joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10045fd5
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
push ebx
mov eax, dword [ebx + 0x40]
mov esi, dword [eax + 0x14]
mov dword [ebp - 0xc], esi
imul edi, dword [esi + 0x20], 0xc8
mov eax, dword [esi + 0x24]
mov dword [ebp - 4], eax
add edi, dword [esi]
push dword [edi + 0x54]
call fcn.10046c01
pop ecx
pop ecx
test eax, eax
jne 0x10046158
push dword [ebp + 0x14]
push edi
call fcn.100466f3
mov edx, eax
mov dword [ebp - 8], edx
pop ecx
pop ecx
test edx, edx
jne 0x10046158
cmp dword [ebx + 0x30], 0x22
mov ecx, dword [ebx + 0x320]
sete al
sub ecx, eax
dec ecx
cmp dword [esi + 0x20], ecx
jle 0x1004603c
mov dword [esi + 0x28], edx
cmp dword [esi + 0x28], edx
je 0x10046054
mov eax, dword [ebp + 0x10]
mov dword [eax], edx
mov eax, dword [ebp + 0x14]
mov eax, dword [eax + 0x1c]
test eax, eax
jne 0x10046158
mov eax, dword [ebp - 4]
imul edi, eax, 0xc8
add edi, dword [esi]
inc eax
mov dword [ebp - 4], eax
cmp dword [edi + 0xa4], edx
je 0x100460a7
lea eax, [edi + 0x3c]
push eax
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [edi + 0xa4], 0
je 0x1004609d
lea esi, [edi + 0x20]
lea ebx, [edi + 0x3c]
push 0xffffffffffffffff
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_SleepConditionVariableCS]
cmp dword [edi + 0xa4], 0
jne 0x10046084
mov esi, dword [ebp - 0xc]
mov ebx, dword [ebp + 8]
lea eax, [edi + 0x3c]
push eax
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
push dword [edi + 0x98]
push dword [ebp + 0xc]
call fcn.1006a1f1
mov eax, dword [edi + 0x9c]
mov edx, dword [ebp - 8]
pop ecx
pop ecx
mov ecx, dword [ebp + 0x10]
mov dword [ecx], eax
mov ecx, dword [ebp + 0xc]
mov eax, dword [edi + 0x68]
mov dword [ecx + 0x78], eax
mov eax, dword [edi + 0x6c]
mov dword [ecx + 0x7c], eax
mov eax, dword [edi + 0xa0]
test eax, eax
mov ecx, dword [ebp - 4]
cmovs edx, eax
xor eax, eax
mov dword [ebp - 8], edx
xor edx, edx
mov dword [edi + 0x9c], edx
cmp ecx, dword [ebx + 0x320]
cmovl eax, ecx
mov ecx, dword [ebp + 0x14]
cmp dword [ecx + 0x1c], edx
jne 0x10046110
mov ecx, dword [ebp + 0x10]
cmp dword [ecx], edx
jne 0x10046110
cmp eax, dword [esi + 0x24]
jne 0x10046057
push 1
push dword [edi + 0x54]
mov dword [ebp - 4], eax
push ebx
call fcn.10046a4f
mov eax, dword [esi + 0x20]
add esp, 0xc
cmp eax, dword [ebx + 0x320]
jl 0x10046130
and dword [esi + 0x20], 0
mov ecx, dword [ebp + 0x14]
mov eax, dword [ebp - 4]
mov dword [esi + 0x24], eax
cmp dword [ecx + 0x1c], 0
jne 0x1004614c
mov eax, dword [ebp + 0x10]
cmp dword [eax], 0
jne 0x1004614c
mov eax, dword [ebp - 8]
jmp 0x10046158
mov eax, dword [edi + 0xa0]
test eax, eax
cmovns eax, dword [ecx + 0x1c]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10046e09
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
push dword [edi + 0xc]
mov ebx, dword [edi + 0x320]
call fcn.100394a1
xor esi, esi
inc esi
pop ecx
test eax, eax
je 0x10046e44
cmp dword [edi + 0x30], esi
jne 0x10046e44
cmp dword [edi + 0x80], 0xaf0
jle 0x10046e44
mov dword [edi + 0x320], esi
mov ebx, esi
test ebx, ebx
jne 0x10046e87
call fcn.10066205
mov ebx, eax
mov eax, dword [edi + 0x80]
test eax, eax
je 0x10046e6a
add eax, 0xf
cdq
and edx, 0xf
add eax, edx
sar eax, 4
cmp ebx, eax
cmovg ebx, eax
cmp ebx, esi
jle 0x10046e7f
push 0x10
inc ebx
pop eax
cmp ebx, eax
cmovg ebx, eax
mov dword [edi + 0x320], ebx
jmp 0x10046e87
mov dword [edi + 0x320], esi
mov ebx, esi
cmp ebx, esi
jg 0x10046e97
and dword [edi + 0x328], 0
jmp 0x10046fb3
push 0x5c
call fcn.1006c3c1
mov esi, eax
mov dword [ebp - 4], esi
pop ecx
test esi, esi
jne 0x10046eb0
or eax, 0xffffffff
jmp 0x10046fb5
cmp ebx, 0x7ffffff
jb 0x10046ebc
xor eax, eax
jmp 0x10046ec8
mov eax, ebx
shl eax, 4
push eax
call fcn.1006c3c1
pop ecx
mov dword [esi], eax
test eax, eax
jne 0x10046ed7
push esi
call sym.ffmpeg.dll_av_free
pop ecx
jmp 0x10046ea8
mov eax, dword [edi + 0x40]
mov dword [eax + 0x14], esi
lea eax, [esi + 0x20]
and dword [esi + 0x40], 0
and dword [esi + 0x14], 0
and dword [esi + 0x18], 0
and dword [esi + 0x44], 0
mov esi, dword [sym.imp.KERNEL32.dll_InitializeConditionVariable]
push eax
call esi
mov eax, dword [ebp - 4]
add eax, 0x1c
push eax
call esi
mov esi, dword [ebp - 4]
push 0
push 0
lea eax, [esi + 0x24]
push eax
mov dword [ebp - 0x10], eax
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSectionEx]
lea eax, [esi + 0x24]
push eax
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
xor eax, eax
mov dword [ebp - 8], eax
test ebx, ebx
jle 0x10046f6f
xor ecx, ecx
mov dword [ebp - 0xc], ecx
mov esi, dword [esi]
push 0
add esi, ecx
push 0
push esi
push 0x100470d4
push 0
push 0
mov dword [esi + 4], 0x100470ec
mov dword [esi + 8], edi
call fcn.10139bf6
add esp, 0x18
mov dword [esi], eax
test eax, eax
mov eax, dword [ebp - 8]
je 0x10046fbc
mov ecx, dword [ebp - 0xc]
inc eax
mov esi, dword [ebp - 4]
add ecx, 0x10
mov dword [ebp - 8], eax
mov dword [ebp - 0xc], ecx
cmp eax, ebx
jl 0x10046f2e
mov eax, dword [esi + 0x14]
add eax, ebx
cmp dword [esi + 0x40], eax
je 0x10046f96
lea edi, [esi + 0x24]
push 0xffffffffffffffff
push edi
lea eax, [esi + 0x1c]
push eax
call dword [sym.imp.KERNEL32.dll_SleepConditionVariableCS]
mov eax, dword [esi + 0x14]
add eax, ebx
cmp dword [esi + 0x40], eax
jne 0x10046f7c
mov edi, dword [ebp + 8]
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov dword [edi + 0x330], fcn.10046fd6
mov dword [edi + 0x334], 0x100470aa
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push dword [ebp - 0x10]
mov dword [edi + 0x320], eax
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
push edi
call fcn.1004593e
jmp 0x10046ed4
Function at 0x1004c987
Capabilities:
Terminate process

Disassembly:
push esi
push edi
mov edi, 0x550
push edi
call sym.ffmpeg.dll_av_malloc
mov esi, eax
pop ecx
test esi, esi
jne 0x1004c99f
xor eax, eax
jmp 0x1004ca0c
push edi
xor edi, edi
push edi
push esi
call fcn.10134340
push esi
mov dword [esi], str.AVFormatContext
mov dword [esi + 0x540], 0x1004ca1d
mov dword [esi + 0x544], 0x1004ca0f
call fcn.1006d095
push 0x68
call fcn.1006c3c1
add esp, 0x14
mov dword [esi + 0x504], eax
test eax, eax
jne 0x1004c9e6
push esi
call sym.ffmpeg.dll_avformat_free_context
pop ecx
jmp 0x1004c99b
mov dword [eax + 0x30], edi
mov ecx, 0x80000000
mov dword [eax + 0x34], ecx
mov eax, dword [esi + 0x504]
mov dword [eax + 0x28], 0x2625a0
mov eax, dword [esi + 0x504]
mov dword [eax + 0x58], edi
mov dword [eax + 0x5c], ecx
mov eax, esi
pop edi
pop esi
ret
Function at 0x10063c5a
Capabilities:
Validate payment card number using luhn algorithm

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push edi
mov edi, dword [ebp + 8]
xor ebx, ebx
test edi, edi
jne 0x10063c71
mov eax, dword [ebp + 0xc]
jmp 0x10063d04
push esi
push 0x1017ac78
push edi
call fcn.1013a600
add edi, eax
or esi, 0xffffffff
xor eax, eax
inc eax
push ebx
cmp byte [edi], 0x2d
cmovne esi, eax
lea eax, [ebp + 8]
push eax
push edi
call fcn.101391c7
mov edi, dword [ebp + 8]
add esp, 0x14
mov dword [ebp - 4], eax
mov al, byte [edi]
inc edi
mov dword [ebp + 8], edi
cmp al, 0x2e
jne 0x10063cd1
mov eax, 0x2710
movsx edx, byte [edi]
lea ecx, [edx - 0x30]
cmp ecx, 9
ja 0x10063cd1
test eax, eax
je 0x10063cd1
lea ecx, [edx - 0x30]
imul ecx, eax
push 0xa
cdq
add ebx, ecx
pop ecx
idiv ecx
inc edi
mov dword [ebp + 8], edi
jmp 0x10063cae
mov edi, dword [ebp - 4]
mov eax, edi
cdq
mov ecx, eax
mov dword [ebp + 8], 0x186a0
xor ecx, edx
mov eax, 0x7fffffff
sub eax, ebx
sub ecx, edx
cdq
idiv dword [ebp + 8]
cmp ecx, eax
jle 0x10063cf8
mov eax, dword [ebp + 0xc]
jmp 0x10063d03
imul esi, ebx
imul eax, edi, 0x186a0
add eax, esi
pop esi
pop edi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x100658ad
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, dword [edi + 0x110]
dec esi
test esi, esi
jle 0x10065930
mov eax, dword [ebp + 0xc]
lea edx, [edi + 0xf0]
push ebx
push 3
mov ebx, esi
lea ecx, [eax + 1]
shl ebx, 4
mov dword [ebp + 8], ecx
pop ecx
sub ecx, eax
add ebx, edi
mov dword [ebp - 4], ecx
push dword [ebp + 8]
push ecx
push dword [ebp + 0x14]
push edx
call fcn.10065f35
lea edx, [edi + 0xf0]
add esp, 0x10
mov ecx, dword [edx]
xor ecx, dword [ebx]
lea ebx, [ebx - 0x10]
mov eax, dword [edx + 4]
xor eax, dword [ebx + 0x14]
mov dword [edi + 0x100], ecx
mov dword [edi + 0x104], eax
mov ecx, dword [ebx + 0x18]
mov eax, dword [ebx + 0x1c]
xor ecx, dword [edx + 8]
xor eax, dword [edx + 0xc]
dec esi
mov dword [edi + 0x108], ecx
mov ecx, dword [ebp - 4]
mov dword [edi + 0x10c], eax
test esi, esi
jg 0x100658e0
pop ebx
push dword [ebp + 0x10]
lea eax, [edi + 0xf0]
push dword [ebp + 0xc]
push eax
call fcn.1006600b
add esp, 0xc
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x100660d1
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
mov edx, dword [ebp + 0x14]
push esi
mov esi, dword [ebp + 0x10]
add edx, esi
mov dword [ebp + 0x10], edx
cmp esi, edx
jae 0x10066187
push ebx
mov ebx, dword [ebp + 0xc]
push edi
mov edi, dword [ebp + 8]
cmp dword [edi + 0x24], 0
jne 0x10066125
push 0
push 0
push 1
lea eax, [edi + 4]
push eax
lea eax, [edi + 0x14]
push eax
push dword [edi]
call fcn.10065ae3
lea ecx, [edi + 0xc]
add esp, 0x18
lea eax, [ecx + 7]
cmp eax, ecx
jb 0x10066122
add byte [eax], 1
jne 0x10066122
dec eax
jmp 0x10066116
mov edx, dword [ebp + 0x10]
mov eax, dword [edi + 0x24]
lea ecx, [edi + 0x14]
add ecx, eax
mov dword [ebp - 4], ecx
mov ecx, esi
sub ecx, eax
add ecx, 0x10
cmp ecx, edx
cmova ecx, edx
and dword [ebp + 0x14], 0
and dword [ebp - 8], 0
sub eax, esi
add eax, ecx
and eax, 0xf
mov dword [edi + 0x24], eax
mov eax, ecx
sub eax, esi
cmp esi, ecx
cmova eax, dword [ebp + 0x14]
mov dword [ebp + 0x14], eax
test eax, eax
je 0x1006617d
mov edx, dword [ebp - 4]
mov ecx, eax
mov edi, dword [ebp - 8]
sub edx, ebx
mov al, byte [edx + ebx]
xor al, byte [esi]
mov byte [ebx], al
inc ebx
inc esi
inc edi
cmp edi, ecx
jb 0x10066169
mov edi, dword [ebp + 8]
mov edx, dword [ebp + 0x10]
cmp esi, edx
jb 0x100660f2
pop edi
pop ebx
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x10066b30
Capabilities:
Encode data using base64

Disassembly:
push ebp
mov ebp, esp
push edi
mov edi, dword [ebp + 0x14]
cmp edi, 0x3fffffff
jae 0x10066c16
lea eax, [edi + 2]
push 3
cdq
pop ecx
idiv ecx
lea eax, [eax*4 + 1]
cmp dword [ebp + 0xc], eax
jl 0x10066c16
push ebx
mov ebx, dword [ebp + 0x10]
push esi
mov esi, dword [ebp + 8]
cmp edi, ecx
jle 0x10066bc4
xor edx, edx
lea eax, [edi - 4]
div ecx
lea edx, [eax + 1]
imul ecx, edx, 3
sub edi, ecx
mov ecx, dword [ebx]
add ebx, 3
bswap ecx
mov eax, ecx
shr eax, 0x1a
mov al, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [esi], al
mov eax, ecx
shr eax, 0x14
and eax, 0x3f
mov al, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [esi + 1], al
mov eax, ecx
shr eax, 0xe
and eax, 0x3f
shr ecx, 8
and ecx, 0x3f
mov al, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [esi + 2], al
mov al, byte [ecx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [esi + 3], al
add esi, 4
sub edx, 1
jne 0x10066b77
xor edx, edx
test edi, edi
je 0x10066bfb
mov ecx, edi
shl ecx, 3
movzx eax, byte [ebx]
shl edx, 8
add edx, eax
inc ebx
sub edi, 1
jne 0x10066bcf
test ecx, ecx
jle 0x10066bfb
shl edx, 6
mov eax, edx
shr eax, cl
sub ecx, 6
and eax, 0x3f
mov al, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [esi], al
inc esi
test ecx, ecx
jg 0x10066be4
mov ecx, esi
sub ecx, dword [ebp + 8]
jmp 0x10066c07
mov byte [esi], 0x3d
inc esi
inc ecx
test cl, 3
jne 0x10066c02
mov eax, dword [ebp + 8]
mov byte [esi], 0
pop esi
pop ebx
jmp 0x10066c18
xor eax, eax
pop edi
pop ebp
ret
Function at 0x100676df
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 0x14]
mov edx, dword [ebp + 0xc]
push ebx
mov ebx, dword [ebp + 0x10]
add ecx, ebx
push esi
mov esi, dword [ebp + 8]
push edi
xor edi, edi
mov dword [ebp + 0x10], ecx
cmp dword [esi + 0x400], edi
jne 0x10067786
test bl, 3
je 0x10067721
cmp ebx, ecx
jae 0x10067721
movzx ecx, byte [ebx]
movzx eax, dl
xor ecx, eax
shr edx, 8
xor edx, dword [esi + ecx*4]
inc ebx
mov ecx, dword [ebp + 0x10]
jmp 0x10067704
and dword [ebp + 0x14], edi
lea eax, [ecx - 3]
mov esi, eax
mov dword [ebp + 0xc], edi
sub esi, ebx
add esi, 3
shr esi, 2
cmp ebx, eax
cmova esi, dword [ebp + 0x14]
test esi, esi
je 0x10067786
mov edi, dword [ebp + 8]
xor edx, dword [ebx]
add ebx, 4
mov eax, edx
shr eax, 8
movzx ecx, al
mov eax, edx
shr eax, 0x10
movzx eax, al
mov ecx, dword [edi + ecx*4 + 0x800]
xor ecx, dword [edi + eax*4 + 0x400]
movzx eax, dl
shr edx, 0x18
xor ecx, dword [edi + eax*4 + 0xc00]
xor ecx, dword [edi + edx*4]
mov eax, dword [ebp + 0xc]
mov edx, ecx
inc eax
mov dword [ebp + 0xc], eax
cmp eax, esi
jb 0x10067741
mov ecx, dword [ebp + 0x10]
xor edi, edi
mov esi, ecx
xor eax, eax
sub esi, ebx
cmp ebx, ecx
cmova esi, eax
test esi, esi
je 0x100677ac
movzx ecx, byte [ebx]
movzx eax, dl
xor ecx, eax
shr edx, 8
mov eax, dword [ebp + 8]
xor edx, dword [eax + ecx*4]
inc ebx
inc edi
cmp edi, esi
jb 0x10067795
pop edi
pop esi
mov eax, edx
pop ebx
pop ebp
ret

Function at 0x10067806
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, dword [ebp + 0x10]
lea eax, [edi - 8]
cmp eax, 0x18
ja 0x100678fe
xor esi, esi
xor edx, edx
xor ecx, ecx
push 0x20
pop ebx
lea eax, [esi + edi]
bts edx, eax
cmp eax, ebx
cmovae ecx, edx
xor edx, ecx
cmp eax, 0x40
cmovae ecx, edx
cmp esi, ecx
jg 0x100678fe
jl 0x1006784b
cmp dword [ebp + 0x14], edx
jae 0x100678fe
cmp dword [ebp + 0x18], 0x404
je 0x10067861
cmp dword [ebp + 0x18], 0x1000
jne 0x100678fe
sub ebx, edi
mov edx, 0x100
mov edi, dword [ebp + 8]
mov dword [ebp - 4], ebx
mov dword [ebp + 0x10], edx
cmp dword [ebp + 0xc], 0
push 8
je 0x10067894
mov ecx, esi
pop ebx
mov eax, ecx
shr ecx, 1
and eax, 1
neg eax
and eax, dword [ebp + 0x14]
xor ecx, eax
sub ebx, 1
jne 0x1006787c
mov dword [edi + esi*4], ecx
jmp 0x100678ba
mov ebx, dword [ebp + 0x14]
mov eax, esi
mov ecx, dword [ebp - 4]
shl eax, 0x18
shl ebx, cl
pop edx
mov ecx, eax
add eax, eax
sar ecx, 0x1f
and ecx, ebx
xor eax, ecx
sub edx, 1
jne 0x100678a2
mov edx, dword [ebp + 0x10]
bswap eax
mov dword [edi + esi*4], eax
inc esi
cmp esi, edx
jb 0x10067871
cmp dword [ebp + 0x18], 0x1000
mov dword [edi + 0x400], 1
jb 0x100678fa
mov edx, edi
push 3
mov esi, edx
pop ebx
mov ecx, dword [esi]
lea esi, [esi + 0x400]
movzx eax, cl
shr ecx, 8
xor ecx, dword [edi + eax*4]
mov dword [esi], ecx
sub ebx, 1
jne 0x100678d9
add edx, 4
sub dword [ebp + 0x10], 1
jne 0x100678d4
xor eax, eax
jmp 0x10067901
push 0xffffffffffffffea
pop eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1006f0f1
Capabilities:
Execute anti-debugging instructions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x9c
mov eax, dword [0x101c0814]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [0x102d4eb0]
push ebx
push esi
xor ebx, ebx
mov dword [ebp - 0x98], eax
cmp dword [0x1018ce80], 0x78
mov eax, dword [0x102d4eb4]
push edi
mov dword [ebp - 0x9c], eax
ja 0x1006f238
rdtsc
xor dword [0x102d46e4], eax
rdtsc
xor dword [0x102d4754], edx
call fcn.10142df7
mov dword [ebp - 0x94], eax
cmp ebx, eax
jne 0x1006f160
mov ecx, dword [0x102d4eb0]
and ecx, 0x1ff
inc dword [ecx*4 + 0x102d46b0]
jmp 0x1006f1d2
mov esi, dword [0x102d4eb0]
mov edi, dword [0x102d4eb4]
add esi, 1
mov ecx, esi
mov dword [0x102d4eb0], esi
adc edi, 0
sub eax, ebx
xor edx, edx
mov dword [0x102d4eb4], edi
mov ebx, 0xc46031b9
and ecx, 0x1ff
div ebx
mov ebx, dword [ebp - 0x9c]
add dword [ecx*4 + 0x102d46b0], edx
mov edx, dword [ebp - 0x98]
mov eax, edx
or eax, ebx
je 0x1006f1bd
mov ecx, esi
mov eax, edi
sub ecx, edx
sbb eax, ebx
test eax, eax
ja 0x1006f1d9
jb 0x1006f1bd
cmp ecx, 4
ja 0x1006f1d9
sub esi, edx
sbb edi, ebx
test edi, edi
ja 0x1006f1d9
jb 0x1006f1cc
cmp esi, 0x40
ja 0x1006f1d9
mov eax, dword [ebp - 0x94]
mov ebx, eax
jmp 0x1006f13c
rdtsc
add dword [0x102d486c], eax
lea eax, [ebp - 0x90]
push 0xa0
push eax
call fcn.1006f9e9
push 0x800
lea eax, [ebp - 0x90]
push 0x102d46b0
push eax
call fcn.1006fac5
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x90]
push eax
call fcn.1006f96a
mov eax, dword [ebp - 8]
add esp, 0x1c
mov ecx, dword [ebp - 0x18]
bswap ecx
bswap eax
add eax, ecx
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10132731
mov esp, ebp
pop ebp
ret
push 0x4b
push str.c:userselectronworkspacelibchromiumcontent_win_ia32_src_third_party_ffmpeglibavutil_random_seed.c
push str.sizeof_tmp____av_sha_size
push str.Assertion__s_failed_at__s:_d_n
push 0
push 0
call fcn.1006b450
add esp, 0x18
call fcn.10136f67
int3

Function at 0x1006f9e9
Capabilities:
Hash data using sha224
Hash data using sha256

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 0xc]
mov eax, edx
mov ecx, dword [ebp + 8]
sar eax, 5
mov byte [ecx], al
sub edx, 0xa0
je 0x1006fa8f
sub edx, 0x40
je 0x1006fa4e
sub edx, 0x20
je 0x1006fa14
push 0xffffffffffffffea
pop eax
pop ebp
ret
mov dword [ecx + 0x50], 0x6a09e667
mov dword [ecx + 0x54], 0xbb67ae85
mov dword [ecx + 0x58], 0x3c6ef372
mov dword [ecx + 0x5c], 0xa54ff53a
mov dword [ecx + 0x60], 0x510e527f
mov dword [ecx + 0x64], 0x9b05688c
mov dword [ecx + 0x68], 0x1f83d9ab
mov dword [ecx + 0x6c], 0x5be0cd19
jmp 0x1006fa86
mov dword [ecx + 0x50], 0xc1059ed8
mov dword [ecx + 0x54], 0x367cd507
mov dword [ecx + 0x58], 0x3070dd17
mov dword [ecx + 0x5c], 0xf70e5939
mov dword [ecx + 0x60], 0xffc00b31
mov dword [ecx + 0x64], 0x68581511
mov dword [ecx + 0x68], 0x64f98fa7
mov dword [ecx + 0x6c], 0xbefa4fa4
mov dword [ecx + 0x70], 0x10070afa
jmp 0x1006fab9
mov dword [ecx + 0x50], 0x67452301
mov dword [ecx + 0x54], 0xefcdab89
mov dword [ecx + 0x58], 0x98badcfe
mov dword [ecx + 0x5c], 0x10325476
mov dword [ecx + 0x60], 0xc3d2e1f0
mov dword [ecx + 0x70], 0x1006fb51
and dword [ecx + 8], 0
and dword [ecx + 0xc], 0
xor eax, eax
pop ebp
ret
Function at 0x1007321f
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 0x20]
test esi, esi
jle 0x1007329d
mov ecx, dword [ebp + 0xc]
push ebx
mov ebx, dword [ebp + 0x10]
push edi
mov edi, dword [ebp + 8]
mov eax, dword [ebx]
mov edx, eax
xor edx, dword [ecx]
and eax, dword [ecx]
mov ecx, dword [edi]
shr edx, 1
and edx, 0x7f7f7f7f
add edx, eax
mov eax, ecx
xor eax, edx
or ecx, edx
shr eax, 1
and eax, 0x7f7f7f7f
sub ecx, eax
mov dword [edi], ecx
mov ecx, dword [ebp + 0xc]
mov eax, dword [ebx + 4]
mov edx, eax
add ebx, dword [ebp + 0x1c]
xor edx, dword [ecx + 4]
and eax, dword [ecx + 4]
mov ecx, dword [edi + 4]
shr edx, 1
and edx, 0x7f7f7f7f
add edx, eax
mov eax, ecx
xor eax, edx
or ecx, edx
shr eax, 1
and eax, 0x7f7f7f7f
sub ecx, eax
mov dword [edi + 4], ecx
mov ecx, dword [ebp + 0xc]
add ecx, dword [ebp + 0x18]
add edi, dword [ebp + 0x14]
mov dword [ebp + 0xc], ecx
sub esi, 1
jne 0x10073235
pop edi
pop ebx
pop esi
pop ebp
ret
Function at 0x100732a0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
mov esi, dword [ebp + 0xc]
push edi
mov edi, dword [ebp + 0x14]
mov dword [ebp - 0xc], 2
lea eax, [edi + 1]
imul eax, dword [ebp + 0x10]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 0x10]
imul eax, edi
mov dword [ebp - 0x14], eax
mov edx, dword [esi]
mov eax, edx
mov ebx, dword [esi + 1]
and eax, 0x3030303
add esi, dword [ebp + 0x10]
mov ecx, ebx
add eax, 0x1010101
shr ebx, 2
and ecx, 0x3030303
shr edx, 2
add eax, ecx
mov dword [ebp + 0xc], esi
mov dword [ebp - 4], eax
mov eax, 0x3f3f3f3f
and ebx, eax
and edx, eax
add ebx, edx
test edi, edi
jle 0x100733e9
lea eax, [edi - 1]
shr eax, 1
inc eax
mov dword [ebp - 8], eax
mov ecx, dword [esi]
mov edx, 0x3030303
mov edi, dword [esi + 1]
mov eax, ecx
and eax, edx
shr ecx, 2
mov esi, edi
shr edi, 2
and esi, edx
mov edx, dword [ebp - 4]
add esi, eax
mov eax, 0x3f3f3f3f
and ecx, eax
and edi, eax
add edi, ecx
mov ecx, dword [ebp + 8]
lea edx, [esi + edx]
shr edx, 2
mov ecx, dword [ecx]
and edx, 0xf0f0f0f
add edx, edi
mov eax, ecx
add edx, ebx
mov ebx, dword [ebp + 0xc]
add ebx, dword [ebp + 0x10]
xor eax, edx
or ecx, edx
shr eax, 1
and eax, 0x7f7f7f7f
mov dword [ebp + 0xc], ebx
sub ecx, eax
mov eax, dword [ebp + 8]
mov dword [eax], ecx
add eax, dword [ebp + 0x10]
mov edx, dword [ebx]
mov ebx, dword [ebx + 1]
mov ecx, ebx
mov dword [ebp + 8], eax
and ecx, 0x3030303
mov eax, edx
shr ebx, 2
shr edx, 2
and eax, 0x3030303
add ecx, 0x1010101
and edx, 0x3f3f3f3f
add eax, ecx
and ebx, 0x3f3f3f3f
mov ecx, dword [ebp + 8]
add ebx, edx
mov dword [ebp - 4], eax
lea edx, [esi + eax]
mov esi, dword [ebp + 0xc]
mov ecx, dword [ecx]
mov eax, ecx
add esi, dword [ebp + 0x10]
shr edx, 2
and edx, 0xf0f0f0f
mov dword [ebp + 0xc], esi
add edx, edi
add edx, ebx
xor eax, edx
or ecx, edx
mov edx, dword [ebp + 8]
shr eax, 1
and eax, 0x7f7f7f7f
sub ecx, eax
mov dword [edx], ecx
add edx, dword [ebp + 0x10]
sub dword [ebp - 8], 1
mov dword [ebp + 8], edx
jne 0x1007330f
mov edi, dword [ebp + 0x14]
jmp 0x100733ec
mov edx, dword [ebp + 8]
push 4
pop eax
sub eax, dword [ebp - 0x10]
add esi, eax
push 4
pop eax
sub eax, dword [ebp - 0x14]
add edx, eax
sub dword [ebp - 0xc], 1
mov dword [ebp + 8], edx
jne 0x100732c9
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x1007351e
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 0x20]
test ebx, ebx
jle 0x10073582
mov eax, dword [ebp + 0x10]
push esi
push edi
mov ecx, dword [ebp + 0xc]
movzx edx, word [ecx]
movzx ecx, word [eax]
mov esi, ecx
mov edi, ecx
xor esi, edx
or edi, edx
shr esi, 1
and esi, 0x7f7f7f7f
sub edi, esi
mov esi, dword [ebp + 8]
mov eax, edi
shr eax, 1
movzx edx, word [esi]
mov ecx, edx
or edi, edx
shr ecx, 1
xor ecx, eax
mov eax, dword [ebp + 0x18]
add dword [ebp + 0xc], eax
and ecx, 0x7f7f
mov eax, dword [ebp + 0x10]
sub edi, ecx
add eax, dword [ebp + 0x1c]
mov word [esi], di
add esi, dword [ebp + 0x14]
mov dword [ebp + 0x10], eax
mov dword [ebp + 8], esi
sub ebx, 1
jne 0x1007352e
pop edi
pop esi
pop ebx
pop ebp
ret