joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1018a150
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
mov eax, dword fs:[0]
mov edx, dword [ebp + 0xc]
push 0xffffffffffffffff
push 0x101a29f5
push eax
mov dword fs:[0], esp
sub esp, 0x10
cmp dword [edx + 0x14], 0xf
push ebx
push esi
push edi
mov ebx, ecx
mov edi, edx
jbe 0x1018a17d
mov edi, dword [edx]
xor ecx, ecx
mov esi, 0x811c9dc5
cmp dword [edx + 0x10], ecx
jbe 0x1018a1a2
nop dword [eax]
movzx eax, byte [edi + ecx]
inc ecx
xor eax, esi
imul esi, eax, 0x1000193
cmp ecx, dword [edx + 0x10]
jb 0x1018a190
push esi
push edx
lea eax, [ebp - 0x14]
mov ecx, ebx
push eax
call fcn.1007e9a0
mov ecx, dword [ebp - 0x10]
test ecx, ecx
je 0x1018a1d2
mov eax, dword [ebp + 8]
mov dword [eax], ecx
mov byte [eax + 4], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
cmp dword [ebx + 8], 0x71c71c7
jne 0x1018a1e6
push str.unordered_map_set_too_long
call dword [sym.imp.MSVCP140.dll_void___cdecl_std::_Xlength_error_char_const__]
lea eax, [ebx + 4]
mov dword [ebp - 0x1c], eax
mov dword [ebp - 4], 0
push 0x24
mov dword [ebp - 0x18], 0
call fcn.101983ec
add esp, 4
mov edi, eax
mov dword [ebp - 0x18], edi
push dword [ebp + 0xc]
lea ecx, [edi + 8]
call fcn.10092dd0
mov dword [edi + 0x20], 0
mov dword [ebp - 4], 1
mov eax, dword [ebx + 8]
inc eax
movss xmm3, dword [ebx]
movd xmm0, eax
cvtdq2pd xmm0, xmm0
shr eax, 0x1f
addsd xmm0, qword [eax*8 + 0x1023d960]
mov eax, dword [ebx + 0x1c]
movd xmm1, eax
cvtdq2pd xmm1, xmm1
shr eax, 0x1f
cvtpd2ps xmm0, xmm0
addsd xmm1, qword [eax*8 + 0x1023d960]
movaps xmm2, xmm0
cvtpd2ps xmm1, xmm1
divss xmm2, xmm1
comiss xmm2, xmm3
jbe 0x1018a2b4
divss xmm0, xmm3
call fcn.10076000
call fcn.10199810
mov ecx, 8
cmp eax, ecx
cmova ecx, eax
mov eax, dword [ebx + 0x1c]
cmp eax, ecx
jae 0x1018a298
cmp eax, 0x200
jae 0x1018a296
shl eax, 3
cmp eax, ecx
jae 0x1018a298
mov eax, ecx
push eax
mov ecx, ebx
call fcn.1007d5e0
push esi
lea eax, [edi + 8]
mov ecx, ebx
push eax
lea eax, [ebp - 0x1c]
push eax
call fcn.1007e9a0
mov edx, dword [eax]
jmp 0x1018a2b7
mov edx, dword [ebp - 0x14]
mov eax, dword [edx + 4]
inc dword [ebx + 8]
mov dword [edi + 4], eax
mov dword [edi], edx
mov dword [eax], edi
mov dword [edx + 4], edi
mov ecx, dword [ebx + 0xc]
mov dword [ebp + 0xc], eax
mov eax, dword [ebx + 0x18]
and eax, esi
mov esi, dword [ecx + eax*8]
cmp esi, dword [ebx + 4]
jne 0x1018a2df
mov dword [ecx + eax*8], edi
jmp 0x1018a2f1
cmp esi, edx
jne 0x1018a2e8
mov dword [ecx + eax*8], edi
jmp 0x1018a2f5
mov edx, dword [ebp + 0xc]
cmp dword [ecx + eax*8 + 4], edx
jne 0x1018a2f5
mov dword [ecx + eax*8 + 4], edi
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
mov dword [eax], edi
pop edi
pop esi
mov byte [eax + 4], 1
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x1018a570
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x101a2f2b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xc
push ebx
push esi
push edi
mov edi, ecx
lea ecx, [edi + 4]
mov dword [ebp - 0x10], edi
mov dword [ebp - 0x14], ecx
mov dword [ecx], 0
mov dword [ecx + 4], 0
mov dword [ecx + 8], 0
lea ebx, [edi + 0x10]
mov dword [ebp - 4], 0
mov dword [ebx], 0
mov dword [ebx + 4], 0
mov dword [ebx + 8], 0
mov byte [ebp - 4], 1
mov eax, dword [ebp + 8]
mov dword [edi], eax
mov eax, dword [ebp + 0xc]
mov dword [edi + 0x1c], 0
mov byte [edi + 0x20], 0
cmp ebx, eax
je 0x1018a68b
mov esi, dword [eax]
mov edi, dword [eax + 4]
mov edx, dword [ebx + 8]
sub edi, esi
mov dword [ebp + 8], esi
cmp edi, edx
jbe 0x1018a641
cmp edi, 0x7fffffff
ja 0x1018a740
mov ecx, edx
mov eax, 0x7fffffff
shr ecx, 1
sub eax, ecx
cmp edx, eax
jbe 0x1018a61d
mov eax, 0x7fffffff
jmp 0x1018a625
lea eax, [ecx + edx]
cmp eax, edi
cmovb eax, edi
push eax
mov ecx, ebx
call fcn.1018ab50
mov esi, dword [ebx]
push edi
push dword [ebp + 8]
push esi
call sub.VCRUNTIME140.dll_memmove
lea eax, [esi + edi]
mov dword [ebx + 4], eax
jmp 0x1018a682
mov eax, dword [ebx + 4]
mov dword [ebp + 8], eax
cmp edi, eax
jbe 0x1018a676
push eax
push esi
push 0
call sub.VCRUNTIME140.dll_memmove
mov eax, dword [ebp + 8]
add esi, eax
sub edi, eax
mov dword [ebp + 8], esi
mov esi, dword [ebx + 4]
push edi
push dword [ebp + 8]
push esi
call sub.VCRUNTIME140.dll_memmove
lea eax, [edi + esi]
add esp, 0x18
mov dword [ebx + 4], eax
jmp 0x1018a685
push edi
push esi
push 0
call sub.VCRUNTIME140.dll_memmove
mov dword [ebx + 4], edi
add esp, 0xc
mov edi, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x14]
mov esi, dword [ebx + 4]
sub esi, dword [ebx]
mov dword [edi + 0x1c], esi
mov eax, dword [ecx + 4]
mov edx, eax
mov ebx, dword [ecx]
sub edx, ebx
mov dword [ebp + 8], eax
cmp esi, edx
jae 0x1018a6ab
lea eax, [esi + ebx]
mov dword [ecx + 4], eax
jmp 0x1018a6d6
jbe 0x1018a6d6
mov eax, dword [ecx + 8]
sub eax, ebx
cmp esi, eax
jbe 0x1018a6bf
push ecx
push esi
call fcn.1018abd0
jmp 0x1018a6d6
mov ebx, dword [ebp + 8]
sub esi, edx
push esi
push 0
push ebx
call sub.VCRUNTIME140.dll_memset
lea eax, [esi + ebx]
add esp, 0xc
mov dword [edi + 8], eax
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [ebp + 0xc]
push eax
push 0x40
push dword [edi + 0x1c]
push dword [edi]
call esi
push dword [edi + 0x1c]
push dword [edi]
push dword [edi + 4]
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
lea eax, [ebp - 0x18]
push eax
push dword [ebp + 0xc]
push dword [edi + 0x1c]
push dword [edi]
call esi
call fcn.1018a520
mov dword [ebp + 8], edi
mov ecx, dword [eax + 4]
cmp ecx, dword [eax + 8]
je 0x1018a71f
mov dword [ecx], edi
add dword [eax + 4], 4
jmp 0x1018a72b
lea edx, [ebp + 8]
push edx
push ecx
mov ecx, eax
call fcn.100c7be0
mov ecx, dword [ebp - 0xc]
mov eax, edi
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 8
call fcn.10075e90
int3
Function at 0x10192070
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x14
push ebx
push esi
mov esi, dword [ebp + 8]
lea ebx, [ecx + 0x44]
push edi
mov al, byte [esi]
test al, al
jne 0x1019208f
mov eax, 0x811c9dc5
jmp 0x101920a5
movsx eax, al
lea ecx, [esi + 1]
xor eax, 0x811c9dc5
imul edx, eax, 0x1000193
call fcn.100981d0
mov dword [esp + 0x10], eax
mov ecx, ebx
lea eax, [esp + 0x10]
push eax
lea eax, [esp + 0x1c]
push eax
call fcn.10192160
mov eax, dword [eax]
cmp dword [eax + 0xc], 0
jne 0x10192113
mov ecx, dword [0x102556c0]
push esi
mov eax, dword [ecx]
call dword [eax + 0x34]
mov cl, byte [esi]
mov dword [esp + 0x10], eax
test cl, cl
jne 0x101920df
mov eax, 0x811c9dc5
jmp 0x101920f5
movsx eax, cl
lea ecx, [esi + 1]
xor eax, 0x811c9dc5
imul edx, eax, 0x1000193
call fcn.100981d0
mov dword [esp + 0x14], eax
mov ecx, ebx
lea eax, [esp + 0x14]
push eax
lea eax, [esp + 0x1c]
push eax
call fcn.10192160
mov ecx, dword [esp + 0x10]
mov eax, dword [eax]
mov dword [eax + 0xc], ecx
mov al, byte [esi]
test al, al
jne 0x10192120
mov eax, 0x811c9dc5
jmp 0x10192136
movsx eax, al
lea ecx, [esi + 1]
xor eax, 0x811c9dc5
imul edx, eax, 0x1000193
call fcn.100981d0
mov dword [esp + 0x14], eax
mov ecx, ebx
lea eax, [esp + 0x14]
push eax
lea eax, [esp + 0x1c]
push eax
call fcn.10192160
pop edi
pop esi
pop ebx
mov eax, dword [eax]
mov eax, dword [eax + 0xc]
mov esp, ebp
pop ebp
ret 4
Function at 0x10192160
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1019d735
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x10
push ebx
mov ebx, dword [ebp + 0xc]
push esi
push edi
mov edi, ecx
movzx eax, byte [ebx]
xor eax, 0x811c9dc5
imul edx, eax, 0x1000193
movzx eax, byte [ebx + 1]
xor edx, eax
movzx eax, byte [ebx + 2]
imul edx, edx, 0x1000193
xor edx, eax
movzx eax, byte [ebx + 3]
imul ecx, edx, 0x1000193
xor ecx, eax
imul eax, ecx, 0x1000193
mov ecx, edi
push eax
mov dword [ebp + 0xc], eax
lea eax, [ebp - 0x1c]
push ebx
push eax
call fcn.1008c820
mov ecx, dword [ebp - 0x18]
test ecx, ecx
je 0x101921e8
mov eax, dword [ebp + 8]
mov dword [eax], ecx
mov byte [eax + 4], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
cmp dword [edi + 8], 0xfffffff
jne 0x101921fc
push str.unordered_map_set_too_long
call dword [sym.imp.MSVCP140.dll_void___cdecl_std::_Xlength_error_char_const__]
lea eax, [edi + 4]
mov dword [ebp - 0x14], eax
mov dword [ebp - 4], 0
push 0x10
mov dword [ebp - 0x10], 0
call fcn.101983ec
mov ecx, dword [ebx]
mov esi, eax
add esp, 4
mov dword [ebp - 0x10], esi
mov dword [esi + 8], ecx
mov dword [esi + 0xc], 0
mov dword [ebp - 4], 1
mov eax, dword [edi + 8]
mov ebx, dword [edi + 0x1c]
inc eax
movss xmm3, dword [edi]
movd xmm0, eax
cvtdq2pd xmm0, xmm0
shr eax, 0x1f
movd xmm1, ebx
addsd xmm0, qword [eax*8 + 0x1023d960]
cvtdq2pd xmm1, xmm1
mov eax, ebx
shr eax, 0x1f
cvtpd2ps xmm0, xmm0
addsd xmm1, qword [eax*8 + 0x1023d960]
movaps xmm2, xmm0
cvtpd2ps xmm1, xmm1
divss xmm2, xmm1
comiss xmm2, xmm3
jbe 0x101922c6
divss xmm0, xmm3
call fcn.10076000
call fcn.10199810
mov ecx, 8
cmp eax, ecx
cmova ecx, eax
cmp ebx, ecx
jae 0x101922a8
cmp ebx, 0x200
jae 0x101922a6
shl ebx, 3
cmp ebx, ecx
jae 0x101922a8
mov ebx, ecx
push ebx
mov ecx, edi
call fcn.1007d470
push dword [ebp + 0xc]
lea eax, [esi + 8]
mov ecx, edi
push eax
lea eax, [ebp - 0x1c]
push eax
call fcn.1008c820
mov edx, dword [eax]
jmp 0x101922c9
mov edx, dword [ebp - 0x1c]
mov ebx, dword [edx + 4]
inc dword [edi + 8]
mov dword [esi], edx
mov dword [esi + 4], ebx
mov dword [ebx], esi
mov dword [edx + 4], esi
mov eax, dword [edi + 0x18]
and eax, dword [ebp + 0xc]
mov ecx, dword [edi + 0xc]
mov esi, dword [ebp - 0x14]
mov edi, dword [ecx + eax*8]
cmp edi, dword [esi]
mov esi, dword [ebp - 0x10]
jne 0x101922f4
mov dword [ecx + eax*8], esi
jmp 0x10192303
cmp edi, edx
jne 0x101922fd
mov dword [ecx + eax*8], esi
jmp 0x10192307
cmp dword [ecx + eax*8 + 4], ebx
jne 0x10192307
mov dword [ecx + eax*8 + 4], esi
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
pop edi
mov dword [eax], esi
pop esi
mov byte [eax + 4], 1
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x10193520
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 8]
movzx eax, byte [edx]
xor eax, 0x811c9dc5
imul ecx, eax, 0x1000193
movzx eax, byte [edx + 1]
xor ecx, eax
movzx eax, byte [edx + 2]
imul ecx, ecx, 0x1000193
xor ecx, eax
movzx eax, byte [edx + 3]
imul ecx, ecx, 0x1000193
xor ecx, eax
movzx eax, byte [edx + 4]
imul ecx, ecx, 0x1000193
xor ecx, eax
movzx eax, byte [edx + 5]
imul ecx, ecx, 0x1000193
xor ecx, eax
movzx eax, byte [edx + 6]
imul ecx, ecx, 0x1000193
xor ecx, eax
movzx eax, byte [edx + 7]
imul ecx, ecx, 0x1000193
xor ecx, eax
imul eax, ecx, 0x1000193
pop ebp
ret 4
Function at 0x10194830
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov edx, dword [ebp + 8]
mov eax, 0x1fffffff
push ebx
mov ebx, ecx
bsr ecx, eax
push esi
push edi
mov edi, 1
mov dword [ebp - 4], ebx
mov eax, edi
shl eax, cl
cmp edx, eax
jbe 0x10194861
push str.invalid_hash_bucket_count
call dword [sym.imp.MSVCP140.dll_void___cdecl_std::_Xlength_error_char_const__]
mov esi, dword [ebx + 4]
lea eax, [edx - 1]
or eax, 1
mov dword [ebp + 8], esi
bsr ecx, eax
push esi
lea ecx, [ecx + 1]
shl edi, cl
lea ecx, [ebx + 0xc]
lea eax, [edi + edi]
push eax
call fcn.100744d0
lea eax, [edi - 1]
mov dword [ebx + 0x1c], edi
mov dword [ebx + 0x18], eax
mov eax, dword [ebx + 4]
mov eax, dword [eax]
mov ecx, eax
cmp eax, esi
je 0x1019496c
nop word [eax + eax]
movzx edx, byte [eax + 8]
xor edx, 0x811c9dc5
mov ecx, dword [ecx]
imul edi, edx, 0x1000193
movzx edx, byte [eax + 9]
xor edi, edx
movzx edx, byte [eax + 0xa]
imul edi, edi, 0x1000193
xor edi, edx
movzx edx, byte [eax + 0xb]
imul edi, edi, 0x1000193
xor edi, edx
mov edx, dword [ebx + 0xc]
imul edi, edi, 0x1000193
and edi, dword [ebx + 0x18]
lea edx, [edx + edi*8]
mov edi, dword [edx]
mov dword [ebp - 8], edx
cmp edi, esi
jne 0x101948ef
mov dword [edx], eax
mov dword [edx + 4], eax
jmp 0x10194962
mov edx, dword [edx + 4]
mov ebx, dword [eax + 8]
cmp ebx, dword [edx + 8]
jne 0x10194929
mov edx, dword [edx]
mov dword [ebp - 0xc], edx
cmp edx, eax
je 0x10194921
mov ebx, dword [eax + 4]
mov esi, dword [ebp - 0xc]
mov dword [ebx], ecx
mov edi, dword [ecx + 4]
mov dword [edi], edx
mov edx, dword [edx + 4]
mov dword [edx], eax
mov dword [esi + 4], edi
mov esi, dword [ebp + 8]
mov dword [ecx + 4], ebx
mov dword [eax + 4], edx
mov edx, dword [ebp - 8]
mov dword [edx + 4], eax
jmp 0x1019495f
cmp edi, edx
je 0x1019493c
nop dword [eax]
mov edx, dword [edx + 4]
cmp ebx, dword [edx + 8]
je 0x10194975
cmp edi, edx
jne 0x10194930
mov ebx, dword [eax + 4]
mov dword [ebp - 0xc], ebx
mov dword [ebx], ecx
mov ebx, dword [ecx + 4]
mov dword [ebx], edx
mov edi, dword [edx + 4]
mov dword [edi], eax
mov dword [edx + 4], ebx
mov edx, dword [ebp - 0xc]
mov dword [ecx + 4], edx
mov edx, dword [ebp - 8]
mov dword [eax + 4], edi
mov dword [edx], eax
mov ebx, dword [ebp - 4]
mov eax, ecx
cmp ecx, esi
jne 0x101948a0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
mov ebx, dword [eax + 4]
mov edx, dword [edx]
mov dword [ebp - 0xc], edx
mov esi, edx
mov dword [ebx], ecx
mov edi, dword [ecx + 4]
mov dword [edi], edx
mov edx, dword [edx + 4]
mov dword [edx], eax
mov dword [esi + 4], edi
mov esi, dword [ebp + 8]
mov dword [ecx + 4], ebx
mov dword [eax + 4], edx
jmp 0x1019495f
Function at 0x10195990
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, ecx
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, edx
mov eax, dword [ebx]
nop
cmp edi, 7
ja case.default.0x101959a5
jmp dword [edi*4 + 0x10195b3c]
mov ecx, esi
and ecx, 3
sub edi, ecx
sub ecx, 1
je 0x101959e8
sub ecx, 1
je 0x101959d5
sub ecx, 1
jne 0x101959fb
movzx edx, byte [esi]
movzx ecx, al
xor edx, ecx
shr eax, 8
xor eax, dword [edx*4 + 0x1021b3c0]
inc esi
movzx edx, byte [esi]
movzx ecx, al
xor edx, ecx
shr eax, 8
xor eax, dword [edx*4 + 0x1021b3c0]
inc esi
movzx edx, byte [esi]
movzx ecx, al
xor edx, ecx
shr eax, 8
xor eax, dword [edx*4 + 0x1021b3c0]
inc esi
mov edx, edi
sar edx, 3
test edx, edx
je 0x10195a7d
xor eax, dword [esi]
movzx ecx, al
shr eax, 8
xor eax, dword [ecx*4 + 0x1021b3c0]
movzx ecx, al
shr eax, 8
xor eax, dword [ecx*4 + 0x1021b3c0]
movzx ecx, al
shr eax, 8
xor eax, dword [ecx*4 + 0x1021b3c0]
mov ecx, eax
movzx eax, cl
shr ecx, 8
mov eax, dword [eax*4 + 0x1021b3c0]
xor eax, dword [esi + 4]
add esi, 8
xor eax, ecx
movzx ecx, al
shr eax, 8
xor eax, dword [ecx*4 + 0x1021b3c0]
movzx ecx, al
shr eax, 8
xor eax, dword [ecx*4 + 0x1021b3c0]
movzx ecx, al
shr eax, 8
xor eax, dword [ecx*4 + 0x1021b3c0]
movzx ecx, al
shr eax, 8
xor eax, dword [ecx*4 + 0x1021b3c0]
sub edx, 1
jne 0x10195a04
and edi, 7
jmp 0x101959a0
movzx edx, byte [esi]
movzx ecx, al
xor edx, ecx
shr eax, 8
xor eax, dword [edx*4 + 0x1021b3c0]
inc esi
movzx edx, byte [esi]
movzx ecx, al
xor edx, ecx
shr eax, 8
xor eax, dword [edx*4 + 0x1021b3c0]
inc esi
movzx edx, byte [esi]
movzx ecx, al
xor edx, ecx
shr eax, 8
xor eax, dword [edx*4 + 0x1021b3c0]
inc esi
xor eax, dword [esi]
movzx ecx, al
shr eax, 8
pop edi
pop esi
xor eax, dword [ecx*4 + 0x1021b3c0]
movzx ecx, al
shr eax, 8
xor eax, dword [ecx*4 + 0x1021b3c0]
movzx ecx, al
shr eax, 8
xor eax, dword [ecx*4 + 0x1021b3c0]
movzx ecx, al
shr eax, 8
xor eax, dword [ecx*4 + 0x1021b3c0]
mov dword [ebx], eax
pop ebx
pop ebp
ret
movzx edx, byte [esi]
movzx ecx, al
xor edx, ecx
shr eax, 8
xor eax, dword [edx*4 + 0x1021b3c0]
inc esi
movzx edx, byte [esi]
movzx ecx, al
xor edx, ecx
shr eax, 8
xor eax, dword [edx*4 + 0x1021b3c0]
inc esi
movzx edx, byte [esi]
movzx ecx, al
xor edx, ecx
shr eax, 8
xor eax, dword [edx*4 + 0x1021b3c0]
pop edi
pop esi
mov dword [ebx], eax
pop ebx
pop ebp
ret
Function at 0x101961d0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push esi
push edi
mov edi, ecx
mov edx, edi
lea ecx, [edx + 1]
nop
mov al, byte [edx]
inc edx
test al, al
jne 0x101961e0
xor esi, esi
mov eax, 0x811c9dc5
sub edx, ecx
je 0x10196236
movzx ecx, byte [edi + esi]
inc esi
xor ecx, eax
imul eax, ecx, 0x1000193
cmp esi, edx
jb 0x101961f2
cmp eax, 0x7c4a5426
ja 0x10196253
je 0x101962ad
cmp eax, 0x39c98ba1
ja 0x1019623e
je 0x101962ad
cmp eax, 0x2eb1674
je 0x101962ad
cmp eax, 0x19acc50e
je 0x101962ad
cmp eax, 0x2a5bf553
je 0x101962ad
xor al, al
pop edi
pop esi
mov esp, ebp
pop ebp
ret
cmp eax, 0x3a712436
je 0x101962ad
cmp eax, 0x43d6266e
je 0x101962ad
cmp eax, 0x4d7aa8c1
jmp 0x10196234
cmp eax, 0xcb7412ac
ja 0x10196281
je 0x101962ad
cmp eax, 0x9d08c4c8
ja 0x10196273
je 0x101962ad
cmp eax, 0x7f11af2d
je 0x101962ad
cmp eax, 0x84ea2fe5
jmp 0x10196234
cmp eax, 0xa7eab73f
je 0x101962ad
cmp eax, 0xc941ff64
jmp 0x10196234
cmp eax, 0xe80bc214
ja 0x10196298
je 0x101962ad
cmp eax, 0xd614ea2e
je 0x101962ad
cmp eax, 0xe1525a25
jmp 0x10196234
cmp eax, 0xee7a29e8
je 0x101962ad
cmp eax, 0xf8573d98
sete al
pop edi
pop esi
mov esp, ebp
pop ebp
ret
pop edi
mov al, 1
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x101962c0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push esi
push edi
mov edi, ecx
mov edx, edi
lea ecx, [edx + 1]
nop
mov al, byte [edx]
inc edx
test al, al
jne 0x101962d0
xor esi, esi
sub edx, ecx
mov ecx, 0x811c9dc5
je 0x10196315
movzx eax, byte [edi + esi]
inc esi
xor eax, ecx
imul ecx, eax, 0x1000193
cmp esi, edx
jb 0x101962e2
cmp ecx, 0x5978b32e
ja 0x1019631d
je 0x10196334
cmp ecx, 0x1b20e275
je 0x10196334
cmp ecx, 0x3cb8abb3
je 0x10196334
cmp ecx, 0x4c849f3c
je 0x10196334
xor al, al
pop edi
pop esi
mov esp, ebp
pop ebp
ret
cmp ecx, 0x97113ea7
je 0x10196334
cmp ecx, 0xa8d619ea
sete al
pop edi
pop esi
mov esp, ebp
pop ebp
ret
pop edi
mov al, 1
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x10196340
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push esi
push edi
mov edi, ecx
mov edx, edi
lea ecx, [edx + 1]
nop
mov al, byte [edx]
inc edx
test al, al
jne 0x10196350
xor esi, esi
sub edx, ecx
mov ecx, 0x811c9dc5
je 0x101963cf
movzx eax, byte [edi + esi]
inc esi
xor eax, ecx
imul ecx, eax, 0x1000193
cmp esi, edx
jb 0x10196362
cmp ecx, 0x92bbd4c5
ja 0x101963b0
je 0x101963a8
cmp ecx, 0x40401f1c
je 0x101963a8
cmp ecx, 0x688917bf
je 0x101963a8
cmp ecx, 0x74386b5b
jne 0x101963cf
mov eax, dword [0x102556c0]
push str.SpellbookFlying_n
push eax
mov ecx, dword [eax]
call dword [ecx + 0x60]
add esp, 8
mov al, 1
pop edi
pop esi
mov esp, ebp
pop ebp
ret
cmp ecx, 0xdd7b05fd
je 0x101963a8
cmp ecx, 0xe5a5eadf
je 0x101963a8
cmp ecx, 0xf51a72ab
sete al
pop edi
pop esi
mov esp, ebp
pop ebp
ret
pop edi
xor al, al
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x10196ce0
Capabilities:
Enumerate threads
Suspend thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
mov esi, ecx
mov dword [ebp - 4], edx
push edi
push 0
push 4
mov dword [esi], 0
mov dword [esi + 4], 0
mov dword [esi + 8], 0
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov edi, eax
cmp edi, 0xffffffff
je 0x10196dd3
lea eax, [ebp - 0x20]
mov dword [ebp - 0x20], 0x1c
push eax
push edi
call dword [sym.imp.KERNEL32.dll_Thread32First]
test eax, eax
je 0x10196dcc
mov ebx, dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
cmp dword [ebp - 0x20], 0x10
jb 0x10196db2
call ebx
cmp dword [ebp - 0x14], eax
jne 0x10196db2
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp dword [ebp - 0x18], eax
je 0x10196db2
mov edx, dword [esi]
test edx, edx
jne 0x10196d78
push 0x200
push edx
push dword [0x102569bc]
mov dword [esi + 4], 0x80
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov edx, eax
mov dword [esi], edx
test edx, edx
je 0x10196dcc
jmp 0x10196da3
mov eax, dword [esi + 4]
cmp dword [esi + 8], eax
jb 0x10196da3
shl eax, 3
push eax
push edx
push 0
push dword [0x102569bc]
call dword [sym.imp.KERNEL32.dll_HeapReAlloc]
mov edx, eax
test edx, edx
je 0x10196dcc
mov eax, dword [esi + 4]
add eax, eax
mov dword [esi], edx
mov dword [esi + 4], eax
mov ecx, dword [esi + 8]
mov eax, dword [ebp - 0x18]
mov dword [edx + ecx*4], eax
lea eax, [ecx + 1]
mov dword [esi + 8], eax
lea eax, [ebp - 0x20]
mov dword [ebp - 0x20], 0x1c
push eax
push edi
call dword [sym.imp.KERNEL32.dll_Thread32Next]
test eax, eax
jne 0x10196d37
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [esi], 0
je 0x10196e19
xor edi, edi
cmp dword [esi + 8], edi
jbe 0x10196e19
nop
mov eax, dword [esi]
push dword [eax + edi*4]
push 0
push 0x5a
call dword [sym.imp.KERNEL32.dll_OpenThread]
mov ebx, eax
test ebx, ebx
je 0x10196e13
push ebx
call dword [sym.imp.KERNEL32.dll_SuspendThread]
push dword [ebp + 8]
mov edx, dword [ebp - 4]
mov ecx, ebx
call fcn.10196ba0
add esp, 4
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
inc edi
cmp edi, dword [esi + 8]
jb 0x10196de0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10196e20
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
imul esi, ecx, 0x2c
mov ebx, edx
push edi
add esi, dword [0x10322510]
mov eax, dword [esi]
mov cl, byte [esi + 0x14]
and cl, 1
lea edi, [eax - 5]
cmove edi, eax
movzx eax, cl
lea ecx, [ebp - 4]
push ecx
push 0x40
lea eax, [eax*2 + 5]
push eax
push edi
mov dword [ebp - 8], eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x10196e6d
pop edi
pop esi
mov eax, 0xa
pop ebx
mov esp, ebp
pop ebp
ret
test ebx, ebx
je 0x10196e8e
mov byte [edi], 0xe9
mov eax, dword [esi + 4]
sub eax, edi
sub eax, 5
mov dword [edi + 1], eax
test byte [esi + 0x14], 1
je 0x10196eaf
mov eax, dword [esi]
mov word [eax], 0xf9eb
jmp 0x10196eaf
mov eax, dword [esi + 0xc]
test byte [esi + 0x14], 1
mov dword [edi], eax
je 0x10196ea9
mov ax, word [esi + 0x10]
mov word [edi + 4], ax
mov al, byte [esi + 0x12]
mov byte [edi + 6], al
jmp 0x10196eaf
mov al, byte [esi + 0x10]
mov byte [edi + 4], al
lea eax, [ebp - 4]
push eax
push dword [ebp - 4]
push dword [ebp - 8]
push edi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
push dword [ebp - 8]
push edi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_FlushInstructionCache]
mov cl, bl
shl bl, 2
add cl, cl
xor cl, byte [esi + 0x14]
and cl, 2
xor cl, byte [esi + 0x14]
xor bl, cl
and bl, 4
xor bl, cl
xor eax, eax
pop edi
mov byte [esi + 0x14], bl
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x10196f00
Capabilities:
Resume thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov edx, dword [0x10322518]
push ebx
push esi
push edi
xor edi, edi
xor esi, esi
mov dword [ebp - 4], edi
mov ebx, ecx
test edx, edx
je 0x10196ff1
mov eax, dword [0x10322510]
add eax, 0x14
movzx ecx, byte [eax]
shr ecx, 1
and ecx, 1
cmp ecx, ebx
jne 0x10196f45
inc esi
add eax, 0x2c
cmp esi, edx
jb 0x10196f28
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
cmp esi, 0xffffffff
je 0x10196ff1
xor eax, eax
lea ecx, [ebp - 0x10]
test ebx, ebx
setne al
or edx, 0xffffffff
push eax
call fcn.10196ce0
mov ecx, dword [0x10322518]
add esp, 4
cmp esi, ecx
jae 0x10196fa5
imul edi, esi, 0x2c
mov eax, dword [0x10322510]
movzx eax, byte [edi + eax + 0x14]
shr eax, 1
and eax, 1
cmp eax, ebx
je 0x10196f9a
mov edx, ebx
mov ecx, esi
call fcn.10196e20
mov dword [ebp - 4], eax
test eax, eax
jne 0x10196fa2
mov ecx, dword [0x10322518]
inc esi
add edi, 0x2c
cmp esi, ecx
jb 0x10196f71
mov edi, dword [ebp - 4]
mov eax, dword [ebp - 0x10]
test eax, eax
je 0x10196ff1
xor esi, esi
cmp dword [ebp - 8], esi
jbe 0x10196fe2
mov edi, eax
push dword [edi + esi*4]
push 0
push 0x5a
call dword [sym.imp.KERNEL32.dll_OpenThread]
mov ebx, eax
test ebx, ebx
je 0x10196fd6
push ebx
call dword [sym.imp.KERNEL32.dll_ResumeThread]
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
inc esi
cmp esi, dword [ebp - 8]
jb 0x10196fb5
mov edi, dword [ebp - 4]
mov eax, dword [ebp - 0x10]
push eax
push 0
push dword [0x102569bc]
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret