joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10131ac7
Capabilities:
Start service

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push ecx
push ecx
push esi
push edi
mov edi, ecx
push 0
push 0
push dword [edi + 4]
call dword [sym.imp.ADVAPI32.dll_StartServiceW]
mov dword [esp + 0xc], eax
test eax, eax
jne 0x10131b10
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp + 8], eax
cmp eax, 0x420
jne 0x10131b2e
push str.OService::StartService___Service_instance_already_running
push ecx
push 0x64
mov edx, 0x7c1
mov ecx, 0x2541043
call fcn.10129c86
cmp byte [edi + 0x14], 0
je 0x10131b57
mov esi, dword [edi + 0xc]
mov ecx, dword [edi + 8]
mov eax, esi
cmp eax, ecx
je 0x10131b44
add esi, 0xffffffe4
mov ecx, esi
call fcn.10131ac7
jmp 0x10131b19
lea eax, [esp + 8]
push eax
lea eax, [esp + 0x10]
push eax
sub esp, 0xc
call fcn.101317a4
xor al, al
jmp 0x10131b59
mov edx, dword [edi + 0xc]
cmp ecx, edx
je 0x10131b57
push ecx
call fcn.10131947
mov eax, dword [edi + 8]
mov dword [edi + 0xc], eax
mov al, 1
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x10135662
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1014d55d
mov eax, dword fs:[0]
push eax
push ecx
push ecx
push ebx
push esi
push edi
mov eax, dword [0x101fe1c0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x14], edx
mov ebx, ecx
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp dword [0x10207430], eax
je 0x101356a6
mov eax, 0x10dd
jmp 0x10135783
mov eax, dword [0x10207434]
test eax, eax
jne 0x10135783
test ebx, ebx
jne 0x101356bf
push 6
pop eax
jmp 0x10135783
cmp dword [ebx], 0
jne 0x101356d1
push 6
pop eax
mov dword [0x10207434], eax
jmp 0x1013577d
push 0x18
pop ecx
call fcn.1002d160
mov esi, eax
test esi, esi
jne 0x101356e7
push 8
pop edi
jmp 0x1013576a
mov ecx, dword [ebx]
call fcn.1013603d
mov ecx, dword [ebp - 0x14]
mov edi, eax
call fcn.1013603d
movzx ecx, byte [edi + 0x36]
mov edx, eax
mov eax, dword [edi + 0x40]
sub eax, ecx
mov dword [ebp - 0x14], eax
test ecx, ecx
je 0x1013575e
cmp ecx, 0x1e
ja 0x1013575e
cmp dword [edi + 0x44], edx
jne 0x1013575e
and dword [ebp - 0x10], 0
lea edx, [ebp - 0x10]
push edx
push 0x40
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x10135734
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
jmp 0x1013576a
mov eax, dword [ebp - 0x14]
mov dword [esi + 0xc], eax
mov dword [esi + 4], 1
mov dword [esi + 8], ebx
mov dword [esi + 0x10], edi
mov eax, dword [ebp - 0x10]
mov dword [esi + 0x14], eax
mov eax, dword [0x10207414]
mov dword [esi], eax
xor eax, eax
mov dword [0x10207414], esi
jmp 0x10135783
cmp dword [0x10207418], 0
push 9
pop edi
jne 0x10135770
mov dword [0x10207434], edi
test esi, esi
je 0x1013577b
push esi
call fcn.1002b486
pop ecx
mov eax, edi
mov dword [0x10207428], ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
leave
ret
Function at 0x10135793
Capabilities:
Resume thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1014cec5
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x101fe1c0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp dword [0x10207430], eax
je 0x101357d1
mov eax, 0x10dd
jmp 0x1013586b
mov edi, dword [0x10207414]
xor ebx, ebx
test edi, edi
je 0x10135830
lea eax, [ebp - 0x10]
push eax
mov eax, dword [edi + 0x10]
push dword [edi + 0x14]
movzx eax, byte [eax + 0x36]
push eax
push dword [edi + 0xc]
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
cmp dword [edi + 4], ebx
jne 0x10135821
mov esi, dword [edi + 0x10]
test esi, esi
je 0x10135821
push 0x48
push ebx
push esi
call fcn.10035153
mov ecx, esi
add esp, 0xc
and ecx, 0xffff0000
mov eax, dword [ecx + 8]
mov dword [esi + 0x40], eax
mov dword [ecx + 8], esi
mov dword [edi + 0x10], ebx
mov esi, dword [edi]
push edi
call fcn.1002b486
mov edi, esi
pop ecx
test esi, esi
jne 0x101357dd
mov dword [0x10207414], ebx
call fcn.10135ffc
mov edi, dword [0x1020741c]
test edi, edi
je 0x1013585d
push dword [edi + 4]
call dword [sym.imp.KERNEL32.dll_ResumeThread]
mov esi, dword [edi]
push edi
call fcn.1002b486
mov edi, esi
pop ecx
test esi, esi
jne 0x10135845
mov dword [0x1020741c], ebx
xor eax, eax
mov dword [0x10207430], ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
leave
ret
Function at 0x10135b4f
Capabilities:
Suspend thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1014cf31
mov eax, dword fs:[0]
push eax
push ebx
push esi
push edi
mov eax, dword [0x101fe1c0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov eax, dword [0x10207434]
test eax, eax
jne 0x10135bd7
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
cmp ebx, eax
je 0x10135bd5
push 8
pop edi
mov ecx, edi
call fcn.1002d160
mov esi, eax
test esi, esi
je 0x10135bb4
push ebx
call dword [sym.imp.KERNEL32.dll_SuspendThread]
cmp eax, 0xffffffff
jne 0x10135bc5
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
push esi
call fcn.1002b486
pop ecx
and dword [0x10207428], 0
mov eax, edi
mov dword [0x10207434], edi
jmp 0x10135bd7
mov eax, dword [0x1020741c]
mov dword [esi + 4], ebx
mov dword [esi], eax
mov dword [0x1020741c], esi
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
leave
ret

Function at 0x10135be7
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
add edx, 0xffff0000
movzx eax, dx
push ebx
push esi
mov esi, edx
mov ebx, ecx
sub esi, eax
test eax, eax
push edi
cmove esi, edx
jmp 0x10135c70
lea eax, [esi - 0x50000000]
cmp eax, 0x30000000
ja 0x10135c1a
mov esi, 0x4fff0000
jmp 0x10135c70
push 7
pop ecx
xor eax, eax
lea edi, [ebp - 0x1c]
rep stosd dword es:[edi], eax
push 0x1c
lea eax, [ebp - 0x1c]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
je 0x10135c74
mov edi, 0x10000
cmp dword [ebp - 0xc], edi
jne 0x10135c5b
cmp dword [ebp - 0x10], edi
jb 0x10135c5b
push 0x40
push 0x3000
push edi
push esi
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
test eax, eax
jne 0x10135c76
sub esi, edi
jmp 0x10135c70
mov ecx, dword [ebp - 0x18]
add ecx, 0xffff0000
mov esi, ecx
movzx eax, si
sub esi, eax
test eax, eax
cmove esi, ecx
cmp esi, ebx
ja 0x10135c06
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret

Function at 0x10135c7b
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push ebx
push esi
push edi
mov ebx, edx
jmp 0x10135ce2
lea eax, [esi - 0x50000000]
cmp eax, 0x30000000
ja 0x10135c9c
mov esi, 0x80010000
jmp 0x10135ce9
push 7
pop ecx
xor eax, eax
lea edi, [ebp - 0x1c]
rep stosd dword es:[edi], eax
push 0x1c
lea eax, [ebp - 0x1c]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
je 0x10135ced
mov ecx, dword [ebp - 0x10]
mov edi, 0x10000
cmp dword [ebp - 0xc], edi
jne 0x10135cdf
cmp ecx, edi
jb 0x10135cdf
push 0x40
push 0x3000
push edi
push esi
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
test eax, eax
jne 0x10135cef
add esi, edi
jmp 0x10135ce9
add ecx, dword [ebp - 0x1c]
call fcn.10135cf4
mov esi, eax
cmp esi, ebx
jb 0x10135c88
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x10135d07
Capabilities:
Hook routines via microsoft detours

Disassembly:
push ebx
push esi
mov esi, ecx
push edi
lea ebx, [esi - 0x7ff80000]
cmp esi, 0x7ff80000
ja 0x10135d1f
mov ebx, 0x10000
lea edi, [esi + 0x7ff80000]
cmp esi, 0x80000000
jb 0x10135d32
mov edi, 0xfff80000
mov edx, dword [0x1020742c]
mov eax, dword [0x10207424]
test edx, edx
jne 0x10135d4d
test eax, eax
je 0x10135d60
mov edx, eax
mov dword [0x1020742c], edx
mov ecx, dword [edx + 8]
test ecx, ecx
je 0x10135d60
cmp ecx, ebx
jb 0x10135d60
cmp ecx, edi
jbe 0x10135e50
mov edx, eax
mov dword [0x1020742c], edx
test eax, eax
je 0x10135d96
mov ecx, eax
test eax, eax
je 0x10135d85
mov eax, dword [ecx + 8]
test eax, eax
je 0x10135d85
cmp eax, ebx
jb 0x10135d85
cmp eax, edi
jbe 0x10135e50
mov edx, dword [edx + 4]
mov ecx, edx
mov dword [0x1020742c], edx
mov eax, edx
test ecx, ecx
jne 0x10135d6e
and esi, 0xffff0000
cmp esi, 0x40000000
jbe 0x10135dd0
lea ecx, [esi - 0x40000000]
mov edx, esi
call fcn.10135c7b
mov edx, eax
test edx, edx
jne 0x10135e16
lea edx, [esi - 0x40000000]
mov ecx, ebx
call fcn.10135be7
mov edx, eax
test edx, edx
jne 0x10135e16
cmp esi, 0x40000000
jae 0x10135df8
lea edx, [esi + 0x40000000]
mov ecx, esi
call fcn.10135be7
mov edx, eax
test edx, edx
jne 0x10135e16
mov edx, edi
lea ecx, [esi + 0x40000000]
call fcn.10135c7b
mov edx, eax
test edx, edx
jne 0x10135e16
mov edx, esi
mov ecx, ebx
call fcn.10135be7
mov edx, eax
test edx, edx
jne 0x10135e16
mov edx, edi
mov ecx, esi
call fcn.10135c7b
mov edx, eax
test edx, edx
je 0x10135e75
xor ecx, ecx
mov dword [edx], 0x52727464
mov dword [edx + 8], ecx
mov esi, 0x38b
mov eax, dword [0x10207424]
mov dword [edx + 4], eax
lea eax, [edx + 0xffa8]
mov dword [0x1020742c], edx
mov dword [0x10207424], edx
mov dword [eax + 0x40], ecx
mov ecx, eax
sub eax, 0x48
sub esi, 1
jne 0x10135e40
mov dword [edx + 8], ecx
mov esi, dword [edx + 8]
cmp esi, ebx
jb 0x10135e75
cmp esi, edi
ja 0x10135e75
mov ecx, dword [esi + 0x40]
push 0x48
push 0xcc
push esi
mov dword [edx + 8], ecx
call fcn.10035153
add esp, 0xc
mov eax, esi
jmp 0x10135e77
xor eax, eax
pop edi
pop esi
pop ebx
ret

Function at 0x10135f35
Capabilities:
Parse pe header

Disassembly:
push 0x24
push 0x101f7e50
call fcn.100342bd
mov edi, edx
push 0x1c
lea eax, [ebp - 0x34]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
and dword [ebp - 4], 0
mov eax, 0x5a4d
mov ecx, dword [ebp - 0x30]
cmp word [ecx], ax
jne 0x10135fab
mov edx, dword [ecx + 0x3c]
cmp dword [edx + ecx], 0x4550
jne 0x10135fab
mov esi, dword [edx + ecx + 0xd8]
lea eax, [esi + ecx]
cmp edi, eax
jb 0x10135fab
mov eax, dword [edx + ecx + 0xdc]
add eax, esi
add eax, ecx
cmp edi, eax
jae 0x10135fab
mov dword [ebp - 4], 0xfffffffe
mov al, 1
jmp 0x10135fb4
mov dword [ebp - 4], 0xfffffffe
xor al, al
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
leave
ret
Function at 0x10135fc4
Capabilities:
Hook routines via microsoft detours

Disassembly:
cmp dword [ecx], 0x52727464
push esi
jne 0x10135ff8
lea esi, [ecx + 0x10000]
xor eax, eax
lea edx, [ecx + 0x88]
cmp dword [edx], 0
je 0x10135fe8
cmp dword [edx], ecx
jb 0x10135ff8
cmp dword [edx], esi
jae 0x10135ff8
inc eax
add edx, 0x48
cmp eax, 0x38d
jb 0x10135fdb
xor eax, eax
inc eax
pop esi
ret
xor eax, eax
pop esi
ret

Function at 0x10136084
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, dword [0x10207424]
jmp 0x101360a6
lea eax, [ebp - 4]
push eax
push 0x40
push 0x10000
push esi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov esi, dword [esi + 4]
test esi, esi
jne 0x10136091
pop esi
leave
ret

Function at 0x10136d73
Capabilities:
Resume thread
Suspend thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2d4
mov eax, dword [0x101fe1c0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push esi
mov esi, dword [ebp + 8]
mov dword [ebp - 0x2d4], eax
push edi
mov edi, ecx
test esi, esi
jne 0x10136da2
xor eax, eax
inc eax
jmp 0x10136e4f
push ebx
mov ebx, dword [edi + 0x44]
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp eax, ebx
jne 0x10136dcc
mov ecx, esi
call fcn.10138e6c
mov ecx, dword [esi + 4]
sub ecx, dword [esi]
mov edx, dword [ebp - 0x2d4]
sar ecx, 4
mov dword [edx], ecx
jmp 0x10136e4e
mov esi, dword [edi + 0x48]
test esi, esi
jne 0x10136dee
push ebx
push esi
push 0xa
call dword [sym.imp.KERNEL32.dll_OpenThread]
lea ecx, [edi + 0x48]
mov esi, eax
call fcn.1002f3da
mov dword [edi + 0x48], esi
test esi, esi
je 0x10136e4b
push 0x2c8
lea eax, [ebp - 0x2cc]
push 0
push eax
call fcn.10035153
add esp, 0xc
mov dword [ebp - 0x2d0], 0x1003f
push esi
call dword [sym.imp.KERNEL32.dll_SuspendThread]
cmp eax, 0xffffffff
je 0x10136e4b
lea eax, [ebp - 0x2d0]
push eax
push dword [edi + 0x48]
call dword [sym.imp.KERNEL32.dll_GetThreadContext]
mov edx, dword [ebp - 0x2d4]
xor esi, esi
push 4
pop ecx
and dword [edx], 0
cmp eax, 1
push dword [edi + 0x48]
cmove esi, ecx
call dword [sym.imp.KERNEL32.dll_ResumeThread]
mov eax, esi
jmp 0x10136e4e
push 5
pop eax
pop ebx
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.10033218
leave
ret 0xc

Function at 0x10137640
Capabilities:
Hash data using fnv

Disassembly:
push ebx
push esi
mov esi, ecx
mov ecx, 0x84222325
push edi
mov edi, 0xcbf29ce4
test esi, esi
je 0x1013767a
lea ebx, [esi + edx]
jmp 0x10137676
movzx eax, byte [esi]
push 0x100
cdq
push 0x1b3
xor edx, edi
xor eax, ecx
push edx
push eax
call fcn.1003405f
mov ecx, eax
mov edi, edx
inc esi
cmp esi, ebx
jb 0x10137658
mov edx, edi
mov eax, ecx
pop edi
pop esi
pop ebx
ret 8
Function at 0x101393a7
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
mov edi, edx
mov edx, ecx
lea ecx, [eax - 1]
mov dword [ebp - 4], edx
mov ebx, ecx
mov dword [ebp - 0xc], edi
sar ebx, 1
mov esi, edi
mov dword [ebp - 8], ecx
cmp edi, ebx
jge 0x1013940b
add esi, esi
lea eax, [esi + 2]
imul ecx, eax, 0x18
add ecx, edx
lea edx, [ecx - 0x18]
call fcn.10068f89
movzx eax, al
xor eax, 0x80
imul ecx, edi, 0x18
shr eax, 7
inc eax
add esi, eax
imul eax, esi, 0x18
add ecx, dword [ebp - 4]
add eax, dword [ebp - 4]
push eax
call fcn.1006941b
mov edx, dword [ebp - 4]
mov edi, esi
cmp esi, ebx
jl 0x101393cd
mov eax, dword [ebp + 8]
cmp esi, ebx
jne 0x10139429
test al, 1
jne 0x10139429
imul eax, eax, 0x18
imul ecx, edi, 0x18
add eax, 0xffffffe8
add eax, edx
add ecx, edx
push eax
call fcn.1006941b
mov edi, dword [ebp - 8]
push dword [ebp + 0x10]
mov ecx, dword [ebp - 4]
mov edx, edi
push dword [ebp + 0xc]
push dword [ebp - 0xc]
call fcn.101394ce
pop edi
pop esi
pop ebx
leave
ret 0xc

Function at 0x1013a960
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x394
mov eax, dword [0x101fe1c0]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ecx + 0x20]
push edi
mov edi, dword [ebp + 8]
cmp esi, 0xffffffff
jne 0x1013a9a7
push str.trying_to_write_to_a_from_a_file_thats_not_open
push ecx
push 0x30303030
lea ecx, [ebp - 0x390]
call fcn.1012ea48
push 0x101ebb90
lea eax, [ebp - 0x390]
push eax
call fcn.100357e4
and dword [ebp - 0x394], 0
mov ecx, edi
call fcn.10030677
push 0
lea ecx, [ebp - 0x394]
push ecx
push dword [edi + 0x10]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x1013a9ed
call dword [sym.imp.KERNEL32.dll_GetLastError]
push str.write_to_file_failed
push eax
push 0xf
push 0x30303030
lea ecx, [ebp - 0x390]
call fcn.10062492
jmp 0x1013a996
mov ecx, dword [ebp - 4]
mov al, 1
pop edi
xor ecx, ebp
pop esi
call fcn.10033218
leave
ret 4
Function at 0x1014229d
Capabilities:
Get hostname

Disassembly:
push 0x60
mov eax, 0x101584bf
call fcn.10033f2f
mov esi, ecx
mov dword [ebp - 0x64], esi
mov eax, dword [ebp + 8]
lea ecx, [esi + 4]
mov edi, dword [ebp + 0xc]
xor ebx, ebx
mov dword [ebp - 0x6c], esi
mov dword [ebp - 0x64], ebx
push eax
mov dword [esi], 0x101dd8bc
call fcn.10010dc7
mov dword [ebp - 4], ebx
cmp dword [edi + 0x10], ebx
je 0x101422e2
push edi
lea ecx, [ebp - 0x60]
call fcn.10010dc7
inc ebx
mov byte [ebp - 4], bl
jmp 0x1014231a
lea eax, [ebp - 0x68]
mov dword [ebp - 0x68], 0x10
push eax
lea eax, [ebp - 0x30]
push eax
call dword [sym.imp.KERNEL32.dll_GetComputerNameW]
test eax, eax
lea edx, [ebp - 0x30]
mov ecx, 0x1015b7b8
cmovne ecx, edx
push ecx
lea ecx, [ebp - 0x48]
call fcn.100111ba
push 6
lea eax, [ebp - 0x48]
mov dword [ebp - 4], 2
pop ebx
push eax
lea ecx, [esi + 0x1c]
mov dword [ebp - 0x64], ebx
call fcn.10010dc7
mov dword [ebp - 4], 3
test bl, 2
je 0x1014233d
lea ecx, [ebp - 0x48]
and ebx, 0xfffffffd
call fcn.100093c1
test bl, 1
je 0x1014234a
lea ecx, [ebp - 0x60]
call fcn.100093c1
lea ecx, [esi + 0x34]
call fcn.1001305d
mov ecx, esi
mov byte [ebp - 4], 6
call fcn.10142869
mov eax, esi
call fcn.10033ee4
ret 8
Function at 0x10003240
Capabilities:
Hash data using djb2

Disassembly:
push esi
mov esi, ecx
cmp byte [esi], 0
je 0x1000325e
lea ecx, [esi + 1]
call fcn.10003240
mov edx, eax
shl edx, 5
add edx, eax
movsx eax, byte [esi]
add eax, edx
pop esi
ret
mov eax, 0x1505
pop esi
ret

Function at 0x10003540
Capabilities:
Hash data using djb2

Disassembly:
push ebx
push esi
mov esi, dword [0x100eea0c]
push edi
mov esi, dword [esi + 0x30]
test esi, esi
je 0x10003585
mov edi, dword [esp + 0x10]
mov ecx, dword [esi + 0xc]
test ecx, ecx
je 0x1000357e
mov bl, byte [ecx]
test bl, bl
je 0x10003575
inc ecx
call fcn.10003240
mov ecx, eax
shl ecx, 5
add ecx, eax
movsx eax, bl
add ecx, eax
jmp 0x1000357a
mov ecx, 0x1505
cmp ecx, edi
je 0x1000358d
mov esi, dword [esi + 4]
test esi, esi
jne 0x10003554
pop edi
pop esi
xor eax, eax
pop ebx
ret 4
pop edi
mov eax, esi
pop esi
pop ebx
ret 4
Function at 0x10008ca0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov edx, dword [esp + 4]
push esi
push edi
cmp dword [edx + 0x14], 0x10
mov edi, dword [edx + 0x10]
jb 0x10008cb1
mov edx, dword [edx]
xor ecx, ecx
mov esi, 0x811c9dc5
test edi, edi
je 0x10008cd1
nop dword [eax]
movzx eax, byte [ecx + edx]
inc ecx
xor eax, esi
imul esi, eax, 0x1000193
cmp ecx, edi
jb 0x10008cc0
pop edi
mov eax, esi
pop esi
ret 4
Function at 0x10012f20
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x14
push ebx
mov ebx, ecx
push esi
push edi
cmp dword [ebx + 0x38], 0
je 0x10012f4c
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____thiscall_std::basic_streambuf_char__struct_std::char_traits_char__::xsputn_char_const___long_long___int64__]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov eax, dword [ebx + 0x20]
mov esi, dword [ebp + 0xc]
mov edi, dword [ebp + 0x10]
mov dword [esp + 0x18], esi
mov eax, dword [eax]
mov dword [esp + 0x1c], edi
mov dword [esp + 0x14], eax
test eax, eax
je 0x10012f6e
mov eax, dword [ebx + 0x30]
mov eax, dword [eax]
jmp 0x10012f70
xor eax, eax
cdq
mov dword [esp + 0xc], eax
mov ecx, edx
mov dword [esp + 0x10], ecx
test edi, edi
jl 0x10012ff5
jg 0x10012f85
test esi, esi
je 0x10012ff5
test ecx, ecx
jl 0x10012fd8
jg 0x10012f8f
test eax, eax
je 0x10012fd8
cmp edi, ecx
jg 0x10012fa3
jl 0x10012f99
cmp esi, eax
jae 0x10012fa3
mov eax, esi
mov dword [esp + 0xc], esi
mov dword [esp + 0x10], edi
push eax
push dword [ebp + 8]
push dword [esp + 0x1c]
call sub.VCRUNTIME140.dll_memcpy
mov ecx, dword [esp + 0x18]
add esp, 0xc
mov eax, dword [ebx + 0x30]
sub esi, ecx
mov edx, dword [ebp + 8]
sbb edi, dword [esp + 0x10]
add edx, ecx
sub dword [eax], ecx
mov eax, dword [ebx + 0x20]
add dword [eax], ecx
test edi, edi
jl 0x10012ff5
jg 0x10012fdb
test esi, esi
je 0x10012ff5
jmp 0x10012fdb
mov edx, dword [ebp + 8]
mov eax, dword [ebx + 0x4c]
test eax, eax
je 0x10012ff5
push eax
push esi
push 1
push edx
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
add esp, 0x10
sub esi, eax
sbb edi, 0
mov eax, dword [esp + 0x18]
mov edx, dword [esp + 0x1c]
sub eax, esi
sbb edx, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x10013010
Capabilities:
Read file on windows

Disassembly:
mov eax, dword [esp + 0xc]
push ebx
mov ebx, ecx
push ebp
mov ebp, dword [esp + 0x10]
test eax, eax
jg 0x1001302f
jl 0x10013026
test ebp, ebp
jne 0x1001302f
pop ebp
xor eax, eax
xor edx, edx
pop ebx
ret 0xc
cmp dword [ebx + 0x38], 0
je 0x10013046
push eax
push ebp
push dword [esp + 0x14]
call dword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____thiscall_std::basic_streambuf_char__struct_std::char_traits_char__::xsgetn_char___long_long___int64__]
pop ebp
pop ebx
ret 0xc
mov eax, dword [ebx + 0x1c]
push esi
push edi
mov edi, ebp
mov ecx, dword [eax]
test ecx, ecx
je 0x10013081
mov eax, dword [ebx + 0x2c]
mov eax, dword [eax]
test eax, eax
je 0x10013081
cmp eax, ebp
mov esi, ebp
cmovb esi, eax
push esi
push ecx
push dword [esp + 0x1c]
call sub.VCRUNTIME140.dll_memcpy
mov eax, dword [ebx + 0x2c]
add esp, 0xc
add dword [esp + 0x14], esi
sub edi, esi
sub dword [eax], esi
mov eax, dword [ebx + 0x1c]
add dword [eax], esi
cmp dword [ebx + 0x4c], 0
mov ecx, edi
mov esi, dword [esp + 0x14]
je 0x100130fa
mov ecx, dword [ebx + 0xc]
lea eax, [ebx + 0x3c]
cmp dword [ecx], eax
jne 0x100130ae
mov eax, dword [ebx + 0xc]
mov edx, dword [ebx + 0x54]
mov ecx, dword [ebx + 0x50]
sub edx, ecx
mov dword [eax], ecx
mov eax, dword [ebx + 0x1c]
mov dword [eax], ecx
mov eax, dword [ebx + 0x2c]
mov dword [eax], edx
mov eax, dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
mov ecx, edi
cmp edi, 0xfff
jbe 0x100130e6
nop dword [eax]
push dword [ebx + 0x4c]
push 0xfff
push 1
push esi
call eax
sub edi, eax
add esp, 0x10
add esi, eax
mov ecx, edi
cmp eax, 0xfff
jne 0x1001310c
cmp edi, eax
mov eax, dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
ja 0x100130c0
test ecx, ecx
je 0x100130fa
push dword [ebx + 0x4c]
push edi
push 1
push esi
call eax
mov ecx, edi
add esp, 0x10
sub ecx, eax
mov edx, dword [esp + 0x1c]
sub ebp, ecx
pop edi
pop esi
mov eax, ebp
sbb edx, 0
pop ebp
pop ebx
ret 0xc
mov edx, dword [esp + 0x1c]
sub ebp, edi
pop edi
pop esi
mov eax, ebp
sbb edx, 0
pop ebp
pop ebx
ret 0xc
Function at 0x10013490
Capabilities:
Write file on windows

Disassembly:
sub esp, 0x28
push ebx
mov ebx, dword [esp + 0x30]
push esi
mov esi, ecx
cmp ebx, 0xffffffff
jne 0x100134aa
pop esi
xor eax, eax
pop ebx
add esp, 0x28
ret 4
mov eax, dword [esi + 0x20]
mov eax, dword [eax]
test eax, eax
je 0x100134d2
mov ecx, dword [esi + 0x30]
mov ecx, dword [ecx]
add ecx, eax
cmp eax, ecx
jae 0x100134d2
mov ecx, esi
call dword [sym.imp.MSVCP140.dll_protected:_char____thiscall_std::basic_streambuf_char__struct_std::char_traits_char__::_Pninc_void_]
pop esi
mov byte [eax], bl
mov eax, ebx
pop ebx
add esp, 0x28
ret 4
cmp dword [esi + 0x4c], 0
push edi
je 0x100135a0
mov edi, dword [esi + 0xc]
lea eax, [esi + 0x3c]
cmp dword [edi], eax
jne 0x100134fb
mov edx, dword [esi + 0x54]
mov ecx, dword [esi + 0x50]
sub edx, ecx
mov dword [edi], ecx
mov eax, dword [esi + 0x1c]
mov dword [eax], ecx
mov eax, dword [esi + 0x2c]
mov dword [eax], edx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x10013507
movsx eax, bl
jmp 0x10013547
lea eax, [esp + 0x38]
mov byte [esp + 0xf], bl
push eax
lea eax, [esp + 0x38]
push eax
lea eax, [esp + 0x1c]
push eax
lea eax, [esp + 0x1c]
push eax
lea eax, [esp + 0x20]
push eax
lea eax, [esp + 0x23]
push eax
lea eax, [esi + 0x40]
push eax
call dword [sym.imp.MSVCP140.dll_public:_int___thiscall_std::codecvt_char__char__struct__Mbstatet_::out_struct__Mbstatet___char_const___char_const___char_const____char___char___char___const]
sub eax, 0
je 0x10013567
sub eax, 1
je 0x10013567
sub eax, 2
jne 0x100135a0
movsx eax, byte [esp + 0xf]
push dword [esi + 0x4c]
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
add esp, 8
or ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, ebx
pop edi
pop esi
mov eax, ecx
pop ebx
add esp, 0x28
ret 4
mov edi, dword [esp + 0x38]
lea eax, [esp + 0x14]
sub edi, eax
je 0x10013587
push dword [esi + 0x4c]
push edi
push 1
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
add esp, 0x10
cmp edi, eax
jne 0x100135a0
lea eax, [esp + 0xf]
mov byte [esi + 0x3d], 1
cmp dword [esp + 0x10], eax
je 0x100135a0
pop edi
pop esi
mov eax, ebx
pop ebx
add esp, 0x28
ret 4
pop edi
pop esi
or eax, 0xffffffff
pop ebx
add esp, 0x28
ret 4