joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100974c9
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
je 0x10097566
push ebx
push esi
call fcn.10097492
xor ebx, ebx
sub eax, esi
push ebx
push ebx
push ebx
push ebx
sar eax, 1
push eax
push esi
push ebx
push ebx
mov dword [ebp - 8], eax
call fcn.1009524a
add esp, 0x24
mov dword [ebp - 4], eax
test eax, eax
jne 0x10097513
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x10097565
push edi
push eax
call fcn.10092826
mov edi, eax
pop ecx
push ebx
test edi, edi
jne 0x10097533
call fcn.1009190b
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x10097564
push ebx
push dword [ebp - 4]
push edi
push dword [ebp - 8]
push esi
push ebx
push ebx
call fcn.1009524a
add esp, 0x20
test eax, eax
jne 0x10097552
push edi
call fcn.1009190b
jmp 0x1009755a
push ebx
call fcn.1009190b
mov ebx, edi
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, ebx
pop edi
pop ebx
pop esi
leave
ret

Function at 0x10097569
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
jne 0x1009757a
pop esi
ret
push ebx
push edi
push esi
call fcn.10097492
mov ebx, eax
sub ebx, esi
and ebx, 0xfffffffe
push ebx
call fcn.10092826
mov edi, eax
pop ecx
pop ecx
test edi, edi
je 0x100975a2
push ebx
push esi
push edi
call fcn.10076440
add esp, 0xc
push 0
call fcn.1009190b
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, edi
pop edi
pop ebx
pop esi
ret

Function at 0x10097cfc
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.10097817

Function at 0x1009a433
Capabilities:
Get geographical location

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push esi
push edi
call fcn.1008fc4a
mov esi, dword [ebp + 8]
mov edi, eax
push 2
lea eax, [ebp - 4]
mov ecx, esi
push eax
and ecx, 0x3ff
push 0x20000001
or ecx, 0x400
push ecx
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x1009a4a2
cmp esi, dword [ebp - 4]
je 0x1009a49d
cmp dword [ebp + 0xc], 0
je 0x1009a49d
mov esi, dword [edi + 0x50]
lea ecx, [esi + 2]
mov ax, word [esi]
add esi, 2
test ax, ax
jne 0x1009a47a
push dword [edi + 0x50]
sub esi, ecx
sar esi, 1
call fcn.10099f85
pop ecx
xor ecx, ecx
cmp eax, esi
setne cl
mov eax, ecx
jmp 0x1009a4a4
xor eax, eax
inc eax
jmp 0x1009a4a4
xor eax, eax
pop edi
pop esi
leave
ret
Function at 0x1009a509
Capabilities:
Get geographical location

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [0x101f3600]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push ebx
mov ebx, dword [ebp + 0x10]
push esi
mov esi, dword [ebp + 8]
push edi
mov dword [ebp - 0x18], eax
call fcn.1008fc4a
add eax, 0x50
lea edi, [ebp - 0x10]
mov dword [ebp - 0x14], eax
xor eax, eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
call fcn.1008fc4a
lea ecx, [ebp - 0x10]
xor edx, edx
mov dword [eax + 0x34c], ecx
lea ecx, [esi + 0x80]
mov eax, dword [ebp - 0x14]
mov dword [eax], esi
lea edi, [eax + 4]
mov dword [edi], ecx
test ecx, ecx
je 0x1009a580
cmp word [ecx], dx
je 0x1009a580
mov eax, dword [0x10133fa4]
push edi
dec eax
push eax
push 0x10133e90
call fcn.1009a4a8
mov eax, dword [ebp - 0x14]
add esp, 0xc
xor edx, edx
mov dword [ebp - 0x10], edx
mov eax, dword [eax]
test eax, eax
je 0x1009a5f3
cmp word [eax], dx
je 0x1009a5f3
mov eax, dword [edi]
test eax, eax
je 0x1009a5a4
cmp word [eax], dx
je 0x1009a5a4
lea eax, [ebp - 0x10]
push eax
call fcn.10099e8b
jmp 0x1009a5ad
lea eax, [ebp - 0x10]
push eax
call fcn.10099f26
cmp dword [ebp - 0x10], 0
pop ecx
jne 0x1009a61d
mov eax, dword [0x10133e8c]
push dword [ebp - 0x14]
dec eax
push eax
push 0x10133b80
call fcn.1009a4a8
add esp, 0xc
test al, al
je 0x1009a61d
mov eax, dword [edi]
xor edi, edi
test eax, eax
je 0x1009a5e8
cmp word [eax], di
je 0x1009a5e8
lea eax, [ebp - 0x10]
push eax
call fcn.10099e8b
pop ecx
jmp 0x1009a61f
lea eax, [ebp - 0x10]
push eax
call fcn.10099f26
jmp 0x1009a5e5
mov eax, dword [edi]
test eax, eax
je 0x1009a60a
cmp word [eax], dx
je 0x1009a60a
lea eax, [ebp - 0x10]
push eax
call fcn.10099e40
pop ecx
jmp 0x1009a61d
mov dword [ebp - 0x10], 0x104
call dword [sym.imp.KERNEL32.dll_GetUserDefaultLCID]
mov dword [ebp - 8], eax
mov dword [ebp - 0xc], eax
xor edi, edi
cmp dword [ebp - 0x10], 0
je 0x1009a6e8
lea eax, [ebp - 0x10]
push eax
lea eax, [esi + 0x100]
neg esi
sbb esi, esi
and esi, eax
push esi
call fcn.1009a32d
mov esi, eax
pop ecx
pop ecx
test esi, esi
je 0x1009a6e8
movzx ecx, si
push ecx
call dword [sym.imp.KERNEL32.dll_IsValidCodePage]
test eax, eax
je 0x1009a6e8
push 1
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_IsValidLocale]
test eax, eax
je 0x1009a6e8
mov eax, dword [ebp - 0x18]
test eax, eax
je 0x1009a675
mov dword [eax], esi
mov eax, dword [ebp - 0x14]
push edi
push 0x55
add eax, 0x250
push eax
push dword [ebp - 0xc]
call fcn.100923f6
test ebx, ebx
je 0x1009a6e3
push edi
push 0x55
lea eax, [ebx + 0x120]
push eax
push dword [ebp - 0xc]
call fcn.100923f6
push 0x40
push ebx
push 0x1001
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x1009a6e8
push 0x40
lea eax, [ebx + 0x80]
push eax
push 0x1002
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x1009a6e8
push 0xa
push 0x10
lea ecx, [ebx + 0x100]
push ecx
push esi
call fcn.1009d4bf
add esp, 0x10
xor eax, eax
inc eax
jmp 0x1009a6ea
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.100747a0
leave
ret
Function at 0x1009c777
Capabilities:
Get disk information

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [0x101f3600]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
cmp eax, 0x1a
jbe 0x1009c7ba
call fcn.10080fb0
mov dword [eax], 0xf
call fcn.10080fc3
mov dword [eax], 0xd
call fcn.1007b604
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100747a0
leave
ret
test eax, eax
jne 0x1009c7c1
inc eax
jmp 0x1009c7ae
add eax, 0x40
push 0x3a
mov word [ebp - 0xc], ax
pop eax
mov word [ebp - 0xa], ax
push 0x5c
pop eax
mov word [ebp - 8], ax
xor eax, eax
mov word [ebp - 6], ax
lea eax, [ebp - 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
mov ecx, eax
test ecx, ecx
je 0x1009c7ac
xor eax, eax
cmp ecx, 1
setne al
jmp 0x1009c7ae
Function at 0x100aaf10
Capabilities:
Encode data using base64

Disassembly:
push ecx
push ebx
push ebp
mov ebp, dword [esp + 0x18]
push esi
xor esi, esi
push edi
test ebp, ebp
je 0x100ab077
mov edi, dword [esp + 0x1c]
mov ecx, dword [esp + 0x18]
cmp edi, 2
jbe 0x100aafcc
mov dword [esp + 0x10], 4
nop dword [eax]
mov ah, byte [ecx]
sub edi, 3
mov dl, byte [ecx + 1]
mov bl, ah
mov dh, byte [ecx + 2]
mov al, dl
mov ebp, dword [esp + 0x24]
and bl, 3
shr al, 4
and dl, 0xf
shl bl, 4
add ecx, 3
add bl, al
shl dl, 2
mov al, dh
shr al, 6
add dl, al
cmp dword [esp + 0x10], ebp
mov ebp, dword [esp + 0x20]
ja 0x100ab077
movzx eax, ah
shr eax, 2
mov al, byte [eax + 0x1013a268]
mov byte [esi + ebp], al
movzx eax, bl
mov al, byte [eax + 0x1013a268]
mov byte [esi + ebp + 1], al
movzx eax, dl
mov al, byte [eax + 0x1013a268]
mov byte [esi + ebp + 2], al
movzx eax, dh
and eax, 0x3f
mov al, byte [eax + 0x1013a268]
mov byte [esi + ebp + 3], al
add esi, 4
mov eax, dword [esp + 0x10]
add eax, 4
mov dword [esp + 0x10], eax
cmp edi, 2
ja 0x100aaf40
test edi, edi
je 0x100ab065
xor bl, bl
mov word [esp + 0x21], 0
xor ah, ah
mov byte [esp + 0x20], bl
xor dl, dl
test edi, edi
je 0x100ab004
push edi
push ecx
lea eax, [esp + 0x28]
push eax
call fcn.10076440
mov ah, byte [esp + 0x2e]
add esp, 0xc
mov dl, byte [esp + 0x21]
mov bl, byte [esp + 0x20]
mov al, dl
shr ah, 6
mov cl, bl
shr al, 4
and bl, 3
shr cl, 2
and dl, 0xf
shl bl, 4
shl dl, 2
add bl, al
add dl, ah
lea eax, [esi + 4]
cmp eax, dword [esp + 0x24]
ja 0x100ab077
movzx eax, cl
mov al, byte [eax + 0x1013a268]
mov byte [esi + ebp], al
movzx eax, bl
mov al, byte [eax + 0x1013a268]
mov byte [esi + ebp + 1], al
add esi, 2
lea ecx, [esi + ebp]
cmp edi, 1
jne 0x100ab052
mov al, 0x3d
jmp 0x100ab05b
movzx eax, dl
mov al, byte [eax + 0x1013a268]
mov byte [ecx], al
mov byte [esi + ebp + 1], 0x3d
add esi, 2
cmp esi, dword [esp + 0x24]
jae 0x100ab077
pop edi
mov byte [esi + ebp], 0
mov eax, esi
pop esi
pop ebp
pop ebx
pop ecx
ret
pop edi
pop esi
pop ebp
or eax, 0xffffffff
pop ebx
pop ecx
ret
Function at 0x100ab380
Capabilities:
Get hostname

Disassembly:
sub esp, 0x13c
mov eax, dword [0x101f3600]
xor eax, esp
mov dword [esp + 0x138], eax
push esi
mov esi, dword [esp + 0x144]
lea eax, [esp + 0x24]
push 0x118
xorps xmm0, xmm0
push 0
push eax
movups xmmword [esp + 0x10], xmm0
call fcn.10076270
lea eax, [esp + 0x30]
push eax
call fcn.100ad4c0
add esp, 0x10
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov ecx, eax
mov dword [esp + 0x30], 0
shr ecx, 0x10
xor ecx, eax
movzx eax, cx
mov dword [esp + 0x2c], eax
lea eax, [esp + 0x34]
push 0x100
push eax
call dword [sym.imp.WS2_32.dll_gethostname]
test eax, eax
je 0x100ab427
call fcn.10080fc3
cmp dword [eax], 0x26
jne 0x100ab408
push 0x100
push str.hostname_exceeds__d_characters__truncating.
jmp 0x100ab414
call fcn.10080fc3
push dword [eax]
push str.unable_to_get_hostname:__d
push 2
call fcn.1007a58f
add esp, 4
push eax
call fcn.100a1e70
add esp, 0xc
push 0
push 0
push 1
push 0x101f5058
mov byte [esp + 0x143], 0
call fcn.100ad3e0
movups xmm0, xmmword [esp + 0x34]
mov dword [esp + 0x144], eax
mov dword [esp + 0x148], edx
movups xmmword [esp + 0x24], xmm0
movd ecx, xmm0
psrldq xmm0, 4
movd eax, xmm0
not ecx
mov dword [esp + 0x2c], ecx
not eax
mov dword [esp + 0x30], eax
lea eax, [esp + 0x14]
push eax
lea eax, [esp + 0x28]
push eax
lea eax, [esp + 0x3c]
push 0x118
push eax
call fcn.100ab6d0
mov eax, dword [esp + 0x24]
add esp, 0x20
cmp byte [esp + 0x148], 0
mov dword [esi + 0x10], eax
mov al, byte [esp + 8]
mov byte [esi + 0x14], al
je 0x100ab4c2
mov eax, dword [esp + 0xc]
mov ecx, eax
and ecx, 0xff0ffff0
and eax, 0xff0ffff0
mov dword [esi + 4], ecx
mov ecx, dword [esp + 0x10]
mov dword [esi + 8], eax
mov dword [esi + 0xc], ecx
mov ecx, dword [esp + 0x30]
mov eax, dword [esp + 0x2c]
mov dword [esi + 0x1c], ecx
mov ecx, dword [esp + 0x13c]
mov dword [esi + 0x18], eax
pop esi
xor ecx, esp
call fcn.100747a0
add esp, 0x13c
ret
Function at 0x100be310
Capabilities:
Resolve dns

Disassembly:
sub esp, 0xc
push ebx
push ebp
mov ebp, dword [esp + 0x1c]
mov ecx, 0x100bfaa0
test ebp, ebp
mov dword [esp + 8], 0
push esi
mov esi, dword [esp + 0x1c]
mov eax, 0x100bf9f0
cmovne eax, ecx
mov dword [esp + 0x10], 0
mov dword [esp + 0x14], eax
mov ecx, 0x101483d8
push edi
mov edi, dword [esp + 0x28]
mov eax, 0x101483dc
cmove eax, ecx
mov bh, 1
mov dword [esp + 0x24], eax
mov ecx, 0x10
push 0
lea eax, [esp + 0x14]
setne bl
push eax
push 0
mov eax, 0x21
cmovne eax, ecx
push 8
movzx eax, ax
push eax
push esi
call sub.DNSAPI.dll_DnsQuery_UTF8
test eax, eax
je 0x100be3ec
push 0
push 0
lea ecx, [esp + 0x1c]
push ecx
push 0x400
push eax
push 0
push 0x1300
call dword [sym.imp.KERNEL32.dll_FormatMessageA]
test eax, eax
je 0x100be3c9
push dword [esp + 0x14]
push esi
push dword [esp + 0x2c]
push str.Failed_to_look_up__s_record___s_:__s
push 3
push 2
push dword [esp + 0x44]
call fcn.100aa440
mov ecx, dword [esp + 0x2c]
add esp, 0x1c
jmp 0x100be4af
push esi
push dword [esp + 0x28]
push str.Failed_to_look_up__s_record___s_:_Unknown_error
push 3
push 2
push dword [esp + 0x40]
call fcn.100aa440
mov ecx, dword [esp + 0x28]
add esp, 0x18
jmp 0x100be4af
mov ecx, dword [esp + 0x10]
test ecx, ecx
jne 0x100be400
push esi
push dword [esp + 0x28]
push str.No__s_records_for___s_
jmp 0x100be3d3
mov edx, dword [esp + 0x2c]
xor esi, esi
cmp ebp, 1
jne 0x100be414
cmp word [ecx + 8], 0x10
je 0x100be41f
jmp 0x100be459
test ebp, ebp
jne 0x100be459
cmp word [ecx + 8], 0x21
jne 0x100be459
test esi, esi
jle 0x100be428
cmp ebp, 1
je 0x100be48b
test edi, edi
je 0x100be43e
test esi, esi
je 0x100be438
mov eax, dword [ecx + 0x10]
cmp eax, dword [edi + 4]
jae 0x100be43e
mov eax, dword [ecx + 0x10]
mov dword [edi + 4], eax
push edx
push edi
push ecx
push dword [esp + 0x2c]
call dword [esp + 0x28]
mov ecx, dword [esp + 0x20]
add esp, 0x10
test al, al
je 0x100be4a9
mov edx, dword [esp + 0x2c]
inc esi
mov eax, dword [ecx]
mov ecx, eax
mov dword [esp + 0x10], ecx
test eax, eax
jne 0x100be406
mov dword [edi], esi
test esi, esi
jne 0x100be4ad
push dword [esp + 0x20]
push dword [esp + 0x28]
push str.No_matching__s_records_for___s_
push 3
push 2
push edx
call fcn.100aa440
mov ecx, dword [esp + 0x28]
add esp, 0x18
jmp 0x100be4af
push dword [esp + 0x20]
xor bh, bh
push str.Multiple_TXT_records_for___s_
push 3
push 2
push edx
call fcn.100aa440
mov ecx, dword [esp + 0x24]
add esp, 0x14
jmp 0x100be4af
xor bh, bh
jmp 0x100be4af
mov bl, 1
test ecx, ecx
je 0x100be4bb
push 1
push ecx
call sub.DNSAPI.dll_DnsFree
mov eax, dword [esp + 0x14]
test eax, eax
je 0x100be4ca
push eax
call dword [sym.imp.KERNEL32.dll_LocalFree]
test bl, bl
je 0x100be4dc
test bh, bh
je 0x100be4dc
pop edi
pop esi
pop ebp
mov al, 1
pop ebx
add esp, 0xc
ret
pop edi
pop esi
pop ebp
xor al, al
pop ebx
add esp, 0xc
ret
Function at 0x100be8e0
Capabilities:
Resolve dns

Disassembly:
sub esp, 0x34
mov eax, dword [0x101f3600]
xor eax, esp
mov dword [esp + 0x30], eax
cmp dword [esp + 0x38], 0
push ebx
mov ebx, dword [esp + 0x44]
push ebp
mov ebp, dword [esp + 0x44]
mov dword [esp + 0xc], ebx
je 0x100bea6a
test ebp, ebp
je 0x100bea9b
movzx eax, word [ebp + 0x20a]
push esi
push eax
push 0x10148540
lea eax, [esp + 0x3c]
push 8
push eax
call fcn.100a9560
mov eax, dword [ebp + 0x20c]
lea esi, [ebp + 4]
add esp, 0x10
mov dword [esp + 0x18], eax
lea eax, [esp + 0xc]
mov dword [esp + 0x1c], 1
xorps xmm0, xmm0
mov dword [esp + 0x14], 0
movlpd qword [esp + 0x24], xmm0
push eax
lea eax, [esp + 0x18]
movlpd qword [esp + 0x30], xmm0
push eax
lea eax, [esp + 0x3c]
mov dword [esp + 0x28], 0
push eax
push esi
call dword [sym.imp.WS2_32.dll_getaddrinfo]
test eax, eax
je 0x100be9a1
push esi
push 0x10148544
push 3
push 2
push ebx
call fcn.100aa440
add esp, 0x14
xor eax, eax
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x30]
xor ecx, esp
call fcn.100747a0
add esp, 0x34
ret
mov esi, dword [esp + 0xc]
push edi
test esi, esi
je 0x100bea32
nop
push dword [esi + 0xc]
push dword [esi + 8]
push dword [esi + 4]
call fcn.100e4740
mov ebx, eax
add esp, 0xc
test ebx, ebx
je 0x100be9fd
call fcn.100ad4a0
mov edi, eax
mov ecx, edx
imul eax, dword [esp + 0x48], 0x3e8
cdq
add edi, eax
adc ecx, edx
push ecx
push edi
push dword [esi + 0x10]
push dword [esi + 0x18]
push ebx
call fcn.100e4470
add esp, 0x14
test eax, eax
je 0x100bea08
push ebx
call fcn.100e45d0
add esp, 4
xor ebx, ebx
mov esi, dword [esi + 0x1c]
test esi, esi
jne 0x100be9b0
test ebx, ebx
je 0x100bea2e
push dword [esp + 0x10]
call dword [sym.imp.WS2_32.dll_freeaddrinfo]
push ebx
call fcn.100eb7f0
add esp, 4
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x30]
xor ecx, esp
call fcn.100747a0
add esp, 0x34
ret
mov ebx, dword [esp + 0x14]
lea eax, [ebp + 0x104]
push eax
push str.Failed_to_connect_to_target_host:__s
push 5
push 2
push ebx
call fcn.100aa440
add esp, 0x14
push dword [esp + 0x10]
call dword [sym.imp.WS2_32.dll_freeaddrinfo]
mov ecx, dword [esp + 0x40]
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.100747a0
add esp, 0x34
ret
push str.connecttimeoutms
push str.mongoc_client_connect_tcp
push 0x29b
push str.C:Usersprocr_vcpkg_buildtreesmongo_c_driver_src1.26.1_690bc2849a.clean_srclibmongoc_srcmongocmongoc_client.c
push str._s:_d__s__:_precondition_failed:__s_n
push 2
call fcn.1007a58f
add esp, 4
push eax
call fcn.100a1e70
add esp, 0x18
call fcn.1008069d
push str.host
push str.mongoc_client_connect_tcp
push 0x29c
push str.C:Usersprocr_vcpkg_buildtreesmongo_c_driver_src1.26.1_690bc2849a.clean_srclibmongoc_srcmongocmongoc_client.c
push str._s:_d__s__:_precondition_failed:__s_n
push 2
call fcn.1007a58f
add esp, 4
push eax
call fcn.100a1e70
add esp, 0x18
call fcn.1008069d
int3
Function at 0x100d66d0
Capabilities:
Hash data via bcrypt

Disassembly:
sub esp, 0x10
push ebx
push esi
mov esi, dword [esp + 0x1c]
lea eax, [esp + 0x10]
push 0
push eax
push 4
lea eax, [esp + 0x18]
mov dword [esp + 0x18], 0
push eax
push str.ObjectLength
push esi
mov dword [esp + 0x20], 0
xor bl, bl
mov dword [esp + 0x2c], 0
mov dword [esp + 0x28], 0
call sub.bcrypt.dll_BCryptGetProperty
test eax, eax
jns 0x100d6735
push eax
push str.BCryptGetProperty__:_OBJECT_LENGTH__ld
push str.mongoc
push 0
call fcn.100b0660
add esp, 0x10
xor al, al
pop esi
pop ebx
add esp, 0x10
ret
push 0
lea eax, [esp + 0x14]
push eax
push 4
lea eax, [esp + 0x20]
push eax
push str.HashDigestLength
push esi
call sub.bcrypt.dll_BCryptGetProperty
test eax, eax
jns 0x100d675a
push eax
push str.BCryptGetProperty__:_HASH_LENGTH__ld
jmp 0x100d671e
push edi
push dword [esp + 0x10]
call fcn.100a7a50
add esp, 4
mov edi, eax
lea eax, [esp + 0xc]
push 0
push dword [esp + 0x2c]
push dword [esp + 0x2c]
push dword [esp + 0x1c]
push edi
push eax
push esi
call sub.bcrypt.dll_BCryptCreateHash
test eax, eax
jns 0x100d679e
push eax
push str.BCryptCreateHash__:__ld
push str.mongoc
push 0
call fcn.100b0660
add esp, 0x10
jmp 0x100d67fc
push 0
push dword [esp + 0x34]
push dword [esp + 0x34]
push dword [esp + 0x18]
call sub.bcrypt.dll_BCryptHashData
test eax, eax
jns 0x100d67cc
push eax
push str.BCryptHashData__:__ld
push str.mongoc
push 0
call fcn.100b0660
add esp, 0x10
jmp 0x100d67fc
push 0
push dword [esp + 0x1c]
push dword [esp + 0x3c]
push dword [esp + 0x18]
call sub.bcrypt.dll_BCryptFinishHash
test eax, eax
jns 0x100d67fa
push eax
push str.BCryptFinishHash__:__ld
push str.mongoc
push 0
call fcn.100b0660
add esp, 0x10
jmp 0x100d67fc
mov bl, 1
mov ecx, dword [esp + 0xc]
test ecx, ecx
je 0x100d680a
push ecx
call sub.bcrypt.dll_BCryptDestroyHash
push edi
call fcn.100a7a40
add esp, 4
mov al, bl
pop edi
pop esi
pop ebx
add esp, 0x10
ret
Function at 0x100d9250
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x54
mov eax, dword [0x101f3600]
xor eax, esp
mov dword [esp + 0x50], eax
mov eax, dword [esp + 0x64]
mov ecx, dword [esp + 0x5c]
push ebx
push ebp
mov ebp, dword [esp + 0x60]
push esi
mov esi, dword [esp + 0x74]
push edi
mov edi, dword [esp + 0x70]
lea ebx, [ebp + 0xb0]
push esi
push eax
lea eax, [esp + 0x48]
mov dword [esp + 0x1c], ebp
push eax
mov dword [esp + 0x1c], ecx
call fcn.10076440
add esp, 0xc
cmp esi, 0x20
jae 0x100d943d
lea eax, [esi + 1]
mov byte [esp + esi + 0x40], 0
cmp eax, 0x20
jae 0x100d943d
mov byte [esp + eax + 0x40], 0
lea eax, [esi + 2]
cmp eax, 0x20
jae 0x100d943d
mov ecx, dword [ebp + 0x118]
mov edx, 0x20
mov byte [esp + eax + 0x40], 0
mov byte [esp + esi + 0x43], 1
test ecx, ecx
jne 0x100d92dc
lea eax, [ecx + 0x14]
jmp 0x100d92e4
xor eax, eax
cmp ecx, 1
cmove eax, edx
mov esi, dword [esp + 0x10]
add ebp, 0x110
push ebx
push eax
lea eax, [esp + 0x48]
mov dword [esp + 0x20], ebp
push eax
push edi
push esi
push ebp
call fcn.100feac0
mov ecx, dword [esp + 0x2c]
add esp, 0x18
mov ecx, dword [ecx + 0x118]
test ecx, ecx
jne 0x100d9317
lea eax, [ecx + 0x14]
jmp 0x100d9324
xor eax, eax
cmp ecx, 1
mov ecx, 0x20
cmove eax, ecx
push eax
lea eax, [esp + 0x24]
push ebx
push eax
call fcn.10076440
mov eax, dword [esp + 0x88]
add esp, 0xc
cmp eax, 2
jb 0x100d9415
dec eax
mov dword [esp + 0x1c], eax
nop dword [eax + eax]
mov eax, dword [esp + 0x14]
mov eax, dword [eax + 0x118]
test eax, eax
jne 0x100d9363
lea esi, [eax + 0x14]
jmp 0x100d9371
cmp eax, 1
jne 0x100d9428
mov esi, 0x20
mov ecx, dword [esp + 0x10]
mov eax, ebp
lea ebp, [esp + 0x20]
mov edx, edi
push ebp
mov ebx, esi
mov edi, ebp
push ebx
push edi
push edx
push ecx
push eax
call fcn.100feac0
mov ebx, dword [esp + 0x2c]
lea eax, [esp + esi + 0x37]
add ebx, 0xb0
add esp, 0x18
xor ecx, ecx
lea edx, [ebx - 1]
add edx, esi
cmp ebx, eax
ja 0x100d93ae
mov eax, ebp
cmp edx, eax
jae 0x100d93dc
mov edx, esi
lea edi, [esp + 0x20]
and edx, 0xfffffff8
mov eax, ebx
sub edi, ebx
nop dword [eax + eax]
movq xmm0, qword [eax]
lea eax, [eax + 8]
movq xmm1, qword [edi + eax - 8]
add ecx, 8
xorps xmm1, xmm0
movq qword [eax - 8], xmm1
cmp ecx, edx
jl 0x100d93c0
cmp ecx, esi
jge 0x100d93fe
lea edx, [esp + 0x20]
sub edx, ebx
lea eax, [ecx + ebx]
sub esi, ecx
nop dword [eax + eax]
mov cl, byte [edx + eax]
lea eax, [eax + 1]
xor byte [eax - 1], cl
sub esi, 1
jne 0x100d93f0
mov esi, dword [esp + 0x10]
mov edi, dword [esp + 0x70]
mov ebp, dword [esp + 0x18]
sub dword [esp + 0x1c], 1
jne 0x100d9350
mov ecx, dword [esp + 0x60]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.100747a0
add esp, 0x54
ret
lea eax, [esp + 0x20]
push eax
push 0
push eax
push edi
push esi
push ebp
call fcn.100feac0
add esp, 0x18
jmp 0x100d940a
call fcn.10074d0a
int3
Function at 0x100e3e90
Capabilities:
Set socket configuration

Disassembly:
push ecx
push esi
mov dword [esp + 4], 1
call fcn.10080fc3
push 4
mov dword [eax], 0
lea eax, [esp + 8]
push eax
push 1
push 6
push dword [esp + 0x1c]
call dword [sym.imp.WS2_32.dll_setsockopt]
mov esi, eax
cmp esi, 0xffffffff
jne 0x100e3edc
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push eax
push str.WSAGetLastError__:__d
push str.socket
push 2
call fcn.100b0660
add esp, 0x10
test esi, esi
pop esi
sete al
pop ecx
ret

Function at 0x100e3f10
Capabilities:
Send data
Send data on socket

Disassembly:
mov ecx, dword [esp + 4]
push edi
xor edi, edi
test ecx, ecx
je 0x100e3fdd
push ebp
mov ebp, dword [esp + 0x10]
test ebp, ebp
je 0x100e400e
push ebx
mov ebx, dword [esp + 0x18]
test ebx, ebx
je 0x100e403f
push esi
xor esi, esi
test ebx, ebx
je 0x100e3fd6
nop dword [eax]
nop dword [eax + eax]
mov eax, dword [ebp + esi*8]
cmp eax, 0x7fffffff
ja 0x100e4070
push 0
push eax
push dword [ebp + esi*8 + 4]
push dword [ecx]
call dword [sym.imp.WS2_32.dll_send]
cmp eax, 0xffffffff
je 0x100e3f95
add edi, eax
cdq
test edx, edx
jl 0x100e3fd6
jg 0x100e3f80
test eax, eax
jb 0x100e3fd6
cmp eax, dword [ebp + esi*8]
jne 0x100e3fd6
test edx, edx
jne 0x100e3fd6
inc esi
cmp esi, ebx
jae 0x100e3fd6
mov ecx, dword [esp + 0x14]
jmp 0x100e3f50
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov ebx, dword [esp + 0x14]
mov esi, eax
mov dword [ebx + 4], esi
call fcn.10080fc3
mov dword [eax], esi
mov eax, dword [ebx + 4]
cmp eax, 0xb
je 0x100e3fc9
cmp eax, 0x2733
je 0x100e3fc9
cmp eax, 0x2734
je 0x100e3fc9
pop esi
pop ebx
pop ebp
or eax, 0xffffffff
pop edi
ret
pop esi
or eax, 0xffffffff
test edi, edi
pop ebx
pop ebp
cmovne eax, edi
pop edi
ret
pop esi
pop ebx
pop ebp
mov eax, edi
pop edi
ret
push str.sock
push str._mongoc_socket_try_sendv_slow
push 0x4c4
push str.C:Usersprocr_vcpkg_buildtreesmongo_c_driver_src1.26.1_690bc2849a.clean_srclibmongoc_srcmongocmongoc_socket.c
push str._s:_d__s__:_precondition_failed:__s_n
push 2
call fcn.1007a58f
add esp, 4
push eax
call fcn.100a1e70
add esp, 0x18
call fcn.1008069d
push 0x1016e014
push str._mongoc_socket_try_sendv_slow
push 0x4c5
push str.C:Usersprocr_vcpkg_buildtreesmongo_c_driver_src1.26.1_690bc2849a.clean_srclibmongoc_srcmongocmongoc_socket.c
push str._s:_d__s__:_precondition_failed:__s_n
push 2
call fcn.1007a58f
add esp, 4
push eax
call fcn.100a1e70
add esp, 0x18
call fcn.1008069d
push str.iovcnt
push str._mongoc_socket_try_sendv_slow
push 0x4c6
push str.C:Usersprocr_vcpkg_buildtreesmongo_c_driver_src1.26.1_690bc2849a.clean_srclibmongoc_srcmongocmongoc_socket.c
push str._s:_d__s__:_precondition_failed:__s_n
push 2
call fcn.1007a58f
add esp, 4
push eax
call fcn.100a1e70
add esp, 0x18
call fcn.1008069d
push str.bson_in_range_unsigned__int__iov_i_.iov_len_
push str._mongoc_socket_try_sendv_slow
push 0x4ca
push str.C:Usersprocr_vcpkg_buildtreesmongo_c_driver_src1.26.1_690bc2849a.clean_srclibmongoc_srcmongocmongoc_socket.c
push str._s:_d__s__:_precondition_failed:__s_n
push 2
call fcn.1007a58f
add esp, 4
push eax
call fcn.100a1e70
add esp, 0x18
call fcn.1008069d
int3