joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1009ef70
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
cmp byte [ebp + 8], 0
push edi
mov edi, ecx
je 0x1009ef83
mov dword [edi + 0x6c], 0
push ebx
push esi
push 0x10167412
lea ecx, [edi + 0x24]
mov word [edi], 0
mov byte [edi + 2], 0
mov dword [edi + 4], 0
mov dword [edi + 8], 0
mov dword [edi + 0xc], 0
mov dword [edi + 0x10], 0x3e99999a
mov dword [edi + 0x14], 0
mov dword [edi + 0x18], 0
mov dword [edi + 0x1c], 0
mov dword [edi + 0x20], 0
call fcn.10056d60
push 0x10167412
lea ecx, [edi + 0x3c]
call fcn.10056d60
push 0x10167412
lea ecx, [edi + 0x54]
call fcn.10056d60
mov dword [edi + 0xa4], 0
lea esi, [edi + 0x8ca]
mov dword [edi + 0xa0], 0
mov ebx, 0x19
mov dword [edi + 0x9c], 0
mov dword [edi + 0xb0], 0
mov dword [edi + 0xac], 0
mov dword [edi + 0xa8], 0
mov dword [edi + 0xbc], 0
mov dword [edi + 0xb8], 0
mov dword [edi + 0xb4], 0
mov byte [edi + 0x70], 0
mov dword [edi + 0x74], 0
mov dword [edi + 0x78], 0
mov dword [edi + 0x7c], 0
mov dword [edi + 0x80], 0
mov dword [edi + 0x84], 0
mov dword [edi + 0x88], 0
mov byte [edi + 0x8c], 0
mov dword [edi + 0x90], 0
mov dword [edi + 0x94], 0
mov dword [edi + 0x98], 0
nop
cmp byte [esi - 0xa], 0
je 0x1009f0f5
mov dword [esi - 6], 0
lea ecx, [esi + 0xa]
mov dword [esi - 2], 0
push 0x10167412
mov dword [esi + 2], 0
mov dword [esi + 6], 0
mov dword [esi + 0x2a], 0x3f800000
call fcn.10056d60
mov dword [esi + 0x22], 0
mov byte [esi - 0xa], 0
mov byte [esi + 0x26], 0
add esi, 0x38
sub ebx, 1
jne 0x1009f0b0
pop esi
pop ebx
push 0x400
lea eax, [edi + 0xc0]
push 0
push eax
call sub.VCRUNTIME140.dll_memset
push 0x400
lea eax, [edi + 0x4c0]
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0x18
pop edi
pop ebp
ret 4

Function at 0x1009f230
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push dword [ebp + 0x10]
lea eax, [ebp - 8]
mov dword [ebp - 8], 0x43800000
push 0
push 0
push eax
push dword [ebp + 8]
mov dword [ebp - 4], 0x42000000
call fcn.1009f2d0
test al, al
je 0x1009f2ad
test byte [ebp + 0x10], 1
jne 0x1009f2ad
push 4
call fcn.10102cea
add esp, 4
test eax, eax
je 0x1009f276
mov ecx, dword [ebp + 0xc]
mov dword [eax], ecx
jmp 0x1009f278
xor eax, eax
lea ecx, [ebp - 4]
push ecx
push 0
push eax
push 0x1009f200
push 0
push 0
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
add esp, 0x18
mov dword [ebp - 8], eax
test eax, eax
je 0x1009f2ba
mov ecx, dword [ebp - 4]
test ecx, ecx
je 0x1009f2b3
push ecx
push eax
call sub.MSVCP140.dll__Thrd_detach
add esp, 8
test eax, eax
jne 0x1009f2b3
mov esp, ebp
pop ebp
ret 0xc
push 1
call sub.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_
push 6
mov dword [ebp - 4], 0
call sub.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_
int3
Function at 0x100c41e0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov edx, 0xcbf29ce4
xor esi, esi
mov dword [ebp + 8], edx
mov ecx, 0x84222325
cmp byte [edi], 0
je 0x100c4207
nop dword [eax]
inc esi
cmp byte [edi + esi], 0
jne 0x100c4200
xor ebx, ebx
test esi, esi
je 0x100c4235
nop dword [eax]
movsx eax, byte [edi + ebx]
push 0x100
cdq
xor edx, dword [ebp + 8]
xor eax, ecx
push 0x1b3
push edx
push eax
call fcn.10103310
inc ebx
mov dword [ebp + 8], edx
mov ecx, eax
cmp ebx, esi
jb 0x100c4210
pop edi
pop esi
mov eax, ecx
pop ebx
pop ebp
ret
Function at 0x100cb290
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
cmp byte [0x1018c006], 0
mov dword [ebp - 4], ecx
je 0x100cb41b
mov ecx, dword [ebp + 8]
push ebx
push esi
push edi
mov eax, dword [ecx]
call dword [eax + 4]
mov ebx, eax
xor esi, esi
mov ecx, 0x84222325
mov edi, 0xcbf29ce4
cmp byte [ebx], 0
je 0x100cb2cb
inc esi
cmp byte [ebx + esi], 0
jne 0x100cb2c4
xor eax, eax
mov dword [ebp - 8], eax
test esi, esi
je 0x100cb418
nop dword [eax + eax]
movsx eax, byte [ebx + eax]
push 0x100
cdq
push 0x1b3
xor edx, edi
xor eax, ecx
push edx
push eax
call fcn.10103310
mov ecx, eax
mov edi, edx
mov eax, dword [ebp - 8]
inc eax
mov dword [ebp - 8], eax
cmp eax, esi
jb 0x100cb2e0
cmp edi, 0x3943e50e
ja 0x100cb3fd
jb 0x100cb323
cmp ecx, 0x2bb2e9fe
ja 0x100cb3fd
cmp ecx, 0x2bb2e9fe
jne 0x100cb3b5
cmp edi, 0x3943e50e
jne 0x100cb3b5
mov ecx, dword [0x1018c07c]
test ecx, ecx
je 0x100cb418
mov eax, dword [0x1024c85c]
test al, 1
jne 0x100cb362
or eax, 1
mov dword [0x1024c85c], eax
mov eax, dword [0x1024c854]
mov dword [0x1024c858], eax
jmp 0x100cb367
mov eax, dword [0x1024c858]
cmp dword [eax + ecx], 0
jne 0x100cb418
mov eax, dword [0x1024c864]
test al, 1
jne 0x100cb38e
or eax, 1
mov dword [0x1024c864], eax
mov eax, dword [0x1024c850]
mov dword [0x1024c860], eax
jmp 0x100cb393
mov eax, dword [0x1024c860]
cmp dword [eax + ecx], 0
jle 0x100cb418
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 8]
cmp ecx, dword [eax + 0xc]
je 0x100cb418
cmp byte [ecx], 0
jne 0x100cb418
pop edi
pop esi
mov byte [ecx], 1
pop ebx
mov esp, ebp
pop ebp
ret 4
cmp ecx, 0x5de24d68
jne 0x100cb3d9
cmp edi, 0x4251ee7
jne 0x100cb3d9
push dword [ebp + 8]
mov ecx, dword [ebp - 4]
call fcn.100cad50
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
cmp ecx, 0xedb6640
jne 0x100cb418
cmp edi, 0x1baa64fb
jne 0x100cb418
push dword [ebp + 8]
mov ecx, dword [ebp - 4]
call fcn.100cbf40
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
cmp ecx, 0xb118f470
jne 0x100cb418
cmp edi, 0xd089c265
jne 0x100cb418
push dword [ebp + 8]
mov ecx, dword [ebp - 4]
call fcn.100cb8b0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x100cbf40
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
mov eax, dword [0x1024b8c0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, ecx
push edi
mov dword [ebp - 0x24], ebx
lea edi, [ebx + 0x13fc]
lea eax, [edi + 0x104]
cmp eax, edi
sbb ecx, ecx
and ecx, 0xffffffbf
add ecx, 0x41
cmp edi, eax
ja 0x100cbf75
xor eax, eax
rep stosd dword es:[edi], eax
lea ecx, [ebx + 0xb0]
lea edx, [ecx + 0x134c]
cmp ecx, edx
je 0x100cc027
add ecx, 0x44
nop dword [eax]
mov eax, dword [ecx - 0x40]
cmp eax, dword [ecx - 0x3c]
je 0x100cbf9b
mov dword [ecx - 0x3c], eax
cmp byte [ecx - 0x34], 0
je 0x100cc00c
mov dword [ecx - 0x34], 0
mov word [ecx - 0x30], 0
mov byte [ecx - 0x2e], 0
mov dword [ecx - 0x2c], 0xffffffff
mov dword [ecx - 0x28], 0
mov dword [ecx - 0x24], 0
mov dword [ecx - 0x18], 0
mov dword [ecx - 0x20], 0
mov dword [ecx - 0x1c], 0
mov dword [ecx - 0x14], 0
mov dword [ecx - 0x10], 0
mov dword [ecx - 0xc], 0
mov dword [ecx - 8], 0
mov dword [ecx + 4], 0
mov dword [ecx], 0
mov dword [ecx - 4], 0
cmp dword [ecx - 0x44], 0
je 0x100cc019
mov dword [ecx - 0x44], 0
add ecx, 0x4c
lea eax, [ecx - 0x44]
cmp eax, edx
jne 0x100cbf90
cmp byte [0x1018c013], 0
jne 0x100cc037
mov byte [0x1018c013], 1
test byte [0x10254734], 4
push esi
je 0x100cc150
cmp byte [0x10246cd0], 0
mov edi, dword [0x102576ac]
je 0x100cc0b1
cmp byte [0x10246cd1], 0
jne 0x100cc0f5
mov byte [0x10246cd1], 1
xor esi, esi
nop word [eax + eax]
xor edx, edx
mov ebx, esi
xor edx, dword [0x10246d0c]
xor ebx, dword [0x10246d08]
xor edx, 0xd28f2c5
xor ebx, 0x1de26cd5
mov ecx, edx
mov eax, ebx
shld ecx, eax, 0xd
shl eax, 0xd
xor edx, ecx
xor ebx, eax
mov eax, ebx
shrd eax, edx, 7
xor al, bl
xor byte [esi + 0x10246cd2], al
inc esi
cmp esi, 0x30
jb 0x100cc070
jmp 0x100cc0f2
xor esi, esi
xor edx, edx
mov ebx, esi
xor edx, dword [0x10246d0c]
xor ebx, dword [0x10246d08]
xor edx, 0xd28f2c5
xor ebx, 0x1de26cd5
mov ecx, edx
mov eax, ebx
shld ecx, eax, 0xd
shl eax, 0xd
xor edx, ecx
xor ebx, eax
mov eax, ebx
shrd eax, edx, 7
xor al, bl
xor byte [esi + 0x10246cd2], al
inc esi
cmp esi, 0x30
jb 0x100cc0b3
mov ebx, dword [ebp - 0x24]
lea eax, [ebp - 0x1d]
push eax
push 0x10246d01
push 0x10246cd2
lea ecx, [ebp - 0x1c]
call fcn.1004f960
push 1
push 0xffffffffffffffff
lea eax, [ebp - 0x1c]
mov ecx, edi
push eax
call fcn.100f2e90
mov ecx, dword [ebp - 8]
cmp ecx, 0xf
jbe 0x100cc150
mov edx, dword [ebp - 0x1c]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x100cc146
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x100cc146
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push ecx
push edx
call fcn.10102d1a
add esp, 8
mov eax, dword [ebx + 8]
lea esi, [ebx + 8]
mov ecx, dword [esi + 4]
cmp eax, ecx
je 0x100cc16d
push esi
push ecx
push eax
call fcn.100c9660
mov eax, dword [esi]
add esp, 0xc
mov dword [esi + 4], eax
mov ecx, dword [ebp - 4]
pop esi
pop edi
xor ecx, ebp
pop ebx
call fcn.10103042
mov esp, ebp
pop ebp
ret 4
Function at 0x100dcd70
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov edx, dword [ebp + 0xc]
mov eax, ecx
push ebx
push esi
push edi
cmp dword [edx + 0x14], 0xf
mov edi, edx
mov ebx, dword [edx + 0x10]
mov dword [ebp - 4], eax
jbe 0x100dcd8e
mov edi, dword [edx]
xor ecx, ecx
mov esi, 0x811c9dc5
test ebx, ebx
je 0x100dcdb4
nop dword [eax]
movzx eax, byte [edi + ecx]
inc ecx
xor eax, esi
imul esi, eax, 0x1000193
cmp ecx, ebx
jb 0x100dcda0
mov eax, dword [ebp - 4]
push esi
push edx
lea ecx, [ebp - 0xc]
push ecx
mov ecx, eax
call fcn.100db5f0
pop edi
pop esi
pop ebx
mov ecx, dword [eax + 4]
mov eax, dword [ebp + 8]
test ecx, ecx
jne 0x100dcdd4
mov ecx, dword [ebp - 4]
mov ecx, dword [ecx + 4]
mov dword [eax], ecx
mov esp, ebp
pop ebp
ret 8

Function at 0x100dcef0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
mov esi, ecx
push edi
cmp byte [esi], 0
lea edi, [esi + 2]
je 0x100dcf57
cmp byte [esi + 1], 0
jne 0x100dcf9c
xor ecx, ecx
mov byte [esi + 1], 1
mov dword [ebp - 8], ecx
mov ebx, ecx
xor edx, edx
xor edx, dword [esi + 0x2c]
xor ebx, dword [esi + 0x28]
xor edx, 0xd28f2c5
xor ebx, 0x1de26cd5
mov ecx, edx
mov eax, ebx
shld ecx, eax, 0xd
shl eax, 0xd
xor edx, ecx
mov ecx, dword [ebp - 8]
xor ebx, eax
mov eax, ebx
shrd eax, edx, 7
xor al, byte [edi + ecx]
xor al, bl
mov byte [edi + ecx], al
inc ecx
mov dword [ebp - 8], ecx
cmp ecx, 0x24
jb 0x100dcf16
jmp 0x100dcf9c
xor ecx, ecx
mov dword [ebp - 8], ecx
nop dword [eax]
mov ebx, ecx
xor edx, edx
xor edx, dword [esi + 0x2c]
xor ebx, dword [esi + 0x28]
xor edx, 0xd28f2c5
xor ebx, 0x1de26cd5
mov ecx, edx
mov eax, ebx
shld ecx, eax, 0xd
shl eax, 0xd
xor edx, ecx
mov ecx, dword [ebp - 8]
xor ebx, eax
mov eax, ebx
shrd eax, edx, 7
xor al, bl
xor byte [edi + ecx], al
inc ecx
mov dword [ebp - 8], ecx
cmp ecx, 0x24
jb 0x100dcf60
mov ecx, dword [ebp + 8]
lea eax, [ebp - 1]
push eax
lea eax, [esi + 0x25]
push eax
push edi
call fcn.1004f960
mov eax, dword [ebp + 8]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x100dcfc0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
mov esi, ecx
push edi
cmp byte [esi], 0
lea edi, [esi + 2]
je 0x100dd027
cmp byte [esi + 1], 0
jne 0x100dd06c
xor ecx, ecx
mov byte [esi + 1], 1
mov dword [ebp - 8], ecx
mov ebx, ecx
xor edx, edx
xor edx, dword [esi + 0x44]
xor ebx, dword [esi + 0x40]
xor edx, 0xd28f2c5
xor ebx, 0x1de26cd5
mov ecx, edx
mov eax, ebx
shld ecx, eax, 0xd
shl eax, 0xd
xor edx, ecx
mov ecx, dword [ebp - 8]
xor ebx, eax
mov eax, ebx
shrd eax, edx, 7
xor al, byte [edi + ecx]
xor al, bl
mov byte [edi + ecx], al
inc ecx
mov dword [ebp - 8], ecx
cmp ecx, 0x3a
jb 0x100dcfe6
jmp 0x100dd06c
xor ecx, ecx
mov dword [ebp - 8], ecx
nop dword [eax]
mov ebx, ecx
xor edx, edx
xor edx, dword [esi + 0x44]
xor ebx, dword [esi + 0x40]
xor edx, 0xd28f2c5
xor ebx, 0x1de26cd5
mov ecx, edx
mov eax, ebx
shld ecx, eax, 0xd
shl eax, 0xd
xor edx, ecx
mov ecx, dword [ebp - 8]
xor ebx, eax
mov eax, ebx
shrd eax, edx, 7
xor al, bl
xor byte [edi + ecx], al
inc ecx
mov dword [ebp - 8], ecx
cmp ecx, 0x3a
jb 0x100dd030
mov ecx, dword [ebp + 8]
lea eax, [ebp - 1]
push eax
lea eax, [esi + 0x3b]
push eax
push edi
call fcn.1004f960
mov eax, dword [ebp + 8]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x100dd090
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
mov esi, ecx
push edi
cmp byte [esi], 0
lea edi, [esi + 2]
je 0x100dd0f7
cmp byte [esi + 1], 0
jne 0x100dd13c
xor ecx, ecx
mov byte [esi + 1], 1
mov dword [ebp - 8], ecx
mov ebx, ecx
xor edx, edx
xor edx, dword [esi + 0x44]
xor ebx, dword [esi + 0x40]
xor edx, 0xd28f2c5
xor ebx, 0x1de26cd5
mov ecx, edx
mov eax, ebx
shld ecx, eax, 0xd
shl eax, 0xd
xor edx, ecx
mov ecx, dword [ebp - 8]
xor ebx, eax
mov eax, ebx
shrd eax, edx, 7
xor al, byte [edi + ecx]
xor al, bl
mov byte [edi + ecx], al
inc ecx
mov dword [ebp - 8], ecx
cmp ecx, 0x3b
jb 0x100dd0b6
jmp 0x100dd13c
xor ecx, ecx
mov dword [ebp - 8], ecx
nop dword [eax]
mov ebx, ecx
xor edx, edx
xor edx, dword [esi + 0x44]
xor ebx, dword [esi + 0x40]
xor edx, 0xd28f2c5
xor ebx, 0x1de26cd5
mov ecx, edx
mov eax, ebx
shld ecx, eax, 0xd
shl eax, 0xd
xor edx, ecx
mov ecx, dword [ebp - 8]
xor ebx, eax
mov eax, ebx
shrd eax, edx, 7
xor al, bl
xor byte [edi + ecx], al
inc ecx
mov dword [ebp - 8], ecx
cmp ecx, 0x3b
jb 0x100dd100
mov ecx, dword [ebp + 8]
lea eax, [ebp - 1]
push eax
lea eax, [esi + 0x3c]
push eax
push edi
call fcn.1004f960
mov eax, dword [ebp + 8]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x100dd160
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
mov esi, ecx
push edi
cmp byte [esi], 0
lea edi, [esi + 2]
je 0x100dd1c7
cmp byte [esi + 1], 0
jne 0x100dd20c
xor ecx, ecx
mov byte [esi + 1], 1
mov dword [ebp - 8], ecx
mov ebx, ecx
xor edx, edx
xor edx, dword [esi + 0x44]
xor ebx, dword [esi + 0x40]
xor edx, 0xd28f2c5
xor ebx, 0x1de26cd5
mov ecx, edx
mov eax, ebx
shld ecx, eax, 0xd
shl eax, 0xd
xor edx, ecx
mov ecx, dword [ebp - 8]
xor ebx, eax
mov eax, ebx
shrd eax, edx, 7
xor al, byte [edi + ecx]
xor al, bl
mov byte [edi + ecx], al
inc ecx
mov dword [ebp - 8], ecx
cmp ecx, 0x3d
jb 0x100dd186
jmp 0x100dd20c
xor ecx, ecx
mov dword [ebp - 8], ecx
nop dword [eax]
mov ebx, ecx
xor edx, edx
xor edx, dword [esi + 0x44]
xor ebx, dword [esi + 0x40]
xor edx, 0xd28f2c5
xor ebx, 0x1de26cd5
mov ecx, edx
mov eax, ebx
shld ecx, eax, 0xd
shl eax, 0xd
xor edx, ecx
mov ecx, dword [ebp - 8]
xor ebx, eax
mov eax, ebx
shrd eax, edx, 7
xor al, bl
xor byte [edi + ecx], al
inc ecx
mov dword [ebp - 8], ecx
cmp ecx, 0x3d
jb 0x100dd1d0
mov ecx, dword [ebp + 8]
lea eax, [ebp - 1]
push eax
lea eax, [esi + 0x3e]
push eax
push edi
call fcn.1004f960
mov eax, dword [ebp + 8]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x100dd230
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
mov esi, ecx
push edi
cmp byte [esi], 0
lea edi, [esi + 2]
je 0x100dd297
cmp byte [esi + 1], 0
jne 0x100dd2dc
xor ecx, ecx
mov byte [esi + 1], 1
mov dword [ebp - 8], ecx
mov ebx, ecx
xor edx, edx
xor edx, dword [esi + 0x4c]
xor ebx, dword [esi + 0x48]
xor edx, 0xd28f2c5
xor ebx, 0x1de26cd5
mov ecx, edx
mov eax, ebx
shld ecx, eax, 0xd
shl eax, 0xd
xor edx, ecx
mov ecx, dword [ebp - 8]
xor ebx, eax
mov eax, ebx
shrd eax, edx, 7
xor al, byte [edi + ecx]
xor al, bl
mov byte [edi + ecx], al
inc ecx
mov dword [ebp - 8], ecx
cmp ecx, 0x40
jb 0x100dd256
jmp 0x100dd2dc
xor ecx, ecx
mov dword [ebp - 8], ecx
nop dword [eax]
mov ebx, ecx
xor edx, edx
xor edx, dword [esi + 0x4c]
xor ebx, dword [esi + 0x48]
xor edx, 0xd28f2c5
xor ebx, 0x1de26cd5
mov ecx, edx
mov eax, ebx
shld ecx, eax, 0xd
shl eax, 0xd
xor edx, ecx
mov ecx, dword [ebp - 8]
xor ebx, eax
mov eax, ebx
shrd eax, edx, 7
xor al, bl
xor byte [edi + ecx], al
inc ecx
mov dword [ebp - 8], ecx
cmp ecx, 0x40
jb 0x100dd2a0
mov ecx, dword [ebp + 8]
lea eax, [ebp - 1]
push eax
lea eax, [esi + 0x41]
push eax
push edi
call fcn.1004f960
mov eax, dword [ebp + 8]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x100dd300
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
mov esi, ecx
push edi
cmp byte [esi], 0
lea edi, [esi + 2]
je 0x100dd367
cmp byte [esi + 1], 0
jne 0x100dd3ac
xor ecx, ecx
mov byte [esi + 1], 1
mov dword [ebp - 8], ecx
mov ebx, ecx
xor edx, edx
xor edx, dword [esi + 0x4c]
xor ebx, dword [esi + 0x48]
xor edx, 0xd28f2c5
xor ebx, 0x1de26cd5
mov ecx, edx
mov eax, ebx
shld ecx, eax, 0xd
shl eax, 0xd
xor edx, ecx
mov ecx, dword [ebp - 8]
xor ebx, eax
mov eax, ebx
shrd eax, edx, 7
xor al, byte [edi + ecx]
xor al, bl
mov byte [edi + ecx], al
inc ecx
mov dword [ebp - 8], ecx
cmp ecx, 0x41
jb 0x100dd326
jmp 0x100dd3ac
xor ecx, ecx
mov dword [ebp - 8], ecx
nop dword [eax]
mov ebx, ecx
xor edx, edx
xor edx, dword [esi + 0x4c]
xor ebx, dword [esi + 0x48]
xor edx, 0xd28f2c5
xor ebx, 0x1de26cd5
mov ecx, edx
mov eax, ebx
shld ecx, eax, 0xd
shl eax, 0xd
xor edx, ecx
mov ecx, dword [ebp - 8]
xor ebx, eax
mov eax, ebx
shrd eax, edx, 7
xor al, bl
xor byte [edi + ecx], al
inc ecx
mov dword [ebp - 8], ecx
cmp ecx, 0x41
jb 0x100dd370
mov ecx, dword [ebp + 8]
lea eax, [ebp - 1]
push eax
lea eax, [esi + 0x42]
push eax
push edi
call fcn.1004f960
mov eax, dword [ebp + 8]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x100dd3d0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
mov esi, ecx
push edi
cmp byte [esi], 0
lea edi, [esi + 2]
je 0x100dd437
cmp byte [esi + 1], 0
jne 0x100dd47c
xor ecx, ecx
mov byte [esi + 1], 1
mov dword [ebp - 8], ecx
mov ebx, ecx
xor edx, edx
xor edx, dword [esi + 0x4c]
xor ebx, dword [esi + 0x48]
xor edx, 0xd28f2c5
xor ebx, 0x1de26cd5
mov ecx, edx
mov eax, ebx
shld ecx, eax, 0xd
shl eax, 0xd
xor edx, ecx
mov ecx, dword [ebp - 8]
xor ebx, eax
mov eax, ebx
shrd eax, edx, 7
xor al, byte [edi + ecx]
xor al, bl
mov byte [edi + ecx], al
inc ecx
mov dword [ebp - 8], ecx
cmp ecx, 0x42
jb 0x100dd3f6
jmp 0x100dd47c
xor ecx, ecx
mov dword [ebp - 8], ecx
nop dword [eax]
mov ebx, ecx
xor edx, edx
xor edx, dword [esi + 0x4c]
xor ebx, dword [esi + 0x48]
xor edx, 0xd28f2c5
xor ebx, 0x1de26cd5
mov ecx, edx
mov eax, ebx
shld ecx, eax, 0xd
shl eax, 0xd
xor edx, ecx
mov ecx, dword [ebp - 8]
xor ebx, eax
mov eax, ebx
shrd eax, edx, 7
xor al, bl
xor byte [edi + ecx], al
inc ecx
mov dword [ebp - 8], ecx
cmp ecx, 0x42
jb 0x100dd440
mov ecx, dword [ebp + 8]
lea eax, [ebp - 1]
push eax
lea eax, [esi + 0x43]
push eax
push edi
call fcn.1004f960
mov eax, dword [ebp + 8]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x100dd4a0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
cmp byte [0x10249a48], 0
push ebx
push esi
je 0x100dd517
cmp byte [0x10249a49], 0
jne 0x100dd565
mov byte [0x10249a49], 1
xor esi, esi
nop word [eax + eax]
xor edx, edx
mov ebx, esi
xor edx, dword [0x10249a6c]
xor ebx, dword [0x10249a68]
xor edx, 0xd28f2c5
xor ebx, 0x1de26cd5
mov ecx, edx
mov eax, ebx
shld ecx, eax, 0xd
shl eax, 0xd
xor edx, ecx
xor ebx, eax
mov eax, ebx
shrd eax, edx, 7
xor al, byte [esi + str.H_t_]
xor al, bl
mov byte [esi + str.H_t_], al
inc esi
cmp esi, 0x19
jb 0x100dd4d0
jmp 0x100dd565
xor esi, esi
nop dword [eax]
xor edx, edx
mov ebx, esi
xor edx, dword [0x10249a6c]
xor ebx, dword [0x10249a68]
xor edx, 0xd28f2c5
xor ebx, 0x1de26cd5
mov ecx, edx
mov eax, ebx
shld ecx, eax, 0xd
shl eax, 0xd
xor edx, ecx
xor ebx, eax
mov eax, ebx
shrd eax, edx, 7
xor al, byte [esi + str.H_t_]
xor al, bl
mov byte [esi + str.H_t_], al
inc esi
cmp esi, 0x19
jb 0x100dd520
mov ecx, dword [ebp + 8]
lea eax, [ebp - 1]
push eax
push 0x10249a62
push str.H_t_
call fcn.1004f960
mov eax, dword [ebp + 8]
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x100dd590
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
cmp byte [0x10249a78], 0
push ebx
push esi
je 0x100dd607
cmp byte [0x10249a79], 0
jne 0x100dd655
mov byte [0x10249a79], 1
xor esi, esi
nop word [eax + eax]
xor edx, edx
mov ebx, esi
xor edx, dword [0x10249a94]
xor ebx, dword [0x10249a90]
xor edx, 0xd28f2c5
xor ebx, 0x1de26cd5
mov ecx, edx
mov eax, ebx
shld ecx, eax, 0xd
shl eax, 0xd
xor edx, ecx
xor ebx, eax
mov eax, ebx
shrd eax, edx, 7
xor al, byte [esi + 0x10249a7a]
xor al, bl
mov byte [esi + 0x10249a7a], al
inc esi
cmp esi, 0x14
jb 0x100dd5c0
jmp 0x100dd655
xor esi, esi
nop dword [eax]
xor edx, edx
mov ebx, esi
xor edx, dword [0x10249a94]
xor ebx, dword [0x10249a90]
xor edx, 0xd28f2c5
xor ebx, 0x1de26cd5
mov ecx, edx
mov eax, ebx
shld ecx, eax, 0xd
shl eax, 0xd
xor edx, ecx
xor ebx, eax
mov eax, ebx
shrd eax, edx, 7
xor al, byte [esi + 0x10249a7a]
xor al, bl
mov byte [esi + 0x10249a7a], al
inc esi
cmp esi, 0x14
jb 0x100dd610
mov ecx, dword [ebp + 8]
lea eax, [ebp - 1]
push eax
push 0x10249a8d
push 0x10249a7a
call fcn.1004f960
mov eax, dword [ebp + 8]
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x100dd680
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
cmp byte [0x10249868], 0
push ebx
push esi
je 0x100dd6f7
cmp byte [0x10249869], 0
jne 0x100dd745
mov byte [0x10249869], 1
xor esi, esi
nop word [eax + eax]
xor edx, edx
mov ebx, esi
xor edx, dword [0x102498a4]
xor ebx, dword [0x102498a0]
xor edx, 0xd28f2c5
xor ebx, 0x1de26cd5
mov ecx, edx
mov eax, ebx
shld ecx, eax, 0xd
shl eax, 0xd
xor edx, ecx
xor ebx, eax
mov eax, ebx
shrd eax, edx, 7
xor al, byte [esi + 0x1024986a]
xor al, bl
mov byte [esi + 0x1024986a], al
inc esi
cmp esi, 0x31
jb 0x100dd6b0
jmp 0x100dd745
xor esi, esi
nop dword [eax]
xor edx, edx
mov ebx, esi
xor edx, dword [0x102498a4]
xor ebx, dword [0x102498a0]
xor edx, 0xd28f2c5
xor ebx, 0x1de26cd5
mov ecx, edx
mov eax, ebx
shld ecx, eax, 0xd
shl eax, 0xd
xor edx, ecx
xor ebx, eax
mov eax, ebx
shrd eax, edx, 7
xor al, byte [esi + 0x1024986a]
xor al, bl
mov byte [esi + 0x1024986a], al
inc esi
cmp esi, 0x31
jb 0x100dd700
mov ecx, dword [ebp + 8]
lea eax, [ebp - 1]
push eax
push 0x1024989a
push 0x1024986a
call fcn.1004f960
mov eax, dword [ebp + 8]
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x100dd990
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov edx, dword [ebp + 8]
mov eax, ecx
push ebx
push esi
push edi
cmp dword [edx + 0x14], 0xf
mov edi, edx
mov ebx, dword [edx + 0x10]
mov dword [ebp - 4], eax
jbe 0x100dd9ae
mov edi, dword [edx]
xor ecx, ecx
mov esi, 0x811c9dc5
test ebx, ebx
je 0x100dd9d4
nop dword [eax]
movzx eax, byte [edi + ecx]
inc ecx
xor eax, esi
imul esi, eax, 0x1000193
cmp ecx, ebx
jb 0x100dd9c0
mov eax, dword [ebp - 4]
push esi
push edx
lea ecx, [ebp - 8]
push ecx
mov ecx, eax
call fcn.100db5f0
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
test eax, eax
je 0x100dd9f4
add eax, 0x20
mov esp, ebp
pop ebp
ret 4
push str.invalid_unordered_map_K__T__key
call sub.MSVCP140.dll_void___cdecl_std::_Xout_of_range_char_const__
int3