joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10066d80
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
and esp, 0xffffffc0
mov eax, dword [ebp + 8]
test eax, eax
je 0x10066df3
cmp eax, 1
je 0x10066df3
cmp eax, 2
je 0x10066dda
cmp eax, 3
je 0x10066dda
cmp eax, 4
jne 0x10066dc4
mov eax, dword [ebp + 0xc]
movss xmm0, dword [eax]
cvtps2pd xmm0, xmm0
sub esp, 8
movsd qword [esp], xmm0
push dword [ebp + 0x10]
push edx
push ecx
call fcn.100421a0
add esp, 0x14
mov esp, ebp
pop ebp
ret
cmp eax, 5
jne 0x10066dd2
mov eax, dword [ebp + 0xc]
movsd xmm0, qword [eax]
jmp 0x10066dab
push 0
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
mov eax, dword [ebp + 0xc]
push dword [eax + 4]
push dword [eax]
push dword [ebp + 0x10]
push edx
push ecx
call fcn.100421a0
add esp, 0x14
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp + 0xc]
push dword [eax]
push dword [ebp + 0x10]
push edx
push ecx
call fcn.100421a0
add esp, 0x10
mov esp, ebp
pop ebp
ret
Function at 0x100692a0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
mov eax, dword [ebp + 0xc]
sub esp, 8
push 0
test eax, 0x100000
je 0x100692bb
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
push 0
push eax
lea eax, [esp + 0xc]
mov dword [esp + 0xc], 0
push eax
push dword [ebp + 8]
mov dword [esp + 0x18], 0
call fcn.1006ad90
add esp, 0x14
mov esp, ebp
pop ebp
ret

Function at 0x100693c0
Capabilities:
Terminate process

Disassembly:
push esi
push edi
test edx, edx
jle 0x10069471
mov esi, dword [ecx + 4]
lea eax, [edx - 1]
cmp eax, esi
jge 0x10069469
mov ecx, dword [ecx + 0xc]
mov edi, 0x3000
movzx eax, word [ecx + eax*2]
cmp eax, 0x20
je 0x10069420
cmp eax, 9
je 0x10069420
cmp ax, di
je 0x10069420
cmp eax, 0x2c
je 0x10069420
cmp eax, 0x3b
je 0x10069420
cmp eax, 0x28
je 0x10069420
cmp eax, 0x29
je 0x10069420
cmp eax, 0x7b
je 0x10069420
cmp eax, 0x7d
je 0x10069420
cmp eax, 0x5b
je 0x10069420
cmp eax, 0x5d
je 0x10069420
cmp eax, 0x7c
jne 0x10069464
cmp edx, esi
jge 0x10069469
movzx eax, word [ecx + edx*2]
cmp eax, 0x20
je 0x10069464
cmp eax, 9
je 0x10069464
cmp ax, di
je 0x10069464
cmp eax, 0x2c
je 0x10069464
cmp eax, 0x3b
je 0x10069464
cmp eax, 0x28
je 0x10069464
cmp eax, 0x29
je 0x10069464
cmp eax, 0x7b
je 0x10069464
cmp eax, 0x7d
je 0x10069464
cmp eax, 0x5b
je 0x10069464
cmp eax, 0x5d
je 0x10069464
cmp eax, 0x7c
jne 0x10069471
pop edi
xor eax, eax
pop esi
ret
push 0
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
pop edi
mov eax, 1
pop esi
ret
Function at 0x100694e0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
mov esi, ecx
mov eax, edx
push edi
mov dword [ebp - 8], eax
mov ebx, dword [esi + 0xe64]
mov edi, dword [esi + 0x2c]
shr ebx, 0x12
and bl, 1
cmp eax, edi
jg 0x10069626
mov eax, dword [ebp + 0xc]
lea ecx, [eax + eax]
mov eax, dword [ebp + 8]
mov dword [ebp - 0xc], ecx
lea edx, [ecx + eax]
mov ecx, eax
call fcn.10042820
mov dword [ebp - 0x10], eax
lea ecx, [esi + 0x28]
mov dword [ebp - 4], ecx
test bl, bl
jne 0x10069536
mov ecx, dword [ecx]
inc ecx
add ecx, eax
cmp ecx, dword [esi + 0x30]
jg 0x1006954c
jmp 0x10069539
mov dword [ebp - 4], ecx
mov edx, dword [ebp + 0xc]
lea ecx, [esi + 4]
lea eax, [edx + 1]
add eax, edi
cmp eax, dword [ecx]
jle 0x100695bf
test bl, bl
jne 0x10069555
pop edi
pop esi
xor al, al
pop ebx
mov esp, ebp
pop ebp
ret
cmp edi, dword [ecx]
jge 0x10069626
mov eax, edx
mov ebx, 0x100
cmp eax, ebx
cmovle edx, ebx
shl eax, 2
cmp eax, 0x20
jge 0x10069578
mov eax, 0x20
jmp 0x1006957d
cmp eax, edx
cmovg eax, edx
mov ebx, dword [ecx + 4]
inc eax
add eax, edi
mov dword [ebp - 4], eax
cmp eax, ebx
jle 0x100695b5
test ebx, ebx
je 0x1006959e
mov eax, ebx
cdq
sub eax, edx
mov edx, eax
mov eax, dword [ebp - 4]
sar edx, 1
add edx, ebx
jmp 0x100695a3
mov edx, 8
cmp edx, dword [ebp - 4]
cmovg eax, edx
push eax
call fcn.10028080
mov eax, dword [ebp - 4]
lea ecx, [esi + 4]
mov edx, dword [ebp + 0xc]
lea ebx, [esi + 0x28]
mov dword [ecx], eax
jmp 0x100695c2
mov ebx, dword [ebp - 4]
mov eax, dword [ebp - 8]
mov ecx, dword [esi + 0xc]
mov dword [ebp - 4], ecx
cmp eax, edi
je 0x100695ef
sub edi, eax
lea eax, [ecx + eax*2]
add edi, edi
push edi
push eax
mov eax, dword [ebp - 8]
add eax, edx
lea eax, [ecx + eax*2]
push eax
call sub.VCRUNTIME140.dll_memmove
mov ecx, dword [ebp - 4]
add esp, 0xc
mov eax, dword [ebp - 8]
push dword [ebp - 0xc]
lea eax, [ecx + eax*2]
push dword [ebp + 8]
push eax
call sub.VCRUNTIME140.dll_memcpy
mov eax, dword [ebp + 0xc]
add esp, 0xc
add dword [esi + 0x2c], eax
mov eax, dword [ebp - 0x10]
mov ecx, dword [esi + 0x2c]
add dword [ebx], eax
cmp ecx, dword [esi + 4]
jge 0x10069626
mov eax, dword [esi + 0xc]
xor edx, edx
pop edi
pop esi
pop ebx
mov word [eax + ecx*2], dx
mov al, 1
mov esp, ebp
pop ebp
ret
push 0
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
Function at 0x10069630
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
push ebx
mov ebx, ecx
movss dword [ebp - 4], xmm1
push esi
xor esi, esi
mov dword [ebp - 8], ebx
push edi
mov edi, dword [ebx + 0x2c]
movaps xmm7, xmm2
mov dword [ebp - 0x1c], esi
xorps xmm6, xmm6
mov dword [ebp - 0x20], esi
mov dword [ebp - 0x10], esi
mov dword [ebp - 0x14], esi
mov dword [ebp - 0xc], esi
test edi, edi
jle 0x100696a1
push esi
mov edx, ebx
lea ecx, [ebp - 0x20]
call fcn.100692f0
mov ecx, dword [ebp - 0xc]
add esp, 4
test ecx, ecx
jle 0x100696a1
test esi, esi
jne 0x10069688
movss xmm0, dword [ebp - 0x14]
addss xmm0, xmm6
comiss xmm0, xmm7
ja 0x100696aa
movss xmm0, dword [ebp - 0x10]
addss xmm0, xmm6
comiss xmm0, xmm7
ja 0x100696b3
addss xmm6, dword [ebp - 0x18]
add esi, ecx
cmp esi, edi
jl 0x10069661
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
movss xmm2, dword [ebp - 0x20]
movss xmm3, dword [ebp - 4]
comiss xmm2, xmm3
jbe 0x100696cb
mov eax, esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
movss xmm0, dword [ebp - 0x1c]
comiss xmm0, xmm3
jbe 0x10069753
xor edi, edi
mov dword [ebp - 4], edi
test ecx, ecx
jle 0x10069753
movss xmm4, dword [0x10145324]
mov edx, esi
cmp edx, dword [ebx + 4]
jge 0x1006975d
mov eax, dword [ebx + 0xc]
movzx eax, word [eax + edx*2]
cmp eax, 0xa
jne 0x100696fe
movaps xmm0, xmm4
jmp 0x1006973b
mov edi, dword [0x1017bfd8]
mov ebx, eax
mov edi, dword [edi + 0x18fc]
cmp ebx, dword [edi]
jge 0x1006971a
mov eax, dword [edi + 8]
movss xmm1, dword [eax + ebx*4]
jmp 0x1006971f
movss xmm1, dword [edi + 0xc]
mov eax, dword [0x1017bfd8]
mov ebx, dword [ebp - 8]
movss xmm0, dword [eax + 0x1900]
divss xmm0, dword [edi + 0x10]
mov edi, dword [ebp - 4]
mulss xmm0, xmm1
movaps xmm1, xmm2
addss xmm1, xmm0
comiss xmm1, xmm3
ja 0x10069765
inc edi
inc edx
mov dword [ebp - 4], edi
movaps xmm2, xmm1
cmp edi, ecx
jl 0x100696e8
add ecx, esi
lea edx, [ecx - 1]
cmp edx, dword [ebx + 4]
jl 0x10069781
push 0
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
mulss xmm0, dword [0x10144fec]
lea eax, [edx + 1]
addss xmm0, xmm2
comiss xmm0, xmm3
cmova eax, edx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [ebx + 0xc]
pop edi
pop esi
pop ebx
cmp word [eax + edx*2], 0xa
cmove ecx, edx
mov eax, ecx
mov esp, ebp
pop ebp
ret
Function at 0x100697a0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
push ebx
push esi
mov ebx, edx
xor eax, eax
push edi
mov edi, ecx
mov dword [ebp - 8], eax
xor esi, esi
mov dword [ebp - 0xc], edi
mov ecx, dword [ebx + 0x2c]
mov dword [ebp - 4], ecx
cmp dword [ebp + 8], ecx
jne 0x1006983c
cmp dword [ebp + 0xc], eax
je 0x100697fe
push esi
lea ecx, [ebp - 0x24]
call fcn.100692f0
movss xmm0, dword [ebp - 0x14]
add esp, 4
subss xmm0, dword [ebp - 0x18]
mov eax, dword [ebp - 4]
mov dword [edi + 4], esi
movss dword [edi + 8], xmm0
movss xmm0, dword [ebp - 0x20]
movss dword [edi], xmm0
mov dword [edi + 0xc], esi
mov dword [edi + 0x10], eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov dword [edi + 4], eax
mov dword [edi], eax
mov dword [edi + 8], 0x3f800000
test ecx, ecx
jle 0x1006982a
mov edi, ecx
push esi
mov edx, ebx
lea ecx, [ebp - 0x24]
call fcn.100692f0
mov eax, esi
add esp, 4
add esi, dword [ebp - 0x10]
cmp esi, edi
jl 0x10069810
mov edi, dword [ebp - 0xc]
mov dword [edi + 0x14], eax
xor eax, eax
mov dword [edi + 0xc], esi
mov dword [edi + 0x10], eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 0
lea ecx, [ebp - 0x24]
mov dword [edi + 4], eax
call fcn.100692f0
mov ecx, dword [ebp - 0x10]
add esp, 4
cmp dword [ebp + 8], ecx
jl 0x10069881
movss xmm0, dword [ebp - 0x1c]
mov edx, ebx
addss xmm0, dword [edi + 4]
mov dword [ebp - 8], esi
add esi, ecx
push esi
lea ecx, [ebp - 0x24]
movss dword [edi + 4], xmm0
call fcn.100692f0
mov ecx, dword [ebp - 0x10]
add esp, 4
lea eax, [ecx + esi]
cmp dword [ebp + 8], eax
jge 0x10069854
movss xmm0, dword [ebp - 0x14]
subss xmm0, dword [ebp - 0x18]
movss xmm1, dword [ebp - 0x24]
mov eax, dword [ebp - 8]
mov dword [edi + 0xc], esi
mov dword [edi + 0x10], ecx
movss dword [edi + 8], xmm0
mov dword [edi + 0x14], eax
movss dword [edi], xmm1
cmp esi, dword [ebp + 8]
jge 0x10069835
cmp esi, dword [ebx + 4]
jge 0x1006992a
movss xmm3, dword [0x10145324]
lea ecx, [esi + esi]
mov edx, ecx
mov dword [ebp - 8], edx
nop
mov eax, dword [ebx + 0xc]
movzx eax, word [ecx + eax]
cmp eax, 0xa
jne 0x100698d1
movaps xmm0, xmm3
jmp 0x1006990b
mov ecx, dword [0x1017bfd8]
mov edx, eax
mov ecx, dword [ecx + 0x18fc]
cmp edx, dword [ecx]
jge 0x100698ed
mov eax, dword [ecx + 8]
movss xmm2, dword [eax + edx*4]
jmp 0x100698f2
movss xmm2, dword [ecx + 0xc]
mov eax, dword [0x1017bfd8]
mov edx, dword [ebp - 8]
movss xmm0, dword [eax + 0x1900]
divss xmm0, dword [ecx + 0x10]
mulss xmm0, xmm2
addss xmm1, xmm0
add edx, 2
inc esi
mov dword [ebp - 8], edx
movss dword [edi], xmm1
cmp esi, dword [ebp + 8]
jge 0x10069835
mov ecx, edx
cmp esi, dword [ebx + 4]
jl 0x100698c0
push 0
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
Function at 0x10069940
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
mov ebx, dword [ebp + 0xc]
mov eax, edx
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, ecx
push 0
push ebx
lea ecx, [eax + 0x18]
mov dword [ebp - 8], eax
mov edx, edi
call fcn.1006a8b0
add esp, 8
mov dword [ebp - 4], eax
test eax, eax
je 0x10069997
xor ecx, ecx
test ebx, ebx
jle 0x10069997
lea edx, [edi + edi]
lea eax, [ecx + edi]
cmp eax, dword [esi + 4]
jge 0x100699b2
mov eax, dword [esi + 0xc]
mov ebx, dword [ebp - 4]
mov ax, word [edx + eax]
add edx, 2
mov word [ebx + ecx*2], ax
inc ecx
mov ebx, dword [ebp + 0xc]
cmp ecx, ebx
jl 0x10069976
push ebx
mov edx, edi
mov ecx, esi
call fcn.10069480
mov eax, dword [ebp - 8]
add esp, 4
pop edi
pop esi
mov byte [eax + 0xf], 0
pop ebx
mov esp, ebp
pop ebp
ret
push 0
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
Function at 0x10071880
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
movss xmm2, dword [0x10145040]
sub esp, 0x10
xorps xmm1, xmm1
push ebx
push esi
mov esi, edx
push edi
movss xmm0, dword [esi]
comiss xmm1, xmm0
jbe 0x100718a4
xorps xmm0, xmm0
jmp 0x100718a8
minss xmm0, xmm2
movss xmm3, dword [0x10145264]
movss xmm4, dword [0x10144fec]
mulss xmm0, xmm3
addss xmm0, xmm4
cvttss2si eax, xmm0
movss xmm0, dword [esi + 4]
comiss xmm1, xmm0
mov dword [ebp - 0xc], eax
jbe 0x100718d6
xorps xmm0, xmm0
jmp 0x100718da
minss xmm0, xmm2
mulss xmm0, xmm3
addss xmm0, xmm4
cvttss2si eax, xmm0
movss xmm0, dword [esi + 8]
comiss xmm1, xmm0
mov dword [ebp - 8], eax
jbe 0x100718f8
xorps xmm0, xmm0
jmp 0x100718fc
minss xmm0, xmm2
mov edi, dword [ebp + 8]
mulss xmm0, xmm3
addss xmm0, xmm4
cvttss2si eax, xmm0
mov dword [ebp - 4], eax
and edi, 2
je 0x1007191a
mov ebx, 0xff
jmp 0x10071939
movss xmm0, dword [esi + 0xc]
comiss xmm1, xmm0
jbe 0x10071929
xorps xmm0, xmm0
jmp 0x1007192d
minss xmm0, xmm2
mulss xmm0, xmm3
addss xmm0, xmm4
cvttss2si ebx, xmm0
mov dl, 1
call fcn.1004dc50
mov edx, str.ColorButton
mov eax, edx
cmp eax, 0xffffffff
jae 0x1007197d
nop dword [eax]
mov cl, byte [edx]
test cl, cl
je 0x10071966
cmp cl, 0x23
jne 0x10071960
cmp byte [edx + 1], cl
je 0x10071966
inc edx
cmp edx, 0xffffffff
jb 0x10071950
cmp edx, str.ColorButton
jbe 0x1007197d
mov ecx, str.ColorButton
call fcn.10062390
call fcn.10065120
movss xmm1, dword [0x10145324]
xorps xmm0, xmm0
call fcn.1004da50
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 8]
mov edx, dword [ebp - 0xc]
test edi, edi
je 0x100719da
movss xmm0, dword [esi + 8]
sub esp, 0x18
cvtps2pd xmm0, xmm0
movsd qword [esp + 0x10], xmm0
movss xmm0, dword [esi + 4]
cvtps2pd xmm0, xmm0
movsd qword [esp + 8], xmm0
movss xmm0, dword [esi]
cvtps2pd xmm0, xmm0
movsd qword [esp], xmm0
push eax
push ecx
push edx
push eax
push ecx
push edx
push str._02X_02X_02X_nR:__d__G:__d__B:__d_n__.3f___.3f___.3f_
call fcn.100628a0
add esp, 0x34
jmp 0x10071a28
movss xmm0, dword [esi + 0xc]
sub esp, 0x20
cvtps2pd xmm0, xmm0
movsd qword [esp + 0x18], xmm0
movss xmm0, dword [esi + 8]
cvtps2pd xmm0, xmm0
movsd qword [esp + 0x10], xmm0
movss xmm0, dword [esi + 4]
cvtps2pd xmm0, xmm0
movsd qword [esp + 8], xmm0
movss xmm0, dword [esi]
cvtps2pd xmm0, xmm0
movsd qword [esp], xmm0
push ebx
push eax
push ecx
push edx
push ebx
push eax
push ecx
push edx
push str._02X_02X_02X_02X_nR:_d__G:_d__B:_d__A:_d_n__.3f___.3f___.3f___.3f_
call fcn.100628a0
add esp, 0x44
mov eax, dword [0x1017bfd8]
mov eax, dword [eax + 0x19e4]
test dword [eax + 8], 0x2000000
jne 0x10071a44
push 0
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
call fcn.1004c800
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10077a20
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, ecx
mov dl, byte [esi]
xor dl, byte [edi]
and dl, 1
xor dl, byte [edi]
mov byte [edi], dl
mov cl, byte [esi]
xor cl, dl
and cl, 2
xor cl, dl
mov byte [edi], cl
movzx eax, byte [esi]
xor al, cl
and al, 4
xor al, cl
mov byte [edi], al
mov eax, dword [esi + 4]
mov dword [edi + 4], eax
mov eax, dword [esi + 8]
mov dword [edi + 8], eax
mov eax, dword [esi + 0xc]
mov dword [edi + 0xc], eax
mov eax, dword [esi + 0x10]
mov dword [edi + 0x10], eax
mov eax, dword [esi + 0x14]
mov dword [edi + 0x14], eax
mov eax, dword [esi + 0x18]
mov dword [edi + 0x18], eax
mov eax, dword [esi + 0x1c]
mov dword [edi + 0x1c], eax
mov eax, dword [esi + 0x20]
mov dword [edi + 0x20], eax
mov eax, dword [esi + 0x24]
mov dword [edi + 0x24], eax
mov eax, dword [esi + 0x28]
mov dword [edi + 0x28], eax
mov eax, dword [esi + 0x2c]
mov dword [edi + 0x2c], eax
mov eax, dword [esi + 0x30]
mov dword [edi + 0x30], eax
mov eax, dword [esi + 0x34]
mov dword [edi + 0x34], eax
mov eax, dword [esi + 0x38]
mov dword [edi + 0x38], eax
mov eax, dword [esi + 0x3c]
mov dword [edi + 0x3c], eax
mov eax, dword [esi + 0x40]
mov dword [edi + 0x40], eax
mov eax, dword [esi + 0x44]
mov dword [edi + 0x44], eax
mov eax, dword [esi + 0x48]
mov dword [edi + 0x48], eax
mov eax, dword [esi + 0x4c]
mov dword [edi + 0x4c], eax
mov eax, dword [esi + 0x50]
mov dword [edi + 0x50], eax
mov eax, dword [esi + 0x54]
mov dword [edi + 0x54], eax
mov eax, dword [esi + 0x58]
mov dword [edi + 0x58], eax
mov eax, dword [esi + 0x5c]
mov dword [edi + 0x5c], eax
mov eax, dword [esi + 0x60]
mov dword [edi + 0x60], eax
mov eax, dword [esi + 0x64]
mov dword [edi + 0x64], eax
mov eax, dword [esi + 0x68]
mov dword [edi + 0x68], eax
mov eax, dword [esi + 0x6c]
mov dword [edi + 0x6c], eax
mov eax, dword [esi + 0x70]
mov dword [edi + 0x70], eax
mov eax, dword [esi + 0x74]
mov dword [edi + 0x74], eax
mov eax, dword [esi + 0x78]
mov dword [edi + 0x78], eax
mov eax, dword [esi + 0x7c]
mov dword [edi + 0x7c], eax
mov eax, dword [esi + 0x80]
mov dword [edi + 0x80], eax
mov eax, dword [esi + 0x84]
mov dword [edi + 0x84], eax
mov eax, dword [esi + 0x88]
mov dword [edi + 0x88], eax
mov eax, dword [esi + 0x8c]
mov dword [edi + 0x8c], eax
mov eax, dword [esi + 0x90]
mov dword [edi + 0x90], eax
mov eax, dword [esi + 0x94]
mov dword [edi + 0x94], eax
mov eax, dword [esi + 0x98]
mov dword [edi + 0x98], eax
mov eax, dword [esi + 0x9c]
mov dword [edi + 0x9c], eax
mov eax, dword [esi + 0xa0]
mov dword [edi + 0xa0], eax
mov eax, dword [esi + 0xa4]
mov dword [edi + 0xa4], eax
movzx eax, byte [esi + 0xa8]
mov byte [edi + 0xa8], al
mov eax, dword [esi + 0xac]
mov dword [edi + 0xac], eax
mov eax, dword [esi + 0xb0]
mov dword [edi + 0xb0], eax
mov eax, dword [esi + 0xb4]
mov dword [edi + 0xb4], eax
mov eax, edi
pop edi
pop esi
pop ebp
ret 4

Function at 0x10077ed0
Capabilities:
Hash data with crc32

Disassembly:
push ebx
mov ebx, ecx
or eax, 0xffffffff
push esi
push edi
mov edi, 4
lea esi, [ebx + 4]
jmp dword [edi*4 + 0x10079118]
Function at 0x1007a570
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
mov eax, dword [ebp + 8]
sub esp, 0x54
cmp dword [eax + 0x14], 0xf
push ebx
push esi
push edi
mov edi, dword [eax + 0x10]
mov esi, eax
jbe 0x1007a58c
mov esi, dword [eax]
xor ecx, ecx
mov edx, 0x811c9dc5
test edi, edi
je 0x1007a5a8
movzx eax, byte [esi + ecx]
inc ecx
xor eax, edx
imul edx, eax, 0x1000193
cmp ecx, edi
jb 0x1007a597
mov eax, dword [ebp + 0xc]
mov dword [esp + 0x10], edx
mov dword [esp + 0x18], 0
cmp dword [eax + 4], 0
jle 0x1007a6fc
xor ecx, ecx
mov dword [esp + 0x1c], ecx
mov ebx, dword [eax]
add ebx, ecx
mov ecx, dword [ebx + 0x28]
test ecx, ecx
je 0x1007a5ed
cmp dword [ecx + 4], 0
jle 0x1007a5ed
mov eax, dword [ebx + 0x2c]
add eax, dword [ebp + 0x10]
push eax
push ecx
push dword [ebp + 8]
mov ecx, 0x101800d0
call fcn.1007a570
mov edi, dword [ebx]
mov esi, 0x811c9dc5
xor eax, eax
inc eax
cmp byte [edi + eax], 0
jne 0x1007a5f6
xor edx, edx
test eax, eax
je 0x1007a614
movsx ecx, byte [edi + edx]
inc edx
xor ecx, esi
imul esi, ecx, 0x1000193
cmp edx, eax
jb 0x1007a603
lea eax, [esp + 0x10]
mov dword [esp + 0x14], esi
push eax
lea eax, [esp + 0x24]
mov ecx, 0x101800f0
push eax
call fcn.1003ece0
mov ecx, dword [eax]
lea eax, [esp + 0x14]
push eax
lea eax, [esp + 0x2c]
add ecx, 0xc
push eax
call fcn.1003eb00
mov eax, dword [eax]
cmp dword [eax + 0x14], 0
jne 0x1007a6da
lea eax, [esp + 0x10]
mov ecx, 0x101800f0
push eax
lea eax, [esp + 0x34]
push eax
call fcn.1003ece0
mov ecx, dword [eax]
lea eax, [esp + 0x14]
push eax
lea eax, [esp + 0x3c]
add ecx, 0xc
push eax
call fcn.1003eb00
mov ecx, 0x101800f0
mov eax, dword [eax]
mov byte [eax + 0xc], 0
lea eax, [esp + 0x10]
push eax
lea eax, [esp + 0x44]
push eax
call fcn.1003ece0
mov ecx, dword [eax]
lea eax, [esp + 0x14]
push eax
lea eax, [esp + 0x4c]
add ecx, 0xc
push eax
call fcn.1003eb00
mov ecx, 0x101800f0
mov eax, dword [eax]
mov dword [eax + 0x10], ebx
lea eax, [esp + 0x10]
mov esi, dword [ebx + 0x2c]
add esi, dword [ebp + 0x10]
push eax
lea eax, [esp + 0x54]
push eax
call fcn.1003ece0
mov ecx, dword [eax]
lea eax, [esp + 0x14]
push eax
lea eax, [esp + 0x5c]
add ecx, 0xc
push eax
call fcn.1003eb00
mov eax, dword [eax]
mov dword [eax + 0x14], esi
mov edx, dword [ebp + 0xc]
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x1c]
inc eax
add ecx, 0x3c
mov dword [esp + 0x18], eax
cmp eax, dword [edx + 4]
mov eax, edx
mov dword [esp + 0x1c], ecx
jl 0x1007a5c7
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x1007a970
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
sub esp, 0x14
test eax, eax
je 0x1007aae0
push ebx
mov ebx, dword [eax + 2]
mov dword [ebp - 0xc], ebx
test ebx, ebx
je 0x1007aadf
lea eax, [ebx - 4]
test eax, eax
je 0x1007aadf
mov ecx, dword [ebx]
test ecx, ecx
je 0x1007aadf
cmp ecx, 0xc8
jg 0x1007aadf
cmp dword [eax], 0
je 0x1007aadf
push esi
mov esi, dword [eax + 8]
test esi, esi
je 0x1007aade
push edi
mov edi, 0x811c9dc5
xor ecx, ecx
nop
inc ecx
cmp byte [esi + ecx], 0
jne 0x1007a9d0
xor edx, edx
test ecx, ecx
je 0x1007a9f1
nop dword [eax]
movsx eax, byte [esi + edx]
inc edx
xor eax, edi
imul edi, eax, 0x1000193
cmp edx, ecx
jb 0x1007a9e0
mov dword [ebp - 4], edi
cmp dword [ebx], 0
mov dword [ebp - 0x10], 0
jle 0x1007aadd
xor esi, esi
mov eax, ebx
mov dword [ebp - 0x14], esi
nop dword [eax + eax]
mov ebx, dword [eax - 4]
add ebx, esi
mov esi, dword [ebx + 4]
test esi, esi
je 0x1007aac5
mov edi, 0x811c9dc5
xor eax, eax
inc eax
cmp byte [esi + eax], 0
jne 0x1007aa27
xor edx, edx
test eax, eax
je 0x1007aa45
movsx ecx, byte [esi + edx]
inc edx
xor ecx, edi
imul edi, ecx, 0x1000193
cmp edx, eax
jb 0x1007aa34
lea eax, [ebp - 4]
mov dword [ebp - 8], edi
push eax
mov ecx, 0x101800f0
call fcn.1003df70
lea ecx, [ebp - 8]
push ecx
mov ecx, eax
call fcn.1003df50
cmp dword [eax + 8], 0
jne 0x1007aac2
lea eax, [ebp - 4]
mov ecx, 0x101800f0
push eax
call fcn.1003df70
lea ecx, [ebp - 8]
push ecx
mov ecx, eax
call fcn.1003df50
mov ecx, 0x101800f0
mov byte [eax], 1
lea eax, [ebp - 4]
mov esi, dword [ebx + 8]
push eax
call fcn.1003df70
lea ecx, [ebp - 8]
push ecx
mov ecx, eax
call fcn.1003df50
mov ecx, 0x101800f0
mov dword [eax + 8], esi
lea eax, [ebp - 4]
push eax
call fcn.1003df70
lea ecx, [ebp - 8]
push ecx
mov ecx, eax
call fcn.1003df50
mov dword [eax + 4], 0
mov eax, dword [ebp - 0xc]
mov ebx, dword [ebp - 0x10]
mov esi, dword [ebp - 0x14]
inc ebx
add esi, 0x3c
mov dword [ebp - 0x10], ebx
mov dword [ebp - 0x14], esi
cmp ebx, dword [eax]
jl 0x1007aa10
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x1007e5a0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10117b3d
mov eax, dword fs:[0]
push eax
sub esp, 0x30
mov eax, dword [0x10150380]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
xorps xmm0, xmm0
mov dword [ebp - 0x30], 0
xor edx, edx
mov eax, 0xf
movups xmmword [ebp - 0x28], xmm0
mov dword [ebp - 0x18], edx
mov dword [ebp - 0x14], eax
mov byte [ebp - 0x28], dl
mov dword [ebp - 4], edx
mov edi, dword [ecx]
mov ecx, dword [ecx + 4]
mov dword [ebp - 0x34], edi
mov dword [ebp - 0x3c], ecx
cmp edi, ecx
je 0x1007e6dc
mov ecx, dword [ebp - 0x28]
lea esi, [ebp - 0x28]
cmp esi, edi
je 0x1007e627
cmp dword [edi + 0x14], 0xf
mov eax, edi
jbe 0x1007e612
mov eax, dword [edi]
push dword [edi + 0x10]
lea ecx, [ebp - 0x28]
push eax
call fcn.1000e570
mov edx, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x28]
mov eax, dword [ebp - 0x14]
lea esi, [edx - 3]
cmp esi, edx
ja 0x1007e641
cmp dword [ebp - 0x14], 0xf
lea eax, [ebp - 0x28]
mov dword [ebp - 0x18], esi
cmova eax, ecx
mov byte [eax + esi], 0
jmp 0x1007e684
mov ecx, esi
sub eax, edx
sub ecx, edx
mov dword [ebp - 0x2c], ecx
push ecx
cmp ecx, eax
ja 0x1007e673
cmp dword [ebp - 0x14], 0xf
mov dword [ebp - 0x18], esi
lea esi, [ebp - 0x28]
cmova esi, dword [ebp - 0x28]
add esi, edx
push 0
push esi
call sub.VCRUNTIME140.dll_memset
mov eax, dword [ebp - 0x2c]
add esp, 0xc
mov byte [esi + eax], 0
jmp 0x1007e684
push ecx
mov byte [ebp - 0x38], 0
push dword [ebp - 0x38]
push ecx
lea ecx, [ebp - 0x28]
call fcn.1001dd20
cmp dword [ebp - 0x14], 0xf
lea eax, [ebp - 0x28]
mov edx, dword [ebp - 0x18]
mov esi, 0x811c9dc5
cmova eax, dword [ebp - 0x28]
xor ecx, ecx
test edx, edx
je 0x1007e6b4
mov edi, eax
nop
movzx eax, byte [edi + ecx]
inc ecx
xor eax, esi
imul esi, eax, 0x1000193
cmp ecx, edx
jb 0x1007e6a0
mov edi, dword [ebp - 0x34]
cmp esi, dword [ebp + 8]
jne 0x1007e6c4
mov esi, dword [ebp - 0x30]
test esi, esi
je 0x1007e6d7
dec esi
mov dword [ebp - 0x30], esi
add edi, 0x1c
mov dword [ebp - 0x34], edi
cmp edi, dword [ebp - 0x3c]
je 0x1007e6dc
mov eax, dword [ebp - 0x14]
jmp 0x1007e5fe
mov edi, dword [edi + 0x18]
jmp 0x1007e6de
xor edi, edi
mov eax, dword [ebp - 0x14]
mov esi, dword [ebp - 0x28]
cmp eax, 0xf
jbe 0x1007e716
lea ecx, [eax + 1]
mov eax, esi
cmp ecx, 0x1000
jb 0x1007e70c
mov esi, dword [eax - 4]
add ecx, 0x23
sub eax, esi
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x1007e70c
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push ecx
push esi
call fcn.1011035b
add esp, 8
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1010fe2d
mov esp, ebp
pop ebp
ret 0xc