joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100f4640
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x24
mov esi, ecx
mov edi, dword [ebp + 0xc]
mov eax, dword [ebp + 8]
mov dword [ebp - 0x1c], esp
mov dword [ebp - 0x10], 0xffffffff
lea ecx, [ebp - 0x18]
mov dword [ebp - 0x14], 0x10103df0
mov edx, dword fs:[0]
mov dword [ebp - 0x18], edx
mov dword fs:[0], ecx
mov dword [esi + 8], 0
mov dword [esi + 4], 0
mov dword [esi], 0x104cb1c0
movups xmm0, xmmword [eax]
movups xmmword [esi + 0xc], xmm0
xorps xmm0, xmm0
movups xmmword [esi + 0x1c], xmm0
mov dword [esi + 0x30], 0
mov dword [esi + 0x2c], 0
mov ecx, dword [edi + 0x10]
cmp dword [edi + 0x14], 0x10
jb 0x100f46b1
mov edi, dword [edi]
lea eax, [esi + 4]
test ecx, ecx
js 0x100f4770
cmp ecx, 0xf
ja 0x100f46d9
lea eax, [esi + 0x1c]
mov dword [esi + 0x2c], ecx
mov dword [esi + 0x30], 0xf
movups xmm0, xmmword [edi]
movups xmmword [eax], xmm0
jmp 0x100f475b
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x2c], edi
mov dword [ebp - 0x20], esi
mov dword [esi + 0x30], 0xf
mov dword [ebp - 0x28], ecx
mov eax, ecx
or eax, 0xf
cmp eax, 0x17
mov ecx, 0x16
cmovae ecx, eax
cmp ecx, 0xfff
mov dword [ebp - 0x30], ecx
jb 0x100f4727
lea eax, [ecx + 0x24]
mov dword [ebp - 0x10], 0
push eax
call fcn.101ac7e6
add esp, 4
mov ecx, eax
add eax, 0x23
and eax, 0xffffffe0
mov dword [eax - 4], ecx
jmp 0x100f473a
lea eax, [ecx + 1]
mov dword [ebp - 0x10], 0
push eax
call fcn.101ac7e6
add esp, 4
mov ecx, dword [ebp - 0x2c]
mov edx, dword [ebp - 0x28]
mov esi, dword [ebp - 0x20]
mov dword [esi + 0x1c], eax
mov dword [esi + 0x2c], edx
mov edi, dword [ebp - 0x30]
mov dword [esi + 0x30], edi
inc edx
push edx
push ecx
push eax
call fcn.10368490
add esp, 0xc
mov eax, dword [ebp - 0x18]
mov dword fs:[0], eax
mov eax, esi
add esp, 0x24
pop esi
pop edi
pop ebx
pop ebp
ret 8
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x20], esi
mov dword [ebp - 0x10], 0
call fcn.10002f00
nop word cs:[eax + eax]
push ebp
sub esp, 0xc
add ebp, 0xc
mov eax, dword [ebp - 0x20]
mov dword [eax], 0x10397148
push dword [ebp - 0x24]
call fcn.10366979
add esp, 0x10
pop ebp
ret
Function at 0x100fef90
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x88
mov esi, ecx
mov dword [ebp - 0x1c], esp
mov dword [ebp - 0x10], 0xffffffff
lea eax, [ebp - 0x18]
mov dword [ebp - 0x14], 0x10103f30
mov ecx, dword fs:[0]
mov dword [ebp - 0x18], ecx
mov dword fs:[0], eax
mov eax, dword [esi + 0x78]
inc eax
mov dword [esi + 0x78], eax
cmp eax, dword [0x105dc394]
ja 0x100ff4ee
mov ebx, dword [ebp + 8]
lea edi, [esi + 0x18]
movups xmm0, xmmword [esi + 0x1c]
movups xmmword [ebp - 0x64], xmm0
mov eax, dword [esi + 0x18]
cmp eax, 0x108
jle 0x100ff027
add eax, 0xfffffef7
cmp eax, 0x28
ja 0x100ff224
jmp dword [eax*4 + 0x104cb5c0]
cmp eax, 0x28
je 0x100ff085
cmp eax, 0x3c
je 0x100ff085
cmp eax, 0x7b
jne 0x100ff224
mov ecx, esi
call fcn.100fe200
jmp 0x100ff182
movzx eax, byte [ebp + 0xc]
mov ecx, esi
push eax
push ebx
call fcn.100fe9d0
jmp 0x100ff455
mov dword [ebx], eax
jmp 0x100ff44e
lea ebx, [esi + 0x3c]
lea eax, [ebp - 0x64]
lea ecx, [ebp - 0x54]
push eax
push ebx
call fcn.100f4590
lea eax, [ebp - 0x5c]
lea ecx, [ebp - 0x7c]
push eax
push ebx
call fcn.100f4590
lea ebx, [ebp - 0x3c]
mov ecx, edi
push ebx
call fcn.100f1410
cmp dword [ebp - 0x28], 0x10
jb 0x100ff255
mov ebx, dword [ebp - 0x3c]
mov dword [ebp - 0x10], 0
push ebx
push 0x10533654
lea eax, [ebp - 0x54]
push eax
lea eax, [ebp - 0x7c]
push eax
push esi
call fcn.10100290
add esp, 0x14
mov ebx, dword [ebp + 8]
mov dword [ebx], eax
mov dword [ebx + 4], 0
mov eax, dword [ebp - 0x28]
cmp eax, 0x10
jb 0x100ff455
mov ecx, dword [ebp - 0x3c]
lea esi, [eax + 1]
cmp esi, 0x1000
jb 0x100ff2b1
mov edx, dword [ecx - 4]
add ecx, 0xfffffffc
sub ecx, edx
cmp ecx, 0x20
jae 0x100ff501
add eax, 0x24
mov esi, eax
mov ecx, edx
push esi
push ecx
call fcn.101ac81b
add esp, 8
jmp 0x100ff455
mov dword [ebx + 4], 0
mov eax, dword [ebp - 0x18]
mov dword fs:[0], eax
mov eax, ebx
add esp, 0x88
pop esi
pop edi
pop ebx
pop ebp
ret 8
add esi, 0x1c
push 0x10533c30
push 0x10534a6a
push esi
call fcn.100f47d0
call fcn.10378384
nop word cs:[eax + eax]
push ebp
sub esp, 0x30
add ebp, 0xc
lea ecx, [ebp - 0x3c]
call fcn.10002320
add esp, 0x30
pop ebp
ret
Function at 0x101026b0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x20
mov esi, dword [ebp + 8]
mov edi, dword [ebp + 0xc]
mov dword [ebp - 0x1c], esp
mov dword [ebp - 0x10], 0xffffffff
lea eax, [ebp - 0x18]
mov dword [ebp - 0x14], 0x10103ff0
mov ecx, dword fs:[0]
mov dword [ebp - 0x18], ecx
mov dword fs:[0], eax
mov dword [esi], 0x10397148
lea ebx, [esi + 4]
mov dword [esi + 8], 0
mov dword [esi + 4], 0
lea eax, [edi + 4]
push ebx
push eax
call fcn.10366916
add esp, 8
mov dword [esi], 0x104cb1c0
movups xmm0, xmmword [edi + 0xc]
movups xmmword [esi + 0xc], xmm0
xorps xmm0, xmm0
movups xmmword [esi + 0x1c], xmm0
mov dword [esi + 0x30], 0
mov dword [esi + 0x2c], 0
mov ecx, dword [edi + 0x2c]
cmp dword [edi + 0x30], 0x10
jb 0x10102738
mov edi, dword [edi + 0x1c]
jmp 0x1010273b
add edi, 0x1c
test ecx, ecx
js 0x101027ef
cmp ecx, 0xf
ja 0x1010275d
lea eax, [esi + 0x1c]
mov dword [esi + 0x2c], ecx
mov dword [esi + 0x30], 0xf
movups xmm0, xmmword [edi]
movups xmmword [eax], xmm0
jmp 0x101027dc
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x28], edi
mov dword [esi + 0x30], 0xf
mov dword [ebp - 0x24], ecx
mov eax, ecx
or eax, 0xf
cmp eax, 0x17
mov ecx, 0x16
cmovae ecx, eax
cmp ecx, 0xfff
mov dword [ebp - 0x2c], ecx
jb 0x101027a8
lea eax, [ecx + 0x24]
mov dword [ebp - 0x10], 0
push eax
call fcn.101ac7e6
add esp, 4
mov ecx, eax
add eax, 0x23
and eax, 0xffffffe0
mov dword [eax - 4], ecx
jmp 0x101027bb
lea eax, [ecx + 1]
mov dword [ebp - 0x10], 0
push eax
call fcn.101ac7e6
add esp, 4
mov ecx, dword [ebp - 0x28]
mov edx, dword [ebp - 0x24]
mov esi, dword [ebp + 8]
mov dword [esi + 0x1c], eax
mov dword [esi + 0x2c], edx
mov edi, dword [ebp - 0x2c]
mov dword [esi + 0x30], edi
inc edx
push edx
push ecx
push eax
call fcn.10368490
add esp, 0xc
mov eax, dword [ebp - 0x18]
mov dword fs:[0], eax
mov eax, esi
add esp, 0x20
pop esi
pop edi
pop ebx
pop ebp
ret
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x10], 0
call fcn.10002f00
nop
push ebp
sub esp, 0xc
add ebp, 0xc
mov eax, dword [ebp + 8]
mov dword [eax], 0x10397148
push dword [ebp - 0x20]
call fcn.10366979
add esp, 0x10
pop ebp
ret

Function at 0x10104260
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebx
push edi
push esi
mov edi, dword [esp + 0x14]
test edi, edi
je 0x10104282
mov ecx, dword [esp + 0x10]
mov edx, edi
and edx, 3
cmp edi, 4
jae 0x10104289
mov eax, 0x811c9dc5
xor esi, esi
jmp 0x101042da
mov eax, 0x811c9dc5
jmp 0x10104301
and edi, 0xfffffffc
mov eax, 0x811c9dc5
xor esi, esi
nop word cs:[eax + eax]
movzx ebx, byte [ecx + esi]
xor ebx, eax
imul eax, ebx, 0x1000193
movzx ebx, byte [ecx + esi + 1]
xor ebx, eax
imul eax, ebx, 0x1000193
movzx ebx, byte [ecx + esi + 2]
xor ebx, eax
imul eax, ebx, 0x1000193
movzx ebx, byte [ecx + esi + 3]
xor ebx, eax
imul eax, ebx, 0x1000193
add esi, 4
cmp edi, esi
jne 0x101042a0
test edx, edx
je 0x10104301
add ecx, esi
xor esi, esi
nop word cs:[eax + eax]
movzx edi, byte [ecx + esi]
xor edi, eax
imul eax, edi, 0x1000193
inc esi
cmp edx, esi
jne 0x101042f0
pop esi
pop edi
pop ebx
ret
Function at 0x10108640
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x20
mov edi, ecx
mov ebx, dword [esp + 0x34]
mov eax, dword [ecx + 4]
lea eax, [eax + eax*2]
shr eax, 2
cmp dword [ecx + 8], eax
jb 0x1010866e
mov ecx, edi
push ebx
call fcn.1010cf10
test eax, eax
jne 0x1010866e
mov ecx, edi
call fcn.1010d0a0
mov ebp, dword [edi + 4]
mov edx, dword [ebx + 0x80]
test edx, edx
mov dword [esp], edx
je 0x10108691
mov eax, edx
and eax, 3
cmp edx, 4
jae 0x10108698
mov esi, 0x811c9dc5
xor ecx, ecx
jmp 0x101086de
mov esi, 0x811c9dc5
jmp 0x101086fe
and edx, 0xfffffffc
mov esi, 0x811c9dc5
xor ecx, ecx
nop word cs:[eax + eax]
xor esi, dword [ebx + ecx*4]
imul esi, esi, 0x1000193
xor esi, dword [ebx + ecx*4 + 4]
imul esi, esi, 0x1000193
xor esi, dword [ebx + ecx*4 + 8]
imul esi, esi, 0x1000193
xor esi, dword [ebx + ecx*4 + 0xc]
imul esi, esi, 0x1000193
add ecx, 4
cmp edx, ecx
jne 0x101086b0
test eax, eax
je 0x101086fe
lea ecx, [ebx + ecx*4]
xor edx, edx
nop word [eax + eax]
xor esi, dword [ecx + edx*4]
imul esi, esi, 0x1000193
inc edx
cmp eax, edx
jne 0x101086f0
mov eax, ebp
dec eax
mov ecx, dword [edi]
mov dword [esp + 0x1c], ecx
mov ecx, dword [edi + 0x8c]
mov dword [esp + 4], edi
lea edx, [edi + 0xc]
mov dword [esp + 0x10], edx
mov dword [esp + 0x18], ecx
lea ecx, [ecx*4]
mov dword [esp + 0xc], ecx
mov ecx, dword [esp]
lea edx, [ecx*4]
mov dword [esp + 8], edx
xor ebp, ebp
mov dword [esp + 0x14], eax
jmp 0x1010874c
add esi, ebp
inc esi
inc ebp
mov eax, dword [esp + 0x14]
cmp ebp, eax
ja 0x101087a2
and esi, eax
mov eax, esi
shl eax, 7
lea eax, [eax + esi*8]
mov edx, dword [esp + 0x1c]
lea edi, [edx + eax]
mov ebx, dword [edx + eax + 0x80]
cmp ebx, dword [esp + 0x18]
jne 0x10108783
push dword [esp + 0xc]
push dword [esp + 0x14]
push edi
call fcn.10366e0d
mov ecx, dword [esp + 0xc]
add esp, 0xc
test eax, eax
je 0x101087a6
cmp ebx, ecx
jne 0x10108740
push dword [esp + 8]
push dword [esp + 0x38]
push edi
call fcn.10366e0d
mov ecx, dword [esp + 0xc]
add esp, 0xc
test eax, eax
jne 0x10108740
jmp 0x101087bf
xor edi, edi
jmp 0x101087bf
push 0x84
push dword [esp + 0x38]
push edi
call fcn.10368490
add esp, 0xc
mov eax, dword [esp + 4]
inc dword [eax + 8]
add edi, 0x84
mov eax, edi
add esp, 0x20
pop esi
pop edi
pop ebx
pop ebp
ret 4
Function at 0x10108840
Capabilities:
Hash data using fnv

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 8
mov esi, ecx
mov eax, dword [esp + 0x1c]
mov ecx, dword [0x10588520]
xor ecx, esp
mov dword [esp + 4], ecx
cmp dword [esi + 0x124], 0
je 0x101088d6
mov ecx, dword [esi + 0x128]
mov dword [esp], ecx
cmp ecx, eax
je 0x101088d6
mov ecx, eax
shr ecx, 0x18
mov ebp, ecx
mov ebx, eax
shr ebx, 0x10
movzx ecx, al
xor ecx, 0x811c9dc5
imul ecx, ecx, 0x1000193
movzx edi, ah
xor edi, ecx
mov edx, dword [esi + 0x11c]
imul ecx, edi, 0x1000193
movzx ebx, bl
xor ebx, ecx
mov edi, dword [esi + 0x120]
dec edi
imul ecx, ebx, 0x1000193
xor ecx, ebp
imul ebx, ecx, 0x1000193
xor ebp, ebp
nop word [eax + eax]
and ebx, edi
mov ecx, dword [edx + ebx*8]
cmp ecx, eax
je 0x10108921
cmp ecx, dword [esp]
je 0x101088d6
add ebx, ebp
inc ebx
inc ebp
cmp ebp, edi
jbe 0x101088c0
mov eax, dword [esi + 0x3c]
sub eax, dword [esi + 0x38]
mov di, 0xffff
cmp eax, 0x1fffc
ja 0x10108926
lea ecx, [esi + 0x11c]
shr eax, 2
mov edi, eax
lea ebx, [esp + 0x1c]
push ebx
call fcn.10108940
mov word [eax], di
mov eax, dword [esi + 0x3c]
cmp eax, dword [esi + 0x40]
je 0x10108913
mov ecx, dword [esp + 0x1c]
mov dword [eax], ecx
add dword [esi + 0x3c], 4
jmp 0x10108926
add esi, 0x38
mov ecx, esi
push ebx
push eax
call fcn.10078760
jmp 0x10108926
movzx edi, word [edx + ebx*8 + 4]
mov ecx, dword [esp + 4]
xor ecx, esp
call fcn.101ac85a
mov eax, edi
add esp, 8
pop esi
pop edi
pop ebx
pop ebp
ret 4
Function at 0x10108940
Capabilities:
Hash data using fnv

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 8
mov esi, ecx
mov edi, dword [esp + 0x1c]
mov eax, dword [ecx + 4]
mov ecx, dword [ecx + 8]
lea edx, [eax + eax*2]
shr edx, 2
cmp ecx, edx
mov dword [esp], esi
jb 0x101089ec
test ecx, ecx
je 0x101089db
mov ecx, dword [esp + 0x1c]
mov ecx, dword [ecx]
mov edx, dword [esp]
mov edx, dword [edx + 0xc]
mov dword [esp + 4], edx
cmp ecx, edx
je 0x101089db
mov edx, ecx
shr edx, 0x18
mov ebp, edx
mov edx, ecx
shr edx, 0x10
movzx esi, cl
xor esi, 0x811c9dc5
imul esi, esi, 0x1000193
movzx edi, ch
xor edi, esi
lea ebx, [eax - 1]
imul esi, edi, 0x1000193
movzx edx, dl
xor edx, esi
imul edx, edx, 0x1000193
xor edx, ebp
imul ebp, edx, 0x1000193
mov edx, dword [esp]
mov edi, dword [edx]
xor edx, edx
nop
and ebp, ebx
mov esi, dword [edi + ebp*8]
cmp esi, ecx
je 0x10108a67
cmp esi, dword [esp + 4]
je 0x101089db
add ebp, edx
inc ebp
inc edx
cmp edx, ebx
jbe 0x101089c0
mov esi, dword [esp]
mov ecx, esi
call fcn.1010d3d0
mov eax, dword [esi + 4]
mov edi, dword [esp + 0x1c]
dec eax
movzx ecx, byte [edi]
xor ecx, 0x811c9dc5
imul ecx, ecx, 0x1000193
movzx edx, byte [edi + 1]
xor edx, ecx
imul ecx, edx, 0x1000193
movzx edx, byte [edi + 2]
xor edx, ecx
imul ecx, edx, 0x1000193
movzx edx, byte [edi + 3]
xor edx, ecx
imul ecx, edx, 0x1000193
mov edx, dword [esi]
mov ebx, dword [esi + 0xc]
mov edi, dword [edi]
xor ebp, ebp
nop dword [eax]
and ecx, eax
mov esi, dword [edx + ecx*8]
cmp esi, ebx
je 0x10108a49
cmp esi, edi
je 0x10108a57
add ecx, ebp
inc ecx
inc ebp
cmp ebp, eax
jbe 0x10108a30
xor eax, eax
jmp 0x10108a5a
lea eax, [edx + ecx*8]
mov dword [edx + ecx*8], edi
mov ecx, dword [esp]
inc dword [ecx + 8]
jmp 0x10108a5a
lea eax, [edx + ecx*8]
add eax, 4
add esp, 8
pop esi
pop edi
pop ebx
pop ebp
ret 4
mov esi, dword [esp]
jmp 0x101089e8

Function at 0x1010a060
Capabilities:
Encode data using xor

Disassembly:
push ebx
push edi
push esi
mov ebx, dword [esp + 0x14]
test ebx, ebx
je 0x1010a0d1
mov ecx, dword [esp + 0x10]
mov edx, ebx
mov eax, ebx
test bl, 1
je 0x1010a090
mov eax, ebx
shl eax, 5
mov esi, ebx
shr esi, 2
add esi, eax
lea edx, [ebx - 1]
movzx eax, byte [ecx + ebx - 1]
add eax, esi
xor eax, ebx
cmp ebx, 1
je 0x1010a0d3
nop word cs:[eax + eax]
mov esi, eax
shl esi, 5
mov edi, eax
shr edi, 2
add edi, esi
movzx esi, byte [ecx + edx - 1]
add esi, edi
xor esi, eax
mov eax, esi
shl eax, 5
mov edi, esi
shr edi, 2
add edi, eax
movzx eax, byte [ecx + edx - 2]
add eax, edi
xor eax, esi
add edx, 0xfffffffe
jne 0x1010a0a0
jmp 0x1010a0d3
xor eax, eax
pop esi
pop edi
pop ebx
ret
Function at 0x1010cf10
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x1c
xor ebx, ebx
cmp dword [ecx + 8], 0
je 0x1010d086
mov ebp, ecx
mov edi, dword [esp + 0x30]
lea esi, [ecx + 0xc]
mov edx, dword [edi + 0x80]
mov ecx, dword [ecx + 0x8c]
mov eax, ecx
mov dword [esp + 8], ecx
cmp edx, ecx
mov dword [esp], edx
jne 0x1010cf63
lea eax, [edx*4]
push eax
push esi
push edi
call fcn.10366e0d
mov edx, dword [esp + 0xc]
add esp, 0xc
test eax, eax
je 0x1010d086
mov eax, dword [ebp + 4]
mov dword [esp + 4], eax
test edx, edx
mov dword [esp + 0x10], esi
je 0x1010cf87
mov eax, edx
and eax, 3
mov ebx, ebp
cmp edx, 4
jae 0x1010cf90
mov ebp, 0x811c9dc5
xor ecx, ecx
jmp 0x1010cfce
mov ebx, ebp
mov ebp, 0x811c9dc5
jmp 0x1010cfee
and edx, 0xfffffffc
mov ebp, 0x811c9dc5
xor ecx, ecx
nop word [eax + eax]
xor ebp, dword [edi + ecx*4]
imul esi, ebp, 0x1000193
xor esi, dword [edi + ecx*4 + 4]
imul esi, esi, 0x1000193
xor esi, dword [edi + ecx*4 + 8]
imul esi, esi, 0x1000193
xor esi, dword [edi + ecx*4 + 0xc]
imul ebp, esi, 0x1000193
add ecx, 4
cmp edx, ecx
jne 0x1010cfa0
test eax, eax
je 0x1010cfee
lea ecx, [edi + ecx*4]
xor edx, edx
nop word [eax + eax]
xor ebp, dword [ecx + edx*4]
imul ebp, ebp, 0x1000193
inc edx
cmp eax, edx
jne 0x1010cfe0
mov edx, dword [esp + 4]
dec edx
mov eax, dword [ebx]
mov dword [esp + 0x18], eax
mov ecx, dword [esp]
lea eax, [ecx*4]
mov dword [esp + 0x14], eax
mov eax, dword [esp + 8]
lea eax, [eax*4]
mov dword [esp + 0xc], eax
xor esi, esi
mov dword [esp + 4], edx
jmp 0x1010d02c
add ebp, esi
inc ebp
inc esi
mov edx, dword [esp + 4]
cmp esi, edx
ja 0x1010d084
and ebp, edx
mov eax, ebp
shl eax, 7
lea eax, [eax + ebp*8]
mov edi, dword [esp + 0x18]
lea edx, [edi + eax]
mov edi, dword [edi + eax + 0x80]
cmp edi, ecx
jne 0x1010d065
push dword [esp + 0x14]
push dword [esp + 0x34]
push edx
mov ebx, edx
call fcn.10366e0d
mov edx, ebx
mov ecx, dword [esp + 0xc]
add esp, 0xc
test eax, eax
je 0x1010d086
cmp edi, dword [esp + 8]
jne 0x1010d020
push dword [esp + 0xc]
push dword [esp + 0x14]
push edx
call fcn.10366e0d
mov ecx, dword [esp + 0xc]
add esp, 0xc
test eax, eax
jne 0x1010d020
xor ebx, ebx
mov eax, ebx
add esp, 0x1c
pop esi
pop edi
pop ebx
pop ebp
ret 4
Function at 0x1010d3d0
Capabilities:
Hash data using fnv

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x18
mov edi, ecx
mov ebx, dword [ecx + 4]
mov esi, dword [ecx + 0xc]
lea eax, [ebx + ebx]
test ebx, ebx
mov ebp, 0x10
cmovne ebp, eax
test ebp, ebp
je 0x1010d477
mov dword [esp], esi
lea eax, [ebp*8]
push eax
mov ebx, ebp
call fcn.101ac7e6
add esp, 4
mov ecx, dword [edi + 0xc]
mov edx, ebp
and edx, 2
xor esi, esi
cmp ebp, 4
jb 0x1010d452
mov ebx, ebp
and ebx, 0xfffffffc
xor esi, esi
nop
mov dword [eax + esi*8], ecx
mov word [eax + esi*8 + 4], 0
mov dword [eax + esi*8 + 8], ecx
mov word [eax + esi*8 + 0xc], 0
mov dword [eax + esi*8 + 0x10], ecx
mov word [eax + esi*8 + 0x14], 0
mov dword [eax + esi*8 + 0x18], ecx
mov word [eax + esi*8 + 0x1c], 0
add esi, 4
cmp ebx, esi
jne 0x1010d420
test edx, edx
je 0x1010d46f
lea ebx, [eax + esi*8]
add ebx, 4
xor esi, esi
nop
mov dword [ebx + esi*8 - 4], ecx
mov word [ebx + esi*8], 0
inc esi
cmp edx, esi
jne 0x1010d460
mov ebx, dword [edi + 4]
mov esi, dword [esp]
jmp 0x1010d47b
xor eax, eax
mov ecx, esi
mov edx, dword [edi]
test ebx, ebx
je 0x1010d55e
mov dword [esp + 0xc], edi
mov dword [esp + 8], ebp
lea edi, [ebp - 1]
mov dword [esp], edi
xor edi, edi
mov ebp, edx
mov dword [esp + 0x14], ecx
mov dword [esp + 0x10], ebx
mov dword [esp + 4], edx
jmp 0x1010d4d8
mov dword [eax + ebp*8], edx
mov ebx, dword [esp + 4]
mov edx, dword [ebx + edi*8]
mov dword [eax + ebp*8], edx
movzx ecx, word [ebx + edi*8 + 4]
mov word [eax + ebp*8 + 4], cx
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x10]
mov ebp, ebx
mov ebx, edx
inc edi
cmp edi, ebx
je 0x1010d54f
mov edx, dword [ebp + edi*8]
cmp edx, ecx
je 0x1010d4d3
movzx ecx, dl
xor ecx, 0x811c9dc5
imul ecx, ecx, 0x1000193
movzx ebx, dh
xor ebx, ecx
mov ecx, edx
shr ecx, 0x10
imul ebx, ebx, 0x1000193
movzx ecx, cl
xor ecx, ebx
mov ebx, edx
shr ebx, 0x18
imul ecx, ecx, 0x1000193
xor ecx, ebx
imul ebp, ecx, 0x1000193
and ebp, dword [esp]
mov ebx, dword [eax + ebp*8]
cmp ebx, esi
je 0x1010d4b0
mov ecx, 1
nop word cs:[eax + eax]
cmp ebx, edx
je 0x1010d546
add ebp, ecx
and ebp, dword [esp]
mov ebx, dword [eax + ebp*8]
inc ecx
cmp ebx, esi
jne 0x1010d530
jmp 0x1010d4b0
mov ebx, dword [esp + 4]
jmp 0x1010d4ba
mov ecx, dword [esp + 0xc]
mov dword [ecx], eax
mov eax, dword [esp + 8]
mov dword [ecx + 4], eax
jmp 0x1010d569
mov dword [edi], eax
mov dword [edi + 4], ebp
test edx, edx
mov ebp, edx
je 0x1010d577
push ebp
call fcn.101ac816
add esp, 0x1c
pop esi
pop edi
pop ebx
pop ebp
ret
add esp, 0x18
jmp 0x1010d572
Function at 0x1010d670
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x24
mov esi, ecx
mov edi, dword [ebp + 0xc]
mov eax, dword [ebp + 8]
mov dword [ebp - 0x1c], esp
mov dword [ebp - 0x10], 0xffffffff
lea ecx, [ebp - 0x18]
mov dword [ebp - 0x14], 0x1011d960
mov edx, dword fs:[0]
mov dword [ebp - 0x18], edx
mov dword fs:[0], ecx
mov dword [esi + 8], 0
mov dword [esi + 4], 0
mov dword [esi], 0x104cbde4
movups xmm0, xmmword [eax]
movups xmmword [esi + 0xc], xmm0
xorps xmm0, xmm0
movups xmmword [esi + 0x1c], xmm0
mov dword [esi + 0x30], 0
mov dword [esi + 0x2c], 0
mov ecx, dword [edi + 0x10]
cmp dword [edi + 0x14], 0x10
jb 0x1010d6e1
mov edi, dword [edi]
lea eax, [esi + 4]
test ecx, ecx
js 0x1010d7a0
cmp ecx, 0xf
ja 0x1010d709
lea eax, [esi + 0x1c]
mov dword [esi + 0x2c], ecx
mov dword [esi + 0x30], 0xf
movups xmm0, xmmword [edi]
movups xmmword [eax], xmm0
jmp 0x1010d78b
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x2c], edi
mov dword [ebp - 0x20], esi
mov dword [esi + 0x30], 0xf
mov dword [ebp - 0x28], ecx
mov eax, ecx
or eax, 0xf
cmp eax, 0x17
mov ecx, 0x16
cmovae ecx, eax
cmp ecx, 0xfff
mov dword [ebp - 0x30], ecx
jb 0x1010d757
lea eax, [ecx + 0x24]
mov dword [ebp - 0x10], 0
push eax
call fcn.101ac7e6
add esp, 4
mov ecx, eax
add eax, 0x23
and eax, 0xffffffe0
mov dword [eax - 4], ecx
jmp 0x1010d76a
lea eax, [ecx + 1]
mov dword [ebp - 0x10], 0
push eax
call fcn.101ac7e6
add esp, 4
mov ecx, dword [ebp - 0x2c]
mov edx, dword [ebp - 0x28]
mov esi, dword [ebp - 0x20]
mov dword [esi + 0x1c], eax
mov dword [esi + 0x2c], edx
mov edi, dword [ebp - 0x30]
mov dword [esi + 0x30], edi
inc edx
push edx
push ecx
push eax
call fcn.10368490
add esp, 0xc
mov eax, dword [ebp - 0x18]
mov dword fs:[0], eax
mov eax, esi
add esp, 0x24
pop esi
pop edi
pop ebx
pop ebp
ret 8
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x20], esi
mov dword [ebp - 0x10], 0
call fcn.10002f00
nop word cs:[eax + eax]
push ebp
sub esp, 0xc
add ebp, 0xc
mov eax, dword [ebp - 0x20]
mov dword [eax], 0x10397148
push dword [ebp - 0x24]
call fcn.10366979
add esp, 0x10
pop ebp
ret
Function at 0x101101d0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x20
mov eax, dword [esp + 0x34]
mov edx, dword [ecx + 0xe8]
mov esi, dword [ecx + 0xec]
mov dword [esp + 0x14], edx
sub esi, edx
sar esi, 2
mov dword [esp + 0x1c], esi
cmp esi, eax
jbe 0x101102ed
mov edx, dword [ecx + 0x3c]
mov dword [esp + 0x18], edx
mov edx, dword [ecx + 0x40]
mov dword [esp + 0xc], edx
mov edx, dword [ecx + 0x34]
mov dword [esp + 8], edx
mov dword [esp + 0x10], ecx
mov edx, dword [ecx + 0x38]
dec edx
mov byte [esp + 3], 0xff
mov dword [esp + 4], 0
jmp 0x1011023b
inc eax
cmp eax, dword [esp + 0x1c]
je 0x101102cf
mov ecx, 0
cmp dword [esp + 0x18], 0
je 0x101102a0
mov ecx, dword [esp + 0x14]
mov esi, dword [ecx + eax*4]
mov ecx, 0
cmp esi, dword [esp + 0xc]
je 0x101102a0
mov ecx, esi
shr ecx, 4
mov edi, esi
shr edi, 9
xor edi, ecx
xor ebp, ebp
nop word [eax + eax]
and edi, edx
lea ecx, [edi + edi*2]
mov ebx, dword [esp + 8]
mov ebx, dword [ebx + ecx*4]
cmp ebx, esi
je 0x10110292
xor ecx, ecx
cmp ebx, dword [esp + 0xc]
je 0x101102a0
add edi, ebp
inc edi
inc ebp
cmp ebp, edx
jbe 0x10110270
jmp 0x101102a0
mov esi, dword [esp + 8]
lea ecx, [esi + ecx*4]
nop dword [eax]
lea esi, [ecx + 4]
test ecx, ecx
cmove esi, ecx
cmp byte [esi + 2], 0
je 0x10110230
movzx ecx, byte [esi]
movzx ebx, byte [esp + 3]
cmp cl, bl
movzx ebx, bl
cmovb ebx, ecx
mov cl, 1
mov dword [esp + 4], ecx
mov ecx, ebx
mov byte [esp + 3], bl
jmp 0x10110230
test byte [esp + 4], 1
mov eax, dword [esp + 0x10]
je 0x101102ed
mov ecx, dword [eax]
movzx edx, byte [esp + 3]
push 0
push 0
push edx
push 0xb
call fcn.10108a70
add esp, 0x20
pop esi
pop edi
pop ebx
pop ebp
ret 4