joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10155040
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
sub esp, 0x18
mov edx, dword [ebp + 8]
push ebx
mov ebx, ecx
cmp edx, eax
je 0x10155196
mov eax, dword [ebx + 4]
mov dword [ebp - 0x10], eax
mov eax, dword [edx + 4]
mov dword [ebp - 4], eax
movzx eax, byte [edx + 8]
xor eax, 0x811c9dc5
imul ecx, eax, 0x1000193
movzx eax, byte [edx + 9]
push esi
push edi
mov edi, dword [ebx + 0xc]
mov esi, edx
xor ecx, eax
mov dword [ebp - 0x18], edi
movzx eax, byte [edx + 0xa]
imul ecx, ecx, 0x1000193
xor ecx, eax
movzx eax, byte [edx + 0xb]
imul ecx, ecx, 0x1000193
xor ecx, eax
mov eax, dword [ebx + 0x18]
imul ecx, ecx, 0x1000193
and eax, ecx
mov ecx, dword [edi + eax*8]
mov dword [ebp - 0xc], ecx
lea eax, [edi + eax*8]
mov dword [ebp - 8], eax
mov eax, dword [eax + 4]
mov dword [ebp - 0x14], eax
mov eax, esi
mov edi, esi
mov esi, dword [esi]
push 0x1c
push eax
call fcn.1016f528
dec dword [ebx + 8]
add esp, 8
cmp edi, dword [ebp - 0x14]
je 0x101550f9
mov eax, dword [ebp + 0xc]
cmp esi, eax
jne 0x101550b7
mov ecx, dword [ebp - 0xc]
cmp ecx, dword [ebp + 8]
jne 0x1015518c
mov edx, dword [ebp - 8]
mov ecx, dword [ebp - 4]
pop edi
mov dword [edx], esi
mov dword [ecx], esi
mov dword [esi + 4], ecx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
mov ecx, dword [ebp - 0xc]
mov edx, dword [ebp - 8]
cmp ecx, dword [ebp + 8]
jne 0x1015510d
mov eax, dword [ebp - 0x10]
mov ecx, eax
mov dword [edx], eax
jmp 0x10155110
mov ecx, dword [ebp - 4]
mov eax, dword [ebp + 0xc]
mov dword [edx + 4], ecx
cmp esi, eax
je 0x1015518c
nop word [eax + eax]
movzx eax, byte [esi + 8]
xor eax, 0x811c9dc5
imul ecx, eax, 0x1000193
movzx eax, byte [esi + 9]
xor ecx, eax
movzx eax, byte [esi + 0xa]
imul ecx, ecx, 0x1000193
xor ecx, eax
movzx eax, byte [esi + 0xb]
imul ecx, ecx, 0x1000193
xor ecx, eax
mov eax, dword [ebx + 0x18]
imul ecx, ecx, 0x1000193
and eax, ecx
mov ecx, dword [ebp - 0x18]
lea eax, [ecx + eax*8]
mov dword [ebp + 8], eax
mov eax, dword [eax + 4]
mov dword [ebp - 0x14], eax
mov eax, esi
mov edi, esi
mov esi, dword [esi]
push 0x1c
push eax
call fcn.1016f528
dec dword [ebx + 8]
add esp, 8
mov eax, dword [ebp + 0xc]
cmp edi, dword [ebp - 0x14]
je 0x1015519d
cmp esi, eax
jne 0x10155167
mov ecx, dword [ebp + 8]
mov dword [ecx], esi
mov ecx, dword [ebp - 4]
pop edi
mov dword [ecx], esi
mov dword [esi + 4], ecx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
mov ecx, dword [ebp + 8]
mov edx, dword [ebp - 0x10]
mov dword [ecx], edx
mov dword [ecx + 4], edx
cmp esi, eax
jne 0x10155120
mov ecx, dword [ebp - 4]
pop edi
mov dword [ecx], esi
mov dword [esi + 4], ecx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x10156290
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10179f85
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x10
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
movzx eax, byte [edi]
xor eax, 0x811c9dc5
imul ecx, eax, 0x1000193
movzx eax, byte [edi + 1]
xor ecx, eax
movzx eax, byte [edi + 2]
imul ecx, ecx, 0x1000193
xor ecx, eax
movzx eax, byte [edi + 3]
imul ecx, ecx, 0x1000193
xor ecx, eax
lea eax, [ebp - 0x14]
imul ebx, ecx, 0x1000193
push ebx
push edi
push eax
call fcn.10156600
mov ecx, dword [ebp - 0x10]
test ecx, ecx
je 0x10156311
mov eax, dword [ebp + 8]
mov dword [eax], ecx
mov byte [eax + 4], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
cmp dword [0x10298868], 0x7ffffff
jne 0x10156328
push str.unordered_map_set_too_long
call dword [sym.imp.MSVCP140.dll_void___cdecl_std::_Xlength_error_char_const__]
mov dword [ebp - 0x1c], 0x10298864
mov dword [ebp - 4], 0
push 0x20
mov dword [ebp - 0x18], 0
call fcn.1016f536
mov ecx, dword [edi]
mov esi, eax
mov dword [ebp - 0x18], esi
add esp, 4
mov dword [esi + 8], ecx
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
mov dword [esi + 0x18], 0
mov dword [esi + 0x1c], 0
mov dword [esi + 0x14], 0
mov dword [esi + 0x10], 0
mov dword [esi + 0xc], 0
mov dword [ebp - 4], 1
mov ecx, dword [0x10298868]
mov edi, dword [0x1029887c]
lea eax, [ecx + 1]
movd xmm0, eax
cvtdq2pd xmm0, xmm0
shr eax, 0x1f
addsd xmm0, qword [eax*8 + 0x10285f50]
mov eax, edi
shr eax, 0x1f
cvtpd2ps xmm3, xmm0
movd xmm0, edi
cvtdq2pd xmm0, xmm0
movaps xmm2, xmm3
addsd xmm0, qword [eax*8 + 0x10285f50]
cvtpd2ps xmm1, xmm0
movss xmm0, dword [0x10298860]
divss xmm2, xmm1
comiss xmm2, xmm0
jbe 0x1015642c
divss xmm3, xmm0
movaps xmm0, xmm3
call fcn.10059060
call fcn.101714a0
mov ecx, 8
cmp eax, ecx
cmova ecx, eax
cmp edi, ecx
jae 0x1015640e
cmp edi, 0x200
jae 0x1015640c
shl edi, 3
cmp edi, ecx
jae 0x1015640e
mov edi, ecx
push edi
call fcn.10156490
push ebx
lea eax, [esi + 8]
push eax
lea eax, [ebp - 0x1c]
push eax
call fcn.10156600
mov ecx, dword [0x10298868]
mov edx, dword [eax]
jmp 0x1015642f
mov edx, dword [ebp - 0x14]
mov edi, dword [edx + 4]
inc ecx
mov dword [0x10298868], ecx
mov dword [esi], edx
mov dword [esi + 4], edi
mov dword [edi], esi
mov dword [edx + 4], esi
mov eax, dword [0x10298878]
mov ecx, dword [0x1029886c]
and eax, ebx
mov ebx, dword [ecx + eax*8]
cmp ebx, dword [0x10298864]
jne 0x10156460
mov dword [ecx + eax*8], esi
jmp 0x1015646f
cmp ebx, edx
jne 0x10156469
mov dword [ecx + eax*8], esi
jmp 0x10156473
cmp dword [ecx + eax*8 + 4], edi
jne 0x10156473
mov dword [ecx + eax*8 + 4], esi
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
pop edi
mov dword [eax], esi
pop esi
mov byte [eax + 4], 1
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x10156490
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1fffffff
sub esp, 8
bsr ecx, eax
push ebx
push esi
push edi
mov edi, 1
mov eax, edi
shl eax, cl
mov ecx, dword [ebp + 8]
cmp ecx, eax
jbe 0x101564bc
push str.invalid_hash_bucket_count
call dword [sym.imp.MSVCP140.dll_void___cdecl_std::_Xlength_error_char_const__]
lea eax, [ecx - 1]
mov esi, dword [0x10298864]
or eax, 1
mov dword [ebp + 8], esi
bsr ecx, eax
push esi
lea ecx, [ecx + 1]
shl edi, cl
mov ecx, 0x1029886c
lea eax, [edi + edi]
push eax
call fcn.10091d70
mov eax, dword [0x10298864]
lea ebx, [edi - 1]
mov dword [0x10298878], ebx
mov dword [0x1029887c], edi
mov eax, dword [eax]
mov ecx, eax
cmp eax, esi
je 0x101565f6
movzx edx, byte [eax + 8]
xor edx, 0x811c9dc5
mov ecx, dword [ecx]
imul edi, edx, 0x1000193
movzx edx, byte [eax + 9]
xor edi, edx
movzx edx, byte [eax + 0xa]
imul edi, edi, 0x1000193
xor edi, edx
movzx edx, byte [eax + 0xb]
imul edi, edi, 0x1000193
xor edi, edx
mov edx, dword [0x1029886c]
imul edi, edi, 0x1000193
and edi, ebx
mov ebx, dword [edx + edi*8]
lea edx, [edx + edi*8]
mov dword [ebp - 4], edx
cmp ebx, esi
jne 0x10156554
mov dword [edx], eax
mov dword [edx + 4], eax
jmp 0x101565c1
mov edx, dword [edx + 4]
mov edi, dword [eax + 8]
cmp edi, dword [edx + 8]
jne 0x1015658e
mov edx, dword [edx]
mov dword [ebp - 8], edx
cmp edx, eax
je 0x10156586
mov ebx, dword [eax + 4]
mov esi, dword [ebp - 8]
mov dword [ebx], ecx
mov edi, dword [ecx + 4]
mov dword [edi], edx
mov edx, dword [edx + 4]
mov dword [edx], eax
mov dword [esi + 4], edi
mov esi, dword [ebp + 8]
mov dword [ecx + 4], ebx
mov dword [eax + 4], edx
mov edx, dword [ebp - 4]
mov dword [edx + 4], eax
jmp 0x101565c1
cmp ebx, edx
je 0x1015659e
mov edx, dword [edx + 4]
cmp edi, dword [edx + 8]
je 0x101565d2
cmp ebx, edx
jne 0x10156592
mov ebx, dword [eax + 4]
mov dword [ebp - 8], ebx
mov dword [ebx], ecx
mov ebx, dword [ecx + 4]
mov dword [ebx], edx
mov edi, dword [edx + 4]
mov dword [edi], eax
mov dword [edx + 4], ebx
mov edx, dword [ebp - 8]
mov dword [ecx + 4], edx
mov edx, dword [ebp - 4]
mov dword [eax + 4], edi
mov dword [edx], eax
mov eax, ecx
cmp ecx, esi
je 0x101565f6
mov ebx, dword [0x10298878]
jmp 0x10156502
mov ebx, dword [eax + 4]
mov edx, dword [edx]
mov dword [ebp - 8], edx
mov esi, edx
mov dword [ebx], ecx
mov edi, dword [ecx + 4]
mov dword [edi], edx
mov edx, dword [edx + 4]
mov dword [edx], eax
mov dword [esi + 4], edi
mov esi, dword [ebp + 8]
mov dword [ecx + 4], ebx
mov dword [eax + 4], edx
jmp 0x101565c1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x1015c660
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1017ab85
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x10
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
movzx eax, byte [edi]
xor eax, 0x811c9dc5
imul ecx, eax, 0x1000193
movzx eax, byte [edi + 1]
xor ecx, eax
movzx eax, byte [edi + 2]
imul ecx, ecx, 0x1000193
xor ecx, eax
movzx eax, byte [edi + 3]
imul ecx, ecx, 0x1000193
xor ecx, eax
lea eax, [ebp - 0x14]
imul ebx, ecx, 0x1000193
push ebx
push edi
push eax
call fcn.1015c9b0
mov ecx, dword [ebp - 0x10]
test ecx, ecx
je 0x1015c6e1
mov eax, dword [ebp + 8]
mov dword [eax], ecx
mov byte [eax + 4], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
cmp dword [0x1029cd28], 0xccccccc
jne 0x1015c6f8
push str.unordered_map_set_too_long
call dword [sym.imp.MSVCP140.dll_void___cdecl_std::_Xlength_error_char_const__]
mov dword [ebp - 0x1c], 0x1029cd24
mov dword [ebp - 4], 0
push 0x14
mov dword [ebp - 0x18], 0
call fcn.1016f536
mov ecx, dword [edi]
mov esi, eax
add esp, 4
mov dword [ebp - 0x18], esi
mov dword [esi + 8], ecx
mov dword [esi + 0xc], 0
mov dword [esi + 0x10], 0
mov dword [ebp - 4], 1
mov ecx, dword [0x1029cd28]
mov edi, dword [0x1029cd3c]
lea eax, [ecx + 1]
movd xmm0, eax
cvtdq2pd xmm0, xmm0
shr eax, 0x1f
addsd xmm0, qword [eax*8 + 0x10285f50]
mov eax, edi
shr eax, 0x1f
cvtpd2ps xmm3, xmm0
movd xmm0, edi
cvtdq2pd xmm0, xmm0
movaps xmm2, xmm3
addsd xmm0, qword [eax*8 + 0x10285f50]
cvtpd2ps xmm1, xmm0
movss xmm0, dword [0x1029cd20]
divss xmm2, xmm1
comiss xmm2, xmm0
jbe 0x1015c7d9
divss xmm3, xmm0
movaps xmm0, xmm3
call fcn.10059060
call fcn.101714a0
mov ecx, 8
cmp eax, ecx
cmova ecx, eax
cmp edi, ecx
jae 0x1015c7bb
cmp edi, 0x200
jae 0x1015c7b9
shl edi, 3
cmp edi, ecx
jae 0x1015c7bb
mov edi, ecx
push edi
call fcn.1015c840
push ebx
lea eax, [esi + 8]
push eax
lea eax, [ebp - 0x1c]
push eax
call fcn.1015c9b0
mov ecx, dword [0x1029cd28]
mov edx, dword [eax]
jmp 0x1015c7dc
mov edx, dword [ebp - 0x14]
mov edi, dword [edx + 4]
inc ecx
mov dword [0x1029cd28], ecx
mov dword [esi], edx
mov dword [esi + 4], edi
mov dword [edi], esi
mov dword [edx + 4], esi
mov eax, dword [0x1029cd38]
mov ecx, dword [0x1029cd2c]
and eax, ebx
mov ebx, dword [ecx + eax*8]
cmp ebx, dword [0x1029cd24]
jne 0x1015c80d
mov dword [ecx + eax*8], esi
jmp 0x1015c81c
cmp ebx, edx
jne 0x1015c816
mov dword [ecx + eax*8], esi
jmp 0x1015c820
cmp dword [ecx + eax*8 + 4], edi
jne 0x1015c820
mov dword [ecx + eax*8 + 4], esi
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
pop edi
mov dword [eax], esi
pop esi
mov byte [eax + 4], 1
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x1015c840
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1fffffff
sub esp, 8
bsr ecx, eax
push ebx
push esi
push edi
mov edi, 1
mov eax, edi
shl eax, cl
mov ecx, dword [ebp + 8]
cmp ecx, eax
jbe 0x1015c86c
push str.invalid_hash_bucket_count
call dword [sym.imp.MSVCP140.dll_void___cdecl_std::_Xlength_error_char_const__]
lea eax, [ecx - 1]
mov esi, dword [0x1029cd24]
or eax, 1
mov dword [ebp + 8], esi
bsr ecx, eax
push esi
lea ecx, [ecx + 1]
shl edi, cl
mov ecx, 0x1029cd2c
lea eax, [edi + edi]
push eax
call fcn.10091d70
mov eax, dword [0x1029cd24]
lea ebx, [edi - 1]
mov dword [0x1029cd38], ebx
mov dword [0x1029cd3c], edi
mov eax, dword [eax]
mov ecx, eax
cmp eax, esi
je 0x1015c9a6
movzx edx, byte [eax + 8]
xor edx, 0x811c9dc5
mov ecx, dword [ecx]
imul edi, edx, 0x1000193
movzx edx, byte [eax + 9]
xor edi, edx
movzx edx, byte [eax + 0xa]
imul edi, edi, 0x1000193
xor edi, edx
movzx edx, byte [eax + 0xb]
imul edi, edi, 0x1000193
xor edi, edx
mov edx, dword [0x1029cd2c]
imul edi, edi, 0x1000193
and edi, ebx
mov ebx, dword [edx + edi*8]
lea edx, [edx + edi*8]
mov dword [ebp - 4], edx
cmp ebx, esi
jne 0x1015c904
mov dword [edx], eax
mov dword [edx + 4], eax
jmp 0x1015c971
mov edx, dword [edx + 4]
mov edi, dword [eax + 8]
cmp edi, dword [edx + 8]
jne 0x1015c93e
mov edx, dword [edx]
mov dword [ebp - 8], edx
cmp edx, eax
je 0x1015c936
mov ebx, dword [eax + 4]
mov esi, dword [ebp - 8]
mov dword [ebx], ecx
mov edi, dword [ecx + 4]
mov dword [edi], edx
mov edx, dword [edx + 4]
mov dword [edx], eax
mov dword [esi + 4], edi
mov esi, dword [ebp + 8]
mov dword [ecx + 4], ebx
mov dword [eax + 4], edx
mov edx, dword [ebp - 4]
mov dword [edx + 4], eax
jmp 0x1015c971
cmp ebx, edx
je 0x1015c94e
mov edx, dword [edx + 4]
cmp edi, dword [edx + 8]
je 0x1015c982
cmp ebx, edx
jne 0x1015c942
mov ebx, dword [eax + 4]
mov dword [ebp - 8], ebx
mov dword [ebx], ecx
mov ebx, dword [ecx + 4]
mov dword [ebx], edx
mov edi, dword [edx + 4]
mov dword [edi], eax
mov dword [edx + 4], ebx
mov edx, dword [ebp - 8]
mov dword [ecx + 4], edx
mov edx, dword [ebp - 4]
mov dword [eax + 4], edi
mov dword [edx], eax
mov eax, ecx
cmp ecx, esi
je 0x1015c9a6
mov ebx, dword [0x1029cd38]
jmp 0x1015c8b2
mov ebx, dword [eax + 4]
mov edx, dword [edx]
mov dword [ebp - 8], edx
mov esi, edx
mov dword [ebx], ecx
mov edi, dword [ecx + 4]
mov dword [edi], edx
mov edx, dword [edx + 4]
mov dword [edx], eax
mov dword [esi + 4], edi
mov esi, dword [ebp + 8]
mov dword [ecx + 4], ebx
mov dword [eax + 4], edx
jmp 0x1015c971
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x10160ea0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x10175195
push eax
mov dword fs:[0], esp
sub esp, 0x10
push ebx
mov ebx, dword [ebp + 0xc]
mov edx, ebx
push esi
push edi
cmp dword [ebx + 0x14], 0xf
mov edi, dword [ebx + 0x10]
jbe 0x10160ece
mov edx, dword [ebx]
xor ecx, ecx
mov esi, 0x811c9dc5
test edi, edi
je 0x10160ef1
nop dword [eax]
movzx eax, byte [ecx + edx]
inc ecx
xor eax, esi
imul esi, eax, 0x1000193
cmp ecx, edi
jb 0x10160ee0
push esi
push ebx
lea eax, [ebp - 0x14]
push eax
call fcn.10161270
mov ecx, dword [ebp - 0x10]
test ecx, ecx
je 0x10160f1f
mov eax, dword [ebp + 8]
mov dword [eax], ecx
mov byte [eax + 4], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
cmp dword [0x1029ccb8], 0x71c71c7
jne 0x10160f36
push str.unordered_map_set_too_long
call dword [sym.imp.MSVCP140.dll_void___cdecl_std::_Xlength_error_char_const__]
mov dword [ebp - 0x1c], 0x1029ccb4
mov dword [ebp - 4], 0
push 0x24
mov dword [ebp - 0x18], 0
call fcn.1016f536
mov edi, eax
add esp, 4
mov dword [ebp - 0x18], edi
lea ecx, [edi + 8]
push ebx
call fcn.10091990
mov ecx, dword [ebx + 0x18]
mov dword [edi + 0x20], ecx
mov dword [ebp - 4], 1
mov ecx, dword [0x1029ccb8]
mov ebx, dword [0x1029cccc]
lea eax, [ecx + 1]
movd xmm0, eax
cvtdq2pd xmm0, xmm0
shr eax, 0x1f
movd xmm1, ebx
addsd xmm0, qword [eax*8 + 0x10285f50]
cvtdq2pd xmm1, xmm1
mov eax, ebx
shr eax, 0x1f
cvtpd2ps xmm0, xmm0
addsd xmm1, qword [eax*8 + 0x10285f50]
movaps xmm2, xmm0
cvtpd2ps xmm1, xmm1
divss xmm2, xmm1
movss xmm1, dword [0x1029ccb0]
comiss xmm2, xmm1
jbe 0x10161010
divss xmm0, xmm1
call fcn.10059060
call fcn.101714a0
mov ecx, 8
cmp eax, ecx
cmova ecx, eax
cmp ebx, ecx
jae 0x10160ff2
cmp ebx, 0x200
jae 0x10160ff0
shl ebx, 3
cmp ebx, ecx
jae 0x10160ff2
mov ebx, ecx
push ebx
call fcn.10161080
push esi
lea eax, [edi + 8]
push eax
lea eax, [ebp - 0x1c]
push eax
call fcn.10161270
mov ecx, dword [0x1029ccb8]
mov edx, dword [eax]
jmp 0x10161013
mov edx, dword [ebp - 0x14]
mov ebx, dword [edx + 4]
inc ecx
mov dword [0x1029ccb8], ecx
mov dword [edi], edx
mov dword [edi + 4], ebx
mov dword [ebx], edi
mov dword [edx + 4], edi
mov eax, dword [0x1029ccc8]
mov ecx, dword [0x1029ccbc]
and eax, esi
mov esi, dword [ecx + eax*8]
cmp esi, dword [0x1029ccb4]
jne 0x10161044
mov dword [ecx + eax*8], edi
jmp 0x10161053
cmp esi, edx
jne 0x1016104d
mov dword [ecx + eax*8], edi
jmp 0x10161057
cmp dword [ecx + eax*8 + 4], ebx
jne 0x10161057
mov dword [ecx + eax*8 + 4], edi
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
mov dword [eax], edi
pop edi
pop esi
mov byte [eax + 4], 1
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x101635e0
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1017bbbb
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xc
push ebx
push esi
push edi
mov edi, ecx
lea ecx, [edi + 4]
mov dword [ebp - 0x10], edi
mov dword [ebp - 0x14], ecx
mov dword [ecx], 0
mov dword [ecx + 4], 0
mov dword [ecx + 8], 0
lea ebx, [edi + 0x10]
mov dword [ebp - 4], 0
mov dword [ebx], 0
mov dword [ebx + 4], 0
mov dword [ebx + 8], 0
mov byte [ebp - 4], 1
mov eax, dword [ebp + 8]
mov dword [edi], eax
mov eax, dword [ebp + 0xc]
mov dword [edi + 0x1c], 0
mov byte [edi + 0x20], 0
cmp ebx, eax
je 0x101636fb
mov esi, dword [eax]
mov edi, dword [eax + 4]
mov edx, dword [ebx + 8]
sub edi, esi
mov dword [ebp + 8], esi
cmp edi, edx
jbe 0x101636b1
cmp edi, 0x7fffffff
ja 0x101637b0
mov ecx, edx
mov eax, 0x7fffffff
shr ecx, 1
sub eax, ecx
cmp edx, eax
jbe 0x1016368d
mov eax, 0x7fffffff
jmp 0x10163695
lea eax, [ecx + edx]
cmp eax, edi
cmovb eax, edi
push eax
mov ecx, ebx
call fcn.10163bd0
mov esi, dword [ebx]
push edi
push dword [ebp + 8]
push esi
call sub.VCRUNTIME140.dll_memmove
lea eax, [esi + edi]
mov dword [ebx + 4], eax
jmp 0x101636f2
mov eax, dword [ebx + 4]
mov dword [ebp + 8], eax
cmp edi, eax
jbe 0x101636e6
push eax
push esi
push 0
call sub.VCRUNTIME140.dll_memmove
mov eax, dword [ebp + 8]
add esi, eax
sub edi, eax
mov dword [ebp + 8], esi
mov esi, dword [ebx + 4]
push edi
push dword [ebp + 8]
push esi
call sub.VCRUNTIME140.dll_memmove
lea eax, [esi + edi]
add esp, 0x18
mov dword [ebx + 4], eax
jmp 0x101636f5
push edi
push esi
push 0
call sub.VCRUNTIME140.dll_memmove
mov dword [ebx + 4], edi
add esp, 0xc
mov edi, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x14]
mov esi, dword [ebx + 4]
sub esi, dword [ebx]
mov dword [edi + 0x1c], esi
mov eax, dword [ecx + 4]
mov edx, eax
mov ebx, dword [ecx]
sub edx, ebx
mov dword [ebp + 8], eax
cmp esi, edx
jae 0x1016371b
lea eax, [esi + ebx]
mov dword [ecx + 4], eax
jmp 0x10163746
jbe 0x10163746
mov eax, dword [ecx + 8]
sub eax, ebx
cmp esi, eax
jbe 0x1016372f
push ecx
push esi
call fcn.10163c50
jmp 0x10163746
mov ebx, dword [ebp + 8]
sub esi, edx
push esi
push 0
push ebx
call sub.VCRUNTIME140.dll_memset
lea eax, [esi + ebx]
add esp, 0xc
mov dword [edi + 8], eax
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [ebp + 0xc]
push eax
push 0x40
push dword [edi + 0x1c]
push dword [edi]
call esi
push dword [edi + 0x1c]
push dword [edi]
push dword [edi + 4]
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
lea eax, [ebp - 0x18]
push eax
push dword [ebp + 0xc]
push dword [edi + 0x1c]
push dword [edi]
call esi
call fcn.10163590
mov dword [ebp + 8], edi
mov ecx, dword [eax + 4]
cmp ecx, dword [eax + 8]
je 0x1016378f
mov dword [ecx], edi
add dword [eax + 4], 4
jmp 0x1016379b
lea edx, [ebp + 8]
push edx
push ecx
mov ecx, eax
call fcn.1014de10
mov ecx, dword [ebp - 0xc]
mov eax, edi
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 8
call fcn.10091a90
int3
Function at 0x10164b20
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x5c
push esi
push 0x40
lea eax, [esp + 0x24]
mov esi, ecx
push 0
push eax
call sub.VCRUNTIME140.dll_memset
mov eax, 0x20
mov dword [esp + 0x14], 0x67452301
mov dword [esp + 0x24], eax
lea ecx, [esp + 0x2c]
shr eax, 3
mov edx, 0x3f
and eax, 0x3f
mov dword [esp + 0x18], 0xefcdab89
add ecx, eax
mov dword [esp + 0x1c], 0x98badcfe
mov dword [esp + 0x20], 0x10325476
sub edx, eax
mov dword [esp + 0x28], 0
add esp, 0xc
mov dword [esp + 0x20], esi
mov byte [ecx], 0x80
inc ecx
cmp edx, 8
jae 0x10164bb7
push edx
push 0
push ecx
call sub.VCRUNTIME140.dll_memset
lea edx, [esp + 0x2c]
lea ecx, [esp + 0x14]
call fcn.101644a0
push 0x38
lea eax, [esp + 0x30]
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0x18
jmp 0x10164bc6
lea eax, [edx - 8]
push eax
push 0
push ecx
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
mov eax, dword [esp + 0x18]
lea edx, [esp + 0x20]
mov dword [esp + 0x58], eax
lea ecx, [esp + 8]
mov eax, dword [esp + 0x1c]
mov dword [esp + 0x5c], eax
call fcn.101644a0
mov eax, dword [esp + 0xe]
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x1016afc0
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0xc
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
mov al, byte [esi]
test al, al
jne 0x1016afdc
mov ebx, 0x811c9dc5
jmp 0x1016aff4
movsx eax, al
lea ecx, [esi + 1]
xor eax, 0x811c9dc5
imul edx, eax, 0x1000193
call fcn.100de180
mov ebx, eax
movzx ecx, bl
xor ecx, 0x811c9dc5
mov dword [esp + 0xc], ebx
imul edx, ecx, 0x1000193
mov ecx, ebx
shr ecx, 8
movzx eax, cl
xor edx, eax
mov eax, ebx
shr eax, 0x10
movzx eax, al
imul ecx, edx, 0x1000193
shr ebx, 0x18
xor ecx, eax
imul eax, ecx, 0x1000193
xor eax, ebx
imul eax, eax, 0x1000193
push eax
lea eax, [esp + 0x10]
push eax
lea eax, [esp + 0x18]
push eax
call fcn.1016b430
cmp dword [eax + 4], 0
jne 0x1016b091
mov ecx, dword [0x1029cd80]
push esi
mov eax, dword [ecx]
call dword [eax + 0x34]
mov cl, byte [esi]
mov ebx, eax
test cl, cl
jne 0x1016b063
mov eax, 0x811c9dc5
jmp 0x1016b079
movsx eax, cl
lea ecx, [esi + 1]
xor eax, 0x811c9dc5
imul edx, eax, 0x1000193
call fcn.100de180
mov dword [esp + 0xc], eax
lea eax, [esp + 0xc]
push eax
lea eax, [esp + 0x14]
push eax
call fcn.1016b0e0
mov eax, dword [eax]
mov dword [eax + 0xc], ebx
mov al, byte [esi]
test al, al
jne 0x1016b09e
mov eax, 0x811c9dc5
jmp 0x1016b0b4
movsx eax, al
lea ecx, [esi + 1]
xor eax, 0x811c9dc5
imul edx, eax, 0x1000193
call fcn.100de180
mov dword [esp + 0xc], eax
lea eax, [esp + 0xc]
push eax
lea eax, [esp + 0x14]
push eax
call fcn.1016b0e0
pop edi
pop esi
pop ebx
mov eax, dword [eax]
mov eax, dword [eax + 0xc]
mov esp, ebp
pop ebp
ret 4