joyce8/EMBER2024-capa huggingface dataset:
Function at 0x50f9e0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x7360f3
push eax
mov dword fs:[0], esp
sub esp, 0x88
cmp byte [0xa82632], 0
push esi
push edi
je 0x50fb06
cmp byte [0x8e0cd0], 0
je 0x50fb06
lea eax, [ebp - 0x10]
push eax
call fcn.0050b180
push 4
mov dword [ebp - 4], 0
call fcn.00503d60
mov edi, eax
add esp, 8
mov dword [ebp - 0x14], edi
test edi, edi
je 0x50fa49
mov ecx, dword [ebp - 0x10]
xor esi, esi
mov dword [ebp - 0x10], esi
mov dword [edi], ecx
jmp 0x50fa4e
mov esi, dword [ebp - 0x10]
xor edi, edi
mov dword [ebp - 0x14], edi
push 0
push 0x400
push edi
lea ecx, [ebp - 0x5c]
mov byte [ebp - 4], 1
call fcn.0050b270
push dword [ebp + 0x10]
lea ecx, [ebp - 0x5c]
mov byte [ebp - 4], 2
push dword [ebp + 0xc]
call fcn.005082c0
push ecx
mov eax, esp
mov dword [ebp - 0x14], 0
mov dword [eax], edi
lea eax, [ebp - 0x5c]
mov edi, dword [ebp + 8]
mov ecx, edi
push eax
call fcn.0050b330
lea ecx, [ebp - 0x5c]
call fcn.0050b480
test esi, esi
je 0x50faf4
mov eax, dword [esi + 0xc]
mov dword [esi], vtable.RSL::PageArena.0
test eax, eax
je 0x50fae9
mov dword [ebp - 0x14], eax
mov eax, dword [esi + 8]
mov dword [ebp - 0x10], eax
mov eax, dword [eax]
mov edi, dword [eax + 0x14]
call fcn.005e60e0
mov edx, dword [esi + 4]
mov ecx, dword [ebp - 0x10]
push eax
lea eax, [ebp - 0x1c]
mov dword [ebp - 0x1c], 0
push eax
lea eax, [ebp - 0x24]
mov dword [ebp - 0x18], 0
push eax
lea eax, [ebp - 0x14]
mov dword [ebp - 0x24], edx
push eax
mov dword [ebp - 0x20], edx
call edi
mov edi, dword [ebp + 8]
push 0x10
push esi
call fcn.00503df0
add esp, 8
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
call fcn.0050f4f0
mov edi, dword [ebp + 0xc]
lea ecx, [ebp - 0x94]
mov esi, dword [ebp + 0x10]
push 0
push 0x400
push eax
call fcn.0050b270
push esi
push edi
lea ecx, [ebp - 0x94]
mov dword [ebp - 4], 3
call fcn.005082c0
mov esi, dword [ebp + 8]
mov dword [esi], 0
mov byte [esi + 4], 1
mov dword [esi + 8], 0
push 0x38
mov byte [ebp - 4], 4
call fcn.00503d60
add esp, 4
test eax, eax
je 0x50fb6e
lea ecx, [ebp - 0x94]
push ecx
mov ecx, eax
call fcn.0050b1d0
jmp 0x50fb70
xor eax, eax
mov dword [esi + 0xc], eax
mov dword [esi], eax
cmp dword [eax + 0x30], 0
setne cl
mov byte [esi + 4], cl
lea ecx, [ebp - 0x94]
call fcn.0050b480
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop edi
mov dword fs:[0], ecx
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x50fba0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x7360f3
push eax
mov dword fs:[0], esp
sub esp, 0x88
cmp byte [0xa82632], 0
push esi
push edi
je 0x50fcc6
cmp byte [0x8e0cd0], 0
je 0x50fcc6
lea eax, [ebp - 0x10]
push eax
call fcn.0050b180
push 4
mov dword [ebp - 4], 0
call fcn.00503d60
mov edi, eax
add esp, 8
mov dword [ebp - 0x14], edi
test edi, edi
je 0x50fc09
mov ecx, dword [ebp - 0x10]
xor esi, esi
mov dword [ebp - 0x10], esi
mov dword [edi], ecx
jmp 0x50fc0e
mov esi, dword [ebp - 0x10]
xor edi, edi
mov dword [ebp - 0x14], edi
push 0
push 0x400
push edi
lea ecx, [ebp - 0x5c]
mov byte [ebp - 4], 1
call fcn.0050b270
push dword [ebp + 0x10]
lea ecx, [ebp - 0x5c]
mov byte [ebp - 4], 2
push dword [ebp + 0xc]
call fcn.00508470
push ecx
mov eax, esp
mov dword [ebp - 0x14], 0
mov dword [eax], edi
lea eax, [ebp - 0x5c]
mov edi, dword [ebp + 8]
mov ecx, edi
push eax
call fcn.0050b330
lea ecx, [ebp - 0x5c]
call fcn.0050b480
test esi, esi
je 0x50fcb4
mov eax, dword [esi + 0xc]
mov dword [esi], vtable.RSL::PageArena.0
test eax, eax
je 0x50fca9
mov dword [ebp - 0x14], eax
mov eax, dword [esi + 8]
mov dword [ebp - 0x10], eax
mov eax, dword [eax]
mov edi, dword [eax + 0x14]
call fcn.005e60e0
mov edx, dword [esi + 4]
mov ecx, dword [ebp - 0x10]
push eax
lea eax, [ebp - 0x1c]
mov dword [ebp - 0x1c], 0
push eax
lea eax, [ebp - 0x24]
mov dword [ebp - 0x18], 0
push eax
lea eax, [ebp - 0x14]
mov dword [ebp - 0x24], edx
push eax
mov dword [ebp - 0x20], edx
call edi
mov edi, dword [ebp + 8]
push 0x10
push esi
call fcn.00503df0
add esp, 8
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
call fcn.0050f4f0
mov edi, dword [ebp + 0xc]
lea ecx, [ebp - 0x94]
mov esi, dword [ebp + 0x10]
push 0
push 0x400
push eax
call fcn.0050b270
push esi
push edi
lea ecx, [ebp - 0x94]
mov dword [ebp - 4], 3
call fcn.00508470
mov esi, dword [ebp + 8]
mov dword [esi], 0
mov byte [esi + 4], 1
mov dword [esi + 8], 0
push 0x38
mov byte [ebp - 4], 4
call fcn.00503d60
add esp, 4
test eax, eax
je 0x50fd2e
lea ecx, [ebp - 0x94]
push ecx
mov ecx, eax
call fcn.0050b1d0
jmp 0x50fd30
xor eax, eax
mov dword [esi + 0xc], eax
mov dword [esi], eax
cmp dword [eax + 0x30], 0
setne cl
mov byte [esi + 4], cl
lea ecx, [ebp - 0x94]
call fcn.0050b480
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop edi
mov dword fs:[0], ecx
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x5119f0
Capabilities:
Check for time delay via queryperformancecounter

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
cmp byte [0xa82632], 0
je 0x511a44
cmp byte [0x8e0d6c], 0
je 0x511a44
cmp byte [0xae6a84], 0
jne 0x511a34
lea eax, [ebp - 8]
push eax
call dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 4]
mov dword [0xae6a88], eax
mov dword [0xae6a8c], ecx
nop
mov byte [0xae6a84], 1
nop
mov eax, dword [0xae6a88]
mov edx, dword [0xae6a8c]
mov esp, ebp
pop ebp
ret
mov ecx, dword [0xae6a88]
mov eax, ecx
mov edx, dword [0xae6a8c]
or eax, edx
jne 0x511a81
cmp byte [0xae6a84], al
jne 0x511a81
lea eax, [ebp - 8]
push eax
call dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov ecx, dword [ebp - 8]
mov edx, dword [ebp - 4]
mov dword [0xae6a88], ecx
mov dword [0xae6a8c], edx
mov byte [0xae6a84], 1
mov eax, ecx
mov esp, ebp
pop ebp
ret

Function at 0x511f00
Capabilities:
Check for time delay via queryperformancecounter

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
cmp byte [0xa82632], 0
push esi
push edi
je 0x511fc1
cmp byte [0x8e0d6c], 0
je 0x511fc1
lea eax, [ebp - 8]
push eax
call dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
cmp byte [0xae6a84], 0
mov esi, dword [ebp - 4]
mov edi, dword [ebp - 8]
jne 0x511f4f
mov dword [0xae6a88], edi
mov dword [0xae6a8c], esi
nop
mov byte [0xae6a84], 1
nop
movsd xmm0, qword [0xae6aa0]
ucomisd xmm0, qword [0x755468]
movsd qword [ebp - 8], xmm0
lahf
test ah, 0x44
jp 0x511f99
lea eax, [ebp - 8]
push eax
call dword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
mov edx, dword [ebp - 4]
mov ecx, dword [ebp - 8]
call fcn.006f2b60
movsd xmm1, qword [0x755c58]
divsd xmm1, xmm0
movsd qword [ebp - 8], xmm1
movsd qword [0xae6aa0], xmm1
sub edi, dword [0xae6a88]
mov ecx, edi
sbb esi, dword [0xae6a8c]
mov edx, esi
call fcn.006f2b60
mulsd xmm0, qword [ebp - 8]
pop edi
pop esi
movsd qword [ebp - 0x10], xmm0
fld qword [ebp - 0x10]
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 8]
push eax
call dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov eax, dword fs:[0x2c]
mov ecx, dword [0x1551db0]
mov esi, dword [ebp - 8]
mov edi, dword [ebp - 4]
mov ecx, dword [eax + ecx*4]
mov eax, dword [0xae6a98]
cmp eax, dword [ecx + 0x78c]
jg 0x51201f
movsd xmm0, qword [0xae6a90]
movsd qword [ebp - 0x18], xmm0
call fcn.005119f0
sub esi, eax
mov ecx, esi
sbb edi, edx
mov edx, edi
call fcn.006f2b60
mulsd xmm0, qword [ebp - 0x18]
pop edi
pop esi
movsd qword [ebp - 0x18], xmm0
fld qword [ebp - 0x18]
mov esp, ebp
pop ebp
ret
push 0xae6a98
call fcn.006f2701
add esp, 4
cmp dword [0xae6a98], 0xffffffff
jne 0x511fed
lea eax, [ebp - 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
mov edx, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x10]
call fcn.006f2b60
movsd xmm1, qword [0x755c58]
divsd xmm1, xmm0
push 0xae6a98
movsd qword [0xae6a90], xmm1
call fcn.006f26b7
add esp, 4
jmp 0x511fed
Function at 0x5169f0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov eax, dword fs:[0]
mov edx, dword [ebp + 0xc]
push 0xffffffffffffffff
push 0x733a25
push eax
mov dword fs:[0], esp
sub esp, 0x10
cmp dword [edx + 0x14], 0x10
push ebx
push esi
push edi
mov ebx, ecx
mov edi, edx
jb 0x516a1d
mov edi, dword [edx]
xor ecx, ecx
mov esi, 0x811c9dc5
cmp dword [edx + 0x10], ecx
jbe 0x516a42
nop dword [eax]
movzx eax, byte [ecx + edi]
inc ecx
xor eax, esi
imul esi, eax, 0x1000193
cmp ecx, dword [edx + 0x10]
jb 0x516a30
push esi
push edx
lea eax, [ebp - 0x14]
mov ecx, ebx
push eax
call fcn.00481980
mov ecx, dword [ebp - 0x10]
test ecx, ecx
je 0x516a72
mov eax, dword [ebp + 8]
mov dword [eax], ecx
mov byte [eax + 4], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
cmp dword [ebx + 8], 0x71c71c7
je 0x516bcb
lea eax, [ebx + 4]
mov dword [ebp - 0x1c], eax
push 0x24
mov dword [ebp - 4], 0
mov dword [ebp - 0x18], 0
call fcn.00503d60
add esp, 4
mov edi, eax
mov dword [ebp - 0x18], edi
push dword [ebp + 0xc]
lea ecx, [edi + 8]
call fcn.0047b780
mov byte [edi + 0x20], 0
mov eax, dword [ebx + 8]
inc eax
movss xmm3, dword [ebx]
mov dword [ebp - 4], 1
movd xmm0, eax
cvtdq2pd xmm0, xmm0
shr eax, 0x1f
addsd xmm0, qword [eax*8 + 0x74c0b0]
mov eax, dword [ebx + 0x1c]
cvtpd2ps xmm2, xmm0
movd xmm0, eax
cvtdq2pd xmm0, xmm0
shr eax, 0x1f
movaps xmm1, xmm2
addsd xmm0, qword [eax*8 + 0x74c0b0]
cvtpd2ps xmm0, xmm0
divss xmm1, xmm0
comiss xmm1, xmm3
jbe 0x516b6a
divss xmm2, xmm3
sub esp, 8
cvtps2pd xmm0, xmm2
movsd qword [ebp - 0x14], xmm0
fld qword [ebp - 0x14]
fstp qword [esp]
call fcn.00704910
fstp qword [ebp - 0x14]
movsd xmm0, qword [ebp - 0x14]
add esp, 8
cvtpd2ps xmm0, xmm0
call fcn.006f2860
mov ecx, 8
cmp eax, ecx
cmova ecx, eax
mov eax, dword [ebx + 0x1c]
cmp eax, ecx
jae 0x516b4e
cmp eax, 0x200
jae 0x516b4c
shl eax, 3
cmp eax, ecx
jae 0x516b4e
mov eax, ecx
push eax
mov ecx, ebx
call fcn.0048c600
push esi
lea eax, [edi + 8]
mov ecx, ebx
push eax
lea eax, [ebp - 0x1c]
push eax
call fcn.00481980
mov edx, dword [eax]
jmp 0x516b6d
mov edx, dword [ebp - 0x14]
mov eax, dword [ebx + 8]
mov ecx, dword [edx + 4]
inc eax
mov dword [ebx + 8], eax
mov dword [edi], edx
mov dword [edi + 4], ecx
mov dword [ecx], edi
mov dword [edx + 4], edi
mov eax, dword [ebx + 0x18]
mov dword [ebp + 0xc], ecx
and eax, esi
mov ecx, dword [ebx + 0xc]
mov esi, dword [ecx + eax*8]
cmp esi, dword [ebx + 4]
jne 0x516b99
mov dword [ecx + eax*8], edi
jmp 0x516bab
cmp esi, edx
jne 0x516ba2
mov dword [ecx + eax*8], edi
jmp 0x516baf
mov edx, dword [ebp + 0xc]
cmp dword [ecx + eax*8 + 4], edx
jne 0x516baf
mov dword [ecx + eax*8 + 4], edi
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
mov dword [eax], edi
pop edi
pop esi
mov byte [eax + 4], 1
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret 8
push str.unordered_map_set_too_long
call fcn.006ddb1a
int3
Function at 0x516e90
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [ebp + 0xc]
cmp dword [eax + 0x1c], 0x10
push ebx
mov ebx, dword [eax + 0x18]
mov dword [ebp - 4], ecx
lea ecx, [eax + 8]
push esi
push edi
mov dword [ebp - 8], ecx
mov edi, ecx
jb 0x516eb2
mov edi, dword [ecx]
xor edx, edx
mov esi, 0x811c9dc5
test ebx, ebx
je 0x516ed1
nop dword [eax]
movzx ecx, byte [edx + edi]
inc edx
xor ecx, esi
imul esi, ecx, 0x1000193
cmp edx, ebx
jb 0x516ec0
mov ebx, dword [ebp - 4]
mov edx, dword [ebx + 0x18]
mov ecx, dword [ebx + 0xc]
and edx, esi
mov esi, dword [ecx + edx*8]
cmp dword [ecx + edx*8 + 4], eax
jne 0x516efe
cmp esi, eax
jne 0x516ef5
mov eax, dword [ebx + 4]
mov dword [ecx + edx*8], eax
mov dword [ecx + edx*8 + 4], eax
jmp 0x516f07
mov eax, dword [eax + 4]
mov dword [ecx + edx*8 + 4], eax
jmp 0x516f07
cmp esi, eax
jne 0x516f0a
mov eax, dword [eax]
mov dword [ecx + edx*8], eax
mov eax, dword [ebp + 0xc]
mov esi, dword [eax]
dec dword [ebx + 8]
mov eax, dword [eax + 4]
mov ecx, dword [ebp - 8]
mov dword [eax], esi
mov eax, dword [ebp + 0xc]
mov eax, dword [eax + 4]
mov dword [esi + 4], eax
call fcn.00504ed0
push 0x24
push dword [ebp + 0xc]
call fcn.00503df0
mov eax, dword [ebp + 8]
add esp, 8
pop edi
mov dword [eax], esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x516f40
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov edx, dword [ebp + 0xc]
mov eax, ecx
push ebx
push esi
push edi
cmp dword [edx + 0x14], 0x10
mov edi, edx
mov ebx, dword [edx + 0x10]
mov dword [ebp - 4], eax
jb 0x516f5e
mov edi, dword [edx]
xor ecx, ecx
mov esi, 0x811c9dc5
test ebx, ebx
je 0x516f84
nop dword [eax]
movzx eax, byte [ecx + edi]
inc ecx
xor eax, esi
imul esi, eax, 0x1000193
cmp ecx, ebx
jb 0x516f70
mov eax, dword [ebp - 4]
push esi
push edx
lea ecx, [ebp - 0xc]
push ecx
mov ecx, eax
call fcn.00481980
pop edi
pop esi
pop ebx
mov ecx, dword [eax + 4]
mov eax, dword [ebp + 8]
test ecx, ecx
jne 0x516fa4
mov ecx, dword [ebp - 4]
mov ecx, dword [ecx + 4]
mov dword [eax], ecx
mov esp, ebp
pop ebp
ret 8
Function at 0x519200
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x7365e5
push eax
mov dword fs:[0], esp
sub esp, 0x10
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
mov ebx, ecx
mov edx, edi
cmp dword [edi + 0x14], 0x10
jb 0x51922d
mov edx, dword [edi]
xor ecx, ecx
mov esi, 0x811c9dc5
cmp dword [edi + 0x10], ecx
jbe 0x519252
nop dword [eax]
movzx eax, byte [ecx + edx]
inc ecx
xor eax, esi
imul esi, eax, 0x1000193
cmp ecx, dword [edi + 0x10]
jb 0x519240
push esi
push edi
lea eax, [ebp - 0x14]
mov ecx, ebx
push eax
call fcn.00481980
mov ecx, dword [ebp - 0x10]
test ecx, ecx
je 0x519272
mov eax, dword [ebp + 8]
mov dword [eax], ecx
xor cl, cl
jmp 0x519336
cmp dword [ebx + 8], 0x71c71c7
je 0x51934c
lea eax, [ebx + 4]
mov dword [ebp - 0x1c], eax
push 0x24
mov dword [ebp - 4], 0
mov dword [ebp - 0x18], 0
call fcn.00503d60
add esp, 4
mov dword [ebp - 0x18], eax
add eax, 8
mov ecx, eax
mov dword [ebp + 0xc], eax
push edi
call fcn.0047b780
mov eax, dword [edi + 0x18]
mov dword [edi + 0x18], 0
mov edi, dword [ebp + 0xc]
mov dword [edi + 0x18], eax
mov eax, dword [ebx + 8]
inc eax
mov dword [ebp - 4], 1
movd xmm0, eax
cvtdq2pd xmm0, xmm0
shr eax, 0x1f
addsd xmm0, qword [eax*8 + 0x74c0b0]
mov eax, dword [ebx + 0x1c]
cvtpd2ps xmm1, xmm0
movd xmm0, eax
cvtdq2pd xmm0, xmm0
shr eax, 0x1f
addsd xmm0, qword [eax*8 + 0x74c0b0]
cvtpd2ps xmm0, xmm0
divss xmm1, xmm0
comiss xmm1, dword [ebx]
jbe 0x51931d
mov ecx, ebx
call fcn.00518c50
push esi
push edi
lea eax, [ebp - 0x14]
mov ecx, ebx
push eax
call fcn.00481980
mov ecx, dword [eax]
jmp 0x519320
mov ecx, dword [ebp - 0x14]
push dword [ebp - 0x18]
push ecx
push esi
mov ecx, ebx
call fcn.004c7b90
mov ecx, dword [ebp + 8]
mov dword [ecx], eax
mov cl, 1
mov eax, dword [ebp + 8]
pop edi
mov byte [eax + 4], cl
mov ecx, dword [ebp - 0xc]
pop esi
pop ebx
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 8
push str.unordered_map_set_too_long
call fcn.006ddb1a
int3
Function at 0x519ce0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x736645
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x34
push ebx
mov ebx, ecx
push esi
push edi
mov dword [ebp - 0x10], ebx
lea esi, [ebx + 0x20]
push esi
mov dword [ebp - 0x14], esi
call fcn.006de95e
add esp, 4
test eax, eax
jne 0x519edb
push dword [ebp + 8]
mov dword [ebp - 4], eax
mov ecx, ebx
lea eax, [ebp + 8]
push eax
call fcn.00516f40
mov edi, dword [ebp + 8]
mov ebx, dword [ebp + 0xc]
push ebx
lea eax, [edi + 8]
push eax
lea eax, [ebp - 0x40]
push eax
call fcn.0051a700
add esp, 0xc
mov ecx, dword [ebp - 0x10]
lea eax, [edi + 8]
push eax
lea eax, [ebp - 0x28]
mov byte [ebp - 4], 1
add ecx, 0x110
push eax
call fcn.004e6be0
lea edx, [ebp - 0x40]
mov eax, dword [eax]
mov dword [eax + 0x20], ebx
mov ebx, 0x811c9dc5
cmp dword [ebp - 0x2c], 0x10
cmovae edx, dword [ebp - 0x40]
xor ecx, ecx
cmp dword [ebp - 0x30], ecx
jbe 0x519d8a
movzx eax, byte [ecx + edx]
inc ecx
xor eax, ebx
imul ebx, eax, 0x1000193
cmp ecx, dword [ebp - 0x30]
jb 0x519d78
mov ecx, dword [ebp - 0x10]
lea eax, [ebp - 0x40]
push ebx
push eax
lea eax, [ebp - 0x20]
push eax
call fcn.00481980
mov eax, dword [ebp - 0x1c]
test eax, eax
jne 0x519e5f
mov eax, dword [ebp - 0x10]
cmp dword [eax + 8], 0x71c71c7
je 0x519ee1
add eax, 4
mov dword [ebp - 0x28], eax
push 0x24
mov byte [ebp - 4], 2
mov dword [ebp - 0x24], 0
call fcn.00503d60
add esp, 4
mov dword [ebp - 0x24], eax
add eax, 8
lea ecx, [ebp - 0x40]
mov dword [ebp + 8], eax
push ecx
mov ecx, eax
call fcn.0047b780
mov eax, dword [ebp + 8]
mov dword [eax + 0x18], 0
mov ecx, dword [ebp - 0x10]
mov byte [ebp - 4], 3
mov eax, dword [ecx + 8]
inc eax
movd xmm0, eax
cvtdq2pd xmm0, xmm0
shr eax, 0x1f
addsd xmm0, qword [eax*8 + 0x74c0b0]
mov eax, dword [ecx + 0x1c]
cvtpd2ps xmm1, xmm0
movd xmm0, eax
cvtdq2pd xmm0, xmm0
shr eax, 0x1f
addsd xmm0, qword [eax*8 + 0x74c0b0]
cvtpd2ps xmm0, xmm0
divss xmm1, xmm0
comiss xmm1, dword [ecx]
jbe 0x519e52
call fcn.00518c50
mov ecx, dword [ebp - 0x10]
lea eax, [ebp - 0x18]
push ebx
push dword [ebp + 8]
push eax
call fcn.00481980
mov ecx, dword [ebp - 0x10]
mov edx, dword [eax]
jmp 0x519e55
mov edx, dword [ebp - 0x20]
push dword [ebp - 0x24]
push edx
push ebx
call fcn.004c7b90
mov edx, dword [eax + 0x20]
mov ecx, dword [edi + 0x20]
mov dword [eax + 0x20], ecx
lea eax, [ebp + 8]
mov ecx, dword [ebp - 0x10]
push edi
push eax
mov dword [edi + 0x20], edx
call fcn.00516e90
mov edx, dword [ebp - 0x2c]
cmp edx, 0x10
jb 0x519ea8
mov ecx, dword [ebp - 0x40]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x519e9e
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x519eeb
push edx
push ecx
call fcn.00503df0
add esp, 8
push esi
mov dword [ebp - 0x30], 0
mov dword [ebp - 0x2c], 0xf
mov byte [ebp - 0x40], 0
call fcn.006de9b9
mov ecx, dword [ebp - 0xc]
add esp, 4
mov eax, 1
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
push eax
call fcn.006ded1a
push str.unordered_map_set_too_long
call fcn.006ddb1a
call fcn.006fee64
int3
Function at 0x51c370
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
mov eax, dword fs:[0]
xorps xmm0, xmm0
push 0xffffffffffffffff
push 0x734f2d
push eax
mov dword fs:[0], esp
push esi
mov esi, dword [ebp + 0xc]
push edi
mov edi, dword [ebp + 8]
lea eax, [edi + 4]
push eax
mov dword [edi], vtable.std::exception.0
movq qword [eax], xmm0
lea eax, [esi + 4]
push eax
call fcn.006f4121
add esp, 8
mov dword [edi], vtable.boost::system::system_error.0
mov eax, dword [esi + 0xc]
mov ecx, dword [esi + 0x10]
mov dword [edi + 0xc], eax
lea eax, [esi + 0x14]
mov dword [edi + 0x10], ecx
lea ecx, [edi + 0x14]
push eax
mov dword [ebp - 4], 0
call fcn.0047b780
mov ecx, dword [ebp - 0xc]
mov eax, edi
mov dword [edi + 0x2c], vtable.boost::exception.0
mov dword [edi + 0x30], 0
mov dword [edi + 0x34], 0
mov dword [edi + 0x38], 0
mov dword [edi + 0x3c], 0xffffffff
mov dword [edi], vtable.boost::exception_detail::error_info_injector_class_boost::lock_error_.0
mov dword [edi + 0x2c], vtable.boost::exception_detail::error_info_injector_class_boost::lock_error_.1.0
pop edi
mov dword fs:[0], ecx
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x51cc10
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x735115
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push esi
mov esi, ecx
xorps xmm0, xmm0
push edi
mov edi, dword [ebp + 8]
lea eax, [esi + 4]
mov dword [ebp - 0x10], esi
mov dword [esi], vtable.std::exception.0
push eax
movq qword [eax], xmm0
lea eax, [edi + 4]
push eax
call fcn.006f4121
add esp, 8
mov dword [esi], vtable.boost::system::system_error.0
mov eax, dword [edi + 0xc]
mov ecx, dword [edi + 0x10]
mov dword [esi + 0xc], eax
lea eax, [edi + 0x14]
mov dword [esi + 0x10], ecx
lea ecx, [esi + 0x14]
push eax
mov dword [ebp - 4], 0
call fcn.0047b780
mov dword [esi], vtable.boost::lock_error.0
mov dword [esi + 0x2c], vtable.boost::exception.0
mov ecx, dword [edi + 0x30]
mov dword [ebp - 4], 1
mov dword [esi + 0x30], ecx
test ecx, ecx
je 0x51cc98
mov eax, dword [ecx]
call dword [eax + 0xc]
mov eax, dword [edi + 0x34]
mov ecx, dword [ebp - 0xc]
mov dword [esi + 0x34], eax
mov eax, dword [edi + 0x38]
mov dword [esi + 0x38], eax
mov eax, dword [edi + 0x3c]
mov dword [esi + 0x3c], eax
mov eax, esi
mov dword [esi], vtable.boost::exception_detail::error_info_injector_class_boost::lock_error_.0
mov dword [esi + 0x2c], vtable.boost::exception_detail::error_info_injector_class_boost::lock_error_.1.0
pop edi
pop esi
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 4
Function at 0x528430
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
mov edx, dword [ebp + 0x10]
push ebx
mov ebx, dword [ebp + 0xc]
push esi
push edi
mov edi, dword [ebp + 8]
xor esi, esi
sub ebx, edi
sar ebx, 4
mov dword [ebp + 0xc], ebx
mov eax, dword [edi]
mov ecx, dword [edi + 4]
mov dword [edx], eax
mov dword [edx + 4], ecx
xor ecx, ecx
mov eax, dword [edi + 8]
mov dword [edx + 8], eax
mov eax, dword [edi + 0xc]
mov dword [edx + 0xc], eax
lea edx, [ebx - 1]
mov eax, edx
mov dword [ebp - 4], edx
sar eax, 1
mov dword [ebp + 8], eax
test eax, eax
jle 0x5284c7
mov ebx, eax
lea edx, [ecx + ecx]
xor eax, eax
mov ecx, edx
add ecx, ecx
movups xmm0, xmmword [edi + ecx*8 + 0x20]
comisd xmm0, xmmword [edi + ecx*8 + 0x10]
seta al
shl esi, 4
xor eax, 1
add esi, edi
inc eax
add edx, eax
mov dword [ebp + 0x10], edx
shl edx, 4
add edx, edi
mov eax, dword [edx]
mov ecx, dword [edx + 4]
mov dword [esi + 4], ecx
mov ecx, dword [ebp + 0x10]
mov dword [esi], eax
mov eax, dword [edx + 8]
mov dword [esi + 8], eax
mov eax, dword [edx + 0xc]
mov dword [esi + 0xc], eax
mov esi, ecx
cmp ecx, ebx
jl 0x528475
mov ebx, dword [ebp + 0xc]
mov eax, dword [ebp + 8]
mov edx, dword [ebp - 4]
cmp esi, eax
jne 0x5284f4
test bl, 1
jne 0x5284f4
add ebx, ebx
shl esi, 4
add esi, edi
mov eax, dword [edi + ebx*8 - 0x10]
mov ecx, dword [edi + ebx*8 - 0xc]
mov dword [esi], eax
mov dword [esi + 4], ecx
mov eax, dword [edi + ebx*8 - 8]
mov dword [esi + 8], eax
mov eax, dword [edi + ebx*8 - 4]
mov dword [esi + 0xc], eax
mov esi, edx
test esi, esi
jle 0x528533
mov eax, dword [ebp + 0x14]
lea ebx, [esi - 1]
sar ebx, 1
mov edx, ebx
add edx, edx
movups xmm0, xmmword [edi + edx*8]
comisd xmm0, xmmword [eax]
jbe 0x528533
mov eax, dword [edi + edx*8]
mov ecx, dword [edi + edx*8 + 4]
shl esi, 4
add esi, edi
mov dword [esi], eax
mov dword [esi + 4], ecx
mov eax, dword [edi + edx*8 + 8]
mov dword [esi + 8], eax
mov eax, dword [edi + edx*8 + 0xc]
mov dword [esi + 0xc], eax
mov esi, ebx
test ebx, ebx
jg 0x5284f8
mov edx, dword [ebp + 0x14]
shl esi, 4
add esi, edi
pop edi
mov eax, dword [edx]
mov ecx, dword [edx + 4]
mov dword [esi], eax
mov dword [esi + 4], ecx
mov eax, dword [edx + 8]
mov dword [esi + 8], eax
mov eax, dword [edx + 0xc]
mov dword [esi + 0xc], eax
pop esi
pop ebx
mov esp, ebp
pop ebp
ret