joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100693f0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
cmp byte [0x1027f240], 0
push ebx
push esi
je 0x10069464
cmp byte [0x1027f241], 0
jne 0x100694a8
mov byte [0x1027f241], 1
xor esi, esi
nop word [eax + eax]
xor edx, edx
mov ebx, esi
xor edx, dword [0x1027f254]
xor ebx, dword [0x1027f250]
xor edx, 0xd28f2c5
xor ebx, 0x1de26cd5
mov ecx, edx
mov eax, ebx
shld ecx, eax, 0xd
shl eax, 0xd
xor edx, ecx
xor ebx, eax
mov dword [ebp - 4], edx
mov eax, ebx
shrd eax, edx, 7
xor al, bl
xor byte [esi + 0x1027f242], al
inc esi
cmp esi, 0xc
jb 0x10069420
jmp 0x100694a8
xor esi, esi
xor edx, edx
mov ebx, esi
xor edx, dword [0x1027f254]
xor ebx, dword [0x1027f250]
xor edx, 0xd28f2c5
xor ebx, 0x1de26cd5
mov ecx, edx
mov eax, ebx
shld ecx, eax, 0xd
shl eax, 0xd
xor edx, ecx
xor ebx, eax
mov dword [ebp - 4], edx
mov eax, ebx
shrd eax, edx, 7
xor al, bl
xor byte [esi + 0x1027f242], al
inc esi
cmp esi, 0xc
jb 0x10069466
mov esi, dword [ebp + 8]
mov ecx, esi
push 0xb
push 0x1027f242
mov dword [esi], 0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0xf
call fcn.100464c0
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x1006d390
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
mov eax, dword [0x1029ad64]
xor eax, ebp
mov dword [ebp - 4], eax
cmp byte [0x10281af0], 0
mov eax, dword [ebp + 0xc]
push ebx
mov ebx, dword [ebp + 0x10]
push esi
push edi
mov edi, dword [ebp + 8]
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x20], ebx
je 0x1006d415
cmp byte [0x10281af1], 0
jne 0x1006d465
mov byte [0x10281af1], 1
xor esi, esi
xor edx, edx
mov ebx, esi
xor edx, dword [0x10281b0c]
xor ebx, dword [0x10281b08]
xor edx, 0xd28f2c5
xor ebx, 0x1de26cd5
mov ecx, edx
mov eax, ebx
shld ecx, eax, 0xd
shl eax, 0xd
xor edx, ecx
xor ebx, eax
mov dword [ebp - 0x28], edx
mov eax, ebx
shrd eax, edx, 7
xor al, bl
xor byte [esi + 0x10281af2], al
inc esi
cmp esi, 0x10
jb 0x1006d3d1
jmp 0x1006d462
xor esi, esi
nop word [eax + eax]
xor edx, edx
mov ebx, esi
xor edx, dword [0x10281b0c]
xor ebx, dword [0x10281b08]
xor edx, 0xd28f2c5
xor ebx, 0x1de26cd5
mov ecx, edx
mov eax, ebx
shld ecx, eax, 0xd
shl eax, 0xd
xor edx, ecx
xor ebx, eax
mov dword [ebp - 0x28], edx
mov eax, ebx
shrd eax, edx, 7
xor al, bl
xor byte [esi + 0x10281af2], al
inc esi
cmp esi, 0x10
jb 0x1006d420
mov ebx, dword [ebp - 0x20]
push 0xf
push 0x10281af2
lea ecx, [ebp - 0x1c]
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0xc], 0
mov dword [ebp - 8], 0xf
call fcn.100464c0
cmp dword [ebp - 8], 0x10
lea eax, [ebp - 0x1c]
cmovae eax, dword [ebp - 0x1c]
push eax
push dword [ebp - 0x24]
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edx, dword [ebp - 8]
mov esi, eax
cmp edx, 0x10
jb 0x1006d4d6
mov ecx, dword [ebp - 0x1c]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x1006d4cc
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x1006d4cc
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push edx
push ecx
call fcn.10138f1a
add esp, 8
mov dword [ebp - 0xc], 0
mov dword [ebp - 8], 0xf
mov byte [ebp - 0x1c], 0
test esi, esi
jne 0x1006d4f0
mov dword [edi], esi
jmp 0x1006d502
cmp dword [ebx + 0x14], 0x10
jb 0x1006d4f8
mov ebx, dword [ebx]
push 0
push ebx
call esi
add esp, 8
mov dword [edi], eax
mov ecx, dword [ebp - 4]
mov eax, edi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10139242
mov esp, ebp
pop ebp
ret 0xc

Function at 0x10073f70
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
push 8
mov esi, ecx
call fcn.10138eea
add esp, 4
test eax, eax
je 0x10073f96
mov edx, dword [ebp + 0xc]
mov ecx, dword [edx]
mov dword [eax], ecx
mov ecx, dword [ebp + 8]
mov ecx, dword [ecx]
mov dword [eax + 4], ecx
jmp 0x10073f98
xor eax, eax
lea edi, [esi + 4]
push edi
push 0
push eax
push 0x10074370
push 0
push 0
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
add esp, 0x18
mov dword [esi], eax
test eax, eax
je 0x10073fbf
pop edi
mov eax, esi
pop esi
pop ebp
ret 8
push 6
mov dword [edi], 0
call sub.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_
int3
Function at 0x10073fd0
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 8]
movzx eax, byte [edx]
xor eax, 0x811c9dc5
imul ecx, eax, 0x1000193
movzx eax, byte [edx + 1]
xor ecx, eax
movzx eax, byte [edx + 2]
imul ecx, ecx, 0x1000193
xor ecx, eax
movzx eax, byte [edx + 3]
imul ecx, ecx, 0x1000193
xor ecx, eax
movzx eax, byte [edx + 4]
imul ecx, ecx, 0x1000193
xor ecx, eax
movzx eax, byte [edx + 5]
imul ecx, ecx, 0x1000193
xor ecx, eax
movzx eax, byte [edx + 6]
imul ecx, ecx, 0x1000193
xor ecx, eax
movzx eax, byte [edx + 7]
imul ecx, ecx, 0x1000193
xor ecx, eax
imul eax, ecx, 0x1000193
pop ebp
ret 4
Function at 0x10077d50
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
cmp byte [0x10285530], 0
push ebx
push esi
je 0x10077dc4
cmp byte [0x10285531], 0
jne 0x10077e08
mov byte [0x10285531], 1
xor esi, esi
nop word [eax + eax]
xor edx, edx
mov ebx, esi
xor edx, dword [0x10285564]
xor ebx, dword [0x10285560]
xor edx, 0xd28f2c5
xor ebx, 0x1de26cd5
mov ecx, edx
mov eax, ebx
shld ecx, eax, 0xd
shl eax, 0xd
xor edx, ecx
xor ebx, eax
mov dword [ebp - 4], edx
mov eax, ebx
shrd eax, edx, 7
xor al, bl
xor byte [esi + 0x10285532], al
inc esi
cmp esi, 0x28
jb 0x10077d80
jmp 0x10077e08
xor esi, esi
xor edx, edx
mov ebx, esi
xor edx, dword [0x10285564]
xor ebx, dword [0x10285560]
xor edx, 0xd28f2c5
xor ebx, 0x1de26cd5
mov ecx, edx
mov eax, ebx
shld ecx, eax, 0xd
shl eax, 0xd
xor edx, ecx
xor ebx, eax
mov dword [ebp - 4], edx
mov eax, ebx
shrd eax, edx, 7
xor al, bl
xor byte [esi + 0x10285532], al
inc esi
cmp esi, 0x28
jb 0x10077dc6
mov esi, dword [ebp + 8]
mov ecx, esi
push 0x27
push 0x10285532
mov dword [esi], 0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0xf
call fcn.100464c0
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x10077e60
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
cmp byte [0x102855e0], 0
push ebx
push esi
je 0x10077ed7
cmp byte [0x102855e1], 0
jne 0x10077f25
mov byte [0x102855e1], 1
xor esi, esi
nop word [eax + eax]
xor edx, edx
mov ebx, esi
xor edx, dword [0x1028568c]
xor ebx, dword [0x10285688]
xor edx, 0xd28f2c5
xor ebx, 0x1de26cd5
mov ecx, edx
mov eax, ebx
shld ecx, eax, 0xd
shl eax, 0xd
xor edx, ecx
xor ebx, eax
mov dword [ebp - 4], edx
mov eax, ebx
shrd eax, edx, 7
xor al, bl
xor byte [esi + 0x102855e2], al
inc esi
cmp esi, 0x9f
jb 0x10077e90
jmp 0x10077f25
xor esi, esi
nop dword [eax]
xor edx, edx
mov ebx, esi
xor edx, dword [0x1028568c]
xor ebx, dword [0x10285688]
xor edx, 0xd28f2c5
xor ebx, 0x1de26cd5
mov ecx, edx
mov eax, ebx
shld ecx, eax, 0xd
shl eax, 0xd
xor edx, ecx
xor ebx, eax
mov dword [ebp - 4], edx
mov eax, ebx
shrd eax, edx, 7
xor al, bl
xor byte [esi + 0x102855e2], al
inc esi
cmp esi, 0x9f
jb 0x10077ee0
mov esi, dword [ebp + 8]
mov ecx, esi
push 0x9e
push 0x102855e2
mov dword [esi], 0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0xf
call fcn.100464c0
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x1007b890
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
cmp dword [ebp + 0xc], 1
push ebx
push esi
push edi
jne 0x1007b90c
mov eax, dword [ebp + 8]
push str.ru_RI.UTF_8
push 0
mov dword [0x102a05d0], eax
call dword [sym.imp.api_ms_win_crt_locale_l1_1_0.dll_setlocale]
add esp, 8
push 0x10079d10
push 1
call dword [sym.imp.KERNEL32.dll_AddVectoredExceptionHandler]
jmp 0x1007b8ca
mov eax, dword [0x1027f008]
sub eax, dword [0x1027f010]
xor eax, dword [0x1027f00c]
mov ecx, dword [ebp + 8]
push 0
push 0
push dword [ebp + 0x10]
mov dword [eax + 0x50], ecx
push 0x10079cd0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
jmp 0x1007b900
mov eax, 1
pop edi
pop esi
pop ebx
pop ebp
ret 0xc
pop edi
pop esi
xor eax, eax
pop ebx
pop ebp
ret 0xc
Function at 0x100865a0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x1029ad64]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, ecx
cmp dword [esi + 0x38], 0
je 0x1008665c
cmp byte [esi + 0x3d], 0
je 0x1008665c
mov eax, dword [esi]
push edi
push 0xffffffffffffffff
call dword [eax + 0xc]
cmp eax, 0xffffffff
je 0x1008664a
mov ecx, dword [esi + 0x38]
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [esi + 0x40]
push eax
call dword [sym.imp.MSVCP140.dll_public:_int___thiscall_std::codecvt_char__char__struct__Mbstatet_::unshift_struct__Mbstatet___char___char___char___const]
sub eax, 0
je 0x10086611
sub eax, 1
je 0x10086615
sub eax, 2
jne 0x1008664a
mov byte [esi + 0x3d], al
mov al, 1
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10139242
mov esp, ebp
pop ebp
ret
mov byte [esi + 0x3d], 0
mov edi, dword [ebp - 0x28]
lea eax, [ebp - 0x24]
sub edi, eax
je 0x10086633
push dword [esi + 0x4c]
push edi
push 1
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
add esp, 0x10
cmp edi, eax
jne 0x1008664a
cmp byte [esi + 0x3d], 0
pop edi
sete al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10139242
mov esp, ebp
pop ebp
ret
pop edi
xor al, al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10139242
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
mov al, 1
xor ecx, ebp
pop esi
call fcn.10139242
mov esp, ebp
pop ebp
ret
Function at 0x1008db10
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [0x1029ad64]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push eax
lea eax, [ebp - 0x1c]
push 0x102a3740
push eax
call fcn.10085b20
cmp dword [ebp - 8], 0x10
lea eax, [ebp - 0x1c]
cmovae eax, dword [ebp - 0x1c]
push eax
call dword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll_remove]
mov edx, dword [ebp - 8]
add esp, 0x10
cmp edx, 0x10
jb 0x1008db7d
mov ecx, dword [ebp - 0x1c]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x1008db73
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x1008db73
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push edx
push ecx
call fcn.10138f1a
add esp, 8
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10139242
mov esp, ebp
pop ebp
ret
Function at 0x1009acb0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
cmp byte [0x10291460], 0
push ebx
push esi
je 0x1009ad24
cmp byte [0x10291461], 0
jne 0x1009ad68
mov byte [0x10291461], 1
xor esi, esi
nop word [eax + eax]
xor edx, edx
mov ebx, esi
xor edx, dword [0x1029147c]
xor ebx, dword [0x10291478]
xor edx, 0xd28f2c5
xor ebx, 0x1de26cd5
mov ecx, edx
mov eax, ebx
shld ecx, eax, 0xd
shl eax, 0xd
xor edx, ecx
xor ebx, eax
mov dword [ebp - 4], edx
mov eax, ebx
shrd eax, edx, 7
xor al, bl
xor byte [esi + str.H_c], al
inc esi
cmp esi, 0xf
jb 0x1009ace0
jmp 0x1009ad68
xor esi, esi
xor edx, edx
mov ebx, esi
xor edx, dword [0x1029147c]
xor ebx, dword [0x10291478]
xor edx, 0xd28f2c5
xor ebx, 0x1de26cd5
mov ecx, edx
mov eax, ebx
shld ecx, eax, 0xd
shl eax, 0xd
xor edx, ecx
xor ebx, eax
mov dword [ebp - 4], edx
mov eax, ebx
shrd eax, edx, 7
xor al, bl
xor byte [esi + str.H_c], al
inc esi
cmp esi, 0xf
jb 0x1009ad26
mov esi, dword [ebp + 8]
mov ecx, esi
push 0xe
push str.H_c
mov dword [esi], 0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0xf
call fcn.100464c0
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x1009ada0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
cmp byte [0x10291440], 0
push ebx
push esi
je 0x1009ae14
cmp byte [0x10291441], 0
jne 0x1009ae58
mov byte [0x10291441], 1
xor esi, esi
nop word [eax + eax]
xor edx, edx
mov ebx, esi
xor edx, dword [0x1029145c]
xor ebx, dword [0x10291458]
xor edx, 0xd28f2c5
xor ebx, 0x1de26cd5
mov ecx, edx
mov eax, ebx
shld ecx, eax, 0xd
shl eax, 0xd
xor edx, ecx
xor ebx, eax
mov dword [ebp - 4], edx
mov eax, ebx
shrd eax, edx, 7
xor al, bl
xor byte [esi + 0x10291442], al
inc esi
cmp esi, 0x12
jb 0x1009add0
jmp 0x1009ae58
xor esi, esi
xor edx, edx
mov ebx, esi
xor edx, dword [0x1029145c]
xor ebx, dword [0x10291458]
xor edx, 0xd28f2c5
xor ebx, 0x1de26cd5
mov ecx, edx
mov eax, ebx
shld ecx, eax, 0xd
shl eax, 0xd
xor edx, ecx
xor ebx, eax
mov dword [ebp - 4], edx
mov eax, ebx
shrd eax, edx, 7
xor al, bl
xor byte [esi + 0x10291442], al
inc esi
cmp esi, 0x12
jb 0x1009ae16
mov esi, dword [ebp + 8]
mov ecx, esi
push 0x11
push 0x10291442
mov dword [esi], 0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0xf
call fcn.100464c0
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x1009ae90
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
cmp byte [0x10291480], 0
push ebx
push esi
je 0x1009af04
cmp byte [0x10291481], 0
jne 0x1009af48
mov byte [0x10291481], 1
xor esi, esi
nop word [eax + eax]
xor edx, edx
mov ebx, esi
xor edx, dword [0x10291494]
xor ebx, dword [0x10291490]
xor edx, 0xd28f2c5
xor ebx, 0x1de26cd5
mov ecx, edx
mov eax, ebx
shld ecx, eax, 0xd
shl eax, 0xd
xor edx, ecx
xor ebx, eax
mov dword [ebp - 4], edx
mov eax, ebx
shrd eax, edx, 7
xor al, bl
xor byte [esi + str.KU], al
inc esi
cmp esi, 0xb
jb 0x1009aec0
jmp 0x1009af48
xor esi, esi
xor edx, edx
mov ebx, esi
xor edx, dword [0x10291494]
xor ebx, dword [0x10291490]
xor edx, 0xd28f2c5
xor ebx, 0x1de26cd5
mov ecx, edx
mov eax, ebx
shld ecx, eax, 0xd
shl eax, 0xd
xor edx, ecx
xor ebx, eax
mov dword [ebp - 4], edx
mov eax, ebx
shrd eax, edx, 7
xor al, bl
xor byte [esi + str.KU], al
inc esi
cmp esi, 0xb
jb 0x1009af06
mov esi, dword [ebp + 8]
mov ecx, esi
push 0xa
push str.KU
mov dword [esi], 0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0xf
call fcn.100464c0
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x1009dd00
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [0x1029bd84]
push esi
mov esi, ecx
test al, 1
jne 0x1009dd22
mov ecx, dword [0x1029bd60]
or eax, 1
mov dword [0x1029bd84], eax
mov dword [0x1029bd80], ecx
jmp 0x1009dd28
mov ecx, dword [0x1029bd80]
mov eax, dword [0x101cf098]
test byte [ecx + eax], 1
je 0x1009dd3f
mov eax, dword [esi]
cmp eax, 3
jg 0x1009dd45
inc eax
mov dword [esi], eax
jmp 0x1009dd45
mov dword [esi], 0
mov ecx, esi
call fcn.1009df40
mov ecx, esi
call fcn.1009c000
mov ecx, esi
call fcn.1009c290
mov ecx, esi
pop esi
jmp fcn.1009c590
Function at 0x100a1e60
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov ebx, ecx
movzx eax, byte [edi]
xor eax, 0x811c9dc5
imul edx, eax, 0x1000193
movzx eax, byte [edi + 1]
xor edx, eax
movzx eax, byte [edi + 2]
imul edx, edx, 0x1000193
xor edx, eax
movzx eax, byte [edi + 3]
imul ecx, edx, 0x1000193
mov edx, dword [ebx + 4]
xor ecx, eax
imul eax, ecx, 0x1000193
mov ecx, dword [ebx + 0x18]
and ecx, eax
mov eax, dword [ebx + 0xc]
mov dword [ebp + 8], ecx
mov esi, dword [eax + ecx*8 + 4]
cmp esi, edx
je 0x100a2017
mov ecx, dword [eax + ecx*8]
mov eax, dword [edi]
cmp eax, dword [esi + 8]
je 0x100a1ed2
cmp esi, ecx
je 0x100a2017
mov esi, dword [esi + 4]
cmp eax, dword [esi + 8]
jne 0x100a1ec2
test esi, esi
je 0x100a2017
mov ecx, dword [ebp + 8]
mov edi, dword [ebx + 0xc]
mov eax, dword [edi + ecx*8]
cmp dword [edi + ecx*8 + 4], esi
jne 0x100a1eff
cmp eax, esi
jne 0x100a1ef6
mov dword [edi + ecx*8], edx
mov dword [edi + ecx*8 + 4], edx
jmp 0x100a1f08
mov edx, dword [esi + 4]
mov dword [edi + ecx*8 + 4], edx
jmp 0x100a1f08
cmp eax, esi
jne 0x100a1f08
mov eax, dword [esi]
mov dword [edi + ecx*8], eax
mov ecx, dword [esi]
dec dword [ebx + 8]
mov eax, dword [esi + 4]
mov dword [eax], ecx
mov eax, dword [esi + 4]
mov dword [ecx + 4], eax
mov ecx, dword [esi + 0x88]
cmp ecx, 0x10
jb 0x100a1f4f
mov eax, dword [esi + 0x74]
inc ecx
cmp ecx, 0x1000
jb 0x100a1f45
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x100a2011
mov eax, edx
push ecx
push eax
call fcn.10138f1a
add esp, 8
mov byte [esi + 0x74], 0
mov dword [esi + 0x84], 0
mov dword [esi + 0x88], 0xf
mov ecx, dword [esi + 0x70]
cmp ecx, 0x10
jb 0x100a1f9b
mov eax, dword [esi + 0x5c]
inc ecx
cmp ecx, 0x1000
jb 0x100a1f91
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x100a2011
mov eax, edx
push ecx
push eax
call fcn.10138f1a
add esp, 8
mov byte [esi + 0x5c], 0
mov dword [esi + 0x6c], 0
mov dword [esi + 0x70], 0xf
mov eax, dword [esi + 0x50]
test eax, eax
je 0x100a1ff5
mov ecx, dword [esi + 0x58]
sub ecx, eax
and ecx, 0xfffffff0
cmp ecx, 0x1000
jb 0x100a1fd6
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x100a2011
mov eax, edx
push ecx
push eax
call fcn.10138f1a
mov dword [esi + 0x50], 0
add esp, 8
mov dword [esi + 0x54], 0
mov dword [esi + 0x58], 0
push 0x98
push esi
call fcn.10138f1a
add esp, 8
mov eax, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x100a2730
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push dword [ebp + 0x10]
lea eax, [ebp - 8]
mov dword [ebp - 8], 0x43800000
push 0
push 0
push eax
push dword [ebp + 8]
mov dword [ebp - 4], 0x42000000
call fcn.100a27d0
test al, al
je 0x100a27ad
test byte [ebp + 0x10], 1
jne 0x100a27ad
push 4
call fcn.10138eea
add esp, 4
test eax, eax
je 0x100a2776
mov ecx, dword [ebp + 0xc]
mov dword [eax], ecx
jmp 0x100a2778
xor eax, eax
lea ecx, [ebp - 4]
push ecx
push 0
push eax
push 0x100a2700
push 0
push 0
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
add esp, 0x18
mov dword [ebp - 8], eax
test eax, eax
je 0x100a27c0
mov ecx, dword [ebp - 4]
test ecx, ecx
je 0x100a27b3
push ecx
push eax
call sub.MSVCP140.dll__Thrd_detach
add esp, 8
test eax, eax
jne 0x100a27ba
mov esp, ebp
pop ebp
ret 0xc
push 1
call sub.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_
push eax
call sub.MSVCP140.dll_void___cdecl_std::_Throw_C_error_int_
push 6
mov dword [ebp - 4], 0
call sub.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_
int3
Function at 0x100c8f40
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov edx, 0xcbf29ce4
xor esi, esi
mov dword [ebp - 4], edx
mov ecx, 0x84222325
cmp byte [edi], 0
je 0x100c8f67
nop
inc esi
cmp byte [esi + edi], 0
jne 0x100c8f60
xor ebx, ebx
test esi, esi
je 0x100c8f95
nop dword [eax]
movsx eax, byte [ebx + edi]
push 0x100
cdq
xor edx, dword [ebp - 4]
xor eax, ecx
push 0x1b3
push edx
push eax
call fcn.101398e0
inc ebx
mov dword [ebp - 4], edx
mov ecx, eax
cmp ebx, esi
jb 0x100c8f70
pop edi
pop esi
mov eax, ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x100d00f0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
cmp byte [0x101cf006], 0
mov dword [ebp - 4], ecx
je 0x100d027b
mov ecx, dword [ebp + 8]
push ebx
push esi
push edi
mov eax, dword [ecx]
call dword [eax + 4]
mov ebx, eax
xor esi, esi
mov edi, 0x84222325
mov ecx, 0xcbf29ce4
cmp byte [ebx], 0
je 0x100d012b
inc esi
cmp byte [esi + ebx], 0
jne 0x100d0124
xor eax, eax
mov dword [ebp - 8], eax
test esi, esi
je 0x100d0278
nop dword [eax + eax]
movsx eax, byte [eax + ebx]
push 0x100
cdq
push 0x1b3
xor edx, ecx
xor eax, edi
push edx
push eax
call fcn.101398e0
mov edi, eax
mov ecx, edx
mov eax, dword [ebp - 8]
inc eax
mov dword [ebp - 8], eax
cmp eax, esi
jb 0x100d0140
cmp ecx, 0x3943e50e
ja 0x100d025d
jb 0x100d0183
cmp edi, 0x2bb2e9fe
ja 0x100d025d
cmp edi, 0x2bb2e9fe
jne 0x100d0215
cmp ecx, 0x3943e50e
jne 0x100d0215
mov ecx, dword [0x101cf098]
test ecx, ecx
je 0x100d0278
mov eax, dword [0x1029bcec]
test al, 1
jne 0x100d01c2
or eax, 1
mov dword [0x1029bcec], eax
mov eax, dword [0x1029bce4]
mov dword [0x1029bce8], eax
jmp 0x100d01c7
mov eax, dword [0x1029bce8]
cmp dword [eax + ecx], 0
jne 0x100d0278
mov eax, dword [0x1029bcf4]
test al, 1
jne 0x100d01ee
or eax, 1
mov dword [0x1029bcf4], eax
mov eax, dword [0x1029bce0]
mov dword [0x1029bcf0], eax
jmp 0x100d01f3
mov eax, dword [0x1029bcf0]
cmp dword [eax + ecx], 0
jle 0x100d0278
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 8]
cmp ecx, dword [eax + 0xc]
je 0x100d0278
cmp byte [ecx], 0
jne 0x100d0278
pop edi
pop esi
mov byte [ecx], 1
pop ebx
mov esp, ebp
pop ebp
ret 4
cmp edi, 0x5de24d68
jne 0x100d0239
cmp ecx, 0x4251ee7
jne 0x100d0239
push dword [ebp + 8]
mov ecx, dword [ebp - 4]
call fcn.100cfc20
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
cmp edi, 0xedb6640
jne 0x100d0278
cmp ecx, 0x1baa64fb
jne 0x100d0278
push dword [ebp + 8]
mov ecx, dword [ebp - 4]
call fcn.100d0f10
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
cmp edi, 0xb118f470
jne 0x100d0278
cmp ecx, 0xd089c265
jne 0x100d0278
push dword [ebp + 8]
mov ecx, dword [ebp - 4]
call fcn.100d07e0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x100d0f10
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x1029ad64]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, ecx
push esi
push edi
mov dword [ebp - 0x20], ebx
lea edi, [ebx + 0x13fc]
lea eax, [edi + 0x104]
cmp eax, edi
sbb ecx, ecx
and ecx, 0xffffffbf
add ecx, 0x41
cmp edi, eax
ja 0x100d0f46
xor eax, eax
rep stosd dword es:[edi], eax
lea ecx, [ebx + 0xb0]
lea edx, [ecx + 0x134c]
cmp ecx, edx
je 0x100d0ff7
add ecx, 0x44
nop dword [eax]
mov eax, dword [ecx - 0x40]
cmp eax, dword [ecx - 0x3c]
je 0x100d0f6b
mov dword [ecx - 0x3c], eax
cmp byte [ecx - 0x34], 0
je 0x100d0fdc
mov dword [ecx - 0x34], 0
mov word [ecx - 0x30], 0
mov byte [ecx - 0x2e], 0
mov dword [ecx - 0x2c], 0xffffffff
mov dword [ecx - 0x28], 0
mov dword [ecx - 0x24], 0
mov dword [ecx - 0x18], 0
mov dword [ecx - 0x20], 0
mov dword [ecx - 0x1c], 0
mov dword [ecx - 0x14], 0
mov dword [ecx - 0x10], 0
mov dword [ecx - 0xc], 0
mov dword [ecx - 8], 0
mov dword [ecx + 4], 0
mov dword [ecx], 0
mov dword [ecx - 4], 0
cmp dword [ecx - 0x44], 0
je 0x100d0fe9
mov dword [ecx - 0x44], 0
add ecx, 0x4c
lea eax, [ecx - 0x44]
cmp eax, edx
jne 0x100d0f60
mov al, byte [0x101cf013]
mov edx, 1
test al, al
movzx ecx, al
cmove ecx, edx
test byte [0x1028e5e8], 4
mov byte [0x101cf013], cl
je 0x100d1134
cmp byte [0x10296148], 0
mov edi, dword [0x102a398c]
je 0x100d1084
cmp byte [0x10296149], 0
jne 0x100d10cb
mov byte [0x10296149], dl
xor esi, esi
xor edx, edx
mov ebx, esi
xor edx, dword [0x10296184]
xor ebx, dword [0x10296180]
xor edx, 0xd28f2c5
xor ebx, 0x1de26cd5
mov ecx, edx
mov eax, ebx
shld ecx, eax, 0xd
shl eax, 0xd
xor edx, ecx
xor ebx, eax
mov dword [ebp - 0x24], edx
mov eax, ebx
shrd eax, edx, 7
xor al, bl
xor byte [esi + 0x1029614a], al
inc esi
cmp esi, 0x30
jb 0x100d1040
jmp 0x100d10c8
xor esi, esi
xor edx, edx
mov ebx, esi
xor edx, dword [0x10296184]
xor ebx, dword [0x10296180]
xor edx, 0xd28f2c5
xor ebx, 0x1de26cd5
mov ecx, edx
mov eax, ebx
shld ecx, eax, 0xd
shl eax, 0xd
xor edx, ecx
xor ebx, eax
mov dword [ebp - 0x24], edx
mov eax, ebx
shrd eax, edx, 7
xor al, bl
xor byte [esi + 0x1029614a], al
inc esi
cmp esi, 0x30
jb 0x100d1086
mov ebx, dword [ebp - 0x20]
push 0x2f
push 0x1029614a
lea ecx, [ebp - 0x1c]
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0xc], 0
mov dword [ebp - 8], 0xf
call fcn.100464c0
push 1
push 0xffffffffffffffff
lea eax, [ebp - 0x1c]
mov ecx, edi
push eax
call fcn.100fd060
mov edx, dword [ebp - 8]
cmp edx, 0x10
jb 0x100d1134
mov ecx, dword [ebp - 0x1c]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x100d112a
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x100d112a
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push edx
push ecx
call fcn.10138f1a
add esp, 8
lea esi, [ebx + 8]
push esi
push dword [esi + 4]
push dword [esi]
call fcn.100ce480
mov eax, dword [esi]
add esp, 0xc
mov ecx, dword [ebp - 4]
mov dword [esi + 4], eax
xor ecx, ebp
pop edi
pop esi
pop ebx
call fcn.10139242
mov esp, ebp
pop ebp
ret 4