joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10039ef4
Capabilities:
Create thread

Disassembly:
push 8
mov eax, 0x102275e6
call fcn.101ec3fa
mov edi, edx
push 0x10
call fcn.101eb095
mov ecx, dword [ebp + 0x14]
mov esi, eax
mov dword [ebp - 0x14], esi
mov ecx, dword [ecx]
mov dword [esi], ecx
mov ecx, dword [ebp + 0x10]
mov ecx, dword [ecx]
mov dword [esi + 4], ecx
mov ecx, dword [ebp + 0xc]
mov eax, dword [ecx]
mov dword [esi + 8], eax
mov eax, dword [ebp + 8]
mov eax, dword [eax]
mov dword [esi + 0xc], eax
xor eax, eax
lea ebx, [edi + 4]
push ebx
push eax
push esi
push 0x1003de0c
push eax
push eax
mov dword [ebp - 4], eax
call fcn.101f5480
add esp, 0x1c
mov dword [edi], eax
test eax, eax
je 0x10039f53
call fcn.101ec3a9
ret
and dword [ebx], 0
push 6
call fcn.101e9f33
int3

Function at 0x1003aaa6
Capabilities:
Create thread

Disassembly:
push 8
mov eax, 0x102275e6
call fcn.101ec3fa
mov edi, edx
push 0x10
call fcn.101eb095
mov ecx, dword [ebp + 0x14]
mov esi, eax
mov dword [ebp - 0x14], esi
mov ecx, dword [ecx]
mov dword [esi], ecx
mov ecx, dword [ebp + 0x10]
mov ecx, dword [ecx]
mov dword [esi + 4], ecx
mov ecx, dword [ebp + 0xc]
mov eax, dword [ecx]
mov dword [esi + 8], eax
mov eax, dword [ebp + 8]
mov eax, dword [eax]
mov dword [esi + 0xc], eax
xor eax, eax
lea ebx, [edi + 4]
push ebx
push eax
push esi
push 0x1003e731
push eax
push eax
mov dword [ebp - 4], eax
call fcn.101f5480
add esp, 0x1c
mov dword [edi], eax
test eax, eax
je 0x1003ab05
call fcn.101ec3a9
ret
and dword [ebx], 0
push 6
call fcn.101e9f33
int3

Function at 0x1003ab10
Capabilities:
Create thread

Disassembly:
push 8
mov eax, 0x102275e6
call fcn.101ec3fa
mov edi, edx
push 0x10
call fcn.101eb095
mov ecx, dword [ebp + 0x14]
mov esi, eax
mov dword [ebp - 0x14], esi
mov ecx, dword [ecx]
mov dword [esi], ecx
mov ecx, dword [ebp + 0x10]
mov ecx, dword [ecx]
mov dword [esi + 4], ecx
mov ecx, dword [ebp + 0xc]
mov eax, dword [ecx]
mov dword [esi + 8], eax
mov eax, dword [ebp + 8]
mov eax, dword [eax]
mov dword [esi + 0xc], eax
xor eax, eax
lea ebx, [edi + 4]
push ebx
push eax
push esi
push 0x1003e79d
push eax
push eax
mov dword [ebp - 4], eax
call fcn.101f5480
add esp, 0x1c
mov dword [edi], eax
test eax, eax
je 0x1003ab6f
call fcn.101ec3a9
ret
and dword [ebx], 0
push 6
call fcn.101e9f33
int3
Function at 0x1003aeea
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [0x102cf440]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
lea ebx, [eax - 1]
mov dword [ebp - 0xc], edx
mov edi, ecx
mov dword [ebp - 8], ebx
mov ecx, dword [ebp + 0xc]
sar ebx, 1
mov dword [ebp - 0x14], ecx
mov ecx, edx
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x10], edx
cmp edx, ebx
jge 0x1003af51
lea esi, [ecx + ecx]
lea ecx, [edi + 8]
lea ecx, [ecx + esi*4]
lea eax, [ecx - 4]
push eax
push ecx
lea ecx, [ebp + 0x10]
call fcn.1003a2eb
mov edx, dword [ebp - 0xc]
movzx ecx, al
xor ecx, 1
inc ecx
add ecx, esi
mov dword [ebp - 0xc], ecx
mov eax, dword [edi + ecx*4]
mov dword [edi + edx*4], eax
cmp ecx, ebx
jl 0x1003af1f
mov eax, dword [ebp - 0x18]
mov esi, ecx
cmp ecx, ebx
jne 0x1003af65
test al, 1
jne 0x1003af65
mov eax, dword [edi + eax*4 - 4]
mov esi, dword [ebp - 8]
mov dword [edi + ecx*4], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 8], eax
cmp dword [ebp - 0x10], esi
jge 0x1003af95
push dword [ebp - 0x14]
lea ebx, [esi - 1]
sar ebx, 1
lea ecx, [ebp - 8]
lea eax, [edi + ebx*4]
push eax
call fcn.1003a2eb
test al, al
je 0x1003af95
mov eax, dword [edi + ebx*4]
mov dword [edi + esi*4], eax
mov esi, ebx
cmp dword [ebp - 0x10], ebx
jl 0x1003af70
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 4]
xor ecx, ebp
mov eax, dword [eax]
mov dword [edi + esi*4], eax
pop edi
pop esi
pop ebx
call fcn.101eafcd
leave
ret

Function at 0x1003b2b0
Capabilities:
Create thread

Disassembly:
push 8
mov eax, 0x102275e6
call fcn.101ec3fa
mov edi, edx
push 0x10
call fcn.101eb095
mov ecx, dword [ebp + 0x14]
mov esi, eax
mov dword [ebp - 0x14], esi
mov ecx, dword [ecx]
mov dword [esi], ecx
mov ecx, dword [ebp + 0x10]
mov ecx, dword [ecx]
mov dword [esi + 4], ecx
mov ecx, dword [ebp + 0xc]
mov eax, dword [ecx]
mov dword [esi + 8], eax
mov eax, dword [ebp + 8]
mov eax, dword [eax]
mov dword [esi + 0xc], eax
xor eax, eax
lea ebx, [edi + 4]
push ebx
push eax
push esi
push 0x1003f745
push eax
push eax
mov dword [ebp - 4], eax
call fcn.101f5480
add esp, 0x1c
mov dword [edi], eax
test eax, eax
je 0x1003b30f
call fcn.101ec3a9
ret
and dword [ebx], 0
push 6
call fcn.101e9f33
int3

Function at 0x1003c344
Capabilities:
Create thread

Disassembly:
push 8
mov eax, 0x102275e6
call fcn.101ec3fa
mov edi, edx
push 0x10
call fcn.101eb095
mov ecx, dword [ebp + 0x14]
mov esi, eax
mov dword [ebp - 0x14], esi
mov ecx, dword [ecx]
mov dword [esi], ecx
mov ecx, dword [ebp + 0x10]
mov ecx, dword [ecx]
mov dword [esi + 4], ecx
mov ecx, dword [ebp + 0xc]
mov eax, dword [ecx]
mov dword [esi + 8], eax
mov eax, dword [ebp + 8]
mov eax, dword [eax]
mov dword [esi + 0xc], eax
xor eax, eax
lea ebx, [edi + 4]
push ebx
push eax
push esi
push 0x1003f79e
push eax
push eax
mov dword [ebp - 4], eax
call fcn.101f5480
add esp, 0x1c
mov dword [edi], eax
test eax, eax
je 0x1003c3a3
call fcn.101ec3a9
ret
and dword [ebx], 0
push 6
call fcn.101e9f33
int3
Function at 0x1004abd0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov ecx, dword [esp + 8]
push ebx
push esi
mov esi, dword [esp + 0x14]
mov ebx, 0x30
push edi
mov edi, dword [esp + 0x10]
push 0x100
push 0x1b3
push esi
push ecx
call fcn.101eb910
mov ecx, eax
lea edi, [edi + 1]
movzx eax, byte [edi - 1]
mov esi, edx
cdq
xor ecx, eax
xor esi, edx
sub ebx, 1
jne 0x1004abe4
pop edi
mov edx, esi
mov eax, ecx
pop esi
pop ebx
ret

Function at 0x1005d2e0
Capabilities:
Hash data using djb2

Disassembly:
mov edx, dword [esp + 4]
mov eax, 0x1505
test edx, edx
je 0x1005d308
push ebx
nop
mov bl, byte [edx]
test bl, bl
je 0x1005d307
mov ecx, eax
shl eax, 5
add eax, ecx
movsx ecx, bl
add eax, ecx
add edx, 1
jne 0x1005d2f0
pop ebx
ret
Function at 0x1007f9e0
Capabilities:
Allocate thread local storage
Get thread local storage value
Set thread local storage value

Disassembly:
mov eax, dword [0x102e6024]
test eax, eax
jne 0x1007fa18
push 0x102e5ea0
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [0x102e6024], 0
jne 0x1007fa08
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
mov dword [0x102e6024], eax
push 0x102e5ea0
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov eax, dword [0x102e6024]
push esi
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov esi, eax
test esi, esi
jne 0x1007fa7a
push eax
call dword [sym.imp.GDI32.dll_CreateCompatibleDC]
mov esi, eax
test esi, esi
jne 0x1007fa44
push str._get_global_font_dc
call fcn.1009e4e0
add esp, 4
xor eax, eax
pop esi
ret
push 2
push esi
call dword [sym.imp.GDI32.dll_SetGraphicsMode]
test eax, eax
jne 0x1007fa69
push str._get_global_font_dc
call fcn.1009e4e0
add esp, 4
push esi
call dword [sym.imp.GDI32.dll_DeleteDC]
xor eax, eax
pop esi
ret
push esi
push dword [0x102e6024]
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
test eax, eax
je 0x1007fa5e
mov eax, esi
pop esi
ret

Function at 0x1007fa80
Capabilities:
Check os version

Disassembly:
sub esp, 0x98
mov eax, dword [0x102cf440]
xor eax, esp
mov dword [esp + 0x94], eax
lea eax, [esp]
mov dword [esp], 0x94
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
test eax, eax
jne 0x1007facd
push str._have_cleartype_quality
call fcn.1009e4e0
add esp, 4
xor eax, eax
mov ecx, dword [esp + 0x94]
xor ecx, esp
call fcn.101eafcd
add esp, 0x98
ret
cmp dword [esp + 4], 5
ja 0x1007fadd
jne 0x1007fab6
cmp dword [esp + 8], 1
jb 0x1007fab6
mov ecx, dword [esp + 0x94]
mov eax, 1
xor ecx, esp
call fcn.101eafcd
add esp, 0x98
ret
Function at 0x100940c0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x1c4
mov eax, dword [0x102cf440]
xor eax, esp
mov dword [esp + 0x1c0], eax
mov eax, dword [esp + 0x1cc]
push esi
mov esi, dword [esp + 0x1cc]
mov dword [esp + 0x10], eax
lea eax, [esp + 0x14]
push edi
push eax
movups xmm0, xmmword [esi + 0x38]
movups xmmword [esp + 0x1c], xmm0
movups xmm0, xmmword [esi + 0x48]
movups xmmword [esp + 0x2c], xmm0
movups xmm0, xmmword [esi + 0x58]
movups xmmword [esp + 0x3c], xmm0
call sym.project.dll_cairo_matrix_invert
add esi, 0x70
push esi
call sym.project.dll_FcAtomicNewFile
mov edi, eax
push 0
push esi
mov dword [esp + 0x20], edi
call fcn.100543a0
add esp, 0x10
test edi, edi
je 0x10094257
push ebx
push ebp
mov ebp, eax
lea ecx, [esp + 0xd0]
sub ebp, ecx
add eax, 0x110
mov dword [esp + 0x14], eax
nop word [eax + eax]
lea edi, [esp + 0xd0]
mov dword [esp + 0x10], 4
nop
mov ebx, 4
movups xmm0, xmmword [edi + ebp]
lea esi, [edi + 8]
push esi
lea eax, [esp + 0x24]
push edi
push eax
movups xmmword [edi], xmm0
call sym.project.dll_cairo_matrix_transform_point
movsd xmm0, qword [esp + 0x1f8]
add esp, 0xc
addsd xmm0, qword [edi]
movsd qword [edi], xmm0
add edi, 0x10
movsd xmm0, qword [esp + 0x1f4]
addsd xmm0, qword [esi]
movsd qword [esi], xmm0
sub ebx, 1
jne 0x10094165
sub dword [esp + 0x10], 1
jne 0x10094160
mov ebx, dword [esp + 0x14]
lea eax, [esp + 0x50]
push eax
lea eax, [esp + 0xd4]
push eax
movups xmm0, xmmword [ebx - 0x10]
push dword [esp + 0x1f0]
movups xmmword [esp + 0x5c], xmm0
movups xmm0, xmmword [ebx]
push dword [esp + 0x1f0]
movups xmmword [esp + 0x70], xmm0
movups xmm0, xmmword [ebx + 0x68]
push dword [esp + 0x1f0]
movups xmmword [esp + 0x84], xmm0
movups xmm0, xmmword [ebx + 0x78]
push dword [esp + 0x30]
movups xmmword [esp + 0x98], xmm0
movups xmm0, xmmword [ebx + 0x18]
movups xmmword [esp + 0xa8], xmm0
movups xmm0, xmmword [ebx + 0x28]
movups xmmword [esp + 0xb8], xmm0
movups xmm0, xmmword [ebx + 0x40]
movups xmmword [esp + 0xc8], xmm0
movups xmm0, xmmword [ebx + 0x50]
movups xmmword [esp + 0xd8], xmm0
call fcn.10094c80
add ebx, 0x1a0
add esp, 0x18
add ebp, 0x1a0
mov dword [esp + 0x14], ebx
sub dword [esp + 0x18], 1
jne 0x10094150
pop ebp
pop ebx
mov ecx, dword [esp + 0x1c8]
pop edi
pop esi
xor ecx, esp
call fcn.101eafcd
add esp, 0x1c4
ret
Function at 0x1009eb00
Capabilities:
Check os version

Disassembly:
sub esp, 0x9c
mov eax, dword [0x102cf440]
xor eax, esp
mov dword [esp + 0x98], eax
cmp dword [0x102e5dac], 0
jne 0x1009eb22
call fcn.10056200
mov eax, dword [0x102e6030]
test eax, eax
je 0x1009eb49
push eax
call sym.project.dll_cairo_device_reference
add esp, 4
mov ecx, dword [esp + 0x98]
xor ecx, esp
call fcn.101eafcd
add esp, 0x9c
ret
push esi
push edi
push 0x48
call fcn.101fe13d
mov esi, eax
push 0x1022db40
push esi
call fcn.100552a0
add esp, 0xc
call fcn.100a8bb0
mov dword [esi + 0x40], eax
xor edi, edi
lea eax, [esp + 0xc]
mov dword [esi + 0x3c], 0
push eax
mov dword [esp + 0x10], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
cmp dword [esp + 0x1c], 1
jne 0x1009eb9b
cmp dword [esp + 0x10], 4
jne 0x1009eb9b
cmp dword [esp + 0x14], 0xa
je 0x1009ebbb
push str.msimg32
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov dword [esi + 0x3c], eax
test eax, eax
je 0x1009ebbb
push str.AlphaBlend
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edi, eax
mov dword [esi + 0x44], edi
mov edx, 0x102e6030
xor ecx, ecx
lea eax, [esp + 8]
lock or dword [eax], ecx
cmp dword [0x102e6030], ecx
jne 0x1009ec00
mov ecx, esi
xor eax, eax
lock cmpxchg dword [edx], ecx
test eax, eax
jne 0x1009ebc3
push esi
call sym.project.dll_cairo_device_reference
add esp, 4
pop edi
pop esi
mov ecx, dword [esp + 0x98]
xor ecx, esp
call fcn.101eafcd
add esp, 0x9c
ret
push esi
call fcn.101fd0fd
push dword [0x102e6030]
call sym.project.dll_cairo_device_reference
mov ecx, dword [esp + 0xa8]
add esp, 8
pop edi
pop esi
xor ecx, esp
call fcn.101eafcd
add esp, 0x9c
ret
Function at 0x100b5ab0
Capabilities:
Encode data using xor

Disassembly:
mov edx, dword [esp + 4]
xor eax, eax
test edx, edx
je 0x100b5ad1
mov cl, byte [edx]
test cl, cl
je 0x100b5ad1
ror eax, 0x1f
lea edx, [edx + 1]
movzx ecx, cl
xor eax, ecx
mov cl, byte [edx]
test cl, cl
jne 0x100b5ac0
ret

Function at 0x100b5d65
Capabilities:
Encode data using xor

Disassembly:
mov ecx, dword [esp + 4]
sub esp, 0x18
mov eax, dword [ecx]
inc eax
push esi
cmp eax, 0xa
ja case.0x100b5d34.0
jmp dword [eax*4 + 0x100b5ee8]
movsd xmm1, qword [ecx + 8]
xorps xmm0, xmm0
comisd xmm0, xmm1
jbe 0x100b5d50
xorps xmm1, xmmword [0x102289b0]
movsd xmm0, qword [0x102304a8]
minsd xmm0, xmm1
pop esi
add esp, 0x18
jmp fcn.101ebdb0
mov edx, dword [ecx + 8]
test dl, 1
je 0x100b5d72
and edx, 0xfffffffe
add edx, ecx
xor ecx, ecx
test edx, edx
je 0x100b5d91
mov al, byte [edx]
test al, al
je 0x100b5d91
nop
ror ecx, 0x1f
lea edx, [edx + 1]
movzx eax, al
xor ecx, eax
mov al, byte [edx]
test al, al
jne 0x100b5d80
mov eax, ecx
pop esi
add esp, 0x18
ret
mov eax, dword [ecx + 8]
pop esi
add esp, 0x18
ret
mov eax, dword [ecx + 8]
xorps xmm3, xmm3
movsd xmm2, qword [0x102289b0]
movsd xmm0, qword [eax]
comisd xmm3, xmm0
jbe 0x100b5dbb
xorps xmm0, xmm2
movsd xmm4, qword [0x102304a8]
movaps xmm1, xmm4
minsd xmm1, xmm0
movsd xmm0, qword [eax + 8]
comisd xmm3, xmm0
movsd qword [esp + 4], xmm1
jbe 0x100b5dde
xorps xmm0, xmm2
movaps xmm1, xmm4
minsd xmm1, xmm0
movsd xmm0, qword [eax + 0x10]
comisd xmm3, xmm0
movsd qword [esp + 0xc], xmm1
jbe 0x100b5df9
xorps xmm0, xmm2
movaps xmm1, xmm4
minsd xmm1, xmm0
movsd qword [esp + 0x14], xmm1
movsd xmm1, qword [eax + 0x18]
comisd xmm3, xmm1
jbe 0x100b5e14
xorps xmm1, xmm2
minsd xmm4, xmm1
movaps xmm0, xmm4
call fcn.101ebdb0
movsd xmm0, qword [esp + 0x14]
mov esi, eax
call fcn.101ebdb0
movsd xmm0, qword [esp + 0xc]
xor esi, eax
call fcn.101ebdb0
movsd xmm0, qword [esp + 4]
xor esi, eax
call fcn.101ebdb0
xor eax, esi
pop esi
add esp, 0x18
ret
mov eax, dword [ecx + 8]
test al, 1
je 0x100b5e5a
and eax, 0xfffffffe
add eax, ecx
mov eax, dword [eax + 4]
pop esi
add esp, 0x18
ret
mov esi, dword [ecx + 8]
xor edx, edx
mov ecx, dword [esi + 0x14]
test ecx, ecx
je 0x100b5e85
mov al, byte [ecx]
test al, al
je 0x100b5e85
ror edx, 0x1f
lea ecx, [ecx + 1]
movzx eax, al
xor edx, eax
mov al, byte [ecx]
test al, al
jne 0x100b5e74
mov esi, dword [esi + 0x18]
xor ecx, ecx
test esi, esi
je 0x100b5ea5
mov al, byte [esi]
test al, al
je 0x100b5ea5
ror ecx, 0x1f
lea esi, [esi + 1]
movzx eax, al
xor ecx, eax
mov al, byte [esi]
test al, al
jne 0x100b5e94
xor ecx, edx
mov eax, ecx
pop esi
add esp, 0x18
ret
mov eax, dword [ecx + 8]
test al, 1
je 0x100b5eba
and eax, 0xfffffffe
add eax, ecx
pop esi
add esp, 0x18
mov dword [esp + 4], eax
jmp sym.project.dll_FcLangSetHash
mov eax, dword [ecx + 8]
test al, 1
je 0x100b5ed3
and eax, 0xfffffffe
add eax, ecx
pop esi
add esp, 0x18
mov dword [esp + 4], eax
jmp fcn.100cb0c0
xor eax, eax
pop esi
add esp, 0x18
ret
Function at 0x100b5e62
Capabilities:
Encode data using xor

Disassembly:
mov ecx, dword [esp + 4]
sub esp, 0x18
mov eax, dword [ecx]
inc eax
push esi
cmp eax, 0xa
ja case.0x100b5d34.0
jmp dword [eax*4 + 0x100b5ee8]
movsd xmm1, qword [ecx + 8]
xorps xmm0, xmm0
comisd xmm0, xmm1
jbe 0x100b5d50
xorps xmm1, xmmword [0x102289b0]
movsd xmm0, qword [0x102304a8]
minsd xmm0, xmm1
pop esi
add esp, 0x18
jmp fcn.101ebdb0
mov edx, dword [ecx + 8]
test dl, 1
je 0x100b5d72
and edx, 0xfffffffe
add edx, ecx
xor ecx, ecx
test edx, edx
je 0x100b5d91
mov al, byte [edx]
test al, al
je 0x100b5d91
nop
ror ecx, 0x1f
lea edx, [edx + 1]
movzx eax, al
xor ecx, eax
mov al, byte [edx]
test al, al
jne 0x100b5d80
mov eax, ecx
pop esi
add esp, 0x18
ret
mov eax, dword [ecx + 8]
pop esi
add esp, 0x18
ret
mov eax, dword [ecx + 8]
xorps xmm3, xmm3
movsd xmm2, qword [0x102289b0]
movsd xmm0, qword [eax]
comisd xmm3, xmm0
jbe 0x100b5dbb
xorps xmm0, xmm2
movsd xmm4, qword [0x102304a8]
movaps xmm1, xmm4
minsd xmm1, xmm0
movsd xmm0, qword [eax + 8]
comisd xmm3, xmm0
movsd qword [esp + 4], xmm1
jbe 0x100b5dde
xorps xmm0, xmm2
movaps xmm1, xmm4
minsd xmm1, xmm0
movsd xmm0, qword [eax + 0x10]
comisd xmm3, xmm0
movsd qword [esp + 0xc], xmm1
jbe 0x100b5df9
xorps xmm0, xmm2
movaps xmm1, xmm4
minsd xmm1, xmm0
movsd qword [esp + 0x14], xmm1
movsd xmm1, qword [eax + 0x18]
comisd xmm3, xmm1
jbe 0x100b5e14
xorps xmm1, xmm2
minsd xmm4, xmm1
movaps xmm0, xmm4
call fcn.101ebdb0
movsd xmm0, qword [esp + 0x14]
mov esi, eax
call fcn.101ebdb0
movsd xmm0, qword [esp + 0xc]
xor esi, eax
call fcn.101ebdb0
movsd xmm0, qword [esp + 4]
xor esi, eax
call fcn.101ebdb0
xor eax, esi
pop esi
add esp, 0x18
ret
mov eax, dword [ecx + 8]
test al, 1
je 0x100b5e5a
and eax, 0xfffffffe
add eax, ecx
mov eax, dword [eax + 4]
pop esi
add esp, 0x18
ret
mov esi, dword [ecx + 8]
xor edx, edx
mov ecx, dword [esi + 0x14]
test ecx, ecx
je 0x100b5e85
mov al, byte [ecx]
test al, al
je 0x100b5e85
ror edx, 0x1f
lea ecx, [ecx + 1]
movzx eax, al
xor edx, eax
mov al, byte [ecx]
test al, al
jne 0x100b5e74
mov esi, dword [esi + 0x18]
xor ecx, ecx
test esi, esi
je 0x100b5ea5
mov al, byte [esi]
test al, al
je 0x100b5ea5
ror ecx, 0x1f
lea esi, [esi + 1]
movzx eax, al
xor ecx, eax
mov al, byte [esi]
test al, al
jne 0x100b5e94
xor ecx, edx
mov eax, ecx
pop esi
add esp, 0x18
ret
mov eax, dword [ecx + 8]
test al, 1
je 0x100b5eba
and eax, 0xfffffffe
add eax, ecx
pop esi
add esp, 0x18
mov dword [esp + 4], eax
jmp sym.project.dll_FcLangSetHash
mov eax, dword [ecx + 8]
test al, 1
je 0x100b5ed3
and eax, 0xfffffffe
add eax, ecx
pop esi
add esp, 0x18
mov dword [esp + 4], eax
jmp fcn.100cb0c0
xor eax, eax
pop esi
add esp, 0x18
ret
Function at 0x100bd070
Capabilities:
Hash data using djb2

Disassembly:
mov ecx, dword [esp + 4]
mov eax, 0x1505
push edi
lea edx, [ecx + 0x2c]
lea edi, [ecx + 0x234]
cmp edx, edi
je 0x100bd0a0
push esi
movzx esi, word [edx]
add edx, 2
test esi, esi
je 0x100bd09f
mov ecx, eax
shl eax, 5
add eax, esi
add eax, ecx
cmp edx, edi
jne 0x100bd088
pop esi
and eax, 0x7fffffff
pop edi
ret
Function at 0x100c1160
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, dword [esp + 8]
xor eax, eax
mov edx, dword [esi + 4]
cmp edx, 8
jb 0x100c1174
lea edx, [eax + 8]
jmp 0x100c1178
test edx, edx
jle 0x100c118a
lea ecx, [esi + 8]
nop dword [eax + eax]
xor eax, dword [ecx]
lea ecx, [ecx + 4]
sub edx, 1
jne 0x100c1180
mov ecx, dword [esi]
pop esi
test ecx, ecx
je 0x100c1194
xor eax, dword [ecx + 4]
ret

Function at 0x100c4ea0
Capabilities:
Create directory

Disassembly:
push ecx
push esi
mov esi, dword [esp + 0xc]
mov ecx, esi
push edi
lea edx, [ecx + 1]
nop dword [eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x100c4eb0
sub ecx, edx
je 0x100c4f38
push esi
call sym.project.dll_FcStrDirname
mov edi, eax
add esp, 4
test edi, edi
je 0x100c4f38
push 0
push edi
call fcn.10201496
add esp, 8
test eax, eax
je 0x100c4ef6
push 0
push edi
call fcn.10201496
add esp, 8
cmp eax, 0xffffffff
jne 0x100c4f27
push edi
call fcn.100c4ea0
add esp, 4
test eax, eax
je 0x100c4f27
push esi
call fcn.10202805
add esp, 4
test eax, eax
jne 0x100c4f27
push 0x1ed
push esi
call fcn.1020547a
add esp, 8
test eax, eax
jne 0x100c4f27
push edi
lea esi, [eax + 1]
call sym.project.dll_FcStrFree
add esp, 4
mov eax, esi
pop edi
pop esi
pop ecx
ret
push edi
xor esi, esi
call sym.project.dll_FcStrFree
add esp, 4
mov eax, esi
pop edi
pop esi
pop ecx
ret
pop edi
xor eax, eax
pop esi
pop ecx
ret
Function at 0x100cc3e0
Capabilities:
Create directory

Disassembly:
sub esp, 0x3c
mov eax, dword [0x102cf440]
xor eax, esp
mov dword [esp + 0x38], eax
push esi
mov esi, dword [esp + 0x44]
push dword [esi + 8]
call fcn.10202805
add esp, 4
test eax, eax
jns 0x100cc465
lea eax, [esp + 0xc]
push eax
push dword [esi + 8]
call fcn.100cb180
add esp, 8
test eax, eax
js 0x100cc453
push 0
call fcn.101fe3dd
sub eax, dword [esp + 0x30]
add esp, 4
cmp eax, 0x258
jle 0x100cc453
push dword [esi + 8]
call fcn.102074f8
add esp, 4
test eax, eax
jne 0x100cc453
push esi
call sym.project.dll_FcAtomicLock
add esp, 4
pop esi
mov ecx, dword [esp + 0x38]
xor ecx, esp
call fcn.101eafcd
add esp, 0x3c
ret
xor eax, eax
pop esi
mov ecx, dword [esp + 0x38]
xor ecx, esp
call fcn.101eafcd
add esp, 0x3c
ret
push dword [esi + 4]
call fcn.10202b9e
mov ecx, dword [esp + 0x40]
add esp, 4
mov eax, 1
pop esi
xor ecx, esp
call fcn.101eafcd
add esp, 0x3c
ret

Function at 0x100cc490
Capabilities:
Move file

Disassembly:
push esi
mov esi, dword [esp + 8]
push dword [esi]
call fcn.10202b9e
push dword [esi]
push dword [esi + 4]
call fcn.10202a5c
xor ecx, ecx
add esp, 0xc
test eax, eax
setns cl
mov eax, ecx
pop esi
ret
Function at 0x100d2920
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ecx
mov eax, dword [esp + 0x10]
push ebp
mov ebp, dword [esp + 0xc]
push edi
mov edi, dword [esp + 0x14]
mov eax, dword [eax + 0xc]
mov dword [esp + 8], eax
mov eax, dword [edi + 0x78]
test eax, eax
je 0x100d2945
push dword [edi + 0x74]
call eax
add esp, 4
push ebx
push esi
mov esi, dword [edi + 0x54]
test esi, esi
je 0x100d29ab
nop
mov ebx, dword [esi + 4]
xor edx, edx
mov eax, dword [ebx + 0x60]
mov eax, dword [eax + 8]
mov dword [esp + 0x1c], eax
mov eax, dword [ebx + 0x54]
test eax, eax
je 0x100d29a4
mov ecx, dword [eax + 8]
cmp eax, esi
je 0x100d2977
mov edx, eax
mov eax, ecx
test eax, eax
jne 0x100d2966
jmp 0x100d29a4
test edx, edx
jne 0x100d2980
mov dword [ebx + 0x54], ecx
jmp 0x100d2983
mov dword [edx + 8], ecx
mov eax, dword [esi + 0x14]
test eax, eax
je 0x100d2990
push esi
call eax
add esp, 4
push esi
call fcn.100d2d40
mov eax, dword [esp + 0x20]
push esi
push eax
mov eax, dword [eax + 8]
call eax
add esp, 0xc
mov esi, dword [edi + 0x54]
test esi, esi
jne 0x100d2950
lea eax, [edi + 0x6c]
test eax, eax
je 0x100d2a2e
test ebp, ebp
je 0x100d2a2e
mov ebx, dword [eax]
test ebx, ebx
je 0x100d2a21
nop dword [eax]
mov esi, dword [ebx + 8]
mov eax, dword [ebx + 4]
mov dword [esp + 0x1c], eax
mov eax, dword [esi + 8]
test eax, eax
je 0x100d29d7
push esi
call eax
add esp, 4
mov eax, dword [esp + 0x20]
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0x3c]
test eax, eax
je 0x100d29eb
push esi
call eax
add esp, 4
mov eax, dword [esi + 0x28]
test eax, eax
je 0x100d29fc
push eax
mov eax, dword [ebp + 8]
push ebp
call eax
add esp, 8
mov dword [esi + 0x28], 0
mov eax, dword [ebp + 8]
push esi
push ebp
call eax
mov eax, dword [ebp + 8]
push ebx
push ebp
call eax
mov eax, dword [esp + 0x2c]
add esp, 0x10
mov ebx, eax
test eax, eax
jne 0x100d29c0
lea eax, [edi + 0x6c]
mov dword [eax], 0
mov dword [eax + 4], 0
mov eax, dword [edi + 0x30]
mov dword [edi + 0x58], 0
test eax, eax
je 0x100d2a42
push edi
call eax
add esp, 4
push ebp
push edi
call fcn.100d28a0
mov eax, dword [esp + 0x18]
add esp, 8
mov eax, dword [eax + 0x34]
test eax, eax
je 0x100d2a5d
push edi
call eax
add esp, 4
mov esi, dword [edi + 0x68]
mov eax, dword [edi + 8]
mov dword [esp + 0x20], eax
test esi, esi
je 0x100d2a8f
mov eax, dword [esi + 0x18]
mov ebx, dword [esi + 0x1c]
test eax, eax
je 0x100d2a7b
push esi
call eax
add esp, 4
test dword [esp + 0x20], 0x400
jne 0x100d2a8f
mov eax, dword [ebx + 8]
push esi
push ebx
call eax
add esp, 8
mov eax, dword [edi + 0x80]
mov dword [edi + 0x68], 0
pop esi
pop ebx
test eax, eax
je 0x100d2ab6
push eax
mov eax, dword [ebp + 8]
push ebp
call eax
add esp, 8
mov dword [edi + 0x80], 0
mov eax, dword [ebp + 8]
push edi
push ebp
call eax
add esp, 8
pop edi
pop ebp
pop ecx
ret