joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1000ba71
Capabilities:
Create directory

Disassembly:
push ebx
push esi
push edi
mov edi, ecx
xor ebx, ebx
xor eax, eax
inc ebx
mov esi, edx
cmp ax, word [edi]
je 0x1000baf5
push 0x10039374
push edi
call fcn.1001de79
pop ecx
pop ecx
test eax, eax
jne 0x1000baf5
push 0x100396a4
push edi
call fcn.1001de79
pop ecx
pop ecx
test eax, eax
jne 0x1000baf5
push 0x5c
pop eax
push eax
push esi
jmp 0x1000bae4
push 0x3a
pop eax
cmp ax, word [esi - 2]
je 0x1000bad9
xor eax, eax
push eax
push edi
mov word [esi], ax
call dword [sym.imp.kernel32.dll_CreateDirectoryW]
test eax, eax
jne 0x1000bad6
call dword [sym.imp.kernel32.dll_GetLastError]
cmp eax, 0xb7
je 0x1000bad6
xor ebx, ebx
jmp 0x1000bad9
xor ebx, ebx
inc ebx
push 0x5c
pop eax
push eax
lea ecx, [esi + 2]
mov word [esi], ax
push ecx
call fcn.1001ddb2
mov esi, eax
pop ecx
pop ecx
test esi, esi
jne 0x1000baab
mov eax, ebx
jmp 0x1000baf7
xor eax, eax
pop edi
pop esi
pop ebx
ret

Function at 0x1000bc32
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
cmp ecx, 0xffffffff
je 0x1000bc66
xor eax, eax
push eax
mov dword [ebp - 8], eax
mov dword [ebp - 4], eax
lea eax, [ebp - 4]
push eax
push 2
lea eax, [ebp - 8]
push eax
push ecx
call dword [sym.imp.kernel32.dll_ReadFile]
test eax, eax
je 0x1000bc66
cmp dword [ebp - 4], 2
jne 0x1000bc66
movzx eax, word [ebp - 8]
leave
ret
or eax, 0xffffffff
leave
ret

Function at 0x1000c191
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
pushal
call 0x1000c1a0
pop dword [ebp - 8]
mov eax, 0x6c6baed4
add eax, 0xa39512cc
sub dword [ebp - 8], eax
push 0x40
push 0x1000
push 0x42f41
push 0
mov eax, sym.imp.kernel32.dll_VirtualAlloc
add eax, dword [ebp - 8]
call dword [eax]
mov ecx, 0x4dfd
xor edx, edx
add edx, eax
mov esi, 0x10048000
add esi, dword [ebp - 8]
mov ebx, 0xb6c19bc8
sub ebx, 0xfe2401c8
mov edi, dword [esi]
add dword [ebp - 4], ecx
xor edi, ebx
sub dword [ebp - 4], 0xf5f72799
mov dword [edx], edi
xor dword [ebp - 4], 0x9a2d5d39
add edx, 0xcbe81809
sub edx, 0xcbe81805
add esi, 0x9f7c332c
sub esi, 0x9f7c3328
loop 0x1000c1f0
add eax, 0x12ac7
mov ebx, eax
add eax, 5
mov ecx, 0x10000000
add ecx, dword [ebp - 8]
call ebx
leave
ret
Function at 0x100194d5
Capabilities:
Query environment variable
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xea0
mov eax, dword [0x100400b0]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 0x14]
push edi
test esi, esi
jne 0x100194fb
mov eax, 0x80070057
jmp 0x1001970d
push ebx
push dword [ebp + 0xc]
lea eax, [ebp - 0x484]
xor ebx, ebx
push str.SoftwareMicrosoftOffice_i.0Registration
push 0x100
push eax
mov dword [esi], ebx
mov dword [ebp - 0xe9c], ebx
call fcn.1000c191
add esp, 0x10
test eax, eax
je 0x100196fd
lea eax, [ebp - 0xe9c]
push eax
push 0x20019
push ebx
lea eax, [ebp - 0x484]
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x100196fd
push 0x40
lea eax, [ebp - 0x84]
push eax
push dword [ebp + 0x10]
push dword [ebp - 0xe9c]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyW]
push dword [ebp - 0xe9c]
mov edi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp edi, 0x103
je 0x100196fd
test edi, edi
jne 0x1001970a
push 0xffffffffffffffff
lea eax, [ebp - 0x484]
mov edi, 0x100
push eax
lea eax, [ebp - 0x284]
push edi
push eax
call fcn.1000c191
add esp, 0x10
cmp eax, 0x50
je 0x1001970a
push 0xffffffffffffffff
push 0x100393f0
lea eax, [ebp - 0x284]
push edi
push eax
call fcn.1000c191
add esp, 0x10
cmp eax, 0x50
je 0x1001970a
push 0xffffffffffffffff
lea eax, [ebp - 0x84]
push eax
lea eax, [ebp - 0x284]
push edi
push eax
call fcn.1000c191
add esp, 0x10
cmp eax, 0x50
je 0x1001970a
lea eax, [ebp - 0xe94]
mov dword [ebp - 0xe98], ebx
push eax
push 1
push ebx
lea eax, [ebp - 0x284]
mov dword [ebp - 0xe94], ebx
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov edi, eax
test edi, edi
jne 0x10019655
lea eax, [ebp - 0xea0]
mov dword [ebp - 0xea0], 0x802
push eax
lea eax, [ebp - 0xe90]
push eax
lea eax, [ebp - 0xe98]
push eax
push ebx
push 0x1003b278
push dword [ebp - 0xe94]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov edi, eax
cmp dword [ebp - 0xe94], ebx
je 0x10019669
push dword [ebp - 0xe94]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test edi, edi
jne 0x100196ce
cmp dword [ebp - 0xe98], 1
je 0x1001967f
cmp dword [ebp - 0xe98], 2
jne 0x100196ce
cmp dword [ebp - 0xe98], 2
jne 0x100196d2
push 0x104
lea eax, [ebp - 0x68c]
push eax
lea eax, [ebp - 0xe90]
push eax
call dword [sym.imp.kernel32.dll_ExpandEnvironmentStringsW]
dec eax
cmp eax, 0x102
ja 0x100196d2
push 0xffffffffffffffff
lea eax, [ebp - 0x68c]
push eax
lea eax, [ebp - 0xe90]
push 0x401
push eax
call fcn.1000c191
xor ebx, ebx
add esp, 0x10
cmp eax, 0x50
setne bl
test ebx, ebx
je 0x1001970a
lea eax, [ebp - 0xe90]
push str._no_more_entries_
push eax
call fcn.1000c191
pop ecx
pop ecx
test eax, eax
je 0x1001970a
xor eax, eax
cmp ax, word [ebp - 0xe90]
je 0x1001970a
lea eax, [ebp - 0xe90]
push eax
jmp 0x10019702
push str._no_more_entries_
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov dword [esi], eax
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.1001c65c
leave
ret 0x10
Function at 0x50872d13
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
pushal
call 0x50872d22
pop dword [ebp - 0x14]
mov eax, 0xec15e68
add eax, 0x41c5ceba
sub dword [ebp - 0x14], eax
mov dword [ebp - 0x24], 0x2d12b2bf
add dword [ebp - 0x24], 0x213f928c
mov dword [ebp - 0x20], 0x437608dc
sub dword [ebp - 0x20], 0x1142bc97
mov dword [ebp - 0x1c], 0xa32b7244
sub dword [ebp - 0x1c], 0x56df2e16
mov dword [ebp - 0x18], 0x8e447a8
add dword [ebp - 0x18], 0xf71bb858
lea eax, [ebp - 0x24]
push eax
mov eax, sym.imp.kernel32.dll_GetModuleHandleA
add eax, dword [ebp - 0x14]
call dword [eax]
mov dword [ebp - 0x24], 0xb052029e
add dword [ebp - 0x24], 0xc42066b8
mov dword [ebp - 0x20], 0x912e7559
add dword [ebp - 0x20], 0xb03dec1c
mov dword [ebp - 0x1c], 0xdf752d74
add dword [ebp - 0x1c], 0x83fa3ef8
mov dword [ebp - 0x18], 0x5f9c91c9
sub dword [ebp - 0x18], 0x5f9c91c9
lea ebx, [ebp - 0x24]
push ebx
push eax
mov eax, 0xf40c2cb5
sub eax, 0xa3851c4d
add eax, dword [ebp - 0x14]
call dword [eax]
push 0x40
push 0x1000
push 0x31885
push 0
call eax
mov ecx, 0x32ca
mov edx, eax
mov edi, 0x50879000
add edi, dword [ebp - 0x14]
mov esi, 0xfc7a4565
add esi, 0x7e8dcf74
sub dword [ebp - 8], 0x7677d59b
mov ebx, dword [edi]
add dword [ebp - 8], ebx
xor ebx, esi
xor dword [ebp - 4], 0x6ccee3a6
mov dword [edx], ebx
xor dword [ebp - 0xc], 0xc391db19
add edx, 4
add edi, 0xdd562e80
add edi, 0x22a9d184
loop 0x50872e33
add eax, 0xbdfb
xor ebx, ebx
add ebx, eax
add eax, 0xea4a7584
sub eax, 0xea4a757f
mov ecx, 0x505a65d4
sub ecx, 0xffd365d4
add ecx, dword [ebp - 0x14]
call ebx
leave
ret

Function at 0x5087472e
Capabilities:
Check os version

Disassembly:
push ebp
lea ebp, [esp - 0x78]
sub esp, 0x94
push esi
mov esi, ecx
call fcn.50874717
and byte [esi + 0xc], 0
mov eax, 0x50870000
push 0x94
mov dword [esi + 8], eax
mov dword [esi + 4], eax
lea eax, [ebp - 0x1c]
push 0
push eax
mov dword [esi], 0x3c
call sub.MSVCR70.dll_memset
add esp, 0xc
lea eax, [ebp - 0x1c]
push eax
mov dword [ebp - 0x1c], 0x94
call dword [sym.imp.kernel32.dll_GetVersionExA]
cmp dword [ebp - 0xc], 2
jne 0x50874788
cmp dword [ebp - 0x18], 5
jb 0x508747a0
jmp 0x5087479c
cmp dword [ebp - 0xc], 1
jne 0x508747a0
cmp dword [ebp - 0x18], 4
ja 0x5087479c
jne 0x508747a0
cmp dword [ebp - 0x14], 0
jbe 0x508747a0
mov byte [esi + 0xc], 1
lea eax, [esi + 0x18]
push eax
mov dword [esi + 0x10], 0x700
mov dword [esi + 0x14], 0x50875050
call dword [sym.imp.kernel32.dll_InitializeCriticalSection]
mov eax, esi
pop esi
add ebp, 0x78
leave
ret
Function at 0x10024a70
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
pushal
call 0x10024a7f
pop dword [ebp - 0x24]
mov eax, 0xdbb3cfda
add eax, 0x344e7aa5
sub dword [ebp - 0x24], eax
push 0x40
push 0x1000
push 0x3dbbc
push 0
mov eax, 0xa0de0720
sub eax, 0x90db7614
add eax, dword [ebp - 0x24]
call dword [eax]
mov ecx, 0x40bcb5a0
sub ecx, 0x40bc6162
xor edi, edi
add edi, eax
mov ebx, 0x10046c00
add ebx, dword [ebp - 0x24]
mov edx, 0x63deae2d
xor dword [ebp - 0xc], 0xb78fbef3
mov esi, dword [ebx]
sub dword [ebp - 0x1c], edi
sub esi, edx
sub dword [ebp - 0xc], 0x3517b98e
mov dword [edi], esi
add dword [ebp - 0xc], 0xf2f98e15
add edi, 4
add ebx, 0xcd88a204
add ebx, 0x32775e00
loop 0x10024ad4
add eax, 0x9fe279f5
add eax, 0x601ec9d6
xor ebx, ebx
add ebx, eax
add eax, 0x6d6dacb9
sub eax, 0x6d6dacb4
mov ecx, 0x10000000
add ecx, dword [ebp - 0x24]
call ebx
leave
ret
Function at 0x100599a8
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
pushal
call 0x100599b7
pop dword [ebp - 0x1c]
mov eax, 0xe5b77d99
add eax, 0x2a4e1c1e
sub dword [ebp - 0x1c], eax
push 0x40
push 0x1000
push 0x4571b
push 0
mov eax, 0xafccfd4a
add eax, 0x603a83d2
add eax, dword [ebp - 0x1c]
call dword [eax]
mov ecx, 0xb987b52e
sub ecx, 0xb9876402
mov edi, eax
mov ebx, 0x10187200
add ebx, dword [ebp - 0x1c]
mov edx, 0xa1a3b3f9
sub dword [ebp - 0x10], 0x58fc0a1e
mov esi, dword [ebx]
mov dword [ebp - 0x14], 0x59a0b175
xor esi, edx
sub dword [ebp - 0x18], 0x6618a7a3
mov dword [edi], esi
sub dword [ebp - 0x14], esi
add edi, 0x28824910
sub edi, 0x2882490c
add ebx, 4
loop 0x10059a0a
add eax, 0x13783
mov ebx, eax
add eax, 5
mov ecx, 0x10000000
add ecx, dword [ebp - 0x1c]
call ebx
leave
ret
Function at 0x10071ed0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push edi
mov edi, dword [ebp + 8]
cmp byte [edi + 0x2d], 0
jne 0x10071f6b
push ebx
mov ebx, dword [ebp + 0x10]
lea eax, [ebp - 4]
push esi
push 0
push eax
push ebx
push dword [ebp + 0xc]
push dword [edi + 0x30]
call dword [sym.imp.kernel32.dll_ReadFile]
mov esi, dword [ebp - 4]
cmp esi, ebx
je 0x10071f22
mov byte [edi + 0x2d], 0xff
test esi, esi
je 0x10071f22
cmp esi, ebx
jge 0x10071f22
mov eax, ebx
sub eax, esi
push eax
mov eax, dword [ebp + 0xc]
add eax, esi
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
cmp dword [edi + 0x18], 0
je 0x10071f65
add dword [edi + 0x1c], ebx
cmp dword [edi + 0x1c], 0xffff
jle 0x10071f65
xor eax, eax
mov word [edi + 0x1e], ax
mov eax, dword [edi]
push edi
mov esi, dword [eax + 0x2c]
mov ecx, esi
call dword [0x100783dc]
call esi
mov ecx, dword [edi + 0x18]
push 1
push dword [edi + 0x20]
mov esi, dword [ecx]
push eax
push ecx
mov ecx, dword [esi + 0xc]
call dword [0x100783dc]
call dword [esi + 0xc]
mov esi, dword [ebp - 4]
mov eax, esi
pop esi
pop ebx
jmp 0x10071f7d
push dword [ebp + 0x10]
push 0
push dword [ebp + 0xc]
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
xor eax, eax
pop edi
leave
ret 0xc

Function at 0x100721a0
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x108
mov eax, dword [0x100bb864]
xor eax, ebp
mov dword [ebp - 4], eax
cmp byte [0x10176174], 0
mov eax, dword [ebp + 8]
je 0x100721c8
push eax
call dword [sym.imp.kernel32.dll_DeleteFileW]
jmp 0x100721e2
lea ecx, [ebp - 0x108]
push ecx
push eax
call fcn.100599a8
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.kernel32.dll_DeleteFileA]
mov ecx, dword [ebp - 4]
test eax, eax
setne al
xor ecx, ebp
call fcn.100762d0
leave
ret 4

Function at 0x100723b0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x310
mov eax, dword [0x100bb864]
xor eax, ebp
mov dword [ebp - 4], eax
cmp byte [0x10176174], 0
push ebx
mov ebx, dword [ebp + 0x14]
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0xc]
je 0x100723e6
push ebx
push dword [ebp + 0x10]
push edi
push esi
call dword [sym.imp.kernel32.dll_GetTempFileNameW]
jmp 0x10072445
push 0x104
lea eax, [ebp - 0x108]
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
lea eax, [ebp - 0x310]
push eax
push esi
call fcn.100599a8
lea eax, [ebp - 0x20c]
push eax
push edi
call fcn.100599a8
lea eax, [ebp - 0x108]
push eax
push dword [ebp + 0x10]
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x310]
push eax
call dword [sym.imp.kernel32.dll_GetTempFileNameA]
mov esi, eax
lea eax, [ebp - 0x108]
push ebx
push eax
call fcn.100599a8
mov eax, esi
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.100762d0
leave
ret 0x10
Function at 0x10072460
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x108
mov eax, dword [0x100bb864]
xor eax, ebp
mov dword [ebp - 4], eax
cmp byte [0x10176174], 0
push esi
mov esi, dword [ebp + 0xc]
je 0x1007248c
push esi
push dword [ebp + 8]
call dword [sym.imp.kernel32.dll_GetTempPathW]
jmp 0x100724bd
lea eax, [ebp - 0x108]
push eax
push 0x104
call dword [sym.imp.kernel32.dll_GetTempPathA]
test eax, eax
je 0x100724bb
push dword [ebp + 8]
lea eax, [ebp - 0x108]
push esi
push eax
call fcn.100599a8
push esi
call dword [sym.imp.kernel32.dll_lstrlenW]
jmp 0x100724bd
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.100762d0
leave
ret 8

Function at 0x438cb9
Capabilities:
Encode data using xor

Disassembly:
mov edx, 0x438a14
or ecx, edi
and edi, ecx
call fcn.00438cfd
mov edi, 0x12f9073a
add ecx, 0xfa9fcd58
xor dword [eax], edx
add ecx, edi
or edi, edi
sub ecx, edi
inc eax
sub ecx, 0x88b8e149
mov edi, 0x5c6df7e7
sub ecx, 1
cmp eax, esi
jne fcn.00438cb9
or ecx, ecx
ret
Function at 0x401a40
Capabilities:
Write file on windows

Disassembly:
mov edx, dword [esp + 8]
mov ecx, dword [ecx]
lea eax, [esp + 8]
push 0
push eax
mov eax, dword [esp + 0xc]
push edx
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_WriteFile]
ret 8

Function at 0x414dd1
Capabilities:
Encode data using xor

Disassembly:
xor dword [esi], ecx
add edi, ebx
add edi, 0xb42e393f
or edi, edi
add esi, 4
mov ebx, 0x19c66604
sub ebx, 0xfc2f5f7
cmp esi, edx
jne fcn.00414dd1
or edi, ebx
or edi, eax
add ebx, ebx
ret

Function at 0x4015a0
Capabilities:
Terminate process

Disassembly:
call fcn.00401940
jmp fcn.004012d0

Function at 0x4015b0
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x403008]
jne 0x4015ba
repz ret
jmp fcn.004019f0
Function at 0x1001cc06
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
pushal
call 0x1001cc15
pop dword [ebp - 0x24]
mov eax, 0x1af83167
sub eax, 0xaf66552
sub dword [ebp - 0x24], eax
mov dword [ebp - 0x34], 0x4aead32
add dword [ebp - 0x34], 0x49a39819
mov dword [ebp - 0x30], 0x18246556
add dword [ebp - 0x30], 0x1a0ee6ef
mov dword [ebp - 0x2c], 0xe3c0dd0b
add dword [ebp - 0x2c], 0x688b6723
mov dword [ebp - 0x28], 0xd52c3a29
add dword [ebp - 0x28], 0x2ad3c5d7
lea eax, [ebp - 0x34]
push eax
mov eax, sym.imp.kernel32.dll_GetModuleHandleA
add eax, dword [ebp - 0x24]
call dword [eax]
mov dword [ebp - 0x34], 0x3b3b1969
sub dword [ebp - 0x34], 0xc6c8b013
mov dword [ebp - 0x30], 0x6e30268d
sub dword [ebp - 0x30], 0x2cc3c518
mov dword [ebp - 0x2c], 0xdef9f47a
sub dword [ebp - 0x2c], 0x7b8a880e
mov dword [ebp - 0x28], 0x9f83e863
sub dword [ebp - 0x28], 0x9f83e863
lea ebx, [ebp - 0x34]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x24]
call dword [eax]
push 0x40
push 0x1000
push 0x3eaec
push 0
call eax
mov ecx, 0x8266863a
add ecx, 0x7d99c71c
mov ebx, eax
mov edi, 0x705645b8
add edi, 0x9fad1248
add edi, dword [ebp - 0x24]
mov edx, 0xfb467811
sub edx, 0x8fb421ee
xor dword [ebp - 0x18], 0x5eaa6e84
mov esi, dword [edi]
add dword [ebp - 4], 0x759443fd
sub esi, edx
xor dword [ebp - 0xc], 0xd3bc6334
mov dword [ebx], esi
sub dword [ebp - 0xc], 0x991a726
add ebx, 4
add edi, 0x1161130c
sub edi, 0x11611308
loop 0x1001cd2d
add eax, 0x3298284b
sub eax, 0x32970020
xor ebx, ebx
add ebx, eax
add eax, 0x364d7735
add eax, 0xc9b288d0
mov ecx, 0x10000000
add ecx, dword [ebp - 0x24]
call ebx
leave
ret

Function at 0x431003
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
mov eax, section..text
nop
nop
mov ebx, 0x40915c
mov ecx, 0x69fe3d21
nop
test eax, eax
nop
nop
nop
nop
nop
nop
nop
nop
je 0x43104e
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
inc eax
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
nop
jne 0x431024
nop
mov eax, section..data
nop
mov ebx, 0x42f3f8
nop
mov ecx, 0x25722e4a
test eax, eax
nop
nop
nop
nop
nop
nop
nop
je 0x431084
nop
nop
xor dword [eax], ecx
nop
nop
nop
add eax, 4
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
jne 0x43106c
nop
nop
nop
popal
nop
nop
nop
nop
nop
jmp 0x401219
Function at 0x10003bc0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1001e8d3
mov eax, dword fs:[0]
push eax
sub esp, 0x28
push ebx
push esi
push edi
mov eax, dword [0x100304c0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov dword [ebp - 0x10], ebx
mov esi, dword [ebp + 8]
lea edi, [ebx + 4]
push 0x48
mov dword [ebp - 0x14], edi
mov eax, dword [esi]
mov dword [ebx], eax
mov dword [edi], 0
mov dword [edi + 4], 0
call fcn.1001477c
add esp, 4
mov dword [eax], eax
mov dword [eax + 4], eax
mov dword [edi], eax
lea ecx, [ebx + 0xc]
mov dword [ebp - 4], 0
mov dword [ecx], 0
mov dword [ecx + 4], 0
mov dword [ecx + 8], 0
mov eax, dword [esi + 0x18]
mov dword [ebx + 0x18], eax
mov eax, dword [esi + 0x1c]
mov dword [ebx + 0x1c], eax
mov eax, dword [esi + 0x10]
sub eax, dword [esi + 0xc]
push dword [edi]
sar eax, 2
push eax
mov byte [ebp - 4], 1
call fcn.100085b0
mov eax, dword [esi + 4]
mov dword [ebp - 0x1c], eax
mov esi, dword [eax]
cmp esi, eax
je 0x10003da7
nop word [eax + eax]
cmp dword [esi + 0x1c], 7
lea ebx, [esi + 8]
mov eax, dword [ebx + 0x10]
mov edx, ebx
jbe 0x10003c80
mov edx, dword [ebx]
xor ecx, ecx
mov edi, 0x811c9dc5
add eax, eax
mov dword [ebp + 8], eax
je 0x10003ca4
mov ebx, eax
movzx eax, byte [edx + ecx]
inc ecx
xor eax, edi
imul edi, eax, 0x1000193
cmp ecx, ebx
jb 0x10003c90
lea ebx, [esi + 8]
mov ecx, dword [ebp - 0x10]
lea eax, [ebp - 0x24]
push edi
push ebx
push eax
call fcn.100051b0
cmp dword [ebp - 0x20], 0
jne 0x10003d99
mov eax, dword [ebp - 0x10]
cmp dword [eax + 8], 0x38e38e3
je 0x10003dbd
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x2c], eax
push 0x48
mov byte [ebp - 4], 2
mov dword [ebp - 0x28], 0
call fcn.1001477c
add esp, 4
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x28], eax
add eax, 8
mov ecx, eax
mov dword [ebp + 8], eax
push ebx
call fcn.10005f30
mov ecx, dword [ebp + 8]
lea eax, [ebx + 0x18]
add ecx, 0x18
mov byte [ebp - 4], 3
push eax
call fcn.10005d40
mov ebx, dword [ebp - 0x10]
mov byte [ebp - 4], 4
mov eax, dword [ebx + 8]
inc eax
movd xmm0, eax
cvtdq2pd xmm0, xmm0
shr eax, 0x1f
addsd xmm0, qword [eax*8 + 0x10022200]
mov eax, dword [ebx + 0x1c]
cvtpd2ps xmm1, xmm0
movd xmm0, eax
cvtdq2pd xmm0, xmm0
shr eax, 0x1f
addsd xmm0, qword [eax*8 + 0x10022200]
cvtpd2ps xmm0, xmm0
divss xmm1, xmm0
comiss xmm1, dword [ebx]
seta al
test al, al
je 0x10003d7d
mov ecx, ebx
call fcn.10008c10
push edi
push dword [ebp + 8]
lea eax, [ebp - 0x34]
mov ecx, ebx
push eax
call fcn.100051b0
mov ecx, dword [eax]
mov eax, dword [eax + 4]
mov dword [ebp - 0x24], ecx
mov dword [ebp - 0x20], eax
jmp 0x10003d80
mov ecx, dword [ebp - 0x24]
push dword [ebp - 0x18]
mov dword [ebp - 0x28], 0
push ecx
push edi
mov ecx, ebx
call fcn.10008bb0
mov byte [ebp - 4], 1
jmp 0x10003d9c
mov ebx, dword [ebp - 0x10]
mov esi, dword [esi]
cmp esi, dword [ebp - 0x1c]
jne 0x10003c70
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
push str.unordered_map_set_too_long
call fcn.10012984
int3
Function at 0x10006ac0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push esi
mov esi, ecx
push edi
mov edi, dword [ebp + 8]
test esi, esi
je 0x10006b2d
cmp byte [esi + 0x20], 6
jne 0x10006b2d
cmp dword [ebp + 0x1c], 7
mov ecx, 0x811c9dc5
mov eax, dword [ebp + 0x18]
push ebx
lea ebx, [ebp + 8]
mov dword [ebp - 4], esi
cmova ebx, edi
xor edx, edx
add eax, eax
je 0x10006b0c
mov dword [ebp - 4], esi
mov edi, eax
movzx eax, byte [ebx + edx]
inc edx
xor eax, ecx
imul ecx, eax, 0x1000193
cmp edx, edi
jb 0x10006af8
mov edi, dword [ebp + 8]
push ecx
mov ecx, dword [ebp - 4]
lea eax, [ebp + 8]
push eax
lea eax, [ebp - 0xc]
push eax
call fcn.100051b0
pop ebx
mov eax, dword [eax + 4]
test eax, eax
je 0x10006b2d
cmp eax, dword [esi + 4]
lea esi, [eax + 0x20]
jne 0x10006b32
mov esi, 0x10030d20
mov eax, dword [ebp + 0x1c]
cmp eax, 7
jbe 0x10006b65
lea ecx, [eax*2 + 2]
mov eax, edi
cmp ecx, 0x1000
jb 0x10006b5b
mov edi, dword [eax - 4]
add ecx, 0x23
sub eax, edi
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x10006b6f
push ecx
push edi
call fcn.100147ac
add esp, 8
pop edi
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret 0x18
call fcn.10016130
int3
Function at 0x10008d40
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
mov dword [ebp - 4], ecx
cmp edx, eax
je 0x10008edc
cmp dword [edx + 0x1c], 7
mov eax, dword [ecx + 4]
push esi
mov dword [ebp - 0x18], eax
mov esi, edx
mov eax, dword [ecx + 0xc]
push edi
mov dword [ebp - 0x14], eax
lea edi, [edx + 8]
mov eax, dword [edx + 4]
mov dword [ebp - 8], eax
mov eax, dword [edi + 0x10]
jbe 0x10008d7b
mov edi, dword [edi]
xor edx, edx
push ebx
mov ebx, 0x811c9dc5
add eax, eax
je 0x10008da4
mov ecx, eax
nop dword [eax]
movzx eax, byte [edi + edx]
inc edx
xor eax, ebx
imul ebx, eax, 0x1000193
cmp edx, ecx
jb 0x10008d90
mov ecx, dword [ebp - 4]
mov eax, dword [ecx + 0x18]
mov ecx, dword [ebp - 0x14]
and eax, ebx
lea eax, [ecx + eax*8]
mov ecx, dword [eax]
mov dword [ebp - 0xc], eax
mov eax, dword [eax + 4]
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0x1c], eax
nop dword [eax]
mov edi, esi
mov ebx, esi
mov esi, dword [esi]
lea ecx, [edi + 8]
call fcn.10006730
push 0x48
push edi
call fcn.100147ac
mov eax, dword [ebp - 4]
add esp, 8
dec dword [eax + 8]
cmp ebx, dword [ebp - 0x1c]
je 0x10008e09
mov eax, dword [ebp + 0xc]
cmp esi, eax
jne 0x10008dc0
mov ecx, dword [ebp - 0x10]
cmp ecx, dword [ebp + 8]
jne 0x10008df8
mov edx, dword [ebp - 0xc]
mov dword [edx], esi
mov ecx, dword [ebp - 8]
pop ebx
pop edi
mov dword [ecx], esi
mov dword [esi + 4], ecx
pop esi
mov esp, ebp
pop ebp
ret 8
mov ecx, dword [ebp - 0x10]
mov edx, dword [ebp - 0xc]
cmp ecx, dword [ebp + 8]
jne 0x10008e1b
mov ecx, dword [ebp - 0x18]
mov dword [edx], ecx
jmp 0x10008e1e
mov ecx, dword [ebp - 8]
mov dword [edx + 4], ecx
mov ecx, dword [ebp + 0xc]
cmp esi, ecx
je 0x10008ecf
nop dword [eax]
cmp dword [esi + 0x1c], 7
lea edx, [esi + 8]
mov ebx, dword [edx + 0x10]
jbe 0x10008e3e
mov edx, dword [edx]
xor ecx, ecx
mov edi, 0x811c9dc5
add ebx, ebx
je 0x10008e64
nop dword [eax]
movzx eax, byte [edx + ecx]
inc ecx
xor eax, edi
imul edi, eax, 0x1000193
cmp ecx, ebx
jb 0x10008e50
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x18]
mov ecx, dword [ebp - 0x14]
and eax, edi
lea eax, [ecx + eax*8]
mov dword [ebp + 8], eax
mov eax, dword [eax + 4]
mov dword [ebp - 0x1c], eax
mov edi, esi
mov ebx, esi
mov esi, dword [esi]
lea ecx, [edi + 8]
call fcn.10006730
push 0x48
push edi
call fcn.100147ac
mov eax, dword [ebp - 4]
add esp, 8
dec dword [eax + 8]
cmp ebx, dword [ebp - 0x1c]
je 0x10008eb9
mov eax, dword [ebp + 0xc]
cmp esi, eax
jne 0x10008e78
mov ecx, dword [ebp + 8]
pop ebx
pop edi
mov dword [ecx], esi
mov ecx, dword [ebp - 8]
mov dword [ecx], esi
mov dword [esi + 4], ecx
pop esi
mov esp, ebp
pop ebp
ret 8
mov ecx, dword [ebp + 8]
mov edi, dword [ebp - 0x18]
mov dword [ecx], edi
mov dword [ecx + 4], edi
mov ecx, dword [ebp + 0xc]
cmp esi, ecx
jne 0x10008e30
mov eax, dword [ebp - 8]
pop ebx
pop edi
mov dword [eax], esi
mov dword [esi + 4], eax
mov eax, ecx
pop esi
mov esp, ebp
pop ebp
ret 8