joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10020f00
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
sub esp, 8
push ebx
push ebp
mov ebp, dword [esp + 0x18]
mov ebx, ecx
push esi
push edi
mov edx, ebp
cmp dword [ebp + 0x14], 0x10
mov edi, dword [ebp + 0x10]
jb 0x10020f1b
mov edx, dword [ebp]
xor ecx, ecx
mov esi, 0x811c9dc5
test edi, edi
je 0x10020f37
movzx eax, byte [ecx + edx]
inc ecx
xor eax, esi
imul esi, eax, 0x1000193
cmp ecx, edi
jb 0x10020f26
push esi
push ebp
lea eax, [esp + 0x18]
mov ecx, ebx
push eax
call fcn.10025670
mov ecx, dword [esp + 0x14]
test ecx, ecx
je 0x10020f61
mov eax, dword [esp + 0x1c]
mov dword [eax], ecx
mov byte [eax + 4], 0
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret 0xc
cmp dword [ebx + 8], 0x5d1745d
je 0x100210b1
push 0x2c
call fcn.1011c1db
add esp, 4
mov edi, eax
lea ecx, [edi + 8]
push ebp
call fcn.10019f90
mov eax, dword [esp + 0x24]
movq xmm0, qword [eax]
movq qword [edi + 0x20], xmm0
mov eax, dword [eax + 8]
mov dword [edi + 0x28], eax
mov ecx, dword [ebx + 8]
mov ebp, dword [ebx + 0x1c]
movss xmm3, dword [ebx]
lea eax, [ecx + 1]
movd xmm0, eax
cvtdq2pd xmm0, xmm0
shr eax, 0x1f
addsd xmm0, qword [eax*8 + 0x101797a0]
mov eax, ebp
shr eax, 0x1f
cvtpd2ps xmm2, xmm0
movd xmm0, ebp
cvtdq2pd xmm0, xmm0
movaps xmm1, xmm2
addsd xmm0, qword [eax*8 + 0x101797a0]
cvtpd2ps xmm0, xmm0
divss xmm1, xmm0
comiss xmm1, xmm3
jbe 0x1002104b
divss xmm2, xmm3
sub esp, 8
movss dword [esp + 0x28], xmm2
fld dword [esp + 0x28]
fstp qword [esp]
call fcn.10141290
add esp, 8
fstp dword [esp + 0x20]
movss xmm0, dword [esp + 0x20]
call fcn.10142a20
mov ecx, 8
cmp eax, ecx
cmova ecx, eax
cmp ebp, ecx
jae 0x1002102b
cmp ebp, 0x200
jae 0x10021029
shl ebp, 3
cmp ebp, ecx
jae 0x1002102b
mov ebp, ecx
push ebp
mov ecx, ebx
call fcn.100233f0
push esi
lea eax, [edi + 8]
mov ecx, ebx
push eax
lea eax, [esp + 0x18]
push eax
call fcn.10025670
mov ecx, dword [ebx + 8]
mov edx, dword [eax]
jmp 0x1002104f
mov edx, dword [esp + 0x10]
mov ebp, dword [edx + 4]
lea eax, [ecx + 1]
mov dword [ebx + 8], eax
mov dword [edi], edx
mov dword [edi + 4], ebp
mov dword [ebp], edi
mov dword [edx + 4], edi
mov eax, dword [ebx + 0x18]
mov ecx, dword [ebx + 0xc]
and eax, esi
mov esi, dword [ecx + eax*8]
cmp esi, dword [ebx + 4]
jne 0x10021078
mov dword [ecx + eax*8], edi
jmp 0x10021099
cmp esi, edx
jne 0x10021093
mov dword [ecx + eax*8], edi
mov eax, dword [esp + 0x1c]
mov dword [eax], edi
mov byte [eax + 4], 1
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret 0xc
cmp dword [ecx + eax*8 + 4], ebp
jne 0x1002109d
mov dword [ecx + eax*8 + 4], edi
mov eax, dword [esp + 0x1c]
mov dword [eax], edi
pop edi
pop esi
pop ebp
mov byte [eax + 4], 1
pop ebx
add esp, 8
ret 0xc
push str.unordered_map_set_too_long
call fcn.1011a7de
int3
Function at 0x10027920
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
sub esp, 0xc
push ebx
push ebp
mov ebp, dword [esp + 0x1c]
mov ebx, ecx
push esi
push edi
mov edx, ebp
cmp dword [ebp + 0x14], 0x10
mov edi, dword [ebp + 0x10]
jb 0x1002793b
mov edx, dword [ebp]
xor ecx, ecx
mov esi, 0x811c9dc5
test edi, edi
je 0x10027957
movzx eax, byte [ecx + edx]
inc ecx
xor eax, esi
imul esi, eax, 0x1000193
cmp ecx, edi
jb 0x10027946
push esi
push ebp
lea eax, [esp + 0x18]
mov ecx, ebx
push eax
call fcn.10025670
mov ecx, dword [esp + 0x14]
test ecx, ecx
je 0x10027981
mov eax, dword [esp + 0x20]
mov dword [eax], ecx
mov byte [eax + 4], 0
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret 8
cmp dword [ebx + 8], 0x4444444
je 0x10027acd
push 0x3c
call fcn.1011c1db
mov cl, byte [0x10157378]
mov edi, eax
push ecx
mov byte [esp + 0x2c], cl
mov ecx, esp
push dword [esp + 0x2c]
mov dword [ecx], ebp
lea ecx, [edi + 8]
call fcn.1002c5d0
mov ecx, dword [ebx + 8]
mov ebp, dword [ebx + 0x1c]
movss xmm3, dword [ebx]
lea eax, [ecx + 1]
movd xmm0, eax
cvtdq2pd xmm0, xmm0
shr eax, 0x1f
addsd xmm0, qword [eax*8 + 0x101797a0]
mov eax, ebp
shr eax, 0x1f
cvtpd2ps xmm2, xmm0
movd xmm0, ebp
cvtdq2pd xmm0, xmm0
movaps xmm1, xmm2
addsd xmm0, qword [eax*8 + 0x101797a0]
cvtpd2ps xmm0, xmm0
divss xmm1, xmm0
comiss xmm1, xmm3
jbe 0x10027a67
divss xmm2, xmm3
sub esp, 8
movss dword [esp + 0x2c], xmm2
fld dword [esp + 0x2c]
fstp qword [esp]
call fcn.10141290
add esp, 8
fstp dword [esp + 0x24]
movss xmm0, dword [esp + 0x24]
call fcn.10142a20
mov ecx, 8
cmp eax, ecx
cmova ecx, eax
cmp ebp, ecx
jae 0x10027a47
cmp ebp, 0x200
jae 0x10027a45
shl ebp, 3
cmp ebp, ecx
jae 0x10027a47
mov ebp, ecx
push ebp
mov ecx, ebx
call fcn.100233f0
push esi
lea eax, [edi + 8]
mov ecx, ebx
push eax
lea eax, [esp + 0x18]
push eax
call fcn.10025670
mov ecx, dword [ebx + 8]
mov edx, dword [eax]
jmp 0x10027a6b
mov edx, dword [esp + 0x10]
mov ebp, dword [edx + 4]
lea eax, [ecx + 1]
mov dword [ebx + 8], eax
mov dword [edi], edx
mov dword [edi + 4], ebp
mov dword [ebp], edi
mov dword [edx + 4], edi
mov eax, dword [ebx + 0x18]
mov ecx, dword [ebx + 0xc]
and eax, esi
mov esi, dword [ecx + eax*8]
cmp esi, dword [ebx + 4]
jne 0x10027a94
mov dword [ecx + eax*8], edi
jmp 0x10027ab5
cmp esi, edx
jne 0x10027aaf
mov dword [ecx + eax*8], edi
mov eax, dword [esp + 0x20]
mov dword [eax], edi
mov byte [eax + 4], 1
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret 8
cmp dword [ecx + eax*8 + 4], ebp
jne 0x10027ab9
mov dword [ecx + eax*8 + 4], edi
mov eax, dword [esp + 0x20]
mov dword [eax], edi
pop edi
pop esi
pop ebp
mov byte [eax + 4], 1
pop ebx
add esp, 0xc
ret 8
push str.unordered_map_set_too_long
call fcn.1011a7de
int3
Function at 0x10027ae0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
sub esp, 0xc
push ebx
push ebp
push esi
mov esi, dword [esp + 0x20]
mov ebp, ecx
push edi
mov edx, esi
cmp dword [esi + 0x14], 0x10
mov ebx, dword [esi + 0x10]
jb 0x10027afa
mov edx, dword [esi]
xor ecx, ecx
mov edi, 0x811c9dc5
test ebx, ebx
je 0x10027b16
movzx eax, byte [ecx + edx]
inc ecx
xor eax, edi
imul edi, eax, 0x1000193
cmp ecx, ebx
jb 0x10027b05
push edi
push esi
lea eax, [esp + 0x18]
mov ecx, ebp
push eax
call fcn.10025670
mov ecx, dword [esp + 0x14]
test ecx, ecx
je 0x10027b40
mov eax, dword [esp + 0x20]
mov dword [eax], ecx
mov byte [eax + 4], 0
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret 8
cmp dword [ebp + 8], 0x234f72c
je 0x10027c94
push 0x74
call fcn.1011c1db
add esp, 4
mov ebx, eax
lea ecx, [ebx + 8]
push esi
call fcn.10019f90
push 0x54
lea esi, [ebx + 0x20]
push 0
push esi
call fcn.1011df10
add esp, 0xc
mov ecx, esi
call fcn.1002c730
mov ecx, dword [ebp + 8]
mov esi, dword [ebp + 0x1c]
movss xmm3, dword [ebp]
lea eax, [ecx + 1]
movd xmm0, eax
cvtdq2pd xmm0, xmm0
shr eax, 0x1f
addsd xmm0, qword [eax*8 + 0x101797a0]
mov eax, esi
shr eax, 0x1f
cvtpd2ps xmm2, xmm0
movd xmm0, esi
cvtdq2pd xmm0, xmm0
movaps xmm1, xmm2
addsd xmm0, qword [eax*8 + 0x101797a0]
cvtpd2ps xmm0, xmm0
divss xmm1, xmm0
comiss xmm1, xmm3
jbe 0x10027c2f
divss xmm2, xmm3
sub esp, 8
movss dword [esp + 0x2c], xmm2
fld dword [esp + 0x2c]
fstp qword [esp]
call fcn.10141290
add esp, 8
fstp dword [esp + 0x24]
movss xmm0, dword [esp + 0x24]
call fcn.10142a20
mov ecx, 8
cmp eax, ecx
cmova ecx, eax
cmp esi, ecx
jae 0x10027c0f
cmp esi, 0x200
jae 0x10027c0d
shl esi, 3
cmp esi, ecx
jae 0x10027c0f
mov esi, ecx
push esi
mov ecx, ebp
call fcn.100233f0
push edi
lea eax, [ebx + 8]
mov ecx, ebp
push eax
lea eax, [esp + 0x18]
push eax
call fcn.10025670
mov ecx, dword [ebp + 8]
mov edx, dword [eax]
jmp 0x10027c33
mov edx, dword [esp + 0x10]
mov esi, dword [edx + 4]
lea eax, [ecx + 1]
mov dword [ebp + 8], eax
mov dword [ebx], edx
mov dword [ebx + 4], esi
mov dword [esi], ebx
mov dword [edx + 4], ebx
mov eax, dword [ebp + 0x18]
mov ecx, dword [ebp + 0xc]
and eax, edi
mov edi, dword [ecx + eax*8]
cmp edi, dword [ebp + 4]
jne 0x10027c5b
mov dword [ecx + eax*8], ebx
jmp 0x10027c7c
cmp edi, edx
jne 0x10027c76
mov dword [ecx + eax*8], ebx
mov eax, dword [esp + 0x20]
mov dword [eax], ebx
mov byte [eax + 4], 1
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret 8
cmp dword [ecx + eax*8 + 4], esi
jne 0x10027c80
mov dword [ecx + eax*8 + 4], ebx
mov eax, dword [esp + 0x20]
pop edi
pop esi
pop ebp
mov dword [eax], ebx
mov byte [eax + 4], 1
pop ebx
add esp, 0xc
ret 8
push str.unordered_map_set_too_long
call fcn.1011a7de
int3
Function at 0x10027ca0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
sub esp, 0x14
push ebx
push ebp
push esi
mov esi, dword [esp + 0x28]
mov edx, esi
push edi
mov edi, ecx
mov dword [esp + 0x14], edi
cmp dword [esi + 0x14], 0x10
mov ebp, dword [esi + 0x10]
jb 0x10027cbe
mov edx, dword [esi]
xor ecx, ecx
mov ebx, 0x811c9dc5
test ebp, ebp
je 0x10027ce1
nop dword [eax]
movzx eax, byte [ecx + edx]
inc ecx
xor eax, ebx
imul ebx, eax, 0x1000193
cmp ecx, ebp
jb 0x10027cd0
push ebx
push esi
lea eax, [esp + 0x20]
mov ecx, edi
push eax
call fcn.10025670
mov ecx, dword [esp + 0x1c]
test ecx, ecx
je 0x10027d0b
mov eax, dword [esp + 0x28]
mov dword [eax], ecx
mov byte [eax + 4], 0
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x14
ret 8
cmp dword [edi + 8], 0xffffff
je 0x10027e76
push 0x100
call fcn.1011c1db
add esp, 4
mov ebp, eax
push esi
lea ecx, [ebp + 8]
call fcn.10019f90
push 0xe0
lea esi, [ebp + 0x20]
push 0
push esi
call fcn.1011df10
add esp, 0xc
mov edi, 7
mov ecx, esi
call fcn.10010730
add esi, 0x20
sub edi, 1
jne 0x10027d48
mov esi, dword [esp + 0x14]
mov ecx, dword [esi + 8]
mov edi, dword [esi + 0x1c]
movss xmm3, dword [esi]
lea eax, [ecx + 1]
movd xmm0, eax
cvtdq2pd xmm0, xmm0
shr eax, 0x1f
addsd xmm0, qword [eax*8 + 0x101797a0]
mov eax, edi
shr eax, 0x1f
cvtpd2ps xmm2, xmm0
movd xmm0, edi
cvtdq2pd xmm0, xmm0
movaps xmm1, xmm2
addsd xmm0, qword [eax*8 + 0x101797a0]
cvtpd2ps xmm0, xmm0
divss xmm1, xmm0
comiss xmm1, xmm3
jbe 0x10027e10
divss xmm2, xmm3
sub esp, 8
movss dword [esp + 0x34], xmm2
fld dword [esp + 0x34]
fstp qword [esp]
call fcn.10141290
add esp, 8
fstp dword [esp + 0x2c]
movss xmm0, dword [esp + 0x2c]
call fcn.10142a20
mov ecx, 8
cmp eax, ecx
cmova ecx, eax
cmp edi, ecx
jae 0x10027df0
cmp edi, 0x200
jae 0x10027dee
shl edi, 3
cmp edi, ecx
jae 0x10027df0
mov edi, ecx
push edi
mov ecx, esi
call fcn.100233f0
push ebx
lea eax, [ebp + 8]
mov ecx, esi
push eax
lea eax, [esp + 0x20]
push eax
call fcn.10025670
mov ecx, dword [esi + 8]
mov edx, dword [eax]
jmp 0x10027e14
mov edx, dword [esp + 0x18]
mov edi, dword [edx + 4]
lea eax, [ecx + 1]
mov dword [esi + 8], eax
mov dword [ebp], edx
mov dword [ebp + 4], edi
mov dword [edi], ebp
mov dword [edx + 4], ebp
mov eax, dword [esi + 0x18]
mov ecx, dword [esi + 0xc]
and eax, ebx
mov ebx, dword [ecx + eax*8]
cmp ebx, dword [esi + 4]
jne 0x10027e3d
mov dword [ecx + eax*8], ebp
jmp 0x10027e5e
cmp ebx, edx
jne 0x10027e58
mov dword [ecx + eax*8], ebp
mov eax, dword [esp + 0x28]
mov dword [eax], ebp
mov byte [eax + 4], 1
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x14
ret 8
cmp dword [ecx + eax*8 + 4], edi
jne 0x10027e62
mov dword [ecx + eax*8 + 4], ebp
mov eax, dword [esp + 0x28]
pop edi
pop esi
mov dword [eax], ebp
pop ebp
mov byte [eax + 4], 1
pop ebx
add esp, 0x14
ret 8
push str.unordered_map_set_too_long
call fcn.1011a7de
int3
Function at 0x10029330
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
sub esp, 0x18
push ebx
mov ebx, dword [esp + 0x20]
push ebp
mov ebp, dword [esp + 0x28]
push edi
mov edi, ecx
cmp ebx, ebp
je 0x100294e6
cmp dword [ebx + 0x1c], 0x10
lea edx, [ebx + 8]
mov eax, dword [edi + 4]
mov dword [esp + 0x18], eax
mov eax, dword [edi + 0xc]
mov dword [esp + 0x14], eax
mov eax, dword [ebx + 4]
mov dword [esp + 0x1c], eax
mov eax, dword [edx + 0x10]
jb 0x1002936b
mov edx, dword [edx]
xor ecx, ecx
push esi
mov esi, 0x811c9dc5
test eax, eax
je 0x10029395
mov ebp, eax
nop dword [eax]
movzx eax, byte [ecx + edx]
inc ecx
xor eax, esi
imul esi, eax, 0x1000193
cmp ecx, ebp
jb 0x10029380
mov ebp, dword [esp + 0x30]
mov eax, dword [edi + 0x18]
mov edx, ebx
mov ecx, dword [esp + 0x18]
and eax, esi
mov esi, dword [ebx]
lea eax, [ecx + eax*8]
mov ecx, dword [eax]
mov dword [esp + 0x2c], eax
mov eax, dword [eax + 4]
mov dword [esp + 0x14], ecx
mov dword [esp + 0x10], eax
call fcn.100034c0
dec dword [edi + 8]
cmp ebx, dword [esp + 0x10]
je 0x100293e2
mov dword [esp + 0x24], esi
cmp esi, ebp
je 0x100293f4
mov edx, esi
mov esi, dword [esi]
call fcn.100034c0
dec dword [edi + 8]
mov eax, dword [esp + 0x10]
cmp dword [esp + 0x24], eax
jne 0x100293c4
mov ecx, dword [esp + 0x2c]
cmp dword [esp + 0x14], ebx
jne 0x10029419
mov eax, dword [esp + 0x1c]
mov dword [ecx], eax
jmp 0x1002941d
cmp dword [esp + 0x14], ebx
jne 0x100294dc
mov eax, dword [esp + 0x20]
mov ecx, dword [esp + 0x2c]
mov dword [ecx], esi
mov dword [eax], esi
mov dword [esi + 4], eax
mov eax, ebp
pop esi
pop edi
pop ebp
pop ebx
add esp, 0x18
ret 8
mov eax, dword [esp + 0x20]
mov dword [ecx + 4], eax
cmp esi, ebp
je 0x100294dc
nop dword [eax + eax]
cmp dword [esi + 0x1c], 0x10
lea edx, [esi + 8]
mov eax, dword [edx + 0x10]
mov dword [esp + 0x24], esi
mov dword [esp + 0x2c], eax
jb 0x10029446
mov edx, dword [edx]
xor ecx, ecx
mov ebx, 0x811c9dc5
test eax, eax
je 0x1002946a
mov ebp, dword [esp + 0x2c]
movzx eax, byte [ecx + edx]
inc ecx
xor eax, ebx
imul ebx, eax, 0x1000193
cmp ecx, ebp
jb 0x10029455
mov ebp, dword [esp + 0x30]
mov eax, dword [edi + 0x18]
mov edx, esi
mov ecx, dword [esp + 0x18]
and eax, ebx
mov ebx, dword [ecx + eax*8 + 4]
mov esi, dword [esi]
mov dword [esp + 0x14], ebx
lea eax, [ecx + eax*8]
mov dword [esp + 0x2c], eax
call fcn.100034c0
dec dword [edi + 8]
cmp dword [esp + 0x24], ebx
je 0x100294ac
mov ebx, esi
cmp esi, ebp
je 0x100294d6
mov edx, esi
mov esi, dword [esi]
call fcn.100034c0
dec dword [edi + 8]
cmp ebx, dword [esp + 0x14]
jne 0x10029494
mov eax, dword [esp + 0x2c]
mov ebx, dword [esp + 0x1c]
mov dword [eax], ebx
mov dword [eax + 4], ebx
cmp esi, ebp
jne 0x10029430
mov eax, dword [esp + 0x20]
mov dword [eax], esi
mov dword [esi + 4], eax
mov eax, ebp
pop esi
pop edi
pop ebp
pop ebx
add esp, 0x18
ret 8
mov eax, dword [esp + 0x2c]
mov dword [eax], esi
mov eax, dword [esp + 0x20]
mov dword [eax], esi
mov dword [esi + 4], eax
pop esi
pop edi
mov eax, ebp
pop ebp
pop ebx
add esp, 0x18
ret 8
Function at 0x10029500
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
sub esp, 0x18
push ebx
mov ebx, dword [esp + 0x20]
push ebp
mov ebp, dword [esp + 0x28]
push edi
mov edi, ecx
cmp ebx, ebp
je 0x100296b6
cmp dword [ebx + 0x1c], 0x10
lea edx, [ebx + 8]
mov eax, dword [edi + 4]
mov dword [esp + 0x18], eax
mov eax, dword [edi + 0xc]
mov dword [esp + 0x14], eax
mov eax, dword [ebx + 4]
mov dword [esp + 0x1c], eax
mov eax, dword [edx + 0x10]
jb 0x1002953b
mov edx, dword [edx]
xor ecx, ecx
push esi
mov esi, 0x811c9dc5
test eax, eax
je 0x10029565
mov ebp, eax
nop dword [eax]
movzx eax, byte [ecx + edx]
inc ecx
xor eax, esi
imul esi, eax, 0x1000193
cmp ecx, ebp
jb 0x10029550
mov ebp, dword [esp + 0x30]
mov eax, dword [edi + 0x18]
mov edx, ebx
mov ecx, dword [esp + 0x18]
and eax, esi
mov esi, dword [ebx]
lea eax, [ecx + eax*8]
mov ecx, dword [eax]
mov dword [esp + 0x2c], eax
mov eax, dword [eax + 4]
mov dword [esp + 0x14], ecx
mov dword [esp + 0x10], eax
call fcn.10003520
dec dword [edi + 8]
cmp ebx, dword [esp + 0x10]
je 0x100295b2
mov dword [esp + 0x24], esi
cmp esi, ebp
je 0x100295c4
mov edx, esi
mov esi, dword [esi]
call fcn.10003520
dec dword [edi + 8]
mov eax, dword [esp + 0x10]
cmp dword [esp + 0x24], eax
jne 0x10029594
mov ecx, dword [esp + 0x2c]
cmp dword [esp + 0x14], ebx
jne 0x100295e9
mov eax, dword [esp + 0x1c]
mov dword [ecx], eax
jmp 0x100295ed
cmp dword [esp + 0x14], ebx
jne 0x100296ac
mov eax, dword [esp + 0x20]
mov ecx, dword [esp + 0x2c]
mov dword [ecx], esi
mov dword [eax], esi
mov dword [esi + 4], eax
mov eax, ebp
pop esi
pop edi
pop ebp
pop ebx
add esp, 0x18
ret 8
mov eax, dword [esp + 0x20]
mov dword [ecx + 4], eax
cmp esi, ebp
je 0x100296ac
nop dword [eax + eax]
cmp dword [esi + 0x1c], 0x10
lea edx, [esi + 8]
mov eax, dword [edx + 0x10]
mov dword [esp + 0x24], esi
mov dword [esp + 0x2c], eax
jb 0x10029616
mov edx, dword [edx]
xor ecx, ecx
mov ebx, 0x811c9dc5
test eax, eax
je 0x1002963a
mov ebp, dword [esp + 0x2c]
movzx eax, byte [ecx + edx]
inc ecx
xor eax, ebx
imul ebx, eax, 0x1000193
cmp ecx, ebp
jb 0x10029625
mov ebp, dword [esp + 0x30]
mov eax, dword [edi + 0x18]
mov edx, esi
mov ecx, dword [esp + 0x18]
and eax, ebx
mov ebx, dword [ecx + eax*8 + 4]
mov esi, dword [esi]
mov dword [esp + 0x14], ebx
lea eax, [ecx + eax*8]
mov dword [esp + 0x2c], eax
call fcn.10003520
dec dword [edi + 8]
cmp dword [esp + 0x24], ebx
je 0x1002967c
mov ebx, esi
cmp esi, ebp
je 0x100296a6
mov edx, esi
mov esi, dword [esi]
call fcn.10003520
dec dword [edi + 8]
cmp ebx, dword [esp + 0x14]
jne 0x10029664
mov eax, dword [esp + 0x2c]
mov ebx, dword [esp + 0x1c]
mov dword [eax], ebx
mov dword [eax + 4], ebx
cmp esi, ebp
jne 0x10029600
mov eax, dword [esp + 0x20]
mov dword [eax], esi
mov dword [esi + 4], eax
mov eax, ebp
pop esi
pop edi
pop ebp
pop ebx
add esp, 0x18
ret 8
mov eax, dword [esp + 0x2c]
mov dword [eax], esi
mov eax, dword [esp + 0x20]
mov dword [eax], esi
mov dword [esi + 4], eax
pop esi
pop edi
mov eax, ebp
pop ebp
pop ebx
add esp, 0x18
ret 8
Function at 0x100511b0
Capabilities:
Encode data using xor

Disassembly:
push ecx
imul eax, edx, 0xcc
push ebx
push esi
mov ebx, dword [eax + ecx + 4]
lea esi, [eax + ecx]
test ebx, ebx
je 0x10051229
push ebp
mov ebp, dword [eax + ecx + 0xc8]
mov edx, ebp
mov ecx, dword [esi + 8]
call fcn.1002e7c0
lea ecx, [esi + 0xc]
mov dword [ecx], eax
add eax, 0x20
and eax, 0xffffffc0
mov dword [esp + 0xc], ecx
mov dword [esi + 0x10], eax
add esi, 0x14
sub ebx, 1
je 0x10051228
push edi
mov ecx, dword [esi]
mov edx, ebp
call fcn.1002e7c0
mov edi, eax
lea esi, [esi + 0xc]
mov eax, dword [esp + 0x10]
mov ecx, dword [eax]
mov eax, edi
sub eax, ecx
cdq
xor eax, edx
sub eax, edx
cmp eax, 0x80
cmovl edi, ecx
mov dword [esi - 8], edi
lea eax, [edi + 0x20]
and eax, 0xffffffc0
mov dword [esi - 4], eax
sub ebx, 1
jne 0x100511f1
pop edi
pop ebp
pop esi
pop ebx
pop ecx
ret
Function at 0x10053860
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ecx
push ebx
push ebp
push esi
mov esi, ecx
mov ebp, edx
xor ecx, ecx
mov dword [esp + 0xc], ebp
xor ebx, ebx
push edi
mov eax, dword [esi + 0x1c]
sub eax, 0x20
mov dword [esi + 0x54], 0
mov dword [esi + 0x20], eax
mov eax, dword [esi + 0x24]
mov dword [esi + 0x50], eax
mov word [esi + 0x4e], 0
mov dword [esi + 0x2c], 0
mov dword [eax + 8], eax
xor eax, eax
mov word [esi + 0x4c], ax
cmp cx, word [esi + 0x78]
jge 0x10053973
xor edx, edx
nop dword [eax]
mov eax, dword [esi + 0x84]
mov ecx, esi
mov dword [esi + 0x5c], 0
mov dword [esi + 0x58], 0
push ebp
movzx eax, word [eax + ebx*2]
push eax
call fcn.100534c0
test al, al
jne 0x10053a05
mov eax, dword [esi + 0x84]
mov edx, dword [esi + 4]
mov ecx, dword [esi + 0x40]
movzx ebp, word [eax + ebx*2]
lea eax, [edx - 1]
test ecx, eax
jne 0x10053912
cmp ecx, dword [esi + 0x44]
jl 0x10053912
cmp ecx, dword [esi + 0x48]
jg 0x10053912
mov edi, dword [esi + 0x58]
test edi, edi
je 0x10053912
mov eax, dword [esi + 0x50]
mov al, byte [eax + 0xc]
xor al, byte [edi + 0xc]
test al, 8
jne 0x10053912
add dword [esi + 0x24], 0xfffffffc
mov edi, dword [esi + 0x50]
mov eax, dword [esi + 0x24]
cmp eax, dword [edi + 8]
je 0x1005392e
test byte [edi + 0xc], 8
je 0x1005392e
neg edx
and edx, ecx
sub ecx, edx
cmp ecx, dword [esi + 8]
jmp 0x1005393c
lea eax, [edx - 1]
neg edx
add eax, ecx
and eax, edx
sub eax, ecx
cmp eax, dword [esi + 8]
setge dl
mov ecx, esi
call fcn.100529e0
test al, al
jne 0x10053a05
mov eax, dword [esi + 0x58]
test eax, eax
je 0x10053958
mov dword [edi + 0x1c], eax
lea eax, [ebp + 1]
inc ebx
mov ebp, dword [esp + 0x10]
movzx edx, ax
movsx eax, word [esi + 0x78]
cmp ebx, eax
jl 0x100538b0
movzx eax, word [esi + 0x4c]
mov ecx, dword [esi + 0x54]
movzx ebp, ax
cmp ax, 1
jbe 0x10053a0d
test ecx, ecx
je 0x10053a0d
nop dword [eax + eax]
mov ebx, dword [ecx + 0x10]
lea edx, [ecx + 4]
mov dword [esp + 0x10], edx
cmp bp, 1
jbe 0x100539a8
mov eax, dword [ecx + 8]
lea eax, [eax + ebx*4]
jmp 0x100539aa
xor eax, eax
mov dword [edx], eax
test byte [ecx + 0xc], 8
mov edi, dword [ecx + 0x14]
mov edx, edi
je 0x100539bc
dec edi
add edi, ebx
jmp 0x100539cc
sub edx, ebx
lea eax, [ebx*4 - 4]
inc edx
add dword [ecx + 8], eax
mov dword [ecx + 0x14], edx
mov ecx, esi
call fcn.10052a70
test al, al
jne 0x10053a05
lea edx, [edi + 1]
mov ecx, esi
call fcn.10052a70
test al, al
jne 0x10053a05
mov ecx, dword [esp + 0x10]
add ebp, 0xffff
mov ecx, dword [ecx]
test bp, bp
jne 0x10053990
mov eax, dword [esi + 0x24]
cmp eax, dword [esi + 0x20]
pop edi
pop esi
pop ebp
setae al
pop ebx
pop ecx
ret
pop edi
pop esi
pop ebp
mov al, 1
pop ebx
pop ecx
ret
mov eax, dword [esi + 0x24]
cmp eax, dword [esi + 0x20]
pop edi
mov dword [esi + 0x54], 0
setae al
pop esi
pop ebp
pop ebx
pop ecx
ret
Function at 0x100620f0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x18
push ebx
push ebp
push esi
push edi
mov edi, ecx
mov dword [esp + 0x20], edi
mov ebx, dword [edi + 0xc]
mov ecx, dword [edi + 0x44]
mov edx, dword [edi + 0x48]
mov dword [esp + 0x10], ebx
movsx ebp, word [ebx + 0x3a]
mov eax, dword [ebx + 0x3c]
mov dword [eax + ebp*8], ecx
mov dword [eax + ebp*8 + 4], edx
mov eax, dword [ebx + 0x3c]
mov ecx, dword [edi + 0x4c]
mov edx, dword [edi + 0x50]
mov dword [eax + ebp*8 + 8], ecx
mov dword [eax + ebp*8 + 0xc], edx
mov eax, dword [ebx + 0x3c]
mov ecx, dword [edi + 0xb4]
mov edx, dword [edi + 0xb8]
mov dword [eax + ebp*8 + 0x10], ecx
mov dword [eax + ebp*8 + 0x14], edx
mov eax, dword [ebx + 0x3c]
mov edx, dword [edi + 0xc0]
mov ecx, dword [edi + 0xbc]
mov dword [eax + ebp*8 + 0x18], ecx
mov dword [eax + ebp*8 + 0x1c], edx
mov eax, dword [ebx + 0x40]
mov byte [eax + ebp], 0
mov eax, dword [ebx + 0x40]
mov byte [eax + ebp + 1], 0
mov eax, dword [ebx + 0x40]
mov byte [eax + ebp + 2], 0
mov eax, dword [ebx + 0x40]
mov byte [eax + ebp + 3], 0
add ebp, 4
mov edx, dword [edi + 0x10]
mov dword [esp + 0x24], ebp
test dl, 2
jne 0x100621e6
movzx esi, word [ebx + 0x3a]
mov word [edi + 0x80], si
mov ax, word [ebx + 0x38]
mov word [edi + 0x82], ax
mov eax, dword [ebx + 0x4c]
mov dword [edi + 0x84], eax
mov edx, dword [ebx + 0x3c]
mov dword [edi + 0x88], edx
mov ecx, dword [ebx + 0x50]
mov dword [edi + 0x8c], ecx
mov eax, dword [ebx + 0x40]
mov dword [edi + 0x90], eax
mov eax, dword [ebx + 0x44]
mov dword [edi + 0x94], eax
xor eax, eax
mov word [edi + 0x98], ax
lea eax, [esi*8 + 0x20]
push eax
push edx
push ecx
call fcn.1011d990
mov edx, dword [edi + 0x10]
add esp, 0xc
mov esi, dword [ebx + 0x3c]
lea ecx, [esi + ebp*8]
test dl, 1
jne 0x10062242
mov eax, dword [edi + 4]
mov eax, dword [eax + 0x2c]
mov ebx, dword [eax + 4]
mov eax, dword [eax + 8]
mov dword [esp + 0x18], ebx
mov ebx, dword [esp + 0x10]
cmp esi, ecx
jae 0x10062242
mov ebx, dword [esp + 0x18]
mov ebp, ecx
mov edi, eax
mov ecx, dword [esi]
mov edx, ebx
call fcn.1002e7c0
mov ecx, dword [esi + 4]
mov edx, edi
mov dword [esi], eax
call fcn.1002e7c0
mov dword [esi + 4], eax
add esi, 8
cmp esi, ebp
jb 0x10062211
mov ebx, dword [esp + 0x10]
mov edi, dword [esp + 0x20]
mov ebp, dword [esp + 0x24]
mov esi, dword [ebx + 0x3c]
mov edx, dword [edi + 0x10]
mov eax, dword [esi + ebp*8 - 0x20]
mov ecx, dword [esi + ebp*8 - 0x1c]
mov dword [edi + 0x44], eax
mov dword [edi + 0x48], ecx
mov eax, dword [ebx + 0x3c]
mov ecx, dword [eax + ebp*8 - 0x18]
mov eax, dword [eax + ebp*8 - 0x14]
mov dword [edi + 0x4c], ecx
mov dword [edi + 0x50], eax
mov eax, dword [ebx + 0x3c]
mov ecx, dword [eax + ebp*8 - 0x10]
mov eax, dword [eax + ebp*8 - 0xc]
mov dword [edi + 0xb4], ecx
mov dword [edi + 0xb8], eax
mov eax, dword [ebx + 0x3c]
mov ecx, dword [eax + ebp*8 - 8]
mov eax, dword [eax + ebp*8 - 4]
mov dword [edi + 0xbc], ecx
mov dword [edi + 0xc0], eax
test dl, 2
jne 0x100622ac
add word [edi + 0x80], 4
mov ecx, edi
pop edi
pop esi
pop ebp
xor dl, dl
pop ebx
add esp, 0x18
jmp fcn.10061d70
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x18
ret