joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10023c50
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100cf73b
mov eax, dword fs:[0]
push eax
push ebx
sub esp, 0x3c
push esi
mov eax, dword [0x100e8040]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov eax, dword [0x100f8fb0]
test al, 1
jne 0x10023d9b
or eax, 1
mov dword [0x100f8fb0], eax
mov dword [ebp - 4], 0
mov eax, 0x10
vmovdqa xmm0, xmmword [str._n_n_n_n_n_n_n_n_n_n_n_n_n_n_n_nheghcgox_8N_nheghxcgox_9N_nellyixoodUgeno__nzfksoxUmcodUi__noxcmeHf]
vpxor xmm0, xmm0, xmmword [0x100dd060]
mov dword [ebp - 0x20], 0x2a352a35
mov dword [ebp - 0x1c], 0x4c2a4832
mov word [ebp - 0x18], 0xa3b
vmovdqu xmmword [ebp - 0x30], xmm0
xor byte [ebp + eax - 0x30], 0xa
inc eax
cmp eax, 0x1a
jb 0x10023cd6
vpxor xmm0, xmm0, xmm0
lea ecx, [ebp - 0x30]
mov dword [ebp - 0x38], 0
vmovdqu xmmword [ebp - 0x48], xmm0
mov dword [ebp - 0x34], 0
lea edx, [ecx + 1]
nop
mov al, byte [ecx]
inc ecx
test al, al
jne 0x10023d00
sub ecx, edx
lea eax, [ebp - 0x30]
push ecx
push eax
lea ecx, [ebp - 0x48]
call fcn.1002a290
mov byte [ebp - 4], 1
mov edx, dword [0x1010e72c]
test edx, edx
je 0x10023d29
mov edx, dword [edx + 0x50]
jmp 0x10023d2b
xor edx, edx
mov eax, dword [0x1010e724]
test eax, eax
je 0x10023d39
mov eax, dword [eax + 0x18]
jmp 0x10023d3b
xor eax, eax
lea ecx, [ebp - 0x48]
push ecx
push eax
lea ecx, [ebp - 0x14]
call fcn.10023740
mov eax, dword [ebp - 0x14]
add esp, 8
mov byte [ebp - 4], 0
mov ecx, dword [ebp - 0x34]
mov dword [0x100f8fb4], eax
cmp ecx, 0xf
jbe 0x10023d92
mov edx, dword [ebp - 0x48]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x10023d83
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x10023d83
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push ecx
push edx
call fcn.100cd567
mov eax, dword [0x100f8fb4]
add esp, 8
mov dword [ebp - 4], 0xffffffff
jmp 0x10023da0
mov eax, dword [0x100f8fb4]
test eax, eax
je 0x10023da8
mov ecx, esi
call eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret
Function at 0x10028960
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
mov ecx, dword [0x100e847c]
push esi
mov al, byte [ecx + 0x30]
and al, 1
cmp dword [0x100e8428], 0x40
jne 0x10028986
test dword [ecx + 0x30], 0x800
je 0x10028986
mov cl, 1
jmp 0x10028988
xor cl, cl
test al, al
jne 0x10028994
test cl, cl
je 0x10028b1a
mov eax, dword [0x100e8454]
mov byte [eax], 0
cmp dword [0x1010cd20], 0
je 0x10028a47
mov eax, dword [0x1010cd44]
test eax, eax
je 0x100289e6
cmp byte [eax + 0x3cc], 0
jne 0x100289e6
vmovss xmm0, dword [eax + 0x18]
mov eax, dword [0x1010e7c4]
vaddss xmm0, xmm0, dword [0x100e8460]
vdivss xmm0, xmm0, dword [eax + 0x20]
mov eax, dword [0x100e847c]
vaddss xmm0, xmm0, dword [0x100dcc00]
vcvttss2si ecx, xmm0
mov dword [eax + 8], ecx
mov eax, dword [0x100e847c]
vmovss xmm0, dword [0x1010cd24]
vmovss dword [eax + 0xc], xmm0
vmovss xmm0, dword [0x1010cd28]
vmovss dword [eax + 0x10], xmm0
vmovss xmm0, dword [0x1010cd2c]
vmovss dword [eax + 0x14], xmm0
cmp byte [0x100e86cc], 0
jne 0x10028a2d
mov ecx, dword [0x1010e768]
push 0x1010cd24
mov eax, dword [ecx]
mov eax, dword [eax + 0x4c]
call eax
cmp byte [0x100e90c8], 0
je 0x10028a47
push dword [0x100db798]
push dword [0x1010cd44]
call fcn.100ca090
cmp byte [0x100e91f0], 0
je 0x10028a5e
cmp dword [0x100f7894], 1
jne 0x10028a5e
call fcn.10028e10
cmp byte [0x100e9278], 0
je 0x10028ad1
mov ecx, dword [0x1010e850]
mov esi, dword [0x1010e9f8]
add esi, 0xffffffad
xor esi, 0xd81b7577
mov eax, dword [ecx]
add esi, dword [0x100e80a0]
mov eax, dword [eax + 0x30]
mov dword [ebp - 4], eax
call dword [ebp - 4]
mov eax, dword [0x100e847c]
vmovss xmm0, dword [esi]
vmovss xmm2, dword [esi + 4]
vmovss xmm3, dword [esi + 8]
fstp dword [ebp - 4]
vmovss xmm4, dword [ebp - 4]
vmovaps xmm1, xmm4
vfnmadd213ss xmm1, xmm0, dword [eax + 0xc]
vmovaps xmm0, xmm4
vfnmadd213ss xmm0, xmm2, dword [eax + 0x10]
vfnmadd213ss xmm4, xmm3, dword [eax + 0x14]
vmovss dword [eax + 0xc], xmm1
vmovss dword [eax + 0x10], xmm0
vmovss dword [eax + 0x14], xmm4
mov eax, dword [0x100e842c]
mov ecx, dword [0x1010cd20]
vcvttss2si esi, dword [0x1010cd40]
mov eax, dword [eax + 0xf4]
test ecx, ecx
je 0x10028afe
mov edx, dword [0x1010cd44]
vmovss xmm2, dword [0x1010cd3c]
jmp 0x10028b0a
vmovss xmm2, dword [0x100dce48]
xor edx, edx
xor ecx, ecx
push esi
push edx
push eax
push ecx
call fcn.100b06e0
mov byte [0x100e80b9], 1
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x10030a00
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x100e8040]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, ecx
cmp dword [esi + 0x38], 0
je 0x10030abc
cmp byte [esi + 0x3d], 0
je 0x10030abc
mov eax, dword [esi]
push edi
push 0xffffffffffffffff
call dword [eax + 0xc]
cmp eax, 0xffffffff
je 0x10030aaa
mov ecx, dword [esi + 0x38]
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [esi + 0x40]
push eax
call dword [sym.imp.MSVCP140.dll_public:_int___thiscall_std::codecvt_char__char__struct__Mbstatet_::unshift_struct__Mbstatet___char___char___char___const]
sub eax, 0
je 0x10030a71
sub eax, 1
je 0x10030a75
sub eax, 2
jne 0x10030aaa
mov byte [esi + 0x3d], al
mov al, 1
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100cd0ec
mov esp, ebp
pop ebp
ret
mov byte [esi + 0x3d], 0
mov edi, dword [ebp - 0x28]
lea eax, [ebp - 0x24]
sub edi, eax
je 0x10030a93
push dword [esi + 0x4c]
push edi
push 1
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
add esp, 0x10
cmp edi, eax
jne 0x10030aaa
cmp byte [esi + 0x3d], 0
pop edi
sete al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100cd0ec
mov esp, ebp
pop ebp
ret
pop edi
xor al, al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100cd0ec
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
mov al, 1
xor ecx, ebp
pop esi
call fcn.100cd0ec
mov esp, ebp
pop ebp
ret
Function at 0x10032f00
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100cffb6
mov eax, dword fs:[0]
push eax
push ebx
sub esp, 0x48
mov eax, dword [0x100e8040]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 4], 0
mov eax, dword [0x10114628]
test al, 1
jne 0x10033043
or eax, 1
mov dword [0x10114628], eax
mov byte [ebp - 4], 1
mov eax, 0x10
vmovdqa xmm0, xmmword [str._n_n_n_n_n_n_n_n_n_n_n_n_n_n_n_nheghcgox_8N_nheghxcgox_9N_nellyixoodUgeno__nzfksoxUmcodUi__noxcmeHf]
vpxor xmm0, xmm0, xmmword [0x100dd0f0]
mov dword [ebp - 0x44], 0x334c2a48
mov dword [ebp - 0x40], 0x2a4c4c2a
mov word [ebp - 0x3c], 0x3f3b
mov byte [ebp - 0x3a], 0xa
vmovdqu xmmword [ebp - 0x54], xmm0
nop dword [eax + eax]
xor byte [ebp + eax - 0x54], 0xa
inc eax
cmp eax, 0x1b
jb 0x10032f90
vpxor xmm0, xmm0, xmm0
lea ecx, [ebp - 0x54]
mov dword [ebp - 0x28], 0
vmovdqu xmmword [ebp - 0x38], xmm0
mov dword [ebp - 0x24], 0
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x10032fb8
sub ecx, edx
lea eax, [ebp - 0x54]
push ecx
push eax
lea ecx, [ebp - 0x38]
call fcn.1002a290
mov byte [ebp - 4], 2
mov edx, dword [0x1010e738]
test edx, edx
je 0x10032fe1
mov edx, dword [edx + 0x50]
jmp 0x10032fe3
xor edx, edx
mov eax, dword [0x1010e730]
test eax, eax
je 0x10032ff1
mov eax, dword [eax + 0x18]
jmp 0x10032ff3
xor eax, eax
lea ecx, [ebp - 0x38]
push ecx
push eax
lea ecx, [ebp - 0x14]
call fcn.10023740
mov eax, dword [ebp - 0x14]
add esp, 8
mov byte [ebp - 4], 1
mov ecx, dword [ebp - 0x24]
mov dword [0x10114604], eax
cmp ecx, 0xf
jbe 0x1003303f
mov edx, dword [ebp - 0x38]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x10033035
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x10033091
push ecx
push edx
call fcn.100cd567
add esp, 8
mov byte [ebp - 4], 0
cmp dword [ebx + 0x1c], 0xf
lea ecx, [ebx + 8]
lea edx, [ebp - 0x20]
mov dword [ebp - 0x20], 0x78657365
cmova ecx, dword [ebx + 8]
mov dword [ebp - 0x1c], 0x756c632e
mov word [ebp - 0x18], 0x62
call dword [0x10114604]
mov ecx, dword [ebx + 0x1c]
cmp ecx, 0xf
jbe 0x100330a1
mov edx, dword [ebx + 8]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x10033097
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x10033097
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push ecx
push edx
call fcn.100cd567
add esp, 8
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret 0x18
Function at 0x10033500
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
cmp byte [0x100f7254], 0
push ebx
push esi
push edi
je 0x1003369d
mov ecx, dword [0x1010e768]
mov eax, dword [ecx]
mov eax, dword [eax + 0x68]
call eax
test al, al
je 0x1003369d
mov ecx, dword [0x1010e7ec]
xor ebx, ebx
mov dword [ebp - 4], ecx
mov eax, dword [ecx + 0x28]
mov dword [ebp - 8], eax
test eax, eax
je 0x1003369d
mov eax, dword [ecx + 0x1c]
mov ecx, dword [eax + ebx*4]
mov eax, dword [ecx]
mov eax, dword [eax + 0x30]
call eax
mov esi, eax
mov edi, 0x811c9dc5
xor ecx, ecx
nop word [eax + eax]
inc ecx
cmp byte [esi + ecx], 0
jne 0x10033560
xor edx, edx
test ecx, ecx
je 0x10033589
nop dword [eax]
movsx eax, byte [esi + edx]
inc edx
xor eax, edi
imul edi, eax, 0x1000193
cmp edx, ecx
jb 0x10033570
cmp edi, 0x5ff56dc5
je 0x10033598
inc ebx
cmp ebx, dword [ebp - 8]
jae 0x1003369d
mov ecx, dword [ebp - 4]
jmp 0x10033544
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x1c]
mov edi, dword [eax + ebx*4]
test edi, edi
je 0x1003369d
mov edx, dword [edi + 0x88]
test edx, edx
je 0x1003369d
vmovss xmm2, dword [0x100dcc68]
vmovss xmm1, dword [0x100dce24]
xor ebx, ebx
cmp edx, 4
jl 0x10033666
mov ecx, dword [edi + 0x7c]
lea esi, [edx - 4]
shr esi, 2
add ecx, 0x1078
inc esi
lea ebx, [esi*4]
nop dword [eax]
vmovss xmm0, dword [ecx - 0xc60]
vucomiss xmm0, xmm2
lahf
test ah, 0x44
jp 0x1003360a
vmovss dword [ecx - 0xc60], xmm1
vmovss xmm0, dword [ecx - 0x840]
vucomiss xmm0, xmm2
lahf
test ah, 0x44
jp 0x10033624
vmovss dword [ecx - 0x840], xmm1
vmovss xmm0, dword [ecx - 0x420]
vucomiss xmm0, xmm2
lahf
test ah, 0x44
jp 0x1003363e
vmovss dword [ecx - 0x420], xmm1
vmovss xmm0, dword [ecx]
vucomiss xmm0, xmm2
lahf
test ah, 0x44
jp 0x10033650
vmovss dword [ecx], xmm1
add ecx, 0x1080
sub esi, 1
jne 0x100335f0
cmp ebx, edx
jl 0x1003366a
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
test edx, edx
jle 0x1003369d
imul ecx, ebx, 0x420
add ecx, 0x418
add ecx, dword [edi + 0x7c]
sub edx, ebx
nop dword [eax + eax]
vmovss xmm0, dword [ecx]
vucomiss xmm0, xmm2
lahf
test ah, 0x44
jp 0x10033692
vmovss dword [ecx], xmm1
add ecx, 0x420
sub edx, 1
jne 0x10033680
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1003513a
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100d0058
mov eax, dword fs:[0]
push eax
push ebx
sub esp, 0x2c
mov eax, dword [0x100e8040]
xor eax, ebp
mov dword [ebp - 0x14], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 4], 0
vpxor xmm0, xmm0, xmm0
vmovdqu xmmword [ebp - 0x2c], xmm0
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x18], 0xf
mov byte [ebp - 0x2c], 0
mov byte [ebp - 4], 1
cmp dword [ebx + 0x1c], 0
je 0x10035239
cmp dword [ebx + 0x20], 0xf
lea ecx, [ebx + 0x24]
lea eax, [ebx + 0xc]
cmova eax, dword [ebx + 0xc]
xor edx, edx
push ecx
push eax
xor ecx, ecx
call fcn.10032320
mov ecx, dword [ebp - 0x1c]
mov esi, eax
add esp, 8
cmp esi, ecx
ja 0x10035176
cmp dword [ebp - 0x18], 0xf
lea ecx, [ebp - 0x2c]
mov dword [ebp - 0x1c], esi
cmova ecx, dword [ebp - 0x2c]
mov byte [ecx + esi], 0
jmp 0x10035183
sub eax, ecx
lea ecx, [ebp - 0x2c]
push 0
push eax
call fcn.10035810
cmp dword [ebx + 0x20], 0xf
lea eax, [ebx + 0xc]
lea edx, [ebx + 0x24]
cmova eax, dword [ebx + 0xc]
lea ecx, [ebp - 0x2c]
cmp dword [ebp - 0x18], 0xf
push edx
cmova ecx, dword [ebp - 0x2c]
lea edx, [esi + 1]
push eax
call fcn.10032320
add esp, 8
mov dword [ebp - 0x3c], 0x6f796f51
mov dword [ebp - 0x38], 0x66692472
xor eax, eax
mov dword [ebp - 0x34], 0x2a57687f
mov byte [ebp - 0x30], 0xa
xor byte [ebp + eax - 0x3c], 0xa
inc eax
cmp eax, 0xd
jb 0x100351c4
mov eax, dword [0x1010e764]
lea edx, [ebp - 0x3c]
push edx
push 0x1010eb94
push eax
mov ecx, dword [eax]
mov eax, dword [ecx + 0x64]
call eax
mov eax, dword [0x1010e764]
lea edx, [ebp - 0x2c]
add esp, 0xc
cmp dword [ebp - 0x18], 0xf
cmova edx, dword [ebp - 0x2c]
mov ecx, dword [eax]
push edx
push 0x100e809c
push eax
mov eax, dword [ecx + 0x64]
call eax
mov ecx, dword [ebp - 0x18]
add esp, 0xc
cmp ecx, 0xf
jbe 0x10035239
mov edx, dword [ebp - 0x2c]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x1003522f
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x10035271
push ecx
push edx
call fcn.100cd567
add esp, 8
mov ecx, dword [ebx + 0x20]
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x18], 0xf
mov byte [ebp - 0x2c], 0
cmp ecx, 0xf
jbe 0x10035281
mov edx, dword [ebx + 0xc]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x10035277
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x10035277
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push ecx
push edx
call fcn.100cd567
add esp, 8
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.100cd0ec
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret
Function at 0x100352c0
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100d0095
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push ebx
push esi
push edi
mov eax, dword [0x100e8040]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
movzx eax, byte [esi]
xor eax, 0x811c9dc5
imul ecx, eax, 0x1000193
movzx eax, byte [esi + 1]
xor ecx, eax
movzx eax, byte [esi + 2]
imul ecx, ecx, 0x1000193
xor ecx, eax
movzx eax, byte [esi + 3]
imul ecx, ecx, 0x1000193
xor ecx, eax
lea eax, [ebp - 0x18]
imul edi, ecx, 0x1000193
push edi
push esi
push eax
call fcn.10036b30
mov eax, dword [ebp - 0x14]
test eax, eax
jne 0x10035442
cmp dword [0x101144d0], 0xfffffff
jne 0x1003534a
push str.unordered_map_set_too_long
call dword [sym.imp.MSVCP140.dll_void___cdecl_std::_Xlength_error_char_const__]
mov dword [ebp - 0x20], 0x101144cc
mov dword [ebp - 4], 0
push 0x10
mov dword [ebp - 0x1c], 0
call fcn.100cd108
mov ebx, eax
add esp, 4
mov eax, dword [esi]
mov dword [ebp - 0x1c], ebx
mov dword [ebx + 8], eax
mov dword [ebx + 0xc], 0
mov dword [ebp - 4], 1
mov eax, dword [0x101144d0]
mov esi, dword [0x101144e4]
inc eax
vmovss xmm1, dword [0x101144c8]
vxorps xmm0, xmm0, xmm0
vcvtsi2sd xmm0, xmm0, eax
shr eax, 0x1f
vaddsd xmm0, xmm0, qword [eax*8 + 0x100dd2c0]
vcvtsd2ss xmm2, xmm0, xmm0
vxorps xmm0, xmm0, xmm0
mov eax, esi
shr eax, 0x1f
vcvtsi2sd xmm0, xmm0, esi
vaddsd xmm0, xmm0, qword [eax*8 + 0x100dd2c0]
vcvtsd2ss xmm0, xmm0, xmm0
vdivss xmm0, xmm2, xmm0
vcomiss xmm0, xmm1
jbe 0x10035437
vdivss xmm0, xmm2, xmm1
vmovss dword [ebp - 0x14], xmm0
fld dword [ebp - 0x14]
fstp qword [ebp - 0x18]
vxorpd xmm0, xmm0, xmm0
vroundsd xmm0, xmm0, qword [ebp - 0x18], 2
vmovsd qword [ebp - 0x18], xmm0
fld qword [ebp - 0x18]
fstp dword [ebp - 0x14]
vmovss xmm0, dword [ebp - 0x14]
call fcn.100ce510
mov ecx, 8
cmp eax, ecx
cmova ecx, eax
cmp esi, ecx
jae 0x1003541f
cmp esi, 0x200
jae 0x1003541d
shl esi, 3
cmp esi, ecx
jae 0x1003541f
mov esi, ecx
push esi
call fcn.10036810
push edi
lea eax, [ebx + 8]
push eax
lea eax, [ebp - 0x20]
push eax
call fcn.10036b30
mov ecx, dword [eax]
jmp 0x1003543a
mov ecx, dword [ebp - 0x18]
push ebx
push ecx
push edi
call fcn.10036770
add eax, 0xc
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x10035680
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
sub esp, 0x18
mov edx, dword [ebp + 8]
push ebx
mov ebx, ecx
cmp edx, eax
je 0x100357d6
mov eax, dword [ebx + 4]
mov dword [ebp - 0x14], eax
mov eax, dword [edx + 4]
mov dword [ebp - 8], eax
movzx eax, byte [edx + 8]
xor eax, 0x811c9dc5
imul ecx, eax, 0x1000193
movzx eax, byte [edx + 9]
push esi
push edi
mov edi, dword [ebx + 0xc]
mov esi, edx
xor ecx, eax
mov dword [ebp - 0x18], edi
movzx eax, byte [edx + 0xa]
imul ecx, ecx, 0x1000193
xor ecx, eax
movzx eax, byte [edx + 0xb]
imul ecx, ecx, 0x1000193
xor ecx, eax
mov eax, dword [ebx + 0x18]
imul ecx, ecx, 0x1000193
and eax, ecx
mov ecx, dword [edi + eax*8]
mov dword [ebp - 4], ecx
lea eax, [edi + eax*8]
mov dword [ebp - 0xc], eax
mov eax, dword [eax + 4]
mov dword [ebp - 0x10], eax
mov eax, esi
mov edi, esi
mov esi, dword [esi]
push 0x10
push eax
call fcn.100cd567
dec dword [ebx + 8]
add esp, 8
cmp edi, dword [ebp - 0x10]
je 0x10035739
mov eax, dword [ebp + 0xc]
cmp esi, eax
jne 0x100356f7
mov ecx, dword [ebp - 4]
cmp ecx, dword [ebp + 8]
jne 0x100357cc
mov edx, dword [ebp - 0xc]
mov ecx, dword [ebp - 8]
pop edi
mov dword [edx], esi
mov dword [ecx], esi
mov dword [esi + 4], ecx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
mov ecx, dword [ebp - 4]
mov edx, dword [ebp - 0xc]
cmp ecx, dword [ebp + 8]
jne 0x1003574d
mov eax, dword [ebp - 0x14]
mov ecx, eax
mov dword [edx], eax
jmp 0x10035750
mov ecx, dword [ebp - 8]
mov eax, dword [ebp + 0xc]
mov dword [edx + 4], ecx
cmp esi, eax
je 0x100357cc
nop word [eax + eax]
movzx eax, byte [esi + 8]
xor eax, 0x811c9dc5
imul ecx, eax, 0x1000193
movzx eax, byte [esi + 9]
xor ecx, eax
movzx eax, byte [esi + 0xa]
imul ecx, ecx, 0x1000193
xor ecx, eax
movzx eax, byte [esi + 0xb]
imul ecx, ecx, 0x1000193
xor ecx, eax
mov eax, dword [ebx + 0x18]
imul ecx, ecx, 0x1000193
and eax, ecx
mov ecx, dword [ebp - 0x18]
lea eax, [ecx + eax*8]
mov dword [ebp - 4], eax
mov eax, dword [eax + 4]
mov dword [ebp - 0x10], eax
mov eax, esi
mov edi, esi
mov esi, dword [esi]
push 0x10
push eax
call fcn.100cd567
dec dword [ebx + 8]
add esp, 8
mov eax, dword [ebp + 0xc]
cmp edi, dword [ebp - 0x10]
je 0x100357dd
cmp esi, eax
jne 0x100357a7
mov ecx, dword [ebp - 4]
mov dword [ecx], esi
mov ecx, dword [ebp - 8]
pop edi
mov dword [ecx], esi
mov dword [esi + 4], ecx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
mov ecx, dword [ebp - 4]
mov edx, dword [ebp - 0x14]
mov dword [ecx], edx
mov dword [ecx + 4], edx
cmp esi, eax
jne 0x10035760
mov ecx, dword [ebp - 8]
pop edi
mov dword [ecx], esi
mov dword [esi + 4], ecx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x100430f0
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [0x100e8040]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword fs:[0x30]
push esi
push edi
mov edi, ecx
test ebx, ebx
jne 0x10043123
xor al, al
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100cd0ec
mov esp, ebp
pop ebp
ret
mov ebx, dword [ebx + 0xc]
add ebx, 0x14
mov esi, dword [ebx]
cmp esi, ebx
je 0x10043190
mov ecx, 0x5a4d
lea edx, [esi - 8]
test edx, edx
je 0x1004318a
mov eax, dword [edx + 0x18]
test eax, eax
je 0x1004318a
cmp word [eax], cx
jne 0x1004318a
mov ecx, dword [eax + 0x3c]
add ecx, eax
je 0x10043185
cmp dword [ecx], 0x4550
jne 0x10043185
mov dword [ebp - 0xc], eax
mov eax, dword [edi + 4]
mov dword [ebp - 0x10], edx
mov dword [ebp - 8], ecx
cmp eax, dword [edi + 8]
je 0x10043179
vmovq xmm0, qword [ebp - 0x10]
vmovq qword [eax], xmm0
mov dword [eax + 8], ecx
add dword [edi + 4], 0xc
jmp 0x10043185
lea ecx, [ebp - 0x10]
push ecx
push eax
mov ecx, edi
call fcn.1002a970
mov ecx, 0x5a4d
mov esi, dword [esi]
cmp esi, ebx
jne 0x10043134
mov eax, dword [edi]
cmp eax, dword [edi + 4]
mov ecx, dword [ebp - 4]
pop edi
setne al
xor ecx, ebp
pop esi
pop ebx
call fcn.100cd0ec
mov esp, ebp
pop ebp
ret
Function at 0x100442a0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, dword [ebp + 8]
mov eax, edx
push edi
mov dword [ebp - 4], eax
mov ebx, ecx
cmp dword [esi + 0x14], 0xf
mov edi, dword [esi + 0x10]
jbe 0x100442bc
mov esi, dword [esi]
xor ecx, ecx
mov edx, 0x811c9dc5
test edi, edi
je 0x100442db
movzx eax, byte [esi + ecx]
inc ecx
xor eax, edx
imul edx, eax, 0x1000193
cmp ecx, edi
jb 0x100442c7
mov eax, dword [ebp - 4]
push edx
mov edx, eax
mov ecx, ebx
call fcn.10043b20
add esp, 4
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1004a0d0
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100d1995
mov eax, dword fs:[0]
push eax
sub esp, 0x18
push ebx
push esi
push edi
mov eax, dword [0x100e8040]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
movzx eax, byte [esi]
xor eax, 0x811c9dc5
imul ecx, eax, 0x1000193
movzx eax, byte [esi + 1]
xor ecx, eax
movzx eax, byte [esi + 2]
imul ecx, ecx, 0x1000193
xor ecx, eax
movzx eax, byte [esi + 3]
imul ecx, ecx, 0x1000193
xor ecx, eax
lea eax, [ebp - 0x1c]
imul edi, ecx, 0x1000193
push edi
push esi
push eax
call fcn.10036b30
mov eax, dword [ebp - 0x18]
test eax, eax
jne 0x1004a252
cmp dword [0x101144d0], 0xfffffff
jne 0x1004a15a
push str.unordered_map_set_too_long
call dword [sym.imp.MSVCP140.dll_void___cdecl_std::_Xlength_error_char_const__]
mov dword [ebp - 0x24], 0x101144cc
mov dword [ebp - 4], 0
push 0x10
mov dword [ebp - 0x20], 0
call fcn.100cd108
mov ebx, eax
add esp, 4
mov eax, dword [esi]
mov dword [ebp - 0x20], ebx
mov dword [ebx + 8], eax
mov dword [ebx + 0xc], 0
mov dword [ebp - 4], 1
mov eax, dword [0x101144d0]
mov esi, dword [0x101144e4]
inc eax
vmovss xmm1, dword [0x101144c8]
vxorps xmm0, xmm0, xmm0
vcvtsi2sd xmm0, xmm0, eax
shr eax, 0x1f
vaddsd xmm0, xmm0, qword [eax*8 + 0x100dd2c0]
vcvtsd2ss xmm2, xmm0, xmm0
vxorps xmm0, xmm0, xmm0
mov eax, esi
shr eax, 0x1f
vcvtsi2sd xmm0, xmm0, esi
vaddsd xmm0, xmm0, qword [eax*8 + 0x100dd2c0]
vcvtsd2ss xmm0, xmm0, xmm0
vdivss xmm0, xmm2, xmm0
vcomiss xmm0, xmm1
jbe 0x1004a247
vdivss xmm0, xmm2, xmm1
vmovss dword [ebp - 0x18], xmm0
fld dword [ebp - 0x18]
fstp qword [ebp - 0x1c]
vxorpd xmm0, xmm0, xmm0
vroundsd xmm0, xmm0, qword [ebp - 0x1c], 2
vmovsd qword [ebp - 0x1c], xmm0
fld qword [ebp - 0x1c]
fstp dword [ebp - 0x18]
vmovss xmm0, dword [ebp - 0x18]
call fcn.100ce510
mov ecx, 8
cmp eax, ecx
cmova ecx, eax
cmp esi, ecx
jae 0x1004a22f
cmp esi, 0x200
jae 0x1004a22d
shl esi, 3
cmp esi, ecx
jae 0x1004a22f
mov esi, ecx
push esi
call fcn.10036810
push edi
lea eax, [ebx + 8]
push eax
lea eax, [ebp - 0x24]
push eax
call fcn.10036b30
mov ecx, dword [eax]
jmp 0x1004a24a
mov ecx, dword [ebp - 0x1c]
push ebx
push ecx
push edi
call fcn.10036770
add eax, 0xc
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4