joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10120e80
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10177c35
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x40
push ebx
push esi
push edi
mov dword [ebp - 0x10], ecx
lea eax, [ebp + 8]
mov dword [ebp - 4], 0
push eax
lea ecx, [ebp - 0x34]
call fcn.10091990
mov byte [ebp - 4], 1
sub esp, 0x18
lea eax, [ebp - 0x34]
mov ecx, esp
push eax
call fcn.10091990
lea eax, [ebp - 0x4c]
push eax
call fcn.100e2850
push eax
lea ecx, [ebp - 0x34]
call fcn.100918d0
mov ecx, dword [ebp - 0x38]
cmp ecx, 0xf
jbe 0x10120f0c
mov edx, dword [ebp - 0x4c]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x10120f02
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x1012104c
push ecx
push edx
call fcn.1016f528
add esp, 8
cmp dword [ebp - 0x20], 0xf
lea edi, [ebp - 0x34]
mov ebx, 0x811c9dc5
cmova edi, dword [ebp - 0x34]
xor edx, edx
mov ecx, edi
lea esi, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x10120f23
sub ecx, esi
je 0x10120f4f
nop
movsx eax, byte [edx + edi]
mov ecx, edi
xor eax, ebx
imul ebx, eax, 0x1000193
inc edx
lea esi, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x10120f42
sub ecx, esi
cmp edx, ecx
jb 0x10120f30
mov al, byte [0x102732c8]
test al, al
jne 0x10120f5f
mov eax, 0x811c9dc5
jmp 0x10120f77
movsx eax, al
mov ecx, 0x102732c9
xor eax, 0x811c9dc5
imul edx, eax, 0x1000193
call fcn.100de180
cmp ebx, eax
mov ebx, dword [ebp - 0x10]
je 0x10120fcd
mov edi, dword [ebp - 0x24]
lea esi, [ebp - 0x34]
add ebx, 0x28
mov edx, 0x811c9dc5
cmp dword [ebp - 0x20], 0xf
cmova esi, dword [ebp - 0x34]
xor ecx, ecx
test edi, edi
je 0x10120fb1
nop word [eax + eax]
movzx eax, byte [ecx + esi]
inc ecx
xor eax, edx
imul edx, eax, 0x1000193
cmp ecx, edi
jb 0x10120fa0
push edx
lea eax, [ebp - 0x34]
mov ecx, ebx
push eax
lea eax, [ebp - 0x1c]
push eax
call fcn.10094890
cmp dword [eax + 4], 0
je 0x10120eb8
jmp 0x10120fd0
add ebx, 0x28
lea eax, [ebp - 0x34]
mov ecx, ebx
push eax
call fcn.100e4090
mov ecx, dword [ebp - 0x20]
movss xmm0, dword [eax]
movss dword [ebp - 0x10], xmm0
cmp ecx, 0xf
jbe 0x10121014
mov edx, dword [ebp - 0x34]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x1012100a
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x1012104c
push ecx
push edx
call fcn.1016f528
add esp, 8
mov ecx, dword [ebp + 0x1c]
mov dword [ebp - 0x24], 0
mov dword [ebp - 0x20], 0xf
mov byte [ebp - 0x34], 0
cmp ecx, 0xf
jbe 0x1012105c
mov edx, dword [ebp + 8]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x10121052
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x10121052
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push ecx
push edx
call fcn.1016f528
add esp, 8
mov ecx, dword [ebp - 0xc]
movss xmm0, dword [ebp - 0x10]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10121080
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10177c35
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x40
push ebx
push esi
push edi
mov dword [ebp - 0x10], ecx
lea eax, [ebp + 8]
mov dword [ebp - 4], 0
push eax
lea ecx, [ebp - 0x34]
call fcn.10091990
mov byte [ebp - 4], 1
sub esp, 0x18
lea eax, [ebp - 0x34]
mov ecx, esp
push eax
call fcn.10091990
lea eax, [ebp - 0x4c]
push eax
call fcn.100e2850
push eax
lea ecx, [ebp - 0x34]
call fcn.100918d0
mov ecx, dword [ebp - 0x38]
cmp ecx, 0xf
jbe 0x1012110c
mov edx, dword [ebp - 0x4c]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x10121102
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x10121245
push ecx
push edx
call fcn.1016f528
add esp, 8
cmp dword [ebp - 0x20], 0xf
lea edi, [ebp - 0x34]
mov ebx, 0x811c9dc5
cmova edi, dword [ebp - 0x34]
xor edx, edx
mov ecx, edi
lea esi, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x10121123
sub ecx, esi
je 0x1012114f
nop
movsx eax, byte [edx + edi]
xor eax, ebx
imul ebx, eax, 0x1000193
mov eax, edi
inc edx
lea esi, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x10121142
sub eax, esi
cmp edx, eax
jb 0x10121130
mov al, byte [0x102732c8]
test al, al
jne 0x1012115f
mov eax, 0x811c9dc5
jmp 0x10121177
movsx eax, al
mov ecx, 0x102732c9
xor eax, 0x811c9dc5
imul edx, eax, 0x1000193
call fcn.100de180
cmp ebx, eax
mov ebx, dword [ebp - 0x10]
je 0x101211cd
mov edi, dword [ebp - 0x24]
lea esi, [ebp - 0x34]
add ebx, 0x28
mov edx, 0x811c9dc5
cmp dword [ebp - 0x20], 0xf
cmova esi, dword [ebp - 0x34]
xor ecx, ecx
test edi, edi
je 0x101211b1
nop word [eax + eax]
movzx eax, byte [ecx + esi]
inc ecx
xor eax, edx
imul edx, eax, 0x1000193
cmp ecx, edi
jb 0x101211a0
push edx
lea eax, [ebp - 0x34]
mov ecx, ebx
push eax
lea eax, [ebp - 0x1c]
push eax
call fcn.10094890
cmp dword [eax + 4], 0
je 0x101210b8
jmp 0x101211d0
add ebx, 0x28
lea eax, [ebp - 0x34]
mov ecx, ebx
push eax
call fcn.100e4090
mov ecx, dword [ebp - 0x20]
mov esi, dword [eax]
cmp ecx, 0xf
jbe 0x1012120d
mov edx, dword [ebp - 0x34]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x10121203
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x10121245
push ecx
push edx
call fcn.1016f528
add esp, 8
mov ecx, dword [ebp + 0x1c]
mov dword [ebp - 0x24], 0
mov dword [ebp - 0x20], 0xf
mov byte [ebp - 0x34], 0
cmp ecx, 0xf
jbe 0x10121255
mov edx, dword [ebp + 8]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x1012124b
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x1012124b
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push ecx
push edx
call fcn.1016f528
add esp, 8
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x101214a0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10177cb5
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x50
push ebx
push esi
push edi
mov dword [ebp - 0x14], edx
mov dword [ebp - 0x18], ecx
lea eax, [ebp + 8]
mov dword [ebp - 4], 0
push eax
lea ecx, [ebp - 0x40]
call fcn.10091990
mov byte [ebp - 4], 1
nop dword [eax + eax]
sub esp, 0x18
lea eax, [ebp - 0x40]
mov ecx, esp
push eax
call fcn.10091990
lea eax, [ebp - 0x58]
push eax
call fcn.100e2850
push eax
lea ecx, [ebp - 0x40]
call fcn.100918d0
mov ecx, dword [ebp - 0x44]
cmp ecx, 0xf
jbe 0x10121534
mov edx, dword [ebp - 0x58]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x1012152a
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x1012167b
push ecx
push edx
call fcn.1016f528
add esp, 8
cmp dword [ebp - 0x2c], 0xf
lea edi, [ebp - 0x40]
mov ebx, 0x811c9dc5
cmova edi, dword [ebp - 0x40]
xor edx, edx
mov ecx, edi
mov dword [ebp - 0x10], ebx
lea esi, [ecx + 1]
nop
mov al, byte [ecx]
inc ecx
test al, al
jne 0x10121550
sub ecx, esi
je 0x10121582
nop dword [eax + eax]
movsx eax, byte [edx + edi]
xor eax, ebx
imul ebx, eax, 0x1000193
mov eax, edi
inc edx
lea esi, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x10121572
sub eax, esi
cmp edx, eax
jb 0x10121560
mov dword [ebp - 0x10], ebx
mov al, byte [0x102732c8]
test al, al
jne 0x10121592
mov eax, 0x811c9dc5
jmp 0x101215aa
movsx eax, al
mov ecx, 0x102732c9
xor eax, 0x811c9dc5
imul edx, eax, 0x1000193
call fcn.100de180
mov ebx, dword [ebp - 0x14]
cmp dword [ebp - 0x10], eax
je 0x101215fc
cmp dword [ebp - 0x2c], 0xf
lea esi, [ebp - 0x40]
mov edi, dword [ebp - 0x30]
mov edx, 0x811c9dc5
cmova esi, dword [ebp - 0x40]
xor ecx, ecx
test edi, edi
je 0x101215e1
nop dword [eax + eax]
movzx eax, byte [ecx + esi]
inc ecx
xor eax, edx
imul edx, eax, 0x1000193
cmp ecx, edi
jb 0x101215d0
push edx
lea eax, [ebp - 0x40]
push eax
lea eax, [ebp - 0x28]
push eax
lea ecx, [ebx + 0x50]
call fcn.10094890
cmp dword [eax + 4], 0
je 0x101214e0
lea eax, [ebp - 0x40]
push eax
lea ecx, [ebx + 0x50]
call fcn.100e40f0
mov esi, dword [ebp - 0x18]
mov ecx, esi
push eax
call fcn.10091990
mov ecx, dword [ebp - 0x2c]
cmp ecx, 0xf
jbe 0x10121643
mov edx, dword [ebp - 0x40]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x10121639
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x1012167b
push ecx
push edx
call fcn.1016f528
add esp, 8
mov ecx, dword [ebp + 0x1c]
mov dword [ebp - 0x30], 0
mov dword [ebp - 0x2c], 0xf
mov byte [ebp - 0x40], 0
cmp ecx, 0xf
jbe 0x1012168b
mov edx, dword [ebp + 8]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x10121681
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x10121681
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push ecx
push edx
call fcn.1016f528
add esp, 8
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10121960
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10177cb5
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x50
push ebx
push esi
push edi
mov dword [ebp - 0x14], edx
mov dword [ebp - 0x18], ecx
lea eax, [ebp + 8]
mov dword [ebp - 4], 0
push eax
lea ecx, [ebp - 0x40]
call fcn.10091990
mov byte [ebp - 4], 1
nop dword [eax + eax]
sub esp, 0x18
lea eax, [ebp - 0x40]
mov ecx, esp
push eax
call fcn.10091990
lea eax, [ebp - 0x58]
push eax
call fcn.100e2850
push eax
lea ecx, [ebp - 0x40]
call fcn.100918d0
mov ecx, dword [ebp - 0x44]
cmp ecx, 0xf
jbe 0x101219f4
mov edx, dword [ebp - 0x58]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x101219ea
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x10121b3b
push ecx
push edx
call fcn.1016f528
add esp, 8
cmp dword [ebp - 0x2c], 0xf
lea edi, [ebp - 0x40]
mov ebx, 0x811c9dc5
cmova edi, dword [ebp - 0x40]
xor edx, edx
mov ecx, edi
mov dword [ebp - 0x10], ebx
lea esi, [ecx + 1]
nop
mov al, byte [ecx]
inc ecx
test al, al
jne 0x10121a10
sub ecx, esi
je 0x10121a42
nop dword [eax + eax]
movsx eax, byte [edx + edi]
xor eax, ebx
imul ebx, eax, 0x1000193
mov eax, edi
inc edx
lea esi, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x10121a32
sub eax, esi
cmp edx, eax
jb 0x10121a20
mov dword [ebp - 0x10], ebx
mov al, byte [0x102732c8]
test al, al
jne 0x10121a52
mov eax, 0x811c9dc5
jmp 0x10121a6a
movsx eax, al
mov ecx, 0x102732c9
xor eax, 0x811c9dc5
imul edx, eax, 0x1000193
call fcn.100de180
mov ebx, dword [ebp - 0x14]
cmp dword [ebp - 0x10], eax
je 0x10121abc
cmp dword [ebp - 0x2c], 0xf
lea esi, [ebp - 0x40]
mov edi, dword [ebp - 0x30]
mov edx, 0x811c9dc5
cmova esi, dword [ebp - 0x40]
xor ecx, ecx
test edi, edi
je 0x10121aa1
nop dword [eax + eax]
movzx eax, byte [ecx + esi]
inc ecx
xor eax, edx
imul edx, eax, 0x1000193
cmp ecx, edi
jb 0x10121a90
push edx
lea eax, [ebp - 0x40]
push eax
lea eax, [ebp - 0x28]
push eax
lea ecx, [ebx + 0x38]
call fcn.10094890
cmp dword [eax + 4], 0
je 0x101219a0
lea eax, [ebp - 0x40]
push eax
lea ecx, [ebx + 0x38]
call fcn.100e4030
mov esi, dword [ebp - 0x18]
mov ecx, esi
push eax
call fcn.100f5b80
mov ecx, dword [ebp - 0x2c]
cmp ecx, 0xf
jbe 0x10121b03
mov edx, dword [ebp - 0x40]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x10121af9
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x10121b3b
push ecx
push edx
call fcn.1016f528
add esp, 8
mov ecx, dword [ebp + 0x1c]
mov dword [ebp - 0x30], 0
mov dword [ebp - 0x2c], 0xf
mov byte [ebp - 0x40], 0
cmp ecx, 0xf
jbe 0x10121b4b
mov edx, dword [ebp + 8]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x10121b41
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x10121b41
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push ecx
push edx
call fcn.1016f528
add esp, 8
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10121b60
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10177c35
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x40
push ebx
push esi
push edi
mov dword [ebp - 0x10], ecx
lea eax, [ebp + 8]
mov dword [ebp - 4], 0
push eax
lea ecx, [ebp - 0x34]
call fcn.10091990
mov byte [ebp - 4], 1
sub esp, 0x18
lea eax, [ebp - 0x34]
mov ecx, esp
push eax
call fcn.10091990
lea eax, [ebp - 0x4c]
push eax
call fcn.100e2850
push eax
lea ecx, [ebp - 0x34]
call fcn.100918d0
mov ecx, dword [ebp - 0x38]
cmp ecx, 0xf
jbe 0x10121bec
mov edx, dword [ebp - 0x4c]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x10121be2
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x10121d25
push ecx
push edx
call fcn.1016f528
add esp, 8
cmp dword [ebp - 0x20], 0xf
lea edi, [ebp - 0x34]
mov ebx, 0x811c9dc5
cmova edi, dword [ebp - 0x34]
xor edx, edx
mov ecx, edi
lea esi, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x10121c03
sub ecx, esi
je 0x10121c2f
nop
movsx eax, byte [edx + edi]
xor eax, ebx
imul ebx, eax, 0x1000193
mov eax, edi
inc edx
lea esi, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x10121c22
sub eax, esi
cmp edx, eax
jb 0x10121c10
mov al, byte [0x102732c8]
test al, al
jne 0x10121c3f
mov eax, 0x811c9dc5
jmp 0x10121c57
movsx eax, al
mov ecx, 0x102732c9
xor eax, 0x811c9dc5
imul edx, eax, 0x1000193
call fcn.100de180
cmp ebx, eax
mov ebx, dword [ebp - 0x10]
je 0x10121cad
mov edi, dword [ebp - 0x24]
lea esi, [ebp - 0x34]
add ebx, 0x28
mov edx, 0x811c9dc5
cmp dword [ebp - 0x20], 0xf
cmova esi, dword [ebp - 0x34]
xor ecx, ecx
test edi, edi
je 0x10121c91
nop word [eax + eax]
movzx eax, byte [ecx + esi]
inc ecx
xor eax, edx
imul edx, eax, 0x1000193
cmp ecx, edi
jb 0x10121c80
push edx
lea eax, [ebp - 0x34]
mov ecx, ebx
push eax
lea eax, [ebp - 0x1c]
push eax
call fcn.10094890
cmp dword [eax + 4], 0
je 0x10121b98
jmp 0x10121cb0
add ebx, 0x28
lea eax, [ebp - 0x34]
mov ecx, ebx
push eax
call fcn.100e4070
mov ecx, dword [ebp - 0x20]
mov esi, dword [eax]
cmp ecx, 0xf
jbe 0x10121ced
mov edx, dword [ebp - 0x34]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x10121ce3
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x10121d25
push ecx
push edx
call fcn.1016f528
add esp, 8
mov ecx, dword [ebp + 0x1c]
mov dword [ebp - 0x24], 0
mov dword [ebp - 0x20], 0xf
mov byte [ebp - 0x34], 0
cmp ecx, 0xf
jbe 0x10121d35
mov edx, dword [ebp + 8]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x10121d2b
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x10121d2b
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push ecx
push edx
call fcn.1016f528
add esp, 8
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10121d50
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10177c5d
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ebx
sub esp, 0x48
test byte [0x102a59ac], 6
push esi
mov esi, ecx
push edi
mov dword [ebp - 0x18], esi
je 0x10121de3
xorps xmm0, xmm0
movups xmmword [esi], xmm0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
mov dword [esi + 0x10], 7
mov dword [esi + 0x14], 0xf
mov eax, dword [0x102732c8]
mov dword [esi], eax
mov ax, word [0x102732cc]
mov word [esi + 4], ax
mov al, byte [0x102732ce]
mov byte [esi + 6], al
mov eax, esi
mov byte [esi + 7], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret
cmp byte [ebx + 8], 0
push str.default
je 0x10121e08
call fcn.10091990
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret
lea ecx, [ebp - 0x3c]
call fcn.10091990
mov dword [ebp - 4], 0
nop word [eax + eax]
cmp dword [ebp - 0x28], 0xf
lea edi, [ebp - 0x3c]
mov esi, 0x811c9dc5
cmova edi, dword [ebp - 0x3c]
xor edx, edx
mov ecx, edi
lea eax, [ecx + 1]
mov dword [ebp - 0x14], eax
nop word [eax + eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x10121e40
sub ecx, dword [ebp - 0x14]
je 0x10121e61
nop dword [eax]
movsx eax, byte [edx + edi]
inc edx
xor eax, esi
imul esi, eax, 0x1000193
cmp edx, ecx
jb 0x10121e50
mov eax, dword [0x102732c8]
test al, al
jne 0x10121e71
mov eax, 0x811c9dc5
jmp 0x10121e89
movsx eax, al
mov ecx, 0x102732c9
xor eax, 0x811c9dc5
imul edx, eax, 0x1000193
call fcn.100de180
cmp esi, eax
je 0x10121f39
cmp dword [ebp - 0x28], 0xf
lea esi, [ebp - 0x3c]
mov edi, dword [ebp - 0x2c]
mov edx, 0x811c9dc5
cmova esi, dword [ebp - 0x3c]
xor eax, eax
test edi, edi
je 0x10121ec1
nop word [eax + eax]
movzx ecx, byte [eax + esi]
inc eax
xor ecx, edx
imul edx, ecx, 0x1000193
cmp eax, edi
jb 0x10121eb0
push edx
lea eax, [ebp - 0x3c]
mov ecx, 0x102a59c0
push eax
lea eax, [ebp - 0x24]
push eax
call fcn.10094890
cmp dword [eax + 4], 0
jne 0x10121f39
sub esp, 0x18
lea eax, [ebp - 0x3c]
mov ecx, esp
push eax
call fcn.10091990
lea eax, [ebp - 0x54]
push eax
call fcn.100e2850
push eax
lea ecx, [ebp - 0x3c]
call fcn.100918d0
mov ecx, dword [ebp - 0x40]
cmp ecx, 0xf
jbe 0x10121e20
mov edx, dword [ebp - 0x54]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x10121f24
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x10121f33
push ecx
push edx
call fcn.1016f528
add esp, 8
jmp 0x10121e20
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
mov eax, dword [ebp - 0x18]
xorps xmm0, xmm0
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
movups xmmword [eax], xmm0
mov dword [eax + 0x10], 0
movups xmm0, xmmword [ebp - 0x3c]
mov dword [eax + 0x14], 0
movups xmmword [eax], xmm0
movq xmm0, qword [ebp - 0x2c]
movq qword [eax + 0x10], xmm0
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret
Function at 0x10121f80
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10177c85
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x40
push ebx
push esi
push edi
lea eax, [ebp + 8]
mov dword [ebp - 4], 0
push eax
lea ecx, [ebp - 0x30]
call fcn.10091990
mov byte [ebp - 4], 1
sub esp, 0x18
lea eax, [ebp - 0x30]
mov ecx, esp
push eax
call fcn.10091990
lea eax, [ebp - 0x48]
push eax
call fcn.100e2850
push eax
lea ecx, [ebp - 0x30]
call fcn.100918d0
mov ecx, dword [ebp - 0x34]
cmp ecx, 0xf
jbe 0x10122009
mov edx, dword [ebp - 0x48]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x10121fff
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x1012213d
push ecx
push edx
call fcn.1016f528
add esp, 8
cmp dword [ebp - 0x1c], 0xf
lea edi, [ebp - 0x30]
mov ebx, 0x811c9dc5
cmova edi, dword [ebp - 0x30]
xor edx, edx
mov ecx, edi
lea esi, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x10122020
sub ecx, esi
je 0x1012204f
nop dword [eax + eax]
movsx eax, byte [edx + edi]
xor eax, ebx
imul ebx, eax, 0x1000193
mov eax, edi
inc edx
lea esi, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x10122042
sub eax, esi
cmp edx, eax
jb 0x10122030
mov al, byte [0x102732c8]
test al, al
jne 0x1012205f
mov eax, 0x811c9dc5
jmp 0x10122077
movsx eax, al
mov ecx, 0x102732c9
xor eax, 0x811c9dc5
imul edx, eax, 0x1000193
call fcn.100de180
cmp ebx, eax
je 0x101220c2
cmp dword [ebp - 0x1c], 0xf
lea esi, [ebp - 0x30]
mov edi, dword [ebp - 0x20]
mov edx, 0x811c9dc5
cmova esi, dword [ebp - 0x30]
xor ecx, ecx
test edi, edi
je 0x101220a5
movzx eax, byte [ecx + esi]
inc ecx
xor eax, edx
imul edx, eax, 0x1000193
cmp ecx, edi
jb 0x10122094
push edx
lea eax, [ebp - 0x30]
mov ecx, 0x102a59c0
push eax
lea eax, [ebp - 0x18]
push eax
call fcn.10094890
cmp dword [eax + 4], 0
je 0x10121fb5
lea eax, [ebp - 0x30]
mov ecx, 0x102a59c0
push eax
call fcn.100e3ff0
mov ecx, dword [ebp - 0x1c]
mov esi, dword [eax]
mov edi, dword [eax + 4]
cmp ecx, 0xf
jbe 0x10122105
mov edx, dword [ebp - 0x30]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x101220fb
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x1012213d
push ecx
push edx
call fcn.1016f528
add esp, 8
mov ecx, dword [ebp + 0x1c]
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x1c], 0xf
mov byte [ebp - 0x30], 0
cmp ecx, 0xf
jbe 0x1012214d
mov edx, dword [ebp + 8]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x10122143
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x10122143
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push ecx
push edx
call fcn.1016f528
add esp, 8
mov ecx, dword [ebp - 0xc]
mov edx, edi
pop edi
mov eax, esi
mov dword fs:[0], ecx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10122da0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10177c35
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x40
push ebx
push esi
push edi
mov dword [ebp - 0x10], ecx
lea eax, [ebp + 8]
mov dword [ebp - 4], 0
push eax
lea ecx, [ebp - 0x34]
call fcn.10091990
mov byte [ebp - 4], 1
sub esp, 0x18
lea eax, [ebp - 0x34]
mov ecx, esp
push eax
call fcn.10091990
lea eax, [ebp - 0x4c]
push eax
call fcn.100e2850
push eax
lea ecx, [ebp - 0x34]
call fcn.100918d0
mov ecx, dword [ebp - 0x38]
cmp ecx, 0xf
jbe 0x10122e2c
mov edx, dword [ebp - 0x4c]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x10122e22
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x10122f68
push ecx
push edx
call fcn.1016f528
add esp, 8
cmp dword [ebp - 0x20], 0xf
lea edi, [ebp - 0x34]
mov ebx, 0x811c9dc5
cmova edi, dword [ebp - 0x34]
xor edx, edx
mov ecx, edi
lea esi, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x10122e43
sub ecx, esi
je 0x10122e6f
nop
movsx eax, byte [edx + edi]
xor eax, ebx
imul ebx, eax, 0x1000193
mov eax, edi
inc edx
lea esi, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x10122e62
sub eax, esi
cmp edx, eax
jb 0x10122e50
mov al, byte [0x102732c8]
test al, al
jne 0x10122e7f
mov eax, 0x811c9dc5
jmp 0x10122e97
movsx eax, al
mov ecx, 0x102732c9
xor eax, 0x811c9dc5
imul edx, eax, 0x1000193
call fcn.100de180
cmp ebx, eax
mov ebx, dword [ebp - 0x10]
je 0x10122eed
mov edi, dword [ebp - 0x24]
lea esi, [ebp - 0x34]
add ebx, 0x30
mov edx, 0x811c9dc5
cmp dword [ebp - 0x20], 0xf
cmova esi, dword [ebp - 0x34]
xor ecx, ecx
test edi, edi
je 0x10122ed1
nop word [eax + eax]
movzx eax, byte [ecx + esi]
inc ecx
xor eax, edx
imul edx, eax, 0x1000193
cmp ecx, edi
jb 0x10122ec0
push edx
lea eax, [ebp - 0x34]
mov ecx, ebx
push eax
lea eax, [ebp - 0x1c]
push eax
call fcn.10094890
cmp dword [eax + 4], 0
je 0x10122dd8
jmp 0x10122ef0
add ebx, 0x30
lea eax, [ebp - 0x34]
mov ecx, ebx
push eax
call fcn.100e40b0
mov ecx, dword [ebp - 0x20]
mov esi, dword [eax]
mov edi, dword [eax + 4]
cmp ecx, 0xf
jbe 0x10122f30
mov edx, dword [ebp - 0x34]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x10122f26
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x10122f68
push ecx
push edx
call fcn.1016f528
add esp, 8
mov ecx, dword [ebp + 0x1c]
mov dword [ebp - 0x24], 0
mov dword [ebp - 0x20], 0xf
mov byte [ebp - 0x34], 0
cmp ecx, 0xf
jbe 0x10122f78
mov edx, dword [ebp + 8]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x10122f6e
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x10122f6e
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push ecx
push edx
call fcn.1016f528
add esp, 8
mov ecx, dword [ebp - 0xc]
mov edx, edi
pop edi
mov eax, esi
mov dword fs:[0], ecx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret