joyce8/EMBER2024-capa huggingface dataset:
Function at 0x401a10
Capabilities:
Check for peb beingdebugged flag

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4251a0
push 0x422b50
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xc
push ebx
push esi
push edi
mov dword [ebp - 0x18], esp
xor ebx, ebx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 4], ebx
mov ax, word [0x42ca6c]
add word [0x42ca58], ax
call dword [0x42d0c4]
test eax, 0x80000000
je 0x401aab
movsx ecx, byte [0x42ca4b]
push ecx
mov edx, dword [0x42ca88]
push edx
call fcn.0040e9b0
add byte [0x42ca4c], al
dec byte [0x42ca48]
mov eax, dword fs:[0x20]
mov dword [ebp - 0x1c], eax
movsx eax, word [0x42ca5c]
push eax
movsx ecx, word [0x42ca60]
push ecx
call fcn.0040e8d0
add esp, 0x10
add dword [0x42ca6c], eax
mov dword [ebp - 4], 0xffffffff
jmp 0x401b5d
push 0x5097ffff
push 0x9579ffff
call fcn.0040e7a0
mov byte [0x42ca4a], al
mov eax, dword fs:[0x30]
mov al, byte [eax + 2]
movzx eax, al
mov dword [ebp - 0x1c], eax
mov dword [0x42ca6c], 1
movsx edx, byte [0x42ca48]
push edx
push 0x7a5ffff
call fcn.0040e8d0
add esp, 0x10
mov dword [0x42ca84], eax
mov eax, dword [0x42ca88]
mov ecx, eax
shl ecx, 5
sub ecx, eax
shl ecx, 2
sub ecx, eax
shl ecx, 3
sub ecx, eax
neg ecx
shl ecx, 0x15
sub ecx, eax
mov word [0x42ca64], cx
mov dword [ebp - 4], 0xffffffff
jmp 0x401b5d
push 0xf435ffff
movsx ecx, word [0x42ca62]
push ecx
call fcn.0040e910
add esp, 8
add dword [0x42ca7c], eax
mov edx, dword [0x42ca70]
imul edx, edx, 0x9919ffff
add dword [0x42ca68], edx
mov byte [0x42ca4e], bl
cmp dword [ebp - 0x1c], ebx
setne al
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x414300
Capabilities:
Hash data with md5

Disassembly:
mov al, byte [0x42ca80]
push esi
mov esi, ecx
mov byte [0x42ca4c], al
xor ecx, ecx
lea edx, [esi + 0x10]
mov dword [esi + 0x10], ecx
mov dword [edx + 4], ecx
mov ax, word [0x42ca5e]
test ax, ax
jne 0x414333
mov ecx, dword [0x42ca88]
mov word [0x42ca58], ax
test ecx, ecx
je 0x41433c
mov word [0x42ca58], 1
movsx eax, ax
push 0x277fffff
push eax
call fcn.0040e890
mov cl, byte [0x42ca4d]
movsx edx, word [0x42ca5c]
add cl, al
mov byte [0x42ca4d], cl
movsx ecx, byte [0x42ca49]
push ecx
push edx
call fcn.0040e840
add word [0x42ca54], ax
mov dword [esi], 0x67452301
mov al, byte [0x42ca52]
mov cl, byte [0x42ca74]
or al, cl
push 0x1403ffff
mov byte [0x42ca49], al
push 0xf907ffff
mov dword [esi + 4], 0xefcdab89
call fcn.0040e8d0
mov edx, dword [0x42ca84]
push 0xc481ffff
add edx, eax
push 0x9f97ffff
mov dword [0x42ca84], edx
call fcn.0040e960
mov cl, byte [0x42ca58]
mov dl, byte [0x42ca4a]
add word [0x42ca62], ax
add dl, cl
mov byte [0x42ca4a], dl
mov dword [esi + 8], 0x98badcfe
movsx ax, byte [0x42ca50]
mov ecx, dword [0x42ca68]
mov dx, word [0x42ca64]
add word [0x42ca5a], dx
or eax, ecx
mov ecx, dword [0x42ca80]
mov word [0x42ca54], ax
push ecx
push 0x29afffff
call fcn.0040e8d0
mov dword [0x42ca80], eax
mov dword [esi + 0xc], 0x10325476
movsx eax, word [0x42ca64]
mov dx, word [0x42ca68]
push 0x9293ffff
sub word [0x42ca58], dx
push eax
call fcn.0040ea40
add esp, 0x30
mov dword [0x42ca88], eax
pop esi
ret
Function at 0x402ed5
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
pushal
call 0x402ee4
pop dword [ebp - 0x20]
mov eax, 0xb7c94e8a
add eax, 0x4876e05a
sub dword [ebp - 0x20], eax
mov dword [ebp - 0x30], 0x25daf04a
sub dword [ebp - 0x30], 0xd788aaff
mov dword [ebp - 0x2c], 0x88341fab
sub dword [ebp - 0x2c], 0x5600d366
mov dword [ebp - 0x28], 0xe8d4c060
sub dword [ebp - 0x28], 0x9c887c32
mov dword [ebp - 0x24], 0xb54a4fa9
add dword [ebp - 0x24], 0x4ab5b057
lea eax, [ebp - 0x30]
push eax
mov eax, 0xcd3ef7a3
sub eax, 0xccfe769f
add eax, dword [ebp - 0x20]
call dword [eax]
mov dword [ebp - 0x30], 0x78ab2f53
sub dword [ebp - 0x30], 0x438c5fd
mov dword [ebp - 0x2c], 0xbd784192
add dword [ebp - 0x2c], 0x83f41fe3
mov dword [ebp - 0x28], 0x48504471
sub dword [ebp - 0x28], 0xe4e0d805
mov dword [ebp - 0x24], 0x61423566
add dword [ebp - 0x24], 0x9ebdca9a
lea ebx, [ebp - 0x30]
push ebx
push eax
mov eax, 0xaf635fb3
sub eax, 0xaf22deb3
add eax, dword [ebp - 0x20]
call dword [eax]
push 0x40
push 0x1000
push 0x35c5f
push 0
call eax
mov ecx, 0x7150d7bd
add ecx, 0x8eaf6b36
mov edi, eax
mov ebx, 0x46e400
add ebx, dword [ebp - 0x20]
mov esi, 0x88c7eec6
sub esi, 0x6bccce20
mov edx, dword [ebx]
xor dword [ebp - 4], ecx
add edx, esi
add dword [ebp - 0x1c], esi
mov dword [edi], edx
add dword [ebp - 0xc], 0x5140f59a
add edi, 4
add ebx, 4
loop 0x403000
add eax, 0x8c7e7e84
sub eax, 0x8c7d7fe5
xor ebx, ebx
add ebx, eax
add eax, 0x3ea9ce01
add eax, 0xc1563204
mov ecx, 0xaf1abdf7
add ecx, 0x51254209
add ecx, dword [ebp - 0x20]
call ebx
leave
ret

Function at 0x40317b
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 8]
push ebx
push esi
xor esi, esi
cmp eax, esi
jl 0x4031a6
mov ecx, dword [0x42a298]
push esi
add eax, ecx
push esi
push eax
mov dword [0x418ed4], eax
push dword [0x40a01c]
call dword [sym.imp.kernel32.dll_SetFilePointer]
push 4
call fcn.00403283
cmp eax, esi
jl 0x40327d
lea eax, [ebp + 8]
push 4
push eax
push dword [0x40a01c]
call fcn.00402ed5
test eax, eax
je 0x40326d
push dword [ebp + 8]
add dword [0x418ed4], 4
call fcn.00403283
mov ebx, eax
cmp ebx, esi
jl 0x40327b
cmp dword [ebp + 0x10], esi
jne 0x403249
cmp dword [ebp + 8], esi
jle 0x40327b
mov esi, 0x414ed0
cmp dword [ebp + 8], 0x4000
mov eax, dword [ebp + 8]
jl 0x40320b
mov eax, 0x4000
push eax
push esi
push dword [0x40a01c]
mov dword [ebp - 4], eax
call fcn.00402ed5
test eax, eax
je 0x40326d
push dword [ebp - 4]
push esi
push dword [ebp + 0xc]
call fcn.00402ed5
test eax, eax
je 0x403245
mov eax, dword [ebp - 4]
sub dword [ebp + 8], eax
add dword [0x418ed4], eax
add ebx, eax
cmp dword [ebp + 8], 0
jg 0x4031fa
jmp 0x40327b
push 0xfffffffffffffffe
jmp 0x40326f
mov eax, dword [ebp + 8]
cmp eax, dword [ebp + 0x14]
jl 0x403254
mov eax, dword [ebp + 0x14]
lea ecx, [ebp - 4]
push esi
push ecx
push eax
push dword [ebp + 0x10]
push dword [0x40a01c]
call dword [sym.imp.kernel32.dll_ReadFile]
test eax, eax
jne 0x403272
push 0xfffffffffffffffd
pop eax
jmp 0x40327d
mov ebx, dword [ebp - 4]
add dword [0x418ed4], ebx
mov eax, ebx
pop esi
pop ebx
leave
ret 0x10
Function at 0x417007
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
pushal
call 0x417016
pop dword [ebp - 0x10]
mov eax, 0xdb4895f1
sub eax, 0xdb0725db
sub dword [ebp - 0x10], eax
push 0x40
push 0x1000
push 0x51508
push 0
mov eax, 0xb17c3f9f
add eax, 0x4ec8731d
add eax, dword [ebp - 0x10]
call dword [eax]
mov ecx, 0x5f36934a
add ecx, 0xa0c9b9a7
mov ebx, eax
mov esi, 0x494d6cd3
add esi, 0xb6fb112d
add esi, dword [ebp - 0x10]
mov edx, 0x7082e85b
add edx, 0x5ea4aec4
xor dword [ebp - 4], edx
mov edi, dword [esi]
add dword [ebp - 0xc], ebx
xor edi, edx
mov dword [ebp - 4], 0x2016e95f
mov dword [ebx], edi
add dword [ebp - 0xc], 0xbe4c8380
add ebx, 4
add esi, 0x449bf043
add esi, 0xbb640fc1
loop 0x417075
add eax, 0x66b7c216
add eax, 0x99496481
mov ebx, eax
add eax, 5
mov ecx, 0xf1d86f44
sub ecx, 0xf1986f44
add ecx, dword [ebp - 0x10]
call ebx
leave
ret

Function at 0x43fcae
Capabilities:
Encrypt data using dpapi

Disassembly:
push esi
push edi
push 0x46b5d8
push str.AdvApi32.dll
call main
mov edi, dword [sym.imp.kernel32.dll_GetProcAddress]
mov esi, eax
test esi, esi
js 0x43fcf1
push str.SystemFunction040
push dword [0x46b5d8]
call edi
push str.SystemFunction041
push dword [0x46b5d8]
mov dword [0x46b5e0], eax
call edi
mov dword [0x46b5e4], eax
jmp 0x43fcf6
mov eax, dword [0x46b5e4]
cmp dword [0x46b5e0], 0
je 0x43fd07
test eax, eax
jne 0x43fdae
push 0x46b5dc
push str.Crypt32.dll
call main
mov esi, eax
test esi, esi
js 0x43fdb8
push str.CryptProtectMemory
push dword [0x46b5dc]
call edi
cmp dword [0x46b5e0], 0
mov dword [0x46b5e8], eax
jne 0x43fd6c
test eax, eax
jne 0x43fd6c
call dword [sym.imp.kernel32.dll_GetLastError]
mov esi, eax
test esi, esi
jle 0x43fd56
movzx esi, si
or esi, 0x80070000
test esi, esi
js 0x43fd5d
mov esi, 0x80004005
push esi
push 0x28
push str.cryputil.cpp
call fcn.00403821
jmp 0x43fdb8
push str.CryptUnprotectMemory
push dword [0x46b5dc]
call edi
cmp dword [0x46b5e4], 0
mov dword [0x46b5ec], eax
jne 0x43fdae
test eax, eax
jne 0x43fdae
call dword [sym.imp.kernel32.dll_GetLastError]
mov esi, eax
test esi, esi
jle 0x43fda2
movzx esi, si
or esi, 0x80070000
test esi, esi
js 0x43fda9
mov esi, 0x80004005
push esi
push 0x2d
jmp 0x43fd60
mov dword [0x46b5f0], 1
pop edi
mov eax, esi
pop esi
ret
Function at 0x4104dc
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x60
pushal
call 0x4104eb
pop dword [ebp - 0x50]
mov eax, 0x695cae77
add eax, 0x96e45674
sub dword [ebp - 0x50], eax
push 0x40
push 0x1000
push 0x3a662
push 0
mov eax, sym.imp.kernel32.dll_VirtualAlloc
add eax, dword [ebp - 0x50]
call dword [eax]
mov ecx, 0x285d131
sub ecx, 0x28596a5
xor esi, esi
add esi, eax
mov edi, 0x435400
add edi, dword [ebp - 0x50]
mov edx, 0xddb36036
add edx, 0x17b19a30
mov dword [ebp - 0x4c], 0x4d4f02f5
mov ebx, dword [edi]
xor dword [ebp - 0x44], 0x9687961e
add ebx, edx
mov dword [ebp - 0x48], 0xc34b914d
mov dword [esi], ebx
add dword [ebp - 0x14], eax
add esi, 0x304c12d2
sub esi, 0x304c12ce
add edi, 0xba1271dc
add edi, 0x45ed8e28
loop 0x410541
add eax, 0x6d7c81ba
add eax, 0x92845b49
xor ebx, ebx
add ebx, eax
add eax, 0x8a6a97f8
sub eax, 0x8a6a97f3
mov ecx, 0x400000
add ecx, dword [ebp - 0x50]
call ebx
leave
ret

Function at 0x41d2d5
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.0040e95e
and dword [ebp - 4], 0
cmp dword [0x4310f8], 0
mov ebx, eax
jne 0x41d386
push str.USER32.DLL
call dword [sym.imp.kernel32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x41d437
mov esi, dword [sym.imp.kernel32.dll_GetProcAddress]
push 0x42d324
push edi
call esi
test eax, eax
je 0x41d437
push eax
call fcn.004104dc
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x4310f8], eax
call esi
push eax
call fcn.004104dc
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x4310fc], eax
call esi
push eax
call fcn.004104dc
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x431100], eax
call esi
push eax
call fcn.004104dc
pop ecx
mov dword [0x431108], eax
test eax, eax
je 0x41d386
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.004104dc
pop ecx
mov dword [0x431104], eax
mov eax, dword [0x431104]
cmp eax, ebx
je 0x41d3de
cmp dword [0x431108], ebx
je 0x41d3de
push eax
call fcn.004104dc
push dword [0x431108]
mov esi, eax
call fcn.004104dc
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x41d3de
test edi, edi
je 0x41d3de
call esi
test eax, eax
je 0x41d3d5
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x41d3d5
test byte [ebp - 0xc], 1
jne 0x41d3de
or dword [ebp + 0x10], 0x200000
jmp 0x41d417
mov eax, dword [0x4310fc]
cmp eax, ebx
je 0x41d417
push eax
call fcn.004104dc
pop ecx
test eax, eax
je 0x41d417
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x41d417
mov eax, dword [0x431100]
cmp eax, ebx
je 0x41d417
push eax
call fcn.004104dc
pop ecx
test eax, eax
je 0x41d417
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x4310f8]
call fcn.004104dc
pop ecx
test eax, eax
je 0x41d437
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x41d439
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x1008e3cc
Capabilities:
Encode data using xor

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff0
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
sub esp, 0x38
push esi
push edi
push 0x104
call fcn.1009de81
push 0x104
mov esi, eax
push 0
push esi
call fcn.1009e861
movups xmm0, xmmword [str._BCH]
mov ax, word [0x100209c4]
add esp, 0x10
cmp dword [0x100252bf], 0x10
mov edi, 0x100252ab
movups xmmword [ebp - 0x2c], xmm0
mov word [ebp - 0x14], ax
movq xmm0, qword [0x100209bc]
mov al, byte [0x100209c6]
movq qword [ebp - 0x1c], xmm0
mov byte [ebp - 0x12], al
jb 0x1008e441
mov edi, dword [0x100252ab]
xor ecx, ecx
cmp dword [0x10025a5c], 2
jl 0x1008e58c
movaps xmm0, xmmword [str.555555555555555566666666666666669999999999999999]
mov eax, 4
movaps xmm4, xmmword [0x10021370]
movaps xmm3, xmmword [0x10021420]
movaps xmm6, xmmword [0x100213b0]
movd xmm5, eax
mov eax, 0x1f
movaps xmmword [ebp - 0x10], xmm0
mov edx, dword [ebp - 0x10]
movd xmm7, eax
lea eax, [ecx + 4]
nop dword [eax]
movd xmm0, ecx
add ecx, 8
pshufd xmm2, xmm0, 0
paddd xmm2, xmm4
movaps xmm1, xmm2
movaps xmm0, xmm2
punpckhdq xmm0, xmm2
punpckldq xmm1, xmm2
pmuldq xmm0, xmm3
pmuldq xmm1, xmm3
shufps xmm1, xmm0, 0xdd
psrad xmm1, xmm5
movaps xmm0, xmm1
psrld xmm0, xmm7
paddd xmm0, xmm1
pmulld xmm0, xmm6
psubd xmm2, xmm0
pshuflw xmm0, xmm2, 0xd8
pshufhw xmm0, xmm0, 0xd8
pshufd xmm1, xmm0, 0xd8
pand xmm1, xmmword [0x100213d0]
packuswb xmm1, xmm1
movd xmm0, edx
paddb xmm1, xmm0
movd xmm0, dword [ebp + eax - 0x30]
pxor xmm1, xmm0
movd xmm0, eax
pshufd xmm2, xmm0, 0
movd dword [ebp + eax - 0x30], xmm1
paddd xmm2, xmm4
movaps xmm1, xmm2
movaps xmm0, xmm2
punpckhdq xmm0, xmm2
punpckldq xmm1, xmm2
pmuldq xmm0, xmm3
pmuldq xmm1, xmm3
shufps xmm1, xmm0, 0xdd
psrad xmm1, xmm5
movaps xmm0, xmm1
psrld xmm0, xmm7
paddd xmm0, xmm1
pmulld xmm0, xmm6
psubd xmm2, xmm0
pshuflw xmm0, xmm2, 0xd8
pshufhw xmm0, xmm0, 0xd8
pshufd xmm1, xmm0, 0xd8
pand xmm1, xmmword [0x100213d0]
packuswb xmm1, xmm1
movd xmm0, edx
paddb xmm1, xmm0
movd xmm0, dword [ebp + eax - 0x2c]
pxor xmm1, xmm0
movd dword [ebp + eax - 0x2c], xmm1
add eax, 8
cmp eax, 0x1c
jl 0x1008e48c
cmp ecx, 0x1b
jge 0x1008e5b4
nop dword [eax]
mov eax, 0x4bda12f7
imul ecx
sar edx, 4
mov eax, edx
shr eax, 0x1f
add eax, edx
mov dl, cl
movsx eax, al
imul eax, eax, 0x36
sub dl, al
add dl, 0x35
xor byte [ebp + ecx - 0x2c], dl
inc ecx
cmp ecx, 0x1b
jl 0x1008e58c
push edi
lea eax, [ebp - 0x2c]
push eax
push 0x104
push esi
call fcn.1008e38c
add esp, 0x10
mov eax, esi
pop edi
pop esi
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret
Function at 0x1009047c
Capabilities:
Encode data using xor

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff0
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
mov eax, dword fs:[0x2c]
sub esp, 0x30
mov ecx, dword [0x10025a58]
mov ecx, dword [eax + ecx*4]
mov eax, dword [0x10025f0c]
cmp eax, dword [ecx + 4]
jle 0x10090679
push 0x10025f0c
call fcn.1009d90d
add esp, 4
cmp dword [0x10025f0c], 0xffffffff
jne 0x10090679
cmp byte [0x10020f43], 0
movups xmm0, xmmword [0x10020f28]
mov eax, dword [0x10020f40]
mov dword [ebp - 0x14], eax
movups xmmword [ebp - 0x2c], xmm0
movq xmm0, qword [0x10020f38]
movq qword [ebp - 0x1c], xmm0
je 0x10090664
xor ecx, ecx
cmp dword [0x10025a5c], 2
jl 0x1009063c
movaps xmm0, xmmword [0x10021400]
mov eax, 4
movaps xmm4, xmmword [0x10021370]
movaps xmm3, xmmword [0x10021420]
movaps xmm6, xmmword [0x100213b0]
movd xmm5, eax
mov eax, 0x1f
movaps xmmword [ebp - 0x10], xmm0
mov edx, dword [ebp - 0x10]
movd xmm7, eax
movd xmm0, ecx
lea eax, [ecx + 4]
pshufd xmm2, xmm0, 0
paddd xmm2, xmm4
movaps xmm1, xmm2
movaps xmm0, xmm2
punpckhdq xmm0, xmm2
punpckldq xmm1, xmm2
pmuldq xmm0, xmm3
pmuldq xmm1, xmm3
shufps xmm1, xmm0, 0xdd
psrad xmm1, xmm5
movaps xmm0, xmm1
psrld xmm0, xmm7
paddd xmm0, xmm1
pmulld xmm0, xmm6
psubd xmm2, xmm0
pshuflw xmm0, xmm2, 0xd8
pshufhw xmm0, xmm0, 0xd8
pshufd xmm1, xmm0, 0xd8
pand xmm1, xmmword [0x100213d0]
packuswb xmm1, xmm1
movd xmm0, edx
paddb xmm1, xmm0
movd xmm0, dword [ebp + ecx - 0x2c]
pxor xmm1, xmm0
movd xmm0, eax
pshufd xmm2, xmm0, 0
movd dword [ebp + ecx - 0x2c], xmm1
paddd xmm2, xmm4
movaps xmm1, xmm2
movaps xmm0, xmm2
punpckhdq xmm0, xmm2
punpckldq xmm1, xmm2
pmuldq xmm0, xmm3
pmuldq xmm1, xmm3
shufps xmm1, xmm0, 0xdd
psrad xmm1, xmm5
movaps xmm0, xmm1
psrld xmm0, xmm7
paddd xmm0, xmm1
pmulld xmm0, xmm6
psubd xmm2, xmm0
pshuflw xmm0, xmm2, 0xd8
pshufhw xmm0, xmm0, 0xd8
pshufd xmm1, xmm0, 0xd8
pand xmm1, xmmword [0x100213d0]
packuswb xmm1, xmm1
movd xmm0, edx
paddb xmm1, xmm0
movd xmm0, dword [ebp + ecx - 0x28]
pxor xmm1, xmm0
movd dword [ebp + ecx - 0x28], xmm1
add ecx, 8
cmp ecx, 0x18
jl 0x10090540
cmp ecx, 0x1c
jge 0x10090664
mov eax, 0x4bda12f7
imul ecx
sar edx, 4
mov eax, edx
shr eax, 0x1f
add eax, edx
mov dl, cl
movsx eax, al
imul eax, eax, 0x36
sub dl, al
add dl, 0x39
xor byte [ebp + ecx - 0x2c], dl
inc ecx
cmp ecx, 0x1c
jl 0x1009063c
lea eax, [ebp - 0x2c]
push 0x10025f0c
mov dword [0x10025f10], eax
call fcn.1009d8c3
add esp, 4
mov eax, dword [0x10025f10]
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret
Function at 0x1009069c
Capabilities:
Encode data using xor

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff0
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
mov eax, dword fs:[0x2c]
sub esp, 0x30
mov ecx, dword [0x10025a58]
mov ecx, dword [eax + ecx*4]
mov eax, dword [0x10025f14]
cmp eax, dword [ecx + 4]
jle 0x10090899
push 0x10025f14
call fcn.1009d90d
add esp, 4
cmp dword [0x10025f14], 0xffffffff
jne 0x10090899
cmp byte [str.PjUVYIVV.b4_2gj___n_50_7Tinvalid_stof_argument], 0
movups xmm0, xmmword [0x10020f10]
movups xmmword [ebp - 0x28], xmm0
movq xmm0, qword [0x10020f20]
movq qword [ebp - 0x18], xmm0
je 0x10090884
xor ecx, ecx
cmp dword [0x10025a5c], 2
jl 0x1009085c
movaps xmm0, xmmword [0x10021400]
mov eax, 4
movaps xmm4, xmmword [0x10021370]
movaps xmm3, xmmword [0x10021420]
movaps xmm6, xmmword [0x100213b0]
movd xmm5, eax
mov eax, 0x1f
movaps xmmword [ebp - 0x10], xmm0
mov edx, dword [ebp - 0x10]
movd xmm7, eax
nop dword [eax]
movd xmm0, ecx
lea eax, [ecx + 4]
pshufd xmm2, xmm0, 0
paddd xmm2, xmm4
movaps xmm1, xmm2
movaps xmm0, xmm2
punpckhdq xmm0, xmm2
punpckldq xmm1, xmm2
pmuldq xmm0, xmm3
pmuldq xmm1, xmm3
shufps xmm1, xmm0, 0xdd
psrad xmm1, xmm5
movaps xmm0, xmm1
psrld xmm0, xmm7
paddd xmm0, xmm1
pmulld xmm0, xmm6
psubd xmm2, xmm0
pshuflw xmm0, xmm2, 0xd8
pshufhw xmm0, xmm0, 0xd8
pshufd xmm1, xmm0, 0xd8
pand xmm1, xmmword [0x100213d0]
packuswb xmm1, xmm1
movd xmm0, edx
paddb xmm1, xmm0
movd xmm0, dword [ebp + ecx - 0x28]
pxor xmm1, xmm0
movd xmm0, eax
pshufd xmm2, xmm0, 0
movd dword [ebp + ecx - 0x28], xmm1
paddd xmm2, xmm4
movaps xmm1, xmm2
movaps xmm0, xmm2
punpckhdq xmm0, xmm2
punpckldq xmm1, xmm2
pmuldq xmm0, xmm3
pmuldq xmm1, xmm3
shufps xmm1, xmm0, 0xdd
psrad xmm1, xmm5
movaps xmm0, xmm1
psrld xmm0, xmm7
paddd xmm0, xmm1
pmulld xmm0, xmm6
psubd xmm2, xmm0
pshuflw xmm0, xmm2, 0xd8
pshufhw xmm0, xmm0, 0xd8
pshufd xmm1, xmm0, 0xd8
pand xmm1, xmmword [0x100213d0]
packuswb xmm1, xmm1
movd xmm0, edx
paddb xmm1, xmm0
movd xmm0, dword [ebp + ecx - 0x24]
pxor xmm1, xmm0
movd dword [ebp + ecx - 0x24], xmm1
add ecx, 8
cmp ecx, 0x18
jl 0x1009075c
jmp 0x10090884
mov eax, 0x4bda12f7
imul ecx
sar edx, 4
mov eax, edx
shr eax, 0x1f
add eax, edx
mov dl, cl
movsx eax, al
imul eax, eax, 0x36
sub dl, al
add dl, 0x39
xor byte [ebp + ecx - 0x28], dl
inc ecx
cmp ecx, 0x18
jl 0x1009085c
lea eax, [ebp - 0x28]
push 0x10025f14
mov dword [0x10025f08], eax
call fcn.1009d8c3
add esp, 4
mov eax, dword [0x10025f08]
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret
Function at 0x10098acc
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1001e6f5
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
push ebx
push esi
push edi
mov eax, dword [0x1002520c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edx, dword [ebp + 0xc]
mov edi, edx
mov ebx, dword [ebp + 8]
mov dword [ebp - 0x1c], edx
cmp dword [edx + 0x14], 0x10
jb 0x10098b07
mov edi, dword [edx]
xor ecx, ecx
mov esi, 0x811c9dc5
cmp dword [edx + 0x10], ecx
jbe 0x10098b25
movzx eax, byte [ecx + edi]
inc ecx
xor eax, esi
imul esi, eax, 0x1000193
cmp ecx, dword [edx + 0x10]
jb 0x10098b13
push esi
push edx
lea eax, [ebp - 0x18]
push eax
call fcn.10098fcc
mov eax, dword [ebp - 0x14]
test eax, eax
je 0x10098b42
mov dword [ebx], eax
mov byte [ebx + 4], 0
jmp 0x10098caf
cmp dword [0x10025e40], 0x2aaaaaa
jne 0x10098b59
push str.unordered_map_set_too_long
call dword [0x10020144]
mov dword [ebp - 0x24], 0x10025e3c
mov dword [ebp - 4], 0
push 0x60
mov dword [ebp - 0x20], 0
call fcn.1009d9e3
mov cl, byte [0x1002064f]
mov edi, eax
mov eax, dword [ebp - 0x1c]
push ecx
mov byte [ebp - 0x10], cl
mov ecx, esp
push dword [ebp - 0x10]
mov dword [ebp - 0x20], edi
mov dword [ecx], eax
lea ecx, [edi + 8]
call fcn.10099d1c
mov dword [ebp - 4], 1
mov edx, dword [0x10025e40]
lea eax, [edx + 1]
movd xmm0, eax
cvtdq2pd xmm0, xmm0
shr eax, 0x1f
addsd xmm0, qword [eax*8 + 0x10021410]
mov eax, dword [0x10025e54]
cvtpd2ps xmm2, xmm0
movd xmm0, eax
cvtdq2pd xmm0, xmm0
shr eax, 0x1f
movaps xmm1, xmm2
addsd xmm0, qword [eax*8 + 0x10021410]
cvtpd2ps xmm0, xmm0
divss xmm1, xmm0
movss xmm0, dword [0x10025e38]
comiss xmm1, xmm0
jbe 0x10098c5e
divss xmm2, xmm0
sub esp, 8
cvtps2pd xmm0, xmm2
movsd qword [ebp - 0x18], xmm0
fld qword [ebp - 0x18]
fstp qword [esp]
call fcn.1009e9d7
fstp qword [ebp - 0x18]
movsd xmm0, qword [ebp - 0x18]
add esp, 8
cvtpd2ps xmm0, xmm0
call fcn.1009e95c
mov ecx, 8
cmp eax, ecx
cmova ecx, eax
mov eax, dword [0x10025e54]
cmp eax, ecx
jae 0x10098c40
cmp eax, 0x200
jae 0x10098c3e
shl eax, 3
cmp eax, ecx
jae 0x10098c40
mov eax, ecx
push eax
call fcn.10098dec
push esi
lea eax, [edi + 8]
push eax
lea eax, [ebp - 0x24]
push eax
call fcn.10098fcc
mov edx, dword [0x10025e40]
mov ecx, dword [eax]
jmp 0x10098c61
mov ecx, dword [ebp - 0x18]
mov eax, dword [ecx + 4]
inc edx
mov dword [0x10025e40], edx
mov dword [edi], ecx
mov dword [edi + 4], eax
mov dword [eax], edi
mov dword [ecx + 4], edi
and esi, dword [0x10025e50]
mov dword [ebp - 0x10], eax
mov eax, dword [0x10025e44]
mov edx, dword [eax + esi*8]
cmp edx, dword [0x10025e3c]
jne 0x10098c93
mov dword [eax + esi*8], edi
jmp 0x10098ca5
cmp edx, ecx
jne 0x10098c9c
mov dword [eax + esi*8], edi
jmp 0x10098ca9
mov ecx, dword [ebp - 0x10]
cmp dword [eax + esi*8 + 4], ecx
jne 0x10098ca9
mov dword [eax + esi*8 + 4], edi
mov dword [ebx], edi
mov byte [ebx + 4], 1
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x1009caec
Capabilities:
Check for software breakpoints

Disassembly:
mov edx, dword [esp + 4]
push esi
mov cl, byte [edx]
test cl, cl
je 0x1009cb01
cmp cl, 0x90
je 0x1009cb01
cmp cl, 0xcc
jne 0x1009cb1f
mov esi, dword [esp + 0xc]
mov eax, 1
cmp esi, eax
jbe 0x1009cb18
cmp byte [eax + edx], cl
jne 0x1009cb1f
inc eax
cmp eax, esi
jb 0x1009cb0e
mov eax, 1
pop esi
ret
xor eax, eax
pop esi
ret