joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1002bbb0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x100f0380]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, ecx
cmp dword [esi + 0x38], 0
je 0x1002bc6c
cmp byte [esi + 0x3d], 0
je 0x1002bc6c
mov eax, dword [esi]
push edi
push 0xffffffffffffffff
call dword [eax + 0xc]
cmp eax, 0xffffffff
je 0x1002bc5a
mov ecx, dword [esi + 0x38]
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [esi + 0x40]
push eax
call dword [sym.imp.MSVCP140D.dll_public:_int___thiscall_std::codecvt_char__char__struct__Mbstatet_::unshift_struct__Mbstatet___char___char___char___const]
sub eax, 0
je 0x1002bc21
sub eax, 1
je 0x1002bc25
sub eax, 2
jne 0x1002bc5a
mov byte [esi + 0x3d], al
mov al, 1
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100c8320
mov esp, ebp
pop ebp
ret
mov byte [esi + 0x3d], 0
mov edi, dword [ebp - 0x28]
lea eax, [ebp - 0x24]
sub edi, eax
je 0x1002bc43
push dword [esi + 0x4c]
push edi
push 1
push eax
call dword [sym.imp.ucrtbased.dll_fwrite]
add esp, 0x10
cmp edi, eax
jne 0x1002bc5a
cmp byte [esi + 0x3d], 0
pop edi
sete al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100c8320
mov esp, ebp
pop ebp
ret
pop edi
xor al, al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100c8320
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
mov al, 1
xor ecx, ebp
pop esi
call fcn.100c8320
mov esp, ebp
pop ebp
ret
Function at 0x1002d780
Capabilities:
Access peb ldr_data

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100cba9c
mov eax, dword fs:[0]
push eax
push ebx
sub esp, 0x20
mov eax, dword [0x100f0380]
xor eax, ebp
mov dword [ebp - 0x14], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x1c], edi
mov dword [ebp - 0x20], edi
mov dword [ebp - 0x24], edi
mov dword [ebp - 4], 0
xorps xmm0, xmm0
mov dword [edi], 0
movups xmmword [edi + 4], xmm0
push 8
mov dword [edi + 0x14], 0
mov dword [edi + 0x18], 0
call fcn.100c8350
add esp, 4
mov dword [eax + 4], 0
mov dword [edi], eax
mov dword [eax], edi
mov dword [edi + 0x14], 0
mov dword [edi + 0x18], 0xf
mov byte [edi + 4], 0
mov dword [ebp - 4], 1
lea esi, [edi + 0x4c]
mov dword [edi + 0x24], 0
mov dword [edi + 0x20], 0
mov dword [edi + 0x2c], 0
mov dword [edi + 0x28], 0
mov dword [edi + 0x34], 0
mov dword [edi + 0x30], 0
mov dword [edi + 0x3c], 0
mov dword [edi + 0x38], 0
mov dword [edi + 0x44], 0
mov dword [edi + 0x40], 0
mov byte [ebp - 4], 2
push 8
mov dword [esi], 0
mov dword [esi + 4], 0
mov dword [esi + 8], 0
mov dword [esi + 0xc], 0
call fcn.100c8350
add esp, 4
mov dword [eax + 4], 0
mov dword [esi], eax
mov dword [eax], esi
lea esi, [edi + 0x5c]
mov byte [ebp - 4], 4
push 8
mov dword [esi], 0
mov dword [esi + 4], 0
mov dword [esi + 8], 0
mov dword [esi + 0xc], 0
call fcn.100c8350
add esp, 4
mov dword [eax + 4], 0
mov dword [esi], eax
mov dword [eax], esi
lea esi, [edi + 0x6c]
mov byte [ebp - 4], 6
xorps xmm0, xmm0
mov dword [esi], 0
movups xmmword [esi + 4], xmm0
push 8
mov dword [esi + 0x14], 0
mov dword [esi + 0x18], 0
call fcn.100c8350
add esp, 4
mov dword [eax + 4], 0
mov dword [esi], eax
mov dword [eax], esi
mov dword [esi + 0x14], 0
mov dword [esi + 0x18], 0xf
mov byte [esi + 4], 0
add edi, 0x90
mov byte [ebp - 4], 7
mov dword [ebp - 0x20], edi
lea esi, [edi + 4]
mov dword [edi], 0
mov dword [esi], 0
lea eax, [ebp - 0x15]
mov dword [esi + 4], 0
push 8
mov dword [esi + 8], 0
mov dword [ebp - 0x28], eax
call fcn.100c8350
add esp, 4
mov dword [ebp - 0x2c], eax
mov dword [eax], esi
mov dword [eax + 4], 0
mov dword [esi], eax
push 0x10
mov byte [ebp - 4], 8
call fcn.100c8350
add esp, 4
mov dword [eax], eax
mov dword [eax + 4], eax
mov dword [esi + 4], eax
lea esi, [edi + 0x10]
mov byte [ebp - 4], 0xa
push 8
mov dword [esi], 0
mov dword [esi + 4], 0
mov dword [esi + 8], 0
mov dword [esi + 0xc], 0
call fcn.100c8350
add esp, 4
mov dword [eax + 4], 0
mov dword [esi], eax
mov dword [eax], esi
mov byte [ebp - 4], 0xb
mov ecx, esi
mov dword [edi + 0x20], 7
mov dword [edi + 0x24], 8
mov dword [edi], 0x3f800000
push dword [edi + 8]
push 0x10
call fcn.10036380
mov eax, dword [ebp - 0x1c]
mov dword [eax + 0xb8], 3
mov dword [eax + 0xbc], 0xa
mov dword [eax + 0xc0], 0
mov dword [eax + 0xc4], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.100c8320
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret
Function at 0x10037950
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
mov ebx, ecx
mov eax, 0x1fffffff
bsr ecx, eax
push esi
push edi
mov edi, 1
mov dword [ebp - 8], ebx
mov eax, edi
shl eax, cl
mov ecx, dword [ebp + 8]
cmp ecx, eax
jbe 0x10037981
push str.invalid_hash_bucket_count
call dword [sym.imp.MSVCP140D.dll_void___cdecl_std::_Xlength_error_char_const__]
lea eax, [ecx - 1]
mov esi, dword [ebx + 8]
or eax, 1
mov dword [ebp - 0xc], esi
bsr ecx, eax
push esi
lea ecx, [ecx + 1]
shl edi, cl
lea ecx, [ebx + 0x10]
lea eax, [edi + edi]
push eax
call fcn.10036380
lea eax, [edi - 1]
mov dword [ebx + 0x24], edi
mov dword [ebx + 0x20], eax
mov eax, dword [ebx + 8]
mov eax, dword [eax]
mov ecx, eax
cmp eax, esi
je 0x10037a8c
nop word [eax + eax]
movzx edx, byte [eax + 8]
xor edx, 0x811c9dc5
mov ecx, dword [ecx]
imul edi, edx, 0x1000193
movzx edx, byte [eax + 9]
xor edi, edx
movzx edx, byte [eax + 0xa]
imul edi, edi, 0x1000193
xor edi, edx
movzx edx, byte [eax + 0xb]
imul edi, edi, 0x1000193
xor edi, edx
imul edx, edi, 0x1000193
mov edi, dword [ebx + 0x20]
and edi, edx
mov edx, dword [ebx + 0x14]
lea edx, [edx + edi*8]
mov edi, dword [edx]
mov dword [ebp - 0x10], edx
cmp edi, esi
jne 0x10037a11
mov dword [edx], eax
mov dword [edx + 4], eax
jmp 0x10037a82
mov edx, dword [edx + 4]
mov ebx, dword [eax + 8]
cmp ebx, dword [edx + 8]
jne 0x10037a4b
mov edx, dword [edx]
mov dword [ebp - 4], edx
cmp edx, eax
je 0x10037a43
mov ebx, dword [eax + 4]
mov esi, dword [ebp - 4]
mov dword [ebx], ecx
mov edi, dword [ecx + 4]
mov dword [edi], edx
mov edx, dword [edx + 4]
mov dword [edx], eax
mov dword [esi + 4], edi
mov esi, dword [ebp - 0xc]
mov dword [ecx + 4], ebx
mov dword [eax + 4], edx
mov edx, dword [ebp - 0x10]
mov dword [edx + 4], eax
jmp 0x10037a7f
cmp edi, edx
je 0x10037a5c
nop
mov edx, dword [edx + 4]
cmp ebx, dword [edx + 8]
je 0x10037a95
cmp edi, edx
jne 0x10037a50
mov ebx, dword [eax + 4]
mov dword [ebp - 4], ebx
mov dword [ebx], ecx
mov ebx, dword [ecx + 4]
mov dword [ebx], edx
mov edi, dword [edx + 4]
mov dword [edi], eax
mov dword [edx + 4], ebx
mov edx, dword [ebp - 4]
mov dword [ecx + 4], edx
mov edx, dword [ebp - 0x10]
mov dword [eax + 4], edi
mov dword [edx], eax
mov ebx, dword [ebp - 8]
mov eax, ecx
cmp ecx, esi
jne 0x100379c0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
mov ebx, dword [eax + 4]
mov edx, dword [edx]
mov dword [ebp - 4], edx
mov esi, edx
mov dword [ebx], ecx
mov edi, dword [ecx + 4]
mov dword [edi], edx
mov edx, dword [edx + 4]
mov dword [edx], eax
mov dword [esi + 4], edi
mov esi, dword [ebp - 0xc]
mov dword [ecx + 4], ebx
mov dword [eax + 4], edx
jmp 0x10037a7f
Function at 0x100441c0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [ebp + 8]
push ebx
push esi
mov dword [ebp - 0x10], eax
mov ebx, ecx
dec eax
push edi
mov edi, edx
mov dword [ebp - 0x14], eax
mov edx, dword [ebp + 0xc]
mov esi, edi
sar eax, 1
mov ecx, edi
mov dword [ebp - 4], edx
mov dword [ebp - 8], esi
mov dword [ebp - 0xc], eax
cmp edi, eax
jge 0x10044223
nop dword [eax]
lea esi, [ecx + ecx]
lea edx, [ebx + 8]
lea edx, [edx + esi*4]
lea eax, [edx - 4]
push eax
call fcn.10043fe0
movzx ecx, al
add esp, 4
xor ecx, 1
inc ecx
add ecx, esi
mov eax, dword [ebx + ecx*4]
mov dword [ebx + edi*4], eax
mov edi, ecx
mov eax, dword [ebp - 0xc]
cmp ecx, eax
jl 0x100441f0
mov edx, dword [ebp - 4]
mov esi, dword [ebp - 8]
mov edi, ecx
cmp ecx, eax
jne 0x1004423a
mov eax, dword [ebp - 0x10]
test al, 1
jne 0x1004423a
mov eax, dword [ebx + eax*4 - 4]
mov edi, dword [ebp - 0x14]
mov dword [ebx + ecx*4], eax
cmp esi, edi
jge 0x10044284
nop
lea esi, [edi - 1]
sar esi, 1
push edx
lea eax, [ebx + esi*4]
mov edx, eax
call fcn.10043fe0
add esp, 4
test al, al
je 0x10044275
mov eax, dword [ebx + esi*4]
mov edx, dword [ebp - 4]
mov dword [ebx + edi*4], eax
mov edi, esi
cmp dword [ebp - 8], esi
jl 0x10044240
mov eax, edx
mov eax, dword [eax]
mov dword [ebx + edi*4], eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 4]
mov eax, dword [eax]
mov dword [ebx + edi*4], eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [edx]
mov dword [ebx + edi*4], eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10045660
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
cmp byte [0x10164c8f], 0
push ebx
push esi
push edi
je 0x100457ee
mov ecx, dword [0x101c643c]
mov eax, dword [ecx]
mov eax, dword [eax + 0x68]
call eax
test al, al
je 0x100457ee
mov ecx, dword [0x101c64c4]
xor ebx, ebx
mov dword [ebp - 4], ecx
mov eax, dword [ecx + 0x28]
mov dword [ebp - 8], eax
test eax, eax
je 0x100457ee
mov eax, dword [ecx + 0x1c]
mov ecx, dword [eax + ebx*4]
mov eax, dword [ecx]
mov eax, dword [eax + 0x30]
call eax
mov esi, eax
mov edi, 0x811c9dc5
xor ecx, ecx
nop word [eax + eax]
inc ecx
cmp byte [esi + ecx], 0
jne 0x100456c0
xor edx, edx
test ecx, ecx
je 0x100456e9
nop dword [eax]
movsx eax, byte [esi + edx]
inc edx
xor eax, edi
imul edi, eax, 0x1000193
cmp edx, ecx
jb 0x100456d0
cmp edi, 0x5ff56dc5
je 0x100456f8
inc ebx
cmp ebx, dword [ebp - 8]
jae 0x100457ee
mov ecx, dword [ebp - 4]
jmp 0x100456a4
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x1c]
mov edi, dword [eax + ebx*4]
test edi, edi
je 0x100457ee
mov edx, dword [edi + 0x88]
test edx, edx
je 0x100457ee
movss xmm1, dword [0x100e2bd0]
xor ebx, ebx
cmp edx, 4
jl 0x100457bb
mov ecx, dword [edi + 0x7c]
lea esi, [edx - 4]
shr esi, 2
add ecx, 0x1078
inc esi
lea ebx, [esi*4]
movss xmm0, dword [ecx - 0xc60]
ucomiss xmm0, xmm1
lahf
test ah, 0x44
jp 0x1004575c
mov dword [ecx - 0xc60], 0x7f7fffff
movss xmm0, dword [ecx - 0x840]
ucomiss xmm0, xmm1
lahf
test ah, 0x44
jp 0x10045777
mov dword [ecx - 0x840], 0x7f7fffff
movss xmm0, dword [ecx - 0x420]
ucomiss xmm0, xmm1
lahf
test ah, 0x44
jp 0x10045792
mov dword [ecx - 0x420], 0x7f7fffff
movss xmm0, dword [ecx]
ucomiss xmm0, xmm1
lahf
test ah, 0x44
jp 0x100457a5
mov dword [ecx], 0x7f7fffff
add ecx, 0x1080
sub esi, 1
jne 0x10045741
cmp ebx, edx
jl 0x100457bf
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
test edx, edx
jle 0x100457ee
imul ecx, ebx, 0x420
add ecx, 0x418
add ecx, dword [edi + 0x7c]
sub edx, ebx
movss xmm0, dword [ecx]
ucomiss xmm0, xmm1
lahf
test ah, 0x44
jp 0x100457e3
mov dword [ecx], 0x7f7fffff
add ecx, 0x420
sub edx, 1
jne 0x100457d0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10046ea0
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, ecx
push edi
call fcn.10045b60
mov ecx, edi
call fcn.10044f30
cmp byte [esi + 4], 0
je 0x100470ea
push 0
call fcn.10045d70
mov ecx, esi
call fcn.10046050
push edi
mov ecx, esi
call fcn.10046ab0
push 1
call fcn.10045d70
cmp byte [0x101cc7f0], 0
mov eax, dword [0x101c6454]
mov byte [eax + 8], 0
mov eax, dword [0x101c65e8]
mov dword [eax], 0xffffffff
mov eax, dword [0x101c649c]
movss xmm0, dword [0x10175dd8]
mov dword [0x101c65ec], 0
movss dword [eax + 0x10], xmm0
mov eax, dword [0x101c649c]
movss xmm0, dword [0x10175ddc]
movss dword [eax + 0x14], xmm0
jne 0x100470ea
push ebx
push dword [0x10164ef8]
call dword [sym.imp.USER32.dll_GetKeyState]
mov bl, byte [0x10164f0a]
test ax, ax
setne byte [0x10175d08]
test ax, ax
jne 0x10046f76
cmp byte [0x101cc85c], al
je 0x100470e9
pop ebx
pop edi
mov dword [0x102301c8], 0
mov dword [0x101cc7f4], 0x10
pop esi
pop ebp
ret 4
cmp byte [0x101cc85c], 0
jne 0x10047005
mov eax, dword [0x101c649c]
movss xmm1, dword [0x100e2b78]
mov ecx, dword [0x102301c8]
divss xmm1, dword [eax + 0x20]
addss xmm1, dword [0x100e2b78]
cvttss2si eax, xmm1
cmp ecx, eax
jle 0x10046fb7
mov dword [0x102301cc], 0x10
jmp 0x10047005
cmp dword [0x101c21d4], 0
jne 0x10046fc7
inc ecx
mov dword [0x102301c8], ecx
mov ecx, dword [0x101651e4]
test byte [ecx + 0x30], 1
je 0x10047005
cmp byte [0x10165188], 0
je 0x10047005
mov dword [0x102301c8], 0
test bl, bl
je 0x10047005
mov eax, dword [0x10165038]
sub eax, 0
je 0x10047000
sub eax, 1
jne 0x10047005
call fcn.10060ef0
jmp 0x10047005
call fcn.100acbe0
mov esi, dword [0x1016beb0]
cmp esi, 0xffffffff
je 0x1004707d
cmp esi, 0x100
jb 0x1004705e
push str.array_subscript_out_of_range
push 0x100d7fd0
push 0
push 0x215
push 0x100d8708
push 2
call dword [sym.imp.ucrtbased.dll__CrtDbgReport]
add esp, 0x18
cmp eax, 1
jne 0x1004703f
int3
push 0
push 0x215
push str.C:Program_FilesMicrosoft_Visual_Studio2022CommunityVCToolsMSVC14.41.34120include_array
push 0x100d8104
push str._array_subscript_out_of_range_
call dword [sym.imp.ucrtbased.dll__invalid_parameter]
add esp, 0x14
lea eax, [esi + esi*2]
mov al, byte [eax*4 + 0x101c6950]
test al, al
je 0x1004707d
mov dword [0x102301c8], 0
mov byte [0x101cc85c], 0
mov ecx, dword [0x101651e4]
test byte [ecx + 0x30], 1
je 0x100470d6
cmp byte [0x10165188], 0
je 0x100470d6
cmp byte [0x101cc85c], 0
je 0x100470df
mov dword [0x102301c8], 0
mov dword [0x101cc7f4], 0xe
test bl, bl
je 0x100470ce
mov eax, dword [0x10165038]
sub eax, 0
je 0x100470c9
sub eax, 1
jne 0x100470ce
call fcn.10060ef0
jmp 0x100470ce
call fcn.100acbe0
mov eax, dword [0x101651b8]
mov byte [eax], 0
cmp byte [0x101cc85c], 0
jne 0x100470e9
mov dword [0x101cc834], 0
pop ebx
pop edi
pop esi
pop ebp
ret 4
Function at 0x10047a50
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100cc305
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push ebx
push esi
push edi
mov eax, dword [0x100f0380]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
movzx eax, byte [esi]
xor eax, 0x811c9dc5
imul ecx, eax, 0x1000193
movzx eax, byte [esi + 1]
xor ecx, eax
movzx eax, byte [esi + 2]
imul ecx, ecx, 0x1000193
xor ecx, eax
movzx eax, byte [esi + 3]
imul ecx, ecx, 0x1000193
xor ecx, eax
lea eax, [ebp - 0x14]
imul edi, ecx, 0x1000193
push edi
push esi
push eax
call fcn.10048ef0
mov eax, dword [ebp - 0x10]
test eax, eax
jne 0x10047b7b
cmp dword [0x101cc78c], 0xfffffff
jne 0x10047ada
push str.unordered_map_set_too_long
call dword [sym.imp.MSVCP140D.dll_void___cdecl_std::_Xlength_error_char_const__]
mov dword [ebp - 0x1c], 0x101cc784
mov dword [ebp - 4], 0
push 0x10
mov dword [ebp - 0x18], 0
call fcn.100c8350
mov ebx, eax
add esp, 4
mov eax, dword [esi]
mov dword [ebp - 0x18], ebx
mov dword [ebx + 8], eax
mov dword [ebx + 0xc], 0
mov dword [ebp - 4], 1
mov eax, dword [0x101cc78c]
inc eax
movd xmm0, eax
cvtdq2pd xmm0, xmm0
shr eax, 0x1f
addsd xmm0, qword [eax*8 + 0x100e2f70]
mov eax, dword [0x101cc7a4]
cvtpd2ps xmm1, xmm0
movd xmm0, eax
cvtdq2pd xmm0, xmm0
shr eax, 0x1f
addsd xmm0, qword [eax*8 + 0x100e2f70]
cvtpd2ps xmm0, xmm0
divss xmm1, xmm0
comiss xmm1, dword [0x101cc780]
jbe 0x10047b70
call fcn.10048c90
push edi
lea eax, [ebx + 8]
push eax
lea eax, [ebp - 0x1c]
push eax
call fcn.10048ef0
mov ecx, dword [eax]
jmp 0x10047b73
mov ecx, dword [ebp - 0x14]
push ebx
push ecx
push edi
call fcn.10048d10
add eax, 0xc
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x10048d80
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1fffffff
sub esp, 0x10
bsr ecx, eax
push ebx
push esi
push edi
mov edi, 1
mov eax, edi
shl eax, cl
mov ecx, dword [ebp + 8]
cmp ecx, eax
jbe 0x10048dac
push str.invalid_hash_bucket_count
call dword [sym.imp.MSVCP140D.dll_void___cdecl_std::_Xlength_error_char_const__]
lea eax, [ecx - 1]
mov esi, dword [0x101cc788]
or eax, 1
mov dword [ebp - 8], esi
bsr ecx, eax
push esi
lea ecx, [ecx + 1]
shl edi, cl
mov ecx, 0x101cc790
lea eax, [edi + edi]
push eax
call fcn.10036380
mov eax, dword [0x101cc788]
lea ebx, [edi - 1]
mov dword [0x101cc7a0], ebx
mov dword [0x101cc7a4], edi
mov eax, dword [eax]
mov ecx, eax
cmp eax, esi
je 0x10048ee6
movzx edx, byte [eax + 8]
xor edx, 0x811c9dc5
mov ecx, dword [ecx]
imul edi, edx, 0x1000193
movzx edx, byte [eax + 9]
xor edi, edx
movzx edx, byte [eax + 0xa]
imul edi, edi, 0x1000193
xor edi, edx
movzx edx, byte [eax + 0xb]
imul edi, edi, 0x1000193
xor edi, edx
mov edx, dword [0x101cc794]
imul edi, edi, 0x1000193
and edi, ebx
mov ebx, dword [edx + edi*8]
lea edx, [edx + edi*8]
mov dword [ebp - 0xc], edx
cmp ebx, esi
jne 0x10048e44
mov dword [edx], eax
mov dword [edx + 4], eax
jmp 0x10048eb1
mov edx, dword [edx + 4]
mov edi, dword [eax + 8]
cmp edi, dword [edx + 8]
jne 0x10048e7e
mov edx, dword [edx]
mov dword [ebp - 4], edx
cmp edx, eax
je 0x10048e76
mov ebx, dword [eax + 4]
mov esi, dword [ebp - 4]
mov dword [ebx], ecx
mov edi, dword [ecx + 4]
mov dword [edi], edx
mov edx, dword [edx + 4]
mov dword [edx], eax
mov dword [esi + 4], edi
mov esi, dword [ebp - 8]
mov dword [ecx + 4], ebx
mov dword [eax + 4], edx
mov edx, dword [ebp - 0xc]
mov dword [edx + 4], eax
jmp 0x10048eb1
cmp ebx, edx
je 0x10048e8e
mov edx, dword [edx + 4]
cmp edi, dword [edx + 8]
je 0x10048ec2
cmp ebx, edx
jne 0x10048e82
mov ebx, dword [eax + 4]
mov dword [ebp - 4], ebx
mov dword [ebx], ecx
mov ebx, dword [ecx + 4]
mov dword [ebx], edx
mov edi, dword [edx + 4]
mov dword [edi], eax
mov dword [edx + 4], ebx
mov edx, dword [ebp - 4]
mov dword [ecx + 4], edx
mov edx, dword [ebp - 0xc]
mov dword [eax + 4], edi
mov dword [edx], eax
mov eax, ecx
cmp ecx, esi
je 0x10048ee6
mov ebx, dword [0x101cc7a0]
jmp 0x10048df2
mov ebx, dword [eax + 4]
mov edx, dword [edx]
mov dword [ebp - 4], edx
mov esi, edx
mov dword [ebx], ecx
mov edi, dword [ecx + 4]
mov dword [edi], edx
mov edx, dword [edx + 4]
mov dword [edx], eax
mov dword [esi + 4], edi
mov esi, dword [ebp - 8]
mov dword [ecx + 4], ebx
mov dword [eax + 4], edx
jmp 0x10048eb1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x10052e70
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100ccee5
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
push ebx
push esi
push edi
mov eax, dword [0x100f0380]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x1c], edi
mov ebx, dword [edi + 4]
mov esi, dword [ebp + 8]
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x20], esi
mov ecx, dword [ebx + 4]
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x14], 0
cmp byte [ecx + 0xd], 0
jne 0x10052f57
mov esi, ecx
lea edi, [esi + 0x10]
mov dword [ebp - 0x18], esi
push eax
mov ecx, edi
call fcn.1004eba0
shr eax, 0x1f
test al, al
je 0x10052f39
mov ecx, dword [ebp - 0x10]
push edi
call fcn.1004eba0
test eax, eax
jns 0x10052f2d
push str.invalid_comparator
push 0x100d7fd0
push 0
push 0x5f8
push 0x100d8e40
push 2
call dword [sym.imp.ucrtbased.dll__CrtDbgReport]
add esp, 0x18
cmp eax, 1
jne 0x10052f0e
int3
push 0
push 0x5f8
push str.C:Program_FilesMicrosoft_Visual_Studio2022CommunityVCToolsMSVC14.41.34120includexutility
push 0x100d8104
push str._invalid_comparator_
call dword [sym.imp.ucrtbased.dll__invalid_parameter]
add esp, 0x14
mov esi, dword [esi + 8]
mov dword [ebp - 0x14], 0
jmp 0x10052f44
mov ebx, esi
mov dword [ebp - 0x14], 1
mov esi, dword [esi]
cmp byte [esi + 0xd], 0
mov eax, dword [ebp - 0x10]
je 0x10052ec5
mov esi, dword [ebp - 0x20]
mov edi, dword [ebp - 0x1c]
cmp byte [ebx + 0xd], 0
jne 0x10052f8a
lea ecx, [ebx + 0x10]
mov edx, eax
push ecx
call fcn.100561a0
add esp, 4
test al, al
jne 0x10052f8a
mov byte [esi + 4], al
mov eax, esi
mov dword [esi], ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
cmp dword [edi + 8], 0x3ffffff
je 0x1005300d
mov ebx, dword [edi + 4]
mov dword [ebp - 0x28], edi
mov dword [ebp - 4], 0
push 0x40
mov dword [ebp - 0x24], 0
call fcn.100c8350
mov edi, eax
add esp, 4
mov dword [ebp - 0x24], edi
push dword [ebp - 0x10]
lea ecx, [edi + 0x10]
mov dword [ebp - 4], 1
call fcn.10027b30
push ecx
lea ecx, [edi + 0x30]
call fcn.1004ea90
mov ecx, dword [ebp - 0x1c]
push edi
push dword [ebp - 0x14]
mov dword [edi], ebx
push dword [ebp - 0x18]
mov dword [edi + 4], ebx
mov dword [edi + 8], ebx
mov word [edi + 0xc], 0
call fcn.100531f0
mov ecx, dword [ebp - 0x20]
mov dword [ecx], eax
mov eax, ecx
mov byte [ecx + 4], 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
call fcn.10049b80
int3
Function at 0x10058af0
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [0x100f0380]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov edi, dword fs:[0x30]
mov ebx, ecx
test edi, edi
jne 0x10058b23
xor al, al
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100c8320
mov esp, ebp
pop ebp
ret
mov edi, dword [edi + 0xc]
add edi, 0x14
mov esi, dword [edi]
cmp esi, edi
je 0x10058b75
mov ecx, 0x5a4d
lea edx, [esi - 8]
test edx, edx
je 0x10058b6f
mov eax, dword [edx + 0x18]
test eax, eax
je 0x10058b6f
cmp word [eax], cx
jne 0x10058b6f
mov ecx, dword [eax + 0x3c]
add ecx, eax
je 0x10058b6a
cmp dword [ecx], 0x4550
jne 0x10058b6a
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0x10]
mov dword [ebp - 8], ecx
mov ecx, ebx
push eax
mov dword [ebp - 0x10], edx
call fcn.1005f180
mov ecx, 0x5a4d
mov esi, dword [esi]
cmp esi, edi
jne 0x10058b34
mov eax, dword [ebx + 4]
cmp eax, dword [ebx + 8]
mov ecx, dword [ebp - 4]
pop edi
setne al
xor ecx, ebp
pop esi
pop ebx
call fcn.100c8320
mov esp, ebp
pop ebp
ret
Function at 0x10059ed0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
cmp dword [eax + 0x18], 0xf
lea esi, [eax + 4]
mov edi, dword [eax + 0x14]
mov ebx, ecx
mov dword [ebp - 4], edx
jbe 0x10059eed
mov esi, dword [esi]
xor ecx, ecx
mov edx, 0x811c9dc5
test edi, edi
je 0x10059f09
movzx eax, byte [esi + ecx]
inc ecx
xor eax, edx
imul edx, eax, 0x1000193
cmp ecx, edi
jb 0x10059ef8
push edx
mov edx, dword [ebp - 4]
mov ecx, ebx
call fcn.100597c0
add esp, 4
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x1005f030
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100cddf5
mov eax, dword fs:[0]
push eax
sub esp, 0x18
push ebx
push esi
push edi
mov eax, dword [0x100f0380]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
movzx eax, byte [esi]
xor eax, 0x811c9dc5
imul ecx, eax, 0x1000193
movzx eax, byte [esi + 1]
xor ecx, eax
movzx eax, byte [esi + 2]
imul ecx, ecx, 0x1000193
xor ecx, eax
movzx eax, byte [esi + 3]
imul ecx, ecx, 0x1000193
xor ecx, eax
lea eax, [ebp - 0x18]
imul edi, ecx, 0x1000193
push edi
push esi
push eax
call fcn.10048ef0
mov eax, dword [ebp - 0x14]
test eax, eax
jne 0x1005f15b
cmp dword [0x101cc78c], 0xfffffff
jne 0x1005f0ba
push str.unordered_map_set_too_long
call dword [sym.imp.MSVCP140D.dll_void___cdecl_std::_Xlength_error_char_const__]
mov dword [ebp - 0x20], 0x101cc784
mov dword [ebp - 4], 0
push 0x10
mov dword [ebp - 0x1c], 0
call fcn.100c8350
mov ebx, eax
add esp, 4
mov eax, dword [esi]
mov dword [ebp - 0x1c], ebx
mov dword [ebx + 8], eax
mov dword [ebx + 0xc], 0
mov dword [ebp - 4], 1
mov eax, dword [0x101cc78c]
inc eax
movd xmm0, eax
cvtdq2pd xmm0, xmm0
shr eax, 0x1f
addsd xmm0, qword [eax*8 + 0x100e2f70]
mov eax, dword [0x101cc7a4]
cvtpd2ps xmm1, xmm0
movd xmm0, eax
cvtdq2pd xmm0, xmm0
shr eax, 0x1f
addsd xmm0, qword [eax*8 + 0x100e2f70]
cvtpd2ps xmm0, xmm0
divss xmm1, xmm0
comiss xmm1, dword [0x101cc780]
jbe 0x1005f150
call fcn.10048c90
push edi
lea eax, [ebx + 8]
push eax
lea eax, [ebp - 0x20]
push eax
call fcn.10048ef0
mov ecx, dword [eax]
jmp 0x1005f153
mov ecx, dword [ebp - 0x18]
push ebx
push ecx
push edi
call fcn.10048d10
add eax, 0xc
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4