joyce8/EMBER2024-capa huggingface dataset:
Function at 0x101a8710
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
cmp byte [0x104b3590], 0
push esi
jne 0x101a8770
mov byte [0x104b3590], 1
xor eax, eax
push ebx
nop word [eax + eax]
xor esi, esi
mov ebx, eax
xor esi, dword [0x104b35a4]
xor ebx, dword [0x104b35a0]
xor esi, 0xd28f2c5
xor ebx, 0x1de26cd5
mov edx, esi
mov ecx, ebx
shld edx, ecx, 0xd
shl ecx, 0xd
xor esi, edx
xor ebx, ecx
mov ecx, ebx
shrd ecx, esi, 7
xor cl, bl
xor byte [eax + str.U_vF_b], cl
inc eax
cmp eax, 0xb
jb 0x101a8730
pop ebx
push ecx
mov ecx, dword [ebp + 8]
push 0x104b359b
push str.U_vF_b
call fcn.1001a620
mov eax, dword [ebp + 8]
pop esi
mov esp, ebp
pop ebp
ret 4

Function at 0x101a8790
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
cmp byte [0x104b40d0], 0
push esi
jne 0x101a87f0
mov byte [0x104b40d0], 1
xor eax, eax
push ebx
nop word [eax + eax]
xor esi, esi
mov ebx, eax
xor esi, dword [0x104b40e4]
xor ebx, dword [0x104b40e0]
xor esi, 0xd28f2c5
xor ebx, 0x1de26cd5
mov edx, esi
mov ecx, ebx
shld edx, ecx, 0xd
shl ecx, 0xd
xor esi, edx
xor ebx, ecx
mov ecx, ebx
shrd ecx, esi, 7
xor cl, bl
xor byte [eax + 0x104b40d1], cl
inc eax
cmp eax, 0xd
jb 0x101a87b0
pop ebx
push ecx
mov ecx, dword [ebp + 8]
push 0x104b40dd
push 0x104b40d1
call fcn.1001a620
mov eax, dword [ebp + 8]
pop esi
mov esp, ebp
pop ebp
ret 4

Function at 0x101a8810
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
cmp byte [0x104b3950], 0
push esi
jne 0x101a8870
mov byte [0x104b3950], 1
xor eax, eax
push ebx
nop word [eax + eax]
xor esi, esi
mov ebx, eax
xor esi, dword [0x104b3964]
xor ebx, dword [0x104b3960]
xor esi, 0xd28f2c5
xor ebx, 0x1de26cd5
mov edx, esi
mov ecx, ebx
shld edx, ecx, 0xd
shl ecx, 0xd
xor esi, edx
xor ebx, ecx
mov ecx, ebx
shrd ecx, esi, 7
xor cl, bl
xor byte [eax + 0x104b3951], cl
inc eax
cmp eax, 0xc
jb 0x101a8830
pop ebx
push ecx
mov ecx, dword [ebp + 8]
push 0x104b395c
push 0x104b3951
call fcn.1001a620
mov eax, dword [ebp + 8]
pop esi
mov esp, ebp
pop ebp
ret 4

Function at 0x101a9010
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
cmp byte [0x104b2e00], 0
push esi
jne 0x101a9070
mov byte [0x104b2e00], 1
xor eax, eax
push ebx
nop word [eax + eax]
xor esi, esi
mov ebx, eax
xor esi, dword [0x104b2e14]
xor ebx, dword [0x104b2e10]
xor esi, 0xd28f2c5
xor ebx, 0x1de26cd5
mov edx, esi
mov ecx, ebx
shld edx, ecx, 0xd
shl ecx, 0xd
xor esi, edx
xor ebx, ecx
mov ecx, ebx
shrd ecx, esi, 7
xor cl, bl
xor byte [eax + 0x104b2e01], cl
inc eax
cmp eax, 0xd
jb 0x101a9030
pop ebx
push ecx
mov ecx, dword [ebp + 8]
push 0x104b2e0d
push 0x104b2e01
call fcn.1001a620
mov eax, dword [ebp + 8]
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x101a9090
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
cmp byte [0x104b4200], 0
push esi
jne 0x101a90f0
mov byte [0x104b4200], 1
xor eax, eax
push ebx
nop word [eax + eax]
xor esi, esi
mov ebx, eax
xor esi, dword [0x104b4214]
xor ebx, dword [0x104b4210]
xor esi, 0xd28f2c5
xor ebx, 0x1de26cd5
mov edx, esi
mov ecx, ebx
shld edx, ecx, 0xd
shl ecx, 0xd
xor esi, edx
xor ebx, ecx
mov ecx, ebx
shrd ecx, esi, 7
xor cl, bl
xor byte [eax + 0x104b4201], cl
inc eax
cmp eax, 0xe
jb 0x101a90b0
pop ebx
push ecx
mov ecx, dword [ebp + 8]
push 0x104b420e
push 0x104b4201
call fcn.1001a620
mov eax, dword [ebp + 8]
pop esi
mov esp, ebp
pop ebp
ret 4

Function at 0x101a9110
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
cmp byte [0x104b40b0], 0
push esi
jne 0x101a9170
mov byte [0x104b40b0], 1
xor eax, eax
push ebx
nop word [eax + eax]
xor esi, esi
mov ebx, eax
xor esi, dword [0x104b40c4]
xor ebx, dword [0x104b40c0]
xor esi, 0xd28f2c5
xor ebx, 0x1de26cd5
mov edx, esi
mov ecx, ebx
shld edx, ecx, 0xd
shl ecx, 0xd
xor esi, edx
xor ebx, ecx
mov ecx, ebx
shrd ecx, esi, 7
xor cl, bl
xor byte [eax + 0x104b40b1], cl
inc eax
cmp eax, 0xc
jb 0x101a9130
pop ebx
push ecx
mov ecx, dword [ebp + 8]
push 0x104b40bc
push 0x104b40b1
call fcn.1001a620
mov eax, dword [ebp + 8]
pop esi
mov esp, ebp
pop ebp
ret 4

Function at 0x101a9790
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
cmp byte [0x104b3ad0], 0
push esi
jne 0x101a97f0
mov byte [0x104b3ad0], 1
xor eax, eax
push ebx
nop word [eax + eax]
xor esi, esi
mov ebx, eax
xor esi, dword [0x104b3ae4]
xor ebx, dword [0x104b3ae0]
xor esi, 0xd28f2c5
xor ebx, 0x1de26cd5
mov edx, esi
mov ecx, ebx
shld edx, ecx, 0xd
shl ecx, 0xd
xor esi, edx
xor ebx, ecx
mov ecx, ebx
shrd ecx, esi, 7
xor cl, bl
xor byte [eax + 0x104b3ad1], cl
inc eax
cmp eax, 0xd
jb 0x101a97b0
pop ebx
push ecx
mov ecx, dword [ebp + 8]
push 0x104b3add
push 0x104b3ad1
call fcn.1001a620
mov eax, dword [ebp + 8]
pop esi
mov esp, ebp
pop ebp
ret 4

Function at 0x101a9b60
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
cmp byte [0x104b2850], 0
push esi
jne 0x101a9bc0
mov byte [0x104b2850], 1
xor eax, eax
push ebx
nop word [eax + eax]
xor esi, esi
mov ebx, eax
xor esi, dword [0x104b2864]
xor ebx, dword [0x104b2860]
xor esi, 0xd28f2c5
xor ebx, 0x1de26cd5
mov edx, esi
mov ecx, ebx
shld edx, ecx, 0xd
shl ecx, 0xd
xor esi, edx
xor ebx, ecx
mov ecx, ebx
shrd ecx, esi, 7
xor cl, bl
xor byte [eax + 0x104b2851], cl
inc eax
cmp eax, 0xc
jb 0x101a9b80
pop ebx
push ecx
mov ecx, dword [ebp + 8]
push 0x104b285c
push 0x104b2851
call fcn.1001a620
mov eax, dword [ebp + 8]
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x101aa790
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
cmp byte [0x104b3bc0], 0
push esi
jne 0x101aa7f0
mov byte [0x104b3bc0], 1
xor eax, eax
push ebx
nop word [eax + eax]
xor esi, esi
mov ebx, eax
xor esi, dword [0x104b3bd4]
xor ebx, dword [0x104b3bd0]
xor esi, 0xd28f2c5
xor ebx, 0x1de26cd5
mov edx, esi
mov ecx, ebx
shld edx, ecx, 0xd
shl ecx, 0xd
xor esi, edx
xor ebx, ecx
mov ecx, ebx
shrd ecx, esi, 7
xor cl, bl
xor byte [eax + 0x104b3bc1], cl
inc eax
cmp eax, 0xd
jb 0x101aa7b0
pop ebx
push ecx
mov ecx, dword [ebp + 8]
push 0x104b3bcd
push 0x104b3bc1
call fcn.1001a620
mov eax, dword [ebp + 8]
pop esi
mov esp, ebp
pop ebp
ret 4

Function at 0x101aab90
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
cmp byte [0x104b3080], 0
push esi
jne 0x101aabf0
mov byte [0x104b3080], 1
xor eax, eax
push ebx
nop word [eax + eax]
xor esi, esi
mov ebx, eax
xor esi, dword [0x104b3094]
xor ebx, dword [0x104b3090]
xor esi, 0xd28f2c5
xor ebx, 0x1de26cd5
mov edx, esi
mov ecx, ebx
shld edx, ecx, 0xd
shl ecx, 0xd
xor esi, edx
xor ebx, ecx
mov ecx, ebx
shrd ecx, esi, 7
xor cl, bl
xor byte [eax + 0x104b3081], cl
inc eax
cmp eax, 0xb
jb 0x101aabb0
pop ebx
push ecx
mov ecx, dword [ebp + 8]
push 0x104b308b
push 0x104b3081
call fcn.1001a620
mov eax, dword [ebp + 8]
pop esi
mov esp, ebp
pop ebp
ret 4

Function at 0x101aac10
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
cmp byte [0x104b3d70], 0
push esi
jne 0x101aac70
mov byte [0x104b3d70], 1
xor eax, eax
push ebx
nop word [eax + eax]
xor esi, esi
mov ebx, eax
xor esi, dword [0x104b3d84]
xor ebx, dword [0x104b3d80]
xor esi, 0xd28f2c5
xor ebx, 0x1de26cd5
mov edx, esi
mov ecx, ebx
shld edx, ecx, 0xd
shl ecx, 0xd
xor esi, edx
xor ebx, ecx
mov ecx, ebx
shrd ecx, esi, 7
xor cl, bl
xor byte [eax + 0x104b3d71], cl
inc eax
cmp eax, 0xd
jb 0x101aac30
pop ebx
push ecx
mov ecx, dword [ebp + 8]
push 0x104b3d7d
push 0x104b3d71
call fcn.1001a620
mov eax, dword [ebp + 8]
pop esi
mov esp, ebp
pop ebp
ret 4

Function at 0x101ab380
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
cmp byte [0x104b4070], 0
push esi
jne 0x101ab3e0
mov byte [0x104b4070], 1
xor eax, eax
push ebx
nop word [eax + eax]
xor esi, esi
mov ebx, eax
xor esi, dword [0x104b4084]
xor ebx, dword [0x104b4080]
xor esi, 0xd28f2c5
xor ebx, 0x1de26cd5
mov edx, esi
mov ecx, ebx
shld edx, ecx, 0xd
shl ecx, 0xd
xor esi, edx
xor ebx, ecx
mov ecx, ebx
shrd ecx, esi, 7
xor cl, bl
xor byte [eax + 0x104b4071], cl
inc eax
cmp eax, 0xc
jb 0x101ab3a0
pop ebx
push ecx
mov ecx, dword [ebp + 8]
push 0x104b407c
push 0x104b4071
call fcn.1001a620
mov eax, dword [ebp + 8]
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x101abcf0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
cmp byte [0x104b4810], 0
push esi
jne 0x101abd50
mov byte [0x104b4810], 1
xor eax, eax
push ebx
nop word [eax + eax]
xor esi, esi
mov ebx, eax
xor esi, dword [0x104b4824]
xor ebx, dword [0x104b4820]
xor esi, 0xd28f2c5
xor ebx, 0x1de26cd5
mov edx, esi
mov ecx, ebx
shld edx, ecx, 0xd
shl ecx, 0xd
xor esi, edx
xor ebx, ecx
mov ecx, ebx
shrd ecx, esi, 7
xor cl, bl
xor byte [eax + 0x104b4811], cl
inc eax
cmp eax, 0xd
jb 0x101abd10
pop ebx
push ecx
mov ecx, dword [ebp + 8]
push 0x104b481d
push 0x104b4811
call fcn.1001a620
mov eax, dword [ebp + 8]
pop esi
mov esp, ebp
pop ebp
ret 4

Function at 0x101abd70
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
cmp byte [0x104b26b0], 0
push esi
jne 0x101abdd0
mov byte [0x104b26b0], 1
xor eax, eax
push ebx
nop word [eax + eax]
xor esi, esi
mov ebx, eax
xor esi, dword [0x104b26c4]
xor ebx, dword [0x104b26c0]
xor esi, 0xd28f2c5
xor ebx, 0x1de26cd5
mov edx, esi
mov ecx, ebx
shld edx, ecx, 0xd
shl ecx, 0xd
xor esi, edx
xor ebx, ecx
mov ecx, ebx
shrd ecx, esi, 7
xor cl, bl
xor byte [eax + 0x104b26b1], cl
inc eax
cmp eax, 0xb
jb 0x101abd90
pop ebx
push ecx
mov ecx, dword [ebp + 8]
push 0x104b26bb
push 0x104b26b1
call fcn.1001a620
mov eax, dword [ebp + 8]
pop esi
mov esp, ebp
pop ebp
ret 4

Function at 0x101abfd0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
cmp byte [0x104b33d0], 0
push esi
jne 0x101ac030
mov byte [0x104b33d0], 1
xor eax, eax
push ebx
nop word [eax + eax]
xor esi, esi
mov ebx, eax
xor esi, dword [0x104b33e4]
xor ebx, dword [0x104b33e0]
xor esi, 0xd28f2c5
xor ebx, 0x1de26cd5
mov edx, esi
mov ecx, ebx
shld edx, ecx, 0xd
shl ecx, 0xd
xor esi, edx
xor ebx, ecx
mov ecx, ebx
shrd ecx, esi, 7
xor cl, bl
xor byte [eax + 0x104b33d1], cl
inc eax
cmp eax, 0xb
jb 0x101abff0
pop ebx
push ecx
mov ecx, dword [ebp + 8]
push 0x104b33db
push 0x104b33d1
call fcn.1001a620
mov eax, dword [ebp + 8]
pop esi
mov esp, ebp
pop ebp
ret 4

Function at 0x101ac890
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
cmp byte [0x104b37d0], 0
push esi
jne 0x101ac8f0
mov byte [0x104b37d0], 1
xor eax, eax
push ebx
nop word [eax + eax]
xor esi, esi
mov ebx, eax
xor esi, dword [0x104b37e4]
xor ebx, dword [0x104b37e0]
xor esi, 0xd28f2c5
xor ebx, 0x1de26cd5
mov edx, esi
mov ecx, ebx
shld edx, ecx, 0xd
shl ecx, 0xd
xor esi, edx
xor ebx, ecx
mov ecx, ebx
shrd ecx, esi, 7
xor cl, bl
xor byte [eax + 0x104b37d1], cl
inc eax
cmp eax, 0xb
jb 0x101ac8b0
pop ebx
push ecx
mov ecx, dword [ebp + 8]
push 0x104b37db
push 0x104b37d1
call fcn.1001a620
mov eax, dword [ebp + 8]
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x101acac0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
cmp byte [0x104b31a0], 0
push esi
jne 0x101acb20
mov byte [0x104b31a0], 1
xor eax, eax
push ebx
nop word [eax + eax]
xor esi, esi
mov ebx, eax
xor esi, dword [0x104b31b4]
xor ebx, dword [0x104b31b0]
xor esi, 0xd28f2c5
xor ebx, 0x1de26cd5
mov edx, esi
mov ecx, ebx
shld edx, ecx, 0xd
shl ecx, 0xd
xor esi, edx
xor ebx, ecx
mov ecx, ebx
shrd ecx, esi, 7
xor cl, bl
xor byte [eax + 0x104b31a1], cl
inc eax
cmp eax, 0xb
jb 0x101acae0
pop ebx
push ecx
mov ecx, dword [ebp + 8]
push 0x104b31ab
push 0x104b31a1
call fcn.1001a620
mov eax, dword [ebp + 8]
pop esi
mov esp, ebp
pop ebp
ret 4

Function at 0x101acf60
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
cmp byte [0x104b3c00], 0
push esi
jne 0x101acfc0
mov byte [0x104b3c00], 1
xor eax, eax
push ebx
nop word [eax + eax]
xor esi, esi
mov ebx, eax
xor esi, dword [0x104b3c14]
xor ebx, dword [0x104b3c10]
xor esi, 0xd28f2c5
xor ebx, 0x1de26cd5
mov edx, esi
mov ecx, ebx
shld edx, ecx, 0xd
shl ecx, 0xd
xor esi, edx
xor ebx, ecx
mov ecx, ebx
shrd ecx, esi, 7
xor cl, bl
xor byte [eax + 0x104b3c01], cl
inc eax
cmp eax, 0xb
jb 0x101acf80
pop ebx
push ecx
mov ecx, dword [ebp + 8]
push 0x104b3c0b
push 0x104b3c01
call fcn.1001a620
mov eax, dword [ebp + 8]
pop esi
mov esp, ebp
pop ebp
ret 4

Function at 0x101ae200
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
cmp byte [0x104b2eb0], 0
push esi
jne 0x101ae260
mov byte [0x104b2eb0], 1
xor eax, eax
push ebx
nop word [eax + eax]
xor esi, esi
mov ebx, eax
xor esi, dword [0x104b2edc]
xor ebx, dword [0x104b2ed8]
xor esi, 0xd28f2c5
xor ebx, 0x1de26cd5
mov edx, esi
mov ecx, ebx
shld edx, ecx, 0xd
shl ecx, 0xd
xor esi, edx
xor ebx, ecx
mov ecx, ebx
shrd ecx, esi, 7
xor cl, bl
xor byte [eax + 0x104b2eb1], cl
inc eax
cmp eax, 0x24
jb 0x101ae220
pop ebx
push ecx
mov ecx, dword [ebp + 8]
push 0x104b2ed4
push 0x104b2eb1
call fcn.1001a620
mov eax, dword [ebp + 8]
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x101b0e30
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov edx, dword [ebp + 0xc]
mov eax, ecx
push ebx
push esi
push edi
cmp dword [edx + 0x14], 0x10
mov edi, edx
mov ebx, dword [edx + 0x10]
mov dword [ebp - 4], eax
jb 0x101b0e4e
mov edi, dword [edx]
xor ecx, ecx
mov esi, 0x811c9dc5
test ebx, ebx
je 0x101b0e74
nop dword [eax]
movzx eax, byte [ecx + edi]
inc ecx
xor eax, esi
imul esi, eax, 0x1000193
cmp ecx, ebx
jb 0x101b0e60
mov eax, dword [ebp - 4]
push esi
push edx
lea ecx, [ebp - 0xc]
push ecx
mov ecx, eax
call fcn.10070fb0
pop edi
pop esi
pop ebx
mov ecx, dword [eax + 4]
mov eax, dword [ebp + 8]
test ecx, ecx
jne 0x101b0e94
mov ecx, dword [ebp - 4]
mov ecx, dword [ecx + 4]
mov dword [eax], ecx
mov esp, ebp
pop ebp
ret 8
Function at 0x101b3b80
Capabilities:
Access peb ldr_data

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10324555
mov eax, dword fs:[0]
push eax
push ebx
sub esp, 0x40
push esi
push edi
mov eax, dword [0x1043900c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x14], esi
mov dword [ebp - 0x18], 0
mov dword [ebp - 4], 1
sub esp, 0xc
mov eax, esp
mov dword [ebp - 0x28], 0x1010101
mov dword [ebp - 0x24], 0x1010101
mov cl, 1
movq xmm0, qword [ebp - 0x28]
movq qword [eax], xmm0
mov byte [eax + 8], cl
mov ecx, dword [esi + 0x10]
call fcn.101bf150
mov ecx, dword [esi + 0x10]
add esp, 0xc
mov dword [ebp - 0x24], ecx
neg eax
mov dword [ebp - 4], 2
mov edx, dword [ebx + 8]
mov dword [edx], 0xfffffffe
mov dword [edx + 4], ecx
mov edx, eax
mov edi, dword [ecx + 0xc]
call fcn.100f5800
mov ecx, dword [ebp - 0x24]
mov edx, dword [eax]
mov esi, dword [eax + 4]
mov dword [edi], edx
mov dword [edi + 4], esi
mov al, byte [eax + 8]
mov byte [edi + 8], al
add dword [ecx + 0xc], 0x10
call fcn.100f8830
mov ecx, dword [ebx + 8]
mov byte [ebp - 4], 1
mov dword [ebp - 0x18], 4
mov dword [ecx], eax
mov eax, dword [ebp - 0x14]
mov edi, dword [eax + 0x10]
mov esi, dword [edi + 0xc]
sub esi, 0x10
cmp dword [edi + 0x24], esi
jb 0x101b3c6f
push 0
push 0xffffffffffffffff
mov edx, esi
mov ecx, edi
call fcn.10103b90
mov eax, dword [ebp - 0x14]
add esp, 8
mov dword [edi + 0xc], esi
mov esi, dword [eax + 0x10]
mov dword [ebp - 0x28], esi
mov dword [ebp - 0x24], 0
mov dword [ebp - 4], 3
mov edi, dword [ebx + 8]
mov ecx, edi
push esi
call fcn.1006c260
mov ecx, dword [ebx + 0xc]
cmp dword [ecx + 0x14], 0x10
jb 0x101b3c9c
mov ecx, dword [ecx]
mov eax, dword [esi + 0x10]
push ecx
mov ecx, esi
mov eax, dword [eax + 0x28]
mov edx, dword [eax + 0xc]
add edx, 0x10
call fcn.100f63e0
add esp, 4
or edx, 0xffffffff
mov dword [ebp - 4], 4
mov ecx, esi
call fcn.100f59a0
mov eax, dword [ebx + 0x34]
mov ecx, dword [ebx + 0x14]
mov dword [ebp - 4], 0
mov dword [ebp - 0x50], eax
mov eax, dword [ebx + 0x30]
mov dword [ebp - 0x4c], eax
mov eax, dword [ebx + 0x2c]
mov dword [ebp - 0x48], eax
mov eax, dword [ebx + 0x28]
mov dword [ebp - 0x44], eax
mov eax, dword [ebx + 0x24]
mov dword [ebp - 0x40], eax
mov eax, dword [ebx + 0x20]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebx + 0x1c]
mov dword [ebp - 0x38], eax
mov eax, dword [ebx + 0x18]
mov dword [ebp - 0x34], eax
lea eax, [ebp - 0x50]
mov dword [ebp - 0x30], ecx
mov ecx, dword [ebx + 0x10]
push eax
push dword [ebp - 0x23]
mov dword [ebp - 0x2c], ecx
mov ecx, edi
mov dword [ebp - 0x18], 2
call fcn.101b7be0
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret 0x30
Function at 0x101b5be0
Capabilities:
Access peb ldr_data

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10324955
mov eax, dword fs:[0]
push eax
push ebx
sub esp, 0x58
push esi
push edi
mov eax, dword [0x1043900c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x14], esi
mov dword [ebp - 0x18], 0
mov dword [ebp - 4], 1
sub esp, 0xc
mov eax, esp
mov dword [ebp - 0x28], 0x1010101
mov dword [ebp - 0x24], 0x1010101
mov cl, 1
movq xmm0, qword [ebp - 0x28]
movq qword [eax], xmm0
mov byte [eax + 8], cl
mov ecx, dword [esi + 4]
call fcn.101be2e0
mov ecx, dword [esi + 4]
add esp, 0xc
mov dword [ebp - 0x24], ecx
neg eax
mov dword [ebp - 4], 2
mov edx, dword [ebx + 8]
mov dword [edx], 0xfffffffe
mov dword [edx + 4], ecx
mov edx, eax
mov edi, dword [ecx + 0xc]
call fcn.100f5800
mov ecx, dword [ebp - 0x24]
mov edx, dword [eax]
mov esi, dword [eax + 4]
mov dword [edi], edx
mov dword [edi + 4], esi
mov al, byte [eax + 8]
mov byte [edi + 8], al
add dword [ecx + 0xc], 0x10
call fcn.100f8830
mov ecx, dword [ebx + 8]
mov byte [ebp - 4], 1
mov dword [ebp - 0x18], 2
mov dword [ecx], eax
mov eax, dword [ebp - 0x14]
mov edi, dword [eax + 4]
mov esi, dword [edi + 0xc]
sub esi, 0x10
cmp dword [edi + 0x24], esi
jb 0x101b5ccf
push 0
push 0xffffffffffffffff
mov edx, esi
mov ecx, edi
call fcn.10103b90
mov eax, dword [ebp - 0x14]
add esp, 8
mov dword [edi + 0xc], esi
mov esi, dword [eax + 4]
mov dword [ebp - 0x28], esi
mov dword [ebp - 0x24], 0
mov dword [ebp - 4], 3
mov edi, dword [ebx + 8]
mov ecx, edi
push esi
call fcn.1006c260
mov ecx, dword [ebx + 0xc]
cmp dword [ecx + 0x14], 0x10
jb 0x101b5cfc
mov ecx, dword [ecx]
mov eax, dword [esi + 0x10]
push ecx
mov ecx, esi
mov eax, dword [eax + 0x28]
mov edx, dword [eax + 0xc]
add edx, 0x10
call fcn.100f63e0
add esp, 4
or edx, 0xffffffff
mov dword [ebp - 4], 4
mov ecx, esi
call fcn.100f59a0
mov eax, dword [ebx + 0x4c]
mov dword [ebp - 4], 0
mov dword [ebp - 0x68], eax
mov eax, dword [ebx + 0x48]
mov dword [ebp - 0x64], eax
mov eax, dword [ebx + 0x44]
mov dword [ebp - 0x60], eax
mov eax, dword [ebx + 0x40]
mov dword [ebp - 0x5c], eax
mov eax, dword [ebx + 0x3c]
mov ecx, dword [ebx + 0x14]
mov dword [ebp - 0x58], eax
mov eax, dword [ebx + 0x38]
mov dword [ebp - 0x54], eax
mov eax, dword [ebx + 0x34]
mov dword [ebp - 0x50], eax
mov eax, dword [ebx + 0x30]
mov dword [ebp - 0x4c], eax
mov eax, dword [ebx + 0x2c]
mov dword [ebp - 0x48], eax
mov eax, dword [ebx + 0x28]
mov dword [ebp - 0x44], eax
mov eax, dword [ebx + 0x24]
mov dword [ebp - 0x40], eax
mov eax, dword [ebx + 0x20]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebx + 0x1c]
mov dword [ebp - 0x38], eax
mov eax, dword [ebx + 0x18]
mov dword [ebp - 0x34], eax
lea eax, [ebp - 0x68]
mov dword [ebp - 0x30], ecx
mov ecx, dword [ebx + 0x10]
push eax
push dword [ebp - 0x23]
mov dword [ebp - 0x2c], ecx
mov ecx, edi
mov dword [ebp - 0x18], 1
call fcn.101b7a50
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret 0x48
Function at 0x101b5dc0
Capabilities:
Access peb ldr_data

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x103249c5
mov eax, dword fs:[0]
push eax
push ebx
sub esp, 0x48
push esi
push edi
mov eax, dword [0x1043900c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x14], esi
mov dword [ebp - 0x18], 0
mov dword [ebp - 4], 1
sub esp, 0xc
mov eax, esp
mov dword [ebp - 0x28], 0x1010101
mov dword [ebp - 0x24], 0x1010101
mov cl, 1
movq xmm0, qword [ebp - 0x28]
movq qword [eax], xmm0
mov byte [eax + 8], cl
mov ecx, dword [esi + 4]
call fcn.101bfd50
mov ecx, dword [esi + 4]
add esp, 0xc
mov dword [ebp - 0x24], ecx
neg eax
mov dword [ebp - 4], 2
mov edx, dword [ebx + 8]
mov dword [edx], 0xfffffffe
mov dword [edx + 4], ecx
mov edx, eax
mov edi, dword [ecx + 0xc]
call fcn.100f5800
mov ecx, dword [ebp - 0x24]
mov edx, dword [eax]
mov esi, dword [eax + 4]
mov dword [edi], edx
mov dword [edi + 4], esi
mov al, byte [eax + 8]
mov byte [edi + 8], al
add dword [ecx + 0xc], 0x10
call fcn.100f8830
mov ecx, dword [ebx + 8]
mov byte [ebp - 4], 1
mov dword [ebp - 0x18], 2
mov dword [ecx], eax
mov eax, dword [ebp - 0x14]
mov edi, dword [eax + 4]
mov esi, dword [edi + 0xc]
sub esi, 0x10
cmp dword [edi + 0x24], esi
jb 0x101b5eaf
push 0
push 0xffffffffffffffff
mov edx, esi
mov ecx, edi
call fcn.10103b90
mov eax, dword [ebp - 0x14]
add esp, 8
mov dword [edi + 0xc], esi
mov esi, dword [eax + 4]
mov dword [ebp - 0x28], esi
mov dword [ebp - 0x24], 0
mov dword [ebp - 4], 3
mov edi, dword [ebx + 8]
mov ecx, edi
push esi
call fcn.1006c260
mov ecx, dword [ebx + 0xc]
cmp dword [ecx + 0x14], 0x10
jb 0x101b5edc
mov ecx, dword [ecx]
mov eax, dword [esi + 0x10]
push ecx
mov ecx, esi
mov eax, dword [eax + 0x28]
mov edx, dword [eax + 0xc]
add edx, 0x10
call fcn.100f63e0
add esp, 4
or edx, 0xffffffff
mov dword [ebp - 4], 4
mov ecx, esi
call fcn.100f59a0
mov eax, dword [ebx + 0x3c]
mov dword [ebp - 4], 0
mov ecx, dword [ebx + 0x14]
mov dword [ebp - 0x58], eax
mov eax, dword [ebx + 0x38]
mov dword [ebp - 0x54], eax
mov eax, dword [ebx + 0x34]
mov dword [ebp - 0x50], eax
mov eax, dword [ebx + 0x30]
mov dword [ebp - 0x4c], eax
mov eax, dword [ebx + 0x2c]
mov dword [ebp - 0x48], eax
mov eax, dword [ebx + 0x28]
mov dword [ebp - 0x44], eax
mov eax, dword [ebx + 0x24]
mov dword [ebp - 0x40], eax
mov eax, dword [ebx + 0x20]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebx + 0x1c]
mov dword [ebp - 0x38], eax
mov eax, dword [ebx + 0x18]
mov dword [ebp - 0x34], eax
lea eax, [ebp - 0x58]
mov dword [ebp - 0x30], ecx
mov ecx, dword [ebx + 0x10]
push eax
push dword [ebp - 0x23]
mov dword [ebp - 0x2c], ecx
mov ecx, edi
mov dword [ebp - 0x18], 1
call fcn.101b7fa0
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret 0x38
Function at 0x101b8920
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x103153b0
mov eax, dword fs:[0]
push eax
push ebx
push esi
push edi
mov eax, dword [0x1043900c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ecx, dword [ebp + 8]
mov edi, dword [ecx + 4]
push edi
mov dword [ebp - 4], 0
call fcn.1003b090
mov esi, eax
mov ecx, edi
mov edx, esi
neg edx
call fcn.100f5f40
not esi
mov ecx, edi
mov edx, esi
mov ebx, eax
call fcn.100f59a0
movzx ecx, bl
xor ecx, 0x811c9dc5
imul edx, ecx, 0x1000193
mov ecx, ebx
shr ecx, 8
movzx eax, cl
xor edx, eax
mov eax, ebx
imul ecx, edx, 0x1000193
shr eax, 0x10
movzx eax, al
shr ebx, 0x18
xor ecx, eax
imul eax, ecx, 0x1000193
xor eax, ebx
imul eax, eax, 0x1000193
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4