joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10100eb0
Capabilities:
Hash data using fnv

Disassembly:
sub esp, 8
push ebx
push ebp
mov ebp, dword [esp + 0x18]
push esi
mov esi, ecx
push edi
mov ebx, dword [ebp]
add ebx, 8
movzx eax, bl
xor eax, 0x811c9dc5
imul edx, eax, 0x1000193
mov eax, ebx
shr eax, 8
movzx eax, al
xor edx, eax
mov eax, ebx
shr eax, 0x10
imul ecx, edx, 0x1000193
movzx eax, al
shr ebx, 0x18
xor ecx, eax
imul eax, ecx, 0x1000193
mov ecx, esi
xor eax, ebx
imul edi, eax, 0x1000193
lea eax, [esp + 0x10]
push edi
push ebp
push eax
call fcn.100edcf0
mov edx, dword [esp + 0x14]
test edx, edx
je 0x10100f27
mov eax, dword [esp + 0x1c]
xor cl, cl
mov dword [eax], edx
mov byte [eax + 4], cl
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret 0xc
cmp dword [esi + 8], 0xfffffff
je 0x10100fd5
push 0x10
call fcn.1017d6f1
mov dword [esp + 0x24], eax
add esp, 4
vxorps xmm0, xmm0, xmm0
lea ebx, [eax + 8]
mov eax, dword [ebp]
mov dword [ebx], eax
mov eax, dword [esp + 0x24]
mov al, byte [eax]
mov byte [ebx + 4], al
mov eax, dword [esi + 8]
inc eax
vcvtsi2sd xmm0, xmm0, eax
shr eax, 0x1f
vaddsd xmm0, xmm0, qword [eax*8 + 0x10229440]
mov eax, dword [esi + 0x1c]
vcvtsd2ss xmm1, xmm0, xmm0
vxorps xmm0, xmm0, xmm0
vcvtsi2sd xmm0, xmm0, eax
shr eax, 0x1f
vaddsd xmm0, xmm0, qword [eax*8 + 0x10229440]
vcvtsd2ss xmm0, xmm0, xmm0
vdivss xmm0, xmm1, xmm0
vcomiss xmm0, dword [esi]
jbe 0x10100fad
mov ecx, esi
call fcn.10100870
push edi
push ebx
lea eax, [esp + 0x18]
mov ecx, esi
push eax
call fcn.100edcf0
mov ecx, dword [eax]
jmp 0x10100fb1
mov ecx, dword [esp + 0x10]
push dword [esp + 0x20]
push ecx
push edi
mov ecx, esi
call fcn.1001cc90
pop edi
mov edx, eax
mov cl, 1
mov eax, dword [esp + 0x18]
pop esi
pop ebp
pop ebx
mov dword [eax], edx
mov byte [eax + 4], cl
add esp, 8
ret 0xc
push str.unordered_map_set_too_long
call fcn.1017aed4
int3
Function at 0x10101320
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0xc
push ebx
mov ebx, dword [ebp + 0xc]
mov edx, ebx
push esi
push edi
cmp dword [ebx + 0x14], 0xf
mov edi, dword [ebx + 0x10]
jbe 0x1010133c
mov edx, dword [ebx]
xor ecx, ecx
mov esi, 0x811c9dc5
test edi, edi
je 0x10101358
movzx eax, byte [edx + ecx]
inc ecx
xor eax, esi
imul esi, eax, 0x1000193
cmp ecx, edi
jb 0x10101347
push esi
push ebx
lea eax, [esp + 0x18]
push eax
call fcn.101024c0
mov ecx, dword [esp + 0x14]
test ecx, ecx
je 0x1010137e
mov eax, dword [ebp + 8]
mov dword [eax], ecx
mov byte [eax + 4], 0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
cmp dword [0x1075a5c8], 0x6666666
je 0x10101515
push 0x28
call fcn.1017d6f1
mov edi, eax
add esp, 4
vpxor xmm0, xmm0, xmm0
vmovdqu xmmword [edi + 8], xmm0
mov dword [edi + 0x18], 0
mov dword [edi + 0x1c], 0
vmovdqu xmm0, xmmword [ebx]
vmovdqu xmmword [edi + 8], xmm0
vmovq xmm0, qword [ebx + 0x10]
vmovq qword [edi + 0x18], xmm0
mov dword [ebx + 0x10], 0
vpxor xmm0, xmm0, xmm0
mov dword [ebx + 0x14], 0xf
mov byte [ebx], 0
vmovq qword [edi + 0x20], xmm0
mov dword [edi + 0x24], 0
mov edx, dword [0x1075a5c8]
mov ebx, dword [0x1075a5dc]
vmovss xmm1, dword [0x1075a5c0]
vxorps xmm0, xmm0, xmm0
lea eax, [edx + 1]
vcvtsi2sd xmm0, xmm0, eax
shr eax, 0x1f
vaddsd xmm0, xmm0, qword [eax*8 + 0x10229440]
vcvtsd2ss xmm2, xmm0, xmm0
vxorps xmm0, xmm0, xmm0
mov eax, ebx
shr eax, 0x1f
vcvtsi2sd xmm0, xmm0, ebx
vaddsd xmm0, xmm0, qword [eax*8 + 0x10229440]
vcvtsd2ss xmm0, xmm0, xmm0
vdivss xmm0, xmm2, xmm0
vcomiss xmm0, xmm1
jbe 0x101014ad
vdivss xmm0, xmm2, xmm1
vmovss dword [esp + 0x10], xmm0
fld dword [esp + 0x10]
fstp qword [esp + 0x10]
vxorpd xmm0, xmm0, xmm0
vroundsd xmm0, xmm0, qword [esp + 0x10], 2
vmovsd qword [esp + 0x10], xmm0
fld qword [esp + 0x10]
fstp dword [esp + 0x10]
vmovss xmm0, dword [esp + 0x10]
call fcn.101a4a40
mov ecx, 8
cmp eax, ecx
cmova ecx, eax
cmp ebx, ecx
jae 0x1010148e
cmp ebx, 0x200
jae 0x1010148c
shl ebx, 3
cmp ebx, ecx
jae 0x1010148e
mov ebx, ecx
push ebx
call fcn.10101560
push esi
lea eax, [edi + 8]
push eax
lea eax, [esp + 0x18]
push eax
call fcn.101024c0
mov edx, dword [0x1075a5c8]
mov ecx, dword [eax]
jmp 0x101014b1
mov ecx, dword [esp + 0x10]
mov ebx, dword [ecx + 4]
inc edx
mov dword [0x1075a5c8], edx
mov dword [edi], ecx
mov dword [edi + 4], ebx
mov dword [ebx], edi
mov dword [ecx + 4], edi
and esi, dword [0x1075a5d8]
mov eax, dword [0x1075a5cc]
mov edx, dword [eax + esi*8]
cmp edx, dword [0x1075a5c4]
jne 0x101014e0
mov dword [eax + esi*8], edi
jmp 0x101014ff
cmp edx, ecx
jne 0x101014f9
mov dword [eax + esi*8], edi
mov eax, dword [ebp + 8]
mov dword [eax], edi
mov byte [eax + 4], 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
cmp dword [eax + esi*8 + 4], ebx
jne 0x10101503
mov dword [eax + esi*8 + 4], edi
mov eax, dword [ebp + 8]
mov dword [eax], edi
pop edi
pop esi
mov byte [eax + 4], 1
pop ebx
mov esp, ebp
pop ebp
ret 8
push str.unordered_map_set_too_long
call fcn.1017aed4
int3
Function at 0x101017b0
Capabilities:
Hash data using fnv

Disassembly:
sub esp, 8
mov eax, dword [esp + 0x10]
push ebx
push ebp
push esi
mov ebx, dword [eax]
add ebx, 8
movzx eax, bl
xor eax, 0x811c9dc5
imul edx, eax, 0x1000193
mov eax, ebx
shr eax, 8
movzx eax, al
push edi
mov edi, ecx
xor edx, eax
mov eax, ebx
shr eax, 0x10
imul ecx, edx, 0x1000193
movzx eax, al
shr ebx, 0x18
xor ecx, eax
imul eax, ecx, 0x1000193
mov ecx, edi
xor eax, ebx
mov ebx, dword [esp + 0x20]
imul ebp, eax, 0x1000193
lea eax, [esp + 0x10]
push ebp
push ebx
push eax
call fcn.100edcf0
mov ecx, dword [esp + 0x14]
test ecx, ecx
je 0x10101829
mov eax, dword [esp + 0x1c]
mov dword [eax], ecx
mov byte [eax + 4], 0
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret 0xc
cmp dword [edi + 8], 0xaaaaaaa
je 0x10101972
push 0x18
call fcn.1017d6f1
mov ecx, dword [ebx]
mov esi, eax
vxorps xmm0, xmm0, xmm0
add esp, 4
mov dword [esi + 8], ecx
mov ecx, dword [esp + 0x24]
mov edx, dword [ecx]
mov ecx, dword [ecx + 4]
mov dword [esi + 0x10], edx
mov dword [esi + 0x14], ecx
mov eax, dword [edi + 8]
mov ebx, dword [edi + 0x1c]
inc eax
vmovss xmm1, dword [edi]
vcvtsi2sd xmm0, xmm0, eax
shr eax, 0x1f
vaddsd xmm0, xmm0, qword [eax*8 + 0x10229440]
vcvtsd2ss xmm2, xmm0, xmm0
vxorps xmm0, xmm0, xmm0
mov eax, ebx
shr eax, 0x1f
vcvtsi2sd xmm0, xmm0, ebx
vaddsd xmm0, xmm0, qword [eax*8 + 0x10229440]
vcvtsd2ss xmm0, xmm0, xmm0
vdivss xmm0, xmm2, xmm0
vcomiss xmm0, xmm1
jbe 0x10101910
vdivss xmm0, xmm2, xmm1
vmovss dword [esp + 0x20], xmm0
fld dword [esp + 0x20]
fstp qword [esp + 0x10]
vxorpd xmm0, xmm0, xmm0
vroundsd xmm0, xmm0, qword [esp + 0x10], 2
vmovsd qword [esp + 0x10], xmm0
fld qword [esp + 0x10]
fstp dword [esp + 0x20]
vmovss xmm0, dword [esp + 0x20]
call fcn.101a4a40
mov ecx, 8
cmp eax, ecx
cmova ecx, eax
cmp ebx, ecx
jae 0x101018f3
cmp ebx, 0x200
jae 0x101018f1
shl ebx, 3
cmp ebx, ecx
jae 0x101018f3
mov ebx, ecx
push ebx
mov ecx, edi
call fcn.10100a20
push ebp
lea eax, [esi + 8]
mov ecx, edi
push eax
lea eax, [esp + 0x18]
push eax
call fcn.100edcf0
mov edx, dword [eax]
jmp 0x10101914
mov edx, dword [esp + 0x10]
mov ebx, dword [edx + 4]
inc dword [edi + 8]
mov dword [esi], edx
mov dword [esi + 4], ebx
mov dword [ebx], esi
mov dword [edx + 4], esi
mov eax, dword [edi + 0x18]
mov ecx, dword [edi + 0xc]
and eax, ebp
mov ebp, dword [ecx + eax*8]
cmp ebp, dword [edi + 4]
jne 0x10101939
mov dword [ecx + eax*8], esi
jmp 0x1010195a
cmp ebp, edx
jne 0x10101954
mov dword [ecx + eax*8], esi
mov eax, dword [esp + 0x1c]
mov dword [eax], esi
mov byte [eax + 4], 1
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret 0xc
cmp dword [ecx + eax*8 + 4], ebx
jne 0x1010195e
mov dword [ecx + eax*8 + 4], esi
mov eax, dword [esp + 0x1c]
pop edi
mov dword [eax], esi
pop esi
pop ebp
mov byte [eax + 4], 1
pop ebx
add esp, 8
ret 0xc
push str.unordered_map_set_too_long
call fcn.1017aed4
int3
Function at 0x10101980
Capabilities:
Hash data using fnv

Disassembly:
sub esp, 8
mov eax, dword [esp + 0x10]
push ebx
push ebp
push esi
mov ebx, dword [eax]
add ebx, 8
movzx eax, bl
xor eax, 0x811c9dc5
imul edx, eax, 0x1000193
mov eax, ebx
shr eax, 8
movzx eax, al
push edi
mov edi, ecx
xor edx, eax
mov eax, ebx
shr eax, 0x10
imul ecx, edx, 0x1000193
movzx eax, al
shr ebx, 0x18
xor ecx, eax
imul eax, ecx, 0x1000193
mov ecx, edi
xor eax, ebx
mov ebx, dword [esp + 0x20]
imul ebp, eax, 0x1000193
lea eax, [esp + 0x10]
push ebp
push ebx
push eax
call fcn.100edcf0
mov ecx, dword [esp + 0x14]
test ecx, ecx
je 0x101019f9
mov eax, dword [esp + 0x1c]
mov dword [eax], ecx
mov byte [eax + 4], 0
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret 0xc
cmp dword [edi + 8], 0xfffffff
je 0x10101b3c
push 0x10
call fcn.1017d6f1
mov ecx, dword [ebx]
mov esi, eax
vxorps xmm0, xmm0, xmm0
add esp, 4
mov dword [esi + 8], ecx
mov ecx, dword [esp + 0x24]
mov ecx, dword [ecx]
mov dword [esi + 0xc], ecx
mov eax, dword [edi + 8]
mov ebx, dword [edi + 0x1c]
inc eax
vmovss xmm1, dword [edi]
vcvtsi2sd xmm0, xmm0, eax
shr eax, 0x1f
vaddsd xmm0, xmm0, qword [eax*8 + 0x10229440]
vcvtsd2ss xmm2, xmm0, xmm0
vxorps xmm0, xmm0, xmm0
mov eax, ebx
shr eax, 0x1f
vcvtsi2sd xmm0, xmm0, ebx
vaddsd xmm0, xmm0, qword [eax*8 + 0x10229440]
vcvtsd2ss xmm0, xmm0, xmm0
vdivss xmm0, xmm2, xmm0
vcomiss xmm0, xmm1
jbe 0x10101ada
vdivss xmm0, xmm2, xmm1
vmovss dword [esp + 0x20], xmm0
fld dword [esp + 0x20]
fstp qword [esp + 0x10]
vxorpd xmm0, xmm0, xmm0
vroundsd xmm0, xmm0, qword [esp + 0x10], 2
vmovsd qword [esp + 0x10], xmm0
fld qword [esp + 0x10]
fstp dword [esp + 0x20]
vmovss xmm0, dword [esp + 0x20]
call fcn.101a4a40
mov ecx, 8
cmp eax, ecx
cmova ecx, eax
cmp ebx, ecx
jae 0x10101abd
cmp ebx, 0x200
jae 0x10101abb
shl ebx, 3
cmp ebx, ecx
jae 0x10101abd
mov ebx, ecx
push ebx
mov ecx, edi
call fcn.10100a20
push ebp
lea eax, [esi + 8]
mov ecx, edi
push eax
lea eax, [esp + 0x18]
push eax
call fcn.100edcf0
mov edx, dword [eax]
jmp 0x10101ade
mov edx, dword [esp + 0x10]
mov ebx, dword [edx + 4]
inc dword [edi + 8]
mov dword [esi], edx
mov dword [esi + 4], ebx
mov dword [ebx], esi
mov dword [edx + 4], esi
mov eax, dword [edi + 0x18]
mov ecx, dword [edi + 0xc]
and eax, ebp
mov ebp, dword [ecx + eax*8]
cmp ebp, dword [edi + 4]
jne 0x10101b03
mov dword [ecx + eax*8], esi
jmp 0x10101b24
cmp ebp, edx
jne 0x10101b1e
mov dword [ecx + eax*8], esi
mov eax, dword [esp + 0x1c]
mov dword [eax], esi
mov byte [eax + 4], 1
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret 0xc
cmp dword [ecx + eax*8 + 4], ebx
jne 0x10101b28
mov dword [ecx + eax*8 + 4], esi
mov eax, dword [esp + 0x1c]
pop edi
mov dword [eax], esi
pop esi
pop ebp
mov byte [eax + 4], 1
pop ebx
add esp, 8
ret 0xc
push str.unordered_map_set_too_long
call fcn.1017aed4
int3
Function at 0x1010bb60
Capabilities:
Hash data using fnv

Disassembly:
sub esp, 8
push ebx
mov ebx, dword [esp + 0x14]
push ebp
push esi
push edi
movzx eax, byte [ebx]
mov edi, ecx
xor eax, 0x811c9dc5
imul edx, eax, 0x1000193
movzx eax, byte [ebx + 1]
xor edx, eax
movzx eax, byte [ebx + 2]
imul edx, edx, 0x1000193
xor edx, eax
movzx eax, byte [ebx + 3]
imul ecx, edx, 0x1000193
xor ecx, eax
lea eax, [esp + 0x10]
imul ebp, ecx, 0x1000193
mov ecx, edi
push ebp
push ebx
push eax
call fcn.100edcf0
mov ecx, dword [esp + 0x14]
test ecx, ecx
je 0x1010bbc9
mov eax, dword [esp + 0x1c]
mov dword [eax], ecx
mov byte [eax + 4], 0
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret 0xc
cmp dword [edi + 8], 0xfffffff
je 0x1010bd0c
push 0x10
call fcn.1017d6f1
mov ecx, dword [ebx]
mov esi, eax
vxorps xmm0, xmm0, xmm0
add esp, 4
mov dword [esi + 8], ecx
mov ecx, dword [esp + 0x24]
mov ecx, dword [ecx]
mov dword [esi + 0xc], ecx
mov eax, dword [edi + 8]
mov ebx, dword [edi + 0x1c]
inc eax
vmovss xmm1, dword [edi]
vcvtsi2sd xmm0, xmm0, eax
shr eax, 0x1f
vaddsd xmm0, xmm0, qword [eax*8 + 0x10229440]
vcvtsd2ss xmm2, xmm0, xmm0
vxorps xmm0, xmm0, xmm0
mov eax, ebx
shr eax, 0x1f
vcvtsi2sd xmm0, xmm0, ebx
vaddsd xmm0, xmm0, qword [eax*8 + 0x10229440]
vcvtsd2ss xmm0, xmm0, xmm0
vdivss xmm0, xmm2, xmm0
vcomiss xmm0, xmm1
jbe 0x1010bcaa
vdivss xmm0, xmm2, xmm1
vmovss dword [esp + 0x20], xmm0
fld dword [esp + 0x20]
fstp qword [esp + 0x10]
vxorpd xmm0, xmm0, xmm0
vroundsd xmm0, xmm0, qword [esp + 0x10], 2
vmovsd qword [esp + 0x10], xmm0
fld qword [esp + 0x10]
fstp dword [esp + 0x20]
vmovss xmm0, dword [esp + 0x20]
call fcn.101a4a40
mov ecx, 8
cmp eax, ecx
cmova ecx, eax
cmp ebx, ecx
jae 0x1010bc8d
cmp ebx, 0x200
jae 0x1010bc8b
shl ebx, 3
cmp ebx, ecx
jae 0x1010bc8d
mov ebx, ecx
push ebx
mov ecx, edi
call fcn.1010bd20
push ebp
lea eax, [esi + 8]
mov ecx, edi
push eax
lea eax, [esp + 0x18]
push eax
call fcn.100edcf0
mov edx, dword [eax]
jmp 0x1010bcae
mov edx, dword [esp + 0x10]
mov ebx, dword [edx + 4]
inc dword [edi + 8]
mov dword [esi], edx
mov dword [esi + 4], ebx
mov dword [ebx], esi
mov dword [edx + 4], esi
mov eax, dword [edi + 0x18]
mov ecx, dword [edi + 0xc]
and eax, ebp
mov ebp, dword [ecx + eax*8]
cmp ebp, dword [edi + 4]
jne 0x1010bcd3
mov dword [ecx + eax*8], esi
jmp 0x1010bcf4
cmp ebp, edx
jne 0x1010bcee
mov dword [ecx + eax*8], esi
mov eax, dword [esp + 0x1c]
mov dword [eax], esi
mov byte [eax + 4], 1
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret 0xc
cmp dword [ecx + eax*8 + 4], ebx
jne 0x1010bcf8
mov dword [ecx + eax*8 + 4], esi
mov eax, dword [esp + 0x1c]
pop edi
mov dword [eax], esi
pop esi
pop ebp
mov byte [eax + 4], 1
pop ebx
add esp, 8
ret 0xc
push str.unordered_map_set_too_long
call fcn.1017aed4
int3
Function at 0x1010f920
Capabilities:
Hash data using fnv

Disassembly:
sub esp, 8
push ebx
mov ebx, dword [esp + 0x14]
push ebp
push esi
push edi
movzx eax, byte [ebx]
mov edi, ecx
xor eax, 0x811c9dc5
imul edx, eax, 0x1000193
movzx eax, byte [ebx + 1]
xor edx, eax
lea eax, [esp + 0x10]
imul ebp, edx, 0x1000193
push ebp
push ebx
push eax
call fcn.100dee00
mov ecx, dword [esp + 0x14]
test ecx, ecx
je 0x1010f96f
mov eax, dword [esp + 0x1c]
mov dword [eax], ecx
mov byte [eax + 4], 0
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret 0xc
cmp dword [edi + 8], 0x9249249
je 0x1010fab8
push 0x1c
call fcn.1017d6f1
mov cx, word [ebx]
mov esi, eax
add esp, 4
mov word [esi + 8], cx
mov ecx, dword [esp + 0x24]
vmovdqu xmm0, xmmword [ecx]
vmovdqu xmmword [esi + 0xc], xmm0
mov eax, dword [edi + 8]
mov ebx, dword [edi + 0x1c]
inc eax
vmovss xmm1, dword [edi]
vxorps xmm0, xmm0, xmm0
vcvtsi2sd xmm0, xmm0, eax
shr eax, 0x1f
vaddsd xmm0, xmm0, qword [eax*8 + 0x10229440]
vcvtsd2ss xmm2, xmm0, xmm0
vxorps xmm0, xmm0, xmm0
mov eax, ebx
shr eax, 0x1f
vcvtsi2sd xmm0, xmm0, ebx
vaddsd xmm0, xmm0, qword [eax*8 + 0x10229440]
vcvtsd2ss xmm0, xmm0, xmm0
vdivss xmm0, xmm2, xmm0
vcomiss xmm0, xmm1
jbe 0x1010fa56
vdivss xmm0, xmm2, xmm1
vmovss dword [esp + 0x20], xmm0
fld dword [esp + 0x20]
fstp qword [esp + 0x10]
vxorpd xmm0, xmm0, xmm0
vroundsd xmm0, xmm0, qword [esp + 0x10], 2
vmovsd qword [esp + 0x10], xmm0
fld qword [esp + 0x10]
fstp dword [esp + 0x20]
vmovss xmm0, dword [esp + 0x20]
call fcn.101a4a40
mov ecx, 8
cmp eax, ecx
cmova ecx, eax
cmp ebx, ecx
jae 0x1010fa39
cmp ebx, 0x200
jae 0x1010fa37
shl ebx, 3
cmp ebx, ecx
jae 0x1010fa39
mov ebx, ecx
push ebx
mov ecx, edi
call fcn.100decb0
push ebp
lea eax, [esi + 8]
mov ecx, edi
push eax
lea eax, [esp + 0x18]
push eax
call fcn.100dee00
mov edx, dword [eax]
jmp 0x1010fa5a
mov edx, dword [esp + 0x10]
mov ebx, dword [edx + 4]
inc dword [edi + 8]
mov dword [esi], edx
mov dword [esi + 4], ebx
mov dword [ebx], esi
mov dword [edx + 4], esi
mov eax, dword [edi + 0x18]
mov ecx, dword [edi + 0xc]
and eax, ebp
mov ebp, dword [ecx + eax*8]
cmp ebp, dword [edi + 4]
jne 0x1010fa7f
mov dword [ecx + eax*8], esi
jmp 0x1010faa0
cmp ebp, edx
jne 0x1010fa9a
mov dword [ecx + eax*8], esi
mov eax, dword [esp + 0x1c]
mov dword [eax], esi
mov byte [eax + 4], 1
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret 0xc
cmp dword [ecx + eax*8 + 4], ebx
jne 0x1010faa4
mov dword [ecx + eax*8 + 4], esi
mov eax, dword [esp + 0x1c]
pop edi
mov dword [eax], esi
pop esi
pop ebp
mov byte [eax + 4], 1
pop ebx
add esp, 8
ret 0xc
push str.unordered_map_set_too_long
call fcn.1017aed4
int3
Function at 0x101104b0
Capabilities:
Enumerate threads
Suspend thread

Disassembly:
sub esp, 0x20
push ebx
push ebp
push esi
mov esi, ecx
mov dword [esp + 0xc], edx
push edi
xor ebx, ebx
push ebx
push 4
mov dword [esi], 0
mov dword [esi + 4], 0
mov dword [esi + 8], 0
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov edi, eax
cmp edi, 0xffffffff
je 0x10110621
lea eax, [esp + 0x14]
mov dword [esp + 0x14], 0x1c
push eax
push edi
call dword [sym.imp.KERNEL32.dll_Thread32First]
test eax, eax
je 0x101105c8
mov ebp, dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov ebx, 1
nop
cmp dword [esp + 0x14], 0x10
jb 0x10110589
call ebp
cmp dword [esp + 0x20], eax
jne 0x10110589
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp dword [esp + 0x1c], eax
je 0x10110589
mov edx, dword [esi]
test edx, edx
jne 0x10110554
push 0x200
push edx
push dword [0x106474f4]
mov dword [esi + 4], 0x80
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov edx, eax
mov dword [esi], edx
test edx, edx
je 0x101105b0
jmp 0x1011057c
mov eax, dword [esi + 4]
cmp dword [esi + 8], eax
jb 0x1011057c
add eax, eax
mov dword [esi + 4], eax
shl eax, 2
push eax
push edx
push 0
push dword [0x106474f4]
call dword [sym.imp.KERNEL32.dll_HeapReAlloc]
mov edx, eax
test edx, edx
je 0x101105b0
mov dword [esi], edx
mov ecx, dword [esi + 8]
mov eax, dword [esp + 0x1c]
mov dword [edx + ecx*4], eax
inc dword [esi + 8]
lea eax, [esp + 0x14]
mov dword [esp + 0x14], 0x1c
push eax
push edi
call dword [sym.imp.KERNEL32.dll_Thread32Next]
test eax, eax
jne 0x10110510
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x12
je 0x101105c8
mov eax, dword [esi]
xor ebx, ebx
test eax, eax
je 0x101105c8
push eax
push ebx
push dword [0x106474f4]
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov dword [esi], ebx
mov ebp, dword [sym.imp.KERNEL32.dll_CloseHandle]
push edi
call ebp
test ebx, ebx
je 0x10110621
cmp dword [esi], 0
je 0x10110615
xor edi, edi
cmp dword [esi + 8], edi
jbe 0x10110615
mov eax, dword [esi]
push dword [eax + edi*4]
push 0
push 0x5a
call dword [sym.imp.KERNEL32.dll_OpenThread]
mov ebx, eax
test ebx, ebx
je 0x1011060f
push ebx
call dword [sym.imp.KERNEL32.dll_SuspendThread]
push dword [esp + 0x34]
mov edx, dword [esp + 0x14]
mov ecx, ebx
call fcn.10110350
push ebx
call ebp
inc edi
cmp edi, dword [esi + 8]
jb 0x101105e1
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x20
ret 4
pop edi
pop esi
pop ebp
mov eax, 9
pop ebx
add esp, 0x20
ret 4

Function at 0x10110630
Capabilities:
Resume thread

Disassembly:
push ebx
mov ebx, ecx
cmp dword [ebx], 0
je 0x10110680
push esi
xor esi, esi
cmp dword [ebx + 8], esi
jbe 0x1011066f
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_ResumeThread]
push edi
mov eax, dword [ebx]
push dword [eax + esi*4]
push 0
push 0x5a
call dword [sym.imp.KERNEL32.dll_OpenThread]
mov edi, eax
test edi, edi
je 0x10110667
push edi
call ebp
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
inc esi
cmp esi, dword [ebx + 8]
jb 0x10110648
pop edi
pop ebp
push dword [ebx]
push 0
push dword [0x106474f4]
call dword [sym.imp.KERNEL32.dll_HeapFree]
pop esi
pop ebx
ret
Function at 0x10110690
Capabilities:
Allocate or change rwx memory

Disassembly:
push ecx
push ebx
push ebp
push esi
imul esi, ecx, 0x2c
mov ebx, edx
push edi
add esi, dword [0x1075abc0]
mov eax, dword [esi]
mov cl, byte [esi + 0x14]
and cl, 1
lea edi, [eax - 5]
cmove edi, eax
movzx eax, cl
lea ebp, [eax*2 + 5]
lea eax, [esp + 0x10]
push eax
push 0x40
push ebp
push edi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x101106d6
pop edi
pop esi
pop ebp
mov eax, 0xa
pop ebx
pop ecx
ret
test ebx, ebx
je 0x101106f7
mov byte [edi], 0xe9
mov eax, dword [esi + 4]
sub eax, edi
sub eax, 5
mov dword [edi + 1], eax
test byte [esi + 0x14], 1
je 0x10110718
mov eax, dword [esi]
mov word [eax], 0xf9eb
jmp 0x10110718
mov eax, dword [esi + 0xc]
test byte [esi + 0x14], 1
mov dword [edi], eax
je 0x10110712
mov ax, word [esi + 0x10]
mov word [edi + 4], ax
mov al, byte [esi + 0x12]
mov byte [edi + 6], al
jmp 0x10110718
mov al, byte [esi + 0x10]
mov byte [edi + 4], al
lea eax, [esp + 0x10]
push eax
push dword [esp + 0x14]
push ebp
push edi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
push ebp
push edi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_FlushInstructionCache]
mov cl, bl
shl bl, 2
add cl, cl
xor cl, byte [esi + 0x14]
and cl, 2
xor cl, byte [esi + 0x14]
xor bl, cl
and bl, 4
xor bl, cl
xor eax, eax
pop edi
mov byte [esi + 0x14], bl
pop esi
pop ebp
pop ebx
pop ecx
ret
Function at 0x10111d30
Capabilities:
Hide graphical window

Disassembly:
sub esp, 0x330
push esi
push dword [esp + 0x340]
mov esi, dword [esp + 0x340]
push esi
push dword [esp + 0x340]
call fcn.1017da66
test eax, eax
jne 0x10111d60
pop esi
add esp, 0x330
ret 0xc
cmp esi, 1
jne 0x10111e08
push str..utf8
push 2
call fcn.1018ee74
add esp, 8
push 0
push str.Valve001
call dword [sym.imp.USER32.dll_FindWindowW]
mov esi, eax
mov dword [esp + 4], 0x14
lea eax, [esp + 4]
mov dword [esp + 8], esi
push eax
mov dword [esp + 0x10], 0xe
mov dword [esp + 0x14], 0
mov dword [esp + 0x18], 0
call dword [sym.imp.USER32.dll_FlashWindowEx]
push 9
push esi
call dword [sym.imp.USER32.dll_ShowWindow]
push dword [esp + 0x338]
lea ecx, [esp + 0x1c]
call fcn.10139f30
cmp byte [0x10639d3c], 0
je 0x10111de9
mov ecx, 0x10639a20
call fcn.1008b8e0
mov byte [0x10639d3c], 0
lea eax, [esp + 0x18]
mov ecx, 0x10639a20
push eax
call fcn.10111e20
lea ecx, [esp + 0x18]
mov byte [0x10639d3c], 1
call fcn.1008b8e0
mov eax, 1
pop esi
add esp, 0x330
ret 0xc
Function at 0x10113b50
Capabilities:
Hash data with crc32

Disassembly:
sub esp, 0xc
vxorps xmm4, xmm4, xmm4
push edi
mov edi, ecx
mov ecx, dword [0x10755f08]
vmovss xmm2, dword [ecx + 0x4c4]
vucomiss xmm2, xmm4
lahf
test ah, 0x44
jnp 0x10113bd5
vmovss xmm1, dword [ecx + 0x8c]
vcomiss xmm2, xmm1
jbe 0x10113c08
vsubss xmm0, xmm2, dword [ecx + 0x18]
vcomiss xmm0, xmm2
vmovss xmm3, dword [ecx + 0x90]
jb 0x10113b9b
xor eax, eax
jmp 0x10113bd1
vcomiss xmm4, xmm3
jb 0x10113bac
xor eax, eax
vcomiss xmm1, xmm0
seta al
jmp 0x10113bd1
vcomiss xmm1, xmm0
jbe 0x10113bb7
or ecx, 0xffffffff
jmp 0x10113bc3
vsubss xmm0, xmm0, xmm1
vdivss xmm0, xmm0, xmm3
vcvttss2si ecx, xmm0
vsubss xmm0, xmm2, xmm1
vdivss xmm0, xmm0, xmm3
vcvttss2si eax, xmm0
sub eax, ecx
test eax, eax
jle 0x10113c08
cmp byte [0x10638316], 0
je 0x10113c08
cmp byte [edi + 0x14], 0
je 0x10113c08
mov byte [edi + 0x14], 0
xor edx, edx
mov ecx, dword [0x1063c388]
push dword [0x1063c5b8]
mov eax, dword [ecx]
push dword [eax + 0x9c]
lea eax, [esp + 0xc]
push eax
call fcn.1002a9f0
mov ecx, 0x107553cc
call fcn.100ecd20
test al, al
je 0x10113cc5
mov cl, byte [edi + 0x14]
test cl, cl
sete al
mov byte [edi + 0x14], al
test cl, cl
je 0x10113c49
mov ecx, dword [0x1063c388]
xor edx, edx
push dword [0x1063c5b8]
mov eax, dword [ecx]
push dword [eax + 0x9c]
lea eax, [esp + 0xc]
push eax
call fcn.1002a9f0
push ebx
push esi
or edx, 0xffffffff
mov esi, 0x1021b361
mov al, 0x41
or ebx, 0xffffffff
cmp al, 0x23
jne 0x10113c66
cmp byte [esi], al
jne 0x10113c66
cmp byte [esi + 1], al
cmove edx, ebx
movzx ecx, dl
movzx eax, al
xor ecx, eax
shr edx, 8
mov al, byte [esi]
inc esi
xor edx, dword [ecx*4 + 0x10221b00]
test al, al
jne 0x10113c58
pop esi
not edx
pop ebx
mov ecx, edx
call fcn.10143c10
test eax, eax
je 0x10113c95
mov ecx, eax
call fcn.10148380
vmovss xmm0, dword [edi + 0x18]
vxorps xmm2, xmm2, xmm2
vcomiss xmm0, xmm2
jbe 0x10113cc0
vmovss xmm1, dword [0x10228684]
vcomiss xmm1, xmm0
jbe 0x10113cc0
vsubss xmm0, xmm1, xmm0
vmovss dword [edi + 0x18], xmm0
pop edi
add esp, 0xc
ret
vmovss dword [edi + 0x18], xmm2
pop edi
add esp, 0xc
ret