joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10167b94
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 0x20]
test esi, esi
jle 0x10167c10
mov ecx, dword [ebp + 0xc]
push ebx
mov ebx, dword [ebp + 0x10]
push edi
mov edi, dword [ebp + 8]
mov edx, dword [ebx]
mov eax, edx
xor eax, dword [ecx]
or edx, dword [ecx]
mov ecx, dword [edi]
shr eax, 1
and eax, 0x7f7f7f7f
sub edx, eax
mov eax, ecx
xor eax, edx
or ecx, edx
shr eax, 1
and eax, 0x7f7f7f7f
sub ecx, eax
mov dword [edi], ecx
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebx + 4]
mov eax, edx
add ebx, dword [ebp + 0x1c]
xor eax, dword [ecx + 4]
or edx, dword [ecx + 4]
mov ecx, dword [edi + 4]
shr eax, 1
and eax, 0x7f7f7f7f
sub edx, eax
mov eax, ecx
xor eax, edx
or ecx, edx
shr eax, 1
and eax, 0x7f7f7f7f
sub ecx, eax
mov dword [edi + 4], ecx
mov ecx, dword [ebp + 0xc]
add ecx, dword [ebp + 0x18]
add edi, dword [ebp + 0x14]
mov dword [ebp + 0xc], ecx
sub esi, 1
jne 0x10167baa
pop edi
pop ebx
pop esi
pop ebp
ret

Function at 0x1017760d
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 0x20]
test edx, edx
jle 0x10177647
push ebx
mov ebx, dword [ebp + 0xc]
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0x10]
mov ecx, dword [edi]
mov eax, ecx
xor eax, dword [ebx]
or ecx, dword [ebx]
add ebx, dword [ebp + 0x18]
add edi, dword [ebp + 0x1c]
shr eax, 1
and eax, 0x7fff7fff
sub ecx, eax
mov dword [esi], ecx
add esi, dword [ebp + 0x14]
sub edx, 1
jne 0x10177623
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x10177649
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 0x20]
test esi, esi
jle 0x1017768d
mov eax, dword [ebp + 0xc]
push ebx
mov ebx, dword [ebp + 0x10]
push edi
mov edi, dword [ebp + 8]
movzx ecx, word [eax]
movzx edx, word [ebx]
add ebx, dword [ebp + 0x1c]
mov eax, edx
xor eax, ecx
or edx, ecx
shr eax, 1
and eax, 0x7f7f
sub edx, eax
mov eax, dword [ebp + 0xc]
add eax, dword [ebp + 0x18]
mov word [edi], dx
add edi, dword [ebp + 0x14]
mov dword [ebp + 0xc], eax
sub esi, 1
jne 0x1017765f
pop edi
pop ebx
pop esi
pop ebp
ret

Function at 0x10177690
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push edi
mov edi, dword [ebp + 0x20]
test edi, edi
jle 0x101776f0
mov eax, dword [ebp + 0x10]
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, dword [eax]
mov ecx, esi
mov edx, dword [eax + 4]
mov eax, dword [ebp + 0xc]
mov edi, dword [ebp + 0xc]
xor ecx, dword [eax]
mov eax, edx
xor eax, dword [edi + 4]
or esi, dword [edi]
or edx, dword [edi + 4]
shrd ecx, eax, 1
shr eax, 1
and ecx, 0x7fff7fff
and eax, 0x7fff7fff
sub esi, ecx
mov dword [ebx], esi
sbb edx, eax
mov eax, dword [ebp + 0x18]
add dword [ebp + 0xc], eax
mov eax, dword [ebp + 0x10]
add eax, dword [ebp + 0x1c]
mov dword [ebx + 4], edx
add ebx, dword [ebp + 0x14]
sub dword [ebp + 0x20], 1
mov dword [ebp + 0x10], eax
jne 0x101776a3
pop esi
pop ebx
pop edi
pop ebp
ret
Function at 0x101776f3
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 0x20]
test edx, edx
jle 0x1017772d
push ebx
mov ebx, dword [ebp + 0xc]
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0x10]
mov ecx, dword [edi]
mov eax, ecx
xor eax, dword [ebx]
or ecx, dword [ebx]
add ebx, dword [ebp + 0x18]
add edi, dword [ebp + 0x1c]
shr eax, 1
and eax, 0x7f7f7f7f
sub ecx, eax
mov dword [esi], ecx
add esi, dword [ebp + 0x14]
sub edx, 1
jne 0x10177709
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x10177767
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push edi
mov edi, dword [ebp + 0x20]
test edi, edi
jle 0x10177805
mov eax, dword [ebp + 0x10]
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, dword [eax]
mov ecx, esi
mov edx, dword [eax + 4]
mov edi, dword [ebp + 0xc]
mov eax, dword [ebp + 0xc]
or esi, dword [edi]
xor ecx, dword [eax]
mov eax, edx
xor eax, dword [edi + 4]
or edx, dword [edi + 4]
shrd ecx, eax, 1
shr eax, 1
and ecx, 0x7fff7fff
and eax, 0x7fff7fff
sub esi, ecx
mov dword [ebx], esi
sbb edx, eax
mov eax, edi
mov dword [ebx + 4], edx
mov edx, dword [ebp + 0x10]
mov esi, dword [edx + 8]
mov ecx, esi
xor ecx, dword [eax + 8]
mov edx, dword [edx + 0xc]
mov eax, edx
xor eax, dword [edi + 0xc]
or esi, dword [edi + 8]
or edx, dword [edi + 0xc]
shrd ecx, eax, 1
shr eax, 1
and ecx, 0x7fff7fff
and eax, 0x7fff7fff
sub esi, ecx
mov dword [ebx + 8], esi
sbb edx, eax
mov eax, dword [ebp + 0x18]
add dword [ebp + 0xc], eax
mov eax, dword [ebp + 0x10]
add eax, dword [ebp + 0x1c]
mov dword [ebx + 0xc], edx
add ebx, dword [ebp + 0x14]
sub dword [ebp + 0x20], 1
mov dword [ebp + 0x10], eax
jne 0x1017777e
pop esi
pop ebx
pop edi
pop ebp
ret

Function at 0x10177808
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 0x20]
test edx, edx
jle 0x10177859
push ebx
mov ebx, dword [ebp + 0xc]
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0x10]
mov ecx, dword [edi]
mov eax, ecx
xor eax, dword [ebx]
or ecx, dword [ebx]
shr eax, 1
and eax, 0x7f7f7f7f
sub ecx, eax
mov dword [esi], ecx
mov ecx, dword [edi + 4]
mov eax, ecx
xor eax, dword [ebx + 4]
or ecx, dword [ebx + 4]
add ebx, dword [ebp + 0x18]
add edi, dword [ebp + 0x1c]
shr eax, 1
and eax, 0x7f7f7f7f
sub ecx, eax
mov dword [esi + 4], ecx
add esi, dword [ebp + 0x14]
sub edx, 1
jne 0x1017781e
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x1017e1a3
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov ecx, dword [ebp + 8]
push ebx
push esi
push edi
mov edx, dword [ecx + 0x6a0c]
mov esi, dword [ecx + 0x61c8]
push 0x4c
pop ebx
mov dword [ebp - 0xc], ebx
cmp edx, 3
je 0x1017e1d6
push 0x50
cmp edx, 2
mov eax, ebx
pop edi
cmove eax, edi
mov eax, dword [eax + esi]
jmp 0x1017e1d9
mov eax, dword [esi + 0x54]
mov edi, dword [ebp + 0xc]
xor esi, esi
mov dword [ebp - 0x10], eax
mov eax, dword [edi + 0x6314]
mov dword [ebp - 0x14], eax
cmp dword [ecx + 0x6a08], esi
je 0x1017e27c
mov edx, dword [edi + 0x5b6c]
mov dword [ebp - 4], esi
add edx, edx
mov dword [ebp - 8], esi
mov eax, dword [ecx + 0x61c8]
mov eax, dword [ebx + eax]
mov dword [ebp - 0x1c], eax
mov eax, dword [edi + 0x631c]
mov eax, dword [ebx + eax]
mov dword [ebp - 0x18], eax
mov eax, esi
mov dword [ebp + 0xc], eax
test edx, edx
je 0x1017e267
mov esi, dword [ebp - 4]
mov ebx, dword [ebp - 8]
add eax, 0x10
push eax
push dword [ebp - 0x18]
push dword [ebp - 0x1c]
push edi
call fcn.1017e75e
mov ecx, dword [ebp + 0xc]
add esp, 0x10
xor ecx, esi
add ecx, ebx
mov dword [edi + ecx*4 + 0x55ec], eax
mov eax, dword [ebp + 0xc]
mov edx, dword [edi + 0x5b6c]
inc eax
add edx, edx
mov dword [ebp + 0xc], eax
cmp eax, edx
jb 0x1017e22b
mov ebx, dword [ebp - 0xc]
xor esi, esi
mov ecx, dword [ebp + 8]
inc dword [ebp - 4]
add ebx, 4
add dword [ebp - 8], 0x20
mov dword [ebp - 0xc], ebx
cmp ebx, 0x54
jl 0x1017e204
mov eax, dword [ebp - 0x14]
cmp dword [edi + 0x5b6c], esi
jbe 0x1017e2a9
lea ebx, [edi + 0x556c]
push esi
push eax
push dword [ebp - 0x10]
push edi
call fcn.1017e75e
add esp, 0x10
mov dword [ebx], eax
mov eax, dword [ebp - 0x14]
lea ebx, [ebx + 4]
inc esi
cmp esi, dword [edi + 0x5b6c]
jb 0x1017e28a
pop edi
pop esi
pop ebx
leave
ret
Function at 0x1018e445
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
push esi
push edi
mov edi, dword [ebp + 0x10]
xor esi, esi
mov dword [ebp - 4], esi
test edi, edi
jle 0x1018e52f
mov eax, dword [ebp + 8]
movd xmm2, edi
cvtdq2pd xmm2, xmm2
movsd qword [ebp - 0xc], xmm2
movd xmm1, esi
xor edi, edi
cvtdq2pd xmm1, xmm1
mov esi, eax
addsd xmm1, qword [0x10244180]
mulsd xmm1, qword [0x102581e8]
movsd qword [ebp - 0x24], xmm1
lea eax, [edi - 6]
movd xmm0, eax
cvtdq2pd xmm0, xmm0
push ecx
push ecx
mulsd xmm0, xmm1
divsd xmm0, xmm2
movsd qword [ebp - 0x1c], xmm0
movsd qword [esp], xmm0
call fcn.10232c80
mov eax, dword [ebp + 0xc]
movss xmm0, dword [eax + edi*4]
cvtps2pd xmm0, xmm0
movsd qword [ebp - 0x14], xmm0
fmul qword [ebp - 0x14]
movsd xmm0, qword [ebp - 0x1c]
movsd qword [esp], xmm0
fstp dword [esi]
call fcn.102330e0
mov eax, dword [ebp + 0xc]
movsd xmm2, qword [ebp - 0xc]
fstp qword [ebp - 0x1c]
movsd xmm1, qword [ebp - 0x1c]
movss xmm0, dword [eax + edi*4]
inc edi
xorps xmm1, xmmword [0x1024c260]
cvtps2pd xmm0, xmm0
pop ecx
pop ecx
mulsd xmm0, xmm1
movsd xmm1, qword [ebp - 0x24]
cvtpd2ps xmm0, xmm0
movss dword [esi + 4], xmm0
add esi, 8
cmp edi, 7
jl 0x1018e48e
mov esi, dword [ebp - 4]
mov eax, dword [ebp + 8]
inc esi
add eax, 0x40
mov dword [ebp - 4], esi
mov dword [ebp + 8], eax
cmp esi, dword [ebp + 0x10]
jl 0x1018e46d
pop edi
pop esi
leave
ret
Function at 0x101ad049
Capabilities:
Terminate process

Disassembly:
push ebx
push esi
mov ebx, 0x560
push ebx
call fcn.101d070f
mov esi, eax
pop ecx
test esi, esi
je 0x101ad0d1
push edi
push 0x68
call fcn.101d0768
mov edi, eax
pop ecx
test edi, edi
jne 0x101ad077
push esi
call fcn.101d06d8
pop ecx
xor eax, eax
jmp 0x101ad0d0
push ebx
xor ebx, ebx
push ebx
push esi
call fcn.1008c9e0
push esi
mov dword [esi], str.AVFormatContext
mov dword [esi + 0x548], 0x101ad0e2
mov dword [esi + 0x54c], 0x101ad0d4
call fcn.101d4e57
mov dword [esi + 0x50c], edi
mov ecx, SysReAllocString
mov dword [edi + 0x30], ebx
add esp, 0x10
mov dword [edi + 0x34], ecx
mov eax, dword [esi + 0x50c]
mov dword [eax + 0x28], 0x2625a0
mov eax, dword [esi + 0x50c]
mov dword [eax + 0x50], ebx
mov dword [eax + 0x54], ecx
mov eax, esi
pop edi
pop esi
pop ebx
ret
Function at 0x101cc114
Capabilities:
Validate payment card number using luhn algorithm

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
mov esi, dword [ebp + 8]
mov ebx, 0x2710
push edi
xor edi, edi
test esi, esi
je 0x101cc1c2
push 0x102891d4
push esi
call fcn.10233630
add esi, eax
push edi
mov al, byte [esi]
mov byte [ebp + 0xb], al
lea eax, [ebp - 4]
push eax
push esi
call fcn.100a45a9
mov esi, eax
add esp, 0x14
mov eax, dword [ebp - 4]
mov dword [ebp - 0xc], esi
mov cl, byte [eax]
inc eax
mov dword [ebp - 4], eax
cmp cl, 0x2e
jne 0x101cc191
mov cl, byte [eax]
mov esi, eax
lea eax, [ecx - 0x30]
cmp al, 9
ja 0x101cc18e
test ebx, ebx
je 0x101cc18e
movsx ecx, cl
mov eax, ebx
sub ecx, 0x30
cdq
imul ecx, ebx
push 0xa
add edi, ecx
pop ecx
idiv ecx
mov ebx, eax
lea eax, [esi + 1]
mov dword [ebp - 4], eax
jmp 0x101cc162
mov esi, dword [ebp - 0xc]
push esi
call fcn.10232e1d
pop ecx
mov ecx, eax
mov ebx, 0x186a0
mov eax, SysReAllocString
sub eax, edi
cdq
idiv ebx
cmp ecx, eax
jg 0x101cc1c2
mov eax, edi
neg eax
cmp byte [ebp + 0xb], 0x2d
cmovne eax, edi
imul ecx, esi, 0x186a0
add eax, ecx
jmp 0x101cc1c5
mov eax, dword [ebp + 0xc]
pop edi
pop esi
pop ebx
leave
ret

Function at 0x101d708c
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 0xc]
push esi
mov esi, dword [ebp + 0x10]
push edi
mov edi, dword [ebp + 0x14]
add edi, esi
cmp esi, edi
jae 0x101d70b8
push ebx
mov ebx, dword [ebp + 8]
movzx ecx, byte [esi]
movzx eax, dl
xor ecx, eax
shr edx, 8
xor edx, dword [ebx + ecx*4]
inc esi
cmp esi, edi
jb 0x101d70a4
pop ebx
pop edi
mov eax, edx
pop esi
pop ebp
ret
Function at 0x101d718e
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
cmp esi, 7
ja case.default.0x101d70ca
jmp dword [esi*4 + 0x101d716e]
mov eax, 0x103ee9c8
mov ecx, 0x101d7008
jmp 0x101d712f
mov eax, 0x103ee9cc
mov ecx, 0x101d704a
jmp 0x101d712f
mov eax, 0x103ee9d0
mov ecx, 0x101d6eaf
jmp 0x101d712f
mov eax, 0x103ee9d4
mov ecx, 0x101d6ef4
jmp 0x101d712f
mov eax, 0x103ee9d8
mov ecx, 0x101d6f39
jmp 0x101d712f
mov eax, 0x103ee9dc
mov ecx, 0x101d6fc3
jmp 0x101d712f
mov eax, 0x103ee9e0
mov ecx, 0x101d6f7e
jmp 0x101d712f
mov eax, 0x103ee9e4
mov ecx, 0x101d6e6a
push ecx
push eax
call fcn.100ad91e
imul eax, esi, 0x404
pop ecx
pop ecx
pop esi
add eax, 0x103ec9a8
pop ebp
ret
push 0x182
push str.libavutil_crc.c
push 0x102cbd44
push str.Assertion__s_failed_at__s:_d_n
push 0
push 0
call fcn.101ceb2e
add esp, 0x18
call fcn.1009dc33
nop dword [eax]
sal dword [eax + 0x1d], 1
adc cl, ch
jo 0x101d7192
adc ch, dh
jo 0x101d7196
adc byte [0x19101d71], cl
jno 0x101d719e
adc byte [0x1101d71], ah
jno 0x101d71a6
adc ch, bl
jo 0x101d71aa
adc byte [ebp - 0x75], dl
in al, dx
push ebx
push esi
push edi
mov edi, dword [ebp + 0x10]
lea eax, [edi - 8]
cmp eax, 0x18
ja 0x101d724e
adc byte [ebp - 0x77c07b9], cl
sbb byte [edi], cl
xchg dword [ebx + 0x33000000], ebp
div byte [ebx]
xor esi, esi
xor edx, edx
xor ecx, ecx
sal byte [ebx], cl
leave
push 0x20
pop ebx
lea eax, [esi + edi]
and byte [ebx - 0x73], bl
add al, 0x3e
bts edx, eax
cmp eax, ebx
cmovae ecx, edx
xor edx, ecx
cmp eax, 0x40
mov eax, dword [ebp + 0x14]
cmovae ecx, edx
cmp esi, ecx
jg 0x101d724e
jl 0x101d71d0
cmp eax, edx
jae 0x101d724e
cmp dword [ebp + 0x18], 0x404
je 0x101d71e2
cmp dword [ebp + 0x18], 0x1000
jne 0x101d724e
mov eax, dword [ebp + 0xc]
sub ebx, edi
mov edi, dword [ebp + 8]
push 8
test eax, eax
je 0x101d7208
mov ecx, esi
pop edx
mov eax, ecx
shr ecx, 1
and eax, 1
neg eax
and eax, dword [ebp + 0x14]
xor ecx, eax
sub edx, 1
jne 0x101d71f3
jmp 0x101d7231
mov edx, dword [ebp + 0x14]
mov eax, esi
mov ecx, ebx
shl eax, 0x18
shl edx, cl
pop edi
mov ecx, eax
add eax, eax
sar ecx, 0x1f
and ecx, edx
xor eax, ecx
sub edi, 1
jne 0x101d7215
push eax
call fcn.1023241c
mov edi, dword [ebp + 8]
pop ecx
mov ecx, eax
mov eax, dword [ebp + 0xc]
mov dword [edi + esi*4], ecx
inc esi
cmp esi, 0x100
jb 0x101d71ea
mov dword [edi + 0x400], 1
xor eax, eax
jmp 0x101d7251
push 0xffffffffffffffea
pop eax
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x101d7308
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
mov ebx, dword [ebp + 0x18]
push esi
push edi
test ebx, ebx
js 0x101d7490
jne 0x101d7333
call fcn.101d7256
xor ebx, ebx
inc ebx
mov dword [ebp + 0x18], ebx
cmp eax, ebx
jle 0x101d7333
lea ebx, [eax + 1]
mov dword [ebp + 0x18], ebx
cmp dword [ebp + 0x14], 0
lea esi, [ebx - 1]
push 0x34
cmovne esi, ebx
mov dword [ebp - 0x18], esi
call fcn.101d0768
mov edi, eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x14], edi
pop ecx
mov dword [eax], edi
test edi, edi
jne 0x101d735e
push 0xfffffffffffffff4
pop eax
jmp 0x101d7465
test esi, esi
je 0x101d737d
push 0x20
push esi
call fcn.101d0520
mov dword [edi], eax
pop ecx
pop ecx
test eax, eax
jne 0x101d737d
push dword [ebp + 8]
call fcn.101d06dd
pop ecx
jmp 0x101d7356
mov eax, dword [ebp + 0xc]
mov dword [edi + 0x28], eax
mov eax, dword [ebp + 0x10]
mov dword [edi + 0x2c], eax
mov eax, dword [ebp + 0x14]
mov dword [edi + 0x30], eax
lea eax, [edi + 0x18]
mov dword [edi + 4], ebx
xor ebx, ebx
push eax
mov dword [edi + 8], ebx
mov dword [edi + 0xc], ebx
mov dword [edi + 0x24], ebx
mov dword [edi + 0x10], ebx
mov dword [edi + 0x14], ebx
call dword [sym.imp.KERNEL32.dll_InitializeSRWLock]
lea eax, [edi + 0x1c]
push eax
call dword [sym.imp.KERNEL32.dll_InitializeConditionVariable]
mov dword [edi + 0x20], ebx
mov dword [ebp - 4], ebx
test esi, esi
jle 0x101d7462
mov ecx, ebx
mov dword [ebp - 0xc], ebx
mov esi, dword [edi]
add esi, ecx
mov dword [ebp - 8], esi
lea eax, [esi + 4]
mov dword [esi], edi
push eax
mov dword [ebp - 0x10], eax
call dword [sym.imp.KERNEL32.dll_InitializeSRWLock]
lea eax, [esi + 8]
push eax
call dword [sym.imp.KERNEL32.dll_InitializeConditionVariable]
lea eax, [esi + 4]
push eax
call dword [sym.imp.KERNEL32.dll_AcquireSRWLockExclusive]
mov eax, dword [ebp - 8]
push ebx
mov dword [esi + 0x1c], ebx
add esi, 0xc
push ebx
push esi
push 0x100e1cfc
push ebx
push ebx
mov dword [esi + 4], 0x101d76de
mov dword [esi + 8], eax
call fcn.10232f88
add esp, 0x18
mov dword [esi], eax
test eax, eax
je 0x101d746a
mov esi, dword [ebp - 8]
cmp dword [esi + 0x1c], ebx
jne 0x101d7440
lea edi, [esi + 4]
push ebx
push 0xffffffffffffffff
push edi
lea eax, [esi + 8]
push eax
call dword [sym.imp.KERNEL32.dll_SleepConditionVariableSRW]
cmp dword [esi + 0x1c], ebx
je 0x101d742a
mov edi, dword [ebp - 0x14]
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_ReleaseSRWLockExclusive]
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 0xc]
inc eax
add ecx, 0x20
mov dword [ebp - 4], eax
mov dword [ebp - 0xc], ecx
cmp eax, dword [ebp - 0x18]
jl 0x101d73ca
mov eax, dword [ebp + 0x18]
pop edi
pop esi
pop ebx
leave
ret
mov ecx, dword [ebp - 4]
cmp dword [ebp + 0x14], ebx
push dword [ebp - 0x10]
lea eax, [ecx + 1]
cmovne eax, ecx
mov dword [edi + 4], eax
call dword [sym.imp.KERNEL32.dll_ReleaseSRWLockExclusive]
push dword [ebp + 8]
call fcn.101d75bb
pop ecx
or eax, 0xffffffff
jmp 0x101d7465
push 0x66
push str.libavutil_slicethread.c
push str.nb_threads___0
push str.Assertion__s_failed_at__s:_d_n
xor ebx, ebx
push ebx
push ebx
call fcn.101ceb2e
add esp, 0x18
call fcn.1009dc33
int3
Function at 0x101d8514
Capabilities:
Encode data using base64

Disassembly:
push ebp
mov ebp, esp
push ecx
push edi
mov edi, dword [ebp + 0x14]
cmp edi, 0x3fffffff
jae 0x101d8607
lea eax, [edi + 2]
push 3
cdq
pop ecx
idiv ecx
lea eax, [eax*4 + 1]
cmp dword [ebp + 0xc], eax
jl 0x101d8607
push ebx
mov ebx, dword [ebp + 0x10]
push esi
mov esi, dword [ebp + 8]
cmp edi, ecx
jle 0x101d85b5
lea eax, [edi - 4]
xor edx, edx
div ecx
inc eax
imul ecx, eax, 3
sub edi, ecx
mov dword [ebp + 0x14], edi
mov edi, eax
push dword [ebx]
call fcn.1023241c
mov edx, eax
add ebx, 3
pop ecx
mov ecx, edx
shr ecx, 0x1a
mov cl, byte [ecx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [esi], cl
mov ecx, edx
shr ecx, 0x14
and ecx, 0x3f
mov al, byte [ecx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [esi + 1], al
mov eax, edx
shr eax, 0xe
and eax, 0x3f
shr edx, 8
and edx, 0x3f
mov al, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [esi + 2], al
mov al, byte [edx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [esi + 3], al
add esi, 4
sub edi, 1
jne 0x101d855f
mov edi, dword [ebp + 0x14]
xor edx, edx
test edi, edi
je 0x101d85ec
mov ecx, edi
shl ecx, 3
movzx eax, byte [ebx]
shl edx, 8
add edx, eax
inc ebx
sub edi, 1
jne 0x101d85c0
test ecx, ecx
jle 0x101d85ec
shl edx, 6
mov eax, edx
shr eax, cl
sub ecx, 6
and eax, 0x3f
mov al, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [esi], al
inc esi
test ecx, ecx
jg 0x101d85d5
mov ecx, esi
sub ecx, dword [ebp + 8]
jmp 0x101d85f8
mov byte [esi], 0x3d
inc esi
inc ecx
test cl, 3
jne 0x101d85f3
mov eax, dword [ebp + 8]
mov byte [esi], 0
pop esi
pop ebx
jmp 0x101d8609
xor eax, eax
pop edi
leave
ret

Function at 0x101d89a8
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, dword [edi + 0x110]
lea edx, [edi + 0xf0]
dec esi
test esi, esi
jle 0x101d8a2b
mov eax, dword [ebp + 0xc]
push ebx
push 3
mov ebx, esi
lea ecx, [eax + 1]
shl ebx, 4
mov dword [ebp + 8], ecx
pop ecx
sub ecx, eax
add ebx, edi
mov dword [ebp - 4], ecx
push dword [ebp + 8]
push ecx
push dword [ebp + 0x14]
push edx
call fcn.101d8fd8
lea edx, [edi + 0xf0]
add esp, 0x10
mov ecx, dword [edx]
xor ecx, dword [ebx]
lea ebx, [ebx - 0x10]
mov eax, dword [edx + 4]
xor eax, dword [ebx + 0x14]
mov dword [edi + 0x100], ecx
mov dword [edi + 0x104], eax
mov ecx, dword [ebx + 0x18]
mov eax, dword [ebx + 0x1c]
xor ecx, dword [edx + 8]
xor eax, dword [edx + 0xc]
dec esi
mov dword [edi + 0x108], ecx
mov ecx, dword [ebp - 4]
mov dword [edi + 0x10c], eax
test esi, esi
jg 0x101d89db
pop ebx
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push edx
call fcn.101d90a6
add esp, 0xc
pop edi
pop esi
leave
ret
Function at 0x101d916c
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 0x14]
push esi
mov esi, dword [ebp + 0x10]
add edx, esi
mov dword [ebp + 0x10], edx
cmp esi, edx
jae 0x101d91fa
push ebx
mov ebx, dword [ebp + 0xc]
push edi
mov edi, dword [ebp + 8]
cmp dword [edi + 0x24], 0
jne 0x101d91ba
push 0
push 0
push 1
lea eax, [edi + 4]
push eax
lea eax, [edi + 0x14]
push eax
push dword [edi]
call fcn.101d8bd0
lea ecx, [edi + 0xc]
add esp, 0x18
lea eax, [ecx + 7]
cmp eax, ecx
jb 0x101d91b7
add byte [eax], 1
jne 0x101d91b7
dec eax
jmp 0x101d91ab
mov edx, dword [ebp + 0x10]
mov eax, dword [edi + 0x24]
lea ecx, [edi + 0x14]
add ecx, eax
mov dword [ebp + 0x14], ecx
mov ecx, esi
sub ecx, eax
add ecx, 0x10
cmp ecx, edx
cmova ecx, edx
sub eax, esi
add eax, ecx
and eax, 0xf
mov dword [edi + 0x24], eax
cmp esi, ecx
jae 0x101d91f4
mov edx, dword [ebp + 0x14]
sub edx, ebx
mov al, byte [edx + ebx]
xor al, byte [esi]
mov byte [ebx], al
inc ebx
inc esi
cmp esi, ecx
jb 0x101d91e4
mov edx, dword [ebp + 0x10]
cmp esi, edx
jb 0x101d9187
pop edi
pop ebx
pop esi
pop ebp
ret

Function at 0x101d9315
Capabilities:
Hash data using sha224
Hash data using sha256

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 0xc]
mov eax, edx
mov ecx, dword [ebp + 8]
sar eax, 5
mov byte [ecx], al
sub edx, 0xa0
je 0x101d93b9
sub edx, 0x40
je 0x101d937a
sub edx, 0x20
je 0x101d9340
push 0xffffffffffffffea
pop eax
pop ebp
ret
mov dword [ecx + 0x50], 0x6a09e667
mov dword [ecx + 0x54], 0xbb67ae85
mov dword [ecx + 0x58], 0x3c6ef372
mov dword [ecx + 0x5c], 0xa54ff53a
mov dword [ecx + 0x60], 0x510e527f
mov dword [ecx + 0x64], 0x9b05688c
mov dword [ecx + 0x68], 0x1f83d9ab
mov dword [ecx + 0x6c], 0x5be0cd19
jmp 0x101d93b2
mov dword [ecx + 0x50], 0xc1059ed8
mov dword [ecx + 0x54], 0x367cd507
mov dword [ecx + 0x58], 0x3070dd17
mov dword [ecx + 0x5c], 0xf70e5939
mov dword [ecx + 0x60], 0xffc00b31
mov dword [ecx + 0x64], 0x68581511
mov dword [ecx + 0x68], 0x64f98fa7
mov dword [ecx + 0x6c], 0xbefa4fa4
mov eax, 0x101d95b4
jmp 0x101d93e1
mov dword [ecx + 0x50], 0x67452301
mov eax, 0x101d9438
mov dword [ecx + 0x54], 0xefcdab89
mov dword [ecx + 0x58], 0x98badcfe
mov dword [ecx + 0x5c], 0x10325476
mov dword [ecx + 0x60], 0xc3d2e1f0
mov dword [ecx + 0x70], eax
and dword [ecx + 8], 0
and dword [ecx + 0xc], 0
xor eax, eax
pop ebp
ret
Function at 0x101da8e1
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push str.SetDefaultDllDirectories
push str.kernel32.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
jne 0x101da9fb
push ebx
push esi
push edi
lea eax, [ebp - 8]
xor edi, edi
push eax
push dword [ebp + 8]
mov dword [ebp - 4], edi
mov esi, edi
mov dword [ebp - 8], edi
call fcn.101ce2b2
mov ebx, dword [ebp - 8]
pop ecx
pop ecx
test eax, eax
jne 0x101da9e5
push 2
push 0x104
call fcn.101d0520
pop ecx
pop ecx
push 0x104
mov esi, eax
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
push 0x5c
pop eax
push eax
push esi
call fcn.10231262
mov edi, eax
sub edi, esi
sar edi, 1
pop ecx
pop ecx
je 0x101da9e5
push ebx
call fcn.1009f866
add eax, 2
add eax, edi
pop ecx
cmp eax, 0x104
ja 0x101da9e5
push 0x5c
pop eax
mov word [esi + edi*2], ax
lea eax, [edi + 1]
lea eax, [esi + eax*2]
push ebx
push eax
call fcn.10234df4
pop ecx
pop ecx
push 8
push 0
push esi
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov dword [ebp - 4], eax
test eax, eax
jne 0x101da9e5
push 0x104
push esi
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
mov edi, eax
test edi, edi
je 0x101da9e5
push ebx
call fcn.1009f866
pop ecx
lea ecx, [edi + 2]
add ecx, eax
cmp ecx, 0x104
ja 0x101da9e5
push 0x5c
pop eax
mov word [esi + edi*2], ax
lea eax, [edi + 1]
lea eax, [esi + eax*2]
push ebx
push eax
call fcn.10234df4
pop ecx
pop ecx
push 8
push 0
push esi
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov dword [ebp - 4], eax
push esi
call fcn.101d06d8
push ebx
call fcn.101d06d8
mov eax, dword [ebp - 4]
pop ecx
pop ecx
pop edi
pop esi
pop ebx
leave
ret
push 0xa00
push 0
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_LoadLibraryExA]
leave
ret