joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10041de0
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, ecx
cmp dword [edi + 0xe4], 0
jg 0x10041e09
push 0x73b
push str.C:UsersWraithDesktopFedoraware_masterFedorawareFedoraware_TF2includeImGuiimgui.h
push str.Size___0
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__wassert]
add esp, 0xc
mov eax, dword [edi + 0xe4]
lea edx, [ebp + 8]
mov ebx, dword [edi + 0xec]
mov esi, 4
mov ebx, dword [ebx + eax*4 - 4]
not ebx
movzx eax, byte [edx]
lea edx, [edx + 1]
movzx ecx, bl
xor ecx, eax
shr ebx, 8
xor ebx, dword [ecx*4 + 0x101a69c0]
sub esi, 1
jne 0x10041e23
mov eax, dword [edi]
not ebx
cmp dword [eax + 0x3e8c], ebx
jne 0x10041e5a
push ecx
push dword [ebp + 8]
lea edx, [esi + 4]
mov ecx, ebx
call fcn.10057c80
add esp, 8
pop edi
pop esi
mov eax, ebx
pop ebx
pop ebp
ret 4

Function at 0x10041e70
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push esi
mov esi, ecx
push edi
cmp dword [esi + 0xe4], 0
jg 0x10041e9b
push 0x73b
push str.C:UsersWraithDesktopFedoraware_masterFedorawareFedoraware_TF2includeImGuiimgui.h
push str.Size___0
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__wassert]
add esp, 0xc
mov eax, dword [ebp + 8]
mov edi, 0x10
movss xmm1, dword [esi + 0x100]
movss xmm2, dword [esi + 0x104]
mov ecx, dword [esi + 0xe4]
movss xmm0, dword [eax]
subss xmm0, xmm1
movss dword [ebp - 0x14], xmm0
movss xmm0, dword [eax + 4]
subss xmm0, xmm2
movss dword [ebp - 0x10], xmm0
movss xmm0, dword [eax + 8]
subss xmm0, xmm1
movss dword [ebp - 0xc], xmm0
movss xmm0, dword [eax + 0xc]
mov eax, dword [esi + 0xec]
subss xmm0, xmm2
lea esi, [ebp - 0x14]
mov edx, dword [eax + ecx*4 - 4]
movss dword [ebp - 8], xmm0
not edx
nop
movzx eax, byte [esi]
lea esi, [esi + 1]
movzx ecx, dl
xor ecx, eax
shr edx, 8
xor edx, dword [ecx*4 + 0x101a69c0]
sub edi, 1
jne 0x10041f00
not edx
pop edi
mov eax, edx
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x10045a50
Capabilities:
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
mov esi, dword [0x1029c718]
push edi
mov edi, dword [ebp + 0x10]
mov dword [ebp - 8], edx
mov ebx, dword [esi + 0x3e58]
mov dword [ebp - 0xc], ecx
mov eax, dword [ebx + 0xc]
and eax, 4
or eax, 0x1000103
or edi, eax
cmp dword [ebx + 0x190], 0
mov dword [ebp + 0x10], edi
jne 0x10045a95
cmp dword [esi + 0x4a14], 0
mov eax, 0x228
je 0x10045a9a
mov eax, 0x1f8
movss xmm4, dword [eax + ebx]
xorps xmm3, xmm3
movss xmm5, dword [eax + ebx + 4]
mov ecx, dword [ebp + 8]
subss xmm4, dword [ebx + 0xf0]
subss xmm5, dword [ebx + 0xf4]
movss xmm2, dword [0x10286da0]
cvttss2si eax, dword [ecx]
mov dword [ebp + 8], 0
mov dword [ebp - 4], 2
movd xmm1, eax
cvttss2si eax, dword [ecx + 4]
cvtdq2ps xmm1, xmm1
movd xmm0, eax
ucomiss xmm1, xmm3
cvtdq2ps xmm0, xmm0
lahf
xor ecx, ecx
test ah, 0x44
mov eax, 1
cmovnp ecx, eax
ucomiss xmm0, xmm3
lahf
test ah, 0x44
mov eax, dword [ebp + 8]
cmovnp eax, dword [ebp - 4]
or eax, ecx
comiss xmm3, xmm1
mov dword [ebp + 8], eax
jb 0x10045b1d
addss xmm1, xmm4
comiss xmm1, xmm2
jae 0x10045b1d
movaps xmm1, xmm2
comiss xmm3, xmm0
jb 0x10045b2e
addss xmm0, xmm5
comiss xmm0, xmm2
jae 0x10045b2e
movaps xmm0, xmm2
or dword [esi + 0x470c], 2
mov ecx, dword [ebp - 0xc]
movss dword [esi + 0x472c], xmm1
movss dword [esi + 0x4730], xmm0
mov dword [esi + 0x4714], 1
mov eax, dword [ebx + 4]
push edx
test ecx, ecx
je 0x10045b71
push ecx
push eax
push str._s__s__08X
lea eax, [ebp - 4]
push 0
push eax
call fcn.1003f430
add esp, 0x18
jmp 0x10045b85
push eax
push str._s__08X
lea eax, [ebp - 4]
push 0
push eax
call fcn.1003f430
add esp, 0x14
cmp byte [ebp + 0xc], 0
movss xmm0, dword [esi + 0x37b0]
movss dword [ebp - 0xc], xmm0
jne 0x10045ba2
mov dword [esi + 0x37b0], 0
mov ecx, dword [ebp - 4]
xor edx, edx
push edi
call fcn.10048720
mov edi, dword [esi + 0x3e58]
add esp, 4
movss xmm0, dword [ebp - 0xc]
mov edx, dword [ebp - 8]
movss dword [esi + 0x37b0], xmm0
cmp word [edi + 0xb6], 1
mov byte [ebp + 0xf], al
mov eax, dword [ebp + 8]
mov dword [ebp - 0xc], edi
mov dword [edi + 0x74], edx
mov byte [edi + 0xc6], al
jne 0x10045bf4
mov ecx, dword [edi + 0x14]
mov eax, dword [edi + 0x18]
mov dword [ebx + 0xf0], ecx
mov dword [ebx + 0xf4], eax
mov edi, edx
mov al, 0x23
not edi
mov edx, 0x101a2451
mov ebx, edi
cmp al, 0x23
jne 0x10045c0f
cmp byte [edx], al
jne 0x10045c0f
cmp byte [edx + 1], al
cmove ebx, edi
movzx ecx, bl
movzx eax, al
xor ecx, eax
shr ebx, 8
mov al, byte [edx]
inc edx
xor ebx, dword [ecx*4 + 0x101a69c0]
test al, al
jne 0x10045c01
mov edi, dword [ebp - 0xc]
not ebx
cmp dword [esi + 0x3ea4], ebx
jne 0x10045c3e
xor edx, edx
xor ecx, ecx
call fcn.10042010
mov eax, dword [ebp - 8]
cmp dword [esi + 0x47e8], eax
jne 0x10045c8c
test dword [ebp + 0x10], 0x800000
jne 0x10045c8c
cmp word [edi + 0x14c], 0
jne 0x10045c65
cmp byte [edi + 0x152], 0
je 0x10045c8c
xor edx, edx
mov ecx, edi
call fcn.1004b660
xor dl, dl
mov ecx, edi
call fcn.10053130
mov edx, edi
mov ecx, ebx
call fcn.10042010
mov eax, dword [esi + 0x480c]
mov dword [esi + 0x3ec4], eax
mov al, byte [ebp + 0xf]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10056820
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push ecx
push ebx
push esi
push edi
mov edi, ecx
mov ebx, edx
cmp dword [edi + 0x5ad0], 0
lea esi, [edi + 0x5ad4]
je 0x100568a2
mov ecx, dword [esi + 4]
test ecx, ecx
jns 0x1005685c
mov eax, ecx
cdq
sub eax, edx
sar eax, 1
add eax, ecx
xor ecx, ecx
test eax, eax
cmovg ecx, eax
push ecx
mov ecx, esi
call fcn.100589b0
push dword [ebp + 8]
mov ecx, esi
mov dword [esi], 0
push ebx
call fcn.1003ff40
mov edx, dword [esi]
mov ecx, 0x1029c714
push dword [edi + 0x5ad0]
lea eax, [edx - 1]
neg edx
sbb edx, edx
and edx, eax
mov eax, dword [edi + 0x5adc]
test eax, eax
push edx
cmovne ecx, eax
push 1
push ecx
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
add esp, 0x10
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push dword [ebp + 8]
mov ecx, esi
push ebx
call fcn.1003ff40
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x100609b0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push esi
mov esi, ecx
push edi
mov edi, dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov ecx, dword [esi + 8]
test ecx, ecx
je 0x100609ea
mov eax, dword [0x1029c718]
mov dword [esi + 4], 0
mov dword [esi], 0
test eax, eax
je 0x100609dd
dec dword [eax + 0xac]
push ecx
call edi
add esp, 4
mov dword [esi + 8], 0
mov ecx, dword [esi + 0x14]
test ecx, ecx
je 0x10060a1b
mov eax, dword [0x1029c718]
mov dword [esi + 0x10], 0
mov dword [esi + 0xc], 0
test eax, eax
je 0x10060a0e
dec dword [eax + 0xac]
push ecx
call edi
add esp, 4
mov dword [esi + 0x14], 0
mov ecx, dword [esi + 0x20]
test ecx, ecx
je 0x10060a4c
mov eax, dword [0x1029c718]
mov dword [esi + 0x1c], 0
mov dword [esi + 0x18], 0
test eax, eax
je 0x10060a3f
dec dword [eax + 0xac]
push ecx
call edi
add esp, 4
mov dword [esi + 0x20], 0
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x34], 0
mov dword [esi + 0x38], 0
mov ecx, dword [esi + 0x44]
test ecx, ecx
je 0x10060a99
mov eax, dword [0x1029c718]
mov dword [esi + 0x40], 0
mov dword [esi + 0x3c], 0
test eax, eax
je 0x10060a8c
dec dword [eax + 0xac]
push ecx
call edi
add esp, 4
mov dword [esi + 0x44], 0
mov ecx, dword [esi + 0x50]
test ecx, ecx
je 0x10060aca
mov eax, dword [0x1029c718]
mov dword [esi + 0x4c], 0
mov dword [esi + 0x48], 0
test eax, eax
je 0x10060abd
dec dword [eax + 0xac]
push ecx
call edi
add esp, 4
mov dword [esi + 0x50], 0
mov ecx, dword [esi + 0x5c]
test ecx, ecx
je 0x10060afb
mov eax, dword [0x1029c718]
mov dword [esi + 0x58], 0
mov dword [esi + 0x54], 0
test eax, eax
je 0x10060aee
dec dword [eax + 0xac]
push ecx
call edi
add esp, 4
mov dword [esi + 0x5c], 0
pop edi
lea ecx, [esi + 0x78]
pop esi
jmp fcn.10063660
Function at 0x10069e70
Capabilities:
Log keystrokes via polling

Disassembly:
mov eax, dword [0x1029c718]
push ebx
mov ebx, dword [sym.imp.USER32.dll_GetKeyState]
push esi
cmp byte [eax + 0x2edc], 0
push edi
mov edi, dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__wassert]
je 0x10069efd
xor edx, edx
mov ecx, 0x210
call fcn.1004eef0
test al, al
je 0x10069efd
push 0xa0
call ebx
shr eax, 0xf
test al, 1
jne 0x10069efd
cmp dword [0x1029c718], 0
jne 0x10069ec8
push 0x1092
push str.C:UsersWraithDesktopFedoraware_masterFedorawareFedoraware_TF2includeImGuiimgui.cpp
push str.GImGui___0___No_current_context._Did_you_call_ImGui::CreateContext___and_ImGui::SetCurrentContext_____
call edi
add esp, 0xc
mov esi, dword [0x1029c718]
cmp byte [esi + 0x3769], 0
je 0x10069ee9
push 0
push 0x210
xorps xmm3, xmm3
lea ecx, [esi + 8]
call fcn.1003eac0
mov dword [esi + 0x338], 0x210
mov dword [esi + 0x8f8], 0xa0
mov eax, dword [0x1029c718]
cmp byte [eax + 0x2f1c], 0
je 0x10069f7b
xor edx, edx
mov ecx, 0x214
call fcn.1004eef0
test al, al
je 0x10069f7b
push 0xa1
call ebx
shr eax, 0xf
test al, 1
jne 0x10069f7b
cmp dword [0x1029c718], 0
jne 0x10069f46
push 0x1092
push str.C:UsersWraithDesktopFedoraware_masterFedorawareFedoraware_TF2includeImGuiimgui.cpp
push str.GImGui___0___No_current_context._Did_you_call_ImGui::CreateContext___and_ImGui::SetCurrentContext_____
call edi
add esp, 0xc
mov esi, dword [0x1029c718]
cmp byte [esi + 0x3769], 0
je 0x10069f67
push 0
push 0x214
xorps xmm3, xmm3
lea ecx, [esi + 8]
call fcn.1003eac0
mov dword [esi + 0x33c], 0x214
mov dword [esi + 0x908], 0xa1
mov eax, dword [0x1029c718]
cmp byte [eax + 0x2efc], 0
je 0x10069ff6
xor edx, edx
mov ecx, 0x212
call fcn.1004eef0
test al, al
je 0x10069ff6
push 0x5b
call ebx
shr eax, 0xf
test al, 1
jne 0x10069ff6
cmp dword [0x1029c718], 0
jne 0x10069fc1
push 0x1092
push str.C:UsersWraithDesktopFedoraware_masterFedorawareFedoraware_TF2includeImGuiimgui.cpp
push str.GImGui___0___No_current_context._Did_you_call_ImGui::CreateContext___and_ImGui::SetCurrentContext_____
call edi
add esp, 0xc
mov esi, dword [0x1029c718]
cmp byte [esi + 0x3769], 0
je 0x10069fe2
push 0
push 0x212
xorps xmm3, xmm3
lea ecx, [esi + 8]
call fcn.1003eac0
mov dword [esi + 0x224], 0x212
mov dword [esi + 0x900], 0x5b
mov eax, dword [0x1029c718]
cmp byte [eax + 0x2f3c], 0
je 0x1006a072
xor edx, edx
mov ecx, 0x216
call fcn.1004eef0
test al, al
je 0x1006a072
push 0x5c
call ebx
shr eax, 0xf
test al, 1
jne 0x1006a072
mov esi, dword [0x1029c718]
test esi, esi
jne 0x1006a043
push 0x1092
push str.C:UsersWraithDesktopFedoraware_masterFedorawareFedoraware_TF2includeImGuiimgui.cpp
push str.GImGui___0___No_current_context._Did_you_call_ImGui::CreateContext___and_ImGui::SetCurrentContext_____
call edi
mov esi, dword [0x1029c718]
add esp, 0xc
cmp byte [esi + 0x3769], 0
je 0x1006a05e
push 0
push 0x216
xorps xmm3, xmm3
lea ecx, [esi + 8]
call fcn.1003eac0
mov dword [esi + 0x228], 0x216
mov dword [esi + 0x910], 0x5c
pop edi
pop esi
pop ebx
ret
Function at 0x10071fd0
Capabilities:
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [0x1029c718]
push esi
mov esi, ecx
push edi
mov edi, dword [eax + 0x4a14]
cmp esi, 0xffffffff
jne 0x10071fef
cmp dword [edi + 0x48], ecx
cmovne esi, dword [edi + 0x48]
mov eax, dword [edi + 0x40]
cmp esi, eax
jne 0x10071ffb
or esi, 0xffffffff
jmp 0x10072000
cmp esi, 0xffffffff
jl 0x10072004
cmp esi, eax
jl 0x1007201c
push 0xc0c
push str.C:UsersWraithDesktopFedoraware_masterFedorawareFedoraware_TF2includeImGuiimgui_tables.cpp
push str.column_n____1__column_n___table__ColumnsCount
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__wassert]
add esp, 0xc
test byte [edi + 4], 7
je 0x10072075
mov ax, word [edi + 0x4c]
mov word [edi + 0x1cc], si
mov esi, 0x10272825
mov word [edi + 0x4e], ax
mov al, 0x23
mov byte [edi + 0x1e3], 1
mov edi, dword [edi]
not edi
mov ecx, edi
cmp al, 0x23
jne 0x10072053
cmp byte [esi], al
jne 0x10072053
cmp byte [esi + 1], al
cmove ecx, edi
movzx edx, cl
movzx eax, al
xor edx, eax
shr ecx, 8
mov al, byte [esi]
inc esi
xor ecx, dword [edx*4 + 0x101a69c0]
test al, al
jne 0x10072045
not ecx
xor edx, edx
call fcn.10050e50
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x10091350
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 0xc]
mov edx, 0x811c9dc5
push edi
mov edi, dword [ebp + 8]
mov ecx, 0
sub esi, edi
je 0x10091381
nop dword [eax]
movzx eax, byte [edi + ecx]
inc ecx
xor eax, edx
imul edx, eax, 0x1000193
cmp ecx, esi
jb 0x10091370
pop edi
mov eax, edx
pop esi
pop ebp
ret 8

Function at 0x10091fb0
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov edx, dword [ebp + 8]
mov eax, 0x1fffffff
push ebx
push esi
push edi
mov edi, ecx
mov esi, 1
bsr ecx, eax
mov eax, esi
mov dword [ebp - 4], edi
shl eax, cl
cmp edx, eax
jbe 0x10091fe1
push str.invalid_hash_bucket_count
call dword [sym.imp.MSVCP140.dll_void___cdecl_std::_Xlength_error_char_const__]
mov ebx, dword [edi + 4]
lea eax, [edx - 1]
or eax, 1
mov dword [ebp - 8], ebx
bsr ecx, eax
push ebx
lea ecx, [ecx + 1]
shl esi, cl
lea ecx, [edi + 0xc]
lea eax, [esi + esi]
push eax
call fcn.10091ca0
lea eax, [esi - 1]
mov dword [edi + 0x1c], esi
mov dword [edi + 0x18], eax
mov ecx, dword [edi + 4]
mov ecx, dword [ecx]
cmp ecx, ebx
je 0x100920e7
mov eax, ecx
nop word [eax + eax]
movzx edx, byte [eax + 8]
xor edx, 0x811c9dc5
mov ecx, dword [ecx]
imul esi, edx, 0x1000193
movzx edx, byte [eax + 9]
xor esi, edx
movzx edx, byte [eax + 0xa]
imul esi, esi, 0x1000193
xor esi, edx
movzx edx, byte [eax + 0xb]
imul esi, esi, 0x1000193
xor esi, edx
imul edx, esi, 0x1000193
mov esi, dword [edi + 0x18]
and esi, edx
mov edx, dword [edi + 0xc]
lea ebx, [edx + esi*8]
mov esi, dword [ebx]
mov dword [ebp + 8], ebx
cmp esi, dword [ebp - 8]
jne 0x10092072
mov dword [ebx], eax
mov dword [ebx + 4], eax
jmp 0x100920dc
mov edx, dword [ebx + 4]
mov edi, dword [eax + 8]
cmp edi, dword [edx + 8]
jne 0x100920a9
mov edx, dword [edx]
mov dword [ebp - 0xc], edx
cmp edx, eax
je 0x100920a4
mov edi, dword [eax + 4]
mov ebx, dword [ebp - 0xc]
mov dword [edi], ecx
mov esi, dword [ecx + 4]
mov dword [esi], edx
mov edx, dword [edx + 4]
mov dword [edx], eax
mov dword [ebx + 4], esi
mov ebx, dword [ebp + 8]
mov dword [ecx + 4], edi
mov dword [eax + 4], edx
mov dword [ebx + 4], eax
jmp 0x100920d9
cmp esi, edx
je 0x100920bc
nop dword [eax]
mov edx, dword [edx + 4]
cmp edi, dword [edx + 8]
je 0x100920f0
cmp esi, edx
jne 0x100920b0
mov ebx, dword [eax + 4]
mov dword [ebx], ecx
mov edi, dword [ecx + 4]
mov dword [edi], edx
mov esi, dword [edx + 4]
mov dword [esi], eax
mov dword [edx + 4], edi
mov edx, dword [ebp + 8]
mov dword [ecx + 4], ebx
mov dword [eax + 4], esi
mov dword [edx], eax
mov edi, dword [ebp - 4]
mov eax, ecx
cmp ecx, dword [ebp - 8]
jne 0x10092020
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
mov edi, dword [eax + 4]
mov ebx, dword [edx]
mov dword [edi], ecx
mov esi, dword [ecx + 4]
mov dword [esi], ebx
mov edx, dword [ebx + 4]
mov dword [edx], eax
mov dword [ebx + 4], esi
mov dword [ecx + 4], edi
mov dword [eax + 4], edx
jmp 0x100920d9
Function at 0x10092110
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
sub esp, 0x18
mov edx, dword [ebp + 8]
push ebx
mov ebx, ecx
cmp edx, eax
je 0x10092266
mov eax, dword [ebx + 4]
mov dword [ebp - 0x10], eax
mov eax, dword [edx + 4]
mov dword [ebp - 4], eax
movzx eax, byte [edx + 8]
xor eax, 0x811c9dc5
imul ecx, eax, 0x1000193
movzx eax, byte [edx + 9]
push esi
push edi
mov edi, dword [ebx + 0xc]
mov esi, edx
xor ecx, eax
mov dword [ebp - 0x18], edi
movzx eax, byte [edx + 0xa]
imul ecx, ecx, 0x1000193
xor ecx, eax
movzx eax, byte [edx + 0xb]
imul ecx, ecx, 0x1000193
xor ecx, eax
mov eax, dword [ebx + 0x18]
imul ecx, ecx, 0x1000193
and eax, ecx
mov ecx, dword [edi + eax*8]
mov dword [ebp - 0xc], ecx
lea eax, [edi + eax*8]
mov dword [ebp - 8], eax
mov eax, dword [eax + 4]
mov dword [ebp - 0x14], eax
mov eax, esi
mov edi, esi
mov esi, dword [esi]
push 0xc
push eax
call fcn.101706c8
dec dword [ebx + 8]
add esp, 8
cmp edi, dword [ebp - 0x14]
je 0x100921c9
mov eax, dword [ebp + 0xc]
cmp esi, eax
jne 0x10092187
mov ecx, dword [ebp - 0xc]
cmp ecx, dword [ebp + 8]
jne 0x1009225c
mov edx, dword [ebp - 8]
mov ecx, dword [ebp - 4]
pop edi
mov dword [edx], esi
mov dword [ecx], esi
mov dword [esi + 4], ecx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
mov ecx, dword [ebp - 0xc]
mov edx, dword [ebp - 8]
cmp ecx, dword [ebp + 8]
jne 0x100921dd
mov eax, dword [ebp - 0x10]
mov ecx, eax
mov dword [edx], eax
jmp 0x100921e0
mov ecx, dword [ebp - 4]
mov eax, dword [ebp + 0xc]
mov dword [edx + 4], ecx
cmp esi, eax
je 0x1009225c
nop word [eax + eax]
movzx eax, byte [esi + 8]
xor eax, 0x811c9dc5
imul ecx, eax, 0x1000193
movzx eax, byte [esi + 9]
xor ecx, eax
movzx eax, byte [esi + 0xa]
imul ecx, ecx, 0x1000193
xor ecx, eax
movzx eax, byte [esi + 0xb]
imul ecx, ecx, 0x1000193
xor ecx, eax
mov eax, dword [ebx + 0x18]
imul ecx, ecx, 0x1000193
and eax, ecx
mov ecx, dword [ebp - 0x18]
lea eax, [ecx + eax*8]
mov dword [ebp + 8], eax
mov eax, dword [eax + 4]
mov dword [ebp - 0x14], eax
mov eax, esi
mov edi, esi
mov esi, dword [esi]
push 0xc
push eax
call fcn.101706c8
dec dword [ebx + 8]
add esp, 8
mov eax, dword [ebp + 0xc]
cmp edi, dword [ebp - 0x14]
je 0x1009226d
cmp esi, eax
jne 0x10092237
mov ecx, dword [ebp + 8]
mov dword [ecx], esi
mov ecx, dword [ebp - 4]
pop edi
mov dword [ecx], esi
mov dword [esi + 4], ecx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
mov ecx, dword [ebp + 8]
mov edx, dword [ebp - 0x10]
mov dword [ecx], edx
mov dword [ecx + 4], edx
cmp esi, eax
jne 0x100921f0
mov ecx, dword [ebp - 4]
pop edi
mov dword [ecx], esi
mov dword [esi + 4], ecx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x10092670
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
mov dword [ebp - 4], ecx
cmp edx, eax
je 0x1009280a
cmp dword [edx + 0x1c], 0xf
mov eax, dword [ecx + 4]
push esi
mov dword [ebp - 0x18], eax
mov esi, edx
mov eax, dword [ecx + 0xc]
push edi
mov dword [ebp - 0x14], eax
lea edi, [edx + 8]
mov eax, dword [edx + 4]
mov dword [ebp - 8], eax
mov eax, dword [edi + 0x10]
jbe 0x100926ab
mov edi, dword [edi]
xor edx, edx
push ebx
mov ebx, 0x811c9dc5
test eax, eax
je 0x100926d4
mov ecx, eax
nop dword [eax]
movzx eax, byte [edi + edx]
inc edx
xor eax, ebx
imul ebx, eax, 0x1000193
cmp edx, ecx
jb 0x100926c0
mov ecx, dword [ebp - 4]
mov eax, dword [ecx + 0x18]
mov ecx, dword [ebp - 0x14]
and eax, ebx
lea eax, [ecx + eax*8]
mov ecx, dword [eax]
mov dword [ebp - 0xc], eax
mov eax, dword [eax + 4]
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0x1c], eax
nop dword [eax]
mov edi, esi
mov ebx, esi
mov esi, dword [esi]
lea edx, [edi + 8]
call fcn.10095350
push 0x40
push edi
call fcn.101706c8
mov eax, dword [ebp - 4]
add esp, 8
dec dword [eax + 8]
cmp ebx, dword [ebp - 0x1c]
je 0x10092739
mov eax, dword [ebp + 0xc]
cmp esi, eax
jne 0x100926f0
mov ecx, dword [ebp - 0x10]
cmp ecx, dword [ebp + 8]
jne 0x10092728
mov edx, dword [ebp - 0xc]
mov dword [edx], esi
mov ecx, dword [ebp - 8]
pop ebx
pop edi
mov dword [ecx], esi
mov dword [esi + 4], ecx
pop esi
mov esp, ebp
pop ebp
ret 8
mov ecx, dword [ebp - 0x10]
mov edx, dword [ebp - 0xc]
cmp ecx, dword [ebp + 8]
jne 0x1009274b
mov ecx, dword [ebp - 0x18]
mov dword [edx], ecx
jmp 0x1009274e
mov ecx, dword [ebp - 8]
mov dword [edx + 4], ecx
mov ecx, dword [ebp + 0xc]
cmp esi, ecx
je 0x100927fd
nop dword [eax]
cmp dword [esi + 0x1c], 0xf
lea edi, [esi + 8]
mov ebx, dword [edi + 0x10]
jbe 0x1009276e
mov edi, dword [edi]
xor ecx, ecx
mov edx, 0x811c9dc5
test ebx, ebx
je 0x10092794
nop dword [eax]
movzx eax, byte [edi + ecx]
inc ecx
xor eax, edx
imul edx, eax, 0x1000193
cmp ecx, ebx
jb 0x10092780
mov eax, dword [ebp - 4]
and edx, dword [eax + 0x18]
mov eax, dword [ebp - 0x14]
lea eax, [eax + edx*8]
mov dword [ebp + 8], eax
mov eax, dword [eax + 4]
mov dword [ebp - 0x1c], eax
mov edi, esi
mov ebx, esi
mov esi, dword [esi]
lea edx, [edi + 8]
call fcn.10095350
push 0x40
push edi
call fcn.101706c8
mov eax, dword [ebp - 4]
add esp, 8
dec dword [eax + 8]
cmp ebx, dword [ebp - 0x1c]
je 0x100927e7
mov eax, dword [ebp + 0xc]
cmp esi, eax
jne 0x100927a6
mov ecx, dword [ebp + 8]
pop ebx
pop edi
mov dword [ecx], esi
mov ecx, dword [ebp - 8]
mov dword [ecx], esi
mov dword [esi + 4], ecx
pop esi
mov esp, ebp
pop ebp
ret 8
mov ecx, dword [ebp + 8]
mov edx, dword [ebp - 0x18]
mov dword [ecx], edx
mov dword [ecx + 4], edx
mov ecx, dword [ebp + 0xc]
cmp esi, ecx
jne 0x10092760
mov eax, dword [ebp - 8]
pop ebx
pop edi
mov dword [eax], esi
mov dword [esi + 4], eax
mov eax, ecx
pop esi
mov esp, ebp
pop ebp
ret 8
Function at 0x100957c0
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x101734f3
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebx
push esi
push edi
mov edi, ecx
mov dword [ebp - 0x10], edi
mov dword [edi + 4], 0
mov dword [edi + 8], 0
mov dword [edi + 0xc], 0
mov dword [edi + 0x10], 0
mov dword [edi + 0x14], 0
mov dword [edi + 0x18], 0
mov dword [edi + 0x1c], 0
mov dword [ebp - 4], 0
mov dword [edi + 0x24], 0
mov dword [edi + 0x28], 0
mov dword [edi + 0x2c], 0
mov dword [edi + 0x30], 0
mov dword [edi + 0x34], 0
mov dword [edi + 0x38], 0
mov dword [edi + 0x3c], 0
lea ecx, [edi + 0x40]
mov dword [ecx], 0
mov dword [ecx + 4], 0
mov dword [ecx + 8], 0
mov eax, dword [ebp + 0xc]
mov esi, dword [ebp + 0x14]
mov edx, dword [ebp + 0x20]
mov byte [ebp - 4], 2
mov dword [edi + 0x50], eax
mov eax, dword [ebp + 8]
mov dword [edi + 0x54], eax
mov eax, dword [ebp + 0x1c]
mov dword [edi + 0x5c], eax
mov eax, dword [ebp + 0x18]
mov dword [edi + 0x58], esi
mov dword [edi + 0x60], edx
mov byte [edi + 0x64], 0
mov dword [edi + 0x68], eax
test byte [esi + 8], 8
je 0x1009589c
test dl, 0x10
jne 0x1009589c
mov al, 1
jmp 0x1009589e
xor al, al
mov byte [edi + 0x6c], al
mov eax, dword [ebp + 0x10]
mov dword [edi + 0x70], eax
mov ebx, dword [ecx + 4]
mov edx, ebx
mov esi, dword [esi + 0x18]
sar edx, 3
cmp esi, edx
jae 0x100958c2
lea eax, [esi*8]
mov dword [ecx + 4], eax
jmp 0x100958f2
jbe 0x100958f2
mov eax, dword [ecx + 8]
sar eax, 3
cmp esi, eax
jbe 0x100958d7
push ecx
push esi
call fcn.10097280
jmp 0x100958f2
sub esi, edx
je 0x100958ef
shl esi, 3
push esi
push 0
push ebx
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
lea ecx, [edi + 0x40]
add ebx, esi
mov dword [ecx + 4], ebx
mov ecx, dword [ebp - 0xc]
mov eax, edi
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 0x1c