joyce8/EMBER2024-capa huggingface dataset:
Function at 0x101f6020
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [0x1040e140]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x1c], ecx
test eax, eax
je 0x101f619a
push ebx
mov ebx, dword [eax + 2]
mov dword [ebp - 0x10], ebx
test ebx, ebx
je 0x101f6199
lea eax, [ebx - 4]
test eax, eax
je 0x101f6199
mov ecx, dword [ebx]
test ecx, ecx
je 0x101f6199
cmp ecx, 0xc8
jg 0x101f6199
cmp dword [eax], 0
je 0x101f6199
push esi
mov esi, dword [eax + 8]
test esi, esi
je 0x101f6198
push edi
mov edi, 0x811c9dc5
xor ecx, ecx
nop dword [eax + eax]
inc ecx
cmp byte [esi + ecx], 0
jne 0x101f6090
xor edx, edx
test ecx, ecx
je 0x101f60b1
nop dword [eax]
movsx eax, byte [esi + edx]
inc edx
xor eax, edi
imul edi, eax, 0x1000193
cmp edx, ecx
jb 0x101f60a0
mov dword [ebp - 8], edi
cmp dword [ebx], 0
mov dword [ebp - 0x18], 0
jle 0x101f6197
xor esi, esi
mov eax, ebx
mov dword [ebp - 0x14], esi
nop dword [eax + eax]
mov ebx, dword [eax - 4]
add ebx, esi
mov esi, dword [ebx + 4]
test esi, esi
je 0x101f617f
mov edi, 0x811c9dc5
xor eax, eax
inc eax
cmp byte [esi + eax], 0
jne 0x101f60e7
xor edx, edx
test eax, eax
je 0x101f6105
movsx ecx, byte [esi + edx]
inc edx
xor ecx, edi
imul edi, ecx, 0x1000193
cmp edx, eax
jb 0x101f60f4
mov dword [ebp - 0xc], edi
lea eax, [ebp - 8]
mov edi, dword [ebp - 0x1c]
add edi, 0x20
push eax
mov ecx, edi
call fcn.10098900
lea ecx, [ebp - 0xc]
push ecx
mov ecx, eax
call fcn.100988e0
cmp dword [eax + 8], 0
jne 0x101f617c
lea eax, [ebp - 8]
mov ecx, edi
push eax
call fcn.10098900
lea ecx, [ebp - 0xc]
push ecx
mov ecx, eax
call fcn.100988e0
mov ecx, edi
mov byte [eax], 1
lea eax, [ebp - 8]
mov esi, dword [ebx + 8]
push eax
call fcn.10098900
lea ecx, [ebp - 0xc]
push ecx
mov ecx, eax
call fcn.100988e0
mov ecx, edi
mov dword [eax + 8], esi
lea eax, [ebp - 8]
push eax
call fcn.10098900
lea ecx, [ebp - 0xc]
push ecx
mov ecx, eax
call fcn.100988e0
mov dword [eax + 4], 0
mov eax, dword [ebp - 0x10]
mov ebx, dword [ebp - 0x18]
mov esi, dword [ebp - 0x14]
inc ebx
add esi, 0x3c
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x14], esi
cmp ebx, dword [eax]
jl 0x101f60d0
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.102e0890
mov esp, ebp
pop ebp
ret 4
Function at 0x1022c3a0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x103347bd
mov eax, dword fs:[0]
push eax
sub esp, 0x28
mov eax, dword [0x1040e140]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
xorps xmm0, xmm0
mov dword [ebp - 0x14], 0xf
xor edx, edx
movups xmmword [ebp - 0x28], xmm0
mov dword [ebp - 0x18], edx
mov byte [ebp - 0x28], dl
mov dword [ebp - 4], edx
mov esi, dword [ecx]
mov eax, dword [ecx + 4]
mov dword [ebp - 0x2c], esi
mov dword [ebp - 0x34], eax
cmp esi, eax
je 0x1022c496
lea eax, [ebp - 0x28]
cmp eax, esi
je 0x1022c416
cmp dword [esi + 0x14], 0xf
mov eax, esi
jbe 0x1022c407
mov eax, dword [esi]
push dword [esi + 0x10]
lea ecx, [ebp - 0x28]
push eax
call fcn.1002e090
mov edx, dword [ebp - 0x18]
cmp byte [ebp + 0x10], 0
je 0x1022c447
lea ecx, [edx - 3]
cmp ecx, edx
ja 0x1022c437
cmp dword [ebp - 0x14], 0xf
lea eax, [ebp - 0x28]
mov dword [ebp - 0x18], ecx
cmova eax, dword [ebp - 0x28]
mov byte [eax + ecx], 0
jmp 0x1022c444
sub ecx, edx
push 0
push ecx
lea ecx, [ebp - 0x28]
call fcn.1002eda0
mov edx, dword [ebp - 0x18]
cmp dword [ebp - 0x14], 0xf
lea eax, [ebp - 0x28]
mov edi, 0x811c9dc5
cmova eax, dword [ebp - 0x28]
mov dword [ebp - 0x30], eax
xor eax, eax
test edx, edx
je 0x1022c477
mov esi, dword [ebp - 0x30]
movzx ecx, byte [eax + esi]
inc eax
xor ecx, edi
imul edi, ecx, 0x1000193
cmp eax, edx
jb 0x1022c463
mov esi, dword [ebp - 0x2c]
cmp edi, dword [ebp + 8]
jne 0x1022c487
mov eax, dword [ebp + 0xc]
test eax, eax
je 0x1022c4bf
dec eax
mov dword [ebp + 0xc], eax
add esi, 0x1c
mov dword [ebp - 0x2c], esi
cmp esi, dword [ebp - 0x34]
jne 0x1022c3f6
xor esi, esi
lea ecx, [ebp - 0x28]
call fcn.10027fc0
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.102e0890
mov esp, ebp
pop ebp
ret 0xc
mov esi, dword [esi + 0x18]
jmp 0x1022c498

Function at 0x1022db70
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
cmp dword [ebp + 0xc], 1
jne 0x1022db9c
push 0
push 0
push dword [ebp + 8]
push 0x10039ee0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
test eax, eax
je 0x1022db9c
mov eax, 1
pop ebp
ret 0xc
xor eax, eax
pop ebp
ret 0xc
Function at 0x10249500
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
test ebx, ebx
je 0x10249691
mov eax, dword [ebx]
mov ecx, ebx
mov eax, dword [eax + 0x280]
call eax
test al, al
je 0x10249691
mov eax, dword [0x105b27a0]
cmp dword [eax + 0x174], 0xffffffff
je 0x10249691
mov eax, dword [0x105b2a6c]
add eax, 0xffffff92
xor eax, 0xbacf802f
cmp dword [eax + ebx], 0
mov eax, dword [0x105b2a34]
setle cl
add eax, 0xffffffa0
xor eax, 0xbacf8021
xor edi, edi
mov byte [eax + ebx], cl
mov eax, dword [0x105b2a28]
add eax, 0xffffffa3
xor eax, 0xbacf801e
mov dword [eax + ebx + 0xc], 0
mov eax, dword [0x105b2a2c]
add eax, 0xffffffa2
xor eax, 0xbacf801f
mov dword [eax + ebx + 0xc], 0
mov ecx, dword [0x105b2a30]
lea eax, [ecx - 0x5f]
xor eax, 0xbacf8020
mov edx, dword [eax + ebx + 0xc]
mov dword [ebp - 4], edx
test edx, edx
je 0x102495ee
lea eax, [ecx - 0x5f]
xor eax, 0xbacf8020
mov eax, dword [eax + ebx]
mov esi, dword [eax + edi*4]
lea ebx, [eax + edi*4]
test esi, esi
je 0x102495e6
or eax, 0xffffffff
lock xadd dword [esi + 4], eax
jne 0x102495da
mov eax, dword [esi]
mov ecx, esi
mov eax, dword [eax + 4]
call eax
test al, al
je 0x102495d7
mov eax, dword [esi]
mov ecx, esi
push 1
call dword [eax]
mov edx, dword [ebp - 4]
mov dword [ebx], 0
mov ecx, dword [0x105b2a30]
mov ebx, dword [ebp + 8]
inc edi
cmp edi, edx
jb 0x102495a3
lea eax, [ecx - 0x5f]
xor eax, 0xbacf8020
lea ecx, [ebx + 8]
push 0
mov dword [eax + ebx + 0xc], 0
mov eax, dword [ebx + 8]
mov eax, dword [eax + 0x1c]
call eax
mov eax, dword [ebx + 8]
lea ecx, [ebx + 8]
push 0
mov eax, dword [eax + 0x14]
call eax
mov ecx, dword [0x105b27b4]
xor ebx, ebx
mov dword [ebp - 4], ecx
mov eax, dword [ecx + 0x28]
mov dword [ebp - 8], eax
test eax, eax
je 0x10249682
nop dword [eax]
mov eax, dword [ecx + 0x1c]
mov ecx, dword [eax + ebx*4]
mov eax, dword [ecx]
mov eax, dword [eax + 0x30]
call eax
mov esi, eax
mov edi, 0x811c9dc5
xor ecx, ecx
inc ecx
cmp byte [esi + ecx], 0
jne 0x10249646
xor edx, edx
test ecx, ecx
je 0x1024966c
movsx eax, byte [esi + edx]
inc edx
xor eax, edi
imul edi, eax, 0x1000193
cmp edx, ecx
jb 0x10249653
cmp edi, 0x79705c5e
je 0x10249677
inc ebx
cmp ebx, dword [ebp - 8]
jae 0x10249682
mov ecx, dword [ebp - 4]
jmp 0x10249630
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x1c]
mov ecx, dword [eax + ebx*4]
jmp 0x10249684
xor ecx, ecx
push 0
push dword [ebp + 8]
push 0
call dword [0x105b28a4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x10255260
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10336db0
mov eax, dword fs:[0]
push eax
sub esp, 0x50
push esi
mov eax, dword [0x1040e140]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
xor eax, eax
mov dword [ebp + 8], eax
mov dword [ebp - 0x10], eax
movss xmm1, dword [esi + 0x36c8]
movss xmm0, dword [esi + 0x36c4]
mulss xmm0, xmm0
mulss xmm1, xmm1
addss xmm0, xmm1
call fcn.10019850
test byte [esi + 0x369c], 1
movss dword [ebp - 0x14], xmm0
je 0x1025534f
movss xmm1, dword [0x103e37c8]
comiss xmm0, xmm1
jbe 0x102552e9
cmp byte [esi + 0x3750], 0
jne 0x102552e9
mov dword [esi + 0x374c], 1
jmp 0x1025538c
comiss xmm1, xmm0
jae 0x102552f7
cmp byte [esi + 0x3750], 0
je 0x1025534f
push 0xc
xorps xmm0, xmm0
mov dword [ebp - 0x1c], 0
push str.override_key
lea ecx, [ebp - 0x2c]
mov dword [ebp - 0x18], 0
movups xmmword [ebp - 0x2c], xmm0
call fcn.10029750
mov eax, 1
mov dword [ebp - 4], 0
mov dword [ebp - 0x10], eax
mov ecx, 0x105b380c
mov dword [ebp + 8], eax
lea eax, [ebp - 0x2c]
push eax
call fcn.100267e0
push dword [eax]
call dword [sym.imp.USER32.dll_GetKeyState]
cwde
shr eax, 0x10
mov byte [ebp + 0xb], 1
test eax, eax
je 0x10255353
mov byte [ebp + 0xb], 0
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x10]
test al, 1
je 0x1025536f
and eax, 0xfffffffe
lea ecx, [ebp - 0x2c]
mov dword [ebp - 0x10], eax
call fcn.10027fc0
cmp byte [ebp + 0xb], 0
movss xmm0, dword [ebp - 0x14]
movss xmm1, dword [0x103e37c8]
je 0x1025538c
mov dword [esi + 0x374c], 2
test byte [esi + 0x369c], 1
je 0x1025544e
comiss xmm1, xmm0
jae 0x102553ab
cmp byte [esi + 0x3750], 0
je 0x1025544e
push 0xc
xorps xmm0, xmm0
mov dword [ebp - 0x4c], 0
push str.override_key
lea ecx, [ebp - 0x5c]
mov dword [ebp - 0x48], 0
movups xmmword [ebp - 0x5c], xmm0
call fcn.10029750
mov dword [ebp - 4], 1
mov ecx, 0x105b380c
mov eax, dword [ebp - 0x10]
or eax, 2
mov dword [ebp - 0x10], eax
mov dword [ebp + 8], eax
lea eax, [ebp - 0x5c]
push eax
call fcn.100267e0
push dword [eax]
call dword [sym.imp.USER32.dll_GetKeyState]
cwde
shr eax, 0x10
test eax, eax
je 0x1025544e
push 8
xorps xmm0, xmm0
mov dword [ebp - 0x34], 0
push str.override
lea ecx, [ebp - 0x44]
mov dword [ebp - 0x30], 0
movups xmmword [ebp - 0x44], xmm0
call fcn.10029750
mov dword [ebp - 4], 2
mov ecx, 0x105b37ec
mov eax, dword [ebp - 0x10]
or eax, 4
mov dword [ebp - 0x10], eax
mov dword [ebp + 8], eax
lea eax, [ebp - 0x44]
push eax
call fcn.10026800
mov byte [ebp + 0xb], 1
cmp byte [eax], 0
jne 0x10255452
mov byte [ebp + 0xb], 0
mov eax, dword [ebp - 0x10]
test al, 4
je 0x1025546a
and eax, 0xfffffffb
lea ecx, [ebp - 0x44]
mov dword [ebp - 0x10], eax
call fcn.10027fc0
mov eax, dword [ebp - 0x10]
test al, 2
je 0x10255476
lea ecx, [ebp - 0x5c]
call fcn.10027fc0
cmp byte [ebp + 0xb], 0
je 0x10255498
mov dword [esi + 0x374c], 8
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret 4
test byte [esi + 0x369c], 1
jne 0x102554ab
mov dword [esi + 0x374c], 5
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x10269410
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10338755
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
push ebx
push esi
push edi
mov eax, dword [0x1040e140]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov edx, dword [ebp + 0xc]
mov edi, dword [ebp + 8]
mov dword [ebp - 0x10], edx
mov dword [ebp - 0x20], edi
movzx eax, byte [edx]
xor eax, 0x811c9dc5
imul ecx, eax, 0x1000193
movzx eax, byte [edx + 1]
xor ecx, eax
movzx eax, byte [edx + 2]
imul ecx, ecx, 0x1000193
xor ecx, eax
movzx eax, byte [edx + 3]
imul ecx, ecx, 0x1000193
xor ecx, eax
imul eax, ecx, 0x1000193
mov ecx, ebx
push eax
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x1c]
push edx
push eax
call fcn.1002a930
mov eax, dword [ebp - 0x18]
test eax, eax
je 0x1026949a
mov dword [edi], eax
mov byte [edi + 4], 0
jmp 0x102695be
cmp dword [ebx + 8], 0xfffffff
je 0x102695d4
lea eax, [ebx + 4]
mov dword [ebp - 0x28], eax
mov dword [ebp - 4], 0
push 0x10
mov dword [ebp - 0x24], 0
call fcn.102e08b1
mov ecx, dword [ebp - 0x10]
mov esi, eax
add esp, 4
mov dword [ebp - 0x24], esi
mov ecx, dword [ecx]
mov dword [esi + 8], ecx
mov byte [esi + 0xc], 0
mov dword [ebp - 4], 1
mov eax, dword [ebx + 8]
inc eax
movss xmm3, dword [ebx]
movd xmm0, eax
cvtdq2pd xmm0, xmm0
shr eax, 0x1f
addsd xmm0, qword [eax*8 + 0x103e4170]
mov eax, dword [ebx + 0x1c]
movd xmm1, eax
cvtdq2pd xmm1, xmm1
shr eax, 0x1f
cvtpd2ps xmm0, xmm0
addsd xmm1, qword [eax*8 + 0x103e4170]
movaps xmm2, xmm0
cvtpd2ps xmm1, xmm1
divss xmm2, xmm1
comiss xmm2, xmm3
jbe 0x10269571
divss xmm0, xmm3
call fcn.10019770
call fcn.102e1840
mov ecx, 8
cmp eax, ecx
cmova ecx, eax
mov eax, dword [ebx + 0x1c]
cmp eax, ecx
jae 0x10269553
cmp eax, 0x200
jae 0x10269551
shl eax, 3
cmp eax, ecx
jae 0x10269553
mov eax, ecx
push eax
mov ecx, ebx
call fcn.100285c0
push dword [ebp - 0x14]
lea eax, [esi + 8]
mov ecx, ebx
push eax
lea eax, [ebp - 0x1c]
push eax
call fcn.1002a930
mov edx, dword [eax]
jmp 0x10269574
mov edx, dword [ebp - 0x1c]
mov eax, dword [edx + 4]
inc dword [ebx + 8]
mov edi, dword [ebp - 0x28]
mov dword [esi + 4], eax
mov dword [esi], edx
mov dword [eax], esi
mov dword [edx + 4], esi
mov ecx, dword [ebx + 0xc]
mov dword [ebp - 0x10], eax
mov eax, dword [ebx + 0x18]
and eax, dword [ebp - 0x14]
mov ebx, dword [ecx + eax*8]
cmp ebx, dword [edi]
jne 0x1026959f
mov dword [ecx + eax*8], esi
jmp 0x102695b1
cmp ebx, edx
jne 0x102695a8
mov dword [ecx + eax*8], esi
jmp 0x102695b5
mov edx, dword [ebp - 0x10]
cmp dword [ecx + eax*8 + 4], edx
jne 0x102695b5
mov dword [ecx + eax*8 + 4], esi
mov edi, dword [ebp - 0x20]
mov dword [edi], esi
mov byte [edi + 4], 1
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
push str.unordered_map_set_too_long
call fcn.102df107
int3
Function at 0x102699f0
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10338755
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
push ebx
push esi
push edi
mov eax, dword [0x1040e140]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov edx, dword [ebp + 0xc]
mov edi, dword [ebp + 8]
mov dword [ebp - 0x10], edx
mov dword [ebp - 0x20], edi
movzx eax, byte [edx]
xor eax, 0x811c9dc5
imul ecx, eax, 0x1000193
movzx eax, byte [edx + 1]
xor ecx, eax
movzx eax, byte [edx + 2]
imul ecx, ecx, 0x1000193
xor ecx, eax
movzx eax, byte [edx + 3]
imul ecx, ecx, 0x1000193
xor ecx, eax
imul eax, ecx, 0x1000193
mov ecx, ebx
push eax
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x1c]
push edx
push eax
call fcn.1002a930
mov eax, dword [ebp - 0x18]
test eax, eax
je 0x10269a7a
mov dword [edi], eax
mov byte [edi + 4], 0
jmp 0x10269ba0
cmp dword [ebx + 8], 0xfffffff
je 0x10269bb6
lea eax, [ebx + 4]
mov dword [ebp - 0x28], eax
mov dword [ebp - 4], 0
push 0x10
mov dword [ebp - 0x24], 0
call fcn.102e08b1
mov edx, dword [ebp - 0x10]
mov esi, eax
add esp, 4
mov dword [ebp - 0x24], esi
mov ecx, dword [edx]
mov edx, dword [edx + 4]
mov dword [esi + 8], ecx
mov dword [esi + 0xc], edx
mov dword [ebp - 4], 1
mov eax, dword [ebx + 8]
inc eax
movss xmm3, dword [ebx]
movd xmm0, eax
cvtdq2pd xmm0, xmm0
shr eax, 0x1f
addsd xmm0, qword [eax*8 + 0x103e4170]
mov eax, dword [ebx + 0x1c]
movd xmm1, eax
cvtdq2pd xmm1, xmm1
shr eax, 0x1f
cvtpd2ps xmm0, xmm0
addsd xmm1, qword [eax*8 + 0x103e4170]
movaps xmm2, xmm0
cvtpd2ps xmm1, xmm1
divss xmm2, xmm1
comiss xmm2, xmm3
jbe 0x10269b53
divss xmm0, xmm3
call fcn.10019770
call fcn.102e1840
mov ecx, 8
cmp eax, ecx
cmova ecx, eax
mov eax, dword [ebx + 0x1c]
cmp eax, ecx
jae 0x10269b35
cmp eax, 0x200
jae 0x10269b33
shl eax, 3
cmp eax, ecx
jae 0x10269b35
mov eax, ecx
push eax
mov ecx, ebx
call fcn.100285c0
push dword [ebp - 0x14]
lea eax, [esi + 8]
mov ecx, ebx
push eax
lea eax, [ebp - 0x1c]
push eax
call fcn.1002a930
mov edx, dword [eax]
jmp 0x10269b56
mov edx, dword [ebp - 0x1c]
mov eax, dword [edx + 4]
inc dword [ebx + 8]
mov edi, dword [ebp - 0x28]
mov dword [esi + 4], eax
mov dword [esi], edx
mov dword [eax], esi
mov dword [edx + 4], esi
mov ecx, dword [ebx + 0xc]
mov dword [ebp - 0x10], eax
mov eax, dword [ebx + 0x18]
and eax, dword [ebp - 0x14]
mov ebx, dword [ecx + eax*8]
cmp ebx, dword [edi]
jne 0x10269b81
mov dword [ecx + eax*8], esi
jmp 0x10269b93
cmp ebx, edx
jne 0x10269b8a
mov dword [ecx + eax*8], esi
jmp 0x10269b97
mov edx, dword [ebp - 0x10]
cmp dword [ecx + eax*8 + 4], edx
jne 0x10269b97
mov dword [ecx + eax*8 + 4], esi
mov edi, dword [ebp - 0x20]
mov dword [edi], esi
mov byte [edi + 4], 1
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
push str.unordered_map_set_too_long
call fcn.102df107
int3
Function at 0x102cb930
Capabilities:
Read file on windows

Disassembly:
mov eax, 0x101c
call fcn.102e1330
mov eax, dword [0x1040e140]
xor eax, esp
mov dword [esp + 0x1018], eax
push ebx
mov ebx, dword [esp + 0x1028]
push ebp
push esi
push edi
mov edi, dword [esp + 0x1030]
push edi
call fcn.102bf120
push ebx
mov esi, eax
call fcn.102f8bdd
add esp, 8
sub esi, 1
jne 0x102cb98b
push 1
push ebx
push edi
call fcn.102cc040
mov ebp, dword [esp + 0x1044]
add esp, 0xc
mov esi, eax
inc ebp
jmp 0x102cbb0e
push str.too_many_arguments
lea eax, [esi + 0x14]
push eax
push edi
call fcn.102c09c0
mov ebp, dword [esp + 0x1044]
mov eax, 1
add esp, 0xc
mov dword [esp + 0x10], eax
nop dword [eax]
dec esi
mov dword [esp + 0x14], esi
test eax, eax
je 0x102cbb0a
push ebp
push edi
call fcn.102c01a0
add esp, 8
cmp eax, 3
jne 0x102cba52
push ebp
push edi
call fcn.102c0810
mov esi, eax
add esp, 8
test esi, esi
jne 0x102cba0e
push ebx
call fcn.102eaf28
mov esi, eax
push ebx
push esi
call fcn.102eb711
push 0x10359640
push edi
call fcn.102bf6e0
xor eax, eax
add esp, 0x14
cmp esi, 0xffffffff
mov esi, dword [esp + 0x14]
setne al
jmp 0x102cbafd
lea eax, [esp + 0x18]
push eax
push edi
call fcn.102c0790
lea eax, [esp + 0x20]
push esi
push eax
call fcn.102c1360
push ebx
push esi
push 1
push eax
call fcn.102eb998
mov esi, eax
lea eax, [esp + 0x38]
add dword [esp + 0x40], esi
push eax
call fcn.102c14e0
xor eax, eax
add esp, 0x24
cmp eax, esi
mov esi, dword [esp + 0x14]
sbb eax, eax
neg eax
jmp 0x102cbafd
push 0
push ebp
push edi
call fcn.102c0880
add esp, 0xc
mov cl, byte [eax]
cmp cl, 0x2a
jne 0x102cba68
mov cl, byte [eax + 1]
movsx eax, cl
add eax, 0xffffffb4
cmp eax, 0x22
ja case.0x102cba7e.77
movzx eax, byte [eax + 0x102cbb88]
jmp dword [eax*4 + 0x102cbb74]
push ebx
push edi
call fcn.102cc160
add esp, 8
jmp 0x102cbafd
push 1
push ebx
push edi
call fcn.102cc040
add esp, 0xc
jmp 0x102cbafd
push 0
push ebx
push edi
call fcn.102cc040
add esp, 0xc
jmp 0x102cbafd
lea eax, [esp + 0x18]
push eax
push edi
call fcn.102c0790
add esp, 8
nop dword [eax + eax]
lea eax, [esp + 0x18]
push 0x1000
push eax
call fcn.102c1360
push ebx
push 0x1000
push 1
push eax
call fcn.102eb998
add dword [esp + 0x38], eax
add esp, 0x18
cmp eax, 0x1000
je 0x102cbac0
lea eax, [esp + 0x18]
push eax
call fcn.102c14e0
add esp, 4
mov eax, 1
inc ebp
mov dword [esp + 0x10], eax
test esi, esi
jne 0x102cb9b0
mov esi, dword [esp + 0x10]
push ebx
call fcn.102f4911
add esp, 4
test eax, eax
je 0x102cbb3b
push 0
push 0
push edi
call fcn.102c0c60
add esp, 0xc
jmp 0x102cbb59
push str.invalid_format
push ebp
push edi
call fcn.102c0670
add esp, 0xc
jmp 0x102cbb59
test esi, esi
jne 0x102cbb50
push 0xfffffffffffffffe
push edi
call fcn.102bfd80
push edi
call fcn.102bf6a0
add esp, 0xc
sub ebp, dword [esp + 0x1038]
mov eax, ebp
mov ecx, dword [esp + 0x1028]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.102e0890
add esp, 0x101c
ret
Function at 0x102ce250
Capabilities:
Check http status code

Disassembly:
sub esp, 0xd8
mov eax, dword [0x1040e140]
xor eax, esp
mov dword [esp + 0xd4], eax
push ebx
mov ebx, dword [esp + 0xe4]
lea eax, [esp + 4]
push ebp
push esi
mov esi, dword [esp + 0xe8]
push edi
push eax
push esi
call fcn.102cd8f0
mov edx, eax
add esp, 8
test edx, edx
je 0x102ce2a6
mov ecx, dword [esp + 0x10]
sub edx, esi
mov dword [ebx], ecx
mov eax, 0x13
mov ecx, dword [esp + 0x14]
mov dword [ebx + 4], ecx
mov dword [ebx + 8], eax
lea eax, [edx + 1]
jmp 0x102ce2c5
push 0x1035b728
push esi
call fcn.102f6250
add esp, 8
test eax, eax
je 0x102ce2de
movzx edi, byte [eax]
or edi, 0x20
cmp edi, 0x6e
jne 0x102ce2e0
xor eax, eax
mov ecx, dword [esp + 0xe4]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.102e0890
add esp, 0xd8
ret
xor edi, edi
push edi
lea eax, [esp + 0x14]
push eax
push esi
call fcn.102cd880
mov edx, eax
add esp, 0xc
test edx, edx
jne 0x102ce36f
push 0x2e
push esi
call fcn.102e2800
mov edx, esi
mov ebp, eax
add esp, 8
lea eax, [edx + 1]
mov cl, byte [edx]
inc edx
test cl, cl
jne 0x102ce307
sub edx, eax
cmp edx, 0xc8
ja 0x102ce2c3
test ebp, ebp
je 0x102ce2c3
lea edx, [esp + 0x18]
mov ecx, esi
sub edx, esi
mov al, byte [ecx]
lea ecx, [ecx + 1]
mov byte [edx + ecx - 1], al
test al, al
jne 0x102ce324
call fcn.102ea629
sub ebp, esi
push edi
mov eax, dword [eax]
mov al, byte [eax]
mov byte [esp + ebp + 0x1c], al
lea eax, [esp + 0x14]
push eax
lea eax, [esp + 0x20]
push eax
call fcn.102cd880
mov edx, eax
add esp, 0xc
test edx, edx
je 0x102ce2c3
mov eax, esi
lea ecx, [esp + 0x18]
sub eax, ecx
add edx, eax
test edx, edx
je 0x102ce2c3
movsd xmm0, qword [esp + 0x10]
sub edx, esi
mov eax, 3
movsd qword [ebx], xmm0
mov dword [ebx + 8], eax
lea eax, [edx + 1]
jmp 0x102ce2c5
Function at 0x102ce4a0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
sub esp, 0x14
push esi
push edi
call fcn.102ea629
mov ecx, dword [esp + 0x20]
xor edi, edi
xor esi, esi
xorps xmm1, xmm1
mov eax, dword [eax]
movsx eax, byte [eax]
mov dword [esp + 0xc], eax
xor eax, eax
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], eax
mov eax, dword [esp + 0x24]
mov dword [eax], ecx
mov al, byte [ecx]
mov byte [esp + 0x23], al
movzx eax, al
test byte [eax + 0x1035c3d9], 8
je 0x102ce4f4
mov al, byte [ecx + 1]
inc ecx
mov byte [esp + 0x23], al
movzx eax, al
test byte [eax + 0x1035c3d9], 8
jne 0x102ce4e0
mov al, byte [esp + 0x23]
lea edx, [ecx + 1]
cmp al, 0x2d
jne 0x102ce509
mov dword [esp + 0x10], 1
jmp 0x102ce512
cmp al, 0x2b
mov dword [esp + 0x10], esi
cmovne edx, ecx
cmp byte [edx], 0x30
jne 0x102ce65a
mov al, byte [edx + 1]
cmp al, 0x78
je 0x102ce52a
cmp al, 0x58
jne 0x102ce65a
movsd xmm2, qword [0x1035abb0]
add edx, 2
mov al, byte [edx]
movsx ecx, al
mov dword [esp + 8], edx
mov byte [esp + 0x23], al
cmp ecx, dword [esp + 0xc]
jne 0x102ce55a
cmp dword [esp + 0x18], 0
jne 0x102ce5af
mov dword [esp + 0x18], 1
inc edx
jmp 0x102ce535
movzx eax, al
test byte [eax + 0x1035c3d9], 0x10
je 0x102ce5af
test edi, edi
jne 0x102ce577
cmp byte [esp + 0x23], 0x30
jne 0x102ce577
inc dword [esp + 0x14]
jmp 0x102ce5a4
inc edi
cmp edi, 0x1e
jg 0x102ce5a3
test byte [ecx + 0x1035c3d9], 2
je 0x102ce58b
add ecx, 0xffffffd0
jmp 0x102ce591
or ecx, 0x20
sub ecx, 0x57
movd xmm0, ecx
cvtdq2pd xmm0, xmm0
mulsd xmm1, xmm2
addsd xmm1, xmm0
jmp 0x102ce5a4
inc esi
cmp dword [esp + 0x18], 0
je 0x102ce5ac
dec esi
inc edx
jmp 0x102ce535
mov eax, dword [esp + 0x14]
add eax, edi
je 0x102ce65a
mov eax, dword [esp + 0x24]
shl esi, 2
mov dword [eax], edx
mov al, byte [edx]
cmp al, 0x70
je 0x102ce5ce
cmp al, 0x50
jne 0x102ce635
inc edx
xor ecx, ecx
mov dl, byte [edx]
cmp dl, 0x2d
jne 0x102ce5e0
lea edi, [ecx + 1]
lea eax, [ecx + 2]
jmp 0x102ce5eb
xor eax, eax
xor edi, edi
cmp dl, 0x2b
sete al
inc eax
mov edx, dword [esp + 8]
add edx, eax
mov al, byte [edx]
mov byte [esp + 0x23], al
movzx eax, al
test byte [eax + 0x1035c3d9], 2
je 0x102ce65a
movsx eax, byte [esp + 0x23]
lea ecx, [ecx + ecx*4]
inc edx
lea ecx, [ecx - 0x18]
lea ecx, [eax + ecx*2]
mov al, byte [edx]
mov byte [esp + 0x23], al
movzx eax, al
test byte [eax + 0x1035c3d9], 2
jne 0x102ce603
mov eax, ecx
neg eax
test edi, edi
cmove eax, ecx
add esi, eax
mov eax, dword [esp + 0x24]
mov dword [eax], edx
cmp dword [esp + 0x10], 0
je 0x102ce643
xorps xmm1, xmmword [0x103e41d0]
push esi
sub esp, 8
movsd qword [esp], xmm1
call fcn.102f638d
add esp, 0xc
pop edi
pop esi
add esp, 0x14
ret
fldz
pop edi
pop esi
add esp, 0x14
ret

Function at 0x102d1970
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, dword [esp + 0xc]
mov eax, esi
xor eax, dword [esp + 0x10]
push edi
mov edi, esi
shr edi, 5
inc edi
cmp esi, edi
jb 0x102d19ac
push ebx
mov ebx, dword [esp + 0x10]
nop dword [eax + eax]
movzx edx, byte [ebx + esi - 1]
mov ecx, eax
shl ecx, 5
sub esi, edi
add edx, ecx
mov ecx, eax
shr ecx, 2
add edx, ecx
xor eax, edx
cmp esi, edi
jae 0x102d1990
pop ebx
pop edi
pop esi
ret