joyce8/EMBER2024-capa huggingface dataset:
Function at 0x590fbfc0
Capabilities:
Check os version

Disassembly:
push 0xffffffffffffffff
push 0x59148955
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x49c
push esi
push edi
mov ecx, 0xff
xor eax, eax
lea edi, [esp + 0xa5]
mov byte [esp + 0xa4], 0
rep stosd dword es:[edi], eax
mov esi, dword [esp + 0x4b8]
mov dword [esp + 0xc], 0
stosw word es:[edi], ax
stosb byte es:[edi], al
mov eax, dword [0x5919a160]
test esi, esi
je 0x590fc0ab
test eax, eax
jne 0x590fc06a
mov ecx, 0x24
xor eax, eax
lea edi, [esp + 0x14]
mov dword [0x5919a160], 1
rep stosd dword es:[edi], eax
lea eax, [esp + 0x10]
mov dword [esp + 0x10], 0x94
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
cmp dword [esp + 0x20], 2
jne 0x590fc05e
cmp dword [esp + 0x14], 5
jb 0x590fc05e
mov ecx, dword [str.GlobalOCULAR_]
mov dword [0x5919a164], ecx
jmp 0x590fc06a
mov edx, dword [0x5918eef8]
mov dword [0x5919a164], edx
mov eax, dword [esp + 0x4bc]
test eax, eax
mov eax, dword [0x5918eef8]
jne 0x590fc07f
mov eax, dword [0x5919a164]
mov ecx, dword [esp + 0x4c4]
mov edx, dword [esp + 0x4c0]
push ecx
push edx
push esi
push eax
lea eax, [esp + 0xb4]
push str._s__s__08x__08x
push eax
call fcn.5907c420
add esp, 0x18
jmp 0x590fc13a
test eax, eax
jne 0x590fc0ff
mov ecx, 0x24
xor eax, eax
lea edi, [esp + 0x14]
mov dword [0x5919a160], 1
rep stosd dword es:[edi], eax
lea ecx, [esp + 0x10]
mov dword [esp + 0x10], 0x94
push ecx
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
cmp dword [esp + 0x20], 2
jne 0x590fc0f5
cmp dword [esp + 0x14], 5
jb 0x590fc0f5
mov edx, dword [str.GlobalOCULAR_]
mov dword [0x5919a164], edx
jmp 0x590fc0ff
mov eax, dword [0x5918eef8]
mov dword [0x5919a164], eax
mov eax, dword [esp + 0x4bc]
test eax, eax
mov eax, dword [0x5918eef8]
jne 0x590fc114
mov eax, dword [0x5919a164]
mov ecx, dword [esp + 0x4c4]
mov edx, dword [esp + 0x4c0]
push ecx
push edx
push eax
lea eax, [esp + 0xb0]
push str._s___08x__08x
push eax
call fcn.5907c420
add esp, 0x14
lea ecx, [esp + 0xa4]
push ecx
lea ecx, [esp + 0xc]
call fcn.59094760
mov esi, dword [esp + 0x4b4]
lea edx, [esp + 8]
push edx
mov ecx, esi
mov dword [esp + 0x4b0], 1
call fcn.59094660
mov dword [esp + 0xc], 1
lea ecx, [esp + 8]
mov byte [esp + 0x4ac], 0
call fcn.59095090
mov ecx, dword [esp + 0x4a4]
mov eax, esi
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x4a8
ret
Function at 0x590ffd30
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x59148def
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x30
mov ecx, dword [0x5914f850]
push ebx
xor eax, eax
push esi
push edi
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], ecx
mov ecx, 9
lea edi, [esp + 0x16]
mov ebx, dword [esp + 0x50]
mov word [esp + 0x14], ax
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov eax, ebx
lea edx, [esp + 0x14]
push 0xa
push edx
shr eax, 0x18
push eax
mov dword [esp + 0x50], 1
call fcn.59121ce9
add esp, 0xc
lea ecx, [esp + 0xc]
push eax
call fcn.5909b060
push 0x5917657c
lea ecx, [esp + 0x10]
call fcn.5909b060
xor edx, edx
lea ecx, [esp + 0x14]
mov dl, byte [esp + 0x52]
push 0xa
push ecx
push edx
call fcn.59121ce9
add esp, 0xc
lea ecx, [esp + 0xc]
push eax
call fcn.5909b060
push 0x5917657c
lea ecx, [esp + 0x10]
call fcn.5909b060
xor ecx, ecx
lea eax, [esp + 0x14]
push 0xa
mov cl, bh
push eax
push ecx
call fcn.59121ce9
add esp, 0xc
lea ecx, [esp + 0xc]
push eax
call fcn.5909b060
push 0x5917657c
lea ecx, [esp + 0x10]
call fcn.5909b060
lea edx, [esp + 0x14]
push 0xa
and ebx, 0xff
push edx
push ebx
call fcn.59121ce9
add esp, 0xc
lea ecx, [esp + 0xc]
push eax
call fcn.5909b060
mov esi, dword [esp + 0x4c]
lea eax, [esp + 0xc]
push eax
mov ecx, esi
call fcn.59099a10
mov dword [esp + 0x10], 1
lea ecx, [esp + 0xc]
mov byte [esp + 0x44], 0
call fcn.5909a410
mov eax, esi
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
add esp, 0x3c
ret

Function at 0x591023a0
Capabilities:
Get common file path

Disassembly:
push 0xffffffffffffffff
push 0x591491eb
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x210
mov eax, dword [0x59156850]
push esi
mov esi, ecx
push edi
mov dword [esp + 0xc], esi
mov dword [esi], eax
mov ecx, 0x81
xor eax, eax
lea edi, [esp + 0x12]
mov word [esp + 0x10], 0
rep stosd dword es:[edi], eax
lea ecx, [esp + 0x10]
push 0x104
push ecx
mov dword [esp + 0x228], 0
stosw word es:[edi], ax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
lea edx, [esp + 0x10]
mov ecx, esi
push edx
call fcn.591115c0
lea eax, [esp + 8]
push 1
push eax
mov ecx, esi
call fcn.591138a0
mov ecx, dword [eax]
push 0x59178d4c
push ecx
call fcn.5907cbeb
add esp, 8
lea ecx, [esp + 8]
mov edi, eax
call fcn.591112e0
test edi, edi
je 0x59102440
push 0x59178d4c
mov ecx, esi
call fcn.59111f20
mov ecx, dword [esp + 0x218]
mov eax, esi
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x21c
ret
Function at 0x59102580
Capabilities:
Get common file path

Disassembly:
push 0xffffffffffffffff
push 0x5914922b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x210
mov eax, dword [0x59156850]
push esi
mov esi, ecx
push edi
mov dword [esp + 0xc], esi
mov dword [esi], eax
mov ecx, 0x81
xor eax, eax
lea edi, [esp + 0x12]
mov word [esp + 0x10], 0
rep stosd dword es:[edi], eax
lea ecx, [esp + 0x10]
push 0x104
push ecx
mov dword [esp + 0x228], 0
stosw word es:[edi], ax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
lea edx, [esp + 0x10]
mov ecx, esi
push edx
call fcn.591115c0
lea eax, [esp + 8]
push 1
push eax
mov ecx, esi
call fcn.591138a0
mov ecx, dword [eax]
push 0x59178d4c
push ecx
call fcn.5907cbeb
add esp, 8
lea ecx, [esp + 8]
mov edi, eax
call fcn.591112e0
test edi, edi
je 0x59102620
push 0x59178d4c
mov ecx, esi
call fcn.59111f20
mov ecx, dword [esp + 0x218]
mov eax, esi
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x21c
ret
Function at 0x5910f7d0
Capabilities:
Extract resource via kernel32 functions
Print debug messages

Disassembly:
mov eax, dword [esp + 8]
mov ecx, dword [esp + 0xc]
push ebx
push ebp
mov ebp, eax
push esi
mov esi, dword [esp + 0x10]
and ebp, 0xf
shr eax, 4
inc eax
push edi
and eax, 0xffff
push ecx
push eax
push 6
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceExA]
test eax, eax
je 0x5910f829
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov esi, eax
test esi, esi
je 0x5910f829
xor edi, edi
xor ebx, ebx
mov bx, word [esi]
add esi, 2
push esi
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp ebp, edi
je 0x5910f830
inc edi
lea esi, [esi + ebx*2]
cmp edi, 0x10
jl 0x5910f80d
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
ret
mov ecx, dword [esp + 0x24]
mov ebp, dword [esp + 0x20]
mov edx, ecx
xor eax, eax
mov edi, ebp
push 0
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, edx
push 0
and ecx, 3
rep stosb byte es:[edi], al
mov eax, edx
dec eax
push eax
push ebp
push ebx
push esi
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
test eax, eax
jne 0x5910f82b
mov edi, ebp
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
pop edi
dec ecx
pop esi
pop ebp
mov eax, ecx
pop ebx
ret

Function at 0x59115300
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov eax, dword [esp + 8]
mov ecx, dword [esp + 0xc]
push esi
push edi
mov esi, dword [esp + 0xc]
mov edi, eax
shr eax, 4
and edi, 0xf
inc eax
and eax, 0xffff
push ecx
push eax
push 6
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceExA]
test eax, eax
je 0x59115350
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov esi, eax
test esi, esi
je 0x59115350
xor ecx, ecx
xor eax, eax
mov ax, word [esi]
add esi, 2
cmp edi, ecx
je 0x59115355
inc ecx
lea esi, [esi + eax*2]
cmp ecx, 0x10
jl 0x5911533b
pop edi
xor eax, eax
pop esi
ret
mov edx, dword [esp + 0x1c]
lea ecx, [edx - 1]
cmp eax, ecx
jle 0x59115362
mov eax, ecx
lea edx, [eax + eax]
push ebx
mov ebx, dword [esp + 0x1c]
mov ecx, edx
push ebp
mov ebp, ecx
mov edi, ebx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebp
pop ebp
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov word [edx + ebx], 0
pop ebx
pop edi
pop esi
ret
Function at 0x59124a70
Capabilities:
Encode data using base64

Disassembly:
push ebp
push edi
mov edi, dword [esp + 0x14]
xor ebp, ebp
test edi, edi
jle 0x59124b56
mov ecx, dword [esp + 0xc]
push ebx
push esi
mov esi, dword [esp + 0x18]
cmp edi, 3
jl 0x59124ae3
xor edx, edx
xor eax, eax
mov dh, byte [esi]
mov al, byte [esi + 2]
mov dl, byte [esi + 1]
shl edx, 8
or edx, eax
mov eax, edx
shr eax, 0x12
and eax, 0x3f
inc ecx
mov al, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [ecx - 1], al
mov eax, edx
shr eax, 0xc
and eax, 0x3f
inc ecx
mov al, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [ecx - 1], al
mov eax, edx
shr eax, 6
and eax, 0x3f
inc ecx
and edx, 0x3f
mov al, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [ecx - 1], al
mov dl, byte [edx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [ecx], dl
jmp 0x59124b3a
xor edx, edx
mov dl, byte [esi]
shl edx, 0x10
cmp edi, 2
jne 0x59124af6
xor eax, eax
mov ah, byte [esi + 1]
or edx, eax
mov eax, edx
shr eax, 0x12
and eax, 0x3f
inc ecx
mov al, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [ecx - 1], al
mov eax, edx
shr eax, 0xc
and eax, 0x3f
inc ecx
cmp edi, 1
mov al, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [ecx - 1], al
jne 0x59124b26
mov ebx, 0x3d
jmp 0x59124b34
shr edx, 6
and edx, 0x3f
xor ebx, ebx
mov bl, byte [edx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [ecx], bl
inc ecx
mov byte [ecx], 0x3d
sub edi, 3
inc ecx
add ebp, 4
add esi, 3
test edi, edi
jg 0x59124a8a
pop esi
pop ebx
mov eax, ebp
pop edi
mov byte [ecx], 0
pop ebp
ret
mov ecx, dword [esp + 0xc]
mov eax, ebp
pop edi
pop ebp
mov byte [ecx], 0
ret
Function at 0x59124f30
Capabilities:
Authenticate hmac
Encode data using xor

Disassembly:
mov eax, 0x80
call fcn.5907e4c0
push ebx
push ebp
push esi
mov esi, dword [esp + 0x9c]
xor eax, eax
push edi
test esi, esi
je 0x59124f5b
mov ebx, dword [esp + 0x94]
mov eax, 1
mov dword [ebx], esi
jmp 0x59124f6d
mov ebx, dword [esp + 0x94]
mov ecx, dword [ebx]
mov dword [esp + 0xa0], ecx
mov esi, ecx
mov ecx, dword [esp + 0x98]
test ecx, ecx
je 0x591250d9
push esi
call fcn.591270e0
mov edi, eax
add esp, 4
cmp edi, 0x80
jle 0x59124fa3
push str.j____int_sizeof_ctx__key_
push 0x54
push str..cryptohmachmac.c
call fcn.590d0bd0
add esp, 0xc
mov ebp, dword [esp + 0x9c]
cmp edi, ebp
jge 0x59124fe2
mov edx, dword [esp + 0xa4]
lea edi, [ebx + 4]
push edx
push esi
push edi
call fcn.590cec80
mov eax, dword [esp + 0xa4]
push ebp
push eax
push edi
call fcn.590cedf0
lea esi, [ebx + 0x34]
lea ecx, [ebx + 0x38]
push esi
push ecx
push edi
call fcn.590ceef0
add esp, 0x24
jmp 0x59125021
test ebp, ebp
jl 0x59124fee
cmp ebp, 0x80
jle 0x59125002
push str.len_0__len__int_sizeof_ctx__key_
push 0x5e
push str..cryptohmachmac.c
call fcn.590d0bd0
add esp, 0xc
mov esi, dword [esp + 0x98]
mov ecx, ebp
mov edx, ecx
lea edi, [ebx + 0x38]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea esi, [ebx + 0x34]
mov dword [esi], ebp
mov esi, dword [esi]
cmp esi, 0x80
je 0x59125046
mov ecx, 0x80
xor eax, eax
sub ecx, esi
lea edi, [esi + ebx + 0x38]
mov edx, ecx
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
mov esi, dword [esp + 0xa0]
xor eax, eax
mov cl, byte [ebx + eax + 0x38]
xor cl, 0x36
mov byte [esp + eax + 0x10], cl
inc eax
cmp eax, 0x80
jl 0x5912504f
mov ebp, dword [esp + 0xa4]
lea edi, [ebx + 0x14]
push ebp
push esi
push edi
call fcn.590cec80
push esi
call fcn.591270e0
lea edx, [esp + 0x20]
push eax
push edx
push edi
call fcn.590cedf0
add esp, 0x1c
xor eax, eax
mov cl, byte [ebx + eax + 0x38]
xor cl, 0x5c
mov byte [esp + eax + 0x10], cl
inc eax
cmp eax, 0x80
jl 0x5912508b
lea edi, [ebx + 0x24]
push ebp
push esi
push edi
call fcn.590cec80
push esi
call fcn.591270e0
lea edx, [esp + 0x20]
push eax
push edx
push edi
call fcn.590cedf0
add esp, 0x1c
lea eax, [ebx + 0x14]
add ebx, 4
push eax
push ebx
call fcn.590cefa0
add esp, 8
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x80
ret
test eax, eax
je 0x591250be
jmp 0x5912504d
Function at 0x591258f0
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x20
call fcn.5907e4c0
push ebx
mov ebx, dword [esp + 0x30]
push ebp
push esi
test ebx, ebx
push edi
jle 0x59125a44
cmp ebx, 0x80
jg 0x59125a44
mov edi, dword [esp + 0x44]
mov eax, edi
mov ecx, dword [eax]
mov dword [esp + 0x10], ecx
mov edx, dword [eax + 4]
mov dword [esp + 0x14], edx
mov ecx, dword [eax + 8]
mov dword [esp + 0x18], ecx
mov edx, dword [eax + 0xc]
mov eax, dword [esp + 0x40]
push eax
push edi
push edi
mov dword [esp + 0x28], edx
call fcn.59126200
lea eax, [ebx + 7]
add esp, 0xc
cdq
and edx, 7
add eax, edx
mov ebp, eax
mov eax, dword [esp + 0x48]
sar ebp, 3
test eax, eax
je 0x59125987
test ebp, ebp
jle 0x591259d5
mov edx, dword [esp + 0x34]
mov ebx, dword [esp + 0x38]
lea esi, [esp + 0x20]
sub edx, edi
sub esi, edi
mov ecx, edi
sub ebx, edi
mov al, byte [edx + ecx]
xor al, byte [ecx]
inc ecx
dec ebp
mov byte [esi + ecx - 1], al
mov byte [ebx + ecx - 1], al
jne 0x59125974
jmp 0x591259d1
xor esi, esi
test ebp, ebp
jle 0x591259d5
mov eax, dword [esp + 0x34]
lea ecx, [esp + 0x20]
mov ebx, edi
lea edx, [esp + 0x20]
sub eax, ecx
mov ecx, dword [esp + 0x38]
sub ebx, edx
lea edx, [esp + 0x20]
sub ecx, edx
mov dword [esp + 0x34], ebx
mov dword [esp + 0x38], ecx
jmp 0x591259b7
mov ebx, dword [esp + 0x34]
lea ecx, [esp + esi + 0x20]
mov dl, byte [eax + ecx]
mov bl, byte [ebx + ecx]
mov byte [ecx], dl
xor bl, dl
mov edx, dword [esp + 0x38]
inc esi
cmp esi, ebp
mov byte [edx + ecx], bl
jl 0x591259b3
mov ebx, dword [esp + 0x3c]
mov ebp, ebx
and ebp, 0x80000007
jns 0x591259e4
dec ebp
or ebp, 0xfffffff8
inc ebp
mov eax, ebx
cdq
and edx, 7
add eax, edx
sar eax, 3
test ebp, ebp
jne 0x59125a15
lea eax, [esp + eax + 0x10]
mov ecx, dword [eax]
mov dword [edi], ecx
mov edx, dword [eax + 4]
mov dword [edi + 4], edx
mov ecx, dword [eax + 8]
mov dword [edi + 8], ecx
mov edx, dword [eax + 0xc]
mov dword [edi + 0xc], edx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x20
ret
mov ecx, 8
xor esi, esi
sub ecx, ebp
lea eax, [esp + eax + 0x10]
mov dword [esp + 0x3c], ecx
jmp 0x59125a2c
mov ecx, dword [esp + 0x3c]
mov dl, byte [eax + esi + 1]
mov bl, byte [eax + esi]
shr dl, cl
mov ecx, ebp
shl bl, cl
or dl, bl
mov byte [esi + edi], dl
inc esi
cmp esi, 0x10
jl 0x59125a28
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x20
ret
Function at 0x100364b0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x10122c00]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, ecx
cmp dword [esi + 0x38], 0
je 0x1003656c
cmp byte [esi + 0x3d], 0
je 0x1003656c
mov eax, dword [esi]
push edi
push 0xffffffffffffffff
call dword [eax + 0xc]
cmp eax, 0xffffffff
je 0x1003655a
mov ecx, dword [esi + 0x38]
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [esi + 0x40]
push eax
call dword [sym.imp.MSVCP140.dll_public:_int___thiscall_std::codecvt_char__char__struct__Mbstatet_::unshift_struct__Mbstatet___char___char___char___const]
sub eax, 0
je 0x10036521
sub eax, 1
je 0x10036525
sub eax, 2
jne 0x1003655a
mov byte [esi + 0x3d], al
mov al, 1
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100ba7ae
mov esp, ebp
pop ebp
ret
mov byte [esi + 0x3d], 0
mov edi, dword [ebp - 0x28]
lea eax, [ebp - 0x24]
sub edi, eax
je 0x10036543
push dword [esi + 0x4c]
push edi
push 1
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
add esp, 0x10
cmp edi, eax
jne 0x1003655a
cmp byte [esi + 0x3d], 0
pop edi
sete al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100ba7ae
mov esp, ebp
pop ebp
ret
pop edi
xor al, al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100ba7ae
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
mov al, 1
xor ecx, ebp
pop esi
call fcn.100ba7ae
mov esp, ebp
pop ebp
ret
Function at 0x10036f80
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 0xc]
push ebx
mov ebx, ecx
mov ecx, dword [ebp + 0x10]
push esi
mov esi, dword [ebp + 8]
mov dword [ebp - 4], esi
test ecx, ecx
jg 0x10036faa
jl 0x10036f9e
test eax, eax
jne 0x10036faa
pop esi
xor eax, eax
xor edx, edx
pop ebx
mov esp, ebp
pop ebp
ret 0xc
cmp dword [ebx + 0x38], 0
je 0x10036fc3
push ecx
push eax
push esi
mov ecx, ebx
call dword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____thiscall_std::basic_streambuf_char__struct_std::char_traits_char__::xsgetn_char___long_long___int64__]
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
push edi
mov ecx, ebx
mov edi, eax
call dword [sym.imp.MSVCP140.dll_protected:_long_long___int64____thiscall_std::basic_streambuf_char__struct_std::char_traits_char__::_Gnavail_void_const]
mov ecx, eax
test ecx, ecx
je 0x10037008
mov esi, dword [ebp + 0xc]
cmp ecx, esi
cmovb esi, ecx
mov ecx, ebx
call dword [sym.imp.MSVCP140.dll_protected:_char____thiscall_std::basic_streambuf_char__struct_std::char_traits_char__::gptr_void_const]
mov edi, dword [ebp - 4]
push esi
push eax
push edi
call sub.VCRUNTIME140.dll_memcpy
add edi, esi
add esp, 0xc
mov dword [ebp - 4], edi
mov ecx, ebx
mov edi, dword [ebp + 0xc]
sub edi, esi
push esi
call dword [sym.imp.MSVCP140.dll_protected:_void___thiscall_std::basic_streambuf_char__struct_std::char_traits_char__::gbump_int_]
mov esi, dword [ebp - 4]
cmp dword [ebx + 0x4c], 0
je 0x10037078
mov ecx, ebx
call dword [sym.imp.MSVCP140.dll_protected:_char____thiscall_std::basic_streambuf_char__struct_std::char_traits_char__::eback_void_const]
lea ecx, [ebx + 0x3c]
cmp eax, ecx
jne 0x1003702d
push dword [ebx + 0x54]
mov eax, dword [ebx + 0x50]
mov ecx, ebx
push eax
push eax
call dword [sym.imp.MSVCP140.dll_protected:_void___thiscall_std::basic_streambuf_char__struct_std::char_traits_char__::setg_char___char___char__]
mov eax, dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
mov ecx, edi
cmp edi, 0xfff
jbe 0x10037066
nop dword [eax]
push dword [ebx + 0x4c]
push 0xfff
push 1
push esi
call eax
sub edi, eax
add esp, 0x10
add esi, eax
mov ecx, edi
cmp eax, 0xfff
jne 0x10037078
cmp edi, eax
mov eax, dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
ja 0x10037040
test ecx, ecx
je 0x10037078
push dword [ebx + 0x4c]
push edi
push 1
push esi
call eax
add esp, 0x10
sub edi, eax
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 0x10]
sub eax, edi
pop edi
pop esi
sbb edx, 0
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x10037090
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
mov ebx, ecx
cmp dword [ebx + 0x38], 0
je 0x100370b5
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____thiscall_std::basic_streambuf_char__struct_std::char_traits_char__::xsputn_char_const___long_long___int64__]
pop ebx
mov esp, ebp
pop ebp
ret 0xc
push esi
mov esi, dword [ebp + 0xc]
push edi
mov edi, dword [ebp + 0x10]
mov dword [ebp - 8], esi
mov dword [ebp - 0xc], edi
call dword [sym.imp.MSVCP140.dll_protected:_long_long___int64____thiscall_std::basic_streambuf_char__struct_std::char_traits_char__::_Pnavail_void_const]
mov dword [ebp + 0x10], eax
mov ecx, edx
mov dword [ebp - 4], ecx
test edi, edi
jl 0x10037147
jg 0x100370db
test esi, esi
je 0x10037147
test ecx, ecx
jl 0x1003712a
jg 0x100370e5
test eax, eax
je 0x1003712a
cmp edi, ecx
jg 0x100370f5
jl 0x100370ef
cmp esi, eax
jae 0x100370f5
mov dword [ebp + 0x10], esi
mov dword [ebp - 4], edi
mov ecx, ebx
call dword [sym.imp.MSVCP140.dll_protected:_char____thiscall_std::basic_streambuf_char__struct_std::char_traits_char__::pptr_void_const]
push dword [ebp + 0x10]
push dword [ebp + 8]
push eax
call sub.VCRUNTIME140.dll_memcpy
mov eax, dword [ebp + 0x10]
add esp, 0xc
add dword [ebp + 8], eax
mov ecx, ebx
sub esi, eax
sbb edi, dword [ebp - 4]
push eax
call dword [sym.imp.MSVCP140.dll_protected:_void___thiscall_std::basic_streambuf_char__struct_std::char_traits_char__::pbump_int_]
test edi, edi
jl 0x10037147
jg 0x1003712a
test esi, esi
je 0x10037147
mov eax, dword [ebx + 0x4c]
mov ecx, dword [ebp + 8]
test eax, eax
je 0x10037147
push eax
push esi
push 1
push ecx
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
add esp, 0x10
sub esi, eax
sbb edi, 0
mov eax, dword [ebp - 8]
mov edx, dword [ebp - 0xc]
sub eax, esi
sbb edx, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x10037370
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, dword [ebp + 0xc]
push edi
mov eax, dword [ebx]
mov edi, dword [ebp + 0x10]
cmp edi, 7
ja case.default.0x10037386
jmp dword [edi*4 + 0x1003751c]
mov ecx, esi
and ecx, 3
sub edi, ecx
sub ecx, 1
je 0x100373c9
sub ecx, 1
je 0x100373b6
sub ecx, 1
jne 0x100373dc
movzx edx, byte [esi]
movzx ecx, al
xor edx, ecx
shr eax, 8
xor eax, dword [edx*4 + 0x100c91d0]
inc esi
movzx edx, byte [esi]
movzx ecx, al
xor edx, ecx
shr eax, 8
xor eax, dword [edx*4 + 0x100c91d0]
inc esi
movzx edx, byte [esi]
movzx ecx, al
xor edx, ecx
shr eax, 8
xor eax, dword [edx*4 + 0x100c91d0]
inc esi
mov edx, edi
sar edx, 3
test edx, edx
je 0x1003745e
xor eax, dword [esi]
movzx ecx, al
shr eax, 8
xor eax, dword [ecx*4 + 0x100c91d0]
movzx ecx, al
shr eax, 8
xor eax, dword [ecx*4 + 0x100c91d0]
movzx ecx, al
shr eax, 8
xor eax, dword [ecx*4 + 0x100c91d0]
mov ecx, eax
movzx eax, cl
shr ecx, 8
mov eax, dword [eax*4 + 0x100c91d0]
xor eax, dword [esi + 4]
add esi, 8
xor eax, ecx
movzx ecx, al
shr eax, 8
xor eax, dword [ecx*4 + 0x100c91d0]
movzx ecx, al
shr eax, 8
xor eax, dword [ecx*4 + 0x100c91d0]
movzx ecx, al
shr eax, 8
xor eax, dword [ecx*4 + 0x100c91d0]
movzx ecx, al
shr eax, 8
xor eax, dword [ecx*4 + 0x100c91d0]
sub edx, 1
jne 0x100373e5
and edi, 7
jmp 0x10037381
movzx edx, byte [esi]
movzx ecx, al
xor edx, ecx
shr eax, 8
xor eax, dword [edx*4 + 0x100c91d0]
inc esi
movzx edx, byte [esi]
movzx ecx, al
xor edx, ecx
shr eax, 8
xor eax, dword [edx*4 + 0x100c91d0]
inc esi
movzx edx, byte [esi]
movzx ecx, al
xor edx, ecx
shr eax, 8
xor eax, dword [edx*4 + 0x100c91d0]
inc esi
xor eax, dword [esi]
movzx ecx, al
shr eax, 8
pop edi
pop esi
xor eax, dword [ecx*4 + 0x100c91d0]
movzx ecx, al
shr eax, 8
xor eax, dword [ecx*4 + 0x100c91d0]
movzx ecx, al
shr eax, 8
xor eax, dword [ecx*4 + 0x100c91d0]
movzx ecx, al
shr eax, 8
xor eax, dword [ecx*4 + 0x100c91d0]
mov dword [ebx], eax
pop ebx
pop ebp
ret
movzx edx, byte [esi]
movzx ecx, al
xor edx, ecx
shr eax, 8
xor eax, dword [edx*4 + 0x100c91d0]
inc esi
movzx edx, byte [esi]
movzx ecx, al
xor edx, ecx
shr eax, 8
xor eax, dword [edx*4 + 0x100c91d0]
inc esi
movzx edx, byte [esi]
movzx ecx, al
xor edx, ecx
shr eax, 8
xor eax, dword [edx*4 + 0x100c91d0]
pop edi
pop esi
mov dword [ebx], eax
pop ebx
pop ebp
ret