joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100055c0
Capabilities:
Create process on windows
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10008720
mov eax, dword fs:[0]
push eax
sub esp, 0xc0
mov eax, dword [0x1000d008]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp dword [0x1000e458], 1
jne 0x100056b1
push ecx
lea ecx, [ebp - 0xcc]
call fcn.100021f0
sub esp, 8
mov dword [ebp - 4], 0
lea ecx, [ebp - 0xcc]
push dword [0x1000e448]
call fcn.10002080
push 0x100029b0
mov edx, str._________________________________________________________________
lea ecx, [ebp - 0xbc]
call fcn.10002770
mov ecx, eax
call dword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______thiscall_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char_______cdecl___class_std::basic_ostream_char__struct_std::char_traits_char_____]
mov edx, dword [0x1000e444]
lea ecx, [ebp - 0xbc]
push 0x100029b0
call fcn.10002770
mov edx, str.Critical_file__URL_content_or_executable_integrity_violation_detected_
mov ecx, eax
call fcn.10002770
mov ecx, eax
call dword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______thiscall_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char_______cdecl___class_std::basic_ostream_char__struct_std::char_traits_char_____]
mov edx, dword [0x1000e444]
lea ecx, [ebp - 0xbc]
push 0x100029b0
call fcn.10002770
mov edx, str.The_game_is_closing.
mov ecx, eax
call fcn.10002770
mov ecx, eax
call dword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______thiscall_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char_______cdecl___class_std::basic_ostream_char__struct_std::char_traits_char_____]
push 1
push 0
push 0
push dword [0x1000e448]
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
lea ecx, [ebp - 0xcc]
call fcn.100013c0
push 0
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
Function at 0x10006b80
Capabilities:
Create process on windows
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10008720
mov eax, dword fs:[0]
push eax
sub esp, 0xc0
mov eax, dword [0x1000d008]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp dword [0x1000e458], 1
jne 0x10006c71
push ecx
lea ecx, [ebp - 0xcc]
call fcn.100021f0
sub esp, 8
mov dword [ebp - 4], 0
lea ecx, [ebp - 0xcc]
push dword [0x1000e448]
call fcn.10002080
push 0x100029b0
mov edx, str._________________________________________________________________
lea ecx, [ebp - 0xbc]
call fcn.10002770
mov ecx, eax
call dword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______thiscall_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char_______cdecl___class_std::basic_ostream_char__struct_std::char_traits_char_____]
mov edx, dword [0x1000e444]
lea ecx, [ebp - 0xbc]
push 0x100029b0
call fcn.10002770
mov edx, str.Memory_Integrity_Violation_Detected_
mov ecx, eax
call fcn.10002770
mov ecx, eax
call dword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______thiscall_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char_______cdecl___class_std::basic_ostream_char__struct_std::char_traits_char_____]
mov edx, dword [0x1000e444]
lea ecx, [ebp - 0xbc]
push 0x100029b0
call fcn.10002770
mov edx, str.The_game_is_closing.
mov ecx, eax
call fcn.10002770
mov ecx, eax
call dword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______thiscall_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char_______cdecl___class_std::basic_ostream_char__struct_std::char_traits_char_____]
push 1
push 0
push 0
push dword [0x1000e448]
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
lea ecx, [ebp - 0xcc]
call fcn.100013c0
push 0
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
Function at 0x432000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
push 4
nop
nop
nop
nop
nop
nop
nop
pop edi
nop
nop
cmp eax, 0
nop
nop
nop
nop
je 0x432072
nop
nop
nop
mov ebx, 0x40c7d0
nop
nop
mov ecx, ebx
nop
nop
nop
nop
nop
nop
nop
sub ecx, eax
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
nop
nop
push eax
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
div edi
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
nop
pop eax
nop
nop
nop
mov esi, 0x216a18ca
nop
nop
nop
xor dword [eax], esi
nop
nop
add eax, edi
nop
nop
nop
nop
loop 0x432060
nop
nop
nop
nop
mov eax, section..data
nop
cmp eax, 0
nop
nop
nop
nop
nop
nop
je 0x4320d2
mov ebx, 0x42f314
nop
mov ecx, ebx
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
nop
push eax
nop
nop
nop
nop
nop
mov eax, ecx
nop
div edi
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
pop eax
nop
nop
nop
nop
mov esi, 0x77a85daf
xor dword [eax], esi
nop
nop
nop
nop
add eax, edi
nop
nop
nop
nop
nop
nop
nop
nop
loop 0x4320c0
nop
nop
nop
nop
popal
nop
jmp 0x431219
Function at 0x4b594d
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push dword [esp + 4]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x4b596d
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.004b4a5a
pop ecx
or eax, 0xffffffff
ret
test al, 1
je 0x4b5990
test byte [esp + 8], 2
je 0x4b5990
call fcn.004b4acd
mov dword [eax], 0xd
call fcn.004b4ad6
mov dword [eax], 5
jmp 0x4b5969
xor eax, eax
ret

Function at 0x4c6699
Capabilities:
Get graphical window text

Disassembly:
push esi
mov esi, ecx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x4c66d1
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
lea ecx, [eax + 1]
push ecx
mov ecx, dword [esp + 0xc]
push eax
call fcn.004c4726
push eax
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov ecx, dword [esp + 8]
push 0xffffffffffffffff
call fcn.004c46fe
jmp 0x4c66dd
mov eax, dword [ecx]
push dword [esp + 8]
call dword [eax + 0x88]
pop esi
ret 4

Function at 0x4c7d8b
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
push edi
xor edi, edi
cmp dword [esp + 0x10], edi
mov ebx, ecx
je 0x4c7dcd
call fcn.004cdb04
mov esi, dword [eax + 0xc]
push 0xf0
push dword [esp + 0x14]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
cmp eax, edi
je 0x4c7dcd
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp eax, edi
jne 0x4c7dc4
xor eax, eax
jmp 0x4c7dd5
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
push edi
mov ecx, ebx
call fcn.004c7ddb
pop edi
pop esi
pop ebx
ret 4

Function at 0x4ce034
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
mov esi, ecx
lea ebx, [esi + 0x1c]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [esp + 0x10], 0
jne 0x4ce062
push dword [esi]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x4ce080
push dword [esp + 0xc]
mov ecx, esi
push eax
call fcn.004cdf9a
jmp 0x4ce080
mov eax, dword [esi + 0x14]
test eax, eax
je 0x4ce080
push edi
push dword [esp + 0x10]
mov edi, dword [eax + 4]
mov ecx, esi
push eax
call fcn.004cdf9a
test edi, edi
mov eax, edi
jne 0x4ce06a
pop edi
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop esi
pop ebx
ret 8

Function at 0x4556fa
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [0xfe68207c]
test eax, eax
je 0x455739
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x455739
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x455739
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x455739
cmp dword [ecx + 0x74], 0xe
jbe 0x455739
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret

Function at 0x4612a0
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x4612cd
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x4612cd
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret
Function at 0x432004
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
call 0x43200c
nop
nop
nop
nop
nop
pop eax
add eax, reloc.kernel32.dll_RemoveDirectoryA
nop
nop
sub eax, 0x407245
nop
nop
nop
nop
mov ebx, dword [eax]
nop
mov ecx, dword [eax + 4]
nop
nop
nop
nop
nop
mov edx, dword [eax + 8]
xor dword [ebx], edx
nop
nop
nop
nop
nop
add ebx, 4
nop
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
nop
nop
jl 0x432030
nop
nop
add eax, 0xc
nop
cmp dword [eax], 0
nop
nop
nop
nop
nop
nop
jne 0x43201e
nop
popal
nop
nop
nop
nop
nop
jmp 0x431219

Function at 0x29d6187
Capabilities:
Encode data using xor

Disassembly:
push 0xb18c88a9
push 0xb8a5ef98
mov dword [ebp], edx
push 0xa49abf21
lea esp, [esp + 0x10]
jmp fcn.025bd62b
lea esp, [esp + 0xc]
je 0x2a0ecf3
mov eax, 0x59b1360e
bswap eax
shl ax, 9
mov eax, dword [ebp + ebx*4]
call fcn.02a9941e
insd dword es:[edi], dx
add al, 8
mov dword [ecx + 0x744a8d3b], edi
pop ebp
aad 0xaf
invalid
mov eax, 0x7fad819a
jmp 0x2a9280c
cwde
mov eax, dword [ebp]
push 0x2632abb6
lea esp, [esp + 4]
call eax
mov ebp, dword [ebp - 4]
call fcn.025abd4e
mov eax, dword [ebp]
push edx
mov edx, dword [eax]
jmp 0x25b9b8b
Function at 0x401750
Capabilities:
Terminate process

Disassembly:
adc byte [ebx], bl
adc eax, 0xea1b1318
adc eax, 0x19181716
sbb dl, byte [eax - 0x6f6f6f70]
nop
nop
sti
nop
nop
nop
and eax, 0x8b559090
push ebp
mov ebp, esp
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
sbb cl, al
enter 0x4035, 0
sub eax, 0x6840c183
je 0x401735
inc eax
pop eax
push ecx
call dword [sym.imp.MSVCRT.dll_fprintf]
mov eax, dword [0xbf4102ac]
add esp, 0xc
test eax, eax
adc byte [ebp + ebx + 0x68], al
push esp
rol byte [eax], cl
call dword [sym.imp.MSVCRT.dll_printf]
add esp, 8
push 1
call dword [sym.imp.MSVCRT.dll_exit]
nop
push ebp
imul ebp, esp, 0xffffff81
in al, dx
add byte cs:[eax], al
add byte [ecx + 0x410278], ah
test dword [esi - 0x5f], edi
stosd dword es:[edi], eax
in eax, 0x41
add byte [esp + edx + 0x68], dh
inc eax
cmp al, 0x41
add byte [eax - 0x18], dl
sahf
inc eax
pop edx
add byte [esi - 0x75], ah
or eax, 0x410274
jmp fcn.004017cf

Function at 0x406420
Capabilities:
Get socket status

Disassembly:
inc ecx
mov dword [edx], esi
mov esi, esp
adc al, 0x20
add byte [eax], al
add edx, 4
dec esi
cmp ecx, esi
jb 0x406390
dec dword [eax + 0x2014]
mov ecx, dword [eax + 0x3c003018]
cmp edi, dword [eax]
jne 0x4063b4
test dword [esi + 0x7e], edi
pop es
ror dword [ecx + 0x301888], cl
add byte [esi + 0x5e], dh
xor eax, eax
pop ebx
mov esi, dword [ebx]
cmp eax, edx
or byte [eax], al
pop edi
mov ebp, 0x9b8
add byte [ebx - 0x75], bl
in eax, 0x5d
or dword [eax], eax
add byte [eax], al
pop ebx
mov esp, ebp
pop ebp
ret 0x99
or byte [esi + 0x57], dl
mov eax, dword [ebx + 0x1b]
retf 0x6cc0
inc ebx
sbb ecx, edx
shr byte [esp + edx - 0x75], 0x45
loope 0x40641d
pop esi
pop ebx
mov dword [eax], 0x1d00
dec edi
ror byte [ebx + 0x14525de5], 0
mov ebx, dword [ebx]
adc byte [ebx - 0x95ef3b5], cl
jg 0x4063e2
jl 0x4063b0
test dword [ebx], ebp
invalid
rol byte [eax], 0x68
inc eax
inc edx
pavgw mm2, qword [esi + 0x57]
call 0xd5b590
retf 0x6800
mov bl, 0xb3
sub edx, dword [eax]
adc byte [eax], al
invalid
invalid
Function at 0x100020a0
Capabilities:
Hash data using djb2

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3f4
mov eax, dword [0x10048100]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [ebp + 0xc]
push esi
mov esi, dword [ebp + 0x10]
push eax
mov dword [ebp - 0x3f4], eax
call fcn.10013c30
add esp, 4
test eax, eax
je 0x1000217c
push esi
add eax, 0x158
push 0x3e8
push eax
call fcn.10022070
mov eax, ebx
add esp, 0xc
lea edx, [eax + 2]
nop
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x100020f0
sub eax, edx
mov esi, 0x1505
push edi
sar eax, 1
xor edi, edi
add eax, eax
je 0x1000213c
nop dword [eax + eax]
dec eax
lea ebx, [ebx + 1]
mov dword [ebp - 0x3f0], eax
mov ecx, edi
mov eax, esi
shld edi, esi, 5
shl esi, 5
add esi, eax
movzx eax, byte [ebx - 1]
cdq
adc edi, ecx
add esi, eax
mov eax, dword [ebp - 0x3f0]
adc edi, edx
test eax, eax
jne 0x10002110
push edi
push esi
push dword [ebp - 0x3f4]
lea eax, [ebp - 0x3ec]
push str.LUNA_NOTIFY._d._llu
push eax
call fcn.100027a0
add esp, 0x14
lea eax, [ebp - 0x3ec]
push eax
push 0
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateEventA]
mov esi, eax
push esi
call dword [sym.imp.KERNEL32.dll_SetEvent]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
pop ebx
call fcn.1001d31f
mov esp, ebp
pop ebp
ret
Function at 0x10004c40
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100380b3
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x10048100]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x10], edi
mov dword [edi], 0
mov dword [edi + 4], 0
mov dword [edi + 8], 0
mov dword [edi + 0xc], 0
mov dword [edi + 0x10], 0
mov dword [edi + 0x14], 0
mov dword [edi + 0x18], 0
mov dword [edi + 0x1c], 0
mov dword [ebp - 4], 0
mov dword [edi + 0x20], 0
mov dword [edi + 0x24], 0
mov dword [edi + 0x28], 0
mov dword [edi + 0x2c], 0
mov dword [edi + 0x30], 0
mov dword [edi + 0x34], 0
mov dword [edi + 0x38], 0
mov dword [edi + 0x3c], 0
lea ecx, [edi + 0x40]
mov dword [ecx], 0
mov dword [ecx + 4], 0
mov dword [ecx + 8], 0
mov eax, dword [ebp + 0xc]
mov esi, dword [ebp + 0x14]
mov edx, dword [ebp + 0x20]
mov dword [edi + 0x4c], 0
mov dword [edi + 0x50], eax
mov eax, dword [ebp + 8]
mov dword [edi + 0x54], eax
mov eax, dword [ebp + 0x1c]
mov dword [edi + 0x5c], eax
mov eax, dword [ebp + 0x18]
mov dword [edi + 0x58], esi
mov dword [edi + 0x60], edx
mov byte [edi + 0x64], 0
mov dword [edi + 0x68], eax
test byte [esi + 8], 8
mov byte [ebp - 4], 2
je 0x10004d3a
test dl, 0x10
jne 0x10004d3a
mov al, 1
jmp 0x10004d3c
xor al, al
mov byte [edi + 0x6c], al
mov eax, dword [ebp + 0x10]
mov dword [edi + 0x70], eax
mov ebx, dword [ecx + 4]
mov edx, ebx
mov esi, dword [esi + 0x18]
sar edx, 3
cmp esi, edx
jae 0x10004d60
lea eax, [esi*8]
mov dword [ecx + 4], eax
jmp 0x10004d93
jbe 0x10004d93
mov eax, dword [ecx + 8]
sar eax, 3
cmp esi, eax
jbe 0x10004d78
lea eax, [ebp + 0x17]
push eax
push esi
call fcn.10003fa0
jmp 0x10004d93
sub esi, edx
je 0x10004d90
shl esi, 3
push esi
push 0
push ebx
call fcn.1001ef60
add esp, 0xc
lea ecx, [edi + 0x40]
add ebx, esi
mov dword [ecx + 4], ebx
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x1c
Function at 0x1000cd50
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 0xc]
mov edx, 0x811c9dc5
push edi
mov edi, dword [ebp + 8]
mov ecx, 0
sub esi, edi
sar esi, 1
add esi, esi
je 0x1000cd81
nop dword [eax]
movzx eax, byte [edi + ecx]
inc ecx
xor eax, edx
imul edx, eax, 0x1000193
cmp ecx, esi
jb 0x1000cd70
pop edi
mov eax, edx
pop esi
pop ebp
ret 8
Function at 0x100101f0
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10038a95
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push ebx
push esi
push edi
mov eax, dword [0x10048100]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov ebx, dword [ebp + 0xc]
movzx eax, byte [ebx]
xor eax, 0x811c9dc5
imul edx, eax, 0x1000193
movzx eax, byte [ebx + 1]
xor edx, eax
movzx eax, byte [ebx + 2]
imul edx, edx, 0x1000193
xor edx, eax
movzx eax, byte [ebx + 3]
imul ecx, edx, 0x1000193
xor ecx, eax
imul eax, ecx, 0x1000193
mov ecx, edi
push eax
mov dword [ebp + 0xc], eax
lea eax, [ebp - 0x1c]
push ebx
push eax
call fcn.1000fe10
mov ecx, dword [ebp - 0x18]
test ecx, ecx
je 0x10010283
mov eax, dword [ebp + 8]
mov dword [eax], ecx
mov byte [eax + 4], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
cmp dword [edi + 8], 0x38e38e3
je 0x100103e3
lea eax, [edi + 4]
mov dword [ebp - 0x14], eax
push 0x48
mov dword [ebp - 4], 0
mov dword [ebp - 0x10], 0
call fcn.1001cfc7
mov edx, dword [ebp + 0x14]
mov esi, eax
mov ecx, dword [ebx]
add esp, 4
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x10], esi
mov dword [esi + 8], ecx
lea ecx, [esi + 0x10]
push dword [edx]
push dword [eax]
call fcn.10010b90
mov eax, dword [edi + 8]
mov ebx, dword [edi + 0x1c]
inc eax
movss xmm3, dword [edi]
mov dword [ebp - 4], 1
movd xmm0, eax
cvtdq2pd xmm0, xmm0
shr eax, 0x1f
addsd xmm0, qword [eax*8 + 0x1003b2f0]
mov eax, ebx
shr eax, 0x1f
cvtpd2ps xmm2, xmm0
movd xmm0, ebx
cvtdq2pd xmm0, xmm0
movaps xmm1, xmm2
addsd xmm0, qword [eax*8 + 0x1003b2f0]
cvtpd2ps xmm0, xmm0
divss xmm1, xmm0
comiss xmm1, xmm3
jbe 0x10010385
divss xmm2, xmm3
sub esp, 8
cvtps2pd xmm0, xmm2
movsd qword [ebp - 0x1c], xmm0
fld qword [ebp - 0x1c]
fstp qword [esp]
call fcn.10026ea0
fstp qword [ebp - 0x1c]
movsd xmm0, qword [ebp - 0x1c]
add esp, 8
cvtpd2ps xmm0, xmm0
call fcn.1001d7d0
mov ecx, 8
cmp eax, ecx
cmova ecx, eax
cmp ebx, ecx
jae 0x10010367
cmp ebx, 0x200
jae 0x10010365
shl ebx, 3
cmp ebx, ecx
jae 0x10010367
mov ebx, ecx
push ebx
mov ecx, edi
call fcn.10017b70
push dword [ebp + 0xc]
lea eax, [esi + 8]
mov ecx, edi
push eax
lea eax, [ebp - 0x1c]
push eax
call fcn.1000fe10
mov edx, dword [eax]
jmp 0x10010388
mov edx, dword [ebp - 0x1c]
mov ebx, dword [edx + 4]
inc dword [edi + 8]
mov dword [esi], edx
mov dword [esi + 4], ebx
mov dword [ebx], esi
mov dword [edx + 4], esi
mov eax, dword [edi + 0x18]
and eax, dword [ebp + 0xc]
mov ecx, dword [edi + 0xc]
mov esi, dword [ebp - 0x14]
mov edi, dword [ecx + eax*8]
cmp edi, dword [esi]
mov esi, dword [ebp - 0x10]
jne 0x100103b3
mov dword [ecx + eax*8], esi
jmp 0x100103c2
cmp edi, edx
jne 0x100103bc
mov dword [ecx + eax*8], esi
jmp 0x100103c6
cmp dword [ecx + eax*8 + 4], ebx
jne 0x100103c6
mov dword [ecx + eax*8 + 4], esi
mov eax, dword [ebp + 8]
mov dword [eax], esi
mov byte [eax + 4], 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
push str.unordered_map_set_too_long
call fcn.1001b925
int3
Function at 0x100103f0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10038acd
mov eax, dword fs:[0]
push eax
sub esp, 0x30
push ebx
push esi
push edi
mov eax, dword [0x10048100]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov eax, dword [ebp + 8]
push 4
push 0x3000
mov dword [ebp - 0x3c], 1
mov ecx, dword [eax]
mov eax, dword [eax + 4]
sub eax, ecx
mov dword [ebp - 0x1c], ecx
mov ecx, dword [esi]
and eax, 0xfffffffc
push eax
push 0
push 0
push ecx
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x38], ecx
mov dword [ebp - 0x2c], eax
call fcn.10016930
mov edi, eax
mov ebx, edx
mov ecx, edi
mov dword [ebp - 0x34], edi
or ecx, ebx
mov dword [ebp - 0x30], ebx
je 0x100104a6
lea eax, [ebp + 8]
mov dword [ebp + 8], 0
push eax
push dword [ebp - 0x10]
push dword [ebp - 0x1c]
push ebx
push edi
push dword [ebp - 0x14]
call fcn.10016c40
test eax, eax
mov eax, dword [ebp - 0x10]
je 0x10010488
cmp dword [ebp + 8], eax
je 0x100104a6
push 0x4000
push eax
push ebx
push edi
push dword [ebp - 0x14]
call fcn.10016ac0
xorps xmm0, xmm0
movlpd qword [ebp - 0x34], xmm0
mov ebx, dword [ebp - 0x30]
mov edi, dword [ebp - 0x34]
mov eax, edi
mov dword [ebp - 4], 0
or eax, ebx
je 0x1001050c
cmp dword [esi + 0x18], 0
mov eax, dword [esi + 4]
push 0
push 0
je 0x100104d5
push ebx
push edi
push dword [eax + 0xc]
push dword [eax + 8]
push 0
push 0
push dword [esi]
call fcn.100136f0
jmp 0x100104e5
push edi
push dword [eax + 8]
push 0
push 0
push dword [esi]
call dword [sym.imp.KERNEL32.dll_CreateRemoteThread]
mov dword [ebp + 8], eax
test eax, eax
je 0x1001050c
push dword [esi + 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x10010539
mov eax, dword [esi + 4]
push dword [ebp + 8]
mov dword [eax], 0
call dword [sym.imp.KERNEL32.dll_CloseHandle]
or esi, 0xffffffff
or ecx, 0xffffffff
mov dword [ebp + 8], ecx
mov eax, edi
mov dword [ebp - 4], 5
or eax, ebx
je 0x10010592
push 0x4000
push dword [ebp - 0x10]
push ebx
push edi
push dword [ebp - 0x14]
call fcn.10016ac0
mov edx, dword [ebp + 8]
jmp 0x10010594
cmp dword [esi + 0x18], 0
je 0x1001056f
cmp dword [esi + 0x10], 0
je 0x1001056f
push dword [ebp + 8]
xorps xmm0, xmm0
movlpd qword [ebp - 0x24], xmm0
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0
push 8
lea eax, [ebp - 0x24]
push eax
push ebx
push edi
push dword [esi]
call fcn.10015590
mov esi, dword [ebp - 0x24]
mov ecx, dword [ebp - 0x20]
jmp 0x10010512
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x18]
push eax
push esi
mov dword [ebp - 0x18], 0
call dword [sym.imp.KERNEL32.dll_GetExitCodeThread]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov esi, dword [ebp - 0x18]
xor ecx, ecx
jmp 0x10010512
mov edx, ecx
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x100105b0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10038acd
mov eax, dword fs:[0]
push eax
sub esp, 0x30
push ebx
push esi
push edi
mov eax, dword [0x10048100]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov eax, dword [ebp + 8]
push 4
push 0x3000
mov dword [ebp - 0x3c], 1
mov ecx, dword [eax]
mov eax, dword [eax + 4]
sub eax, ecx
mov dword [ebp - 0x1c], ecx
mov ecx, dword [esi]
and eax, 0xfffffff8
push eax
push 0
push 0
push ecx
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x38], ecx
mov dword [ebp - 0x2c], eax
call fcn.10016930
mov edi, eax
mov ebx, edx
mov ecx, edi
mov dword [ebp - 0x34], edi
or ecx, ebx
mov dword [ebp - 0x30], ebx
je 0x10010666
lea eax, [ebp + 8]
mov dword [ebp + 8], 0
push eax
push dword [ebp - 0x10]
push dword [ebp - 0x1c]
push ebx
push edi
push dword [ebp - 0x14]
call fcn.10016c40
test eax, eax
mov eax, dword [ebp - 0x10]
je 0x10010648
cmp dword [ebp + 8], eax
je 0x10010666
push 0x4000
push eax
push ebx
push edi
push dword [ebp - 0x14]
call fcn.10016ac0
xorps xmm0, xmm0
movlpd qword [ebp - 0x34], xmm0
mov ebx, dword [ebp - 0x30]
mov edi, dword [ebp - 0x34]
mov eax, edi
mov dword [ebp - 4], 0
or eax, ebx
je 0x100106cc
cmp dword [esi + 0x18], 0
mov eax, dword [esi + 4]
push 0
push 0
je 0x10010695
push ebx
push edi
push dword [eax + 0xc]
push dword [eax + 8]
push 0
push 0
push dword [esi]
call fcn.100136f0
jmp 0x100106a5
push edi
push dword [eax + 8]
push 0
push 0
push dword [esi]
call dword [sym.imp.KERNEL32.dll_CreateRemoteThread]
mov dword [ebp + 8], eax
test eax, eax
je 0x100106cc
push dword [esi + 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x100106f9
mov eax, dword [esi + 4]
push dword [ebp + 8]
mov dword [eax], 0
call dword [sym.imp.KERNEL32.dll_CloseHandle]
or esi, 0xffffffff
or ecx, 0xffffffff
mov dword [ebp + 8], ecx
mov eax, edi
mov dword [ebp - 4], 5
or eax, ebx
je 0x10010752
push 0x4000
push dword [ebp - 0x10]
push ebx
push edi
push dword [ebp - 0x14]
call fcn.10016ac0
mov edx, dword [ebp + 8]
jmp 0x10010754
cmp dword [esi + 0x18], 0
je 0x1001072f
cmp dword [esi + 0x10], 0
je 0x1001072f
push dword [ebp + 8]
xorps xmm0, xmm0
movlpd qword [ebp - 0x24], xmm0
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0
push 8
lea eax, [ebp - 0x24]
push eax
push ebx
push edi
push dword [esi]
call fcn.10015590
mov esi, dword [ebp - 0x24]
mov ecx, dword [ebp - 0x20]
jmp 0x100106d2
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x18]
push eax
push esi
mov dword [ebp - 0x18], 0
call dword [sym.imp.KERNEL32.dll_GetExitCodeThread]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov esi, dword [ebp - 0x18]
xor ecx, ecx
jmp 0x100106d2
mov edx, ecx
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4