joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1002e570
Capabilities:
Reference sql statements

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10067d1d
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push ebx
push esi
push edi
mov eax, dword [0x100ad040]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], edx
mov dword [ebp - 0x14], ecx
mov eax, str.SELECT__FROM___s__WHERE__Property__s
xor esi, esi
lea eax, [eax + 2]
inc esi
cmp word [eax], 0
jne 0x1002e5a5
xor ecx, ecx
mov eax, edx
cmp word [edx], cx
je 0x1002e5c2
lea eax, [eax + 2]
inc ecx
cmp word [eax], 0
jne 0x1002e5b8
mov ebx, dword [ebp + 8]
xor edx, edx
mov eax, ebx
cmp word [ebx], dx
je 0x1002e5da
nop
lea eax, [eax + 2]
inc edx
cmp word [eax], 0
jne 0x1002e5d0
lea eax, [edx + ecx]
add esi, 0xfffffffd
xor ecx, ecx
add eax, esi
mov edx, 2
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
push 0x40
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov edi, eax
mov dword [ebp - 0x1c], 0xffffffff
mov dword [ebp - 0x18], edi
mov dword [ebp - 4], 0
push ebx
push dword [ebp - 0x10]
push str.SELECT__FROM___s__WHERE__Property__s
push edi
call dword [sym.imp.USER32.dll_wsprintfW]
mov esi, dword [ebp + 0xc]
add esp, 0x10
push esi
push edi
push dword [ebp - 0x14]
call dword [sym.imp.msi.dll_MsiEnumClientsA]
test eax, eax
jne 0x1002e645
push eax
push dword [esi]
call dword [sym.imp.msi.dll_MsiViewModify]
test eax, eax
jne 0x1002e645
lea esi, [eax + 1]
jmp 0x1002e647
xor esi, esi
mov dword [ebp - 4], 0xffffffff
test edi, edi
je 0x1002e659
push edi
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov dword [ebp - 0x18], 0
mov eax, esi
mov dword [ebp - 0x1c], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1002f920
Capabilities:
Reference sql statements

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1006801d
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push esi
push edi
mov eax, dword [0x100ad040]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, edx
mov edi, ecx
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0
mov dword [ebp - 4], 0
push 0x208
push 0x40
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
push dword [ebp + 0x10]
mov ebx, eax
mov dword [ebp - 0x18], 0x104
push dword [ebp + 0xc]
mov dword [ebp - 0x14], ebx
push str.SELECT__FROM__Control__WHERE__Dialog_____s_AND__Control____s
push 0x104
push ebx
call fcn.10028580
push ebx
push dword [ebp + 8]
mov edx, esi
mov ecx, edi
call fcn.1002f780
add esp, 0x1c
mov byte [ebp - 0xd], al
mov dword [ebp - 4], 0xffffffff
test ebx, ebx
je 0x1002f9b8
push ebx
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov al, byte [ebp - 0xd]
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x18], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1002f9e0
Capabilities:
Reference sql statements

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10068065
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push ebx
push esi
push edi
mov eax, dword [0x100ad040]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, edx
mov edi, ecx
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x1c], 0
mov dword [ebp - 4], 0
push 0x208
push 0x40
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
push dword [ebp + 8]
mov ebx, eax
mov dword [ebp - 0x20], 0x104
push esi
push str.SELECT__Attributes__FROM__Control__WHERE__Dialog_____s_AND__Control____s
push 0x104
push ebx
mov dword [ebp - 0x1c], ebx
call fcn.10028580
add esp, 0x14
mov dword [ebp - 0x10], 0
mov byte [ebp - 4], 1
mov eax, dword [ebp - 0x10]
test eax, eax
je 0x1002fa6a
push eax
call dword [sym.imp.msi.dll_MsiConfigureFeatureFromDescriptorA]
push edi
mov dword [ebp - 0x10], 0
call dword [sym.imp.msi.dll_MsiGetFeatureCostA]
mov esi, eax
mov dword [ebp - 0x18], esi
mov byte [ebp - 4], 2
test ebx, ebx
je 0x1002faac
cmp word [ebx], 0
je 0x1002faac
lea eax, [ebp - 0x10]
push eax
push ebx
push esi
call dword [sym.imp.msi.dll_MsiEnumClientsA]
test eax, eax
jle 0x1002faa5
movzx eax, ax
or eax, 0x80070000
test eax, eax
jns 0x1002fb06
call fcn.1002f140
mov byte [ebp - 4], 1
test esi, esi
je 0x1002fabb
push esi
call dword [sym.imp.msi.dll_MsiConfigureFeatureFromDescriptorA]
mov esi, SysReAllocString
mov byte [ebp - 4], 0
mov eax, dword [ebp - 0x10]
test eax, eax
je 0x1002fad2
push eax
call dword [sym.imp.msi.dll_MsiConfigureFeatureFromDescriptorA]
mov dword [ebp - 4], 0xffffffff
test ebx, ebx
je 0x1002fae4
push ebx
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov dword [ebp - 0x1c], 0
mov eax, esi
mov dword [ebp - 0x20], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 0
push dword [ebp - 0x10]
call dword [sym.imp.msi.dll_MsiViewModify]
mov edi, eax
test edi, edi
jle 0x1002fb22
movzx edi, di
or edi, 0x80070000
test edi, edi
jns 0x1002fb29
call fcn.1002f140
mov byte [ebp - 4], 1
test esi, esi
je 0x1002fb38
push esi
call dword [sym.imp.msi.dll_MsiConfigureFeatureFromDescriptorA]
test edi, edi
jne 0x1002fabb
mov dword [ebp - 0x14], edi
mov byte [ebp - 4], 3
mov eax, dword [ebp - 0x14]
test eax, eax
je 0x1002fb55
push eax
call dword [sym.imp.msi.dll_MsiConfigureFeatureFromDescriptorA]
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x14], 0
test eax, eax
je 0x1002fb8a
lea ecx, [ebp - 0x14]
push ecx
push eax
call dword [sym.imp.msi.dll_MsiDatabaseIsTablePersistentA]
test eax, eax
jle 0x1002fb7c
movzx eax, ax
or eax, 0x80070000
test eax, eax
jns 0x1002fbaa
cmp eax, 0x80070103
je 0x1002fb8a
call fcn.1002f140
mov esi, SysReAllocString
mov byte [ebp - 4], 1
mov eax, dword [ebp - 0x14]
test eax, eax
je 0x1002fac0
push eax
call dword [sym.imp.msi.dll_MsiConfigureFeatureFromDescriptorA]
jmp 0x1002fac0
test eax, eax
jne 0x1002fb8a
push 1
push dword [ebp - 0x14]
call dword [sym.imp.msi.dll_MsiRecordReadStream]
mov esi, eax
jmp 0x1002fb8f
Function at 0x10030540
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1006638d
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push esi
push edi
mov eax, dword [0x100ad040]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0
mov dword [ebp - 4], 0
lea eax, [ebp - 0x10]
push eax
push 0x10093cf4
xor edi, edi
push str.MsiLogFileLocation
push dword [ebp + 8]
mov dword [ebp - 0x14], edi
mov dword [ebp - 0x18], edi
mov dword [ebp - 0x10], edi
call dword [sym.imp.msi.dll_MsiGetSummaryInformationW]
cmp eax, 0xea
jne 0x100305f7
mov esi, dword [ebp - 0x10]
xor ecx, ecx
inc esi
mov edx, 2
mov eax, esi
mov dword [ebp - 0x10], esi
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
push 0x40
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov edi, eax
lea eax, [ebp - 0x10]
push eax
push edi
push str.MsiLogFileLocation
push dword [ebp + 8]
mov dword [ebp - 0x14], edi
mov dword [ebp - 0x18], esi
call dword [sym.imp.msi.dll_MsiGetSummaryInformationW]
test esi, esi
je 0x100305f7
push 5
push 0
push 0
push edi
push 0
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
mov dword [ebp - 4], 0xffffffff
test edi, edi
je 0x10030609
push edi
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov dword [ebp - 0x14], 0
xor eax, eax
mov dword [ebp - 0x18], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x10032990
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1006939d
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push ebx
push esi
push edi
mov eax, dword [0x100ad040]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov edx, dword [ebp + 0xc]
mov edi, edx
cmp dword [edx + 0x14], 7
mov eax, dword [edx + 0x10]
jbe 0x100329ca
mov edi, dword [edx]
xor ecx, ecx
mov esi, 0x811c9dc5
add eax, eax
je 0x100329eb
mov edx, eax
movzx eax, byte [ecx + edi]
inc ecx
xor eax, esi
imul esi, eax, 0x1000193
cmp ecx, edx
jb 0x100329d7
mov edx, dword [ebp + 0xc]
push esi
push edx
lea eax, [ebp - 0x14]
mov ecx, ebx
push eax
call fcn.1000fc00
mov ecx, dword [ebp - 0x10]
test ecx, ecx
je 0x10032a1c
mov eax, dword [ebp + 8]
mov dword [eax], ecx
mov byte [eax + 4], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
cmp dword [ebx + 8], 0x7ffffff
je 0x10032b69
lea eax, [ebx + 4]
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x1c], eax
mov dword [ebp - 4], 0
push 0x20
push 0x40
mov dword [ebp - 0x18], 0
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
push dword [ebp + 0xc]
mov edi, eax
mov dword [ebp - 0x18], edi
lea ecx, [edi + 8]
call fcn.100057f0
mov dword [ebp - 4], 1
mov ecx, dword [ebx + 8]
mov eax, dword [ebx + 0x1c]
inc ecx
movss xmm3, dword [ebx]
movd xmm0, ecx
cvtdq2pd xmm0, xmm0
shr ecx, 0x1f
movd xmm1, eax
addsd xmm0, qword [ecx*8 + 0x1009d870]
cvtdq2pd xmm1, xmm1
shr eax, 0x1f
cvtpd2ps xmm0, xmm0
addsd xmm1, qword [eax*8 + 0x1009d870]
movaps xmm2, xmm0
cvtpd2ps xmm1, xmm1
divss xmm2, xmm1
comiss xmm2, xmm3
jbe 0x10032afd
divss xmm0, xmm3
call fcn.100106e0
call fcn.10060ce0
mov ecx, 8
cmp eax, ecx
cmova ecx, eax
mov eax, dword [ebx + 0x1c]
cmp eax, ecx
jae 0x10032adb
cmp eax, 0x200
jae 0x10032ad9
shl eax, 3
cmp eax, ecx
jae 0x10032adb
mov eax, ecx
push eax
mov ecx, ebx
call fcn.10032c00
push esi
lea eax, [edi + 8]
mov ecx, ebx
push eax
lea eax, [ebp - 0x14]
push eax
call fcn.1000fc00
mov edx, dword [eax]
mov eax, dword [eax + 4]
mov dword [ebp - 0x10], eax
jmp 0x10032b00
mov edx, dword [ebp - 0x14]
mov eax, dword [edx + 4]
inc dword [ebx + 8]
mov dword [edi + 4], eax
mov dword [edi], edx
mov dword [eax], edi
mov dword [edx + 4], edi
mov ecx, dword [ebx + 0xc]
mov dword [ebp - 0x10], eax
mov eax, dword [ebx + 0x18]
and eax, esi
mov dword [ebp - 0x18], 0
mov esi, dword [ecx + eax*8]
cmp esi, dword [ebx + 4]
jne 0x10032b2f
mov dword [ecx + eax*8], edi
jmp 0x10032b41
cmp esi, edx
jne 0x10032b38
mov dword [ecx + eax*8], edi
jmp 0x10032b45
mov edx, dword [ebp - 0x10]
cmp dword [ecx + eax*8 + 4], edx
jne 0x10032b45
mov dword [ecx + eax*8 + 4], edi
mov eax, dword [ebp + 8]
mov dword [eax], edi
mov byte [eax + 4], 1
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
push str.unordered_map_set_too_long
call fcn.1004cc5a
int3
Function at 0x100333b0
Capabilities:
Get process heap flags

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10069533
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push esi
mov eax, dword [0x100ad040]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
mov eax, dword [ebp + 8]
xorps xmm0, xmm0
movups xmmword [esi], xmm0
mov dword [esi + 0x10], 0
xor ecx, ecx
mov dword [esi + 0x14], 0
movups xmm0, xmmword [eax]
movups xmmword [esi], xmm0
movq xmm0, qword [eax + 0x10]
movq qword [esi + 0x10], xmm0
mov dword [eax + 0x10], 0
mov dword [eax + 0x14], 7
mov word [eax], cx
mov dword [ebp - 4], ecx
lea ecx, [esi + 0x18]
mov dword [ebp - 0x14], ecx
mov byte [ecx + 0x18], 0xff
mov byte [ebp - 4], 2
movsx edx, byte [eax + 0x30]
inc edx
sub edx, 0
je 0x10033485
sub edx, 1
je 0x10033442
movups xmm0, xmmword [eax + 0x18]
movups xmmword [ecx], xmm0
mov byte [ecx + 0x18], 1
jmp 0x10033485
xorps xmm0, xmm0
mov dword [ebp - 0x18], ecx
movups xmmword [ecx], xmm0
mov dword [ecx + 0x10], 0
xor edx, edx
mov dword [ecx + 0x14], 0
movups xmm0, xmmword [eax + 0x18]
movups xmmword [ecx], xmm0
movq xmm0, qword [eax + 0x28]
movq qword [ecx + 0x10], xmm0
mov dword [eax + 0x28], 0
mov dword [eax + 0x2c], 7
mov word [eax + 0x18], dx
mov byte [ebp - 4], 2
mov byte [ecx + 0x18], dl
mov byte [ebp - 4], 8
lea ecx, [esi + 0x34]
mov dword [ebp - 0x18], ecx
mov byte [ecx + 0x18], 0xff
mov byte [ebp - 4], 0xa
movsx edx, byte [eax + 0x4c]
inc edx
sub edx, 0
je 0x100334f6
sub edx, 1
je 0x100334b3
movups xmm0, xmmword [eax + 0x34]
movups xmmword [ecx], xmm0
mov byte [ecx + 0x18], 1
jmp 0x100334f6
xorps xmm0, xmm0
mov dword [ebp - 0x14], ecx
movups xmmword [ecx], xmm0
mov dword [ecx + 0x10], 0
xor edx, edx
mov dword [ecx + 0x14], 0
movups xmm0, xmmword [eax + 0x34]
movups xmmword [ecx], xmm0
movq xmm0, qword [eax + 0x44]
movq qword [ecx + 0x10], xmm0
mov dword [eax + 0x44], 0
mov dword [eax + 0x48], 7
mov word [eax + 0x34], dx
mov byte [ebp - 4], 0xa
mov byte [ecx + 0x18], dl
mov dword [ebp - 4], 0xffffffff
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x10035440
Capabilities:
Delete directory

Disassembly:
sub esp, 0xd0
mov eax, dword [0x100ad040]
xor eax, esp
mov dword [esp + 0xcc], eax
lea eax, [esp]
mov dword [esp], 0x64
push eax
lea eax, [esp + 8]
push eax
push 0x1009666c
push dword [esp + 0xe0]
call dword [sym.imp.msi.dll_MsiGetSummaryInformationW]
test eax, eax
jne 0x10035485
lea eax, [esp + 4]
push eax
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
mov ecx, dword [esp + 0xcc]
xor eax, eax
xor ecx, esp
call fcn.1004d46a
add esp, 0xd0
ret 4
Function at 0x100354a0
Capabilities:
Enumerate files on windows

Disassembly:
push ebp
lea ebp, [esp - 0x6e4]
sub esp, 0x6e4
push 0xffffffffffffffff
push 0x100697cd
mov eax, dword fs:[0]
push eax
sub esp, 0xc
mov eax, dword [0x100ad040]
xor eax, ebp
mov dword [ebp + 0x6e0], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, dword [ebp + 0x6ec]
push ebx
call dword [sym.imp.msi.dll_MsiGetFeatureCostA]
mov dword [ebp - 0x18], eax
mov dword [ebp - 4], 0
test eax, eax
jne 0x100354fe
mov esi, 0x643
jmp 0x10035696
push str.AI_SH_DIR
mov edx, str.ComboBox
mov ecx, ebx
call fcn.1002e680
add esp, 4
mov dword [ebp - 0x10], 0x104
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp + 0x458]
push eax
push str.ProgramMenuFolder
push ebx
call dword [sym.imp.msi.dll_MsiGetSummaryInformationW]
test eax, eax
jne 0x10035694
lea eax, [ebp - 0x10]
mov dword [ebp - 0x10], 0x40
push eax
lea eax, [ebp + 0x660]
push eax
push 0x100996cc
push ebx
call dword [sym.imp.msi.dll_MsiGetSummaryInformationW]
test eax, eax
jne 0x10035694
xor ecx, ecx
lea eax, [ebp + 0x458]
cmp word [ebp + 0x458], cx
je 0x1003557a
nop
lea eax, [eax + 2]
inc ecx
cmp word [eax], 0
jne 0x10035570
lea eax, [ebp + 0x458]
mov edx, 0x100962e4
lea eax, [eax + ecx*2]
mov ecx, 0x2a
sub edx, eax
nop
mov word [eax], cx
lea eax, [eax + 2]
movzx ecx, word [edx + eax]
test cx, cx
jne 0x10035590
xor ecx, ecx
push 0x250
mov word [eax], cx
lea eax, [ebp]
push ecx
push eax
call fcn.1004f1c0
add esp, 0xc
lea eax, [ebp]
push eax
lea eax, [ebp + 0x458]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov edi, eax
mov dword [ebp - 0x14], edi
cmp edi, 0xffffffff
je 0x10035694
lea eax, [ebp]
mov esi, 2
push eax
push edi
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test byte [ebp], 0x10
je 0x10035679
mov cx, word [ebp + 0x2c]
cmp cx, 0x2e
jne 0x1003560e
mov ax, word [ebp + 0x2e]
test ax, ax
je 0x10035679
cmp ax, cx
jne 0x1003560e
cmp word [ebp + 0x30], 0
je 0x10035679
lea eax, [ebp + 0x250]
test cx, cx
je 0x10035635
mov edi, eax
movzx ecx, cx
lea edx, [ebp + 0x2c]
sub edx, edi
mov edi, dword [ebp - 0x14]
mov word [eax], cx
add eax, 2
movzx ecx, word [edx + eax]
test cx, cx
jne 0x10035626
xor ecx, ecx
mov word [eax], cx
lea eax, [ebp + 0x660]
push eax
lea eax, [ebp + 0x250]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x10035679
push 0x10093cf4
lea eax, [ebp + 0x250]
mov edx, ebx
push eax
push eax
push esi
push str.AI_SH_DIR
mov ecx, str.ComboBox
call fcn.1002e150
add esp, 0x14
test eax, eax
je 0x10035679
inc esi
lea eax, [ebp]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
cmp eax, 1
je 0x100355e5
push edi
call dword [sym.imp.KERNEL32.dll_FindClose]
xor esi, esi
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x18]
test eax, eax
je 0x100356ab
push eax
call dword [sym.imp.msi.dll_MsiConfigureFeatureFromDescriptorA]
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x6e0]
xor ecx, ebp
call fcn.1004d46a
lea esp, [ebp + 0x6e4]
pop ebp
ret 4
Function at 0x10037cb0
Capabilities:
Get disk size

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10069c25
mov eax, dword fs:[0]
push eax
sub esp, 0x20
push ebx
push esi
push edi
mov eax, dword [0x100ad040]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x2c], 0
mov dword [ebp - 0x28], 0
mov dword [ebp - 4], 0
lea eax, [ebp - 0x10]
mov ebx, dword [ebp + 8]
xor edi, edi
push eax
push 0x10093cf4
mov dword [ebp - 0x28], edi
xor esi, esi
push 0x1009666c
mov dword [ebp - 0x2c], esi
push ebx
mov dword [ebp - 0x10], esi
call dword [sym.imp.msi.dll_MsiGetSummaryInformationW]
cmp eax, 0xea
jne 0x10037d54
mov esi, dword [ebp - 0x10]
xor ecx, ecx
inc esi
mov edx, 2
mov eax, esi
mov dword [ebp - 0x10], esi
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
push 0x40
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov edi, eax
lea eax, [ebp - 0x10]
push eax
push edi
push 0x1009666c
mov dword [ebp - 0x28], edi
push ebx
mov dword [ebp - 0x2c], esi
call dword [sym.imp.msi.dll_MsiGetSummaryInformationW]
test esi, esi
je 0x10037e1f
cmp esi, 2
jne 0x10037d6c
mov eax, 0x3a
mov word [edi + 2], ax
jmp 0x10037d71
cmp esi, 3
jne 0x10037d7a
mov eax, 0x5c
mov word [edi + 4], ax
lea eax, [ebp - 0x24]
mov dword [ebp - 0x1c], 0
push eax
lea eax, [ebp - 0x20]
mov dword [ebp - 0x18], 0
push eax
lea eax, [ebp - 0x18]
mov dword [ebp - 0x20], 0
push eax
lea eax, [ebp - 0x1c]
mov dword [ebp - 0x24], 0
push eax
push edi
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceW]
test eax, eax
je 0x10037e1f
mov esi, dword [ebp - 0x18]
imul esi, dword [ebp - 0x1c]
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x10], 0
shr esi, 0xa
imul esi, dword [ebp - 0x20]
shr esi, 0xa
mov byte [ebp - 4], 1
push 0x16
push 0x40
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov ebx, eax
mov dword [ebp - 0x14], 0xb
mov edx, ebx
mov dword [ebp - 0x10], ebx
mov ecx, esi
call fcn.10028780
push ebx
push str.AI_FREE_DISK_SPACE
push dword [ebp + 8]
call dword [sym.imp.msi.dll_MsiSummaryInfoGetPropertyCount]
mov byte [ebp - 4], 0
test ebx, ebx
je 0x10037e11
push ebx
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov dword [ebp - 0x10], 0
mov dword [ebp - 0x14], 0
mov dword [ebp - 4], 0xffffffff
test edi, edi
je 0x10037e31
push edi
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov dword [ebp - 0x28], 0
xor eax, eax
mov dword [ebp - 0x2c], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x10038110
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10069ea4
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push ebx
push esi
push edi
mov eax, dword [0x100ad040]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, edx
mov ebx, ecx
mov dword [ebp - 0x18], ebx
mov edx, dword [ebp + 8]
mov eax, edx
shr eax, 8
movzx esi, al
movzx eax, dl
xor eax, 0x811c9dc5
mov dword [ebp - 0x10], 0
imul eax, eax, 0x1000193
mov dword [ebp - 0x14], edx
xor esi, eax
mov eax, edx
shr eax, 0x10
movzx eax, al
imul ecx, esi, 0x1000193
xor ecx, eax
mov eax, edx
imul ecx, ecx, 0x1000193
shr eax, 0x18
xor ecx, eax
imul eax, ecx, 0x1000193
push eax
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x20]
push eax
call fcn.1003a950
mov eax, dword [eax + 4]
test eax, eax
je 0x10038232
cmp eax, dword [0x100aee24]
je 0x10038232
push dword [eax + 0x10]
mov edx, edi
lea ecx, [ebp - 0x14]
push dword [eax + 0x14]
call fcn.10037ef0
add esp, 8
mov dword [ebp - 4], 1
lea esi, [ebx + 4]
mov dword [ebp - 0x1c], esi
mov ecx, dword [eax]
sub ecx, 0x10
call fcn.10009d60
add eax, 0x10
mov dword [esi], eax
mov byte [ebp - 4], 3
mov eax, dword [ebp + 8]
mov dword [ebx + 8], eax
mov byte [ebp - 4], 1
mov dword [ebp - 0x10], 1
mov dword [ebp - 4], 0
or eax, 0xffffffff
mov ecx, dword [ebp - 0x14]
add ecx, 0xfffffff0
lock xadd dword [ecx + 0xc], eax
dec eax
test eax, eax
jg 0x1003827c
mov edi, dword [ecx]
push ecx
mov eax, dword [edi]
mov esi, dword [eax + 4]
mov ecx, esi
call dword [0x1006e578]
mov ecx, edi
call esi
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea eax, [ebx + 4]
mov dword [ebx], 0
mov dword [ebp - 0x1c], eax
call fcn.1000a250
mov edi, eax
test edi, edi
je 0x10038290
mov eax, dword [edi]
mov esi, dword [eax + 0xc]
mov ecx, esi
call dword [0x1006e578]
mov ecx, edi
call esi
add eax, 0x10
mov dword [ebx + 4], eax
mov dword [ebp - 4], 6
mov dword [ebx + 8], 0
mov dword [ebp - 4], 0
mov dword [ebp - 0x10], 1
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 0x80004005
call fcn.10005390
int3
Function at 0x1003a260
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1006a3fd
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push ebx
push esi
push edi
mov eax, dword [0x100ad040]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, dword [ebp + 0xc]
movzx eax, byte [edi]
xor eax, 0x811c9dc5
imul ecx, eax, 0x1000193
movzx eax, byte [edi + 1]
xor ecx, eax
movzx eax, byte [edi + 2]
imul ecx, ecx, 0x1000193
xor ecx, eax
movzx eax, byte [edi + 3]
imul ecx, ecx, 0x1000193
xor ecx, eax
lea eax, [ebp - 0x1c]
imul ebx, ecx, 0x1000193
push ebx
push edi
push eax
call fcn.1003a950
mov ecx, dword [ebp - 0x18]
test ecx, ecx
je 0x1003a2ec
mov eax, dword [ebp + 8]
mov dword [eax], ecx
mov byte [eax + 4], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
cmp dword [0x100aee28], 0xaaaaaaa
je 0x1003a45a
mov dword [ebp - 0x14], 0x100aee24
mov dword [ebp - 0x10], 0
mov dword [ebp - 4], 0
push 0x18
push 0x40
mov dword [ebp - 0x10], 0
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov ecx, dword [edi]
mov esi, eax
mov dword [ebp - 0x10], esi
mov dword [esi + 8], ecx
mov ecx, dword [edi + 4]
mov dword [esi + 0xc], ecx
mov eax, dword [edi + 8]
mov dword [esi + 0x10], eax
mov eax, dword [edi + 0xc]
mov dword [esi + 0x14], eax
mov dword [ebp - 4], 1
mov ecx, dword [0x100aee28]
mov edi, dword [0x100aee3c]
lea eax, [ecx + 1]
movd xmm0, eax
cvtdq2pd xmm0, xmm0
shr eax, 0x1f
addsd xmm0, qword [eax*8 + 0x1009d870]
mov eax, edi
shr eax, 0x1f
cvtpd2ps xmm3, xmm0
movd xmm0, edi
cvtdq2pd xmm0, xmm0
movaps xmm2, xmm3
addsd xmm0, qword [eax*8 + 0x1009d870]
cvtpd2ps xmm1, xmm0
movss xmm0, dword [0x100aee20]
divss xmm2, xmm1
comiss xmm2, xmm0
jbe 0x1003a3e8
divss xmm3, xmm0
movaps xmm0, xmm3
call fcn.100106e0
call fcn.10060ce0
mov ecx, 8
cmp eax, ecx
cmova ecx, eax
cmp edi, ecx
jae 0x1003a3ca
cmp edi, 0x200
jae 0x1003a3c8
shl edi, 3
cmp edi, ecx
jae 0x1003a3ca
mov edi, ecx
push edi
call fcn.1003a4f0
push ebx
lea eax, [esi + 8]
push eax
lea eax, [ebp - 0x1c]
push eax
call fcn.1003a950
mov ecx, dword [0x100aee28]
mov edx, dword [eax]
jmp 0x1003a3eb
mov edx, dword [ebp - 0x1c]
mov edi, dword [edx + 4]
inc ecx
mov dword [0x100aee28], ecx
mov dword [esi], edx
mov dword [esi + 4], edi
mov dword [edi], esi
mov dword [edx + 4], esi
mov eax, dword [0x100aee38]
mov ecx, dword [0x100aee2c]
and eax, ebx
mov dword [ebp - 0x10], 0
mov ebx, dword [ecx + eax*8]
cmp ebx, dword [0x100aee24]
jne 0x1003a423
mov dword [ecx + eax*8], esi
jmp 0x1003a432
cmp ebx, edx
jne 0x1003a42c
mov dword [ecx + eax*8], esi
jmp 0x1003a436
cmp dword [ecx + eax*8 + 4], edi
jne 0x1003a436
mov dword [ecx + eax*8 + 4], esi
mov eax, dword [ebp + 8]
mov dword [eax], esi
mov byte [eax + 4], 1
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
push str.unordered_map_set_too_long
call fcn.1004cc5a
int3