joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100a4200
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, ecx
mov ecx, dword [ebp + 8]
mov eax, dword [esi + 4]
mov edx, dword [esi + 8]
sub eax, edx
cmp ecx, eax
jbe 0x100a4271
push eax
push ecx
push ecx
push ecx
mov edx, str.ERROR:
mov ecx, 0x100eada8
call fcn.10015be0
mov edx, str.Internal_error:_position_advanced_by
mov ecx, eax
call fcn.10015be0
add esp, 4
mov ecx, eax
call fcn.10012f80
mov edx, str._bytes__current_unparsed_size
mov ecx, eax
call fcn.10015be0
add esp, 4
mov ecx, eax
call fcn.10012f80
push eax
call fcn.1001a510
add esp, 4
cmp byte [0x100ec09c], 0
jne 0x100a427c
mov eax, dword [esi + 4]
mov dword [esi + 8], eax
pop esi
pop ebp
ret 4
lea eax, [edx + ecx]
mov dword [esi + 8], eax
pop esi
pop ebp
ret 4
mov ecx, 0x100eada8
call fcn.1002d1d0
push 1
call fcn.100b3502
int3

Function at 0x100a4290
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, ecx
push edi
mov edi, dword [ebp + 8]
mov ebx, dword [esi]
cmp edi, ebx
jae 0x100a42f8
mov edx, str.ERROR:
mov ecx, 0x100eada8
call fcn.10015be0
mov edx, str.Internal_error:_new_data_position
mov ecx, eax
call fcn.10015be0
mov edx, edi
mov ecx, eax
call fcn.10015be0
mov edx, str._is_beyond_start_of_data
mov ecx, eax
call fcn.10015be0
mov edx, ebx
mov ecx, eax
call fcn.10015be0
push eax
call fcn.1001a510
add esp, 4
cmp byte [0x100ec09c], 0
jne 0x100a4361
mov eax, dword [esi]
mov dword [esi + 8], eax
pop edi
pop esi
pop ebx
pop ebp
ret 4
mov ebx, dword [esi + 4]
cmp edi, ebx
jbe 0x100a4357
mov edx, str.ERROR:
mov ecx, 0x100eada8
call fcn.10015be0
mov edx, str.Internal_error:_new_data_position
mov ecx, eax
call fcn.10015be0
mov edx, edi
mov ecx, eax
call fcn.10015be0
mov edx, str._is_beyond_end_of_data
mov ecx, eax
call fcn.10015be0
mov edx, ebx
mov ecx, eax
call fcn.10015be0
push eax
call fcn.1001a510
add esp, 4
cmp byte [0x100ec09c], 0
jne 0x100a4372
mov eax, dword [esi + 4]
mov dword [esi + 8], eax
pop edi
pop esi
pop ebx
pop ebp
ret 4
mov dword [esi + 8], edi
pop edi
pop esi
pop ebx
pop ebp
ret 4
mov ecx, 0x100eada8
call fcn.1002d1d0
push 1
call fcn.100b3502
mov ecx, 0x100eada8
call fcn.1002d1d0
push 1
call fcn.100b3502
int3

Function at 0x100a4390
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 8]
push esi
mov esi, ecx
mov eax, dword [esi + 4]
mov ecx, eax
sub ecx, dword [esi + 8]
cmp edx, ecx
jbe 0x100a4401
push ecx
push ecx
push edx
push ecx
mov edx, str.ERROR:
mov ecx, 0x100eada8
call fcn.10015be0
mov edx, str.Internal_error:_specified_number_of_remaining_bytes
mov ecx, eax
call fcn.10015be0
add esp, 4
mov ecx, eax
call fcn.10012f80
mov edx, str._is_greater_than_unparsed_data_size
mov ecx, eax
call fcn.10015be0
add esp, 4
mov ecx, eax
call fcn.10012f80
push eax
call fcn.1001a510
add esp, 4
cmp byte [0x100ec09c], 0
jne 0x100a440b
mov eax, dword [esi + 4]
mov dword [esi + 8], eax
pop esi
pop ebp
ret 4
sub eax, edx
mov dword [esi + 8], eax
pop esi
pop ebp
ret 4
mov ecx, 0x100eada8
call fcn.1002d1d0
push 1
call fcn.100b3502
int3
Function at 0x100a4420
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, ecx
cmp dword [esi + 0xc], 0
jne 0x100a44a8
mov ecx, dword [esi + 4]
lea edx, [esi + 8]
call fcn.100a9bb0
cmp eax, 0xfffffffe
je 0x100a44a1
cmp eax, 0xffffffff
je 0x100a444f
mov ecx, dword [ebp + 0xc]
mov dword [ecx], eax
mov al, 1
pop esi
pop ecx
pop ebp
ret 8
mov edx, str.ERROR:
mov ecx, 0x100eada8
call fcn.10015be0
mov edx, str.Expected
mov ecx, eax
call fcn.10015be0
mov edx, dword [ebp + 8]
mov ecx, eax
call fcn.10015be0
mov edx, str.__found_invalid_variable_length_integer
mov ecx, eax
call fcn.10015be0
push eax
call fcn.1001a510
add esp, 4
cmp byte [0x100ec09c], 0
jne 0x100a44b0
mov dword [esi + 0xc], 0xffffffff
xor al, al
pop esi
pop ecx
pop ebp
ret 8
mov dword [esi + 0xc], 0xfffffffe
xor al, al
pop esi
pop ecx
pop ebp
ret 8
mov ecx, 0x100eada8
call fcn.1002d1d0
push 1
call fcn.100b3502
int3

Function at 0x100a44d0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, ecx
cmp dword [esi + 0xc], 0
jne 0x100a4572
mov ecx, dword [esi + 4]
lea edx, [esi + 8]
call fcn.100a9d20
mov ecx, eax
cmp ecx, 0xfffffffe
jne 0x100a4503
cmp edx, 0xffffffff
jne 0x100a4503
mov dword [esi + 0xc], eax
xor al, al
pop esi
pop ecx
pop ebp
ret 8
and eax, edx
cmp eax, 0xffffffff
je 0x100a4587
test edx, edx
jl 0x100a457a
jg 0x100a4515
cmp ecx, 0xffffffff
jbe 0x100a457a
push edx
push ecx
mov edx, str.ERROR:
mov ecx, 0x100eada8
call fcn.10015be0
mov edx, str.Value_of
mov ecx, eax
call fcn.10015be0
mov edx, str.Adler32_checksum_value
mov ecx, eax
call fcn.10015be0
mov edx, 0x10106010
mov ecx, eax
call fcn.10015be0
mov ecx, eax
call fcn.100a4b60
mov edx, str.__is_too_large_for_unsigned_32_bit_integer
mov ecx, eax
call fcn.10015be0
push eax
call fcn.1001a510
add esp, 4
call fcn.100966b0
mov dword [esi + 0xc], 0xffffffff
xor al, al
pop esi
pop ecx
pop ebp
ret 8
mov eax, dword [ebp + 0xc]
pop esi
mov dword [eax], ecx
mov al, 1
pop ecx
pop ebp
ret 8
mov edx, str.ERROR:
mov ecx, 0x100eada8
call fcn.10015be0
mov edx, str.Expected
mov ecx, eax
call fcn.10015be0
mov edx, str.Adler32_checksum_value
mov ecx, eax
call fcn.10015be0
mov edx, str.__found_invalid_variable_length_integer
mov ecx, eax
call fcn.10015be0
push eax
call fcn.1001a510
add esp, 4
cmp byte [0x100ec09c], 0
je 0x100a456b
mov ecx, 0x100eada8
call fcn.1002d1d0
push 1
call fcn.100b3502
int3
Function at 0x100a45e0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
push edi
lea eax, [ebp - 4]
mov dword [ebp - 4], 0
push eax
push str.source_segment_length
mov edi, ecx
call fcn.100a4420
test al, al
je 0x100a4741
mov ebx, dword [ebp + 0x14]
mov eax, dword [ebp - 4]
mov esi, dword [ebp + 8]
mov dword [ebx], eax
cmp eax, esi
jbe 0x100a4693
push esi
push ecx
push eax
push ecx
mov edx, str.ERROR:
mov ecx, 0x100eada8
call fcn.10015be0
mov edx, str.Source_segment_length__
mov ecx, eax
call fcn.10015be0
add esp, 4
mov ecx, eax
call fcn.10012f80
mov edx, str.__is_larger_than
mov ecx, eax
call fcn.10015be0
mov edx, dword [ebp + 0x10]
mov ecx, eax
call fcn.10015be0
mov edx, 0x100f95a0
mov ecx, eax
call fcn.10015be0
add esp, 4
mov ecx, eax
call fcn.10012f80
mov edx, 0x100f959c
mov ecx, eax
call fcn.10015be0
push eax
call fcn.1001a510
add esp, 4
cmp byte [0x100ec09c], 0
je 0x100a473a
jmp 0x100a477c
lea eax, [ebp + 0x14]
mov dword [ebp + 0x14], 0
push eax
push str.source_segment_position
mov ecx, edi
call fcn.100a4420
test al, al
je 0x100a4741
mov eax, dword [ebp + 0x18]
mov ecx, dword [ebp + 0x14]
mov dword [eax], ecx
cmp ecx, esi
jb 0x100a474c
cmp dword [ebx], 0
jbe 0x100a474c
push esi
push ecx
push ecx
push ecx
mov edx, str.ERROR:
mov ecx, 0x100eada8
call fcn.10015be0
mov edx, str.Source_segment_position__
mov ecx, eax
call fcn.10015be0
add esp, 4
mov ecx, eax
call fcn.10012f80
mov edx, str.__is_past
mov ecx, eax
call fcn.10015be0
mov edx, dword [ebp + 0xc]
mov ecx, eax
call fcn.10015be0
mov edx, 0x100f95a0
mov ecx, eax
call fcn.10015be0
add esp, 4
mov ecx, eax
call fcn.10012f80
mov edx, 0x100f959c
mov ecx, eax
call fcn.10015be0
push eax
call fcn.1001a510
add esp, 4
call fcn.100966b0
mov dword [edi + 0xc], 0xffffffff
xor al, al
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x14
mov eax, dword [ebx]
add eax, ecx
cmp eax, esi
jbe 0x100a4771
push esi
push ecx
push eax
push ecx
mov edx, str.ERROR:
mov ecx, 0x100eada8
call fcn.10015be0
mov edx, str.Source_segment_end_position__
jmp 0x100a46e3
pop edi
pop esi
mov al, 1
pop ebx
mov esp, ebp
pop ebp
ret 0x14
mov ecx, 0x100eada8
call fcn.1002d1d0
push 1
call fcn.100b3502
int3
Function at 0x100a4790
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
mov edi, ecx
cmp dword [edi + 0xc], 0
jne 0x100a47ae
mov eax, dword [edi + 4]
mov ecx, dword [edi + 8]
sub eax, ecx
jne 0x100a47b6
mov dword [edi + 0xc], 0xfffffffe
xor al, al
pop edi
pop esi
pop ebp
ret 0x18
mov esi, dword [ebp + 0x14]
mov al, byte [ecx]
mov ecx, edi
push 1
mov byte [esi], al
call fcn.100a4200
movzx eax, byte [esi]
and eax, 3
dec eax
je 0x100a486e
dec eax
je 0x100a4810
dec eax
je 0x100a47e1
mov al, 1
pop edi
pop esi
pop ebp
ret 0x18
mov edx, str.ERROR:
mov ecx, 0x100eada8
call fcn.10015be0
mov edx, str.Win_Indicator_must_not_have_both_VCD_SOURCE_and_VCD_TARGET_set
mov ecx, eax
call fcn.10015be0
push eax
call fcn.1001a510
add esp, 4
cmp byte [0x100ec09c], 0
je 0x100a483f
jmp 0x100a488e
cmp byte [ebp + 0x10], 0
jne 0x100a484e
mov edx, str.ERROR:
mov ecx, 0x100eada8
call fcn.10015be0
mov edx, str.Delta_file_contains_VCD_TARGET_flag__which_is_not_allowed_by_current_decoder_settings
mov ecx, eax
call fcn.10015be0
push eax
call fcn.1001a510
add esp, 4
call fcn.100966b0
mov dword [edi + 0xc], 0xffffffff
xor al, al
pop edi
pop esi
pop ebp
ret 0x18
push dword [ebp + 0x1c]
mov ecx, edi
push dword [ebp + 0x18]
push str.target_file
push str.current_target_position
push dword [ebp + 0xc]
call fcn.100a45e0
pop edi
pop esi
pop ebp
ret 0x18
push dword [ebp + 0x1c]
mov ecx, edi
push dword [ebp + 0x18]
push str.dictionary
push str.end_of_dictionary
push dword [ebp + 8]
call fcn.100a45e0
pop edi
pop esi
pop ebp
ret 0x18
mov ecx, 0x100eada8
call fcn.1002d1d0
push 1
call fcn.100b3502
int3

Function at 0x100a48a0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push esi
mov esi, ecx
cmp dword [esi + 0x14], 0
je 0x100a48ec
mov edx, str.ERROR:
mov ecx, 0x100eada8
call fcn.10015be0
mov edx, str.Internal_error:_VCDiffHeaderParser::ParseWindowLengths_was_called_twice_for_the_same_delta_window
mov ecx, eax
call fcn.10015be0
push eax
call fcn.1001a510
add esp, 4
cmp byte [0x100ec09c], 0
jne 0x100a493d
mov dword [esi + 0xc], 0xffffffff
xor al, al
pop esi
mov esp, ebp
pop ebp
ret 4
lea eax, [ebp - 4]
mov dword [ebp - 4], 0
push eax
push str.length_of_the_delta_encoding
call fcn.100a4420
test al, al
je 0x100a48e3
mov eax, dword [ebp - 4]
mov ecx, esi
mov dword [esi + 0x10], eax
mov eax, dword [esi + 8]
mov dword [esi + 0x14], eax
lea eax, [ebp - 4]
push eax
push str.size_of_the_target_window
mov dword [ebp - 4], 0
call fcn.100a4420
test al, al
je 0x100a48e3
mov ecx, dword [ebp + 8]
mov eax, dword [ebp - 4]
pop esi
mov dword [ecx], eax
mov al, 1
mov esp, ebp
pop ebp
ret 4
mov ecx, 0x100eada8
call fcn.1002d1d0
push 1
call fcn.100b3502
int3

Function at 0x100a4950
Capabilities:
Terminate process

Disassembly:
push ecx
mov edx, str.ERROR:
mov ecx, 0x100eada8
call fcn.10015be0
mov edx, str.Internal_error:_VCDiffHeaderParser::GetDeltaWindowEnd_was_called_before_ParseWindowLengths
mov ecx, eax
call fcn.10015be0
push eax
call fcn.1001a510
add esp, 4
cmp byte [0x100ec09c], 0
jne 0x100a4982
xor eax, eax
pop ecx
ret
mov ecx, 0x100eada8
call fcn.1002d1d0
push 1
call fcn.100b3502
int3
Function at 0x100a49a0
Capabilities:
Terminate process

Disassembly:
push ecx
push ebx
push esi
mov esi, ecx
cmp dword [esi + 0xc], 0
jne 0x100a49bc
mov eax, dword [esi + 4]
mov ecx, dword [esi + 8]
sub eax, ecx
jne 0x100a49c2
mov dword [esi + 0xc], 0xfffffffe
xor al, al
pop esi
pop ebx
pop ecx
ret
mov bl, byte [ecx]
mov ecx, esi
push 1
call fcn.100a4200
test bl, 7
je 0x100a4a0c
mov edx, str.ERROR:
mov ecx, 0x100eada8
call fcn.10015be0
mov edx, str.Secondary_compression_of_delta_file_sections_is_not_supported
mov ecx, eax
call fcn.10015be0
push eax
call fcn.1001a510
add esp, 4
cmp byte [0x100ec09c], 0
jne 0x100a4a12
mov dword [esi + 0xc], 0xffffffff
xor al, al
pop esi
pop ebx
pop ecx
ret
pop esi
mov al, 1
pop ebx
pop ecx
ret
mov ecx, 0x100eada8
call fcn.1002d1d0
push 1
call fcn.100b3502
int3

Function at 0x100a4a30
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
push edi
lea eax, [ebp - 4]
mov dword [ebp - 4], 0
push eax
push str.length_of_data_for_ADDs_and_RUNs
mov esi, ecx
call fcn.100a4420
mov ebx, dword [ebp + 0xc]
test al, al
je 0x100a4a5c
mov eax, dword [ebp - 4]
mov dword [ebx], eax
lea eax, [ebp + 0xc]
mov dword [ebp + 0xc], 0
push eax
push str.length_of_instructions_section
mov ecx, esi
call fcn.100a4420
mov edi, dword [ebp + 0x10]
test al, al
je 0x100a4a7f
mov eax, dword [ebp + 0xc]
mov dword [edi], eax
lea eax, [ebp + 0xc]
mov dword [ebp + 0xc], 0
push eax
push str.length_of_addresses_for_COPYs
mov ecx, esi
call fcn.100a4420
test al, al
je 0x100a4aa2
mov ecx, dword [ebp + 0x14]
mov eax, dword [ebp + 0xc]
mov dword [ecx], eax
cmp byte [ebp + 8], 0
je 0x100a4ac7
lea eax, [ebp + 8]
mov dword [ebp + 8], 0
push eax
push ecx
mov ecx, esi
call fcn.100a44d0
test al, al
je 0x100a4ac7
mov ecx, dword [ebp + 0x18]
mov eax, dword [ebp + 8]
mov dword [ecx], eax
cmp dword [esi + 0xc], 0
jne 0x100a4b08
mov ecx, dword [esi + 0x14]
test ecx, ecx
jne 0x100a4b13
mov edx, str.ERROR:
mov ecx, 0x100eada8
call fcn.10015be0
mov edx, str.Internal_error:_VCDiffHeaderParser::ParseSectionLengths_was_called_before_ParseWindowLengths
mov ecx, eax
call fcn.10015be0
push eax
call fcn.1001a510
add esp, 4
cmp byte [0x100ec09c], 0
jne 0x100a4b47
mov dword [esi + 0xc], 0xffffffff
xor al, al
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x14
mov eax, dword [esi + 8]
sub eax, ecx
mov ecx, dword [ebp + 0x14]
add eax, dword [ebx]
add eax, dword [edi]
add eax, dword [ecx]
cmp dword [esi + 0x10], eax
je 0x100a4b3c
mov edx, str.ERROR:
mov ecx, 0x100eada8
call fcn.10015be0
mov edx, str.The_length_of_the_delta_encoding_does_not_match_the_size_of_the_header_plus_the_sizes_of_the_data_sections
jmp 0x100a4ae8
pop edi
pop esi
mov al, 1
pop ebx
mov esp, ebp
pop ebp
ret 0x14
mov ecx, 0x100eada8
call fcn.1002d1d0
push 1
call fcn.100b3502
int3
Function at 0x100a4d30
Capabilities:
Terminate process

Disassembly:
push esi
mov esi, ecx
cmp dword [esi + 8], 0
je 0x100a4d6a
mov edx, str.ERROR:
mov ecx, 0x100eada8
call fcn.10015be0
mov edx, str.Init___called_twice_for_same_VCDiffEngine_object
mov ecx, eax
call fcn.10015be0
push eax
call fcn.1001a510
add esp, 4
cmp byte [0x100ec09c], 0
jne 0x100a4d9a
xor al, al
pop esi
ret
mov edx, dword [esi + 4]
mov ecx, dword [esi]
call fcn.100aa1a0
mov dword [esi + 8], eax
test eax, eax
jne 0x100a4d91
mov edx, str.ERROR:
mov ecx, 0x100eada8
call fcn.10015be0
mov edx, str.Creation_of_dictionary_hash_failed
jmp 0x100a4d4d
call fcn.100a4db0
mov al, 1
pop esi
ret
mov ecx, 0x100eada8
call fcn.1002d1d0
push 1
call fcn.100b3502
int3
Function at 0x100a4e20
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
mov ebx, ecx
push esi
push edi
mov dword [ebp - 8], ebx
cmp dword [ebx + 8], 0
jne 0x100a4e6a
mov edx, str.ERROR:
mov ecx, 0x100eada8
call fcn.10015be0
mov edx, str.Internal_error:_VCDiffEngine::Encode___called_before_VCDiffEngine::Init__
mov ecx, eax
call fcn.10015be0
push eax
call fcn.1001a510
add esp, 4
cmp byte [0x100ec09c], 0
je 0x100a4fca
jmp 0x100a4fd3
mov esi, dword [ebp + 0xc]
test esi, esi
je 0x100a4fca
cmp esi, 0x10
jae 0x100a4e9f
mov edi, dword [ebp + 0x14]
test esi, esi
je 0x100a4e8c
mov eax, dword [edi]
mov ecx, edi
push esi
push dword [ebp + 8]
call dword [eax + 0xc]
mov eax, dword [edi]
mov ecx, edi
push dword [ebp + 0x10]
call dword [eax + 0x1c]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
lea ecx, [ebp + 0xf]
call fcn.100a5120
push dword [ebx + 4]
mov ebx, dword [ebp + 8]
mov edx, esi
mov ecx, ebx
call fcn.100aa260
add esp, 4
mov dword [ebp + 0xc], eax
test eax, eax
jne 0x100a4ef2
mov edx, str.ERROR:
mov ecx, 0x100eada8
call fcn.10015be0
mov edx, str.Instantiation_of_target_hash_failed
mov ecx, eax
call fcn.10015be0
push eax
call fcn.1001a510
add esp, 4
call fcn.100966b0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
lea eax, [ebx + esi]
mov ecx, ebx
mov dword [ebp - 4], eax
mov esi, ebx
mov edi, ebx
call fcn.100a5170
mov ebx, eax
mov edx, dword [ebp + 0xc]
push dword [ebp + 0x14]
mov ecx, dword [ebp - 4]
push edx
sub ecx, esi
push ecx
mov ecx, dword [ebp - 8]
push esi
push edi
push ebx
call fcn.100a51c0
mov ecx, dword [ebp - 4]
test eax, eax
je 0x100a4f48
add esi, eax
lea eax, [ecx - 0x10]
mov edi, esi
cmp esi, eax
ja 0x100a4f9d
mov ecx, esi
call fcn.100a5170
mov ecx, dword [ebp + 0xc]
mov ebx, eax
mov eax, esi
sub eax, dword [ebp + 8]
push eax
call fcn.100aa620
jmp 0x100a4f05
lea eax, [edi + 1]
add ecx, 0xfffffff0
mov dword [ebp - 0xc], eax
cmp eax, ecx
ja 0x100a4f9a
mov edx, dword [ebp + 0xc]
mov eax, edi
sub eax, dword [ebp + 8]
mov ecx, dword [edx + 0x34]
inc ecx
shl ecx, 4
cmp eax, ecx
jne 0x100a4f73
push ebx
mov ecx, edx
call fcn.100aa470
mov edx, dword [ebp + 0xc]
movzx ecx, byte [edi]
mov eax, dword [0x100ed1f4]
mov eax, dword [eax + ecx*4]
add eax, ebx
imul ebx, eax, 0x101
movzx eax, byte [edi + 0x10]
mov edi, dword [ebp - 0xc]
add ebx, eax
and ebx, 0x7fffff
jmp 0x100a4f08
mov ecx, dword [ebp - 4]
mov ebx, dword [ebp + 0x14]
sub ecx, esi
je 0x100a4fad
mov eax, dword [ebx]
push ecx
push esi
mov ecx, ebx
call dword [eax + 0xc]
mov eax, dword [ebx]
mov ecx, ebx
push dword [ebp + 0x10]
call dword [eax + 0x1c]
mov ebx, dword [ebp + 0xc]
mov ecx, ebx
call fcn.100a9fb0
push ebx
call fcn.100af6c3
add esp, 4
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
mov ecx, 0x100eada8
call fcn.1002d1d0
push 1
call fcn.100b3502
int3
Function at 0x100a4ff0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, ecx
push ebx
push esi
push edi
cmp dword [eax + 8], 0
mov dword [ebp - 4], eax
jne 0x100a5038
mov edx, str.ERROR:
mov ecx, 0x100eada8
call fcn.10015be0
mov edx, str.Internal_error:_VCDiffEngine::Encode___called_before_VCDiffEngine::Init__
mov ecx, eax
call fcn.10015be0
push eax
call fcn.1001a510
add esp, 4
cmp byte [0x100ec09c], 0
je 0x100a50d1
jmp 0x100a5107
mov edi, dword [ebp + 0xc]
test edi, edi
je 0x100a50d1
cmp edi, 0x10
jae 0x100a506d
mov esi, dword [ebp + 0x14]
test edi, edi
je 0x100a505a
mov eax, dword [esi]
mov ecx, esi
push edi
push dword [ebp + 8]
call dword [eax + 0xc]
mov eax, dword [esi]
mov ecx, esi
push dword [ebp + 0x10]
call dword [eax + 0x1c]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
lea ecx, [ebp + 0xf]
call fcn.100a5120
mov esi, dword [ebp + 8]
lea eax, [esi + edi]
mov edi, esi
mov dword [ebp + 8], eax
mov ecx, esi
call fcn.100a5170
mov ebx, eax
lea esp, [esp]
push dword [ebp + 0x14]
push ecx
mov ecx, dword [ebp + 8]
sub ecx, esi
push ecx
mov ecx, dword [ebp - 4]
push esi
push edi
push ebx
call fcn.100a5250
mov ecx, dword [ebp + 8]
test eax, eax
je 0x100a50da
add esi, eax
lea eax, [ecx - 0x10]
mov edi, esi
cmp esi, eax
jbe 0x100a5080
mov ebx, dword [ebp + 0x14]
sub ecx, esi
je 0x100a50c7
mov eax, dword [ebx]
push ecx
push esi
mov ecx, ebx
call dword [eax + 0xc]
mov eax, dword [ebx]
mov ecx, ebx
push dword [ebp + 0x10]
call dword [eax + 0x1c]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
lea edx, [edi + 1]
lea eax, [ecx - 0x10]
cmp edx, eax
ja 0x100a50b7
movzx ecx, byte [edi]
mov eax, dword [0x100ed1f4]
mov eax, dword [eax + ecx*4]
add eax, ebx
imul ebx, eax, 0x101
movzx eax, byte [edi + 0x10]
mov edi, edx
add ebx, eax
and ebx, 0x7fffff
jmp 0x100a5090
mov ecx, 0x100eada8
call fcn.1002d1d0
push 1
call fcn.100b3502
int3

Function at 0x100a5120
Capabilities:
Terminate process

Disassembly:
cmp dword [0x100ed1f4], 0
push esi
mov esi, ecx
jne 0x100a5159
mov edx, str.ERROR:
mov ecx, 0x100eada8
call fcn.10015be0
mov edx, str.RollingHash_object_instantiated_before_calling_RollingHash::Init__
mov ecx, eax
call fcn.10015be0
push eax
call fcn.1001a510
add esp, 4
cmp byte [0x100ec09c], 0
jne 0x100a515d
mov eax, esi
pop esi
ret
mov ecx, 0x100eada8
call fcn.1002d1d0
push 1
call fcn.100b3502
int3
Function at 0x100a5ab0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x14
mov eax, dword [0x10001850]
xor eax, esp
mov dword [esp + 0x10], eax
push ebx
push esi
push edi
mov edi, ecx
cmp dword [edi + 0x88], 0
jne 0x100a5b08
mov edx, str.ERROR:
mov ecx, 0x100eada8
call fcn.10015be0
mov edx, str.VCDiffCodeTableWriter::Copy___called_without_calling_Init__
mov ecx, eax
call fcn.10015be0
push eax
call fcn.1001a510
add esp, 4
cmp byte [0x100ec09c], 0
je 0x100a5b8c
jmp 0x100a5ba0
lea eax, [esp + 0x10]
mov dword [esp + 0x10], 0
push eax
mov eax, dword [edi + 0x7c]
lea ecx, [edi + 0x58]
add eax, dword [edi + 0x80]
push eax
push dword [ebp + 8]
call fcn.100a3ab0
mov bl, al
mov ecx, edi
mov byte [esp + 0x14], bl
push dword [esp + 0x14]
push dword [ebp + 0xc]
push 3
call fcn.100a57b0
mov cl, byte [edi + 0x58]
mov al, cl
add al, 2
cmp bl, al
jb 0x100a5b64
mov al, byte [edi + 0x5c]
inc al
add al, cl
cmp bl, al
ja 0x100a5b64
push dword [esp + 0x10]
mov ecx, dword [edi + 0x3c]
call fcn.1007da50
jmp 0x100a5b83
mov ecx, dword [esp + 0x10]
lea edx, [esp + 0x14]
mov esi, dword [edi + 0x3c]
call fcn.100a9c80
lea edx, [esp + 0x19]
mov ecx, esi
push eax
sub edx, eax
push edx
call fcn.1002c5d0
mov eax, dword [ebp + 0xc]
add dword [edi + 0x80], eax
mov ecx, dword [esp + 0x1c]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.100b0fcd
mov esp, ebp
pop ebp
ret 8
mov ecx, 0x100eada8
call fcn.1002d1d0
push 1
call fcn.100b3502
int3
Function at 0x100a5ff0
Capabilities:
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
test edx, edx
jne 0x100a5ffb
xor eax, eax
pop ebp
ret
pop ebp
jmp fcn.100a6010
Function at 0x100a8ed0
Capabilities:
Encode data using xor
Encrypt data using rc4 ksa
Manually build aes constants

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov eax, 0x100ecbc0
mov word [0x100ed0c0], 0
push esi
dec eax
mov word [0x100ecbc0], 0x301
push edi
mov edi, 0x100ecbc0
mov byte [0x100ed0c3], 1
mov ebx, 2
sub edi, eax
lea esi, [eax + 2]
mov cl, byte [esi]
lea esi, [esi + 1]
mov dl, cl
mov al, cl
and dl, 0x80
neg dl
sbb dl, dl
add al, al
xor al, cl
and dl, 0x1b
xor al, dl
mov byte [edi + esi - 1], al
movzx eax, al
mov byte [eax + 0x100ed0c0], bl
inc ebx
cmp ebx, 0x100
jl 0x100a8f05
mov byte [0x100ec940], 0x63
mov ebx, 1
mov byte [0x100ecaa3], 0
jmp 0x100a8f50
movzx eax, bl
mov ecx, 0x100eccbf
movzx eax, byte [eax + 0x100ed0c0]
sub ecx, eax
mov cl, byte [ecx]
mov dl, cl
rol dl, 1
xor cl, dl
rol dl, 1
xor cl, dl
rol dl, 1
mov al, dl
rol al, 1
xor al, cl
xor al, dl
xor al, 0x63
mov byte [ebx + 0x100ec940], al
movzx eax, al
mov byte [eax + 0x100eca40], bl
inc ebx
cmp ebx, 0x100
jl 0x100a8f50
mov al, 1
mov edx, 0x100ecb40
movzx ecx, al
mov dword [edx], ecx
mov cl, al
and cl, 0x80
neg cl
sbb cl, cl
add al, al
and cl, 0x1b
add edx, 4
xor al, cl
cmp edx, 0x100ecbb8
jl 0x100a8f98
mov ecx, dword [0x1000315c]
xor esi, esi
mov edi, 0xff
mov ah, byte [esi + 0x100ec940]
mov bl, ah
mov bh, ah
and bl, 0x80
mov al, bl
neg al
sbb al, al
add bh, bh
and al, 0x1b
mov dl, bh
xor dl, al
xor dl, ah
neg bl
movzx edx, dl
sbb bl, bl
movzx eax, ah
shl edx, 8
and bl, 0x1b
or edx, eax
xor bh, bl
mov bl, byte [esi + 0x100eca40]
shl edx, 8
or edx, eax
movzx eax, bh
shl edx, 8
or edx, eax
mov dword [esi*4 + 0x100eccc0], edx
test cl, cl
je 0x100a903c
test bl, bl
je 0x100a903c
movzx eax, cl
movzx edx, bl
movzx eax, byte [eax + 0x100ed0c0]
movzx edx, byte [edx + 0x100ed0c0]
add eax, edx
cdq
idiv edi
mov al, byte [edx + 0x100ecbc0]
mov byte [ebp - 1], al
jmp 0x100a9040
mov byte [ebp - 1], 0
test ch, ch
je 0x100a906c
test bl, bl
je 0x100a906c
movzx eax, ch
movzx edx, bl
movzx eax, byte [eax + 0x100ed0c0]
movzx edx, byte [edx + 0x100ed0c0]
add eax, edx
cdq
idiv edi
mov al, byte [edx + 0x100ecbc0]
mov byte [ebp - 2], al
jmp 0x100a9070
mov byte [ebp - 2], 0
mov al, byte [0x1000315e]
test al, al
je 0x100a909e
test bl, bl
je 0x100a909e
movzx eax, al
movzx edx, bl
movzx eax, byte [eax + 0x100ed0c0]
movzx edx, byte [edx + 0x100ed0c0]
add eax, edx
cdq
idiv edi
mov bh, byte [edx + 0x100ecbc0]
jmp 0x100a90a0
xor bh, bh
mov al, byte [0x1000315f]
test al, al
je 0x100a90ce
test bl, bl
je 0x100a90ce
movzx eax, al
movzx edx, bl
movzx eax, byte [eax + 0x100ed0c0]
movzx edx, byte [edx + 0x100ed0c0]
add eax, edx
cdq
idiv edi
mov bl, byte [edx + 0x100ecbc0]
jmp 0x100a90d0
xor bl, bl
movzx edx, byte [ebp - 1]
movzx eax, byte [ebp - 2]
shl edx, 8
or edx, eax
movzx eax, bh
shl edx, 8
or edx, eax
movzx eax, bl
shl edx, 8
or edx, eax
mov dword [esi*4 + 0x100ec540], edx
inc esi
cmp esi, 0x100
jl 0x100a8fc5
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret