joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100a0d10
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
mov ebx, ecx
push esi
push edi
mov dword [ebp - 8], ebx
cmp dword [ebx + 8], 0
jne 0x100a0d5a
mov edx, str.ERROR:
mov ecx, 0x100e6740
call fcn.10022690
mov edx, str.Internal_error:_VCDiffEngine::Encode___called_before_VCDiffEngine::Init__
mov ecx, eax
call fcn.10022690
push eax
call fcn.100953e0
add esp, 4
cmp byte [0x100e7a64], 0
je 0x100a0eba
jmp 0x100a0ec3
mov esi, dword [ebp + 0xc]
test esi, esi
je 0x100a0eba
cmp esi, 0x10
jae 0x100a0d8f
mov edi, dword [ebp + 0x14]
test esi, esi
je 0x100a0d7c
mov eax, dword [edi]
mov ecx, edi
push esi
push dword [ebp + 8]
call dword [eax + 0xc]
mov eax, dword [edi]
mov ecx, edi
push dword [ebp + 0x10]
call dword [eax + 0x1c]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
lea ecx, [ebp + 0xf]
call fcn.100a1010
push dword [ebx + 4]
mov ebx, dword [ebp + 8]
mov edx, esi
mov ecx, ebx
call fcn.100a5140
add esp, 4
mov dword [ebp + 0xc], eax
test eax, eax
jne 0x100a0de2
mov edx, str.ERROR:
mov ecx, 0x100e6740
call fcn.10022690
mov edx, str.Instantiation_of_target_hash_failed
mov ecx, eax
call fcn.10022690
push eax
call fcn.100953e0
add esp, 4
call fcn.10093560
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
lea eax, [ebx + esi]
mov ecx, ebx
mov dword [ebp - 4], eax
mov esi, ebx
mov edi, ebx
call fcn.100a1060
mov ebx, eax
mov edx, dword [ebp + 0xc]
push dword [ebp + 0x14]
mov ecx, dword [ebp - 4]
push edx
sub ecx, esi
push ecx
mov ecx, dword [ebp - 8]
push esi
push edi
push ebx
call fcn.100a10b0
mov ecx, dword [ebp - 4]
test eax, eax
je 0x100a0e38
add esi, eax
lea eax, [ecx - 0x10]
mov edi, esi
cmp esi, eax
ja 0x100a0e8d
mov ecx, esi
call fcn.100a1060
mov ecx, dword [ebp + 0xc]
mov ebx, eax
mov eax, esi
sub eax, dword [ebp + 8]
push eax
call fcn.100a5500
jmp 0x100a0df5
lea eax, [edi + 1]
add ecx, 0xfffffff0
mov dword [ebp - 0xc], eax
cmp eax, ecx
ja 0x100a0e8a
mov edx, dword [ebp + 0xc]
mov eax, edi
sub eax, dword [ebp + 8]
mov ecx, dword [edx + 0x34]
inc ecx
shl ecx, 4
cmp eax, ecx
jne 0x100a0e63
push ebx
mov ecx, edx
call fcn.100a5350
mov edx, dword [ebp + 0xc]
movzx ecx, byte [edi]
mov eax, dword [0x100e8b74]
mov eax, dword [eax + ecx*4]
add eax, ebx
imul ebx, eax, 0x101
movzx eax, byte [edi + 0x10]
mov edi, dword [ebp - 0xc]
add ebx, eax
and ebx, 0x7fffff
jmp 0x100a0df8
mov ecx, dword [ebp - 4]
mov ebx, dword [ebp + 0x14]
sub ecx, esi
je 0x100a0e9d
mov eax, dword [ebx]
push ecx
push esi
mov ecx, ebx
call dword [eax + 0xc]
mov eax, dword [ebx]
mov ecx, ebx
push dword [ebp + 0x10]
call dword [eax + 0x1c]
mov ebx, dword [ebp + 0xc]
mov ecx, ebx
call fcn.100a4e90
push ebx
call fcn.100ab5a9
add esp, 4
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
mov ecx, 0x100e6740
call fcn.10026780
push 1
call fcn.100af252
int3
Function at 0x100a0ee0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, ecx
push ebx
push esi
push edi
cmp dword [eax + 8], 0
mov dword [ebp - 4], eax
jne 0x100a0f28
mov edx, str.ERROR:
mov ecx, 0x100e6740
call fcn.10022690
mov edx, str.Internal_error:_VCDiffEngine::Encode___called_before_VCDiffEngine::Init__
mov ecx, eax
call fcn.10022690
push eax
call fcn.100953e0
add esp, 4
cmp byte [0x100e7a64], 0
je 0x100a0fc1
jmp 0x100a0ff7
mov edi, dword [ebp + 0xc]
test edi, edi
je 0x100a0fc1
cmp edi, 0x10
jae 0x100a0f5d
mov esi, dword [ebp + 0x14]
test edi, edi
je 0x100a0f4a
mov eax, dword [esi]
mov ecx, esi
push edi
push dword [ebp + 8]
call dword [eax + 0xc]
mov eax, dword [esi]
mov ecx, esi
push dword [ebp + 0x10]
call dword [eax + 0x1c]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
lea ecx, [ebp + 0xf]
call fcn.100a1010
mov esi, dword [ebp + 8]
lea eax, [esi + edi]
mov edi, esi
mov dword [ebp + 8], eax
mov ecx, esi
call fcn.100a1060
mov ebx, eax
lea esp, [esp]
push dword [ebp + 0x14]
push ecx
mov ecx, dword [ebp + 8]
sub ecx, esi
push ecx
mov ecx, dword [ebp - 4]
push esi
push edi
push ebx
call fcn.100a1140
mov ecx, dword [ebp + 8]
test eax, eax
je 0x100a0fca
add esi, eax
lea eax, [ecx - 0x10]
mov edi, esi
cmp esi, eax
jbe 0x100a0f70
mov ebx, dword [ebp + 0x14]
sub ecx, esi
je 0x100a0fb7
mov eax, dword [ebx]
push ecx
push esi
mov ecx, ebx
call dword [eax + 0xc]
mov eax, dword [ebx]
mov ecx, ebx
push dword [ebp + 0x10]
call dword [eax + 0x1c]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
lea edx, [edi + 1]
lea eax, [ecx - 0x10]
cmp edx, eax
ja 0x100a0fa7
movzx ecx, byte [edi]
mov eax, dword [0x100e8b74]
mov eax, dword [eax + ecx*4]
add eax, ebx
imul ebx, eax, 0x101
movzx eax, byte [edi + 0x10]
mov edi, edx
add ebx, eax
and ebx, 0x7fffff
jmp 0x100a0f80
mov ecx, 0x100e6740
call fcn.10026780
push 1
call fcn.100af252
int3

Function at 0x100a1010
Capabilities:
Terminate process

Disassembly:
cmp dword [0x100e8b74], 0
push esi
mov esi, ecx
jne 0x100a1049
mov edx, str.ERROR:
mov ecx, 0x100e6740
call fcn.10022690
mov edx, str.RollingHash_object_instantiated_before_calling_RollingHash::Init__
mov ecx, eax
call fcn.10022690
push eax
call fcn.100953e0
add esp, 4
cmp byte [0x100e7a64], 0
jne 0x100a104d
mov eax, esi
pop esi
ret
mov ecx, 0x100e6740
call fcn.10026780
push 1
call fcn.100af252
int3
Function at 0x100a19a0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x14
mov eax, dword [0x10001840]
xor eax, esp
mov dword [esp + 0x10], eax
push ebx
push esi
push edi
mov edi, ecx
cmp dword [edi + 0x88], 0
jne 0x100a19f8
mov edx, str.ERROR:
mov ecx, 0x100e6740
call fcn.10022690
mov edx, str.VCDiffCodeTableWriter::Copy___called_without_calling_Init__
mov ecx, eax
call fcn.10022690
push eax
call fcn.100953e0
add esp, 4
cmp byte [0x100e7a64], 0
je 0x100a1a7c
jmp 0x100a1a90
lea eax, [esp + 0x10]
mov dword [esp + 0x10], 0
push eax
mov eax, dword [edi + 0x7c]
lea ecx, [edi + 0x58]
add eax, dword [edi + 0x80]
push eax
push dword [ebp + 8]
call fcn.1009f9a0
mov bl, al
mov ecx, edi
mov byte [esp + 0x14], bl
push dword [esp + 0x14]
push dword [ebp + 0xc]
push 3
call fcn.100a16a0
mov cl, byte [edi + 0x58]
mov al, cl
add al, 2
cmp bl, al
jb 0x100a1a54
mov al, byte [edi + 0x5c]
inc al
add al, cl
cmp bl, al
ja 0x100a1a54
push dword [esp + 0x10]
mov ecx, dword [edi + 0x3c]
call fcn.10080220
jmp 0x100a1a73
mov ecx, dword [esp + 0x10]
lea edx, [esp + 0x14]
mov esi, dword [edi + 0x3c]
call fcn.100a4b60
lea edx, [esp + 0x19]
mov ecx, esi
push eax
sub edx, eax
push edx
call fcn.100278f0
mov eax, dword [ebp + 0xc]
add dword [edi + 0x80], eax
mov ecx, dword [esp + 0x1c]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.100acf3e
mov esp, ebp
pop ebp
ret 8
mov ecx, 0x100e6740
call fcn.10026780
push 1
call fcn.100af252
int3
Function at 0x100a1ee0
Capabilities:
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
test edx, edx
jne 0x100a1eeb
xor eax, eax
pop ebp
ret
pop ebp
jmp fcn.100a1f00
Function at 0x100a4af0
Capabilities:
Terminate process

Disassembly:
push ecx
test ecx, ecx
jns 0x100a4b3e
push ecx
push ecx
mov edx, str.ERROR:
mov ecx, 0x100e6740
call fcn.10022690
mov edx, str.Negative_value
mov ecx, eax
call fcn.10022690
add esp, 4
mov ecx, eax
call fcn.10050180
mov edx, str._passed_to_VarintBE::Length__which_requires_non_negative_argument
mov ecx, eax
call fcn.10022690
push eax
call fcn.100953e0
add esp, 4
cmp byte [0x100e7a64], 0
jne 0x100a4b4a
xor eax, eax
pop ecx
ret
xor eax, eax
sar ecx, 7
inc eax
test ecx, ecx
jne 0x100a4b40
pop ecx
ret
mov ecx, 0x100e6740
call fcn.10026780
push 1
call fcn.100af252
int3

Function at 0x100a4b60
Capabilities:
Terminate process

Disassembly:
push ecx
push esi
push edi
test ecx, ecx
jns 0x100a4bb2
push ecx
push ecx
mov edx, str.ERROR:
mov ecx, 0x100e6740
call fcn.10022690
mov edx, str.Negative_value
mov ecx, eax
call fcn.10022690
add esp, 4
mov ecx, eax
call fcn.10050180
mov edx, str._passed_to_VarintBE::EncodeInternal__which_requires_non_negative_argument
mov ecx, eax
call fcn.10022690
push eax
call fcn.100953e0
add esp, 4
cmp byte [0x100e7a64], 0
jne 0x100a4be1
xor eax, eax
pop edi
pop esi
pop ecx
ret
mov al, cl
lea esi, [edx + 4]
and al, 0x7f
sar ecx, 7
mov byte [esi], al
mov edi, 1
dec esi
test ecx, ecx
je 0x100a4bdb
mov dl, cl
lea esi, [esi - 1]
or dl, 0x80
sar ecx, 7
inc edi
mov byte [esi + 1], dl
test ecx, ecx
jne 0x100a4bc8
mov eax, edi
pop edi
pop esi
pop ecx
ret
mov ecx, 0x100e6740
call fcn.10026780
push 1
call fcn.100af252
int3

Function at 0x100a4c90
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
push esi
test eax, eax
jg 0x100a4ced
jl 0x100a4ca5
test edx, edx
jae 0x100a4ced
push eax
push edx
mov edx, str.ERROR:
mov ecx, 0x100e6740
call fcn.10022690
mov edx, str.Negative_value
mov ecx, eax
call fcn.10022690
mov ecx, eax
call fcn.100a0a50
mov edx, str._passed_to_VarintBE::Length__which_requires_non_negative_argument
mov ecx, eax
call fcn.10022690
push eax
call fcn.100953e0
add esp, 4
cmp byte [0x100e7a64], 0
jne 0x100a4d04
xor eax, eax
pop esi
pop ecx
pop ebp
ret
xor esi, esi
nop
shrd edx, eax, 7
inc esi
sar eax, 7
mov ecx, edx
or ecx, eax
jne 0x100a4cf0
mov eax, esi
pop esi
pop ecx
pop ebp
ret
mov ecx, 0x100e6740
call fcn.10026780
push 1
call fcn.100af252
int3
Function at 0x100a4d20
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
push esi
push edi
test eax, eax
jg 0x100a4d7d
jl 0x100a4d35
test edx, edx
jae 0x100a4d7d
push eax
push edx
mov edx, str.ERROR:
mov ecx, 0x100e6740
call fcn.10022690
mov edx, str.Negative_value
mov ecx, eax
call fcn.10022690
mov ecx, eax
call fcn.100a0a50
mov edx, str._passed_to_VarintBE::EncodeInternal__which_requires_non_negative_argument
mov ecx, eax
call fcn.10022690
push eax
call fcn.100953e0
add esp, 4
cmp byte [0x100e7a64], 0
jne 0x100a4dbf
xor eax, eax
pop edi
pop esi
pop ebp
ret
lea esi, [ecx + 8]
mov edi, 1
mov cl, dl
and cl, 0x7f
shrd edx, eax, 7
mov byte [esi], cl
dec esi
sar eax, 7
mov ecx, edx
or ecx, eax
je 0x100a4db9
lea ebx, [ebx]
mov cl, dl
lea esi, [esi - 1]
or cl, 0x80
inc edi
shrd edx, eax, 7
mov byte [esi + 1], cl
sar eax, 7
mov ecx, edx
or ecx, eax
jne 0x100a4da0
mov eax, edi
pop edi
pop esi
pop ebp
ret
mov ecx, 0x100e6740
call fcn.10026780
push 1
call fcn.100af252
int3

Function at 0x100a4de0
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100e4a51
mov eax, dword fs:[0]
push eax
push ecx
mov eax, dword [0x10001840]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], ecx
mov eax, dword [ebp + 8]
mov dword [ecx], eax
mov eax, dword [ebp + 0xc]
mov dword [ecx + 4], eax
mov dword [ecx + 8], 0
mov dword [ecx + 0xc], 0
mov dword [ecx + 0x10], 0
mov dword [ebp - 4], 0
mov dword [ecx + 0x14], 0
mov dword [ecx + 0x18], 0
mov dword [ecx + 0x1c], 0
mov byte [ebp - 4], 1
mov dword [ecx + 0x20], 0
mov dword [ecx + 0x24], 0
mov dword [ecx + 0x28], 0
mov byte [ebp - 4], 2
mov eax, dword [ebp + 0x10]
mov dword [ecx + 0x2c], 0
mov dword [ecx + 0x30], eax
mov dword [ecx + 0x34], 0xffffffff
mov dword [ebp - 4], 0xffffffff
mov eax, ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x100a4f50
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
mov esi, ecx
push edi
mov eax, dword [esi + 8]
cmp eax, dword [esi + 0xc]
jne 0x100a5038
mov eax, dword [esi + 0x14]
cmp eax, dword [esi + 0x18]
jne 0x100a5038
mov eax, dword [esi + 0x20]
cmp eax, dword [esi + 0x24]
jne 0x100a5038
mov ecx, dword [esi + 4]
call fcn.100a5200
mov ecx, eax
test ecx, ecx
jne 0x100a4fcf
push dword [esi + 4]
mov edx, str.ERROR:
push ecx
mov ecx, 0x100e6740
call fcn.10022690
mov edx, str.Error_finding_table_size_for_source_size
mov ecx, eax
call fcn.10022690
add esp, 4
mov ecx, eax
call fcn.10049220
push eax
call fcn.100953e0
add esp, 4
call fcn.10093560
xor al, al
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
lea eax, [ecx - 1]
mov dword [ebp - 4], 0xffffffff
mov dword [esi + 0x2c], eax
lea eax, [ebp - 4]
push eax
push ecx
lea ecx, [esi + 8]
call fcn.100a5860
lea eax, [ebp - 4]
mov dword [ebp - 4], 0xffffffff
push eax
mov eax, dword [esi + 4]
lea ecx, [esi + 0x14]
shr eax, 4
push eax
call fcn.100a5860
lea eax, [ebp - 4]
mov dword [ebp - 4], 0xffffffff
push eax
mov eax, dword [esi + 4]
lea ecx, [esi + 0x20]
shr eax, 4
push eax
call fcn.100a5860
cmp byte [ebp + 8], 0
je 0x100a502d
push dword [esi + 4]
mov ecx, esi
call fcn.100a5500
pop edi
pop esi
mov al, 1
pop ebx
mov esp, ebp
pop ebp
ret 4
mov edx, str.ERROR:
mov ecx, 0x100e6740
call fcn.10022690
mov edx, str.Init___called_twice_for_same_BlockHash_object
mov ecx, eax
call fcn.10022690
push eax
call fcn.100953e0
add esp, 4
cmp byte [0x100e7a64], 0
je 0x100a4fc4
mov ecx, 0x100e6740
call fcn.10026780
push 1
call fcn.100af252
int3
Function at 0x100a5200
Capabilities:
Terminate process

Disassembly:
push esi
mov esi, ecx
mov eax, 1
mov edx, esi
shr edx, 2
inc edx
cmp edx, eax
jbe 0x100a521a
add eax, eax
je 0x100a526b
cmp eax, edx
jb 0x100a5212
lea ecx, [eax - 1]
test eax, ecx
je 0x100a52ca
push eax
push ecx
push esi
push ecx
mov edx, str.ERROR:
mov ecx, 0x100e6740
call fcn.10022690
mov edx, str.Internal_error:_CalcTableSize_dictionary_size_
mov ecx, eax
call fcn.10022690
add esp, 4
mov ecx, eax
call fcn.10049220
mov edx, str._:_resulting_table_size
mov ecx, eax
call fcn.10022690
add esp, 4
mov ecx, eax
call fcn.10049220
mov edx, str._is_not_a_power_of_2
jmp 0x100a52af
push eax
push ecx
push esi
push ecx
mov edx, str.ERROR:
mov ecx, 0x100e6740
call fcn.10022690
mov edx, str.Internal_error:_CalcTableSize_dictionary_size_
mov ecx, eax
call fcn.10022690
add esp, 4
mov ecx, eax
call fcn.10049220
mov edx, str._:_resulting_table_size
mov ecx, eax
call fcn.10022690
add esp, 4
mov ecx, eax
call fcn.10049220
mov edx, str._is_zero_or_negative
mov ecx, eax
call fcn.10022690
push eax
call fcn.100953e0
add esp, 4
cmp byte [0x100e7a64], 0
je 0x100a532e
jmp 0x100a5332
test esi, esi
je 0x100a5330
lea ecx, [edx + edx]
cmp eax, ecx
jbe 0x100a5330
push eax
push ecx
push esi
push ecx
mov edx, str.ERROR:
mov ecx, 0x100e6740
call fcn.10022690
mov edx, str.Internal_error:_CalcTableSize_dictionary_size_
mov ecx, eax
call fcn.10022690
add esp, 4
mov ecx, eax
call fcn.10049220
mov edx, str._:_resulting_table_size
mov ecx, eax
call fcn.10022690
add esp, 4
mov ecx, eax
call fcn.10049220
mov edx, str._is_too_large
mov ecx, eax
call fcn.10022690
push eax
call fcn.100953e0
add esp, 4
call fcn.10093560
xor eax, eax
pop esi
ret
mov ecx, 0x100e6740
call fcn.10026780
push 1
call fcn.100af252
int3
Function at 0x100a5350
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
mov edx, ecx
push ebx
push esi
push edi
mov eax, dword [edx + 8]
cmp eax, dword [edx + 0xc]
jne 0x100a5396
mov edx, str.ERROR:
mov ecx, 0x100e6740
call fcn.10022690
mov edx, str.BlockHash::AddBlock___called_before_BlockHash::Init__
mov ecx, eax
call fcn.10022690
push eax
call fcn.100953e0
add esp, 4
cmp byte [0x100e7a64], 0
je 0x100a54e0
jmp 0x100a54e7
mov esi, dword [edx + 0x34]
mov eax, dword [edx + 4]
inc esi
shr eax, 4
cmp esi, eax
jl 0x100a53e6
dec eax
mov edx, str.ERROR:
push eax
push ecx
push esi
push ecx
mov ecx, 0x100e6740
call fcn.10022690
mov edx, str.BlockHash::AddBlock___called_with_block_number
mov ecx, eax
call fcn.10022690
add esp, 4
mov ecx, eax
call fcn.10050180
mov edx, str._that_is_past_last_block
mov ecx, eax
call fcn.10022690
add esp, 4
mov ecx, eax
call fcn.10050180
jmp 0x100a537b
mov edi, dword [edx + 0x14]
cmp dword [edi + esi*4], 0xffffffff
lea eax, [edi + esi*4]
je 0x100a5437
push dword [eax]
mov edx, str.ERROR:
push ecx
push esi
push ecx
mov ecx, 0x100e6740
call fcn.10022690
mov edx, str.Internal_error_in_BlockHash::AddBlock__:_block_number_
mov ecx, eax
call fcn.10022690
add esp, 4
mov ecx, eax
call fcn.10050180
mov edx, str.__next_block_should_be__1_but_is
mov ecx, eax
call fcn.10022690
add esp, 4
mov ecx, eax
call fcn.10050180
jmp 0x100a537b
mov ecx, dword [edx + 0x2c]
and ecx, dword [ebp + 8]
mov eax, dword [edx + 8]
mov ebx, dword [eax + ecx*4]
test ebx, ebx
jns 0x100a545a
mov dword [eax + ecx*4], esi
mov eax, dword [edx + 0x20]
mov dword [eax + esi*4], esi
mov dword [edx + 0x34], esi
pop edi
pop esi
pop ebx
pop ebp
ret 4
mov eax, dword [edx + 0x20]
mov eax, dword [eax + ebx*4]
cmp dword [edi + eax*4], 0xffffffff
je 0x100a54d4
push dword [edi + eax*4]
mov edx, str.ERROR:
push ecx
push eax
push ecx
push ebx
push ecx
mov ecx, 0x100e6740
call fcn.10022690
mov edx, str.Internal_error_in_BlockHash::AddBlock__:_first_matching_block_
mov ecx, eax
call fcn.10022690
add esp, 4
mov ecx, eax
call fcn.10050180
mov edx, str.__last_matching_block_
mov ecx, eax
call fcn.10022690
add esp, 4
mov ecx, eax
call fcn.10050180
mov edx, str.__next_block_should_be__1_but_is
mov ecx, eax
call fcn.10022690
add esp, 4
mov ecx, eax
call fcn.10050180
push eax
call fcn.100953e0
add esp, 4
call fcn.10093560
pop edi
pop esi
pop ebx
pop ebp
ret 4
mov dword [edi + eax*4], esi
mov eax, dword [edx + 0x20]
mov dword [eax + ebx*4], esi
mov dword [edx + 0x34], esi
pop edi
pop esi
pop ebx
pop ebp
ret 4
mov ecx, 0x100e6740
call fcn.10026780
push 1
call fcn.100af252
int3
Function at 0x100a5500
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, ecx
mov ecx, dword [ebp + 8]
mov eax, dword [edi + 4]
cmp ecx, eax
jle 0x100a556c
push eax
push ecx
push ecx
push ecx
mov edx, str.ERROR:
mov ecx, 0x100e6740
call fcn.10022690
mov edx, str.BlockHash::AddAllBlocksThroughIndex___called_with_index
mov ecx, eax
call fcn.10022690
add esp, 4
mov ecx, eax
call fcn.10050180
mov edx, str._higher_than_end_index
mov ecx, eax
call fcn.10022690
add esp, 4
mov ecx, eax
call fcn.10049220
push eax
call fcn.100953e0
add esp, 4
cmp byte [0x100e7a64], 0
je 0x100a55f6
jmp 0x100a55fd
mov edx, dword [edi + 0x34]
shl edx, 4
cmp ecx, edx
jg 0x100a55c3
push edx
push ecx
push ecx
push ecx
mov edx, str.ERROR:
mov ecx, 0x100e6740
call fcn.10022690
mov edx, str.BlockHash::AddAllBlocksThroughIndex___called_with_index
mov ecx, eax
call fcn.10022690
add esp, 4
mov ecx, eax
call fcn.10050180
mov edx, str.___last_index_added__
mov ecx, eax
call fcn.10022690
add esp, 4
mov ecx, eax
call fcn.10050180
mov edx, 0x100fdcc8
mov ecx, eax
call fcn.10022690
jmp 0x100a5551
cmp eax, 0x10
jb 0x100a55f6
add eax, 0xfffffff0
cmp ecx, eax
jle 0x100a55d2
lea ecx, [eax + 1]
mov eax, dword [edi]
lea esi, [eax + 0x10]
lea ebx, [eax + ecx]
add esi, edx
cmp esi, ebx
jae 0x100a55f6
mov ecx, esi
call fcn.100a1060
push eax
mov ecx, edi
call fcn.100a5350
add esi, 0x10
cmp esi, ebx
jb 0x100a55e0
pop edi
pop esi
pop ebx
pop ebp
ret 4
mov ecx, 0x100e6740
call fcn.10026780
push 1
call fcn.100af252
int3

Function at 0x100a5690
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ecx + 4]
mov edx, dword [ebp + 8]
shr eax, 4
cmp edx, eax
jb 0x100a56e0
push edx
push ecx
mov edx, str.ERROR:
mov ecx, 0x100e6740
call fcn.10022690
mov edx, str.NextMatchingBlock_called_for_invalid_block_number
mov ecx, eax
call fcn.10022690
add esp, 4
mov ecx, eax
call fcn.10050180
push eax
call fcn.100953e0
add esp, 4
cmp byte [0x100e7a64], 0
jne 0x100a56f2
or eax, 0xffffffff
pop ebp
ret 8
mov eax, dword [ecx + 0x14]
push dword [ebp + 0xc]
push dword [eax + edx*4]
call fcn.100a5610
pop ebp
ret 8
mov ecx, 0x100e6740
call fcn.10026780
push 1
call fcn.100af252
int3
Function at 0x100a6140
Capabilities:
Encode data using xor
Encrypt data using rc4 ksa
Manually build aes constants

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov eax, 0x100e8540
mov word [0x100e8a40], 0
push esi
dec eax
mov word [0x100e8540], 0x301
push edi
mov edi, 0x100e8540
mov byte [0x100e8a43], 1
mov ebx, 2
sub edi, eax
lea esi, [eax + 2]
mov cl, byte [esi]
lea esi, [esi + 1]
mov dl, cl
mov al, cl
and dl, 0x80
neg dl
sbb dl, dl
add al, al
xor al, cl
and dl, 0x1b
xor al, dl
mov byte [edi + esi - 1], al
movzx eax, al
mov byte [eax + 0x100e8a40], bl
inc ebx
cmp ebx, 0x100
jl 0x100a6175
mov byte [0x100e82c0], 0x63
mov ebx, 1
mov byte [0x100e8423], 0
jmp 0x100a61c0
movzx eax, bl
mov ecx, 0x100e863f
movzx eax, byte [eax + 0x100e8a40]
sub ecx, eax
mov cl, byte [ecx]
mov dl, cl
rol dl, 1
xor cl, dl
rol dl, 1
xor cl, dl
rol dl, 1
mov al, dl
rol al, 1
xor al, cl
xor al, dl
xor al, 0x63
mov byte [ebx + 0x100e82c0], al
movzx eax, al
mov byte [eax + 0x100e83c0], bl
inc ebx
cmp ebx, 0x100
jl 0x100a61c0
mov al, 1
mov edx, 0x100e84c0
movzx ecx, al
mov dword [edx], ecx
mov cl, al
and cl, 0x80
neg cl
sbb cl, cl
add al, al
and cl, 0x1b
add edx, 4
xor al, cl
cmp edx, 0x100e8538
jl 0x100a6208
mov ecx, dword [0x100031bc]
xor esi, esi
mov edi, 0xff
mov ah, byte [esi + 0x100e82c0]
mov bl, ah
mov bh, ah
and bl, 0x80
mov al, bl
neg al
sbb al, al
add bh, bh
and al, 0x1b
mov dl, bh
xor dl, al
xor dl, ah
neg bl
movzx edx, dl
sbb bl, bl
movzx eax, ah
shl edx, 8
and bl, 0x1b
or edx, eax
xor bh, bl
mov bl, byte [esi + 0x100e83c0]
shl edx, 8
or edx, eax
movzx eax, bh
shl edx, 8
or edx, eax
mov dword [esi*4 + 0x100e8640], edx
test cl, cl
je 0x100a62ac
test bl, bl
je 0x100a62ac
movzx eax, cl
movzx edx, bl
movzx eax, byte [eax + 0x100e8a40]
movzx edx, byte [edx + 0x100e8a40]
add eax, edx
cdq
idiv edi
mov al, byte [edx + 0x100e8540]
mov byte [ebp - 1], al
jmp 0x100a62b0
mov byte [ebp - 1], 0
test ch, ch
je 0x100a62dc
test bl, bl
je 0x100a62dc
movzx eax, ch
movzx edx, bl
movzx eax, byte [eax + 0x100e8a40]
movzx edx, byte [edx + 0x100e8a40]
add eax, edx
cdq
idiv edi
mov al, byte [edx + 0x100e8540]
mov byte [ebp - 2], al
jmp 0x100a62e0
mov byte [ebp - 2], 0
mov al, byte [0x100031be]
test al, al
je 0x100a630e
test bl, bl
je 0x100a630e
movzx eax, al
movzx edx, bl
movzx eax, byte [eax + 0x100e8a40]
movzx edx, byte [edx + 0x100e8a40]
add eax, edx
cdq
idiv edi
mov bh, byte [edx + 0x100e8540]
jmp 0x100a6310
xor bh, bh
mov al, byte [0x100031bf]
test al, al
je 0x100a633e
test bl, bl
je 0x100a633e
movzx eax, al
movzx edx, bl
movzx eax, byte [eax + 0x100e8a40]
movzx edx, byte [edx + 0x100e8a40]
add eax, edx
cdq
idiv edi
mov bl, byte [edx + 0x100e8540]
jmp 0x100a6340
xor bl, bl
movzx edx, byte [ebp - 1]
movzx eax, byte [ebp - 2]
shl edx, 8
or edx, eax
movzx eax, bh
shl edx, 8
or edx, eax
movzx eax, bl
shl edx, 8
or edx, eax
mov dword [esi*4 + 0x100e7ec0], edx
inc esi
cmp esi, 0x100
jl 0x100a6235
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret