joyce8/EMBER2024-capa huggingface dataset:
Function at 0x505f38
Capabilities:
Encode data using xor

Disassembly:
sahf
mov ds, edx
ret 0xc37
mov word [esi], fs
test dword [edx + 0x10], ebx
invalid
rcr dword [ebp - 0x321d0b7f], 1
mov ch, 0x36
or esi, dword [ecx]
cmpsb byte es:[esi], byte es:[edi]
cmp eax, 0x50f0c280
jnp 0x505f24
in al, dx
jb 0x505fb2
jnp 0x505edc
or eax, 0xaa4ad2d6
stosb byte es:[edi], al
push esi
jo 0x505f76
retf
or eax, 0xf3cdfd02
lds ebx, [eax - 0x6ed4c20f]
inc edi
push es
shl dword [esi + 0x659b3136], 1
sahf
neg dword [ebx + 0x60]
retf 0xd7f3
xchg esi, eax
test al, 0xa9
nop
sub byte [edi - 0xd], cl
mov edi, 0x7edf37e9
jecxz 0x505f56
jp 0x505fdb
mov bh, 0x32
or byte [edi + ebx], dh
pop es
add edi, eax
or al, 2
mov dword [ebx + 0x1c], ebp
movsb byte es:[edi], byte [esi]
invalid
fbstp tbyte [edi]
out 0xc3, al
scasd eax, dword es:[edi]
stosd dword es:[edi], eax
pushfd
cmp byte [ebx + 0x33], 0
hlt

Function at 0x50bf18
Capabilities:
Encode data using xor

Disassembly:
invalid
xchg esp, eax
call 0x19822e2f
xor dword [ecx], ebx
out 0x43, eax
mov ah, 0xcd
jecxz 0x50bf5d
cmc
jbe 0x50bee2
clc
dec edi
rcl byte [esp + ebx*8], 0x57
jb 0x50be92
scasb al, byte es:[edi]
out 0x19, al
xlatb
shr eax, 1
cmp al, 0xc8
sbb al, 0x1c
inc edx
and esp, dword [0x26974294]
xchg edi, eax
invalid
push eax
adc edi, edi
jg 0x50bede
lcall 0xc54b, 0xf228e148
fist word [esi]
or ecx, dword [esi]
outsd dx, dword [esi]
sub bh, 0xf
and bl, byte [ecx + esi*4 - 0x64]
or byte [ebp - 0x6cae5c03], ch
stosb byte es:[edi], al
invalid
mov byte [0x8b025399], al
sbb dword [ecx - 0x76bcec6b], edi
je 0x50bf37
push ebx
add cl, byte [ebx + 0x1395b919]
inc ebx
mov dword [edi + ecx*8 - 0x52], esi
scasb al, byte es:[edi]
push ebx
mov dword [edx], eax
popfd
xchg ecx, eax
lodsd eax, dword [esi]
rcr byte [eax + 0x6c], 1
idiv dword fs:[ebx - 0x5a1ce8b1]
in eax, 0xe2
xor ch, ch
jecxz 0x50bf5b
test dl, 0x4b
or bl, ch
fld xword [0xc642a3bc]
jmp 0x3404ff53
Function at 0x5e6508
Capabilities:
Encode data using xor

Disassembly:
repne lodsb al, byte [esi]
mov word [eax + 0x12085985], es
cwde
loop 0x5e641f
sar dword [esi], 1
mov ebp, 0x198e568d
in al, 0xc
mov ah, ah
les ecx, [esi + ebx*2]
in al, 0xc4
or al, 0x5e
popfd
pushal
xor bl, byte [ebx + 0x5e]
invalid
aam 0xac
jl 0x5e640a
pop eax
mov bl, 0xec
out dx, eax
jb 0x5e64a0
sub cl, byte [ebx + 0x31]
dec edi
add dh, al
pop eax
jecxz 0x5e64d4
adc eax, 0xb37994a0
or dword [ecx], ebp
dec ebx
lodsd eax, dword [esi]
jg 0x5e64ca
mov edx, 0xcbad3e87
jp 0x5e6501
jb 0x5e646a
fimul dword [eax]
bnd je 0x5e64db
or dl, dh
je 0x5e64db
sbb al, 0x78
les ecx, [edx]
pop eax
cld
cmpsd dword [esi], dword es:[edi]
add esi, dword [ebp + ecx - 0xb]
push esi
jbe 0x5e64f9
pop esi
or dword [ebp + 0x22], 0x6c
insb byte es:[edi], dx
pushal
sub byte [esi - 0x9c2feed], bl
stosd dword es:[edi], eax
mov ecx, 0x6ceb4f0a
fsubr dword [ecx - 0x5c]
jns 0x5e64a2
imul esp, dword [ecx + edi*2 - 0x1c920717], 0xd96406ad
mov ebx, 0xb4c67ce0
clc
insd dword es:[edi], dx
jecxz 0x5e646a
push es
fnstcw word fs:[ebx - 0x4b398320]
adc edi, ecx
add eax, 0x5e8adc6c
test eax, 0x953c140b
fmul qword [edx + 0x140ba95e]
cmp al, 0x95
xlatb
mov bh, 0xc8
cli
and byte [ebx - 0x7c4368b7], ah
push 0x8acc8a7d
aaa
add ecx, dword [esi + esi*4 - 0x21]
inc edi
cmp al, 0x88
cld
sti
cwde
in eax, 0x1f
push 0x184f6891
cmp al, 0x28
enter 0x20fa, 0xffffffffffffffa3
dec ecx
xchg edi, eax
mov esp, 0x8a7d6883
sub dword [eax + 0x7d], 0xffffff8a
int3
sbb byte [eax + ebp], bh
push cs
js 0x5e6510
jnp 0x5e64a6
lodsb al, byte [esi]
inc edi
pop ds
jne 0x5e64f2
bound eax, qword [ebx]
mov ebp, 0x15e38b73
jae 0x5e648e
jecxz 0x5e651a
scasd eax, dword es:[edi]
jns 0x5e6527
fsubr dword [eax - 0x40994cc5]
leave
xchg esp, eax
jge 0x5e64b5
or dh, byte [ebx - 0x39]
push esi
push es
dec edi
mov dl, 0x74
pop eax
push ebx
push 0xa2ac162e
pop ecx
push edx
add cl, dl
mov bl, 0xe7
rcl byte [ecx - 0x76e6d395], 0xf7
invalid
out 0xc0, eax
xchg ecx, eax
imul ebp, dword [ecx + ebx], 0xffffff89
test dword [esi + esi + 0x5209c898], 0x541c0771
sti
push 0xffffffffffffffe8
mov ebx, 0x94e8bdb8
cmp byte [ebx - 0x10], ah
bound ebx, qword [edi - 0x14]
push es
xor dword [eax + edi - 0x354ceeb1], edi
mov esi, 0x216d5323
invalid
Function at 0x63aaf8
Capabilities:
Encode data using xor

Disassembly:
and dword [esi + 0x29], ecx
sbb dword [0x564c5ded], edx
and byte [ecx - 2], dh
shr esp, cl
push 0x6acc2049
call 0x692fa4a0
jae 0x63ab3d
push 0xffffffffffffffe8
aad 0xf9
retf
mov al, 0xcf
mov bh, 0xb4
jbe 0x63aac1
daa
xchg byte [ebp + 0x167813d9], dl
fst dword [ebp + 0x1b4b3007]
ret
pop ss
xchg dword [ecx - 0x2ed7f6b7], esi
adc eax, dword [edx + 0x45a3aa7d]
inc ebp
lds edi, [ecx*4 - 0x4b4a6b84]
out 0x97, eax
sub byte [edx + 0x38], dh
stosb byte es:[edi], al
jb 0x63ab4b
jb 0x63aac5
test byte [ebp - 0x18], dl
mov dh, 0x66
fiadd dword [edx - 0x6a]
mov byte [ebp - 0x5c], dh
aam 0x47
imul esp, dword [edi - 0x6b], 0xffffff96
paddusb mm2, qword [edi - 0x36]
lodsb al, byte [esi]
shl dword [ebp - 0x30], 1
jg 0x63aab3
aad 0x39
add al, 0x8e
pop ds
test al, 0xa8
js 0x63ab6f
xor eax, 0x5724fba
test al, 0x94
mov edx, 0xf205724f
test al, 0x94
add eax, 0x94a8f3f2
les esi, [ebp + 0x71508d93]
imul ebx, dword [ebx + 0x42c14e0e], 0xffffffdd
and byte [edi], dh
push cs
dec esi
rol dword [edx - 0x23], 0x20
aaa
sbb dword [0x6b09ea07], edi
mov byte [ebx + 0x434a5003], dh
jns 0x63ab04
mov byte [0xf6678e5d], al
mov ecx, 0xe594070b
mov eax, dword [0x54f759d3]
in eax, dx
mov byte [0x24353533], ah
xor eax, dword [eax]
pop ds
out 0x47, eax
push ebp
jo 0x63ab39
loope 0x63ab33
mov esi, 0x99c51acb
cmpsd dword [esi], dword es:[edi]
pop ebx
invalid

Function at 0x63ad38
Capabilities:
Encode data using xor

Disassembly:
and eax, 0x6538d67f
pop eax
notrack jmp 0x63ad11
mov byte [0xf21f16a8], al
les eax, [ebp - 0xb]
add eax, 0x1c74ddc7
aad 0xa7
inc ebx
stosb byte es:[edi], al
xchg edx, eax
xchg edi, eax
js 0x63acb7
push eax
mov bl, 0xc4
and al, 0x95
arpl bx, bp
cwde
test al, 0xdc
movsb byte es:[edi], byte [esi]
jno 0x63acd5
call 0xc2f9db4
leave
sbb dword [edi], esi
imul esi, dword [eax], 0xc610f381
pop es
sbb ch, byte [ecx + 0x6e]
dec ecx
je 0x63ad78
retf 0x6c50
xor eax, 0x4fc41308
cmp byte [edi + 9], bh
xor al, 0x30
mov cl, 0xb6
mov ah, 0xf
sar dword [edi - 0x446e15bd], cl
test byte [ebx], ah
push esp
jecxz 0x63acc6
inc ebp
mov dword [edi], ebx
fcmovnbe st(0), st(4)
mov ebp, 0x73c934c0
or dword [ebp - 0x7a], esi
sbb esp, dword [esp + esi*8 + 0x1b853c77]
inc ebx
xchg byte [edi - 0x258d4a7c], dh
les ebx, ds:[eax - 0x222afae9]
das
pop eax
pop ecx
sbb dword [ebx + ecx*2 + 0x35], edx
and al, 0x17
salc
push es
xor ebx, dword gs:[ecx - 0x30]
add ecx, dword [ebx - 0x49]
inc ebx
pop ss
aam 0x33
test eax, 0xf73538ed
in eax, 0xb9
sahf
xlatb
xor al, 0x88
mov esp, 0xb13028c8
mov dh, 0xd
push 0xa8647be0
inc ebx
jnp 0x63adde
test al, 0x43
mov ecx, dword [ebp + 0x68]
je 0x63ad11
lcall 0xc79b, 0xfd0e6d54
jg 0x63adbe
stc
inc esp
fadd st(4), st(0)
fcmovb st(0), st(7)
pop esp
push es
lcall 0x91c1, 0xf911aa61
aaa
aas
and al, 0x2c
shl byte [ecx], 1
inc ecx
nop
inc esi
push eax
sub dword [ecx], 0xffffffe1
cdq
movsb byte es:[edi], byte [esi]
xor esi, dword [ebp + 0x53b8689a]
rcl dh, 0xc4
xor eax, dword [ecx]
arpl word [esi - 6], bp
lcall 0x4b5b, 0x69beac9e
cwde
test eax, 0x23948cad
add al, 0xdd
clc
invalid
ret
Function at 0x41f28d
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x41f2cc
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x41f2cc
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x41f2cc
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x41f2cc
cmp dword [ecx + 0x74], 0xe
jbe 0x41f2cc
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret
Function at 0x426628
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
je 0x4266c5
push ebx
push esi
call fcn.004265f1
xor ebx, ebx
sub eax, esi
push ebx
push ebx
push ebx
push ebx
sar eax, 1
push eax
push esi
push ebx
push ebx
mov dword [ebp - 8], eax
call fcn.00426585
add esp, 0x24
mov dword [ebp - 4], eax
test eax, eax
jne 0x426672
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x4266c4
push edi
push eax
call fcn.00424f8b
mov edi, eax
pop ecx
push ebx
test edi, edi
jne 0x426692
call fcn.00424fd9
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x4266c3
push ebx
push dword [ebp - 4]
push edi
push dword [ebp - 8]
push esi
push ebx
push ebx
call fcn.00426585
add esp, 0x20
test eax, eax
jne 0x4266b1
push edi
call fcn.00424fd9
jmp 0x4266b9
push ebx
call fcn.00424fd9
mov ebx, edi
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, ebx
pop edi
pop ebx
pop esi
leave
ret

Function at 0x4278d5
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x430d20
push 0x430d18
push str.FlsAlloc
push 0x1f
call fcn.00427794
mov esi, eax
add esp, 0x10
test esi, esi
je 0x427909
push dword [ebp + 8]
mov ecx, esi
call dword [0x42e148]
call esi
jmp 0x42790f
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
pop esi
pop ebp
ret 4

Function at 0x427953
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x430d30
push 0x430d28
push str.FlsGetValue
push 0x21
call fcn.00427794
mov esi, eax
add esp, 0x10
test esi, esi
je 0x42798a
push dword [ebp + 8]
mov ecx, esi
call dword [0x42e148]
call esi
pop esi
pop ebp
ret 4
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsGetValue]

Function at 0x427992
Capabilities:
Set thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x430d38
push 0x430d30
push str.FlsSetValue
push 0x22
call fcn.00427794
mov esi, eax
add esp, 0x10
test esi, esi
je 0x4279cc
push dword [ebp + 0xc]
mov ecx, esi
push dword [ebp + 8]
call dword [0x42e148]
call esi
pop esi
pop ebp
ret 8
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsSetValue]
Function at 0x42cd90
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x42cdbd
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x42cdbd
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret
Function at 0x100092c3
Capabilities:
Get common file path

Disassembly:
push ebp
push edi
push 0x120
call sub.glib_lite.dll_Ordinal_394
mov edi, eax
pop ecx
test edi, edi
je 0x1000934d
push edi
xor ebp, ebp
push ebp
push 0x1001d834
push 0x10023880
call dword [sym.imp.kernel32.dll_GetTempFileNameA]
test eax, eax
je 0x10009352
push ebx
push ebp
mov ebx, 0x4000100
push ebx
push 2
push ebp
push 5
push 0xc0000000
push edi
call dword [sym.imp.kernel32.dll_CreateFileA]
push ebp
push ebx
push 3
push ebp
push 7
push Ordinal_1
push edi
mov dword [edi + 0x108], eax
call dword [sym.imp.kernel32.dll_CreateFileA]
cmp dword [edi + 0x108], 0xffffffff
mov dword [edi + 0x104], eax
pop ebx
je 0x10009352
cmp eax, 0xffffffff
je 0x10009352
mov dword [edi + 0x118], ebp
mov dword [edi + 0x11c], ebp
mov dword [edi + 0x110], ebp
mov dword [edi + 0x114], ebp
mov eax, edi
pop edi
pop ebp
ret
push edi
call sub.glib_lite.dll_Ordinal_105
pop ecx
xor eax, eax
jmp 0x1000934f

Function at 0x10010530
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [esp + 4]
push ebx
push ebp
mov ebp, dword [esp + 0x10]
mov ecx, dword [eax*4 + 0x1001e2c8]
push esi
push edi
push 0xffffffffffffff80
mov dword [esp + 0x18], ecx
lea edi, [ecx + ecx]
pop esi
mov ebx, esi
xor edx, edx
sar ebx, 0x1f
mov eax, ebx
xor eax, esi
sub eax, ebx
cmp eax, edi
cmovl edx, eax
mov al, bl
sub edx, ecx
mov ecx, edx
sar ecx, 0x1f
xor dl, cl
sub al, dl
add al, cl
mov ecx, dword [esp + 0x14]
add al, cl
xor al, bl
mov byte [esi + ebp], al
inc esi
cmp esi, 0x80
jle 0x1001054d
pop edi
pop esi
pop ebp
pop ebx
ret

Function at 0x10013a24
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
pushal
call 0x10013a33
pop dword [ebp - 0x10]
mov eax, 0x10013a33
sub dword [ebp - 0x10], eax
mov dword [ebp - 0x20], 0xdc8e5b33
add dword [ebp - 0x20], 0x71c3ea18
mov dword [ebp - 0x1c], 0xd6e3cc4c
sub dword [ebp - 0x1c], 0xa4b08007
mov dword [ebp - 0x18], 0x5d806cbf
add dword [ebp - 0x18], 0xeecbd76f
mov dword [ebp - 0x14], 0x78874442
add dword [ebp - 0x14], 0x8778bbbe
lea eax, [ebp - 0x20]
push eax
mov eax, 0x4789176c
add eax, 0xc878a914
add eax, dword [ebp - 0x10]
call dword [eax]
mov dword [ebp - 0x20], 0xda85f5a4
sub dword [ebp - 0x20], 0x66138c4e
mov dword [ebp - 0x1c], 0xb1a188fb
sub dword [ebp - 0x1c], 0x70352786
mov dword [ebp - 0x18], 0xd5b262b6
add dword [ebp - 0x18], 0x8dbd09b6
mov dword [ebp - 0x14], 0xf85f706
sub dword [ebp - 0x14], 0xf85f706
lea ebx, [ebp - 0x20]
push ebx
push eax
mov eax, 0x257592d9
add eax, 0xea8c2d27
add eax, dword [ebp - 0x10]
call dword [eax]
push 0x40
push 0x1000
push 0x369d5
push 0
call eax
mov ecx, 0x82f11302
sub ecx, 0x82f0ce32
mov edi, eax
mov ebx, 0xa292cc8a
add ebx, 0x6d6f9b76
add ebx, dword [ebp - 0x10]
mov esi, 0x6a25a84f
xor dword [ebp - 8], edi
mov edx, dword [ebx]
sub dword [ebp - 4], eax
sub edx, esi
mov dword [edi], edx
sub dword [ebp - 4], ebx
add edi, 0x761ee35
add edi, 0xf89e11cf
add ebx, 0x7f978593
sub ebx, 0x7f97858f
loop 0x10013b4a
add eax, 0x10613
mov ebx, eax
add eax, 0xb1798a9c
sub eax, 0xb1798a97
mov ecx, 0xfce4bef5
add ecx, 0x131b410b
add ecx, dword [ebp - 0x10]
call ebx
leave
ret
Function at 0x100179e0
Capabilities:
Encode data using xor

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100f059b
mov eax, dword fs:[0]
push eax
push ebx
sub esp, 0x3c
push esi
mov eax, dword [0x10118080]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov eax, dword [0x10126af8]
test al, 1
jne 0x10017b25
or eax, 1
mov dword [0x10126af8], eax
mov dword [ebp - 4], 0
mov eax, 0x10
movaps xmm0, xmmword [0x101077e0]
xorps xmm0, xmmword [0x10107a60]
mov dword [ebp - 0x20], 0xe6f9e6f9
mov dword [ebp - 0x1c], 0x80e684fe
mov word [ebp - 0x18], 0xc6f7
movups xmmword [ebp - 0x30], xmm0
xor byte [ebp + eax - 0x30], 0xc6
inc eax
cmp eax, 0x1a
jb 0x10017a63
xorps xmm0, xmm0
mov dword [ebp - 0x38], 0
lea ecx, [ebp - 0x30]
mov dword [ebp - 0x34], 0
movups xmmword [ebp - 0x48], xmm0
lea edx, [ecx + 1]
nop dword [eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x10017a90
sub ecx, edx
lea eax, [ebp - 0x30]
push ecx
push eax
lea ecx, [ebp - 0x48]
call fcn.10020530
mov byte [ebp - 4], 1
mov edx, dword [0x1013c1c4]
test edx, edx
je 0x10017ab9
mov edx, dword [edx + 0x50]
jmp 0x10017abb
xor edx, edx
mov eax, dword [0x1013c1bc]
test eax, eax
je 0x10017ac9
mov eax, dword [eax + 0x18]
jmp 0x10017acb
xor eax, eax
lea ecx, [ebp - 0x48]
push ecx
push eax
lea ecx, [ebp - 0x14]
call fcn.10017500
mov eax, dword [ebp - 0x14]
add esp, 8
mov byte [ebp - 4], 0
mov ecx, dword [ebp - 0x34]
mov dword [0x10126afc], eax
cmp ecx, 0xf
jbe 0x10017b1c
mov edx, dword [ebp - 0x48]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x10017b0d
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x10017b45
push ecx
push edx
call fcn.100c66e2
mov eax, dword [0x10126afc]
add esp, 8
mov dword [ebp - 4], 0xffffffff
jmp 0x10017b2a
mov eax, dword [0x10126afc]
test eax, eax
je 0x10017b32
mov ecx, esi
call eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret
call fcn.100cc10b
int3

Function at 0x1001f8e0
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100f04d0
mov eax, dword fs:[0]
push eax
push esi
push edi
mov eax, dword [0x10118080]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
push 8
mov dword [edi], vtable.std::basic_streambuf_char__struct_std::char_traits_char__.0
mov dword [edi + 4], 0
mov dword [edi + 8], 0
mov dword [edi + 0xc], 0
mov dword [edi + 0x10], 0
mov dword [edi + 0x14], 0
mov dword [edi + 0x18], 0
mov dword [edi + 0x1c], 0
mov dword [edi + 0x20], 0
mov dword [edi + 0x24], 0
mov dword [edi + 0x28], 0
mov dword [edi + 0x2c], 0
mov dword [edi + 0x30], 0
call fcn.100c6283
mov esi, eax
xorps xmm0, xmm0
movq qword [esi], xmm0
push 1
mov dword [ebp - 4], 0
call fcn.100c53d0
add esp, 8
mov dword [esi + 4], eax
mov ecx, edi
mov dword [edi + 0x34], esi
call fcn.1001fc20
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x1002a400
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0xc
mov eax, dword [ebp + 0x10]
push ebx
mov ebx, ecx
mov ecx, dword [ebp + 0xc]
push esi
push edi
mov edi, dword [ebp + 8]
mov dword [esp + 0xc], edi
test eax, eax
jg 0x1002a432
jl 0x1002a425
test ecx, ecx
jne 0x1002a432
xor eax, eax
xor edx, edx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
cmp dword [ebx + 0x38], 0
je 0x1002a4f2
mov dword [esp + 0x10], ecx
mov dword [esp + 0xc], eax
mov ecx, ebx
call fcn.1001f3d0
mov esi, eax
mov eax, edx
mov dword [esp + 0x14], eax
test eax, eax
jl 0x1002a49e
jg 0x1002a45d
test esi, esi
je 0x1002a49e
mov ecx, dword [esp + 0xc]
cmp ecx, eax
jg 0x1002a475
mov eax, dword [esp + 0x10]
jl 0x1002a46f
cmp eax, esi
jae 0x1002a475
mov esi, eax
mov dword [esp + 0x14], ecx
mov eax, dword [ebx + 0x1c]
push esi
push dword [eax]
push edi
call fcn.100c79e0
mov eax, dword [ebx + 0x2c]
add esp, 0xc
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 0xc]
sub ecx, esi
sbb edx, dword [esp + 0x14]
sub dword [eax], esi
mov eax, dword [ebx + 0x1c]
add dword [eax], esi
jmp 0x1002a4bf
mov eax, dword [ebx]
mov ecx, ebx
call dword [eax + 0x1c]
mov edx, dword [esp + 0xc]
cmp eax, 0xffffffff
je 0x1002a4db
mov ecx, dword [esp + 0x10]
mov esi, 1
add ecx, 0xffffffff
mov byte [edi], al
adc edx, 0xffffffff
add edi, esi
mov dword [esp + 0xc], edx
mov dword [esp + 0x10], ecx
test edx, edx
jg 0x1002a444
jl 0x1002a4db
test ecx, ecx
jne 0x1002a444
mov eax, dword [ebp + 0xc]
sub eax, dword [esp + 0x10]
mov ecx, dword [ebp + 0x10]
sbb ecx, edx
mov edx, ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov eax, dword [ebx + 0x1c]
lea esi, [ebx + 0x2c]
mov edi, ecx
mov edx, dword [eax]
test edx, edx
je 0x1002a536
mov eax, dword [esi]
mov eax, dword [eax]
test eax, eax
je 0x1002a536
mov edi, dword [esp + 0xc]
cmp eax, ecx
mov esi, ecx
cmovb esi, eax
push esi
push edx
push edi
call fcn.100c79e0
mov eax, dword [ebx + 0x2c]
add edi, esi
mov dword [esp + 0x18], edi
add esp, 0xc
mov edi, dword [ebp + 0xc]
sub edi, esi
sub dword [eax], esi
mov eax, dword [ebx + 0x1c]
add dword [eax], esi
lea esi, [ebx + 0x2c]
cmp dword [ebx + 0x4c], 0
je 0x1002a5a7
mov ecx, dword [ebx + 0xc]
lea eax, [ebx + 0x3c]
cmp dword [ecx], eax
jne 0x1002a55c
mov eax, dword [ebx + 0xc]
mov edx, dword [ebx + 0x54]
mov ecx, dword [ebx + 0x50]
sub edx, ecx
mov dword [eax], ecx
mov eax, dword [ebx + 0x1c]
mov dword [eax], ecx
mov eax, dword [esi]
mov dword [eax], edx
mov esi, dword [esp + 0xc]
cmp edi, 0xfff
jbe 0x1002a592
nop dword [eax + eax]
push dword [ebx + 0x4c]
push 0xfff
push 1
push esi
call fcn.100d246d
add esp, 0x10
add esi, eax
sub edi, eax
cmp eax, 0xfff
jne 0x1002a5a7
cmp edi, eax
ja 0x1002a570
test edi, edi
je 0x1002a5a7
push dword [ebx + 0x4c]
push edi
push 1
push esi
call fcn.100d246d
add esp, 0x10
sub edi, eax
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 0x10]
sub eax, edi
pop edi
pop esi
sbb edx, 0
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x1002c950
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [0x10118080]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword fs:[0x30]
push esi
push edi
mov edi, ecx
test ebx, ebx
jne 0x1002c983
xor al, al
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100c6262
mov esp, ebp
pop ebp
ret
mov ebx, dword [ebx + 0xc]
add ebx, 0x14
mov esi, dword [ebx]
cmp esi, ebx
je 0x1002c9f0
mov ecx, 0x5a4d
lea edx, [esi - 8]
test edx, edx
je 0x1002c9ea
mov eax, dword [edx + 0x18]
test eax, eax
je 0x1002c9ea
cmp word [eax], cx
jne 0x1002c9ea
mov ecx, dword [eax + 0x3c]
add ecx, eax
je 0x1002c9e5
cmp dword [ecx], 0x4550
jne 0x1002c9e5
mov dword [ebp - 0xc], eax
mov eax, dword [edi + 4]
mov dword [ebp - 0x10], edx
mov dword [ebp - 8], ecx
cmp eax, dword [edi + 8]
je 0x1002c9d9
movq xmm0, qword [ebp - 0x10]
movq qword [eax], xmm0
mov dword [eax + 8], ecx
add dword [edi + 4], 0xc
jmp 0x1002c9e5
lea ecx, [ebp - 0x10]
push ecx
push eax
mov ecx, edi
call fcn.10033480
mov ecx, 0x5a4d
mov esi, dword [esi]
cmp esi, ebx
jne 0x1002c994
mov eax, dword [edi]
cmp eax, dword [edi + 4]
mov ecx, dword [ebp - 4]
pop edi
setne al
xor ecx, ebp
pop esi
pop ebx
call fcn.100c6262
mov esp, ebp
pop ebp
ret
Function at 0x1002d830
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
cmp byte [0x10123e04], 0
push ebx
push esi
push edi
je 0x1002d9be
mov ecx, dword [0x1013c20c]
mov eax, dword [ecx]
mov eax, dword [eax + 0x68]
call eax
test al, al
je 0x1002d9be
mov ecx, dword [0x1013c290]
xor ebx, ebx
mov dword [ebp - 4], ecx
mov eax, dword [ecx + 0x28]
mov dword [ebp - 8], eax
test eax, eax
je 0x1002d9be
mov eax, dword [ecx + 0x1c]
mov ecx, dword [eax + ebx*4]
mov eax, dword [ecx]
mov eax, dword [eax + 0x30]
call eax
mov esi, eax
mov edi, 0x811c9dc5
xor ecx, ecx
nop word [eax + eax]
inc ecx
cmp byte [esi + ecx], 0
jne 0x1002d890
xor edx, edx
test ecx, ecx
je 0x1002d8b9
nop dword [eax]
movsx eax, byte [esi + edx]
inc edx
xor eax, edi
imul edi, eax, 0x1000193
cmp edx, ecx
jb 0x1002d8a0
cmp edi, 0x5ff56dc5
je 0x1002d8c8
inc ebx
cmp ebx, dword [ebp - 8]
jae 0x1002d9be
mov ecx, dword [ebp - 4]
jmp 0x1002d874
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x1c]
mov edi, dword [eax + ebx*4]
test edi, edi
je 0x1002d9be
mov edx, dword [edi + 0x88]
test edx, edx
je 0x1002d9be
movss xmm1, dword [0x10106dac]
xor ebx, ebx
cmp edx, 4
jl 0x1002d98b
mov ecx, dword [edi + 0x7c]
lea esi, [edx - 4]
shr esi, 2
add ecx, 0x1078
inc esi
lea ebx, [esi*4]
movss xmm0, dword [ecx - 0xc60]
ucomiss xmm0, xmm1
lahf
test ah, 0x44
jp 0x1002d92c
mov dword [ecx - 0xc60], 0x7f7fffff
movss xmm0, dword [ecx - 0x840]
ucomiss xmm0, xmm1
lahf
test ah, 0x44
jp 0x1002d947
mov dword [ecx - 0x840], 0x7f7fffff
movss xmm0, dword [ecx - 0x420]
ucomiss xmm0, xmm1
lahf
test ah, 0x44
jp 0x1002d962
mov dword [ecx - 0x420], 0x7f7fffff
movss xmm0, dword [ecx]
ucomiss xmm0, xmm1
lahf
test ah, 0x44
jp 0x1002d975
mov dword [ecx], 0x7f7fffff
add ecx, 0x1080
sub esi, 1
jne 0x1002d911
cmp ebx, edx
jl 0x1002d98f
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
test edx, edx
jle 0x1002d9be
imul ecx, ebx, 0x420
add ecx, 0x418
add ecx, dword [edi + 0x7c]
sub edx, ebx
movss xmm0, dword [ecx]
ucomiss xmm0, xmm1
lahf
test ah, 0x44
jp 0x1002d9b3
mov dword [ecx], 0x7f7fffff
add ecx, 0x420
sub edx, 1
jne 0x1002d9a0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret