joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10003130
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
mov ebx, dword [ebp + 0xc]
movzx eax, bl
xor eax, 0x811c9dc5
imul edx, eax, 0x1000193
mov eax, ebx
shr eax, 8
movzx eax, al
push esi
push edi
xor edx, eax
mov edi, ecx
mov eax, ebx
imul ecx, edx, 0x1000193
shr eax, 0x10
movzx eax, al
shr ebx, 0x18
xor ecx, eax
imul eax, ecx, 0x1000193
lea ecx, [edi + 0x50]
xor eax, ebx
imul ebx, eax, 0x1000193
lea eax, [ebp + 0xc]
push ebx
push eax
lea eax, [ebp - 8]
push eax
call fcn.10001400
mov edx, dword [eax + 4]
test edx, edx
je 0x100031da
mov ecx, dword [edi + 0x68]
mov eax, dword [edi + 0x5c]
and ecx, ebx
lea ecx, [eax + ecx*8]
mov eax, dword [ecx]
cmp dword [ecx + 4], edx
jne 0x100031b7
cmp eax, edx
jne 0x100031af
mov eax, dword [edi + 0x54]
mov dword [ecx], eax
mov dword [ecx + 4], eax
jmp 0x100031bf
mov eax, dword [edx + 4]
mov dword [ecx + 4], eax
jmp 0x100031bf
cmp eax, edx
jne 0x100031bf
mov eax, dword [edx]
mov dword [ecx], eax
mov ecx, dword [edx]
dec dword [edi + 0x58]
mov eax, dword [edx + 4]
push 0xc
push edx
mov dword [eax], ecx
mov eax, dword [edx + 4]
mov dword [ecx + 4], eax
call fcn.10056ffd
add esp, 8
mov edx, dword [ebp + 8]
movzx eax, dl
xor eax, 0x811c9dc5
imul ecx, eax, 0x1000193
movzx eax, dh
xor ecx, eax
movzx eax, byte [ebp + 0xa]
imul ecx, ecx, 0x1000193
xor ecx, eax
movzx eax, byte [ebp + 0xb]
imul ecx, ecx, 0x1000193
xor ecx, eax
lea eax, [ebp + 8]
imul ebx, ecx, 0x1000193
lea ecx, [edi + 0x10]
push ebx
push eax
lea eax, [ebp - 8]
push eax
call fcn.10001390
mov ecx, dword [eax + 4]
test ecx, ecx
jne 0x10003229
mov ecx, dword [edi + 0x14]
cmp ecx, dword [edi + 0x14]
je 0x100032a6
mov eax, dword [ecx + 0x10]
cmp eax, 1
jne 0x100032a2
push ebx
lea eax, [ebp + 8]
push eax
lea eax, [ebp - 0x10]
push eax
lea ecx, [edi + 0x10]
call fcn.10001390
mov edx, dword [eax + 4]
test edx, edx
je 0x100032a6
mov ecx, dword [edi + 0x28]
mov eax, dword [edi + 0x1c]
and ecx, ebx
lea ecx, [eax + ecx*8]
mov eax, dword [ecx]
cmp dword [ecx + 4], edx
jne 0x10003276
cmp eax, edx
jne 0x1000326e
mov eax, dword [edi + 0x14]
mov dword [ecx], eax
mov dword [ecx + 4], eax
jmp 0x1000327e
mov eax, dword [edx + 4]
mov dword [ecx + 4], eax
jmp 0x1000327e
cmp eax, edx
jne 0x1000327e
mov eax, dword [edx]
mov dword [ecx], eax
mov ecx, dword [edx]
dec dword [edi + 0x18]
mov eax, dword [edx + 4]
push 0x14
push edx
mov dword [eax], ecx
mov eax, dword [edx + 4]
mov dword [ecx + 4], eax
call fcn.10056ffd
add esp, 8
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
dec eax
mov dword [ecx + 0x10], eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x100036d0
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push esi
mov esi, dword [ebp + 0xc]
mov edx, dword [esi + 4]
test edx, edx
jne 0x100036ed
mov edx, dword [ecx + 0xc]
lea eax, [edx + 1]
mov dword [ecx + 0xc], eax
mov dword [esi + 4], edx
lea esi, [ecx + 0x10]
movzx eax, dl
xor eax, 0x811c9dc5
mov dword [ebp + 0xc], edx
imul ecx, eax, 0x1000193
mov eax, edx
shr eax, 8
movzx eax, al
xor ecx, eax
mov eax, edx
shr eax, 0x10
imul ecx, ecx, 0x1000193
movzx eax, al
shr edx, 0x18
xor ecx, eax
imul eax, ecx, 0x1000193
mov ecx, esi
xor eax, edx
imul eax, eax, 0x1000193
push eax
lea eax, [ebp + 0xc]
push eax
lea eax, [ebp - 8]
push eax
call fcn.10001390
mov ecx, dword [eax + 4]
test ecx, ecx
je 0x10003759
cmp ecx, dword [esi + 4]
je 0x10003759
mov eax, dword [ebp + 8]
mov ecx, dword [ecx + 0xc]
pop esi
mov dword [eax], ecx
mov al, 1
mov esp, ebp
pop ebp
ret 8
xor al, al
pop esi
mov esp, ebp
pop ebp
ret 8

Function at 0x10003850
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100b0d15
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push ebx
push esi
push edi
mov eax, dword [0x10147364]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov ebx, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
movzx eax, byte [ebx]
xor eax, 0x811c9dc5
imul edx, eax, 0x1000193
movzx eax, byte [ebx + 1]
xor edx, eax
movzx eax, byte [ebx + 2]
imul ecx, edx, 0x1000193
xor ecx, eax
movzx eax, byte [ebx + 3]
imul ecx, ecx, 0x1000193
xor ecx, eax
imul eax, ecx, 0x1000193
mov ecx, edi
push eax
mov dword [ebp + 8], eax
lea eax, [ebp - 0x14]
push ebx
push eax
call fcn.10001400
mov eax, dword [ebp - 0x10]
test eax, eax
je 0x100038d2
mov dword [esi], eax
xor al, al
jmp 0x10003984
cmp dword [edi + 8], 0x15555555
je 0x100039a4
lea eax, [edi + 4]
mov dword [ebp - 0x1c], eax
push 0xc
mov dword [ebp - 4], 0
mov dword [ebp - 0x18], 0
call fcn.10056fcd
mov dword [ebp - 0x18], eax
add esp, 4
lea ecx, [eax + 8]
mov eax, dword [ebx]
mov dword [ebp + 0xc], ecx
mov dword [ecx], eax
mov eax, dword [edi + 8]
inc eax
mov dword [ebp - 4], 1
movd xmm0, eax
cvtdq2pd xmm0, xmm0
shr eax, 0x1f
addsd xmm0, qword [eax*8 + 0x100b77a0]
mov eax, dword [edi + 0x1c]
cvtpd2ps xmm1, xmm0
movd xmm0, eax
cvtdq2pd xmm0, xmm0
shr eax, 0x1f
addsd xmm0, qword [eax*8 + 0x100b77a0]
cvtpd2ps xmm0, xmm0
divss xmm1, xmm0
comiss xmm1, dword [edi]
jbe 0x1000396e
mov ecx, edi
call fcn.10002bf0
mov ebx, dword [ebp + 8]
lea eax, [ebp - 0x14]
push ebx
push dword [ebp + 0xc]
mov ecx, edi
push eax
call fcn.10001400
mov ecx, dword [eax]
jmp 0x10003974
mov ecx, dword [ebp - 0x14]
mov ebx, dword [ebp + 8]
push dword [ebp - 0x18]
push ecx
push ebx
mov ecx, edi
call fcn.10002b00
mov dword [esi], eax
mov al, 1
mov edx, 4
mov ecx, esi
mov byte [ecx + edx], al
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
push str.unordered_map_set_too_long
call fcn.10034905
int3
Function at 0x10006040
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100b0f03
mov eax, dword fs:[0]
push eax
sub esp, 8
push esi
push edi
mov eax, dword [0x10147364]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x10], edi
push 0x48
mov dword [edi + 4], 0
mov dword [edi + 8], 0
call fcn.10056fcd
mov dword [eax], eax
mov dword [eax + 4], eax
mov dword [edi + 4], eax
lea esi, [edi + 0x10]
mov dword [ebp - 4], 0
mov dword [ebp - 0x14], esi
mov dword [esi], 0
push 0x14
mov dword [esi + 4], 0
mov dword [esi + 8], 0
call fcn.10056fcd
add esp, 8
mov dword [eax], eax
mov dword [eax + 4], eax
mov dword [esi + 4], eax
lea ecx, [esi + 0xc]
mov dword [ecx], 0
mov dword [ecx + 4], 0
mov dword [ecx + 8], 0
mov dword [esi + 0x18], 7
mov dword [esi + 0x1c], 8
mov dword [esi], 0x3f800000
push dword [esi + 4]
mov byte [ebp - 4], 2
push 0x10
call fcn.10002570
lea esi, [edi + 0x30]
mov byte [ebp - 4], 3
mov dword [ebp - 0x14], esi
mov dword [esi], 0
push 0x1c
mov dword [esi + 4], 0
mov dword [esi + 8], 0
call fcn.10056fcd
add esp, 4
mov dword [eax], eax
mov dword [eax + 4], eax
mov dword [esi + 4], eax
lea ecx, [esi + 0xc]
mov dword [ecx], 0
mov dword [ecx + 4], 0
mov dword [ecx + 8], 0
mov dword [esi + 0x18], 7
mov dword [esi + 0x1c], 8
mov dword [esi], 0x3f800000
push dword [esi + 4]
mov byte [ebp - 4], 5
push 0x10
call fcn.10002480
lea esi, [edi + 0x50]
mov byte [ebp - 4], 6
mov dword [ebp - 0x14], esi
mov dword [esi], 0
push 0xc
mov dword [esi + 4], 0
mov dword [esi + 8], 0
call fcn.10056fcd
add esp, 4
mov dword [eax], eax
mov dword [eax + 4], eax
mov dword [esi + 4], eax
lea ecx, [esi + 0xc]
mov dword [ecx], 0
mov dword [ecx + 4], 0
mov dword [ecx + 8], 0
mov byte [ebp - 4], 8
mov dword [esi + 0x18], 7
mov dword [esi + 0x1c], 8
mov dword [esi], 0x3f800000
push dword [esi + 4]
push 0x10
call fcn.10002390
mov ecx, edi
mov byte [ebp - 4], 9
call fcn.10007d40
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x10006450
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100b0fd9
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x10147364]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x10], edi
mov ebx, dword [ebp + 8]
push 0x24
mov dword [ebp - 0x14], edi
mov eax, dword [ebx]
mov dword [edi], eax
mov dword [edi + 4], 0
mov dword [edi + 8], 0
call fcn.10056fcd
add esp, 4
mov dword [eax], eax
mov dword [eax + 4], eax
mov dword [edi + 4], eax
mov dword [ebp - 4], 0
mov dword [edi + 0xc], 0
mov dword [edi + 0x10], 0
mov dword [edi + 0x14], 0
push eax
push 0x10
lea ecx, [edi + 0xc]
mov byte [ebp - 4], 1
call fcn.10007170
mov ecx, dword [edi + 4]
mov eax, dword [ebx + 4]
mov dword [edi + 4], eax
mov eax, dword [ebx + 8]
mov dword [ebx + 4], ecx
mov ecx, dword [edi + 8]
mov dword [edi + 8], eax
mov eax, dword [ebx + 0xc]
mov dword [ebx + 8], ecx
mov ecx, dword [edi + 0xc]
mov dword [edi + 0xc], eax
mov eax, dword [ebx + 0x10]
mov dword [ebx + 0xc], ecx
mov ecx, dword [edi + 0x10]
mov dword [edi + 0x10], eax
mov eax, dword [ebx + 0x14]
mov dword [ebx + 0x10], ecx
mov ecx, dword [edi + 0x14]
mov dword [edi + 0x14], eax
mov eax, dword [ebx + 0x18]
mov dword [ebx + 0x14], ecx
mov dword [ebx + 0x18], 7
mov dword [edi + 0x18], eax
mov eax, dword [ebx + 0x1c]
mov dword [ebx + 0x1c], 8
mov dword [edi + 0x1c], eax
mov eax, dword [ebx + 0x20]
add edi, 0x20
push 0x30
mov dword [ebp - 4], 2
mov dword [ebp + 8], edi
mov dword [edi], eax
mov dword [edi + 4], 0
mov dword [edi + 8], 0
call fcn.10056fcd
add esp, 4
mov dword [eax], eax
mov dword [eax + 4], eax
mov dword [edi + 4], eax
mov dword [edi + 0xc], 0
mov dword [edi + 0x10], 0
mov dword [edi + 0x14], 0
push eax
push 0x10
lea ecx, [edi + 0xc]
mov byte [ebp - 4], 4
call fcn.10007080
mov ecx, dword [edi + 4]
mov eax, dword [ebx + 0x24]
mov dword [edi + 4], eax
mov eax, dword [ebx + 0x28]
mov dword [ebx + 0x24], ecx
mov ecx, dword [edi + 8]
mov dword [edi + 8], eax
mov dword [ebx + 0x28], ecx
mov ecx, dword [edi + 0xc]
mov eax, dword [ebx + 0x2c]
mov dword [edi + 0xc], eax
mov eax, dword [ebx + 0x30]
mov dword [ebx + 0x2c], ecx
mov ecx, dword [edi + 0x10]
mov dword [edi + 0x10], eax
mov eax, dword [ebx + 0x34]
mov dword [ebx + 0x30], ecx
mov ecx, dword [edi + 0x14]
mov dword [edi + 0x14], eax
mov eax, dword [ebx + 0x38]
mov dword [ebx + 0x34], ecx
mov dword [ebx + 0x38], 7
mov dword [edi + 0x18], eax
mov eax, dword [ebx + 0x3c]
mov dword [ebx + 0x3c], 8
mov dword [edi + 0x1c], eax
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x10007490
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
sub esp, 0x18
mov edx, dword [ebp + 8]
push ebx
mov ebx, ecx
cmp edx, eax
je 0x100075e6
mov eax, dword [ebx + 4]
mov dword [ebp - 0x10], eax
mov eax, dword [edx + 4]
mov dword [ebp - 4], eax
movzx eax, byte [edx + 8]
xor eax, 0x811c9dc5
imul ecx, eax, 0x1000193
movzx eax, byte [edx + 9]
push esi
push edi
mov edi, dword [ebx + 0xc]
mov esi, edx
xor ecx, eax
mov dword [ebp - 0x18], edi
movzx eax, byte [edx + 0xa]
imul ecx, ecx, 0x1000193
xor ecx, eax
movzx eax, byte [edx + 0xb]
imul ecx, ecx, 0x1000193
xor ecx, eax
mov eax, dword [ebx + 0x18]
imul ecx, ecx, 0x1000193
and eax, ecx
mov ecx, dword [edi + eax*8]
mov dword [ebp - 0xc], ecx
lea eax, [edi + eax*8]
mov dword [ebp - 8], eax
mov eax, dword [eax + 4]
mov dword [ebp - 0x14], eax
mov eax, esi
mov edi, esi
mov esi, dword [esi]
push 0x1c
push eax
call fcn.10056ffd
dec dword [ebx + 8]
add esp, 8
cmp edi, dword [ebp - 0x14]
je 0x10007549
mov eax, dword [ebp + 0xc]
cmp esi, eax
jne 0x10007507
mov ecx, dword [ebp - 0xc]
cmp ecx, dword [ebp + 8]
jne 0x100075dc
mov edx, dword [ebp - 8]
mov ecx, dword [ebp - 4]
pop edi
mov dword [edx], esi
mov dword [ecx], esi
mov dword [esi + 4], ecx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
mov ecx, dword [ebp - 0xc]
mov edx, dword [ebp - 8]
cmp ecx, dword [ebp + 8]
jne 0x1000755d
mov eax, dword [ebp - 0x10]
mov ecx, eax
mov dword [edx], eax
jmp 0x10007560
mov ecx, dword [ebp - 4]
mov eax, dword [ebp + 0xc]
mov dword [edx + 4], ecx
cmp esi, eax
je 0x100075dc
nop word [eax + eax]
movzx eax, byte [esi + 8]
xor eax, 0x811c9dc5
imul ecx, eax, 0x1000193
movzx eax, byte [esi + 9]
xor ecx, eax
movzx eax, byte [esi + 0xa]
imul ecx, ecx, 0x1000193
xor ecx, eax
movzx eax, byte [esi + 0xb]
imul ecx, ecx, 0x1000193
xor ecx, eax
imul eax, ecx, 0x1000193
mov ecx, dword [ebx + 0x18]
and ecx, eax
mov eax, dword [ebp - 0x18]
lea eax, [eax + ecx*8]
mov dword [ebp + 8], eax
mov eax, dword [eax + 4]
mov dword [ebp - 0x14], eax
mov eax, esi
mov edi, esi
mov esi, dword [esi]
push 0x1c
push eax
call fcn.10056ffd
dec dword [ebx + 8]
add esp, 8
mov eax, dword [ebp + 0xc]
cmp edi, dword [ebp - 0x14]
je 0x100075ed
cmp esi, eax
jne 0x100075b7
mov ecx, dword [ebp + 8]
mov dword [ecx], esi
mov ecx, dword [ebp - 4]
pop edi
mov dword [ecx], esi
mov dword [esi + 4], ecx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
mov ecx, dword [ebp + 8]
mov edx, dword [ebp - 0x10]
mov dword [ecx], edx
mov dword [ecx + 4], edx
cmp esi, eax
jne 0x10007570
mov ecx, dword [ebp - 4]
pop edi
mov dword [ecx], esi
mov dword [esi + 4], ecx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x10007620
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
sub esp, 0x18
mov edx, dword [ebp + 8]
push ebx
mov ebx, ecx
cmp edx, eax
je 0x10007776
mov eax, dword [ebx + 4]
mov dword [ebp - 0x10], eax
mov eax, dword [edx + 4]
mov dword [ebp - 4], eax
movzx eax, byte [edx + 8]
xor eax, 0x811c9dc5
imul ecx, eax, 0x1000193
movzx eax, byte [edx + 9]
push esi
push edi
mov edi, dword [ebx + 0xc]
mov esi, edx
xor ecx, eax
mov dword [ebp - 0x18], edi
movzx eax, byte [edx + 0xa]
imul ecx, ecx, 0x1000193
xor ecx, eax
movzx eax, byte [edx + 0xb]
imul ecx, ecx, 0x1000193
xor ecx, eax
mov eax, dword [ebx + 0x18]
imul ecx, ecx, 0x1000193
and eax, ecx
mov ecx, dword [edi + eax*8]
mov dword [ebp - 0xc], ecx
lea eax, [edi + eax*8]
mov dword [ebp - 8], eax
mov eax, dword [eax + 4]
mov dword [ebp - 0x14], eax
mov eax, esi
mov edi, esi
mov esi, dword [esi]
push 0x14
push eax
call fcn.10056ffd
dec dword [ebx + 8]
add esp, 8
cmp edi, dword [ebp - 0x14]
je 0x100076d9
mov eax, dword [ebp + 0xc]
cmp esi, eax
jne 0x10007697
mov ecx, dword [ebp - 0xc]
cmp ecx, dword [ebp + 8]
jne 0x1000776c
mov edx, dword [ebp - 8]
mov ecx, dword [ebp - 4]
pop edi
mov dword [edx], esi
mov dword [ecx], esi
mov dword [esi + 4], ecx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
mov ecx, dword [ebp - 0xc]
mov edx, dword [ebp - 8]
cmp ecx, dword [ebp + 8]
jne 0x100076ed
mov eax, dword [ebp - 0x10]
mov ecx, eax
mov dword [edx], eax
jmp 0x100076f0
mov ecx, dword [ebp - 4]
mov eax, dword [ebp + 0xc]
mov dword [edx + 4], ecx
cmp esi, eax
je 0x1000776c
nop word [eax + eax]
movzx eax, byte [esi + 8]
xor eax, 0x811c9dc5
imul ecx, eax, 0x1000193
movzx eax, byte [esi + 9]
xor ecx, eax
movzx eax, byte [esi + 0xa]
imul ecx, ecx, 0x1000193
xor ecx, eax
movzx eax, byte [esi + 0xb]
imul ecx, ecx, 0x1000193
xor ecx, eax
imul eax, ecx, 0x1000193
mov ecx, dword [ebx + 0x18]
and ecx, eax
mov eax, dword [ebp - 0x18]
lea eax, [eax + ecx*8]
mov dword [ebp + 8], eax
mov eax, dword [eax + 4]
mov dword [ebp - 0x14], eax
mov eax, esi
mov edi, esi
mov esi, dword [esi]
push 0x14
push eax
call fcn.10056ffd
dec dword [ebx + 8]
add esp, 8
mov eax, dword [ebp + 0xc]
cmp edi, dword [ebp - 0x14]
je 0x1000777d
cmp esi, eax
jne 0x10007747
mov ecx, dword [ebp + 8]
mov dword [ecx], esi
mov ecx, dword [ebp - 4]
pop edi
mov dword [ecx], esi
mov dword [esi + 4], ecx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
mov ecx, dword [ebp + 8]
mov edx, dword [ebp - 0x10]
mov dword [ecx], edx
mov dword [ecx + 4], edx
cmp esi, eax
jne 0x10007700
mov ecx, dword [ebp - 4]
pop edi
mov dword [ecx], esi
mov dword [esi + 4], ecx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x100077b0
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
sub esp, 0x18
mov edx, dword [ebp + 8]
push ebx
mov ebx, ecx
cmp edx, eax
je 0x10007906
mov eax, dword [ebx + 4]
mov dword [ebp - 0x10], eax
mov eax, dword [edx + 4]
mov dword [ebp - 4], eax
movzx eax, byte [edx + 8]
xor eax, 0x811c9dc5
imul ecx, eax, 0x1000193
movzx eax, byte [edx + 9]
push esi
push edi
mov edi, dword [ebx + 0xc]
mov esi, edx
xor ecx, eax
mov dword [ebp - 0x18], edi
movzx eax, byte [edx + 0xa]
imul ecx, ecx, 0x1000193
xor ecx, eax
movzx eax, byte [edx + 0xb]
imul ecx, ecx, 0x1000193
xor ecx, eax
mov eax, dword [ebx + 0x18]
imul ecx, ecx, 0x1000193
and eax, ecx
mov ecx, dword [edi + eax*8]
mov dword [ebp - 0xc], ecx
lea eax, [edi + eax*8]
mov dword [ebp - 8], eax
mov eax, dword [eax + 4]
mov dword [ebp - 0x14], eax
mov eax, esi
mov edi, esi
mov esi, dword [esi]
push 0xc
push eax
call fcn.10056ffd
dec dword [ebx + 8]
add esp, 8
cmp edi, dword [ebp - 0x14]
je 0x10007869
mov eax, dword [ebp + 0xc]
cmp esi, eax
jne 0x10007827
mov ecx, dword [ebp - 0xc]
cmp ecx, dword [ebp + 8]
jne 0x100078fc
mov edx, dword [ebp - 8]
mov ecx, dword [ebp - 4]
pop edi
mov dword [edx], esi
mov dword [ecx], esi
mov dword [esi + 4], ecx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
mov ecx, dword [ebp - 0xc]
mov edx, dword [ebp - 8]
cmp ecx, dword [ebp + 8]
jne 0x1000787d
mov eax, dword [ebp - 0x10]
mov ecx, eax
mov dword [edx], eax
jmp 0x10007880
mov ecx, dword [ebp - 4]
mov eax, dword [ebp + 0xc]
mov dword [edx + 4], ecx
cmp esi, eax
je 0x100078fc
nop word [eax + eax]
movzx eax, byte [esi + 8]
xor eax, 0x811c9dc5
imul ecx, eax, 0x1000193
movzx eax, byte [esi + 9]
xor ecx, eax
movzx eax, byte [esi + 0xa]
imul ecx, ecx, 0x1000193
xor ecx, eax
movzx eax, byte [esi + 0xb]
imul ecx, ecx, 0x1000193
xor ecx, eax
imul eax, ecx, 0x1000193
mov ecx, dword [ebx + 0x18]
and ecx, eax
mov eax, dword [ebp - 0x18]
lea eax, [eax + ecx*8]
mov dword [ebp + 8], eax
mov eax, dword [eax + 4]
mov dword [ebp - 0x14], eax
mov eax, esi
mov edi, esi
mov esi, dword [esi]
push 0xc
push eax
call fcn.10056ffd
dec dword [ebx + 8]
add esp, 8
mov eax, dword [ebp + 0xc]
cmp edi, dword [ebp - 0x14]
je 0x1000790d
cmp esi, eax
jne 0x100078d7
mov ecx, dword [ebp + 8]
mov dword [ecx], esi
mov ecx, dword [ebp - 4]
pop edi
mov dword [ecx], esi
mov dword [esi + 4], ecx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
mov ecx, dword [ebp + 8]
mov edx, dword [ebp - 0x10]
mov dword [ecx], edx
mov dword [ecx + 4], edx
cmp esi, eax
jne 0x10007890
mov ecx, dword [ebp - 4]
pop edi
mov dword [ecx], esi
mov dword [esi + 4], ecx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x1000c170
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0x18]
sub esp, 0x24
push edi
mov edi, dword [eax + 4]
test edi, edi
jns 0x1000c1a5
cmp dword [eax], 0
jg 0x1000c1a5
push dword [ebp + 0xc]
mov eax, dword [ebp + 0x14]
mov ecx, dword [ebp + 0x10]
add eax, ecx
push eax
push ecx
call fcn.1000a750
mov eax, dword [ebp + 8]
add esp, 0xc
mov dword [eax], edx
pop edi
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp + 0x10]
lea edx, [ebp - 0x10]
mov ecx, dword [ebp + 0x14]
push ebx
push esi
add ecx, eax
mov dword [ebp - 0x1c], eax
push edx
push ecx
push eax
mov dword [ebp - 8], ecx
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x10], 0
call fcn.10018050
mov ebx, dword [ebp - 0x1c]
add esp, 0xc
xor esi, esi
mov dword [ebp - 0x14], eax
mov byte [ebp - 0xc], 0
cmp ebx, dword [ebp - 0x18]
je 0x1000c23f
mov dword [ebp - 4], esi
cmp esi, edi
jne 0x1000c1f0
test edi, edi
jns 0x1000c23f
mov edx, dword [ebp - 0x10]
mov ecx, 1
mov eax, 0x100b9fc8
nop dword [eax]
cmp edx, dword [eax]
jb 0x1000c216
add eax, 4
xor ecx, 3
cmp eax, 0x100ba038
jne 0x1000c200
mov ecx, 1
mov eax, 0x7fffffff
sub eax, ecx
cmp eax, esi
jl 0x1000c2a7
add esi, ecx
cmp esi, edi
jle 0x1000c22f
test edi, edi
jns 0x1000c2a2
lea ecx, [ebp - 0x1c]
call fcn.10016050
mov ebx, dword [ebp - 0x1c]
cmp ebx, dword [ebp - 0x18]
jne 0x1000c1e5
mov dword [ebp - 8], ebx
mov eax, dword [ebp + 0x10]
xor edi, edi
mov ecx, dword [ebp + 0xc]
xor ebx, ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0xc], 1
mov dword [ebp - 4], edi
mov al, byte [eax + 9]
test al, al
movzx edx, al
cmove edx, dword [ebp - 0xc]
mov dword [ebp - 0xc], edx
mov edx, dword [ebp + 0x18]
mov edx, dword [edx]
cmp esi, edx
jge 0x1000c2b6
mov eax, dword [ebp - 0xc]
movzx eax, al
sub eax, 1
je 0x1000c2ea
sub eax, 1
je 0x1000c2b2
sub eax, 1
jne 0x1000c2b6
mov eax, edx
sub eax, esi
cdq
sub eax, edx
mov ebx, eax
mov eax, dword [ebp + 0x18]
sar ebx, 1
mov edi, dword [eax]
sub edi, ebx
sub edi, esi
mov dword [ebp - 4], edi
jmp 0x1000c2b9
mov esi, dword [ebp - 4]
jmp 0x1000c23f
test edi, edi
jns 0x1000c23f
mov esi, 0x7fffffff
jmp 0x1000c242
mov ebx, edx
sub ebx, esi
mov eax, dword [ebp + 0x18]
lea esi, [eax + 0xf]
movzx eax, byte [eax + 0xe]
mov edx, esi
test ebx, ebx
jle 0x1000c2fa
lea edi, [esi + eax]
mov dword [ebp + 0x18], edi
nop dword [eax]
push ecx
push edi
push esi
call fcn.1000a750
dec ebx
add esp, 0xc
mov ecx, edx
test ebx, ebx
jg 0x1000c2d0
mov edi, dword [ebp - 4]
mov ebx, dword [ebp + 0x18]
jmp 0x1000c2fd
mov eax, dword [ebp + 0x18]
mov edi, edx
sub edi, esi
lea esi, [eax + 0xf]
movzx eax, byte [eax + 0xe]
mov edx, esi
lea ebx, [eax + edx]
mov eax, dword [ebp - 0x20]
mov edx, dword [ebp - 8]
sub edx, eax
push ecx
add edx, eax
push edx
push eax
call fcn.1000a750
add esp, 0xc
test edi, edi
jle 0x1000c326
push edx
push ebx
push esi
call fcn.1000a750
dec edi
add esp, 0xc
test edi, edi
jg 0x1000c316
mov eax, dword [ebp + 8]
pop esi
pop ebx
pop edi
mov dword [eax], edx
mov esp, ebp
pop ebp
ret
Function at 0x1001ec70
Capabilities:
Enumerate pe sections
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100b1f66
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x10147364]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
mov ebx, dword [ebp + 8]
lea edi, [esi + 0x2c]
mov dword [ebp + 8], edi
mov eax, dword [ebx]
mov dword [esi], eax
movzx eax, byte [ebx + 4]
mov byte [esi + 4], al
movzx eax, byte [ebx + 5]
mov byte [esi + 5], al
movzx eax, byte [ebx + 6]
mov byte [esi + 6], al
movzx eax, byte [ebx + 7]
mov byte [esi + 7], al
movzx eax, byte [ebx + 8]
mov byte [esi + 8], al
movzx eax, byte [ebx + 9]
mov byte [esi + 9], al
mov eax, dword [ebx + 0x10]
mov ecx, dword [ebx + 0x14]
mov dword [esi + 0x10], eax
mov dword [esi + 0x14], ecx
mov eax, dword [ebx + 0x18]
mov ecx, dword [ebx + 0x1c]
mov dword [esi + 0x18], eax
mov dword [esi + 0x1c], ecx
mov eax, dword [ebx + 0x20]
mov ecx, dword [ebx + 0x24]
mov dword [esi + 0x20], eax
mov dword [esi + 0x24], ecx
movzx eax, byte [ebx + 0x28]
mov byte [esi + 0x28], al
movzx eax, byte [ebx + 0x29]
mov byte [esi + 0x29], al
movzx eax, byte [ebx + 0x2a]
mov byte [esi + 0x2a], al
mov dword [edi], 0
mov dword [edi + 4], 0
mov dword [edi + 8], 0
mov eax, dword [ebx + 0x30]
sub eax, dword [ebx + 0x2c]
je 0x1001ed5b
cmp eax, 0x7fffffff
ja 0x1001ee11
push eax
mov ecx, edi
call fcn.10020c40
mov esi, dword [ebx + 0x30]
mov eax, dword [ebx + 0x2c]
sub esi, eax
mov edi, dword [edi]
push esi
push eax
push edi
call fcn.10059d40
mov ecx, dword [ebp + 8]
lea eax, [esi + edi]
mov esi, dword [ebp - 0x10]
add esp, 0xc
mov dword [ecx + 4], eax
lea eax, [esi + 0x38]
mov dword [ebp - 4], 0
mov dword [eax], 0
mov dword [eax + 4], 0
mov dword [eax + 8], 0
mov edi, dword [ebx + 0x3c]
sub edi, dword [ebx + 0x38]
sar edi, 2
mov dword [ebp + 8], eax
test edi, edi
je 0x1001edcf
cmp edi, 0x3fffffff
ja 0x1001ee16
push edi
mov ecx, eax
call fcn.10021c80
mov ecx, dword [ebp + 8]
mov dword [ecx], eax
mov dword [ecx + 4], eax
lea eax, [eax + edi*4]
mov dword [ecx + 8], eax
mov esi, dword [ebx + 0x3c]
mov eax, dword [ebx + 0x38]
sub esi, eax
mov edi, dword [ecx]
push esi
push eax
push edi
call fcn.10059d40
mov ecx, dword [ebp + 8]
add esp, 0xc
sar esi, 2
lea eax, [edi + esi*4]
mov esi, dword [ebp - 0x10]
mov dword [ecx + 4], eax
lea eax, [ebx + 0x44]
mov byte [ebp - 4], 1
lea ecx, [esi + 0x44]
push eax
call fcn.1001e880
lea eax, [ebx + 0x5c]
mov byte [ebp - 4], 2
push eax
lea ecx, [esi + 0x5c]
call fcn.1001e880
mov eax, dword [ebx + 0x74]
mov dword [esi + 0x74], eax
mov eax, dword [ebx + 0x78]
mov dword [esi + 0x78], eax
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
call fcn.10021bf0
call fcn.10021c10
int3