joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100c6fb0
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [0x10117880]
push ebx
push esi
push edi
mov eax, dword [eax + 0xa8]
mov dword [ebp - 4], edx
mov dword [ebp - 8], ecx
cmp byte [eax], 0
jne 0x100c704f
mov eax, dword [ebp + 0x10]
mov eax, dword [eax + 0x48]
test eax, eax
je 0x100c704f
mov eax, dword [eax + 0x40]
test eax, eax
je 0x100c704f
lea ebx, [eax + 0x38]
mov edx, 0x811c9dc5
mov ecx, ebx
xor esi, esi
lea edi, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x100c6ff3
sub ecx, edi
je 0x100c704f
nop
movsx eax, byte [esi + ebx]
xor eax, edx
imul edx, eax, 0x1000193
mov eax, ebx
inc esi
lea edi, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x100c7012
sub eax, edi
cmp esi, eax
jb 0x100c7000
cmp edx, 0xf1dac051
je 0x100c706d
cmp edx, 0xba191d04
je 0x100c706d
cmp edx, 0x70f10fa6
je 0x100c706d
cmp edx, 0x5d34131
je 0x100c706d
cmp edx, 0x6f36f8cd
je 0x100c706d
cmp edx, 0xffdba2c0
je 0x100c706d
push dword [ebp + 0x1c]
mov edx, dword [ebp - 4]
push dword [ebp + 0x18]
mov ecx, dword [ebp - 8]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.ateris.dll_void____fastcall___void___void___void___void___struct_SpriteRenderInfo_t___int__void___class_Vector___RenderSpriteCard::OriginalFunction]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x18
Function at 0x100d1760
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x64
mov eax, dword [0x10112040]
xor eax, esp
mov dword [esp + 0x60], eax
push esi
push 0x40
lea eax, [esp + 0x24]
mov esi, ecx
push 0
push eax
call sub.VCRUNTIME140.dll_memset
mov eax, 0x20
mov dword [esp + 0x14], 0x67452301
mov dword [esp + 0x24], eax
lea ecx, [esp + 0x2c]
shr eax, 3
mov edx, 0x3f
and eax, 0x3f
mov dword [esp + 0x18], 0xefcdab89
add ecx, eax
mov dword [esp + 0x1c], 0x98badcfe
mov dword [esp + 0x20], 0x10325476
sub edx, eax
mov dword [esp + 0x28], 0
add esp, 0xc
mov dword [esp + 0x20], esi
mov byte [ecx], 0x80
inc ecx
cmp edx, 8
jae 0x100d1802
push edx
push 0
push ecx
call sub.VCRUNTIME140.dll_memset
lea edx, [esp + 0x2c]
lea ecx, [esp + 0x14]
call fcn.100d10e0
push 0x38
lea eax, [esp + 0x30]
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0x18
jmp 0x100d1811
lea eax, [edx - 8]
push eax
push 0
push ecx
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
mov eax, dword [esp + 0x18]
lea edx, [esp + 0x20]
mov dword [esp + 0x58], eax
lea ecx, [esp + 8]
mov eax, dword [esp + 0x1c]
mov dword [esp + 0x5c], eax
call fcn.100d10e0
mov ecx, dword [esp + 0x64]
mov eax, dword [esp + 0xe]
pop esi
xor ecx, esp
call fcn.100e1a4b
mov esp, ebp
pop ebp
ret
Function at 0x100d7960
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100eef75
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push ebx
push esi
push edi
mov eax, dword [0x10112040]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
movzx eax, byte [esi]
xor eax, 0x811c9dc5
imul ecx, eax, 0x1000193
movzx eax, byte [esi + 1]
xor ecx, eax
movzx eax, byte [esi + 2]
imul ecx, ecx, 0x1000193
xor ecx, eax
movzx eax, byte [esi + 3]
imul ecx, ecx, 0x1000193
xor ecx, eax
lea eax, [ebp - 0x14]
imul edi, ecx, 0x1000193
push edi
push esi
push eax
call fcn.100d7eb0
mov eax, dword [ebp - 0x10]
test eax, eax
jne 0x100d7ac1
cmp dword [0x10114e18], 0xfffffff
jne 0x100d79ea
push str.unordered_map_set_too_long
call dword [sym.imp.MSVCP140.dll_void___cdecl_std::_Xlength_error_char_const__]
mov dword [ebp - 0x1c], 0x10114e14
mov dword [ebp - 4], 0
push 0x10
mov dword [ebp - 0x18], 0
call fcn.100e1a59
mov ebx, eax
add esp, 4
mov eax, dword [esi]
mov dword [ebp - 0x18], ebx
mov dword [ebx + 8], eax
mov dword [ebx + 0xc], 0
mov dword [ebp - 4], 1
mov eax, dword [0x10114e18]
mov esi, dword [0x10114e2c]
inc eax
vmovss xmm1, dword [0x10114e10]
vxorps xmm0, xmm0, xmm0
vcvtsi2sd xmm0, xmm0, eax
shr eax, 0x1f
vaddsd xmm0, xmm0, qword [eax*8 + 0x10100f50]
vcvtsd2ss xmm2, xmm0, xmm0
vxorps xmm0, xmm0, xmm0
mov eax, esi
shr eax, 0x1f
vcvtsi2sd xmm0, xmm0, esi
vaddsd xmm0, xmm0, qword [eax*8 + 0x10100f50]
vcvtsd2ss xmm0, xmm0, xmm0
vdivss xmm0, xmm2, xmm0
vcomiss xmm0, xmm1
jbe 0x100d7ab6
vdivss xmm0, xmm2, xmm1
call fcn.10025300
call fcn.100e2db0
mov ecx, 8
cmp eax, ecx
cmova ecx, eax
cmp esi, ecx
jae 0x100d7a9e
cmp esi, 0x200
jae 0x100d7a9c
shl esi, 3
cmp esi, ecx
jae 0x100d7a9e
mov esi, ecx
push esi
call fcn.100d7d30
push edi
lea eax, [ebx + 8]
push eax
lea eax, [ebp - 0x1c]
push eax
call fcn.100d7eb0
mov ecx, dword [eax]
jmp 0x100d7ab9
mov ecx, dword [ebp - 0x14]
push ebx
push ecx
push edi
call fcn.100d7cc0
add eax, 0xc
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x100d7ae0
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100eefb5
mov eax, dword fs:[0]
push eax
sub esp, 0x18
push ebx
push esi
push edi
mov eax, dword [0x10112040]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
movzx eax, byte [esi]
xor eax, 0x811c9dc5
imul ecx, eax, 0x1000193
movzx eax, byte [esi + 1]
xor ecx, eax
movzx eax, byte [esi + 2]
imul ecx, ecx, 0x1000193
xor ecx, eax
movzx eax, byte [esi + 3]
imul ecx, ecx, 0x1000193
xor ecx, eax
lea eax, [ebp - 0x18]
imul edi, ecx, 0x1000193
push edi
push esi
push eax
call fcn.100d7eb0
mov eax, dword [ebp - 0x14]
test eax, eax
jne 0x100d7c41
cmp dword [0x10114e18], 0xfffffff
jne 0x100d7b6a
push str.unordered_map_set_too_long
call dword [sym.imp.MSVCP140.dll_void___cdecl_std::_Xlength_error_char_const__]
mov dword [ebp - 0x20], 0x10114e14
mov dword [ebp - 4], 0
push 0x10
mov dword [ebp - 0x1c], 0
call fcn.100e1a59
mov ebx, eax
add esp, 4
mov eax, dword [esi]
mov dword [ebp - 0x1c], ebx
mov dword [ebx + 8], eax
mov dword [ebx + 0xc], 0
mov dword [ebp - 4], 1
mov eax, dword [0x10114e18]
mov esi, dword [0x10114e2c]
inc eax
vmovss xmm1, dword [0x10114e10]
vxorps xmm0, xmm0, xmm0
vcvtsi2sd xmm0, xmm0, eax
shr eax, 0x1f
vaddsd xmm0, xmm0, qword [eax*8 + 0x10100f50]
vcvtsd2ss xmm2, xmm0, xmm0
vxorps xmm0, xmm0, xmm0
mov eax, esi
shr eax, 0x1f
vcvtsi2sd xmm0, xmm0, esi
vaddsd xmm0, xmm0, qword [eax*8 + 0x10100f50]
vcvtsd2ss xmm0, xmm0, xmm0
vdivss xmm0, xmm2, xmm0
vcomiss xmm0, xmm1
jbe 0x100d7c36
vdivss xmm0, xmm2, xmm1
call fcn.10025300
call fcn.100e2db0
mov ecx, 8
cmp eax, ecx
cmova ecx, eax
cmp esi, ecx
jae 0x100d7c1e
cmp esi, 0x200
jae 0x100d7c1c
shl esi, 3
cmp esi, ecx
jae 0x100d7c1e
mov esi, ecx
push esi
call fcn.100d7d30
push edi
lea eax, [ebx + 8]
push eax
lea eax, [ebp - 0x20]
push eax
call fcn.100d7eb0
mov ecx, dword [eax]
jmp 0x100d7c39
mov ecx, dword [ebp - 0x18]
push ebx
push ecx
push edi
call fcn.100d7cc0
add eax, 0xc
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x100d8870
Capabilities:
Enumerate threads
Suspend thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x10112040]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, ecx
mov dword [ebp - 0x24], edx
push edi
push 0
push 4
mov dword [esi], 0
mov dword [esi + 4], 0
mov dword [esi + 8], 0
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov edi, eax
cmp edi, 0xffffffff
je 0x100d896a
lea eax, [ebp - 0x20]
mov dword [ebp - 0x20], 0x1c
push eax
push edi
call dword [sym.imp.KERNEL32.dll_Thread32First]
test eax, eax
je 0x100d8963
mov ebx, dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
cmp dword [ebp - 0x20], 0x10
jb 0x100d8949
call ebx
cmp dword [ebp - 0x14], eax
jne 0x100d8949
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp dword [ebp - 0x18], eax
je 0x100d8949
mov edx, dword [esi]
test edx, edx
jne 0x100d8912
push 0x200
push edx
push dword [0x101174fc]
mov dword [esi + 4], 0x80
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov edx, eax
mov dword [esi], edx
test edx, edx
je 0x100d8963
jmp 0x100d893d
mov eax, dword [esi + 4]
cmp dword [esi + 8], eax
jb 0x100d893d
shl eax, 3
push eax
push edx
push 0
push dword [0x101174fc]
call dword [sym.imp.KERNEL32.dll_HeapReAlloc]
mov edx, eax
test edx, edx
je 0x100d8963
mov eax, dword [esi + 4]
add eax, eax
mov dword [esi], edx
mov dword [esi + 4], eax
mov ecx, dword [esi + 8]
mov eax, dword [ebp - 0x18]
mov dword [edx + ecx*4], eax
inc dword [esi + 8]
lea eax, [ebp - 0x20]
mov dword [ebp - 0x20], 0x1c
push eax
push edi
call dword [sym.imp.KERNEL32.dll_Thread32Next]
test eax, eax
jne 0x100d88d1
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [esi], 0
je 0x100d89af
xor edi, edi
cmp dword [esi + 8], edi
jbe 0x100d89af
mov eax, dword [esi]
push dword [eax + edi*4]
push 0
push 0x5a
call dword [sym.imp.KERNEL32.dll_OpenThread]
mov ebx, eax
test ebx, ebx
je 0x100d89a9
push ebx
call dword [sym.imp.KERNEL32.dll_SuspendThread]
push dword [ebp + 8]
mov edx, dword [ebp - 0x24]
mov ecx, ebx
call fcn.100d8700
add esp, 4
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
inc edi
cmp edi, dword [esi + 8]
jb 0x100d8976
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.100e1a4b
mov esp, ebp
pop ebp
ret

Function at 0x100d89c0
Capabilities:
Resume thread

Disassembly:
push ebx
mov ebx, ecx
cmp dword [ebx], 0
je 0x100d8a0c
push esi
xor esi, esi
cmp dword [ebx + 8], esi
jbe 0x100d89fb
push edi
mov eax, dword [ebx]
push dword [eax + esi*4]
push 0
push 0x5a
call dword [sym.imp.KERNEL32.dll_OpenThread]
mov edi, eax
test edi, edi
je 0x100d89f4
push edi
call dword [sym.imp.KERNEL32.dll_ResumeThread]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
inc esi
cmp esi, dword [ebx + 8]
jb 0x100d89d1
pop edi
push dword [ebx]
push 0
push dword [0x101174fc]
call dword [sym.imp.KERNEL32.dll_HeapFree]
pop esi
pop ebx
ret
Function at 0x100d8a10
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [0x10112040]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
imul esi, ecx, 0x2c
mov ebx, edx
push edi
add esi, dword [0x101187f0]
mov eax, dword [esi]
mov cl, byte [esi + 0x14]
and cl, 1
lea edi, [eax - 5]
cmove edi, eax
movzx eax, cl
lea ecx, [ebp - 8]
push ecx
push 0x40
lea eax, [eax*2 + 5]
push eax
push edi
mov dword [ebp - 0xc], eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x100d8a71
pop edi
pop esi
mov eax, 0xa
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100e1a4b
mov esp, ebp
pop ebp
ret
test ebx, ebx
je 0x100d8a92
mov byte [edi], 0xe9
mov eax, dword [esi + 4]
sub eax, edi
sub eax, 5
mov dword [edi + 1], eax
test byte [esi + 0x14], 1
je 0x100d8ab3
mov eax, dword [esi]
mov word [eax], 0xf9eb
jmp 0x100d8ab3
mov eax, dword [esi + 0xc]
test byte [esi + 0x14], 1
mov dword [edi], eax
je 0x100d8aad
mov ax, word [esi + 0x10]
mov word [edi + 4], ax
mov al, byte [esi + 0x12]
mov byte [edi + 6], al
jmp 0x100d8ab3
mov al, byte [esi + 0x10]
mov byte [edi + 4], al
lea eax, [ebp - 8]
push eax
push dword [ebp - 8]
push dword [ebp - 0xc]
push edi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
push dword [ebp - 0xc]
push edi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_FlushInstructionCache]
mov cl, bl
xor eax, eax
add cl, cl
shl bl, 2
xor cl, byte [esi + 0x14]
and cl, 2
xor cl, byte [esi + 0x14]
xor bl, cl
and bl, 4
xor bl, cl
mov ecx, dword [ebp - 4]
pop edi
mov byte [esi + 0x14], bl
xor ecx, ebp
pop esi
pop ebx
call fcn.100e1a4b
mov esp, ebp
pop ebp
ret
Function at 0x100d8b10
Capabilities:
Resume thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov edx, dword [0x101187f8]
push ebx
push esi
push edi
xor edi, edi
xor esi, esi
mov dword [ebp - 4], edi
mov ebx, ecx
test edx, edx
je 0x100d8c01
mov eax, dword [0x101187f0]
add eax, 0x14
movzx ecx, byte [eax]
shr ecx, 1
and ecx, 1
cmp ecx, ebx
jne 0x100d8b55
inc esi
add eax, 0x2c
cmp esi, edx
jb 0x100d8b38
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
cmp esi, 0xffffffff
je 0x100d8c01
xor eax, eax
lea ecx, [ebp - 0x10]
test ebx, ebx
setne al
or edx, 0xffffffff
push eax
call fcn.100d8870
mov ecx, dword [0x101187f8]
add esp, 4
cmp esi, ecx
jae 0x100d8bb5
imul edi, esi, 0x2c
mov eax, dword [0x101187f0]
movzx eax, byte [edi + eax + 0x14]
shr eax, 1
and eax, 1
cmp eax, ebx
je 0x100d8baa
mov edx, ebx
mov ecx, esi
call fcn.100d8a10
mov dword [ebp - 4], eax
test eax, eax
jne 0x100d8bb2
mov ecx, dword [0x101187f8]
inc esi
add edi, 0x2c
cmp esi, ecx
jb 0x100d8b81
mov edi, dword [ebp - 4]
mov eax, dword [ebp - 0x10]
test eax, eax
je 0x100d8c01
xor esi, esi
cmp dword [ebp - 8], esi
jbe 0x100d8bf2
mov edi, eax
push dword [edi + esi*4]
push 0
push 0x5a
call dword [sym.imp.KERNEL32.dll_OpenThread]
mov ebx, eax
test ebx, ebx
je 0x100d8be6
push ebx
call dword [sym.imp.KERNEL32.dll_ResumeThread]
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
inc esi
cmp esi, dword [ebp - 8]
jb 0x100d8bc5
mov edi, dword [ebp - 4]
mov eax, dword [ebp - 0x10]
push eax
push 0
push dword [0x101174fc]
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x100dc7d0
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ecx + 4]
add ecx, 4
push ebx
push esi
push edi
mov eax, dword [eax + 0x24]
call eax
mov ecx, dword [0x10116054]
push eax
mov edx, dword [ecx]
mov edx, dword [edx + 0xc]
call edx
mov ebx, eax
mov edi, 0x811c9dc5
mov ecx, ebx
xor edx, edx
lea esi, [ecx + 1]
nop
mov al, byte [ecx]
inc ecx
test al, al
jne 0x100dc800
sub ecx, esi
je 0x100dc83f
nop dword [eax + eax]
movsx eax, byte [edx + ebx]
xor eax, edi
imul edi, eax, 0x1000193
mov eax, ebx
inc edx
lea esi, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x100dc822
sub eax, esi
cmp edx, eax
jb 0x100dc810
cmp edi, 0x959035c5
pop edi
pop esi
sete al
pop ebx
mov esp, ebp
pop ebp
ret
pop edi
pop esi
xor al, al
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x100e1973
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
push ecx
push 2
lea eax, [ebp - 4]
push eax
push 0x20000001
push str._x_sys_default_locale
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoEx]
xor ecx, ecx
test eax, eax
jne 0x100e199a
mov eax, ecx
mov dword [ebp - 4], eax
jmp 0x100e199d
mov eax, dword [ebp - 4]
push esi
mov esi, dword [ebp + 0xc]
push ecx
push ecx
push esi
push eax
push dword [ebp + 8]
push ecx
push 0x1300
call dword [sym.imp.KERNEL32.dll_FormatMessageA]
push eax
push dword [esi]
call fcn.100e194f
pop esi
leave
ret 8
Function at 0x100311f0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 0xc]
mov edx, 0x811c9dc5
push edi
mov edi, dword [ebp + 8]
mov ecx, 0
sub esi, edi
je 0x10031221
lfence
nop dword [eax]
movzx eax, byte [ecx + edi]
inc ecx
xor eax, edx
imul edx, eax, 0x1000193
cmp ecx, esi
jb 0x10031210
pop edi
mov eax, edx
pop esi
pop ebp
ret 8

Function at 0x1003bbb0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10169ffd
mov eax, dword fs:[0]
push eax
push ebx
sub esp, 0x10
push esi
push edi
mov eax, dword [0x1023d090]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x1c], ecx
call fcn.100eb0c0
mov dword [ebp - 0x14], eax
xor ecx, ecx
mov eax, dword [ebx + 8]
mov edx, 0x811c9dc5
mov esi, dword [eax + 4]
mov edi, dword [eax]
test esi, esi
je 0x1003bc21
nop dword [eax]
movzx eax, byte [edi + ecx]
inc ecx
xor eax, edx
imul edx, eax, 0x1000193
cmp ecx, esi
jb 0x1003bc10
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax + 0x18]
mov eax, dword [eax + 0xc]
and ecx, edx
mov esi, dword [eax + ecx*8 + 4]
lea edi, [eax + ecx*8]
mov eax, dword [ebp - 0x14]
mov eax, dword [eax + 4]
mov dword [ebp - 0x14], eax
cmp esi, eax
jne 0x1003bc44
xor esi, esi
jmp 0x1003bc74
mov edi, dword [edi]
lea eax, [esi + 8]
push eax
push dword [ebx + 8]
call fcn.100eb0c0
test al, al
jne 0x1003bc71
cmp esi, edi
je 0x1003bc6f
mov esi, dword [esi + 4]
lea eax, [esi + 8]
push eax
push dword [ebx + 8]
call fcn.100eb0c0
test al, al
je 0x1003bc56
jmp 0x1003bc71
xor esi, esi
mov eax, dword [ebp - 0x14]
test esi, esi
cmove esi, eax
cmp esi, eax
je 0x1003bd10
mov ecx, dword [ebp - 0x1c]
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0
mov eax, dword [ecx + 8]
test eax, eax
je 0x1003bc9d
lock inc dword [eax + 4]
mov eax, dword [ecx + 4]
mov dword [ebp - 0x18], eax
mov eax, dword [ecx + 8]
mov dword [ebp - 0x14], eax
mov dword [ebp - 4], 0
mov edi, dword [esi + 0x34]
test edi, edi
je 0x1003bd28
mov eax, dword [edi]
mov esi, dword [eax + 8]
lea eax, [ebp - 0x18]
push eax
mov ecx, esi
call dword [0x101851c8]
mov ecx, edi
call esi
mov edi, dword [ebp - 0x14]
mov dword [ebp - 0x1c], eax
test edi, edi
je 0x1003bd0b
or ecx, 0xffffffff
lock xadd dword [edi + 4], ecx
jne 0x1003bd0b
mov eax, dword [edi]
mov esi, dword [eax]
mov ecx, esi
call dword [0x101851c8]
mov ecx, edi
call esi
or eax, 0xffffffff
lock xadd dword [edi + 8], eax
jne 0x1003bd0b
mov eax, dword [edi]
mov esi, dword [eax + 4]
mov ecx, esi
call dword [0x101851c8]
mov ecx, edi
call esi
mov eax, dword [ebp - 0x1c]
jmp 0x1003bd12
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret 4
call fcn.100eb0c0
int3
Function at 0x10064630
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [0x1023d090]
xor eax, ebp
mov dword [ebp - 4], eax
push edi
mov edi, ecx
mov dword [ebp - 8], 0
mov ecx, dword [edi + 0x1c]
test ecx, ecx
je 0x1006468e
push 0
lea eax, [ebp - 8]
push eax
push 0x4000
lea eax, [edi + 0x20]
push eax
push ecx
call dword [sym.imp.kernel32.dll_ReadFile]
test eax, eax
jne 0x1006467c
xor eax, eax
pop edi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10138f44
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 8]
pop edi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10138f44
mov esp, ebp
pop ebp
ret
mov ecx, dword [edi + 0x4024]
test ecx, ecx
je 0x1006466b
mov edx, dword [edi + 0x402c]
mov eax, dword [edi + 0x4028]
cmp edx, eax
jae 0x1006466b
push esi
sub eax, edx
mov esi, 0x4000
cmp eax, esi
cmovb esi, eax
mov dword [ebp - 8], esi
test esi, esi
je 0x1006475d
lea eax, [edi + 0x20]
push ebx
lea ebx, [edx + ecx]
test eax, eax
jne 0x100646ee
call fcn.10149915
mov dword [eax], 0x16
call fcn.10144b0f
pop ebx
pop esi
xor eax, eax
pop edi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10138f44
mov esp, ebp
pop ebp
ret
test ebx, ebx
je 0x1006471e
cmp esi, 0x4000
ja 0x1006471e
push esi
push ebx
push eax
call fcn.1013ae70
add esp, 0xc
mov eax, esi
add dword [edi + 0x402c], esi
pop ebx
pop esi
pop edi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10138f44
mov esp, ebp
pop ebp
ret
push 0x4000
push 0
push eax
call fcn.1013cbe0
add esp, 0xc
test ebx, ebx
je 0x100646cb
cmp esi, 0x4000
jbe 0x1006474a
call fcn.10149915
mov dword [eax], 0x22
call fcn.10144b0f
pop ebx
pop esi
xor eax, eax
pop edi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10138f44
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
mov eax, esi
pop esi
xor ecx, ebp
pop edi
call fcn.10138f44
mov esp, ebp
pop ebp
ret

Function at 0x10064960
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
add ecx, 8
pop ebp
jmp fcn.10063890
Function at 0x1007ced0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1016dd05
mov eax, dword fs:[0]
push eax
push ebx
sub esp, 0x18
push esi
push edi
mov eax, dword [0x1023d090]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edx, dword [ebx + 0xc]
mov edi, dword [ebx + 8]
mov dword [ebp - 0x20], edi
mov dword [ebp - 0x14], edx
cmp dword [edx + 0x14], 0x10
mov dword [ebp - 0x18], edx
jb 0x1007cf25
mov eax, dword [edx]
mov dword [ebp - 0x18], eax
xor ecx, ecx
mov esi, 0x811c9dc5
cmp dword [edx + 0x10], ecx
jbe 0x1007cf49
mov edi, dword [ebp - 0x18]
movzx eax, byte [ecx + edi]
inc ecx
xor eax, esi
imul esi, eax, 0x1000193
cmp ecx, dword [edx + 0x10]
jb 0x1007cf34
mov edi, dword [ebp - 0x20]
push esi
push edx
lea eax, [ebp - 0x1c]
mov ecx, 0x10250190
push eax
call fcn.100eb0c0
mov eax, dword [ebp - 0x18]
test eax, eax
je 0x1007cf6d
mov dword [edi], eax
mov eax, edi
mov byte [edi + 4], 0
jmp 0x1007d0bb
cmp dword [0x10250198], 0x71c71c7
je 0x1007d0d1
mov dword [ebp - 0x28], 0x10250194
mov dword [ebp - 4], 0
mov dword [ebp - 0x24], 0
push 0x24
lfence
call fcn.100eb0c0
add esp, 4
mov edi, eax
mov dword [ebp - 0x24], edi
push dword [ebp - 0x14]
lea ecx, [edi + 8]
call fcn.100eb0c0
mov byte [edi + 0x20], 0
mov dword [ebp - 4], 1
mov ecx, dword [0x10250198]
lea eax, [ecx + 1]
movd xmm0, eax
cvtdq2pd xmm0, xmm0
shr eax, 0x1f
addsd xmm0, qword [eax*8 + 0x10222200]
mov eax, dword [0x102501ac]
movd xmm1, eax
cvtdq2pd xmm1, xmm1
shr eax, 0x1f
cvtpd2ps xmm0, xmm0
addsd xmm1, qword [eax*8 + 0x10222200]
movaps xmm2, xmm0
cvtpd2ps xmm1, xmm1
divss xmm2, xmm1
movss xmm1, dword [0x10250190]
comiss xmm2, xmm1
jbe 0x1007d065
divss xmm0, xmm1
call fcn.100eb0c0
call fcn.10165340
mov ecx, 8
cmp eax, ecx
cmova ecx, eax
mov eax, dword [0x102501ac]
cmp eax, ecx
jae 0x1007d03d
cmp eax, 0x200
jae 0x1007d03b
shl eax, 3
cmp eax, ecx
jae 0x1007d03d
mov eax, ecx
push eax
mov ecx, 0x10250190
call fcn.100eb0c0
push esi
lea eax, [edi + 8]
mov ecx, 0x10250190
push eax
lea eax, [ebp - 0x28]
push eax
call fcn.100eb0c0
mov ecx, dword [0x10250198]
mov edx, dword [eax]
jmp 0x1007d068
mov edx, dword [ebp - 0x1c]
mov eax, dword [edx + 4]
inc ecx
mov dword [0x10250198], ecx
mov dword [edi + 4], eax
mov dword [edi], edx
mov dword [eax], edi
mov dword [edx + 4], edi
mov ecx, dword [0x1025019c]
mov dword [ebp - 0x14], eax
mov eax, dword [0x102501a8]
and eax, esi
mov esi, dword [ecx + eax*8]
cmp esi, dword [0x10250194]
jne 0x1007d09c
mov dword [ecx + eax*8], edi
jmp 0x1007d0ae
cmp esi, edx
jne 0x1007d0a5
mov dword [ecx + eax*8], edi
jmp 0x1007d0b2
mov edx, dword [ebp - 0x14]
cmp dword [ecx + eax*8 + 4], edx
jne 0x1007d0b2
mov dword [ecx + eax*8 + 4], edi
mov eax, dword [ebp - 0x20]
mov dword [eax], edi
mov byte [eax + 4], 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret 8
push str.unordered_map_set_too_long
call fcn.100eb0c0
int3