joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40689a
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x23c
push esi
mov esi, 0x104
lea eax, [ebp - 0x23c]
push esi
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
cmp eax, esi
pop esi
jbe 0x4068be
xor eax, eax
test eax, eax
je 0x4068d1
cmp word [ebp + eax*2 - 0x23e], 0x5c
je 0x4068d1
xor ecx, ecx
jmp 0x4068d4
xor ecx, ecx
inc ecx
push dword [ebp + 8]
lea ecx, [ecx*2 + 0x40a014]
lea eax, [ebp + eax*2 - 0x23c]
push ecx
push str._s_S.dll
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x10
lea eax, [ebp - 0x23c]
push 8
push 0
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
leave
ret 4

Function at 0x4069f7
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
cmp dword [0x43190c], 0
push esi
jne 0x406a2e
xor ecx, ecx
push 8
mov eax, ecx
pop esi
mov edx, eax
and dl, 1
neg dl
sbb edx, edx
and edx, 0xedb88320
shr eax, 1
xor eax, edx
dec esi
jne 0x406a08
mov dword [ecx*4 + 0x431908], eax
inc ecx
cmp ecx, 0x100
jl 0x406a03
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 8]
test edx, edx
not eax
jbe 0x406a5f
mov ecx, dword [esp + 0xc]
push edi
movzx edi, byte [ecx]
mov esi, eax
and esi, 0xff
xor esi, edi
shr eax, 8
mov esi, dword [esi*4 + 0x431908]
xor eax, esi
inc ecx
dec edx
jne 0x406a41
pop edi
not eax
pop esi
ret 0xc

Function at 0x414ac0
Capabilities:
Encode data using xor

Disassembly:
invalid
invalid
out dx, al
mov byte [0x248a6695], al
imul esi, dword [ecx + 0x32], 0x23
loope 0x414a42
pop edi
pop ss
retf 0x4871
dec eax
sub dl, byte [edi - 0x7e]
mov bh, 0xb6
mov dh, 0x1c
invalid
jno 0x414aab
mov dh, 0x1c
imul esi, dword [ecx - 0x1a], 0x45
inc ebp
fcompi st(6)
jecxz 0x414a5e
mul bl
xchg esp, eax
out 0x67, al
xor ebx, edx
mov ds, ebp
adc eax, 0x1d72f47d
jge 0x414ac7
jb 0x414af2
push 0xffffffffffffffde
pop edi
inc edi
push ebx
jo 0x414b24
pop edx
xchg ebp, eax
jle 0x414ad1
jecxz 0x414b11
mov al, byte [edi - 0x5b]
xchg ebp, eax
xchg dword ss:[ebx - 0x4ca0712c], eax
push 0x71
dec eax
or ecx, esi
jno 0x414b3c
sbb al, 0x2d
sahf
xlatb
mov byte [0x65666695], al
push 0x71
jle 0x414b21
xchg ebp, eax
invalid
push 0x71
dec eax
jecxz 0x414aab
invalid
xchg ebp, eax
invalid
mov bh, 0xe3
xchg ebp, eax
jecxz 0x414abb
invalid
jecxz 0x414b23
iretd
Function at 0x10008a70
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push esi
xor esi, esi
mov dword [ebp - 0x14], 0
cmp byte [ebp + 0xc], 0
mov eax, ecx
push edi
mov edi, edx
mov dword [ebp - 4], eax
cmovne esi, edi
test esi, esi
jne 0x10008a99
mov byte [ebp - 8], 0
jmp 0x10008ab9
mov eax, dword [ebp + 8]
lea ecx, [ebp - 0xc]
push ecx
push 0x40
push esi
push eax
mov dword [ebp - 0x10], esi
mov dword [ebp - 0x14], eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
mov eax, dword [ebp - 4]
setne byte [ebp - 8]
push edi
push eax
push dword [ebp + 8]
call fcn.1001c730
add esp, 0xc
cmp byte [ebp - 8], 0
je 0x10008ae3
mov eax, dword [ebp - 0xc]
lea ecx, [ebp + 0xc]
push ecx
push eax
push dword [ebp - 0x10]
mov dword [ebp + 0xc], eax
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x10008af0
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
xor esi, esi
mov dword [ebp - 8], ecx
cmp byte [ebp + 0xc], 0
mov eax, edx
push edi
cmovne esi, eax
mov dword [ebp - 4], eax
xor edi, edi
mov dword [ebp - 0x18], edi
test esi, esi
jne 0x10008b17
xor bl, bl
jmp 0x10008b3c
mov eax, dword [ebp + 8]
lea ecx, [ebp - 0x10]
push ecx
push 0x40
push esi
push eax
mov dword [ebp - 0x14], esi
mov dword [ebp - 0x18], eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov edi, dword [ebp - 0x18]
test eax, eax
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 8]
setne bl
push eax
push dword [ebp + 8]
mov byte [ebp - 0xc], bl
push ecx
call fcn.1001c730
add esp, 0xc
test bl, bl
je 0x10008b65
mov eax, dword [ebp - 0x10]
lea ecx, [ebp + 0xc]
push ecx
push eax
push dword [ebp - 0x14]
mov dword [ebp + 0xc], eax
push edi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10008b70
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [ebp - 0x10]
push esi
mov esi, dword [ebp + 8]
push edi
push eax
push 0x40
push 1
push esi
mov edi, ecx
mov dword [ebp - 0x14], 1
mov dword [ebp - 0x18], esi
call ebx
test eax, eax
setne byte [ebp - 0xc]
mov cl, byte [esi]
mov byte [ebp - 1], cl
test eax, eax
je 0x10008bbe
mov eax, dword [ebp - 0x10]
lea ecx, [ebp - 8]
push ecx
push eax
push dword [ebp - 0x14]
mov dword [ebp - 8], eax
push dword [ebp - 0x18]
call ebx
mov cl, byte [ebp - 1]
movzx eax, cl
sub eax, 0xe8
je 0x10008c41
sub eax, 1
je 0x10008c41
sub eax, 0x16
jne 0x10008c32
mov eax, dword [ebp + 8]
push ecx
mov ecx, esp
inc eax
mov dword [ecx], eax
call fcn.10013bb0
add esp, 4
cmp al, 0x15
je 0x10008beb
cmp al, 0x25
jne 0x10008c32
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x10]
push eax
push 0x40
add esi, 2
mov dword [ebp - 0x14], 4
push 4
push esi
mov dword [ebp - 0x18], esi
call ebx
test eax, eax
setne byte [ebp - 0xc]
mov esi, dword [esi]
test eax, eax
je 0x10008c25
mov eax, dword [ebp - 0x10]
lea ecx, [ebp - 8]
push ecx
push eax
push dword [ebp - 0x14]
mov dword [ebp - 8], eax
push dword [ebp - 0x18]
call ebx
mov eax, dword [esi]
mov dword [edi], eax
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov dword [edi], 0
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov esi, dword [ebp + 8]
push ecx
mov eax, esp
inc esi
mov dword [eax], esi
call fcn.10013b60
add esp, 4
add eax, 4
add eax, esi
mov dword [edi], eax
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x10008c70
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
push ecx
mov edx, esp
mov dword [ebp - 4], ecx
mov dword [edx], eax
call fcn.10008b70
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x10]
mov ebx, dword [sym.imp.KERNEL32.dll_VirtualProtect]
add esp, 4
mov dword [ebp - 0x14], 1
mov dword [ebp - 0x18], esi
push eax
push 0x40
push 1
push esi
call ebx
test eax, eax
setne byte [ebp - 0xc]
mov byte [esi], 0xe8
test eax, eax
je 0x10008cca
mov eax, dword [ebp - 0x10]
lea ecx, [ebp - 8]
push ecx
push eax
push dword [ebp - 0x14]
mov dword [ebp - 8], eax
push dword [ebp - 0x18]
call ebx
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x10]
mov edi, dword [ebp + 0xc]
inc esi
push eax
push 0x40
push 4
sub edi, esi
mov dword [ebp - 0x14], 4
push esi
sub edi, 4
mov dword [ebp - 0x18], esi
call ebx
test eax, eax
setne byte [ebp - 0xc]
mov dword [esi], edi
test eax, eax
je 0x10008d0a
mov eax, dword [ebp - 0x10]
lea ecx, [ebp - 8]
push ecx
push eax
push dword [ebp - 0x14]
mov dword [ebp - 8], eax
push dword [ebp - 0x18]
call ebx
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1000df90
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100433dd
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push ebx
push esi
push edi
mov eax, dword [0x10054068]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x14], ecx
lea ecx, [ebp + 8]
mov dword [ebp - 4], 0
call fcn.10005500
mov edx, dword [ebp + 0x1c]
lea eax, [ebp + 8]
mov ebx, dword [ebp + 8]
lea edi, [ebp + 8]
cmp edx, 0x10
lea esi, [ebp + 8]
cmovae eax, ebx
cmovae edi, ebx
add eax, dword [ebp + 0x18]
cmp edx, 0x10
cmovae esi, ebx
cmp esi, eax
je 0x1000e00d
sub edi, esi
mov ebx, eax
movsx eax, byte [esi]
push eax
call fcn.10020731
mov byte [edi + esi], al
add esp, 4
inc esi
cmp esi, ebx
jne 0x1000dff3
mov ebx, dword [ebp + 8]
mov edx, dword [ebp + 0x1c]
mov esi, dword [ebp + 0x18]
lea edi, [ebp + 8]
cmp edx, 0x10
mov ecx, 0x811c9dc5
cmovae edi, ebx
xor edx, edx
test esi, esi
je 0x1000e035
movzx eax, byte [edx + edi]
inc edx
xor eax, ecx
imul ecx, eax, 0x1000193
cmp edx, esi
jb 0x1000e024
push ecx
mov ecx, dword [ebp - 0x14]
lea eax, [ebp + 8]
push eax
lea eax, [ebp - 0x1c]
push eax
call fcn.100170c0
mov ecx, dword [ebp + 0x1c]
cmp dword [eax + 4], 0
setne al
mov byte [ebp - 0xd], al
cmp ecx, 0x10
jb 0x1000e080
inc ecx
mov eax, ebx
cmp ecx, 0x1000
jb 0x1000e073
mov ebx, dword [eax - 4]
add ecx, 0x23
sub eax, ebx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x1000e094
push ecx
push ebx
call fcn.1001b437
mov al, byte [ebp - 0xd]
add esp, 8
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x18
call fcn.1002b013
int3
Function at 0x10011250
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10043700
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x10054068]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov dword [ebp - 0x10], ebx
push 8
mov dword [ebx], vtable.std::basic_streambuf_char__struct_std::char_traits_char__.0
call fcn.1001b0ed
mov esi, eax
push 1
mov dword [ebp - 4], 0
call fcn.1001a5bb
add esp, 8
mov dword [esi + 4], eax
mov ecx, ebx
mov dword [ebx + 0x34], esi
call fcn.100129c0
mov eax, ebx
lea ecx, [eax + 0x18]
lea edx, [eax + 0x24]
lea esi, [eax + 8]
lea ebx, [eax + 4]
mov dword [eax + 0x20], ecx
mov dword [eax + 0xc], ebx
lea edi, [eax + 0x14]
mov dword [eax + 0x2c], edx
mov dword [eax], vtable.std::basic_filebuf_char__struct_std::char_traits_char__.0
mov byte [eax + 0x48], 0
mov byte [eax + 0x3d], 0
mov dword [eax + 0x10], esi
mov dword [eax + 0x1c], edi
add eax, 0x28
mov dword [ebp - 0x14], ebx
mov ebx, dword [ebp - 0x10]
mov dword [ebx + 0x30], eax
mov ebx, dword [ebp - 0x14]
mov dword [esi], 0
mov dword [ecx], 0
mov ecx, dword [0x10057550]
mov dword [eax], 0
mov eax, dword [0x1005754c]
mov dword [ebx], 0
mov dword [edi], 0
mov dword [edx], 0
mov edx, dword [ebp - 0x10]
mov dword [edx + 0x40], eax
mov eax, edx
mov dword [edx + 0x4c], 0
mov dword [edx + 0x44], ecx
mov dword [edx + 0x38], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10012bd0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10043885
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push ebx
push esi
push edi
mov eax, dword [0x10054068]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov edx, dword [ebp + 8]
mov esi, edx
cmp dword [edx + 0x14], 0x10
jb 0x10012c07
mov esi, dword [edx]
xor ecx, ecx
mov edi, 0x811c9dc5
cmp dword [edx + 0x10], ecx
jbe 0x10012c25
movzx eax, byte [ecx + esi]
inc ecx
xor eax, edi
imul edi, eax, 0x1000193
cmp ecx, dword [edx + 0x10]
jb 0x10012c13
push edi
push edx
lea eax, [ebp - 0x14]
mov ecx, ebx
push eax
call fcn.100170c0
mov esi, dword [ebp - 0x10]
test esi, esi
jne 0x10012d1a
cmp dword [ebx + 8], 0x71c71c7
je 0x10012d31
lea eax, [ebx + 4]
mov dword [ebp - 0x1c], eax
mov dword [ebp - 4], esi
push 0x24
mov dword [ebp - 0x18], esi
call fcn.1001b0ed
add esp, 4
mov esi, eax
mov dword [ebp - 0x18], esi
push dword [ebp + 8]
lea ecx, [esi + 8]
call fcn.1000fcc0
mov dword [esi + 0x20], 0
mov dword [ebp - 4], 1
mov eax, dword [ebx + 8]
inc eax
movd xmm0, eax
cvtdq2pd xmm0, xmm0
shr eax, 0x1f
addsd xmm0, qword [eax*8 + 0x1004dee0]
mov eax, dword [ebx + 0x1c]
cvtpd2ps xmm1, xmm0
movd xmm0, eax
cvtdq2pd xmm0, xmm0
shr eax, 0x1f
addsd xmm0, qword [eax*8 + 0x1004dee0]
cvtpd2ps xmm0, xmm0
divss xmm1, xmm0
comiss xmm1, dword [ebx]
jbe 0x10012cd9
mov ecx, ebx
call fcn.100153e0
push edi
lea eax, [esi + 8]
mov ecx, ebx
push eax
lea eax, [ebp - 0x1c]
push eax
call fcn.100170c0
mov edx, dword [eax]
jmp 0x10012cdc
mov edx, dword [ebp - 0x14]
mov eax, dword [edx + 4]
inc dword [ebx + 8]
mov dword [esi + 4], eax
mov dword [esi], edx
mov dword [eax], esi
mov dword [edx + 4], esi
mov ecx, dword [ebx + 0xc]
mov dword [ebp + 8], eax
mov eax, dword [ebx + 0x18]
and eax, edi
mov edi, dword [ecx + eax*8]
cmp edi, dword [ebx + 4]
jne 0x10012d04
mov dword [ecx + eax*8], esi
jmp 0x10012d16
cmp edi, edx
jne 0x10012d0d
mov dword [ecx + eax*8], esi
jmp 0x10012d1a
mov edx, dword [ebp + 8]
cmp dword [ecx + eax*8 + 4], edx
jne 0x10012d1a
mov dword [ecx + eax*8 + 4], esi
lea eax, [esi + 0x20]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
push str.unordered_map_set_too_long
call fcn.1001a3e9
int3

Function at 0x10013b60
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push esi
mov esi, dword [ebp + 8]
lea eax, [ebp - 0xc]
push eax
push 0x40
push 4
push esi
mov dword [ebp - 0x10], 4
mov dword [ebp - 0x14], esi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
setne byte [ebp - 8]
mov esi, dword [esi]
test eax, eax
je 0x10013ba6
mov ecx, dword [ebp - 0xc]
lea eax, [ebp - 4]
push eax
push ecx
push dword [ebp - 0x10]
mov dword [ebp - 4], ecx
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x10013bb0
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
mov esi, dword [ebp + 8]
lea eax, [ebp - 0xc]
push eax
push 0x40
push 1
push esi
mov dword [ebp - 0x10], 1
mov dword [ebp - 0x14], esi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
setne byte [ebp - 8]
mov bl, byte [esi]
test eax, eax
je 0x10013bf7
mov ecx, dword [ebp - 0xc]
lea eax, [ebp - 4]
push eax
push ecx
push dword [ebp - 0x10]
mov dword [ebp - 4], ecx
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
pop esi
mov al, bl
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x10013c00
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov edx, dword [ebp + 8]
mov eax, ecx
push ebx
push esi
push edi
cmp dword [edx + 0x14], 0x10
mov edi, edx
mov ebx, dword [edx + 0x10]
mov dword [ebp - 4], eax
jb 0x10013c1e
mov edi, dword [edx]
xor ecx, ecx
mov esi, 0x811c9dc5
test ebx, ebx
je 0x10013c44
nop dword [eax]
movzx eax, byte [ecx + edi]
inc ecx
xor eax, esi
imul esi, eax, 0x1000193
cmp ecx, ebx
jb 0x10013c30
mov eax, dword [ebp - 4]
push esi
push edx
lea ecx, [ebp - 8]
push ecx
mov ecx, eax
call fcn.100170c0
xor ecx, ecx
pop edi
pop esi
cmp dword [eax + 4], ecx
pop ebx
setne cl
mov eax, ecx
mov esp, ebp
pop ebp
ret 4
Function at 0x10015700
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov edx, dword [ebp + 8]
mov eax, 0x1fffffff
push ebx
mov ebx, ecx
bsr ecx, eax
push esi
mov esi, 1
mov dword [ebp - 0x10], ebx
mov eax, esi
shl eax, cl
push edi
cmp edx, eax
ja 0x1001586d
lea eax, [edx - 1]
or eax, esi
bsr ecx, eax
mov eax, dword [ebx + 4]
push eax
mov dword [ebp + 8], eax
lea ecx, [ecx + 1]
shl esi, cl
lea ecx, [ebx + 0xc]
lea eax, [esi + esi]
push eax
call fcn.10013160
lea eax, [esi - 1]
mov dword [ebx + 0x1c], esi
mov dword [ebx + 0x18], eax
mov esi, dword [ebx + 4]
mov eax, dword [ebp + 8]
mov esi, dword [esi]
mov edi, esi
cmp esi, eax
je 0x10015848
cmp dword [esi + 0x1c], 0x10
lea ecx, [esi + 8]
mov edi, dword [edi]
mov edx, dword [ecx + 0x10]
mov dword [ebp - 0xc], edi
mov dword [ebp - 8], edx
mov dword [ebp - 4], ecx
jb 0x10015781
mov edx, dword [ecx]
mov dword [ebp - 4], edx
xor edx, edx
mov ebx, 0x811c9dc5
cmp dword [ecx + 0x10], edx
jbe 0x100157aa
mov eax, dword [ebp - 4]
mov edi, dword [ebp - 8]
movzx ecx, byte [edx + eax]
inc edx
xor ecx, ebx
imul ebx, ecx, 0x1000193
cmp edx, edi
jb 0x10015793
mov edi, dword [ebp - 0xc]
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0x10]
mov edx, dword [ecx + 0x18]
mov ecx, dword [ecx + 0xc]
and edx, ebx
lea ecx, [ecx + edx*8]
mov dword [ebp - 4], ecx
cmp dword [ecx], eax
jne 0x100157c6
mov dword [ecx], esi
mov dword [ecx + 4], esi
jmp 0x1001583e
mov ebx, dword [ecx + 4]
lea ecx, [esi + 8]
lea edx, [ebx + 8]
call fcn.10013ae0
test al, al
je 0x100157fe
mov ebx, dword [ebx]
cmp ebx, esi
je 0x100157f6
mov edx, dword [esi + 4]
mov dword [edx], edi
mov ecx, dword [edi + 4]
mov dword [ecx], ebx
mov eax, dword [ebx + 4]
mov dword [eax], esi
mov dword [ebx + 4], ecx
mov dword [edi + 4], edx
mov dword [esi + 4], eax
mov eax, dword [ebp - 4]
mov dword [eax + 4], esi
jmp 0x1001583b
mov eax, dword [ebp - 4]
cmp dword [eax], ebx
je 0x1001581e
mov ebx, dword [ebx + 4]
lea ecx, [esi + 8]
lea edx, [ebx + 8]
call fcn.10013ae0
test al, al
jne 0x10015851
mov eax, dword [ebp - 4]
cmp dword [eax], ebx
jne 0x10015805
mov edx, dword [esi + 4]
mov dword [edx], edi
mov ecx, dword [edi + 4]
mov dword [ecx], ebx
mov eax, dword [ebx + 4]
mov dword [eax], esi
mov dword [ebx + 4], ecx
mov dword [edi + 4], edx
mov dword [esi + 4], eax
mov eax, dword [ebp - 4]
mov dword [eax], esi
mov eax, dword [ebp + 8]
mov esi, edi
cmp edi, eax
jne 0x10015765
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
mov edx, dword [esi + 4]
mov ebx, dword [ebx]
mov dword [edx], edi
mov ecx, dword [edi + 4]
mov dword [ecx], ebx
mov eax, dword [ebx + 4]
mov dword [eax], esi
mov dword [ebx + 4], ecx
mov dword [edi + 4], edx
mov dword [esi + 4], eax
jmp 0x1001583b
push str.invalid_hash_bucket_count
call fcn.1001a3e9
int3
Function at 0x10019af0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10044485
mov eax, dword fs:[0]
push eax
sub esp, 0x28
push ebx
push esi
push edi
mov eax, dword [0x10054068]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edx, ecx
mov dword [ebp - 0x10], edx
mov esi, dword [ebp + 8]
mov edi, dword [ebp + 0xc]
cmp esi, edi
je 0x10019cb0
nop dword [eax + eax]
cmp dword [esi + 0x1c], 0x10
lea eax, [esi + 8]
mov ecx, dword [eax + 0x10]
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 0x14], eax
jb 0x10019b4a
mov ecx, dword [eax]
mov dword [ebp - 0x14], ecx
xor ecx, ecx
mov ebx, 0x811c9dc5
cmp dword [eax + 0x10], ecx
jbe 0x10019b7a
mov edx, dword [ebp - 0x14]
mov edi, dword [ebp - 0x1c]
nop dword [eax]
movzx eax, byte [ecx + edx]
inc ecx
xor eax, ebx
imul ebx, eax, 0x1000193
cmp ecx, edi
jb 0x10019b60
mov edi, dword [ebp + 0xc]
lea eax, [esi + 8]
mov edx, dword [ebp - 0x10]
push ebx
push eax
lea eax, [ebp - 0x24]
mov ecx, edx
push eax
call fcn.100170c0
cmp dword [ebp - 0x20], 0
jne 0x10019c9f
mov edi, dword [ebp - 0x10]
cmp dword [edi + 8], 0x71c71c7
je 0x10019cc4
lea eax, [edi + 4]
mov dword [ebp - 0x2c], eax
mov dword [ebp - 4], 0
push 0x24
mov dword [ebp - 0x28], 0
call fcn.1001b0ed
add esp, 4
mov esi, eax
mov dword [ebp - 0x28], esi
push dword [ebp - 0x18]
lea ecx, [esi + 8]
call fcn.1000fcc0
mov ecx, dword [ebp - 0x18]
mov eax, dword [ecx + 0x18]
mov dword [esi + 0x20], eax
mov dword [ebp - 4], 1
mov eax, dword [edi + 8]
inc eax
movd xmm0, eax
cvtdq2pd xmm0, xmm0
shr eax, 0x1f
addsd xmm0, qword [eax*8 + 0x1004dee0]
mov eax, dword [edi + 0x1c]
cvtpd2ps xmm1, xmm0
movd xmm0, eax
cvtdq2pd xmm0, xmm0
shr eax, 0x1f
addsd xmm0, qword [eax*8 + 0x1004dee0]
cvtpd2ps xmm0, xmm0
divss xmm1, xmm0
comiss xmm1, dword [edi]
seta al
test al, al
je 0x10019c48
mov ecx, edi
call fcn.100153e0
push ebx
lea eax, [esi + 8]
mov ecx, edi
push eax
lea eax, [ebp - 0x34]
push eax
call fcn.100170c0
mov edx, dword [eax]
mov eax, dword [eax + 4]
mov dword [ebp - 0x24], edx
mov dword [ebp - 0x20], eax
jmp 0x10019c4b
mov edx, dword [ebp - 0x24]
mov eax, dword [edx + 4]
inc dword [edi + 8]
mov dword [esi + 4], eax
mov dword [esi], edx
mov dword [eax], esi
mov dword [edx + 4], esi
mov ecx, dword [edi + 0xc]
mov dword [ebp - 0x1c], eax
mov eax, dword [edi + 0x18]
and eax, ebx
mov dword [ebp - 0x28], 0
mov ebx, dword [ebp - 0x2c]
mov edi, dword [ecx + eax*8]
cmp edi, dword [ebx]
jne 0x10019c7c
mov dword [ecx + eax*8], esi
jmp 0x10019c8e
cmp edi, edx
jne 0x10019c85
mov dword [ecx + eax*8], esi
jmp 0x10019c92
mov edx, dword [ebp - 0x1c]
cmp dword [ecx + eax*8 + 4], edx
jne 0x10019c92
mov dword [ecx + eax*8 + 4], esi
mov dword [ebp - 4], 0xffffffff
mov edi, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
mov esi, dword [esi]
mov dword [ebp + 8], esi
cmp esi, edi
je 0x10019cb0
mov edx, dword [ebp - 0x10]
jmp 0x10019b30
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
push str.unordered_map_set_too_long
call fcn.1001a3e9
int3
Function at 0x10019f40
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push esi
mov ecx, 0x401000
call fcn.1001a180
mov dword [ebp - 4], eax
lea ecx, [ebp - 4]
lea eax, [ebp - 8]
push eax
call fcn.1000d710
mov dword [ebp - 0x14], 4
mov esi, dword [eax]
lea eax, [ebp - 0x10]
push eax
push 0x40
push 4
push esi
mov dword [ebp - 0x18], esi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
setne byte [ebp - 0xc]
mov esi, dword [esi]
test eax, eax
je 0x10019f9e
mov eax, dword [ebp - 0x10]
lea ecx, [ebp - 4]
push ecx
push eax
push dword [ebp - 0x14]
mov dword [ebp - 4], eax
push dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
cmp esi, 0x53ec8b55
jne 0x10019fb0
mov eax, 0x3e9
pop esi
mov esp, ebp
pop ebp
ret
mov ecx, 0x401000
call fcn.1001a0c0
cmp eax, 0x16197be9
jne 0x10019fcb
mov eax, 0x3ea
pop esi
mov esp, ebp
pop ebp
ret
mov ecx, 0x8245bc
call fcn.1001a0c0
cmp eax, 0x94bf
jne 0x10019fe6
mov eax, 0x3f3
pop esi
mov esp, ebp
pop ebp
ret
mov ecx, 0x8252fc
call fcn.1001a0c0
cmp eax, 0x94bf
jne 0x1001a001
mov eax, 0x44d
pop esi
mov esp, ebp
pop ebp
ret
mov ecx, 0x82533c
call fcn.1001a0c0
cmp eax, 0x94bf
jne 0x1001a01c
mov eax, 0x457
pop esi
mov esp, ebp
pop ebp
ret
mov ecx, 0x858d51
call fcn.1001a0c0
cmp eax, 0x3539f633
jne 0x1001a037
mov eax, 0xc80
pop esi
mov esp, ebp
pop ebp
ret
mov ecx, 0x858c61
call fcn.1001a0c0
xor ecx, ecx
mov edx, 0xc8a
cmp eax, 0x3539f633
pop esi
cmove ecx, edx
mov eax, ecx
mov esp, ebp
pop ebp
ret

Function at 0x1001a0c0
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push esi
call fcn.1001a180
mov dword [ebp - 4], eax
lea ecx, [ebp - 4]
lea eax, [ebp - 8]
push eax
call fcn.1000d710
mov dword [ebp - 0x14], 4
mov esi, dword [eax]
lea eax, [ebp - 0x10]
push eax
push 0x40
push 4
push esi
mov dword [ebp - 0x18], esi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
setne byte [ebp - 0xc]
mov esi, dword [esi]
test eax, eax
je 0x1001a119
mov ecx, dword [ebp - 0x10]
lea eax, [ebp - 4]
push eax
push ecx
push dword [ebp - 0x14]
mov dword [ebp - 4], ecx
push dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x10025427
Capabilities:
Get disk information

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x210
mov eax, dword [0x10054068]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
push 0x10047288
push esi
call fcn.10032fff
pop ecx
pop ecx
test eax, eax
jne 0x10025455
xor al, al
jmp 0x100254d2
push ebx
lea eax, [ebp - 0x210]
xor ebx, ebx
push eax
push 0x104
lea eax, [ebp - 0x20c]
mov dword [ebp - 0x210], ebx
push esi
push eax
call fcn.10025168
mov edx, eax
add esp, 0x10
test edx, edx
jne 0x1002548f
push dword [ebp - 0x210]
call fcn.100268ab
xor al, al
jmp 0x100254d0
mov ecx, edx
push edi
lea edi, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, bx
jne 0x10025495
sub ecx, edi
sar ecx, 1
pop edi
cmp ecx, 3
je 0x100254b5
push edx
call fcn.1002535e
pop ecx
test al, al
je 0x10025480
push esi
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
cmp eax, 1
jbe 0x100254c3
mov bl, 1
push dword [ebp - 0x210]
call fcn.100268ab
mov al, bl
pop ecx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.1001affa
leave
ret

Function at 0x1002d306
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x1002d345
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x1002d345
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x1002d345
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x1002d345
cmp dword [ecx + 0x74], 0xe
jbe 0x1002d345
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret