joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10021b30
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push esi
push edi
mov edi, dword [esp + 0xc]
mov ecx, edi
lea edx, [ecx + 1]
jmp 0x10021b40
mov al, byte [ecx]
inc ecx
test al, al
jne 0x10021b40
sub ecx, edx
mov esi, 0x811c9dc5
mov edx, 0
je 0x10021b66
movzx eax, byte [edx + edi]
inc edx
xor eax, esi
imul esi, eax, 0x1000193
cmp edx, ecx
jb 0x10021b55
pop edi
mov eax, esi
pop esi
ret

Function at 0x100238e0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff0
sub esp, 0x40
cmp dword [ebp + 0xc], 1
jne 0x10023a84
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_DisableThreadLibraryCalls]
mov dword [esp + 0x10], 0x1e59cba8
lea ecx, [esp + 0x10]
mov dword [esp + 0x14], 0xcb18cd39
lea edx, [ecx + 1]
mov dword [esp + 0x18], 0x44f38fce
mov dword [esp + 0x1c], 0xa185e458
movaps xmm1, xmmword [esp + 0x10]
mov dword [esp + 0x20], 0x6c3cb8dd
mov dword [esp + 0x24], 0xcb18cd39
mov dword [esp + 0x28], 0x44f38fce
mov dword [esp + 0x2c], 0xa185e458
pxor xmm1, xmmword [esp + 0x20]
movaps xmmword [esp + 0x10], xmm1
mov al, byte [ecx]
inc ecx
test al, al
jne 0x10023953
sub ecx, edx
lea eax, [esp + 0x10]
push ecx
push eax
mov ecx, 0x10217054
call fcn.10007c60
mov dword [esp + 0x20], 0x5ecdad
lea ecx, [esp + 0x20]
mov dword [esp + 0x24], 0xcb18ae50
lea edx, [ecx + 1]
mov dword [esp + 0x28], 0x44f38fce
mov dword [esp + 0x2c], 0xa185e458
movaps xmm1, xmmword [esp + 0x20]
mov dword [esp + 0x30], 0x6c3cb8dd
mov dword [esp + 0x34], 0xcb18cd39
mov dword [esp + 0x38], 0x44f38fce
mov dword [esp + 0x3c], 0xa185e458
pxor xmm1, xmmword [esp + 0x30]
movaps xmmword [esp + 0x20], xmm1
mov al, byte [ecx]
inc ecx
test al, al
jne 0x100239c3
sub ecx, edx
lea eax, [esp + 0x20]
push ecx
push eax
mov ecx, 0x1021706c
call fcn.10007c60
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_GetPriorityClass]
cmp eax, 0x80
je 0x10023a09
cmp eax, 0x100
je 0x10023a09
push 0x80
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_SetPriorityClass]
mov dword [esp + 0xc], 0xd493a27e
mov eax, dword [esp + 0xc]
bswap eax
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0xc]
sub eax, 0x7ea293d4
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0xc]
ror eax, 0xf8
mov dword [esp + 0xc], eax
mov ecx, dword [esp + 0xc]
mov dword [esp + 0xc], 0x183fdbd
mov eax, dword [esp + 0xc]
bswap eax
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0xc]
add eax, 0x42027cff
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0xc]
push 0
push ecx
ror eax, 0xd
push 0
mov dword [esp + 0x18], eax
mov eax, dword [esp + 0x18]
push 0x10022fc0
push eax
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
test eax, eax
je 0x10023a84
mov al, 1
mov esp, ebp
pop ebp
ret 0xc
xor al, al
mov esp, ebp
pop ebp
ret 0xc
Function at 0x1003ca60
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
mov edx, dword [ecx + 0xc0]
mov eax, dword [ecx + 0xc8]
push esi
push edi
lea esi, [esp + 0xc]
mov edi, 4
mov eax, dword [eax + edx*4 - 4]
not eax
lea ecx, [ecx]
movzx ecx, byte [esi]
lea esi, [esi + 1]
movzx edx, al
xor edx, ecx
shr eax, 8
xor eax, dword [edx*4 + 0x101ab320]
sub edi, 1
jne 0x1003ca80
mov ecx, dword [0x1021c4b0]
not eax
pop edi
pop esi
cmp dword [ecx + 0x1a44], eax
jne 0x1003cab2
mov dword [ecx + 0x1a48], eax
cmp dword [ecx + 0x1a7c], eax
jne 0x1003cac1
mov byte [ecx + 0x1a80], 1
ret 4

Function at 0x1003cb30
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
sub esp, 0x10
push esi
mov esi, dword [esp + 0x18]
push edi
mov edi, ecx
fld dword [edi + 0x10]
fld dword [esi]
fsub st(1)
call fcn.10162460
fld dword [edi + 0x14]
fld dword [esi + 4]
fsub st(1)
mov dword [esp + 8], eax
call fcn.10162460
fld dword [esi + 8]
fsubrp st(2)
mov dword [esp + 0xc], eax
fxch st(1)
call fcn.10162460
fsubr dword [esi + 0xc]
mov dword [esp + 0x10], eax
call fcn.10162460
mov ecx, dword [edi + 0xc0]
lea esi, [esp + 8]
mov dword [esp + 0x14], eax
mov eax, dword [edi + 0xc8]
mov edi, 0x10
mov edx, dword [eax + ecx*4 - 4]
not edx
movzx eax, byte [esi]
lea esi, [esi + 1]
movzx ecx, dl
xor ecx, eax
shr edx, 8
xor edx, dword [ecx*4 + 0x101ab320]
sub edi, 1
jne 0x1003cb93
mov eax, dword [0x1021c4b0]
not edx
pop edi
pop esi
cmp dword [eax + 0x1a44], edx
jne 0x1003cbc4
mov dword [eax + 0x1a48], edx
cmp dword [eax + 0x1a7c], edx
jne 0x1003cbd3
mov byte [eax + 0x1a80], 1
mov eax, edx
add esp, 0x10
ret 4
Function at 0x1003d230
Capabilities:
Read file on windows

Disassembly:
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0x1c]
test edi, edi
je 0x1003d242
mov dword [edi], 0
push dword [esp + 0x18]
push dword [esp + 0x18]
call fcn.1003d360
mov esi, eax
add esp, 8
test esi, esi
je 0x1003d352
push esi
call fcn.10176fdf
mov ebp, eax
add esp, 4
cmp ebp, 0xffffffff
je 0x1003d349
push 2
push 0
push esi
call fcn.10173a55
add esp, 0xc
test eax, eax
jne 0x1003d349
push esi
call fcn.10176fdf
mov ebx, eax
add esp, 4
cmp ebx, 0xffffffff
je 0x1003d349
push 0
push ebp
push esi
call fcn.10173a55
add esp, 0xc
test eax, eax
jne 0x1003d349
mov eax, dword [0x1021c4b0]
test eax, eax
je 0x1003d2bc
inc dword [eax + 0x378]
push dword [0x1021c4b8]
mov eax, dword [esp + 0x24]
add eax, ebx
push eax
call dword [0x102170b8]
mov ebp, eax
add esp, 8
test ebp, ebp
je 0x1003d349
push esi
push ebx
push 1
push ebp
call fcn.1017363d
add esp, 0x10
cmp eax, ebx
je 0x1003d31c
push esi
call fcn.10172d81
mov eax, dword [0x1021c4b0]
add esp, 4
test eax, eax
je 0x1003d301
dec dword [eax + 0x378]
mov eax, dword [0x1021c4b8]
test eax, eax
je 0x1003d352
push eax
push ebp
call dword [0x102170bc]
add esp, 8
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
ret
mov eax, dword [esp + 0x20]
test eax, eax
jle 0x1003d333
push eax
lea eax, [ebx + ebp]
push 0
push eax
call fcn.10164250
add esp, 0xc
push esi
call fcn.10172d81
add esp, 4
test edi, edi
je 0x1003d342
mov dword [edi], ebx
pop edi
pop esi
mov eax, ebp
pop ebp
pop ebx
ret
push esi
call fcn.10172d81
add esp, 4
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
ret

Function at 0x1003d5a0
Capabilities:
Hash data with crc32

Disassembly:
push ebx
mov ebx, dword [esp + 0x10]
push esi
mov esi, dword [esp + 0xc]
not ebx
push edi
mov edi, dword [esp + 0x14]
mov eax, ebx
test edi, edi
je 0x1003d602
mov cl, byte [esi]
lea esi, [esi + 1]
dec edi
cmp cl, 0x23
jne 0x1003d5e6
cmp edi, 2
jb 0x1003d5e6
cmp byte [esi], cl
jne 0x1003d5e6
cmp byte [esi + 1], cl
jne 0x1003d5e6
mov eax, ebx
movzx ecx, cl
movzx edx, al
xor edx, ecx
shr eax, 8
xor eax, dword [edx*4 + 0x101ab320]
jmp 0x1003d5b7
movzx edx, al
movzx ecx, cl
xor edx, ecx
shr eax, 8
xor eax, dword [edx*4 + 0x101ab320]
test edi, edi
jne 0x1003d5b7
pop edi
pop esi
not eax
pop ebx
ret
mov cl, byte [esi]
inc esi
test cl, cl
je 0x1003d639
lea esp, [esp]
cmp cl, 0x23
jne 0x1003d620
cmp byte [esi], cl
jne 0x1003d620
cmp byte [esi + 1], cl
jne 0x1003d620
mov eax, ebx
movzx edx, al
movzx ecx, cl
xor edx, ecx
shr eax, 8
mov cl, byte [esi]
inc esi
xor eax, dword [edx*4 + 0x101ab320]
test cl, cl
jne 0x1003d610
pop edi
pop esi
not eax
pop ebx
ret
Function at 0x1003e210
Capabilities:
Hash data with crc32

Disassembly:
sub esp, 0x24
push ebx
push esi
push edi
mov dword [esp + 0x18], 0
or edx, 0xffffffff
mov dword [esp + 0x2c], 0
mov esi, 0x101ab8ed
mov dword [esp + 0xc], str.Window
mov al, 0x57
cmp al, 0x23
jne 0x1003e248
cmp byte [esi], al
jne 0x1003e248
cmp byte [esi + 1], al
jne 0x1003e248
or edx, 0xffffffff
movzx ecx, dl
movzx eax, al
xor ecx, eax
shr edx, 8
mov al, byte [esi]
inc esi
xor edx, dword [ecx*4 + 0x101ab320]
test al, al
jne 0x1003e238
mov ebx, dword [esp + 0x34]
not edx
mov dword [esp + 0x10], edx
mov dword [esp + 0x14], 0x100488a0
mov dword [esp + 0x1c], 0x100489e0
mov edi, dword [ebx + 0x2dd4]
mov ecx, dword [ebx + 0x2dd8]
mov dword [esp + 0x20], 0x10048920
mov dword [esp + 0x24], 0x10048820
mov dword [esp + 0x28], 0x10048a40
cmp edi, ecx
jne 0x1003e34d
inc edi
test ecx, ecx
je 0x1003e2b9
mov eax, ecx
cdq
sub eax, edx
mov esi, eax
sar esi, 1
add esi, ecx
jmp 0x1003e2be
mov esi, 8
cmp esi, edi
jg 0x1003e2c4
mov esi, edi
cmp esi, ecx
jle 0x1003e34d
mov eax, dword [0x1021c4b0]
test eax, eax
je 0x1003e2db
inc dword [eax + 0x378]
push dword [0x1021c4b8]
lea eax, [esi + esi*8]
shl eax, 2
push eax
call dword [0x102170b8]
mov edi, eax
add esp, 8
mov eax, dword [ebx + 0x2ddc]
test eax, eax
je 0x1003e341
mov ecx, dword [ebx + 0x2dd4]
lea ecx, [ecx + ecx*8]
shl ecx, 2
push ecx
push eax
push edi
call fcn.10163cd0
mov ecx, dword [ebx + 0x2ddc]
add esp, 0xc
test ecx, ecx
je 0x1003e32d
mov eax, dword [0x1021c4b0]
test eax, eax
je 0x1003e32d
dec dword [eax + 0x378]
mov eax, dword [0x1021c4b8]
test eax, eax
je 0x1003e341
push eax
push ecx
call dword [0x102170bc]
add esp, 8
mov dword [ebx + 0x2ddc], edi
mov dword [ebx + 0x2dd8], esi
mov eax, dword [ebx + 0x2dd4]
lea esi, [esp + 0xc]
lea ecx, [eax + eax*8]
mov eax, dword [ebx + 0x2ddc]
lea edi, [eax + ecx*4]
mov ecx, 9
rep movsd dword es:[edi], dword [esi]
inc dword [ebx + 0x2dd4]
pop edi
pop esi
mov byte [ebx], 1
pop ebx
add esp, 0x24
ret

Function at 0x100433a0
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
mov eax, dword [0x1021c4b0]
lea edx, [esp + 4]
push ebx
push ebp
push esi
push edi
mov edi, dword [eax + 0x1a10]
mov esi, 4
mov eax, dword [esp + 0x14]
add edi, 0xc0
mov dword [esp + 0x14], eax
mov ebp, dword [edi]
mov ebx, dword [edi + 8]
mov ebx, dword [ebx + ebp*4 - 4]
not ebx
movzx eax, byte [edx]
lea edx, [edx + 1]
movzx ecx, bl
xor ecx, eax
shr ebx, 8
xor ebx, dword [ecx*4 + 0x101ab320]
sub esi, 1
jne 0x100433d1
mov ecx, dword [edi + 4]
not ebx
cmp ebp, ecx
jne 0x10043419
lea esi, [ebp + 1]
test ecx, ecx
je 0x10043406
mov eax, ecx
cdq
sub eax, edx
sar eax, 1
add eax, ecx
jmp 0x1004340b
mov eax, 8
cmp eax, esi
jg 0x10043411
mov eax, esi
push eax
mov ecx, edi
call fcn.10049180
mov ecx, dword [edi]
mov eax, dword [edi + 8]
mov dword [eax + ecx*4], ebx
inc dword [edi]
pop edi
pop esi
pop ebp
pop ebx
ret
Function at 0x10047e00
Capabilities:
Read file on windows

Disassembly:
push edi
mov edi, dword [0x1021c4b0]
cmp byte [edi + 0x2dc0], 0
lea ecx, [edi + 0x20]
jne 0x10047f00
mov eax, dword [ecx]
test eax, eax
je 0x10047ef9
push esi
push 0x101ab9c0
push eax
call fcn.1003d360
mov esi, eax
add esp, 8
test esi, esi
je 0x10047ef5
push ebx
push ebp
push esi
call fcn.10176fdf
mov ebx, eax
add esp, 4
cmp ebx, 0xffffffff
je 0x10047f54
push 2
push 0
push esi
call fcn.10173a55
add esp, 0xc
test eax, eax
jne 0x10047f54
push esi
call fcn.10176fdf
mov ebp, eax
add esp, 4
cmp ebp, 0xffffffff
je 0x10047f54
push 0
push ebx
push esi
call fcn.10173a55
add esp, 0xc
test eax, eax
jne 0x10047f54
mov eax, dword [0x1021c4b0]
test eax, eax
je 0x10047e9c
inc dword [eax + 0x378]
push dword [0x1021c4b8]
push ebp
call dword [0x102170b8]
mov ebx, eax
add esp, 8
test ebx, ebx
je 0x10047f54
push esi
push ebp
push 1
push ebx
call fcn.1017363d
add esp, 0x10
push esi
cmp eax, ebp
je 0x10047f40
call fcn.10172d81
add esp, 4
mov eax, dword [0x1021c4b0]
test eax, eax
je 0x10047edf
dec dword [eax + 0x378]
mov eax, dword [0x1021c4b8]
test eax, eax
je 0x10047ef3
push eax
push ebx
call dword [0x102170bc]
add esp, 8
pop ebp
pop ebx
lea ecx, [edi + 0x20]
pop esi
mov byte [edi + 0x2dc0], 1
fld dword [edi + 0x2dc4]
fldz
fcom st(1)
fnstsw ax
test ah, 5
jp 0x10047f6e
fxch st(1)
fsub dword [edi + 0x18]
fst dword [edi + 0x2dc4]
fcomp st(1)
fnstsw ax
test ah, 0x41
jp 0x10047f70
mov eax, dword [ecx]
test eax, eax
je 0x10047f5f
push eax
fstp st(0)
call fcn.100460c0
fldz
add esp, 4
fstp dword [edi + 0x2dc4]
pop edi
ret
call fcn.10172d81
push ebp
push ebx
call fcn.1003ecb0
add esp, 0xc
jmp 0x10047ed0
push esi
call fcn.10172d81
add esp, 4
jmp 0x10047ef3
fstp dword [edi + 0x2dc4]
mov byte [edi + 0x360], 1
pop edi
ret
fstp st(1)
fstp st(0)
pop edi
ret
Function at 0x10056d30
Capabilities:
Log keystrokes via polling

Disassembly:
sub esp, 0x28
push ebx
push esi
push edi
call fcn.1003cc10
mov edi, eax
lea eax, [esp + 0x24]
push eax
push dword [0x1021c4f0]
call dword [sym.imp.USER32.dll_GetClientRect]
mov ecx, dword [esp + 0x2c]
sub ecx, dword [esp + 0x24]
mov eax, dword [esp + 0x30]
sub eax, dword [esp + 0x28]
mov dword [esp + 0xc], ecx
fild dword [esp + 0xc]
mov dword [esp + 0xc], eax
lea eax, [esp + 0x14]
push eax
fild dword [esp + 0x10]
fxch st(1)
fstp dword [edi + 8]
fstp dword [edi + 0xc]
call dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov ecx, dword [esp + 0x14]
sub ecx, dword [0x1021c4f8]
mov eax, dword [esp + 0x18]
sbb eax, dword [0x1021c4fc]
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x20], eax
fild qword [esp + 0x1c]
mov esi, dword [sym.imp.USER32.dll_GetKeyState]
push 0x11
fild qword [0x1021c500]
fdivp st(1)
fstp dword [edi + 0x10]
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x1c]
mov dword [0x1021c4f8], eax
mov dword [0x1021c4fc], ecx
call esi
shr eax, 0xf
and al, 1
push 0x10
mov byte [edi + 0xfc], al
call esi
shr eax, 0xf
and al, 1
push 0x12
mov byte [edi + 0xfd], al
call esi
shr eax, 0xf
and al, 1
mov byte [edi + 0xff], 0
mov byte [edi + 0xfe], al
call fcn.1003cc10
mov ebx, eax
cmp byte [ebx + 0x357], 0
je 0x10056e46
fld dword [ebx + 0xe4]
call fcn.10162460
fld dword [ebx + 0xe8]
mov dword [esp + 0xc], eax
call fcn.10162460
mov dword [esp + 0x10], eax
lea eax, [esp + 0xc]
push eax
push dword [0x1021c4f0]
call dword [sym.imp.USER32.dll_ClientToScreen]
push dword [esp + 0x10]
push dword [esp + 0x10]
call dword [sym.imp.USER32.dll_SetCursorPos]
fld dword [0x101abaf8]
fst dword [ebx + 0xe4]
fstp dword [ebx + 0xe8]
call dword [sym.imp.USER32.dll_GetForegroundWindow]
test eax, eax
je 0x10056eb0
mov ecx, dword [0x1021c4f0]
cmp eax, ecx
je 0x10056e78
push ecx
push eax
call dword [sym.imp.USER32.dll_IsChild]
test eax, eax
je 0x10056eb0
lea eax, [esp + 0x1c]
push eax
call dword [sym.imp.USER32.dll_GetCursorPos]
test eax, eax
je 0x10056eb0
lea eax, [esp + 0x1c]
push eax
push dword [0x1021c4f0]
call dword [sym.imp.USER32.dll_ScreenToClient]
test eax, eax
je 0x10056eb0
fild dword [esp + 0x20]
fild dword [esp + 0x1c]
fstp dword [ebx + 0xe4]
fstp dword [ebx + 0xe8]
cmp byte [edi + 0xac], 0
pop edi
pop esi
pop ebx
je 0x10056ec1
or eax, 0xffffffff
jmp 0x10056ec6
call fcn.1003cc20
cmp dword [0x10217278], eax
je 0x10056ed8
mov dword [0x10217278], eax
call fcn.100571a0
call fcn.10056ef0
add esp, 0x28
ret
Function at 0x1006e540
Capabilities:
Hash data using fnv

Disassembly:
mov eax, dword [esp + 4]
push ebx
push esi
push dword [eax]
mov esi, dword [eax + 4]
push 0xffffd8f0
push esi
call sub.lua51.dll_lua_rawgeti
push 0xffffffffffffffff
push esi
call sub.lua51.dll_lua_type
push 0xffffffffffffffff
push esi
call sub.lua51.dll_lua_topointer
push 0xfffffffffffffffe
push esi
mov ebx, eax
call sub.lua51.dll_lua_settop
movzx ecx, bl
add esp, 0x24
xor ecx, 0x811c9dc5
imul edx, ecx, 0x1000193
mov ecx, ebx
shr ecx, 8
movzx eax, cl
pop esi
xor edx, eax
mov eax, ebx
shr eax, 0x10
imul ecx, edx, 0x1000193
movzx eax, al
shr ebx, 0x18
xor ecx, eax
imul eax, ecx, 0x1000193
xor eax, ebx
imul eax, eax, 0x1000193
pop ebx
ret 4
Function at 0x1006efb0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x10191765
push eax
mov dword fs:[0], esp
sub esp, 0x14
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
mov ebx, ecx
mov edx, edi
cmp dword [edi + 0x14], 0x10
jb 0x1006efdd
mov edx, dword [edi]
xor ecx, ecx
mov esi, 0x811c9dc5
cmp dword [edi + 0x10], ecx
jbe 0x1006f002
lea esp, [esp]
movzx eax, byte [ecx + edx]
inc ecx
xor eax, esi
imul esi, eax, 0x1000193
cmp ecx, dword [edi + 0x10]
jb 0x1006eff0
push esi
push edi
lea eax, [ebp - 0x18]
mov ecx, ebx
push eax
call fcn.1001fd90
cmp dword [ebp - 0x14], 0
je 0x1006f075
mov eax, dword [ebp + 0x10]
mov ecx, dword [eax + 4]
test ecx, ecx
je 0x1006f023
lock inc dword [ecx + 4]
mov ebx, dword [ebp - 0x14]
mov ecx, dword [eax + 4]
mov eax, dword [eax]
mov esi, dword [ebx + 0x24]
mov dword [ebx + 0x20], eax
mov dword [ebx + 0x24], ecx
test esi, esi
je 0x1006f059
or edi, 0xffffffff
mov eax, edi
lock xadd dword [esi + 4], eax
jne 0x1006f059
mov eax, dword [esi]
mov ecx, esi
call dword [eax]
lock xadd dword [esi + 8], edi
dec edi
jne 0x1006f059
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 4]
mov eax, dword [ebp + 8]
pop edi
pop esi
mov dword [eax], ebx
mov byte [eax + 4], 0
pop ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 0xc
cmp dword [ebx + 8], 0x6666666
je 0x1006f15f
lea eax, [ebx + 4]
mov dword [ebp - 0x20], eax
push 0x28
mov dword [ebp - 4], 0
mov dword [ebp - 0x1c], 0
call fcn.10161ef8
add esp, 4
mov dword [ebp + 0xc], eax
mov dword [ebp - 0x1c], eax
add eax, 8
mov dword [ebp - 0x10], eax
push edi
mov edi, eax
mov ecx, eax
call fcn.10003000
mov ecx, dword [ebp + 0x10]
mov dword [edi + 0x18], 0
mov dword [edi + 0x1c], 0
mov eax, dword [ecx + 4]
test eax, eax
je 0x1006f0d2
lock inc dword [eax + 4]
mov eax, dword [ecx]
mov dword [edi + 0x18], eax
mov dword [ebp - 4], 1
mov eax, dword [ecx + 4]
mov dword [edi + 0x1c], eax
mov eax, dword [ebx + 8]
add eax, 1
mov dword [ebp + 0x10], eax
fild dword [ebp + 0x10]
jns 0x1006f0f8
fadd dword [0x101a87b0]
mov eax, dword [ebx + 0x1c]
fild dword [ebx + 0x1c]
test eax, eax
jns 0x1006f108
fadd dword [0x101a87b0]
fdivp st(1)
fcomp dword [ebx]
fnstsw ax
test ah, 0x41
jne 0x1006f131
mov ecx, ebx
call fcn.100e13a0
mov edi, dword [ebp + 0xc]
mov ecx, ebx
push esi
lea eax, [edi + 8]
push eax
lea eax, [ebp - 0x20]
push eax
call fcn.1001fd90
mov ecx, dword [eax]
jmp 0x1006f137
mov ecx, dword [ebp - 0x18]
mov edi, dword [ebp + 0xc]
push edi
push ecx
push esi
mov ecx, ebx
call fcn.100e0ee0
mov ecx, dword [ebp + 8]
pop edi
pop esi
pop ebx
mov dword [ecx], eax
mov eax, ecx
mov byte [ecx + 4], 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 0xc
push str.unordered_map_set_too_long
call fcn.1016049b
int3
Function at 0x1006f170
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10191795
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x18
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
mov ebx, ecx
movzx eax, byte [edi]
xor eax, 0x811c9dc5
imul edx, eax, 0x1000193
movzx eax, byte [edi + 1]
xor edx, eax
movzx eax, byte [edi + 2]
imul edx, edx, 0x1000193
xor edx, eax
movzx eax, byte [edi + 3]
imul ecx, edx, 0x1000193
xor ecx, eax
imul eax, ecx, 0x1000193
mov ecx, ebx
push eax
mov dword [ebp + 0xc], eax
lea eax, [ebp - 0x14]
push edi
push eax
call fcn.10001f10
mov eax, dword [ebp - 0x10]
test eax, eax
je 0x1006f215
mov esi, dword [ebp + 0x10]
lea edi, [eax + 0xc]
push esi
mov ecx, edi
call fcn.100cdc30
lea eax, [esi + 8]
push eax
lea ecx, [edi + 8]
call fcn.100cdc30
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0x10]
mov dword [eax], ecx
mov byte [eax + 4], 0
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 0xc
cmp dword [ebx + 8], 0x9249249
je 0x1006f358
lea eax, [ebx + 4]
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x24], eax
push 0x1c
mov dword [ebp - 4], 0
mov dword [ebp - 0x20], 0
call fcn.10161ef8
add esp, 4
mov esi, eax
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0x20], esi
push dword [ebp + 0x10]
lea ecx, [esi + 8]
push edi
call fcn.1006c4c0
mov eax, dword [ebx + 8]
fld dword [ebx]
add eax, 1
mov dword [ebp + 0x10], eax
fild dword [ebp + 0x10]
mov dword [ebp - 4], 1
jns 0x1006f274
fadd dword [0x101a87b0]
mov edi, dword [ebx + 0x1c]
fild dword [ebx + 0x1c]
test edi, edi
jns 0x1006f284
fadd dword [0x101a87b0]
fdivr st(1)
fcomp st(2)
fnstsw ax
test ah, 0x41
jne 0x1006f2f7
fdivrp st(1)
sub esp, 8
fstp qword [esp]
call fcn.1016e5b0
fnstcw word [ebp + 0x12]
movzx eax, word [ebp + 0x12]
add esp, 8
or eax, 0xc00
mov dword [ebp - 0x10], eax
fldcw word [ebp - 0x10]
fistp qword [ebp - 0x14]
mov eax, dword [ebp - 0x14]
fldcw word [ebp + 0x12]
cmp eax, 8
ja 0x1006f2c4
mov eax, 8
cmp edi, eax
jae 0x1006f2d9
cmp edi, 0x200
jae 0x1006f2d7
shl edi, 3
cmp edi, eax
jae 0x1006f2d9
mov edi, eax
push edi
mov ecx, ebx
call fcn.10004650
push dword [ebp + 0xc]
lea eax, [esi + 8]
mov ecx, ebx
push eax
lea eax, [ebp - 0x24]
push eax
call fcn.10001f10
mov edx, dword [eax]
jmp 0x1006f2fe
mov edx, dword [ebp - 0x14]
fstp st(1)
fstp st(0)
mov edi, dword [edx + 4]
inc dword [ebx + 8]
mov dword [esi], edx
mov dword [esi + 4], edi
mov dword [edi], esi
mov dword [edx + 4], esi
mov eax, dword [ebx + 0x18]
and eax, dword [ebp + 0xc]
mov ecx, dword [ebx + 0xc]
mov esi, dword [ebp - 0x18]
mov ebx, dword [ecx + eax*8]
cmp ebx, dword [esi]
mov esi, dword [ebp - 0x1c]
jne 0x1006f329
mov dword [ecx + eax*8], esi
jmp 0x1006f338
cmp ebx, edx
jne 0x1006f332
mov dword [ecx + eax*8], esi
jmp 0x1006f33c
cmp dword [ecx + eax*8 + 4], edi
jne 0x1006f33c
mov dword [ecx + eax*8 + 4], esi
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
pop edi
mov dword [eax], esi
pop esi
mov byte [eax + 4], 1
pop ebx
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 0xc
push str.unordered_map_set_too_long
call fcn.1016049b
int3
Function at 0x1008bfe0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov eax, dword [esp + 8]
xor edx, edx
push ebx
push ebp
push esi
mov ebx, dword [eax + 8]
mov ebp, ecx
push edi
mov edi, dword [eax + 0xc]
mov esi, 0x811c9dc5
test edi, edi
je 0x1008c011
jmp 0x1008c000
movzx ecx, byte [ebx + edx]
inc edx
xor ecx, esi
imul esi, ecx, 0x1000193
cmp edx, edi
jb 0x1008c000
mov edx, dword [ebp + 0x18]
mov ecx, dword [ebp + 0xc]
and edx, esi
mov esi, dword [ecx + edx*8]
cmp dword [ecx + edx*8 + 4], eax
jne 0x1008c03b
cmp esi, eax
jne 0x1008c032
mov eax, dword [ebp + 4]
mov dword [ecx + edx*8], eax
mov dword [ecx + edx*8 + 4], eax
jmp 0x1008c044
mov eax, dword [eax + 4]
mov dword [ecx + edx*8 + 4], eax
jmp 0x1008c044
cmp esi, eax
jne 0x1008c048
mov eax, dword [eax]
mov dword [ecx + edx*8], eax
mov eax, dword [esp + 0x18]
mov esi, dword [eax]
dec dword [ebp + 8]
mov ecx, dword [eax + 4]
push 0x1c
mov dword [ecx], esi
mov eax, dword [eax + 4]
mov dword [esi + 4], eax
push dword [esp + 0x1c]
call fcn.10161f28
mov eax, dword [esp + 0x1c]
add esp, 8
pop edi
mov dword [eax], esi
pop esi
pop ebp
pop ebx
ret 8

Function at 0x1008c3e0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
sub esp, 8
mov edx, 0x811c9dc5
push ebx
push ebp
mov ebp, dword [esp + 0x18]
mov ebx, ecx
push esi
xor ecx, ecx
push edi
mov esi, dword [ebp + 4]
mov edi, dword [ebp]
test esi, esi
je 0x1008c411
mov edi, edi
movzx eax, byte [edi + ecx]
inc ecx
xor eax, edx
imul edx, eax, 0x1000193
cmp ecx, esi
jb 0x1008c400
push edx
push ebp
lea eax, [esp + 0x18]
mov ecx, ebx
push eax
call fcn.1006ee30
mov ecx, dword [eax + 4]
mov eax, dword [esp + 0x1c]
test ecx, ecx
jne 0x1008c42d
mov ecx, dword [ebx + 4]
pop edi
pop esi
pop ebp
mov dword [eax], ecx
pop ebx
add esp, 8
ret 8