joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10081950
Capabilities:
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x144
mov eax, dword [0x10290198]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
lea ecx, [ebp - 0x144]
push ebx
push esi
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov esi, eax
mov bl, 1
cmp esi, 0xffffffff
je 0x100819cc
push edi
mov edi, dword [0x101ae270]
lea eax, [ebp - 0x118]
push eax
call edi
add esp, 4
test eax, eax
je 0x100819ae
lea eax, [ebp - 0x118]
push eax
push str.ERROR:_Unable_to_delete_file__s_n
call sym.tesseract41.dll_void___cdecl_tprintf_char_const__
add esp, 8
xor al, al
jmp 0x100819b0
mov al, 1
and bl, al
lea eax, [ebp - 0x144]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x10081986
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
pop edi
mov ecx, dword [ebp - 4]
mov al, bl
pop esi
xor ecx, ebp
pop ebx
call fcn.10193ac9
mov esp, ebp
pop ebp
ret

Function at 0x10088e10
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 8]
movzx eax, byte [edx]
xor eax, 0x811c9dc5
imul ecx, eax, 0x1000193
movzx eax, byte [edx + 1]
xor ecx, eax
movzx eax, byte [edx + 2]
imul ecx, ecx, 0x1000193
xor ecx, eax
movzx eax, byte [edx + 3]
imul ecx, ecx, 0x1000193
xor ecx, eax
imul eax, ecx, 0x1000193
pop ebp
ret
Function at 0x1008bce0
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov edx, dword [ebp + 8]
mov eax, 0x1fffffff
bsr eax, eax
push ebx
mov ebx, ecx
mov ecx, 1
shlx eax, ecx, eax
mov dword [ebp - 0xc], ebx
push esi
push edi
cmp edx, eax
ja 0x1008be3e
mov esi, dword [ebx + 4]
lea eax, [edx - 1]
or eax, ecx
mov dword [ebp - 8], esi
bsr eax, eax
push esi
inc eax
shlx edi, ecx, eax
lea ecx, [ebx + 0xc]
lea eax, [edi + edi]
push eax
call sym.tesseract41.dll___Assign_grow____Hash_vec_V__allocator_V___List_unchecked_const_iterator_V___List_val_U___List_simple_types_PA
lea eax, [edi - 1]
mov dword [ebx + 0x1c], edi
mov dword [ebx + 0x18], eax
mov ecx, dword [ebx + 4]
mov ecx, dword [ecx]
mov edx, ecx
cmp ecx, esi
je 0x1008be10
movzx eax, byte [ecx + 8]
xor eax, 0x811c9dc5
mov edx, dword [edx]
imul edi, eax, 0x1000193
movzx eax, byte [ecx + 9]
xor edi, eax
movzx eax, byte [ecx + 0xa]
imul edi, edi, 0x1000193
xor edi, eax
movzx eax, byte [ecx + 0xb]
imul edi, edi, 0x1000193
xor edi, eax
imul eax, edi, 0x1000193
mov edi, dword [ebx + 0x18]
and edi, eax
mov eax, dword [ebx + 0xc]
mov ebx, dword [eax + edi*8]
lea eax, [eax + edi*8]
mov dword [ebp + 8], eax
cmp ebx, esi
jne 0x1008bd95
mov dword [eax], ecx
mov dword [eax + 4], ecx
jmp 0x1008bdff
mov eax, dword [eax + 4]
mov edi, dword [ecx + 8]
cmp edi, dword [eax + 8]
jne 0x1008bdcc
mov eax, dword [eax]
cmp eax, ecx
je 0x1008bdc4
mov ebx, dword [ecx + 4]
mov dword [ebp - 4], ebx
mov dword [ebx], edx
mov ebx, dword [edx + 4]
mov dword [ebx], eax
mov edi, dword [eax + 4]
mov dword [edi], ecx
mov dword [eax + 4], ebx
mov eax, dword [ebp - 4]
mov dword [edx + 4], eax
mov dword [ecx + 4], edi
mov eax, dword [ebp + 8]
mov dword [eax + 4], ecx
jmp 0x1008bdff
cmp ebx, eax
je 0x1008bddc
mov eax, dword [eax + 4]
cmp edi, dword [eax + 8]
je 0x1008be19
cmp ebx, eax
jne 0x1008bdd0
mov ebx, dword [ecx + 4]
mov dword [ebp - 4], ebx
mov dword [ebx], edx
mov ebx, dword [edx + 4]
mov dword [ebx], eax
mov edi, dword [eax + 4]
mov dword [edi], ecx
mov dword [eax + 4], ebx
mov eax, dword [ebp - 4]
mov dword [edx + 4], eax
mov eax, dword [ebp + 8]
mov dword [ecx + 4], edi
mov dword [eax], ecx
mov ebx, dword [ebp - 0xc]
mov ecx, edx
cmp edx, esi
jne 0x1008bd44
nop dword [eax]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
mov ebx, dword [ecx + 4]
mov eax, dword [eax]
mov dword [ebp + 8], eax
mov esi, dword [ebp + 8]
mov dword [ebx], edx
mov edi, dword [edx + 4]
mov dword [edi], eax
mov eax, dword [eax + 4]
mov dword [eax], ecx
mov dword [esi + 4], edi
mov esi, dword [ebp - 8]
mov dword [edx + 4], ebx
mov dword [ecx + 4], eax
jmp 0x1008bdff
push str.invalid_hash_bucket_count
call fcn.10195177
int3
Function at 0x1008be50
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov edx, dword [ebp + 8]
mov eax, 0x1fffffff
bsr eax, eax
push ebx
mov ebx, ecx
mov ecx, 1
shlx eax, ecx, eax
mov dword [ebp - 0xc], ebx
push esi
push edi
cmp edx, eax
ja 0x1008bfaa
mov esi, dword [ebx + 4]
lea eax, [edx - 1]
or eax, ecx
mov dword [ebp - 8], esi
bsr eax, eax
push esi
inc eax
shlx edi, ecx, eax
lea ecx, [ebx + 0xc]
lea eax, [edi + edi]
push eax
call sym.tesseract41.dll___Assign_grow____Hash_vec_V__allocator_V___List_unchecked_const_iterator_V___List_val_U___List_simple_types_PA
lea eax, [edi - 1]
mov dword [ebx + 0x1c], edi
mov dword [ebx + 0x18], eax
mov ecx, dword [ebx + 4]
mov ecx, dword [ecx]
mov edx, ecx
cmp ecx, esi
je 0x1008bf7c
movzx eax, byte [ecx + 8]
xor eax, 0x811c9dc5
mov edx, dword [edx]
imul edi, eax, 0x1000193
movzx eax, byte [ecx + 9]
xor edi, eax
movzx eax, byte [ecx + 0xa]
imul edi, edi, 0x1000193
xor edi, eax
movzx eax, byte [ecx + 0xb]
imul edi, edi, 0x1000193
xor edi, eax
imul eax, edi, 0x1000193
mov edi, dword [ebx + 0x18]
and edi, eax
mov eax, dword [ebx + 0xc]
mov ebx, dword [eax + edi*8]
lea eax, [eax + edi*8]
mov dword [ebp + 8], eax
cmp ebx, esi
jne 0x1008bf05
mov dword [eax], ecx
mov dword [eax + 4], ecx
jmp 0x1008bf6f
mov eax, dword [eax + 4]
mov edi, dword [ecx + 8]
cmp edi, dword [eax + 8]
jne 0x1008bf3c
mov eax, dword [eax]
cmp eax, ecx
je 0x1008bf34
mov ebx, dword [ecx + 4]
mov dword [ebp - 4], ebx
mov dword [ebx], edx
mov ebx, dword [edx + 4]
mov dword [ebx], eax
mov edi, dword [eax + 4]
mov dword [edi], ecx
mov dword [eax + 4], ebx
mov eax, dword [ebp - 4]
mov dword [edx + 4], eax
mov dword [ecx + 4], edi
mov eax, dword [ebp + 8]
mov dword [eax + 4], ecx
jmp 0x1008bf6f
cmp ebx, eax
je 0x1008bf4c
mov eax, dword [eax + 4]
cmp edi, dword [eax + 8]
je 0x1008bf85
cmp ebx, eax
jne 0x1008bf40
mov ebx, dword [ecx + 4]
mov dword [ebp - 4], ebx
mov dword [ebx], edx
mov ebx, dword [edx + 4]
mov dword [ebx], eax
mov edi, dword [eax + 4]
mov dword [edi], ecx
mov dword [eax + 4], ebx
mov eax, dword [ebp - 4]
mov dword [edx + 4], eax
mov eax, dword [ebp + 8]
mov dword [ecx + 4], edi
mov dword [eax], ecx
mov ebx, dword [ebp - 0xc]
mov ecx, edx
cmp edx, esi
jne 0x1008beb4
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
mov ebx, dword [ecx + 4]
mov eax, dword [eax]
mov dword [ebp + 8], eax
mov esi, dword [ebp + 8]
mov dword [ebx], edx
mov edi, dword [edx + 4]
mov dword [edi], eax
mov eax, dword [eax + 4]
mov dword [eax], ecx
mov dword [esi + 4], edi
mov esi, dword [ebp - 8]
mov dword [edx + 4], ebx
mov dword [ecx + 4], eax
jmp 0x1008bf6f
push str.invalid_hash_bucket_count
call fcn.10195177
int3
Function at 0x1008ed40
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x101957e0
mov eax, dword fs:[0]
push eax
push ebx
push esi
push edi
mov eax, dword [0x10290198]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov eax, dword [esi + 0x10]
test eax, eax
je 0x1008eda3
xor edi, edi
cmp dword [esi + 0x14], edi
jle 0x1008ed8c
mov eax, dword [esi + 0x10]
push dword [eax + edi*4]
call fcn.101937aa
inc edi
add esp, 4
cmp edi, dword [esi + 0x14]
jl 0x1008ed75
mov eax, dword [esi + 0x10]
push eax
call fcn.101937aa
add esp, 4
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
mov eax, dword [esi]
test eax, eax
je 0x1008ee12
xor ebx, ebx
cmp dword [esi + 8], ebx
jle 0x1008edd7
xor edi, edi
mov eax, dword [esi]
push 0x24
push dword [edi + eax + 0x6c]
call fcn.10193770
mov eax, dword [esi]
lea edi, [edi + 0x70]
inc ebx
add esp, 8
mov dword [edi + eax - 4], 0
cmp ebx, dword [esi + 8]
jl 0x1008edb2
mov eax, dword [esi]
test eax, eax
je 0x1008ee0c
push sym.tesseract41.dll_public:_void___thiscall_UNICHARSET::UNICHAR_SLOT::destructor_void_
push dword [eax - 4]
lea edi, [eax - 4]
mov dword [ebp - 4], 0
push 0x70
push eax
call fcn.10193ada
imul eax, dword [edi], 0x70
add eax, 4
push eax
push edi
call fcn.10193bef
add esp, 8
mov dword [ebp - 4], 0xffffffff
mov dword [esi], 0
lea ecx, [esi + 4]
mov dword [esi + 0x18], 0
mov dword [esi + 0xc], 0
mov dword [esi + 8], 0
call sym.tesseract41.dll_public:_void___thiscall_UNICHARMAP::clear_void_
mov dword [esi + 0x1c], 0
mov dword [esi + 0x20], 0
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x2c], 0
mov dword [esi + 0x30], 0
mov dword [esi + 0x34], 0
mov dword [esi + 0x38], 0
mov dword [esi + 0x3c], 0
mov dword [esi + 0x40], 0
mov dword [esi + 0x44], 0
mov dword [esi + 0x48], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x100bb340
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1019f887
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x10290198]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
vxorps xmm0, xmm0, xmm0
mov dword [esi], 0
mov dword [esi + 4], 0xffffffff
vmovss dword [esi + 8], xmm0
push 0x10
mov dword [esi + 0x10], 0
mov dword [esi + 0xc], 0
call fcn.1019377e
mov dword [esi + 0x14], eax
mov dword [esi + 0x10], 4
mov dword [esi + 0x18], 0
mov dword [esi + 0x1c], 0
push 0x10
mov dword [ebp - 4], 0
mov dword [esi + 0x24], 0
mov dword [esi + 0x20], 0
call fcn.1019377e
mov dword [esi + 0x28], eax
add esp, 8
mov dword [esi + 0x24], 4
mov dword [esi + 0x2c], 0
mov dword [esi + 0x30], 0
lea ecx, [esi + 0x34]
mov byte [ebp - 4], 1
call sym.tesseract41.dll_public:_void___thiscall_tesseract::KDPairInc_float__struct_MATRIX_COORD_::constructor_void_
push 0x10
mov byte [ebp - 4], 2
mov dword [esi + 0x40], 0
mov dword [esi + 0x3c], 0
call fcn.1019377e
mov dword [esi + 0x44], eax
mov dword [esi + 0x40], 4
mov dword [esi + 0x48], 0
mov dword [esi + 0x4c], 0
push 0x10
mov byte [ebp - 4], 3
mov dword [esi + 0x54], 0
mov dword [esi + 0x50], 0
call fcn.1019377e
mov dword [esi + 0x58], eax
mov dword [esi + 0x54], 4
mov dword [esi + 0x5c], 0
mov dword [esi + 0x60], 0
push 0x30
mov byte [ebp - 4], 4
mov dword [esi + 0x68], 0
mov dword [esi + 0x64], 0
call fcn.1019377e
mov dword [esi + 0x6c], eax
add esp, 0xc
mov dword [esi + 0x68], 4
mov eax, esi
mov dword [esi + 0x70], 0
mov dword [esi + 0x74], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x100cda40
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x101a0a76
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x10290198]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x10], edi
mov ebx, dword [ebp + 0x10]
lea ecx, [edi + 4]
mov eax, dword [ebp + 8]
mov dword [edi], eax
vxorps xmm0, xmm0, xmm0
push 0
mov dword [edi + 4], vtable.GENERIC_2D_ARRAY_float_.0
mov dword [edi + 8], 0
vmovss dword [edi + 0xc], xmm0
mov dword [edi + 0x10], 0
mov dword [edi + 0x14], 0
mov dword [edi + 0x18], 0
push dword [ebx + 0x10]
push dword [ebx + 0xc]
call sym.tesseract41.dll_public:_void___thiscall_GENERIC_2D_ARRAY_float_::ResizeNoInit_int__int__int_
mov eax, dword [edi + 4]
mov eax, dword [eax + 4]
cmp eax, sym.tesseract41.dll_public_virtual:_int___thiscall_GENERIC_2D_ARRAY_signed_char_::num_elements_void_const
jne 0x100cdac5
mov eax, dword [edi + 0x10]
imul eax, dword [edi + 0x14]
jmp 0x100cdaca
lea ecx, [edi + 4]
call eax
test eax, eax
jle 0x100cdae0
shl eax, 2
push eax
push dword [ebx + 4]
push dword [edi + 8]
call fcn.101952b5
add esp, 0xc
mov eax, dword [ebp + 0xc]
mov dword [edi + 0x1c], eax
push 0x10
mov dword [ebp - 4], 0
mov dword [edi + 0x30], 0
mov dword [edi + 0x2c], 0
call fcn.1019377e
mov dword [edi + 0x34], eax
mov dword [edi + 0x30], 4
mov dword [edi + 0x38], 0
mov dword [edi + 0x3c], 0
push 0x10
mov byte [ebp - 4], 1
mov dword [edi + 0x44], 0
mov dword [edi + 0x40], 0
call fcn.1019377e
mov dword [edi + 0x48], eax
add esp, 8
mov dword [edi + 0x44], 4
mov dword [edi + 0x4c], 0
mov dword [edi + 0x50], 0
mov eax, dword [ebx + 0xc]
mov dword [edi + 0x20], eax
mov eax, dword [ebx + 0x10]
mov dword [edi + 0x24], eax
mov eax, dword [edi]
mov eax, dword [eax]
mov dword [edi + 0x28], eax
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x100ddc70
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x101a1658
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
push esi
push edi
mov eax, dword [0x10290198]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
push 0x10
mov dword [ebp - 0x28], 0
call fcn.1019377e
add esp, 4
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x24], 4
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x18], 0
lea eax, [ebp - 0x10]
mov dword [ebp - 4], 0
push eax
mov eax, dword [edi + 8]
lea ecx, [ebp - 0x28]
mov dword [ebp - 0x10], 0
push dword [eax + 0x18]
call sym.tesseract41.dll_public:_void___thiscall_GenericVector_int_::init_to_size_int__int_const__
mov edx, dword [ebp + 8]
xor ecx, ecx
mov esi, dword [ebp - 0x20]
mov dword [ebp - 0x10], 0
cmp dword [edx], ecx
jle 0x100ddd19
nop word [eax + eax]
mov eax, dword [edx + 8]
mov eax, dword [eax + ecx*4]
cmp eax, dword [edi + 0x204]
je 0x100ddd14
inc dword [esi + eax*4]
inc dword [ebp - 0x10]
inc ecx
cmp ecx, dword [edx]
jl 0x100ddd00
mov edx, dword [ebp + 0xc]
xor ecx, ecx
cmp dword [edx], ecx
jle 0x100ddd38
mov eax, dword [edx + 8]
mov eax, dword [eax + ecx*4]
cmp eax, dword [edi + 0x204]
je 0x100ddd33
dec dword [esi + eax*4]
inc ecx
cmp ecx, dword [edx]
jl 0x100ddd22
mov edi, dword [ebp - 0x28]
xor edx, edx
xor ecx, ecx
mov dword [ebp + 8], edx
test edi, edi
jle 0x100dddb9
cmp edi, 0x10
jb 0x100ddda0
mov eax, edi
and eax, 0x8000000f
jns 0x100ddd59
dec eax
or eax, 0xfffffff0
inc eax
mov edx, edi
sub edx, eax
vpxor xmm1, xmm1, xmm1
vpxor xmm2, xmm2, xmm2
vpabsd ymm0, ymmword [esi + ecx*4]
vpaddd ymm1, ymm0, ymm1
vpabsd ymm0, ymmword [esi + ecx*4 + 0x20]
add ecx, 0x10
vpaddd ymm2, ymm0, ymm2
cmp ecx, edx
jl 0x100ddd65
vpaddd ymm0, ymm1, ymm2
vphaddd ymm0, ymm0, ymm0
vphaddd ymm1, ymm0, ymm0
vextracti128 xmm0, ymm1, 1
vpaddd xmm0, xmm1, xmm0
vmovd edx, xmm0
mov dword [ebp + 8], edx
cmp ecx, edi
jge 0x100dddb9
mov eax, dword [esi + ecx*4]
inc ecx
cdq
xor eax, edx
sub eax, edx
mov edx, dword [ebp + 8]
add edx, eax
mov dword [ebp + 8], edx
cmp ecx, edi
jl 0x100ddda4
mov eax, dword [ebp - 0x10]
test eax, eax
jne 0x100dddd4
test edx, edx
jne 0x100dddca
vxorpd xmm0, xmm0, xmm0
jmp 0x100ddde8
vmovsd xmm0, qword [0x101af3e0]
jmp 0x100ddde8
vxorps xmm0, xmm0, xmm0
vxorps xmm1, xmm1, xmm1
vcvtsi2sd xmm1, xmm1, edx
vcvtsi2sd xmm0, xmm0, eax
vdivsd xmm0, xmm1, xmm0
vmovsd qword [ebp - 0x14], xmm0
cmp dword [ebp - 0x24], 0
mov dword [ebp - 4], 2
jle 0x100dde1c
mov ecx, dword [ebp - 0x1c]
test ecx, ecx
je 0x100dde1c
xor edi, edi
cmp dword [ebp - 0x28], edi
jle 0x100dde1c
mov eax, dword [ecx]
push dword [esi + edi*4]
vzeroupper
call dword [eax + 4]
mov ecx, dword [ebp - 0x1c]
inc edi
cmp edi, dword [ebp - 0x28]
jl 0x100dde08
push esi
vzeroupper
call fcn.101937aa
mov ecx, dword [ebp - 0x1c]
add esp, 4
test ecx, ecx
je 0x100dde35
mov eax, dword [ecx]
push 1
call dword [eax]
mov ecx, dword [ebp - 0x18]
test ecx, ecx
je 0x100dde42
mov eax, dword [ecx]
push 1
call dword [eax]
fld qword [ebp - 0x14]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 8
Function at 0x100ed960
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x101a2893
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x10290198]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x10], edi
push 0
push 0
push dword [ebp + 8]
push 4
call sym.tesseract41.dll_public:_void___thiscall_tesseract::Network::constructor_enum_tesseract::NetworkType__class_STRING_const___int__int_
lea esi, [edi + 0x30]
mov dword [edi], vtable.tesseract::Plumbing.0
push 0x10
mov dword [ebp - 4], 0
mov dword [ebp + 8], esi
mov dword [esi + 4], 0
mov dword [esi], 0
call fcn.1019377e
mov dword [esi + 8], eax
mov dword [esi + 4], 4
mov dword [esi + 0xc], 0
mov dword [esi + 0x10], 0
push 0x10
mov byte [ebp - 4], 1
mov dword [edi + 0x48], 0
mov dword [edi + 0x44], 0
call fcn.1019377e
mov dword [edi + 0x4c], eax
add esp, 8
mov dword [edi + 0x48], 4
mov eax, edi
mov dword [edi + 0x50], 0
mov dword [edi + 0x54], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4

Function at 0x100eeb20
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x101a2979
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x10290198]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x10], edi
mov dword [edi], 0
mov dword [edi + 4], 0
mov dword [edi + 8], 0
mov eax, dword [ebp + 8]
lea esi, [edi + 0x10]
mov dword [edi + 0xc], eax
push 0x10
mov dword [ebp - 4], 0
mov dword [ebp + 8], esi
mov dword [esi + 4], 0
mov dword [esi], 0
call fcn.1019377e
mov dword [esi + 8], eax
mov dword [esi + 4], 4
mov dword [esi + 0xc], 0
mov dword [esi + 0x10], 0
mov dword [edi + 0x24], 0
push 0x10
mov byte [ebp - 4], 1
mov dword [edi + 0x2c], 0
mov dword [edi + 0x28], 0
call fcn.1019377e
mov dword [edi + 0x30], eax
mov dword [edi + 0x2c], 4
mov dword [edi + 0x34], 0
mov dword [edi + 0x38], 0
lea esi, [edi + 0x44]
mov dword [edi + 0x3c], 0xffffffff
mov dword [edi + 0x40], 0xffffffff
push 0x20
mov byte [ebp - 4], 2
mov dword [ebp + 8], esi
mov dword [esi + 4], 0
mov dword [esi], 0
call fcn.1019377e
mov dword [esi + 8], eax
add esp, 0xc
mov dword [esi + 4], 4
mov dword [esi + 0xc], 0
mov dword [esi + 0x10], 0
mov al, byte [ebp + 0x10]
mov ecx, dword [ebp + 0x14]
mov byte [edi + 0x5d], al
mov eax, dword [ebp + 0xc]
mov byte [ebp - 4], 3
mov dword [edi + 0x58], ecx
mov byte [edi + 0x5c], 1
mov dword [edi + 0x60], eax
test ecx, ecx
je 0x100eec5c
call sym.tesseract41.dll_public:_bool___thiscall_tesseract::Dict::IsSpaceDelimitedLang_void_const
test al, al
mov eax, edi
jne 0x100eec5e
mov byte [edi + 0x5c], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 0x10
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 0x10
Function at 0x100fee20
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
movsx eax, word [ecx + 4]
sub esp, 8
movsx edx, word [ecx + 8]
vmovss xmm5, dword [ecx + 0x40]
vmovss xmm3, dword [ecx + 0x4c]
vmovss xmm2, dword [ecx + 0x44]
add edx, eax
vxorps xmm0, xmm0, xmm0
vcvtsi2ss xmm0, xmm0, edx
vmulss xmm6, xmm0, dword [0x101af3cc]
vmovss xmm0, dword [ecx + 0x48]
vsubss xmm0, xmm0, xmm5
vcvtss2sd xmm4, xmm0, xmm0
vucomisd xmm4, qword [0x101b0ad0]
lahf
test ah, 0x44
jp 0x100fee7f
vaddss xmm0, xmm2, xmm3
vcvtss2sd xmm0, xmm0, xmm0
vmulsd xmm0, xmm0, qword [0x101b0070]
jmp 0x100feea3
vcvtss2sd xmm1, xmm6, xmm6
vcvtss2sd xmm0, xmm5, xmm5
vsubsd xmm1, xmm1, xmm0
vsubss xmm0, xmm3, xmm2
vcvtss2sd xmm0, xmm0, xmm0
vmulsd xmm0, xmm1, xmm0
vdivsd xmm1, xmm0, xmm4
vcvtss2sd xmm0, xmm2, xmm2
vaddsd xmm0, xmm1, xmm0
mov eax, dword [ebp + 8]
vcvtsd2ss xmm0, xmm0, xmm0
vmovss xmm3, dword [eax]
vmovss xmm2, dword [eax + 4]
vmulss xmm1, xmm0, xmm3
vmulss xmm0, xmm2, xmm6
vsubss xmm0, xmm1, xmm0
vmovss dword [esp + 4], xmm0
vmulss xmm1, xmm2, xmm2
vmulss xmm0, xmm3, xmm3
vaddss xmm0, xmm1, xmm0
vcvtss2sd xmm0, xmm0, xmm0
call fcn.101952f1
vmovss xmm1, dword [esp + 4]
vcvtsd2ss xmm0, xmm0, xmm0
vdivss xmm0, xmm1, xmm0
vmovss dword [esp + 4], xmm0
fld dword [esp + 4]
mov esp, ebp
pop ebp
ret 4
Function at 0x10143070
Capabilities:
Check for peb beingdebugged flag

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x101a5a6f
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x10290198]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x10], edi
mov esi, dword [ebp + 0x10]
push esi
push dword [ebp + 0xc]
push dword [ebp + 8]
call sym.tesseract41.dll_public:_void___thiscall_tesseract::AlignedBlob::constructor_int__class_ICOORD_const___class_ICOORD_const__
xor eax, eax
mov dword [edi], vtable.tesseract::TabFind.0
mov dword [edi + 0x20], eax
xor ecx, ecx
mov eax, dword [ebp + 0x20]
mov dword [edi + 0x24], eax
mov ax, word [esi + 2]
dec ax
mov word [edi + 0x28], cx
movzx eax, ax
mov word [edi + 0x2a], ax
lea eax, [edi + 0x2c]
mov dword [ebp - 4], 0
mov dword [eax], ecx
mov dword [edi + 0x30], eax
mov dword [edi + 0x34], ecx
mov eax, dword [eax]
test eax, eax
je 0x101430ea
mov eax, dword [eax + 4]
jmp 0x101430ec
xor eax, eax
mov dword [edi + 0x38], eax
test eax, eax
je 0x101430f8
mov eax, dword [eax + 4]
jmp 0x101430fa
xor eax, eax
mov dword [edi + 0x3c], eax
mov dword [edi + 0x44], 0
mov byte [edi + 0x48], 0
mov word [edi + 0x40], 0
mov dword [edi + 0x4c], 0
mov dword [edi + 0x50], 0
push 0x10
mov byte [ebp - 4], 3
mov dword [edi + 0x5c], 0
mov dword [edi + 0x58], 0
call fcn.1019377e
mov dword [edi + 0x60], eax
mov dword [edi + 0x5c], 4
mov dword [edi + 0x64], 0
mov dword [edi + 0x68], 0
push 0x10
mov byte [ebp - 4], 4
mov dword [edi + 0x70], 0
mov dword [edi + 0x6c], 0
call fcn.1019377e
mov dword [edi + 0x74], eax
add esp, 8
mov dword [edi + 0x70], 4
mov dword [edi + 0x78], 0
mov dword [edi + 0x7c], 0
push dword [ebp + 0x14]
lea ecx, [edi + 0x30]
mov byte [ebp - 4], 5
mov dword [edi + 0x54], 0
call sym.tesseract41.dll_public:_void___thiscall_ELIST2_ITERATOR::add_list_after_class_ELIST2__
push dword [ebp + 0x1c]
mov ecx, edi
push dword [ebp + 0x18]
call sym.tesseract41.dll_private:_void___thiscall_tesseract::TabFind::SetVerticalSkewAndParallelize_int__int_
push 0xc
call fcn.10193740
add esp, 4
mov dword [ebp + 0x10], eax
test eax, eax
je 0x101431ca
mov dword [eax], vtable._TessMemberResultCallback_0_1_0__bool__class_tesseract::TabFind__int_.0
mov dword [eax + 4], edi
mov dword [eax + 8], sym.tesseract41.dll_public:_bool___thiscall_tesseract::TabFind::CommonWidth_int_
mov dword [edi + 0x54], eax
jmp 0x101431d1
mov dword [edi + 0x54], 0
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 0x1c