joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10071360
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
cmp byte [0x10317360], 0
push ebx
push esi
je 0x100713d1
cmp byte [0x10317361], 0
jne 0x10071412
mov byte [0x10317361], 1
xor esi, esi
nop word [eax + eax]
xor edx, edx
mov ebx, esi
xor edx, dword [0x103173b4]
xor ebx, dword [0x103173b0]
xor edx, 0xd28f2c5
xor ebx, 0x1de26cd5
mov ecx, edx
mov eax, ebx
shld ecx, eax, 0xd
shl eax, 0xd
xor edx, ecx
xor ebx, eax
mov eax, ebx
shrd eax, edx, 7
xor al, bl
xor byte [esi + 0x10317362], al
inc esi
cmp esi, 0x4a
jb 0x10071390
jmp 0x10071412
xor esi, esi
xor edx, edx
mov ebx, esi
xor edx, dword [0x103173b4]
xor ebx, dword [0x103173b0]
xor edx, 0xd28f2c5
xor ebx, 0x1de26cd5
mov ecx, edx
mov eax, ebx
shld ecx, eax, 0xd
shl eax, 0xd
xor edx, ecx
xor ebx, eax
mov eax, ebx
shrd eax, edx, 7
xor al, bl
xor byte [esi + 0x10317362], al
inc esi
cmp esi, 0x4a
jb 0x100713d3
mov ecx, dword [ebp + 8]
lea eax, [ebp - 1]
push eax
push 0x103173ab
push 0x10317362
call fcn.10054040
mov eax, dword [ebp + 8]
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x10071440
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
cmp byte [0x103174a8], 0
push ebx
push esi
je 0x100714b1
cmp byte [0x103174a9], 0
jne 0x100714f2
mov byte [0x103174a9], 1
xor esi, esi
nop word [eax + eax]
xor edx, edx
mov ebx, esi
xor edx, dword [0x103174f4]
xor ebx, dword [0x103174f0]
xor edx, 0xd28f2c5
xor ebx, 0x1de26cd5
mov ecx, edx
mov eax, ebx
shld ecx, eax, 0xd
shl eax, 0xd
xor edx, ecx
xor ebx, eax
mov eax, ebx
shrd eax, edx, 7
xor al, bl
xor byte [esi + 0x103174aa], al
inc esi
cmp esi, 0x45
jb 0x10071470
jmp 0x100714f2
xor esi, esi
xor edx, edx
mov ebx, esi
xor edx, dword [0x103174f4]
xor ebx, dword [0x103174f0]
xor edx, 0xd28f2c5
xor ebx, 0x1de26cd5
mov ecx, edx
mov eax, ebx
shld ecx, eax, 0xd
shl eax, 0xd
xor edx, ecx
xor ebx, eax
mov eax, ebx
shrd eax, edx, 7
xor al, bl
xor byte [esi + 0x103174aa], al
inc esi
cmp esi, 0x45
jb 0x100714b3
mov ecx, dword [ebp + 8]
lea eax, [ebp - 1]
push eax
push 0x103174ee
push 0x103174aa
call fcn.10054040
mov eax, dword [ebp + 8]
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x10071520
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
cmp byte [0x103175a8], 0
push ebx
push esi
je 0x10071591
cmp byte [0x103175a9], 0
jne 0x100715d2
mov byte [0x103175a9], 1
xor esi, esi
nop word [eax + eax]
xor edx, edx
mov ebx, esi
xor edx, dword [0x103175ec]
xor ebx, dword [0x103175e8]
xor edx, 0xd28f2c5
xor ebx, 0x1de26cd5
mov ecx, edx
mov eax, ebx
shld ecx, eax, 0xd
shl eax, 0xd
xor edx, ecx
xor ebx, eax
mov eax, ebx
shrd eax, edx, 7
xor al, bl
xor byte [esi + 0x103175aa], al
inc esi
cmp esi, 0x3a
jb 0x10071550
jmp 0x100715d2
xor esi, esi
xor edx, edx
mov ebx, esi
xor edx, dword [0x103175ec]
xor ebx, dword [0x103175e8]
xor edx, 0xd28f2c5
xor ebx, 0x1de26cd5
mov ecx, edx
mov eax, ebx
shld ecx, eax, 0xd
shl eax, 0xd
xor edx, ecx
xor ebx, eax
mov eax, ebx
shrd eax, edx, 7
xor al, bl
xor byte [esi + 0x103175aa], al
inc esi
cmp esi, 0x3a
jb 0x10071593
mov ecx, dword [ebp + 8]
lea eax, [ebp - 1]
push eax
push 0x103175e3
push 0x103175aa
call fcn.10054040
mov eax, dword [ebp + 8]
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x10071600
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
cmp byte [0x10316178], 0
push ebx
push esi
je 0x10071671
cmp byte [0x10316179], 0
jne 0x100716b2
mov byte [0x10316179], 1
xor esi, esi
nop word [eax + eax]
xor edx, edx
mov ebx, esi
xor edx, dword [0x10316194]
xor ebx, dword [0x10316190]
xor edx, 0xd28f2c5
xor ebx, 0x1de26cd5
mov ecx, edx
mov eax, ebx
shld ecx, eax, 0xd
shl eax, 0xd
xor edx, ecx
xor ebx, eax
mov eax, ebx
shrd eax, edx, 7
xor al, bl
xor byte [esi + 0x1031617a], al
inc esi
cmp esi, 0x10
jb 0x10071630
jmp 0x100716b2
xor esi, esi
xor edx, edx
mov ebx, esi
xor edx, dword [0x10316194]
xor ebx, dword [0x10316190]
xor edx, 0xd28f2c5
xor ebx, 0x1de26cd5
mov ecx, edx
mov eax, ebx
shld ecx, eax, 0xd
shl eax, 0xd
xor edx, ecx
xor ebx, eax
mov eax, ebx
shrd eax, edx, 7
xor al, bl
xor byte [esi + 0x1031617a], al
inc esi
cmp esi, 0x10
jb 0x10071673
mov ecx, dword [ebp + 8]
lea eax, [ebp - 1]
push eax
push 0x10316189
push 0x1031617a
call fcn.10054040
mov eax, dword [ebp + 8]
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x100716e0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
cmp byte [0x103163e0], 0
push ebx
push esi
je 0x10071754
cmp byte [0x103163e1], 0
jne 0x10071798
mov byte [0x103163e1], 1
xor esi, esi
nop word [eax + eax]
xor edx, edx
mov ebx, esi
xor edx, dword [0x10316524]
xor ebx, dword [0x10316520]
xor edx, 0xd28f2c5
xor ebx, 0x1de26cd5
mov ecx, edx
mov eax, ebx
shld ecx, eax, 0xd
shl eax, 0xd
xor edx, ecx
xor ebx, eax
mov eax, ebx
shrd eax, edx, 7
xor al, bl
xor byte [esi + 0x103163e2], al
inc esi
cmp esi, 0x137
jb 0x10071710
jmp 0x10071798
xor esi, esi
xor edx, edx
mov ebx, esi
xor edx, dword [0x10316524]
xor ebx, dword [0x10316520]
xor edx, 0xd28f2c5
xor ebx, 0x1de26cd5
mov ecx, edx
mov eax, ebx
shld ecx, eax, 0xd
shl eax, 0xd
xor edx, ecx
xor ebx, eax
mov eax, ebx
shrd eax, edx, 7
xor al, bl
xor byte [esi + 0x103163e2], al
inc esi
cmp esi, 0x137
jb 0x10071756
mov ecx, dword [ebp + 8]
lea eax, [ebp - 1]
push eax
push 0x10316518
push 0x103163e2
call fcn.10054040
mov eax, dword [ebp + 8]
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x100717c0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
cmp byte [0x103178b0], 0
push ebx
push esi
je 0x10071831
cmp byte [0x103178b1], 0
jne 0x10071872
mov byte [0x103178b1], 1
xor esi, esi
nop word [eax + eax]
xor edx, edx
mov ebx, esi
xor edx, dword [0x103178d4]
xor ebx, dword [0x103178d0]
xor edx, 0xd28f2c5
xor ebx, 0x1de26cd5
mov ecx, edx
mov eax, ebx
shld ecx, eax, 0xd
shl eax, 0xd
xor edx, ecx
xor ebx, eax
mov eax, ebx
shrd eax, edx, 7
xor al, bl
xor byte [esi + 0x103178b2], al
inc esi
cmp esi, 0x19
jb 0x100717f0
jmp 0x10071872
xor esi, esi
xor edx, edx
mov ebx, esi
xor edx, dword [0x103178d4]
xor ebx, dword [0x103178d0]
xor edx, 0xd28f2c5
xor ebx, 0x1de26cd5
mov ecx, edx
mov eax, ebx
shld ecx, eax, 0xd
shl eax, 0xd
xor edx, ecx
xor ebx, eax
mov eax, ebx
shrd eax, edx, 7
xor al, bl
xor byte [esi + 0x103178b2], al
inc esi
cmp esi, 0x19
jb 0x10071833
mov ecx, dword [ebp + 8]
lea eax, [ebp - 1]
push eax
push 0x103178ca
push 0x103178b2
call fcn.10054040
mov eax, dword [ebp + 8]
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x100718a0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
cmp byte [0x10316198], 0
push ebx
push esi
je 0x10071911
cmp byte [0x10316199], 0
jne 0x10071952
mov byte [0x10316199], 1
xor esi, esi
nop word [eax + eax]
xor edx, edx
mov ebx, esi
xor edx, dword [0x103161ac]
xor ebx, dword [0x103161a8]
xor edx, 0xd28f2c5
xor ebx, 0x1de26cd5
mov ecx, edx
mov eax, ebx
shld ecx, eax, 0xd
shl eax, 0xd
xor edx, ecx
xor ebx, eax
mov eax, ebx
shrd eax, edx, 7
xor al, bl
xor byte [esi + 0x1031619a], al
inc esi
cmp esi, 0xc
jb 0x100718d0
jmp 0x10071952
xor esi, esi
xor edx, edx
mov ebx, esi
xor edx, dword [0x103161ac]
xor ebx, dword [0x103161a8]
xor edx, 0xd28f2c5
xor ebx, 0x1de26cd5
mov ecx, edx
mov eax, ebx
shld ecx, eax, 0xd
shl eax, 0xd
xor edx, ecx
xor ebx, eax
mov eax, ebx
shrd eax, edx, 7
xor al, bl
xor byte [esi + 0x1031619a], al
inc esi
cmp esi, 0xc
jb 0x10071913
mov ecx, dword [ebp + 8]
lea eax, [ebp - 1]
push eax
push 0x103161a5
push 0x1031619a
call fcn.10054040
mov eax, dword [ebp + 8]
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x10075700
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
mov eax, dword [0x10331c40]
xor eax, ebp
mov dword [ebp - 4], eax
cmp byte [0x10318a60], 0
mov eax, dword [ebp + 0xc]
push ebx
mov ebx, dword [ebp + 0x10]
push esi
push edi
mov edi, dword [ebp + 8]
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x24], ebx
je 0x10075782
cmp byte [0x10318a61], 0
jne 0x100757c6
mov byte [0x10318a61], 1
xor esi, esi
xor edx, edx
mov ebx, esi
xor edx, dword [0x10318a7c]
xor ebx, dword [0x10318a78]
xor edx, 0xd28f2c5
xor ebx, 0x1de26cd5
mov ecx, edx
mov eax, ebx
shld ecx, eax, 0xd
shl eax, 0xd
xor edx, ecx
xor ebx, eax
mov eax, ebx
shrd eax, edx, 7
xor al, bl
xor byte [esi + 0x10318a62], al
inc esi
cmp esi, 0x10
jb 0x10075741
jmp 0x100757c3
xor esi, esi
xor edx, edx
mov ebx, esi
xor edx, dword [0x10318a7c]
xor ebx, dword [0x10318a78]
xor edx, 0xd28f2c5
xor ebx, 0x1de26cd5
mov ecx, edx
mov eax, ebx
shld ecx, eax, 0xd
shl eax, 0xd
xor edx, ecx
xor ebx, eax
mov eax, ebx
shrd eax, edx, 7
xor al, bl
xor byte [esi + 0x10318a62], al
inc esi
cmp esi, 0x10
jb 0x10075784
mov ebx, dword [ebp - 0x24]
lea eax, [ebp - 0x1d]
push eax
push 0x10318a71
push 0x10318a62
lea ecx, [ebp - 0x1c]
call fcn.10054040
cmp dword [ebp - 8], 0xf
lea eax, [ebp - 0x1c]
cmova eax, dword [ebp - 0x1c]
push eax
push dword [ebp - 0x28]
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ecx, dword [ebp - 8]
mov esi, eax
cmp ecx, 0xf
jbe 0x10075829
mov edx, dword [ebp - 0x1c]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x1007581f
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x1007581f
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push ecx
push edx
call fcn.1015539a
add esp, 8
mov dword [ebp - 0xc], 0
mov dword [ebp - 8], 0xf
mov byte [ebp - 0x1c], 0
test esi, esi
jne 0x10075843
mov dword [edi], esi
jmp 0x10075855
cmp dword [ebx + 0x14], 0xf
jbe 0x1007584b
mov ebx, dword [ebx]
push 0
push ebx
call esi
add esp, 8
mov dword [edi], eax
mov ecx, dword [ebp - 4]
mov eax, edi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.101556c2
mov esp, ebp
pop ebp
ret 0xc
Function at 0x1007d840
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 8]
movzx eax, byte [edx]
xor eax, 0x811c9dc5
imul ecx, eax, 0x1000193
movzx eax, byte [edx + 1]
xor ecx, eax
movzx eax, byte [edx + 2]
imul ecx, ecx, 0x1000193
xor ecx, eax
movzx eax, byte [edx + 3]
imul ecx, ecx, 0x1000193
xor ecx, eax
movzx eax, byte [edx + 4]
imul ecx, ecx, 0x1000193
xor ecx, eax
movzx eax, byte [edx + 5]
imul ecx, ecx, 0x1000193
xor ecx, eax
movzx eax, byte [edx + 6]
imul ecx, ecx, 0x1000193
xor ecx, eax
movzx eax, byte [edx + 7]
imul ecx, ecx, 0x1000193
xor ecx, eax
imul eax, ecx, 0x1000193
pop ebp
ret 4

Function at 0x1007de90
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push 8
call fcn.1015536a
add esp, 4
test eax, eax
je 0x1007deb2
mov ecx, dword [ebp + 0x14]
mov ecx, dword [ecx]
mov dword [eax], ecx
mov ecx, dword [ebp + 0x10]
mov ecx, dword [ecx]
mov dword [eax + 4], ecx
jmp 0x1007deb4
xor eax, eax
push esi
mov esi, dword [ebp + 0xc]
push edi
lea edi, [esi + 4]
push edi
push 0
push eax
push 0x1007db60
push 0
push 0
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
add esp, 0x18
mov dword [esi], eax
test eax, eax
je 0x1007dedc
pop edi
pop esi
pop ebp
ret
push 6
mov dword [edi], 0
call sub.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_
int3

Function at 0x10081c20
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
cmp byte [0x1031c570], 0
push ebx
push esi
je 0x10081c91
cmp byte [0x1031c571], 0
jne 0x10081cd2
mov byte [0x1031c571], 1
xor esi, esi
nop word [eax + eax]
xor edx, edx
mov ebx, esi
xor edx, dword [0x1031c5a4]
xor ebx, dword [0x1031c5a0]
xor edx, 0xd28f2c5
xor ebx, 0x1de26cd5
mov ecx, edx
mov eax, ebx
shld ecx, eax, 0xd
shl eax, 0xd
xor edx, ecx
xor ebx, eax
mov eax, ebx
shrd eax, edx, 7
xor al, bl
xor byte [esi + 0x1031c572], al
inc esi
cmp esi, 0x28
jb 0x10081c50
jmp 0x10081cd2
xor esi, esi
xor edx, edx
mov ebx, esi
xor edx, dword [0x1031c5a4]
xor ebx, dword [0x1031c5a0]
xor edx, 0xd28f2c5
xor ebx, 0x1de26cd5
mov ecx, edx
mov eax, ebx
shld ecx, eax, 0xd
shl eax, 0xd
xor edx, ecx
xor ebx, eax
mov eax, ebx
shrd eax, edx, 7
xor al, bl
xor byte [esi + 0x1031c572], al
inc esi
cmp esi, 0x28
jb 0x10081c93
mov ecx, dword [ebp + 8]
lea eax, [ebp - 1]
push eax
push 0x1031c599
push 0x1031c572
call fcn.10054040
mov eax, dword [ebp + 8]
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x10081d20
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
cmp byte [0x1031c620], 0
push ebx
push esi
je 0x10081d94
cmp byte [0x1031c621], 0
jne 0x10081dd8
mov byte [0x1031c621], 1
xor esi, esi
nop word [eax + eax]
xor edx, edx
mov ebx, esi
xor edx, dword [0x1031c6cc]
xor ebx, dword [0x1031c6c8]
xor edx, 0xd28f2c5
xor ebx, 0x1de26cd5
mov ecx, edx
mov eax, ebx
shld ecx, eax, 0xd
shl eax, 0xd
xor edx, ecx
xor ebx, eax
mov eax, ebx
shrd eax, edx, 7
xor al, bl
xor byte [esi + 0x1031c622], al
inc esi
cmp esi, 0x9f
jb 0x10081d50
jmp 0x10081dd8
xor esi, esi
xor edx, edx
mov ebx, esi
xor edx, dword [0x1031c6cc]
xor ebx, dword [0x1031c6c8]
xor edx, 0xd28f2c5
xor ebx, 0x1de26cd5
mov ecx, edx
mov eax, ebx
shld ecx, eax, 0xd
shl eax, 0xd
xor edx, ecx
xor ebx, eax
mov eax, ebx
shrd eax, edx, 7
xor al, bl
xor byte [esi + 0x1031c622], al
inc esi
cmp esi, 0x9f
jb 0x10081d96
mov ecx, dword [ebp + 8]
lea eax, [ebp - 1]
push eax
push 0x1031c6c0
push 0x1031c622
call fcn.10054040
mov eax, dword [ebp + 8]
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x10085b10
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
cmp dword [ebp + 0xc], 1
push ebx
push esi
push edi
jne 0x10085b7c
mov eax, dword [ebp + 8]
push 0x100836a0
push 1
mov dword [0x10333ed8], eax
call dword [sym.imp.KERNEL32.dll_AddVectoredExceptionHandler]
jmp 0x10085b3a
mov eax, dword [0x1020cf3c]
sub eax, dword [0x1020cf44]
xor eax, dword [0x1020cf40]
mov ecx, dword [ebp + 8]
push 0
push 0
push dword [ebp + 0x10]
mov dword [eax + 0x6c], ecx
push 0x10083660
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
jmp 0x10085b70
mov eax, 1
pop edi
pop esi
pop ebx
pop ebp
ret 0xc
pop edi
pop esi
xor eax, eax
pop ebx
pop ebp
ret 0xc
Function at 0x10098100
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [0x10331c40]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push eax
lea eax, [ebp - 0x1c]
push 0x10337050
push eax
call fcn.1008e5e0
cmp dword [ebp - 8], 0xf
lea eax, [ebp - 0x1c]
cmova eax, dword [ebp - 0x1c]
push eax
call dword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll_remove]
mov ecx, dword [ebp - 8]
add esp, 0x10
cmp ecx, 0xf
jbe 0x1009816d
mov edx, dword [ebp - 0x1c]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x10098163
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x10098163
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push ecx
push edx
call fcn.1015539a
add esp, 8
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.101556c2
mov esp, ebp
pop ebp
ret
Function at 0x100a7ea0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
cmp byte [0x103290a8], 0
push ebx
push esi
je 0x100a7f11
cmp byte [0x103290a9], 0
jne 0x100a7f52
mov byte [0x103290a9], 1
xor esi, esi
nop word [eax + eax]
xor edx, edx
mov ebx, esi
xor edx, dword [0x103290c4]
xor ebx, dword [0x103290c0]
xor edx, 0xd28f2c5
xor ebx, 0x1de26cd5
mov ecx, edx
mov eax, ebx
shld ecx, eax, 0xd
shl eax, 0xd
xor edx, ecx
xor ebx, eax
mov eax, ebx
shrd eax, edx, 7
xor al, bl
xor byte [esi + 0x103290aa], al
inc esi
cmp esi, 0x12
jb 0x100a7ed0
jmp 0x100a7f52
xor esi, esi
xor edx, edx
mov ebx, esi
xor edx, dword [0x103290c4]
xor ebx, dword [0x103290c0]
xor edx, 0xd28f2c5
xor ebx, 0x1de26cd5
mov ecx, edx
mov eax, ebx
shld ecx, eax, 0xd
shl eax, 0xd
xor edx, ecx
xor ebx, eax
mov eax, ebx
shrd eax, edx, 7
xor al, bl
xor byte [esi + 0x103290aa], al
inc esi
cmp esi, 0x12
jb 0x100a7f13
mov ecx, dword [ebp + 8]
lea eax, [ebp - 1]
push eax
push 0x103290bb
push 0x103290aa
call fcn.10054040
mov eax, dword [ebp + 8]
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x100afd70
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 0xc]
sub esp, 8
cmp dword [edx + 0x14], 0xf
push ebx
push esi
push edi
mov ebx, ecx
mov edi, edx
jbe 0x100afd88
mov edi, dword [edx]
xor ecx, ecx
mov esi, 0x811c9dc5
cmp dword [edx + 0x10], ecx
jbe 0x100afda6
movzx eax, byte [ecx + edi]
inc ecx
xor eax, esi
imul esi, eax, 0x1000193
cmp ecx, dword [edx + 0x10]
jb 0x100afd94
push esi
push edx
lea eax, [ebp - 8]
mov ecx, ebx
push eax
call fcn.100af530
mov ecx, dword [ebp - 4]
test ecx, ecx
je 0x100afdcc
mov eax, dword [ebp + 8]
mov dword [eax], ecx
mov byte [eax + 4], 0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
cmp dword [ebx + 8], 0x4924924
je 0x100aff19
push 0x38
call fcn.1015536a
add esp, 4
mov edi, eax
push dword [ebp + 0xc]
lea ecx, [edi + 8]
call fcn.100492f0
xorps xmm0, xmm0
movups xmmword [edi + 0x20], xmm0
mov dword [edi + 0x30], 0
mov dword [edi + 0x34], 0xf
mov byte [edi + 0x20], 0
mov eax, dword [ebx + 8]
mov ecx, dword [ebx + 0x1c]
inc eax
movss xmm3, dword [ebx]
movd xmm0, eax
cvtdq2pd xmm0, xmm0
shr eax, 0x1f
addsd xmm0, qword [eax*8 + 0x101bba20]
mov eax, ecx
shr eax, 0x1f
cvtpd2ps xmm2, xmm0
movd xmm0, ecx
cvtdq2pd xmm0, xmm0
movaps xmm1, xmm2
addsd xmm0, qword [eax*8 + 0x101bba20]
cvtpd2ps xmm0, xmm0
divss xmm1, xmm0
comiss xmm1, xmm3
jbe 0x100afeb6
divss xmm2, xmm3
sub esp, 8
movss dword [ebp + 0xc], xmm2
fld dword [ebp + 0xc]
fstp qword [esp]
call sub.api_ms_win_crt_math_l1_1_0.dll_ceil
add esp, 8
fstp dword [ebp + 0xc]
movss xmm0, dword [ebp + 0xc]
call fcn.10155750
mov ecx, 8
cmp eax, ecx
cmova ecx, eax
mov eax, dword [ebx + 0x1c]
cmp eax, ecx
jae 0x100afe9a
cmp eax, 0x200
jae 0x100afe98
shl eax, 3
cmp eax, ecx
jae 0x100afe9a
mov eax, ecx
push eax
mov ecx, ebx
call fcn.100b7210
push esi
lea eax, [edi + 8]
mov ecx, ebx
push eax
lea eax, [ebp - 8]
push eax
call fcn.100af530
mov edx, dword [eax]
jmp 0x100afeb9
mov edx, dword [ebp - 8]
mov eax, dword [edx + 4]
inc dword [ebx + 8]
mov dword [edi + 4], eax
mov dword [edi], edx
mov dword [eax], edi
mov dword [edx + 4], edi
mov ecx, dword [ebx + 0xc]
mov dword [ebp + 0xc], eax
mov eax, dword [ebx + 0x18]
and eax, esi
mov esi, dword [ecx + eax*8]
cmp esi, dword [ebx + 4]
jne 0x100afee1
mov dword [ecx + eax*8], edi
jmp 0x100aff03
cmp esi, edx
jne 0x100afefa
mov dword [ecx + eax*8], edi
mov eax, dword [ebp + 8]
mov dword [eax], edi
mov byte [eax + 4], 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
mov edx, dword [ebp + 0xc]
cmp dword [ecx + eax*8 + 4], edx
jne 0x100aff07
mov dword [ecx + eax*8 + 4], edi
mov eax, dword [ebp + 8]
mov dword [eax], edi
pop edi
pop esi
mov byte [eax + 4], 1
pop ebx
mov esp, ebp
pop ebp
ret 8
push str.unordered_map_set_too_long
call sub.MSVCP140.dll_void___cdecl_std::_Xlength_error_char_const__
int3
Function at 0x100aff30
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 0xc]
sub esp, 8
cmp dword [edx + 0x14], 0xf
push ebx
push esi
push edi
mov ebx, ecx
mov edi, edx
jbe 0x100aff48
mov edi, dword [edx]
xor ecx, ecx
mov esi, 0x811c9dc5
cmp dword [edx + 0x10], ecx
jbe 0x100aff66
movzx eax, byte [ecx + edi]
inc ecx
xor eax, esi
imul esi, eax, 0x1000193
cmp ecx, dword [edx + 0x10]
jb 0x100aff54
push esi
push edx
lea eax, [ebp - 8]
mov ecx, ebx
push eax
call fcn.100af530
mov ecx, dword [ebp - 4]
test ecx, ecx
je 0x100aff8c
mov eax, dword [ebp + 8]
mov dword [eax], ecx
mov byte [eax + 4], 0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
cmp dword [ebx + 8], 0x6666666
je 0x100b00e9
push 0x28
call fcn.1015536a
add esp, 4
mov edi, eax
push dword [ebp + 0xc]
lea ecx, [edi + 8]
call fcn.100492f0
push 0x28
mov dword [edi + 0x20], 0
mov dword [edi + 0x24], 0
call fcn.1015536a
add esp, 4
mov dword [eax], eax
mov dword [eax + 4], eax
mov dword [eax + 8], eax
mov word [eax + 0xc], 0x101
mov dword [edi + 0x20], eax
mov eax, dword [ebx + 8]
mov ecx, dword [ebx + 0x1c]
inc eax
movss xmm3, dword [ebx]
movd xmm0, eax
cvtdq2pd xmm0, xmm0
shr eax, 0x1f
addsd xmm0, qword [eax*8 + 0x101bba20]
mov eax, ecx
shr eax, 0x1f
cvtpd2ps xmm2, xmm0
movd xmm0, ecx
cvtdq2pd xmm0, xmm0
movaps xmm1, xmm2
addsd xmm0, qword [eax*8 + 0x101bba20]
cvtpd2ps xmm0, xmm0
divss xmm1, xmm0
comiss xmm1, xmm3
jbe 0x100b0086
divss xmm2, xmm3
sub esp, 8
movss dword [ebp + 0xc], xmm2
fld dword [ebp + 0xc]
fstp qword [esp]
call sub.api_ms_win_crt_math_l1_1_0.dll_ceil
add esp, 8
fstp dword [ebp + 0xc]
movss xmm0, dword [ebp + 0xc]
call fcn.10155750
mov ecx, 8
cmp eax, ecx
cmova ecx, eax
mov eax, dword [ebx + 0x1c]
cmp eax, ecx
jae 0x100b006a
cmp eax, 0x200
jae 0x100b0068
shl eax, 3
cmp eax, ecx
jae 0x100b006a
mov eax, ecx
push eax
mov ecx, ebx
call fcn.100b7210
push esi
lea eax, [edi + 8]
mov ecx, ebx
push eax
lea eax, [ebp - 8]
push eax
call fcn.100af530
mov edx, dword [eax]
jmp 0x100b0089
mov edx, dword [ebp - 8]
mov eax, dword [edx + 4]
inc dword [ebx + 8]
mov dword [edi + 4], eax
mov dword [edi], edx
mov dword [eax], edi
mov dword [edx + 4], edi
mov ecx, dword [ebx + 0xc]
mov dword [ebp + 0xc], eax
mov eax, dword [ebx + 0x18]
and eax, esi
mov esi, dword [ecx + eax*8]
cmp esi, dword [ebx + 4]
jne 0x100b00b1
mov dword [ecx + eax*8], edi
jmp 0x100b00d3
cmp esi, edx
jne 0x100b00ca
mov dword [ecx + eax*8], edi
mov eax, dword [ebp + 8]
mov dword [eax], edi
mov byte [eax + 4], 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
mov edx, dword [ebp + 0xc]
cmp dword [ecx + eax*8 + 4], edx
jne 0x100b00d7
mov dword [ecx + eax*8 + 4], edi
mov eax, dword [ebp + 8]
mov dword [eax], edi
pop edi
pop esi
mov byte [eax + 4], 1
pop ebx
mov esp, ebp
pop ebp
ret 8
push str.unordered_map_set_too_long
call sub.MSVCP140.dll_void___cdecl_std::_Xlength_error_char_const__
int3
Function at 0x100b0270
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
mov esi, dword [ebp + 0xc]
push edi
mov edi, ecx
movzx eax, byte [esi]
xor eax, 0x811c9dc5
imul edx, eax, 0x1000193
movzx eax, byte [esi + 1]
xor edx, eax
movzx eax, byte [esi + 2]
imul edx, edx, 0x1000193
xor edx, eax
movzx eax, byte [esi + 3]
imul ecx, edx, 0x1000193
xor ecx, eax
lea eax, [ebp - 0xc]
imul ebx, ecx, 0x1000193
mov ecx, edi
push ebx
push esi
push eax
call fcn.1005f250
mov ecx, dword [ebp - 8]
test ecx, ecx
je 0x100b02d6
mov eax, dword [ebp + 8]
pop edi
pop esi
pop ebx
mov dword [eax], ecx
mov byte [eax + 4], 0
mov esp, ebp
pop ebp
ret 8
cmp dword [edi + 8], 0x35e50d7
je 0x100b041b
push 0x4c
call fcn.1015536a
mov ecx, dword [esi]
xorps xmm0, xmm0
mov dword [ebp - 4], eax
add esp, 4
mov dword [eax + 8], ecx
movups xmmword [eax + 0xc], xmm0
mov dword [eax + 0x1c], 0
mov dword [eax + 0x20], 0
movups xmm0, xmmword [esi + 4]
movups xmmword [eax + 0xc], xmm0
movq xmm0, qword [esi + 0x14]
movq qword [eax + 0x1c], xmm0
xorps xmm0, xmm0
mov dword [esi + 0x14], 0
mov dword [esi + 0x18], 0xf
mov byte [esi + 4], 0
movups xmmword [eax + 0x24], xmm0
mov dword [eax + 0x34], 0
mov dword [eax + 0x38], 0
movups xmm0, xmmword [esi + 0x1c]
movups xmmword [eax + 0x24], xmm0
movq xmm0, qword [esi + 0x2c]
movq qword [eax + 0x34], xmm0
mov dword [esi + 0x2c], 0
mov dword [esi + 0x30], 0xf
mov byte [esi + 0x1c], 0
mov eax, dword [esi + 0x34]
mov edx, dword [esi + 0x3c]
mov ecx, dword [esi + 0x38]
mov dword [esi + 0x3c], 0
mov dword [esi + 0x38], 0
mov dword [esi + 0x34], 0
mov esi, dword [ebp - 4]
mov dword [esi + 0x3c], eax
mov dword [esi + 0x40], ecx
mov dword [esi + 0x44], edx
mov esi, dword [ebp + 0xc]
mov eax, dword [esi + 0x40]
mov esi, dword [ebp - 4]
add esi, 8
mov dword [esi + 0x40], eax
mov eax, dword [edi + 8]
inc eax
movd xmm0, eax
cvtdq2pd xmm0, xmm0
shr eax, 0x1f
addsd xmm0, qword [eax*8 + 0x101bba20]
mov eax, dword [edi + 0x1c]
cvtpd2ps xmm1, xmm0
movd xmm0, eax
cvtdq2pd xmm0, xmm0
shr eax, 0x1f
addsd xmm0, qword [eax*8 + 0x101bba20]
cvtpd2ps xmm0, xmm0
divss xmm1, xmm0
comiss xmm1, dword [edi]
jbe 0x100b03f8
mov ecx, edi
call fcn.100b77c0
push ebx
push esi
lea eax, [ebp - 0xc]
mov ecx, edi
push eax
call fcn.1005f250
mov ecx, dword [eax]
jmp 0x100b03fb
mov ecx, dword [ebp - 0xc]
push dword [ebp - 4]
push ecx
push ebx
mov ecx, edi
call fcn.100b7760
mov ecx, dword [ebp + 8]
pop edi
pop esi
pop ebx
mov dword [ecx], eax
mov eax, ecx
mov byte [ecx + 4], 1
mov esp, ebp
pop ebp
ret 8
push str.unordered_map_set_too_long
call sub.MSVCP140.dll_void___cdecl_std::_Xlength_error_char_const__
int3