joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1010eff0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
mov dword [ebp - 4], ecx
cmp edx, eax
je 0x1010f164
cmp dword [edx + 0x1c], 0x10
mov eax, dword [ecx + 4]
push ebx
push esi
mov dword [ebp - 0x14], eax
mov esi, edx
mov eax, dword [ecx + 0xc]
push edi
mov dword [ebp - 0x10], eax
lea edi, [edx + 8]
mov eax, dword [edx + 4]
mov dword [ebp - 0x18], eax
mov eax, dword [edi + 0x10]
jb 0x1010f02c
mov edi, dword [edi]
xor edx, edx
mov ebx, 0x811c9dc5
test eax, eax
je 0x1010f054
mov ecx, eax
nop dword [eax]
movzx eax, byte [edx + edi]
inc edx
xor eax, ebx
imul ebx, eax, 0x1000193
cmp edx, ecx
jb 0x1010f040
mov ecx, dword [ebp - 4]
mov eax, dword [ecx + 0x18]
mov ecx, dword [ebp - 0x10]
and eax, ebx
lea eax, [ecx + eax*8]
mov ecx, dword [eax]
mov dword [ebp - 8], eax
mov eax, dword [eax + 4]
mov dword [ebp - 0xc], ecx
mov dword [ebp - 0x1c], eax
nop dword [eax]
mov edi, esi
mov ebx, esi
mov esi, dword [esi]
lea ecx, [edi + 8]
call fcn.1010d770
push 0x30
push edi
call fcn.10138f1a
mov eax, dword [ebp - 4]
add esp, 8
dec dword [eax + 8]
cmp ebx, dword [ebp - 0x1c]
je 0x1010f0be
cmp esi, dword [ebp + 0xc]
jne 0x1010f070
mov ecx, dword [ebp - 0xc]
cmp ecx, dword [ebp + 8]
jne 0x1010f156
mov eax, dword [ebp - 0x18]
mov edx, dword [ebp - 8]
pop edi
mov dword [edx], esi
mov dword [eax], esi
mov dword [esi + 4], eax
mov eax, dword [ebp + 0xc]
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
mov ecx, dword [ebp - 0xc]
mov edx, dword [ebp - 8]
cmp ecx, dword [ebp + 8]
jne 0x1010f0d0
mov ecx, dword [ebp - 0x14]
mov dword [edx], ecx
jmp 0x1010f0d3
mov ecx, dword [ebp - 0x18]
mov dword [edx + 4], ecx
cmp esi, dword [ebp + 0xc]
je 0x1010f156
nop dword [eax + eax]
cmp dword [esi + 0x1c], 0x10
lea edx, [esi + 8]
mov ebx, dword [edx + 0x10]
jb 0x1010f0ee
mov edx, dword [edx]
xor ecx, ecx
mov edi, 0x811c9dc5
test ebx, ebx
je 0x1010f114
nop dword [eax]
movzx eax, byte [ecx + edx]
inc ecx
xor eax, edi
imul edi, eax, 0x1000193
cmp ecx, ebx
jb 0x1010f100
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x18]
mov ecx, dword [ebp - 0x10]
and eax, edi
lea eax, [ecx + eax*8]
mov dword [ebp + 8], eax
mov eax, dword [eax + 4]
mov dword [ebp - 0x1c], eax
mov edi, esi
mov ebx, esi
mov esi, dword [esi]
lea ecx, [edi + 8]
call fcn.1010d770
push 0x30
push edi
call fcn.10138f1a
mov eax, dword [ebp - 4]
add esp, 8
dec dword [eax + 8]
cmp ebx, dword [ebp - 0x1c]
je 0x1010f16a
cmp esi, dword [ebp + 0xc]
jne 0x1010f128
mov ecx, dword [ebp + 8]
mov dword [ecx], esi
mov eax, dword [ebp - 0x18]
pop edi
mov dword [eax], esi
mov dword [esi + 4], eax
mov eax, dword [ebp + 0xc]
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
mov ecx, dword [ebp + 8]
mov edi, dword [ebp - 0x14]
mov dword [ecx], edi
mov dword [ecx + 4], edi
cmp esi, dword [ebp + 0xc]
jne 0x1010f0e0
mov eax, dword [ebp - 0x18]
pop edi
mov dword [eax], esi
mov dword [esi + 4], eax
mov eax, dword [ebp + 0xc]
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x10111140
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
push esi
call fcn.10112010
push 2
push esi
mov edi, eax
call fcn.101164f0
add esp, 0xc
push 0
push 2
push esi
test eax, eax
je 0x10111172
call fcn.101171e0
add esp, 0xc
jmp 0x10111186
call fcn.101172d0
add esp, 4
fstp qword [esp]
call dword [sym.imp.api_ms_win_crt_math_l1_1_0.dll_llround]
add esp, 8
mov edx, eax
movzx eax, dl
xor eax, 0x811c9dc5
mov dword [ebp - 4], edx
imul ecx, eax, 0x1000193
mov eax, edx
shr eax, 8
movzx eax, al
xor ecx, eax
mov eax, edx
shr eax, 0x10
imul ecx, ecx, 0x1000193
movzx eax, al
shr edx, 0x18
xor ecx, eax
imul eax, ecx, 0x1000193
mov ecx, edi
xor eax, edx
imul ebx, eax, 0x1000193
lea eax, [ebp - 4]
push ebx
push eax
lea eax, [ebp - 0xc]
push eax
call fcn.10059950
mov esi, dword [eax + 4]
test esi, esi
je 0x10111231
mov ecx, dword [edi + 0x18]
mov edx, dword [edi + 0xc]
and ecx, ebx
mov eax, dword [edx + ecx*8]
cmp dword [edx + ecx*8 + 4], esi
jne 0x10111205
cmp eax, esi
jne 0x101111fc
mov eax, dword [edi + 4]
mov dword [edx + ecx*8], eax
mov dword [edx + ecx*8 + 4], eax
jmp 0x1011120e
mov eax, dword [esi + 4]
mov dword [edx + ecx*8 + 4], eax
jmp 0x1011120e
cmp eax, esi
jne 0x1011120e
mov eax, dword [esi]
mov dword [edx + ecx*8], eax
mov ecx, dword [esi]
dec dword [edi + 8]
mov eax, dword [esi + 4]
mov dword [eax], ecx
mov eax, dword [esi + 4]
mov dword [ecx + 4], eax
lea ecx, [esi + 0xc]
call fcn.1010d4d0
push 0x2c
push esi
call fcn.10138f1a
add esp, 8
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10111240
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
mov eax, dword [0x1029ad64]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x24]
push edi
push eax
push 1
push esi
mov dword [ebp - 0x24], 0
mov dword [ebp - 0x20], 0
call fcn.1010cca0
mov dword [ebp - 0x28], eax
lea eax, [ebp - 0x20]
push eax
push 2
push esi
call fcn.10117240
add esp, 0x18
mov dword [ebp - 0x1c], 0
lea ecx, [ebp - 0x1c]
mov dword [ebp - 0xc], 0
mov dword [ebp - 8], 0xf
push dword [ebp - 0x20]
push eax
call fcn.100464c0
mov eax, dword [ebp - 8]
lea edx, [ebp - 0x1c]
mov ebx, dword [ebp - 0x1c]
cmp eax, 0x10
mov esi, dword [ebp - 0xc]
mov edi, 0x811c9dc5
cmovae edx, ebx
mov dword [ebp - 0x20], eax
xor ecx, ecx
test esi, esi
je 0x101112d4
movzx eax, byte [ecx + edx]
inc ecx
xor eax, edi
imul edi, eax, 0x1000193
cmp ecx, esi
jb 0x101112c3
mov ecx, dword [ebp - 0x28]
lea eax, [ebp - 0x1c]
push edi
push eax
lea eax, [ebp - 0x30]
push eax
call fcn.100e6fc0
mov esi, dword [eax + 4]
test esi, esi
je 0x10111342
mov edx, dword [ebp - 0x28]
mov ecx, dword [edx + 0x18]
mov eax, dword [edx + 0xc]
and ecx, edi
lea ecx, [eax + ecx*8]
mov eax, dword [ecx]
cmp dword [ecx + 4], esi
jne 0x10111317
cmp eax, esi
jne 0x1011130f
mov eax, dword [edx + 4]
mov dword [ecx], eax
mov dword [ecx + 4], eax
jmp 0x1011131f
mov eax, dword [esi + 4]
mov dword [ecx + 4], eax
jmp 0x1011131f
cmp eax, esi
jne 0x1011131f
mov eax, dword [esi]
mov dword [ecx], eax
mov ecx, dword [esi]
dec dword [edx + 8]
mov eax, dword [esi + 4]
mov dword [eax], ecx
mov eax, dword [esi + 4]
mov dword [ecx + 4], eax
lea ecx, [esi + 8]
call fcn.1010d770
push 0x30
push esi
call fcn.10138f1a
add esp, 8
mov ecx, dword [ebp - 0x20]
cmp ecx, 0x10
jb 0x10111375
inc ecx
mov eax, ebx
cmp ecx, 0x1000
jb 0x1011136b
mov ebx, dword [ebx - 4]
add ecx, 0x23
sub eax, ebx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x1011136b
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push ecx
push ebx
call fcn.10138f1a
add esp, 8
mov ecx, dword [ebp - 4]
xor eax, eax
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10139242
mov esp, ebp
pop ebp
ret
Function at 0x101117d0
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push esi
mov esi, dword [ebp + 8]
push edi
push esi
call fcn.10112010
push 0xffffffffffffffff
push esi
mov edi, eax
call fcn.101164f0
add esp, 0xc
push 0
push 0xffffffffffffffff
push esi
test eax, eax
je 0x10111801
call fcn.101171e0
add esp, 0xc
jmp 0x10111815
call fcn.101172d0
add esp, 4
fstp qword [esp]
call dword [sym.imp.api_ms_win_crt_math_l1_1_0.dll_llround]
add esp, 8
mov edx, eax
movzx eax, dl
xor eax, 0x811c9dc5
mov dword [ebp - 4], edx
imul ecx, eax, 0x1000193
mov eax, edx
shr eax, 8
movzx eax, al
xor ecx, eax
mov eax, edx
shr eax, 0x10
imul ecx, ecx, 0x1000193
movzx eax, al
shr edx, 0x18
xor ecx, eax
imul eax, ecx, 0x1000193
mov ecx, edi
xor eax, edx
imul eax, eax, 0x1000193
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0xc]
push eax
call fcn.10059950
mov eax, dword [eax + 4]
test eax, eax
je 0x1011186f
mov ecx, dword [edi + 4]
jmp 0x10111874
mov eax, dword [edi + 4]
mov ecx, eax
cmp eax, ecx
jne 0x10111889
push esi
call fcn.10116930
add esp, 4
xor eax, eax
pop edi
pop esi
mov esp, ebp
pop ebp
ret
add eax, 0xc
mov dword [ebp - 4], esi
push eax
lea eax, [ebp - 4]
push eax
push esi
call fcn.1010c8d0
add esp, 0xc
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x101118b0
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4c
mov eax, dword [0x1029ad64]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
lea eax, [ebp - 0x2c]
push esi
push edi
push eax
push 1
push ebx
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x2c], 0
mov dword [ebp - 0x28], 0
call fcn.1010cca0
mov dword [ebp - 0x28], eax
lea eax, [ebp - 0x30]
push eax
push 0xffffffffffffffff
push ebx
call fcn.10117240
add esp, 0x18
mov dword [ebp - 0x1c], 0
lea ecx, [ebp - 0x1c]
mov dword [ebp - 0xc], 0
mov dword [ebp - 8], 0xf
push dword [ebp - 0x30]
push eax
call fcn.100464c0
cmp dword [ebp - 8], 0x10
lea edi, [ebp - 0x1c]
mov esi, dword [ebp - 0x1c]
mov edx, 0x811c9dc5
mov ebx, dword [ebp - 0xc]
setae byte [ebp - 0x1d]
cmovae edi, esi
xor ecx, ecx
test ebx, ebx
je 0x10111946
movzx eax, byte [ecx + edi]
inc ecx
xor eax, edx
imul edx, eax, 0x1000193
cmp ecx, ebx
jb 0x10111935
mov ebx, dword [ebp - 0x28]
lea eax, [ebp - 0x1c]
push edx
push eax
lea eax, [ebp - 0x34]
mov ecx, ebx
push eax
call fcn.100e6fc0
mov eax, dword [eax + 4]
test eax, eax
je 0x10111965
mov ecx, dword [ebx + 4]
jmp 0x1011196a
mov eax, dword [ebx + 4]
mov ecx, eax
mov dword [ebp - 0x28], eax
cmp eax, ecx
jne 0x10111982
push dword [ebp - 0x24]
call fcn.10116930
add esp, 4
xor edi, edi
xor ebx, ebx
jmp 0x1011199e
lea eax, [ebp - 0x28]
push eax
push dword [ebp - 0x24]
lea eax, [ebp - 0x4c]
push dword [ebp - 0x28]
push eax
call fcn.1010bc30
mov ebx, dword [ebp - 0x48]
add esp, 0x10
mov edi, dword [ebp - 0x4c]
cmp byte [ebp - 0x1d], 0
je 0x101119d2
mov ecx, dword [ebp - 8]
mov eax, esi
inc ecx
cmp ecx, 0x1000
jb 0x101119c8
mov esi, dword [esi - 4]
add ecx, 0x23
sub eax, esi
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x101119c8
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push ecx
push esi
call fcn.10138f1a
add esp, 8
test ebx, ebx
je 0x101119f0
push dword [ebp - 0x38]
push dword [ebp - 0x3c]
push dword [ebp - 0x40]
push dword [ebp - 0x44]
push ebx
push dword [ebp - 0x24]
call fcn.10117db0
add esp, 0x18
mov edi, eax
mov ecx, dword [ebp - 4]
mov eax, edi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10139242
mov esp, ebp
pop ebp
ret
Function at 0x10112790
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
push edi
mov edi, dword [ebp + 0x10]
mov esi, ecx
movzx eax, byte [edi]
xor eax, 0x811c9dc5
imul edx, eax, 0x1000193
movzx eax, byte [edi + 1]
xor edx, eax
movzx eax, byte [edi + 2]
imul edx, edx, 0x1000193
xor edx, eax
movzx eax, byte [edi + 3]
imul ecx, edx, 0x1000193
xor ecx, eax
imul edx, ecx, 0x1000193
mov ecx, dword [ebp + 0xc]
mov dword [ebp + 0x10], edx
cmp ecx, dword [esi + 4]
je 0x101127e6
mov eax, dword [ecx + 8]
cmp eax, dword [edi]
jne 0x101127e6
mov ebx, dword [ecx]
jmp 0x101127f9
push edx
push edi
lea eax, [ebp - 0xc]
mov ecx, esi
push eax
call fcn.10059950
mov ecx, dword [ebp - 8]
mov ebx, dword [ebp - 0xc]
test ecx, ecx
je 0x1011280d
mov edx, dword [ebp + 8]
mov eax, edx
pop edi
pop esi
pop ebx
mov dword [edx], ecx
mov esp, ebp
pop ebp
ret 0xc
cmp dword [esi + 8], 0x5d1745d
je 0x101128ce
push 0x2c
call fcn.10138eea
mov dword [ebp - 4], eax
lea edx, [edi + 4]
mov eax, dword [edi]
add esp, 4
mov edi, dword [ebp - 4]
push edx
lea ecx, [edi + 0xc]
mov dword [edi + 8], eax
call fcn.1010cef0
mov eax, dword [esi + 8]
inc eax
movd xmm0, eax
cvtdq2pd xmm0, xmm0
shr eax, 0x1f
addsd xmm0, qword [eax*8 + 0x1019e920]
mov eax, dword [esi + 0x1c]
cvtpd2ps xmm1, xmm0
movd xmm0, eax
cvtdq2pd xmm0, xmm0
shr eax, 0x1f
addsd xmm0, qword [eax*8 + 0x1019e920]
cvtpd2ps xmm0, xmm0
divss xmm1, xmm0
comiss xmm1, dword [esi]
jbe 0x10112894
mov ecx, esi
call fcn.1010eb30
mov ecx, dword [ebp + 0xc]
cmp ecx, dword [esi + 4]
je 0x101128b3
mov eax, dword [ecx + 8]
cmp eax, dword [edi + 8]
jne 0x101128b3
mov ebx, dword [ecx]
mov edi, dword [ebp + 0x10]
push dword [ebp - 4]
mov ecx, esi
push ebx
push edi
call fcn.1010e740
mov edx, dword [ebp + 8]
pop edi
pop esi
pop ebx
mov dword [edx], eax
mov eax, edx
mov esp, ebp
pop ebp
ret 0xc
mov eax, dword [ebp - 4]
mov ecx, esi
mov edi, dword [ebp + 0x10]
add eax, 8
push edi
push eax
lea eax, [ebp - 0xc]
push eax
call fcn.10059950
mov ebx, dword [ebp - 0xc]
jmp 0x10112897
push str.unordered_map_set_too_long
call sub.MSVCP140.dll_void___cdecl_std::_Xlength_error_char_const__
int3
Function at 0x10114cf0
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x54
mov eax, dword [ebp + 0x1c]
push esi
mov esi, dword [ebp + 0x18]
push edi
mov edi, dword [ebp + 0x14]
push esi
push eax
mov dword [ebp + 0x14], eax
call fcn.101164f0
add esp, 8
push 0
push esi
push dword [ebp + 0x14]
test eax, eax
je 0x10114d22
call fcn.101171e0
add esp, 0xc
jmp 0x10114d36
call fcn.101172d0
add esp, 4
fstp qword [esp]
call dword [sym.imp.api_ms_win_crt_math_l1_1_0.dll_llround]
add esp, 8
mov edx, eax
movzx eax, dl
xor eax, 0x811c9dc5
mov dword [ebp + 0x14], edx
imul ecx, eax, 0x1000193
mov eax, edx
shr eax, 8
movzx eax, al
mov dword [ebp - 4], edx
xor ecx, eax
mov eax, edx
imul ecx, ecx, 0x1000193
shr eax, 0x10
movzx eax, al
xor ecx, eax
mov eax, edx
imul ecx, ecx, 0x1000193
shr eax, 0x18
xor ecx, eax
imul eax, ecx, 0x1000193
mov ecx, edi
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x10]
push eax
call fcn.10059950
mov esi, dword [eax + 4]
test esi, esi
je 0x10114d95
mov eax, dword [edi + 4]
jmp 0x10114d9a
mov esi, dword [edi + 4]
mov eax, esi
mov ecx, dword [ebp + 0x24]
cmp esi, eax
mov eax, dword [ebp + 0x20]
mov dword [ebp - 8], eax
lea eax, [ebp - 0x30]
mov dword [ebp - 4], ecx
lea ecx, [ebp - 8]
push eax
jne 0x10114ddf
call fcn.1010adb0
mov edx, dword [ebp + 0x14]
lea ecx, [ebp - 0x50]
push eax
mov dword [ebp - 0x54], edx
call fcn.1010cef0
lea eax, [ebp - 0x54]
mov ecx, edi
push eax
push esi
lea eax, [ebp + 0x14]
push eax
call fcn.10112790
lea ecx, [ebp - 0x50]
call fcn.1010d4d0
jmp 0x10114e4c
call fcn.1010adb0
mov edi, eax
add esi, 0xc
cmp esi, edi
je 0x10114e4c
mov ecx, esi
call fcn.101107a0
mov ecx, dword [edi]
mov dword [esi], ecx
mov ecx, dword [esi + 4]
mov eax, dword [edi + 4]
mov dword [esi + 4], eax
mov eax, dword [edi + 8]
mov dword [edi + 4], ecx
mov ecx, dword [esi + 8]
mov dword [esi + 8], eax
mov eax, dword [edi + 0xc]
mov dword [edi + 8], ecx
mov ecx, dword [esi + 0xc]
mov dword [esi + 0xc], eax
mov eax, dword [edi + 0x10]
mov dword [edi + 0xc], ecx
mov ecx, dword [esi + 0x10]
mov dword [esi + 0x10], eax
mov eax, dword [edi + 0x14]
mov dword [edi + 0x10], ecx
mov ecx, dword [esi + 0x14]
mov dword [esi + 0x14], eax
mov eax, dword [edi + 0x18]
mov dword [edi + 0x14], ecx
mov ecx, dword [esi + 0x18]
mov dword [esi + 0x18], eax
mov eax, dword [edi + 0x1c]
mov dword [edi + 0x18], ecx
mov ecx, dword [esi + 0x1c]
mov dword [esi + 0x1c], eax
mov dword [edi + 0x1c], ecx
lea ecx, [ebp - 0x30]
call fcn.1010d4d0
mov eax, dword [ebp + 8]
pop edi
pop esi
mov dword [eax + 4], 0
mov dword [eax], 0
mov esp, ebp
pop ebp
ret
Function at 0x10115260
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
mov ebx, dword [ebp + 8]
push edi
mov edi, ecx
cmp ebx, 0xffffffff
je 0x10115394
cmp dword [edi + 0xc], ebx
jbe 0x1011539c
mov edx, dword [edi]
mov eax, ebx
shr eax, 5
mov ecx, ebx
shl eax, 2
and ecx, 0x1f
add edx, eax
mov dword [ebp - 0x10], eax
mov eax, 1
mov dword [ebp - 0x14], ecx
shl eax, cl
test dword [edx], eax
je 0x10115394
mov ecx, dword [edi + 0x20]
mov eax, 0x2aaaaaab
push esi
mov esi, dword [edi + 0x1c]
sub ecx, esi
imul ecx
sar edx, 1
mov eax, edx
shr eax, 0x1f
add eax, edx
cmp eax, ebx
jbe 0x101153a3
lea eax, [ebx + ebx*2]
lea ecx, [esi + eax*4]
mov eax, dword [ecx + 4]
mov esi, dword [ecx]
mov dword [ebp - 8], ecx
cmp esi, eax
je 0x101152f6
mov ebx, eax
nop word [eax + eax]
mov ecx, esi
call fcn.1010d800
add esi, 0x48
cmp esi, ebx
jne 0x101152e0
mov ecx, dword [ebp - 8]
mov ebx, dword [ebp + 8]
mov esi, dword [ecx]
mov dword [ecx + 4], esi
call fcn.100c0e50
lea ecx, [ebp + 8]
push ecx
lea ecx, [ebp - 8]
push ecx
lea ecx, [eax + 0x28]
call fcn.1010b740
mov esi, eax
call fcn.100c0e50
lea ecx, [eax + 0x2c]
mov eax, dword [esi]
cmp eax, dword [ecx]
je 0x10115376
call fcn.100c0e50
lea esi, [eax + 0x28]
movzx eax, bl
xor eax, 0x811c9dc5
imul ecx, eax, 0x1000193
movzx eax, bh
xor ecx, eax
movzx eax, byte [ebp + 0xa]
imul ecx, ecx, 0x1000193
xor ecx, eax
movzx eax, byte [ebp + 0xb]
imul edx, ecx, 0x1000193
mov ecx, esi
xor edx, eax
imul eax, edx, 0x1000193
push eax
lea eax, [ebp + 8]
push eax
lea eax, [ebp - 0xc]
push eax
call fcn.10059950
mov ecx, dword [ebp - 8]
test ecx, ecx
je 0x101153a8
add ecx, 0xc
call fcn.101107a0
push ebx
lea ecx, [edi + 0x48]
call fcn.10115a20
pop esi
cmp dword [edi + 0xc], ebx
jbe 0x1011539c
mov ecx, dword [edi]
add ecx, dword [ebp - 0x10]
mov edx, dword [ebp - 0x14]
mov eax, dword [ecx]
btr eax, edx
mov dword [ecx], eax
pop edi
pop ebx
mov esp, ebp
pop ebp
ret 4
mov ecx, edi
call fcn.1010f1b0
call fcn.100a90e0
push str.invalid_unordered_map_K__T__key
call sub.MSVCP140.dll_void___cdecl_std::_Xout_of_range_char_const__
int3
Function at 0x10122d20
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
push ebx
mov esi, 1
call fcn.101163b0
mov edi, dword [ebp + 0x10]
add esp, 4
sub eax, edi
je 0x10122df4
dec eax
push edi
push ebx
mov dword [ebp - 4], eax
call fcn.101173e0
add esp, 8
cmp eax, 3
jne 0x10122dc4
push edi
push ebx
call fcn.101164f0
add esp, 8
push 0
push edi
push ebx
test eax, eax
je 0x10122d81
call fcn.101171e0
push edx
push eax
push str._lld
push dword [ebp + 0xc]
call fcn.101176e0
add esp, 0x1c
jmp 0x10122d9c
call fcn.101172d0
add esp, 4
fstp qword [esp]
push str._.14g
push dword [ebp + 0xc]
call fcn.101176e0
add esp, 0x10
test esi, esi
je 0x10122da4
test eax, eax
jg 0x10122ded
xor esi, esi
mov eax, dword [ebp - 4]
inc edi
test eax, eax
jne 0x10122d43
test esi, esi
jne 0x10122df4
push esi
push esi
push ebx
call fcn.10117ed0
add esp, 0xc
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea eax, [ebp + 0x10]
push eax
push edi
push ebx
call fcn.10117ae0
add esp, 0xc
test esi, esi
je 0x10122da4
push dword [ebp + 0xc]
push dword [ebp + 0x10]
push 1
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
add esp, 0x10
cmp eax, dword [ebp + 0x10]
jne 0x10122da4
mov esi, 1
jmp 0x10122da6
pop edi
pop esi
mov eax, 1
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10126a80
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x114
mov eax, dword [0x1029ad64]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push ebx
push esi
mov esi, dword [ebp + 0x10]
push edi
mov edi, dword [ebp + 8]
push str._5_3
push esi
mov dword [ebp - 0x114], eax
mov eax, dword [ebp + 0x14]
push str._s_s
push edi
mov dword [ebp - 0x110], eax
call fcn.10116840
push eax
call dword [sym.imp.api_ms_win_crt_environment_l1_1_0.dll_getenv]
mov ebx, eax
add esp, 0x14
test ebx, ebx
jne 0x10126adf
push esi
call dword [sym.imp.api_ms_win_crt_environment_l1_1_0.dll_getenv]
mov ebx, eax
add esp, 4
test ebx, ebx
je 0x10126b42
push str.LUA_NOENV
push 0xfff0b9d8
push edi
call fcn.101161f0
push 0xffffffffffffffff
push edi
call fcn.101171b0
push 0xfffffffffffffffe
push edi
mov esi, eax
call fcn.10116fc0
add esp, 0x1c
test esi, esi
jne 0x10126b42
push 0x101af0f4
push 0x101af0f8
push ebx
push edi
call fcn.10118020
push dword [ebp - 0x110]
push 0x101af0fc
push eax
push edi
call fcn.10118020
push 0xffffffffffffffff
push 0xfffffffffffffffe
push edi
call fcn.10116d60
push 0xfffffffffffffffe
push edi
call fcn.10116fc0
add esp, 0x34
jmp 0x10126b51
push dword [ebp - 0x110]
push edi
call fcn.10116970
add esp, 8
push 0x105
lea eax, [ebp - 0x10c]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
je 0x10126bbf
cmp eax, 0x105
je 0x10126bbf
lea eax, [ebp - 0x10c]
push 0x5c
push eax
call sub.VCRUNTIME140.dll_strrchr
add esp, 8
test eax, eax
je 0x10126bbf
mov byte [eax], 0
lea eax, [ebp - 0x10c]
push eax
push 0x101af0c0
push 0
push 0xffffffffffffffff
push edi
call fcn.10117240
add esp, 0xc
push eax
push edi
call fcn.10118020
push 0xffffffffffffffff
push 0xfffffffffffffffe
push edi
call fcn.10116d60
push 0xfffffffffffffffe
push edi
call fcn.10116fc0
add esp, 0x24
jmp 0x10126bcd
push str.unable_to_get_ModuleFileName
push edi
call fcn.10117db0
add esp, 8
push dword [ebp - 0x114]
push 0xfffffffffffffffd
push edi
call fcn.10116e00
push 0xfffffffffffffffe
push edi
call fcn.10116fc0
mov ecx, dword [ebp - 4]
add esp, 0x14
xor ecx, ebp
pop edi
pop esi
pop ebx
call fcn.10139242
mov esp, ebp
pop ebp
ret
Function at 0x101276e0
Capabilities:
Check http status code

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xdc
mov eax, dword [0x1029ad64]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 0xc]
lea eax, [ebp - 0xd8]
push esi
push edi
mov edi, dword [ebp + 8]
push eax
push edi
mov dword [ebp - 0xdc], ebx
call fcn.10126da0
mov esi, eax
add esp, 8
test esi, esi
je 0x10127747
mov ecx, dword [ebp - 0xd8]
sub esi, edi
mov edx, dword [ebp - 0xd4]
mov eax, 0x13
mov dword [ebx], ecx
mov dword [ebx + 4], edx
mov dword [ebx + 8], eax
lea eax, [esi + 1]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10139242
mov esp, ebp
pop ebp
ret
push 0x101af3b8
push edi
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strpbrk]
add esp, 8
test eax, eax
je 0x10127778
movzx ebx, byte [eax]
or ebx, 0x20
cmp ebx, 0x6e
jne 0x1012777a
pop edi
pop esi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10139242
mov esp, ebp
pop ebp
ret
xor ebx, ebx
push ebx
lea eax, [ebp - 0xd8]
push eax
push edi
call fcn.10126d30
mov esi, eax
add esp, 0xc
test esi, esi
jne 0x1012781b
push 0x2e
push edi
call sub.VCRUNTIME140.dll_strchr
mov edx, edi
mov esi, eax
add esp, 8
lea eax, [edx + 1]
mov cl, byte [edx]
inc edx
test cl, cl
jne 0x101277a7
sub edx, eax
cmp edx, 0xc8
ja 0x10127765
test esi, esi
je 0x10127765
lea edx, [ebp - 0xd0]
mov ecx, edi
sub edx, edi
mov al, byte [ecx]
lea ecx, [ecx + 1]
mov byte [edx + ecx - 1], al
test al, al
jne 0x101277c6
call dword [sym.imp.api_ms_win_crt_locale_l1_1_0.dll_localeconv]
sub esi, edi
push ebx
mov eax, dword [eax]
mov al, byte [eax]
mov byte [ebp + esi - 0xd0], al
lea eax, [ebp - 0xd8]
push eax
lea eax, [ebp - 0xd0]
push eax
call fcn.10126d30
mov esi, eax
add esp, 0xc
test esi, esi
je 0x10127765
mov eax, edi
lea ecx, [ebp - 0xd0]
sub eax, ecx
add esi, eax
test esi, esi
je 0x10127765
mov ebx, dword [ebp - 0xdc]
sub esi, edi
movsd xmm0, qword [ebp - 0xd8]
mov eax, 3
mov ecx, dword [ebp - 4]
pop edi
movsd qword [ebx], xmm0
xor ecx, ebp
mov dword [ebx + 8], eax
lea eax, [esi + 1]
pop esi
pop ebx
call fcn.10139242
mov esp, ebp
pop ebp
ret