + 4]
mov dword [edi], edx
mov edx, dword [edx + 4]
mov dword [edx], eax
mov dword [esi + 4], edi
mov esi, dword [ebp - 8]
mov dword [ecx + 4], ebx
mov dword [eax + 4], edx
mov edx, dword [ebp - 0xc]
mov dword [edx + 4], eax
jmp 0x10068d31
cmp ebx, edx
je 0x10068d0e
mov edx, dword [edx + 4]
cmp edi, dword [edx + 8]
je 0x10068d42
cmp ebx, edx
jne 0x10068d02
mov ebx, dword [eax + 4]
mov dword [ebp - 4], ebx
mov dword [ebx], ecx
mov ebx, dword [ecx + 4]
mov dword [ebx], edx
mov edi, dword [edx + 4]
mov dword [edi], eax
mov dword [edx + 4], ebx
mov edx, dword [ebp - 4]
mov dword [ecx + 4], edx
mov edx, dword [ebp - 0xc]
mov dword [eax + 4], edi
mov dword [edx], eax
mov eax, ecx
cmp ecx, esi
je 0x10068d66
mov ebx, dword [0x100a3004]
jmp 0x10068c72
mov ebx, dword [eax + 4]
mov edx, dword [edx]
mov dword [ebp - 4], edx
mov esi, edx
mov dword [ebx], ecx
mov edi, dword [ecx + 4]
mov dword [edi], edx
mov edx, dword [edx + 4]
mov dword [edx], eax
mov dword [esi + 4], edi
mov esi, dword [ebp - 8]
mov dword [ecx + 4], ebx
mov dword [eax + 4], edx
jmp 0x10068d31
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x1006b9a0
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10083a95
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
push ebx
push esi
push edi
mov eax, dword [0x1009e040]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, dword [ebp + 0xc]
mov edi, dword [ebp + 8]
mov dword [ebp - 0x20], edi
movzx eax, byte [ebx]
xor eax, 0x811c9dc5
imul ecx, eax, 0x1000193
movzx eax, byte [ebx + 1]
xor ecx, eax
movzx eax, byte [ebx + 2]
imul ecx, ecx, 0x1000193
xor ecx, eax
movzx eax, byte [ebx + 3]
imul ecx, ecx, 0x1000193
xor ecx, eax
imul eax, ecx, 0x1000193
push eax
mov dword [ebp - 0x1c], eax
lea eax, [ebp - 0x18]
push ebx
push eax
call fcn.1006bd10
mov eax, dword [ebp - 0x14]
test eax, eax
je 0x1006ba23
mov dword [edi], eax
mov byte [edi + 4], 0
jmp 0x1006bb84
cmp dword [0x100a30e0], 0xfffffff
jne 0x1006ba3a
push str.unordered_map_set_too_long
call dword [sym.imp.MSVCP140.dll_void___cdecl_std::_Xlength_error_char_const__]
mov dword [ebp - 0x28], 0x100a30dc
mov dword [ebp - 4], 0
push 0x10
mov dword [ebp - 0x24], 0
call fcn.100828b8
mov ecx, dword [ebx]
mov esi, eax
add esp, 4
mov dword [ebp - 0x24], esi
mov dword [esi + 8], ecx
mov byte [esi + 0xc], 0
mov dword [ebp - 4], 1
mov ecx, dword [0x100a30e0]
mov ebx, dword [0x100a30f4]
lea eax, [ecx + 1]
movd xmm0, eax
cvtdq2pd xmm0, xmm0
shr eax, 0x1f
addsd xmm0, qword [eax*8 + 0x10097390]
mov eax, ebx
shr eax, 0x1f
cvtpd2ps xmm2, xmm0
movd xmm0, ebx
cvtdq2pd xmm0, xmm0
movaps xmm1, xmm2
addsd xmm0, qword [eax*8 + 0x10097390]
cvtpd2ps xmm0, xmm0
divss xmm1, xmm0
movss xmm0, dword [0x100a30d8]
comiss xmm1, xmm0
jbe 0x1006bb31
divss xmm2, xmm0
sub esp, 8
cvtps2pd xmm0, xmm2
movsd qword [ebp - 0x18], xmm0
fld qword [ebp - 0x18]
fstp qword [esp]
call sub.api_ms_win_crt_math_l1_1_0.dll_ceil
fstp qword [ebp - 0x18]
movsd xmm0, qword [ebp - 0x18]
add esp, 8
cvtpd2ps xmm0, xmm0
call fcn.10083870
mov ecx, 8
cmp eax, ecx
cmova ecx, eax
cmp ebx, ecx
jae 0x1006bb10
cmp ebx, 0x200
jae 0x1006bb0e
shl ebx, 3
cmp ebx, ecx
jae 0x1006bb10
mov ebx, ecx
push ebx
call fcn.1006bba0
mov edi, dword [ebp - 0x1c]
lea eax, [esi + 8]
push edi
push eax
lea eax, [ebp - 0x28]
push eax
call fcn.1006bd10
mov ecx, dword [0x100a30e0]
mov edx, dword [eax]
jmp 0x1006bb37
mov edx, dword [ebp - 0x18]
mov edi, dword [ebp - 0x1c]
mov ebx, dword [edx + 4]
inc ecx
mov dword [0x100a30e0], ecx
mov dword [esi], edx
mov dword [esi + 4], ebx
mov dword [ebx], esi
mov dword [edx + 4], esi
mov eax, dword [0x100a30f0]
mov ecx, dword [0x100a30e4]
and eax, edi
mov edi, dword [ecx + eax*8]
cmp edi, dword [0x100a30dc]
jne 0x1006bb68
mov dword [ecx + eax*8], esi
jmp 0x1006bb77
cmp edi, edx
jne 0x1006bb71
mov dword [ecx + eax*8], esi
jmp 0x1006bb7b
cmp dword [ecx + eax*8 + 4], ebx
jne 0x1006bb7b
mov dword [ecx + eax*8 + 4], esi
mov edi, dword [ebp - 0x20]
mov dword [edi], esi
mov byte [edi + 4], 1
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x1006bba0
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1fffffff
sub esp, 0x10
bsr ecx, eax
push ebx
push esi
push edi
mov edi, 1
mov eax, edi
shl eax, cl
mov ecx, dword [ebp + 8]
cmp ecx, eax
jbe 0x1006bbcc
push str.invalid_hash_bucket_count
call dword [sym.imp.MSVCP140.dll_void___cdecl_std::_Xlength_error_char_const__]
lea eax, [ecx - 1]
mov esi, dword [0x100a30dc]
or eax, 1
mov dword [ebp - 8], esi
bsr ecx, eax
push esi
lea ecx, [ecx + 1]
shl edi, cl
mov ecx, 0x100a30e4
lea eax, [edi + edi]
push eax
call fcn.100051b0
mov eax, dword [0x100a30dc]
lea ebx, [edi - 1]
mov dword [0x100a30f0], ebx
mov dword [0x100a30f4], edi
mov eax, dword [eax]
mov ecx, eax
cmp eax, esi
je 0x1006bd06
movzx edx, byte [eax + 8]
xor edx, 0x811c9dc5
mov ecx, dword [ecx]
imul edi, edx, 0x1000193
movzx edx, byte [eax + 9]
xor edi, edx
movzx edx, byte [eax + 0xa]
imul edi, edi, 0x1000193
xor edi, edx
movzx edx, byte [eax + 0xb]
imul edi, edi, 0x1000193
xor edi, edx
mov edx, dword [0x100a30e4]
imul edi, edi, 0x1000193
and edi, ebx
mov ebx, dword [edx + edi*8]
lea edx, [edx + edi*8]
mov dword [ebp - 0xc], edx
cmp ebx, esi
jne 0x1006bc64
mov dword [edx], eax
mov dword [edx + 4], eax
jmp 0x1006bcd1
mov edx, dword [edx + 4]
mov edi, dword [eax + 8]
cmp edi, dword [edx + 8]
jne 0x1006bc9e
mov edx, dword [edx]
mov dword [ebp - 4], edx
cmp edx, eax
je 0x1006bc96
mov ebx, dword [eax + 4]
mov esi, dword [ebp - 4]
mov dword [ebx], ecx
mov edi, dword [ecx + 4]
mov dword [edi], edx
mov edx, dword [edx + 4]
mov dword [edx], eax
mov dword [esi + 4], edi
mov esi, dword [ebp - 8]
mov dword [ecx + 4], ebx
mov dword [eax + 4], edx
mov edx, dword [ebp - 0xc]
mov dword [edx + 4], eax
jmp 0x1006bcd1
cmp ebx, edx
je 0x1006bcae
mov edx, dword [edx + 4]
cmp edi, dword [edx + 8]
je 0x1006bce2
cmp ebx, edx
jne 0x1006bca2
mov ebx, dword [eax + 4]
mov dword [ebp - 4], ebx
mov dword [ebx], ecx
mov ebx, dword [ecx + 4]
mov dword [ebx], edx
mov edi, dword [edx + 4]
mov dword [edi], eax
mov dword [edx + 4], ebx
mov edx, dword [ebp - 4]
mov dword [ecx + 4], edx
mov edx, dword [ebp - 0xc]
mov dword [eax + 4], edi
mov dword [edx], eax
mov eax, ecx
cmp ecx, esi
je 0x1006bd06
mov ebx, dword [0x100a30f0]
jmp 0x1006bc12
mov ebx, dword [eax + 4]
mov edx, dword [edx]
mov dword [ebp - 4], edx
mov esi, edx
mov dword [ebx], ecx
mov edi, dword [ecx + 4]
mov dword [edi], edx
mov edx, dword [edx + 4]
mov dword [edx], eax
mov dword [esi + 4], edi
mov esi, dword [ebp - 8]
mov dword [ecx + 4], ebx
mov dword [eax + 4], edx
jmp 0x1006bcd1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x1006d260
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10083a95
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
push ebx
push esi
push edi
mov eax, dword [0x1009e040]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, dword [ebp + 0xc]
mov edi, dword [ebp + 8]
mov dword [ebp - 0x20], edi
movzx eax, byte [ebx]
xor eax, 0x811c9dc5
imul ecx, eax, 0x1000193
movzx eax, byte [ebx + 1]
xor ecx, eax
movzx eax, byte [ebx + 2]
imul ecx, ecx, 0x1000193
xor ecx, eax
movzx eax, byte [ebx + 3]
imul ecx, ecx, 0x1000193
xor ecx, eax
imul eax, ecx, 0x1000193
push eax
mov dword [ebp - 0x1c], eax
lea eax, [ebp - 0x18]
push ebx
push eax
call fcn.1006d5d0
mov eax, dword [ebp - 0x14]
test eax, eax
je 0x1006d2e3
mov dword [edi], eax
mov byte [edi + 4], 0
jmp 0x1006d447
cmp dword [0x100a3158], 0xfffffff
jne 0x1006d2fa
push str.unordered_map_set_too_long
call dword [sym.imp.MSVCP140.dll_void___cdecl_std::_Xlength_error_char_const__]
mov dword [ebp - 0x28], 0x100a3154
mov dword [ebp - 4], 0
push 0x10
mov dword [ebp - 0x24], 0
call fcn.100828b8
mov ecx, dword [ebx]
mov esi, eax
add esp, 4
mov dword [ebp - 0x24], esi
mov dword [esi + 8], ecx
mov dword [esi + 0xc], 0
mov dword [ebp - 4], 1
mov ecx, dword [0x100a3158]
mov ebx, dword [0x100a316c]
lea eax, [ecx + 1]
movd xmm0, eax
cvtdq2pd xmm0, xmm0
shr eax, 0x1f
addsd xmm0, qword [eax*8 + 0x10097390]
mov eax, ebx
shr eax, 0x1f
cvtpd2ps xmm2, xmm0
movd xmm0, ebx
cvtdq2pd xmm0, xmm0
movaps xmm1, xmm2
addsd xmm0, qword [eax*8 + 0x10097390]
cvtpd2ps xmm0, xmm0
divss xmm1, xmm0
movss xmm0, dword [0x100a3150]
comiss xmm1, xmm0
jbe 0x1006d3f4
divss xmm2, xmm0
sub esp, 8
cvtps2pd xmm0, xmm2
movsd qword [ebp - 0x18], xmm0
fld qword [ebp - 0x18]
fstp qword [esp]
call sub.api_ms_win_crt_math_l1_1_0.dll_ceil
fstp qword [ebp - 0x18]
movsd xmm0, qword [ebp - 0x18]
add esp, 8
cvtpd2ps xmm0, xmm0
call fcn.10083870
mov ecx, 8
cmp eax, ecx
cmova ecx, eax
cmp ebx, ecx
jae 0x1006d3d3
cmp ebx, 0x200
jae 0x1006d3d1
shl ebx, 3
cmp ebx, ecx
jae 0x1006d3d3
mov ebx, ecx
push ebx
call fcn.1006d460
mov edi, dword [ebp - 0x1c]
lea eax, [esi + 8]
push edi
push eax
lea eax, [ebp - 0x28]
push eax
call fcn.1006d5d0
mov ecx, dword [0x100a3158]
mov edx, dword [eax]
jmp 0x1006d3fa
mov edx, dword [ebp - 0x18]
mov edi, dword [ebp - 0x1c]
mov ebx, dword [edx + 4]
inc ecx
mov dword [0x100a3158], ecx
mov dword [esi], edx
mov dword [esi + 4], ebx
mov dword [ebx], esi
mov dword [edx + 4], esi
mov eax, dword [0x100a3168]
mov ecx, dword [0x100a315c]
and eax, edi
mov edi, dword [ecx + eax*8]
cmp edi, dword [0x100a3154]
jne 0x1006d42b
mov dword [ecx + eax*8], esi
jmp 0x1006d43a
cmp edi, edx
jne 0x1006d434
mov dword [ecx + eax*8], esi
jmp 0x1006d43e
cmp dword [ecx + eax*8 + 4], ebx
jne 0x1006d43e
mov dword [ecx + eax*8 + 4], esi
mov edi, dword [ebp - 0x20]
mov dword [edi], esi
mov byte [edi + 4], 1
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x1006d460
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1fffffff
sub esp, 0x10
bsr ecx, eax
push ebx
push esi
push edi
mov edi, 1
mov eax, edi
shl eax, cl
mov ecx, dword [ebp + 8]
cmp ecx, eax
jbe 0x1006d48c
push str.invalid_hash_bucket_count
call dword [sym.imp.MSVCP140.dll_void___cdecl_std::_Xlength_error_char_const__]
lea eax, [ecx - 1]
mov esi, dword [0x100a3154]
or eax, 1
mov dword [ebp - 8], esi
bsr ecx, eax
push esi
lea ecx, [ecx + 1]
shl edi, cl
mov ecx, 0x100a315c
lea eax, [edi + edi]
push eax
call fcn.100051b0
mov eax, dword [0x100a3154]
lea ebx, [edi - 1]
mov dword [0x100a3168], ebx
mov dword [0x100a316c], edi
mov eax, dword [eax]
mov ecx, eax
cmp eax, esi
je 0x1006d5c6
movzx edx, byte [eax + 8]
xor edx, 0x811c9dc5
mov ecx, dword [ecx]
imul edi, edx, 0x1000193
movzx edx, byte [eax + 9]
xor edi, edx
movzx edx, byte [eax + 0xa]
imul edi, edi, 0x1000193
xor edi, edx
movzx edx, byte [eax + 0xb]
imul edi, edi, 0x1000193
xor edi, edx
mov edx, dword [0x100a315c]
imul edi, edi, 0x1000193
and edi, ebx
mov ebx, dword [edx + edi*8]
lea edx, [edx + edi*8]
mov dword [ebp - 0xc], edx
cmp ebx, esi
jne 0x1006d524
mov dword [edx], eax
mov dword [edx + 4], eax
jmp 0x1006d591
mov edx, dword [edx + 4]
mov edi, dword [eax + 8]
cmp edi, dword [edx + 8]
jne 0x1006d55e
mov edx, dword [edx]
mov dword [ebp - 4], edx
cmp edx, eax
je 0x1006d556
mov ebx, dword [eax + 4]
mov esi, dword [ebp - 4]
mov dword [ebx], ecx
mov edi, dword [ecx + 4]
mov dword [edi], edx
mov edx, dword [edx + 4]
mov dword [edx], eax
mov dword [esi + 4], edi
mov esi, dword [ebp - 8]
mov dword [ecx + 4], ebx
mov dword [eax + 4], edx
mov edx, dword [ebp - 0xc]
mov dword [edx + 4], eax
jmp 0x1006d591
cmp ebx, edx
je 0x1006d56e
mov edx, dword [edx + 4]
cmp edi, dword [edx + 8]
je 0x1006d5a2
cmp ebx, edx
jne 0x1006d562
mov ebx, dword [eax + 4]
mov dword [ebp - 4], ebx
mov dword [ebx], ecx
mov ebx, dword [ecx + 4]
mov dword [ebx], edx
mov edi, dword [edx + 4]
mov dword [edi], eax
mov dword [edx + 4], ebx
mov edx, dword [ebp - 4]
mov dword [ecx + 4], edx
mov edx, dword [ebp - 0xc]
mov dword [eax + 4], edi
mov dword [edx], eax
mov eax, ecx
cmp ecx, esi
je 0x1006d5c6
mov ebx, dword [0x100a3168]
jmp 0x1006d4d2
mov ebx, dword [eax + 4]
mov edx, dword [edx]
mov dword [ebp - 4], edx
mov esi, edx
mov dword [ebx], ecx
mov edi, dword [ecx + 4]
mov dword [edi], edx
mov edx, dword [edx + 4]
mov dword [edx], eax
mov dword [esi + 4], edi
mov esi, dword [ebp - 8]
mov dword [ecx + 4], ebx
mov dword [eax + 4], edx
jmp 0x1006d591
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x10071b00
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x1c
mov eax, dword [0x1009e040]
xor eax, esp
mov dword [esp + 0x18], eax
cmp byte [0x100a3422], 0
movaps xmm0, xmm1
push esi
movss dword [esp + 4], xmm0
mov dword [esp + 0x10], ecx
jne 0x10071baf
mov edx, 0x100733d0
mov byte [0x100a3422], 1
mov ecx, 0x100a344c
call fcn.100048e0
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [esp + 0x14]
push eax
push 0x40
push 4
push dword [0x100a3450]
call esi
lea eax, [esp + 0x18]
push eax
push 0x40
push 4
push dword [0x100a3448]
call esi
mov ecx, dword [0x100a3450]
mov eax, dword [0x100a3448]
mov dword [ecx], 0x909008eb
mov dword [eax], 0x909008eb
lea eax, [esp + 0x14]
push eax
push dword [esp + 0x18]
push 4
push ecx
call esi
lea eax, [esp + 0x18]
push eax
push dword [esp + 0x1c]
push 4
push dword [0x100a3448]
call esi
mov ecx, dword [esp + 0x10]
movss xmm0, dword [esp + 4]
test ecx, ecx
je 0x10071bef
comiss xmm0, dword [0x10097308]
jbe 0x10071bef
lea eax, [esp + 0x10]
mov ecx, 0x100a0dc8
push eax
lea eax, [esp + 0xc]
push eax
call fcn.10065d90
movss xmm0, dword [esp + 4]
mov eax, dword [eax]
movss dword [eax + 0xc], xmm0
mov al, 1
pop esi
mov ecx, dword [esp + 0x18]
xor ecx, esp
call fcn.100828aa
mov esp, ebp
pop ebp
ret
mov ecx, dword [esp + 0x1c]
xor al, al
pop esi
xor ecx, esp
call fcn.100828aa
mov esp, ebp
pop ebp
ret

Function at 0x10071c10
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x18
mov eax, dword [0x1009e040]
xor eax, esp
mov dword [esp + 0x14], eax
mov edx, ecx
mov dword [esp + 0x10], edx
test edx, edx
je 0x10071cac
movzx eax, dl
xor eax, 0x811c9dc5
imul ecx, eax, 0x1000193
mov eax, edx
shr eax, 8
movzx eax, al
xor ecx, eax
mov eax, edx
shr eax, 0x10
imul ecx, ecx, 0x1000193
movzx eax, al
shr edx, 0x18
xor ecx, eax
imul eax, ecx, 0x1000193
mov ecx, 0x100a0dc8
xor eax, edx
imul eax, eax, 0x1000193
push eax
lea eax, [esp + 0x14]
push eax
lea eax, [esp + 8]
push eax
call fcn.100116a0
cmp dword [eax + 4], 0
je 0x10071cac
lea eax, [esp + 0x10]
mov ecx, 0x100a0dc8
push eax
lea eax, [esp + 0xc]
push eax
call fcn.10065d90
mov eax, dword [eax]
movss xmm0, dword [eax + 0xc]
mov ecx, dword [esp + 0x14]
xor ecx, esp
call fcn.100828aa
mov esp, ebp
pop ebp
ret
mov ecx, dword [esp + 0x14]
movss xmm0, dword [0x1009735c]
xor ecx, esp
call fcn.100828aa
mov esp, ebp
pop ebp
ret
Function at 0x10073d60
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [0x1009e040]
xor eax, ebp
mov dword [ebp - 4], eax
push edi
mov edi, ecx
test edi, edi
je 0x10073ddd
push esi
push 8
push 0xffffffffffffffff
push str.plugin_memory
push 0xc4
mov dword [ebp - 8], 0x40
call dword [0x100a163c]
mov esi, eax
lea eax, [ebp - 8]
push eax
push dword [ebp - 8]
push 0xc4
push esi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
test esi, esi
je 0x10073dcb
push 1
push 2
push edi
xor edx, edx
mov ecx, esi
call dword [0x100a3504]
pop esi
pop edi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100828aa
mov esp, ebp
pop ebp
ret
pop esi
xor eax, eax
pop edi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100828aa
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor eax, eax
xor ecx, ebp
pop edi
call fcn.100828aa
mov esp, ebp
pop ebp
ret

Function at 0x1007c930
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10085735
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push ebx
push esi
push edi
mov eax, dword [0x1009e040]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
movzx eax, byte [esi]
xor eax, 0x811c9dc5
imul ecx, eax, 0x1000193
movzx eax, byte [esi + 1]
xor ecx, eax
movzx eax, byte [esi + 2]
imul ecx, ecx, 0x1000193
xor ecx, eax
movzx eax, byte [esi + 3]
imul ecx, ecx, 0x1000193
xor ecx, eax
lea eax, [ebp - 0x14]
imul edi, ecx, 0x1000193
push edi
push esi
push eax
call fcn.1007d220
mov eax, dword [ebp - 0x10]
test eax, eax
jne 0x1007ca5b
cmp dword [0x100a359c], 0xfffffff
jne 0x1007c9ba
push str.unordered_map_set_too_long
call dword [sym.imp.MSVCP140.dll_void___cdecl_std::_Xlength_error_char_const__]
mov dword [ebp - 0x1c], 0x100a3598
mov dword [ebp - 4], 0
push 0x10
mov dword [ebp - 0x18], 0
call fcn.100828b8
mov ebx, eax
add esp, 4
mov eax, dword [esi]
mov dword [ebp - 0x18], ebx
mov dword [ebx + 8], eax
mov dword [ebx + 0xc], 0
mov dword [ebp - 4], 1
mov eax, dword [0x100a359c]
inc eax
movd xmm0, eax
cvtdq2pd xmm0, xmm0
shr eax, 0x1f
addsd xmm0, qword [eax*8 + 0x10097390]
mov eax, dword [0x100a35b0]
cvtpd2ps xmm1, xmm0
movd xmm0, eax
cvtdq2pd xmm0, xmm0
shr eax, 0x1f
addsd xmm0, qword [eax*8 + 0x10097390]
cvtpd2ps xmm0, xmm0
divss xmm1, xmm0
comiss xmm1, dword [0x100a3594]
jbe 0x1007ca50
call fcn.1007cdd0
push edi
lea eax, [ebx + 8]
push eax
lea eax, [ebp - 0x1c]
push eax
call fcn.1007d220
mov ecx, dword [eax]
jmp 0x1007ca53
mov ecx, dword [ebp - 0x14]
push ebx
push ecx
push edi
call fcn.1007ce60
add eax, 0xc
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4