joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10003140
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x100382a4]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, ecx
push edi
cmp dword [esi + 0x38], 0
je 0x100031e3
cmp byte [esi + 0x3d], 0
je 0x100031e3
mov eax, dword [esi]
push 0xffffffffffffffff
call dword [eax + 0xc]
cmp eax, 0xffffffff
je 0x10003198
mov ecx, dword [esi + 0x38]
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [esi + 0x40]
push eax
call dword [sym.imp.MSVCP140.dll_public:_int___thiscall_std::codecvt_char__char__struct__Mbstatet_::unshift_struct__Mbstatet___char___char___char___const]
sub eax, 0
je 0x100031aa
sub eax, 1
je 0x100031ae
sub eax, 2
je 0x100031e3
pop edi
xor al, al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100255b7
mov esp, ebp
pop ebp
ret
mov byte [esi + 0x3d], 0
mov edi, dword [ebp - 0x28]
lea eax, [ebp - 0x24]
sub edi, eax
je 0x100031cc
push dword [esi + 0x4c]
push edi
push 1
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
add esp, 0x10
cmp edi, eax
jne 0x10003198
cmp byte [esi + 0x3d], 0
pop edi
sete al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100255b7
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
mov al, 1
pop edi
xor ecx, ebp
pop esi
call fcn.100255b7
mov esp, ebp
pop ebp
ret
Function at 0x10004ca0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
mov eax, dword [0x100382a4]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push edi
mov edi, ecx
cmp ebx, 0xffffffff
jne 0x10004cd0
pop edi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100255b7
mov esp, ebp
pop ebp
ret 4
push esi
call dword [sym.imp.MSVCP140.dll_protected:_char____thiscall_std::basic_streambuf_char__struct_std::char_traits_char__::pptr_void_const]
test eax, eax
je 0x10004d10
mov ecx, edi
call dword [sym.imp.MSVCP140.dll_protected:_char____thiscall_std::basic_streambuf_char__struct_std::char_traits_char__::epptr_void_const]
mov ecx, edi
mov esi, eax
call dword [sym.imp.MSVCP140.dll_protected:_char____thiscall_std::basic_streambuf_char__struct_std::char_traits_char__::pptr_void_const]
cmp eax, esi
jae 0x10004d10
mov ecx, edi
call dword [sym.imp.MSVCP140.dll_protected:_char____thiscall_std::basic_streambuf_char__struct_std::char_traits_char__::_Pninc_void_]
mov byte [eax], bl
pop esi
pop edi
mov eax, ebx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100255b7
mov esp, ebp
pop ebp
ret 4
cmp dword [edi + 0x4c], 0
je 0x10004df9
mov ecx, edi
call dword [sym.imp.MSVCP140.dll_protected:_char____thiscall_std::basic_streambuf_char__struct_std::char_traits_char__::eback_void_const]
lea ecx, [edi + 0x3c]
cmp eax, ecx
jne 0x10004d39
push dword [edi + 0x54]
mov eax, dword [edi + 0x50]
mov ecx, edi
push eax
push eax
call dword [sym.imp.MSVCP140.dll_protected:_void___thiscall_std::basic_streambuf_char__struct_std::char_traits_char__::setg_char___char___char__]
mov ecx, dword [edi + 0x38]
test ecx, ecx
jne 0x10004d6d
push dword [edi + 0x4c]
movsx eax, bl
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
add esp, 8
or ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, ebx
pop esi
pop edi
mov eax, ecx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100255b7
mov esp, ebp
pop ebp
ret 4
lea eax, [ebp - 0x2c]
mov byte [ebp - 0x28], bl
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 0x27]
push eax
lea eax, [ebp - 0x28]
push eax
lea eax, [edi + 0x40]
push eax
call dword [sym.imp.MSVCP140.dll_public:_int___thiscall_std::codecvt_char__char__struct__Mbstatet_::out_struct__Mbstatet___char_const___char_const___char_const____char___char___char___const]
test eax, eax
js 0x10004df9
cmp eax, 1
jle 0x10004dcb
cmp eax, 3
jne 0x10004df9
push dword [edi + 0x4c]
push dword [ebp - 0x28]
call fcn.100018d0
add esp, 8
or ecx, 0xffffffff
test al, al
cmovne ecx, ebx
pop esi
pop edi
mov eax, ecx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100255b7
mov esp, ebp
pop ebp
ret 4
mov esi, dword [ebp - 0x2c]
lea eax, [ebp - 0x24]
sub esi, eax
je 0x10004de9
push dword [edi + 0x4c]
push esi
push 1
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
add esp, 0x10
cmp esi, eax
jne 0x10004df9
lea eax, [ebp - 0x28]
mov byte [edi + 0x3d], 1
cmp dword [ebp - 0x30], eax
jne 0x10004cfb
mov ecx, dword [ebp - 4]
or eax, 0xffffffff
pop esi
pop edi
xor ecx, ebp
pop ebx
call fcn.100255b7
mov esp, ebp
pop ebp
ret 4
Function at 0x100055b0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
mov ebx, ecx
cmp dword [ebx + 0x38], 0
je 0x100055d5
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____thiscall_std::basic_streambuf_char__struct_std::char_traits_char__::xsgetn_char___long_long___int64__]
pop ebx
mov esp, ebp
pop ebp
ret 0xc
push esi
mov esi, dword [ebp + 0xc]
push edi
mov edi, dword [ebp + 0x10]
mov dword [ebp - 8], esi
mov dword [ebp - 0xc], edi
call dword [sym.imp.MSVCP140.dll_protected:_long_long___int64____thiscall_std::basic_streambuf_char__struct_std::char_traits_char__::_Gnavail_void_const]
mov dword [ebp + 0x10], eax
mov ecx, edx
mov dword [ebp - 4], ecx
test edi, edi
jl 0x1000567a
jg 0x100055ff
test esi, esi
je 0x1000567a
test ecx, ecx
jl 0x10005646
jg 0x10005609
test eax, eax
je 0x10005646
cmp edi, ecx
jg 0x10005619
jl 0x10005613
cmp esi, eax
jae 0x10005619
mov dword [ebp + 0x10], esi
mov dword [ebp - 4], edi
mov ecx, ebx
call dword [sym.imp.MSVCP140.dll_protected:_char____thiscall_std::basic_streambuf_char__struct_std::char_traits_char__::gptr_void_const]
push dword [ebp + 0x10]
push eax
push dword [ebp + 8]
call sub.VCRUNTIME140.dll_memcpy
mov eax, dword [ebp + 0x10]
add esp, 0xc
add dword [ebp + 8], eax
mov ecx, ebx
sub esi, eax
sbb edi, dword [ebp - 4]
push eax
call dword [sym.imp.MSVCP140.dll_protected:_void___thiscall_std::basic_streambuf_char__struct_std::char_traits_char__::gbump_int_]
jmp 0x1000564c
mov eax, dword [ebp + 8]
mov dword [ebp + 8], eax
test edi, edi
jl 0x1000567a
jg 0x10005656
test esi, esi
je 0x1000567a
cmp dword [ebx + 0x4c], 0
je 0x1000567a
mov ecx, ebx
call fcn.10003510
push dword [ebx + 0x4c]
push esi
push 1
push dword [ebp + 8]
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
add esp, 0x10
sub esi, eax
sbb edi, 0
mov eax, dword [ebp - 8]
mov edx, dword [ebp - 0xc]
sub eax, esi
sbb edx, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x10005690
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
mov ebx, ecx
cmp dword [ebx + 0x38], 0
je 0x100056b5
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____thiscall_std::basic_streambuf_char__struct_std::char_traits_char__::xsputn_char_const___long_long___int64__]
pop ebx
mov esp, ebp
pop ebp
ret 0xc
push esi
mov esi, dword [ebp + 0xc]
push edi
mov edi, dword [ebp + 0x10]
mov dword [ebp - 8], esi
mov dword [ebp - 0xc], edi
call dword [sym.imp.MSVCP140.dll_protected:_long_long___int64____thiscall_std::basic_streambuf_char__struct_std::char_traits_char__::_Pnavail_void_const]
mov dword [ebp + 0x10], eax
mov ecx, edx
mov dword [ebp - 4], ecx
test edi, edi
jl 0x10005747
jg 0x100056db
test esi, esi
je 0x10005747
test ecx, ecx
jl 0x10005720
jg 0x100056e5
test eax, eax
je 0x10005720
cmp edi, ecx
jg 0x100056f5
jl 0x100056ef
cmp esi, eax
jae 0x100056f5
mov dword [ebp + 0x10], esi
mov dword [ebp - 4], edi
mov ecx, ebx
call dword [sym.imp.MSVCP140.dll_protected:_char____thiscall_std::basic_streambuf_char__struct_std::char_traits_char__::pptr_void_const]
push dword [ebp + 0x10]
push dword [ebp + 8]
push eax
call sub.VCRUNTIME140.dll_memcpy
mov eax, dword [ebp + 0x10]
add esp, 0xc
add dword [ebp + 8], eax
mov ecx, ebx
sub esi, eax
sbb edi, dword [ebp - 4]
push eax
call dword [sym.imp.MSVCP140.dll_protected:_void___thiscall_std::basic_streambuf_char__struct_std::char_traits_char__::pbump_int_]
mov eax, dword [ebp + 8]
test edi, edi
jl 0x10005747
jg 0x1000572d
test esi, esi
je 0x10005747
mov ecx, dword [ebx + 0x4c]
test ecx, ecx
je 0x10005747
push ecx
push esi
push 1
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
add esp, 0x10
sub esi, eax
sbb edi, 0
mov eax, dword [ebp - 8]
mov edx, dword [ebp - 0xc]
sub eax, esi
sbb edx, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x10006db0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
mov esi, edi
mov dword [ebp - 4], ecx
cmp dword [edi + 0x14], 0x10
mov ebx, dword [edi + 0x10]
jb 0x10006dcc
mov esi, dword [edi]
xor ecx, ecx
mov edx, 0x811c9dc5
test ebx, ebx
je 0x10006de8
movzx eax, byte [ecx + esi]
inc ecx
xor eax, edx
imul edx, eax, 0x1000193
cmp ecx, ebx
jb 0x10006dd7
mov ebx, dword [ebp - 4]
mov eax, dword [ebx + 0x18]
mov ecx, dword [ebx + 0xc]
and eax, edx
mov ebx, dword [ebx + 4]
mov esi, dword [ecx + eax*8]
add eax, eax
mov edx, dword [ecx + eax*4]
inc eax
mov dword [ebp - 8], edx
lea eax, [ecx + eax*4]
mov dword [ebp - 0xc], eax
cmp edx, ebx
jne 0x10006e10
mov eax, ebx
jmp 0x10006e14
mov eax, dword [eax]
mov eax, dword [eax]
cmp esi, eax
je 0x10006e88
cmp dword [edi + 0x14], 0x10
mov edx, edi
jb 0x10006e22
mov edx, dword [edi]
mov edi, dword [esi + 0x1c]
lea ecx, [esi + 8]
mov dword [ebp - 0x10], edi
cmp edi, 0x10
mov edi, dword [ebp + 0xc]
jb 0x10006e36
mov ecx, dword [esi + 8]
push dword [edi + 0x10]
mov eax, dword [esi + 0x18]
push edx
push eax
push ecx
mov dword [ebp - 0x14], eax
call fcn.10006d40
add esp, 0x10
test al, al
jne 0x10006e58
mov esi, dword [esi]
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 0xc]
jmp 0x10006e08
cmp dword [ebp - 0x10], 0x10
lea eax, [esi + 8]
jb 0x10006e63
mov eax, dword [eax]
cmp dword [edi + 0x14], 0x10
mov ecx, edi
jb 0x10006e6d
mov ecx, dword [edi]
push dword [ebp - 0x14]
push eax
push dword [edi + 0x10]
push ecx
call fcn.10006d40
add esp, 0x10
mov ecx, ebx
test al, al
cmovne ecx, esi
mov eax, ecx
jmp 0x10006e8c
mov ecx, ebx
mov eax, ebx
cmp eax, ebx
jne 0x10006eec
mov esi, dword [ebx]
lea eax, [ebp + 0xf]
mov ebx, dword [ebp - 4]
push eax
lea eax, [ebp - 0x14]
mov dword [ebp - 0x14], edi
mov edi, dword [esi + 4]
push eax
push 0x1002c9a9
push edi
push esi
lea ecx, [ebx + 4]
call fcn.10006430
mov edx, eax
mov ecx, 0x3fffffe
mov eax, dword [ebx + 8]
sub ecx, eax
cmp ecx, 1
jb 0x10006efe
inc eax
mov ecx, ebx
mov dword [ebx + 8], eax
mov dword [esi + 4], edx
mov esi, dword [ebp + 8]
mov dword [edi], edx
mov eax, dword [ebx + 4]
mov eax, dword [eax]
push eax
add eax, 8
push eax
push esi
call fcn.10006650
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
mov eax, dword [ebp + 8]
pop edi
pop esi
pop ebx
mov dword [eax], ecx
mov byte [eax + 4], 0
mov esp, ebp
pop ebp
ret 8
push str.list_T__too_long
call sub.MSVCP140.dll_void___cdecl_std::_Xlength_error_char_const__
int3
Function at 0x10006f10
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
mov esi, edi
mov dword [ebp - 4], ecx
cmp dword [edi + 0x14], 0x10
mov ebx, dword [edi + 0x10]
jb 0x10006f2c
mov esi, dword [edi]
xor ecx, ecx
mov edx, 0x811c9dc5
test ebx, ebx
je 0x10006f48
movzx eax, byte [ecx + esi]
inc ecx
xor eax, edx
imul edx, eax, 0x1000193
cmp ecx, ebx
jb 0x10006f37
mov ebx, dword [ebp - 4]
mov eax, dword [ebx + 0x18]
mov ecx, dword [ebx + 0xc]
and eax, edx
mov ebx, dword [ebx + 4]
mov esi, dword [ecx + eax*8]
add eax, eax
mov edx, dword [ecx + eax*4]
inc eax
mov dword [ebp - 8], edx
lea eax, [ecx + eax*4]
mov dword [ebp - 0xc], eax
cmp edx, ebx
jne 0x10006f70
mov eax, ebx
jmp 0x10006f74
mov eax, dword [eax]
mov eax, dword [eax]
cmp esi, eax
je 0x10006fe8
cmp dword [edi + 0x14], 0x10
mov edx, edi
jb 0x10006f82
mov edx, dword [edi]
mov edi, dword [esi + 0x1c]
lea ecx, [esi + 8]
mov dword [ebp - 0x10], edi
cmp edi, 0x10
mov edi, dword [ebp + 0xc]
jb 0x10006f96
mov ecx, dword [esi + 8]
push dword [edi + 0x10]
mov eax, dword [esi + 0x18]
push edx
push eax
push ecx
mov dword [ebp - 0x14], eax
call fcn.10006d40
add esp, 0x10
test al, al
jne 0x10006fb8
mov esi, dword [esi]
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 0xc]
jmp 0x10006f68
cmp dword [ebp - 0x10], 0x10
lea eax, [esi + 8]
jb 0x10006fc3
mov eax, dword [eax]
cmp dword [edi + 0x14], 0x10
mov ecx, edi
jb 0x10006fcd
mov ecx, dword [edi]
push dword [ebp - 0x14]
push eax
push dword [edi + 0x10]
push ecx
call fcn.10006d40
add esp, 0x10
mov ecx, ebx
test al, al
cmovne ecx, esi
mov eax, ecx
jmp 0x10006fec
mov ecx, ebx
mov eax, ebx
cmp eax, ebx
jne 0x1000704c
mov esi, dword [ebx]
lea eax, [ebp + 0xf]
mov ebx, dword [ebp - 4]
push eax
lea eax, [ebp - 0x14]
mov dword [ebp - 0x14], edi
mov edi, dword [esi + 4]
push eax
push 0x1002c9a9
push edi
push esi
lea ecx, [ebx + 4]
call fcn.100064c0
mov edx, eax
mov ecx, 0x2aaaaa9
mov eax, dword [ebx + 8]
sub ecx, eax
cmp ecx, 1
jb 0x1000705e
inc eax
mov ecx, ebx
mov dword [ebx + 8], eax
mov dword [esi + 4], edx
mov esi, dword [ebp + 8]
mov dword [edi], edx
mov eax, dword [ebx + 4]
mov eax, dword [eax]
push eax
add eax, 8
push eax
push esi
call fcn.100068a0
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
mov eax, dword [ebp + 8]
pop edi
pop esi
pop ebx
mov dword [eax], ecx
mov byte [eax + 4], 0
mov esp, ebp
pop ebp
ret 8
push str.list_T__too_long
call sub.MSVCP140.dll_void___cdecl_std::_Xlength_error_char_const__
int3
Function at 0x10007070
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
mov esi, edi
mov dword [ebp - 4], ecx
cmp dword [edi + 0x14], 0x10
mov ebx, dword [edi + 0x10]
jb 0x1000708c
mov esi, dword [edi]
xor ecx, ecx
mov edx, 0x811c9dc5
test ebx, ebx
je 0x100070a8
movzx eax, byte [ecx + esi]
inc ecx
xor eax, edx
imul edx, eax, 0x1000193
cmp ecx, ebx
jb 0x10007097
mov ebx, dword [ebp - 4]
mov eax, dword [ebx + 0x18]
mov ecx, dword [ebx + 0xc]
and eax, edx
mov ebx, dword [ebx + 4]
mov esi, dword [ecx + eax*8]
add eax, eax
mov edx, dword [ecx + eax*4]
inc eax
mov dword [ebp - 8], edx
lea eax, [ecx + eax*4]
mov dword [ebp - 0xc], eax
cmp edx, ebx
jne 0x100070d0
mov eax, ebx
jmp 0x100070d4
mov eax, dword [eax]
mov eax, dword [eax]
cmp esi, eax
je 0x10007148
cmp dword [edi + 0x14], 0x10
mov edx, edi
jb 0x100070e2
mov edx, dword [edi]
mov edi, dword [esi + 0x1c]
lea ecx, [esi + 8]
mov dword [ebp - 0x10], edi
cmp edi, 0x10
mov edi, dword [ebp + 0xc]
jb 0x100070f6
mov ecx, dword [esi + 8]
push dword [edi + 0x10]
mov eax, dword [esi + 0x18]
push edx
push eax
push ecx
mov dword [ebp - 0x14], eax
call fcn.10006d40
add esp, 0x10
test al, al
jne 0x10007118
mov esi, dword [esi]
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 0xc]
jmp 0x100070c8
cmp dword [ebp - 0x10], 0x10
lea eax, [esi + 8]
jb 0x10007123
mov eax, dword [eax]
cmp dword [edi + 0x14], 0x10
mov ecx, edi
jb 0x1000712d
mov ecx, dword [edi]
push dword [ebp - 0x14]
push eax
push dword [edi + 0x10]
push ecx
call fcn.10006d40
add esp, 0x10
mov ecx, ebx
test al, al
cmovne ecx, esi
mov eax, ecx
jmp 0x1000714c
mov ecx, ebx
mov eax, ebx
cmp eax, ebx
jne 0x100071ac
mov esi, dword [ebx]
lea eax, [ebp + 0xf]
mov ebx, dword [ebp - 4]
push eax
lea eax, [ebp - 0x14]
mov dword [ebp - 0x14], edi
mov edi, dword [esi + 4]
push eax
push 0x1002c9a9
push edi
push esi
lea ecx, [ebx + 4]
call fcn.10006580
mov edx, eax
mov ecx, 0x71c71c6
mov eax, dword [ebx + 8]
sub ecx, eax
cmp ecx, 1
jb 0x100071be
inc eax
mov ecx, ebx
mov dword [ebx + 8], eax
mov dword [esi + 4], edx
mov esi, dword [ebp + 8]
mov dword [edi], edx
mov eax, dword [ebx + 4]
mov eax, dword [eax]
push eax
add eax, 8
push eax
push esi
call fcn.10006af0
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
mov eax, dword [ebp + 8]
pop edi
pop esi
pop ebx
mov dword [eax], ecx
mov byte [eax + 4], 0
mov esp, ebp
pop ebp
ret 8
push str.list_T__too_long
call sub.MSVCP140.dll_void___cdecl_std::_Xlength_error_char_const__
int3
Function at 0x10007270
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
mov dword [ebp - 4], ecx
mov dword [ebp - 8], eax
cmp dword [edi + 0x1c], 0x10
lea esi, [edi + 8]
mov ebx, dword [edi + 0x18]
jb 0x10007294
mov esi, dword [edi + 8]
xor ecx, ecx
mov edx, 0x811c9dc5
test ebx, ebx
je 0x100072b1
nop
movzx eax, byte [ecx + esi]
inc ecx
xor eax, edx
imul edx, eax, 0x1000193
cmp ecx, ebx
jb 0x100072a0
mov ebx, dword [ebp - 4]
mov eax, dword [ebx + 0x18]
mov ecx, dword [ebx + 0xc]
and eax, edx
lea edx, [eax*8]
mov eax, dword [ecx + edx]
add ecx, edx
cmp dword [ecx + 4], edi
jne 0x100072ea
cmp eax, edi
jne 0x100072e2
mov eax, dword [ebx + 4]
mov dword [ecx], eax
mov ecx, dword [ebx + 0xc]
mov eax, dword [ebx + 4]
mov dword [edx + ecx + 4], eax
jmp 0x100072f2
mov eax, dword [edi + 4]
mov dword [ecx + 4], eax
jmp 0x100072f2
cmp eax, edi
jne 0x100072f2
mov eax, dword [edi]
mov dword [ecx], eax
mov eax, dword [edi + 4]
lea ecx, [edi + 8]
mov esi, dword [edi]
mov dword [eax], esi
mov edx, dword [edi]
mov eax, dword [edi + 4]
mov dword [edx + 4], eax
dec dword [ebx + 8]
call fcn.100076d0
push 0x40
push edi
call fcn.100256fb
mov eax, dword [ebp - 8]
add esp, 8
pop edi
mov dword [eax], esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x10007330
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
mov dword [ebp - 4], ecx
mov dword [ebp - 8], eax
cmp dword [edi + 0x1c], 0x10
lea esi, [edi + 8]
mov ebx, dword [edi + 0x18]
jb 0x10007354
mov esi, dword [edi + 8]
xor ecx, ecx
mov edx, 0x811c9dc5
test ebx, ebx
je 0x10007371
nop
movzx eax, byte [ecx + esi]
inc ecx
xor eax, edx
imul edx, eax, 0x1000193
cmp ecx, ebx
jb 0x10007360
mov ebx, dword [ebp - 4]
mov eax, dword [ebx + 0x18]
mov ecx, dword [ebx + 0xc]
and eax, edx
lea edx, [eax*8]
mov eax, dword [ecx + edx]
add ecx, edx
cmp dword [ecx + 4], edi
jne 0x100073aa
cmp eax, edi
jne 0x100073a2
mov eax, dword [ebx + 4]
mov dword [ecx], eax
mov ecx, dword [ebx + 0xc]
mov eax, dword [ebx + 4]
mov dword [edx + ecx + 4], eax
jmp 0x100073b2
mov eax, dword [edi + 4]
mov dword [ecx + 4], eax
jmp 0x100073b2
cmp eax, edi
jne 0x100073b2
mov eax, dword [edi]
mov dword [ecx], eax
mov eax, dword [edi + 4]
lea ecx, [edi + 8]
mov esi, dword [edi]
mov dword [eax], esi
mov edx, dword [edi]
mov eax, dword [edi + 4]
mov dword [edx + 4], eax
dec dword [ebx + 8]
call fcn.10007730
push 0x60
push edi
call fcn.100256fb
mov eax, dword [ebp - 8]
add esp, 8
pop edi
mov dword [eax], esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x100073f0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [ebp + 8]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 0xc]
cmp dword [eax + 0x1c], 0x10
push ebx
mov ebx, dword [eax + 0x18]
push esi
lea esi, [eax + 8]
mov dword [ebp - 4], ecx
push edi
jb 0x10007413
mov esi, dword [esi]
xor edx, edx
mov edi, 0x811c9dc5
test ebx, ebx
je 0x10007431
nop
movzx ecx, byte [edx + esi]
inc edx
xor ecx, edi
imul edi, ecx, 0x1000193
cmp edx, ebx
jb 0x10007420
mov ebx, dword [ebp - 4]
mov ecx, dword [ebx + 0x18]
mov edx, dword [ebx + 0xc]
and ecx, edi
lea esi, [ecx*8]
mov ecx, dword [edx + esi]
add edx, esi
cmp dword [edx + 4], eax
jne 0x1000746a
cmp ecx, eax
jne 0x10007462
mov ecx, dword [ebx + 4]
mov dword [edx], ecx
mov edx, dword [ebx + 0xc]
mov ecx, dword [ebx + 4]
mov dword [esi + edx + 4], ecx
jmp 0x10007472
mov ecx, dword [eax + 4]
mov dword [edx + 4], ecx
jmp 0x10007472
cmp ecx, eax
jne 0x10007472
mov ecx, dword [eax]
mov dword [edx], ecx
mov edx, dword [eax + 4]
lea ecx, [ebx + 4]
mov edi, dword [eax]
push eax
mov dword [edx], edi
mov esi, dword [eax]
mov edx, dword [eax + 4]
mov dword [esi + 4], edx
dec dword [ecx + 4]
call fcn.10008950
mov eax, dword [ebp - 8]
mov dword [eax], edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x10008a00
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [0x100382a4]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov ebx, ecx
mov dword [ebp - 0x10], edi
mov esi, edi
cmp dword [edi + 0x14], 0x10
jb 0x10008a25
mov esi, dword [edi]
xor ecx, ecx
mov edx, 0x811c9dc5
cmp dword [edi + 0x10], ecx
jbe 0x10008a43
movzx eax, byte [ecx + esi]
inc ecx
xor eax, edx
imul edx, eax, 0x1000193
cmp ecx, dword [edi + 0x10]
jb 0x10008a31
mov eax, dword [ebx + 0x18]
mov ecx, dword [ebx + 0xc]
and eax, edx
mov ebx, dword [ebx + 4]
mov esi, dword [ecx + eax*8]
add eax, eax
mov edx, dword [ecx + eax*4]
inc eax
mov dword [ebp - 8], edx
lea eax, [ecx + eax*4]
mov dword [ebp - 0xc], eax
cmp edx, ebx
jne 0x10008a68
mov eax, ebx
jmp 0x10008a6c
mov eax, dword [eax]
mov eax, dword [eax]
cmp esi, eax
je 0x10008afd
cmp dword [edi + 0x14], 0x10
mov edx, edi
jb 0x10008a7e
mov edx, dword [edi]
cmp dword [esi + 0x1c], 0x10
lea ecx, [esi + 8]
jb 0x10008a8a
mov ecx, dword [esi + 8]
push dword [edi + 0x10]
push edx
push dword [esi + 0x18]
push ecx
call fcn.10006d40
add esp, 0x10
test al, al
jne 0x10008aa8
mov esi, dword [esi]
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 0xc]
jmp 0x10008a60
mov edi, esi
mov dword [ebp - 0x14], esi
mov dword [ebp - 0x18], edi
mov edi, dword [ebp - 0x10]
cmp dword [ebp - 8], ebx
jne 0x10008abc
mov eax, ebx
jmp 0x10008ac3
mov eax, dword [ebp - 0xc]
mov eax, dword [eax]
mov eax, dword [eax]
cmp esi, eax
je 0x10008af5
cmp dword [esi + 0x1c], 0x10
lea edx, [esi + 8]
jb 0x10008ad3
mov edx, dword [esi + 8]
cmp dword [edi + 0x14], 0x10
mov ecx, edi
jb 0x10008add
mov ecx, dword [edi]
push dword [esi + 0x18]
push edx
push dword [edi + 0x10]
push ecx
call fcn.10006d40
add esp, 0x10
test al, al
je 0x10008af5
mov esi, dword [esi]
jmp 0x10008ab3
mov edi, dword [ebp - 0x18]
cmp dword [ebp - 0x14], esi
jne 0x10008b01
mov edi, ebx
mov esi, ebx
xor eax, eax
cmp edi, esi
je 0x10008b0e
mov edi, dword [edi]
inc eax
cmp edi, esi
jne 0x10008b07
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.100255b7
mov esp, ebp
pop ebp
ret 4

Function at 0x100145c0
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
add ecx, 4
pop ebp
jmp fcn.10021e60

Function at 0x100145f0
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
add ecx, 4
pop ebp
jmp fcn.10019960

Function at 0x10014650
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
add ecx, 4
pop ebp
jmp fcn.1001b710

Function at 0x10014680
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
add ecx, 4
pop ebp
jmp fcn.100155d0