joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10008090
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
push ebx
push esi
xor eax, eax
mov dword [ebp - 0x44], 0x310043
push edi
mov dword [ebp - 0x40], 0x380038
mov dword [ebp - 0x3c], 0x310038
mov dword [ebp - 0x38], 0x410035
mov dword [ebp - 0x34], 0x420045
mov dword [ebp - 0x30], 0x330031
mov dword [ebp - 0x2c], 0x300044
mov dword [ebp - 0x28], 0x430037
mov dword [ebp - 0x24], 0x390044
mov dword [ebp - 0x20], 0x340044
mov dword [ebp - 0x1c], 0x390030
mov dword [ebp - 0x18], 0x300043
mov dword [ebp - 0x14], 0x370032
mov dword [ebp - 0x10], 0x360035
mov dword [ebp - 0xc], 0x450033
mov dword [ebp - 8], 0x460033
mov word [ebp - 4], ax
call fcn.10001bd0
mov ecx, eax
test ecx, ecx
je 0x1000816a
mov eax, dword [ecx]
push 2
push 0x20
call dword [eax]
test eax, eax
je 0x10008174
mov esi, dword [ebp + 8]
add eax, 0x10
mov dword [esi], eax
cmp dword [eax - 8], 0x20
jl 0x10008160
mov dword [eax - 0xc], 0x20
xor eax, eax
mov ecx, dword [esi]
push 0x20
mov word [ecx + 0x40], ax
lea eax, [ebp - 0x44]
push eax
push 0x20
push dword [esi]
call fcn.10001990
add esp, 0x10
mov eax, esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
push 0x80070057
call fcn.10001900
push 0x80004005
call fcn.10001900
call fcn.100029e0
int3

Function at 0x10008180
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
push ebx
push esi
xor eax, eax
mov dword [ebp - 0x44], 0x420041
push edi
mov dword [ebp - 0x40], 0x380039
mov dword [ebp - 0x3c], 0x320030
mov dword [ebp - 0x38], 0x370041
mov dword [ebp - 0x34], 0x460046
mov dword [ebp - 0x30], 0x320039
mov dword [ebp - 0x2c], 0x370034
mov dword [ebp - 0x28], 0x380044
mov dword [ebp - 0x24], 0x350041
mov dword [ebp - 0x20], 0x450041
mov dword [ebp - 0x1c], 0x300033
mov dword [ebp - 0x18], 0x370039
mov dword [ebp - 0x14], 0x390038
mov dword [ebp - 0x10], 0x300032
mov dword [ebp - 0xc], 0x420043
mov dword [ebp - 8], 0x330034
mov word [ebp - 4], ax
call fcn.10001bd0
mov ecx, eax
test ecx, ecx
je 0x1000825a
mov eax, dword [ecx]
push 2
push 0x20
call dword [eax]
test eax, eax
je 0x10008264
mov esi, dword [ebp + 8]
add eax, 0x10
mov dword [esi], eax
cmp dword [eax - 8], 0x20
jl 0x10008250
mov dword [eax - 0xc], 0x20
xor eax, eax
mov ecx, dword [esi]
push 0x20
mov word [ecx + 0x40], ax
lea eax, [ebp - 0x44]
push eax
push 0x20
push dword [esi]
call fcn.10001990
add esp, 0x10
mov eax, esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
push 0x80070057
call fcn.10001900
push 0x80004005
call fcn.10001900
call fcn.100029e0
int3
Function at 0x10008270
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
push ebx
push esi
xor eax, eax
mov dword [ebp - 0x44], 0x300031
push edi
mov dword [ebp - 0x40], 0x330032
mov dword [ebp - 0x3c], 0x330045
mov dword [ebp - 0x38], 0x420037
mov dword [ebp - 0x34], 0x390034
mov dword [ebp - 0x30], 0x360035
mov dword [ebp - 0x2c], 0x410043
mov dword [ebp - 0x28], 0x320046
mov dword [ebp - 0x24], 0x320032
mov dword [ebp - 0x20], 0x300031
mov dword [ebp - 0x1c], 0x360044
mov dword [ebp - 0x18], 0x360039
mov dword [ebp - 0x14], 0x390038
mov dword [ebp - 0x10], 0x360036
mov dword [ebp - 0xc], 0x300039
mov dword [ebp - 8], 0x340039
mov word [ebp - 4], ax
call fcn.10001bd0
mov ecx, eax
test ecx, ecx
je 0x1000834a
mov eax, dword [ecx]
push 2
push 0x20
call dword [eax]
test eax, eax
je 0x10008354
mov esi, dword [ebp + 8]
add eax, 0x10
mov dword [esi], eax
cmp dword [eax - 8], 0x20
jl 0x10008340
mov dword [eax - 0xc], 0x20
xor eax, eax
mov ecx, dword [esi]
push 0x20
mov word [ecx + 0x40], ax
lea eax, [ebp - 0x44]
push eax
push 0x20
push dword [esi]
call fcn.10001990
add esp, 0x10
mov eax, esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
push 0x80070057
call fcn.10001900
push 0x80004005
call fcn.10001900
call fcn.100029e0
int3

Function at 0x10008e40
Capabilities:
Read .ini file

Disassembly:
add ecx, 0xa8
jmp fcn.10010db0
Function at 0x1000b650
Capabilities:
Parse credit card information

Disassembly:
push esi
mov esi, ecx
xor cl, cl
mov eax, dword [esi + 0x4c]
cmp eax, 0xffffffff
je 0x1000b865
push ebx
push edi
cmp eax, 0x7c
je 0x1000b863
cmp eax, 0x29
jne 0x1000b691
cmp dword [esi + 0x10], 0
jne 0x1000b863
cmp eax, eax
jne 0x1000b691
test dword [esi + 0x50], 0x10000000
je 0x1000b872
jmp 0x1000b81c
cmp eax, 0x2e
jne 0x1000b6eb
push 5
lea ecx, [esi + 0x24]
call fcn.1000e3d0
mov eax, dword [esi]
mov edx, dword [esi + 8]
cmp eax, edx
je 0x1000b6df
cmp byte [eax], 0x5c
jne 0x1000b6dc
lea ecx, [eax + 1]
cmp ecx, edx
je 0x1000b6dc
mov edx, dword [esi + 0x50]
test dl, 8
jne 0x1000b6c9
mov bl, byte [ecx]
cmp bl, 0x28
je 0x1000b6da
cmp bl, 0x29
je 0x1000b6da
test dl, 0x10
jne 0x1000b6dc
mov dl, byte [ecx]
cmp dl, 0x7b
je 0x1000b6da
cmp dl, 0x7d
jne 0x1000b6dc
mov eax, ecx
inc eax
mov dword [esi], eax
mov ecx, esi
call fcn.1000e6f0
jmp 0x1000b84e
cmp eax, 0x5c
jne 0x1000b747
mov ecx, esi
call fcn.1000e450
test byte [esi + 0x50], 0x80
je 0x1000b73b
mov al, byte [esi + 0x48]
cmp al, 0x62
jne 0x1000b71a
push 4
lea ecx, [esi + 0x24]
call fcn.1000e3d0
mov ecx, esi
call fcn.1000e450
jmp 0x1000b855
cmp al, 0x42
jne 0x1000b73b
push 4
lea ecx, [esi + 0x24]
call fcn.1000e3d0
mov eax, dword [esi + 0x28]
mov ecx, esi
xor dword [eax + 8], 1
call fcn.1000e450
jmp 0x1000b855
mov ecx, esi
call fcn.1000b890
jmp 0x1000b84e
cmp eax, 0x5b
jne 0x1000b7a8
mov ecx, esi
call fcn.1000e450
lea ecx, [esi + 0x24]
call fcn.1000abc0
mov eax, dword [esi + 0x4c]
cmp eax, 0x5e
jne 0x1000b774
mov eax, dword [esi + 0x28]
mov ecx, esi
xor dword [eax + 8], 1
call fcn.1000e450
mov eax, dword [esi + 0x4c]
test dword [esi + 0x50], 0x20000000
je 0x1000b792
cmp eax, 0x5d
jne 0x1000b792
push eax
lea ecx, [esi + 0x24]
call fcn.1000ab50
mov ecx, esi
call fcn.1000e450
mov ecx, esi
call fcn.1000c2a0
cmp dword [esi + 0x4c], 0x5d
jne 0x1000b87b
jmp 0x1000b847
cmp eax, 0x28
jne 0x1000b7d8
mov ecx, esi
call fcn.1000e450
mov ecx, esi
call fcn.1000e980
cmp dword [esi + 0x4c], 0x29
mov bl, al
jne 0x1000b872
mov ecx, esi
call fcn.1000e450
test bl, bl
je 0x1000b855
jmp 0x1000b84e
cmp eax, 0x5e
jne 0x1000b7f0
push 2
lea ecx, [esi + 0x24]
call fcn.1000e3d0
mov ecx, esi
call fcn.1000e450
jmp 0x1000b855
cmp eax, 0x24
jne 0x1000b808
push 3
lea ecx, [esi + 0x24]
call fcn.1000e3d0
mov ecx, esi
call fcn.1000e450
jmp 0x1000b855
cmp eax, 0x2a
je 0x1000b869
cmp eax, 0x2b
je 0x1000b869
cmp eax, 0x3f
je 0x1000b869
cmp eax, 0x7b
je 0x1000b869
cmp eax, 0x7d
jne 0x1000b82c
test dword [esi + 0x50], 0x10000000
je 0x1000b884
jmp 0x1000b83a
cmp eax, 0x5d
jne 0x1000b83a
test dword [esi + 0x50], 0x10000000
je 0x1000b87b
movzx eax, byte [esi + 0x48]
lea ecx, [esi + 0x24]
push eax
call fcn.1000aa40
mov ecx, esi
call fcn.1000e450
mov ecx, esi
call fcn.1000e5a0
mov eax, dword [esi + 0x4c]
mov cl, 1
cmp eax, 0xffffffff
jne 0x1000b663
pop edi
pop ebx
mov al, cl
pop esi
ret
push 0xa
mov ecx, esi
call fcn.1000daa0
push 5
mov ecx, esi
call fcn.1000daa0
push 4
mov ecx, esi
call fcn.1000daa0
push 6
mov ecx, esi
call fcn.1000daa0
int3
Function at 0x1000f4f0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 0xc]
mov edx, 0x811c9dc5
push edi
mov edi, dword [ebp + 8]
mov ecx, 0
sub esi, edi
je 0x1000f521
nop dword [eax]
movzx eax, byte [ecx + edi]
inc ecx
xor eax, edx
imul edx, eax, 0x1000193
cmp ecx, esi
jb 0x1000f510
pop edi
mov eax, edx
pop esi
pop ebp
ret 8

Function at 0x1000fd80
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10102d68
mov eax, dword fs:[0]
push eax
sub esp, 0x24
push esi
push edi
mov eax, dword [0x1014b520]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
push 8
mov dword [esi + 0x30], 0
mov dword [esi + 8], 0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0x201
mov dword [esi + 0x18], 6
mov dword [esi + 0x1c], 0
mov dword [esi + 0x20], 0
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x2c], 0
mov dword [esi + 0xc], 0
call fcn.100bb0a7
mov edi, eax
add esp, 4
test edi, edi
je 0x1000fe23
xorps xmm0, xmm0
movq qword [edi], xmm0
push 1
mov dword [ebp - 4], 0
call fcn.10033685
add esp, 4
mov dword [edi + 4], eax
jmp 0x1000fe25
xor edi, edi
mov eax, dword [ebp + 8]
mov dword [esi + 0x30], edi
mov dword [esi + 0x38], eax
mov dword [esi + 0x3c], 0
mov ecx, dword [edi + 4]
mov dword [ebp - 4], 1
mov dword [ebp - 0x10], ecx
mov eax, dword [ecx]
call dword [eax + 4]
lea eax, [ebp - 0x14]
mov dword [ebp - 4], 2
push eax
call fcn.10004530
add esp, 4
mov ecx, eax
mov edx, dword [eax]
push 0x20
call dword [edx + 0x30]
movzx edi, ax
mov ecx, dword [ebp - 0x10]
mov dword [ebp - 4], 3
test ecx, ecx
je 0x1000fe85
mov eax, dword [ecx]
call dword [eax + 8]
test eax, eax
je 0x1000fe85
mov edx, dword [eax]
mov ecx, eax
push 1
call dword [edx]
cmp dword [esi + 0x38], 0
mov dword [ebp - 4], 0xffffffff
mov word [esi + 0x40], di
jne 0x1000fea9
mov eax, dword [esi + 0xc]
mov ecx, dword [esi + 0x10]
and eax, 0x13
or eax, 4
mov dword [esi + 0xc], eax
and ecx, eax
jne 0x1000fecb
cmp byte [ebp + 0xc], 0
je 0x1000feb8
push esi
call fcn.10033b68
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 8
test cl, 4
je 0x1000fed7
mov esi, str.ios_base::badbit_set
jmp 0x1000fee7
test cl, 2
mov esi, str.ios_base::failbit_set
mov eax, str.ios_base::eofbit_set
cmove esi, eax
lea eax, [ebp - 0x1c]
push 1
push eax
call fcn.1000ff10
add esp, 8
lea ecx, [ebp - 0x30]
push eax
push esi
call fcn.10005900
push 0x1013d614
lea eax, [ebp - 0x30]
push eax
call fcn.100d5f0a
int3

Function at 0x10010c40
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x1014b520]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push 0x208
lea eax, [ebp - 0x20c]
mov esi, ecx
push 0
push eax
call fcn.100d6e30
add esp, 0xc
lea eax, [ebp - 0x20c]
push dword [esi]
push 0x104
push eax
push dword [0x1014a02c]
push str.cd_time
push str.active
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
lea eax, [ebp - 0x20c]
push eax
call fcn.100df54f
mov ecx, dword [ebp - 4]
add esp, 4
xor ecx, ebp
pop esi
call fcn.100bb073
mov esp, ebp
pop ebp
ret
Function at 0x10010cd0
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x1014b520]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push 0x208
lea eax, [ebp - 0x20c]
mov esi, ecx
push 0
push eax
call fcn.100d6e30
add esp, 0xc
lea eax, [ebp - 0x20c]
push dword [esi]
push 0x104
push eax
push dword [0x1014a02c]
push str.first_add_web_time
push str.active
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
lea eax, [ebp - 0x20c]
push eax
call fcn.100df54f
mov ecx, dword [ebp - 4]
add esp, 4
xor ecx, ebp
pop esi
call fcn.100bb073
mov esp, ebp
pop ebp
ret

Function at 0x10010d40
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x1014b520]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push 0x208
lea eax, [ebp - 0x20c]
mov esi, ecx
push 0
push eax
call fcn.100d6e30
add esp, 0xc
lea eax, [ebp - 0x20c]
push dword [esi]
push 0x104
push eax
push dword [0x1014a02c]
push str.cd_time
push str.passive
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
lea eax, [ebp - 0x20c]
push eax
call fcn.100df54f
mov ecx, dword [ebp - 4]
add esp, 4
xor ecx, ebp
pop esi
call fcn.100bb073
mov esp, ebp
pop ebp
ret
Function at 0x10013080
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [0x1014b520]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x14]
push 0xc
push eax
mov ecx, esi
mov dword [ebp - 0x18], esi
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0xf
mov dword [ebp - 0x14], 0x6f736572
mov dword [ebp - 0x10], 0x65637275
mov dword [ebp - 0xc], 0x6c72755f
mov byte [ebp - 8], 0
mov byte [esi], 0
call fcn.1000f130
mov ecx, dword [ebp - 4]
mov eax, esi
xor ecx, ebp
pop esi
call fcn.100bb073
mov esp, ebp
pop ebp
ret 4

Function at 0x100130f0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [0x1014b520]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x14]
push 0xd
push eax
mov ecx, esi
mov dword [ebp - 0x18], esi
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0xf
mov dword [ebp - 0x14], 0x69746361
mov dword [ebp - 0x10], 0x635f6576
mov dword [ebp - 0xc], 0x6d697464
mov word [ebp - 8], 0x65
mov byte [esi], 0
call fcn.1000f130
mov ecx, dword [ebp - 4]
mov eax, esi
xor ecx, ebp
pop esi
call fcn.100bb073
mov esp, ebp
pop ebp
ret 4

Function at 0x10013160
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4c
mov eax, dword [0x1014b520]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
xor eax, eax
push edi
mov word [ebp - 8], ax
mov ecx, esi
push 0x20
mov dword [esi + 0x10], eax
mov dword [esi + 0x14], 7
mov word [esi], ax
lea eax, [ebp - 0x48]
push eax
mov dword [ebp - 0x4c], esi
mov dword [ebp - 0x48], 0x620041
mov dword [ebp - 0x44], 0x590035
mov dword [ebp - 0x40], 0x530077
mov dword [ebp - 0x3c], 0x770073
mov dword [ebp - 0x38], 0x580051
mov dword [ebp - 0x34], 0x340064
mov dword [ebp - 0x30], 0x50006b
mov dword [ebp - 0x2c], 0x710042
mov dword [ebp - 0x28], 0x590072
mov dword [ebp - 0x24], 0x310046
mov dword [ebp - 0x20], 0x350069
mov dword [ebp - 0x1c], 0x440043
mov dword [ebp - 0x18], 0x300059
mov dword [ebp - 0x14], 0x57005a
mov dword [ebp - 0x10], 0x610039
mov dword [ebp - 0xc], 0x760065
call fcn.1000f230
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
xor ecx, ebp
pop esi
call fcn.100bb073
mov esp, ebp
pop ebp
ret 4

Function at 0x10013220
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [0x1014b520]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x14]
push 0xe
push eax
mov ecx, esi
mov dword [ebp - 0x18], esi
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0xf
mov dword [ebp - 0x14], 0x73736170
mov dword [ebp - 0x10], 0x5f657669
mov dword [ebp - 0xc], 0x69746463
mov word [ebp - 8], 0x656d
mov byte [ebp - 6], 0
mov byte [esi], 0
call fcn.1000f130
mov ecx, dword [ebp - 4]
mov eax, esi
xor ecx, ebp
pop esi
call fcn.100bb073
mov esp, ebp
pop ebp
ret 4
Function at 0x10013800
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [0x1014b520]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x14]
push 0xe
push eax
mov ecx, esi
mov dword [ebp - 0x18], esi
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0xf
mov dword [ebp - 0x14], 0x6f6e6769
mov dword [ebp - 0x10], 0x775f6572
mov dword [ebp - 0xc], 0x635f6265
mov word [ebp - 8], 0x6e64
mov byte [ebp - 6], 0
mov byte [esi], 0
call fcn.1000f130
mov ecx, dword [ebp - 4]
mov eax, esi
xor ecx, ebp
pop esi
call fcn.100bb073
mov esp, ebp
pop ebp
ret 4

Function at 0x10013870
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x1014b520]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x10]
push 9
push eax
mov ecx, esi
mov dword [ebp - 0x14], esi
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0xf
mov dword [ebp - 0x10], 0x696f7661
mov dword [ebp - 0xc], 0x72625f64
mov word [ebp - 8], 0x6f
mov byte [esi], 0
call fcn.1000f130
mov ecx, dword [ebp - 4]
mov eax, esi
xor ecx, ebp
pop esi
call fcn.100bb073
mov esp, ebp
pop ebp
ret 4

Function at 0x100138d0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [0x1014b520]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x14]
push 0xd
push eax
mov ecx, esi
mov dword [ebp - 0x18], esi
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0xf
mov dword [ebp - 0x14], 0x696f7661
mov dword [ebp - 0x10], 0x65775f64
mov dword [ebp - 0xc], 0x64635f62
mov word [ebp - 8], 0x6e
mov byte [esi], 0
call fcn.1000f130
mov ecx, dword [ebp - 4]
mov eax, esi
xor ecx, ebp
pop esi
call fcn.100bb073
mov esp, ebp
pop ebp
ret 4
Function at 0x100198b0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
mov dword [ebp - 4], ecx
mov dword [ebp - 8], eax
cmp dword [edi + 0x1c], 0x10
lea esi, [edi + 8]
mov ebx, dword [edi + 0x18]
jb 0x100198d4
mov esi, dword [edi + 8]
xor ecx, ecx
mov edx, 0x811c9dc5
test ebx, ebx
je 0x100198f1
nop
movzx eax, byte [ecx + esi]
inc ecx
xor eax, edx
imul edx, eax, 0x1000193
cmp ecx, ebx
jb 0x100198e0
mov ebx, dword [ebp - 4]
mov eax, dword [ebx + 0x18]
mov ecx, dword [ebx + 0xc]
and eax, edx
lea edx, [eax*8]
mov eax, dword [ecx + edx]
add ecx, edx
cmp dword [ecx + 4], edi
jne 0x1001992a
cmp eax, edi
jne 0x10019922
mov eax, dword [ebx + 4]
mov dword [ecx], eax
mov ecx, dword [ebx + 0xc]
mov eax, dword [ebx + 4]
mov dword [edx + ecx + 4], eax
jmp 0x10019932
mov eax, dword [edi + 4]
mov dword [ecx + 4], eax
jmp 0x10019932
cmp eax, edi
jne 0x10019932
mov eax, dword [edi]
mov dword [ecx], eax
mov eax, dword [edi + 4]
lea ecx, [edi + 8]
mov esi, dword [edi]
mov dword [eax], esi
mov edx, dword [edi]
mov eax, dword [edi + 4]
mov dword [edx + 4], eax
dec dword [ebx + 8]
call fcn.10019e70
push 0x28
push edi
call fcn.100bacf4
mov eax, dword [ebp - 8]
add esp, 8
pop edi
mov dword [eax], esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x10019970
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [ebp + 8]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 0xc]
cmp dword [eax + 0x1c], 0x10
push ebx
mov ebx, dword [eax + 0x18]
push esi
lea esi, [eax + 8]
mov dword [ebp - 4], ecx
push edi
jb 0x10019993
mov esi, dword [esi]
xor edx, edx
mov edi, 0x811c9dc5
test ebx, ebx
je 0x100199b1
nop
movzx ecx, byte [edx + esi]
inc edx
xor ecx, edi
imul edi, ecx, 0x1000193
cmp edx, ebx
jb 0x100199a0
mov ebx, dword [ebp - 4]
mov ecx, dword [ebx + 0x18]
mov edx, dword [ebx + 0xc]
and ecx, edi
lea esi, [ecx*8]
mov ecx, dword [edx + esi]
add edx, esi
cmp dword [edx + 4], eax
jne 0x100199ea
cmp ecx, eax
jne 0x100199e2
mov ecx, dword [ebx + 4]
mov dword [edx], ecx
mov edx, dword [ebx + 0xc]
mov ecx, dword [ebx + 4]
mov dword [esi + edx + 4], ecx
jmp 0x100199f2
mov ecx, dword [eax + 4]
mov dword [edx + 4], ecx
jmp 0x100199f2
cmp ecx, eax
jne 0x100199f2
mov ecx, dword [eax]
mov dword [edx], ecx
mov edx, dword [eax + 4]
lea ecx, [ebx + 4]
mov edi, dword [eax]
push eax
mov dword [edx], edi
mov esi, dword [eax]
mov edx, dword [eax + 4]
mov dword [esi + 4], edx
dec dword [ecx + 4]
call fcn.1001efb0
mov eax, dword [ebp - 8]
mov dword [eax], edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x10019b60
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10103ade
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push esi
push edi
mov eax, dword [0x1014b520]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov dword [ebp - 0x10], ebx
mov dword [ebp - 0x14], ebx
xor eax, eax
mov dword [ebx + 0x14], 0
mov dword [ebx + 0x18], 0xf
mov byte [ebx + 4], 0
mov dword [ebx + 0x2c], 0
mov dword [ebx + 0x30], 7
mov word [ebx + 0x1c], ax
mov dword [ebx + 0x44], eax
mov dword [ebx + 0x48], 7
mov word [ebx + 0x34], ax
lea edi, [ebx + 0x4c]
mov dword [ebx], vtable.IgnoreWebCfg.0
lea esi, [edi + 4]
mov dword [ebp - 0x10], edi
push eax
mov dword [edi], eax
mov ecx, esi
push eax
mov dword [ebp - 4], eax
mov dword [ebp - 0x18], esi
mov dword [esi], eax
mov dword [esi + 4], eax
call fcn.1001ee80
mov dword [esi], eax
mov dword [edi + 0xc], 0
mov dword [edi + 0x10], 0
mov dword [edi + 0x14], 0
push 8
mov ecx, edi
mov byte [ebp - 4], 2
mov dword [edi], 0x3f800000
call fcn.1001f060
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x1001a440
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
mov dword [ebp - 4], ecx
mov esi, ebx
cmp dword [ebx + 0x14], 0x10
mov edi, dword [ebx + 0x10]
jb 0x1001a45c
mov esi, dword [ebx]
xor ecx, ecx
mov edx, 0x811c9dc5
test edi, edi
je 0x1001a478
movzx eax, byte [ecx + esi]
inc ecx
xor eax, edx
imul edx, eax, 0x1000193
cmp ecx, edi
jb 0x1001a467
mov edi, dword [ebp - 4]
mov eax, dword [edi + 0x18]
mov ecx, dword [edi + 0xc]
and eax, edx
mov edi, dword [edi + 4]
mov esi, dword [ecx + eax*8]
add eax, eax
mov edx, dword [ecx + eax*4]
inc eax
mov dword [ebp + 8], edx
lea eax, [ecx + eax*4]
mov dword [ebp - 8], eax
cmp edx, edi
jne 0x1001a4a0
mov eax, edi
jmp 0x1001a4a4
mov eax, dword [eax]
mov eax, dword [eax]
cmp esi, eax
je 0x1001a4db
lea eax, [esi + 8]
push ebx
push eax
call fcn.10011750
add esp, 8
test al, al
jne 0x1001a4c3
mov esi, dword [esi]
mov edx, dword [ebp + 8]
mov eax, dword [ebp - 8]
jmp 0x1001a498
lea eax, [esi + 8]
push eax
push ebx
call fcn.10011750
add esp, 8
mov ecx, edi
test al, al
cmovne ecx, esi
mov eax, ecx
jmp 0x1001a4df
mov ecx, edi
mov eax, edi
cmp eax, edi
jne 0x1001a537
mov esi, dword [edi]
lea eax, [ebp + 0xb]
push eax
lea eax, [ebp - 8]
mov dword [ebp - 8], ebx
mov ebx, dword [ebp - 4]
mov edi, dword [esi + 4]
push eax
push 0x1010e6e0
push edi
push esi
lea ecx, [ebx + 4]
call fcn.10019090
mov edx, eax
mov ecx, 0x6666665
mov eax, dword [ebx + 8]
sub ecx, eax
cmp ecx, 1
jb 0x1001a543
inc eax
mov ecx, ebx
mov dword [ebx + 8], eax
mov dword [esi + 4], edx
mov dword [edi], edx
mov eax, dword [ebx + 4]
mov eax, dword [eax]
push eax
add eax, 8
push eax
lea eax, [ebp - 0xc]
push eax
call fcn.10019280
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
lea eax, [ecx + 0x20]
pop ebx
mov esp, ebp
pop ebp
ret 4
push str.list_T__too_long
call fcn.10032d3a
int3