joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10057c80
Capabilities:
Enumerate pe sections
Parse pe header
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1008b500
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x218
push ebx
xor bl, bl
push 0
mov byte [ebp - 0xd], bl
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov dword [ebp - 0x1c], eax
test eax, eax
je 0x10057d99
push esi
push edi
push 0x104
lea eax, [ebp - 0x224]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea eax, [ebp - 0x224]
push 0x100a7dcc
push eax
call dword [sym.imp.msvcrt.dll__wfopen]
mov esi, dword [sym.imp.msvcrt.dll_fseek]
mov ebx, eax
push 2
push 0
push ebx
call esi
push ebx
call dword [sym.imp.msvcrt.dll_ftell]
push 0
push 0
push ebx
mov edi, eax
call esi
push edi
call fcn.1007ace7
push ebx
push 1
mov esi, eax
push edi
push esi
mov dword [ebp - 0x14], esi
call dword [sym.imp.msvcrt.dll_fread]
push ebx
call dword [sym.imp.msvcrt.dll_fclose]
mov eax, 0x5a4d
add esp, 0x3c
cmp word [esi], ax
jne 0x10057d8b
mov ecx, dword [esi + 0x3c]
add ecx, esi
cmp dword [ecx], 0x4550
jne 0x10057d8b
movzx eax, word [ecx + 0x14]
xor esi, esi
movzx ebx, word [ecx + 6]
add eax, 0x18
add eax, ecx
mov dword [ebp - 0x18], eax
test ebx, ebx
je 0x10057d88
mov edi, eax
nop dword [eax]
mov eax, edi
mov ecx, str..bind
mov dl, byte [ecx]
cmp dl, byte [eax]
jne 0x10057d77
test dl, dl
je 0x10057d73
mov dl, byte [ecx + 1]
cmp dl, byte [eax + 1]
jne 0x10057d77
add ecx, 2
add eax, 2
test dl, dl
jne 0x10057d57
xor eax, eax
jmp 0x10057d7c
sbb eax, eax
or eax, 1
test eax, eax
je 0x10057dac
inc esi
add edi, 0x28
cmp esi, ebx
jl 0x10057d50
mov esi, dword [ebp - 0x14]
mov bl, byte [ebp - 0xd]
push esi
call fcn.1007ac2d
add esp, 4
pop edi
pop esi
mov ecx, dword [ebp - 0xc]
mov al, bl
pop ebx
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 0x10
mov ecx, dword [ebp - 0x18]
lea eax, [esi + esi*4]
mov esi, dword [ebp - 0x14]
lea edx, [ecx + eax*8]
mov eax, dword [ebp + 0x10]
mov bl, 1
mov ecx, dword [edx + 0xc]
add ecx, dword [ebp - 0x1c]
mov dword [eax], ecx
mov ecx, dword [edx + 0x10]
cmp ecx, dword [edx + 8]
mov eax, dword [ebp + 0x14]
cmovbe ecx, dword [edx + 8]
mov dword [eax], ecx
jmp 0x10057d8e
Function at 0x10057de0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1008b51d
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ebx
sub esp, 0x148
push esi
push edi
mov edi, dword [ebx + 8]
mov esi, ecx
mov dword [ebp - 0x14], esi
test edi, edi
jne 0x10057e2c
push edi
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
jmp 0x10057fab
xorps xmm0, xmm0
mov dword [ebp - 0x20], 0
push edi
movups xmmword [ebp - 0x30], xmm0
mov dword [ebp - 0x1c], 0
call dword [sym.imp.msvcrt.dll_strlen]
add esp, 4
lea ecx, [ebp - 0x30]
push eax
push edi
call fcn.10007aa4
cmp dword [ebp - 0x1c], 0x10
lea eax, [esi + 0x14]
lea esi, [ebp - 0x30]
mov dword [ebp - 0x18], eax
cmovae esi, dword [ebp - 0x30]
mov edx, 0x811c9dc5
xor ecx, ecx
cmp dword [ebp - 0x20], ecx
jbe 0x10057e87
movzx eax, byte [ecx + esi]
inc ecx
xor eax, edx
imul edx, eax, 0x1000193
cmp ecx, dword [ebp - 0x20]
jb 0x10057e72
mov eax, dword [ebp - 0x18]
push edx
lea ecx, [ebp - 0x30]
push ecx
lea ecx, [ebp - 0x50]
push ecx
mov ecx, eax
call fcn.1005a870
mov esi, dword [eax + 4]
test esi, esi
jne 0x10057ea4
mov esi, dword [ebp - 0x14]
mov esi, dword [esi + 0x18]
mov ecx, dword [ebp - 0x1c]
cmp ecx, 0x10
jb 0x10057ed8
mov edx, dword [ebp - 0x30]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x10057ece
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x10057fc0
push ecx
push edx
call fcn.1007abfc
add esp, 8
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x1c], 0xf
mov byte [ebp - 0x30], 0
cmp esi, dword [eax + 0x18]
jne 0x10057fa6
xorps xmm0, xmm0
mov dword [ebp - 0x38], 0
push edi
movups xmmword [ebp - 0x48], xmm0
mov dword [ebp - 0x34], 0
call dword [sym.imp.msvcrt.dll_strlen]
add esp, 4
lea ecx, [ebp - 0x48]
push eax
push edi
call fcn.10007aa4
push edi
mov dword [ebp - 4], 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov esi, eax
test esi, esi
jne 0x10057f66
push edi
lea eax, [ebp - 0x158]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push str..dll
lea eax, [ebp - 0x158]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatA]
lea eax, [ebp - 0x158]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov esi, eax
test esi, esi
jne 0x10057f66
mov ecx, dword [ebp - 0x18]
lea eax, [ebp - 0x48]
push eax
call fcn.10058da0
mov dword [eax], esi
mov ecx, dword [ebp - 0x34]
cmp ecx, 0x10
jb 0x10057fa9
mov edx, dword [ebp - 0x48]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x10057f9a
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x10057fc5
push ecx
push edx
call fcn.1007abfc
add esp, 8
jmp 0x10057fa9
mov esi, dword [esi + 0x20]
mov eax, esi
mov ecx, dword [ebp - 0xc]
pop edi
mov dword fs:[0], ecx
pop esi
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret 4
call fcn.1007bbe0
call fcn.1007bbe0
int3
Function at 0x10057fe0
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
sub esp, 8
mov eax, dword [esp + 0x14]
push ebx
push ebp
push esi
mov esi, dword [esp + 0x18]
push edi
mov edi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov dword [esp + 0x14], eax
lea eax, [esp + 0x10]
push eax
push 0x40
push 4
push esi
mov dword [esp + 0x20], 0
call edi
mov ebp, dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea eax, [esp + 0x14]
push 0
push 4
push eax
push esi
call ebp
mov ebx, dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
push eax
call ebx
lea eax, [esp + 0x10]
push eax
push dword [esp + 0x14]
push 4
push esi
call edi
push 4
push esi
call ebp
mov edi, dword [sym.imp.KERNEL32.dll_FlushInstructionCache]
push eax
call edi
lea eax, [esp + 0x1c]
mov dword [esp + 0x1c], 0
push eax
push 0x40
push dword [esp + 0x2c]
add esi, 4
push esi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
push 0
push dword [esp + 0x28]
push dword [esp + 0x28]
push esi
call ebp
push eax
call ebx
mov ebx, dword [esp + 0x24]
lea eax, [esp + 0x1c]
push eax
push dword [esp + 0x20]
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
push ebx
push esi
call ebp
push eax
call edi
pop edi
pop esi
pop ebp
lea eax, [ebx + 4]
pop ebx
add esp, 8
ret 0xc
Function at 0x100580a0
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1008b53d
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x18
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
push 8
mov dword [ebp - 0x10], ecx
call fcn.1007a79d
mov edi, eax
add esp, 4
mov dword [ebp - 0x18], edi
mov dword [edi], vtable.MemoryAllocator.0
test esi, esi
je 0x100580e3
and esi, 0xfffff000
mov ebx, dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov dword [edi + 4], 0
push 0x40
push 0x3000
push 0x200
add esi, 0x1000
push esi
call ebx
mov dword [edi + 4], eax
test eax, eax
je 0x100580f0
mov ebx, dword [ebp - 0x10]
mov eax, dword [ebx + 0xc]
lea ecx, [ebx + 8]
mov dword [ebp - 0x18], edi
cmp eax, dword [ecx + 8]
je 0x10058125
mov dword [eax], edi
add dword [ecx + 4], 4
jmp 0x1005812f
lea edx, [ebp - 0x18]
push edx
push eax
call fcn.1005a900
mov edx, dword [ebp + 8]
movzx eax, dl
xor eax, 0x811c9dc5
mov esi, dword [edi + 4]
imul ecx, eax, 0x1000193
movzx eax, dh
mov dword [ebp - 0x18], edx
xor ecx, eax
movzx eax, byte [ebp + 0xa]
imul ecx, ecx, 0x1000193
xor ecx, eax
movzx eax, byte [ebp + 0xb]
imul ecx, ecx, 0x1000193
xor ecx, eax
imul eax, ecx, 0x1000193
lea ecx, [ebx + 0x34]
push eax
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x14]
push eax
call fcn.1005a6f0
mov eax, dword [eax + 4]
test eax, eax
jne 0x10058184
mov eax, dword [ebx + 0x38]
cmp eax, dword [ebx + 0x38]
je 0x1005818e
add eax, 0xc
jne 0x100581db
mov dword [ebp - 0x24], 0
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x1c], 0
lea eax, [ebp + 8]
mov dword [ebp - 4], 0
push eax
lea ecx, [ebx + 0x34]
call fcn.10058c40
lea ecx, [ebp - 0x24]
cmp eax, ecx
je 0x100581c8
push 0
push 0
mov ecx, eax
call fcn.100596e0
lea eax, [ebp + 8]
push eax
lea ecx, [ebx + 0x34]
call fcn.10058c40
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [eax + 4]
mov dword [ebp - 0x18], esi
cmp ecx, dword [eax + 8]
je 0x100581ee
mov dword [ecx], esi
add dword [eax + 4], 4
jmp 0x100581fa
lea edx, [ebp - 0x18]
push edx
push ecx
mov ecx, eax
call fcn.1005a760
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x10058a30
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call
Hash data using fnv

Disassembly:
sub esp, 0xc
push ebx
mov ebx, dword [esp + 0x14]
movzx eax, bl
xor eax, 0x811c9dc5
mov dword [esp + 4], ebx
imul edx, eax, 0x1000193
mov eax, ebx
shr eax, 8
movzx eax, al
push ebp
mov ebp, ecx
xor edx, eax
mov eax, ebx
shr eax, 0x10
movzx eax, al
imul ecx, edx, 0x1000193
push esi
xor ecx, eax
mov eax, ebx
imul ecx, ecx, 0x1000193
shr eax, 0x18
xor ecx, eax
imul eax, ecx, 0x1000193
lea ecx, [ebp + 0x34]
push eax
lea eax, [esp + 0x10]
push eax
lea eax, [esp + 0x18]
push eax
call fcn.1005a6f0
mov eax, dword [eax + 4]
test eax, eax
jne 0x10058a98
mov eax, dword [ebp + 0x38]
xor ebx, ebx
lea ecx, [eax + 0xc]
cmp eax, dword [ebp + 0x38]
cmovne ebx, ecx
test ebx, ebx
jne 0x10058ab2
pop esi
pop ebp
xor al, al
pop ebx
add esp, 0xc
ret 8
mov eax, dword [ebx + 4]
cmp dword [ebx], eax
je 0x10058b6a
push edi
nop
mov edi, dword [eax - 4]
lea eax, [esp + 0x10]
push eax
push 0x40
mov dword [esp + 0x18], 0
mov esi, dword [edi]
push esi
push dword [esp + 0x2c]
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
push 0
push esi
lea eax, [edi + 4]
push eax
push dword [esp + 0x2c]
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
lea eax, [esp + 0x10]
push eax
push dword [esp + 0x14]
push esi
push dword [esp + 0x2c]
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
push esi
push dword [esp + 0x24]
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_FlushInstructionCache]
mov esi, dword [ebp + 8]
mov eax, dword [ebp + 0xc]
cmp esi, eax
je 0x10058b58
mov ecx, dword [esi]
cmp dword [ecx + 4], edi
je 0x10058b37
add esi, 4
cmp esi, eax
jne 0x10058b27
jmp 0x10058b58
test ecx, ecx
je 0x10058b41
mov eax, dword [ecx]
push 1
call dword [eax]
mov eax, dword [ebp + 0xc]
lea ecx, [esi + 4]
sub eax, ecx
push eax
push ecx
push esi
call sub.msvcrt.dll_memmove
add esp, 0xc
add dword [ebp + 0xc], 0xfffffffc
mov eax, dword [ebx + 4]
add eax, 0xfffffffc
mov dword [ebx + 4], eax
cmp dword [ebx], eax
jne 0x10058ac0
pop edi
pop esi
pop ebp
mov al, 1
pop ebx
add esp, 0xc
ret 8
Function at 0x10058e70
Capabilities:
Hash data using fnv

Disassembly:
mov eax, dword [esp + 8]
sub esp, 0x18
mov edx, dword [esp + 0x1c]
push ebp
mov ebp, ecx
cmp edx, eax
je 0x10058ffc
mov eax, dword [ebp + 4]
mov dword [esp + 0x10], eax
mov eax, dword [edx + 4]
mov dword [esp + 4], eax
movzx eax, byte [edx + 8]
xor eax, 0x811c9dc5
imul ecx, eax, 0x1000193
movzx eax, byte [edx + 9]
push ebx
mov ebx, dword [ebp + 0xc]
push esi
xor ecx, eax
mov dword [esp + 0x20], ebx
movzx eax, byte [edx + 0xa]
mov esi, edx
imul ecx, ecx, 0x1000193
push edi
xor ecx, eax
movzx eax, byte [edx + 0xb]
imul ecx, ecx, 0x1000193
xor ecx, eax
mov eax, dword [ebp + 0x18]
imul ecx, ecx, 0x1000193
and eax, ecx
mov ecx, dword [ebx + eax*8]
mov dword [esp + 0x18], ecx
lea eax, [ebx + eax*8]
mov dword [esp + 0x14], eax
mov eax, dword [eax + 4]
mov dword [esp + 0x20], eax
nop dword [eax]
mov edi, esi
mov ebx, esi
mov esi, dword [esi]
lea ecx, [edi + 0xc]
call fcn.10058be0
push 0x18
push edi
call fcn.1007abfc
dec dword [ebp + 8]
add esp, 8
cmp ebx, dword [esp + 0x20]
je 0x10058f41
mov eax, dword [esp + 0x30]
cmp esi, eax
jne 0x10058ef0
mov ecx, dword [esp + 0x18]
cmp ecx, dword [esp + 0x2c]
jne 0x10058ff0
mov edx, dword [esp + 0x14]
mov ecx, dword [esp + 0x10]
pop edi
mov dword [edx], esi
mov dword [ecx], esi
mov dword [esi + 4], ecx
pop esi
pop ebx
pop ebp
add esp, 0x18
ret 8
mov ecx, dword [esp + 0x18]
mov edx, dword [esp + 0x14]
cmp ecx, dword [esp + 0x2c]
jne 0x10058f59
mov eax, dword [esp + 0x1c]
mov ecx, eax
mov dword [edx], eax
jmp 0x10058f5d
mov ecx, dword [esp + 0x10]
mov eax, dword [esp + 0x30]
mov dword [edx + 4], ecx
cmp esi, eax
je 0x10058ff0
nop dword [eax]
movzx eax, byte [esi + 8]
xor eax, 0x811c9dc5
imul ecx, eax, 0x1000193
movzx eax, byte [esi + 9]
xor ecx, eax
movzx eax, byte [esi + 0xa]
imul ecx, ecx, 0x1000193
xor ecx, eax
movzx eax, byte [esi + 0xb]
imul ecx, ecx, 0x1000193
xor ecx, eax
mov eax, dword [ebp + 0x18]
imul ecx, ecx, 0x1000193
and eax, ecx
mov ecx, dword [esp + 0x24]
lea eax, [ecx + eax*8]
mov dword [esp + 0x2c], eax
mov eax, dword [eax + 4]
mov dword [esp + 0x20], eax
nop word [eax + eax]
mov edi, esi
mov ebx, esi
mov esi, dword [esi]
lea ecx, [edi + 0xc]
call fcn.10058be0
push 0x18
push edi
call fcn.1007abfc
dec dword [ebp + 8]
add esp, 8
mov eax, dword [esp + 0x30]
cmp ebx, dword [esp + 0x20]
je 0x10059003
cmp esi, eax
jne 0x10058fc0
mov ecx, dword [esp + 0x2c]
mov dword [ecx], esi
mov ecx, dword [esp + 0x10]
pop edi
mov dword [ecx], esi
mov dword [esi + 4], ecx
pop esi
pop ebx
pop ebp
add esp, 0x18
ret 8
mov ecx, dword [esp + 0x2c]
mov edx, dword [esp + 0x1c]
mov dword [ecx], edx
mov dword [ecx + 4], edx
cmp esi, eax
jne 0x10058f70
mov ecx, dword [esp + 0x10]
pop edi
mov dword [ecx], esi
mov dword [esi + 4], ecx
pop esi
pop ebx
pop ebp
add esp, 0x18
ret 8
Function at 0x10059030
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
sub esp, 0x18
push ebx
mov ebx, dword [esp + 0x20]
push ebp
mov ebp, dword [esp + 0x28]
push edi
mov edi, ecx
cmp ebx, ebp
je 0x100591d5
cmp dword [ebx + 0x1c], 0x10
mov eax, dword [edi + 4]
mov dword [esp + 0x1c], eax
mov eax, dword [edi + 0xc]
mov dword [esp + 0x18], eax
mov eax, dword [ebx + 4]
push esi
mov dword [esp + 0x2c], eax
lea esi, [ebx + 8]
jb 0x1005906a
mov esi, dword [ebx + 8]
xor ecx, ecx
mov edx, 0x811c9dc5
cmp dword [ebx + 0x18], ecx
jbe 0x10059088
movzx eax, byte [ecx + esi]
inc ecx
xor eax, edx
imul edx, eax, 0x1000193
cmp ecx, dword [ebx + 0x18]
jb 0x10059076
mov eax, dword [edi + 0x18]
mov ecx, dword [esp + 0x1c]
and eax, edx
mov esi, dword [ebx]
mov edx, ebx
lea eax, [ecx + eax*8]
mov ecx, dword [eax]
mov dword [esp + 0x10], eax
mov eax, dword [eax + 4]
mov dword [esp + 0x18], ecx
mov dword [esp + 0x14], eax
call fcn.10059da0
dec dword [edi + 8]
cmp ebx, dword [esp + 0x14]
je 0x100590d5
mov dword [esp + 0x24], esi
cmp esi, ebp
je 0x100590e7
mov edx, esi
mov esi, dword [esi]
call fcn.10059da0
dec dword [edi + 8]
mov eax, dword [esp + 0x14]
cmp dword [esp + 0x24], eax
jne 0x100590b7
mov ecx, dword [esp + 0x10]
cmp dword [esp + 0x18], ebx
jne 0x1005910c
mov eax, dword [esp + 0x20]
mov dword [ecx], eax
jmp 0x10059110
cmp dword [esp + 0x18], ebx
jne 0x100591cb
mov eax, dword [esp + 0x2c]
mov ecx, dword [esp + 0x10]
mov dword [ecx], esi
mov dword [eax], esi
mov dword [esi + 4], eax
mov eax, ebp
pop esi
pop edi
pop ebp
pop ebx
add esp, 0x18
ret 8
mov eax, dword [esp + 0x2c]
mov dword [ecx + 4], eax
cmp esi, ebp
je 0x100591cb
nop dword [eax + eax]
cmp dword [esi + 0x1c], 0x10
lea ebx, [esi + 8]
mov dword [esp + 0x14], esi
jb 0x10059130
mov ebx, dword [esi + 8]
mov eax, dword [esi + 0x18]
xor ecx, ecx
mov dword [esp + 0x24], eax
mov edx, 0x811c9dc5
test eax, eax
je 0x10059159
mov ebp, eax
movzx eax, byte [ecx + ebx]
inc ecx
xor eax, edx
imul edx, eax, 0x1000193
cmp ecx, ebp
jb 0x10059144
mov ebp, dword [esp + 0x30]
mov eax, dword [edi + 0x18]
mov ecx, dword [esp + 0x1c]
and eax, edx
mov ebx, dword [ecx + eax*8 + 4]
lea eax, [ecx + eax*8]
mov edx, esi
mov dword [esp + 0x18], eax
mov esi, dword [esi]
mov dword [esp + 0x24], ebx
call fcn.10059da0
dec dword [edi + 8]
cmp dword [esp + 0x14], ebx
je 0x1005919b
mov ebx, esi
cmp esi, ebp
je 0x100591c5
mov edx, esi
mov esi, dword [esi]
call fcn.10059da0
dec dword [edi + 8]
cmp ebx, dword [esp + 0x24]
jne 0x10059183
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x20]
mov dword [eax], ecx
mov dword [eax + 4], ecx
cmp esi, ebp
jne 0x10059120
mov eax, dword [esp + 0x2c]
mov dword [eax], esi
mov dword [esi + 4], eax
mov eax, ebp
pop esi
pop edi
pop ebp
pop ebx
add esp, 0x18
ret 8
mov eax, dword [esp + 0x18]
mov dword [eax], esi
mov eax, dword [esp + 0x2c]
mov dword [eax], esi
mov dword [esi + 4], eax
pop esi
pop edi
mov eax, ebp
pop ebp
pop ebx
add esp, 0x18
ret 8
Function at 0x10059e10
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push esi
mov esi, dword [esp + 0xc]
mov edx, 0x811c9dc5
push edi
mov edi, dword [esp + 0xc]
mov ecx, 0
sub esi, edi
je 0x10059e39
movzx eax, byte [ecx + edi]
inc ecx
xor eax, edx
imul edx, eax, 0x1000193
cmp ecx, esi
jb 0x10059e28
pop edi
mov eax, edx
pop esi
ret 8

Function at 0x1005a350
Capabilities:
Hash data using fnv

Disassembly:
sub esp, 8
mov edx, dword [esp + 0xc]
mov eax, 0x1fffffff
push ebx
mov ebx, ecx
bsr ecx, eax
push ebp
push esi
push edi
mov edi, 1
mov dword [esp + 0x10], ebx
mov eax, edi
shl eax, cl
cmp edx, eax
ja 0x1005a4a5
mov esi, dword [ebx + 4]
lea eax, [edx - 1]
or eax, edi
lea ebp, [ebx + 0xc]
bsr ecx, eax
push esi
lea ecx, [ecx + 1]
shl edi, cl
mov ecx, ebp
lea eax, [edi + edi]
push eax
call fcn.100591e0
lea eax, [edi - 1]
mov dword [ebx + 0x1c], edi
mov dword [ebx + 0x18], eax
mov eax, dword [ebx + 4]
mov eax, dword [eax]
mov ecx, eax
cmp eax, esi
je 0x1005a47f
movzx edx, byte [eax + 8]
xor edx, 0x811c9dc5
mov ecx, dword [ecx]
imul edi, edx, 0x1000193
movzx edx, byte [eax + 9]
xor edi, edx
movzx edx, byte [eax + 0xa]
imul edi, edi, 0x1000193
xor edi, edx
movzx edx, byte [eax + 0xb]
imul edi, edi, 0x1000193
xor edi, edx
imul edx, edi, 0x1000193
mov edi, dword [ebx + 0x18]
and edi, edx
mov edx, dword [ebp]
lea ebp, [edx + edi*8]
mov edi, dword [ebp]
mov dword [esp + 0x1c], ebp
cmp edi, esi
jne 0x1005a405
mov dword [ebp], eax
mov dword [ebp + 4], eax
jmp 0x1005a472
mov edx, dword [ebp + 4]
mov ebx, dword [eax + 8]
cmp ebx, dword [edx + 8]
jne 0x1005a43f
mov edx, dword [edx]
mov dword [esp + 0x14], edx
cmp edx, eax
je 0x1005a43a
mov ebx, dword [eax + 4]
mov ebp, dword [esp + 0x14]
mov dword [ebx], ecx
mov edi, dword [ecx + 4]
mov dword [edi], edx
mov edx, dword [edx + 4]
mov dword [edx], eax
mov dword [ebp + 4], edi
mov ebp, dword [esp + 0x1c]
mov dword [ecx + 4], ebx
mov dword [eax + 4], edx
mov dword [ebp + 4], eax
jmp 0x1005a46e
cmp edi, edx
je 0x1005a44f
mov edx, dword [edx + 4]
cmp ebx, dword [edx + 8]
je 0x1005a489
cmp edi, edx
jne 0x1005a443
mov ebp, dword [eax + 4]
mov dword [ebp], ecx
mov ebx, dword [ecx + 4]
mov dword [ebx], edx
mov edi, dword [edx + 4]
mov dword [edi], eax
mov dword [edx + 4], ebx
mov edx, dword [esp + 0x1c]
mov dword [ecx + 4], ebp
mov dword [eax + 4], edi
mov dword [edx], eax
mov ebx, dword [esp + 0x10]
lea ebp, [ebx + 0xc]
mov eax, ecx
cmp ecx, esi
jne 0x1005a3b1
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret 4
mov ebx, dword [eax + 4]
mov ebp, dword [edx]
mov dword [ebx], ecx
mov edi, dword [ecx + 4]
mov dword [edi], ebp
mov edx, dword [ebp + 4]
mov dword [edx], eax
mov dword [ebp + 4], edi
mov dword [ecx + 4], ebx
mov dword [eax + 4], edx
jmp 0x1005a46e
push str.invalid_hash_bucket_count
call fcn.10078fcb
int3
Function at 0x1006d8a0
Capabilities:
Encode data using xor

Disassembly:
push ecx
xor eax, eax
mov dword [0x100e47b0], eax
mov word [0x100e47b4], ax
movzx eax, cl
lea ecx, [ecx + ecx*2]
imul eax, eax, 0xd
add ecx, ecx
push ebx
push esi
mov bl, al
mov dword [esp + 8], eax
xor bl, 0x6e
xor eax, eax
sub ecx, 0x100e47b0
lea esi, [ecx + 0x100ac560]
mov dl, byte [esi + eax + 0x100e47b0]
mov cl, dl
add dl, byte [esp + 8]
xor cl, bl
add dl, al
mov byte [eax + 0x100e47b0], cl
add bl, dl
inc eax
cmp eax, 6
jl 0x1006d8d2
pop esi
pop ebx
mov eax, 0x100e47b0
pop ecx
ret
Function at 0x10070b20
Capabilities:
Encode data using xor

Disassembly:
push esi
xorps xmm0, xmm0
lea edx, [ecx + 0x100c7a88]
mov esi, 0x100e47cc
movups xmmword [0x100e47cc], xmm0
sub esi, ecx
movups xmmword [0x100e47dc], xmm0
nop
mov al, byte [edx]
lea edx, [edx + 1]
xor al, cl
xor al, 0x6e
mov byte [esi + ecx], al
inc ecx
test al, al
jne 0x10070b40
pop esi
mov eax, 0x100e47cc
ret
Function at 0x10072af5
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
not ecx
cmp esi, 4
jb 0x10072b60
push edi
mov edi, esi
shr edi, 2
movzx eax, byte [edx]
sub esi, 4
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x1009e030]
movzx eax, byte [edx + 1]
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x1009e030]
movzx eax, byte [edx + 2]
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x1009e030]
movzx eax, byte [edx + 3]
add edx, 4
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x1009e030]
sub edi, 1
jne 0x10072b09
pop edi
test esi, esi
je 0x10072b7c
movzx eax, byte [edx]
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x1009e030]
inc edx
sub esi, 1
jne 0x10072b64
not ecx
mov eax, ecx
pop esi
pop ebp
ret
Function at 0x1007892c
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x464
mov eax, dword [0x100c701c]
xor eax, esp
mov dword [esp + 0x460], eax
push ebx
push esi
mov esi, ecx
push edi
mov edi, edx
test esi, esi
jne 0x10078959
or eax, 0xffffffff
jmp 0x10078a47
cmp dword [esi + 0x14], 1
je 0x10078967
push 0xfffffffffffffffc
pop eax
jmp 0x10078a47
cmp edi, dword [esi + 0x10]
jb 0x10078970
push 0xfffffffffffffff6
jmp 0x10078961
mov ecx, dword [esi + 0x48]
mov eax, dword [ecx + 0x10]
mov eax, dword [eax + edi*4]
add eax, dword [ecx]
jne 0x10078981
push 0xfffffffffffffff5
jmp 0x10078961
movzx ebx, word [eax + 0x1c]
add eax, 0x2e
cmp dword [esi + 0x5c], 0
mov dword [esp + 0xc], eax
je 0x100789a4
push dword [esi + 0x5c]
call dword [sym.imp.msvcrt.dll_free]
and dword [esi + 0x5c], 0
mov eax, dword [esp + 0x10]
pop ecx
push ecx
push ecx
mov edx, ebx
mov ecx, eax
call fcn.100787e7
mov dword [esi + 0x5c], eax
pop ecx
pop ecx
test eax, eax
jne 0x100789bc
push 0xfffffffffffffffe
jmp 0x10078961
lea eax, [esp + 0x10]
mov edx, edi
push eax
mov ecx, esi
call fcn.100787b7
pop ecx
test eax, eax
jne 0x100789d3
push 0xfffffffffffffffd
jmp 0x10078961
mov eax, dword [esp + 0x38]
mov ecx, dword [esp + 0x3c]
mov dword [esi + 0x68], eax
mov eax, dword [esp + 0x40]
mov dword [esi + 0x60], eax
mov eax, dword [esp + 0x30]
mov dword [esi + 0x70], eax
mov eax, dword [esp + 0x18]
mov dword [esi + 0x78], eax
mov eax, dword [esp + 0x50]
mov dword [esi + 0x6c], ecx
mov ecx, dword [esp + 0x44]
mov dword [esi + 0xa0], eax
mov ax, word [esp + 0x26]
mov dword [esi + 0x64], ecx
mov ecx, dword [esp + 0x1c]
mov word [esi + 0xa8], ax
mov eax, dword [esp + 0x4c]
mov dword [esi + 0x7c], ecx
mov ecx, dword [esp + 0x54]
mov dword [esi + 0x4e008], eax
mov eax, dword [esp + 0x28]
mov dword [esi + 0xa4], ecx
mov ecx, dword [esp + 0x2c]
mov dword [esi + 0x4e010], eax
xor eax, eax
mov dword [esi + 0x58], edi
mov dword [esi + 0x4e014], ecx
mov ecx, dword [esp + 0x46c]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.1007b0c7
mov esp, ebp
pop ebp
ret