joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100a0730
Capabilities:
Terminate process

Disassembly:
push esi
mov esi, ecx
cmp dword [esi + 8], 0
je 0x100a076a
mov edx, str.ERROR:
mov ecx, 0x100e6780
call fcn.100200d0
mov edx, str.Init___called_twice_for_same_VCDiffEngine_object
mov ecx, eax
call fcn.100200d0
push eax
call fcn.10094e10
add esp, 4
cmp byte [0x100e7ab4], 0
jne 0x100a079a
xor al, al
pop esi
ret
mov edx, dword [esi + 4]
mov ecx, dword [esi]
call fcn.100a4b90
mov dword [esi + 8], eax
test eax, eax
jne 0x100a0791
mov edx, str.ERROR:
mov ecx, 0x100e6780
call fcn.100200d0
mov edx, str.Creation_of_dictionary_hash_failed
jmp 0x100a074d
call fcn.100a07b0
mov al, 1
pop esi
ret
mov ecx, 0x100e6780
call fcn.100239b0
push 1
call fcn.100aecb2
int3
Function at 0x100a0820
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
mov ebx, ecx
push esi
push edi
mov dword [ebp - 8], ebx
cmp dword [ebx + 8], 0
jne 0x100a086a
mov edx, str.ERROR:
mov ecx, 0x100e6780
call fcn.100200d0
mov edx, str.Internal_error:_VCDiffEngine::Encode___called_before_VCDiffEngine::Init__
mov ecx, eax
call fcn.100200d0
push eax
call fcn.10094e10
add esp, 4
cmp byte [0x100e7ab4], 0
je 0x100a09ca
jmp 0x100a09d3
mov esi, dword [ebp + 0xc]
test esi, esi
je 0x100a09ca
cmp esi, 0x10
jae 0x100a089f
mov edi, dword [ebp + 0x14]
test esi, esi
je 0x100a088c
mov eax, dword [edi]
mov ecx, edi
push esi
push dword [ebp + 8]
call dword [eax + 0xc]
mov eax, dword [edi]
mov ecx, edi
push dword [ebp + 0x10]
call dword [eax + 0x1c]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
lea ecx, [ebp + 0xf]
call fcn.100a0b20
push dword [ebx + 4]
mov ebx, dword [ebp + 8]
mov edx, esi
mov ecx, ebx
call fcn.100a4c50
add esp, 4
mov dword [ebp + 0xc], eax
test eax, eax
jne 0x100a08f2
mov edx, str.ERROR:
mov ecx, 0x100e6780
call fcn.100200d0
mov edx, str.Instantiation_of_target_hash_failed
mov ecx, eax
call fcn.100200d0
push eax
call fcn.10094e10
add esp, 4
call fcn.10092f90
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
lea eax, [ebx + esi]
mov ecx, ebx
mov dword [ebp - 4], eax
mov esi, ebx
mov edi, ebx
call fcn.100a0b70
mov ebx, eax
mov edx, dword [ebp + 0xc]
push dword [ebp + 0x14]
mov ecx, dword [ebp - 4]
push edx
sub ecx, esi
push ecx
mov ecx, dword [ebp - 8]
push esi
push edi
push ebx
call fcn.100a0bc0
mov ecx, dword [ebp - 4]
test eax, eax
je 0x100a0948
add esi, eax
lea eax, [ecx - 0x10]
mov edi, esi
cmp esi, eax
ja 0x100a099d
mov ecx, esi
call fcn.100a0b70
mov ecx, dword [ebp + 0xc]
mov ebx, eax
mov eax, esi
sub eax, dword [ebp + 8]
push eax
call fcn.100a5010
jmp 0x100a0905
lea eax, [edi + 1]
add ecx, 0xfffffff0
mov dword [ebp - 0xc], eax
cmp eax, ecx
ja 0x100a099a
mov edx, dword [ebp + 0xc]
mov eax, edi
sub eax, dword [ebp + 8]
mov ecx, dword [edx + 0x34]
inc ecx
shl ecx, 4
cmp eax, ecx
jne 0x100a0973
push ebx
mov ecx, edx
call fcn.100a4e60
mov edx, dword [ebp + 0xc]
movzx ecx, byte [edi]
mov eax, dword [0x100e8bc4]
mov eax, dword [eax + ecx*4]
add eax, ebx
imul ebx, eax, 0x101
movzx eax, byte [edi + 0x10]
mov edi, dword [ebp - 0xc]
add ebx, eax
and ebx, 0x7fffff
jmp 0x100a0908
mov ecx, dword [ebp - 4]
mov ebx, dword [ebp + 0x14]
sub ecx, esi
je 0x100a09ad
mov eax, dword [ebx]
push ecx
push esi
mov ecx, ebx
call dword [eax + 0xc]
mov eax, dword [ebx]
mov ecx, ebx
push dword [ebp + 0x10]
call dword [eax + 0x1c]
mov ebx, dword [ebp + 0xc]
mov ecx, ebx
call fcn.100a49a0
push ebx
call fcn.100ab003
add esp, 4
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
mov ecx, 0x100e6780
call fcn.100239b0
push 1
call fcn.100aecb2
int3
Function at 0x100a09f0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, ecx
push ebx
push esi
push edi
cmp dword [eax + 8], 0
mov dword [ebp - 4], eax
jne 0x100a0a38
mov edx, str.ERROR:
mov ecx, 0x100e6780
call fcn.100200d0
mov edx, str.Internal_error:_VCDiffEngine::Encode___called_before_VCDiffEngine::Init__
mov ecx, eax
call fcn.100200d0
push eax
call fcn.10094e10
add esp, 4
cmp byte [0x100e7ab4], 0
je 0x100a0ad1
jmp 0x100a0b07
mov edi, dword [ebp + 0xc]
test edi, edi
je 0x100a0ad1
cmp edi, 0x10
jae 0x100a0a6d
mov esi, dword [ebp + 0x14]
test edi, edi
je 0x100a0a5a
mov eax, dword [esi]
mov ecx, esi
push edi
push dword [ebp + 8]
call dword [eax + 0xc]
mov eax, dword [esi]
mov ecx, esi
push dword [ebp + 0x10]
call dword [eax + 0x1c]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
lea ecx, [ebp + 0xf]
call fcn.100a0b20
mov esi, dword [ebp + 8]
lea eax, [esi + edi]
mov edi, esi
mov dword [ebp + 8], eax
mov ecx, esi
call fcn.100a0b70
mov ebx, eax
lea esp, [esp]
push dword [ebp + 0x14]
push ecx
mov ecx, dword [ebp + 8]
sub ecx, esi
push ecx
mov ecx, dword [ebp - 4]
push esi
push edi
push ebx
call fcn.100a0c50
mov ecx, dword [ebp + 8]
test eax, eax
je 0x100a0ada
add esi, eax
lea eax, [ecx - 0x10]
mov edi, esi
cmp esi, eax
jbe 0x100a0a80
mov ebx, dword [ebp + 0x14]
sub ecx, esi
je 0x100a0ac7
mov eax, dword [ebx]
push ecx
push esi
mov ecx, ebx
call dword [eax + 0xc]
mov eax, dword [ebx]
mov ecx, ebx
push dword [ebp + 0x10]
call dword [eax + 0x1c]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
lea edx, [edi + 1]
lea eax, [ecx - 0x10]
cmp edx, eax
ja 0x100a0ab7
movzx ecx, byte [edi]
mov eax, dword [0x100e8bc4]
mov eax, dword [eax + ecx*4]
add eax, ebx
imul ebx, eax, 0x101
movzx eax, byte [edi + 0x10]
mov edi, edx
add ebx, eax
and ebx, 0x7fffff
jmp 0x100a0a90
mov ecx, 0x100e6780
call fcn.100239b0
push 1
call fcn.100aecb2
int3

Function at 0x100a0b20
Capabilities:
Terminate process

Disassembly:
cmp dword [0x100e8bc4], 0
push esi
mov esi, ecx
jne 0x100a0b59
mov edx, str.ERROR:
mov ecx, 0x100e6780
call fcn.100200d0
mov edx, str.RollingHash_object_instantiated_before_calling_RollingHash::Init__
mov ecx, eax
call fcn.100200d0
push eax
call fcn.10094e10
add esp, 4
cmp byte [0x100e7ab4], 0
jne 0x100a0b5d
mov eax, esi
pop esi
ret
mov ecx, 0x100e6780
call fcn.100239b0
push 1
call fcn.100aecb2
int3
Function at 0x100a14b0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x14
mov eax, dword [0x10001840]
xor eax, esp
mov dword [esp + 0x10], eax
push ebx
push esi
push edi
mov edi, ecx
cmp dword [edi + 0x88], 0
jne 0x100a1508
mov edx, str.ERROR:
mov ecx, 0x100e6780
call fcn.100200d0
mov edx, str.VCDiffCodeTableWriter::Copy___called_without_calling_Init__
mov ecx, eax
call fcn.100200d0
push eax
call fcn.10094e10
add esp, 4
cmp byte [0x100e7ab4], 0
je 0x100a158c
jmp 0x100a15a0
lea eax, [esp + 0x10]
mov dword [esp + 0x10], 0
push eax
mov eax, dword [edi + 0x7c]
lea ecx, [edi + 0x58]
add eax, dword [edi + 0x80]
push eax
push dword [ebp + 8]
call fcn.1009f4b0
mov bl, al
mov ecx, edi
mov byte [esp + 0x14], bl
push dword [esp + 0x14]
push dword [ebp + 0xc]
push 3
call fcn.100a11b0
mov cl, byte [edi + 0x58]
mov al, cl
add al, 2
cmp bl, al
jb 0x100a1564
mov al, byte [edi + 0x5c]
inc al
add al, cl
cmp bl, al
ja 0x100a1564
push dword [esp + 0x10]
mov ecx, dword [edi + 0x3c]
call fcn.10080040
jmp 0x100a1583
mov ecx, dword [esp + 0x10]
lea edx, [esp + 0x14]
mov esi, dword [edi + 0x3c]
call fcn.100a4670
lea edx, [esp + 0x19]
mov ecx, esi
push eax
sub edx, eax
push edx
call fcn.10024b20
mov eax, dword [ebp + 0xc]
add dword [edi + 0x80], eax
mov ecx, dword [esp + 0x1c]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.100ac90e
mov esp, ebp
pop ebp
ret 8
mov ecx, 0x100e6780
call fcn.100239b0
push 1
call fcn.100aecb2
int3
Function at 0x100a19f0
Capabilities:
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
test edx, edx
jne 0x100a19fb
xor eax, eax
pop ebp
ret
pop ebp
jmp fcn.100a1a10
Function at 0x100a4600
Capabilities:
Terminate process

Disassembly:
push ecx
test ecx, ecx
jns 0x100a464e
push ecx
push ecx
mov edx, str.ERROR:
mov ecx, 0x100e6780
call fcn.100200d0
mov edx, str.Negative_value
mov ecx, eax
call fcn.100200d0
add esp, 4
mov ecx, eax
call fcn.1004dc70
mov edx, str._passed_to_VarintBE::Length__which_requires_non_negative_argument
mov ecx, eax
call fcn.100200d0
push eax
call fcn.10094e10
add esp, 4
cmp byte [0x100e7ab4], 0
jne 0x100a465a
xor eax, eax
pop ecx
ret
xor eax, eax
sar ecx, 7
inc eax
test ecx, ecx
jne 0x100a4650
pop ecx
ret
mov ecx, 0x100e6780
call fcn.100239b0
push 1
call fcn.100aecb2
int3

Function at 0x100a4670
Capabilities:
Terminate process

Disassembly:
push ecx
push esi
push edi
test ecx, ecx
jns 0x100a46c2
push ecx
push ecx
mov edx, str.ERROR:
mov ecx, 0x100e6780
call fcn.100200d0
mov edx, str.Negative_value
mov ecx, eax
call fcn.100200d0
add esp, 4
mov ecx, eax
call fcn.1004dc70
mov edx, str._passed_to_VarintBE::EncodeInternal__which_requires_non_negative_argument
mov ecx, eax
call fcn.100200d0
push eax
call fcn.10094e10
add esp, 4
cmp byte [0x100e7ab4], 0
jne 0x100a46f1
xor eax, eax
pop edi
pop esi
pop ecx
ret
mov al, cl
lea esi, [edx + 4]
and al, 0x7f
sar ecx, 7
mov byte [esi], al
mov edi, 1
dec esi
test ecx, ecx
je 0x100a46eb
mov dl, cl
lea esi, [esi - 1]
or dl, 0x80
sar ecx, 7
inc edi
mov byte [esi + 1], dl
test ecx, ecx
jne 0x100a46d8
mov eax, edi
pop edi
pop esi
pop ecx
ret
mov ecx, 0x100e6780
call fcn.100239b0
push 1
call fcn.100aecb2
int3

Function at 0x100a47a0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
push esi
test eax, eax
jg 0x100a47fd
jl 0x100a47b5
test edx, edx
jae 0x100a47fd
push eax
push edx
mov edx, str.ERROR:
mov ecx, 0x100e6780
call fcn.100200d0
mov edx, str.Negative_value
mov ecx, eax
call fcn.100200d0
mov ecx, eax
call fcn.100a0560
mov edx, str._passed_to_VarintBE::Length__which_requires_non_negative_argument
mov ecx, eax
call fcn.100200d0
push eax
call fcn.10094e10
add esp, 4
cmp byte [0x100e7ab4], 0
jne 0x100a4814
xor eax, eax
pop esi
pop ecx
pop ebp
ret
xor esi, esi
nop
shrd edx, eax, 7
inc esi
sar eax, 7
mov ecx, edx
or ecx, eax
jne 0x100a4800
mov eax, esi
pop esi
pop ecx
pop ebp
ret
mov ecx, 0x100e6780
call fcn.100239b0
push 1
call fcn.100aecb2
int3
Function at 0x100a4830
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
push esi
push edi
test eax, eax
jg 0x100a488d
jl 0x100a4845
test edx, edx
jae 0x100a488d
push eax
push edx
mov edx, str.ERROR:
mov ecx, 0x100e6780
call fcn.100200d0
mov edx, str.Negative_value
mov ecx, eax
call fcn.100200d0
mov ecx, eax
call fcn.100a0560
mov edx, str._passed_to_VarintBE::EncodeInternal__which_requires_non_negative_argument
mov ecx, eax
call fcn.100200d0
push eax
call fcn.10094e10
add esp, 4
cmp byte [0x100e7ab4], 0
jne 0x100a48cf
xor eax, eax
pop edi
pop esi
pop ebp
ret
lea esi, [ecx + 8]
mov edi, 1
mov cl, dl
and cl, 0x7f
shrd edx, eax, 7
mov byte [esi], cl
dec esi
sar eax, 7
mov ecx, edx
or ecx, eax
je 0x100a48c9
lea ebx, [ebx]
mov cl, dl
lea esi, [esi - 1]
or cl, 0x80
inc edi
shrd edx, eax, 7
mov byte [esi + 1], cl
sar eax, 7
mov ecx, edx
or ecx, eax
jne 0x100a48b0
mov eax, edi
pop edi
pop esi
pop ebp
ret
mov ecx, 0x100e6780
call fcn.100239b0
push 1
call fcn.100aecb2
int3

Function at 0x100a48f0
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100e4c51
mov eax, dword fs:[0]
push eax
push ecx
mov eax, dword [0x10001840]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], ecx
mov eax, dword [ebp + 8]
mov dword [ecx], eax
mov eax, dword [ebp + 0xc]
mov dword [ecx + 4], eax
mov dword [ecx + 8], 0
mov dword [ecx + 0xc], 0
mov dword [ecx + 0x10], 0
mov dword [ebp - 4], 0
mov dword [ecx + 0x14], 0
mov dword [ecx + 0x18], 0
mov dword [ecx + 0x1c], 0
mov byte [ebp - 4], 1
mov dword [ecx + 0x20], 0
mov dword [ecx + 0x24], 0
mov dword [ecx + 0x28], 0
mov byte [ebp - 4], 2
mov eax, dword [ebp + 0x10]
mov dword [ecx + 0x2c], 0
mov dword [ecx + 0x30], eax
mov dword [ecx + 0x34], 0xffffffff
mov dword [ebp - 4], 0xffffffff
mov eax, ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x100a4a60
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
mov esi, ecx
push edi
mov eax, dword [esi + 8]
cmp eax, dword [esi + 0xc]
jne 0x100a4b48
mov eax, dword [esi + 0x14]
cmp eax, dword [esi + 0x18]
jne 0x100a4b48
mov eax, dword [esi + 0x20]
cmp eax, dword [esi + 0x24]
jne 0x100a4b48
mov ecx, dword [esi + 4]
call fcn.100a4d10
mov ecx, eax
test ecx, ecx
jne 0x100a4adf
push dword [esi + 4]
mov edx, str.ERROR:
push ecx
mov ecx, 0x100e6780
call fcn.100200d0
mov edx, str.Error_finding_table_size_for_source_size
mov ecx, eax
call fcn.100200d0
add esp, 4
mov ecx, eax
call fcn.10046f30
push eax
call fcn.10094e10
add esp, 4
call fcn.10092f90
xor al, al
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
lea eax, [ecx - 1]
mov dword [ebp - 4], 0xffffffff
mov dword [esi + 0x2c], eax
lea eax, [ebp - 4]
push eax
push ecx
lea ecx, [esi + 8]
call fcn.100a53b0
lea eax, [ebp - 4]
mov dword [ebp - 4], 0xffffffff
push eax
mov eax, dword [esi + 4]
lea ecx, [esi + 0x14]
shr eax, 4
push eax
call fcn.100a53b0
lea eax, [ebp - 4]
mov dword [ebp - 4], 0xffffffff
push eax
mov eax, dword [esi + 4]
lea ecx, [esi + 0x20]
shr eax, 4
push eax
call fcn.100a53b0
cmp byte [ebp + 8], 0
je 0x100a4b3d
push dword [esi + 4]
mov ecx, esi
call fcn.100a5010
pop edi
pop esi
mov al, 1
pop ebx
mov esp, ebp
pop ebp
ret 4
mov edx, str.ERROR:
mov ecx, 0x100e6780
call fcn.100200d0
mov edx, str.Init___called_twice_for_same_BlockHash_object
mov ecx, eax
call fcn.100200d0
push eax
call fcn.10094e10
add esp, 4
cmp byte [0x100e7ab4], 0
je 0x100a4ad4
mov ecx, 0x100e6780
call fcn.100239b0
push 1
call fcn.100aecb2
int3
Function at 0x100a4d10
Capabilities:
Terminate process

Disassembly:
push esi
mov esi, ecx
mov eax, 1
mov edx, esi
shr edx, 2
inc edx
cmp edx, eax
jbe 0x100a4d2a
add eax, eax
je 0x100a4d7b
cmp eax, edx
jb 0x100a4d22
lea ecx, [eax - 1]
test eax, ecx
je 0x100a4dda
push eax
push ecx
push esi
push ecx
mov edx, str.ERROR:
mov ecx, 0x100e6780
call fcn.100200d0
mov edx, str.Internal_error:_CalcTableSize_dictionary_size_
mov ecx, eax
call fcn.100200d0
add esp, 4
mov ecx, eax
call fcn.10046f30
mov edx, str._:_resulting_table_size
mov ecx, eax
call fcn.100200d0
add esp, 4
mov ecx, eax
call fcn.10046f30
mov edx, str._is_not_a_power_of_2
jmp 0x100a4dbf
push eax
push ecx
push esi
push ecx
mov edx, str.ERROR:
mov ecx, 0x100e6780
call fcn.100200d0
mov edx, str.Internal_error:_CalcTableSize_dictionary_size_
mov ecx, eax
call fcn.100200d0
add esp, 4
mov ecx, eax
call fcn.10046f30
mov edx, str._:_resulting_table_size
mov ecx, eax
call fcn.100200d0
add esp, 4
mov ecx, eax
call fcn.10046f30
mov edx, str._is_zero_or_negative
mov ecx, eax
call fcn.100200d0
push eax
call fcn.10094e10
add esp, 4
cmp byte [0x100e7ab4], 0
je 0x100a4e3e
jmp 0x100a4e42
test esi, esi
je 0x100a4e40
lea ecx, [edx + edx]
cmp eax, ecx
jbe 0x100a4e40
push eax
push ecx
push esi
push ecx
mov edx, str.ERROR:
mov ecx, 0x100e6780
call fcn.100200d0
mov edx, str.Internal_error:_CalcTableSize_dictionary_size_
mov ecx, eax
call fcn.100200d0
add esp, 4
mov ecx, eax
call fcn.10046f30
mov edx, str._:_resulting_table_size
mov ecx, eax
call fcn.100200d0
add esp, 4
mov ecx, eax
call fcn.10046f30
mov edx, str._is_too_large
mov ecx, eax
call fcn.100200d0
push eax
call fcn.10094e10
add esp, 4
call fcn.10092f90
xor eax, eax
pop esi
ret
mov ecx, 0x100e6780
call fcn.100239b0
push 1
call fcn.100aecb2
int3
Function at 0x100a4e60
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
mov edx, ecx
push ebx
push esi
push edi
mov eax, dword [edx + 8]
cmp eax, dword [edx + 0xc]
jne 0x100a4ea6
mov edx, str.ERROR:
mov ecx, 0x100e6780
call fcn.100200d0
mov edx, str.BlockHash::AddBlock___called_before_BlockHash::Init__
mov ecx, eax
call fcn.100200d0
push eax
call fcn.10094e10
add esp, 4
cmp byte [0x100e7ab4], 0
je 0x100a4ff0
jmp 0x100a4ff7
mov esi, dword [edx + 0x34]
mov eax, dword [edx + 4]
inc esi
shr eax, 4
cmp esi, eax
jl 0x100a4ef6
dec eax
mov edx, str.ERROR:
push eax
push ecx
push esi
push ecx
mov ecx, 0x100e6780
call fcn.100200d0
mov edx, str.BlockHash::AddBlock___called_with_block_number
mov ecx, eax
call fcn.100200d0
add esp, 4
mov ecx, eax
call fcn.1004dc70
mov edx, str._that_is_past_last_block
mov ecx, eax
call fcn.100200d0
add esp, 4
mov ecx, eax
call fcn.1004dc70
jmp 0x100a4e8b
mov edi, dword [edx + 0x14]
cmp dword [edi + esi*4], 0xffffffff
lea eax, [edi + esi*4]
je 0x100a4f47
push dword [eax]
mov edx, str.ERROR:
push ecx
push esi
push ecx
mov ecx, 0x100e6780
call fcn.100200d0
mov edx, str.Internal_error_in_BlockHash::AddBlock__:_block_number_
mov ecx, eax
call fcn.100200d0
add esp, 4
mov ecx, eax
call fcn.1004dc70
mov edx, str.__next_block_should_be__1_but_is
mov ecx, eax
call fcn.100200d0
add esp, 4
mov ecx, eax
call fcn.1004dc70
jmp 0x100a4e8b
mov ecx, dword [edx + 0x2c]
and ecx, dword [ebp + 8]
mov eax, dword [edx + 8]
mov ebx, dword [eax + ecx*4]
test ebx, ebx
jns 0x100a4f6a
mov dword [eax + ecx*4], esi
mov eax, dword [edx + 0x20]
mov dword [eax + esi*4], esi
mov dword [edx + 0x34], esi
pop edi
pop esi
pop ebx
pop ebp
ret 4
mov eax, dword [edx + 0x20]
mov eax, dword [eax + ebx*4]
cmp dword [edi + eax*4], 0xffffffff
je 0x100a4fe4
push dword [edi + eax*4]
mov edx, str.ERROR:
push ecx
push eax
push ecx
push ebx
push ecx
mov ecx, 0x100e6780
call fcn.100200d0
mov edx, str.Internal_error_in_BlockHash::AddBlock__:_first_matching_block_
mov ecx, eax
call fcn.100200d0
add esp, 4
mov ecx, eax
call fcn.1004dc70
mov edx, str.__last_matching_block_
mov ecx, eax
call fcn.100200d0
add esp, 4
mov ecx, eax
call fcn.1004dc70
mov edx, str.__next_block_should_be__1_but_is
mov ecx, eax
call fcn.100200d0
add esp, 4
mov ecx, eax
call fcn.1004dc70
push eax
call fcn.10094e10
add esp, 4
call fcn.10092f90
pop edi
pop esi
pop ebx
pop ebp
ret 4
mov dword [edi + eax*4], esi
mov eax, dword [edx + 0x20]
mov dword [eax + ebx*4], esi
mov dword [edx + 0x34], esi
pop edi
pop esi
pop ebx
pop ebp
ret 4
mov ecx, 0x100e6780
call fcn.100239b0
push 1
call fcn.100aecb2
int3
Function at 0x100a5010
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 8]
push ebx
mov ebx, ecx
push esi
push edi
mov eax, dword [ebx + 4]
cmp edx, eax
jle 0x100a507c
push eax
push ecx
push edx
push ecx
mov edx, str.ERROR:
mov ecx, 0x100e6780
call fcn.100200d0
mov edx, str.BlockHash::AddAllBlocksThroughIndex___called_with_index
mov ecx, eax
call fcn.100200d0
add esp, 4
mov ecx, eax
call fcn.1004dc70
mov edx, str._higher_than_end_index
mov ecx, eax
call fcn.100200d0
add esp, 4
mov ecx, eax
call fcn.10046f30
push eax
call fcn.10094e10
add esp, 4
cmp byte [0x100e7ab4], 0
je 0x100a5143
jmp 0x100a514a
mov ecx, dword [ebx + 0x34]
shl ecx, 4
cmp edx, ecx
jg 0x100a50d3
push ecx
push ecx
push edx
push ecx
mov edx, str.ERROR:
mov ecx, 0x100e6780
call fcn.100200d0
mov edx, str.BlockHash::AddAllBlocksThroughIndex___called_with_index
mov ecx, eax
call fcn.100200d0
add esp, 4
mov ecx, eax
call fcn.1004dc70
mov edx, str.___last_index_added__
mov ecx, eax
call fcn.100200d0
add esp, 4
mov ecx, eax
call fcn.1004dc70
mov edx, 0x100fdca8
mov ecx, eax
call fcn.100200d0
jmp 0x100a5061
cmp eax, 0x10
jb 0x100a5143
add eax, 0xfffffff0
cmp edx, eax
jle 0x100a50e2
lea edx, [eax + 1]
mov eax, dword [ebx]
add edx, eax
mov dword [ebp + 8], edx
lea edi, [eax + 0x10]
add edi, ecx
cmp edi, edx
jae 0x100a5143
movzx eax, byte [edi]
lea edx, [edi + 3]
movzx ecx, byte [edi + 1]
mov esi, 7
imul eax, eax, 0x101
add eax, ecx
lea esp, [esp]
movzx ecx, byte [edx - 1]
lea edx, [edx + 2]
imul eax, eax, 0x101
add ecx, eax
imul eax, ecx, 0x101
movzx ecx, byte [edx - 2]
add eax, ecx
and eax, 0x7fffff
dec esi
jne 0x100a5110
push eax
mov ecx, ebx
call fcn.100a4e60
add edi, 0x10
cmp edi, dword [ebp + 8]
jb 0x100a50f2
pop edi
pop esi
pop ebx
pop ebp
ret 4
mov ecx, 0x100e6780
call fcn.100239b0
push 1
call fcn.100aecb2
int3

Function at 0x100a51e0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ecx + 4]
mov edx, dword [ebp + 8]
shr eax, 4
cmp edx, eax
jb 0x100a5230
push edx
push ecx
mov edx, str.ERROR:
mov ecx, 0x100e6780
call fcn.100200d0
mov edx, str.NextMatchingBlock_called_for_invalid_block_number
mov ecx, eax
call fcn.100200d0
add esp, 4
mov ecx, eax
call fcn.1004dc70
push eax
call fcn.10094e10
add esp, 4
cmp byte [0x100e7ab4], 0
jne 0x100a5242
or eax, 0xffffffff
pop ebp
ret 8
mov eax, dword [ecx + 0x14]
push dword [ebp + 0xc]
push dword [eax + edx*4]
call fcn.100a5160
pop ebp
ret 8
mov ecx, 0x100e6780
call fcn.100239b0
push 1
call fcn.100aecb2
int3
Function at 0x100a5c90
Capabilities:
Encode data using xor
Encrypt data using rc4 ksa
Manually build aes constants

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov eax, 0x100e8590
mov word [0x100e8a90], 0
push esi
dec eax
mov word [0x100e8590], 0x301
push edi
mov edi, 0x100e8590
mov byte [0x100e8a93], 1
mov ebx, 2
sub edi, eax
lea esi, [eax + 2]
mov cl, byte [esi]
lea esi, [esi + 1]
mov dl, cl
mov al, cl
and dl, 0x80
neg dl
sbb dl, dl
add al, al
xor al, cl
and dl, 0x1b
xor al, dl
mov byte [edi + esi - 1], al
movzx eax, al
mov byte [eax + 0x100e8a90], bl
inc ebx
cmp ebx, 0x100
jl 0x100a5cc5
mov byte [0x100e8310], 0x63
mov ebx, 1
mov byte [0x100e8473], 0
jmp 0x100a5d10
movzx eax, bl
mov ecx, 0x100e868f
movzx eax, byte [eax + 0x100e8a90]
sub ecx, eax
mov cl, byte [ecx]
mov dl, cl
rol dl, 1
xor cl, dl
rol dl, 1
xor cl, dl
rol dl, 1
mov al, dl
rol al, 1
xor al, cl
xor al, dl
xor al, 0x63
mov byte [ebx + 0x100e8310], al
movzx eax, al
mov byte [eax + 0x100e8410], bl
inc ebx
cmp ebx, 0x100
jl 0x100a5d10
mov al, 1
mov edx, 0x100e8510
movzx ecx, al
mov dword [edx], ecx
mov cl, al
and cl, 0x80
neg cl
sbb cl, cl
add al, al
and cl, 0x1b
add edx, 4
xor al, cl
cmp edx, 0x100e8588
jl 0x100a5d58
mov ecx, dword [0x100031ac]
xor esi, esi
mov edi, 0xff
mov ah, byte [esi + 0x100e8310]
mov bl, ah
mov bh, ah
and bl, 0x80
mov al, bl
neg al
sbb al, al
add bh, bh
and al, 0x1b
mov dl, bh
xor dl, al
xor dl, ah
neg bl
movzx edx, dl
sbb bl, bl
movzx eax, ah
shl edx, 8
and bl, 0x1b
or edx, eax
xor bh, bl
mov bl, byte [esi + 0x100e8410]
shl edx, 8
or edx, eax
movzx eax, bh
shl edx, 8
or edx, eax
mov dword [esi*4 + 0x100e8690], edx
test cl, cl
je 0x100a5dfc
test bl, bl
je 0x100a5dfc
movzx eax, cl
movzx edx, bl
movzx eax, byte [eax + 0x100e8a90]
movzx edx, byte [edx + 0x100e8a90]
add eax, edx
cdq
idiv edi
mov al, byte [edx + 0x100e8590]
mov byte [ebp - 1], al
jmp 0x100a5e00
mov byte [ebp - 1], 0
test ch, ch
je 0x100a5e2c
test bl, bl
je 0x100a5e2c
movzx eax, ch
movzx edx, bl
movzx eax, byte [eax + 0x100e8a90]
movzx edx, byte [edx + 0x100e8a90]
add eax, edx
cdq
idiv edi
mov al, byte [edx + 0x100e8590]
mov byte [ebp - 2], al
jmp 0x100a5e30
mov byte [ebp - 2], 0
mov al, byte [0x100031ae]
test al, al
je 0x100a5e5e
test bl, bl
je 0x100a5e5e
movzx eax, al
movzx edx, bl
movzx eax, byte [eax + 0x100e8a90]
movzx edx, byte [edx + 0x100e8a90]
add eax, edx
cdq
idiv edi
mov bh, byte [edx + 0x100e8590]
jmp 0x100a5e60
xor bh, bh
mov al, byte [0x100031af]
test al, al
je 0x100a5e8e
test bl, bl
je 0x100a5e8e
movzx eax, al
movzx edx, bl
movzx eax, byte [eax + 0x100e8a90]
movzx edx, byte [edx + 0x100e8a90]
add eax, edx
cdq
idiv edi
mov bl, byte [edx + 0x100e8590]
jmp 0x100a5e90
xor bl, bl
movzx edx, byte [ebp - 1]
movzx eax, byte [ebp - 2]
shl edx, 8
or edx, eax
movzx eax, bh
shl edx, 8
or edx, eax
movzx eax, bl
shl edx, 8
or edx, eax
mov dword [esi*4 + 0x100e7f10], edx
inc esi
cmp esi, 0x100
jl 0x100a5d85
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret