joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1002c5f0
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [0x100f5008]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebp + 0xc]
movss xmm3, dword [0x100e9b08]
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x18], eax
movzx eax, cl
push esi
push edi
mov edi, dword [ebp + 8]
movd xmm0, eax
mov eax, ecx
shr eax, 8
movzx eax, al
shr ecx, 0x10
cvtdq2ps xmm0, xmm0
movd xmm1, eax
movzx eax, cl
mulss xmm0, xmm3
cvtdq2ps xmm1, xmm1
movd xmm2, eax
mulss xmm1, xmm3
cvtdq2ps xmm2, xmm2
mulss xmm2, xmm3
test edi, edi
je 0x1002c6fe
mov eax, dword [edi]
sub esp, 0xc
mov ecx, edi
mov eax, dword [eax + 0x70]
movss dword [esp + 8], xmm2
movss dword [esp + 4], xmm1
movss dword [esp], xmm0
call eax
mov dword [ebp - 0x10], 0xdac2c988
xor eax, eax
mov dword [ebp - 0xc], 0xd8dccdc1
mov dword [ebp - 8], 0xacd8c2c5
xor byte [ebp + eax - 0x10], 0xac
inc eax
cmp eax, 0xc
jb 0x1002c687
mov eax, dword [edi]
lea ecx, [ebp - 0x10]
push 1
push 0
push ecx
mov eax, dword [eax + 0x2c]
mov ecx, edi
call eax
mov esi, eax
test esi, esi
je 0x1002c725
movzx ecx, byte [ebp - 0x16]
sub esp, 0xc
movss xmm1, dword [0x100e9b08]
mov eax, dword [ebp - 0x1c]
mov edx, dword [esi]
movd xmm0, ecx
cvtdq2ps xmm0, xmm0
movzx ecx, ah
movzx eax, al
mulss xmm0, xmm1
movss dword [esp + 8], xmm0
movd xmm0, ecx
mov ecx, esi
cvtdq2ps xmm0, xmm0
mulss xmm0, xmm1
movss dword [esp + 4], xmm0
movd xmm0, eax
mov eax, dword [edx + 0x2c]
cvtdq2ps xmm0, xmm0
mulss xmm0, xmm1
movss dword [esp], xmm0
call eax
jmp 0x1002c725
mov ecx, dword [0x10124910]
lea edx, [ebp - 0x14]
movss dword [ebp - 0x14], xmm0
movss dword [ebp - 0x10], xmm1
movss dword [ebp - 0xc], xmm2
mov dword [ebp - 8], 0x3f800000
mov eax, dword [ecx]
push edx
mov eax, dword [eax + 0x18]
call eax
mov eax, dword [edi]
mov ecx, edi
mov esi, dword [ebp + 0x14]
push esi
push 0x400
mov eax, dword [eax + 0x74]
call eax
mov eax, dword [edi]
mov ecx, edi
push esi
push 0x4000
mov eax, dword [eax + 0x74]
call eax
mov eax, dword [edi]
mov ecx, edi
push esi
push 0x8000
mov eax, dword [eax + 0x74]
call eax
mov ecx, dword [0x10124920]
push 0
push 0
push edi
mov eax, dword [ecx]
mov eax, dword [eax + 0x84]
call eax
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.100da7b6
mov esp, ebp
pop ebp
ret 0x10
Function at 0x1002e7f0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x100f5008]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, ecx
cmp dword [esi + 0x38], 0
je 0x1002e8ac
cmp byte [esi + 0x3d], 0
je 0x1002e8ac
mov eax, dword [esi]
push edi
push 0xffffffffffffffff
call dword [eax + 0xc]
cmp eax, 0xffffffff
je 0x1002e89a
mov ecx, dword [esi + 0x38]
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [esi + 0x40]
push eax
call dword [sym.imp.MSVCP140.dll_public:_int___thiscall_std::codecvt_char__char__struct__Mbstatet_::unshift_struct__Mbstatet___char___char___char___const]
sub eax, 0
je 0x1002e861
sub eax, 1
je 0x1002e865
sub eax, 2
jne 0x1002e89a
mov byte [esi + 0x3d], al
mov al, 1
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100da7b6
mov esp, ebp
pop ebp
ret
mov byte [esi + 0x3d], 0
mov edi, dword [ebp - 0x28]
lea eax, [ebp - 0x24]
sub edi, eax
je 0x1002e883
push dword [esi + 0x4c]
push edi
push 1
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
add esp, 0x10
cmp edi, eax
jne 0x1002e89a
cmp byte [esi + 0x3d], 0
pop edi
sete al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100da7b6
mov esp, ebp
pop ebp
ret
pop edi
xor al, al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100da7b6
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
mov al, 1
xor ecx, ebp
pop esi
call fcn.100da7b6
mov esp, ebp
pop ebp
ret
Function at 0x100309c0
Capabilities:
Encode data using xor

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100dd3e6
mov eax, dword fs:[0]
push eax
push ebx
sub esp, 0x40
mov eax, dword [0x100f5008]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 4], 0
mov eax, dword [0x1012a988]
test al, 1
jne 0x10030b01
or eax, 1
mov dword [0x1012a988], eax
mov byte [ebp - 4], 1
mov eax, 0x10
movaps xmm0, xmmword [0x100ea470]
pxor xmm0, xmmword [0x100ea1c0]
mov dword [ebp - 0x3c], 0x95ea8cee
mov dword [ebp - 0x38], 0x8ceaea8c
mov word [ebp - 0x34], 0x999d
mov byte [ebp - 0x32], 0xac
movups xmmword [ebp - 0x4c], xmm0
nop dword [eax]
xor byte [ebp + eax - 0x4c], 0xac
inc eax
cmp eax, 0x1b
jb 0x10030a50
xorps xmm0, xmm0
mov dword [ebp - 0x20], 0
lea ecx, [ebp - 0x4c]
mov dword [ebp - 0x1c], 0
movups xmmword [ebp - 0x30], xmm0
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x10030a76
sub ecx, edx
lea eax, [ebp - 0x4c]
push ecx
push eax
lea ecx, [ebp - 0x30]
call fcn.10027260
mov byte [ebp - 4], 2
mov edx, dword [0x101248bc]
test edx, edx
je 0x10030a9f
mov edx, dword [edx + 0x50]
jmp 0x10030aa1
xor edx, edx
mov eax, dword [0x101248b4]
test eax, eax
je 0x10030aaf
mov eax, dword [eax + 0x18]
jmp 0x10030ab1
xor eax, eax
lea ecx, [ebp - 0x30]
push ecx
push eax
lea ecx, [ebp - 0x18]
call fcn.1001e560
mov eax, dword [ebp - 0x18]
add esp, 8
mov byte [ebp - 4], 1
mov ecx, dword [ebp - 0x1c]
mov dword [0x1012a984], eax
cmp ecx, 0x10
jb 0x10030afd
mov edx, dword [ebp - 0x30]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x10030af3
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x10030b4c
push ecx
push edx
call fcn.100dac31
add esp, 8
mov byte [ebp - 4], 0
cmp dword [ebx + 0x1c], 0x10
lea ecx, [ebx + 8]
lea edx, [ebp - 0x18]
mov dword [ebp - 0x18], 0x65656863
cmovae ecx, dword [ebx + 8]
mov word [ebp - 0x14], 0x6573
mov byte [ebp - 0x12], 0
call dword [0x1012a984]
mov ecx, dword [ebx + 0x1c]
cmp ecx, 0x10
jb 0x10030b5c
mov edx, dword [ebx + 8]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x10030b52
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x10030b52
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push ecx
push edx
call fcn.100dac31
add esp, 8
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret 0x18
Function at 0x10030b70
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
cmp byte [0x101053b0], 0
push ebx
push esi
push edi
je 0x10030cfe
mov ecx, dword [0x101248ec]
mov eax, dword [ecx]
mov eax, dword [eax + 0x68]
call eax
test al, al
je 0x10030cfe
mov ecx, dword [0x10124974]
xor ebx, ebx
mov dword [ebp - 4], ecx
mov eax, dword [ecx + 0x28]
mov dword [ebp - 8], eax
test eax, eax
je 0x10030cfe
mov eax, dword [ecx + 0x1c]
mov ecx, dword [eax + ebx*4]
mov eax, dword [ecx]
mov eax, dword [eax + 0x30]
call eax
mov esi, eax
mov edi, 0x811c9dc5
xor ecx, ecx
nop word [eax + eax]
inc ecx
cmp byte [ecx + esi], 0
jne 0x10030bd0
xor edx, edx
test ecx, ecx
je 0x10030bf9
nop dword [eax]
movsx eax, byte [edx + esi]
inc edx
xor eax, edi
imul edi, eax, 0x1000193
cmp edx, ecx
jb 0x10030be0
cmp edi, 0x5ff56dc5
je 0x10030c08
inc ebx
cmp ebx, dword [ebp - 8]
jae 0x10030cfe
mov ecx, dword [ebp - 4]
jmp 0x10030bb4
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x1c]
mov edi, dword [eax + ebx*4]
test edi, edi
je 0x10030cfe
mov edx, dword [edi + 0x88]
test edx, edx
je 0x10030cfe
movss xmm1, dword [0x100e9c08]
xor ebx, ebx
cmp edx, 4
jl 0x10030ccb
mov ecx, dword [edi + 0x7c]
lea esi, [edx - 4]
shr esi, 2
add ecx, 0x1078
inc esi
lea ebx, [esi*4]
movss xmm0, dword [ecx - 0xc60]
ucomiss xmm0, xmm1
lahf
test ah, 0x44
jp 0x10030c6c
mov dword [ecx - 0xc60], 0x7f7fffff
movss xmm0, dword [ecx - 0x840]
ucomiss xmm0, xmm1
lahf
test ah, 0x44
jp 0x10030c87
mov dword [ecx - 0x840], 0x7f7fffff
movss xmm0, dword [ecx - 0x420]
ucomiss xmm0, xmm1
lahf
test ah, 0x44
jp 0x10030ca2
mov dword [ecx - 0x420], 0x7f7fffff
movss xmm0, dword [ecx]
ucomiss xmm0, xmm1
lahf
test ah, 0x44
jp 0x10030cb5
mov dword [ecx], 0x7f7fffff
add ecx, 0x1080
sub esi, 1
jne 0x10030c51
cmp ebx, edx
jl 0x10030ccf
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
test edx, edx
jle 0x10030cfe
imul ecx, ebx, 0x420
add ecx, 0x418
add ecx, dword [edi + 0x7c]
sub edx, ebx
movss xmm0, dword [ecx]
ucomiss xmm0, xmm1
lahf
test ah, 0x44
jp 0x10030cf3
mov dword [ecx], 0x7f7fffff
add ecx, 0x420
sub edx, 1
jne 0x10030ce0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10032be0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100dd4a8
mov eax, dword fs:[0]
push eax
push ebx
sub esp, 0x2c
mov eax, dword [0x100f5008]
xor eax, ebp
mov dword [ebp - 0x14], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 4], 0
xorps xmm0, xmm0
movups xmmword [ebp - 0x2c], xmm0
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x18], 0xf
mov byte [ebp - 0x2c], 0
mov byte [ebp - 4], 1
cmp dword [ebx + 0x1c], 0
je 0x10032d32
cmp dword [ebx + 0x20], 0x10
lea ecx, [ebx + 0x24]
lea eax, [ebx + 0xc]
cmovae eax, dword [ebx + 0xc]
xor edx, edx
push ecx
push eax
xor ecx, ecx
call fcn.10030070
mov ecx, dword [ebp - 0x1c]
mov esi, eax
add esp, 8
cmp esi, ecx
ja 0x10032c84
cmp dword [ebp - 0x18], 0x10
lea ecx, [ebp - 0x2c]
mov dword [ebp - 0x1c], esi
cmovae ecx, dword [ebp - 0x2c]
mov byte [ecx + esi], 0
jmp 0x10032c91
sub eax, ecx
lea ecx, [ebp - 0x2c]
push 0
push eax
call fcn.100339f0
cmp dword [ebx + 0x20], 0x10
lea eax, [ebx + 0xc]
lea edx, [ebx + 0x24]
cmovae eax, dword [ebx + 0xc]
lea ecx, [ebp - 0x2c]
cmp dword [ebp - 0x18], 0x10
push edx
cmovae ecx, dword [ebp - 0x2c]
lea edx, [esi + 1]
push eax
call fcn.10030070
mov eax, dword [0x101248e8]
lea edx, [ebp - 0x38]
push edx
push 0x10124d84
push eax
mov ecx, dword [eax]
mov dword [ebp - 0x38], 0x6568635b
mov dword [ebp - 0x34], 0x5d657365
mov word [ebp - 0x30], 0x20
mov eax, dword [ecx + 0x64]
call eax
mov eax, dword [0x101248e8]
lea edx, [ebp - 0x2c]
add esp, 0x14
cmp dword [ebp - 0x18], 0x10
cmovae edx, dword [ebp - 0x2c]
mov ecx, dword [eax]
push edx
push 0x100f501c
push eax
mov eax, dword [ecx + 0x64]
call eax
mov ecx, dword [ebp - 0x18]
add esp, 0xc
cmp ecx, 0x10
jb 0x10032d32
mov edx, dword [ebp - 0x2c]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x10032d28
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x10032d6a
push ecx
push edx
call fcn.100dac31
add esp, 8
mov ecx, dword [ebx + 0x20]
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x18], 0xf
mov byte [ebp - 0x2c], 0
cmp ecx, 0x10
jb 0x10032d7a
mov edx, dword [ebx + 0xc]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x10032d70
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x10032d70
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push ecx
push edx
call fcn.100dac31
add esp, 8
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.100da7b6
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret
Function at 0x100334c0
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100dd535
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push ebx
push esi
push edi
mov eax, dword [0x100f5008]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
movzx eax, byte [esi]
xor eax, 0x811c9dc5
imul ecx, eax, 0x1000193
movzx eax, byte [esi + 1]
xor ecx, eax
movzx eax, byte [esi + 2]
imul ecx, ecx, 0x1000193
xor ecx, eax
movzx eax, byte [esi + 3]
imul ecx, ecx, 0x1000193
xor ecx, eax
lea eax, [ebp - 0x14]
imul edi, ecx, 0x1000193
push edi
push esi
push eax
call fcn.100344a0
mov eax, dword [ebp - 0x10]
test eax, eax
jne 0x100335eb
cmp dword [0x1012a848], 0xfffffff
jne 0x1003354a
push str.unordered_map_set_too_long
call dword [sym.imp.MSVCP140.dll_void___cdecl_std::_Xlength_error_char_const__]
mov dword [ebp - 0x1c], 0x1012a844
mov dword [ebp - 4], 0
push 0x10
mov dword [ebp - 0x18], 0
call fcn.100da7d2
mov ebx, eax
add esp, 4
mov eax, dword [esi]
mov dword [ebp - 0x18], ebx
mov dword [ebx + 8], eax
mov dword [ebx + 0xc], 0
mov dword [ebp - 4], 1
mov eax, dword [0x1012a848]
inc eax
movd xmm0, eax
cvtdq2pd xmm0, xmm0
shr eax, 0x1f
addsd xmm0, qword [eax*8 + 0x100e9e80]
mov eax, dword [0x1012a85c]
cvtpd2ps xmm1, xmm0
movd xmm0, eax
cvtdq2pd xmm0, xmm0
shr eax, 0x1f
addsd xmm0, qword [eax*8 + 0x100e9e80]
cvtpd2ps xmm0, xmm0
divss xmm1, xmm0
comiss xmm1, dword [0x1012a840]
jbe 0x100335e0
call fcn.10034170
push edi
lea eax, [ebx + 8]
push eax
lea eax, [ebp - 0x1c]
push eax
call fcn.100344a0
mov ecx, dword [eax]
jmp 0x100335e3
mov ecx, dword [ebp - 0x14]
push ebx
push ecx
push edi
call fcn.100341f0
add eax, 0xc
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x10033860
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
sub esp, 0x18
mov edx, dword [ebp + 8]
push ebx
mov ebx, ecx
cmp edx, eax
je 0x100339b6
mov eax, dword [ebx + 4]
mov dword [ebp - 0x14], eax
mov eax, dword [edx + 4]
mov dword [ebp - 8], eax
movzx eax, byte [edx + 8]
xor eax, 0x811c9dc5
imul ecx, eax, 0x1000193
movzx eax, byte [edx + 9]
push esi
push edi
mov edi, dword [ebx + 0xc]
mov esi, edx
xor ecx, eax
mov dword [ebp - 0x18], edi
movzx eax, byte [edx + 0xa]
imul ecx, ecx, 0x1000193
xor ecx, eax
movzx eax, byte [edx + 0xb]
imul ecx, ecx, 0x1000193
xor ecx, eax
mov eax, dword [ebx + 0x18]
imul ecx, ecx, 0x1000193
and eax, ecx
mov ecx, dword [edi + eax*8]
mov dword [ebp - 4], ecx
lea eax, [edi + eax*8]
mov dword [ebp - 0xc], eax
mov eax, dword [eax + 4]
mov dword [ebp - 0x10], eax
mov eax, esi
mov edi, esi
mov esi, dword [esi]
push 0x10
push eax
call fcn.100dac31
dec dword [ebx + 8]
add esp, 8
cmp edi, dword [ebp - 0x10]
je 0x10033919
mov eax, dword [ebp + 0xc]
cmp esi, eax
jne 0x100338d7
mov ecx, dword [ebp - 4]
cmp ecx, dword [ebp + 8]
jne 0x100339ac
mov edx, dword [ebp - 0xc]
mov ecx, dword [ebp - 8]
pop edi
mov dword [edx], esi
mov dword [ecx], esi
mov dword [esi + 4], ecx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
mov ecx, dword [ebp - 4]
mov edx, dword [ebp - 0xc]
cmp ecx, dword [ebp + 8]
jne 0x1003392d
mov eax, dword [ebp - 0x14]
mov ecx, eax
mov dword [edx], eax
jmp 0x10033930
mov ecx, dword [ebp - 8]
mov eax, dword [ebp + 0xc]
mov dword [edx + 4], ecx
cmp esi, eax
je 0x100339ac
nop word [eax + eax]
movzx eax, byte [esi + 8]
xor eax, 0x811c9dc5
imul ecx, eax, 0x1000193
movzx eax, byte [esi + 9]
xor ecx, eax
movzx eax, byte [esi + 0xa]
imul ecx, ecx, 0x1000193
xor ecx, eax
movzx eax, byte [esi + 0xb]
imul ecx, ecx, 0x1000193
xor ecx, eax
imul eax, ecx, 0x1000193
mov ecx, dword [ebx + 0x18]
and ecx, eax
mov eax, dword [ebp - 0x18]
lea eax, [eax + ecx*8]
mov dword [ebp - 4], eax
mov eax, dword [eax + 4]
mov dword [ebp - 0x10], eax
mov eax, esi
mov edi, esi
mov esi, dword [esi]
push 0x10
push eax
call fcn.100dac31
dec dword [ebx + 8]
add esp, 8
mov eax, dword [ebp + 0xc]
cmp edi, dword [ebp - 0x10]
je 0x100339bd
cmp esi, eax
jne 0x10033987
mov ecx, dword [ebp - 4]
mov dword [ecx], esi
mov ecx, dword [ebp - 8]
pop edi
mov dword [ecx], esi
mov dword [esi + 4], ecx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
mov ecx, dword [ebp - 4]
mov edx, dword [ebp - 0x14]
mov dword [ecx], edx
mov dword [ecx + 4], edx
cmp esi, eax
jne 0x10033940
mov ecx, dword [ebp - 8]
pop edi
mov dword [ecx], esi
mov dword [esi + 4], ecx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x10034260
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1fffffff
sub esp, 0x10
bsr ecx, eax
push ebx
push esi
push edi
mov edi, 1
mov eax, edi
shl eax, cl
mov ecx, dword [ebp + 8]
cmp ecx, eax
jbe 0x1003428c
push str.invalid_hash_bucket_count
call dword [sym.imp.MSVCP140.dll_void___cdecl_std::_Xlength_error_char_const__]
lea eax, [ecx - 1]
mov esi, dword [0x1012a844]
or eax, 1
mov dword [ebp - 8], esi
bsr ecx, eax
push esi
lea ecx, [ecx + 1]
shl edi, cl
mov ecx, 0x1012a84c
lea eax, [edi + edi]
push eax
call fcn.10033b70
mov eax, dword [0x1012a844]
lea ebx, [edi - 1]
mov dword [0x1012a858], ebx
mov dword [0x1012a85c], edi
mov eax, dword [eax]
mov ecx, eax
cmp eax, esi
je 0x100343c6
movzx edx, byte [eax + 8]
xor edx, 0x811c9dc5
mov ecx, dword [ecx]
imul edi, edx, 0x1000193
movzx edx, byte [eax + 9]
xor edi, edx
movzx edx, byte [eax + 0xa]
imul edi, edi, 0x1000193
xor edi, edx
movzx edx, byte [eax + 0xb]
imul edi, edi, 0x1000193
xor edi, edx
mov edx, dword [0x1012a84c]
imul edi, edi, 0x1000193
and edi, ebx
mov ebx, dword [edx + edi*8]
lea edx, [edx + edi*8]
mov dword [ebp - 0xc], edx
cmp ebx, esi
jne 0x10034324
mov dword [edx], eax
mov dword [edx + 4], eax
jmp 0x10034391
mov edx, dword [edx + 4]
mov edi, dword [eax + 8]
cmp edi, dword [edx + 8]
jne 0x1003435e
mov edx, dword [edx]
mov dword [ebp - 4], edx
cmp edx, eax
je 0x10034356
mov ebx, dword [eax + 4]
mov esi, dword [ebp - 4]
mov dword [ebx], ecx
mov edi, dword [ecx + 4]
mov dword [edi], edx
mov edx, dword [edx + 4]
mov dword [edx], eax
mov dword [esi + 4], edi
mov esi, dword [ebp - 8]
mov dword [ecx + 4], ebx
mov dword [eax + 4], edx
mov edx, dword [ebp - 0xc]
mov dword [edx + 4], eax
jmp 0x10034391
cmp ebx, edx
je 0x1003436e
mov edx, dword [edx + 4]
cmp edi, dword [edx + 8]
je 0x100343a2
cmp ebx, edx
jne 0x10034362
mov ebx, dword [eax + 4]
mov dword [ebp - 4], ebx
mov dword [ebx], ecx
mov ebx, dword [ecx + 4]
mov dword [ebx], edx
mov edi, dword [edx + 4]
mov dword [edi], eax
mov dword [edx + 4], ebx
mov edx, dword [ebp - 4]
mov dword [ecx + 4], edx
mov edx, dword [ebp - 0xc]
mov dword [eax + 4], edi
mov dword [edx], eax
mov eax, ecx
cmp ecx, esi
je 0x100343c6
mov ebx, dword [0x1012a858]
jmp 0x100342d2
mov ebx, dword [eax + 4]
mov edx, dword [edx]
mov dword [ebp - 4], edx
mov esi, edx
mov dword [ebx], ecx
mov edi, dword [ecx + 4]
mov dword [edi], edx
mov edx, dword [edx + 4]
mov dword [edx], eax
mov dword [esi + 4], edi
mov esi, dword [ebp - 8]
mov dword [ecx + 4], ebx
mov dword [eax + 4], edx
jmp 0x10034391
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x10035e40
Capabilities:
Encode data using base64

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100dd7ee
mov eax, dword fs:[0]
push eax
sub esp, 0x18
push esi
push edi
mov eax, dword [0x100f5008]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x24], edi
mov dword [ebp - 0x1c], 0
xorps xmm0, xmm0
movups xmmword [edi], xmm0
mov dword [edi + 0x10], 0
mov dword [edi + 0x14], 0
mov dword [edi + 0x10], 0
mov dword [edi + 0x14], 0xf
mov byte [edi], 0
mov eax, dword [ebp + 8]
xor esi, esi
mov dword [ebp - 4], 0
mov dword [ebp - 0x1c], 1
test eax, eax
je 0x1003600f
dec eax
mov dword [ebp + 8], eax
mov al, byte [edx]
inc edx
mov byte [ebp + esi - 0x14], al
inc esi
mov ah, byte [ebp - 0x12]
mov ch, byte [ebp - 0x13]
mov cl, byte [ebp - 0x14]
mov dword [ebp - 0x20], edx
mov byte [ebp - 0xf], ah
mov byte [ebp - 0xd], ch
mov byte [ebp - 0xe], cl
cmp esi, 3
jne 0x10035f45
mov al, cl
and cl, 3
shr al, 2
mov byte [ebp - 0x18], al
mov al, ch
shl cl, 4
shr al, 4
add cl, al
mov al, ah
mov byte [ebp - 0x17], cl
and ah, 0x3f
mov cl, ch
shr al, 6
and cl, 0xf
mov byte [ebp - 0x15], ah
shl cl, 2
add cl, al
xor esi, esi
mov byte [ebp - 0x16], cl
nop dword [eax + eax]
cmp dword [0x1011df98], 0x10
mov ecx, 0x1011df84
movzx eax, byte [ebp + esi - 0x18]
cmovae ecx, dword [0x1011df84]
movzx eax, byte [eax + ecx]
mov ecx, edi
push eax
call fcn.10026a20
inc esi
cmp esi, 4
jl 0x10035f10
mov edx, dword [ebp - 0x20]
xor esi, esi
mov ch, byte [ebp - 0xd]
mov cl, byte [ebp - 0xe]
mov eax, dword [ebp + 8]
test eax, eax
jne 0x10035eb3
mov dword [ebp + 8], esi
test esi, esi
je 0x1003600f
mov eax, esi
cmp esi, 3
jge 0x10035f81
cmp eax, 3
jae 0x10036022
mov byte [ebp + eax - 0x14], 0
inc eax
cmp eax, 3
jl 0x10035f65
mov dl, byte [ebp - 0x12]
mov ch, byte [ebp - 0x13]
mov cl, byte [ebp - 0x14]
jmp 0x10035f84
mov dl, byte [ebp - 0xf]
mov al, cl
and cl, 3
shr al, 2
mov byte [ebp - 0x18], al
mov al, ch
shr al, 4
and ch, 0xf
shl cl, 4
add cl, al
shl ch, 2
mov al, dl
mov byte [ebp - 0x17], cl
shr al, 6
and dl, 0x3f
add ch, al
mov byte [ebp - 0x15], dl
lea eax, [esi + 1]
mov byte [ebp - 0x16], ch
mov dword [ebp - 0x20], eax
test eax, eax
jle 0x10035fed
xor esi, esi
nop
cmp dword [0x1011df98], 0x10
mov ecx, 0x1011df84
movzx eax, byte [ebp + esi - 0x18]
cmovae ecx, dword [0x1011df84]
movzx eax, byte [eax + ecx]
mov ecx, edi
push eax
call fcn.10026a20
inc esi
cmp esi, dword [ebp - 0x20]
jl 0x10035fc0
mov esi, dword [ebp + 8]
cmp esi, 3
jge 0x1003600f
mov eax, 3
sub eax, esi
mov dword [ebp + 8], eax
nop dword [eax]
push 0x3d
mov ecx, edi
call fcn.10026a20
sub dword [ebp + 8], 1
jne 0x10036000
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
call fcn.100dae06
int3
Function at 0x1003ebe0
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [0x100f5008]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword fs:[0x30]
push esi
push edi
mov edi, ecx
test ebx, ebx
jne 0x1003ec13
xor al, al
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100da7b6
mov esp, ebp
pop ebp
ret
mov ebx, dword [ebx + 0xc]
add ebx, 0x14
mov esi, dword [ebx]
cmp esi, ebx
je 0x1003ec80
mov ecx, 0x5a4d
lea edx, [esi - 8]
test edx, edx
je 0x1003ec7a
mov eax, dword [edx + 0x18]
test eax, eax
je 0x1003ec7a
cmp word [eax], cx
jne 0x1003ec7a
mov ecx, dword [eax + 0x3c]
add ecx, eax
je 0x1003ec75
cmp dword [ecx], 0x4550
jne 0x1003ec75
mov dword [ebp - 0xc], eax
mov eax, dword [edi + 4]
mov dword [ebp - 0x10], edx
mov dword [ebp - 8], ecx
cmp eax, dword [edi + 8]
je 0x1003ec69
movq xmm0, qword [ebp - 0x10]
movq qword [eax], xmm0
mov dword [eax + 8], ecx
add dword [edi + 4], 0xc
jmp 0x1003ec75
lea ecx, [ebp - 0x10]
push ecx
push eax
mov ecx, edi
call fcn.10027a50
mov ecx, 0x5a4d
mov esi, dword [esi]
cmp esi, ebx
jne 0x1003ec24
mov eax, dword [edi]
cmp eax, dword [edi + 4]
mov ecx, dword [ebp - 4]
pop edi
setne al
xor ecx, ebp
pop esi
pop ebx
call fcn.100da7b6
mov esp, ebp
pop ebp
ret
Function at 0x1003fc90
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, dword [ebp + 8]
mov eax, edx
push edi
mov dword [ebp - 4], eax
mov ebx, ecx
cmp dword [esi + 0x14], 0x10
mov edi, dword [esi + 0x10]
jb 0x1003fcac
mov esi, dword [esi]
xor ecx, ecx
mov edx, 0x811c9dc5
test edi, edi
je 0x1003fccb
movzx eax, byte [ecx + esi]
inc ecx
xor eax, edx
imul edx, eax, 0x1000193
cmp ecx, edi
jb 0x1003fcb7
mov eax, dword [ebp - 4]
push edx
mov edx, eax
mov ecx, ebx
call fcn.1003f640
add esp, 4
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret