joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1007ef90
Capabilities:
Get keyboard layout

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
mov edi, ecx
mov esi, dword [edi + 0x48]
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push eax
call dword [sym.imp.USER32.dll_GetKeyboardLayout]
push eax
push 0
push esi
call dword [sym.imp.USER32.dll_MapVirtualKeyExW]
mov ecx, dword [ebp + 8]
cmp byte [eax + ecx], 0
jge 0x1007f026
mov eax, dword [edi + 0x4c]
test al, 2
je 0x1007efd0
cmp byte [ecx + 0x1d], 0
jl 0x1007efd0
cmp byte [ecx + 0x9d], 0
jge 0x1007f026
test al, 4
je 0x1007efe3
cmp byte [ecx + 0x38], 0
jl 0x1007efe3
cmp byte [ecx + 0xb8], 0
jge 0x1007f026
test al, 1
je 0x1007eff3
cmp byte [ecx + 0x2a], 0
jl 0x1007eff3
cmp byte [ecx + 0x36], 0
jge 0x1007f026
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov esi, eax
mov eax, dword [edi + 0x28]
mov ecx, esi
sub ecx, eax
cmp ecx, 0xfa
ja 0x1007f00e
cmp esi, eax
jae 0x1007f026
push str.Detected_screenshot_hot_key_via_dinput_n
call fcn.10084630
add esp, 4
mov dword [edi + 0x28], esi
mov al, 1
pop edi
pop esi
pop ebp
ret 4
pop edi
xor al, al
pop esi
pop ebp
ret 4
Function at 0x10080770
Capabilities:
Set global application hook

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x60c
push esi
mov esi, ecx
push edi
cmp byte [esi + 0x38], 0
jne 0x10080992
mov eax, dword [esi + 0xb0]
cdq
mov dword [ebp - 0x608], eax
lea eax, [ebp - 0x60c]
push eax
mov byte [esi + 0x38], 1
mov dword [ebp - 0x60c], 1
mov dword [ebp - 0x604], edx
mov byte [ebp - 0x600], 1
call fcn.10077700
add esp, 4
lea ecx, [esi + 4]
call fcn.10052df0
mov eax, dword [0x1010f480]
test eax, eax
je 0x1008082b
cmp byte [esi + 0xd8], 0
je 0x100807f6
push 0
call eax
add eax, 1
mov dword [0x1010f460], eax
js 0x100807f2
push 0
call dword [0x1010f480]
test eax, eax
jns 0x100807e6
xor al, al
jmp 0x10080812
push 1
call eax
add eax, 0xffffffff
mov dword [0x1010f460], eax
jns 0x10080810
push 1
call dword [0x1010f480]
test eax, eax
js 0x10080804
mov al, 1
mov byte [esi + 0xd9], al
push dword [0x1010f460]
push str.Showing_overlay_and_saving_cursor_show_count:__d_n
call fcn.10084630
add esp, 8
mov eax, dword [0x1010f484]
test eax, eax
je 0x1008083b
push 0x1010f464
call eax
mov eax, dword [0x1010f47c]
test eax, eax
je 0x10080859
call eax
push eax
push str.Saved_Cursor:__p_n
mov dword [0x1010f46c], eax
call fcn.10084630
add esp, 8
push 2
mov ecx, esi
call fcn.10081f30
mov eax, dword [esi + 0xb0]
test eax, eax
je 0x100808f1
push 0xfffffffffffffff4
push eax
call dword [sym.imp.USER32.dll_GetClassLongW]
push 0
push 0xfffffffffffffff4
push dword [esi + 0xb0]
mov dword [esi + 0xe0], eax
call dword [sym.imp.USER32.dll_SetClassLongW]
mov eax, dword [esi + 0xe0]
cdq
push edx
push eax
push str.Saved_GCLP_HCURSOR:__llu_n
call fcn.10084630
mov eax, dword [0x1010f4a0]
add esp, 0xc
test eax, eax
je 0x100808bc
push dword [esi + 0xb0]
call eax
mov dword [esi + 0xe4], eax
cmp dword [0x1010f4b4], 0
je 0x100808f1
mov eax, dword [0x1010a37c]
sub esp, 0x10
mov ecx, esp
mov dword [ecx], eax
mov eax, dword [0x1010a380]
mov dword [ecx + 4], eax
mov eax, dword [0x1010a384]
mov dword [ecx + 8], eax
mov eax, dword [0x1010a388]
mov dword [ecx + 0xc], eax
call fcn.10082680
add esp, 0x10
cmp byte [esi + 0x103dc], 0
jne 0x10080959
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [0x1010f580], eax
mov edi, dword [esi + 0x174]
test edi, edi
jne 0x10080917
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov edi, eax
push edi
push 0
push 0x10080c10
push 3
call dword [sym.imp.USER32.dll_SetWindowsHookExW]
mov dword [esi + 0x16c], eax
test eax, eax
jne 0x10080938
push str.WH_GETMESSAGE_hook_failed_n
jmp 0x1008095e
push edi
push 0
push 0x100802b0
push 4
call dword [sym.imp.USER32.dll_SetWindowsHookExW]
mov dword [esi + 0x170], eax
test eax, eax
jne 0x10080966
push str.WH_CALLWNDPROC_hook_failed_n
jmp 0x1008095e
push str.Not_using_SetWindowsHookExW_for_this_process_n
call fcn.10084630
add esp, 4
call fcn.10075600
call fcn.100726b0
call fcn.10075d50
call fcn.10072ed0
mov ecx, esi
call fcn.10080590
mov ecx, dword [0x1010f56c]
push dword [esi + 0xb0]
mov eax, dword [ecx]
call dword [eax + 0x54]
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x10081040
Capabilities:
Check for time delay via gettickcount
Set global application hook

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, ecx
push edi
cmp dword [esi + 0x16c], 0
je 0x100810d7
mov edi, dword [sym.imp.KERNEL32.dll_GetTickCount]
call edi
mov edx, dword [esi + 0xb8]
cmp eax, edx
jb 0x10081080
mov ecx, dword [esi + 0xbc]
cmp eax, ecx
jb 0x10081080
cmp ecx, edx
jbe 0x100810d7
sub ecx, edx
cmp ecx, 0x1f4
jbe 0x100810d7
push str.Reseting_get_message_hook_because_we_think_it_may_have_died_n
call fcn.10084630
add esp, 4
push dword [esi + 0x16c]
call dword [sym.imp.USER32.dll_UnhookWindowsHookEx]
call edi
mov dword [0x1010f580], eax
mov eax, dword [esi + 0x174]
test eax, eax
jne 0x100810b0
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push eax
push 0
push 0x10080c10
push 3
call dword [sym.imp.USER32.dll_SetWindowsHookExW]
mov dword [esi + 0x16c], eax
test eax, eax
jne 0x100810d7
push str.WH_GETMESSAGE_hook_failed_n
call fcn.10084630
add esp, 4
call dword [sym.imp.USER32.dll_GetActiveWindow]
mov edi, eax
test edi, edi
jne 0x100810f7
cmp byte [esi + 0xcc], al
jne 0x1008110f
call dword [sym.imp.USER32.dll_GetForegroundWindow]
mov edi, eax
test edi, edi
je 0x1008110f
lea eax, [ebp - 4]
push eax
push edi
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
cmp dword [ebp - 4], eax
je 0x10081118
pop edi
pop esi
xor al, al
pop ebx
mov esp, ebp
pop ebp
ret
cmp byte [esi + 0xcc], 0
je 0x10081179
mov eax, dword [esi + 0xb0]
cmp eax, edi
je 0x100811a6
test eax, eax
je 0x10081179
push str.Reattaching_input_because_g_hWndGame_has_changed..._n
call fcn.10084630
add esp, 4
cmp dword [esi + 0xb0], 0
je 0x10081186
push str.Detaching_input_hook..._n
call fcn.10084630
add esp, 4
mov ecx, esi
call fcn.10080380
mov ecx, 0x1010f4cc
mov dword [esi + 0xb0], 0
mov dword [esi + 0xb4], 0
call fcn.10052850
jmp 0x10081186
push str.Trying_to_setup_input_hook..._n
call fcn.10084630
add esp, 4
push str.Set_input_hook..._n
mov dword [esi + 0xb0], edi
mov dword [esi + 0xb4], ebx
mov byte [esi + 0xcc], 1
call fcn.10084630
add esp, 4
pop edi
pop esi
mov al, 1
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x100842e0
Capabilities:
Accept command line arguments
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x100
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
test eax, eax
je 0x10084327
push str.__typegpu_process
push eax
call fcn.100a7b50
add esp, 8
test eax, eax
je 0x10084327
push str.libcef.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
test eax, eax
je 0x10084327
push str.We_wont_start_a_UI_process__because_we_see_this_is_CEF_Chromium_GPU_process_n
call fcn.10084630
add esp, 4
xor al, al
mov esp, ebp
pop ebp
ret
push 0x100
lea eax, [ebp - 0x100]
push eax
push str.SteamNoOverlayUIDrawing
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
test eax, eax
je 0x10084370
cmp eax, 0x100
jae 0x10084370
lea eax, [ebp - 0x100]
push eax
call fcn.100b6c1a
add esp, 4
cmp eax, 1
jne 0x10084370
push str.SteamNoOverlayUIDrawing_was_set_n
call fcn.10084630
add esp, 4
xor al, al
mov esp, ebp
pop ebp
ret
mov al, 1
mov esp, ebp
pop ebp
ret
Function at 0x100851f0
Capabilities:
Link many functions at runtime

Disassembly:
cmp byte [0x1011f922], 0
je 0x10085205
mov byte [0x1011f922], 0
jmp fcn.10084a00
ret

Function at 0x100852a0
Capabilities:
Set environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x410
cmp byte [ebp + 8], 0
push ebx
push edi
je 0x1008534d
mov edi, dword [0x1011fdd8]
mov ebx, dword [0x1011fdd4]
sub edi, ebx
sar edi, 2
test edi, edi
je 0x1008534d
push esi
push 0x400
lea eax, [ebp - 0x410]
push 0
push eax
call fcn.100a7070
add esp, 0xc
xor esi, esi
test edi, edi
jle 0x10085334
mov edi, 0x100e221c
push dword [ebx + esi*4]
test esi, esi
mov eax, 0x100d65cc
cmovne eax, edi
push eax
lea eax, [ebp - 0x10]
push eax
call fcn.10084220
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x410]
push 0x400
push eax
call fcn.100aab29
mov eax, dword [0x1011fdd8]
inc esi
mov ebx, dword [0x1011fdd4]
add esp, 0x18
sub eax, ebx
sar eax, 2
cmp esi, eax
jl 0x100852f0
lea eax, [ebp - 0x410]
push eax
push str._SteamInjectionPIDs
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableA]
pop esi
pop edi
pop ebx
mov esp, ebp
pop ebp
ret
push 0
push str._SteamInjectionPIDs
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableA]
pop edi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10088a60
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100cf855
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x1c
push ebx
mov ebx, dword [ebp + 0xc]
push esi
push edi
mov edi, ecx
movzx eax, byte [ebx]
xor eax, 0x811c9dc5
imul edx, eax, 0x1000193
movzx eax, byte [ebx + 1]
xor edx, eax
movzx eax, byte [ebx + 2]
imul edx, edx, 0x1000193
xor edx, eax
movzx eax, byte [ebx + 3]
imul ecx, edx, 0x1000193
xor ecx, eax
imul eax, ecx, 0x1000193
mov ecx, edi
push eax
mov dword [ebp + 0xc], eax
lea eax, [ebp - 0x20]
push ebx
push eax
call fcn.100889a0
mov ecx, dword [ebp - 0x1c]
test ecx, ecx
je 0x10088ae8
mov eax, dword [ebp + 8]
mov dword [eax], ecx
mov byte [eax + 4], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
cmp dword [edi + 8], 0x38e38e3
je 0x10088bfa
lea eax, [edi + 4]
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x28], eax
push 0x48
mov dword [ebp - 4], 0
mov dword [ebp - 0x24], 0
call fcn.100a573e
mov ecx, dword [ebx]
mov esi, eax
push 0x38
push 0
mov dword [ebp - 0x18], esi
mov dword [esi + 8], ecx
lea ecx, [esi + 0x10]
push ecx
mov dword [ebp - 0x24], esi
call fcn.100a7070
add esp, 0x10
mov ecx, dword [edi + 8]
fld dword [edi]
mov dword [ebp - 4], 1
lea edx, [ecx + 1]
mov dword [ebp - 0x10], edx
fild dword [ebp - 0x10]
test edx, edx
jns 0x10088b4f
fadd dword [0x100d5b98]
fstp dword [ebp - 0x10]
fld dword [ebp - 0x10]
mov eax, dword [edi + 0x1c]
fild dword [edi + 0x1c]
test eax, eax
jns 0x10088b65
fadd dword [0x100d5b98]
fstp dword [ebp - 0x10]
fdiv dword [ebp - 0x10]
fcompi st(1)
fstp st(0)
ja 0x10088b76
mov edx, dword [ebp - 0x20]
jmp 0x10088b9d
push edx
mov ecx, edi
call fcn.1008e4b0
push eax
mov ecx, edi
call fcn.1008e540
push dword [ebp + 0xc]
lea eax, [esi + 8]
mov ecx, edi
push eax
lea eax, [ebp - 0x20]
push eax
call fcn.100889a0
mov ecx, dword [edi + 8]
mov edx, dword [eax]
mov ebx, dword [edx + 4]
lea eax, [ecx + 1]
mov dword [edi + 8], eax
mov dword [esi], edx
mov dword [esi + 4], ebx
mov dword [ebx], esi
mov dword [edx + 4], esi
mov eax, dword [edi + 0x18]
and eax, dword [ebp + 0xc]
mov ecx, dword [edi + 0xc]
mov esi, dword [ebp - 0x14]
mov edi, dword [ecx + eax*8]
cmp edi, dword [esi]
mov esi, dword [ebp - 0x18]
jne 0x10088bcb
mov dword [ecx + eax*8], esi
jmp 0x10088bda
cmp edi, edx
jne 0x10088bd4
mov dword [ecx + eax*8], esi
jmp 0x10088bde
cmp dword [ecx + eax*8 + 4], ebx
jne 0x10088bde
mov dword [ecx + eax*8 + 4], esi
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
pop edi
mov dword [eax], esi
pop esi
mov byte [eax + 4], 1
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret 8
push str.unordered_map_set_too_long
call fcn.100a4817
int3
Function at 0x10089070
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100cf915
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x24
push ebx
mov ebx, dword [ebp + 0xc]
push esi
push edi
mov edi, ecx
movzx eax, byte [ebx]
xor eax, 0x811c9dc5
imul edx, eax, 0x1000193
movzx eax, byte [ebx + 1]
xor edx, eax
movzx eax, byte [ebx + 2]
imul edx, edx, 0x1000193
xor edx, eax
movzx eax, byte [ebx + 3]
imul ecx, edx, 0x1000193
xor ecx, eax
imul eax, ecx, 0x1000193
mov ecx, edi
push eax
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x18]
push ebx
push eax
call fcn.100889a0
mov ecx, dword [ebp - 0x14]
test ecx, ecx
je 0x100890f8
mov eax, dword [ebp + 8]
mov dword [eax], ecx
mov byte [eax + 4], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
cmp dword [edi + 8], 0xfffffff
je 0x10089256
lea eax, [edi + 4]
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x28], eax
push 0x10
mov dword [ebp - 4], 0
mov dword [ebp - 0x24], 0
call fcn.100a573e
mov ecx, dword [ebx]
mov esi, eax
add esp, 4
mov dword [ebp - 0x20], esi
mov dword [ebp - 0x24], esi
mov dword [esi + 8], ecx
mov dword [esi + 0xc], 0
mov ecx, dword [edi + 8]
fld dword [edi]
mov dword [ebp - 4], 1
lea eax, [ecx + 1]
mov dword [ebp + 0xc], eax
fild dword [ebp + 0xc]
test eax, eax
jns 0x10089159
fadd dword [0x100d5b98]
fstp dword [ebp + 0xc]
fld dword [ebp + 0xc]
mov ebx, dword [edi + 0x1c]
fild dword [edi + 0x1c]
test ebx, ebx
jns 0x1008916f
fadd dword [0x100d5b98]
fstp dword [ebp + 0xc]
fld dword [ebp + 0xc]
fdivr st(1)
fcompi st(2)
ja 0x10089184
mov edx, dword [ebp - 0x18]
fstp st(0)
fstp st(0)
jmp 0x100891f9
fdivrp st(1)
sub esp, 8
fstp dword [ebp + 0xc]
fld dword [ebp + 0xc]
fstp qword [esp]
call fcn.100aae30
fstp dword [ebp + 0xc]
fld dword [ebp + 0xc]
mov ecx, 8
fnstcw word [ebp + 0xe]
movzx eax, word [ebp + 0xe]
add esp, 8
or eax, 0xc00
mov dword [ebp - 0x14], eax
fldcw word [ebp - 0x14]
fistp qword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
cmp eax, ecx
cmova ecx, eax
fldcw word [ebp + 0xe]
cmp ebx, ecx
jae 0x100891da
cmp ebx, 0x200
jae 0x100891d8
shl ebx, 3
cmp ebx, ecx
jae 0x100891da
mov ebx, ecx
push ebx
mov ecx, edi
call fcn.1008e540
push dword [ebp - 0x10]
lea eax, [esi + 8]
mov ecx, edi
push eax
lea eax, [ebp - 0x30]
push eax
call fcn.100889a0
mov ecx, dword [edi + 8]
mov edx, dword [eax]
mov ebx, dword [edx + 4]
lea eax, [ecx + 1]
mov dword [edi + 8], eax
mov dword [esi], edx
mov dword [esi + 4], ebx
mov dword [ebx], esi
mov dword [edx + 4], esi
mov eax, dword [edi + 0x18]
and eax, dword [ebp - 0x10]
mov ecx, dword [edi + 0xc]
mov esi, dword [ebp - 0x1c]
mov edi, dword [ecx + eax*8]
cmp edi, dword [esi]
mov esi, dword [ebp - 0x20]
jne 0x10089227
mov dword [ecx + eax*8], esi
jmp 0x10089236
cmp edi, edx
jne 0x10089230
mov dword [ecx + eax*8], esi
jmp 0x1008923a
cmp dword [ecx + eax*8 + 4], ebx
jne 0x1008923a
mov dword [ecx + eax*8 + 4], esi
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
pop edi
mov dword [eax], esi
pop esi
mov byte [eax + 4], 1
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret 8
push str.unordered_map_set_too_long
call fcn.100a4817
int3
Function at 0x10089270
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100cf945
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x1c
push ebx
mov ebx, dword [ebp + 0xc]
push esi
push edi
mov edi, ecx
movzx eax, byte [ebx]
xor eax, 0x811c9dc5
imul edx, eax, 0x1000193
movzx eax, byte [ebx + 1]
xor edx, eax
movzx eax, byte [ebx + 2]
imul edx, edx, 0x1000193
xor edx, eax
movzx eax, byte [ebx + 3]
imul ecx, edx, 0x1000193
xor ecx, eax
imul eax, ecx, 0x1000193
mov ecx, edi
push eax
mov dword [ebp + 0xc], eax
lea eax, [ebp - 0x20]
push ebx
push eax
call fcn.100889a0
mov ecx, dword [ebp - 0x1c]
test ecx, ecx
je 0x100892f8
mov eax, dword [ebp + 8]
mov dword [eax], ecx
mov byte [eax + 4], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
cmp dword [edi + 8], 0x2aaaaaa
je 0x1008940a
lea eax, [edi + 4]
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x28], eax
push 0x60
mov dword [ebp - 4], 0
mov dword [ebp - 0x24], 0
call fcn.100a573e
mov ecx, dword [ebx]
mov esi, eax
push 0x50
push 0
mov dword [ebp - 0x18], esi
mov dword [esi + 8], ecx
lea ecx, [esi + 0x10]
push ecx
mov dword [ebp - 0x24], esi
call fcn.100a7070
add esp, 0x10
mov ecx, dword [edi + 8]
fld dword [edi]
mov dword [ebp - 4], 1
lea edx, [ecx + 1]
mov dword [ebp - 0x10], edx
fild dword [ebp - 0x10]
test edx, edx
jns 0x1008935f
fadd dword [0x100d5b98]
fstp dword [ebp - 0x10]
fld dword [ebp - 0x10]
mov eax, dword [edi + 0x1c]
fild dword [edi + 0x1c]
test eax, eax
jns 0x10089375
fadd dword [0x100d5b98]
fstp dword [ebp - 0x10]
fdiv dword [ebp - 0x10]
fcompi st(1)
fstp st(0)
ja 0x10089386
mov edx, dword [ebp - 0x20]
jmp 0x100893ad
push edx
mov ecx, edi
call fcn.1008e4b0
push eax
mov ecx, edi
call fcn.1008e540
push dword [ebp + 0xc]
lea eax, [esi + 8]
mov ecx, edi
push eax
lea eax, [ebp - 0x20]
push eax
call fcn.100889a0
mov ecx, dword [edi + 8]
mov edx, dword [eax]
mov ebx, dword [edx + 4]
lea eax, [ecx + 1]
mov dword [edi + 8], eax
mov dword [esi], edx
mov dword [esi + 4], ebx
mov dword [ebx], esi
mov dword [edx + 4], esi
mov eax, dword [edi + 0x18]
and eax, dword [ebp + 0xc]
mov ecx, dword [edi + 0xc]
mov esi, dword [ebp - 0x14]
mov edi, dword [ecx + eax*8]
cmp edi, dword [esi]
mov esi, dword [ebp - 0x18]
jne 0x100893db
mov dword [ecx + eax*8], esi
jmp 0x100893ea
cmp edi, edx
jne 0x100893e4
mov dword [ecx + eax*8], esi
jmp 0x100893ee
cmp dword [ecx + eax*8 + 4], ebx
jne 0x100893ee
mov dword [ecx + eax*8 + 4], esi
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
pop edi
mov dword [eax], esi
pop esi
mov byte [eax + 4], 1
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret 8
push str.unordered_map_set_too_long
call fcn.100a4817
int3
Function at 0x10089420
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, ecx
movzx eax, byte [esi]
xor eax, 0x811c9dc5
imul edx, eax, 0x1000193
movzx eax, byte [esi + 1]
xor edx, eax
movzx eax, byte [esi + 2]
imul edx, edx, 0x1000193
xor edx, eax
movzx eax, byte [esi + 3]
imul ecx, edx, 0x1000193
xor ecx, eax
imul eax, ecx, 0x1000193
mov ecx, edi
push eax
push esi
lea eax, [ebp - 8]
push eax
call fcn.100889a0
xor ecx, ecx
pop edi
pop esi
cmp dword [eax + 4], ecx
setne cl
mov eax, ecx
mov esp, ebp
pop ebp
ret 4

Function at 0x1008a630
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100cfab5
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x1c
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, ecx
movzx eax, byte [edi]
xor eax, 0x811c9dc5
imul edx, eax, 0x1000193
movzx eax, byte [edi + 1]
xor edx, eax
movzx eax, byte [edi + 2]
imul edx, edx, 0x1000193
xor edx, eax
movzx eax, byte [edi + 3]
imul ecx, edx, 0x1000193
xor ecx, eax
lea eax, [ebp - 0x18]
imul ebx, ecx, 0x1000193
mov ecx, esi
push ebx
push edi
push eax
call fcn.100889a0
mov eax, dword [ebp - 0x14]
test eax, eax
jne 0x1008a759
cmp dword [esi + 8], 0x7ffffff
je 0x1008a76f
lea eax, [esi + 4]
mov dword [ebp - 0x20], eax
push 0x20
mov dword [ebp - 4], 0
mov dword [ebp - 0x1c], 0
call fcn.100a573e
mov dword [ebp + 8], eax
add esp, 4
mov dword [ebp - 0x1c], eax
lea ecx, [eax + 8]
mov eax, dword [edi]
mov dword [ecx], eax
xor eax, eax
mov dword [ecx + 8], eax
mov dword [ecx + 0xc], eax
mov dword [ecx + 0x10], eax
mov dword [ecx + 0x14], eax
mov ecx, dword [esi + 8]
fld dword [esi]
add ecx, 1
mov dword [ebp - 0x10], ecx
fild dword [ebp - 0x10]
mov dword [ebp - 4], 1
jns 0x1008a700
fadd dword [0x100d5b98]
fstp dword [ebp - 0x10]
fld dword [ebp - 0x10]
mov eax, dword [esi + 0x1c]
fild dword [esi + 0x1c]
test eax, eax
jns 0x1008a716
fadd dword [0x100d5b98]
fstp dword [ebp - 0x10]
fdiv dword [ebp - 0x10]
fcompi st(1)
fstp st(0)
jbe 0x1008a749
push ecx
mov ecx, esi
call fcn.1008e4b0
push eax
mov ecx, esi
call fcn.1008e540
mov edi, dword [ebp + 8]
mov ecx, esi
push ebx
lea eax, [edi + 8]
push eax
lea eax, [ebp - 0x28]
push eax
call fcn.100889a0
mov ecx, dword [eax]
jmp 0x1008a74f
mov ecx, dword [ebp - 0x18]
mov edi, dword [ebp + 8]
push edi
push ecx
push ebx
mov ecx, esi
call fcn.1008e810
mov ecx, dword [ebp - 0xc]
add eax, 0x10
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret 4
push str.unordered_map_set_too_long
call fcn.100a4817
int3
Function at 0x1008ad20
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
sub esp, 8
test eax, eax
je 0x1008ae17
push esi
push eax
call sub.mantle32.dll_grDestroyObject
mov esi, dword [ebp + 8]
lea eax, [ebp + 0xc]
add esi, 0x1c4
push eax
mov ecx, esi
call fcn.1008a630
cmp dword [eax], 0
je 0x1008ad63
lea eax, [ebp + 0xc]
mov ecx, esi
push eax
call fcn.1008a630
push dword [eax]
call sub.mantle32.dll_grFreeMemory
cmp byte [ebp + 0x10], 0
je 0x1008ae0e
mov edx, dword [ebp + 0xc]
movzx eax, dl
xor eax, 0x811c9dc5
imul ecx, eax, 0x1000193
movzx eax, dh
push edi
xor ecx, eax
movzx eax, byte [ebp + 0xe]
imul ecx, ecx, 0x1000193
xor ecx, eax
movzx eax, byte [ebp + 0xf]
imul ecx, ecx, 0x1000193
xor ecx, eax
lea eax, [ebp + 0xc]
imul edi, ecx, 0x1000193
mov ecx, esi
push edi
push eax
lea eax, [ebp - 8]
push eax
call fcn.100889a0
mov edx, dword [eax + 4]
test edx, edx
je 0x1008ae04
mov ecx, dword [esi + 0x18]
mov eax, dword [esi + 0xc]
and ecx, edi
lea ecx, [eax + ecx*8]
mov eax, dword [ecx]
cmp dword [ecx + 4], edx
jne 0x1008ade1
cmp eax, edx
jne 0x1008add9
mov eax, dword [esi + 4]
mov dword [ecx], eax
mov dword [ecx + 4], eax
jmp 0x1008ade9
mov eax, dword [edx + 4]
mov dword [ecx + 4], eax
jmp 0x1008ade9
cmp eax, edx
jne 0x1008ade9
mov eax, dword [edx]
mov dword [ecx], eax
mov ecx, dword [edx]
dec dword [esi + 8]
mov eax, dword [edx + 4]
push 0x20
push edx
mov dword [eax], ecx
mov eax, dword [edx + 4]
mov dword [ecx + 4], eax
call fcn.100a576e
add esp, 8
pop edi
mov al, 1
pop esi
mov esp, ebp
pop ebp
ret 0xc
mov al, 1
pop esi
mov esp, ebp
pop ebp
ret 0xc
mov al, 1
mov esp, ebp
pop ebp
ret 0xc
Function at 0x1008b190
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.grCreateDevice
push esi
call edi
mov ebx, eax
test ebx, ebx
je 0x1008b1d4
push 0x1008f640
push ebx
call fcn.10071f00
add esp, 8
test al, al
jne 0x1008b1d4
push 0
push 0x1012f158
push 0x1008f640
push ebx
call fcn.100714b0
add esp, 0x10
push str.grDestroyDevice
push esi
call edi
mov ebx, eax
test ebx, ebx
je 0x1008b209
push 0x1008f6b0
push ebx
call fcn.10071f00
add esp, 8
test al, al
jne 0x1008b209
push 0
push 0x1012f15c
push 0x1008f6b0
push ebx
call fcn.100714b0
add esp, 0x10
push 0x100e494c
push esi
call edi
mov ebx, eax
test ebx, ebx
je 0x1008b23e
push 0x1008f8a0
push ebx
call fcn.10071f00
add esp, 8
test al, al
jne 0x1008b23e
push 0
push 0x1012f160
push 0x1008f8a0
push ebx
call fcn.100714b0
add esp, 0x10
push str.grWsiWinCreatePresentableImage
push esi
call edi
mov ebx, eax
test ebx, ebx
je 0x1008b273
push 0x1008f920
push ebx
call fcn.10071f00
add esp, 8
test al, al
jne 0x1008b273
push 0
push 0x1012f164
push 0x1008f920
push ebx
call fcn.100714b0
add esp, 0x10
push str.grWsiWinQueuePresent
push esi
call edi
mov esi, eax
test esi, esi
je 0x1008b2a8
push 0x1008f970
push esi
call fcn.10071f00
add esp, 8
test al, al
jne 0x1008b2a8
push 0
push 0x1012f168
push 0x1008f970
push esi
call fcn.100714b0
add esp, 0x10
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x1008d0a0
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
mov ebx, dword [ebp + 8]
movzx eax, bl
xor eax, 0x811c9dc5
imul edx, eax, 0x1000193
mov eax, ebx
sar eax, 8
movzx eax, al
push esi
mov esi, ecx
xor edx, eax
mov eax, ebx
sar eax, 0x10
imul ecx, edx, 0x1000193
movzx eax, al
sar ebx, 0x18
xor ecx, eax
movzx eax, bl
imul ecx, ecx, 0x1000193
xor ecx, eax
imul eax, ecx, 0x1000193
lea ecx, [esi + 0xd8]
push eax
lea eax, [ebp + 8]
push eax
lea eax, [ebp - 8]
push eax
call fcn.100889a0
pop esi
pop ebx
cmp dword [eax + 4], 0
setne al
mov esp, ebp
pop ebp
ret 4