joyce8/EMBER2024-capa huggingface dataset:
Function at 0x412c10
Capabilities:
Check mutex on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x425f60
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x4323e0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov esi, ecx
xor ebx, ebx
mov dword [ebp - 4], ebx
cmp dword [esi + 4], ebx
je 0x412c58
push 0x42f75c
lea eax, [ebp - 0x11]
push eax
mov byte [ebp - 0x11], bl
call fcn.00414b3b
cmp dword [esi + 0x20], 0x10
jb 0x412c63
mov eax, dword [esi + 0xc]
jmp 0x412c66
lea eax, [esi + 0xc]
push eax
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
cmp eax, ebx
mov dword [esi + 4], eax
jne 0x412c87
push 0x42f75c
lea ecx, [ebp - 0x12]
push ecx
mov byte [ebp - 0x12], bl
call fcn.00414b3b
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x412ccd
mov edx, dword [esi]
mov eax, dword [edx + 0x14]
mov ecx, esi
call eax
push 0x42f75c
lea ecx, [ebp - 0x13]
push ecx
mov byte [ebp - 0x13], bl
call fcn.00414b3b
mov byte [ebp - 0x14], 0
mov eax, 0x412cb8
ret
mov al, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x412cf0
Capabilities:
Check mutex on windows

Disassembly:
push ebx
push esi
mov esi, ecx
xor bl, bl
cmp dword [esi + 4], 0
jne 0x412d18
cmp dword [esi + 0x20], 0x10
jb 0x412d07
mov eax, dword [esi + 0xc]
jmp 0x412d0a
lea eax, [esi + 0xc]
push eax
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
mov dword [esi + 4], eax
mov eax, dword [esi + 4]
test eax, eax
je 0x412d59
mov ecx, dword [esi + 0x24]
push edi
mov edi, dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push ecx
push eax
call edi
test eax, eax
je 0x412d53
cmp eax, 0x80
jne 0x412d44
mov ecx, dword [esi + 4]
push 0
push ecx
call edi
test eax, eax
je 0x412d4d
mov edx, dword [esi]
mov eax, dword [edx + 0x14]
mov ecx, esi
call eax
pop edi
pop esi
mov al, bl
pop ebx
ret
pop edi
pop esi
mov al, 1
pop ebx
ret
pop esi
mov al, bl
pop ebx
ret

Function at 0x413bbc
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x4323e0]
jne 0x413bc6
repz ret
jmp fcn.00418156
Function at 0x41825a
Capabilities:
Write file on windows

Disassembly:
push ecx
push ebx
mov ebx, dword [esp + 0xc]
push esi
push edi
xor esi, esi
xor edi, edi
cmp ebx, dword [edi*8 + 0x432400]
je 0x418275
inc edi
cmp edi, 0x17
jb 0x418266
cmp edi, 0x17
jae 0x4183f5
push ebp
push 3
call fcn.0042156c
cmp eax, 1
pop ecx
je 0x4183c1
push 3
call fcn.0042156c
test eax, eax
pop ecx
jne 0x4182a9
cmp dword [0x432248], 1
je 0x4183c1
cmp ebx, 0xfc
je 0x4183f4
push str.Runtime_Error__n_nProgram:
mov ebx, 0x314
push ebx
mov ebp, 0x434bf8
push ebp
call fcn.004172cc
add esp, 0xc
test eax, eax
je 0x4182df
push esi
push esi
push esi
push esi
push esi
call fcn.0041407f
add esp, 0x14
push 0x104
mov esi, 0x434c11
push esi
push 0
mov byte [0x434d15], 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x418323
push str._program_name_unknown_
push 0x2fb
push esi
call fcn.004172cc
add esp, 0xc
test eax, eax
je 0x418323
xor eax, eax
push eax
push eax
push eax
push eax
push eax
call fcn.0041407f
add esp, 0x14
push esi
call fcn.00414ab0
inc eax
cmp eax, 0x3c
pop ecx
jbe 0x418368
push esi
call fcn.00414ab0
sub esi, 0x3b
add eax, esi
push 3
mov ecx, 0x434f0c
push 0x42a46c
sub ecx, eax
push ecx
push eax
call fcn.004141b4
add esp, 0x14
test eax, eax
je 0x418368
xor esi, esi
push esi
push esi
push esi
push esi
push esi
call fcn.0041407f
add esp, 0x14
jmp 0x41836a
xor esi, esi
push 0x42a468
push ebx
push ebp
call fcn.0041e6a6
add esp, 0xc
test eax, eax
je 0x41838a
push esi
push esi
push esi
push esi
push esi
call fcn.0041407f
add esp, 0x14
push dword [edi*8 + 0x432404]
push ebx
push ebp
call fcn.0041e6a6
add esp, 0xc
test eax, eax
je 0x4183ac
push esi
push esi
push esi
push esi
push esi
call fcn.0041407f
add esp, 0x14
push 0x12010
push str.Microsoft_Visual_C_Runtime_Library
push ebp
call fcn.004213af
add esp, 0xc
jmp 0x4183f4
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
mov ebp, eax
cmp ebp, esi
je 0x4183f4
cmp ebp, 0xffffffff
je 0x4183f4
push 0
lea eax, [esp + 0x14]
push eax
lea esi, [edi*8 + 0x432404]
push dword [esi]
call fcn.00414ab0
pop ecx
push eax
push dword [esi]
push ebp
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop ebp
pop edi
pop esi
pop ebx
pop ecx
ret
Function at 0x4213af
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
push edi
call fcn.00417622
xor ebx, ebx
cmp dword [0x435224], ebx
mov dword [ebp - 8], eax
mov dword [ebp - 4], ebx
mov dword [ebp - 0xc], ebx
mov dword [ebp - 0x10], ebx
jne 0x421485
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
cmp edi, ebx
je 0x421565
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
cmp eax, ebx
je 0x421565
push eax
call fcn.004175b4
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x435224], eax
call esi
push eax
call fcn.004175b4
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x435228], eax
call esi
push eax
call fcn.004175b4
mov dword [0x43522c], eax
lea eax, [ebp - 0xc]
push eax
call fcn.00417ced
test eax, eax
pop ecx
pop ecx
je 0x421453
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.0041407f
add esp, 0x14
cmp dword [ebp - 0xc], 2
jne 0x421485
push str.GetUserObjectInformationA
push edi
call esi
push eax
call fcn.004175b4
cmp eax, ebx
pop ecx
mov dword [0x435234], eax
je 0x421485
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.004175b4
pop ecx
mov dword [0x435230], eax
mov eax, dword [0x435230]
mov ecx, dword [ebp - 8]
cmp eax, ecx
je 0x42150a
cmp dword [0x435234], ecx
je 0x42150a
push eax
call fcn.0041762b
push dword [0x435234]
mov esi, eax
call fcn.0041762b
cmp esi, ebx
pop ecx
pop ecx
mov edi, eax
je 0x42150a
cmp edi, ebx
je 0x42150a
call esi
cmp eax, ebx
je 0x4214d7
lea ecx, [ebp - 0x14]
push ecx
push 0xc
lea ecx, [ebp - 0x20]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x4214d7
test byte [ebp - 0x18], 1
jne 0x42150a
lea eax, [ebp - 0x10]
push eax
call fcn.00417d24
test eax, eax
pop ecx
je 0x4214f2
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.0041407f
add esp, 0x14
cmp dword [ebp - 0x10], 4
jb 0x421501
or dword [ebp + 0x10], 0x200000
jmp 0x421545
or dword [ebp + 0x10], 0x40000
jmp 0x421545
mov eax, dword [0x435228]
cmp eax, dword [ebp - 8]
je 0x421545
push eax
call fcn.0041762b
cmp eax, ebx
pop ecx
je 0x421545
call eax
cmp eax, ebx
mov dword [ebp - 4], eax
je 0x421545
mov eax, dword [0x43522c]
cmp eax, dword [ebp - 8]
je 0x421545
push eax
call fcn.0041762b
cmp eax, ebx
pop ecx
je 0x421545
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x435224]
call fcn.0041762b
cmp eax, ebx
pop ecx
je 0x421565
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x421567
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x10008930
Capabilities:
Read file on windows

Disassembly:
sub esp, 8
push ebx
push ebp
push esi
push edi
push 0x40
push 0x1000
mov esi, ecx
call sym.MNN.dll_MNNMemoryAllocAlign
mov edi, eax
add esp, 8
test edi, edi
je 0x10008a3c
push dword [esi + 0xc]
mov ebp, dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
push 0x1000
push 1
push edi
call ebp
mov ebx, eax
mov dword [esp + 0x24], edi
mov dword [esi + 0x10], ebx
add esp, 0x10
mov eax, dword [esi + 4]
mov dword [esp + 0x10], ebx
cmp eax, dword [esi + 8]
je 0x10008988
mov dword [eax], ebx
mov dword [eax + 4], edi
add dword [esi + 4], 8
jmp 0x10008995
lea ecx, [esp + 0x10]
push ecx
push eax
mov ecx, esi
call fcn.10008580
cmp ebx, 0x1000
jne 0x10008a06
nop dword [eax]
push 0x40
push 0x1000
call sym.MNN.dll_MNNMemoryAllocAlign
mov ebx, eax
add esp, 8
test ebx, ebx
je 0x10008a3c
push dword [esi + 0xc]
push 0x1000
push 1
push ebx
call ebp
mov edi, eax
add esp, 0x10
cmp edi, 0x1000
ja 0x10008a1f
add dword [esi + 0x10], edi
mov eax, dword [esi + 4]
mov dword [esp + 0x10], edi
mov dword [esp + 0x14], ebx
cmp eax, dword [esi + 8]
je 0x100089f1
mov dword [eax], edi
mov dword [eax + 4], ebx
add dword [esi + 4], 8
jmp 0x100089fe
lea ecx, [esp + 0x10]
push ecx
push eax
mov ecx, esi
call fcn.10008580
cmp edi, 0x1000
je 0x100089a0
push dword [esi + 0xc]
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_ferror]
add esp, 4
test eax, eax
sete al
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret
push str.Read_file_Error_n
call fcn.10001230
push ebx
call sym.MNN.dll_MNNMemoryFreeAlign
add esp, 8
xor al, al
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret
push str.Memory_Alloc_Failed_n
call fcn.10001230
add esp, 4
xor al, al
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret

Function at 0x10008a70
Capabilities:
Write file on windows

Disassembly:
sub esp, 8
push ebx
mov ebx, dword [esp + 0x10]
push 0x101aa8b0
push ebx
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fopen]
add esp, 8
mov dword [esp + 4], eax
test eax, eax
jne 0x10008aa4
push ebx
push str.Open__s_error_n
call fcn.10001230
add esp, 8
xor al, al
pop ebx
add esp, 8
ret
mov edx, dword [esp + 0x18]
push ebp
push esi
push edi
lea ebp, [edx + 0xfff]
mov dword [esp + 0x14], edx
shr ebp, 0xc
xor edi, edi
test ebp, ebp
je 0x10008afa
xor ecx, ecx
lea ebx, [ecx + 0x1000]
mov esi, edx
cmp ebx, edx
cmovb esi, ebx
cmp esi, ecx
jbe 0x10008af3
push eax
mov eax, dword [esp + 0x24]
sub esi, ecx
push esi
add eax, ecx
push 1
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
add esp, 0x10
cmp eax, esi
jne 0x10008b0e
mov eax, dword [esp + 0x10]
mov edx, dword [esp + 0x14]
inc edi
mov ecx, ebx
cmp edi, ebp
jb 0x10008ac0
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
add esp, 4
mov al, 1
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret
push dword [esp + 0x1c]
push str.Write__s_error_n
call fcn.10001230
push dword [esp + 0x18]
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
add esp, 0xc
xor al, al
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret
Function at 0x1000ac20
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10198908
mov eax, dword fs:[0]
push eax
sub esp, 8
push esi
push edi
mov eax, dword [0x101df584]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x10], edi
mov dword [edi + 4], 0
mov dword [edi + 4], 0
mov dword [edi], 0
mov dword [edi + 8], 0
mov dword [ebp - 4], 0
mov dword [edi + 0xc], 0
mov dword [edi + 0x10], 0
mov dword [edi + 0x14], 0
lea esi, [edi + 0x18]
mov byte [ebp - 4], 1
push 0x18
mov dword [ebp - 0x14], esi
mov dword [esi], 0
mov dword [esi + 4], 0
call fcn.10196241
xorps xmm0, xmm0
push 2
mov dword [eax], eax
mov dword [eax + 4], eax
mov dword [eax + 8], eax
mov word [eax + 0xc], 0x101
mov dword [esi], eax
lea eax, [edi + 0x58]
mov dword [edi + 0x20], 0
mov dword [edi + 0x24], 2
mov dword [edi + 0x28], 4
mov dword [edi + 0x2c], 8
mov dword [edi + 0x30], 6
mov dword [edi + 0x34], 5
mov dword [edi + 0x3c], 0
mov dword [edi + 0x38], 0
movups xmmword [edi + 0x40], xmm0
mov dword [edi + 0x50], 0
mov dword [edi + 0x54], 0xf
push eax
mov byte [edi + 0x40], 0
call sub.MSVCP140.dll__Mtx_init_in_situ
mov dword [edi + 0x88], 0
xorps xmm0, xmm0
movups xmmword [edi + 0x8c], xmm0
mov dword [edi + 0x9c], 0
add esp, 0xc
mov dword [edi + 0xa0], 0xf
mov eax, edi
mov byte [edi + 0x8c], 0
movups xmmword [edi + 0xa4], xmm0
mov dword [edi + 0xb4], 0
mov dword [edi + 0xb8], 0xf
mov byte [edi + 0xa4], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x1000b070
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10198988
mov eax, dword fs:[0]
push eax
sub esp, 8
push esi
push edi
mov eax, dword [0x101df584]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x10], edi
mov dword [edi], 0
mov dword [edi + 4], 0
mov dword [edi + 8], 0
lea esi, [edi + 0xc]
mov dword [ebp - 4], 0
push 0x2c
mov dword [ebp - 0x14], esi
mov dword [esi], 0
mov dword [esi + 4], 0
call fcn.10196241
mov dword [eax], eax
mov dword [eax + 4], eax
mov dword [eax + 8], eax
mov word [eax + 0xc], 0x101
mov dword [esi], eax
lea esi, [edi + 0x14]
mov byte [ebp - 4], 1
push 0x2c
mov dword [ebp - 0x14], esi
mov dword [esi], 0
mov dword [esi + 4], 0
call fcn.10196241
add esp, 8
mov dword [eax], eax
mov dword [eax + 4], eax
mov dword [eax + 8], eax
mov word [eax + 0xc], 0x101
mov dword [esi], eax
mov eax, edi
mov dword [edi + 0x1c], 0
mov dword [edi + 0x20], 0
mov dword [edi + 0x24], 0
mov dword [edi + 0x2c], 0
mov dword [edi + 0x30], 0
mov byte [edi + 0x34], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x1000b150
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10198a01
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push esi
push edi
mov eax, dword [0x101df584]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x10], edi
mov ebx, dword [ebp + 8]
push ebx
call fcn.1000a8a0
add edi, 0x10
mov dword [ebp - 4], 0
mov dword [edi], 0
mov dword [edi + 4], 0
mov dword [edi + 8], 0
mov eax, dword [ebx + 0x14]
sub eax, dword [ebx + 0x10]
sar eax, 3
test eax, eax
je 0x1000b20a
cmp eax, 0x1fffffff
ja 0x1000b320
push eax
mov ecx, edi
call fcn.10003450
mov edx, dword [ebx + 0x14]
mov ecx, dword [ebx + 0x10]
mov esi, dword [edi]
cmp ecx, edx
je 0x1000b1fc
mov dword [esi], 0
mov dword [esi + 4], 0
mov eax, dword [ecx + 4]
test eax, eax
je 0x1000b1e8
lock inc dword [eax + 4]
mov eax, dword [ecx]
mov dword [esi], eax
mov eax, dword [ecx + 4]
add ecx, 8
mov dword [esi + 4], eax
add esi, 8
cmp ecx, edx
jne 0x1000b1d0
push edi
push esi
push esi
call fcn.10002960
add esp, 0xc
mov dword [edi + 4], esi
mov edi, dword [ebp - 0x10]
lea eax, [ebx + 0x1c]
push eax
mov byte [ebp - 4], 1
lea ecx, [edi + 0x1c]
call fcn.10002b70
lea esi, [edi + 0x28]
mov byte [ebp - 4], 2
push 0x2c
mov dword [ebp + 8], esi
mov dword [esi], 0
mov dword [esi + 4], 0
mov dword [ebp - 0x18], esi
mov dword [ebp - 0x14], esi
call fcn.10196241
add esp, 4
mov dword [eax], eax
mov dword [eax + 4], eax
mov dword [eax + 8], eax
mov word [eax + 0xc], 0x101
mov dword [esi], eax
lea eax, [ebx + 0x28]
mov byte [ebp - 4], 3
push eax
mov ecx, esi
call fcn.10009d00
lea esi, [edi + 0x30]
mov byte [ebp - 4], 4
push 0x2c
mov dword [ebp + 8], esi
mov dword [esi], 0
mov dword [esi + 4], 0
mov dword [ebp - 0x18], esi
mov dword [ebp - 0x14], esi
call fcn.10196241
add esp, 4
mov dword [eax], eax
mov dword [eax + 4], eax
mov dword [eax + 8], eax
mov word [eax + 0xc], 0x101
mov dword [esi], eax
lea eax, [ebx + 0x30]
mov byte [ebp - 4], 5
push eax
mov ecx, esi
call fcn.10009d00
movzx eax, byte [ebx + 0x38]
lea esi, [edi + 0x40]
mov byte [edi + 0x38], al
movzx eax, byte [ebx + 0x39]
mov byte [edi + 0x39], al
movzx eax, byte [ebx + 0x3a]
mov byte [edi + 0x3a], al
mov eax, dword [ebx + 0x3c]
mov dword [edi + 0x3c], eax
push 0x20
mov byte [ebp - 4], 6
mov dword [ebp + 8], esi
mov dword [esi], 0
mov dword [esi + 4], 0
mov dword [ebp - 0x18], esi
mov dword [ebp - 0x14], esi
call fcn.10196241
add esp, 4
mov dword [eax], eax
mov dword [eax + 4], eax
mov dword [eax + 8], eax
mov word [eax + 0xc], 0x101
mov dword [esi], eax
lea eax, [ebx + 0x40]
mov byte [ebp - 4], 7
push eax
mov ecx, esi
call fcn.10009c90
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
call fcn.10003720
int3
Function at 0x1003d330
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x30
push ebx
push ebp
push esi
mov esi, dword [esp + 0x48]
lea ecx, [esi + 0x34]
push edi
mov edi, dword [esp + 0x48]
mov eax, dword [esi + 4]
mov dword [esp + 0x3c], eax
mov eax, dword [esi + 8]
mov dword [esp + 0x38], eax
mov eax, dword [esi + 0xc]
mov dword [esp + 0x34], eax
mov eax, dword [esi + 0x10]
mov dword [esp + 0x30], eax
mov eax, dword [esi + 0x14]
mov dword [esp + 0x2c], eax
mov eax, dword [esi + 0x18]
mov ebp, dword [esi]
mov dword [esp + 0x28], eax
mov eax, dword [esi + 0x1c]
mov dword [esp + 0x24], eax
mov eax, dword [esi + 0x20]
mov dword [esp + 0x20], eax
mov eax, dword [esi + 0x24]
mov dword [esp + 0x1c], eax
mov eax, dword [esi + 0x28]
mov dword [esp + 0x18], eax
mov eax, dword [esi + 0x2c]
mov dword [esp + 0x14], eax
movzx eax, byte [esi + 0x30]
mov byte [esp + 0x10], al
movzx eax, byte [esi + 0x31]
mov byte [esp + 0x4c], al
mov eax, dword [ecx + 4]
sub eax, dword [ecx]
test eax, 0xfffffffc
je 0x1003d3be
push ecx
lea eax, [esp + 0x4c]
mov ecx, edi
push eax
call fcn.100369c0
mov ebx, dword [eax]
jmp 0x1003d3c0
xor ebx, ebx
mov eax, dword [esi + 0x44]
lea ecx, [esi + 0x40]
sub eax, dword [ecx]
test eax, 0xfffffffc
je 0x1003d3e0
push ecx
lea eax, [esp + 0x4c]
mov ecx, edi
push eax
call fcn.100369c0
mov ecx, dword [eax]
jmp 0x1003d3e2
xor ecx, ecx
movzx eax, byte [esi + 0x4c]
push eax
push ecx
push ebx
push dword [esp + 0x58]
mov esi, dword [esp + 0x54]
push dword [esp + 0x20]
push dword [esp + 0x28]
push dword [esp + 0x30]
push dword [esp + 0x38]
push dword [esp + 0x40]
push dword [esp + 0x48]
push dword [esp + 0x50]
push dword [esp + 0x58]
push dword [esp + 0x60]
push dword [esp + 0x68]
push dword [esp + 0x70]
push dword [esp + 0x78]
push ebp
push edi
push esi
call fcn.1003cfd0
add esp, 0x4c
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x30
ret
Function at 0x1008b4a0
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1019e2c5
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push ebx
push esi
push edi
mov eax, dword [0x101df584]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov ebx, dword [ebp + 0xc]
movzx eax, byte [ebx]
xor eax, 0x811c9dc5
imul edx, eax, 0x1000193
movzx eax, byte [ebx + 1]
xor edx, eax
movzx eax, byte [ebx + 2]
imul edx, edx, 0x1000193
xor edx, eax
movzx eax, byte [ebx + 3]
imul ecx, edx, 0x1000193
xor ecx, eax
imul eax, ecx, 0x1000193
mov ecx, edi
push eax
mov dword [ebp + 0xc], eax
lea eax, [ebp - 0x1c]
push ebx
push eax
call fcn.1008b430
mov ecx, dword [ebp - 0x18]
test ecx, ecx
je 0x1008b533
mov eax, dword [ebp + 8]
mov dword [eax], ecx
mov byte [eax + 4], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
cmp dword [edi + 8], 0x15555555
je 0x1008b681
lea eax, [edi + 4]
mov dword [ebp - 0x14], eax
push 0xc
mov dword [ebp - 4], 0
mov dword [ebp - 0x10], 0
call fcn.10196241
mov ecx, dword [ebx]
mov esi, eax
add esp, 4
mov dword [ebp - 0x10], esi
mov dword [esi + 8], ecx
mov eax, dword [edi + 8]
mov ebx, dword [edi + 0x1c]
inc eax
movss xmm3, dword [edi]
mov dword [ebp - 4], 1
movd xmm0, eax
cvtdq2pd xmm0, xmm0
shr eax, 0x1f
addsd xmm0, qword [eax*8 + 0x101aa850]
mov eax, ebx
shr eax, 0x1f
cvtpd2ps xmm2, xmm0
movd xmm0, ebx
cvtdq2pd xmm0, xmm0
movaps xmm1, xmm2
addsd xmm0, qword [eax*8 + 0x101aa850]
cvtpd2ps xmm0, xmm0
divss xmm1, xmm0
comiss xmm1, xmm3
jbe 0x1008b623
divss xmm2, xmm3
sub esp, 8
cvtps2pd xmm0, xmm2
movsd qword [ebp - 0x1c], xmm0
fld qword [ebp - 0x1c]
fstp qword [esp]
call sub.api_ms_win_crt_math_l1_1_0.dll_ceil
fstp qword [ebp - 0x1c]
movsd xmm0, qword [ebp - 0x1c]
add esp, 8
cvtpd2ps xmm0, xmm0
call fcn.10196080
mov ecx, 8
cmp eax, ecx
cmova ecx, eax
cmp ebx, ecx
jae 0x1008b605
cmp ebx, 0x200
jae 0x1008b603
shl ebx, 3
cmp ebx, ecx
jae 0x1008b605
mov ebx, ecx
push ebx
mov ecx, edi
call fcn.1008b790
push dword [ebp + 0xc]
lea eax, [esi + 8]
mov ecx, edi
push eax
lea eax, [ebp - 0x1c]
push eax
call fcn.1008b430
mov edx, dword [eax]
jmp 0x1008b626
mov edx, dword [ebp - 0x1c]
mov ebx, dword [edx + 4]
inc dword [edi + 8]
mov dword [esi], edx
mov dword [esi + 4], ebx
mov dword [ebx], esi
mov dword [edx + 4], esi
mov eax, dword [edi + 0x18]
and eax, dword [ebp + 0xc]
mov ecx, dword [edi + 0xc]
mov esi, dword [ebp - 0x14]
mov edi, dword [ecx + eax*8]
cmp edi, dword [esi]
mov esi, dword [ebp - 0x10]
jne 0x1008b651
mov dword [ecx + eax*8], esi
jmp 0x1008b660
cmp edi, edx
jne 0x1008b65a
mov dword [ecx + eax*8], esi
jmp 0x1008b664
cmp dword [ecx + eax*8 + 4], ebx
jne 0x1008b664
mov dword [ecx + eax*8 + 4], esi
mov eax, dword [ebp + 8]
mov dword [eax], esi
mov byte [eax + 4], 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
push str.unordered_map_set_too_long
call sub.MSVCP140.dll_void___cdecl_std::_Xlength_error_char_const__
int3
Function at 0x1008b790
Capabilities:
Hash data using fnv

Disassembly:
push ecx
mov edx, dword [esp + 8]
mov eax, 0x1fffffff
push ebx
mov ebx, ecx
bsr ecx, eax
push esi
mov esi, 1
mov dword [esp + 8], ebx
mov eax, esi
shl eax, cl
cmp edx, eax
ja 0x1008b8d2
lea eax, [edx - 1]
or eax, esi
bsr ecx, eax
push ebp
mov ebp, dword [ebx + 4]
push edi
push ebp
lea ecx, [ecx + 1]
mov dword [esp + 0x1c], ebp
shl esi, cl
lea edi, [ebx + 0xc]
mov ecx, edi
lea eax, [esi + esi]
push eax
call fcn.100201b0
mov ecx, dword [ebx + 4]
lea eax, [esi - 1]
mov dword [ebx + 0x18], eax
mov dword [ebx + 0x1c], esi
mov ecx, dword [ecx]
cmp ecx, ebp
je 0x1008b8ae
mov eax, ecx
movzx edx, byte [eax + 8]
xor edx, 0x811c9dc5
mov ecx, dword [ecx]
imul esi, edx, 0x1000193
movzx edx, byte [eax + 9]
xor esi, edx
movzx edx, byte [eax + 0xa]
imul esi, esi, 0x1000193
xor esi, edx
movzx edx, byte [eax + 0xb]
imul esi, esi, 0x1000193
xor esi, edx
mov edx, dword [edi]
imul esi, esi, 0x1000193
and esi, dword [ebx + 0x18]
mov edi, dword [edx + esi*8]
lea ebp, [edx + esi*8]
cmp edi, dword [esp + 0x18]
jne 0x1008b842
mov dword [ebp], eax
mov dword [ebp + 4], eax
jmp 0x1008b89f
mov edx, dword [ebp + 4]
mov esi, dword [eax + 8]
cmp esi, dword [edx + 8]
jne 0x1008b870
mov ebx, dword [edx]
cmp ebx, eax
je 0x1008b86b
mov edi, dword [eax + 4]
mov dword [edi], ecx
mov esi, dword [ecx + 4]
mov dword [esi], ebx
mov edx, dword [ebx + 4]
mov dword [edx], eax
mov dword [ebx + 4], esi
mov dword [ecx + 4], edi
mov dword [eax + 4], edx
mov dword [ebp + 4], eax
jmp 0x1008b89b
cmp edi, edx
je 0x1008b880
mov edx, dword [edx + 4]
cmp esi, dword [edx + 8]
je 0x1008b8b6
cmp edi, edx
jne 0x1008b874
mov ebx, dword [eax + 4]
mov dword [ebx], ecx
mov edi, dword [ecx + 4]
mov dword [edi], edx
mov esi, dword [edx + 4]
mov dword [esi], eax
mov dword [edx + 4], edi
mov dword [ecx + 4], ebx
mov dword [eax + 4], esi
mov dword [ebp], eax
mov ebx, dword [esp + 0x10]
lea edi, [ebx + 0xc]
mov eax, ecx
cmp ecx, dword [esp + 0x18]
jne 0x1008b7f3
pop edi
pop ebp
pop esi
pop ebx
pop ecx
ret 4
mov edi, dword [eax + 4]
mov ebx, dword [edx]
mov dword [edi], ecx
mov esi, dword [ecx + 4]
mov dword [esi], ebx
mov edx, dword [ebx + 4]
mov dword [edx], eax
mov dword [ebx + 4], esi
mov dword [ecx + 4], edi
mov dword [eax + 4], edx
jmp 0x1008b89b
push str.invalid_hash_bucket_count
call sub.MSVCP140.dll_void___cdecl_std::_Xlength_error_char_const__
int3