joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1001c6a0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push edi
mov edi, dword [ebp + 8]
cmp byte [edi + 0x2d], 0
jne 0x1001c73b
push ebx
mov ebx, dword [ebp + 0x10]
lea eax, [ebp - 4]
push esi
push 0
push eax
push ebx
push dword [ebp + 0xc]
push dword [edi + 0x30]
call dword [sym.imp.kernel32.dll_ReadFile]
mov esi, dword [ebp - 4]
cmp esi, ebx
je 0x1001c6f2
mov byte [edi + 0x2d], 0xff
test esi, esi
je 0x1001c6f2
cmp esi, ebx
jge 0x1001c6f2
mov eax, ebx
sub eax, esi
push eax
mov eax, dword [ebp + 0xc]
add eax, esi
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
cmp dword [edi + 0x18], 0
je 0x1001c735
add dword [edi + 0x1c], ebx
cmp dword [edi + 0x1c], 0xffff
jle 0x1001c735
xor eax, eax
mov word [edi + 0x1e], ax
mov eax, dword [edi]
push edi
mov esi, dword [eax + 0x2c]
mov ecx, esi
call dword [0x100252e4]
call esi
mov ecx, dword [edi + 0x18]
push 1
push dword [edi + 0x20]
mov esi, dword [ecx]
push eax
push ecx
mov ecx, dword [esi + 0xc]
call dword [0x100252e4]
call dword [esi + 0xc]
mov esi, dword [ebp - 4]
mov eax, esi
pop esi
pop ebx
jmp 0x1001c74d
push dword [ebp + 0x10]
push 0
push dword [ebp + 0xc]
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
xor eax, eax
pop edi
leave
ret 0xc

Function at 0x1001c970
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x108
mov eax, dword [0x1002d6f4]
xor eax, ebp
mov dword [ebp - 4], eax
cmp byte [0x1002da0c], 0
mov eax, dword [ebp + 8]
je 0x1001c998
push eax
call dword [sym.imp.kernel32.dll_DeleteFileW]
jmp 0x1001c9b2
lea ecx, [ebp - 0x108]
push ecx
push eax
call fcn.10002d90
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.kernel32.dll_DeleteFileA]
mov ecx, dword [ebp - 4]
test eax, eax
setne al
xor ecx, ebp
call fcn.10022650
leave
ret 4

Function at 0x1001cb80
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x310
mov eax, dword [0x1002d6f4]
xor eax, ebp
mov dword [ebp - 4], eax
cmp byte [0x1002da0c], 0
push ebx
mov ebx, dword [ebp + 0x14]
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0xc]
je 0x1001cbb6
push ebx
push dword [ebp + 0x10]
push edi
push esi
call dword [sym.imp.kernel32.dll_GetTempFileNameW]
jmp 0x1001cc15
push 0x104
lea eax, [ebp - 0x108]
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
lea eax, [ebp - 0x310]
push eax
push esi
call fcn.10002d90
lea eax, [ebp - 0x20c]
push eax
push edi
call fcn.10002d90
lea eax, [ebp - 0x108]
push eax
push dword [ebp + 0x10]
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x310]
push eax
call dword [sym.imp.kernel32.dll_GetTempFileNameA]
mov esi, eax
lea eax, [ebp - 0x108]
push ebx
push eax
call fcn.10002d90
mov eax, esi
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10022650
leave
ret 0x10
Function at 0x1001cc30
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x108
mov eax, dword [0x1002d6f4]
xor eax, ebp
mov dword [ebp - 4], eax
cmp byte [0x1002da0c], 0
push esi
mov esi, dword [ebp + 0xc]
je 0x1001cc5c
push esi
push dword [ebp + 8]
call dword [sym.imp.kernel32.dll_GetTempPathW]
jmp 0x1001cc8d
lea eax, [ebp - 0x108]
push eax
push 0x104
call dword [sym.imp.kernel32.dll_GetTempPathA]
test eax, eax
je 0x1001cc8b
push dword [ebp + 8]
lea eax, [ebp - 0x108]
push esi
push eax
call fcn.10002d90
push esi
call dword [sym.imp.kernel32.dll_lstrlenW]
jmp 0x1001cc8d
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.10022650
leave
ret 8
Function at 0x1003a700
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x60
pushal
call 0x1003a70f
pop dword [ebp - 0x50]
mov eax, 0x1003a70f
sub dword [ebp - 0x50], eax
mov dword [ebp - 0x60], 0xfae18718
add dword [ebp - 0x60], 0x5370be33
mov dword [ebp - 0x5c], 0x3e7e4ba4
sub dword [ebp - 0x5c], 0xc4aff5f
mov dword [ebp - 0x58], 0xb9741bc
add dword [ebp - 0x58], 0x40b50272
mov dword [ebp - 0x54], 0xb7f0c8cb
sub dword [ebp - 0x54], 0xb7f0c8cb
lea eax, [ebp - 0x60]
push eax
mov eax, 0xe3da5a28
add eax, 0x2c2e160c
add eax, dword [ebp - 0x50]
call dword [eax]
mov dword [ebp - 0x60], 0xe68ca210
sub dword [ebp - 0x60], 0x721a38ba
mov dword [ebp - 0x5c], 0xecca7cc7
add dword [ebp - 0x5c], 0x54a1e4ae
mov dword [ebp - 0x58], 0x707e6a1c
add dword [ebp - 0x58], 0xf2f10250
mov dword [ebp - 0x54], 0xd5af011f
add dword [ebp - 0x54], 0x2a50fee1
lea ebx, [ebp - 0x60]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x50]
call dword [eax]
push 0x40
push 0x1000
push 0x42048
push 0
call eax
mov ecx, 0xad56fb46
sub ecx, 0xad56a205
mov esi, eax
mov edx, 0xf734eb2d
sub edx, 0xe7295b2d
add edx, dword [ebp - 0x50]
mov edi, 0x1db546d0
add edi, 0xb53c9dd9
xor dword [ebp - 0x38], ebx
mov ebx, dword [edx]
sub dword [ebp - 0x40], edx
sub ebx, edi
sub dword [ebp - 0x3c], ecx
mov dword [esi], ebx
add dword [ebp - 0x34], edi
add esi, 0x3ac387ce
add esi, 0xc53c7836
add edx, 4
loop 0x1003a827
add eax, 0xa2e2386a
sub eax, 0xa2e0e093
mov ebx, eax
add eax, 0xbf09438a
add eax, 0x40f6bc7b
mov ecx, 0x10000000
add ecx, dword [ebp - 0x50]
call ebx
leave
ret
Function at 0x4015a0
Capabilities:
Terminate process

Disassembly:
call fcn.00401940
jmp fcn.004012d0

Function at 0x4015b0
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x403008]
jne 0x4015ba
repz ret
jmp fcn.004019f0

Function at 0x438caf
Capabilities:
Encode data using xor

Disassembly:
mov edi, 0x438a14
and esi, esi
or edx, edx
call fcn.00438cde
dec edx
xor dword [ebx], edi
mov esi, edx
mov edx, edx
inc ebx
and esi, edx
cmp ebx, ecx
jne fcn.00438caf
push 0x388b58d8
pop edx
sub esi, esi
ret
Function at 0x1003d012
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
pushal
call 0x1003d021
pop dword [ebp - 0x18]
mov eax, 0xf05f6446
add eax, 0x1fa46bdb
sub dword [ebp - 0x18], eax
push 0x40
push 0x1000
push 0x445f0
push 0
mov eax, 0xd85dd454
add eax, 0x37a9acc8
add eax, dword [ebp - 0x18]
call dword [eax]
mov ecx, 0xa13da392
sub ecx, 0xa13d5537
xor edi, edi
add edi, eax
mov edx, 0x18b070c0
add edx, 0xf7680340
add edx, dword [ebp - 0x18]
mov esi, 0x6f701ed4
add esi, 0xa1c37464
sub dword [ebp - 0xc], esi
mov ebx, dword [edx]
add dword [ebp - 4], 0x54b140bb
xor ebx, esi
xor dword [ebp - 0x10], edx
mov dword [edi], ebx
sub dword [ebp - 8], esi
add edi, 0x98e65510
add edi, 0x6719aaf4
add edx, 0xb9888931
add edx, 0x467776d3
loop 0x1003d082
add eax, 0x12c3f
mov ebx, eax
add eax, 0xbb044567
add eax, 0x44fbba9e
mov ecx, 0x10000000
add ecx, dword [ebp - 0x18]
call ebx
leave
ret
Function at 0x10072480
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push edi
mov edi, dword [ebp + 8]
cmp byte [edi + 0x2d], 0
jne 0x1007251b
push ebx
mov ebx, dword [ebp + 0x10]
lea eax, [ebp - 4]
push esi
push 0
push eax
push ebx
push dword [ebp + 0xc]
push dword [edi + 0x30]
call dword [sym.imp.kernel32.dll_ReadFile]
mov esi, dword [ebp - 4]
cmp esi, ebx
je 0x100724d2
mov byte [edi + 0x2d], 0xff
test esi, esi
je 0x100724d2
cmp esi, ebx
jge 0x100724d2
mov eax, ebx
sub eax, esi
push eax
mov eax, dword [ebp + 0xc]
add eax, esi
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
cmp dword [edi + 0x18], 0
je 0x10072515
add dword [edi + 0x1c], ebx
cmp dword [edi + 0x1c], 0xffff
jle 0x10072515
xor eax, eax
mov word [edi + 0x1e], ax
mov eax, dword [edi]
push edi
mov esi, dword [eax + 0x2c]
mov ecx, esi
call dword [0x100783d8]
call esi
mov ecx, dword [edi + 0x18]
push 1
push dword [edi + 0x20]
mov esi, dword [ecx]
push eax
push ecx
mov ecx, dword [esi + 0xc]
call dword [0x100783d8]
call dword [esi + 0xc]
mov esi, dword [ebp - 4]
mov eax, esi
pop esi
pop ebx
jmp 0x1007252d
push dword [ebp + 0x10]
push 0
push dword [ebp + 0xc]
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
xor eax, eax
pop edi
leave
ret 0xc

Function at 0x10072750
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x108
mov eax, dword [0x100bb860]
xor eax, ebp
mov dword [ebp - 4], eax
cmp byte [0x10176180], 0
mov eax, dword [ebp + 8]
je 0x10072778
push eax
call dword [sym.imp.kernel32.dll_DeleteFileW]
jmp 0x10072792
lea ecx, [ebp - 0x108]
push ecx
push eax
call fcn.1003d012
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.kernel32.dll_DeleteFileA]
mov ecx, dword [ebp - 4]
test eax, eax
setne al
xor ecx, ebp
call fcn.10076730
leave
ret 4

Function at 0x10072960
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x310
mov eax, dword [0x100bb860]
xor eax, ebp
mov dword [ebp - 4], eax
cmp byte [0x10176180], 0
push ebx
mov ebx, dword [ebp + 0x14]
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0xc]
je 0x10072996
push ebx
push dword [ebp + 0x10]
push edi
push esi
call dword [sym.imp.kernel32.dll_GetTempFileNameW]
jmp 0x100729f5
push 0x104
lea eax, [ebp - 0x108]
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
lea eax, [ebp - 0x310]
push eax
push esi
call fcn.1003d012
lea eax, [ebp - 0x20c]
push eax
push edi
call fcn.1003d012
lea eax, [ebp - 0x108]
push eax
push dword [ebp + 0x10]
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x310]
push eax
call dword [sym.imp.kernel32.dll_GetTempFileNameA]
mov esi, eax
lea eax, [ebp - 0x108]
push ebx
push eax
call fcn.1003d012
mov eax, esi
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10076730
leave
ret 0x10
Function at 0x10072a10
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x108
mov eax, dword [0x100bb860]
xor eax, ebp
mov dword [ebp - 4], eax
cmp byte [0x10176180], 0
push esi
mov esi, dword [ebp + 0xc]
je 0x10072a3c
push esi
push dword [ebp + 8]
call dword [sym.imp.kernel32.dll_GetTempPathW]
jmp 0x10072a6d
lea eax, [ebp - 0x108]
push eax
push 0x104
call dword [sym.imp.kernel32.dll_GetTempPathA]
test eax, eax
je 0x10072a6b
push dword [ebp + 8]
lea eax, [ebp - 0x108]
push esi
push eax
call fcn.1003d012
push esi
call dword [sym.imp.kernel32.dll_lstrlenW]
jmp 0x10072a6d
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.10076730
leave
ret 8
Function at 0x10002f70
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1001dd43
mov eax, dword fs:[0]
push eax
sub esp, 0x28
push ebx
push esi
push edi
mov eax, dword [0x1002f4c0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov dword [ebp - 0x10], ebx
mov esi, dword [ebp + 8]
lea edi, [ebx + 4]
push 0x48
mov dword [ebp - 0x14], edi
mov eax, dword [esi]
mov dword [ebx], eax
mov dword [edi], 0
mov dword [edi + 4], 0
call fcn.10013beb
add esp, 4
mov dword [eax], eax
mov dword [eax + 4], eax
mov dword [edi], eax
lea ecx, [ebx + 0xc]
mov dword [ebp - 4], 0
mov dword [ecx], 0
mov dword [ecx + 4], 0
mov dword [ecx + 8], 0
mov eax, dword [esi + 0x18]
mov dword [ebx + 0x18], eax
mov eax, dword [esi + 0x1c]
mov dword [ebx + 0x1c], eax
mov eax, dword [esi + 0x10]
sub eax, dword [esi + 0xc]
push dword [edi]
sar eax, 2
push eax
mov byte [ebp - 4], 1
call fcn.10007910
mov eax, dword [esi + 4]
mov dword [ebp - 0x1c], eax
mov esi, dword [eax]
cmp esi, eax
je 0x10003157
nop word [eax + eax]
cmp dword [esi + 0x1c], 7
lea ebx, [esi + 8]
mov eax, dword [ebx + 0x10]
mov edx, ebx
jbe 0x10003030
mov edx, dword [ebx]
xor ecx, ecx
mov edi, 0x811c9dc5
add eax, eax
mov dword [ebp + 8], eax
je 0x10003054
mov ebx, eax
movzx eax, byte [ecx + edx]
inc ecx
xor eax, edi
imul edi, eax, 0x1000193
cmp ecx, ebx
jb 0x10003040
lea ebx, [esi + 8]
mov ecx, dword [ebp - 0x10]
lea eax, [ebp - 0x24]
push edi
push ebx
push eax
call fcn.100044c0
cmp dword [ebp - 0x20], 0
jne 0x10003149
mov eax, dword [ebp - 0x10]
cmp dword [eax + 8], 0x38e38e3
je 0x1000316d
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x2c], eax
push 0x48
mov byte [ebp - 4], 2
mov dword [ebp - 0x28], 0
call fcn.10013beb
add esp, 4
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x28], eax
add eax, 8
mov ecx, eax
mov dword [ebp + 8], eax
push ebx
call fcn.10005240
mov ecx, dword [ebp + 8]
lea eax, [ebx + 0x18]
add ecx, 0x18
mov byte [ebp - 4], 3
push eax
call fcn.10005050
mov ebx, dword [ebp - 0x10]
mov byte [ebp - 4], 4
mov eax, dword [ebx + 8]
inc eax
movd xmm0, eax
cvtdq2pd xmm0, xmm0
shr eax, 0x1f
addsd xmm0, qword [eax*8 + 0x10021200]
mov eax, dword [ebx + 0x1c]
cvtpd2ps xmm1, xmm0
movd xmm0, eax
cvtdq2pd xmm0, xmm0
shr eax, 0x1f
addsd xmm0, qword [eax*8 + 0x10021200]
cvtpd2ps xmm0, xmm0
divss xmm1, xmm0
comiss xmm1, dword [ebx]
seta al
test al, al
je 0x1000312d
mov ecx, ebx
call fcn.10007f70
push edi
push dword [ebp + 8]
lea eax, [ebp - 0x34]
mov ecx, ebx
push eax
call fcn.100044c0
mov ecx, dword [eax]
mov eax, dword [eax + 4]
mov dword [ebp - 0x24], ecx
mov dword [ebp - 0x20], eax
jmp 0x10003130
mov ecx, dword [ebp - 0x24]
push dword [ebp - 0x18]
mov dword [ebp - 0x28], 0
push ecx
push edi
mov ecx, ebx
call fcn.10007f10
mov byte [ebp - 4], 1
jmp 0x1000314c
mov ebx, dword [ebp - 0x10]
mov esi, dword [esi]
cmp esi, dword [ebp - 0x1c]
jne 0x10003020
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
push str.unordered_map_set_too_long
call fcn.10011e24
int3
Function at 0x10005ea0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push esi
mov esi, ecx
push edi
mov edi, dword [ebp + 8]
test esi, esi
je 0x10005f0d
cmp byte [esi + 0x20], 6
jne 0x10005f0d
cmp dword [ebp + 0x1c], 7
mov ecx, 0x811c9dc5
mov eax, dword [ebp + 0x18]
push ebx
lea ebx, [ebp + 8]
mov dword [ebp - 4], esi
cmova ebx, edi
xor edx, edx
add eax, eax
je 0x10005eec
mov dword [ebp - 4], esi
mov edi, eax
movzx eax, byte [edx + ebx]
inc edx
xor eax, ecx
imul ecx, eax, 0x1000193
cmp edx, edi
jb 0x10005ed8
mov edi, dword [ebp + 8]
push ecx
mov ecx, dword [ebp - 4]
lea eax, [ebp + 8]
push eax
lea eax, [ebp - 0xc]
push eax
call fcn.100044c0
pop ebx
mov eax, dword [eax + 4]
test eax, eax
je 0x10005f0d
cmp eax, dword [esi + 4]
lea esi, [eax + 0x20]
jne 0x10005f12
mov esi, 0x1002fd20
mov eax, dword [ebp + 0x1c]
cmp eax, 7
jbe 0x10005f45
lea ecx, [eax*2 + 2]
mov eax, edi
cmp ecx, 0x1000
jb 0x10005f3b
mov edi, dword [eax - 4]
add ecx, 0x23
sub eax, edi
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x10005f4f
push ecx
push edi
call fcn.10013c1b
add esp, 8
pop edi
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret 0x18
call fcn.100155a0
int3
Function at 0x100080a0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
mov dword [ebp - 4], ecx
cmp edx, eax
je 0x1000823c
cmp dword [edx + 0x1c], 7
mov eax, dword [ecx + 4]
push esi
mov dword [ebp - 0x18], eax
mov esi, edx
mov eax, dword [ecx + 0xc]
push edi
mov dword [ebp - 0x14], eax
lea edi, [edx + 8]
mov eax, dword [edx + 4]
mov dword [ebp - 8], eax
mov eax, dword [edi + 0x10]
jbe 0x100080db
mov edi, dword [edi]
xor edx, edx
push ebx
mov ebx, 0x811c9dc5
add eax, eax
je 0x10008104
mov ecx, eax
nop dword [eax]
movzx eax, byte [edx + edi]
inc edx
xor eax, ebx
imul ebx, eax, 0x1000193
cmp edx, ecx
jb 0x100080f0
mov ecx, dword [ebp - 4]
mov eax, dword [ecx + 0x18]
mov ecx, dword [ebp - 0x14]
and eax, ebx
lea eax, [ecx + eax*8]
mov ecx, dword [eax]
mov dword [ebp - 0xc], eax
mov eax, dword [eax + 4]
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0x1c], eax
nop dword [eax]
mov edi, esi
mov ebx, esi
mov esi, dword [esi]
lea ecx, [edi + 8]
call fcn.10005b10
push 0x48
push edi
call fcn.10013c1b
mov eax, dword [ebp - 4]
add esp, 8
dec dword [eax + 8]
cmp ebx, dword [ebp - 0x1c]
je 0x10008169
mov eax, dword [ebp + 0xc]
cmp esi, eax
jne 0x10008120
mov ecx, dword [ebp - 0x10]
cmp ecx, dword [ebp + 8]
jne 0x10008158
mov edx, dword [ebp - 0xc]
mov dword [edx], esi
mov ecx, dword [ebp - 8]
pop ebx
pop edi
mov dword [ecx], esi
mov dword [esi + 4], ecx
pop esi
mov esp, ebp
pop ebp
ret 8
mov ecx, dword [ebp - 0x10]
mov edx, dword [ebp - 0xc]
cmp ecx, dword [ebp + 8]
jne 0x1000817b
mov ecx, dword [ebp - 0x18]
mov dword [edx], ecx
jmp 0x1000817e
mov ecx, dword [ebp - 8]
mov dword [edx + 4], ecx
mov ecx, dword [ebp + 0xc]
cmp esi, ecx
je 0x1000822f
nop dword [eax]
cmp dword [esi + 0x1c], 7
lea edx, [esi + 8]
mov ebx, dword [edx + 0x10]
jbe 0x1000819e
mov edx, dword [edx]
xor ecx, ecx
mov edi, 0x811c9dc5
add ebx, ebx
je 0x100081c4
nop dword [eax]
movzx eax, byte [ecx + edx]
inc ecx
xor eax, edi
imul edi, eax, 0x1000193
cmp ecx, ebx
jb 0x100081b0
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x18]
mov ecx, dword [ebp - 0x14]
and eax, edi
lea eax, [ecx + eax*8]
mov dword [ebp + 8], eax
mov eax, dword [eax + 4]
mov dword [ebp - 0x1c], eax
mov edi, esi
mov ebx, esi
mov esi, dword [esi]
lea ecx, [edi + 8]
call fcn.10005b10
push 0x48
push edi
call fcn.10013c1b
mov eax, dword [ebp - 4]
add esp, 8
dec dword [eax + 8]
cmp ebx, dword [ebp - 0x1c]
je 0x10008219
mov eax, dword [ebp + 0xc]
cmp esi, eax
jne 0x100081d8
mov ecx, dword [ebp + 8]
pop ebx
pop edi
mov dword [ecx], esi
mov ecx, dword [ebp - 8]
mov dword [ecx], esi
mov dword [esi + 4], ecx
pop esi
mov esp, ebp
pop ebp
ret 8
mov ecx, dword [ebp + 8]
mov edi, dword [ebp - 0x18]
mov dword [ecx], edi
mov dword [ecx + 4], edi
mov ecx, dword [ebp + 0xc]
cmp esi, ecx
jne 0x10008190
mov eax, dword [ebp - 8]
pop ebx
pop edi
mov dword [eax], esi
mov dword [esi + 4], eax
mov eax, ecx
pop esi
mov esp, ebp
pop ebp
ret 8
Function at 0x100087f0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov edx, dword [ebp + 8]
mov eax, ecx
push ebx
push esi
push edi
cmp dword [edx + 0x14], 7
mov edi, edx
mov ebx, dword [edx + 0x10]
mov dword [ebp - 4], eax
jbe 0x1000880e
mov edi, dword [edx]
xor ecx, ecx
mov esi, 0x811c9dc5
add ebx, ebx
je 0x10008834
nop dword [eax]
movzx eax, byte [ecx + edi]
inc ecx
xor eax, esi
imul esi, eax, 0x1000193
cmp ecx, ebx
jb 0x10008820
mov eax, dword [ebp - 4]
push esi
push edx
lea ecx, [ebp - 8]
push ecx
mov ecx, eax
call fcn.100044c0
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
test eax, eax
je 0x10008854
add eax, 0x20
mov esp, ebp
pop ebp
ret 4
push str.invalid_unordered_map_K__T__key
call fcn.10011e44
int3
Function at 0x1000a7f0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1001ea45
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push esi
push edi
mov eax, dword [0x1002f4c0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edx, ecx
mov dword [ebp - 0x10], edx
mov edi, dword [ebp + 0xc]
mov dword [ebp - 0x14], edi
cmp dword [edi + 0x14], 7
mov ecx, dword [edi + 0x10]
jbe 0x1000a830
mov eax, dword [edi]
mov dword [ebp - 0x14], eax
lea eax, [ecx + ecx]
mov esi, 0x811c9dc5
xor ecx, ecx
test eax, eax
je 0x1000a85a
mov edx, dword [ebp - 0x14]
mov edi, eax
movzx eax, byte [ecx + edx]
inc ecx
xor eax, esi
imul esi, eax, 0x1000193
cmp ecx, edi
jb 0x1000a843
mov edi, dword [ebp + 0xc]
mov edx, dword [ebp - 0x10]
push esi
push edi
lea eax, [ebp - 0x18]
mov ecx, edx
push eax
call fcn.100044c0
mov ecx, dword [ebp - 0x14]
test ecx, ecx
je 0x1000a88a
mov eax, dword [ebp + 8]
mov dword [eax], ecx
mov byte [eax + 4], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 0xc
mov eax, dword [ebp - 0x10]
cmp dword [eax + 8], 0x4924924
je 0x1000a9bf
add eax, 4
mov dword [ebp - 0x20], eax
push 0x38
mov dword [ebp - 4], 0
mov dword [ebp - 0x1c], 0
call fcn.10013beb
xorps xmm0, xmm0
mov dword [ebp - 0x1c], eax
movups xmmword [eax + 8], xmm0
mov dword [eax + 0x18], 0
add esp, 4
mov dword [eax + 0x1c], 0
lea ecx, [eax + 8]
movups xmm0, xmmword [edi]
xor eax, eax
movups xmmword [ecx], xmm0
movq xmm0, qword [edi + 0x10]
movq qword [ecx + 0x10], xmm0
xorps xmm0, xmm0
mov word [edi], ax
mov dword [edi + 0x10], 0
mov dword [edi + 0x14], 7
movups xmmword [ecx + 0x18], xmm0
mov dword [ecx + 0x28], eax
mov dword [ecx + 0x2c], eax
mov eax, dword [ebp + 0x10]
movups xmm0, xmmword [eax]
movups xmmword [ecx + 0x18], xmm0
movq xmm0, qword [eax + 0x10]
movq qword [ecx + 0x28], xmm0
xor ecx, ecx
mov dword [eax + 0x10], 0
mov dword [eax + 0x14], 7
mov word [eax], cx
mov edi, dword [ebp - 0x10]
mov dword [ebp - 4], 1
mov eax, dword [edi + 8]
inc eax
movd xmm0, eax
cvtdq2pd xmm0, xmm0
shr eax, 0x1f
addsd xmm0, qword [eax*8 + 0x10021200]
mov eax, dword [edi + 0x1c]
cvtpd2ps xmm1, xmm0
movd xmm0, eax
cvtdq2pd xmm0, xmm0
shr eax, 0x1f
addsd xmm0, qword [eax*8 + 0x10021200]
cvtpd2ps xmm0, xmm0
divss xmm1, xmm0
comiss xmm1, dword [edi]
jbe 0x1000a992
mov ecx, edi
call fcn.1000f490
mov eax, dword [ebp - 0x1c]
mov ecx, edi
push esi
add eax, 8
push eax
lea eax, [ebp - 0x18]
push eax
call fcn.100044c0
mov ecx, dword [eax]
jmp 0x1000a995
mov ecx, dword [ebp - 0x18]
push dword [ebp - 0x1c]
push ecx
push esi
mov ecx, edi
call fcn.10007f10
mov ecx, dword [ebp + 8]
mov dword [ecx], eax
mov eax, ecx
mov byte [ecx + 4], 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 0xc
push str.unordered_map_set_too_long
call fcn.10011e24
int3
Function at 0x1000acd0
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1001eb10
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x1002f4c0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
lea ebx, [esi + 4]
mov dword [esi], vtable.std::basic_streambuf_char__struct_std::char_traits_char__.0
push 8
mov dword [ebx], 0
mov dword [esi + 8], 0
mov dword [esi + 0xc], 0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
mov dword [esi + 0x18], 0
mov dword [esi + 0x1c], 0
mov dword [esi + 0x20], 0
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x2c], 0
mov dword [esi + 0x30], 0
call fcn.10013beb
mov edi, eax
add esp, 4
test edi, edi
je 0x1000ad7d
push 1
mov dword [ebp - 4], 0
call fcn.10012012
add esp, 4
mov dword [edi + 4], eax
jmp 0x1000ad7f
xor edi, edi
mov ecx, esi
mov dword [esi + 0x34], edi
call fcn.1000ee40
mov dword [esi + 0xc], ebx
lea eax, [esi + 8]
mov dword [esi + 0x10], eax
lea ecx, [esi + 0x14]
mov dword [esi], vtable.std::basic_filebuf_char__struct_std::char_traits_char__.0
lea edx, [esi + 0x18]
mov byte [esi + 0x48], 0
lea edi, [esi + 0x24]
mov byte [esi + 0x3d], 0
lea ebx, [esi + 0x28]
mov dword [esi + 0x1c], ecx
mov dword [esi + 0x20], edx
mov dword [esi + 0x2c], edi
mov dword [esi + 0x30], ebx
mov dword [eax], 0
mov dword [edx], 0
mov dword [esi + 0x28], 0
mov dword [esi + 4], 0
mov dword [ecx], 0
mov dword [edi], 0
mov dword [esi + 0x4c], 0
mov eax, dword [0x1002fdc8]
mov ecx, dword [0x1002fdcc]
mov dword [esi + 0x40], eax
mov eax, esi
mov dword [esi + 0x44], ecx
mov dword [esi + 0x38], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret