joyce8/EMBER2024-capa huggingface dataset:
Function at 0x401d70
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
lea esp, [esp - 0x14]
mov dword [ebp - 4], eax
mov dword [ebp - 8], edx
mov eax, dword [ebp - 4]
call fcn.004073c0
xor eax, eax
push fcn.00401d60
push ebp
push 0x40d9d0
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [0x4120f0]
mov dword [ebp - 0x14], eax
mov eax, dword [0x4120ec]
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0xc]
push eax
push 0
mov eax, dword [ebp - 4]
test eax, eax
jne 0x401dc2
mov eax, 0x481a90
push eax
push dword [0x4384e0]
call sub.advapi32.dll_RegQueryValueExA
test eax, 0xffffffff
je 0x401dd7
jmp 0x401dfb
movzx eax, byte [ebp - 0xd]
shl eax, 0x18
movzx edx, byte [ebp - 0xe]
shl edx, 0x10
or eax, edx
movzx edx, byte [ebp - 0xf]
shl edx, 8
or eax, edx
movzx edx, byte [ebp - 0x10]
or eax, edx
mov edx, dword [ebp - 8]
mov dword [edx], eax
xor eax, eax
pop edx
add esp, 0xc
mov dword fs:[eax], edx
mov eax, ebp
call fcn.00401d60
leave
ret

Function at 0x401e30
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
lea esp, [esp - 0xc]
mov dword [ebp - 4], eax
mov dword [ebp - 8], edx
mov eax, dword [ebp - 4]
call fcn.004073c0
mov eax, dword [ebp - 8]
call fcn.004084d0
mov dword [ebp - 0xc], 0
xor eax, eax
push fcn.00401e10
push ebp
push 0x40d9d0
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 8]
test eax, eax
je 0x401e71
mov eax, dword [eax - 4]
shl eax, 1
push eax
mov eax, dword [ebp - 8]
test eax, eax
jne 0x401e80
mov eax, 0x481a90
push eax
push 1
push 0
mov eax, dword [ebp - 4]
lea edx, [ebp - 0xc]
call fcn.00408500
mov eax, dword [ebp - 0xc]
test eax, eax
jne 0x401e9c
mov eax, 0x481a90
push eax
push dword [0x4384e0]
call sub.advapi32.dll_RegSetValueExW
xor eax, eax
pop edx
add esp, 0xc
mov dword fs:[eax], edx
mov eax, ebp
call fcn.00401e10
leave
ret

Function at 0x401ed0
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
lea esp, [esp - 8]
mov dword [ebp - 4], eax
mov dword [ebp - 8], edx
mov eax, dword [ebp - 4]
call fcn.004073c0
xor eax, eax
push fcn.00401ec0
push ebp
push 0x40d9d0
push dword fs:[eax]
mov dword fs:[eax], esp
push 4
lea eax, [ebp - 8]
push eax
push 4
push 0
mov eax, dword [ebp - 4]
test eax, eax
jne 0x401f0e
mov eax, 0x481a90
push eax
push dword [0x4384e0]
call sub.advapi32.dll_RegSetValueExA
xor eax, eax
pop edx
add esp, 0xc
mov dword fs:[eax], edx
mov eax, ebp
call fcn.00401ec0
leave
ret

Function at 0x401f40
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
lea esp, [esp - 4]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.004073c0
xor eax, eax
push fcn.00401f30
push ebp
push 0x40d9d0
push dword fs:[eax]
mov dword fs:[eax], esp
push 8
lea eax, [ebp + 8]
push eax
push 0xb
push 0
mov eax, dword [ebp - 4]
test eax, eax
jne 0x401f7b
mov eax, 0x481a90
push eax
push dword [0x4384e0]
call sub.advapi32.dll_RegSetValueExA
xor eax, eax
pop edx
add esp, 0xc
mov dword fs:[eax], edx
mov eax, ebp
call fcn.00401f30
leave
ret 8
Function at 0x4020f0
Capabilities:
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
lea esp, [esp - 8]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.004084d0
mov dword [ebp - 8], 0
xor eax, eax
push fcn.004020d0
push ebp
push 0x40d9d0
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [0x438760], 0
mov eax, 0x438770
mov edx, 0
call fcn.004085d0
mov eax, dword [0x438760]
lea eax, [eax + 1]
mov dword [0x438760], eax
mov eax, dword [0x438760]
cmp eax, dword [0x438750]
ja 0x402151
jmp 0x402153
jmp 0x402170
mov eax, dword [0x438760]
mov eax, dword [eax*4 + 0x438770]
mov edx, dword [ebp - 4]
call fcn.00408ac0
test eax, 0xffffffff
je 0x402170
jmp 0x402135
mov eax, dword [0x438760]
cmp eax, dword [0x438750]
ja 0x402182
jmp 0x40220e
mov dword [0x438750], 0
mov eax, dword [ebp - 4]
lea edx, [ebp - 8]
call fcn.00410b60
mov edx, dword [ebp - 8]
mov eax, 0x478780
call fcn.004085d0
push 0x438500
lea eax, [ebp - 8]
call fcn.00408480
mov edx, dword [0x478780]
mov ecx, 0x412114
lea eax, [ebp - 8]
call fcn.00408610
mov eax, dword [ebp - 8]
test eax, eax
jne 0x4021d0
mov eax, 0x481a90
push eax
call sub.kernel32.dll_FindFirstFileW
mov dword [0x4384f0], eax
cmp dword [0x4384f0], 0xffffffff
jne 0x4021e6
jmp 0x40220e
mov eax, dword [ebp - 4]
call fcn.00401fc0
jmp 0x4021f8
mov eax, dword [ebp - 4]
call fcn.00401fc0
push 0x438500
push dword [0x4384f0]
call sub.kernel32.dll_FindNextFileW
test eax, eax
jne 0x4021f0
jmp 0x40220e
xor eax, eax
pop edx
add esp, 0xc
mov dword fs:[eax], edx
mov eax, ebp
call fcn.004020d0
leave
ret
Function at 0x40aba0
Capabilities:
Check for software breakpoints

Disassembly:
push ebx
push esi
push edi
mov ax, word [0x4113f0]
cmp ax, 0xcb
je 0x40acac
cmp ax, 0xcc
je 0x40acac
lea esi, [esi]
mov edx, dword [0x481d90]
test edx, edx
je 0x40abd5
mov eax, dword [0x481c40]
call edx
mov ebx, eax
jmp 0x40abda
mov ebx, 0x481c44
cmp word [0x481c30], 0
jle 0x40ac00
mov eax, 0x481c10
call fcn.0040ae10
mov eax, ebx
call fcn.0040a760
mov eax, ebx
call fcn.0040a7d0
lea esi, [esi]
mov edi, dword [ebx]
jmp 0x40ac22
mov esi, dword [edi + 4]
mov eax, dword [edi]
and eax, 1
jne 0x40ac1d
mov edx, edi
mov eax, ebx
call fcn.00409bd0
jmp 0x40ac20
and dword [edi], 0xfffffffe
mov edi, esi
test edi, edi
jne 0x40ac08
mov dword [ebx], 0
mov dword [ebx + 0x88], 0
cmp word [0x481c30], 0
jle 0x40acac
mov edx, 0x481b50
mov eax, ebx
call fcn.00409d10
mov edi, eax
test edi, edi
je 0x40ac7c
mov eax, dword [0x481be4]
mov dword [edi + 0xc], eax
cmp dword [0x481be4], 0
je 0x40ac70
mov eax, dword [0x481be4]
mov dword [eax + 8], edi
mov eax, dword [ebx + 0x94]
mov dword [0x481be4], eax
nop
sub word [0x481c30], 1
cmp word [0x481c30], 0
sete bl
mov eax, 0x481c10
call fcn.0040ae20
test bl, bl
je 0x40acac
mov eax, 0x481c10
call fcn.0040ae00
lea esi, [esi]
pop edi
pop esi
pop ebx
ret
Function at 0x40cc20
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
lea esp, [esp - 0x114]
push ebx
push esi
push edi
mov dword [ebp - 0x10c], 0
mov dword [0x481a00], 0
mov dword [ebp - 4], 0
push 0x104
lea eax, [ebp - 0x108]
push eax
push 0
call sub.kernel32.dll_GetModuleFileNameA
mov byte [ebp + eax - 0x108], 0
mov dword [ebp - 0x110], eax
mov ecx, eax
xor edx, edx
mov eax, ebp
call fcn.0040ce00
mov eax, dword [ebp - 0x110]
lea ecx, [eax + 1]
mov eax, dword [0x481a00]
mov edx, dword [eax]
lea eax, [ebp - 0x108]
call fcn.00406600
call sub.kernel32.dll_GetCommandLineA
mov dword [0x411460], eax
mov ebx, eax
jmp 0x40cdc3
add ebx, 1
movzx eax, byte [ebx]
sub eax, 1
cmp eax, 0x20
jb 0x40cca8
cmp byte [ebx], 0
je 0x40cdcc
nop
mov byte [ebp - 0x114], 0
mov edi, ebx
mov dword [ebp - 0x110], 0
jmp 0x40cd23
mov al, byte [ebx]
cmp al, 1
jb 0x40cd18
sub al, 0x20
jbe 0x40cce8
sub al, 2
je 0x40ccfc
jmp 0x40cd18
mov al, byte [ebp - 0x114]
test al, al
je 0x40cd28
add dword [ebp - 0x110], 1
jmp 0x40cd20
cmp byte [ebx + 1], 0x22
je 0x40cd13
mov al, byte [ebp - 0x114]
test al, al
sete byte [ebp - 0x114]
jmp 0x40cd20
add ebx, 1
jmp 0x40cd20
add dword [ebp - 0x110], 1
nop
add ebx, 1
cmp byte [ebx], 0
jne 0x40ccd8
test dword [ebp - 0x10c], 0xffffffff
je 0x40cdbc
mov ecx, dword [ebp - 0x110]
mov edx, dword [ebp - 0x10c]
mov eax, ebp
call fcn.0040ce00
mov byte [ebp - 0x114], 0
mov ebx, edi
mov eax, dword [0x481a00]
mov edx, dword [ebp - 0x10c]
mov esi, dword [eax + edx*4]
jmp 0x40cdb3
mov al, byte [ebx]
cmp al, 1
jb 0x40cda8
sub al, 0x20
jbe 0x40cd78
sub al, 2
je 0x40cd8c
jmp 0x40cda8
mov al, byte [ebp - 0x114]
test al, al
je 0x40cdb8
mov al, byte [ebx]
mov byte [esi], al
add esi, 1
jmp 0x40cdb0
cmp byte [ebx + 1], 0x22
je 0x40cda3
mov al, byte [ebp - 0x114]
test al, al
sete byte [ebp - 0x114]
jmp 0x40cdb0
add ebx, 1
jmp 0x40cdb0
mov al, byte [ebx]
mov byte [esi], al
add esi, 1
nop
add ebx, 1
cmp byte [ebx], 0
jne 0x40cd68
mov byte [esi], 0
nop
add dword [ebp - 0x10c], 1
cmp byte [ebx], 0
jne 0x40ccab
mov ebx, dword [ebp - 0x10c]
mov dword [0x4819f0], ebx
lea edx, [ebx + 1]
shl edx, 2
mov eax, 0x481a00
call fcn.0040a9e0
mov eax, dword [0x481a00]
mov dword [eax + ebx*4], 0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x40e9c0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
lea esp, [esp - 0xc]
mov dword [ebp - 4], eax
mov eax, dword [0x482a00]
lea eax, [eax + 1]
mov dword [0x482a00], eax
mov eax, dword [0x482a00]
and eax, 0xff
mov dword [0x482a00], eax
mov eax, dword [0x482a00]
call fcn.0040ea20
lea eax, [ebp - 0xc]
push eax
push 0
push 0
push dword [ebp - 4]
push 0
push 0
call sub.kernel32.dll_CreateThread
mov edx, dword [0x482a00]
mov dword [edx*4 + 0x482600], eax
mov eax, dword [0x482a00]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
leave
ret

Function at 0x40ea20
Capabilities:
Terminate thread

Disassembly:
push ebp
mov ebp, esp
lea esp, [esp - 4]
mov dword [ebp - 4], eax
push 0
mov eax, dword [ebp - 4]
push dword [eax*4 + 0x482600]
call sub.kernel32.dll_TerminateThread
leave
ret
Function at 0x1003b450
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x100ee008]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, ecx
cmp dword [esi + 0x38], 0
je 0x1003b50c
cmp byte [esi + 0x3d], 0
je 0x1003b50c
mov eax, dword [esi]
push edi
push 0xffffffffffffffff
call dword [eax + 0xc]
cmp eax, 0xffffffff
je 0x1003b4fa
mov ecx, dword [esi + 0x38]
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [esi + 0x40]
push eax
call dword [sym.imp.MSVCP140.dll_public:_int___thiscall_std::codecvt_char__char__struct__Mbstatet_::unshift_struct__Mbstatet___char___char___char___const]
sub eax, 0
je 0x1003b4c1
sub eax, 1
je 0x1003b4c5
sub eax, 2
jne 0x1003b4fa
mov byte [esi + 0x3d], al
mov al, 1
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100c981f
mov esp, ebp
pop ebp
ret
mov byte [esi + 0x3d], 0
mov edi, dword [ebp - 0x28]
lea eax, [ebp - 0x24]
sub edi, eax
je 0x1003b4e3
push dword [esi + 0x4c]
push edi
push 1
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
add esp, 0x10
cmp edi, eax
jne 0x1003b4fa
cmp byte [esi + 0x3d], 0
pop edi
sete al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100c981f
mov esp, ebp
pop ebp
ret
pop edi
xor al, al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100c981f
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
mov al, 1
xor ecx, ebp
pop esi
call fcn.100c981f
mov esp, ebp
pop ebp
ret
Function at 0x1003d8b0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
cmp byte [0x102cbfc8], 0
push ebx
push esi
push edi
je 0x1003da4d
mov ecx, dword [0x104480ec]
mov eax, dword [ecx]
mov eax, dword [eax + 0x68]
call eax
test al, al
je 0x1003da4d
mov ecx, dword [0x10448174]
xor ebx, ebx
mov dword [ebp - 4], ecx
mov eax, dword [ecx + 0x28]
mov dword [ebp - 8], eax
test eax, eax
je 0x1003da4d
mov eax, dword [ecx + 0x1c]
mov ecx, dword [eax + ebx*4]
mov eax, dword [ecx]
mov eax, dword [eax + 0x30]
call eax
mov esi, eax
mov edi, 0x811c9dc5
xor ecx, ecx
nop word [eax + eax]
inc ecx
cmp byte [ecx + esi], 0
jne 0x1003d910
xor edx, edx
test ecx, ecx
je 0x1003d939
nop dword [eax]
movsx eax, byte [edx + esi]
inc edx
xor eax, edi
imul edi, eax, 0x1000193
cmp edx, ecx
jb 0x1003d920
cmp edi, 0x5ff56dc5
je 0x1003d948
inc ebx
cmp ebx, dword [ebp - 8]
jae 0x1003da4d
mov ecx, dword [ebp - 4]
jmp 0x1003d8f4
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x1c]
mov edi, dword [eax + ebx*4]
test edi, edi
je 0x1003da4d
mov edx, dword [edi + 0x88]
test edx, edx
je 0x1003da4d
vmovss xmm2, dword [0x100e2bc8]
vmovss xmm1, dword [0x100e2db4]
xor ebx, ebx
cmp edx, 4
jl 0x1003da16
mov ecx, dword [edi + 0x7c]
lea esi, [edx - 4]
shr esi, 2
add ecx, 0x1078
inc esi
lea ebx, [esi*4]
nop dword [eax]
vmovss xmm0, dword [ecx - 0xc60]
vucomiss xmm0, xmm2
lahf
test ah, 0x44
jp 0x1003d9ba
vmovss dword [ecx - 0xc60], xmm1
vmovss xmm0, dword [ecx - 0x840]
vucomiss xmm0, xmm2
lahf
test ah, 0x44
jp 0x1003d9d4
vmovss dword [ecx - 0x840], xmm1
vmovss xmm0, dword [ecx - 0x420]
vucomiss xmm0, xmm2
lahf
test ah, 0x44
jp 0x1003d9ee
vmovss dword [ecx - 0x420], xmm1
vmovss xmm0, dword [ecx]
vucomiss xmm0, xmm2
lahf
test ah, 0x44
jp 0x1003da00
vmovss dword [ecx], xmm1
add ecx, 0x1080
sub esi, 1
jne 0x1003d9a0
cmp ebx, edx
jl 0x1003da1a
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
test edx, edx
jle 0x1003da4d
imul ecx, ebx, 0x420
add ecx, 0x418
add ecx, dword [edi + 0x7c]
sub edx, ebx
nop dword [eax + eax]
vmovss xmm0, dword [ecx]
vucomiss xmm0, xmm2
lahf
test ah, 0x44
jp 0x1003da42
vmovss dword [ecx], xmm1
add ecx, 0x420
sub edx, 1
jne 0x1003da30
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1003f8d0
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100cbc85
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push ebx
push esi
push edi
mov eax, dword [0x100ee008]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
movzx eax, byte [esi]
xor eax, 0x811c9dc5
imul ecx, eax, 0x1000193
movzx eax, byte [esi + 1]
xor ecx, eax
movzx eax, byte [esi + 2]
imul ecx, ecx, 0x1000193
xor ecx, eax
movzx eax, byte [esi + 3]
imul ecx, ecx, 0x1000193
xor ecx, eax
lea eax, [ebp - 0x18]
imul edi, ecx, 0x1000193
push edi
push esi
push eax
call fcn.100410c0
mov eax, dword [ebp - 0x14]
test eax, eax
jne 0x1003fa5a
cmp dword [0x1044fcf8], 0xfffffff
jne 0x1003f95a
push str.unordered_map_set_too_long
call dword [sym.imp.MSVCP140.dll_void___cdecl_std::_Xlength_error_char_const__]
mov dword [ebp - 0x20], 0x1044fcf4
mov dword [ebp - 4], 0
push 0x10
mov dword [ebp - 0x1c], 0
call fcn.100c983b
mov ebx, eax
add esp, 4
mov eax, dword [esi]
mov dword [ebp - 0x1c], ebx
mov dword [ebx + 8], eax
mov dword [ebx + 0xc], 0
mov dword [ebp - 4], 1
mov eax, dword [0x1044fcf8]
mov esi, dword [0x1044fd0c]
inc eax
vmovss xmm1, dword [0x1044fcf0]
vxorps xmm0, xmm0, xmm0
vcvtsi2sd xmm0, xmm0, eax
shr eax, 0x1f
vaddsd xmm0, xmm0, qword [eax*8 + 0x100e2ee0]
vcvtsd2ss xmm2, xmm0, xmm0
vxorps xmm0, xmm0, xmm0
mov eax, esi
shr eax, 0x1f
vcvtsi2sd xmm0, xmm0, esi
vaddsd xmm0, xmm0, qword [eax*8 + 0x100e2ee0]
vcvtsd2ss xmm0, xmm0, xmm0
vdivss xmm0, xmm2, xmm0
vcomiss xmm0, xmm1
jbe 0x1003fa4f
vdivss xmm0, xmm2, xmm1
vcvtss2sd xmm0, xmm0, xmm0
vmovsd qword [ebp - 0x18], xmm0
fld qword [ebp - 0x18]
vxorpd xmm0, xmm0, xmm0
fstp qword [ebp - 0x18]
vroundsd xmm0, xmm0, qword [ebp - 0x18], 2
vmovsd qword [ebp - 0x18], xmm0
fld qword [ebp - 0x18]
fstp qword [ebp - 0x18]
vmovsd xmm0, qword [ebp - 0x18]
vcvtpd2ps xmm0, xmm0
call fcn.100caaa0
mov ecx, 8
cmp eax, ecx
cmova ecx, eax
cmp esi, ecx
jae 0x1003fa37
cmp esi, 0x200
jae 0x1003fa35
shl esi, 3
cmp esi, ecx
jae 0x1003fa37
mov esi, ecx
push esi
call fcn.10040e70
push edi
lea eax, [ebx + 8]
push eax
lea eax, [ebp - 0x20]
push eax
call fcn.100410c0
mov ecx, dword [eax]
jmp 0x1003fa52
mov ecx, dword [ebp - 0x18]
push ebx
push ecx
push edi
call fcn.10040e00
add eax, 0xc
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x1003ff00
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
sub esp, 0x18
mov edx, dword [ebp + 8]
push ebx
mov ebx, ecx
cmp edx, eax
je 0x10040056
mov eax, dword [ebx + 4]
mov dword [ebp - 0x14], eax
mov eax, dword [edx + 4]
mov dword [ebp - 8], eax
movzx eax, byte [edx + 8]
xor eax, 0x811c9dc5
imul ecx, eax, 0x1000193
movzx eax, byte [edx + 9]
push esi
push edi
mov edi, dword [ebx + 0xc]
mov esi, edx
xor ecx, eax
mov dword [ebp - 0x18], edi
movzx eax, byte [edx + 0xa]
imul ecx, ecx, 0x1000193
xor ecx, eax
movzx eax, byte [edx + 0xb]
imul ecx, ecx, 0x1000193
xor ecx, eax
mov eax, dword [ebx + 0x18]
imul ecx, ecx, 0x1000193
and eax, ecx
mov ecx, dword [edi + eax*8]
mov dword [ebp - 4], ecx
lea eax, [edi + eax*8]
mov dword [ebp - 0xc], eax
mov eax, dword [eax + 4]
mov dword [ebp - 0x10], eax
mov eax, esi
mov edi, esi
mov esi, dword [esi]
push 0x10
push eax
call fcn.100c9c9f
dec dword [ebx + 8]
add esp, 8
cmp edi, dword [ebp - 0x10]
je 0x1003ffb9
mov eax, dword [ebp + 0xc]
cmp esi, eax
jne 0x1003ff77
mov ecx, dword [ebp - 4]
cmp ecx, dword [ebp + 8]
jne 0x1004004c
mov edx, dword [ebp - 0xc]
mov ecx, dword [ebp - 8]
pop edi
mov dword [edx], esi
mov dword [ecx], esi
mov dword [esi + 4], ecx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
mov ecx, dword [ebp - 4]
mov edx, dword [ebp - 0xc]
cmp ecx, dword [ebp + 8]
jne 0x1003ffcd
mov eax, dword [ebp - 0x14]
mov ecx, eax
mov dword [edx], eax
jmp 0x1003ffd0
mov ecx, dword [ebp - 8]
mov eax, dword [ebp + 0xc]
mov dword [edx + 4], ecx
cmp esi, eax
je 0x1004004c
nop word [eax + eax]
movzx eax, byte [esi + 8]
xor eax, 0x811c9dc5
imul ecx, eax, 0x1000193
movzx eax, byte [esi + 9]
xor ecx, eax
movzx eax, byte [esi + 0xa]
imul ecx, ecx, 0x1000193
xor ecx, eax
movzx eax, byte [esi + 0xb]
imul ecx, ecx, 0x1000193
xor ecx, eax
imul eax, ecx, 0x1000193
mov ecx, dword [ebx + 0x18]
and ecx, eax
mov eax, dword [ebp - 0x18]
lea eax, [eax + ecx*8]
mov dword [ebp - 4], eax
mov eax, dword [eax + 4]
mov dword [ebp - 0x10], eax
mov eax, esi
mov edi, esi
mov esi, dword [esi]
push 0x10
push eax
call fcn.100c9c9f
dec dword [ebx + 8]
add esp, 8
mov eax, dword [ebp + 0xc]
cmp edi, dword [ebp - 0x10]
je 0x1004005d
cmp esi, eax
jne 0x10040027
mov ecx, dword [ebp - 4]
mov dword [ecx], esi
mov ecx, dword [ebp - 8]
pop edi
mov dword [ecx], esi
mov dword [esi + 4], ecx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
mov ecx, dword [ebp - 4]
mov edx, dword [ebp - 0x14]
mov dword [ecx], edx
mov dword [ecx + 4], edx
cmp esi, eax
jne 0x1003ffe0
mov ecx, dword [ebp - 8]
pop edi
mov dword [ecx], esi
mov dword [esi + 4], ecx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x10043500
Capabilities:
Encode data using base64

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100cbffe
mov eax, dword fs:[0]
push eax
sub esp, 0x18
push esi
push edi
mov eax, dword [0x100ee008]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x24], edi
mov dword [ebp - 0x1c], 0
vpxor xmm0, xmm0, xmm0
vmovdqu xmmword [edi], xmm0
mov dword [edi + 0x10], 0
mov dword [edi + 0x14], 0
mov dword [edi + 0x10], 0
mov dword [edi + 0x14], 0xf
mov byte [edi], 0
mov eax, dword [ebp + 8]
xor esi, esi
mov dword [ebp - 4], 0
mov dword [ebp - 0x1c], 1
test eax, eax
je 0x100436cf
dec eax
mov dword [ebp + 8], eax
mov al, byte [edx]
inc edx
mov byte [ebp + esi - 0x14], al
inc esi
mov ah, byte [ebp - 0x12]
mov ch, byte [ebp - 0x13]
mov cl, byte [ebp - 0x14]
mov dword [ebp - 0x20], edx
mov byte [ebp - 0xf], ah
mov byte [ebp - 0xd], ch
mov byte [ebp - 0xe], cl
cmp esi, 3
jne 0x10043605
mov al, cl
and cl, 3
shr al, 2
mov byte [ebp - 0x18], al
mov al, ch
shl cl, 4
shr al, 4
add cl, al
mov al, ah
mov byte [ebp - 0x17], cl
and ah, 0x3f
mov cl, ch
shr al, 6
and cl, 0xf
mov byte [ebp - 0x15], ah
shl cl, 2
add cl, al
xor esi, esi
mov byte [ebp - 0x16], cl
nop dword [eax]
cmp dword [0x10337140], 0x10
mov ecx, 0x1033712c
movzx eax, byte [ebp + esi - 0x18]
cmovae ecx, dword [0x1033712c]
movzx eax, byte [eax + ecx]
mov ecx, edi
push eax
call fcn.100309a0
inc esi
cmp esi, 4
jl 0x100435d0
mov edx, dword [ebp - 0x20]
xor esi, esi
mov ch, byte [ebp - 0xd]
mov cl, byte [ebp - 0xe]
mov eax, dword [ebp + 8]
test eax, eax
jne 0x10043575
mov dword [ebp + 8], esi
test esi, esi
je 0x100436cf
mov eax, esi
cmp esi, 3
jge 0x10043641
cmp eax, 3
jae 0x100436e2
mov byte [ebp + eax - 0x14], 0
inc eax
cmp eax, 3
jl 0x10043625
mov dl, byte [ebp - 0x12]
mov ch, byte [ebp - 0x13]
mov cl, byte [ebp - 0x14]
jmp 0x10043644
mov dl, byte [ebp - 0xf]
mov al, cl
and cl, 3
shr al, 2
mov byte [ebp - 0x18], al
mov al, ch
shr al, 4
and ch, 0xf
shl cl, 4
add cl, al
shl ch, 2
mov al, dl
mov byte [ebp - 0x17], cl
shr al, 6
and dl, 0x3f
add ch, al
mov byte [ebp - 0x15], dl
lea eax, [esi + 1]
mov byte [ebp - 0x16], ch
mov dword [ebp - 0x20], eax
test eax, eax
jle 0x100436ad
xor esi, esi
nop
cmp dword [0x10337140], 0x10
mov ecx, 0x1033712c
movzx eax, byte [ebp + esi - 0x18]
cmovae ecx, dword [0x1033712c]
movzx eax, byte [eax + ecx]
mov ecx, edi
push eax
call fcn.100309a0
inc esi
cmp esi, dword [ebp - 0x20]
jl 0x10043680
mov esi, dword [ebp + 8]
cmp esi, 3
jge 0x100436cf
mov eax, 3
sub eax, esi
mov dword [ebp + 8], eax
nop dword [eax]
push 0x3d
mov ecx, edi
call fcn.100309a0
sub dword [ebp + 8], 1
jne 0x100436c0
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
call fcn.100c9e74
int3
Function at 0x1004c5a0
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [ebp + 0xc]
mov edx, ecx
push ebx
mov ebx, dword [ebp + 8]
mov dword [ebp - 0x14], edx
cmp ebx, eax
je 0x1004c711
mov eax, dword [edx + 4]
mov dword [ebp - 0x18], eax
mov eax, dword [ebx + 4]
mov dword [ebp - 8], eax
movzx eax, byte [ebx + 8]
xor eax, 0x811c9dc5
imul ecx, eax, 0x1000193
movzx eax, byte [ebx + 9]
push esi
push edi
mov edi, dword [edx + 0xc]
mov esi, ebx
xor ecx, eax
mov dword [ebp - 0x1c], edi
movzx eax, byte [ebx + 0xa]
imul ecx, ecx, 0x1000193
xor ecx, eax
movzx eax, byte [ebx + 0xb]
imul ecx, ecx, 0x1000193
xor ecx, eax
mov eax, dword [edx + 0x18]
imul ecx, ecx, 0x1000193
and eax, ecx
mov ecx, dword [edi + eax*8]
mov dword [ebp - 4], ecx
lea eax, [edi + eax*8]
mov dword [ebp - 0xc], eax
mov eax, dword [eax + 4]
mov dword [ebp - 0x10], eax
nop word [eax + eax]
mov edi, esi
mov ebx, esi
mov esi, dword [esi]
lea ecx, [edi + 0xc]
call fcn.1004d020
push 0x2c
push edi
call fcn.100c9c9f
mov edx, dword [ebp - 0x14]
add esp, 8
dec dword [edx + 8]
cmp ebx, dword [ebp - 0x10]
je 0x1004c66d
mov eax, dword [ebp + 0xc]
cmp esi, eax
jne 0x1004c620
mov ecx, dword [ebp - 4]
cmp ecx, dword [ebp + 8]
jne 0x1004c707
mov edi, dword [ebp - 0xc]
mov ecx, dword [ebp - 8]
mov dword [edi], esi
mov dword [ecx], esi
pop edi
mov dword [esi + 4], ecx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
mov ecx, dword [ebp - 4]
mov edi, dword [ebp - 0xc]
cmp ecx, dword [ebp + 8]
jne 0x1004c681
mov eax, dword [ebp - 0x18]
mov ecx, eax
mov dword [edi], eax
jmp 0x1004c684
mov ecx, dword [ebp - 8]
mov eax, dword [ebp + 0xc]
mov dword [edi + 4], ecx
cmp esi, eax
je 0x1004c707
nop
movzx eax, byte [esi + 8]
xor eax, 0x811c9dc5
imul ecx, eax, 0x1000193
movzx eax, byte [esi + 9]
xor ecx, eax
movzx eax, byte [esi + 0xa]
imul ecx, ecx, 0x1000193
xor ecx, eax
movzx eax, byte [esi + 0xb]
imul ecx, ecx, 0x1000193
xor ecx, eax
imul eax, ecx, 0x1000193
mov ecx, dword [edx + 0x18]
and ecx, eax
mov eax, dword [ebp - 0x1c]
lea eax, [eax + ecx*8]
mov dword [ebp - 4], eax
mov eax, dword [eax + 4]
mov dword [ebp - 0x10], eax
mov edi, esi
mov ebx, esi
mov esi, dword [esi]
lea ecx, [edi + 0xc]
call fcn.1004d020
push 0x2c
push edi
call fcn.100c9c9f
mov edx, dword [ebp - 0x14]
add esp, 8
mov eax, dword [ebp + 0xc]
dec dword [edx + 8]
cmp ebx, dword [ebp - 0x10]
je 0x1004c718
cmp esi, eax
jne 0x1004c6d7
mov ecx, dword [ebp - 4]
mov dword [ecx], esi
mov ecx, dword [ebp - 8]
pop edi
mov dword [ecx], esi
mov dword [esi + 4], ecx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
mov ecx, dword [ebp - 4]
mov ebx, dword [ebp - 0x18]
mov dword [ecx], ebx
mov dword [ecx + 4], ebx
cmp esi, eax
jne 0x1004c690
mov ecx, dword [ebp - 8]
pop edi
mov dword [ecx], esi
mov dword [esi + 4], ecx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8