joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100d0c70
Capabilities:
Hash data using fnv

Disassembly:
mov eax, 0x1fffffff
bsr ecx, eax
push ebx
push ebp
push esi
push edi
mov edi, 1
mov eax, edi
shl eax, cl
mov ecx, dword [esp + 0x14]
cmp ecx, eax
ja 0x100d0dbf
lea eax, [ecx - 1]
mov esi, dword [0x1027db70]
or eax, edi
bsr ecx, eax
push esi
lea ecx, [ecx + 1]
shl edi, cl
mov ecx, 0x1027db78
lea eax, [edi + edi]
push eax
call fcn.100d05c0
mov ecx, dword [0x1027db70]
lea ebx, [edi - 1]
mov dword [0x1027db84], ebx
mov dword [0x1027db88], edi
mov ecx, dword [ecx]
mov edx, ecx
cmp ecx, esi
je 0x100d0db8
movzx eax, byte [ecx + 8]
xor eax, 0x811c9dc5
mov edx, dword [edx]
imul edi, eax, 0x1000193
movzx eax, byte [ecx + 9]
xor edi, eax
movzx eax, byte [ecx + 0xa]
imul edi, edi, 0x1000193
xor edi, eax
movzx eax, byte [ecx + 0xb]
imul edi, edi, 0x1000193
xor edi, eax
mov eax, dword [0x1027db78]
imul edi, edi, 0x1000193
and edi, ebx
mov ebx, dword [eax + edi*8]
lea eax, [eax + edi*8]
mov dword [esp + 0x14], eax
cmp ebx, esi
jne 0x100d0d25
mov dword [eax], ecx
mov dword [eax + 4], ecx
jmp 0x100d0d8b
mov eax, dword [eax + 4]
mov edi, dword [ecx + 8]
cmp edi, dword [eax + 8]
jne 0x100d0d58
mov eax, dword [eax]
cmp eax, ecx
je 0x100d0d4f
mov ebp, dword [ecx + 4]
mov dword [ebp], edx
mov ebx, dword [edx + 4]
mov dword [ebx], eax
mov edi, dword [eax + 4]
mov dword [edi], ecx
mov dword [eax + 4], ebx
mov dword [edx + 4], ebp
mov dword [ecx + 4], edi
mov eax, dword [esp + 0x14]
mov dword [eax + 4], ecx
jmp 0x100d0d8b
cmp ebx, eax
je 0x100d0d6c
nop dword [eax]
mov eax, dword [eax + 4]
cmp edi, dword [eax + 8]
je 0x100d0d9c
cmp ebx, eax
jne 0x100d0d60
mov ebp, dword [ecx + 4]
mov dword [ebp], edx
mov ebx, dword [edx + 4]
mov dword [ebx], eax
mov edi, dword [eax + 4]
mov dword [edi], ecx
mov dword [eax + 4], ebx
mov eax, dword [esp + 0x14]
mov dword [edx + 4], ebp
mov dword [ecx + 4], edi
mov dword [eax], ecx
mov ecx, edx
cmp edx, esi
je 0x100d0db8
mov ebx, dword [0x1027db84]
jmp 0x100d0cd4
mov ebx, dword [ecx + 4]
mov ebp, dword [eax]
mov dword [ebx], edx
mov edi, dword [edx + 4]
mov dword [edi], ebp
mov eax, dword [ebp + 4]
mov dword [eax], ecx
mov dword [ebp + 4], edi
mov dword [edx + 4], ebx
mov dword [ecx + 4], eax
jmp 0x100d0d8b
pop edi
pop esi
pop ebp
pop ebx
ret 4
push str.invalid_hash_bucket_count
call fcn.10118f5f
int3

Function at 0x100d1980
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebx
mov ebx, ecx
or eax, 0xffffffff
push esi
push edi
mov edi, 4
lea esi, [ebx + 4]
jmp dword [edi*4 + 0x100d2bc8]
Function at 0x100dcb00
Capabilities:
Hash data with crc32

Disassembly:
push ebx
mov ebx, dword [esp + 8]
push esi
push edi
mov edi, edx
not ebx
mov esi, ecx
mov eax, ebx
test edi, edi
je 0x100dcb60
mov cl, byte [esi]
lea esi, [esi + 1]
dec edi
cmp cl, 0x23
jne 0x100dcb42
cmp edi, 2
jb 0x100dcb42
cmp byte [esi], cl
jne 0x100dcb42
cmp byte [esi + 1], cl
jne 0x100dcb42
mov eax, ebx
movzx ecx, cl
movzx edx, al
xor edx, ecx
shr eax, 8
xor eax, dword [edx*4 + 0x1017d228]
jmp 0x100dcb13
movzx edx, al
movzx ecx, cl
xor edx, ecx
shr eax, 8
xor eax, dword [edx*4 + 0x1017d228]
test edi, edi
jne 0x100dcb13
pop edi
pop esi
not eax
pop ebx
ret 4
mov cl, byte [esi]
inc esi
test cl, cl
je 0x100dcb8f
cmp cl, 0x23
jne 0x100dcb76
cmp byte [esi], cl
jne 0x100dcb76
cmp byte [esi + 1], cl
cmove eax, ebx
movzx edx, al
movzx ecx, cl
xor edx, ecx
shr eax, 8
mov cl, byte [esi]
inc esi
xor eax, dword [edx*4 + 0x1017d228]
test cl, cl
jne 0x100dcb67
pop edi
pop esi
not eax
pop ebx
ret 4

Function at 0x100dcc70
Capabilities:
Read file on windows

Disassembly:
push ebx
push ebp
mov ebp, dword [esp + 0xc]
push esi
push edi
test ebp, ebp
je 0x100dcc83
mov dword [ebp], 0
call fcn.100dcba0
mov esi, eax
test esi, esi
je 0x100dcd7b
push esi
call fcn.10130a7e
mov ebx, eax
add esp, 4
cmp ebx, 0xffffffff
je 0x100dcd72
push 2
push 0
push esi
call fcn.1012c546
add esp, 0xc
test eax, eax
jne 0x100dcd72
push esi
call fcn.10130a7e
mov edi, eax
add esp, 4
cmp edi, 0xffffffff
je 0x100dcd72
push 0
push ebx
push esi
call fcn.1012c546
add esp, 0xc
test eax, eax
jne 0x100dcd72
mov eax, dword [0x1019deb4]
test eax, eax
je 0x100dccf2
inc dword [eax + 0x370]
mov eax, dword [esp + 0x18]
add eax, edi
push eax
call fcn.1012cc15
mov ebx, eax
add esp, 4
test ebx, ebx
je 0x100dcd72
push esi
push edi
push 1
push ebx
call fcn.1012c169
add esp, 0x10
cmp eax, edi
je 0x100dcd42
push esi
call fcn.101284cd
mov eax, dword [0x1019deb4]
add esp, 4
test eax, eax
je 0x100dcd30
dec dword [eax + 0x370]
push ebx
call fcn.1012bcd9
add esp, 4
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
ret 8
mov eax, dword [esp + 0x18]
test eax, eax
jle 0x100dcd59
push eax
lea eax, [edi + ebx]
push 0
push eax
call fcn.10120ba0
add esp, 0xc
push esi
call fcn.101284cd
add esp, 4
test ebp, ebp
je 0x100dcd69
mov dword [ebp], edi
mov eax, ebx
pop edi
pop esi
pop ebp
pop ebx
ret 8
push esi
call fcn.101284cd
add esp, 4
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
ret 8
Function at 0x100df2a0
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
mov edx, dword [ecx + 0xc0]
mov eax, dword [ecx + 0xc8]
push esi
push edi
lea esi, [esp + 0xc]
mov edi, 4
mov eax, dword [eax + edx*4 - 4]
not eax
nop dword [eax]
movzx ecx, byte [esi]
lea esi, [esi + 1]
movzx edx, al
xor edx, ecx
shr eax, 8
xor eax, dword [edx*4 + 0x1017d228]
sub edi, 1
jne 0x100df2c0
mov ecx, dword [0x1019deb4]
not eax
pop edi
pop esi
cmp dword [ecx + 0x1bc8], eax
jne 0x100df2f2
mov dword [ecx + 0x1bcc], eax
cmp dword [ecx + 0x1c04], eax
jne 0x100df301
mov byte [ecx + 0x1c08], 1
ret 4

Function at 0x100df310
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
sub esp, 0x10
mov edx, dword [esp + 0x14]
push esi
mov esi, ecx
push edi
movss xmm0, dword [edx]
mov edi, 0x10
subss xmm0, dword [esi + 0xc]
mov ecx, dword [esi + 0xc0]
cvttss2si eax, xmm0
movss xmm0, dword [edx + 4]
subss xmm0, dword [esi + 0x10]
mov dword [esp + 8], eax
cvttss2si eax, xmm0
movss xmm0, dword [edx + 8]
subss xmm0, dword [esi + 0xc]
mov dword [esp + 0xc], eax
cvttss2si eax, xmm0
movss xmm0, dword [edx + 0xc]
subss xmm0, dword [esi + 0x10]
mov dword [esp + 0x10], eax
cvttss2si eax, xmm0
mov dword [esp + 0x14], eax
mov eax, dword [esi + 0xc8]
lea esi, [esp + 8]
mov edx, dword [eax + ecx*4 - 4]
not edx
nop dword [eax]
movzx eax, byte [esi]
lea esi, [esi + 1]
movzx ecx, dl
xor ecx, eax
shr edx, 8
xor edx, dword [ecx*4 + 0x1017d228]
sub edi, 1
jne 0x100df380
mov eax, dword [0x1019deb4]
not edx
pop edi
pop esi
cmp dword [eax + 0x1bc8], edx
jne 0x100df3b1
mov dword [eax + 0x1bcc], edx
cmp dword [eax + 0x1c04], edx
jne 0x100df3c0
mov byte [eax + 0x1c08], 1
mov eax, edx
add esp, 0x10
ret 4
Function at 0x100e8670
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ecx
mov eax, dword [0x1019deb4]
lea edx, [esp]
push ebx
push ebp
push esi
push edi
mov edi, dword [eax + 0x1b94]
mov esi, 4
add edi, 0xc0
mov dword [esp + 0x10], ecx
mov ebp, dword [edi]
mov ebx, dword [edi + 8]
mov ebx, dword [ebx + ebp*4 - 4]
not ebx
nop dword [eax]
movzx eax, byte [edx]
lea edx, [edx + 1]
movzx ecx, bl
xor ecx, eax
shr ebx, 8
xor ebx, dword [ecx*4 + 0x1017d228]
sub esi, 1
jne 0x100e86a0
mov esi, dword [edi + 4]
not ebx
cmp ebp, esi
jne 0x100e86e7
lea ecx, [ebp + 1]
test esi, esi
je 0x100e86d5
mov eax, esi
cdq
sub eax, edx
sar eax, 1
add eax, esi
jmp 0x100e86da
mov eax, 8
cmp eax, ecx
cmovg ecx, eax
push ecx
mov ecx, edi
call fcn.100a1880
mov ecx, dword [edi]
mov eax, dword [edi + 8]
mov dword [eax + ecx*4], ebx
inc dword [edi]
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
Function at 0x100ed180
Capabilities:
Hash data with crc32

Disassembly:
movss xmm0, dword [0x10183708]
sub esp, 0x14
push ebx
push ebp
push esi
push edi
mov edi, dword [0x1019deb4]
comiss xmm0, dword [edi + 0x1e0c]
ja 0x100ed3f7
cmp dword [edi + 0x1e08], 0
jne 0x100ed1ee
or edx, 0xffffffff
mov esi, 0x1017d02d
mov al, 0x23
or ebx, 0xffffffff
cmp al, 0x23
jne 0x100ed1c6
cmp byte [esi], al
jne 0x100ed1c6
cmp byte [esi + 1], al
cmove edx, ebx
movzx ecx, dl
movzx eax, al
xor ecx, eax
shr edx, 8
mov al, byte [esi]
inc esi
xor edx, dword [ecx*4 + 0x1017d228]
test al, al
jne 0x100ed1b8
not edx
mov ecx, edx
call fcn.100e3850
mov dword [edi + 0x1e08], eax
mov eax, dword [edi + 0x1cf4]
lea edx, [esp + 0x10]
mov dword [esp + 0x18], 0x7f7fffff
mov dword [esp + 0x1c], 0x7f7fffff
mov ecx, dword [eax]
mov eax, dword [edi + 0x1c18]
or eax, 0x10
movss xmm2, dword [ecx + 0xc]
movss xmm1, dword [ecx + 0x10]
mulss xmm1, dword [0x1018371c]
mov dword [edi + 0x1c18], eax
or eax, 1
mulss xmm2, dword [0x1018371c]
mov dword [edi + 0x1c64], 0
movss dword [esp + 0x14], xmm1
mov dword [edi + 0x1c68], 0
movss dword [esp + 0x10], xmm2
movups xmm0, xmmword [esp + 0x10]
movups xmmword [edi + 0x1c54], xmm0
movss xmm1, dword [ecx + 0x10]
movss xmm2, dword [ecx + 0xc]
mulss xmm1, dword [0x1018377c]
mulss xmm2, dword [0x1018377c]
addss xmm1, dword [ecx + 8]
addss xmm2, dword [ecx + 4]
mov dword [edi + 0x1c18], eax
mov ecx, 1
mov dword [edi + 0x1c30], 0x3f000000
movss dword [edi + 0x1c2c], xmm1
mov dword [edi + 0x1c34], 0x3f000000
movss dword [edi + 0x1c28], xmm2
mov dword [edi + 0x1c1c], 1
movss xmm1, dword [edi + 0x151c]
movss xmm0, dword [edi + 0x1520]
addss xmm1, xmm1
addss xmm0, xmm0
movss dword [esp + 0x10], xmm1
movss dword [esp + 0x14], xmm0
call fcn.100ddb00
push 0xc1347
xor edx, edx
mov ecx, str.NavWindowingList
call fcn.100e5b00
mov ebp, dword [edi + 0x1b60]
sub ebp, 1
js 0x100ed3e1
nop dword [eax + eax]
mov eax, dword [edi + 0x1b68]
mov esi, dword [eax + ebp*4]
cmp byte [esi + 0x8b], 0
je 0x100ed3d8
cmp esi, dword [esi + 0x320]
jne 0x100ed3d8
test dword [esi + 8], 0x80000
jne 0x100ed3d8
mov ecx, dword [esi]
mov edx, ecx
cmp ecx, 0xffffffff
jae 0x100ed362
mov bl, byte [edx]
test bl, bl
je 0x100ed35e
cmp bl, 0x23
jne 0x100ed358
cmp byte [edx + 1], bl
je 0x100ed35e
inc edx
cmp edx, 0xffffffff
jb 0x100ed348
cmp ecx, edx
jne 0x100ed3b3
mov eax, dword [esi + 8]
test eax, 0x4000000
je 0x100ed373
mov ecx, str._Popup_
jmp 0x100ed3b3
test eax, 0x400
je 0x100ed3ae
mov eax, str.MainMenuBar
nop
mov dl, byte [ecx]
cmp dl, byte [eax]
jne 0x100ed3a0
test dl, dl
je 0x100ed39c
mov dl, byte [ecx + 1]
cmp dl, byte [eax + 1]
jne 0x100ed3a0
add ecx, 2
add eax, 2
test dl, dl
jne 0x100ed380
xor eax, eax
jmp 0x100ed3a5
sbb eax, eax
or eax, 1
mov ecx, str._Main_menu_bar_
test eax, eax
je 0x100ed3b3
mov ecx, str._Untitled_
cmp dword [edi + 0x1e00], esi
lea eax, [esp + 0x10]
push eax
push 0
sete dl
mov dword [esp + 0x18], 0
mov dword [esp + 0x1c], 0
call fcn.10108bc0
sub ebp, 1
jns 0x100ed310
call fcn.100e7d40
mov ecx, 1
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x14
jmp fcn.100ddb80
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x14
ret
Function at 0x100ed4e0
Capabilities:
Hash data with crc32

Disassembly:
sub esp, 0x14
mov edx, dword [0x1019deb4]
mov eax, ecx
push ebx
push ebp
push esi
push edi
mov edi, edx
mov dword [esp + 0x1c], eax
xor esi, esi
mov dword [esp + 0x18], esi
mov ebp, dword [edi + 0x1b94]
test al, 0x10
jne 0x100ed641
mov ebx, dword [ebp + 0x118]
test ebx, ebx
je 0x100ed541
cmp dword [edi + 0x1bc8], ebx
jne 0x100ed637
mov esi, dword [edi + 0x1c00]
xor eax, eax
cmp esi, 0xffffffff
cmove esi, eax
cmp byte [esi + edi + 0xec], al
je 0x100ed637
xor al, al
jmp 0x100ed5cb
cmp byte [edi + 0xec], 0
je 0x100ed637
test al, 8
je 0x100ed637
test byte [ebp + 0x11c], 1
jne 0x100ed577
cmp dword [edi + 0x1bc8], esi
je 0x100ed637
cmp dword [edi + 0x1bf8], ebp
jne 0x100ed637
lea esi, [ebp + 0x120]
mov ecx, ebp
push esi
call fcn.100df310
mov ebx, eax
mov ecx, esi
mov edx, ebx
mov dword [ebp + 0x118], ebx
call fcn.100df620
mov byte [esp + 0x17], al
test al, al
je 0x100ed5bb
cmp byte [edi + 0x3d8], 0
je 0x100ed5bb
mov edx, ebp
mov ecx, ebx
call fcn.100df3d0
mov ecx, ebp
call fcn.100e7e40
mov al, byte [esp + 0x17]
cmp dword [edi + 0x1bc8], ebx
jne 0x100ed637
mov edx, dword [0x1019deb4]
xor esi, esi
mov byte [edi + 0x1bd5], al
cmp byte [edx + esi + 0xec], 0
mov ecx, dword [ebp + 0xc0]
mov eax, dword [ebp + 0xc8]
mov eax, dword [eax + ecx*4 - 4]
mov dword [esp + 0x18], eax
jne 0x100ed5f3
xor al, al
jmp 0x100ed60b
movss xmm1, dword [edx + 0x30]
movss xmm0, dword [edx + esi*4 + 0x444]
mulss xmm1, xmm1
comiss xmm0, xmm1
setae al
mov dword [edi + 0x1bdc], 0xffffffff
mov dword [edi + 0x1be0], 0xffffffff
mov dword [edi + 0x1be8], 0xffffffff
mov dword [edi + 0x1bec], 0xffffffff
test al, al
jne 0x100ed67b
xor al, al
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x14
ret
xor ebp, ebp
or ebx, 0xffffffff
mov edx, 0x1017d01d
mov al, 0x23
or esi, 0xffffffff
cmp al, 0x23
jne 0x100ed65e
cmp byte [edx], al
jne 0x100ed65e
cmp byte [edx + 1], al
cmove ebx, esi
movzx ecx, bl
movzx eax, al
xor ecx, eax
shr ebx, 8
mov al, byte [edx]
inc edx
xor ebx, dword [ecx*4 + 0x1017d228]
test al, al
jne 0x100ed650
not ebx
mov esi, ebp
cmp byte [edi + 0x1e3c], 0
jne 0x100ed6bf
call fcn.100ed400
mov eax, dword [esp + 0x18]
mov dword [edi + 0x1e58], eax
mov eax, dword [esp + 0x1c]
mov dword [edi + 0x1e54], ebx
mov byte [edi + 0x1e3c], 1
mov dword [edi + 0x1e40], eax
mov dword [edi + 0x1e48], esi
cmp ebx, dword [edi + 0x1bc8]
jne 0x100ed6bf
mov byte [edi + 0x1bd6], 1
mov ebx, dword [esp + 0x1c]
mov eax, dword [edi + 0x1b38]
mov dword [edi + 0x1e44], eax
mov byte [edi + 0x1e3d], 1
test bl, 1
jne 0x100ed70d
xor edx, edx
xor ecx, ecx
call fcn.100e9740
cmp dword [edi + 0x1ea4], 0
je 0x100ed70d
test dword [edi + 0x1e98], 0x1000
je 0x100ed70d
mov eax, dword [edi + 0x1b94]
mov byte [eax + 0x8f], 1
mov byte [eax + 0xa8], 1
test bl, 0x12
jne 0x100ed719
and dword [ebp + 0x11c], 0xfffffffe
pop edi
pop esi
pop ebp
mov al, 1
pop ebx
add esp, 0x14
ret
Function at 0x100efce0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push esi
mov esi, ecx
mov ecx, dword [esi + 8]
test ecx, ecx
je 0x100efd16
mov eax, dword [0x1019deb4]
mov dword [esi + 4], 0
mov dword [esi], 0
test eax, eax
je 0x100efd06
dec dword [eax + 0x370]
push ecx
call fcn.1012bcd9
add esp, 4
mov dword [esi + 8], 0
mov ecx, dword [esi + 0x14]
test ecx, ecx
je 0x100efd4a
mov eax, dword [0x1019deb4]
mov dword [esi + 0x10], 0
mov dword [esi + 0xc], 0
test eax, eax
je 0x100efd3a
dec dword [eax + 0x370]
push ecx
call fcn.1012bcd9
add esp, 4
mov dword [esi + 0x14], 0
mov ecx, dword [esi + 0x20]
test ecx, ecx
je 0x100efd7e
mov eax, dword [0x1019deb4]
mov dword [esi + 0x1c], 0
mov dword [esi + 0x18], 0
test eax, eax
je 0x100efd6e
dec dword [eax + 0x370]
push ecx
call fcn.1012bcd9
add esp, 4
mov dword [esi + 0x20], 0
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x34], 0
mov dword [esi + 0x38], 0
mov ecx, dword [esi + 0x44]
test ecx, ecx
je 0x100efdce
mov eax, dword [0x1019deb4]
mov dword [esi + 0x40], 0
mov dword [esi + 0x3c], 0
test eax, eax
je 0x100efdbe
dec dword [eax + 0x370]
push ecx
call fcn.1012bcd9
add esp, 4
mov dword [esi + 0x44], 0
mov ecx, dword [esi + 0x50]
test ecx, ecx
je 0x100efe02
mov eax, dword [0x1019deb4]
mov dword [esi + 0x4c], 0
mov dword [esi + 0x48], 0
test eax, eax
je 0x100efdf2
dec dword [eax + 0x370]
push ecx
call fcn.1012bcd9
add esp, 4
mov dword [esi + 0x50], 0
mov ecx, dword [esi + 0x5c]
test ecx, ecx
je 0x100efe36
mov eax, dword [0x1019deb4]
mov dword [esi + 0x58], 0
mov dword [esi + 0x54], 0
test eax, eax
je 0x100efe26
dec dword [eax + 0x370]
push ecx
call fcn.1012bcd9
add esp, 4
mov dword [esi + 0x5c], 0
lea ecx, [esi + 0x78]
pop esi
jmp fcn.100f2960
Function at 0x100f3740
Capabilities:
Enumerate pe sections

Disassembly:
sub esp, 0x174
push ebx
push ebp
push esi
mov esi, dword [esp + 0x184]
push edi
movss dword [esp + 0x10], xmm3
mov dword [esp + 0x14], ecx
movzx ebx, byte [esi + 8]
movzx eax, byte [esi + 9]
shl ebx, 8
add ebx, eax
movzx eax, byte [esi + 0xa]
shl ebx, 8
add ebx, eax
movzx eax, byte [esi + 0xb]
shl ebx, 8
add ebx, eax
mov eax, dword [0x1019deb4]
test eax, eax
je 0x100f3789
inc dword [eax + 0x370]
push ebx
call fcn.1012cc15
movzx edx, byte [esi]
add esp, 4
movzx ecx, byte [esi + 1]
mov ebp, eax
shl edx, 8
add edx, ecx
movzx ecx, byte [esi + 2]
shl edx, 8
add edx, ecx
movzx ecx, byte [esi + 3]
shl edx, 8
add edx, ecx
cmp edx, 0x57bc0000
jne 0x100f3837
movzx ecx, byte [esi + 4]
movzx eax, byte [esi + 5]
shl ecx, 8
add ecx, eax
movzx eax, byte [esi + 6]
shl ecx, 8
add ecx, eax
movzx eax, byte [esi + 7]
shl ecx, 8
add ecx, eax
jne 0x100f3837
movzx ecx, byte [esi + 8]
movzx eax, byte [esi + 9]
movzx edi, byte [esi + 0xb]
shl ecx, 8
add ecx, eax
mov dword [0x1027cf3c], esi
movzx eax, byte [esi + 0xa]
add esi, 0x10
shl ecx, 8
add ecx, eax
mov dword [0x1027cf44], ebp
shl ecx, 8
add ecx, ebp
mov dword [0x1027cf48], ebp
add edi, ecx
mov ecx, esi
mov dword [0x1027cf40], edi
call fcn.100f5ef0
cmp eax, esi
je 0x100f3837
cmp dword [0x1027cf48], edi
ja 0x100f3837
mov ecx, eax
mov esi, eax
call fcn.100f5ef0
cmp eax, esi
jne 0x100f3822
mov esi, dword [esp + 0x190]
test esi, esi
je 0x100f3859
mov ecx, 0x1e
lea edi, [esp + 0x108]
rep movsd dword es:[edi], dword [esi]
lea esi, [esp + 0x108]
jmp 0x100f389d
push 0x78
lea eax, [esp + 0x1c]
push 0
push eax
call fcn.10120ba0
mov eax, 0xffff
mov byte [esp + 0x2c], 1
add esp, 0xc
mov dword [esp + 0x2c], 3
mov dword [esp + 0x30], 1
lea esi, [esp + 0x18]
mov dword [esp + 0x50], 0x7f7fffff
mov dword [esp + 0x5c], 0x3f800000
mov word [esp + 0x60], ax
mov eax, dword [esp + 0x194]
lea edi, [esp + 0x90]
movss xmm0, dword [esp + 0x10]
mov ecx, 0x1e
rep movsd dword es:[edi], dword [esi]
mov ecx, 0x1e
mov byte [esp + 0x98], 1
lea esi, [esp + 0x90]
test eax, eax
lea edi, [esp + 0x18]
rep movsd dword es:[edi], dword [esi]
mov ecx, dword [esp + 0x48]
cmovne ecx, eax
mov dword [esp + 0x18], ebp
lea eax, [esp + 0x18]
mov dword [esp + 0x48], ecx
mov ecx, dword [esp + 0x14]
push eax
mov dword [esp + 0x20], ebx
movss dword [esp + 0x2c], xmm0
call fcn.100f32e0
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x174
ret 0x10
Function at 0x100f6fc0
Capabilities:
Log keystrokes via polling

Disassembly:
sub esp, 0x30
push ebx
mov ebx, dword [0x1019deb4]
lea eax, [esp + 0x20]
push esi
push edi
push eax
push dword [0x101a0608]
call dword [sym.imp.USER32.dll_GetClientRect]
mov eax, dword [esp + 0x30]
sub eax, dword [esp + 0x28]
movd xmm1, eax
mov eax, dword [esp + 0x34]
sub eax, dword [esp + 0x2c]
cvtdq2ps xmm1, xmm1
movd xmm0, eax
lea eax, [esp + 0x20]
cvtdq2ps xmm0, xmm0
push eax
movss dword [ebx + 0x10], xmm1
movss dword [ebx + 0x14], xmm0
call dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov edi, dword [esp + 0x20]
mov ecx, edi
sub ecx, dword [0x101a0600]
mov esi, dword [esp + 0x24]
mov edx, esi
sbb edx, dword [0x101a0604]
call fcn.10148450
mov edx, dword [0x101a05fc]
mov ecx, dword [0x101a05f8]
cvtsd2ss xmm0, xmm0
movss dword [esp + 0x10], xmm0
call fcn.10148450
movss xmm1, dword [esp + 0x10]
cvtsd2ss xmm0, xmm0
push 0x11
divss xmm1, xmm0
movss dword [ebx + 0x18], xmm1
mov dword [0x101a0604], esi
mov esi, dword [sym.imp.USER32.dll_GetKeyState]
mov dword [0x101a0600], edi
call esi
shr eax, 0xf
and al, 1
push 0x10
mov byte [ebx + 0xfc], al
call esi
shr eax, 0xf
and al, 1
push 0x12
mov byte [ebx + 0xfd], al
call esi
shr eax, 0xf
and al, 1
mov byte [ebx + 0xff], 0
push 0xa0
mov byte [ebx + 0xfe], al
call esi
shr eax, 0xf
and al, 1
push 0xa1
mov byte [ebx + 0x1a0], al
call esi
mov ecx, dword [0x1019deb4]
shr eax, 0xf
and al, 1
mov byte [ebx + 0x1a1], al
cmp byte [ecx + 0x357], 0
lea esi, [ecx + 0xe4]
je 0x100f710d
cvttss2si eax, dword [esi]
mov dword [esp + 0x10], eax
cvttss2si eax, dword [ecx + 0xe8]
mov dword [esp + 0x14], eax
lea eax, [esp + 0x10]
push eax
push dword [0x101a0608]
call dword [sym.imp.USER32.dll_ClientToScreen]
push dword [esp + 0x14]
push dword [esp + 0x14]
call dword [sym.imp.USER32.dll_SetCursorPos]
mov dword [esi], 0xff7fffff
mov dword [esi + 4], 0xff7fffff
call dword [sym.imp.USER32.dll_GetForegroundWindow]
test eax, eax
je 0x100f7179
mov ecx, dword [0x101a0608]
cmp eax, ecx
je 0x100f713a
push ecx
push eax
call dword [sym.imp.USER32.dll_IsChild]
test eax, eax
je 0x100f7179
lea eax, [esp + 0x18]
push eax
call dword [sym.imp.USER32.dll_GetCursorPos]
test eax, eax
je 0x100f7179
lea eax, [esp + 0x18]
push eax
push dword [0x101a0608]
call dword [sym.imp.USER32.dll_ScreenToClient]
test eax, eax
je 0x100f7179
movd xmm0, dword [esp + 0x18]
movd xmm1, dword [esp + 0x1c]
cvtdq2ps xmm0, xmm0
cvtdq2ps xmm1, xmm1
movss dword [esi], xmm0
movss dword [esi + 4], xmm1
cmp byte [ebx + 0xb0], 0
je 0x100f7187
or eax, 0xffffffff
jmp 0x100f7192
mov eax, dword [0x1019deb4]
mov eax, dword [eax + 0x1e38]
cmp dword [0x10192948], eax
je 0x100f71a4
mov dword [0x10192948], eax
call fcn.100f6e90
pop edi
pop esi
pop ebx
add esp, 0x30
ret
Function at 0x10112e30
Capabilities:
Packed with generic packer

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword fs:[0x2c]
movaps xmm0, xmm1
mov edx, dword [0x101935ec]
push ebx
mov ebx, ecx
movss dword [ebp - 0x20], xmm0
push esi
mov ecx, dword [eax + edx*4]
mov eax, dword [0x101a0618]
push edi
mov dword [ebp - 0x10], ebx
mov dword [ebp - 0xc], ecx
cmp eax, dword [ecx + 4]
jle 0x10112e9d
push 0x101a0618
call fcn.10117cbc
add esp, 4
cmp dword [0x101a0618], 0xffffffff
jne 0x10112e98
mov eax, dword [0x1019294c]
push 0x101a0618
mov eax, dword [eax + 0x17c]
mov dword [0x101a0610], eax
call fcn.10117c6b
add esp, 4
movss xmm0, dword [ebp - 0x20]
mov eax, dword [ebx + 0x2950]
mov dword [ebp - 4], eax
test eax, eax
je 0x10112f45
cmp dword [ebp + 8], 0
jl 0x10112f45
pushal
movss xmm2, dword [ebp - 0x20]
lea ecx, [ebp - 8]
push ecx
mov edx, dword [ebp + 8]
mov ecx, dword [ebp - 4]
call dword [0x101a0610]
pop ecx
popal
mov ecx, dword [ebp - 0xc]
movss xmm0, dword [ebp - 8]
mov eax, dword [0x101a0614]
movss dword [ebp - 4], xmm0
cmp eax, dword [ecx + 4]
jle 0x10112f2d
push 0x101a0614
call fcn.10117cbc
add esp, 4
cmp dword [0x101a0614], 0xffffffff
jne 0x10112f28
mov edx, 0xc60bf9f2
mov ecx, 0x10176eb1
call fcn.1006ec50
mov ecx, eax
call fcn.100b1780
push 0x101a0614
mov dword [0x101a061c], eax
call fcn.10117c6b
add esp, 4
movss xmm0, dword [ebp - 4]
mov ecx, dword [ebp + 8]
mov eax, dword [0x101a061c]
lea eax, [eax + ecx*4]
mov ecx, dword [ebp - 0x10]
movss dword [eax + ecx], xmm0
movss xmm0, dword [ebp - 0x20]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x10118681
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push 2
lea eax, [ebp - 4]
push eax
push 0x20000001
push str._x_sys_default_locale
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoEx]
mov esi, dword [ebp + 0xc]
neg eax
sbb eax, eax
xor ecx, ecx
and eax, dword [ebp - 4]
push ecx
push ecx
push esi
push eax
push dword [ebp + 8]
mov dword [ebp - 4], eax
push ecx
push 0x1300
call dword [sym.imp.KERNEL32.dll_FormatMessageA]
push eax
push dword [esi]
call fcn.1011865d
pop esi
leave
ret 8
Function at 0x1012d63b
Capabilities:
Get disk information

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x210
mov eax, dword [0x1018a014]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
push 0x101521d0
push esi
call fcn.1013a282
pop ecx
pop ecx
test eax, eax
jne 0x1012d669
xor al, al
jmp 0x1012d6e6
push ebx
lea eax, [ebp - 0x210]
xor ebx, ebx
push eax
push 0x104
lea eax, [ebp - 0x20c]
mov dword [ebp - 0x210], ebx
push esi
push eax
call fcn.1012d37c
mov edx, eax
add esp, 0x10
test edx, edx
jne 0x1012d6a3
push dword [ebp - 0x210]
call fcn.1012bcd9
xor al, al
jmp 0x1012d6e4
mov ecx, edx
push edi
lea edi, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, bx
jne 0x1012d6a9
sub ecx, edi
sar ecx, 1
pop edi
cmp ecx, 3
je 0x1012d6c9
push edx
call fcn.1012d572
pop ecx
test al, al
je 0x1012d694
push esi
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
cmp eax, 1
jbe 0x1012d6d7
mov bl, 1
push dword [ebp - 0x210]
call fcn.1012bcd9
mov al, bl
pop ecx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.1011842f
leave
ret

Function at 0x10130266
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x101302a5
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x101302a5
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x101302a5
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x101302a5
cmp dword [ecx + 0x74], 0xe
jbe 0x101302a5
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret