joyce8/EMBER2024-capa huggingface dataset:
Function at 0x468cc5
Capabilities:
Check for time delay via gettickcount
Check for time delay via queryperformancecounter

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
xor eax, eax
push ebx
mov ebx, dword [ebp + 0x10]
push esi
mov esi, ecx
inc eax
and dword [esi + 0x28], 0
and dword [ebx], 0
cmp dword [ebp + 0xc], 0
push edi
jbe 0x468e87
cmp dword [esi + 0x64], 0x2710
jbe 0x468d04
cmp dword [esi + 0x5c], 0
je 0x468d04
mov ecx, esi
call fcn.0046906a
mov edi, eax
imul edi, edi, 0xf
jmp 0x468d09
mov edi, 0x5dc
push 1
test edi, edi
pop eax
cmove edi, eax
cmp byte [esi + 0x98], 0
je 0x468d26
lea eax, [ebp - 0x20]
push eax
call dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
jmp 0x468d33
call dword [sym.imp.KERNEL32.dll_GetTickCount]
and dword [ebp - 0x1c], 0
mov dword [ebp - 0x20], eax
push dword [esi + 0xc]
call dword [sym.imp.KERNEL32.dll_ResetEvent]
lea eax, [ebp - 4]
mov dword [esi + 0x28], eax
mov eax, dword [ebp + 0xc]
sub eax, dword [ebx]
cmp eax, edi
cmovb edi, eax
lea eax, [ebp - 4]
push eax
mov eax, dword [ebp + 8]
add eax, dword [ebx]
push edi
push eax
push dword [esi + 4]
call fcn.00467c8c
add esp, 0x10
test eax, eax
jne 0x468d7e
mov eax, dword [esi]
push 0
lea ecx, [esi + 0xc]
push ecx
push dword [esi + 0x2c]
mov ecx, esi
call dword [eax + 8]
test al, al
je 0x468e8e
cmp byte [esi + 0x98], 0
je 0x468d99
lea eax, [ebp - 0x18]
push eax
call dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov ebx, dword [ebp - 0x14]
mov edi, dword [ebp - 0x18]
jmp 0x468da9
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov edi, eax
xor ebx, ebx
mov dword [ebp - 0x18], edi
mov dword [ebp - 0x14], ebx
mov eax, dword [ebp - 4]
test eax, eax
je 0x468e84
mov ecx, dword [ebp + 0x10]
add dword [ecx], eax
add dword [esi + 0x54], eax
add dword [esi + 0x5c], eax
add dword [esi + 0x68], eax
sub edi, dword [ebp - 0x20]
sbb ebx, dword [ebp - 0x1c]
mov eax, edi
or eax, ebx
jne 0x468dd3
push 5
pop edi
xor ebx, ebx
push 0
push 0x3e8
push ebx
push edi
call fcn.00477120
mov ecx, dword [esi + 0x94]
mov dword [ebp - 8], eax
mov eax, dword [esi + 0x90]
mov dword [ebp - 0xc], edx
cmp edx, ecx
jl 0x468e26
mov edx, dword [ebp - 8]
jg 0x468e00
cmp edx, eax
jb 0x468e26
push ecx
push eax
push dword [ebp - 0xc]
push edx
call fcn.0047bf60
add dword [esi + 0x64], eax
add dword [esi + 0x70], eax
push 0
push 0x3e8
push ebx
push ecx
mov dword [ebp - 0xc], edx
call fcn.004769c0
mov edi, eax
mov ebx, edx
push 0
push 0xf4240
push ebx
push edi
call fcn.00477120
push dword [esi + 0x94]
push dword [esi + 0x90]
push edx
push eax
call fcn.004769c0
add dword [esi + 0x60], eax
add dword [esi + 0x6c], eax
mov ecx, 0x3e8
cmp dword [esi + 0x60], ecx
jbe 0x468e64
mov eax, dword [esi + 0x60]
xor edx, edx
div ecx
add dword [esi + 0x64], eax
mov dword [esi + 0x60], edx
cmp dword [esi + 0x6c], ecx
jbe 0x468e76
mov eax, dword [esi + 0x6c]
xor edx, edx
div ecx
add dword [esi + 0x70], eax
mov dword [esi + 0x6c], edx
mov ebx, dword [ebp + 0x10]
mov eax, dword [ebp + 0xc]
cmp dword [ebx], eax
jb 0x468ce7
xor eax, eax
inc eax
pop edi
pop esi
pop ebx
leave
ret 0xc
xor al, al
jmp 0x468e87
Function at 0x46906a
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_GetTickCount]
push esi
push edi
mov esi, ecx
call ebx
sub eax, dword [esi + 0x74]
xor edi, edi
cmp eax, 0x7530
jbe 0x4690a7
mov eax, dword [esi + 0x68]
mov dword [esi + 0x5c], eax
mov eax, dword [esi + 0x70]
mov dword [esi + 0x64], eax
mov eax, dword [esi + 0x6c]
mov dword [esi + 0x68], edi
mov dword [esi + 0x70], edi
mov dword [esi + 0x60], eax
mov dword [esi + 0x6c], edi
call ebx
mov dword [esi + 0x74], eax
mov ecx, dword [esi + 0x64]
test ecx, ecx
jne 0x4690b3
mov eax, dword [esi + 0x5c]
jmp 0x4690ff
push 0xa
pop ebx
mov dword [ebp - 4], edi
test edi, edi
jne 0x4690fd
or eax, 0xffffffff
xor edx, edx
div ebx
mov edi, dword [esi + 0x5c]
cmp edi, eax
jbe 0x4690d5
shr edi, 1
shr ecx, 1
mov dword [esi + 0x5c], edi
mov dword [esi + 0x64], ecx
mov eax, dword [esi + 0x5c]
mov ecx, dword [esi + 0x64]
imul eax, ebx
xor edx, edx
div ecx
xor edx, edx
imul eax, eax, 0x3e8
div ebx
imul ebx, ebx, 0xa
mov edi, eax
mov eax, dword [ebp - 4]
inc eax
mov dword [ebp - 4], eax
cmp eax, 3
jb 0x4690b9
mov eax, edi
pop edi
pop esi
pop ebx
leave
ret
Function at 0x46c3c6
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 0xc]
push esi
xor eax, eax
push edi
mov edi, ecx
test ebx, ebx
je 0x46c3e8
push 1
push eax
push eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov dword [ebx], eax
xor eax, eax
lea esi, [edi + 0x70]
push esi
push eax
push eax
push eax
push 2
push dword [edi + 0x10]
call fcn.00469ec8
add esp, 0x18
test eax, eax
jne 0x46c410
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [edi + 0x78], eax
xor al, al
jmp 0x46c4b2
push dword [esi]
call fcn.00474bb7
mov esi, eax
pop ecx
cmp esi, dword [edi + 0x6c]
je 0x46c428
push dword [edi + 0x6c]
call fcn.00472d16
pop ecx
push 0
mov dword [edi + 0x6c], esi
call fcn.00472d16
lea esi, [edi + 0x70]
push esi
push dword [edi + 0x6c]
push 0
push 0
push 2
push dword [edi + 0x10]
call fcn.00469ec8
add esp, 0x1c
test eax, eax
je 0x46c400
push 0
lea eax, [ebp + 0xc]
push eax
push 4
push esi
push dword [ebp + 8]
mov esi, dword [sym.imp.KERNEL32.dll_WriteFile]
call esi
push 0
lea eax, [edi + 0x70]
push eax
push dword [eax]
push dword [edi + 0x6c]
push dword [ebp + 8]
call esi
test byte [ebp + 0x10], 1
jne 0x46c499
push 0
push dword [ebp + 8]
push 1
push 1
push 0x10001
push dword [edi + 0xc]
call fcn.00469c33
add esp, 0x18
test eax, eax
je 0x46c400
test ebx, ebx
je 0x46c4b0
push 1
push 0
push 0
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
sub eax, dword [ebx]
mov dword [ebx], eax
mov al, 1
pop edi
pop esi
pop ebx
pop ebp
ret 0xc

Function at 0x46ce43
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
xor ebx, ebx
push ebx
push 0x80
push 3
push ebx
push 1
push SysReAllocStringLen
push dword [ebp + 8]
mov edi, ecx
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
jne 0x46ce75
xor eax, eax
jmp 0x46cf27
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov ebx, eax
lea eax, [ebx + 1]
push eax
call fcn.004521fb
pop ecx
push 0
lea ecx, [ebp + 8]
push ecx
push ebx
push eax
push esi
mov dword [ebp - 4], eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
cmp ebx, dword [ebp + 8]
jne 0x46ce6e
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea ecx, [edi + 0x2c]
call fcn.0046da2d
lea esi, [edi + 0x20]
mov ecx, esi
push dword [esi + 4]
push dword [esi]
call fcn.00455ca2
mov eax, dword [esi]
push 0
push 0x4cb3ac
mov ecx, edi
mov dword [esi + 4], eax
call fcn.00404c70
mov esi, dword [ebp - 4]
mov ecx, edi
mov byte [esi + ebx], 0
mov dword [edi + 0x38], esi
call fcn.0046cc85
push eax
push 0
mov ecx, edi
call fcn.0046cf2e
test eax, eax
je 0x46ce6e
mov ecx, edi
call fcn.0046cc85
push eax
push 9
mov ecx, edi
call fcn.0046cf2e
test eax, eax
je 0x46ce6e
push edi
mov ecx, edi
call fcn.0046d474
test eax, eax
je 0x46ce6e
push esi
call fcn.00473c4d
xor eax, eax
pop ecx
inc eax
pop edi
pop esi
pop ebx
leave
ret 4
Function at 0x46e279
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
and dword [eax + 0x14], 0
and dword [eax + 0x10], 0
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
pop ebp
ret

Function at 0x46ec1f
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
lea eax, [ebp - 8]
push eax
push dword [ebp + 8]
mov ebx, ecx
call sub.VERSION.dll_GetFileVersionInfoSizeW
mov dword [ebp - 4], eax
test eax, eax
jne 0x46ec42
xor al, al
jmp 0x46ecdc
push eax
call fcn.004521fb
pop ecx
push eax
push dword [ebp - 4]
mov dword [ebx + 0x40], eax
push dword [ebp - 8]
push dword [ebp + 8]
call sub.VERSION.dll_GetFileVersionInfoW
test eax, eax
je 0x46ec3b
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0xc]
push eax
push 0x4b6f58
push dword [ebx + 0x40]
call sub.VERSION.dll_VerQueryValueW
test eax, eax
je 0x46ec3b
push esi
mov esi, dword [ebp - 0xc]
push edi
push 0xd
pop ecx
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x10]
push eax
lea edi, [ebx + 4]
push str.VarFileInfoTranslation
rep movsd dword es:[edi], dword [esi]
push dword [ebx + 0x40]
call sub.VERSION.dll_VerQueryValueW
pop edi
pop esi
test eax, eax
je 0x46ecda
mov eax, dword [ebp - 4]
shr eax, 2
xor ecx, ecx
push 4
pop edx
mov dword [ebx + 0x3c], eax
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.004521fb
xor edx, edx
pop ecx
mov dword [ebx + 0x38], eax
cmp dword [ebx + 0x3c], edx
jbe 0x46ecda
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebx + 0x38]
mov eax, dword [eax + edx*4]
mov dword [ecx + edx*4], eax
inc edx
cmp edx, dword [ebx + 0x3c]
jb 0x46ecc8
mov al, 1
pop ebx
leave
ret 4
Function at 0x471180
Capabilities:
Get file size
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4b26f8
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push ebx
push esi
push edi
mov eax, dword [0x4ed0f0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], ecx
or esi, 0xffffffff
mov dword [ebp - 4], 0
xor edi, edi
push edi
push 0x80
push 3
push edi
push 1
push SysReAllocStringLen
push dword [ebp + 8]
mov byte [ebp - 4], 2
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov ebx, eax
cmp ebx, esi
je 0x471239
push edi
push edi
push edi
push 2
push edi
mov esi, ebx
push ebx
mov dword [ebp - 0x14], esi
call dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
test eax, eax
je 0x471239
push 0
push 0
push 0
push 4
mov edi, eax
push eax
mov dword [ebp - 0x18], edi
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov dword [ebp + 8], eax
test eax, eax
je 0x471239
push dword [ebp + 0xc]
mov dword [ebp - 0x1c], eax
push 0
push ebx
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov ebx, dword [ebp + 8]
mov ecx, dword [ebp - 0x10]
push eax
push ebx
call fcn.00470f20
mov eax, dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov byte [ebp + 0xb], 1
test eax, eax
je 0x47123d
push ebx
call eax
jmp 0x47123d
mov byte [ebp + 0xb], 0
mov ebx, dword [sym.imp.KERNEL32.dll_CloseHandle]
test edi, edi
je 0x47124e
test ebx, ebx
je 0x47124e
push edi
call ebx
cmp esi, 0xffffffff
je 0x47125a
test ebx, ebx
je 0x47125a
push esi
call ebx
mov al, byte [ebp + 0xb]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x48c346
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push edi
call fcn.0047d1b2
mov esi, dword [ebp + 8]
push 2
mov edi, eax
lea eax, [ebp - 4]
push eax
mov ecx, esi
and ecx, 0x3ff
push 0x20000001
or ecx, 0x400
push ecx
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
jne 0x48c37e
xor eax, eax
jmp 0x48c3aa
cmp esi, dword [ebp - 4]
je 0x48c3a7
cmp dword [ebp + 0xc], 0
je 0x48c3a7
push dword [edi + 0x9c]
call fcn.0048bf54
push dword [edi + 0x9c]
mov esi, eax
call fcn.00473c34
pop ecx
pop ecx
cmp esi, eax
je 0x48c37a
xor eax, eax
inc eax
pop edi
pop esi
leave
ret
Function at 0x48d412
Capabilities:
Link many functions at runtime
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x4ed0f0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_EncodePointer]
push esi
push edi
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp + 0xc]
xor edi, edi
push edi
mov dword [ebp - 0x20], eax
call ebx
mov esi, eax
mov dword [ebp - 0x18], esi
call fcn.00485078
mov dword [ebp - 0x14], eax
cmp dword [0x4f39f4], edi
jne 0x48d503
push 0x800
push edi
push 0x4c5280
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov esi, eax
test esi, esi
jne 0x48d490
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x57
jne 0x48d5e3
push 0x4c5280
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov esi, eax
test esi, esi
je 0x48d5e3
push 0x4c5298
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x48d5e3
push eax
call ebx
push str.GetActiveWindow
push esi
mov dword [0x4f39f4], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetLastActivePopup
push esi
mov dword [0x4f39f8], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetUserObjectInformationW
push esi
mov dword [0x4f39fc], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x4f3a04], eax
test eax, eax
je 0x48d500
push str.GetProcessWindowStation
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x4f3a00], eax
mov esi, dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x48d528
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x48d51b
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp dword [ebp - 0x14], edi
je 0x48d53d
push 4
pop eax
jmp 0x48d5e5
cmp dword [ebp - 0x14], edi
je 0x48d53d
push dword [0x4f39f4]
call dword [sym.imp.KERNEL32.dll_DecodePointer]
push 3
jmp 0x48d522
mov eax, dword [0x4f3a00]
mov ebx, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, esi
je 0x48d59b
cmp dword [0x4f3a04], esi
je 0x48d59b
push eax
call ebx
push dword [0x4f3a04]
mov dword [ebp - 0x14], eax
call ebx
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
test ecx, ecx
je 0x48d59b
test eax, eax
je 0x48d59b
call ecx
test eax, eax
je 0x48d590
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call dword [ebp - 0x18]
test eax, eax
je 0x48d590
test byte [ebp - 8], 1
jne 0x48d59b
mov esi, dword [ebp + 0x10]
or esi, 0x200000
jmp 0x48d5cb
mov eax, dword [0x4f39f8]
cmp eax, esi
je 0x48d5c8
push eax
call ebx
test eax, eax
je 0x48d5c8
call eax
mov edi, eax
test edi, edi
je 0x48d5c8
mov eax, dword [0x4f39fc]
cmp eax, esi
je 0x48d5c8
push eax
call ebx
test eax, eax
je 0x48d5c8
push edi
call eax
mov edi, eax
mov esi, dword [ebp + 0x10]
push dword [0x4f39f4]
call ebx
test eax, eax
je 0x48d5e3
push esi
push dword [ebp - 0x20]
push dword [ebp - 0x1c]
push edi
call eax
jmp 0x48d5e5
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00473c52
leave
ret
Function at 0x10005450
Capabilities:
Resolve function by parsing pe exports

Disassembly:
lea edx, [ecx + 0x98]
mov dword [edx], 0x7c
mov dword [edx + 4], 0x16041101
mov eax, dword [ecx + 0x1c]
sub eax, dword [ecx + 0x18]
sar eax, 2
mov dword [edx + 8], eax
mov eax, dword [ecx + 0x18]
mov dword [edx + 0xc], eax
mov eax, dword [ecx + 0x28]
sub eax, dword [ecx + 0x24]
sar eax, 2
mov dword [edx + 0x10], eax
mov eax, dword [ecx + 0x24]
mov dword [edx + 0x14], eax
mov eax, dword [ecx + 0x124]
push esi
mov esi, dword [ecx + 0x120]
sub eax, esi
sar eax, 2
cmp eax, 1
jbe 0x100054bb
mov eax, dword [esi + 4]
mov dword [edx + 0x1c], eax
mov eax, dword [ecx + 0x138]
mov eax, dword [eax + 4]
mov dword [edx + 0x18], eax
mov eax, dword [ecx + 0x150]
mov eax, dword [eax + 4]
jmp 0x100054ce
mov dword [edx + 0x1c], 0x10036b98
mov eax, 0x10036b98
mov dword [edx + 0x18], 0x10036b98
mov dword [edx + 0x44], eax
lea eax, [ecx + 0x48]
cmp dword [eax + 0x14], 7
jbe 0x100054dc
mov eax, dword [eax]
mov dword [edx + 0x20], eax
lea eax, [ecx + 0x60]
cmp dword [eax + 0x14], 7
jbe 0x100054ea
mov eax, dword [eax]
mov dword [edx + 0x40], eax
movzx eax, byte [ecx + 0x78]
mov dword [edx + 0x24], eax
mov eax, dword [ecx + 0x8c]
sub eax, dword [ecx + 0x88]
sar eax, 2
mov dword [edx + 0x28], eax
mov eax, dword [ecx + 0x88]
mov dword [edx + 0x2c], eax
mov dword [edx + 0x30], 1
mov dword [edx + 0x34], 0
mov eax, dword [ecx + 0x94]
mov dword [edx + 0x38], eax
lea eax, [ecx + 0x30]
cmp dword [eax + 0x14], 7
jbe 0x10005531
mov eax, dword [eax]
mov dword [edx + 0x3c], eax
mov eax, dword [ecx + 0x124]
sub eax, dword [ecx + 0x120]
sar eax, 2
mov dword [edx + 0x48], eax
mov eax, dword [ecx + 0x120]
mov dword [edx + 0x4c], eax
mov eax, dword [ecx + 0x13c]
sub eax, dword [ecx + 0x138]
sar eax, 2
mov dword [edx + 0x50], eax
mov eax, dword [ecx + 0x138]
mov dword [edx + 0x54], eax
mov eax, dword [ecx + 0x154]
sub eax, dword [ecx + 0x150]
sar eax, 2
mov dword [edx + 0x58], eax
mov eax, dword [ecx + 0x150]
mov dword [edx + 0x5c], eax
mov eax, dword [ecx + 0x16c]
sub eax, dword [ecx + 0x168]
sar eax, 2
mov dword [edx + 0x60], eax
mov eax, dword [ecx + 0x168]
mov dword [edx + 0x64], eax
lea eax, [ecx + 0x180]
cmp dword [eax + 0x14], 7
jbe 0x100055ae
mov eax, dword [eax]
mov dword [edx + 0x68], eax
lea eax, [ecx + 0x198]
cmp dword [eax + 0x14], 7
jbe 0x100055bf
mov eax, dword [eax]
mov dword [edx + 0x6c], eax
lea eax, [ecx + 0x1b0]
cmp dword [eax + 0x14], 7
jbe 0x100055d0
mov eax, dword [eax]
add ecx, 0x1c8
mov dword [edx + 0x70], eax
cmp dword [ecx + 0x14], 7
jbe 0x100055e1
mov ecx, dword [ecx]
mov dword [edx + 0x74], ecx
mov eax, edx
mov ecx, dword [0x10044d90]
mov dword [edx + 0x78], 0
test ecx, ecx
je 0x100055fd
mov ecx, dword [ecx + 0x38]
mov dword [edx + 0x78], ecx
pop esi
ret
Function at 0x1000ef80
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1003000d
mov eax, dword fs:[0]
push eax
sub esp, 0x2c
push ebx
push esi
push edi
mov eax, dword [0x10044080]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edx, ecx
mov dword [ebp - 0x10], edx
mov esi, dword [ebp + 8]
mov edi, dword [ebp + 0xc]
cmp esi, edi
je 0x1000f152
nop dword [eax + eax]
cmp dword [esi + 0x1c], 7
lea eax, [esi + 8]
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], eax
jbe 0x1000efd4
mov ecx, dword [eax]
mov dword [ebp - 0x14], ecx
mov eax, dword [eax + 0x10]
mov ebx, 0x811c9dc5
add eax, eax
mov ecx, 0
mov dword [ebp - 0x1c], eax
je 0x1000f007
mov edi, dword [ebp - 0x14]
mov edx, eax
nop dword [eax]
movzx eax, byte [edi + ecx]
inc ecx
xor eax, ebx
imul ebx, eax, 0x1000193
cmp ecx, edx
jb 0x1000eff0
mov edi, dword [ebp + 0xc]
mov edx, dword [ebp - 0x10]
push ebx
lea eax, [esi + 8]
mov ecx, edx
push eax
lea eax, [ebp - 0x24]
push eax
call fcn.100064c0
cmp dword [ebp - 0x20], 0
jne 0x1000f141
mov eax, dword [ebp - 0x10]
cmp dword [eax + 8], 0x4924924
je 0x1000f166
add eax, 4
mov dword [ebp - 0x2c], eax
mov dword [ebp - 4], 0
push 0x38
mov dword [ebp - 0x28], 0
call fcn.1002b6a8
mov edi, eax
add esp, 4
mov dword [ebp - 0x28], edi
push dword [ebp - 0x18]
lea esi, [edi + 8]
mov ecx, esi
mov dword [ebp - 0x1c], esi
call fcn.10002a90
mov eax, dword [ebp - 0x18]
lea ecx, [esi + 0x18]
add eax, 0x18
mov byte [ebp - 4], 1
push eax
call fcn.10002a90
mov esi, dword [ebp - 0x10]
mov dword [ebp - 4], 2
mov eax, dword [esi + 8]
inc eax
movd xmm0, eax
cvtdq2pd xmm0, xmm0
shr eax, 0x1f
addsd xmm0, qword [eax*8 + 0x1003e4f0]
mov eax, dword [esi + 0x1c]
cvtpd2ps xmm1, xmm0
movd xmm0, eax
cvtdq2pd xmm0, xmm0
shr eax, 0x1f
addsd xmm0, qword [eax*8 + 0x1003e4f0]
cvtpd2ps xmm0, xmm0
divss xmm1, xmm0
comiss xmm1, dword [esi]
seta al
test al, al
je 0x1000f0ea
mov ecx, esi
call fcn.1000f320
push ebx
lea eax, [edi + 8]
mov ecx, esi
push eax
lea eax, [ebp - 0x34]
push eax
call fcn.100064c0
mov edx, dword [eax]
mov eax, dword [eax + 4]
mov dword [ebp - 0x24], edx
mov dword [ebp - 0x20], eax
jmp 0x1000f0ed
mov edx, dword [ebp - 0x24]
mov eax, dword [edx + 4]
inc dword [esi + 8]
mov dword [edi + 4], eax
mov dword [edi], edx
mov dword [eax], edi
mov dword [edx + 4], edi
mov ecx, dword [esi + 0xc]
mov dword [ebp - 0x1c], eax
mov eax, dword [esi + 0x18]
and eax, ebx
mov dword [ebp - 0x28], 0
mov ebx, dword [ebp - 0x2c]
mov esi, dword [ecx + eax*8]
cmp esi, dword [ebx]
jne 0x1000f11e
mov dword [ecx + eax*8], edi
jmp 0x1000f130
cmp esi, edx
jne 0x1000f127
mov dword [ecx + eax*8], edi
jmp 0x1000f134
mov edx, dword [ebp - 0x1c]
cmp dword [ecx + eax*8 + 4], edx
jne 0x1000f134
mov dword [ecx + eax*8 + 4], edi
mov dword [ebp - 4], 0xffffffff
mov edi, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
mov esi, dword [esi]
mov dword [ebp + 8], esi
cmp esi, edi
je 0x1000f152
mov edx, dword [ebp - 0x10]
jmp 0x1000efc0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
push str.unordered_map_set_too_long
call fcn.1002a80a
int3
Function at 0x1000f6a0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
mov dword [ebp - 4], ecx
cmp edx, eax
je 0x1000f81b
cmp dword [edx + 0x1c], 7
mov eax, dword [ecx + 4]
push ebx
mov dword [ebp - 0x18], eax
lea ebx, [edx + 8]
mov eax, dword [ecx + 0xc]
mov dword [ebp - 0x14], eax
mov eax, dword [edx + 4]
push esi
mov dword [ebp - 8], eax
mov esi, edx
mov dword [ebp - 0xc], ebx
jbe 0x1000f6de
mov eax, dword [ebx]
mov dword [ebp - 0xc], eax
mov ebx, dword [ebx + 0x10]
mov edx, 0
push edi
mov edi, 0x811c9dc5
add ebx, ebx
je 0x1000f707
mov ecx, dword [ebp - 0xc]
movzx eax, byte [ecx + edx]
inc edx
xor eax, edi
imul edi, eax, 0x1000193
cmp edx, ebx
jb 0x1000f6f3
mov ecx, dword [ebp - 4]
mov eax, dword [ecx + 0x18]
mov ecx, dword [ebp - 0x14]
and eax, edi
lea eax, [ecx + eax*8]
mov ecx, dword [eax]
mov dword [ebp - 0xc], eax
mov eax, dword [eax + 4]
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0x1c], eax
mov edi, esi
mov ebx, esi
mov esi, dword [esi]
lea ecx, [edi + 8]
call fcn.10006930
push 0x38
push edi
call fcn.1002b9f2
mov edi, dword [ebp - 4]
add esp, 8
dec dword [edi + 8]
cmp ebx, dword [ebp - 0x1c]
je 0x1000f76d
mov eax, dword [ebp + 0xc]
cmp esi, eax
jne 0x1000f720
mov ecx, dword [ebp - 0x10]
cmp ecx, dword [ebp + 8]
jne 0x1000f810
mov ecx, dword [ebp - 0xc]
pop edi
mov dword [ecx], esi
mov ecx, dword [ebp - 8]
mov dword [ecx], esi
mov dword [esi + 4], ecx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
mov ecx, dword [ebp - 0x10]
cmp ecx, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
jne 0x1000f77f
mov eax, dword [ebp - 0x18]
mov dword [ecx], eax
jmp 0x1000f782
mov eax, dword [ebp - 8]
mov dword [ecx + 4], eax
mov eax, dword [ebp + 0xc]
cmp esi, eax
je 0x1000f810
cmp dword [esi + 0x1c], 7
lea ebx, [esi + 8]
mov dword [ebp - 0x10], ebx
jbe 0x1000f7a1
mov eax, dword [ebx]
mov dword [ebp - 0x10], eax
mov ebx, dword [ebx + 0x10]
mov edx, 0x811c9dc5
mov ecx, 0
add ebx, ebx
je 0x1000f7c9
mov edi, dword [ebp - 0x10]
movzx eax, byte [edi + ecx]
inc ecx
xor eax, edx
imul edx, eax, 0x1000193
cmp ecx, ebx
jb 0x1000f7b5
mov edi, dword [ebp - 4]
mov eax, dword [edi + 0x18]
mov ecx, dword [ebp - 0x14]
and eax, edx
lea eax, [ecx + eax*8]
mov dword [ebp - 0x10], eax
mov eax, dword [eax + 4]
mov dword [ebp - 0x1c], eax
nop dword [eax]
mov edi, esi
mov ebx, esi
mov esi, dword [esi]
lea ecx, [edi + 8]
call fcn.10006930
push 0x38
push edi
call fcn.1002b9f2
mov edi, dword [ebp - 4]
add esp, 8
mov eax, dword [ebp + 0xc]
dec dword [edi + 8]
cmp ebx, dword [ebp - 0x1c]
je 0x1000f821
cmp esi, eax
jne 0x1000f7e0
mov ecx, dword [ebp - 0x10]
mov dword [ecx], esi
mov ecx, dword [ebp - 8]
pop edi
mov dword [ecx], esi
mov dword [esi + 4], ecx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
mov ecx, dword [ebp - 0x10]
mov edx, dword [ebp - 0x18]
mov dword [ecx], edx
mov dword [ecx + 4], edx
cmp esi, eax
jne 0x1000f790
mov ecx, dword [ebp - 8]
pop edi
mov dword [ecx], esi
mov dword [esi + 4], ecx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8