joyce8/EMBER2024-capa huggingface dataset:
Function at 0x436cf0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov eax, dword [esp + 4]
cmp dword [eax + 0x14], 0x10
jb 0x436cfe
mov ecx, dword [eax]
jmp 0x436d00
mov ecx, eax
mov edx, dword [eax + 0x10]
add edx, ecx
mov eax, 0x811c9dc5
cmp ecx, edx
je 0x436d21
push esi
nop
movsx esi, byte [ecx]
imul eax, eax, 0x1000193
inc ecx
xor eax, esi
cmp ecx, edx
jne 0x436d10
pop esi
and eax, 0x7fffffff
push 0x1f31d
push eax
call fcn.0053fbfe
imul eax, eax, 0xb14
imul edx, edx, 0x41a7
add esp, 8
sub edx, eax
mov eax, edx
jns 0x436d4b
add eax, 0x7fffffff
ret 4

Function at 0x519ba1
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov edi, edi
push esi
mov esi, ecx
call fcn.00447bd0
call fcn.0043fa00
cmp eax, esi
pop esi
jne 0x519bbd
mov ecx, 0x5ca210
jmp fcn.00456b13
ret
Function at 0x1001e150
Capabilities:
Encode data using xor

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100dbdab
mov eax, dword fs:[0]
push eax
push ebx
sub esp, 0x3c
push esi
mov eax, dword [0x100f5008]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov eax, dword [0x10107268]
test al, 1
jne 0x1001e29b
or eax, 1
mov dword [0x10107268], eax
mov dword [ebp - 4], 0
mov eax, 0x10
movaps xmm0, xmmword [0x100ea3d0]
pxor xmm0, xmmword [0x100e9f40]
mov dword [ebp - 0x20], 0x8c938c93
mov dword [ebp - 0x1c], 0xea8cee94
mov word [ebp - 0x18], 0xac9d
movups xmmword [ebp - 0x30], xmm0
xor byte [ebp + eax - 0x30], 0xac
inc eax
cmp eax, 0x1a
jb 0x1001e1d4
xorps xmm0, xmm0
mov dword [ebp - 0x38], 0
lea ecx, [ebp - 0x30]
mov dword [ebp - 0x34], 0
movups xmmword [ebp - 0x48], xmm0
lea edx, [ecx + 1]
nop word [eax + eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x1001e200
sub ecx, edx
lea eax, [ebp - 0x30]
push ecx
push eax
lea ecx, [ebp - 0x48]
call fcn.10026020
mov byte [ebp - 4], 1
mov edx, dword [0x10123304]
test edx, edx
je 0x1001e229
mov edx, dword [edx + 0x50]
jmp 0x1001e22b
xor edx, edx
mov eax, dword [0x101232fc]
test eax, eax
je 0x1001e239
mov eax, dword [eax + 0x18]
jmp 0x1001e23b
xor eax, eax
lea ecx, [ebp - 0x48]
push ecx
push eax
lea ecx, [ebp - 0x14]
call fcn.1001dc50
mov eax, dword [ebp - 0x14]
add esp, 8
mov byte [ebp - 4], 0
mov ecx, dword [ebp - 0x34]
mov dword [0x10107260], eax
cmp ecx, 0x10
jb 0x1001e292
mov edx, dword [ebp - 0x48]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x1001e283
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x1001e283
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push ecx
push edx
call fcn.100d9f61
mov eax, dword [0x10107260]
add esp, 8
mov dword [ebp - 4], 0xffffffff
jmp 0x1001e2a0
mov eax, dword [0x10107260]
test eax, eax
je 0x1001e2a8
mov ecx, esi
call eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret
Function at 0x1002ac90
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [0x100f5008]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebp + 0xc]
movss xmm3, dword [0x100e9ad4]
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x18], eax
movzx eax, cl
push esi
push edi
mov edi, dword [ebp + 8]
movd xmm0, eax
mov eax, ecx
shr eax, 8
movzx eax, al
shr ecx, 0x10
cvtdq2ps xmm0, xmm0
movd xmm1, eax
movzx eax, cl
mulss xmm0, xmm3
cvtdq2ps xmm1, xmm1
movd xmm2, eax
mulss xmm1, xmm3
cvtdq2ps xmm2, xmm2
mulss xmm2, xmm3
test edi, edi
je 0x1002ad9e
mov eax, dword [edi]
sub esp, 0xc
mov ecx, edi
mov eax, dword [eax + 0x70]
movss dword [esp + 8], xmm2
movss dword [esp + 4], xmm1
movss dword [esp], xmm0
call eax
mov dword [ebp - 0x10], 0xdac2c988
xor eax, eax
mov dword [ebp - 0xc], 0xd8dccdc1
mov dword [ebp - 8], 0xacd8c2c5
xor byte [ebp + eax - 0x10], 0xac
inc eax
cmp eax, 0xc
jb 0x1002ad27
mov eax, dword [edi]
lea ecx, [ebp - 0x10]
push 1
push 0
push ecx
mov eax, dword [eax + 0x2c]
mov ecx, edi
call eax
mov esi, eax
test esi, esi
je 0x1002adc5
movzx ecx, byte [ebp - 0x16]
sub esp, 0xc
movss xmm1, dword [0x100e9ad4]
mov eax, dword [ebp - 0x1c]
mov edx, dword [esi]
movd xmm0, ecx
cvtdq2ps xmm0, xmm0
movzx ecx, ah
movzx eax, al
mulss xmm0, xmm1
movss dword [esp + 8], xmm0
movd xmm0, ecx
mov ecx, esi
cvtdq2ps xmm0, xmm0
mulss xmm0, xmm1
movss dword [esp + 4], xmm0
movd xmm0, eax
mov eax, dword [edx + 0x2c]
cvtdq2ps xmm0, xmm0
mulss xmm0, xmm1
movss dword [esp], xmm0
call eax
jmp 0x1002adc5
mov ecx, dword [0x10123370]
lea edx, [ebp - 0x14]
movss dword [ebp - 0x14], xmm0
movss dword [ebp - 0x10], xmm1
movss dword [ebp - 0xc], xmm2
mov dword [ebp - 8], 0x3f800000
mov eax, dword [ecx]
push edx
mov eax, dword [eax + 0x18]
call eax
mov eax, dword [edi]
mov ecx, edi
mov esi, dword [ebp + 0x14]
push esi
push 0x400
mov eax, dword [eax + 0x74]
call eax
mov eax, dword [edi]
mov ecx, edi
push esi
push 0x4000
mov eax, dword [eax + 0x74]
call eax
mov eax, dword [edi]
mov ecx, edi
push esi
push 0x8000
mov eax, dword [eax + 0x74]
call eax
mov ecx, dword [0x10123380]
push 0
push 0
push edi
mov eax, dword [ecx]
mov eax, dword [eax + 0x84]
call eax
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.100d9ae6
mov esp, ebp
pop ebp
ret 0x10
Function at 0x1002cf60
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x100f5008]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, ecx
cmp dword [esi + 0x38], 0
je 0x1002d01c
cmp byte [esi + 0x3d], 0
je 0x1002d01c
mov eax, dword [esi]
push edi
push 0xffffffffffffffff
call dword [eax + 0xc]
cmp eax, 0xffffffff
je 0x1002d00a
mov ecx, dword [esi + 0x38]
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [esi + 0x40]
push eax
call dword [sym.imp.MSVCP140.dll_public:_int___thiscall_std::codecvt_char__char__struct__Mbstatet_::unshift_struct__Mbstatet___char___char___char___const]
sub eax, 0
je 0x1002cfd1
sub eax, 1
je 0x1002cfd5
sub eax, 2
jne 0x1002d00a
mov byte [esi + 0x3d], al
mov al, 1
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100d9ae6
mov esp, ebp
pop ebp
ret
mov byte [esi + 0x3d], 0
mov edi, dword [ebp - 0x28]
lea eax, [ebp - 0x24]
sub edi, eax
je 0x1002cff3
push dword [esi + 0x4c]
push edi
push 1
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
add esp, 0x10
cmp edi, eax
jne 0x1002d00a
cmp byte [esi + 0x3d], 0
pop edi
sete al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100d9ae6
mov esp, ebp
pop ebp
ret
pop edi
xor al, al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100d9ae6
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
mov al, 1
xor ecx, ebp
pop esi
call fcn.100d9ae6
mov esp, ebp
pop ebp
ret
Function at 0x1002f100
Capabilities:
Encode data using xor

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100dc696
mov eax, dword fs:[0]
push eax
push ebx
sub esp, 0x40
mov eax, dword [0x100f5008]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 4], 0
mov eax, dword [0x101293f0]
test al, 1
jne 0x1002f241
or eax, 1
mov dword [0x101293f0], eax
mov byte [ebp - 4], 1
mov eax, 0x10
movaps xmm0, xmmword [0x100ea3d0]
pxor xmm0, xmmword [0x100ea130]
mov dword [ebp - 0x3c], 0x95ea8cee
mov dword [ebp - 0x38], 0x8ceaea8c
mov word [ebp - 0x34], 0x999d
mov byte [ebp - 0x32], 0xac
movups xmmword [ebp - 0x4c], xmm0
nop dword [eax]
xor byte [ebp + eax - 0x4c], 0xac
inc eax
cmp eax, 0x1b
jb 0x1002f190
xorps xmm0, xmm0
mov dword [ebp - 0x20], 0
lea ecx, [ebp - 0x4c]
mov dword [ebp - 0x1c], 0
movups xmmword [ebp - 0x30], xmm0
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x1002f1b6
sub ecx, edx
lea eax, [ebp - 0x4c]
push ecx
push eax
lea ecx, [ebp - 0x30]
call fcn.10026020
mov byte [ebp - 4], 2
mov edx, dword [0x1012331c]
test edx, edx
je 0x1002f1df
mov edx, dword [edx + 0x50]
jmp 0x1002f1e1
xor edx, edx
mov eax, dword [0x10123314]
test eax, eax
je 0x1002f1ef
mov eax, dword [eax + 0x18]
jmp 0x1002f1f1
xor eax, eax
lea ecx, [ebp - 0x30]
push ecx
push eax
lea ecx, [ebp - 0x18]
call fcn.1001dc50
mov eax, dword [ebp - 0x18]
add esp, 8
mov byte [ebp - 4], 1
mov ecx, dword [ebp - 0x1c]
mov dword [0x101293ec], eax
cmp ecx, 0x10
jb 0x1002f23d
mov edx, dword [ebp - 0x30]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x1002f233
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x1002f28c
push ecx
push edx
call fcn.100d9f61
add esp, 8
mov byte [ebp - 4], 0
cmp dword [ebx + 0x1c], 0x10
lea ecx, [ebx + 8]
lea edx, [ebp - 0x18]
mov dword [ebp - 0x18], 0x65656863
cmovae ecx, dword [ebx + 8]
mov word [ebp - 0x14], 0x6573
mov byte [ebp - 0x12], 0
call dword [0x101293ec]
mov ecx, dword [ebx + 0x1c]
cmp ecx, 0x10
jb 0x1002f29c
mov edx, dword [ebx + 8]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x1002f292
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x1002f292
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push ecx
push edx
call fcn.100d9f61
add esp, 8
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret 0x18
Function at 0x1002f2b0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
cmp byte [0x10104dcc], 0
push ebx
push esi
push edi
je 0x1002f43e
mov ecx, dword [0x1012334c]
mov eax, dword [ecx]
mov eax, dword [eax + 0x68]
call eax
test al, al
je 0x1002f43e
mov ecx, dword [0x101233d4]
xor ebx, ebx
mov dword [ebp - 4], ecx
mov eax, dword [ecx + 0x28]
mov dword [ebp - 8], eax
test eax, eax
je 0x1002f43e
mov eax, dword [ecx + 0x1c]
mov ecx, dword [eax + ebx*4]
mov eax, dword [ecx]
mov eax, dword [eax + 0x30]
call eax
mov esi, eax
mov edi, 0x811c9dc5
xor ecx, ecx
nop word [eax + eax]
inc ecx
cmp byte [ecx + esi], 0
jne 0x1002f310
xor edx, edx
test ecx, ecx
je 0x1002f339
nop dword [eax]
movsx eax, byte [edx + esi]
inc edx
xor eax, edi
imul edi, eax, 0x1000193
cmp edx, ecx
jb 0x1002f320
cmp edi, 0x5ff56dc5
je 0x1002f348
inc ebx
cmp ebx, dword [ebp - 8]
jae 0x1002f43e
mov ecx, dword [ebp - 4]
jmp 0x1002f2f4
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x1c]
mov edi, dword [eax + ebx*4]
test edi, edi
je 0x1002f43e
mov edx, dword [edi + 0x88]
test edx, edx
je 0x1002f43e
movss xmm1, dword [0x100e9be0]
xor ebx, ebx
cmp edx, 4
jl 0x1002f40b
mov ecx, dword [edi + 0x7c]
lea esi, [edx - 4]
shr esi, 2
add ecx, 0x1078
inc esi
lea ebx, [esi*4]
movss xmm0, dword [ecx - 0xc60]
ucomiss xmm0, xmm1
lahf
test ah, 0x44
jp 0x1002f3ac
mov dword [ecx - 0xc60], 0x7f7fffff
movss xmm0, dword [ecx - 0x840]
ucomiss xmm0, xmm1
lahf
test ah, 0x44
jp 0x1002f3c7
mov dword [ecx - 0x840], 0x7f7fffff
movss xmm0, dword [ecx - 0x420]
ucomiss xmm0, xmm1
lahf
test ah, 0x44
jp 0x1002f3e2
mov dword [ecx - 0x420], 0x7f7fffff
movss xmm0, dword [ecx]
ucomiss xmm0, xmm1
lahf
test ah, 0x44
jp 0x1002f3f5
mov dword [ecx], 0x7f7fffff
add ecx, 0x1080
sub esi, 1
jne 0x1002f391
cmp ebx, edx
jl 0x1002f40f
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
test edx, edx
jle 0x1002f43e
imul ecx, ebx, 0x420
add ecx, 0x418
add ecx, dword [edi + 0x7c]
sub edx, ebx
movss xmm0, dword [ecx]
ucomiss xmm0, xmm1
lahf
test ah, 0x44
jp 0x1002f433
mov dword [ecx], 0x7f7fffff
add ecx, 0x420
sub edx, 1
jne 0x1002f420
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10030e50
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100dc708
mov eax, dword fs:[0]
push eax
push ebx
sub esp, 0x2c
mov eax, dword [0x100f5008]
xor eax, ebp
mov dword [ebp - 0x14], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 4], 0
xorps xmm0, xmm0
movups xmmword [ebp - 0x2c], xmm0
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x18], 0xf
mov byte [ebp - 0x2c], 0
mov byte [ebp - 4], 1
cmp dword [ebx + 0x1c], 0
je 0x10030fa2
cmp dword [ebx + 0x20], 0x10
lea ecx, [ebx + 0x24]
lea eax, [ebx + 0xc]
cmovae eax, dword [ebx + 0xc]
xor edx, edx
push ecx
push eax
xor ecx, ecx
call fcn.1002e7e0
mov ecx, dword [ebp - 0x1c]
mov esi, eax
add esp, 8
cmp esi, ecx
ja 0x10030ef4
cmp dword [ebp - 0x18], 0x10
lea ecx, [ebp - 0x2c]
mov dword [ebp - 0x1c], esi
cmovae ecx, dword [ebp - 0x2c]
mov byte [ecx + esi], 0
jmp 0x10030f01
sub eax, ecx
lea ecx, [ebp - 0x2c]
push 0
push eax
call fcn.10031d70
cmp dword [ebx + 0x20], 0x10
lea eax, [ebx + 0xc]
lea edx, [ebx + 0x24]
cmovae eax, dword [ebx + 0xc]
lea ecx, [ebp - 0x2c]
cmp dword [ebp - 0x18], 0x10
push edx
cmovae ecx, dword [ebp - 0x2c]
lea edx, [esi + 1]
push eax
call fcn.1002e7e0
mov eax, dword [0x10123348]
lea edx, [ebp - 0x38]
push edx
push 0x101237f8
push eax
mov ecx, dword [eax]
mov dword [ebp - 0x38], 0x6568635b
mov dword [ebp - 0x34], 0x5d657365
mov word [ebp - 0x30], 0x20
mov eax, dword [ecx + 0x64]
call eax
mov eax, dword [0x10123348]
lea edx, [ebp - 0x2c]
add esp, 0x14
cmp dword [ebp - 0x18], 0x10
cmovae edx, dword [ebp - 0x2c]
mov ecx, dword [eax]
push edx
push 0x100f501c
push eax
mov eax, dword [ecx + 0x64]
call eax
mov ecx, dword [ebp - 0x18]
add esp, 0xc
cmp ecx, 0x10
jb 0x10030fa2
mov edx, dword [ebp - 0x2c]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x10030f98
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x10030fda
push ecx
push edx
call fcn.100d9f61
add esp, 8
mov ecx, dword [ebx + 0x20]
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x18], 0xf
mov byte [ebp - 0x2c], 0
cmp ecx, 0x10
jb 0x10030fea
mov edx, dword [ebx + 0xc]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x10030fe0
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x10030fe0
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push ecx
push edx
call fcn.100d9f61
add esp, 8
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.100d9ae6
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret
Function at 0x10031840
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100dc795
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push ebx
push esi
push edi
mov eax, dword [0x100f5008]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
movzx eax, byte [esi]
xor eax, 0x811c9dc5
imul ecx, eax, 0x1000193
movzx eax, byte [esi + 1]
xor ecx, eax
movzx eax, byte [esi + 2]
imul ecx, ecx, 0x1000193
xor ecx, eax
movzx eax, byte [esi + 3]
imul ecx, ecx, 0x1000193
xor ecx, eax
lea eax, [ebp - 0x14]
imul edi, ecx, 0x1000193
push edi
push esi
push eax
call fcn.10032820
mov eax, dword [ebp - 0x10]
test eax, eax
jne 0x1003196b
cmp dword [0x101292b0], 0xfffffff
jne 0x100318ca
push str.unordered_map_set_too_long
call dword [sym.imp.MSVCP140.dll_void___cdecl_std::_Xlength_error_char_const__]
mov dword [ebp - 0x1c], 0x101292ac
mov dword [ebp - 4], 0
push 0x10
mov dword [ebp - 0x18], 0
call fcn.100d9b02
mov ebx, eax
add esp, 4
mov eax, dword [esi]
mov dword [ebp - 0x18], ebx
mov dword [ebx + 8], eax
mov dword [ebx + 0xc], 0
mov dword [ebp - 4], 1
mov eax, dword [0x101292b0]
inc eax
movd xmm0, eax
cvtdq2pd xmm0, xmm0
shr eax, 0x1f
addsd xmm0, qword [eax*8 + 0x100e9e50]
mov eax, dword [0x101292c4]
cvtpd2ps xmm1, xmm0
movd xmm0, eax
cvtdq2pd xmm0, xmm0
shr eax, 0x1f
addsd xmm0, qword [eax*8 + 0x100e9e50]
cvtpd2ps xmm0, xmm0
divss xmm1, xmm0
comiss xmm1, dword [0x101292a8]
jbe 0x10031960
call fcn.100324f0
push edi
lea eax, [ebx + 8]
push eax
lea eax, [ebp - 0x1c]
push eax
call fcn.10032820
mov ecx, dword [eax]
jmp 0x10031963
mov ecx, dword [ebp - 0x14]
push ebx
push ecx
push edi
call fcn.10032570
add eax, 0xc
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x10031be0
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
sub esp, 0x18
mov edx, dword [ebp + 8]
push ebx
mov ebx, ecx
cmp edx, eax
je 0x10031d36
mov eax, dword [ebx + 4]
mov dword [ebp - 0x14], eax
mov eax, dword [edx + 4]
mov dword [ebp - 8], eax
movzx eax, byte [edx + 8]
xor eax, 0x811c9dc5
imul ecx, eax, 0x1000193
movzx eax, byte [edx + 9]
push esi
push edi
mov edi, dword [ebx + 0xc]
mov esi, edx
xor ecx, eax
mov dword [ebp - 0x18], edi
movzx eax, byte [edx + 0xa]
imul ecx, ecx, 0x1000193
xor ecx, eax
movzx eax, byte [edx + 0xb]
imul ecx, ecx, 0x1000193
xor ecx, eax
mov eax, dword [ebx + 0x18]
imul ecx, ecx, 0x1000193
and eax, ecx
mov ecx, dword [edi + eax*8]
mov dword [ebp - 4], ecx
lea eax, [edi + eax*8]
mov dword [ebp - 0xc], eax
mov eax, dword [eax + 4]
mov dword [ebp - 0x10], eax
mov eax, esi
mov edi, esi
mov esi, dword [esi]
push 0x10
push eax
call fcn.100d9f61
dec dword [ebx + 8]
add esp, 8
cmp edi, dword [ebp - 0x10]
je 0x10031c99
mov eax, dword [ebp + 0xc]
cmp esi, eax
jne 0x10031c57
mov ecx, dword [ebp - 4]
cmp ecx, dword [ebp + 8]
jne 0x10031d2c
mov edx, dword [ebp - 0xc]
mov ecx, dword [ebp - 8]
pop edi
mov dword [edx], esi
mov dword [ecx], esi
mov dword [esi + 4], ecx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
mov ecx, dword [ebp - 4]
mov edx, dword [ebp - 0xc]
cmp ecx, dword [ebp + 8]
jne 0x10031cad
mov eax, dword [ebp - 0x14]
mov ecx, eax
mov dword [edx], eax
jmp 0x10031cb0
mov ecx, dword [ebp - 8]
mov eax, dword [ebp + 0xc]
mov dword [edx + 4], ecx
cmp esi, eax
je 0x10031d2c
nop word [eax + eax]
movzx eax, byte [esi + 8]
xor eax, 0x811c9dc5
imul ecx, eax, 0x1000193
movzx eax, byte [esi + 9]
xor ecx, eax
movzx eax, byte [esi + 0xa]
imul ecx, ecx, 0x1000193
xor ecx, eax
movzx eax, byte [esi + 0xb]
imul ecx, ecx, 0x1000193
xor ecx, eax
imul eax, ecx, 0x1000193
mov ecx, dword [ebx + 0x18]
and ecx, eax
mov eax, dword [ebp - 0x18]
lea eax, [eax + ecx*8]
mov dword [ebp - 4], eax
mov eax, dword [eax + 4]
mov dword [ebp - 0x10], eax
mov eax, esi
mov edi, esi
mov esi, dword [esi]
push 0x10
push eax
call fcn.100d9f61
dec dword [ebx + 8]
add esp, 8
mov eax, dword [ebp + 0xc]
cmp edi, dword [ebp - 0x10]
je 0x10031d3d
cmp esi, eax
jne 0x10031d07
mov ecx, dword [ebp - 4]
mov dword [ecx], esi
mov ecx, dword [ebp - 8]
pop edi
mov dword [ecx], esi
mov dword [esi + 4], ecx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
mov ecx, dword [ebp - 4]
mov edx, dword [ebp - 0x14]
mov dword [ecx], edx
mov dword [ecx + 4], edx
cmp esi, eax
jne 0x10031cc0
mov ecx, dword [ebp - 8]
pop edi
mov dword [ecx], esi
mov dword [esi + 4], ecx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x100325e0
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1fffffff
sub esp, 0x10
bsr ecx, eax
push ebx
push esi
push edi
mov edi, 1
mov eax, edi
shl eax, cl
mov ecx, dword [ebp + 8]
cmp ecx, eax
jbe 0x1003260c
push str.invalid_hash_bucket_count
call dword [sym.imp.MSVCP140.dll_void___cdecl_std::_Xlength_error_char_const__]
lea eax, [ecx - 1]
mov esi, dword [0x101292ac]
or eax, 1
mov dword [ebp - 8], esi
bsr ecx, eax
push esi
lea ecx, [ecx + 1]
shl edi, cl
mov ecx, 0x101292b4
lea eax, [edi + edi]
push eax
call fcn.10031ef0
mov eax, dword [0x101292ac]
lea ebx, [edi - 1]
mov dword [0x101292c0], ebx
mov dword [0x101292c4], edi
mov eax, dword [eax]
mov ecx, eax
cmp eax, esi
je 0x10032746
movzx edx, byte [eax + 8]
xor edx, 0x811c9dc5
mov ecx, dword [ecx]
imul edi, edx, 0x1000193
movzx edx, byte [eax + 9]
xor edi, edx
movzx edx, byte [eax + 0xa]
imul edi, edi, 0x1000193
xor edi, edx
movzx edx, byte [eax + 0xb]
imul edi, edi, 0x1000193
xor edi, edx
mov edx, dword [0x101292b4]
imul edi, edi, 0x1000193
and edi, ebx
mov ebx, dword [edx + edi*8]
lea edx, [edx + edi*8]
mov dword [ebp - 0xc], edx
cmp ebx, esi
jne 0x100326a4
mov dword [edx], eax
mov dword [edx + 4], eax
jmp 0x10032711
mov edx, dword [edx + 4]
mov edi, dword [eax + 8]
cmp edi, dword [edx + 8]
jne 0x100326de
mov edx, dword [edx]
mov dword [ebp - 4], edx
cmp edx, eax
je 0x100326d6
mov ebx, dword [eax + 4]
mov esi, dword [ebp - 4]
mov dword [ebx], ecx
mov edi, dword [ecx + 4]
mov dword [edi], edx
mov edx, dword [edx + 4]
mov dword [edx], eax
mov dword [esi + 4], edi
mov esi, dword [ebp - 8]
mov dword [ecx + 4], ebx
mov dword [eax + 4], edx
mov edx, dword [ebp - 0xc]
mov dword [edx + 4], eax
jmp 0x10032711
cmp ebx, edx
je 0x100326ee
mov edx, dword [edx + 4]
cmp edi, dword [edx + 8]
je 0x10032722
cmp ebx, edx
jne 0x100326e2
mov ebx, dword [eax + 4]
mov dword [ebp - 4], ebx
mov dword [ebx], ecx
mov ebx, dword [ecx + 4]
mov dword [ebx], edx
mov edi, dword [edx + 4]
mov dword [edi], eax
mov dword [edx + 4], ebx
mov edx, dword [ebp - 4]
mov dword [ecx + 4], edx
mov edx, dword [ebp - 0xc]
mov dword [eax + 4], edi
mov dword [edx], eax
mov eax, ecx
cmp ecx, esi
je 0x10032746
mov ebx, dword [0x101292c0]
jmp 0x10032652
mov ebx, dword [eax + 4]
mov edx, dword [edx]
mov dword [ebp - 4], edx
mov esi, edx
mov dword [ebx], ecx
mov edi, dword [ecx + 4]
mov dword [edi], edx
mov edx, dword [edx + 4]
mov dword [edx], eax
mov dword [esi + 4], edi
mov esi, dword [ebp - 8]
mov dword [ecx + 4], ebx
mov dword [eax + 4], edx
jmp 0x10032711
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x100341c0
Capabilities:
Encode data using base64

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100dca4e
mov eax, dword fs:[0]
push eax
sub esp, 0x18
push esi
push edi
mov eax, dword [0x100f5008]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x24], edi
mov dword [ebp - 0x1c], 0
xorps xmm0, xmm0
movups xmmword [edi], xmm0
mov dword [edi + 0x10], 0
mov dword [edi + 0x14], 0
mov dword [edi + 0x10], 0
mov dword [edi + 0x14], 0xf
mov byte [edi], 0
mov eax, dword [ebp + 8]
xor esi, esi
mov dword [ebp - 4], 0
mov dword [ebp - 0x1c], 1
test eax, eax
je 0x1003438f
dec eax
mov dword [ebp + 8], eax
mov al, byte [edx]
inc edx
mov byte [ebp + esi - 0x14], al
inc esi
mov ah, byte [ebp - 0x12]
mov ch, byte [ebp - 0x13]
mov cl, byte [ebp - 0x14]
mov dword [ebp - 0x20], edx
mov byte [ebp - 0xf], ah
mov byte [ebp - 0xd], ch
mov byte [ebp - 0xe], cl
cmp esi, 3
jne 0x100342c5
mov al, cl
and cl, 3
shr al, 2
mov byte [ebp - 0x18], al
mov al, ch
shl cl, 4
shr al, 4
add cl, al
mov al, ah
mov byte [ebp - 0x17], cl
and ah, 0x3f
mov cl, ch
shr al, 6
and cl, 0xf
mov byte [ebp - 0x15], ah
shl cl, 2
add cl, al
xor esi, esi
mov byte [ebp - 0x16], cl
nop dword [eax + eax]
cmp dword [0x1011ca1c], 0x10
mov ecx, 0x1011ca08
movzx eax, byte [ebp + esi - 0x18]
cmovae ecx, dword [0x1011ca08]
movzx eax, byte [eax + ecx]
mov ecx, edi
push eax
call fcn.10025a40
inc esi
cmp esi, 4
jl 0x10034290
mov edx, dword [ebp - 0x20]
xor esi, esi
mov ch, byte [ebp - 0xd]
mov cl, byte [ebp - 0xe]
mov eax, dword [ebp + 8]
test eax, eax
jne 0x10034233
mov dword [ebp + 8], esi
test esi, esi
je 0x1003438f
mov eax, esi
cmp esi, 3
jge 0x10034301
cmp eax, 3
jae 0x100343a2
mov byte [ebp + eax - 0x14], 0
inc eax
cmp eax, 3
jl 0x100342e5
mov dl, byte [ebp - 0x12]
mov ch, byte [ebp - 0x13]
mov cl, byte [ebp - 0x14]
jmp 0x10034304
mov dl, byte [ebp - 0xf]
mov al, cl
and cl, 3
shr al, 2
mov byte [ebp - 0x18], al
mov al, ch
shr al, 4
and ch, 0xf
shl cl, 4
add cl, al
shl ch, 2
mov al, dl
mov byte [ebp - 0x17], cl
shr al, 6
and dl, 0x3f
add ch, al
mov byte [ebp - 0x15], dl
lea eax, [esi + 1]
mov byte [ebp - 0x16], ch
mov dword [ebp - 0x20], eax
test eax, eax
jle 0x1003436d
xor esi, esi
nop
cmp dword [0x1011ca1c], 0x10
mov ecx, 0x1011ca08
movzx eax, byte [ebp + esi - 0x18]
cmovae ecx, dword [0x1011ca08]
movzx eax, byte [eax + ecx]
mov ecx, edi
push eax
call fcn.10025a40
inc esi
cmp esi, dword [ebp - 0x20]
jl 0x10034340
mov esi, dword [ebp + 8]
cmp esi, 3
jge 0x1003438f
mov eax, 3
sub eax, esi
mov dword [ebp + 8], eax
nop dword [eax]
push 0x3d
mov ecx, edi
call fcn.10025a40
sub dword [ebp + 8], 1
jne 0x10034380
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
call fcn.100da136
int3