joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1003749f
Capabilities:
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, dword [ebp + 0xc]
push edi
mov eax, dword [ebx]
mov edi, dword [ebp + 0x10]
cmp edi, 7
ja case.default.0x10037386
jmp dword [edi*4 + 0x1003751c]
mov ecx, esi
and ecx, 3
sub edi, ecx
sub ecx, 1
je 0x100373c9
sub ecx, 1
je 0x100373b6
sub ecx, 1
jne 0x100373dc
movzx edx, byte [esi]
movzx ecx, al
xor edx, ecx
shr eax, 8
xor eax, dword [edx*4 + 0x100c91e0]
inc esi
movzx edx, byte [esi]
movzx ecx, al
xor edx, ecx
shr eax, 8
xor eax, dword [edx*4 + 0x100c91e0]
inc esi
movzx edx, byte [esi]
movzx ecx, al
xor edx, ecx
shr eax, 8
xor eax, dword [edx*4 + 0x100c91e0]
inc esi
mov edx, edi
sar edx, 3
test edx, edx
je 0x1003745e
xor eax, dword [esi]
movzx ecx, al
shr eax, 8
xor eax, dword [ecx*4 + 0x100c91e0]
movzx ecx, al
shr eax, 8
xor eax, dword [ecx*4 + 0x100c91e0]
movzx ecx, al
shr eax, 8
xor eax, dword [ecx*4 + 0x100c91e0]
mov ecx, eax
movzx eax, cl
shr ecx, 8
mov eax, dword [eax*4 + 0x100c91e0]
xor eax, dword [esi + 4]
add esi, 8
xor eax, ecx
movzx ecx, al
shr eax, 8
xor eax, dword [ecx*4 + 0x100c91e0]
movzx ecx, al
shr eax, 8
xor eax, dword [ecx*4 + 0x100c91e0]
movzx ecx, al
shr eax, 8
xor eax, dword [ecx*4 + 0x100c91e0]
movzx ecx, al
shr eax, 8
xor eax, dword [ecx*4 + 0x100c91e0]
sub edx, 1
jne 0x100373e5
and edi, 7
jmp 0x10037381
movzx edx, byte [esi]
movzx ecx, al
xor edx, ecx
shr eax, 8
xor eax, dword [edx*4 + 0x100c91e0]
inc esi
movzx edx, byte [esi]
movzx ecx, al
xor edx, ecx
shr eax, 8
xor eax, dword [edx*4 + 0x100c91e0]
inc esi
movzx edx, byte [esi]
movzx ecx, al
xor edx, ecx
shr eax, 8
xor eax, dword [edx*4 + 0x100c91e0]
inc esi
xor eax, dword [esi]
movzx ecx, al
shr eax, 8
pop edi
pop esi
xor eax, dword [ecx*4 + 0x100c91e0]
movzx ecx, al
shr eax, 8
xor eax, dword [ecx*4 + 0x100c91e0]
movzx ecx, al
shr eax, 8
xor eax, dword [ecx*4 + 0x100c91e0]
movzx ecx, al
shr eax, 8
xor eax, dword [ecx*4 + 0x100c91e0]
mov dword [ebx], eax
pop ebx
pop ebp
ret
movzx edx, byte [esi]
movzx ecx, al
xor edx, ecx
shr eax, 8
xor eax, dword [edx*4 + 0x100c91e0]
inc esi
movzx edx, byte [esi]
movzx ecx, al
xor edx, ecx
shr eax, 8
xor eax, dword [edx*4 + 0x100c91e0]
inc esi
movzx edx, byte [esi]
movzx ecx, al
xor edx, ecx
shr eax, 8
xor eax, dword [edx*4 + 0x100c91e0]
pop edi
pop esi
mov dword [ebx], eax
pop ebx
pop ebp
ret
Function at 0x10039390
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
cmp byte [0x10121078], 0
push ebx
push esi
push edi
je 0x10039548
mov ecx, dword [0x1012b17c]
mov eax, dword [ecx]
mov eax, dword [eax + 0x68]
call eax
test al, al
je 0x10039548
mov esi, dword [0x1012b200]
xor ebx, ebx
mov dword [ebp - 4], esi
mov eax, dword [esi + 0x28]
mov dword [ebp - 8], eax
test eax, eax
je 0x10039548
mov eax, dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__wassert]
cmp ebx, dword [esi + 0x28]
jl 0x100393f7
push 0x410
push str.C:UsersSDesktoppedo_hookutlvector.h
push str.i___m_Size
call eax
mov eax, dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__wassert]
add esp, 0xc
cmp dword [esi + 0x24], 0xfffffffe
jne 0x10039411
push 0x272
push str.C:UsersSDesktoppedo_hookutlvector.h
push str._IsReadOnly__
call eax
add esp, 0xc
mov eax, dword [esi + 0x1c]
mov ecx, dword [eax + ebx*4]
mov eax, dword [ecx]
mov eax, dword [eax + 0x30]
call eax
mov esi, eax
mov edi, 0x811c9dc5
xor ecx, ecx
inc ecx
cmp byte [esi + ecx], 0
jne 0x10039427
xor edx, edx
test ecx, ecx
je 0x1003944d
movsx eax, byte [esi + edx]
inc edx
xor eax, edi
imul edi, eax, 0x1000193
cmp edx, ecx
jb 0x10039434
cmp edi, 0x5ff56dc5
je 0x1003945f
inc ebx
cmp ebx, dword [ebp - 8]
jae 0x10039548
mov esi, dword [ebp - 4]
jmp 0x100393d4
mov edi, dword [ebp - 4]
mov esi, dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__wassert]
cmp ebx, dword [edi + 0x28]
jl 0x10039481
push 0x410
push str.C:UsersSDesktoppedo_hookutlvector.h
push str.i___m_Size
call esi
add esp, 0xc
cmp dword [edi + 0x24], 0xfffffffe
jne 0x1003949b
push 0x272
push str.C:UsersSDesktoppedo_hookutlvector.h
push str._IsReadOnly__
call esi
add esp, 0xc
mov eax, dword [edi + 0x1c]
mov edi, dword [eax + ebx*4]
test edi, edi
je 0x10039548
mov eax, dword [edi + 0x88]
mov dword [ebp - 8], eax
test eax, eax
je 0x10039548
xor esi, esi
test eax, eax
jle 0x10039548
xor edx, edx
mov dword [ebp - 4], edx
nop dword [eax]
mov ebx, dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__wassert]
cmp esi, dword [edi + 0x88]
jl 0x100394f5
push 0x410
push str.C:UsersSDesktoppedo_hookutlvector.h
push str.i___m_Size
call ebx
mov edx, dword [ebp - 4]
add esp, 0xc
cmp dword [edi + 0x84], 0xfffffffe
jne 0x10039515
push 0x272
push str.C:UsersSDesktoppedo_hookutlvector.h
push str._IsReadOnly__
call ebx
mov edx, dword [ebp - 4]
add esp, 0xc
mov ecx, dword [edi + 0x7c]
movss xmm0, dword [ecx + edx + 0x418]
ucomiss xmm0, dword [0x100c96cc]
lahf
test ah, 0x44
jp 0x10039539
mov dword [ecx + edx + 0x418], 0x7f7fffff
inc esi
add edx, 0x420
mov dword [ebp - 4], edx
cmp esi, dword [ebp - 8]
jl 0x100394d0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10039790
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100bcdb5
mov eax, dword fs:[0]
push eax
sub esp, 0x2c
push ebx
push esi
push edi
mov eax, dword [0x10122c00]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x1c], ecx
call fcn.1003b9e0
mov ecx, dword [0x1012b174]
test ecx, ecx
je 0x10039946
mov eax, dword [ecx]
mov eax, dword [eax + 0x20]
call eax
mov edi, eax
test edi, edi
je 0x10039946
nop
mov eax, dword [edi + 0x14]
mov ebx, 0x811c9dc5
mov esi, dword [edi + 8]
xor ecx, ecx
mov dword [ebp - 0x28], eax
inc ecx
cmp byte [esi + ecx], 0
jne 0x100397f0
xor edx, edx
test ecx, ecx
je 0x10039811
nop dword [eax]
movsx eax, byte [esi + edx]
inc edx
xor eax, ebx
imul ebx, eax, 0x1000193
cmp edx, ecx
jb 0x10039800
movzx eax, bl
xor eax, 0x811c9dc5
mov dword [ebp - 0x10], ebx
imul ecx, eax, 0x1000193
mov eax, ebx
shr eax, 8
movzx eax, al
xor ecx, eax
mov eax, ebx
shr eax, 0x10
imul ecx, ecx, 0x1000193
movzx eax, al
shr ebx, 0x18
xor ecx, eax
imul eax, ecx, 0x1000193
xor eax, ebx
mov ebx, dword [ebp - 0x1c]
imul esi, eax, 0x1000193
mov ecx, ebx
lea eax, [ebp - 0x10]
push esi
push eax
lea eax, [ebp - 0x18]
push eax
call fcn.10037760
mov eax, dword [ebp - 0x14]
test eax, eax
jne 0x10039935
cmp dword [ebx + 8], 0xfffffff
je 0x10039958
lea eax, [ebx + 4]
mov dword [ebp - 0x30], eax
push 0x10
mov dword [ebp - 4], 0
mov dword [ebp - 0x2c], 0
call fcn.100ba448
mov ecx, dword [ebp - 0x10]
add esp, 4
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x2c], eax
add eax, 8
mov dword [ebp - 0x20], eax
mov dword [eax], ecx
mov dword [eax + 4], 0
mov ecx, dword [ebx + 8]
mov eax, dword [ebx + 0x1c]
inc ecx
mov dword [ebp - 4], 1
movd xmm0, ecx
cvtdq2pd xmm0, xmm0
shr ecx, 0x1f
addsd xmm0, qword [ecx*8 + 0x100c9760]
cvtpd2ps xmm1, xmm0
movd xmm0, eax
cvtdq2pd xmm0, xmm0
shr eax, 0x1f
addsd xmm0, qword [eax*8 + 0x100c9760]
cvtpd2ps xmm0, xmm0
divss xmm1, xmm0
comiss xmm1, dword [ebx]
jbe 0x10039918
mov ecx, ebx
call fcn.1003b350
push esi
push dword [ebp - 0x20]
lea eax, [ebp - 0x38]
mov ecx, ebx
push eax
call fcn.10037760
mov ecx, dword [eax]
mov eax, dword [eax + 4]
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x14], eax
jmp 0x1003991b
mov ecx, dword [ebp - 0x18]
push dword [ebp - 0x24]
mov dword [ebp - 0x2c], 0
push ecx
push esi
mov ecx, ebx
call fcn.1003b2f0
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0x28]
mov dword [eax + 0xc], ecx
mov edi, dword [edi + 0x10]
test edi, edi
jne 0x100397e0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push str.unordered_map_set_too_long
call sub.MSVCP140.dll_void___cdecl_std::_Xlength_error_char_const__
int3
Function at 0x100485c0
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100bdee5
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push ebx
push esi
push edi
mov eax, dword [0x10122c00]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov edi, dword [ebp + 8]
movzx eax, byte [edi]
xor eax, 0x811c9dc5
imul ecx, eax, 0x1000193
movzx eax, byte [edi + 1]
xor ecx, eax
movzx eax, byte [edi + 2]
imul ecx, ecx, 0x1000193
xor ecx, eax
movzx eax, byte [edi + 3]
imul ecx, ecx, 0x1000193
xor ecx, eax
lea eax, [ebp - 0x14]
imul ebx, ecx, 0x1000193
mov ecx, esi
push ebx
push edi
push eax
call fcn.10037760
mov eax, dword [ebp - 0x10]
test eax, eax
jne 0x100486e6
cmp dword [esi + 8], 0xfffffff
je 0x100486fd
lea eax, [esi + 4]
mov dword [ebp - 0x20], eax
push 0x10
mov dword [ebp - 4], 0
mov dword [ebp - 0x1c], 0
call fcn.100ba448
mov dword [ebp - 0x1c], eax
add esp, 4
lea ecx, [eax + 8]
mov eax, dword [edi]
mov dword [ebp - 0x18], ecx
mov dword [ecx], eax
mov dword [ecx + 4], 0
mov eax, dword [esi + 8]
inc eax
mov dword [ebp - 4], 1
movd xmm0, eax
cvtdq2pd xmm0, xmm0
shr eax, 0x1f
addsd xmm0, qword [eax*8 + 0x100c9760]
mov eax, dword [esi + 0x1c]
cvtpd2ps xmm1, xmm0
movd xmm0, eax
cvtdq2pd xmm0, xmm0
shr eax, 0x1f
addsd xmm0, qword [eax*8 + 0x100c9760]
cvtpd2ps xmm0, xmm0
divss xmm1, xmm0
comiss xmm1, dword [esi]
jbe 0x100486d7
mov ecx, esi
call fcn.1003b350
push ebx
push dword [ebp - 0x18]
lea eax, [ebp - 0x14]
mov ecx, esi
push eax
call fcn.10037760
mov ecx, dword [eax]
jmp 0x100486da
mov ecx, dword [ebp - 0x14]
push dword [ebp - 0x1c]
push ecx
push ebx
mov ecx, esi
call fcn.1003b2f0
add eax, 0xc
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
push str.unordered_map_set_too_long
call sub.MSVCP140.dll_void___cdecl_std::_Xlength_error_char_const__
int3

Function at 0x100487e0
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [0x10122c00]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword fs:[0x30]
push esi
push edi
mov edi, dword [ebp + 8]
test ebx, ebx
jne 0x10048814
xor al, al
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100ba7ae
mov esp, ebp
pop ebp
ret
mov ebx, dword [ebx + 0xc]
add ebx, 0x14
mov esi, dword [ebx]
cmp esi, ebx
je 0x10048881
mov ecx, 0x5a4d
lea edx, [esi - 8]
test edx, edx
je 0x1004887b
mov eax, dword [edx + 0x18]
test eax, eax
je 0x1004887b
cmp word [eax], cx
jne 0x1004887b
mov ecx, dword [eax + 0x3c]
add ecx, eax
je 0x10048876
cmp dword [ecx], 0x4550
jne 0x10048876
mov dword [ebp - 0xc], eax
mov eax, dword [edi + 4]
mov dword [ebp - 0x10], edx
mov dword [ebp - 8], ecx
cmp eax, dword [edi + 8]
je 0x1004886a
movq xmm0, qword [ebp - 0x10]
movq qword [eax], xmm0
mov dword [eax + 8], ecx
add dword [edi + 4], 0xc
jmp 0x10048876
lea ecx, [ebp - 0x10]
push ecx
push eax
mov ecx, edi
call fcn.10047e30
mov ecx, 0x5a4d
mov esi, dword [esi]
cmp esi, ebx
jne 0x10048825
mov eax, dword [edi]
cmp eax, dword [edi + 4]
mov ecx, dword [ebp - 4]
pop edi
setne al
xor ecx, ebp
pop esi
pop ebx
call fcn.100ba7ae
mov esp, ebp
pop ebp
ret
Function at 0x100526a0
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100bf175
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
push ebx
push esi
push edi
mov eax, dword [0x10122c00]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov edx, dword [ebp + 0xc]
mov edi, dword [ebp + 8]
mov dword [ebp - 0x10], edx
mov dword [ebp - 0x20], edi
movzx eax, byte [edx]
xor eax, 0x811c9dc5
imul ecx, eax, 0x1000193
movzx eax, byte [edx + 1]
xor ecx, eax
movzx eax, byte [edx + 2]
imul ecx, ecx, 0x1000193
xor ecx, eax
movzx eax, byte [edx + 3]
imul ecx, ecx, 0x1000193
xor ecx, eax
imul eax, ecx, 0x1000193
mov ecx, ebx
push eax
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x1c]
push edx
push eax
call fcn.10037760
mov eax, dword [ebp - 0x18]
test eax, eax
je 0x1005272a
mov dword [edi], eax
mov byte [edi + 4], 0
jmp 0x10052877
cmp dword [ebx + 8], 0xaaaaaaa
je 0x1005288d
lea eax, [ebx + 4]
mov dword [ebp - 0x28], eax
push 0x18
mov dword [ebp - 4], 0
mov dword [ebp - 0x24], 0
call fcn.100ba448
mov ecx, dword [ebp - 0x10]
mov esi, eax
add esp, 4
mov dword [ebp - 0x24], esi
mov ecx, dword [ecx]
mov dword [esi + 8], ecx
mov byte [esi + 0xc], 0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
mov eax, dword [ebx + 8]
mov ecx, dword [ebx + 0x1c]
inc eax
movss xmm3, dword [ebx]
mov dword [ebp - 4], 1
movd xmm0, eax
cvtdq2pd xmm0, xmm0
shr eax, 0x1f
addsd xmm0, qword [eax*8 + 0x100c9760]
mov eax, ecx
shr eax, 0x1f
cvtpd2ps xmm2, xmm0
movd xmm0, ecx
cvtdq2pd xmm0, xmm0
movaps xmm1, xmm2
addsd xmm0, qword [eax*8 + 0x100c9760]
cvtpd2ps xmm0, xmm0
divss xmm1, xmm0
comiss xmm1, xmm3
jbe 0x1005282a
divss xmm2, xmm3
sub esp, 8
movss dword [ebp - 0x10], xmm2
fld dword [ebp - 0x10]
fstp qword [esp]
call sub.api_ms_win_crt_math_l1_1_0.dll_ceil
add esp, 8
fstp dword [ebp - 0x10]
movss xmm0, dword [ebp - 0x10]
call fcn.100ba870
mov ecx, 8
cmp eax, ecx
cmova ecx, eax
mov eax, dword [ebx + 0x1c]
cmp eax, ecx
jae 0x1005280c
cmp eax, 0x200
jae 0x1005280a
shl eax, 3
cmp eax, ecx
jae 0x1005280c
mov eax, ecx
push eax
mov ecx, ebx
call fcn.1003ae20
push dword [ebp - 0x14]
lea eax, [esi + 8]
mov ecx, ebx
push eax
lea eax, [ebp - 0x1c]
push eax
call fcn.10037760
mov edx, dword [eax]
jmp 0x1005282d
mov edx, dword [ebp - 0x1c]
mov eax, dword [edx + 4]
inc dword [ebx + 8]
mov edi, dword [ebp - 0x28]
mov dword [esi + 4], eax
mov dword [esi], edx
mov dword [eax], esi
mov dword [edx + 4], esi
mov ecx, dword [ebx + 0xc]
mov dword [ebp - 0x10], eax
mov eax, dword [ebx + 0x18]
and eax, dword [ebp - 0x14]
mov ebx, dword [ecx + eax*8]
cmp ebx, dword [edi]
jne 0x10052858
mov dword [ecx + eax*8], esi
jmp 0x1005286a
cmp ebx, edx
jne 0x10052861
mov dword [ecx + eax*8], esi
jmp 0x1005286e
mov edx, dword [ebp - 0x10]
cmp dword [ecx + eax*8 + 4], edx
jne 0x1005286e
mov dword [ecx + eax*8 + 4], esi
mov edi, dword [ebp - 0x20]
mov dword [edi], esi
mov byte [edi + 4], 1
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
push str.unordered_map_set_too_long
call sub.MSVCP140.dll_void___cdecl_std::_Xlength_error_char_const__
int3
Function at 0x100b1aa0
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100c5a23
mov eax, dword fs:[0]
push eax
sub esp, 0x28
push ebx
push esi
push edi
mov eax, dword [0x10122c00]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x10], edi
mov ebx, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
mov dword [ebp - 0x2c], edi
mov dword [edi], 0
push 0x10
mov dword [ebp - 0x20], ebx
mov dword [edi + 4], 0
mov dword [edi + 8], 0
call fcn.100ba448
add esp, 4
mov dword [eax], eax
mov dword [eax + 4], eax
mov dword [edi + 4], eax
lea ecx, [edi + 0xc]
mov dword [ebp - 4], 0
mov dword [ecx], 0
mov dword [ecx + 4], 0
mov dword [ecx + 8], 0
mov dword [edi + 0x18], 7
mov dword [edi + 0x1c], 8
mov dword [edi], 0x3f800000
push dword [edi + 4]
mov byte [ebp - 4], 1
push 0x10
call fcn.1003ad50
mov dword [ebp - 4], 2
cmp esi, ebx
je 0x100b1c64
nop
movzx eax, byte [esi]
xor eax, 0x811c9dc5
imul ecx, eax, 0x1000193
movzx eax, byte [esi + 1]
xor ecx, eax
movzx eax, byte [esi + 2]
imul ecx, ecx, 0x1000193
xor ecx, eax
movzx eax, byte [esi + 3]
imul ecx, ecx, 0x1000193
xor ecx, eax
lea eax, [ebp - 0x18]
imul ebx, ecx, 0x1000193
mov ecx, edi
push ebx
push esi
push eax
call fcn.10037760
cmp dword [ebp - 0x14], 0
jne 0x100b1c58
cmp dword [edi + 8], 0xfffffff
je 0x100b1c7a
lea eax, [edi + 4]
mov dword [ebp - 0x28], eax
push 0x10
mov byte [ebp - 4], 3
mov dword [ebp - 0x24], 0
call fcn.100ba448
mov ecx, dword [esi + 4]
add esp, 4
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x24], eax
lea edx, [eax + 8]
mov eax, dword [esi]
mov dword [ebp - 0x1c], edx
mov dword [edx], eax
mov dword [edx + 4], ecx
mov eax, dword [edi + 8]
inc eax
mov byte [ebp - 4], 4
movd xmm0, eax
cvtdq2pd xmm0, xmm0
shr eax, 0x1f
addsd xmm0, qword [eax*8 + 0x100c9760]
mov eax, dword [edi + 0x1c]
cvtpd2ps xmm1, xmm0
movd xmm0, eax
cvtdq2pd xmm0, xmm0
shr eax, 0x1f
addsd xmm0, qword [eax*8 + 0x100c9760]
cvtpd2ps xmm0, xmm0
divss xmm1, xmm0
comiss xmm1, dword [edi]
jbe 0x100b1c3e
mov ecx, edi
call fcn.1003b350
push ebx
push dword [ebp - 0x1c]
lea eax, [ebp - 0x34]
mov ecx, edi
push eax
call fcn.10037760
mov ecx, dword [eax]
mov eax, dword [eax + 4]
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x14], eax
jmp 0x100b1c41
mov ecx, dword [ebp - 0x18]
push dword [ebp - 0x10]
mov dword [ebp - 0x24], 0
push ecx
push ebx
mov ecx, edi
call fcn.1003b2f0
mov byte [ebp - 4], 2
add esi, 8
cmp esi, dword [ebp - 0x20]
jne 0x100b1b50
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
push str.unordered_map_set_too_long
call sub.MSVCP140.dll_void___cdecl_std::_Xlength_error_char_const__
int3
Function at 0x42e000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
nop
nop
nop
push 4
nop
nop
nop
nop
nop
pop edi
nop
nop
nop
cmp eax, 0
nop
nop
je 0x42e072
nop
nop
nop
nop
mov ebx, 0x407ef8
nop
nop
nop
mov ecx, ebx
nop
nop
nop
nop
sub ecx, eax
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
nop
push eax
nop
mov eax, ecx
nop
nop
nop
nop
nop
nop
nop
div edi
nop
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
pop eax
nop
nop
nop
mov esi, 0x3dd56e54
nop
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
add eax, edi
nop
loop 0x42e060
nop
nop
nop
nop
mov eax, section..data
nop
nop
nop
cmp eax, 0
nop
nop
je 0x42e0d2
nop
nop
nop
nop
mov ebx, 0x42cd70
nop
mov ecx, ebx
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
push eax
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
div edi
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
pop eax
nop
nop
nop
nop
nop
mov esi, 0x78bd1d08
nop
nop
nop
xor dword [eax], esi
nop
nop
nop
add eax, edi
nop
nop
nop
nop
nop
nop
loop 0x42e0c0
nop
nop
nop
nop
nop
popal
nop
jmp 0x401219
Function at 0x48b85f
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x1c
push ebx
push esi
mov ebx, ecx
push edi
mov dword [esp + 0x10], ebx
call fcn.0048ab7d
push str.Find:
lea eax, [esp + 0x18]
mov dword [ebx + 0x30], 0x17
push eax
mov ecx, ebx
call fcn.00489a15
mov esi, dword [ebx + 4]
xor edi, edi
push edi
push edi
mov eax, dword [eax]
mov dword [ebx + 0x40], eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
push 0xde
push esi
push 0x50
push 0x12c
push 2
push 0x32
push 0x44010042
push 0x4d8a44
push str.ComboBox
push edi
call dword [sym.imp.USER32.dll_CreateWindowExW]
push edi
lea esi, [ebx + 0x44]
mov dword [esi], eax
push dword [ebx + 0xc]
mov ebx, dword [sym.imp.USER32.dll_SendMessageW]
push 0x30
push eax
call ebx
mov edi, dword [sym.imp.USER32.dll_ShowWindow]
push 4
push dword [esi]
call edi
lea eax, [esp + 0x18]
mov ecx, esi
push eax
call fcn.00430ecc
mov eax, dword [esp + 0x24]
sub eax, dword [esp + 0x1c]
mov esi, dword [esp + 0x10]
add eax, 3
push str.Replace:
mov ecx, esi
mov dword [esi + 0x30], eax
lea eax, [esp + 0x18]
push eax
call fcn.00489a15
push 0
push 0
mov eax, dword [eax]
mov dword [esi + 0x68], eax
mov esi, dword [esi + 4]
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
push 0xe7
push esi
push 0x50
push 0x12c
push 2
push 0x32
push 0x40010042
push 0x4d8a44
push str.ComboBox
push 0
call dword [sym.imp.USER32.dll_CreateWindowExW]
mov esi, dword [esp + 0x10]
push 0
mov dword [esi + 0x6c], eax
push dword [esi + 0xc]
push 0x30
push eax
call ebx
push 4
push dword [esi + 0x6c]
call edi
xor ebx, ebx
lea eax, [esp + 0x14]
push ebx
xor edi, edi
mov ecx, esi
inc edi
push edi
push 0x4edef8
push eax
call fcn.00489b42
push ebx
push 0xec
push 0x4edf10
mov eax, dword [eax]
mov ecx, esi
mov dword [esi + 0x60], eax
lea eax, [esp + 0x20]
push eax
call fcn.00489b42
push ebx
push 0xed
push 0x4edf1c
mov eax, dword [eax]
mov ecx, esi
mov dword [esi + 0x70], eax
lea eax, [esp + 0x20]
push eax
call fcn.00489b42
push ebx
push 0xee
push str.In_Selection
mov eax, dword [eax]
mov ecx, esi
mov dword [esi + 0x64], eax
lea eax, [esp + 0x20]
push eax
call fcn.00489b42
push edi
mov ecx, esi
mov eax, dword [eax]
mov dword [esi + 0x74], eax
lea eax, [esp + 0x18]
push dword [0x505228]
push dword [0x505220]
push eax
call fcn.00489b42
push edi
mov ecx, esi
mov eax, dword [eax]
mov dword [esi + 0x48], eax
lea eax, [esp + 0x18]
push dword [0x505240]
push dword [0x505238]
push eax
call fcn.00489b42
push edi
mov ecx, esi
mov eax, dword [eax]
mov dword [esi + 0x50], eax
lea eax, [esp + 0x18]
push dword [0x505234]
push dword [0x50522c]
push eax
call fcn.00489b42
push edi
mov ecx, esi
mov eax, dword [eax]
mov dword [esi + 0x4c], eax
lea eax, [esp + 0x18]
push dword [0x50524c]
push dword [0x505244]
push eax
call fcn.00489b42
push edi
mov eax, dword [eax]
mov dword [esi + 0x54], eax
push dword [0x505258]
push dword [0x505250]
lea eax, [esp + 0x20]
mov ecx, esi
push eax
call fcn.00489b42
pop edi
mov eax, dword [eax]
mov dword [esi + 0x58], eax
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x43e368
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x4b8071
call fcn.004b7628
sub esp, 0x1c
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x1c], edx
mov eax, ecx
mov dword [ebp - 0x28], eax
xor ebx, ebx
mov dword [ebp - 0x20], 0x4611
cmp dword [ebp - 0x20], 0x4637
jle 0x43e3f1
xor esi, esi
mov dword [ebp - 0x18], esi
xor edi, edi
mov dword [ebp - 0x14], edi
xor ebx, ebx
mov dword [ebp - 0x24], esi
mov ecx, edi
sar esi, cl
xor edi, edi
lea eax, [edi + ebx]
xor eax, esi
cdq
push edx
push eax
mov ecx, 0xaa4f58
call fcn.0040ac83
inc edi
cmp edi, 0xd48
jl 0x43e3aa
inc ebx
cmp ebx, 0xb05
jl 0x43e3a8
mov edi, dword [ebp - 0x14]
inc edi
mov dword [ebp - 0x14], edi
cmp edi, 0x6c6c
mov esi, dword [ebp - 0x18]
jl 0x43e39f
inc esi
mov dword [ebp - 0x18], esi
cmp esi, 0x3a0d
jl 0x43e39a
xor ebx, ebx
mov eax, dword [ebp - 0x28]
lea esi, [eax + eax]
test esi, esi
je 0x43e422
mov edi, dword [ebp + 8]
mov eax, ebx
xor edx, edx
push 0x2d
pop ecx
div ecx
mov edx, dword [edi + edx*4]
mov ecx, dword [ebp - 0x1c]
mov ecx, dword [ecx + ebx*4]
mov eax, ecx
and eax, edx
add eax, eax
sub ecx, eax
add ecx, edx
mov eax, dword [ebp - 0x1c]
mov dword [eax + ebx*4], ecx
inc ebx
cmp ebx, esi
jb 0x43e3fb
and dword [ebp - 4], 0
cmp dword [ebp - 0x20], 0x45ee
jge 0x43e43e
mov edx, 0xa877b0
mov ecx, 0xaa4f58
call fcn.0040d509
or dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret