joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1002e9e0
Capabilities:
Read .ini file

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff0
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
sub esp, 0x20
cmp dword [ecx + 0x10], 0
jne 0x1002ea0a
xor eax, eax
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret 8
cmp dword [ecx + 0x14], 0x10
jb 0x1002ea12
mov ecx, dword [ecx]
push ecx
push dword [ebx + 0xc]
mov dword [ebp - 0x10], 0x234bcc0a
lea eax, [ebp - 0x10]
push dword [ebx + 8]
mov dword [ebp - 0xc], 0x94077666
mov dword [ebp - 8], 0x7aad87b6
mov dword [ebp - 4], 0xc1e1376e
mov dword [ebp - 0x20], 0x4525a349
mov dword [ebp - 0x1c], 0x9407110f
mov dword [ebp - 0x18], 0x7aad87b6
mov dword [ebp - 0x14], 0xc1e1376e
movaps xmm1, xmmword [ebp - 0x20]
pxor xmm1, xmmword [ebp - 0x10]
push eax
movaps xmmword [ebp - 0x10], xmm1
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret 8

Function at 0x10039990
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100e4e90
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x103dda04]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, ecx
mov dword [ebp - 0x10], eax
push 8
mov dword [eax], vtable.std::basic_streambuf_char__struct_std::char_traits_char__.0
call fcn.100aaf30
mov esi, eax
add esp, 4
test esi, esi
je 0x100399f0
xorps xmm0, xmm0
movq qword [esi], xmm0
push 1
mov dword [ebp - 4], 0
call fcn.100b48ae
add esp, 4
mov dword [esi + 4], eax
jmp 0x100399f2
xor esi, esi
mov eax, dword [ebp - 0x10]
lea edi, [eax + 0x14]
lea ecx, [eax + 0x18]
lea edx, [eax + 0x24]
mov dword [eax + 0x34], esi
lea ebx, [eax + 4]
mov dword [eax + 0xc], ebx
lea esi, [eax + 8]
mov dword [eax + 0x10], esi
mov dword [eax + 0x1c], edi
mov dword [eax + 0x20], ecx
mov dword [eax + 0x2c], edx
add eax, 0x28
mov dword [ebp - 0x14], ebx
mov ebx, dword [ebp - 0x10]
mov dword [ebx + 0x30], eax
mov ebx, dword [ebp - 0x14]
mov dword [esi], 0
mov dword [ecx], 0
mov dword [eax], 0
mov eax, dword [ebp - 0x10]
mov dword [ebx], 0
mov dword [edi], 0
mov dword [edx], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1003c880
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100e5230
mov eax, dword fs:[0]
push eax
push esi
push edi
mov eax, dword [0x103dda04]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
push 8
mov dword [esi + 0x30], 0
mov dword [esi + 8], 0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0x201
mov dword [esi + 0x18], 6
mov dword [esi + 0x1c], 0
mov dword [esi + 0x20], 0
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x2c], 0
mov dword [esi + 0xc], 0
call fcn.100aaf30
mov edi, eax
add esp, 4
test edi, edi
je 0x1003c932
xorps xmm0, xmm0
movq qword [edi], xmm0
push 1
mov dword [ebp - 4], 0
call fcn.100b48ae
mov dword [edi + 4], eax
add esp, 4
mov dword [esi + 0x30], edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
mov dword [esi + 0x30], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x10040790
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [ebp + 0x10]
push ebx
mov ebx, ecx
mov ecx, dword [ebp + 0xc]
push edi
mov edi, dword [ebp + 8]
mov dword [ebp - 4], edi
test eax, eax
jg 0x100407bc
jl 0x100407b0
test ecx, ecx
jne 0x100407bc
pop edi
xor eax, eax
xor edx, edx
pop ebx
mov esp, ebp
pop ebp
ret 0xc
cmp dword [ebx + 0x38], 0
push esi
je 0x1004086e
mov dword [ebp - 8], ecx
mov dword [ebp - 4], eax
nop dword [eax]
mov ecx, ebx
call fcn.1003c750
mov esi, eax
mov eax, edx
mov dword [ebp - 0xc], eax
test eax, eax
jl 0x10040823
jg 0x100407e8
test esi, esi
je 0x10040823
mov ecx, dword [ebp - 4]
cmp ecx, eax
jg 0x100407fd
mov eax, dword [ebp - 8]
jl 0x100407f8
cmp eax, esi
jae 0x100407fd
mov esi, eax
mov dword [ebp - 0xc], ecx
mov eax, dword [ebx + 0x1c]
push esi
push dword [eax]
push edi
call fcn.100b8180
mov eax, dword [ebx + 0x2c]
add esp, 0xc
mov ecx, dword [ebp - 8]
mov edx, dword [ebp - 4]
sub ecx, esi
sbb edx, dword [ebp - 0xc]
sub dword [eax], esi
mov eax, dword [ebx + 0x1c]
add dword [eax], esi
jmp 0x10040842
mov eax, dword [ebx]
mov ecx, ebx
call dword [eax + 0x1c]
mov edx, dword [ebp - 4]
cmp eax, 0xffffffff
je 0x10040858
mov ecx, dword [ebp - 8]
mov esi, 1
add ecx, 0xffffffff
mov byte [edi], al
adc edx, 0xffffffff
add edi, esi
mov dword [ebp - 4], edx
mov dword [ebp - 8], ecx
test edx, edx
jg 0x100407d0
jl 0x10040858
test ecx, ecx
jne 0x100407d0
mov eax, dword [ebp + 0xc]
sub eax, dword [ebp - 8]
mov ecx, dword [ebp + 0x10]
pop esi
sbb ecx, edx
pop edi
mov edx, ecx
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov eax, dword [ebx + 0x1c]
lea esi, [ebx + 0x2c]
mov edi, ecx
mov edx, dword [eax]
test edx, edx
je 0x100408b0
mov eax, dword [esi]
mov eax, dword [eax]
test eax, eax
je 0x100408b0
mov edi, dword [ebp - 4]
cmp eax, ecx
mov esi, ecx
cmovb esi, eax
push esi
push edx
push edi
call fcn.100b8180
mov eax, dword [ebx + 0x2c]
add edi, esi
mov dword [ebp - 4], edi
add esp, 0xc
mov edi, dword [ebp + 0xc]
sub edi, esi
sub dword [eax], esi
mov eax, dword [ebx + 0x1c]
add dword [eax], esi
lea esi, [ebx + 0x2c]
cmp dword [ebx + 0x4c], 0
je 0x10040918
mov ecx, dword [ebx + 0xc]
lea eax, [ebx + 0x3c]
cmp dword [ecx], eax
jne 0x100408d6
mov eax, dword [ebx + 0xc]
mov edx, dword [ebx + 0x54]
mov ecx, dword [ebx + 0x50]
sub edx, ecx
mov dword [eax], ecx
mov eax, dword [ebx + 0x1c]
mov dword [eax], ecx
mov eax, dword [esi]
mov dword [eax], edx
mov esi, dword [ebp - 4]
cmp edi, 0xfff
jbe 0x10040903
push dword [ebx + 0x4c]
push 0xfff
push 1
push esi
call fcn.100c2822
add esp, 0x10
add esi, eax
sub edi, eax
cmp eax, 0xfff
jne 0x10040918
cmp edi, eax
ja 0x100408e1
test edi, edi
je 0x10040918
push dword [ebx + 0x4c]
push edi
push 1
push esi
call fcn.100c2822
add esp, 0x10
sub edi, eax
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 0x10]
sub eax, edi
pop esi
pop edi
sbb edx, 0
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x1004c270
Capabilities:
Create process on windows

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff0
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
sub esp, 0x50
mov dword [ebp - 0x50], 0x3551d721
mov eax, 0x5efa45
mov dword [ebp - 0x4c], 0xbb282b7c
mov dword [ebp - 0x48], 0x19deeed2
mov dword [ebp - 0x44], 0xef854501
mov dword [ebp - 0x40], 0xc72b067c
mov dword [ebp - 0x3c], 0xbf8ec9ca
mov dword [ebp - 0x38], 0x2d45a280
mov dword [ebp - 0x34], 0xb76a58c3
movaps xmm1, xmmword [ebp - 0x50]
mov dword [ebp - 0x30], 0x4525a349
mov dword [ebp - 0x2c], 0x9407110f
mov dword [ebp - 0x28], 0x7aad87b6
mov dword [ebp - 0x24], 0xc1e1376e
pxor xmm1, xmmword [ebp - 0x30]
movaps xmmword [ebp - 0x50], xmm1
movaps xmm1, xmmword [ebp - 0x40]
mov dword [ebp - 0x20], 0xbf04611b
mov dword [ebp - 0x1c], 0xc8f7aaa1
mov dword [ebp - 0x18], 0x691fc5c8
mov dword [ebp - 0x14], 0xb76a58a8
pxor xmm1, xmmword [ebp - 0x20]
movaps xmmword [ebp - 0x40], xmm1
mov dword [ebp - 0x10], 0x2b40d326
mov dword [ebp - 0xc], 0x9407110f
mov dword [ebp - 8], 0x7aad87b6
mov dword [ebp - 4], 0xc1e1376e
mov dword [ebp - 0x20], 0x4525a349
mov dword [ebp - 0x1c], 0x9407110f
mov dword [ebp - 0x18], 0x7aad87b6
mov dword [ebp - 0x14], 0xc1e1376e
movaps xmm1, xmmword [ebp - 0x20]
pxor xmm1, xmmword [ebp - 0x10]
movaps xmmword [ebp - 0x10], xmm1
movd xmm1, eax
mov eax, 0x5efa44
movd xmm0, eax
pxor xmm1, xmm0
movd eax, xmm1
push eax
push 0
push 0
lea eax, [ebp - 0x50]
push eax
lea eax, [ebp - 0x10]
push eax
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret
Function at 0x1004c390
Capabilities:
Create process on windows

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff0
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
sub esp, 0x80
mov dword [ebp - 0x50], 0x3551d721
mov eax, 0x5efa45
mov dword [ebp - 0x4c], 0xbb282b7c
mov dword [ebp - 0x48], 0x11cee6de
mov dword [ebp - 0x44], 0xa8cf5303
mov dword [ebp - 0x40], 0xec444e74
mov dword [ebp - 0x3c], 0xa087dac0
mov dword [ebp - 0x38], 0x1a6ab7b1
mov dword [ebp - 0x34], 0xf2130b87
mov dword [ebp - 0x30], 0x67ffae4a
mov dword [ebp - 0x2c], 0xfdc2633a
mov dword [ebp - 0x28], 0xa1822c3a
mov dword [ebp - 0x24], 0x78ab1b82
movaps xmm1, xmmword [ebp - 0x50]
mov dword [ebp - 0x80], 0x4525a349
mov dword [ebp - 0x7c], 0x9407110f
mov dword [ebp - 0x78], 0x7aad87b6
mov dword [ebp - 0x74], 0xc1e1376e
pxor xmm1, xmmword [ebp - 0x80]
movaps xmmword [ebp - 0x50], xmm1
movaps xmm1, xmmword [ebp - 0x40]
mov dword [ebp - 0x70], 0xbf04611b
mov dword [ebp - 0x6c], 0xc8f7aaa1
mov dword [ebp - 0x68], 0x691fc5c8
mov dword [ebp - 0x64], 0xb76a58a8
pxor xmm1, xmmword [ebp - 0x70]
movaps xmmword [ebp - 0x40], xmm1
movaps xmm1, xmmword [ebp - 0x30]
mov dword [ebp - 0x60], 0x31a7993d
mov dword [ebp - 0x5c], 0xfdc20003
mov dword [ebp - 0x58], 0xa1822c3a
mov dword [ebp - 0x54], 0x78ab1b82
pxor xmm1, xmmword [ebp - 0x60]
movaps xmmword [ebp - 0x30], xmm1
mov dword [ebp - 0x10], 0x2b40d326
mov dword [ebp - 0xc], 0x9407110f
mov dword [ebp - 8], 0x7aad87b6
mov dword [ebp - 4], 0xc1e1376e
mov dword [ebp - 0x20], 0x4525a349
mov dword [ebp - 0x1c], 0x9407110f
mov dword [ebp - 0x18], 0x7aad87b6
mov dword [ebp - 0x14], 0xc1e1376e
movaps xmm1, xmmword [ebp - 0x20]
pxor xmm1, xmmword [ebp - 0x10]
movaps xmmword [ebp - 0x10], xmm1
movd xmm1, eax
mov eax, 0x5efa44
movd xmm0, eax
pxor xmm1, xmm0
movd eax, xmm1
push eax
push 0
push 0
lea eax, [ebp - 0x50]
push eax
lea eax, [ebp - 0x10]
push eax
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret
add ecx, 4
jmp 0x10048880
Function at 0x1004c3a0
Capabilities:
Create process on windows

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff0
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
sub esp, 0xa0
mov dword [ebp - 0x50], 0x3551d721
mov eax, 0x5efa45
mov dword [ebp - 0x4c], 0xbb282b7c
mov dword [ebp - 0x48], 0x54daf0c1
mov dword [ebp - 0x44], 0xa4825608
mov dword [ebp - 0x40], 0xd46b0e79
mov dword [ebp - 0x3c], 0xa598c98f
mov dword [ebp - 0x38], 0x66db5e7
mov dword [ebp - 0x34], 0xd20631ce
mov dword [ebp - 0x30], 0x41cfe913
mov dword [ebp - 0x2c], 0xc0a6693c
mov dword [ebp - 0x28], 0x91b21c0b
mov dword [ebp - 0x24], 0x4d9f2eba
mov dword [ebp - 0x20], 0xde51df7e
mov dword [ebp - 0x1c], 0xc7cfdfb5
mov dword [ebp - 0x18], 0xde4c8e4c
mov dword [ebp - 0x14], 0x25ca85ec
movaps xmm1, xmmword [ebp - 0x50]
mov dword [ebp - 0xa0], 0x4525a349
mov dword [ebp - 0x9c], 0x9407110f
mov dword [ebp - 0x98], 0x7aad87b6
mov dword [ebp - 0x94], 0xc1e1376e
pxor xmm1, xmmword [ebp - 0xa0]
movaps xmmword [ebp - 0x50], xmm1
movaps xmm1, xmmword [ebp - 0x40]
mov dword [ebp - 0x90], 0xbf04611b
mov dword [ebp - 0x8c], 0xc8f7aaa1
mov dword [ebp - 0x88], 0x691fc5c8
mov dword [ebp - 0x84], 0xb76a58a8
pxor xmm1, xmmword [ebp - 0x90]
movaps xmmword [ebp - 0x40], xmm1
movaps xmm1, xmmword [ebp - 0x30]
mov dword [ebp - 0x80], 0x31a7993d
mov dword [ebp - 0x7c], 0xfdc20003
mov dword [ebp - 0x78], 0xa1822c3a
mov dword [ebp - 0x74], 0x78ab1b82
pxor xmm1, xmmword [ebp - 0x80]
movaps xmmword [ebp - 0x30], xmm1
movaps xmm1, xmmword [ebp - 0x20]
mov dword [ebp - 0x70], 0xec65eb4f
mov dword [ebp - 0x6c], 0xc7feea85
mov dword [ebp - 0x68], 0xde4c8e4c
mov dword [ebp - 0x64], 0x25ca85ec
pxor xmm1, xmmword [ebp - 0x70]
movaps xmmword [ebp - 0x20], xmm1
mov dword [ebp - 0x10], 0x2b40d326
mov dword [ebp - 0xc], 0x9407110f
mov dword [ebp - 8], 0x7aad87b6
mov dword [ebp - 4], 0xc1e1376e
mov dword [ebp - 0x60], 0x4525a349
mov dword [ebp - 0x5c], 0x9407110f
mov dword [ebp - 0x58], 0x7aad87b6
mov dword [ebp - 0x54], 0xc1e1376e
movaps xmm1, xmmword [ebp - 0x60]
pxor xmm1, xmmword [ebp - 0x10]
movaps xmmword [ebp - 0x10], xmm1
movd xmm1, eax
mov eax, 0x5efa44
movd xmm0, eax
pxor xmm1, xmm0
movd eax, xmm1
push eax
push 0
push 0
lea eax, [ebp - 0x50]
push eax
lea eax, [ebp - 0x10]
push eax
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret
add ecx, 4
jmp 0x100489f0
Function at 0x1004c3d0
Capabilities:
Create process on windows

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff0
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
sub esp, 0x80
mov dword [ebp - 0x50], 0x3551d721
mov eax, 0x5efa45
mov dword [ebp - 0x4c], 0xbb282b7c
mov dword [ebp - 0x48], 0x54daf0c1
mov dword [ebp - 0x44], 0xa38f5e16
mov dword [ebp - 0x40], 0x926b0072
mov dword [ebp - 0x3c], 0xa494c3c0
mov dword [ebp - 0x38], 0x470a6e6
mov dword [ebp - 0x34], 0xc5053e87
mov dword [ebp - 0x30], 0x78af448
mov dword [ebp - 0x2c], 0xd3f32d32
mov dword [ebp - 0x28], 0xcdef5852
mov dword [ebp - 0x24], 0x78ab1b82
movaps xmm1, xmmword [ebp - 0x50]
mov dword [ebp - 0x80], 0x4525a349
mov dword [ebp - 0x7c], 0x9407110f
mov dword [ebp - 0x78], 0x7aad87b6
mov dword [ebp - 0x74], 0xc1e1376e
pxor xmm1, xmmword [ebp - 0x80]
movaps xmmword [ebp - 0x50], xmm1
movaps xmm1, xmmword [ebp - 0x40]
mov dword [ebp - 0x70], 0xbf04611b
mov dword [ebp - 0x6c], 0xc8f7aaa1
mov dword [ebp - 0x68], 0x691fc5c8
mov dword [ebp - 0x64], 0xb76a58a8
pxor xmm1, xmmword [ebp - 0x70]
movaps xmmword [ebp - 0x40], xmm1
movaps xmm1, xmmword [ebp - 0x30]
mov dword [ebp - 0x60], 0x31a7993d
mov dword [ebp - 0x5c], 0xfdc20003
mov dword [ebp - 0x58], 0xa1822c3a
mov dword [ebp - 0x54], 0x78ab1b82
pxor xmm1, xmmword [ebp - 0x60]
movaps xmmword [ebp - 0x30], xmm1
mov dword [ebp - 0x10], 0x2b40d326
mov dword [ebp - 0xc], 0x9407110f
mov dword [ebp - 8], 0x7aad87b6
mov dword [ebp - 4], 0xc1e1376e
mov dword [ebp - 0x20], 0x4525a349
mov dword [ebp - 0x1c], 0x9407110f
mov dword [ebp - 0x18], 0x7aad87b6
mov dword [ebp - 0x14], 0xc1e1376e
movaps xmm1, xmmword [ebp - 0x20]
pxor xmm1, xmmword [ebp - 0x10]
movaps xmmword [ebp - 0x10], xmm1
movd xmm1, eax
mov eax, 0x5efa44
movd xmm0, eax
pxor xmm1, xmm0
movd eax, xmm1
push eax
push 0
push 0
lea eax, [ebp - 0x50]
push eax
lea eax, [ebp - 0x10]
push eax
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret
add ecx, 4
jmp 0x10048bc0
Function at 0x1004db20
Capabilities:
Access peb ldr_data
Encode data using xor
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, 0x5efa45
mov dword [ebp - 0x10], ecx
mov ecx, dword [ebp + 8]
movd xmm1, eax
mov eax, 0x5ef9ab
movd xmm0, eax
pxor xmm1, xmm0
movd eax, xmm1
cmp ecx, eax
jne 0x1004dc07
mov eax, dword fs:[0x30]
push esi
push edi
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0xc]
nop dword [eax]
mov edx, dword [eax + 0x18]
mov dword [ebp - 0xc], edx
mov ecx, dword [edx + 0x3c]
mov ecx, dword [ecx + edx + 0x78]
add ecx, edx
mov dword [ebp - 8], ecx
cmp ecx, edx
je 0x1004dbc7
mov edi, dword [ecx + 0x18]
test edi, edi
je 0x1004dbc7
mov ecx, dword [ecx + 0x20]
lea ecx, [ecx + edi*4]
add ecx, edx
sub ecx, 4
dec edi
mov dword [ebp - 4], ecx
mov esi, 0x811c9dc5
mov ecx, dword [ecx]
add ecx, edx
mov dl, byte [ecx]
inc ecx
test dl, dl
je 0x1004dbbd
nop dword [eax]
movsx edx, dl
lea ecx, [ecx + 1]
xor edx, esi
imul esi, edx, 0x1000193
mov dl, byte [ecx - 1]
test dl, dl
jne 0x1004dba0
cmp esi, 0x60ac7e39
je 0x1004dbcb
mov ecx, dword [ebp - 4]
mov edx, dword [eax + 0x18]
test edi, edi
jne 0x1004db85
mov eax, dword [eax]
jmp 0x1004db60
mov esi, dword [ebp - 8]
mov edx, dword [ebp - 0xc]
push 0
push 0
mov eax, dword [esi + 0x24]
push 0
push 0x1004e430
push 0
lea eax, [eax + edi*2]
movzx ecx, word [eax + edx]
mov eax, dword [esi + 0x1c]
push 0
lea eax, [eax + ecx*4]
mov eax, dword [eax + edx]
add eax, edx
call eax
push eax
mov ecx, 0x103e8c58
call fcn.100ab3e0
mov ecx, dword [ebp + 8]
pop edi
pop esi
push ecx
mov ecx, dword [ebp - 0x10]
call dword [0x103dd56c]
mov esp, ebp
pop ebp
ret 4
Function at 0x1005ac90
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ecx + 0xc4]
mov eax, dword [ecx + 0xcc]
push esi
push edi
lea esi, [ebp + 8]
mov edi, 4
mov eax, dword [eax + edx*4 - 4]
not eax
nop
movzx ecx, byte [esi]
lea esi, [esi + 1]
movzx edx, al
xor edx, ecx
shr eax, 8
xor eax, dword [edx*4 + 0x10296268]
sub edi, 1
jne 0x1005acb0
mov ecx, dword [0x103e890c]
not eax
pop edi
pop esi
cmp dword [ecx + 0x1bd0], eax
jne 0x1005ace2
mov dword [ecx + 0x1bd4], eax
cmp dword [ecx + 0x1c0c], eax
jne 0x1005acf1
mov byte [ecx + 0x1c10], 1
pop ebp
ret 4

Function at 0x1005b680
Capabilities:
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 0x10]
push esi
mov esi, dword [ebp + 8]
not ebx
push edi
mov edi, dword [ebp + 0xc]
mov eax, ebx
test edi, edi
je 0x1005b6e3
mov cl, byte [esi]
lea esi, [esi + 1]
dec edi
cmp cl, 0x23
jne 0x1005b6c6
cmp edi, 2
jb 0x1005b6c6
cmp byte [esi], cl
jne 0x1005b6c6
cmp byte [esi + 1], cl
jne 0x1005b6c6
mov eax, ebx
movzx ecx, cl
movzx edx, al
xor edx, ecx
shr eax, 8
xor eax, dword [edx*4 + 0x10296268]
jmp 0x1005b697
movzx edx, al
movzx ecx, cl
xor edx, ecx
shr eax, 8
xor eax, dword [edx*4 + 0x10296268]
test edi, edi
jne 0x1005b697
pop edi
pop esi
not eax
pop ebx
pop ebp
ret
mov cl, byte [esi]
inc esi
test cl, cl
je 0x1005b718
nop word [eax + eax]
cmp cl, 0x23
jne 0x1005b6ff
cmp byte [esi], cl
jne 0x1005b6ff
cmp byte [esi + 1], cl
cmove eax, ebx
movzx edx, al
movzx ecx, cl
xor edx, ecx
shr eax, 8
mov cl, byte [esi]
inc esi
xor eax, dword [edx*4 + 0x10296268]
test cl, cl
jne 0x1005b6f0
pop edi
pop esi
not eax
pop ebx
pop ebp
ret
Function at 0x10061870
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [0x103dda04]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [0x103e890c]
lea edx, [ebp - 8]
push ebx
push esi
push edi
mov edi, dword [eax + 0x1b98]
mov esi, 4
mov eax, dword [ebp + 8]
add edi, 0xc4
mov dword [ebp - 8], eax
mov eax, dword [edi]
mov ebx, dword [edi + 8]
mov ebx, dword [ebx + eax*4 - 4]
not ebx
nop dword [eax]
movzx eax, byte [edx]
lea edx, [edx + 1]
movzx ecx, bl
xor ecx, eax
shr ebx, 8
xor ebx, dword [ecx*4 + 0x10296268]
sub esi, 1
jne 0x100618b0
mov esi, dword [edi + 4]
not ebx
mov ecx, dword [edi]
cmp ecx, esi
jne 0x100618f7
inc ecx
test esi, esi
je 0x100618e5
mov eax, esi
cdq
sub eax, edx
sar eax, 1
add eax, esi
jmp 0x100618ea
mov eax, 8
cmp eax, ecx
cmovg ecx, eax
push ecx
mov ecx, edi
call fcn.10067480
mov ecx, dword [edi]
mov eax, dword [edi + 8]
mov dword [eax + ecx*4], ebx
inc dword [edi]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.100b684e
mov esp, ebp
pop ebp
ret

Function at 0x10065e70
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push edi
mov edi, dword [0x103e890c]
cmp byte [edi + 0x2f1d], 0
lea eax, [edi + 0x20]
jne 0x10065f8f
mov ecx, dword [eax]
push ebx
test ecx, ecx
je 0x10065f87
push esi
push 0x102967e0
push ecx
call fcn.1005b470
mov esi, eax
add esp, 8
test esi, esi
je 0x10065f83
push esi
call fcn.100c7c3e
add esp, 4
mov dword [ebp - 8], eax
cmp eax, 0xffffffff
je 0x10065f7a
push 2
push 0
push esi
call fcn.100c2cbb
add esp, 0xc
test eax, eax
jne 0x10065f7a
push esi
call fcn.100c7c3e
mov ebx, eax
add esp, 4
mov dword [ebp - 4], ebx
cmp ebx, 0xffffffff
je 0x10065f7a
push 0
push dword [ebp - 8]
push esi
call fcn.100c2cbb
add esp, 0xc
test eax, eax
jne 0x10065f7a
mov eax, dword [0x103e890c]
test eax, eax
je 0x10065f13
inc dword [eax + 0x36c]
push dword [0x103e8914]
push ebx
call dword [0x103dd6b8]
mov ebx, eax
add esp, 8
test ebx, ebx
je 0x10065f7a
push esi
push dword [ebp - 4]
push 1
push ebx
call fcn.100c2822
add esp, 0x10
push esi
cmp eax, dword [ebp - 4]
je 0x10065f67
call fcn.100bcc31
add esp, 4
mov eax, dword [0x103e890c]
test eax, eax
je 0x10065f55
dec dword [eax + 0x36c]
push dword [0x103e8914]
push ebx
call dword [0x103dd6bc]
add esp, 8
jmp 0x10065f83
call fcn.100bcc31
push dword [ebp - 4]
push ebx
call fcn.1005c890
add esp, 0xc
jmp 0x10065f46
push esi
call fcn.100bcc31
add esp, 4
lea eax, [edi + 0x20]
pop esi
mov byte [edi + 0x2f1d], 1
pop ebx
movss xmm0, dword [edi + 0x2f20]
xorps xmm1, xmm1
comiss xmm0, xmm1
jbe 0x10065fe0
subss xmm0, dword [edi + 0x18]
comiss xmm1, xmm0
movss dword [edi + 0x2f20], xmm0
jb 0x10065fe0
mov eax, dword [eax]
test eax, eax
je 0x10065fcf
push eax
call fcn.100638c0
add esp, 4
mov dword [edi + 0x2f20], 0
pop edi
mov esp, ebp
pop ebp
ret
mov byte [edi + 0x354], 1
mov dword [edi + 0x2f20], 0
pop edi
mov esp, ebp
pop ebp
ret
Function at 0x1006a0f0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100e6090
mov eax, dword fs:[0]
push eax
push ebx
push esi
push edi
mov eax, dword [0x103dda04]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
xor ebx, ebx
cmp dword [esi + 0x4c], ebx
jle 0x1006a14d
xor edi, edi
mov eax, dword [esi + 0x54]
mov ecx, dword [edi + eax]
test ecx, ecx
je 0x1006a144
cmp byte [edi + eax + 8], 0
je 0x1006a144
push ecx
call fcn.1005cde0
mov eax, dword [esi + 0x54]
add esp, 4
mov dword [edi + eax], 0
inc ebx
add edi, 0x78
cmp ebx, dword [esi + 0x4c]
jl 0x1006a120
xor edx, edx
cmp dword [esi + 0x34], edx
jle 0x1006a18d
mov eax, dword [esi + 0x3c]
mov edi, dword [eax + edx*4]
mov eax, dword [esi + 0x54]
mov ebx, dword [edi + 0x34]
cmp ebx, eax
jb 0x1006a187
mov ecx, dword [esi + 0x4c]
shl ecx, 4
sub ecx, dword [esi + 0x4c]
lea eax, [eax + ecx*8]
cmp ebx, eax
jae 0x1006a187
mov dword [edi + 0x34], 0
xor ecx, ecx
mov eax, dword [esi + 0x3c]
mov eax, dword [eax + edx*4]
mov word [eax + 0x38], cx
inc edx
cmp edx, dword [esi + 0x34]
jl 0x1006a154
mov eax, dword [esi + 0x54]
test eax, eax
je 0x1006a1b2
push eax
mov dword [esi + 0x50], 0
mov dword [esi + 0x4c], 0
call fcn.1005cde0
add esp, 4
mov dword [esi + 0x54], 0
mov eax, dword [esi + 0x48]
test eax, eax
je 0x1006a1d7
push eax
mov dword [esi + 0x44], 0
mov dword [esi + 0x40], 0
call fcn.1005cde0
add esp, 4
mov dword [esi + 0x48], 0
mov eax, dword [esi + 0x14]
mov dword [esi + 0x464], 0xffffffff
mov dword [esi + 0x460], 0xffffffff
test eax, eax
je 0x1006a1fb
push eax
call fcn.1005cde0
add esp, 4
mov eax, dword [esi + 0x18]
test eax, eax
je 0x1006a20b
push eax
call fcn.1005cde0
add esp, 4
xor ebx, ebx
mov dword [esi + 0x14], 0
mov dword [esi + 0x18], 0
mov byte [esi + 0x12], 0
cmp dword [esi + 0x34], ebx
jle 0x1006a28e
mov eax, dword [esi + 0x3c]
mov edi, dword [eax + ebx*4]
test edi, edi
je 0x1006a288
mov ecx, edi
mov dword [ebp - 4], 0
call fcn.1006a3b0
mov eax, dword [edi + 0x28]
mov byte [ebp - 4], 1
test eax, eax
je 0x1006a250
push eax
call fcn.1005cde0
add esp, 4
mov eax, dword [edi + 0x1c]
mov byte [ebp - 4], 2
test eax, eax
je 0x1006a264
push eax
call fcn.1005cde0
add esp, 4
mov eax, dword [edi + 8]
mov byte [ebp - 4], 3
test eax, eax
je 0x1006a278
push eax
call fcn.1005cde0
add esp, 4
push edi
mov dword [ebp - 4], 0xffffffff
call fcn.1005cde0
add esp, 4
inc ebx
cmp ebx, dword [esi + 0x34]
jl 0x1006a224
mov eax, dword [esi + 0x3c]
test eax, eax
je 0x1006a2b3
push eax
mov dword [esi + 0x38], 0
mov dword [esi + 0x34], 0
call fcn.1005cde0
add esp, 4
mov dword [esi + 0x3c], 0
mov byte [esi + 0x11], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret