joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1000f840
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push esi
push 0
push dword [ebp + 8]
mov esi, ecx
push 0
push 0
push 1
mov eax, dword [esi + 0x1c]
push 1
push 0
push 0
push 0xcf0000
push eax
push eax
push 0
call dword [sym.imp.USER32.dll_CreateWindowExW]
mov dword [esi + 0xb0], eax
test eax, eax
jne 0x1000f878
pop esi
pop ebp
ret 4
push esi
push 0xffffffffffffffeb
push eax
call dword [sym.imp.USER32.dll_SetWindowLongW]
push 0
push dword [esi + 0xb0]
call dword [sym.imp.USER32.dll_ShowWindow]
mov eax, 1
pop esi
pop ebp
ret 4

Function at 0x1000f8a0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, ecx
push edi
push dword [esi + 0xb0]
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
jne 0x1000f98f
mov edx, dword [ebp + 0xc]
test edx, edx
jne 0x1000f8c6
xor ecx, ecx
jmp 0x1000f8e0
mov ecx, edx
push ebx
lea ebx, [ecx + 2]
nop dword [eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x1000f8d0
sub ecx, ebx
sar ecx, 1
pop ebx
push ecx
push edx
lea ecx, [esi + 0x1c]
call fcn.1000deb0
mov edi, dword [ebp + 8]
test edi, edi
je 0x1000f90e
mov ecx, edi
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x1000f8f6
sub ecx, edx
sar ecx, 1
push ecx
push edi
mov ecx, esi
call fcn.1000deb0
mov dword [esi + 0x84], 1
mov ecx, esi
push dword [0x100f9144]
call fcn.1000f7c0
test ax, ax
jne 0x1000f93f
push 0x100cd7fc
call fcn.1000c680
add esp, 4
xor eax, eax
pop edi
pop esi
pop ebp
ret 8
push dword [0x100f9144]
mov ecx, esi
call fcn.1000f840
test eax, eax
jne 0x1000f965
push 0x100cd80c
call fcn.1000c680
add esp, 4
xor eax, eax
pop edi
pop esi
pop ebp
ret 8
push edi
push edi
call dword [sym.imp.USER32.dll_FindWindowW]
cmp dword [esi + 0x78], 0
mov dword [esi + 0x20], eax
jne 0x1000f98f
push 0
push 0
push esi
push 0x100104b0
push 0
push 0
call fcn.100a4d7d
add esp, 0x18
mov dword [esi + 0x78], eax
pop edi
mov eax, 1
pop esi
pop ebp
ret 8
Function at 0x1000fc50
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100c1208
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
push ebx
push esi
push edi
mov eax, dword [0x100f5074]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
xor edi, edi
cmp dword [esi + 0x20], edi
jne 0x1000fcbb
mov ebx, dword [sym.imp.USER32.dll_FindWindowW]
mov eax, dword [esi]
push eax
push eax
call ebx
mov dword [esi + 0x20], eax
test eax, eax
jne 0x1000fcb4
push edi
push str.times__d__checkcheck_popmgr_wnd_DOES_NOT_exist.
call fcn.1000c680
add esp, 8
push 0xc8
push dword [esi + 0x7c]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x1000fd05
inc edi
cmp dword [esi + 0x20], 0
je 0x1000fc87
push edi
push str.times__d__check_popmgr_wnd_exist.
call fcn.1000c680
add esp, 8
mov ebx, dword [sym.imp.KERNEL32.dll_GetTickCount]
nop
mov eax, dword [esi + 0x7c]
mov dword [ebp - 0x14], eax
mov eax, dword [esi + 0x80]
push 0xffffffffffffffff
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x14]
push 0
push eax
push 2
call dword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
test eax, eax
jne 0x1000fd51
cmp dword [esi + 0x88], eax
jne 0x1000fd14
call ebx
mov dword [esi + 0x88], eax
jmp 0x1000fd23
push str.channel_send_thread_quit.
call fcn.1000c680
add esp, 4
jmp 0x1000fcc9
call ebx
sub eax, dword [esi + 0x88]
cmp eax, 0x2710
jae 0x1000fd3f
cmp dword [esi + 0x74], 0
jbe 0x1000fd3f
cmp dword [esi + 0x84], 0
je 0x1000fd3f
push dword [esi + 0x20]
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
jne 0x1000fd56
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
cmp eax, 1
jne 0x1000fd3f
lea ecx, [ebp - 0x28]
call fcn.10093750
mov eax, dword [esi + 0x48]
lea edi, [esi + 0x48]
push edi
mov dword [ebp - 4], 0
call dword [eax]
cmp dword [esi + 0x74], 0
jbe 0x1000fdc9
mov eax, dword [esi + 0x64]
test eax, eax
je 0x1000fd7d
mov eax, dword [eax]
mov ecx, dword [eax + 8]
mov eax, dword [eax + 4]
dec ecx
and ecx, dword [esi + 0x70]
push dword [eax + ecx*4]
lea ecx, [ebp - 0x28]
call fcn.100937c0
mov ecx, dword [esi + 0x6c]
mov eax, dword [esi + 0x68]
dec ecx
and ecx, dword [esi + 0x70]
push 0
mov ecx, dword [eax + ecx*4]
mov eax, dword [ecx]
call dword [eax]
add dword [esi + 0x74], 0xffffffff
jne 0x1000fdb4
mov dword [esi + 0x70], 0
jmp 0x1000fdb7
inc dword [esi + 0x70]
cmp dword [esi + 0x74], 0
jbe 0x1000fdc9
push dword [esi + 0x80]
call dword [sym.imp.KERNEL32.dll_SetEvent]
mov eax, dword [edi]
push edi
call dword [eax + 4]
mov eax, dword [ebp - 0x24]
cmp dword [eax + 8], 0
jbe 0x1000fde3
lea eax, [ebp - 0x28]
mov ecx, esi
push eax
call fcn.1000ff20
lea ecx, [ebp - 0x28]
mov dword [ebp - 4], 0xffffffff
call fcn.100937b0
jmp 0x1000fcd0

Function at 0x10012560
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ecx]
test ecx, ecx
je 0x1001256f
pop ebp
jmp fcn.10013400
xor eax, eax
pop ebp
ret 0xc
Function at 0x10013400
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100c1510
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push esi
push edi
mov eax, dword [0x100f5074]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
lea edi, [esi + 0x34]
mov dword [ebp - 0x18], vtable._BaseModule::CAutoLocker.0
mov dword [ebp - 0x14], edi
test edi, edi
je 0x10013440
mov eax, dword [edi]
push edi
call dword [eax]
cmp dword [esi + 0x24], 0
mov dword [ebp - 4], 0
jl 0x10013457
mov esi, 1
jmp 0x100135a4
mov ebx, dword [ebp + 8]
mov dword [esi + 0x24], ebx
test ebx, ebx
jns 0x10013468
xor esi, esi
jmp 0x100135a4
mov eax, dword [ebp + 0xc]
test eax, eax
je 0x10013478
push eax
lea ecx, [esi + 0x30]
call fcn.100128e0
mov eax, dword [ebp + 0x10]
test eax, eax
je 0x1001348a
push eax
lea ecx, [esi + 0x2c]
call fcn.100128e0
jmp 0x100134c3
lea eax, [ebp + 8]
push ebx
push eax
call fcn.10095320
add esp, 8
push eax
lea ecx, [esi + 0x2c]
mov byte [ebp - 4], 1
call fcn.1000e300
mov edx, dword [ebp + 8]
or eax, 0xffffffff
mov byte [ebp - 4], 0
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x100134c3
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov ecx, esi
call fcn.10013730
lea eax, [ebp - 0x10]
push ebx
push eax
call fcn.10094cd0
add esp, 8
push dword [ebp - 0x10]
mov byte [ebp - 4], 2
push 0
push str.stat_rand
push str.statistic
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
mov dword [esi + 0x1c], eax
test eax, eax
jne 0x10013580
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push eax
call fcn.100a4eba
add esp, 4
call fcn.100a4e99
cdq
mov ecx, 0x64
idiv ecx
inc edx
mov dword [esi + 0x1c], edx
call fcn.1000b3b0
mov ecx, eax
test ecx, ecx
je 0x100135cb
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp + 8], eax
push dword [esi + 0x1c]
lea eax, [ebp + 8]
mov byte [ebp - 4], 3
push 0x100cdf14
push eax
call fcn.1000e5b0
mov esi, dword [ebp + 8]
add esp, 0xc
push dword [ebp - 0x10]
push esi
push str.stat_rand
push str.statistic
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
mov byte [ebp - 4], 2
add esi, 0xfffffff0
or eax, 0xffffffff
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x10013580
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
mov edx, dword [ebp - 0x10]
mov esi, 1
mov byte [ebp - 4], 0
add edx, 0xfffffff0
or eax, 0xffffffff
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x100135a4
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov dword [ebp - 4], 4
test edi, edi
je 0x100135b5
mov ecx, dword [edi]
push edi
call dword [ecx + 4]
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
push 0x80004005
call fcn.100087a0
int3
Function at 0x100135e0
Capabilities:
Delete file
Download url
Receive data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100c1543
mov eax, dword fs:[0]
push eax
sub esp, 0x420
mov eax, dword [0x100f5074]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov esi, dword [ebp + 8]
mov eax, dword [ebp + 0xc]
xor edi, edi
mov dword [ebp - 4], 0
test esi, esi
je 0x10013685
cmp word [esi], di
je 0x10013685
test eax, eax
je 0x10013641
cmp word [eax], di
je 0x10013641
push edi
push edi
push eax
push esi
push edi
call sub.urlmon.dll_URLDownloadToFileW
test eax, eax
js 0x10013685
jmp 0x10013680
push 0x410
lea eax, [ebp - 0x420]
push 0
push eax
call fcn.1009e830
add esp, 0xc
lea eax, [ebp - 0x420]
push 0
push 0
push 0x104
push eax
push esi
push 0
call sub.urlmon.dll_URLDownloadToCacheFileW
test eax, eax
js 0x10013685
lea eax, [ebp - 0x420]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov edi, 1
mov ecx, dword [ebp + 0x34]
test ecx, ecx
je 0x100136fc
mov eax, dword [ebx + 0x24]
test eax, eax
js 0x100136e7
lea esi, [ebx + 0x34]
mov dword [ebp - method._BaseModule::CAutoLocker.virtual_0], vtable._BaseModule::CAutoLocker.0
mov dword [ebp - 0x428], esi
test esi, esi
je 0x100136b5
mov eax, dword [esi]
push esi
call dword [eax]
mov eax, dword [ebx + 0x24]
mov ecx, dword [ebp + 0x34]
mov byte [ebp - 4], 1
test eax, eax
js 0x100136d6
mov dword [ebp - 0x424], edi
test ecx, ecx
je 0x1001371c
mov eax, dword [ecx]
lea edx, [ebp - 0x424]
push edx
call dword [eax + 8]
mov ecx, dword [ebp + 0x34]
mov byte [ebp - 4], 2
test esi, esi
je 0x100136e7
mov eax, dword [esi]
push esi
call dword [eax + 4]
mov ecx, dword [ebp + 0x34]
test ecx, ecx
je 0x100136fc
mov edx, dword [ecx]
lea eax, [ebp + 0x10]
cmp ecx, eax
setne al
movzx eax, al
push eax
call dword [edx + 0x10]
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.10010efc
mov esp, ebp
pop ebp
ret 0x30
call fcn.10010e4e
int3
Function at 0x10023c80
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100c23c7
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x100f5074]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x10], edi
mov eax, dword [ebp + 8]
mov dword [edi], eax
mov eax, dword [ebp + 0xc]
mov dword [edi + 4], eax
mov eax, dword [ebp + 0x10]
mov dword [edi + 8], eax
mov dword [edi + 0xc], 0
mov dword [edi + 0x10], 0
mov dword [edi + 0x14], 0
mov byte [edi + 0x18], 0
mov dword [edi + 0x2c], 0
mov dword [edi + 0x30], 0xf
mov dword [ebp - 4], 0
mov byte [edi + 0x1c], 0
lea esi, [edi + 0x3c]
mov byte [ebp - 4], 1
mov ecx, esi
mov dword [ebp + 8], esi
mov dword [esi], 0
mov dword [esi + 4], 0
call fcn.100404d0
mov dword [esi], eax
lea esi, [edi + 0x44]
mov byte [ebp - 4], 2
mov ecx, esi
mov dword [ebp + 8], esi
mov dword [esi], 0
mov dword [esi + 4], 0
call fcn.100404d0
mov dword [esi], eax
mov dword [edi + 0x4c], 0
mov dword [edi + 0x60], 0
mov dword [edi + 0x64], 0xf
mov byte [edi + 0x50], 0
lea ecx, [edi + 0x68]
mov byte [ebp - 4], 4
mov dword [ecx + 0x10], 0
push 0
mov dword [ecx + 0x14], 0xf
push 0x100cbc00
mov byte [ecx], 0
call fcn.10007260
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 0xc

Function at 0x10025790
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
push esi
push edi
mov esi, dword [eax]
mov ecx, esi
lea edx, [ecx + 1]
nop
mov al, byte [ecx]
inc ecx
test al, al
jne 0x100257a0
sub ecx, edx
xor edi, edi
push ebx
xor ebx, ebx
mov eax, 0x811c9dc5
lea edx, [ecx + esi]
cmp esi, edx
cmova ecx, ebx
pop ebx
test ecx, ecx
je 0x100257d3
movzx edx, byte [esi]
lea esi, [esi + 1]
xor edx, eax
inc edi
imul eax, edx, 0x1000193
cmp edi, ecx
jne 0x100257c0
and eax, 0x7fffffff
push 0x1f31d
push eax
call fcn.100a6223
imul eax, eax, 0xb14
add esp, 8
imul ecx, edx, 0x41a7
pop edi
pop esi
sub ecx, eax
lea eax, [ecx + 0x7fffffff]
js 0x10025800
mov eax, ecx
pop ebp
ret 4
Function at 0x100698c0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100c6f1a
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push esi
push edi
mov eax, dword [0x100f5074]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, dword [ebp + 8]
test edi, edi
jne 0x1006992d
push 0x38
call fcn.10010ebe
add esp, 4
mov dword [ebp + 8], eax
mov dword [ebp - 4], edi
test eax, eax
je 0x1006991a
mov ecx, eax
call fcn.1006c400
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
cmp dword [edi + 0x40], 0
je 0x10069941
push 0x38
push 0x100f74cc
mov ecx, edi
call fcn.10016fa0
push 0x38
mov ecx, edi
call fcn.10016d10
mov esi, eax
mov dword [ebp + 8], esi
mov dword [esi], vtable.google::protobuf::FieldDescriptorProto.0
mov dword [ebp - 4], 1
mov dword [esi + 4], edi
mov dword [esi + 8], 0
mov eax, dword [0x100f999c]
mov byte [ebp - 4], 2
cmp eax, 2
je 0x100699a3
mov dword [ebp - 0x18], 0x100cb4e4
mov dword [ebp - 0x14], 0x10074690
mov byte [ebp - 0x10], 0
lea eax, [ebp - 0x18]
mov byte [ebp - 4], 3
push eax
push 0x100f999c
call fcn.10016fc0
add esp, 8
lea ecx, [ebp - 0x18]
call fcn.100147b0
mov dword [esi + 0xc], 0
xorps xmm0, xmm0
mov dword [esi + 0x10], 0x100f91c0
mov eax, esi
mov dword [esi + 0x14], 0x100f91c0
mov dword [esi + 0x18], 0x100f91c0
mov dword [esi + 0x1c], 0x100f91c0
mov dword [esi + 0x20], 0x100f91c0
movq qword [esi + 0x24], xmm0
mov dword [esi + 0x2c], 0
mov dword [esi + 0x30], 1
mov dword [esi + 0x34], 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x1006a980
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100c7275
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push esi
push edi
mov eax, dword [0x100f5074]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, dword [ebp + 8]
test edi, edi
jne 0x1006a9ed
push 0x48
call fcn.10010ebe
add esp, 4
mov dword [ebp + 8], eax
mov dword [ebp - 4], edi
test eax, eax
je 0x1006a9da
mov ecx, eax
call fcn.1006d3b0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
cmp dword [edi + 0x40], 0
je 0x1006aa01
push 0x48
push 0x100f8598
mov ecx, edi
call fcn.10016fa0
push 0x48
mov ecx, edi
call fcn.10016d10
mov esi, eax
mov dword [ebp + 8], esi
mov dword [esi], vtable.google::protobuf::UninterpretedOption.0
mov dword [ebp - 4], 1
mov dword [esi + 4], edi
mov dword [esi + 8], 0
mov dword [esi + 0x10], edi
mov dword [esi + 0x14], 0
mov dword [esi + 0x18], 0
mov dword [esi + 0x1c], 0
mov eax, dword [0x100f99dc]
mov byte [ebp - 4], 3
cmp eax, 2
je 0x1006aa7b
mov dword [ebp - 0x18], 0x100cb4e4
mov dword [ebp - 0x14], 0x100752b0
mov byte [ebp - 0x10], 0
lea eax, [ebp - 0x18]
mov byte [ebp - 4], 4
push eax
push 0x100f99dc
call fcn.10016fc0
add esp, 8
lea ecx, [ebp - 0x18]
call fcn.100147b0
xorps xmm0, xmm0
mov dword [esi + 0xc], 0
mov dword [esi + 0x20], 0x100f91c0
mov eax, esi
mov dword [esi + 0x24], 0x100f91c0
mov dword [esi + 0x28], 0x100f91c0
movups xmmword [esi + 0x30], xmm0
movq qword [esi + 0x40], xmm0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x1006c320
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100c73db
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push esi
mov eax, dword [0x100f5074]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
mov eax, dword [ebp + 8]
mov dword [esi], vtable.google::protobuf::FieldDescriptorProto.0
mov dword [ebp - 4], 0
mov dword [esi + 4], eax
mov dword [esi + 8], 0
mov eax, dword [0x100f999c]
mov byte [ebp - 4], 1
cmp eax, 2
je 0x1006c3a2
mov dword [ebp - 0x1c], 0x100cb4e4
mov dword [ebp - 0x18], 0x10074690
mov byte [ebp - 0x14], 0
lea eax, [ebp - 0x1c]
mov byte [ebp - 4], 2
push eax
push 0x100f999c
call fcn.10016fc0
add esp, 8
lea ecx, [ebp - 0x1c]
call fcn.100147b0
mov dword [esi + 0xc], 0
xorps xmm0, xmm0
mov dword [esi + 0x10], 0x100f91c0
mov eax, esi
mov dword [esi + 0x14], 0x100f91c0
mov dword [esi + 0x18], 0x100f91c0
mov dword [esi + 0x1c], 0x100f91c0
mov dword [esi + 0x20], 0x100f91c0
movq qword [esi + 0x24], xmm0
mov dword [esi + 0x2c], 0
mov dword [esi + 0x30], 1
mov dword [esi + 0x34], 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x10071200
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push esi
mov esi, ecx
push edi
mov dword [ebp - 8], esi
mov edi, dword [esi + 0x14]
test edi, edi
jle 0x10071242
mov edx, dword [esi + 0x1c]
xor ecx, ecx
nop dword [eax]
mov eax, dword [edx + ecx*4 + 4]
cmp dword [eax + 0x14], 0x10
mov dword [eax + 0x10], 0
jb 0x10071233
mov eax, dword [eax]
inc ecx
mov byte [eax], 0
cmp ecx, edi
jl 0x10071220
mov dword [esi + 0x14], 0
push ebx
mov ebx, dword [esi + 0x24]
test ebx, ebx
jle 0x10071269
mov eax, dword [esi + 0x2c]
xor edi, edi
mov esi, eax
mov ecx, dword [esi + edi*4 + 4]
call fcn.100709e0
inc edi
cmp edi, ebx
jl 0x10071251
mov esi, dword [ebp - 8]
mov dword [esi + 0x24], 0
mov ebx, dword [esi + 0x34]
test ebx, ebx
jle 0x10071298
mov eax, dword [esi + 0x3c]
xor edi, edi
mov dword [ebp - 4], eax
mov esi, eax
nop word [eax + eax]
mov ecx, dword [esi + edi*4 + 4]
call fcn.10070d60
inc edi
cmp edi, ebx
jl 0x10071280
mov esi, dword [ebp - 8]
mov dword [esi + 0x34], 0
mov ebx, dword [esi + 0x44]
test ebx, ebx
jle 0x100712c8
mov eax, dword [esi + 0x4c]
xor edi, edi
mov dword [ebp - 4], eax
mov esi, eax
nop dword [eax]
mov ecx, dword [esi + edi*4 + 4]
call fcn.100718d0
inc edi
cmp edi, ebx
jl 0x100712b0
mov esi, dword [ebp - 8]
mov dword [esi + 0x44], 0
mov ebx, dword [esi + 0x54]
test ebx, ebx
jle 0x100712f8
mov eax, dword [esi + 0x5c]
xor edi, edi
mov dword [ebp - 4], eax
mov esi, eax
nop dword [eax]
mov ecx, dword [esi + edi*4 + 4]
call fcn.10071070
inc edi
cmp edi, ebx
jl 0x100712e0
mov esi, dword [ebp - 8]
mov dword [esi + 0x54], 0
mov dword [esi + 0x60], 0
mov dword [esi + 0x6c], 0
mov ebx, dword [esi + 8]
test bl, 0x1f
je 0x10071398
test bl, 1
je 0x10071333
mov eax, dword [esi + 0x78]
cmp eax, 0x100f91c0
je 0x10071333
cmp dword [eax + 0x14], 0x10
mov dword [eax + 0x10], 0
jb 0x10071330
mov eax, dword [eax]
mov byte [eax], 0
test bl, 2
je 0x10071354
mov eax, dword [esi + 0x7c]
cmp eax, 0x100f91c0
je 0x10071354
cmp dword [eax + 0x14], 0x10
mov dword [eax + 0x10], 0
jb 0x10071351
mov eax, dword [eax]
mov byte [eax], 0
test bl, 4
je 0x10071378
mov eax, dword [esi + 0x80]
cmp eax, 0x100f91c0
je 0x10071378
cmp dword [eax + 0x14], 0x10
mov dword [eax + 0x10], 0
jb 0x10071375
mov eax, dword [eax]
mov byte [eax], 0
test bl, 8
je 0x10071388
mov ecx, dword [esi + 0x84]
call fcn.10071420
test bl, 0x10
je 0x10071398
mov ecx, dword [esi + 0x88]
call fcn.10071970
mov dword [esi + 8], 0
test byte [esi + 4], 1
pop ebx
je 0x100713b6
mov ecx, dword [esi + 4]
and ecx, 0xfffffffe
cmp dword [ecx], 0
je 0x100713b6
call fcn.1001d140
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x1008e110
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100c26a0
mov eax, dword fs:[0]
push eax
sub esp, 0x50
mov eax, dword [0x100f5074]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
mov ecx, esi
call fcn.1005cd80
dec eax
cmp eax, 9
ja case.default.0x1008e14b
jmp dword [eax*4 + 0x1008e2ac]
push 0x32c
push str.D:_sourcecode460SoftwareGasteprotobuf_cpp_3.5.1protobuf_3.5.1_srcgoogle_protobuf_map_field.h
push 3
lea ecx, [ebp - 0x34]
call fcn.100146f0
push str.Unsupported
mov ecx, eax
mov dword [ebp - 4], 0
call fcn.10014b10
push eax
lea ecx, [ebp - 0x59]
call fcn.10014900
lea ecx, [ebp - 0x34]
mov dword [ebp - 4], 0xffffffff
call fcn.10014830
push 0x33b
push str.D:_sourcecode460SoftwareGasteprotobuf_cpp_3.5.1protobuf_3.5.1_srcgoogle_protobuf_map_field.h
push 3
lea ecx, [ebp - 0x58]
call fcn.100146f0
push str.Cant_get_here.
mov ecx, eax
mov dword [ebp - 4], 1
call fcn.10014b10
push eax
lea ecx, [ebp - 0x5a]
call fcn.10014900
lea ecx, [ebp - 0x58]
call fcn.10014830
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.10010efc
mov esp, ebp
pop ebp
ret 4
mov ecx, esi
call fcn.10058c80
mov esi, eax
cmp dword [esi + 0x14], 0x10
jb 0x1008e1fa
mov esi, dword [esi]
mov edx, esi
lea ecx, [edx + 1]
nop
mov al, byte [edx]
inc edx
test al, al
jne 0x1008e200
sub edx, ecx
xor ebx, ebx
xor edi, edi
mov eax, 0x811c9dc5
lea ecx, [edx + esi]
cmp esi, ecx
cmova edx, ebx
test edx, edx
je 0x1008e233
nop
movzx ecx, byte [esi]
lea esi, [esi + 1]
xor ecx, eax
inc edi
imul eax, ecx, 0x1000193
cmp edi, edx
jne 0x1008e220
and eax, 0x7fffffff
push 0x1f31d
push eax
call fcn.100a6223
imul edx, edx, 0x41a7
add esp, 8
imul ecx, eax, 0xb14
sub edx, ecx
jns 0x1008e25c
add edx, 0x7fffffff
mov eax, edx
jmp 0x1008e1cb
mov ecx, esi
call fcn.10058990
xor eax, 0xdeadbeef
jmp 0x1008e233
mov ecx, esi
call fcn.100587a0
xor eax, 0xdeadbeef
jmp 0x1008e233
mov ecx, esi
call fcn.10059050
xor eax, 0xdeadbeef
jmp 0x1008e233
mov ecx, esi
call fcn.10058e60
xor eax, 0xdeadbeef
jmp 0x1008e233
mov ecx, esi
call fcn.100585b0
movzx eax, al
xor eax, 0xdeadbeef
jmp 0x1008e233