joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10290fa0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
mov esi, ecx
mov eax, dword [ecx + 0x14]
test eax, eax
je 0x10290fe9
mov edi, dword [esi + 0x10]
lea ecx, [edi - 1]
cmp dword [esi + 0xc], ecx
jb 0x10291009
lea ecx, [edi*4 + 0x20]
push ecx
push eax
call dword [sym.imp.mozglue.dll_realloc]
add esp, 8
mov dword [esi + 0x14], eax
test eax, eax
je 0x1029100d
add edi, 8
mov ecx, dword [esi + 0x10]
xorps xmm0, xmm0
movups xmmword [eax + ecx*4 + 0x10], xmm0
movups xmmword [eax + ecx*4], xmm0
mov dword [esi + 0x10], edi
jmp 0x10291009
push 4
call dword [sym.imp.mozglue.dll_malloc]
add esp, 4
mov dword [esi + 0x14], eax
test eax, eax
je 0x1029100d
xor ecx, ecx
mov dword [eax], ecx
mov dword [esi + 0x10], 1
mov dword [esi + 0xc], ecx
pop esi
pop edi
pop ebp
ret
mov esi, 2
push esi
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
add esp, 4
push str.out_of_dynamic_memory_in_yyensure_buffer_stack__
push 0x10365e67
push eax
call fcn.1021b4a0
add esp, 0xc
push esi
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3

Function at 0x10291040
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
mov esi, edx
mov edi, ecx
push 0x30
call dword [sym.imp.mozglue.dll_malloc]
add esp, 4
test eax, eax
je 0x10291092
mov ebx, eax
mov dword [eax + 0xc], 0x4000
push 0x4002
call dword [sym.imp.mozglue.dll_malloc]
add esp, 4
mov dword [ebx + 4], eax
test eax, eax
je 0x10291092
mov dword [ebx + 0x14], 1
mov ecx, ebx
mov edx, edi
push esi
call fcn.10291eb0
add esp, 4
mov eax, ebx
pop esi
pop edi
pop ebx
pop ebp
ret
mov esi, 2
push esi
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
add esp, 4
push str.out_of_dynamic_memory_in_yy_create_buffer__
push 0x10365e67
push eax
call fcn.1021b4a0
add esp, 0xc
push esi
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3

Function at 0x10291e00
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, 2
push esi
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
add esp, 4
push str.fatal_flex_scanner_internal_error__no_action_found
push 0x10365e67
push eax
call fcn.1021b4a0
add esp, 0xc
push esi
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3

Function at 0x10292060
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push esi
mov eax, dword [edx + 0x14]
test eax, eax
je 0x1029207b
mov edx, dword [edx + 0xc]
mov eax, dword [eax + edx*4]
test eax, eax
je 0x1029207b
mov dword [eax + 0x20], ecx
pop esi
pop ebp
ret
mov esi, 2
push esi
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
add esp, 4
push str.yyset_lineno_called_with_no_buffer
push 0x10365e67
push eax
call fcn.1021b4a0
add esp, 0xc
push esi
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
Function at 0x102920b0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push esi
mov eax, dword [edx + 0x14]
test eax, eax
je 0x102920cb
mov edx, dword [edx + 0xc]
mov eax, dword [eax + edx*4]
test eax, eax
je 0x102920cb
mov dword [eax + 0x24], ecx
pop esi
pop ebp
ret
mov esi, 2
push esi
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
add esp, 4
push str.yyset_column_called_with_no_buffer
push 0x10365e67
push eax
call fcn.1021b4a0
add esp, 0xc
push esi
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3

Function at 0x102962b0
Capabilities:
Encode data using base64

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 0x98]
pop ebp
jmp fcn.10292360
Function at 0x1029ab50
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 8
mov esi, ecx
mov ebx, dword [ebp + 0xc]
movzx eax, byte [ebx]
xor eax, 0x811c9dc5
imul eax, eax, 0x1000193
movzx ecx, byte [ebx + 1]
xor ecx, eax
imul eax, ecx, 0x1000193
movzx ecx, byte [ebx + 2]
xor ecx, eax
imul eax, ecx, 0x1000193
movzx ecx, byte [ebx + 3]
xor ecx, eax
imul eax, ecx, 0x1000193
mov ecx, dword [esi + 0x18]
mov dword [ebp - 0x14], eax
and ecx, eax
mov edx, dword [esi + 0xc]
mov edi, dword [edx + ecx*8 + 4]
cmp edi, dword [esi + 4]
je 0x1029abd2
mov eax, dword [ebx]
cmp eax, dword [edi + 8]
je 0x1029abbc
add ecx, ecx
mov ecx, dword [edx + ecx*4]
cmp edi, ecx
je 0x1029abd0
mov edi, dword [edi + 4]
cmp eax, dword [edi + 8]
jne 0x1029abb0
xor ecx, ecx
mov eax, dword [ebp + 8]
mov dword [eax], edi
mov byte [eax + 4], cl
add esp, 8
pop esi
pop edi
pop ebx
pop ebp
ret 8
mov edi, ecx
cmp dword [esi + 8], 0xfffffff
je 0x1029ac89
push 0x10
call dword [sym.imp.mozglue.dll_moz_xmalloc]
add esp, 4
mov ebx, dword [ebx]
mov dword [eax + 8], ebx
mov dword [eax + 0xc], 0
mov ecx, dword [esi + 8]
inc ecx
movq xmm0, qword [0x102c3120]
movd xmm1, ecx
por xmm1, xmm0
subsd xmm1, xmm0
cvtsd2ss xmm1, xmm1
movss xmm2, dword [esi + 0x1c]
orpd xmm2, xmm0
subsd xmm2, xmm0
xorps xmm0, xmm0
cvtsd2ss xmm0, xmm2
divss xmm1, xmm0
ucomiss xmm1, dword [esi]
jbe 0x1029ac4e
mov dword [ebp - 0x10], eax
mov ecx, esi
call fcn.1029aca0
mov eax, dword [esi + 0x18]
and eax, dword [ebp - 0x14]
mov ecx, dword [esi + 0xc]
mov edi, dword [ecx + eax*8 + 4]
cmp edi, dword [esi + 4]
jne 0x1029ac63
mov eax, dword [ebp - 0x10]
mov ecx, esi
push eax
push edi
push dword [ebp - 0x14]
call fcn.10218310
mov edi, eax
mov cl, 1
jmp 0x1029abbe
cmp ebx, dword [edi + 8]
jne 0x1029ac6f
mov eax, dword [ebp - 0x10]
mov edi, dword [edi]
jmp 0x1029ac4e
add eax, eax
mov ecx, dword [ecx + eax*4]
mov eax, dword [ebp - 0x10]
cmp edi, ecx
je 0x1029ac85
mov edi, dword [edi + 4]
cmp ebx, dword [edi + 8]
jne 0x1029ac77
jmp 0x1029ac6b
mov edi, ecx
jmp 0x1029ac4e
push str.unordered_map_set_too_long
call sub.MSVCP140.dll_void___cdecl_std::_Xlength_error_char_const__
int3
Function at 0x1029ad40
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x10
mov eax, dword [ebp + 8]
cmp eax, 0x10000001
jae 0x1029ae99
mov edi, ecx
dec eax
or eax, 1
bsr ecx, eax
xor ecx, 0x1f
neg cl
xor esi, esi
inc esi
shl esi, cl
lea eax, [edi + 0xc]
mov ebx, dword [edi + 4]
mov edx, 2
shl edx, cl
mov ecx, eax
push ebx
push edx
call fcn.10217f20
lea eax, [esi - 1]
mov dword [edi + 0x18], eax
mov dword [edi + 0x1c], esi
mov eax, dword [edi + 4]
mov ecx, dword [eax]
cmp ecx, ebx
je 0x1029ae8f
mov dword [ebp - 0x14], edi
mov dword [ebp - 0x18], ebx
mov eax, ecx
movzx ecx, byte [ecx + 8]
xor ecx, 0x811c9dc5
imul ecx, ecx, 0x1000193
movzx edx, byte [eax + 9]
xor edx, ecx
imul ecx, edx, 0x1000193
movzx edx, byte [eax + 0xa]
xor edx, ecx
imul ecx, edx, 0x1000193
movzx edx, byte [eax + 0xb]
xor edx, ecx
imul ecx, edx, 0x1000193
and ecx, dword [edi + 0x18]
mov edx, dword [edi + 0xc]
lea edi, [ecx + ecx]
lea esi, [ecx + ecx]
inc esi
mov dword [ebp - 0x10], esi
mov esi, dword [edx + ecx*8]
mov ecx, dword [eax]
cmp esi, ebx
je 0x1029ae24
mov dword [ebp - 0x1c], edi
mov edi, dword [ebp - 0x10]
mov ebx, dword [edx + edi*4]
mov edi, dword [eax + 8]
cmp edi, dword [ebx + 8]
je 0x1029ae32
cmp esi, ebx
je 0x1029ae6c
mov ebx, dword [ebx + 4]
cmp edi, dword [ebx + 8]
jne 0x1029adfc
mov edx, dword [ebx]
mov esi, dword [eax + 4]
mov dword [esi], ecx
mov edi, dword [ecx + 4]
mov dword [edi], edx
mov ebx, dword [edx + 4]
mov dword [ebx], eax
mov dword [edx + 4], edi
mov dword [ecx + 4], esi
mov dword [eax + 4], ebx
jmp 0x1029ae5c
mov dword [edx + edi*4], eax
mov esi, dword [ebp - 0x10]
mov dword [edx + esi*4], eax
mov edi, dword [ebp - 0x14]
jmp 0x1029ae62
mov esi, dword [ebx]
cmp esi, eax
je 0x1029ae56
mov edi, dword [eax + 4]
mov dword [ebp - 0x1c], edi
mov dword [edi], ecx
mov ebx, dword [ecx + 4]
mov dword [ebx], esi
mov edi, dword [esi + 4]
mov dword [edi], eax
mov dword [esi + 4], ebx
mov esi, dword [ebp - 0x1c]
mov dword [ecx + 4], esi
mov dword [eax + 4], edi
mov esi, dword [ebp - 0x10]
mov dword [edx + esi*4], eax
mov edi, dword [ebp - 0x14]
mov ebx, dword [ebp - 0x18]
cmp ecx, ebx
jne 0x1029ad9c
jmp 0x1029ae8f
mov edi, dword [eax + 4]
mov dword [ebp - 0x10], edi
mov dword [edi], ecx
mov ebx, dword [ecx + 4]
mov dword [ebx], esi
mov edi, dword [esi + 4]
mov dword [edi], eax
mov dword [esi + 4], ebx
mov esi, dword [ebp - 0x10]
mov dword [ecx + 4], esi
mov dword [eax + 4], edi
mov esi, dword [ebp - 0x1c]
jmp 0x1029ae59
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret 4
push str.invalid_hash_bucket_count
call sub.MSVCP140.dll_void___cdecl_std::_Xlength_error_char_const__
int3
Function at 0x1029b250
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
movzx eax, byte [edx]
xor eax, 0x811c9dc5
imul eax, eax, 0x1000193
movzx esi, byte [edx + 1]
xor esi, eax
imul eax, esi, 0x1000193
movzx esi, byte [edx + 2]
xor esi, eax
imul eax, esi, 0x1000193
movzx esi, byte [edx + 3]
xor esi, eax
imul esi, esi, 0x1000193
and esi, dword [ecx + 0x18]
mov edi, dword [ecx + 0xc]
mov eax, dword [edi + esi*8 + 4]
cmp eax, dword [ecx + 4]
je 0x1029b2b5
mov ecx, dword [edx]
cmp ecx, dword [eax + 8]
je 0x1029b2ae
add esi, esi
mov edx, dword [edi + esi*4]
cmp eax, edx
je 0x1029b2b5
mov eax, dword [eax + 4]
cmp ecx, dword [eax + 8]
jne 0x1029b2a2
add eax, 0xc
pop esi
pop edi
pop ebp
ret
push str.invalid_unordered_map_K__T__key
call sub.MSVCP140.dll_void___cdecl_std::_Xout_of_range_char_const__
int3

Function at 0x1029f090
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
mov eax, edx
mov esi, dword [ebp + 8]
movzx edx, byte [esi]
xor edx, 0x811c9dc5
imul edx, edx, 0x1000193
movzx edi, byte [esi + 1]
xor edi, edx
imul edx, edi, 0x1000193
movzx edi, byte [esi + 2]
xor edi, edx
imul edx, edi, 0x1000193
movzx edi, byte [esi + 3]
xor edi, edx
imul edi, edi, 0x1000193
and edi, dword [ecx + 0x18]
mov edx, dword [ecx + 4]
mov ebx, dword [ecx + 0xc]
mov ecx, dword [ebx + edi*8 + 4]
cmp ecx, edx
je 0x1029f0f9
mov esi, dword [esi]
cmp esi, dword [ecx + 8]
je 0x1029f0fb
add edi, edi
mov edi, dword [ebx + edi*4]
cmp ecx, edi
je 0x1029f0f9
mov ecx, dword [ecx + 4]
cmp esi, dword [ecx + 8]
jne 0x1029f0eb
jmp 0x1029f0fb
xor ecx, ecx
test ecx, ecx
cmovne edx, ecx
mov dword [eax], edx
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x102a3dc0
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
mov eax, dword [ebp + 8]
movzx edx, byte [eax]
xor edx, 0x811c9dc5
imul edx, edx, 0x1000193
movzx esi, byte [eax + 1]
xor esi, edx
imul edx, esi, 0x1000193
movzx esi, byte [eax + 2]
xor esi, edx
imul edx, esi, 0x1000193
movzx esi, byte [eax + 3]
xor esi, edx
imul esi, esi, 0x1000193
and esi, dword [ecx + 0x18]
mov edi, dword [ecx + 0xc]
mov edx, dword [edi + esi*8 + 4]
cmp edx, dword [ecx + 4]
je 0x102a3e24
mov eax, dword [eax]
cmp eax, dword [edx + 8]
je 0x102a3e26
add esi, esi
mov ecx, dword [edi + esi*4]
cmp edx, ecx
je 0x102a3e24
mov edx, dword [edx + 4]
cmp eax, dword [edx + 8]
jne 0x102a3e16
jmp 0x102a3e26
xor edx, edx
xor eax, eax
test edx, edx
setne al
pop esi
pop edi
pop ebp
ret 4
Function at 0x102a7fd0
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
movzx eax, byte [edx]
xor eax, 0x811c9dc5
imul eax, eax, 0x1000193
movzx esi, byte [edx + 1]
xor esi, eax
imul eax, esi, 0x1000193
movzx esi, byte [edx + 2]
xor esi, eax
imul eax, esi, 0x1000193
movzx esi, byte [edx + 3]
xor esi, eax
imul edi, esi, 0x1000193
and edi, dword [ecx + 0x18]
mov ebx, dword [ecx + 0xc]
mov esi, dword [ebx + edi*8 + 4]
cmp esi, dword [ecx + 4]
je 0x102a8031
mov eax, dword [edx]
cmp eax, dword [esi + 8]
je 0x102a8033
add edi, edi
mov ecx, dword [ebx + edi*4]
cmp esi, ecx
je 0x102a8031
mov esi, dword [esi + 4]
cmp eax, dword [esi + 8]
jne 0x102a8023
jmp 0x102a8033
xor esi, esi
xor eax, eax
test esi, esi
setne al
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x102a8040
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0xc
mov edi, ecx
mov esi, dword [ebp + 8]
movzx eax, byte [esi]
xor eax, 0x811c9dc5
imul eax, eax, 0x1000193
movzx ecx, byte [esi + 1]
xor ecx, eax
imul eax, ecx, 0x1000193
movzx ecx, byte [esi + 2]
xor ecx, eax
imul eax, ecx, 0x1000193
movzx ecx, byte [esi + 3]
xor ecx, eax
imul eax, ecx, 0x1000193
mov ecx, dword [edi + 0x18]
mov dword [ebp - 0x18], eax
and ecx, eax
mov esi, dword [edi + 0xc]
mov ebx, dword [esi + ecx*8 + 4]
mov dword [ebp - 0x10], edi
cmp ebx, dword [edi + 4]
je 0x102a80d0
mov edi, dword [ebp + 8]
mov eax, dword [edi]
cmp eax, dword [ebx + 8]
je 0x102a80cc
mov dword [ebp - 0x14], edx
add ecx, ecx
mov esi, dword [esi + ecx*4]
mov ecx, dword [ebp - 0x10]
cmp ebx, esi
je 0x102a80db
mov ebx, dword [ebx + 4]
cmp eax, dword [ebx + 8]
jne 0x102a80ac
xor eax, eax
mov edx, dword [ebp - 0x14]
mov dword [edx], ebx
mov byte [edx + 4], al
mov eax, edx
add esp, 0xc
pop esi
pop edi
pop ebx
pop ebp
ret
xor eax, eax
jmp 0x102a80bd
mov dword [ebp - 0x14], edx
mov esi, ebx
mov ecx, dword [ebp - 0x10]
mov edi, dword [ebp + 8]
cmp dword [ecx + 8], 0xfffffff
je 0x102a818b
push 0x10
call dword [sym.imp.mozglue.dll_moz_xmalloc]
add esp, 4
mov ebx, eax
mov edi, dword [edi]
mov dword [eax + 8], edi
mov dword [eax + 0xc], 0
mov ecx, dword [ebp - 0x10]
mov eax, dword [ecx + 8]
inc eax
movq xmm0, qword [0x102c3120]
movd xmm1, eax
por xmm1, xmm0
subsd xmm1, xmm0
cvtsd2ss xmm1, xmm1
movss xmm2, dword [ecx + 0x1c]
orpd xmm2, xmm0
subsd xmm2, xmm0
xorps xmm0, xmm0
cvtsd2ss xmm0, xmm2
divss xmm1, xmm0
ucomiss xmm1, dword [ecx]
jbe 0x102a8157
call fcn.102a81a0
mov ecx, dword [ebp - 0x10]
mov eax, dword [ecx + 0x18]
and eax, dword [ebp - 0x18]
mov edx, dword [ecx + 0xc]
mov esi, dword [edx + eax*8 + 4]
cmp esi, dword [ecx + 4]
jne 0x102a816b
mov edx, dword [ebp - 0x18]
push ebx
push esi
call fcn.102195c0
add esp, 8
mov al, 1
jmp 0x102a80ba
cmp edi, dword [esi + 8]
jne 0x102a8174
mov esi, dword [esi]
jmp 0x102a8157
add eax, eax
mov eax, dword [edx + eax*4]
cmp esi, eax
je 0x102a8187
mov esi, dword [esi + 4]
cmp edi, dword [esi + 8]
jne 0x102a8179
jmp 0x102a8170
mov esi, eax
jmp 0x102a8157
push str.unordered_map_set_too_long
call sub.MSVCP140.dll_void___cdecl_std::_Xlength_error_char_const__
int3
Function at 0x102a81a0
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
sub esp, 0xc
mov esi, ecx
mov eax, dword [ecx + 8]
inc eax
movd xmm0, eax
por xmm0, xmmword [0x102c3850]
subsd xmm0, qword [0x102c3120]
cvtsd2ss xmm0, xmm0
mov edi, dword [ecx + 0x1c]
divss xmm0, dword [ecx]
cvtss2sd xmm0, xmm0
movsd qword [esp], xmm0
call sub.api_ms_win_crt_math_l1_1_0.dll_ceil
fstp dword [ebp - 0xc]
movss xmm0, dword [ebp - 0xc]
cvttss2si eax, xmm0
mov ecx, eax
subss xmm0, dword [0x102c3128]
cvttss2si edx, xmm0
sar ecx, 0x1f
and edx, ecx
or edx, eax
cmp edx, 9
mov eax, 8
cmovae eax, edx
cmp edi, eax
jae 0x102a8222
lea ecx, [edi*8]
cmp ecx, eax
cmovb ecx, eax
cmp edi, 0x200
cmovae ecx, eax
mov edi, ecx
mov ecx, esi
mov edx, edi
add esp, 0xc
pop esi
pop edi
pop ebp
jmp fcn.102a8240
Function at 0x102a9f30
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0xc
mov edi, ecx
mov esi, dword [ebp + 8]
movzx eax, byte [esi]
xor eax, 0x811c9dc5
imul eax, eax, 0x1000193
movzx ecx, byte [esi + 1]
xor ecx, eax
imul eax, ecx, 0x1000193
movzx ecx, byte [esi + 2]
xor ecx, eax
imul eax, ecx, 0x1000193
movzx ecx, byte [esi + 3]
xor ecx, eax
imul eax, ecx, 0x1000193
mov ecx, dword [edi + 0x18]
mov dword [ebp - 0x18], eax
and ecx, eax
mov esi, dword [edi + 0xc]
mov ebx, dword [esi + ecx*8 + 4]
mov dword [ebp - 0x10], edi
cmp ebx, dword [edi + 4]
je 0x102a9fc0
mov edi, dword [ebp + 8]
mov eax, dword [edi]
cmp eax, dword [ebx + 8]
je 0x102a9fbc
mov dword [ebp - 0x14], edx
add ecx, ecx
mov esi, dword [esi + ecx*4]
mov ecx, dword [ebp - 0x10]
cmp ebx, esi
je 0x102a9fcb
mov ebx, dword [ebx + 4]
cmp eax, dword [ebx + 8]
jne 0x102a9f9c
xor eax, eax
mov edx, dword [ebp - 0x14]
mov dword [edx], ebx
mov byte [edx + 4], al
mov eax, edx
add esp, 0xc
pop esi
pop edi
pop ebx
pop ebp
ret
xor eax, eax
jmp 0x102a9fad
mov dword [ebp - 0x14], edx
mov esi, ebx
mov ecx, dword [ebp - 0x10]
mov edi, dword [ebp + 8]
cmp dword [ecx + 8], 0xfffffff
je 0x102aa078
push 0x10
call dword [sym.imp.mozglue.dll_moz_xmalloc]
add esp, 4
mov ebx, eax
mov edi, dword [edi]
mov dword [eax + 8], edi
mov byte [eax + 0xc], 0
mov ecx, dword [ebp - 0x10]
mov eax, dword [ecx + 8]
inc eax
movq xmm0, qword [0x102c3120]
movd xmm1, eax
por xmm1, xmm0
subsd xmm1, xmm0
cvtsd2ss xmm1, xmm1
movss xmm2, dword [ecx + 0x1c]
orpd xmm2, xmm0
subsd xmm2, xmm0
xorps xmm0, xmm0
cvtsd2ss xmm0, xmm2
divss xmm1, xmm0
ucomiss xmm1, dword [ecx]
jbe 0x102aa044
call fcn.102a81a0
mov ecx, dword [ebp - 0x10]
mov eax, dword [ecx + 0x18]
and eax, dword [ebp - 0x18]
mov edx, dword [ecx + 0xc]
mov esi, dword [edx + eax*8 + 4]
cmp esi, dword [ecx + 4]
jne 0x102aa058
mov edx, dword [ebp - 0x18]
push ebx
push esi
call fcn.102195c0
add esp, 8
mov al, 1
jmp 0x102a9faa
cmp edi, dword [esi + 8]
jne 0x102aa061
mov esi, dword [esi]
jmp 0x102aa044
add eax, eax
mov eax, dword [edx + eax*4]
cmp esi, eax
je 0x102aa074
mov esi, dword [esi + 4]
cmp edi, dword [esi + 8]
jne 0x102aa066
jmp 0x102aa05d
mov esi, eax
jmp 0x102aa044
push str.unordered_map_set_too_long
call sub.MSVCP140.dll_void___cdecl_std::_Xlength_error_char_const__
int3
Function at 0x102b6da0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x24
mov esi, dword [ebp + 8]
mov eax, dword [0x1038000c]
xor eax, ebp
mov dword [ebp - 0x10], eax
mov eax, dword [esi + 0x10]
cmp dword [esi + 0x14], 0x10
mov edi, esi
jb 0x102b6dc3
mov edi, dword [esi]
mov dword [ebp - 0x2c], edx
mov ebx, 0x811c9dc5
test eax, eax
je 0x102b6de2
xor edx, edx
movzx esi, byte [edi + edx]
xor esi, ebx
imul ebx, esi, 0x1000193
inc edx
cmp eax, edx
jne 0x102b6dd1
lea esi, [ebp - 0x18]
mov edi, ecx
push ebx
push dword [ebp + 8]
push esi
call fcn.10218130
mov eax, dword [esi + 4]
test eax, eax
je 0x102b6e15
mov esi, dword [ebp - 0x2c]
mov dword [esi], eax
mov byte [esi + 4], 0
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.10212780
mov eax, esi
add esp, 0x24
pop esi
pop edi
pop ebx
pop ebp
ret
cmp dword [edi + 8], 0x7ffffff
je 0x102b6eee
lea eax, [edi + 4]
mov dword [ebp - 0x20], eax
push 0x20
call dword [sym.imp.mozglue.dll_moz_xmalloc]
add esp, 4
mov edx, eax
mov eax, dword [ebp + 8]
movsd xmm0, qword [eax + 0x10]
movsd qword [edx + 0x18], xmm0
movups xmm0, xmmword [eax]
movups xmmword [edx + 8], xmm0
mov dword [eax + 0x10], 0
mov dword [eax + 0x14], 0xf
mov byte [eax], 0
mov eax, dword [edi + 8]
inc eax
movq xmm0, qword [0x102c3120]
movd xmm1, eax
por xmm1, xmm0
subsd xmm1, xmm0
cvtsd2ss xmm1, xmm1
movss xmm2, dword [edi + 0x1c]
orpd xmm2, xmm0
subsd xmm2, xmm0
xorps xmm0, xmm0
cvtsd2ss xmm0, xmm2
divss xmm1, xmm0
ucomiss xmm1, dword [edi]
jbe 0x102b6ec1
mov esi, edx
add esi, 8
mov ecx, edi
mov dword [ebp - 0x30], edx
call fcn.10218270
lea eax, [ebp - 0x28]
mov ecx, edi
push ebx
push esi
mov esi, eax
push eax
call fcn.10218130
mov edx, dword [ebp - 0x30]
mov eax, dword [esi]
mov ecx, dword [esi + 4]
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x18], eax
jmp 0x102b6ec4
mov eax, dword [ebp - 0x18]
mov esi, dword [ebp - 0x2c]
lea ecx, [ebp - 0x20]
mov dword [ecx + 4], 0
mov ecx, edi
push edx
push eax
push ebx
call fcn.10218310
mov dword [esi], eax
mov byte [esi + 4], 1
lea ecx, [ebp - 0x20]
call fcn.10218360
jmp 0x102b6e01
push str.unordered_map_set_too_long
call sub.MSVCP140.dll_void___cdecl_std::_Xlength_error_char_const__
int3
Function at 0x102b6f80
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x24
mov dword [ebp - 0x14], ecx
cmp edx, dword [ebp + 8]
je 0x102b703b
mov eax, dword [edx + 0x18]
cmp dword [edx + 0x1c], 0x10
mov dword [ebp - 0x10], edx
jb 0x102b6fa6
mov edx, dword [edx + 8]
jmp 0x102b6fa9
add edx, 8
mov ecx, dword [ebp - 0x14]
mov ebx, dword [ecx + 0xc]
mov ecx, 0x811c9dc5
test eax, eax
je 0x102b6fcb
xor esi, esi
movzx edi, byte [edx + esi]
xor edi, ecx
imul ecx, edi, 0x1000193
inc esi
cmp eax, esi
jne 0x102b6fba
mov eax, dword [ebp - 0x14]
lea edx, [eax + 4]
mov dword [ebp - 0x2c], edx
and ecx, dword [eax + 0x18]
mov eax, dword [eax + 4]
mov dword [ebp - 0x20], eax
lea eax, [ecx + ecx]
lea edx, [ebx + ecx*8]
lea ecx, [ecx + ecx + 1]
mov dword [ebp - 0x30], ecx
mov dword [ebp - 0x1c], ebx
mov esi, dword [ebx + eax*4 + 4]
mov ebx, dword [ebp - 0x10]
mov eax, dword [ebx + 4]
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x18], edx
mov eax, dword [edx]
mov dword [ebp - 0x28], eax
mov edi, ebx
mov ebx, dword [ebx]
push edi
push dword [ebp - 0x2c]
call fcn.10217e00
add esp, 8
mov eax, dword [ebp - 0x14]
dec dword [eax + 8]
cmp edi, esi
je 0x102b7043
mov eax, dword [ebp + 8]
cmp ebx, eax
jne 0x102b702f
mov ecx, dword [ebp - 0x28]
cmp ecx, dword [ebp - 0x10]
je 0x102b70d1
cmp ebx, eax
jne 0x102b7002
mov ecx, dword [ebp - 0x24]
mov dword [ecx], eax
mov dword [eax + 4], ecx
add esp, 0x24
pop esi
pop edi
pop ebx
pop ebp
ret
mov eax, dword [ebp - 0x24]
mov ecx, dword [ebp - 0x28]
cmp ecx, dword [ebp - 0x10]
jne 0x102b7056
mov eax, dword [ebp - 0x20]
mov ecx, dword [ebp - 0x18]
mov dword [ecx], eax
mov ecx, dword [ebp - 0x1c]
mov edx, dword [ebp - 0x30]
mov dword [ecx + edx*4], eax
mov eax, dword [ebp + 8]
cmp ebx, eax
je 0x102b7033
cmp dword [ebx + 0x1c], 0x10
jb 0x102b7071
mov eax, dword [ebx + 8]
jmp 0x102b7074
lea eax, [ebx + 8]
mov edx, dword [ebx + 0x18]
mov ecx, 0x811c9dc5
test edx, edx
je 0x102b7093
xor esi, esi
movzx edi, byte [eax + esi]
xor edi, ecx
imul ecx, edi, 0x1000193
inc esi
cmp edx, esi
jne 0x102b7082
mov eax, dword [ebp - 0x14]
and ecx, dword [eax + 0x18]
lea eax, [ecx + ecx]
mov edx, dword [ebp - 0x1c]
lea esi, [edx + ecx*8]
mov dword [ebp - 0x18], esi
add ecx, ecx
inc ecx
mov dword [ebp - 0x10], ecx
mov edi, dword [edx + eax*4 + 4]
mov esi, ebx
mov ebx, dword [ebx]
push esi
push dword [ebp - 0x2c]
call fcn.10217e00
add esp, 8
mov eax, dword [ebp - 0x14]
dec dword [eax + 8]
cmp esi, edi
je 0x102b70db
cmp ebx, dword [ebp + 8]
jne 0x102b70af
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0x18]
mov dword [ecx], eax
jmp 0x102b7033
mov ecx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x18]
mov dword [eax], ecx
mov eax, dword [ebp - 0x1c]
mov edx, dword [ebp - 0x10]
mov dword [eax + edx*4], ecx
jmp 0x102b705f
Function at 0xef82e4
Capabilities:
Encode data using xor

Disassembly:
jmp 0xef82ee
pushal
call 0xef82f4
pop ebp
sub ebp, 0x10
sub ebp, 0xaf82e4
jmp 0xef830a
mov eax, 0xaf82e4
add eax, ebp
add eax, 0x4c
mov ecx, 0x5a7
mov edx, 0x221e82c3
xor byte [eax], dl
inc eax
dec ecx
jne 0xef8321
jmp 0xef8334
dec eax
push cs
dec eax
dec edx
inc ebx
ret

Function at 0x4400c9
Capabilities:
Encrypt data using dpapi

Disassembly:
push esi
push edi
push 0x46c6d0
push str.AdvApi32.dll
call main
mov edi, dword [sym.imp.kernel32.dll_GetProcAddress]
mov esi, eax
test esi, esi
js 0x44010c
push str.SystemFunction040
push dword [0x46c6d0]
call edi
push str.SystemFunction041
push dword [0x46c6d0]
mov dword [0x46c6c0], eax
call edi
mov dword [0x46c6c4], eax
jmp 0x440111
mov eax, dword [0x46c6c4]
cmp dword [0x46c6c0], 0
je 0x440122
test eax, eax
jne 0x4401c9
push 0x46c6d4
push str.Crypt32.dll
call main
mov esi, eax
test esi, esi
js 0x4401d3
push str.CryptProtectMemory
push dword [0x46c6d4]
call edi
cmp dword [0x46c6c0], 0
mov dword [0x46c6c8], eax
jne 0x440187
test eax, eax
jne 0x440187
call dword [sym.imp.kernel32.dll_GetLastError]
mov esi, eax
test esi, esi
jle 0x440171
movzx esi, si
or esi, 0x80070000
test esi, esi
js 0x440178
mov esi, 0x80004005
push esi
push 0x28
push str.c:_agent_work138_s_srclibsdutilcryputil.cpp
call fcn.004038f5
jmp 0x4401d3
push str.CryptUnprotectMemory
push dword [0x46c6d4]
call edi
cmp dword [0x46c6c4], 0
mov dword [0x46c6cc], eax
jne 0x4401c9
test eax, eax
jne 0x4401c9
call dword [sym.imp.kernel32.dll_GetLastError]
mov esi, eax
test esi, esi
jle 0x4401bd
movzx esi, si
or esi, 0x80070000
test esi, esi
js 0x4401c4
mov esi, 0x80004005
push esi
push 0x2d
jmp 0x44017b
mov dword [0x46c6d8], 1
pop edi
mov eax, esi
pop esi
ret