joyce8/EMBER2024-capa huggingface dataset:
Function at 0x485d60
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x4a1a98
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x4d8b40]
xor eax, esp
push eax
lea eax, [esp + 0x10]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0xc], esi
mov edi, dword [esp + 0x20]
push edi
call fcn.00439640
mov dword [esp + 0x18], 0
test edi, edi
je 0x485da4
add edi, 0x28
jmp 0x485da6
xor edi, edi
mov dword [esi + 0x28], vtable.boost::exception.0
mov ecx, dword [edi + 4]
mov dword [esi + 0x2c], ecx
test ecx, ecx
je 0x485dbe
mov eax, dword [ecx]
mov edx, dword [eax + 0xc]
call edx
mov eax, dword [edi + 8]
mov dword [esi + 0x30], eax
mov ecx, dword [edi + 0xc]
mov dword [esi + 0x34], ecx
mov edx, dword [edi + 0x10]
mov dword [esi + 0x38], edx
mov dword [esi], vtable.boost::exception_detail::error_info_injector_class_std::runtime_error_.1.0
mov dword [esi + 0x28], vtable.boost::exception_detail::error_info_injector_class_std::runtime_error_.0
mov eax, esi
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x10
ret 4

Function at 0x4878f0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x4a1c18
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x4d8b40]
xor eax, esp
push eax
lea eax, [esp + 0x10]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0xc], esi
mov edi, dword [esp + 0x20]
push edi
call fcn.004190f0
mov dword [esi], vtable.std::invalid_argument.0
mov dword [esp + 0x18], 0
test edi, edi
je 0x48793a
add edi, 0x28
jmp 0x48793c
xor edi, edi
mov dword [esi + 0x28], vtable.boost::exception.0
mov ecx, dword [edi + 4]
mov dword [esi + 0x2c], ecx
test ecx, ecx
je 0x487954
mov eax, dword [ecx]
mov edx, dword [eax + 0xc]
call edx
mov eax, dword [edi + 8]
mov dword [esi + 0x30], eax
mov ecx, dword [edi + 0xc]
mov dword [esi + 0x34], ecx
mov edx, dword [edi + 0x10]
mov dword [esi + 0x38], edx
mov dword [esi], vtable.boost::exception_detail::error_info_injector_class_std::invalid_argument_.1.0
mov dword [esi + 0x28], vtable.boost::exception_detail::error_info_injector_class_std::invalid_argument_.0
mov eax, esi
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x10
ret 4
Function at 0x48f760
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
push 0xffffffffffffffff
push 0x4a22b3
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
mov eax, dword [0x4d8b40]
xor eax, esp
push eax
lea eax, [esp + 0x10]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0xc], esi
call fcn.0048aaa0
xor ebx, ebx
lea ecx, [esi + 0x18]
mov dword [esp + 0x18], ebx
call fcn.0048aaa0
lea ecx, [esi + 0x40]
mov byte [esp + 0x18], 1
call fcn.0048aaa0
mov byte [esi + 0x30], bl
mov byte [esi + 0x31], bl
mov dword [esi + 0x34], ebx
mov dword [esi + 0x38], ebx
mov byte [esi + 0x3c], 1
mov eax, esi
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
add esp, 0x10
ret
Function at 0x49bcf0
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x4a1a98
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x4d8b40]
xor eax, esp
push eax
lea eax, [esp + 0x10]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0xc], esi
mov edi, dword [esp + 0x20]
push edi
call fcn.00439640
mov dword [esi], vtable.boost::regex_error.0
mov eax, dword [edi + 0x28]
mov dword [esi + 0x28], eax
mov ecx, dword [edi + 0x2c]
mov dword [esi + 0x2c], ecx
mov dword [esi + 0x30], vtable.boost::exception.0
mov ecx, dword [edi + 0x34]
mov dword [esp + 0x18], 0
mov dword [esi + 0x34], ecx
test ecx, ecx
je 0x49bd55
mov edx, dword [ecx]
mov eax, dword [edx + 0xc]
call eax
mov ecx, dword [edi + 0x38]
mov dword [esi + 0x38], ecx
mov edx, dword [edi + 0x3c]
mov dword [esi + 0x3c], edx
mov eax, dword [edi + 0x40]
mov dword [esi + 0x40], eax
mov dword [esi], vtable.boost::exception_detail::error_info_injector_class_boost::regex_error_.1.0
mov dword [esi + 0x30], vtable.boost::exception_detail::error_info_injector_class_boost::regex_error_.0
mov eax, esi
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x10
ret 4

Function at 0x49bdf0
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push 0xffffffffffffffff
push 0x4a2cc3
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x4d8b40]
xor eax, esp
push eax
lea eax, [esp + 0x10]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0xc], esi
mov edi, dword [esp + 0x20]
push edi
call fcn.0049bcf0
xor ecx, ecx
mov dword [esp + 0x18], ecx
mov dword [esi + 0x44], vtable.boost::exception_detail::clone_base.0
lea eax, [esi + 0x30]
mov byte [esp + 0x18], 1
mov dword [esi], vtable.boost::exception_detail::clone_impl_struct_boost::exception_detail::error_info_injector_class_boost::regex_error__.1.0
mov dword [eax], vtable.boost::exception_detail::clone_impl_struct_boost::exception_detail::error_info_injector_class_boost::regex_error__.0
mov dword [esi + 0x44], vtable.boost::exception_detail::clone_impl_struct_boost::exception_detail::error_info_injector_class_boost::regex_error__.2.0
cmp edi, ecx
je 0x49be52
lea ecx, [edi + 0x30]
push ecx
push eax
call fcn.00482730
add esp, 8
mov eax, esi
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x10
ret 4
Function at 0x49c9f0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0xf0
mov eax, 0x4c10b4
mov dword [esp], eax
mov dword [esp + 4], 0x4c4eec
mov dword [esp + 8], 0x4c33b4
mov dword [esp + 0xc], 0x4c00e8
mov dword [esp + 0x10], 0x4ae110
mov dword [esp + 0x14], 0x4c59c0
mov dword [esp + 0x18], 0x4c4f00
mov dword [esp + 0x1c], 0x4ae130
mov dword [esp + 0x20], 0x4c00e4
mov dword [esp + 0x24], 0x4c00e0
mov dword [esp + 0x28], 0x4c00dc
mov dword [esp + 0x2c], str._
mov dword [esp + 0x30], 0x4c23cc
mov dword [esp + 0x34], 0x4c25e4
mov dword [esp + 0x38], 0x4a79b0
mov dword [esp + 0x3c], 0x4c00d8
mov dword [esp + 0x40], 0x4c00d4
mov dword [esp + 0x44], str.0123456789
mov dword [esp + 0x48], 0x4af9e4
mov dword [esp + 0x4c], str.BDMS
mov dword [esp + 0x50], 0x4c49ec
mov dword [esp + 0x54], 0x4c492c
mov dword [esp + 0x58], eax
mov dword [esp + 0x5c], eax
mov dword [esp + 0x60], 0x4c00c4
mov dword [esp + 0x64], 0x4c00c0
mov dword [esp + 0x68], 0x4c4910
mov dword [esp + 0x6c], 0x4c2f8c
mov dword [esp + 0x70], 0x4af9ec
mov dword [esp + 0x74], 0x4bfddc
mov dword [esp + 0x78], 0x4bfdbc
mov dword [esp + 0x7c], 0x4c3770
mov dword [esp + 0x80], 0x4af9e0
mov dword [esp + 0x84], 0x4bfda8
mov dword [esp + 0x88], 0x4bfda4
mov dword [esp + 0x8c], 0x4bfde8
mov dword [esp + 0x90], 0x4c5e98
mov dword [esp + 0x94], 0x4c5ccc
mov dword [esp + 0x98], 0x4bfde0
mov dword [esp + 0x9c], eax
mov dword [esp + 0xa0], eax
mov dword [esp + 0xa4], eax
mov dword [esp + 0xa8], eax
mov dword [esp + 0xac], eax
mov dword [esp + 0xb0], eax
mov dword [esp + 0xb4], eax
mov dword [esp + 0xb8], eax
mov dword [esp + 0xbc], 0x4bfe90
mov dword [esp + 0xc0], 0x4bfe6c
mov dword [esp + 0xc4], 0x4bfe54
mov dword [esp + 0xc8], 0x4ac388
mov dword [esp + 0xcc], str.ZYXWVUTRQPNKJIHGFEA
mov dword [esp + 0xd0], 0x4bfe88
mov dword [esp + 0xd4], 0x4ae154
mov dword [esp + 0xd8], 0x4a9df8
mov dword [esp + 0xdc], 0x4bfe70
mov dword [esp + 0xe0], 0x4bfe74
mov dword [esp + 0xe4], 0x4c00bc
mov dword [esp + 0xe8], 0x4bfe78
mov dword [esp + 0xec], 0x4bfe68
cmp cl, 0x3c
jae 0x49cc0d
movzx eax, cl
mov eax, dword [esp + eax*4]
add esp, 0xf0
ret
Function at 0x10019580
Capabilities:
Encode data using xor

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100b8f36
mov eax, dword fs:[0]
push eax
push ebx
sub esp, 0x3c
push esi
mov eax, dword [0x100d0008]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov eax, dword [0x100f4750]
test al, 1
jne 0x100196c2
or eax, 1
mov dword [0x100f4750], eax
mov dword [ebp - 4], 0
mov eax, 0x10
movaps xmm0, xmmword [0x100c4950]
pxor xmm0, xmmword [0x100c4d00]
mov dword [ebp - 0x1c], 0xbaa5baa5
mov dword [ebp - 0x18], 0xdcbad8a2
mov word [ebp - 0x14], 0x9aab
movups xmmword [ebp - 0x2c], xmm0
xor byte [ebp + eax - 0x2c], 0x9a
inc eax
cmp eax, 0x1a
jb 0x10019604
lea ecx, [ebp - 0x2c]
mov dword [ebp - 0x38], 0
mov dword [ebp - 0x34], 0xf
lea edx, [ecx + 1]
mov byte [ebp - 0x48], 0
mov al, byte [ecx]
inc ecx
test al, al
jne 0x10019627
sub ecx, edx
lea eax, [ebp - 0x2c]
push ecx
push eax
lea ecx, [ebp - 0x48]
call fcn.1001f040
mov byte [ebp - 4], 1
mov edx, dword [0x100f485c]
test edx, edx
je 0x10019650
mov edx, dword [edx + 0x50]
jmp 0x10019652
xor edx, edx
mov eax, dword [0x100f4854]
test eax, eax
je 0x10019660
mov eax, dword [eax + 0x18]
jmp 0x10019662
xor eax, eax
lea ecx, [ebp - 0x48]
push ecx
push eax
lea ecx, [ebp - 0x30]
call fcn.100191a0
mov eax, dword [ebp - 0x30]
add esp, 8
mov byte [ebp - 4], 0
mov edx, dword [ebp - 0x34]
mov dword [0x100f4754], eax
cmp edx, 0x10
jb 0x100196b9
mov ecx, dword [ebp - 0x48]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x100196aa
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x100196aa
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push edx
push ecx
call fcn.100b7d6a
mov eax, dword [0x100f4754]
add esp, 8
mov dword [ebp - 4], 0xffffffff
jmp 0x100196c7
mov eax, dword [0x100f4754]
test eax, eax
je 0x100196cf
mov ecx, esi
call eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret
Function at 0x1001f300
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100b9192
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x100d0008]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, edx
mov dword [ebp - 0x10], ecx
push 0x40c
call fcn.100b78f6
mov ebx, eax
add esp, 4
mov dword [ebp - 0x14], ebx
mov dword [ebp - 4], 0
lea edi, [ebx + 0xc]
mov dword [ebx + 4], 1
mov dword [ebx + 8], 1
mov dword [ebx], 0x100c35c8
mov ecx, dword [esi]
mov dword [edi + 0xc], 0
mov dword [edi + 0x20], 0
mov dword [edi + 0x24], 0
mov dword [edi + 0x28], 0
mov dword [edi + 0x2c], 0
mov dword [edi + 0x30], 0
mov dword [edi + 0x34], 0
mov dword [edi + 0x38], 0
mov dword [edi + 0x3c], 0
mov dword [edi + 0x40], 0
mov dword [edi + 0x44], 0
mov dword [edi + 0x48], 0
mov dword [edi + 0x4c], 0
mov dword [edi + 0x50], 0
mov dword [edi + 0x54], 0
mov dword [edi + 0x58], 0
mov dword [edi + 0x5c], 0
mov dword [edi + 0x60], 0
mov dword [edi + 0x64], 0
mov dword [edi + 0x68], 0
mov dword [edi + 0x6c], 0
mov dword [edi + 0x70], 0
mov dword [edi + 0x3b4], 0
mov dword [edi + 0x3b8], 0
mov dword [edi + 0x3bc], 0
mov byte [edi + 0x3c0], 0
mov dword [edi + 0x3c4], 0
mov word [edi + 0x3c8], 0
mov dword [edi + 0x3cc], 0
mov dword [edi + 0x3d0], 0
mov dword [edi + 0x3d4], 0
push ecx
mov dword [edi + 0x3d8], 0
mov ecx, edi
mov dword [edi + 0x3dc], 0
mov dword [edi + 0x3e0], 0
mov word [edi + 0x3f0], 0
call fcn.100196f0
mov eax, dword [ebp - 0x10]
xorps xmm0, xmm0
movq qword [eax], xmm0
mov dword [eax], edi
mov dword [eax + 4], ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x100241b0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov dword [ebp - 0x10], 0xfffef5d7
xor eax, eax
mov dword [ebp - 0xc], 0xffeebaf6
mov dword [ebp - 8], 0xe8efeee2
mov word [ebp - 4], 0xe9ff
mov byte [ebp - 2], 0x9a
xor byte [ebp + eax - 0x10], 0x9a
inc eax
cmp eax, 0xf
jb 0x100241d7
movaps xmm0, xmmword [0x100c5330]
mov eax, 0x10
pxor xmm0, xmmword [0x100c4950]
mov dword [ebp - 0x18], 0xeff9eef4
mov word [ebp - 0x14], 0xfff8
mov byte [ebp - 0x12], 0x9a
movups xmmword [ebp - 0x28], xmm0
nop dword [eax + eax]
xor byte [ebp + eax - 0x28], 0x9a
inc eax
cmp eax, 0x17
jb 0x10024210
mov ecx, dword [0x100f48c8]
lea edx, [ebp - 0x10]
push 0
push 1
push edx
mov eax, dword [ecx]
lea edx, [ebp - 0x28]
push edx
mov eax, dword [eax + 0x150]
call eax
mov ecx, eax
mov dword [0x100f4814], ecx
mov eax, dword [ecx]
mov eax, dword [eax + 0x30]
call eax
mov dword [ebp - 0x10], 0xfffef5d7
xor eax, eax
mov dword [ebp - 0xc], 0xffeebaf6
mov dword [ebp - 8], 0xe8efeee2
mov word [ebp - 4], 0xe9ff
mov byte [ebp - 2], 0x9a
xor byte [ebp + eax - 0x10], 0x9a
inc eax
cmp eax, 0xf
jb 0x10024267
movaps xmm0, xmmword [0x100c5260]
mov eax, 0x10
pxor xmm0, xmmword [0x100c4950]
mov dword [ebp - 0x18], 0x9aeefbf6
movups xmmword [ebp - 0x28], xmm0
xor byte [ebp + eax - 0x28], 0x9a
inc eax
cmp eax, 0x14
jb 0x10024291
mov ecx, dword [0x100f48c8]
lea edx, [ebp - 0x10]
push 0
push 1
push edx
mov eax, dword [ecx]
lea edx, [ebp - 0x28]
push edx
mov eax, dword [eax + 0x150]
call eax
mov ecx, eax
mov dword [0x100f4818], ecx
mov eax, dword [ecx]
mov eax, dword [eax + 0x30]
call eax
mov esp, ebp
pop ebp
ret
Function at 0x10026ad0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100b9490
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push ebx
push esi
push edi
mov eax, dword [0x100d0008]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 4], 0
mov eax, dword [0x100f979c]
mov ecx, dword [eax]
mov dword [eax], eax
mov eax, dword [0x100f979c]
mov dword [eax + 4], eax
mov dword [0x100f97a0], 0
cmp ecx, dword [0x100f979c]
je 0x10026b39
mov esi, dword [ecx]
push 0x10
push ecx
call fcn.100b7d6a
add esp, 8
mov ecx, esi
cmp esi, dword [0x100f979c]
jne 0x10026b22
push 8
mov ecx, 0x100f9798
call fcn.10029770
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [0x100f4890]
test ecx, ecx
je 0x10026c97
mov eax, dword [ecx]
mov eax, dword [eax + 0x20]
call eax
mov edi, eax
test edi, edi
je 0x10026c97
nop dword [eax + eax]
mov eax, dword [edi + 0x14]
mov ebx, 0x811c9dc5
mov esi, dword [edi + 8]
mov dword [ebp - 0x18], eax
xor eax, eax
inc eax
cmp byte [eax + esi], 0
jne 0x10026b80
xor edx, edx
test eax, eax
je 0x10026ba1
nop dword [eax]
movsx ecx, byte [edx + esi]
inc edx
xor ecx, ebx
imul ebx, ecx, 0x1000193
cmp edx, eax
jb 0x10026b90
movzx eax, bl
xor eax, 0x811c9dc5
mov dword [ebp - 0x14], ebx
imul ecx, eax, 0x1000193
mov eax, ebx
shr eax, 8
movzx eax, al
xor ecx, eax
mov eax, ebx
imul ecx, ecx, 0x1000193
shr eax, 0x10
movzx eax, al
xor ecx, eax
mov eax, ebx
imul ecx, ecx, 0x1000193
shr eax, 0x18
xor ecx, eax
imul edx, ecx, 0x1000193
mov ecx, dword [0x100f97a4]
and edx, dword [0x100f97b0]
mov esi, dword [ecx + edx*8]
lea ecx, [ecx + edx*8]
mov edx, dword [0x100f979c]
add ecx, 4
mov eax, esi
mov dword [ebp - 0x10], ecx
nop
cmp esi, edx
jne 0x10026c08
mov ecx, edx
jmp 0x10026c0c
mov ecx, dword [ecx]
mov ecx, dword [ecx]
cmp eax, ecx
je 0x10026c20
cmp dword [eax + 8], ebx
je 0x10026c1c
mov eax, dword [eax]
mov ecx, dword [ebp - 0x10]
jmp 0x10026c00
mov ecx, eax
jmp 0x10026c24
mov eax, edx
mov ecx, edx
cmp ecx, edx
jne 0x10026c7f
mov esi, dword [edx]
lea eax, [ebp - 0x14]
push ecx
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x10]
push eax
mov ebx, dword [esi + 4]
push ecx
push ebx
push esi
call fcn.1002a4a0
mov edx, dword [0x100f97a0]
mov ecx, 0xffffffe
sub ecx, edx
cmp ecx, 1
jb 0x10026ca9
lea ecx, [edx + 1]
mov dword [0x100f97a0], ecx
mov ecx, 0x100f9798
mov dword [esi + 4], eax
mov dword [ebx], eax
mov eax, dword [0x100f979c]
mov eax, dword [eax]
push eax
add eax, 8
push eax
lea eax, [ebp - 0x20]
push eax
call fcn.1002a280
mov eax, dword [ebp - 0x20]
jmp 0x10026c86
mov dword [ebp - 0x20], eax
mov byte [ebp - 0x1c], 0
mov ecx, dword [ebp - 0x18]
mov dword [eax + 0xc], ecx
mov edi, dword [edi + 0x10]
test edi, edi
jne 0x10026b70
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push str.list_T__too_long
call dword [sym.imp.MSVCP140.dll_void___cdecl_std::_Xlength_error_char_const__]
int3
Function at 0x10027610
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
mov ecx, dword [0x100f4898]
sub esp, 0xc
mov eax, dword [ecx]
push ebx
push esi
push edi
mov eax, dword [eax + 0x14]
push 0x100e3290
push 0x100e328c
call eax
call fcn.100b0950
call fcn.10093880
call fcn.10026dd0
call fcn.10027150
cmp byte [0x100f2a68], 0
je 0x100277d4
mov ecx, dword [0x100f4898]
mov eax, dword [ecx]
mov eax, dword [eax + 0x68]
call eax
test al, al
je 0x100277d4
mov ecx, dword [0x100f491c]
xor ebx, ebx
mov dword [esp + 0x10], ecx
mov eax, dword [ecx + 0x28]
mov dword [esp + 0x14], eax
test eax, eax
je 0x100277d4
mov eax, dword [ecx + 0x1c]
mov ecx, dword [eax + ebx*4]
mov eax, dword [ecx]
mov eax, dword [eax + 0x30]
call eax
mov esi, eax
mov edi, 0x811c9dc5
xor ecx, ecx
nop word [eax + eax]
inc ecx
cmp byte [ecx + esi], 0
jne 0x100276a0
xor edx, edx
test ecx, ecx
je 0x100276c9
nop dword [eax]
movsx eax, byte [edx + esi]
inc edx
xor eax, edi
imul edi, eax, 0x1000193
cmp edx, ecx
jb 0x100276b0
cmp edi, 0x5ff56dc5
je 0x100276da
inc ebx
cmp ebx, dword [esp + 0x14]
jae 0x100277d4
mov ecx, dword [esp + 0x10]
jmp 0x10027684
mov eax, dword [esp + 0x10]
mov eax, dword [eax + 0x1c]
mov ebx, dword [eax + ebx*4]
test ebx, ebx
je 0x100277d4
mov esi, dword [ebx + 0x88]
test esi, esi
je 0x100277d4
movss xmm1, dword [0x100c46e8]
xor edx, edx
cmp esi, 4
jl 0x100277a1
mov eax, dword [ebx + 0x7c]
lea edi, [esi - 4]
shr edi, 2
inc edi
lea ecx, [eax + 0x838]
lea edx, [eax + 0x1078]
lea eax, [edi*4]
mov dword [esp + 0x14], eax
nop
movss xmm0, dword [ecx - 0x420]
ucomiss xmm0, xmm1
lahf
test ah, 0x44
jp 0x1002774b
mov dword [ecx - 0x420], 0x7f7fffff
movss xmm0, dword [ecx]
ucomiss xmm0, xmm1
lahf
test ah, 0x44
jp 0x1002775e
mov dword [ecx], 0x7f7fffff
movss xmm0, dword [edx - 0x420]
ucomiss xmm0, xmm1
lahf
test ah, 0x44
jp 0x10027779
mov dword [edx - 0x420], 0x7f7fffff
movss xmm0, dword [edx]
ucomiss xmm0, xmm1
lahf
test ah, 0x44
jp 0x1002778c
mov dword [edx], 0x7f7fffff
add ecx, 0x1080
add edx, 0x1080
sub edi, 1
jne 0x10027730
mov edx, dword [esp + 0x14]
cmp edx, esi
jge 0x100277d4
imul ecx, edx, 0x420
add ecx, 0x418
add ecx, dword [ebx + 0x7c]
sub esi, edx
movss xmm0, dword [ecx]
ucomiss xmm0, xmm1
lahf
test ah, 0x44
jp 0x100277c9
mov dword [ecx], 0x7f7fffff
add ecx, 0x420
sub esi, 1
jne 0x100277b6
call fcn.10095140
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10028fd0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100b95b0
mov eax, dword fs:[0]
push eax
sub esp, 0x30
mov eax, dword [0x100d0008]
xor eax, ebp
mov dword [ebp - 0x14], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 4], 0
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x18], 0xf
mov byte [ebp - 0x2c], 0
mov byte [ebp - 4], 1
cmp dword [ebp + 0x1c], 0
je 0x1002912b
cmp dword [ebp + 0x20], 0x10
lea ecx, [ebp + 0x24]
lea eax, [ebp + 0xc]
cmovae eax, dword [ebp + 0xc]
xor edx, edx
push ecx
push eax
xor ecx, ecx
call fcn.10026a90
mov ecx, dword [ebp - 0x1c]
mov esi, eax
add esp, 8
cmp esi, ecx
ja 0x10029059
cmp dword [ebp - 0x18], 0x10
lea ecx, [ebp - 0x2c]
mov dword [ebp - 0x1c], esi
cmovae ecx, dword [ebp - 0x2c]
mov byte [ecx + esi], 0
jmp 0x10029066
sub eax, ecx
lea ecx, [ebp - 0x2c]
push 0
push eax
call fcn.10029840
cmp dword [ebp + 0x20], 0x10
lea eax, [ebp + 0xc]
lea edx, [ebp + 0x24]
cmovae eax, dword [ebp + 0xc]
lea ecx, [ebp - 0x2c]
cmp dword [ebp - 0x18], 0x10
push edx
cmovae ecx, dword [ebp - 0x2c]
lea edx, [esi + 1]
push eax
call fcn.10026a90
add esp, 8
mov dword [ebp - 0x3c], 0xe0f3edc1
mov dword [ebp - 0x38], 0xf2fee8fb
xor eax, eax
mov dword [ebp - 0x34], 0xc7f1f9fb
mov word [ebp - 0x30], 0x9aba
nop dword [eax]
xor byte [ebp + eax - 0x3c], 0x9a
inc eax
cmp eax, 0xe
jb 0x100290b0
mov eax, dword [0x100f4894]
lea edx, [ebp - 0x3c]
push edx
push 0x100e31b4
push eax
mov ecx, dword [eax]
mov eax, dword [ecx + 0x64]
call eax
mov eax, dword [0x100f4894]
lea edx, [ebp - 0x2c]
add esp, 0xc
cmp dword [ebp - 0x18], 0x10
cmovae edx, dword [ebp - 0x2c]
mov ecx, dword [eax]
push edx
push 0x100d0034
push eax
mov eax, dword [ecx + 0x64]
call eax
mov edx, dword [ebp - 0x18]
add esp, 0xc
cmp edx, 0x10
jb 0x1002912b
mov ecx, dword [ebp - 0x2c]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x10029121
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x10029121
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push edx
push ecx
call fcn.100b7d6a
add esp, 8
mov edx, dword [ebp + 0x20]
mov byte [ebp - 0x2c], 0
mov dword [ebp - 0x18], 0xf
mov dword [ebp - 0x1c], 0
cmp edx, 0x10
jb 0x10029173
mov ecx, dword [ebp + 0xc]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x10029169
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x10029169
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push edx
push ecx
call fcn.100b7d6a
add esp, 8
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.100b78d7
mov esp, ebp
pop ebp
ret
Function at 0x1002a4d0
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
push ebx
push esi
push edi
movzx edx, byte [eax + 8]
mov edi, ecx
movzx ecx, byte [eax + 9]
xor edx, 0x811c9dc5
imul edx, edx, 0x1000193
mov ebx, dword [ebp + 8]
xor edx, ecx
movzx ecx, byte [eax + 0xa]
imul edx, edx, 0x1000193
xor edx, ecx
movzx ecx, byte [eax + 0xb]
imul edx, edx, 0x1000193
xor edx, ecx
imul ecx, edx, 0x1000193
mov edx, dword [edi + 0x18]
and edx, ecx
lea esi, [edx*8]
mov edx, dword [edi + 0xc]
add edx, esi
mov ecx, dword [edx]
cmp dword [edx + 4], eax
jne 0x1002a547
cmp ecx, eax
jne 0x1002a53f
mov ecx, dword [edi + 4]
mov dword [edx], ecx
mov edx, dword [edi + 0xc]
mov ecx, dword [edi + 4]
mov dword [esi + edx + 4], ecx
jmp 0x1002a54f
mov ecx, dword [eax + 4]
mov dword [edx + 4], ecx
jmp 0x1002a54f
cmp ecx, eax
jne 0x1002a54f
mov ecx, dword [eax]
mov dword [edx], ecx
mov ecx, dword [eax + 4]
mov esi, dword [eax]
push 0x10
push eax
mov dword [ecx], esi
mov edx, dword [eax]
mov ecx, dword [eax + 4]
mov dword [edx + 4], ecx
dec dword [edi + 8]
call fcn.100b7d6a
add esp, 8
mov dword [ebx], esi
mov eax, ebx
pop edi
pop esi
pop ebx
pop ebp
ret 8