joyce8/EMBER2024-capa huggingface dataset:
Function at 0x431fe0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push 0xffffffffffffffff
push 0x435528
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
mov eax, dword [0x44c054]
xor eax, esp
mov dword [esp + 0x18], eax
push ebx
push esi
push edi
mov eax, dword [0x44c054]
xor eax, esp
push eax
lea eax, [esp + 0x2c]
mov dword fs:[0], eax
mov esi, ecx
mov ecx, dword [esi]
mov ebx, dword [esp + 0x3c]
mov eax, dword [ecx + 0x13c]
sub eax, dword [ecx + 0x138]
cmp dword [esi + 0x70], eax
jne 0x43208f
mov eax, dword [esi + 0x7c]
sub eax, dword [esi + 0x78]
test eax, 0xfffffffc
je 0x43208f
mov eax, dword [esi + 0x7c]
cmp dword [eax - 4], ebx
jle 0x43208f
mov eax, dword [ecx + 0x14]
test al, 3
jne 0x43204d
test eax, 0x1000000
je 0x43208f
push str.Cant_terminate_a_sub_expression_with_an_alternation_operator_.
lea ecx, [esp + 0x14]
call fcn.0040ef97
lea eax, [esp + 0x10]
push eax
mov eax, dword [esi + 0x5c]
sub eax, dword [esi + 0x54]
mov ecx, esi
push eax
push 0x11
mov dword [esp + 0x40], 0
call fcn.00429a30
cmp dword [esp + 0x24], 0x10
jb 0x43208b
push dword [esp + 0x10]
call sub.MSVCR110.dll_void___cdecl_operator_delete_void__
add esp, 4
xor al, al
jmp 0x4320fe
mov eax, dword [esi + 0x7c]
sub eax, dword [esi + 0x78]
test eax, 0xfffffffc
je 0x4320fc
lea esp, [esp]
mov eax, dword [esi + 0x7c]
mov edi, dword [eax - 4]
cmp edi, ebx
jle 0x4320fc
cmp dword [esi + 0x78], eax
je 0x4320b5
add eax, 0xfffffffc
mov dword [esi + 0x7c], eax
mov edx, dword [esi]
mov ecx, dword [edx + 0x13c]
sub ecx, dword [edx + 0x138]
add ecx, 3
and ecx, 0xfffffffc
add ecx, dword [edx + 0x138]
mov dword [edx + 0x13c], ecx
mov eax, dword [esi]
mov ecx, dword [eax + 0x13c]
sub ecx, dword [eax + 0x138]
mov eax, dword [eax + 0x138]
sub ecx, edi
mov dword [eax + edi + 8], ecx
mov eax, dword [esi + 0x7c]
sub eax, dword [esi + 0x78]
test eax, 0xfffffffc
jne 0x4320a0
mov al, 1
mov ecx, dword [esp + 0x2c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x18]
xor ecx, esp
call fcn.0041d508
add esp, 0x28
ret 4
Function at 0x10001400
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10042cb0
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x1006f368]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, 0x10070c18
mov dword [ebp - 0x10], edi
push 8
mov dword [0x10070c1c], 0
mov dword [0x10070c20], 0
mov dword [0x10070c24], 0
mov dword [0x10070c28], 0
mov dword [0x10070c2c], 0
call fcn.10041382
mov dword [eax + 4], 0
mov dword [0x10070c1c], eax
mov dword [eax], 0x10070c1c
mov dword [ebp - 4], 0
lea esi, [edi + 0x18]
push 8
mov dword [esi], 0
mov dword [esi + 4], 0
mov dword [esi + 8], 0
mov dword [esi + 0xc], 0
mov dword [esi + 0x10], 0
call fcn.10041382
add esp, 8
mov dword [eax + 4], 0
mov dword [esi], eax
mov dword [eax], esi
mov eax, edi
mov byte [edi + 0x2c], 1
mov dword [edi + 0x30], 0x3f800000
mov dword [edi + 0x34], 0x61
mov dword [edi + 0x38], 0xba
mov dword [edi + 0x3c], 0x3b
mov dword [edi + 0x40], 0xff
mov dword [edi + 0x68], 0
mov dword [edi + 0x6c], 0
mov dword [edi + 0x70], 0
mov dword [edi + 0x74], 0
mov dword [edi + 0x78], 0
mov dword [edi + 0x7c], 0
mov dword [edi + 0x80], 0
mov dword [edi + 0x84], 0
mov dword [edi + 0x88], 0
mov dword [edi + 0x8c], 0
mov dword [edi + 0x90], 0
mov dword [edi + 0x94], 0
mov dword [edi + 0x98], 0
mov dword [edi + 0x9c], 0
mov dword [edi + 0xa0], 0
mov dword [edi + 0xa4], 0
mov dword [edi + 0xa8], 0
mov dword [edi + 0xac], 0
mov dword [edi + 0xb0], 0
mov dword [edi + 0xb4], 0
mov dword [edi + 0xb8], 0
mov dword [edi + 0xbc], 0
mov dword [edi + 0xc0], 0
mov dword [edi + 0xc4], 0
mov dword [edi + 0xc8], 0
mov dword [edi + 0xcc], 0
mov dword [edi + 0xd0], 0
mov dword [edi + 0xd4], 0
mov dword [edi + 0xd8], 0
mov dword [edi + 0xdc], 0
mov dword [edi + 0xe0], 0
mov dword [edi + 0xe4], 0
mov dword [edi + 0xe8], 0
mov dword [edi + 0xec], 0
mov dword [edi + 0xf0], 0
mov dword [edi + 0xf4], 0
mov dword [edi + 0xf8], 0
mov dword [edi + 0xfc], 0
mov dword [edi + 0x100], 0
mov dword [edi + 0x104], 0
mov dword [edi + 0x108], 0
mov dword [edi + 0x10c], 0
mov dword [edi + 0x110], 0
mov dword [edi + 0x114], 0
mov dword [edi + 0x118], 0
mov dword [edi + 0x11c], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x10006e50
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x1c
push ebx
mov ebx, ecx
push esi
push edi
cmp dword [ebx + 0x38], 0
je 0x10006e7c
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____thiscall_std::basic_streambuf_char__struct_std::char_traits_char__::xsputn_char_const___long_long___int64__]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov eax, dword [ebx + 0x20]
mov esi, dword [ebp + 0xc]
mov edi, dword [ebp + 0x10]
mov dword [esp + 0x20], esi
mov ecx, dword [eax]
lea eax, [ebx + 0x30]
mov dword [esp + 0x24], edi
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x18], eax
test ecx, ecx
je 0x10006ea4
mov eax, dword [eax]
mov ecx, dword [eax]
jmp 0x10006eaa
xor ecx, ecx
mov dword [esp + 0x18], eax
mov eax, ecx
cdq
mov dword [esp + 0x10], eax
mov ecx, edx
mov dword [esp + 0x14], ecx
test edi, edi
jl 0x10006f12
jg 0x10006ec1
test esi, esi
je 0x10006f12
test ecx, ecx
jl 0x10006f0d
jg 0x10006ecb
test eax, eax
je 0x10006f0d
cmp edi, ecx
jg 0x10006edf
jl 0x10006ed5
cmp esi, eax
jae 0x10006edf
mov eax, esi
mov dword [esp + 0x10], esi
mov dword [esp + 0x14], edi
push eax
push dword [ebp + 8]
push dword [esp + 0x24]
call sub.VCRUNTIME140.dll_memcpy
mov eax, dword [esp + 0x24]
add esp, 0xc
mov edx, dword [esp + 0x10]
mov ecx, dword [ebp + 8]
add ecx, edx
sub esi, edx
mov eax, dword [eax]
sbb edi, dword [esp + 0x14]
sub dword [eax], edx
mov eax, dword [ebx + 0x20]
add dword [eax], edx
jmp 0x10006f15
mov ecx, dword [ebp + 8]
jmp 0x10006f1f
mov ecx, dword [ebp + 8]
test edi, edi
jl 0x10006f39
jg 0x10006f1f
test esi, esi
je 0x10006f39
mov eax, dword [ebx + 0x4c]
test eax, eax
je 0x10006f39
push eax
push esi
push 1
push ecx
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
add esp, 0x10
sub esi, eax
sbb edi, 0
mov eax, dword [esp + 0x20]
mov edx, dword [esp + 0x24]
sub eax, esi
sbb edx, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x10006f50
Capabilities:
Read file on windows

Disassembly:
mov eax, dword [esp + 0xc]
sub esp, 8
push ebx
mov ebx, ecx
push ebp
mov ebp, dword [esp + 0x14]
push esi
mov esi, dword [esp + 0x1c]
test eax, eax
jg 0x10006f7b
jl 0x10006f6e
test esi, esi
jne 0x10006f7b
pop esi
pop ebp
xor eax, eax
xor edx, edx
pop ebx
add esp, 8
ret 0xc
cmp dword [ebx + 0x38], 0
je 0x10006f93
push eax
push esi
push ebp
call dword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____thiscall_std::basic_streambuf_char__struct_std::char_traits_char__::xsgetn_char___long_long___int64__]
pop esi
pop ebp
pop ebx
add esp, 8
ret 0xc
mov eax, dword [ebx + 0x1c]
push edi
mov edi, esi
mov edx, dword [eax]
test edx, edx
je 0x10006fd5
mov eax, dword [ebx + 0x2c]
lea ecx, [ebx + 0x2c]
mov dword [esp + 0x10], ecx
mov eax, dword [eax]
test eax, eax
je 0x10006fdc
cmp eax, dword [esp + 0x20]
cmovb esi, eax
push esi
push edx
push ebp
call sub.VCRUNTIME140.dll_memcpy
mov eax, dword [ebx + 0x2c]
add ebp, esi
sub edi, esi
add esp, 0xc
sub dword [eax], esi
mov eax, dword [ebx + 0x1c]
add dword [eax], esi
mov esi, dword [esp + 0x20]
jmp 0x10006fdc
lea eax, [ebx + 0x2c]
mov dword [esp + 0x10], eax
cmp dword [ebx + 0x4c], 0
je 0x10007049
mov ecx, dword [ebx + 0xc]
lea eax, [ebx + 0x3c]
cmp dword [ecx], eax
jne 0x10007006
mov eax, dword [ebx + 0xc]
mov edx, dword [ebx + 0x54]
mov ecx, dword [ebx + 0x50]
sub edx, ecx
mov dword [eax], ecx
mov eax, dword [ebx + 0x1c]
mov dword [eax], ecx
mov eax, dword [esp + 0x10]
mov eax, dword [eax]
mov dword [eax], edx
mov eax, dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
cmp edi, 0xfff
jbe 0x10007037
push dword [ebx + 0x4c]
push 0xfff
push 1
push ebp
call eax
add esp, 0x10
add ebp, eax
sub edi, eax
cmp eax, 0xfff
jne 0x10007049
cmp edi, eax
mov eax, dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
ja 0x10007013
test edi, edi
je 0x10007049
push dword [ebx + 0x4c]
push edi
push 1
push ebp
call eax
add esp, 0x10
sub edi, eax
mov edx, dword [esp + 0x24]
sub esi, edi
pop edi
mov eax, esi
sbb edx, 0
pop esi
pop ebp
pop ebx
add esp, 8
ret 0xc
Function at 0x100073c0
Capabilities:
Write file on windows

Disassembly:
sub esp, 0x30
mov eax, dword [0x1006f368]
xor eax, esp
mov dword [esp + 0x2c], eax
push ebx
mov ebx, dword [esp + 0x38]
push esi
mov esi, ecx
cmp ebx, 0xffffffff
jne 0x100073f0
pop esi
xor eax, eax
pop ebx
mov ecx, dword [esp + 0x2c]
xor ecx, esp
call fcn.10040c92
add esp, 0x30
ret 4
mov eax, dword [esi + 0x20]
mov eax, dword [eax]
test eax, eax
je 0x10007421
mov edx, dword [esi + 0x30]
mov edx, dword [edx]
add edx, eax
cmp eax, edx
jae 0x10007421
call dword [sym.imp.MSVCP140.dll_protected:_char____thiscall_std::basic_streambuf_char__struct_std::char_traits_char__::_Pninc_void_]
pop esi
mov byte [eax], bl
mov eax, ebx
pop ebx
mov ecx, dword [esp + 0x2c]
xor ecx, esp
call fcn.10040c92
add esp, 0x30
ret 4
cmp dword [esi + 0x4c], 0
push edi
je 0x10007507
mov edi, dword [esi + 0xc]
lea eax, [esi + 0x3c]
cmp dword [edi], eax
jne 0x1000744a
mov edx, dword [esi + 0x54]
mov ecx, dword [esi + 0x50]
sub edx, ecx
mov dword [edi], ecx
mov eax, dword [esi + 0x1c]
mov dword [eax], ecx
mov eax, dword [esi + 0x2c]
mov dword [eax], edx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x10007456
movsx eax, bl
jmp 0x10007496
lea eax, [esp + 0xc]
mov byte [esp + 0x17], bl
push eax
lea eax, [esp + 0x3c]
push eax
lea eax, [esp + 0x20]
push eax
lea eax, [esp + 0x1c]
push eax
lea eax, [esp + 0x28]
push eax
lea eax, [esp + 0x2b]
push eax
lea eax, [esi + 0x40]
push eax
call dword [sym.imp.MSVCP140.dll_public:_int___thiscall_std::codecvt_char__char__struct__Mbstatet_::out_struct__Mbstatet___char_const___char_const___char_const____char___char___char___const]
sub eax, 0
je 0x100074c1
sub eax, 1
je 0x100074c1
sub eax, 2
jne 0x10007507
movsx eax, byte [esp + 0x17]
push dword [esi + 0x4c]
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
add esp, 8
or ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, ebx
pop edi
pop esi
mov eax, ecx
pop ebx
mov ecx, dword [esp + 0x2c]
xor ecx, esp
call fcn.10040c92
add esp, 0x30
ret 4
mov edi, dword [esp + 0xc]
lea eax, [esp + 0x18]
sub edi, eax
je 0x100074e1
push dword [esi + 0x4c]
push edi
push 1
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
add esp, 0x10
cmp edi, eax
jne 0x10007507
lea ecx, [esp + 0x17]
mov byte [esi + 0x3d], 1
or eax, 0xffffffff
cmp dword [esp + 0x10], ecx
pop edi
pop esi
cmovne eax, ebx
pop ebx
mov ecx, dword [esp + 0x2c]
xor ecx, esp
call fcn.10040c92
add esp, 0x30
ret 4
mov ecx, dword [esp + 0x38]
or eax, 0xffffffff
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.10040c92
add esp, 0x30
ret 4
Function at 0x10008940
Capabilities:
Write file on windows

Disassembly:
sub esp, 0x28
mov eax, dword [0x1006f368]
xor eax, esp
mov dword [esp + 0x24], eax
push esi
mov esi, ecx
cmp dword [esi + 0x38], 0
je 0x10008a02
cmp byte [esi + 0x3d], 0
je 0x10008a02
mov eax, dword [esi]
push edi
push 0xffffffffffffffff
call dword [eax + 0xc]
cmp eax, 0xffffffff
je 0x100089ef
mov ecx, dword [esi + 0x38]
lea eax, [esp + 8]
push eax
lea eax, [esp + 0x30]
push eax
lea eax, [esp + 0x14]
push eax
lea eax, [esi + 0x40]
push eax
call dword [sym.imp.MSVCP140.dll_public:_int___thiscall_std::codecvt_char__char__struct__Mbstatet_::unshift_struct__Mbstatet___char___char___char___const]
sub eax, 0
je 0x100089b3
sub eax, 1
je 0x100089b7
sub eax, 2
jne 0x100089ef
mov byte [esi + 0x3d], al
mov al, 1
pop edi
pop esi
mov ecx, dword [esp + 0x24]
xor ecx, esp
call fcn.10040c92
add esp, 0x28
ret
mov byte [esi + 0x3d], 0
mov edi, dword [esp + 8]
lea eax, [esp + 0xc]
sub edi, eax
je 0x100089d7
push dword [esi + 0x4c]
push edi
push 1
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
add esp, 0x10
cmp edi, eax
jne 0x100089ef
cmp byte [esi + 0x3d], 0
pop edi
sete al
pop esi
mov ecx, dword [esp + 0x24]
xor ecx, esp
call fcn.10040c92
add esp, 0x28
ret
pop edi
xor al, al
pop esi
mov ecx, dword [esp + 0x24]
xor ecx, esp
call fcn.10040c92
add esp, 0x28
ret
mov ecx, dword [esp + 0x28]
mov al, 1
pop esi
xor ecx, esp
call fcn.10040c92
add esp, 0x28
ret
Function at 0x10016ad0
Capabilities:
Create thread

Disassembly:
cmp dword [esp + 8], 1
jne 0x10016b03
push dword [esp + 4]
call dword [sym.imp.KERNEL32.dll_DisableThreadLibraryCalls]
push 0
push 0
push dword [esp + 0xc]
push 0x10016a80
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
test eax, eax
je 0x10016b03
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 1
ret 0xc
Function at 0x10020790
Capabilities:
Hash data using fnv

Disassembly:
sub esp, 0x10
push ebx
mov ebx, ecx
mov eax, 0x1fffffff
bsr ecx, eax
push ebp
push esi
push edi
mov edi, 1
mov dword [esp + 0x1c], ebx
mov eax, edi
shl eax, cl
mov ecx, dword [esp + 0x24]
cmp ecx, eax
jbe 0x100207c1
push str.invalid_hash_bucket_count
call dword [sym.imp.MSVCP140.dll_void___cdecl_std::_Xlength_error_char_const__]
lea eax, [ecx - 1]
mov esi, dword [ebx + 4]
or eax, 1
lea ebp, [ebx + 0xc]
bsr ecx, eax
push esi
lea ecx, [ecx + 1]
shl edi, cl
mov ecx, ebp
lea eax, [edi + edi]
push eax
call fcn.10004b60
lea eax, [edi - 1]
mov dword [ebx + 0x1c], edi
mov dword [ebx + 0x18], eax
mov eax, dword [ebx + 4]
mov eax, dword [eax]
mov ecx, eax
cmp eax, esi
je 0x100208cc
nop dword [eax]
movzx edx, byte [eax + 8]
xor edx, 0x811c9dc5
mov ecx, dword [ecx]
imul edi, edx, 0x1000193
movzx edx, byte [eax + 9]
xor edi, edx
movzx edx, byte [eax + 0xa]
imul edi, edi, 0x1000193
xor edi, edx
movzx edx, byte [eax + 0xb]
imul edi, edi, 0x1000193
xor edi, edx
mov edx, dword [ebp]
imul edi, edi, 0x1000193
and edi, dword [ebx + 0x18]
mov ebx, dword [edx + edi*8]
lea ebp, [edx + edi*8]
mov dword [esp + 0x14], ebp
cmp ebx, esi
jne 0x10020852
mov dword [ebp], eax
mov dword [ebp + 4], eax
jmp 0x100208bb
mov edx, dword [ebp + 4]
mov edi, dword [eax + 8]
cmp edi, dword [edx + 8]
jne 0x1002088c
mov edx, dword [edx]
mov dword [esp + 0x18], edx
cmp edx, eax
je 0x10020887
mov ebx, dword [eax + 4]
mov ebp, dword [esp + 0x18]
mov dword [ebx], ecx
mov edi, dword [ecx + 4]
mov dword [edi], edx
mov edx, dword [edx + 4]
mov dword [edx], eax
mov dword [ebp + 4], edi
mov ebp, dword [esp + 0x14]
mov dword [ecx + 4], ebx
mov dword [eax + 4], edx
mov dword [ebp + 4], eax
jmp 0x100208bb
cmp ebx, edx
je 0x1002089c
mov edx, dword [edx + 4]
cmp edi, dword [edx + 8]
je 0x100208d6
cmp ebx, edx
jne 0x10020890
mov ebp, dword [eax + 4]
mov dword [ebp], ecx
mov ebx, dword [ecx + 4]
mov dword [ebx], edx
mov edi, dword [edx + 4]
mov dword [edi], eax
mov dword [edx + 4], ebx
mov edx, dword [esp + 0x14]
mov dword [ecx + 4], ebp
mov dword [eax + 4], edi
mov dword [edx], eax
mov ebx, dword [esp + 0x1c]
mov eax, ecx
lea ebp, [ebx + 0xc]
cmp ecx, esi
jne 0x10020800
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret 4
mov ebx, dword [eax + 4]
mov ebp, dword [edx]
mov dword [ebx], ecx
mov edi, dword [ecx + 4]
mov dword [edi], ebp
mov edx, dword [ebp + 4]
mov dword [edx], eax
mov dword [ebp + 4], edi
mov dword [ecx + 4], ebx
mov dword [eax + 4], edx
jmp 0x100208bb
Function at 0x10020fc0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100447bd
mov eax, dword fs:[0]
push eax
sub esp, 0x30
push ebx
push esi
push edi
mov eax, dword [0x1006f368]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x20], eax
test eax, eax
je 0x10021154
cmp dword [eax + 4], 0
mov dword [ebp - 0x18], 0
jle 0x10021154
xor ecx, ecx
mov dword [ebp - 0x1c], ecx
mov esi, dword [eax]
mov edx, dword [ebp + 8]
add esi, ecx
mov ebx, dword [ebp + 0x10]
mov ecx, dword [esi + 0x28]
test ecx, ecx
je 0x10021035
cmp dword [esi + 0x34], 0
je 0x10021035
mov eax, dword [esi + 0x2c]
add eax, ebx
push eax
push ecx
push edx
mov ecx, 0x10070b68
call fcn.10020fc0
mov eax, dword [esi + 0x2c]
lea ecx, [ebp - 0x3c]
push dword [esi]
add eax, ebx
mov dword [ebp - 0x24], eax
call fcn.100154d0
mov dword [ebp - 4], 0
xor esi, esi
mov edx, dword [ebp - 0x2c]
xor ecx, ecx
mov ebx, dword [ebp - 0x28]
mov edi, dword [ebp - 0x3c]
test edx, edx
je 0x1002107a
nop
imul esi, esi, 0x811c9dc5
lea eax, [ebp - 0x3c]
cmp ebx, 0x10
cmovae eax, edi
movsx eax, byte [eax + ecx]
inc ecx
xor esi, eax
cmp ecx, edx
jb 0x10021060
mov edx, dword [0x10070b78]
mov ecx, dword [0x10070b70]
lea eax, [edx + 1]
cmp ecx, eax
ja 0x1002109f
push ecx
call fcn.10021a50
mov edx, dword [0x10070b78]
mov ecx, dword [0x10070b70]
dec ecx
mov eax, ecx
and eax, dword [0x10070b74]
mov dword [0x10070b74], eax
add eax, edx
and ecx, eax
lea eax, [ecx*4]
mov ecx, dword [0x10070b6c]
mov dword [ebp - 0x14], eax
cmp dword [eax + ecx], 0
jne 0x100210e5
push 0xc
call fcn.10041382
mov ecx, dword [0x10070b6c]
add esp, 4
mov edx, dword [ebp - 0x14]
mov dword [edx + ecx], eax
mov eax, edx
mov ecx, dword [0x10070b6c]
mov eax, dword [eax + ecx]
mov ecx, dword [ebp + 8]
mov dword [eax], ecx
mov ecx, dword [ebp - 0x24]
mov dword [eax + 4], esi
mov dword [eax + 8], ecx
inc dword [0x10070b78]
mov dword [ebp - 4], 0xffffffff
cmp ebx, 0x10
jb 0x1002112f
lea ecx, [ebx + 1]
mov eax, edi
cmp ecx, 0x1000
jb 0x10021125
mov edi, dword [eax - 4]
add ecx, 0x23
sub eax, edi
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x1002114e
push ecx
push edi
call fcn.1004136f
add esp, 8
mov eax, dword [ebp - 0x18]
mov edx, dword [ebp - 0x20]
inc eax
mov ecx, dword [ebp - 0x1c]
add ecx, 0x3c
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x1c], ecx
cmp eax, dword [edx + 4]
jge 0x10021154
mov eax, edx
jmp 0x1002100c
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x1002aaa0
Capabilities:
Hash data using fnv

Disassembly:
sub esp, 8
mov eax, 0x1fffffff
bsr ecx, eax
push ebx
push ebp
push esi
push edi
mov edi, 1
mov eax, edi
shl eax, cl
mov ecx, dword [esp + 0x1c]
cmp ecx, eax
jbe 0x1002aacb
push str.invalid_hash_bucket_count
call dword [sym.imp.MSVCP140.dll_void___cdecl_std::_Xlength_error_char_const__]
lea eax, [ecx - 1]
mov esi, dword [0x1006fb1c]
or eax, 1
bsr ecx, eax
push esi
lea ecx, [ecx + 1]
shl edi, cl
mov ecx, 0x1006fb24
lea eax, [edi + edi]
push eax
call fcn.10004b60
mov eax, dword [0x1006fb1c]
lea ebx, [edi - 1]
mov dword [0x1006fb30], ebx
mov dword [0x1006fb34], edi
mov eax, dword [eax]
mov ecx, eax
cmp eax, esi
je 0x1002abfa
nop
movzx edx, byte [eax + 8]
xor edx, 0x811c9dc5
mov ecx, dword [ecx]
imul edi, edx, 0x1000193
movzx edx, byte [eax + 9]
xor edi, edx
movzx edx, byte [eax + 0xa]
imul edi, edi, 0x1000193
xor edi, edx
movzx edx, byte [eax + 0xb]
imul edi, edi, 0x1000193
xor edi, edx
mov edx, dword [0x1006fb24]
imul edi, edi, 0x1000193
and edi, ebx
mov ebx, dword [edx + edi*8]
lea ebp, [edx + edi*8]
mov dword [esp + 0x10], ebp
cmp ebx, esi
jne 0x1002ab64
mov dword [ebp], eax
mov dword [ebp + 4], eax
jmp 0x1002abcd
mov edx, dword [ebp + 4]
mov edi, dword [eax + 8]
cmp edi, dword [edx + 8]
jne 0x1002ab9e
mov edx, dword [edx]
mov dword [esp + 0x14], edx
cmp edx, eax
je 0x1002ab99
mov ebx, dword [eax + 4]
mov ebp, dword [esp + 0x14]
mov dword [ebx], ecx
mov edi, dword [ecx + 4]
mov dword [edi], edx
mov edx, dword [edx + 4]
mov dword [edx], eax
mov dword [ebp + 4], edi
mov ebp, dword [esp + 0x10]
mov dword [ecx + 4], ebx
mov dword [eax + 4], edx
mov dword [ebp + 4], eax
jmp 0x1002abcd
cmp ebx, edx
je 0x1002abae
mov edx, dword [edx + 4]
cmp edi, dword [edx + 8]
je 0x1002abde
cmp ebx, edx
jne 0x1002aba2
mov ebp, dword [eax + 4]
mov dword [ebp], ecx
mov ebx, dword [ecx + 4]
mov dword [ebx], edx
mov edi, dword [edx + 4]
mov dword [edi], eax
mov dword [edx + 4], ebx
mov edx, dword [esp + 0x10]
mov dword [ecx + 4], ebp
mov dword [eax + 4], edi
mov dword [edx], eax
mov eax, ecx
cmp ecx, esi
je 0x1002abfa
mov ebx, dword [0x1006fb30]
jmp 0x1002ab10
mov ebx, dword [eax + 4]
mov ebp, dword [edx]
mov dword [ebx], ecx
mov edi, dword [ecx + 4]
mov dword [edi], ebp
mov edx, dword [ebp + 4]
mov dword [edx], eax
mov dword [ebp + 4], edi
mov dword [ecx + 4], ebx
mov dword [eax + 4], edx
jmp 0x1002abcd
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret 4
Function at 0x1002d8d0
Capabilities:
Access peb ldr_data
Get number of processors

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10044acd
mov eax, dword fs:[0]
push eax
push ebx
sub esp, 0x28
push esi
push edi
mov eax, dword [0x1006f368]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x14], ecx
mov eax, dword [ebx + 8]
mov dword [ebp - 4], 0
mov dword [ebp - 0x20], eax
movups xmm0, xmmword [ebx + 0x10]
mov dword [ebp - 0x1c], 0
push 0x64
movups xmmword [ebp - 0x38], xmm0
mov dword [ebp - 0x18], eax
xorps xmm0, xmm0
movq qword [eax], xmm0
call fcn.10041382
mov edi, eax
mov dword [ebp - 0x24], edi
mov dword [ebp - 4], 1
lea esi, [edi + 0xc]
xorps xmm0, xmm0
sub esp, 0xc
movq qword [edi], xmm0
mov eax, esp
movups xmm0, xmmword [ebp - 0x38]
mov dword [edi + 8], 0
mov ecx, esi
push dword [ebx + 0xc]
mov dword [edi + 4], 1
mov dword [edi + 8], 1
mov dword [edi], vtable.std::_Ref_count_obj2_class_c_groupbox_.0
movups xmmword [eax], xmm0
call fcn.10016d50
mov eax, dword [ebp - 0x18]
xorps xmm0, xmm0
movq qword [eax], xmm0
mov dword [eax + 4], 0
mov dword [eax], esi
mov dword [eax + 4], edi
mov esi, dword [ebp - 0x14]
mov dword [ebp - 4], 0
mov dword [ebp - 0x1c], 3
mov eax, dword [esi + 0x30]
mov ecx, dword [esi + 0x34]
add eax, ecx
test al, 1
jne 0x1002d9c8
lea eax, [ecx + 2]
shr eax, 1
cmp dword [esi + 0x2c], eax
ja 0x1002d9c8
push ecx
lea ecx, [esi + 0x24]
call fcn.10003290
mov ecx, dword [esi + 0x2c]
lea eax, [ecx*2 - 1]
dec ecx
and dword [esi + 0x30], eax
mov edi, dword [esi + 0x34]
add edi, dword [esi + 0x30]
mov eax, edi
shr eax, 1
and ecx, eax
mov eax, dword [esi + 0x28]
shl ecx, 2
mov dword [ebp - 0x14], ecx
cmp dword [ecx + eax], 0
jne 0x1002da08
push 0x10
call fcn.10041382
mov edx, dword [ebp - 0x14]
mov ecx, eax
mov eax, dword [esi + 0x28]
add esp, 4
mov dword [edx + eax], ecx
mov ecx, edx
mov eax, dword [esi + 0x28]
and edi, 1
mov eax, dword [ecx + eax]
mov dword [eax + edi*8], 0
mov dword [eax + edi*8 + 4], 0
lea edx, [eax + edi*8]
mov eax, dword [ebp - 0x18]
mov ecx, dword [eax + 4]
test ecx, ecx
je 0x1002da31
lock inc dword [ecx + 4]
mov ecx, dword [eax]
mov dword [edx], ecx
mov ecx, dword [eax + 4]
mov dword [edx + 4], ecx
inc dword [esi + 0x34]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret 0x18
Function at 0x1003d650
Capabilities:
Encode data using xor

Disassembly:
push esi
push edi
mov edi, ecx
xor eax, eax
xor edx, edx
mov esi, dword [edi + 0x10]
test esi, esi
je 0x1003d6a1
cmp dword [edi + 0x14], 0x10
jb 0x1003d684
mov edi, dword [edi]
nop word [eax + eax]
movsx ecx, byte [edi + edx]
inc edx
imul eax, eax, 0x811c9dc5
xor eax, ecx
cmp edx, esi
jb 0x1003d670
pop edi
pop esi
ret
xor edx, edx
nop word [eax + eax]
movsx ecx, byte [edx + edi]
inc edx
imul eax, eax, 0x811c9dc5
xor eax, ecx
cmp edx, esi
jb 0x1003d690
pop edi
pop esi
ret