joyce8/EMBER2024-capa huggingface dataset:
Function at 0x441690
Capabilities:
Check for software breakpoints

Disassembly:
push esi
mov esi, dword [esp + 8]
cmp dword [esi + 0x10], 0xca
jne 0x4416c3
push esi
call fcn.0044f9d0
mov eax, dword [esi + 0x40]
add esp, 4
test eax, eax
je 0x4416bc
mov dword [esi + 0x10], 0xcf
mov eax, 1
pop esi
ret
mov dword [esi + 0x10], 0xcb
mov eax, dword [esi + 0x10]
cmp eax, 0xcb
jne 0x441749
mov eax, dword [esi + 0x1b0]
mov ecx, dword [eax + 0x10]
test ecx, ecx
je 0x441732
mov eax, dword [esi + 8]
test eax, eax
je 0x4416e7
push esi
call dword [eax]
add esp, 4
mov ecx, dword [esi + 0x1b0]
push esi
call dword [ecx]
add esp, 4
test eax, eax
je 0x44172e
cmp eax, 2
je 0x441732
mov ecx, dword [esi + 8]
test ecx, ecx
je 0x4416da
cmp eax, 3
je 0x44170d
cmp eax, 1
jne 0x4416da
mov eax, dword [ecx + 4]
inc eax
mov dword [ecx + 4], eax
mov eax, dword [esi + 8]
mov ecx, dword [eax + 8]
mov edx, dword [eax + 4]
cmp edx, ecx
jl 0x4416da
mov edx, dword [esi + 0x13c]
add edx, ecx
mov dword [eax + 8], edx
jmp 0x4416da
xor eax, eax
pop esi
ret
mov eax, dword [esi + 0x90]
push esi
mov dword [esi + 0x98], eax
call fcn.00441770
add esp, 4
pop esi
ret
cmp eax, 0xcc
je 0x441758
mov ecx, dword [esi]
push esi
call dword [ecx]
add esp, 4
push esi
call fcn.00441770
add esp, 4
pop esi
ret

Function at 0x441fe0
Capabilities:
Terminate process

Disassembly:
mov eax, dword [esp + 4]
test eax, eax
je 0x442001
mov ecx, dword [eax + 0x40]
test ecx, ecx
je 0x442001
mov eax, dword [eax + 0x44]
test eax, eax
je 0x442001
mov edx, dword [esp + 8]
push edx
push eax
call ecx
add esp, 8
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]

Function at 0x45f4c0
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ecx
mov eax, dword [0xc25adc]
xor edx, edx
cmp eax, edx
jne 0x45f4e6
xor eax, eax
mov byte [eax + 0xc259dc], al
inc eax
cmp eax, 0x100
jl 0x45f4ce
mov dword [0xc25adc], 1
mov eax, dword [esp + 0xc]
push ebx
mov ebx, dword [esp + 0x14]
push esi
push edi
mov ecx, 0x40
mov esi, 0xc259dc
mov edi, ebx
rep movsd dword es:[edi], dword [esi]
cmp eax, edx
mov byte [ebx + 0x100], dl
mov byte [ebx + 0x101], dl
jle 0x45f577
xor esi, esi
push ebp
mov byte [esp + 0x20], dl
xor ecx, ecx
mov edi, dword [esp + 0x20]
mov ebp, dword [esp + 0x18]
mov al, byte [esi + ebx]
and edi, 0xff
xor edx, edx
mov dl, byte [edi + ebp]
mov ebp, eax
and ebp, 0xff
add ecx, edx
add ecx, ebp
and ecx, 0x800000ff
jns 0x45f54a
dec ecx
or ecx, 0xffffff00
inc ecx
mov byte [esp + 0x10], cl
mov ecx, dword [esp + 0x10]
and ecx, 0xff
mov dl, byte [ecx + ebx]
mov byte [esi + ebx], dl
mov byte [ecx + ebx], al
lea eax, [edi + 1]
cdq
idiv dword [esp + 0x1c]
inc esi
cmp esi, 0x100
mov byte [esp + 0x20], dl
jl 0x45f518
pop ebp
pop edi
pop esi
pop ebx
pop ecx
ret
Function at 0x45f580
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [ebp + 0x10]
push ebx
push esi
push edi
mov cl, byte [eax + 0x100]
mov dl, byte [eax + 0x101]
mov dword [ebp - 8], eax
mov byte [ebp - 1], cl
mov byte [ebp - 2], dl
xor ebx, ebx
mov bl, byte [ebp - 1]
xor edx, edx
mov dl, byte [ebp - 2]
mov esi, dword [ebp - 8]
mov edi, dword [ebp + 8]
xor eax, eax
mov ecx, dword [ebp + 0xc]
test ecx, ecx
jle 0x45f5d3
inc bl
mov al, byte [esi + ebx]
add dl, al
xchg byte [esi + edx], al
mov byte [esi + ebx], al
add al, byte [esi + edx]
mov al, byte [esi + eax]
xor byte [edi], al
inc edi
dec ecx
jne 0x45f5ba
mov byte [ebp - 1], bl
mov byte [ebp - 2], dl
mov eax, dword [ebp + 0x10]
mov cl, byte [ebp - 1]
mov dl, byte [ebp - 2]
pop edi
pop esi
mov byte [eax + 0x100], cl
mov byte [eax + 0x101], dl
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x465f90
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x49286e
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
mov eax, dword [esp + 0x18]
push esi
push edi
mov edi, ecx
mov ecx, dword [esp + 0x1c]
push eax
push ecx
mov ecx, edi
mov dword [esp + 0x10], edi
call fcn.004668b0
push 0x10
mov dword [esp + 0x18], 0
mov dword [edi], 0xbecc74
call fcn.00484894
mov esi, eax
add esp, 4
mov dword [esp + 0x20], esi
mov al, 1
test esi, esi
mov byte [esp + 0x14], al
je 0x466023
push 4
mov byte [esi + 8], al
mov dword [esi], 0
mov dword [esi + 4], 0
call fcn.00484894
add esp, 4
mov dword [esp + 0x1c], eax
test eax, eax
mov byte [esp + 0x14], 2
je 0x46601c
push 0
mov ecx, eax
call fcn.0045d100
mov dword [esi + 0xc], eax
jmp 0x466025
xor eax, eax
mov dword [esi + 0xc], eax
jmp 0x466025
xor esi, esi
mov ecx, dword [esp + 0xc]
mov dword [edi + 0x30], esi
mov dword [edi + 0x34], 0
mov eax, edi
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret 8

Function at 0x486efa
Capabilities:
Get graphical window text

Disassembly:
push esi
mov esi, ecx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x486f32
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
lea ecx, [eax + 1]
push ecx
mov ecx, dword [esp + 0xc]
push eax
call fcn.00484fae
push eax
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov ecx, dword [esp + 8]
push 0xffffffffffffffff
call fcn.00484f86
jmp 0x486f3e
mov eax, dword [ecx]
push dword [esp + 8]
call dword [eax + 0x88]
pop esi
ret 4

Function at 0x4885e8
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
push edi
xor edi, edi
cmp dword [esp + 0x10], edi
mov ebx, ecx
je 0x48862a
call fcn.0048e0a1
mov esi, dword [eax + 0xc]
push 0xf0
push dword [esp + 0x14]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
cmp eax, edi
je 0x48862a
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp eax, edi
jne 0x488621
xor eax, eax
jmp 0x488632
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
push edi
mov ecx, ebx
call fcn.00488638
pop edi
pop esi
pop ebx
ret 4
Function at 0x48e5d1
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
mov esi, ecx
lea ebx, [esi + 0x1c]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [esp + 0x10], 0
jne 0x48e5ff
push dword [esi]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x48e61d
push dword [esp + 0xc]
mov ecx, esi
push eax
call fcn.0048e537
jmp 0x48e61d
mov eax, dword [esi + 0x14]
test eax, eax
je 0x48e61d
push edi
push dword [esp + 0x10]
mov edi, dword [eax + 4]
mov ecx, esi
push eax
call fcn.0048e537
test edi, edi
mov eax, edi
jne 0x48e607
pop edi
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop esi
pop ebx
ret 8
Function at 0x1001c540
Capabilities:
Hash data with md5

Disassembly:
sub esp, 0x134
mov eax, dword [0x10103040]
xor eax, esp
mov dword [esp + 0x12c], eax
mov eax, dword [esp + 0x138]
push ebx
push ebp
mov ebp, dword [esp + 0x144]
mov ebx, ecx
push esi
push edi
mov ecx, 0x10175a17
mov dword [esp + 0x14], eax
call fcn.100b6430
cmp dword [ebx + 0xc], 0
je 0x1001c582
cmp dword [ebx + 8], 0
jne 0x1001c5ac
mov edx, str.A3_________66_0F_6E_86
mov ecx, 0x100bd80c
call fcn.1002b810
mov edx, str.89_35_________F3_0F_10_48
mov ecx, 0x100bd80c
mov eax, dword [eax + 1]
mov dword [ebx + 0xc], eax
call fcn.1002b810
mov eax, dword [eax + 2]
mov dword [ebx + 8], eax
mov esi, dword [ebp + 4]
lea eax, [esp + 0x40]
push 0x40
push 0
push eax
call sub.VCRUNTIME140D.dll_memset
mov eax, 0x20
mov dword [esp + 0x34], 0x67452301
mov dword [esp + 0x44], eax
lea ecx, [esp + 0x4c]
shr eax, 3
mov edx, 0x3f
and eax, 0x3f
mov dword [esp + 0x38], 0xefcdab89
add ecx, eax
mov dword [esp + 0x3c], 0x98badcfe
mov dword [esp + 0x40], 0x10325476
sub edx, eax
mov dword [esp + 0x48], 0
add esp, 0xc
mov dword [esp + 0x40], esi
mov byte [ecx], 0x80
inc ecx
cmp edx, 8
jae 0x1001c635
push edx
push 0
push ecx
call sub.VCRUNTIME140D.dll_memset
add esp, 0xc
lea edx, [esp + 0x40]
lea ecx, [esp + 0x28]
call fcn.100a8150
push 0x38
push 0
lea eax, [esp + 0x48]
push eax
jmp 0x1001c63c
lea eax, [edx - 8]
push eax
push 0
push ecx
call sub.VCRUNTIME140D.dll_memset
mov eax, dword [esp + 0x44]
lea edx, [esp + 0x4c]
add esp, 0xc
mov dword [esp + 0x78], eax
mov eax, dword [esp + 0x3c]
lea ecx, [esp + 0x28]
mov dword [esp + 0x7c], eax
call fcn.100a8150
movups xmm0, xmmword [esp + 0x28]
mov eax, dword [ebx + 0xc]
mov esi, dword [esp + 0x14]
movups xmmword [esp + 0x18], xmm0
mov ecx, dword [esp + 0x1e]
and ecx, 0x7fffffff
mov dword [esp + 0x28], 0
mov dword [eax], ecx
mov eax, dword [ebx + 8]
mov ecx, dword [0x10103ec0]
mov dword [eax], esi
mov eax, dword [ecx + 0x10]
mov dword [ebx], eax
mov eax, dword [ecx + 0x14]
mov dword [ebx + 4], eax
mov eax, dword [0x1016ebd4]
mov ecx, dword [eax]
call fcn.10008080
mov ecx, dword [0x10103ec0]
push esi
movd xmm0, dword [eax]
movss xmm1, dword [ecx + 0x20]
cvtdq2ps xmm0, xmm0
movss dword [ecx + 0x14], xmm1
mulss xmm0, xmm1
movss dword [ecx + 0x10], xmm0
mov ecx, dword [0x101040b4]
mov eax, dword [ecx]
call dword [eax + 0xc]
mov ecx, dword [0x101040a8]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
push 0xb8
lea eax, [esp + 0x84]
push 0
push eax
call sub.VCRUNTIME140D.dll_memset
mov ecx, dword [0x101040ac]
lea edx, [esp + 0x8c]
add esp, 0xc
mov eax, dword [ecx]
push edx
push dword [0x101040a8]
push ebp
push esi
call dword [eax + 0x50]
mov ecx, dword [0x101040b4]
lea edx, [esp + 0x80]
push edx
push esi
mov eax, dword [ecx]
call dword [eax + 4]
mov ecx, dword [0x101040ac]
lea edx, [esp + 0x80]
push edx
push ebp
push esi
mov eax, dword [ecx]
call dword [eax + 0x54]
mov ecx, dword [0x101040b4]
push esi
mov eax, dword [ecx]
call dword [eax + 0x10]
mov ecx, dword [0x101040a8]
push 0
mov eax, dword [ecx]
call dword [eax + 4]
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x12c]
xor ecx, esp
call fcn.100b3fd0
add esp, 0x134
ret 8
Function at 0x1001e8f0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x1c
push ebx
push esi
mov ebx, ecx
mov ecx, 0x101756e3
push edi
mov dword [esp + 0xc], ebx
call fcn.100b6430
cmp dword [ebx + 0x38], 0
je 0x1001e92c
push dword [ebp + 0x10]
mov ecx, ebx
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.MSVCP140D.dll_protected_virtual:_long_long___int64____thiscall_std::basic_streambuf_char__struct_std::char_traits_char__::xsputn_char_const___long_long___int64__]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov eax, dword [ebx + 0x20]
mov esi, dword [ebp + 0xc]
mov edi, dword [ebp + 0x10]
mov dword [esp + 0x20], esi
mov ecx, dword [eax]
lea eax, [ebx + 0x30]
mov dword [esp + 0x24], edi
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x18], eax
test ecx, ecx
je 0x1001e954
mov eax, dword [eax]
mov ecx, dword [eax]
jmp 0x1001e95a
xor ecx, ecx
mov dword [esp + 0x18], eax
mov eax, ecx
cdq
mov dword [esp + 0x10], eax
mov ecx, edx
mov dword [esp + 0x14], ecx
test edi, edi
jl 0x1001e9c8
jg 0x1001e971
test esi, esi
je 0x1001e9c8
test ecx, ecx
jl 0x1001e9bf
jg 0x1001e97b
test eax, eax
je 0x1001e9bf
cmp edi, ecx
jg 0x1001e98f
jl 0x1001e985
cmp esi, eax
jae 0x1001e98f
mov eax, esi
mov dword [esp + 0x10], esi
mov dword [esp + 0x14], edi
mov ebx, dword [ebp + 8]
push eax
push ebx
push dword [esp + 0x24]
call sub.VCRUNTIME140D.dll_memcpy
mov eax, dword [esp + 0x24]
add esp, 0xc
mov edx, dword [esp + 0x10]
add ebx, edx
mov ecx, dword [esp + 0xc]
sub esi, edx
mov eax, dword [eax]
sbb edi, dword [esp + 0x14]
sub dword [eax], edx
mov eax, dword [ecx + 0x20]
add dword [eax], edx
jmp 0x1001e9cf
mov ebx, dword [ebp + 8]
mov ecx, dword [esp + 0xc]
jmp 0x1001e9d9
mov ebx, dword [ebp + 8]
mov ecx, dword [esp + 0xc]
test edi, edi
jl 0x1001e9f3
jg 0x1001e9d9
test esi, esi
je 0x1001e9f3
mov eax, dword [ecx + 0x4c]
test eax, eax
je 0x1001e9f3
push eax
push esi
push 1
push ebx
call dword [sym.imp.ucrtbased.dll_fwrite]
add esp, 0x10
sub esi, eax
sbb edi, 0
mov eax, dword [esp + 0x20]
mov edx, dword [esp + 0x24]
sub eax, esi
sbb edx, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x1001ea10
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0xc
push ebx
push esi
mov esi, dword [ebp + 8]
mov ebx, ecx
push edi
mov ecx, 0x101756e3
mov dword [esp + 0xc], esi
call fcn.100b6430
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebp + 0xc]
test eax, eax
jg 0x1001ea4c
jl 0x1001ea3f
test ecx, ecx
jne 0x1001ea4c
xor eax, eax
xor edx, edx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
cmp dword [ebx + 0x38], 0
je 0x1001ea66
push eax
push ecx
push esi
mov ecx, ebx
call dword [sym.imp.MSVCP140D.dll_protected_virtual:_long_long___int64____thiscall_std::basic_streambuf_char__struct_std::char_traits_char__::xsgetn_char___long_long___int64__]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov eax, dword [ebx + 0x1c]
mov edi, ecx
mov eax, dword [eax]
mov dword [esp + 0x10], eax
test eax, eax
je 0x1001eab9
mov eax, dword [ebx + 0x2c]
lea edx, [ebx + 0x2c]
mov dword [esp + 0x14], edx
mov eax, dword [eax]
test eax, eax
je 0x1001eac0
mov edi, dword [esp + 0xc]
cmp eax, ecx
mov esi, ecx
cmovb esi, eax
push esi
push dword [esp + 0x14]
push edi
call sub.VCRUNTIME140D.dll_memcpy
mov eax, dword [ebx + 0x2c]
add edi, esi
mov dword [esp + 0x18], edi
add esp, 0xc
mov edi, dword [ebp + 0xc]
sub edi, esi
sub dword [eax], esi
mov eax, dword [ebx + 0x1c]
add dword [eax], esi
mov esi, dword [esp + 0xc]
jmp 0x1001eac0
lea eax, [ebx + 0x2c]
mov dword [esp + 0x14], eax
cmp dword [ebx + 0x4c], 0
je 0x1001eb36
mov ecx, dword [ebx + 0xc]
lea eax, [ebx + 0x3c]
cmp dword [ecx], eax
jne 0x1001eaea
mov eax, dword [ebx + 0xc]
mov edx, dword [ebx + 0x54]
mov ecx, dword [ebx + 0x50]
sub edx, ecx
mov dword [eax], ecx
mov eax, dword [ebx + 0x1c]
mov dword [eax], ecx
mov eax, dword [esp + 0x14]
mov eax, dword [eax]
mov dword [eax], edx
mov eax, dword [sym.imp.ucrtbased.dll_fread]
cmp edi, 0xfff
jbe 0x1001eb24
nop word [eax + eax]
push dword [ebx + 0x4c]
push 0xfff
push 1
push esi
call eax
add esp, 0x10
add esi, eax
sub edi, eax
cmp eax, 0xfff
jne 0x1001eb36
cmp edi, eax
mov eax, dword [sym.imp.ucrtbased.dll_fread]
ja 0x1001eb00
test edi, edi
je 0x1001eb36
push dword [ebx + 0x4c]
push edi
push 1
push esi
call eax
add esp, 0x10
sub edi, eax
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 0x10]
sub eax, edi
pop edi
pop esi
sbb edx, 0
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x1001ef80
Capabilities:
Write file on windows

Disassembly:
sub esp, 0x30
mov eax, dword [0x10103040]
xor eax, esp
mov dword [esp + 0x2c], eax
push ebx
mov ebx, dword [esp + 0x38]
push esi
mov esi, ecx
mov ecx, 0x101756e3
call fcn.100b6430
cmp ebx, 0xffffffff
jne 0x1001efba
pop esi
xor eax, eax
pop ebx
mov ecx, dword [esp + 0x2c]
xor ecx, esp
call fcn.100b3fd0
add esp, 0x30
ret 4
mov eax, dword [esi + 0x20]
push edi
mov ecx, dword [eax]
test ecx, ecx
je 0x1001eff7
mov edx, dword [esi + 0x30]
mov edi, dword [edx]
lea eax, [edi + ecx]
cmp ecx, eax
jae 0x1001eff7
lea ecx, [edi - 1]
mov eax, ebx
mov dword [edx], ecx
mov edx, dword [esi + 0x20]
pop edi
mov esi, dword [edx]
lea ecx, [esi + 1]
mov dword [edx], ecx
mov byte [esi], bl
pop esi
pop ebx
mov ecx, dword [esp + 0x2c]
xor ecx, esp
call fcn.100b3fd0
add esp, 0x30
ret 4
cmp dword [esi + 0x4c], 0
je 0x1001f0ff
mov edi, dword [esi + 0xc]
lea eax, [esi + 0x3c]
cmp dword [edi], eax
jne 0x1001f01f
mov edx, dword [esi + 0x54]
mov ecx, dword [esi + 0x50]
sub edx, ecx
mov dword [edi], ecx
mov eax, dword [esi + 0x1c]
mov dword [eax], ecx
mov eax, dword [esi + 0x2c]
mov dword [eax], edx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x1001f054
push dword [esi + 0x4c]
movsx eax, bl
push eax
call dword [sym.imp.ucrtbased.dll_fputc]
add esp, 8
or ecx, 0xffffffff
cmp eax, ecx
cmove ebx, ecx
pop edi
pop esi
mov eax, ebx
pop ebx
mov ecx, dword [esp + 0x2c]
xor ecx, esp
call fcn.100b3fd0
add esp, 0x30
ret 4
lea eax, [esp + 0xc]
mov byte [esp + 0x17], bl
push eax
lea eax, [esp + 0x3c]
push eax
lea eax, [esp + 0x20]
push eax
lea eax, [esp + 0x1c]
push eax
lea eax, [esp + 0x28]
push eax
lea eax, [esp + 0x2b]
push eax
lea eax, [esi + 0x40]
push eax
call dword [sym.imp.MSVCP140D.dll_public:_int___thiscall_std::codecvt_char__char__struct__Mbstatet_::out_struct__Mbstatet___char_const___char_const___char_const____char___char___char___const]
sub eax, 0
je 0x1001f0b9
sub eax, 1
je 0x1001f0b9
sub eax, 2
jne 0x1001f0ff
mov edx, dword [esi + 0x4c]
mov cl, byte [esp + 0x17]
call fcn.1001da70
or ecx, 0xffffffff
test al, al
pop edi
cmove ebx, ecx
pop esi
mov eax, ebx
pop ebx
mov ecx, dword [esp + 0x2c]
xor ecx, esp
call fcn.100b3fd0
add esp, 0x30
ret 4
mov edi, dword [esp + 0xc]
lea eax, [esp + 0x18]
sub edi, eax
je 0x1001f0d9
push dword [esi + 0x4c]
push edi
push 1
push eax
call dword [sym.imp.ucrtbased.dll_fwrite]
add esp, 0x10
cmp edi, eax
jne 0x1001f0ff
lea ecx, [esp + 0x17]
mov byte [esi + 0x3d], 1
or eax, 0xffffffff
cmp dword [esp + 0x10], ecx
pop edi
pop esi
cmovne eax, ebx
pop ebx
mov ecx, dword [esp + 0x2c]
xor ecx, esp
call fcn.100b3fd0
add esp, 0x30
ret 4
mov ecx, dword [esp + 0x38]
or eax, 0xffffffff
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.100b3fd0
add esp, 0x30
ret 4
Function at 0x1001fbe0
Capabilities:
Write file on windows

Disassembly:
sub esp, 0x28
mov eax, dword [0x10103040]
xor eax, esp
mov dword [esp + 0x24], eax
push esi
mov esi, ecx
mov ecx, 0x101756e3
call fcn.100b6430
cmp dword [esi + 0x38], 0
je 0x1001fcae
cmp byte [esi + 0x3d], 0
je 0x1001fcae
mov eax, dword [esi]
mov ecx, esi
push edi
push 0xffffffffffffffff
call dword [eax + 0xc]
cmp eax, 0xffffffff
je 0x1001fc9b
mov ecx, dword [esi + 0x38]
lea eax, [esp + 8]
push eax
lea eax, [esp + 0x30]
push eax
lea eax, [esp + 0x14]
push eax
lea eax, [esi + 0x40]
push eax
call dword [sym.imp.MSVCP140D.dll_public:_int___thiscall_std::codecvt_char__char__struct__Mbstatet_::unshift_struct__Mbstatet___char___char___char___const]
sub eax, 0
je 0x1001fc5f
sub eax, 1
je 0x1001fc63
sub eax, 2
jne 0x1001fc9b
mov byte [esi + 0x3d], al
mov al, 1
pop edi
pop esi
mov ecx, dword [esp + 0x24]
xor ecx, esp
call fcn.100b3fd0
add esp, 0x28
ret
mov byte [esi + 0x3d], 0
mov edi, dword [esp + 8]
lea eax, [esp + 0xc]
sub edi, eax
je 0x1001fc83
push dword [esi + 0x4c]
push edi
push 1
push eax
call dword [sym.imp.ucrtbased.dll_fwrite]
add esp, 0x10
cmp edi, eax
jne 0x1001fc9b
cmp byte [esi + 0x3d], 0
pop edi
sete al
pop esi
mov ecx, dword [esp + 0x24]
xor ecx, esp
call fcn.100b3fd0
add esp, 0x28
ret
pop edi
xor al, al
pop esi
mov ecx, dword [esp + 0x24]
xor ecx, esp
call fcn.100b3fd0
add esp, 0x28
ret
mov ecx, dword [esp + 0x28]
mov al, 1
pop esi
xor ecx, esp
call fcn.100b3fd0
add esp, 0x28
ret
Function at 0x1002e3b0
Capabilities:
Hash data with crc32

Disassembly:
push ecx
push ebx
mov ebx, dword [0x10103ea8]
mov ecx, 0x1017530e
push esi
push edi
call fcn.100b6430
mov edi, 4
lea esi, [ebx + 4]
or eax, 0xffffffff
nop
jmp dword [edi*4 + 0x1002f608]
Function at 0x1003cdf0
Capabilities:
Read file on windows

Disassembly:
push esi
mov esi, ecx
mov ecx, 0x10175a17
push edi
call fcn.100b6430
test esi, esi
jne 0x1003ce1a
push 0x5fa
push 0x100c05b8
push str.filename__file_open_mode
call dword [sym.imp.ucrtbased.dll__wassert]
add esp, 0xc
mov edi, dword [esp + 0xc]
test edi, edi
je 0x1003ce28
mov dword [edi], 0
mov edx, 0x100c3c68
mov ecx, esi
call fcn.1003cc40
mov esi, eax
test esi, esi
jne 0x1003ce3d
pop edi
pop esi
ret
push ebx
push ebp
mov ebp, dword [sym.imp.ucrtbased.dll_fseek]
push 2
push 0
push esi
call ebp
add esp, 0xc
test eax, eax
jne 0x1003cedb
push esi
call dword [sym.imp.ucrtbased.dll_ftell]
mov ebx, eax
add esp, 4
cmp ebx, 0xffffffff
je 0x1003cedb
push 0
push 0
push esi
call ebp
add esp, 0xc
test eax, eax
jne 0x1003cedb
mov ecx, ebx
call fcn.10041ad0
mov ebp, eax
test ebp, ebp
je 0x1003cedb
push esi
push ebx
push 1
push ebp
call dword [sym.imp.ucrtbased.dll_fread]
add esp, 0x10
push esi
cmp eax, ebx
je 0x1003cec5
call dword [sym.imp.ucrtbased.dll_fclose]
mov eax, dword [0x1010713c]
add esp, 4
test eax, eax
je 0x1003ceae
dec dword [eax + 0x36c]
push dword [0x10168b44]
push ebp
call dword [0x10103308]
add esp, 8
xor eax, eax
pop ebp
pop ebx
pop edi
pop esi
ret
call dword [sym.imp.ucrtbased.dll_fclose]
add esp, 4
test edi, edi
je 0x1003ced4
mov dword [edi], ebx
mov eax, ebp
pop ebp
pop ebx
pop edi
pop esi
ret
push esi
call dword [sym.imp.ucrtbased.dll_fclose]
add esp, 4
xor eax, eax
pop ebp
pop ebx
pop edi
pop esi
ret
Function at 0x10040b10
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push esi
mov esi, ecx
mov ecx, 0x10175a17
push edi
call fcn.100b6430
cmp dword [esi + 0x1c0], 0
jg 0x10040b3f
push 0x4b7
push 0x100c0510
push str.Size___0
call dword [sym.imp.ucrtbased.dll__wassert]
add esp, 0xc
mov ecx, dword [esi + 0x1c0]
mov edi, 4
mov eax, dword [esi + 0x1c8]
lea esi, [esp + 0xc]
mov eax, dword [eax + ecx*4 - 4]
not eax
nop word [eax + eax]
movzx ecx, byte [esi]
lea esi, [esi + 1]
movzx edx, al
xor edx, ecx
shr eax, 8
xor eax, dword [edx*4 + 0x100c46f0]
sub edi, 1
jne 0x10040b60
mov ecx, dword [0x1010713c]
not eax
pop edi
pop esi
cmp dword [ecx + 0x19bc], eax
jne 0x10040b92
mov dword [ecx + 0x19c4], eax
cmp dword [ecx + 0x19c0], eax
jne 0x10040ba1
mov byte [ecx + 0x19d0], 1
ret 4

Function at 0x10040c10
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push esi
mov esi, ecx
mov ecx, 0x10175a17
push edi
call fcn.100b6430
cmp dword [esi + 0x1c0], 0
jg 0x10040c3f
push 0x4b7
push 0x100c0510
push str.Size___0
call dword [sym.imp.ucrtbased.dll__wassert]
add esp, 0xc
mov ecx, dword [esi + 0x1c0]
mov edi, 4
mov eax, dword [esi + 0x1c8]
lea esi, [esp + 0xc]
mov eax, dword [eax + ecx*4 - 4]
not eax
nop word [eax + eax]
movzx ecx, byte [esi]
lea esi, [esi + 1]
movzx edx, al
xor edx, ecx
shr eax, 8
xor eax, dword [edx*4 + 0x100c46f0]
sub edi, 1
jne 0x10040c60
pop edi
pop esi
not eax
ret 4

Function at 0x10040c90
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
sub esp, 0x14
mov eax, dword [0x10103040]
xor eax, esp
mov dword [esp + 0x10], eax
push esi
mov esi, ecx
mov ecx, 0x10175a17
push edi
call fcn.100b6430
cmp dword [esi + 0x1c0], 0
jg 0x10040ccd
push 0x4b7
push 0x100c0510
push str.Size___0
call dword [sym.imp.ucrtbased.dll__wassert]
add esp, 0xc
mov ecx, dword [esp + 0x20]
mov edi, 0x10
movss xmm0, dword [ecx]
subss xmm0, dword [esi + 0xc]
cvttss2si eax, xmm0
movss xmm0, dword [ecx + 4]
subss xmm0, dword [esi + 0x10]
mov dword [esp + 8], eax
cvttss2si eax, xmm0
movss xmm0, dword [ecx + 8]
subss xmm0, dword [esi + 0xc]
mov dword [esp + 0xc], eax
cvttss2si eax, xmm0
movss xmm0, dword [ecx + 0xc]
subss xmm0, dword [esi + 0x10]
mov ecx, dword [esi + 0x1c0]
mov dword [esp + 0x10], eax
cvttss2si eax, xmm0
mov dword [esp + 0x14], eax
mov eax, dword [esi + 0x1c8]
lea esi, [esp + 8]
mov edx, dword [eax + ecx*4 - 4]
not edx
movzx eax, byte [esi]
lea esi, [esi + 1]
movzx ecx, dl
xor ecx, eax
shr edx, 8
xor edx, dword [ecx*4 + 0x100c46f0]
sub edi, 1
jne 0x10040d33
mov eax, dword [0x1010713c]
not edx
pop edi
pop esi
cmp dword [eax + 0x19bc], edx
jne 0x10040d64
mov dword [eax + 0x19c4], edx
cmp dword [eax + 0x19c0], edx
jne 0x10040d73
mov byte [eax + 0x19d0], 1
mov ecx, dword [esp + 0x10]
mov eax, edx
xor ecx, esp
call fcn.100b3fd0
add esp, 0x14
ret 4