joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10011140
Capabilities:
Encode data using xor

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x100d6ff1
push eax
mov dword fs:[0], esp
mov eax, dword fs:[0x2c]
mov edx, dword [0x10162de0]
push ebx
sub esp, 0x1c
mov edx, dword [eax + edx*4]
mov eax, dword [0x101631f8]
push esi
mov esi, ecx
cmp eax, dword [edx + 4]
jle 0x10011269
push 0x101631f8
call fcn.100d50bc
add esp, 4
cmp dword [0x101631f8], 0xffffffff
jne 0x10011269
mov dword [ebp - 4], 0
xor ecx, ecx
mov dword [ebp - 0x1c], 0x75494073
mov dword [ebp - 0x18], 0x6b494247
mov dword [ebp - 0x14], 0x1004a53
nop word [eax + eax]
lea eax, [ecx + 0x1e]
xor byte [ebp + ecx - 0x1c], al
inc ecx
cmp ecx, 0xa
jb 0x100111d0
mov dword [ebp - 0x2b], 0x637f4b5a
mov ecx, 8
mov dword [ebp - 0x27], 0x60415043
vpmovsxbd ymm1, qword [ebp - 0x2b]
vpxor ymm0, ymm1, ymmword [0x1014fce0]
vpshufb ymm0, ymm0, ymmword [0x1014fc40]
vpermq ymm0, ymm0, 0xd8
vpshufb ymm0, ymm0, ymmword [0x10150520]
vextracti128 xmm0, ymm0, 0
mov byte [ebp - 0x11], 0
mov dword [ebp - 0x23], 0x5d415348
mov word [ebp - 0x1f], 0x53
mov byte [ebp - 0x1d], 1
vmovq qword [ebp - 0x2b], xmm0
lea eax, [ecx + 0x1e]
xor byte [ebp + ecx - 0x2b], al
inc ecx
cmp ecx, 0xd
jb 0x10011236
lea eax, [ebp - 0x1c]
mov byte [ebp - 0x1d], 0
push eax
lea eax, [ebp - 0x2b]
push eax
vzeroupper
call fcn.1000f3e0
push 0x101631f8
mov dword [0x101631d8], eax
call fcn.100d506b
add esp, 4
mov eax, dword [0x101631d8]
mov ecx, dword [ebp - 0xc]
mov eax, dword [eax + esi]
mov dword fs:[0], ecx
pop esi
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret
Function at 0x10011290
Capabilities:
Encode data using xor

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x100d7011
push eax
mov dword fs:[0], esp
mov eax, dword fs:[0x2c]
mov edx, dword [0x10162de0]
push ebx
sub esp, 0x2c
mov edx, dword [eax + edx*4]
mov eax, dword [0x10163258]
push esi
mov esi, ecx
cmp eax, dword [edx + 4]
jle 0x10011407
push 0x10163258
call fcn.100d50bc
add esp, 4
cmp dword [0x10163258], 0xffffffff
jne 0x10011407
mov dword [ebp - 4], 0
mov ecx, 8
mov dword [ebp - 0x1a], 0x62494073
mov dword [ebp - 0x16], 0x5657424e
vpmovsxbd ymm0, qword [ebp - 0x1a]
vpxor ymm0, ymm0, ymmword [0x1014fce0]
vpshufb ymm0, ymm0, ymmword [0x1014fc40]
vpermq ymm0, ymm0, 0xd8
vpshufb ymm0, ymm0, ymmword [0x10150520]
vextracti128 xmm0, ymm0, 0
vmovq qword [ebp - 0x1a], xmm0
mov dword [ebp - 0x36], 0x4d704073
mov dword [ebp - 0x32], 0x57415a43
vpmovsxbd ymm0, qword [ebp - 0x36]
vpxor ymm0, ymm0, ymmword [0x1014fce0]
vpshufb ymm0, ymm0, ymmword [0x1014fc40]
vpermq ymm0, ymm0, 0xd8
vpshufb ymm0, ymm0, ymmword [0x10150520]
vextracti128 xmm0, ymm0, 0
mov word [ebp - 0x12], 0
mov dword [ebp - 0x2e], 0x5a494b65
mov word [ebp - 0x2a], 0x59
mov byte [ebp - 0x28], 1
vmovq qword [ebp - 0x36], xmm0
nop dword [eax]
lea eax, [ecx + 0x1e]
xor byte [ebp + ecx - 0x36], al
inc ecx
cmp ecx, 0xd
jb 0x100113a0
mov byte [ebp - 0x28], 0
xor eax, eax
mov dword [ebp - 0x27], 0x757f4b5a
mov dword [ebp - 0x23], 0x44487364
mov dword [ebp - 0x1f], 0x5a425f
mov byte [ebp - 0x1b], 1
nop dword [eax]
lea ecx, [eax + 0x1e]
xor byte [ebp + eax - 0x27], cl
inc eax
cmp eax, 0xb
jb 0x100113d0
lea eax, [ebp - 0x1a]
mov byte [ebp - 0x1b], 0
push eax
lea eax, [ebp - 0x36]
push eax
lea eax, [ebp - 0x27]
push eax
vzeroupper
call fcn.1000f4d0
push 0x10163258
mov dword [0x10163274], eax
call fcn.100d506b
add esp, 4
mov eax, dword [0x10163274]
mov ecx, dword [ebp - 0xc]
mov eax, dword [eax + esi]
mov dword fs:[0], ecx
pop esi
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret
Function at 0x10011430
Capabilities:
Encode data using xor

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x100d7031
push eax
mov dword fs:[0], esp
mov eax, dword fs:[0x2c]
mov edx, dword [0x10162de0]
push ebx
sub esp, 0x2c
mov edx, dword [eax + edx*4]
mov eax, dword [0x10163280]
push esi
mov esi, ecx
cmp eax, dword [edx + 4]
jle 0x10011554
push 0x10163280
call fcn.100d50bc
add esp, 4
cmp dword [0x10163280], 0xffffffff
jne 0x10011554
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x39]
vmovdqa xmm0, xmmword [str.s_NqNB__TdGGNnT]
vmovdqu xmmword [ebp - 0x39], xmm0
mov word [ebp - 0x29], 0x100
call fcn.1000bb70
mov dword [ebp - 0x1a], 0x49734073
mov edx, eax
mov dword [ebp - 0x16], 0x41415143
xor eax, eax
vpmovsxbd ymm1, qword [ebp - 0x1a]
vpxor ymm0, ymm1, ymmword [0x1014fce0]
vpshufb ymm0, ymm0, ymmword [0x1014fc40]
vpermq ymm0, ymm0, 0xd8
vpshufb ymm0, ymm0, ymmword [0x10150520]
vextracti128 xmm0, ymm0, 0
mov word [ebp - 0x12], 0
vmovq qword [ebp - 0x1a], xmm0
mov dword [ebp - 0x27], 0x757f4b5a
mov dword [ebp - 0x23], 0x44487364
mov dword [ebp - 0x1f], 0x5a425f
mov byte [ebp - 0x1b], 1
lea ecx, [eax + 0x1e]
xor byte [ebp + eax - 0x27], cl
inc eax
cmp eax, 0xb
jb 0x10011520
push edx
lea eax, [ebp - 0x1a]
mov byte [ebp - 0x1b], 0
push eax
lea eax, [ebp - 0x27]
push eax
vzeroupper
call fcn.1000f4d0
push 0x10163280
mov dword [0x101631e4], eax
call fcn.100d506b
add esp, 4
mov eax, dword [0x101631e4]
mov ecx, dword [ebp - 0xc]
mov eax, dword [eax + esi]
mov dword fs:[0], ecx
pop esi
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret
Function at 0x10011570
Capabilities:
Encode data using xor

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x100d7051
push eax
mov dword fs:[0], esp
mov eax, dword fs:[0x2c]
mov edx, dword [0x10162de0]
push ebx
sub esp, 0x2c
mov edx, dword [eax + edx*4]
mov eax, dword [0x101631c0]
push esi
mov esi, ecx
cmp eax, dword [edx + 4]
jle 0x10011694
push 0x101631c0
call fcn.100d50bc
add esp, 4
cmp dword [0x101631c0], 0xffffffff
jne 0x10011694
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x39]
vmovdqa xmm0, xmmword [0x1014ee60]
vmovdqu xmmword [ebp - 0x39], xmm0
mov word [ebp - 0x29], 0x100
call fcn.1000bb70
mov dword [ebp - 0x1a], 0x49734073
mov edx, eax
mov dword [ebp - 0x16], 0x41415143
xor eax, eax
vpmovsxbd ymm1, qword [ebp - 0x1a]
vpxor ymm0, ymm1, ymmword [0x1014fce0]
vpshufb ymm0, ymm0, ymmword [0x1014fc40]
vpermq ymm0, ymm0, 0xd8
vpshufb ymm0, ymm0, ymmword [0x10150520]
vextracti128 xmm0, ymm0, 0
mov word [ebp - 0x12], 0
vmovq qword [ebp - 0x1a], xmm0
mov dword [ebp - 0x27], 0x757f4b5a
mov dword [ebp - 0x23], 0x44487364
mov dword [ebp - 0x1f], 0x5a425f
mov byte [ebp - 0x1b], 1
lea ecx, [eax + 0x1e]
xor byte [ebp + eax - 0x27], cl
inc eax
cmp eax, 0xb
jb 0x10011660
push edx
lea eax, [ebp - 0x1a]
mov byte [ebp - 0x1b], 0
push eax
lea eax, [ebp - 0x27]
push eax
vzeroupper
call fcn.1000f4d0
push 0x101631c0
mov dword [0x101631fc], eax
call fcn.100d506b
add esp, 4
mov eax, dword [0x101631fc]
mov ecx, dword [ebp - 0xc]
mov eax, dword [eax + esi]
mov dword fs:[0], ecx
pop esi
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret

Function at 0x10011780
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x100d7071
push eax
mov dword fs:[0], esp
sub esp, 0x18
mov eax, dword fs:[0x2c]
mov edx, dword [0x10162de0]
push esi
mov esi, ecx
mov edx, dword [eax + edx*4]
mov eax, dword [0x10163278]
cmp eax, dword [edx + 4]
jle 0x1001184f
push 0x10163278
call fcn.100d50bc
add esp, 4
cmp dword [0x10163278], 0xffffffff
jne 0x1001184f
mov dword [ebp - 4], 0
xor ecx, ecx
mov dword [ebp - 0x17], 0x44564073
mov dword [ebp - 0x13], 0x4b4d6e41
mov word [ebp - 0xf], 0x55
mov byte [ebp - 0xd], 1
lea eax, [ecx + 0x1e]
xor byte [ebp + ecx - 0x17], al
inc ecx
cmp ecx, 9
jb 0x100117f5
mov byte [ebp - 0xd], 0
xor ecx, ecx
mov dword [ebp - 0x24], 0x52415d5d
mov dword [ebp - 0x20], 0x514a6647
mov dword [ebp - 0x1c], 0x51534f
mov byte [ebp - 0x18], 1
lea eax, [ecx + 0x1e]
xor byte [ebp + ecx - 0x24], al
inc ecx
cmp ecx, 0xb
jb 0x10011821
lea edx, [ebp - 0x17]
mov byte [ebp - 0x18], 0
lea ecx, [ebp - 0x24]
call fcn.1000bfd0
push 0x10163278
mov dword [0x10163210], eax
call fcn.100d506b
add esp, 4
mov eax, dword [0x10163210]
mov ecx, dword [ebp - 0xc]
add eax, esi
mov dword fs:[0], ecx
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x10011870
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x100d7091
push eax
mov dword fs:[0], esp
sub esp, 0x18
mov eax, dword fs:[0x2c]
mov edx, dword [0x10162de0]
push esi
mov esi, ecx
mov edx, dword [eax + edx*4]
mov eax, dword [0x10163200]
cmp eax, dword [edx + 4]
jle 0x1001193f
push 0x10163200
call fcn.100d50bc
add esp, 4
cmp dword [0x10163200], 0xffffffff
jne 0x1001193f
mov dword [ebp - 4], 0
xor ecx, ecx
mov dword [ebp - 0x17], 0x44564073
mov dword [ebp - 0x13], 0x5d456e41
mov word [ebp - 0xf], 0x55
mov byte [ebp - 0xd], 1
lea eax, [ecx + 0x1e]
xor byte [ebp + ecx - 0x17], al
inc ecx
cmp ecx, 9
jb 0x100118e5
mov byte [ebp - 0xd], 0
xor ecx, ecx
mov dword [ebp - 0x24], 0x52415d5d
mov dword [ebp - 0x20], 0x514a6647
mov dword [ebp - 0x1c], 0x51534f
mov byte [ebp - 0x18], 1
lea eax, [ecx + 0x1e]
xor byte [ebp + ecx - 0x24], al
inc ecx
cmp ecx, 0xb
jb 0x10011911
lea edx, [ebp - 0x17]
mov byte [ebp - 0x18], 0
lea ecx, [ebp - 0x24]
call fcn.1000bfd0
push 0x10163200
mov dword [0x101631e8], eax
call fcn.100d506b
add esp, 4
mov eax, dword [0x101631e8]
mov ecx, dword [ebp - 0xc]
add eax, esi
mov dword fs:[0], ecx
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x10011b43
Capabilities:
Encode data using xor

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x100d70b1
push eax
mov dword fs:[0], esp
mov eax, dword fs:[0x2c]
mov edx, dword [0x10162de0]
push ebx
sub esp, 0x34
mov edx, dword [eax + edx*4]
mov eax, dword [0x10163214]
push esi
mov esi, ecx
cmp eax, dword [edx + 4]
jle 0x10011c56
push 0x10163214
call fcn.100d50bc
add esp, 4
cmp dword [0x10163214], 0xffffffff
jne 0x10011c56
mov dword [ebp - 4], 0
mov eax, 8
mov dword [ebp - 0x1a], 0x62494073
mov dword [ebp - 0x16], 0x14544a4e
vpmovsxbd ymm0, qword [ebp - 0x1a]
vpxor ymm0, ymm0, ymmword [0x1014fce0]
vpshufb ymm0, ymm0, ymmword [0x1014fc40]
vpermq ymm0, ymm0, 0xd8
vpshufb ymm0, ymm0, ymmword [0x10150520]
vextracti128 xmm0, ymm0, 0
vmovq qword [ebp - 0x1a], xmm0
vmovdqa xmm0, xmmword [str.RpC_NtADVHFmK_M]
vmovdqu xmmword [ebp - 0x2b], xmm0
vmovq xmm0, xmm0
vpmovsxbd ymm0, xmm0
vpxor ymm0, ymm0, ymmword [0x1014fce0]
vpshufb ymm0, ymm0, ymmword [0x1014fc40]
vpermq ymm0, ymm0, 0xd8
vpshufb ymm0, ymm0, ymmword [0x10150520]
vextracti128 xmm0, ymm0, 0
mov word [ebp - 0x12], 0
mov byte [ebp - 0x1b], 1
vmovq qword [ebp - 0x2b], xmm0
lea ecx, [eax + 0x1e]
xor byte [ebp + eax - 0x2b], cl
inc eax
cmp eax, 0xf
jb 0x10011c02
vmovdqa xmm0, xmmword [0x1014f670]
mov byte [ebp - 0x1b], 0
lea ecx, [ebp - 0x40]
vmovdqu xmmword [ebp - 0x40], xmm0
mov dword [ebp - 0x30], 0x5e405e
mov byte [ebp - 0x2c], 1
vzeroupper
call fcn.1000bd20
lea ecx, [ebp - 0x1a]
push ecx
lea ecx, [ebp - 0x2b]
push ecx
push eax
call fcn.1000f4d0
push 0x10163214
mov dword [0x10163244], eax
call fcn.100d506b
add esp, 4
mov eax, dword [0x10163244]
mov ecx, dword [ebp - 0xc]
mov eax, dword [eax + esi]
mov dword fs:[0], ecx
pop esi
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret
Function at 0x10011c70
Capabilities:
Encode data using xor

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x100d70d1
push eax
mov dword fs:[0], esp
mov eax, dword fs:[0x2c]
mov edx, dword [0x10162de0]
push ebx
sub esp, 0x48
mov edx, dword [eax + edx*4]
mov eax, dword [0x101631ec]
push esi
push edi
mov esi, ecx
cmp eax, dword [edx + 4]
jle 0x10011dd9
push 0x101631ec
call fcn.100d50bc
add esp, 4
cmp dword [0x101631ec], 0xffffffff
jne 0x10011dd9
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x53]
vmovdqa xmm0, xmmword [0x1014ef40]
vmovdqu xmmword [ebp - 0x53], xmm0
mov dword [ebp - 0x43], 0x2b200422
mov dword [ebp - 0x3f], 0x1002935
call fcn.10010cb0
mov edi, eax
mov dword [ebp - 0x18], 0x4b776251
mov dword [ebp - 0x14], 0x1002c25
xor ecx, ecx
nop dword [eax]
lea eax, [ecx + 0x3c]
xor byte [ebp + ecx - 0x18], al
inc ecx
cmp ecx, 6
jb 0x10011d20
vmovdqa xmm0, xmmword [0x1014f0a0]
lea ecx, [ebp - 0x3b]
mov byte [ebp - 0x11], 0
vmovdqu xmmword [ebp - 0x3b], xmm0
mov dword [ebp - 0x2b], 0x1003f29
call fcn.10010b50
mov dword [ebp - 0x27], 0x647f4b5a
mov edx, eax
mov dword [ebp - 0x23], 0x604a4c41
mov ecx, 8
vpmovsxbd ymm1, qword [ebp - 0x27]
vpxor ymm0, ymm1, ymmword [0x1014fce0]
vpshufb ymm0, ymm0, ymmword [0x1014fc40]
vpermq ymm0, ymm0, 0xd8
vpshufb ymm0, ymm0, ymmword [0x10150520]
vextracti128 xmm0, ymm0, 0
mov dword [ebp - 0x1f], 0x5d415348
mov word [ebp - 0x1b], 0x53
mov byte [ebp - 0x19], 1
vmovq qword [ebp - 0x27], xmm0
lea eax, [ecx + 0x1e]
xor byte [ebp + ecx - 0x27], al
inc ecx
cmp ecx, 0xd
jb 0x10011da4
push edi
lea eax, [ebp - 0x18]
mov byte [ebp - 0x19], 0
push eax
push edx
lea eax, [ebp - 0x27]
push eax
vzeroupper
call fcn.10016ef0
push 0x101631ec
mov dword [0x1016325c], eax
call fcn.100d506b
add esp, 4
mov eax, dword [0x1016325c]
mov ecx, dword [ebp - 0xc]
pop edi
mov eax, dword [eax + esi]
mov dword fs:[0], ecx
pop esi
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret
Function at 0x100120e0
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100d7131
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xd8
mov eax, dword fs:[0x2c]
push ebx
push esi
mov esi, dword [0x10162de0]
mov ebx, ecx
push edi
mov edi, edx
vmovss dword [ebp - 0x10], xmm0
mov esi, dword [eax + esi*4]
mov eax, dword [0x101631f4]
cmp eax, dword [esi + 4]
jle 0x10012363
push 0x101631f4
call fcn.100d50bc
add esp, 4
cmp dword [0x101631f4], 0xffffffff
jne 0x1001235e
mov dword [ebp - 4], 0
lea ecx, [ebp - 0xe2]
mov dword [ebp - 0xe2], 0x2080209
mov dword [ebp - 0xde], 0x207021e
mov dword [ebp - 0xda], 0x2610202
mov dword [ebp - 0xd6], 0x2000207
mov dword [ebp - 0xd2], 0x27d0264
mov dword [ebp - 0xce], 0x2670275
mov dword [ebp - 0xca], 0x20a020d
mov dword [ebp - 0xc6], 0x27b026a
mov dword [ebp - 0xc2], 0x26d020f
mov dword [ebp - 0xbe], 0x20d0276
mov dword [ebp - 0xba], 0x2610270
mov dword [ebp - 0xb6], 0x2730216
mov dword [ebp - 0xb2], 0x275026b
mov dword [ebp - 0xae], 0x2770269
mov dword [ebp - 0xaa], 0x2790267
mov dword [ebp - 0xa6], 0x27b0265
mov dword [ebp - 0xa2], 0x26e0269
mov dword [ebp - 0x9e], 0x26a027e
mov dword [ebp - 0x9a], 0x2410256
mov dword [ebp - 0x96], 0x2540257
mov dword [ebp - 0x92], 0x2560244
mov dword [ebp - 0x8e], 0x2470255
mov dword [ebp - 0x8a], 0x25f022e
mov dword [ebp - 0x86], 0x258024a
mov dword [ebp - 0x82], 0x24d025f
mov dword [ebp - 0x7e], 0x2290228
mov dword [ebp - 0x7a], 0x2490250
mov dword [ebp - 0x76], 0x253024b
mov dword [ebp - 0x72], 0x2400243
mov dword [ebp - 0x6e], 0x2310256
mov dword [ebp - 0x6a], 0x259024c
mov dword [ebp - 0x66], 0x2420242
mov dword [ebp - 0x62], 0x24a025c
mov dword [ebp - 0x5e], 0x25f023a
mov dword [ebp - 0x5a], 0x2b902c6
mov dword [ebp - 0x56], 0x2bb02a2
mov dword [ebp - 0x52], 0x2a502c6
mov dword [ebp - 0x4e], 0x2b602b2
mov dword [ebp - 0x4a], 0x2b902a8
mov dword [ebp - 0x46], 0x2ab02b2
mov dword [ebp - 0x42], 0x2b802b4
mov dword [ebp - 0x3e], 0x2cc02ae
mov dword [ebp - 0x3a], 0x2b102a0
mov dword [ebp - 0x36], 0x2a702a5
mov dword [ebp - 0x32], 0x2a602b4
mov dword [ebp - 0x2e], 0x2ae
mov byte [ebp - 0x2a], 1
call fcn.10016a30
xor eax, eax
mov dword [ebp - 0x28], 0xd730d7d
mov dword [ebp - 0x24], 0xd440d49
xor ecx, ecx
mov dword [ebp - 0x20], 0xd570d4c
mov dword [ebp - 0x1c], 0xd410d0a
mov dword [ebp - 0x18], 0xd4b0d4a
mov word [ebp - 0x14], ax
mov byte [ebp - 0x12], 1
nop word [eax + eax]
lea eax, [ecx + 0xd1e]
xor word [ebp + ecx*2 - 0x28], ax
inc ecx
cmp ecx, 0xa
jb 0x10012320
lea eax, [ebp - 0xe2]
mov byte [ebp - 0x12], 0
push eax
lea eax, [ebp - 0x28]
push eax
call fcn.100d4490
push 0x101631f4
mov dword [0x1016323c], eax
mov dword [ebp - 4], 0xffffffff
call fcn.100d506b
add esp, 4
vmovss xmm0, dword [ebp - 0x10]
mov eax, dword [0x1016323c]
push 1
push 0
push edi
push ebx
push ecx
mov dword [ebp - 0x10], eax
vmovss dword [esp], xmm0
call dword [ebp - 0x10]
mov ecx, dword [ebp - 0xc]
add esp, 0x14
fstp dword [ebp - 0x10]
vmovss xmm0, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10016a30
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
cmp byte [ecx + 0xb8], 0
mov dword [ebp - 0xc], ecx
je 0x10016bac
vmovdqu ymm4, ymmword [0x1014fc60]
vmovdqu ymm5, ymmword [0x1014fd80]
vmovdqu ymm3, ymmword [0x10150540]
push ebx
push esi
mov ebx, 0x25b
lea edx, [ecx + 0x20]
push edi
xor eax, eax
mov dword [ebp - 8], ebx
mov dword [ebp - 4], edx
vpmovzxwd ymm1, xmmword [edx - 0x20]
vmovd xmm0, eax
vpbroadcastd ymm0, xmm0
vpaddd ymm0, ymm0, ymm5
vpxor ymm0, ymm0, ymm1
vpshufb ymm0, ymm0, ymm3
vpermq ymm0, ymm0, 0xd8
vextracti128 xmm0, ymm0, 0
vmovdqu xmmword [edx - 0x20], xmm0
vpmovzxwd ymm1, xmmword [edx - 0x10]
lea ecx, [ebx - 0x17]
add eax, 0x20
vmovd xmm0, ecx
vpbroadcastd ymm0, xmm0
vpaddd ymm0, ymm0, ymm4
vpxor ymm0, ymm0, ymm1
vpshufb ymm0, ymm0, ymm3
vpermq ymm0, ymm0, 0xd8
vextracti128 xmm0, ymm0, 0
vmovdqu xmmword [edx - 0x10], xmm0
vpmovzxwd ymm1, xmmword [edx]
lea ecx, [ebx - 0xf]
vmovd xmm0, ecx
vpbroadcastd ymm0, xmm0
vpaddd ymm0, ymm0, ymm4
vpxor ymm0, ymm0, ymm1
vpshufb ymm0, ymm0, ymm3
vpermq ymm0, ymm0, 0xd8
vextracti128 xmm0, ymm0, 0
vmovdqu xmmword [edx], xmm0
vpmovzxwd ymm2, xmmword [edx + 0x10]
lea ecx, [ebx - 7]
lea edx, [ebx - 6]
mov dword [ebp - 0x10], ecx
vmovd xmm0, ecx
vpinsrd xmm0, xmm0, edx, 1
lea esi, [ebx - 5]
mov dword [ebp - 0x14], edx
mov edx, dword [ebp - 4]
lea edi, [ebx - 4]
vpinsrd xmm0, xmm0, esi, 2
vpinsrd xmm1, xmm0, edi, 3
add ebx, 0xfffffffd
vmovd xmm0, ebx
mov ebx, dword [ebp - 8]
lea ecx, [ebx - 2]
vpinsrd xmm0, xmm0, ecx, 1
lea ecx, [ebx - 1]
vpinsrd xmm0, xmm0, ecx, 2
vpinsrd xmm0, xmm0, ebx, 3
vinsertf128 ymm0, ymm1, xmm0, 1
vpxor ymm0, ymm0, ymm2
vpshufb ymm0, ymm0, ymm3
vpermq ymm0, ymm0, 0xd8
vextracti128 xmm0, ymm0, 0
add ebx, 0x20
vmovdqu xmmword [edx + 0x10], xmm0
add edx, 0x40
mov dword [ebp - 8], ebx
mov dword [ebp - 4], edx
cmp ebx, 0x29b
jb 0x10016a71
mov edx, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
cmp eax, 0x5b
jae 0x10016ba5
lea ecx, [eax + 0x23c]
xor word [edx + eax*2], cx
inc eax
cmp eax, 0x5b
jb 0x10016b95
mov byte [edx + 0xb8], 0
vzeroupper
mov esp, ebp
pop ebp
ret
Function at 0x10016c70
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov ebx, ecx
mov dword [ebp - 4], ebx
cmp byte [ebx + 0x1a], 0
je 0x10016d36
vmovdqu ymm3, ymmword [0x1014fc40]
vmovdqu ymm4, ymmword [0x10150520]
push esi
xor eax, eax
push edi
nop dword [eax + eax]
vpmovsxbd ymm2, qword [ebx + eax]
lea ecx, [eax + 0x3c]
vmovd xmm0, ecx
lea edx, [eax + 0x3d]
vpinsrd xmm0, xmm0, edx, 1
lea esi, [eax + 0x3e]
vpinsrd xmm0, xmm0, esi, 2
lea edi, [eax + 0x3f]
vpinsrd xmm1, xmm0, edi, 3
lea ebx, [eax + 0x40]
vmovd xmm0, ebx
mov ebx, dword [ebp - 4]
lea ecx, [eax + 0x41]
vpinsrd xmm0, xmm0, ecx, 1
lea ecx, [eax + 0x42]
vpinsrd xmm0, xmm0, ecx, 2
lea ecx, [eax + 0x43]
vpinsrd xmm0, xmm0, ecx, 3
vinsertf128 ymm0, ymm1, xmm0, 1
vpxor ymm0, ymm0, ymm2
vpshufb ymm0, ymm0, ymm3
vpermq ymm0, ymm0, 0xd8
vpshufb ymm0, ymm0, ymm4
vextracti128 xmm0, ymm0, 0
vmovq qword [ebx + eax], xmm0
add eax, 8
lea ecx, [eax + 0x43]
cmp ecx, 0x5b
jb 0x10016ca0
pop edi
pop esi
cmp eax, 0x19
jae 0x10016d32
lea edx, [ebx + eax]
lea ecx, [eax + 0x3c]
inc eax
xor byte [edx], cl
cmp eax, 0x19
jb 0x10016d24
mov byte [ebx + 0x1a], 0
pop ebx
vzeroupper
mov esp, ebp
pop ebp
ret

Function at 0x10016d40
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov ebx, ecx
mov dword [ebp - 4], ebx
cmp byte [ebx + 0x17], 0
je 0x10016e06
vmovdqu ymm3, ymmword [0x1014fc40]
vmovdqu ymm4, ymmword [0x10150520]
push esi
xor eax, eax
push edi
nop dword [eax + eax]
vpmovsxbd ymm2, qword [ebx + eax]
lea ecx, [eax + 0x3c]
vmovd xmm0, ecx
lea edx, [eax + 0x3d]
vpinsrd xmm0, xmm0, edx, 1
lea esi, [eax + 0x3e]
vpinsrd xmm0, xmm0, esi, 2
lea edi, [eax + 0x3f]
vpinsrd xmm1, xmm0, edi, 3
lea ebx, [eax + 0x40]
vmovd xmm0, ebx
mov ebx, dword [ebp - 4]
lea ecx, [eax + 0x41]
vpinsrd xmm0, xmm0, ecx, 1
lea ecx, [eax + 0x42]
vpinsrd xmm0, xmm0, ecx, 2
lea ecx, [eax + 0x43]
vpinsrd xmm0, xmm0, ecx, 3
vinsertf128 ymm0, ymm1, xmm0, 1
vpxor ymm0, ymm0, ymm2
vpshufb ymm0, ymm0, ymm3
vpermq ymm0, ymm0, 0xd8
vpshufb ymm0, ymm0, ymm4
vextracti128 xmm0, ymm0, 0
vmovq qword [ebx + eax], xmm0
add eax, 8
lea ecx, [eax + 0x43]
cmp ecx, 0x53
jb 0x10016d70
pop edi
pop esi
cmp eax, 0x16
jae 0x10016e02
lea edx, [ebx + eax]
lea ecx, [eax + 0x3c]
inc eax
xor byte [edx], cl
cmp eax, 0x16
jb 0x10016df4
mov byte [ebx + 0x17], 0
pop ebx
vzeroupper
mov esp, ebp
pop ebp
ret
Function at 0x10017270
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100d72c5
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x18
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
movzx eax, byte [edi]
xor eax, 0x811c9dc5
imul ecx, eax, 0x1000193
movzx eax, byte [edi + 1]
xor ecx, eax
movzx eax, byte [edi + 2]
imul ecx, ecx, 0x1000193
xor ecx, eax
movzx eax, byte [edi + 3]
imul ecx, ecx, 0x1000193
xor ecx, eax
lea eax, [ebp - 0x18]
imul ebx, ecx, 0x1000193
push ebx
push edi
push eax
call fcn.10017dd0
mov ecx, dword [ebp - 0x14]
test ecx, ecx
je 0x100172f1
mov eax, dword [ebp + 8]
mov dword [eax], ecx
mov byte [eax + 4], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
cmp dword [0x1015d840], 0xfffffff
jne 0x10017308
push str.unordered_map_set_too_long
call dword [sym.imp.MSVCP140.dll_void___cdecl_std::_Xlength_error_char_const__]
mov dword [ebp - 0x20], 0x1015d83c
mov dword [ebp - 4], 0
push 0x10
mov dword [ebp - 0x1c], 0
call fcn.100d5120
mov ecx, dword [edi]
mov esi, eax
add esp, 4
mov dword [ebp - 0x1c], esi
mov dword [esi + 8], ecx
mov dword [esi + 0xc], 2
mov dword [ebp - 4], 1
mov ecx, dword [0x1015d840]
mov edi, dword [0x1015d854]
vmovss xmm1, dword [0x1015d838]
vxorps xmm0, xmm0, xmm0
lea eax, [ecx + 1]
vcvtsi2sd xmm0, xmm0, eax
shr eax, 0x1f
vaddsd xmm0, xmm0, qword [eax*8 + 0x1014f480]
vcvtsd2ss xmm2, xmm0, xmm0
vxorps xmm0, xmm0, xmm0
mov eax, edi
shr eax, 0x1f
vcvtsi2sd xmm0, xmm0, edi
vaddsd xmm0, xmm0, qword [eax*8 + 0x1014f480]
vcvtsd2ss xmm0, xmm0, xmm0
vdivss xmm0, xmm2, xmm0
vcomiss xmm0, xmm1
jbe 0x10017406
vdivss xmm0, xmm2, xmm1
vcvtss2sd xmm0, xmm0, xmm0
vmovsd qword [ebp - 0x18], xmm0
fld qword [ebp - 0x18]
vxorpd xmm0, xmm0, xmm0
fstp qword [ebp - 0x18]
vroundsd xmm0, xmm0, qword [ebp - 0x18], 2
vmovsd qword [ebp - 0x18], xmm0
fld qword [ebp - 0x18]
fstp qword [ebp - 0x18]
vmovsd xmm0, qword [ebp - 0x18]
vcvtpd2ps xmm0, xmm0
call fcn.100d65b0
mov ecx, 8
cmp eax, ecx
cmova ecx, eax
cmp edi, ecx
jae 0x100173e8
cmp edi, 0x200
jae 0x100173e6
shl edi, 3
cmp edi, ecx
jae 0x100173e8
mov edi, ecx
push edi
call fcn.100177c0
push ebx
lea eax, [esi + 8]
push eax
lea eax, [ebp - 0x20]
push eax
call fcn.10017dd0
mov ecx, dword [0x1015d840]
mov edx, dword [eax]
jmp 0x10017409
mov edx, dword [ebp - 0x18]
mov edi, dword [edx + 4]
inc ecx
mov dword [0x1015d840], ecx
mov dword [esi], edx
mov dword [esi + 4], edi
mov dword [edi], esi
mov dword [edx + 4], esi
mov eax, dword [0x1015d850]
mov ecx, dword [0x1015d844]
and eax, ebx
mov ebx, dword [ecx + eax*8]
cmp ebx, dword [0x1015d83c]
jne 0x1001743a
mov dword [ecx + eax*8], esi
jmp 0x10017449
cmp ebx, edx
jne 0x10017443
mov dword [ecx + eax*8], esi
jmp 0x1001744d
cmp dword [ecx + eax*8 + 4], edi
jne 0x1001744d
mov dword [ecx + eax*8 + 4], esi
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
pop edi
mov dword [eax], esi
pop esi
mov byte [eax + 4], 1
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret 8