joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100d2fe0
Capabilities:
Encrypt data using des

Disassembly:
sub esp, 0xf4
xor ecx, ecx
push ebx
push ebp
push esi
mov esi, dword [esp + 0x104]
push edi
xor eax, eax
mov al, byte [ecx + 0x10166164]
mov edx, eax
and eax, 7
sar edx, 3
mov bl, byte [eax*2 + 0x101660f4]
mov dl, byte [edx + esi]
test bl, dl
setne al
mov byte [esp + ecx + 0x4c], al
inc ecx
cmp ecx, 0x38
jl 0x100d2ff3
mov eax, 0x1e
xor edx, edx
mov dword [esp + 0x10], eax
cmp dword [esp + 0x10c], 1
je 0x100d3034
lea eax, [edx + edx]
lea edi, [esp + eax*4 + 0x88]
lea ebp, [esp + eax*4 + 0x84]
xor eax, eax
xor ecx, ecx
mov cl, byte [edx + 0x1016619c]
mov dword [edi], 0
mov dword [ebp], 0
mov esi, ecx
cmp ecx, 0x1c
jge 0x100d3066
mov bl, byte [esp + ecx + 0x4c]
jmp 0x100d306a
mov bl, byte [esp + ecx + 0x30]
mov byte [esp + eax + 0x14], bl
inc eax
inc ecx
cmp eax, 0x1c
jl 0x100d305b
mov eax, 0x1c
lea ecx, [esi + 0x1c]
cmp ecx, 0x38
jge 0x100d3088
mov bl, byte [esp + ecx + 0x4c]
jmp 0x100d308c
mov bl, byte [esp + ecx + 0x30]
mov byte [esp + eax + 0x14], bl
inc eax
inc ecx
cmp eax, 0x38
jl 0x100d307d
xor ecx, ecx
mov eax, 0x10166104
xor ebx, ebx
mov bl, byte [ecx + 0x101661ac]
cmp byte [esp + ebx + 0x14], 0
je 0x100d30b7
mov esi, dword [eax]
mov ebx, dword [ebp]
or ebx, esi
mov dword [ebp], ebx
xor ebx, ebx
mov bl, byte [ecx + 0x101661c4]
cmp byte [esp + ebx + 0x14], 0
je 0x100d30ce
mov esi, dword [eax]
mov ebx, dword [edi]
or ebx, esi
mov dword [edi], ebx
add eax, 4
inc ecx
cmp eax, 0x10166164
jl 0x100d309e
mov eax, dword [esp + 0x10]
inc edx
sub eax, 2
cmp eax, 0xfffffffe
mov dword [esp + 0x10], eax
jg 0x100d3027
lea edx, [esp + 0x84]
push edx
call fcn.100d3110
add esp, 4
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xf4
ret
Function at 0x100e84dd
Capabilities:
Get graphical window text

Disassembly:
push esi
mov esi, ecx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x100e8515
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
lea ecx, [eax + 1]
push ecx
mov ecx, dword [esp + 0xc]
push eax
call fcn.100e6594
push eax
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov ecx, dword [esp + 8]
push 0xffffffffffffffff
call fcn.100e656c
jmp 0x100e8521
mov eax, dword [ecx]
push dword [esp + 8]
call dword [eax + 0x88]
pop esi
ret 4

Function at 0x100e9bd2
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
push edi
xor edi, edi
cmp dword [esp + 0x10], edi
mov ebx, ecx
je 0x100e9c14
call fcn.100ef7e4
mov esi, dword [eax + 0xc]
push 0xf0
push dword [esp + 0x14]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
cmp eax, edi
je 0x100e9c14
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp eax, edi
jne 0x100e9c0b
xor eax, eax
jmp 0x100e9c1c
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
push edi
mov ecx, ebx
call fcn.100e9c22
pop edi
pop esi
pop ebx
ret 4

Function at 0x101c1091
Capabilities:
Packed with generic packer

Disassembly:
push bx
lea esp, [esp + 2]
jmp fcn.101c114b

Function at 0x101c1f18
Capabilities:
Packed with generic packer

Disassembly:
push edx
mov dword [esp + 4], eax
setnp al
push cx
mov ax, dx
jmp 0x101c1f39
xchg word [esp], ax
bswap eax
lea esp, [esp + 2]
mov dword [esp], ebx
call 0x101c1f4c
popal
pop bx
mov ebx, esp
jmp 0x101c1f80
mov ebx, 0xec44828d
lea eax, [edi*4]
mov dx, word [esp]
jmp 0x101c1fc3
mov word [esp], cx
mov bh, ah
push word [esp]
push word [esp + 2]
lea esp, [esp + 2]
mov dword [esp], edx
jmp 0x101c1f6a
not bh
mov bl, byte [esp]
xchg ebx, eax
push si
lea esp, [esp + 2]
pop ebx
jmp 0x101c203f
lea edx, [esi + 0x16]
mov bh, 0x44
not bh
lea eax, [ebx*4]
pop edx
mov ah, bh
jmp 0x101c1fad
lea esp, [esp + 0xc]
call fcn.101c1fea
mov ah, dl
setne ah
mov ax, word [esp]
push esi
setnp ah
mov eax, dword [esp + 4]
jmp 0x101c2009

Function at 0x101e0a3c
Capabilities:
Resolve function by parsing pe exports

Disassembly:
lea esp, [esp + 4]
mov ebx, dword [ebp + 8]
jmp 0x101e0a68
cmp ebx, 0
je 0x101e09a7
mov ax, cx
jmp 0x101e0cc7
mov di, 0xed4b
jmp 0x101e0ae2
setge al
inc di
bswap edi
mov eax, dword [edx + 0x20]
pushal
jmp 0x101e0a84
mov al, 0x93
shr si, cl
jmp 0x101e0aee
mov si, 0x4144
sub esp, 1
mov byte [esp], dh
lea esp, [esp + 1]
push eax
jmp 0x101e0aa7
lea esp, [esp + 0x20]
push ecx
push ecx
btc di, sp
jmp 0x101e0abd
xor eax, eax
mov edi, dword [esp]
or ecx, 0xffffffff
jmp 0x101e0bb7
add edx, ebx
mov cl, byte [esp]
mov ah, al
mov cx, 0xc960
mov ecx, dword [edx + 0x18]
jmp 0x101e0a9a
mov edi, ecx
lea edi, [edx*4]
not ecx
pop eax
jmp 0x101e0a52
sub esp, 5
dec esi
pop word [esp]
lea esp, [esp + 3]
repne scasb al, byte es:[edi]
jmp 0x101e0b37
mov edi, dword [ebp + 0xc]
mov si, 0x72f6
lea esi, [edi*4]
mov edi, dword [edi]
jmp 0x101e0b5d
mov dl, byte [esp]
mov si, word [esp]
mov edx, dword [eax + 0x78]
neg al
jmp 0x101e0b0e
mov eax, dword [ebx + 0x3c]
mov ecx, dword [esp]
add eax, ebx
lea edx, [edi*4]
jmp 0x101e0c1e
Function at 0x1028ec5a
Capabilities:
Encode data using xor

Disassembly:
leave
ret 4
lea esp, [esp + 4]
je 0x10045066
jne 0x1028ec98
imul ebp, edi, 0x7f
sbb ch, cl
and eax, dword [edx - 0x1460f3c3]
call 0xbec91c7d
mov al, byte [0xb2b27f19]
lahf
std
lahf
mov dh, 0x7a
in al, dx
sub byte [eax], dl
jne 0x1028ec55
jmp 0x1028ec44
adc dword [eax + 0x18428b13], edx
jmp 0x10045066
arpl bx, bx
call [0xb68ed1b]
adc byte [ebx], 0x38
xchg esp, eax
lahf
xchg ebp, eax
and byte [eax - 0x4de293fc], 0x58
xchg ebx, eax
xchg esp, eax
mov dh, 0xba
in al, dx
sub byte [eax], dl
jne 0x1028ec1f
and eax, 0x850fc754
adc ah, byte [ebx + ebx*8 - 1]
jne loc.100450b0
je 0x10045041
xchg ebp, eax
in eax, dx
scasb al, byte es:[edi]
cmpsd dword [esi], dword es:[edi]
je 0x1028ec77
invalid

Function at 0x102ac3dc
Capabilities:
Packed with generic packer

Disassembly:
pushal
call fcn.102ac43f
pop eax
mov dh, 1
add byte [eax], al
add byte [ebx], bl
mov dh, 0x9e
adc ch, byte [ebx]
adc byte [ebp + 0x20], dh
arpl word [edx + 0x262078e9], bx
add byte [eax - 0x4a], bl
add byte [eax], al
add byte [eax], al
sbb esi, dword [esi + 0x102b1910]
jne 0x1004bc39
xchg esi, eax
add eax, eax
jmp 0x102ac417
call fcn.101c106c
seto al
mov al, byte [esp]
pushal
jmp 0x102ac455
lea esp, [esp + 4]
je 0x1004bc01
jne 0x102ac401
popal
in eax, 0x75
sbb al, 0xef
add al, 0x91
push ss
test bl, ah
push ds
inc byte [edi]
scasb al, byte es:[edi]
mov ecx, 0x648dfb98
and al, 4
xor edx, edx
jmp loc.1004b9be
lea esp, [esp + 0x20]
mov eax, dword [ebp + ecx*4 - 0x50]
jmp loc.1004b9be

Function at 0x102b70f1
Capabilities:
Encode data using xor

Disassembly:
push 0x101c5f40
call fcn.101bf395
mov dword [edi - 0x29], 0x7aa641b2
push ebp
les esi, [edi + 0x5e]
test eax, 0x1b82f66c
std
push 0x24048978
mov dword [esp], eax
lea esp, [esp + 4]
jmp 0x102b7a9a
push 0x101c5f29
call fcn.101bf395
insb byte es:[edi], dx
pminsw mm6, mm7
invalid

Function at 0x102bb086
Capabilities:
Encode data using xor

Disassembly:
push dword [0x1016c31c]
jmp 0x102bb057
add esp, 1
add esp, 0
call fcn.102bb009
call fcn.100500aa
jmp 0x102bb06d
push dword [ebp - 4]
jmp 0x102bb077
call fcn.100500f5
jmp 0x102bab30
call fcn.101c29ee
mov dword [ebp - 0x10], eax
clc
call 0x102bb086
mov esp, 0xbb4e9
add byte [ebp + edx*4 - 0x4a], ch
push edi
inc dword [eax + edx]
in eax, dx
scasb al, byte es:[edi]
in eax, dx
mov dh, 0xb3
mov al, 0x2b
adc byte [ebp - 0x71], dh
push ss
add dword [eax - 0x73], 0xe8042464
mov esp, 0xe9ffd94e
insd dword es:[edi], dx
cli
invalid
Function at 0x40a018
Capabilities:
Allocate or change rwx memory
Get system information on windows

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xffffffbc
mov edi, eax
lea esi, [esp + 0x28]
lea eax, [esp + 4]
push eax
call sub.kernel32.dll_GetSystemInfo
mov ebx, edi
push 0x1c
push esi
push ebx
call sub.kernel32.dll_VirtualQuery
test eax, eax
je 0x40a0cc
jmp 0x40a0c1
cmp dword [esi + 0x10], 0x1000
jne 0x40a0ad
test byte [esi + 0x15], 1
jne 0x40a0ad
xor ebx, ebx
mov eax, dword [esi + 0x14]
cmp eax, 1
je 0x40a06c
cmp eax, 2
je 0x40a06c
cmp eax, 0x10
je 0x40a06c
cmp eax, 0x20
jne 0x40a081
push esp
push 0x40
mov eax, dword [esi + 0xc]
push eax
mov eax, dword [esi]
push eax
call sub.kernel32.dll_VirtualProtect
test eax, eax
je 0x40a081
mov bl, 1
xor ebp, ebp
jmp 0x40a092
mov eax, dword [esi]
add eax, ebp
call fcn.0040a010
add ebp, dword [esp + 8]
cmp ebp, dword [esi + 0xc]
jb 0x40a085
test bl, bl
je 0x40a0ad
push esp
mov eax, dword [esp + 4]
push eax
mov eax, dword [esi + 0xc]
push eax
mov eax, dword [esi]
push eax
call sub.kernel32.dll_VirtualProtect
mov eax, dword [esi]
add eax, dword [esi + 0xc]
mov ebx, eax
push 0x1c
push esi
push ebx
call sub.kernel32.dll_VirtualQuery
test eax, eax
je 0x40a0cc
mov eax, dword [esi + 4]
cmp eax, edi
je 0x40a044
add esp, 0x44
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x431000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
mov ebx, 0x40915c
nop
mov ecx, 0x4998402a
nop
nop
nop
nop
nop
test eax, eax
je 0x43104e
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
jne 0x431024
nop
nop
nop
nop
mov eax, section..data
mov ebx, 0x42f3f8
nop
mov ecx, 0x7506766c
nop
nop
test eax, eax
nop
nop
nop
je 0x431084
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
add eax, 4
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
jne 0x43106c
nop
nop
popal
nop
nop
nop
nop
nop
jmp 0x401219

Function at 0x432004
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
mov eax, section..text
mov ebx, 0x40c7d0
nop
nop
mov ecx, 0x61fa4127
nop
nop
nop
nop
test eax, eax
nop
nop
nop
je 0x43204e
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
inc eax
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
jne 0x432024
nop
nop
nop
mov eax, section..tls
nop
mov ebx, 0x42f314
nop
nop
mov ecx, 0x4e1b194e
nop
test eax, eax
nop
nop
nop
nop
nop
nop
je 0x432084
nop
nop
nop
nop
nop
xor dword [eax], ecx
add eax, 4
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
jne 0x43206c
nop
nop
nop
nop
nop
nop
popal
nop
nop
jmp 0x431219
Function at 0x1000d750
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
mov edx, dword [esp + 4]
mov eax, 1
mov dword [0x10759a44], 0xffffffff
mov dword [0x107586c4], edx
nop dword [eax]
mov ecx, edx
shr ecx, 0x1e
xor ecx, edx
imul edx, ecx, 0x6c078965
add edx, eax
mov dword [eax*4 + 0x107586c4], edx
inc eax
cmp eax, 0x270
jb 0x1000d770
mov dword [0x107586c0], 0x270
mov eax, 0x107586c0
ret 4
Function at 0x1000ff90
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov eax, dword [esp + 4]
sub esp, 0x1c
push ebx
push ebp
mov ebp, dword [esp + 0x2c]
mov ebx, ecx
cmp eax, ebp
jne 0x1000ffad
mov eax, ebp
pop ebp
pop ebx
add esp, 0x1c
ret 8
cmp dword [eax + 0x1c], 0xf
lea edx, [eax + 8]
mov ecx, dword [ebx + 4]
mov dword [esp + 0x14], ecx
mov ecx, dword [ebx + 0xc]
push esi
mov dword [esp + 0x14], ecx
mov esi, eax
mov ecx, dword [eax + 4]
mov eax, dword [edx + 0x10]
mov dword [esp + 0x1c], ecx
jbe 0x1000ffd3
mov edx, dword [edx]
xor ecx, ecx
push edi
mov edi, 0x811c9dc5
test eax, eax
je 0x1000fff6
mov ebp, eax
movzx eax, byte [edx + ecx]
inc ecx
xor eax, edi
imul edi, eax, 0x1000193
cmp ecx, ebp
jb 0x1000ffe1
mov ebp, dword [esp + 0x34]
mov eax, dword [ebx + 0x18]
mov ecx, dword [esp + 0x18]
and eax, edi
lea eax, [ecx + eax*8]
mov ecx, dword [eax]
mov dword [esp + 0x10], eax
mov eax, dword [eax + 4]
mov dword [esp + 0x14], ecx
mov dword [esp + 0x24], eax
mov edi, esi
mov dword [esp + 0x28], esi
mov esi, dword [esi]
lea ecx, [edi + 8]
call fcn.1001dae0
mov ecx, dword [edi - 4]
sub edi, ecx
lea eax, [edi - 4]
cmp eax, 0x1f
ja 0x10010165
push 0x3d43
push ecx
call fcn.1017d3f8
dec dword [ebx + 8]
add esp, 8
mov eax, dword [esp + 0x24]
cmp dword [esp + 0x28], eax
je 0x1001007c
cmp esi, ebp
jne 0x10010013
mov eax, dword [esp + 0x14]
cmp eax, dword [esp + 0x30]
jne 0x10010126
mov eax, dword [esp + 0x20]
mov ecx, dword [esp + 0x10]
pop edi
mov dword [ecx], esi
mov dword [eax], esi
mov dword [esi + 4], eax
mov eax, ebp
pop esi
pop ebp
pop ebx
add esp, 0x1c
ret 8
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x10]
cmp eax, dword [esp + 0x30]
jne 0x10010092
mov eax, dword [esp + 0x1c]
mov dword [ecx], eax
jmp 0x10010096
mov eax, dword [esp + 0x20]
mov dword [ecx + 4], eax
cmp esi, ebp
je 0x10010126
cmp dword [esi + 0x1c], 0xf
lea edi, [esi + 8]
mov ebp, dword [edi + 0x10]
jbe 0x100100af
mov edi, dword [edi]
xor ecx, ecx
mov edx, 0x811c9dc5
test ebp, ebp
je 0x100100d1
nop word [eax + eax]
movzx eax, byte [ecx + edi]
inc ecx
xor eax, edx
imul edx, eax, 0x1000193
cmp ecx, ebp
jb 0x100100c0
and edx, dword [ebx + 0x18]
mov eax, dword [esp + 0x18]
lea eax, [eax + edx*8]
mov dword [esp + 0x30], eax
mov eax, dword [eax + 4]
mov dword [esp + 0x28], eax
mov edi, esi
mov ebp, esi
mov esi, dword [esi]
lea ecx, [edi + 8]
call fcn.1001dae0
mov ecx, dword [edi - 4]
sub edi, ecx
lea eax, [edi - 4]
cmp eax, 0x1f
ja 0x10010165
push 0x3d43
push ecx
call fcn.1017d3f8
dec dword [ebx + 8]
add esp, 8
cmp ebp, dword [esp + 0x28]
mov ebp, dword [esp + 0x34]
je 0x1001013b
cmp esi, ebp
jne 0x100100e6
mov eax, dword [esp + 0x30]
mov dword [eax], esi
mov eax, dword [esp + 0x20]
pop edi
mov dword [eax], esi
mov dword [esi + 4], eax
mov eax, ebp
pop esi
pop ebp
pop ebx
add esp, 0x1c
ret 8
mov eax, dword [esp + 0x30]
mov edx, dword [esp + 0x1c]
mov dword [eax], edx
mov dword [eax + 4], edx
cmp esi, ebp
jne 0x100100a1
mov eax, dword [esp + 0x20]
pop edi
mov dword [eax], esi
mov dword [esi + 4], eax
mov eax, ebp
pop esi
pop ebp
pop ebx
add esp, 0x1c
ret 8
call fcn.101829ea
int3
Function at 0x100103c0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov eax, dword [esp + 8]
sub esp, 0x18
push ebp
mov ebp, ecx
mov ecx, dword [esp + 0x20]
cmp ecx, eax
je 0x10010537
cmp dword [ecx + 0x1c], 0xf
lea edx, [ecx + 8]
mov eax, dword [ebp + 4]
push ebx
mov ebx, dword [edx + 0x10]
mov dword [esp + 0x14], eax
mov eax, dword [ebp + 0xc]
push esi
mov dword [esp + 0x14], eax
mov esi, ecx
mov eax, dword [ecx + 4]
push edi
mov dword [esp + 0x20], eax
jbe 0x100103fe
mov edx, dword [edx]
xor ecx, ecx
mov edi, 0x811c9dc5
test ebx, ebx
je 0x10010421
nop dword [eax]
movzx eax, byte [edx + ecx]
inc ecx
xor eax, edi
imul edi, eax, 0x1000193
cmp ecx, ebx
jb 0x10010410
mov eax, dword [ebp + 0x18]
mov ecx, dword [esp + 0x18]
and eax, edi
lea eax, [ecx + eax*8]
mov ecx, dword [eax]
mov dword [esp + 0x10], eax
mov eax, dword [eax + 4]
mov dword [esp + 0x14], ecx
mov dword [esp + 0x24], eax
nop
mov edi, esi
mov ebx, esi
mov esi, dword [esi]
lea ecx, [edi + 8]
call fcn.1001dcc0
push 0xc0
push edi
call fcn.1017d3f8
dec dword [ebp + 8]
add esp, 8
cmp ebx, dword [esp + 0x24]
je 0x10010484
cmp esi, dword [esp + 0x30]
jne 0x10010440
mov eax, dword [esp + 0x14]
cmp eax, dword [esp + 0x2c]
jne 0x10010527
mov ecx, dword [esp + 0x10]
mov dword [ecx], esi
jmp 0x10010527
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x10]
cmp eax, dword [esp + 0x2c]
jne 0x1001049a
mov eax, dword [esp + 0x1c]
mov dword [ecx], eax
jmp 0x1001049e
mov eax, dword [esp + 0x20]
mov dword [ecx + 4], eax
cmp esi, dword [esp + 0x30]
je 0x10010527
nop dword [eax + eax]
cmp dword [esi + 0x1c], 0xf
lea edi, [esi + 8]
mov ebx, dword [edi + 0x10]
jbe 0x100104be
mov edi, dword [edi]
xor ecx, ecx
mov edx, 0x811c9dc5
test ebx, ebx
je 0x100104e1
nop dword [eax]
movzx eax, byte [edi + ecx]
inc ecx
xor eax, edx
imul edx, eax, 0x1000193
cmp ecx, ebx
jb 0x100104d0
and edx, dword [ebp + 0x18]
mov eax, dword [esp + 0x18]
lea eax, [eax + edx*8]
mov dword [esp + 0x2c], eax
mov eax, dword [eax + 4]
mov dword [esp + 0x24], eax
mov edi, esi
mov ebx, esi
mov esi, dword [esi]
lea ecx, [edi + 8]
call fcn.1001dcc0
push 0xc0
push edi
call fcn.1017d3f8
dec dword [ebp + 8]
add esp, 8
cmp ebx, dword [esp + 0x24]
je 0x1001053e
cmp esi, dword [esp + 0x30]
jne 0x100104f6
mov eax, dword [esp + 0x2c]
mov dword [eax], esi
mov eax, dword [esp + 0x20]
pop edi
mov dword [eax], esi
mov dword [esi + 4], eax
mov eax, dword [esp + 0x2c]
pop esi
pop ebx
pop ebp
add esp, 0x18
ret 8
mov eax, dword [esp + 0x2c]
mov edx, dword [esp + 0x1c]
mov dword [eax], edx
mov dword [eax + 4], edx
cmp esi, dword [esp + 0x30]
jne 0x100104b0
jmp 0x10010527
Function at 0x10010700
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov eax, dword [esp + 8]
sub esp, 0x18
push ebp
mov ebp, ecx
mov ecx, dword [esp + 0x20]
cmp ecx, eax
je 0x10010877
cmp dword [ecx + 0x1c], 0xf
lea edx, [ecx + 8]
mov eax, dword [ebp + 4]
push ebx
mov ebx, dword [edx + 0x10]
mov dword [esp + 0x14], eax
mov eax, dword [ebp + 0xc]
push esi
mov dword [esp + 0x14], eax
mov esi, ecx
mov eax, dword [ecx + 4]
push edi
mov dword [esp + 0x20], eax
jbe 0x1001073e
mov edx, dword [edx]
xor ecx, ecx
mov edi, 0x811c9dc5
test ebx, ebx
je 0x10010761
nop dword [eax]
movzx eax, byte [edx + ecx]
inc ecx
xor eax, edi
imul edi, eax, 0x1000193
cmp ecx, ebx
jb 0x10010750
mov eax, dword [ebp + 0x18]
mov ecx, dword [esp + 0x18]
and eax, edi
lea eax, [ecx + eax*8]
mov ecx, dword [eax]
mov dword [esp + 0x10], eax
mov eax, dword [eax + 4]
mov dword [esp + 0x14], ecx
mov dword [esp + 0x24], eax
nop
mov edi, esi
mov ebx, esi
mov esi, dword [esi]
lea ecx, [edi + 8]
call fcn.1001dcc0
push 0xd8
push edi
call fcn.1017d3f8
dec dword [ebp + 8]
add esp, 8
cmp ebx, dword [esp + 0x24]
je 0x100107c4
cmp esi, dword [esp + 0x30]
jne 0x10010780
mov eax, dword [esp + 0x14]
cmp eax, dword [esp + 0x2c]
jne 0x10010867
mov ecx, dword [esp + 0x10]
mov dword [ecx], esi
jmp 0x10010867
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x10]
cmp eax, dword [esp + 0x2c]
jne 0x100107da
mov eax, dword [esp + 0x1c]
mov dword [ecx], eax
jmp 0x100107de
mov eax, dword [esp + 0x20]
mov dword [ecx + 4], eax
cmp esi, dword [esp + 0x30]
je 0x10010867
nop dword [eax + eax]
cmp dword [esi + 0x1c], 0xf
lea edi, [esi + 8]
mov ebx, dword [edi + 0x10]
jbe 0x100107fe
mov edi, dword [edi]
xor ecx, ecx
mov edx, 0x811c9dc5
test ebx, ebx
je 0x10010821
nop dword [eax]
movzx eax, byte [edi + ecx]
inc ecx
xor eax, edx
imul edx, eax, 0x1000193
cmp ecx, ebx
jb 0x10010810
and edx, dword [ebp + 0x18]
mov eax, dword [esp + 0x18]
lea eax, [eax + edx*8]
mov dword [esp + 0x2c], eax
mov eax, dword [eax + 4]
mov dword [esp + 0x24], eax
mov edi, esi
mov ebx, esi
mov esi, dword [esi]
lea ecx, [edi + 8]
call fcn.1001dcc0
push 0xd8
push edi
call fcn.1017d3f8
dec dword [ebp + 8]
add esp, 8
cmp ebx, dword [esp + 0x24]
je 0x1001087e
cmp esi, dword [esp + 0x30]
jne 0x10010836
mov eax, dword [esp + 0x2c]
mov dword [eax], esi
mov eax, dword [esp + 0x20]
pop edi
mov dword [eax], esi
mov dword [esi + 4], eax
mov eax, dword [esp + 0x2c]
pop esi
pop ebx
pop ebp
add esp, 0x18
ret 8
mov eax, dword [esp + 0x2c]
mov edx, dword [esp + 0x1c]
mov dword [eax], edx
mov dword [eax + 4], edx
cmp esi, dword [esp + 0x30]
jne 0x100107f0
jmp 0x10010867
Function at 0x100108a0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov eax, dword [esp + 8]
sub esp, 0x18
push ebp
mov ebp, ecx
mov ecx, dword [esp + 0x20]
cmp ecx, eax
je 0x10010a17
cmp dword [ecx + 0x1c], 0xf
lea edx, [ecx + 8]
mov eax, dword [ebp + 4]
push ebx
mov ebx, dword [edx + 0x10]
mov dword [esp + 0x14], eax
mov eax, dword [ebp + 0xc]
push esi
mov dword [esp + 0x14], eax
mov esi, ecx
mov eax, dword [ecx + 4]
push edi
mov dword [esp + 0x20], eax
jbe 0x100108de
mov edx, dword [edx]
xor ecx, ecx
mov edi, 0x811c9dc5
test ebx, ebx
je 0x10010901
nop dword [eax]
movzx eax, byte [edx + ecx]
inc ecx
xor eax, edi
imul edi, eax, 0x1000193
cmp ecx, ebx
jb 0x100108f0
mov eax, dword [ebp + 0x18]
mov ecx, dword [esp + 0x18]
and eax, edi
lea eax, [ecx + eax*8]
mov ecx, dword [eax]
mov dword [esp + 0x10], eax
mov eax, dword [eax + 4]
mov dword [esp + 0x14], ecx
mov dword [esp + 0x24], eax
nop
mov edi, esi
mov ebx, esi
mov esi, dword [esi]
lea ecx, [edi + 8]
call fcn.1001dcc0
push 0x1a8
push edi
call fcn.1017d3f8
dec dword [ebp + 8]
add esp, 8
cmp ebx, dword [esp + 0x24]
je 0x10010964
cmp esi, dword [esp + 0x30]
jne 0x10010920
mov eax, dword [esp + 0x14]
cmp eax, dword [esp + 0x2c]
jne 0x10010a07
mov ecx, dword [esp + 0x10]
mov dword [ecx], esi
jmp 0x10010a07
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x10]
cmp eax, dword [esp + 0x2c]
jne 0x1001097a
mov eax, dword [esp + 0x1c]
mov dword [ecx], eax
jmp 0x1001097e
mov eax, dword [esp + 0x20]
mov dword [ecx + 4], eax
cmp esi, dword [esp + 0x30]
je 0x10010a07
nop dword [eax + eax]
cmp dword [esi + 0x1c], 0xf
lea edi, [esi + 8]
mov ebx, dword [edi + 0x10]
jbe 0x1001099e
mov edi, dword [edi]
xor ecx, ecx
mov edx, 0x811c9dc5
test ebx, ebx
je 0x100109c1
nop dword [eax]
movzx eax, byte [edi + ecx]
inc ecx
xor eax, edx
imul edx, eax, 0x1000193
cmp ecx, ebx
jb 0x100109b0
and edx, dword [ebp + 0x18]
mov eax, dword [esp + 0x18]
lea eax, [eax + edx*8]
mov dword [esp + 0x2c], eax
mov eax, dword [eax + 4]
mov dword [esp + 0x24], eax
mov edi, esi
mov ebx, esi
mov esi, dword [esi]
lea ecx, [edi + 8]
call fcn.1001dcc0
push 0x1a8
push edi
call fcn.1017d3f8
dec dword [ebp + 8]
add esp, 8
cmp ebx, dword [esp + 0x24]
je 0x10010a1e
cmp esi, dword [esp + 0x30]
jne 0x100109d6
mov eax, dword [esp + 0x2c]
mov dword [eax], esi
mov eax, dword [esp + 0x20]
pop edi
mov dword [eax], esi
mov dword [esi + 4], eax
mov eax, dword [esp + 0x2c]
pop esi
pop ebx
pop ebp
add esp, 0x18
ret 8
mov eax, dword [esp + 0x2c]
mov edx, dword [esp + 0x1c]
mov dword [eax], edx
mov dword [eax + 4], edx
cmp esi, dword [esp + 0x30]
jne 0x10010990
jmp 0x10010a07
Function at 0x10013eb0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
sub esp, 8
push ebx
push ebp
mov ebp, dword [esp + 0x18]
mov ebx, ecx
push esi
push edi
mov edx, ebp
cmp dword [ebp + 0x14], 0xf
mov edi, dword [ebp + 0x10]
jbe 0x10013ecb
mov edx, dword [ebp]
xor ecx, ecx
mov esi, 0x811c9dc5
test edi, edi
je 0x10013ee7
movzx eax, byte [edx + ecx]
inc ecx
xor eax, esi
imul esi, eax, 0x1000193
cmp ecx, edi
jb 0x10013ed6
push esi
push ebp
lea eax, [esp + 0x18]
mov ecx, ebx
push eax
call fcn.10019e60
mov ecx, dword [esp + 0x14]
test ecx, ecx
je 0x10013f11
mov eax, dword [esp + 0x1c]
mov dword [eax], ecx
mov byte [eax + 4], 0
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret 0xc
cmp dword [ebx + 8], 0x5d1745d
je 0x10014063
push 0x2c
call fcn.1017d6f1
add esp, 4
mov edi, eax
lea ecx, [edi + 8]
push ebp
call fcn.10024a90
mov eax, dword [esp + 0x24]
vmovq xmm0, qword [eax]
mov eax, dword [eax + 8]
vmovq qword [edi + 0x20], xmm0
mov dword [edi + 0x28], eax
mov eax, dword [ebx + 8]
mov ebp, dword [ebx + 0x1c]
inc eax
vmovss xmm1, dword [ebx]
vxorps xmm0, xmm0, xmm0
vcvtsi2sd xmm0, xmm0, eax
shr eax, 0x1f
vaddsd xmm0, xmm0, qword [eax*8 + 0x10229440]
vcvtsd2ss xmm2, xmm0, xmm0
vxorps xmm0, xmm0, xmm0
mov eax, ebp
shr eax, 0x1f
vcvtsi2sd xmm0, xmm0, ebp
vaddsd xmm0, xmm0, qword [eax*8 + 0x10229440]
vcvtsd2ss xmm0, xmm0, xmm0
vdivss xmm0, xmm2, xmm0
vcomiss xmm0, xmm1
jbe 0x10014000
vdivss xmm0, xmm2, xmm1
vmovss dword [esp + 0x20], xmm0
fld dword [esp + 0x20]
fstp qword [esp + 0x10]
vxorpd xmm0, xmm0, xmm0
vroundsd xmm0, xmm0, qword [esp + 0x10], 2
vmovsd qword [esp + 0x10], xmm0
fld qword [esp + 0x10]
fstp dword [esp + 0x20]
vmovss xmm0, dword [esp + 0x20]
call fcn.101a4a40
mov ecx, 8
cmp eax, ecx
cmova ecx, eax
cmp ebp, ecx
jae 0x10013fe3
cmp ebp, 0x200
jae 0x10013fe1
shl ebp, 3
cmp ebp, ecx
jae 0x10013fe3
mov ebp, ecx
push ebp
mov ecx, ebx
call fcn.10015fd0
push esi
lea eax, [edi + 8]
mov ecx, ebx
push eax
lea eax, [esp + 0x18]
push eax
call fcn.10019e60
mov edx, dword [eax]
jmp 0x10014004
mov edx, dword [esp + 0x10]
mov ebp, dword [edx + 4]
inc dword [ebx + 8]
mov dword [edi], edx
mov dword [edi + 4], ebp
mov dword [ebp], edi
mov dword [edx + 4], edi
mov eax, dword [ebx + 0x18]
mov ecx, dword [ebx + 0xc]
and eax, esi
mov esi, dword [ecx + eax*8]
cmp esi, dword [ebx + 4]
jne 0x1001402a
mov dword [ecx + eax*8], edi
jmp 0x1001404b
cmp esi, edx
jne 0x10014045
mov dword [ecx + eax*8], edi
mov eax, dword [esp + 0x1c]
mov dword [eax], edi
mov byte [eax + 4], 1
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret 0xc
cmp dword [ecx + eax*8 + 4], ebp
jne 0x1001404f
mov dword [ecx + eax*8 + 4], edi
mov eax, dword [esp + 0x1c]
mov dword [eax], edi
pop edi
pop esi
pop ebp
mov byte [eax + 4], 1
pop ebx
add esp, 8
ret 0xc
push str.unordered_map_set_too_long
call fcn.1017aed4
int3