joyce8/EMBER2024-capa huggingface dataset:
Function at 0x450d96
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [0x49b3e4]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x10]
push ebx
mov ebx, ecx
mov ecx, dword [ebp + 8]
push esi
mov esi, dword [ebp + 0x18]
push edi
and dword [ebx + 0x474], 0
mov edi, dword [ebp + 0x1c]
mov dword [ebx + 0x20], eax
mov eax, dword [ebp + 0x14]
mov dword [ebx + 0x24], eax
mov eax, dword [ebp + 0xc]
mov dword [ebx + 0x28], eax
mov eax, dword [ebp + 0x20]
mov dword [ebp - 0x18], esi
mov dword [ebx + 0x470], ecx
mov dword [ebx + 0x478], eax
test ecx, ecx
jne 0x450e01
call fcn.00450b5d
push esi
mov ecx, eax
mov edx, dword [eax]
call dword [edx + 0xc]
test edi, edi
je 0x450e01
call fcn.00450b5d
push edi
mov ecx, eax
mov edx, dword [eax]
call dword [edx + 0x14]
call fcn.00450b5d
mov esi, ebx
lea edx, [ebx + 0x10]
neg esi
mov ecx, eax
mov edi, dword [eax]
sbb esi, esi
and esi, edx
push esi
call dword [edi]
mov ecx, dword [ebx + 0x470]
test ecx, ecx
jne 0x450e27
mov ecx, dword [ebp - 0x18]
jmp 0x450e2e
mov eax, dword [ecx]
call dword [eax + 0x1c]
mov ecx, eax
call fcn.00416668
lea ecx, [ebp - 0x14]
mov dword [ebp - 0x18], eax
call fcn.0040d2cc
push 0
sub esp, 0x10
mov esi, eax
mov edi, esp
mov ecx, ebx
push 0x88
movsd dword es:[edi], dword [esi]
push SysReAllocString
push 0
push dword [ebp - 0x18]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
call fcn.0041b57c
mov esi, dword [ebx + 4]
mov edi, dword [sym.imp.USER32.dll_GetParent]
jmp 0x450e71
push esi
call edi
mov esi, eax
push esi
call edi
test eax, eax
jne 0x450e6c
push 5
push dword [ebx + 4]
call dword [sym.imp.USER32.dll_ShowWindow]
push 0
push 1
push 0x86
push esi
call dword [sym.imp.USER32.dll_SendMessageW]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00457d74
mov esp, ebp
pop ebp
ret 0x1c

Function at 0x4568e4
Capabilities:
Get keyboard layout
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
mov eax, dword [0x49b3e4]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
xor esi, esi
push esi
mov dword [ebp - 0x210], esi
call dword [sym.imp.USER32.dll_GetKeyboardLayout]
push eax
push esi
mov esi, dword [ebp + 0xc]
push esi
call dword [sym.imp.USER32.dll_MapVirtualKeyExW]
mov edi, eax
cmp esi, 0x21
jb 0x456932
cmp esi, 0x28
jbe 0x45692c
lea eax, [esi - 0x2d]
cmp eax, 1
ja 0x456932
or edi, 0x100
push 0x208
lea eax, [ebp - 0x20c]
push 0
push eax
call fcn.00459940
add esp, 0xc
lea eax, [ebp - 0x20c]
mov ecx, edi
or ecx, 0x1000000
cmp dword [ebp + 0x10], 0
push 0x104
cmove ecx, edi
push eax
shl ecx, 0x10
push ecx
call dword [sym.imp.USER32.dll_GetKeyNameTextW]
push 0xffffffffffffffff
lea eax, [ebp - 0x20c]
mov ecx, ebx
push eax
call fcn.0040d315
mov ecx, dword [ebp - 4]
mov eax, ebx
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00457d74
mov esp, ebp
pop ebp
ret 0xc
Function at 0x456c25
Capabilities:
Hide graphical window

Disassembly:
push 0x98
mov eax, 0x47689b
call fcn.004585cc
mov ebx, ecx
mov eax, dword [ebp + 8]
mov dword [ebx + 0x10], eax
test eax, eax
je 0x456d2c
lea eax, [ebp - 0xa4]
push eax
call fcn.004563c4
mov ecx, dword [ebx + 0x10]
lea esi, [ebp - 0xa4]
xor eax, eax
push eax
sub esp, 0x10
mov ecx, dword [ecx + 0x44]
mov edi, esp
push eax
movsd dword es:[edi], dword [esi]
push 0x40000080
push eax
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
call fcn.00416668
push eax
mov ecx, ebx
call fcn.0041b57c
push eax
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x456d2c
mov ecx, dword [ebx + 0x10]
call fcn.0043c983
mov ecx, dword [ebx + 0x10]
push eax
mov ecx, dword [ecx + 0x44]
call fcn.00416295
push 1
push dword [eax]
push 0x30
push dword [ebx + 4]
call dword [sym.imp.USER32.dll_SendMessageW]
mov ecx, dword [ebx + 0x10]
movzx eax, word [ecx + 0x70e]
push eax
movzx eax, word [ecx + 0x70c]
mov ecx, ebx
push eax
call fcn.0045715d
lea eax, [ebp - 0x94]
mov ecx, ebx
push eax
call fcn.00456736
mov ecx, dword [ebx + 0x10]
and dword [ebp - 4], 0
add ecx, 0x1c8
push eax
call fcn.0040d496
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x94]
call fcn.0040d417
mov ecx, dword [ebx + 0x10]
mov eax, dword [ecx]
call dword [eax + 0x100]
xor ecx, ecx
cmp al, 1
sete cl
push ecx
push dword [ebx + 4]
call dword [sym.imp.USER32.dll_EnableWindow]
push 4
push dword [ebx + 4]
call dword [sym.imp.USER32.dll_ShowWindow]
push dword [ebx + 4]
call dword [sym.imp.USER32.dll_SetFocus]
mov byte [ebx + 0x18], 1
call fcn.00458587
ret 4

Function at 0x46b7a4
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.0046b623

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx

Function at 0x401000
Capabilities:
Log keystrokes via polling

Disassembly:
mov ecx, 0x5bfe
mov eax, ecx
mov dword [0x4b4752], eax
mov dword [0x4b4739], 0
mov eax, dword [0x4b4739]
mov dword [0x4b48ef], eax
mov dword [0x4b49c1], 0
mov eax, dword [0x4b49c1]
mov eax, ebx
xor ebx, eax
test dword [0x4b428b], eax
jne 0x401045
mov ebx, 0x19c2
sub eax, ebx
dec eax
shl eax, 1
ror eax, 1
or eax, dword [0x4b43b9]
je 0x401077
sub eax, dword [0x4b47dd]
dec eax
mov ebx, 0x11e8
add eax, ebx
dec eax
or eax, ebx
mov ebx, 0x1dd0
sub eax, ebx
add eax, dword [0x4b4a1d]
xor ebx, eax
sub eax, dword [0x4b46db]
shr eax, 1
add dword [0x4b42db], eax
jmp fcn.00402754
Function at 0xbcd2e0
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x4c8000]
push edi
jmp 0xbcd2fa
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0xbcd301
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0xbcd2f0
mov eax, 1
add ebx, ebx
jne 0xbcd313
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0xbcd324
jne 0xbcd343
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0xbcd343
dec eax
add ebx, ebx
jne 0xbcd330
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0xbcd308
add ebx, ebx
jne 0xbcd33f
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0xbcd395
xor ecx, ecx
sub eax, 3
jb 0xbcd35b
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0xbcd3ca
sar eax, 1
mov ebp, eax
jmp 0xbcd366
add ebx, ebx
jne 0xbcd366
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0xbcd334
inc ecx
add ebx, ebx
jne 0xbcd374
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0xbcd334
add ebx, ebx
jne 0xbcd381
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0xbcd376
jne 0xbcd392
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0xbcd376
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0xbcd3b4
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0xbcd3a6
jmp 0xbcd2f6
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0xbcd3b4
add edi, ecx
jmp 0xbcd2f6
pop esi
mov edi, esi
mov ecx, 0x17ec6
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0xbcd3d2
cmp byte [edi], 0x22
jne 0xbcd3d2
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0xbcd3d7
lea edi, [esi + 0x7b0000]
mov eax, dword [edi]
or eax, eax
je 0xbcd44f
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x7d796c]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x7d7b24]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0xbcd404
mov ecx, edi
jns 0xbcd433
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x7d7b28]
or eax, eax
je 0xbcd449
mov dword [ebx], eax
add ebx, 4
jmp 0xbcd421
call dword [esi + 0x7d7b38]
add edi, 4
lea ebx, [esi - 4]
xor eax, eax
mov al, byte [edi]
inc edi
or eax, eax
je 0xbcd480
cmp al, 0xef
ja 0xbcd473
add ebx, eax
mov eax, dword [ebx]
xchg ah, al
rol eax, 0x10
xchg ah, al
add eax, esi
mov dword [ebx], eax
jmp 0xbcd455
and al, 0xf
shl eax, 0x10
mov ax, word [edi]
add edi, 2
jmp 0xbcd462
mov ebp, dword [esi + 0x7d7b2c]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x22f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0xbcd4b4
sub esp, 0xffffff80
jmp 0x6518e2
Function at 0x408d00
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x6000]
push edi
jmp 0x408d1a
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x408d21
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x408d10
mov eax, 1
add ebx, ebx
jne 0x408d33
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x408d28
jne 0x408d44
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x408d28
xor ecx, ecx
sub eax, 3
jb 0x408d58
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x408dca
mov ebp, eax
add ebx, ebx
jne 0x408d63
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x408d70
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x408d94
inc ecx
add ebx, ebx
jne 0x408d80
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x408d75
jne 0x408d91
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x408d75
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x408db4
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x408da5
jmp 0x408d16
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x408db4
add edi, ecx
jmp 0x408d16
pop esi
mov edi, esi
mov ecx, 0x29
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x408dd2
cmp byte [edi], 1
jne 0x408dd2
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x408dd7
lea edi, [esi + 0x6000]
mov eax, dword [edi]
or eax, eax
je 0x408e46
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x9110]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x914c]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x408e04
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x9154]
or eax, eax
je 0x408e40
mov dword [ebx], eax
add ebx, 4
jmp 0x408e21
call dword [esi + 0x9150]
mov ebp, dword [esi + 0x9158]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x1e7]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x408e7a
sub esp, 0xffffff80
jmp 0x402550

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x1000b790
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
xor ecx, ecx
mov eax, 0x38e38e39
push ebx
push esi
mov dword [ebp - 4], ecx
mov ecx, dword [0x1076369c]
push edi
mov edi, dword [0x10763698]
sub ecx, edi
imul ecx
sar edx, 3
mov eax, edx
shr eax, 0x1f
add eax, edx
je 0x1000b7f3
mov ebx, dword [ebp + 8]
xor esi, esi
cmp ebx, dword [esi + edi]
jb 0x1000b7cf
cmp ebx, dword [esi + edi + 4]
jb 0x1000b7fe
mov ecx, dword [0x1076369c]
mov eax, 0x38e38e39
inc dword [ebp - 4]
sub ecx, edi
imul ecx
add esi, 0x24
sar edx, 3
mov eax, edx
shr eax, 0x1f
add eax, edx
cmp dword [ebp - 4], eax
jb 0x1000b7c4
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret 4
movzx eax, bl
xor eax, 0x811c9dc5
imul ecx, eax, 0x1000193
movzx eax, bh
xor ecx, eax
movzx eax, byte [ebp + 0xa]
imul ecx, ecx, 0x1000193
xor ecx, eax
movzx eax, byte [ebp + 0xb]
imul ecx, ecx, 0x1000193
xor ecx, eax
imul eax, ecx, 0x1000193
push eax
lea eax, [ebp + 8]
push eax
lea eax, [ebp - 0xc]
push eax
call fcn.1000d660
mov ecx, dword [0x10763650]
mov eax, dword [eax + 4]
test eax, eax
cmovne ecx, eax
mov eax, dword [ebp - 4]
lea eax, [eax + eax*8]
shl eax, 2
cmp byte [ecx + 0x10], 0
je 0x1000b88c
mov esi, dword [ecx + 0x14]
add eax, 8
mov ebx, dword [ecx + 0xc]
add eax, edi
cmp dword [eax + 0x14], 0x10
jb 0x1000b86d
mov eax, dword [eax]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push esi
mov edx, ebx
mov ecx, eax
call fcn.100022f0
add esp, 4
mov eax, dword [eax]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
mov eax, dword [eax + edi + 0x20]
push 0
push dword [ecx + 0xc]
call eax
add esp, 8
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x1000ba20
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x58
mov eax, dword [0x10017008]
xor eax, ebp
mov dword [ebp - 4], eax
lea eax, [ebp - 0x58]
mov dword [ebp - 0x48], 0x44
push eax
lea eax, [ebp - 0x48]
xorps xmm0, xmm0
push eax
push 0
push 0
push 0x8000020
push 1
push 0
push 0
push ecx
push 0
movlpd qword [ebp - 0x44], xmm0
movlpd qword [ebp - 0x3c], xmm0
movlpd qword [ebp - 0x34], xmm0
movlpd qword [ebp - 0x2c], xmm0
movlpd qword [ebp - 0x24], xmm0
movlpd qword [ebp - 0x1c], xmm0
movlpd qword [ebp - 0x14], xmm0
movlpd qword [ebp - 0xc], xmm0
movups xmmword [ebp - 0x58], xmm0
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
je 0x1000bab7
push 0xffffffffffffffff
push dword [ebp - 0x58]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push dword [ebp - 0x58]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword [ebp - 0x54]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1000e70d
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
or eax, 0xffffffff
xor ecx, ebp
call fcn.1000e70d
mov esp, ebp
pop ebp
ret

Function at 0x1000c240
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
cmp dword [ebp + 0xc], 1
jne 0x1000c25e
push 0
push 0
push 0
push 0x1000be30
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov al, 1
pop ebp
ret 0xc
Function at 0x1000c9e0
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100102c5
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
push esi
push edi
mov eax, dword [0x10017008]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edx, dword [ebp + 0xc]
mov edi, dword [ebp + 8]
mov dword [ebp - 0x10], edx
mov dword [ebp - 0x20], edi
movzx eax, byte [edx]
xor eax, 0x811c9dc5
imul ecx, eax, 0x1000193
movzx eax, byte [edx + 1]
xor ecx, eax
movzx eax, byte [edx + 2]
imul ecx, ecx, 0x1000193
xor ecx, eax
movzx eax, byte [edx + 3]
imul ecx, ecx, 0x1000193
xor ecx, eax
imul eax, ecx, 0x1000193
push eax
mov dword [ebp - 0x1c], eax
lea eax, [ebp - 0x18]
push edx
push eax
call fcn.1000d660
mov eax, dword [ebp - 0x14]
test eax, eax
je 0x1000ca65
mov dword [edi], eax
mov byte [edi + 4], 0
jmp 0x1000cbc5
cmp dword [0x10763654], 0xaaaaaaa
jne 0x1000ca7c
push str.unordered_map_set_too_long
call dword [sym.imp.MSVCP140.dll_void___cdecl_std::_Xlength_error_char_const__]
mov dword [ebp - 0x28], 0x10763650
mov dword [ebp - 4], 0
push 0x18
mov dword [ebp - 0x24], 0
call fcn.1000e71b
mov esi, eax
add esp, 4
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x24], esi
movups xmm0, xmmword [eax]
movups xmmword [esi + 8], xmm0
mov dword [ebp - 4], 1
mov ecx, dword [0x10763654]
mov eax, dword [0x10763668]
inc ecx
movd xmm0, ecx
cvtdq2pd xmm0, xmm0
shr ecx, 0x1f
addsd xmm0, qword [ecx*8 + 0x10014ef0]
cvtpd2ps xmm2, xmm0
movd xmm0, eax
cvtdq2pd xmm0, xmm0
shr eax, 0x1f
movaps xmm1, xmm2
addsd xmm0, qword [eax*8 + 0x10014ef0]
cvtpd2ps xmm0, xmm0
divss xmm1, xmm0
movss xmm0, dword [0x1076364c]
comiss xmm1, xmm0
jbe 0x1000cb6d
divss xmm2, xmm0
sub esp, 8
cvtps2pd xmm0, xmm2
movsd qword [ebp - 0x18], xmm0
fld qword [ebp - 0x18]
fstp qword [esp]
call sub.api_ms_win_crt_math_l1_1_0.dll_ceil
fstp qword [ebp - 0x18]
movsd xmm0, qword [ebp - 0x18]
add esp, 8
cvtpd2ps xmm0, xmm0
call fcn.1000f500
mov ecx, 8
cmp eax, ecx
cmova ecx, eax
mov eax, dword [0x10763668]
cmp eax, ecx
jae 0x1000cb52
cmp eax, 0x200
jae 0x1000cb50
shl eax, 3
cmp eax, ecx
jae 0x1000cb52
mov eax, ecx
push eax
call fcn.1000d360
mov edi, dword [ebp - 0x1c]
lea eax, [esi + 8]
push edi
push eax
lea eax, [ebp - 0x28]
push eax
call fcn.1000d660
mov edx, dword [eax]
jmp 0x1000cb73
mov edx, dword [ebp - 0x18]
mov edi, dword [ebp - 0x1c]
mov eax, dword [edx + 4]
inc dword [0x10763654]
mov dword [esi + 4], eax
mov dword [esi], edx
mov dword [eax], esi
mov dword [edx + 4], esi
mov ecx, dword [0x10763658]
mov dword [ebp - 0x10], eax
mov eax, dword [0x10763664]
and eax, edi
mov edi, dword [ecx + eax*8]
cmp edi, dword [0x10763650]
jne 0x1000cba6
mov dword [ecx + eax*8], esi
jmp 0x1000cbb8
cmp edi, edx
jne 0x1000cbaf
mov dword [ecx + eax*8], esi
jmp 0x1000cbbc
mov edx, dword [ebp - 0x10]
cmp dword [ecx + eax*8 + 4], edx
jne 0x1000cbbc
mov dword [ecx + eax*8 + 4], esi
mov edi, dword [ebp - 0x20]
mov dword [edi], esi
mov byte [edi + 4], 1
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 8
Function at 0x1000cbe0
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10010305
mov eax, dword fs:[0]
push eax
sub esp, 0x18
push ebx
push esi
push edi
mov eax, dword [0x10017008]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, dword [ebp + 0xc]
mov edi, dword [ebp + 8]
mov dword [ebp - 0x1c], edi
movzx eax, byte [ebx]
xor eax, 0x811c9dc5
imul ecx, eax, 0x1000193
movzx eax, byte [ebx + 1]
xor ecx, eax
movzx eax, byte [ebx + 2]
imul ecx, ecx, 0x1000193
xor ecx, eax
movzx eax, byte [ebx + 3]
imul ecx, ecx, 0x1000193
xor ecx, eax
imul eax, ecx, 0x1000193
push eax
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x14]
push ebx
push eax
call fcn.1000d6d0
mov eax, dword [ebp - 0x10]
test eax, eax
je 0x1000cc63
mov dword [edi], eax
mov byte [edi + 4], 0
jmp 0x1000cdc6
cmp dword [0x10763674], 0xccccccc
jne 0x1000cc7a
push str.unordered_map_set_too_long
call dword [sym.imp.MSVCP140.dll_void___cdecl_std::_Xlength_error_char_const__]
mov dword [ebp - 0x24], 0x10763670
mov dword [ebp - 4], 0
push 0x14
mov dword [ebp - 0x20], 0
call fcn.1000e71b
movq xmm0, qword [ebx]
mov esi, eax
lea edi, [esi + 8]
add esp, 4
movq qword [edi], xmm0
mov ecx, dword [ebx + 8]
mov dword [ebp - 0x20], esi
mov dword [edi + 8], ecx
mov dword [ebp - 4], 1
mov ecx, dword [0x10763674]
mov ebx, dword [0x10763688]
lea eax, [ecx + 1]
movd xmm0, eax
cvtdq2pd xmm0, xmm0
shr eax, 0x1f
addsd xmm0, qword [eax*8 + 0x10014ef0]
mov eax, ebx
shr eax, 0x1f
cvtpd2ps xmm2, xmm0
movd xmm0, ebx
cvtdq2pd xmm0, xmm0
movaps xmm1, xmm2
addsd xmm0, qword [eax*8 + 0x10014ef0]
cvtpd2ps xmm0, xmm0
divss xmm1, xmm0
movss xmm0, dword [0x1076366c]
comiss xmm1, xmm0
jbe 0x1000cd75
divss xmm2, xmm0
sub esp, 8
cvtps2pd xmm0, xmm2
movsd qword [ebp - 0x14], xmm0
fld qword [ebp - 0x14]
fstp qword [esp]
call sub.api_ms_win_crt_math_l1_1_0.dll_ceil
fstp qword [ebp - 0x14]
movsd xmm0, qword [ebp - 0x14]
add esp, 8
cvtpd2ps xmm0, xmm0
call fcn.1000f500
mov ecx, 8
cmp eax, ecx
cmova ecx, eax
cmp ebx, ecx
jae 0x1000cd58
cmp ebx, 0x200
jae 0x1000cd56
shl ebx, 3
cmp ebx, ecx
jae 0x1000cd58
mov ebx, ecx
push ebx
call fcn.1000d4e0
push dword [ebp - 0x18]
lea eax, [ebp - 0x24]
push edi
push eax
call fcn.1000d6d0
mov ecx, dword [0x10763674]
mov edx, dword [eax]
jmp 0x1000cd78
mov edx, dword [ebp - 0x14]
mov ebx, dword [edx + 4]
inc ecx
mov dword [0x10763674], ecx
mov dword [esi], edx
mov dword [esi + 4], ebx
mov dword [ebx], esi
mov dword [edx + 4], esi
mov eax, dword [0x10763684]
and eax, dword [ebp - 0x18]
mov ecx, dword [0x10763678]
mov edi, dword [ecx + eax*8]
cmp edi, dword [0x10763670]
jne 0x1000cdaa
mov dword [ecx + eax*8], esi
jmp 0x1000cdb9
cmp edi, edx
jne 0x1000cdb3
mov dword [ecx + eax*8], esi
jmp 0x1000cdbd
cmp dword [ecx + eax*8 + 4], ebx
jne 0x1000cdbd
mov dword [ecx + eax*8 + 4], esi
mov edi, dword [ebp - 0x1c]
mov dword [edi], esi
mov byte [edi + 4], 1
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x1000d360
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1fffffff
sub esp, 0xc
bsr ecx, eax
push ebx
push esi
push edi
mov edi, 1
mov eax, edi
shl eax, cl
mov ecx, dword [ebp + 8]
cmp ecx, eax
jbe 0x1000d38c
push str.invalid_hash_bucket_count
call dword [sym.imp.MSVCP140.dll_void___cdecl_std::_Xlength_error_char_const__]
lea eax, [ecx - 1]
mov esi, dword [0x10763650]
or eax, 1
mov dword [ebp - 0xc], esi
bsr ecx, eax
push esi
lea ecx, [ecx + 1]
shl edi, cl
mov ecx, 0x10763658
lea eax, [edi + edi]
push eax
call fcn.1000c830
mov ecx, dword [0x10763650]
lea ebx, [edi - 1]
mov dword [0x10763664], ebx
mov dword [0x10763668], edi
mov ecx, dword [ecx]
mov edx, ecx
cmp ecx, esi
je 0x1000d4d0
movzx eax, byte [ecx + 8]
xor eax, 0x811c9dc5
mov edx, dword [edx]
imul edi, eax, 0x1000193
movzx eax, byte [ecx + 9]
xor edi, eax
movzx eax, byte [ecx + 0xa]
imul edi, edi, 0x1000193
xor edi, eax
movzx eax, byte [ecx + 0xb]
imul edi, edi, 0x1000193
xor edi, eax
mov eax, dword [0x10763658]
imul edi, edi, 0x1000193
and edi, ebx
mov ebx, dword [eax + edi*8]
mov dword [ebp - 4], ebx
lea eax, [eax + edi*8]
mov dword [ebp - 8], eax
cmp ebx, esi
jne 0x1000d426
mov dword [eax], ecx
mov dword [eax + 4], ecx
jmp 0x1000d499
mov eax, dword [eax + 4]
mov ebx, dword [ecx + 8]
cmp ebx, dword [eax + 8]
jne 0x1000d460
mov eax, dword [eax]
mov dword [ebp - 4], eax
cmp eax, ecx
je 0x1000d458
mov ebx, dword [ecx + 4]
mov esi, dword [ebp - 4]
mov dword [ebx], edx
mov edi, dword [edx + 4]
mov dword [edi], eax
mov eax, dword [eax + 4]
mov dword [eax], ecx
mov dword [esi + 4], edi
mov esi, dword [ebp - 0xc]
mov dword [edx + 4], ebx
mov dword [ecx + 4], eax
mov eax, dword [ebp - 8]
mov dword [eax + 4], ecx
jmp 0x1000d499
mov edi, eax
cmp dword [ebp - 4], eax
je 0x1000d476
mov eax, dword [eax + 4]
mov edi, eax
cmp ebx, dword [eax + 8]
je 0x1000d4aa
cmp dword [ebp - 4], eax
jne 0x1000d467
mov eax, dword [ecx + 4]
mov dword [ebp - 4], eax
mov dword [eax], edx
mov ebx, dword [edx + 4]
mov dword [ebx], edi
mov eax, dword [edi + 4]
mov dword [eax], ecx
mov dword [edi + 4], ebx
mov edi, dword [ebp - 4]
mov dword [edx + 4], edi
mov dword [ecx + 4], eax
mov eax, dword [ebp - 8]
mov dword [eax], ecx
mov ecx, edx
cmp edx, esi
je 0x1000d4d0
mov ebx, dword [0x10763664]
jmp 0x1000d3d3
mov ebx, dword [ecx + 4]
mov eax, dword [eax]
mov dword [ebp - 8], eax
mov esi, eax
mov dword [ebx], edx
mov edi, dword [edx + 4]
mov dword [edi], eax
mov eax, dword [eax + 4]
mov dword [eax], ecx
mov dword [esi + 4], edi
mov esi, dword [ebp - 0xc]
mov dword [edx + 4], ebx
mov dword [ecx + 4], eax
jmp 0x1000d499
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4