joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100dbee0
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x18
mov eax, dword [esp + 0x1c]
dec eax
mov dword [esp + 0x14], ecx
push esi
mov esi, edx
mov dword [esp + 4], eax
sar eax, 1
mov dword [esp + 8], eax
push edi
mov edi, esi
mov dword [esp + 0x18], edi
cmp esi, eax
jge 0x100dbf54
lea eax, [edx + edx]
mov dword [esp + 0x14], eax
add eax, 2
shl eax, 4
add eax, ecx
lea ecx, [esp + 0x2c]
mov dword [esp + 0x10], eax
lea edi, [eax - 0x10]
push edi
push eax
call fcn.100cf5e0
mov edx, dword [esp + 0x14]
movzx ecx, al
inc edx
xor ecx, 1
add edx, ecx
mov ecx, dword [esp + 0x1c]
test al, al
mov eax, dword [esp + 0xc]
cmove edi, dword [esp + 0x10]
add esi, esi
movups xmm0, xmmword [edi]
movups xmmword [ecx + esi*8], xmm0
mov esi, edx
cmp edx, eax
jl 0x100dbf04
mov edi, dword [esp + 0x18]
cmp edx, eax
jne 0x100dbf71
mov eax, dword [esp + 0x24]
test al, 1
jne 0x100dbf71
add eax, eax
add esi, esi
movups xmm0, xmmword [ecx + eax*8 - 0x10]
movups xmmword [ecx + esi*8], xmm0
mov esi, dword [esp + 8]
mov eax, dword [esp + 0x2c]
mov dword [esp + 0x24], eax
cmp edi, esi
jge 0x100dbfbb
nop dword [eax]
push dword [esp + 0x28]
lea edi, [esi - 1]
sar edi, 1
mov eax, edi
shl eax, 4
add eax, ecx
lea ecx, [esp + 0x28]
push eax
mov dword [esp + 0x10], eax
call fcn.100cf5e0
mov ecx, dword [esp + 0x1c]
test al, al
je 0x100dbfbb
mov eax, dword [esp + 8]
add esi, esi
movups xmm0, xmmword [eax]
movups xmmword [ecx + esi*8], xmm0
mov esi, edi
cmp dword [esp + 0x18], edi
jl 0x100dbf80
mov eax, dword [esp + 0x28]
add esi, esi
pop edi
movups xmm0, xmmword [eax]
movups xmmword [ecx + esi*8], xmm0
pop esi
add esp, 0x18
ret 0x14
Function at 0x100de240
Capabilities:
Hash data using fnv

Disassembly:
sub esp, 0x28
push ebx
mov ebx, dword [esp + 0x30]
push ebp
push esi
push edi
mov dword [ebx], 0
mov edi, ecx
push 0x10
mov dword [ebx + 4], 0
mov dword [ebx + 8], 0
call fcn.100faea5
add esp, 4
mov dword [eax], eax
mov dword [eax + 4], eax
mov dword [ebx + 4], eax
lea eax, [ebx + 0xc]
mov dword [eax], 0
mov ecx, eax
mov dword [eax + 4], 0
mov dword [eax + 8], 0
mov dword [ebx + 0x18], 7
mov dword [ebx + 0x1c], 8
mov dword [ebx], 0x3f800000
push dword [ebx + 4]
mov dword [esp + 0x18], eax
push 0x10
call fcn.10086b30
mov edi, dword [edi + 4]
xor eax, eax
mov dword [esp + 0x10], eax
mov dword [esp + 0x18], edi
mov esi, dword [edi]
cmp esi, edi
je 0x100de3a4
mov ebp, dword [esi + 0xc]
lea eax, [esi + 0xc]
mov dword [esp + 0x1c], eax
lea edx, [ebp + 8]
movzx eax, dl
xor eax, 0x811c9dc5
imul ecx, eax, 0x1000193
mov eax, edx
shr eax, 8
movzx eax, al
xor ecx, eax
mov eax, edx
shr eax, 0x10
imul ecx, ecx, 0x1000193
movzx eax, al
shr edx, 0x18
xor ecx, eax
imul eax, ecx, 0x1000193
xor eax, edx
mov edx, dword [ebx + 4]
imul ecx, eax, 0x1000193
mov eax, dword [esp + 0x14]
and ecx, dword [ebx + 0x18]
mov eax, dword [eax]
mov eax, dword [eax + ecx*8 + 4]
cmp eax, edx
je 0x100de34a
mov edi, dword [esp + 0x14]
mov ebx, dword [edi]
mov edi, dword [esp + 0x18]
mov ecx, dword [ebx + ecx*8]
mov ebx, dword [esp + 0x3c]
cmp ebp, dword [eax + 8]
je 0x100de341
cmp eax, ecx
je 0x100de34a
mov eax, dword [eax + 4]
cmp ebp, dword [eax + 8]
jne 0x100de335
test eax, eax
je 0x100de34a
mov edx, dword [ebx + 4]
jmp 0x100de34c
mov eax, edx
mov ecx, ebx
cmp eax, edx
je 0x100de366
add eax, 0xc
push eax
lea eax, [esi + 8]
push eax
lea eax, [esp + 0x28]
push eax
call fcn.100e2bc0
jmp 0x100de39a
inc dword [esp + 0x10]
lea eax, [esp + 0x10]
push eax
push dword [esp + 0x20]
lea eax, [esp + 0x30]
push eax
call fcn.100e2bc0
lea eax, [esp + 0x10]
mov ecx, ebx
push eax
lea eax, [esi + 8]
push eax
lea eax, [esp + 0x38]
push eax
call fcn.100e2bc0
mov eax, dword [esp + 0x10]
mov dword [esp + 0x10], eax
mov esi, dword [esi]
cmp esi, edi
jne 0x100de2c5
pop edi
pop esi
pop ebp
mov eax, ebx
pop ebx
add esp, 0x28
ret 4
Function at 0x100e2b20
Capabilities:
Hash data using fnv

Disassembly:
mov eax, dword [esp + 8]
push ebx
push esi
push edi
mov edi, dword [eax]
mov esi, ecx
lea ebx, [edi + 8]
movzx eax, bl
xor eax, 0x811c9dc5
imul edx, eax, 0x1000193
mov eax, ebx
shr eax, 8
movzx eax, al
xor edx, eax
mov eax, ebx
shr eax, 0x10
imul ecx, edx, 0x1000193
mov edx, dword [esi + 4]
movzx eax, al
shr ebx, 0x18
xor ecx, eax
imul eax, ecx, 0x1000193
mov ecx, dword [esi + 0x18]
xor eax, ebx
imul eax, eax, 0x1000193
and ecx, eax
mov eax, dword [esi + 0xc]
lea ecx, [eax + ecx*8]
mov eax, dword [ecx + 4]
cmp eax, edx
je 0x100e2ba2
mov ecx, dword [ecx]
cmp edi, dword [eax + 8]
je 0x100e2ba4
cmp eax, ecx
je 0x100e2ba2
mov eax, dword [eax + 4]
cmp edi, dword [eax + 8]
jne 0x100e2b83
mov ecx, dword [esp + 0x10]
test eax, eax
pop edi
cmove eax, edx
pop esi
mov dword [ecx], eax
mov eax, ecx
pop ebx
ret 8
xor eax, eax
mov ecx, dword [esp + 0x10]
test eax, eax
pop edi
cmove eax, edx
pop esi
mov dword [ecx], eax
mov eax, ecx
pop ebx
ret 8
Function at 0x100e3400
Capabilities:
Hash data using fnv

Disassembly:
sub esp, 8
mov edx, dword [esp + 0xc]
mov eax, 0x1fffffff
push ebx
mov ebx, ecx
bsr ecx, eax
push ebp
push esi
push edi
mov edi, 1
mov dword [esp + 0x14], ebx
mov eax, edi
shl eax, cl
cmp edx, eax
ja 0x100e3552
mov esi, dword [ebx + 4]
lea eax, [edx - 1]
or eax, edi
lea ebp, [ebx + 0xc]
bsr ecx, eax
push esi
lea ecx, [ecx + 1]
shl edi, cl
mov ecx, ebp
lea eax, [edi + edi]
push eax
call fcn.10086b30
lea eax, [edi - 1]
mov dword [ebx + 0x1c], edi
mov dword [ebx + 0x18], eax
mov ecx, dword [ebx + 4]
mov ecx, dword [ecx]
mov edx, ecx
cmp ecx, esi
je 0x100e352c
movzx eax, byte [ecx + 8]
xor eax, 0x811c9dc5
mov edx, dword [edx]
imul edi, eax, 0x1000193
movzx eax, byte [ecx + 9]
xor edi, eax
movzx eax, byte [ecx + 0xa]
imul edi, edi, 0x1000193
xor edi, eax
movzx eax, byte [ecx + 0xb]
imul edi, edi, 0x1000193
xor edi, eax
imul eax, edi, 0x1000193
mov edi, dword [ebx + 0x18]
and edi, eax
mov eax, dword [ebp]
mov ebx, dword [eax + edi*8]
lea eax, [eax + edi*8]
mov dword [esp + 0x1c], eax
cmp ebx, esi
jne 0x100e34b3
mov dword [eax], ecx
mov dword [eax + 4], ecx
jmp 0x100e351b
mov eax, dword [eax + 4]
mov edi, dword [ecx + 8]
cmp edi, dword [eax + 8]
jne 0x100e34e6
mov eax, dword [eax]
cmp eax, ecx
je 0x100e34dd
mov ebp, dword [ecx + 4]
mov dword [ebp], edx
mov ebx, dword [edx + 4]
mov dword [ebx], eax
mov edi, dword [eax + 4]
mov dword [edi], ecx
mov dword [eax + 4], ebx
mov dword [edx + 4], ebp
mov dword [ecx + 4], edi
mov eax, dword [esp + 0x1c]
mov dword [eax + 4], ecx
jmp 0x100e351b
cmp ebx, eax
je 0x100e34fc
nop word [eax + eax]
mov eax, dword [eax + 4]
cmp edi, dword [eax + 8]
je 0x100e3536
cmp ebx, eax
jne 0x100e34f0
mov ebp, dword [ecx + 4]
mov dword [ebp], edx
mov ebx, dword [edx + 4]
mov dword [ebx], eax
mov edi, dword [eax + 4]
mov dword [edi], ecx
mov dword [eax + 4], ebx
mov eax, dword [esp + 0x1c]
mov dword [edx + 4], ebp
mov dword [ecx + 4], edi
mov dword [eax], ecx
mov ebx, dword [esp + 0x14]
mov ecx, edx
lea ebp, [ebx + 0xc]
cmp edx, esi
jne 0x100e3461
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret 4
mov ebx, dword [ecx + 4]
mov ebp, dword [eax]
mov dword [ebx], edx
mov edi, dword [edx + 4]
mov dword [edi], ebp
mov eax, dword [ebp + 4]
mov dword [eax], ecx
mov dword [ebp + 4], edi
mov dword [edx + 4], ebx
mov dword [ecx + 4], eax
jmp 0x100e351b
push str.invalid_hash_bucket_count
call fcn.100fb945
int3
Function at 0x100e7340
Capabilities:
Hash data using fnv

Disassembly:
sub esp, 8
push ebx
mov ebx, dword [esp + 0x14]
push ebp
push esi
push edi
movzx eax, byte [ebx]
mov edi, ecx
xor eax, 0x811c9dc5
imul edx, eax, 0x1000193
movzx eax, byte [ebx + 1]
xor edx, eax
lea eax, [esp + 0x10]
imul ebp, edx, 0x1000193
push ebp
push ebx
push eax
call fcn.100da6a0
mov ecx, dword [esp + 0x14]
test ecx, ecx
je 0x100e738f
mov eax, dword [esp + 0x1c]
mov dword [eax], ecx
mov byte [eax + 4], 0
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret 0xc
cmp dword [edi + 8], 0x9249249
je 0x100e74d4
push 0x1c
call fcn.100faea5
mov cx, word [ebx]
mov esi, eax
add esp, 4
mov word [esi + 8], cx
mov ecx, dword [esp + 0x24]
movups xmm0, xmmword [ecx]
movups xmmword [esi + 0xc], xmm0
mov ecx, dword [edi + 8]
mov ebx, dword [edi + 0x1c]
movss xmm3, dword [edi]
lea eax, [ecx + 1]
movd xmm0, eax
cvtdq2pd xmm0, xmm0
shr eax, 0x1f
addsd xmm0, qword [eax*8 + 0x1014bca0]
mov eax, ebx
shr eax, 0x1f
cvtpd2ps xmm2, xmm0
movd xmm0, ebx
cvtdq2pd xmm0, xmm0
movaps xmm1, xmm2
addsd xmm0, qword [eax*8 + 0x1014bca0]
cvtpd2ps xmm0, xmm0
divss xmm1, xmm0
comiss xmm1, xmm3
jbe 0x100e746f
divss xmm2, xmm3
sub esp, 8
movss dword [esp + 0x28], xmm2
fld dword [esp + 0x28]
fstp qword [esp]
call fcn.1011f260
add esp, 8
fstp dword [esp + 0x20]
movss xmm0, dword [esp + 0x20]
call fcn.10120ad0
mov ecx, 8
cmp eax, ecx
cmova ecx, eax
cmp ebx, ecx
jae 0x100e744f
cmp ebx, 0x200
jae 0x100e744d
shl ebx, 3
cmp ebx, ecx
jae 0x100e744f
mov ebx, ecx
push ebx
mov ecx, edi
call fcn.100c9620
push ebp
lea eax, [esi + 8]
mov ecx, edi
push eax
lea eax, [esp + 0x18]
push eax
call fcn.100da6a0
mov ecx, dword [edi + 8]
mov edx, dword [eax]
jmp 0x100e7473
mov edx, dword [esp + 0x10]
mov ebx, dword [edx + 4]
lea eax, [ecx + 1]
mov dword [edi + 8], eax
mov dword [esi], edx
mov dword [esi + 4], ebx
mov dword [ebx], esi
mov dword [edx + 4], esi
mov eax, dword [edi + 0x18]
mov ecx, dword [edi + 0xc]
and eax, ebp
mov ebp, dword [ecx + eax*8]
cmp ebp, dword [edi + 4]
jne 0x100e749b
mov dword [ecx + eax*8], esi
jmp 0x100e74bc
cmp ebp, edx
jne 0x100e74b6
mov dword [ecx + eax*8], esi
mov eax, dword [esp + 0x1c]
mov dword [eax], esi
mov byte [eax + 4], 1
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret 0xc
cmp dword [ecx + eax*8 + 4], ebx
jne 0x100e74c0
mov dword [ecx + eax*8 + 4], esi
mov eax, dword [esp + 0x1c]
pop edi
mov dword [eax], esi
pop esi
pop ebp
mov byte [eax + 4], 1
pop ebx
add esp, 8
ret 0xc
push str.unordered_map_set_too_long
call fcn.100fb945
int3

Function at 0x100e7710
Capabilities:
Hash data using fnv

Disassembly:
mov al, byte [ecx]
test al, al
je 0x100e7727
movsx eax, al
xor eax, edx
imul edx, eax, 0x1000193
inc ecx
jmp fcn.100e7710
mov eax, edx
ret
Function at 0x100ec4c0
Capabilities:
Create thread

Disassembly:
sub esp, 0xc
push ebx
push ebp
mov ebp, dword [esp + 0x2c]
push esi
push edi
mov edi, ecx
cmp dword [ebp + 0xad0], 0
mov esi, dword [ebp + 0xb34]
mov dword [esp + 0x14], edi
mov dword [esp + 0x34], esi
jne 0x100ec59c
push esi
call fcn.100ec710
push 0
push ebp
mov ecx, edi
call fcn.100ecb70
push 0
push ebp
mov ecx, edi
call fcn.100ed820
push 0
lea ecx, [esi + 4]
call fcn.100ab3f0
lea ebx, [esi + 0xf0c]
push 0
mov ecx, ebx
call fcn.100af120
push 0
push ebp
mov ecx, edi
call fcn.100ee210
xor dl, dl
mov ecx, ebp
call fcn.100b4d30
lea eax, [esi + 0xf68]
push 0
mov ecx, eax
mov dword [esp + 0x1c], eax
call fcn.100bcba0
mov edi, dword [esp + 0x30]
add esi, 0x1068
push 0
push edi
mov ecx, esi
call fcn.100d31e0
mov ecx, dword [esp + 0x34]
push 0
add ecx, 0x142c
call fcn.100b1120
mov ecx, dword [esp + 0x14]
push 0
push ebp
call fcn.100ee5e0
push 0
push ebx
push esi
mov esi, dword [esp + 0x40]
push dword [esp + 0x24]
lea ecx, [esi + 0x13a8]
call fcn.100f4e30
mov ecx, dword [esp + 0x14]
push 0
push ebp
push edi
push dword [esp + 0x38]
call fcn.100ee810
jmp 0x100ec5ad
push ebp
push dword [esp + 0x34]
push dword [esp + 0x34]
sub esp, 8
call fcn.100ef990
cmp byte [esi + 0x13a8], 0
lea ebx, [esi + 0x13a8]
lea ebp, [esi + 0xf68]
je 0x100ec706
push 1
mov ecx, ebx
call fcn.100f4d60
push 1
mov ecx, ebp
call fcn.100bcab0
xor edx, edx
xor ecx, ecx
call fcn.1007cfa0
call fcn.1007cca0
cmp dword [0x1015690c], 0
je 0x100ec675
xor ecx, ecx
call fcn.1007cbe0
test eax, eax
jne 0x100ec675
mov eax, dword [0x1015d13c]
mov dword [0x1015d13c], 0
test eax, eax
je 0x100ec62d
mov edi, dword [sym.imp.KERNEL32.dll_VirtualFree]
mov esi, dword [eax]
push 0x8000
push 0
push eax
call edi
mov eax, esi
test esi, esi
jne 0x100ec617
mov esi, dword [esp + 0x34]
push dword [0x1015d130]
push 0
push dword [0x1015690c]
call dword [sym.imp.KERNEL32.dll_HeapFree]
push dword [0x1015690c]
call dword [sym.imp.KERNEL32.dll_HeapDestroy]
mov dword [0x1015690c], 0
mov dword [0x1015d130], 0
mov dword [0x1015d134], 0
mov dword [0x1015d138], 0
xor eax, eax
mov ecx, 0x10156910
xchg dword [ecx], eax
mov ecx, dword [0x10156994]
test ecx, ecx
je 0x100ec68f
mov eax, dword [0x10156990]
mov dword [ecx], eax
mov ecx, dword [0x1015699c]
test ecx, ecx
je 0x100ec6a0
mov eax, dword [0x10156998]
mov dword [ecx], eax
mov eax, dword [0x1015ced8]
lea ecx, [esi + 0xf0c]
mov dword [0x1015cedc], eax
call fcn.100af070
push ecx
lea ecx, [esi + 0x1068]
call fcn.100d6de0
mov edx, dword [esp + 0x20]
push 0
push 0
push 0
mov eax, dword [edx + 0x158]
push 0x100ebc40
push 0
push 0
mov eax, dword [eax]
mov ecx, dword [eax]
mov eax, dword [edx]
mov dword [ecx], eax
mov eax, dword [edx + 0x158]
mov eax, dword [eax + 4]
mov ecx, dword [eax]
mov eax, dword [edx + 4]
mov dword [ecx], eax
call dword [sym.imp.KERNEL32.dll_CreateThread]
test eax, eax
je 0x100ec703
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov byte [ebx], 0
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret 0x18
Function at 0x100f8ea0
Capabilities:
Hash data using fnv

Disassembly:
mov eax, dword [esp + 8]
sub esp, 0x18
mov edx, dword [esp + 0x1c]
push ebp
mov ebp, ecx
cmp edx, eax
je 0x100f901e
mov eax, dword [ebp + 4]
mov dword [esp + 0xc], eax
mov eax, dword [edx + 4]
mov dword [esp + 0x10], eax
movzx eax, byte [edx + 8]
xor eax, 0x811c9dc5
imul ecx, eax, 0x1000193
movzx eax, byte [edx + 9]
push ebx
mov ebx, dword [ebp + 0xc]
push esi
xor ecx, eax
mov dword [esp + 0x20], ebx
movzx eax, byte [edx + 0xa]
mov esi, edx
imul ecx, ecx, 0x1000193
push edi
xor ecx, eax
movzx eax, byte [edx + 0xb]
imul ecx, ecx, 0x1000193
xor ecx, eax
mov eax, dword [ebp + 0x18]
imul ecx, ecx, 0x1000193
and eax, ecx
mov ecx, dword [ebx + eax*8]
mov dword [esp + 0x14], ecx
lea eax, [ebx + eax*8]
mov dword [esp + 0x10], eax
mov eax, dword [eax + 4]
mov dword [esp + 0x20], eax
nop dword [eax]
mov edi, esi
mov ebx, esi
mov esi, dword [esi]
lea ecx, [edi + 0x10]
call fcn.100f34b0
push 0x30
push edi
call fcn.100fa9c7
dec dword [ebp + 8]
add esp, 8
cmp ebx, dword [esp + 0x20]
je 0x100f8f61
cmp esi, dword [esp + 0x30]
jne 0x100f8f20
mov eax, dword [esp + 0x14]
cmp eax, dword [esp + 0x2c]
jne 0x100f900e
mov ecx, dword [esp + 0x10]
mov dword [ecx], esi
jmp 0x100f900e
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x10]
cmp eax, dword [esp + 0x2c]
jne 0x100f8f77
mov eax, dword [esp + 0x18]
mov dword [ecx], eax
jmp 0x100f8f7b
mov eax, dword [esp + 0x1c]
mov dword [ecx + 4], eax
cmp esi, dword [esp + 0x30]
je 0x100f900e
nop dword [eax + eax]
movzx eax, byte [esi + 8]
xor eax, 0x811c9dc5
imul ecx, eax, 0x1000193
movzx eax, byte [esi + 9]
xor ecx, eax
movzx eax, byte [esi + 0xa]
imul ecx, ecx, 0x1000193
xor ecx, eax
movzx eax, byte [esi + 0xb]
imul ecx, ecx, 0x1000193
xor ecx, eax
imul eax, ecx, 0x1000193
mov ecx, dword [ebp + 0x18]
and ecx, eax
mov eax, dword [esp + 0x24]
lea eax, [eax + ecx*8]
mov dword [esp + 0x2c], eax
mov eax, dword [eax + 4]
mov dword [esp + 0x20], eax
nop word [eax + eax]
mov edi, esi
mov ebx, esi
mov esi, dword [esi]
lea ecx, [edi + 0x10]
call fcn.100f34b0
push 0x30
push edi
call fcn.100fa9c7
dec dword [ebp + 8]
add esp, 8
cmp ebx, dword [esp + 0x20]
je 0x100f9025
cmp esi, dword [esp + 0x30]
jne 0x100f8fe0
mov eax, dword [esp + 0x2c]
mov dword [eax], esi
mov eax, dword [esp + 0x1c]
pop edi
mov dword [eax], esi
mov dword [esi + 4], eax
mov eax, dword [esp + 0x2c]
pop esi
pop ebx
pop ebp
add esp, 0x18
ret 8
mov eax, dword [esp + 0x2c]
mov edx, dword [esp + 0x18]
mov dword [eax], edx
mov dword [eax + 4], edx
cmp esi, dword [esp + 0x30]
jne 0x100f8f90
jmp 0x100f900e
Function at 0x100f9b40
Capabilities:
Hash data using fnv

Disassembly:
sub esp, 0xc
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0x24]
movzx eax, byte [edi]
xor eax, 0x811c9dc5
imul ecx, eax, 0x1000193
movzx eax, byte [edi + 1]
xor ecx, eax
movzx eax, byte [edi + 2]
imul ecx, ecx, 0x1000193
xor ecx, eax
movzx eax, byte [edi + 3]
imul ecx, ecx, 0x1000193
xor ecx, eax
lea eax, [esp + 0x10]
imul ebx, ecx, 0x1000193
push ebx
push edi
push eax
call fcn.100fa270
mov ecx, dword [esp + 0x14]
test ecx, ecx
je 0x100f9ba5
mov eax, dword [esp + 0x20]
mov dword [eax], ecx
mov byte [eax + 4], 0
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret 8
cmp dword [0x1015d04c], 0x5555555
je 0x100f9d0c
push 0x30
call fcn.100faea5
mov ecx, dword [edi]
mov esi, eax
lea ebp, [esi + 8]
xorps xmm0, xmm0
mov dword [ebp], ecx
add esp, 4
movups xmmword [ebp + 4], xmm0
lea ecx, [ebp + 8]
movups xmmword [ebp + 0x14], xmm0
mov dword [ebp + 0x24], 0
call fcn.100f8cb0
mov ecx, dword [0x1015d04c]
mov edi, dword [0x1015d060]
lea eax, [ecx + 1]
movd xmm0, eax
cvtdq2pd xmm0, xmm0
shr eax, 0x1f
addsd xmm0, qword [eax*8 + 0x1014bca0]
mov eax, edi
shr eax, 0x1f
cvtpd2ps xmm2, xmm0
movd xmm0, edi
cvtdq2pd xmm0, xmm0
movaps xmm1, xmm2
addsd xmm0, qword [eax*8 + 0x1014bca0]
cvtpd2ps xmm0, xmm0
divss xmm1, xmm0
movss xmm0, dword [0x1015d044]
comiss xmm1, xmm0
jbe 0x100f9c9e
divss xmm2, xmm0
sub esp, 8
movss dword [esp + 0x2c], xmm2
fld dword [esp + 0x2c]
fstp qword [esp]
call fcn.1011f260
add esp, 8
fstp dword [esp + 0x24]
movss xmm0, dword [esp + 0x24]
call fcn.10120ad0
mov ecx, 8
cmp eax, ecx
cmova ecx, eax
cmp edi, ecx
jae 0x100f9c82
cmp edi, 0x200
jae 0x100f9c80
shl edi, 3
cmp edi, ecx
jae 0x100f9c82
mov edi, ecx
push edi
call fcn.100f9f40
push ebx
push ebp
lea eax, [esp + 0x18]
push eax
call fcn.100fa270
mov ecx, dword [0x1015d04c]
mov edx, dword [eax]
jmp 0x100f9ca2
mov edx, dword [esp + 0x10]
mov edi, dword [edx + 4]
inc ecx
mov dword [0x1015d04c], ecx
mov dword [esi], edx
mov dword [esi + 4], edi
mov dword [edi], esi
mov dword [edx + 4], esi
mov eax, dword [0x1015d05c]
mov ecx, dword [0x1015d050]
and eax, ebx
mov ebx, dword [ecx + eax*8]
cmp ebx, dword [0x1015d048]
jne 0x100f9cd3
mov dword [ecx + eax*8], esi
jmp 0x100f9cf4
cmp ebx, edx
jne 0x100f9cee
mov dword [ecx + eax*8], esi
mov eax, dword [esp + 0x20]
mov dword [eax], esi
mov byte [eax + 4], 1
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret 8
cmp dword [ecx + eax*8 + 4], edi
jne 0x100f9cf8
mov dword [ecx + eax*8 + 4], esi
mov eax, dword [esp + 0x20]
pop edi
mov dword [eax], esi
pop esi
pop ebp
mov byte [eax + 4], 1
pop ebx
add esp, 0xc
ret 8
push str.unordered_map_set_too_long
call fcn.100fb945
int3
Function at 0x100f9d20
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
sub esp, 0xc
push ebx
push ebp
mov ebp, dword [esp + 0x1c]
mov ebx, ecx
push esi
push edi
mov edx, ebp
cmp dword [ebp + 0x14], 0x10
mov edi, dword [ebp + 0x10]
jb 0x100f9d3b
mov edx, dword [ebp]
xor ecx, ecx
mov esi, 0x811c9dc5
test edi, edi
je 0x100f9d57
movzx eax, byte [ecx + edx]
inc ecx
xor eax, esi
imul esi, eax, 0x1000193
cmp ecx, edi
jb 0x100f9d46
push esi
push ebp
lea eax, [esp + 0x18]
mov ecx, ebx
push eax
call fcn.1008e0f0
mov ecx, dword [esp + 0x14]
test ecx, ecx
je 0x100f9d81
mov eax, dword [esp + 0x20]
mov dword [eax], ecx
mov byte [eax + 4], 0
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret 8
cmp dword [ebx + 8], 0x71c71c7
je 0x100f9ec5
push 0x24
call fcn.100faea5
add esp, 4
mov edi, eax
lea ecx, [edi + 8]
push ebp
call fcn.1009c920
mov dword [edi + 0x20], 0
mov ecx, dword [ebx + 8]
mov ebp, dword [ebx + 0x1c]
movss xmm3, dword [ebx]
lea eax, [ecx + 1]
movd xmm0, eax
cvtdq2pd xmm0, xmm0
shr eax, 0x1f
addsd xmm0, qword [eax*8 + 0x1014bca0]
mov eax, ebp
shr eax, 0x1f
cvtpd2ps xmm2, xmm0
movd xmm0, ebp
cvtdq2pd xmm0, xmm0
movaps xmm1, xmm2
addsd xmm0, qword [eax*8 + 0x1014bca0]
cvtpd2ps xmm0, xmm0
divss xmm1, xmm0
comiss xmm1, xmm3
jbe 0x100f9e5f
divss xmm2, xmm3
sub esp, 8
movss dword [esp + 0x2c], xmm2
fld dword [esp + 0x2c]
fstp qword [esp]
call fcn.1011f260
add esp, 8
fstp dword [esp + 0x24]
movss xmm0, dword [esp + 0x24]
call fcn.10120ad0
mov ecx, 8
cmp eax, ecx
cmova ecx, eax
cmp ebp, ecx
jae 0x100f9e3f
cmp ebp, 0x200
jae 0x100f9e3d
shl ebp, 3
cmp ebp, ecx
jae 0x100f9e3f
mov ebp, ecx
push ebp
mov ecx, ebx
call fcn.1008b9c0
push esi
lea eax, [edi + 8]
mov ecx, ebx
push eax
lea eax, [esp + 0x18]
push eax
call fcn.1008e0f0
mov ecx, dword [ebx + 8]
mov edx, dword [eax]
jmp 0x100f9e63
mov edx, dword [esp + 0x10]
mov ebp, dword [edx + 4]
lea eax, [ecx + 1]
mov dword [ebx + 8], eax
mov dword [edi], edx
mov dword [edi + 4], ebp
mov dword [ebp], edi
mov dword [edx + 4], edi
mov eax, dword [ebx + 0x18]
mov ecx, dword [ebx + 0xc]
and eax, esi
mov esi, dword [ecx + eax*8]
cmp esi, dword [ebx + 4]
jne 0x100f9e8c
mov dword [ecx + eax*8], edi
jmp 0x100f9ead
cmp esi, edx
jne 0x100f9ea7
mov dword [ecx + eax*8], edi
mov eax, dword [esp + 0x20]
mov dword [eax], edi
mov byte [eax + 4], 1
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret 8
cmp dword [ecx + eax*8 + 4], ebp
jne 0x100f9eb1
mov dword [ecx + eax*8 + 4], edi
mov eax, dword [esp + 0x20]
mov dword [eax], edi
pop edi
pop esi
pop ebp
mov byte [eax + 4], 1
pop ebx
add esp, 0xc
ret 8
push str.unordered_map_set_too_long
call fcn.100fb945
int3
Function at 0x100f9f40
Capabilities:
Hash data using fnv

Disassembly:
mov eax, 0x1fffffff
bsr ecx, eax
push ebx
push ebp
push esi
push edi
mov edi, 1
mov eax, edi
shl eax, cl
mov ecx, dword [esp + 0x14]
cmp ecx, eax
ja 0x100fa08f
lea eax, [ecx - 1]
mov esi, dword [0x1015d048]
or eax, edi
bsr ecx, eax
push esi
lea ecx, [ecx + 1]
shl edi, cl
mov ecx, 0x1015d050
lea eax, [edi + edi]
push eax
call fcn.100f9280
mov ecx, dword [0x1015d048]
lea ebx, [edi - 1]
mov dword [0x1015d05c], ebx
mov dword [0x1015d060], edi
mov ecx, dword [ecx]
mov edx, ecx
cmp ecx, esi
je 0x100fa088
movzx eax, byte [ecx + 8]
xor eax, 0x811c9dc5
mov edx, dword [edx]
imul edi, eax, 0x1000193
movzx eax, byte [ecx + 9]
xor edi, eax
movzx eax, byte [ecx + 0xa]
imul edi, edi, 0x1000193
xor edi, eax
movzx eax, byte [ecx + 0xb]
imul edi, edi, 0x1000193
xor edi, eax
mov eax, dword [0x1015d050]
imul edi, edi, 0x1000193
and edi, ebx
mov ebx, dword [eax + edi*8]
lea eax, [eax + edi*8]
mov dword [esp + 0x14], eax
cmp ebx, esi
jne 0x100f9ff5
mov dword [eax], ecx
mov dword [eax + 4], ecx
jmp 0x100fa05b
mov eax, dword [eax + 4]
mov edi, dword [ecx + 8]
cmp edi, dword [eax + 8]
jne 0x100fa028
mov eax, dword [eax]
cmp eax, ecx
je 0x100fa01f
mov ebp, dword [ecx + 4]
mov dword [ebp], edx
mov ebx, dword [edx + 4]
mov dword [ebx], eax
mov edi, dword [eax + 4]
mov dword [edi], ecx
mov dword [eax + 4], ebx
mov dword [edx + 4], ebp
mov dword [ecx + 4], edi
mov eax, dword [esp + 0x14]
mov dword [eax + 4], ecx
jmp 0x100fa05b
cmp ebx, eax
je 0x100fa03c
nop dword [eax]
mov eax, dword [eax + 4]
cmp edi, dword [eax + 8]
je 0x100fa06c
cmp ebx, eax
jne 0x100fa030
mov ebp, dword [ecx + 4]
mov dword [ebp], edx
mov ebx, dword [edx + 4]
mov dword [ebx], eax
mov edi, dword [eax + 4]
mov dword [edi], ecx
mov dword [eax + 4], ebx
mov eax, dword [esp + 0x14]
mov dword [edx + 4], ebp
mov dword [ecx + 4], edi
mov dword [eax], ecx
mov ecx, edx
cmp edx, esi
je 0x100fa088
mov ebx, dword [0x1015d05c]
jmp 0x100f9fa4
mov ebx, dword [ecx + 4]
mov ebp, dword [eax]
mov dword [ebx], edx
mov edi, dword [edx + 4]
mov dword [edi], ebp
mov eax, dword [ebp + 4]
mov dword [eax], ecx
mov dword [ebp + 4], edi
mov dword [edx + 4], ebx
mov dword [ecx + 4], eax
jmp 0x100fa05b
pop edi
pop esi
pop ebp
pop ebx
ret 4
push str.invalid_hash_bucket_count
call fcn.100fb945
int3
Function at 0x1011232b
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.101121a1

Function at 0x1011728a
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.10116f07