joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10030590
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
mov eax, dword [0x103090f4]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
call fcn.10013d50
mov edi, eax
lea eax, [ebp - 0x14]
push eax
push dword [0x1030a008]
call dword [sym.imp.USER32.dll_GetClientRect]
mov ecx, dword [ebp - 0xc]
mov eax, dword [ebp - 8]
sub eax, dword [ebp - 0x10]
sub ecx, dword [ebp - 0x14]
movd xmm0, eax
lea eax, [ebp - 0x24]
movd xmm1, ecx
cvtdq2ps xmm1, xmm1
push eax
cvtdq2ps xmm0, xmm0
movss dword [edi + 8], xmm1
movss dword [edi + 0xc], xmm0
call dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov ecx, dword [ebp - 0x24]
sub ecx, dword [0x1030a010]
mov edx, dword [ebp - 0x20]
sbb edx, dword [0x1030a014]
call fcn.100e1530
mov edx, dword [0x1030a01c]
mov ecx, dword [0x1030a018]
cvtsd2ss xmm0, xmm0
movss dword [ebp - 0x18], xmm0
call fcn.100e1530
movss xmm1, dword [ebp - 0x18]
cvtsd2ss xmm0, xmm0
mov esi, dword [sym.imp.USER32.dll_GetKeyState]
push 0x11
divss xmm1, xmm0
movss dword [edi + 0x10], xmm1
mov eax, dword [ebp - 0x24]
mov ecx, dword [ebp - 0x20]
mov dword [0x1030a010], eax
mov dword [0x1030a014], ecx
call esi
shr eax, 0xf
and al, 1
push 0x10
mov byte [edi + 0xf8], al
call esi
shr eax, 0xf
and al, 1
push 0x12
mov byte [edi + 0xf9], al
call esi
shr eax, 0xf
and al, 1
mov byte [edi + 0xfb], 0
mov byte [edi + 0xfa], al
call fcn.10013d50
cmp byte [eax + 0x353], 0
lea esi, [eax + 0xe0]
je 0x100306b7
cvttss2si eax, dword [eax + 0xe4]
cvttss2si ecx, dword [esi]
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x1c]
push eax
push dword [0x1030a008]
mov dword [ebp - 0x1c], ecx
call dword [sym.imp.USER32.dll_ClientToScreen]
push dword [ebp - 0x18]
push dword [ebp - 0x1c]
call dword [sym.imp.USER32.dll_SetCursorPos]
mov dword [esi], 0xff7fffff
mov dword [esi + 4], 0xff7fffff
call dword [sym.imp.USER32.dll_GetForegroundWindow]
test eax, eax
je 0x1003071f
mov ecx, dword [0x1030a008]
cmp eax, ecx
je 0x100306e4
push ecx
push eax
call dword [sym.imp.USER32.dll_IsChild]
test eax, eax
je 0x1003071f
lea eax, [ebp - 0x2c]
push eax
call dword [sym.imp.USER32.dll_GetCursorPos]
test eax, eax
je 0x1003071f
lea eax, [ebp - 0x2c]
push eax
push dword [0x1030a008]
call dword [sym.imp.USER32.dll_ScreenToClient]
test eax, eax
je 0x1003071f
movd xmm0, dword [ebp - 0x2c]
movd xmm1, dword [ebp - 0x28]
cvtdq2ps xmm0, xmm0
cvtdq2ps xmm1, xmm1
movss dword [esi], xmm0
movss dword [esi + 4], xmm1
cmp byte [edi + 0xa8], 0
pop edi
pop esi
je 0x1003072f
or eax, 0xffffffff
jmp 0x10030734
call fcn.10013d60
cmp dword [0x10173350], eax
je 0x10030746
mov dword [0x10173350], eax
call fcn.10030760
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100e1332
mov esp, ebp
pop ebp
ret
Function at 0x1005c310
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, dword [ebp + 0xc]
push edi
mov eax, dword [ebx]
mov edi, dword [ebp + 0x10]
cmp edi, 7
ja case.default.0x1005c326
jmp dword [edi*4 + 0x1005c4bc]
mov ecx, esi
and ecx, 3
sub edi, ecx
sub ecx, 1
je 0x1005c369
sub ecx, 1
je 0x1005c356
sub ecx, 1
jne 0x1005c37c
movzx edx, byte [esi]
movzx ecx, al
xor edx, ecx
shr eax, 8
xor eax, dword [edx*4 + 0x1014bf18]
inc esi
movzx edx, byte [esi]
movzx ecx, al
xor edx, ecx
shr eax, 8
xor eax, dword [edx*4 + 0x1014bf18]
inc esi
movzx edx, byte [esi]
movzx ecx, al
xor edx, ecx
shr eax, 8
xor eax, dword [edx*4 + 0x1014bf18]
inc esi
mov edx, edi
sar edx, 3
test edx, edx
je 0x1005c3fe
xor eax, dword [esi]
movzx ecx, al
shr eax, 8
xor eax, dword [ecx*4 + 0x1014bf18]
movzx ecx, al
shr eax, 8
xor eax, dword [ecx*4 + 0x1014bf18]
movzx ecx, al
shr eax, 8
xor eax, dword [ecx*4 + 0x1014bf18]
mov ecx, eax
movzx eax, cl
shr ecx, 8
mov eax, dword [eax*4 + 0x1014bf18]
xor eax, dword [esi + 4]
add esi, 8
xor eax, ecx
movzx ecx, al
shr eax, 8
xor eax, dword [ecx*4 + 0x1014bf18]
movzx ecx, al
shr eax, 8
xor eax, dword [ecx*4 + 0x1014bf18]
movzx ecx, al
shr eax, 8
xor eax, dword [ecx*4 + 0x1014bf18]
movzx ecx, al
shr eax, 8
xor eax, dword [ecx*4 + 0x1014bf18]
sub edx, 1
jne 0x1005c385
and edi, 7
jmp 0x1005c321
movzx edx, byte [esi]
movzx ecx, al
xor edx, ecx
shr eax, 8
xor eax, dword [edx*4 + 0x1014bf18]
inc esi
movzx edx, byte [esi]
movzx ecx, al
xor edx, ecx
shr eax, 8
xor eax, dword [edx*4 + 0x1014bf18]
inc esi
movzx edx, byte [esi]
movzx ecx, al
xor edx, ecx
shr eax, 8
xor eax, dword [edx*4 + 0x1014bf18]
inc esi
xor eax, dword [esi]
movzx ecx, al
shr eax, 8
pop edi
pop esi
xor eax, dword [ecx*4 + 0x1014bf18]
movzx ecx, al
shr eax, 8
xor eax, dword [ecx*4 + 0x1014bf18]
movzx ecx, al
shr eax, 8
xor eax, dword [ecx*4 + 0x1014bf18]
movzx ecx, al
shr eax, 8
xor eax, dword [ecx*4 + 0x1014bf18]
mov dword [ebx], eax
pop ebx
pop ebp
ret
movzx edx, byte [esi]
movzx ecx, al
xor edx, ecx
shr eax, 8
xor eax, dword [edx*4 + 0x1014bf18]
inc esi
movzx edx, byte [esi]
movzx ecx, al
xor edx, ecx
shr eax, 8
xor eax, dword [edx*4 + 0x1014bf18]
inc esi
movzx edx, byte [esi]
movzx ecx, al
xor edx, ecx
shr eax, 8
xor eax, dword [edx*4 + 0x1014bf18]
pop edi
pop esi
mov dword [ebx], eax
pop ebx
pop ebp
ret
Function at 0x1005c9d0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push esi
push 0x200
mov esi, ecx
push 0
push esi
call sub.VCRUNTIME140.dll_memset
push 4
call fcn.100e0fda
add esp, 0x10
test eax, eax
je 0x1005c9f8
mov dword [eax], esi
jmp 0x1005c9fa
xor eax, eax
lea ecx, [ebp - 4]
push ecx
push 0
push eax
push 0x1005c760
push 0
push 0
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
add esp, 0x18
mov dword [ebp - 8], eax
test eax, eax
je 0x1005ca36
mov ecx, dword [ebp - 4]
test ecx, ecx
je 0x1005ca44
push ecx
push eax
call sub.MSVCP140.dll__Thrd_detach
add esp, 8
test eax, eax
jne 0x1005ca44
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret
push 6
mov dword [ebp - 4], 0
call sub.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_
push 1
call sub.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_
int3
Function at 0x10068450
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 8]
movzx eax, byte [edx]
xor eax, 0x811c9dc5
imul ecx, eax, 0x1000193
movzx eax, byte [edx + 1]
xor ecx, eax
movzx eax, byte [edx + 2]
imul ecx, ecx, 0x1000193
xor ecx, eax
movzx eax, byte [edx + 3]
imul ecx, ecx, 0x1000193
xor ecx, eax
movzx eax, byte [edx + 4]
imul ecx, ecx, 0x1000193
xor ecx, eax
movzx eax, byte [edx + 5]
imul ecx, ecx, 0x1000193
xor ecx, eax
movzx eax, byte [edx + 6]
imul ecx, ecx, 0x1000193
xor ecx, eax
movzx eax, byte [edx + 7]
imul ecx, ecx, 0x1000193
xor ecx, eax
imul eax, ecx, 0x1000193
pop ebp
ret 4

Function at 0x100689e0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push 8
call fcn.100e0fda
add esp, 4
test eax, eax
je 0x10068a02
mov ecx, dword [ebp + 0x14]
mov ecx, dword [ecx]
mov dword [eax], ecx
mov ecx, dword [ebp + 0x10]
mov ecx, dword [ecx]
mov dword [eax + 4], ecx
jmp 0x10068a04
xor eax, eax
push esi
mov esi, dword [ebp + 0xc]
push edi
lea edi, [esi + 4]
push edi
push 0
push eax
push 0x100687d0
push 0
push 0
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
add esp, 0x18
mov dword [esi], eax
test eax, eax
je 0x10068a2c
pop edi
pop esi
pop ebp
ret
push 6
mov dword [edi], 0
call sub.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_
int3
Function at 0x1006e7c0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
cmp dword [ebp + 0xc], 1
push ebx
push esi
push edi
jne 0x1006e81f
mov eax, dword [ebp + 8]
mov dword [0x1030af10], eax
jmp 0x1006e7dd
mov eax, dword [0x102fed7c]
sub eax, dword [str.____f]
xor eax, dword [0x102fed80]
mov ecx, dword [ebp + 8]
push 0
push 0
push dword [ebp + 0x10]
mov dword [eax + 4], ecx
push 0x1006d590
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
jmp 0x1006e813
mov eax, 1
pop edi
pop esi
pop ebx
pop ebp
ret 0xc
pop edi
pop esi
xor eax, eax
pop ebx
pop ebp
ret 0xc
Function at 0x10076ed0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x103090f4]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, ecx
cmp dword [esi + 0x38], 0
je 0x10076f8c
cmp byte [esi + 0x3d], 0
je 0x10076f8c
mov eax, dword [esi]
push edi
push 0xffffffffffffffff
call dword [eax + 0xc]
cmp eax, 0xffffffff
je 0x10076f7a
mov ecx, dword [esi + 0x38]
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [esi + 0x40]
push eax
call dword [sym.imp.MSVCP140.dll_public:_int___thiscall_std::codecvt_char__char__struct__Mbstatet_::unshift_struct__Mbstatet___char___char___char___const]
sub eax, 0
je 0x10076f41
sub eax, 1
je 0x10076f45
sub eax, 2
jne 0x10076f7a
mov byte [esi + 0x3d], al
mov al, 1
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100e1332
mov esp, ebp
pop ebp
ret
mov byte [esi + 0x3d], 0
mov edi, dword [ebp - 0x28]
lea eax, [ebp - 0x24]
sub edi, eax
je 0x10076f63
push dword [esi + 0x4c]
push edi
push 1
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
add esp, 0x10
cmp edi, eax
jne 0x10076f7a
cmp byte [esi + 0x3d], 0
pop edi
sete al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100e1332
mov esp, ebp
pop ebp
ret
pop edi
xor al, al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100e1332
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
mov al, 1
xor ecx, ebp
pop esi
call fcn.100e1332
mov esp, ebp
pop ebp
ret
Function at 0x1007ad60
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
push ebx
push esi
push edi
jmp 0x1007ad6c
mov ecx, 0x103042ac
push str.cuteflow_
call fcn.10053500
push str.cuteflow_sounds
mov ecx, 0x10300b40
call fcn.10053500
cmp dword [0x103042c0], 0x10
mov eax, 0x103042ac
cmovae eax, dword [0x103042ac]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x1007adb6
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
je 0x1007adbb
test bl, 0x10
jne 0x1007add7
cmp dword [0x103042c0], 0x10
mov eax, 0x103042ac
push 0
cmovae eax, dword [0x103042ac]
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
cmp dword [0x10300b54], 0x10
mov eax, 0x10300b40
cmovae eax, dword [0x10300b40]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x1007ae03
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
je 0x1007ae08
test bl, 0x10
jne 0x1007ae24
cmp dword [0x10300b54], 0x10
mov eax, 0x10300b40
push 0
cmovae eax, dword [0x10300b40]
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
jmp 0x1007ae2d
pop edi
pop esi
pop ebx
ret

Function at 0x1007ae40
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [0x103090f4]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push eax
lea eax, [ebp - 0x1c]
push 0x103042ac
push eax
call fcn.10076400
cmp dword [ebp - 8], 0x10
lea eax, [ebp - 0x1c]
cmovae eax, dword [ebp - 0x1c]
push eax
call dword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll_remove]
mov ecx, dword [ebp - 8]
add esp, 0x10
cmp ecx, 0x10
jb 0x1007aead
mov edx, dword [ebp - 0x1c]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x1007aea3
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x1007aea3
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push ecx
push edx
call fcn.100e100a
add esp, 8
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100e1332
mov esp, ebp
pop ebp
ret
Function at 0x100872f0
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov ebx, dword [ebp + 8]
mov dword [ebp - 4], ecx
push esi
push edi
movzx eax, byte [ebx]
xor eax, 0x811c9dc5
imul edx, eax, 0x1000193
movzx eax, byte [ebx + 1]
xor edx, eax
movzx eax, byte [ebx + 2]
imul edx, edx, 0x1000193
xor edx, eax
movzx eax, byte [ebx + 3]
imul ecx, edx, 0x1000193
mov edx, dword [ebp - 4]
mov edi, dword [edx + 4]
xor ecx, eax
imul eax, ecx, 0x1000193
mov ecx, dword [edx + 0x18]
and ecx, eax
mov eax, dword [edx + 0xc]
mov esi, dword [eax + ecx*8 + 4]
lea ecx, [eax + ecx*8]
cmp esi, edi
jne 0x1008734c
xor esi, esi
jmp 0x10087368
mov eax, dword [ebx]
mov edx, dword [ecx]
cmp eax, dword [esi + 8]
je 0x10087365
cmp esi, edx
je 0x10087363
mov esi, dword [esi + 4]
cmp eax, dword [esi + 8]
jne 0x10087355
jmp 0x10087365
xor esi, esi
mov edx, dword [ebp - 4]
test esi, esi
je 0x100874a1
mov eax, dword [ecx]
cmp dword [ecx + 4], esi
jne 0x1008738a
cmp eax, esi
jne 0x10087382
mov dword [ecx], edi
mov dword [ecx + 4], edi
jmp 0x10087392
mov edi, dword [esi + 4]
mov dword [ecx + 4], edi
jmp 0x10087392
cmp eax, esi
jne 0x10087392
mov eax, dword [esi]
mov dword [ecx], eax
mov ecx, dword [esi]
dec dword [edx + 8]
mov eax, dword [esi + 4]
mov dword [eax], ecx
mov eax, dword [esi + 4]
mov dword [ecx + 4], eax
mov ecx, dword [esi + 0x88]
cmp ecx, 0x10
jb 0x100873d9
mov eax, dword [esi + 0x74]
inc ecx
cmp ecx, 0x1000
jb 0x100873cf
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x1008749b
mov eax, edx
push ecx
push eax
call fcn.100e100a
add esp, 8
mov dword [esi + 0x84], 0
mov dword [esi + 0x88], 0xf
mov byte [esi + 0x74], 0
mov ecx, dword [esi + 0x70]
cmp ecx, 0x10
jb 0x10087425
mov eax, dword [esi + 0x5c]
inc ecx
cmp ecx, 0x1000
jb 0x1008741b
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x1008749b
mov eax, edx
push ecx
push eax
call fcn.100e100a
add esp, 8
mov dword [esi + 0x6c], 0
mov dword [esi + 0x70], 0xf
mov byte [esi + 0x5c], 0
mov eax, dword [esi + 0x50]
test eax, eax
je 0x1008747f
mov ecx, dword [esi + 0x58]
sub ecx, eax
and ecx, 0xfffffff0
cmp ecx, 0x1000
jb 0x10087460
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x1008749b
mov eax, edx
push ecx
push eax
call fcn.100e100a
mov dword [esi + 0x50], 0
add esp, 8
mov dword [esi + 0x54], 0
mov dword [esi + 0x58], 0
push 0x98
push esi
call fcn.100e100a
add esp, 8
mov eax, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x10087c80
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push dword [ebp + 0x10]
lea eax, [ebp - 8]
mov dword [ebp - 8], 0x43800000
push 0
push 0
push eax
push dword [ebp + 8]
mov dword [ebp - 4], 0x42000000
call fcn.10087d20
test al, al
je 0x10087cfd
test byte [ebp + 0x10], 1
jne 0x10087cfd
push 4
call fcn.100e0fda
add esp, 4
test eax, eax
je 0x10087cc6
mov ecx, dword [ebp + 0xc]
mov dword [eax], ecx
jmp 0x10087cc8
xor eax, eax
lea ecx, [ebp - 4]
push ecx
push 0
push eax
push 0x10087c50
push 0
push 0
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
add esp, 0x18
mov dword [ebp - 8], eax
test eax, eax
je 0x10087d0a
mov ecx, dword [ebp - 4]
test ecx, ecx
je 0x10087d03
push ecx
push eax
call sub.MSVCP140.dll__Thrd_detach
add esp, 8
test eax, eax
jne 0x10087d03
mov esp, ebp
pop ebp
ret 0xc
push 1
call sub.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_
push 6
mov dword [ebp - 4], 0
call sub.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_
int3
Function at 0x100926a0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xb4
mov eax, dword [0x103090f4]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
push 0
call dword [sym.imp.api_ms_win_crt_time_l1_1_0.dll__time64]
mov dword [ebp - 0xb4], eax
lea eax, [ebp - 0xb4]
push eax
mov dword [ebp - 0xb0], edx
call dword [sym.imp.api_ms_win_crt_time_l1_1_0.dll__localtime64]
xorps xmm0, xmm0
add esp, 8
mov ecx, dword [eax + 0x18]
mov eax, dword [str.Sunday]
movups xmmword [ebp - 0xac], xmm0
mov dword [ebp - 0xac], eax
movzx eax, word [0x10150a04]
mov word [ebp - 0xa8], ax
mov eax, dword [str.Monday]
movups xmmword [ebp - 0x94], xmm0
mov dword [ebp - 0x94], eax
movzx eax, word [0x10150a0c]
mov word [ebp - 0x90], ax
mov eax, dword [str.Tuesday]
movups xmmword [ebp - 0x7c], xmm0
mov dword [ebp - 0x7c], eax
movzx eax, word [0x10150a14]
mov word [ebp - 0x78], ax
movzx eax, byte [0x10150a16]
movups xmmword [ebp - 0x64], xmm0
mov byte [ebp - 0x76], al
movq xmm0, qword [str.Wednesday]
movzx eax, byte [0x10150a20]
mov byte [ebp - 0x5c], al
mov eax, dword [str.Friday]
movq qword [ebp - 0x64], xmm0
xorps xmm0, xmm0
movups xmmword [ebp - 0x34], xmm0
mov dword [ebp - 0x34], eax
movzx eax, word [0x10150a28]
mov word [ebp - 0x30], ax
lea eax, [ecx + ecx*2]
lea ecx, [ebp - 0xac]
mov dword [ebp - 0x9c], 6
lea eax, [ecx + eax*8]
mov dword [ebp - 0x98], 0xf
movups xmmword [ebp - 0x4c], xmm0
push eax
movups xmmword [ebp - 0x1c], xmm0
mov ecx, ebx
mov byte [ebp - 0xa6], 0
mov dword [ebp - 0x84], 6
mov dword [ebp - 0x80], 0xf
mov byte [ebp - 0x8e], 0
mov dword [ebp - 0x6c], 7
mov dword [ebp - 0x68], 0xf
mov byte [ebp - 0x75], 0
mov dword [ebp - 0x54], 9
mov dword [ebp - 0x50], 0xf
mov byte [ebp - 0x5b], 0
mov dword [ebp - 0x3c], 8
mov dword [ebp - 0x38], 0xf
mov dword [ebp - 0x4c], 0x72756854
mov dword [ebp - 0x48], 0x79616473
mov byte [ebp - 0x44], 0
mov dword [ebp - 0x24], 6
mov dword [ebp - 0x20], 0xf
mov byte [ebp - 0x2e], 0
mov dword [ebp - 0xc], 8
mov dword [ebp - 8], 0xf
mov dword [ebp - 0x1c], 0x75746153
mov dword [ebp - 0x18], 0x79616472
mov byte [ebp - 0x14], 0
call fcn.10044130
mov edi, 7
lea esi, [ebp - 4]
mov ecx, dword [esi - 4]
lea esi, [esi - 0x18]
dec edi
cmp ecx, 0x10
jb 0x10092879
mov eax, dword [esi]
inc ecx
cmp ecx, 0x1000
jb 0x1009286f
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x100928a1
mov eax, edx
push ecx
push eax
call fcn.100e100a
add esp, 8
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0xf
mov byte [esi], 0
test edi, edi
jne 0x10092846
mov ecx, dword [ebp - 4]
mov eax, ebx
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.100e1332
mov esp, ebp
pop ebp
ret
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
Function at 0x100a5e80
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov edx, 0xcbf29ce4
xor esi, esi
mov dword [ebp - 4], edx
mov ecx, 0x84222325
cmp byte [edi], 0
je 0x100a5ea7
nop
inc esi
cmp byte [esi + edi], 0
jne 0x100a5ea0
xor ebx, ebx
test esi, esi
je 0x100a5ed5
nop dword [eax]
movsx eax, byte [ebx + edi]
push 0x100
cdq
xor edx, dword [ebp - 4]
xor eax, ecx
push 0x1b3
push edx
push eax
call fcn.100e17c0
inc ebx
mov dword [ebp - 4], edx
mov ecx, eax
cmp ebx, esi
jb 0x100a5eb0
pop edi
pop esi
mov eax, ecx
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x100ac9b0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
cmp byte [0x10173005], 0
mov dword [ebp - 4], ecx
je 0x100acb3b
mov ecx, dword [ebp + 8]
push ebx
push esi
push edi
mov eax, dword [ecx]
call dword [eax + 4]
mov ebx, eax
xor esi, esi
mov ecx, 0x84222325
mov edi, 0xcbf29ce4
cmp byte [ebx], 0
je 0x100ac9eb
inc esi
cmp byte [esi + ebx], 0
jne 0x100ac9e4
xor eax, eax
mov dword [ebp - 8], eax
test esi, esi
je 0x100acb38
nop dword [eax + eax]
movsx eax, byte [eax + ebx]
push 0x100
cdq
push 0x1b3
xor edx, edi
xor eax, ecx
push edx
push eax
call fcn.100e17c0
mov ecx, eax
mov edi, edx
mov eax, dword [ebp - 8]
inc eax
mov dword [ebp - 8], eax
cmp eax, esi
jb 0x100aca00
cmp edi, 0x3943e50e
ja 0x100acb1d
jb 0x100aca43
cmp ecx, 0x2bb2e9fe
ja 0x100acb1d
cmp ecx, 0x2bb2e9fe
jne 0x100acad5
cmp edi, 0x3943e50e
jne 0x100acad5
mov ecx, dword [0x10173080]
test ecx, ecx
je 0x100acb38
mov eax, dword [0x1030a1fc]
test al, 1
jne 0x100aca82
or eax, 1
mov dword [0x1030a1fc], eax
mov eax, dword [0x1030a1f4]
mov dword [0x1030a1f8], eax
jmp 0x100aca87
mov eax, dword [0x1030a1f8]
cmp dword [eax + ecx], 0
jne 0x100acb38
mov eax, dword [0x1030a204]
test al, 1
jne 0x100acaae
or eax, 1
mov dword [0x1030a204], eax
mov eax, dword [0x1030a1f0]
mov dword [0x1030a200], eax
jmp 0x100acab3
mov eax, dword [0x1030a200]
cmp dword [eax + ecx], 0
jle 0x100acb38
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 8]
cmp ecx, dword [eax + 0xc]
je 0x100acb38
cmp byte [ecx], 0
jne 0x100acb38
pop edi
pop esi
mov byte [ecx], 1
pop ebx
mov esp, ebp
pop ebp
ret 4
cmp ecx, 0x5de24d68
jne 0x100acaf9
cmp edi, 0x4251ee7
jne 0x100acaf9
push dword [ebp + 8]
mov ecx, dword [ebp - 4]
call fcn.100ac5c0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
cmp ecx, 0xedb6640
jne 0x100acb38
cmp edi, 0x1baa64fb
jne 0x100acb38
push dword [ebp + 8]
mov ecx, dword [ebp - 4]
call fcn.100ad650
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
cmp ecx, 0xb118f470
jne 0x100acb38
cmp edi, 0xd089c265
jne 0x100acb38
push dword [ebp + 8]
mov ecx, dword [ebp - 4]
call fcn.100ad0a0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x100bfcf0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov edx, dword [ebp + 0xc]
mov eax, ecx
push ebx
push esi
push edi
cmp dword [edx + 0x14], 0x10
mov edi, edx
mov ebx, dword [edx + 0x10]
mov dword [ebp - 4], eax
jb 0x100bfd0e
mov edi, dword [edx]
xor ecx, ecx
mov esi, 0x811c9dc5
test ebx, ebx
je 0x100bfd34
nop dword [eax]
movzx eax, byte [ecx + edi]
inc ecx
xor eax, esi
imul esi, eax, 0x1000193
cmp ecx, ebx
jb 0x100bfd20
mov eax, dword [ebp - 4]
push esi
push edx
lea ecx, [ebp - 0xc]
push ecx
mov ecx, eax
call fcn.100be5b0
pop edi
pop esi
pop ebx
mov ecx, dword [eax + 4]
mov eax, dword [ebp + 8]
test ecx, ecx
jne 0x100bfd54
mov ecx, dword [ebp - 4]
mov ecx, dword [ecx + 4]
mov dword [eax], ecx
mov esp, ebp
pop ebp
ret 8
Function at 0x100c0070
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov edx, dword [ebp + 8]
mov eax, ecx
push ebx
push esi
push edi
cmp dword [edx + 0x14], 0x10
mov edi, edx
mov ebx, dword [edx + 0x10]
mov dword [ebp - 4], eax
jb 0x100c008e
mov edi, dword [edx]
xor ecx, ecx
mov esi, 0x811c9dc5
test ebx, ebx
je 0x100c00b4
nop dword [eax]
movzx eax, byte [ecx + edi]
inc ecx
xor eax, esi
imul esi, eax, 0x1000193
cmp ecx, ebx
jb 0x100c00a0
mov eax, dword [ebp - 4]
push esi
push edx
lea ecx, [ebp - 8]
push ecx
mov ecx, eax
call fcn.100be5b0
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
test eax, eax
je 0x100c00d4
add eax, 0x20
mov esp, ebp
pop ebp
ret 4
push str.invalid_unordered_map_K__T__key
call sub.MSVCP140.dll_void___cdecl_std::_Xout_of_range_char_const__
int3