joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1005f630
Capabilities:
Resume thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
push eax
call dword [sym.imp.KERNEL32.dll_GetThreadPriority]
mov dword [ebp - 8], eax
push 0xf
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
push eax
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
mov dword [ebp - 4], 0
jmp 0x1005f667
mov eax, dword [ebp - 4]
add eax, 1
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
cmp ecx, dword [0x101a0108]
jae 0x1005f69b
lfence
mov edx, dword [ebp - 4]
mov eax, dword [0x101a0104]
mov ecx, dword [eax + edx*4]
push ecx
call dword [sym.imp.KERNEL32.dll_ResumeThread]
mov edx, dword [ebp - 4]
mov eax, dword [0x101a0104]
mov ecx, dword [eax + edx*4]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x1005f65e
mov edx, dword [0x101a0104]
push edx
call fcn.10106340
add esp, 4
mov dword [0x101a0104], 0
mov dword [0x101a0108], 0
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
push eax
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
mov esp, ebp
pop ebp
ret

Function at 0x1005f870
Capabilities:
Resume thread
Suspend thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2e0
mov eax, dword [0x1019a784]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push eax
push 0
push 0x1fffff
call dword [sym.imp.KERNEL32.dll_OpenThread]
mov dword [ebp - 0x2d4], eax
cmp dword [ebp - 0x2d4], 0xffffffff
je 0x1005f9b5
cmp dword [ebp - 0x2d4], 0
je 0x1005f9b5
mov ecx, dword [ebp - 0x2d4]
push ecx
call dword [sym.imp.KERNEL32.dll_SuspendThread]
mov dword [ebp - 0x2dc], eax
cmp dword [ebp - 0x2dc], 0xffffffff
je 0x1005f99e
mov dword [ebp - 0x2d0], 0x10001
mov dword [ebp - 0x2d8], 0
lea edx, [ebp - 0x2d0]
push edx
mov eax, dword [ebp - 0x2d4]
push eax
call dword [sym.imp.KERNEL32.dll_GetThreadContext]
test eax, eax
je 0x1005f99c
mov ecx, dword [ebp - 0x218]
mov dword [ebp - 0x2e0], ecx
mov edx, dword [ebp + 0x10]
push edx
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp - 0x2e0]
push ecx
call fcn.1005fc60
add esp, 0xc
test eax, eax
jne 0x1005f995
cmp dword [ebp - 0x2d8], 3
jge 0x1005f96a
lfence
mov edx, dword [ebp - 0x2d4]
push edx
call dword [sym.imp.KERNEL32.dll_ResumeThread]
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
mov eax, dword [ebp - 0x2d4]
push eax
call dword [sym.imp.KERNEL32.dll_SuspendThread]
mov ecx, dword [ebp - 0x2d8]
add ecx, 1
mov dword [ebp - 0x2d8], ecx
jmp 0x1005f993
lfence
mov edx, dword [ebp - 0x2d4]
push edx
call dword [sym.imp.KERNEL32.dll_ResumeThread]
mov eax, dword [ebp - 0x2d4]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0x2d4], 0
jmp 0x1005f99c
jmp 0x1005f997
jmp 0x1005f99c
jmp 0x1005f8e8
jmp 0x1005f9b5
mov ecx, dword [ebp - 0x2d4]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0x2d4], 0
mov eax, dword [ebp - 0x2d4]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1006e560
mov esp, ebp
pop ebp
ret
Function at 0x100609d0
Capabilities:
Access peb ldr_data
Get kernel32 base address
Get process heap flags
Get process heap force flags

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1012114d
mov eax, dword fs:[0]
push eax
sub esp, 0x24
mov eax, dword [0x1019a784]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x18], ecx
mov ecx, dword [ebp - 0x18]
call fcn.10026fe0
mov dword [ebp - 4], 0
mov eax, dword [ebp - 0x18]
mov dword [eax], vtable.tutorial::PollAuthSessionStatusResponse.0
mov ecx, dword [ebp - 0x18]
add ecx, 8
call fcn.10026ae0
xor ecx, ecx
mov edx, dword [ebp - 0x18]
add edx, 0xc
mov dword [edx], ecx
mov ecx, dword [ebp - 0x18]
add ecx, 0xc
call fcn.10026f40
mov eax, dword [ebp - 0x18]
add eax, 0x10
mov dword [ebp - 0x1c], eax
movzx ecx, byte [ebp - 0xd]
push ecx
push 0x101a1a70
mov ecx, dword [ebp - 0x1c]
call fcn.10026b80
mov edx, dword [ebp - 0x18]
add edx, 0x14
mov dword [ebp - 0x20], edx
movzx eax, byte [ebp - 0xe]
push eax
push 0x101a1a70
mov ecx, dword [ebp - 0x20]
call fcn.10026b80
mov ecx, dword [ebp - 0x18]
add ecx, 0x18
mov dword [ebp - 0x24], ecx
movzx edx, byte [ebp - 0xf]
push edx
push 0x101a1a70
mov ecx, dword [ebp - 0x24]
call fcn.10026b80
mov eax, dword [ebp - 0x18]
add eax, 0x1c
mov dword [ebp - 0x28], eax
movzx ecx, byte [ebp - 0x10]
push ecx
push 0x101a1a70
mov ecx, dword [ebp - 0x28]
call fcn.10026b80
mov edx, dword [ebp - 0x18]
add edx, 0x20
mov dword [ebp - 0x2c], edx
movzx eax, byte [ebp - 0x11]
push eax
push 0x101a1a70
mov ecx, dword [ebp - 0x2c]
call fcn.10026b80
mov ecx, dword [ebp - 0x18]
add ecx, 0x24
mov dword [ebp - 0x30], ecx
movzx edx, byte [ebp - 0x12]
push edx
push 0x101a1a70
mov ecx, dword [ebp - 0x30]
call fcn.10026b80
mov eax, dword [ebp - 0x18]
xor ecx, ecx
xor edx, edx
mov dword [eax + 0x28], ecx
mov dword [eax + 0x2c], edx
mov eax, dword [ebp - 0x18]
mov byte [eax + 0x30], 0
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret 4
Function at 0x10064af8
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov dword [esp], 0x729e58b2
add ebp, 4
shr word [esp + 2], 0x27
push 0xaba17ab
ja 0x101aa52a
not ecx
mov dword [esp + 3], 0x8b0a3f
push 0x40a55a6
neg byte [esp + 2]
and edx, ecx
push 0x341b0d84
mov dword [ebp], edx
call fcn.101a7409
jnp 0x1006b878
not edx
jp 0x100671b2
jne 0x101a5c1b
mov ax, word [ebp]
mov di, word [ebp + 2]
call fcn.101a4f0d
push 0x59b7388f
neg word [esp + 2]
not cl
adc word [esp + 2], 0x9e95
call fcn.101aa97a
mov edx, dword [ebp]
mov eax, dword [ebp + 4]
mov ecx, 0xa8be9ca4
rol ecx, cl
mov cl, byte [ebp + 8]
call fcn.101a83bf

Function at 0x10065060
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x10065084
xor eax, eax
jmp 0x10065104
mov edx, dword [ebp - 0xc]
push edx
call dword [sym.imp.KERNEL32.dll_LockResource]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x1006509b
xor eax, eax
jmp 0x10065104
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov dword [ebp - 0x14], eax
mov edx, dword [ebp - 4]
add edx, dword [ebp - 0x14]
mov dword [ebp - 0x10], edx
mov eax, dword [ebp + 0x10]
and eax, 0xf
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jbe 0x100650e7
mov ecx, dword [ebp - 4]
cmp ecx, dword [ebp - 0x10]
jae 0x100650e7
mov edx, dword [ebp - 4]
movzx eax, word [edx]
mov ecx, dword [ebp - 4]
lea edx, [ecx + eax*2 + 2]
mov dword [ebp - 4], edx
mov eax, dword [ebp - 8]
sub eax, 1
mov dword [ebp - 8], eax
jmp 0x100650be
mov ecx, dword [ebp - 4]
cmp ecx, dword [ebp - 0x10]
jb 0x100650f3
xor eax, eax
jmp 0x10065104
mov edx, dword [ebp - 4]
movzx eax, word [edx]
test eax, eax
jne 0x10065101
xor eax, eax
jmp 0x10065104
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
Function at 0x10065150
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x54
mov eax, dword [0x1019a784]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x30], ecx
mov eax, dword [ebp - 0x30]
cmp dword [eax + 0x38], 0
je 0x10065177
mov ecx, dword [ebp - 0x30]
movzx edx, byte [ecx + 0x3d]
test edx, edx
jne 0x1006517e
mov al, 1
jmp 0x1006526c
mov eax, dword [ebp - 0x30]
mov ecx, dword [eax]
mov edx, dword [ecx + 0xc]
mov dword [ebp - 0x44], edx
call fcn.10010bdf
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x40]
push eax
mov ecx, dword [ebp - 0x30]
call dword [ebp - 0x44]
mov dword [ebp - 0x48], eax
call fcn.10010bdf
mov dword [ebp - 0x4c], eax
lea ecx, [ebp - 0x48]
push ecx
lea edx, [ebp - 0x4c]
push edx
call fcn.10010be3
add esp, 8
movzx eax, al
test eax, eax
je 0x100651c4
xor al, al
jmp 0x1006526c
mov dword [ebp - 0x54], 0x20
mov ecx, dword [ebp - 0x30]
mov edx, dword [ecx + 0x38]
mov dword [ebp - 0x50], edx
lea eax, [ebp - 0x2c]
push eax
lea ecx, [ebp - 8]
push ecx
lea edx, [ebp - 0x28]
push edx
mov eax, dword [ebp - 0x30]
add eax, 0x40
push eax
mov ecx, dword [ebp - 0x50]
call fcn.10067bd0
mov dword [ebp - 0x34], eax
cmp dword [ebp - 0x34], 0
je 0x10065206
cmp dword [ebp - 0x34], 1
je 0x1006520d
cmp dword [ebp - 0x34], 3
je 0x1006525f
jmp 0x1006526a
mov ecx, dword [ebp - 0x30]
mov byte [ecx + 0x3d], 0
mov edx, dword [ebp - 0x2c]
lea eax, [ebp - 0x28]
sub edx, eax
mov dword [ebp - 0x38], edx
je 0x1006523f
lfence
mov ecx, dword [ebp - 0x30]
mov edx, dword [ecx + 0x4c]
push edx
mov eax, dword [ebp - 0x38]
push eax
push 1
lea ecx, [ebp - 0x28]
push ecx
call fcn.101086b6
add esp, 0x10
cmp dword [ebp - 0x38], eax
je 0x1006523f
xor al, al
jmp 0x1006526c
mov edx, dword [ebp - 0x30]
movzx eax, byte [edx + 0x3d]
test eax, eax
jne 0x10065253
mov dword [ebp - 0x3c], 1
jmp 0x1006525a
mov dword [ebp - 0x3c], 0
mov al, byte [ebp - 0x3c]
jmp 0x1006526c
mov ecx, dword [ebp - 0x30]
mov byte [ecx + 0x3d], 0
mov al, 1
jmp 0x1006526c
xor al, al
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1006e560
mov esp, ebp
pop ebp
ret
Function at 0x10066de0
Capabilities:
Execute anti-debugging instructions

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x101217e6
mov eax, dword fs:[0]
push eax
sub esp, 0x698
mov eax, dword [0x1019a784]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push str._e_i0
jmp fcn.101a823e

Function at 0x10067c00
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
mov eax, dword [0x1019a784]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x10], ecx
cmp dword [ebp + 0x10], 0
jg 0x10067c2a
jl 0x10067c21
cmp dword [ebp + 0xc], 0
ja 0x10067c2a
xor eax, eax
xor edx, edx
jmp 0x10067d6b
mov eax, dword [ebp - 0x10]
cmp dword [eax + 0x38], 0
je 0x10067c4c
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 0x10]
call fcn.1001382a
jmp 0x10067d6b
mov ecx, dword [ebp + 0xc]
mov dword [ebp - 8], ecx
mov edx, dword [ebp + 0xc]
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x20], edx
mov dword [ebp - 0x1c], eax
mov ecx, dword [ebp - 0x10]
call fcn.10010c05
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jbe 0x10067cbb
lea ecx, [ebp - 0xc]
push ecx
lea edx, [ebp - 8]
push edx
call fcn.10012556
add esp, 8
mov eax, dword [eax]
mov dword [ebp - 0x14], eax
mov ecx, dword [ebp - 0x14]
push ecx
mov ecx, dword [ebp - 0x10]
call fcn.10010c35
push eax
mov edx, dword [ebp + 8]
push edx
call fcn.100123fc
add esp, 0xc
mov eax, dword [ebp + 8]
add eax, dword [ebp - 0x14]
mov dword [ebp + 8], eax
mov ecx, dword [ebp - 8]
sub ecx, dword [ebp - 0x14]
mov dword [ebp - 8], ecx
mov edx, dword [ebp - 0x14]
push edx
mov ecx, dword [ebp - 0x10]
call fcn.10014238
mov eax, dword [ebp - 0x10]
cmp dword [eax + 0x4c], 0
je 0x10067d5c
mov ecx, dword [ebp - 0x10]
call fcn.100655e0
mov dword [ebp - 0x2c], 0xfff
cmp dword [ebp - 8], 0xfff
jbe 0x10067d2b
mov ecx, dword [ebp - 0x10]
mov edx, dword [ecx + 0x4c]
push edx
push 0xfff
push 1
mov eax, dword [ebp + 8]
push eax
call fcn.101080b0
add esp, 0x10
mov dword [ebp - 0x18], eax
mov ecx, dword [ebp + 8]
add ecx, dword [ebp - 0x18]
mov dword [ebp + 8], ecx
mov edx, dword [ebp - 8]
sub edx, dword [ebp - 0x18]
mov dword [ebp - 8], edx
cmp dword [ebp - 0x18], 0xfff
je 0x10067d29
xor eax, eax
mov ecx, dword [ebp - 0x20]
sub ecx, dword [ebp - 8]
mov edx, dword [ebp - 0x1c]
sbb edx, eax
mov eax, ecx
jmp 0x10067d6b
jmp 0x10067cd7
cmp dword [ebp - 8], 0
jbe 0x10067d5c
mov edx, dword [ebp - 0x10]
mov eax, dword [edx + 0x4c]
push eax
mov ecx, dword [ebp - 8]
push ecx
push 1
mov edx, dword [ebp + 8]
push edx
call fcn.101080b0
add esp, 0x10
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 8]
mov dword [ebp - 0x24], eax
mov ecx, dword [ebp - 0x24]
sub ecx, dword [ebp - 0x28]
mov dword [ebp - 8], ecx
xor edx, edx
mov eax, dword [ebp - 0x20]
sub eax, dword [ebp - 8]
mov ecx, dword [ebp - 0x1c]
sbb ecx, edx
mov edx, ecx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1006e560
mov esp, ebp
pop ebp
ret 0xc
Function at 0x100695e0
Capabilities:
Allocate or change rwx memory
Create thread
Inject thread
Spawn thread to rwx shellcode

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x1019a784]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 8], 0
mov dword [ebp - 0x10], 0
mov byte [ebp - 9], 0
push 0x40
push 0x3000
push 0x400
push 0
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
jne 0x10069639
push 0xcf
push 0x1006bab0
call fcn.1006bbf0
add esp, 8
jmp 0x100696b4
lea ecx, [ebp - 8]
push ecx
mov edx, dword [ebp + 0x10]
push edx
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp - 0x14]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
test eax, eax
jne 0x1006966d
push 0xd0
push 0x1006bab0
call fcn.1006bbf0
add esp, 8
jmp 0x100696b4
push 0
push 0
push 0
mov eax, dword [ebp - 0x14]
push eax
push 0
push 0
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_CreateRemoteThread]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jne 0x100696a4
push 0xd1
push 0x1006bab0
call fcn.1006bbf0
add esp, 8
jmp 0x100696b4
push 0xffffffffffffffff
mov edx, dword [ebp - 0x10]
push edx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov byte [ebp - 9], 1
mov eax, dword [ebp - 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0x4000
push 0
mov ecx, dword [ebp - 0x14]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_VirtualFreeEx]
mov al, byte [ebp - 9]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1006e560
mov esp, ebp
pop ebp
ret

Function at 0x1006b4e0
Capabilities:
Execute anti-debugging instructions
Get system information on windows
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x5c4
mov eax, dword [0x1019a784]
xor eax, ebp
mov dword [ebp - 4], eax
push 0x10134008
jmp loc.101a7f72

Function at 0x1006bbf0
Capabilities:
Find graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push 0x101340ec
jmp loc.101a9c1d

Function at 0x1006bcf0
Capabilities:
64-bit execution via heavens gate

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [0x1019a784]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
cmp dword [ebp + 8], 0
je 0x1006bd1b
cmp dword [ebp + 0xc], 0
jne 0x1006bd15
cmp dword [ebp + 0x10], 0
je 0x1006bd1b
cmp dword [ebp + 0x14], 0
jne 0x1006bd1f
xor al, al
jmp 0x1006bd83
mov byte [ebp - 5], 0
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 0x10]
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], ecx
push 0x33
call fcn.1006bd36
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1006e560
mov esp, ebp
pop ebp
ret
Function at 0x1006c1a0
Capabilities:
64-bit execution via heavens gate

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [0x1019a784]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
cmp dword [ebp + 8], 0
je 0x1006c1cb
cmp dword [ebp + 0xc], 0
jne 0x1006c1c5
cmp dword [ebp + 0x10], 0
je 0x1006c1cb
cmp dword [ebp + 0x14], 0
jne 0x1006c1cd
jmp 0x1006c220
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 0x10]
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], ecx
push 0x33
call 0x1006c1e0
add dword [esp], 5
retf
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1006e560
mov esp, ebp
pop ebp
ret

Function at 0x1006c290
Capabilities:
64-bit execution via heavens gate

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [0x1019a784]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
xorps xmm0, xmm0
movlpd qword [ebp - 0xc], xmm0
push 0x33
call fcn.1006c2b2
Function at 0x1006c5a0
Capabilities:
64-bit execution via heavens gate

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x68
mov eax, dword [0x1019a784]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
cmp dword [0x1019a724], 0
jne 0x1006c5c5
xor eax, eax
xor edx, edx
jmp 0x1006c78d
lea eax, [ebp + 0x14]
mov dword [ebp - 0x48], eax
cmp dword [ebp + 0x10], 0
jle 0x1006c5f4
mov ecx, dword [ebp + 0x10]
sub ecx, 1
mov dword [ebp + 0x10], ecx
mov edx, dword [ebp - 0x48]
add edx, 8
mov dword [ebp - 0x48], edx
mov eax, dword [ebp - 0x48]
mov ecx, dword [eax - 8]
mov edx, dword [eax - 4]
mov dword [ebp - 0x50], ecx
mov dword [ebp - 0x4c], edx
jmp 0x1006c5fc
xorps xmm0, xmm0
movlpd qword [ebp - 0x50], xmm0
mov eax, dword [ebp - 0x50]
mov ecx, dword [ebp - 0x4c]
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x20], ecx
cmp dword [ebp + 0x10], 0
jle 0x1006c631
mov edx, dword [ebp + 0x10]
sub edx, 1
mov dword [ebp + 0x10], edx
mov eax, dword [ebp - 0x48]
add eax, 8
mov dword [ebp - 0x48], eax
mov ecx, dword [ebp - 0x48]
mov edx, dword [ecx - 8]
mov eax, dword [ecx - 4]
mov dword [ebp - 0x58], edx
mov dword [ebp - 0x54], eax
jmp 0x1006c639
xorps xmm0, xmm0
movlpd qword [ebp - 0x58], xmm0
mov ecx, dword [ebp - 0x58]
mov edx, dword [ebp - 0x54]
mov dword [ebp - 0x2c], ecx
mov dword [ebp - 0x28], edx
cmp dword [ebp + 0x10], 0
jle 0x1006c66e
mov eax, dword [ebp + 0x10]
sub eax, 1
mov dword [ebp + 0x10], eax
mov ecx, dword [ebp - 0x48]
add ecx, 8
mov dword [ebp - 0x48], ecx
mov edx, dword [ebp - 0x48]
mov eax, dword [edx - 8]
mov ecx, dword [edx - 4]
mov dword [ebp - 0x60], eax
mov dword [ebp - 0x5c], ecx
jmp 0x1006c676
xorps xmm0, xmm0
movlpd qword [ebp - 0x60], xmm0
mov edx, dword [ebp - 0x60]
mov eax, dword [ebp - 0x5c]
mov dword [ebp - 0x34], edx
mov dword [ebp - 0x30], eax
cmp dword [ebp + 0x10], 0
jle 0x1006c6ab
mov ecx, dword [ebp + 0x10]
sub ecx, 1
mov dword [ebp + 0x10], ecx
mov edx, dword [ebp - 0x48]
add edx, 8
mov dword [ebp - 0x48], edx
mov eax, dword [ebp - 0x48]
mov ecx, dword [eax - 8]
mov edx, dword [eax - 4]
mov dword [ebp - 0x68], ecx
mov dword [ebp - 0x64], edx
jmp 0x1006c6b3
xorps xmm0, xmm0
movlpd qword [ebp - 0x68], xmm0
mov eax, dword [ebp - 0x68]
mov ecx, dword [ebp - 0x64]
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0x38], ecx
xorps xmm0, xmm0
movlpd qword [ebp - 0x1c], xmm0
mov edx, dword [ebp - 0x48]
add edx, 8
mov dword [ebp - 0x48], edx
mov eax, dword [ebp - 0x48]
sub eax, 8
xor ecx, ecx
mov dword [ebp - 0x44], eax
mov dword [ebp - 0x40], ecx
mov eax, dword [ebp + 0x10]
cdq
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x10], edx
mov dword [ebp - 0xc], 0
xor edx, edx
mov word [ebp - 8], dx
mov word [ebp - 8], fs
mov eax, 0x2b
mov fs, ax
mov dword [ebp - 0xc], esp
and esp, 0xfffffff0
push 0x33
call 0x1006c70e
add dword [esp], 5
retf
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1006e560
mov esp, ebp
pop ebp
ret
Function at 0x1006f820
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 0xc]
sub esp, 8
movzx eax, byte [edx]
xor eax, 0x811c9dc5
imul ecx, eax, 0x1000193
movzx eax, byte [edx + 1]
push esi
mov esi, dword [ebp + 8]
xor ecx, eax
movzx eax, byte [edx + 2]
imul ecx, ecx, 0x1000193
xor ecx, eax
movzx eax, byte [edx + 3]
imul ecx, ecx, 0x1000193
xor ecx, eax
imul eax, ecx, 0x1000193
mov ecx, esi
push eax
push edx
lea eax, [ebp - 8]
push eax
call fcn.1006fa90
mov eax, dword [eax + 4]
test eax, eax
je 0x1006f880
cmp eax, dword [esi + 4]
je 0x1006f880
mov eax, dword [eax + 0xc]
pop esi
mov esp, ebp
pop ebp
ret
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x1006fe00
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10121ea5
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push ebx
push esi
push edi
mov eax, dword [0x1019a784]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov ebx, dword [ebp + 0xc]
movzx eax, byte [ebx]
xor eax, 0x811c9dc5
imul edx, eax, 0x1000193
movzx eax, byte [ebx + 1]
xor edx, eax
movzx eax, byte [ebx + 2]
imul edx, edx, 0x1000193
xor edx, eax
movzx eax, byte [ebx + 3]
imul ecx, edx, 0x1000193
xor ecx, eax
imul eax, ecx, 0x1000193
mov ecx, edi
push eax
mov dword [ebp + 0xc], eax
lea eax, [ebp - 0x1c]
push ebx
push eax
call fcn.1006fa90
mov ecx, dword [ebp - 0x18]
test ecx, ecx
je 0x1006fe93
mov eax, dword [ebp + 8]
mov dword [eax], ecx
mov byte [eax + 4], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
cmp dword [edi + 8], 0xfffffff
je 0x1006ffef
lea eax, [edi + 4]
mov dword [ebp - 0x14], eax
push 0x10
mov dword [ebp - 4], 0
mov dword [ebp - 0x10], 0
call fcn.1006dff1
mov ecx, dword [ebx]
mov esi, eax
mov edx, dword [ebx + 4]
add esp, 4
mov dword [ebp - 0x10], esi
mov dword [esi + 8], ecx
mov dword [esi + 0xc], edx
mov ecx, dword [edi + 8]
mov ebx, dword [edi + 0x1c]
movss xmm3, dword [edi]
mov dword [ebp - 4], 1
lea eax, [ecx + 1]
movd xmm0, eax
cvtdq2pd xmm0, xmm0
shr eax, 0x1f
addsd xmm0, qword [eax*8 + 0x1014ce70]
mov eax, ebx
shr eax, 0x1f
cvtpd2ps xmm2, xmm0
movd xmm0, ebx
cvtdq2pd xmm0, xmm0
movaps xmm1, xmm2
addsd xmm0, qword [eax*8 + 0x1014ce70]
cvtpd2ps xmm0, xmm0
divss xmm1, xmm0
comiss xmm1, xmm3
jbe 0x1006ff8e
divss xmm2, xmm3
sub esp, 8
cvtps2pd xmm0, xmm2
movsd qword [ebp - 0x1c], xmm0
fld qword [ebp - 0x1c]
fstp qword [esp]
call fcn.10108a40
fstp qword [ebp - 0x1c]
movsd xmm0, qword [ebp - 0x1c]
add esp, 8
cvtpd2ps xmm0, xmm0
call fcn.1006e980
mov ecx, 8
cmp eax, ecx
cmova ecx, eax
cmp ebx, ecx
jae 0x1006ff6d
cmp ebx, 0x200
jae 0x1006ff6b
shl ebx, 3
cmp ebx, ecx
jae 0x1006ff6d
mov ebx, ecx
push ebx
mov ecx, edi
call fcn.100721a0
push dword [ebp + 0xc]
lea eax, [esi + 8]
mov ecx, edi
push eax
lea eax, [ebp - 0x1c]
push eax
call fcn.1006fa90
mov ecx, dword [edi + 8]
mov edx, dword [eax]
jmp 0x1006ff91
mov edx, dword [ebp - 0x1c]
mov ebx, dword [edx + 4]
lea eax, [ecx + 1]
mov dword [edi + 8], eax
mov dword [esi], edx
mov dword [esi + 4], ebx
mov dword [ebx], esi
mov dword [edx + 4], esi
mov eax, dword [edi + 0x18]
and eax, dword [ebp + 0xc]
mov ecx, dword [edi + 0xc]
mov esi, dword [ebp - 0x14]
mov edi, dword [ecx + eax*8]
cmp edi, dword [esi]
mov esi, dword [ebp - 0x10]
jne 0x1006ffbf
mov dword [ecx + eax*8], esi
jmp 0x1006ffce
cmp edi, edx
jne 0x1006ffc8
mov dword [ecx + eax*8], esi
jmp 0x1006ffd2
cmp dword [ecx + eax*8 + 4], ebx
jne 0x1006ffd2
mov dword [ecx + eax*8 + 4], esi
mov eax, dword [ebp + 8]
mov dword [eax], esi
mov byte [eax + 4], 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
push str.unordered_map_set_too_long
call fcn.1006cb20
int3