joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4fe92c
Capabilities:
Copy file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe78
xor ecx, ecx
mov dword [ebp - 0x184], ecx
mov dword [ebp - 0x188], ecx
mov dword [ebp - 0x17c], ecx
mov dword [ebp - 0x180], ecx
mov dword [ebp - 0x178], ecx
mov dword [ebp - 0x174], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.0040569c
mov eax, dword [ebp - 8]
call fcn.0040569c
lea eax, [ebp - 0x170]
mov edx, dword [0x4089b4]
call fcn.00405e24
xor eax, eax
push ebp
push 0x4feb0a
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x174]
mov ecx, 0x4feb20
mov edx, dword [ebp - 4]
call fcn.004054f8
mov eax, dword [ebp - 0x174]
lea ecx, [ebp - 0x170]
mov edx, 0x3f
call fcn.0040a550
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x4feac3
test byte [ebp - 0x160], 0x18
jne 0x4feaab
mov eax, dword [ebp - 0x15c]
mov edx, 0x4feb30
call fcn.004055f8
je 0x4feaab
mov eax, dword [ebp - 0x15c]
mov edx, 0x4feb3c
call fcn.004055f8
je 0x4feaab
lea eax, [ebp - 0x178]
mov ecx, dword [ebp - 0x15c]
mov edx, dword [ebp - 8]
call fcn.004054f8
mov eax, dword [ebp - 0x178]
call fcn.0040a2a8
test al, al
jne 0x4fea6b
push 0
lea eax, [ebp - 0x17c]
mov ecx, dword [ebp - 0x15c]
mov edx, dword [ebp - 8]
call fcn.004054f8
mov eax, dword [ebp - 0x17c]
call fcn.004056ac
push eax
lea eax, [ebp - 0x180]
mov ecx, dword [ebp - 0x15c]
mov edx, dword [ebp - 4]
call fcn.004054f8
mov eax, dword [ebp - 0x180]
call fcn.004056ac
push eax
call sub.kernel32.dll_CopyFileA
jmp 0x4feaab
mov eax, dword [ebp + 8]
push eax
lea eax, [ebp - 0x184]
mov ecx, dword [ebp - 0x15c]
mov edx, dword [ebp - 8]
call fcn.004054f8
mov eax, dword [ebp - 0x184]
push eax
lea eax, [ebp - 0x188]
mov ecx, dword [ebp - 0x15c]
mov edx, dword [ebp - 4]
call fcn.004054f8
mov eax, dword [ebp - 0x188]
pop edx
call fcn.004fe718
pop ecx
lea eax, [ebp - 0x170]
call fcn.0040a5a0
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x4fe9c6
lea eax, [ebp - 0x170]
call fcn.0040a5c4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4feb11
lea eax, [ebp - 0x188]
mov edx, 6
call fcn.0040520c
lea eax, [ebp - 0x170]
mov edx, dword [0x4089b4]
call fcn.00405ef4
lea eax, [ebp - 8]
mov edx, 2
call fcn.0040520c
ret
Function at 0x4ff088
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.0040569c
xor eax, eax
push ebp
push 0x4ff155
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp + 0x10]
cmp dword [eax + 0xc], 0
jne 0x4ff100
cmp dword [eax + 8], 0
jne 0x4ff100
mov eax, dword [ebp + 0x10]
mov eax, dword [eax - 4]
call fcn.004fd7fc
shrd eax, edx, 0x14
shr edx, 0x14
cmp edx, 0
jne 0x4ff0d4
cmp eax, 0x100
jb 0x4ff10f
jmp 0x4ff0d6
jl 0x4ff10f
mov eax, dword [ebp + 0x10]
mov eax, dword [eax - 4]
cmp byte [eax + 0x280], 0
je 0x4ff10f
mov eax, dword [ebp + 0x10]
mov eax, dword [eax - 4]
mov eax, dword [eax + 0x288]
mov edx, dword [ebp - 4]
call fcn.004f4118
cmp eax, 0x5a
jl 0x4ff13f
jmp 0x4ff10f
mov eax, dword [ebp + 8]
mov edx, dword [ebp + 0xc]
mov ecx, dword [ebp + 0x10]
sub dword [ecx - 0x10], eax
sbb dword [ecx - 0xc], edx
mov eax, dword [ebp - 4]
call fcn.004dc810
mov eax, dword [ebp - 4]
call fcn.004056ac
push eax
call sub.kernel32.dll_DeleteFileA
mov eax, dword [ebp + 0x10]
cmp dword [eax - 0xc], 0
jne 0x4ff136
cmp dword [eax - 0x10], 0
jae 0x4ff13f
jmp 0x4ff138
jge 0x4ff13f
mov eax, dword [ebp + 0x10]
mov byte [eax - 0x11], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4ff15c
lea eax, [ebp - 4]
call fcn.004051e8
ret
Function at 0x50a2b4
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffcc
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0x1c], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.0040569c
xor eax, eax
push ebp
push 0x50a394
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x14]
push eax
mov eax, dword [ebp - 4]
call fcn.004056ac
push eax
call sub.version.dll_GetFileVersionInfoSizeA
mov dword [ebp - 0x10], eax
xor eax, eax
push ebp
push 0x50a367
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0x10]
call fcn.00402d48
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x50a358
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [ebp - 0x10]
push eax
push 0
lea eax, [ebp - 4]
call fcn.00405704
push eax
call sub.version.dll_GetFileVersionInfoA
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x18]
push eax
push 0x50a3a8
mov eax, dword [ebp - 0xc]
push eax
call sub.version.dll_VerQueryValueA
mov eax, dword [ebp - 0x18]
mov eax, dword [eax + 8]
shr eax, 0x10
and eax, 0xff
mov dword [ebp - 8], eax
mov eax, dword [ebp - 0xc]
call fcn.00402d64
jmp 0x50a35d
xor eax, eax
mov dword [ebp - 8], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x50a376
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x50a39b
lea eax, [ebp - 0x1c]
call fcn.004051e8
lea eax, [ebp - 4]
call fcn.004051e8
ret
Function at 0x515814
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 8], edx
mov byte [ebp - 1], al
xor eax, eax
push ebp
push 0x515936
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [0x527578], 0
jne 0x5158c8
cmp byte [0x52757c], 0
jne 0x5158c8
mov byte [0x52757c], 1
mov al, byte [ebp - 1]
mov byte [0x52df88], al
xor eax, eax
push ebp
push 0x5158b4
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 8]
mov eax, 0x527568
call fcn.0048a5f0
mov edx, dword [ebp - 8]
mov eax, 0x527578
mov ecx, 0x515944
call fcn.00406fa4
mov eax, dword [0x527578]
push eax
mov eax, dword [eax]
call dword [eax + 0xc]
mov al, byte [ebp - 1]
push eax
mov eax, dword [0x527b70]
mov eax, dword [eax]
mov eax, dword [eax + 0x30]
push eax
mov eax, dword [0x527578]
push eax
mov eax, dword [eax]
call dword [eax + 0x28]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x5158c8
cmp dword [0x527578], 0
je 0x515920
mov al, byte [ebp - 1]
cmp al, byte [0x52df88]
je 0x515920
xor eax, eax
push ebp
push 0x515916
push dword fs:[eax]
mov dword fs:[eax], esp
mov al, byte [ebp - 1]
mov byte [0x52df88], al
mov al, byte [ebp - 1]
push eax
mov eax, dword [0x527b70]
mov eax, dword [eax]
mov eax, dword [eax + 0x30]
push eax
mov eax, dword [0x527578]
push eax
mov eax, dword [eax]
call dword [eax + 0x28]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x515920
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x51593d
lea eax, [ebp - 8]
call fcn.00406f60
ret

Function at 0x515a5c
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff68
lea eax, [ebp - 0x98]
xor ecx, ecx
mov edx, 0x94
call fcn.00403a94
mov dword [ebp - 0x98], 0x94
lea eax, [ebp - 0x98]
push eax
call sub.kernel32.dll_GetVersionExA
cmp dword [ebp - 0x94], 6
setae byte [ebp - 1]
mov al, byte [ebp - 1]
mov esp, ebp
pop ebp
ret

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x1000b7a1
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push 0x424
mov eax, 0x10012385
call fcn.1001109f
mov eax, dword [ebp + 0xc]
xor ebx, ebx
mov edi, dword [ebp + 8]
mov dword [ebp - 0x424], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x420], eax
mov dword [ebp - 0x428], ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 0x42c], ecx
mov dword [ebp - 0x430], ebx
mov dword [ebp - 0x418], ebx
mov byte [ebp - 4], 1
test edi, edi
je 0x1000b97f
push edi
call dword [sym.imp.MSVCR120.dll_wcslen]
inc eax
push 2
push eax
mov dword [ebp - 0x41c], eax
lea eax, [ebp - 0x41c]
push eax
call fcn.10011412
add esp, 0x10
test eax, eax
js 0x1000b979
mov esi, dword [ebp - 0x41c]
cmp esi, 0x400
jg 0x1000b83d
push esi
call fcn.10006ae7
pop ecx
test al, al
je 0x1000b83d
mov eax, esi
call fcn.100110e0
mov dword [ebp - 0x10], esp
mov eax, esp
jmp 0x1000b849
push esi
lea ecx, [ebp - 0x428]
call fcn.10011412
push 3
push esi
push edi
push eax
call fcn.10011412
mov esi, eax
test esi, esi
je 0x1000b979
push 0x60
push ebx
push esi
call dword [sym.imp.kernel32.dll_LoadLibraryExA]
mov edi, eax
mov dword [ebp - 0x41c], edi
test edi, edi
jne 0x1000b895
push 2
push ebx
push esi
call dword [sym.imp.kernel32.dll_LoadLibraryExA]
mov edi, eax
mov dword [ebp - 0x41c], eax
test edi, edi
jne 0x1000b895
call fcn.10002f77
mov esi, eax
jmp 0x1000b95e
push dword [ebp - 0x420]
push dword [ebp - 0x424]
push edi
call dword [sym.imp.kernel32.dll_FindResourceA]
mov esi, eax
test esi, esi
jne 0x1000b8b8
call fcn.10002f77
jmp 0x1000b951
push esi
push edi
call dword [sym.imp.kernel32.dll_LoadResource]
mov dword [ebp - 0x420], eax
test eax, eax
je 0x1000b8ae
push esi
push edi
call dword [sym.imp.kernel32.dll_SizeofResource]
mov esi, eax
mov dword [ebp - 0x424], esi
lea eax, [esi + 1]
cmp eax, esi
jae 0x1000b8e8
mov esi, 0x8007000e
jmp 0x1000b953
push eax
lea ecx, [ebp - 0x418]
mov byte [ebp - 4], 2
call fcn.10011412
jmp 0x1000b90e
cmp dword [ebp - 0x418], 0
mov dword [ebp - 4], 1
je 0x1000b8e1
push esi
push dword [ebp - 0x420]
push esi
push dword [ebp - 0x418]
call fcn.10011412
mov eax, dword [ebp - 0x418]
lea ecx, [ebp - 0x430]
add esp, 0x10
mov byte [eax + esi], bl
push dword [ebp + 0x14]
push dword [ebp - 0x418]
call fcn.10011412
mov esi, eax
test edi, edi
je 0x1000b95e
push edi
call dword [sym.imp.kernel32.dll_FreeLibrary]
lea eax, [ebp - 0x414]
cmp dword [ebp - 0x418], eax
je 0x1000b999
lea ecx, [ebp - 0x418]
call fcn.1000af68
jmp 0x1000b999
mov ebx, dword [ebp - 0x418]
lea eax, [ebp - 0x414]
cmp ebx, eax
je 0x1000b994
lea ecx, [ebp - 0x418]
call fcn.1000af68
mov esi, 0x8007000e
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x428]
call fcn.10001f09
mov eax, esi
lea esp, [ebp - 0x440]
call fcn.10010ff1
ret 0x10
Function at 0x1000d27a
Capabilities:
Parse url

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
sub esp, 0x3c
push ebx
mov ebx, dword [sym.imp.MSVCR120.dll__wcsicmp]
push esi
mov esi, dword [eax + 8]
push edi
mov edi, dword [ebp + 0x10]
add esi, 0x568
push 0x100144f0
push edi
call ebx
pop ecx
pop ecx
test eax, eax
je 0x1000d2fd
push str.file:__
push edi
call ebx
pop ecx
pop ecx
test eax, eax
je 0x1000d2fd
push dword [ebp + 0xc]
push edi
call ebx
pop ecx
pop ecx
test eax, eax
je 0x1000d2fd
push 0x38
xor ebx, ebx
mov dword [ebp - 0x3c], 0x3c
lea eax, [ebp - 0x38]
push ebx
push eax
call sub.MSVCR120.dll_memset
add esp, 0xc
lea eax, [ebp - 0x3c]
push eax
push ebx
push ebx
push edi
call dword [sym.imp.wininet.dll_InternetCrackUrlW]
test eax, eax
je 0x1000d300
mov eax, dword [ebp - 0x30]
cmp eax, 1
je 0x1000d2f9
add eax, 0xfffffffd
cmp eax, 1
ja 0x1000d300
mov esi, edi
jmp 0x1000d300
mov esi, dword [ebp + 0xc]
push esi
push dword [ebp + 0x20]
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
call fcn.10011412
add esp, 0x10
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x20
Function at 0x407e15
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x42e180]
jne 0x407e1f
repz ret
jmp fcn.0040bc0c

Function at 0x40ea60
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
pushal
call 0x40ea6f
pop dword [ebp - 0x18]
mov eax, 0xdbbac363
add eax, 0x2486270c
sub dword [ebp - 0x18], eax
mov dword [ebp - 0x28], 0xe1626274
sub dword [ebp - 0x28], 0x93101d29
mov dword [ebp - 0x24], 0xe0797b3
sub dword [ebp - 0x24], 0xdbd44b6e
mov dword [ebp - 0x20], 0x9989aa40
add dword [ebp - 0x20], 0xb2c299ee
mov dword [ebp - 0x1c], 0x489829c8
sub dword [ebp - 0x1c], 0x489829c8
lea eax, [ebp - 0x28]
push eax
mov eax, sym.imp.kernel32.dll_GetModuleHandleA
add eax, dword [ebp - 0x18]
call dword [eax]
mov dword [ebp - 0x28], 0xdf52dca8
add dword [ebp - 0x28], 0x951f8cae
mov dword [ebp - 0x24], 0xf1a15e51
add dword [ebp - 0x24], 0x4fcb0324
mov dword [ebp - 0x20], 0x96bdbaa3
sub dword [ebp - 0x20], 0x334e4e37
mov dword [ebp - 0x1c], 0xc12b5e4e
sub dword [ebp - 0x1c], 0xc12b5e4e
lea ebx, [ebp - 0x28]
push ebx
push eax
mov eax, 0x9df6a3b9
sub eax, 0x9db47295
add eax, dword [ebp - 0x18]
call dword [eax]
push 0x40
push 0x1000
push 0x3f64b
push 0
call eax
mov ecx, 0x57c94aba
add ecx, 0xa83703f6
mov ebx, eax
mov esi, 0x434400
add esi, dword [ebp - 0x18]
mov edx, 0x4a865e20
add edx, 0x662d8ce3
mov dword [ebp - 8], 0xea4ed560
mov edi, dword [esi]
sub dword [ebp - 4], 0x4901e5a8
xor edi, edx
mov dword [ebx], edi
sub dword [ebp - 0x14], edx
add ebx, 0x9970650
sub ebx, 0x997064c
add esi, 4
loop 0x40eb86
add eax, 0x3037dc9b
sub eax, 0x3036af08
mov ebx, eax
add eax, 0xc822785b
add eax, 0x37dd87aa
mov ecx, 0xc3c01e3c
add ecx, 0x3c7fe1c4
add ecx, dword [ebp - 0x18]
call ebx
leave
ret
Function at 0x4b5910
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x4b593d
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x4b593d
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret
Function at 0x100016e0
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
mov eax, dword [0x10028c30]
sub esp, 0xc
mov ecx, 0x10028c30
push ebx
call dword [eax]
mov edx, dword [ebp + 8]
movzx eax, dl
xor eax, 0x811c9dc5
imul ecx, eax, 0x1000193
movzx eax, dh
xor ecx, eax
movzx eax, byte [ebp + 0xa]
imul ecx, ecx, 0x1000193
xor ecx, eax
movzx eax, byte [ebp + 0xb]
imul ecx, ecx, 0x1000193
xor ecx, eax
imul eax, ecx, 0x1000193
mov ecx, 0x10028c10
push eax
lea eax, [ebp + 8]
push eax
lea eax, [esp + 0x10]
push eax
call fcn.10003350
mov eax, dword [eax + 4]
test eax, eax
je 0x1000174f
mov bl, 1
cmp eax, dword [0x10028c14]
jne 0x10001764
lea eax, [ebp + 8]
mov ecx, 0x10028c10
push eax
lea eax, [esp + 0xc]
push eax
call fcn.10002bc0
xor bl, bl
mov edx, dword [0x10028c30]
mov ecx, 0x10028c30
call dword [edx + 4]
mov al, bl
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x10001cf0
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
mov ebx, dword [ebp + 8]
push ebx
call fcn.100016e0
test al, al
je 0x10001d0d
xor al, al
pop ebx
mov esp, ebp
pop ebp
ret 0x10
push esi
push edi
push ecx
push ebx
call fcn.100018e0
push 0x400
push 0x40
mov dword [ebp - 4], eax
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov edi, eax
lea eax, [ebp - 8]
push eax
push 0x40
push 0x400
push edi
mov dword [ebp + 8], edi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov eax, dword [0x10028c58]
cmp eax, dword [0x10028c5c]
je 0x10001d55
mov dword [eax], edi
add dword [0x10028c58], 4
jmp 0x10001d64
lea ecx, [ebp + 8]
push ecx
push eax
mov ecx, 0x10028c54
call fcn.100031f0
lea eax, [edi + 2]
mov word [edi], 0x9c60
mov dword [ebp + 8], eax
lea eax, [ebp + 8]
push eax
call fcn.10001bf0
mov eax, dword [ebp + 8]
mov dword [ebp + 8], 0
lea esi, [eax + 1]
mov byte [eax], 0x54
lea eax, [ebp + 8]
push eax
push 4
push 5
push esi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov eax, 0x10003760
mov byte [esi], 0xe8
sub eax, esi
sub eax, 5
mov dword [esi + 1], eax
lea eax, [ebp + 8]
push eax
push dword [ebp + 8]
push 5
push esi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [esi + 5]
mov dword [ebp + 8], eax
lea eax, [ebp + 8]
push eax
call fcn.10001c70
mov eax, dword [ebp + 8]
push dword [ebp - 4]
push ebx
lea esi, [eax + 2]
mov word [eax], 0x619d
push esi
call fcn.10001960
add esi, eax
mov dword [ebp + 8], 0
lea eax, [ebp + 8]
push eax
push 4
push 5
push esi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov eax, dword [ebp - 4]
sub eax, esi
mov byte [esi], 0xe9
add eax, 0xfffffffb
add eax, ebx
mov dword [esi + 1], eax
lea eax, [ebp + 8]
push eax
push dword [ebp + 8]
push 5
push esi
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
call esi
lea eax, [ebp + 8]
mov dword [ebp + 8], 0
push eax
push 4
push 5
push ebx
call esi
lea eax, [ebp + 8]
mov byte [ebx], 0xe9
push eax
push dword [ebp + 8]
sub edi, ebx
push 5
sub edi, 5
push ebx
mov dword [ebx + 1], edi
call esi
pop edi
pop esi
mov al, 1
pop ebx
mov esp, ebp
pop ebp
ret 0x10
Function at 0x10002bc0
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10014655
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push ebx
push esi
push edi
mov eax, dword [0x1001f040]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov ebx, dword [ebp + 0xc]
movzx eax, byte [ebx]
xor eax, 0x811c9dc5
imul edx, eax, 0x1000193
movzx eax, byte [ebx + 1]
xor edx, eax
movzx eax, byte [ebx + 2]
imul edx, edx, 0x1000193
xor edx, eax
movzx eax, byte [ebx + 3]
imul ecx, edx, 0x1000193
xor ecx, eax
imul eax, ecx, 0x1000193
mov ecx, edi
push eax
mov dword [ebp + 0xc], eax
lea eax, [ebp - 0x20]
push ebx
push eax
call fcn.10003350
mov ecx, dword [ebp - 0x1c]
test ecx, ecx
je 0x10002c53
mov eax, dword [ebp + 8]
mov dword [eax], ecx
mov byte [eax + 4], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
cmp dword [edi + 8], 0x15555555
je 0x10002da1
lea eax, [edi + 4]
mov dword [ebp - 0x14], eax
mov dword [ebp - 4], 0
push 0xc
mov dword [ebp - 0x10], 0
call fcn.10003d71
mov ecx, dword [ebx]
mov esi, eax
add esp, 4
mov dword [ebp - 0x10], esi
mov dword [esi + 8], ecx
mov dword [ebp - 4], 1
mov eax, dword [edi + 8]
mov ebx, dword [edi + 0x1c]
inc eax
movss xmm3, dword [edi]
movd xmm0, eax
cvtdq2pd xmm0, xmm0
shr eax, 0x1f
addsd xmm0, qword [eax*8 + 0x1001d460]
mov eax, ebx
shr eax, 0x1f
cvtpd2ps xmm2, xmm0
movd xmm0, ebx
cvtdq2pd xmm0, xmm0
movaps xmm1, xmm2
addsd xmm0, qword [eax*8 + 0x1001d460]
cvtpd2ps xmm0, xmm0
divss xmm1, xmm0
comiss xmm1, xmm3
jbe 0x10002d43
divss xmm2, xmm3
sub esp, 8
cvtps2pd xmm0, xmm2
movsd qword [ebp - 0x20], xmm0
fld qword [ebp - 0x20]
fstp qword [esp]
call fcn.100123f0
fstp qword [ebp - 0x20]
movsd xmm0, qword [ebp - 0x20]
add esp, 8
cvtpd2ps xmm0, xmm0
call fcn.10014590
mov ecx, 8
cmp eax, ecx
cmova ecx, eax
cmp ebx, ecx
jae 0x10002d25
cmp ebx, 0x200
jae 0x10002d23
shl ebx, 3
cmp ebx, ecx
jae 0x10002d25
mov ebx, ecx
push ebx
mov ecx, edi
call fcn.10002dd0
push dword [ebp + 0xc]
lea eax, [esi + 8]
mov ecx, edi
push eax
lea eax, [ebp - 0x20]
push eax
call fcn.10003350
mov edx, dword [eax]
jmp 0x10002d46
mov edx, dword [ebp - 0x20]
mov ebx, dword [edx + 4]
inc dword [edi + 8]
mov dword [esi], edx
mov dword [esi + 4], ebx
mov dword [ebx], esi
mov dword [edx + 4], esi
mov eax, dword [edi + 0x18]
and eax, dword [ebp + 0xc]
mov ecx, dword [edi + 0xc]
mov esi, dword [ebp - 0x14]
mov edi, dword [ecx + eax*8]
cmp edi, dword [esi]
mov esi, dword [ebp - 0x10]
jne 0x10002d71
mov dword [ecx + eax*8], esi
jmp 0x10002d80
cmp edi, edx
jne 0x10002d7a
mov dword [ecx + eax*8], esi
jmp 0x10002d84
cmp dword [ecx + eax*8 + 4], ebx
jne 0x10002d84
mov dword [ecx + eax*8 + 4], esi
mov eax, dword [ebp + 8]
mov dword [eax], esi
mov byte [eax + 4], 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
push str.unordered_map_set_too_long
call fcn.10003c21
int3
Function at 0x10002dd0
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov edx, dword [ebp + 8]
mov eax, 0x1fffffff
push ebx
push esi
push edi
mov edi, ecx
mov esi, 1
bsr ecx, eax
mov eax, esi
mov dword [ebp - 4], edi
shl eax, cl
cmp edx, eax
ja 0x10002f1c
mov ebx, dword [edi + 4]
lea eax, [edx - 1]
or eax, esi
mov dword [ebp - 8], ebx
bsr ecx, eax
push ebx
lea ecx, [ecx + 1]
shl esi, cl
lea ecx, [edi + 0xc]
lea eax, [esi + esi]
push eax
call fcn.10002ac0
mov ecx, dword [edi + 4]
lea eax, [esi - 1]
mov dword [edi + 0x18], eax
mov dword [edi + 0x1c], esi
mov ecx, dword [ecx]
cmp ecx, ebx
je 0x10002ef7
mov eax, ecx
movzx edx, byte [eax + 8]
xor edx, 0x811c9dc5
mov ecx, dword [ecx]
imul esi, edx, 0x1000193
movzx edx, byte [eax + 9]
xor esi, edx
movzx edx, byte [eax + 0xa]
imul esi, esi, 0x1000193
xor esi, edx
movzx edx, byte [eax + 0xb]
imul esi, esi, 0x1000193
xor esi, edx
imul edx, esi, 0x1000193
mov esi, dword [edi + 0x18]
and esi, edx
mov edx, dword [edi + 0xc]
lea ebx, [edx + esi*8]
mov esi, dword [ebx]
mov dword [ebp + 8], ebx
cmp esi, dword [ebp - 8]
jne 0x10002e84
mov dword [ebx], eax
mov dword [ebx + 4], eax
jmp 0x10002eec
mov edx, dword [ebx + 4]
mov edi, dword [eax + 8]
cmp edi, dword [edx + 8]
jne 0x10002ebb
mov edx, dword [edx]
mov dword [ebp - 0xc], edx
cmp edx, eax
je 0x10002eb6
mov edi, dword [eax + 4]
mov ebx, dword [ebp - 0xc]
mov dword [edi], ecx
mov esi, dword [ecx + 4]
mov dword [esi], edx
mov edx, dword [edx + 4]
mov dword [edx], eax
mov dword [ebx + 4], esi
mov ebx, dword [ebp + 8]
mov dword [ecx + 4], edi
mov dword [eax + 4], edx
mov dword [ebx + 4], eax
jmp 0x10002ee9
cmp esi, edx
je 0x10002ecc
nop
mov edx, dword [edx + 4]
cmp edi, dword [edx + 8]
je 0x10002f00
cmp esi, edx
jne 0x10002ec0
mov ebx, dword [eax + 4]
mov dword [ebx], ecx
mov edi, dword [ecx + 4]
mov dword [edi], edx
mov esi, dword [edx + 4]
mov dword [esi], eax
mov dword [edx + 4], edi
mov edx, dword [ebp + 8]
mov dword [ecx + 4], ebx
mov dword [eax + 4], esi
mov dword [edx], eax
mov edi, dword [ebp - 4]
mov eax, ecx
cmp ecx, dword [ebp - 8]
jne 0x10002e32
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
mov edi, dword [eax + 4]
mov ebx, dword [edx]
mov dword [edi], ecx
mov esi, dword [ecx + 4]
mov dword [esi], ebx
mov edx, dword [ebx + 4]
mov dword [edx], eax
mov dword [ebx + 4], esi
mov dword [ecx + 4], edi
mov dword [eax + 4], edx
jmp 0x10002ee9
push str.invalid_hash_bucket_count
call fcn.10003c21
int3