joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40a290
Capabilities:
Create process on windows
Terminate process

Disassembly:
sub esp, 0x474
mov eax, dword [0x413028]
xor eax, esp
mov dword [esp + 0x46c], eax
push ebx
push ebp
push esi
push edi
xor eax, eax
push 0x206
mov edi, ecx
push eax
lea ecx, [esp + 0x72]
push ecx
mov word [esp + 0x74], ax
call sub.MSVCR90.dll_memset
xor edx, edx
push 0x206
push edx
lea eax, [esp + 0x286]
push eax
mov word [esp + 0x288], dx
call sub.MSVCR90.dll_memset
push 0x44
lea ecx, [esp + 0x3c]
push 0
push ecx
call sub.MSVCR90.dll_memset
xor eax, eax
xor edx, edx
lea esi, [edi + 0x400]
mov word [esp + 0x76], dx
push esi
push str._sZVSCANAPC_API.DLL
lea edx, [esp + 0x94]
mov dword [esp + 0x3c], eax
mov dword [esp + 0x40], eax
mov dword [esp + 0x44], eax
mov dword [esp + 0x48], eax
mov dword [esp + 0x4c], 0x44
mov dword [esp + 0x78], 1
mov word [esp + 0x7c], ax
call fcn.0040aa70
push esi
push str._sZVSCANBUYNOW.EXE
lea edx, [esp + 0x2a4]
call fcn.0040aa70
add esp, 0x34
lea ecx, [esp + 0x68]
push ecx
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov esi, eax
cmp esi, 0xffffffff
jne 0x40a399
push 0x40f620
push str.c:zvUpgradeNp.log
call dword [sym.imp.MSVCR90.dll_fopen]
mov esi, eax
add esp, 8
test esi, esi
je 0x40a392
mov edi, dword [sym.imp.MSVCR90.dll_fputs]
push esi
push str.Important_file_APC_API.DLL_has_problem___
call edi
push esi
push 0x40ec00
call edi
push esi
call dword [sym.imp.MSVCR90.dll_fclose]
add esp, 0x14
xor eax, eax
jmp 0x40a456
push str.IsNPExpired
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x40a451
call eax
test eax, eax
je 0x40a451
push 0x40f620
push str.c:zvUpgradeNp.log
call dword [sym.imp.MSVCR90.dll_fopen]
mov ebx, eax
add esp, 8
test ebx, ebx
je 0x40a3f0
mov ebp, dword [sym.imp.MSVCR90.dll_fputs]
push ebx
push 0x40ff14
call ebp
push ebx
push 0x40ec00
call ebp
push ebx
call dword [sym.imp.MSVCR90.dll_fclose]
add esp, 0x14
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
xor ebx, ebx
push ebx
push ebx
push str.NPAV_Is_Expired__Please_Renew_Your_Key_
mov ecx, edi
call sub.mfc90u.dll_CWnd::MessageBoxW
lea edx, [esp + 0x10]
push edx
lea eax, [esp + 0x24]
push eax
push ebx
push ebx
push 0x8000000
push ebx
push ebx
push ebx
lea ecx, [esp + 0x290]
push ecx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x40a44a
mov edx, dword [esp + 0x14]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push edx
call esi
mov eax, dword [esp + 0x10]
push eax
mov dword [esp + 0x18], ebx
call esi
mov dword [esp + 0x10], ebx
push ebx
call dword [sym.imp.MSVCR90.dll_exit]
mov eax, 1
mov ecx, dword [esp + 0x47c]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.0040b240
add esp, 0x474
ret

Function at 0x40b240
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x413028]
jne 0x40b24a
repz ret
jmp fcn.0040b76e
Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
push 4
nop
nop
nop
nop
nop
nop
nop
pop edi
nop
nop
cmp eax, 0
nop
nop
nop
nop
je 0x430072
nop
nop
nop
mov ebx, 0x408ecc
nop
nop
mov ecx, ebx
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
push eax
nop
mov eax, ecx
nop
nop
nop
nop
nop
nop
nop
div edi
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
pop eax
nop
nop
nop
nop
nop
mov esi, 0x34f1015b
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
nop
add eax, edi
nop
loop 0x430060
nop
nop
nop
mov eax, section..data
nop
nop
cmp eax, 0
nop
nop
nop
nop
nop
nop
je 0x4300d2
nop
mov ebx, 0x42e1d0
nop
nop
nop
mov ecx, ebx
nop
nop
sub ecx, eax
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
push eax
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
div edi
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
pop eax
mov esi, 0x41040be9
nop
nop
nop
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
add eax, edi
nop
nop
loop 0x4300c0
nop
nop
popal
nop
nop
nop
nop
nop
jmp 0x401219

Function at 0x432005
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
mov eax, section..text
nop
mov ebx, 0x40c7d0
nop
nop
mov ecx, 0x7b585971
test eax, eax
nop
nop
nop
nop
nop
nop
nop
nop
je 0x43204e
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
jne 0x432024
nop
nop
nop
mov eax, section..data
nop
mov ebx, 0x42f314
nop
nop
mov ecx, 0xbda6f40
nop
nop
nop
nop
test eax, eax
nop
nop
je 0x432084
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
add eax, 4
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x43206c
nop
nop
nop
nop
nop
nop
nop
popal
nop
jmp 0x431219
Function at 0x41787c
Capabilities:
Get common file path

Disassembly:
pop es
pop esp
arpl word [ecx + 0x30f9e2a0], di
loop 0x417877
xor byte [esi + 0x5852dd86], dh
loop 0x417877
xor byte [esi + 0x5852dd86], dh
jnp 0x4178df
mov cl, 0xc
scasb al, byte es:[edi]
salc
xchg ebx, eax
sub eax, esi
aas
sbb dword [ecx], edi
rcr cl, 0x81
xchg edi, eax
add ah, byte [esp + eax*8 + 0x1a3a4358]
mov byte [0x557e7112], al
push edx
mov dl, 0xd6
and byte [esi - 0x7d61eed5], dl
jb 0x417938
ficom dword [ebp - 0x24]
pop esi
push ecx
xor byte [ebx], bh
cli
add ebx, dword [ebx]
xchg ecx, eax
sbb ah, bh
imul ebx, dword [ecx + 0x677935f0], 0x644ea9d9
adc eax, 0x22d6ddee
aam 0xc4
dec esp
fidivr word [0x52ad468a]
sub dword [ecx], 0xffffff86
cmp al, 0xa9
dec ebp
mov byte [0x5fe7555a], al
mul dword [edx]
xchg esi, eax
imul ebx, dword [edx - 0x5855ced], 0x963f8e32
adc esp, dword [ebx - 0x71cd0586]
aas
xchg esi, eax
shr dword [0xabe7fc3], cl
jecxz 0x417997
test dword [edi - 0x6b], esi
sub edx, esp
push 0xffffffffffffffa3
push edi
add ebx, ebp
ja 0x417921
daa
mov bl, 0x40
rcl dword [ebx], cl
int 4
mov esp, 0x53575677
push ebp
sub esp, 0x20
mov ecx, dword [esp + 0x48]
cmp ecx, 0
jle 0x417a7e
sub ecx, 1
mov dword [esp + 0x48], ecx
mov eax, dword [esp + 0x34]
mov ebx, dword [esp + 0x3c]
mov ecx, dword [eax]
mov edx, dword [ebx]
mov dword [esp], ecx
mov dword [esp + 0xc], edx
mov ecx, dword [eax + 4]
mov edx, dword [ebx + 4]
mov dword [esp + 4], ecx
mov dword [esp + 0x10], edx
and al, 0x10
mov ecx, dword [eax + 8]
mov edx, dword [ebx + 8]
mov dword [esp + 8], ecx
dec esp
and al, 8
or eax, 0x62e034

Function at 0x417888
Capabilities:
Get common file path

Disassembly:
not dword [edi]
les edx, [ebp + 0x16]
mov byte [0xded73a50], al
dec eax
invalid

Function at 0x417898
Capabilities:
Get common file path

Disassembly:
push ebp
dec esp
sub al, 0xeb
sub byte [eax], 0x34
xchg dword [ebx], eax
lodsd eax, dword [esi]
idiv dword [esi + 0x49]
insd dword es:[edi], dx
pop es
mov esi, 0xc4b3b396
xor eax, 0x3af7294a
push ecx
push ss
loopne 0x4178f2
sbb eax, 0x3270a652
mov ss, ebx
lodsb al, byte [esi]
ja 0x41791c
shr dword [edi + esi*2 - 0x6dbb4ca4], cl
mov bl, 0x44
xchg edx, eax
dec edi
mov ch, 0x71
leave
pop ecx
jno 0x4178bc
cmp byte [ebx + eax - 0x4b01de6f], dh
rcl bl, 0xe8
movsd dword es:[edi], dword [esi]
pop esp
xlatb
xchg byte [eax + ecx*2 + 0x26], dh
clc
jb 0x417901
outsb dx, byte [esi]
sbb ah, byte [edx + 0x557e7112]
fst st(6)
and dl, ah
les ecx, [esi + ebx*8 + 0x3d]
mov al, byte [esi - 0x53]
push edx

Function at 0x417a10
Capabilities:
Get common file path

Disassembly:
sub esp, 0x58
mov eax, dword [0x62e038]
mov dword [esp + 4], 0
push esi
lea ecx, [eax + eax]
mov eax, dword [0x62e03c]
add byte [ebx], cl
enter 0x4c89, 0x24
add al, 0x8b
dec esp
and al, 0x60
Function at 0x42d744
Capabilities:
Encode data using xor

Disassembly:
add cl, byte [ebx]
int1
lea edx, [0x7b982f2f]
mov ecx, 0x5aacd2e
mov al, 0xf4
sub ecx, dword [edx + esi]
nop
push esi
fisubr word [ebx]
or esp, dword [eax + 0xa5cc9]
add al, al
sbb dword [edi + 5], ecx
xchg ecx, eax
add al, 4
pop esp
invalid
sbb ecx, dword [edi - 0x97c299d]
jl 0x42d6e1
inc esi
dec ebx
pop ebx
outsb dx, byte [esi]
jno 0x42d703
ficom dword [edx + 0x5c]
invalid

Function at 0x436e96
Capabilities:
Encode data using xor

Disassembly:
cmpsb byte [esi], byte es:[edi]
inc eax
pop ebp
sti
mov byte [esi + esi*4 + 0x19], ah
mov dh, 0x19
mov dh, 0x19
xchg edx, eax
push 0xffffffffffffffa5
sbb edx, eax
xlatb
xor esi, dword [esi]
and eax, 0x236ca00
pop ss
mov al, 0x76
jbe 0x436e90
xchg byte [edi + 0x73], al
add al, 0xd4
inc edi
test al, 0x54
xchg ebx, eax
in al, dx
push 0xfffffffffffffff7
xchg ebx, eax
add eax, 0x63091ce6
call 0x99fadaf
les eax, [ecx]
jp 0x436ee5
retf
hlt

Function at 0x43b100
Capabilities:
Encode data using xor

Disassembly:
jp 0x43b11c
aaa
mov edx, 0xda875dd2
aaa
sbb bh, byte [ebx + 0x16]
or ebx, dword [ebx]
dec ebx
cmpsb byte [esi], byte es:[edi]
push edx
inc edi
popfd
cmp al, 0xb6
stosd dword es:[edi], eax
inc edx
jo 0x43b13d
stc
vmwrite esi, dword [esi - 0x4ebbc8ca]
mov al, byte [0x86eca661]
inc edx
mov bh, 0x41
mov dh, 0x36
aaa
inc esp
mov cl, 0xa0
popal
cmpsb byte [esi], byte es:[edi]
in al, dx
xchg byte [edx - 0x49], al
inc ecx
mov byte [0x93b9647c], al
invalid
cmp eax, 0x6eb4b78e
and ecx, dword [ecx + 0x701b45b6]
and byte [esi], dl
inc esp
outsb dx, byte [esi]
ja 0x43b13d
xchg dword [esi + 0x7b], ebp
push edx
pop ebx
mov ch, 0xd6
pop ebp
pop ss
in al, dx
adc ah, bl
cmp byte [edx - 0x7a], dl
cdq
sub bh, byte [ebx + 0x1b]
invalid

Function at 0x468d8c
Capabilities:
Encode data using xor

Disassembly:
add byte [eax - 0x3d], bh
and al, 0xf3
push eax
mov eax, 0x80ae78f0
mov al, 0x73
rcr byte [esi + 3], 1
mov byte [ebx + 0x6b01830], bh
test al, 0xde
mov al, 0x86
mov edi, 0x53734f88
invalid
jbe 0x468ca7
dec eax
pop ds
xchg edx, eax
mov ebp, 0x17dfe2bf
in eax, 0xd8
fadd dword [ecx]
mov edi, 0x201d5f52
invalid
jnp 0x468ddb
loop 0x468dc3
jmp 0xdcddeb0e
nop
pop ebp
xchg edi, eax
fdiv qword [ebp + 0x636e642e]
insd dword es:[edi], dx
daa
jp 0x468d11
ficom dword [ecx]
dec edx
int1
fsub qword [esp + ebp*2 - 0x1c897e1f]
movsb byte es:[edi], byte [esi]
insb byte es:[edi], dx
loope 0x468d11
jbe 0x468d75
movsb byte es:[edi], byte [esi]
insb byte es:[edi], dx
loope 0x468d11
jbe 0x468d75
adc dh, dl
jno 0x468d7a
sahf
hlt
push eax
xlatb
insd dword es:[edi], dx
cmc
mov al, 0x2b
invalid
pop ecx
pop ds
xchg edx, eax
xchg esi, eax
cli
int1
jl 0x468ddc
xor edi, dword [ecx]
push 0xffffffffffffff9f
xchg edx, eax
daa
invalid

Function at 0x493318
Capabilities:
Encode data using xor

Disassembly:
dec edx
test byte [ebp - 0x7b], dh
add ebp, ecx
fild word gs:[ebp - 0x1ae4698c]
xor al, 0x47
pop esi
cmc
fcomp qword [esi + 0x14]
xor eax, esp
mov al, 0x72
inc ebp
sbb al, 0xf4
pop edx
insd dword es:[edi], dx
arpl dx, cx
pop esi
sahf
push ecx
pop eax
jb 0x49331c
xor ebp, dword [ebp - 0x2b]
lea ebp, [ebx]
invalid
Function at 0x4a085c
Capabilities:
Encode data using xor

Disassembly:
sub edx, ebp
adc bl, byte [ecx]
xchg esp, eax
adc edx, eax
xchg ecx, eax
jae 0x4a088d
lahf
aaa
push cs
fst qword [ecx]
cmp al, 0x23
mov byte [eax], ah
bound eax, qword [ecx - 0x7900bdcc]
out dx, eax
out dx, eax
imul ecx, dword [edi - 0x60], 0x4a03f222
ror dword [edi + 0x11f62465], 1
std
add al, 0xa9
xor ah, byte [edx - 0x57]
cmc
stc
push ecx
push edx
invalid

Function at 0x6275d5
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov edx, dword [ebp + 8]
xor ecx, ecx
mov eax, 0x62e3c8
cmp edx, dword [eax]
je 0x6275f7
add eax, 8
inc ecx
cmp eax, 0x62e458
jl 0x6275e8
push esi
mov esi, ecx
shl esi, 3
cmp edx, dword [esi + 0x62e3c8]
jne 0x627725
mov eax, dword [0x633d60]
cmp eax, 1
je 0x6276ff
test eax, eax
jne 0x627628
cmp dword [0x62e2f0], 1
je 0x6276ff
cmp edx, 0xfc
je 0x627725
lea eax, [ebp - 0x1a4]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x62765f
lea eax, [ebp - 0x1a4]
push str._program_name_unknown_
push eax
call fcn.00627fc0
pop ecx
pop ecx
lea eax, [ebp - 0x1a4]
push edi
push eax
lea edi, [ebp - 0x1a4]
call fcn.00628450
inc eax
pop ecx
cmp eax, 0x3c
jbe 0x6276a2
lea eax, [ebp - 0x1a4]
push eax
call fcn.00628450
mov edi, eax
lea eax, [ebp - 0x1a4]
sub eax, 0x3b
push 3
add edi, eax
push 0x62c634
push edi
call fcn.0062a320
add esp, 0x10
lea eax, [ebp - 0xa0]
push str.Runtime_Error__n_nProgram:
push eax
call fcn.00627fc0
lea eax, [ebp - 0xa0]
push edi
push eax
call fcn.00627fd0
lea eax, [ebp - 0xa0]
push 0x62c614
push eax
call fcn.00627fd0
push dword [esi + 0x62e3cc]
lea eax, [ebp - 0xa0]
push eax
call fcn.00627fd0
push 0x12010
lea eax, [ebp - 0xa0]
push str.Microsoft_Visual_C_Runtime_Library
push eax
call fcn.0062a294
add esp, 0x2c
pop edi
jmp 0x627725
lea eax, [ebp + 8]
lea esi, [esi + 0x62e3cc]
push 0
push eax
push dword [esi]
call fcn.00628450
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop esi
leave
ret
Function at 0x1001d3b0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100905b7
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push esi
push edi
mov eax, dword [0x100a9040]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, edx
mov dword [ebp - 0x10], ecx
push 0x40c
call fcn.1008df78
mov ebx, eax
add esp, 4
mov dword [ebp - 0x18], ebx
mov dword [ebp - 4], 0
lea edi, [ebx + 0xc]
xorps xmm0, xmm0
mov ecx, edi
movq qword [ebx], xmm0
mov dword [ebx + 8], 0
mov dword [ebx + 4], 1
mov dword [ebx + 8], 1
mov dword [ebx], 0x1009a660
mov eax, dword [esi]
push eax
mov dword [edi + 0xc], 0
mov dword [edi + 0x20], 0
mov dword [edi + 0x24], 0
mov dword [edi + 0x28], 0
mov dword [edi + 0x2c], 0
mov dword [edi + 0x30], 0
mov dword [edi + 0x34], 0
mov dword [edi + 0x38], 0
mov dword [edi + 0x3c], 0
mov dword [edi + 0x40], 0
mov dword [edi + 0x44], 0
mov dword [edi + 0x48], 0
mov dword [edi + 0x4c], 0
mov dword [edi + 0x50], 0
mov dword [edi + 0x54], 0
mov dword [edi + 0x58], 0
mov dword [edi + 0x5c], 0
mov dword [edi + 0x60], 0
mov dword [edi + 0x64], 0
mov dword [edi + 0x68], 0
mov dword [edi + 0x6c], 0
mov dword [edi + 0x70], 0
mov dword [edi + 0x3b4], 0
mov dword [edi + 0x3b8], 0
mov dword [edi + 0x3bc], 0
mov byte [edi + 0x3c0], 0
mov dword [edi + 0x3c4], 0
mov byte [edi + 0x3c8], 0
mov dword [edi + 0x3cc], 0
mov dword [edi + 0x3d0], 0
mov dword [edi + 0x3d4], 0
mov dword [edi + 0x3d8], 0
mov dword [edi + 0x3dc], 0
mov dword [edi + 0x3e0], 0
mov word [edi + 0x3f0], 0
call fcn.10017bb0
mov eax, dword [ebp - 0x10]
xorps xmm0, xmm0
movq qword [eax], xmm0
mov dword [eax + 4], 0
mov dword [eax], edi
mov dword [eax + 4], ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10025440
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
cmp byte [0x100b6f90], 0
push ebx
push esi
push edi
je 0x100255ce
mov ecx, dword [0x100ccf50]
mov eax, dword [ecx]
mov eax, dword [eax + 0x68]
call eax
test al, al
je 0x100255ce
mov ecx, dword [0x100ccfd4]
xor ebx, ebx
mov dword [ebp - 4], ecx
mov eax, dword [ecx + 0x28]
mov dword [ebp - 8], eax
test eax, eax
je 0x100255ce
mov eax, dword [ecx + 0x1c]
mov ecx, dword [eax + ebx*4]
mov eax, dword [ecx]
mov eax, dword [eax + 0x30]
call eax
mov esi, eax
mov edi, 0x811c9dc5
xor ecx, ecx
nop word [eax + eax]
inc ecx
cmp byte [esi + ecx], 0
jne 0x100254a0
xor edx, edx
test ecx, ecx
je 0x100254c9
nop dword [eax]
movsx eax, byte [esi + edx]
inc edx
xor eax, edi
imul edi, eax, 0x1000193
cmp edx, ecx
jb 0x100254b0
cmp edi, 0x5ff56dc5
je 0x100254d8
inc ebx
cmp ebx, dword [ebp - 8]
jae 0x100255ce
mov ecx, dword [ebp - 4]
jmp 0x10025484
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x1c]
mov edi, dword [eax + ebx*4]
test edi, edi
je 0x100255ce
mov edx, dword [edi + 0x88]
test edx, edx
je 0x100255ce
movss xmm1, dword [0x1009f2d0]
xor ebx, ebx
cmp edx, 4
jl 0x1002559b
mov ecx, dword [edi + 0x7c]
lea esi, [edx - 4]
shr esi, 2
add ecx, 0x1078
inc esi
lea ebx, [esi*4]
movss xmm0, dword [ecx - 0xc60]
ucomiss xmm0, xmm1
lahf
test ah, 0x44
jp 0x1002553c
mov dword [ecx - 0xc60], 0x7f7fffff
movss xmm0, dword [ecx - 0x840]
ucomiss xmm0, xmm1
lahf
test ah, 0x44
jp 0x10025557
mov dword [ecx - 0x840], 0x7f7fffff
movss xmm0, dword [ecx - 0x420]
ucomiss xmm0, xmm1
lahf
test ah, 0x44
jp 0x10025572
mov dword [ecx - 0x420], 0x7f7fffff
movss xmm0, dword [ecx]
ucomiss xmm0, xmm1
lahf
test ah, 0x44
jp 0x10025585
mov dword [ecx], 0x7f7fffff
add ecx, 0x1080
sub esi, 1
jne 0x10025521
cmp ebx, edx
jl 0x1002559f
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
test edx, edx
jle 0x100255ce
imul ecx, ebx, 0x420
add ecx, 0x418
add ecx, dword [edi + 0x7c]
sub edx, ebx
movss xmm0, dword [ecx]
ucomiss xmm0, xmm1
lahf
test ah, 0x44
jp 0x100255c3
mov dword [ecx], 0x7f7fffff
add ecx, 0x420
sub edx, 1
jne 0x100255b0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x100272d0
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10090bf5
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push ebx
push esi
push edi
mov eax, dword [0x100a9040]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, dword [ebp + 8]
movzx eax, byte [edi]
xor eax, 0x811c9dc5
imul ecx, eax, 0x1000193
movzx eax, byte [edi + 1]
xor ecx, eax
movzx eax, byte [edi + 2]
imul ecx, ecx, 0x1000193
xor ecx, eax
movzx eax, byte [edi + 3]
imul ecx, ecx, 0x1000193
xor ecx, eax
lea eax, [ebp - 0x14]
imul ebx, ecx, 0x1000193
push ebx
push edi
push eax
call fcn.10028490
mov esi, dword [ebp - 0x10]
test esi, esi
jne 0x10027440
cmp dword [0x100d2190], 0xfffffff
jne 0x1002735a
push str.unordered_map_set_too_long
call dword [sym.imp.MSVCP140.dll_void___cdecl_std::_Xlength_error_char_const__]
mov dword [ebp - 0x1c], 0x100d218c
mov dword [ebp - 4], 0
push 0x10
mov dword [ebp - 0x18], 0
call fcn.1008df78
mov ecx, dword [edi]
mov esi, eax
add esp, 4
mov dword [ebp - 0x18], esi
mov dword [esi + 8], ecx
mov dword [esi + 0xc], 0
mov dword [ebp - 4], 1
mov ecx, dword [0x100d2190]
lea eax, [ecx + 1]
movd xmm0, eax
cvtdq2pd xmm0, xmm0
shr eax, 0x1f
addsd xmm0, qword [eax*8 + 0x1009f4c0]
mov eax, dword [0x100d21a4]
cvtpd2ps xmm1, xmm0
movd xmm0, eax
cvtdq2pd xmm0, xmm0
shr eax, 0x1f
addsd xmm0, qword [eax*8 + 0x1009f4c0]
cvtpd2ps xmm0, xmm0
divss xmm1, xmm0
comiss xmm1, dword [0x100d2188]
jbe 0x100273f9
call fcn.100282a0
push ebx
lea eax, [esi + 8]
push eax
lea eax, [ebp - 0x1c]
push eax
call fcn.10028490
mov ecx, dword [0x100d2190]
mov edx, dword [eax]
jmp 0x100273fc
mov edx, dword [ebp - 0x14]
mov edi, dword [edx + 4]
inc ecx
mov dword [0x100d2190], ecx
mov dword [esi], edx
mov dword [esi + 4], edi
mov dword [edi], esi
mov dword [edx + 4], esi
mov eax, dword [0x100d21a0]
mov ecx, dword [0x100d2194]
and eax, ebx
mov ebx, dword [ecx + eax*8]
cmp ebx, dword [0x100d218c]
jne 0x1002742d
mov dword [ecx + eax*8], esi
jmp 0x1002743c
cmp ebx, edx
jne 0x10027436
mov dword [ecx + eax*8], esi
jmp 0x10027440
cmp dword [ecx + eax*8 + 4], edi
jne 0x10027440
mov dword [ecx + eax*8 + 4], esi
lea eax, [esi + 0xc]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x10027610
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
sub esp, 0x18
mov edx, dword [ebp + 8]
push ebx
mov ebx, ecx
cmp edx, eax
je 0x10027766
mov eax, dword [ebx + 4]
mov dword [ebp - 0x14], eax
mov eax, dword [edx + 4]
mov dword [ebp - 8], eax
movzx eax, byte [edx + 8]
xor eax, 0x811c9dc5
imul ecx, eax, 0x1000193
movzx eax, byte [edx + 9]
push esi
push edi
mov edi, dword [ebx + 0xc]
mov esi, edx
xor ecx, eax
mov dword [ebp - 0x18], edi
movzx eax, byte [edx + 0xa]
imul ecx, ecx, 0x1000193
xor ecx, eax
movzx eax, byte [edx + 0xb]
imul ecx, ecx, 0x1000193
xor ecx, eax
mov eax, dword [ebx + 0x18]
imul ecx, ecx, 0x1000193
and eax, ecx
mov ecx, dword [edi + eax*8]
mov dword [ebp - 4], ecx
lea eax, [edi + eax*8]
mov dword [ebp - 0xc], eax
mov eax, dword [eax + 4]
mov dword [ebp - 0x10], eax
mov eax, esi
mov edi, esi
mov esi, dword [esi]
push 0x10
push eax
call fcn.1008e3d7
dec dword [ebx + 8]
add esp, 8
cmp edi, dword [ebp - 0x10]
je 0x100276c9
mov eax, dword [ebp + 0xc]
cmp esi, eax
jne 0x10027687
mov ecx, dword [ebp - 4]
cmp ecx, dword [ebp + 8]
jne 0x1002775c
mov edx, dword [ebp - 0xc]
mov ecx, dword [ebp - 8]
pop edi
mov dword [edx], esi
mov dword [ecx], esi
mov dword [esi + 4], ecx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
mov ecx, dword [ebp - 4]
mov edx, dword [ebp - 0xc]
cmp ecx, dword [ebp + 8]
jne 0x100276dd
mov eax, dword [ebp - 0x14]
mov ecx, eax
mov dword [edx], eax
jmp 0x100276e0
mov ecx, dword [ebp - 8]
mov eax, dword [ebp + 0xc]
mov dword [edx + 4], ecx
cmp esi, eax
je 0x1002775c
nop word [eax + eax]
movzx eax, byte [esi + 8]
xor eax, 0x811c9dc5
imul ecx, eax, 0x1000193
movzx eax, byte [esi + 9]
xor ecx, eax
movzx eax, byte [esi + 0xa]
imul ecx, ecx, 0x1000193
xor ecx, eax
movzx eax, byte [esi + 0xb]
imul ecx, ecx, 0x1000193
xor ecx, eax
mov eax, dword [ebx + 0x18]
imul ecx, ecx, 0x1000193
and eax, ecx
mov ecx, dword [ebp - 0x18]
lea eax, [ecx + eax*8]
mov dword [ebp - 4], eax
mov eax, dword [eax + 4]
mov dword [ebp - 0x10], eax
mov eax, esi
mov edi, esi
mov esi, dword [esi]
push 0x10
push eax
call fcn.1008e3d7
dec dword [ebx + 8]
add esp, 8
mov eax, dword [ebp + 0xc]
cmp edi, dword [ebp - 0x10]
je 0x1002776d
cmp esi, eax
jne 0x10027737
mov ecx, dword [ebp - 4]
mov dword [ecx], esi
mov ecx, dword [ebp - 8]
pop edi
mov dword [ecx], esi
mov dword [esi + 4], ecx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
mov ecx, dword [ebp - 4]
mov edx, dword [ebp - 0x14]
mov dword [ecx], edx
mov dword [ecx + 4], edx
cmp esi, eax
jne 0x100276f0
mov ecx, dword [ebp - 8]
pop edi
mov dword [ecx], esi
mov dword [esi + 4], ecx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x10028320
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1fffffff
sub esp, 0x10
bsr ecx, eax
push ebx
push esi
push edi
mov edi, 1
mov eax, edi
shl eax, cl
mov ecx, dword [ebp + 8]
cmp ecx, eax
jbe 0x1002834c
push str.invalid_hash_bucket_count
call dword [sym.imp.MSVCP140.dll_void___cdecl_std::_Xlength_error_char_const__]
lea eax, [ecx - 1]
mov esi, dword [0x100d218c]
or eax, 1
mov dword [ebp - 8], esi
bsr ecx, eax
push esi
lea ecx, [ecx + 1]
shl edi, cl
mov ecx, 0x100d2194
lea eax, [edi + edi]
push eax
call fcn.100277a0
mov eax, dword [0x100d218c]
lea ebx, [edi - 1]
mov dword [0x100d21a0], ebx
mov dword [0x100d21a4], edi
mov eax, dword [eax]
mov ecx, eax
cmp eax, esi
je 0x10028486
movzx edx, byte [eax + 8]
xor edx, 0x811c9dc5
mov ecx, dword [ecx]
imul edi, edx, 0x1000193
movzx edx, byte [eax + 9]
xor edi, edx
movzx edx, byte [eax + 0xa]
imul edi, edi, 0x1000193
xor edi, edx
movzx edx, byte [eax + 0xb]
imul edi, edi, 0x1000193
xor edi, edx
mov edx, dword [0x100d2194]
imul edi, edi, 0x1000193
and edi, ebx
mov ebx, dword [edx + edi*8]
lea edx, [edx + edi*8]
mov dword [ebp - 0xc], edx
cmp ebx, esi
jne 0x100283e4
mov dword [edx], eax
mov dword [edx + 4], eax
jmp 0x10028451
mov edx, dword [edx + 4]
mov edi, dword [eax + 8]
cmp edi, dword [edx + 8]
jne 0x1002841e
mov edx, dword [edx]
mov dword [ebp - 4], edx
cmp edx, eax
je 0x10028416
mov ebx, dword [eax + 4]
mov esi, dword [ebp - 4]
mov dword [ebx], ecx
mov edi, dword [ecx + 4]
mov dword [edi], edx
mov edx, dword [edx + 4]
mov dword [edx], eax
mov dword [esi + 4], edi
mov esi, dword [ebp - 8]
mov dword [ecx + 4], ebx
mov dword [eax + 4], edx
mov edx, dword [ebp - 0xc]
mov dword [edx + 4], eax
jmp 0x10028451
cmp ebx, edx
je 0x1002842e
mov edx, dword [edx + 4]
cmp edi, dword [edx + 8]
je 0x10028462
cmp ebx, edx
jne 0x10028422
mov ebx, dword [eax + 4]
mov dword [ebp - 4], ebx
mov dword [ebx], ecx
mov ebx, dword [ecx + 4]
mov dword [ebx], edx
mov edi, dword [edx + 4]
mov dword [edi], eax
mov dword [edx + 4], ebx
mov edx, dword [ebp - 4]
mov dword [ecx + 4], edx
mov edx, dword [ebp - 0xc]
mov dword [eax + 4], edi
mov dword [edx], eax
mov eax, ecx
cmp ecx, esi
je 0x10028486
mov ebx, dword [0x100d21a0]
jmp 0x10028392
mov ebx, dword [eax + 4]
mov edx, dword [edx]
mov dword [ebp - 4], edx
mov esi, edx
mov dword [ebx], ecx
mov edi, dword [ecx + 4]
mov dword [edi], edx
mov edx, dword [edx + 4]
mov dword [edx], eax
mov dword [esi + 4], edi
mov esi, dword [ebp - 8]
mov dword [ecx + 4], ebx
mov dword [eax + 4], edx
jmp 0x10028451
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4