joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10007ef0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [ebp + 0x10]
push ebx
mov ebx, ecx
mov ecx, dword [ebp + 0xc]
push esi
mov esi, dword [ebp + 8]
mov dword [ebp - 4], esi
test eax, eax
jg 0x10007f1c
jl 0x10007f10
test ecx, ecx
jne 0x10007f1c
pop esi
xor eax, eax
xor edx, edx
pop ebx
mov esp, ebp
pop ebp
ret 0xc
cmp dword [ebx + 0x38], 0
je 0x10007f35
push eax
push ecx
push esi
mov ecx, ebx
call dword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____thiscall_std::basic_streambuf_char__struct_std::char_traits_char__::xsgetn_char___long_long___int64__]
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov eax, dword [ebx + 0x1c]
push edi
mov edi, ecx
mov eax, dword [eax]
mov dword [ebp - 8], eax
test eax, eax
je 0x10007f7d
mov eax, dword [ebx + 0x2c]
lea edx, [ebx + 0x2c]
mov dword [ebp - 0xc], edx
mov eax, dword [eax]
test eax, eax
je 0x10007f83
cmp eax, ecx
mov esi, ecx
cmovb esi, eax
push esi
push dword [ebp - 8]
push dword [ebp - 4]
call sub.VCRUNTIME140.dll_memcpy
mov eax, dword [ebx + 0x2c]
sub edi, esi
add dword [ebp - 4], esi
add esp, 0xc
sub dword [eax], esi
mov eax, dword [ebx + 0x1c]
add dword [eax], esi
mov esi, dword [ebp - 4]
jmp 0x10007f83
lea eax, [ebx + 0x2c]
mov dword [ebp - 0xc], eax
cmp dword [ebx + 0x4c], 0
je 0x10007ff6
mov ecx, dword [ebx + 0xc]
lea eax, [ebx + 0x3c]
cmp dword [ecx], eax
jne 0x10007fac
mov eax, dword [ebx + 0xc]
mov edx, dword [ebx + 0x54]
mov ecx, dword [ebx + 0x50]
sub edx, ecx
mov dword [eax], ecx
mov eax, dword [ebx + 0x1c]
mov dword [eax], ecx
mov eax, dword [ebp - 0xc]
mov eax, dword [eax]
mov dword [eax], edx
mov eax, dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
cmp edi, 0xfff
jbe 0x10007fe4
nop dword [eax]
push dword [ebx + 0x4c]
push 0xfff
push 1
push esi
call eax
add esp, 0x10
add esi, eax
sub edi, eax
cmp eax, 0xfff
jne 0x10007ff6
cmp edi, eax
mov eax, dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
ja 0x10007fc0
test edi, edi
je 0x10007ff6
push dword [ebx + 0x4c]
push edi
push 1
push esi
call eax
add esp, 0x10
sub edi, eax
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 0x10]
sub eax, edi
pop edi
pop esi
sbb edx, 0
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x10008360
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
mov eax, dword [0x1005b008]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, ecx
cmp ebx, 0xffffffff
jne 0x10008390
pop esi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1004c44e
mov esp, ebp
pop ebp
ret 4
mov eax, dword [esi + 0x20]
mov eax, dword [eax]
test eax, eax
je 0x100083c0
mov edx, dword [esi + 0x30]
mov edx, dword [edx]
add edx, eax
cmp eax, edx
jae 0x100083c0
call dword [sym.imp.MSVCP140.dll_protected:_char____thiscall_std::basic_streambuf_char__struct_std::char_traits_char__::_Pninc_void_]
pop esi
mov byte [eax], bl
mov eax, ebx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1004c44e
mov esp, ebp
pop ebp
ret 4
cmp dword [esi + 0x4c], 0
push edi
je 0x10008498
mov edi, dword [esi + 0xc]
lea eax, [esi + 0x3c]
cmp dword [edi], eax
jne 0x100083e9
mov edx, dword [esi + 0x54]
mov ecx, dword [esi + 0x50]
sub edx, ecx
mov dword [edi], ecx
mov eax, dword [esi + 0x1c]
mov dword [eax], ecx
mov eax, dword [esi + 0x2c]
mov dword [eax], edx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x100083f5
movsx eax, bl
jmp 0x1000842d
lea eax, [ebp - 0x2c]
mov byte [ebp - 0x25], bl
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x25]
push eax
lea eax, [esi + 0x40]
push eax
call dword [sym.imp.MSVCP140.dll_public:_int___thiscall_std::codecvt_char__char__struct__Mbstatet_::out_struct__Mbstatet___char_const___char_const___char_const____char___char___char___const]
sub eax, 0
je 0x10008457
sub eax, 1
je 0x10008457
sub eax, 2
jne 0x10008498
movsx eax, byte [ebp - 0x25]
push dword [esi + 0x4c]
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
add esp, 8
or ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, ebx
pop edi
pop esi
mov eax, ecx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1004c44e
mov esp, ebp
pop ebp
ret 4
mov edi, dword [ebp - 0x2c]
lea eax, [ebp - 0x24]
sub edi, eax
je 0x10008475
push dword [esi + 0x4c]
push edi
push 1
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
add esp, 0x10
cmp edi, eax
jne 0x10008498
lea ecx, [ebp - 0x25]
mov byte [esi + 0x3d], 1
or eax, 0xffffffff
cmp dword [ebp - 0x30], ecx
pop edi
pop esi
cmovne eax, ebx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1004c44e
mov esp, ebp
pop ebp
ret 4
mov ecx, dword [ebp - 4]
or eax, 0xffffffff
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1004c44e
mov esp, ebp
pop ebp
ret 4
Function at 0x10008d70
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x1005b008]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, ecx
cmp dword [esi + 0x38], 0
je 0x10008e2c
cmp byte [esi + 0x3d], 0
je 0x10008e2c
mov eax, dword [esi]
push edi
push 0xffffffffffffffff
call dword [eax + 0xc]
cmp eax, 0xffffffff
je 0x10008e1a
mov ecx, dword [esi + 0x38]
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [esi + 0x40]
push eax
call dword [sym.imp.MSVCP140.dll_public:_int___thiscall_std::codecvt_char__char__struct__Mbstatet_::unshift_struct__Mbstatet___char___char___char___const]
sub eax, 0
je 0x10008de1
sub eax, 1
je 0x10008de5
sub eax, 2
jne 0x10008e1a
mov byte [esi + 0x3d], al
mov al, 1
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1004c44e
mov esp, ebp
pop ebp
ret
mov byte [esi + 0x3d], 0
mov edi, dword [ebp - 0x28]
lea eax, [ebp - 0x24]
sub edi, eax
je 0x10008e03
push dword [esi + 0x4c]
push edi
push 1
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
add esp, 0x10
cmp edi, eax
jne 0x10008e1a
cmp byte [esi + 0x3d], 0
pop edi
sete al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1004c44e
mov esp, ebp
pop ebp
ret
pop edi
xor al, al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1004c44e
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
mov al, 1
xor ecx, ebp
pop esi
call fcn.1004c44e
mov esp, ebp
pop ebp
ret

Function at 0x1000bd20
Capabilities:
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
mov edi, edx
not ebx
mov esi, ecx
mov eax, ebx
test edi, edi
je 0x1000bd81
mov cl, byte [esi]
lea esi, [esi + 1]
dec edi
cmp cl, 0x23
jne 0x1000bd64
cmp edi, 2
jb 0x1000bd64
cmp byte [esi], cl
jne 0x1000bd64
cmp byte [esi + 1], cl
jne 0x1000bd64
mov eax, ebx
movzx ecx, cl
movzx edx, al
xor edx, ecx
shr eax, 8
xor eax, dword [edx*4 + 0x10050408]
jmp 0x1000bd35
movzx edx, al
movzx ecx, cl
xor edx, ecx
shr eax, 8
xor eax, dword [edx*4 + 0x10050408]
test edi, edi
jne 0x1000bd35
pop edi
pop esi
not eax
pop ebx
pop ebp
ret
mov cl, byte [esi]
inc esi
test cl, cl
je 0x1000bdb0
cmp cl, 0x23
jne 0x1000bd97
cmp byte [esi], cl
jne 0x1000bd97
cmp byte [esi + 1], cl
cmove eax, ebx
movzx edx, al
movzx ecx, cl
xor edx, ecx
shr eax, 8
mov cl, byte [esi]
inc esi
xor eax, dword [edx*4 + 0x10050408]
test cl, cl
jne 0x1000bd88
pop edi
pop esi
not eax
pop ebx
pop ebp
ret
Function at 0x1000bec0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
test ebx, ebx
je 0x1000bed4
mov dword [ebx], 0
mov edx, 0x10055464
call fcn.1000bdc0
mov esi, eax
test esi, esi
je 0x1000bfc2
mov edi, dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_ftell]
push esi
call edi
add esp, 4
mov dword [ebp - 4], eax
cmp eax, 0xffffffff
je 0x1000bfb8
push 2
push 0
push esi
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fseek]
add esp, 0xc
test eax, eax
jne 0x1000bfb8
push esi
call edi
mov edi, eax
add esp, 4
mov dword [ebp + 8], edi
cmp edi, 0xffffffff
je 0x1000bfb8
push 0
push dword [ebp - 4]
push esi
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fseek]
add esp, 0xc
test eax, eax
jne 0x1000bfb8
mov eax, dword [0x1006ef44]
test eax, eax
je 0x1000bf4c
inc dword [eax + 0xac]
push edi
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov edi, eax
add esp, 4
test edi, edi
je 0x1000bfb8
push esi
push dword [ebp + 8]
push 1
push edi
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
add esp, 0x10
push esi
cmp eax, dword [ebp + 8]
je 0x1000bf9d
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
mov eax, dword [0x1006ef44]
add esp, 4
test eax, eax
je 0x1000bf8a
dec dword [eax + 0xac]
push edi
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
add esp, 4
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
add esp, 4
test ebx, ebx
je 0x1000bfaf
mov eax, dword [ebp + 8]
mov dword [ebx], eax
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push esi
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
add esp, 4
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1000bfd0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
mov bl, byte [edx]
movzx eax, bl
shr eax, 3
mov dword [ebp - 0xc], ecx
push esi
push edi
movsx ecx, byte [eax + 0x10054884]
xor eax, eax
test ecx, ecx
mov dword [ebp - 8], ecx
sete al
add eax, ecx
mov ecx, dword [ebp + 8]
mov dword [ebp - 0x10], eax
test ecx, ecx
jne 0x1000c004
lea ecx, [eax + edx]
cmp edx, ecx
lea esi, [edx + 1]
sbb al, al
and al, bl
mov byte [ebp - 3], al
cmp esi, ecx
jae 0x1000c018
mov ah, byte [esi]
jmp 0x1000c01a
xor ah, ah
lea esi, [edx + 2]
mov byte [ebp - 2], ah
cmp esi, ecx
jae 0x1000c028
mov bl, byte [esi]
jmp 0x1000c02a
xor bl, bl
add edx, 3
mov byte [ebp - 1], bl
cmp edx, ecx
jae 0x1000c038
mov cl, byte [edx]
jmp 0x1000c03a
xor cl, cl
mov edx, dword [ebp - 8]
movzx edi, ah
movzx eax, al
movzx esi, bl
movzx ebx, cl
mov byte [ebp + 0xb], cl
mov ecx, dword [edx*4 + 0x100548a4]
and ecx, eax
mov eax, edi
and eax, 0x3f
shl ecx, 6
or ecx, eax
and edi, 0xc0
shl ecx, 6
mov eax, esi
and eax, 0x3f
and esi, 0xc0
or ecx, eax
mov eax, ebx
and eax, 0x3f
shr ebx, 2
or ebx, esi
shl ecx, 6
mov esi, dword [ebp - 8]
or ecx, eax
mov eax, dword [edx*4 + 0x10050184]
shrx edx, ecx, eax
mov eax, dword [ebp - 0xc]
shr ebx, 2
or ebx, edi
mov edi, 0x80
shr ebx, 2
cmp edx, dword [esi*4 + 0x100548b8]
mov dword [eax], edx
sbb eax, eax
xor ecx, ecx
and eax, 0x40
or ebx, eax
mov eax, edx
and eax, 0xfffff800
cmp eax, 0xd800
mov eax, 0xffff
cmove ecx, edi
or ebx, ecx
cmp eax, edx
pop edi
sbb eax, eax
and eax, 0x100
or ebx, eax
mov eax, dword [esi*4 + 0x100548cc]
xor ebx, 0x2a
sarx eax, ebx, eax
pop esi
pop ebx
test eax, eax
je 0x1000c128
xor ecx, ecx
cmp byte [ebp - 3], cl
setne cl
xor eax, eax
cmp byte [ebp + 0xb], al
setne al
add ecx, eax
xor eax, eax
cmp byte [ebp - 1], al
setne al
add ecx, eax
xor eax, eax
cmp byte [ebp - 2], al
setne al
add ecx, eax
mov eax, dword [ebp - 0xc]
cmp dword [ebp - 0x10], ecx
cmovl ecx, dword [ebp - 0x10]
mov dword [eax], 0xfffd
mov eax, ecx
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 0x10]
mov esp, ebp
pop ebp
ret
Function at 0x1000ed00
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [0x1005b008]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
lea edx, [ebp - 8]
push ebx
push esi
push edi
mov edi, ecx
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], eax
mov esi, 4
mov eax, dword [edi + 0xe4]
mov ebx, dword [edi + 0xec]
mov ebx, dword [ebx + eax*4 - 4]
not ebx
nop dword [eax + eax]
movzx eax, byte [edx]
lea edx, [edx + 1]
movzx ecx, bl
xor ecx, eax
shr ebx, 8
xor ebx, dword [ecx*4 + 0x10050408]
sub esi, 1
jne 0x1000ed40
mov eax, dword [edi]
not ebx
cmp dword [eax + 0x3e8c], ebx
jne 0x1000ed77
push ecx
push dword [ebp - 0xc]
lea edx, [esi + 4]
mov ecx, ebx
call fcn.100219d0
add esp, 8
mov ecx, dword [ebp - 4]
mov eax, ebx
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1004c44e
mov esp, ebp
pop ebp
ret 4
Function at 0x100128a0
Capabilities:
Hash data with crc32

Disassembly:
mov eax, ecx
or ecx, 0xffffffff
push ebx
push esi
mov bl, byte [eax]
lea esi, [eax + 1]
test bl, bl
je 0x100128dd
push edi
or edi, 0xffffffff
cmp bl, 0x23
jne 0x100128c3
cmp byte [esi], bl
jne 0x100128c3
cmp byte [esi + 1], bl
cmove ecx, edi
movzx edx, cl
movzx eax, bl
mov bl, byte [esi]
xor edx, eax
shr ecx, 8
inc esi
xor ecx, dword [edx*4 + 0x10050408]
test bl, bl
jne 0x100128b4
pop edi
pop esi
not ecx
pop ebx
jmp fcn.10012840
Function at 0x10020370
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push ecx
push ebx
push esi
push edi
mov edi, ecx
mov ebx, edx
cmp dword [edi + 0x5ad0], 0
lea esi, [edi + 0x5ad4]
je 0x100203f2
mov ecx, dword [esi + 4]
test ecx, ecx
jns 0x100203ac
mov eax, ecx
cdq
sub eax, edx
sar eax, 1
add eax, ecx
xor ecx, ecx
test eax, eax
cmovg ecx, eax
push ecx
mov ecx, esi
call fcn.10022510
push dword [ebp + 8]
mov ecx, esi
mov dword [esi], 0
push ebx
call fcn.1000c350
mov edx, dword [esi]
mov ecx, 0x1006ef40
push dword [edi + 0x5ad0]
lea eax, [edx - 1]
neg edx
sbb edx, edx
and edx, eax
mov eax, dword [edi + 0x5adc]
test eax, eax
push edx
cmovne ecx, eax
push 1
push ecx
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
add esp, 0x10
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push dword [ebp + 8]
mov ecx, esi
push ebx
call fcn.1000c350
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x100207e0
Capabilities:
Hash data with crc32

Disassembly:
push ebx
mov bl, byte [ecx]
or eax, 0xffffffff
push esi
lea esi, [ecx + 1]
push edi
mov edi, dword [0x1006ef44]
test bl, bl
je 0x10020826
or edi, 0xffffffff
cmp bl, 0x23
jne 0x10020807
cmp byte [esi], bl
jne 0x10020807
cmp byte [esi + 1], bl
cmove eax, edi
movzx edx, al
movzx ecx, bl
mov bl, byte [esi]
xor edx, ecx
shr eax, 8
inc esi
xor eax, dword [edx*4 + 0x10050408]
test bl, bl
jne 0x100207f8
mov edi, dword [0x1006ef44]
mov esi, dword [edi + 0x5a74]
xor ecx, ecx
not eax
test esi, esi
jle 0x1002084c
mov edi, dword [edi + 0x5a7c]
lea edx, [edi + 4]
nop dword [eax]
cmp dword [edx], eax
je 0x10020852
inc ecx
add edx, 0x24
cmp ecx, esi
jl 0x10020840
pop edi
pop esi
xor eax, eax
pop ebx
ret
lea eax, [ecx + ecx*8]
lea eax, [edi + eax*4]
pop edi
pop esi
pop ebx
ret

Function at 0x10020a80
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
mov eax, dword [0x1006ef44]
sub esp, 8
vxorps xmm0, xmm0, xmm0
push esi
mov esi, ecx
push edi
vmovss dword [eax + 0x5a64], xmm0
test esi, esi
je 0x10020adf
lea ecx, [esp + 0xc]
mov dword [esp + 0xc], 0
call fcn.10020af0
mov edx, 0x10055468
mov ecx, esi
mov edi, eax
call fcn.1000bdc0
mov esi, eax
test esi, esi
je 0x10020adf
push esi
push dword [esp + 0x10]
push 1
push edi
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
push esi
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
add esp, 0x14
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x10023e40
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
mov eax, dword [0x1005b008]
xor eax, ebp
mov dword [ebp - 4], eax
vmovq xmm0, qword [ebp + 0xc]
mov eax, dword [ebp + 0x20]
lea ecx, [ebp - 0x18]
push ebx
mov ebx, dword [ebp + 0x14]
mov edx, 0x12
push esi
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x34]
vmovq qword [ebp - 0x28], xmm0
vmovq xmm0, qword [ebp + 0x18]
push edi
push eax
mov dword [ebp - 0x20], ebx
vmovq qword [ebp - 0x18], xmm0
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0xc], 0
mov dword [ebp - 8], 0
call fcn.10023980
add esp, 4
xor esi, esi
vmovq xmm0, qword [eax]
mov eax, dword [eax + 8]
vmovq qword [ebp - 0x18], xmm0
mov dword [ebp - 0x10], eax
nop dword [eax]
cmp dword [ebp - 0x14], eax
jge 0x10023ecc
lea ecx, [ebp - 0x18]
call fcn.100237e0
mov dword [ebp + esi*4 - 0xc], eax
inc esi
cmp esi, 2
jge 0x10023ecc
mov eax, dword [ebp - 0x10]
jmp 0x10023eb0
mov edi, dword [ebp - 8]
test edi, edi
je 0x10023fa8
mov ecx, dword [ebp - 0xc]
test ecx, ecx
je 0x10023fa8
xor edx, edx
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0
test edi, edi
js 0x10023f10
test ecx, ecx
js 0x10023f10
cmp edi, ebx
jg 0x10023f10
mov eax, ebx
sub eax, edi
cmp ecx, eax
jg 0x10023f10
mov eax, dword [ebp - 0x28]
mov edx, ecx
add eax, edi
mov dword [ebp - 0x18], eax
vmovq xmm0, qword [ebp - 0x18]
lea eax, [ebp - 0x34]
mov dword [ebp - 0x10], edx
push eax
mov edx, 0x13
lea ecx, [ebp - 0x18]
vmovq qword [ebp - 0x18], xmm0
call fcn.10023980
add esp, 4
xor esi, esi
vmovq xmm0, qword [eax]
mov eax, dword [eax + 8]
vmovq qword [ebp - 0x18], xmm0
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x14], eax
jge 0x10023f5e
lea ecx, [ebp - 0x18]
call fcn.100237e0
mov dword [ebp + esi*4 - 0x1c], eax
inc esi
cmp esi, 1
jge 0x10023f5e
mov eax, dword [ebp - 0x10]
jmp 0x10023f42
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x10023fa8
add eax, edi
cmp eax, ebx
jg 0x10023f72
mov dword [ebp - 0x24], eax
test eax, eax
jns 0x10023f75
mov dword [ebp - 0x24], ebx
lea eax, [ebp - 0x34]
push eax
lea ecx, [ebp - 0x28]
call fcn.100236f0
mov edx, dword [ebp + 8]
add esp, 4
vmovq xmm0, qword [eax]
mov ecx, dword [eax + 8]
mov eax, edx
pop edi
pop esi
vmovq qword [edx], xmm0
mov dword [edx + 8], ecx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1004c44e
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 4]
pop edi
mov dword [ebp - 0x18], 0
xor ecx, ebp
mov dword [ebp - 0x14], 0
vmovq xmm0, qword [ebp - 0x18]
pop esi
vmovq qword [eax], xmm0
mov dword [eax + 8], 0
pop ebx
call fcn.1004c44e
mov esp, ebp
pop ebp
ret
Function at 0x1002ac30
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push esi
mov esi, ecx
push edi
mov edi, dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov ecx, dword [esi + 8]
test ecx, ecx
je 0x1002ac6a
mov eax, dword [0x1006ef44]
mov dword [esi + 4], 0
mov dword [esi], 0
test eax, eax
je 0x1002ac5d
dec dword [eax + 0xac]
push ecx
call edi
add esp, 4
mov dword [esi + 8], 0
mov ecx, dword [esi + 0x14]
test ecx, ecx
je 0x1002ac9b
mov eax, dword [0x1006ef44]
mov dword [esi + 0x10], 0
mov dword [esi + 0xc], 0
test eax, eax
je 0x1002ac8e
dec dword [eax + 0xac]
push ecx
call edi
add esp, 4
mov dword [esi + 0x14], 0
mov ecx, dword [esi + 0x20]
test ecx, ecx
je 0x1002accc
mov eax, dword [0x1006ef44]
mov dword [esi + 0x1c], 0
mov dword [esi + 0x18], 0
test eax, eax
je 0x1002acbf
dec dword [eax + 0xac]
push ecx
call edi
add esp, 4
mov dword [esi + 0x20], 0
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x34], 0
mov dword [esi + 0x38], 0
mov ecx, dword [esi + 0x44]
test ecx, ecx
je 0x1002ad19
mov eax, dword [0x1006ef44]
mov dword [esi + 0x40], 0
mov dword [esi + 0x3c], 0
test eax, eax
je 0x1002ad0c
dec dword [eax + 0xac]
push ecx
call edi
add esp, 4
mov dword [esi + 0x44], 0
mov ecx, dword [esi + 0x50]
test ecx, ecx
je 0x1002ad4a
mov eax, dword [0x1006ef44]
mov dword [esi + 0x4c], 0
mov dword [esi + 0x48], 0
test eax, eax
je 0x1002ad3d
dec dword [eax + 0xac]
push ecx
call edi
add esp, 4
mov dword [esi + 0x50], 0
mov ecx, dword [esi + 0x5c]
test ecx, ecx
je 0x1002ad7b
mov eax, dword [0x1006ef44]
mov dword [esi + 0x58], 0
mov dword [esi + 0x54], 0
test eax, eax
je 0x1002ad6e
dec dword [eax + 0xac]
push ecx
call edi
add esp, 4
mov dword [esi + 0x5c], 0
pop edi
lea ecx, [esi + 0x78]
pop esi
jmp fcn.1002d5c0
Function at 0x100330f0
Capabilities:
Log keystrokes via polling

Disassembly:
mov ecx, dword [0x1006ef44]
mov edx, 0x210
push esi
push edi
call fcn.10018080
mov edi, dword [sym.imp.USER32.dll_GetKeyState]
cmp byte [eax], 0
je 0x10033169
mov edx, 0x210
call fcn.1000b3b0
cmp byte [eax + 8], 0
jne 0x10033169
push 0xa0
call edi
mov ecx, dword [0x1006ef44]
shr eax, 0xf
test al, 1
jne 0x10033169
cmp byte [ecx + 0x3769], 0
lea esi, [ecx + 8]
je 0x10033155
push 0
push 0x210
vxorps xmm3, xmm3, xmm3
mov ecx, esi
call fcn.1000b900
mov ecx, dword [0x1006ef44]
mov dword [esi + 0x330], 0x210
mov dword [esi + 0x8f0], 0xa0
mov edx, 0x214
call fcn.10018080
cmp byte [eax], 0
je 0x100331d4
mov edx, 0x214
call fcn.1000b3b0
cmp byte [eax + 8], 0
jne 0x100331d4
push 0xa1
call edi
mov ecx, dword [0x1006ef44]
shr eax, 0xf
test al, 1
jne 0x100331d4
cmp byte [ecx + 0x3769], 0
lea esi, [ecx + 8]
je 0x100331c0
push 0
push 0x214
vxorps xmm3, xmm3, xmm3
mov ecx, esi
call fcn.1000b900
mov ecx, dword [0x1006ef44]
mov dword [esi + 0x334], 0x214
mov dword [esi + 0x900], 0xa1
mov edx, 0x212
call fcn.10018080
cmp byte [eax], 0
je 0x1003323c
mov edx, 0x212
call fcn.1000b3b0
cmp byte [eax + 8], 0
jne 0x1003323c
push 0x5b
call edi
mov ecx, dword [0x1006ef44]
shr eax, 0xf
test al, 1
jne 0x1003323c
cmp byte [ecx + 0x3769], 0
lea esi, [ecx + 8]
je 0x10033228
push 0
push 0x212
vxorps xmm3, xmm3, xmm3
mov ecx, esi
call fcn.1000b900
mov ecx, dword [0x1006ef44]
mov dword [esi + 0x21c], 0x212
mov dword [esi + 0x8f8], 0x5b
mov edx, 0x216
call fcn.10018080
cmp byte [eax], 0
je 0x1003329c
mov edx, 0x216
call fcn.1000b3b0
cmp byte [eax + 8], 0
jne 0x1003329c
push 0x5c
call edi
shr eax, 0xf
test al, 1
jne 0x1003329c
mov esi, dword [0x1006ef44]
cmp byte [esi + 0x3769], 0
je 0x10033288
push 0
push 0x216
vxorps xmm3, xmm3, xmm3
lea ecx, [esi + 8]
call fcn.1000b900
mov dword [esi + 0x228], 0x216
mov dword [esi + 0x910], 0x5c
pop edi
pop esi
ret
Function at 0x100416b0
Capabilities:
Hash data with crc32

Disassembly:
push ecx
test dword [ecx + 0xc], 0x100000
push ebx
push esi
push edi
mov edi, edx
je 0x10041722
mov cl, byte [edi]
lea esi, [edi + 1]
or eax, 0xffffffff
test cl, cl
je 0x100416f8
or edi, 0xffffffff
nop
cmp cl, 0x23
jne 0x100416df
cmp byte [esi], cl
jne 0x100416df
cmp byte [esi + 1], cl
cmove eax, edi
movzx edx, al
movzx ecx, cl
xor edx, ecx
shr eax, 8
mov cl, byte [esi]
inc esi
xor eax, dword [edx*4 + 0x10050408]
test cl, cl
jne 0x100416d0
mov ecx, dword [0x1006ef44]
not eax
cmp dword [ecx + 0x3ea4], eax
jne 0x1004170e
mov dword [ecx + 0x3ea8], eax
cmp dword [ecx + 0x3ecc], eax
jne 0x10041768
mov byte [ecx + 0x3ed0], 1
pop edi
pop esi
pop ebx
pop ecx
ret
mov eax, dword [0x1006ef44]
xor edx, edx
mov esi, dword [eax + 0x3e58]
mov ecx, dword [esi + 0xe4]
mov eax, dword [esi + 0xec]
push dword [eax + ecx*4 - 4]
mov ecx, edi
call fcn.1000bd20
mov ecx, dword [esi]
mov ebx, eax
add esp, 4
cmp dword [ecx + 0x3e8c], ebx
jne 0x10041766
push ecx
push edi
mov edx, 0xb
mov ecx, ebx
call fcn.100219d0
add esp, 8
mov eax, ebx
pop edi
pop esi
pop ebx
pop ecx
ret
Function at 0x10046d30
Capabilities:
Check for time delay via queryperformancecounter

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [0x1005b008]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
lea eax, [ebp - 0x10]
mov esi, ecx
push eax
call dword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
push 0
push 0x3e8
push dword [ebp - 0xc]
push dword [ebp - 0x10]
call fcn.1004d300
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x18]
push eax
mov dword [ebp - 0xc], edx
call dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
push dword [ebp - 0xc]
push dword [ebp - 0x10]
push dword [ebp - 0x14]
push dword [ebp - 0x18]
call fcn.1004d300
mov edi, eax
mov ebx, edx
mov eax, esi
cdq
add edi, eax
vxorpd xmm0, xmm0, xmm0
adc ebx, edx
vmovlpd qword [ebp - 0x18], xmm0
js 0x10046dcb
jg 0x10046d9e
test edi, edi
je 0x10046dcb
mov esi, dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
lea eax, [ebp - 0x18]
push eax
call esi
push dword [ebp - 0xc]
push dword [ebp - 0x10]
push dword [ebp - 0x14]
push dword [ebp - 0x18]
call fcn.1004d300
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], edx
cmp edx, ebx
jl 0x10046da4
jg 0x10046dcb
cmp eax, edi
jb 0x10046da4
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1004c44e
mov esp, ebp
pop ebp
ret