joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100fd850
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x114
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
push str._5_3
push esi
mov edi, ecx
mov dword [ebp - 4], edx
push str._s_s
push edi
call fcn.100ec660
push eax
call dword [sym.imp.api_ms_win_crt_environment_l1_1_0.dll_getenv]
mov ebx, eax
add esp, 0x14
test ebx, ebx
jne 0x100fd89a
push esi
call dword [sym.imp.api_ms_win_crt_environment_l1_1_0.dll_getenv]
mov ebx, eax
add esp, 4
test ebx, ebx
jne 0x100fd89a
lea esi, [edi + 0xc]
jmp 0x100fd8d9
push str.LUA_NOENV
mov edx, 0xfff0b9d8
mov ecx, edi
call fcn.100ec0e0
mov edx, eax
mov ecx, edi
call fcn.100ec750
add esp, 4
or edx, 0xffffffff
mov ecx, edi
call fcn.100ec0e0
mov ecx, dword [eax + 8]
test ecx, ecx
je 0x100fd911
cmp ecx, 1
jne 0x100fd8d2
cmp dword [eax], 0
je 0x100fd911
add dword [edi + 0xc], 0xfffffff0
lea esi, [edi + 0xc]
mov edx, dword [ebp + 0xc]
test edx, edx
jne 0x100fd8e7
mov eax, dword [esi]
mov dword [eax + 8], edx
jmp 0x100fd8fc
mov ecx, edi
call fcn.10105850
mov ecx, dword [esi]
mov dword [ecx], eax
movzx eax, byte [eax + 4]
or eax, 0x40
mov dword [ecx + 8], eax
mov eax, dword [edi + 0x10]
add dword [esi], 0x10
cmp dword [eax + 0xc], 0
jle 0x100fd950
mov ecx, edi
call fcn.100f8530
jmp 0x100fd950
add dword [edi + 0xc], 0xfffffff0
lea esi, [edi + 0xc]
push 0x10248828
push 0x1024882c
mov edx, ebx
mov ecx, edi
call fcn.100ef360
push dword [ebp + 0xc]
mov edx, eax
mov ecx, edi
push 0x1024874c
call fcn.100ef360
push 0xffffffffffffffff
mov edx, 0xfffffffe
mov ecx, edi
call fcn.100ec290
add esp, 0x14
add dword [esi], 0xfffffff0
push 0x105
lea eax, [ebp - 0x110]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
je 0x100fda26
cmp eax, 0x105
je 0x100fda26
lea eax, [ebp - 0x110]
push 0x5c
push eax
call dword [sym.imp.VCRUNTIME140.dll_strrchr]
add esp, 8
test eax, eax
je 0x100fda26
or edx, 0xffffffff
mov byte [eax], 0
mov ecx, edi
call fcn.100ec0e0
mov ecx, dword [eax + 8]
and ecx, 0xf
cmp ecx, 4
je 0x100fd9d5
cmp ecx, 3
je 0x100fd9b2
xor edx, edx
jmp 0x100fd9da
mov edx, eax
mov ecx, edi
call fcn.100ff760
mov eax, dword [edi + 0x10]
cmp dword [eax + 0xc], 0
jle 0x100fd9cb
mov ecx, edi
call fcn.100f8530
or edx, 0xffffffff
mov ecx, edi
call fcn.100ec0e0
mov edx, dword [eax]
add edx, 0x10
lea eax, [ebp - 0x110]
mov ecx, edi
push eax
push 0x102487f4
call fcn.100ef360
push 0xffffffffffffffff
mov edx, 0xfffffffe
mov ecx, edi
call fcn.100ec290
add dword [esi], 0xfffffff0
add esp, 0xc
mov edx, 0xfffffffd
mov ecx, edi
push dword [ebp - 4]
call fcn.100ec0e0
mov edx, eax
mov ecx, edi
call fcn.100ec840
add esp, 4
add dword [esi], 0xfffffff0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push str.unable_to_get_ModuleFileName
push edi
call fcn.100edd20
int3
Function at 0x100ff240
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
sub esp, 0x20
push esi
push edi
mov dword [ebp - 0x10], edx
mov esi, ecx
call dword [sym.imp.api_ms_win_crt_locale_l1_1_0.dll_localeconv]
xor ecx, ecx
xor edi, edi
mov dword [ebp - 0xc], ecx
xorps xmm1, xmm1
mov eax, dword [eax]
movsx eax, byte [eax]
mov dword [ebp - 0x1c], eax
xor eax, eax
mov dword [ebp - 8], eax
mov eax, dword [ebp - 0x10]
mov dword [eax], esi
mov cl, byte [esi]
movzx eax, cl
test byte [eax + 0x10207269], 8
je 0x100ff2a0
mov cl, byte [esi + 1]
inc esi
movzx eax, cl
test byte [eax + 0x10207269], 8
jne 0x100ff290
lea edx, [esi + 1]
cmp cl, 0x2d
jne 0x100ff2b1
mov dword [ebp - 0x14], 1
jmp 0x100ff2ba
cmp cl, 0x2b
mov dword [ebp - 0x14], edi
cmovne edx, esi
cmp byte [edx], 0x30
jne 0x100ff3ff
mov al, byte [edx + 1]
cmp al, 0x78
je 0x100ff2d2
cmp al, 0x58
jne 0x100ff3ff
movsd xmm2, qword [0x10251650]
add edx, 2
xor esi, esi
nop
mov al, byte [edx]
movsx ecx, al
mov byte [ebp - 1], al
cmp ecx, dword [ebp - 0x1c]
jne 0x100ff2f9
test esi, esi
jne 0x100ff34f
mov esi, 1
inc edx
jmp 0x100ff2e0
movzx eax, al
test byte [eax + 0x10207269], 0x10
je 0x100ff34f
mov eax, dword [ebp - 8]
test eax, eax
jne 0x100ff317
cmp byte [ebp - 1], 0x30
jne 0x100ff317
inc dword [ebp - 0xc]
jmp 0x100ff347
inc eax
mov dword [ebp - 8], eax
cmp eax, 0x1e
jg 0x100ff346
test byte [ecx + 0x10207269], 2
je 0x100ff32e
add ecx, 0xffffffd0
jmp 0x100ff334
or ecx, 0x20
sub ecx, 0x57
movd xmm0, ecx
cvtdq2pd xmm0, xmm0
mulsd xmm1, xmm2
addsd xmm1, xmm0
jmp 0x100ff347
inc edi
test esi, esi
je 0x100ff34c
dec edi
inc edx
jmp 0x100ff2e0
mov eax, dword [ebp - 8]
add eax, dword [ebp - 0xc]
je 0x100ff3ff
mov eax, dword [ebp - 0x10]
shl edi, 2
mov dword [eax], edx
mov al, byte [edx]
cmp al, 0x70
je 0x100ff36d
cmp al, 0x50
jne 0x100ff3cf
mov al, byte [edx + 1]
xor ecx, ecx
mov byte [ebp - 1], al
cmp al, 0x2d
jne 0x100ff381
lea esi, [ecx + 1]
lea eax, [ecx + 2]
jmp 0x100ff38d
xor eax, eax
xor esi, esi
cmp byte [ebp - 1], 0x2b
sete al
inc eax
add edx, eax
mov al, byte [edx]
mov byte [ebp - 1], al
movzx eax, al
test byte [eax + 0x10207269], 2
je 0x100ff3ff
movsx eax, byte [ebp - 1]
lea ecx, [ecx + ecx*4]
inc edx
lea ecx, [ecx - 0x18]
lea ecx, [eax + ecx*2]
mov al, byte [edx]
mov byte [ebp - 1], al
movzx eax, al
test byte [eax + 0x10207269], 2
jne 0x100ff3a0
mov eax, ecx
neg eax
test esi, esi
cmove eax, ecx
add edi, eax
mov eax, dword [ebp - 0x10]
mov dword [eax], edx
cmp dword [ebp - 0x14], 0
je 0x100ff3dc
xorps xmm1, xmmword [0x10251e30]
push edi
sub esp, 8
movsd qword [esp], xmm1
call dword [sym.imp.api_ms_win_crt_math_l1_1_0.dll_ldexp]
fstp qword [ebp - 0x20]
movsd xmm0, qword [ebp - 0x20]
add esp, 0xc
pop edi
pop esi
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret
pop edi
xorps xmm0, xmm0
pop esi
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret
Function at 0x100ff630
Capabilities:
Check http status code

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xe4
push ebx
mov ebx, edx
lea edx, [ebp - 8]
push esi
push edi
mov dword [ebp - 0xc], ebx
mov edi, ecx
call fcn.100ff480
mov esi, eax
test esi, esi
je 0x100ff670
mov edx, dword [ebp - 8]
sub esi, edi
mov ecx, dword [ebp - 4]
mov eax, 0x13
mov dword [ebx], edx
mov dword [ebx + 4], ecx
mov dword [ebx + 8], eax
lea eax, [esi + 1]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push str..xXnN
push edi
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strpbrk]
add esp, 8
test eax, eax
je 0x100ff697
movzx ebx, byte [eax]
or ebx, 0x20
cmp ebx, 0x6e
jne 0x100ff699
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
xor ebx, ebx
push ebx
lea edx, [ebp - 8]
mov ecx, edi
call fcn.100ff410
mov esi, eax
add esp, 4
test esi, esi
jne 0x100ff733
push 0x2e
push edi
call dword [sym.imp.VCRUNTIME140.dll_strchr]
mov edx, edi
mov esi, eax
add esp, 8
lea eax, [edx + 1]
mov cl, byte [edx]
inc edx
test cl, cl
jne 0x100ff6c4
sub edx, eax
cmp edx, 0xc8
ja 0x100ff68e
test esi, esi
je 0x100ff68e
lea edx, [ebp - 0xe0]
mov ecx, edi
sub edx, edi
mov al, byte [ecx]
lea ecx, [ecx + 1]
mov byte [edx + ecx - 1], al
test al, al
jne 0x100ff6e3
call dword [sym.imp.api_ms_win_crt_locale_l1_1_0.dll_localeconv]
sub esi, edi
lea edx, [ebp - 8]
push ebx
lea ecx, [ebp - 0xe0]
mov eax, dword [eax]
mov al, byte [eax]
mov byte [ebp + esi - 0xe0], al
call fcn.100ff410
mov esi, eax
add esp, 4
test esi, esi
je 0x100ff68e
mov eax, edi
lea ecx, [ebp - 0xe0]
sub eax, ecx
add esi, eax
test esi, esi
je 0x100ff68e
mov ebx, dword [ebp - 0xc]
sub esi, edi
movsd xmm0, qword [ebp - 8]
mov eax, 3
pop edi
movsd qword [ebx], xmm0
mov dword [ebx + 8], eax
lea eax, [esi + 1]
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10105300
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x1c
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
mov edi, dword [ebp + 0xc]
push 0x338
push 8
push 0
push edi
call ebx
mov ecx, eax
add esp, 0x10
mov dword [esp + 0x10], ecx
test ecx, ecx
jne 0x10105332
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea eax, [ecx + 4]
mov byte [ecx + 0xbc], 1
lea esi, [ecx + 0x80]
mov dword [eax], 0
xor ecx, ecx
mov dword [eax + 4], pe_nt_image_headers32
mov word [eax + 0x6e], cx
mov dword [eax + 0x10], esi
mov dword [eax + 0x20], 0
mov dword [eax + 0x14], 0
mov dword [eax + 0x60], 0
mov dword [eax + 0x2c], eax
mov dword [eax + 0x30], 0
mov dword [eax + 0x58], ecx
mov dword [eax + 0x70], ecx
mov dword [eax + 0x64], ecx
mov dword [eax + 0x68], ecx
mov dword [eax + 0x24], ecx
mov ecx, 1
mov byte [eax + 0x74], 1
mov word [eax + 0x6c], cx
mov byte [eax + 8], 0
mov dword [eax + 0x5c], 0
mov dword [esi + 0x7c], eax
mov dword [esp + 0x18], eax
lea eax, [esp + 0x14]
mov dword [esi], ebx
lea ebx, [ecx + 0xf]
push 0
mov dword [esi + 4], edi
mov dword [esp + 0x20], eax
mov dword [esp + 0x24], 0x10207740
mov dword [esp + 0x28], fcn.10105300
call dword [sym.imp.api_ms_win_crt_time_l1_1_0.dll__time64]
mov edi, eax
add esp, 4
xor edi, ebx
movzx edx, byte [esp + ebx + 0x17]
mov ecx, edi
shl ecx, 5
mov eax, edi
add edx, ecx
shr eax, 2
add edx, eax
dec ebx
xor edi, edx
cmp ebx, 1
jae 0x101053d4
mov dword [esi + 0x38], edi
mov edx, 0x10104fd0
mov word [esi + 0x3e], 0
mov dword [esi + 0x14], 0
mov dword [esi + 0x1c], 0
mov dword [esi + 0x20], 0
mov dword [esi + 0x18], 0
mov dword [esi + 0x30], 0
mov dword [esi + 0x78], 0
mov dword [esi + 0x80], 0
mov byte [esi + 0x3d], 7
mov dword [esi + 0x64], 0
mov dword [esi + 0x60], 0
mov dword [esi + 0x48], 0
mov dword [esi + 0x40], 0
mov dword [esi + 0x44], 0
mov dword [esi + 0x50], 0
mov dword [esi + 0x4c], 0
mov dword [esi + 0x5c], 0
mov dword [esi + 0x58], 0
mov dword [esi + 0x54], 0
mov dword [esi + 0x68], 0
mov dword [esi + 8], 0x338
mov dword [esi + 0xc], 0
mov dword [esi + 0x6c], 0
mov dword [esi + 0x70], 0xc8
mov dword [esi + 0x74], 0xc8
mov dword [esi + 0xe8], 0
mov dword [esi + 0xec], 0
mov dword [esi + 0xf0], 0
mov dword [esi + 0xf4], 0
mov dword [esi + 0xf8], 0
mov dword [esi + 0xfc], 0
mov dword [esi + 0x100], 0
mov dword [esi + 0x104], 0
mov dword [esi + 0x108], 0
mov esi, dword [esp + 0x10]
add esi, 4
push 0
mov ecx, esi
call fcn.100f5550
add esp, 4
test eax, eax
je 0x1010551f
mov ecx, esi
call fcn.101051f0
xor esi, esi
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10105630
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
mov eax, ecx
mov dword [ebp - 0xc], edx
push esi
push edi
mov dword [ebp - 8], eax
mov edi, dword [eax + 0x10]
mov eax, dword [ebp + 8]
mov esi, eax
mov edx, eax
mov dword [ebp - 4], edi
shr edx, 5
mov ebx, dword [edi + 0x38]
inc edx
xor ebx, eax
cmp eax, edx
jb 0x1010567e
mov edi, dword [ebp - 0xc]
nop
movzx ecx, byte [edi + esi - 1]
mov eax, ebx
shl eax, 5
sub esi, edx
add ecx, eax
mov eax, ebx
shr eax, 2
add ecx, eax
xor ebx, ecx
cmp esi, edx
jae 0x10105660
mov edi, dword [ebp - 4]
mov edx, dword [edi + 0x20]
mov eax, dword [edi + 0x18]
lea ecx, [edx - 1]
and ecx, ebx
mov edi, dword [eax + ecx*4]
lea eax, [eax + ecx*4]
mov dword [ebp - 0x10], eax
test edi, edi
je 0x1010572c
mov ecx, dword [ebp + 8]
nop dword [eax]
movzx eax, byte [edi + 7]
cmp ecx, eax
jne 0x101056fb
mov edx, dword [ebp - 0xc]
lea eax, [edi + 0x10]
mov esi, ecx
sub esi, 4
jb 0x101056c6
mov ecx, dword [edx]
cmp ecx, dword [eax]
jne 0x101056cb
add edx, 4
add eax, 4
sub esi, 4
jae 0x101056b5
cmp esi, 0xfffffffc
je 0x1010570a
mov cl, byte [edx]
cmp cl, byte [eax]
jne 0x101056f8
cmp esi, 0xfffffffd
je 0x1010570a
mov cl, byte [edx + 1]
cmp cl, byte [eax + 1]
jne 0x101056f8
cmp esi, 0xfffffffe
je 0x1010570a
mov cl, byte [edx + 2]
cmp cl, byte [eax + 2]
jne 0x101056f8
cmp esi, 0xffffffff
je 0x1010570a
mov cl, byte [edx + 3]
cmp cl, byte [eax + 3]
je 0x1010570a
mov ecx, dword [ebp + 8]
mov edi, dword [edi + 0xc]
test edi, edi
jne 0x101056a0
mov esi, dword [ebp - 4]
mov edx, dword [esi + 0x20]
jmp 0x1010572f
mov ecx, dword [ebp - 4]
mov al, byte [edi + 5]
xor al, 3
mov cl, byte [ecx + 0x3c]
xor cl, 3
test al, cl
jne 0x101057b5
mov byte [edi + 5], al
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov esi, dword [ebp - 4]
mov edi, dword [ebp - 8]
cmp dword [esi + 0x1c], edx
jl 0x10105757
cmp edx, 0x3fffffff
jg 0x10105757
add edx, edx
mov ecx, edi
call fcn.10105530
mov ecx, dword [esi + 0x20]
mov eax, dword [esi + 0x18]
dec ecx
and ecx, ebx
lea eax, [eax + ecx*4]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 8]
xor edx, edx
mov esi, dword [edi + 0x10]
add eax, 0x11
push eax
push 4
mov ecx, edi
call fcn.100fd750
mov cl, byte [esi + 0x3c]
mov edi, eax
and cl, 3
mov byte [edi + 5], cl
lea eax, [edi + 0x10]
mov byte [edi + 4], 4
mov ecx, dword [esi + 0x40]
mov dword [edi], ecx
mov dword [esi + 0x40], edi
mov dword [edi + 8], ebx
mov ebx, dword [ebp + 8]
push ebx
push dword [ebp - 0xc]
mov byte [edi + 6], 0
push eax
mov byte [edi + ebx + 0x10], 0
call sub.VCRUNTIME140.dll_memcpy
mov ecx, dword [ebp - 0x10]
add esp, 0x14
mov byte [edi + 7], bl
mov eax, dword [ecx]
mov dword [edi + 0xc], eax
mov dword [ecx], edi
mov ecx, dword [ebp - 4]
inc dword [ecx + 0x1c]
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10109717
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [edx + 8]
push ebx
and eax, 0x3f
mov ebx, ecx
dec eax
mov dword [ebp - 4], ebx
push esi
push edi
cmp eax, 0x15
ja case.0x10109665.2
movzx eax, byte [eax + 0x101097c0]
jmp dword [eax*4 + 0x101097a8]
mov cl, byte [ebx + 7]
mov eax, 1
shl eax, cl
dec eax
and eax, dword [edx]
shl eax, 5
add eax, dword [ebx + 0x10]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
movsd xmm0, qword [edx]
lea eax, [ebp - 4]
push eax
sub esp, 8
movsd qword [esp], xmm0
call dword [sym.imp.api_ms_win_crt_math_l1_1_0.dll_frexp]
fmul qword [0x10251700]
add esp, 0xc
fstp qword [ebp - 0x10]
movsd xmm0, qword [ebp - 0x10]
comisd xmm0, xmmword [0x102518c8]
jb 0x101096d8
movsd xmm1, qword [0x102517d0]
comisd xmm1, xmm0
jbe 0x101096d8
call fcn.1019bac0
add eax, dword [ebp - 4]
cmp eax, 0x7fffffff
jbe 0x101096da
not eax
jmp 0x101096da
xor eax, eax
mov cl, byte [ebx + 7]
mov esi, 1
shl esi, cl
dec esi
cdq
or esi, 1
idiv esi
shl edx, 5
add edx, dword [ebx + 0x10]
mov eax, edx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov cl, byte [ebx + 7]
mov eax, 1
shl eax, cl
mov ecx, dword [edx]
dec eax
and eax, dword [ecx + 8]
shl eax, 5
add eax, dword [ebx + 0x10]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [edx]
mov dword [ebp - 0xc], eax
cmp byte [eax + 6], 0
mov edx, dword [eax + 8]
jne 0x10109768
mov edi, dword [eax + 0xc]
mov esi, edi
shr esi, 5
xor edx, edi
inc esi
cmp edi, esi
jb 0x10109761
lea ebx, [eax + 0xf]
add ebx, edi
nop dword [eax]
mov ecx, edx
mov eax, edx
shl ecx, 5
sub edi, esi
shr eax, 2
add ecx, eax
movzx eax, byte [ebx]
add ecx, eax
sub ebx, esi
xor edx, ecx
cmp edi, esi
jae 0x10109740
mov ebx, dword [ebp - 4]
mov eax, dword [ebp - 0xc]
mov dword [eax + 8], edx
mov byte [eax + 6], 1
mov cl, byte [ebx + 7]
mov eax, 1
shl eax, cl
dec eax
and eax, edx
shl eax, 5
add eax, dword [ebx + 0x10]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov cl, byte [ebx + 7]
mov esi, 1
mov eax, dword [edx]
xor edx, edx
shl esi, cl
dec esi
or esi, 1
div esi
pop edi
shl edx, 5
add edx, dword [ebx + 0x10]
pop esi
mov eax, edx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10111e40
Capabilities:
Enumerate threads
Suspend thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
mov esi, ecx
mov dword [ebp - 4], edx
push edi
push 0
push 4
mov dword [esi], 0
mov dword [esi + 4], 0
mov dword [esi + 8], 0
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov edi, eax
cmp edi, 0xffffffff
je 0x10111f33
lea eax, [ebp - 0x20]
mov dword [ebp - 0x20], 0x1c
push eax
push edi
call dword [sym.imp.KERNEL32.dll_Thread32First]
test eax, eax
je 0x10111f2c
mov ebx, dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
cmp dword [ebp - 0x20], 0x10
jb 0x10111f12
call ebx
cmp dword [ebp - 0x14], eax
jne 0x10111f12
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp dword [ebp - 0x18], eax
je 0x10111f12
mov edx, dword [esi]
test edx, edx
jne 0x10111ed8
push 0x200
push edx
push dword [0x1026a4c4]
mov dword [esi + 4], 0x80
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov edx, eax
mov dword [esi], edx
test edx, edx
je 0x10111f2c
jmp 0x10111f03
mov eax, dword [esi + 4]
cmp dword [esi + 8], eax
jb 0x10111f03
shl eax, 3
push eax
push edx
push 0
push dword [0x1026a4c4]
call dword [sym.imp.KERNEL32.dll_HeapReAlloc]
mov edx, eax
test edx, edx
je 0x10111f2c
mov eax, dword [esi + 4]
add eax, eax
mov dword [esi], edx
mov dword [esi + 4], eax
mov ecx, dword [esi + 8]
mov eax, dword [ebp - 0x18]
mov dword [edx + ecx*4], eax
lea eax, [ecx + 1]
mov dword [esi + 8], eax
lea eax, [ebp - 0x20]
mov dword [ebp - 0x20], 0x1c
push eax
push edi
call dword [sym.imp.KERNEL32.dll_Thread32Next]
test eax, eax
jne 0x10111e97
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [esi], 0
je 0x10111f79
xor edi, edi
cmp dword [esi + 8], edi
jbe 0x10111f79
nop
mov eax, dword [esi]
push dword [eax + edi*4]
push 0
push 0x5a
call dword [sym.imp.KERNEL32.dll_OpenThread]
mov ebx, eax
test ebx, ebx
je 0x10111f73
push ebx
call dword [sym.imp.KERNEL32.dll_SuspendThread]
push dword [ebp + 8]
mov edx, dword [ebp - 4]
mov ecx, ebx
call fcn.10111cf0
add esp, 4
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
inc edi
cmp edi, dword [esi + 8]
jb 0x10111f40
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x10111f80
Capabilities:
Resume thread

Disassembly:
push ebx
mov ebx, ecx
mov eax, dword [ebx]
test eax, eax
je 0x10111fce
push esi
xor esi, esi
cmp dword [ebx + 8], esi
jbe 0x10111fbe
push edi
mov eax, dword [ebx]
push dword [eax + esi*4]
push 0
push 0x5a
call dword [sym.imp.KERNEL32.dll_OpenThread]
mov edi, eax
test edi, edi
je 0x10111fb5
push edi
call dword [sym.imp.KERNEL32.dll_ResumeThread]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
inc esi
cmp esi, dword [ebx + 8]
jb 0x10111f92
mov eax, dword [ebx]
pop edi
push eax
push 0
push dword [0x1026a4c4]
call dword [sym.imp.KERNEL32.dll_HeapFree]
pop esi
pop ebx
ret
Function at 0x10111fd0
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
imul esi, ecx, 0x2c
mov ebx, edx
push edi
add esi, dword [0x102a7be0]
mov eax, dword [esi]
mov cl, byte [esi + 0x14]
and cl, 1
lea edi, [eax - 5]
cmove edi, eax
movzx eax, cl
lea ecx, [ebp - 4]
push ecx
push 0x40
lea eax, [eax*2 + 5]
push eax
push edi
mov dword [ebp - 8], eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x1011201d
pop edi
pop esi
mov eax, 0xa
pop ebx
mov esp, ebp
pop ebp
ret
test ebx, ebx
je 0x1011203e
mov byte [edi], 0xe9
mov eax, dword [esi + 4]
sub eax, edi
sub eax, 5
mov dword [edi + 1], eax
test byte [esi + 0x14], 1
je 0x1011205f
mov eax, dword [esi]
mov word [eax], 0xf9eb
jmp 0x1011205f
mov eax, dword [esi + 0xc]
test byte [esi + 0x14], 1
mov dword [edi], eax
je 0x10112059
mov ax, word [esi + 0x10]
mov word [edi + 4], ax
mov al, byte [esi + 0x12]
mov byte [edi + 6], al
jmp 0x1011205f
mov al, byte [esi + 0x10]
mov byte [edi + 4], al
lea eax, [ebp - 4]
push eax
push dword [ebp - 4]
push dword [ebp - 8]
push edi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
push dword [ebp - 8]
push edi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_FlushInstructionCache]
mov al, byte [esi + 0x14]
and bl, 1
mov cl, bl
and al, 0xfd
add cl, cl
shl bl, 2
or cl, al
and cl, 0xfb
or cl, bl
xor eax, eax
pop edi
mov byte [esi + 0x14], cl
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x101120b0
Capabilities:
Resume thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov edx, dword [0x102a7be8]
push ebx
push esi
push edi
xor edi, edi
xor esi, esi
mov dword [ebp - 4], edi
mov ebx, ecx
test edx, edx
je 0x101121a1
mov eax, dword [0x102a7be0]
add eax, 0x14
movzx ecx, byte [eax]
shr ecx, 1
and ecx, 1
cmp ecx, ebx
jne 0x101120f5
inc esi
add eax, 0x2c
cmp esi, edx
jb 0x101120d8
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
cmp esi, 0xffffffff
je 0x101121a1
xor eax, eax
lea ecx, [ebp - 0x10]
test ebx, ebx
setne al
or edx, 0xffffffff
push eax
call fcn.10111e40
mov ecx, dword [0x102a7be8]
add esp, 4
cmp esi, ecx
jae 0x10112155
imul edi, esi, 0x2c
mov eax, dword [0x102a7be0]
movzx eax, byte [edi + eax + 0x14]
shr eax, 1
and eax, 1
cmp eax, ebx
je 0x1011214a
mov edx, ebx
mov ecx, esi
call fcn.10111fd0
mov dword [ebp - 4], eax
test eax, eax
jne 0x10112152
mov ecx, dword [0x102a7be8]
inc esi
add edi, 0x2c
cmp esi, ecx
jb 0x10112121
mov edi, dword [ebp - 4]
mov eax, dword [ebp - 0x10]
test eax, eax
je 0x101121a1
xor esi, esi
cmp dword [ebp - 8], esi
jbe 0x10112192
mov edi, eax
push dword [edi + esi*4]
push 0
push 0x5a
call dword [sym.imp.KERNEL32.dll_OpenThread]
mov ebx, eax
test ebx, ebx
je 0x10112186
push ebx
call dword [sym.imp.KERNEL32.dll_ResumeThread]
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
inc esi
cmp esi, dword [ebp - 8]
jb 0x10112165
mov edi, dword [ebp - 4]
mov eax, dword [ebp - 0x10]
push eax
push 0
push dword [0x1026a4c4]
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10133e30
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x101a3405
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x18
push ebx
mov ebx, dword [ebp + 0xc]
push esi
push edi
mov edi, ecx
movzx eax, byte [ebx]
xor eax, 0x811c9dc5
imul edx, eax, 0x1000193
movzx eax, byte [ebx + 1]
xor edx, eax
movzx eax, byte [ebx + 2]
imul edx, edx, 0x1000193
xor edx, eax
movzx eax, byte [ebx + 3]
imul ecx, edx, 0x1000193
xor ecx, eax
imul eax, ecx, 0x1000193
mov ecx, edi
push eax
mov dword [ebp + 0xc], eax
lea eax, [ebp - 0x1c]
push ebx
push eax
call fcn.10133dc0
mov ecx, dword [ebp - 0x18]
test ecx, ecx
je 0x10133eb8
mov eax, dword [ebp + 8]
mov dword [eax], ecx
mov byte [eax + 4], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
cmp dword [edi + 8], 0xfffffff
jne 0x10133ecc
push str.unordered_map_set_too_long
call dword [sym.imp.MSVCP140.dll_void___cdecl_std::_Xlength_error_char_const__]
lea eax, [edi + 4]
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x24], eax
mov dword [ebp - 4], 0
push 0x10
mov dword [ebp - 0x20], 0
call fcn.1019a153
mov esi, eax
add esp, 4
mov dword [ebp - 0x14], esi
mov dword [ebp - 0x20], esi
mov dword [ebp - 4], 1
mov ecx, dword [ebx]
mov dword [esi + 8], ecx
mov dword [esi + 0xc], 0
mov ecx, dword [edi + 8]
mov ebx, dword [edi + 0x1c]
movss xmm3, dword [edi]
lea eax, [ecx + 1]
movd xmm0, eax
cvtdq2pd xmm0, xmm0
shr eax, 0x1f
movd xmm1, ebx
addsd xmm0, qword [eax*8 + 0x10251df0]
cvtdq2pd xmm1, xmm1
mov eax, ebx
shr eax, 0x1f
cvtpd2ps xmm0, xmm0
addsd xmm1, qword [eax*8 + 0x10251df0]
movaps xmm2, xmm0
cvtpd2ps xmm1, xmm1
divss xmm2, xmm1
comiss xmm2, xmm3
jbe 0x10133fa1
divss xmm0, xmm3
call fcn.10014820
call fcn.1019b850
mov ecx, 8
cmp eax, ecx
cmova ecx, eax
cmp ebx, ecx
jae 0x10133f80
cmp ebx, 0x200
jae 0x10133f7e
shl ebx, 3
cmp ebx, ecx
jae 0x10133f80
mov ebx, ecx
push ebx
mov ecx, edi
call fcn.101342b0
push dword [ebp + 0xc]
lea eax, [esi + 8]
mov ecx, edi
push eax
lea eax, [ebp - 0x24]
push eax
call fcn.10133dc0
mov ecx, dword [edi + 8]
mov edx, dword [eax]
jmp 0x10133fa4
mov edx, dword [ebp - 0x1c]
mov ebx, dword [edx + 4]
lea eax, [ecx + 1]
mov dword [edi + 8], eax
mov dword [esi], edx
mov dword [esi + 4], ebx
mov dword [ebx], esi
mov dword [edx + 4], esi
mov eax, dword [edi + 0x18]
and eax, dword [ebp + 0xc]
mov ecx, dword [edi + 0xc]
mov esi, dword [ebp - 0x10]
mov edi, dword [ecx + eax*8]
cmp edi, dword [esi]
mov esi, dword [ebp - 0x14]
jne 0x10133fd2
mov dword [ecx + eax*8], esi
jmp 0x10133fe1
cmp edi, edx
jne 0x10133fdb
mov dword [ecx + eax*8], esi
jmp 0x10133fe5
cmp dword [ecx + eax*8 + 4], ebx
jne 0x10133fe5
mov dword [ecx + eax*8 + 4], esi
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
pop edi
mov dword [eax], esi
pop esi
mov byte [eax + 4], 1
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret 8