joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1000d950
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
imul esi, dword [ebp + 8], 0x2c
mov eax, 5
push edi
mov dword [ebp + 8], eax
add esi, dword [0x10a5f530]
test byte [esi + 0x14], 1
mov edi, dword [esi]
je 0x1000d97a
sub edi, eax
mov eax, 7
mov dword [ebp + 8], eax
lea ecx, [ebp - 4]
push ecx
push 0x40
push eax
push edi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x1000d997
pop edi
mov eax, 0xa
pop esi
mov esp, ebp
pop ebp
ret
push ebx
mov ebx, dword [ebp + 0xc]
test ebx, ebx
je 0x1000d9bc
mov byte [edi], 0xe9
mov eax, dword [esi + 4]
sub eax, edi
sub eax, 5
mov dword [edi + 1], eax
test byte [esi + 0x14], 1
je 0x1000d9dd
mov eax, dword [esi]
mov word [eax], 0xf9eb
jmp 0x1000d9dd
mov eax, dword [esi + 0xc]
test byte [esi + 0x14], 1
mov dword [edi], eax
je 0x1000d9d7
mov ax, word [esi + 0x10]
mov word [edi + 4], ax
mov al, byte [esi + 0x12]
mov byte [edi + 6], al
jmp 0x1000d9dd
mov al, byte [esi + 0x10]
mov byte [edi + 4], al
lea eax, [ebp - 4]
push eax
push dword [ebp - 4]
push dword [ebp + 8]
push edi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
push dword [ebp + 8]
push edi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_FlushInstructionCache]
mov al, byte [esi + 0x14]
and bl, 1
mov cl, bl
and al, 0xfd
add cl, cl
shl bl, 2
or cl, al
and cl, 0xfb
or cl, bl
xor eax, eax
pop ebx
pop edi
mov byte [esi + 0x14], cl
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x1000da80
Capabilities:
Enumerate threads

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [0x1013b994]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
push edi
push 0
push 4
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov edi, eax
cmp edi, 0xffffffff
je 0x1000db67
lea eax, [ebp - 0x20]
mov dword [ebp - 0x20], 0x1c
push eax
push edi
call sub.KERNEL32.dll_Thread32First
test eax, eax
je 0x1000db60
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
nop dword [eax]
cmp dword [ebp - 0x20], 0x10
jb 0x1000db46
call ebx
cmp dword [ebp - 0x14], eax
jne 0x1000db46
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp dword [ebp - 0x18], eax
je 0x1000db46
mov ecx, dword [esi]
test ecx, ecx
jne 0x1000db0f
push 0x200
push ecx
mov dword [esi + 4], 0x80
push dword [0x10a5e814]
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov dword [esi], eax
test eax, eax
je 0x1000db5f
jmp 0x1000db38
mov eax, dword [esi + 4]
cmp dword [esi + 8], eax
jb 0x1000db38
shl eax, 3
push eax
push ecx
push 0
push dword [0x10a5e814]
call dword [sym.imp.KERNEL32.dll_HeapReAlloc]
test eax, eax
je 0x1000db5f
mov ecx, dword [esi + 4]
add ecx, ecx
mov dword [esi], eax
mov dword [esi + 4], ecx
mov edx, dword [esi + 8]
mov ecx, dword [esi]
mov eax, dword [ebp - 0x18]
mov dword [ecx + edx*4], eax
inc dword [esi + 8]
lea eax, [ebp - 0x20]
mov dword [ebp - 0x20], 0x1c
push eax
push edi
call sub.KERNEL32.dll_Thread32Next
test eax, eax
jne 0x1000dad0
pop ebx
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.1000ff45
mov esp, ebp
pop ebp
ret
Function at 0x1000dc20
Capabilities:
Suspend thread

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
push esi
mov dword [esi], 0
mov dword [esi + 4], 0
mov dword [esi + 8], 0
call fcn.1000da80
add esp, 4
cmp dword [esi], 0
je 0x1000dc8c
push edi
xor edi, edi
cmp dword [esi + 8], edi
jbe 0x1000dc8b
push ebx
mov eax, dword [esi]
push dword [eax + edi*4]
push 0
push 0x5a
call dword [sym.imp.KERNEL32.dll_OpenThread]
mov ebx, eax
test ebx, ebx
je 0x1000dc84
push ebx
call dword [sym.imp.KERNEL32.dll_SuspendThread]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push ebx
call fcn.1000dea0
add esp, 0xc
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
inc edi
cmp edi, dword [esi + 8]
jb 0x1000dc52
pop ebx
pop edi
pop esi
pop ebp
ret

Function at 0x1000dfe0
Capabilities:
Resume thread

Disassembly:
push ebp
mov ebp, esp
push edi
mov edi, dword [ebp + 8]
cmp dword [edi], 0
je 0x1000e030
push esi
xor esi, esi
cmp dword [edi + 8], esi
jbe 0x1000e01f
push ebx
mov eax, dword [edi]
push dword [eax + esi*4]
push 0
push 0x5a
call dword [sym.imp.KERNEL32.dll_OpenThread]
mov ebx, eax
test ebx, ebx
je 0x1000e018
push ebx
call dword [sym.imp.KERNEL32.dll_ResumeThread]
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
inc esi
cmp esi, dword [edi + 8]
jb 0x1000dff5
pop ebx
push dword [edi]
push 0
push dword [0x10a5e814]
call dword [sym.imp.KERNEL32.dll_HeapFree]
pop esi
pop edi
pop ebp
ret
Function at 0x1001f3a5
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.1001f224

Function at 0x10023db5
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.10023a75
Function at 0x10020de0
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100fb4db
mov eax, dword fs:[0]
push eax
push ebx
sub esp, 0x3c
push esi
mov eax, dword [0x10115364]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov eax, dword [0x101d4878]
test al, 1
jne 0x10020f2b
or eax, 1
mov dword [0x101d4878], eax
mov dword [ebp - 4], 0
mov eax, 0x10
movaps xmm0, xmmword [0x1010aa60]
pxor xmm0, xmmword [0x1010a8f0]
mov dword [ebp - 0x1c], 0x56495649
mov dword [ebp - 0x18], 0x3056344e
mov word [ebp - 0x14], 0x7647
movups xmmword [ebp - 0x2c], xmm0
xor byte [ebp + eax - 0x2c], 0x76
inc eax
cmp eax, 0x1a
jb 0x10020e64
lea ecx, [ebp - 0x2c]
mov dword [ebp - 0x48], 0
mov dword [ebp - 0x38], 0
lea edx, [ecx + 1]
mov dword [ebp - 0x34], 0xf
mov byte [ebp - 0x48], 0
nop
mov al, byte [ecx]
inc ecx
test al, al
jne 0x10020e90
sub ecx, edx
lea eax, [ebp - 0x2c]
push ecx
push eax
lea ecx, [ebp - 0x48]
call fcn.10028dc0
mov byte [ebp - 4], 1
mov edx, dword [0x101d4984]
test edx, edx
je 0x10020eb9
mov edx, dword [edx + 0x50]
jmp 0x10020ebb
xor edx, edx
mov eax, dword [0x101d497c]
test eax, eax
je 0x10020ec9
mov eax, dword [eax + 0x18]
jmp 0x10020ecb
xor eax, eax
lea ecx, [ebp - 0x48]
push ecx
push eax
lea ecx, [ebp - 0x30]
call fcn.100209a0
mov eax, dword [ebp - 0x30]
add esp, 8
mov byte [ebp - 4], 0
mov edx, dword [ebp - 0x34]
mov dword [0x101d487c], eax
cmp edx, 0x10
jb 0x10020f22
mov ecx, dword [ebp - 0x48]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x10020f13
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x10020f13
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push edx
push ecx
call fcn.100f8cec
mov eax, dword [0x101d487c]
add esp, 8
mov dword [ebp - 4], 0xffffffff
jmp 0x10020f30
mov eax, dword [0x101d487c]
test eax, eax
je 0x10020f38
mov ecx, esi
call eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret
Function at 0x100225e0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100fb610
mov eax, dword fs:[0]
push eax
sub esp, 0x41c
push ebx
push esi
push edi
mov eax, dword [0x10115364]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
mov eax, dword [0x101d9bf4]
test al, 1
jne 0x10022688
or eax, 1
mov dword [0x101d9bf4], eax
mov eax, dword [0x101d49bc]
mov ebx, dword [eax + 0x30]
test ebx, ebx
je 0x10022673
nop dword [eax]
mov edi, dword [ebx + 0xc]
mov esi, 0x811c9dc5
xor ecx, ecx
nop word [eax + eax]
inc ecx
cmp byte [ecx + edi], 0
jne 0x10022640
xor edx, edx
test ecx, ecx
je 0x10022669
nop dword [eax]
movsx eax, byte [edx + edi]
inc edx
xor eax, esi
imul esi, eax, 0x1000193
cmp edx, ecx
jb 0x10022650
cmp esi, 0xc5764f31
je 0x1002267d
mov ebx, dword [ebx + 4]
test ebx, ebx
jne 0x10022630
mov esi, dword [ebp - 0x10]
xor ebx, ebx
mov dword [0x101d9bf8], ebx
jmp 0x1002268e
mov esi, dword [ebp - 0x10]
mov dword [0x101d9bf8], ebx
jmp 0x1002268e
mov ebx, dword [0x101d9bf8]
mov eax, dword [ebx]
mov ecx, ebx
push 1
mov eax, dword [eax + 0x40]
call eax
mov ecx, dword [0x101d49c0]
push str.r_jiggle_bones_0
mov eax, dword [ecx]
mov eax, dword [eax + 0x1b0]
call eax
mov eax, dword [ebp + 8]
xorps xmm0, xmm0
mov dword [ebp - 0x2c], 0
mov dword [esi], eax
mov dword [ebp - 0x41c], 0
movups xmmword [ebp - 0x408], xmm0
mov dword [ebp - 0x3b8], 0
movups xmmword [ebp - 0x3f8], xmm0
mov dword [ebp - 0x74], 0
movups xmmword [ebp - 0x3e8], xmm0
mov dword [ebp - 0x70], 0
movups xmmword [ebp - 0x3d8], xmm0
mov dword [ebp - 0x6c], 0
movups xmmword [ebp - 0x3c8], xmm0
mov byte [ebp - 0x68], 0
mov dword [ebp - 0x64], 0
mov byte [ebp - 0x60], 0
movups xmmword [ebp - 0x5c], xmm0
mov dword [ebp - 0x4c], 0
mov dword [ebp - 0x48], 0
mov word [ebp - 0x38], 0
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x18], 0xf
mov byte [ebp - 0x2c], 0
lea eax, [ebp - 0x428]
mov dword [ebp - 4], 0
push eax
lea ecx, [esi + 0x30]
call fcn.10021290
mov dword [ebp - 4], 1
mov ecx, dword [0x101d4a3c]
push dword [ebp - 0x64]
mov eax, dword [ecx]
mov eax, dword [eax + 0x14]
call eax
mov edx, dword [ebp - 0x18]
cmp edx, 0x10
jb 0x100227a5
mov ecx, dword [ebp - 0x2c]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x1002279b
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x1002279b
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push edx
push ecx
call fcn.100f8cec
add esp, 8
lea ecx, [esi + 8]
mov dword [esi + 0x28], 0
mov dword [esi + 0x2c], 0
mov dword [esi + 0x450], 0
mov dword [esi + 0x454], 0
mov dword [esi + 0x460], 0
call fcn.10028b90
mov eax, dword [esi + 0x1c]
mov dword [esi + 0x20], eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x100290f0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100fb845
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push esi
push edi
mov eax, dword [0x10115364]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, edx
mov dword [ebp - 0x10], ecx
push 0x424
call fcn.100f888d
mov ebx, eax
add esp, 4
mov dword [ebp - 0x14], ebx
mov dword [ebp - 4], 0
lea edi, [ebx + 0xc]
xorps xmm0, xmm0
mov dword [ebp - 0x18], edi
movq qword [ebx], xmm0
mov dword [ebx + 8], 0
mov dword [ebx + 4], 1
mov dword [ebx + 8], 1
mov dword [ebx], 0x10107d28
mov eax, dword [esi]
mov dword [edi + 0xc], 0
mov dword [edi + 0x20], 0
mov dword [edi + 0x24], 0
mov dword [edi + 0x28], 0
mov dword [edi + 0x2c], 0
mov dword [edi + 0x30], 0
mov dword [edi + 0x34], 0
mov dword [edi + 0x38], 0
mov dword [edi + 0x3c], 0
mov dword [edi + 0x40], 0
mov dword [edi + 0x44], 0
mov dword [edi + 0x48], 0
mov dword [edi + 0x4c], 0
mov dword [edi + 0x50], 0
mov dword [edi + 0x54], 0
mov dword [edi + 0x58], 0
mov dword [edi + 0x5c], 0
mov dword [edi + 0x60], 0
mov dword [edi + 0x64], 0
mov dword [edi + 0x68], 0
mov dword [edi + 0x6c], 0
mov dword [edi + 0x70], 0
mov dword [edi + 0x3b4], 0
mov dword [edi + 0x3b8], 0
mov dword [edi + 0x3bc], 0
mov byte [edi + 0x3c0], 0
mov dword [edi + 0x3c4], 0
mov byte [edi + 0x3c8], 0
mov dword [edi + 0x3cc], 0
mov dword [edi + 0x3d0], 0
mov dword [edi + 0x3d4], 0
mov dword [edi + 0x3d8], 0
mov dword [edi + 0x3dc], 0
mov dword [edi + 0x3e0], 0
mov word [edi + 0x3f0], 0
mov dword [edi + 0x3fc], 0
mov dword [edi + 0x40c], 0
mov dword [edi + 0x410], 0xf
push eax
mov ecx, edi
mov byte [ebp - 4], 1
call fcn.10021000
mov eax, dword [ebp - 0x10]
xorps xmm0, xmm0
movq qword [eax], xmm0
mov dword [eax], edi
mov dword [eax + 4], ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10031750
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x10115364]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, ecx
cmp dword [esi + 0x38], 0
je 0x1003180c
cmp byte [esi + 0x3d], 0
je 0x1003180c
mov eax, dword [esi]
push edi
push 0xffffffffffffffff
call dword [eax + 0xc]
cmp eax, 0xffffffff
je 0x100317fa
mov ecx, dword [esi + 0x38]
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [esi + 0x40]
push eax
call dword [sym.imp.MSVCP140.dll_public:_int___thiscall_std::codecvt_char__char__struct__Mbstatet_::unshift_struct__Mbstatet___char___char___char___const]
sub eax, 0
je 0x100317c1
sub eax, 1
je 0x100317c5
sub eax, 2
jne 0x100317fa
mov byte [esi + 0x3d], al
mov al, 1
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100f8871
mov esp, ebp
pop ebp
ret
mov byte [esi + 0x3d], 0
mov edi, dword [ebp - 0x28]
lea eax, [ebp - 0x24]
sub edi, eax
je 0x100317e3
push dword [esi + 0x4c]
push edi
push 1
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
add esp, 0x10
cmp edi, eax
jne 0x100317fa
cmp byte [esi + 0x3d], 0
pop edi
sete al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100f8871
mov esp, ebp
pop ebp
ret
pop edi
xor al, al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100f8871
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
mov al, 1
xor ecx, ebp
pop esi
call fcn.100f8871
mov esp, ebp
pop ebp
ret
Function at 0x100350a0
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100fc016
mov eax, dword fs:[0]
push eax
push ebx
sub esp, 0x40
mov eax, dword [0x10115364]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 4], 0
mov eax, dword [0x101d9c10]
test al, 1
jne 0x100351eb
or eax, 1
mov dword [0x101d9c10], eax
mov byte [ebp - 4], 1
mov eax, 0x10
movaps xmm0, xmmword [0x1010aa60]
pxor xmm0, xmmword [0x1010a780]
mov dword [ebp - 0x3c], 0x4f305634
mov dword [ebp - 0x38], 0x56303056
mov word [ebp - 0x34], 0x4347
mov byte [ebp - 0x32], 0x76
movups xmmword [ebp - 0x4c], xmm0
nop dword [eax]
xor byte [ebp + eax - 0x4c], 0x76
inc eax
cmp eax, 0x1b
jb 0x10035130
lea ecx, [ebp - 0x4c]
mov dword [ebp - 0x30], 0
mov dword [ebp - 0x20], 0
lea edx, [ecx + 1]
mov dword [ebp - 0x1c], 0xf
mov byte [ebp - 0x30], 0
nop word [eax + eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x10035160
sub ecx, edx
lea eax, [ebp - 0x4c]
push ecx
push eax
lea ecx, [ebp - 0x30]
call fcn.10028dc0
mov byte [ebp - 4], 2
mov edx, dword [0x101d4990]
test edx, edx
je 0x10035189
mov edx, dword [edx + 0x50]
jmp 0x1003518b
xor edx, edx
mov eax, dword [0x101d4988]
test eax, eax
je 0x10035199
mov eax, dword [eax + 0x18]
jmp 0x1003519b
xor eax, eax
lea ecx, [ebp - 0x30]
push ecx
push eax
lea ecx, [ebp - 0x14]
call fcn.100209a0
mov eax, dword [ebp - 0x14]
add esp, 8
mov byte [ebp - 4], 1
mov edx, dword [ebp - 0x1c]
mov dword [0x101d9c18], eax
cmp edx, 0x10
jb 0x100351e7
mov ecx, dword [ebp - 0x30]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x100351dd
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x10035233
push edx
push ecx
call fcn.100f8cec
add esp, 8
mov byte [ebp - 4], 0
cmp dword [ebx + 0x1c], 0x10
lea ecx, [ebx + 8]
lea edx, [ebp - 0x18]
mov dword [ebp - 0x18], 0x68786976
cmovae ecx, dword [ebx + 8]
mov dword [ebp - 0x14], 0x6b6f6f
call dword [0x101d9c18]
mov edx, dword [ebx + 0x1c]
cmp edx, 0x10
jb 0x10035243
mov ecx, dword [ebx + 8]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x10035239
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x10035239
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push edx
push ecx
call fcn.100f8cec
add esp, 8
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret 0x18
Function at 0x10035c80
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
cmp byte [0x101d1e3c], 0
push ebx
push esi
push edi
je 0x10035e0e
mov ecx, dword [0x101d49c0]
mov eax, dword [ecx]
mov eax, dword [eax + 0x68]
call eax
test al, al
je 0x10035e0e
mov ecx, dword [0x101d4a44]
xor ebx, ebx
mov dword [ebp - 4], ecx
mov eax, dword [ecx + 0x28]
mov dword [ebp - 8], eax
test eax, eax
je 0x10035e0e
mov eax, dword [ecx + 0x1c]
mov ecx, dword [eax + ebx*4]
mov eax, dword [ecx]
mov eax, dword [eax + 0x30]
call eax
mov esi, eax
mov edi, 0x811c9dc5
xor ecx, ecx
nop word [eax + eax]
inc ecx
cmp byte [ecx + esi], 0
jne 0x10035ce0
xor edx, edx
test ecx, ecx
je 0x10035d09
nop dword [eax]
movsx eax, byte [edx + esi]
inc edx
xor eax, edi
imul edi, eax, 0x1000193
cmp edx, ecx
jb 0x10035cf0
cmp edi, 0x5ff56dc5
je 0x10035d18
inc ebx
cmp ebx, dword [ebp - 8]
jae 0x10035e0e
mov ecx, dword [ebp - 4]
jmp 0x10035cc4
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x1c]
mov edi, dword [eax + ebx*4]
test edi, edi
je 0x10035e0e
mov edx, dword [edi + 0x88]
test edx, edx
je 0x10035e0e
movss xmm1, dword [0x10109c00]
xor ebx, ebx
cmp edx, 4
jl 0x10035ddb
mov ecx, dword [edi + 0x7c]
lea esi, [edx - 4]
shr esi, 2
add ecx, 0x1078
inc esi
lea ebx, [esi*4]
movss xmm0, dword [ecx - 0xc60]
ucomiss xmm0, xmm1
lahf
test ah, 0x44
jp 0x10035d7c
mov dword [ecx - 0xc60], 0x7f7fffff
movss xmm0, dword [ecx - 0x840]
ucomiss xmm0, xmm1
lahf
test ah, 0x44
jp 0x10035d97
mov dword [ecx - 0x840], 0x7f7fffff
movss xmm0, dword [ecx - 0x420]
ucomiss xmm0, xmm1
lahf
test ah, 0x44
jp 0x10035db2
mov dword [ecx - 0x420], 0x7f7fffff
movss xmm0, dword [ecx]
ucomiss xmm0, xmm1
lahf
test ah, 0x44
jp 0x10035dc5
mov dword [ecx], 0x7f7fffff
add ecx, 0x1080
sub esi, 1
jne 0x10035d61
cmp ebx, edx
jl 0x10035ddf
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
test edx, edx
jle 0x10035e0e
imul ecx, ebx, 0x420
add ecx, 0x418
add ecx, dword [edi + 0x7c]
sub edx, ebx
movss xmm0, dword [ecx]
ucomiss xmm0, xmm1
lahf
test ah, 0x44
jp 0x10035e03
mov dword [ecx], 0x7f7fffff
add ecx, 0x420
sub edx, 1
jne 0x10035df0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10037700
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100fc0f5
mov eax, dword fs:[0]
push eax
sub esp, 0x30
mov eax, dword [0x10115364]
xor eax, ebp
mov dword [ebp - 0x14], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 4], 0
mov dword [ebp - 0x2c], 0
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x18], 0xf
mov byte [ebp - 0x2c], 0
mov byte [ebp - 4], 1
cmp dword [ebp + 0x1c], 0
je 0x1003785c
cmp dword [ebp + 0x20], 0x10
lea ecx, [ebp + 0x24]
lea eax, [ebp + 0xc]
cmovae eax, dword [ebp + 0xc]
xor edx, edx
push ecx
push eax
xor ecx, ecx
call fcn.10032fe0
mov ecx, dword [ebp - 0x1c]
mov esi, eax
add esp, 8
cmp esi, ecx
ja 0x10037790
cmp dword [ebp - 0x18], 0x10
lea ecx, [ebp - 0x2c]
mov dword [ebp - 0x1c], esi
cmovae ecx, dword [ebp - 0x2c]
mov byte [ecx + esi], 0
jmp 0x1003779d
sub eax, ecx
lea ecx, [ebp - 0x2c]
push 0
push eax
call fcn.10038380
cmp dword [ebp + 0x20], 0x10
lea eax, [ebp + 0xc]
lea edx, [ebp + 0x24]
cmovae eax, dword [ebp + 0xc]
lea ecx, [ebp - 0x2c]
cmp dword [ebp - 0x18], 0x10
push edx
cmovae ecx, dword [ebp - 0x2c]
lea edx, [esi + 1]
push eax
call fcn.10032fe0
add esp, 8
mov dword [ebp - 0x38], 0xe1f002d
mov dword [ebp - 0x34], 0x1d19191e
xor eax, eax
mov word [ebp - 0x30], 0x562b
mov byte [ebp - 0x2e], 0x76
nop dword [eax]
xor byte [ebp + eax - 0x38], 0x76
inc eax
cmp eax, 0xb
jb 0x100377e0
mov eax, dword [0x101d24f8]
lea edx, [ebp - 0x38]
mov dword [ebp - 0x3c], eax
mov eax, dword [0x101d49bc]
push edx
lea edx, [ebp - 0x3c]
push edx
mov ecx, dword [eax]
push eax
mov eax, dword [ecx + 0x64]
call eax
mov eax, dword [0x101d49bc]
lea edx, [ebp - 0x2c]
add esp, 0xc
cmp dword [ebp - 0x18], 0x10
cmovae edx, dword [ebp - 0x2c]
mov ecx, dword [eax]
push edx
push 0x101a95dc
push eax
mov eax, dword [ecx + 0x64]
call eax
mov edx, dword [ebp - 0x18]
add esp, 0xc
cmp edx, 0x10
jb 0x1003785c
mov ecx, dword [ebp - 0x2c]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x10037852
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x10037894
push edx
push ecx
call fcn.100f8cec
add esp, 8
mov edx, dword [ebp + 0x20]
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x18], 0xf
mov byte [ebp - 0x2c], 0
cmp edx, 0x10
jb 0x100378a4
mov ecx, dword [ebp + 0xc]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x1003789a
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x1003789a
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push edx
push ecx
call fcn.100f8cec
add esp, 8
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.100f8871
mov esp, ebp
pop ebp
ret
Function at 0x10037db0
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100fc135
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push ebx
push esi
push edi
mov eax, dword [0x10115364]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
movzx eax, byte [esi]
xor eax, 0x811c9dc5
imul ecx, eax, 0x1000193
movzx eax, byte [esi + 1]
xor ecx, eax
movzx eax, byte [esi + 2]
imul ecx, ecx, 0x1000193
xor ecx, eax
movzx eax, byte [esi + 3]
imul ecx, ecx, 0x1000193
xor ecx, eax
lea eax, [ebp - 0x14]
imul edi, ecx, 0x1000193
push edi
push esi
push eax
call fcn.10039ae0
mov eax, dword [ebp - 0x10]
test eax, eax
jne 0x10037edb
cmp dword [0x101d9a88], 0xfffffff
jne 0x10037e3a
push str.unordered_map_set_too_long
call dword [sym.imp.MSVCP140.dll_void___cdecl_std::_Xlength_error_char_const__]
mov dword [ebp - 0x1c], 0x101d9a84
mov dword [ebp - 4], 0
push 0x10
mov dword [ebp - 0x18], 0
call fcn.100f888d
mov ebx, eax
add esp, 4
mov eax, dword [esi]
mov dword [ebp - 0x18], ebx
mov dword [ebx + 8], eax
mov dword [ebx + 0xc], 0
mov dword [ebp - 4], 1
mov eax, dword [0x101d9a88]
inc eax
movd xmm0, eax
cvtdq2pd xmm0, xmm0
shr eax, 0x1f
addsd xmm0, qword [eax*8 + 0x1010a570]
mov eax, dword [0x101d9a9c]
cvtpd2ps xmm1, xmm0
movd xmm0, eax
cvtdq2pd xmm0, xmm0
shr eax, 0x1f
addsd xmm0, qword [eax*8 + 0x1010a570]
cvtpd2ps xmm0, xmm0
divss xmm1, xmm0
comiss xmm1, dword [0x101d9a80]
jbe 0x10037ed0
call fcn.100395e0
push edi
lea eax, [ebx + 8]
push eax
lea eax, [ebp - 0x1c]
push eax
call fcn.10039ae0
mov ecx, dword [eax]
jmp 0x10037ed3
mov ecx, dword [ebp - 0x14]
push ebx
push ecx
push edi
call fcn.10039660
add eax, 0xc
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4