joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10006830
Capabilities:
Create directory
Download url
Receive data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100cc5b0
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
mov eax, dword [0x101025ec]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push 1
sub esp, 8
mov dword [ebp - 4], 1
lea ecx, [ebp + 0x20]
call fcn.10007d50
push eax
push 0
lea eax, [ebp - 0x28]
push eax
lea ecx, [ebp + 0x20]
call fcn.10007610
cmp dword [ebp - 0x14], 8
lea esi, [ebp - 0x28]
cmovae esi, dword [ebp - 0x28]
push esi
call dword [sym.imp.SHLWAPI.dll_PathIsRootW]
test eax, eax
jne 0x100068a6
push esi
call dword [sym.imp.SHLWAPI.dll_PathIsDirectoryW]
test eax, eax
jne 0x100068a6
push eax
push esi
push eax
call dword [sym.imp.SHELL32.dll_SHCreateDirectoryExW]
cmp dword [ebp + 0x34], 8
lea ecx, [ebp + 0x20]
push 0
cmovae ecx, dword [ebp + 0x20]
lea eax, [ebp + 8]
cmp dword [ebp + 0x1c], 8
push 0
cmovae eax, dword [ebp + 8]
push ecx
push eax
push 0
call dword [sym.imp.urlmon.dll_URLDownloadToFileW]
mov esi, eax
neg esi
sbb esi, esi
cmp dword [ebp - 0x14], 8
jb 0x100068e1
push dword [ebp - 0x28]
call fcn.1002f7b8
add esp, 4
xor eax, eax
mov dword [ebp - 0x14], 7
cmp dword [ebp + 0x1c], 8
mov dword [ebp - 0x18], 0
mov word [ebp - 0x28], ax
jb 0x10006906
push dword [ebp + 8]
call fcn.1002f7b8
add esp, 4
xor eax, eax
mov dword [ebp + 0x1c], 7
cmp dword [ebp + 0x34], 8
mov dword [ebp + 0x18], 0
mov word [ebp + 8], ax
jb 0x1000692b
push dword [ebp + 0x20]
call fcn.1002f7b8
add esp, 4
lea eax, [esi + 1]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1002f7bd
mov esp, ebp
pop ebp
ret

Function at 0x10006c60
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
push ecx
cmp dword [0x1010aa18], 0
push esi
push edi
mov edi, edx
jne 0x10006d3e
mov dword [0x1010aa18], 1
xor esi, esi
mov eax, esi
and al, 1
movzx ecx, al
mov eax, esi
neg ecx
sbb ecx, ecx
shr eax, 1
and ecx, 0xedb88320
xor ecx, eax
mov eax, ecx
and al, 1
movzx edx, al
neg edx
sbb edx, edx
shr ecx, 1
and edx, 0xedb88320
xor edx, ecx
mov eax, edx
and al, 1
movzx ecx, al
neg ecx
sbb ecx, ecx
shr edx, 1
and ecx, 0xedb88320
xor ecx, edx
mov eax, ecx
and al, 1
movzx edx, al
neg edx
sbb edx, edx
shr ecx, 1
and edx, 0xedb88320
xor edx, ecx
mov eax, edx
and al, 1
movzx ecx, al
neg ecx
sbb ecx, ecx
shr edx, 1
and ecx, 0xedb88320
xor ecx, edx
mov eax, ecx
and al, 1
movzx edx, al
neg edx
sbb edx, edx
shr ecx, 1
and edx, 0xedb88320
xor edx, ecx
mov eax, edx
and al, 1
movzx ecx, al
neg ecx
sbb ecx, ecx
shr edx, 1
and ecx, 0xedb88320
xor ecx, edx
mov eax, ecx
and al, 1
movzx eax, al
neg eax
sbb eax, eax
shr ecx, 1
and eax, 0xedb88320
xor eax, ecx
mov dword [esi*4 + 0x10107de0], eax
inc esi
cmp esi, 0x100
jl 0x10006c81
mov esi, dword [ebp + 8]
or eax, 0xffffffff
xor edx, edx
test esi, esi
jle 0x10006d6b
lea ebx, [ebx]
movsx ecx, byte [edx + edi]
inc edx
xor ecx, eax
shr eax, 8
and ecx, 0xff
xor eax, dword [ecx*4 + 0x10107de0]
cmp edx, esi
jl 0x10006d50
pop edi
not eax
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x10006d80
Capabilities:
Parse url

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100cc628
mov eax, dword fs:[0]
push eax
mov eax, 0x1488
call fcn.1003e850
mov eax, dword [0x101025ec]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
xor eax, eax
mov dword [ebp - 4], 0
push 0x1fe
push eax
mov word [ebp - 0x410], ax
lea eax, [ebp - 0x40e]
push eax
call fcn.10034ae0
xor eax, eax
push 0xfe
push eax
mov word [ebp - 0x210], ax
lea eax, [ebp - 0x20e]
push eax
call fcn.10034ae0
xor eax, eax
push 0xfe
push eax
mov word [ebp - 0x110], ax
lea eax, [ebp - 0x10e]
push eax
call fcn.10034ae0
xor eax, eax
push 0x1046
push eax
mov word [ebp - 0x1458], ax
lea eax, [ebp - 0x1456]
push eax
call fcn.10034ae0
push 0x38
lea eax, [ebp - 0x1490]
push 0
push eax
call fcn.10034ae0
lea eax, [ebp - 0x410]
mov dword [ebp - 0x1494], 0x3c
mov dword [ebp - 0x1484], eax
lea ecx, [ebp - 0x1494]
add esp, 0x3c
mov dword [ebp - 0x1480], 0x100
cmp dword [ebp + 0x1c], 8
lea eax, [ebp - 0x210]
mov dword [ebp - 0x1478], eax
lea eax, [ebp - 0x110]
mov dword [ebp - 0x1470], eax
lea eax, [ebp - 0x1458]
push ecx
mov dword [ebp - 0x1468], eax
lea eax, [ebp + 8]
cmovae eax, dword [ebp + 8]
push 0
push 0
push eax
mov dword [ebp - 0x1474], 0x80
mov dword [ebp - 0x146c], 0x80
mov dword [ebp - 0x1464], 0x824
call dword [sym.imp.WININET.dll_InternetCrackUrlW]
test eax, eax
je 0x10006f3b
mov eax, dword [ebp - 0x1488]
cmp eax, 3
je 0x10006ecd
cmp eax, 4
jne 0x10006f3b
mov edx, dword [ebp - 0x1484]
mov esi, 1
cmp word [edx], 0
jne 0x10006ee2
xor ecx, ecx
jmp 0x10006ef6
mov ecx, edx
lea edi, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x10006ee7
sub ecx, edi
sar ecx, 1
push ecx
push edx
mov ecx, ebx
call fcn.10001b10
mov edx, dword [ebp - 0x1468]
cmp word [edx], 0
jne 0x10006f19
xor ecx, ecx
push ecx
push edx
lea ecx, [ebx + 0x18]
call fcn.10001b10
jmp 0x10006f3d
mov ecx, edx
lea edi, [ecx + 2]
mov edi, edi
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x10006f20
sub ecx, edi
sar ecx, 1
push ecx
push edx
lea ecx, [ebx + 0x18]
call fcn.10001b10
jmp 0x10006f3d
xor esi, esi
cmp dword [ebp + 0x1c], 8
jb 0x10006f4e
push dword [ebp + 8]
call fcn.1002f7b8
add esp, 4
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1002f7bd
mov esp, ebp
pop ebp
ret
Function at 0x10007030
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x64
mov eax, dword [0x101025ec]
xor eax, ebp
mov dword [ebp - 8], eax
push esi
push edi
push 0x40
lea eax, [ebp - 0x50]
mov esi, edx
push 0
push eax
mov edi, ecx
call fcn.10034ae0
add esp, 0xc
mov dword [ebp - 0x54], 0x44
xorps xmm0, xmm0
movdqu xmmword [ebp - 0x64], xmm0
test edi, edi
je 0x100070d1
lea eax, [ebp - 0x64]
push eax
lea eax, [ebp - 0x54]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
push edi
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x100070d1
test esi, esi
je 0x100070ac
movdqu xmm0, xmmword [ebp - 0x64]
mov eax, 1
movdqu xmmword [esi], xmm0
pop edi
pop esi
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.1002f7bd
mov esp, ebp
pop ebp
ret
push dword [ebp - 0x64]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push dword [ebp - 0x60]
call esi
mov eax, 1
pop edi
pop esi
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.1002f7bd
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 8]
xor eax, eax
pop edi
xor ecx, ebp
pop esi
call fcn.1002f7bd
mov esp, ebp
pop ebp
ret

Function at 0x10008dc0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100cc768
mov eax, dword fs:[0]
push eax
sub esp, 8
mov eax, dword [0x101025ec]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
lea ecx, [esi + 0x30]
mov dword [ebp - 4], 0
lea eax, [ebp + 8]
cmp ecx, eax
je 0x10008e07
push 0xffffffffffffffff
push 0
push eax
call fcn.10001790
lea eax, [ebp - 0x14]
mov byte [esi + 0x2c], 1
push eax
push 0
push esi
push 0x10009bb0
push 0
push 0
mov byte [esi + 0x48], 1
lea edi, [esi + 0x24]
mov dword [ebp - 0x14], 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
test edi, edi
je 0x10008e37
mov dword [edi], eax
jmp 0x10008e3e
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp + 0x1c], 8
jb 0x10008e4f
push dword [ebp + 8]
call fcn.1002f7b8
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1002f7bd
mov esp, ebp
pop ebp
ret 0x18
Function at 0x1000a9d0
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100cc99a
mov eax, dword fs:[0]
push eax
sub esp, 0x80c
mov eax, dword [0x101025ec]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x818], esi
mov dword [ebp - 0x814], 0
mov dword [ebp - 4], 3
xor eax, eax
push 7
mov dword [esi + 0x14], 7
mov dword [esi + 0x10], 0
push 0x100f1898
mov word [esi], ax
call fcn.10001b10
xor eax, eax
mov dword [ebp - 0x814], 1
push 0x7fe
push eax
mov word [ebp - 0x810], ax
lea eax, [ebp - 0x80e]
push eax
call fcn.10034ae0
add esp, 0xc
lea ecx, [ebp + 8]
cmp dword [ebp + 0x1c], 8
lea edx, [ebp + 0x38]
lea eax, [ebp + 0x20]
cmovae ecx, dword [ebp + 8]
cmp dword [ebp + 0x4c], 8
push ecx
cmovae edx, dword [ebp + 0x38]
lea ecx, [ebp - 0x810]
cmp dword [ebp + 0x34], 8
push 0x800
cmovae eax, dword [ebp + 0x20]
push ecx
push 0
push edx
push eax
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
test eax, eax
je 0x1000aace
cmp word [ebp - 0x810], 0
jne 0x1000aaa6
xor eax, eax
jmp 0x1000aabf
lea eax, [ebp - 0x810]
lea edx, [eax + 2]
nop
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x1000aab0
sub eax, edx
sar eax, 1
push eax
lea eax, [ebp - 0x810]
mov ecx, esi
push eax
call fcn.10001b10
cmp dword [ebp + 0x1c], 8
jb 0x1000aadf
push dword [ebp + 8]
call fcn.1002f7b8
add esp, 4
xor eax, eax
mov dword [ebp + 0x1c], 7
cmp dword [ebp + 0x34], 8
mov dword [ebp + 0x18], 0
mov word [ebp + 8], ax
jb 0x1000ab04
push dword [ebp + 0x20]
call fcn.1002f7b8
add esp, 4
xor eax, eax
mov dword [ebp + 0x34], 7
cmp dword [ebp + 0x4c], 8
mov dword [ebp + 0x30], 0
mov word [ebp + 0x20], ax
jb 0x1000ab29
push dword [ebp + 0x38]
call fcn.1002f7b8
add esp, 4
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1002f7bd
mov esp, ebp
pop ebp
ret
Function at 0x1000acb0
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x804
mov eax, dword [0x101025ec]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
xor eax, eax
mov esi, 0xabababab
push 0x7fe
push eax
mov word [ebp - 0x804], ax
lea eax, [ebp - 0x802]
push eax
call fcn.10034ae0
add esp, 0xc
lea ecx, [ebp + 8]
cmp dword [ebp + 0x1c], 8
lea edx, [ebp + 0x38]
lea eax, [ebp + 0x20]
cmovae ecx, dword [ebp + 8]
cmp dword [ebp + 0x4c], 8
push ecx
cmovae edx, dword [ebp + 0x38]
lea ecx, [ebp - 0x804]
cmp dword [ebp + 0x34], 8
push 0x800
cmovae eax, dword [ebp + 0x20]
push ecx
push 0
push edx
push eax
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
test eax, eax
je 0x1000ad34
lea eax, [ebp - 0x804]
push eax
call fcn.1002ff7a
add esp, 4
mov esi, eax
cmp dword [ebp + 0x1c], 8
jb 0x1000ad45
push dword [ebp + 8]
call fcn.1002f7b8
add esp, 4
xor eax, eax
mov dword [ebp + 0x1c], 7
cmp dword [ebp + 0x34], 8
mov dword [ebp + 0x18], 0
mov word [ebp + 8], ax
jb 0x1000ad6a
push dword [ebp + 0x20]
call fcn.1002f7b8
add esp, 4
xor eax, eax
mov dword [ebp + 0x34], 7
cmp dword [ebp + 0x4c], 8
mov dword [ebp + 0x30], 0
mov word [ebp + 0x20], ax
jb 0x1000ad8f
push dword [ebp + 0x38]
call fcn.1002f7b8
add esp, 4
mov ecx, dword [ebp - 4]
mov eax, esi
xor ecx, ebp
pop esi
call fcn.1002f7bd
mov esp, ebp
pop ebp
ret

Function at 0x1000b0e0
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
test esi, esi
je 0x1000b149
test edx, edx
je 0x1000b149
xor eax, eax
test edx, edx
jle 0x1000b149
cmp edx, 0x20
jb 0x1000b13c
mov ecx, edx
push edi
and ecx, 0x8000001f
jns 0x1000b106
dec ecx
or ecx, 0xffffffe0
inc ecx
movdqa xmm1, xmmword [0x100f3130]
mov edi, edx
sub edi, ecx
lea ecx, [esi + 0x10]
movdqu xmm0, xmmword [ecx - 0x10]
add eax, 0x20
lea ecx, [ecx + 0x20]
pxor xmm0, xmm1
movdqu xmmword [ecx - 0x30], xmm0
movdqu xmm0, xmmword [ecx - 0x20]
pxor xmm0, xmm1
movdqu xmmword [ecx - 0x20], xmm0
cmp eax, edi
jl 0x1000b115
pop edi
cmp eax, edx
jge 0x1000b149
xor byte [eax + esi], 0xbb
inc eax
cmp eax, edx
jl 0x1000b140
pop esi
ret
Function at 0x1000d100
Capabilities:
Copy file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100ccda6
mov eax, dword fs:[0]
push eax
sub esp, 0xa4
mov eax, dword [0x101025ec]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
call fcn.1000c950
lea ebx, [esi + 0x60]
push 0x100f13b0
mov edx, ebx
lea ecx, [ebp - 0x98]
call fcn.10008700
add esp, 4
push str.Update.exe
mov edx, eax
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x38]
call fcn.10003a00
add esp, 4
mov edi, eax
push 0x100f13b0
lea edx, [esi + 0x78]
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x68]
call fcn.10008700
add esp, 4
push str.Update.exe
mov edx, eax
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x80]
call fcn.10003a00
add esp, 4
cmp dword [edi + 0x14], 8
jb 0x1000d19d
mov edi, dword [edi]
cmp dword [eax + 0x14], 8
jb 0x1000d1a5
mov eax, dword [eax]
push 0
push edi
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileW]
cmp dword [ebp - 0x6c], 8
jb 0x1000d1c0
push dword [ebp - 0x80]
call fcn.1002f7b8
add esp, 4
xor eax, eax
mov dword [ebp - 0x6c], 7
cmp dword [ebp - 0x54], 8
mov dword [ebp - 0x70], 0
mov word [ebp - 0x80], ax
jb 0x1000d1e5
push dword [ebp - 0x68]
call fcn.1002f7b8
add esp, 4
xor eax, eax
mov dword [ebp - 0x54], 7
cmp dword [ebp - 0x24], 8
mov dword [ebp - 0x58], 0
mov word [ebp - 0x68], ax
jb 0x1000d20a
push dword [ebp - 0x38]
call fcn.1002f7b8
add esp, 4
xor eax, eax
mov dword [ebp - 4], 0xffffffff
cmp dword [ebp - 0x84], 8
mov dword [ebp - 0x24], 7
mov dword [ebp - 0x28], 0
mov word [ebp - 0x38], ax
jb 0x1000d23c
push dword [ebp - 0x98]
call fcn.1002f7b8
add esp, 4
push dword [ebp + 0xc]
xor eax, eax
xorps xmm0, xmm0
push dword [ebp + 8]
mov word [ebp - 0x20], ax
mov dword [ebp - 0x16], eax
mov word [ebp - 0x12], ax
lea eax, [ebp - 0x20]
push str._d__d
push eax
movq qword [ebp - 0x1e], xmm0
call dword [sym.imp.USER32.dll_wsprintfW]
push 0x100f13b0
mov edx, ebx
lea ecx, [ebp - 0xb0]
call fcn.10008700
add esp, 0x14
push str.Update.exe
mov edx, eax
mov dword [ebp - 4], 3
lea ecx, [ebp - 0x50]
call fcn.10003a00
add esp, 4
cmp dword [eax + 0x14], 8
jb 0x1000d29c
mov eax, dword [eax]
push ecx
lea ecx, [ebp - 0x20]
push ecx
push 1
mov ecx, eax
call fcn.10005670
add esp, 0xc
test eax, eax
sete bl
cmp dword [ebp - 0x3c], 8
jb 0x1000d2c3
push dword [ebp - 0x50]
call fcn.1002f7b8
add esp, 4
xor eax, eax
mov dword [ebp - 0x3c], 7
cmp dword [ebp - 0x9c], 8
mov dword [ebp - 0x40], 0
mov word [ebp - 0x50], ax
jb 0x1000d2ee
push dword [ebp - 0xb0]
call fcn.1002f7b8
add esp, 4
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1002f7bd
mov esp, ebp
pop ebp
ret 8
Function at 0x1000f940
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100cd1a7
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push esi
push edi
mov eax, dword [0x101025ec]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x14], edi
mov dword [ebp - 0x10], 0
mov dword [edi], 0x100f1c34
mov dword [edi + 0x10], 0x100f1c2c
mov dword [edi + 0x78], vtable.std::basic_ios_char__struct_std::char_traits_char__.0
push ecx
lea esi, [edi + 0x18]
mov dword [ebp - 4], 0
push esi
mov dword [ebp - 0x10], 1
call fcn.10010810
mov dword [ebp - 4], 1
mov eax, dword [edi]
mov eax, dword [eax + 4]
mov dword [edi + eax], vtable.std::basic_fstream_char__struct_std::char_traits_char__.0
mov eax, dword [edi]
mov ecx, dword [eax + 4]
lea eax, [ecx - 0x78]
mov dword [ecx + edi - 4], eax
mov ecx, esi
call fcn.10010e90
lea eax, [esi + 4]
mov dword [esi], vtable.std::basic_filebuf_char__struct_std::char_traits_char__.0
mov dword [esi + 0xc], eax
lea ecx, [esi + 8]
lea eax, [esi + 0x14]
mov byte [esi + 0x4c], 0
mov dword [esi + 0x1c], eax
lea eax, [esi + 0x18]
mov dword [esi + 0x20], eax
lea eax, [esi + 0x24]
mov dword [esi + 0x2c], eax
lea eax, [esi + 0x28]
mov dword [esi + 0x30], eax
mov byte [esi + 0x45], 0
mov dword [esi + 0x10], ecx
mov dword [ecx], 0
mov eax, dword [esi + 0x20]
mov dword [eax], 0
mov eax, dword [esi + 0x30]
mov dword [eax], 0
mov eax, dword [esi + 0xc]
mov dword [eax], 0
mov eax, dword [esi + 0x1c]
mov dword [eax], 0
mov eax, dword [esi + 0x2c]
mov dword [eax], 0
mov eax, dword [0x1010aa44]
mov dword [esi + 0x48], eax
mov eax, edi
mov dword [esi + 0x50], 0
mov dword [esi + 0x40], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x10010ad0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x100cd2d8
mov eax, dword fs:[0]
push eax
sub esp, 0x28
mov eax, dword [0x101025ec]
xor eax, esp
mov dword [esp + 0x20], eax
push ebx
push esi
push edi
mov eax, dword [0x101025ec]
xor eax, esp
push eax
lea eax, [esp + 0x38]
mov dword fs:[0], eax
mov ebx, ecx
cmp dword [ebx + 0x40], 0
je 0x10010c24
cmp byte [ebx + 0x45], 0
je 0x10010c24
mov eax, dword [ebx]
push 0xffffffffffffffff
call dword [eax + 0xc]
cmp eax, 0xffffffff
jne 0x10010b30
xor al, al
jmp 0x10010c26
mov ecx, 0xf
mov byte [esp + 0x18], 0
xorps xmm0, xmm0
mov dword [esp + 0x2c], ecx
cmp ecx, 0x10
movq qword [esp + 0x18], xmm0
lea eax, [esp + 0x18]
mov dword [esp + 0x28], 8
cmovae eax, dword [esp + 0x18]
mov byte [eax + 8], 0
mov dword [esp + 0x40], 0
jmp 0x10010b70
cmp dword [esp + 0x2c], 0x10
lea eax, [esp + 0x14]
mov ecx, dword [ebx + 0x40]
lea edi, [esp + 0x18]
cmovae edi, dword [esp + 0x18]
lea esi, [esp + 0x18]
cmovae esi, dword [esp + 0x18]
push eax
mov eax, dword [esp + 0x2c]
mov edx, dword [ecx]
add eax, edi
push eax
push esi
lea eax, [ebx + 0x48]
push eax
call dword [edx + 0x20]
sub eax, 0
je 0x10010bb1
dec eax
je 0x10010bb5
sub eax, 2
je 0x10010c0b
xor bl, bl
jmp 0x10010c0d
mov byte [ebx + 0x45], 0
mov ecx, dword [esp + 0x2c]
lea eax, [esp + 0x18]
mov edx, dword [esp + 0x18]
cmp ecx, 0x10
mov esi, dword [esp + 0x14]
cmovae eax, edx
sub esi, eax
je 0x10010bec
push dword [ebx + 0x50]
cmp ecx, 0x10
lea eax, [esp + 0x1c]
push esi
cmovae eax, edx
push 1
push eax
call fcn.10032134
add esp, 0x10
cmp esi, eax
jne 0x10010bad
cmp byte [ebx + 0x45], 0
je 0x10010c0b
test esi, esi
jne 0x10010b70
push esi
push 8
lea ecx, [esp + 0x20]
call fcn.10008930
jmp 0x10010b70
mov bl, 1
cmp dword [esp + 0x2c], 0x10
jb 0x10010c20
push dword [esp + 0x18]
call fcn.1002f7b8
add esp, 4
mov al, bl
jmp 0x10010c26
mov al, 1
mov ecx, dword [esp + 0x38]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x20]
xor ecx, esp
call fcn.1002f7bd
mov esp, ebp
pop ebp
ret
Function at 0x10011620
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100cd40a
mov eax, dword fs:[0]
push eax
sub esp, 0x18
mov eax, dword [0x101025ec]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov edi, dword [ebp + 8]
push 0
mov dword [ebp - 0x18], esi
call fcn.1002f246
mov dword [ebp - 4], 0
mov dword [esi + 4], 0
mov byte [esi + 8], 0
mov dword [esi + 0xc], 0
mov byte [esi + 0x10], 0
xor eax, eax
mov dword [esi + 0x14], 0
mov word [esi + 0x18], ax
mov dword [esi + 0x1c], eax
mov word [esi + 0x20], ax
mov dword [esi + 0x24], eax
mov byte [esi + 0x28], al
mov dword [esi + 0x2c], eax
mov byte [esi + 0x30], al
mov byte [ebp - 4], 6
test edi, edi
jne 0x100116c6
lea eax, [ebp - 0x14]
mov dword [ebp - 0x14], str.bad_locale_name
push eax
lea ecx, [ebp - 0x24]
call fcn.10031c37
push 0x100fd4e8
lea eax, [ebp - 0x24]
mov dword [ebp - 0x24], vtable.std::runtime_error.0
push eax
call fcn.100337ab
push edi
push esi
call fcn.1002f119
add esp, 8
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1002f7bd
mov esp, ebp
pop ebp
ret 4

Function at 0x10012510
Capabilities:
Get file size
Hash data with md5
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [0x101025ec]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, ecx
push edi
mov edi, dword [ebp + 8]
cmp dword [esi + 4], 0
jne 0x1001253e
push 0xf4240
call fcn.1002ed8d
add esp, 4
mov dword [esi + 4], eax
push 0
push 0x80
push 3
push 0
push 1
push SysReAllocString
push edi
mov dword [esi + 8], 0x67452301
mov dword [esi + 0xc], 0xefcdab89
mov dword [esi + 0x10], 0x98badcfe
mov dword [esi + 0x14], 0x10325476
mov dword [esi + 0x18], 0
mov dword [esi + 0x1c], 0
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x100125fc
push 0
push ebx
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov edi, eax
test edi, edi
jle 0x100125d4
jmp 0x100125a0
push 0
lea eax, [ebp - 8]
mov dword [ebp - 8], 0
push eax
push 0xf4240
push dword [esi + 4]
push ebx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x100125f5
push dword [ebp - 8]
mov ecx, esi
push dword [esi + 4]
call fcn.10012620
sub edi, dword [ebp - 8]
test edi, edi
jg 0x100125a0
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, esi
call fcn.10012720
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1002f7bd
mov esp, ebp
pop ebp
ret 4
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 4]
mov eax, 0x100f1358
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1002f7bd
mov esp, ebp
pop ebp
ret 4
Function at 0x10014dd0
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
test edx, edx
jne 0x10014ddb
xor eax, eax
pop ebp
ret
push esi
mov esi, dword [ebp + 8]
not ecx
cmp esi, 8
jb 0x10014ea5
push edi
mov edi, esi
shr edi, 3
movzx eax, byte [edx]
sub esi, 8
xor eax, ecx
shr ecx, 8
and eax, 0xff
xor ecx, dword [eax*4 + 0x100f0770]
movzx eax, byte [edx + 1]
xor eax, ecx
shr ecx, 8
and eax, 0xff
xor ecx, dword [eax*4 + 0x100f0770]
movzx eax, byte [edx + 2]
xor eax, ecx
shr ecx, 8
and eax, 0xff
xor ecx, dword [eax*4 + 0x100f0770]
movzx eax, byte [edx + 3]
xor eax, ecx
shr ecx, 8
and eax, 0xff
xor ecx, dword [eax*4 + 0x100f0770]
movzx eax, byte [edx + 4]
xor eax, ecx
shr ecx, 8
and eax, 0xff
xor ecx, dword [eax*4 + 0x100f0770]
movzx eax, byte [edx + 5]
xor eax, ecx
shr ecx, 8
and eax, 0xff
xor ecx, dword [eax*4 + 0x100f0770]
movzx eax, byte [edx + 6]
xor eax, ecx
shr ecx, 8
and eax, 0xff
xor ecx, dword [eax*4 + 0x100f0770]
movzx eax, byte [edx + 7]
add edx, 8
xor eax, ecx
shr ecx, 8
and eax, 0xff
xor ecx, dword [eax*4 + 0x100f0770]
dec edi
jne 0x10014df0
pop edi
test esi, esi
je 0x10014eca
lea esp, [esp]
movzx eax, byte [edx]
lea edx, [edx + 1]
xor eax, ecx
shr ecx, 8
and eax, 0xff
xor ecx, dword [eax*4 + 0x100f0770]
dec esi
jne 0x10014eb0
not ecx
mov eax, ecx
pop esi
pop ebp
ret

Function at 0x10014ee0
Capabilities:
Generate random numbers using the delphi lcg
Hash data with crc32

Disassembly:
push esi
push edi
mov edi, ecx
movsx eax, dl
mov esi, dword [edi]
xor eax, esi
and eax, 0xff
shr esi, 8
mov eax, dword [eax*4 + 0x100f0770]
xor eax, esi
mov dword [edi], eax
movzx eax, al
add eax, dword [edi + 4]
imul ecx, eax, 0x8088405
mov eax, dword [edi + 8]
inc ecx
mov dword [edi + 4], ecx
shr ecx, 0x18
xor ecx, eax
shr eax, 8
and ecx, 0xff
xor eax, dword [ecx*4 + 0x100f0770]
mov dword [edi + 8], eax
pop edi
pop esi
ret

Function at 0x10014f30
Capabilities:
Generate random numbers using the delphi lcg
Hash data with crc32

Disassembly:
push ebx
push esi
mov bl, dl
mov edx, ecx
push edi
mov edi, dword [edx + 8]
mov esi, edi
mov ecx, dword [edx]
and esi, 0xfffd
or esi, 2
mov eax, esi
xor eax, 1
imul eax, esi
shr eax, 8
xor bl, al
movsx eax, bl
xor eax, ecx
shr ecx, 8
and eax, 0xff
mov eax, dword [eax*4 + 0x100f0770]
xor eax, ecx
mov dword [edx], eax
movzx eax, al
add eax, dword [edx + 4]
imul eax, eax, 0x8088405
inc eax
mov dword [edx + 4], eax
shr eax, 0x18
xor eax, edi
shr edi, 8
and eax, 0xff
xor edi, dword [eax*4 + 0x100f0770]
mov al, bl
mov dword [edx + 8], edi
pop edi
pop esi
pop ebx
ret