joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4092be
Capabilities:
Encode data using xor

Disassembly:
jbe 0x40930f
adc eax, 0x35e405fa
or dh, byte [edx - 0x739b56a9]
sbb esp, dword [ebp - 0xc]
sbb byte [ebp - 0x2c], cl
inc edi
xchg dword [ecx - 0xa], edx
or dh, byte [esi + eax*4]
ror dword [edx - 0x2a502aff], 0x63
in al, 0x4a
dec edx
mov ch, 0x2d
fldenv [esi]
and byte es:[edx + edi*2 - 0x683b75c6], 0x55
and byte [edx + edi*2 - 0x683b75c6], 0x55
adc al, dl
mov cl, 0xdc
push esp
xor al, 0x55
out 0x8c, al
stosd dword es:[edi], eax
cmpsb byte [esi], byte es:[edi]
aam 0xf4
push es
das
jae 0x4092ba
and al, 0xa4
lahf
mov dword [bx + si + 0xc], ebp
ja 0x40934c
pop eax
push esp
jns 0x409328
arpl word [esi + 0x4a], dx
out 0x75, al
in al, dx
xor al, 0xb4
aad 0x74
into
je 0x4092bd
mov dh, 0xd6
add al, 0xc
jne 0x4092b9
jno 0x409300
int 0xcd
or dh, byte [edi]
cmp al, dl
sub eax, 0x340222ac
test ecx, 0xe3814115
jp 0x409297
add dh, byte [edi + esi*8]
rcl dword [0x7ae38141], 0x8d
popal
push ss
dec esp
xor eax, 0x453ea714
cmpsd dword [esi], dword es:[edi]
inc ebp
daa
out 0x6e, eax
invalid
push 0xfffffffffffffff0
inc ecx
sbb al, 0x7f
sar edi, 0x2e
jmp [esi]
and al, 0x52
cld
push ebx
pushfd
bound eax, qword [esi - 0x68]
out 0x9b, al
pop esp
loope 0x409394
sub ebx, dword [edx]
scasd eax, dword es:[edi]
test ah, bl
iretd
pop es
pop edx
pop esi
xor al, 0xd2
je 0x4092ed
pop eax
cli
invalid
mov esi, dword [ecx - 0x3c]
movsd dword es:[edi], dword [esi]
xchg edi, eax
inc esp
mov bh, 0x7c
jp 0x4093dc
in eax, 0x81
and eax, 0x169c16b6
mov ebx, 0x2037441e
movsd dword es:[edi], dword [esi]
xor dword [esp + edi*8 + 0x3cb08c3c], eax
cld
cmp al, 0x8c
mov al, 0x3c
mov esp, 0xcdea7c65
ljmp 0x25ac
xchg edi, eax
je 0x409356
aam 0xc7
in eax, 7
salc
sub ch, byte [0xe4a1a4bc]
sub al, 0x50
pop ss
inc eax
sub al, 0x74
popfd
jb 0x40936f
pop esp
and byte [eax], al
pushal
mov eax, 0xfb755ae4
je 0x4093c3
test byte [esp + esi*2 - 0x75], dh
sti
movsb byte es:[edi], byte [esi]
push ds
add al, 0x75
or dl, byte [ebp + 0x63]
push esi
add eax, 0x74accc74
lcall 0x7674, 0x29a2b529
add ebx, dword [ebp + 0xc]
push ds
add al, 0x7c
pop eax
dec edi
sub dh, byte [eax]
cmp al, 0xd1
and al, 0xb0
shl dword [eax + esi*4], 1
scasd eax, dword es:[edi]
mov edi, 0x13dc60eb
test dh, cl
sub al, 0x70
pop eax
dec ebx
nop dword [esi + 0x62949f04]
stc
dec eax
and al, 0x1c
std
in al, 0xac
and al, 0xb4
add ebp, 0x30
sub byte [esi - 0x323120cc], 0x93
rol byte [edi], 0xf2
imul edx, dword [ebp - 0x75], 0xf467cc5b
loopne 0x4093d0
push ebp
xchg esp, eax
push ds
test eax, 0x5871e5dc
cmpsb byte [esi], byte es:[edi]
mov dl, 0x60
mov ah, 0xb7
mov edx, 0xe0dc1634
add al, 0x1d
loopne 0x409426
jmp dword [ebx]
and esp, dword [esi + 0x6e]
invalid
Function at 0x417e10
Capabilities:
Get disk information

Disassembly:
push ecx
push esi
push 0x4c3074
call dword [sym.imp.KERNEL32.dll_GetDriveTypeA]
mov dword [0x4c6aec], eax
call dword [sym.imp.KERNEL32.dll_GetOEMCP]
mov dword [0x4c6aec], eax
call dword [sym.imp.COMCTL32.dll_InitCommonControls]
call dword [sym.imp.USER32.dll_GetForegroundWindow]
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push 0
mov dword [0x4c74b0], eax
mov dword [esp + 8], 0
call dword [sym.imp.ole32.dll_CoInitialize]
test esi, esi
je 0x417e66
lea eax, [esp + 4]
push eax
push esi
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
push str.MSWHEEL_ROLLMSG
call dword [sym.imp.USER32.dll_RegisterWindowMessageA]
pop esi
mov ecx, dword [esp]
add ecx, eax
mov eax, ecx
pop ecx
ret

Function at 0x4376ee
Capabilities:
Encode data using xor

Disassembly:
sbb bh, byte [eax - 0x77a34032]
jae 0x4376ed
pushfd
sbb bh, byte [eax]
invalid
invalid
inc edx
je 0x437694
mov eax, dword [esi - 0xf]
push ebp
sub eax, 0x76a5e2b4
stc
jno 0x4376c9
invalid

Function at 0x44e5e6
Capabilities:
Encode data using xor

Disassembly:
out 1, eax
mov ch, 0x55
push ds
inc ebp
jae 0x44e624
mov bh, 0x22
mov eax, dword [0xf3904e7d]
popal
and dword [0x110a95d6], esp
sub edx, dword [edx]
stosb byte es:[edi], al
in eax, 0x4a
sub eax, 0x280465e3
fadd dword [edi]
ljmp 0xa748
cmpsd dword [esi], dword es:[edi]
outsd dx, dword [esi]
sbb dword [edx - 0x4894d7bf], esp
and byte [edi + 0x7c97f317], dh
xor al, byte [edi - 0x6a]
jns 0x44e68a
test dword [ebx - 0x5a90a2f4], esp
push cs
adc dword [esi], esp
std
push eax
sbb cl, bh
rol byte [edi + 0x13], 0x47
pop ss
xchg edi, eax
mov esi, 0xa5bf2198
mov word [eax + 0x47], ds
pop ebx
inc esi
mov edi, 0xed0ff739
push esp
push esp
lahf
jp 0x44e69b
cmp eax, 0x855dd5c3
out 0xc6, al
pop ebp
iretd
out dx, eax
arpl cx, sp
clc
loope 0x44e702
clc
push ebp
xor al, 0x11
mov ecx, 0xfdb72bf7
xchg dword [esi], esi
neg byte [ecx + 0x76]
and eax, 0x432551f4
cmpsd dword [esi], dword es:[edi]
xor eax, 0xd099bb71
mov dword [0x266d2f5b], eax
movsb byte es:[edi], byte [esi]
sub dword [ebp + 0x65c78606], eax
movsb byte es:[edi], byte [esi]
jne 0x44e699
adc byte [esi], 0xe3
pop esi
pop ebx
push edx
pop ss
push ebp
pop edx
xchg ecx, eax
jne 0x44e710
ror cl, 0xed
je 0x44e691
dec eax
pop ss
xor esi, dword [eax + 0xeeaa147]
mov dword [eax - 0x523ea243], 0x2b90057f
retf
cmp al, 0x81
mov edx, 0x8b5693e4
ret 0xce84
xchg esi, ecx
push 0xffffffffffffffe9
outsd dx, dword [esi]
test edi, esp
mov dh, 0x19
add ah, ch
cld
xchg edi, eax
out 0xb0, eax
jb 0x44e733
mov dh, 0x47
sbb eax, 0x716dd5c0
aam 0xcb
out dx, al
test eax, 0x4dc59562
pop ds
xor eax, 0x7603a78f
outsd dx, dword [esi]
cmpsd dword [esi], dword es:[edi]
add esi, dword [esi + 0x6f]
inc esi
adc esi, dword [esi]
mov dword [0xb687dfa9], eax
mov edx, 0x6c7507ef
invalid
Function at 0x4bb351
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov edx, dword [ebp + 8]
xor ecx, ecx
mov eax, 0x4c33a8
cmp edx, dword [eax]
je 0x4bb373
add eax, 8
inc ecx
cmp eax, 0x4c3438
jl 0x4bb364
push esi
mov esi, ecx
shl esi, 3
cmp edx, dword [esi + 0x4c33a8]
jne 0x4bb4a1
mov eax, dword [0x4c7d2c]
cmp eax, 1
je 0x4bb47b
test eax, eax
jne 0x4bb3a4
cmp dword [0x4c32d4], 1
je 0x4bb47b
cmp edx, 0xfc
je 0x4bb4a1
lea eax, [ebp - 0x1a4]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x4bb3db
lea eax, [ebp - 0x1a4]
push 0x4c0858
push eax
call fcn.004bbd30
pop ecx
pop ecx
lea eax, [ebp - 0x1a4]
push edi
push eax
lea edi, [ebp - 0x1a4]
call fcn.004bc1c0
inc eax
pop ecx
cmp eax, 0x3c
jbe 0x4bb41e
lea eax, [ebp - 0x1a4]
push eax
call fcn.004bc1c0
mov edi, eax
lea eax, [ebp - 0x1a4]
sub eax, 0x3b
push 3
add edi, eax
push 0x4c0854
push edi
call fcn.004be090
add esp, 0x10
lea eax, [ebp - 0xa0]
push 0x4c0838
push eax
call fcn.004bbd30
lea eax, [ebp - 0xa0]
push edi
push eax
call fcn.004bbd40
lea eax, [ebp - 0xa0]
push 0x4c0834
push eax
call fcn.004bbd40
push dword [esi + 0x4c33ac]
lea eax, [ebp - 0xa0]
push eax
call fcn.004bbd40
push 0x12010
lea eax, [ebp - 0xa0]
push 0x4c080c
push eax
call fcn.004be004
add esp, 0x2c
pop edi
jmp 0x4bb4a1
lea eax, [ebp + 8]
lea esi, [esi + 0x4c33ac]
push 0
push eax
push dword [esi]
call fcn.004bc1c0
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop esi
leave
ret
Function at 0x1002e310
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100b8e11
mov eax, dword fs:[0]
push eax
push ecx
mov eax, dword [0x100d6040]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [edx]
xorps xmm0, xmm0
mov dword [ecx + 0xc], 0
mov dword [ecx + 0x14], 0
mov dword [ecx + 0x30], 0
mov dword [ecx + 0x34], 0
mov dword [ecx + 0x38], 0
mov dword [ecx + 0x3c], 0
mov dword [ecx + 0x40], 0
mov dword [ecx + 0x44], 0
mov dword [ecx + 0x48], 0
mov dword [ecx + 0x4c], 0
mov dword [ecx + 0x50], 0
mov dword [ecx + 0x54], 0
mov dword [ecx + 0x58], 0
mov dword [ecx + 0x5c], 0
mov dword [ecx + 0x60], 0
mov dword [ecx + 0x64], 0
mov dword [ecx + 0x68], 0
mov dword [ecx + 0x70], 0
mov dword [ecx + 0x74], 0
mov dword [ecx + 0x78], 0
mov dword [ecx + 0x7c], 0
mov dword [ecx + 0x80], 0
mov dword [ecx + 0x84], 0
movups xmmword [ecx + 0x90], xmm0
mov dword [ecx + 0xa0], 0
mov dword [ecx + 0xa4], 0xf
mov dword [ebp - 0x10], ecx
mov byte [ecx + 0x90], 0
mov dword [ebp - 4], 0
movups xmmword [ecx + 0xa8], xmm0
mov dword [ecx + 0xb8], 0
mov dword [ecx + 0xbc], 0xf
mov byte [ecx + 0xa8], 0
mov byte [ebp - 4], 1
mov word [ecx + 0xc1], 0
mov byte [ecx + 0xc3], 0
mov dword [ecx + 0xc0], 0
mov dword [ecx + 0x400], 0
mov dword [ecx + 0x404], 0
mov dword [ecx + 0x408], 0
mov dword [ecx + 0x40c], 0
mov dword [ecx + 0x410], 0
mov dword [ecx + 0x414], 0
mov dword [ecx + 0x418], 0
mov dword [ecx + 0x41c], 0
mov byte [ecx + 0x420], 0
push eax
mov byte [ecx + 0x3424], 0
mov dword [ecx + 0x3428], 0
mov dword [ecx + 0x342c], 0
mov dword [ecx + 0x3430], 0
mov dword [ecx + 0x3434], 0
mov dword [ecx + 0x3438], 0
mov dword [ecx + 0x343c], 0
mov byte [ecx + 0x344d], 0
mov byte [ecx + 0x3458], 0
mov byte [ecx + 0x3744], 0
mov dword [ecx + 0x3748], 0
mov dword [ecx + 0x374c], 0
mov dword [ecx + 0x3750], 0
mov dword [ecx + 0x3754], 0
mov dword [ecx + 0x3758], 0
mov dword [ecx + 0x375c], 0
mov byte [ecx + 0x3764], 0
mov dword [ecx + 0x3774], 0
mov byte [ecx + 0x377a], 0
mov dword [ecx + 0x377c], 0
mov dword [ecx + 0x3780], 0
call fcn.100252b0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
Function at 0x1002e8e0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [ebp + 8]
push ebx
push esi
mov dword [ebp - 0x10], eax
mov ebx, ecx
dec eax
push edi
mov edi, edx
mov dword [ebp - 0x14], eax
mov edx, dword [ebp + 0xc]
mov esi, edi
sar eax, 1
mov ecx, edi
mov dword [ebp - 4], edx
mov dword [ebp - 8], esi
mov dword [ebp - 0xc], eax
cmp edi, eax
jge 0x1002e93e
nop dword [eax]
lea esi, [ecx + ecx]
push dword [ebx + esi*4 + 4]
push dword [ebx + esi*4 + 8]
call fcn.10028760
movzx ecx, al
xor ecx, 1
inc ecx
add ecx, esi
mov eax, dword [ebx + ecx*4]
mov dword [ebx + edi*4], eax
mov edi, ecx
mov eax, dword [ebp - 0xc]
cmp ecx, eax
jl 0x1002e910
mov edx, dword [ebp - 4]
mov esi, dword [ebp - 8]
mov edi, ecx
cmp ecx, eax
jne 0x1002e955
mov eax, dword [ebp - 0x10]
test al, 1
jne 0x1002e955
mov eax, dword [ebx + eax*4 - 4]
mov edi, dword [ebp - 0x14]
mov dword [ebx + ecx*4], eax
cmp esi, edi
jge 0x1002e9a0
nop dword [eax]
push dword [edx]
lea esi, [edi - 1]
sar esi, 1
push dword [ebx + esi*4]
call fcn.10028760
test al, al
je 0x1002e991
mov eax, dword [ebx + esi*4]
mov edx, dword [ebp - 4]
mov dword [ebx + edi*4], eax
mov edi, esi
cmp dword [ebp - 8], esi
jl 0x1002e960
mov eax, edx
mov eax, dword [eax]
mov dword [ebx + edi*4], eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 4]
mov eax, dword [eax]
mov dword [ebx + edi*4], eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [edx]
mov dword [ebx + edi*4], eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10035a60
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x100d6040]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, ecx
cmp dword [esi + 0x38], 0
je 0x10035b1c
cmp byte [esi + 0x3d], 0
je 0x10035b1c
mov eax, dword [esi]
push edi
push 0xffffffffffffffff
call dword [eax + 0xc]
cmp eax, 0xffffffff
je 0x10035b0a
mov ecx, dword [esi + 0x38]
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [esi + 0x40]
push eax
call dword [sym.imp.MSVCP140.dll_public:_int___thiscall_std::codecvt_char__char__struct__Mbstatet_::unshift_struct__Mbstatet___char___char___char___const]
sub eax, 0
je 0x10035ad1
sub eax, 1
je 0x10035ad5
sub eax, 2
jne 0x10035b0a
mov byte [esi + 0x3d], al
mov al, 1
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100b63ac
mov esp, ebp
pop ebp
ret
mov byte [esi + 0x3d], 0
mov edi, dword [ebp - 0x28]
lea eax, [ebp - 0x24]
sub edi, eax
je 0x10035af3
push dword [esi + 0x4c]
push edi
push 1
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
add esp, 0x10
cmp edi, eax
jne 0x10035b0a
cmp byte [esi + 0x3d], 0
pop edi
sete al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100b63ac
mov esp, ebp
pop ebp
ret
pop edi
xor al, al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100b63ac
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
mov al, 1
xor ecx, ebp
pop esi
call fcn.100b63ac
mov esp, ebp
pop ebp
ret
Function at 0x100388e0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
cmp byte [0x100efca8], 0
push ebx
push esi
push edi
je 0x10038a6e
mov ecx, dword [0x1023b454]
mov eax, dword [ecx]
mov eax, dword [eax + 0x68]
call eax
test al, al
je 0x10038a6e
mov ecx, dword [0x1023b4dc]
xor ebx, ebx
mov dword [ebp - 4], ecx
mov eax, dword [ecx + 0x28]
mov dword [ebp - 8], eax
test eax, eax
je 0x10038a6e
mov eax, dword [ecx + 0x1c]
mov ecx, dword [eax + ebx*4]
mov eax, dword [ecx]
mov eax, dword [eax + 0x30]
call eax
mov esi, eax
mov edi, 0x811c9dc5
xor ecx, ecx
nop word [eax + eax]
inc ecx
cmp byte [esi + ecx], 0
jne 0x10038940
xor edx, edx
test ecx, ecx
je 0x10038969
nop dword [eax]
movsx eax, byte [esi + edx]
inc edx
xor eax, edi
imul edi, eax, 0x1000193
cmp edx, ecx
jb 0x10038950
cmp edi, 0x5ff56dc5
je 0x10038978
inc ebx
cmp ebx, dword [ebp - 8]
jae 0x10038a6e
mov ecx, dword [ebp - 4]
jmp 0x10038924
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x1c]
mov edi, dword [eax + ebx*4]
test edi, edi
je 0x10038a6e
mov edx, dword [edi + 0x88]
test edx, edx
je 0x10038a6e
movss xmm1, dword [0x100cabc8]
xor ebx, ebx
cmp edx, 4
jl 0x10038a3b
mov ecx, dword [edi + 0x7c]
lea esi, [edx - 4]
shr esi, 2
add ecx, 0x1078
inc esi
lea ebx, [esi*4]
movss xmm0, dword [ecx - 0xc60]
ucomiss xmm0, xmm1
lahf
test ah, 0x44
jp 0x100389dc
mov dword [ecx - 0xc60], 0x7f7fffff
movss xmm0, dword [ecx - 0x840]
ucomiss xmm0, xmm1
lahf
test ah, 0x44
jp 0x100389f7
mov dword [ecx - 0x840], 0x7f7fffff
movss xmm0, dword [ecx - 0x420]
ucomiss xmm0, xmm1
lahf
test ah, 0x44
jp 0x10038a12
mov dword [ecx - 0x420], 0x7f7fffff
movss xmm0, dword [ecx]
ucomiss xmm0, xmm1
lahf
test ah, 0x44
jp 0x10038a25
mov dword [ecx], 0x7f7fffff
add ecx, 0x1080
sub esi, 1
jne 0x100389c1
cmp ebx, edx
jl 0x10038a3f
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
test edx, edx
jle 0x10038a6e
imul ecx, ebx, 0x420
add ecx, 0x418
add ecx, dword [edi + 0x7c]
sub edx, ebx
movss xmm0, dword [ecx]
ucomiss xmm0, xmm1
lahf
test ah, 0x44
jp 0x10038a63
mov dword [ecx], 0x7f7fffff
add ecx, 0x420
sub edx, 1
jne 0x10038a50
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10038e00
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [0x10240938]
sub esp, 0xc
push ebx
push esi
push edi
test al, 1
jne 0x10038e81
or eax, 1
mov dword [0x10240938], eax
mov ebx, dword [0x1023b450]
mov ebx, dword [ebx + 0x30]
test ebx, ebx
je 0x10038e79
nop word [eax + eax]
mov edi, dword [ebx + 0xc]
mov esi, 0x811c9dc5
xor ecx, ecx
nop word [eax + eax]
inc ecx
cmp byte [edi + ecx], 0
jne 0x10038e40
xor edx, edx
test ecx, ecx
je 0x10038e6d
nop dword [eax]
movsx eax, byte [edi + edx]
inc edx
xor eax, esi
imul esi, eax, 0x1000193
cmp edx, ecx
jb 0x10038e50
cmp esi, 0xa9bf35
je 0x10038f03
mov ebx, dword [ebx + 4]
test ebx, ebx
jne 0x10038e30
mov eax, dword [0x10240938]
xor ebx, ebx
mov dword [0x10240924], ebx
test al, 2
jne 0x10038eed
or eax, 2
mov dword [0x10240938], eax
mov ecx, dword [0x1023b450]
mov ebx, dword [ecx + 0x30]
test ebx, ebx
je 0x10038ee5
nop word [eax + eax]
mov edi, dword [ebx + 0xc]
mov esi, 0x811c9dc5
xor ecx, ecx
nop word [eax + eax]
inc ecx
cmp byte [edi + ecx], 0
jne 0x10038eb0
xor edx, edx
test ecx, ecx
je 0x10038ed9
nop dword [eax]
movsx eax, byte [edi + edx]
inc edx
xor eax, esi
imul esi, eax, 0x1000193
cmp edx, ecx
jb 0x10038ec0
cmp esi, 0xe5abc68c
je 0x10038f0d
mov ebx, dword [ebx + 4]
test ebx, ebx
jne 0x10038ea0
mov eax, dword [0x10240938]
xor ebx, ebx
mov dword [0x10240920], ebx
test al, 4
jne 0x10038f58
or eax, 4
mov dword [0x10240938], eax
mov eax, dword [0x1023b450]
mov ebx, dword [eax + 0x30]
jmp 0x10038f4c
mov eax, dword [0x10240938]
jmp 0x10038e7b
mov eax, dword [0x10240938]
jmp 0x10038ee7
mov edi, dword [ebx + 0xc]
mov esi, 0x811c9dc5
xor ecx, ecx
nop
inc ecx
cmp byte [edi + ecx], 0
jne 0x10038f20
xor edx, edx
test ecx, ecx
je 0x10038f49
nop dword [eax]
movsx eax, byte [edi + edx]
inc edx
xor eax, esi
imul esi, eax, 0x1000193
cmp edx, ecx
jb 0x10038f30
cmp esi, 0xadc3dc05
je 0x10038f50
mov ebx, dword [ebx + 4]
test ebx, ebx
jne 0x10038f14
mov dword [0x1024091c], ebx
jmp 0x10038f5e
mov ebx, dword [0x1024091c]
mov eax, dword [ebx]
mov ecx, ebx
mov eax, dword [eax + 0x30]
call eax
mov ecx, dword [0x10240920]
fstp dword [ebp - 8]
mov eax, dword [ecx]
mov eax, dword [eax + 0x30]
mov dword [ebp - 4], eax
call dword [ebp - 4]
mov ecx, dword [0x10240924]
fstp dword [ebp - 0xc]
mov eax, dword [ecx]
mov eax, dword [eax + 0x30]
mov dword [ebp - 4], eax
call dword [ebp - 4]
movss xmm0, dword [ebp - 8]
sub esp, 8
divss xmm0, dword [ebp - 0xc]
fstp dword [ebp - 4]
movss dword [esp + 4], xmm0
movss xmm0, dword [ebp - 4]
movss dword [esp], xmm0
call dword [sym.imp.api_ms_win_crt_math_l1_1_0.dll_fmaxf]
add esp, 8
fstp dword [0x100d9c60]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1003a8a0
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100b9535
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push ebx
push esi
push edi
mov eax, dword [0x100d6040]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
movzx eax, byte [esi]
xor eax, 0x811c9dc5
imul ecx, eax, 0x1000193
movzx eax, byte [esi + 1]
xor ecx, eax
movzx eax, byte [esi + 2]
imul ecx, ecx, 0x1000193
xor ecx, eax
movzx eax, byte [esi + 3]
imul ecx, ecx, 0x1000193
xor ecx, eax
lea eax, [ebp - 0x14]
imul edi, ecx, 0x1000193
push edi
push esi
push eax
call fcn.1003c060
mov eax, dword [ebp - 0x10]
test eax, eax
jne 0x1003a9cb
cmp dword [0x102407e0], 0xfffffff
jne 0x1003a92a
push str.unordered_map_set_too_long
call dword [sym.imp.MSVCP140.dll_void___cdecl_std::_Xlength_error_char_const__]
mov dword [ebp - 0x1c], 0x102407dc
mov dword [ebp - 4], 0
push 0x10
mov dword [ebp - 0x18], 0
call fcn.100b63c8
mov ebx, eax
add esp, 4
mov eax, dword [esi]
mov dword [ebp - 0x18], ebx
mov dword [ebx + 8], eax
mov dword [ebx + 0xc], 0
mov dword [ebp - 4], 1
mov eax, dword [0x102407e0]
inc eax
movd xmm0, eax
cvtdq2pd xmm0, xmm0
shr eax, 0x1f
addsd xmm0, qword [eax*8 + 0x100cae80]
mov eax, dword [0x102407f4]
cvtpd2ps xmm1, xmm0
movd xmm0, eax
cvtdq2pd xmm0, xmm0
shr eax, 0x1f
addsd xmm0, qword [eax*8 + 0x100cae80]
cvtpd2ps xmm0, xmm0
divss xmm1, xmm0
comiss xmm1, dword [0x102407d8]
jbe 0x1003a9c0
call fcn.1003baf0
push edi
lea eax, [ebx + 8]
push eax
lea eax, [ebp - 0x1c]
push eax
call fcn.1003c060
mov ecx, dword [eax]
jmp 0x1003a9c3
mov ecx, dword [ebp - 0x14]
push ebx
push ecx
push edi
call fcn.1003bb70
add eax, 0xc
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x1003acb0
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
sub esp, 0x18
mov edx, dword [ebp + 8]
push ebx
mov ebx, ecx
cmp edx, eax
je 0x1003ae06
mov eax, dword [ebx + 4]
mov dword [ebp - 0x14], eax
mov eax, dword [edx + 4]
mov dword [ebp - 8], eax
movzx eax, byte [edx + 8]
xor eax, 0x811c9dc5
imul ecx, eax, 0x1000193
movzx eax, byte [edx + 9]
push esi
push edi
mov edi, dword [ebx + 0xc]
mov esi, edx
xor ecx, eax
mov dword [ebp - 0x18], edi
movzx eax, byte [edx + 0xa]
imul ecx, ecx, 0x1000193
xor ecx, eax
movzx eax, byte [edx + 0xb]
imul ecx, ecx, 0x1000193
xor ecx, eax
mov eax, dword [ebx + 0x18]
imul ecx, ecx, 0x1000193
and eax, ecx
mov ecx, dword [edi + eax*8]
mov dword [ebp - 4], ecx
lea eax, [edi + eax*8]
mov dword [ebp - 0xc], eax
mov eax, dword [eax + 4]
mov dword [ebp - 0x10], eax
mov eax, esi
mov edi, esi
mov esi, dword [esi]
push 0x10
push eax
call fcn.100b68da
dec dword [ebx + 8]
add esp, 8
cmp edi, dword [ebp - 0x10]
je 0x1003ad69
mov eax, dword [ebp + 0xc]
cmp esi, eax
jne 0x1003ad27
mov ecx, dword [ebp - 4]
cmp ecx, dword [ebp + 8]
jne 0x1003adfc
mov edx, dword [ebp - 0xc]
mov ecx, dword [ebp - 8]
pop edi
mov dword [edx], esi
mov dword [ecx], esi
mov dword [esi + 4], ecx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
mov ecx, dword [ebp - 4]
mov edx, dword [ebp - 0xc]
cmp ecx, dword [ebp + 8]
jne 0x1003ad7d
mov eax, dword [ebp - 0x14]
mov ecx, eax
mov dword [edx], eax
jmp 0x1003ad80
mov ecx, dword [ebp - 8]
mov eax, dword [ebp + 0xc]
mov dword [edx + 4], ecx
cmp esi, eax
je 0x1003adfc
nop word [eax + eax]
movzx eax, byte [esi + 8]
xor eax, 0x811c9dc5
imul ecx, eax, 0x1000193
movzx eax, byte [esi + 9]
xor ecx, eax
movzx eax, byte [esi + 0xa]
imul ecx, ecx, 0x1000193
xor ecx, eax
movzx eax, byte [esi + 0xb]
imul ecx, ecx, 0x1000193
xor ecx, eax
mov eax, dword [ebx + 0x18]
imul ecx, ecx, 0x1000193
and eax, ecx
mov ecx, dword [ebp - 0x18]
lea eax, [ecx + eax*8]
mov dword [ebp - 4], eax
mov eax, dword [eax + 4]
mov dword [ebp - 0x10], eax
mov eax, esi
mov edi, esi
mov esi, dword [esi]
push 0x10
push eax
call fcn.100b68da
dec dword [ebx + 8]
add esp, 8
mov eax, dword [ebp + 0xc]
cmp edi, dword [ebp - 0x10]
je 0x1003ae0d
cmp esi, eax
jne 0x1003add7
mov ecx, dword [ebp - 4]
mov dword [ecx], esi
mov ecx, dword [ebp - 8]
pop edi
mov dword [ecx], esi
mov dword [esi + 4], ecx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
mov ecx, dword [ebp - 4]
mov edx, dword [ebp - 0x14]
mov dword [ecx], edx
mov dword [ecx + 4], edx
cmp esi, eax
jne 0x1003ad90
mov ecx, dword [ebp - 8]
pop edi
mov dword [ecx], esi
mov dword [esi + 4], ecx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x1003bdc0
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1fffffff
sub esp, 0x10
bsr ecx, eax
push ebx
push esi
push edi
mov edi, 1
mov eax, edi
shl eax, cl
mov ecx, dword [ebp + 8]
cmp ecx, eax
jbe 0x1003bdec
push str.invalid_hash_bucket_count
call dword [sym.imp.MSVCP140.dll_void___cdecl_std::_Xlength_error_char_const__]
lea eax, [ecx - 1]
mov esi, dword [0x102407dc]
or eax, 1
mov dword [ebp - 8], esi
bsr ecx, eax
push esi
lea ecx, [ecx + 1]
shl edi, cl
mov ecx, 0x102407e4
lea eax, [edi + edi]
push eax
call fcn.1002c3c0
mov eax, dword [0x102407dc]
lea ebx, [edi - 1]
mov dword [0x102407f0], ebx
mov dword [0x102407f4], edi
mov eax, dword [eax]
mov ecx, eax
cmp eax, esi
je 0x1003bf26
movzx edx, byte [eax + 8]
xor edx, 0x811c9dc5
mov ecx, dword [ecx]
imul edi, edx, 0x1000193
movzx edx, byte [eax + 9]
xor edi, edx
movzx edx, byte [eax + 0xa]
imul edi, edi, 0x1000193
xor edi, edx
movzx edx, byte [eax + 0xb]
imul edi, edi, 0x1000193
xor edi, edx
mov edx, dword [0x102407e4]
imul edi, edi, 0x1000193
and edi, ebx
mov ebx, dword [edx + edi*8]
lea edx, [edx + edi*8]
mov dword [ebp - 0xc], edx
cmp ebx, esi
jne 0x1003be84
mov dword [edx], eax
mov dword [edx + 4], eax
jmp 0x1003bef1
mov edx, dword [edx + 4]
mov edi, dword [eax + 8]
cmp edi, dword [edx + 8]
jne 0x1003bebe
mov edx, dword [edx]
mov dword [ebp - 4], edx
cmp edx, eax
je 0x1003beb6
mov ebx, dword [eax + 4]
mov esi, dword [ebp - 4]
mov dword [ebx], ecx
mov edi, dword [ecx + 4]
mov dword [edi], edx
mov edx, dword [edx + 4]
mov dword [edx], eax
mov dword [esi + 4], edi
mov esi, dword [ebp - 8]
mov dword [ecx + 4], ebx
mov dword [eax + 4], edx
mov edx, dword [ebp - 0xc]
mov dword [edx + 4], eax
jmp 0x1003bef1
cmp ebx, edx
je 0x1003bece
mov edx, dword [edx + 4]
cmp edi, dword [edx + 8]
je 0x1003bf02
cmp ebx, edx
jne 0x1003bec2
mov ebx, dword [eax + 4]
mov dword [ebp - 4], ebx
mov dword [ebx], ecx
mov ebx, dword [ecx + 4]
mov dword [ebx], edx
mov edi, dword [edx + 4]
mov dword [edi], eax
mov dword [edx + 4], ebx
mov edx, dword [ebp - 4]
mov dword [ecx + 4], edx
mov edx, dword [ebp - 0xc]
mov dword [eax + 4], edi
mov dword [edx], eax
mov eax, ecx
cmp ecx, esi
je 0x1003bf26
mov ebx, dword [0x102407f0]
jmp 0x1003be32
mov ebx, dword [eax + 4]
mov edx, dword [edx]
mov dword [ebp - 4], edx
mov esi, edx
mov dword [ebx], ecx
mov edi, dword [ecx + 4]
mov dword [edi], edx
mov edx, dword [edx + 4]
mov dword [edx], eax
mov dword [esi + 4], edi
mov esi, dword [ebp - 8]
mov dword [ecx + 4], ebx
mov dword [eax + 4], edx
jmp 0x1003bef1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4