joyce8/EMBER2024-capa huggingface dataset:
Function at 0x448150
Capabilities:
Encode data using base64 via winapi

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x496e68
mov eax, dword fs:[0]
push eax
sub esp, 0x30
mov eax, dword [0x4c312c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 0x10]
mov edx, 2
mov dword [ebp - 0x38], eax
mov eax, dword [ebp + 0x14]
mov esi, dword [ebp + 8]
mov dword [ebp - 0x34], eax
mov ecx, dword [eax]
mov eax, ecx
add ecx, 0xa
shr eax, 6
add eax, ecx
xor ecx, ecx
mov dword [ebp - 0x2c], eax
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.00446d39
mov ecx, dword [ebp - 0x2c]
mov edi, eax
add ecx, ecx
push ecx
push 0
push edi
call fcn.00449a30
add esp, 0x10
lea eax, [ebp - 0x2c]
push eax
push edi
push 0x80000001
push dword [ebp + 0xc]
push esi
call dword [sym.imp.CRYPT32.dll_CryptBinaryToStringW]
mov ecx, edi
mov dword [ebp - 0x18], 0
mov esi, eax
mov dword [ebp - 0x14], 7
xor eax, eax
mov dword [ebp - 0x3c], esi
mov word [ebp - 0x28], ax
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x4481f4
sub ecx, edx
sar ecx, 1
push ecx
push edi
lea ecx, [ebp - 0x28]
call fcn.00427533
push 2
push edi
mov dword [ebp - 4], 0
call fcn.004468e9
mov ebx, dword [ebp - 0x14]
add esp, 8
mov edi, dword [ebp - 0x28]
test esi, esi
je 0x4482f6
cmp ebx, 8
lea eax, [ebp - 0x28]
cmovae eax, edi
mov edx, dword [ebp - 0x18]
mov dword [ebp - 0x30], edx
nop dword [eax]
cmp ebx, 8
lea ecx, [ebp - 0x28]
cmovae ecx, edi
lea ecx, [ecx + edx*2]
cmp eax, ecx
je 0x4482c4
cmp word [eax], 0xa
jne 0x4482bc
cmp ebx, 8
lea ecx, [ebp - 0x28]
cmovae ecx, edi
sub eax, ecx
sar eax, 1
cmp edx, eax
jb 0x448344
mov ecx, edx
lea esi, [eax + eax]
sub ecx, eax
mov edx, 1
cmp ecx, edx
cmovb edx, ecx
cmp ebx, 8
mov ebx, dword [ebp - 0x30]
lea ecx, [ebp - 0x28]
cmovae ecx, edi
sub ebx, edx
mov dword [ebp - 0x18], ebx
add ecx, esi
sub ebx, eax
lea eax, [ebx*2 + 2]
push eax
lea eax, [ecx + edx*2]
push eax
push ecx
call fcn.004494b0
mov ebx, dword [ebp - 0x14]
lea eax, [ebp - 0x28]
mov edi, dword [ebp - 0x28]
add esp, 0xc
cmp ebx, 8
cmovae eax, edi
add eax, esi
jmp 0x448236
add eax, 2
jmp 0x448240
mov esi, dword [ebp - 0x34]
mov ecx, dword [esi]
cmp edx, ecx
jbe 0x4482d1
xor esi, esi
jmp 0x4482f6
cmp ebx, 8
lea eax, [ebp - 0x28]
push edx
cmovae eax, edi
push eax
push ecx
push dword [ebp - 0x38]
call fcn.004545ca
mov eax, dword [ebp - 0x18]
add esp, 0x10
mov ebx, dword [ebp - 0x14]
mov edi, dword [ebp - 0x28]
mov dword [esi], eax
mov esi, dword [ebp - 0x3c]
cmp ebx, 8
jb 0x448326
lea ebx, [ebx*2 + 2]
mov eax, edi
cmp ebx, 0x1000
jb 0x44831c
mov edi, dword [edi - 4]
add ebx, 0x23
sub eax, edi
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x448349
push ebx
push edi
call fcn.004468e9
add esp, 8
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00446cf9
mov esp, ebp
pop ebp
ret
call fcn.0042727a
call fcn.00453b88
int3

Function at 0x48440f
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.00483be9
Function at 0x48441a
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.00483e24

Function at 0x484994
Capabilities:
Create thread
Print debug messages

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.0048471b
Function at 0xde22fc
Capabilities:
Encode data using xor

Disassembly:
jmp 0xde2306
pushal
call 0xde230c
pop ebp
sub ebp, 0x10
sub ebp, 0x9e22fc
jmp 0xde2322
mov eax, 0x9e22fc
add eax, ebp
add eax, 0x4c
mov ecx, 0x5c3
mov edx, 0x547e9318
xor byte [eax], dl
inc eax
dec ecx
jne 0xde2339
jmp 0xde234c
xchg ebx, eax
aad 0x93
xchg ecx, eax
and al, 0x18
sbb byte [eax], bl
cdq
fchs
sbb byte [eax], bl
sbb byte [ebx], bl
aad 0xa0
pop ds
sbb byte [eax], bl
sbb byte [edx + 0x18181830], ah
out dx, eax
cli
sbb edx, eax
xchg ebx, eax
cdq
adc al, 0x18
sbb byte [eax], bl
sbb ebx, ebp
xchg ebp, eax
jl 0xde23b1
in al, 0x91
sbb al, 0x3c
xchg ebp, eax
jl 0xde23b8
in al, 0x91
sbb al, 0x3c
jo 0xde2372
aaa
cmp dword [eax], ebx
jo 0xde2393
jmp 0xde23ed
sbb eax, 0xf1181818
sbb byte ss:[eax], bl
sbb byte [ebp - 0x6e1bc384], dl
xor al, 0x3c
dec esp
inc ebp
xchg ebx, eax
popfd
adc byte [eax], bl
sbb byte [eax], bl
xchg ebx, eax
lea edx, [eax + ebx]
sbb byte [eax], bl
xchg ebx, eax
xchg ebp, eax
or byte [eax], bl
sbb byte [eax], bl
fyl2x
int1
sbb ch, byte [ecx]
sbb bl, byte [ebx + 0x17511cda]
popfd
in al, dx
out 0xe7, eax
out 0x45, eax
ficom dword [eax + ebx]
xchg ebx, eax
xchg esp, eax
cmp al, 0x1c
sbb byte [eax], bl
sbb byte [eax - 0x10], dh
aaa
cmp dword [eax], ebx
jo 0xde23e4
jmp 0xde243e
xor al, 0x3c
xchg ebp, eax
jl 0xde241d
in al, 0x91
adc al, 0x3c
invalid
cmp al, 0xf0
sbb eax, 0xf1181818
pop edi
sbb bl, byte [eax]
sbb byte [ebp - 0x6e1bc384], dl
sbb byte [eax], bl
xchg ebp, eax
jl 0xde242e
in al, 0x91
xor al, 0x3c
xchg ebp, eax
je 0xde2435
sbb bh, ah
insd dword es:[edi], dx
adc al, 0xe7
insd dword es:[edi], dx
adc al, dh
push 0x18
sbb byte [eax], bl
xchg ebx, eax
movsd dword es:[edi], dword [esi]
adc byte [eax], bl
sbb byte [eax], bl
sub edx, ecx
cdq
ljmp 0xea99
sbb eax, 0x569c1750
sbb byte [eax], bl
sbb byte [edi], dl
nop
push eax
sbb byte [eax], bl
sbb byte [esi - 0x6d], bh
xchg ebx, eax
add al, 0x21
cwde
jecxz 0xde2422
and dword [eax - 0x63e80f1d], ebx
pop ss
pushfd
add bl, byte [eax]
sbb byte [eax], bl
cwde
jecxz 0xde242c
sbb byte [eax], bl
sbb byte [eax - 0x63e80e1d], bl
pop ss
pushfd
or dword [eax], ebx
sbb byte [eax], bl
jle 0xde23dc
sbb byte [eax], bl
sbb byte [esi - 0x67], bh
jecxz 0xde242c
cmp eax, 0x180d9c17
sbb byte [eax], bl
pop ecx
int1
aam 0xe7
out 0xe7, eax
xor dword [ecx + 0x19], edx
wait
fstp dword [0xf11cf09b]
movsd dword es:[edi], dword [esi]
out 0xe7, eax
out 0x31, eax
dec esp
and dword [edx], ebx
wait
fstp dword [esi]
wait
sbb al, 0x9b
invalid
Function at 0x401e33
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x401e72
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x401e72
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x401e72
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x401e72
cmp dword [ecx + 0x74], 0xe
jbe 0x401e72
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret
Function at 0xc98058
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.00c981a8
push ebx
mov ebx, esp
push ebx
mov esi, dword [ebx + 8]
mov edi, dword [ebx + 0x10]
cld
mov dl, pe_nt_image_headers32
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
mov ebx, 2
add dl, dl
jne 0xc9807e
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0xc9806a
add dl, dl
jne 0xc98089
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0xc980dc
xor eax, eax
add dl, dl
jne 0xc98096
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0xc9817d
add dl, dl
jne 0xc980a5
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xc980b0
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xc980bb
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xc980c6
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0xc980d2
push edi
mov eax, eax
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0xc98075
mov eax, 1
add dl, dl
jne 0xc980ea
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xc980f5
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0xc980e1
sub eax, ebx
mov ebx, 1
jne 0xc98128
mov ecx, 1
add dl, dl
jne 0xc9810e
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0xc98119
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0xc98105
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0xc98075
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0xc9813f
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0xc9814a
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0xc98136
cmp eax, 0x7d00
jae 0xc9816d
cmp eax, 0x500
jb 0xc98168
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0xc98075
cmp eax, 0x7f
ja 0xc98170
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0xc98075
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0xc9819e
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0xc98075
pop ebx
sub edi, dword [ebx + 0x10]
mov eax, edi
pop ebx
ret 0x10
Function at 0x42e000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
nop
mov ebx, 0x407ef8
nop
mov ecx, 0x34015f81
nop
nop
nop
nop
test eax, eax
nop
nop
nop
nop
je 0x42e04e
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x42e024
nop
mov eax, section..data
nop
mov ebx, 0x42cd70
nop
mov ecx, 0x5472597
nop
nop
nop
nop
test eax, eax
nop
nop
nop
nop
nop
je 0x42e084
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
add eax, 4
cmp eax, ebx
nop
nop
nop
nop
nop
nop
nop
jne 0x42e06c
nop
nop
nop
nop
nop
nop
popal
jmp 0x401219
Function at 0x401000
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x42a004]
jne 0x40100a
repz ret
jmp fcn.0040129c

Function at 0x40324b
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x42a004]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.0040223e
and dword [ebp - 0x14], 0
cmp dword [0x42cab0], 0
mov dword [ebp - 0x18], eax
jne 0x4032fe
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x4033a6
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxW
push ebx
call edi
test eax, eax
je 0x4033a6
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push str.GetActiveWindow
push ebx
mov dword [0x42cab0], eax
call edi
push eax
call esi
push str.GetLastActivePopup
push ebx
mov dword [0x42cab4], eax
call edi
push eax
call esi
push str.GetUserObjectInformationW
push ebx
mov dword [0x42cab8], eax
call edi
push eax
call esi
mov dword [0x42cac0], eax
test eax, eax
je 0x4032fe
push str.GetProcessWindowStation
push ebx
call edi
push eax
call esi
mov dword [0x42cabc], eax
mov eax, dword [0x42cabc]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x403357
cmp dword [0x42cac0], ecx
je 0x403357
push eax
call esi
push dword [0x42cac0]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x403357
test ebx, ebx
je 0x403357
call edi
test eax, eax
je 0x40334e
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x40334e
test byte [ebp - 8], 1
jne 0x403357
or dword [ebp + 0x10], 0x200000
jmp 0x40338a
mov eax, dword [0x42cab4]
cmp eax, dword [ebp - 0x18]
je 0x40338a
push eax
call esi
test eax, eax
je 0x40338a
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x40338a
mov eax, dword [0x42cab8]
cmp eax, dword [ebp - 0x18]
je 0x40338a
push eax
call esi
test eax, eax
je 0x40338a
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x42cab0]
call esi
test eax, eax
je 0x4033a6
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x4033a8
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00401000
leave
ret

Function at 0x4054f0
Capabilities:
Create pipe

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [str.Z6r_]
sub esp, 0x10
push esi
mov esi, dword [0x471e78]
push edi
mov edi, dword [0x472154]
push eax
call fcn.004053e0
add esp, 4
cmp dword [0x472154], 0x2f
jne 0x405550
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str.Bihux_nivew_zuziduzaz_winojego_roli
call dword [sym.imp.KERNEL32.dll_CreateNamedPipeA]
lea ecx, [ebp - 8]
push ecx
lea edx, [ebp - 0x10]
push edx
mov dword [ebp - 8], 0
mov dword [ebp - 4], 0
call dword [sym.imp.KERNEL32.dll_FileTimeToLocalFileTime]
push esi
call fcn.00405430
add esp, 4
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x59e000
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push eax
push ecx
push edx
push ebx
push ebp
push esi
push edi
call 0x59e00c
pop ebx
sub ebx, 0x8d00c
mov edi, 0
push ebx
add dword [ebx + 0x2d8], 0xf81308b
sub dword [ebx + 0x234], 0x26443c5b
not dword [ebx + 0xe0]
not dword [ebx + 0xf4]
sub dword [ebx + 0x3f8], 0x13797fc3
add dword [ebx + 0x120], 0x6e7a60ba
add dword [ebx + 0xb8], 0x60460427
sub dword [ebx + 0x25c], 0x4d93601e
not dword [ebx + 0x394]
sub dword [ebx + 0x64], 0x10e73224
xor dword [ebx + 0xb4], 0x1fef41b2
sub dword [ebx + 0x3a0], 0x145979a2
xor dword [ebx + 0x3c0], 0x27332226
sub dword [ebx + 0x1f0], 0x33d704e5
add dword [ebx + 0x340], 0x15be2797
sub dword [ebx + 0x100], 0x88117cc
sub dword [ebx + 0x324], 0x450b0184
sub dword [ebx + 0x3b0], 0xf3343a1
xor dword [ebx + 0x30], 0x241375bb
add dword [ebx + 0x3c4], 0x6a272f59
invalid
stosd dword es:[edi], eax
pushfd
invalid
Function at 0x10008d00
Capabilities:
Inspect section memory permissions

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
mov ebx, dword [ebp + 0x10]
push esi
mov esi, dword [ebp + 0xc]
push edi
mov al, byte [ebx + 0xc]
lea edx, [esi + 0x20]
test al, 0x60
je 0x10008d35
movzx eax, al
shr eax, 5
and eax, 3
mov ecx, dword [eax*8 + 0x100af058]
or dword [edx], ecx
mov eax, dword [eax*8 + 0x100af05c]
or dword [edx + 4], eax
mov al, byte [ebx + 0xd]
lea edi, [ebx + 0xd]
test al, 3
je 0x10008d66
movzx ecx, al
and ecx, 3
mov eax, dword [ecx*8 + 0x100af078]
or dword [edx], eax
mov eax, dword [ecx*8 + 0x100af07c]
lea ecx, [esi + 0x20]
or dword [edx + 4], eax
add ebx, 0xd
mov dword [ebp + 0xc], ecx
mov dword [ebp - 4], ebx
jmp 0x10008d6e
mov dword [ebp + 0xc], edx
mov ebx, edi
mov dword [ebp - 4], edi
mov al, byte [edi]
test al, 0xc
je 0x10008d93
movzx ecx, al
shr ecx, 2
and ecx, 3
mov eax, dword [ecx*8 + 0x100af098]
or dword [edx], eax
mov eax, dword [ecx*8 + 0x100af09c]
or dword [edx + 4], eax
mov edx, dword [ebp + 0xc]
mov eax, dword [esi + 0xc]
jmp dword [eax*4 + 0x10009210]

Function at 0x1000aee0
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [ecx + 4]
push esi
push edi
mov edi, dword [ebp + 8]
mov eax, dword [eax]
mov dword [ebp - 0xc], eax
mov dword [ebp - 4], eax
mov eax, dword [ecx]
mov dword [ebp - 0x10], edi
mov dword [ebp - 8], ecx
mov ecx, dword [eax + 4]
mov eax, dword [eax]
mov dword [ebp + 8], ecx
cmp eax, ecx
je 0x1000af2c
nop word [eax + eax]
mov edx, dword [eax]
mov ecx, edi
mov esi, edx
sub ecx, edx
sub esi, edi
cmp edi, edx
cmovbe ecx, esi
cmp ecx, dword [ebp - 4]
ja 0x1000af4a
add eax, 4
cmp eax, dword [ebp + 8]
jne 0x1000af10
mov eax, dword [ebp - 8]
push 0x40
push 0x3000
mov eax, dword [eax + 8]
push dword [eax]
push edi
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4
pop edi
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x1000f840
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1004387b
mov eax, dword fs:[0]
push eax
sub esp, 0x28
push ebx
push esi
push edi
mov eax, dword [0x100c7140]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov dword [ebp - 0x10], ebx
mov esi, dword [ebp + 8]
lea edi, [ebx + 4]
push 0x24
mov dword [ebp - 0x14], edi
mov eax, dword [esi]
mov dword [ebx], eax
mov dword [edi], 0
mov dword [edi + 4], 0
call fcn.1002307e
add esp, 4
mov dword [eax], eax
mov dword [eax + 4], eax
mov dword [edi], eax
lea ecx, [ebx + 0xc]
mov dword [ebp - 4], 0
mov dword [ecx], 0
mov dword [ecx + 4], 0
mov dword [ecx + 8], 0
mov eax, dword [esi + 0x18]
mov dword [ebx + 0x18], eax
mov eax, dword [esi + 0x1c]
mov dword [ebx + 0x1c], eax
mov eax, dword [esi + 0x10]
sub eax, dword [esi + 0xc]
push dword [edi]
sar eax, 2
push eax
mov byte [ebp - 4], 1
call fcn.10013d90
mov eax, dword [esi + 4]
mov dword [ebp - 0x1c], eax
mov esi, dword [eax]
cmp esi, eax
je 0x1000fa0b
cmp dword [esi + 0x1c], 0xf
lea ebx, [esi + 8]
mov edx, ebx
jbe 0x1000f8f4
mov edx, dword [ebx]
xor ecx, ecx
mov edi, 0x811c9dc5
cmp dword [ebx + 0x10], ecx
jbe 0x1000f912
movzx eax, byte [ecx + edx]
inc ecx
xor eax, edi
imul edi, eax, 0x1000193
cmp ecx, dword [ebx + 0x10]
jb 0x1000f900
mov ecx, dword [ebp - 0x10]
lea eax, [ebp - 0x24]
push edi
push ebx
push eax
call fcn.10010580
cmp dword [ebp - 0x20], 0
jne 0x1000f9fd
mov eax, dword [ebp - 0x10]
cmp dword [eax + 8], 0x71c71c7
je 0x1000fa21
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x2c], eax
push 0x24
mov byte [ebp - 4], 2
mov dword [ebp - 0x28], 0
call fcn.1002307e
add esp, 4
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x28], eax
add eax, 8
mov ecx, eax
mov dword [ebp + 8], eax
push ebx
call fcn.10011bc0
mov eax, dword [ebp + 8]
mov ecx, dword [ebx + 0x18]
mov dword [eax + 0x18], ecx
mov ebx, dword [ebp - 0x10]
mov byte [ebp - 4], 3
mov eax, dword [ebx + 8]
inc eax
movd xmm0, eax
cvtdq2pd xmm0, xmm0
shr eax, 0x1f
addsd xmm0, qword [eax*8 + 0x100b5110]
mov eax, dword [ebx + 0x1c]
cvtpd2ps xmm1, xmm0
movd xmm0, eax
cvtdq2pd xmm0, xmm0
shr eax, 0x1f
addsd xmm0, qword [eax*8 + 0x100b5110]
cvtpd2ps xmm0, xmm0
divss xmm1, xmm0
comiss xmm1, dword [ebx]
seta al
test al, al
je 0x1000f9e1
mov ecx, ebx
call fcn.10014a00
push edi
push dword [ebp + 8]
lea eax, [ebp - 0x34]
mov ecx, ebx
push eax
call fcn.10010580
mov ecx, dword [eax]
mov eax, dword [eax + 4]
mov dword [ebp - 0x24], ecx
mov dword [ebp - 0x20], eax
jmp 0x1000f9e4
mov ecx, dword [ebp - 0x24]
push dword [ebp - 0x18]
mov dword [ebp - 0x28], 0
push ecx
push edi
mov ecx, ebx
call fcn.100145d0
mov byte [ebp - 4], 1
jmp 0x1000fa00
mov ebx, dword [ebp - 0x10]
mov esi, dword [esi]
cmp esi, dword [ebp - 0x1c]
jne 0x1000f8e7
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
push str.unordered_map_set_too_long
call fcn.10021fb4
int3
Function at 0x10011500
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov edx, dword [ebp + 0xc]
mov eax, ecx
push ebx
push esi
push edi
cmp dword [edx + 0x14], 0xf
mov edi, edx
mov ebx, dword [edx + 0x10]
mov dword [ebp - 4], eax
jbe 0x1001151e
mov edi, dword [edx]
xor ecx, ecx
mov esi, 0x811c9dc5
test ebx, ebx
je 0x10011544
nop dword [eax]
movzx eax, byte [ecx + edi]
inc ecx
xor eax, esi
imul esi, eax, 0x1000193
cmp ecx, ebx
jb 0x10011530
mov eax, dword [ebp - 4]
push esi
push edx
lea ecx, [ebp - 0xc]
push ecx
mov ecx, eax
call fcn.10010580
pop edi
pop esi
pop ebx
mov ecx, dword [eax + 4]
mov eax, dword [ebp + 8]
test ecx, ecx
jne 0x10011564
mov ecx, dword [ebp - 4]
mov ecx, dword [ecx + 4]
mov dword [eax], ecx
mov esp, ebp
pop ebp
ret 8

Function at 0x10013310
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10043e15
mov eax, dword fs:[0]
push eax
sub esp, 0x18
push ebx
push esi
push edi
mov eax, dword [0x100c7140]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov edi, dword [ebp + 8]
mov edx, edi
cmp dword [edi + 0x14], 0xf
jbe 0x10013347
mov edx, dword [edi]
xor ecx, ecx
mov esi, 0x811c9dc5
cmp dword [edi + 0x10], ecx
jbe 0x10013365
movzx eax, byte [ecx + edx]
inc ecx
xor eax, esi
imul esi, eax, 0x1000193
cmp ecx, dword [edi + 0x10]
jb 0x10013353
push esi
push edi
lea eax, [ebp - 0x14]
mov ecx, ebx
push eax
call fcn.10010580
mov eax, dword [ebp - 0x10]
test eax, eax
jne 0x10013431
cmp dword [ebx + 8], 0x71c71c7
je 0x10013448
lea eax, [ebx + 4]
mov dword [ebp - 0x1c], eax
push 0x24
mov dword [ebp - 4], 0
mov dword [ebp - 0x18], 0
call fcn.1002307e
add esp, 4
mov dword [ebp - 0x18], eax
add eax, 8
mov ecx, eax
mov dword [ebp + 8], eax
push edi
call fcn.10011bc0
mov edi, dword [ebp + 8]
mov dword [edi + 0x18], 0
mov eax, dword [ebx + 8]
inc eax
mov dword [ebp - 4], 1
movd xmm0, eax
cvtdq2pd xmm0, xmm0
shr eax, 0x1f
addsd xmm0, qword [eax*8 + 0x100b5110]
mov eax, dword [ebx + 0x1c]
cvtpd2ps xmm1, xmm0
movd xmm0, eax
cvtdq2pd xmm0, xmm0
shr eax, 0x1f
addsd xmm0, qword [eax*8 + 0x100b5110]
cvtpd2ps xmm0, xmm0
divss xmm1, xmm0
comiss xmm1, dword [ebx]
jbe 0x10013422
mov ecx, ebx
call fcn.10014a00
push esi
push edi
lea eax, [ebp - 0x24]
mov ecx, ebx
push eax
call fcn.10010580
mov ecx, dword [eax]
jmp 0x10013425
mov ecx, dword [ebp - 0x14]
push dword [ebp - 0x18]
push ecx
push esi
mov ecx, ebx
call fcn.100145d0
add eax, 0x20
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
push str.unordered_map_set_too_long
call fcn.10021fb4
int3

Function at 0x100137d0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateThread]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop ebp
ret
Function at 0x10015c20
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1004400d
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
push ebx
push esi
push edi
mov eax, dword [0x100c7140]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
push 8
mov dword [esi + 0x30], 0
mov dword [esi + 8], 0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0x201
mov dword [esi + 0x18], 6
mov dword [esi + 0x1c], 0
mov dword [esi + 0x20], 0
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x2c], 0
mov dword [esi + 0xc], 0
call fcn.1002307e
mov edi, eax
add esp, 4
test edi, edi
je 0x10015cbd
push 1
mov dword [ebp - 4], 0
call fcn.100223e5
add esp, 4
mov dword [edi + 4], eax
jmp 0x10015cbf
xor edi, edi
mov eax, dword [ebp + 8]
mov dword [esi + 0x30], edi
mov dword [esi + 0x38], eax
mov dword [esi + 0x3c], 0
mov edi, dword [edi + 4]
mov ecx, edi
mov dword [ebp - 0x10], edi
mov eax, dword [edi]
call dword [eax + 4]
lea eax, [ebp - 0x14]
mov dword [ebp - 4], 1
push eax
call fcn.10011710
add esp, 4
mov ecx, dword [eax]
push 0x20
mov edx, dword [ecx + 0x20]
mov ecx, eax
call edx
mov dword [ebp - 4], 0xffffffff
mov bl, al
test edi, edi
je 0x10015d1a
mov edx, dword [edi]
mov ecx, edi
call dword [edx + 8]
test eax, eax
je 0x10015d1a
mov edx, dword [eax]
mov ecx, eax
push 1
call dword [edx]
cmp dword [esi + 0x38], 0
mov byte [esi + 0x40], bl
jne 0x10015d36
mov eax, dword [esi + 0xc]
mov ecx, dword [esi + 0x10]
and eax, 0x13
or eax, 4
mov dword [esi + 0xc], eax
and ecx, eax
jne 0x10015d59
cmp byte [ebp + 0xc], 0
je 0x10015d45
push esi
call fcn.10022b0a
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
test cl, 4
je 0x10015d65
mov esi, str.ios_base::badbit_set
jmp 0x10015d75
test cl, 2
mov esi, str.ios_base::failbit_set
mov eax, str.ios_base::eofbit_set
cmove esi, eax
lea eax, [ebp - 0x14]
push 1
push eax
call fcn.10015eb0
add esp, 8
lea ecx, [ebp - 0x28]
push eax
push esi
call fcn.100122a0
push 0x100c2e24
lea eax, [ebp - 0x28]
push eax
call fcn.1002424d
int3

Function at 0x10017ba0
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
movzx eax, byte [ebp + 0xc]
xor edx, edx
mov dword [ebp - 0x10], edx
push ebx
push esi
mov esi, dword [ebp + 8]
test eax, eax
jne 0x10017bbc
xor al, al
jmp 0x10017bd8
lea ecx, [ebp - 8]
mov dword [ebp - 0xc], eax
push ecx
push 0x40
push eax
push esi
mov dword [ebp - 0x10], esi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov edx, dword [ebp - 0x10]
test eax, eax
setne al
mov byte [ebp - 4], al
mov bl, byte [esi]
test al, al
je 0x10017bf6
mov ecx, dword [ebp - 8]
lea eax, [ebp + 0xc]
push eax
push ecx
push dword [ebp - 0xc]
mov dword [ebp + 0xc], ecx
push edx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
pop esi
mov al, bl
pop ebx
mov esp, ebp
pop ebp
ret