joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40b7b0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
push 1
call sym.__configure_wide_argv
add esp, 4
call sym.__initialize_wide_environment
call sym.___p___argc
mov edi, dword [eax]
call sym.___p___wargv
mov ebx, dword [eax]
call sym.__get_initial_wide_environment
mov esi, eax
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 8]
mov ecx, dword [eax + 0x3c]
xor edx, edx
cmp word [eax + ecx + 0x5c], 2
sete dl
inc edx
push edx
call sym.__set_app_type
add esp, 4
push esi
push ebx
push edi
call dbg.wmain
add esp, 0xc
push eax
call sym._exit
int3

Function at 0x40b840
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
sub esp, 0x44
xor ebx, ebx
call dword [sym.imp.kernel32.dll_GetCommandLineW]
mov esi, eax
xor eax, eax
jmp 0x40b86b
xor edx, edx
test eax, eax
je 0x40b8b7
add esi, 2
mov ebx, edx
movzx ecx, word [esi]
cmp ecx, 9
je 0x40b860
test ecx, ecx
je 0x40b8b7
cmp cx, 0x20
jne 0x40b881
test eax, eax
je 0x40b8b7
xor edx, edx
cmp ecx, 0x22
je 0x40b892
cmp ecx, 0x5c
jne 0x40b866
inc ebx
mov edx, ebx
jmp 0x40b866
xor ecx, ecx
test eax, eax
sete cl
test bl, 1
cmove eax, ecx
jmp 0x40b866
movzx ecx, word [esi + 2]
add esi, 2
cmp cx, 0x20
je 0x40b8b0
movzx eax, cx
cmp eax, 9
je 0x40b8b0
lea eax, [ebp - 0x4c]
push eax
call dword [sym.imp.kernel32.dll_GetStartupInfoW]
test byte [ebp - 0x20], 1
jne 0x40b8db
mov word [ebp - 0x1c], 1
push 0
call dword [sym.imp.kernel32.dll_GetModuleHandleW]
movzx ecx, word [ebp - 0x1c]
push ecx
push esi
push 0
push eax
call dbg._wWinMain@16
add esp, 0x44
pop esi
pop ebx
pop ebp
ret

Function at 0x42e000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x42e00c
pop eax
nop
nop
nop
nop
nop
add eax, 0x403ac5
nop
sub eax, 0x403a6b
nop
nop
nop
nop
mov ebx, dword [eax]
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
xor dword [ebx], edx
nop
nop
add ebx, 4
nop
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
nop
nop
jl 0x42e030
nop
nop
add eax, 0xc
nop
nop
nop
nop
cmp dword [eax], 0
nop
nop
nop
jne 0x42e01e
nop
nop
nop
nop
nop
nop
popal
jmp fcn.00401219

Function at 0x42e000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..rsrc
mov ebx, 0x407ef8
nop
nop
mov ecx, 0x4819473b
nop
nop
test eax, eax
nop
nop
je 0x42e04e
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
inc eax
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
jne 0x42e024
nop
nop
nop
nop
mov eax, section..data
nop
mov ebx, 0x42cd70
nop
mov ecx, 0x2fc602be
nop
nop
nop
nop
test eax, eax
nop
je 0x42e084
nop
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
add eax, 4
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x42e06c
nop
nop
nop
nop
nop
nop
nop
popal
nop
jmp 0x401219
Function at 0x10040a40
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10081bd5
mov eax, dword fs:[0]
push eax
sub esp, 0x44
mov eax, dword [0x100b3040]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
lea eax, [ebp - 0x44]
mov dword [ebp - 0x44], 0
push eax
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
push eax
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
xor esi, esi
mov ecx, eax
mov dword [ebp - 0x48], ecx
cmp dword [ebp - 0x44], esi
jle 0x10040bbc
mov edi, dword [ecx + esi*4]
mov eax, edi
lea edx, [eax + 2]
nop word [eax + eax]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x10040aa0
push 0
push 0
push 0
sub eax, edx
push 0
sar eax, 1
inc eax
push eax
push edi
push 0x80
push 0xfde9
mov dword [ebp - 0x50], eax
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov dword [ebp - 0x4c], eax
xorps xmm0, xmm0
test eax, eax
jne 0x10040aea
movups xmmword [ebp - 0x40], xmm0
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x2c], 0xf
mov byte [ebp - 0x40], al
jmp 0x10040b5c
movups xmmword [ebp - 0x28], xmm0
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0xf
mov byte [ebp - 0x28], 0
push ecx
push eax
lea ecx, [ebp - 0x28]
mov dword [ebp - 4], 0
call fcn.100591c0
cmp dword [ebp - 0x14], 0xf
lea eax, [ebp - 0x28]
push 0
cmova eax, dword [ebp - 0x28]
push 0
push dword [ebp - 0x4c]
push eax
push dword [ebp - 0x50]
push edi
push 0x80
push 0xfde9
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
movups xmm0, xmmword [ebp - 0x28]
mov byte [ebp - 0x28], 0
movups xmmword [ebp - 0x40], xmm0
movq xmm0, qword [ebp - 0x18]
movq qword [ebp - 0x30], xmm0
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0xf
lea eax, [ebp - 0x40]
mov dword [ebp - 4], 1
push eax
mov ecx, 0x100b4ab4
call fcn.10040d10
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0x2c]
cmp ecx, 0xf
jbe 0x10040ba8
mov edx, dword [ebp - 0x40]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x10040b9e
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x10040bb6
push ecx
push edx
call fcn.1008095a
add esp, 8
inc esi
cmp esi, dword [ebp - 0x44]
jge 0x10040bbc
mov ecx, dword [ebp - 0x48]
jmp 0x10040a92
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
call fcn.100404c0
push 0x100408f0
lea ecx, [eax + 0x34]
call fcn.10040d80
call fcn.100404c0
push 0x10040990
lea ecx, [eax + 0x28]
call fcn.10040d80
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.10080947
mov esp, ebp
pop ebp
ret
Function at 0x10041330
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10081c4d
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push ebx
push esi
push edi
mov eax, dword [0x100b3040]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edx, ecx
mov dword [ebp - 0x14], edx
mov ecx, dword [edx]
xor edi, edi
mov esi, dword [ebp + 0xc]
mov ebx, ecx
mov dword [ebp - 0x18], ecx
mov eax, dword [ecx + 4]
mov dword [ebp - 0x10], eax
lea ecx, [esi + 0x30]
cmp byte [eax + 0xd], 0
jne 0x100413ae
mov edx, dword [ecx]
nop word [eax + eax]
mov dword [ebp - 0x10], eax
cmp dword [eax + 0x40], edx
jl 0x1004139d
jne 0x10041392
mov ecx, dword [eax + 0x3c]
cmp ecx, dword [esi + 0x2c]
jb 0x1004139d
mov ebx, eax
mov edi, 1
mov eax, dword [eax]
jmp 0x100413a2
mov eax, dword [eax + 8]
xor edi, edi
cmp byte [eax + 0xd], 0
je 0x10041380
mov edx, dword [ebp - 0x14]
lea ecx, [esi + 0x30]
cmp byte [ebx + 0xd], 0
jne 0x100413e2
mov eax, dword [ecx]
cmp eax, dword [ebx + 0x40]
jl 0x100413e2
jne 0x100413c5
mov eax, dword [esi + 0x2c]
cmp eax, dword [ebx + 0x3c]
jb 0x100413e2
mov eax, dword [ebp + 8]
mov dword [eax], ebx
mov byte [eax + 4], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
cmp dword [edx + 4], 0x38e38e3
je 0x100414a7
mov dword [ebp - 0x20], edx
mov dword [ebp - 4], 0
push 0x48
mov dword [ebp - 0x1c], 0
call fcn.10080a48
mov edx, eax
add esp, 4
lea ebx, [edx + 0x10]
mov dword [ebp + 0xc], edx
mov dword [ebx + 0x24], 0
mov ecx, dword [esi + 0x24]
test ecx, ecx
je 0x1004144c
cmp ecx, esi
jne 0x1004149b
mov eax, dword [ecx]
push ebx
call dword [eax + 4]
mov dword [ebx + 0x24], eax
mov ecx, dword [esi + 0x24]
test ecx, ecx
je 0x10041449
mov edx, dword [ecx]
cmp ecx, esi
setne al
movzx eax, al
push eax
call dword [edx + 0x10]
mov dword [esi + 0x24], 0
mov edx, dword [ebp + 0xc]
mov eax, dword [esi + 0x28]
mov ecx, dword [ebp - 0x14]
mov dword [ebx + 0x28], eax
mov eax, dword [esi + 0x2c]
mov dword [ebx + 0x2c], eax
mov eax, dword [esi + 0x30]
mov dword [ebx + 0x30], eax
mov eax, dword [ebp - 0x18]
push edx
mov dword [edx], eax
push edi
push dword [ebp - 0x10]
mov dword [edx + 4], eax
mov dword [edx + 8], eax
mov word [edx + 0xc], 0
call fcn.100414b0
mov ecx, dword [ebp + 8]
mov dword [ecx], eax
mov eax, ecx
mov byte [ecx + 4], 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
mov dword [ebx + 0x24], ecx
mov dword [esi + 0x24], 0
jmp 0x1004144c
call fcn.100404b0
int3
Function at 0x10041810
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push ebx
push esi
push edi
mov edi, ecx
lea eax, [edi + 0x20]
mov ecx, eax
mov dword [ebp - 0x14], eax
call fcn.10042120
mov edi, dword [edi + 4]
mov dword [ebp - 0x18], edi
mov esi, dword [edi]
cmp esi, edi
je 0x10041915
nop dword [eax + eax]
mov eax, dword [esi + 8]
mov ebx, dword [esi + 0x10]
mov ecx, dword [ebp - 0x14]
sub ebx, dword [esi + 0xc]
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0xc]
push eax
call fcn.10041ef0
mov edx, eax
mov dword [ebp - 8], edx
mov ecx, dword [edx + 4]
mov eax, dword [edx]
mov dword [ebp - 4], ecx
sub ecx, eax
cmp ebx, ecx
jb 0x1004189a
jbe 0x1004189f
mov eax, dword [edx + 8]
sub eax, dword [edx]
cmp ebx, eax
jbe 0x10041884
push ecx
push ebx
mov ecx, edx
call fcn.10042c20
mov edx, dword [ebp - 8]
jmp 0x1004189f
sub ebx, ecx
push ebx
push 0
push dword [ebp - 4]
call sub.VCRUNTIME140.dll_memset
mov eax, dword [ebp - 4]
add esp, 0xc
mov edx, dword [ebp - 8]
add eax, ebx
mov dword [edx + 4], eax
mov ecx, dword [edx]
mov eax, dword [edx + 4]
sub eax, ecx
push eax
push dword [ebp - 0xc]
push ecx
call sub.VCRUNTIME140.dll_memcpy
mov ecx, dword [esi + 8]
lea eax, [ebp - 0x10]
add esp, 0xc
mov dword [ebp - 0xc], ecx
push eax
mov eax, dword [esi + 0x10]
sub eax, dword [esi + 0xc]
push 0x40
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov ebx, dword [esi + 0x10]
xor eax, eax
mov edx, dword [esi + 0xc]
mov ecx, ebx
sub ecx, edx
je 0x100418f8
mov edi, dword [ebp - 0xc]
nop
mov cl, byte [edx + eax]
mov byte [edi + eax], cl
inc eax
mov ebx, dword [esi + 0x10]
mov ecx, ebx
mov edx, dword [esi + 0xc]
sub ecx, edx
cmp eax, ecx
jb 0x100418e0
mov edi, dword [ebp - 0x18]
lea eax, [ebp - 0x10]
sub ebx, edx
push eax
push dword [ebp - 0x10]
push ebx
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov esi, dword [esi]
cmp esi, edi
jne 0x10041840
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x10041920
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push esi
lea eax, [ecx + 0x20]
push edi
mov edi, dword [eax + 4]
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], edi
mov esi, dword [edi]
cmp esi, edi
je 0x100419a5
push ebx
nop dword [eax + eax]
mov ecx, dword [esi + 8]
lea eax, [ebp - 4]
push eax
mov eax, dword [esi + 0x10]
sub eax, dword [esi + 0xc]
push 0x40
push eax
push ecx
mov dword [ebp - 8], ecx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov ebx, dword [esi + 0x10]
xor eax, eax
mov edx, dword [esi + 0xc]
mov ecx, ebx
sub ecx, edx
je 0x10041988
mov edi, dword [ebp - 8]
nop dword [eax + eax]
mov cl, byte [edx + eax]
mov byte [edi + eax], cl
inc eax
mov ebx, dword [esi + 0x10]
mov ecx, ebx
mov edx, dword [esi + 0xc]
sub ecx, edx
cmp eax, ecx
jb 0x10041970
mov edi, dword [ebp - 0xc]
lea eax, [ebp - 4]
sub ebx, edx
push eax
push dword [ebp - 4]
push ebx
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov esi, dword [esi]
cmp esi, edi
jne 0x10041940
mov eax, dword [ebp - 0x10]
pop ebx
mov ecx, eax
call fcn.10042120
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x10041ef0
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10081db5
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push ebx
push esi
push edi
mov eax, dword [0x100b3040]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov edi, dword [ebp + 8]
movzx eax, byte [edi]
xor eax, 0x811c9dc5
imul edx, eax, 0x1000193
movzx eax, byte [edi + 1]
xor edx, eax
movzx eax, byte [edi + 2]
imul edx, edx, 0x1000193
xor edx, eax
movzx eax, byte [edi + 3]
imul ecx, edx, 0x1000193
xor ecx, eax
lea eax, [ebp - 0x1c]
imul ebx, ecx, 0x1000193
mov ecx, esi
push ebx
push edi
push eax
call fcn.10042d30
mov eax, dword [ebp - 0x18]
test eax, eax
jne 0x1004202d
cmp dword [esi + 8], 0xaaaaaaa
jne 0x10041f7b
push str.unordered_map_set_too_long
call dword [sym.imp.MSVCP140.dll_void___cdecl_std::_Xlength_error_char_const__]
lea eax, [esi + 4]
mov dword [ebp - 0x14], eax
mov dword [ebp - 4], 0
push 0x18
mov dword [ebp - 0x10], 0
call fcn.10080a48
mov dword [ebp - 0x10], eax
add esp, 4
lea ecx, [eax + 8]
mov eax, dword [edi]
mov dword [ecx], eax
mov dword [ecx + 4], 0
mov dword [ecx + 8], 0
mov dword [ecx + 0xc], 0
mov dword [ebp - 4], 1
mov eax, dword [esi + 8]
inc eax
movd xmm0, eax
cvtdq2pd xmm0, xmm0
shr eax, 0x1f
addsd xmm0, qword [eax*8 + 0x100ac1f0]
mov eax, dword [esi + 0x1c]
cvtpd2ps xmm1, xmm0
movd xmm0, eax
cvtdq2pd xmm0, xmm0
shr eax, 0x1f
addsd xmm0, qword [eax*8 + 0x100ac1f0]
cvtpd2ps xmm0, xmm0
divss xmm1, xmm0
comiss xmm1, dword [esi]
jbe 0x1004201d
mov ecx, esi
call fcn.100429a0
mov edi, dword [ebp - 0x10]
mov ecx, esi
push ebx
lea eax, [edi + 8]
push eax
lea eax, [ebp - 0x14]
push eax
call fcn.10042d30
mov ecx, dword [eax]
jmp 0x10042023
mov ecx, dword [ebp - 0x1c]
mov edi, dword [ebp - 0x10]
push edi
push ecx
push ebx
mov ecx, esi
call fcn.10042a30
add eax, 0xc
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x10042200
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [ebp + 0xc]
mov edx, ecx
push ebx
mov ebx, dword [ebp + 8]
mov dword [ebp - 0x10], edx
cmp ebx, eax
je 0x10042371
mov eax, dword [edx + 4]
mov dword [ebp - 0x14], eax
mov eax, dword [ebx + 4]
mov dword [ebp - 4], eax
movzx eax, byte [ebx + 8]
xor eax, 0x811c9dc5
imul ecx, eax, 0x1000193
movzx eax, byte [ebx + 9]
push esi
push edi
mov edi, dword [edx + 0xc]
mov esi, ebx
xor ecx, eax
mov dword [ebp - 0x1c], edi
movzx eax, byte [ebx + 0xa]
imul ecx, ecx, 0x1000193
xor ecx, eax
movzx eax, byte [ebx + 0xb]
imul ecx, ecx, 0x1000193
xor ecx, eax
mov eax, dword [edx + 0x18]
imul ecx, ecx, 0x1000193
and eax, ecx
mov ecx, dword [edi + eax*8]
mov dword [ebp - 0xc], ecx
lea eax, [edi + eax*8]
mov dword [ebp - 8], eax
mov eax, dword [eax + 4]
mov dword [ebp - 0x18], eax
nop word [eax + eax]
mov edi, esi
mov ebx, esi
mov esi, dword [esi]
lea ecx, [edi + 8]
call fcn.10041c40
push 0x18
push edi
call fcn.1008095a
mov edx, dword [ebp - 0x10]
add esp, 8
dec dword [edx + 8]
cmp ebx, dword [ebp - 0x18]
je 0x100422cd
mov eax, dword [ebp + 0xc]
cmp esi, eax
jne 0x10042280
mov ecx, dword [ebp - 0xc]
cmp ecx, dword [ebp + 8]
jne 0x10042367
mov edi, dword [ebp - 8]
mov ecx, dword [ebp - 4]
mov dword [edi], esi
mov dword [ecx], esi
pop edi
mov dword [esi + 4], ecx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
mov ecx, dword [ebp - 0xc]
mov edi, dword [ebp - 8]
cmp ecx, dword [ebp + 8]
jne 0x100422e1
mov eax, dword [ebp - 0x14]
mov ecx, eax
mov dword [edi], eax
jmp 0x100422e4
mov ecx, dword [ebp - 4]
mov eax, dword [ebp + 0xc]
mov dword [edi + 4], ecx
cmp esi, eax
je 0x10042367
nop
movzx eax, byte [esi + 8]
xor eax, 0x811c9dc5
imul ecx, eax, 0x1000193
movzx eax, byte [esi + 9]
xor ecx, eax
movzx eax, byte [esi + 0xa]
imul ecx, ecx, 0x1000193
xor ecx, eax
movzx eax, byte [esi + 0xb]
imul ecx, ecx, 0x1000193
xor ecx, eax
mov eax, dword [edx + 0x18]
imul ecx, ecx, 0x1000193
and eax, ecx
mov ecx, dword [ebp - 0x1c]
lea eax, [ecx + eax*8]
mov dword [ebp + 8], eax
mov eax, dword [eax + 4]
mov dword [ebp - 0x18], eax
mov edi, esi
mov ebx, esi
mov esi, dword [esi]
lea ecx, [edi + 8]
call fcn.10041c40
push 0x18
push edi
call fcn.1008095a
mov edx, dword [ebp - 0x10]
add esp, 8
mov eax, dword [ebp + 0xc]
dec dword [edx + 8]
cmp ebx, dword [ebp - 0x18]
je 0x10042378
cmp esi, eax
jne 0x10042337
mov ecx, dword [ebp + 8]
mov dword [ecx], esi
mov ecx, dword [ebp - 4]
pop edi
mov dword [ecx], esi
mov dword [esi + 4], ecx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
mov ecx, dword [ebp + 8]
mov ebx, dword [ebp - 0x14]
mov dword [ecx], ebx
mov dword [ecx + 4], ebx
cmp esi, eax
jne 0x100422f0
mov ecx, dword [ebp - 4]
pop edi
mov dword [ecx], esi
mov dword [esi + 4], ecx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x100426e0
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10081ea5
mov eax, dword fs:[0]
push eax
sub esp, 0x24
push ebx
push esi
push edi
mov eax, dword [0x100b3040]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x14], esi
mov ebx, dword [ebp + 8]
cmp ebx, dword [ebp + 0xc]
je 0x10042892
add ebx, 8
nop dword [eax]
movzx eax, byte [ebx - 8]
lea edi, [ebx - 8]
xor eax, 0x811c9dc5
imul ecx, eax, 0x1000193
movzx eax, byte [ebx - 7]
xor ecx, eax
movzx eax, byte [ebx - 6]
imul ecx, ecx, 0x1000193
xor ecx, eax
movzx eax, byte [ebx - 5]
imul ecx, ecx, 0x1000193
xor ecx, eax
imul eax, ecx, 0x1000193
mov ecx, esi
push eax
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x20]
push edi
push eax
call fcn.10042d30
cmp dword [ebp - 0x1c], 0
jne 0x10042883
cmp dword [esi + 8], 0xaaaaaaa
je 0x100428a6
lea eax, [esi + 4]
mov dword [ebp - 0x28], eax
mov dword [ebp - 4], 0
push 0x18
mov dword [ebp - 0x24], 0
call fcn.10080a48
mov ecx, dword [edi]
add esp, 4
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x24], eax
add eax, 8
lea edi, [eax + 4]
mov dword [ebp + 8], eax
mov dword [eax], ecx
mov dword [edi], 0
mov dword [edi + 4], 0
mov dword [edi + 8], 0
mov eax, dword [ebx]
sub eax, dword [ebx - 4]
je 0x100427f1
push eax
mov ecx, edi
call fcn.10042910
mov esi, dword [ebx]
mov eax, dword [ebx - 4]
sub esi, eax
mov edi, dword [edi]
push esi
push eax
push edi
call sub.VCRUNTIME140.dll_memmove
mov ecx, dword [ebp + 8]
lea eax, [esi + edi]
mov esi, dword [ebp - 0x14]
add esp, 0xc
mov dword [ecx + 8], eax
mov dword [ebp - 4], 1
mov eax, dword [esi + 8]
inc eax
movd xmm0, eax
cvtdq2pd xmm0, xmm0
shr eax, 0x1f
addsd xmm0, qword [eax*8 + 0x100ac1f0]
mov eax, dword [esi + 0x1c]
cvtpd2ps xmm1, xmm0
movd xmm0, eax
cvtdq2pd xmm0, xmm0
shr eax, 0x1f
addsd xmm0, qword [eax*8 + 0x100ac1f0]
cvtpd2ps xmm0, xmm0
divss xmm1, xmm0
comiss xmm1, dword [esi]
seta al
test al, al
je 0x10042863
mov ecx, esi
call fcn.100429a0
mov edi, dword [ebp - 0x10]
lea eax, [ebp - 0x30]
push edi
push dword [ebp + 8]
mov ecx, esi
push eax
call fcn.10042d30
mov ecx, dword [eax]
mov eax, dword [eax + 4]
mov dword [ebp - 0x20], ecx
mov dword [ebp - 0x1c], eax
jmp 0x10042869
mov ecx, dword [ebp - 0x20]
mov edi, dword [ebp - 0x10]
push dword [ebp - 0x18]
mov dword [ebp - 0x24], 0
push ecx
push edi
mov ecx, esi
call fcn.10042a30
mov dword [ebp - 4], 0xffffffff
add ebx, 0x10
lea eax, [ebx - 8]
cmp eax, dword [ebp + 0xc]
jne 0x10042720
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
push str.unordered_map_set_too_long
call dword [sym.imp.MSVCP140.dll_void___cdecl_std::_Xlength_error_char_const__]
int3
Function at 0x10042ab0
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov edx, dword [ebp + 8]
mov eax, 0x1fffffff
push ebx
mov ebx, ecx
bsr ecx, eax
push esi
push edi
mov edi, 1
mov dword [ebp - 4], ebx
mov eax, edi
shl eax, cl
cmp edx, eax
jbe 0x10042ae1
push str.invalid_hash_bucket_count
call dword [sym.imp.MSVCP140.dll_void___cdecl_std::_Xlength_error_char_const__]
mov esi, dword [ebx + 4]
lea eax, [edx - 1]
or eax, 1
mov dword [ebp + 8], esi
bsr ecx, eax
push esi
lea ecx, [ecx + 1]
shl edi, cl
lea ecx, [ebx + 0xc]
lea eax, [edi + edi]
push eax
call fcn.100424c0
lea eax, [edi - 1]
mov dword [ebx + 0x1c], edi
mov dword [ebx + 0x18], eax
mov eax, dword [ebx + 4]
mov eax, dword [eax]
mov ecx, eax
cmp eax, esi
je 0x10042bec
nop word [eax + eax]
movzx edx, byte [eax + 8]
xor edx, 0x811c9dc5
mov ecx, dword [ecx]
imul edi, edx, 0x1000193
movzx edx, byte [eax + 9]
xor edi, edx
movzx edx, byte [eax + 0xa]
imul edi, edi, 0x1000193
xor edi, edx
movzx edx, byte [eax + 0xb]
imul edi, edi, 0x1000193
xor edi, edx
mov edx, dword [ebx + 0xc]
imul edi, edi, 0x1000193
and edi, dword [ebx + 0x18]
lea edx, [edx + edi*8]
mov edi, dword [edx]
mov dword [ebp - 8], edx
cmp edi, esi
jne 0x10042b6f
mov dword [edx], eax
mov dword [edx + 4], eax
jmp 0x10042be2
mov edx, dword [edx + 4]
mov ebx, dword [eax + 8]
cmp ebx, dword [edx + 8]
jne 0x10042ba9
mov edx, dword [edx]
mov dword [ebp - 0xc], edx
cmp edx, eax
je 0x10042ba1
mov ebx, dword [eax + 4]
mov esi, dword [ebp - 0xc]
mov dword [ebx], ecx
mov edi, dword [ecx + 4]
mov dword [edi], edx
mov edx, dword [edx + 4]
mov dword [edx], eax
mov dword [esi + 4], edi
mov esi, dword [ebp + 8]
mov dword [ecx + 4], ebx
mov dword [eax + 4], edx
mov edx, dword [ebp - 8]
mov dword [edx + 4], eax
jmp 0x10042bdf
cmp edi, edx
je 0x10042bbc
nop dword [eax]
mov edx, dword [edx + 4]
cmp ebx, dword [edx + 8]
je 0x10042bf5
cmp edi, edx
jne 0x10042bb0
mov ebx, dword [eax + 4]
mov dword [ebp - 0xc], ebx
mov dword [ebx], ecx
mov ebx, dword [ecx + 4]
mov dword [ebx], edx
mov edi, dword [edx + 4]
mov dword [edi], eax
mov dword [edx + 4], ebx
mov edx, dword [ebp - 0xc]
mov dword [ecx + 4], edx
mov edx, dword [ebp - 8]
mov dword [eax + 4], edi
mov dword [edx], eax
mov ebx, dword [ebp - 4]
mov eax, ecx
cmp ecx, esi
jne 0x10042b20
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
mov ebx, dword [eax + 4]
mov edx, dword [edx]
mov dword [ebp - 0xc], edx
mov esi, edx
mov dword [ebx], ecx
mov edi, dword [ecx + 4]
mov dword [edi], edx
mov edx, dword [edx + 4]
mov dword [edx], eax
mov dword [esi + 4], edi
mov esi, dword [ebp + 8]
mov dword [ecx + 4], ebx
mov dword [eax + 4], edx
jmp 0x10042bdf