joyce8/EMBER2024-capa huggingface dataset:
Function at 0x101e9b47
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
sub esp, 0x3c
mov dword [0x10223f98], 0x128e
mov dword [ebp - 0xc], 0
mov eax, dword fs:[0x30]
mov dword [ebp - 0xc], eax
xor ecx, ecx
mov edx, dword [ebp - 0xc]
mov edx, dword [edx + 0x10]
mov edx, dword [edx + 0x3c]
mov dword [0x10223f98], 0x278
mov esi, dword [0x10223f9c]
mov edi, esi
add edi, 0xffffe6f4
add esi, 0xffffee35
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x14], esi
mov dword [ebp - 0x18], edx
mov dword [ebp - 0x1c], edi
mov dword [ebp - 0x20], ecx
jmp 0x101e9c34
mov eax, dword [ebp - 0x24]
add eax, 0xfffffff4
mov dword [0x10223f98], 0x15d0
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x28]
cmp word [eax + ecx*2], 0x6f
je 0x101e9c16
jmp 0x101e9cce
mov dword [0x10223f98], 0x16f
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x24]
cmp word [eax + ecx*2 - 0x12], 0x64
je 0x101e9c86
jmp 0x101e9cce
mov eax, dword [ebp - 0x2c]
add eax, 1
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x30]
cmp eax, 0x104
mov ecx, dword [ebp - 0x14]
mov edx, dword [ebp - 0x30]
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x34], ecx
mov dword [ebp - 0x38], edx
jl 0x101e9c34
jmp 0x101e9c50
mov dword [0x10223f98], 0x19fd
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x24]
cmp word [eax + ecx*2 - 0x16], 0x61
je 0x101e9c71
jmp 0x101e9cce
mov eax, dword [ebp - 0x20]
mov ecx, dword [ebp - 0x18]
cmp word [ecx + eax*2], 0
mov edx, dword [ebp - 0x1c]
mov esi, eax
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x34], edx
mov dword [ebp - 0x38], esi
jne 0x101e9bf0
mov eax, dword [ebp - 0x38]
mov ecx, dword [ebp - 0x34]
mov dword [0x10223f98], ecx
mov ecx, dword [ebp - 0x18]
cmp word [ecx + eax*2 - 0x1a], 0x6c
mov dword [ebp - 0x24], eax
je 0x101e9ba6
jmp 0x101e9cce
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x24]
cmp word [eax + ecx*2 - 0x14], 0x64
je 0x101e9bce
jmp 0x101e9cce
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x24]
mov dx, word [eax + ecx*2 - 0x10]
mov word [ebp - 0x3a], dx
mov ax, word [ebp - 0x3a]
cmp ax, 0x6c
jne 0x101e9cce
mov dword [0x10223f9c], 0x1349
mov eax, dword [ebp - 0x24]
add eax, 0xfffffff9
shl eax, 1
mov ecx, dword [ebp - 0x18]
add ecx, eax
mov dword [ebp - 0x40], ecx
mov eax, 1
mov ecx, dword [ebp - 0x40]
cmp word [ecx], 0x6c
mov dword [ebp - 0x44], eax
je 0x101e9cd5
xor eax, eax
mov dword [ebp - 0x44], eax
jmp 0x101e9cd5
mov eax, dword [ebp - 0x44]
add esp, 0x3c
pop esi
pop edi
pop ebp
ret
Function at 0x10001000
Capabilities:
Create thread

Disassembly:
push 0
push 0
push 0
push 0x100012f0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
xor eax, eax
ret
Function at 0x1000465d
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x1000469c
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x1000469c
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x1000469c
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x1000469c
cmp dword [ecx + 0x74], 0xe
jbe 0x1000469c
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret
Function at 0x10007368
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
je 0x10007405
push ebx
push esi
call fcn.10007331
xor ebx, ebx
sub eax, esi
push ebx
push ebx
push ebx
push ebx
sar eax, 1
push eax
push esi
push ebx
push ebx
mov dword [ebp - 8], eax
call fcn.100072c5
add esp, 0x24
mov dword [ebp - 4], eax
test eax, eax
jne 0x100073b2
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x10007404
push edi
push eax
call fcn.10008323
mov edi, eax
pop ecx
push ebx
test edi, edi
jne 0x100073d2
call fcn.100052ed
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x10007403
push ebx
push dword [ebp - 4]
push edi
push dword [ebp - 8]
push esi
push ebx
push ebx
call fcn.100072c5
add esp, 0x20
test eax, eax
jne 0x100073f1
push edi
call fcn.100052ed
jmp 0x100073f9
push ebx
call fcn.100052ed
mov ebx, edi
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, ebx
pop edi
pop ebx
pop esi
leave
ret

Function at 0x10007672
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x1000f5d0
push 0x1000f5c8
push str.FlsAlloc
push 0x1f
call fcn.1000758e
mov esi, eax
add esp, 0x10
test esi, esi
je 0x100076a6
push dword [ebp + 8]
mov ecx, esi
call dword [0x1000e150]
call esi
jmp 0x100076ac
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
pop esi
pop ebp
ret 4

Function at 0x100076f0
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x1000f5e0
push 0x1000f5d8
push str.FlsGetValue
push 0x21
call fcn.1000758e
mov esi, eax
add esp, 0x10
test esi, esi
je 0x10007727
push dword [ebp + 8]
mov ecx, esi
call dword [0x1000e150]
call esi
pop esi
pop ebp
ret 4
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsGetValue]

Function at 0x1000772f
Capabilities:
Set thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x1000f5e8
push 0x1000f5e0
push str.FlsSetValue
push 0x22
call fcn.1000758e
mov esi, eax
add esp, 0x10
test esi, esi
je 0x10007769
push dword [ebp + 0xc]
mov ecx, esi
push dword [ebp + 8]
call dword [0x1000e150]
call esi
pop esi
pop ebp
ret 8
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsSetValue]
Function at 0x1000cd90
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x1000cdbd
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x1000cdbd
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret

Function at 0x43ad3f
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
pushal
call 0x43ad4e
pop dword [ebp - 0x18]
mov eax, 0x43ad4e
sub dword [ebp - 0x18], eax
mov dword [ebp - 0x28], 0xca0ed034
sub dword [ebp - 0x28], 0x7bbc8ae9
mov dword [ebp - 0x24], 0x1471446d
sub dword [ebp - 0x24], 0xe23df828
mov dword [ebp - 0x20], 0x5b78fcc6
sub dword [ebp - 0x20], 0xf2cb898
mov dword [ebp - 0x1c], 0xdef27194
add dword [ebp - 0x1c], 0x210d8e6c
lea eax, [ebp - 0x28]
push eax
mov eax, sym.imp.kernel32.dll_GetModuleHandleA
add eax, dword [ebp - 0x18]
call dword [eax]
mov dword [ebp - 0x28], 0xed337e75
sub dword [ebp - 0x28], 0x78c1151f
mov dword [ebp - 0x24], 0xe310f0a3
add dword [ebp - 0x24], 0x5e5b70d2
mov dword [ebp - 0x20], 0xf779b825
add dword [ebp - 0x20], 0x6bf5b447
mov dword [ebp - 0x1c], 0x5be5f4ee
add dword [ebp - 0x1c], 0xa41a0b12
lea ebx, [ebp - 0x28]
push ebx
push eax
mov eax, 0x35453810
add eax, 0xcb007870
add eax, dword [ebp - 0x18]
call dword [eax]
push 0x40
push 0x1000
push 0x50134
push 0
call eax
mov ecx, 0x5297
xor edx, edx
add edx, eax
mov ebx, 0x62597e0e
add ebx, 0x9dede1f2
add ebx, dword [ebp - 0x18]
mov esi, 0x9f5c942e
sub esi, 0x33fd0baf
sub dword [ebp - 0x10], 0xab3eba91
mov edi, dword [ebx]
sub dword [ebp - 0xc], eax
xor edi, esi
xor dword [ebp - 8], 0x74b6bef9
mov dword [edx], edi
add dword [ebp - 0x10], esi
add edx, 0x597fa047
sub edx, 0x597fa043
add ebx, 4
loop 0x43ae62
add eax, 0xbbf205cf
add eax, 0x440f3760
xor ebx, ebx
add ebx, eax
add eax, 0x3f255f3
sub eax, 0x3f255ee
mov ecx, 0x51853cce
add ecx, 0xaebac332
add ecx, dword [ebp - 0x18]
call ebx
leave
ret
Function at 0x1000ee80
Capabilities:
Create directory

Disassembly:
mov eax, dword [sym.rlmfc.dll_int_R_File::m_archiveHandling]
sub esp, 0x100
cmp eax, 1
push esi
push edi
jne 0x1000ee9b
lea edi, [ecx + 1]
lea edx, [esp + 8]
jmp 0x1000eea1
lea edx, [esp + 8]
mov edi, ecx
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
shr ecx, 2
mov esi, edi
mov edi, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
or ecx, 0xffffffff
xor eax, eax
lea edi, [esp + 8]
repne scasb al, byte es:[edi]
not ecx
dec ecx
test ecx, ecx
pop edi
pop esi
jle 0x1000eee2
lea eax, [esp]
dec eax
cmp byte [eax + ecx], 0x5c
je 0x1000eee2
dec ecx
test ecx, ecx
jg 0x1000eed7
mov byte [esp + ecx], 0
push 0
lea ecx, [esp + 4]
push ecx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
add esp, 0x100
ret

Function at 0x1000ef00
Capabilities:
Accept command line arguments
Get common file path
Set current directory

Disassembly:
mov eax, dword [sym.rlmfc.dll_unsigned_int_R_File::instance]
sub esp, 0x100
push ebp
mov ebp, ecx
mov ecx, eax
inc eax
test ecx, ecx
mov dword [sym.rlmfc.dll_unsigned_int_R_File::instance], eax
jne 0x1000ef6a
call fcn.10015b60
mov dword [sym.rlmfc.dll_class_R_DLList_struct_R_File::R_RASArchive___R_File::RASArchiveList], eax
call fcn.10015b60
mov dword [sym.rlmfc.dll_class_R_DLList_struct_R_File::R_RASArchive___R_File::RASArchiveListSwap], eax
call fcn.10015c80
mov dword [sym.rlmfc.dll_class_R_DLList_int___R_File::m_findDirIDList], eax
call fcn.10015de0
mov dword [0x10051b94], eax
call fcn.10015de0
mov dword [0x10051b98], eax
call fcn.10015de0
mov dword [0x10051b9c], eax
call fcn.10015de0
mov dword [0x10051ba0], eax
call fcn.10015de0
mov dword [0x10051ba4], eax
push esi
push sym.rlmfc.dll_char__R_File::m_strStartupDirectory
push 0xff
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
mov esi, dword [sym.imp.KERNEL32.dll_GetCommandLineA]
call esi
cmp byte [eax], 0x22
push 0xff
jne 0x1000efa3
call esi
inc eax
push eax
lea edx, [esp + 0x10]
push edx
call dword [sym.imp.MSVCRT.dll_strncpy]
add esp, 0xc
mov al, 0x22
jmp 0x1000efb6
call esi
push eax
lea eax, [esp + 0x10]
push eax
call dword [sym.imp.MSVCRT.dll_strncpy]
add esp, 0xc
mov al, 0x20
movsx ecx, al
push ecx
lea edx, [esp + 0xc]
push edx
mov byte [esp + 0x10f], 0
call dword [sym.imp.MSVCRT.dll_strchr]
add esp, 8
test eax, eax
pop esi
je 0x1000efd8
mov byte [eax], 0
push edi
or ecx, 0xffffffff
xor eax, eax
lea edi, [esp + 8]
repne scasb al, byte es:[edi]
not ecx
mov dl, byte [esp + ecx + 6]
add ecx, 0xfffffffe
mov al, 0x5c
cmp dl, al
pop edi
je 0x1000effd
mov dl, byte [esp + ecx + 3]
dec ecx
cmp dl, al
jne 0x1000eff4
lea eax, [esp + 4]
push eax
mov byte [esp + ecx + 8], 0
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
push sym.rlmfc.dll_char__R_File::m_originalLocalDirPath
push 0xff
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
push 1
mov ecx, ebp
call sym.rlmfc.dll_public:_void___thiscall_R_File::setOverride_int_
mov ecx, ebp
call sym.rlmfc.dll_private:_bool___thiscall_R_File::loadArchives_void_
mov eax, ebp
pop ebp
add esp, 0x100
ret
Function at 0x1000f5c0
Capabilities:
Get common file path
Set current directory

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x10028630
push eax
mov dword fs:[0], esp
sub esp, 0xc
push esi
push edi
mov edi, ecx
call sym.rlmfc.dll_private:_void___thiscall_R_File::unloadArchives_void_
mov esi, dword [esp + 0x24]
push esi
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
test eax, eax
jne 0x1000f681
lea ecx, [esp + 8]
call sym.rlmfc.dll_protected:_void___thiscall_R_Exception::constructor_void_
push esi
lea eax, [esp + 0xc]
push str.Directory__s_not_found
mov edi, vtable.R_FileException_DirectoryNotFound.0
push eax
mov dword [esp + 0x28], 0
mov dword [esp + 0x14], edi
call sym.rlmfc.dll_public:_void___cdecl_R_Exception::setError_char_const__
add esp, 0xc
mov cl, byte [0x1006261c]
mov eax, 1
test al, cl
mov dword [esp + 0x1c], eax
jne 0x1000f65b
mov dl, cl
or dl, al
mov ecx, 0x10062620
mov byte [0x1006261c], dl
call sym.rlmfc.dll_protected:_void___thiscall_R_Exception::constructor_void_
push 0x100160a0
mov dword [0x10062620], edi
call fcn.100281de
add esp, 4
lea ecx, [esp + 8]
push ecx
mov ecx, 0x10062620
call sym.rlmfc.dll_public:_class_R_Exception____thiscall_R_Exception::operator_class_R_Exception_const__
push 0x1002cf90
lea edx, [esp + 0x28]
push edx
mov dword [esp + 0x2c], 0x10062620
call sub.MSVCRT.dll__CxxThrowException
push sym.rlmfc.dll_char__R_File::m_originalLocalDirPath
push 0xff
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
mov ecx, edi
call sym.rlmfc.dll_private:_bool___thiscall_R_File::loadArchives_void_
mov ecx, dword [esp + 0x14]
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x18
ret 4
Function at 0x10012290
Capabilities:
Write file on windows

Disassembly:
sub esp, 0x200
push ebx
push esi
push edi
mov edi, dword [esp + 0x210]
mov esi, ecx
mov edx, edi
lea ecx, [esp + 0xc]
xor ebx, ebx
call sym.rlmfc.dll_private:_static_void___fastcall_R_File::relativeToAbsolutePath_char___char_const__
lea edx, [esp + 0xc]
lea ecx, [esp + 0x10c]
call sym.rlmfc.dll_private:_static_void___fastcall_R_File::absolutePathToDirStructure_char___char_const__
lea ecx, [esp + 0xc]
call sym.rlmfc.dll_private:_static_void___fastcall_R_File::checkPathExistence_char_const__
mov eax, dword [esi + 0x568]
test eax, eax
je 0x100122da
push edi
mov ecx, esi
call sym.rlmfc.dll_public:_int___thiscall_R_File::del_char_const__
push edi
mov ecx, esi
call sym.rlmfc.dll_public:_enum_R_File::Location___thiscall_R_File::where_char_const__
cmp eax, 2
jne 0x100122f5
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0x200
ret 0xc
lea eax, [esp + 0x10c]
push 0x1003db08
push eax
call dword [sym.imp.MSVCRT.dll_fopen]
mov esi, eax
add esp, 8
test esi, esi
je 0x10012345
mov ecx, dword [esp + 0x218]
mov edx, dword [esp + 0x214]
push esi
push ecx
push 1
push edx
call dword [sym.imp.MSVCRT.dll_fwrite]
push esi
call dword [sym.imp.MSVCRT.dll_fclose]
add esp, 0x14
pop edi
pop esi
mov eax, 1
pop ebx
add esp, 0x200
ret 0xc
pop edi
pop esi
mov eax, ebx
pop ebx
add esp, 0x200
ret 0xc

Function at 0x10012360
Capabilities:
Write file on windows

Disassembly:
sub esp, 0x200
push ebx
mov ebx, dword [esp + 0x208]
push esi
push edi
mov edi, ecx
mov edx, ebx
lea ecx, [esp + 0xc]
call sym.rlmfc.dll_private:_static_void___fastcall_R_File::relativeToAbsolutePath_char___char_const__
lea edx, [esp + 0xc]
lea ecx, [esp + 0x10c]
call sym.rlmfc.dll_private:_static_void___fastcall_R_File::absolutePathToDirStructure_char___char_const__
lea ecx, [esp + 0xc]
call sym.rlmfc.dll_private:_static_void___fastcall_R_File::checkPathExistence_char_const__
lea eax, [esp + 0x10c]
push 0x1003db0c
push eax
call dword [sym.imp.MSVCRT.dll_fopen]
mov esi, eax
add esp, 8
test esi, esi
je 0x100123f1
push 2
push 0
push esi
call dword [sym.imp.MSVCRT.dll_fseek]
mov ecx, dword [esp + 0x224]
mov edx, dword [esp + 0x220]
push esi
push ecx
push 1
push edx
call dword [sym.imp.MSVCRT.dll_fwrite]
push esi
call dword [sym.imp.MSVCRT.dll_fclose]
add esp, 0x20
pop edi
pop esi
mov eax, 1
pop ebx
add esp, 0x200
ret 0xc
mov eax, dword [esp + 0x218]
mov ecx, dword [esp + 0x214]
push eax
push ecx
push ebx
mov ecx, edi
call sym.rlmfc.dll_public:_int___thiscall_R_File::save_char_const___void_const___unsigned_int_
pop edi
pop esi
pop ebx
add esp, 0x200
ret 0xc

Function at 0x10012420
Capabilities:
Delete file

Disassembly:
mov edx, dword [esp + 4]
sub esp, 0x200
lea ecx, [esp]
call sym.rlmfc.dll_private:_static_void___fastcall_R_File::relativeToAbsolutePath_char___char_const__
lea edx, [esp]
lea ecx, [esp + 0x100]
call sym.rlmfc.dll_private:_static_void___fastcall_R_File::absolutePathToDirStructure_char___char_const__
lea eax, [esp + 0x100]
push eax
call dword [sym.imp.MSVCRT.dll_remove]
neg eax
sbb eax, eax
inc eax
add esp, 0x204
ret 4
Function at 0x100126f0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov edx, dword [esp + 4]
sub esp, 0x20c
push esi
lea ecx, [esp + 0x10]
xor esi, esi
call sym.rlmfc.dll_private:_static_void___fastcall_R_File::relativeToAbsolutePath_char___char_const__
lea edx, [esp + 0x10]
lea ecx, [esp + 0x110]
call sym.rlmfc.dll_private:_static_void___fastcall_R_File::absolutePathToDirStructure_char___char_const__
lea eax, [esp + 0x110]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x10012738
mov eax, 2
pop esi
add esp, 0x20c
ret 4
lea edx, [esp + 0x10]
lea ecx, [esp + 4]
call sym.rlmfc.dll_private:_static_void___fastcall_R_File::searchFile_struct_R_File::R_RASFind___char_const__
mov eax, dword [esp + 4]
test eax, eax
je 0x1001275c
mov eax, 1
pop esi
add esp, 0x20c
ret 4
lea edx, [esp + 0x10]
lea ecx, [esp + 4]
call sym.rlmfc.dll_private:_static_void___fastcall_R_File::searchDir_struct_R_File::R_RASFind___char_const__
mov eax, dword [esp + 4]
test eax, eax
mov eax, 1
jne 0x10012778
mov eax, esi
pop esi
add esp, 0x20c
ret 4

Function at 0x10012cc0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov edx, dword [esp + 4]
sub esp, 0x20c
lea ecx, [esp + 0xc]
call sym.rlmfc.dll_private:_static_void___fastcall_R_File::relativeToAbsolutePath_char___char_const__
lea edx, [esp + 0xc]
lea ecx, [esp + 0x10c]
call sym.rlmfc.dll_private:_static_void___fastcall_R_File::absolutePathToDirStructure_char___char_const__
lea eax, [esp + 0x10c]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x10012d08
test al, 0x10
je 0x10012d08
mov eax, 1
add esp, 0x20c
ret 4
lea edx, [esp + 0xc]
lea ecx, [esp]
call sym.rlmfc.dll_private:_static_void___fastcall_R_File::searchDir_struct_R_File::R_RASFind___char_const__
mov ecx, dword [esp]
xor eax, eax
test ecx, ecx
setne al
add esp, 0x20c
ret 4

Function at 0x100134a0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 0x10]
test eax, eax
jne 0x100134b2
mov dword [ebp + 0x10], 1
push edi
mov edi, dword [ebp + 0xc]
test edi, edi
mov dword [ebp - 4], 0
jle 0x10013534
push ebx
push esi
mov esi, dword [ebp + 8]
mov eax, dword [ebp - 4]
cdq
mov ecx, 5
idiv ecx
mov dword [ebp + 0xc], edx
mov ecx, dword [ebp + 0xc]
mov ebx, dword [ebp + 8]
add ebx, dword [ebp - 4]
mov al, byte [ebx]
rol al, cl
mov byte [ebx], al
mov ecx, dword [ebp + 0x10]
mov eax, 0xb92143fb
imul ecx
add edx, ecx
sar edx, 7
mov eax, edx
shr eax, 0x1f
add edx, eax
imul edx, edx, 0x763d
lea eax, [ecx*8]
sub eax, ecx
lea eax, [ecx + eax*8]
lea ecx, [eax + eax*2]
mov eax, ecx
mov ecx, dword [ebp - 4]
sub eax, edx
mov edx, eax
mov al, cl
add al, 3
mov bl, 6
imul bl
xor al, byte [ecx + esi]
add al, dl
mov byte [ecx + esi], al
inc ecx
cmp ecx, edi
mov dword [ebp + 0x10], edx
mov dword [ebp - 4], ecx
jl 0x100134c6
pop esi
pop ebx
pop edi
mov esp, ebp
pop ebp
ret 0xc
Function at 0x10013a40
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push esi
mov esi, dword [esp + 0xc]
or eax, 0xffffffff
xor ecx, ecx
test esi, esi
jbe 0x10013a7c
push ebx
push edi
mov edi, dword [esp + 0x10]
xor edx, edx
mov dl, byte [ecx + edi]
mov ebx, eax
and ebx, 0xff
shr eax, 8
and edx, 0xff
xor edx, ebx
mov edx, dword [edx*4 + 0x1003d220]
xor eax, edx
inc ecx
cmp ecx, esi
jb 0x10013a54
pop edi
pop ebx
not eax
pop esi
ret 8
Function at 0x100153f0
Capabilities:
Read file on windows

Disassembly:
sub esp, 0x10
push ebx
mov ebx, dword [esp + 0x1c]
push ebp
mov ebp, ecx
mov ecx, dword [ebp + 8]
mov eax, dword [ebp + 0xc]
lea edx, [ecx + ebx]
cmp edx, eax
push esi
push edi
mov dword [esp + 0x10], 0
jb 0x10015416
sub eax, ecx
mov ebx, eax
test ebx, ebx
jbe 0x100154ac
lea esi, [ebp + 0x34]
mov edx, dword [ebp + 0x30]
mov eax, dword [esi]
cmp edx, eax
jge 0x10015469
sub eax, edx
cmp ebx, eax
jge 0x10015432
mov eax, ebx
mov esi, dword [ebp + 0x24]
mov edi, dword [esp + 0x24]
add esi, edx
mov ecx, eax
mov edx, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, dword [esp + 0x24]
mov edx, dword [ebp + 0x30]
mov ecx, dword [esp + 0x10]
add edi, eax
add edx, eax
sub ebx, eax
add ecx, eax
mov dword [esp + 0x24], edi
mov dword [ebp + 0x30], edx
mov dword [esp + 0x10], ecx
test ebx, ebx
je 0x100154ac
mov al, byte [ebp + 0x38]
test al, al
jne 0x100154c2
mov eax, dword [ebp + 0x20]
mov ecx, dword [ebp + 0x24]
mov edx, dword [ebp + 0x18]
push 0
lea esi, [ebp + 0x34]
push esi
push eax
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov eax, dword [ebp + 0x2c]
mov ecx, dword [esi]
mov dword [ebp + 0x30], eax
cmp ecx, dword [ebp + 0x20]
mov dword [ebp + 0x2c], 0
jge 0x100154a4
mov byte [ebp + 0x38], 1
test ebx, ebx
ja 0x10015421
mov ecx, dword [ebp + 8]
mov eax, dword [esp + 0x10]
pop edi
add ecx, eax
pop esi
mov dword [ebp + 8], ecx
pop ebp
pop ebx
add esp, 0x10
ret 8
mov edx, dword [ebp + 0x14]
mov esi, dword [edx + 4]
lea ecx, [esp + 0x14]
call sym.rlmfc.dll_protected:_void___thiscall_R_Exception::constructor_void_
push esi
lea eax, [esp + 0x18]
push str.Overreading_stream__s
mov edi, vtable.R_FileException_OverreadingStream.0
push eax
mov dword [esp + 0x20], edi
call sym.rlmfc.dll_public:_void___cdecl_R_Exception::setError_char_const__
mov al, byte [0x1006256c]
add esp, 0xc
test al, 1
jne 0x1001551e
mov dl, al
or dl, 1
mov ecx, 0x10062570
mov byte [0x1006256c], dl
call sym.rlmfc.dll_protected:_void___thiscall_R_Exception::constructor_void_
push 0x10015ff0
mov dword [0x10062570], edi
call fcn.100281de
add esp, 4
lea ecx, [esp + 0x14]
push ecx
mov ecx, 0x10062570
call sym.rlmfc.dll_public:_class_R_Exception____thiscall_R_Exception::operator_class_R_Exception_const__
push 0x1002dac0
lea edx, [esp + 0x28]
push edx
mov dword [esp + 0x2c], 0x10062570
call sub.MSVCRT.dll__CxxThrowException
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop

Function at 0x1001ac20
Capabilities:
Resolve function by parsing pe exports

Disassembly:
call sym.rlmfc.dll_protected:_static_struct_R_Profile::R_PENTRY____fastcall_R_Profile::find_char_const__
test eax, eax
je 0x1001ac30
mov ecx, eax
jmp sym.rlmfc.dll_protected:_static_void___fastcall_R_Profile::clearEntry_struct_R_Profile::R_PENTRY__
ret
Function at 0x1001ac40
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push ecx
push ebx
push esi
push edi
xor edi, edi
mov eax, 0xbf800000
mov dword [ecx + 0x5c], edi
mov dword [ecx + 0x64], edi
mov dword [ecx + 0x38], edi
mov dword [ecx + 0x40], edi
mov dword [ecx + 0x30], edi
mov dword [ecx + 0x54], eax
mov dword [ecx + 0x58], eax
mov dword [ecx + 0x4c], edi
mov dword [ecx + 0x50], edi
mov dword [ecx + 0x60], edi
mov dword [ecx + 0x68], edi
mov dword [ecx + 0x74], edi
mov dword [ecx + 0x78], edi
mov dword [ecx + 0x7c], edi
mov dword [ecx + 0x80], edi
mov dword [ecx + 0x84], edi
mov dword [ecx + 0x88], edi
mov dword [ecx + 0x8c], edi
mov dword [ecx + 0x90], edi
mov dword [ecx + 0x94], edi
mov dword [ecx + 0x98], edi
mov dword [ecx + 0x9c], edi
mov dword [ecx + 0xa0], edi
mov dword [ecx + 0x3c], edi
mov dword [ecx + 0x44], edi
mov dword [ecx + 0x34], edi
mov eax, dword [ecx + 0x24]
cmp eax, edi
je 0x1001ad38
mov edx, dword [ecx + 0x28]
sub edx, eax
mov eax, 0x66666667
imul edx
sar edx, 4
mov eax, edx
shr eax, 0x1f
add edx, eax
je 0x1001ad38
mov esi, dword [ecx + 0x28]
lea edx, [esi]
cmp edx, esi
je 0x1001ad29
lea eax, [edx - 0x18]
mov ebx, dword [edx]
mov dword [eax - 0x10], ebx
mov ebx, dword [edx + 4]
mov dword [eax - 0xc], ebx
mov ebx, dword [eax + 0x20]
mov dword [eax - 8], ebx
mov ebx, dword [eax + 0x24]
mov dword [eax - 4], ebx
mov ebx, dword [eax + 0x28]
mov dword [eax], ebx
mov ebx, dword [eax + 0x2c]
mov dword [eax + 4], ebx
mov ebx, dword [eax + 0x30]
mov dword [eax + 8], ebx
mov ebx, dword [eax + 0x34]
mov dword [eax + 0xc], ebx
mov ebx, dword [eax + 0x38]
mov dword [eax + 0x10], ebx
mov ebx, dword [eax + 0x3c]
mov dword [eax + 0x14], ebx
add edx, 0x28
add eax, 0x28
cmp edx, esi
jne 0x1001ace5
mov eax, dword [ecx + 0x28]
add eax, 0xffffffd8
mov dword [esp + 0xc], eax
mov dword [ecx + 0x28], eax
jmp 0x1001acba
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret