joyce8/EMBER2024-capa huggingface dataset:
Function at 0x426ac0
Capabilities:
Check mutex on windows
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x2c
mov edi, dword [ebp + 8]
mov dword [esp], edi
call sym._strlen
mov ebx, eax
lea eax, [eax + 0x40]
and eax, 0xfffffff0
call fcn.004142e0
mov edx, 0x326d
sub esp, eax
lea eax, [esp + 0x1b]
mov dword [esp + 4], edi
mov dword [esp + 8], ebx
lea esi, [esp + 0xc]
mov word [esp + 0x18], dx
mov dword [esp + 0xc], 0x2d636367
mov dword [esp], eax
mov dword [esp + 0x10], 0x656d6873
mov dword [esp + 0x14], 0x64742d6d
mov byte [esp + 0x1a], 0x2d
call sym._memcpy
lea eax, [ebx + 0x10]
lea edi, [esi + eax]
mov dword [ebp - 0x24], eax
lea eax, [ebx + 0x30]
mov dword [edi], 0x61616161
mov dword [edi + 4], 0x61616161
mov dword [edi + 8], 0x61616161
mov dword [edi + 0xc], 0x61616161
mov dword [edi + 0x10], 0x61616161
mov dword [edi + 0x14], 0x61616161
mov dword [edi + 0x18], 0x61616161
mov dword [edi + 0x1c], 0x61616161
mov dword [ebp - 0x1c], eax
mov byte [esp + ebx + 0x3c], 0
mov byte [esp + ebx + 0x1b], 0
mov dword [esp + 8], esi
mov dword [esp + 4], 0
mov dword [esp], 0
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
sub esp, 0xc
mov byte [esi + ebx + 0xf], 0x2d
mov dword [ebp - 0x20], eax
mov dword [esp + 4], 0xffffffff
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
sub esp, 8
test eax, eax
je 0x426baf
int3
mov dword [esp], esi
call dword [sym.imp.KERNEL32.dll_FindAtomA]
sub esp, 4
test ax, ax
jne 0x426c53
mov eax, dword [ebp + 0xc]
mov dword [esp], eax
call sym._malloc
mov edx, edi
mov ebx, eax
mov eax, 0x20
nop
lea esi, [esi]
bt ebx, eax
jae 0x426be8
mov byte [edx], 0x41
add edx, 1
sub eax, 1
jne 0x426be0
mov dword [esp], esi
call dword [sym.imp.KERNEL32.dll_AddAtomA]
sub esp, 4
test ax, ax
je 0x426c50
mov ecx, dword [ebp - 0x24]
mov edx, esi
movzx eax, ax
mov dword [esp], ecx
mov ecx, dword [ebp - 0x1c]
call sym._get_ptr_from_atom_1
cmp eax, ebx
mov esi, eax
je 0x426c6a
mov dword [esp], ebx
call sym._free
mov edi, dword [ebp - 0x20]
mov dword [esp], edi
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
sub esp, 4
mov dword [esp], edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
sub esp, 4
lea esp, [ebp - 0xc]
mov eax, esi
pop ebx
pop esi
pop edi
pop ebp
ret
int3
mov ecx, dword [ebp - 0x24]
mov edx, esi
movzx eax, ax
mov dword [esp], ecx
mov ecx, dword [ebp - 0x1c]
call sym._get_ptr_from_atom_1
mov esi, eax
jmp 0x426c22
mov eax, dword [ebp + 0xc]
mov dword [esp + 4], 0
mov dword [esp], ebx
mov dword [esp + 8], eax
call sym._memset
mov eax, dword [ebp + 0x10]
test eax, eax
je 0x426c22
mov dword [esp], ebx
call dword [ebp + 0x10]
jmp 0x426c22
Function at 0x432000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
nop
nop
push 4
nop
nop
nop
nop
nop
nop
nop
pop edi
nop
nop
nop
cmp eax, 0
je 0x432072
nop
nop
nop
nop
mov ebx, 0x40c7d0
nop
mov ecx, ebx
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
push eax
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
div edi
nop
nop
nop
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
pop eax
nop
nop
nop
nop
mov esi, 0x61bc4f64
nop
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
nop
add eax, edi
nop
nop
loop 0x432060
nop
nop
nop
mov eax, section..data
nop
cmp eax, 0
nop
nop
je 0x4320d2
nop
nop
nop
nop
mov ebx, 0x42f314
nop
nop
mov ecx, ebx
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
push eax
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
nop
div edi
nop
nop
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
pop eax
mov esi, 0x2fed5637
nop
nop
nop
nop
xor dword [eax], esi
nop
nop
nop
add eax, edi
nop
nop
nop
nop
loop 0x4320c0
nop
nop
popal
nop
nop
nop
nop
nop
jmp 0x431219

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx

Function at 0x9302d8
Capabilities:
Encode data using xor

Disassembly:
pushal
call 0x9302de
pop ebp
sub ebp, 6
sub ebp, 0x5302d8
jmp 0x93033c
jmp 0x930345
mov eax, 0x5302d8
add eax, ebp
add eax, 0x93
mov ecx, 0x628
mov edx, 0x71b33b98
xor byte [eax], dl
inc eax
dec ecx
jne 0x93035c
jmp 0x93036f
fdiv st(0)
cwde
mov byte [eax + 0x5498f098], bl
mov ah, 0x98
stosd dword es:[edi], eax
pop eax
enter 0xd67, 0xffffffffffffffe0
invalid
Function at 0x4195ec
Capabilities:
Terminate process

Disassembly:
call fcn.004195f9
push 0
call dword [sym.imp.KERNEL32.DLL_ExitProcess]

Function at 0x430002
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
mov eax, section..idata
nop
push 4
nop
nop
nop
nop
nop
nop
pop edi
nop
nop
nop
cmp eax, 0
nop
nop
nop
nop
nop
je 0x430072
nop
mov ebx, 0x408ecc
nop
nop
nop
mov ecx, ebx
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
push eax
nop
nop
mov eax, ecx
nop
nop
nop
nop
div edi
nop
nop
nop
nop
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
pop eax
mov esi, 0x54d578d5
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
add eax, edi
nop
nop
nop
loop 0x430060
nop
nop
nop
nop
nop
mov eax, section..data
nop
nop
nop
cmp eax, 0
nop
je 0x4300d2
nop
nop
nop
nop
mov ebx, 0x42e1d0
nop
mov ecx, ebx
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
nop
xor edx, edx
push eax
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
nop
div edi
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
nop
pop eax
nop
mov esi, 0x644b1020
nop
nop
nop
xor dword [eax], esi
nop
add eax, edi
nop
nop
nop
nop
nop
nop
nop
nop
loop 0x4300c0
nop
nop
nop
nop
popal
nop
jmp 0x401219

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x401e40
Capabilities:
Encode data using xor

Disassembly:
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push ebp
mov ebp, esp
sub esp, 0x78
push esi
mov ecx, edi
or al, 0x56
lea eax, [ebp - 0x28]
push 0x78
push eax
push esi
call fcn.00408726
mov ecx, dword [ebp - 0x7e]
xor dl, byte [0xbec0c8]
xor byte [edx], 0x15
enter 0xffffffffffffbec0, 0
push eax
push ecx
sbb dword [edi + 0x40], 0x68
lodsb al, byte [esi]
aam 0x1c
add byte [edx - 1], dl
adc eax, 0x2b40c180
mov eax, dword [0x1d4102ac]
add esp, 0x4e
push 0xffffffffffffffc0
je 0x401e59
push eax
inc edi
push esp
rol byte [eax], cl
call dword [0xb55cc164]
add esp, 8
ja 0x401e8d
call dword [ebx + 0x3440a173]
pop esi
xchg ebx, eax
jae 0x401e32
inc eax
xor al, 0x5e
nop
nop
out dx, eax
nop
nop
nop
test eax, 0x90909007
sti

Function at 0x406a00
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub dword [eax + 8], 0xffffff8d
inc ebp
rcl byte [esi + 0x1d]
call dword [0xd2c078]
mov ebx, dword [esi]
push es
aaa
inc ebp
xlatb
xor esi, esi
xor edx, dword [ebp + 0xb56740b]
enter 0xffffffffffff966a, 0x52
stc
call fcn.0040b590
sub eax, 0x48864000
pop esi
sub dword [esi - 0x6a], 0xa2fd2942
cmp dword [ebp + 0x7a], ebx
nop
nop
sahf
nop
nop
nop

Function at 0x40a340
Capabilities:
Encode data using xor

Disassembly:
pop esi
pop ebp
ret 0x1b04
push ebp
mov ebp, esp
mov ecx, dword [ebp + 8]
push esi
mov esp, dword [ebp + 4]
test eax, eax
jne 0x40a35f
loopne 0x40a311
or al, 0x51
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
xor eax, eax
pop esi
pop ebp
xchg ebp, eax
add al, 0
cmp eax, 0xffffffc2
dec byte [esi - 0x75]
inc ecx
wait
push ss
call dword [0x409130]
cld
jae 0xe3b5a66d
mov ecx, dword [ecx + 8]
push ecx
call ecx
xor al, 0xc0
inc eax
add byte [ebp - 0x742a8a40], al
xor ebx, dword [eax - 0xffbf40]
salc
test eax, eax
je 0x40a358
dec eax
add eax, 0x946efc80
pop esi
pop ebp
ret 0xb104

Function at 0x40a4b0
Capabilities:
Allocate thread local storage

Disassembly:
push ebp
popfd
dec byte [ebx + 0x76561445]
jne 0x40a4c2
neg eax
sahf
sal bh, 0xd8
dec eax
push eax
mov eax, dword [esi + 0x50]
push eax
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
test dword [eax + 0x2a144589], eax
dec ebx
mov edx, dword [esi + 0x14]
pushfd
mov ebx, 0xff075114
in al, dx
and al, 0xc0
inc eax
add cl, ah
sal byte [edx + ecx*2 - 0x7e], 0x45
or al, 0x8b
dec ebp
pop ecx
test dword [edx], edi
rol dword [edx], 1
mov dword [eax], ecx
mov edx, dword [ebp + 0x18]
test ebp, edi
mov edi, 0xa96f510b
pop esp
imul ecx, dword [ebx - 0x761b3b7d], 0xe078b02
int3
Function at 0x40a720
Capabilities:
Check os version

Disassembly:
sub cl, byte [ebx + 0x57dca1ec]
inc ecx
add byte [esi - 0x7b], dl
ror byte [ecx + 0xf], 0x88
salc
add dword [eax], eax
add byte [eax - 8], ch
sbb byte [ecx], al
mov dword [0x410767], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
mov eax, dword [0xe410842]
cmp eax, 2
scasd eax, dword es:[edi]
test dword [esi - 0x5fff10ff], edi
or al, 8
inc ecx
add byte [esi + 0x41080c], bh
test al, al
je 0x40a79e
mov edi, dword [0xad40d368]
mov eax, dword [0x9c40c174]
cmp dword [eax], 1
jle 0x40a781
xor ecx, ecx
push 4
mov bl, dl
push ecx
call edi
add esp, 8
jmp 0x40a792
mov eax, dword [0x70c178]
xor edx, edx
mov dl, byte [esi]
mov ecx, dword [edx - 0x76]
add al, 0x51
sbb esp, eax
adc eax, dword [ebp - 0x75c98a40]
push es
test eax, eax
jne 0x40a7cc
mov al, byte [esi]
add dword [esi - 0x7c], eax
sal byte [ebp - 0x35], 0x8b
loopne 0x40a7aa
mov esp, dword [esi - 0x20]
or byte [edi + 0x5f], ah
pop edi
mov eax, dword [0x4107fc]
cmp eax, 3
jb 0x4140a911
clc
add ecx, dword [edi]
sbb byte [edi + 1], 0
inc ecx
pop esp
test byte [ecx + 1], bl
add byte [eax], al
cmp eax, 4
jne 0x40a822
cmp ecx, 2
jae 0x40a7e5
mov eax, 0x310076
idiv dword [edi - 0x6428ffff]
wait
add byte ds:[ebp - 0x33], ch
inc esi
call dword [0xdf92c16c]
mov edi, dword [0x1f04c483]
or eax, 0x4108e0
jmp 0x40a7a4
jb 0x40a7f1
mov eax, 0x2a
jmp 0x40a916
cmp ecx, 3
mov dword [0x2bb80a], eax
stc
add cl, ch
push ss
add dword [eax], eax
add byte [ebx + 0xa7704f9], al
mov eax, 0x4bc4
mov dword [0x107], eax
mov edx, 0x6e05
cmp ebp, dword [ebx + ebx - 0x40]
neg eax
xor ebx, 0x2d
jmp 0xefa916
cmp eax, 5
jne 0x40a7fd
mov eax, dword [0x410800]
rol eax, 1
cmp ebx, dword [esi]
test ecx, ecx
jl 0x40a83e
mov eax, 0x32
jmp 0x40a905
xor eax, eax
cmp ecx, 1
orps xmm0, xmm0
add eax, 0xffffffd2
mov ah, 0xc8
add byte [edx - 0xe], cl
cmp eax, 2
jne 0x40a85d
mov eax, 0x59001c46
jmp 0x40a920
xor esp, 1
jae 0x40a86c
mov eax, 0x3900003c
invalid
inc eax
rol byte [ebx - 0x6af0fe07], 0xd6
add eax, 0x3d
jmp 0xd9269450
inc esp
add byte [esi], cl
push esp
or al, 0xb8
adc al, byte [eax]
add byte [eax], al
jmp 0x40a916
mov dword [0x41dcdc], eax
mov esi, dword [esi + 8]
pop edi
stosd dword es:[edi], eax
add cl, byte [ebx + 0x41089c35]
add byte [ebx], dh
sal byte [eax + 0x3b0f0105], 0x80
dec eax
ja 0x40a91f
dec edi
dec esi
add byte [eax], al
fcmovnb st(0), st(3)
nop
nop
fst dword [eax - 0x6f6f6f70]
Function at 0x40b080
Capabilities:
Read file on windows

Disassembly:
add byte [eax], al
add byte [ebx - 0x17afa7bd], cl
or eax, 0x8bffffda
inc ebp
or dh, dl
retf 0xab5b
push ebp
mov ebp, esp
push esi
mov esi, esi
sub byte [edi - 0x75], dh
jge 0x40b09b
mov eax, dword [esi + 0x10]
mov ecx, dword [esi + 0x14]
or eax, ecx
mov dword [ebp - 0x25], 0xa4ee0000
jne 0x40b10d
jno 0x40b027
mov dh, al
lock or byte [eax + eax*8 + 0x56126a74], al
or byte [eax + eax*8 + 0x56126a74], al
add al, 0x8d
dec ebp
or byte [edx], ch
push ecx
push 0
push 0x5f
push 0
ror byte [eax + 0x15], cl
ffreep st(0)
jae 0x40b0b9
aam 0x9b
xor eax, 0x98358b35
rol byte [eax], 0xff
salc
test eax, eax
cld
or ecx, edx
dec ebp
cmpsb byte [esi], byte es:[edi]
pop edi
pop esi
mov dword [ecx], eax
pop ebp
jno 0x40b0d2
call esi
salc
add eax, 0xafc80
in eax, 0xed
cld
or al, byte [eax]
jne 0x40b09e
mov eax, 0x54116e
mov ebx, dword [esp + edx + 0x1c75e5f]
add byte [eax], al
rol byte [eax], cl
pop ebp
ret
mov edx, dword [ebp + 0x748d850c]
and esi, dword [edx + 0x1684084e]
jne 0x40b137
mov ecx, dword [esi + 0x50]
mov dword [eax + 8], ecx
mov eax, dword [esi + 0x50]
mov edx, dword [esi + 0x54]
mov ecx, 0x2b
bnd js 0x40b135
add byte [eax], al
mov edx, dword [esi - 0x7a]
test eax, 0x466b0c42
inc edx
or al, 0x6b
inc esi
imul eax, dword [esi + 0xc], 0xffffff8b
or al, 0x8b
push ebp
or al, 0x7f
sub byte [ebp + 0x10], al
and ecx, dword [ebx + 0x5c516746]
push edx
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
and eax, eax
je 0x40b0e5
xor eax, eax
jmp 0x10fb285
Function at 0x10041e50
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x100f1040]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, ecx
cmp dword [esi + 0x38], 0
je 0x10041f0c
cmp byte [esi + 0x3d], 0
je 0x10041f0c
mov eax, dword [esi]
push edi
push 0xffffffffffffffff
call dword [eax + 0xc]
cmp eax, 0xffffffff
je 0x10041efa
mov ecx, dword [esi + 0x38]
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [esi + 0x40]
push eax
call dword [sym.imp.MSVCP140.dll_public:_int___thiscall_std::codecvt_char__char__struct__Mbstatet_::unshift_struct__Mbstatet___char___char___char___const]
sub eax, 0
je 0x10041ec1
sub eax, 1
je 0x10041ec5
sub eax, 2
jne 0x10041efa
mov byte [esi + 0x3d], al
mov al, 1
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100cb0e9
mov esp, ebp
pop ebp
ret
mov byte [esi + 0x3d], 0
mov edi, dword [ebp - 0x28]
lea eax, [ebp - 0x24]
sub edi, eax
je 0x10041ee3
push dword [esi + 0x4c]
push edi
push 1
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
add esp, 0x10
cmp edi, eax
jne 0x10041efa
cmp byte [esi + 0x3d], 0
pop edi
sete al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100cb0e9
mov esp, ebp
pop ebp
ret
pop edi
xor al, al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100cb0e9
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
mov al, 1
xor ecx, ebp
pop esi
call fcn.100cb0e9
mov esp, ebp
pop ebp
ret
Function at 0x10044380
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
cmp byte [0x102cf030], 0
push ebx
push esi
push edi
je 0x1004451d
mov ecx, dword [0x1044a3e4]
mov eax, dword [ecx]
mov eax, dword [eax + 0x68]
call eax
test al, al
je 0x1004451d
mov ecx, dword [0x1044a46c]
xor ebx, ebx
mov dword [ebp - 4], ecx
mov eax, dword [ecx + 0x28]
mov dword [ebp - 8], eax
test eax, eax
je 0x1004451d
mov eax, dword [ecx + 0x1c]
mov ecx, dword [eax + ebx*4]
mov eax, dword [ecx]
mov eax, dword [eax + 0x30]
call eax
mov esi, eax
mov edi, 0x811c9dc5
xor ecx, ecx
nop word [eax + eax]
inc ecx
cmp byte [esi + ecx], 0
jne 0x100443e0
xor edx, edx
test ecx, ecx
je 0x10044409
nop dword [eax]
movsx eax, byte [esi + edx]
inc edx
xor eax, edi
imul edi, eax, 0x1000193
cmp edx, ecx
jb 0x100443f0
cmp edi, 0x5ff56dc5
je 0x10044418
inc ebx
cmp ebx, dword [ebp - 8]
jae 0x1004451d
mov ecx, dword [ebp - 4]
jmp 0x100443c4
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x1c]
mov edi, dword [eax + ebx*4]
test edi, edi
je 0x1004451d
mov edx, dword [edi + 0x88]
test edx, edx
je 0x1004451d
vmovss xmm2, dword [0x100e51f0]
vmovss xmm1, dword [0x100e5370]
xor ebx, ebx
cmp edx, 4
jl 0x100444e6
mov ecx, dword [edi + 0x7c]
lea esi, [edx - 4]
shr esi, 2
add ecx, 0x1078
inc esi
lea ebx, [esi*4]
nop dword [eax]
vmovss xmm0, dword [ecx - 0xc60]
vucomiss xmm0, xmm2
lahf
test ah, 0x44
jp 0x1004448a
vmovss dword [ecx - 0xc60], xmm1
vmovss xmm0, dword [ecx - 0x840]
vucomiss xmm0, xmm2
lahf
test ah, 0x44
jp 0x100444a4
vmovss dword [ecx - 0x840], xmm1
vmovss xmm0, dword [ecx - 0x420]
vucomiss xmm0, xmm2
lahf
test ah, 0x44
jp 0x100444be
vmovss dword [ecx - 0x420], xmm1
vmovss xmm0, dword [ecx]
vucomiss xmm0, xmm2
lahf
test ah, 0x44
jp 0x100444d0
vmovss dword [ecx], xmm1
add ecx, 0x1080
sub esi, 1
jne 0x10044470
cmp ebx, edx
jl 0x100444ea
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
test edx, edx
jle 0x1004451d
imul ecx, ebx, 0x420
add ecx, 0x418
add ecx, dword [edi + 0x7c]
sub edx, ebx
nop dword [eax + eax]
vmovss xmm0, dword [ecx]
vucomiss xmm0, xmm2
lahf
test ah, 0x44
jp 0x10044512
vmovss dword [ecx], xmm1
add ecx, 0x420
sub edx, 1
jne 0x10044500
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10046970
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100cd6a5
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push ebx
push esi
push edi
mov eax, dword [0x100f1040]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
movzx eax, byte [esi]
xor eax, 0x811c9dc5
imul ecx, eax, 0x1000193
movzx eax, byte [esi + 1]
xor ecx, eax
movzx eax, byte [esi + 2]
imul ecx, ecx, 0x1000193
xor ecx, eax
movzx eax, byte [esi + 3]
imul ecx, ecx, 0x1000193
xor ecx, eax
lea eax, [ebp - 0x18]
imul edi, ecx, 0x1000193
push edi
push esi
push eax
call fcn.100481d0
mov eax, dword [ebp - 0x14]
test eax, eax
jne 0x10046afa
cmp dword [0x1044e2f0], 0xfffffff
jne 0x100469fa
push str.unordered_map_set_too_long
call dword [sym.imp.MSVCP140.dll_void___cdecl_std::_Xlength_error_char_const__]
mov dword [ebp - 0x20], 0x1044e2ec
mov dword [ebp - 4], 0
push 0x10
mov dword [ebp - 0x1c], 0
call fcn.100cb105
mov ebx, eax
add esp, 4
mov eax, dword [esi]
mov dword [ebp - 0x1c], ebx
mov dword [ebx + 8], eax
mov dword [ebx + 0xc], 0
mov dword [ebp - 4], 1
mov eax, dword [0x1044e2f0]
mov esi, dword [0x1044e304]
inc eax
vmovss xmm1, dword [0x1044e2e8]
vxorps xmm0, xmm0, xmm0
vcvtsi2sd xmm0, xmm0, eax
shr eax, 0x1f
vaddsd xmm0, xmm0, qword [eax*8 + 0x100e54d0]
vcvtsd2ss xmm2, xmm0, xmm0
vxorps xmm0, xmm0, xmm0
mov eax, esi
shr eax, 0x1f
vcvtsi2sd xmm0, xmm0, esi
vaddsd xmm0, xmm0, qword [eax*8 + 0x100e54d0]
vcvtsd2ss xmm0, xmm0, xmm0
vdivss xmm0, xmm2, xmm0
vcomiss xmm0, xmm1
jbe 0x10046aef
vdivss xmm0, xmm2, xmm1
vcvtss2sd xmm0, xmm0, xmm0
vmovsd qword [ebp - 0x18], xmm0
fld qword [ebp - 0x18]
vxorpd xmm0, xmm0, xmm0
fstp qword [ebp - 0x18]
vroundsd xmm0, xmm0, qword [ebp - 0x18], 2
vmovsd qword [ebp - 0x18], xmm0
fld qword [ebp - 0x18]
fstp qword [ebp - 0x18]
vmovsd xmm0, qword [ebp - 0x18]
vcvtpd2ps xmm0, xmm0
call fcn.100cc370
mov ecx, 8
cmp eax, ecx
cmova ecx, eax
cmp esi, ecx
jae 0x10046ad7
cmp esi, 0x200
jae 0x10046ad5
shl esi, 3
cmp esi, ecx
jae 0x10046ad7
mov esi, ecx
push esi
call fcn.10047f80
push edi
lea eax, [ebx + 8]
push eax
lea eax, [ebp - 0x20]
push eax
call fcn.100481d0
mov ecx, dword [eax]
jmp 0x10046af2
mov ecx, dword [ebp - 0x18]
push ebx
push ecx
push edi
call fcn.10047f10
add eax, 0xc
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x10046fb0
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
sub esp, 0x18
mov edx, dword [ebp + 8]
push ebx
mov ebx, ecx
cmp edx, eax
je 0x10047106
mov eax, dword [ebx + 4]
mov dword [ebp - 0x14], eax
mov eax, dword [edx + 4]
mov dword [ebp - 8], eax
movzx eax, byte [edx + 8]
xor eax, 0x811c9dc5
imul ecx, eax, 0x1000193
movzx eax, byte [edx + 9]
push esi
push edi
mov edi, dword [ebx + 0xc]
mov esi, edx
xor ecx, eax
mov dword [ebp - 0x18], edi
movzx eax, byte [edx + 0xa]
imul ecx, ecx, 0x1000193
xor ecx, eax
movzx eax, byte [edx + 0xb]
imul ecx, ecx, 0x1000193
xor ecx, eax
mov eax, dword [ebx + 0x18]
imul ecx, ecx, 0x1000193
and eax, ecx
mov ecx, dword [edi + eax*8]
mov dword [ebp - 4], ecx
lea eax, [edi + eax*8]
mov dword [ebp - 0xc], eax
mov eax, dword [eax + 4]
mov dword [ebp - 0x10], eax
mov eax, esi
mov edi, esi
mov esi, dword [esi]
push 0x10
push eax
call fcn.100cb569
dec dword [ebx + 8]
add esp, 8
cmp edi, dword [ebp - 0x10]
je 0x10047069
mov eax, dword [ebp + 0xc]
cmp esi, eax
jne 0x10047027
mov ecx, dword [ebp - 4]
cmp ecx, dword [ebp + 8]
jne 0x100470fc
mov edx, dword [ebp - 0xc]
mov ecx, dword [ebp - 8]
pop edi
mov dword [edx], esi
mov dword [ecx], esi
mov dword [esi + 4], ecx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
mov ecx, dword [ebp - 4]
mov edx, dword [ebp - 0xc]
cmp ecx, dword [ebp + 8]
jne 0x1004707d
mov eax, dword [ebp - 0x14]
mov ecx, eax
mov dword [edx], eax
jmp 0x10047080
mov ecx, dword [ebp - 8]
mov eax, dword [ebp + 0xc]
mov dword [edx + 4], ecx
cmp esi, eax
je 0x100470fc
nop word [eax + eax]
movzx eax, byte [esi + 8]
xor eax, 0x811c9dc5
imul ecx, eax, 0x1000193
movzx eax, byte [esi + 9]
xor ecx, eax
movzx eax, byte [esi + 0xa]
imul ecx, ecx, 0x1000193
xor ecx, eax
movzx eax, byte [esi + 0xb]
imul ecx, ecx, 0x1000193
xor ecx, eax
mov eax, dword [ebx + 0x18]
imul ecx, ecx, 0x1000193
and eax, ecx
mov ecx, dword [ebp - 0x18]
lea eax, [ecx + eax*8]
mov dword [ebp - 4], eax
mov eax, dword [eax + 4]
mov dword [ebp - 0x10], eax
mov eax, esi
mov edi, esi
mov esi, dword [esi]
push 0x10
push eax
call fcn.100cb569
dec dword [ebx + 8]
add esp, 8
mov eax, dword [ebp + 0xc]
cmp edi, dword [ebp - 0x10]
je 0x1004710d
cmp esi, eax
jne 0x100470d7
mov ecx, dword [ebp - 4]
mov dword [ecx], esi
mov ecx, dword [ebp - 8]
pop edi
mov dword [ecx], esi
mov dword [esi + 4], ecx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
mov ecx, dword [ebp - 4]
mov edx, dword [ebp - 0x14]
mov dword [ecx], edx
mov dword [ecx + 4], edx
cmp esi, eax
jne 0x10047090
mov ecx, dword [ebp - 8]
pop edi
mov dword [ecx], esi
mov dword [esi + 4], ecx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x10053f40
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [ebp + 0xc]
mov edx, ecx
push ebx
mov ebx, dword [ebp + 8]
mov dword [ebp - 0x14], edx
cmp ebx, eax
je 0x100540b1
mov eax, dword [edx + 4]
mov dword [ebp - 0x18], eax
mov eax, dword [ebx + 4]
mov dword [ebp - 8], eax
movzx eax, byte [ebx + 8]
xor eax, 0x811c9dc5
imul ecx, eax, 0x1000193
movzx eax, byte [ebx + 9]
push esi
push edi
mov edi, dword [edx + 0xc]
mov esi, ebx
xor ecx, eax
mov dword [ebp - 0x1c], edi
movzx eax, byte [ebx + 0xa]
imul ecx, ecx, 0x1000193
xor ecx, eax
movzx eax, byte [ebx + 0xb]
imul ecx, ecx, 0x1000193
xor ecx, eax
mov eax, dword [edx + 0x18]
imul ecx, ecx, 0x1000193
and eax, ecx
mov ecx, dword [edi + eax*8]
mov dword [ebp - 4], ecx
lea eax, [edi + eax*8]
mov dword [ebp - 0xc], eax
mov eax, dword [eax + 4]
mov dword [ebp - 0x10], eax
nop word [eax + eax]
mov edi, esi
mov ebx, esi
mov esi, dword [esi]
lea ecx, [edi + 0xc]
call fcn.10054860
push 0x2c
push edi
call fcn.100cb569
mov edx, dword [ebp - 0x14]
add esp, 8
dec dword [edx + 8]
cmp ebx, dword [ebp - 0x10]
je 0x1005400d
mov eax, dword [ebp + 0xc]
cmp esi, eax
jne 0x10053fc0
mov ecx, dword [ebp - 4]
cmp ecx, dword [ebp + 8]
jne 0x100540a7
mov edi, dword [ebp - 0xc]
mov ecx, dword [ebp - 8]
mov dword [edi], esi
mov dword [ecx], esi
pop edi
mov dword [esi + 4], ecx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
mov ecx, dword [ebp - 4]
mov edi, dword [ebp - 0xc]
cmp ecx, dword [ebp + 8]
jne 0x10054021
mov eax, dword [ebp - 0x18]
mov ecx, eax
mov dword [edi], eax
jmp 0x10054024
mov ecx, dword [ebp - 8]
mov eax, dword [ebp + 0xc]
mov dword [edi + 4], ecx
cmp esi, eax
je 0x100540a7
nop
movzx eax, byte [esi + 8]
xor eax, 0x811c9dc5
imul ecx, eax, 0x1000193
movzx eax, byte [esi + 9]
xor ecx, eax
movzx eax, byte [esi + 0xa]
imul ecx, ecx, 0x1000193
xor ecx, eax
movzx eax, byte [esi + 0xb]
imul ecx, ecx, 0x1000193
xor ecx, eax
mov eax, dword [edx + 0x18]
imul ecx, ecx, 0x1000193
and eax, ecx
mov ecx, dword [ebp - 0x1c]
lea eax, [ecx + eax*8]
mov dword [ebp - 4], eax
mov eax, dword [eax + 4]
mov dword [ebp - 0x10], eax
mov edi, esi
mov ebx, esi
mov esi, dword [esi]
lea ecx, [edi + 0xc]
call fcn.10054860
push 0x2c
push edi
call fcn.100cb569
mov edx, dword [ebp - 0x14]
add esp, 8
mov eax, dword [ebp + 0xc]
dec dword [edx + 8]
cmp ebx, dword [ebp - 0x10]
je 0x100540b8
cmp esi, eax
jne 0x10054077
mov ecx, dword [ebp - 4]
mov dword [ecx], esi
mov ecx, dword [ebp - 8]
pop edi
mov dword [ecx], esi
mov dword [esi + 4], ecx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
mov ecx, dword [ebp - 4]
mov ebx, dword [ebp - 0x18]
mov dword [ecx], ebx
mov dword [ecx + 4], ebx
cmp esi, eax
jne 0x10054030
mov ecx, dword [ebp - 8]
pop edi
mov dword [ecx], esi
mov dword [esi + 4], ecx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8