joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10001370
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
push edi
mov edi, edx
mov ebx, ecx
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x100013c8
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x100013c8
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [esp + 0x10]
lea edx, [esi + eax]
and ecx, 0xf
jbe 0x100013b6
cmp esi, edx
jae 0x100013c8
movzx eax, word [esi]
lea esi, [esi + eax*2]
add esi, 2
sub ecx, 1
jne 0x100013a4
cmp esi, edx
jae 0x100013c8
xor eax, eax
cmp word [esi], ax
pop edi
cmove esi, eax
mov eax, esi
pop esi
pop ebx
ret
pop edi
pop esi
xor eax, eax
pop ebx
ret
Function at 0x100094a0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10054ced
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push ebx
push esi
push edi
mov eax, dword [0x10065070]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x10], edi
mov eax, dword [edi]
mov eax, dword [eax + 4]
mov dword [edi + eax], vtable.std::basic_istream_char__struct_std::char_traits_char__.0
mov eax, dword [edi]
mov edx, dword [eax + 4]
lea eax, [edx - 0x18]
mov dword [edx + edi - 4], eax
mov eax, dword [edi]
mov dword [edi + 8], 0
mov dword [edi + 0xc], 0
mov esi, dword [eax + 4]
add esi, edi
mov ecx, esi
call fcn.100028c0
mov eax, dword [ebp + 8]
mov dword [esi + 0x38], eax
mov eax, dword [esi + 0x30]
mov dword [esi + 0x3c], 0
mov ebx, dword [eax + 4]
mov ecx, ebx
mov dword [ebp - 0x18], ebx
mov eax, dword [ebx]
call dword [eax + 4]
lea eax, [ebp - 0x1c]
mov dword [ebp - 4], 1
push eax
call fcn.1000b920
add esp, 4
mov ecx, dword [eax]
push 0x20
mov edx, dword [ecx + 0x20]
mov ecx, eax
call edx
mov byte [ebp + 0xb], al
mov byte [ebp - 4], 0
test ebx, ebx
je 0x1000955d
mov edx, dword [ebx]
mov ecx, ebx
call dword [edx + 8]
test eax, eax
je 0x1000955a
mov edx, dword [eax]
mov ecx, eax
push 1
call dword [edx]
mov al, byte [ebp + 0xb]
cmp dword [esi + 0x38], 0
mov byte [esi + 0x40], al
jne 0x10009576
mov eax, dword [esi + 0xc]
mov ecx, esi
push 0
or eax, 4
push eax
call fcn.10002840
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc

Function at 0x1000a5b0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10054da0
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x10065070]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov dword [ebp - 0x10], ebx
push 8
mov dword [ebx], vtable.std::basic_streambuf_char__struct_std::char_traits_char__.0
call fcn.10045fe5
mov esi, eax
push 1
mov dword [ebp - 4], 0
call fcn.1002e095
add esp, 8
mov dword [esi + 4], eax
mov ecx, ebx
mov dword [ebx + 0x34], esi
call fcn.1000a830
mov eax, ebx
lea ecx, [eax + 0x18]
lea edx, [eax + 0x24]
lea esi, [eax + 8]
lea ebx, [eax + 4]
mov dword [eax + 0x2c], edx
mov dword [eax + 0xc], ebx
lea edi, [eax + 0x14]
mov dword [eax], vtable.std::basic_filebuf_char__struct_std::char_traits_char__.0
mov byte [eax + 0x48], 0
mov byte [eax + 0x3d], 0
mov dword [eax + 0x10], esi
mov dword [eax + 0x1c], edi
mov dword [eax + 0x20], ecx
add eax, 0x28
mov dword [ebp - 0x14], ebx
mov ebx, dword [ebp - 0x10]
mov dword [ebx + 0x30], eax
mov ebx, dword [ebp - 0x14]
mov dword [esi], 0
mov dword [ecx], 0
mov dword [eax], 0
mov dword [ebx], 0
mov dword [edi], 0
mov dword [edx], 0
mov edx, dword [ebp - 0x10]
mov dword [edx + 0x4c], 0
mov eax, dword [0x10066f30]
mov ecx, dword [0x10066f34]
mov dword [edx + 0x40], eax
mov eax, edx
mov dword [edx + 0x44], ecx
mov dword [edx + 0x38], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1000ed40
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push esi
mov esi, dword [esp + 0x10]
xor ecx, ecx
test esi, esi
je 0x1000ed6a
mov edx, dword [esp + 8]
push edi
mov edi, dword [esp + 0x10]
movzx eax, byte [ecx + edi]
inc ecx
xor eax, edx
imul edx, eax, 0x1000193
cmp ecx, esi
jb 0x1000ed54
pop edi
mov eax, edx
pop esi
ret
mov eax, dword [esp + 8]
pop esi
ret

Function at 0x1000f1a0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov edx, dword [esp + 8]
mov ecx, 0
push esi
push edi
mov edi, dword [esp + 0xc]
mov esi, 0x811c9dc5
sub edx, edi
sar edx, 1
add edx, edx
je 0x1000f1d1
nop dword [eax]
movzx eax, byte [ecx + edi]
inc ecx
xor eax, esi
imul esi, eax, 0x1000193
cmp ecx, edx
jb 0x1000f1c0
pop edi
mov eax, esi
pop esi
ret 8

Function at 0x1000fca0
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push 0xfffffffffffffffe
push 0x100624b0
push fcn.10047070
mov eax, dword fs:[0]
push eax
sub esp, 0x24
push ebx
push esi
push edi
mov eax, dword [0x10065070]
xor dword [ebp - 8], eax
xor eax, ebp
push eax
lea eax, [ebp - 0x10]
mov dword fs:[0], eax
mov dword [ebp - 0x18], esp
mov edi, edx
push 0x1c
lea eax, [ebp - 0x34]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
mov dword [ebp - 4], 0
mov eax, 0x5a4d
mov ecx, dword [ebp - 0x30]
cmp word [ecx], ax
jne 0x1000fd50
mov edx, dword [ecx + 0x3c]
cmp dword [edx + ecx], 0x4550
jne 0x1000fd50
mov esi, dword [edx + ecx + 0xd8]
lea eax, [esi + ecx]
cmp edi, eax
jb 0x1000fd50
mov eax, dword [edx + ecx + 0xdc]
add eax, esi
add eax, ecx
cmp edi, eax
jae 0x1000fd50
mov dword [ebp - 4], 0xfffffffe
mov al, 1
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov dword [ebp - 4], 0xfffffffe
xor al, al
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10010070
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
sub esp, 0x1c
push ebx
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov ebx, edx
push esi
mov esi, ecx
push edi
lea ecx, [esi - 0x10000]
movzx eax, cx
mov edi, ecx
sub edi, eax
test eax, eax
cmove edi, ecx
cmp edi, ebx
jbe 0x1001012e
nop dword [eax + eax]
lea eax, [edi - 0x70000000]
cmp eax, 0x10000000
ja 0x100100b5
sub edi, 0x8000000
jmp 0x10010126
push 0x1c
lea eax, [esp + 0x14]
mov dword [esp + 0x2c], 0
xorps xmm0, xmm0
push eax
push edi
movups xmmword [esp + 0x1c], xmm0
movq qword [esp + 0x2c], xmm0
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
je 0x1001012e
cmp dword [esp + 0x20], 0x10000
jne 0x10010110
cmp dword [esp + 0x1c], 0x10000
jb 0x10010110
push 0x40
push 0x3000
push 0x10000
push edi
call ebp
test eax, eax
jne 0x100101da
sub edi, 0x10000
jmp 0x10010126
mov ecx, dword [esp + 0x14]
add ecx, 0xffff0000
mov edi, ecx
movzx eax, di
sub edi, eax
test eax, eax
cmove edi, ecx
cmp edi, ebx
ja 0x100100a0
movzx eax, si
test eax, eax
je 0x1001013d
sub esi, eax
add esi, 0x10000
mov edi, dword [esp + 0x30]
cmp esi, edi
jae 0x100101d8
mov ebx, dword [sym.imp.KERNEL32.dll_VirtualQuery]
nop
lea eax, [esi - 0x70000000]
cmp eax, 0x10000000
ja 0x10010165
add esi, 0x8000000
jmp 0x100101d0
push 0x1c
lea eax, [esp + 0x14]
mov dword [esp + 0x2c], 0
xorps xmm0, xmm0
push eax
push esi
movups xmmword [esp + 0x1c], xmm0
movq qword [esp + 0x2c], xmm0
call ebx
test eax, eax
je 0x100101d8
cmp dword [esp + 0x20], 0x10000
mov ecx, dword [esp + 0x1c]
jne 0x100101ba
cmp ecx, 0x10000
jb 0x100101ba
push 0x40
push 0x3000
push 0x10000
push esi
call ebp
test eax, eax
jne 0x100101da
add esi, 0x10000
jmp 0x100101d0
mov esi, dword [esp + 0x10]
add esi, ecx
movzx ecx, si
test ecx, ecx
je 0x100101d0
mov eax, 0x10000
sub eax, ecx
add esi, eax
cmp esi, edi
jb 0x10010150
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x1c
ret

Function at 0x10010290
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ecx
cmp dword [0x10066eb4], 0
jne 0x10010306
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov ecx, eax
mov edx, 0x10066eb4
xor eax, eax
lock cmpxchg dword [edx], ecx
test eax, eax
jne 0x10010306
push esi
mov esi, dword [0x10066ec0]
mov dword [0x10066ec8], eax
mov dword [0x10066ec4], eax
mov dword [0x10066ebc], eax
push edi
test esi, esi
je 0x100102ec
mov edi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [esp + 8]
push eax
push 0x40
push 0x10000
push esi
call edi
test eax, eax
je 0x100102f7
mov esi, dword [esi + 4]
test esi, esi
jne 0x100102d2
xor eax, eax
pop edi
mov dword [0x10066eb0], eax
pop esi
pop ecx
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
pop edi
mov dword [0x10066eb0], eax
pop esi
pop ecx
ret
mov eax, 0x10dd
pop ecx
ret
Function at 0x10010740
Capabilities:
Suspend thread

Disassembly:
mov eax, dword [0x10066eb0]
push esi
mov esi, ecx
test eax, eax
jne 0x100107ae
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
cmp esi, eax
jne 0x1001075a
xor eax, eax
pop esi
ret
push edi
push 8
call fcn.10045fe5
add esp, 4
mov edi, eax
push esi
call dword [sym.imp.KERNEL32.dll_SuspendThread]
cmp eax, 0xffffffff
jne 0x1001079b
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
push 8
push edi
call fcn.1004632f
add esp, 8
mov dword [0x10066eb0], esi
mov eax, esi
mov dword [0x10066ebc], 0
pop edi
pop esi
ret
mov eax, dword [0x10066ec4]
mov dword [edi], eax
xor eax, eax
mov dword [edi + 4], esi
mov dword [0x10066ec4], edi
pop edi
pop esi
ret
Function at 0x10010c90
Capabilities:
Allocate or change rwx memory

Disassembly:
sub esp, 0x1c
push ebx
push esi
push edi
mov ebx, edx
mov esi, ecx
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edi, eax
mov dword [esp + 0x24], 0
push 0x1c
lea eax, [esp + 0x10]
xorps xmm0, xmm0
push eax
push esi
push edi
movups xmmword [esp + 0x1c], xmm0
movq qword [esp + 0x2c], xmm0
call dword [sym.imp.KERNEL32.dll_VirtualQueryEx]
test eax, eax
jne 0x10010cd4
pop edi
pop esi
pop ebx
add esp, 0x1c
ret 8
push dword [esp + 0x30]
test byte [esp + 0x24], 0xf0
mov ecx, 0x40
mov eax, 4
cmovne eax, ecx
push eax
push ebx
push esi
push edi
call dword [sym.imp.KERNEL32.dll_VirtualProtectEx]
pop edi
pop esi
pop ebx
add esp, 0x1c
ret 8

Function at 0x10010d00
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push 0xfffffffffffffffe
push 0x100624d0
push fcn.10047070
mov eax, dword fs:[0]
push eax
sub esp, 0x24
push ebx
push esi
push edi
mov eax, dword [0x10065070]
xor dword [ebp - 8], eax
xor eax, ebp
push eax
lea eax, [ebp - 0x10]
mov dword fs:[0], eax
mov dword [ebp - 0x18], esp
lea esi, [ecx + 0x10000]
xorps xmm0, xmm0
movups xmmword [ebp - 0x34], xmm0
movq qword [ebp - 0x24], xmm0
mov dword [ebp - 0x1c], 0
mov edi, 0x5a4d
push 0x1c
lea eax, [ebp - 0x34]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
jne 0x10010d74
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
cmp dword [ebp - 0x24], 0x1000
jne 0x10010dfa
cmp byte [ebp - 0x20], 1
je 0x10010dfa
test dword [ebp - 0x20], 0x100
jne 0x10010dfa
mov dword [ebp - 4], 0
cmp word [esi], di
jne 0x10010dae
mov eax, dword [esi + 0x3c]
cmp eax, dword [ebp - 0x28]
ja 0x10010dae
cmp eax, 0x40
jb 0x10010dae
cmp dword [eax + esi], 0x4550
je 0x10010dbd
mov dword [ebp - 4], 0xfffffffe
mov esi, dword [ebp - 0x28]
add esi, dword [ebp - 0x34]
jmp 0x10010d51
mov dword [ebp - 4], 0xfffffffe
mov eax, esi
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov esi, dword [ebp - 0x28]
add esi, dword [ebp - 0x34]
jmp 0x10010d51
Function at 0x10010e10
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push 0xfffffffffffffffe
push 0x100624f0
push fcn.10047070
mov eax, dword fs:[0]
push eax
sub esp, 0x18
push ebx
push esi
push edi
mov eax, dword [0x10065070]
xor dword [ebp - 8], eax
xor eax, ebp
push eax
lea eax, [ebp - 0x10]
mov dword fs:[0], eax
mov dword [ebp - 0x18], esp
mov ebx, ecx
test ebx, ebx
jne 0x10010e52
push ecx
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov ebx, eax
mov dword [ebp - 4], 0
mov eax, 0x5a4d
cmp word [ebx], ax
je 0x10010e6d
push 0xc1
jmp 0x10010f61
mov ecx, dword [ebx + 0x3c]
add ecx, ebx
mov dword [ebp - 0x24], ecx
cmp dword [ecx], 0x4550
je 0x10010e87
push 0xbf
jmp 0x10010f61
movzx eax, word [ecx + 0x14]
test ax, ax
je 0x10010f5c
lea edx, [eax + ecx]
mov dword [ebp - 0x1c], edx
lea edx, [eax + 0x18]
add edx, ecx
mov dword [ebp - 0x28], edx
xor esi, esi
mov dword [ebp - 0x20], esi
movzx eax, word [ecx + 6]
cmp esi, eax
jae 0x10010f5c
lea edi, [esi + esi*4]
mov ecx, str..detour
lea eax, [edx + edi*8]
nop
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x10010ee0
test dl, dl
je 0x10010edc
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x10010ee0
add eax, 2
add ecx, 2
test dl, dl
jne 0x10010ec0
xor eax, eax
jmp 0x10010ee5
sbb eax, eax
or eax, 1
test eax, eax
jne 0x10010f3a
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ecx + edi*8 + 0x24]
test eax, eax
je 0x10010f5c
cmp dword [ecx + edi*8 + 0x28], 0
je 0x10010f5c
lea esi, [eax + ebx]
mov eax, dword [esi]
cmp eax, 0x40
jb 0x10010f5c
cmp dword [esi + 4], 0x727444
jne 0x10010f5c
cmp dword [esi + 8], 0
jne 0x10010f17
mov dword [esi + 8], eax
push 0
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov dword [ebp - 4], 0xfffffffe
mov eax, esi
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
inc esi
mov ecx, dword [ebp - 0x24]
mov edx, dword [ebp - 0x28]
jmp 0x10010ea4
push 0xc0
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov dword [ebp - 4], 0xfffffffe
xor eax, eax
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10012510
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100554f0
mov eax, dword fs:[0]
push eax
sub esp, 0x24
push ebx
push esi
push edi
mov eax, dword [0x10065070]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x1c], edx
mov edi, ecx
mov dword [ebp - 0x18], edi
mov dword [ebp - 4], 0
mov eax, dword [0x10066ed4]
mov esi, dword [eax]
cmp esi, eax
je 0x10012618
cmp dword [edi + 0x14], 8
mov ebx, edi
mov eax, dword [edi + 0x10]
mov dword [ebp - 0x14], eax
jb 0x10012569
mov ebx, dword [edi]
lea ecx, [eax + eax]
mov edx, 0x811c9dc5
xor eax, eax
test ecx, ecx
je 0x10012591
movzx ecx, byte [eax + ebx]
inc eax
mov edi, dword [ebp - 0x14]
xor ecx, edx
imul edx, ecx, 0x1000193
lea ecx, [edi + edi]
mov edi, dword [ebp - 0x18]
cmp eax, ecx
jb 0x10012577
mov ebx, dword [esi + 0x20]
lea eax, [ebp - 0x24]
push edx
push edi
push eax
lea ecx, [ebx + 4]
call fcn.10014510
mov eax, dword [eax + 4]
test eax, eax
jne 0x100125ac
mov eax, dword [ebx + 8]
cmp eax, dword [ebx + 8]
je 0x1001260c
push edi
lea ecx, [ebx + 4]
call fcn.10012e30
sub esp, 0xc
mov ecx, eax
push dword [ebp - 0x1c]
call fcn.10014700
mov al, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov esi, dword [esi]
mov eax, dword [0x10066ed4]
jmp 0x10012551
xor al, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10013840
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10055645
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push esi
push edi
mov eax, dword [0x10065070]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, dword [ebp + 0xc]
mov edx, edi
cmp dword [edi + 0x14], 0x10
jb 0x10013874
mov edx, dword [edi]
xor ecx, ecx
mov esi, 0x811c9dc5
cmp dword [edi + 0x10], ecx
jbe 0x10013892
movzx eax, byte [ecx + edx]
inc ecx
xor eax, esi
imul esi, eax, 0x1000193
cmp ecx, dword [edi + 0x10]
jb 0x10013880
push esi
push edi
lea eax, [ebp - 0x14]
push eax
call fcn.100145c0
mov ecx, dword [ebp - 0x10]
test ecx, ecx
je 0x100138c0
mov eax, dword [ebp + 8]
mov dword [eax], ecx
mov byte [eax + 4], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 8
cmp dword [0x10066ed8], 0x71c71c7
je 0x100139c9
mov dword [ebp - 0x1c], 0x10066ed4
mov dword [ebp - 4], 0
push 0x24
mov dword [ebp - 0x18], 0
call fcn.10045fe5
mov ecx, eax
xorps xmm0, xmm0
mov dword [ebp - 0x18], ecx
add esp, 4
mov dword [ebp + 0xc], ecx
movups xmmword [ecx + 8], xmm0
mov dword [ecx + 0x18], 0
mov dword [ecx + 0x1c], 0
movups xmm0, xmmword [edi]
movups xmmword [ecx + 8], xmm0
movq xmm0, qword [edi + 0x10]
movq qword [ecx + 0x18], xmm0
mov dword [edi + 0x10], 0
mov dword [edi + 0x14], 0xf
mov byte [edi], 0
mov eax, dword [edi + 0x18]
mov dword [ecx + 0x20], eax
mov dword [ebp - 4], 1
mov eax, dword [0x10066ed8]
inc eax
movd xmm0, eax
cvtdq2pd xmm0, xmm0
shr eax, 0x1f
addsd xmm0, qword [eax*8 + 0x1005e5a0]
mov eax, dword [0x10066eec]
cvtpd2ps xmm1, xmm0
movd xmm0, eax
cvtdq2pd xmm0, xmm0
shr eax, 0x1f
addsd xmm0, qword [eax*8 + 0x1005e5a0]
cvtpd2ps xmm0, xmm0
divss xmm1, xmm0
comiss xmm1, dword [0x10066ed0]
jbe 0x100139a0
call fcn.10013eb0
mov eax, dword [ebp + 0xc]
push esi
add eax, 8
push eax
lea eax, [ebp - 0x1c]
push eax
call fcn.100145c0
mov ecx, dword [ebp + 0xc]
mov edx, dword [eax]
jmp 0x100139a3
mov edx, dword [ebp - 0x14]
push ecx
push edx
push esi
call fcn.10013f30
mov ecx, dword [ebp + 8]
mov dword [ecx], eax
mov eax, ecx
mov byte [ecx + 4], 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 8
push str.unordered_map_set_too_long
call fcn.1002de6e
int3
Function at 0x10013a40
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10055685
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push ebx
push esi
push edi
mov eax, dword [0x10065070]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
mov edx, dword [ebp + 0xc]
mov ebx, edx
cmp dword [edx + 0x14], 8
mov eax, dword [edx + 0x10]
jb 0x10013a7d
mov ebx, dword [edx]
xor ecx, ecx
mov edi, 0x811c9dc5
add eax, eax
je 0x10013aa4
mov esi, eax
nop word [eax + eax]
movzx eax, byte [ecx + ebx]
inc ecx
xor eax, edi
imul edi, eax, 0x1000193
cmp ecx, esi
jb 0x10013a90
mov esi, dword [ebp - 0x10]
push edi
push edx
lea eax, [ebp - 0x18]
mov ecx, esi
push eax
call fcn.10014510
mov ecx, dword [ebp - 0x14]
test ecx, ecx
je 0x10013ad5
mov eax, dword [ebp + 8]
mov dword [eax], ecx
mov byte [eax + 4], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
cmp dword [esi + 8], 0x2222222
je 0x10013bdd
lea eax, [esi + 4]
mov dword [ebp - 0x20], eax
mov dword [ebp - 4], 0
push 0x78
mov dword [ebp - 0x1c], 0
call fcn.10045fe5
add esp, 4
mov ebx, eax
mov dword [ebp - 0x1c], ebx
push dword [ebp + 0xc]
lea ecx, [ebx + 8]
call fcn.1000ef70
lea ecx, [ebx + 0x20]
call fcn.10014690
mov esi, dword [ebp - 0x10]
mov dword [ebp - 4], 1
mov eax, dword [esi + 8]
inc eax
movd xmm0, eax
cvtdq2pd xmm0, xmm0
shr eax, 0x1f
addsd xmm0, qword [eax*8 + 0x1005e5a0]
mov eax, dword [esi + 0x1c]
cvtpd2ps xmm1, xmm0
movd xmm0, eax
cvtdq2pd xmm0, xmm0
shr eax, 0x1f
addsd xmm0, qword [eax*8 + 0x1005e5a0]
cvtpd2ps xmm0, xmm0
divss xmm1, xmm0
comiss xmm1, dword [esi]
jbe 0x10013b7d
mov ecx, esi
call fcn.10013fa0
push edi
lea eax, [ebx + 8]
mov ecx, esi
push eax
lea eax, [ebp - 0x18]
push eax
call fcn.10014510
mov edx, dword [eax]
jmp 0x10013b80
mov edx, dword [ebp - 0x18]
mov eax, dword [edx + 4]
inc dword [esi + 8]
mov dword [ebx + 4], eax
mov dword [ebx], edx
mov dword [eax], ebx
mov dword [edx + 4], ebx
mov ecx, dword [esi + 0xc]
mov dword [ebp + 0xc], eax
mov eax, dword [esi + 0x18]
and eax, edi
mov edi, dword [ebp - 0x20]
mov esi, dword [ecx + eax*8]
cmp esi, dword [edi]
jne 0x10013baa
mov dword [ecx + eax*8], ebx
jmp 0x10013bbc
cmp esi, edx
jne 0x10013bb3
mov dword [ecx + eax*8], ebx
jmp 0x10013bc0
mov edx, dword [ebp + 0xc]
cmp dword [ecx + eax*8 + 4], edx
jne 0x10013bc0
mov dword [ecx + eax*8 + 4], ebx
mov eax, dword [ebp + 8]
mov dword [eax], ebx
mov byte [eax + 4], 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
push str.unordered_map_set_too_long
call fcn.1002de6e
int3
Function at 0x1001cb80
Capabilities:
Hash data using djb2

Disassembly:
push ebx
push esi
push edi
mov ebx, ecx
xor edi, edi
mov esi, 0x1505
test ebx, ebx
jne 0x1001cb96
xor eax, eax
pop edi
pop esi
pop ebx
ret
mov dl, byte [ebx]
test dl, dl
je 0x1001cbc0
nop dword [eax]
mov eax, esi
lea ebx, [ebx + 1]
mov ecx, edi
shld edi, esi, 5
shl esi, 5
add esi, eax
movzx eax, dl
cdq
adc edi, ecx
add esi, eax
adc edi, edx
mov dl, byte [ebx]
test dl, dl
jne 0x1001cba0
pop edi
mov eax, esi
pop esi
pop ebx
ret
Function at 0x100231f0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push ecx
mov eax, dword [ebp + 8]
xor edx, edx
push ebx
push esi
push edi
xor edi, edi
bts edi, eax
cmp eax, 0x20
cmovae edx, edi
xor edi, edx
cmp eax, 0x40
mov eax, dword [ebp + 0xc]
cmovae edx, edi
test eax, eax
js 0x10023242
lea ebx, [ebp + 0xc]
nop dword [eax]
xor ecx, ecx
lea ebx, [ebx + 4]
bts ecx, eax
xor esi, esi
cmp eax, 0x20
cmovae esi, ecx
xor ecx, esi
cmp eax, 0x40
mov eax, dword [ebx]
cmovae esi, ecx
or edi, ecx
or edx, esi
test eax, eax
jns 0x10023220
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10023fb0
Capabilities:
Generate random numbers via winapi

Disassembly:
sub esp, 0x50
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
cmp byte [edi + 0x28], 0
jne 0x10023ff0
lea ecx, [esp + 0x18]
call fcn.1001bab0
mov ecx, dword [edi]
test ecx, ecx
je 0x1002400a
lea edx, [esp + 0x18]
call fcn.10023400
test eax, eax
jns 0x1002400a
mov ecx, dword [edi]
lea edx, [edi + 0xc]
test edx, edx
je 0x10023ff0
mov eax, dword [ecx + 0xc]
mov dword [edx], eax
mov eax, dword [ecx + 0x10]
mov dword [edx + 4], eax
add esi, 0x18
je 0x10024000
mov eax, dword [edi + 0xc]
mov dword [esi], eax
mov eax, dword [edi + 0x10]
mov dword [esi + 4], eax
or eax, 0xffffffff
pop edi
pop esi
pop ebx
add esp, 0x50
ret
push 3
push 0
push 0x40
lea edx, [esp + 0x24]
mov ecx, edi
call fcn.1001ca90
add esp, 0xc
test edx, edx
jl 0x10023ff0
jg 0x10024028
test eax, eax
jb 0x10023ff0
push dword [esp + 0x44]
lea edx, [esp + 0x14]
push dword [esp + 0x44]
lea ecx, [esp + 0x1c]
call fcn.10021b00
mov ebx, dword [sym.imp.msvcrt.dll_malloc]
push 0xc
call ebx
mov edi, eax
add esp, 0xc
test edi, edi
je 0x10024065
push 0x18
call ebx
add esp, 4
test eax, eax
jne 0x10024088
push edi
call dword [sym.imp.msvcrt.dll_free]
add esp, 4
mov dword [esi + 0x10], 0
add esi, 0x18
je 0x10024000
mov dword [esi], 0xe
or eax, 0xffffffff
mov dword [esi + 4], 0
pop edi
pop esi
pop ebx
add esp, 0x50
ret
push 2
push 0xb
push edi
push 0
mov word [eax], 0x101
mov dword [eax + 4], edi
mov dword [eax + 8], 0xc
mov dword [eax + 0xc], 0
mov dword [eax + 0x10], 0
mov dword [eax + 0x14], 0
mov dword [esi + 0x10], eax
call dword [sym.imp.bcrypt.dll_BCryptGenRandom]
test eax, eax
jns 0x10024106
lea eax, [esi + 0x18]
test eax, eax
je 0x100240d4
mov dword [eax], 0x14
mov dword [eax + 4], 0
mov edi, dword [esi + 0x10]
test edi, edi
je 0x100240f5
cmp byte [edi + 1], 0
mov ebx, dword [sym.imp.msvcrt.dll_free]
je 0x100240ef
push dword [edi + 4]
call ebx
add esp, 4
push edi
call ebx
add esp, 4
mov dword [esi + 0x10], 0
or eax, 0xffffffff
pop edi
pop esi
pop ebx
add esp, 0x50
ret
mov eax, dword [esp + 0x14]
lea ecx, [esi + 4]
push 0
shr eax, 8
mov edx, edi
push 0xc
push edi
mov byte [edi + 0xb], al
call fcn.1002a840
add esp, 0xc
xor eax, eax
pop edi
pop esi
pop ebx
add esp, 0x50
ret