joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1006e930
Capabilities:
Check for time delay via queryperformancecounter
Execute anti-debugging instructions

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x48
mov eax, dword [0x10123014]
xor eax, ebp
mov dword [esp + 0x40], eax
movsd xmm1, qword [0x10129560]
xorpd xmm0, xmm0
ucomisd xmm1, xmm0
jne 0x1006eaac
jp 0x1006eaac
mov esi, dword [sym.imp.KERNEL32.dll_GetCurrentThread]
call esi
push eax
call dword [sym.imp.KERNEL32.dll_GetThreadPriority]
mov dword [esp + 0xc], eax
call esi
push 2
push eax
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
mov eax, dword [0x10129570]
mov ecx, dword [0x10126eb8]
mov edx, dword fs:[0x2c]
mov ecx, dword [edx + ecx*4]
cmp eax, dword [ecx + 4]
jg 0x1006ead1
mov eax, dword [0x10129580]
mov ecx, dword [0x10126eb8]
mov edx, dword fs:[0x2c]
mov ecx, dword [edx + ecx*4]
cmp eax, dword [ecx + 4]
jg 0x1006eb0a
rdtsc
mov dword [esp + 8], eax
mov dword [esp + 4], edx
mov dword [esp + 0x3c], 0
mov dword [esp + 0x38], 0
lea ebx, [esp + 0x38]
push ebx
call dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov esi, dword [esp + 0x38]
mov edi, dword [esp + 0x3c]
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
push dword [esp + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
mov dword [esp + 0x3c], 0
mov dword [esp + 0x38], 0
push ebx
call dword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
sub esi, dword [0x10129578]
sbb edi, dword [0x1012957c]
movd xmm0, edi
movd xmm1, esi
punpckldq xmm1, xmm0
movq qword [esp + 0x28], xmm1
fild qword [esp + 0x28]
fstp qword [esp + 0x20]
movsd xmm0, qword [esp + 0x20]
fild qword [esp + 0x38]
fstp qword [esp + 0x30]
divsd xmm0, qword [esp + 0x30]
pxor xmm1, xmm1
movsd xmm2, qword [0x101165f8]
ucomisd xmm2, xmm0
ja 0x1006eaac
mov eax, dword [esp + 8]
sub eax, dword [0x10129568]
mov ecx, dword [esp + 4]
sbb ecx, dword [0x1012956c]
movd xmm1, ecx
movd xmm2, eax
punpckldq xmm2, xmm1
punpckldq xmm2, xmmword [0x101165d0]
subpd xmm2, xmmword [0x101165e0]
movapd xmm1, xmm2
unpckhpd xmm1, xmm2
addsd xmm1, xmm2
divsd xmm1, xmm0
movsd qword [0x10129560], xmm1
movsd qword [esp + 0x18], xmm1
fld qword [esp + 0x18]
fstp xword [esp + 0xc]
mov ecx, dword [esp + 0x40]
xor ecx, ebp
call fcn.100dea63
fld xword [esp + 0xc]
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
push 0x10129570
call fcn.100de107
add esp, 4
cmp dword [0x10129570], 0xffffffff
jne 0x1006e9a2
rdtsc
mov dword [0x10129568], eax
mov dword [0x1012956c], edx
push 0x10129570
call fcn.100de17d
add esp, 4
jmp 0x1006e9a2
push 0x10129580
call fcn.100de107
add esp, 4
cmp dword [0x10129580], 0xffffffff
jne 0x1006e9c3
mov dword [esp + 0x3c], 0
mov dword [esp + 0x38], 0
lea eax, [esp + 0x38]
push eax
call dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov eax, dword [esp + 0x38]
mov ecx, dword [esp + 0x3c]
mov dword [0x1012957c], ecx
mov dword [0x10129578], eax
push 0x10129580
call fcn.100de17d
add esp, 4
jmp 0x1006e9c3
Function at 0x1006ffd0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x20
mov eax, dword [0x10123014]
xor eax, ebp
mov dword [esp + 0x18], eax
mov edi, dword [ecx + 0x38]
test edi, edi
jne 0x10070095
mov esi, ecx
mov dword [esp + 0xc], 0xffffffff
mov dword [esp + 0x10], 0xffffffff
mov dword [esp + 0x14], 0x9ffffff
lea edx, [esp + 0xc]
cmp edx, str.discarded
ja 0x10070027
lea eax, [esp + 0x15]
cmp eax, str.discarded
ja 0x100700ac
mov dword [esp + 0x10], 0x65647261
mov dword [esp + 0xc], 0x63736964
mov word [esp + 0x14], 0x64
mov edi, esp
mov ecx, esi
push edx
push edi
call fcn.1006ff40
push 0x48
call fcn.100de068
add esp, 4
mov ebx, eax
mov ecx, eax
push edi
push dword [esi + 0x28]
lea eax, [esp + 0x14]
push eax
call fcn.1006ee40
mov edi, dword [esi + 0x38]
mov dword [esi + 0x38], ebx
test edi, edi
je 0x1007007f
mov ecx, edi
call fcn.1006ef30
push edi
call fcn.100de098
add esp, 4
cmp byte [esp + 0x17], 0
jns 0x10070092
push dword [esp + 0xc]
call fcn.100de098
add esp, 4
mov edi, dword [esi + 0x38]
mov ecx, dword [esp + 0x18]
xor ecx, ebp
call fcn.100dea63
mov eax, edi
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret 4
push str.char_traits::copy_overlapped_range
push str.__s2_____s1____s2_____s1__n
push 0xec
push str....._buildtools_third_partylibc_trunkinclude__stringchar_traits.h
push str._s:_d:_assertion__s_failed:__s
call fcn.1003963c
int3
Function at 0x10075650
Capabilities:
Encode data using xor
Hash data using murmur2

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x18
mov dword [ebp - 0x10], ecx
mov esi, dword [ebp + 0xc]
movzx ebx, byte [esi + 0xb]
mov eax, dword [esi]
mov ecx, dword [esi + 4]
test bl, bl
mov dword [ebp - 0x14], ecx
lea ecx, [eax + ecx]
lea edx, [esi + ebx]
cmovs edx, ecx
cmovs esi, eax
sub edx, esi
cmp edx, 4
mov dword [ebp - 0x20], ebx
jb 0x100756bd
mov ecx, esi
mov eax, edx
nop word [eax + eax]
imul edi, dword [ecx], 0x5bd1e995
mov ebx, edi
shr ebx, 0x18
xor ebx, edi
imul edi, ebx, 0x5bd1e995
imul eax, eax, 0x5bd1e995
xor eax, edi
add ecx, 4
add edx, 0xfffffffc
cmp edx, 3
ja 0x10075690
cmp edx, 1
jne 0x100756c6
jmp 0x100756e2
mov eax, edx
mov ecx, esi
cmp edx, 1
je 0x100756e2
cmp edx, 2
je 0x100756d9
cmp edx, 3
jne 0x100756ed
movzx edx, byte [ecx + 2]
shl edx, 0x10
xor eax, edx
movzx edx, byte [ecx + 1]
shl edx, 8
xor eax, edx
movzx ecx, byte [ecx]
xor ecx, eax
imul eax, ecx, 0x5bd1e995
mov ecx, dword [ebp - 0x10]
mov ebx, dword [ecx + 4]
xor ecx, ecx
test ebx, ebx
je 0x1007584e
mov edx, eax
shr edx, 0xd
xor edx, eax
imul eax, edx, 0x5bd1e995
mov edi, eax
shr edi, 0xf
xor edi, eax
mov edx, ebx
shr edx, 1
and edx, 0x55555555
mov eax, ebx
sub eax, edx
mov edx, eax
and edx, 0x33333333
shr eax, 2
and eax, 0x33333333
add eax, edx
mov edx, eax
shr edx, 4
add edx, eax
and edx, 0xf0f0f0f
imul eax, edx, 0x1010101
shr eax, 0x18
mov dword [ebp - 0x24], eax
cmp eax, 1
ja 0x10075756
lea edx, [ebx - 1]
and edx, edi
jmp 0x10075762
mov edx, edi
cmp edi, ebx
jb 0x10075762
mov eax, edi
xor edx, edx
div ebx
mov eax, dword [ebp - 0x10]
mov eax, dword [eax]
mov eax, dword [eax + edx*4]
test eax, eax
je 0x1007584e
mov dword [ebp - 0x18], ebx
mov ebx, dword [eax]
test ebx, ebx
je 0x1007584e
mov dword [ebp - 0x10], edx
mov eax, dword [ebp - 0x18]
dec eax
mov dword [ebp - 0x1c], eax
mov ecx, dword [ebp - 0x20]
test cl, cl
mov eax, dword [ebp - 0x14]
cmovns eax, ecx
mov dword [ebp - 0x14], eax
jmp 0x100757b5
and eax, dword [ebp - 0x1c]
cmp eax, edx
jne 0x1007584c
mov ebx, dword [ebx]
test ebx, ebx
je 0x1007584c
mov eax, dword [ebx + 4]
cmp eax, edi
jne 0x10075810
movzx eax, byte [ebx + 0x13]
mov ecx, eax
test al, al
jns 0x100757c9
mov ecx, dword [ebx + 0xc]
cmp ecx, dword [ebp - 0x14]
jne 0x100757ab
lea ecx, [ebx + 8]
test al, al
jns 0x100757d7
mov ecx, dword [ecx]
js 0x1007582e
cmp dword [ebp - 0x14], 0
je 0x10075848
xor ecx, ecx
nop word cs:[eax + eax]
movzx edx, byte [ebx + ecx + 8]
cmp dl, byte [esi + ecx]
jne 0x100757ab
inc ecx
cmp eax, ecx
jne 0x100757f0
jmp 0x10075848
cmp dword [ebp - 0x24], 1
mov edx, dword [ebp - 0x10]
jbe 0x100757a0
mov ecx, dword [ebp - 0x18]
cmp eax, ecx
jb 0x100757a3
xor edx, edx
div ecx
mov eax, edx
mov edx, dword [ebp - 0x10]
jmp 0x100757a3
mov eax, dword [ebp - 0x14]
test eax, eax
je 0x10075848
push eax
push esi
push ecx
call fcn.100e033d
add esp, 0xc
test eax, eax
jne 0x100757ab
mov ecx, ebx
jmp 0x1007584e
xor ecx, ecx
mov eax, dword [ebp + 8]
mov dword [eax], ecx
add esp, 0x18
pop esi
pop edi
pop ebx
pop ebp
ret 8
Function at 0x10080ac8
Capabilities:
Generate random numbers via rtlgenrandom

Disassembly:
push ebp
mov ebp, esp
pop ebp
jmp fcn.1006e110

Function at 0x10080ba2
Capabilities:
Connect pipe
Create pipe

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x3c
mov dword [ebp - 0x48], edx
mov dword [ebp - 0x44], ecx
mov eax, dword [0x10123014]
xor eax, ebp
mov dword [ebp - 0x10], eax
xor eax, eax
dec eax
lea ebx, [ebp - 0x1c]
mov dword [ebx], eax
mov dword [ebx + 4], eax
mov dword [ebx + 8], eax
call fcn.100674f0
mov dword [ebp - 0x40], eax
mov edi, edx
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push edi
push dword [ebp - 0x40]
push esi
push eax
push str..pipemojo._lu._lu._I64u
push ebx
call fcn.1008a5e0
add esp, 0x18
mov dword [ebp - 0x40], esp
push eax
mov edi, esp
cmp byte [ebx + 0xb], 0
jns 0x10080c04
mov ebx, dword [ebp - 0x1c]
sub esp, 0x20
xor esi, esi
mov dword [esp + 0x1c], esi
movaps xmm0, xmmword [0x10117d00]
movups xmmword [esp + 4], xmm0
mov dword [esp], ebx
mov dword [esp + 0x18], 0x1388
mov dword [esp + 0x14], 0x1000
call dword [sym.imp.KERNEL32.dll_CreateNamedPipeW]
mov dword [edi], esi
mov ecx, edi
push eax
call fcn.10080d86
lea edi, [ebp - 0x2c]
mov ecx, edi
call fcn.10080e78
mov esp, dword [ebp - 0x40]
mov esi, dword [ebp - 0x44]
mov ecx, esi
push edi
call fcn.10080e52
mov ecx, edi
call fcn.10080ea0
mov eax, dword [esi + 4]
inc eax
cmp eax, 1
ja 0x10080c7e
lea esi, [ebp - 0x20]
push 0x48
push str.....mojopubliccppplatformplatform_channel.cc
push esi
call fcn.100ae530
add esp, 0xc
mov ecx, esi
call fcn.100ae5a0
mov ebx, esp
mov eax, dword [0x10117d84]
mov dword [ebp - 0x24], eax
movsd xmm0, qword [0x10117d7c]
movsd qword [ebp - 0x2c], xmm0
push eax
mov edi, esp
cmp byte [ebp - 0x11], 0
jns 0x10080ca3
mov eax, dword [ebp - 0x1c]
jmp 0x10080ca6
lea eax, [ebp - 0x1c]
xor esi, esi
push esi
push 0x40100000
push 3
lea ecx, [ebp - 0x2c]
push ecx
push esi
push 0xc0000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [edi], esi
mov ecx, edi
push eax
call fcn.10080d86
lea esi, [ebp - 0x34]
mov ecx, esi
call fcn.10080e78
mov esp, ebx
mov edi, dword [ebp - 0x48]
mov ecx, edi
push esi
call fcn.10080e52
mov ecx, esi
call fcn.10080ea0
mov eax, dword [edi + 4]
inc eax
cmp eax, 1
ja 0x10080d0c
lea esi, [ebp - 0x38]
push 0x55
push str.....mojopubliccppplatformplatform_channel.cc
push esi
call fcn.100ae530
add esp, 0xc
mov ecx, esi
call fcn.100ae5a0
push 0
mov eax, dword [ebp - 0x44]
push dword [eax + 4]
call dword [sym.imp.KERNEL32.dll_ConnectNamedPipe]
test eax, eax
jne 0x10080d6a
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x217
jne 0x10080d4e
cmp byte [ebp - 0x11], 0
jns 0x10080d3c
push dword [ebp - 0x1c]
call fcn.100de098
add esp, 4
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.100dea63
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
lea esi, [ebp - 0x3c]
push 0x5a
push str.....mojopubliccppplatformplatform_channel.cc
push esi
call fcn.100ae530
add esp, 0xc
mov ecx, esi
call fcn.100ae5a0
jmp 0x10080d2b
int3
Function at 0x10080d86
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
mov ebx, dword [ebp + 8]
cmp dword [ecx], ebx
je 0x10080dba
mov esi, ecx
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
mov ecx, esi
call fcn.1001db40
lea eax, [ebx + 1]
cmp eax, 2
jb 0x10080db3
mov dword [esi], ebx
call fcn.10060950
push edi
call dword [sym.imp.KERNEL32.dll_SetLastError]
pop esi
pop edi
pop ebx
pop ebp
ret 4
Function at 0x10091930
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x70
mov esi, ecx
mov eax, dword [ecx + 0x1174]
mov ebx, dword [ecx + 0x1178]
add ebx, eax
mov eax, dword [ecx + 0x116c]
mov ecx, ebx
sub ecx, eax
cmp ecx, 0x40000001
jb 0x10091966
push dword [ebp + 8]
call fcn.100baf00
mov dword [esp + 0xc], 0
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea ecx, [esp + 0xc]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_IsWow64Process]
mov eax, dword [esp + 0xc]
test eax, eax
mov ecx, 0x40000000
mov edi, 0xaf000000
cmove edi, ecx
mov dword [esp + 0x58], eax
mov dword [esp + 0x5c], 0
mov dword [esp + 0x54], 0x365f776f
mov dword [esp + 0x50], 0x775f7369
lea eax, [esp + 0x50]
push eax
call fcn.10010790
add esp, 4
cmp ebx, edi
jbe 0x100919c6
push ebx
call fcn.100baf30
mov dword [esp + 0x48], ebx
mov dword [esp + 0x4c], 0
mov dword [esp + 0x44], 0x657a69
mov dword [esp + 0x40], 0x735f6176
lea eax, [esp + 0x40]
push eax
call fcn.10010790
add esp, 4
mov eax, dword [esi + 0x117c]
mov dword [esp + 0x38], eax
mov dword [esp + 0x3c], 0
mov dword [esp + 0x34], 0x20200063
mov dword [esp + 0x30], 0x6f6c6c61
lea eax, [esp + 0x30]
push eax
call fcn.10010790
add esp, 4
pcmpeqd xmm0, xmm0
movdqa xmmword [esp + 0x10], xmm0
mov eax, dword [esi + 0x116c]
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], 0
mov dword [esp + 0x14], 0x20007469
mov dword [esp + 0x10], 0x6d6d6f63
lea eax, [esp + 0x10]
push eax
call fcn.10010790
add esp, 4
mov esi, dword [ebp + 8]
mov dword [esp + 0x28], esi
mov dword [esp + 0x2c], 0
mov dword [esp + 0x24], 0x20202000
mov dword [esp + 0x20], 0x657a6973
lea eax, [esp + 0x20]
push eax
call fcn.10010790
add esp, 4
mov ecx, dword [0x10138fb8]
test ecx, ecx
je 0x10091a99
call dword [section..00cfg]
push esi
call ecx
add esp, 4
push esi
call fcn.100985f0
int3
Function at 0x100989a0
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [0x10138e78]
mov ecx, dword [0x10126eb8]
mov edx, dword fs:[0x2c]
mov ecx, dword [edx + ecx*4]
cmp eax, dword [ecx + 4]
jg 0x100989cb
mov ecx, 0x10138e70
pop ebp
jmp fcn.100694a0
push 0x10138e78
call fcn.100de107
add esp, 4
cmp dword [0x10138e78], 0xffffffff
jne 0x100989c0
mov dword [0x10138e74], 0
mov dword [0x10138e70], 0
mov ecx, 0x10138e70
push 0
call fcn.10069510
push 0x10138e78
call fcn.100de17d
add esp, 4
jmp 0x100989c0
Function at 0x100a16b0
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x124
mov eax, dword [0x10123014]
xor eax, ebp
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x128]
push 0x118
push 0
push eax
call fcn.100e17d0
add esp, 0xc
mov dword [ebp - 0x12c], 0x11c
lea edi, [ebp - 0x12c]
push edi
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
mov dword [ebp - 0x130], 0
lea eax, [ebp - 0x130]
push eax
push 0
push 0
push dword [ebp - 0x124]
push dword [ebp - 0x128]
call dword [sym.imp.KERNEL32.dll_GetProductInfo]
push 0x54
call fcn.100de068
add esp, 4
mov esi, eax
mov ebx, dword [ebp - 0x130]
mov eax, dword [0x10138f0c]
mov ecx, dword [0x10126eb8]
mov edx, dword fs:[0x2c]
mov ecx, dword [edx + ecx*4]
cmp eax, dword [ecx + 4]
jg 0x100a176e
mov ecx, esi
push ebx
push 0x10138ee8
push edi
call fcn.100a1820
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.100dea63
mov eax, esi
add esp, 0x124
pop esi
pop edi
pop ebx
pop ebp
ret
push 0x10138f0c
call fcn.100de107
add esp, 4
cmp dword [0x10138f0c], 0xffffffff
jne 0x100a1749
xorps xmm0, xmm0
movups xmmword [0x10138ef8], xmm0
movups xmmword [0x10138ee8], xmm0
mov dword [0x10138f08], 0
push 0x10138ee8
call dword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
push 0x10138f0c
call fcn.100de17d
add esp, 4
jmp 0x100a1749
Function at 0x100a59e0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x90
mov eax, dword [ebp + 0x14]
mov ecx, dword [0x10123014]
xor ecx, ebp
mov dword [esp + 0x88], ecx
xor esi, esi
cmp eax, 0x30
ja 0x100a5c35
mov ecx, dword [ebp + 0xc]
movups xmm0, xmmword [ecx + 0x20]
movaps xmmword [esp + 0x40], xmm0
movdqu xmm0, xmmword [ecx]
movdqu xmm1, xmmword [ecx + 0x10]
movdqa xmmword [esp + 0x30], xmm1
movdqa xmmword [esp + 0x20], xmm0
test eax, eax
je 0x100a5a4d
mov ecx, dword [ebp + 0x10]
xor edx, edx
nop word cs:[eax + eax]
movzx ebx, byte [ecx + edx]
xor byte [esp + edx + 0x20], bl
inc edx
cmp eax, edx
jne 0x100a5a40
mov esi, dword [ebp + 8]
xor eax, eax
nop word cs:[eax + eax]
movzx ecx, byte [eax + 0x10118ab0]
xor byte [esp + eax + 0x20], cl
inc eax
cmp eax, 0x30
jne 0x100a5a60
lea edi, [esi + 0xf4]
mov eax, dword [0x10138f40]
test eax, 0x2000000
jne 0x100a5bcb
test eax, 0x200
jne 0x100a5bea
mov dword [esp + 0xc], edi
mov dword [esi + 0xf0], 0xe
movaps xmm0, xmmword [esp + 0x20]
movaps xmmword [esp + 0x70], xmm0
movups xmmword [esi], xmm0
movaps xmm0, xmmword [esp + 0x30]
movaps xmmword [esp + 0x60], xmm0
movups xmmword [esi + 0x10], xmm0
mov edi, 0x30
mov ebx, 0x10118b00
movdqa xmm0, xmmword [esp + 0x70]
movdqa xmmword [esp + 0x10], xmm0
lea esi, [esp + 0x50]
nop word cs:[eax + eax]
pcmpeqd xmm0, xmm0
movdqa xmmword [esp + 0x50], xmm0
mov ecx, esi
lea edx, [esp + 0x60]
call fcn.100a63d0
movzx eax, byte [ebx]
movd xmm1, eax
pxor xmm1, xmmword [esp + 0x10]
movdqa xmm0, xmmword [esp + 0x50]
movdqa xmm2, xmm0
psrld xmm2, 8
pslld xmm0, 0x18
por xmm0, xmm2
psrldq xmm0, 0xc
pxor xmm0, xmm1
movdqa xmm1, xmm0
pslldq xmm1, 4
movdqa xmm2, xmm0
pslldq xmm2, 8
pxor xmm2, xmm1
movdqa xmm1, xmm0
pslldq xmm1, 0xc
pxor xmm1, xmm2
pxor xmm1, xmm0
movdqa xmmword [esp + 0x70], xmm1
movaps xmm0, xmmword [esp + 0x70]
mov eax, dword [ebp + 8]
movups xmmword [eax + edi - 0x10], xmm0
cmp edi, 0xf0
je 0x100a5c4d
movdqa xmmword [esp + 0x10], xmm1
mov ecx, esi
lea edx, [esp + 0x70]
call fcn.100a63d0
movdqa xmm0, xmmword [esp + 0x50]
psrldq xmm0, 0xc
pxor xmm0, xmmword [esp + 0x60]
movdqa xmm1, xmm0
movdqa xmm2, xmm0
pslldq xmm2, 0xc
pxor xmm2, xmm0
pslldq xmm0, 4
pslldq xmm1, 8
pxor xmm1, xmm0
pxor xmm2, xmm1
movdqa xmmword [esp + 0x60], xmm2
movdqa xmm0, xmmword [esp + 0x60]
mov eax, dword [ebp + 8]
movdqu xmmword [eax + edi], xmm0
add edi, 0x20
inc ebx
jmp 0x100a5ae0
lea eax, [esp + 0x20]
push esi
push 0x100
push eax
call fcn.10003380
add esp, 0xc
mov ecx, section..text
mov eax, 0x10001b90
jmp 0x100a5c04
lea eax, [esp + 0x20]
push esi
push 0x100
push eax
call fcn.10003ea0
add esp, 0xc
mov ecx, 0x10003f50
xor eax, eax
test edi, edi
je 0x100a5c0a
mov dword [edi], ecx
mov dword [esi + 0xf8], eax
movaps xmm0, xmmword [esp + 0x40]
movups xmmword [esi + 0xfc], xmm0
mov dword [esi + 0x114], 0
mov dword [esi + 0x110], 1
mov esi, 1
mov ecx, dword [esp + 0x88]
xor ecx, ebp
call fcn.100dea63
mov eax, esi
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
mov ecx, 0x100a37c0
mov eax, 0x100a4b00
mov edi, dword [esp + 0xc]
test edi, edi
mov esi, dword [ebp + 8]
jne 0x100a5c08
jmp 0x100a5c0a
Function at 0x100ab810
Capabilities:
Encode data using xor
Hash data using murmur2

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x18
mov dword [ebp - 0x10], ecx
mov esi, dword [ebp + 0xc]
movzx ebx, byte [esi + 0xb]
mov eax, dword [esi]
mov ecx, dword [esi + 4]
test bl, bl
mov dword [ebp - 0x14], ecx
lea ecx, [eax + ecx]
lea edx, [esi + ebx]
cmovs edx, ecx
cmovs esi, eax
sub edx, esi
cmp edx, 4
mov dword [ebp - 0x20], ebx
jb 0x100ab87d
mov ecx, esi
mov eax, edx
nop word [eax + eax]
imul edi, dword [ecx], 0x5bd1e995
mov ebx, edi
shr ebx, 0x18
xor ebx, edi
imul edi, ebx, 0x5bd1e995
imul eax, eax, 0x5bd1e995
xor eax, edi
add ecx, 4
add edx, 0xfffffffc
cmp edx, 3
ja 0x100ab850
cmp edx, 1
jne 0x100ab886
jmp 0x100ab8a2
mov eax, edx
mov ecx, esi
cmp edx, 1
je 0x100ab8a2
cmp edx, 2
je 0x100ab899
cmp edx, 3
jne 0x100ab8ad
movzx edx, byte [ecx + 2]
shl edx, 0x10
xor eax, edx
movzx edx, byte [ecx + 1]
shl edx, 8
xor eax, edx
movzx ecx, byte [ecx]
xor ecx, eax
imul eax, ecx, 0x5bd1e995
mov ecx, dword [ebp - 0x10]
mov ebx, dword [ecx + 4]
xor ecx, ecx
test ebx, ebx
je 0x100aba0e
mov edx, eax
shr edx, 0xd
xor edx, eax
imul eax, edx, 0x5bd1e995
mov edi, eax
shr edi, 0xf
xor edi, eax
mov edx, ebx
shr edx, 1
and edx, 0x55555555
mov eax, ebx
sub eax, edx
mov edx, eax
and edx, 0x33333333
shr eax, 2
and eax, 0x33333333
add eax, edx
mov edx, eax
shr edx, 4
add edx, eax
and edx, 0xf0f0f0f
imul eax, edx, 0x1010101
shr eax, 0x18
mov dword [ebp - 0x24], eax
cmp eax, 1
ja 0x100ab916
lea edx, [ebx - 1]
and edx, edi
jmp 0x100ab922
mov edx, edi
cmp edi, ebx
jb 0x100ab922
mov eax, edi
xor edx, edx
div ebx
mov eax, dword [ebp - 0x10]
mov eax, dword [eax]
mov eax, dword [eax + edx*4]
test eax, eax
je 0x100aba0e
mov dword [ebp - 0x18], ebx
mov ebx, dword [eax]
test ebx, ebx
je 0x100aba0e
mov dword [ebp - 0x10], edx
mov eax, dword [ebp - 0x18]
dec eax
mov dword [ebp - 0x1c], eax
mov ecx, dword [ebp - 0x20]
test cl, cl
mov eax, dword [ebp - 0x14]
cmovns eax, ecx
mov dword [ebp - 0x14], eax
jmp 0x100ab975
and eax, dword [ebp - 0x1c]
cmp eax, edx
jne 0x100aba0c
mov ebx, dword [ebx]
test ebx, ebx
je 0x100aba0c
mov eax, dword [ebx + 4]
cmp edi, eax
jne 0x100ab9d0
movzx eax, byte [ebx + 0x13]
mov ecx, eax
test al, al
jns 0x100ab989
mov ecx, dword [ebx + 0xc]
cmp ecx, dword [ebp - 0x14]
jne 0x100ab96b
lea ecx, [ebx + 8]
test al, al
jns 0x100ab997
mov ecx, dword [ecx]
js 0x100ab9ee
cmp dword [ebp - 0x14], 0
je 0x100aba08
xor ecx, ecx
nop word cs:[eax + eax]
movzx edx, byte [ebx + ecx + 8]
cmp dl, byte [esi + ecx]
jne 0x100ab96b
inc ecx
cmp eax, ecx
jne 0x100ab9b0
jmp 0x100aba08
cmp dword [ebp - 0x24], 1
mov edx, dword [ebp - 0x10]
jbe 0x100ab960
mov ecx, dword [ebp - 0x18]
cmp eax, ecx
jb 0x100ab963
xor edx, edx
div ecx
mov eax, edx
mov edx, dword [ebp - 0x10]
jmp 0x100ab963
mov eax, dword [ebp - 0x14]
test eax, eax
je 0x100aba08
push eax
push esi
push ecx
call fcn.100e033d
add esp, 0xc
test eax, eax
jne 0x100ab96b
mov ecx, ebx
jmp 0x100aba0e
xor ecx, ecx
mov eax, dword [ebp + 8]
mov dword [eax], ecx
add esp, 0x18
pop esi
pop edi
pop ebx
pop ebp
ret 8
Function at 0x100ae8d0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x80
mov eax, dword [ebp + 0xc]
mov ecx, dword [0x10123014]
xor ecx, ebp
mov dword [esp + 0x78], ecx
pcmpeqd xmm0, xmm0
movdqu xmmword [esp + 0x5e], xmm0
movdqa xmmword [esp + 0x50], xmm0
movdqa xmmword [esp + 0x40], xmm0
movdqa xmmword [esp + 0x30], xmm0
movdqa xmmword [esp + 0x20], xmm0
movzx ecx, byte [eax + 0xf]
mov dword [esp + 0x18], ecx
movzx edx, byte [eax + 0xe]
movzx esi, byte [eax + 0xd]
movzx ebx, byte [eax + 0xc]
movzx edi, byte [eax + 0xb]
movzx ecx, byte [eax + 0xa]
mov dword [esp + 0x1c], ecx
movzx ecx, byte [eax + 9]
mov dword [esp + 0x10], ecx
movzx ecx, byte [eax + 8]
mov dword [esp + 0x14], ecx
movzx ecx, word [eax + 6]
mov dword [esp + 8], ecx
movzx ecx, word [eax + 4]
mov dword [esp + 0xc], ecx
lea ecx, [esp + 0x20]
push dword [esp + 0x18]
push edx
push esi
push ebx
push edi
mov edi, ecx
push dword [esp + 0x30]
push dword [esp + 0x28]
push dword [esp + 0x30]
push dword [esp + 0x28]
push dword [esp + 0x30]
push dword [eax]
push str._08lX__04X__04X__02X_02X__02X_02X_02X_02X_02X_02X
push 0x27
push ecx
call fcn.100aea30
add esp, 0x38
test eax, eax
js 0x100aea1e
mov esi, dword [ebp + 8]
push 0x50
call fcn.100de068
add esp, 4
mov dword [esi], eax
mov dword [esi + 8], 0x80000028
mov dword [esi + 4], 0x26
lea ecx, [eax + 0x4c]
cmp ecx, edi
setbe cl
cmp eax, edi
ja 0x100ae9b9
test cl, cl
je 0x100aea00
movups xmm0, xmmword [esp + 0x5c]
movups xmmword [eax + 0x3c], xmm0
movaps xmm0, xmmword [esp + 0x50]
movups xmmword [eax + 0x30], xmm0
movaps xmm0, xmmword [esp + 0x40]
movups xmmword [eax + 0x20], xmm0
movaps xmm0, xmmword [esp + 0x20]
movaps xmm1, xmmword [esp + 0x30]
movups xmmword [eax + 0x10], xmm1
movups xmmword [eax], xmm0
mov word [eax + 0x4c], 0
mov ecx, dword [esp + 0x78]
xor ecx, ebp
call fcn.100dea63
mov eax, esi
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
push str.char_traits::copy_overlapped_range
push str.__s2_____s1____s2_____s1__n
push 0x154
push str....._buildtools_third_partylibc_trunkinclude__stringchar_traits.h
push str._s:_d:_assertion__s_failed:__s
call fcn.1003963c
int3