joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10018fc0
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 8]
sub esp, 0x10
mov eax, dword [ecx]
push ebx
push esi
push edi
mov edi, dword [0x1060b4e8]
call dword [eax + 8]
mov esi, eax
movzx ecx, byte [esi]
movzx eax, byte [esi + 3]
xor ecx, 0x811c9dc5
imul edx, ecx, 0x1000193
movzx ecx, byte [esi + 1]
xor edx, ecx
movzx ecx, byte [esi + 2]
imul edx, edx, 0x1000193
xor edx, ecx
imul ecx, edx, 0x1000193
xor ecx, eax
imul eax, ecx, 0x1000193
mov ecx, edi
push eax
push esi
lea eax, [ebp - 0xc]
push eax
call fcn.1001b5a0
mov ebx, dword [eax + 4]
test ebx, ebx
je 0x1001909d
cmp ebx, dword [edi + 4]
je 0x1001909d
mov edi, dword [ebx + 0xc]
cmp dword [edi + 0x14], 0
je 0x1001909d
mov esi, dword [edi + 0x10]
mov edi, dword [edi + 4]
mov eax, dword [ebx + 0xc]
mov ecx, dword [eax + 0x14]
add ecx, dword [eax + 0x10]
cmp esi, ecx
je 0x1001909d
test edi, edi
je 0x10019049
mov eax, dword [edi]
jmp 0x1001904b
xor eax, eax
mov ecx, dword [eax + 8]
mov eax, dword [eax + 4]
dec ecx
movss xmm1, dword [0x1041ed08]
and ecx, esi
mov ecx, dword [eax + ecx*4]
call fcn.10015590
test al, al
jne 0x1001906b
inc esi
jmp 0x10019034
test edi, edi
je 0x10019086
mov eax, dword [edi]
mov ecx, dword [eax + 8]
mov eax, dword [eax + 4]
dec ecx
and ecx, esi
mov eax, dword [eax + ecx*4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
xor eax, eax
mov ecx, dword [eax + 8]
mov eax, dword [eax + 4]
dec ecx
and ecx, esi
mov eax, dword [eax + ecx*4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x100190b0
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov ecx, dword [ebp + 8]
push ebx
push esi
push edi
mov eax, dword [ecx]
mov edi, dword [0x1060b4e8]
call dword [eax + 8]
mov esi, eax
movzx ecx, byte [esi]
movzx eax, byte [esi + 3]
xor ecx, 0x811c9dc5
imul edx, ecx, 0x1000193
movzx ecx, byte [esi + 1]
xor edx, ecx
movzx ecx, byte [esi + 2]
imul edx, edx, 0x1000193
xor edx, ecx
imul ecx, edx, 0x1000193
xor ecx, eax
imul eax, ecx, 0x1000193
mov ecx, edi
push eax
push esi
lea eax, [ebp - 0xc]
push eax
call fcn.1001b5a0
mov eax, dword [eax + 4]
mov dword [ebp + 8], eax
test eax, eax
je 0x100191d1
cmp eax, dword [edi + 4]
je 0x100191d1
mov esi, dword [eax + 0xc]
cmp dword [esi + 0x14], 0
je 0x100191d1
mov edi, dword [esi + 0x14]
add edi, dword [esi + 0x10]
mov esi, dword [esi + 4]
lea ebx, [edi - 1]
nop dword [eax]
mov eax, dword [eax + 0xc]
cmp edi, dword [eax + 0x10]
je 0x100191d1
cmp byte [0x1060ec60], 0
je 0x10019171
test esi, esi
je 0x10019165
mov eax, dword [esi]
movss xmm1, dword [0x1060ec64]
jmp 0x10019183
movss xmm1, dword [0x1060ec64]
xor eax, eax
jmp 0x10019183
test esi, esi
je 0x10019179
mov eax, dword [esi]
jmp 0x1001917b
xor eax, eax
movss xmm1, dword [0x1041ed08]
mov ecx, dword [eax + 8]
mov eax, dword [eax + 4]
dec ecx
and ecx, ebx
mov ecx, dword [eax + ecx*4]
call fcn.10015590
dec edi
test al, al
jne 0x1001919f
mov eax, dword [ebp + 8]
dec ebx
jmp 0x10019140
test esi, esi
je 0x100191ba
mov eax, dword [esi]
mov ecx, dword [eax + 8]
mov eax, dword [eax + 4]
dec ecx
and ecx, edi
mov eax, dword [eax + ecx*4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
xor eax, eax
mov ecx, dword [eax + 8]
mov eax, dword [eax + 4]
dec ecx
and ecx, edi
mov eax, dword [eax + ecx*4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x10019bd0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10313e3e
mov eax, dword fs:[0]
push eax
sub esp, 8
push esi
push edi
mov eax, dword [0x1043900c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x10], 0
xorps xmm0, xmm0
mov esi, dword [ebp + 8]
movups xmmword [esi], xmm0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0xf
mov byte [esi], 0
mov dword [ebp - 4], 0
mov ecx, esi
push 0xc
mov dword [ebp - 0x10], 1
call fcn.1001a120
lea eax, [edi + 0x14]
mov dword [ebp - 0x14], eax
cmp edi, eax
je 0x10019c67
nop dword [eax]
mov al, byte [edi]
mov ecx, esi
xor al, 0xa5
movzx eax, al
push eax
call fcn.1001a280
add edi, 2
cmp edi, dword [ebp - 0x14]
jne 0x10019c50
cmp dword [esi + 0x14], 0x10
mov edi, esi
mov eax, dword [esi + 0x10]
jb 0x10019c74
mov edi, dword [esi]
test eax, eax
je 0x10019d02
push eax
push 0
push edi
call sub.VCRUNTIME140.dll_memchr
mov edx, eax
add esp, 0xc
test edx, edx
je 0x10019d02
sub edx, edi
cmp edx, 0xffffffff
je 0x10019d02
mov ecx, dword [esi + 0x14]
mov edi, 1
cmp ecx, 0x10
jb 0x10019cb3
mov ecx, dword [esi + 0x10]
mov eax, ecx
sub eax, edx
mov dword [ebp + 8], ecx
cmp eax, edi
cmovb edi, eax
jmp 0x10019cce
mov eax, esi
sub eax, esi
add edx, eax
mov eax, dword [esi + 0x10]
mov dword [ebp + 8], eax
sub eax, edx
cmp eax, 1
cmovb edi, eax
mov eax, esi
cmp ecx, 0x10
jb 0x10019cd0
mov eax, dword [esi]
lea ecx, [eax + edx]
mov eax, dword [ebp + 8]
sub eax, edi
mov dword [ebp + 8], eax
sub eax, edx
inc eax
push eax
lea eax, [ecx + edi]
push eax
push ecx
call sub.VCRUNTIME140.dll_memmove
mov eax, dword [ebp + 8]
add esp, 8
mov ecx, esi
mov dword [esi + 0x10], eax
push 0
call fcn.1001a0e0
mov edx, eax
cmp edx, 0xffffffff
jne 0x10019c95
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x10019f10
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
sub esp, 0x18
mov edx, dword [ebp + 8]
push ebx
mov ebx, ecx
cmp edx, eax
je 0x1001a066
mov eax, dword [ebx + 4]
mov dword [ebp - 0x10], eax
mov eax, dword [edx + 4]
mov dword [ebp - 4], eax
movzx eax, byte [edx + 8]
xor eax, 0x811c9dc5
imul ecx, eax, 0x1000193
movzx eax, byte [edx + 9]
push esi
push edi
mov edi, dword [ebx + 0xc]
mov esi, edx
xor ecx, eax
mov dword [ebp - 0x18], edi
movzx eax, byte [edx + 0xa]
imul ecx, ecx, 0x1000193
xor ecx, eax
movzx eax, byte [edx + 0xb]
imul ecx, ecx, 0x1000193
xor ecx, eax
mov eax, dword [ebx + 0x18]
imul ecx, ecx, 0x1000193
and eax, ecx
mov ecx, dword [edi + eax*8]
mov dword [ebp - 0xc], ecx
lea eax, [edi + eax*8]
mov dword [ebp - 8], eax
mov eax, dword [eax + 4]
mov dword [ebp - 0x14], eax
mov eax, esi
mov edi, esi
mov esi, dword [esi]
push 0x10
push eax
call fcn.102bb95a
dec dword [ebx + 8]
add esp, 8
cmp edi, dword [ebp - 0x14]
je 0x10019fc9
mov eax, dword [ebp + 0xc]
cmp esi, eax
jne 0x10019f87
mov ecx, dword [ebp - 0xc]
cmp ecx, dword [ebp + 8]
jne 0x1001a05c
mov edx, dword [ebp - 8]
mov ecx, dword [ebp - 4]
pop edi
mov dword [edx], esi
mov dword [ecx], esi
mov dword [esi + 4], ecx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
mov ecx, dword [ebp - 0xc]
mov edx, dword [ebp - 8]
cmp ecx, dword [ebp + 8]
jne 0x10019fdd
mov eax, dword [ebp - 0x10]
mov ecx, eax
mov dword [edx], eax
jmp 0x10019fe0
mov ecx, dword [ebp - 4]
mov eax, dword [ebp + 0xc]
mov dword [edx + 4], ecx
cmp esi, eax
je 0x1001a05c
nop word [eax + eax]
movzx eax, byte [esi + 8]
xor eax, 0x811c9dc5
imul ecx, eax, 0x1000193
movzx eax, byte [esi + 9]
xor ecx, eax
movzx eax, byte [esi + 0xa]
imul ecx, ecx, 0x1000193
xor ecx, eax
movzx eax, byte [esi + 0xb]
imul ecx, ecx, 0x1000193
xor ecx, eax
mov eax, dword [ebx + 0x18]
imul ecx, ecx, 0x1000193
and eax, ecx
mov ecx, dword [ebp - 0x18]
lea eax, [ecx + eax*8]
mov dword [ebp + 8], eax
mov eax, dword [eax + 4]
mov dword [ebp - 0x14], eax
mov eax, esi
mov edi, esi
mov esi, dword [esi]
push 0x10
push eax
call fcn.102bb95a
dec dword [ebx + 8]
add esp, 8
mov eax, dword [ebp + 0xc]
cmp edi, dword [ebp - 0x14]
je 0x1001a06d
cmp esi, eax
jne 0x1001a037
mov ecx, dword [ebp + 8]
mov dword [ecx], esi
mov ecx, dword [ebp - 4]
pop edi
mov dword [ecx], esi
mov dword [esi + 4], ecx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
mov ecx, dword [ebp + 8]
mov edx, dword [ebp - 0x10]
mov dword [ecx], edx
mov dword [ecx + 4], edx
cmp esi, eax
jne 0x10019ff0
mov ecx, dword [ebp - 4]
pop edi
mov dword [ecx], esi
mov dword [esi + 4], ecx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x1001a5b0
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push esi
mov esi, dword [ebp + 0xc]
push edi
mov edi, ecx
movzx eax, byte [esi]
xor eax, 0x811c9dc5
imul edx, eax, 0x1000193
movzx eax, byte [esi + 1]
xor edx, eax
movzx eax, byte [esi + 2]
imul edx, edx, 0x1000193
xor edx, eax
movzx eax, byte [esi + 3]
imul ecx, edx, 0x1000193
xor ecx, eax
imul eax, ecx, 0x1000193
mov ecx, edi
push eax
push esi
lea eax, [ebp - 8]
push eax
call fcn.1001b5a0
mov ecx, dword [eax + 4]
mov eax, dword [ebp + 8]
test ecx, ecx
jne 0x1001a609
mov ecx, dword [edi + 4]
pop edi
mov dword [eax], ecx
pop esi
mov esp, ebp
pop ebp
ret 8

Function at 0x1001a8c0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, dword [ebp + 0xc]
mov ebx, ecx
push edi
mov edi, edx
cmp edi, dword [ebp + 8]
je 0x1001a8e9
mov al, byte [edi]
mov ecx, esi
xor al, 0xa5
movzx eax, al
push eax
call fcn.1001a280
add edi, 2
cmp edi, dword [ebp + 8]
jne 0x1001a8d2
pop edi
mov dword [ebx], esi
mov eax, ebx
pop esi
pop ebx
pop ebp
ret
Function at 0x1001abf0
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10313e75
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push ebx
push esi
push edi
mov eax, dword [0x1043900c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov ebx, dword [ebp + 0xc]
movzx eax, byte [ebx]
xor eax, 0x811c9dc5
imul edx, eax, 0x1000193
movzx eax, byte [ebx + 1]
xor edx, eax
movzx eax, byte [ebx + 2]
imul edx, edx, 0x1000193
xor edx, eax
movzx eax, byte [ebx + 3]
imul ecx, edx, 0x1000193
xor ecx, eax
imul eax, ecx, 0x1000193
mov ecx, edi
push eax
mov dword [ebp + 0xc], eax
lea eax, [ebp - 0x1c]
push ebx
push eax
call fcn.1001b5a0
mov ecx, dword [ebp - 0x18]
test ecx, ecx
je 0x1001ac8b
mov eax, dword [ebp + 0x10]
mov eax, dword [eax]
mov dword [ecx + 0xc], eax
mov eax, dword [ebp + 8]
mov dword [eax], ecx
mov byte [eax + 4], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
cmp dword [edi + 8], 0xfffffff
jne 0x1001ac9f
push str.unordered_map_set_too_long
call dword [sym.imp.MSVCP140.dll_void___cdecl_std::_Xlength_error_char_const__]
lea eax, [edi + 4]
mov dword [ebp - 0x14], eax
mov dword [ebp - 4], 0
push 0x10
mov dword [ebp - 0x10], 0
call fcn.102bb92a
mov ecx, dword [ebx]
mov esi, eax
add esp, 4
mov dword [ebp - 0x10], esi
mov dword [esi + 8], ecx
mov ecx, dword [ebp + 0x10]
mov ecx, dword [ecx]
mov dword [esi + 0xc], ecx
mov dword [ebp - 4], 1
mov eax, dword [edi + 8]
mov ebx, dword [edi + 0x1c]
inc eax
movss xmm3, dword [edi]
movd xmm0, eax
cvtdq2pd xmm0, xmm0
shr eax, 0x1f
addsd xmm0, qword [eax*8 + 0x1041f410]
mov eax, ebx
shr eax, 0x1f
cvtpd2ps xmm2, xmm0
movd xmm0, ebx
cvtdq2pd xmm0, xmm0
movaps xmm1, xmm2
addsd xmm0, qword [eax*8 + 0x1041f410]
cvtpd2ps xmm0, xmm0
divss xmm1, xmm0
comiss xmm1, xmm3
jbe 0x1001ad83
divss xmm2, xmm3
sub esp, 8
movss dword [ebp + 0x10], xmm2
fld dword [ebp + 0x10]
fstp qword [esp]
call sub.api_ms_win_crt_math_l1_1_0.dll_ceil
add esp, 8
fstp dword [ebp + 0x10]
movss xmm0, dword [ebp + 0x10]
call fcn.10311f90
mov ecx, 8
cmp eax, ecx
cmova ecx, eax
cmp ebx, ecx
jae 0x1001ad65
cmp ebx, 0x200
jae 0x1001ad63
shl ebx, 3
cmp ebx, ecx
jae 0x1001ad65
mov ebx, ecx
push ebx
mov ecx, edi
call fcn.1001b430
push dword [ebp + 0xc]
lea eax, [esi + 8]
mov ecx, edi
push eax
lea eax, [ebp - 0x1c]
push eax
call fcn.1001b5a0
mov edx, dword [eax]
jmp 0x1001ad86
mov edx, dword [ebp - 0x1c]
mov ebx, dword [edx + 4]
inc dword [edi + 8]
mov dword [esi], edx
mov dword [esi + 4], ebx
mov dword [ebx], esi
mov dword [edx + 4], esi
mov eax, dword [edi + 0x18]
and eax, dword [ebp + 0xc]
mov ecx, dword [edi + 0xc]
mov esi, dword [ebp - 0x14]
mov edi, dword [ecx + eax*8]
cmp edi, dword [esi]
mov esi, dword [ebp - 0x10]
jne 0x1001adb1
mov dword [ecx + eax*8], esi
jmp 0x1001adc0
cmp edi, edx
jne 0x1001adba
mov dword [ecx + eax*8], esi
jmp 0x1001adc4
cmp dword [ecx + eax*8 + 4], ebx
jne 0x1001adc4
mov dword [ecx + eax*8 + 4], esi
mov eax, dword [ebp + 8]
mov dword [eax], esi
mov byte [eax + 4], 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x1001b430
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov edx, dword [ebp + 8]
mov eax, 0x1fffffff
push ebx
mov ebx, ecx
bsr ecx, eax
push esi
push edi
mov edi, 1
mov dword [ebp - 4], ebx
mov eax, edi
shl eax, cl
cmp edx, eax
jbe 0x1001b461
push str.invalid_hash_bucket_count
call dword [sym.imp.MSVCP140.dll_void___cdecl_std::_Xlength_error_char_const__]
mov esi, dword [ebx + 4]
lea eax, [edx - 1]
or eax, 1
mov dword [ebp + 8], esi
bsr ecx, eax
push esi
lea ecx, [ecx + 1]
shl edi, cl
lea ecx, [ebx + 0xc]
lea eax, [edi + edi]
push eax
call fcn.1001a400
lea eax, [edi - 1]
mov dword [ebx + 0x1c], edi
mov dword [ebx + 0x18], eax
mov eax, dword [ebx + 4]
mov eax, dword [eax]
mov ecx, eax
cmp eax, esi
je 0x1001b56c
nop word [eax + eax]
movzx edx, byte [eax + 8]
xor edx, 0x811c9dc5
mov ecx, dword [ecx]
imul edi, edx, 0x1000193
movzx edx, byte [eax + 9]
xor edi, edx
movzx edx, byte [eax + 0xa]
imul edi, edi, 0x1000193
xor edi, edx
movzx edx, byte [eax + 0xb]
imul edi, edi, 0x1000193
xor edi, edx
imul edx, edi, 0x1000193
mov edi, dword [ebx + 0x18]
and edi, edx
mov edx, dword [ebx + 0xc]
lea edx, [edx + edi*8]
mov edi, dword [edx]
mov dword [ebp - 8], edx
cmp edi, esi
jne 0x1001b4f1
mov dword [edx], eax
mov dword [edx + 4], eax
jmp 0x1001b562
mov edx, dword [edx + 4]
mov ebx, dword [eax + 8]
cmp ebx, dword [edx + 8]
jne 0x1001b52b
mov edx, dword [edx]
mov dword [ebp - 0xc], edx
cmp edx, eax
je 0x1001b523
mov ebx, dword [eax + 4]
mov esi, dword [ebp - 0xc]
mov dword [ebx], ecx
mov edi, dword [ecx + 4]
mov dword [edi], edx
mov edx, dword [edx + 4]
mov dword [edx], eax
mov dword [esi + 4], edi
mov esi, dword [ebp + 8]
mov dword [ecx + 4], ebx
mov dword [eax + 4], edx
mov edx, dword [ebp - 8]
mov dword [edx + 4], eax
jmp 0x1001b55f
cmp edi, edx
je 0x1001b53c
nop
mov edx, dword [edx + 4]
cmp ebx, dword [edx + 8]
je 0x1001b575
cmp edi, edx
jne 0x1001b530
mov ebx, dword [eax + 4]
mov dword [ebp - 0xc], ebx
mov dword [ebx], ecx
mov ebx, dword [ecx + 4]
mov dword [ebx], edx
mov edi, dword [edx + 4]
mov dword [edi], eax
mov dword [edx + 4], ebx
mov edx, dword [ebp - 0xc]
mov dword [ecx + 4], edx
mov edx, dword [ebp - 8]
mov dword [eax + 4], edi
mov dword [edx], eax
mov ebx, dword [ebp - 4]
mov eax, ecx
cmp ecx, esi
jne 0x1001b4a0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
mov ebx, dword [eax + 4]
mov edx, dword [edx]
mov dword [ebp - 0xc], edx
mov esi, edx
mov dword [ebx], ecx
mov edi, dword [ecx + 4]
mov dword [edi], edx
mov edx, dword [edx + 4]
mov dword [edx], eax
mov dword [esi + 4], edi
mov esi, dword [ebp + 8]
mov dword [ecx + 4], ebx
mov dword [eax + 4], edx
jmp 0x1001b55f
Function at 0x1002ad00
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
cmp byte [0x10439fa0], 0
push esi
jne 0x1002ad60
mov byte [0x10439fa0], 1
xor eax, eax
push ebx
nop word [eax + eax]
xor esi, esi
mov ebx, eax
xor esi, dword [0x10439fb4]
xor ebx, dword [0x10439fb0]
xor esi, 0xd28f2c5
xor ebx, 0x1de26cd5
mov edx, esi
mov ecx, ebx
shld edx, ecx, 0xd
shl ecx, 0xd
xor esi, edx
xor ebx, ecx
mov ecx, ebx
shrd ecx, esi, 7
xor cl, bl
xor byte [eax + 0x10439fa1], cl
inc eax
cmp eax, 0xc
jb 0x1002ad20
pop ebx
push ecx
mov ecx, dword [ebp + 8]
push 0x10439fac
push 0x10439fa1
call fcn.1001a620
mov eax, dword [ebp + 8]
pop esi
mov esp, ebp
pop ebp
ret 4

Function at 0x1002ad80
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
cmp byte [0x10439fc0], 0
push esi
jne 0x1002ade0
mov byte [0x10439fc0], 1
xor eax, eax
push ebx
nop word [eax + eax]
xor esi, esi
mov ebx, eax
xor esi, dword [0x10439fd4]
xor ebx, dword [0x10439fd0]
xor esi, 0xd28f2c5
xor ebx, 0x1de26cd5
mov edx, esi
mov ecx, ebx
shld edx, ecx, 0xd
shl ecx, 0xd
xor esi, edx
xor ebx, ecx
mov ecx, ebx
shrd ecx, esi, 7
xor cl, bl
xor byte [eax + 0x10439fc1], cl
inc eax
cmp eax, 0xb
jb 0x1002ada0
pop ebx
push ecx
mov ecx, dword [ebp + 8]
push 0x10439fcb
push 0x10439fc1
call fcn.1001a620
mov eax, dword [ebp + 8]
pop esi
mov esp, ebp
pop ebp
ret 4

Function at 0x1002ae00
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
cmp byte [0x10439f30], 0
push esi
jne 0x1002ae6b
mov byte [0x10439f30], 1
xor eax, eax
push edi
nop word [eax + eax]
xor esi, esi
mov edi, eax
xor esi, dword [0x10439f54]
xor edi, dword [0x10439f50]
xor esi, 0xd28f2c5
xor edi, 0x1de26cd5
mov edx, esi
mov ecx, edi
shld edx, ecx, 0xd
shl ecx, 0xd
xor esi, edx
xor edi, ecx
mov ecx, edi
shrd ecx, esi, 7
xor cx, word [eax*2 + 0x10439f32]
xor cx, di
mov word [eax*2 + 0x10439f32], cx
inc eax
cmp eax, 0xd
jb 0x1002ae20
pop edi
push ecx
mov ecx, dword [ebp + 8]
push 0x10439f4a
push 0x10439f32
call fcn.1002cb60
mov eax, dword [ebp + 8]
pop esi
mov esp, ebp
pop ebp
ret 4

Function at 0x1002b070
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
cmp byte [0x10439ef0], 0
push esi
jne 0x1002b0db
mov byte [0x10439ef0], 1
xor eax, eax
push edi
nop word [eax + eax]
xor esi, esi
mov edi, eax
xor esi, dword [0x10439f24]
xor edi, dword [0x10439f20]
xor esi, 0xd28f2c5
xor edi, 0x1de26cd5
mov edx, esi
mov ecx, edi
shld edx, ecx, 0xd
shl ecx, 0xd
xor esi, edx
xor edi, ecx
mov ecx, edi
shrd ecx, esi, 7
xor cx, word [eax*2 + 0x10439ef2]
xor cx, di
mov word [eax*2 + 0x10439ef2], cx
inc eax
cmp eax, 0x14
jb 0x1002b090
pop edi
push ecx
mov ecx, dword [ebp + 8]
push 0x10439f18
push 0x10439ef2
call fcn.1002cb60
mov eax, dword [ebp + 8]
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x1002b3d0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
cmp dword [ebp + 0xc], 1
jne 0x1002b3fd
push 0
push 0
push dword [ebp + 0x10]
push 0x10028d80
push 0
push 0
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov eax, dword [0x1060b5e0]
add esp, 0x18
mov ecx, dword [ebp + 8]
mov dword [eax + 0x64], ecx
mov eax, 1
pop ebp
ret 0xc

Function at 0x1002b600
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10313e3e
mov eax, dword fs:[0]
push eax
sub esp, 8
push esi
push edi
mov eax, dword [0x1043900c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x10], 0
xorps xmm0, xmm0
mov esi, dword [ebp + 8]
movups xmmword [esi], xmm0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0xf
mov byte [esi], 0
mov dword [ebp - 4], 0
mov ecx, esi
push 0x15
mov dword [ebp - 0x10], 1
call fcn.1001a120
lea eax, [edi + 0x26]
mov dword [ebp - 0x14], eax
cmp edi, eax
je 0x1002b697
nop dword [eax]
mov al, byte [edi]
mov ecx, esi
xor al, 0xa5
movzx eax, al
push eax
call fcn.1001a280
add edi, 2
cmp edi, dword [ebp - 0x14]
jne 0x1002b680
cmp dword [esi + 0x14], 0x10
mov edi, esi
mov eax, dword [esi + 0x10]
jb 0x1002b6a4
mov edi, dword [esi]
test eax, eax
je 0x1002b732
push eax
push 0
push edi
call sub.VCRUNTIME140.dll_memchr
mov edx, eax
add esp, 0xc
test edx, edx
je 0x1002b732
sub edx, edi
cmp edx, 0xffffffff
je 0x1002b732
mov ecx, dword [esi + 0x14]
mov edi, 1
cmp ecx, 0x10
jb 0x1002b6e3
mov ecx, dword [esi + 0x10]
mov eax, ecx
sub eax, edx
mov dword [ebp + 8], ecx
cmp eax, edi
cmovb edi, eax
jmp 0x1002b6fe
mov eax, esi
sub eax, esi
add edx, eax
mov eax, dword [esi + 0x10]
mov dword [ebp + 8], eax
sub eax, edx
cmp eax, 1
cmovb edi, eax
mov eax, esi
cmp ecx, 0x10
jb 0x1002b700
mov eax, dword [esi]
lea ecx, [eax + edx]
mov eax, dword [ebp + 8]
sub eax, edi
mov dword [ebp + 8], eax
sub eax, edx
inc eax
push eax
lea eax, [ecx + edi]
push eax
push ecx
call sub.VCRUNTIME140.dll_memmove
mov eax, dword [ebp + 8]
add esp, 8
mov ecx, esi
mov dword [esi + 0x10], eax
push 0
call fcn.1001a0e0
mov edx, eax
cmp edx, 0xffffffff
jne 0x1002b6c5
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x1002b750
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10313e3e
mov eax, dword fs:[0]
push eax
sub esp, 8
push esi
push edi
mov eax, dword [0x1043900c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x10], 0
xorps xmm0, xmm0
mov esi, dword [ebp + 8]
movups xmmword [esi], xmm0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0xf
mov byte [esi], 0
mov dword [ebp - 4], 0
mov ecx, esi
push 0x13
mov dword [ebp - 0x10], 1
call fcn.1001a120
lea eax, [edi + 0x22]
mov dword [ebp - 0x14], eax
cmp edi, eax
je 0x1002b7e7
nop dword [eax]
mov al, byte [edi]
mov ecx, esi
xor al, 0xa5
movzx eax, al
push eax
call fcn.1001a280
add edi, 2
cmp edi, dword [ebp - 0x14]
jne 0x1002b7d0
cmp dword [esi + 0x14], 0x10
mov edi, esi
mov eax, dword [esi + 0x10]
jb 0x1002b7f4
mov edi, dword [esi]
test eax, eax
je 0x1002b882
push eax
push 0
push edi
call sub.VCRUNTIME140.dll_memchr
mov edx, eax
add esp, 0xc
test edx, edx
je 0x1002b882
sub edx, edi
cmp edx, 0xffffffff
je 0x1002b882
mov ecx, dword [esi + 0x14]
mov edi, 1
cmp ecx, 0x10
jb 0x1002b833
mov ecx, dword [esi + 0x10]
mov eax, ecx
sub eax, edx
mov dword [ebp + 8], ecx
cmp eax, edi
cmovb edi, eax
jmp 0x1002b84e
mov eax, esi
sub eax, esi
add edx, eax
mov eax, dword [esi + 0x10]
mov dword [ebp + 8], eax
sub eax, edx
cmp eax, 1
cmovb edi, eax
mov eax, esi
cmp ecx, 0x10
jb 0x1002b850
mov eax, dword [esi]
lea ecx, [eax + edx]
mov eax, dword [ebp + 8]
sub eax, edi
mov dword [ebp + 8], eax
sub eax, edx
inc eax
push eax
lea eax, [ecx + edi]
push eax
push ecx
call sub.VCRUNTIME140.dll_memmove
mov eax, dword [ebp + 8]
add esp, 8
mov ecx, esi
mov dword [esi + 0x10], eax
push 0
call fcn.1001a0e0
mov edx, eax
cmp edx, 0xffffffff
jne 0x1002b815
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x10032cb0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov edx, ecx
push esi
lea esi, [edx + 1]
mov al, byte [edx]
inc edx
test al, al
jne 0x10032cb6
sub edx, esi
lea esi, [edx + 1]
mov edx, 0x811c9dc5
test esi, esi
je 0x10032ce3
nop dword [eax + eax]
movsx eax, byte [ecx]
lea ecx, [ecx + 1]
xor eax, edx
imul edx, eax, 0x1000193
sub esi, 1
jne 0x10032cd0
mov eax, edx
pop esi
ret
Function at 0x10033450
Capabilities:
Hash data with crc32

Disassembly:
push ebx
mov ebx, ecx
or eax, 0xffffffff
push esi
push edi
mov edi, 4
lea esi, [ebx + 4]
jmp dword [edi*4 + 0x10034698]
Function at 0x1003e0f0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x103153b0
mov eax, dword fs:[0]
push eax
push ebx
push esi
push edi
mov eax, dword [0x1043900c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push dword [ebp + 0x10]
movss xmm0, dword [ebp + 0xc]
mov ebx, dword [ebp + 8]
mov dword [ebp - 4], 0
mov eax, dword [0x1060c20c]
mov ecx, dword [eax + 4]
add ecx, 0x58
push ecx
movss dword [esp], xmm0
push ebx
mov edx, dword [ecx]
mov ecx, dword [eax]
call edx
mov dword [ebp - 4], 0xffffffff
mov eax, dword [0x1060b274]
mov ecx, dword [0x1060b288]
mov edi, dword [0x1060b5e0]
mov eax, dword [eax]
mov esi, dword [eax + 0xc]
mov eax, dword [ecx]
call dword [eax + 0x30]
mov ecx, dword [0x1060b274]
push eax
call esi
mov dword [edi + 0xaa8], eax
mov ecx, dword [0x1060b284]
push ebx
push 0
mov eax, dword [ecx]
mov eax, dword [eax + 0x20]
call eax
mov esi, eax
test esi, esi
je 0x1003e1ea
cmp dword [esi + 4], 0
je 0x1003e1ea
mov eax, dword [0x1060b5e0]
cmp dword [eax + 0xaa8], 0
je 0x1003e1ea
cmp byte [eax + 0x70], 0
jne 0x1003e1ea
mov eax, 0x1b4e81b5
imul ebx
sar edx, 4
mov eax, edx
shr eax, 0x1f
add eax, edx
imul eax, eax, 0x96
sub ebx, eax
mov eax, dword [0x1060b284]
imul edi, ebx, 0x68
add edi, dword [eax + 0xf4]
je 0x1003e1ea
mov edx, dword [ebp + 0x14]
mov ecx, esi
movss xmm0, dword [ebp + 0xc]
call fcn.1003b300
push esi
mov ecx, edi
call fcn.10038d00
mov ecx, esi
call fcn.10033450
mov dword [edi + 0x64], eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10