joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10001860
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
cmp dword [0x10248378], 0
je 0x10001879
mov eax, dword [0x10248378]
jmp 0x10001a16
mov dword [0x10248378], 0x10248350
push 0x28
push 0
push 0x10248350
call sub.VCRUNTIME140D.dll_memset
add esp, 0xc
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov dword [0x10248350], eax
push str.imagehlp.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov dword [0x10248354], eax
cmp dword [0x10248354], 0
jne 0x100018bf
xor eax, eax
jmp 0x10001a16
push str.ImagehlpApiVersionEx
mov eax, dword [0x10248354]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x10248358], eax
push str.SymInitialize
mov ecx, dword [0x10248354]
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x1024835c], eax
push str.SymSetOptions
mov edx, dword [0x10248354]
push edx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x10248360], eax
push str.SymGetOptions
mov eax, dword [0x10248354]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x10248364], eax
push str.SymLoadModule
mov ecx, dword [0x10248354]
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x10248368], eax
push str.SymGetModuleInfo
mov edx, dword [0x10248354]
push edx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x1024836c], eax
push str.SymGetSymFromName
mov eax, dword [0x10248354]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x10248370], eax
push str.BindImage
mov ecx, dword [0x10248354]
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x10248374], eax
push 8
push 0
lea edx, [ebp - 8]
push edx
call sub.VCRUNTIME140D.dll_memset
add esp, 0xc
mov word [ebp - 8], 9
cmp dword [0x10248358], 0
je 0x1000199d
lea eax, [ebp - 8]
push eax
call dword [0x10248358]
cmp dword [0x10248358], 0
je 0x100019af
movzx ecx, word [ebp - 8]
cmp ecx, 9
jge 0x100019ca
mov edx, dword [0x10248354]
push edx
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov dword [0x10248354], 0
xor eax, eax
jmp 0x10001a16
cmp dword [0x1024835c], 0
je 0x100019e3
push 0
push 0
mov eax, dword [0x10248350]
push eax
call dword [0x1024835c]
cmp dword [0x10248364], 0
je 0x10001a11
cmp dword [0x10248360], 0
je 0x10001a11
call dword [0x10248364]
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp - 0xc]
and ecx, 7
mov dword [ebp - 0xc], ecx
mov edx, dword [ebp - 0xc]
push edx
call dword [0x10248360]
mov eax, dword [0x10248378]
mov esp, ebp
pop ebp
ret
Function at 0x10002190
Capabilities:
Enumerate pe sections
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x101ac2c0
push 0x10193488
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
add esp, 0xffffffd0
push ebx
push esi
push edi
mov dword [ebp - 0x18], esp
mov eax, dword [ebp + 8]
mov dword [ebp - 0x1c], eax
cmp dword [ebp + 8], 0
jne 0x100021cd
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov dword [ebp - 0x1c], eax
mov dword [ebp - 4], 0
mov ecx, dword [ebp - 0x1c]
movzx edx, word [ecx]
cmp edx, 0x5a4d
je 0x10002203
push 0xc1
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov dword [ebp - 0x34], 0
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x34]
jmp 0x10002361
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x1c]
add ecx, dword [eax + 0x3c]
mov dword [ebp - 0x24], ecx
mov edx, dword [ebp - 0x24]
cmp dword [edx], 0x4550
je 0x1000223b
push 0xbf
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov dword [ebp - 0x38], 0
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x38]
jmp 0x10002361
mov eax, dword [ebp - 0x24]
movzx ecx, word [eax + 0x14]
test ecx, ecx
jne 0x10002267
push 0xc0
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov dword [ebp - 0x3c], 0
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x3c]
jmp 0x10002361
mov edx, dword [ebp - 0x24]
movzx eax, word [edx + 0x14]
mov ecx, dword [ebp - 0x24]
lea edx, [ecx + eax + 0x18]
mov dword [ebp - 0x20], edx
mov dword [ebp - 0x28], 0
jmp 0x1000228a
mov eax, dword [ebp - 0x28]
add eax, 1
mov dword [ebp - 0x28], eax
mov ecx, dword [ebp - 0x24]
movzx edx, word [ecx + 6]
cmp dword [ebp - 0x28], edx
jae 0x1000233b
push str..detour
mov eax, dword [ebp - 0x28]
imul eax, eax, 0x28
mov ecx, dword [ebp - 0x20]
add ecx, eax
push ecx
call sub.ucrtbased.dll_strcmp
add esp, 8
test eax, eax
jne 0x10002336
mov edx, dword [ebp - 0x28]
imul edx, edx, 0x28
mov eax, dword [ebp - 0x20]
cmp dword [eax + edx + 0xc], 0
je 0x100022d7
mov ecx, dword [ebp - 0x28]
imul ecx, ecx, 0x28
mov edx, dword [ebp - 0x20]
cmp dword [edx + ecx + 0x10], 0
jne 0x100022d9
jmp 0x1000233b
mov eax, dword [ebp - 0x28]
imul eax, eax, 0x28
mov ecx, dword [ebp - 0x20]
mov edx, dword [ebp - 0x1c]
add edx, dword [ecx + eax + 0xc]
mov dword [ebp - 0x30], edx
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x2c], eax
mov ecx, dword [ebp - 0x2c]
cmp dword [ecx], 0x30
jb 0x10002306
mov edx, dword [ebp - 0x2c]
cmp dword [edx + 4], 0x727444
je 0x10002308
jmp 0x1000233b
mov eax, dword [ebp - 0x2c]
cmp dword [eax + 8], 0
jne 0x1000231c
mov ecx, dword [ebp - 0x2c]
mov edx, dword [ebp - 0x2c]
mov eax, dword [edx]
mov dword [ecx + 8], eax
push 0
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov ecx, dword [ebp - 0x2c]
mov dword [ebp - 0x40], ecx
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x40]
jmp 0x10002361
jmp 0x10002281
mov dword [ebp - 4], 0xffffffff
jmp 0x10002354
push 0xc0
call dword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x100447d0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x102480b4]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, ecx
mov ecx, 0x1028aaee
call fcn.10193940
cmp dword [esi + 0x38], 0
je 0x10044898
cmp byte [esi + 0x3d], 0
je 0x10044898
mov eax, dword [esi]
mov ecx, esi
push edi
push 0xffffffffffffffff
call dword [eax + 0xc]
cmp eax, 0xffffffff
je 0x10044886
mov ecx, dword [esi + 0x38]
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [esi + 0x40]
push eax
call dword [sym.imp.MSVCP140D.dll_public:_int___thiscall_std::codecvt_char__char__struct__Mbstatet_::unshift_struct__Mbstatet___char___char___char___const]
sub eax, 0
je 0x1004484d
sub eax, 1
je 0x10044851
sub eax, 2
jne 0x10044886
mov byte [esi + 0x3d], al
mov al, 1
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.101912d0
mov esp, ebp
pop ebp
ret
mov byte [esi + 0x3d], 0
mov edi, dword [ebp - 0x28]
lea eax, [ebp - 0x24]
sub edi, eax
je 0x1004486f
push dword [esi + 0x4c]
push edi
push 1
push eax
call dword [sym.imp.ucrtbased.dll_fwrite]
add esp, 0x10
cmp edi, eax
jne 0x10044886
cmp byte [esi + 0x3d], 0
pop edi
sete al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.101912d0
mov esp, ebp
pop ebp
ret
pop edi
xor al, al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.101912d0
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
mov al, 1
xor ecx, ebp
pop esi
call fcn.101912d0
mov esp, ebp
pop ebp
ret
Function at 0x10048340
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10194fbf
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push esi
push edi
mov eax, dword [0x102480b4]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, edx
mov dword [ebp - 0x10], ecx
mov ecx, 0x1028aac6
call fcn.10193940
push 0x42c
call fcn.10191600
mov ebx, eax
add esp, 4
mov dword [ebp - 0x18], ebx
mov dword [ebp - 4], 0
xorps xmm0, xmm0
movq qword [ebx], xmm0
mov dword [ebx + 8], 0
mov dword [ebx + 4], 1
mov dword [ebx + 8], 1
mov byte [ebp - 4], 1
lea edi, [ebx + 0xc]
mov dword [ebx], 0x101aec38
mov ecx, edi
mov eax, dword [esi]
push eax
mov dword [edi + 0xc], 0
mov dword [edi + 0x2c], 0
mov dword [edi + 0x30], 0
mov dword [edi + 0x34], 0
mov dword [edi + 0x38], 0
mov dword [edi + 0x3c], 0
mov dword [edi + 0x40], 0
mov dword [edi + 0x44], 0
mov dword [edi + 0x48], 0
mov dword [edi + 0x4c], 0
mov dword [edi + 0x50], 0
mov dword [edi + 0x54], 0
mov dword [edi + 0x58], 0
mov dword [edi + 0x5c], 0
mov dword [edi + 0x60], 0
mov dword [edi + 0x64], 0
mov dword [edi + 0x68], 0
mov dword [edi + 0x6c], 0
mov dword [edi + 0x70], 0
mov dword [edi + 0x74], 0
mov dword [edi + 0x78], 0
mov dword [edi + 0x7c], 0
mov dword [edi + 0x80], 0
mov dword [edi + 0x3cc], 0
mov dword [edi + 0x3d0], 0
mov dword [edi + 0x3d4], 0
mov byte [edi + 0x3d8], 0
mov dword [edi + 0x3dc], 0
mov word [edi + 0x3e0], 0
mov dword [edi + 0x3e4], 0
mov dword [edi + 0x3e8], 0
mov dword [edi + 0x3ec], 0
mov dword [edi + 0x3f0], 0
mov dword [edi + 0x3f4], 0
mov dword [edi + 0x3f8], 0
mov word [edi + 0x408], 0
call fcn.10033a50
mov eax, dword [ebp - 0x10]
xorps xmm0, xmm0
movq qword [eax], xmm0
mov dword [eax + 4], 0
mov dword [eax], edi
mov dword [eax + 4], ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10063d70
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov ecx, 0x1028ab99
push ebx
push esi
push edi
call fcn.10193940
cmp byte [0x1027cbd0], 0
je 0x10063f01
mov ecx, dword [0x10264840]
mov eax, dword [ecx]
mov eax, dword [eax + 0x68]
call eax
test al, al
je 0x10063f01
mov ecx, dword [0x102648c4]
xor ebx, ebx
mov dword [ebp - 4], ecx
mov eax, dword [ecx + 0x28]
mov dword [ebp - 8], eax
test eax, eax
je 0x10063f01
nop
mov eax, dword [ecx + 0x1c]
mov ecx, dword [eax + ebx*4]
mov eax, dword [ecx]
mov eax, dword [eax + 0x30]
call eax
mov esi, eax
mov edi, 0x811c9dc5
xor ecx, ecx
inc ecx
cmp byte [ecx + esi], 0
jne 0x10063dd6
xor edx, edx
test ecx, ecx
je 0x10063dfc
movsx eax, byte [edx + esi]
inc edx
xor eax, edi
imul edi, eax, 0x1000193
cmp edx, ecx
jb 0x10063de3
cmp edi, 0x5ff56dc5
je 0x10063e0b
inc ebx
cmp ebx, dword [ebp - 8]
jae 0x10063f01
mov ecx, dword [ebp - 4]
jmp 0x10063dc0
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x1c]
mov edi, dword [eax + ebx*4]
test edi, edi
je 0x10063f01
mov edx, dword [edi + 0x88]
test edx, edx
je 0x10063f01
movss xmm1, dword [0x10232260]
xor ebx, ebx
cmp edx, 4
jl 0x10063ece
mov ecx, dword [edi + 0x7c]
lea esi, [edx - 4]
shr esi, 2
add ecx, 0x1078
inc esi
lea ebx, [esi*4]
movss xmm0, dword [ecx - 0xc60]
ucomiss xmm0, xmm1
lahf
test ah, 0x44
jp 0x10063e6f
mov dword [ecx - 0xc60], 0x7f7fffff
movss xmm0, dword [ecx - 0x840]
ucomiss xmm0, xmm1
lahf
test ah, 0x44
jp 0x10063e8a
mov dword [ecx - 0x840], 0x7f7fffff
movss xmm0, dword [ecx - 0x420]
ucomiss xmm0, xmm1
lahf
test ah, 0x44
jp 0x10063ea5
mov dword [ecx - 0x420], 0x7f7fffff
movss xmm0, dword [ecx]
ucomiss xmm0, xmm1
lahf
test ah, 0x44
jp 0x10063eb8
mov dword [ecx], 0x7f7fffff
add ecx, 0x1080
sub esi, 1
jne 0x10063e54
cmp ebx, edx
jl 0x10063ed2
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
test edx, edx
jle 0x10063f01
imul ecx, ebx, 0x420
add ecx, 0x418
add ecx, dword [edi + 0x7c]
sub edx, ebx
movss xmm0, dword [ecx]
ucomiss xmm0, xmm1
lahf
test ah, 0x44
jp 0x10063ef6
mov dword [ecx], 0x7f7fffff
add ecx, 0x420
sub edx, 1
jne 0x10063ee3
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1006e740
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, ecx
push edi
call fcn.10072e20
lea eax, [edi + 0x10]
push eax
lea ecx, [esi + 0x10]
call fcn.10072e20
lea eax, [edi + 0x20]
lea ebx, [esi + 0x20]
cmp ebx, eax
je 0x1006e780
mov ecx, ebx
call fcn.1002f6d0
lea eax, [edi + 0x24]
push eax
lea ecx, [ebx + 4]
call fcn.10072e20
mov eax, dword [edi + 0x34]
mov dword [ebx + 0x14], eax
mov eax, dword [edi + 0x38]
lea ebx, [esi + 0x60]
mov dword [esi + 0x38], eax
mov eax, dword [edi + 0x3c]
mov dword [esi + 0x3c], eax
mov eax, dword [edi + 0x40]
mov dword [esi + 0x40], eax
mov eax, dword [edi + 0x44]
mov dword [esi + 0x44], eax
movzx eax, byte [edi + 0x48]
mov byte [esi + 0x48], al
mov eax, dword [edi + 0x4c]
mov dword [esi + 0x4c], eax
movzx eax, byte [edi + 0x50]
mov byte [esi + 0x50], al
mov eax, dword [edi + 0x54]
mov dword [esi + 0x54], eax
movzx eax, byte [edi + 0x58]
mov byte [esi + 0x58], al
mov eax, dword [edi + 0x5c]
mov dword [esi + 0x5c], eax
lea eax, [edi + 0x60]
cmp ebx, eax
je 0x1006e7e2
mov ecx, ebx
call fcn.1002f6d0
lea eax, [edi + 0x64]
push eax
lea ecx, [ebx + 4]
call fcn.10072e20
mov eax, dword [edi + 0x74]
mov dword [ebx + 0x14], eax
lea eax, [edi + 0x78]
lea ebx, [esi + 0x78]
cmp ebx, eax
je 0x1006e808
mov ecx, ebx
call fcn.1002f6d0
lea eax, [edi + 0x7c]
push eax
lea ecx, [ebx + 4]
call fcn.10072e20
mov eax, dword [edi + 0x8c]
mov dword [ebx + 0x14], eax
mov eax, dword [edi + 0x90]
lea ecx, [esi + 0x94]
add edi, 0x94
mov dword [esi + 0x90], eax
cmp ecx, edi
je 0x1006e838
cmp dword [edi + 0x18], 0x10
lea eax, [edi + 4]
jb 0x1006e82f
mov eax, dword [eax]
push dword [edi + 0x14]
push eax
call fcn.100425a0
pop edi
mov eax, esi
pop esi
pop ebx
pop ebp
ret 4
Function at 0x10072590
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10197345
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push ebx
push esi
push edi
mov eax, dword [0x102480b4]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
mov ecx, 0x1028aaf0
call fcn.10193940
movzx eax, byte [esi]
xor eax, 0x811c9dc5
imul ecx, eax, 0x1000193
movzx eax, byte [esi + 1]
xor ecx, eax
movzx eax, byte [esi + 2]
imul ecx, ecx, 0x1000193
xor ecx, eax
movzx eax, byte [esi + 3]
imul ecx, ecx, 0x1000193
xor ecx, eax
lea eax, [ebp - 0x14]
imul edi, ecx, 0x1000193
push edi
push esi
push eax
call fcn.1007ab50
mov eax, dword [ebp - 0x10]
test eax, eax
jne 0x100726c5
cmp dword [0x1027d644], 0xfffffff
jne 0x10072624
push str.unordered_map_set_too_long
call dword [sym.imp.MSVCP140D.dll_void___cdecl_std::_Xlength_error_char_const__]
mov dword [ebp - 0x1c], 0x1027d63c
mov dword [ebp - 4], 0
push 0x10
mov dword [ebp - 0x18], 0
call fcn.10191600
mov ebx, eax
add esp, 4
mov eax, dword [esi]
mov dword [ebp - 0x18], ebx
mov dword [ebx + 8], eax
mov dword [ebx + 0xc], 0
mov dword [ebp - 4], 1
mov eax, dword [0x1027d644]
inc eax
movd xmm0, eax
cvtdq2pd xmm0, xmm0
shr eax, 0x1f
addsd xmm0, qword [eax*8 + 0x10232500]
mov eax, dword [0x1027d65c]
cvtpd2ps xmm1, xmm0
movd xmm0, eax
cvtdq2pd xmm0, xmm0
shr eax, 0x1f
addsd xmm0, qword [eax*8 + 0x10232500]
cvtpd2ps xmm0, xmm0
divss xmm1, xmm0
comiss xmm1, dword [0x1027d638]
jbe 0x100726ba
call fcn.100799e0
push edi
lea eax, [ebx + 8]
push eax
lea eax, [ebp - 0x1c]
push eax
call fcn.1007ab50
mov ecx, dword [eax]
jmp 0x100726bd
mov ecx, dword [ebp - 0x14]
push ebx
push ecx
push edi
call fcn.10079b00
add eax, 0xc
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x10079d50
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov ecx, 0x1028aaef
push ebx
push esi
push edi
call fcn.10193940
mov eax, 0x1fffffff
mov edi, 1
bsr ecx, eax
mov eax, edi
shl eax, cl
mov ecx, dword [ebp + 8]
cmp ecx, eax
jbe 0x10079d86
push str.invalid_hash_bucket_count
call dword [sym.imp.MSVCP140D.dll_void___cdecl_std::_Xlength_error_char_const__]
lea eax, [ecx - 1]
mov esi, dword [0x1027d640]
or eax, 1
mov dword [ebp - 8], esi
bsr ecx, eax
push esi
lea ecx, [ecx + 1]
shl edi, cl
mov ecx, 0x1027d648
lea eax, [edi + edi]
push eax
call fcn.10075af0
mov eax, dword [0x1027d640]
lea ebx, [edi - 1]
mov dword [0x1027d658], ebx
mov dword [0x1027d65c], edi
mov eax, dword [eax]
mov ecx, eax
cmp eax, esi
je 0x10079ec4
nop dword [eax]
movzx edx, byte [eax + 8]
xor edx, 0x811c9dc5
mov ecx, dword [ecx]
imul edi, edx, 0x1000193
movzx edx, byte [eax + 9]
xor edi, edx
movzx edx, byte [eax + 0xa]
imul edi, edi, 0x1000193
xor edi, edx
movzx edx, byte [eax + 0xb]
imul edi, edi, 0x1000193
xor edi, edx
mov edx, dword [0x1027d64c]
imul edi, edi, 0x1000193
and edi, ebx
mov ebx, dword [edx + edi*8]
lea edx, [edx + edi*8]
mov dword [ebp - 0xc], edx
cmp ebx, esi
jne 0x10079e22
mov dword [edx], eax
mov dword [edx + 4], eax
jmp 0x10079e8f
mov edx, dword [edx + 4]
mov edi, dword [eax + 8]
cmp edi, dword [edx + 8]
jne 0x10079e5c
mov edx, dword [edx]
mov dword [ebp - 4], edx
cmp edx, eax
je 0x10079e54
mov ebx, dword [eax + 4]
mov esi, dword [ebp - 4]
mov dword [ebx], ecx
mov edi, dword [ecx + 4]
mov dword [edi], edx
mov edx, dword [edx + 4]
mov dword [edx], eax
mov dword [esi + 4], edi
mov esi, dword [ebp - 8]
mov dword [ecx + 4], ebx
mov dword [eax + 4], edx
mov edx, dword [ebp - 0xc]
mov dword [edx + 4], eax
jmp 0x10079e8f
cmp ebx, edx
je 0x10079e6c
mov edx, dword [edx + 4]
cmp edi, dword [edx + 8]
je 0x10079ea0
cmp ebx, edx
jne 0x10079e60
mov ebx, dword [eax + 4]
mov dword [ebp - 4], ebx
mov dword [ebx], ecx
mov ebx, dword [ecx + 4]
mov dword [ebx], edx
mov edi, dword [edx + 4]
mov dword [edi], eax
mov dword [edx + 4], ebx
mov edx, dword [ebp - 4]
mov dword [ecx + 4], edx
mov edx, dword [ebp - 0xc]
mov dword [eax + 4], edi
mov dword [edx], eax
mov eax, ecx
cmp ecx, esi
je 0x10079ec4
mov ebx, dword [0x1027d658]
jmp 0x10079dd0
mov ebx, dword [eax + 4]
mov edx, dword [edx]
mov dword [ebp - 4], edx
mov esi, edx
mov dword [ebx], ecx
mov edi, dword [ecx + 4]
mov dword [edi], edx
mov edx, dword [edx + 4]
mov dword [edx], eax
mov dword [esi + 4], edi
mov esi, dword [ebp - 8]
mov dword [ecx + 4], ebx
mov dword [eax + 4], edx
jmp 0x10079e8f
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x1009e640
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [0x102480b4]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov ebx, ecx
mov ecx, 0x1028ab43
push edi
call fcn.10193940
mov edi, dword fs:[0x30]
test edi, edi
jne 0x1009e67d
xor al, al
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.101912d0
mov esp, ebp
pop ebp
ret
mov edi, dword [edi + 0xc]
add edi, 0x14
mov esi, dword [edi]
cmp esi, edi
je 0x1009e6d1
mov ecx, 0x5a4d
nop
lea edx, [esi - 8]
test edx, edx
je 0x1009e6cb
mov eax, dword [edx + 0x18]
test eax, eax
je 0x1009e6cb
cmp word [eax], cx
jne 0x1009e6cb
mov ecx, dword [eax + 0x3c]
add ecx, eax
je 0x1009e6c6
cmp dword [ecx], 0x4550
jne 0x1009e6c6
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0x10]
mov dword [ebp - 8], ecx
mov ecx, ebx
push eax
mov dword [ebp - 0x10], edx
call fcn.100a6710
mov ecx, 0x5a4d
mov esi, dword [esi]
cmp esi, edi
jne 0x1009e690
mov eax, dword [ebx + 4]
cmp eax, dword [ebx + 8]
mov ecx, dword [ebp - 4]
pop edi
setne al
xor ecx, ebp
pop esi
pop ebx
call fcn.101912d0
mov esp, ebp
pop ebp
ret
Function at 0x100a0000
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
mov ebx, ecx
mov dword [ebp - 4], edx
push edi
mov ecx, 0x1028ab43
mov dword [ebp - 8], ebx
call fcn.10193940
mov eax, dword [ebp + 8]
cmp dword [eax + 0x18], 0x10
lea esi, [eax + 4]
mov edi, dword [eax + 0x14]
jb 0x100a002c
mov esi, dword [esi]
xor ecx, ecx
mov edx, 0x811c9dc5
test edi, edi
je 0x100a0048
movzx eax, byte [ecx + esi]
inc ecx
xor eax, edx
imul edx, eax, 0x1000193
cmp ecx, edi
jb 0x100a0037
push edx
mov edx, dword [ebp - 4]
mov ecx, ebx
call fcn.1009f300
add esp, 4
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x100a6560
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1019ae35
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push ebx
push esi
push edi
mov eax, dword [0x102480b4]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
mov ecx, 0x1028aaf0
call fcn.10193940
movzx eax, byte [esi]
xor eax, 0x811c9dc5
imul ecx, eax, 0x1000193
movzx eax, byte [esi + 1]
xor ecx, eax
movzx eax, byte [esi + 2]
imul ecx, ecx, 0x1000193
xor ecx, eax
movzx eax, byte [esi + 3]
imul ecx, ecx, 0x1000193
xor ecx, eax
lea eax, [ebp - 0x14]
imul edi, ecx, 0x1000193
push edi
push esi
push eax
call fcn.1007ab50
mov eax, dword [ebp - 0x10]
test eax, eax
jne 0x100a6695
cmp dword [0x1027d644], 0xfffffff
jne 0x100a65f4
push str.unordered_map_set_too_long
call dword [sym.imp.MSVCP140D.dll_void___cdecl_std::_Xlength_error_char_const__]
mov dword [ebp - 0x1c], 0x1027d63c
mov dword [ebp - 4], 0
push 0x10
mov dword [ebp - 0x18], 0
call fcn.10191600
mov ebx, eax
add esp, 4
mov eax, dword [esi]
mov dword [ebp - 0x18], ebx
mov dword [ebx + 8], eax
mov dword [ebx + 0xc], 0
mov dword [ebp - 4], 1
mov eax, dword [0x1027d644]
inc eax
movd xmm0, eax
cvtdq2pd xmm0, xmm0
shr eax, 0x1f
addsd xmm0, qword [eax*8 + 0x10232500]
mov eax, dword [0x1027d65c]
cvtpd2ps xmm1, xmm0
movd xmm0, eax
cvtdq2pd xmm0, xmm0
shr eax, 0x1f
addsd xmm0, qword [eax*8 + 0x10232500]
cvtpd2ps xmm0, xmm0
divss xmm1, xmm0
comiss xmm1, dword [0x1027d638]
jbe 0x100a668a
call fcn.100799e0
push edi
lea eax, [ebx + 8]
push eax
lea eax, [ebp - 0x1c]
push eax
call fcn.1007ab50
mov ecx, dword [eax]
jmp 0x100a668d
mov ecx, dword [ebp - 0x14]
push ebx
push ecx
push edi
call fcn.10079b00
add eax, 0xc
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x100adc00
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [0x102480b4]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov ebx, ecx
mov ecx, 0x1028ab43
push edi
call fcn.10193940
mov edi, dword fs:[0x30]
test edi, edi
jne 0x100adc3d
xor al, al
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.101912d0
mov esp, ebp
pop ebp
ret
mov edi, dword [edi + 0xc]
add edi, 0x14
mov esi, dword [edi]
cmp esi, edi
je 0x100adc91
mov ecx, 0x5a4d
nop
lea edx, [esi - 8]
test edx, edx
je 0x100adc8b
mov eax, dword [edx + 0x18]
test eax, eax
je 0x100adc8b
cmp word [eax], cx
jne 0x100adc8b
mov ecx, dword [eax + 0x3c]
add ecx, eax
je 0x100adc86
cmp dword [ecx], 0x4550
jne 0x100adc86
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0x10]
mov dword [ebp - 8], ecx
mov ecx, ebx
push eax
mov dword [ebp - 0x10], edx
call fcn.100a6710
mov ecx, 0x5a4d
mov esi, dword [esi]
cmp esi, edi
jne 0x100adc50
mov eax, dword [ebx + 4]
cmp eax, dword [ebx + 8]
mov ecx, dword [ebp - 4]
pop edi
setne al
xor ecx, ebp
pop esi
pop ebx
call fcn.101912d0
mov esp, ebp
pop ebp
ret
Function at 0x100af590
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
mov ebx, ecx
mov dword [ebp - 4], edx
push edi
mov ecx, 0x1028ab43
mov dword [ebp - 8], ebx
call fcn.10193940
mov eax, dword [ebp + 8]
cmp dword [eax + 0x18], 0x10
lea esi, [eax + 4]
mov edi, dword [eax + 0x14]
jb 0x100af5bc
mov esi, dword [esi]
xor ecx, ecx
mov edx, 0x811c9dc5
test edi, edi
je 0x100af5d8
movzx eax, byte [ecx + esi]
inc ecx
xor eax, edx
imul edx, eax, 0x1000193
cmp ecx, edi
jb 0x100af5c7
push edx
mov edx, dword [ebp - 4]
mov ecx, ebx
call fcn.100ae890
add esp, 4
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret