joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10017d00
Capabilities:
Allocate thread local storage

Disassembly:
sub esp, 0xc
push ebx
push esi
push dword [esp + 0x18]
lea eax, [esp + 0xc]
push eax
call fcn.100b4690
mov eax, dword [section..data]
add esp, 8
cmp dword [esp + 8], 0x3000
je 0x10017d61
cmp eax, 0xffffffff
jne 0x10017d34
call sub.KERNEL32.dll_TlsAlloc
mov dword [section..data], eax
push eax
call fcn.1002e140
add esp, 4
test eax, eax
jne 0x10017d46
call fcn.100079f0
mov ecx, dword [esp + 8]
xor esi, esi
mov dword [eax], ecx
lea ecx, [esp + 0x10]
call fcn.100016b0
mov eax, esi
pop esi
pop ebx
add esp, 0xc
ret 8
cmp eax, 0xffffffff
jne 0x10017d70
call sub.KERNEL32.dll_TlsAlloc
mov dword [section..data], eax
push eax
call fcn.1002e140
add esp, 4
test eax, eax
jne 0x10017d82
call fcn.100079f0
mov ebx, dword [eax + 0xc]
test ebx, ebx
jne 0x10017dca
mov eax, dword [section..data]
cmp eax, 0xffffffff
jne 0x10017d9d
call sub.KERNEL32.dll_TlsAlloc
mov dword [section..data], eax
push eax
call fcn.1002e140
add esp, 4
test eax, eax
jne 0x10017daf
call fcn.100079f0
lea ecx, [esp + 0x10]
mov dword [eax], 0x300d
xor esi, esi
call fcn.100016b0
mov eax, esi
pop esi
pop ebx
add esp, 0xc
ret 8
push edi
mov ecx, ebx
call fcn.10055fa0
lea edx, [esp + 0x20]
mov ecx, ebx
mov edi, dword [eax + 0x54]
lea esi, [eax + 0x58]
mov eax, dword [esp + 0x20]
cmp eax, dword [esi]
cmovl edx, esi
mov eax, dword [edx]
cmp edi, eax
cmovl eax, edi
push eax
call fcn.10158eb0
mov eax, dword [section..data]
pop edi
cmp eax, 0xffffffff
jne 0x10017e09
call sub.KERNEL32.dll_TlsAlloc
mov dword [section..data], eax
push eax
call fcn.1002e140
add esp, 4
test eax, eax
jne 0x10017e1b
call fcn.100079f0
lea ecx, [esp + 0x10]
mov dword [eax], 0x3000
mov esi, 1
call fcn.100016b0
mov eax, esi
pop esi
pop ebx
add esp, 0xc
ret 8

Function at 0x10017e40
Capabilities:
Allocate thread local storage

Disassembly:
push esi
mov esi, dword [esp + 8]
test esi, esi
je 0x10017edf
push esi
call fcn.100280c0
add esp, 4
test al, al
je 0x10017edf
mov eax, dword [section..data]
cmp eax, 0xffffffff
jne 0x10017e72
call sub.KERNEL32.dll_TlsAlloc
mov dword [section..data], eax
push eax
call fcn.1002e140
add esp, 4
test eax, eax
jne 0x10017e84
call fcn.100079f0
push dword [eax + 0x14]
mov ecx, esi
call fcn.10028080
test al, al
je 0x10017ea3
push 0
call fcn.10016920
push 0
call fcn.10016950
add esp, 8
mov ecx, esi
call fcn.10028990
mov eax, dword [section..data]
cmp eax, 0xffffffff
jne 0x10017ebe
call sub.KERNEL32.dll_TlsAlloc
mov dword [section..data], eax
push eax
call fcn.1002e140
add esp, 4
test eax, eax
jne 0x10017ed0
call fcn.100079f0
mov dword [eax], 0x3000
mov eax, 1
pop esi
ret 4
mov eax, dword [section..data]
cmp eax, 0xffffffff
jne 0x10017ef3
call sub.KERNEL32.dll_TlsAlloc
mov dword [section..data], eax
push eax
call fcn.1002e140
add esp, 4
test eax, eax
jne 0x10017f05
call fcn.100079f0
mov dword [eax], 0x3008
xor eax, eax
pop esi
ret 4
Function at 0x1001ac80
Capabilities:
Allocate thread local storage

Disassembly:
mov eax, dword [section..data]
sub esp, 0x18
cmp eax, 0xffffffff
jne 0x1001ac97
call sub.KERNEL32.dll_TlsAlloc
mov dword [section..data], eax
push eax
call fcn.1002e140
add esp, 4
test eax, eax
jne 0x1001aca9
call fcn.100079f0
push esi
mov esi, dword [eax + 8]
lea eax, [esp + 4]
push esi
push eax
call fcn.100b4690
add esp, 8
cmp dword [esp + 4], 0x3000
jne 0x1001acee
lea eax, [esp + 0x10]
mov ecx, esi
push eax
call fcn.10028c90
push eax
lea ecx, [esp + 8]
call fcn.10001760
lea ecx, [esp + 0x18]
call fcn.100016b0
cmp dword [esp + 4], 0x3000
je 0x1001ad2c
mov eax, dword [section..data]
cmp eax, 0xffffffff
jne 0x1001ad02
call sub.KERNEL32.dll_TlsAlloc
mov dword [section..data], eax
push eax
call fcn.1002e140
add esp, 4
test eax, eax
jne 0x1001ad14
call fcn.100079f0
mov ecx, dword [esp + 4]
xor esi, esi
mov dword [eax], ecx
lea ecx, [esp + 0xc]
call fcn.100016b0
mov eax, esi
pop esi
add esp, 0x18
ret
mov eax, dword [section..data]
cmp eax, 0xffffffff
jne 0x1001ad40
call sub.KERNEL32.dll_TlsAlloc
mov dword [section..data], eax
push eax
call fcn.1002e140
add esp, 4
test eax, eax
jne 0x1001ad52
call fcn.100079f0
lea ecx, [esp + 0xc]
mov dword [eax], 0x3000
mov esi, 1
call fcn.100016b0
mov eax, esi
pop esi
add esp, 0x18
ret
Function at 0x1001ad70
Capabilities:
Allocate thread local storage

Disassembly:
mov eax, dword [section..data]
sub esp, 0x18
cmp eax, 0xffffffff
jne 0x1001ad87
call sub.KERNEL32.dll_TlsAlloc
mov dword [section..data], eax
push eax
call fcn.1002e140
add esp, 4
test eax, eax
jne 0x1001ad99
call fcn.100079f0
push esi
push edi
mov edi, dword [eax + 8]
lea eax, [esp + 8]
push edi
push eax
call fcn.100b4690
add esp, 8
cmp dword [esp + 8], 0x3000
jne 0x1001ae91
mov esi, dword [esp + 0x24]
push ebx
cmp esi, 0x305b
je 0x1001ae13
push str.the_engine_parameter_has_an_unrecognized_value
lea eax, [esp + 0x1c]
push 0x300c
push eax
call fcn.10131350
mov ebx, eax
add esp, 0xc
mov eax, dword [section..data]
cmp eax, 0xffffffff
jne 0x1001adf4
call sub.KERNEL32.dll_TlsAlloc
mov dword [section..data], eax
push eax
call fcn.1002e140
add esp, 4
test eax, eax
jne 0x1001ae06
call fcn.100079f0
mov ecx, dword [ebx]
mov dword [eax], ecx
lea ecx, [esp + 0x20]
call fcn.100016b0
mov eax, dword [section..data]
cmp eax, 0xffffffff
jne 0x1001ae27
call sub.KERNEL32.dll_TlsAlloc
mov dword [section..data], eax
push eax
call fcn.1002e140
add esp, 4
test eax, eax
jne 0x1001ae39
call fcn.100079f0
mov ebx, dword [eax + 0x10]
mov eax, dword [section..data]
cmp eax, 0xffffffff
jne 0x1001ae50
call sub.KERNEL32.dll_TlsAlloc
mov dword [section..data], eax
push eax
call fcn.1002e140
add esp, 4
test eax, eax
jne 0x1001ae62
call fcn.100079f0
push ebx
push dword [eax + 0xc]
lea eax, [esp + 0x20]
mov ecx, edi
push esi
push eax
call fcn.10028cb0
push eax
lea ecx, [esp + 0x10]
call fcn.10001760
lea ecx, [esp + 0x20]
call fcn.100016b0
cmp dword [esp + 0xc], 0x3000
pop ebx
je 0x1001aed2
mov eax, dword [section..data]
cmp eax, 0xffffffff
jne 0x1001aea5
call sub.KERNEL32.dll_TlsAlloc
mov dword [section..data], eax
push eax
call fcn.1002e140
add esp, 4
test eax, eax
jne 0x1001aeb7
call fcn.100079f0
mov ecx, dword [esp + 8]
xor esi, esi
mov dword [eax], ecx
lea ecx, [esp + 0x10]
call fcn.100016b0
pop edi
mov eax, esi
pop esi
add esp, 0x18
ret 4
mov eax, dword [section..data]
cmp eax, 0xffffffff
jne 0x1001aee6
call sub.KERNEL32.dll_TlsAlloc
mov dword [section..data], eax
push eax
call fcn.1002e140
add esp, 4
test eax, eax
jne 0x1001aef8
call fcn.100079f0
lea ecx, [esp + 0x10]
mov dword [eax], 0x3000
mov esi, 1
call fcn.100016b0
pop edi
mov eax, esi
pop esi
add esp, 0x18
ret 4
Function at 0x1001b3d0
Capabilities:
Allocate thread local storage

Disassembly:
mov eax, dword [esp + 8]
cmp eax, 3
ja case.default.0x1001b3dd
jmp dword [eax*4 + 0x1001b478]
call sub.KERNEL32.dll_TlsAlloc
mov dword [section..data], eax
cmp eax, 0xffffffff
jne case.0x1001b3dd.2
xor eax, eax
ret 0xc
call fcn.100079f0
mov eax, 1
ret 0xc
push dword [section..data]
call fcn.1002e140
push eax
call dword [sym.imp.mozglue.dll_free]
push 0
push dword [section..data]
call fcn.1002e980
add esp, 0x10
mov eax, 1
ret 0xc
push dword [section..data]
call fcn.1002e140
push eax
call dword [sym.imp.mozglue.dll_free]
push 0
push dword [section..data]
call fcn.1002e980
mov eax, dword [section..data]
add esp, 0x10
cmp eax, 0xffffffff
je case.default.0x1001b3dd
push eax
call fcn.1002ddf0
add esp, 4
mov dword [section..data], 0xffffffff
mov eax, 1
ret 0xc

Function at 0x1001d610
Capabilities:
Terminate process

Disassembly:
push dword [esp + 4]
push 0x1017d024
push 2
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
add esp, 4
push eax
call fcn.10021130
add esp, 0xc
push 2
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
Function at 0x1002fe20
Capabilities:
Get common file path

Disassembly:
sub esp, 0x104
lea eax, [esp]
push esi
mov esi, dword [esp + 0x10c]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
test eax, eax
jne 0x1002fe57
mov dword [esi], eax
mov dword [esi + 0x10], eax
mov dword [esi + 0x14], 0xf
mov eax, esi
pop esi
add esp, 0x104
ret
lea eax, [esp + 4]
push eax
push 0
push 0x10183bec
push eax
call dword [sym.imp.KERNEL32.dll_GetTempFileNameA]
mov dword [esi], 0
mov dword [esi + 0x10], 0
test eax, eax
je 0x1002fe46
lea ecx, [esp + 4]
mov dword [esi + 0x14], 0
lea edx, [ecx + 1]
nop dword [eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x1002fe90
sub ecx, edx
lea eax, [esp + 4]
push ecx
push eax
mov ecx, esi
call fcn.100011e0
mov eax, esi
pop esi
add esp, 0x104
ret
Function at 0x10033890
Capabilities:
Write file on windows

Disassembly:
push esi
push 0x10183bf0
push dword [esp + 0xc]
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fopen]
mov esi, eax
add esp, 8
test esi, esi
je 0x100338c4
push esi
push dword [esp + 0x14]
push 1
push dword [esp + 0x18]
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
push esi
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
add esp, 0x14
pop esi
ret
Function at 0x1007d8d0
Capabilities:
Check os version

Disassembly:
sub esp, 0x11c
push edi
mov edi, ecx
cmp byte [edi + 0xb54], 0
je 0x1007d8f0
mov al, byte [edi + 0xb55]
pop edi
add esp, 0x11c
ret
call fcn.10056820
cmp byte [eax + 4], 0
je 0x1007da0f
call fcn.1001ce10
test al, al
jne 0x1007da0f
cmp dword [edi + 0x958], 0x9300
jle 0x1007da0f
cmp byte [edi + 0x2fc], al
je 0x1007d948
push dword [edi + 0x950]
call fcn.10095140
add esp, 4
test eax, eax
je 0x1007da0f
cmp eax, 2
je 0x1007da0f
cmp eax, 3
jmp 0x1007d96c
mov eax, dword [edi + 0x2f8]
cmp eax, 4
je 0x1007da0f
cmp eax, 2
je 0x1007da0f
cmp eax, 3
je 0x1007da0f
cmp eax, 5
jne 0x1007d9fc
push esi
push pe_nt_image_headers32
lea eax, [esp + 0x20]
mov dword [esp + 0xc], 0x11c
push 0
push eax
mov dword [esp + 0x20], 0
mov dword [esp + 0x24], 0
call sub.VCRUNTIME140.dll_memset
mov esi, dword [sym.imp.KERNEL32.dll_VerSetConditionMask]
add esp, 0xc
xor eax, eax
mov word [esp + 0x11e], ax
mov dword [esp + 0x120], eax
push 3
push 0x20
push 3
push 1
push 3
push 2
push eax
push eax
call esi
push edx
push eax
call esi
push edx
push eax
call esi
push edx
push eax
push 0x23
lea eax, [esp + 0x14]
mov dword [esp + 0x18], 6
xor ecx, ecx
mov dword [esp + 0x1c], 2
push eax
mov word [esp + 0x12c], cx
call dword [sym.imp.KERNEL32.dll_VerifyVersionInfoW]
pop esi
test eax, eax
je 0x1007da0f
mov word [edi + 0xb54], 0x101
mov al, 1
pop edi
add esp, 0x11c
ret
mov word [edi + 0xb54], 1
xor al, al
pop edi
add esp, 0x11c
ret
Function at 0x1008a4f0
Capabilities:
Get number of processors

Disassembly:
sub esp, 0x64
mov eax, dword [0x101b9ba0]
push ebx
push ebp
push esi
lea esi, [eax*4]
mov dword [esp + 0x24], 0
mov eax, dword fs:[0x2c]
push edi
mov dword [esp + 0x2c], 0
mov dword [esp + 0x30], 0
mov ecx, dword [esi + eax]
mov eax, dword [0x101b8340]
mov dword [esp + 0x34], 0
mov dword [esp + 0x38], 0
mov dword [esp + 0x3c], 0
mov dword [esp + 0x40], 0
cmp eax, dword [ecx + 4]
jg 0x1008a6b3
lea eax, [esp + 0x7c]
mov ecx, 0x101b8338
push eax
lea eax, [esp + 0x14]
push eax
call fcn.10034700
mov ecx, dword [esp + 0x18]
mov eax, dword [0x101b8338]
mov edi, dword [esp + 0x7c]
cmp byte [ecx + 0xd], 0
jne 0x1008a581
cmp edi, dword [ecx + 0x10]
jge 0x1008a583
mov ecx, eax
cmp ecx, eax
je 0x1008a5aa
mov eax, dword [ecx + 0x14]
mov dword [esp + 0x28], eax
mov eax, dword [ecx + 0x18]
mov dword [esp + 0x2c], eax
mov eax, dword [ecx + 0x1c]
mov dword [esp + 0x30], eax
mov eax, dword [ecx + 0x24]
mov dword [esp + 0x34], eax
mov eax, dword [ecx + 0x28]
mov dword [esp + 0x38], eax
mov eax, dword fs:[0x2c]
mov ecx, dword [esi + eax]
mov eax, dword [0x101b834c]
cmp eax, dword [ecx + 4]
jg 0x1008a6f3
lea eax, [esp + 0x7c]
mov ecx, 0x101b8344
push eax
lea eax, [esp + 0x14]
push eax
call fcn.10034700
mov ecx, dword [esp + 0x18]
mov eax, dword [0x101b8344]
cmp byte [ecx + 0xd], 0
jne 0x1008a5ec
cmp edi, dword [ecx + 0x10]
jge 0x1008a5ee
mov ecx, eax
cmp ecx, eax
je 0x1008a600
mov eax, dword [ecx + 0x14]
mov dword [esp + 0x3c], eax
mov eax, dword [ecx + 0x18]
mov dword [esp + 0x40], eax
movups xmm0, xmmword [esp + 0x28]
mov eax, dword [esp + 0x80]
mov ebx, dword [esp + 0x78]
mov ecx, ebx
mov ebp, dword [esp + 0x84]
mov dword [esp + 0x44], eax
lea eax, [esp + 0x4c]
movups xmmword [esp + 0x50], xmm0
push eax
movups xmm0, xmmword [esp + 0x3c]
lea eax, [esp + 0x20]
mov dword [esp + 0x50], edi
push eax
movups xmmword [esp + 0x68], xmm0
mov dword [esp + 0x78], ebp
call fcn.10034700
movq xmm0, qword [eax]
mov eax, dword [eax + 8]
movq qword [esp + 0x10], xmm0
cmp byte [eax + 0xd], 0
jne 0x1008a65b
cmp edi, dword [eax + 0x10]
jge 0x1008a6ab
cmp dword [ebx + 4], 0x4924924
je 0x1008a733
mov esi, dword [ebx]
push 0x38
call dword [sym.imp.mozglue.dll_moz_xmalloc]
movups xmm0, xmmword [esp + 0x2c]
add esp, 4
mov ecx, ebx
movups xmmword [eax + 0x14], xmm0
mov dword [eax + 0x10], edi
movups xmm0, xmmword [esp + 0x38]
push eax
push dword [esp + 0x18]
movups xmmword [eax + 0x24], xmm0
mov dword [eax + 0x34], ebp
push dword [esp + 0x18]
mov dword [eax], esi
mov dword [eax + 4], esi
mov dword [eax + 8], esi
mov word [eax + 0xc], 0
call fcn.1001b090
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x64
ret
push 0x101b8340
call fcn.10174843
add esp, 4
cmp dword [0x101b8340], 0xffffffff
jne 0x1008a555
push 0x101b8338
call fcn.1008a800
push 0x101759a0
call fcn.1017471f
push 0x101b8340
call fcn.101747f9
add esp, 0xc
jmp 0x1008a555
push 0x101b834c
call fcn.10174843
add esp, 4
cmp dword [0x101b834c], 0xffffffff
jne 0x1008a5c4
push 0x101b8344
call fcn.1008bc70
push 0x101759b0
call fcn.1017471f
push 0x101b834c
call fcn.101747f9
add esp, 0xc
jmp 0x1008a5c4
call fcn.1001b2d0
int3
Function at 0x1008e250
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x24
push ebx
push ebp
mov ebp, dword [esp + 0x30]
mov ecx, ebp
push esi
push edi
call fcn.10114000
mov ecx, dword [esp + 0x48]
mov eax, dword [esp + 0x44]
mov esi, dword [esp + 0x40]
push ecx
mov dword [esp + 0x14], eax
mov eax, dword [ecx]
push esi
mov dword [esp + 0x1c], eax
call fcn.1008e4f0
push esi
mov edi, eax
call fcn.1014e780
add esp, 0xc
mov ecx, 0x20
cmp dword [eax + 0x1c], 0
jne 0x1008e2ad
cmp dword [eax + 0x20], 0
jne 0x1008e2ad
cmp dword [esp + 0x3c], 2
mov ecx, 0xa0
mov eax, 0xe0
cmovg ecx, eax
push ecx
push dword [edi + 8]
lea ecx, [esp + 0x18]
call fcn.100994b0
push 0x200
mov byte [ebp], al
lea ecx, [esp + 0x14]
push dword [edi + 0xc]
call fcn.100994b0
push 0x4000
mov byte [ebp + 1], al
lea ecx, [esp + 0x14]
push dword [edi + 0x10]
call fcn.100994b0
lea ebx, [edi + 0x14]
test al, al
jne 0x1008e2fd
push 0x10000
push dword [ebx]
lea ecx, [esp + 0x18]
call fcn.100994b0
test al, al
je 0x1008e2ff
mov al, 1
mov byte [ebp + 2], al
mov ebx, dword [ebx]
test ebx, ebx
jne 0x1008e313
mov ebx, dword [edi + 0x10]
test ebx, ebx
je 0x1008e44a
push 0x200000
push ebx
lea ecx, [esp + 0x18]
call fcn.100994b0
test al, al
je 0x1008e44a
lea eax, [esp + 0x48]
mov dword [esp + 0x48], 1
push eax
lea eax, [esp + 0x20]
add ebp, 4
push eax
mov ecx, ebp
call fcn.10025580
movq xmm0, qword [eax]
mov eax, dword [eax + 8]
movq qword [esp + 0x10], xmm0
cmp byte [eax + 0xd], 0
jne 0x1008e35f
cmp dword [eax + 0x10], 1
jbe 0x1008e39f
cmp dword [ebp + 4], 0xccccccc
je 0x1008e454
mov esi, dword [ebp]
push 0x14
call dword [sym.imp.mozglue.dll_moz_xmalloc]
add esp, 4
mov ecx, ebp
mov dword [eax + 0x10], 1
push eax
push dword [esp + 0x18]
mov dword [eax], esi
push dword [esp + 0x18]
mov dword [eax + 4], esi
mov dword [eax + 8], esi
mov word [eax + 0xc], 0
call fcn.1001b090
mov edi, 2
mov dword [esp + 0x10], edi
mov esi, edi
nop word [eax + eax]
mov ecx, dword [esp + 0x44]
lea edx, [esp + 0x48]
push edx
push edi
push ebx
mov eax, dword [ecx]
push ecx
mov dword [esp + 0x58], 0
call dword [eax + 0x78]
test eax, eax
js 0x1008e435
cmp dword [esp + 0x48], 0
je 0x1008e446
lea eax, [esp + 0x10]
mov ecx, ebp
push eax
lea eax, [esp + 0x2c]
push eax
call fcn.10025580
movq xmm0, qword [eax]
mov eax, dword [eax + 8]
movq qword [esp + 0x1c], xmm0
cmp byte [eax + 0xd], 0
jne 0x1008e3fd
cmp esi, dword [eax + 0x10]
jae 0x1008e435
cmp dword [ebp + 4], 0xccccccc
je 0x1008e454
mov esi, dword [ebp]
push 0x14
call dword [sym.imp.mozglue.dll_moz_xmalloc]
add esp, 4
mov ecx, ebp
mov dword [eax + 0x10], edi
push eax
push dword [esp + 0x24]
mov dword [eax], esi
push dword [esp + 0x24]
mov dword [eax + 4], esi
mov dword [eax + 8], esi
mov word [eax + 0xc], 0
call fcn.1001b090
add edi, edi
mov dword [esp + 0x10], edi
mov esi, edi
cmp edi, 0x20
jbe 0x1008e3b0
mov ebp, dword [esp + 0x38]
pop edi
pop esi
mov eax, ebp
pop ebp
pop ebx
add esp, 0x24
ret
call fcn.1001b2d0
int3
Function at 0x10097b50
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x54
push edi
lea eax, [esp + 4]
mov dword [esp + 4], 0
push eax
lea eax, [esp + 0x14]
mov edi, ecx
push eax
call fcn.10098920
mov ecx, dword [esp + 0x10]
test ecx, ecx
je 0x10097b90
mov eax, dword [esp + 0x5c]
pop edi
mov dword [eax], ecx
mov ecx, dword [esp + 0x10]
mov dword [eax + 4], ecx
mov ecx, dword [esp + 0x14]
mov dword [eax + 8], ecx
add esp, 0x54
ret 0xc
mov ecx, dword [esp + 0x64]
push esi
mov esi, dword [ecx]
mov eax, dword [ecx + 0xc]
mov edx, dword [ecx + 4]
add eax, esi
mov dword [esp + 0x34], eax
mov eax, dword [ecx + 0x10]
add eax, edx
mov dword [esp + 0x2c], esi
cmp dword [edi + 0x24], 1
mov dword [esp + 0x38], eax
mov eax, dword [edi + 0x20]
mov dword [esp + 0x30], edx
mov dword [esp + 0xc], esi
mov dword [esp + 0x10], edx
mov esi, dword [eax + 0x2f4]
jne 0x10097ce0
mov edi, dword [esp + 8]
lea ecx, [esp + 0x3c]
push ecx
push edi
mov eax, dword [edi]
call dword [eax + 0x30]
mov eax, dword [esi]
lea ecx, [esp + 0x68]
push 0
push ecx
push 2
push dword [esp + 0x48]
mov dword [esp + 0x78], 0
push dword [esp + 0x68]
push dword [esp + 0x68]
push esi
call dword [eax + 0x90]
test eax, eax
jns 0x10097c80
push eax
push str.Internal_CreateOffscreenPlainSurface_call_failed__result:_0x_X.
mov esi, dword [esp + 0x68]
push 0x505
push esi
call fcn.101314c0
add esp, 0x10
mov edi, dword [esp + 0x1c]
test edi, edi
je 0x10097c76
mov ecx, dword [edi + 0x14]
cmp ecx, 0x10
jb 0x10097c5b
mov eax, dword [edi]
inc ecx
cmp ecx, 0x1000
jb 0x10097c51
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x10097cda
mov eax, edx
push ecx
push eax
call fcn.10174919
add esp, 8
mov dword [edi + 0x10], 0
mov dword [edi + 0x14], 0xf
push edi
mov byte [edi], 0
call dword [sym.imp.mozglue.dll_free]
add esp, 4
mov eax, esi
pop esi
pop edi
add esp, 0x54
ret 0xc
push edi
push dword [esp + 0x6c]
lea eax, [esp + 0x28]
push eax
call fcn.10097790
add esp, 0xc
lea ecx, [esp + 0x28]
call fcn.100016b0
mov eax, dword [esi]
lea ecx, [esp + 0xc]
push ecx
push dword [esp + 0x68]
lea ecx, [esp + 0x34]
push ecx
push dword [esp + 0x74]
push esi
call dword [eax + 0x78]
mov edx, dword [esp + 0x68]
mov esi, eax
test edx, edx
je 0x10097ccb
mov ecx, dword [edx]
push edx
call dword [ecx + 8]
mov dword [esp + 0x68], 0
test esi, esi
jns 0x10097d07
push esi
push str.Internal_UpdateSurface_call_failed__result:_0x_X.
jmp 0x10097c0e
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
mov eax, dword [esi]
lea ecx, [esp + 0xc]
push ecx
push dword [esp + 0x68]
lea ecx, [esp + 0x34]
push ecx
push dword [esp + 0x14]
push esi
call dword [eax + 0x78]
test eax, eax
jns 0x10097d07
push eax
push str.Internal_UpdateSurface_call_failed__result:_0x_X.
jmp 0x10097c0e
mov esi, dword [esp + 0x60]
mov dword [esi], 0
mov dword [esi + 4], 0
mov dword [esi + 8], 0
jmp 0x10097c20
Function at 0x1009bc60
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
sub esp, 8
push ebx
push ebp
mov ebp, dword [esp + 0x18]
mov ebx, ecx
push esi
push edi
mov edx, ebp
cmp dword [ebp + 0x14], 0x10
mov edi, dword [ebp + 0x10]
jb 0x1009bc7b
mov edx, dword [ebp]
xor ecx, ecx
mov esi, 0x811c9dc5
test edi, edi
je 0x1009bc97
movzx eax, byte [ecx + edx]
inc ecx
xor eax, esi
imul esi, eax, 0x1000193
cmp ecx, edi
jb 0x1009bc86
push esi
push ebp
lea eax, [esp + 0x18]
mov ecx, ebx
push eax
call fcn.1009b940
mov ecx, dword [esp + 0x14]
test ecx, ecx
je 0x1009bcc1
mov eax, dword [esp + 0x1c]
mov dword [eax], ecx
mov byte [eax + 4], 0
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret 8
cmp dword [ebx + 8], 0x71c71c7
je 0x1009be05
push 0x24
call dword [sym.imp.mozglue.dll_moz_xmalloc]
add esp, 4
mov edi, eax
lea ecx, [edi + 8]
push ebp
call fcn.10029be0
mov dword [edi + 0x20], 0
mov ecx, dword [ebx + 8]
mov ebp, dword [ebx + 0x1c]
inc ecx
mov eax, ebp
movss xmm3, dword [ebx]
shr eax, 0x1f
movd xmm0, ecx
cvtdq2pd xmm0, xmm0
shr ecx, 0x1f
addsd xmm0, qword [ecx*8 + 0x10179f60]
cvtpd2ps xmm2, xmm0
movd xmm0, ebp
cvtdq2pd xmm0, xmm0
movaps xmm1, xmm2
addsd xmm0, qword [eax*8 + 0x10179f60]
cvtpd2ps xmm0, xmm0
divss xmm1, xmm0
comiss xmm1, xmm3
jbe 0x1009bda2
divss xmm2, xmm3
sub esp, 8
cvtps2pd xmm0, xmm2
movsd qword [esp + 0x18], xmm0
fld qword [esp + 0x18]
fstp qword [esp]
call sub.api_ms_win_crt_math_l1_1_0.dll_ceil
fstp qword [esp + 0x18]
movsd xmm0, qword [esp + 0x18]
add esp, 8
cvtpd2ps xmm0, xmm0
call fcn.101749f0
mov ecx, 8
cmp eax, ecx
cmova ecx, eax
cmp ebp, ecx
jae 0x1009bd85
cmp ebp, 0x200
jae 0x1009bd83
shl ebp, 3
cmp ebp, ecx
jae 0x1009bd85
mov ebp, ecx
push ebp
mov ecx, ebx
call fcn.1009fff0
push esi
lea eax, [edi + 8]
mov ecx, ebx
push eax
lea eax, [esp + 0x18]
push eax
call fcn.1009b940
mov edx, dword [eax]
jmp 0x1009bda6
mov edx, dword [esp + 0x10]
mov ebp, dword [edx + 4]
inc dword [ebx + 8]
mov dword [edi], edx
mov dword [edi + 4], ebp
mov dword [ebp], edi
mov dword [edx + 4], edi
mov eax, dword [ebx + 0x18]
mov ecx, dword [ebx + 0xc]
and eax, esi
mov esi, dword [ecx + eax*8]
cmp esi, dword [ebx + 4]
jne 0x1009bdcc
mov dword [ecx + eax*8], edi
jmp 0x1009bded
cmp esi, edx
jne 0x1009bde7
mov dword [ecx + eax*8], edi
mov eax, dword [esp + 0x1c]
mov dword [eax], edi
mov byte [eax + 4], 1
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret 8
cmp dword [ecx + eax*8 + 4], ebp
jne 0x1009bdf1
mov dword [ecx + eax*8 + 4], edi
mov eax, dword [esp + 0x1c]
mov dword [eax], edi
pop edi
pop esi
pop ebp
mov byte [eax + 4], 1
pop ebx
add esp, 8
ret 8
push str.unordered_map_set_too_long
call sub.MSVCP140.dll_void___cdecl_std::_Xlength_error_char_const__
int3
Function at 0x100bc0b0
Capabilities:
Encode data using xor
Hash data using murmur3

Disassembly:
mov ecx, dword [esp + 4]
push ebx
mov ebx, dword [esp + 0xc]
mov eax, ebx
cdq
and edx, 3
add edx, eax
sar edx, 2
push esi
mov esi, dword [esp + 0x14]
push edi
lea edi, [ecx + edx*4]
neg edx
je 0x100bc103
nop dword [eax]
nop word [eax + eax]
imul eax, dword [edi + edx*4], 0xcc9e2d51
rol eax, 0xf
imul eax, eax, 0x1b873593
xor esi, eax
rol esi, 0xd
add esi, 0xfaddaf14
lea esi, [esi + esi*4]
add edx, 1
jne 0x100bc0e0
mov eax, ebx
xor ecx, ecx
and eax, 3
sub eax, 1
je 0x100bc129
sub eax, 1
je 0x100bc120
sub eax, 1
jne 0x100bc13f
movzx ecx, byte [edi + 2]
shl ecx, 0x10
movzx eax, byte [edi + 1]
shl eax, 8
xor ecx, eax
movzx eax, byte [edi]
xor eax, ecx
imul eax, eax, 0xcc9e2d51
rol eax, 0xf
imul eax, eax, 0x1b873593
xor esi, eax
xor esi, ebx
mov eax, esi
shr eax, 0x10
xor eax, esi
imul ecx, eax, 0x85ebca6b
pop edi
pop esi
pop ebx
mov eax, ecx
shr eax, 0xd
xor eax, ecx
imul eax, eax, 0xc2b2ae35
mov ecx, eax
shr ecx, 0x10
xor ecx, eax
mov eax, dword [esp + 0x10]
mov dword [eax], ecx
ret