joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1001bb3c
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x1006d6cd
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x1000a378]
xor eax, esp
push eax
lea eax, [esp + 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 8], esi
lea ecx, [esi + 0x30]
mov dword [esp + 0x14], 0
call fcn.1001b952
mov dword [esi], 0x1000402c
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x10
ret

Function at 0x10026196
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x54
pushal
call 0x100261a5
pop dword [ebp - 0x44]
mov eax, 0x8a981542
add eax, 0x856a4c63
sub dword [ebp - 0x44], eax
push 0x40
push 0x1000
push 0x49f70
push 0
mov eax, sym.imp.kernel32.dll_VirtualAlloc
add eax, dword [ebp - 0x44]
call dword [eax]
mov ecx, 0xb0de1dc7
add ecx, 0x4f221e1b
mov esi, eax
mov edi, 0x10079600
add edi, dword [ebp - 0x44]
mov edx, 0x5debd6c6
add dword [ebp - 0x34], 0xf773c54a
mov ebx, dword [edi]
xor dword [ebp - 0x28], 0x867a3287
add ebx, edx
sub dword [ebp - 0x40], eax
mov dword [esi], ebx
add dword [ebp - 0xc], esi
add esi, 0x675a4c3f
add esi, 0x98a5b3c5
add edi, 0xb3e6d2b0
sub edi, 0xb3e6d2ac
loop 0x100261f3
add eax, 0xe25b
xor ebx, ebx
add ebx, eax
add eax, 0x304ff4eb
add eax, 0xcfb00b1a
mov ecx, 0xbfcf5bd
sub ecx, 0xfbfcf5bd
add ecx, dword [ebp - 0x44]
call ebx
leave
ret
Function at 0x10028fbc
Capabilities:
Get file size
Get system information on windows

Disassembly:
push 0x38
mov eax, 0x1006db8e
call fcn.1006ca02
mov esi, ecx
mov eax, dword [ebp + 8]
mov edi, dword [ebp + 0x10]
mov dword [ebp - 0x14], eax
xor eax, eax
mov dword [ebp - 0x44], esi
mov dword [esi + 0x10], eax
mov dword [esi + 0xc], eax
mov dword [esi + 8], eax
mov dword [esi + 4], 1
mov ebx, dword [ebp + 0xc]
or dword [esi + 0x14], 0xffffffff
mov ecx, 0x1000
mov dword [ebp - 4], eax
mov dword [esi], fcn.10027600
mov dword [esi + 0x18], eax
mov dword [esi + 0x1c], eax
mov dword [ebp - 0x1c], ecx
test ebx, ebx
je 0x10029017
lea eax, [ebp - 0x38]
push eax
call dword [sym.imp.kernel32.dll_GetSystemInfo]
mov ecx, dword [ebp - 0x1c]
xor edx, edx
mov eax, ebx
div ecx
push 0
push 0x8000080
push 3
push 0
push 1
push 0x80000000
push dword [ebp - 0x14]
mov ecx, ebx
mov eax, edx
sub ecx, eax
mov dword [ebp - 0x40], eax
mov dword [ebp - 0x3c], ecx
call dword [sym.imp.kernel32.dll_CreateFileA]
mov dword [esi + 0x14], eax
cmp eax, 0xffffffff
je 0x100290d2
cmp edi, 0xffffffff
jne 0x10029077
and dword [ebp - 0x14], 0
lea ecx, [ebp - 0x14]
push ecx
push eax
call dword [sym.imp.kernel32.dll_GetFileSize]
cmp dword [ebp - 0x14], 0
mov edi, eax
jne 0x100290d2
cmp edi, ebx
jbe 0x100290d2
cmp edi, 0xffffffff
je 0x100290d2
sub edi, ebx
xor eax, eax
push eax
push eax
push eax
push 2
push eax
push dword [esi + 0x14]
call dword [sym.imp.kernel32.dll_CreateFileMappingA]
mov ebx, dword [ebp - 0x40]
lea ecx, [edi + ebx]
mov dword [esi + 0x18], eax
cmp ecx, edi
jb 0x100290d2
test eax, eax
je 0x100290ad
push 0
push ecx
push dword [ebp - 0x3c]
push 0
push 4
push eax
call dword [sym.imp.kernel32.dll_MapViewOfFileEx]
mov dword [esi + 0x1c], eax
mov eax, dword [esi + 0x1c]
test eax, eax
je 0x100290d2
push 0
push 0
lea ecx, [eax + ebx]
push edi
push ecx
mov ecx, esi
call fcn.10026196
mov byte [esi + 5], 1
mov eax, esi
call fcn.1006ca85
ret 0xc
mov ecx, esi
call fcn.1002913d
push 0x1006ed24
lea eax, [ebp - 0x3c]
push eax
mov dword [ebp - 0x3c], 1
call sub.MSVCR100.dll__CxxThrowException
int3

Function at 0x1005318f
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
push edi
mov edi, dword [esi]
xor eax, eax
test edi, edi
je 0x100531b3
mov edx, dword [edi + 0x20]
mov dword [edi + 0x20], eax
mov ax, word [0x10006de8]
xor word [edi + 0x24], ax
mov eax, edi
mov edi, edx
test edx, edx
jne 0x1005319b
mov ecx, dword [esi + 4]
mov eax, dword [esi]
pop edi
mov dword [esi + 4], eax
mov dword [esi], ecx
pop esi
ret
Function at 0x1006c574
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x1000a378]
jne 0x1006cc00
ret
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x328
mov dword [0x10074a78], eax
mov dword [0x10074a74], ecx
mov dword [0x10074a70], edx
mov dword [0x10074a6c], ebx
mov dword [0x10074a68], esi
mov dword [0x10074a64], edi
mov word [0x10074a90], ss
mov word [0x10074a84], cs
mov word [0x10074a60], ds
mov word [0x10074a5c], es
mov word [0x10074a58], fs
mov word [0x10074a54], gs
pushfd
pop dword [0x10074a88]
mov eax, dword [ebp]
mov dword [0x10074a7c], eax
mov eax, dword [ebp + 4]
mov dword [0x10074a80], eax
lea eax, [ebp + 8]
mov dword [0x10074a8c], eax
mov eax, dword [ebp - 0x320]
mov dword [0x100749c8], 0x10001
mov eax, dword [0x10074a80]
mov dword [0x1007497c], eax
mov dword [0x10074970], 0xc0000409
mov dword [0x10074974], 1
mov eax, dword [0x1000a378]
mov dword [ebp - 0x328], eax
mov eax, dword [0x10073cc8]
mov dword [ebp - 0x324], eax
call dword [sym.imp.kernel32.dll_IsDebuggerPresent]
mov dword [0x100749c0], eax
push 1
call sub.MSVCR100.dll__crt_debugger_hook
pop ecx
push 0
call dword [sym.imp.kernel32.dll_SetUnhandledExceptionFilter]
push 0x1000a388
call dword [sym.imp.kernel32.dll_UnhandledExceptionFilter]
cmp dword [0x100749c0], 0
jne 0x1006ccec
push 1
call sub.MSVCR100.dll__crt_debugger_hook
pop ecx
push 0xc0000409
call dword [sym.imp.kernel32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.kernel32.dll_TerminateProcess]
leave
ret
Function at 0x1000a090
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 0xc]
push esi
mov esi, ecx
mov dword [esi], 0
test edx, edx
jne 0x1000a0af
xor al, al
mov byte [esi + 0xc], al
mov eax, esi
pop esi
pop ebp
ret 8
mov eax, dword [ebp + 8]
lea ecx, [esi + 8]
push ecx
push 0x40
push edx
push eax
mov dword [esi + 4], edx
mov dword [esi], eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
setne al
mov byte [esi + 0xc], al
mov eax, esi
pop esi
pop ebp
ret 8

Function at 0x1000a0e0
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [ebp - 0x14]
push esi
mov esi, dword [ebp + 8]
push edi
push eax
push 0x40
push 1
push esi
mov edi, ecx
mov dword [ebp - 0x18], 1
mov dword [ebp - 0x1c], esi
call ebx
test eax, eax
setne byte [ebp - 0x10]
mov cl, byte [esi]
mov byte [ebp - 5], cl
test eax, eax
je 0x1000a12e
mov eax, dword [ebp - 0x14]
lea ecx, [ebp - 0xc]
push ecx
push eax
push dword [ebp - 0x18]
mov dword [ebp - 0xc], eax
push dword [ebp - 0x1c]
call ebx
mov cl, byte [ebp - 5]
movzx eax, cl
sub eax, 0xe8
je 0x1000a1b1
sub eax, 1
je 0x1000a1b1
sub eax, 0x16
jne 0x1000a1a2
mov eax, dword [ebp + 8]
push ecx
mov ecx, esp
inc eax
mov dword [ecx], eax
call fcn.1000d210
add esp, 4
cmp al, 0x15
je 0x1000a15b
cmp al, 0x25
jne 0x1000a1a2
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x14]
push eax
push 0x40
add esi, 2
mov dword [ebp - 0x18], 4
push 4
push esi
mov dword [ebp - 0x1c], esi
call ebx
test eax, eax
setne byte [ebp - 0x10]
mov esi, dword [esi]
test eax, eax
je 0x1000a195
mov eax, dword [ebp - 0x14]
lea ecx, [ebp - 0xc]
push ecx
push eax
push dword [ebp - 0x18]
mov dword [ebp - 0xc], eax
push dword [ebp - 0x1c]
call ebx
mov eax, dword [esi]
mov dword [edi], eax
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov dword [edi], 0
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov esi, dword [ebp + 8]
push ecx
mov eax, esp
inc esi
mov dword [eax], esi
call fcn.1000d1c0
add esp, 4
add eax, 4
add eax, esi
mov dword [edi], eax
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1000c610
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10076a3d
mov eax, dword fs:[0]
push eax
sub esp, 0x18
push ebx
push esi
push edi
mov eax, dword [0x10098128]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov dword [ebp - 0x14], ebx
mov eax, dword [ebx]
push 0
push 0
mov eax, dword [eax + 4]
mov dword [ebx + eax], vtable.std::basic_istream_char__struct_std::char_traits_char__.0
mov eax, dword [ebx]
mov edx, dword [eax + 4]
lea eax, [edx - 0x18]
mov dword [edx + ebx - 4], eax
mov eax, dword [ebx]
mov dword [ebx + 8], 0
mov dword [ebx + 0xc], 0
mov edi, dword [eax + 4]
add edi, ebx
mov ecx, edi
mov dword [edi + 0x30], 0
mov dword [edi + 8], 0
mov dword [edi + 0x10], 0
mov dword [edi + 0x14], 0x201
mov dword [edi + 0x18], 6
mov dword [edi + 0x1c], 0
mov dword [edi + 0x20], 0
mov dword [edi + 0x24], 0
mov dword [edi + 0x28], 0
mov dword [edi + 0x2c], 0
call fcn.100097f0
push 8
call fcn.10054a33
add esp, 4
mov esi, eax
push 1
mov dword [ebp - 4], 1
call fcn.100524b7
mov dword [esi + 4], eax
add esp, 4
mov eax, dword [ebp + 8]
mov dword [edi + 0x30], esi
mov dword [edi + 0x38], eax
mov dword [edi + 0x3c], 0
mov esi, dword [esi + 4]
mov ecx, esi
mov dword [ebp - 0x1c], esi
mov eax, dword [esi]
call dword [eax + 4]
lea eax, [ebp - 0x20]
mov dword [ebp - 4], 2
push eax
call fcn.1000d050
add esp, 4
mov ecx, eax
mov edx, dword [eax]
push 0x20
mov edx, dword [edx + 0x20]
call edx
mov byte [ebp - 4], 0
mov ecx, esi
mov edx, dword [esi]
mov byte [ebp + 0xb], al
call dword [edx + 8]
test eax, eax
je 0x1000c730
mov edx, dword [eax]
mov ecx, eax
push 1
call dword [edx]
cmp dword [edi + 0x38], 0
mov al, byte [ebp + 0xb]
mov byte [edi + 0x40], al
jne 0x1000c74c
mov eax, dword [edi + 0xc]
mov ecx, edi
push 0
or eax, 4
push eax
call fcn.100097f0
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc

Function at 0x1000ccf0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10076a80
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x10098128]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, ecx
mov dword [ebp - 0x10], eax
push 8
mov dword [eax], vtable.std::basic_streambuf_char__struct_std::char_traits_char__.0
call fcn.10054a33
mov esi, eax
push 1
mov dword [ebp - 4], 0
call fcn.100524b7
mov dword [esi + 4], eax
add esp, 8
mov eax, dword [ebp - 0x10]
lea edi, [eax + 0x14]
lea ecx, [eax + 0x18]
lea edx, [eax + 0x24]
mov dword [eax + 0x34], esi
lea ebx, [eax + 4]
mov dword [eax + 0xc], ebx
lea esi, [eax + 8]
mov dword [eax + 0x10], esi
mov dword [eax + 0x1c], edi
mov dword [eax + 0x20], ecx
mov dword [eax + 0x2c], edx
add eax, 0x28
mov dword [ebp - 0x14], ebx
mov ebx, dword [ebp - 0x10]
mov dword [ebx + 0x30], eax
mov ebx, dword [ebp - 0x14]
mov dword [esi], 0
mov dword [ecx], 0
mov dword [eax], 0
mov eax, dword [ebp - 0x10]
mov dword [ebx], 0
mov dword [edi], 0
mov dword [edx], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1000d1c0
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push esi
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x10]
push eax
push 0x40
push 4
push esi
mov dword [ebp - 0x14], 4
mov dword [ebp - 0x18], esi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
setne byte [ebp - 0xc]
mov esi, dword [esi]
test eax, eax
je 0x1000d206
mov ecx, dword [ebp - 0x10]
lea eax, [ebp - 8]
push eax
push ecx
push dword [ebp - 0x14]
mov dword [ebp - 8], ecx
push dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x1000d210
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push ebx
push esi
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x10]
push eax
push 0x40
push 1
push esi
mov dword [ebp - 0x14], 1
mov dword [ebp - 0x18], esi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
setne byte [ebp - 0xc]
mov bl, byte [esi]
test eax, eax
je 0x1000d257
mov ecx, dword [ebp - 0x10]
lea eax, [ebp - 8]
push eax
push ecx
push dword [ebp - 0x14]
mov dword [ebp - 8], ecx
push dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
pop esi
mov al, bl
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10011590
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
cmp dword [0x10098b80], 0xffffffff
push esi
je 0x10011615
mov ecx, dword [0x100cc9f8]
lea eax, [ebp + 0xc]
push eax
push dword [ebp + 8]
call fcn.10011550
mov edx, dword [0x100cc9f8]
add esp, 8
mov ecx, edx
mov dword [ebp - 4], 0
lea esi, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x100115c7
push 0
lea eax, [ebp - 4]
sub ecx, esi
push eax
push ecx
push edx
push dword [0x10098b80]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x100115f5
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x3e5
jne 0x10011615
mov ecx, dword [0x100cc9f8]
lea edx, [ecx + 1]
nop
mov al, byte [ecx]
inc ecx
test al, al
jne 0x10011600
sub ecx, edx
cmp ecx, dword [ebp - 4]
jne 0x10011615
mov al, 1
pop esi
mov esp, ebp
pop ebp
ret
xor al, al
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x10011620
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10076fbd
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
push esi
push edi
mov eax, dword [0x10098128]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp dword [0x10098b80], 0xffffffff
je 0x1001178c
lea eax, [ebp + 8]
push eax
lea eax, [ebp - 0x28]
push eax
call fcn.100117f0
mov edi, dword [ebp + 8]
mov eax, dword [eax + 8]
cmp byte [eax + 0xd], 0
jne 0x10011676
cmp edi, dword [eax + 0x10]
jae 0x1001178c
lea eax, [ebp + 0x10]
push eax
push 0
push dword [ebp + 0xc]
push 0x1869f
push dword [0x100cc9f8]
call fcn.10008bb0
mov ecx, dword [eax]
push dword [eax + 4]
or ecx, 2
push ecx
call fcn.1005c05a
mov edx, dword [0x100cc9f8]
add esp, 0x1c
mov ecx, edx
mov dword [ebp - 0x10], 0
lea esi, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x100116b2
push 0
lea eax, [ebp - 0x10]
sub ecx, esi
push eax
push ecx
push edx
push dword [0x10098b80]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x100116e4
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x3e5
jne 0x1001178c
mov ecx, dword [0x100cc9f8]
lea edx, [ecx + 1]
nop dword [eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x100116f0
sub ecx, edx
cmp ecx, dword [ebp - 0x10]
jne 0x1001178c
lea eax, [ebp + 8]
push eax
lea eax, [ebp - 0x1c]
push eax
call fcn.100117f0
movq xmm0, qword [eax]
mov eax, dword [eax + 8]
movq qword [ebp - 0x28], xmm0
cmp byte [eax + 0xd], 0
jne 0x10011726
cmp edi, dword [eax + 0x10]
jae 0x10011779
cmp dword [0x100cc944], 0xccccccc
je 0x1001179f
mov esi, dword [0x100cc940]
mov dword [ebp - 0x18], 0x100cc940
mov dword [ebp - 4], 0
push 0x14
mov dword [ebp - 0x14], 0
call fcn.10054a33
add esp, 4
mov ecx, 0x100cc940
mov dword [eax + 0x10], edi
push eax
push dword [ebp - 0x24]
mov dword [eax], esi
push dword [ebp - 0x28]
mov dword [eax + 4], esi
mov dword [eax + 8], esi
mov word [eax + 0xc], 0
call fcn.1000fb30
mov al, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
xor al, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
call fcn.1000e5d0
int3
Function at 0x100118f0
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
push ecx
mov edx, esp
mov dword [ebp - 4], ecx
mov dword [edx], eax
call fcn.1000a0e0
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x10]
mov ebx, dword [sym.imp.KERNEL32.dll_VirtualProtect]
add esp, 4
mov dword [ebp - 0x14], 1
mov dword [ebp - 0x18], esi
push eax
push 0x40
push 1
push esi
call ebx
test eax, eax
setne byte [ebp - 0xc]
mov byte [esi], 0xe9
test eax, eax
je 0x1001194a
mov eax, dword [ebp - 0x10]
lea ecx, [ebp - 8]
push ecx
push eax
push dword [ebp - 0x14]
mov dword [ebp - 8], eax
push dword [ebp - 0x18]
call ebx
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x10]
mov edi, dword [ebp + 0xc]
inc esi
push eax
push 0x40
push 4
sub edi, esi
mov dword [ebp - 0x14], 4
push esi
sub edi, 4
mov dword [ebp - 0x18], esi
call ebx
test eax, eax
setne byte [ebp - 0xc]
mov dword [esi], edi
test eax, eax
je 0x1001198a
mov eax, dword [ebp - 0x10]
lea ecx, [ebp - 8]
push ecx
push eax
push dword [ebp - 0x14]
mov dword [ebp - 8], eax
push dword [ebp - 0x18]
call ebx
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x100119a0
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
push ecx
mov edx, esp
mov dword [ebp - 4], ecx
mov dword [edx], eax
call fcn.1000a0e0
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x10]
mov ebx, dword [sym.imp.KERNEL32.dll_VirtualProtect]
add esp, 4
mov dword [ebp - 0x14], 1
mov dword [ebp - 0x18], esi
push eax
push 0x40
push 1
push esi
call ebx
test eax, eax
setne byte [ebp - 0xc]
mov byte [esi], 0xe8
test eax, eax
je 0x100119fa
mov eax, dword [ebp - 0x10]
lea ecx, [ebp - 8]
push ecx
push eax
push dword [ebp - 0x14]
mov dword [ebp - 8], eax
push dword [ebp - 0x18]
call ebx
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x10]
mov edi, dword [ebp + 0xc]
inc esi
push eax
push 0x40
push 4
sub edi, esi
mov dword [ebp - 0x14], 4
push esi
sub edi, 4
mov dword [ebp - 0x18], esi
call ebx
test eax, eax
setne byte [ebp - 0xc]
mov dword [esi], edi
test eax, eax
je 0x10011a3a
mov eax, dword [ebp - 0x10]
lea ecx, [ebp - 8]
push ecx
push eax
push dword [ebp - 0x14]
mov dword [ebp - 8], eax
push dword [ebp - 0x18]
call ebx
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10011a50
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0xc]
mov dword [ebp - 0x14], 0
sub edi, esi
jne 0x10011a6f
mov byte [ebp - 8], 0
jmp 0x10011a89
lea eax, [ebp - 0xc]
mov dword [ebp - 0x10], edi
push eax
push 0x40
push edi
push esi
mov dword [ebp - 0x14], esi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
setne byte [ebp - 8]
push edi
push 0x90
push esi
call fcn.10056820
add esp, 0xc
cmp byte [ebp - 8], 0
je 0x10011ab5
mov eax, dword [ebp - 0xc]
lea ecx, [ebp - 4]
push ecx
push eax
push dword [ebp - 0x10]
mov dword [ebp - 4], eax
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x10015a40
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x20
mov eax, dword [0x10098128]
xor eax, esp
mov dword [esp + 0x1c], eax
push str.ModelVariations_Peds.ini
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x10015a90
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
jne 0x10015a90
push str.ModelVariations_Peds.ini
push str._n_s_not_found__n_n
call fcn.10011590
add esp, 8
mov ecx, dword [esp + 0x1c]
xor ecx, esp
call fcn.10054817
mov esp, ebp
pop ebp
ret
sub esp, 8
lea ecx, [esp + 0xc]
mov eax, esp
mov dword [eax], str.ModelVariations_Peds.ini
mov dword [eax + 4], 0x18
call fcn.10012360
add esp, 8
cmp dword [eax + 0x14], 0x10
jb 0x10015ab6
mov eax, dword [eax]
push eax
push str._n_ModelVariations_Peds.ini__n_n_s_n
call fcn.10011590
mov edx, dword [esp + 0x20]
add esp, 8
cmp edx, 0x10
jb 0x10015af6
mov ecx, dword [esp + 4]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x10015aec
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x10015b05
push edx
push ecx
call fcn.10054a68
add esp, 8
mov ecx, dword [esp + 0x1c]
xor ecx, esp
call fcn.10054817
mov esp, ebp
pop ebp
ret
call fcn.1006001f
int3
Function at 0x10016700
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100774d5
mov eax, dword fs:[0]
push eax
sub esp, 0x18
push ebx
push esi
push edi
mov eax, dword [0x10098128]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov ebx, dword [ebp + 8]
movzx eax, byte [ebx]
xor eax, 0x811c9dc5
imul edx, eax, 0x1000193
movzx eax, byte [ebx + 1]
xor edx, eax
imul eax, edx, 0x1000193
push eax
mov dword [ebp + 8], eax
lea eax, [ebp - 0x14]
push ebx
push eax
call fcn.1001bd40
mov esi, dword [ebp - 0x10]
test esi, esi
jne 0x1001685a
cmp dword [edi + 8], 0x71c71c7
je 0x10016871
lea eax, [edi + 4]
mov dword [ebp - 0x1c], eax
mov dword [ebp - 4], esi
push 0x24
mov dword [ebp - 0x18], esi
call fcn.10054a33
mov cx, word [ebx]
mov esi, eax
add esp, 4
mov dword [ebp - 0x18], esi
mov word [esi + 8], cx
mov dword [esi + 0xc], 0
mov dword [esi + 0x1c], 0
mov dword [esi + 0x20], 0xf
mov dword [ebp - 4], 3
mov ecx, dword [edi + 8]
lea eax, [ecx + 1]
movd xmm0, eax
cvtdq2pd xmm0, xmm0
shr eax, 0x1f
addsd xmm0, qword [eax*8 + 0x1008d2c0]
mov eax, dword [edi + 0x1c]
cvtpd2ps xmm1, xmm0
movd xmm0, eax
cvtdq2pd xmm0, xmm0
shr eax, 0x1f
addsd xmm0, qword [eax*8 + 0x1008d2c0]
cvtpd2ps xmm0, xmm0
divss xmm1, xmm0
comiss xmm1, dword [edi]
jbe 0x10016813
mov ecx, edi
call fcn.1001b1b0
push dword [ebp + 8]
lea eax, [esi + 8]
mov ecx, edi
push eax
lea eax, [ebp - 0x24]
push eax
call fcn.1001bd40
mov ecx, dword [edi + 8]
mov edx, dword [eax]
mov eax, dword [eax + 4]
mov dword [ebp - 0x10], eax
jmp 0x10016816
mov edx, dword [ebp - 0x14]
mov ebx, dword [edx + 4]
lea eax, [ecx + 1]
mov dword [edi + 8], eax
mov dword [esi + 4], ebx
mov dword [esi], edx
mov dword [ebx], esi
mov dword [edx + 4], esi
mov eax, dword [edi + 0x18]
and eax, dword [ebp + 8]
mov ecx, dword [edi + 0xc]
mov dword [ebp - 0x10], ebx
mov ebx, dword [ebp - 0x1c]
mov edi, dword [ecx + eax*8]
cmp edi, dword [ebx]
mov ebx, dword [ebp - 0x10]
jne 0x10016847
mov dword [ecx + eax*8], esi
jmp 0x10016856
cmp edi, edx
jne 0x10016850
mov dword [ecx + eax*8], esi
jmp 0x1001685a
cmp dword [ecx + eax*8 + 4], ebx
jne 0x1001685a
mov dword [ecx + eax*8 + 4], esi
lea eax, [esi + 0xc]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
push str.unordered_map_set_too_long
call fcn.100522e0
int3