joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100587a0
Capabilities:
Enumerate pe sections
Parse pe header
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1008c060
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x218
push ebx
xor bl, bl
push 0
mov byte [ebp - 0xd], bl
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov dword [ebp - 0x1c], eax
test eax, eax
je 0x100588b9
push esi
push edi
push 0x104
lea eax, [ebp - 0x224]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea eax, [ebp - 0x224]
push 0x100a9d9c
push eax
call dword [sym.imp.msvcrt.dll__wfopen]
mov esi, dword [sym.imp.msvcrt.dll_fseek]
mov ebx, eax
push 2
push 0
push ebx
call esi
push ebx
call dword [sym.imp.msvcrt.dll_ftell]
push 0
push 0
push ebx
mov edi, eax
call esi
push edi
call fcn.1007b784
push ebx
push 1
mov esi, eax
push edi
push esi
mov dword [ebp - 0x14], esi
call dword [sym.imp.msvcrt.dll_fread]
push ebx
call dword [sym.imp.msvcrt.dll_fclose]
mov eax, 0x5a4d
add esp, 0x3c
cmp word [esi], ax
jne 0x100588ab
mov ecx, dword [esi + 0x3c]
add ecx, esi
cmp dword [ecx], 0x4550
jne 0x100588ab
movzx eax, word [ecx + 0x14]
xor esi, esi
movzx ebx, word [ecx + 6]
add eax, 0x18
add eax, ecx
mov dword [ebp - 0x18], eax
test ebx, ebx
je 0x100588a8
mov edi, eax
nop dword [eax]
mov eax, edi
mov ecx, str..bind
mov dl, byte [ecx]
cmp dl, byte [eax]
jne 0x10058897
test dl, dl
je 0x10058893
mov dl, byte [ecx + 1]
cmp dl, byte [eax + 1]
jne 0x10058897
add ecx, 2
add eax, 2
test dl, dl
jne 0x10058877
xor eax, eax
jmp 0x1005889c
sbb eax, eax
or eax, 1
test eax, eax
je 0x100588cc
inc esi
add edi, 0x28
cmp esi, ebx
jl 0x10058870
mov esi, dword [ebp - 0x14]
mov bl, byte [ebp - 0xd]
push esi
call fcn.1007b6ca
add esp, 4
pop edi
pop esi
mov ecx, dword [ebp - 0xc]
mov al, bl
pop ebx
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 0x10
mov ecx, dword [ebp - 0x18]
lea eax, [esi + esi*4]
mov esi, dword [ebp - 0x14]
lea edx, [ecx + eax*8]
mov eax, dword [ebp + 0x10]
mov bl, 1
mov ecx, dword [edx + 0xc]
add ecx, dword [ebp - 0x1c]
mov dword [eax], ecx
mov ecx, dword [edx + 0x10]
cmp ecx, dword [edx + 8]
mov eax, dword [ebp + 0x14]
cmovbe ecx, dword [edx + 8]
mov dword [eax], ecx
jmp 0x100588ae
Function at 0x10058900
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1008c07d
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ebx
sub esp, 0x148
push esi
push edi
mov edi, dword [ebx + 8]
mov esi, ecx
mov dword [ebp - 0x14], esi
test edi, edi
jne 0x1005894c
push edi
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
jmp 0x10058acb
xorps xmm0, xmm0
mov dword [ebp - 0x20], 0
push edi
movups xmmword [ebp - 0x30], xmm0
mov dword [ebp - 0x1c], 0
call dword [sym.imp.msvcrt.dll_strlen]
add esp, 4
lea ecx, [ebp - 0x30]
push eax
push edi
call fcn.10007e96
cmp dword [ebp - 0x1c], 0x10
lea eax, [esi + 0x14]
lea esi, [ebp - 0x30]
mov dword [ebp - 0x18], eax
cmovae esi, dword [ebp - 0x30]
mov edx, 0x811c9dc5
xor ecx, ecx
cmp dword [ebp - 0x20], ecx
jbe 0x100589a7
movzx eax, byte [ecx + esi]
inc ecx
xor eax, edx
imul edx, eax, 0x1000193
cmp ecx, dword [ebp - 0x20]
jb 0x10058992
mov eax, dword [ebp - 0x18]
push edx
lea ecx, [ebp - 0x30]
push ecx
lea ecx, [ebp - 0x50]
push ecx
mov ecx, eax
call fcn.1005b310
mov esi, dword [eax + 4]
test esi, esi
jne 0x100589c4
mov esi, dword [ebp - 0x14]
mov esi, dword [esi + 0x18]
mov ecx, dword [ebp - 0x1c]
cmp ecx, 0x10
jb 0x100589f8
mov edx, dword [ebp - 0x30]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x100589ee
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x10058ae0
push ecx
push edx
call fcn.1007b699
add esp, 8
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x1c], 0xf
mov byte [ebp - 0x30], 0
cmp esi, dword [eax + 0x18]
jne 0x10058ac6
xorps xmm0, xmm0
mov dword [ebp - 0x38], 0
push edi
movups xmmword [ebp - 0x48], xmm0
mov dword [ebp - 0x34], 0
call dword [sym.imp.msvcrt.dll_strlen]
add esp, 4
lea ecx, [ebp - 0x48]
push eax
push edi
call fcn.10007e96
push edi
mov dword [ebp - 4], 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov esi, eax
test esi, esi
jne 0x10058a86
push edi
lea eax, [ebp - 0x158]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push str..dll
lea eax, [ebp - 0x158]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatA]
lea eax, [ebp - 0x158]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov esi, eax
test esi, esi
jne 0x10058a86
mov ecx, dword [ebp - 0x18]
lea eax, [ebp - 0x48]
push eax
call fcn.10059840
mov dword [eax], esi
mov ecx, dword [ebp - 0x34]
cmp ecx, 0x10
jb 0x10058ac9
mov edx, dword [ebp - 0x48]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x10058aba
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x10058ae5
push ecx
push edx
call fcn.1007b699
add esp, 8
jmp 0x10058ac9
mov esi, dword [esi + 0x20]
mov eax, esi
mov ecx, dword [ebp - 0xc]
pop edi
mov dword fs:[0], ecx
pop esi
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret 4
call fcn.1007c700
call fcn.1007c700
int3
Function at 0x10058af0
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
sub esp, 8
mov eax, dword [esp + 0x14]
push ebx
push ebp
push esi
mov esi, dword [esp + 0x18]
push edi
mov edi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov dword [esp + 0x14], eax
lea eax, [esp + 0x10]
push eax
push 0x40
push 4
push esi
mov dword [esp + 0x20], 0
call edi
mov ebp, dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea eax, [esp + 0x14]
push 0
push 4
push eax
push esi
call ebp
mov ebx, dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
push eax
call ebx
lea eax, [esp + 0x10]
push eax
push dword [esp + 0x14]
push 4
push esi
call edi
push 4
push esi
call ebp
mov edi, dword [sym.imp.KERNEL32.dll_FlushInstructionCache]
push eax
call edi
lea eax, [esp + 0x1c]
mov dword [esp + 0x1c], 0
push eax
push 0x40
push dword [esp + 0x2c]
add esi, 4
push esi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
push 0
push dword [esp + 0x28]
push dword [esp + 0x28]
push esi
call ebp
push eax
call ebx
mov ebx, dword [esp + 0x24]
lea eax, [esp + 0x1c]
push eax
push dword [esp + 0x20]
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
push ebx
push esi
call ebp
push eax
call edi
pop edi
pop esi
pop ebp
lea eax, [ebx + 4]
pop ebx
add esp, 8
ret 0xc
Function at 0x10058bb0
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1008c09d
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x18
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
push 8
mov dword [ebp - 0x10], ecx
call fcn.1007b23a
mov edi, eax
add esp, 4
mov dword [ebp - 0x18], edi
mov dword [edi], vtable.MemoryAllocator.0
test esi, esi
je 0x10058bf3
and esi, 0xfffff000
mov ebx, dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov dword [edi + 4], 0
push 0x40
push 0x3000
push 0x200
add esi, 0x1000
push esi
call ebx
mov dword [edi + 4], eax
test eax, eax
je 0x10058c00
mov ebx, dword [ebp - 0x10]
mov eax, dword [ebx + 0xc]
lea ecx, [ebx + 8]
mov dword [ebp - 0x18], edi
cmp eax, dword [ecx + 8]
je 0x10058c35
mov dword [eax], edi
add dword [ecx + 4], 4
jmp 0x10058c3f
lea edx, [ebp - 0x18]
push edx
push eax
call fcn.1005b3a0
mov edx, dword [ebp + 8]
movzx eax, dl
xor eax, 0x811c9dc5
mov esi, dword [edi + 4]
imul ecx, eax, 0x1000193
movzx eax, dh
mov dword [ebp - 0x18], edx
xor ecx, eax
movzx eax, byte [ebp + 0xa]
imul ecx, ecx, 0x1000193
xor ecx, eax
movzx eax, byte [ebp + 0xb]
imul ecx, ecx, 0x1000193
xor ecx, eax
imul eax, ecx, 0x1000193
lea ecx, [ebx + 0x34]
push eax
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x14]
push eax
call fcn.1005b190
mov eax, dword [eax + 4]
test eax, eax
jne 0x10058c94
mov eax, dword [ebx + 0x38]
cmp eax, dword [ebx + 0x38]
je 0x10058c9e
add eax, 0xc
jne 0x10058ceb
mov dword [ebp - 0x24], 0
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x1c], 0
lea eax, [ebp + 8]
mov dword [ebp - 4], 0
push eax
lea ecx, [ebx + 0x34]
call fcn.100596e0
lea ecx, [ebp - 0x24]
cmp eax, ecx
je 0x10058cd8
push 0
push 0
mov ecx, eax
call fcn.1005a180
lea eax, [ebp + 8]
push eax
lea ecx, [ebx + 0x34]
call fcn.100596e0
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [eax + 4]
mov dword [ebp - 0x18], esi
cmp ecx, dword [eax + 8]
je 0x10058cfe
mov dword [ecx], esi
add dword [eax + 4], 4
jmp 0x10058d0a
lea edx, [ebp - 0x18]
push edx
push ecx
mov ecx, eax
call fcn.1005b200
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x100594d0
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call
Hash data using fnv

Disassembly:
sub esp, 0xc
push ebx
mov ebx, dword [esp + 0x14]
movzx eax, bl
xor eax, 0x811c9dc5
mov dword [esp + 4], ebx
imul edx, eax, 0x1000193
mov eax, ebx
shr eax, 8
movzx eax, al
push ebp
mov ebp, ecx
xor edx, eax
mov eax, ebx
shr eax, 0x10
movzx eax, al
imul ecx, edx, 0x1000193
push esi
xor ecx, eax
mov eax, ebx
imul ecx, ecx, 0x1000193
shr eax, 0x18
xor ecx, eax
imul eax, ecx, 0x1000193
lea ecx, [ebp + 0x34]
push eax
lea eax, [esp + 0x10]
push eax
lea eax, [esp + 0x18]
push eax
call fcn.1005b190
mov eax, dword [eax + 4]
test eax, eax
jne 0x10059538
mov eax, dword [ebp + 0x38]
xor ebx, ebx
lea ecx, [eax + 0xc]
cmp eax, dword [ebp + 0x38]
cmovne ebx, ecx
test ebx, ebx
jne 0x10059552
pop esi
pop ebp
xor al, al
pop ebx
add esp, 0xc
ret 8
mov eax, dword [ebx + 4]
cmp dword [ebx], eax
je 0x1005960a
push edi
nop
mov edi, dword [eax - 4]
lea eax, [esp + 0x10]
push eax
push 0x40
mov dword [esp + 0x18], 0
mov esi, dword [edi]
push esi
push dword [esp + 0x2c]
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
push 0
push esi
lea eax, [edi + 4]
push eax
push dword [esp + 0x2c]
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
lea eax, [esp + 0x10]
push eax
push dword [esp + 0x14]
push esi
push dword [esp + 0x2c]
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
push esi
push dword [esp + 0x24]
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_FlushInstructionCache]
mov esi, dword [ebp + 8]
mov eax, dword [ebp + 0xc]
cmp esi, eax
je 0x100595f8
mov ecx, dword [esi]
cmp dword [ecx + 4], edi
je 0x100595d7
add esi, 4
cmp esi, eax
jne 0x100595c7
jmp 0x100595f8
test ecx, ecx
je 0x100595e1
mov eax, dword [ecx]
push 1
call dword [eax]
mov eax, dword [ebp + 0xc]
lea ecx, [esi + 4]
sub eax, ecx
push eax
push ecx
push esi
call sub.msvcrt.dll_memmove
add esp, 0xc
add dword [ebp + 0xc], 0xfffffffc
mov eax, dword [ebx + 4]
add eax, 0xfffffffc
mov dword [ebx + 4], eax
cmp dword [ebx], eax
jne 0x10059560
pop edi
pop esi
pop ebp
mov al, 1
pop ebx
add esp, 0xc
ret 8
Function at 0x10059910
Capabilities:
Hash data using fnv

Disassembly:
mov eax, dword [esp + 8]
sub esp, 0x18
mov edx, dword [esp + 0x1c]
push ebp
mov ebp, ecx
cmp edx, eax
je 0x10059a9c
mov eax, dword [ebp + 4]
mov dword [esp + 0x10], eax
mov eax, dword [edx + 4]
mov dword [esp + 4], eax
movzx eax, byte [edx + 8]
xor eax, 0x811c9dc5
imul ecx, eax, 0x1000193
movzx eax, byte [edx + 9]
push ebx
mov ebx, dword [ebp + 0xc]
push esi
xor ecx, eax
mov dword [esp + 0x20], ebx
movzx eax, byte [edx + 0xa]
mov esi, edx
imul ecx, ecx, 0x1000193
push edi
xor ecx, eax
movzx eax, byte [edx + 0xb]
imul ecx, ecx, 0x1000193
xor ecx, eax
mov eax, dword [ebp + 0x18]
imul ecx, ecx, 0x1000193
and eax, ecx
mov ecx, dword [ebx + eax*8]
mov dword [esp + 0x18], ecx
lea eax, [ebx + eax*8]
mov dword [esp + 0x14], eax
mov eax, dword [eax + 4]
mov dword [esp + 0x20], eax
nop dword [eax]
mov edi, esi
mov ebx, esi
mov esi, dword [esi]
lea ecx, [edi + 0xc]
call fcn.10059680
push 0x18
push edi
call fcn.1007b699
dec dword [ebp + 8]
add esp, 8
cmp ebx, dword [esp + 0x20]
je 0x100599e1
mov eax, dword [esp + 0x30]
cmp esi, eax
jne 0x10059990
mov ecx, dword [esp + 0x18]
cmp ecx, dword [esp + 0x2c]
jne 0x10059a90
mov edx, dword [esp + 0x14]
mov ecx, dword [esp + 0x10]
pop edi
mov dword [edx], esi
mov dword [ecx], esi
mov dword [esi + 4], ecx
pop esi
pop ebx
pop ebp
add esp, 0x18
ret 8
mov ecx, dword [esp + 0x18]
mov edx, dword [esp + 0x14]
cmp ecx, dword [esp + 0x2c]
jne 0x100599f9
mov eax, dword [esp + 0x1c]
mov ecx, eax
mov dword [edx], eax
jmp 0x100599fd
mov ecx, dword [esp + 0x10]
mov eax, dword [esp + 0x30]
mov dword [edx + 4], ecx
cmp esi, eax
je 0x10059a90
nop dword [eax]
movzx eax, byte [esi + 8]
xor eax, 0x811c9dc5
imul ecx, eax, 0x1000193
movzx eax, byte [esi + 9]
xor ecx, eax
movzx eax, byte [esi + 0xa]
imul ecx, ecx, 0x1000193
xor ecx, eax
movzx eax, byte [esi + 0xb]
imul ecx, ecx, 0x1000193
xor ecx, eax
mov eax, dword [ebp + 0x18]
imul ecx, ecx, 0x1000193
and eax, ecx
mov ecx, dword [esp + 0x24]
lea eax, [ecx + eax*8]
mov dword [esp + 0x2c], eax
mov eax, dword [eax + 4]
mov dword [esp + 0x20], eax
nop word [eax + eax]
mov edi, esi
mov ebx, esi
mov esi, dword [esi]
lea ecx, [edi + 0xc]
call fcn.10059680
push 0x18
push edi
call fcn.1007b699
dec dword [ebp + 8]
add esp, 8
mov eax, dword [esp + 0x30]
cmp ebx, dword [esp + 0x20]
je 0x10059aa3
cmp esi, eax
jne 0x10059a60
mov ecx, dword [esp + 0x2c]
mov dword [ecx], esi
mov ecx, dword [esp + 0x10]
pop edi
mov dword [ecx], esi
mov dword [esi + 4], ecx
pop esi
pop ebx
pop ebp
add esp, 0x18
ret 8
mov ecx, dword [esp + 0x2c]
mov edx, dword [esp + 0x1c]
mov dword [ecx], edx
mov dword [ecx + 4], edx
cmp esi, eax
jne 0x10059a10
mov ecx, dword [esp + 0x10]
pop edi
mov dword [ecx], esi
mov dword [esi + 4], ecx
pop esi
pop ebx
pop ebp
add esp, 0x18
ret 8
Function at 0x10059ad0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
sub esp, 0x18
push ebx
mov ebx, dword [esp + 0x20]
push ebp
mov ebp, dword [esp + 0x28]
push edi
mov edi, ecx
cmp ebx, ebp
je 0x10059c75
cmp dword [ebx + 0x1c], 0x10
mov eax, dword [edi + 4]
mov dword [esp + 0x1c], eax
mov eax, dword [edi + 0xc]
mov dword [esp + 0x18], eax
mov eax, dword [ebx + 4]
push esi
mov dword [esp + 0x2c], eax
lea esi, [ebx + 8]
jb 0x10059b0a
mov esi, dword [ebx + 8]
xor ecx, ecx
mov edx, 0x811c9dc5
cmp dword [ebx + 0x18], ecx
jbe 0x10059b28
movzx eax, byte [ecx + esi]
inc ecx
xor eax, edx
imul edx, eax, 0x1000193
cmp ecx, dword [ebx + 0x18]
jb 0x10059b16
mov eax, dword [edi + 0x18]
mov ecx, dword [esp + 0x1c]
and eax, edx
mov esi, dword [ebx]
mov edx, ebx
lea eax, [ecx + eax*8]
mov ecx, dword [eax]
mov dword [esp + 0x10], eax
mov eax, dword [eax + 4]
mov dword [esp + 0x18], ecx
mov dword [esp + 0x14], eax
call fcn.1005a840
dec dword [edi + 8]
cmp ebx, dword [esp + 0x14]
je 0x10059b75
mov dword [esp + 0x24], esi
cmp esi, ebp
je 0x10059b87
mov edx, esi
mov esi, dword [esi]
call fcn.1005a840
dec dword [edi + 8]
mov eax, dword [esp + 0x14]
cmp dword [esp + 0x24], eax
jne 0x10059b57
mov ecx, dword [esp + 0x10]
cmp dword [esp + 0x18], ebx
jne 0x10059bac
mov eax, dword [esp + 0x20]
mov dword [ecx], eax
jmp 0x10059bb0
cmp dword [esp + 0x18], ebx
jne 0x10059c6b
mov eax, dword [esp + 0x2c]
mov ecx, dword [esp + 0x10]
mov dword [ecx], esi
mov dword [eax], esi
mov dword [esi + 4], eax
mov eax, ebp
pop esi
pop edi
pop ebp
pop ebx
add esp, 0x18
ret 8
mov eax, dword [esp + 0x2c]
mov dword [ecx + 4], eax
cmp esi, ebp
je 0x10059c6b
nop dword [eax + eax]
cmp dword [esi + 0x1c], 0x10
lea ebx, [esi + 8]
mov dword [esp + 0x14], esi
jb 0x10059bd0
mov ebx, dword [esi + 8]
mov eax, dword [esi + 0x18]
xor ecx, ecx
mov dword [esp + 0x24], eax
mov edx, 0x811c9dc5
test eax, eax
je 0x10059bf9
mov ebp, eax
movzx eax, byte [ecx + ebx]
inc ecx
xor eax, edx
imul edx, eax, 0x1000193
cmp ecx, ebp
jb 0x10059be4
mov ebp, dword [esp + 0x30]
mov eax, dword [edi + 0x18]
mov ecx, dword [esp + 0x1c]
and eax, edx
mov ebx, dword [ecx + eax*8 + 4]
lea eax, [ecx + eax*8]
mov edx, esi
mov dword [esp + 0x18], eax
mov esi, dword [esi]
mov dword [esp + 0x24], ebx
call fcn.1005a840
dec dword [edi + 8]
cmp dword [esp + 0x14], ebx
je 0x10059c3b
mov ebx, esi
cmp esi, ebp
je 0x10059c65
mov edx, esi
mov esi, dword [esi]
call fcn.1005a840
dec dword [edi + 8]
cmp ebx, dword [esp + 0x24]
jne 0x10059c23
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x20]
mov dword [eax], ecx
mov dword [eax + 4], ecx
cmp esi, ebp
jne 0x10059bc0
mov eax, dword [esp + 0x2c]
mov dword [eax], esi
mov dword [esi + 4], eax
mov eax, ebp
pop esi
pop edi
pop ebp
pop ebx
add esp, 0x18
ret 8
mov eax, dword [esp + 0x18]
mov dword [eax], esi
mov eax, dword [esp + 0x2c]
mov dword [eax], esi
mov dword [esi + 4], eax
pop esi
pop edi
mov eax, ebp
pop ebp
pop ebx
add esp, 0x18
ret 8
Function at 0x1005a8b0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push esi
mov esi, dword [esp + 0xc]
mov edx, 0x811c9dc5
push edi
mov edi, dword [esp + 0xc]
mov ecx, 0
sub esi, edi
je 0x1005a8d9
movzx eax, byte [ecx + edi]
inc ecx
xor eax, edx
imul edx, eax, 0x1000193
cmp ecx, esi
jb 0x1005a8c8
pop edi
mov eax, edx
pop esi
ret 8

Function at 0x1005adf0
Capabilities:
Hash data using fnv

Disassembly:
sub esp, 8
mov edx, dword [esp + 0xc]
mov eax, 0x1fffffff
push ebx
mov ebx, ecx
bsr ecx, eax
push ebp
push esi
push edi
mov edi, 1
mov dword [esp + 0x10], ebx
mov eax, edi
shl eax, cl
cmp edx, eax
ja 0x1005af45
mov esi, dword [ebx + 4]
lea eax, [edx - 1]
or eax, edi
lea ebp, [ebx + 0xc]
bsr ecx, eax
push esi
lea ecx, [ecx + 1]
shl edi, cl
mov ecx, ebp
lea eax, [edi + edi]
push eax
call fcn.10059c80
lea eax, [edi - 1]
mov dword [ebx + 0x1c], edi
mov dword [ebx + 0x18], eax
mov eax, dword [ebx + 4]
mov eax, dword [eax]
mov ecx, eax
cmp eax, esi
je 0x1005af1f
movzx edx, byte [eax + 8]
xor edx, 0x811c9dc5
mov ecx, dword [ecx]
imul edi, edx, 0x1000193
movzx edx, byte [eax + 9]
xor edi, edx
movzx edx, byte [eax + 0xa]
imul edi, edi, 0x1000193
xor edi, edx
movzx edx, byte [eax + 0xb]
imul edi, edi, 0x1000193
xor edi, edx
imul edx, edi, 0x1000193
mov edi, dword [ebx + 0x18]
and edi, edx
mov edx, dword [ebp]
lea ebp, [edx + edi*8]
mov edi, dword [ebp]
mov dword [esp + 0x1c], ebp
cmp edi, esi
jne 0x1005aea5
mov dword [ebp], eax
mov dword [ebp + 4], eax
jmp 0x1005af12
mov edx, dword [ebp + 4]
mov ebx, dword [eax + 8]
cmp ebx, dword [edx + 8]
jne 0x1005aedf
mov edx, dword [edx]
mov dword [esp + 0x14], edx
cmp edx, eax
je 0x1005aeda
mov ebx, dword [eax + 4]
mov ebp, dword [esp + 0x14]
mov dword [ebx], ecx
mov edi, dword [ecx + 4]
mov dword [edi], edx
mov edx, dword [edx + 4]
mov dword [edx], eax
mov dword [ebp + 4], edi
mov ebp, dword [esp + 0x1c]
mov dword [ecx + 4], ebx
mov dword [eax + 4], edx
mov dword [ebp + 4], eax
jmp 0x1005af0e
cmp edi, edx
je 0x1005aeef
mov edx, dword [edx + 4]
cmp ebx, dword [edx + 8]
je 0x1005af29
cmp edi, edx
jne 0x1005aee3
mov ebp, dword [eax + 4]
mov dword [ebp], ecx
mov ebx, dword [ecx + 4]
mov dword [ebx], edx
mov edi, dword [edx + 4]
mov dword [edi], eax
mov dword [edx + 4], ebx
mov edx, dword [esp + 0x1c]
mov dword [ecx + 4], ebp
mov dword [eax + 4], edi
mov dword [edx], eax
mov ebx, dword [esp + 0x10]
lea ebp, [ebx + 0xc]
mov eax, ecx
cmp ecx, esi
jne 0x1005ae51
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret 4
mov ebx, dword [eax + 4]
mov ebp, dword [edx]
mov dword [ebx], ecx
mov edi, dword [ecx + 4]
mov dword [edi], ebp
mov edx, dword [ebp + 4]
mov dword [edx], eax
mov dword [ebp + 4], edi
mov dword [ecx + 4], ebx
mov dword [eax + 4], edx
jmp 0x1005af0e
push str.invalid_hash_bucket_count
call fcn.10079a6b
int3
Function at 0x1006e340
Capabilities:
Encode data using xor

Disassembly:
push ecx
xor eax, eax
mov dword [0x100e64a0], eax
mov word [0x100e64a4], ax
movzx eax, cl
lea ecx, [ecx + ecx*2]
imul eax, eax, 0xd
add ecx, ecx
push ebx
push esi
mov bl, al
mov dword [esp + 8], eax
xor bl, 0x6e
xor eax, eax
sub ecx, 0x100e64a0
lea esi, [ecx + 0x100aa8d8]
mov dl, byte [esi + eax + 0x100e64a0]
mov cl, dl
add dl, byte [esp + 8]
xor cl, bl
add dl, al
mov byte [eax + 0x100e64a0], cl
add bl, dl
inc eax
cmp eax, 6
jl 0x1006e372
pop esi
pop ebx
mov eax, 0x100e64a0
pop ecx
ret
Function at 0x100715c0
Capabilities:
Encode data using xor

Disassembly:
push esi
xorps xmm0, xmm0
lea edx, [ecx + 0x100c9748]
mov esi, 0x100e64bc
movups xmmword [0x100e64bc], xmm0
sub esi, ecx
movups xmmword [0x100e64cc], xmm0
nop
mov al, byte [edx]
lea edx, [edx + 1]
xor al, cl
xor al, 0x6e
mov byte [esi + ecx], al
inc ecx
test al, al
jne 0x100715e0
pop esi
mov eax, 0x100e64bc
ret
Function at 0x10073595
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
not ecx
cmp esi, 4
jb 0x10073600
push edi
mov edi, esi
shr edi, 2
movzx eax, byte [edx]
sub esi, 4
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x1009f0d8]
movzx eax, byte [edx + 1]
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x1009f0d8]
movzx eax, byte [edx + 2]
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x1009f0d8]
movzx eax, byte [edx + 3]
add edx, 4
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x1009f0d8]
sub edi, 1
jne 0x100735a9
pop edi
test esi, esi
je 0x1007361c
movzx eax, byte [edx]
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x1009f0d8]
inc edx
sub esi, 1
jne 0x10073604
not ecx
mov eax, ecx
pop esi
pop ebp
ret
Function at 0x100793cc
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x464
mov eax, dword [0x100c901c]
xor eax, esp
mov dword [esp + 0x460], eax
push ebx
push esi
mov esi, ecx
push edi
mov edi, edx
test esi, esi
jne 0x100793f9
or eax, 0xffffffff
jmp 0x100794e7
cmp dword [esi + 0x14], 1
je 0x10079407
push 0xfffffffffffffffc
pop eax
jmp 0x100794e7
cmp edi, dword [esi + 0x10]
jb 0x10079410
push 0xfffffffffffffff6
jmp 0x10079401
mov ecx, dword [esi + 0x48]
mov eax, dword [ecx + 0x10]
mov eax, dword [eax + edi*4]
add eax, dword [ecx]
jne 0x10079421
push 0xfffffffffffffff5
jmp 0x10079401
movzx ebx, word [eax + 0x1c]
add eax, 0x2e
cmp dword [esi + 0x5c], 0
mov dword [esp + 0xc], eax
je 0x10079444
push dword [esi + 0x5c]
call dword [sym.imp.msvcrt.dll_free]
and dword [esi + 0x5c], 0
mov eax, dword [esp + 0x10]
pop ecx
push ecx
push ecx
mov edx, ebx
mov ecx, eax
call fcn.10079287
mov dword [esi + 0x5c], eax
pop ecx
pop ecx
test eax, eax
jne 0x1007945c
push 0xfffffffffffffffe
jmp 0x10079401
lea eax, [esp + 0x10]
mov edx, edi
push eax
mov ecx, esi
call fcn.10079257
pop ecx
test eax, eax
jne 0x10079473
push 0xfffffffffffffffd
jmp 0x10079401
mov eax, dword [esp + 0x38]
mov ecx, dword [esp + 0x3c]
mov dword [esi + 0x68], eax
mov eax, dword [esp + 0x40]
mov dword [esi + 0x60], eax
mov eax, dword [esp + 0x30]
mov dword [esi + 0x70], eax
mov eax, dword [esp + 0x18]
mov dword [esi + 0x78], eax
mov eax, dword [esp + 0x50]
mov dword [esi + 0x6c], ecx
mov ecx, dword [esp + 0x44]
mov dword [esi + 0xa0], eax
mov ax, word [esp + 0x26]
mov dword [esi + 0x64], ecx
mov ecx, dword [esp + 0x1c]
mov word [esi + 0xa8], ax
mov eax, dword [esp + 0x4c]
mov dword [esi + 0x7c], ecx
mov ecx, dword [esp + 0x54]
mov dword [esi + 0x4e008], eax
mov eax, dword [esp + 0x28]
mov dword [esi + 0xa4], ecx
mov ecx, dword [esp + 0x2c]
mov dword [esi + 0x4e010], eax
xor eax, eax
mov dword [esi + 0x58], edi
mov dword [esi + 0x4e014], ecx
mov ecx, dword [esp + 0x46c]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.1007bb64
mov esp, ebp
pop ebp
ret