joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100a0240
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, ecx
movzx eax, byte [esi]
xor eax, 0x811c9dc5
imul edx, eax, 0x1000193
movzx eax, byte [esi + 1]
xor edx, eax
movzx eax, byte [esi + 2]
imul edx, edx, 0x1000193
xor edx, eax
movzx eax, byte [esi + 3]
imul ecx, edx, 0x1000193
xor ecx, eax
lea eax, [ebp - 8]
imul ebx, ecx, 0x1000193
mov ecx, edi
push ebx
push esi
push eax
call fcn.100a0af0
mov edx, dword [eax + 4]
test edx, edx
je 0x100a02e7
mov ecx, dword [edi + 0x18]
mov eax, dword [edi + 0xc]
and ecx, ebx
lea ecx, [eax + ecx*8]
mov eax, dword [ecx]
cmp dword [ecx + 4], edx
jne 0x100a02bc
cmp eax, edx
jne 0x100a02b4
mov eax, dword [edi + 4]
mov dword [ecx], eax
mov dword [ecx + 4], eax
jmp 0x100a02c4
mov eax, dword [edx + 4]
mov dword [ecx + 4], eax
jmp 0x100a02c4
cmp eax, edx
jne 0x100a02c4
mov eax, dword [edx]
mov dword [ecx], eax
mov ecx, dword [edx]
dec dword [edi + 8]
mov eax, dword [edx + 4]
mov dword [eax], ecx
mov eax, dword [edx + 4]
mov dword [ecx + 4], eax
call fcn.10027d00
pop edi
pop esi
mov eax, 1
pop ebx
mov esp, ebp
pop ebp
ret 4
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x100a0370
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 8]
sub esp, 0x1c
push ebx
push edi
mov edi, dword [ebp + 0xc]
mov ebx, ecx
cmp edx, edi
jne 0x100a038e
mov eax, edi
pop edi
pop ebx
mov esp, ebp
pop ebp
ret 8
mov eax, dword [ebx + 4]
mov dword [ebp - 0x14], eax
mov eax, dword [edx + 4]
mov dword [ebp - 4], eax
movzx eax, byte [edx + 8]
xor eax, 0x811c9dc5
imul ecx, eax, 0x1000193
movzx eax, byte [edx + 9]
push esi
mov esi, dword [ebx + 0xc]
mov dword [ebp - 0x1c], esi
xor ecx, eax
movzx eax, byte [edx + 0xa]
imul ecx, ecx, 0x1000193
xor ecx, eax
movzx eax, byte [edx + 0xb]
imul ecx, ecx, 0x1000193
xor ecx, eax
mov eax, dword [ebx + 0x18]
imul ecx, ecx, 0x1000193
and eax, ecx
mov ecx, dword [esi + eax*8]
mov dword [ebp - 0x10], ecx
lea eax, [esi + eax*8]
mov esi, dword [edx]
mov dword [ebp - 8], eax
mov eax, dword [eax + 4]
mov dword [ebp - 0xc], eax
call fcn.10027d00
dec dword [ebx + 8]
mov eax, dword [ebp + 8]
cmp eax, dword [ebp - 0xc]
je 0x100a041e
nop dword [eax]
mov dword [ebp - 0x18], esi
cmp esi, edi
je 0x100a042d
mov edx, esi
mov esi, dword [esi]
call fcn.10027d00
dec dword [ebx + 8]
mov eax, dword [ebp - 0xc]
cmp dword [ebp - 0x18], eax
jne 0x100a0400
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 8]
cmp dword [ebp - 0x10], eax
jne 0x100a044d
mov eax, dword [ebp - 0x14]
mov dword [ecx], eax
jmp 0x100a0450
mov ecx, dword [ebp - 0x10]
cmp ecx, dword [ebp + 8]
jne 0x100a043a
mov ecx, dword [ebp - 8]
mov dword [ecx], esi
mov eax, dword [ebp - 4]
mov dword [eax], esi
mov dword [esi + 4], eax
mov eax, edi
pop esi
pop edi
pop ebx
mov esp, ebp
pop ebp
ret 8
mov eax, dword [ebp - 4]
mov dword [ecx + 4], eax
cmp esi, edi
je 0x100a043a
nop word [eax + eax]
movzx eax, byte [esi + 8]
mov edx, esi
xor eax, 0x811c9dc5
mov edi, esi
imul ecx, eax, 0x1000193
movzx eax, byte [esi + 9]
xor ecx, eax
movzx eax, byte [esi + 0xa]
imul ecx, ecx, 0x1000193
xor ecx, eax
movzx eax, byte [esi + 0xb]
mov esi, dword [esi]
imul ecx, ecx, 0x1000193
xor ecx, eax
mov eax, dword [ebx + 0x18]
imul ecx, ecx, 0x1000193
and eax, ecx
mov ecx, dword [ebp - 0x1c]
lea eax, [ecx + eax*8]
mov dword [ebp - 0x10], eax
mov eax, dword [eax + 4]
mov dword [ebp + 8], eax
call fcn.10027d00
dec dword [ebx + 8]
cmp edi, dword [ebp + 8]
je 0x100a04da
nop word [eax + eax]
mov eax, dword [ebp + 0xc]
mov edi, esi
cmp esi, eax
je 0x100a0503
mov edx, esi
mov esi, dword [esi]
call fcn.10027d00
dec dword [ebx + 8]
cmp edi, dword [ebp + 8]
jne 0x100a04c0
mov ecx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x14]
mov edi, dword [ebp + 0xc]
mov dword [ecx], eax
mov dword [ecx + 4], eax
cmp esi, edi
jne 0x100a0460
mov eax, dword [ebp - 4]
mov dword [eax], esi
mov dword [esi + 4], eax
mov eax, edi
pop esi
pop edi
pop ebx
mov esp, ebp
pop ebp
ret 8
mov ecx, dword [ebp - 0x10]
mov dword [ecx], esi
mov ecx, dword [ebp - 4]
mov dword [ecx], esi
mov dword [esi + 4], ecx
pop esi
pop edi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x100a0b60
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100ac4a5
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
push ebx
push esi
push edi
mov eax, dword [0x100bf040]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov edx, dword [ebp + 0xc]
mov edi, dword [ebp + 8]
mov dword [ebp - 0x10], edx
mov dword [ebp - 0x20], edi
movzx eax, byte [edx]
xor eax, 0x811c9dc5
imul ecx, eax, 0x1000193
movzx eax, byte [edx + 1]
xor ecx, eax
movzx eax, byte [edx + 2]
imul ecx, ecx, 0x1000193
xor ecx, eax
movzx eax, byte [edx + 3]
imul ecx, ecx, 0x1000193
xor ecx, eax
imul eax, ecx, 0x1000193
mov ecx, ebx
push eax
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x1c]
push edx
push eax
call fcn.100a0af0
mov eax, dword [ebp - 0x18]
test eax, eax
je 0x100a0bea
mov dword [edi], eax
mov byte [edi + 4], 0
jmp 0x100a0d30
cmp dword [ebx + 8], 0xfffffff
jne 0x100a0bfe
push str.unordered_map_set_too_long
call dword [sym.imp.MSVCP140.dll_void___cdecl_std::_Xlength_error_char_const__]
lea eax, [ebx + 4]
mov dword [ebp - 0x28], eax
mov dword [ebp - 4], 0
push 0x10
mov dword [ebp - 0x24], 0
call fcn.100a30c8
mov ecx, dword [ebp - 0x10]
mov esi, eax
add esp, 4
mov dword [ebp - 0x24], esi
mov ecx, dword [ecx]
mov dword [esi + 8], ecx
mov byte [esi + 0xc], 0
mov dword [ebp - 4], 1
mov eax, dword [ebx + 8]
mov ecx, dword [ebx + 0x1c]
inc eax
movss xmm3, dword [ebx]
movd xmm0, eax
cvtdq2pd xmm0, xmm0
shr eax, 0x1f
addsd xmm0, qword [eax*8 + 0x100b5530]
mov eax, ecx
shr eax, 0x1f
cvtpd2ps xmm2, xmm0
movd xmm0, ecx
cvtdq2pd xmm0, xmm0
movaps xmm1, xmm2
addsd xmm0, qword [eax*8 + 0x100b5530]
cvtpd2ps xmm0, xmm0
divss xmm1, xmm0
comiss xmm1, xmm3
jbe 0x100a0ce3
divss xmm2, xmm3
sub esp, 8
movss dword [ebp - 0x10], xmm2
fld dword [ebp - 0x10]
fstp qword [esp]
call sub.api_ms_win_crt_math_l1_1_0.dll_ceil
add esp, 8
fstp dword [ebp - 0x10]
movss xmm0, dword [ebp - 0x10]
call fcn.100a4490
mov ecx, 8
cmp eax, ecx
cmova ecx, eax
mov eax, dword [ebx + 0x1c]
cmp eax, ecx
jae 0x100a0cc5
cmp eax, 0x200
jae 0x100a0cc3
shl eax, 3
cmp eax, ecx
jae 0x100a0cc5
mov eax, ecx
push eax
mov ecx, ebx
call fcn.100427c0
push dword [ebp - 0x14]
lea eax, [esi + 8]
mov ecx, ebx
push eax
lea eax, [ebp - 0x1c]
push eax
call fcn.100a0af0
mov edx, dword [eax]
jmp 0x100a0ce6
mov edx, dword [ebp - 0x1c]
mov eax, dword [edx + 4]
inc dword [ebx + 8]
mov edi, dword [ebp - 0x28]
mov dword [esi + 4], eax
mov dword [esi], edx
mov dword [eax], esi
mov dword [edx + 4], esi
mov ecx, dword [ebx + 0xc]
mov dword [ebp - 0x10], eax
mov eax, dword [ebx + 0x18]
and eax, dword [ebp - 0x14]
mov ebx, dword [ecx + eax*8]
cmp ebx, dword [edi]
jne 0x100a0d11
mov dword [ecx + eax*8], esi
jmp 0x100a0d23
cmp ebx, edx
jne 0x100a0d1a
mov dword [ecx + eax*8], esi
jmp 0x100a0d27
mov edx, dword [ebp - 0x10]
cmp dword [ecx + eax*8 + 4], edx
jne 0x100a0d27
mov dword [ecx + eax*8 + 4], esi
mov edi, dword [ebp - 0x20]
mov dword [edi], esi
mov byte [edi + 4], 1
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x100a11f0
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100ac4a5
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
push ebx
push esi
push edi
mov eax, dword [0x100bf040]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov edx, dword [ebp + 0xc]
mov edi, dword [ebp + 8]
mov dword [ebp - 0x10], edx
mov dword [ebp - 0x20], edi
movzx eax, byte [edx]
xor eax, 0x811c9dc5
imul ecx, eax, 0x1000193
movzx eax, byte [edx + 1]
xor ecx, eax
movzx eax, byte [edx + 2]
imul ecx, ecx, 0x1000193
xor ecx, eax
movzx eax, byte [edx + 3]
imul ecx, ecx, 0x1000193
xor ecx, eax
imul eax, ecx, 0x1000193
mov ecx, ebx
push eax
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x1c]
push edx
push eax
call fcn.100a0af0
mov eax, dword [ebp - 0x18]
test eax, eax
je 0x100a127a
mov dword [edi], eax
mov byte [edi + 4], 0
jmp 0x100a13c2
cmp dword [ebx + 8], 0xfffffff
jne 0x100a128e
push str.unordered_map_set_too_long
call dword [sym.imp.MSVCP140.dll_void___cdecl_std::_Xlength_error_char_const__]
lea eax, [ebx + 4]
mov dword [ebp - 0x28], eax
mov dword [ebp - 4], 0
push 0x10
mov dword [ebp - 0x24], 0
call fcn.100a30c8
mov edx, dword [ebp - 0x10]
mov esi, eax
add esp, 4
mov dword [ebp - 0x24], esi
mov ecx, dword [edx]
mov edx, dword [edx + 4]
mov dword [esi + 8], ecx
mov dword [esi + 0xc], edx
mov dword [ebp - 4], 1
mov eax, dword [ebx + 8]
mov ecx, dword [ebx + 0x1c]
inc eax
movss xmm3, dword [ebx]
movd xmm0, eax
cvtdq2pd xmm0, xmm0
shr eax, 0x1f
addsd xmm0, qword [eax*8 + 0x100b5530]
mov eax, ecx
shr eax, 0x1f
cvtpd2ps xmm2, xmm0
movd xmm0, ecx
cvtdq2pd xmm0, xmm0
movaps xmm1, xmm2
addsd xmm0, qword [eax*8 + 0x100b5530]
cvtpd2ps xmm0, xmm0
divss xmm1, xmm0
comiss xmm1, xmm3
jbe 0x100a1375
divss xmm2, xmm3
sub esp, 8
movss dword [ebp - 0x10], xmm2
fld dword [ebp - 0x10]
fstp qword [esp]
call sub.api_ms_win_crt_math_l1_1_0.dll_ceil
add esp, 8
fstp dword [ebp - 0x10]
movss xmm0, dword [ebp - 0x10]
call fcn.100a4490
mov ecx, 8
cmp eax, ecx
cmova ecx, eax
mov eax, dword [ebx + 0x1c]
cmp eax, ecx
jae 0x100a1357
cmp eax, 0x200
jae 0x100a1355
shl eax, 3
cmp eax, ecx
jae 0x100a1357
mov eax, ecx
push eax
mov ecx, ebx
call fcn.100427c0
push dword [ebp - 0x14]
lea eax, [esi + 8]
mov ecx, ebx
push eax
lea eax, [ebp - 0x1c]
push eax
call fcn.100a0af0
mov edx, dword [eax]
jmp 0x100a1378
mov edx, dword [ebp - 0x1c]
mov eax, dword [edx + 4]
inc dword [ebx + 8]
mov edi, dword [ebp - 0x28]
mov dword [esi + 4], eax
mov dword [esi], edx
mov dword [eax], esi
mov dword [edx + 4], esi
mov ecx, dword [ebx + 0xc]
mov dword [ebp - 0x10], eax
mov eax, dword [ebx + 0x18]
and eax, dword [ebp - 0x14]
mov ebx, dword [ecx + eax*8]
cmp ebx, dword [edi]
jne 0x100a13a3
mov dword [ecx + eax*8], esi
jmp 0x100a13b5
cmp ebx, edx
jne 0x100a13ac
mov dword [ecx + eax*8], esi
jmp 0x100a13b9
mov edx, dword [ebp - 0x10]
cmp dword [ecx + eax*8 + 4], edx
jne 0x100a13b9
mov dword [ecx + eax*8 + 4], esi
mov edi, dword [ebp - 0x20]
mov dword [edi], esi
mov byte [edi + 4], 1
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x10002d50
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub dword [ebp + 0xc], 1
jne 0x10002d7a
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_DisableThreadLibraryCalls]
push 0
push 0
push 0
push 0x10002d90
push 0x1000
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov eax, 1
pop ebp
ret 0xc
Function at 0x1000abc0
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1009585d
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x100b6540]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x14], esi
push 8
mov dword [esi], vtable.std::basic_streambuf_char__struct_std::char_traits_char__.0
mov dword [esi + 4], 0
mov dword [esi + 8], 0
mov dword [esi + 0xc], 0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
mov dword [esi + 0x18], 0
mov dword [esi + 0x1c], 0
mov dword [esi + 0x20], 0
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x2c], 0
mov dword [esi + 0x30], 0
call fcn.1006bb73
mov edi, eax
add esp, 4
test edi, edi
je 0x1000ac6d
push 1
mov dword [ebp - 4], 0
call fcn.1006a12d
add esp, 4
mov dword [edi + 4], eax
jmp 0x1000ac6f
xor edi, edi
mov ecx, esi
mov dword [esi + 0x34], edi
call fcn.1000b730
mov ebx, dword [ebp + 0xc]
mov ecx, ebx
not ecx
mov dword [esi], vtable.std::basic_stringbuf_char__struct_std::char_traits_char___class_std::allocator_char__.0
and ecx, 1
mov dword [ebp - 4], 1
shl ecx, 2
mov edx, ecx
or edx, 2
test bl, 2
cmovne edx, ecx
mov ecx, edx
or ecx, 8
test bl, 8
cmove ecx, edx
mov eax, ecx
or eax, 0x10
test bl, 4
cmove eax, ecx
mov ecx, dword [ebp + 8]
mov dword [ebp + 0xc], eax
cmp dword [ecx + 0x14], 0xf
mov ebx, dword [ecx + 0x10]
jbe 0x1000acc8
mov ecx, dword [ecx]
mov dword [ebp + 8], ecx
cmp ebx, 0x7fffffff
ja 0x1000ad8e
test ebx, ebx
je 0x1000ad6e
and eax, 6
cmp al, 6
je 0x1000ad6b
lea eax, [ebp - 0x10]
mov dword [ebp - 0x10], ebx
push eax
lea eax, [esi + 0x40]
push eax
call fcn.10007d20
push ebx
push dword [ebp + 8]
mov edi, eax
push edi
call fcn.1006d7c0
mov eax, dword [ebp + 0xc]
lea ecx, [ebx + edi]
mov dword [esi + 0x38], ecx
add esp, 0x14
mov ecx, eax
and ecx, 4
mov dword [ebp + 8], ecx
jne 0x1000ad2b
mov eax, dword [esi + 0xc]
mov dword [eax], edi
mov eax, dword [esi + 0x1c]
mov dword [eax], edi
mov eax, dword [esi + 0x2c]
mov dword [eax], ebx
mov eax, dword [ebp + 0xc]
test al, 2
jne 0x1000ad66
mov edx, dword [esi + 0x38]
test al, 0x18
mov eax, dword [esi + 0x10]
mov ecx, edi
cmovne ecx, edx
sub edx, ecx
cmp dword [ebp + 8], 0
mov dword [eax], edi
mov eax, dword [esi + 0x20]
mov dword [eax], ecx
mov eax, dword [esi + 0x30]
mov dword [eax], edx
je 0x1000ad63
mov eax, dword [esi + 0xc]
mov dword [eax], edi
mov eax, dword [esi + 0x1c]
mov dword [eax], edi
mov eax, dword [esi + 0x2c]
mov dword [eax], 0
mov eax, dword [ebp + 0xc]
or eax, 1
jmp 0x1000ad75
mov eax, dword [ebp + 0xc]
mov dword [esi + 0x38], 0
mov dword [esi + 0x3c], eax
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
call fcn.10069eff
int3
Function at 0x1000de40
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10095c25
mov eax, dword fs:[0]
push eax
sub esp, 0x48
mov eax, dword [0x100b6540]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
lea eax, [ebp - 0x44]
mov dword [ebp - 0x44], 4
push eax
lea eax, [ebp - 0x54]
mov ecx, 0x100b7708
push eax
call fcn.10007fb0
mov esi, dword [ebp - 0x4c]
cmp byte [esi + 0xd], 0
jne 0x1000df03
cmp dword [esi + 0x10], 4
jg 0x1000df03
add esi, 0x14
mov edi, esi
cmp dword [esi + 0x14], 0xf
jbe 0x1000dea2
mov edi, dword [esi]
xor ecx, ecx
mov edx, 0x811c9dc5
cmp dword [esi + 0x10], ecx
jbe 0x1000dec2
nop
movzx eax, byte [edi + ecx]
inc ecx
xor eax, edx
imul edx, eax, 0x1000193
cmp ecx, dword [esi + 0x10]
jb 0x1000deb0
push edx
push esi
lea eax, [ebp - 0x48]
mov ecx, ebx
push eax
call fcn.1000da00
mov eax, dword [eax + 4]
test eax, eax
je 0x1000deff
cmp eax, dword [ebx + 4]
je 0x1000deff
cmp dword [ebx + 8], 1
jne 0x1000df0d
mov al, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1006bb34
mov esp, ebp
pop ebp
ret
xor al, al
jmp 0x1000dee3
push str.invalid_map_K__T__key
call fcn.10069f5c
lea eax, [ebp - 0x28]
mov ecx, ebx
push eax
call fcn.1000df60
push eax
lea eax, [ebp - 0x40]
mov dword [ebp - 4], 0
push str.AcceptEncoding_does_not_accept_any_other_values_if_disabled_is_present._You_set_the_following_encodings:
push eax
call fcn.100085b0
add esp, 0xc
push eax
lea ecx, [ebp - 0x54]
mov byte [ebp - 4], 1
call fcn.1000ddf0
push 0x100b3a08
lea eax, [ebp - 0x54]
push eax
call fcn.1006d74e
int3
Function at 0x10018640
Capabilities:
Generate random numbers via winapi

Disassembly:
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0x1c]
mov ecx, 0x2b
test edi, edi
je 0x100186eb
mov ebp, dword [esp + 0x14]
mov esi, dword [esp + 0x18]
nop dword [eax]
mov ebx, 4
lea eax, [esp + 0x1c]
push 4
push eax
cmp edi, ebx
push ebp
cmovb ebx, edi
call fcn.1001a750
mov ecx, eax
add esp, 0xc
cmp ecx, 4
jne 0x100186a8
cmp byte [0x100b78e8], 0
jne 0x100186b2
push 2
push eax
lea eax, [esp + 0x24]
mov dword [esp + 0x24], 0
push eax
push 0
call sub.bcrypt.dll_BCryptGenRandom
neg eax
sbb ecx, ecx
and ecx, 2
test ecx, ecx
jne 0x100186eb
mov eax, dword [esp + 0x1c]
jmp 0x100186cf
imul eax, dword [0x100b78e4], 0x41c64e6d
add eax, 0x3039
mov dword [0x100b78e4], eax
ror eax, 0x10
xor ecx, ecx
mov dword [esp + 0x1c], eax
test ebx, ebx
je 0x100186e3
mov byte [esi], al
dec edi
inc esi
shr eax, 8
sub ebx, 1
jne 0x100186d3
mov dword [esp + 0x1c], eax
test edi, edi
jne 0x10018660
pop edi
pop esi
pop ebp
mov eax, ecx
pop ebx
ret

Function at 0x10018700
Capabilities:
Generate random numbers via winapi

Disassembly:
push ebx
mov ebx, dword [esp + 0x10]
push ebp
push esi
push edi
mov edi, dword [esp + 0x18]
sub ebx, 1
je 0x10018798
mov esi, dword [esp + 0x14]
mov ebp, 0x3e
nop
push 4
lea eax, [esp + 0x20]
push eax
push esi
call fcn.1001a750
add esp, 0xc
cmp eax, 4
jne 0x1001875c
cmp byte [0x100b78e8], 0
jne 0x10018766
push 2
push eax
lea eax, [esp + 0x24]
mov dword [esp + 0x24], 0
push eax
push 0
call sub.bcrypt.dll_BCryptGenRandom
neg eax
sbb eax, eax
and eax, 2
test eax, eax
jne 0x1001879d
mov eax, dword [esp + 0x1c]
jmp 0x10018781
imul eax, dword [0x100b78e4], 0x41c64e6d
add eax, 0x3039
mov dword [0x100b78e4], eax
ror eax, 0x10
mov dword [esp + 0x1c], eax
cmp eax, 0xfffffffc
jae 0x10018720
xor edx, edx
div ebp
mov al, byte [edx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789]
mov byte [edi], al
inc edi
sub ebx, 1
jne 0x10018720
mov byte [edi], 0
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
ret

Function at 0x100187b0
Capabilities:
Generate random numbers via winapi

Disassembly:
push dword [esp + 8]
push 0
push dword [esp + 0xc]
call fcn.1006ddf0
add esp, 0xc
push 2
push dword [esp + 0xc]
push dword [esp + 0xc]
push 0
call sub.bcrypt.dll_BCryptGenRandom
neg eax
sbb eax, eax
and eax, 2
ret
Function at 0x1001a4b0
Capabilities:
Convert ip address from string

Disassembly:
sub esp, 0x14
mov eax, dword [0x100b6540]
xor eax, esp
mov dword [esp + 0x10], eax
mov ecx, dword [esp + 0x1c]
push ebx
push ebp
push esi
mov eax, dword [ecx]
push edi
mov edi, dword [esp + 0x28]
mov eax, dword [eax + 4]
and eax, 0xa
cmp al, 0xa
mov eax, dword [ecx + 0xc]
jne 0x1001a4e7
mov esi, dword [eax + 0x78]
mov ebx, dword [eax + 0x7c]
mov ebp, dword [eax + 0x80]
jmp 0x1001a4f3
mov esi, dword [eax + 0x30]
mov ebx, dword [eax + 0x34]
mov ebp, dword [eax + 0x4c0]
test esi, esi
je 0x1001a5d4
mov eax, dword [edi]
test eax, eax
je 0x1001a530
mov ecx, esi
mov dl, byte [ecx]
cmp dl, byte [eax]
jne 0x1001a523
test dl, dl
je 0x1001a51f
mov dl, byte [ecx + 1]
cmp dl, byte [eax + 1]
jne 0x1001a523
add ecx, 2
add eax, 2
test dl, dl
jne 0x1001a503
xor eax, eax
jmp 0x1001a528
sbb eax, eax
or eax, 1
test eax, eax
je 0x1001a5d4
push edi
call fcn.1001a460
push esi
call dword [0x100b60d8]
mov edx, eax
add esp, 8
mov dword [edi], edx
test edx, edx
je 0x1001a58a
test ebx, ebx
je 0x1001a5ab
mov ecx, ebx
nop
mov al, byte [esi]
cmp al, byte [ecx]
jne 0x1001a570
test al, al
je 0x1001a56c
mov al, byte [esi + 1]
cmp al, byte [ecx + 1]
jne 0x1001a570
add esi, 2
add ecx, 2
test al, al
jne 0x1001a550
xor eax, eax
jmp 0x1001a575
sbb eax, eax
or eax, 1
test eax, eax
je 0x1001a5ab
push ebx
call dword [0x100b60d8]
add esp, 4
mov dword [edi + 4], eax
test eax, eax
jne 0x1001a5ae
push edi
call fcn.1001a460
add esp, 4
mov eax, 0x1b
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x10]
xor ecx, esp
call fcn.1006bb34
add esp, 0x14
ret
mov dword [edi + 4], edx
mov esi, dword [edi]
test esi, esi
je 0x1001a60a
cmp byte [esi], 0
je 0x1001a60a
mov ebx, dword [sym.imp.WS2_32.dll_inet_pton]
lea eax, [esp + 0x10]
push eax
push esi
push 2
call ebx
test eax, eax
je 0x1001a5f3
mov dword [edi + 0xc], 1
mov eax, dword [esp + 0x30]
mov ecx, dword [esp + 0x20]
mov dword [edi + 0x10], ebp
mov dword [edi + 0x14], eax
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.1006bb34
add esp, 0x14
ret
lea eax, [esp + 0x10]
push eax
push esi
push 0x17
call ebx
test eax, eax
je 0x1001a60a
mov dword [edi + 0xc], 2
jmp 0x1001a5d4
mov ecx, dword [edi]
mov dword [edi + 0xc], 0
cmp byte [ecx], 0
je 0x1001a5d4
mov esi, ecx
lea edx, [esi + 1]
nop dword [eax]
mov al, byte [esi]
inc esi
test al, al
jne 0x1001a620
sub esi, edx
je 0x1001a633
cmp byte [ecx + esi - 1], 0x2e
jne 0x1001a633
dec esi
cmp esi, 0xffff
jae 0x1001a5d4
lea eax, [esi + 1]
push eax
push 1
call dword [0x100b60dc]
add esp, 8
mov dword [edi + 8], eax
test eax, eax
je 0x1001a58a
push esi
push dword [edi]
push eax
call fcn.100164d0
mov eax, dword [edi + 8]
add esp, 0xc
mov byte [esi + eax], 0
jmp 0x1001a5d4
Function at 0x1001ca80
Capabilities:
Encode data using xor
Hash data using djb2

Disassembly:
push esi
mov esi, dword [esp + 8]
test esi, esi
je 0x1001cb2f
push esi
call fcn.1003a7a0
add esp, 4
test al, al
jne 0x1001cb2f
push ebx
push edi
mov edi, esi
xor ebx, ebx
lea ecx, [edi + 1]
mov al, byte [edi]
inc edi
test al, al
jne 0x1001caa7
sub edi, ecx
push edi
push 0x2e
push esi
call fcn.1003ba60
add esp, 0xc
test eax, eax
je 0x1001cadb
sub eax, esi
push eax
push 0x2e
push esi
call fcn.1003ba60
mov ebx, eax
add esp, 0xc
test ebx, ebx
je 0x1001cadd
inc ebx
mov ecx, esi
sub ecx, ebx
add edi, ecx
test ebx, ebx
cmovne esi, ebx
lea ebx, [esi + edi]
mov edi, 0x1505
cmp esi, ebx
jae 0x1001cb0e
nop dword [eax]
mov al, byte [esi]
push eax
call fcn.10016470
movsx ecx, al
inc esi
mov eax, edi
add esp, 4
shl eax, 5
add eax, edi
xor ecx, eax
mov edi, ecx
cmp esi, ebx
jb 0x1001caf0
mov eax, 0x4104105
mov esi, edi
mul edi
sub esi, edx
shr esi, 1
add esi, edx
shr esi, 5
mov ecx, esi
shl ecx, 6
sub ecx, esi
sub edi, ecx
mov eax, edi
pop edi
pop ebx
pop esi
ret
xor eax, eax
pop esi
ret
Function at 0x1002cd20
Capabilities:
Get common file path

Disassembly:
push ecx
push ebx
push edi
push str.kernel32
xor edi, edi
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov ebx, eax
test ebx, ebx
jne 0x1002cd3a
pop edi
pop ebx
pop ecx
ret
push ebp
push esi
push 0x1009a598
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, dword [esp + 0x18]
mov ebp, eax
push 0x1009a5a8
push esi
call fcn.1007f1e4
add esp, 8
test eax, eax
je 0x1002cd82
test ebp, ebp
je 0x1002cd73
push 8
push 0
push esi
call ebp
pop esi
pop ebp
mov edi, eax
pop edi
pop ebx
pop ecx
ret
push esi
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
pop esi
pop ebp
mov edi, eax
pop edi
pop ebx
pop ecx
ret
test ebp, ebp
je 0x1002cda8
push str.AddDllDirectory
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x1002cda8
push 0x800
push 0
push esi
call ebp
pop esi
pop ebp
mov edi, eax
pop edi
pop ebx
pop ecx
ret
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
mov edx, eax
mov dword [esp + 0x10], edx
test edx, edx
je 0x1002ce82
mov ecx, esi
lea ebx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x1002cdc5
sub ecx, ebx
sar ecx, 1
lea eax, [ecx + edx]
lea eax, [eax*2 + 2]
push eax
call dword [0x100b60cc]
mov ebx, eax
add esp, 4
test ebx, ebx
je 0x1002ce78
push dword [esp + 0x10]
push ebx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
test eax, eax
je 0x1002ce78
mov ecx, ebx
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x1002ce06
sub ecx, edx
sar ecx, 1
mov dword [ebx + ecx*2], 0x5c
mov ecx, ebx
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x1002ce21
sub ecx, edx
sar ecx, 1
add ecx, ecx
sub ecx, esi
add ecx, ebx
nop word [eax + eax]
movzx eax, word [esi]
lea esi, [esi + 2]
mov word [ecx + esi - 2], ax
test ax, ax
jne 0x1002ce40
test ebp, ebp
je 0x1002ce6f
push 8
push 0
push ebx
call ebp
push ebx
mov edi, eax
call dword [0x100b60d0]
add esp, 4
mov eax, edi
pop esi
pop ebp
pop edi
pop ebx
pop ecx
ret
push ebx
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov edi, eax
push ebx
call dword [0x100b60d0]
add esp, 4
pop esi
pop ebp
mov eax, edi
pop edi
pop ebx
pop ecx
ret