joyce8/EMBER2024-capa huggingface dataset:
Function at 0x101223e0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10179135
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x50
push ebx
push esi
push edi
mov dword [ebp - 0x14], edx
mov dword [ebp - 0x18], ecx
lea eax, [ebp + 8]
mov dword [ebp - 4], 0
push eax
lea ecx, [ebp - 0x40]
call fcn.100918c0
mov byte [ebp - 4], 1
nop dword [eax + eax]
sub esp, 0x18
lea eax, [ebp - 0x40]
mov ecx, esp
push eax
call fcn.100918c0
lea eax, [ebp - 0x58]
push eax
call fcn.100e2db0
push eax
lea ecx, [ebp - 0x40]
call fcn.100917b0
mov ecx, dword [ebp - 0x44]
cmp ecx, 0xf
jbe 0x10122474
mov edx, dword [ebp - 0x58]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x1012246a
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x101225bb
push ecx
push edx
call fcn.101706c8
add esp, 8
cmp dword [ebp - 0x2c], 0xf
lea edi, [ebp - 0x40]
mov ebx, 0x811c9dc5
cmova edi, dword [ebp - 0x40]
xor edx, edx
mov ecx, edi
mov dword [ebp - 0x10], ebx
lea esi, [ecx + 1]
nop
mov al, byte [ecx]
inc ecx
test al, al
jne 0x10122490
sub ecx, esi
je 0x101224c2
nop dword [eax + eax]
movsx eax, byte [edi + edx]
xor eax, ebx
imul ebx, eax, 0x1000193
mov eax, edi
inc edx
lea esi, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x101224b2
sub eax, esi
cmp edx, eax
jb 0x101224a0
mov dword [ebp - 0x10], ebx
mov al, byte [0x10274478]
test al, al
jne 0x101224d2
mov eax, 0x811c9dc5
jmp 0x101224ea
movsx eax, al
mov ecx, 0x10274479
xor eax, 0x811c9dc5
imul edx, eax, 0x1000193
call fcn.100de6f0
mov ebx, dword [ebp - 0x14]
cmp dword [ebp - 0x10], eax
je 0x1012253c
cmp dword [ebp - 0x2c], 0xf
lea esi, [ebp - 0x40]
mov edi, dword [ebp - 0x30]
mov edx, 0x811c9dc5
cmova esi, dword [ebp - 0x40]
xor ecx, ecx
test edi, edi
je 0x10122521
nop dword [eax + eax]
movzx eax, byte [esi + ecx]
inc ecx
xor eax, edx
imul edx, eax, 0x1000193
cmp ecx, edi
jb 0x10122510
push edx
lea eax, [ebp - 0x40]
push eax
lea eax, [ebp - 0x28]
push eax
lea ecx, [ebx + 0x50]
call fcn.100948e0
cmp dword [eax + 4], 0
je 0x10122420
lea eax, [ebp - 0x40]
push eax
lea ecx, [ebx + 0x50]
call fcn.100e4650
mov esi, dword [ebp - 0x18]
mov ecx, esi
push eax
call fcn.100918c0
mov ecx, dword [ebp - 0x2c]
cmp ecx, 0xf
jbe 0x10122583
mov edx, dword [ebp - 0x40]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x10122579
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x101225bb
push ecx
push edx
call fcn.101706c8
add esp, 8
mov ecx, dword [ebp + 0x1c]
mov dword [ebp - 0x30], 0
mov dword [ebp - 0x2c], 0xf
mov byte [ebp - 0x40], 0
cmp ecx, 0xf
jbe 0x101225cb
mov edx, dword [ebp + 8]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x101225c1
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x101225c1
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push ecx
push edx
call fcn.101706c8
add esp, 8
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x101228a0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10179135
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x50
push ebx
push esi
push edi
mov dword [ebp - 0x14], edx
mov dword [ebp - 0x18], ecx
lea eax, [ebp + 8]
mov dword [ebp - 4], 0
push eax
lea ecx, [ebp - 0x40]
call fcn.100918c0
mov byte [ebp - 4], 1
nop dword [eax + eax]
sub esp, 0x18
lea eax, [ebp - 0x40]
mov ecx, esp
push eax
call fcn.100918c0
lea eax, [ebp - 0x58]
push eax
call fcn.100e2db0
push eax
lea ecx, [ebp - 0x40]
call fcn.100917b0
mov ecx, dword [ebp - 0x44]
cmp ecx, 0xf
jbe 0x10122934
mov edx, dword [ebp - 0x58]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x1012292a
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x10122a7b
push ecx
push edx
call fcn.101706c8
add esp, 8
cmp dword [ebp - 0x2c], 0xf
lea edi, [ebp - 0x40]
mov ebx, 0x811c9dc5
cmova edi, dword [ebp - 0x40]
xor edx, edx
mov ecx, edi
mov dword [ebp - 0x10], ebx
lea esi, [ecx + 1]
nop
mov al, byte [ecx]
inc ecx
test al, al
jne 0x10122950
sub ecx, esi
je 0x10122982
nop dword [eax + eax]
movsx eax, byte [edi + edx]
xor eax, ebx
imul ebx, eax, 0x1000193
mov eax, edi
inc edx
lea esi, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x10122972
sub eax, esi
cmp edx, eax
jb 0x10122960
mov dword [ebp - 0x10], ebx
mov al, byte [0x10274478]
test al, al
jne 0x10122992
mov eax, 0x811c9dc5
jmp 0x101229aa
movsx eax, al
mov ecx, 0x10274479
xor eax, 0x811c9dc5
imul edx, eax, 0x1000193
call fcn.100de6f0
mov ebx, dword [ebp - 0x14]
cmp dword [ebp - 0x10], eax
je 0x101229fc
cmp dword [ebp - 0x2c], 0xf
lea esi, [ebp - 0x40]
mov edi, dword [ebp - 0x30]
mov edx, 0x811c9dc5
cmova esi, dword [ebp - 0x40]
xor ecx, ecx
test edi, edi
je 0x101229e1
nop dword [eax + eax]
movzx eax, byte [esi + ecx]
inc ecx
xor eax, edx
imul edx, eax, 0x1000193
cmp ecx, edi
jb 0x101229d0
push edx
lea eax, [ebp - 0x40]
push eax
lea eax, [ebp - 0x28]
push eax
lea ecx, [ebx + 0x38]
call fcn.100948e0
cmp dword [eax + 4], 0
je 0x101228e0
lea eax, [ebp - 0x40]
push eax
lea ecx, [ebx + 0x38]
call fcn.100e4590
mov esi, dword [ebp - 0x18]
mov ecx, esi
push eax
call fcn.100f6620
mov ecx, dword [ebp - 0x2c]
cmp ecx, 0xf
jbe 0x10122a43
mov edx, dword [ebp - 0x40]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x10122a39
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x10122a7b
push ecx
push edx
call fcn.101706c8
add esp, 8
mov ecx, dword [ebp + 0x1c]
mov dword [ebp - 0x30], 0
mov dword [ebp - 0x2c], 0xf
mov byte [ebp - 0x40], 0
cmp ecx, 0xf
jbe 0x10122a8b
mov edx, dword [ebp + 8]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x10122a81
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x10122a81
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push ecx
push edx
call fcn.101706c8
add esp, 8
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10122aa0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x101790b5
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x40
push ebx
push esi
push edi
mov dword [ebp - 0x10], ecx
lea eax, [ebp + 8]
mov dword [ebp - 4], 0
push eax
lea ecx, [ebp - 0x34]
call fcn.100918c0
mov byte [ebp - 4], 1
sub esp, 0x18
lea eax, [ebp - 0x34]
mov ecx, esp
push eax
call fcn.100918c0
lea eax, [ebp - 0x4c]
push eax
call fcn.100e2db0
push eax
lea ecx, [ebp - 0x34]
call fcn.100917b0
mov ecx, dword [ebp - 0x38]
cmp ecx, 0xf
jbe 0x10122b2c
mov edx, dword [ebp - 0x4c]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x10122b22
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x10122c65
push ecx
push edx
call fcn.101706c8
add esp, 8
cmp dword [ebp - 0x20], 0xf
lea edi, [ebp - 0x34]
mov ebx, 0x811c9dc5
cmova edi, dword [ebp - 0x34]
xor edx, edx
mov ecx, edi
lea esi, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x10122b43
sub ecx, esi
je 0x10122b6f
nop
movsx eax, byte [edi + edx]
xor eax, ebx
imul ebx, eax, 0x1000193
mov eax, edi
inc edx
lea esi, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x10122b62
sub eax, esi
cmp edx, eax
jb 0x10122b50
mov al, byte [0x10274478]
test al, al
jne 0x10122b7f
mov eax, 0x811c9dc5
jmp 0x10122b97
movsx eax, al
mov ecx, 0x10274479
xor eax, 0x811c9dc5
imul edx, eax, 0x1000193
call fcn.100de6f0
cmp ebx, eax
mov ebx, dword [ebp - 0x10]
je 0x10122bed
mov edi, dword [ebp - 0x24]
lea esi, [ebp - 0x34]
add ebx, 0x28
mov edx, 0x811c9dc5
cmp dword [ebp - 0x20], 0xf
cmova esi, dword [ebp - 0x34]
xor ecx, ecx
test edi, edi
je 0x10122bd1
nop word [eax + eax]
movzx eax, byte [esi + ecx]
inc ecx
xor eax, edx
imul edx, eax, 0x1000193
cmp ecx, edi
jb 0x10122bc0
push edx
lea eax, [ebp - 0x34]
mov ecx, ebx
push eax
lea eax, [ebp - 0x1c]
push eax
call fcn.100948e0
cmp dword [eax + 4], 0
je 0x10122ad8
jmp 0x10122bf0
add ebx, 0x28
lea eax, [ebp - 0x34]
mov ecx, ebx
push eax
call fcn.100e45d0
mov ecx, dword [ebp - 0x20]
mov esi, dword [eax]
cmp ecx, 0xf
jbe 0x10122c2d
mov edx, dword [ebp - 0x34]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x10122c23
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x10122c65
push ecx
push edx
call fcn.101706c8
add esp, 8
mov ecx, dword [ebp + 0x1c]
mov dword [ebp - 0x24], 0
mov dword [ebp - 0x20], 0xf
mov byte [ebp - 0x34], 0
cmp ecx, 0xf
jbe 0x10122c75
mov edx, dword [ebp + 8]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x10122c6b
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x10122c6b
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push ecx
push edx
call fcn.101706c8
add esp, 8
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10122c90
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x101790dd
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ebx
sub esp, 0x48
test byte [0x102a65fc], 6
push esi
mov esi, ecx
push edi
mov dword [ebp - 0x18], esi
je 0x10122d23
xorps xmm0, xmm0
movups xmmword [esi], xmm0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
mov dword [esi + 0x10], 7
mov dword [esi + 0x14], 0xf
mov eax, dword [0x10274478]
mov dword [esi], eax
mov ax, word [0x1027447c]
mov word [esi + 4], ax
mov al, byte [0x1027447e]
mov byte [esi + 6], al
mov eax, esi
mov byte [esi + 7], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret
cmp byte [ebx + 8], 0
push str.default
je 0x10122d48
call fcn.100918c0
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret
lea ecx, [ebp - 0x3c]
call fcn.100918c0
mov dword [ebp - 4], 0
nop word [eax + eax]
cmp dword [ebp - 0x28], 0xf
lea edi, [ebp - 0x3c]
mov esi, 0x811c9dc5
cmova edi, dword [ebp - 0x3c]
xor edx, edx
mov ecx, edi
lea eax, [ecx + 1]
mov dword [ebp - 0x14], eax
nop word [eax + eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x10122d80
sub ecx, dword [ebp - 0x14]
je 0x10122da1
nop dword [eax]
movsx eax, byte [edi + edx]
inc edx
xor eax, esi
imul esi, eax, 0x1000193
cmp edx, ecx
jb 0x10122d90
mov eax, dword [0x10274478]
test al, al
jne 0x10122db1
mov eax, 0x811c9dc5
jmp 0x10122dc9
movsx eax, al
mov ecx, 0x10274479
xor eax, 0x811c9dc5
imul edx, eax, 0x1000193
call fcn.100de6f0
cmp esi, eax
je 0x10122e79
cmp dword [ebp - 0x28], 0xf
lea esi, [ebp - 0x3c]
mov edi, dword [ebp - 0x2c]
mov edx, 0x811c9dc5
cmova esi, dword [ebp - 0x3c]
xor eax, eax
test edi, edi
je 0x10122e01
nop word [eax + eax]
movzx ecx, byte [esi + eax]
inc eax
xor ecx, edx
imul edx, ecx, 0x1000193
cmp eax, edi
jb 0x10122df0
push edx
lea eax, [ebp - 0x3c]
mov ecx, 0x102a6610
push eax
lea eax, [ebp - 0x24]
push eax
call fcn.100948e0
cmp dword [eax + 4], 0
jne 0x10122e79
sub esp, 0x18
lea eax, [ebp - 0x3c]
mov ecx, esp
push eax
call fcn.100918c0
lea eax, [ebp - 0x54]
push eax
call fcn.100e2db0
push eax
lea ecx, [ebp - 0x3c]
call fcn.100917b0
mov ecx, dword [ebp - 0x40]
cmp ecx, 0xf
jbe 0x10122d60
mov edx, dword [ebp - 0x54]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x10122e64
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x10122e73
push ecx
push edx
call fcn.101706c8
add esp, 8
jmp 0x10122d60
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
mov eax, dword [ebp - 0x18]
xorps xmm0, xmm0
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
movups xmmword [eax], xmm0
mov dword [eax + 0x10], 0
movups xmm0, xmmword [ebp - 0x3c]
mov dword [eax + 0x14], 0
movups xmmword [eax], xmm0
movq xmm0, qword [ebp - 0x2c]
movq qword [eax + 0x10], xmm0
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret
Function at 0x10122ec0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10179105
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x40
push ebx
push esi
push edi
lea eax, [ebp + 8]
mov dword [ebp - 4], 0
push eax
lea ecx, [ebp - 0x30]
call fcn.100918c0
mov byte [ebp - 4], 1
sub esp, 0x18
lea eax, [ebp - 0x30]
mov ecx, esp
push eax
call fcn.100918c0
lea eax, [ebp - 0x48]
push eax
call fcn.100e2db0
push eax
lea ecx, [ebp - 0x30]
call fcn.100917b0
mov ecx, dword [ebp - 0x34]
cmp ecx, 0xf
jbe 0x10122f49
mov edx, dword [ebp - 0x48]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x10122f3f
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x1012307d
push ecx
push edx
call fcn.101706c8
add esp, 8
cmp dword [ebp - 0x1c], 0xf
lea edi, [ebp - 0x30]
mov ebx, 0x811c9dc5
cmova edi, dword [ebp - 0x30]
xor edx, edx
mov ecx, edi
lea esi, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x10122f60
sub ecx, esi
je 0x10122f8f
nop dword [eax + eax]
movsx eax, byte [edi + edx]
xor eax, ebx
imul ebx, eax, 0x1000193
mov eax, edi
inc edx
lea esi, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x10122f82
sub eax, esi
cmp edx, eax
jb 0x10122f70
mov al, byte [0x10274478]
test al, al
jne 0x10122f9f
mov eax, 0x811c9dc5
jmp 0x10122fb7
movsx eax, al
mov ecx, 0x10274479
xor eax, 0x811c9dc5
imul edx, eax, 0x1000193
call fcn.100de6f0
cmp ebx, eax
je 0x10123002
cmp dword [ebp - 0x1c], 0xf
lea esi, [ebp - 0x30]
mov edi, dword [ebp - 0x20]
mov edx, 0x811c9dc5
cmova esi, dword [ebp - 0x30]
xor ecx, ecx
test edi, edi
je 0x10122fe5
movzx eax, byte [esi + ecx]
inc ecx
xor eax, edx
imul edx, eax, 0x1000193
cmp ecx, edi
jb 0x10122fd4
push edx
lea eax, [ebp - 0x30]
mov ecx, 0x102a6610
push eax
lea eax, [ebp - 0x18]
push eax
call fcn.100948e0
cmp dword [eax + 4], 0
je 0x10122ef5
lea eax, [ebp - 0x30]
mov ecx, 0x102a6610
push eax
call fcn.100e4550
mov ecx, dword [ebp - 0x1c]
mov esi, dword [eax]
mov edi, dword [eax + 4]
cmp ecx, 0xf
jbe 0x10123045
mov edx, dword [ebp - 0x30]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x1012303b
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x1012307d
push ecx
push edx
call fcn.101706c8
add esp, 8
mov ecx, dword [ebp + 0x1c]
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x1c], 0xf
mov byte [ebp - 0x30], 0
cmp ecx, 0xf
jbe 0x1012308d
mov edx, dword [ebp + 8]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x10123083
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x10123083
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push ecx
push edx
call fcn.101706c8
add esp, 8
mov ecx, dword [ebp - 0xc]
mov edx, edi
pop edi
mov eax, esi
mov dword fs:[0], ecx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10123ce0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x101790b5
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x40
push ebx
push esi
push edi
mov dword [ebp - 0x10], ecx
lea eax, [ebp + 8]
mov dword [ebp - 4], 0
push eax
lea ecx, [ebp - 0x34]
call fcn.100918c0
mov byte [ebp - 4], 1
sub esp, 0x18
lea eax, [ebp - 0x34]
mov ecx, esp
push eax
call fcn.100918c0
lea eax, [ebp - 0x4c]
push eax
call fcn.100e2db0
push eax
lea ecx, [ebp - 0x34]
call fcn.100917b0
mov ecx, dword [ebp - 0x38]
cmp ecx, 0xf
jbe 0x10123d6c
mov edx, dword [ebp - 0x4c]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x10123d62
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x10123ea8
push ecx
push edx
call fcn.101706c8
add esp, 8
cmp dword [ebp - 0x20], 0xf
lea edi, [ebp - 0x34]
mov ebx, 0x811c9dc5
cmova edi, dword [ebp - 0x34]
xor edx, edx
mov ecx, edi
lea esi, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x10123d83
sub ecx, esi
je 0x10123daf
nop
movsx eax, byte [edi + edx]
xor eax, ebx
imul ebx, eax, 0x1000193
mov eax, edi
inc edx
lea esi, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x10123da2
sub eax, esi
cmp edx, eax
jb 0x10123d90
mov al, byte [0x10274478]
test al, al
jne 0x10123dbf
mov eax, 0x811c9dc5
jmp 0x10123dd7
movsx eax, al
mov ecx, 0x10274479
xor eax, 0x811c9dc5
imul edx, eax, 0x1000193
call fcn.100de6f0
cmp ebx, eax
mov ebx, dword [ebp - 0x10]
je 0x10123e2d
mov edi, dword [ebp - 0x24]
lea esi, [ebp - 0x34]
add ebx, 0x30
mov edx, 0x811c9dc5
cmp dword [ebp - 0x20], 0xf
cmova esi, dword [ebp - 0x34]
xor ecx, ecx
test edi, edi
je 0x10123e11
nop word [eax + eax]
movzx eax, byte [esi + ecx]
inc ecx
xor eax, edx
imul edx, eax, 0x1000193
cmp ecx, edi
jb 0x10123e00
push edx
lea eax, [ebp - 0x34]
mov ecx, ebx
push eax
lea eax, [ebp - 0x1c]
push eax
call fcn.100948e0
cmp dword [eax + 4], 0
je 0x10123d18
jmp 0x10123e30
add ebx, 0x30
lea eax, [ebp - 0x34]
mov ecx, ebx
push eax
call fcn.100e4610
mov ecx, dword [ebp - 0x20]
mov esi, dword [eax]
mov edi, dword [eax + 4]
cmp ecx, 0xf
jbe 0x10123e70
mov edx, dword [ebp - 0x34]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x10123e66
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x10123ea8
push ecx
push edx
call fcn.101706c8
add esp, 8
mov ecx, dword [ebp + 0x1c]
mov dword [ebp - 0x24], 0
mov dword [ebp - 0x20], 0xf
mov byte [ebp - 0x34], 0
cmp ecx, 0xf
jbe 0x10123eb8
mov edx, dword [ebp + 8]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x10123eae
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x10123eae
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push ecx
push edx
call fcn.101706c8
add esp, 8
mov ecx, dword [ebp - 0xc]
mov edx, edi
pop edi
mov eax, esi
mov dword fs:[0], ecx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x101267c0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
mov ebx, edx
mov edx, dword [ebp + 8]
push esi
push edi
mov edi, ecx
mov dword [ebp - 8], ebx
lea ecx, [edx - 1]
mov dword [ebp - 4], edi
mov dword [ebp - 0x14], ecx
mov eax, ebx
sar ecx, 1
mov dword [ebp - 0x10], ecx
cmp ebx, ecx
jge 0x10126842
lea esi, [eax + eax]
lea eax, [esi + 2]
lea eax, [eax + eax*8]
lea ecx, [edi + eax*4]
lea eax, [ecx - 0x24]
push eax
push ecx
call fcn.10125280
mov ecx, dword [ebp - 4]
inc esi
movzx eax, al
xor eax, 1
add eax, esi
mov dword [ebp - 0xc], eax
lea eax, [eax + eax*8]
lea edi, [edi + eax*4]
lea eax, [ebx + ebx*8]
lea esi, [ecx + eax*4]
push edi
mov ecx, esi
call fcn.100917b0
movq xmm0, qword [edi + 0x18]
mov ecx, dword [ebp - 0x10]
movq qword [esi + 0x18], xmm0
mov eax, dword [edi + 0x20]
mov edi, dword [ebp - 4]
mov dword [esi + 0x20], eax
mov eax, dword [ebp - 0xc]
mov ebx, eax
cmp eax, ecx
jl 0x101267e7
mov edx, dword [ebp + 8]
cmp eax, ecx
jne 0x10126878
test dl, 1
jne 0x10126878
mov ecx, dword [ebp - 4]
lea eax, [edx + edx*8]
lea edi, [edi + eax*4]
lea eax, [ebx + ebx*8]
add edi, 0xffffffdc
push edi
lea esi, [ecx + eax*4]
mov ecx, esi
call fcn.100917b0
movq xmm0, qword [edi + 0x18]
mov ebx, dword [ebp - 0x14]
movq qword [esi + 0x18], xmm0
mov eax, dword [edi + 0x20]
mov dword [esi + 0x20], eax
cmp dword [ebp - 8], ebx
jge 0x101268c6
nop dword [eax]
mov edi, dword [ebp - 4]
lea esi, [ebx - 1]
push dword [ebp + 0xc]
sar esi, 1
lea eax, [esi + esi*8]
lea eax, [edi + eax*4]
push eax
mov dword [ebp + 8], eax
call fcn.10125280
test al, al
je 0x101268c6
lea eax, [ebx + ebx*8]
mov ebx, dword [ebp + 8]
lea edi, [edi + eax*4]
push ebx
mov ecx, edi
call fcn.100917b0
movq xmm0, qword [ebx + 0x18]
movq qword [edi + 0x18], xmm0
mov eax, dword [ebx + 0x20]
mov ebx, esi
mov dword [edi + 0x20], eax
cmp dword [ebp - 8], esi
jl 0x10126880
mov ecx, dword [ebp - 4]
lea eax, [ebx + ebx*8]
mov ebx, dword [ebp + 0xc]
push ebx
lea esi, [ecx + eax*4]
mov ecx, esi
call fcn.100917b0
movq xmm0, qword [ebx + 0x18]
movq qword [esi + 0x18], xmm0
mov eax, dword [ebx + 0x20]
pop edi
mov dword [esi + 0x20], eax
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10126ad0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
mov ebx, edx
mov edx, dword [ebp + 8]
push esi
push edi
mov edi, ecx
mov dword [ebp - 8], ebx
lea ecx, [edx - 1]
mov dword [ebp - 4], edi
mov dword [ebp - 0x14], ecx
mov eax, ebx
sar ecx, 1
mov dword [ebp - 0x10], ecx
cmp ebx, ecx
jge 0x10126b77
nop dword [eax + eax]
lea esi, [eax + eax]
lea ecx, [esi + 2]
lea eax, [ecx*8]
sub eax, ecx
lea ecx, [edi + eax*8]
lea eax, [ecx - 0x38]
push eax
push ecx
call fcn.10126040
movzx eax, al
lea ecx, [esi + 1]
xor eax, 1
add ecx, eax
mov dword [ebp - 0xc], ecx
lea eax, [ecx*8]
sub eax, ecx
mov ecx, dword [ebp - 4]
lea edi, [edi + eax*8]
lea eax, [ebx*8]
sub eax, ebx
push edi
lea esi, [ecx + eax*8]
mov ecx, esi
call fcn.100917b0
mov eax, dword [edi + 0x18]
lea ecx, [esi + 0x1c]
mov dword [esi + 0x18], eax
lea eax, [edi + 0x1c]
push eax
call fcn.100917b0
mov al, byte [edi + 0x34]
mov ecx, dword [ebp - 0x10]
mov edi, dword [ebp - 4]
mov byte [esi + 0x34], al
mov eax, dword [ebp - 0xc]
mov ebx, eax
cmp eax, ecx
jl 0x10126b00
mov edx, dword [ebp + 8]
cmp eax, ecx
jne 0x10126bc1
test dl, 1
jne 0x10126bc1
mov ecx, dword [ebp - 4]
lea eax, [edx*8]
sub eax, edx
lea edi, [edi + eax*8]
lea eax, [ebx*8]
add edi, 0xffffffc8
sub eax, ebx
push edi
lea esi, [ecx + eax*8]
mov ecx, esi
call fcn.100917b0
mov eax, dword [edi + 0x18]
lea ecx, [esi + 0x1c]
mov dword [esi + 0x18], eax
lea eax, [edi + 0x1c]
push eax
call fcn.100917b0
mov al, byte [edi + 0x34]
mov ebx, dword [ebp - 0x14]
mov byte [esi + 0x34], al
cmp dword [ebp - 8], ebx
jge 0x10126c20
mov edi, dword [ebp - 4]
lea esi, [ebx - 1]
push dword [ebp + 0xc]
sar esi, 1
lea eax, [esi*8]
sub eax, esi
lea eax, [edi + eax*8]
push eax
mov dword [ebp + 8], eax
call fcn.10126040
test al, al
je 0x10126c20
lea eax, [ebx*8]
sub eax, ebx
mov ebx, dword [ebp + 8]
push ebx
lea edi, [edi + eax*8]
mov ecx, edi
call fcn.100917b0
mov eax, dword [ebx + 0x18]
lea ecx, [edi + 0x1c]
mov dword [edi + 0x18], eax
lea eax, [ebx + 0x1c]
push eax
call fcn.100917b0
mov al, byte [ebx + 0x34]
mov ebx, esi
mov byte [edi + 0x34], al
cmp dword [ebp - 8], esi
jl 0x10126bc6
mov ecx, dword [ebp - 4]
lea eax, [ebx*8]
sub eax, ebx
mov ebx, dword [ebp + 0xc]
push ebx
lea esi, [ecx + eax*8]
mov ecx, esi
call fcn.100917b0
mov eax, dword [ebx + 0x18]
lea ecx, [esi + 0x1c]
mov dword [esi + 0x18], eax
lea eax, [ebx + 0x1c]
push eax
call fcn.100917b0
mov al, byte [ebx + 0x34]
pop edi
mov byte [esi + 0x34], al
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10127280
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x101791ad
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x14
push ebx
push esi
push edi
mov dword [ebp - 4], 0
mov edx, dword [ebp + 0x1c]
test edx, edx
jne 0x101272b3
mov esi, dword [ebp + 0xc]
xor bl, bl
jmp 0x10127321
cmp dword [ebp + 0x20], 0xf
lea ebx, [ebp + 0xc]
mov esi, dword [ebp + 0xc]
lea eax, [ecx + 0x48]
cmova ebx, esi
mov dword [ebp - 0x14], eax
xor ecx, ecx
mov edi, 0x811c9dc5
test edx, edx
je 0x101272e5
movzx eax, byte [ebx + ecx]
inc ecx
xor eax, edi
imul edi, eax, 0x1000193
cmp ecx, edx
jb 0x101272d1
mov eax, dword [ebp - 0x14]
push edi
lea ecx, [ebp + 0xc]
push ecx
lea ecx, [ebp - 0x1c]
push ecx
mov ecx, eax
call fcn.100948e0
cmp dword [eax + 4], 0
je 0x1012731f
mov ecx, dword [ebp - 0x14]
lea eax, [ebp + 0xc]
push eax
call fcn.1011ce90
mov ecx, dword [ebp + 8]
mov bl, 1
mov esi, dword [ebp + 0xc]
movq xmm0, qword [eax]
movq qword [ecx], xmm0
mov eax, dword [eax + 8]
mov dword [ecx + 8], eax
jmp 0x10127321
xor bl, bl
mov eax, dword [ebp + 0x20]
cmp eax, 0xf
jbe 0x10127356
lea ecx, [eax + 1]
mov eax, esi
cmp ecx, 0x1000
jb 0x1012734c
mov esi, dword [eax - 4]
add ecx, 0x23
sub eax, esi
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x1012734c
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push ecx
push esi
call fcn.101706c8
add esp, 8
mov ecx, dword [ebp - 0xc]
mov al, bl
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret 0x1c