joyce8/EMBER2024-capa huggingface dataset:
Function at 0x5e4270
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x5e429d
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x5e429d
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret

Function at 0x5e43d0
Capabilities:
Encode data using xor
Hash data using murmur2

Disassembly:
sub esp, 0x40
lea eax, [esp]
mov ecx, 0x40
nop dword [eax + eax]
mov byte [eax], 0
lea eax, [eax + 1]
sub ecx, 1
jne 0x5e43e0
mov eax, dword [esp + 0x44]
lea edx, [esp]
push ebx
push ebp
push esi
mov esi, dword [esp + 0x54]
mov ebx, esi
shr ebx, 2
push edi
mov edi, ebx
test edi, edi
je 0x5e4414
mov ecx, dword [eax]
add eax, 4
mov dword [edx], ecx
add edx, 4
sub edi, 1
jne 0x5e4405
mov edi, esi
and edi, 3
je 0x5e442e
sub edx, eax
nop dword [eax]
mov cl, byte [eax]
lea eax, [eax + 1]
mov byte [edx + eax - 1], cl
sub edi, 1
jne 0x5e4420
xor edx, edx
test esi, esi
jle 0x5e444b
mov cl, byte [esp + edx + 0x10]
lea eax, [ecx - 0x41]
cmp al, 0x19
ja 0x5e4446
add cl, 0x20
mov byte [esp + edx + 0x10], cl
inc edx
cmp edx, esi
jl 0x5e4434
mov edi, dword [esp + 0x5c]
mov ebp, esi
lea edx, [esp + 0x10]
cmp esi, 4
jl 0x5e4484
mov eax, ebx
neg eax
lea esi, [esi + eax*4]
imul ecx, dword [edx], 0x5bd1e995
add edx, 4
imul edi, edi, 0x5bd1e995
mov eax, ecx
shr eax, 0x18
xor eax, ecx
imul ecx, eax, 0x5bd1e995
xor edi, ecx
sub ebx, 1
jne 0x5e4461
xor ecx, ecx
sub esi, 1
je 0x5e44a5
sub esi, 1
je 0x5e449c
sub esi, 1
jne 0x5e44aa
movzx ecx, byte [edx + 2]
shl ecx, 0x10
movzx eax, byte [edx + 1]
shl eax, 8
xor ecx, eax
movzx eax, byte [edx]
xor ecx, eax
imul ecx, ecx, 0x5bd1e995
imul edx, ebp, 0x5bd1e995
mov eax, ecx
shr eax, 0x18
xor eax, ecx
imul ecx, eax, 0x5bd1e995
imul eax, edi, 0x5bd1e995
pop edi
pop esi
pop ebp
pop ebx
xor ecx, eax
mov eax, edx
shr eax, 0x18
xor eax, edx
imul ecx, ecx, 0x5bd1e995
imul eax, eax, 0x5bd1e995
xor ecx, eax
mov eax, ecx
shr eax, 0xd
xor eax, ecx
imul ecx, eax, 0x5bd1e995
mov eax, ecx
shr eax, 0xf
xor eax, ecx
add esp, 0x40
ret

Function at 0x433000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43300c
pop eax
nop
nop
nop
nop
nop
nop
add eax, 0x40a063
nop
sub eax, 0x40a009
nop
nop
nop
mov ebx, dword [eax]
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
nop
nop
mov edx, dword [eax + 8]
nop
xor dword [ebx], edx
nop
nop
nop
nop
nop
nop
add ebx, 4
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
jl 0x433030
nop
nop
nop
nop
add eax, 0xc
nop
cmp dword [eax], 0
nop
nop
nop
nop
jne 0x43301e
nop
nop
nop
nop
popal
nop
nop
nop
nop
jmp 0x431219
Function at 0x14d0fa28
Capabilities:
Check http status code

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
push ebx
push esi
xor ebx, ebx
push ebx
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0xc]
push eax
push 0x20000013
push dword [ebp + 8]
mov dword [ebp - 8], 4
mov dword [ebp - 0xc], ebx
call dword [0x14d12300]
test eax, eax
je 0x14d0fb16
cmp dword [ebp - 0xc], 0xc8
jne 0x14d0fb16
push ebx
push 0x80
push 2
push ebx
push ebx
push 0x40000000
push dword [ebp + 0xc]
call dword [0x14d12158]
mov esi, eax
cmp esi, 0xffffffff
je 0x14d0fb16
mov byte [ebp - 1], bl
push ebx
push dword [ebp + 0x10]
call dword [0x14d12150]
test eax, eax
je 0x14d0fabc
lea eax, [ebp - 8]
push eax
push 0x200
lea eax, [ebp - 0x210]
push eax
push dword [ebp + 8]
call dword [0x14d122ec]
test eax, eax
jne 0x14d0fac0
mov byte [ebp - 1], 1
cmp dword [ebp - 8], ebx
je 0x14d0faf0
push ebx
lea eax, [ebp - 0x10]
push eax
push dword [ebp - 8]
lea eax, [ebp - 0x210]
push eax
push esi
call dword [0x14d12190]
test eax, eax
je 0x14d0fae7
mov eax, dword [ebp - 0x10]
cmp eax, dword [ebp - 8]
je 0x14d0faeb
mov byte [ebp - 1], 1
cmp byte [ebp - 1], bl
je 0x14d0fa91
push esi
call dword [0x14d121a0]
push esi
call dword [0x14d12140]
cmp byte [ebp - 1], bl
je 0x14d0fb0c
push dword [ebp + 0xc]
call fcn.14d0eab6
pop ecx
xor eax, eax
cmp byte [ebp - 1], bl
sete al
jmp 0x14d0fb18
xor al, al
pop esi
pop ebx
leave
ret

Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..text
nop
nop
nop
nop
push 4
nop
pop edi
nop
nop
nop
nop
nop
nop
cmp eax, 0
nop
nop
nop
nop
je 0x430072
nop
mov ebx, 0x408ed0
nop
nop
nop
mov ecx, ebx
nop
nop
nop
nop
nop
nop
sub ecx, eax
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
nop
nop
push eax
nop
mov eax, ecx
nop
nop
nop
div edi
nop
nop
nop
nop
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
pop eax
nop
nop
mov esi, 0xb8d2685
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
add eax, edi
nop
nop
nop
nop
nop
nop
nop
loop 0x430060
mov eax, section..data
nop
nop
nop
cmp eax, 0
nop
nop
nop
je 0x4300d2
nop
nop
nop
mov ebx, 0x42e1d0
nop
nop
nop
nop
mov ecx, ebx
nop
nop
nop
nop
sub ecx, eax
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
nop
push eax
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
div edi
nop
nop
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
pop eax
nop
mov esi, 0x559200fa
nop
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
add eax, edi
nop
nop
nop
nop
nop
nop
loop 0x4300c0
nop
nop
popal
nop
nop
nop
jmp 0x401219

Function at 0x402680
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
push ebx
xor ebx, ebx
imul edx, dword [ebx + 0x409008], 0x8088405
inc edx
mov dword [ebx + 0x409008], edx
mul edx
mov eax, edx
pop ebx
ret

Function at 0x407080
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
mov esi, eax
mov eax, dword [0x409214]
mov dword [eax], ecx
mov ebx, edx
test ebx, ebx
jle 0x4070a1
mov eax, 0xff
call fcn.00402680
xor byte [esi], al
inc esi
dec ebx
jne 0x407091
pop esi
pop ebx
ret
Function at 0x431005
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
mov eax, section..rsrc
nop
nop
mov ebx, 0x40915c
mov ecx, 0x31e80e38
nop
nop
nop
nop
test eax, eax
nop
nop
nop
nop
je 0x43104e
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x431024
nop
nop
nop
nop
mov eax, section..data
nop
nop
mov ebx, 0x42f3f8
nop
mov ecx, 0x7f77677e
test eax, eax
nop
nop
nop
nop
nop
nop
nop
nop
je 0x431084
nop
nop
nop
nop
xor dword [eax], ecx
add eax, 4
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
nop
jne 0x43106c
nop
nop
nop
popal
nop
nop
jmp 0x401219
Function at 0x100016d0
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1003bba8
mov eax, dword fs:[0]
push eax
sub esp, 0x30
mov eax, dword [0x10051014]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
movaps xmm0, xmmword [0x10048f30]
xor ecx, ecx
movups xmmword [ebp - 0x3c], xmm0
mov dword [ebp - 0x2c], 0x11b3711
mov dword [ebp - 0x28], 0x611001a
mov byte [ebp - 0x24], 0
mov al, byte [ebp - 0x3c]
xor byte [ebp + ecx - 0x3b], al
inc ecx
cmp ecx, 0x17
jb 0x10001714
mov byte [ebp - 0x24], 0
mov cl, 0x52
mov dword [ebp - 0x1c], 0x20373952
xor eax, eax
mov dword [ebp - 0x18], 0x613e373c
mov dword [ebp - 0x14], 0x3e367c60
mov word [ebp - 0x10], 0x3e
xor byte [ebp + eax - 0x1b], cl
inc eax
cmp eax, 0xc
jae 0x10001753
mov cl, byte [ebp - 0x1c]
jmp 0x10001744
lea eax, [ebp - 0x3b]
mov byte [ebp - 0xf], 0
push eax
lea eax, [ebp - 0x1b]
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ecx, eax
call fcn.100125c0
cmp al, 0xe9
jne 0x100017fa
movaps xmm0, xmmword [0x10049350]
xor ecx, ecx
movups xmmword [ebp - 0x20], xmm0
mov word [ebp - 0x10], 0x4c
nop
mov al, byte [ebp - 0x20]
xor byte [ebp + ecx - 0x1f], al
inc ecx
cmp ecx, 0x10
jb 0x10001790
cmp byte [ebp - 0x1f], 0
mov byte [ebp - 0xf], 0
mov dword [ebp - 0x28], 0xf
mov dword [ebp - 0x2c], 0
mov byte [ebp - 0x3c], 0
jne 0x100017bd
xor ecx, ecx
jmp 0x100017cc
lea ecx, [ebp - 0x1f]
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x100017c3
sub ecx, edx
push ecx
lea eax, [ebp - 0x1f]
push eax
lea ecx, [ebp - 0x3c]
call fcn.100027c0
lea ecx, [ebp - 0x3c]
mov dword [ebp - 4], 0
call fcn.10015e90
mov eax, dword [ebp - 0x28]
cmp eax, 0x10
jb 0x100017fa
inc eax
push eax
push dword [ebp - 0x3c]
call fcn.100026c0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
Function at 0x10001810
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1003bbd8
mov eax, dword fs:[0]
push eax
sub esp, 0x30
mov eax, dword [0x10051014]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov cl, 0x70
mov dword [ebp - 0x1c], 0x1d190470
mov dword [ebp - 0x18], 0x4153715
xor eax, eax
mov dword [ebp - 0x14], 0x151d1924
mov byte [ebp - 0x10], 0
xor byte [ebp + eax - 0x1b], cl
inc eax
cmp eax, 0xb
jae 0x10001861
mov cl, byte [ebp - 0x1c]
jmp 0x10001852
mov byte [ebp - 0x10], 0
mov cl, 0x2b
mov dword [ebp - 0x34], 0x594e402b
xor eax, eax
mov dword [ebp - 0x30], 0x18474e45
mov dword [ebp - 0x2c], 0x474f0519
mov word [ebp - 0x28], 0x47
xor byte [ebp + eax - 0x33], cl
inc eax
cmp eax, 0xc
jae 0x10001893
mov cl, byte [ebp - 0x34]
jmp 0x10001884
lea eax, [ebp - 0x1b]
mov byte [ebp - 0x27], 0
push eax
lea eax, [ebp - 0x33]
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ecx, eax
call fcn.100125c0
cmp al, 0xe9
jne 0x1000193a
movaps xmm0, xmmword [0x10048ec0]
xor ecx, ecx
movups xmmword [ebp - 0x38], xmm0
mov word [ebp - 0x28], 0x1b
nop
mov al, byte [ebp - 0x38]
xor byte [ebp + ecx - 0x37], al
inc ecx
cmp ecx, 0x10
jb 0x100018d0
cmp byte [ebp - 0x37], 0
mov byte [ebp - 0x27], 0
mov dword [ebp - 0x10], 0xf
mov dword [ebp - 0x14], 0
mov byte [ebp - 0x24], 0
jne 0x100018fd
xor ecx, ecx
jmp 0x1000190c
lea ecx, [ebp - 0x37]
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x10001903
sub ecx, edx
push ecx
lea eax, [ebp - 0x37]
push eax
lea ecx, [ebp - 0x24]
call fcn.100027c0
lea ecx, [ebp - 0x24]
mov dword [ebp - 4], 0
call fcn.10015e90
mov eax, dword [ebp - 0x10]
cmp eax, 0x10
jb 0x1000193a
inc eax
push eax
push dword [ebp - 0x24]
call fcn.100026c0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
Function at 0x10001d00
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x10051014]
xor eax, ebp
mov dword [ebp - 4], eax
movaps xmm0, xmmword [0x10048c40]
xor eax, eax
movups xmmword [ebp - 0x28], xmm0
nop dword [eax]
mov cl, byte [ebp - 0x28]
xor byte [ebp + eax - 0x27], cl
inc eax
cmp eax, 0xe
jb 0x10001d20
mov byte [ebp - 0x19], 0
mov cl, 0x1f
mov dword [ebp - 0x18], 0x4d5a541f
xor eax, eax
mov dword [ebp - 0x14], 0x2c535a51
mov dword [ebp - 0x10], 0x737b312d
mov word [ebp - 0xc], 0x73
xor byte [ebp + eax - 0x17], cl
inc eax
cmp eax, 0xc
jae 0x10001d5f
mov cl, byte [ebp - 0x18]
jmp 0x10001d50
lea eax, [ebp - 0x27]
mov byte [ebp - 0xb], 0
push eax
lea eax, [ebp - 0x17]
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0
push 1
lea ecx, [ebp - 5]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
cmp byte [ebp - 5], 0xe9
mov ecx, dword [ebp - 4]
sete al
xor ecx, ebp
call fcn.10038745
mov esp, ebp
pop ebp
ret

Function at 0x10001dd0
Capabilities:
Check for peb beingdebugged flag

Disassembly:
mov eax, dword fs:[0x30]
movzx eax, byte [eax + 2]
ret

Function at 0x10001de0
Capabilities:
Allocate or change rwx memory
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
push 0xfffffffffffffffe
push 0x1004b230
push 0x100391f3
mov eax, dword fs:[0]
push eax
add esp, 0xffffffc0
mov eax, dword [0x10051014]
xor dword [ebp - 8], eax
xor eax, ebp
mov dword [ebp - 0x1c], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0x10]
mov dword fs:[0], eax
mov dword [ebp - 0x18], esp
mov dword [ebp - 0x50], 0
mov dword [ebp - 0x48], 0
xor eax, eax
mov dword [ebp - 0x44], eax
mov dword [ebp - 0x40], eax
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x24], 0
lea ecx, [ebp - 0x48]
push ecx
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
push 0x40
push 0x3000
mov edx, dword [ebp - 0x44]
push edx
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 0
jne 0x10001e79
xor al, al
jmp 0x10001f02
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x50], eax
mov ecx, dword [ebp - 0x50]
mov byte [ecx], 0xc3
lea edx, [ebp - 0x20]
push edx
push 0x140
mov eax, dword [ebp - 0x44]
push eax
mov ecx, dword [ebp - 0x24]
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x10001ea4
xor al, al
jmp 0x10001f02
mov dword [ebp - 4], 0
mov eax, dword [ebp - 0x24]
push 0x10001eef
jmp eax
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x1c]
xor ecx, ebp
call fcn.10038745
mov esp, ebp
pop ebp
ret
Function at 0x100029b0
Capabilities:
Encode data using xor
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
movaps xmm0, xmmword [0x100491f0]
xor ecx, ecx
movups xmmword [ebp - 0x1c], xmm0
mov dword [ebp - 0xc], 0x363c053e
mov dword [ebp - 8], 0x21333e11
mov word [ebp - 4], 0x21
mov al, byte [ebp - 0x1c]
xor byte [ebp + ecx - 0x1b], al
inc ecx
cmp ecx, 0x18
jb 0x100029d7
push 0
lea eax, [ebp - 0x1b]
mov byte [ebp - 3], 0
push eax
call dword [sym.imp.USER32.dll_FindWindowA]
test eax, eax
je 0x10002a0f
push 9
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
mov esp, ebp
pop ebp
ret

Function at 0x10002a20
Capabilities:
Encode data using xor
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x10051014]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push 0x1000
push 0x40
mov dword [ebp - 8], 0x1000
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov esi, eax
lea eax, [ebp - 8]
push eax
push esi
push 0x250000
call dword [sym.imp.MPR.dll_WNetGetProviderNameA]
test eax, eax
jne 0x10002ab7
movaps xmm0, xmmword [0x10048da0]
xor ecx, ecx
movups xmmword [ebp - 0x24], xmm0
mov dword [ebp - 0x14], 0x32541011
mov dword [ebp - 0x10], 0x1110181b
mov word [ebp - 0xc], 0x706
mov byte [ebp - 0xa], al
nop
mov al, byte [ebp - 0x24]
xor byte [ebp + ecx - 0x23], al
inc ecx
cmp ecx, 0x19
jb 0x10002a80
lea eax, [ebp - 0x23]
mov byte [ebp - 0xa], 0
push eax
push esi
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
jne 0x10002ab7
push 9
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.10038745
mov esp, ebp
pop ebp
ret
Function at 0x10003060
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
movaps xmm0, xmmword [0x10049000]
xor ecx, ecx
movups xmmword [ebp - 0x18], xmm0
mov dword [ebp - 8], 0x35237924
mov word [ebp - 4], 0x3b
mov al, byte [ebp - 0x18]
xor byte [ebp + ecx - 0x17], al
inc ecx
cmp ecx, 0x14
jb 0x10003080
lea eax, [ebp - 0x17]
mov byte [ebp - 3], 0
push eax
call fcn.10003560
cmp eax, 0xd73df878
je 0x100030a7
xor al, al
mov esp, ebp
pop ebp
ret
movaps xmm0, xmmword [0x10049580]
xor ecx, ecx
movups xmmword [ebp - 0x18], xmm0
mov dword [ebp - 8], 0x70663c79
mov word [ebp - 4], 0x7e
mov al, byte [ebp - 0x18]
xor byte [ebp + ecx - 0x17], al
inc ecx
cmp ecx, 0x14
jb 0x100030c1
lea eax, [ebp - 0x17]
mov byte [ebp - 3], 0
push eax
call fcn.10003560
cmp eax, 0xd73df878
jne 0x100030a1
movaps xmm0, xmmword [0x10048df0]
xor ecx, ecx
movups xmmword [ebp - 0x18], xmm0
mov dword [ebp - 8], 0x1e085219
mov word [ebp - 4], 0x10
nop dword [eax]
mov al, byte [ebp - 0x18]
xor byte [ebp + ecx - 0x17], al
inc ecx
cmp ecx, 0x14
jb 0x10003100
lea eax, [ebp - 0x17]
mov byte [ebp - 3], 0
push eax
call fcn.10003560
cmp eax, 0xb212610
jne 0x100030a1
movaps xmm0, xmmword [0x10048e30]
xor ecx, ecx
movups xmmword [ebp - 0x1c], xmm0
mov dword [ebp - 0xc], 0xf0f2c14
mov dword [ebp - 8], 0x144e130b
mov word [ebp - 4], 0xc02
mov byte [ebp - 2], 0
mov al, byte [ebp - 0x1c]
xor byte [ebp + ecx - 0x1b], al
inc ecx
cmp ecx, 0x19
jb 0x10003146
lea eax, [ebp - 0x1b]
mov byte [ebp - 2], 0
push eax
call fcn.10003560
cmp eax, 0x6694b71f
jne 0x100030a1
movaps xmm0, xmmword [0x10048be0]
xor ecx, ecx
movups xmmword [ebp - 0x14], xmm0
mov al, byte [ebp - 0x14]
xor byte [ebp + ecx - 0x13], al
inc ecx
cmp ecx, 0xe
jb 0x10003178
lea eax, [ebp - 0x13]
mov byte [ebp - 5], 0
push eax
call fcn.10003560
cmp eax, 0xef7c0020
sete al
mov esp, ebp
pop ebp
ret
Function at 0x10003420
Capabilities:
Hash data using crc32b

Disassembly:
push ebp
mov ebp, esp
push ecx
push 0x400
push 0
push 0x100532f0
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
xor ecx, ecx
mov dword [ebp - 4], ecx
push ebx
nop
xor eax, eax
test cl, 1
je 0x1000344b
bts eax, 7
shr ecx, 1
test cl, 1
je 0x10003456
bts eax, 6
shr ecx, 1
test cl, 1
je 0x10003461
bts eax, 5
shr ecx, 1
test cl, 1
je 0x1000346c
bts eax, 4
shr ecx, 1
test cl, 1
je 0x10003477
bts eax, 3
shr ecx, 1
test cl, 1
je 0x10003482
bts eax, 2
shr ecx, 1
test cl, 1
je 0x1000348d
bts eax, 1
test cl, 2
je 0x10003496
bts eax, 0
shl eax, 0x18
mov ecx, eax
add eax, eax
sar ecx, 0x1f
and ecx, 0x4c11db7
xor ecx, eax
mov edx, ecx
sar edx, 0x1f
and edx, 0x4c11db7
lea eax, [ecx + ecx]
xor edx, eax
mov ecx, edx
sar ecx, 0x1f
and ecx, 0x4c11db7
lea eax, [edx + edx]
xor ecx, eax
mov edx, ecx
sar edx, 0x1f
and edx, 0x4c11db7
lea eax, [ecx + ecx]
xor edx, eax
mov ecx, edx
sar ecx, 0x1f
and ecx, 0x4c11db7
lea eax, [edx + edx]
xor ecx, eax
mov edx, ecx
sar edx, 0x1f
and edx, 0x4c11db7
lea eax, [ecx + ecx]
xor edx, eax
mov ecx, edx
sar ecx, 0x1f
and ecx, 0x4c11db7
lea eax, [edx + edx]
xor ecx, eax
mov ebx, ecx
sar ebx, 0x1f
and ebx, 0x4c11db7
lea eax, [ecx + ecx]
xor ebx, eax
mov eax, dword [ebp - 4]
xor edx, edx
mov dword [eax*4 + 0x100532f0], ebx
lea ecx, [edx + 1]
test bl, 1
je 0x10003536
mov eax, 0x20
sub eax, ecx
bts edx, eax
inc ecx
shr ebx, 1
cmp ecx, 0x21
jl 0x10003527
mov ecx, dword [ebp - 4]
mov dword [ecx*4 + 0x100532f0], edx
inc ecx
mov dword [ebp - 4], ecx
cmp ecx, 0xff
jle 0x10003440
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x10003560
Capabilities:
Encode data using xor
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x408
mov eax, dword [0x10051014]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push 0x10040abc
push eax
or ebx, 0xffffffff
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fopen]
add esp, 8
mov dword [ebp - 0x408], eax
test eax, eax
jne 0x100035a7
or eax, 0xffffffff
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10038745
mov esp, ebp
pop ebp
ret 4
push esi
push edi
nop dword [eax]
push eax
push 0x400
lea eax, [ebp - 0x404]
push 1
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
mov edi, eax
lea esi, [ebp - 0x404]
add esp, 0x10
mov edx, edi
test edi, edi
je 0x100035f0
movzx eax, byte [esi]
lea esi, [esi + 1]
movzx ecx, bl
xor ecx, eax
shr ebx, 8
xor ebx, dword [ecx*4 + 0x100532f0]
sub edx, 1
jne 0x100035d6
mov eax, dword [ebp - 0x408]
cmp edi, 0x400
je 0x100035b0
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
mov ecx, dword [ebp - 4]
add esp, 4
not ebx
xor ecx, ebp
mov eax, ebx
pop edi
pop esi
pop ebx
call fcn.10038745
mov esp, ebp
pop ebp
ret 4
Function at 0x10007da0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1003c088
mov eax, dword fs:[0]
push eax
sub esp, 0x24
mov eax, dword [0x10051014]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
cmp dword [ebx + 0x38], 0
je 0x10007ed3
cmp byte [ebx + 0x3d], 0
je 0x10007ed3
mov eax, dword [ebx]
push 0xffffffffffffffff
call dword [eax + 0xc]
cmp eax, 0xffffffff
sete al
test al, al
je 0x10007df9
xor al, al
jmp 0x10007ed5
push 0
push 8
lea ecx, [ebp - 0x28]
mov dword [ebp - 0x14], 0xf
mov dword [ebp - 0x18], 0
mov byte [ebp - 0x28], 0
call fcn.100079b0
mov dword [ebp - 4], 0
mov esi, dword [ebp - 0x14]
lea edi, [ebx + 0x40]
cmp esi, 0x10
lea eax, [ebp - 0x2c]
push eax
mov eax, dword [ebp - 0x18]
lea edx, [ebp - 0x28]
cmovae edx, dword [ebp - 0x28]
lea ecx, [ebp - 0x28]
cmovae ecx, dword [ebp - 0x28]
add eax, edx
push eax
push ecx
mov ecx, dword [ebx + 0x38]
push edi
call dword [sym.imp.MSVCP140.dll_public:_int___thiscall_std::codecvt_char__char__struct__Mbstatet_::unshift_struct__Mbstatet___char___char___char___const]
sub eax, 0
je 0x10007e60
sub eax, 1
je 0x10007e64
mov esi, dword [ebp - 0x14]
sub eax, 2
je 0x10007ebc
xor bl, bl
jmp 0x10007ebe
mov byte [ebx + 0x3d], 0
mov esi, dword [ebp - 0x14]
lea eax, [ebp - 0x28]
mov ecx, dword [ebp - 0x28]
cmp esi, 0x10
mov edi, dword [ebp - 0x2c]
cmovae eax, ecx
sub edi, eax
je 0x10007e9a
push dword [ebx + 0x4c]
cmp esi, 0x10
lea eax, [ebp - 0x28]
push edi
cmovae eax, ecx
push 1
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
mov esi, dword [ebp - 0x14]
add esp, 0x10
cmp edi, eax
jne 0x10007e5c
cmp byte [ebx + 0x3d], 0
je 0x10007ebc
test edi, edi
lea edi, [ebx + 0x40]
jne 0x10007e24
push 0
push 8
lea ecx, [ebp - 0x28]
call fcn.10007a70
jmp 0x10007e1e
mov bl, 1
cmp esi, 0x10
jb 0x10007ecf
lea ecx, [esi + 1]
push ecx
push dword [ebp - 0x28]
call fcn.100026c0
mov al, bl
jmp 0x10007ed5
mov al, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.10038745
mov esp, ebp
pop ebp
ret