joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10071fc0
Capabilities:
Allocate thread local storage

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1012bde8
mov eax, dword fs:[0]
push eax
sub esp, 8
push esi
mov eax, dword [0x101791e0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [0x10179110]
cmp eax, 0xffffffff
jne 0x10071ffa
call sub.KERNEL32.dll_TlsAlloc
mov dword [0x10179110], eax
push eax
call fcn.100ce040
add esp, 4
test eax, eax
jne 0x1007200c
call fcn.10071e30
mov esi, dword [eax + 0x14]
test esi, esi
je 0x10072074
mov ecx, esi
call fcn.1000ebf0
test al, al
je 0x10072086
push str.Context_has_been_lost.
lea eax, [ebp - 0x14]
push 0x505
push eax
call fcn.100119d0
add esp, 0xc
push eax
mov ecx, esi
mov dword [ebp - 4], 0
call fcn.1000ef00
mov esi, dword [ebp - 0x10]
test esi, esi
je 0x10072074
cmp dword [esi + 0x14], 0x10
jb 0x1007205a
push dword [esi]
call sub.MSVCR120.dll_void___cdecl_operator_delete_void__
add esp, 4
mov dword [esi + 0x14], 0xf
mov dword [esi + 0x10], 0
push esi
mov byte [esi], 0
call sub.MSVCR120.dll_void___cdecl_operator_delete_void__
add esp, 4
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x100720a0
Capabilities:
Allocate thread local storage

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [0x10179110]
cmp eax, 0xffffffff
jne 0x100720b7
call sub.KERNEL32.dll_TlsAlloc
mov dword [0x10179110], eax
push eax
call fcn.100ce040
add esp, 4
test eax, eax
jne 0x100720c9
call fcn.10071e30
mov ecx, dword [ebp + 8]
mov dword [eax + 4], ecx
pop ebp
ret

Function at 0x100720e0
Capabilities:
Allocate thread local storage

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [0x10179110]
cmp eax, 0xffffffff
jne 0x100720f7
call sub.KERNEL32.dll_TlsAlloc
mov dword [0x10179110], eax
push eax
call fcn.100ce040
add esp, 4
test eax, eax
jne 0x10072109
call fcn.10071e30
mov ecx, dword [ebp + 8]
mov dword [eax + 0x14], ecx
pop ebp
ret

Function at 0x10072120
Capabilities:
Allocate thread local storage

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [0x10179110]
cmp eax, 0xffffffff
jne 0x10072137
call sub.KERNEL32.dll_TlsAlloc
mov dword [0x10179110], eax
push eax
call fcn.100ce040
add esp, 4
test eax, eax
jne 0x10072149
call fcn.10071e30
mov ecx, dword [ebp + 8]
mov dword [eax + 8], ecx
pop ebp
ret

Function at 0x10072160
Capabilities:
Allocate thread local storage

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [0x10179110]
cmp eax, 0xffffffff
jne 0x10072177
call sub.KERNEL32.dll_TlsAlloc
mov dword [0x10179110], eax
push eax
call fcn.100ce040
add esp, 4
test eax, eax
jne 0x10072189
call fcn.10071e30
mov ecx, dword [ebp + 8]
mov dword [eax + 0xc], ecx
pop ebp
ret
Function at 0x100721a0
Capabilities:
Allocate thread local storage

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [0x10179110]
cmp eax, 0xffffffff
jne 0x100721b7
call sub.KERNEL32.dll_TlsAlloc
mov dword [0x10179110], eax
push eax
call fcn.100ce040
add esp, 4
test eax, eax
jne 0x100721c9
call fcn.10071e30
mov ecx, dword [ebp + 8]
mov ecx, dword [ecx]
mov dword [eax], ecx
pop ebp
ret

Function at 0x100721e0
Capabilities:
Allocate thread local storage

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [0x10179110]
cmp eax, 0xffffffff
jne 0x100721f7
call sub.KERNEL32.dll_TlsAlloc
mov dword [0x10179110], eax
push eax
call fcn.100ce040
add esp, 4
test eax, eax
jne 0x10072209
call fcn.10071e30
mov ecx, dword [ebp + 8]
mov dword [eax + 0x10], ecx
pop ebp
ret

Function at 0x10072220
Capabilities:
Allocate thread local storage

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
cmp eax, 3
ja case.default.0x1007222f
jmp dword [eax*4 + 0x100722cc]
call sub.KERNEL32.dll_TlsAlloc
mov dword [0x10179110], eax
cmp eax, 0xffffffff
jne case.0x1007222f.2
xor eax, eax
pop ebp
ret 0xc
call fcn.10071e30
mov eax, 1
pop ebp
ret 0xc
push dword [0x10179110]
call fcn.100ce040
push eax
call sub.MSVCR120.dll_void___cdecl_operator_delete_void__
push 0
push dword [0x10179110]
call fcn.100ce060
add esp, 0x10
mov eax, 1
pop ebp
ret 0xc
push dword [0x10179110]
call fcn.100ce040
push eax
call sub.MSVCR120.dll_void___cdecl_operator_delete_void__
push 0
push dword [0x10179110]
call fcn.100ce060
mov eax, dword [0x10179110]
add esp, 0x10
cmp eax, 0xffffffff
je case.default.0x1007222f
push eax
call fcn.100ce020
add esp, 4
mov dword [0x10179110], 0xffffffff
mov eax, 1
pop ebp
ret 0xc

Function at 0x10077520
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1012d0a8
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x101791e0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
mov eax, dword [ebp + 8]
mov dword [esi + 4], eax
mov dword [esi + 8], 0
mov dword [esi + 0xc], 4
mov dword [esi + 0x10], 0
mov dword [esi], vtable.rx::Buffer11::PackStorage.0
lea ecx, [esi + 0x28]
mov dword [esi + 0x14], 0
mov dword [esi + 0x18], 0
mov dword [ebp - 4], 0
mov dword [esi + 0x1c], 0
mov dword [esi + 0x20], 0
mov dword [esi + 0x24], 0
call fcn.100024a0
lea ecx, [esi + 0x34]
mov dword [esi + 0x30], 0
call fcn.100774b0
mov byte [esi + 0x74], 0
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x100aa290
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1012e8b8
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
push esi
mov eax, dword [0x101791e0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
call fcn.1004f730
mov eax, dword [ebp + 0x18]
mov ecx, dword [ebp + 0xc]
mov dword [esi + 0xc], eax
mov eax, dword [ebp + 0x1c]
mov dword [esi + 0x10], eax
mov eax, dword [ebp + 0x20]
mov dword [esi + 0x14], eax
mov eax, dword [ebp + 0x14]
mov dword [esi + 0x18], eax
mov eax, dword [ebp + 0x24]
mov dword [esi + 0x20], eax
mov eax, dword [ebp + 8]
mov dword [esi + 0x30], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 4], 0
mov dword [esi], vtable.rx::TextureRenderTarget11.0
mov dword [esi + 0x1c], 0
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], ecx
mov dword [esi + 0x2c], 0
mov dword [esi + 0x34], eax
test ecx, ecx
je 0x100aa31c
mov eax, dword [ecx]
push ecx
call dword [eax + 4]
mov ecx, dword [esi + 0x30]
test ecx, ecx
je 0x100aa329
mov eax, dword [ecx]
push ecx
call dword [eax + 4]
mov ecx, dword [esi + 0x34]
test ecx, ecx
je 0x100aa336
mov eax, dword [ecx]
push ecx
call dword [eax + 4]
mov eax, dword [esi + 0x30]
test eax, eax
je 0x100aa364
mov ecx, dword [esi + 0x28]
test ecx, ecx
je 0x100aa364
push eax
push ecx
call fcn.100aa590
mov dword [esi + 0x24], eax
lea edx, [ebp - 0x28]
mov eax, dword [esi + 0x30]
add esp, 8
mov ecx, dword [eax]
push edx
push eax
call dword [ecx + 0x20]
mov eax, dword [ebp - 0x28]
mov dword [esi + 0x1c], eax
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret 0x20
Function at 0x100aa380
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1012e8e8
mov eax, dword fs:[0]
push eax
sub esp, 0x18
push esi
mov eax, dword [0x101791e0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
call fcn.1004f730
mov eax, dword [ebp + 0x18]
mov ecx, dword [ebp + 0xc]
mov dword [esi + 0xc], eax
mov eax, dword [ebp + 0x1c]
mov dword [esi + 0x10], eax
mov eax, dword [ebp + 0x20]
mov dword [esi + 0x14], eax
mov eax, dword [ebp + 0x14]
mov dword [esi + 0x18], eax
mov eax, dword [ebp + 0x24]
mov dword [esi + 0x20], eax
mov eax, dword [ebp + 8]
mov dword [esi + 0x2c], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 4], 0
mov dword [esi], vtable.rx::TextureRenderTarget11.0
mov dword [esi + 0x1c], 0
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], ecx
mov dword [esi + 0x30], 0
mov dword [esi + 0x34], eax
test ecx, ecx
je 0x100aa40c
mov eax, dword [ecx]
push ecx
call dword [eax + 4]
mov ecx, dword [esi + 0x2c]
test ecx, ecx
je 0x100aa419
mov eax, dword [ecx]
push ecx
call dword [eax + 4]
mov ecx, dword [esi + 0x34]
test ecx, ecx
je 0x100aa426
mov eax, dword [ecx]
push ecx
call dword [eax + 4]
mov eax, dword [esi + 0x2c]
test eax, eax
je 0x100aa454
mov ecx, dword [esi + 0x28]
test ecx, ecx
je 0x100aa454
push eax
push ecx
call fcn.100aa690
mov dword [esi + 0x24], eax
lea edx, [ebp - 0x24]
mov eax, dword [esi + 0x2c]
add esp, 8
mov ecx, dword [eax]
push edx
push eax
call dword [ecx + 0x20]
mov eax, dword [ebp - 0x24]
mov dword [esi + 0x1c], eax
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret 0x20
Function at 0x100ac810
Capabilities:
Access peb ldr_data
Get ntdll base address
Get number of processors

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1012ead3
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x101791e0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x10], edi
mov eax, dword [ebp + 0xc]
mov dword [edi + 4], eax
mov eax, dword [ebp + 0x14]
mov dword [edi + 8], eax
mov eax, dword [ebp + 0x18]
mov dword [edi + 0xc], eax
mov eax, dword [ebp + 0x10]
mov dword [edi + 0x10], eax
mov esi, dword [ebp + 8]
lea ecx, [edi + 0x64]
push 0
push esi
push edi
mov dword [ebp - 4], 0
mov dword [edi], vtable.rx::SwapChain11.0
mov dword [edi + 0x14], esi
call fcn.100aa260
push 1
push esi
push edi
lea ecx, [edi + 0x7c]
mov byte [ebp - 4], 1
call fcn.100aa260
cmp dword [edi + 0x10], 0
mov dword [edi + 0x2c], 0
setne al
mov dword [edi + 0x30], 0
mov byte [edi + 0x20], al
mov eax, edi
mov dword [edi + 0x34], 0
mov dword [edi + 0x38], 0
mov dword [edi + 0x3c], 0
mov dword [edi + 0x40], 0
mov dword [edi + 0x44], 0
mov dword [edi + 0x48], 0
mov dword [edi + 0x4c], 0
mov dword [edi + 0x50], 0
mov dword [edi + 0x54], 0
mov dword [edi + 0x58], 0
mov dword [edi + 0x5c], 0
mov dword [edi + 0x60], 0
mov dword [edi + 0x1c], 0xffffffff
mov dword [edi + 0x18], 0xffffffff
mov dword [edi + 0x24], 0
mov byte [edi + 0x28], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 0x14
Function at 0x100ae510
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1012eb78
mov eax, dword fs:[0]
push eax
sub esp, 0x60
mov eax, dword [0x101791e0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov eax, dword [ebp + 8]
mov edi, dword [ebp + 0xc]
push 0x28
push eax
mov dword [ebp - 0x40], esi
call fcn.100ae220
mov dword [esi], vtable.rx::TextureStorage11_2D.0
mov ecx, edi
mov eax, dword [edi]
mov dword [ebp - 4], 0
call dword [eax + 0x20]
mov ecx, eax
mov dword [esi + 0x1bc], 0
mov dword [esi + 0x17c], ecx
mov dword [esi + 0x1c0], 0
mov byte [esi + 0x1c4], 0
mov dword [esi + 0x1c8], 0
mov eax, dword [ecx]
push ecx
call dword [eax + 4]
lea eax, [esi + 0x180]
mov ecx, 0xf
nop
mov dword [eax + 0x88], 0
lea eax, [eax + 4]
mov dword [eax - 4], 0
mov dword [eax + 0x48], 0
dec ecx
jne 0x100ae5a0
mov eax, dword [esi + 0x17c]
lea edx, [ebp - 0x3c]
push edx
push eax
mov ecx, dword [eax]
call dword [ecx + 0x28]
mov eax, dword [ebp - 0x34]
mov ecx, edi
mov dword [esi + 0x14], eax
mov eax, dword [ebp - 0x2c]
mov dword [esi + 0x1c], eax
mov eax, dword [ebp - 0x3c]
mov dword [esi + 0x38], eax
mov eax, dword [ebp - 0x38]
mov dword [esi + 0x3c], eax
mov dword [esi + 0x40], 1
mov eax, dword [edi + 8]
mov dword [esi + 0x18], eax
mov eax, dword [edi]
call dword [eax + 0x28]
lea ecx, [ebp - 0x6c]
push ecx
push eax
mov edx, dword [eax]
call dword [edx + 0x20]
mov eax, dword [ebp - 0x6c]
mov ecx, edi
mov dword [esi + 0x20], eax
mov eax, dword [edi]
call dword [eax + 0x24]
lea edx, [ebp - 0x54]
push edx
push eax
mov ecx, dword [eax]
call dword [ecx + 0x20]
mov eax, dword [ebp - 0x54]
push dword [esi + 0x1c]
mov dword [esi + 0x24], eax
call fcn.10099be0
mov ecx, eax
mov eax, dword [esi + 0xc]
push dword [eax + 0x814]
push dword [ecx + 0x30]
call fcn.10099ce0
mov edx, eax
add esp, 0xc
mov eax, dword [edx + 0x14]
mov dword [esi + 0x2c], eax
mov ecx, dword [edx + 0x18]
mov dword [esi + 0x30], ecx
mov ecx, dword [edx + 0x1c]
push 1
mov dword [esi + 0x34], ecx
mov ecx, esi
push 1
mov dword [esi + 0x28], 0
call fcn.10059dd0
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.10125970
mov esp, ebp
pop ebp
ret 8
Function at 0x100ae690
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1012ebc4
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x101791e0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x10], edi
mov eax, dword [ebp + 8]
xor esi, esi
push dword [eax + 0x814]
push dword [ebp + 0xc]
call fcn.10099ce0
add esp, 8
mov ecx, 8
cmp dword [eax + 4], esi
cmovne esi, ecx
cmp dword [eax + 0xc], 0
je 0x100ae6e4
or esi, 0x40
cmp dword [eax + 8], 0
je 0x100ae6f3
cmp byte [ebp + 0x10], 0
je 0x100ae6f3
or esi, 0x20
push esi
mov esi, dword [ebp + 8]
mov ecx, edi
push esi
call fcn.100ae220
mov dword [edi], vtable.rx::TextureStorage11_2DArray.0
push 0x1c
mov dword [ebp - 4], 0
mov dword [edi + 0x17c], 0
mov dword [edi + 0x180], 0
call sub.MSVCR120.dll_void____cdecl_operator_new_unsigned_int_
add esp, 4
test eax, eax
jne 0x100ae734
call dword [sym.imp.MSVCP120.dll_void___cdecl_std::_Xbad_alloc_void_]
lea ecx, [eax + 4]
mov dword [eax], eax
test ecx, ecx
je 0x100ae73f
mov dword [ecx], eax
lea ecx, [eax + 8]
test ecx, ecx
je 0x100ae748
mov dword [ecx], eax
mov word [eax + 0xc], 0x101
mov dword [edi + 0x17c], eax
push 0x1c
mov byte [ebp - 4], 1
mov dword [edi + 0x1c8], 0
mov dword [edi + 0x1cc], 0
call sub.MSVCR120.dll_void____cdecl_operator_new_unsigned_int_
add esp, 4
test eax, eax
jne 0x100ae780
call dword [sym.imp.MSVCP120.dll_void___cdecl_std::_Xbad_alloc_void_]
lea ecx, [eax + 4]
mov dword [eax], eax
test ecx, ecx
je 0x100ae78b
mov dword [ecx], eax
lea ecx, [eax + 8]
test ecx, ecx
je 0x100ae794
mov dword [ecx], eax
mov word [eax + 0xc], 0x101
mov dword [edi + 0x1c8], eax
mov eax, dword [ebp + 0xc]
xorps xmm0, xmm0
mov dword [edi + 0x184], 0
mov dword [edi + 0x188], 0
movdqu xmmword [edi + 0x18c], xmm0
mov byte [ebp - 4], 2
movdqu xmmword [edi + 0x19c], xmm0
movdqu xmmword [edi + 0x1ac], xmm0
movq qword [edi + 0x1bc], xmm0
mov dword [edi + 0x1c4], 0
mov dword [edi + 0x18], eax
push dword [esi + 0x814]
push eax
call fcn.10099ce0
mov edx, eax
lea esi, [edi + 0x10]
push esi
mov ecx, dword [edx]
mov dword [edi + 0x1c], ecx
mov ecx, dword [edx + 4]
mov dword [edi + 0x20], ecx
mov ecx, dword [edx + 0xc]
mov dword [edi + 0x28], ecx
mov ecx, dword [edx + 8]
mov dword [edi + 0x24], ecx
mov eax, dword [edx + 0x14]
mov dword [edi + 0x2c], eax
mov eax, dword [edx + 0x18]
mov dword [edi + 0x30], eax
mov eax, dword [edx + 0x1c]
mov dword [edi + 0x34], eax
lea eax, [ebp + 0x18]
push eax
lea eax, [ebp + 0x14]
push eax
push dword [edi + 0x1c]
push 0
call fcn.100a9d70
mov edx, dword [ebp + 0x20]
add esp, 0x1c
add edx, dword [esi]
mov ecx, edi
mov eax, dword [ebp + 0x14]
mov dword [edi + 0x38], eax
mov eax, dword [ebp + 0x18]
mov dword [edi + 0x14], edx
sub edx, dword [esi]
mov dword [edi + 0x3c], eax
mov eax, dword [ebp + 0x1c]
imul edx, eax
push eax
mov dword [edi + 0x40], eax
push edx
call fcn.10059dd0
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 0x1c
Function at 0x100ae880
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1012ebf6
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x101791e0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x10], edi
mov ebx, dword [ebp + 8]
xor esi, esi
push dword [ebx + 0x814]
push dword [ebp + 0xc]
call fcn.10099ce0
add esp, 8
mov ecx, 8
cmp dword [eax + 4], esi
cmovne esi, ecx
cmp dword [eax + 0xc], 0
je 0x100ae8d5
or esi, 0x40
cmp dword [eax + 8], 0
je 0x100ae8e4
cmp byte [ebp + 0x10], 0
je 0x100ae8e4
or esi, 0x20
push esi
push ebx
mov ecx, edi
call fcn.100ae220
mov dword [edi], vtable.rx::TextureStorage11_3D.0
push 0x1c
mov dword [ebp - 4], 0
mov dword [edi + 0x17c], 0
mov dword [edi + 0x180], 0
call sub.MSVCR120.dll_void____cdecl_operator_new_unsigned_int_
add esp, 4
test eax, eax
jne 0x100ae922
call dword [sym.imp.MSVCP120.dll_void___cdecl_std::_Xbad_alloc_void_]
lea ecx, [eax + 4]
mov dword [eax], eax
test ecx, ecx
je 0x100ae92d
mov dword [ecx], eax
lea ecx, [eax + 8]
test ecx, ecx
je 0x100ae936
mov dword [ecx], eax
mov word [eax + 0xc], 0x101
mov dword [edi + 0x17c], eax
mov byte [ebp - 4], 1
lea eax, [edi + 0x184]
mov dword [edi + 0x1c0], 0
mov ecx, 0xf
mov dword [edi + 0x1c4], 0
jmp 0x100ae970
mov dword [eax + 0x80], 0
lea eax, [eax + 4]
mov dword [eax - 4], 0
mov dword [eax + 0x40], 0
dec ecx
jne 0x100ae970
mov eax, dword [ebp + 0xc]
mov dword [edi + 0x18], eax
push dword [ebx + 0x814]
push eax
call fcn.10099ce0
mov edx, eax
lea esi, [edi + 0x10]
push esi
mov ecx, dword [edx]
mov dword [edi + 0x1c], ecx
mov ecx, dword [edx + 4]
mov dword [edi + 0x20], ecx
mov ecx, dword [edx + 0xc]
mov dword [edi + 0x28], ecx
mov ecx, dword [edx + 8]
mov dword [edi + 0x24], ecx
mov eax, dword [edx + 0x14]
mov dword [edi + 0x2c], eax
mov eax, dword [edx + 0x18]
mov dword [edi + 0x30], eax
mov eax, dword [edx + 0x1c]
mov dword [edi + 0x34], eax
lea eax, [ebp + 0x18]
push eax
lea eax, [ebp + 0x14]
push eax
push dword [edi + 0x1c]
push 0
call fcn.100a9d70
mov edx, dword [ebp + 0x20]
add esp, 0x1c
add edx, dword [esi]
mov ecx, edi
mov eax, dword [ebp + 0x14]
mov dword [edi + 0x38], eax
mov eax, dword [ebp + 0x18]
mov dword [edi + 0x14], edx
sub edx, dword [esi]
mov dword [edi + 0x3c], eax
mov eax, dword [ebp + 0x1c]
imul edx, eax
push eax
mov dword [edi + 0x40], eax
push edx
call fcn.10059dd0
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x1c
Function at 0x100c4c50
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
mov ebx, ecx
cmp dword [edi + 0x1c], 0x10
lea edx, [edi + 8]
mov eax, dword [edx + 0x10]
mov dword [ebp - 8], edi
jb 0x100c4c6f
mov edx, dword [edx]
xor ecx, ecx
mov esi, 0x811c9dc5
test eax, eax
je 0x100c4c94
mov edi, eax
lea esp, [esp]
movzx eax, byte [edx + ecx]
inc ecx
xor eax, esi
imul esi, eax, 0x1000193
cmp ecx, edi
jb 0x100c4c80
mov edi, dword [ebp - 8]
mov edx, dword [ebx + 0x14]
mov ecx, edx
and ecx, esi
cmp dword [ebx + 0x18], ecx
ja 0x100c4ca9
shr edx, 1
or eax, 0xffffffff
sub eax, edx
add ecx, eax
lea edx, [ecx*8]
mov ecx, dword [ebx + 8]
add ecx, edx
cmp dword [ecx + 4], edi
jne 0x100c4cd5
cmp dword [ecx], edi
jne 0x100c4ccd
mov eax, dword [ebx]
mov dword [ecx], eax
mov ecx, dword [ebx + 8]
mov eax, dword [ebx]
mov dword [edx + ecx + 4], eax
jmp 0x100c4cdd
mov eax, dword [edi + 4]
mov dword [ecx + 4], eax
jmp 0x100c4cdd
cmp dword [ecx], edi
jne 0x100c4ce0
mov eax, dword [edi]
mov dword [ecx], eax
mov edi, dword [ebp + 0xc]
mov eax, dword [edi + 4]
mov esi, dword [edi]
mov dword [eax], esi
mov ecx, dword [edi]
mov eax, dword [edi + 4]
mov dword [ecx + 4], eax
dec dword [ebx + 4]
cmp dword [edi + 0x1c], 0x10
jb 0x100c4d03
push dword [edi + 8]
call sub.MSVCR120.dll_void___cdecl_operator_delete_void__
add esp, 4
mov dword [edi + 0x1c], 0xf
mov dword [edi + 0x18], 0
push edi
mov byte [edi + 8], 0
call sub.MSVCR120.dll_void___cdecl_operator_delete_void__
mov eax, dword [ebp + 8]
add esp, 4
pop edi
mov dword [eax], esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x100c6d70
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [ebp + 0xc]
push ebx
push esi
mov ebx, ecx
mov ecx, dword [eax + 0x14]
mov dword [ebp - 8], ecx
push edi
mov edi, dword [eax + 0x10]
mov dword [ebp - 4], edi
cmp ecx, 0x10
jb 0x100c6d93
mov esi, dword [eax]
jmp 0x100c6d95
mov esi, eax
xor ecx, ecx
mov edx, 0x811c9dc5
test edi, edi
je 0x100c6db1
movzx eax, byte [esi + ecx]
inc ecx
xor eax, edx
imul edx, eax, 0x1000193
cmp ecx, edi
jb 0x100c6da0
mov ecx, dword [ebx + 0x14]
mov edi, ecx
and edi, edx
cmp dword [ebx + 0x18], edi
ja 0x100c6dc6
shr ecx, 1
or eax, 0xffffffff
sub eax, ecx
add edi, eax
mov ecx, dword [ebx + 8]
lea eax, [edi + edi]
mov edx, dword [ebx]
lea eax, [eax + 1]
mov ebx, dword [ebp - 4]
mov dword [ebp - 0xc], edx
mov esi, dword [ecx + edi*8]
mov edi, dword [ecx + eax*4 - 4]
lea eax, [ecx + eax*4]
mov dword [ebp - 0x10], edi
mov dword [ebp - 0x14], eax
cmp edi, edx
jne 0x100c6def
mov eax, edx
jmp 0x100c6df3
mov eax, dword [eax]
mov eax, dword [eax]
cmp esi, eax
je 0x100c6f13
cmp dword [ebp - 8], 0x10
lea ecx, [esi + 8]
jb 0x100c6e0b
mov eax, dword [ebp + 0xc]
mov edi, dword [eax]
jmp 0x100c6e0e
mov edi, dword [ebp + 0xc]
cmp dword [ecx + 0x14], 0x10
mov eax, dword [ecx + 0x10]
mov dword [ebp - 4], eax
jb 0x100c6e1c
mov ecx, dword [ecx]
cmp eax, ebx
mov edx, ebx
cmovb edx, eax
test edx, edx
je 0x100c6e83
sub edx, 4
jb 0x100c6e41
lea esp, [esp]
mov eax, dword [ecx]
cmp eax, dword [edi]
jne 0x100c6e46
add ecx, 4
add edi, 4
sub edx, 4
jae 0x100c6e30
cmp edx, 0xfffffffc
je 0x100c6e7a
mov al, byte [ecx]
cmp al, byte [edi]
jne 0x100c6e73
cmp edx, 0xfffffffd
je 0x100c6e7a
mov al, byte [ecx + 1]
cmp al, byte [edi + 1]
jne 0x100c6e73
cmp edx, 0xfffffffe
je 0x100c6e7a
mov al, byte [ecx + 2]
cmp al, byte [edi + 2]
jne 0x100c6e73
cmp edx, 0xffffffff
je 0x100c6e7a
mov al, byte [ecx + 3]
cmp al, byte [edi + 3]
je 0x100c6e7a
sbb eax, eax
or eax, 1
jmp 0x100c6e7c
xor eax, eax
test eax, eax
jne 0x100c6e93
mov eax, dword [ebp - 4]
cmp eax, ebx
jb 0x100c6e93
xor eax, eax
cmp dword [ebp - 4], ebx
setne al
test eax, eax
je 0x100c6ea3
mov esi, dword [esi]
mov edx, dword [ebp - 0xc]
mov edi, dword [ebp - 0x10]
mov eax, dword [ebp - 0x14]
jmp 0x100c6de7
cmp dword [esi + 0x1c], 0x10
lea ecx, [esi + 8]
mov edi, dword [ecx + 0x10]
jb 0x100c6eb1
mov ecx, dword [ecx]
cmp dword [ebp - 8], 0x10
jb 0x100c6ebf
mov eax, dword [ebp + 0xc]
mov eax, dword [eax]
mov dword [ebp + 0xc], eax
cmp ebx, edi
mov eax, edi
cmovb eax, ebx
push eax
push ecx
push dword [ebp + 0xc]
call fcn.1000b8a0
add esp, 0xc
test eax, eax
jne 0x100c6efa
cmp ebx, edi
jb 0x100c6efa
cmp ebx, edi
setne al
test eax, eax
jne 0x100c6efa
mov eax, dword [ebp + 8]
lea ecx, [ebp + 0xc]
pop edi
mov dword [ebp + 0xc], esi
mov ecx, dword [ecx]
pop esi
mov dword [eax], ecx
pop ebx
mov esp, ebp
pop ebp
ret 8
mov eax, dword [ebp - 0xc]
lea ecx, [ebp + 0xc]
mov dword [ebp + 0xc], eax
mov eax, dword [ebp + 8]
mov ecx, dword [ecx]
pop edi
pop esi
mov dword [eax], ecx
pop ebx
mov esp, ebp
pop ebp
ret 8
mov eax, dword [ebp + 8]
pop edi
pop esi
pop ebx
mov dword [eax], edx
mov esp, ebp
pop ebp
ret 8