joyce8/EMBER2024-capa huggingface dataset:
Function at 0x405fc3
Capabilities:
Delete directory
Delete file
Enumerate files on windows
Enumerate files recursively
Set file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x144
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
push ebx
call fcn.0040623e
mov ecx, dword [ebp + 0xc]
mov dword [ebp - 4], eax
test cl, 8
je 0x405ffa
push ebx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
neg eax
sbb eax, eax
inc eax
add dword [0x4243c8], eax
jmp 0x406156
mov dword [ebp + 8], ecx
and dword [ebp + 8], 1
je 0x406014
test eax, eax
je 0x406156
test cl, 2
je 0x406112
mov esi, 0x421d50
push ebx
push esi
call sub.KERNEL32.dll_lstrcpyA
cmp dword [ebp + 8], 0
mov edi, dword [sym.imp.KERNEL32.dll_lstrcatA]
je 0x406036
push str..
push esi
call edi
jmp 0x40603c
push ebx
call fcn.004061a5
push 0x40900c
push ebx
call edi
push ebx
call sub.KERNEL32.dll_lstrlenA
mov edi, eax
lea eax, [ebp - 0x144]
push eax
push esi
add edi, ebx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov esi, eax
cmp esi, 0xffffffff
je 0x406108
cmp byte [ebp - 0x118], 0x2e
jne 0x406082
cmp byte [ebp - 0x117], 0x2e
je 0x4060eb
cmp byte [ebp - 0x117], 0
je 0x4060eb
lea eax, [ebp - 0x118]
push eax
push edi
call sub.KERNEL32.dll_lstrcpyA
mov eax, dword [ebp - 0x144]
test al, 0x10
je 0x4060ae
mov eax, dword [ebp + 0xc]
and eax, 3
cmp al, 3
jne 0x4060eb
push dword [ebp + 0xc]
push ebx
call fcn.00405fc3
jmp 0x4060eb
and al, 0xfe
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
push ebx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
test eax, eax
jne 0x4060e3
test byte [ebp + 0xc], 4
je 0x4060db
push ebx
push 0xfffffffffffffff1
call fcn.00405a19
push 0
push ebx
call fcn.00406394
jmp 0x4060eb
inc dword [0x4243c8]
jmp 0x4060eb
push ebx
push 0xfffffffffffffff2
call fcn.00405a19
lea eax, [ebp - 0x144]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x406067
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
cmp dword [ebp + 8], 0
je 0x406112
and byte [edi - 1], 0
xor esi, esi
cmp dword [ebp - 4], esi
je 0x406156
cmp dword [ebp + 8], esi
je 0x406156
push ebx
call fcn.0040615d
push ebx
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
test eax, eax
jne 0x40614e
test byte [ebp + 0xc], 4
je 0x406146
push ebx
push 0xfffffffffffffff1
call fcn.00405a19
push esi
push ebx
call fcn.00406394
jmp 0x406156
inc dword [0x4243c8]
jmp 0x406156
push ebx
push 0xffffffffffffffe5
call fcn.00405a19
pop edi
pop esi
pop ebx
leave
ret 8
Function at 0x40623e
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push esi
push edi
push dword [esp + 0xc]
mov esi, 0x422150
push esi
call sub.KERNEL32.dll_lstrcpyA
push esi
call fcn.004061f1
test eax, eax
jne 0x40625d
xor eax, eax
jmp 0x4062ac
test byte [0x424350], 0x80
je 0x406271
mov cl, byte [eax]
test cl, cl
je 0x406259
cmp cl, 0x5c
je 0x406259
mov edi, eax
sub edi, esi
jmp 0x40628b
call fcn.00406939
test eax, eax
je 0x406285
test byte [eax], 0x10
je 0x406259
push esi
call fcn.004061a5
push esi
call sub.KERNEL32.dll_lstrlenA
cmp eax, edi
push esi
jg 0x406277
call fcn.0040615d
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
xor ecx, ecx
cmp eax, 0xffffffff
setne cl
mov eax, ecx
pop edi
pop esi
ret 4

Function at 0x40631d
Capabilities:
Get file attributes

Disassembly:
push dword [esp + 4]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov ecx, eax
push 0
inc ecx
neg ecx
sbb ecx, ecx
and ecx, eax
push ecx
push dword [esp + 0x14]
push 0
push 1
push dword [esp + 0x1c]
push dword [esp + 0x1c]
call dword [sym.imp.KERNEL32.dll_CreateFileA]
ret 0xc

Function at 0x40634c
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
push edi
push 0x64
pop edi
dec edi
mov dword [ebp + 8], 0x61736e
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push 0x1a
xor edx, edx
pop ecx
div ecx
push esi
lea eax, [ebp + 8]
push 0
push eax
push dword [ebp + 0xc]
add byte [ebp + 0xa], dl
call dword [sym.imp.KERNEL32.dll_GetTempFileNameA]
test eax, eax
jne 0x406390
test edi, edi
jne 0x406357
and byte [esi], 0
pop edi
pop esi
pop ebp
ret 8
mov eax, esi
jmp 0x40638a
Function at 0x406394
Capabilities:
Get common file path
Get file size

Disassembly:
push ebx
push ebp
push esi
push edi
push str.KERNEL32.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
test eax, eax
mov esi, dword [esp + 0x18]
je 0x4063cc
push str.MoveFileExA
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x4063cc
push 5
push esi
push dword [esp + 0x1c]
call eax
test eax, eax
jne 0x406511
mov ebx, dword [sym.imp.KERNEL32.dll_GetShortPathNameA]
mov dword [0x422ed8], 0x4c554e
test esi, esi
mov edi, 0x400
mov ebp, 0x422ed8
je 0x406410
push 1
push 0
push esi
call fcn.0040631d
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push edi
push ebp
push esi
call ebx
test eax, eax
je 0x406517
cmp eax, edi
jg 0x406517
mov esi, 0x422ad8
push edi
push esi
push dword [esp + 0x1c]
call ebx
test eax, eax
je 0x406517
cmp eax, edi
jg 0x406517
push esi
push ebp
push str._s_s_r_n
push 0x4226d8
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x10
mov ebp, eax
push 0x3f0
push esi
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
push str.wininit.ini
push esi
call dword [sym.imp.KERNEL32.dll_lstrcatA]
xor edi, edi
push edi
push 0x8000080
push 4
push edi
push edi
push 0xc0000000
push esi
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x406511
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov esi, eax
push edi
lea eax, [esi + ebp + 0xa]
push eax
push edi
push 4
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_CreateFileMappingA]
cmp eax, edi
mov dword [esp + 0x14], eax
je 0x4064f9
push edi
push edi
push edi
push 2
push eax
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov edi, eax
test edi, edi
je 0x4064ed
push str._Rename__r_n
push edi
call fcn.004062b1
test eax, eax
jne 0x40651e
lea eax, [edi + esi]
push str._Rename__r_n
push eax
call sub.KERNEL32.dll_lstrcpyA
add esi, 0xa
mov eax, esi
push ebp
add eax, edi
push 0x4226d8
push eax
call fcn.004062fd
push edi
add esi, ebp
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
push dword [esp + 0x14]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor edi, edi
push edi
push edi
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
push ebx
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
inc dword [0x4243d0]
pop edi
pop esi
pop ebp
pop ebx
ret 8
add eax, 0xa
push 0x409318
push eax
call fcn.004062b1
test eax, eax
je 0x4064d4
inc eax
lea edx, [edi + esi]
cmp eax, edx
mov ecx, eax
jae 0x406547
mov dl, byte [ecx]
mov byte [ecx + ebp], dl
inc ecx
lea edx, [edi + esi]
cmp ecx, edx
jb 0x40653a
sub eax, edi
jmp 0x4064d6
Function at 0x40654b
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ebx
lea eax, [ebp + 0xc]
push esi
mov esi, dword [ebp + 0x14]
xor ebx, ebx
push eax
push 0x20019
push ebx
push dword [ebp + 0xc]
mov byte [esi], bl
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x4065af
lea eax, [ebp + 8]
mov dword [ebp + 8], 0x400
push eax
lea eax, [ebp + 0x14]
push esi
push eax
push ebx
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x40659e
cmp dword [ebp + 0x14], 1
je 0x4065a0
cmp dword [ebp + 0x14], 2
je 0x4065a0
mov byte [esi], bl
push dword [ebp + 0xc]
mov byte [esi + 0x3ff], bl
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
pop ebx
pop ebp
ret 0x10
Function at 0x418180
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, 0x411015
lea edi, [esi - 0x10015]
push edi
or ebp, 0xffffffff
jmp 0x4181a2
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x4181a9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x418198
mov eax, 1
add ebx, ebx
jne 0x4181bb
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x4181b0
jne 0x4181cc
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x4181b0
xor ecx, ecx
sub eax, 3
jb 0x4181e0
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x418252
mov ebp, eax
add ebx, ebx
jne 0x4181eb
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x4181f8
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x41821c
inc ecx
add ebx, ebx
jne 0x418208
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x4181fd
jne 0x418219
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x4181fd
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x41823c
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x41822d
jmp 0x41819e
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x41823c
add edi, ecx
jmp 0x41819e
pop esi
mov edi, esi
mov ecx, 0xb97
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x41825a
cmp byte [edi], 4
jne 0x41825a
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x41825f
lea edi, [esi + 0x16000]
mov eax, dword [edi]
or eax, eax
je 0x4182ce
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x18000]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x18110]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x41828c
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x18118]
or eax, eax
je 0x4182c8
mov dword [ebx], eax
add ebx, 4
jmp 0x4182a9
call dword [esi + 0x18114]
mov ebp, dword [esi + 0x1811c]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x19f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x418302
sub esp, 0xffffff80
jmp section.UPX0
Function at 0x10002b80
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x10104008]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, ecx
mov ecx, 0x101080e9
call fcn.100de193
mov ecx, dword [esi + 4]
mov dword [ebp - 0x14], 0x33323738
mov dword [ebp - 0x10], 0x35444633
mov dword [ebp - 0xc], 0x38304638
mov dword [ebp - 8], 0x46434334
pop esi
test ecx, ecx
je 0x10002bcc
push 0x10
lea eax, [ebp - 0x14]
push eax
call fcn.10025d50
mov ecx, dword [ebp - 4]
mov al, 1
xor ecx, ebp
call fcn.100dcb60
mov esp, ebp
pop ebp
ret

Function at 0x10003dd0
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [0x10104008]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, ecx
mov ecx, 0x101080e9
call fcn.100de193
mov eax, dword [esi + 0xc]
cmp eax, 0xffffffff
je 0x10003e31
lea ecx, [ebp - 8]
mov dword [ebp - 8], 0
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov esi, eax
cmp esi, 0xffffffff
jne 0x10003e18
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x10003e31
mov edx, dword [ebp - 8]
xor eax, eax
add eax, esi
pop esi
adc edx, 0
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100dcb60
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor eax, eax
xor ecx, ebp
xor edx, edx
pop esi
call fcn.100dcb60
mov esp, ebp
pop ebp
ret
Function at 0x1000bac0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov ecx, 0x101080e9
call fcn.100de193
mov eax, dword [ebp + 0xc]
mov esi, dword [eax + 0x18]
test esi, esi
je 0x1000bc4a
cmp dword [eax + 0x10], 0
je 0x1000bc4a
cmp dword [eax + 0x14], 8
jb 0x1000baf0
mov eax, dword [eax]
mov edi, dword [ebp + 8]
mov ebx, dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
push edi
push 1
push 0x40
push eax
call ebx
add esp, 0x10
cmp eax, 1
jne 0x1000bc4a
push edi
push eax
push 4
push esi
call ebx
add esp, 0x10
cmp eax, 1
jne 0x1000bc4a
push edi
push eax
lea eax, [esi + 4]
push 4
push eax
call ebx
add esp, 0x10
cmp eax, 1
jne 0x1000bc4a
push edi
push eax
lea eax, [esi + 8]
push 2
push eax
call ebx
add esp, 0x10
cmp eax, 1
jne 0x1000bc4a
push edi
push eax
lea eax, [esi + 0xa]
push 2
push eax
call ebx
add esp, 0x10
cmp eax, 1
jne 0x1000bc4a
push edi
push eax
lea eax, [esi + 0xc]
push 2
push eax
call ebx
add esp, 0x10
cmp eax, 1
jne 0x1000bc4a
push edi
push eax
lea eax, [esi + 0xe]
push 2
push eax
call ebx
add esp, 0x10
cmp eax, 1
jne 0x1000bc4a
push edi
push eax
lea eax, [esi + 0x10]
push 0x80
push eax
call ebx
add esp, 0x10
cmp eax, 1
jne 0x1000bc4a
push edi
push eax
lea eax, [esi + 0x90]
push 2
push eax
call ebx
add esp, 0x10
cmp eax, 1
jne 0x1000bc4a
push edi
push eax
lea eax, [esi + 0x92]
push 2
push eax
call ebx
add esp, 0x10
cmp eax, 1
jne 0x1000bc4a
push edi
push eax
lea eax, [esi + 0x94]
push 2
push eax
call ebx
add esp, 0x10
cmp eax, 1
jne 0x1000bc4a
push edi
push eax
lea eax, [esi + 0x96]
push 2
push eax
call ebx
add esp, 0x10
cmp eax, 1
jne 0x1000bc4a
push edi
push eax
lea eax, [esi + 0x98]
push 0x80
push eax
call ebx
add esp, 0x10
cmp eax, 1
jne 0x1000bc4a
push edi
push eax
lea eax, [esi + 0x118]
push 8
push eax
call ebx
add esp, 0x10
cmp eax, 1
jne 0x1000bc4a
push edi
push eax
lea eax, [esi + 0x120]
push 8
push eax
call ebx
add esp, 0x10
cmp eax, 1
jne 0x1000bc4a
pop edi
pop esi
mov al, al
pop ebx
pop ebp
ret 8
pop edi
pop esi
xor al, al
pop ebx
pop ebp
ret 8
Function at 0x1000c670
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
push 0xfffffffffffffffe
push 0x100fd968
push 0x100dd140
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push ebx
push esi
push edi
mov eax, dword [0x10104008]
xor dword [ebp - 8], eax
xor eax, ebp
push eax
lea eax, [ebp - 0x10]
mov dword fs:[0], eax
mov dword [ebp - 0x18], esp
mov esi, ecx
mov dword [ebp - 0x20], esi
mov ecx, 0x101080e9
call fcn.100de193
xor bl, bl
mov ecx, esi
call fcn.1000c420
mov ecx, eax
mov dword [ebp - 0x24], ecx
test ecx, ecx
je 0x1000c731
mov al, byte [ebp + 8]
mov byte [esi + 4], al
push 0x100ed6ec
push ecx
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll__wfopen]
add esp, 8
mov edi, eax
mov dword [ebp + 8], edi
test edi, edi
je 0x1000c724
mov dword [ebp - 4], 0
push edi
mov ecx, esi
call fcn.1000c220
mov bl, al
mov byte [ebp - 0x19], bl
mov dword [ebp - 4], 0xfffffffe
jmp 0x1000c71a
push edi
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
add esp, 4
test bl, bl
je 0x1000c747
push dword [ebp - 0x24]
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
xor al, al
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
push str.Ntdll.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov edi, eax
test edi, edi
je 0x1000c771
push str.NtQuerySystemTime
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [esi + 0x88], eax
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, dword [esi + 8]
test eax, eax
je 0x1000c781
push eax
lea ecx, [esi + 0xc]
call fcn.1000d580
mov al, 1
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x1000cd10
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
push 0xfffffffffffffffe
push 0x100fd9e0
push 0x100dd140
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push ebx
push esi
push edi
mov eax, dword [0x10104008]
xor dword [ebp - 8], eax
xor eax, ebp
push eax
lea eax, [ebp - 0x10]
mov dword fs:[0], eax
mov dword [ebp - 0x18], esp
mov ebx, ecx
mov ecx, 0x101080e9
call fcn.100de193
mov ecx, ebx
call fcn.1000c420
mov edi, eax
mov dword [ebp - 0x20], edi
push 0x100ed71c
push edi
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll__wfopen]
add esp, 8
mov esi, eax
mov dword [ebp - 0x24], esi
test esi, esi
je 0x1000cdd4
mov dword [ebp - 4], 0
push esi
mov ecx, ebx
call fcn.1000c7a0
mov bl, al
mov byte [ebp - 0x19], bl
mov dword [ebp - 4], 0xfffffffe
jmp 0x1000cdab
push esi
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
add esp, 4
test bl, bl
je 0x1000cdc0
push edi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov al, 1
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
xor al, al
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1000db10
Capabilities:
Encode data using xor
Encrypt data using rc4 prga
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
mov edi, ecx
mov dword [ebp - 8], 0
mov dword [ebp - 0x14], edi
mov eax, dword [edi + 0x44]
dec eax
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 0xc]
mov edx, eax
cmp dword [eax + 0x14], 8
mov ebx, dword [eax + 0x10]
jb 0x1000db3c
mov edx, dword [eax]
xor ecx, ecx
mov esi, 0x811c9dc5
add ebx, ebx
je 0x1000db58
movzx eax, byte [ecx + edx]
inc ecx
xor eax, esi
imul esi, eax, 0x1000193
cmp ecx, ebx
jb 0x1000db47
and esi, dword [ebp - 0xc]
mov eax, 0xaaaaaaab
mul esi
or ebx, 0xffffffff
mov eax, edx
shr eax, 5
mov dword [ebp - 0x10], eax
lea ecx, [eax + eax*2]
shl ecx, 2
mov dword [ebp - 4], ecx
lea ecx, [eax + eax*2]
shl ecx, 4
mov eax, esi
sub eax, ecx
movzx edx, ax
mov eax, 1
mov ecx, edx
shr edx, 3
add edx, dword [edi + 0x38]
and ecx, 7
shl ax, cl
mov ecx, dword [ebp - 4]
test byte [edx + ecx + 6], al
je 0x1000dc48
push esi
mov ecx, edi
call fcn.1000e1f0
test al, al
je 0x1000dbbb
cmp ebx, 0xffffffff
mov eax, esi
cmovne eax, ebx
mov ebx, eax
jmp 0x1000dbf4
mov eax, dword [ebp - 0x10]
mov edx, esi
mov edi, dword [edi + 0x38]
add edi, dword [ebp - 4]
lea eax, [eax + eax*2]
shl eax, 4
sub edx, eax
lea ecx, [edi + 6]
call fcn.1000e280
movzx eax, ax
lea ecx, [eax*8]
sub ecx, eax
mov eax, dword [edi]
lea eax, [eax + ecx*4]
push eax
push dword [ebp + 0xc]
call fcn.1000dff0
test al, al
jne 0x1000dc62
mov eax, dword [ebp - 8]
inc eax
add esi, eax
mov dword [ebp - 8], eax
and esi, dword [ebp - 0xc]
mov eax, 0xaaaaaaab
mul esi
mov edi, edx
shr edi, 5
mov dword [ebp - 0x10], edi
lea eax, [edi + edi*2]
shl eax, 2
lea ecx, [edi + edi*2]
mov edi, dword [ebp - 0x14]
mov dword [ebp - 4], eax
mov eax, esi
shl ecx, 4
sub eax, ecx
movzx edx, ax
mov eax, 1
mov ecx, edx
shr edx, 3
add edx, dword [edi + 0x38]
and ecx, 7
shl ax, cl
mov ecx, dword [ebp - 4]
test byte [edx + ecx + 6], al
jne 0x1000dba3
mov eax, dword [ebp + 8]
mov dword [eax], 0xffffffff
cmp ebx, 0xffffffff
jne 0x1000dc77
pop edi
mov dword [eax + 4], esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
mov eax, dword [ebp + 8]
pop edi
mov dword [eax], esi
pop esi
mov dword [eax + 4], 0xffffffff
pop ebx
mov esp, ebp
pop ebp
ret 8
pop edi
pop esi
mov dword [eax + 4], ebx
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x1000e660
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100e0750
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
push ebx
push esi
push edi
mov eax, dword [0x10104008]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x1c], ecx
mov esi, dword [ebp + 8]
mov eax, 0xaaaaaaab
mov edi, dword [ecx]
mul esi
shr edx, 5
lea ebx, [edx + edx*2]
shl ebx, 2
add edi, ebx
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x18], edi
movzx eax, word [edi + 4]
lea ecx, [edi + 6]
mov dword [ebp - 0x24], eax
lea eax, [edx + edx*2]
shl eax, 4
sub esi, eax
movzx esi, si
mov edx, esi
call fcn.1000e280
movzx ebx, ax
lea edx, [edi + 6]
mov eax, esi
mov ecx, esi
shr eax, 3
add edx, eax
and ecx, 7
mov eax, 1
mov dword [ebp - 0x14], ecx
shl ax, cl
mov dword [ebp - 0x10], edx
test byte [edx], al
je 0x1000e70e
mov ecx, dword [edi]
mov eax, ebx
lea ebx, [eax*8]
sub ebx, eax
shl ebx, 2
add ecx, ebx
mov dword [ebp + 8], ecx
mov dword [ebp - 4], 0xffffffff
call fcn.10004b60
jmp 0x1000e7bd
movzx eax, word [edi + 4]
xor ecx, ecx
inc eax
mov edx, 0x1c
movzx esi, ax
mov eax, esi
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov edx, eax
add esp, 4
mov dword [ebp + 8], edx
test edx, edx
jne 0x1000e75d
push esi
push str.sparsehash_FATAL_ERROR:_failed_to_allocate__lu_groups_n
push 2
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
add esp, 4
push eax
call fcn.1000b7c0
add esp, 0xc
push 1
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
mov ecx, dword [edi]
mov eax, ebx
push edx
lea ebx, [eax*8]
sub ebx, eax
shl ebx, 2
lea edx, [ebx + ecx]
call fcn.1000ed80
movzx ecx, word [edi + 4]
add esp, 4
mov eax, dword [ebp + 8]
mov esi, dword [edi]
add eax, 0x1c
add eax, ebx
push eax
lea eax, [ecx*8]
sub eax, ecx
lea ecx, [ebx + esi]
lea edx, [esi + eax*4]
call fcn.1000ed80
add esp, 4
mov ecx, edi
call fcn.1000e2e0
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp + 8]
inc word [edi + 4]
mov ecx, dword [ebp - 0x14]
mov dword [edi], eax
movzx eax, byte [edx]
bts eax, ecx
mov byte [edx], al
mov edi, dword [edi]
mov esi, dword [ebp + 0xc]
add edi, ebx
push esi
mov ecx, edi
mov dword [ebp + 8], edi
call fcn.10008640
mov dword [ebp - 4], 1
mov eax, dword [esi + 0x18]
mov dword [edi + 0x18], eax
mov dword [ebp - 4], 0xffffffff
mov esi, dword [ebp - 0x1c]
mov edx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x18]
mov ecx, dword [esi]
mov eax, dword [eax]
add eax, ebx
movzx edx, word [edx + ecx + 4]
mov ecx, dword [ebp - 0x24]
movzx ecx, cx
sub edx, ecx
add dword [esi + 0x10], edx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x1000e930
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x14
mov eax, dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
mov di, word [ebp + 0xc]
mov esi, ecx
mov dword [esp + 0x1c], eax
nop
cmp ebx, dword [ebp + 0x10]
jne 0x1000e95f
cmp di, word [ebp + 0x14]
je 0x1000ea7a
mov eax, dword [ebp + 0xc]
movzx edx, di
mov ecx, edx
mov dword [esp + 0x10], ebx
mov dword [esp + 0x10], eax
and ecx, 7
shr edx, 3
mov eax, 1
shl ax, cl
test byte [edx + esi + 6], al
je 0x1000ea4d
mov edx, dword [esp + 0x10]
lea ecx, [esi + 6]
call fcn.1000e280
movzx ebx, ax
movzx eax, word [esi + 4]
cmp eax, 1
jne 0x1000e9a9
mov dword [esp + 0xc], 0
jmp 0x1000ea15
dec eax
xor ecx, ecx
movzx edi, ax
mov edx, 0x1c
mov eax, edi
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call dword [esp + 0x20]
add esp, 4
mov dword [esp + 0xc], eax
test eax, eax
je 0x1000ea58
mov ecx, ebx
push eax
lea ebx, [ecx*8]
sub ebx, ecx
mov ecx, dword [esi]
shl ebx, 2
lea edx, [ecx + ebx]
call fcn.1000ed80
movzx ecx, word [esi + 4]
add esp, 4
mov eax, dword [esp + 0xc]
mov edi, dword [esi]
add eax, ebx
push eax
lea eax, [ecx*8]
sub eax, ecx
lea ecx, [edi + 0x1c]
add ecx, ebx
lea edx, [edi + eax*4]
call fcn.1000ed80
add esp, 4
mov ecx, esi
call fcn.1000e2e0
mov eax, dword [esp + 0xc]
mov dword [esi], eax
mov eax, 0xffff
add word [esi + 4], ax
mov eax, dword [esp + 0x10]
movzx edx, ax
mov ecx, edx
and edx, 7
shr ecx, 3
movzx eax, byte [ecx + esi + 6]
btr eax, edx
mov byte [ecx + esi + 6], al
mov di, word [ebp + 0xc]
mov ebx, dword [ebp + 8]
inc di
mov word [ebp + 0xc], di
jmp 0x1000e950
push edi
push str.sparsehash_FATAL_ERROR:_failed_to_allocate__lu_groups_n
push 2
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
add esp, 4
push eax
call fcn.1000b7c0
add esp, 0xc
push 1
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10

Function at 0x1000eb50
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push esi
movzx esi, word [ebp + 8]
xor ecx, ecx
mov eax, esi
mov edx, 0x1c
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
add esp, 4
test eax, eax
jne 0x1000eb9a
push esi
push str.sparsehash_FATAL_ERROR:_failed_to_allocate__lu_groups_n
push 2
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
add esp, 4
push eax
call fcn.1000b7c0
add esp, 0xc
push 1
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
pop esi
pop ebp
ret 4