joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1004cac0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10113a65
mov eax, dword fs:[0]
push eax
sub esp, 0x38
mov eax, dword [0x1014a524]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x44]
push eax
push 0
push 0
mov dword [ebp - 0x44], esi
push 0x1012728c
mov dword [ebp - 0x44], 0
call sub.SHELL32.dll_SHGetKnownFolderPath
push 0
push str.Graphtec_Corporation
lea ecx, [ebp - 0x40]
call fcn.1004c9b0
mov edx, dword [ebp - 0x44]
xor eax, eax
mov ecx, edx
mov dword [ebp - 0x28], 0
mov dword [ebp - 4], 0
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 7
mov word [ebp - 0x28], ax
lea edi, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x1004cb42
sub ecx, edi
sar ecx, 1
push ecx
push edx
lea ecx, [ebp - 0x28]
call fcn.10013b40
lea eax, [ebp - 0x40]
mov byte [ebp - 4], 1
push eax
lea ecx, [ebp - 0x28]
call fcn.100ca100
movups xmm0, xmmword [ebp - 0x28]
mov edx, dword [ebp - 0x2c]
xor eax, eax
mov dword [esi], 0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
mov word [ebp - 0x28], ax
movups xmmword [esi], xmm0
movq xmm0, qword [ebp - 0x18]
movq qword [esi + 0x10], xmm0
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 7
cmp edx, 8
jb 0x1004cbda
mov ecx, dword [ebp - 0x40]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x1004cbd0
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x1004cbf7
push edx
push ecx
call fcn.100e1499
add esp, 8
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.100e14ac
mov esp, ebp
pop ebp
ret
call fcn.100ecb47
int3

Function at 0x1004cc00
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push edi
lea eax, [ebp - 4]
mov dword [ebp - 4], 0
push eax
push 0
push 0
push 0x1012729c
call sub.SHELL32.dll_SHGetKnownFolderPath
mov esi, dword [ebp + 8]
xor eax, eax
mov edx, dword [ebp - 4]
mov ecx, edx
mov dword [esi], 0
mov dword [esi + 0x10], 0
lea edi, [ecx + 2]
mov dword [esi + 0x14], 7
mov word [esi], ax
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x1004cc43
sub ecx, edi
sar ecx, 1
push ecx
push edx
mov ecx, esi
call fcn.10013b40
pop edi
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x10053050
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push esi
mov esi, dword [ebp + 0xc]
push edi
mov edi, ecx
movzx eax, byte [esi]
xor eax, 0x811c9dc5
imul edx, eax, 0x1000193
movzx eax, byte [esi + 1]
xor edx, eax
movzx eax, byte [esi + 2]
imul edx, edx, 0x1000193
xor edx, eax
movzx eax, byte [esi + 3]
imul ecx, edx, 0x1000193
xor ecx, eax
imul eax, ecx, 0x1000193
mov ecx, edi
push eax
push esi
lea eax, [ebp - 8]
push eax
call fcn.10007660
mov ecx, dword [eax + 4]
mov eax, dword [ebp + 8]
test ecx, ecx
jne 0x100530a9
mov ecx, dword [edi + 4]
pop edi
mov dword [eax], ecx
pop esi
mov esp, ebp
pop ebp
ret 8

Function at 0x100533d0
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10113b75
mov eax, dword fs:[0]
push eax
sub esp, 0x18
push ebx
push esi
push edi
mov eax, dword [0x1014a524]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov edi, dword [ebp + 8]
movzx eax, byte [edi]
xor eax, 0x811c9dc5
imul edx, eax, 0x1000193
movzx eax, byte [edi + 1]
xor edx, eax
movzx eax, byte [edi + 2]
imul edx, edx, 0x1000193
xor edx, eax
movzx eax, byte [edi + 3]
imul ecx, edx, 0x1000193
xor ecx, eax
lea eax, [ebp - 0x14]
imul ebx, ecx, 0x1000193
mov ecx, esi
push ebx
push edi
push eax
call fcn.10007660
mov eax, dword [ebp - 0x10]
test eax, eax
jne 0x10053507
cmp dword [esi + 8], 0x3ffffff
je 0x1005351e
lea eax, [esi + 4]
mov dword [ebp - 0x1c], eax
push 0x40
mov dword [ebp - 4], 0
mov dword [ebp - 0x18], 0
call fcn.100e1469
mov ecx, eax
mov eax, dword [edi]
lea edi, [ecx + 8]
mov dword [ebp - 0x18], ecx
mov dword [edi], eax
lea eax, [edi + 8]
push 0x30
push 0
push eax
call fcn.100e38b0
add esp, 0x10
mov dword [edi + 0x2c], 0
mov dword [edi + 0x30], 0
mov eax, dword [esi + 8]
inc eax
mov dword [ebp - 4], 1
movd xmm0, eax
cvtdq2pd xmm0, xmm0
shr eax, 0x1f
addsd xmm0, qword [eax*8 + 0x1011e810]
mov eax, dword [esi + 0x1c]
cvtpd2ps xmm1, xmm0
movd xmm0, eax
cvtdq2pd xmm0, xmm0
shr eax, 0x1f
addsd xmm0, qword [eax*8 + 0x1011e810]
cvtpd2ps xmm0, xmm0
divss xmm1, xmm0
comiss xmm1, dword [esi]
jbe 0x100534f8
mov ecx, esi
call fcn.10053700
push ebx
push edi
lea eax, [ebp - 0x24]
mov ecx, esi
push eax
call fcn.10007660
mov ecx, dword [eax]
jmp 0x100534fb
mov ecx, dword [ebp - 0x14]
push dword [ebp - 0x18]
push ecx
push ebx
mov ecx, esi
call fcn.100536a0
add eax, 0x10
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
push str.unordered_map_set_too_long
call fcn.100cd797
int3
Function at 0x10053530
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov edx, dword [ebp + 8]
mov eax, 0x1fffffff
push ebx
mov ebx, ecx
bsr ecx, eax
push esi
push edi
mov edi, 1
mov dword [ebp - 0xc], ebx
mov eax, edi
shl eax, cl
cmp edx, eax
ja 0x10053693
mov esi, dword [ebx + 4]
lea eax, [edx - 1]
or eax, edi
mov dword [ebp - 4], esi
bsr ecx, eax
push esi
lea ecx, [ecx + 1]
shl edi, cl
lea ecx, [ebx + 0xc]
lea eax, [edi + edi]
push eax
call fcn.1002c2c0
lea eax, [edi - 1]
mov dword [ebx + 0x1c], edi
mov dword [ebx + 0x18], eax
mov ecx, dword [ebx + 4]
mov ecx, dword [ecx]
mov edx, ecx
cmp ecx, esi
je 0x10053666
movzx eax, byte [ecx + 8]
xor eax, 0x811c9dc5
mov edx, dword [edx]
imul edi, eax, 0x1000193
movzx eax, byte [ecx + 9]
xor edi, eax
movzx eax, byte [ecx + 0xa]
imul edi, edi, 0x1000193
xor edi, eax
movzx eax, byte [ecx + 0xb]
imul edi, edi, 0x1000193
xor edi, eax
imul eax, edi, 0x1000193
mov edi, dword [ebx + 0x18]
and edi, eax
mov eax, dword [ebx + 0xc]
mov ebx, dword [eax + edi*8]
mov dword [ebp + 8], ebx
lea eax, [eax + edi*8]
mov dword [ebp - 8], eax
cmp ebx, esi
jne 0x100535e6
mov dword [eax], ecx
mov dword [eax + 4], ecx
jmp 0x10053659
mov eax, dword [eax + 4]
mov ebx, dword [ecx + 8]
cmp ebx, dword [eax + 8]
jne 0x10053620
mov eax, dword [eax]
mov dword [ebp + 8], eax
cmp eax, ecx
je 0x10053618
mov ebx, dword [ecx + 4]
mov esi, dword [ebp + 8]
mov dword [ebx], edx
mov edi, dword [edx + 4]
mov dword [edi], eax
mov eax, dword [eax + 4]
mov dword [eax], ecx
mov dword [esi + 4], edi
mov esi, dword [ebp - 4]
mov dword [edx + 4], ebx
mov dword [ecx + 4], eax
mov eax, dword [ebp - 8]
mov dword [eax + 4], ecx
jmp 0x10053659
mov edi, eax
cmp dword [ebp + 8], eax
je 0x10053636
mov eax, dword [eax + 4]
mov edi, eax
cmp ebx, dword [eax + 8]
je 0x1005366f
cmp dword [ebp + 8], eax
jne 0x10053627
mov eax, dword [ecx + 4]
mov dword [ebp + 8], eax
mov dword [eax], edx
mov ebx, dword [edx + 4]
mov dword [ebx], edi
mov eax, dword [edi + 4]
mov dword [eax], ecx
mov dword [edi + 4], ebx
mov edi, dword [ebp + 8]
mov dword [edx + 4], edi
mov dword [ecx + 4], eax
mov eax, dword [ebp - 8]
mov dword [eax], ecx
mov ebx, dword [ebp - 0xc]
mov ecx, edx
cmp edx, esi
jne 0x10053592
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
mov ebx, dword [ecx + 4]
mov eax, dword [eax]
mov dword [ebp + 8], eax
mov esi, eax
mov dword [ebx], edx
mov edi, dword [edx + 4]
mov dword [edi], eax
mov eax, dword [eax + 4]
mov dword [eax], ecx
mov dword [esi + 4], edi
mov esi, dword [ebp - 4]
mov dword [edx + 4], ebx
mov dword [ecx + 4], eax
jmp 0x10053659
push str.invalid_hash_bucket_count
call fcn.100cd797
int3
Function at 0x100b6cb0
Capabilities:
Get process heap flags

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1011931d
mov eax, dword fs:[0]
push eax
sub esp, 8
push esi
mov eax, dword [0x1014a524]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
mov dword [ebp - 0x10], esi
movups xmm0, xmmword [ebp + 0x20]
lea eax, [ebp + 8]
mov dword [ebp - 4], 0
push eax
movups xmmword [esi], xmm0
lea ecx, [esi + 0x18]
movq xmm0, qword [ebp + 0x30]
movq qword [esi + 0x10], xmm0
call fcn.1000d600
movups xmm0, xmmword [ebp + 0x20]
mov dword [esi + 0x30], 0x41100000
mov dword [esi + 0x34], 0
psrldq xmm0, 0xc
movd ecx, xmm0
test ecx, ecx
jl 0x100b6d8c
mov eax, dword [ebp + 0x28]
jg 0x100b6d8c
test eax, eax
jb 0x100b6d8c
test ecx, ecx
jg 0x100b6d8c
jl 0x100b6d35
cmp eax, 7
ja 0x100b6d8c
jmp dword [eax*4 + 0x100b6dfc]
movsd xmm0, qword [ebp - 0x14]
cvtpd2ps xmm0, xmm0
mov edx, dword [ebp + 0x1c]
movss dword [esi + 0x3c], xmm0
movss dword [esi + 0x38], xmm0
cvtps2pd xmm0, xmm0
mulsd xmm0, qword [0x10126d28]
cvtpd2ps xmm0, xmm0
movss dword [esi + 0x40], xmm0
cmp edx, 0x10
jb 0x100b6de3
mov ecx, dword [ebp + 8]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x100b6dd9
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x100b6df7
push edx
push ecx
call fcn.100e1499
add esp, 8
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret 0x30
call fcn.100ecb47
cmp al, 0x6d
or edx, dword [eax]
inc esi
insd dword es:[edi], dx
or edx, dword [eax]
push eax
insd dword es:[edi], dx
or edx, dword [eax]
pop edx
insd dword es:[edi], dx
or edx, dword [eax]
insd dword es:[edi], dx
or edx, dword [eax]
outsb dx, byte [esi]
insd dword es:[edi], dx
or edx, dword [eax]
js 0x100b6e83
or edx, dword [eax]
sub byte [ebp + 0xb], 0x10
int3
adc al, 0x53
push esi
push edi
mov eax, dword [0x1014a524]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov ebx, dword [ebp + 8]
lea eax, [ebp - 0x20]
push ebx
push eax
call fcn.100b6c10
mov edx, dword [ebp - 0x18]
cmp byte [edx + 0xd], 0
jne 0x100b6eb7
mov eax, dword [ebx]
cmp eax, dword [edx + 0x10]
jge 0x100b6f06
cmp dword [edi + 4], 0xaaaaaaa
je 0x100b6f1d
mov esi, dword [edi]
mov dword [ebp - 0x14], edi
push 0x18
mov dword [ebp - 4], 0
mov dword [ebp - 0x10], 0
call fcn.100e1469
mov ecx, eax
add esp, 4
mov eax, dword [ebx]
mov dword [ecx + 0x10], eax
mov byte [ecx + 0x14], 0
push ecx
push dword [ebp - 0x1c]
mov dword [ecx], esi
push dword [ebp - 0x20]
mov dword [ecx + 4], esi
mov dword [ecx + 8], esi
mov word [ecx + 0xc], 0
mov ecx, edi
call fcn.10012730
mov edx, eax
lea eax, [edx + 0x14]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
call fcn.10012d60
int3
Function at 0x100bac40
Capabilities:
Access peb ldr_data

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10119a40
mov eax, dword fs:[0]
push eax
push ebx
sub esp, 0x78
push esi
push edi
mov eax, dword [0x1014a524]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
lea eax, [ebx + 0xc]
mov dword [ebp - 4], 0
push eax
lea eax, [ebp - 0x58]
push eax
call fcn.100bead0
lea ecx, [esi + 0x10]
movsd xmm0, qword [eax]
movups xmmword [ebp - 0x48], xmm0
movsd xmm0, qword [eax + 8]
lea eax, [ebx + 0xc]
push eax
lea eax, [ebp - 0x68]
movsd qword [ebp - 0x18], xmm0
push eax
call fcn.100bead0
lea ecx, [esi + 0x20]
movsd xmm0, qword [eax]
movsd qword [ebp - 0x20], xmm0
movsd xmm0, qword [eax + 8]
lea eax, [ebx + 0xc]
push eax
lea eax, [ebp - 0x78]
movsd qword [ebp - 0x28], xmm0
push eax
call fcn.100bead0
lea ecx, [esi + 0x30]
movsd xmm0, qword [eax]
movsd qword [ebp - 0x30], xmm0
movsd xmm0, qword [eax + 8]
lea eax, [ebx + 0xc]
push eax
lea eax, [ebp - 0x88]
movsd qword [ebp - 0x38], xmm0
push eax
call fcn.100bead0
mov edi, dword [ebx + 8]
movups xmm3, xmmword [ebp - 0x48]
mov esi, dword [ebx + 0x44]
movsd xmm2, qword [ebp - 0x18]
unpcklpd xmm3, xmm2
movsd xmm2, qword [ebp - 0x20]
movups xmm0, xmmword [eax]
movsd qword [edi + 0x10], xmm2
movsd xmm2, qword [ebp - 0x28]
movsd qword [edi + 0x18], xmm2
movsd xmm2, qword [ebp - 0x30]
movsd qword [edi + 0x20], xmm2
movsd xmm2, qword [ebp - 0x38]
movsd qword [edi + 0x28], xmm2
movups xmmword [edi], xmm3
movups xmmword [edi + 0x30], xmm0
mov dword [edi + 0x40], 0
mov dword [edi + 0x44], 0
test esi, esi
je 0x100bad65
mov ecx, esi
call fcn.1001ecc0
push 0x40
push esi
call fcn.100e1499
add esp, 8
mov esi, dword [ebx + 0x40]
test esi, esi
je 0x100bad7e
mov ecx, esi
call fcn.1001ecc0
push 0x40
push esi
call fcn.100e1499
add esp, 8
mov esi, dword [ebx + 0x3c]
test esi, esi
je 0x100bad97
mov ecx, esi
call fcn.1001ecc0
push 0x40
push esi
call fcn.100e1499
add esp, 8
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret 0x44

Function at 0x100c2240
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 0xc]
mov ecx, 0
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, 0x811c9dc5
sub edx, edi
sar edx, 1
add edx, edx
je 0x100c2271
nop dword [eax]
movzx eax, byte [ecx + edi]
inc ecx
xor eax, esi
imul esi, eax, 0x1000193
cmp ecx, edx
jb 0x100c2260
pop edi
mov eax, esi
pop esi
pop ebp
ret 8
Function at 0x100c3ef0
Capabilities:
Get geographical location
Identify system language via api

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x78
mov eax, dword [0x1014a524]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
push edi
mov dword [ebp - 0x78], esi
call fcn.100c40a0
cmp byte [eax + 0x18], 0
je 0x100c3f1e
call fcn.100c40a0
push eax
jmp 0x100c4022
mov eax, dword fs:[0x2c]
mov ecx, dword [0x1014e348]
mov ecx, dword [eax + ecx*4]
mov eax, dword [0x1014ddec]
cmp eax, dword [ecx + 4]
jg 0x100c403b
cmp byte [0x1014ddf0], 0
jne 0x100c401d
push 0x55
lea eax, [ebp - 0x5c]
mov byte [0x1014ddf0], 1
push eax
push 0x5c
call dword [sym.imp.KERNEL32.dll_GetUserDefaultUILanguage]
movzx eax, ax
push eax
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
sub esp, 0x18
lea ecx, [ebp - 0x5c]
mov edx, esp
lea edi, [ecx + 1]
mov dword [edx], 0
mov dword [edx + 0x10], 0
mov dword [edx + 0x14], 0xf
nop dword [eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x100c3f90
sub ecx, edi
lea eax, [ebp - 0x5c]
push ecx
push eax
mov ecx, edx
call fcn.10013940
lea eax, [ebp - 0x74]
push eax
call fcn.100c4100
mov edx, dword [0x1014dde8]
add esp, 0x1c
cmp edx, 0x10
jb 0x100c3feb
mov ecx, dword [0x1014ddd4]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x100c3fe1
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x100c408f
push edx
push ecx
call fcn.100e1499
add esp, 8
movups xmm0, xmmword [ebp - 0x74]
lea ecx, [ebp - 0x74]
mov byte [ebp - 0x74], 0
movups xmmword [0x1014ddd4], xmm0
movq xmm0, qword [ebp - 0x64]
movq qword [0x1014dde4], xmm0
mov dword [ebp - 0x64], 0
mov dword [ebp - 0x60], 0xf
call fcn.1000fa70
push 0x1014ddd4
mov ecx, esi
call fcn.1000d600
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
xor ecx, ebp
pop esi
call fcn.100e14ac
mov esp, ebp
pop ebp
ret
push 0x1014ddec
call fcn.100e1f94
add esp, 4
cmp dword [0x1014ddec], 0xffffffff
jne 0x100c3f3e
push 0x1011c480
mov dword [0x1014ddd4], 0
mov dword [0x1014dde4], 0
mov dword [0x1014dde8], 0xf
call fcn.100e1e4c
push 0x1014ddec
call fcn.100e1f4a
add esp, 8
jmp 0x100c3f3e
call fcn.100ecb47
int3
Function at 0x100c4c70
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1011a7a5
mov eax, dword fs:[0]
push eax
sub esp, 0x64
push esi
mov eax, dword [0x1014a524]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
mov eax, dword [ebp + 8]
mov dword [esi + 4], eax
push 0
lea ecx, [ebp - 0x70]
mov dword [ebp - 4], 0
mov dword [esi], vtable.std::codecvt_wchar_t__char__struct__Mbstatet_.0
call fcn.100cd5dc
mov dword [ebp - 0x6c], 0
mov byte [ebp - 0x68], 0
mov dword [ebp - 0x64], 0
mov byte [ebp - 0x60], 0
xor eax, eax
mov dword [ebp - 0x5c], 0
mov word [ebp - 0x58], ax
mov dword [ebp - 0x54], eax
mov word [ebp - 0x50], ax
mov dword [ebp - 0x4c], eax
mov byte [ebp - 0x48], al
mov dword [ebp - 0x44], eax
mov byte [ebp - 0x40], al
lea eax, [ebp - 0x70]
mov byte [ebp - 4], 7
push 0x101269bc
push eax
call fcn.100cdaa4
lea eax, [ebp - 0x3c]
push eax
call fcn.100ce18d
movups xmm0, xmmword [eax]
movups xmmword [esi + 8], xmm0
movups xmm0, xmmword [eax + 0x10]
movups xmmword [esi + 0x18], xmm0
movq xmm0, qword [eax + 0x20]
movq qword [esi + 0x28], xmm0
mov eax, dword [eax + 0x28]
mov dword [esi + 0x30], eax
lea eax, [ebp - 0x70]
mov byte [ebp - 4], 8
push eax
call fcn.100cdaef
mov eax, dword [ebp - 0x44]
add esp, 0x10
test eax, eax
je 0x100c4d48
push eax
call fcn.100ecc24
add esp, 4
mov eax, dword [ebp - 0x4c]
mov dword [ebp - 0x44], 0
test eax, eax
je 0x100c4d5f
push eax
call fcn.100ecc24
add esp, 4
mov eax, dword [ebp - 0x54]
mov dword [ebp - 0x4c], 0
test eax, eax
je 0x100c4d76
push eax
call fcn.100ecc24
add esp, 4
mov eax, dword [ebp - 0x5c]
mov dword [ebp - 0x54], 0
test eax, eax
je 0x100c4d8d
push eax
call fcn.100ecc24
add esp, 4
mov eax, dword [ebp - 0x64]
mov dword [ebp - 0x5c], 0
test eax, eax
je 0x100c4da4
push eax
call fcn.100ecc24
add esp, 4
mov eax, dword [ebp - 0x6c]
mov dword [ebp - 0x64], 0
test eax, eax
je 0x100c4dbb
push eax
call fcn.100ecc24
add esp, 4
lea ecx, [ebp - 0x70]
mov dword [ebp - 0x6c], 0
call fcn.100cd634
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret 4

Function at 0x100c7560
Capabilities:
Hash data using fnv

Disassembly:
push esi
mov esi, ecx
movzx eax, byte [esi]
xor eax, 0x811c9dc5
imul edx, eax, 0x1000193
movzx eax, byte [esi + 1]
xor edx, eax
movzx eax, byte [esi + 2]
imul edx, edx, 0x1000193
xor edx, eax
movzx eax, byte [esi + 3]
imul ecx, edx, 0x1000193
xor ecx, eax
movzx eax, byte [esi + 4]
imul ecx, ecx, 0x1000193
xor ecx, eax
movzx eax, byte [esi + 5]
imul ecx, ecx, 0x1000193
xor ecx, eax
movzx eax, byte [esi + 6]
imul ecx, ecx, 0x1000193
xor ecx, eax
movzx eax, byte [esi + 7]
imul ecx, ecx, 0x1000193
pop esi
xor ecx, eax
imul eax, ecx, 0x1000193
ret
Function at 0x100cc610
Capabilities:
Check if file exists
Get file attributes

Disassembly:
sub esp, 8
push ebx
push esi
mov esi, dword [esp + 0x14]
mov eax, esi
cmp dword [esi + 0x14], 8
jb 0x100cc623
mov eax, dword [esi]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x100cc64b
push dword [esp + 0x18]
lea eax, [esp + 0xc]
push esi
push eax
call fcn.100cc4e0
add esp, 0xc
mov eax, dword [eax]
pop esi
pop ebx
add esp, 8
ret
mov eax, dword [esp + 0x18]
test eax, eax
je 0x100cc664
mov dword [eax], 0
mov byte [eax + 4], 0
mov dword [eax + 8], 0x10127038
test ebx, 0x400
je 0x100cc69a
push esi
call fcn.100cc2b0
add esp, 4
test al, al
je 0x100cc68f
test bl, 0x10
mov eax, 4
mov ecx, 0xb
pop esi
cmovne eax, ecx
pop ebx
add esp, 8
ret
pop esi
mov eax, 9
pop ebx
add esp, 8
ret
and ebx, 0x10
or ebx, 0x20
shr ebx, 4
pop esi
mov eax, ebx
pop ebx
add esp, 8
ret

Function at 0x100cc730
Capabilities:
Check if file exists
Delete directory
Delete file

Disassembly:
mov eax, dword [esp + 8]
cmp eax, 1
jne 0x100cc755
mov eax, dword [esp + 0xc]
test eax, eax
je 0x100cc752
mov dword [eax], 0
mov byte [eax + 4], 0
mov dword [eax + 8], 0x10127038
xor al, al
ret
push esi
push edi
cmp eax, 3
je 0x100cc778
cmp eax, 0xb
je 0x100cc778
mov esi, dword [esp + 0xc]
mov eax, esi
cmp dword [esi + 0x14], 8
jb 0x100cc76f
mov eax, dword [esi]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
jmp 0x100cc78d
mov esi, dword [esp + 0xc]
mov eax, esi
cmp dword [esi + 0x14], 8
jb 0x100cc786
mov eax, dword [esi]
push eax
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
test eax, eax
jne 0x100cc7e1
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
call edi
cmp eax, 2
je 0x100cc7e1
cmp eax, 3
je 0x100cc7e1
cmp eax, 0x7b
je 0x100cc7e1
cmp eax, 0xf
je 0x100cc7e1
cmp eax, 0x15
je 0x100cc7e1
cmp eax, 0x57
je 0x100cc7e1
cmp eax, 0xa1
je 0x100cc7e1
cmp eax, 0x35
je 0x100cc7e1
call edi
test eax, eax
je 0x100cc7e1
push str.boost::filesystem::remove
push dword [esp + 0x18]
push esi
push eax
call fcn.100cd320
add esp, 0x10
xor al, al
pop edi
pop esi
ret
mov eax, dword [esp + 0x14]
test eax, eax
je 0x100cc7fa
mov dword [eax + 8], 0x10127038
mov byte [eax + 4], 0
mov dword [eax], 0
pop edi
mov al, 1
pop esi
ret
Function at 0x100cc800
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1011b2c5
mov eax, dword fs:[0]
push eax
sub esp, 0x2c
mov eax, dword [0x1014a524]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, dword [ebp + 0xc]
mov eax, dword [ebp + 0x10]
mov edi, dword [ebp + 8]
mov dword [ebp - 0x2c], eax
mov eax, ebx
cmp dword [ebx + 0x14], 8
jb 0x100cc841
mov eax, dword [ebx]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov esi, eax
mov dword [ebp - 0x38], esi
cmp esi, 0xffffffff
jne 0x100cc864
push dword [ebp - 0x2c]
push ebx
push edi
call fcn.100cc4e0
add esp, 0xc
jmp 0x100cc9dc
push esi
push ebx
call fcn.100cc3b0
add esp, 8
mov ecx, eax
mov dword [ebp - 0x30], ecx
test esi, 0x400
je 0x100cc9a1
cmp dword [ebx + 0x14], 8
mov edx, ebx
jb 0x100cc889
mov edx, dword [ebx]
mov ecx, edx
mov dword [ebp - 0x28], 0
xor eax, eax
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 7
mov word [ebp - 0x28], ax
lea esi, [ecx + 2]
nop dword [eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x100cc8b0
sub ecx, esi
sar ecx, 1
push ecx
push edx
lea ecx, [ebp - 0x28]
call fcn.10013b40
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
push 0
cmovae eax, dword [ebp - 0x28]
push 0x2000000
push 3
push 0
push 7
push 0
push eax
mov dword [ebp - 4], 0
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
mov dword [ebp - 0x34], esi
mov edx, dword [ebp - 0x14]
mov byte [ebp - 4], 2
cmp edx, 8
jb 0x100cc93c
mov ecx, dword [ebp - 0x28]
lea edx, [edx*2 + 2]
mov eax, ecx
mov byte [ebp - 4], 3
cmp edx, 0x1000
jb 0x100cc92e
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x100cc9fa
push edx
push ecx
call fcn.100e1499
add esp, 8
mov byte [ebp - 4], 2
xor eax, eax
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 7
mov word [ebp - 0x28], ax
cmp esi, 0xffffffff
jne 0x100cc964
push dword [ebp - 0x2c]
push ebx
push edi
call fcn.100cc4e0
add esp, 0xc
jmp 0x100cc9dc
push ebx
call fcn.100cc2b0
add esp, 4
test al, al
jne 0x100cc98d
mov eax, dword [ebp - 0x30]
mov dword [edi], 9
mov dword [edi + 4], eax
push esi
mov dword [ebp - 4], 5
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x100cc9dc
push esi
mov dword [ebp - 4], 6
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov esi, dword [ebp - 0x38]
mov ecx, dword [ebp - 0x30]
mov eax, dword [ebp - 0x2c]
test eax, eax
je 0x100cc9b9
mov dword [eax], 0
mov byte [eax + 4], 0
mov dword [eax + 8], 0x10127038
and esi, 0x10
je 0x100cc9c3
mov edx, dword [ebp - 0x34]
jmp 0x100cc9c8
mov edx, ecx
mov ecx, dword [ebp - 0x34]
xor eax, eax
test esi, esi
setne al
add eax, 2
test esi, esi
mov dword [edi], eax
cmove ecx, edx
mov dword [edi + 4], ecx
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.100e14ac
mov esp, ebp
pop ebp
ret
call fcn.100ecb47
int3

Function at 0x100fe51b
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.100fe391