joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100478f0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x68
push esi
push edi
mov edi, dword [esp + 0x74]
mov ecx, edi
call fcn.100282c0
mov esi, eax
mov ecx, esi
mov dword [esp + 0x74], esi
mov edx, dword [esi]
mov edx, dword [edx + 0x14]
call edx
cmp eax, 4
jae 0x10047928
xorps xmm0, xmm0
comisd xmm0, xmmword [esp + 0x78]
pop edi
pop esi
seta al
add esp, 0x68
ret 0xc
mov eax, dword [esi]
mov ecx, esi
mov eax, dword [eax + 0x14]
call eax
cmp eax, 4
jne 0x100479fa
mov eax, dword [esi]
mov ecx, esi
push 2
mov eax, dword [eax + 0xc]
call eax
mov edx, dword [esi]
mov ecx, esi
push 1
mov edi, eax
mov edx, dword [edx + 0xc]
call edx
mov ecx, dword [esp + 0x74]
mov esi, eax
push 0
mov edx, dword [ecx]
mov edx, dword [edx + 0xc]
call edx
lea ecx, [esp + 8]
movups xmm0, xmmword [eax]
movups xmmword [esp + 8], xmm0
movq xmm0, qword [eax + 0x10]
lea eax, [esp + 0x50]
movq qword [esp + 0x18], xmm0
movups xmm0, xmmword [esi]
push eax
movups xmmword [esp + 0x24], xmm0
movq xmm0, qword [esi + 0x10]
movq qword [esp + 0x34], xmm0
movups xmm0, xmmword [edi]
movups xmmword [esp + 0x3c], xmm0
movq xmm0, qword [edi + 0x10]
movq qword [esp + 0x4c], xmm0
xorps xmm0, xmm0
movups xmmword [esp + 0x54], xmm0
movsd xmm0, qword [0x102de680]
movsd qword [esp + 0x64], xmm0
call fcn.100607b0
lea eax, [esp + 0x20]
push eax
lea eax, [esp + 0xc]
push eax
lea eax, [esp + 0x58]
push eax
call fcn.1003f3d0
movsd xmm0, qword [esp + 0x84]
add esp, 0xc
andps xmm0, xmmword [0x101fc7b0]
fstp qword [esp + 0x68]
comisd xmm0, xmmword [esp + 0x68]
pop edi
pop esi
seta al
add esp, 0x68
ret 0xc
mov eax, dword [edi]
mov ecx, edi
mov eax, dword [eax + 0x54]
call eax
mov edx, eax
xorps xmm3, xmm3
movsd xmm0, qword [edx + 8]
ucomisd xmm0, xmm0
setp cl
cmp cl, 1
jne 0x10047a1e
xorps xmm1, xmm1
jmp 0x10047a25
movaps xmm1, xmm0
subsd xmm1, qword [edx]
ucomisd xmm0, xmm0
setp al
movzx eax, al
cmp al, 1
jne 0x10047a38
xorps xmm2, xmm2
jmp 0x10047a42
movsd xmm2, qword [edx + 0x18]
subsd xmm2, qword [edx + 0x10]
movsd xmm0, qword [esp + 0x78]
comisd xmm3, xmm0
jbe 0x10047a6c
andps xmm0, xmmword [0x101fc7b0]
minsd xmm1, xmm2
addsd xmm0, xmm0
pop edi
pop esi
comisd xmm0, xmm1
seta al
add esp, 0x68
ret 0xc
pop edi
xor al, al
pop esi
add esp, 0x68
ret 0xc
Function at 0x10051220
Capabilities:
Encode data using xor

Disassembly:
sub esp, 8
mov ecx, dword [esp + 0x10]
mov eax, 0x2aaaaaab
push ebx
push esi
mov esi, dword [esp + 0x14]
sub ecx, esi
imul ecx
sar edx, 2
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
mov ebx, ecx
mov dword [esp + 0x14], ecx
sar ebx, 1
test ebx, ebx
jle 0x1005136f
lea eax, [ecx - 1]
mov dword [esp + 0xc], eax
sar eax, 1
push ebp
mov dword [esp + 0x1c], eax
lea eax, [ebx + ebx*2]
push edi
lea ebp, [esi + eax*8]
mov eax, dword [esp + 0x20]
sub ebp, 0x18
dec ebx
mov dword [esp + 0x10], ebp
mov edx, ebx
mov edi, ebx
movq xmm3, qword [ebp + 0x10]
movups xmm2, xmmword [ebp]
cmp ebx, eax
jge 0x100512df
mov ebp, eax
lea ecx, [edi + edi]
lea eax, [ecx + ecx*2]
movsd xmm0, qword [esi + eax*8 + 0x20]
lea edi, [ecx + 1]
movsd xmm1, qword [esi + eax*8 + 0x38]
addsd xmm0, qword [esi + eax*8 + 0x18]
addsd xmm1, qword [esi + eax*8 + 0x30]
xor eax, eax
comisd xmm0, xmm1
seta al
xor eax, 1
add edi, eax
lea eax, [edx + edx*2]
mov edx, edi
lea ecx, [edi + edi*2]
movups xmm0, xmmword [esi + ecx*8]
movups xmmword [esi + eax*8], xmm0
movq xmm0, qword [esi + ecx*8 + 0x10]
movq qword [esi + eax*8 + 0x10], xmm0
cmp edi, ebp
jl 0x10051284
mov ecx, dword [esp + 0x1c]
mov ebp, dword [esp + 0x10]
mov eax, dword [esp + 0x20]
cmp edx, eax
jne 0x10051307
test cl, 1
jne 0x10051307
lea ecx, [ecx + ecx*2]
movups xmm0, xmmword [esi + ecx*8 - 0x18]
lea eax, [edx + edx*2]
mov edx, dword [esp + 0x14]
movups xmmword [esi + eax*8], xmm0
movq xmm0, qword [esi + ecx*8 - 8]
movq qword [esi + eax*8 + 0x10], xmm0
lea ecx, [edx - 1]
sar ecx, 1
cmp ebx, edx
jge 0x10051354
movaps xmm1, xmm2
unpckhpd xmm1, xmm2
addsd xmm1, xmm2
nop dword [eax + eax]
lea edi, [ecx + ecx*2]
movsd xmm0, qword [esi + edi*8 + 8]
addsd xmm0, qword [esi + edi*8]
comisd xmm1, xmm0
jbe 0x10051354
movups xmm0, xmmword [esi + edi*8]
lea eax, [edx + edx*2]
mov edx, ecx
dec ecx
movups xmmword [esi + eax*8], xmm0
sar ecx, 1
movq xmm0, qword [esi + edi*8 + 0x10]
movq qword [esi + eax*8 + 0x10], xmm0
cmp ebx, edx
jl 0x10051320
mov ecx, dword [esp + 0x1c]
lea eax, [edx + edx*2]
movups xmmword [esi + eax*8], xmm2
movq qword [esi + eax*8 + 0x10], xmm3
test ebx, ebx
jg 0x10051265
pop edi
pop ebp
pop esi
pop ebx
add esp, 8
ret
Function at 0x10051720
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [esp + 0xc]
mov edx, dword [esp + 4]
push ebx
push ebp
lea ecx, [eax - 1]
mov ebx, ecx
push esi
mov esi, dword [esp + 0x14]
mov ebp, esi
sar ebx, 1
mov dword [esp + 0x14], ecx
push edi
mov edi, esi
cmp esi, ebx
jge 0x10051796
lea ecx, [edi + edi]
lea eax, [ecx + ecx*2]
movsd xmm0, qword [edx + eax*8 + 0x20]
lea edi, [ecx + 1]
movsd xmm1, qword [edx + eax*8 + 0x38]
addsd xmm0, qword [edx + eax*8 + 0x18]
addsd xmm1, qword [edx + eax*8 + 0x30]
xor eax, eax
comisd xmm0, xmm1
seta al
xor eax, 1
add edi, eax
lea eax, [esi + esi*2]
mov esi, edi
lea ecx, [edi + edi*2]
movups xmm0, xmmword [edx + ecx*8]
movups xmmword [edx + eax*8], xmm0
movq xmm0, qword [edx + ecx*8 + 0x10]
movq qword [edx + eax*8 + 0x10], xmm0
cmp edi, ebx
jl 0x10051743
mov eax, dword [esp + 0x1c]
cmp edi, ebx
jne 0x100517bd
test al, 1
jne 0x100517bd
lea ecx, [eax + eax*2]
movups xmm0, xmmword [edx + ecx*8 - 0x18]
lea eax, [esi + esi*2]
mov esi, dword [esp + 0x18]
movups xmmword [edx + eax*8], xmm0
movq xmm0, qword [edx + ecx*8 - 8]
movq qword [edx + eax*8 + 0x10], xmm0
mov ebx, dword [esp + 0x20]
cmp ebp, esi
jge 0x1005180f
nop word [eax + eax]
movsd xmm0, qword [ebx + 8]
lea ecx, [esi - 1]
addsd xmm0, qword [ebx]
sar ecx, 1
lea edi, [ecx + ecx*2]
movsd xmm1, qword [edx + edi*8 + 8]
addsd xmm1, qword [edx + edi*8]
comisd xmm0, xmm1
jbe 0x1005180f
lea eax, [esi + esi*2]
mov esi, ecx
movups xmm0, xmmword [edx + edi*8]
movups xmmword [edx + eax*8], xmm0
movq xmm0, qword [edx + edi*8 + 0x10]
movq qword [edx + eax*8 + 0x10], xmm0
cmp ebp, ecx
jl 0x100517d0
movups xmm0, xmmword [ebx]
pop edi
lea eax, [esi + esi*2]
pop esi
movups xmmword [edx + eax*8], xmm0
pop ebp
movq xmm0, qword [ebx + 0x10]
movq qword [edx + eax*8 + 0x10], xmm0
pop ebx
ret
Function at 0x100526e0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
and esp, 0xffffffc0
sub esp, 0x34
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov ecx, dword [edi]
mov eax, dword [ecx]
call dword [eax + 0x14]
mov edx, eax
movzx eax, dl
xor eax, 0x811c9dc5
mov dword [esp + 0x38], edx
imul ecx, eax, 0x1000193
mov eax, edx
shr eax, 8
movzx eax, al
xor ecx, eax
mov eax, edx
imul ecx, ecx, 0x1000193
shr eax, 0x10
movzx eax, al
xor ecx, eax
mov eax, edx
imul ecx, ecx, 0x1000193
shr eax, 0x18
xor ecx, eax
imul ebx, ecx, 0x1000193
cmp byte [edi + 4], 0
je 0x100527aa
xor esi, esi
mov dword [esp + 0x3c], esi
test edx, edx
je 0x10052809
nop dword [eax + eax]
mov ecx, dword [edi]
push esi
mov eax, dword [ecx]
call dword [eax + 0xc]
mov edi, eax
lea ecx, [esp + 0x37]
sub esp, 8
movsd xmm0, qword [edi + 8]
movsd qword [esp], xmm0
call fcn.10015e40
movsd xmm0, qword [edi]
lea ecx, [esp + 0x37]
sub esp, 8
mov esi, eax
add esi, esi
movsd qword [esp], xmm0
call fcn.10015e40
mov edi, dword [ebp + 8]
xor esi, eax
xor ebx, esi
mov esi, dword [esp + 0x3c]
inc esi
mov dword [esp + 0x3c], esi
cmp esi, dword [esp + 0x38]
jb 0x10052750
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
test edx, edx
je 0x10052809
dec edx
mov dword [esp + 0x3c], edx
mov ecx, dword [edi]
push edx
mov eax, dword [ecx]
call dword [eax + 0xc]
mov edi, eax
lea ecx, [esp + 0x37]
sub esp, 8
movsd xmm0, qword [edi + 8]
movsd qword [esp], xmm0
call fcn.10015e40
movsd xmm0, qword [edi]
lea ecx, [esp + 0x37]
sub esp, 8
mov esi, eax
add esi, esi
movsd qword [esp], xmm0
call fcn.10015e40
mov edx, dword [esp + 0x3c]
xor esi, eax
mov eax, dword [esp + 0x38]
dec edx
mov edi, dword [ebp + 8]
dec eax
xor ebx, esi
mov dword [esp + 0x38], eax
mov dword [esp + 0x3c], edx
test eax, eax
jne 0x100527b3
pop edi
pop esi
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x100569e0
Capabilities:
Access peb ldr_data
Get ntdll base address
Get process heap flags

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x101f9be0
mov eax, dword fs:[0]
push eax
sub esp, 0xa4
push esi
mov eax, dword [0x102f0d80]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
push 1
lea ecx, [ebp - 0xb0]
call fcn.10015ce0
lea eax, [ebp - 0xb0]
mov dword [ebp - 4], 0
push str.EdgeEnd:
push eax
call fcn.100077b0
lea eax, [esi + 0x18]
push eax
lea eax, [ebp - 0xb0]
push eax
call fcn.100310e0
lea eax, [ebp - 0xb0]
push 0x10201410
push eax
call fcn.100077b0
lea eax, [esi + 0x30]
push eax
lea eax, [ebp - 0xb0]
push eax
call fcn.100310e0
lea eax, [ebp - 0xb0]
push 0x101fca9c
push eax
call fcn.100077b0
fld qword [esi + 0x50]
add esp, 0x28
fld qword [esi + 0x48]
call fcn.10131cc0
sub esp, 8
lea ecx, [ebp - 0xb0]
fstp qword [ebp - 0x18]
movsd xmm0, qword [ebp - 0x18]
movsd qword [esp], xmm0
push 0x101fcc58
push dword [esi + 0x58]
call fcn.10024310
push eax
call fcn.100077b0
add esp, 8
mov ecx, eax
call fcn.1000ef60
lea eax, [ebp - 0xb0]
push 0x1020078c
push eax
call fcn.100077b0
lea eax, [esi + 0xc]
push eax
lea eax, [ebp - 0xb0]
push eax
call fcn.10060ca0
mov esi, dword [ebp + 8]
lea ecx, [ebp - 0xac]
add esp, 0x10
push esi
call fcn.1000e1a0
mov eax, dword [ebp - 0xb0]
mov eax, dword [eax + 4]
mov dword [ebp + eax - 0xb0], vtable.std::basic_ostringstream_char__struct_std::char_traits_char___class_std::allocator_char__.0
mov eax, dword [ebp - 0xb0]
mov ecx, dword [eax + 4]
lea eax, [ecx - 0x50]
mov dword [ebp + ecx - 0xb4], eax
lea ecx, [ebp - 0xac]
call fcn.10009340
mov eax, dword [ebp - 0xb0]
mov eax, dword [eax + 4]
mov dword [ebp + eax - 0xb0], vtable.std::basic_ostream_char__struct_std::char_traits_char__.0
mov eax, dword [ebp - 0xb0]
mov edx, dword [eax + 4]
lea ecx, [edx - 8]
mov dword [ebp + edx - 0xb4], ecx
lea eax, [ebp - 0x60]
mov dword [ebp - 4], 1
push eax
mov dword [ebp - 0x60], vtable.std::ios_base.0
call fcn.1011b19a
add esp, 4
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret 4

Function at 0x10065d40
Capabilities:
Read file on windows

Disassembly:
sub esp, 0x104
mov eax, dword [0x102f0d80]
xor eax, esp
mov dword [esp + 0x100], eax
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0x118]
lea eax, [esp + 0x10]
push 0x100
push 0
push eax
call fcn.1011e7c0
push 0x102018f4
push edi
call fcn.101320d0
mov ebx, eax
add esp, 0x14
test ebx, ebx
je 0x10065dd5
push ebx
push 0x100
lea eax, [esp + 0x18]
push 1
push eax
call fcn.101322c0
push ebx
mov ebp, eax
call fcn.10131fed
push ebx
mov esi, eax
call fcn.10131fbd
add esp, 0x18
test esi, esi
jne 0x10065dd5
mov esi, dword [0x102f4be4]
test esi, esi
je 0x10065dd1
push ebp
lea eax, [esp + 0x14]
push eax
mov eax, dword [esi + 4]
push edi
call eax
add esp, 0xc
test eax, eax
jne 0x10065dd1
mov esi, dword [esi + 0xc]
test esi, esi
jne 0x10065db7
mov eax, esi
jmp 0x10065dd7
xor eax, eax
mov ecx, dword [esp + 0x110]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.1011bad5
add esp, 0x104
ret
Function at 0x1006c070
Capabilities:
Read file on windows

Disassembly:
sub esp, 8
push ebx
push ebp
mov ebp, dword [esp + 0x1c]
xorps xmm0, xmm0
push esi
push edi
push dword [esp + 0x2c]
movlpd qword [esp + 0x14], xmm0
push dword [esp + 0x2c]
push ebp
push dword [esp + 0x2c]
call fcn.1011c800
mov edi, dword [esp + 0x30]
mov esi, eax
mov ebx, edx
cmp dword [edi + 0x1e2c], 0
je 0x1006c0d3
push dword [edi + 0x1e44]
mov eax, dword [edi + 0x1e38]
push ebx
push esi
push dword [esp + 0x28]
call eax
mov esi, dword [esp + 0x30]
add esp, 0x10
push ebp
push esi
push edx
push eax
call fcn.1011c9c0
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret
test ebx, ebx
jg 0x1006c0e9
jl 0x1006c0dd
test esi, esi
jne 0x1006c0e9
pop edi
pop esi
pop ebp
xor eax, eax
xor edx, edx
pop ebx
add esp, 8
ret
mov eax, dword [esp + 0x14]
mov ebp, dword [esp + 0x10]
mov dword [esp + 0x30], eax
test ebx, ebx
jne 0x1006c103
mov eax, esi
cmp esi, 0x40000000
jbe 0x1006c108
mov eax, 0x40000000
push 0
lea ecx, [esp + 0x14]
push ecx
push eax
mov eax, dword [esp + 0x28]
add eax, ebp
push eax
push dword [edi + 0x900]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x1006c14c
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x30]
test eax, eax
je 0x1006c160
cdq
add ebp, eax
adc ecx, edx
sub esi, eax
mov dword [esp + 0x30], ecx
sbb ebx, edx
test ebx, ebx
jg 0x1006c103
jl 0x1006c160
test esi, esi
jne 0x1006c0f5
jmp 0x1006c160
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push edi
call fcn.1006c630
mov ecx, dword [esp + 0x38]
add esp, 8
cmp dword [edi + 0x1cfc], 0
je 0x1006c175
add dword [edi + 0x1d00], ebp
adc dword [edi + 0x1d04], ecx
push dword [esp + 0x24]
mov esi, dword [esp + 0x24]
push esi
push ecx
push ebp
call fcn.1011c9c0
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret

Function at 0x1006c2f0
Capabilities:
Clear file content

Disassembly:
mov ecx, dword [esp + 0xc]
mov eax, dword [esp + 8]
push esi
xor esi, esi
test ecx, ecx
jg 0x1006c30c
jl 0x1006c305
test eax, eax
jae 0x1006c30c
mov eax, 1
pop esi
ret
push edi
mov edi, dword [esp + 0xc]
push 0
push 0
push ecx
push eax
push dword [edi + 0x900]
call dword [sym.imp.KERNEL32.dll_SetFilePointerEx]
test eax, eax
jne 0x1006c343
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x1006c343
push eax
push edi
or esi, 0xffffffff
call fcn.1006c630
add esp, 8
mov eax, esi
pop edi
pop esi
ret
push dword [edi + 0x900]
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
test eax, eax
jne 0x1006c366
or esi, 0xffffffff
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push edi
call fcn.1006c630
add esp, 8
pop edi
mov eax, esi
pop esi
ret
Function at 0x1006c370
Capabilities:
Write file on windows

Disassembly:
sub esp, 8
push ebx
push ebp
mov ebp, dword [esp + 0x1c]
xorps xmm0, xmm0
push esi
push edi
push dword [esp + 0x2c]
movlpd qword [esp + 0x14], xmm0
push dword [esp + 0x2c]
push ebp
push dword [esp + 0x2c]
call fcn.1011c800
mov edi, dword [esp + 0x30]
mov esi, eax
mov ebx, edx
cmp dword [edi + 0x1e2c], 0
je 0x1006c3d3
push dword [edi + 0x1e44]
mov eax, dword [edi + 0x1e3c]
push ebx
push esi
push dword [esp + 0x28]
call eax
mov esi, dword [esp + 0x30]
add esp, 0x10
push ebp
push esi
push edx
push eax
call fcn.1011c9c0
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret
test ebx, ebx
jg 0x1006c3e9
jl 0x1006c3dd
test esi, esi
jne 0x1006c3e9
pop edi
pop esi
pop ebp
xor eax, eax
xor edx, edx
pop ebx
add esp, 8
ret
mov eax, dword [esp + 0x14]
mov ebp, dword [esp + 0x10]
mov dword [esp + 0x30], eax
test ebx, ebx
jne 0x1006c403
mov eax, esi
cmp esi, 0x40000000
jbe 0x1006c408
mov eax, 0x40000000
push 0
lea ecx, [esp + 0x14]
push ecx
push eax
mov eax, dword [esp + 0x28]
add eax, ebp
push eax
push dword [edi + 0x900]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x1006c44c
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x30]
test eax, eax
je 0x1006c460
cdq
add ebp, eax
adc ecx, edx
sub esi, eax
mov dword [esp + 0x30], ecx
sbb ebx, edx
test ebx, ebx
jg 0x1006c403
jl 0x1006c460
test esi, esi
jne 0x1006c3f5
jmp 0x1006c460
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push edi
call fcn.1006c630
mov ecx, dword [esp + 0x38]
add esp, 8
cmp dword [edi + 0x1cfc], 0
je 0x1006c475
add dword [edi + 0x1d00], ebp
adc dword [edi + 0x1d04], ecx
push dword [esp + 0x24]
mov esi, dword [esp + 0x24]
push esi
push ecx
push ebp
call fcn.1011c9c0
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret

Function at 0x1006c490
Capabilities:
Get file size

Disassembly:
sub esp, 8
push esi
mov esi, dword [esp + 0x10]
cmp dword [esi + 0x1e2c], 0
je 0x1006c4b7
push dword [esi + 0x1e44]
mov eax, dword [esi + 0x1e30]
call eax
add esp, 4
pop esi
add esp, 8
ret
lea eax, [esp + 4]
push eax
push dword [esi + 0x900]
call dword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
jne 0x1006c4d6
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x1006c4e7
mov ecx, dword [esp + 4]
mov eax, ecx
mov edx, dword [esp + 8]
and eax, edx
cmp eax, 0xffffffff
jne 0x1006c501
call fcn.101339ec
push dword [eax]
push esi
call fcn.1006c630
add esp, 8
or eax, 0xffffffff
or edx, eax
pop esi
add esp, 8
ret
cmp ecx, 0xfffffff1
jne 0x1006c51e
cmp edx, 0xffffffff
jne 0x1006c51e
mov dword [esi + 0x1ce4], 0xf
or eax, edx
or edx, edx
pop esi
add esp, 8
ret
mov eax, dword [esi + 0x90c]
cmp eax, 0x10
je 0x1006c552
cmp eax, 0x20
je 0x1006c53f
cmp eax, 0x30
je 0x1006c580
or ecx, 0xffffffff
or edx, ecx
mov eax, ecx
pop esi
add esp, 8
ret
sub ecx, dword [esi + 0x1d58]
mov eax, ecx
sbb edx, dword [esi + 0x1d5c]
pop esi
add esp, 8
ret
cmp dword [esi + 0x1d5c], 0
jl 0x1006c580
jg 0x1006c566
cmp dword [esi + 0x1d58], 0
jbe 0x1006c580
mov eax, dword [esi + 0x1d50]
mov esi, dword [esi + 0x1d54]
test esi, esi
jl 0x1006c580
jg 0x1006c57c
test eax, eax
je 0x1006c580
mov ecx, eax
mov edx, esi
mov eax, ecx
pop esi
add esp, 8
ret
Function at 0x1006c590
Capabilities:
Get file size

Disassembly:
sub esp, 8
lea eax, [esp]
push eax
push dword [esp + 0x10]
call dword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
jne 0x1006c5b8
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x1006c5b8
or eax, 0xffffffff
or edx, eax
add esp, 8
ret
mov eax, dword [esp]
mov edx, dword [esp + 4]
add esp, 8
ret

Function at 0x1006c750
Capabilities:
Get file size

Disassembly:
sub esp, 8
push esi
mov esi, dword [esp + 0x10]
cmp dword [esi + 0x1210], 0xffffffff
je 0x1006c768
xor eax, eax
pop esi
add esp, 8
ret
push edi
push esi
push str._s_rsrc
lea edi, [esi + 0x910]
push 0x400
push edi
call fcn.10068b30
push edi
mov dword [esi + 0x1ce4], 0
call fcn.1006c690
add esp, 0x14
mov dword [esi + 0x1210], eax
cmp eax, 0xffffffff
je 0x1006c7ed
lea ecx, [esp + 8]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
jne 0x1006c7d1
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x1006c7d1
or eax, 0xffffffff
or ecx, eax
mov dword [esi + 0x1d60], eax
pop edi
mov dword [esi + 0x1d64], ecx
xor eax, eax
pop esi
add esp, 8
ret
mov eax, dword [esp + 8]
mov ecx, dword [esp + 0xc]
mov dword [esi + 0x1d60], eax
xor eax, eax
pop edi
mov dword [esi + 0x1d64], ecx
pop esi
add esp, 8
ret
push ebx
push ebp
lea ebx, [esi + 0x800]
push ebx
lea ebp, [esi + 0x400]
push ebp
push str._s.__s
push 0x400
push edi
call fcn.10068b30
push edi
mov dword [esi + 0x1ce4], 0
call fcn.1006c690
add esp, 0x18
mov dword [esi + 0x1210], eax
cmp eax, 0xffffffff
jne 0x1006c85b
push ebx
push ebp
push str._s.AppleDouble__s
push 0x400
push edi
call fcn.10068b30
push edi
mov dword [esi + 0x1ce4], 0
call fcn.1006c690
add esp, 0x18
mov dword [esi + 0x1210], eax
cmp eax, 0xffffffff
je 0x1006c87a
push eax
call fcn.1006c590
add esp, 4
mov dword [esi + 0x1d60], eax
mov dword [esi + 0x1d64], edx
xor eax, eax
pop ebp
pop ebx
pop edi
pop esi
add esp, 8
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push esi
call fcn.1006c630
mov eax, dword [esi + 0x1ce4]
add esp, 8
pop ebp
pop ebx
pop edi
pop esi
add esp, 8
ret
Function at 0x10076f30
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, dword [esp + 0xc]
mov ecx, dword [esi]
lea eax, [ecx - 8]
cmp eax, 0x14
ja 0x10077143
cmp ecx, 0xe
jge 0x10076f5b
mov dword [esi + 8], 0x3c
mov eax, 0x10076890
mov ecx, 0x10076770
jmp 0x10076f84
cmp ecx, 0x15
jge 0x10076f73
mov dword [esi + 8], 0x28
mov eax, 0x10076ae0
mov ecx, 0x100769a0
jmp 0x10076f84
mov dword [esi + 8], 0x1e
mov eax, 0x10076d40
mov ecx, 0x10076c00
push edi
mov edi, dword [esp + 0xc]
mov dword [esi + 0x10], ecx
mov dword [esi + 0x14], eax
mov eax, dword [edi + 0x90c]
cmp eax, 0x10
je 0x10076fa3
cmp eax, 0x30
jne 0x10077106
mov dword [edi + 0x1df0], 0x10077c40
mov dword [edi + 0x1df4], 0x10077c10
mov dword [edi + 0x1df8], 0x100775c0
mov dword [edi + 0x1dfc], 0x10077310
mov eax, dword [esi + 0x10]
cmp eax, 0x10076c00
jne 0x100770ff
mov ecx, dword [esi + 8]
mov eax, ecx
inc dword [esi + 0x18]
imul eax, dword [esi + 0x18]
mov dword [esi + 0x1c], 0
cmp eax, dword [esi + 4]
jle 0x1007700f
lea eax, [ecx*4]
push eax
lea eax, [esi + 0xa0]
push 0
push eax
call fcn.1011e7c0
add esp, 0xc
jmp 0x10077106
push ebx
push edi
push 0
push 0x7f
push 0
lea ebx, [esi + 0x20]
push 1
push ebx
call fcn.1006c070
add esp, 0x18
cmp eax, 0x7f
je 0x1007703b
push 0x7f
push eax
push str._Warning_:_short_read___d____d_._n
push edi
call fcn.1006ac00
add esp, 0x10
mov al, byte [ebx]
cmp al, 0xf0
je 0x10077052
movzx eax, al
push eax
push str.Error_A_:__02X_n
call fcn.10067080
add esp, 8
mov bl, byte [esi + 0x21]
cmp bl, 0x7e
je 0x1007706b
movzx eax, bl
push eax
push str.Error_1_:__02X_n
call fcn.10067080
add esp, 8
lea ecx, [esi + 0x23]
mov edx, 0x29
mov al, byte [ecx - 1]
lea ecx, [ecx + 3]
xor al, byte [ecx - 2]
xor bl, al
xor bl, byte [ecx - 3]
sub edx, 1
jne 0x10077073
mov al, byte [esi + 0x9d]
and bl, 0x7f
cmp bl, al
je 0x100770ae
movzx eax, al
push eax
movzx eax, bl
push eax
movzx eax, byte [esi + 0x24]
push eax
push str.Block__d_:_checksum_is__02X_should_be__02X_n
push edi
call fcn.1006ac00
add esp, 0x14
mov ebx, 0xffffffd9
lea edx, [esi + 0x27]
sub ebx, esi
nop dword [eax + eax]
movzx ecx, byte [edx - 2]
movzx eax, byte [edx - 1]
sub ecx, 0x40
shl ecx, 7
add ecx, eax
movzx eax, byte [edx]
shl ecx, 7
add ecx, eax
movzx eax, byte [edx + 1]
shl ecx, 7
add ecx, eax
lea eax, [edx + ebx]
shr eax, 2
lea edx, [edx + 4]
shl ecx, 4
mov dword [esi + eax*4 + 0xa0], ecx
lea eax, [edx + ebx]
cmp eax, 0x78
jl 0x100770c0
pop ebx
jmp 0x10077106
push esi
push edi
call eax
add esp, 8
mov eax, dword [edi + 0x90c]
cmp eax, 0x20
je 0x10077116
cmp eax, 0x30
jne 0x1007713e
mov dword [edi + 0x1e00], 0x100786a0
mov dword [edi + 0x1e04], 0x10078670
mov dword [edi + 0x1e08], 0x10078270
mov dword [edi + 0x1e0c], 0x10078080
pop edi
xor eax, eax
pop esi
ret
mov eax, dword [esp + 8]
pop esi
mov dword [eax + 0x1ce4], 0x93
mov eax, 0x93
ret