joyce8/EMBER2024-capa huggingface dataset:
Function at 0x449c10
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 8
lea eax, [esp]
push esi
xor esi, esi
push eax
push 0x20019
push esi
push str.CLSIDE69FD98D_7EBE_4C01_BFED_67B4E4616A49InProcServer32
push 0x80000000
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x449c3e
xor eax, eax
pop esi
add esp, 8
ret 4
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 4]
lea ecx, [esp + 8]
mov dword [esp + 8], 0x104
push ecx
push edx
push 0
push 0
push str.ThreadingModel
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x449c6d
mov esi, 1
mov ecx, dword [esp + 4]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop esi
add esp, 8
ret 4

Function at 0x50e5a0
Capabilities:
Encode data using xor

Disassembly:
test al, 0x1b
loop 0x50e55d
mov bl, 0xf8
inc edx
int1
salc
push esi
inc eax
or eax, 0xe915ad01
jne 0x50e54e
adc eax, 0x332d75e9
push eax
and eax, 0xcbad589c
leave
rcr byte [esi + 0x37], cl
pop ebx
popfd
inc ebx
pushfd
invalid
xor edx, dword [eax + 0x25]
pushfd
pop eax
lodsd eax, dword [esi]
retf
jne 0x50e567
cwde
fisttp dword [esp - 0x71806523]
pop ebx
neg esi
inc ebx
mov bh, 0xee
loope 0x50e5c3
jge 0x50e51d
loopne 0x50e50f
push edx
cmp eax, 0x5b35d4f
dec edi
pop ebp
mov bl, 5
arpl word [edi + 0x6c], bp
lodsd eax, dword [esi]
or byte [ecx + ebp*8 - 0x6d4edbdb], 0xab
ret 0x9ef7
mov esp, 0x40f0fb8a
loop 0x50e5c0
cmp dword [eax - 0xd], edx
push esp
mov ecx, 0x774933be
mov bl, ch
invalid
sbb eax, 0xa5907223
nop
movsd dword es:[edi], dword [esi]
push ds
sar byte [edi - 0x51839db1], cl
fnstenv [edx]
in eax, dx
add dword [ecx], ebp
sahf
imul edi, dword [ebp - 0x7f1c952c], 0xfffffff0
fsub qword [esi - 0x3a92292f]
sub dword [esi + 0x6ad4bd6b], ebx
jecxz 0x50e558
fsub qword [esi - 0x3a92292f]
das
xor eax, 0x53c000d
call edx
xor eax, 0x991efd70
in al, 0x5e
sbb cl, cl
jg 0x50e5d0
popfd
insd dword es:[edi], dx
mov ebx, 0x670c9bfa
fadd st(3)
call dword [eax - 0x2cac1d33]
and ch, byte [edx]
adc dh, byte [ecx + edi*8]
mov cl, 0x38
inc esp
call 0x2f032700
pop ebp
cld
mov word [edx - 0x4a], fs
xor ah, byte [edi]
mov dl, 0xdf
mov byte [0x33a0e97d], al
sbb al, 0x5b
or eax, 0x322748e1
push eax
je 0x50e624
xor dl, byte [eax + 0x74]
cld
outsd dx, dword [esi]
loop 0x50e690
out 0x6c, eax
push ecx
mov bl, 0x26
mov eax, 0x2c205522
cmpsd dword [esi], dword es:[edi]
xor eax, 0x3c8404eb
xor ch, ah
invalid
sbb al, 0xd4
mov al, 0xae
push ebx
xchg ebx, eax
pop esp
sar ch, 0xff
mov ecx, 0x6e23907e
test dword [edi], ecx
lcall 0x770c, 0x17d3a0d6
pop edi
loopne 0x50e718
rol dword [eax + 0x5e], 0xa8
push edi
adc al, byte [edx + 0x11e57a71]
std
pop ebx
pop esp
sti
invalid
cmp ch, byte [edx]
cmpsd dword [esi], dword es:[edi]
pop es
invalid
add eax, 0x5f4c9ab5
push edx
js 0x50e6e1
push cs
btr dword [ecx - 0x61a6d3ae], esp
jno 0x50e740
insd dword es:[edi], dx
insb byte es:[edi], dx
invalid
or al, 0xa2
lodsd eax, dword [esi]
das
sub eax, 0x594ea38d
cdq
fst qword [edi + 0x7b]
push ebx
push edi
pop esi
sub al, 0x40
salc
pop eax
scasd eax, dword es:[edi]
xchg esi, eax
mov ch, 0x79
retf 0x5993
Function at 0x515571
Capabilities:
Encode data using xor

Disassembly:
sbb dh, dl
loopne 0x5155a4
loop 0x5155f5
cmp bl, ch
invalid
cmc
dec esp
add al, 0xdf
call 0xddbdb68
mov bl, 0xe0
push 0x71
fcomp dword [0x31b7b369]
jno 0x515598
fcomp dword [0x31b7b369]
insd dword es:[edi], dx
invalid
in al, 0xeb
sbb al, ch
into
xchg esp, eax
mov al, byte [eax - 0x47b4808d]
and esi, dword [edx + 0x37766d34]
and eax, 0x60
in eax, dx
and ebx, dword [esi - 0x518d925b]
ljmp 0xdfbe

Function at 0x55c5c7
Capabilities:
Encode data using xor

Disassembly:
test eax, 0x281ccac5
mov edx, 0x55b5b717
lodsd eax, dword [esi]

Function at 0x59f6f0
Capabilities:
Encode data using xor

Disassembly:
invalid
add dword [eax - 0x13], eax
aas
add ebx, dword [esi]
push ds
xor dword [ebx], esi
mov ebp, 0x4bc765fa
mov edi, 0xed28013a
sub ch, ch
xchg esi, eax
test eax, 0x9b8c057a
imul byte [ecx + 0x636e1017]
lcall 0x6ef8, 0x53179e93
jl 0x59f6bd
salc
inc ebx
jns 0x59f6d5
push ecx
pushal
invalid

Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..text
nop
mov ebx, 0x408ecc
mov ecx, 0x6d791f94
nop
nop
nop
nop
nop
test eax, eax
nop
nop
nop
je 0x43004e
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
nop
jne 0x430024
nop
nop
mov eax, section..data
mov ebx, 0x42e1d0
nop
mov ecx, 0x7e006b8c
nop
nop
nop
nop
nop
test eax, eax
nop
je 0x430084
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
add eax, 4
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
jne 0x43006c
nop
nop
nop
popal
nop
nop
nop
nop
nop
jmp 0x401219
Function at 0x449c10
Capabilities:
Accept command line arguments
Check os version

Disassembly:
push ecx
push ebx
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov edi, eax
call dword [sym.imp.KERNEL32.dll_GetVersion]
mov ebx, eax
lea eax, [esp + 0xc]
mov esi, ebx
push eax
push edi
and esi, 0xff
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
test eax, eax
je 0x449c4e
mov ecx, dword [0x64cd34]
push 0x64ca4c
push ecx
call dword [sym.imp.KERNEL32.dll_GetConsoleMode]
xor eax, eax
cmp esi, 5
mov al, bh
jne 0x449c6b
cmp eax, 1
jae 0x449c7c
pop edi
pop esi
mov dword [0x64c238], 0x409
pop ebx
pop ecx
ret
ja 0x449c7c
pop edi
pop esi
mov dword [0x64c238], 0x409
pop ebx
pop ecx
ret
pop edi
pop esi
mov dword [0x64c238], 0x7f
pop ebx
pop ecx
ret

Function at 0x5a1b04
Capabilities:
Encode data using xor

Disassembly:
sub dword [esi*8 + 0x1c0b7a19], esi
invalid
pop ebx
add esi, dword [esp + esi*4]
mov ah, 0x56
inc ebp
dec eax
jns 0x5a1a8e
popal
imul ebp
retf 0x3d18
inc esp
jno 0x5a1a9f
enter 0x1634, 0xffffffffffffffed
cmp dword [esi - 0xf], eax
push esi
cwde
aad 0x35
or eax, 0xdaefdfeb
iretd

Function at 0x62db30
Capabilities:
Encode data using xor

Disassembly:
arpl word [eax - 0x50], dx
mov cl, 0xe0
invalid
and eax, 0xce5f7d9f
push ecx
mov ch, 0xa0
xchg ebp, eax
clc
xchg dword [ecx], esp
out dx, eax
mov eax, 0xbfcb300f
das
mov ebx, 0xa88986ea
mov byte [ebp - 0x59], ah
mov cl, 0x62
leave
sub eax, dword [ecx + edx*2]
push esi
jg 0x62dae6
adc al, 0x7d
xor bh, byte [edi - 0x261fe9fd]
pop es
mov esi, 0x309478e5
movsb byte es:[edi], byte [esi]
mov dh, 0x50
jge 0x62db88
outsd dx, dword [esi]
les edx, [esi + 0x35c3a5d4]
aad 0xdb
mov dword [0x2726b8dc], eax
mov al, byte [0x43baf070]
dec ebx
pushal
inc esi
adc byte [ebp - 0x31], cl
das
sbb edi, eax
sub ah, bh
mov esi, 0x4ec500ed
in eax, dx
add ch, al
dec esi
or bh, byte [edx]
sbb edi, esi
and al, 0x7b
rol byte [ecx - 0x32ea73eb], cl
inc edi
retf 0xfed

Function at 0x6377bb
Capabilities:
Encode data using xor

Disassembly:
cmc
wait
xchg esp, eax
mov eax, dword [0xe7b9e36c]
fstp qword [ebx]
sal eax, 1
invalid
mov dword [edi + 0x18f4d5a8], ebp
pop edi
movsd dword es:[edi], dword [esi]
or al, 0xd5
mov esp, 0xb7d5fe54
test dword [edx + 0x5b], 0x397b06d9
mov dl, 0x7e
mov word [eax - 0x72], es
sbb dword [ebp + edx*2 - 0x12], edx
sub al, 0xc
pushal
stc
xor al, 0xfe
push esp
or al, 0xfa
jg 0x637778
inc esi
or esi, 0x8f05d6e3
pop eax
mov ss, edx
sub ebx, dword [edx + 0x61397599]
sub byte [ebp - 0x4014815a], dl
pop ds
cli
and al, 0x59
push es
pop cx
aaa
mov bh, 7
int1
add ecx, ebp
hlt
Function at 0x10008100
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x1c
push ebx
mov ebx, ecx
push esi
push edi
cmp dword [ebx + 0x38], 0
je 0x1000812c
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____thiscall_std::basic_streambuf_char__struct_std::char_traits_char__::xsputn_char_const___long_long___int64__]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov eax, dword [ebx + 0x20]
mov esi, dword [ebp + 0xc]
mov edi, dword [ebp + 0x10]
mov dword [esp + 0x20], esi
mov ecx, dword [eax]
lea eax, [ebx + 0x30]
mov dword [esp + 0x24], edi
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x18], eax
test ecx, ecx
je 0x10008154
mov eax, dword [eax]
mov ecx, dword [eax]
jmp 0x1000815a
xor ecx, ecx
mov dword [esp + 0x18], eax
mov eax, ecx
cdq
mov dword [esp + 0x10], eax
mov ecx, edx
mov dword [esp + 0x14], ecx
test edi, edi
jl 0x100081c2
jg 0x10008171
test esi, esi
je 0x100081c2
test ecx, ecx
jl 0x100081bd
jg 0x1000817b
test eax, eax
je 0x100081bd
cmp edi, ecx
jg 0x1000818f
jl 0x10008185
cmp esi, eax
jae 0x1000818f
mov eax, esi
mov dword [esp + 0x10], esi
mov dword [esp + 0x14], edi
push eax
push dword [ebp + 8]
push dword [esp + 0x24]
call sub.VCRUNTIME140.dll_memcpy
mov eax, dword [esp + 0x24]
add esp, 0xc
mov edx, dword [esp + 0x10]
mov ecx, dword [ebp + 8]
add ecx, edx
sub esi, edx
mov eax, dword [eax]
sbb edi, dword [esp + 0x14]
sub dword [eax], edx
mov eax, dword [ebx + 0x20]
add dword [eax], edx
jmp 0x100081c5
mov ecx, dword [ebp + 8]
jmp 0x100081cf
mov ecx, dword [ebp + 8]
test edi, edi
jl 0x100081e9
jg 0x100081cf
test esi, esi
je 0x100081e9
mov eax, dword [ebx + 0x4c]
test eax, eax
je 0x100081e9
push eax
push esi
push 1
push ecx
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
add esp, 0x10
sub esi, eax
sbb edi, 0
mov eax, dword [esp + 0x20]
mov edx, dword [esp + 0x24]
sub eax, esi
sbb edx, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x10008200
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [ebp + 0x10]
push ebx
mov ebx, ecx
mov ecx, dword [ebp + 0xc]
push esi
mov esi, dword [ebp + 8]
mov dword [ebp - 4], esi
test eax, eax
jg 0x1000822c
jl 0x10008220
test ecx, ecx
jne 0x1000822c
pop esi
xor eax, eax
xor edx, edx
pop ebx
mov esp, ebp
pop ebp
ret 0xc
cmp dword [ebx + 0x38], 0
je 0x10008245
push eax
push ecx
push esi
mov ecx, ebx
call dword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____thiscall_std::basic_streambuf_char__struct_std::char_traits_char__::xsgetn_char___long_long___int64__]
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov eax, dword [ebx + 0x1c]
push edi
mov edi, ecx
mov eax, dword [eax]
mov dword [ebp - 8], eax
test eax, eax
je 0x1000828d
mov eax, dword [ebx + 0x2c]
lea edx, [ebx + 0x2c]
mov dword [ebp - 0xc], edx
mov eax, dword [eax]
test eax, eax
je 0x10008293
cmp eax, ecx
mov esi, ecx
cmovb esi, eax
push esi
push dword [ebp - 8]
push dword [ebp - 4]
call sub.VCRUNTIME140.dll_memcpy
mov eax, dword [ebx + 0x2c]
sub edi, esi
add dword [ebp - 4], esi
add esp, 0xc
sub dword [eax], esi
mov eax, dword [ebx + 0x1c]
add dword [eax], esi
mov esi, dword [ebp - 4]
jmp 0x10008293
lea eax, [ebx + 0x2c]
mov dword [ebp - 0xc], eax
cmp dword [ebx + 0x4c], 0
je 0x10008306
mov ecx, dword [ebx + 0xc]
lea eax, [ebx + 0x3c]
cmp dword [ecx], eax
jne 0x100082bc
mov eax, dword [ebx + 0xc]
mov edx, dword [ebx + 0x54]
mov ecx, dword [ebx + 0x50]
sub edx, ecx
mov dword [eax], ecx
mov eax, dword [ebx + 0x1c]
mov dword [eax], ecx
mov eax, dword [ebp - 0xc]
mov eax, dword [eax]
mov dword [eax], edx
mov eax, dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
cmp edi, 0xfff
jbe 0x100082f4
nop dword [eax]
push dword [ebx + 0x4c]
push 0xfff
push 1
push esi
call eax
add esp, 0x10
add esi, eax
sub edi, eax
cmp eax, 0xfff
jne 0x10008306
cmp edi, eax
mov eax, dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
ja 0x100082d0
test edi, edi
je 0x10008306
push dword [ebx + 0x4c]
push edi
push 1
push esi
call eax
add esp, 0x10
sub edi, eax
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 0x10]
sub eax, edi
pop edi
pop esi
sbb edx, 0
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x10008680
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
mov eax, dword [0x10089040]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, ecx
cmp ebx, 0xffffffff
jne 0x100086b0
pop esi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100714c0
mov esp, ebp
pop ebp
ret 4
mov eax, dword [esi + 0x20]
push edi
mov ecx, dword [eax]
test ecx, ecx
je 0x100086ec
mov edx, dword [esi + 0x30]
mov edi, dword [edx]
lea eax, [edi + ecx]
cmp ecx, eax
jae 0x100086ec
lea ecx, [edi - 1]
mov eax, ebx
mov dword [edx], ecx
mov edx, dword [esi + 0x20]
pop edi
mov esi, dword [edx]
lea ecx, [esi + 1]
mov dword [edx], ecx
mov byte [esi], bl
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100714c0
mov esp, ebp
pop ebp
ret 4
cmp dword [esi + 0x4c], 0
je 0x100087c3
mov edi, dword [esi + 0xc]
lea eax, [esi + 0x3c]
cmp dword [edi], eax
jne 0x10008714
mov edx, dword [esi + 0x54]
mov ecx, dword [esi + 0x50]
sub edx, ecx
mov dword [edi], ecx
mov eax, dword [esi + 0x1c]
mov dword [eax], ecx
mov eax, dword [esi + 0x2c]
mov dword [eax], edx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x10008720
movsx eax, bl
jmp 0x10008758
lea eax, [ebp - 0x2c]
mov byte [ebp - 0x25], bl
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x25]
push eax
lea eax, [esi + 0x40]
push eax
call dword [sym.imp.MSVCP140.dll_public:_int___thiscall_std::codecvt_char__char__struct__Mbstatet_::out_struct__Mbstatet___char_const___char_const___char_const____char___char___char___const]
sub eax, 0
je 0x10008782
sub eax, 1
je 0x10008782
sub eax, 2
jne 0x100087c3
movsx eax, byte [ebp - 0x25]
push dword [esi + 0x4c]
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
add esp, 8
or ecx, 0xffffffff
cmp eax, ecx
cmove ebx, ecx
pop edi
pop esi
mov eax, ebx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100714c0
mov esp, ebp
pop ebp
ret 4
mov edi, dword [ebp - 0x2c]
lea eax, [ebp - 0x24]
sub edi, eax
je 0x100087a0
push dword [esi + 0x4c]
push edi
push 1
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
add esp, 0x10
cmp edi, eax
jne 0x100087c3
lea ecx, [ebp - 0x25]
mov byte [esi + 0x3d], 1
or eax, 0xffffffff
cmp dword [ebp - 0x30], ecx
pop edi
pop esi
cmovne eax, ebx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100714c0
mov esp, ebp
pop ebp
ret 4
mov ecx, dword [ebp - 4]
or eax, 0xffffffff
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.100714c0
mov esp, ebp
pop ebp
ret 4
Function at 0x10008f40
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x10089040]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, ecx
cmp dword [esi + 0x38], 0
je 0x10008ffc
cmp byte [esi + 0x3d], 0
je 0x10008ffc
mov eax, dword [esi]
push edi
push 0xffffffffffffffff
call dword [eax + 0xc]
cmp eax, 0xffffffff
je 0x10008fea
mov ecx, dword [esi + 0x38]
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [esi + 0x40]
push eax
call dword [sym.imp.MSVCP140.dll_public:_int___thiscall_std::codecvt_char__char__struct__Mbstatet_::unshift_struct__Mbstatet___char___char___char___const]
sub eax, 0
je 0x10008fb1
sub eax, 1
je 0x10008fb5
sub eax, 2
jne 0x10008fea
mov byte [esi + 0x3d], al
mov al, 1
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100714c0
mov esp, ebp
pop ebp
ret
mov byte [esi + 0x3d], 0
mov edi, dword [ebp - 0x28]
lea eax, [ebp - 0x24]
sub edi, eax
je 0x10008fd3
push dword [esi + 0x4c]
push edi
push 1
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
add esp, 0x10
cmp edi, eax
jne 0x10008fea
cmp byte [esi + 0x3d], 0
pop edi
sete al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100714c0
mov esp, ebp
pop ebp
ret
pop edi
xor al, al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100714c0
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
mov al, 1
xor ecx, ebp
pop esi
call fcn.100714c0
mov esp, ebp
pop ebp
ret

Function at 0x1000abf0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff0
sub esp, 0x70
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_DisableThreadLibraryCalls]
mov eax, dword [ebp + 0xc]
sub eax, 0
je 0x1000accb
sub eax, 1
jne 0x1000accb
push str..utf8
push 2
call dword [sym.imp.api_ms_win_crt_locale_l1_1_0.dll_setlocale]
xorps xmm0, xmm0
lea edx, [esp + 8]
movaps xmmword [esp + 8], xmm0
movq qword [esp + 0x18], xmm0
call fcn.10067050
add esp, 8
cmp dword [0x1008b854], 0
jne 0x1000acaa
mov ecx, dword [0x1008b8ac]
xorps xmm0, xmm0
mov eax, dword [0x1008b8a8]
mov dword [esp + 0x34], ecx
lea ecx, [esp + 0x28]
mov dword [esp + 0x28], 0
movlpd qword [esp + 0x44], xmm0
movlpd qword [esp + 0x4c], xmm0
movlpd qword [esp + 0x54], xmm0
movlpd qword [esp + 0x5c], xmm0
movlpd qword [esp + 0x64], xmm0
mov dword [esp + 0x6c], 0
mov dword [esp + 0x30], eax
movlpd qword [esp + 0x38], xmm0
mov dword [esp + 0x2c], str.Shut_the_fuck_up__Im_playing
mov dword [esp + 0x40], str.art2
call fcn.100676f0
push 0
push 0
push dword [ebp + 8]
push 0x1000a9a0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
test eax, eax
je 0x1000accb
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 1
mov esp, ebp
pop ebp
ret 0xc

Function at 0x1000b060
Capabilities:
Hash data using fnv

Disassembly:
mov al, byte [ecx]
test al, al
jne 0x1000b069
mov eax, edx
ret
movsx eax, al
xor eax, edx
imul edx, eax, 0x1000193
inc ecx
jmp fcn.1000b060
Function at 0x100200d0
Capabilities:
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
mov edi, edx
not ebx
mov esi, ecx
mov eax, ebx
test edi, edi
je 0x10020131
mov cl, byte [esi]
lea esi, [esi + 1]
dec edi
cmp cl, 0x23
jne 0x10020114
cmp edi, 2
jb 0x10020114
cmp byte [esi], cl
jne 0x10020114
cmp byte [esi + 1], cl
jne 0x10020114
mov eax, ebx
movzx ecx, cl
movzx edx, al
xor edx, ecx
shr eax, 8
xor eax, dword [edx*4 + 0x10079d98]
jmp 0x100200e5
movzx edx, al
movzx ecx, cl
xor edx, ecx
shr eax, 8
xor eax, dword [edx*4 + 0x10079d98]
test edi, edi
jne 0x100200e5
pop edi
pop esi
not eax
pop ebx
pop ebp
ret
mov cl, byte [esi]
inc esi
test cl, cl
je 0x10020160
cmp cl, 0x23
jne 0x10020147
cmp byte [esi], cl
jne 0x10020147
cmp byte [esi + 1], cl
cmove eax, ebx
movzx edx, al
movzx ecx, cl
xor edx, ecx
shr eax, 8
mov cl, byte [esi]
inc esi
xor eax, dword [edx*4 + 0x10079d98]
test cl, cl
jne 0x10020138
pop edi
pop esi
not eax
pop ebx
pop ebp
ret

Function at 0x10020270
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
test ebx, ebx
je 0x10020284
mov dword [ebx], 0
mov edx, 0x1007e9bc
call fcn.10020170
mov esi, eax
test esi, esi
je 0x10020372
mov edi, dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_ftell]
push esi
call edi
add esp, 4
mov dword [ebp - 4], eax
cmp eax, 0xffffffff
je 0x10020368
push 2
push 0
push esi
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fseek]
add esp, 0xc
test eax, eax
jne 0x10020368
push esi
call edi
mov edi, eax
add esp, 4
mov dword [ebp + 8], edi
cmp edi, 0xffffffff
je 0x10020368
push 0
push dword [ebp - 4]
push esi
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fseek]
add esp, 0xc
test eax, eax
jne 0x10020368
mov eax, dword [0x1008b850]
test eax, eax
je 0x100202fc
inc dword [eax + 0x370]
push edi
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov edi, eax
add esp, 4
test edi, edi
je 0x10020368
push esi
push dword [ebp + 8]
push 1
push edi
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
add esp, 0x10
push esi
cmp eax, dword [ebp + 8]
je 0x1002034d
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
mov eax, dword [0x1008b850]
add esp, 4
test eax, eax
je 0x1002033a
dec dword [eax + 0x370]
push edi
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
add esp, 4
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
add esp, 4
test ebx, ebx
je 0x1002035f
mov eax, dword [ebp + 8]
mov dword [ebx], eax
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push esi
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
add esp, 4
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x100222b0
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x10089040]
xor eax, ebp
mov dword [ebp - 4], eax
mov edx, dword [ebp + 8]
push esi
mov esi, ecx
push edi
movss xmm0, dword [edx]
mov edi, 0x10
subss xmm0, dword [esi + 0xc]
mov ecx, dword [esi + 0xc4]
cvttss2si eax, xmm0
movss xmm0, dword [edx + 4]
subss xmm0, dword [esi + 0x10]
mov dword [ebp - 0x14], eax
cvttss2si eax, xmm0
movss xmm0, dword [edx + 8]
subss xmm0, dword [esi + 0xc]
mov dword [ebp - 0x10], eax
cvttss2si eax, xmm0
movss xmm0, dword [edx + 0xc]
subss xmm0, dword [esi + 0x10]
mov dword [ebp - 0xc], eax
cvttss2si eax, xmm0
mov dword [ebp - 8], eax
mov eax, dword [esi + 0xcc]
lea esi, [ebp - 0x14]
mov edx, dword [eax + ecx*4 - 4]
not edx
movzx eax, byte [esi]
lea esi, [esi + 1]
movzx ecx, dl
xor ecx, eax
shr edx, 8
xor edx, dword [ecx*4 + 0x10079d98]
sub edi, 1
jne 0x10022324
mov eax, dword [0x1008b850]
not edx
pop edi
pop esi
cmp dword [eax + 0x1bd4], edx
jne 0x10022355
mov dword [eax + 0x1bd8], edx
cmp dword [eax + 0x1c0c], edx
jne 0x10022364
mov byte [eax + 0x1c10], 1
mov ecx, dword [ebp - 4]
mov eax, edx
xor ecx, ebp
call fcn.100714c0
mov esp, ebp
pop ebp
ret 4
Function at 0x10025d60
Capabilities:
Hash data with crc32

Disassembly:
push ebx
mov bl, byte [ecx]
or eax, 0xffffffff
push esi
lea esi, [ecx + 1]
or ecx, 0xffffffff
push edi
test bl, bl
je 0x10025d9f
cmp bl, 0x23
jne 0x10025d81
cmp byte [esi], bl
jne 0x10025d81
cmp byte [esi + 1], bl
cmove eax, ecx
movzx edx, al
movzx ecx, bl
mov bl, byte [esi]
xor edx, ecx
shr eax, 8
inc esi
mov ecx, 0xffffffff
xor eax, dword [edx*4 + 0x10079d98]
test bl, bl
jne 0x10025d72
mov ecx, dword [0x1008b850]
not eax
mov esi, dword [ecx + 0x1b84]
mov edi, dword [ecx + 0x1b8c]
lea ebx, [edi + esi*8]
test esi, esi
je 0x10025dde
nop word [eax + eax]
mov edx, esi
shr edx, 1
cmp dword [edi + edx*8], eax
lea ecx, [edi + edx*8]
jae 0x10025dd8
lea edi, [ecx + 8]
or ecx, 0xffffffff
sub ecx, edx
add esi, ecx
jmp 0x10025dda
mov esi, edx
test esi, esi
jne 0x10025dc0
cmp edi, ebx
je 0x10025ded
cmp dword [edi], eax
jne 0x10025ded
mov eax, dword [edi + 4]
pop edi
pop esi
pop ebx
ret
pop edi
pop esi
xor eax, eax
pop ebx
ret
Function at 0x100311c0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push ecx
push ebx
push esi
push edi
mov edi, ecx
mov ebx, edx
cmp dword [edi + 0x2ee8], 0
lea esi, [edi + 0x2eec]
je 0x10031242
mov ecx, dword [esi + 4]
test ecx, ecx
jns 0x100311fc
mov eax, ecx
cdq
sub eax, edx
sar eax, 1
add eax, ecx
xor ecx, ecx
test eax, eax
cmovg ecx, eax
push ecx
mov ecx, esi
call fcn.10032ad0
push dword [ebp + 8]
mov ecx, esi
mov dword [esi], 0
push ebx
call fcn.10020780
mov edx, dword [esi]
mov ecx, 0x1008b816
push dword [edi + 0x2ee8]
lea eax, [edx - 1]
neg edx
sbb edx, edx
and edx, eax
mov eax, dword [edi + 0x2ef4]
test eax, eax
push edx
cmovne ecx, eax
push 1
push ecx
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
add esp, 0x10
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push dword [ebp + 8]
mov ecx, esi
push ebx
call fcn.10020780
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret