joyce8/EMBER2024-capa huggingface dataset:
Function at 0x51f580
Capabilities:
Read file on windows

Disassembly:
sub esp, 8
push ebx
push ebp
push esi
mov esi, dword [esp + 0x1c]
test esi, esi
push edi
jne 0x51f599
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 8
ret
push esi
call fcn.00520a50
add esp, 4
test eax, eax
jne 0x51f5ae
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret
mov eax, dword [esi]
xor edi, edi
cmp eax, 1
jne 0x51f6ee
mov edi, dword [esi + 4]
mov esi, dword [sym.imp.KERNEL32.DLL_SetFilePointer]
push eax
push 0
push 0
push edi
mov dword [esp + 0x24], edi
call esi
cmp eax, 0xffffffff
mov dword [esp + 0x10], eax
jne 0x51f5ec
push 2
push 0
push 0
push edi
call esi
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 8
ret
push 0x1000
xor ebp, ebp
call fcn.0052201b
add esp, 4
mov ebx, eax
lea eax, [esp + 0x20]
mov esi, ebx
push ebp
push eax
push 0x1000
push ebx
push edi
call dword [sym.imp.KERNEL32.DLL_ReadFile]
test eax, eax
je 0x51f6ce
mov edx, dword [esp + 0x20]
xor ecx, ecx
test edx, edx
jbe 0x51f634
mov al, byte [esi]
cmp al, 0xd
je 0x51f676
cmp al, 0xa
je 0x51f676
inc ecx
inc esi
cmp ecx, edx
jb 0x51f624
add ebp, edx
cmp edx, 0x1000
jb 0x51f678
push 0x1000
push ebx
call fcn.005225ce
mov ebx, eax
mov eax, dword [esp + 0x28]
add esp, 8
cmp eax, 0x1000
jne 0x51f678
lea ecx, [esp + 0x20]
push 0
lea esi, [ebx + ebp]
push ecx
push 0x1000
push esi
push edi
call dword [sym.imp.KERNEL32.DLL_ReadFile]
test eax, eax
je 0x51f6ce
jmp 0x51f61a
add ebp, ecx
lea edx, [ebp + 1]
push edx
call fcn.0051b930
mov ecx, dword [esp + 0x14]
mov edi, eax
mov al, byte [esi]
add esp, 4
add ecx, ebp
cmp al, 0xd
je 0x51f696
cmp al, 0xa
jne 0x51f69f
mov al, byte [esi + 1]
inc ecx
cmp al, 0xa
jne 0x51f69f
inc ecx
mov eax, dword [esp + 0x14]
push 0
push 0
push ecx
push eax
call dword [sym.imp.KERNEL32.DLL_SetFilePointer]
push ebp
push ebx
push edi
call fcn.005224d0
push ebx
mov byte [edi + ebp], 0
call fcn.00521f32
add esp, 0x10
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret
push 2
push 0
push 0
push edi
call dword [sym.imp.KERNEL32.DLL_SetFilePointer]
push ebx
call fcn.00521f32
add esp, 4
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret
cmp eax, 2
jne 0x51f77c
mov esi, dword [esi + 4]
mov ecx, esi
mov edx, dword [esi]
call dword [edx + 0x14]
lea ecx, [esp + 0x10]
lea edx, [esp + 0x20]
push ecx
mov dword [esp + 0x18], eax
mov eax, dword [esi]
push edx
push 0xffffffffffffffff
push 0
mov ecx, esi
call dword [eax + 0x30]
mov ebp, dword [esp + 0x20]
xor ebx, ebx
test eax, eax
jbe 0x51f737
mov cl, byte [ebp]
cmp cl, 0xd
je 0x51f737
cmp cl, 0xa
je 0x51f737
inc ebx
inc ebp
cmp ebx, eax
jb 0x51f724
lea eax, [ebx + 1]
push eax
call fcn.0051b930
mov ecx, dword [esp + 0x18]
mov edi, eax
mov al, byte [ebp]
add esp, 4
add ecx, ebx
cmp al, 0xd
je 0x51f756
cmp al, 0xa
jne 0x51f75f
mov al, byte [ebp + 1]
inc ecx
cmp al, 0xa
jne 0x51f75f
inc ecx
mov edx, dword [esi]
push 0
push ecx
mov ecx, esi
call dword [edx + 0x18]
mov eax, dword [esp + 0x20]
push ebx
push eax
push edi
call fcn.005224d0
add esp, 0xc
mov byte [ebx + edi], 0
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret
Function at 0x51f980
Capabilities:
Get file size
Read file on windows

Disassembly:
sub esp, 0xc
push esi
mov esi, dword [esp + 0x18]
test esi, esi
jne 0x51f996
mov eax, 1
pop esi
add esp, 0xc
ret
push esi
call fcn.00520a50
add esp, 4
test eax, eax
jne 0x51f9ad
mov eax, 1
pop esi
add esp, 0xc
ret
mov eax, dword [esi]
push ebx
push ebp
cmp eax, 1
push edi
mov dword [esp + 0x10], 1
jne 0x51fa5d
mov esi, dword [esi + 4]
lea eax, [esp + 0x14]
push eax
push esi
call dword [sym.imp.KERNEL32.DLL_GetFileSize]
mov ebp, dword [sym.imp.KERNEL32.DLL_SetFilePointer]
push 1
push 0
push 0
push esi
mov ebx, eax
call ebp
mov edi, eax
cmp edi, 0xffffffff
je 0x51fac5
cmp edi, ebx
jae 0x51fac5
mov eax, dword [esp + 0x38]
mov dword [esp + 0x10], 0
test eax, eax
je 0x51fac5
mov eax, dword [esp + 0x30]
test eax, eax
je 0x51fac5
lea ecx, [esp + 0x18]
push 0
push ecx
lea edx, [esp + 0x2c]
push 1
push edx
push esi
call dword [sym.imp.KERNEL32.DLL_ReadFile]
push 0
push 0
push edi
push esi
mov ebx, eax
call ebp
test ebx, ebx
je 0x51fac5
mov al, byte [esp + 0x24]
test al, al
je 0x51fabd
cmp al, 0x1a
jne 0x51fac5
pop edi
mov dword [esp + 0xc], 1
mov eax, dword [esp + 0xc]
pop ebp
pop ebx
pop esi
add esp, 0xc
ret
cmp eax, 2
jne 0x51fac5
mov esi, dword [esi + 4]
mov ecx, esi
call fcn.00520b10
mov ebx, eax
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0x14]
mov edi, eax
cmp edi, ebx
jae 0x51fac5
mov eax, dword [esp + 0x38]
mov dword [esp + 0x10], 0
test eax, eax
je 0x51fac5
mov eax, dword [esp + 0x30]
test eax, eax
je 0x51fac5
mov edx, dword [esi]
lea eax, [esp + 0x24]
push 1
push eax
mov ecx, esi
call dword [edx + 0x20]
mov edx, dword [esi]
push 0
push edi
mov ecx, esi
mov ebp, eax
call dword [edx + 0x18]
test ebp, ebp
je 0x51fac5
mov al, byte [esp + 0x24]
test al, al
je 0x51fabd
cmp al, 0x1a
jne 0x51fac5
mov dword [esp + 0x10], 1
mov eax, dword [esp + 0x10]
pop edi
pop ebp
pop ebx
pop esi
add esp, 0xc
ret

Function at 0x530404
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
push edi
xor edi, edi
cmp dword [esp + 0x10], edi
mov ebx, ecx
je 0x530446
call fcn.005334de
mov esi, dword [eax + 0xc]
push 0xf0
push dword [esp + 0x14]
push esi
call dword [sym.imp.KERNEL32.DLL_FindResourceA]
cmp eax, edi
je 0x530446
push eax
push esi
call dword [sym.imp.KERNEL32.DLL_LoadResource]
cmp eax, edi
jne 0x53043d
xor eax, eax
jmp 0x53044e
push eax
call dword [sym.imp.KERNEL32.DLL_LockResource]
mov edi, eax
push edi
mov ecx, ebx
call fcn.00530454
pop edi
pop esi
pop ebx
ret 4

Function at 0x54ad94
Capabilities:
Get graphical window text

Disassembly:
push esi
mov esi, ecx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x54adcc
push dword [esi + 0x1c]
call dword [sym.imp.USER32.DLL_GetWindowTextLengthA]
lea ecx, [eax + 1]
push ecx
mov ecx, dword [esp + 0xc]
push eax
call fcn.00548e0f
push eax
push dword [esi + 0x1c]
call dword [sym.imp.USER32.DLL_GetWindowTextA_1]
mov ecx, dword [esp + 8]
push 0xffffffffffffffff
call fcn.00548de7
jmp 0x54add8
mov eax, dword [ecx]
push dword [esp + 8]
call dword [eax + 0x88]
pop esi
ret 4
Function at 0x54c58f
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
push edi
xor edi, edi
cmp dword [esp + 0x10], edi
mov ebx, ecx
je 0x54c5d1
call fcn.005527c9
mov esi, dword [eax + 0xc]
push 0xf0
push dword [esp + 0x14]
push esi
call dword [sym.imp.KERNEL32.DLL_FindResourceA_1]
cmp eax, edi
je 0x54c5d1
push eax
push esi
call dword [sym.imp.KERNEL32.DLL_LoadResource_1]
cmp eax, edi
jne 0x54c5c8
xor eax, eax
jmp 0x54c5d9
push eax
call dword [sym.imp.KERNEL32.DLL_LockResource_1]
mov edi, eax
push edi
mov ecx, ebx
call fcn.0054c5df
pop edi
pop esi
pop ebx
ret 4

Function at 0x552cf9
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
mov esi, ecx
lea ebx, [esi + 0x1c]
push ebx
call dword [sym.imp.KERNEL32.DLL_EnterCriticalSection_1]
cmp dword [esp + 0x10], 0
jne 0x552d27
push dword [esi]
call dword [sym.imp.KERNEL32.DLL_TlsGetValue_1]
test eax, eax
je 0x552d45
push dword [esp + 0xc]
mov ecx, esi
push eax
call fcn.00552c5f
jmp 0x552d45
mov eax, dword [esi + 0x14]
test eax, eax
je 0x552d45
push edi
push dword [esp + 0x10]
mov edi, dword [eax + 4]
mov ecx, esi
push eax
call fcn.00552c5f
test edi, edi
mov eax, edi
jne 0x552d2f
pop edi
push ebx
call dword [sym.imp.KERNEL32.DLL_LeaveCriticalSection_1]
pop esi
pop ebx
ret 8

Function at 0x5af9a6
Capabilities:
Encode data using xor

Disassembly:
xor al, al
xor ecx, ecx
mov dl, byte [esp + ecx + 5]
xor al, dl
inc ecx
cmp ecx, 5
jl 0x5af9aa
xor ecx, ecx
mov dl, byte [esp + ecx + 0xa]
xor al, dl
inc ecx
cmp ecx, 0x12
jl 0x5af9b8
ret

Function at 0x5b6516
Capabilities:
Encode data using xor

Disassembly:
mov edx, dword [esp + 8]
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0x14]
mov ebp, edi
xor ecx, ecx
sub ebp, edx
xor eax, eax
mov bl, cl
or bl, al
add bl, byte [eax + edi]
inc eax
add byte [edx], bl
cmp eax, 8
jl 0x5b652a
xor esi, esi
mov al, byte [esi + edi]
dec al
imul cl
xor byte [edx], al
inc esi
cmp esi, 8
jl 0x5b653b
mov al, byte [edx + ebp]
shl al, cl
inc ecx
inc edx
xor byte [edx - 1], al
cmp ecx, 8
jl 0x5b6528
pop edi
pop esi
pop ebp
pop ebx
ret

Function at 0x63da3c
Capabilities:
Decompress data using aplib

Disassembly:
push ebp
mov ebp, esp
mov esi, dword [ebp + 8]
mov edi, dword [ebp + 0xc]
cld
mov dl, 0x80
movsb byte es:[edi], byte [esi]
call fcn.0063dabb
jae 0x63da48
xor ecx, ecx
call fcn.0063dabb
jae 0x63da72
xor eax, eax
call fcn.0063dabb
jae 0x63da83
mov al, 0x10
call fcn.0063dabb
adc al, al
jae 0x63da64
jne 0x63dab0
stosb byte es:[edi], al
jmp 0x63da49
call fcn.0063dac7
dec ecx
loop 0x63da8f
mov eax, ebp
call fcn.0063dac5
jmp 0x63dab1
lodsb al, byte [esi]
shr eax, 1
je 0x63dad7
adc ecx, 2
mov ebp, eax
jmp 0x63dab1
xchg ecx, eax
dec eax
shl eax, 8
lodsb al, byte [esi]
mov ebp, eax
call fcn.0063dac5
cmp eax, 0x7d00
jae 0x63daaf
cmp eax, 0x500
jae 0x63dab0
cmp eax, 0x7f
ja 0x63dab1
inc ecx
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x63da49
pop ebp
ret 8
Function at 0x41911a
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov edx, dword [ebp + 8]
xor ecx, ecx
mov eax, 0x4c3cc8
cmp edx, dword [eax]
je 0x41913c
add eax, 8
inc ecx
cmp eax, 0x4c3d58
jl 0x41912d
push esi
mov esi, ecx
shl esi, 3
cmp edx, dword [esi + 0x4c3cc8]
jne 0x41926a
mov eax, dword [0xdcc508]
cmp eax, 1
je 0x419244
test eax, eax
jne 0x41916d
cmp dword [0xdcc50c], 1
je 0x419244
cmp edx, 0xfc
je 0x41926a
lea eax, [ebp - 0x1a4]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x4191a4
lea eax, [ebp - 0x1a4]
push str._program_name_unknown_
push eax
call fcn.00413ab0
pop ecx
pop ecx
lea eax, [ebp - 0x1a4]
push edi
push eax
lea edi, [ebp - 0x1a4]
call fcn.00413ba0
inc eax
pop ecx
cmp eax, 0x3c
jbe 0x4191e7
lea eax, [ebp - 0x1a4]
push eax
call fcn.00413ba0
mov edi, eax
lea eax, [ebp - 0x1a4]
sub eax, 0x3b
push 3
add edi, eax
push 0x4969fc
push edi
call fcn.0041acd0
add esp, 0x10
lea eax, [ebp - 0xa0]
push str.Runtime_Error__n_nProgram:
push eax
call fcn.00413ab0
lea eax, [ebp - 0xa0]
push edi
push eax
call fcn.00413ac0
lea eax, [ebp - 0xa0]
push 0x4969dc
push eax
call fcn.00413ac0
push dword [esi + 0x4c3ccc]
lea eax, [ebp - 0xa0]
push eax
call fcn.00413ac0
push 0x12010
lea eax, [ebp - 0xa0]
push str.Microsoft_Visual_C_Runtime_Library
push eax
call fcn.0041c7b7
add esp, 0x2c
pop edi
jmp 0x41926a
lea eax, [ebp + 8]
lea esi, [esi + 0x4c3ccc]
push 0
push eax
push dword [esi]
call fcn.00413ba0
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop esi
leave
ret
Function at 0x10002c80
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
mov eax, dword [0x10049100]
xor eax, ebp
mov dword [ebp - 4], eax
mov al, byte [ebp + 0x28]
push 0x28
mov byte [ebp - 0xc], al
call fcn.1001dd3b
add esp, 4
test eax, eax
je 0x10002cbf
movups xmm0, xmmword [ebp + 8]
movups xmmword [eax], xmm0
movups xmm0, xmmword [ebp + 0x18]
movups xmmword [eax + 0x10], xmm0
movq xmm0, qword [ebp - 0xc]
movq qword [eax + 0x20], xmm0
jmp 0x10002cc1
xor eax, eax
lea ecx, [ebp - 0x30]
push ecx
push 0
push eax
push 0x10001560
push 0
push 0
call fcn.1002697f
add esp, 0x18
mov dword [ebp - 0x34], eax
test eax, eax
je 0x10002d0a
mov ecx, dword [ebp - 0x30]
test ecx, ecx
je 0x10002d03
push ecx
push eax
call fcn.1001c71b
add esp, 8
test eax, eax
jne 0x10002d03
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1001e093
mov esp, ebp
pop ebp
ret
push 1
call fcn.1001ce25
push 6
mov dword [ebp - 0x30], 0
call fcn.1001ce25
int3

Function at 0x10002d50
Capabilities:
Hash data using djb2

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x414
mov eax, dword [0x10049100]
xor eax, ebp
mov dword [ebp - 4], eax
movups xmm1, xmmword [ebp + 8]
push esi
movups xmm0, xmmword [ebp + 0x18]
mov esi, dword [ebp + 0x28]
movd eax, xmm1
push edi
mov edi, dword [ebp + 0x2c]
push eax
movups xmmword [ebp - 0x404], xmm0
mov dword [ebp - 0x3f0], esi
mov dword [ebp - 0x3f4], eax
call fcn.100144e0
add esp, 4
test eax, eax
je 0x10002e39
push 0x3e8
add eax, 0x10
push edi
push eax
call fcn.10022e54
mov eax, esi
add esp, 0xc
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x10002db2
sub eax, edx
xor edi, edi
sar eax, 1
mov esi, 0x1505
push ebx
lea ebx, [eax + eax]
test ebx, ebx
je 0x10002df9
mov eax, esi
mov ecx, edi
shld edi, esi, 5
shl esi, 5
add esi, eax
adc edi, ecx
mov ecx, dword [ebp - 0x3f0]
movzx eax, byte [ecx]
cdq
add esi, eax
adc edi, edx
inc ecx
mov dword [ebp - 0x3f0], ecx
sub ebx, 1
jne 0x10002dd0
push edi
push esi
push dword [ebp - 0x3f4]
lea eax, [ebp - 0x3ec]
push str.LUNA_NOTIFY._d._llu
push eax
call fcn.10002f50
add esp, 0x14
lea eax, [ebp - 0x3ec]
push eax
push 0
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateEventA]
mov esi, eax
push esi
call dword [sym.imp.KERNEL32.dll_SetEvent]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop ebx
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.1001e093
mov esp, ebp
pop ebp
ret
Function at 0x100053f0
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10038f23
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x10049100]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x10], edi
mov dword [edi], 0
mov dword [edi + 4], 0
mov dword [edi + 8], 0
mov dword [edi + 0xc], 0
mov dword [edi + 0x10], 0
mov dword [edi + 0x14], 0
mov dword [edi + 0x18], 0
mov dword [edi + 0x1c], 0
mov dword [ebp - 4], 0
mov dword [edi + 0x20], 0
mov dword [edi + 0x24], 0
mov dword [edi + 0x28], 0
mov dword [edi + 0x2c], 0
mov dword [edi + 0x30], 0
mov dword [edi + 0x34], 0
mov dword [edi + 0x38], 0
mov dword [edi + 0x3c], 0
lea ecx, [edi + 0x40]
mov dword [ecx], 0
mov dword [ecx + 4], 0
mov dword [ecx + 8], 0
mov eax, dword [ebp + 0xc]
mov esi, dword [ebp + 0x14]
mov edx, dword [ebp + 0x20]
mov dword [edi + 0x4c], 0
mov dword [edi + 0x50], eax
mov eax, dword [ebp + 8]
mov dword [edi + 0x54], eax
mov eax, dword [ebp + 0x1c]
mov dword [edi + 0x5c], eax
mov eax, dword [ebp + 0x18]
mov dword [edi + 0x58], esi
mov dword [edi + 0x60], edx
mov byte [edi + 0x64], 0
mov dword [edi + 0x68], eax
test byte [esi + 8], 8
mov byte [ebp - 4], 2
je 0x100054ea
test dl, 0x10
jne 0x100054ea
mov al, 1
jmp 0x100054ec
xor al, al
mov byte [edi + 0x6c], al
mov eax, dword [ebp + 0x10]
mov dword [edi + 0x70], eax
mov ebx, dword [ecx + 4]
mov edx, ebx
mov esi, dword [esi + 0x18]
sar edx, 3
cmp esi, edx
jae 0x10005510
lea eax, [esi*8]
mov dword [ecx + 4], eax
jmp 0x10005543
jbe 0x10005543
mov eax, dword [ecx + 8]
sar eax, 3
cmp esi, eax
jbe 0x10005528
lea eax, [ebp + 0x17]
push eax
push esi
call fcn.10004750
jmp 0x10005543
sub esi, edx
je 0x10005540
shl esi, 3
push esi
push 0
push ebx
call fcn.1001fce0
add esp, 0xc
lea ecx, [edi + 0x40]
add ebx, esi
mov dword [ecx + 4], ebx
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x1c
Function at 0x10010710
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100398b5
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push ebx
push esi
push edi
mov eax, dword [0x10049100]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov ebx, dword [ebp + 0xc]
movzx eax, byte [ebx]
xor eax, 0x811c9dc5
imul edx, eax, 0x1000193
movzx eax, byte [ebx + 1]
xor edx, eax
movzx eax, byte [ebx + 2]
imul edx, edx, 0x1000193
xor edx, eax
movzx eax, byte [ebx + 3]
imul ecx, edx, 0x1000193
xor ecx, eax
imul eax, ecx, 0x1000193
mov ecx, edi
push eax
mov dword [ebp + 0xc], eax
lea eax, [ebp - 0x1c]
push ebx
push eax
call fcn.10010330
mov ecx, dword [ebp - 0x18]
test ecx, ecx
je 0x100107a3
mov eax, dword [ebp + 8]
mov dword [eax], ecx
mov byte [eax + 4], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
cmp dword [edi + 8], 0x38e38e3
je 0x10010903
lea eax, [edi + 4]
mov dword [ebp - 0x14], eax
push 0x48
mov dword [ebp - 4], 0
mov dword [ebp - 0x10], 0
call fcn.1001dd3b
mov edx, dword [ebp + 0x14]
mov esi, eax
mov ecx, dword [ebx]
add esp, 4
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x10], esi
mov dword [esi + 8], ecx
lea ecx, [esi + 0x10]
push dword [edx]
push dword [eax]
call fcn.10011160
mov eax, dword [edi + 8]
mov ebx, dword [edi + 0x1c]
inc eax
movss xmm3, dword [edi]
mov dword [ebp - 4], 1
movd xmm0, eax
cvtdq2pd xmm0, xmm0
shr eax, 0x1f
addsd xmm0, qword [eax*8 + 0x1003c310]
mov eax, ebx
shr eax, 0x1f
cvtpd2ps xmm2, xmm0
movd xmm0, ebx
cvtdq2pd xmm0, xmm0
movaps xmm1, xmm2
addsd xmm0, qword [eax*8 + 0x1003c310]
cvtpd2ps xmm0, xmm0
divss xmm1, xmm0
comiss xmm1, xmm3
jbe 0x100108a5
divss xmm2, xmm3
sub esp, 8
cvtps2pd xmm0, xmm2
movsd qword [ebp - 0x1c], xmm0
fld qword [ebp - 0x1c]
fstp qword [esp]
call fcn.10027c50
fstp qword [ebp - 0x1c]
movsd xmm0, qword [ebp - 0x1c]
add esp, 8
cvtpd2ps xmm0, xmm0
call fcn.1001e550
mov ecx, 8
cmp eax, ecx
cmova ecx, eax
cmp ebx, ecx
jae 0x10010887
cmp ebx, 0x200
jae 0x10010885
shl ebx, 3
cmp ebx, ecx
jae 0x10010887
mov ebx, ecx
push ebx
mov ecx, edi
call fcn.10018860
push dword [ebp + 0xc]
lea eax, [esi + 8]
mov ecx, edi
push eax
lea eax, [ebp - 0x1c]
push eax
call fcn.10010330
mov edx, dword [eax]
jmp 0x100108a8
mov edx, dword [ebp - 0x1c]
mov ebx, dword [edx + 4]
inc dword [edi + 8]
mov dword [esi], edx
mov dword [esi + 4], ebx
mov dword [ebx], esi
mov dword [edx + 4], esi
mov eax, dword [edi + 0x18]
and eax, dword [ebp + 0xc]
mov ecx, dword [edi + 0xc]
mov esi, dword [ebp - 0x14]
mov edi, dword [ecx + eax*8]
cmp edi, dword [esi]
mov esi, dword [ebp - 0x10]
jne 0x100108d3
mov dword [ecx + eax*8], esi
jmp 0x100108e2
cmp edi, edx
jne 0x100108dc
mov dword [ecx + eax*8], esi
jmp 0x100108e6
cmp dword [ecx + eax*8 + 4], ebx
jne 0x100108e6
mov dword [ecx + eax*8 + 4], esi
mov eax, dword [ebp + 8]
mov dword [eax], esi
mov byte [eax + 4], 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
push str.unordered_map_set_too_long
call fcn.1001c695
int3
Function at 0x10010910
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100398ed
mov eax, dword fs:[0]
push eax
sub esp, 0x30
push ebx
push esi
push edi
mov eax, dword [0x10049100]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov eax, dword [ebp + 8]
push 4
push 0x3000
mov dword [ebp - 0x3c], 1
mov ecx, dword [eax]
mov eax, dword [eax + 4]
sub eax, ecx
mov dword [ebp - 0x1c], ecx
mov ecx, dword [esi]
and eax, 0xfffffffc
push eax
push 0
push 0
push ecx
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x38], ecx
mov dword [ebp - 0x2c], eax
call fcn.100173f0
mov edi, eax
mov ebx, edx
mov ecx, edi
mov dword [ebp - 0x34], edi
or ecx, ebx
mov dword [ebp - 0x30], ebx
je 0x100109c6
lea eax, [ebp + 8]
mov dword [ebp + 8], 0
push eax
push dword [ebp - 0x10]
push dword [ebp - 0x1c]
push ebx
push edi
push dword [ebp - 0x14]
call fcn.100177d0
test eax, eax
mov eax, dword [ebp - 0x10]
je 0x100109a8
cmp dword [ebp + 8], eax
je 0x100109c6
push 0x4000
push eax
push ebx
push edi
push dword [ebp - 0x14]
call fcn.10017580
xorps xmm0, xmm0
movlpd qword [ebp - 0x34], xmm0
mov ebx, dword [ebp - 0x30]
mov edi, dword [ebp - 0x34]
mov eax, edi
mov dword [ebp - 4], 0
or eax, ebx
je 0x10010a2c
cmp dword [esi + 0x18], 0
mov eax, dword [esi + 4]
push 0
push 0
je 0x100109f5
push ebx
push edi
push dword [eax + 0xc]
push dword [eax + 8]
push 0
push 0
push dword [esi]
call fcn.10013fa0
jmp 0x10010a05
push edi
push dword [eax + 8]
push 0
push 0
push dword [esi]
call dword [sym.imp.KERNEL32.dll_CreateRemoteThread]
mov dword [ebp + 8], eax
test eax, eax
je 0x10010a2c
push dword [esi + 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x10010a59
mov eax, dword [esi + 4]
push dword [ebp + 8]
mov dword [eax], 0
call dword [sym.imp.KERNEL32.dll_CloseHandle]
or esi, 0xffffffff
or ecx, 0xffffffff
mov dword [ebp + 8], ecx
mov eax, edi
mov dword [ebp - 4], 5
or eax, ebx
je 0x10010ab2
push 0x4000
push dword [ebp - 0x10]
push ebx
push edi
push dword [ebp - 0x14]
call fcn.10017580
mov edx, dword [ebp + 8]
jmp 0x10010ab4
cmp dword [esi + 0x18], 0
je 0x10010a8f
cmp dword [esi + 0x10], 0
je 0x10010a8f
push dword [ebp + 8]
xorps xmm0, xmm0
movlpd qword [ebp - 0x24], xmm0
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0
push 8
lea eax, [ebp - 0x24]
push eax
push ebx
push edi
push dword [esi]
call fcn.10015da0
mov esi, dword [ebp - 0x24]
mov ecx, dword [ebp - 0x20]
jmp 0x10010a32
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x18]
push eax
push esi
mov dword [ebp - 0x18], 0
call dword [sym.imp.KERNEL32.dll_GetExitCodeThread]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov esi, dword [ebp - 0x18]
xor ecx, ecx
jmp 0x10010a32
mov edx, ecx
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x10010ad0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100398ed
mov eax, dword fs:[0]
push eax
sub esp, 0x30
push ebx
push esi
push edi
mov eax, dword [0x10049100]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov eax, dword [ebp + 8]
push 4
push 0x3000
mov dword [ebp - 0x3c], 1
mov ecx, dword [eax]
mov eax, dword [eax + 4]
sub eax, ecx
mov dword [ebp - 0x1c], ecx
mov ecx, dword [esi]
and eax, 0xfffffff8
push eax
push 0
push 0
push ecx
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x38], ecx
mov dword [ebp - 0x2c], eax
call fcn.100173f0
mov edi, eax
mov ebx, edx
mov ecx, edi
mov dword [ebp - 0x34], edi
or ecx, ebx
mov dword [ebp - 0x30], ebx
je 0x10010b86
lea eax, [ebp + 8]
mov dword [ebp + 8], 0
push eax
push dword [ebp - 0x10]
push dword [ebp - 0x1c]
push ebx
push edi
push dword [ebp - 0x14]
call fcn.100177d0
test eax, eax
mov eax, dword [ebp - 0x10]
je 0x10010b68
cmp dword [ebp + 8], eax
je 0x10010b86
push 0x4000
push eax
push ebx
push edi
push dword [ebp - 0x14]
call fcn.10017580
xorps xmm0, xmm0
movlpd qword [ebp - 0x34], xmm0
mov ebx, dword [ebp - 0x30]
mov edi, dword [ebp - 0x34]
mov eax, edi
mov dword [ebp - 4], 0
or eax, ebx
je 0x10010bec
cmp dword [esi + 0x18], 0
mov eax, dword [esi + 4]
push 0
push 0
je 0x10010bb5
push ebx
push edi
push dword [eax + 0xc]
push dword [eax + 8]
push 0
push 0
push dword [esi]
call fcn.10013fa0
jmp 0x10010bc5
push edi
push dword [eax + 8]
push 0
push 0
push dword [esi]
call dword [sym.imp.KERNEL32.dll_CreateRemoteThread]
mov dword [ebp + 8], eax
test eax, eax
je 0x10010bec
push dword [esi + 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x10010c19
mov eax, dword [esi + 4]
push dword [ebp + 8]
mov dword [eax], 0
call dword [sym.imp.KERNEL32.dll_CloseHandle]
or esi, 0xffffffff
or ecx, 0xffffffff
mov dword [ebp + 8], ecx
mov eax, edi
mov dword [ebp - 4], 5
or eax, ebx
je 0x10010c72
push 0x4000
push dword [ebp - 0x10]
push ebx
push edi
push dword [ebp - 0x14]
call fcn.10017580
mov edx, dword [ebp + 8]
jmp 0x10010c74
cmp dword [esi + 0x18], 0
je 0x10010c4f
cmp dword [esi + 0x10], 0
je 0x10010c4f
push dword [ebp + 8]
xorps xmm0, xmm0
movlpd qword [ebp - 0x24], xmm0
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0
push 8
lea eax, [ebp - 0x24]
push eax
push ebx
push edi
push dword [esi]
call fcn.10015da0
mov esi, dword [ebp - 0x24]
mov ecx, dword [ebp - 0x20]
jmp 0x10010bf2
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x18]
push eax
push esi
mov dword [ebp - 0x18], 0
call dword [sym.imp.KERNEL32.dll_GetExitCodeThread]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov esi, dword [ebp - 0x18]
xor ecx, ecx
jmp 0x10010bf2
mov edx, ecx
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4