joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10019c00
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff0
sub esp, 0x58
mov edx, dword [0x100e1348]
mov eax, edx
shr eax, 8
movzx ecx, al
movzx eax, dl
xor eax, 0x811c9dc5
mov dword [esp + 0xc], edx
imul eax, eax, 0x1000193
push esi
push edi
xor ecx, eax
mov eax, edx
shr eax, 0x10
imul ecx, ecx, 0x1000193
movzx eax, al
shr edx, 0x18
xor ecx, eax
imul eax, ecx, 0x1000193
mov ecx, 0x100e163c
xor eax, edx
imul eax, eax, 0x1000193
push eax
lea eax, [esp + 0x18]
push eax
lea eax, [esp + 0x60]
push eax
call fcn.10008b20
mov edx, dword [0x100e1640]
mov eax, dword [eax + 4]
test eax, eax
cmovne edx, eax
cmp edx, dword [0x100e1640]
jne 0x10019c86
xor al, al
vzeroupper
pop edi
pop esi
mov esp, ebp
pop ebp
ret 8
mov eax, dword [edx + 0xc]
mov dword [esp + 0x14], eax
mov edx, dword [eax + 0x2064]
mov ecx, dword [edx]
cmp ecx, edx
je 0x10019e22
vxorps xmm5, xmm5, xmm5
mov edi, dword [ecx + 0x20]
mov eax, dword [edi + 0x18]
mov esi, dword [eax + 0x244]
mov eax, dword [edi + 0x30]
and al, 3
cmp al, 1
jne 0x10019d7e
mov eax, dword [esp + 0x14]
vmovss xmm0, dword [eax + 0x14]
vucomiss xmm0, xmm5
lahf
test ah, 0x44
jp 0x10019d7e
mov eax, dword [edi + 0x2c]
vmovdqu xmm1, xmmword [esi + 0x10]
vmovdqu xmm2, xmmword [esi + 0x20]
vmovdqu xmm4, xmmword [esi + 0x40]
vmovdqu xmm3, xmmword [esi + 0x30]
lea eax, [eax + eax*2]
shl eax, 4
add eax, dword [0x100e1088]
vmovss dword [esp + 0x18], xmm1
vextractps dword [esp + 0x1c], xmm1, 1
vextractps dword [esp + 0x20], xmm1, 2
vmovss dword [esp + 0x24], xmm4
vmovss dword [esp + 0x28], xmm2
vextractps dword [esp + 0x2c], xmm2, 1
vextractps dword [esp + 0x30], xmm2, 2
vextractps dword [esp + 0x34], xmm4, 1
vmovdqu ymm1, ymmword [esp + 0x18]
vmovdqu ymmword [eax], ymm1
vmovss dword [esp + 0x38], xmm3
vextractps dword [esp + 0x3c], xmm3, 1
vextractps dword [esp + 0x40], xmm3, 2
vextractps dword [esp + 0x44], xmm4, 2
vmovdqu xmm0, xmmword [esp + 0x38]
vmovdqu xmmword [eax + 0x20], xmm0
mov eax, dword [edi + 0x2c]
lea eax, [eax + eax*2]
shl eax, 4
add eax, dword [0x100e1100]
vmovdqu ymmword [eax], ymm1
vmovdqu xmmword [eax + 0x20], xmm0
jmp 0x10019e18
mov eax, dword [edi + 0x2c]
lea eax, [eax + eax*2]
shl eax, 4
add eax, dword [0x100e1088]
vmovdqu ymm1, ymmword [eax]
vmovdqu xmm2, xmmword [eax + 0x20]
vmovaps xmm0, xmm1
vextractps dword [esi + 0x14], xmm0, 1
vextractps dword [esi + 0x18], xmm0, 2
vextractf128 xmm0, ymm1, 1
vmovss dword [esi + 0x20], xmm0
vextractf128 xmm0, ymm1, 1
vextractps dword [esi + 0x24], xmm0, 1
vextractf128 xmm0, ymm1, 1
vextractps dword [esi + 0x28], xmm0, 2
vmovaps xmm0, xmm1
vextractps dword [esi + 0x40], xmm0, 3
vextractf128 xmm0, ymm1, 1
vmovss dword [esi + 0x10], xmm1
vmovss dword [esi + 0x1c], xmm5
vmovss dword [esi + 0x2c], xmm5
vmovss dword [esi + 0x30], xmm2
vextractps dword [esi + 0x34], xmm2, 1
vextractps dword [esi + 0x38], xmm2, 2
vmovss dword [esi + 0x3c], xmm5
vextractps dword [esi + 0x44], xmm0, 3
vextractps dword [esi + 0x48], xmm2, 3
vmovss dword [esi + 0x4c], xmm5
mov ecx, dword [ecx]
cmp ecx, edx
jne 0x10019ca1
mov al, 1
vzeroupper
pop edi
pop esi
mov esp, ebp
pop ebp
ret 8
Function at 0x1001a340
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 0xc]
sub esp, 8
movzx eax, dl
xor eax, 0x811c9dc5
imul ecx, eax, 0x1000193
mov eax, edx
sar eax, 8
movzx eax, al
xor ecx, eax
mov eax, edx
imul ecx, ecx, 0x1000193
sar eax, 0x10
movzx eax, al
sar edx, 0x18
xor ecx, eax
movzx eax, dl
imul ecx, ecx, 0x1000193
xor ecx, eax
imul eax, ecx, 0x1000193
mov ecx, 0x100e163c
push eax
lea eax, [ebp + 0xc]
push eax
lea eax, [ebp - 8]
push eax
call fcn.10008b20
mov ecx, dword [0x100e1640]
mov eax, dword [eax + 4]
test eax, eax
cmovne ecx, eax
mov eax, dword [ebp + 8]
mov dword [eax], ecx
mov esp, ebp
pop ebp
ret 8

Function at 0x1001a3c0
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x18
push esi
push edi
push dword [ebp + 8]
lea eax, [esp + 0x10]
push eax
call fcn.1001a340
mov edi, dword [0x100e1640]
mov esi, dword [esp + 0xc]
cmp esi, edi
je 0x1001a487
mov edx, dword [ebp + 0xc]
movzx eax, dl
xor eax, 0x811c9dc5
mov dword [esp + 0xc], edx
imul ecx, eax, 0x1000193
mov eax, edx
shr eax, 8
movzx eax, al
xor ecx, eax
mov eax, edx
shr eax, 0x10
imul ecx, ecx, 0x1000193
movzx eax, al
shr edx, 0x18
xor ecx, eax
imul eax, ecx, 0x1000193
mov ecx, 0x100e163c
xor eax, edx
imul eax, eax, 0x1000193
push eax
lea eax, [esp + 0x10]
push eax
lea eax, [esp + 0x20]
push eax
call fcn.10008b20
mov eax, dword [eax + 4]
test eax, eax
cmove eax, edi
cmp eax, edi
jne 0x1001a487
mov edi, dword [esi + 0xc]
lea eax, [esp + 0x10]
push esi
push eax
mov ecx, 0x100e163c
call fcn.1001cec0
lea eax, [esp + 0xc]
mov ecx, 0x100e163c
push eax
lea eax, [esp + 0x14]
push eax
call fcn.1001cf60
mov eax, dword [eax]
mov dword [eax + 0xc], edi
mov eax, dword [esp + 0xc]
mov dword [edi], eax
mov al, 1
pop edi
pop esi
mov esp, ebp
pop ebp
ret 8
pop edi
xor al, al
pop esi
mov esp, ebp
pop ebp
ret 8
Function at 0x1001ce20
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov edx, dword [ebp + 0xc]
mov eax, ecx
push ebx
push esi
push edi
cmp dword [edx + 0x14], 0x10
mov edi, edx
mov dword [ebp - 4], eax
jb 0x1001ce3b
mov edi, dword [edx]
mov ebx, dword [edx + 0x10]
xor ecx, ecx
mov esi, 0x811c9dc5
test ebx, ebx
je 0x1001ce64
nop dword [eax]
movzx eax, byte [ecx + edi]
inc ecx
xor eax, esi
imul esi, eax, 0x1000193
cmp ecx, ebx
jb 0x1001ce50
mov eax, dword [ebp - 4]
push esi
push edx
lea ecx, [ebp - 0xc]
push ecx
mov ecx, eax
call fcn.1001f510
pop edi
pop esi
pop ebx
mov ecx, dword [eax + 4]
mov eax, dword [ebp + 8]
test ecx, ecx
jne 0x1001ce84
mov ecx, dword [ebp - 4]
mov ecx, dword [ecx + 4]
mov dword [eax], ecx
mov esp, ebp
pop ebp
ret 8

Function at 0x1001cec0
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
push esi
push edi
mov edi, ecx
movzx edx, byte [eax + 8]
movzx ecx, byte [eax + 0xb]
xor edx, 0x811c9dc5
imul esi, edx, 0x1000193
movzx edx, byte [eax + 9]
xor esi, edx
movzx edx, byte [eax + 0xa]
imul esi, esi, 0x1000193
xor esi, edx
imul edx, esi, 0x1000193
xor edx, ecx
imul ecx, edx, 0x1000193
mov edx, dword [edi + 0x18]
and edx, ecx
mov ecx, dword [edi + 0xc]
mov esi, dword [ecx + edx*8]
cmp dword [ecx + edx*8 + 4], eax
jne 0x1001cf28
cmp esi, eax
jne 0x1001cf1f
mov eax, dword [edi + 4]
mov dword [ecx + edx*8], eax
mov dword [ecx + edx*8 + 4], eax
jmp 0x1001cf31
mov eax, dword [eax + 4]
mov dword [ecx + edx*8 + 4], eax
jmp 0x1001cf31
cmp esi, eax
jne 0x1001cf34
mov eax, dword [eax]
mov dword [ecx + edx*8], eax
mov eax, dword [ebp + 0xc]
mov esi, dword [eax]
dec dword [edi + 8]
mov ecx, dword [eax + 4]
push 0x10
mov dword [ecx], esi
mov eax, dword [eax + 4]
mov dword [esi + 4], eax
push dword [ebp + 0xc]
call fcn.1008ccfa
mov eax, dword [ebp + 8]
add esp, 8
pop edi
mov dword [eax], esi
pop esi
pop ebp
ret 8
Function at 0x1001d1c0
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100af435
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push ebx
push esi
push edi
mov eax, dword [0x100db274]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov ebx, dword [ebp + 0xc]
movzx eax, byte [ebx]
xor eax, 0x811c9dc5
imul edx, eax, 0x1000193
movzx eax, byte [ebx + 1]
xor edx, eax
movzx eax, byte [ebx + 2]
imul edx, edx, 0x1000193
xor edx, eax
movzx eax, byte [ebx + 3]
imul ecx, edx, 0x1000193
xor ecx, eax
imul eax, ecx, 0x1000193
mov ecx, edi
push eax
mov dword [ebp + 0xc], eax
lea eax, [ebp - 0x18]
push ebx
push eax
call fcn.10008b20
mov ecx, dword [ebp - 0x14]
test ecx, ecx
je 0x1001d253
mov eax, dword [ebp + 8]
mov dword [eax], ecx
mov byte [eax + 4], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
cmp dword [edi + 8], 0xfffffff
je 0x1001d3a7
lea eax, [edi + 4]
mov dword [ebp - 0x20], eax
mov dword [ebp - 4], 0
push 0x10
mov dword [ebp - 0x1c], 0
call fcn.1008c9b0
mov ecx, dword [ebx]
mov esi, eax
add esp, 4
mov dword [ebp - 0x1c], esi
mov dword [esi + 8], ecx
mov dword [esi + 0xc], 0
mov dword [ebp - 4], 1
mov eax, dword [edi + 8]
mov ebx, dword [edi + 0x1c]
inc eax
vmovss xmm1, dword [edi]
vxorps xmm0, xmm0, xmm0
vcvtsi2sd xmm0, xmm0, eax
shr eax, 0x1f
vaddsd xmm0, xmm0, qword [eax*8 + 0x100d5080]
vcvtsd2ss xmm2, xmm0, xmm0
vxorps xmm0, xmm0, xmm0
mov eax, ebx
shr eax, 0x1f
vcvtsi2sd xmm0, xmm0, ebx
vaddsd xmm0, xmm0, qword [eax*8 + 0x100d5080]
vcvtsd2ss xmm0, xmm0, xmm0
vdivss xmm0, xmm2, xmm0
vcomiss xmm0, xmm1
jbe 0x1001d349
vdivss xmm0, xmm2, xmm1
vmovss dword [ebp - 0x14], xmm0
fld dword [ebp - 0x14]
fstp qword [ebp - 0x18]
vxorpd xmm0, xmm0, xmm0
vroundsd xmm0, xmm0, qword [ebp - 0x18], 2
vmovsd qword [ebp - 0x18], xmm0
fld qword [ebp - 0x18]
fstp dword [ebp - 0x14]
vmovss xmm0, dword [ebp - 0x14]
call fcn.1008d4d0
mov ecx, 8
cmp eax, ecx
cmova ecx, eax
cmp ebx, ecx
jae 0x1001d32b
cmp ebx, 0x200
jae 0x1001d329
shl ebx, 3
cmp ebx, ecx
jae 0x1001d32b
mov ebx, ecx
push ebx
mov ecx, edi
call fcn.1001e300
push dword [ebp + 0xc]
lea eax, [esi + 8]
mov ecx, edi
push eax
lea eax, [ebp - 0x18]
push eax
call fcn.10008b20
mov edx, dword [eax]
jmp 0x1001d34c
mov edx, dword [ebp - 0x18]
mov ebx, dword [edx + 4]
inc dword [edi + 8]
mov dword [esi], edx
mov dword [esi + 4], ebx
mov dword [ebx], esi
mov dword [edx + 4], esi
mov eax, dword [edi + 0x18]
and eax, dword [ebp + 0xc]
mov ecx, dword [edi + 0xc]
mov esi, dword [ebp - 0x20]
mov edi, dword [ecx + eax*8]
cmp edi, dword [esi]
mov esi, dword [ebp - 0x1c]
jne 0x1001d377
mov dword [ecx + eax*8], esi
jmp 0x1001d386
cmp edi, edx
jne 0x1001d380
mov dword [ecx + eax*8], esi
jmp 0x1001d38a
cmp dword [ecx + eax*8 + 4], ebx
jne 0x1001d38a
mov dword [ecx + eax*8 + 4], esi
mov eax, dword [ebp + 8]
mov dword [eax], esi
mov byte [eax + 4], 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
push str.unordered_map_set_too_long
call fcn.1008e970
int3
Function at 0x1001d3c0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100af965
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push ebx
push esi
push edi
mov eax, dword [0x100db274]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov edx, dword [ebp + 0xc]
mov edi, edx
cmp dword [edx + 0x14], 0x10
jb 0x1001d3f7
mov edi, dword [edx]
xor ecx, ecx
mov esi, 0x811c9dc5
cmp dword [edx + 0x10], ecx
jbe 0x1001d415
movzx eax, byte [ecx + edi]
inc ecx
xor eax, esi
imul esi, eax, 0x1000193
cmp ecx, dword [edx + 0x10]
jb 0x1001d403
push esi
push edx
lea eax, [ebp - 0x18]
mov ecx, ebx
push eax
call fcn.1001f510
mov ecx, dword [ebp - 0x14]
test ecx, ecx
je 0x1001d446
mov eax, dword [ebp + 8]
mov dword [eax], ecx
mov byte [eax + 4], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
cmp dword [ebx + 8], 0x71c71c7
je 0x1001d59f
lea eax, [ebx + 4]
mov dword [ebp - 0x20], eax
mov dword [ebp - 4], 0
push 0x24
mov dword [ebp - 0x1c], 0
call fcn.1008c9b0
add esp, 4
mov edi, eax
mov dword [ebp - 0x1c], edi
push dword [ebp + 0xc]
lea ecx, [edi + 8]
call fcn.1001c850
mov dword [edi + 0x20], 0
mov dword [ebp - 4], 1
mov eax, dword [ebx + 8]
vmovss xmm1, dword [ebx]
vxorps xmm0, xmm0, xmm0
inc eax
vcvtsi2sd xmm0, xmm0, eax
shr eax, 0x1f
vaddsd xmm0, xmm0, qword [eax*8 + 0x100d5080]
mov eax, dword [ebx + 0x1c]
vcvtsd2ss xmm2, xmm0, xmm0
vxorps xmm0, xmm0, xmm0
vcvtsi2sd xmm0, xmm0, dword [ebx + 0x1c]
shr eax, 0x1f
vaddsd xmm0, xmm0, qword [eax*8 + 0x100d5080]
vcvtsd2ss xmm0, xmm0, xmm0
vdivss xmm0, xmm2, xmm0
vcomiss xmm0, xmm1
jbe 0x1001d541
vdivss xmm0, xmm2, xmm1
vmovss dword [ebp + 0xc], xmm0
fld dword [ebp + 0xc]
fstp qword [ebp - 0x18]
vxorpd xmm0, xmm0, xmm0
vroundsd xmm0, xmm0, qword [ebp - 0x18], 2
vmovsd qword [ebp - 0x18], xmm0
fld qword [ebp - 0x18]
fstp dword [ebp + 0xc]
vmovss xmm0, dword [ebp + 0xc]
call fcn.1008d4d0
mov ecx, 8
cmp eax, ecx
cmova ecx, eax
mov eax, dword [ebx + 0x1c]
cmp eax, ecx
jae 0x1001d525
cmp eax, 0x200
jae 0x1001d523
shl eax, 3
cmp eax, ecx
jae 0x1001d525
mov eax, ecx
push eax
mov ecx, ebx
call fcn.1001e470
push esi
lea eax, [edi + 8]
mov ecx, ebx
push eax
lea eax, [ebp - 0x20]
push eax
call fcn.1001f510
mov edx, dword [eax]
jmp 0x1001d544
mov edx, dword [ebp - 0x18]
mov eax, dword [edx + 4]
inc dword [ebx + 8]
mov dword [edi + 4], eax
mov dword [edi], edx
mov dword [eax], edi
mov dword [edx + 4], edi
mov ecx, dword [ebx + 0xc]
mov dword [ebp + 0xc], eax
mov eax, dword [ebx + 0x18]
and eax, esi
mov esi, dword [ecx + eax*8]
cmp esi, dword [ebx + 4]
jne 0x1001d56c
mov dword [ecx + eax*8], edi
jmp 0x1001d57e
cmp esi, edx
jne 0x1001d575
mov dword [ecx + eax*8], edi
jmp 0x1001d582
mov edx, dword [ebp + 0xc]
cmp dword [ecx + eax*8 + 4], edx
jne 0x1001d582
mov dword [ecx + eax*8 + 4], edi
mov eax, dword [ebp + 8]
mov dword [eax], edi
mov byte [eax + 4], 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
push str.unordered_map_set_too_long
call fcn.1008e970
int3
Function at 0x1001e300
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov edx, dword [ebp + 8]
mov eax, 0x1fffffff
bsr eax, eax
push ebx
mov ebx, ecx
mov ecx, 1
shlx eax, ecx, eax
mov dword [ebp - 4], ebx
push esi
push edi
cmp edx, eax
ja 0x1001e45a
mov esi, dword [ebx + 4]
lea eax, [edx - 1]
or eax, ecx
mov dword [ebp + 8], esi
bsr eax, eax
push esi
inc eax
shlx edi, ecx, eax
lea ecx, [ebx + 0xc]
lea eax, [edi + edi]
push eax
call fcn.10008620
lea eax, [edi - 1]
mov dword [ebx + 0x1c], edi
mov dword [ebx + 0x18], eax
mov eax, dword [ebx + 4]
mov eax, dword [eax]
mov ecx, eax
cmp eax, esi
je 0x1001e42d
movzx edx, byte [eax + 8]
xor edx, 0x811c9dc5
mov ecx, dword [ecx]
imul edi, edx, 0x1000193
movzx edx, byte [eax + 9]
xor edi, edx
movzx edx, byte [eax + 0xa]
imul edi, edi, 0x1000193
xor edi, edx
movzx edx, byte [eax + 0xb]
imul edi, edi, 0x1000193
xor edi, edx
mov edx, dword [ebx + 0xc]
imul edi, edi, 0x1000193
and edi, dword [ebx + 0x18]
lea edx, [edx + edi*8]
mov edi, dword [edx]
mov dword [ebp - 8], edx
cmp edi, esi
jne 0x1001e3b3
mov dword [edx], eax
mov dword [edx + 4], eax
jmp 0x1001e423
mov edx, dword [edx + 4]
mov ebx, dword [eax + 8]
cmp ebx, dword [edx + 8]
jne 0x1001e3ed
mov edx, dword [edx]
mov dword [ebp - 0xc], edx
cmp edx, eax
je 0x1001e3e5
mov ebx, dword [eax + 4]
mov esi, dword [ebp - 0xc]
mov dword [ebx], ecx
mov edi, dword [ecx + 4]
mov dword [edi], edx
mov edx, dword [edx + 4]
mov dword [edx], eax
mov dword [esi + 4], edi
mov esi, dword [ebp + 8]
mov dword [ecx + 4], ebx
mov dword [eax + 4], edx
mov edx, dword [ebp - 8]
mov dword [edx + 4], eax
jmp 0x1001e420
cmp edi, edx
je 0x1001e3fd
mov edx, dword [edx + 4]
cmp ebx, dword [edx + 8]
je 0x1001e436
cmp edi, edx
jne 0x1001e3f1
mov ebx, dword [eax + 4]
mov dword [ebp - 0xc], ebx
mov dword [ebx], ecx
mov ebx, dword [ecx + 4]
mov dword [ebx], edx
mov edi, dword [edx + 4]
mov dword [edi], eax
mov dword [edx + 4], ebx
mov edx, dword [ebp - 0xc]
mov dword [ecx + 4], edx
mov edx, dword [ebp - 8]
mov dword [eax + 4], edi
mov dword [edx], eax
mov ebx, dword [ebp - 4]
mov eax, ecx
cmp ecx, esi
jne 0x1001e364
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
mov ebx, dword [eax + 4]
mov edx, dword [edx]
mov dword [ebp - 0xc], edx
mov esi, edx
mov dword [ebx], ecx
mov edi, dword [ecx + 4]
mov dword [edi], edx
mov edx, dword [edx + 4]
mov dword [edx], eax
mov dword [esi + 4], edi
mov esi, dword [ebp + 8]
mov dword [ecx + 4], ebx
mov dword [eax + 4], edx
jmp 0x1001e420
push str.invalid_hash_bucket_count
call fcn.1008e970
int3
Function at 0x10025f40
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff0
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100aff18
mov eax, dword fs:[0]
push eax
push ebx
sub esp, 0x38
push esi
push edi
mov eax, dword [0x100db274]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x1c], esi
vmovss xmm0, dword [0x100d4ee4]
vmovss dword [esi + 0x10], xmm0
vmovss dword [esi + 0x14], xmm0
vmovss dword [esi + 0x18], xmm0
vxorps xmm0, xmm0, xmm0
vmovss dword [esi + 0x1c], xmm0
mov dword [esi], 0x100b2558
mov dword [ebp - 4], 0
mov byte [esi + 0x30], 1
mov dword [esi + 0x2c], 0
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
mov eax, dword [ebx + 8]
mov dword [ebp - 0x40], eax
mov eax, dword [ebx + 0xc]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebx + 0x10]
mov dword [ebp - 0x38], eax
mov eax, dword [ebx + 0x14]
mov dword [ebp - 0x34], eax
mov eax, dword [ebx + 0x18]
mov dword [ebp - 0x30], eax
mov eax, dword [ebx + 0x1c]
mov dword [esi + 0x3c], 0
mov ecx, dword [esi + 0x24]
mov dword [ebp - 0x2c], eax
mov eax, dword [esi + 0x28]
mov byte [ebp - 4], 1
mov dword [ebp - 0x28], 2
mov dword [ebp - 0x24], 0
cmp ecx, eax
jne 0x1002609a
lea edi, [ecx + ecx]
test ecx, ecx
jne 0x1002601d
mov edi, 1
mov dword [ebp - 0x14], edi
cmp eax, edi
jge 0x1002609a
test edi, edi
je 0x1002603a
mov eax, edi
shl eax, 5
push 0x10
push eax
call fcn.10071340
add esp, 8
jmp 0x1002603c
xor eax, eax
mov ecx, dword [esi + 0x24]
mov dword [ebp - 0x18], eax
test ecx, ecx
jle 0x10026071
xor edi, edi
mov edx, eax
nop word [eax + eax]
test edx, edx
je 0x10026060
mov eax, dword [esi + 0x2c]
vmovdqu ymm0, ymmword [eax + edi]
vmovdqu ymmword [edx], ymm0
add edi, 0x20
add edx, 0x20
sub ecx, 1
jne 0x10026050
mov ecx, dword [esi + 0x24]
mov edi, dword [ebp - 0x14]
mov eax, dword [esi + 0x2c]
test eax, eax
je 0x1002608d
cmp byte [esi + 0x30], 0
je 0x1002608a
push eax
vzeroupper
call fcn.10071350
add esp, 4
mov ecx, dword [esi + 0x24]
mov eax, dword [ebp - 0x18]
mov byte [esi + 0x30], 1
mov dword [esi + 0x2c], eax
mov dword [esi + 0x28], edi
shl ecx, 5
add ecx, dword [esi + 0x2c]
je 0x100260ab
vmovdqu ymm0, ymmword [ebp - 0x40]
vmovdqu ymmword [ecx], ymm0
inc dword [esi + 0x24]
mov ecx, dword [esi + 0x24]
mov eax, dword [esi + 0x2c]
shl ecx, 5
mov dword [ecx + eax - 8], 2
mov eax, esi
vzeroupper
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret 0x18
Function at 0x1003b480
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0x14]
mov dword [ebp - 4], ecx
mov eax, dword [esi + 0xc]
shr eax, 0x1f
xor al, 1
mov dx, word [esi + 0xa]
mov dword [ebp + 8], eax
movzx eax, word [edi + 4]
cmp ax, word [esi + 4]
movzx eax, word [edi + 2]
sbb ecx, ecx
mov bx, word [esi + 6]
inc ecx
cmp ax, word [esi + 2]
sbb eax, eax
xor edi, edi
inc eax
and ecx, eax
mov eax, dword [ebp + 0x10]
cmp word [eax + 4], dx
mov edx, eax
cmovbe edi, ecx
movzx eax, word [edx + 2]
cmp word [esi + 8], ax
sbb eax, eax
xor ecx, ecx
inc eax
and edi, eax
cmp word [edx], bx
cmovbe ecx, edi
mov edi, dword [ebp + 0x14]
movzx eax, word [edi]
cmp ax, word [esi]
sbb eax, eax
inc eax
and ecx, eax
neg ecx
jns 0x1003b5a4
cmp byte [ebp + 8], 0
jne 0x1003b58d
mov ecx, dword [ebp - 4]
add esi, 0x10
push edi
push edx
push dword [ebp + 0xc]
push esi
call fcn.1003b480
mov eax, dword [esi + 0xc]
test eax, eax
js 0x1003b51b
add esi, 0x10
jmp 0x1003b520
shl eax, 4
sub esi, eax
mov eax, dword [esi + 0xc]
shr eax, 0x1f
xor al, 1
mov dx, word [esi + 0xa]
mov byte [ebp + 8], al
movzx eax, word [edi + 4]
cmp ax, word [esi + 4]
movzx eax, word [edi + 2]
sbb ecx, ecx
mov bx, word [esi + 6]
inc ecx
cmp ax, word [esi + 2]
sbb eax, eax
xor edi, edi
inc eax
and ecx, eax
mov eax, dword [ebp + 0x10]
cmp word [eax + 4], dx
mov edx, eax
cmovbe edi, ecx
movzx eax, word [edx + 2]
cmp word [esi + 8], ax
sbb eax, eax
xor ecx, ecx
inc eax
and edi, eax
cmp word [edx], bx
cmovbe ecx, edi
mov edi, dword [ebp + 0x14]
movzx eax, word [edi]
cmp ax, word [esi]
sbb eax, eax
inc eax
and ecx, eax
neg ecx
js 0x1003b4f4
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
mov edx, dword [esi + 0xc]
mov eax, edx
mov ecx, dword [ebp + 0xc]
and eax, 0x7ffffff
push eax
sar edx, 0x1b
push edx
mov esi, dword [ecx]
call dword [esi + 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
Function at 0x1003b5b0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0x14]
sub esp, 8
push esi
mov esi, eax
shl esi, 4
add esi, dword [ecx + 0x94]
cmp eax, dword [ebp + 0x18]
jge 0x1003b670
push ebx
push edi
mov eax, dword [esi + 0xc]
mov edi, dword [ebp + 0xc]
shr eax, 0x1f
xor al, 1
mov dx, word [esi + 4]
mov dword [ebp - 4], eax
movzx eax, word [edi + 2]
cmp word [esi + 8], ax
movzx eax, word [edi + 4]
sbb ecx, ecx
mov bx, word [esi + 6]
inc ecx
cmp word [esi + 0xa], ax
sbb eax, eax
xor edi, edi
inc eax
and ecx, eax
mov eax, dword [ebp + 0x10]
cmp word [eax + 4], dx
movzx eax, word [eax + 2]
cmovae edi, ecx
cmp ax, word [esi + 2]
sbb eax, eax
xor ecx, ecx
inc eax
and edi, eax
mov eax, dword [ebp + 0xc]
cmp word [eax], bx
mov eax, dword [ebp + 0x10]
cmovbe ecx, edi
movzx eax, word [eax]
cmp ax, word [esi]
sbb eax, eax
inc eax
and ecx, eax
neg ecx
and ecx, 0x80000000
cmp byte [ebp - 4], 0
je 0x1003b677
test ecx, ecx
je 0x1003b65b
mov ecx, dword [esi + 0xc]
mov eax, ecx
mov ebx, dword [ebp + 8]
and eax, 0x7ffffff
sar ecx, 0x1b
push eax
push ecx
mov edx, dword [ebx]
mov ecx, ebx
call dword [edx + 4]
mov eax, dword [ebp + 0x14]
add esi, 0x10
inc eax
mov dword [ebp + 0x14], eax
cmp eax, dword [ebp + 0x18]
jl 0x1003b5d0
pop edi
pop ebx
pop esi
mov esp, ebp
pop ebp
ret 0x14
test ecx, ecx
jne 0x1003b65b
mov ecx, dword [esi + 0xc]
neg ecx
mov eax, ecx
shl eax, 4
add esi, eax
mov eax, dword [ebp + 0x14]
add eax, ecx
jmp 0x1003b662
Function at 0x10047150
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
push edi
mov eax, dword [esi + 0x10]
test eax, eax
je 0x1004716a
cmp byte [esi + 0x14], 0
je 0x1004716a
push eax
call fcn.10071350
add esp, 4
mov byte [esi + 0x14], 1
mov dword [esi + 0x10], 0
mov dword [esi + 8], 0
mov dword [esi + 0xc], 0
mov eax, dword [esi + 0x24]
test eax, eax
je 0x10047199
cmp byte [esi + 0x28], 0
je 0x10047199
push eax
call fcn.10071350
add esp, 4
mov byte [esi + 0x28], 1
mov dword [esi + 0x24], 0
mov dword [esi + 0x1c], 0
mov dword [esi + 0x20], 0
mov eax, dword [esi + 0x38]
test eax, eax
je 0x100471c8
cmp byte [esi + 0x3c], 0
je 0x100471c8
push eax
call fcn.10071350
add esp, 4
mov byte [esi + 0x3c], 1
mov dword [esi + 0x38], 0
mov dword [esi + 0x30], 0
mov dword [esi + 0x34], 0
cmp dword [esi + 0xc], 2
jge 0x10047244
push ebx
push 0x10
push 0x18
call fcn.10071340
mov edx, dword [esi + 8]
add esp, 8
mov ebx, eax
test edx, edx
jle 0x1004721f
xor ecx, ecx
nop
mov eax, dword [esi + 0x10]
lea ecx, [ecx + 0xc]
vmovq xmm0, qword [eax + ecx - 0xc]
vmovq qword [ecx + ebx - 0xc], xmm0
mov eax, dword [eax + ecx - 4]
mov dword [ecx + ebx - 4], eax
sub edx, 1
jne 0x10047200
mov eax, dword [esi + 0x10]
test eax, eax
je 0x10047235
cmp byte [esi + 0x14], 0
je 0x10047235
push eax
call fcn.10071350
add esp, 4
mov dword [esi + 0x10], ebx
mov byte [esi + 0x14], 1
mov dword [esi + 0xc], 2
pop ebx
pop edi
mov ecx, esi
pop esi
jmp fcn.10046ce0