joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10195428
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x2d0
mov eax, dword [0x103c2010]
xor eax, ebp
mov dword [ebp - 0x10], eax
mov al, byte [ecx + 0x2cd]
test al, 1
jne 0x10195639
mov ebx, ecx
movzx eax, byte [0x103c9747]
test al, al
jns 0x1019545e
mov eax, dword [0x103c9740]
test eax, eax
je 0x10195639
push 0x103c973c
call fcn.101f9f70
add esp, 4
test al, al
je 0x10195639
lea edi, [ebp - 0x2a4]
push 0x294
push 0xff
push edi
call fcn.102f7d80
add esp, 0xc
mov ecx, edi
push 2
push 0
push 0x103c973c
call fcn.101fafb0
xor eax, eax
dec eax
lea esi, [ebp - 0x2b0]
mov dword [esi], eax
mov dword [esi + 4], eax
mov dword [esi + 8], eax
mov ecx, edi
push esi
call fcn.101fb1c0
mov ecx, esi
movzx eax, byte [esi + 0xb]
test al, al
jns 0x101954cd
mov eax, dword [ebp - 0x2ac]
test eax, eax
mov dword [ebp - 0x2dc], ebx
je 0x10195607
mov dword [ebp - 0x2d8], 0
lea edi, [ebp - 0x2c8]
lea esi, [ebp - 0x2bc]
mov ebx, esi
xor eax, eax
dec eax
mov dword [ebp - 0x2bc], eax
mov dword [ebp - 0x2b8], eax
mov dword [ebp - 0x2b4], eax
mov esi, edi
lea edi, [ebp - 0x2d4]
push edi
call fcn.10223c20
mov ecx, edi
mov edi, esi
push esi
call fcn.102250c0
movzx eax, byte [ebp - 0x2bd]
mov edx, esi
test al, al
jns 0x10195539
mov edx, dword [ebp - 0x2c8]
mov eax, dword [ebp - 0x2c4]
mov esi, ebx
mov ecx, ebx
push eax
push edx
call fcn.102019f0
cmp byte [ebp - 0x2bd], 0
jns 0x1019555b
push dword [ebp - 0x2c8]
call fcn.102f3c66
add esp, 4
lea ecx, [ebp - 0x2d4]
call fcn.102233c0
mov ecx, esi
call fcn.10201d20
test al, al
je 0x101955c0
cmp byte [ebp + 8], 0
jne 0x101955ba
lea ebx, [ebp - 0x2b0]
push ebx
call fcn.101fd8a0
add esp, 4
test al, al
jne 0x101955c0
mov ecx, ebx
push edi
call fcn.10223c20
cmp byte [ebp - 0x2bd], 0
mov eax, edi
jns 0x101955a3
mov eax, dword [ebp - 0x2c8]
push eax
mov ebx, dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
call ebx
mov ecx, edi
call fcn.102233c0
push 0x10352860
call ebx
inc dword [ebp - 0x2d8]
mov ecx, esi
call fcn.1017fca0
lea ecx, [ebp - 0x2a4]
push esi
call fcn.101fb1c0
lea ecx, [ebp - 0x2b0]
push esi
call fcn.10223400
mov ecx, esi
call fcn.102233c0
movzx eax, byte [ebp - 0x2a5]
test al, al
jns 0x101955f7
mov eax, dword [ebp - 0x2ac]
test eax, eax
lea ecx, [ebp - 0x2b0]
jne 0x101954f1
jmp 0x10195611
mov dword [ebp - 0x2d8], 0
lea ecx, [ebp - 0x2b0]
call fcn.102233c0
mov eax, dword [ebp - 0x2dc]
mov ecx, dword [ebp - 0x2d8]
mov dword [eax + 0x26c], ecx
lea ecx, [ebp - 0x2a4]
call fcn.101fb150
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.102f4c53
add esp, 0x2d0
pop esi
pop edi
pop ebx
pop ebp
ret 4
Function at 0x10195650
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x10
mov esi, ecx
mov eax, dword [0x103c2010]
xor eax, ebp
mov dword [ebp - 0x10], eax
movzx eax, byte [0x103c9747]
test al, al
jns 0x10195675
mov eax, dword [0x103c9740]
test eax, eax
je 0x10195721
mov eax, dword [0x103c38e8]
cmp eax, 0xffffffff
jne 0x101956f3
xor eax, eax
dec eax
lea edi, [ebp - 0x1c]
mov dword [edi], eax
mov dword [edi + 4], eax
mov dword [edi + 8], eax
mov ecx, edi
call fcn.100e857c
push edi
push str.COREWEBVIEW2_MAX_INSTANCES
call fcn.100e8530
add esp, 8
test al, al
je 0x101956d3
lea ecx, [ebp - 0x1c]
call fcn.100b8830
push 0xa
push 0
push eax
call fcn.1030a283
add esp, 0xc
mov dword [0x103c38e8], eax
push str.Found_override_at_COREWEBVIEW2_MAX_INSTANCES_n
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp dword [0x103c38e8], 0
jg 0x101956e6
mov dword [0x103c38e8], 0x14
lea ecx, [ebp - 0x1c]
call fcn.100e858e
mov eax, dword [0x103c38e8]
cmp dword [esi + 0x26c], eax
jle 0x10195721
mov ecx, esi
push 0
call fcn.10195428
mov eax, dword [esi + 0x26c]
cmp eax, dword [0x103c38e8]
jle 0x10195721
push str.WebView_found_too_many_old_versions_of_Edge_installed.Try_closing_the_webview_instances_and_deleting_old_Edge_versions._n
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov bl, 1
jmp 0x10195723
xor ebx, ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.102f4c53
mov eax, ebx
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x101a0cb8
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
mov esi, ecx
movzx eax, byte [ecx + 0x10d]
shl eax, 3
mov edi, dword [sym.imp.USER32.dll_ShowWindow]
push eax
push dword [ecx + 0x1c]
call edi
movzx eax, byte [esi + 0x10d]
shl eax, 3
push eax
push dword [esi + 0x108]
call edi
cmp dword [esi + 0x60], 0
je 0x101a0d1a
mov ecx, dword [esi + 0x5c]
call fcn.1019af90
test al, al
jne 0x101a0d1a
mov ecx, dword [esi + 0x60]
movzx eax, byte [esi + 0x10d]
push eax
call fcn.101705d0
cmp byte [esi + 0x10d], 0
je 0x101a0d1a
mov ecx, esi
call fcn.101a3d48
pop esi
pop edi
pop ebp
ret 4
Function at 0x101a3a06
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x18
mov edi, ecx
mov eax, dword [0x103c2010]
xor eax, ebp
mov dword [ebp - 0x10], eax
call fcn.102551b0
mov eax, dword [0x103d9c24]
mov dword [ebp - 0x20], eax
mov eax, dword [0x103d9c28]
mov dword [ebp - 0x1c], eax
mov eax, dword [0x103d9c2c]
mov dword [ebp - 0x18], eax
mov eax, dword [0x103d9c30]
mov dword [ebp - 0x14], eax
xor esi, esi
mov ebx, dword [sym.imp.USER32.dll_ChangeWindowMessageFilterEx]
push 0
push 1
push dword [ebp + esi*4 - 0x20]
push dword [edi + 0x1c]
call ebx
inc esi
cmp esi, 4
jne 0x101a3a48
xor esi, esi
mov ecx, edi
push esi
push 0x40000000
call fcn.101a4a6c
push 1
push dword [edi + 0x108]
call dword [sym.imp.USER32.dll_GetSystemMenu]
mov eax, dword [edi + 0x108]
sub esp, 0x1c
mov dword [esp + 0x14], esi
movaps xmm0, xmmword [0x10354dd0]
movups xmmword [esp + 4], xmm0
mov dword [esp], eax
mov dword [esp + 0x18], 0x13
call dword [sym.imp.USER32.dll_SetWindowPos]
test eax, eax
jne 0x101a3b1f
call dword [sym.imp.KERNEL32.dll_GetLastError]
movzx esi, ax
or esi, 0x80070000
test eax, eax
cmovle esi, eax
push str.SetWindowPos_failed_before_parenting_browser_window_with_error:
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov eax, 0x1034e5c4
lea ebx, [ebp - 0x20]
mov dword [ebx], eax
mov dword [ebx + 4], esi
xor eax, eax
mov dword [ebx + 8], eax
mov dword [ebx + 0xc], eax
mov ecx, ebx
call fcn.1008957a
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov eax, 0x1034e5c4
mov dword [ebx], eax
mov esi, dword [ebx + 8]
test esi, esi
je 0x101a3b04
mov eax, dword [esi]
mov ecx, dword [eax + 8]
call dword [section..00cfg]
push esi
call ecx
mov eax, dword [ebp - 0x14]
test eax, eax
je 0x101a3b12
push eax
call dword [sym.imp.KERNEL32.dll_LocalFree]
push 0x10352860
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
xor esi, esi
push dword [edi + 0x1c]
push dword [edi + 0x108]
call dword [sym.imp.USER32.dll_SetParent]
test eax, eax
jne 0x101a3baa
call dword [sym.imp.KERNEL32.dll_GetLastError]
movzx esi, ax
or esi, 0x80070000
test eax, eax
cmovle esi, eax
push str.SetParent_failed_while_parenting_browser_window_with_error:
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov ebx, 0x1034e5c4
lea edi, [ebp - 0x20]
mov dword [edi], ebx
mov dword [ebp - 0x24], esi
mov dword [edi + 4], esi
xor eax, eax
mov dword [edi + 8], eax
mov dword [edi + 0xc], eax
mov ecx, edi
call fcn.1008957a
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov dword [edi], ebx
mov esi, dword [edi + 8]
test esi, esi
je 0x101a3b8e
mov eax, dword [esi]
mov ecx, dword [eax + 8]
call dword [section..00cfg]
push esi
call ecx
mov eax, dword [ebp - 0x14]
test eax, eax
je 0x101a3b9c
push eax
call dword [sym.imp.KERNEL32.dll_LocalFree]
push 0x10352860
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov esi, dword [ebp - 0x24]
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.102f4c53
mov eax, esi
add esp, 0x18
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x101a53b0
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
push eax
cmp dword [ecx + 0x60], 0
je 0x101a5472
mov esi, ecx
mov ecx, dword [ecx + 0x5c]
call fcn.1019af90
test al, al
jne 0x101a5472
mov eax, dword [esi + 0x100]
dec eax
cmp eax, 2
jae 0x101a53f1
mov ecx, dword [esi + 0x60]
push dword [esi + 0x108]
push 1
call fcn.10170f70
jmp 0x101a53fd
push dword [esi + 0x108]
call dword [sym.imp.USER32.dll_SetFocus]
cmp byte [esi + 0x10c], 0
jne 0x101a5472
push 9
call dword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
jns 0x101a5472
push 0xa0
call dword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
js 0x101a5436
push 0xa1
call dword [sym.imp.USER32.dll_GetKeyState]
movzx ebx, ax
shr ebx, 0xf
jmp 0x101a5438
mov bl, 1
mov eax, ebx
xor al, 1
movzx edi, al
mov eax, dword [esi + 0x1c]
mov dword [ebp - 0x10], eax
push 2
push dword [esi + 0x104]
call dword [sym.imp.USER32.dll_GetAncestor]
push edi
push dword [ebp - 0x10]
push eax
call dword [sym.imp.USER32.dll_GetNextDlgTabItem]
cmp eax, dword [ebp + 8]
jne 0x101a5472
mov ecx, dword [esi + 0x60]
movzx eax, bl
inc eax
push 0
push eax
call fcn.10170680
add esp, 4
pop esi
pop edi
pop ebx
pop ebp
ret 4
Function at 0x101b2c3a
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x2d0
mov eax, dword [0x103c2010]
xor eax, ebp
mov dword [ebp - 0x10], eax
mov al, byte [ecx + 0x2a5]
test al, 1
jne 0x101b2e4b
mov ebx, ecx
movzx eax, byte [0x103c97b3]
test al, al
jns 0x101b2c70
mov eax, dword [0x103c97ac]
test eax, eax
je 0x101b2e4b
push 0x103c97a8
call fcn.101f9f70
add esp, 4
test al, al
je 0x101b2e4b
lea edi, [ebp - 0x2a4]
push 0x294
push 0xff
push edi
call fcn.102f7d80
add esp, 0xc
mov ecx, edi
push 2
push 0
push 0x103c97a8
call fcn.101fafb0
xor eax, eax
dec eax
lea esi, [ebp - 0x2b0]
mov dword [esi], eax
mov dword [esi + 4], eax
mov dword [esi + 8], eax
mov ecx, edi
push esi
call fcn.101fb1c0
mov ecx, esi
movzx eax, byte [esi + 0xb]
test al, al
jns 0x101b2cdf
mov eax, dword [ebp - 0x2ac]
test eax, eax
mov dword [ebp - 0x2dc], ebx
je 0x101b2e19
mov dword [ebp - 0x2d8], 0
lea edi, [ebp - 0x2c8]
lea esi, [ebp - 0x2bc]
mov ebx, esi
xor eax, eax
dec eax
mov dword [ebp - 0x2bc], eax
mov dword [ebp - 0x2b8], eax
mov dword [ebp - 0x2b4], eax
mov esi, edi
lea edi, [ebp - 0x2d4]
push edi
call fcn.10223c20
mov ecx, edi
mov edi, esi
push esi
call fcn.102250c0
movzx eax, byte [ebp - 0x2bd]
mov edx, esi
test al, al
jns 0x101b2d4b
mov edx, dword [ebp - 0x2c8]
mov eax, dword [ebp - 0x2c4]
mov esi, ebx
mov ecx, ebx
push eax
push edx
call fcn.102019f0
cmp byte [ebp - 0x2bd], 0
jns 0x101b2d6d
push dword [ebp - 0x2c8]
call fcn.102f3c66
add esp, 4
lea ecx, [ebp - 0x2d4]
call fcn.102233c0
mov ecx, esi
call fcn.10201d20
test al, al
je 0x101b2dd2
cmp byte [ebp + 8], 0
jne 0x101b2dcc
lea ebx, [ebp - 0x2b0]
push ebx
call fcn.101fd8a0
add esp, 4
test al, al
jne 0x101b2dd2
mov ecx, ebx
push edi
call fcn.10223c20
cmp byte [ebp - 0x2bd], 0
mov eax, edi
jns 0x101b2db5
mov eax, dword [ebp - 0x2c8]
push eax
mov ebx, dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
call ebx
mov ecx, edi
call fcn.102233c0
push 0x10352860
call ebx
inc dword [ebp - 0x2d8]
mov ecx, esi
call fcn.1017fca0
lea ecx, [ebp - 0x2a4]
push esi
call fcn.101fb1c0
lea ecx, [ebp - 0x2b0]
push esi
call fcn.10223400
mov ecx, esi
call fcn.102233c0
movzx eax, byte [ebp - 0x2a5]
test al, al
jns 0x101b2e09
mov eax, dword [ebp - 0x2ac]
test eax, eax
lea ecx, [ebp - 0x2b0]
jne 0x101b2d03
jmp 0x101b2e23
mov dword [ebp - 0x2d8], 0
lea ecx, [ebp - 0x2b0]
call fcn.102233c0
mov eax, dword [ebp - 0x2dc]
mov ecx, dword [ebp - 0x2d8]
mov dword [eax + 0x244], ecx
lea ecx, [ebp - 0x2a4]
call fcn.101fb150
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.102f4c53
add esp, 0x2d0
pop esi
pop edi
pop ebx
pop ebp
ret 4
Function at 0x101b2e62
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x10
mov esi, ecx
mov eax, dword [0x103c2010]
xor eax, ebp
mov dword [ebp - 0x10], eax
movzx eax, byte [0x103c97b3]
test al, al
jns 0x101b2e87
mov eax, dword [0x103c97ac]
test eax, eax
je 0x101b2f33
mov eax, dword [0x103c39b0]
cmp eax, 0xffffffff
jne 0x101b2f05
xor eax, eax
dec eax
lea edi, [ebp - 0x1c]
mov dword [edi], eax
mov dword [edi + 4], eax
mov dword [edi + 8], eax
mov ecx, edi
call fcn.100e857c
push edi
push str.COREWEBVIEW2_MAX_INSTANCES
call fcn.100e8530
add esp, 8
test al, al
je 0x101b2ee5
lea ecx, [ebp - 0x1c]
call fcn.100b8830
push 0xa
push 0
push eax
call fcn.1030a283
add esp, 0xc
mov dword [0x103c39b0], eax
push str.Found_override_at_COREWEBVIEW2_MAX_INSTANCES_n
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp dword [0x103c39b0], 0
jg 0x101b2ef8
mov dword [0x103c39b0], 0x14
lea ecx, [ebp - 0x1c]
call fcn.100e858e
mov eax, dword [0x103c39b0]
cmp dword [esi + 0x244], eax
jle 0x101b2f33
mov ecx, esi
push 0
call fcn.101b2c3a
mov eax, dword [esi + 0x244]
cmp eax, dword [0x103c39b0]
jle 0x101b2f33
push str.WebView_found_too_many_old_versions_of_Edge_installed.Try_closing_the_webview_instances_and_deleting_old_Edge_versions._n
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov bl, 1
jmp 0x101b2f35
xor ebx, ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.102f4c53
mov eax, ebx
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x101bbeaa
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
mov esi, ecx
movzx eax, byte [ecx + 0xdd]
shl eax, 3
mov edi, dword [sym.imp.USER32.dll_ShowWindow]
push eax
push dword [ecx + 0x1c]
call edi
movzx eax, byte [esi + 0xdd]
shl eax, 3
push eax
push dword [esi + 0xd8]
call edi
cmp dword [esi + 0x54], 0
je 0x101bbf0c
mov ecx, dword [esi + 0x50]
call fcn.101b7e54
test al, al
jne 0x101bbf0c
mov ecx, dword [esi + 0x54]
movzx eax, byte [esi + 0xdd]
push eax
call fcn.101705d0
cmp byte [esi + 0xdd], 0
je 0x101bbf0c
mov ecx, esi
call fcn.101be664
pop esi
pop edi
pop ebp
ret 4

Function at 0x101bf3b8
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
push eax
cmp dword [ecx + 0x54], 0
je 0x101bf47a
mov esi, ecx
mov ecx, dword [ecx + 0x50]
call fcn.101b7e54
test al, al
jne 0x101bf47a
mov eax, dword [esi + 0xd0]
dec eax
cmp eax, 2
jae 0x101bf3f9
mov ecx, dword [esi + 0x54]
push dword [esi + 0xd8]
push 1
call fcn.10170f70
jmp 0x101bf405
push dword [esi + 0xd8]
call dword [sym.imp.USER32.dll_SetFocus]
cmp byte [esi + 0xdc], 0
jne 0x101bf47a
push 9
call dword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
jns 0x101bf47a
push 0xa0
call dword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
js 0x101bf43e
push 0xa1
call dword [sym.imp.USER32.dll_GetKeyState]
movzx ebx, ax
shr ebx, 0xf
jmp 0x101bf440
mov bl, 1
mov eax, ebx
xor al, 1
movzx edi, al
mov eax, dword [esi + 0x1c]
mov dword [ebp - 0x10], eax
push 2
push dword [esi + 0xd4]
call dword [sym.imp.USER32.dll_GetAncestor]
push edi
push dword [ebp - 0x10]
push eax
call dword [sym.imp.USER32.dll_GetNextDlgTabItem]
cmp eax, dword [ebp + 8]
jne 0x101bf47a
mov ecx, dword [esi + 0x54]
movzx eax, bl
inc eax
push 0
push eax
call fcn.10170680
add esp, 4
pop esi
pop edi
pop ebx
pop ebp
ret 4
Function at 0x101d3a94
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
push eax
mov ebx, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
mov ecx, esi
call fcn.101dee18
mov edx, eax
test ebx, ebx
je 0x101d3abb
mov eax, dword [ebx + 0xc]
cmp eax, dword [ebx + 0x10]
je 0x101d3ac6
movzx eax, word [eax]
jmp 0x101d3add
xor ecx, ecx
test dl, dl
je 0x101d3af0
jmp 0x101d3b84
mov eax, dword [ebx]
mov edi, dword [eax + 0x20]
mov ecx, edi
mov byte [ebp - 0x10], dl
call dword [section..00cfg]
mov ecx, ebx
call edi
mov dl, byte [ebp - 0x10]
xor edi, edi
cmp ax, 0xffff
sete al
je 0x101d3aea
mov edi, ebx
mov ecx, edi
cmp dl, al
je 0x101d3b6a
mov edi, dword [esi]
mov eax, dword [edi + 0xc]
cmp eax, dword [edi + 0x10]
mov dword [ebp - 0x10], ecx
je 0x101d3b02
movzx edi, word [eax]
jmp 0x101d3b15
mov eax, dword [edi]
mov esi, dword [eax + 0x20]
mov ecx, esi
call dword [section..00cfg]
mov ecx, edi
call esi
mov edi, eax
mov ebx, dword [ebp + 0x14]
mov eax, dword [ebx]
mov esi, dword [eax + 0xc]
mov ecx, esi
call dword [section..00cfg]
movzx eax, di
mov ecx, ebx
push eax
push 8
call esi
test al, al
je 0x101d3b64
mov esi, dword [ebp + 8]
mov edi, dword [esi]
mov eax, dword [edi + 0xc]
cmp eax, dword [edi + 0x10]
mov ebx, dword [ebp - 0x10]
je 0x101d3b4e
add eax, 2
mov dword [edi + 0xc], eax
jmp 0x101d3aa1
mov eax, dword [edi]
mov esi, dword [eax + 0x24]
mov ecx, esi
call dword [section..00cfg]
mov ecx, edi
call esi
jmp 0x101d3a9e
mov edi, dword [ebp - 0x10]
mov esi, dword [ebp + 8]
mov ecx, esi
call fcn.101dee18
mov ebx, eax
test edi, edi
je 0x101d3b8d
mov eax, dword [edi + 0xc]
cmp eax, dword [edi + 0x10]
je 0x101d3b93
movzx eax, word [eax]
jmp 0x101d3ba4
mov ecx, esi
call fcn.101dee18
mov ebx, eax
test bl, bl
jne 0x101d3baf
jmp 0x101d3bb5
mov eax, dword [edi]
mov esi, dword [eax + 0x20]
mov ecx, esi
call dword [section..00cfg]
mov ecx, edi
call esi
cmp ax, 0xffff
sete al
xor bl, al
jne 0x101d3bb5
mov eax, dword [ebp + 0x10]
or byte [eax], 2
add esp, 4
pop esi
pop edi
pop ebx
pop ebp
ret 0x10
Function at 0x101e5630
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
mov esi, ecx
mov edi, dword [ebp + 8]
mov dword [ecx], 0x10350e7c
add ecx, 4
call fcn.100b6230
lea ecx, [esi + 8]
call fcn.100b6230
mov byte [esi + 0xc], 0
lea ecx, [esi + 0x24]
xorps xmm0, xmm0
movups xmmword [esi + 0x10], xmm0
mov dword [esi + 0x20], 0
call fcn.100b6230
mov byte [esi + 0x28], 0
mov dword [esi + 0x2c], 0
mov dword [esi + 0x30], 0
mov dword [esi + 0x34], 0
lea eax, [esi + 0x3c]
mov dword [esi + 0x3c], 0
mov dword [esi + 0x40], 0
mov dword [esi + 0x38], eax
xorps xmm0, xmm0
movups xmmword [esi + 0x44], xmm0
movups xmmword [esi + 0x54], xmm0
mov dword [esi + 0x68], 0
mov dword [esi + 0x64], 0
mov dword [esi + 0x6c], 0x3f800000
movups xmmword [esi + 0x70], xmm0
mov dword [esi + 0x80], 0
mov dword [esi + 0x84], 0x3f800000
movups xmmword [esi + 0x88], xmm0
mov dword [esi + 0x98], 0x3f800000
movups xmmword [esi + 0x9c], xmm0
mov dword [esi + 0xac], 0x3f800000
movups xmmword [esi + 0xb0], xmm0
mov dword [esi + 0xc0], 0x3f800000
mov dword [esi + 0xe4], 0
mov dword [esi + 0xe0], 0
movups xmmword [esi + 0xc8], xmm0
mov dword [esi + 0xd8], 0
mov eax, dword [0x1039c414]
mov dword [esi + 0xe8], eax
lea ecx, [esi + 0xec]
call fcn.10263c10
lea ecx, [esi + 0x188]
push 0
call fcn.10207c90
lea ecx, [esi + 0x190]
push 0
call fcn.10207c90
lea ecx, [esi + 0x198]
push 0
call fcn.10207c90
xorps xmm0, xmm0
movups xmmword [esi + 0x1a0], xmm0
mov dword [esi + 0x1b0], 0x3f800000
movups xmmword [esi + 0x1b4], xmm0
movups xmmword [esi + 0x1bd], xmm0
mov dword [esi + 0x1d0], edi
mov byte [esi + 0x1d4], 0
mov dword [esi + 0x1d8], 0
mov dword [esi + 0x1dc], 0
mov dword [esi + 0x1e0], 0
call sym.EmbeddedBrowserWebView.dll_public_virtual:_void___thiscall_telemetry_client::IDataFieldVisitor::destructor_void_
call fcn.101f3d00
mov ecx, eax
mov dword [esi + 0xd8], eax
xor ecx, 0x84222325
mov edx, 0x1b3
mov eax, ecx
mul edx
shl ecx, 8
add ecx, edx
add ecx, 0x8d40976c
mov dword [esi + 0xd0], eax
mov dword [esi + 0xd4], ecx
mov edx, dword [esi + 0xe8]
mov ecx, dword [esi + 0xf0]
mov eax, ecx
shr eax, 6
test dword [0x1039c418], edx
je 0x101e580d
cmp ecx, 0x40
mov ecx, 0x3e8
jmp 0x101e581d
test dword [0x1039c41c], edx
je 0x101e5868
cmp ecx, 0x40
mov ecx, 0x100
cmovb eax, ecx
push eax
call fcn.10262de0
add esp, 4
mov edi, dword [esi + 0x14]
mov dword [esi + 0x14], eax
test edi, edi
je 0x101e5845
mov eax, dword [edi]
mov ebx, dword [eax]
mov ecx, ebx
call dword [section..00cfg]
mov ecx, edi
push 1
call ebx
call fcn.101ea790
mov ecx, eax
push 0
push str.TraceLog
push esi
call fcn.101ea8e0
mov dword [0x103ca60c], esi
mov eax, esi
pop esi
pop edi
pop ebx
pop ebp
ret 4
test dword [0x1039c420], edx
je 0x101e587a
cmp ecx, 0x40
mov ecx, 0x7a1200
jmp 0x101e5882
cmp ecx, 0x40
mov ecx, 0xfa0
cmovb eax, ecx
push eax
call fcn.10262e80
jmp 0x101e5826
Function at 0x101e8fd0
Capabilities:
Encode data using xor
Hash data using murmur2

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x18
mov dword [ebp - 0x10], ecx
mov esi, dword [ebp + 0xc]
movzx ebx, byte [esi + 0xb]
mov eax, dword [esi]
mov ecx, dword [esi + 4]
test bl, bl
mov dword [ebp - 0x14], ecx
lea ecx, [eax + ecx]
lea edx, [esi + ebx]
cmovs edx, ecx
cmovs esi, eax
sub edx, esi
cmp edx, 4
mov dword [ebp - 0x20], ebx
jb 0x101e903d
mov ecx, esi
mov eax, edx
nop word [eax + eax]
imul edi, dword [ecx], 0x5bd1e995
mov ebx, edi
shr ebx, 0x18
xor ebx, edi
imul edi, ebx, 0x5bd1e995
imul eax, eax, 0x5bd1e995
xor eax, edi
add ecx, 4
add edx, 0xfffffffc
cmp edx, 3
ja 0x101e9010
cmp edx, 1
jne 0x101e9046
jmp 0x101e9062
mov eax, edx
mov ecx, esi
cmp edx, 1
je 0x101e9062
cmp edx, 2
je 0x101e9059
cmp edx, 3
jne 0x101e906d
movzx edx, byte [ecx + 2]
shl edx, 0x10
xor eax, edx
movzx edx, byte [ecx + 1]
shl edx, 8
xor eax, edx
movzx ecx, byte [ecx]
xor ecx, eax
imul eax, ecx, 0x5bd1e995
mov ecx, dword [ebp - 0x10]
mov ebx, dword [ecx + 4]
xor ecx, ecx
test ebx, ebx
je 0x101e91ce
mov edx, eax
shr edx, 0xd
xor edx, eax
imul eax, edx, 0x5bd1e995
mov edi, eax
shr edi, 0xf
xor edi, eax
mov edx, ebx
shr edx, 1
and edx, 0x55555555
mov eax, ebx
sub eax, edx
mov edx, eax
and edx, 0x33333333
shr eax, 2
and eax, 0x33333333
add eax, edx
mov edx, eax
shr edx, 4
add edx, eax
and edx, 0xf0f0f0f
imul eax, edx, 0x1010101
shr eax, 0x18
mov dword [ebp - 0x24], eax
cmp eax, 1
ja 0x101e90d6
lea edx, [ebx - 1]
and edx, edi
jmp 0x101e90e2
mov edx, edi
cmp edi, ebx
jb 0x101e90e2
mov eax, edi
xor edx, edx
div ebx
mov eax, dword [ebp - 0x10]
mov eax, dword [eax]
mov eax, dword [eax + edx*4]
test eax, eax
je 0x101e91ce
mov dword [ebp - 0x18], ebx
mov ebx, dword [eax]
test ebx, ebx
je 0x101e91ce
mov dword [ebp - 0x10], edx
mov eax, dword [ebp - 0x18]
dec eax
mov dword [ebp - 0x1c], eax
mov ecx, dword [ebp - 0x20]
test cl, cl
mov eax, dword [ebp - 0x14]
cmovns eax, ecx
mov dword [ebp - 0x14], eax
jmp 0x101e9135
and eax, dword [ebp - 0x1c]
cmp eax, edx
jne 0x101e91cc
mov ebx, dword [ebx]
test ebx, ebx
je 0x101e91cc
mov eax, dword [ebx + 4]
cmp eax, edi
jne 0x101e9190
movzx eax, byte [ebx + 0x13]
mov ecx, eax
test al, al
jns 0x101e9149
mov ecx, dword [ebx + 0xc]
cmp ecx, dword [ebp - 0x14]
jne 0x101e912b
lea ecx, [ebx + 8]
test al, al
jns 0x101e9157
mov ecx, dword [ecx]
js 0x101e91ae
cmp dword [ebp - 0x14], 0
je 0x101e91c8
xor ecx, ecx
nop word cs:[eax + eax]
movzx edx, byte [ebx + ecx + 8]
cmp dl, byte [esi + ecx]
jne 0x101e912b
inc ecx
cmp eax, ecx
jne 0x101e9170
jmp 0x101e91c8
cmp dword [ebp - 0x24], 1
mov edx, dword [ebp - 0x10]
jbe 0x101e9120
mov ecx, dword [ebp - 0x18]
cmp eax, ecx
jb 0x101e9123
xor edx, edx
div ecx
mov eax, edx
mov edx, dword [ebp - 0x10]
jmp 0x101e9123
mov eax, dword [ebp - 0x14]
test eax, eax
je 0x101e91c8
push eax
push esi
push ecx
call fcn.102f617d
add esp, 0xc
test eax, eax
jne 0x101e912b
mov ecx, ebx
jmp 0x101e91ce
xor ecx, ecx
mov eax, dword [ebp + 8]
mov dword [eax], ecx
add esp, 0x18
pop esi
pop edi
pop ebx
pop ebp
ret 8