joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1000a8b0
Capabilities:
Allocate or change rwx memory
Create thread
Spawn thread to rwx shellcode

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
lea eax, [ebp + 8]
mov ebx, ecx
push esi
push eax
call fcn.1000b5e0
mov esi, eax
add esp, 4
mov dword [ebp - 4], esi
test esi, esi
je 0x1000aabe
push 0
push 0
push esi
call fcn.100085c0
push 0xffffffffffffffff
push esi
lea eax, [ebp + 0x1d0]
push eax
push str.inserting_hook:__s__p
push 0
call fcn.10006980
push 0xc350
call fcn.100d26fd
mov dword [ebx + 0xab8], eax
add esp, 0x24
mov eax, dword [0x10140d60]
test eax, eax
je 0x1000a91b
cmp eax, 0xffffffff
je 0x1000a91b
push 0xffffffffffffffff
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov eax, dword [ebp - 4]
lea esi, [ebp + 8]
push edi
mov ecx, 0x280
mov dword [ebx + 0xa00], eax
mov edi, ebx
mov dword [ebx + 0xa04], 0
rep movsd dword es:[edi], dword [esi]
mov eax, dword [0x10140d60]
pop edi
test eax, eax
je 0x1000a951
cmp eax, 0xffffffff
je 0x1000a951
push eax
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov eax, dword [ebp + 0x18c]
mov ecx, dword [ebp + 0x188]
mov dword [ebx + 0xa0c], eax
mov eax, ecx
and eax, 0x1000000
mov dword [ebx + 0xa08], ecx
or eax, 0
je 0x1000a9ad
push 0
push 0
push ebx
push 0x1000a260
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
push 0
push 0
push 0
push 0
mov dword [ebx + 0xa18], eax
call dword [sym.imp.KERNEL32.dll_CreateEventW]
mov dword [ebx + 0xa20], eax
pop esi
mov al, 1
pop ebx
mov esp, ebp
pop ebp
ret 0xa00
and ecx, 0x800000
or ecx, 0
je 0x1000a9de
mov ecx, ebx
call fcn.1000aad0
test al, al
jne 0x1000a9a3
cmp byte [0x10140ed4], al
je 0x1000aabe
mov ecx, ebx
call fcn.1000aad0
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xa00
push 0x10140e68
push 0x40
push 0xa
push dword [ebx + 0xa00]
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [ebp - 4]
push eax
lea esi, [ebx + 0xa29]
push esi
push dword [ebx + 0xa00]
call fcn.10084250
test eax, eax
je 0x1000aa43
nop dword [eax]
cmp eax, 3
jne 0x1000aaab
push 9
push dword [ebx + 0xa04]
push dword [ebx + 0xa00]
call fcn.100085c0
add esp, 0xc
lea eax, [ebp - 4]
push eax
push esi
push dword [ebx + 0xa00]
call fcn.10084250
test eax, eax
jne 0x1000aa10
mov eax, dword [0x101392f4]
mov ecx, dword [0x101392fc]
mov dword [eax + 0x101392d4], ebx
mov eax, dword [0x101392f8]
mov dword [eax + 0x101392d4], 0x1000ad50
mov eax, dword [ebp - 4]
mov dword [ecx + 0x101392d4], eax
movups xmm0, xmmword [0x101392d4]
push dword [ebx + 0xa00]
movups xmmword [esi], xmm0
movq xmm0, qword [0x101392e4]
movq qword [esi + 0x10], xmm0
mov eax, dword [0x101392ec]
mov dword [esi + 0x18], eax
mov al, byte [0x101392f0]
mov byte [esi + 0x1c], al
call fcn.10084470
test eax, eax
pop esi
sete al
pop ebx
mov esp, ebp
pop ebp
ret 0xa00
push 0xffffffffffffffff
push eax
call fcn.10084690
push eax
push 0
call fcn.10006980
add esp, 0xc
pop esi
xor al, al
pop ebx
mov esp, ebp
pop ebp
ret 0xa00
Function at 0x1000beb0
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
push esi
push edi
mov edi, ecx
movzx edx, byte [eax + 8]
movzx ecx, byte [eax + 0xa]
xor edx, 0x811c9dc5
imul esi, edx, 0x1000193
movzx edx, byte [eax + 9]
xor esi, edx
imul edx, esi, 0x1000193
xor edx, ecx
movzx ecx, byte [eax + 0xb]
imul edx, edx, 0x1000193
xor edx, ecx
imul ecx, edx, 0x1000193
mov edx, dword [edi + 0x18]
and edx, ecx
lea esi, [edx*8]
mov edx, dword [edi + 0xc]
add edx, esi
mov ecx, dword [edx]
cmp dword [edx + 4], eax
jne 0x1000bf23
cmp ecx, eax
jne 0x1000bf1b
mov ecx, dword [edi + 4]
mov dword [edx], ecx
mov edx, dword [edi + 0xc]
mov ecx, dword [edi + 4]
mov dword [esi + edx + 4], ecx
jmp 0x1000bf2b
mov ecx, dword [eax + 4]
mov dword [edx + 4], ecx
jmp 0x1000bf2b
cmp ecx, eax
jne 0x1000bf2b
mov ecx, dword [eax]
mov dword [edx], ecx
mov ecx, dword [eax + 4]
mov esi, dword [eax]
push 0x18
push eax
mov dword [ecx], esi
mov edx, dword [eax]
mov ecx, dword [eax + 4]
mov dword [edx + 4], ecx
dec dword [edi + 8]
call fcn.100d26ef
mov eax, dword [ebp + 8]
add esp, 8
pop edi
mov dword [eax], esi
pop esi
pop ebp
ret 8
Function at 0x1000d100
Capabilities:
Parse pe header
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100faaa8
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push ebx
push esi
push edi
mov eax, dword [0x1013a098]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, dword [ebp + 0xc]
test edi, edi
jne 0x1000d158
mov eax, dword [ebp + 8]
mov dword [eax], 0
mov dword [eax + 4], 0
mov dword [eax + 8], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, 0x5a4d
cmp word [edi], ax
jne 0x1000d12f
mov eax, dword [edi + 0x3c]
cmp dword [eax + edi], 0x4550
jne 0x1000d12f
mov ecx, dword [eax + edi + 0x78]
mov dword [ebp + 0xc], ecx
test ecx, ecx
je 0x1000d12f
xor eax, eax
xor edx, edx
xor ebx, ebx
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x18], edx
mov dword [ebp - 0x14], ebx
xor esi, esi
mov dword [ebp - 4], ebx
cmp dword [ecx + edi + 0x18], esi
jbe 0x1000d1e0
mov eax, ecx
mov eax, dword [eax + edi + 0x24]
lea ecx, [edi + esi*2]
movzx ecx, word [ecx + eax]
mov eax, dword [ebp + 0xc]
mov eax, dword [eax + edi + 0x1c]
lea eax, [eax + ecx*4]
mov eax, dword [eax + edi]
add eax, edi
mov dword [ebp - 0x10], eax
cmp ebx, edx
je 0x1000d1c0
mov dword [edx], eax
add edx, 4
mov dword [ebp - 0x18], edx
jmp 0x1000d1d3
lea eax, [ebp - 0x10]
push eax
push edx
lea ecx, [ebp - 0x1c]
call fcn.1000b990
mov ebx, dword [ebp - 0x14]
mov edx, dword [ebp - 0x18]
mov eax, dword [ebp + 0xc]
inc esi
cmp esi, dword [eax + edi + 0x18]
jb 0x1000d195
mov eax, dword [ebp - 0x1c]
mov esi, dword [ebp + 8]
lea ecx, [ebp - 0x1c]
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0
mov dword [esi], eax
mov dword [esi + 4], edx
mov dword [esi + 8], ebx
call fcn.10006490
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x1000ddc0
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
mov esi, ecx
mov ebx, dword [ebp + 8]
movzx eax, byte [edi]
xor eax, 0x811c9dc5
imul edx, eax, 0x1000193
movzx eax, byte [edi + 1]
xor edx, eax
movzx eax, byte [edi + 2]
imul ecx, edx, 0x1000193
mov edx, dword [esi + 0xc]
xor ecx, eax
movzx eax, byte [edi + 3]
imul ecx, ecx, 0x1000193
xor ecx, eax
imul eax, ecx, 0x1000193
mov ecx, dword [esi + 0x18]
mov esi, dword [esi + 4]
and ecx, eax
lea eax, [ecx*8]
mov ecx, dword [eax + edx]
add edx, 4
add eax, edx
mov edx, ecx
mov dword [ebp + 0xc], eax
nop
cmp edx, esi
jne 0x1000de28
mov eax, esi
jmp 0x1000de2c
mov eax, dword [eax]
mov eax, dword [eax]
cmp ecx, eax
je 0x1000de49
mov eax, dword [ecx + 8]
cmp eax, dword [edi]
je 0x1000de3e
mov ecx, dword [ecx]
mov eax, dword [ebp + 0xc]
jmp 0x1000de20
pop edi
pop esi
mov dword [ebx], ecx
mov eax, ebx
pop ebx
pop ebp
ret 8
pop edi
mov dword [ebx], esi
mov eax, ebx
pop esi
pop ebx
pop ebp
ret 8
Function at 0x10011c90
Capabilities:
Parse credit card information

Disassembly:
push esi
mov esi, ecx
xor cl, cl
mov eax, dword [esi + 0x4c]
cmp eax, 0xffffffff
je 0x10011ea5
push ebx
push edi
cmp eax, 0x7c
je 0x10011ea3
cmp eax, 0x29
jne 0x10011cd1
cmp dword [esi + 0x10], 0
jne 0x10011ea3
cmp eax, eax
jne 0x10011cd1
test dword [esi + 0x50], 0x10000000
je 0x10011eb2
jmp 0x10011e5c
cmp eax, 0x2e
jne 0x10011d2b
push 5
lea ecx, [esi + 0x24]
call fcn.10014980
mov eax, dword [esi]
mov edx, dword [esi + 8]
cmp eax, edx
je 0x10011d1f
cmp byte [eax], 0x5c
jne 0x10011d1c
lea ecx, [eax + 1]
cmp ecx, edx
je 0x10011d1c
mov edx, dword [esi + 0x50]
test dl, 8
jne 0x10011d09
mov bl, byte [ecx]
cmp bl, 0x28
je 0x10011d1a
cmp bl, 0x29
je 0x10011d1a
test dl, 0x10
jne 0x10011d1c
mov dl, byte [ecx]
cmp dl, 0x7b
je 0x10011d1a
cmp dl, 0x7d
jne 0x10011d1c
mov eax, ecx
inc eax
mov dword [esi], eax
mov ecx, esi
call fcn.10014d80
jmp 0x10011e8e
cmp eax, 0x5c
jne 0x10011d87
mov ecx, esi
call fcn.100149f0
test byte [esi + 0x50], 0x80
je 0x10011d7b
mov al, byte [esi + 0x48]
cmp al, 0x62
jne 0x10011d5a
push 4
lea ecx, [esi + 0x24]
call fcn.10014980
mov ecx, esi
call fcn.100149f0
jmp 0x10011e95
cmp al, 0x42
jne 0x10011d7b
push 4
lea ecx, [esi + 0x24]
call fcn.10014980
mov eax, dword [esi + 0x28]
mov ecx, esi
xor dword [eax + 8], 1
call fcn.100149f0
jmp 0x10011e95
mov ecx, esi
call fcn.10011ed0
jmp 0x10011e8e
cmp eax, 0x5b
jne 0x10011de8
mov ecx, esi
call fcn.100149f0
lea ecx, [esi + 0x24]
call fcn.10011290
mov eax, dword [esi + 0x4c]
cmp eax, 0x5e
jne 0x10011db4
mov eax, dword [esi + 0x28]
mov ecx, esi
xor dword [eax + 8], 1
call fcn.100149f0
mov eax, dword [esi + 0x4c]
test dword [esi + 0x50], 0x20000000
je 0x10011dd2
cmp eax, 0x5d
jne 0x10011dd2
push eax
lea ecx, [esi + 0x24]
call fcn.10011220
mov ecx, esi
call fcn.100149f0
mov ecx, esi
call fcn.10012bc0
cmp dword [esi + 0x4c], 0x5d
jne 0x10011ebb
jmp 0x10011e87
cmp eax, 0x28
jne 0x10011e18
mov ecx, esi
call fcn.100149f0
mov ecx, esi
call fcn.10014f80
cmp dword [esi + 0x4c], 0x29
mov bl, al
jne 0x10011eb2
mov ecx, esi
call fcn.100149f0
test bl, bl
je 0x10011e95
jmp 0x10011e8e
cmp eax, 0x5e
jne 0x10011e30
push 2
lea ecx, [esi + 0x24]
call fcn.10014980
mov ecx, esi
call fcn.100149f0
jmp 0x10011e95
cmp eax, 0x24
jne 0x10011e48
push 3
lea ecx, [esi + 0x24]
call fcn.10014980
mov ecx, esi
call fcn.100149f0
jmp 0x10011e95
cmp eax, 0x2a
je 0x10011ea9
cmp eax, 0x2b
je 0x10011ea9
cmp eax, 0x3f
je 0x10011ea9
cmp eax, 0x7b
je 0x10011ea9
cmp eax, 0x7d
jne 0x10011e6c
test dword [esi + 0x50], 0x10000000
je 0x10011ec4
jmp 0x10011e7a
cmp eax, 0x5d
jne 0x10011e7a
test dword [esi + 0x50], 0x10000000
je 0x10011ebb
movzx eax, byte [esi + 0x48]
lea ecx, [esi + 0x24]
push eax
call fcn.10011110
mov ecx, esi
call fcn.100149f0
mov ecx, esi
call fcn.10014a50
mov eax, dword [esi + 0x4c]
mov cl, 1
cmp eax, 0xffffffff
jne 0x10011ca3
pop edi
pop ebx
mov al, cl
pop esi
ret
push 0xa
mov ecx, esi
call fcn.10013ff0
push 5
mov ecx, esi
call fcn.10013ff0
push 4
mov ecx, esi
call fcn.10013ff0
push 6
mov ecx, esi
call fcn.10013ff0
int3
Function at 0x10015310
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 0xc]
mov edx, 0x811c9dc5
push edi
mov edi, dword [ebp + 8]
mov ecx, 0
sub esi, edi
je 0x10015341
nop dword [eax]
movzx eax, byte [ecx + edi]
inc ecx
xor eax, edx
imul edx, eax, 0x1000193
cmp ecx, esi
jb 0x10015330
pop edi
mov eax, edx
pop esi
pop ebp
ret 8
Function at 0x1001f3c0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100fb7d0
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push ebx
push esi
push edi
mov eax, dword [0x1013a098]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov ebx, ecx
mov dword [ebp - 0x1c], ebx
mov edi, dword [ebp + 0xc]
mov esi, edi
mov dword [ebp - 4], 0
cmp dword [edi + 0x14], 8
mov eax, dword [edi + 0x10]
jb 0x1001f407
mov esi, dword [edi]
xor ecx, ecx
mov edx, 0x811c9dc5
add eax, eax
je 0x1001f428
mov edi, eax
movzx eax, byte [ecx + esi]
inc ecx
xor eax, edx
imul edx, eax, 0x1000193
cmp ecx, edi
jb 0x1001f414
mov edi, dword [ebp + 0xc]
mov eax, dword [ebx + 0x18]
mov esi, dword [ebx + 4]
and eax, edx
lea ecx, [eax*8]
mov eax, dword [ebx + 0xc]
add eax, ecx
mov dword [ebp + 0xc], ecx
mov dword [ebp - 0x14], eax
cmp esi, dword [eax]
je 0x1001f488
mov esi, dword [eax + 4]
mov esi, dword [esi]
nop dword [eax + eax]
cmp esi, dword [eax]
je 0x1001f488
mov esi, dword [esi + 4]
lea eax, [esi + 8]
push eax
push edi
call fcn.1001eee0
add esp, 8
test al, al
mov eax, dword [ebp - 0x14]
je 0x1001f450
mov eax, dword [ebp + 8]
mov dword [eax], esi
mov byte [eax + 4], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov eax, dword [ebx + 4]
lea ecx, [ebx + 4]
push edi
mov dword [ebp - 4], 0xffffffff
mov eax, dword [eax]
mov dword [ebp - 0x14], eax
mov edx, dword [eax + 4]
push edx
push eax
mov dword [ebp - 0x18], edx
call fcn.1001f000
mov edx, eax
mov ecx, 0x7fffffe
mov eax, dword [ebx + 8]
sub ecx, eax
cmp ecx, 1
jb 0x1001f58c
inc eax
mov dword [ebx + 8], eax
mov eax, dword [ebp - 0x14]
mov dword [eax + 4], edx
mov eax, dword [ebp - 0x18]
mov dword [eax], edx
mov ecx, dword [ebx + 4]
mov edi, dword [ecx]
mov dword [ebp - 0x18], edi
mov eax, dword [edi]
cmp esi, eax
je 0x1001f4fe
mov ecx, dword [edi + 4]
mov dword [ecx], eax
mov ecx, dword [eax + 4]
mov dword [ecx], esi
mov ecx, dword [esi + 4]
mov dword [ecx], edi
mov ecx, dword [eax + 4]
mov edx, dword [esi + 4]
mov dword [esi + 4], ecx
mov ecx, dword [edi + 4]
mov dword [eax + 4], ecx
mov dword [edi + 4], edx
mov ecx, dword [ebx + 4]
mov edx, dword [ebp + 0xc]
add edx, dword [ebx + 0xc]
mov eax, dword [edx]
cmp eax, ecx
jne 0x1001f518
mov ecx, dword [ebp + 0xc]
mov dword [edx], edi
mov eax, dword [ebx + 0xc]
mov dword [ecx + eax + 4], edi
jmp 0x1001f53b
cmp eax, esi
jne 0x1001f520
mov dword [edx], edi
jmp 0x1001f53b
mov eax, dword [edx + 4]
mov eax, dword [eax]
mov dword [edx + 4], eax
cmp eax, edi
je 0x1001f53b
mov ecx, dword [ebp + 0xc]
add ecx, dword [ebx + 0xc]
mov eax, dword [ecx + 4]
mov eax, dword [eax + 4]
mov dword [ecx + 4], eax
mov ecx, ebx
mov dword [ebp - 4], 2
call fcn.100200d0
mov eax, dword [ebp + 8]
mov dword [eax], edi
mov byte [eax + 4], 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
push str.list_T__too_long
call fcn.100a5e47
int3
Function at 0x1001f5a0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100fb7f0
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push esi
push edi
mov eax, dword [0x1013a098]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov ebx, ecx
mov dword [ebp - 0x18], ebx
mov edi, dword [ebp + 0xc]
mov esi, edi
mov dword [ebp - 4], 0
cmp dword [edi + 0x14], 8
mov eax, dword [edi + 0x10]
jb 0x1001f5e7
mov esi, dword [edi]
xor ecx, ecx
mov edx, 0x811c9dc5
add eax, eax
je 0x1001f608
mov edi, eax
movzx eax, byte [ecx + esi]
inc ecx
xor eax, edx
imul edx, eax, 0x1000193
cmp ecx, edi
jb 0x1001f5f4
mov edi, dword [ebp + 0xc]
mov eax, dword [ebx + 0x18]
mov esi, dword [ebx + 4]
and eax, edx
lea edx, [eax*8]
mov eax, dword [ebx + 0xc]
add eax, edx
mov dword [ebp - 0x14], edx
mov dword [ebp + 0xc], eax
cmp esi, dword [eax]
je 0x1001f686
mov esi, dword [eax + 4]
mov esi, dword [esi]
nop dword [eax + eax]
cmp esi, dword [eax]
je 0x1001f686
mov esi, dword [esi + 4]
lea eax, [esi + 8]
push eax
push edi
call fcn.1001eee0
add esp, 8
test al, al
mov eax, dword [ebp + 0xc]
je 0x1001f630
mov edi, dword [ebp + 0x10]
lea ecx, [ebx + 4]
push edi
mov edx, dword [edi + 4]
mov eax, dword [edi]
mov dword [edx], eax
mov edx, dword [edi]
mov eax, dword [edi + 4]
mov dword [edx + 4], eax
dec dword [ecx + 4]
call fcn.10020390
mov eax, dword [ebp + 8]
mov dword [eax], esi
mov byte [eax + 4], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov edi, dword [ebp + 0x10]
mov dword [ebp + 0xc], edi
mov eax, dword [edi]
cmp esi, eax
je 0x1001f6b3
mov ecx, dword [edi + 4]
mov dword [ecx], eax
mov ecx, dword [eax + 4]
mov dword [ecx], esi
mov ecx, dword [esi + 4]
mov dword [ecx], edi
mov ecx, dword [eax + 4]
mov edx, dword [esi + 4]
mov dword [esi + 4], ecx
mov ecx, dword [edi + 4]
mov dword [eax + 4], ecx
mov dword [edi + 4], edx
mov ecx, dword [ebx + 0xc]
mov edx, dword [ebp - 0x14]
add ecx, edx
mov eax, dword [ecx]
cmp eax, dword [ebx + 4]
jne 0x1001f6cd
mov dword [ecx], edi
mov eax, dword [ebx + 0xc]
mov dword [eax + edx + 4], edi
jmp 0x1001f6ef
cmp eax, esi
jne 0x1001f6d5
mov dword [ecx], edi
jmp 0x1001f6ef
mov eax, dword [ecx + 4]
mov eax, dword [eax]
mov dword [ecx + 4], eax
cmp eax, edi
je 0x1001f6ef
mov ecx, dword [ebx + 0xc]
mov eax, dword [ecx + edx + 4]
mov eax, dword [eax + 4]
mov dword [ecx + edx + 4], eax
mov ecx, ebx
mov dword [ebp - 4], 2
call fcn.100200d0
mov eax, dword [ebp + 8]
mov dword [eax], edi
mov byte [eax + 4], 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x1001f750
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100fb810
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push ebx
push esi
push edi
mov eax, dword [0x1013a098]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov ebx, ecx
mov dword [ebp - 0x1c], ebx
mov edi, dword [ebp + 0xc]
mov esi, edi
mov dword [ebp - 4], 0
cmp dword [edi + 0x14], 8
mov eax, dword [edi + 0x10]
jb 0x1001f797
mov esi, dword [edi]
xor ecx, ecx
mov edx, 0x811c9dc5
add eax, eax
je 0x1001f7b8
mov edi, eax
movzx eax, byte [ecx + esi]
inc ecx
xor eax, edx
imul edx, eax, 0x1000193
cmp ecx, edi
jb 0x1001f7a4
mov edi, dword [ebp + 0xc]
mov eax, dword [ebx + 0x18]
mov esi, dword [ebx + 4]
and eax, edx
lea ecx, [eax*8]
mov eax, dword [ebx + 0xc]
add eax, ecx
mov dword [ebp + 0xc], ecx
mov dword [ebp - 0x14], eax
cmp esi, dword [eax]
je 0x1001f818
mov esi, dword [eax + 4]
mov esi, dword [esi]
nop dword [eax + eax]
cmp esi, dword [eax]
je 0x1001f818
mov esi, dword [esi + 4]
lea eax, [esi + 8]
push eax
push edi
call fcn.1001eee0
add esp, 8
test al, al
mov eax, dword [ebp - 0x14]
je 0x1001f7e0
mov eax, dword [ebp + 8]
mov dword [eax], esi
mov byte [eax + 4], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov eax, dword [ebx + 4]
lea ecx, [ebx + 4]
push edi
mov dword [ebp - 4], 0xffffffff
mov eax, dword [eax]
mov dword [ebp - 0x14], eax
mov edx, dword [eax + 4]
push edx
push eax
mov dword [ebp - 0x18], edx
call fcn.1001f080
mov edx, eax
mov ecx, 0x7fffffe
mov eax, dword [ebx + 8]
sub ecx, eax
cmp ecx, 1
jb 0x1001f91c
inc eax
mov dword [ebx + 8], eax
mov eax, dword [ebp - 0x14]
mov dword [eax + 4], edx
mov eax, dword [ebp - 0x18]
mov dword [eax], edx
mov ecx, dword [ebx + 4]
mov edi, dword [ecx]
mov dword [ebp - 0x18], edi
mov eax, dword [edi]
cmp esi, eax
je 0x1001f88e
mov ecx, dword [edi + 4]
mov dword [ecx], eax
mov ecx, dword [eax + 4]
mov dword [ecx], esi
mov ecx, dword [esi + 4]
mov dword [ecx], edi
mov ecx, dword [eax + 4]
mov edx, dword [esi + 4]
mov dword [esi + 4], ecx
mov ecx, dword [edi + 4]
mov dword [eax + 4], ecx
mov dword [edi + 4], edx
mov ecx, dword [ebx + 4]
mov edx, dword [ebp + 0xc]
add edx, dword [ebx + 0xc]
mov eax, dword [edx]
cmp eax, ecx
jne 0x1001f8a8
mov ecx, dword [ebp + 0xc]
mov dword [edx], edi
mov eax, dword [ebx + 0xc]
mov dword [eax + ecx + 4], edi
jmp 0x1001f8cb
cmp eax, esi
jne 0x1001f8b0
mov dword [edx], edi
jmp 0x1001f8cb
mov eax, dword [edx + 4]
mov eax, dword [eax]
mov dword [edx + 4], eax
cmp eax, edi
je 0x1001f8cb
mov ecx, dword [ebp + 0xc]
add ecx, dword [ebx + 0xc]
mov eax, dword [ecx + 4]
mov eax, dword [eax + 4]
mov dword [ecx + 4], eax
mov ecx, ebx
mov dword [ebp - 4], 2
call fcn.100200d0
mov eax, dword [ebp + 8]
mov dword [eax], edi
mov byte [eax + 4], 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
push str.list_T__too_long
call fcn.100a5e47
int3
Function at 0x10020d10
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
cmp dword [edi + 0x1c], 8
lea edx, [edi + 8]
mov ebx, dword [edx + 0x10]
mov dword [ebp - 4], ecx
jb 0x10020d2b
mov edx, dword [edx]
xor ecx, ecx
mov esi, 0x811c9dc5
add ebx, ebx
je 0x10020d47
movzx eax, byte [ecx + edx]
inc ecx
xor eax, esi
imul esi, eax, 0x1000193
cmp ecx, ebx
jb 0x10020d36
mov edx, dword [ebp - 4]
mov eax, dword [edx + 0x18]
mov ecx, dword [edx + 0xc]
and eax, esi
lea esi, [eax*8]
mov eax, dword [ecx + esi]
add ecx, esi
cmp dword [ecx + 4], edi
jne 0x10020d80
cmp eax, edi
jne 0x10020d78
mov eax, dword [edx + 4]
mov dword [ecx], eax
mov ecx, dword [edx + 0xc]
mov eax, dword [edx + 4]
mov dword [esi + ecx + 4], eax
jmp 0x10020d88
mov eax, dword [edi + 4]
mov dword [ecx + 4], eax
jmp 0x10020d88
cmp eax, edi
jne 0x10020d8b
mov eax, dword [edi]
mov dword [ecx], eax
mov edi, dword [ebp + 0xc]
mov eax, dword [edi + 4]
lea ecx, [edx + 4]
mov esi, dword [edi]
push edi
mov dword [eax], esi
mov edx, dword [edi]
mov eax, dword [edi + 4]
mov dword [edx + 4], eax
dec dword [ecx + 4]
call fcn.10020390
mov eax, dword [ebp + 8]
pop edi
mov dword [eax], esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x10020dc0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov ebx, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 4], ecx
mov esi, ebx
cmp dword [ebx + 0x14], 8
mov edi, dword [ebx + 0x10]
jb 0x10020dda
mov esi, dword [ebx]
xor ecx, ecx
mov edx, 0x811c9dc5
add edi, edi
je 0x10020df6
movzx eax, byte [ecx + esi]
inc ecx
xor eax, edx
imul edx, eax, 0x1000193
cmp ecx, edi
jb 0x10020de5
mov edi, dword [ebp - 4]
mov eax, dword [edi + 0x18]
mov ecx, dword [edi + 0xc]
and eax, edx
mov edi, dword [edi + 4]
mov edx, dword [ecx + eax*8]
lea eax, [eax*8 + 4]
add eax, ecx
mov dword [ebp + 0xc], edx
mov esi, edx
mov dword [ebp - 4], eax
cmp edx, edi
jne 0x10020e20
mov eax, edi
jmp 0x10020e24
mov eax, dword [eax]
mov eax, dword [eax]
cmp esi, eax
je 0x10020e55
lea eax, [esi + 8]
push ebx
push eax
call fcn.1001eee0
add esp, 8
test al, al
jne 0x10020e43
mov esi, dword [esi]
mov edx, dword [ebp + 0xc]
mov eax, dword [ebp - 4]
jmp 0x10020e18
lea eax, [esi + 8]
push eax
push ebx
call fcn.1001eee0
add esp, 8
test al, al
cmovne edi, esi
mov eax, dword [ebp + 8]
mov dword [eax], edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x10030b70
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xa00
push ebx
push esi
push edi
push str.Engine.dll
push 0x78
push 0x101390a8
call fcn.100ddaa5
mov esi, dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
add esp, 0xc
push 0x10140e68
push 0x40
push 2
push esi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov eax, 0xc340
push 0x174
mov word [esi], ax
lea eax, [ebp - 0x9f4]
push 0
push eax
call fcn.100d5410
push 0x85c
xorps xmm0, xmm0
lea eax, [ebp - 0x85c]
push 0
push eax
movups xmmword [ebp - 0x878], xmm0
movq qword [ebp - 0x868], xmm0
call fcn.100d5410
mov eax, dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
lea esi, [ebp - 0xa00]
add esp, 0x18
mov dword [ebp - 0xa00], eax
mov ecx, 0x280
mov dword [ebp - 0x9fc], 0
mov dword [ebp - 0x880], 0x22
mov dword [ebp - 0x87c], 0
push 0x1010972c
sub esp, 0xa00
mov dword [ebp - 0x9f8], 4
mov edi, esp
mov dword [ebp - 0x860], 0x1002a100
rep movsd dword es:[edi], dword [esi]
call fcn.10006be0
mov edx, dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
lea esi, [ebp - 0xa00]
add esp, 0xa04
mov dword [ebp - 0xa00], edx
mov ecx, 0x280
mov dword [ebp - 0x9fc], 0
mov dword [ebp - 0x880], 0x24
mov bl, al
mov dword [ebp - 0x87c], 0
push 0x10109740
sub esp, 0xa00
mov dword [ebp - 0x860], 0x1002a860
mov edi, esp
rep movsd dword es:[edi], dword [esi]
call fcn.10006be0
add esp, 0xa04
or al, bl
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x10030cf0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 0xc]
mov ecx, 0
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, 0x811c9dc5
sub edx, edi
sar edx, 1
add edx, edx
je 0x10030d21
nop dword [eax]
movzx eax, byte [ecx + edi]
inc ecx
xor eax, esi
imul esi, eax, 0x1000193
cmp ecx, edx
jb 0x10030d10
pop edi
mov eax, esi
pop esi
pop ebp
ret 8