joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100c236c
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
je 0x100c2409
push ebx
push esi
call fcn.100c2335
xor ebx, ebx
sub eax, esi
push ebx
push ebx
push ebx
push ebx
sar eax, 1
push eax
push esi
push ebx
push ebx
mov dword [ebp - 8], eax
call fcn.100c00ed
add esp, 0x24
mov dword [ebp - 4], eax
test eax, eax
jne 0x100c23b6
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x100c2408
push edi
push eax
call fcn.100bd6c9
mov edi, eax
pop ecx
push ebx
test edi, edi
jne 0x100c23d6
call fcn.100bc7af
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x100c2407
push ebx
push dword [ebp - 4]
push edi
push dword [ebp - 8]
push esi
push ebx
push ebx
call fcn.100c00ed
add esp, 0x20
test eax, eax
jne 0x100c23f5
push edi
call fcn.100bc7af
jmp 0x100c23fd
push ebx
call fcn.100bc7af
mov ebx, edi
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, ebx
pop edi
pop ebx
pop esi
leave
ret

Function at 0x100c240c
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
jne 0x100c241d
pop esi
ret
push ebx
push edi
push esi
call fcn.100c2335
mov ebx, eax
sub ebx, esi
and ebx, 0xfffffffe
push ebx
call fcn.100bd6c9
mov edi, eax
pop ecx
pop ecx
test edi, edi
je 0x100c2445
push ebx
push esi
push edi
call fcn.100a1570
add esp, 0xc
push 0
call fcn.100bc7af
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, edi
pop edi
pop ebx
pop esi
ret

Function at 0x100c2b9f
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.100c26ba

Function at 0x100c52d6
Capabilities:
Get geographical location

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push esi
push edi
call fcn.100baaed
mov esi, dword [ebp + 8]
mov edi, eax
push 2
lea eax, [ebp - 4]
mov ecx, esi
push eax
and ecx, 0x3ff
push 0x20000001
or ecx, 0x400
push ecx
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x100c5345
cmp esi, dword [ebp - 4]
je 0x100c5340
cmp dword [ebp + 0xc], 0
je 0x100c5340
mov esi, dword [edi + 0x50]
lea ecx, [esi + 2]
mov ax, word [esi]
add esi, 2
test ax, ax
jne 0x100c531d
push dword [edi + 0x50]
sub esi, ecx
sar esi, 1
call fcn.100c4e28
pop ecx
xor ecx, ecx
cmp eax, esi
setne cl
mov eax, ecx
jmp 0x100c5347
xor eax, eax
inc eax
jmp 0x100c5347
xor eax, eax
pop edi
pop esi
leave
ret
Function at 0x100c53ac
Capabilities:
Get geographical location

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [0x1022d400]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push ebx
mov ebx, dword [ebp + 0x10]
push esi
mov esi, dword [ebp + 8]
push edi
mov dword [ebp - 0x18], eax
call fcn.100baaed
add eax, 0x50
lea edi, [ebp - 0x10]
mov dword [ebp - 0x14], eax
xor eax, eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
call fcn.100baaed
lea ecx, [ebp - 0x10]
xor edx, edx
mov dword [eax + 0x34c], ecx
lea ecx, [esi + 0x80]
mov eax, dword [ebp - 0x14]
mov dword [eax], esi
lea edi, [eax + 4]
mov dword [edi], ecx
test ecx, ecx
je 0x100c5423
cmp word [ecx], dx
je 0x100c5423
mov eax, dword [0x10160eec]
push edi
dec eax
push eax
push 0x10160dd8
call fcn.100c534b
mov eax, dword [ebp - 0x14]
add esp, 0xc
xor edx, edx
mov dword [ebp - 0x10], edx
mov eax, dword [eax]
test eax, eax
je 0x100c5496
cmp word [eax], dx
je 0x100c5496
mov eax, dword [edi]
test eax, eax
je 0x100c5447
cmp word [eax], dx
je 0x100c5447
lea eax, [ebp - 0x10]
push eax
call fcn.100c4d2e
jmp 0x100c5450
lea eax, [ebp - 0x10]
push eax
call fcn.100c4dc9
cmp dword [ebp - 0x10], 0
pop ecx
jne 0x100c54c0
mov eax, dword [0x10160dd4]
push dword [ebp - 0x14]
dec eax
push eax
push 0x10160ac8
call fcn.100c534b
add esp, 0xc
test al, al
je 0x100c54c0
mov eax, dword [edi]
xor edi, edi
test eax, eax
je 0x100c548b
cmp word [eax], di
je 0x100c548b
lea eax, [ebp - 0x10]
push eax
call fcn.100c4d2e
pop ecx
jmp 0x100c54c2
lea eax, [ebp - 0x10]
push eax
call fcn.100c4dc9
jmp 0x100c5488
mov eax, dword [edi]
test eax, eax
je 0x100c54ad
cmp word [eax], dx
je 0x100c54ad
lea eax, [ebp - 0x10]
push eax
call fcn.100c4ce3
pop ecx
jmp 0x100c54c0
mov dword [ebp - 0x10], 0x104
call dword [sym.imp.KERNEL32.dll_GetUserDefaultLCID]
mov dword [ebp - 8], eax
mov dword [ebp - 0xc], eax
xor edi, edi
cmp dword [ebp - 0x10], 0
je 0x100c558b
lea eax, [ebp - 0x10]
push eax
lea eax, [esi + 0x100]
neg esi
sbb esi, esi
and esi, eax
push esi
call fcn.100c51d0
mov esi, eax
pop ecx
pop ecx
test esi, esi
je 0x100c558b
movzx ecx, si
push ecx
call dword [sym.imp.KERNEL32.dll_IsValidCodePage]
test eax, eax
je 0x100c558b
push 1
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_IsValidLocale]
test eax, eax
je 0x100c558b
mov eax, dword [ebp - 0x18]
test eax, eax
je 0x100c5518
mov dword [eax], esi
mov eax, dword [ebp - 0x14]
push edi
push 0x55
add eax, 0x250
push eax
push dword [ebp - 0xc]
call fcn.100bd299
test ebx, ebx
je 0x100c5586
push edi
push 0x55
lea eax, [ebx + 0x120]
push eax
push dword [ebp - 0xc]
call fcn.100bd299
push 0x40
push ebx
push 0x1001
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x100c558b
push 0x40
lea eax, [ebx + 0x80]
push eax
push 0x1002
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x100c558b
push 0xa
push 0x10
lea ecx, [ebx + 0x100]
push ecx
push esi
call fcn.100c835f
add esp, 0x10
xor eax, eax
inc eax
jmp 0x100c558d
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1009f33b
leave
ret
Function at 0x100c761a
Capabilities:
Get disk information

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [0x1022d400]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
cmp eax, 0x1a
jbe 0x100c765d
call fcn.100b18b8
mov dword [eax], 0xf
call fcn.100b18cb
mov dword [eax], 0xd
call fcn.100a6384
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1009f33b
leave
ret
test eax, eax
jne 0x100c7664
inc eax
jmp 0x100c7651
add eax, 0x40
push 0x3a
mov word [ebp - 0xc], ax
pop eax
mov word [ebp - 0xa], ax
push 0x5c
pop eax
mov word [ebp - 8], ax
xor eax, eax
mov word [ebp - 6], ax
lea eax, [ebp - 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
mov ecx, eax
test ecx, ecx
je 0x100c764f
xor eax, eax
cmp ecx, 1
setne al
jmp 0x100c7651
Function at 0x100d5d70
Capabilities:
Encode data using base64

Disassembly:
push ecx
push ebx
push ebp
mov ebp, dword [esp + 0x18]
push esi
xor esi, esi
push edi
test ebp, ebp
je 0x100d5ed7
mov edi, dword [esp + 0x1c]
mov ecx, dword [esp + 0x18]
cmp edi, 2
jbe 0x100d5e2c
mov dword [esp + 0x10], 4
nop dword [eax]
mov ah, byte [ecx]
sub edi, 3
mov dl, byte [ecx + 1]
mov bl, ah
mov dh, byte [ecx + 2]
mov al, dl
mov ebp, dword [esp + 0x24]
and bl, 3
shr al, 4
and dl, 0xf
shl bl, 4
add ecx, 3
add bl, al
shl dl, 2
mov al, dh
shr al, 6
add dl, al
cmp dword [esp + 0x10], ebp
mov ebp, dword [esp + 0x20]
ja 0x100d5ed7
movzx eax, ah
shr eax, 2
mov al, byte [eax + 0x10167180]
mov byte [esi + ebp], al
movzx eax, bl
mov al, byte [eax + 0x10167180]
mov byte [esi + ebp + 1], al
movzx eax, dl
mov al, byte [eax + 0x10167180]
mov byte [esi + ebp + 2], al
movzx eax, dh
and eax, 0x3f
mov al, byte [eax + 0x10167180]
mov byte [esi + ebp + 3], al
add esi, 4
mov eax, dword [esp + 0x10]
add eax, 4
mov dword [esp + 0x10], eax
cmp edi, 2
ja 0x100d5da0
test edi, edi
je 0x100d5ec5
xor bl, bl
mov word [esp + 0x21], 0
xor ah, ah
mov byte [esp + 0x20], bl
xor dl, dl
test edi, edi
je 0x100d5e64
push edi
push ecx
lea eax, [esp + 0x28]
push eax
call fcn.100a1570
mov ah, byte [esp + 0x2e]
add esp, 0xc
mov dl, byte [esp + 0x21]
mov bl, byte [esp + 0x20]
mov al, dl
shr ah, 6
mov cl, bl
shr al, 4
and bl, 3
shr cl, 2
and dl, 0xf
shl bl, 4
shl dl, 2
add bl, al
add dl, ah
lea eax, [esi + 4]
cmp eax, dword [esp + 0x24]
ja 0x100d5ed7
movzx eax, cl
mov al, byte [eax + 0x10167180]
mov byte [esi + ebp], al
movzx eax, bl
mov al, byte [eax + 0x10167180]
mov byte [esi + ebp + 1], al
add esi, 2
lea ecx, [esi + ebp]
cmp edi, 1
jne 0x100d5eb2
mov al, 0x3d
jmp 0x100d5ebb
movzx eax, dl
mov al, byte [eax + 0x10167180]
mov byte [ecx], al
mov byte [esi + ebp + 1], 0x3d
add esi, 2
cmp esi, dword [esp + 0x24]
jae 0x100d5ed7
pop edi
mov byte [esi + ebp], 0
mov eax, esi
pop esi
pop ebp
pop ebx
pop ecx
ret
pop edi
pop esi
pop ebp
or eax, 0xffffffff
pop ebx
pop ecx
ret
Function at 0x100d61e0
Capabilities:
Get hostname

Disassembly:
sub esp, 0x13c
mov eax, dword [0x1022d400]
xor eax, esp
mov dword [esp + 0x138], eax
push esi
mov esi, dword [esp + 0x144]
lea eax, [esp + 0x24]
push 0x118
xorps xmm0, xmm0
push 0
push eax
movups xmmword [esp + 0x10], xmm0
call fcn.100a13a0
lea eax, [esp + 0x30]
push eax
call fcn.100d8320
add esp, 0x10
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov ecx, eax
mov dword [esp + 0x30], 0
shr ecx, 0x10
xor ecx, eax
movzx eax, cx
mov dword [esp + 0x2c], eax
lea eax, [esp + 0x34]
push 0x100
push eax
call dword [sym.imp.WS2_32.dll_gethostname]
test eax, eax
je 0x100d6287
call fcn.100b18cb
cmp dword [eax], 0x26
jne 0x100d6268
push 0x100
push str.hostname_exceeds__d_characters__truncating.
jmp 0x100d6274
call fcn.100b18cb
push dword [eax]
push str.unable_to_get_hostname:__d
push 2
call fcn.100a530f
add esp, 4
push eax
call fcn.100ccd10
add esp, 0xc
push 0
push 0
push 1
push 0x1022ee58
mov byte [esp + 0x143], 0
call fcn.100d8240
movups xmm0, xmmword [esp + 0x34]
mov dword [esp + 0x144], eax
mov dword [esp + 0x148], edx
movups xmmword [esp + 0x24], xmm0
movd ecx, xmm0
psrldq xmm0, 4
movd eax, xmm0
not ecx
mov dword [esp + 0x2c], ecx
not eax
mov dword [esp + 0x30], eax
lea eax, [esp + 0x14]
push eax
lea eax, [esp + 0x28]
push eax
lea eax, [esp + 0x3c]
push 0x118
push eax
call fcn.100d6530
mov eax, dword [esp + 0x24]
add esp, 0x20
cmp byte [esp + 0x148], 0
mov dword [esi + 0x10], eax
mov al, byte [esp + 8]
mov byte [esi + 0x14], al
je 0x100d6322
mov eax, dword [esp + 0xc]
mov ecx, eax
and ecx, 0xff0ffff0
and eax, 0xff0ffff0
mov dword [esi + 4], ecx
mov ecx, dword [esp + 0x10]
mov dword [esi + 8], eax
mov dword [esi + 0xc], ecx
mov ecx, dword [esp + 0x30]
mov eax, dword [esp + 0x2c]
mov dword [esi + 0x1c], ecx
mov ecx, dword [esp + 0x13c]
mov dword [esi + 0x18], eax
pop esi
xor ecx, esp
call fcn.1009f33b
add esp, 0x13c
ret
Function at 0x100e9160
Capabilities:
Resolve dns

Disassembly:
sub esp, 0xc
push ebx
push ebp
mov ebp, dword [esp + 0x1c]
mov ecx, 0x100ea8f0
test ebp, ebp
mov dword [esp + 8], 0
push esi
mov esi, dword [esp + 0x1c]
mov eax, 0x100ea840
cmovne eax, ecx
mov dword [esp + 0x10], 0
mov dword [esp + 0x14], eax
mov ecx, 0x101752c8
push edi
mov edi, dword [esp + 0x28]
mov eax, 0x101752cc
cmove eax, ecx
mov bh, 1
mov dword [esp + 0x24], eax
mov ecx, 0x10
push 0
lea eax, [esp + 0x14]
setne bl
push eax
push 0
mov eax, 0x21
cmovne eax, ecx
push 8
movzx eax, ax
push eax
push esi
call sub.DNSAPI.dll_DnsQuery_UTF8
test eax, eax
je 0x100e923c
push 0
push 0
lea ecx, [esp + 0x1c]
push ecx
push 0x400
push eax
push 0
push 0x1300
call dword [sym.imp.KERNEL32.dll_FormatMessageA]
test eax, eax
je 0x100e9219
push dword [esp + 0x14]
push esi
push dword [esp + 0x2c]
push str.Failed_to_look_up__s_record___s_:__s
push 3
push 2
push dword [esp + 0x44]
call fcn.100d52a0
mov ecx, dword [esp + 0x2c]
add esp, 0x1c
jmp 0x100e92ff
push esi
push dword [esp + 0x28]
push str.Failed_to_look_up__s_record___s_:_Unknown_error
push 3
push 2
push dword [esp + 0x40]
call fcn.100d52a0
mov ecx, dword [esp + 0x28]
add esp, 0x18
jmp 0x100e92ff
mov ecx, dword [esp + 0x10]
test ecx, ecx
jne 0x100e9250
push esi
push dword [esp + 0x28]
push str.No__s_records_for___s_
jmp 0x100e9223
mov edx, dword [esp + 0x2c]
xor esi, esi
cmp ebp, 1
jne 0x100e9264
cmp word [ecx + 8], 0x10
je 0x100e926f
jmp 0x100e92a9
test ebp, ebp
jne 0x100e92a9
cmp word [ecx + 8], 0x21
jne 0x100e92a9
test esi, esi
jle 0x100e9278
cmp ebp, 1
je 0x100e92db
test edi, edi
je 0x100e928e
test esi, esi
je 0x100e9288
mov eax, dword [ecx + 0x10]
cmp eax, dword [edi + 4]
jae 0x100e928e
mov eax, dword [ecx + 0x10]
mov dword [edi + 4], eax
push edx
push edi
push ecx
push dword [esp + 0x2c]
call dword [esp + 0x28]
mov ecx, dword [esp + 0x20]
add esp, 0x10
test al, al
je 0x100e92f9
mov edx, dword [esp + 0x2c]
inc esi
mov eax, dword [ecx]
mov ecx, eax
mov dword [esp + 0x10], ecx
test eax, eax
jne 0x100e9256
mov dword [edi], esi
test esi, esi
jne 0x100e92fd
push dword [esp + 0x20]
push dword [esp + 0x28]
push str.No_matching__s_records_for___s_
push 3
push 2
push edx
call fcn.100d52a0
mov ecx, dword [esp + 0x28]
add esp, 0x18
jmp 0x100e92ff
push dword [esp + 0x20]
xor bh, bh
push str.Multiple_TXT_records_for___s_
push 3
push 2
push edx
call fcn.100d52a0
mov ecx, dword [esp + 0x24]
add esp, 0x14
jmp 0x100e92ff
xor bh, bh
jmp 0x100e92ff
mov bl, 1
test ecx, ecx
je 0x100e930b
push 1
push ecx
call sub.DNSAPI.dll_DnsFree
mov eax, dword [esp + 0x14]
test eax, eax
je 0x100e931a
push eax
call dword [sym.imp.KERNEL32.dll_LocalFree]
test bl, bl
je 0x100e932c
test bh, bh
je 0x100e932c
pop edi
pop esi
pop ebp
mov al, 1
pop ebx
add esp, 0xc
ret
pop edi
pop esi
pop ebp
xor al, al
pop ebx
add esp, 0xc
ret
Function at 0x100e9730
Capabilities:
Resolve dns

Disassembly:
sub esp, 0x34
mov eax, dword [0x1022d400]
xor eax, esp
mov dword [esp + 0x30], eax
cmp dword [esp + 0x38], 0
push ebx
mov ebx, dword [esp + 0x44]
push ebp
mov ebp, dword [esp + 0x44]
mov dword [esp + 0xc], ebx
je 0x100e98ba
test ebp, ebp
je 0x100e98eb
movzx eax, word [ebp + 0x20a]
push esi
push eax
push 0x10175430
lea eax, [esp + 0x3c]
push 8
push eax
call fcn.100d43c0
mov eax, dword [ebp + 0x20c]
lea esi, [ebp + 4]
add esp, 0x10
mov dword [esp + 0x18], eax
lea eax, [esp + 0xc]
mov dword [esp + 0x1c], 1
xorps xmm0, xmm0
mov dword [esp + 0x14], 0
movlpd qword [esp + 0x24], xmm0
push eax
lea eax, [esp + 0x18]
movlpd qword [esp + 0x30], xmm0
push eax
lea eax, [esp + 0x3c]
mov dword [esp + 0x28], 0
push eax
push esi
call dword [sym.imp.WS2_32.dll_getaddrinfo]
test eax, eax
je 0x100e97f1
push esi
push 0x10175434
push 3
push 2
push ebx
call fcn.100d52a0
add esp, 0x14
xor eax, eax
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x30]
xor ecx, esp
call fcn.1009f33b
add esp, 0x34
ret
mov esi, dword [esp + 0xc]
push edi
test esi, esi
je 0x100e9882
nop
push dword [esi + 0xc]
push dword [esi + 8]
push dword [esi + 4]
call fcn.1010f570
mov ebx, eax
add esp, 0xc
test ebx, ebx
je 0x100e984d
call fcn.100d8300
mov edi, eax
mov ecx, edx
imul eax, dword [esp + 0x48], 0x3e8
cdq
add edi, eax
adc ecx, edx
push ecx
push edi
push dword [esi + 0x10]
push dword [esi + 0x18]
push ebx
call fcn.1010f2a0
add esp, 0x14
test eax, eax
je 0x100e9858
push ebx
call fcn.1010f400
add esp, 4
xor ebx, ebx
mov esi, dword [esi + 0x1c]
test esi, esi
jne 0x100e9800
test ebx, ebx
je 0x100e987e
push dword [esp + 0x10]
call dword [sym.imp.WS2_32.dll_freeaddrinfo]
push ebx
call fcn.10116620
add esp, 4
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x30]
xor ecx, esp
call fcn.1009f33b
add esp, 0x34
ret
mov ebx, dword [esp + 0x14]
lea eax, [ebp + 0x104]
push eax
push str.Failed_to_connect_to_target_host:__s
push 5
push 2
push ebx
call fcn.100d52a0
add esp, 0x14
push dword [esp + 0x10]
call dword [sym.imp.WS2_32.dll_freeaddrinfo]
mov ecx, dword [esp + 0x40]
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.1009f33b
add esp, 0x34
ret
push str.connecttimeoutms
push str.mongoc_client_connect_tcp
push 0x29b
push str.C:Usersprocr_vcpkg_buildtreesmongo_c_driver_src1.26.1_690bc2849a.clean_srclibmongoc_srcmongocmongoc_client.c
push str._s:_d__s__:_precondition_failed:__s_n
push 2
call fcn.100a530f
add esp, 4
push eax
call fcn.100ccd10
add esp, 0x18
call fcn.100b1525
push str.host
push str.mongoc_client_connect_tcp
push 0x29c
push str.C:Usersprocr_vcpkg_buildtreesmongo_c_driver_src1.26.1_690bc2849a.clean_srclibmongoc_srcmongocmongoc_client.c
push str._s:_d__s__:_precondition_failed:__s_n
push 2
call fcn.100a530f
add esp, 4
push eax
call fcn.100ccd10
add esp, 0x18
call fcn.100b1525
int3
Function at 0x10101500
Capabilities:
Hash data via bcrypt

Disassembly:
sub esp, 0x10
push ebx
push esi
mov esi, dword [esp + 0x1c]
lea eax, [esp + 0x10]
push 0
push eax
push 4
lea eax, [esp + 0x18]
mov dword [esp + 0x18], 0
push eax
push str.ObjectLength
push esi
mov dword [esp + 0x20], 0
xor bl, bl
mov dword [esp + 0x2c], 0
mov dword [esp + 0x28], 0
call sub.bcrypt.dll_BCryptGetProperty
test eax, eax
jns 0x10101565
push eax
push str.BCryptGetProperty__:_OBJECT_LENGTH__ld
push str.mongoc
push 0
call fcn.100db4d0
add esp, 0x10
xor al, al
pop esi
pop ebx
add esp, 0x10
ret
push 0
lea eax, [esp + 0x14]
push eax
push 4
lea eax, [esp + 0x20]
push eax
push str.HashDigestLength
push esi
call sub.bcrypt.dll_BCryptGetProperty
test eax, eax
jns 0x1010158a
push eax
push str.BCryptGetProperty__:_HASH_LENGTH__ld
jmp 0x1010154e
push edi
push dword [esp + 0x10]
call fcn.100d28d0
add esp, 4
mov edi, eax
lea eax, [esp + 0xc]
push 0
push dword [esp + 0x2c]
push dword [esp + 0x2c]
push dword [esp + 0x1c]
push edi
push eax
push esi
call sub.bcrypt.dll_BCryptCreateHash
test eax, eax
jns 0x101015ce
push eax
push str.BCryptCreateHash__:__ld
push str.mongoc
push 0
call fcn.100db4d0
add esp, 0x10
jmp 0x1010162c
push 0
push dword [esp + 0x34]
push dword [esp + 0x34]
push dword [esp + 0x18]
call sub.bcrypt.dll_BCryptHashData
test eax, eax
jns 0x101015fc
push eax
push str.BCryptHashData__:__ld
push str.mongoc
push 0
call fcn.100db4d0
add esp, 0x10
jmp 0x1010162c
push 0
push dword [esp + 0x1c]
push dword [esp + 0x3c]
push dword [esp + 0x18]
call sub.bcrypt.dll_BCryptFinishHash
test eax, eax
jns 0x1010162a
push eax
push str.BCryptFinishHash__:__ld
push str.mongoc
push 0
call fcn.100db4d0
add esp, 0x10
jmp 0x1010162c
mov bl, 1
mov ecx, dword [esp + 0xc]
test ecx, ecx
je 0x1010163a
push ecx
call sub.bcrypt.dll_BCryptDestroyHash
push edi
call fcn.100d28c0
add esp, 4
mov al, bl
pop edi
pop esi
pop ebx
add esp, 0x10
ret
Function at 0x101040a0
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x54
mov eax, dword [0x1022d400]
xor eax, esp
mov dword [esp + 0x50], eax
mov eax, dword [esp + 0x64]
mov ecx, dword [esp + 0x5c]
push ebx
push ebp
mov ebp, dword [esp + 0x60]
push esi
mov esi, dword [esp + 0x74]
push edi
mov edi, dword [esp + 0x70]
lea ebx, [ebp + 0xb0]
push esi
push eax
lea eax, [esp + 0x48]
mov dword [esp + 0x1c], ebp
push eax
mov dword [esp + 0x1c], ecx
call fcn.100a1570
add esp, 0xc
cmp esi, 0x20
jae 0x1010428d
lea eax, [esi + 1]
mov byte [esp + esi + 0x40], 0
cmp eax, 0x20
jae 0x1010428d
mov byte [esp + eax + 0x40], 0
lea eax, [esi + 2]
cmp eax, 0x20
jae 0x1010428d
mov ecx, dword [ebp + 0x118]
mov edx, 0x20
mov byte [esp + eax + 0x40], 0
mov byte [esp + esi + 0x43], 1
test ecx, ecx
jne 0x1010412c
lea eax, [ecx + 0x14]
jmp 0x10104134
xor eax, eax
cmp ecx, 1
cmove eax, edx
mov esi, dword [esp + 0x10]
add ebp, 0x110
push ebx
push eax
lea eax, [esp + 0x48]
mov dword [esp + 0x20], ebp
push eax
push edi
push esi
push ebp
call fcn.10129920
mov ecx, dword [esp + 0x2c]
add esp, 0x18
mov ecx, dword [ecx + 0x118]
test ecx, ecx
jne 0x10104167
lea eax, [ecx + 0x14]
jmp 0x10104174
xor eax, eax
cmp ecx, 1
mov ecx, 0x20
cmove eax, ecx
push eax
lea eax, [esp + 0x24]
push ebx
push eax
call fcn.100a1570
mov eax, dword [esp + 0x88]
add esp, 0xc
cmp eax, 2
jb 0x10104265
dec eax
mov dword [esp + 0x1c], eax
nop dword [eax + eax]
mov eax, dword [esp + 0x14]
mov eax, dword [eax + 0x118]
test eax, eax
jne 0x101041b3
lea esi, [eax + 0x14]
jmp 0x101041c1
cmp eax, 1
jne 0x10104278
mov esi, 0x20
mov ecx, dword [esp + 0x10]
mov eax, ebp
lea ebp, [esp + 0x20]
mov edx, edi
push ebp
mov ebx, esi
mov edi, ebp
push ebx
push edi
push edx
push ecx
push eax
call fcn.10129920
mov ebx, dword [esp + 0x2c]
lea eax, [esp + esi + 0x37]
add ebx, 0xb0
add esp, 0x18
xor ecx, ecx
lea edx, [ebx - 1]
add edx, esi
cmp ebx, eax
ja 0x101041fe
mov eax, ebp
cmp edx, eax
jae 0x1010422c
mov edx, esi
lea edi, [esp + 0x20]
and edx, 0xfffffff8
mov eax, ebx
sub edi, ebx
nop dword [eax + eax]
movq xmm0, qword [eax]
lea eax, [eax + 8]
movq xmm1, qword [edi + eax - 8]
add ecx, 8
xorps xmm1, xmm0
movq qword [eax - 8], xmm1
cmp ecx, edx
jl 0x10104210
cmp ecx, esi
jge 0x1010424e
lea edx, [esp + 0x20]
sub edx, ebx
lea eax, [ecx + ebx]
sub esi, ecx
nop dword [eax + eax]
mov cl, byte [edx + eax]
lea eax, [eax + 1]
xor byte [eax - 1], cl
sub esi, 1
jne 0x10104240
mov esi, dword [esp + 0x10]
mov edi, dword [esp + 0x70]
mov ebp, dword [esp + 0x18]
sub dword [esp + 0x1c], 1
jne 0x101041a0
mov ecx, dword [esp + 0x60]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.1009f33b
add esp, 0x54
ret
lea eax, [esp + 0x20]
push eax
push 0
push eax
push edi
push esi
push ebp
call fcn.10129920
add esp, 0x18
jmp 0x1010425a
call fcn.1009f8a0
int3
Function at 0x1010ece0
Capabilities:
Set socket configuration

Disassembly:
push ecx
push esi
mov dword [esp + 4], 1
call fcn.100b18cb
push 4
mov dword [eax], 0
lea eax, [esp + 8]
push eax
push 1
push 6
push dword [esp + 0x1c]
call dword [sym.imp.WS2_32.dll_setsockopt]
mov esi, eax
cmp esi, 0xffffffff
jne 0x1010ed2c
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push eax
push str.WSAGetLastError__:__d
push str.socket
push 2
call fcn.100db4d0
add esp, 0x10
test esi, esi
pop esi
sete al
pop ecx
ret

Function at 0x1010ed40
Capabilities:
Send data
Send data on socket

Disassembly:
mov ecx, dword [esp + 4]
push edi
xor edi, edi
test ecx, ecx
je 0x1010ee0d
push ebp
mov ebp, dword [esp + 0x10]
test ebp, ebp
je 0x1010ee3e
push ebx
mov ebx, dword [esp + 0x18]
test ebx, ebx
je 0x1010ee6f
push esi
xor esi, esi
test ebx, ebx
je 0x1010ee06
nop dword [eax]
nop dword [eax + eax]
mov eax, dword [ebp + esi*8]
cmp eax, 0x7fffffff
ja 0x1010eea0
push 0
push eax
push dword [ebp + esi*8 + 4]
push dword [ecx]
call dword [sym.imp.WS2_32.dll_send]
cmp eax, 0xffffffff
je 0x1010edc5
add edi, eax
cdq
test edx, edx
jl 0x1010ee06
jg 0x1010edb0
test eax, eax
jb 0x1010ee06
cmp eax, dword [ebp + esi*8]
jne 0x1010ee06
test edx, edx
jne 0x1010ee06
inc esi
cmp esi, ebx
jae 0x1010ee06
mov ecx, dword [esp + 0x14]
jmp 0x1010ed80
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov ebx, dword [esp + 0x14]
mov esi, eax
mov dword [ebx + 4], esi
call fcn.100b18cb
mov dword [eax], esi
mov eax, dword [ebx + 4]
cmp eax, 0xb
je 0x1010edf9
cmp eax, 0x2733
je 0x1010edf9
cmp eax, 0x2734
je 0x1010edf9
pop esi
pop ebx
pop ebp
or eax, 0xffffffff
pop edi
ret
pop esi
or eax, 0xffffffff
test edi, edi
pop ebx
pop ebp
cmovne eax, edi
pop edi
ret
pop esi
pop ebx
pop ebp
mov eax, edi
pop edi
ret
push str.sock
push str._mongoc_socket_try_sendv_slow
push 0x4c4
push str.C:Usersprocr_vcpkg_buildtreesmongo_c_driver_src1.26.1_690bc2849a.clean_srclibmongoc_srcmongocmongoc_socket.c
push str._s:_d__s__:_precondition_failed:__s_n
push 2
call fcn.100a530f
add esp, 4
push eax
call fcn.100ccd10
add esp, 0x18
call fcn.100b1525
push 0x1019aef4
push str._mongoc_socket_try_sendv_slow
push 0x4c5
push str.C:Usersprocr_vcpkg_buildtreesmongo_c_driver_src1.26.1_690bc2849a.clean_srclibmongoc_srcmongocmongoc_socket.c
push str._s:_d__s__:_precondition_failed:__s_n
push 2
call fcn.100a530f
add esp, 4
push eax
call fcn.100ccd10
add esp, 0x18
call fcn.100b1525
push str.iovcnt
push str._mongoc_socket_try_sendv_slow
push 0x4c6
push str.C:Usersprocr_vcpkg_buildtreesmongo_c_driver_src1.26.1_690bc2849a.clean_srclibmongoc_srcmongocmongoc_socket.c
push str._s:_d__s__:_precondition_failed:__s_n
push 2
call fcn.100a530f
add esp, 4
push eax
call fcn.100ccd10
add esp, 0x18
call fcn.100b1525
push str.bson_in_range_unsigned__int__iov_i_.iov_len_
push str._mongoc_socket_try_sendv_slow
push 0x4ca
push str.C:Usersprocr_vcpkg_buildtreesmongo_c_driver_src1.26.1_690bc2849a.clean_srclibmongoc_srcmongocmongoc_socket.c
push str._s:_d__s__:_precondition_failed:__s_n
push 2
call fcn.100a530f
add esp, 4
push eax
call fcn.100ccd10
add esp, 0x18
call fcn.100b1525
int3