joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10002190
Capabilities:
Enumerate pe sections
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10299228
push 0x101da470
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
add esp, 0xffffffd0
push ebx
push esi
push edi
mov dword [ebp - 0x18], esp
mov eax, dword [ebp + 8]
mov dword [ebp - 0x1c], eax
cmp dword [ebp + 8], 0
jne 0x100021cd
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov dword [ebp - 0x1c], eax
mov dword [ebp - 4], 0
mov ecx, dword [ebp - 0x1c]
movzx edx, word [ecx]
cmp edx, 0x5a4d
je 0x10002203
push 0xc1
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov dword [ebp - 0x34], 0
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x34]
jmp 0x10002361
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x1c]
add ecx, dword [eax + 0x3c]
mov dword [ebp - 0x24], ecx
mov edx, dword [ebp - 0x24]
cmp dword [edx], 0x4550
je 0x1000223b
push 0xbf
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov dword [ebp - 0x38], 0
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x38]
jmp 0x10002361
mov eax, dword [ebp - 0x24]
movzx ecx, word [eax + 0x14]
test ecx, ecx
jne 0x10002267
push 0xc0
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov dword [ebp - 0x3c], 0
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x3c]
jmp 0x10002361
mov edx, dword [ebp - 0x24]
movzx eax, word [edx + 0x14]
mov ecx, dword [ebp - 0x24]
lea edx, [ecx + eax + 0x18]
mov dword [ebp - 0x20], edx
mov dword [ebp - 0x28], 0
jmp 0x1000228a
mov eax, dword [ebp - 0x28]
add eax, 1
mov dword [ebp - 0x28], eax
mov ecx, dword [ebp - 0x24]
movzx edx, word [ecx + 6]
cmp dword [ebp - 0x28], edx
jae 0x1000233b
push str..detour
mov eax, dword [ebp - 0x28]
imul eax, eax, 0x28
mov ecx, dword [ebp - 0x20]
add ecx, eax
push ecx
call fcn.10233ec0
add esp, 8
test eax, eax
jne 0x10002336
mov edx, dword [ebp - 0x28]
imul edx, edx, 0x28
mov eax, dword [ebp - 0x20]
cmp dword [eax + edx + 0xc], 0
je 0x100022d7
mov ecx, dword [ebp - 0x28]
imul ecx, ecx, 0x28
mov edx, dword [ebp - 0x20]
cmp dword [edx + ecx + 0x10], 0
jne 0x100022d9
jmp 0x1000233b
mov eax, dword [ebp - 0x28]
imul eax, eax, 0x28
mov ecx, dword [ebp - 0x20]
mov edx, dword [ebp - 0x1c]
add edx, dword [ecx + eax + 0xc]
mov dword [ebp - 0x30], edx
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x2c], eax
mov ecx, dword [ebp - 0x2c]
cmp dword [ecx], 0x30
jb 0x10002306
mov edx, dword [ebp - 0x2c]
cmp dword [edx + 4], 0x727444
je 0x10002308
jmp 0x1000233b
mov eax, dword [ebp - 0x2c]
cmp dword [eax + 8], 0
jne 0x1000231c
mov ecx, dword [ebp - 0x2c]
mov edx, dword [ebp - 0x2c]
mov eax, dword [edx]
mov dword [ecx + 8], eax
push 0
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov ecx, dword [ebp - 0x2c]
mov dword [ebp - 0x40], ecx
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x40]
jmp 0x10002361
jmp 0x10002281
mov dword [ebp - 4], 0xffffffff
jmp 0x10002354
push 0xc0
call dword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x10031060
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10278caf
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x1036413c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
mov ecx, 0x10478adf
call fcn.102758d0
push 0
mov ecx, esi
call fcn.101a61c0
mov dword [ebp - 4], 0
mov dword [esi + 4], 0
mov byte [esi + 8], 0
mov dword [esi + 0xc], 0
mov byte [esi + 0x10], 0
xor eax, eax
mov dword [esi + 0x14], 0
mov word [esi + 0x18], ax
mov dword [esi + 0x1c], eax
mov word [esi + 0x20], ax
mov dword [esi + 0x24], eax
mov byte [esi + 0x28], al
mov dword [esi + 0x2c], eax
mov byte [esi + 0x30], al
mov eax, dword [ebp + 8]
mov byte [ebp - 4], 6
test eax, eax
je 0x10031102
push eax
push esi
call fcn.101a73a0
add esp, 8
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret 4
push str.bad_locale_name
call fcn.101a6be0
int3
Function at 0x1006bd40
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push esi
mov ecx, 0x10478aa1
call fcn.102758d0
mov esi, dword [ebp + 0x10]
xor ecx, ecx
test esi, esi
je 0x1006bd77
mov edx, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0xc]
nop
movzx eax, byte [ecx + edi]
inc ecx
xor eax, edx
imul edx, eax, 0x1000193
cmp ecx, esi
jb 0x1006bd60
pop edi
mov eax, edx
pop esi
pop ebp
ret
mov eax, dword [ebp + 8]
pop esi
pop ebp
ret

Function at 0x1006ed10
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov ecx, 0x10478ba8
push ebx
push esi
push edi
call fcn.102758d0
cmp byte [0x1046af98], 0
je 0x1006eea1
mov ecx, dword [0x10452c18]
mov eax, dword [ecx]
mov eax, dword [eax + 0x68]
call eax
test al, al
je 0x1006eea1
mov ecx, dword [0x10452c9c]
xor ebx, ebx
mov dword [ebp - 4], ecx
mov eax, dword [ecx + 0x28]
mov dword [ebp - 8], eax
test eax, eax
je 0x1006eea1
nop
mov eax, dword [ecx + 0x1c]
mov ecx, dword [eax + ebx*4]
mov eax, dword [ecx]
mov eax, dword [eax + 0x30]
call eax
mov esi, eax
mov edi, 0x811c9dc5
xor ecx, ecx
inc ecx
cmp byte [ecx + esi], 0
jne 0x1006ed76
xor edx, edx
test ecx, ecx
je 0x1006ed9c
movsx eax, byte [edx + esi]
inc edx
xor eax, edi
imul edi, eax, 0x1000193
cmp edx, ecx
jb 0x1006ed83
cmp edi, 0x5ff56dc5
je 0x1006edab
inc ebx
cmp ebx, dword [ebp - 8]
jae 0x1006eea1
mov ecx, dword [ebp - 4]
jmp 0x1006ed60
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x1c]
mov edi, dword [eax + ebx*4]
test edi, edi
je 0x1006eea1
mov edx, dword [edi + 0x88]
test edx, edx
je 0x1006eea1
movss xmm1, dword [0x10342b58]
xor ebx, ebx
cmp edx, 4
jl 0x1006ee6e
mov ecx, dword [edi + 0x7c]
lea esi, [edx - 4]
shr esi, 2
add ecx, 0x1078
inc esi
lea ebx, [esi*4]
movss xmm0, dword [ecx - 0xc60]
ucomiss xmm0, xmm1
lahf
test ah, 0x44
jp 0x1006ee0f
mov dword [ecx - 0xc60], 0x7f7fffff
movss xmm0, dword [ecx - 0x840]
ucomiss xmm0, xmm1
lahf
test ah, 0x44
jp 0x1006ee2a
mov dword [ecx - 0x840], 0x7f7fffff
movss xmm0, dword [ecx - 0x420]
ucomiss xmm0, xmm1
lahf
test ah, 0x44
jp 0x1006ee45
mov dword [ecx - 0x420], 0x7f7fffff
movss xmm0, dword [ecx]
ucomiss xmm0, xmm1
lahf
test ah, 0x44
jp 0x1006ee58
mov dword [ecx], 0x7f7fffff
add ecx, 0x1080
sub esi, 1
jne 0x1006edf4
cmp ebx, edx
jl 0x1006ee72
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
test edx, edx
jle 0x1006eea1
imul ecx, ebx, 0x420
add ecx, 0x418
add ecx, dword [edi + 0x7c]
sub edx, ebx
movss xmm0, dword [ecx]
ucomiss xmm0, xmm1
lahf
test ah, 0x44
jp 0x1006ee96
mov dword [ecx], 0x7f7fffff
add ecx, 0x420
sub edx, 1
jne 0x1006ee83
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10079550
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, ecx
push edi
call fcn.1007db30
lea eax, [edi + 0x10]
push eax
lea ecx, [esi + 0x10]
call fcn.1007db30
lea eax, [edi + 0x20]
lea ebx, [esi + 0x20]
cmp ebx, eax
je 0x10079590
mov ecx, ebx
call fcn.10030300
lea eax, [edi + 0x24]
push eax
lea ecx, [ebx + 4]
call fcn.1007db30
mov eax, dword [edi + 0x34]
mov dword [ebx + 0x14], eax
mov eax, dword [edi + 0x38]
lea ebx, [esi + 0x60]
mov dword [esi + 0x38], eax
mov eax, dword [edi + 0x3c]
mov dword [esi + 0x3c], eax
mov eax, dword [edi + 0x40]
mov dword [esi + 0x40], eax
mov eax, dword [edi + 0x44]
mov dword [esi + 0x44], eax
movzx eax, byte [edi + 0x48]
mov byte [esi + 0x48], al
mov eax, dword [edi + 0x4c]
mov dword [esi + 0x4c], eax
movzx eax, byte [edi + 0x50]
mov byte [esi + 0x50], al
mov eax, dword [edi + 0x54]
mov dword [esi + 0x54], eax
movzx eax, byte [edi + 0x58]
mov byte [esi + 0x58], al
mov eax, dword [edi + 0x5c]
mov dword [esi + 0x5c], eax
lea eax, [edi + 0x60]
cmp ebx, eax
je 0x100795f2
mov ecx, ebx
call fcn.10030300
lea eax, [edi + 0x64]
push eax
lea ecx, [ebx + 4]
call fcn.1007db30
mov eax, dword [edi + 0x74]
mov dword [ebx + 0x14], eax
lea eax, [edi + 0x78]
lea ebx, [esi + 0x78]
cmp ebx, eax
je 0x10079618
mov ecx, ebx
call fcn.10030300
lea eax, [edi + 0x7c]
push eax
lea ecx, [ebx + 4]
call fcn.1007db30
mov eax, dword [edi + 0x8c]
mov dword [ebx + 0x14], eax
mov eax, dword [edi + 0x90]
lea ecx, [esi + 0x94]
add edi, 0x94
mov dword [esi + 0x90], eax
cmp ecx, edi
je 0x10079648
cmp dword [edi + 0x18], 0x10
lea eax, [edi + 4]
jb 0x1007963f
mov eax, dword [eax]
push dword [edi + 0x14]
push eax
call fcn.10047dd0
pop edi
mov eax, esi
pop esi
pop ebx
pop ebp
ret 4
Function at 0x1007d2a0
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1027c6d5
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push ebx
push esi
push edi
mov eax, dword [0x1036413c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
mov ecx, 0x10478ad9
call fcn.102758d0
movzx eax, byte [esi]
xor eax, 0x811c9dc5
imul ecx, eax, 0x1000193
movzx eax, byte [esi + 1]
xor ecx, eax
movzx eax, byte [esi + 2]
imul ecx, ecx, 0x1000193
xor ecx, eax
movzx eax, byte [esi + 3]
imul ecx, ecx, 0x1000193
xor ecx, eax
lea eax, [ebp - 0x14]
imul edi, ecx, 0x1000193
push edi
push esi
push eax
call fcn.100856c0
mov eax, dword [ebp - 0x10]
test eax, eax
jne 0x1007d3c6
cmp dword [0x1046ba0c], 0xfffffff
je 0x1007d3dd
mov dword [ebp - 0x1c], 0x1046ba04
mov dword [ebp - 4], eax
push 0x10
mov dword [ebp - 0x18], eax
call fcn.101d5af0
mov ebx, eax
add esp, 4
mov eax, dword [esi]
mov dword [ebp - 0x18], ebx
mov dword [ebx + 8], eax
mov dword [ebx + 0xc], 0
mov dword [ebp - 4], 1
mov eax, dword [0x1046ba0c]
inc eax
movd xmm0, eax
cvtdq2pd xmm0, xmm0
shr eax, 0x1f
addsd xmm0, qword [eax*8 + 0x10342e10]
mov eax, dword [0x1046ba24]
cvtpd2ps xmm1, xmm0
movd xmm0, eax
cvtdq2pd xmm0, xmm0
shr eax, 0x1f
addsd xmm0, qword [eax*8 + 0x10342e10]
cvtpd2ps xmm0, xmm0
divss xmm1, xmm0
comiss xmm1, dword [0x1046ba00]
jbe 0x1007d3bb
call fcn.10084410
push edi
lea eax, [ebx + 8]
push eax
lea eax, [ebp - 0x1c]
push eax
call fcn.100856c0
mov ecx, dword [eax]
jmp 0x1007d3be
mov ecx, dword [ebp - 0x14]
push ebx
push ecx
push edi
call fcn.10084530
add eax, 0xc
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
push str.unordered_map_set_too_long
call fcn.101a6b20
int3
Function at 0x100847f0
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov ecx, 0x10478ad6
push ebx
push esi
push edi
call fcn.102758d0
mov eax, 0x1fffffff
mov edi, 1
bsr ecx, eax
mov eax, edi
shl eax, cl
mov ecx, dword [ebp + 8]
cmp ecx, eax
ja 0x10084961
lea eax, [ecx - 1]
mov esi, dword [0x1046ba08]
or eax, edi
mov dword [ebp - 8], esi
bsr ecx, eax
push esi
lea ecx, [ecx + 1]
shl edi, cl
mov ecx, 0x1046ba10
lea eax, [edi + edi]
push eax
call fcn.100803f0
mov eax, dword [0x1046ba08]
lea ebx, [edi - 1]
mov dword [0x1046ba20], ebx
mov dword [0x1046ba24], edi
mov eax, dword [eax]
mov ecx, eax
cmp eax, esi
je 0x10084958
movzx edx, byte [eax + 8]
xor edx, 0x811c9dc5
mov ecx, dword [ecx]
imul edi, edx, 0x1000193
movzx edx, byte [eax + 9]
xor edi, edx
movzx edx, byte [eax + 0xa]
imul edi, edi, 0x1000193
xor edi, edx
movzx edx, byte [eax + 0xb]
imul edi, edi, 0x1000193
xor edi, edx
mov edx, dword [0x1046ba14]
imul edi, edi, 0x1000193
and edi, ebx
mov ebx, dword [edx + edi*8]
lea edx, [edx + edi*8]
mov dword [ebp - 0xc], edx
cmp ebx, esi
jne 0x100848b6
mov dword [edx], eax
mov dword [edx + 4], eax
jmp 0x10084923
mov edx, dword [edx + 4]
mov edi, dword [eax + 8]
cmp edi, dword [edx + 8]
jne 0x100848f0
mov edx, dword [edx]
mov dword [ebp - 4], edx
cmp edx, eax
je 0x100848e8
mov ebx, dword [eax + 4]
mov esi, dword [ebp - 4]
mov dword [ebx], ecx
mov edi, dword [ecx + 4]
mov dword [edi], edx
mov edx, dword [edx + 4]
mov dword [edx], eax
mov dword [esi + 4], edi
mov esi, dword [ebp - 8]
mov dword [ecx + 4], ebx
mov dword [eax + 4], edx
mov edx, dword [ebp - 0xc]
mov dword [edx + 4], eax
jmp 0x10084923
cmp ebx, edx
je 0x10084900
mov edx, dword [edx + 4]
cmp edi, dword [edx + 8]
je 0x10084934
cmp ebx, edx
jne 0x100848f4
mov ebx, dword [eax + 4]
mov dword [ebp - 4], ebx
mov dword [ebx], ecx
mov ebx, dword [ecx + 4]
mov dword [ebx], edx
mov edi, dword [edx + 4]
mov dword [edi], eax
mov dword [edx + 4], ebx
mov edx, dword [ebp - 4]
mov dword [ecx + 4], edx
mov edx, dword [ebp - 0xc]
mov dword [eax + 4], edi
mov dword [edx], eax
mov eax, ecx
cmp ecx, esi
je 0x10084958
mov ebx, dword [0x1046ba20]
jmp 0x10084864
mov ebx, dword [eax + 4]
mov edx, dword [edx]
mov dword [ebp - 4], edx
mov esi, edx
mov dword [ebx], ecx
mov edi, dword [ecx + 4]
mov dword [edi], edx
mov edx, dword [edx + 4]
mov dword [edx], eax
mov dword [esi + 4], edi
mov esi, dword [ebp - 8]
mov dword [ecx + 4], ebx
mov dword [eax + 4], edx
jmp 0x10084923
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
push str.invalid_hash_bucket_count
call fcn.101a6b20
int3
Function at 0x100aa030
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [0x1036413c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov ebx, ecx
mov ecx, 0x10478b5c
push edi
call fcn.102758d0
mov edi, dword fs:[0x30]
test edi, edi
jne 0x100aa06d
xor al, al
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.101d57a0
mov esp, ebp
pop ebp
ret
mov edi, dword [edi + 0xc]
add edi, 0x14
mov esi, dword [edi]
cmp esi, edi
je 0x100aa0c1
mov ecx, 0x5a4d
nop
lea edx, [esi - 8]
test edx, edx
je 0x100aa0bb
mov eax, dword [edx + 0x18]
test eax, eax
je 0x100aa0bb
cmp word [eax], cx
jne 0x100aa0bb
mov ecx, dword [eax + 0x3c]
add ecx, eax
je 0x100aa0b6
cmp dword [ecx], 0x4550
jne 0x100aa0b6
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0x10]
mov dword [ebp - 8], ecx
mov ecx, ebx
push eax
mov dword [ebp - 0x10], edx
call fcn.100b25a0
mov ecx, 0x5a4d
mov esi, dword [esi]
cmp esi, edi
jne 0x100aa080
mov eax, dword [ebx + 4]
cmp eax, dword [ebx + 8]
mov ecx, dword [ebp - 4]
pop edi
setne al
xor ecx, ebp
pop esi
pop ebx
call fcn.101d57a0
mov esp, ebp
pop ebp
ret
Function at 0x100ab670
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
mov ebx, ecx
mov dword [ebp - 4], edx
push edi
mov ecx, 0x10478b5c
mov dword [ebp - 8], ebx
call fcn.102758d0
mov eax, dword [ebp + 8]
cmp dword [eax + 0x18], 0x10
lea esi, [eax + 4]
mov edi, dword [eax + 0x14]
jb 0x100ab69c
mov esi, dword [esi]
xor ecx, ecx
mov edx, 0x811c9dc5
test edi, edi
je 0x100ab6b8
movzx eax, byte [ecx + esi]
inc ecx
xor eax, edx
imul edx, eax, 0x1000193
cmp ecx, edi
jb 0x100ab6a7
push edx
mov edx, dword [ebp - 4]
mov ecx, ebx
call fcn.100aad50
add esp, 4
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x100b23f0
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x102802c5
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push ebx
push esi
push edi
mov eax, dword [0x1036413c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
mov ecx, 0x10478ad9
call fcn.102758d0
movzx eax, byte [esi]
xor eax, 0x811c9dc5
imul ecx, eax, 0x1000193
movzx eax, byte [esi + 1]
xor ecx, eax
movzx eax, byte [esi + 2]
imul ecx, ecx, 0x1000193
xor ecx, eax
movzx eax, byte [esi + 3]
imul ecx, ecx, 0x1000193
xor ecx, eax
lea eax, [ebp - 0x14]
imul edi, ecx, 0x1000193
push edi
push esi
push eax
call fcn.100856c0
mov eax, dword [ebp - 0x10]
test eax, eax
jne 0x100b2516
cmp dword [0x1046ba0c], 0xfffffff
je 0x100b252d
mov dword [ebp - 0x1c], 0x1046ba04
mov dword [ebp - 4], eax
push 0x10
mov dword [ebp - 0x18], eax
call fcn.101d5af0
mov ebx, eax
add esp, 4
mov eax, dword [esi]
mov dword [ebp - 0x18], ebx
mov dword [ebx + 8], eax
mov dword [ebx + 0xc], 0
mov dword [ebp - 4], 1
mov eax, dword [0x1046ba0c]
inc eax
movd xmm0, eax
cvtdq2pd xmm0, xmm0
shr eax, 0x1f
addsd xmm0, qword [eax*8 + 0x10342e10]
mov eax, dword [0x1046ba24]
cvtpd2ps xmm1, xmm0
movd xmm0, eax
cvtdq2pd xmm0, xmm0
shr eax, 0x1f
addsd xmm0, qword [eax*8 + 0x10342e10]
cvtpd2ps xmm0, xmm0
divss xmm1, xmm0
comiss xmm1, dword [0x1046ba00]
jbe 0x100b250b
call fcn.10084410
push edi
lea eax, [ebx + 8]
push eax
lea eax, [ebp - 0x1c]
push eax
call fcn.100856c0
mov ecx, dword [eax]
jmp 0x100b250e
mov ecx, dword [ebp - 0x14]
push ebx
push ecx
push edi
call fcn.10084530
add eax, 0xc
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
push str.unordered_map_set_too_long
call fcn.101a6b20
int3
Function at 0x100b9d70
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [0x1036413c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov ebx, ecx
mov ecx, 0x10478b5c
push edi
call fcn.102758d0
mov edi, dword fs:[0x30]
test edi, edi
jne 0x100b9dad
xor al, al
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.101d57a0
mov esp, ebp
pop ebp
ret
mov edi, dword [edi + 0xc]
add edi, 0x14
mov esi, dword [edi]
cmp esi, edi
je 0x100b9e01
mov ecx, 0x5a4d
nop
lea edx, [esi - 8]
test edx, edx
je 0x100b9dfb
mov eax, dword [edx + 0x18]
test eax, eax
je 0x100b9dfb
cmp word [eax], cx
jne 0x100b9dfb
mov ecx, dword [eax + 0x3c]
add ecx, eax
je 0x100b9df6
cmp dword [ecx], 0x4550
jne 0x100b9df6
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0x10]
mov dword [ebp - 8], ecx
mov ecx, ebx
push eax
mov dword [ebp - 0x10], edx
call fcn.100b25a0
mov ecx, 0x5a4d
mov esi, dword [esi]
cmp esi, edi
jne 0x100b9dc0
mov eax, dword [ebx + 4]
cmp eax, dword [ebx + 8]
mov ecx, dword [ebp - 4]
pop edi
setne al
xor ecx, ebp
pop esi
pop ebx
call fcn.101d57a0
mov esp, ebp
pop ebp
ret
Function at 0x100bb390
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
mov ebx, ecx
mov dword [ebp - 4], edx
push edi
mov ecx, 0x10478b5c
mov dword [ebp - 8], ebx
call fcn.102758d0
mov eax, dword [ebp + 8]
cmp dword [eax + 0x18], 0x10
lea esi, [eax + 4]
mov edi, dword [eax + 0x14]
jb 0x100bb3bc
mov esi, dword [esi]
xor ecx, ecx
mov edx, 0x811c9dc5
test edi, edi
je 0x100bb3d8
movzx eax, byte [ecx + esi]
inc ecx
xor eax, edx
imul edx, eax, 0x1000193
cmp ecx, edi
jb 0x100bb3c7
push edx
mov edx, dword [ebp - 4]
mov ecx, ebx
call fcn.100baa70
add esp, 4
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x100bc540
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x5c
mov eax, dword [0x1036413c]
xor eax, esp
mov dword [esp + 0x58], eax
push ebx
mov ebx, dword [ebp + 0xc]
mov ecx, 0x10478b68
push esi
mov esi, dword [ebp + 8]
push edi
mov dword [esp + 0xc], esi
mov dword [esp + 0x18], ebx
call fcn.102758d0
mov eax, dword [esp + 0xc]
mov edi, dword [esi + 0x14]
add esi, 4
cmp dword [eax + 0x18], 0x10
jb 0x100bc581
mov esi, dword [esi]
xor ecx, ecx
mov edx, 0x811c9dc5
test edi, edi
je 0x100bc5a1
nop dword [eax]
movzx eax, byte [ecx + esi]
inc ecx
xor eax, edx
imul edx, eax, 0x1000193
cmp ecx, edi
jb 0x100bc590
cmp dword [ebx + 4], 0
mov dword [esp + 0x5c], edx
mov dword [esp + 0x10], 0
jle 0x100bc6f8
xor ecx, ecx
mov dword [esp + 0x14], ecx
nop dword [eax]
mov ebx, dword [ebx]
add ebx, ecx
mov ecx, dword [ebx + 0x28]
test ecx, ecx
je 0x100bc5e7
cmp dword [ecx + 4], 0
jle 0x100bc5e7
mov eax, dword [ebx + 0x2c]
add eax, dword [ebp + 0x10]
push eax
push ecx
push dword [esp + 0x14]
mov ecx, 0x1046ba00
call fcn.100bc540
mov edi, dword [ebx]
mov esi, 0x811c9dc5
xor eax, eax
inc eax
cmp byte [eax + edi], 0
jne 0x100bc5f0
xor edx, edx
test eax, eax
je 0x100bc611
nop dword [eax]
movsx ecx, byte [edx + edi]
inc edx
xor ecx, esi
imul esi, ecx, 0x1000193
cmp edx, eax
jb 0x100bc600
lea eax, [esp + 0x5c]
mov dword [esp + 0x60], esi
push eax
lea eax, [esp + 0x20]
mov ecx, 0x1046ba28
push eax
call fcn.10105490
mov ecx, dword [eax]
lea eax, [esp + 0x60]
push eax
lea eax, [esp + 0x28]
add ecx, 0xc
push eax
call fcn.10105280
mov eax, dword [eax]
cmp dword [eax + 0x14], 0
jne 0x100bc6d7
lea eax, [esp + 0x5c]
mov ecx, 0x1046ba28
push eax
lea eax, [esp + 0x30]
push eax
call fcn.10105490
mov ecx, dword [eax]
lea eax, [esp + 0x60]
push eax
lea eax, [esp + 0x38]
add ecx, 0xc
push eax
call fcn.10105280
mov ecx, 0x1046ba28
mov eax, dword [eax]
mov byte [eax + 0xc], 0
lea eax, [esp + 0x5c]
push eax
lea eax, [esp + 0x40]
push eax
call fcn.10105490
mov ecx, dword [eax]
lea eax, [esp + 0x60]
push eax
lea eax, [esp + 0x48]
add ecx, 0xc
push eax
call fcn.10105280
mov ecx, 0x1046ba28
mov eax, dword [eax]
mov dword [eax + 0x10], ebx
lea eax, [esp + 0x5c]
mov esi, dword [ebx + 0x2c]
add esi, dword [ebp + 0x10]
push eax
lea eax, [esp + 0x50]
push eax
call fcn.10105490
mov ecx, dword [eax]
lea eax, [esp + 0x60]
push eax
lea eax, [esp + 0x58]
add ecx, 0xc
push eax
call fcn.10105280
mov eax, dword [eax]
mov dword [eax + 0x14], esi
mov eax, dword [esp + 0x10]
mov ebx, dword [esp + 0x18]
inc eax
mov ecx, dword [esp + 0x14]
add ecx, 0x3c
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], ecx
cmp eax, dword [ebx + 4]
jl 0x100bc5c0
mov ecx, dword [esp + 0x64]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.101d57a0
mov esp, ebp
pop ebp
ret 0xc
Function at 0x100bc9e0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x102818bd
mov eax, dword fs:[0]
push eax
sub esp, 0x18
mov eax, dword [0x1036413c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ecx, 0x10478b68
mov dword [ebp - 4], 0
call fcn.102758d0
mov eax, dword [ebp + 8]
test eax, eax
je 0x100bcb80
mov eax, dword [eax + 2]
mov dword [ebp - 0x1c], eax
test eax, eax
je 0x100bcb80
lea ebx, [eax - 4]
test ebx, ebx
je 0x100bcb80
mov eax, dword [ebx + 4]
test eax, eax
je 0x100bcb80
cmp eax, 0xc8
jg 0x100bcb80
cmp dword [ebx], 0
je 0x100bcb80
mov esi, dword [ebx + 8]
test esi, esi
je 0x100bcb80
mov edi, 0x811c9dc5
xor ecx, ecx
inc ecx
cmp byte [ecx + esi], 0
jne 0x100bca71
xor edx, edx
test ecx, ecx
je 0x100bca91
nop
movsx eax, byte [edx + esi]
inc edx
xor eax, edi
imul edi, eax, 0x1000193
cmp edx, ecx
jb 0x100bca80
mov dword [ebp - 0x14], edi
cmp dword [ebx + 4], 0
mov dword [ebp - 0x24], 0
jle 0x100bcb80
mov ecx, dword [ebp - 0x1c]
xor eax, eax
mov dword [ebp - 0x20], eax
nop dword [eax]
mov ebx, dword [ebx]
add ebx, eax
mov esi, dword [ebx + 4]
test esi, esi
je 0x100bcb67
mov edi, 0x811c9dc5
xor eax, eax
inc eax
cmp byte [eax + esi], 0
jne 0x100bcac6
xor edx, edx
test eax, eax
je 0x100bcae4
movsx ecx, byte [edx + esi]
inc edx
xor ecx, edi
imul edi, ecx, 0x1000193
cmp edx, eax
jb 0x100bcad3
lea eax, [ebp - 0x14]
mov dword [ebp - 0x18], edi
push eax
mov ecx, 0x1046ba28
call fcn.100ff4d0
lea ecx, [ebp - 0x18]
push ecx
mov ecx, eax
call fcn.100ff490
cmp dword [eax + 8], 0
jne 0x100bcb61
lea eax, [ebp - 0x14]
mov ecx, 0x1046ba28
push eax
call fcn.100ff4d0
lea ecx, [ebp - 0x18]
push ecx
mov ecx, eax
call fcn.100ff490
mov ecx, 0x1046ba28
mov byte [eax], 1
lea eax, [ebp - 0x14]
mov esi, dword [ebx + 8]
push eax
call fcn.100ff4d0
lea ecx, [ebp - 0x18]
push ecx
mov ecx, eax
call fcn.100ff490
mov ecx, 0x1046ba28
mov dword [eax + 8], esi
lea eax, [ebp - 0x14]
push eax
call fcn.100ff4d0
lea ecx, [ebp - 0x18]
push ecx
mov ecx, eax
call fcn.100ff490
mov dword [eax + 4], 0
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x20]
mov esi, dword [ebp - 0x24]
lea ebx, [ecx - 4]
inc esi
add eax, 0x3c
mov dword [ebp - 0x24], esi
mov dword [ebp - 0x20], eax
cmp esi, dword [ebx + 4]
jl 0x100bcab0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.101d57a0
mov esp, ebp
pop ebp
ret 4