joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4158b0
Capabilities:
Inspect section memory permissions

Disassembly:
mov edi, dword [ebp - 0x88]
mov eax, dword [ebp + 0xc]
cmp ax, word [edi + 6]
jne 0x415895
mov edx, dword [ebp - 0xb4]
xor ecx, ecx
mov edi, 0x60000000
jmp 0x4158b3
movzx eax, ax
lea eax, [eax + eax*4]
mov ecx, dword [edi + eax*8 + 0x104]
mov edx, dword [edi + eax*8 + 0x108]
lea eax, [edi + eax*8 + 0xf8]
mov edi, dword [eax + 0x24]
lea eax, [edx + ecx - 1]
xor edx, edx
div dword [ebp - 0xac]
xor edx, edx
mov dword [ebp - 0x44], eax
mov eax, ecx
div dword [ebp - 0xac]
cmp eax, dword [ebp - 0x44]
ja 0x415911
mov edx, edi
mov dword [ebp + 8], edi
and dword [ebp + 8], 0x40000000
mov dword [ebp + 0x10], edi
and edx, 0x20000000
and dword [ebp + 0x10], 0x80000000
mov ecx, dword [ebp + 0x18]
cmp edx, ebx
je 0x4158f8
or byte [eax + ecx], 1
cmp dword [ebp + 8], ebx
je 0x415901
or byte [eax + ecx], 2
cmp dword [ebp + 0x10], ebx
je 0x41590b
add ecx, eax
or byte [ecx], 4
inc eax
cmp eax, dword [ebp - 0x44]
jbe 0x4158ed
inc dword [ebp + 0xc]
mov eax, dword [ebp - 0x88]
mov cx, word [ebp + 0xc]
cmp cx, word [eax + 6]
jbe 0x415877
mov dword [ebp + 8], esi
xor edi, edi
dec dword [ebx + 0x26a1845]
mov eax, dword [ebp + 0x18]
push 2
pop ecx
movzx eax, byte [edi + eax]
sub eax, ecx
je 0x41595e
dec eax
je 0x415955
sub eax, 3
je 0x41594c
mov dword [ebp - 4], 0x40
jmp 0x41597b
mov dword [ebp - 4], 4
jmp 0x415961
mov dword [ebp - 4], 0x20
jmp 0x415961
mov dword [ebp - 4], ecx
lea eax, [ebp - 4]
push eax
push dword [ebp - 4]
push dword [ebp - 0xac]
push dword [ebp + 8]
call dword [ebp - 0xbc]
test eax, eax
je 0x4159ad
mov eax, dword [ebp - 0xac]
add dword [ebp + 8], eax
inc edi
cmp edi, dword [ebp - 0x8c]
jbe 0x41592d
mov eax, dword [ebp - 0x88]
mov edi, dword [eax + 0x28]
add edi, esi
call fcn.004151be
jecxz 0x41592c
or esi, dword [esi - 1]
jne 0x4159b8
push 1
push esi
call edi
mov eax, esi
jmp 0x4159b9
push 0x8000
push ebx
push esi
call dword [ebp - 8]
xor eax, eax
rcr byte [edi + 0x5e], 0x5b
pop edi
pop esi
pop ebx
leave
ret

Function at 0x415a50
Capabilities:
Contain obfuscated stackstrings

Disassembly:
test dword [esi + 0x25fffffc], edi
lea eax, [ebp - 0x354]
push eax
call fcn.004151ce
pop ecx
push eax
push dword [ebp + 0x18]
push dword [ebp + 0x14]
call fcn.00415183
add esp, 0xc
mov dword [ebp - 0x68c], eax
call dword [ebp - 0x68c]
mov dword [ebp - 0x674], eax
mov dword [ebp - 0x384], 4
invalid
movsd dword es:[edi], dword [esi]
Function at 0x415eb0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
add byte [eax], al
cmp dword [ebp + 0xc], 8
jne 0x416044
and byte [ebp - 0x6b8], 0
and byte [ebp - 0x6b7], 0
mov byte [ebp - 0x6b6], 0x9b
and byte [ebp - 0x6b5], 0
mov byte [ebp - 0x6b4], 0x33
mov byte [ebp - 0x6b3], 0x16
mov byte [ebp - 0x6b2], 0xd
mov byte [ebp - 0x6b1], 0x10
mov byte [ebp - 0x6b0], 1
mov byte [ebp - 0x6af], 0x34
mov byte [ebp - 0x6ae], 0x16
mov byte [ebp - 0x6ad], 0xb
mov byte [ebp - 0x6ac], 7
mov byte [ebp - 0x6ab], 1
mov byte [ebp - 0x6aa], 0x17
mov byte [ebp - 0x6a9], 0x17
mov byte [ebp - 0x6a8], 0x29
mov byte [ebp - 0x6a7], 1
mov byte [ebp - 0x6a6], 9
mov byte [ebp - 0x6a5], 0xb
mov byte [ebp - 0x6a4], 0x16
mov byte [ebp - 0x6a3], 0x1d
mov byte [ebp - 0x6a2], 0x64
lea eax, [ebp - 0x6b8]
push eax
call fcn.004151ce
pop ecx
push eax
push dword [ebp + 0x18]
push dword [ebp + 0x14]
call fcn.00415183
add esp, 0xc
mov dword [ebp - 0x690], eax
mov byte [ebp - 0x6a0], 0x8b
or byte [ebp - 0x69f], 0xff
mov byte [ebp - 0x69e], 0x55
mov byte [ebp - 0x69d], 0x8b
mov byte [ebp - 0x69c], 0xec
lea eax, [ebp - 0x694]
push eax
push 5
lea eax, [ebp - 0x6a0]
push eax
push dword [ebp - 0x33c]
push 0xffffffffffffffff
call dword [ebp - 0x690]
mov eax, dword [ebp + 8]
mov dword [ebp - 0x6c0], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x6bc], eax
push 0x1000
push 8
push dword [ebp - 0x674]
call dword [ebp - 0x67c]
mov dword [ebp - 0x698], eax
call fcn.004151be
mov ebp, 0xff74085f
mov ch, 0x68
stc
invalid
call fcn.004151be
jo 0x416092
cmp dword [eax + eax*4 - 0x5b], ebx
mov esp, 0xfffffa
push 0
call dword [ebp - 0x340]
mov dword [ebp + 8], eax
push 0x104
lea eax, [ebp - 0x334]
push eax
push 0
call dword [ebp - 0x538]
call fcn.004151be
cmp ebp, esi
mov byte [0xd0a580a3], al
std
invalid
Function at 0x4160b0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
inc dword [eax]
push 0x40
pop ecx
xor eax, eax
lea edi, [ebp - 0x22f]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
and byte [ebp - 0x12c], 0
push 0x40
pop ecx
xor eax, eax
lea edi, [ebp - 0x12b]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
and byte [ebp - 0x654], 0
add byte [edx + 0x40], ch
pop ecx
xor eax, eax
lea edi, [ebp - 0x653]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
and byte [ebp - 0x504], 0
push 0x40
pop ecx
xor eax, eax
lea edi, [ebp - 0x503]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
call fcn.0041519c
or byte [eax + 0x2ff845c6], ah
mov byte [ebp - 0x24], 0x34
and byte [ebp - 0x36c], 0
and byte [ebp - 0x36b], 0
mov byte [ebp - 0x36a], 0xaa
and byte [ebp - 0x369], 0
mov byte [ebp - 0x368], 0x12
mov byte [ebp - 0x367], 0x30
mov byte [ebp - 0x366], 0x21
mov byte [ebp - 0x365], 6
mov byte [ebp - 0x364], 0x2c
mov byte [ebp - 0x363], 0x26
mov byte [ebp - 0x362], 0x21
mov byte [ebp - 0x361], 0x30
mov byte [ebp - 0x360], 0x38
mov byte [ebp - 0x35f], 0x11
mov byte [ebp - 0x35e], 0x3c
mov byte [ebp - 0x35d], 0x27
mov byte [ebp - 0x35c], 0x30
mov byte [ebp - 0x35b], 0x36
mov byte [ebp - 0x35a], 0x21
mov byte [ebp - 0x359], 0x3a
mov byte [ebp - 0x358], 0x27
mov byte [ebp - 0x357], 0x2c
mov byte [ebp - 0x356], 0x14
mov byte [ebp - 0x355], 0x55
lea eax, [ebp - 0x36c]
push eax
call fcn.004151ce
pop ecx
push eax
push dword [ebp + 0x18]
push dword [ebp + 0x14]
call fcn.00415183
add esp, 0xc
mov dword [ebp - 0x3d4], eax
call fcn.004151be
jo 0x416225
xchg edi, eax
xchg ebp, eax
push 0x104
lea eax, [ebp - 0x12c]
push eax
call dword [ebp - 0x3d4]
mov dword [ebp - 0x28], eax
call fcn.004151be
scasd eax, dword es:[edi]
rcl dword [ebp + 0x7c], cl
and byte [ebp - 0x20], 0
and byte [ebp - 0x1f], 0
mov byte [ebp - 0x1e], 0x1d
and byte [ebp - 0x1d], 0
mov byte [ebp - 0x1c], 0xa5
mov byte [ebp - 0x1b], 0x87
mov byte [ebp - 0x1a], 0x96
mov byte [ebp - 0x19], 0xb6
mov byte [ebp - 0x18], 0x87
mov byte [ebp - 0x17], 0x8f
mov byte [ebp - 0x16], 0x92
mov byte [ebp - 0x15], 0xb2
mov byte [ebp - 0x14], 0x83
mov byte [ebp - 0x13], 0x96
mov byte [ebp - 0x12], 0x8a
mov byte [ebp - 0x11], 0xa3
mov byte [ebp - 0x10], 0xe2
lea eax, [ebp - 0x20]
push eax
call fcn.004151ce
pop ecx
push eax
push dword [ebp + 0x18]
push dword [ebp + 0x14]
call fcn.00415183
add esp, 0xc
mov dword [ebp - 0x370], eax
lea eax, [ebp - 0x654]
push eax
push 0x104
call dword [ebp - 0x370]
mov dword [ebp - 0x550], eax
mov eax, dword [ebp - 0x28]
movsx eax, byte [ebp + eax - 0x12d]
cmp eax, 0x5c
jne 0x41626a
mov eax, dword [ebp - 0x28]
dec eax
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x550]
movsx eax, byte [ebp + eax - 0x655]
cmp eax, 0x5c
jne 0x41628a
mov eax, dword [ebp - 0x550]
dec eax
mov dword [ebp - 0x550], eax
and dword [ebp - 0x338], 0
and dword [ebp - 0x3d0], 0
jmp 0x4162a7
mov eax, dword [ebp - 0x3d0]
inc eax
mov dword [ebp - 0x3d0], eax
cmp dword [ebp - 0x3d0], 0x104
jge 0x41630e
mov eax, dword [ebp - 0x3d0]
invalid
mov esi, 0xfccc0584
invalid
Function at 0x467510
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x48e30c
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push esi
push edi
mov eax, dword [0x4bc1dc]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov dword [ebp - 0x14], ebx
lea eax, [ebp - 0x10]
mov dword [ebp - 4], 5
push eax
call fcn.004688b0
mov ecx, ebx
mov byte [ebp - 4], 6
call fcn.0046a100
cmp byte [ebx + 0x590], 0
je 0x46757c
lea ecx, [ebp - 0x10]
call fcn.0046b860
test eax, eax
je 0x46757c
lea ecx, [ebp - 0x10]
call fcn.0046b310
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov eax, dword [ebx + 0x594]
mov ecx, dword [eax]
mov dword [eax], eax
mov eax, dword [ebx + 0x594]
mov dword [eax + 4], eax
mov dword [ebx + 0x598], 0
cmp ecx, dword [ebx + 0x594]
je 0x4675b6
mov esi, dword [ecx]
push ecx
call fcn.004705af
add esp, 4
mov ecx, esi
cmp esi, dword [ebx + 0x594]
jne 0x4675a1
push ebx
call fcn.00447ed0
mov ecx, dword [ebp - 0x10]
mov byte [ebp - 4], 5
test ecx, ecx
je 0x4675cc
call fcn.0046b840
mov eax, dword [ebx + 0x594]
mov ecx, dword [eax]
mov dword [eax], eax
mov eax, dword [ebx + 0x594]
mov dword [eax + 4], eax
mov dword [ebx + 0x598], 0
cmp ecx, dword [ebx + 0x594]
je 0x467606
mov esi, dword [ecx]
push ecx
call fcn.004705af
add esp, 4
mov ecx, esi
cmp esi, dword [ebx + 0x594]
jne 0x4675f1
push dword [ebx + 0x594]
call fcn.004705af
mov eax, dword [ebx + 0x584]
add esp, 4
mov esi, dword [sym.imp.KERNEL32.dll_VirtualFree]
test eax, eax
je 0x467637
push 0x4000
lea eax, [eax + eax*4]
push eax
push dword [ebx + 0x578]
call esi
jmp 0x46764f
push dword [ebx + 0x578]
call fcn.00471b0c
add esp, 4
mov dword [ebx + 0x578], 0
cmp dword [ebx + 0x584], 0
mov dword [ebx + 0x57c], 0
mov dword [ebx + 0x580], 0
je 0x46767b
push 0x8000
push 0
push dword [ebx + 0x578]
call esi
lea ecx, [ebx + 0x52c]
mov byte [ebp - 4], 2
call 0x415a90
mov eax, dword [ebx + 0x514]
lea edi, [ebx + 0x4fc]
push eax
lea ecx, [edi + 0x18]
push dword [eax]
lea eax, [ebp - 0x18]
push eax
call fcn.0045e160
push dword [edi + 0x18]
call fcn.004705af
add esp, 4
push edi
call dword [sym.imp.KERNEL32.dll_DeleteCriticalSection]
lea ecx, [ebx + 0x4c8]
mov byte [ebp - 4], 0
call fcn.0040d8e0
lea ecx, [ebx + 0x3c0]
mov dword [ebp - 4], 0xffffffff
call fcn.00415b30
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10003160
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x18
mov dword [ebp - 0x1c], esp
mov dword [ebp - 0x10], 0xffffffff
lea eax, [ebp - 0x18]
mov dword [ebp - 0x14], 0x10020b70
mov ecx, dword fs:[0]
mov dword [ebp - 0x18], ecx
mov dword fs:[0], eax
push 0xd0
call fcn.100f13cd
add esp, 4
lea esi, [eax + 0x18]
xorps xmm0, xmm0
movups xmmword [eax + 0x10], xmm0
movups xmmword [eax + 0x20], xmm0
movups xmmword [eax + 0x40], xmm0
movups xmmword [eax + 0x30], xmm0
movups xmmword [eax], xmm0
movups xmmword [eax + 0x50], xmm0
movups xmmword [eax + 0x60], xmm0
movups xmmword [eax + 0x70], xmm0
movups xmmword [eax + 0x80], xmm0
movups xmmword [eax + 0x90], xmm0
movups xmmword [eax + 0xa0], xmm0
movups xmmword [eax + 0xb0], xmm0
movups xmmword [eax + 0xc0], xmm0
mov dword [eax + 0x1c], 0x5562b51
mov dword [eax + 0x18], vtable.sdk::cfg_var_t_struct_csgo::hacks::c_anti_aim::cfg_t_.0
mov dword [eax + 0x26], 0
mov dword [eax + 0x2a], 0
mov dword [eax + 0x20], 0
mov dword [eax + 0x24], 0
movups xmmword [eax + 0x3c], xmm0
mov dword [eax + 0x4c], 2
mov word [eax + 0x58], 0
mov dword [eax + 0x50], 0
mov dword [eax + 0x54], 0
mov byte [eax + 0x64], 0
mov dword [eax + 0x6c], 0
mov byte [eax + 0x74], 0
mov byte [eax + 0x7c], 0
mov dword [eax + 0x84], 0
mov byte [eax + 0x8c], 0
mov byte [eax + 0x94], 0
mov dword [eax + 0x9c], 0
mov byte [eax + 0xa4], 0
mov byte [eax + 0xac], 0
mov dword [ebp - 0x20], eax
mov byte [eax + 0xb1], 0
mov ecx, dword [0x1026fc6c]
mov dword [ebp - 0x24], esi
mov edx, dword [ecx + 8]
cmp edx, dword [ecx + 0xc]
je 0x10003291
mov dword [edx], esi
add dword [ecx + 8], 4
jmp 0x100032a5
add ecx, 4
mov dword [ebp - 0x10], 0
lea eax, [ebp - 0x24]
push eax
push edx
call fcn.10018320
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0x20]
mov word [ecx + 0xb4], 0
mov dword [ecx + 0xb8], 0
mov dword [ecx + 0xbc], 0
mov byte [ecx + 0xc0], 0
mov dword [ecx + 0xc8], 0
mov dword [ecx + 0xc4], 0
mov dword [ecx + 0xcc], 0
mov dword [eax], ecx
mov ecx, dword [ebp - 0x18]
mov dword fs:[0], ecx
add esp, 0x18
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x10003eb0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x24
mov ecx, dword [ebp + 0xc]
mov dword [ebp - 0x1c], esp
mov dword [ebp - 0x10], 0xffffffff
lea eax, [ebp - 0x18]
mov dword [ebp - 0x14], 0x100209d0
mov edx, dword fs:[0]
mov dword [ebp - 0x18], edx
mov dword fs:[0], eax
xor eax, eax
cmp ecx, 1
jne 0x10003fbd
mov dword [ebp - 0x28], 0
mov dword [ebp - 0x24], 0
mov dword [ebp - 0x2c], 0
mov dword [ebp - 0x10], 0
push 0x14
call fcn.100f13cd
add esp, 4
movaps xmm0, xmmword [0x10141280]
movups xmmword [eax], xmm0
mov dword [eax + 0x10], 0
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x10], 1
push 1
call fcn.100f13cd
add esp, 4
mov esi, eax
lea eax, [ebp - 0x24]
push eax
push 0
push esi
push 0x1001f730
push 0
push 0
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
add esp, 0x18
mov dword [ebp - 0x28], eax
test eax, eax
je 0x10003fd1
mov ecx, dword [ebp - 0x24]
test ecx, ecx
je 0x10003fec
push ecx
push eax
call sub.MSVCP140.dll__Thrd_detach
add esp, 8
test eax, eax
jne 0x10003ffd
mov dword [ebp - 0x28], 0
mov dword [ebp - 0x24], 0
lea ecx, [ebp - 0x28]
call fcn.1001f240
mov eax, dword [ebp - 0x20]
test eax, eax
je 0x10003fb2
mov ecx, 0xfffffffe
lock xadd dword [eax + 4], ecx
and ecx, 0xfffffffe
cmp ecx, 2
jne 0x10003fb2
lock dec dword [eax]
jne 0x10003fb2
push eax
call fcn.100f14ab
add esp, 4
cmp dword [ebp - 0x24], 0
jne 0x1000400e
mov eax, 1
mov ecx, dword [ebp - 0x18]
mov dword fs:[0], ecx
add esp, 0x24
pop esi
pop edi
pop ebx
pop ebp
ret 0xc
mov dword [ebp - 0x30], esi
mov dword [ebp - 0x24], 0
mov dword [ebp - 0x10], 2
push 6
call sub.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_
add esp, 4
mov dword [ebp - 0x10], 3
push 1
call sub.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_
add esp, 4
mov dword [ebp - 0x10], 3
push 1
call sub.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_
add esp, 4
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_terminate]
nop word cs:[eax + eax]
push ebp
sub esp, 0x18
add ebp, 0xc
push dword [ebp - 0x30]
call fcn.100f14ab
add esp, 0x1c
pop ebp
ret
Function at 0x10004170
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x50
mov esi, esp
mov dword [esi + 0x38], ebp
mov edx, dword [ebp + 8]
mov dword [esi + 0x3c], esp
mov dword [esi + 0x48], 0xffffffff
lea eax, [esi + 0x40]
mov dword [esi + 0x44], 0x100209e0
mov ecx, dword fs:[0]
mov dword [esi + 0x40], ecx
mov dword fs:[0], eax
mov eax, dword fs:[0x30]
mov dword [esi + 0x10], 0x10141bc4
mov dword [esi + 0x14], edx
lea ecx, [esi + 0x10]
mov dword [esi + 0x34], ecx
mov eax, dword [eax + 0xc]
mov edx, dword [eax + 0xc]
add eax, 0xc
mov dword [esi + 4], eax
cmp edx, eax
jne 0x100041d7
jmp 0x1000420a
mov edx, dword [edx]
cmp edx, dword [esi + 4]
je 0x10004203
test edx, edx
je 0x100041d0
mov dword [esi + 8], edx
mov dword [esi + 0xc], edx
mov ecx, dword [esi + 0x34]
mov dword [esi + 0x48], 0
test ecx, ecx
je 0x10004284
mov eax, dword [ecx]
lea edx, [esi + 0xc]
push edx
call dword [eax + 8]
test al, al
mov edx, dword [esi + 8]
je 0x100041d0
mov ecx, dword [esi + 0x34]
test ecx, ecx
je 0x1000421a
xor eax, eax
lea edx, [esi + 0x10]
cmp ecx, edx
setne al
mov edx, dword [ecx]
push eax
call dword [edx + 0x10]
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 0x18]
mov eax, dword [ecx + 4]
mov edi, dword [ecx + 0xc]
add edx, edx
and edx, 0x1f102e22
mov ecx, dword [edi + edx*4 + 4]
cmp ecx, eax
je 0x10004262
cmp dword [ecx + 8], 0xb749e5ab
je 0x10004264
mov edx, dword [edi + edx*4]
nop word cs:[eax + eax]
cmp ecx, edx
je 0x10004262
mov ecx, dword [ecx + 4]
cmp dword [ecx + 8], 0xb749e5ab
jne 0x10004250
jmp 0x10004264
xor ecx, ecx
test ecx, ecx
sete dl
cmp ecx, eax
sete al
or al, dl
mov ecx, dword [esi + 0x40]
mov dword fs:[0], ecx
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret 4
call sub.MSVCP140.dll_void___cdecl_std::_Xbad_function_call_void_
nop dword [eax]
push ebp
push eax
lea esi, [ebp - 0x4c]
mov ebp, dword [esi + 0x38]
mov ecx, dword [esi + 0x34]
test ecx, ecx
je 0x100042af
lea eax, [esi + 0x10]
xor edx, edx
cmp ecx, eax
setne dl
mov eax, dword [ecx]
push edx
call dword [eax + 0x10]
add esp, 4
pop ebp
ret
Function at 0x10017970
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x2c
mov dword [ebp - 0x1c], esp
mov dword [ebp - 0x10], 0xffffffff
lea eax, [ebp - 0x18]
mov dword [ebp - 0x14], 0x10020bd0
mov edx, dword fs:[0]
mov dword [ebp - 0x18], edx
mov dword fs:[0], eax
mov dword [ecx], 0
mov dword [ebp - 0x20], ecx
mov dword [ecx + 4], 0
mov dword [ebp - 0x2c], 0
mov dword [ebp - 0x10], 0
push 0x14
call fcn.100f13cd
add esp, 4
mov edx, eax
mov ecx, dword [ebp - 0x20]
lea eax, [ecx + 8]
movaps xmm0, xmmword [0x10141280]
movups xmmword [edx], xmm0
mov dword [edx + 0x10], 0
mov dword [ebp - 0x30], eax
mov dword [eax], edx
lock inc dword [edx]
lea eax, [ecx + 4]
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x34], edx
mov dword [ebp - 0x28], edx
mov dword [ebp - 0x10], 1
push 8
call fcn.100f13cd
add esp, 4
mov ecx, dword [ebp + 8]
mov edx, dword [ebp - 0x34]
mov dword [eax], edx
mov dword [eax + 4], ecx
mov dword [ebp - 0x38], eax
mov esi, dword [ebp - 0x24]
push esi
push 0
push eax
push 0x10017b10
push 0
push 0
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
add esp, 0x18
mov ecx, dword [ebp - 0x20]
mov dword [ecx], eax
test eax, eax
je 0x10017a49
mov eax, dword [ebp - 0x18]
mov dword fs:[0], eax
mov eax, dword [ebp - 0x20]
add esp, 0x2c
pop esi
pop edi
pop ebx
pop ebp
ret 4
mov dword [esi], 0
mov dword [ebp - 0x10], 2
push 6
call sub.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_
add esp, 4
push ebp
sub esp, 0x18
add ebp, 0xc
lea ecx, [ebp - 0x38]
call fcn.10017ba0
mov dword [ebp - 0x28], 0
add esp, 0x18
pop ebp
ret
Function at 0x10017ea0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x20
mov esi, ecx
mov eax, dword [ebp + 8]
mov dword [ebp - 0x1c], esp
mov dword [ebp - 0x10], 0xffffffff
lea ecx, [ebp - 0x18]
mov dword [ebp - 0x14], 0x10020bf0
mov edx, dword fs:[0]
mov dword [ebp - 0x18], edx
mov dword fs:[0], ecx
mov eax, dword [eax]
mov dword [esi], eax
lea eax, [esi + 4]
mov dword [ebp - 0x24], eax
mov dword [esi + 4], 0
mov dword [esi + 8], 0
push 0x28
call fcn.100f13cd
add esp, 4
mov dword [eax], eax
mov dword [eax + 4], eax
mov dword [ebp - 0x28], eax
mov dword [esi + 4], eax
lea eax, [esi + 0xc]
mov dword [ebp - 0x20], eax
movaps xmm0, xmmword [0x101412d0]
movups xmmword [esi + 0xc], xmm0
mov dword [esi + 0x1c], 8
mov dword [ebp - 0x2c], esi
mov dword [esi], 0x3f800000
mov dword [ebp - 0x10], 0
push 0x40
call fcn.100f13cd
add esp, 4
mov esi, eax
mov edi, dword [ebp - 0x2c]
mov ecx, dword [edi + 0xc]
mov eax, dword [edi + 0x14]
sub eax, ecx
je 0x10017f64
cmp eax, 0x1000
jb 0x10017f5a
mov edx, dword [ecx - 4]
add ecx, 0xfffffffc
sub ecx, edx
cmp ecx, 0x20
jae 0x10017fa4
add eax, 0x23
mov ecx, edx
push eax
push ecx
call fcn.100f14b0
add esp, 8
mov dword [edi + 0xc], esi
mov eax, esi
add eax, 0x40
mov dword [edi + 0x10], eax
mov dword [edi + 0x14], eax
movd xmm0, dword [ebp - 0x28]
pshufd xmm0, xmm0, 0
movdqu xmmword [esi], xmm0
movdqu xmmword [esi + 0x10], xmm0
movdqu xmmword [esi + 0x20], xmm0
movdqu xmmword [esi + 0x30], xmm0
mov eax, dword [ebp - 0x18]
mov dword fs:[0], eax
mov eax, edi
add esp, 0x20
pop esi
pop edi
pop ebx
pop ebp
ret 8
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop word [eax + eax]
push ebp
sub esp, 8
add ebp, 0xc
mov ecx, dword [ebp - 0x20]
call fcn.10017fd0
mov ecx, dword [ebp - 0x24]
call fcn.10018020
add esp, 8
pop ebp
ret
Function at 0x1001d070
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x20
mov esi, ecx
mov eax, dword [ebp + 8]
mov dword [ebp - 0x1c], esp
mov dword [ebp - 0x10], 0xffffffff
lea ecx, [ebp - 0x18]
mov dword [ebp - 0x14], 0x10020da0
mov edx, dword fs:[0]
mov dword [ebp - 0x18], edx
mov dword fs:[0], ecx
mov eax, dword [eax]
mov dword [esi], eax
lea eax, [esi + 4]
mov dword [ebp - 0x24], eax
mov dword [esi + 4], 0
mov dword [esi + 8], 0
push 0x6c
call fcn.100f13cd
add esp, 4
mov dword [eax], eax
mov dword [eax + 4], eax
mov dword [ebp - 0x28], eax
mov dword [esi + 4], eax
lea eax, [esi + 0xc]
mov dword [ebp - 0x20], eax
movaps xmm0, xmmword [0x101412d0]
movups xmmword [esi + 0xc], xmm0
mov dword [esi + 0x1c], 8
mov dword [ebp - 0x2c], esi
mov dword [esi], 0x3f800000
mov dword [ebp - 0x10], 0
push 0x40
call fcn.100f13cd
add esp, 4
mov esi, eax
mov edi, dword [ebp - 0x2c]
mov ecx, dword [edi + 0xc]
mov eax, dword [edi + 0x14]
sub eax, ecx
je 0x1001d134
cmp eax, 0x1000
jb 0x1001d12a
mov edx, dword [ecx - 4]
add ecx, 0xfffffffc
sub ecx, edx
cmp ecx, 0x20
jae 0x1001d174
add eax, 0x23
mov ecx, edx
push eax
push ecx
call fcn.100f14b0
add esp, 8
mov dword [edi + 0xc], esi
mov eax, esi
add eax, 0x40
mov dword [edi + 0x10], eax
mov dword [edi + 0x14], eax
movd xmm0, dword [ebp - 0x28]
pshufd xmm0, xmm0, 0
movdqu xmmword [esi], xmm0
movdqu xmmword [esi + 0x10], xmm0
movdqu xmmword [esi + 0x20], xmm0
movdqu xmmword [esi + 0x30], xmm0
mov eax, dword [ebp - 0x18]
mov dword fs:[0], eax
mov eax, edi
add esp, 0x20
pop esi
pop edi
pop ebx
pop ebp
ret 8
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop word [eax + eax]
push ebp
sub esp, 8
add ebp, 0xc
mov ecx, dword [ebp - 0x20]
call fcn.10017fd0
mov ecx, dword [ebp - 0x24]
call fcn.1001d1a0
add esp, 8
pop ebp
ret
Function at 0x1001fb80
Capabilities:
Hash data using fnv

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x10
mov eax, dword [esp + 0x24]
cmp eax, 0x10000001
jae 0x1001fd00
mov ebx, ecx
dec eax
or eax, 1
bsr ecx, eax
xor ecx, 0x1f
neg cl
mov esi, 1
shl esi, cl
lea eax, [ebx + 0xc]
mov edi, dword [ebx + 4]
mov edx, 2
shl edx, cl
mov ecx, eax
push edi
push edx
call fcn.1001fd10
lea eax, [esi - 1]
mov dword [ebx + 0x18], eax
mov dword [ebx + 0x1c], esi
mov eax, dword [ebx + 4]
mov eax, dword [eax]
cmp eax, edi
je 0x1001fcf6
mov dword [esp + 4], ebx
mov dword [esp], edi
jmp 0x1001fbf4
mov dword [edx + ebx*4], ecx
mov dword [edx + esi*4], ecx
mov ebx, eax
mov eax, dword [esp + 0xc]
cmp eax, edi
je 0x1001fcf6
mov ecx, eax
mov eax, dword [eax]
mov dword [esp + 0xc], eax
movzx edx, byte [ecx + 8]
xor edx, 0x811c9dc5
imul edx, edx, 0x1000193
movzx esi, byte [ecx + 9]
xor esi, edx
imul edx, esi, 0x1000193
movzx esi, byte [ecx + 0xa]
xor esi, edx
imul edx, esi, 0x1000193
movzx esi, byte [ecx + 0xb]
xor esi, edx
imul edi, esi, 0x1000193
and edi, dword [ebx + 0x18]
mov edx, dword [ebx + 0xc]
mov eax, ebx
lea ebx, [edi + edi]
lea esi, [edi*2 + 1]
mov ebp, dword [edx + edi*8]
mov edi, dword [esp]
cmp ebp, edi
je 0x1001fbe0
mov dword [esp + 8], ebx
mov edi, dword [edx + esi*4]
mov ebx, dword [ecx + 8]
cmp ebx, dword [edi + 8]
jne 0x1001fc90
mov edi, dword [edi]
cmp edi, ecx
mov eax, dword [esp + 0xc]
je 0x1001fce4
mov ebx, dword [ecx + 4]
mov dword [esp + 8], ebx
mov dword [ebx], eax
mov ebp, dword [eax + 4]
mov dword [ebp], edi
mov ebx, dword [edi + 4]
mov dword [ebx], ecx
mov dword [edi + 4], ebp
mov edi, dword [esp + 8]
mov dword [eax + 4], edi
mov dword [ecx + 4], ebx
jmp 0x1001fce4
mov eax, dword [esp + 0xc]
nop word cs:[eax + eax]
cmp ebp, edi
je 0x1001fcc8
mov edi, dword [edi + 4]
cmp ebx, dword [edi + 8]
jne 0x1001fca0
mov edx, dword [edi]
mov esi, dword [ecx + 4]
mov dword [esi], eax
mov edi, dword [eax + 4]
mov dword [edi], edx
mov ebx, dword [edx + 4]
mov dword [ebx], ecx
mov dword [edx + 4], edi
mov dword [eax + 4], esi
mov dword [ecx + 4], ebx
jmp 0x1001fce7
mov esi, dword [ecx + 4]
mov dword [esi], eax
mov edi, dword [eax + 4]
mov dword [edi], ebp
mov ebx, dword [ebp + 4]
mov dword [ebx], ecx
mov dword [ebp + 4], edi
mov dword [eax + 4], esi
mov dword [ecx + 4], ebx
mov esi, dword [esp + 8]
mov dword [edx + esi*4], ecx
mov ebx, dword [esp + 4]
mov edi, dword [esp]
cmp eax, edi
jne 0x1001fbf4
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret 4
push str.invalid_hash_bucket_count
call sub.MSVCP140.dll_void___cdecl_std::_Xlength_error_char_const__
int3