joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100070e0
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push edi
lea eax, [ebp - 4]
mov ebx, ecx
push eax
push 0x40
push 2
push ebx
mov edi, edx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov ax, word [edi]
mov word [ebx], ax
lea eax, [ebp - 4]
push eax
push dword [ebp - 4]
push 2
push ebx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
pop edi
pop ebx
leave
ret
Function at 0x100095d5
Capabilities:
Encode data using xor

Disassembly:
mov edx, ecx
cmp byte [edx + 0x14], 0
je 0x100095f3
push ebx
xor ebx, ebx
lea ecx, [ebx + edx]
lea eax, [ebx - 0x7f]
xor byte [ecx], al
inc ebx
cmp ebx, 0x13
jb 0x100095e0
pop ebx
mov byte [edx + 0x14], 0
mov eax, edx
ret

Function at 0x100095f6
Capabilities:
Encode data using xor

Disassembly:
mov edx, ecx
cmp byte [edx + 0x15], 0
je 0x10009614
push ebx
xor ebx, ebx
lea ecx, [ebx + edx]
lea eax, [ebx - 0x7f]
xor byte [ecx], al
inc ebx
cmp ebx, 0x14
jb 0x10009601
pop ebx
mov byte [edx + 0x15], 0
mov eax, edx
ret

Function at 0x10009617
Capabilities:
Get disk information

Disassembly:
push 0x40
mov eax, 0x10045c54
call fcn.1004504e
mov ebx, ecx
mov dword [ebp - 0x44], ebx
and dword [ebp - 4], 0
mov dword [ebp - 0x4c], ebx
and dword [ebp - 0x48], 0
push 0x100473e0
call fcn.10002669
xor ecx, ecx
lea eax, [ebp - 0x44]
push ecx
push ecx
push ecx
push ecx
push eax
push ecx
push ecx
mov dword [ebp - 4], ecx
push 0x10047a14
mov dword [ebp - 0x48], 1
mov dword [ebp - 0x44], ecx
call dword [sym.imp.KERNEL32.dll_GetVolumeInformationA]
mov eax, dword [ebp - 0x44]
lea ecx, [ebp - 0x13]
xor edx, edx
dec ecx
push 0xa
pop esi
div esi
add dl, 0x30
mov byte [ecx], dl
test eax, eax
jne 0x10009667
lea edi, [ebp - 0x40]
stosd dword es:[edi], eax
push 0xf
pop esi
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
lea eax, [ebp - 0x13]
and dword [ebp - 0x30], 0
and dword [ebp - 0x2c], 0
cmp ecx, eax
jne 0x1000969c
mov edx, esi
mov byte [ebp - 0x40], 0
mov dword [ebp - 0x2c], edx
jmp 0x100096ae
lea eax, [ebp - 0x13]
sub eax, ecx
push eax
push ecx
lea ecx, [ebp - 0x40]
call fcn.10013f22
mov edx, dword [ebp - 0x2c]
lea eax, [ebp - 0x40]
cmp ebx, eax
je 0x100096e0
mov edx, dword [ebx + 0x14]
cmp edx, esi
jbe 0x100096c4
mov ecx, dword [ebx]
inc edx
call fcn.10002c29
push 6
xor eax, eax
mov dword [ebx + 0x14], esi
pop ecx
lea esi, [ebp - 0x40]
mov dword [ebx + 0x10], eax
mov edi, ebx
mov byte [ebx], al
rep movsd dword es:[edi], dword [esi]
push 0xf
pop esi
mov edx, esi
mov byte [ebp - 0x40], al
cmp edx, esi
jbe 0x100096ed
mov ecx, dword [ebp - 0x40]
inc edx
call fcn.10002c29
mov eax, ebx
call fcn.1004500c
ret
Function at 0x1000a2ee
Capabilities:
Encode data using xor

Disassembly:
mov edx, ecx
cmp byte [edx + 0xb], 0
je 0x1000a30c
push ebx
xor ebx, ebx
lea ecx, [ebx + edx]
lea eax, [ebx - 0x7f]
xor byte [ecx], al
inc ebx
cmp ebx, 0xa
jb 0x1000a2f9
pop ebx
mov byte [edx + 0xb], 0
mov eax, edx
ret

Function at 0x1000d205
Capabilities:
Encode data using xor

Disassembly:
mov edx, ecx
cmp byte [edx + 0x10], 0
je 0x1000d223
push ebx
xor ebx, ebx
lea ecx, [ebx + edx]
lea eax, [ebx - 0x7f]
xor byte [ecx], al
inc ebx
cmp ebx, 0xf
jb 0x1000d210
pop ebx
mov byte [edx + 0x10], 0
mov eax, edx
ret

Function at 0x1000d226
Capabilities:
Encode data using xor

Disassembly:
mov edx, ecx
cmp byte [edx + 0x13], 0
je 0x1000d244
push ebx
xor ebx, ebx
lea ecx, [ebx + edx]
lea eax, [ebx - 0x7f]
xor byte [ecx], al
inc ebx
cmp ebx, 0x12
jb 0x1000d231
pop ebx
mov byte [edx + 0x13], 0
mov eax, edx
ret

Function at 0x1000d247
Capabilities:
Encode data using xor

Disassembly:
mov edx, ecx
cmp byte [edx + 0xf], 0
je 0x1000d265
push ebx
xor ebx, ebx
lea ecx, [ebx + edx]
lea eax, [ebx - 0x7f]
xor byte [ecx], al
inc ebx
cmp ebx, 0xe
jb 0x1000d252
pop ebx
mov byte [edx + 0xf], 0
mov eax, edx
ret

Function at 0x1000d268
Capabilities:
Encode data using xor

Disassembly:
mov edx, ecx
cmp byte [edx + 0x11], 0
je 0x1000d286
push ebx
xor ebx, ebx
lea ecx, [ebx + edx]
lea eax, [ebx - 0x7f]
xor byte [ecx], al
inc ebx
cmp ebx, 0x10
jb 0x1000d273
pop ebx
mov byte [edx + 0x11], 0
mov eax, edx
ret

Function at 0x1000d289
Capabilities:
Encode data using xor

Disassembly:
mov edx, ecx
cmp byte [edx + 0x1d], 0
je 0x1000d2a7
push ebx
xor ebx, ebx
lea ecx, [ebx + edx]
lea eax, [ebx - 0x7f]
xor byte [ecx], al
inc ebx
cmp ebx, 0x1c
jb 0x1000d294
pop ebx
mov byte [edx + 0x1d], 0
mov eax, edx
ret
Function at 0x10011a9f
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
mov eax, dword [0x10050040]
xor eax, ebp
mov dword [ebp - 4], eax
movaps xmm0, xmmword [0x1004d180]
lea ecx, [ebp - 0x18]
push ebx
movups xmmword [ebp - 0x18], xmm0
xor ebx, ebx
mov word [ebp - 8], 0x100
call fcn.1000d268
mov edx, 0x100c6837
mov ecx, eax
call fcn.10024ada
cmp byte [0x100c6837], bl
je 0x10011b32
call fcn.10043d30
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
push eax
call fcn.10044210
push 0x1000fe6a
push 0x100c68d4
call fcn.100437b0
call fcn.10043d90
sub esp, 0xc
mov dword [ebp - 0x10], 0xe4e41033
lea ecx, [ebp - 0x10]
mov dword [ebp - 0xc], 0xc1cda3ee
mov word [ebp - 8], 0x100
call fcn.10001405
mov edx, 0x100c6890
mov ecx, eax
call fcn.10028926
add esp, 0xc
movaps xmm0, xmmword [0x1004cdf0]
mov ecx, ebx
movups xmmword [ebp - 0x3c], xmm0
mov dword [ebp - 0xc], 0xf1e7f1f0
movaps xmm0, xmmword [0x1004d250]
movups xmmword [ebp - 0x2c], xmm0
mov word [ebp - 8], 0xe7
movaps xmm0, xmmword [0x1004d1a0]
movups xmmword [ebp - 0x1c], xmm0
mov byte [ebp - 6], 1
lea eax, [ecx - 0x7f]
xor byte [ebp + ecx - 0x3c], al
inc ecx
cmp ecx, 0x35
jb 0x10011b66
lea eax, [ebp - 0x3c]
mov byte [ebp - 6], bl
push eax
call fcn.10021f56
movaps xmm0, xmmword [0x1004d100]
pop ecx
movups xmmword [ebp - 0x24], xmm0
mov dword [ebp - 0x14], 0xddc4b2d4
mov ecx, ebx
mov dword [ebp - 0x10], 0xd1b7dec1
mov dword [ebp - 0xc], 0x100bbcd
lea eax, [ecx - 0x7f]
xor byte [ebp + ecx - 0x24], al
inc ecx
cmp ecx, 0x1a
jb 0x10011ba2
lea eax, [ebp - 0x24]
mov byte [ebp - 9], bl
push eax
call fcn.10021f56
movaps xmm0, xmmword [0x1004cfe0]
movups xmmword [ebp - 0x2c], xmm0
pop ecx
movaps xmm0, xmmword [0x1004d350]
mov ecx, ebx
movups xmmword [ebp - 0x1c], xmm0
mov dword [ebp - 0xc], 0xe3edebf5
mov word [ebp - 8], 0x84
mov byte [ebp - 6], 1
lea eax, [ecx - 0x7f]
xor byte [ebp + ecx - 0x2c], al
inc ecx
cmp ecx, 0x25
jb 0x10011be5
lea eax, [ebp - 0x2c]
mov byte [ebp - 6], bl
push eax
call fcn.10021f56
pop ecx
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop ebx
call fcn.100415f4
leave
ret
Function at 0x10011e30
Capabilities:
Execute command

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x44
mov eax, dword [0x10050040]
xor eax, esp
mov dword [esp + 0x40], eax
movaps xmm0, xmmword [0x1004c9b0]
lea ecx, [esp + 0xc]
and dword [esp + 4], 0
and dword [esp + 8], 0
push ebx
movups xmmword [esp + 0x10], xmm0
mov byte [esp + 0x20], 1
call fcn.1000d205
xor ebx, ebx
lea edx, [esp + 8]
push ebx
mov ecx, eax
call fcn.10022774
pop ecx
test al, al
je 0x10011ebd
movaps xmm0, xmmword [0x1004cde0]
lea ecx, [esp + 0x24]
movups xmmword [esp + 0x24], xmm0
mov dword [esp + 0x34], 0xf7fafdc7
mov dword [esp + 0x38], 0xf9ffd5f0
mov dword [esp + 0x3c], 0xe4feb4ed
mov word [esp + 0x40], 0xf8
mov byte [esp + 0x42], 1
call fcn.10011f63
push eax
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
pop ecx
and dword [esp + 8], ebx
lea ecx, [esp + 0x10]
and dword [esp + 0xc], ebx
mov dword [esp + 0x10], 0xe4f61e2d
mov dword [esp + 0x14], 0xe4e1c5a2
mov dword [esp + 0x18], 0xecfaf2f2
mov word [esp + 0x1c], 0xf9
mov byte [esp + 0x1e], 1
call fcn.10001360
push ebx
lea edx, [esp + 0xc]
mov ecx, eax
call fcn.10022774
pop ecx
test al, al
je 0x10011f08
call fcn.1000a30f
and dword [esp + 8], ebx
lea ecx, [esp + 0x10]
and dword [esp + 0xc], ebx
mov dword [esp + 0x10], 0xe5e11032
mov dword [esp + 0x14], 0xe4e1c5a2
mov dword [esp + 0x18], 0xecfaf2f2
mov word [esp + 0x1c], 0xf9
mov byte [esp + 0x1e], 1
call fcn.10001360
push ebx
lea edx, [esp + 0xc]
mov ecx, eax
call fcn.10022774
pop ecx
test al, al
je 0x10011f53
call fcn.1000d2aa
mov ecx, dword [esp + 0x44]
pop ebx
xor ecx, esp
call fcn.100415f4
mov esp, ebp
pop ebp
ret

Function at 0x10011f63
Capabilities:
Encode data using xor

Disassembly:
mov edx, ecx
cmp byte [edx + 0x1e], 0
je 0x10011f81
push ebx
xor ebx, ebx
lea ecx, [ebx + edx]
lea eax, [ebx - 0x7f]
xor byte [ecx], al
inc ebx
cmp ebx, 0x1d
jb 0x10011f6e
pop ebx
mov byte [edx + 0x1e], 0
mov eax, edx
ret

Function at 0x1001373d
Capabilities:
Create thread
Terminate process

Disassembly:
push 0x34
mov eax, 0x1004641b
call fcn.1004504e
cmp dword [ebp + 0xc], 1
mov esi, dword [ebp + 8]
jne 0x100137ba
lea ecx, [ebp - 0x3c]
call fcn.10009617
sub esp, 0x18
lea eax, [ebp - 0x3c]
mov ecx, esp
xor ebx, ebx
mov dword [ebp - 4], ebx
push eax
call fcn.10002dfc
call fcn.100096f5
add esp, 0x18
test al, al
je 0x100137c5
mov ecx, esi
call fcn.1000368d
mov ecx, esi
call fcn.10003631
push 0x64
push 0x232
call dword [sym.imp.KERNEL32.dll_Beep]
mov esi, dword [sym.imp.KERNEL32.dll_CreateThread]
push ebx
push ebx
push ebx
push 0x10013738
push ebx
push ebx
call esi
push ebx
push ebx
push ebx
push 0x100035df
push ebx
push ebx
call esi
lea ecx, [ebp - 0x3c]
call fcn.10002646
xor eax, eax
inc eax
call fcn.1004500c
ret 0xc
movaps xmm0, xmmword [0x1004d070]
lea ecx, [ebp - 0x24]
push 0x10
push 0x100473e0
movups xmmword [ebp - 0x24], xmm0
mov word [ebp - 0x14], 0x100
call fcn.1000d268
push eax
push ebx
call dword [sym.imp.USER32.dll_MessageBoxA]
push ebx
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
Function at 0x1001381d
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0x1e], 0
je 0x1001383a
xor edx, edx
lea ecx, [edx + esi]
lea eax, [edx - 0x7f]
xor byte [ecx], al
inc edx
cmp edx, 0x1d
jb 0x10013828
mov byte [esi + 0x1e], 0
pop esi
ret

Function at 0x10013920
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0x1d], 0
je 0x1001393d
xor edx, edx
lea ecx, [edx + esi]
lea eax, [edx - 0x7f]
xor byte [ecx], al
inc edx
cmp edx, 0x1c
jb 0x1001392b
mov byte [esi + 0x1d], 0
pop esi
ret

Function at 0x1001393f
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0x18], 0
je 0x1001395c
xor edx, edx
lea ecx, [edx + esi]
lea eax, [edx - 0x7f]
xor byte [ecx], al
inc edx
cmp edx, 0x17
jb 0x1001394a
mov byte [esi + 0x18], 0
pop esi
ret

Function at 0x1001395e
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0x17], 0
je 0x1001397b
xor edx, edx
lea ecx, [edx + esi]
lea eax, [edx - 0x7f]
xor byte [ecx], al
inc edx
cmp edx, 0x16
jb 0x10013969
mov byte [esi + 0x17], 0
pop esi
ret

Function at 0x1001397d
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0x1b], 0
je 0x1001399a
xor edx, edx
lea ecx, [edx + esi]
lea eax, [edx - 0x7f]
xor byte [ecx], al
inc edx
cmp edx, 0x1a
jb 0x10013988
mov byte [esi + 0x1b], 0
pop esi
ret

Function at 0x1001399c
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0x11], 0
je 0x100139b9
xor edx, edx
lea ecx, [edx + esi]
lea eax, [edx - 0x7f]
xor byte [ecx], al
inc edx
cmp edx, 0x10
jb 0x100139a7
mov byte [esi + 0x11], 0
pop esi
ret

Function at 0x100139bb
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0xf], 0
je 0x100139d8
xor edx, edx
lea ecx, [edx + esi]
lea eax, [edx - 0x7f]
xor byte [ecx], al
inc edx
cmp edx, 0xe
jb 0x100139c6
mov byte [esi + 0xf], 0
pop esi
ret

Function at 0x100139da
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0x13], 0
je 0x100139f7
xor edx, edx
lea ecx, [edx + esi]
lea eax, [edx - 0x7f]
xor byte [ecx], al
inc edx
cmp edx, 0x12
jb 0x100139e5
mov byte [esi + 0x13], 0
pop esi
ret

Function at 0x100139f9
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0x10], 0
je 0x10013a16
xor edx, edx
lea ecx, [edx + esi]
lea eax, [edx - 0x7f]
xor byte [ecx], al
inc edx
cmp edx, 0xf
jb 0x10013a04
mov byte [esi + 0x10], 0
pop esi
ret

Function at 0x10013a18
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0xb], 0
je 0x10013a35
xor edx, edx
lea ecx, [edx + esi]
lea eax, [edx - 0x7f]
xor byte [ecx], al
inc edx
cmp edx, 0xa
jb 0x10013a23
mov byte [esi + 0xb], 0
pop esi
ret

Function at 0x10013ad7
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0x15], 0
je 0x10013af4
xor edx, edx
lea ecx, [edx + esi]
lea eax, [edx - 0x7f]
xor byte [ecx], al
inc edx
cmp edx, 0x14
jb 0x10013ae2
mov byte [esi + 0x15], 0
pop esi
ret
Function at 0x10013af6
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0x14], 0
je 0x10013b13
xor edx, edx
lea ecx, [edx + esi]
lea eax, [edx - 0x7f]
xor byte [ecx], al
inc edx
cmp edx, 0x13
jb 0x10013b01
mov byte [esi + 0x14], 0
pop esi
ret
Function at 0x10014a5b
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [0x10050040]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [0x100c68f8]
lea eax, [ebp - 0x14]
push esi
push edi
push eax
push dword [0x100fd1fc]
call dword [sym.imp.USER32.dll_GetClientRect]
mov eax, dword [ebp - 0xc]
sub eax, dword [ebp - 0x14]
movd xmm1, eax
mov eax, dword [ebp - 8]
sub eax, dword [ebp - 0x10]
cvtdq2ps xmm1, xmm1
movd xmm0, eax
lea eax, [ebp - 0x20]
cvtdq2ps xmm0, xmm0
push eax
movss dword [ebx + 0x10], xmm1
movss dword [ebx + 0x14], xmm0
call dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov edi, dword [ebp - 0x20]
mov ecx, edi
sub ecx, dword [0x100fd200]
mov esi, dword [ebp - 0x1c]
mov edx, esi
sbb edx, dword [0x100fd204]
call fcn.100454b0
mov edx, dword [0x100fd20c]
mov ecx, dword [0x100fd208]
cvtsd2ss xmm0, xmm0
movss dword [ebp - 0x18], xmm0
call fcn.100454b0
movss xmm1, dword [ebp - 0x18]
cvtsd2ss xmm0, xmm0
push 0x11
divss xmm1, xmm0
movss dword [ebx + 0x18], xmm1
mov dword [0x100fd204], esi
mov esi, dword [sym.imp.USER32.dll_GetKeyState]
mov dword [0x100fd200], edi
call esi
shr eax, 0xf
and al, 1
push 0x10
mov byte [ebx + 0xf1], al
call esi
shr eax, 0xf
and al, 1
push 0x12
mov byte [ebx + 0xf2], al
call esi
shr eax, 0xf
and al, 1
mov byte [ebx + 0xf4], 0
mov byte [ebx + 0xf3], al
call fcn.100149b4
cmp byte [ebx + 0xf0], 0
pop edi
pop esi
pop ebx
je 0x10014b55
or eax, 0xffffffff
jmp 0x10014b60
mov eax, dword [0x100c68f8]
mov eax, dword [eax + 0x1cfc]
cmp dword [0x10050c58], eax
je 0x10014b72
mov dword [0x10050c58], eax
call fcn.10014918
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100415f4
leave
ret

Function at 0x10016081
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
cmp dword [0x100fd254], 0
push ebx
push esi
push edi
mov ebx, edx
mov edi, ecx
jne 0x100160c0
xor esi, esi
push 8
mov edx, esi
pop ecx
mov eax, edx
shr edx, 1
and eax, 1
neg eax
and eax, 0xedb88320
xor edx, eax
sub ecx, 1
jne 0x1001609b
mov dword [esi*4 + 0x100fd250], edx
inc esi
cmp esi, 0x100
jb 0x10016096
mov esi, dword [ebp + 8]
not esi
mov edx, esi
test ebx, ebx
jle 0x10016105
movzx eax, byte [edi]
movzx ecx, dl
xor ecx, eax
shr edx, 8
xor edx, dword [ecx*4 + 0x100fd250]
inc edi
sub ebx, 1
jne 0x100160cb
jmp 0x1001610c
cmp al, 0x23
jne 0x100160f3
cmp byte [edi], al
jne 0x100160f3
cmp byte [edi + 1], al
cmove edx, esi
movzx ecx, dl
movzx eax, al
xor ecx, eax
shr edx, 8
xor edx, dword [ecx*4 + 0x100fd250]
mov al, byte [edi]
inc edi
test al, al
jne 0x100160e5
pop edi
not edx
pop esi
mov eax, edx
pop ebx
pop ebp
ret
Function at 0x10016906
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
mov edi, dword [ebp + 8]
test edi, edi
je 0x10016915
and dword [edi], 0
mov edx, 0x1004be58
call fcn.10016874
mov esi, eax
test esi, esi
je 0x100169b3
push ebx
push 2
push 0
push esi
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fseek]
add esp, 0xc
test eax, eax
jne 0x100169a8
push esi
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_ftell]
mov ebx, eax
pop ecx
cmp ebx, 0xffffffff
je 0x100169a8
push 0
push 0
push esi
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fseek]
add esp, 0xc
test eax, eax
jne 0x100169a8
mov ecx, ebx
call fcn.10018031
mov dword [ebp + 8], eax
test eax, eax
je 0x100169a8
push esi
push ebx
push 1
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
add esp, 0x10
push esi
cmp eax, ebx
je 0x10016996
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
push dword [ebp + 8]
dec dword [0x100fd210]
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
pop ecx
jmp 0x100169af
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
pop ecx
test edi, edi
je 0x100169a3
mov dword [edi], ebx
mov eax, dword [ebp + 8]
jmp 0x100169b2
push esi
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
xor eax, eax
pop ecx
pop ebx
pop edi
pop esi
pop ebp
ret

Function at 0x1001b095
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [0x100c68f8]
push esi
mov esi, ecx
and dword [eax + 0x2c8c], 0
test esi, esi
je 0x1001b0e5
and dword [ebp - 4], 0
lea ecx, [ebp - 4]
push edi
call fcn.1001b0e8
mov edx, 0x1004be5c
mov ecx, esi
mov edi, eax
call fcn.10016874
mov esi, eax
test esi, esi
je 0x1001b0e4
push esi
push dword [ebp - 4]
push 1
push edi
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
push esi
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
add esp, 0x14
pop edi
pop esi
leave
ret
Function at 0x10021f0d
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push esi
push edi
mov edi, dword [0x100c68f8]
mov eax, dword [edi + 0x1a20]
mov byte [eax + 0x78], 1
mov eax, dword [edi + 0x1a20]
cmp byte [eax + 0x7b], 0
jne 0x10021f53
push edx
lea esi, [edi + 0x2ec4]
mov edx, 0xc01
push ecx
mov ecx, esi
call fcn.10016053
pop ecx
pop ecx
lea edx, [edi + 0x2ec4]
mov ecx, esi
lea edx, [edx + eax]
pop edi
pop esi
jmp fcn.10021f93
pop edi
pop esi
ret
Function at 0x10032e05
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x30
mov eax, dword [0x10050040]
xor eax, esp
mov dword [esp + 0x2c], eax
movaps xmm0, xmmword [0x1004d470]
xor edx, edx
movups xmmword [esp], xmm0
mov dword [esp + 0x20], 0xc2cad5d6
movaps xmm0, xmmword [0x1004d0b0]
movups xmmword [esp + 0x10], xmm0
mov dword [esp + 0x24], 0xd9cbed88
mov dword [esp + 0x28], 0x100adc7
mov al, dl
sub al, 0x7c
xor byte [esp + edx], al
inc edx
cmp edx, 0x2a
jb 0x10032e4a
push ecx
lea eax, [esp + 4]
mov byte [esp + 0x2f], 0
push eax
mov edx, 0x100fd65c
call fcn.10028fe9
pop ecx
pop ecx
test al, al
je 0x10032eb7
mov eax, dword [0x100fd65c]
sub eax, 0
je 0x10032eac
sub eax, 1
je 0x10032ea5
sub eax, 1
je 0x10032e9e
sub eax, 1
je 0x10032e97
sub eax, 1
jne 0x10032eb3
call fcn.1003be49
jmp 0x10032eb3
call fcn.1003c4b3
jmp 0x10032eb3
call fcn.1003b2c1
jmp 0x10032eb3
call fcn.1003b93d
jmp 0x10032eb3
xor ecx, ecx
call fcn.1003a94b
mov al, 1
jmp 0x10032eb9
xor al, al
mov ecx, dword [esp + 0x2c]
xor ecx, esp
call fcn.100415f4
mov esp, ebp
pop ebp
ret
Function at 0x10035876
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0x34], 0
je 0x10035893
xor edx, edx
lea ecx, [edx + esi]
lea eax, [edx - 0x7c]
xor byte [ecx], al
inc edx
cmp edx, 0x33
jb 0x10035881
mov byte [esi + 0x34], 0
pop esi
ret

Function at 0x10035895
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0x24], 0
je 0x100358b2
xor edx, edx
lea ecx, [edx + esi]
lea eax, [edx - 0x7c]
xor byte [ecx], al
inc edx
cmp edx, 0x23
jb 0x100358a0
mov byte [esi + 0x24], 0
pop esi
ret

Function at 0x100358b4
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0x1a5], 0
je 0x100358da
xor edx, edx
lea ecx, [edx + esi]
lea eax, [edx - 0x7c]
xor byte [ecx], al
inc edx
cmp edx, 0x1a4
jb 0x100358c2
mov byte [esi + 0x1a5], 0
pop esi
ret

Function at 0x100358dc
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0x2c], 0
je 0x100358f9
xor edx, edx
lea ecx, [edx + esi]
lea eax, [edx - 0x7c]
xor byte [ecx], al
inc edx
cmp edx, 0x2b
jb 0x100358e7
mov byte [esi + 0x2c], 0
pop esi
ret

Function at 0x100358fb
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0x22], 0
je 0x10035918
xor edx, edx
lea ecx, [edx + esi]
lea eax, [edx - 0x7c]
xor byte [ecx], al
inc edx
cmp edx, 0x21
jb 0x10035906
mov byte [esi + 0x22], 0
pop esi
ret

Function at 0x1003591a
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0x5f], 0
je 0x10035937
xor edx, edx
lea ecx, [edx + esi]
lea eax, [edx - 0x7c]
xor byte [ecx], al
inc edx
cmp edx, 0x5e
jb 0x10035925
mov byte [esi + 0x5f], 0
pop esi
ret

Function at 0x10035939
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0x3c], 0
je 0x10035956
xor edx, edx
lea ecx, [edx + esi]
lea eax, [edx - 0x7c]
xor byte [ecx], al
inc edx
cmp edx, 0x3b
jb 0x10035944
mov byte [esi + 0x3c], 0
pop esi
ret

Function at 0x10035958
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0x68], 0
je 0x10035975
xor edx, edx
lea ecx, [edx + esi]
lea eax, [edx - 0x7c]
xor byte [ecx], al
inc edx
cmp edx, 0x67
jb 0x10035963
mov byte [esi + 0x68], 0
pop esi
ret

Function at 0x10035977
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0x41], 0
je 0x10035994
xor edx, edx
lea ecx, [edx + esi]
lea eax, [edx - 0x7c]
xor byte [ecx], al
inc edx
cmp edx, 0x40
jb 0x10035982
mov byte [esi + 0x41], 0
pop esi
ret

Function at 0x10035996
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0x8b], 0
je 0x100359bc
xor edx, edx
lea ecx, [edx + esi]
lea eax, [edx - 0x7c]
xor byte [ecx], al
inc edx
cmp edx, 0x8a
jb 0x100359a4
mov byte [esi + 0x8b], 0
pop esi
ret

Function at 0x100359be
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0x2b], 0
je 0x100359db
xor edx, edx
lea ecx, [edx + esi]
lea eax, [edx - 0x7c]
xor byte [ecx], al
inc edx
cmp edx, 0x2a
jb 0x100359c9
mov byte [esi + 0x2b], 0
pop esi
ret