joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10005380
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10048815
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
push ebx
push esi
push edi
mov eax, dword [0x10059040]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, dword [ebp + 0xc]
mov edi, dword [ebp + 8]
mov dword [ebp - 0x14], edi
movzx eax, byte [ebx]
xor eax, 0x811c9dc5
imul ecx, eax, 0x1000193
movzx eax, byte [ebx + 1]
xor ecx, eax
movzx eax, byte [ebx + 2]
imul ecx, ecx, 0x1000193
xor ecx, eax
movzx eax, byte [ebx + 3]
imul ecx, ecx, 0x1000193
xor ecx, eax
imul eax, ecx, 0x1000193
push eax
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x1c]
push ebx
push eax
call fcn.100066d0
mov eax, dword [ebp - 0x18]
test eax, eax
je 0x10005403
mov dword [edi], eax
mov byte [edi + 4], 0
jmp 0x10005543
cmp dword [0x1005b158], 0xfffffff
je 0x10005559
mov dword [ebp - 0x24], 0x1005b154
mov dword [ebp - 4], 0
push 0x10
mov dword [ebp - 0x20], 0
call fcn.1002965b
mov ecx, dword [ebx]
mov esi, eax
add esp, 4
mov dword [ebp - 0x20], esi
mov dword [esi + 8], ecx
mov dword [esi + 0xc], 0
mov dword [ebp - 4], 1
mov ecx, dword [0x1005b158]
mov ebx, dword [0x1005b16c]
lea eax, [ecx + 1]
movd xmm0, eax
cvtdq2pd xmm0, xmm0
shr eax, 0x1f
addsd xmm0, qword [eax*8 + 0x10054220]
mov eax, ebx
shr eax, 0x1f
cvtpd2ps xmm3, xmm0
movd xmm0, ebx
cvtdq2pd xmm0, xmm0
movaps xmm2, xmm3
addsd xmm0, qword [eax*8 + 0x10054220]
cvtpd2ps xmm1, xmm0
movss xmm0, dword [0x1005b150]
divss xmm2, xmm1
comiss xmm2, xmm0
jbe 0x100054f0
divss xmm3, xmm0
movaps xmm0, xmm3
call fcn.10001450
call fcn.10048220
mov ecx, 8
cmp eax, ecx
cmova ecx, eax
cmp ebx, ecx
jae 0x100054cf
cmp ebx, 0x200
jae 0x100054cd
shl ebx, 3
cmp ebx, ecx
jae 0x100054cf
mov ebx, ecx
push ebx
call fcn.10006520
mov edi, dword [ebp - 0x10]
lea eax, [esi + 8]
push edi
push eax
lea eax, [ebp - 0x24]
push eax
call fcn.100066d0
mov ecx, dword [0x1005b158]
mov edx, dword [eax]
jmp 0x100054f6
mov edx, dword [ebp - 0x1c]
mov edi, dword [ebp - 0x10]
mov ebx, dword [edx + 4]
inc ecx
mov dword [0x1005b158], ecx
mov dword [esi], edx
mov dword [esi + 4], ebx
mov dword [ebx], esi
mov dword [edx + 4], esi
mov eax, dword [0x1005b168]
mov ecx, dword [0x1005b15c]
and eax, edi
mov edi, dword [ecx + eax*8]
cmp edi, dword [0x1005b154]
jne 0x10005527
mov dword [ecx + eax*8], esi
jmp 0x10005536
cmp edi, edx
jne 0x10005530
mov dword [ecx + eax*8], esi
jmp 0x1000553a
cmp dword [ecx + eax*8 + 4], ebx
jne 0x1000553a
mov dword [ecx + eax*8 + 4], esi
mov edi, dword [ebp - 0x14]
mov dword [edi], esi
mov byte [edi + 4], 1
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
push str.unordered_map_set_too_long
call fcn.10028306
int3
Function at 0x10006520
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1fffffff
sub esp, 0x10
bsr ecx, eax
push ebx
push esi
push edi
mov edi, 1
mov eax, edi
shl eax, cl
mov ecx, dword [ebp + 8]
cmp ecx, eax
ja 0x1000668d
lea eax, [ecx - 1]
mov esi, dword [0x1005b154]
or eax, edi
mov dword [ebp - 8], esi
bsr ecx, eax
push esi
lea ecx, [ecx + 1]
shl edi, cl
mov ecx, 0x1005b15c
lea eax, [edi + edi]
push eax
call fcn.10004ae0
mov eax, dword [0x1005b154]
lea ebx, [edi - 1]
mov dword [0x1005b168], ebx
mov dword [0x1005b16c], edi
mov eax, dword [eax]
mov ecx, eax
cmp eax, esi
je 0x10006684
nop word [eax + eax]
movzx edx, byte [eax + 8]
xor edx, 0x811c9dc5
mov ecx, dword [ecx]
imul edi, edx, 0x1000193
movzx edx, byte [eax + 9]
xor edi, edx
movzx edx, byte [eax + 0xa]
imul edi, edi, 0x1000193
xor edi, edx
movzx edx, byte [eax + 0xb]
imul edi, edi, 0x1000193
xor edi, edx
mov edx, dword [0x1005b15c]
imul edi, edi, 0x1000193
and edi, ebx
mov ebx, dword [edx + edi*8]
lea edx, [edx + edi*8]
mov dword [ebp - 0xc], edx
cmp ebx, esi
jne 0x100065e2
mov dword [edx], eax
mov dword [edx + 4], eax
jmp 0x1000664f
mov edx, dword [edx + 4]
mov edi, dword [eax + 8]
cmp edi, dword [edx + 8]
jne 0x1000661c
mov edx, dword [edx]
mov dword [ebp - 4], edx
cmp edx, eax
je 0x10006614
mov ebx, dword [eax + 4]
mov esi, dword [ebp - 4]
mov dword [ebx], ecx
mov edi, dword [ecx + 4]
mov dword [edi], edx
mov edx, dword [edx + 4]
mov dword [edx], eax
mov dword [esi + 4], edi
mov esi, dword [ebp - 8]
mov dword [ecx + 4], ebx
mov dword [eax + 4], edx
mov edx, dword [ebp - 0xc]
mov dword [edx + 4], eax
jmp 0x1000664f
cmp ebx, edx
je 0x1000662c
mov edx, dword [edx + 4]
cmp edi, dword [edx + 8]
je 0x10006660
cmp ebx, edx
jne 0x10006620
mov ebx, dword [eax + 4]
mov dword [ebp - 4], ebx
mov dword [ebx], ecx
mov ebx, dword [ecx + 4]
mov dword [ebx], edx
mov edi, dword [edx + 4]
mov dword [edi], eax
mov dword [edx + 4], ebx
mov edx, dword [ebp - 4]
mov dword [ecx + 4], edx
mov edx, dword [ebp - 0xc]
mov dword [eax + 4], edi
mov dword [edx], eax
mov eax, ecx
cmp ecx, esi
je 0x10006684
mov ebx, dword [0x1005b168]
jmp 0x10006590
mov ebx, dword [eax + 4]
mov edx, dword [edx]
mov dword [ebp - 4], edx
mov esi, edx
mov dword [ebx], ecx
mov edi, dword [ecx + 4]
mov dword [edi], edx
mov edx, dword [edx + 4]
mov dword [edx], eax
mov dword [esi + 4], edi
mov esi, dword [ebp - 8]
mov dword [ecx + 4], ebx
mov dword [eax + 4], edx
jmp 0x1000664f
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
push str.invalid_hash_bucket_count
call fcn.10028306
int3
Function at 0x10006740
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, edx
mov ebx, ecx
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x1000679b
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x1000679b
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [ebp + 8]
lea edx, [esi + eax]
and ecx, 0xf
jbe 0x10006788
cmp esi, edx
jae 0x1000679b
movzx eax, word [esi]
lea esi, [esi + eax*2]
add esi, 2
sub ecx, 1
jne 0x10006776
cmp esi, edx
jae 0x1000679b
xor eax, eax
cmp word [esi], ax
pop edi
cmove esi, eax
mov eax, esi
pop esi
pop ebx
pop ebp
ret
pop edi
pop esi
xor eax, eax
pop ebx
pop ebp
ret

Function at 0x100067b0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push edi
mov edi, edx
mov ebx, ecx
mov eax, edi
shr eax, 4
inc eax
push 6
movzx eax, ax
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov dword [ebp - 4], eax
test eax, eax
jne 0x100067da
pop edi
pop ebx
mov esp, ebp
pop ebp
ret
push esi
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
jne 0x100067f2
xor esi, esi
mov eax, esi
pop esi
pop edi
pop ebx
mov esp, ebp
pop ebp
ret
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x100067e7
push dword [ebp - 4]
push ebx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
lea ecx, [esi + eax]
and edi, 0xf
jbe 0x10006823
cmp esi, ecx
jae 0x100067e7
movzx eax, word [esi]
lea esi, [esi + eax*2]
add esi, 2
sub edi, 1
jne 0x10006811
cmp esi, ecx
jae 0x100067e7
xor eax, eax
cmp word [esi], ax
cmove esi, eax
mov eax, esi
pop esi
pop edi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x100068d0
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [0x10059040]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push ebx
push esi
push edi
push 0
mov dword [ebp - 0x10], eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov esi, eax
mov eax, 0x5a4d
mov dword [ebp - 8], esi
cmp word [esi], ax
jne 0x100069e4
mov ecx, dword [esi + 0x3c]
cmp dword [ecx + esi], 0x4550
jne 0x100069e4
cmp word [ecx + esi + 0x14], 0
je 0x100069e4
mov ebx, dword [ecx + esi + 0x80]
lea eax, [ebx + esi]
neg ebx
sbb ebx, ebx
and ebx, eax
je 0x100069e4
cmp dword [ebx], 0
je 0x100069e4
nop
mov ecx, dword [ebx + 0xc]
lea eax, [ecx + esi]
neg ecx
sbb ecx, ecx
and ecx, eax
je 0x100069e4
push str.KERNEL32.DLL
push ecx
call fcn.10030ca4
add esp, 8
test eax, eax
jne 0x100069d8
mov edi, dword [ebx]
mov ecx, dword [ebp - 8]
mov edx, dword [ebx + 0x10]
lea eax, [edi + ecx]
neg edi
sbb edi, edi
and edi, eax
lea eax, [edx + ecx]
neg edx
sbb edx, edx
and edx, eax
mov dword [ebp - 0xc], edx
test edi, edi
je 0x100069f7
mov eax, dword [edi]
xor esi, esi
test eax, eax
je 0x100069f7
js 0x100069cc
add eax, 2
je 0x100069cc
add eax, ecx
je 0x100069cc
mov ecx, dword [ebp + 8]
nop dword [eax + eax]
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x100069c0
test dl, dl
je 0x100069bc
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x100069c0
add eax, 2
add ecx, 2
test dl, dl
jne 0x100069a0
xor eax, eax
jmp 0x100069c5
sbb eax, eax
or eax, 1
test eax, eax
je 0x100069fb
mov ecx, dword [ebp - 8]
mov eax, dword [edi + esi*4 + 4]
inc esi
test eax, eax
jne 0x1000698d
mov esi, dword [ebp - 8]
add ebx, 0x14
cmp dword [ebx], 0
jne 0x10006940
pop edi
pop esi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10029593
mov esp, ebp
pop ebp
ret
mov esi, ecx
jmp 0x100069d8
mov eax, dword [ebp - 0xc]
mov edi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea esi, [eax + esi*4]
lea eax, [ebp - 8]
push eax
push 0x40
push 4
push esi
call edi
test eax, eax
je 0x10006a3d
mov eax, dword [ebp - 0x10]
mov dword [esi], eax
lea eax, [ebp - 8]
push eax
push dword [ebp - 8]
push 4
push esi
call edi
mov ecx, dword [ebp - 4]
mov eax, 1
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10029593
mov esp, ebp
pop ebp
ret
push esi
push str.Failed_to_modify_protection_at__08X__
call fcn.10006a50
int3
Function at 0x10007080
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push 0xfffffffffffffffe
push 0x100561a8
push 0x1002abd0
mov eax, dword fs:[0]
push eax
sub esp, 0x28
mov eax, dword [0x10059040]
xor dword [ebp - 8], eax
xor eax, ebp
mov dword [ebp - 0x1c], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0x10]
mov dword fs:[0], eax
mov dword [ebp - 0x18], esp
mov edi, edx
push 0x1c
lea eax, [ebp - 0x38]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
mov dword [ebp - 4], 0
mov eax, 0x5a4d
mov ecx, dword [ebp - 0x34]
cmp word [ecx], ax
jne 0x10007123
mov edx, dword [ecx + 0x3c]
cmp dword [edx + ecx], 0x4550
jne 0x10007123
mov esi, dword [edx + ecx + 0xd8]
lea eax, [esi + ecx]
cmp edi, eax
jb 0x10007123
mov eax, dword [edx + ecx + 0xdc]
add eax, esi
add eax, ecx
cmp edi, eax
jae 0x10007123
mov dword [ebp - 4], 0xfffffffe
mov al, 1
jmp 0x1000712c
mov dword [ebp - 4], 0xfffffffe
xor al, al
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x1c]
xor ecx, ebp
call fcn.10029593
mov esp, ebp
pop ebp
ret
Function at 0x10007440
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [0x10059040]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, ecx
mov ebx, edx
push edi
lea ecx, [esi - 0x10000]
movzx eax, cx
mov edi, ecx
sub edi, eax
test eax, eax
cmove edi, ecx
cmp edi, ebx
jbe 0x100074fc
lea eax, [edi - 0x70000000]
cmp eax, 0x10000000
ja 0x10007486
sub edi, 0x8000000
jmp 0x100074f4
push 0x1c
lea eax, [ebp - 0x20]
mov dword [ebp - 8], 0
xorps xmm0, xmm0
push eax
push edi
movups xmmword [ebp - 0x20], xmm0
movq qword [ebp - 0x10], xmm0
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
je 0x100074fc
cmp dword [ebp - 0x10], 0x10000
jne 0x100074df
cmp dword [ebp - 0x14], 0x10000
jb 0x100074df
push 0x40
push 0x3000
push 0x10000
push edi
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
test eax, eax
jne 0x100075a7
sub edi, 0x10000
jmp 0x100074f4
mov ecx, dword [ebp - 0x1c]
add ecx, 0xffff0000
mov edi, ecx
movzx eax, di
sub edi, eax
test eax, eax
cmove edi, ecx
cmp edi, ebx
ja 0x10007471
movzx eax, si
test eax, eax
je 0x1000750b
sub esi, eax
add esi, 0x10000
mov edi, dword [ebp + 8]
cmp esi, edi
jae 0x100075a5
mov ebx, dword [sym.imp.KERNEL32.dll_VirtualQuery]
nop dword [eax]
lea eax, [esi - 0x70000000]
cmp eax, 0x10000000
ja 0x10007535
add esi, 0x8000000
jmp 0x1000759d
push 0x1c
lea eax, [ebp - 0x20]
mov dword [ebp - 8], 0
xorps xmm0, xmm0
push eax
push esi
movups xmmword [ebp - 0x20], xmm0
movq qword [ebp - 0x10], xmm0
call ebx
test eax, eax
je 0x100075a5
cmp dword [ebp - 0x10], 0x10000
mov ecx, dword [ebp - 0x14]
jne 0x10007588
cmp ecx, 0x10000
jb 0x10007588
push 0x40
push 0x3000
push 0x10000
push esi
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
test eax, eax
jne 0x100075a7
add esi, 0x10000
jmp 0x1000759d
mov esi, dword [ebp - 0x20]
add esi, ecx
movzx ecx, si
test ecx, ecx
je 0x1000759d
mov eax, 0x10000
sub eax, ecx
add esi, eax
cmp esi, edi
jb 0x10007520
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10029593
mov esp, ebp
pop ebp
ret
Function at 0x10008020
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x10059040]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push ebx
push esi
push edi
mov ebx, edx
mov dword [ebp - 0x24], eax
mov esi, ecx
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edi, eax
mov dword [ebp - 8], 0
push 0x1c
lea eax, [ebp - 0x20]
xorps xmm0, xmm0
push eax
push esi
push edi
movups xmmword [ebp - 0x20], xmm0
movq qword [ebp - 0x10], xmm0
call dword [sym.imp.KERNEL32.dll_VirtualQueryEx]
test eax, eax
jne 0x1000807d
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10029593
mov esp, ebp
pop ebp
ret 8
push dword [ebp - 0x24]
test byte [ebp - 0xc], 0xf0
mov ecx, 0x40
mov eax, 4
cmovne eax, ecx
push eax
push ebx
push esi
push edi
call dword [sym.imp.KERNEL32.dll_VirtualProtectEx]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10029593
mov esp, ebp
pop ebp
ret 8

Function at 0x100080b0
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push 0xfffffffffffffffe
push 0x100561c8
push 0x1002abd0
mov eax, dword fs:[0]
push eax
sub esp, 0x28
mov eax, dword [0x10059040]
xor dword [ebp - 8], eax
xor eax, ebp
mov dword [ebp - 0x1c], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0x10]
mov dword fs:[0], eax
mov dword [ebp - 0x18], esp
lea esi, [ecx + 0x10000]
xorps xmm0, xmm0
movups xmmword [ebp - 0x38], xmm0
movq qword [ebp - 0x28], xmm0
mov dword [ebp - 0x20], 0
mov edi, 0x5a4d
push 0x1c
lea eax, [ebp - 0x38]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
jne 0x10008131
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x1c]
xor ecx, ebp
call fcn.10029593
mov esp, ebp
pop ebp
ret
cmp dword [ebp - 0x28], 0x1000
jne 0x100081a7
cmp byte [ebp - 0x24], 1
je 0x100081a7
test dword [ebp - 0x24], 0x100
jne 0x100081a7
mov dword [ebp - 4], 0
cmp word [esi], di
jne 0x1000816b
mov eax, dword [esi + 0x3c]
cmp eax, dword [ebp - 0x2c]
ja 0x1000816b
cmp eax, 0x40
jb 0x1000816b
cmp dword [eax + esi], 0x4550
je 0x1000817a
mov dword [ebp - 4], 0xfffffffe
mov esi, dword [ebp - 0x2c]
add esi, dword [ebp - 0x38]
jmp 0x10008104
mov dword [ebp - 4], 0xfffffffe
mov eax, esi
jmp 0x10008115
mov esi, dword [ebp - 0x2c]
add esi, dword [ebp - 0x38]
jmp 0x10008104
Function at 0x100081c0
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push 0xfffffffffffffffe
push 0x100561e8
push 0x1002abd0
mov eax, dword fs:[0]
push eax
sub esp, 0x18
push ebx
push esi
push edi
mov eax, dword [0x10059040]
xor dword [ebp - 8], eax
xor eax, ebp
push eax
lea eax, [ebp - 0x10]
mov dword fs:[0], eax
mov dword [ebp - 0x18], esp
mov ebx, ecx
test ebx, ebx
jne 0x10008202
push ecx
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov ebx, eax
mov dword [ebp - 4], 0
mov eax, 0x5a4d
cmp word [ebx], ax
je 0x1000821d
push 0xc1
jmp 0x10008311
mov ecx, dword [ebx + 0x3c]
add ecx, ebx
mov dword [ebp - 0x24], ecx
cmp dword [ecx], 0x4550
je 0x10008237
push 0xbf
jmp 0x10008311
movzx eax, word [ecx + 0x14]
test ax, ax
je 0x1000830c
lea edx, [eax + ecx]
mov dword [ebp - 0x1c], edx
lea edx, [eax + 0x18]
add edx, ecx
mov dword [ebp - 0x28], edx
xor esi, esi
mov dword [ebp - 0x20], esi
movzx eax, word [ecx + 6]
cmp esi, eax
jae 0x1000830c
lea edi, [esi + esi*4]
mov ecx, str..detour
lea eax, [edx + edi*8]
nop
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x10008290
test dl, dl
je 0x1000828c
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x10008290
add eax, 2
add ecx, 2
test dl, dl
jne 0x10008270
xor eax, eax
jmp 0x10008295
sbb eax, eax
or eax, 1
test eax, eax
jne 0x100082ea
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ecx + edi*8 + 0x24]
test eax, eax
je 0x1000830c
cmp dword [ecx + edi*8 + 0x28], 0
je 0x1000830c
lea esi, [eax + ebx]
mov eax, dword [esi]
cmp eax, 0x40
jb 0x1000830c
cmp dword [esi + 4], 0x727444
jne 0x1000830c
cmp dword [esi + 8], 0
jne 0x100082c7
mov dword [esi + 8], eax
push 0
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov dword [ebp - 4], 0xfffffffe
mov eax, esi
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
inc esi
mov ecx, dword [ebp - 0x24]
mov edx, dword [ebp - 0x28]
jmp 0x10008254
push 0xc0
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov dword [ebp - 4], 0xfffffffe
xor eax, eax
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10009ff0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10048c7d
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push ebx
push esi
push edi
mov eax, dword [0x10059040]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov dword [ebp - 4], 0
lea esi, [ebp + 8]
cmp dword [ebp + 0x1c], 0xf
mov edx, 0x811c9dc5
mov edi, dword [ebp + 0x18]
cmova esi, dword [ebp + 8]
xor ecx, ecx
test edi, edi
je 0x1000a051
nop word [eax + eax]
movzx eax, byte [ecx + esi]
inc ecx
xor eax, edx
imul edx, eax, 0x1000193
cmp ecx, edi
jb 0x1000a040
push edx
lea eax, [ebp + 8]
mov ecx, ebx
push eax
lea eax, [ebp - 0x1c]
push eax
call fcn.100100d0
mov eax, dword [eax + 4]
test eax, eax
je 0x1000a0ec
cmp eax, dword [ebx + 4]
je 0x1000a0ec
lea eax, [ebp + 8]
mov ecx, ebx
push eax
call fcn.1000bba0
mov eax, dword [eax]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp + 0x20]
mov edi, dword [eax + 4]
mov esi, dword [edi]
cmp esi, edi
je 0x1000a0ba
nop dword [eax]
sub esp, 0x1c
lea eax, [esi + 8]
mov ebx, esp
mov ecx, ebx
mov dword [ebp - 0x18], ebx
push eax
call fcn.10003620
mov eax, dword [esi + 0x20]
mov ecx, dword [ebp - 0x14]
mov dword [ebx + 0x18], eax
call fcn.10009ff0
mov esi, dword [esi]
cmp esi, edi
jne 0x1000a090
mov eax, dword [ebp + 0x20]
mov edi, dword [eax + 0x24]
mov esi, dword [edi]
cmp esi, edi
je 0x1000a0fb
sub esp, 0x1c
lea eax, [esi + 8]
mov ebx, esp
mov ecx, ebx
mov dword [ebp - 0x18], ebx
push eax
call fcn.10003620
mov eax, dword [esi + 0x20]
mov ecx, dword [ebp - 0x14]
mov dword [ebx + 0x18], eax
call fcn.1000a150
mov esi, dword [esi]
cmp esi, edi
jne 0x1000a0c3
jmp 0x1000a0fb
lea eax, [ebp + 8]
mov ecx, ebx
push eax
lea eax, [ebp - 0x1c]
push eax
call fcn.1000fb10
mov ecx, dword [ebp + 0x1c]
cmp ecx, 0xf
jbe 0x1000a12b
mov edx, dword [ebp + 8]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x1000a121
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x1000a13f
push ecx
push edx
call fcn.100299a5
add esp, 8
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x1c
call fcn.10030684
int3
Function at 0x1000a150
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10048c7d
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push ebx
push esi
push edi
mov eax, dword [0x10059040]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, ecx
mov dword [ebp - 0x14], eax
mov dword [ebp - 4], 0
lea edi, [ebp + 8]
cmp dword [ebp + 0x1c], 0xf
lea esi, [eax + 0x20]
mov ebx, dword [ebp + 0x18]
mov edx, 0x811c9dc5
cmova edi, dword [ebp + 8]
xor ecx, ecx
test ebx, ebx
je 0x1000a1b1
movzx eax, byte [ecx + edi]
inc ecx
xor eax, edx
imul edx, eax, 0x1000193
cmp ecx, ebx
jb 0x1000a1a0
push edx
lea eax, [ebp + 8]
mov ecx, esi
push eax
lea eax, [ebp - 0x1c]
push eax
call fcn.100100d0
mov eax, dword [eax + 4]
test eax, eax
jne 0x1000a1cb
mov eax, dword [esi + 4]
mov ecx, dword [ebp - 0x14]
cmp eax, dword [ecx + 0x24]
lea eax, [ebp + 8]
mov ecx, esi
push eax
je 0x1000a1e5
call fcn.1000bb60
mov ecx, dword [ebp + 0x20]
mov dword [eax], ecx
jmp 0x1000a1ee
lea eax, [ebp - 0x1c]
push eax
call fcn.1000fd00
mov ecx, dword [ebp + 0x1c]
cmp ecx, 0xf
jbe 0x1000a21e
mov edx, dword [ebp + 8]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x1000a214
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x1000a232
push ecx
push edx
call fcn.100299a5
add esp, 8
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x1c
call fcn.10030684
int3
Function at 0x1000a940
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
push edi
mov edi, ecx
test edi, edi
je 0x1000a9e4
mov esi, dword [ebp + 8]
mov ecx, esi
cmp dword [esi + 0x14], 0xf
mov ebx, dword [esi + 0x10]
jbe 0x1000a963
mov ecx, dword [esi]
push 0
push 0x10051eb2
mov edx, ebx
call fcn.100101d0
add esp, 8
test al, al
jne 0x1000a9e4
cmp dword [esi + 0x14], 0xf
mov dword [ebp - 8], esi
jbe 0x1000a986
mov eax, dword [esi]
mov dword [ebp - 8], eax
xor ecx, ecx
lea eax, [edi + 0x20]
mov edx, 0x811c9dc5
test ebx, ebx
je 0x1000a9b3
mov esi, dword [ebp - 8]
movzx eax, byte [ecx + esi]
inc ecx
xor eax, edx
imul edx, eax, 0x1000193
cmp ecx, ebx
jb 0x1000a997
mov esi, dword [ebp + 8]
lea ebx, [edi + 0x20]
lea eax, [edi + 0x20]
jmp 0x1000a9b5
mov ebx, eax
push edx
push esi
lea ecx, [ebp - 0x10]
push ecx
mov ecx, eax
call fcn.100100d0
mov eax, dword [eax + 4]
test eax, eax
jne 0x1000a9cc
mov eax, dword [edi + 0x24]
cmp eax, dword [edi + 0x24]
je 0x1000a9e4
push esi
mov ecx, ebx
call fcn.1000bb60
mov eax, dword [eax]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret 4