joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1006c360
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
push esi
push edi
mov edi, ecx
movzx edx, byte [eax + 8]
movzx ecx, byte [eax + 0xa]
xor edx, 0x811c9dc5
imul esi, edx, 0x1000193
movzx edx, byte [eax + 9]
xor esi, edx
imul edx, esi, 0x1000193
xor edx, ecx
movzx ecx, byte [eax + 0xb]
imul edx, edx, 0x1000193
xor edx, ecx
imul ecx, edx, 0x1000193
mov edx, dword [edi + 0x18]
and edx, ecx
lea esi, [edx*8]
mov edx, dword [edi + 0xc]
add edx, esi
mov ecx, dword [edx]
cmp dword [edx + 4], eax
jne 0x1006c3d3
cmp ecx, eax
jne 0x1006c3cb
mov ecx, dword [edi + 4]
mov dword [edx], ecx
mov edx, dword [edi + 0xc]
mov ecx, dword [edi + 4]
mov dword [esi + edx + 4], ecx
jmp 0x1006c3db
mov ecx, dword [eax + 4]
mov dword [edx + 4], ecx
jmp 0x1006c3db
cmp ecx, eax
jne 0x1006c3db
mov ecx, dword [eax]
mov dword [edx], ecx
mov ecx, dword [eax + 4]
mov esi, dword [eax]
push 0x20
push eax
mov dword [ecx], esi
mov edx, dword [eax]
mov ecx, dword [eax + 4]
mov dword [edx + 4], ecx
dec dword [edi + 8]
call fcn.100bd88f
mov eax, dword [ebp + 8]
add esp, 8
pop edi
mov dword [eax], esi
pop esi
pop ebp
ret 8

Function at 0x1006d1e0
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
cmp byte [0x1012932d], 0
push esi
je 0x1006d246
mov eax, dword [0x10129254]
xor esi, esi
mov edx, dword [ebp + 8]
add eax, 0xa0
nop dword [eax]
mov ecx, dword [eax - 0xa0]
or ecx, dword [eax - 0x9c]
je 0x1006d23d
mov ecx, dword [eax - 0x50]
cmp ecx, dword [edx + 8]
jne 0x1006d23d
mov ecx, dword [eax - 0x4c]
cmp ecx, dword [edx + 0xc]
jne 0x1006d23d
mov ecx, dword [eax]
cmp ecx, dword [edx + 0x10]
jne 0x1006d23d
mov ecx, dword [eax + 4]
cmp ecx, dword [edx + 0x14]
jne 0x1006d23d
mov ecx, dword [eax + 0x50]
cmp ecx, dword [edx + 0x18]
jne 0x1006d23d
mov ecx, dword [eax + 0x54]
cmp ecx, dword [edx + 0x1c]
je 0x1006d24b
inc esi
add eax, 8
cmp esi, 0xa
jl 0x1006d200
xor al, al
pop esi
pop ebp
ret
mov esi, dword [sym.imp.USER32.dll_GetKeyState]
push 0x11
call esi
test al, 0xf0
jne 0x1006d269
push 0x10
call esi
test al, 0xf0
je 0x1006d277
push 0xd
call esi
test al, 0xf0
jne 0x1006d277
mov eax, dword [0x10129254]
cmp byte [eax + 0x9f8], 0
jne 0x1006d246
mov al, 1
pop esi
pop ebp
ret
Function at 0x1006dbf0
Capabilities:
Hash data using djb2
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3f0
mov eax, dword [0x10122fb8]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov edi, dword [ebp + 0x10]
mov eax, dword [edi + 0x10]
add eax, eax
cmp dword [edi + 0x14], 8
jb 0x1006dc16
mov edi, dword [edi]
xor ebx, ebx
mov esi, 0x1505
test eax, eax
je 0x1006dc4d
dec eax
lea edi, [edi + 1]
mov dword [ebp - 0x3f0], eax
mov ecx, ebx
mov eax, esi
shld ebx, esi, 5
shl esi, 5
add esi, eax
movzx eax, byte [edi - 1]
cdq
adc ebx, ecx
add esi, eax
mov eax, dword [ebp - 0x3f0]
adc ebx, edx
test eax, eax
jne 0x1006dc21
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push ebx
push esi
push eax
lea eax, [ebp - 0x3ec]
push str.LUNA_NOTIFY._d._llu
push eax
call fcn.10020930
add esp, 0x14
lea eax, [ebp - 0x3ec]
push eax
push 0
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateEventA]
mov ebx, dword [ebp + 8]
mov dword [ebp - 0x3f0], eax
test ebx, ebx
je 0x1006dcf6
mov esi, dword [ebp + 0xc]
cmp byte [0x1012932d], 0
mov edi, dword [sym.imp.USER32.dll_GetKeyState]
je 0x1006dcf6
mov eax, dword [0x10129254]
xor edx, edx
add eax, 0xa0
nop dword [eax + eax]
mov ecx, dword [eax - 0xa0]
or ecx, dword [eax - 0x9c]
je 0x1006dced
mov ecx, dword [eax - 0x50]
cmp ecx, dword [esi + 8]
jne 0x1006dced
mov ecx, dword [eax - 0x4c]
cmp ecx, dword [esi + 0xc]
jne 0x1006dced
mov ecx, dword [eax]
cmp ecx, dword [esi + 0x10]
jne 0x1006dced
mov ecx, dword [eax + 4]
cmp ecx, dword [esi + 0x14]
jne 0x1006dced
mov ecx, dword [eax + 0x50]
cmp ecx, dword [esi + 0x18]
jne 0x1006dced
mov ecx, dword [eax + 0x54]
cmp ecx, dword [esi + 0x1c]
je 0x1006dd17
inc edx
add eax, 8
cmp edx, 0xa
jl 0x1006dcb0
xor bl, bl
push dword [ebp - 0x3f0]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 4]
mov al, bl
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.100bd89d
mov esp, ebp
pop ebp
ret
push 0x11
call edi
test al, 0xf0
jne 0x1006dd2f
push 0x10
call edi
test al, 0xf0
je 0x1006dd3d
push 0xd
call edi
test al, 0xf0
jne 0x1006dd3d
mov eax, dword [0x10129254]
cmp byte [eax + 0x9f8], 0
jne 0x1006dcf6
cmp ebx, 0x64
mov eax, 0x64
mov edi, ebx
cmova edi, eax
push edi
push dword [ebp - 0x3f0]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x1006dd64
sub ebx, edi
je 0x1006dcf6
jmp 0x1006dc8d
mov bl, 1
jmp 0x1006dcf8
Function at 0x10070970
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100e5950
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x10122fb8]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push 0x10ca0944
call fcn.10091460
add esp, 4
test eax, eax
je 0x100709b0
push eax
call fcn.10091680
add esp, 4
mov ecx, dword [0x10ca0974]
test ecx, ecx
je 0x10070a9f
mov ecx, dword [ecx]
xor edx, edx
xor ebx, ebx
test ecx, ecx
je 0x10070a9f
mov edi, dword [ebp + 8]
nop
mov esi, dword [ecx + 8]
mov eax, edi
sub eax, esi
cmp eax, edx
ja 0x100709e5
mov ebx, ecx
test edx, edx
je 0x100709ec
mov edx, edi
sub edx, esi
mov ecx, dword [ecx + 4]
test ecx, ecx
jne 0x100709d0
test ebx, ebx
je 0x10070a9f
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [ebp - 0x10]
push eax
push 0x40
push 4
push dword [ebx + 8]
call esi
test eax, eax
je 0x10070a21
mov ecx, dword [ebx + 8]
mov al, byte [ebx + 0x44]
mov byte [ecx], al
lea eax, [ebp - 0x10]
push eax
push dword [ebx + 0x48]
push 4
push dword [ebx + 8]
call esi
push dword [ebx + 0x38]
call dword [sym.imp.KERNEL32.dll_RemoveVectoredExceptionHandler]
mov ecx, dword [0x10ca0974]
mov edx, dword [ecx]
mov esi, edx
test esi, esi
je 0x10070a9b
cmp dword [esi + 8], edi
je 0x10070a48
mov esi, dword [esi + 4]
test esi, esi
jne 0x10070a38
mov bl, 1
jmp 0x10070aa1
cmp dword [ecx + 4], esi
jne 0x10070a52
mov eax, dword [esi]
mov dword [ecx + 4], eax
cmp edx, esi
jne 0x10070a5b
mov eax, dword [esi + 4]
mov dword [ecx], eax
mov ecx, dword [esi]
test ecx, ecx
je 0x10070a67
mov eax, dword [esi + 4]
mov dword [ecx + 4], eax
mov ecx, dword [esi + 4]
test ecx, ecx
je 0x10070a72
mov eax, dword [esi]
mov dword [ecx], eax
mov ecx, dword [esi + 0x34]
lea edi, [esi + 0x10]
test ecx, ecx
je 0x10070a90
mov eax, dword [ecx]
cmp ecx, edi
mov edx, dword [eax + 0x10]
setne al
push eax
call edx
mov dword [edi + 0x24], 0
push 0x50
push esi
call fcn.100bd88f
add esp, 8
mov bl, 1
jmp 0x10070aa1
xor bl, bl
push 0x10ca0944
mov dword [ebp - 4], 0
call fcn.10091485
add esp, 4
test eax, eax
je 0x10070ac2
push eax
call fcn.10091680
add esp, 4
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x10070ae0
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
lea eax, [ebp + 8]
push eax
push 0x40
push 4
push dword [esi + 8]
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
je 0x10070b16
mov ecx, dword [esi + 8]
mov al, byte [esi + 0x44]
mov byte [ecx], al
lea eax, [ebp + 8]
push eax
push dword [esi + 0x48]
push 4
push dword [esi + 8]
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
pop esi
pop ebp
ret
Function at 0x10074590
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
imul esi, dword [ebp + 8], 0x2c
push edi
add esi, dword [0x10ca23f0]
mov eax, dword [esi]
mov cl, byte [esi + 0x14]
and cl, 1
lea edi, [eax - 5]
cmove edi, eax
movzx eax, cl
lea ecx, [ebp + 8]
push ecx
push 0x40
lea eax, [eax*2 + 5]
push eax
push edi
mov dword [ebp - 4], eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x100745d8
pop edi
mov eax, 0xa
pop esi
mov esp, ebp
pop ebp
ret
push ebx
mov ebx, dword [ebp + 0xc]
test ebx, ebx
je 0x100745fd
mov byte [edi], 0xe9
mov eax, dword [esi + 4]
sub eax, edi
sub eax, 5
mov dword [edi + 1], eax
test byte [esi + 0x14], 1
je 0x1007461e
mov eax, dword [esi]
mov word [eax], 0xf9eb
jmp 0x1007461e
mov eax, dword [esi + 0xc]
test byte [esi + 0x14], 1
mov dword [edi], eax
je 0x10074618
mov ax, word [esi + 0x10]
mov word [edi + 4], ax
mov al, byte [esi + 0x12]
mov byte [edi + 6], al
jmp 0x1007461e
mov al, byte [esi + 0x10]
mov byte [edi + 4], al
lea eax, [ebp + 8]
push eax
push dword [ebp + 8]
push dword [ebp - 4]
push edi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
push dword [ebp - 4]
push edi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_FlushInstructionCache]
mov al, byte [esi + 0x14]
and bl, 1
mov cl, bl
and al, 0xfd
add cl, cl
shl bl, 2
or cl, al
and cl, 0xfb
or cl, bl
xor eax, eax
pop ebx
pop edi
mov byte [esi + 0x14], cl
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x10074700
Capabilities:
Enumerate threads
Suspend thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [0x10122fb8]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 8]
xor ebx, ebx
push edi
push ebx
push 4
mov dword [esi], 0
mov dword [esi + 4], 0
mov dword [esi + 8], 0
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov edi, eax
cmp edi, 0xffffffff
je 0x1007487b
lea eax, [ebp - 0x20]
mov dword [ebp - 0x20], 0x1c
push eax
push edi
call sub.KERNEL32.dll_Thread32First
test eax, eax
je 0x10074815
mov ebx, 1
nop dword [eax]
cmp dword [ebp - 0x20], 0x10
jb 0x100747d9
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
cmp dword [ebp - 0x14], eax
jne 0x100747d9
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp dword [ebp - 0x18], eax
je 0x100747d9
mov edx, dword [esi]
test edx, edx
jne 0x100747a5
push 0x200
push edx
mov dword [esi + 4], 0x80
push dword [0x10ca0994]
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov edx, eax
mov dword [esi], edx
test edx, edx
je 0x100747fd
jmp 0x100747cd
mov eax, dword [esi + 4]
cmp dword [esi + 8], eax
jb 0x100747cd
add eax, eax
mov dword [esi + 4], eax
shl eax, 2
push eax
push edx
push 0
push dword [0x10ca0994]
call dword [sym.imp.KERNEL32.dll_HeapReAlloc]
mov edx, eax
test edx, edx
je 0x100747fd
mov dword [esi], edx
mov ecx, dword [esi + 8]
mov eax, dword [ebp - 0x18]
mov dword [edx + ecx*4], eax
inc dword [esi + 8]
lea eax, [ebp - 0x20]
mov dword [ebp - 0x20], 0x1c
push eax
push edi
call sub.KERNEL32.dll_Thread32Next
test eax, eax
jne 0x10074760
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x12
je 0x10074815
mov eax, dword [esi]
xor ebx, ebx
test eax, eax
je 0x10074815
push eax
push ebx
push dword [0x10ca0994]
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov dword [esi], ebx
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test ebx, ebx
je 0x1007487b
cmp dword [esi], 0
je 0x10074868
xor ebx, ebx
cmp dword [esi + 8], ebx
jbe 0x10074868
nop dword [eax]
mov eax, dword [esi]
push dword [eax + ebx*4]
push 0
push 0x5a
call dword [sym.imp.KERNEL32.dll_OpenThread]
mov edi, eax
test edi, edi
je 0x10074862
push edi
call dword [sym.imp.KERNEL32.dll_SuspendThread]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push edi
call fcn.10074f30
add esp, 0xc
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
inc ebx
cmp ebx, dword [esi + 8]
jb 0x10074830
pop edi
pop esi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100bd89d
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
mov eax, 9
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.100bd89d
mov esp, ebp
pop ebp
ret
Function at 0x100751a0
Capabilities:
Resume thread

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
mov eax, dword [ebx]
test eax, eax
je 0x100751f2
push esi
xor esi, esi
cmp dword [ebx + 8], esi
jbe 0x100751e2
push edi
mov eax, dword [ebx]
push dword [eax + esi*4]
push 0
push 0x5a
call dword [sym.imp.KERNEL32.dll_OpenThread]
mov edi, eax
test edi, edi
je 0x100751d9
push edi
call dword [sym.imp.KERNEL32.dll_ResumeThread]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
inc esi
cmp esi, dword [ebx + 8]
jb 0x100751b6
mov eax, dword [ebx]
pop edi
push eax
push 0
push dword [0x10ca0994]
call dword [sym.imp.KERNEL32.dll_HeapFree]
pop esi
pop ebx
pop ebp
ret

Function at 0x10075200
Capabilities:
Allocate or change rwx memory

Disassembly:
mov eax, dword [0x10ca23ec]
test eax, eax
je 0x1007521c
nop dword [eax]
cmp dword [eax + 4], 0
jne 0x10075274
mov eax, dword [eax]
test eax, eax
jne 0x10075210
push 0x40
push 0x3000
push 0x1000
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
test eax, eax
je 0x10075286
push esi
lea edx, [eax + 0x20]
mov dword [eax + 4], 0
mov dword [eax + 8], 0
mov esi, 0x20
nop dword [eax + eax]
mov ecx, dword [eax + 4]
add esi, 0x20
mov dword [edx], ecx
mov dword [eax + 4], edx
add edx, 0x20
cmp esi, 0xfe0
jbe 0x10075250
mov ecx, dword [0x10ca23ec]
mov dword [eax], ecx
mov dword [0x10ca23ec], eax
pop esi
test eax, eax
je 0x10075286
mov edx, dword [eax + 4]
mov ecx, dword [edx]
inc dword [eax + 8]
mov dword [eax + 4], ecx
mov eax, edx
ret
xor eax, eax
ret
Function at 0x100765b0
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
push esi
push edi
mov edi, ecx
movzx edx, byte [eax + 8]
movzx ecx, byte [eax + 0xa]
xor edx, 0x811c9dc5
imul esi, edx, 0x1000193
movzx edx, byte [eax + 9]
xor esi, edx
imul edx, esi, 0x1000193
xor edx, ecx
movzx ecx, byte [eax + 0xb]
imul edx, edx, 0x1000193
xor edx, ecx
imul ecx, edx, 0x1000193
mov edx, dword [edi + 0x18]
and edx, ecx
lea esi, [edx*8]
mov edx, dword [edi + 0xc]
add edx, esi
mov ecx, dword [edx]
cmp dword [edx + 4], eax
jne 0x10076623
cmp ecx, eax
jne 0x1007661b
mov ecx, dword [edi + 4]
mov dword [edx], ecx
mov edx, dword [edi + 0xc]
mov ecx, dword [edi + 4]
mov dword [esi + edx + 4], ecx
jmp 0x1007662b
mov ecx, dword [eax + 4]
mov dword [edx + 4], ecx
jmp 0x1007662b
cmp ecx, eax
jne 0x1007662b
mov ecx, dword [eax]
mov dword [edx], ecx
mov ecx, dword [eax + 4]
mov esi, dword [eax]
push 0x30
push eax
mov dword [ecx], esi
mov edx, dword [eax]
mov ecx, dword [eax + 4]
mov dword [edx + 4], ecx
dec dword [edi + 8]
call fcn.100bd88f
mov eax, dword [ebp + 8]
add esp, 8
pop edi
mov dword [eax], esi
pop esi
pop ebp
ret 8

Function at 0x100768b0
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
sub esp, 8
mov eax, dword [eax + 0x198]
push esi
mov esi, dword [eax]
mov eax, esi
and eax, 0x3e000000
cmp eax, 0x8000000
je 0x100768fe
mov eax, esi
and eax, 0x3f800000
cmp eax, 0x4000000
je 0x100768fe
mov eax, esi
and eax, 0xbfffc000
cmp eax, 0x10000
je 0x100768fe
mov eax, esi
and eax, 0x3f000000
cmp eax, 0x8000000
jb 0x100769bc
mov eax, dword [ebp + 8]
push ebx
push edi
mov ebx, dword [eax + 0x20]
mov eax, ebx
shr eax, 8
movzx ecx, al
movzx eax, bl
xor eax, 0x811c9dc5
mov dword [ebp + 0xc], ebx
imul eax, eax, 0x1000193
xor ecx, eax
mov eax, ebx
imul ecx, ecx, 0x1000193
shr eax, 0x10
movzx eax, al
xor ecx, eax
mov eax, ebx
imul ecx, ecx, 0x1000193
shr eax, 0x18
xor ecx, eax
imul eax, ecx, 0x1000193
mov ecx, dword [0x10ca09cc]
and eax, dword [0x10ca09d8]
mov edi, dword [ecx + eax*8]
lea edx, [eax*8]
mov eax, dword [edx + ecx]
add ecx, 4
add ecx, edx
mov edx, dword [0x10ca09c4]
mov dword [ebp + 8], ecx
nop dword [eax + eax]
cmp edi, edx
jne 0x10076978
mov ecx, edx
jmp 0x1007697c
mov ecx, dword [ecx]
mov ecx, dword [ecx]
cmp eax, ecx
je 0x10076990
cmp dword [eax + 8], ebx
je 0x1007698c
mov eax, dword [eax]
mov ecx, dword [ebp + 8]
jmp 0x10076970
cmp eax, edx
jne 0x100769b1
push dword [ebp + 0xc]
lea eax, [ebp + 0xc]
mov ecx, 0x10ca09c0
push eax
lea eax, [ebp - 8]
push eax
call fcn.10036810
push dword [ebp + 0xc]
push esi
call fcn.1007a090
add esp, 8
push esi
call fcn.10007000
add esp, 4
pop edi
pop ebx
pop esi
mov esp, ebp
pop ebp
ret 0x14
Function at 0x1007cd50
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
cmp dword [ebp + 8], 0
je 0x1007ce97
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str._RequestInterrupt_Isolate_v8__QAEXP6AXPAV12_PAX_Z1_Z
push dword [0x10ca09f8]
call esi
push str._NewFromUtf8_String_v8__SA_AV__MaybeLocal_VString_v8___2_PAVIsolate_2_PBDW4NewStringType_2_H_Z
push dword [0x10ca09f8]
mov dword [0x10ca09fc], eax
call esi
push str._NewFromUtf8_String_v8__SA_AV__Local_VString_v8___2_PAVIsolate_2_PBDW4NewStringType_12_H_Z
push dword [0x10ca09f8]
mov dword [0x10ca0a04], eax
call esi
push str._GetCurrentContext_Isolate_v8__QAE_AV__Local_VContext_v8___2_XZ
push dword [0x10ca09f8]
mov dword [0x10ca0a08], eax
call esi
mov ecx, dword [0x10ca0a08]
mov dword [0x10ca0a0c], eax
test ecx, ecx
je 0x1007cdeb
push str._Compile_Script_v8__SA_AV__Local_VScript_v8___2_V__Handle_VString_v8___2_PAVScriptOrigin_2__Z
push dword [0x10ca09f8]
mov dword [0x10ca0a00], ecx
call esi
mov dword [0x10ca0a10], eax
test eax, eax
jne 0x1007cde4
push str._Compile_Script_v8__SA_AV__Local_VScript_v8___2_V__Local_VString_v8___2_PAVScriptOrigin_2__Z
push dword [0x10ca09f8]
call esi
mov dword [0x10ca0a10], eax
push str._Run_Script_v8__QAE_AV__Local_VValue_v8___2_XZ
jmp 0x1007ce10
mov eax, dword [0x10ca0a04]
test eax, eax
je 0x1007ce28
push str._Compile_Script_v8__SA_AV__MaybeLocal_VScript_v8___2_V__Local_VContext_v8___2_V__Local_VString_v8___2_PAVScriptOrigin_2__Z
push dword [0x10ca09f8]
mov dword [0x10ca0a00], eax
call esi
mov dword [0x10ca0a10], eax
push str._Run_Script_v8__QAE_AV__MaybeLocal_VValue_v8___2_V__Local_VContext_v8___2__Z
push dword [0x10ca09f8]
call esi
mov ecx, dword [0x10ca0a08]
mov dword [0x10ca0a14], eax
mov eax, dword [0x10ca0a04]
push eax
push ecx
push str._p__p
call fcn.10004e70
push dword [0x10ca0a14]
push dword [0x10ca0a10]
push dword [0x10ca0a00]
push dword [0x10ca0a0c]
push str._p__p__p__p
call fcn.10004e70
add esp, 0x20
cmp dword [0x10ca0a0c], 0
pop esi
je 0x1007ce97
cmp dword [0x10ca0a00], 0
je 0x1007ce97
cmp dword [0x10ca0a10], 0
je 0x1007ce97
cmp dword [0x10ca0a14], 0
je 0x1007ce97
mov eax, dword [0x10ca09fc]
test eax, eax
je 0x1007ce97
mov ecx, dword [ebp + 8]
push 0
push 0x1007a7f0
call eax
mov al, 1
pop ebp
ret
xor al, al
pop ebp
ret
Function at 0x10086f60
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100ec1a0
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push ebx
push esi
push edi
mov eax, dword [0x10122fb8]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov ebx, ecx
mov dword [ebp - 0x1c], ebx
mov edi, dword [ebp + 0xc]
mov esi, edi
mov dword [ebp - 4], 0
cmp dword [edi + 0x14], 8
mov eax, dword [edi + 0x10]
jb 0x10086fa7
mov esi, dword [edi]
xor ecx, ecx
mov edx, 0x811c9dc5
add eax, eax
je 0x10086fc8
mov edi, eax
movzx eax, byte [ecx + esi]
inc ecx
xor eax, edx
imul edx, eax, 0x1000193
cmp ecx, edi
jb 0x10086fb4
mov edi, dword [ebp + 0xc]
mov eax, dword [ebx + 0x18]
mov esi, dword [ebx + 4]
and eax, edx
lea ecx, [eax*8]
mov eax, dword [ebx + 0xc]
add eax, ecx
mov dword [ebp - 0x18], ecx
mov dword [ebp + 0xc], eax
cmp dword [eax], esi
je 0x10086feb
mov esi, dword [eax + 4]
mov esi, dword [esi]
mov edx, dword [edi + 0x10]
jmp 0x10086ff3
mov eax, dword [ebp + 0xc]
cmp esi, dword [eax]
je 0x10087074
mov esi, dword [esi + 4]
cmp dword [esi + 0x1c], 8
lea eax, [esi + 8]
mov ecx, dword [eax + 0x10]
mov dword [ebp - 0x14], ecx
jb 0x1008700b
mov eax, dword [eax]
cmp dword [edi + 0x14], 8
mov ecx, edi
jb 0x10087015
mov ecx, dword [edi]
cmp edx, dword [ebp - 0x14]
jne 0x10086ff0
push edx
push eax
push ecx
call fcn.1002e070
mov edx, dword [edi + 0x10]
add esp, 0xc
test eax, eax
mov eax, dword [ebp + 0xc]
jne 0x10086ff3
mov edi, dword [ebp + 0x10]
mov ecx, dword [edi + 4]
mov eax, dword [edi]
mov dword [ecx], eax
mov ecx, dword [edi]
mov eax, dword [edi + 4]
mov dword [ecx + 4], eax
lea ecx, [edi + 8]
dec dword [ebx + 8]
call fcn.10087a10
push 0x38
push edi
call fcn.100bd88f
mov eax, dword [ebp + 8]
add esp, 8
mov dword [eax], esi
mov byte [eax + 4], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov edi, dword [ebp + 0x10]
mov dword [ebp + 0xc], edi
mov eax, dword [edi]
cmp esi, eax
je 0x100870a1
mov ecx, dword [edi + 4]
mov dword [ecx], eax
mov ecx, dword [eax + 4]
mov dword [ecx], esi
mov ecx, dword [esi + 4]
mov dword [ecx], edi
mov ecx, dword [eax + 4]
mov edx, dword [esi + 4]
mov dword [esi + 4], ecx
mov ecx, dword [edi + 4]
mov dword [eax + 4], ecx
mov dword [edi + 4], edx
mov ecx, dword [ebx + 0xc]
mov edx, dword [ebp - 0x18]
add ecx, edx
mov eax, dword [ecx]
cmp eax, dword [ebx + 4]
jne 0x100870bb
mov dword [ecx], edi
mov eax, dword [ebx + 0xc]
mov dword [eax + edx + 4], edi
jmp 0x100870dd
cmp eax, esi
jne 0x100870c3
mov dword [ecx], edi
jmp 0x100870dd
mov eax, dword [ecx + 4]
mov eax, dword [eax]
mov dword [ecx + 4], eax
cmp eax, edi
je 0x100870dd
mov ecx, dword [ebx + 0xc]
mov eax, dword [ecx + edx + 4]
mov eax, dword [eax + 4]
mov dword [ecx + edx + 4], eax
mov ecx, ebx
mov dword [ebp - 4], 2
call fcn.10088100
mov eax, dword [ebp + 8]
mov dword [eax], edi
mov byte [eax + 4], 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x10087330
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
mov dword [ebp - 4], ecx
cmp dword [edi + 0x1c], 8
lea esi, [edi + 8]
mov ebx, dword [edi + 0x18]
jb 0x1008734c
mov esi, dword [edi + 8]
xor ecx, ecx
mov edx, 0x811c9dc5
add ebx, ebx
je 0x10087368
movzx eax, byte [ecx + esi]
inc ecx
xor eax, edx
imul edx, eax, 0x1000193
cmp ecx, ebx
jb 0x10087357
mov ebx, dword [ebp - 4]
mov eax, dword [ebx + 0x18]
mov ecx, dword [ebx + 0xc]
and eax, edx
lea edx, [eax*8]
mov eax, dword [ecx + edx]
add ecx, edx
cmp dword [ecx + 4], edi
jne 0x100873a1
cmp eax, edi
jne 0x10087399
mov eax, dword [ebx + 4]
mov dword [ecx], eax
mov ecx, dword [ebx + 0xc]
mov eax, dword [ebx + 4]
mov dword [edx + ecx + 4], eax
jmp 0x100873a9
mov eax, dword [edi + 4]
mov dword [ecx + 4], eax
jmp 0x100873a9
cmp eax, edi
jne 0x100873a9
mov eax, dword [edi]
mov dword [ecx], eax
mov eax, dword [edi + 4]
lea ecx, [edi + 8]
mov esi, dword [edi]
mov dword [eax], esi
mov edx, dword [edi]
mov eax, dword [edi + 4]
mov dword [edx + 4], eax
dec dword [ebx + 8]
call fcn.10087a10
push 0x38
push edi
call fcn.100bd88f
mov eax, dword [ebp + 8]
add esp, 8
pop edi
mov dword [eax], esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8