joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100255a0
Capabilities:
Get process heap flags

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100e6280
mov eax, dword fs:[0]
push eax
sub esp, 0xa30
push esi
mov eax, dword [0x10102380]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov eax, dword [ebp + 8]
xorps xmm0, xmm0
push fcn.10029d20
push fcn.10029db0
push 0x40
mov dword [esi], eax
lea eax, [ebp - 0x628]
push 0x18
push eax
mov dword [ebp - 0xa30], 0
movups xmmword [ebp - 0xa1c], xmm0
mov dword [ebp - 0x9cc], 0
movups xmmword [ebp - 0xa0c], xmm0
mov dword [ebp - 0x67c], 0
movups xmmword [ebp - 0x9fc], xmm0
mov dword [ebp - 0x678], 0
movups xmmword [ebp - 0x9ec], xmm0
mov dword [ebp - 0x674], 0
movups xmmword [ebp - 0x9dc], xmm0
mov byte [ebp - 0x668], 0
mov dword [ebp - 0x664], 0
mov word [ebp - 0x660], 0
movups xmmword [ebp - 0x65c], xmm0
mov dword [ebp - 0x64c], 0
mov dword [ebp - 0x648], 0
mov byte [ebp - 0x634], 0
mov byte [ebp - 0x632], 0
call fcn.100e39e2
xorps xmm0, xmm0
mov dword [ebp - 0x14], 0
movups xmmword [ebp - 0x24], xmm0
mov dword [ebp - 0x10], 0xf
mov byte [ebp - 0x24], 0
lea eax, [ebp - 0xa3c]
mov dword [ebp - 4], 0
push eax
lea ecx, [esi + 0x30]
call fcn.10023710
mov dword [ebp - 4], 1
mov ecx, dword [0x10203d14]
push dword [ebp - 0x664]
mov eax, dword [ecx]
mov eax, dword [eax + 0x14]
call eax
mov ecx, dword [ebp - 0x10]
cmp ecx, 0xf
jbe 0x10025704
mov edx, dword [ebp - 0x24]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x100256fa
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x100256fa
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push ecx
push edx
call fcn.100e39b1
add esp, 8
push fcn.10029d20
push 0x40
push 0x18
lea eax, [ebp - 0x628]
mov dword [ebp - 0x14], 0
push eax
mov dword [ebp - 0x10], 0xf
mov byte [ebp - 0x24], 0
call fcn.100e3582
lea ecx, [esi + 8]
mov dword [esi + 0x28], 0
mov dword [esi + 0x2c], 0
mov dword [esi + 0xa70], 0
mov dword [esi + 0xa84], 0
mov dword [esi + 0xa90], 0
call fcn.10029e60
mov eax, dword [esi + 0x1c]
cmp eax, dword [esi + 0x20]
je 0x1002576a
mov dword [esi + 0x20], eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x1002a3a0
Capabilities:
Access peb ldr_data
Get process heap flags
Get process heap force flags

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100e643d
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push esi
push edi
mov eax, dword [0x10102380]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, edx
mov dword [ebp - 0x10], ecx
push 0xa3c
call fcn.100e3552
add esp, 4
mov dword [ebp - 0x14], eax
mov dword [ebp - 4], 0
lea edi, [eax + 0xc]
push fcn.10029d20
push fcn.10029db0
xorps xmm0, xmm0
mov dword [ebp - 0x1c], edi
movq qword [eax], xmm0
mov dword [eax + 8], 0
mov dword [eax + 4], 1
mov dword [eax + 8], 1
mov dword [eax], 0x100f2d30
lea eax, [edi + 0x414]
mov esi, dword [esi]
push 0x40
push 0x18
push eax
mov dword [edi + 0xc], 0
mov dword [edi + 0x20], 0
mov dword [edi + 0x24], 0
mov dword [edi + 0x28], 0
mov dword [edi + 0x2c], 0
mov dword [edi + 0x30], 0
mov dword [edi + 0x34], 0
mov dword [edi + 0x38], 0
mov dword [edi + 0x3c], 0
mov dword [edi + 0x40], 0
mov dword [edi + 0x44], 0
mov dword [edi + 0x48], 0
mov dword [edi + 0x4c], 0
mov dword [edi + 0x50], 0
mov dword [edi + 0x54], 0
mov dword [edi + 0x58], 0
mov dword [edi + 0x5c], 0
mov dword [edi + 0x60], 0
mov dword [edi + 0x64], 0
mov dword [edi + 0x68], 0
mov dword [edi + 0x6c], 0
mov dword [edi + 0x70], 0
mov dword [edi + 0x3c0], 0
mov dword [edi + 0x3c4], 0
mov dword [edi + 0x3c8], 0
mov byte [edi + 0x3d4], 0
mov dword [edi + 0x3d8], 0
mov word [edi + 0x3dc], 0
mov dword [edi + 0x3e0], 0
mov dword [edi + 0x3e4], 0
mov dword [edi + 0x3e8], 0
mov dword [edi + 0x3ec], 0
mov dword [edi + 0x3f0], 0
mov dword [edi + 0x3f4], 0
mov byte [edi + 0x408], 0
mov byte [edi + 0x40a], 0
call fcn.100e39e2
xorps xmm0, xmm0
movups xmmword [edi + 0xa18], xmm0
mov dword [edi + 0xa28], 0
mov dword [edi + 0xa2c], 0xf
mov byte [edi + 0xa18], 0
push esi
mov ecx, edi
mov byte [ebp - 4], 2
call fcn.10023480
mov ecx, dword [ebp - 0x10]
xorps xmm0, xmm0
mov eax, dword [ebp - 0x14]
movq qword [ecx], xmm0
mov dword [ecx + 4], 0
mov dword [ecx + 4], eax
mov eax, ecx
mov dword [ecx], edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x10032070
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x10102380]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, ecx
cmp dword [esi + 0x38], 0
je 0x1003212c
cmp byte [esi + 0x3d], 0
je 0x1003212c
mov eax, dword [esi]
push edi
push 0xffffffffffffffff
call dword [eax + 0xc]
cmp eax, 0xffffffff
je 0x1003211a
mov ecx, dword [esi + 0x38]
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [esi + 0x40]
push eax
call dword [sym.imp.MSVCP140.dll_public:_int___thiscall_std::codecvt_char__char__struct__Mbstatet_::unshift_struct__Mbstatet___char___char___char___const]
sub eax, 0
je 0x100320e1
sub eax, 1
je 0x100320e5
sub eax, 2
jne 0x1003211a
mov byte [esi + 0x3d], al
mov al, 1
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100e3536
mov esp, ebp
pop ebp
ret
mov byte [esi + 0x3d], 0
mov edi, dword [ebp - 0x28]
lea eax, [ebp - 0x24]
sub edi, eax
je 0x10032103
push dword [esi + 0x4c]
push edi
push 1
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
add esp, 0x10
cmp edi, eax
jne 0x1003211a
cmp byte [esi + 0x3d], 0
pop edi
sete al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100e3536
mov esp, ebp
pop ebp
ret
pop edi
xor al, al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100e3536
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
mov al, 1
xor ecx, ebp
pop esi
call fcn.100e3536
mov esp, ebp
pop ebp
ret
Function at 0x10037ee0
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100e6d46
mov eax, dword fs:[0]
push eax
push ebx
sub esp, 0x48
mov eax, dword [0x10102380]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 4], 0
mov eax, dword [0x10209e78]
test al, 1
jne 0x10038021
or eax, 1
mov dword [0x10209e78], eax
mov byte [ebp - 4], 1
mov eax, 0x10
movaps xmm0, xmmword [0x100f5330]
xorps xmm0, xmmword [0x100f5830]
mov dword [ebp - 0x44], 0x324d2b49
mov dword [ebp - 0x40], 0x2b4d4d2b
mov word [ebp - 0x3c], 0x3e3a
mov byte [ebp - 0x3a], 0xb
movups xmmword [ebp - 0x54], xmm0
nop dword [eax + eax]
xor byte [ebp + eax - 0x54], 0xb
inc eax
cmp eax, 0x1b
jb 0x10037f70
xorps xmm0, xmm0
mov dword [ebp - 0x28], 0
lea ecx, [ebp - 0x54]
mov dword [ebp - 0x24], 0
movups xmmword [ebp - 0x38], xmm0
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x10037f96
sub ecx, edx
lea eax, [ebp - 0x54]
push ecx
push eax
lea ecx, [ebp - 0x38]
call fcn.1002a5c0
mov byte [ebp - 4], 2
mov edx, dword [0x10203c68]
test edx, edx
je 0x10037fbf
mov edx, dword [edx + 0x50]
jmp 0x10037fc1
xor edx, edx
mov eax, dword [0x10203c60]
test eax, eax
je 0x10037fcf
mov eax, dword [eax + 0x18]
jmp 0x10037fd1
xor eax, eax
lea ecx, [ebp - 0x38]
push ecx
push eax
lea ecx, [ebp - 0x14]
call fcn.10022d40
mov eax, dword [ebp - 0x14]
add esp, 8
mov byte [ebp - 4], 1
mov ecx, dword [ebp - 0x24]
mov dword [0x10209ed0], eax
cmp ecx, 0xf
jbe 0x1003801d
mov edx, dword [ebp - 0x38]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x10038013
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x1003806f
push ecx
push edx
call fcn.100e39b1
add esp, 8
mov byte [ebp - 4], 0
cmp dword [ebx + 0x1c], 0xf
lea ecx, [ebx + 8]
lea edx, [ebp - 0x20]
mov dword [ebp - 0x20], 0x65656c73
cmova ecx, dword [ebx + 8]
mov dword [ebp - 0x1c], 0x73656c70
mov word [ebp - 0x18], 0x73
call dword [0x10209ed0]
mov ecx, dword [ebx + 0x1c]
cmp ecx, 0xf
jbe 0x1003807f
mov edx, dword [ebx + 8]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x10038075
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x10038075
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push ecx
push edx
call fcn.100e39b1
add esp, 8
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret 0x18
Function at 0x10038b30
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
cmp byte [0x101d00cc], 0
push ebx
push esi
push edi
je 0x10038cbe
mov ecx, dword [0x10203c98]
mov eax, dword [ecx]
mov eax, dword [eax + 0x68]
call eax
test al, al
je 0x10038cbe
mov ecx, dword [0x10203d1c]
xor ebx, ebx
mov dword [ebp - 4], ecx
mov eax, dword [ecx + 0x28]
mov dword [ebp - 8], eax
test eax, eax
je 0x10038cbe
mov eax, dword [ecx + 0x1c]
mov ecx, dword [eax + ebx*4]
mov eax, dword [ecx]
mov eax, dword [eax + 0x30]
call eax
mov esi, eax
mov edi, 0x811c9dc5
xor ecx, ecx
nop word [eax + eax]
inc ecx
cmp byte [ecx + esi], 0
jne 0x10038b90
xor edx, edx
test ecx, ecx
je 0x10038bb9
nop dword [eax]
movsx eax, byte [edx + esi]
inc edx
xor eax, edi
imul edi, eax, 0x1000193
cmp edx, ecx
jb 0x10038ba0
cmp edi, 0x5ff56dc5
je 0x10038bc8
inc ebx
cmp ebx, dword [ebp - 8]
jae 0x10038cbe
mov ecx, dword [ebp - 4]
jmp 0x10038b74
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x1c]
mov edi, dword [eax + ebx*4]
test edi, edi
je 0x10038cbe
mov edx, dword [edi + 0x88]
test edx, edx
je 0x10038cbe
movss xmm1, dword [0x100f5040]
xor ebx, ebx
cmp edx, 4
jl 0x10038c8b
mov ecx, dword [edi + 0x7c]
lea esi, [edx - 4]
shr esi, 2
add ecx, 0x1078
inc esi
lea ebx, [esi*4]
movss xmm0, dword [ecx - 0xc60]
ucomiss xmm0, xmm1
lahf
test ah, 0x44
jp 0x10038c2c
mov dword [ecx - 0xc60], 0x7f7fffff
movss xmm0, dword [ecx - 0x840]
ucomiss xmm0, xmm1
lahf
test ah, 0x44
jp 0x10038c47
mov dword [ecx - 0x840], 0x7f7fffff
movss xmm0, dword [ecx - 0x420]
ucomiss xmm0, xmm1
lahf
test ah, 0x44
jp 0x10038c62
mov dword [ecx - 0x420], 0x7f7fffff
movss xmm0, dword [ecx]
ucomiss xmm0, xmm1
lahf
test ah, 0x44
jp 0x10038c75
mov dword [ecx], 0x7f7fffff
add ecx, 0x1080
sub esi, 1
jne 0x10038c11
cmp ebx, edx
jl 0x10038c8f
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
test edx, edx
jle 0x10038cbe
imul ecx, ebx, 0x420
add ecx, 0x418
add ecx, dword [edi + 0x7c]
sub edx, ebx
movss xmm0, dword [ecx]
ucomiss xmm0, xmm1
lahf
test ah, 0x44
jp 0x10038cb3
mov dword [ecx], 0x7f7fffff
add ecx, 0x420
sub edx, 1
jne 0x10038ca0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1003ad10
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100e6e28
mov eax, dword fs:[0]
push eax
push ebx
sub esp, 0x34
mov eax, dword [0x10102380]
xor eax, ebp
mov dword [ebp - 0x14], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 4], 0
xorps xmm0, xmm0
movups xmmword [ebp - 0x2c], xmm0
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x18], 0xf
mov byte [ebp - 0x2c], 0
mov byte [ebp - 4], 1
cmp dword [ebx + 0x1c], 0
je 0x1003ae7e
cmp dword [ebx + 0x20], 0xf
lea ecx, [ebx + 0x24]
lea eax, [ebx + 0xc]
cmova eax, dword [ebx + 0xc]
xor edx, edx
push ecx
push eax
xor ecx, ecx
call fcn.100339a0
mov ecx, dword [ebp - 0x1c]
mov esi, eax
add esp, 8
cmp esi, ecx
ja 0x1003adb4
cmp dword [ebp - 0x18], 0xf
lea ecx, [ebp - 0x2c]
mov dword [ebp - 0x1c], esi
cmova ecx, dword [ebp - 0x2c]
mov byte [ecx + esi], 0
jmp 0x1003adc1
sub eax, ecx
lea ecx, [ebp - 0x2c]
push 0
push eax
call fcn.1003b530
cmp dword [ebx + 0x20], 0xf
lea eax, [ebx + 0xc]
lea edx, [ebx + 0x24]
cmova eax, dword [ebx + 0xc]
lea ecx, [ebp - 0x2c]
cmp dword [ebp - 0x18], 0xf
push edx
cmova ecx, dword [ebp - 0x2c]
lea edx, [esi + 1]
push eax
call fcn.100339a0
add esp, 8
mov dword [ebp - 0x3c], 0x6e677850
mov dword [ebp - 0x38], 0x6e677b6e
xor eax, eax
mov dword [ebp - 0x34], 0x2b567878
mov byte [ebp - 0x30], 0xb
xor byte [ebp + eax - 0x3c], 0xb
inc eax
cmp eax, 0xd
jb 0x1003ae02
mov eax, dword [0x101d08f8]
lea edx, [ebp - 0x3c]
mov dword [ebp - 0x40], eax
mov eax, dword [0x10203c94]
push edx
lea edx, [ebp - 0x40]
push edx
mov ecx, dword [eax]
push eax
mov eax, dword [ecx + 0x64]
call eax
mov eax, dword [0x10203c94]
lea edx, [ebp - 0x2c]
add esp, 0xc
cmp dword [ebp - 0x18], 0xf
cmova edx, dword [ebp - 0x2c]
mov ecx, dword [eax]
push edx
push 0x101bf808
push eax
mov eax, dword [ecx + 0x64]
call eax
mov ecx, dword [ebp - 0x18]
add esp, 0xc
cmp ecx, 0xf
jbe 0x1003ae7e
mov edx, dword [ebp - 0x2c]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x1003ae74
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x1003aeb6
push ecx
push edx
call fcn.100e39b1
add esp, 8
mov ecx, dword [ebx + 0x20]
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x18], 0xf
mov byte [ebp - 0x2c], 0
cmp ecx, 0xf
jbe 0x1003aec6
mov edx, dword [ebx + 0xc]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x1003aebc
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x1003aebc
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push ecx
push edx
call fcn.100e39b1
add esp, 8
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.100e3536
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret
Function at 0x1003af90
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100e6e65
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push ebx
push esi
push edi
mov eax, dword [0x10102380]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
movzx eax, byte [esi]
xor eax, 0x811c9dc5
imul ecx, eax, 0x1000193
movzx eax, byte [esi + 1]
xor ecx, eax
movzx eax, byte [esi + 2]
imul ecx, ecx, 0x1000193
xor ecx, eax
movzx eax, byte [esi + 3]
imul ecx, ecx, 0x1000193
xor ecx, eax
lea eax, [ebp - 0x14]
imul edi, ecx, 0x1000193
push edi
push esi
push eax
call fcn.1003d880
mov eax, dword [ebp - 0x10]
test eax, eax
jne 0x1003b0bb
cmp dword [0x10209d58], 0xfffffff
jne 0x1003b01a
push str.unordered_map_set_too_long
call dword [sym.imp.MSVCP140.dll_void___cdecl_std::_Xlength_error_char_const__]
mov dword [ebp - 0x1c], 0x10209d54
mov dword [ebp - 4], 0
push 0x10
mov dword [ebp - 0x18], 0
call fcn.100e3552
mov ebx, eax
add esp, 4
mov eax, dword [esi]
mov dword [ebp - 0x18], ebx
mov dword [ebx + 8], eax
mov dword [ebx + 0xc], 0
mov dword [ebp - 4], 1
mov eax, dword [0x10209d58]
inc eax
movd xmm0, eax
cvtdq2pd xmm0, xmm0
shr eax, 0x1f
addsd xmm0, qword [eax*8 + 0x100f5ad0]
mov eax, dword [0x10209d6c]
cvtpd2ps xmm1, xmm0
movd xmm0, eax
cvtdq2pd xmm0, xmm0
shr eax, 0x1f
addsd xmm0, qword [eax*8 + 0x100f5ad0]
cvtpd2ps xmm0, xmm0
divss xmm1, xmm0
comiss xmm1, dword [0x10209d50]
jbe 0x1003b0b0
call fcn.1003cd80
push edi
lea eax, [ebx + 8]
push eax
lea eax, [ebp - 0x1c]
push eax
call fcn.1003d880
mov ecx, dword [eax]
jmp 0x1003b0b3
mov ecx, dword [ebp - 0x14]
push ebx
push ecx
push edi
call fcn.1003ce00
add eax, 0xc
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x1003b3a0
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
sub esp, 0x18
mov edx, dword [ebp + 8]
push ebx
mov ebx, ecx
cmp edx, eax
je 0x1003b4f6
mov eax, dword [ebx + 4]
mov dword [ebp - 0x14], eax
mov eax, dword [edx + 4]
mov dword [ebp - 8], eax
movzx eax, byte [edx + 8]
xor eax, 0x811c9dc5
imul ecx, eax, 0x1000193
movzx eax, byte [edx + 9]
push esi
push edi
mov edi, dword [ebx + 0xc]
mov esi, edx
xor ecx, eax
mov dword [ebp - 0x18], edi
movzx eax, byte [edx + 0xa]
imul ecx, ecx, 0x1000193
xor ecx, eax
movzx eax, byte [edx + 0xb]
imul ecx, ecx, 0x1000193
xor ecx, eax
mov eax, dword [ebx + 0x18]
imul ecx, ecx, 0x1000193
and eax, ecx
mov ecx, dword [edi + eax*8]
mov dword [ebp - 4], ecx
lea eax, [edi + eax*8]
mov dword [ebp - 0xc], eax
mov eax, dword [eax + 4]
mov dword [ebp - 0x10], eax
mov eax, esi
mov edi, esi
mov esi, dword [esi]
push 0x10
push eax
call fcn.100e39b1
dec dword [ebx + 8]
add esp, 8
cmp edi, dword [ebp - 0x10]
je 0x1003b459
mov eax, dword [ebp + 0xc]
cmp esi, eax
jne 0x1003b417
mov ecx, dword [ebp - 4]
cmp ecx, dword [ebp + 8]
jne 0x1003b4ec
mov edx, dword [ebp - 0xc]
mov ecx, dword [ebp - 8]
pop edi
mov dword [edx], esi
mov dword [ecx], esi
mov dword [esi + 4], ecx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
mov ecx, dword [ebp - 4]
mov edx, dword [ebp - 0xc]
cmp ecx, dword [ebp + 8]
jne 0x1003b46d
mov eax, dword [ebp - 0x14]
mov ecx, eax
mov dword [edx], eax
jmp 0x1003b470
mov ecx, dword [ebp - 8]
mov eax, dword [ebp + 0xc]
mov dword [edx + 4], ecx
cmp esi, eax
je 0x1003b4ec
nop word [eax + eax]
movzx eax, byte [esi + 8]
xor eax, 0x811c9dc5
imul ecx, eax, 0x1000193
movzx eax, byte [esi + 9]
xor ecx, eax
movzx eax, byte [esi + 0xa]
imul ecx, ecx, 0x1000193
xor ecx, eax
movzx eax, byte [esi + 0xb]
imul ecx, ecx, 0x1000193
xor ecx, eax
mov eax, dword [ebx + 0x18]
imul ecx, ecx, 0x1000193
and eax, ecx
mov ecx, dword [ebp - 0x18]
lea eax, [ecx + eax*8]
mov dword [ebp - 4], eax
mov eax, dword [eax + 4]
mov dword [ebp - 0x10], eax
mov eax, esi
mov edi, esi
mov esi, dword [esi]
push 0x10
push eax
call fcn.100e39b1
dec dword [ebx + 8]
add esp, 8
mov eax, dword [ebp + 0xc]
cmp edi, dword [ebp - 0x10]
je 0x1003b4fd
cmp esi, eax
jne 0x1003b4c7
mov ecx, dword [ebp - 4]
mov dword [ecx], esi
mov ecx, dword [ebp - 8]
pop edi
mov dword [ecx], esi
mov dword [esi + 4], ecx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
mov ecx, dword [ebp - 4]
mov edx, dword [ebp - 0x14]
mov dword [ecx], edx
mov dword [ecx + 4], edx
cmp esi, eax
jne 0x1003b480
mov ecx, dword [ebp - 8]
pop edi
mov dword [ecx], esi
mov dword [esi + 4], ecx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x1003d180
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1fffffff
sub esp, 0x10
bsr ecx, eax
push ebx
push esi
push edi
mov edi, 1
mov eax, edi
shl eax, cl
mov ecx, dword [ebp + 8]
cmp ecx, eax
jbe 0x1003d1ac
push str.invalid_hash_bucket_count
call dword [sym.imp.MSVCP140.dll_void___cdecl_std::_Xlength_error_char_const__]
lea eax, [ecx - 1]
mov esi, dword [0x10209d54]
or eax, 1
mov dword [ebp - 8], esi
bsr ecx, eax
push esi
lea ecx, [ecx + 1]
shl edi, cl
mov ecx, 0x10209d5c
lea eax, [edi + edi]
push eax
call fcn.1003b5f0
mov eax, dword [0x10209d54]
lea ebx, [edi - 1]
mov dword [0x10209d68], ebx
mov dword [0x10209d6c], edi
mov eax, dword [eax]
mov ecx, eax
cmp eax, esi
je 0x1003d2e6
movzx edx, byte [eax + 8]
xor edx, 0x811c9dc5
mov ecx, dword [ecx]
imul edi, edx, 0x1000193
movzx edx, byte [eax + 9]
xor edi, edx
movzx edx, byte [eax + 0xa]
imul edi, edi, 0x1000193
xor edi, edx
movzx edx, byte [eax + 0xb]
imul edi, edi, 0x1000193
xor edi, edx
mov edx, dword [0x10209d5c]
imul edi, edi, 0x1000193
and edi, ebx
mov ebx, dword [edx + edi*8]
lea edx, [edx + edi*8]
mov dword [ebp - 0xc], edx
cmp ebx, esi
jne 0x1003d244
mov dword [edx], eax
mov dword [edx + 4], eax
jmp 0x1003d2b1
mov edx, dword [edx + 4]
mov edi, dword [eax + 8]
cmp edi, dword [edx + 8]
jne 0x1003d27e
mov edx, dword [edx]
mov dword [ebp - 4], edx
cmp edx, eax
je 0x1003d276
mov ebx, dword [eax + 4]
mov esi, dword [ebp - 4]
mov dword [ebx], ecx
mov edi, dword [ecx + 4]
mov dword [edi], edx
mov edx, dword [edx + 4]
mov dword [edx], eax
mov dword [esi + 4], edi
mov esi, dword [ebp - 8]
mov dword [ecx + 4], ebx
mov dword [eax + 4], edx
mov edx, dword [ebp - 0xc]
mov dword [edx + 4], eax
jmp 0x1003d2b1
cmp ebx, edx
je 0x1003d28e
mov edx, dword [edx + 4]
cmp edi, dword [edx + 8]
je 0x1003d2c2
cmp ebx, edx
jne 0x1003d282
mov ebx, dword [eax + 4]
mov dword [ebp - 4], ebx
mov dword [ebx], ecx
mov ebx, dword [ecx + 4]
mov dword [ebx], edx
mov edi, dword [edx + 4]
mov dword [edi], eax
mov dword [edx + 4], ebx
mov edx, dword [ebp - 4]
mov dword [ecx + 4], edx
mov edx, dword [ebp - 0xc]
mov dword [eax + 4], edi
mov dword [edx], eax
mov eax, ecx
cmp ecx, esi
je 0x1003d2e6
mov ebx, dword [0x10209d68]
jmp 0x1003d1f2
mov ebx, dword [eax + 4]
mov edx, dword [edx]
mov dword [ebp - 4], edx
mov esi, edx
mov dword [ebx], ecx
mov edi, dword [ecx + 4]
mov dword [edi], edx
mov edx, dword [edx + 4]
mov dword [edx], eax
mov dword [esi + 4], edi
mov esi, dword [ebp - 8]
mov dword [ecx + 4], ebx
mov dword [eax + 4], edx
jmp 0x1003d2b1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x1003fcf0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100e742d
mov eax, dword fs:[0]
push eax
sub esp, 0x28
mov eax, dword [0x10102380]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ecx, dword [0x101c018c]
mov byte [0x101c0178], 0
cmp ecx, 0x105
jb 0x1003fd53
cmp dword [0x101c0190], 0xf
mov eax, 0x101c017c
mov dword [0x101c018c], 0x105
cmova eax, dword [0x101c017c]
mov byte [eax + 0x105], 0
jmp 0x1003fd67
mov eax, 0x105
sub eax, ecx
mov ecx, 0x101c017c
push 0
push eax
call fcn.1003b530
cmp dword [0x101c0190], 0xf
mov eax, 0x101c017c
mov ecx, dword [0x101d210c]
cmova eax, dword [0x101c017c]
push eax
push 0
push 0
push 5
push 0
call ecx
test eax, eax
js 0x1003fe62
xorps xmm0, xmm0
mov dword [ebp - 0x34], 0x65656c73
lea eax, [ebp - 0x34]
mov dword [ebp - 0x30], 0x73656c70
mov word [ebp - 0x2c], 0x73
lea edx, [eax + 1]
movups xmmword [ebp - 0x28], xmm0
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x1003fdc2
sub eax, edx
lea ecx, [ebp - 0x28]
push eax
lea eax, [ebp - 0x34]
push eax
call fcn.1002a5c0
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x28]
cmp dword [ebp - 0x14], 0xf
mov eax, 0x101c017c
mov edx, dword [0x101d2114]
cmova ecx, dword [ebp - 0x28]
cmp dword [0x101c0190], 0xf
push ecx
cmova eax, dword [0x101c017c]
push eax
call edx
cmp dword [0x101c0190], 0xf
mov eax, 0x101c017c
mov ecx, dword [0x101d2110]
cmova eax, dword [0x101c017c]
push 0
push eax
call ecx
mov ecx, dword [ebp - 0x14]
mov byte [0x101c0178], 1
cmp ecx, 0xf
jbe 0x1003fe62
mov edx, dword [ebp - 0x28]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x1003fe58
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x1003fe58
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push ecx
push edx
call fcn.100e39b1
add esp, 8
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.100e3536
mov esp, ebp
pop ebp
ret
Function at 0x10047b50
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [0x10102380]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword fs:[0x30]
push esi
push edi
mov edi, ecx
test ebx, ebx
jne 0x10047b83
xor al, al
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100e3536
mov esp, ebp
pop ebp
ret
mov ebx, dword [ebx + 0xc]
add ebx, 0x14
mov esi, dword [ebx]
cmp esi, ebx
je 0x10047bf0
mov ecx, 0x5a4d
lea edx, [esi - 8]
test edx, edx
je 0x10047bea
mov eax, dword [edx + 0x18]
test eax, eax
je 0x10047bea
cmp word [eax], cx
jne 0x10047bea
mov ecx, dword [eax + 0x3c]
add ecx, eax
je 0x10047be5
cmp dword [ecx], 0x4550
jne 0x10047be5
mov dword [ebp - 0xc], eax
mov eax, dword [edi + 4]
mov dword [ebp - 0x10], edx
mov dword [ebp - 8], ecx
cmp eax, dword [edi + 8]
je 0x10047bd9
movq xmm0, qword [ebp - 0x10]
movq qword [eax], xmm0
mov dword [eax + 8], ecx
add dword [edi + 4], 0xc
jmp 0x10047be5
lea ecx, [ebp - 0x10]
push ecx
push eax
mov ecx, edi
call fcn.1002ad20
mov ecx, 0x5a4d
mov esi, dword [esi]
cmp esi, ebx
jne 0x10047b94
mov eax, dword [edi]
cmp eax, dword [edi + 4]
mov ecx, dword [ebp - 4]
pop edi
setne al
xor ecx, ebp
pop esi
pop ebx
call fcn.100e3536
mov esp, ebp
pop ebp
ret