joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10005420
Capabilities:
Resolve function by parsing pe exports

Disassembly:
lea edx, [ecx + 0x98]
mov dword [edx], 0x7c
mov dword [edx + 4], 0x16041101
mov eax, dword [ecx + 0x1c]
sub eax, dword [ecx + 0x18]
sar eax, 2
mov dword [edx + 8], eax
mov eax, dword [ecx + 0x18]
mov dword [edx + 0xc], eax
mov eax, dword [ecx + 0x28]
sub eax, dword [ecx + 0x24]
sar eax, 2
mov dword [edx + 0x10], eax
mov eax, dword [ecx + 0x24]
mov dword [edx + 0x14], eax
mov eax, dword [ecx + 0x124]
push esi
mov esi, dword [ecx + 0x120]
sub eax, esi
sar eax, 2
cmp eax, 1
jbe 0x1000548b
mov eax, dword [esi + 4]
mov dword [edx + 0x1c], eax
mov eax, dword [ecx + 0x138]
mov eax, dword [eax + 4]
mov dword [edx + 0x18], eax
mov eax, dword [ecx + 0x150]
mov eax, dword [eax + 4]
jmp 0x1000549e
mov dword [edx + 0x1c], 0x1003bce0
mov eax, 0x1003bce0
mov dword [edx + 0x18], 0x1003bce0
mov dword [edx + 0x44], eax
lea eax, [ecx + 0x48]
cmp dword [eax + 0x14], 7
jbe 0x100054ac
mov eax, dword [eax]
mov dword [edx + 0x20], eax
lea eax, [ecx + 0x60]
cmp dword [eax + 0x14], 7
jbe 0x100054ba
mov eax, dword [eax]
mov dword [edx + 0x40], eax
movzx eax, byte [ecx + 0x78]
mov dword [edx + 0x24], eax
mov eax, dword [ecx + 0x8c]
sub eax, dword [ecx + 0x88]
sar eax, 2
mov dword [edx + 0x28], eax
mov eax, dword [ecx + 0x88]
mov dword [edx + 0x2c], eax
mov dword [edx + 0x30], 1
mov dword [edx + 0x34], 0
mov eax, dword [ecx + 0x94]
mov dword [edx + 0x38], eax
lea eax, [ecx + 0x30]
cmp dword [eax + 0x14], 7
jbe 0x10005501
mov eax, dword [eax]
mov dword [edx + 0x3c], eax
mov eax, dword [ecx + 0x124]
sub eax, dword [ecx + 0x120]
sar eax, 2
mov dword [edx + 0x48], eax
mov eax, dword [ecx + 0x120]
mov dword [edx + 0x4c], eax
mov eax, dword [ecx + 0x13c]
sub eax, dword [ecx + 0x138]
sar eax, 2
mov dword [edx + 0x50], eax
mov eax, dword [ecx + 0x138]
mov dword [edx + 0x54], eax
mov eax, dword [ecx + 0x154]
sub eax, dword [ecx + 0x150]
sar eax, 2
mov dword [edx + 0x58], eax
mov eax, dword [ecx + 0x150]
mov dword [edx + 0x5c], eax
mov eax, dword [ecx + 0x16c]
sub eax, dword [ecx + 0x168]
sar eax, 2
mov dword [edx + 0x60], eax
mov eax, dword [ecx + 0x168]
mov dword [edx + 0x64], eax
lea eax, [ecx + 0x180]
cmp dword [eax + 0x14], 7
jbe 0x1000557e
mov eax, dword [eax]
mov dword [edx + 0x68], eax
lea eax, [ecx + 0x198]
cmp dword [eax + 0x14], 7
jbe 0x1000558f
mov eax, dword [eax]
mov dword [edx + 0x6c], eax
lea eax, [ecx + 0x1b0]
cmp dword [eax + 0x14], 7
jbe 0x100055a0
mov eax, dword [eax]
add ecx, 0x1c8
mov dword [edx + 0x70], eax
cmp dword [ecx + 0x14], 7
jbe 0x100055b1
mov ecx, dword [ecx]
mov dword [edx + 0x74], ecx
mov eax, edx
mov ecx, dword [0x10049bb4]
mov dword [edx + 0x78], 0
test ecx, ecx
je 0x100055cd
mov ecx, dword [ecx + 0x38]
mov dword [edx + 0x78], ecx
pop esi
ret
Function at 0x10008860
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x2c
mov eax, dword [0x10049080]
xor eax, esp
mov dword [esp + 0x28], eax
push ebx
mov ebx, dword [ebp + 0xc]
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0x10]
call fcn.10019ed0
push str.567edafe6106e6b769c64f6a2ed876190baa642a
push 0x1003c5a8
push str.____Invoked__s__commit_hash:__s_
call fcn.1001a370
add esp, 0xc
test ebx, ebx
je 0x10008a01
test edi, edi
je 0x10008a01
test esi, esi
jne 0x100088df
call fcn.1000d490
mov esi, eax
test esi, esi
jne 0x10008904
push str.Hosting_components_context_has_not_been_initialized._Cannot_get_runtime_properties.
call fcn.1001a3c0
add esp, 4
mov eax, 0x800080a3
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x28]
xor ecx, esp
call fcn.100309eb
mov esp, ebp
pop ebp
ret
mov eax, dword [esi]
cmp eax, 0xabababab
jne 0x100089dd
cmp dword [esi + 4], 4
jne 0x10008904
push str.Host_context_is_in_an_invalid_state
call fcn.1001a3c0
add esp, 4
jmp 0x10008a01
cmp dword [esi + 4], 3
jne 0x100089b9
add esi, 0x90
lea ecx, [esp + 0x1c]
push ebx
mov dword [esp + 0x14], esi
call fcn.100029e0
mov eax, dword [esp + 0x2c]
lea esi, [esp + 0x1c]
cmp dword [esp + 0x30], 7
mov edx, 0x811c9dc5
cmova esi, dword [esp + 0x1c]
xor ecx, ecx
lea ebx, [eax + eax]
test ebx, ebx
je 0x10008953
movzx eax, byte [ecx + esi]
inc ecx
xor eax, edx
imul edx, eax, 0x1000193
cmp ecx, ebx
jb 0x10008942
mov ebx, dword [esp + 0x10]
lea eax, [esp + 0x1c]
push edx
push eax
lea eax, [esp + 0x1c]
mov ecx, ebx
push eax
call fcn.100064c0
mov esi, dword [eax + 4]
test esi, esi
jne 0x10008973
mov esi, dword [ebx + 4]
lea ecx, [esp + 0x1c]
call fcn.100028f0
cmp esi, dword [ebx + 4]
jne 0x10008998
mov eax, 0x800080a4
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x28]
xor ecx, esp
call fcn.100309eb
mov esp, ebp
pop ebp
ret
cmp dword [esi + 0x34], 7
lea eax, [esi + 0x20]
jbe 0x100089a3
mov eax, dword [eax]
mov dword [edi], eax
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x28]
xor ecx, esp
call fcn.100309eb
mov esp, ebp
pop ebp
ret
mov esi, dword [esi + 0x24]
mov ecx, esi
push edi
push ebx
call dword [0x10038244]
call esi
add esp, 8
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x28]
xor ecx, esp
call fcn.100309eb
mov esp, ebp
pop ebp
ret
cmp eax, 0xcdcdcdcd
jne 0x100089f3
push str.Host_context_has_already_been_closed
call fcn.1001a3c0
add esp, 4
jmp 0x10008a01
push eax
push str.Invalid_host_context_handle_marker:_0x_x
call fcn.1001a3c0
add esp, 8
mov ecx, dword [esp + 0x34]
mov eax, 0x80008081
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.100309eb
mov esp, ebp
pop ebp
ret
Function at 0x1000f340
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100353fd
mov eax, dword fs:[0]
push eax
sub esp, 0x2c
push ebx
push esi
push edi
mov eax, dword [0x10049080]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edx, ecx
mov dword [ebp - 0x10], edx
mov esi, dword [ebp + 8]
mov edi, dword [ebp + 0xc]
cmp esi, edi
je 0x1000f512
nop dword [eax + eax]
cmp dword [esi + 0x1c], 7
lea eax, [esi + 8]
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], eax
jbe 0x1000f394
mov ecx, dword [eax]
mov dword [ebp - 0x14], ecx
mov eax, dword [eax + 0x10]
mov ebx, 0x811c9dc5
add eax, eax
mov ecx, 0
mov dword [ebp - 0x1c], eax
je 0x1000f3c7
mov edi, dword [ebp - 0x14]
mov edx, eax
nop dword [eax]
movzx eax, byte [ecx + edi]
inc ecx
xor eax, ebx
imul ebx, eax, 0x1000193
cmp ecx, edx
jb 0x1000f3b0
mov edi, dword [ebp + 0xc]
mov edx, dword [ebp - 0x10]
push ebx
lea eax, [esi + 8]
mov ecx, edx
push eax
lea eax, [ebp - 0x24]
push eax
call fcn.100064c0
cmp dword [ebp - 0x20], 0
jne 0x1000f501
mov eax, dword [ebp - 0x10]
cmp dword [eax + 8], 0x4924924
je 0x1000f526
add eax, 4
mov dword [ebp - 0x2c], eax
mov dword [ebp - 4], 0
push 0x38
mov dword [ebp - 0x28], 0
call fcn.100309f9
mov edi, eax
add esp, 4
mov dword [ebp - 0x28], edi
push dword [ebp - 0x18]
lea esi, [edi + 8]
mov ecx, esi
mov dword [ebp - 0x1c], esi
call fcn.10002a30
mov eax, dword [ebp - 0x18]
lea ecx, [esi + 0x18]
add eax, 0x18
mov byte [ebp - 4], 1
push eax
call fcn.10002a30
mov esi, dword [ebp - 0x10]
mov dword [ebp - 4], 2
mov eax, dword [esi + 8]
inc eax
movd xmm0, eax
cvtdq2pd xmm0, xmm0
shr eax, 0x1f
addsd xmm0, qword [eax*8 + 0x10043510]
mov eax, dword [esi + 0x1c]
cvtpd2ps xmm1, xmm0
movd xmm0, eax
cvtdq2pd xmm0, xmm0
shr eax, 0x1f
addsd xmm0, qword [eax*8 + 0x10043510]
cvtpd2ps xmm0, xmm0
divss xmm1, xmm0
comiss xmm1, dword [esi]
seta al
test al, al
je 0x1000f4aa
mov ecx, esi
call fcn.1000fc40
push ebx
lea eax, [edi + 8]
mov ecx, esi
push eax
lea eax, [ebp - 0x34]
push eax
call fcn.100064c0
mov edx, dword [eax]
mov eax, dword [eax + 4]
mov dword [ebp - 0x24], edx
mov dword [ebp - 0x20], eax
jmp 0x1000f4ad
mov edx, dword [ebp - 0x24]
mov eax, dword [edx + 4]
inc dword [esi + 8]
mov dword [edi + 4], eax
mov dword [edi], edx
mov dword [eax], edi
mov dword [edx + 4], edi
mov ecx, dword [esi + 0xc]
mov dword [ebp - 0x1c], eax
mov eax, dword [esi + 0x18]
and eax, ebx
mov dword [ebp - 0x28], 0
mov ebx, dword [ebp - 0x2c]
mov esi, dword [ecx + eax*8]
cmp esi, dword [ebx]
jne 0x1000f4de
mov dword [ecx + eax*8], edi
jmp 0x1000f4f0
cmp esi, edx
jne 0x1000f4e7
mov dword [ecx + eax*8], edi
jmp 0x1000f4f4
mov edx, dword [ebp - 0x1c]
cmp dword [ecx + eax*8 + 4], edx
jne 0x1000f4f4
mov dword [ecx + eax*8 + 4], edi
mov dword [ebp - 4], 0xffffffff
mov edi, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
mov esi, dword [esi]
mov dword [ebp + 8], esi
cmp esi, edi
je 0x1000f512
mov edx, dword [ebp - 0x10]
jmp 0x1000f380
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
push str.unordered_map_set_too_long
call fcn.1002f7fa
int3
Function at 0x10010010
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
mov dword [ebp - 4], ecx
cmp edx, eax
je 0x1001018b
cmp dword [edx + 0x1c], 7
mov eax, dword [ecx + 4]
push ebx
mov dword [ebp - 0x18], eax
lea ebx, [edx + 8]
mov eax, dword [ecx + 0xc]
mov dword [ebp - 0x14], eax
mov eax, dword [edx + 4]
push esi
mov dword [ebp - 8], eax
mov esi, edx
mov dword [ebp - 0xc], ebx
jbe 0x1001004e
mov eax, dword [ebx]
mov dword [ebp - 0xc], eax
mov ebx, dword [ebx + 0x10]
mov edx, 0
push edi
mov edi, 0x811c9dc5
add ebx, ebx
je 0x10010077
mov ecx, dword [ebp - 0xc]
movzx eax, byte [edx + ecx]
inc edx
xor eax, edi
imul edi, eax, 0x1000193
cmp edx, ebx
jb 0x10010063
mov ecx, dword [ebp - 4]
mov eax, dword [ecx + 0x18]
mov ecx, dword [ebp - 0x14]
and eax, edi
lea eax, [ecx + eax*8]
mov ecx, dword [eax]
mov dword [ebp - 0xc], eax
mov eax, dword [eax + 4]
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0x1c], eax
mov edi, esi
mov ebx, esi
mov esi, dword [esi]
lea ecx, [edi + 8]
call fcn.10006930
push 0x38
push edi
call fcn.10030d43
mov edi, dword [ebp - 4]
add esp, 8
dec dword [edi + 8]
cmp ebx, dword [ebp - 0x1c]
je 0x100100dd
mov eax, dword [ebp + 0xc]
cmp esi, eax
jne 0x10010090
mov ecx, dword [ebp - 0x10]
cmp ecx, dword [ebp + 8]
jne 0x10010180
mov ecx, dword [ebp - 0xc]
pop edi
mov dword [ecx], esi
mov ecx, dword [ebp - 8]
mov dword [ecx], esi
mov dword [esi + 4], ecx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
mov ecx, dword [ebp - 0x10]
cmp ecx, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
jne 0x100100ef
mov eax, dword [ebp - 0x18]
mov dword [ecx], eax
jmp 0x100100f2
mov eax, dword [ebp - 8]
mov dword [ecx + 4], eax
mov eax, dword [ebp + 0xc]
cmp esi, eax
je 0x10010180
cmp dword [esi + 0x1c], 7
lea ebx, [esi + 8]
mov dword [ebp - 0x10], ebx
jbe 0x10010111
mov eax, dword [ebx]
mov dword [ebp - 0x10], eax
mov ebx, dword [ebx + 0x10]
mov edx, 0x811c9dc5
mov ecx, 0
add ebx, ebx
je 0x10010139
mov edi, dword [ebp - 0x10]
movzx eax, byte [ecx + edi]
inc ecx
xor eax, edx
imul edx, eax, 0x1000193
cmp ecx, ebx
jb 0x10010125
mov edi, dword [ebp - 4]
mov eax, dword [edi + 0x18]
mov ecx, dword [ebp - 0x14]
and eax, edx
lea eax, [ecx + eax*8]
mov dword [ebp - 0x10], eax
mov eax, dword [eax + 4]
mov dword [ebp - 0x1c], eax
nop dword [eax]
mov edi, esi
mov ebx, esi
mov esi, dword [esi]
lea ecx, [edi + 8]
call fcn.10006930
push 0x38
push edi
call fcn.10030d43
mov edi, dword [ebp - 4]
add esp, 8
mov eax, dword [ebp + 0xc]
dec dword [edi + 8]
cmp ebx, dword [ebp - 0x1c]
je 0x10010191
cmp esi, eax
jne 0x10010150
mov ecx, dword [ebp - 0x10]
mov dword [ecx], esi
mov ecx, dword [ebp - 8]
pop edi
mov dword [ecx], esi
mov dword [esi + 4], ecx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
mov ecx, dword [ebp - 0x10]
mov edx, dword [ebp - 0x18]
mov dword [ecx], edx
mov dword [ecx + 4], edx
cmp esi, eax
jne 0x10010100
mov ecx, dword [ebp - 8]
pop edi
mov dword [ecx], esi
mov dword [esi + 4], ecx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x100138a0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1003598d
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
push ebx
push esi
push edi
mov eax, dword [0x10049080]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x14], esi
mov ebx, dword [ebp + 0xc]
mov dword [ebp - 0x10], ebx
cmp dword [ebx + 0x14], 7
jbe 0x100138de
mov eax, dword [ebx]
mov dword [ebp - 0x10], eax
mov edx, dword [ebx + 0x10]
mov edi, 0x811c9dc5
mov ecx, 0
add edx, edx
je 0x10013906
mov esi, dword [ebp - 0x10]
movzx eax, byte [ecx + esi]
inc ecx
xor eax, edi
imul edi, eax, 0x1000193
cmp ecx, edx
jb 0x100138f2
mov esi, dword [ebp - 0x14]
push edi
push ebx
lea eax, [ebp - 0x1c]
mov ecx, esi
push eax
call fcn.100064c0
mov ecx, dword [ebp - 0x18]
test ecx, ecx
je 0x10013937
mov eax, dword [ebp + 8]
mov dword [eax], ecx
mov byte [eax + 4], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
cmp dword [esi + 8], 0x1af286b
je 0x10013a4b
lea eax, [esi + 4]
mov dword [ebp - 0x24], eax
mov dword [ebp - 4], 0
push 0x98
mov dword [ebp - 0x20], 0
call fcn.100309f9
mov ebx, eax
add esp, 4
mov dword [ebp - 0x20], ebx
push dword [ebp + 0xc]
lea esi, [ebx + 8]
mov ecx, esi
mov dword [ebp - 0x10], esi
call fcn.10002a30
lea ecx, [esi + 0x18]
mov byte [ebp - 4], 1
call fcn.10010220
mov esi, dword [ebp - 0x14]
mov dword [ebp - 4], 2
mov eax, dword [esi + 8]
inc eax
movd xmm0, eax
cvtdq2pd xmm0, xmm0
shr eax, 0x1f
addsd xmm0, qword [eax*8 + 0x10043510]
mov eax, dword [esi + 0x1c]
cvtpd2ps xmm1, xmm0
movd xmm0, eax
cvtdq2pd xmm0, xmm0
shr eax, 0x1f
addsd xmm0, qword [eax*8 + 0x10043510]
cvtpd2ps xmm0, xmm0
divss xmm1, xmm0
comiss xmm1, dword [esi]
jbe 0x100139eb
mov ecx, esi
call fcn.1000fc40
push edi
lea eax, [ebx + 8]
mov ecx, esi
push eax
lea eax, [ebp - 0x1c]
push eax
call fcn.100064c0
mov edx, dword [eax]
jmp 0x100139ee
mov edx, dword [ebp - 0x1c]
mov eax, dword [edx + 4]
inc dword [esi + 8]
mov dword [ebx + 4], eax
mov dword [ebx], edx
mov dword [eax], ebx
mov dword [edx + 4], ebx
mov ecx, dword [esi + 0xc]
mov dword [ebp - 0x14], eax
mov eax, dword [esi + 0x18]
and eax, edi
mov edi, dword [ebp - 0x24]
mov esi, dword [ecx + eax*8]
cmp esi, dword [edi]
jne 0x10013a18
mov dword [ecx + eax*8], ebx
jmp 0x10013a2a
cmp esi, edx
jne 0x10013a21
mov dword [ecx + eax*8], ebx
jmp 0x10013a2e
mov edx, dword [ebp - 0x14]
cmp dword [ecx + eax*8 + 4], edx
jne 0x10013a2e
mov dword [ecx + eax*8 + 4], ebx
mov eax, dword [ebp + 8]
mov dword [eax], ebx
mov byte [eax + 4], 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
push str.unordered_map_set_too_long
call fcn.1002f7fa
int3
Function at 0x10013a60
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100359c5
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
push ebx
push esi
push edi
mov eax, dword [0x10049080]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x18], esi
mov ebx, dword [ebp + 0xc]
mov dword [ebp - 0x10], ebx
cmp dword [ebx + 0x14], 7
jbe 0x10013a9e
mov eax, dword [ebx]
mov dword [ebp - 0x10], eax
mov edx, dword [ebx + 0x10]
mov edi, 0x811c9dc5
mov ecx, 0
add edx, edx
je 0x10013ac6
mov esi, dword [ebp - 0x10]
movzx eax, byte [ecx + esi]
inc ecx
xor eax, edi
imul edi, eax, 0x1000193
cmp ecx, edx
jb 0x10013ab2
mov esi, dword [ebp - 0x18]
push edi
push ebx
lea eax, [ebp - 0x14]
mov ecx, esi
push eax
call fcn.100064c0
mov ecx, dword [ebp - 0x10]
test ecx, ecx
je 0x10013af7
mov eax, dword [ebp + 8]
mov dword [eax], ecx
mov byte [eax + 4], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
cmp dword [esi + 8], 0x1af286b
je 0x10013c09
lea eax, [esi + 4]
mov dword [ebp - 0x24], eax
mov dword [ebp - 4], 0
push 0x98
mov dword [ebp - 0x20], 0
call fcn.100309f9
add esp, 4
mov ebx, eax
mov dword [ebp - 0x20], ebx
push dword [ebp + 0xc]
lea ecx, [ebx + 8]
call fcn.10002a30
mov ecx, dword [ebp + 0xc]
add ecx, 0x18
push ecx
lea ecx, [ebx + 0x20]
call fcn.10006a00
mov dword [ebp - 4], 1
mov esi, dword [ebp - 0x18]
mov eax, dword [esi + 8]
inc eax
movd xmm0, eax
cvtdq2pd xmm0, xmm0
shr eax, 0x1f
addsd xmm0, qword [eax*8 + 0x10043510]
mov eax, dword [esi + 0x1c]
cvtpd2ps xmm1, xmm0
movd xmm0, eax
cvtdq2pd xmm0, xmm0
shr eax, 0x1f
addsd xmm0, qword [eax*8 + 0x10043510]
cvtpd2ps xmm0, xmm0
divss xmm1, xmm0
comiss xmm1, dword [esi]
jbe 0x10013ba9
mov ecx, esi
call fcn.1000fc40
push edi
lea eax, [ebx + 8]
mov ecx, esi
push eax
lea eax, [ebp - 0x1c]
push eax
call fcn.100064c0
mov edx, dword [eax]
jmp 0x10013bac
mov edx, dword [ebp - 0x14]
mov eax, dword [edx + 4]
inc dword [esi + 8]
mov dword [ebx + 4], eax
mov dword [ebx], edx
mov dword [eax], ebx
mov dword [edx + 4], ebx
mov ecx, dword [esi + 0xc]
mov dword [ebp - 0x18], eax
mov eax, dword [esi + 0x18]
and eax, edi
mov edi, dword [ebp - 0x24]
mov esi, dword [ecx + eax*8]
cmp esi, dword [edi]
jne 0x10013bd6
mov dword [ecx + eax*8], ebx
jmp 0x10013be8
cmp esi, edx
jne 0x10013bdf
mov dword [ecx + eax*8], ebx
jmp 0x10013bec
mov edx, dword [ebp - 0x18]
cmp dword [ecx + eax*8 + 4], edx
jne 0x10013bec
mov dword [ecx + eax*8 + 4], ebx
mov eax, dword [ebp + 8]
mov dword [eax], ebx
mov byte [eax + 4], 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
push str.unordered_map_set_too_long
call fcn.1002f7fa
int3
Function at 0x10014070
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
mov eax, dword [0x10049080]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [0x10049ce0], 0
push ebx
push esi
push edi
mov dword [ebp - 0x30], edx
mov esi, ecx
je 0x1001420c
push str.____Summary_of_all_frameworks:
call fcn.1001a320
mov eax, dword [esi]
add esp, 4
mov edx, dword [esi + 4]
mov cl, 1
mov byte [ebp - 0x1d], cl
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x28], edx
cmp eax, edx
je 0x1001420c
nop word [eax + eax]
test cl, cl
je 0x100140ce
xor cl, cl
mov byte [ebp - 0x1d], cl
jmp 0x100141fe
mov esi, dword [eax]
mov ebx, esi
cmp dword [esi + 0x14], 7
jbe 0x100140da
mov ebx, dword [esi]
mov edi, dword [esi + 0x10]
mov edx, 0x811c9dc5
mov ecx, 0
add edi, edi
je 0x10014101
nop dword [eax + eax]
movzx eax, byte [ecx + ebx]
inc ecx
xor eax, edx
imul edx, eax, 0x1000193
cmp ecx, edi
jb 0x100140f0
mov ebx, dword [ebp - 0x30]
lea eax, [ebp - 0x38]
push edx
push esi
push eax
mov ecx, ebx
call fcn.100064c0
mov esi, dword [eax + 4]
test esi, esi
jne 0x1001411b
mov esi, dword [ebx + 4]
mov eax, dword [esi + 0x24]
xorps xmm0, xmm0
movups xmmword [ebp - 0x1c], xmm0
mov dword [ebp - 0xc], 0
mov dword [ebp - 8], 0
mov edx, dword [eax*4 + 0x1003acc8]
mov eax, edx
lea edi, [eax + 2]
nop
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x10014140
sub eax, edi
lea ecx, [ebp - 0x1c]
sar eax, 1
push eax
push edx
call fcn.10002da0
mov eax, dword [ebp - 0x24]
mov ecx, dword [eax]
cmp dword [ecx + 0x2c], 7
lea eax, [ecx + 0x18]
jbe 0x10014169
mov eax, dword [eax]
cmp dword [ebp - 8], 7
lea edx, [ebp - 0x1c]
lea ebx, [esi + 0x44]
cmova edx, dword [ebp - 0x1c]
cmp dword [ebx + 0x14], 7
mov dword [ebp - 0x2c], edx
jbe 0x10014182
mov ebx, dword [ebx]
cmp dword [ecx + 0x5c], 7
lea edx, [ecx + 0x48]
jbe 0x1001418d
mov edx, dword [edx]
cmp dword [ecx + 0x44], 7
lea edi, [ecx + 0x30]
jbe 0x10014198
mov edi, dword [edi]
cmp dword [ecx + 0x14], 7
jbe 0x100141a0
mov ecx, dword [ecx]
push eax
movzx eax, byte [esi + 0x28]
push eax
push dword [ebp - 0x2c]
movzx eax, byte [esi + 0x20]
push eax
push ebx
push edx
push edi
push ecx
push str._____framework:_s__lowest_requested_version_s__found_version_s__effective_reference_version_s_apply_patches_d__version_compatibility_range_s__roll_to_highest_version_d__folder_s
call fcn.1001a320
mov ecx, dword [ebp - 8]
add esp, 0x24
cmp ecx, 7
jbe 0x100141f5
mov edx, dword [ebp - 0x1c]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x100141eb
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x1001421d
push ecx
push edx
call fcn.10030d43
add esp, 8
mov edx, dword [ebp - 0x28]
mov cl, byte [ebp - 0x1d]
mov eax, dword [ebp - 0x24]
add eax, 4
mov dword [ebp - 0x24], eax
cmp eax, edx
jne 0x100140c0
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.100309eb
mov esp, ebp
pop ebp
ret
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
Function at 0x100156b0
Capabilities:
Access peb ldr_data
Get ntdll base address
Get process heap flags

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10035c03
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x10049080]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov dword [ebp - 0x10], ebx
mov edi, dword [ebp + 8]
push edi
call fcn.10002a30
lea eax, [edi + 0x18]
mov dword [ebp - 4], 0
push eax
lea ecx, [ebx + 0x18]
call fcn.10002a30
mov byte [ebp - 4], 1
lea esi, [ebx + 0x30]
mov dword [ebp - 0x14], esi
lea ecx, [esi + 0xc]
mov eax, dword [edi + 0x30]
mov dword [esi], eax
mov eax, dword [edi + 0x34]
mov dword [esi + 4], eax
mov eax, dword [edi + 0x38]
mov dword [esi + 8], eax
lea eax, [edi + 0x3c]
push eax
call fcn.10002a30
lea eax, [edi + 0x54]
mov byte [ebp - 4], 2
push eax
lea ecx, [esi + 0x24]
call fcn.10002a30
mov eax, dword [edi + 0x6c]
mov dword [ebx + 0x6c], eax
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x10016f10
Capabilities:
Access peb ldr_data

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10035db6
mov eax, dword fs:[0]
push eax
push ebx
push ecx
push esi
mov eax, dword [0x10049080]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x14], esi
mov eax, dword [ebx + 8]
mov dword [esi + 4], eax
mov eax, dword [ebx + 0xc]
mov dword [esi], 0xabababab
movups xmm0, xmmword [eax]
movups xmmword [esi + 8], xmm0
movq xmm0, qword [eax + 0x10]
mov eax, dword [ebx + 0x10]
movq qword [esi + 0x18], xmm0
movups xmm0, xmmword [eax]
movups xmmword [esi + 0x20], xmm0
movups xmm0, xmmword [eax + 0x10]
movups xmmword [esi + 0x30], xmm0
mov dword [esi + 0x44], 0
mov dword [esi + 0x48], 0
mov dword [esi + 0x4c], 0
lea ecx, [esi + 0x50]
mov dword [ebp - 4], 0
call fcn.10016fe0
lea ecx, [esi + 0x70]
mov byte [ebp - 4], 1
call fcn.10016fe0
lea ecx, [esi + 0x90]
mov byte [ebp - 4], 2
call fcn.10005c70
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret 0xc