joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1b00b769
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov edx, dword [ebp + 8]
xor ecx, ecx
mov eax, 0x1b00f190
cmp edx, dword [eax]
je 0x1b00b78b
add eax, 8
inc ecx
cmp eax, 0x1b00f220
jl 0x1b00b77c
push esi
mov esi, ecx
shl esi, 3
cmp edx, dword [esi + 0x1b00f190]
jne 0x1b00b8b9
mov eax, dword [0x1b00fbb0]
cmp eax, 1
je 0x1b00b893
test eax, eax
jne 0x1b00b7bc
cmp dword [0x1b00f0e4], 1
je 0x1b00b893
cmp edx, 0xfc
je 0x1b00b8b9
lea eax, [ebp - 0x1a4]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x1b00b7f3
lea eax, [ebp - 0x1a4]
push str._program_name_unknown_
push eax
call fcn.1b00c670
pop ecx
pop ecx
lea eax, [ebp - 0x1a4]
push edi
push eax
lea edi, [ebp - 0x1a4]
call fcn.1b00c490
inc eax
pop ecx
cmp eax, 0x3c
jbe 0x1b00b836
lea eax, [ebp - 0x1a4]
push eax
call fcn.1b00c490
mov edi, eax
lea eax, [ebp - 0x1a4]
sub eax, 0x3b
push 3
add edi, eax
push 0x1b00e45c
push edi
call fcn.1b00cf00
add esp, 0x10
lea eax, [ebp - 0xa0]
push str.Runtime_Error__n_nProgram:
push eax
call fcn.1b00c670
lea eax, [ebp - 0xa0]
push edi
push eax
call fcn.1b00c680
lea eax, [ebp - 0xa0]
push 0x1b00e43c
push eax
call fcn.1b00c680
push dword [esi + 0x1b00f194]
lea eax, [ebp - 0xa0]
push eax
call fcn.1b00c680
push 0x12010
lea eax, [ebp - 0xa0]
push str.Microsoft_Visual_C_Runtime_Library
push eax
call fcn.1b00ce75
add esp, 0x2c
pop edi
jmp 0x1b00b8b9
lea eax, [ebp + 8]
lea esi, [esi + 0x1b00f194]
push 0
push eax
push dword [esi]
call fcn.1b00c490
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop esi
leave
ret

Function at 0x98a754
Capabilities:
Encode data using xor

Disassembly:
jmp 0x98a75e
pushal
call 0x98a764
pop ebp
sub ebp, 0x10
sub ebp, 0x58a754
jmp 0x98a77a
mov eax, 0x58a754
add eax, ebp
add eax, 0x4c
mov ecx, 0x5fd
mov edx, 0x3362c64a
xor byte [eax], dl
inc eax
dec ecx
jne 0x98a791
jmp 0x98a7a4
rol dword [edi + 0x4a76c3c1], 0x4a
dec edx
retf
Function at 0x10048d72
Capabilities:
Get keyboard layout
Log keystrokes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
push ebx
push esi
push edi
xor eax, eax
mov ebx, ecx
push eax
mov dword [ebp - 0x1c], ebx
mov edi, 0x80004005
call dword [sym.imp.USER32.dll_GetKeyboardLayout]
mov esi, ebx
mov dword [ebp - 0x14], eax
xor ecx, ecx
lea edx, [esi + 2]
mov ax, word [esi]
add esi, 2
cmp ax, cx
jne 0x10048d9a
sub esi, edx
sar esi, 1
mov dword [ebp - 0x18], esi
test esi, esi
jle 0x10048ef7
lea ebx, [esi + esi]
xor ecx, ecx
push 0x1c
pop edx
mov eax, ebx
mov dword [ebp - 0x20], ebx
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.1001b624
mov dword [ebp - 0x24], eax
pop ecx
test eax, eax
je 0x10048ef7
xor ecx, ecx
lea edi, [eax + 4]
mov edx, ecx
mov dword [ebp - 4], ecx
mov ecx, dword [ebp - 0x14]
mov eax, esi
mov dword [ebp - 0xc], edx
mov ebx, esi
mov dword [ebp - 8], edi
test ecx, ecx
je 0x10048e65
neg eax
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x1c]
lea esi, [edi - 4]
push ecx
xor ecx, ecx
mov dword [esi], 1
push ecx
movzx eax, word [eax + edx*2]
push eax
mov word [edi], ax
call dword [sym.imp.USER32.dll_MapVirtualKeyExW]
mov word [edi + 2], ax
xor eax, eax
mov dword [edi + 4], eax
call dword [sym.imp.api_ms_win_core_sysinfo_l1_1_0.dll_GetTickCount]
mov edx, dword [ebp - 0x10]
add eax, edx
add dword [ebp - 4], 2
mov dword [edi + 8], eax
xor eax, eax
mov dword [edi + 0xc], eax
add edi, 0x18
mov eax, dword [ebp - 0xc]
push 7
pop ecx
rep movsd dword es:[edi], dword [esi]
mov edi, dword [ebp - 8]
mov ecx, dword [ebp - 0x14]
or dword [edi + 0x20], 2
inc eax
inc edx
mov dword [ebp - 0xc], eax
add edi, 0x38
mov dword [ebp - 0x10], edx
mov dword [ebp - 8], edi
mov edx, eax
cmp eax, ebx
jl 0x10048dfc
jmp 0x10048ed2
xor edx, edx
neg eax
mov ecx, edx
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x14], ecx
mov eax, dword [ebp - 0x1c]
lea esi, [edi - 4]
push edx
mov dword [esi], 1
movzx eax, word [eax + ecx*2]
push eax
mov word [edi], ax
call dword [sym.imp.USER32.dll_MapVirtualKeyW]
mov word [edi + 2], ax
xor eax, eax
mov dword [edi + 4], eax
call dword [sym.imp.api_ms_win_core_sysinfo_l1_1_0.dll_GetTickCount]
mov edx, dword [ebp - 0x10]
add eax, edx
add dword [ebp - 4], 2
mov dword [edi + 8], eax
xor eax, eax
mov dword [edi + 0xc], eax
add edi, 0x18
push 7
pop ecx
rep movsd dword es:[edi], dword [esi]
mov edi, dword [ebp - 8]
mov ecx, dword [ebp - 0x14]
push eax
or dword [edi + 0x20], 2
inc ecx
inc edx
mov dword [ebp - 0x14], ecx
add edi, 0x38
mov dword [ebp - 0x10], edx
mov dword [ebp - 8], edi
pop edx
cmp ecx, ebx
jl 0x10048e71
mov esi, dword [ebp - 0x24]
mov ebx, dword [ebp - 0x20]
push 0x1c
push esi
push ebx
call dword [sym.imp.USER32.dll_SendInput]
sub ebx, eax
neg ebx
push esi
sbb ebx, ebx
and ebx, 0x80004005
mov edi, ebx
call fcn.1001b64d
pop ecx
mov eax, edi
pop edi
pop esi
pop ebx
leave
ret

Function at 0x1004eb43
Capabilities:
Contain obfuscated stackstrings

Disassembly:
test dword [edi + edi*8 - 1], eax
dec dword [ebp + 0x5d88d445]
mov byte [ebp - 0x2c], bl
push eax
Function at 0x1004eb4b
Capabilities:
Contain obfuscated stackstrings

Disassembly:
test dword [edi + edi*8 - 1], eax
dec dword [ebp + 0x5d88d445]
mov byte [ebp - 0x2c], bl
push eax
Function at 0x50ce50
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.QNhjSkbP
lea edi, [esi - 0x9000]
push edi
or ebp, 0xffffffff
jmp 0x50ce72
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x50ce79
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x50ce68
mov eax, 1
add ebx, ebx
jne 0x50ce8b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x50ce80
jne 0x50ce9c
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x50ce80
xor ecx, ecx
sub eax, 3
jb 0x50ceb0
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x50cf22
mov ebp, eax
add ebx, ebx
jne 0x50cebb
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x50cec8
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x50ceec
inc ecx
add ebx, ebx
jne 0x50ced8
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x50cecd
jne 0x50cee9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x50cecd
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x50cf0c
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x50cefd
jmp 0x50ce6e
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x50cf0c
add edi, ecx
jmp 0x50ce6e
pop esi
lea edi, [esi + 0xa000]
mov eax, dword [edi]
or eax, eax
je 0x50cf6b
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0xeacc]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0xeb24]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x50cf29
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0xeb2c]
or eax, eax
je 0x50cf65
mov dword [ebx], eax
add ebx, 4
jmp 0x50cf46
call dword [esi + 0xeb28]
mov ebp, dword [esi + 0xeb30]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x20f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x50cf9f
sub esp, 0xffffff80
jmp section.bUItIFMf

Function at 0x408931
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x4085d8
and esi, esi
call fcn.0040894e
sub esi, ebx
xor dword [edx], eax
add esi, esi
inc edx
sub ebx, ebx
cmp edx, ecx
jne fcn.00408931
and esi, esi
inc ebx
ret
Function at 0x412820
Capabilities:
Parse pe header

Disassembly:
push 0xc
push 0x412d70
call fcn.00412b1c
xor ecx, ecx
mov eax, dword [ebp + 8]
test eax, eax
je 0x412880
cmp eax, 0xffffffff
je 0x412880
mov dword [ebp - 4], ecx
mov edx, 0x5a4d
cmp word [eax], dx
jne 0x412879
mov edx, dword [eax + 0x3c]
test edx, edx
js 0x412879
cmp edx, 0x10000000
jae 0x412879
add eax, edx
mov dword [ebp - 0x1c], eax
mov ecx, dword [eax]
sub ecx, 0x4550
neg ecx
sbb ecx, ecx
not ecx
and ecx, eax
jmp 0x412876
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 4], 0xfffffffe
mov eax, ecx
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
leave
ret 4

Function at 0x412900
Capabilities:
Enumerate pe sections

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
xor edx, edx
push ebx
push esi
push edi
mov ecx, dword [eax + 0x3c]
add ecx, eax
movzx eax, word [ecx + 0x14]
movzx ebx, word [ecx + 6]
add eax, 0x18
add eax, ecx
test ebx, ebx
je 0x41293e
mov edi, dword [ebp + 0xc]
mov esi, dword [eax + 0xc]
cmp edi, esi
jb 0x412936
mov ecx, dword [eax + 8]
add ecx, esi
cmp edi, ecx
jb 0x412940
inc edx
add eax, 0x28
cmp edx, ebx
jb 0x412926
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x412a20
Capabilities:
Parse pe header

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x412a4f
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x412a4f
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret

Function at 0x431000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43100c
pop eax
nop
nop
nop
nop
nop
add eax, 0x403e6a
nop
nop
sub eax, 0x403e10
nop
nop
mov ebx, dword [eax]
nop
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
xor dword [ebx], edx
nop
add ebx, 4
nop
nop
nop
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
jl 0x431030
nop
nop
add eax, 0xc
nop
nop
nop
nop
nop
nop
cmp dword [eax], 0
nop
nop
nop
nop
jne 0x43101e
nop
nop
popal
nop
nop
nop
jmp loc.00401219
Function at 0x68f98d
Capabilities:
Encode data using xor

Disassembly:
push ebp
push esp
inc esp
leave
fldcw word [edi + 0x7f]
xor ah, byte [edx]
dec ebp
pop ebp
push eax
inc eax
mul dh
stosd dword es:[edi], eax
mov ebx, 0x3727aaba
adc dword [ecx + 0x6f7fccdc], 0xd4c47262
cdq
mov dword [eax - 0x4cfaea68], ecx
mov dword [0x8191feee], eax
mov word [edx + ebp + 0x6667773a], ds
jbe 0x68f9bc
ja 0x68fa25
jbe 0x68f9bc
jmp 0x68fa20
inc esi
sub dword [ecx], edi
xor al, 0x24
xchg edx, eax
or bh, 0xdf
fmulp st(6)
inc ebx
push ebx
in eax, 0xf5
mov eax, 0xbf8ba3a8
xchg edi, eax
sbb dh, byte [edx]
inc esi
outsb dx, byte [esi]
and dword [ecx], ecx
mov ebp, 0x44301895
insb byte es:[edi], dx
cmpsd dword [esi], dword es:[edi]
invalid
mov ecx, 0x40341c91
push 0xeec6f2da
arpl word [ebx + 0x3f], cx
pop ss
pop eax
jo 0x68f9f5
in al, dx
popal
dec ecx
cmp eax, 0xc2f6de15
ljmp 0x745c

Function at 0x725f0d
Capabilities:
Encode data using xor

Disassembly:
mov ebp, 0xe97bd3b0
mov ch, 0xc2
and edi, esp
rcl dword [edx], cl
inc eax
add byte [ebx + 0x980e3fc], dl
pop ebx
push ebx
mov esp, 0x8e7cfcf8
invalid
Function at 0x437a10
Capabilities:
Get hostname

Disassembly:
sub esp, 0x42c
mov eax, dword [0x43b004]
xor eax, esp
mov dword [esp + 0x428], eax
cmp edi, 0x182
jne 0x437a3b
lea eax, [esp + 0xc]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_BuildCommDCBW]
jmp 0x437a75
cmp edi, 0x19f
jne 0x437a75
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetNumaNodeProcessorMask]
push str.fihiresaduduvakuzafanenazewuduhe
push str.vabunayadedifecibu
push str.yosavagenisusoluselidesuli
push str.nibezitihomoyaradilocaxihenazigo
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringA]
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_RaiseException]
push esi
xor esi, esi
test edi, edi
jle 0x437ae2
lea esp, [esp]
lea ecx, [esp + 8]
mov dword [esp + 4], 5
mov dword [esp + 8], 0
call fcn.00437a00
mov eax, dword [esp + 8]
add eax, 0x46
mov dword [esp + 4], eax
sub dword [esp + 4], 0x46
mov cl, byte [esp + 4]
xor byte [ebx + esi], cl
cmp edi, 0xf
jne 0x437add
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetNumaNodeProcessorMask]
lea edx, [esp + 0xc]
push edx
lea eax, [esp + 0x30]
push eax
call dword [sym.imp.KERNEL32.dll_GetComputerNameA]
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetCalendarInfoW]
inc esi
cmp esi, edi
jl 0x437a80
pop esi
cmp edi, 0x2d
jne 0x437afc
mov dword [0x515500], 0xa62e7790
mov dword [0x515504], 0xffffffff
mov ecx, dword [esp + 0x428]
xor ecx, esp
call fcn.00401000
add esp, 0x42c
ret
Function at 0x10017dd0
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x101a5b2b
mov eax, dword fs:[0]
push eax
sub esp, 0x2c
push ebx
push esi
push edi
mov eax, dword [0x104cdec0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x14], edi
mov esi, dword [ebp + 8]
mov dword [ebp - 0x30], edi
push 0x10
mov eax, dword [esi]
mov dword [edi], eax
mov dword [edi + 4], 0
mov dword [edi + 8], 0
call fcn.101a3a03
add esp, 4
mov dword [eax], eax
mov dword [eax + 4], eax
mov dword [edi + 4], eax
lea ecx, [edi + 0xc]
mov dword [ebp - 4], 0
mov dword [ecx], 0
mov dword [ecx + 4], 0
mov dword [ecx + 8], 0
mov eax, dword [esi + 0x18]
mov dword [edi + 0x18], eax
mov eax, dword [esi + 0x1c]
mov dword [edi + 0x1c], eax
mov eax, dword [esi + 0x10]
sub eax, dword [esi + 0xc]
push dword [edi + 4]
sar eax, 2
push eax
mov byte [ebp - 4], 1
call fcn.100258c0
mov eax, dword [esi + 4]
mov dword [ebp - 0x14], eax
mov esi, dword [eax]
cmp esi, eax
je 0x10017fab
nop word [eax + eax]
movzx eax, byte [esi + 8]
lea ebx, [esi + 8]
xor eax, 0x811c9dc5
imul ecx, eax, 0x1000193
movzx eax, byte [ebx + 1]
xor ecx, eax
movzx eax, byte [ebx + 2]
imul ecx, ecx, 0x1000193
xor ecx, eax
movzx eax, byte [ebx + 3]
imul ecx, ecx, 0x1000193
xor ecx, eax
imul eax, ecx, 0x1000193
mov ecx, edi
push eax
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x1c]
push ebx
push eax
call fcn.10018e80
cmp dword [ebp - 0x18], 0
jne 0x10017fa0
cmp dword [edi + 8], 0xfffffff
je 0x10017fc1
lea eax, [edi + 4]
mov dword [ebp - 0x2c], eax
push 0x10
mov byte [ebp - 4], 2
mov dword [ebp - 0x28], 0
call fcn.101a3a03
mov ecx, dword [ebx + 4]
add esp, 4
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x28], eax
lea edx, [eax + 8]
mov eax, dword [ebx]
mov dword [ebp - 0x20], edx
mov dword [edx], eax
mov dword [edx + 4], ecx
mov ecx, dword [edi + 8]
inc ecx
mov byte [ebp - 4], 3
mov eax, ecx
shr eax, 0x1f
movd xmm0, ecx
cvtdq2pd xmm0, xmm0
addsd xmm0, qword [eax*8 + 0x101bc260]
mov eax, dword [edi + 0x1c]
cvtpd2ps xmm1, xmm0
movd xmm0, eax
cvtdq2pd xmm0, xmm0
shr eax, 0x1f
addsd xmm0, qword [eax*8 + 0x101bc260]
cvtpd2ps xmm0, xmm0
divss xmm1, xmm0
comiss xmm1, dword [edi]
jbe 0x10017f83
push ecx
mov ecx, edi
call fcn.10025b40
push eax
mov ecx, edi
call fcn.10025c30
mov ebx, dword [ebp - 0x10]
lea eax, [ebp - 0x38]
push ebx
push dword [ebp - 0x20]
mov ecx, edi
push eax
call fcn.10018e80
mov ecx, dword [eax]
mov eax, dword [eax + 4]
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 0x18], eax
jmp 0x10017f89
mov ecx, dword [ebp - 0x1c]
mov ebx, dword [ebp - 0x10]
push dword [ebp - 0x24]
mov dword [ebp - 0x28], 0
push ecx
push ebx
mov ecx, edi
call fcn.10026490
mov byte [ebp - 4], 1
mov esi, dword [esi]
cmp esi, dword [ebp - 0x14]
jne 0x10017e80
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
push str.unordered_map_set_too_long
call sub.MSVCP140.dll_void___cdecl_std::_Xlength_error_char_const__
int3
Function at 0x1001a5f0
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x101a5e8f
mov eax, dword fs:[0]
push eax
sub esp, 8
push esi
mov eax, dword [0x104cdec0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
mov dword [esi], 0x4c155a19
lea eax, [esi + 0x9c]
mov dword [esi + 4], 0x4c225a28
mov dword [esi + 8], 0x9937b441
mov dword [esi + 0xc], 0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
mov dword [esi + 0x18], 0
mov dword [esi + 0x1c], 0xc2b40000
mov dword [esi + 0x20], 0
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0x42b40000
mov dword [esi + 0x2c], 0
mov dword [esi + 0x30], 0
mov dword [esi + 0x34], 0x43340000
mov dword [esi + 0x38], 0
mov dword [esi + 0x3c], 0xc2a00000
mov dword [esi + 0x40], 0
mov dword [esi + 0x44], 0
mov dword [esi + 0x48], 0xc2a00000
mov dword [esi + 0x4c], 0xc2b40000
mov dword [esi + 0x50], 0
mov dword [esi + 0x54], 0xc2a00000
mov dword [esi + 0x58], 0x42b40000
mov dword [esi + 0x5c], 0
mov dword [esi + 0x60], 0xc2a00000
mov dword [esi + 0x64], 0x43340000
mov dword [esi + 0x68], 0
push 0x1001b400
mov dword [esi + 0x6c], 0x42a00000
mov dword [esi + 0x70], 0
mov dword [esi + 0x74], 0
push 0x1001a250
mov dword [esi + 0x78], 0x42a00000
mov dword [esi + 0x7c], 0xc2b40000
mov dword [esi + 0x80], 0
push 0x40
mov dword [esi + 0x84], 0x42a00000
mov dword [esi + 0x88], 0x42b40000
mov dword [esi + 0x8c], 0
push 0x2670
push eax
mov dword [esi + 0x90], 0x42a00000
mov dword [esi + 0x94], 0x43340000
mov dword [esi + 0x98], 0
mov dword [ebp - 0x14], eax
call fcn.101a387a
mov dword [ebp - 4], 0
lea eax, [esi + 0x99c9c]
push 0x1001b760
push 0x1001aa70
push 0x40
push 0x208
push eax
mov byte [ebp - 4], 1
call fcn.101a387a
mov dword [esi + 0xa1e9c], 0
mov dword [esi + 0xa1ea0], 0
mov dword [esi + 0xa1ea4], 0
mov ecx, 0x40
lea eax, [esi + 0xa36b8]
mov dword [eax - 8], 0
lea eax, [eax + 0x1840]
mov dword [eax - 0x1844], 0
mov dword [eax - 0x1840], 0
mov dword [eax - 0x183c], 0
mov dword [eax - 0x1838], 0
mov dword [eax - 0x1834], 0
mov dword [eax - 0x1830], 0
mov dword [eax - 0x182c], 0
mov dword [eax - 0x1828], 0
mov dword [eax - 0x1824], 0
mov dword [eax - 0x1820], 0
mov dword [eax - 0x181c], 0
mov dword [eax - 0x1818], 0
mov dword [eax - 0x1814], 0
mov dword [eax - 0x1810], 0
sub ecx, 1
jne 0x1001a7b1
mov dword [esi + 0x102ec8], ecx
mov eax, esi
mov dword [esi + 0x102ecc], ecx
mov dword [esi + 0x102ed0], ecx
mov dword [esi + 0x102ed4], ecx
mov dword [esi + 0x102ed8], ecx
mov dword [esi + 0x102edc], ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x1001bf90
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x101a5f65
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push ebx
push esi
push edi
mov eax, dword [0x104cdec0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov edi, dword [ebp + 8]
movzx eax, byte [edi]
xor eax, 0x811c9dc5
imul ecx, eax, 0x1000193
movzx eax, byte [edi + 1]
xor ecx, eax
movzx eax, byte [edi + 2]
imul ecx, ecx, 0x1000193
xor ecx, eax
movzx eax, byte [edi + 3]
imul ecx, ecx, 0x1000193
xor ecx, eax
lea eax, [ebp - 0x14]
imul ebx, ecx, 0x1000193
mov ecx, esi
push ebx
push edi
push eax
call fcn.10018e80
mov eax, dword [ebp - 0x10]
test eax, eax
jne 0x1001c0be
cmp dword [esi + 8], 0xfffffff
je 0x1001c0d5
lea eax, [esi + 4]
mov dword [ebp - 0x20], eax
push 0x10
mov dword [ebp - 4], 0
mov dword [ebp - 0x1c], 0
call fcn.101a3a03
mov dword [ebp - 0x1c], eax
add esp, 4
lea ecx, [eax + 8]
mov eax, dword [edi]
mov dword [ebp - 0x18], ecx
mov dword [ecx], eax
mov byte [ecx + 4], 0
mov ecx, dword [esi + 8]
inc ecx
mov dword [ebp - 4], 1
mov eax, ecx
shr eax, 0x1f
movd xmm0, ecx
cvtdq2pd xmm0, xmm0
addsd xmm0, qword [eax*8 + 0x101bc260]
mov eax, dword [esi + 0x1c]
cvtpd2ps xmm1, xmm0
movd xmm0, eax
cvtdq2pd xmm0, xmm0
shr eax, 0x1f
addsd xmm0, qword [eax*8 + 0x101bc260]
cvtpd2ps xmm0, xmm0
divss xmm1, xmm0
comiss xmm1, dword [esi]
jbe 0x1001c0af
push ecx
mov ecx, esi
call fcn.10025b40
push eax
mov ecx, esi
call fcn.10025c30
push ebx
push dword [ebp - 0x18]
lea eax, [ebp - 0x14]
mov ecx, esi
push eax
call fcn.10018e80
mov ecx, dword [eax]
jmp 0x1001c0b2
mov ecx, dword [ebp - 0x14]
push dword [ebp - 0x1c]
push ecx
push ebx
mov ecx, esi
call fcn.10026490
add eax, 0xc
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
push str.unordered_map_set_too_long
call sub.MSVCP140.dll_void___cdecl_std::_Xlength_error_char_const__
int3
Function at 0x10025c30
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
mov ebx, ecx
mov eax, 0x1fffffff
bsr ecx, eax
push esi
push edi
mov edi, 1
mov dword [ebp - 8], ebx
mov eax, edi
shl eax, cl
mov ecx, dword [ebp + 8]
cmp ecx, eax
ja 0x10025d99
lea eax, [ecx - 1]
mov esi, dword [ebx + 4]
or eax, edi
mov dword [ebp - 0xc], esi
bsr ecx, eax
push esi
lea ecx, [ecx + 1]
shl edi, cl
lea ecx, [ebx + 0xc]
lea eax, [edi + edi]
push eax
call fcn.100258c0
lea eax, [edi - 1]
mov dword [ebx + 0x1c], edi
mov dword [ebx + 0x18], eax
mov eax, dword [ebx + 4]
mov eax, dword [eax]
mov ecx, eax
cmp eax, esi
je 0x10025d5d
movzx edx, byte [eax + 8]
xor edx, 0x811c9dc5
mov ecx, dword [ecx]
imul edi, edx, 0x1000193
movzx edx, byte [eax + 9]
xor edi, edx
movzx edx, byte [eax + 0xa]
imul edi, edi, 0x1000193
xor edi, edx
movzx edx, byte [eax + 0xb]
imul edi, edi, 0x1000193
xor edi, edx
imul edx, edi, 0x1000193
mov edi, dword [ebx + 0x18]
and edi, edx
mov edx, dword [ebx + 0xc]
lea edx, [edx + edi*8]
mov edi, dword [edx]
mov dword [ebp - 0x10], edx
cmp edi, esi
jne 0x10025ce3
mov dword [edx], eax
mov dword [edx + 4], eax
jmp 0x10025d53
mov edx, dword [edx + 4]
mov ebx, dword [eax + 8]
cmp ebx, dword [edx + 8]
jne 0x10025d1d
mov edx, dword [edx]
mov dword [ebp - 4], edx
cmp edx, eax
je 0x10025d15
mov ebx, dword [eax + 4]
mov esi, dword [ebp - 4]
mov dword [ebx], ecx
mov edi, dword [ecx + 4]
mov dword [edi], edx
mov edx, dword [edx + 4]
mov dword [edx], eax
mov dword [esi + 4], edi
mov esi, dword [ebp - 0xc]
mov dword [ecx + 4], ebx
mov dword [eax + 4], edx
mov edx, dword [ebp - 0x10]
mov dword [edx + 4], eax
jmp 0x10025d50
cmp edi, edx
je 0x10025d2d
mov edx, dword [edx + 4]
cmp ebx, dword [edx + 8]
je 0x10025d75
cmp edi, edx
jne 0x10025d21
mov ebx, dword [eax + 4]
mov dword [ebp - 4], ebx
mov dword [ebx], ecx
mov ebx, dword [ecx + 4]
mov dword [ebx], edx
mov edi, dword [edx + 4]
mov dword [edi], eax
mov dword [edx + 4], ebx
mov edx, dword [ebp - 4]
mov dword [ecx + 4], edx
mov edx, dword [ebp - 0x10]
mov dword [eax + 4], edi
mov dword [edx], eax
mov ebx, dword [ebp - 8]
mov eax, ecx
cmp ecx, esi
jne 0x10025c92
lea ecx, [ebp - 4]
mov dword [ebp - 4], 0
call fcn.1001b580
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
mov ebx, dword [eax + 4]
mov edx, dword [edx]
mov dword [ebp - 4], edx
mov esi, edx
mov dword [ebx], ecx
mov edi, dword [ecx + 4]
mov dword [edi], edx
mov edx, dword [edx + 4]
mov dword [edx], eax
mov dword [esi + 4], edi
mov esi, dword [ebp - 0xc]
mov dword [ecx + 4], ebx
mov dword [eax + 4], edx
jmp 0x10025d50
push str.invalid_hash_bucket_count
call sub.MSVCP140.dll_void___cdecl_std::_Xlength_error_char_const__
int3