joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10008060
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
cmp byte [0x100b32f0], 0
jne 0x100080a4
mov eax, dword [0x100b32dc]
test eax, eax
je 0x100080a4
push eax
push dword [0x100b32d0]
push 0x100b32e0
call fcn.10052c90
push dword [0x100b32dc]
mov edx, dword [0x100b32d4]
mov ecx, dword [0x100b32d0]
call fcn.10002f80
add esp, 0x10
mov byte [0x100b32f0], 1
mov ecx, 0x100b3318
jmp fcn.100010c0

Function at 0x100080b0
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ecx
cmp byte [0x100b1e2e], 0
jne 0x10008184
cmp byte [0x100b1e2d], 0
jne 0x10008184
cmp byte [0x100b1e2f], 0
jne 0x10008184
cmp byte [0x100b1fc2], 0
jne 0x10008184
cmp byte [0x100b1fc1], 0
jne 0x10008184
cmp byte [0x100b32f0], 0
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_VirtualProtect]
push esi
push edi
je 0x1000813e
mov esi, dword [0x100b32dc]
lea eax, [esp + 0xc]
mov edi, dword [0x100b32d0]
push eax
push 0x40
push esi
push edi
call ebx
push esi
push 0x100b32e0
push edi
call fcn.10052c90
add esp, 0xc
lea eax, [esp + 0xc]
push eax
push dword [esp + 0x10]
push esi
push edi
call ebx
mov byte [0x100b32f0], 0
cmp byte [0x100b3338], 0
je 0x10008181
mov esi, dword [0x100b3324]
lea eax, [esp + 0xc]
mov edi, dword [0x100b3318]
push eax
push 0x40
push esi
push edi
call ebx
push esi
push 0x100b3328
push edi
call fcn.10052c90
add esp, 0xc
lea eax, [esp + 0xc]
push eax
push dword [esp + 0x10]
push esi
push edi
call ebx
mov byte [0x100b3338], 0
pop edi
pop esi
pop ebx
pop ecx
ret

Function at 0x10008190
Capabilities:
Allocate or change rwx memory

Disassembly:
push ecx
cmp byte [0x100b0950], 0
jne 0x100081fb
cmp byte [0x100b09a0], 0
jne 0x100081fb
cmp byte [0x100b0978], 0
jne 0x100081fb
cmp byte [0x100b335c], 0
je 0x100081fb
push ebx
mov ebx, dword [0x100b333c]
lea eax, [esp + 4]
push edi
mov edi, dword [0x100b3348]
push eax
push 0x40
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
push edi
push 0x100b334c
push ebx
call fcn.10052c90
add esp, 0xc
lea eax, [esp + 8]
push eax
push dword [esp + 0xc]
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
pop edi
mov byte [0x100b335c], 0
pop ebx
pop ecx
ret
Function at 0x10009c80
Capabilities:
Allocate or change rwx memory

Disassembly:
push ecx
cmp byte [0x100b34a0], 0
je 0x10009cd0
push ebx
mov ebx, dword [0x100b3480]
lea eax, [esp + 4]
push edi
mov edi, dword [0x100b348c]
push eax
push 0x40
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
push edi
push 0x100b3490
push ebx
call fcn.10052c90
add esp, 0xc
lea eax, [esp + 8]
push eax
push dword [esp + 0xc]
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
pop edi
mov byte [0x100b34a0], 0
pop ebx
pop ecx
ret

Function at 0x10009d10
Capabilities:
Allocate or change rwx memory

Disassembly:
push ecx
call fcn.100080b0
cmp byte [0x100b34c4], 0
je 0x10009d65
push ebx
mov ebx, dword [0x100b34a4]
lea eax, [esp + 4]
push edi
mov edi, dword [0x100b34b0]
push eax
push 0x40
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
push edi
push 0x100b34b4
push ebx
call fcn.10052c90
add esp, 0xc
lea eax, [esp + 8]
push eax
push dword [esp + 0xc]
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
pop edi
mov byte [0x100b34c4], 0
pop ebx
pop ecx
ret

Function at 0x1000a1a0
Capabilities:
Allocate or change rwx memory

Disassembly:
push ecx
call fcn.100080b0
cmp byte [0x100b34ec], 0
je 0x1000a1f5
push ebx
mov ebx, dword [0x100b34cc]
lea eax, [esp + 4]
push edi
mov edi, dword [0x100b34d8]
push eax
push 0x40
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
push edi
push 0x100b34dc
push ebx
call fcn.10052c90
add esp, 0xc
lea eax, [esp + 8]
push eax
push dword [esp + 0xc]
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
pop edi
mov byte [0x100b34ec], 0
pop ebx
pop ecx
ret

Function at 0x1000a270
Capabilities:
Allocate or change rwx memory

Disassembly:
push ecx
cmp byte [0x100b3510], 0
je 0x1000a2c0
push ebx
mov ebx, dword [0x100b34f0]
lea eax, [esp + 4]
push edi
mov edi, dword [0x100b34fc]
push eax
push 0x40
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
push edi
push 0x100b3500
push ebx
call fcn.10052c90
add esp, 0xc
lea eax, [esp + 8]
push eax
push dword [esp + 0xc]
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
pop edi
mov byte [0x100b3510], 0
pop ebx
pop ecx
ret
Function at 0x1000a3b0
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ecx
cmp byte [0x100b357c], 0
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_VirtualProtect]
push esi
push edi
je 0x1000a3fd
mov esi, dword [0x100b3568]
lea eax, [esp + 0xc]
mov edi, dword [0x100b355c]
push eax
push 0x40
push esi
push edi
call ebx
push esi
push 0x100b356c
push edi
call fcn.10052c90
add esp, 0xc
lea eax, [esp + 0xc]
push eax
push dword [esp + 0x10]
push esi
push edi
call ebx
mov byte [0x100b357c], 0
cmp byte [0x100b3558], 0
je 0x1000a440
mov esi, dword [0x100b3544]
lea eax, [esp + 0xc]
mov edi, dword [0x100b3538]
push eax
push 0x40
push esi
push edi
call ebx
push esi
push 0x100b3548
push edi
call fcn.10052c90
add esp, 0xc
lea eax, [esp + 0xc]
push eax
push dword [esp + 0x10]
push esi
push edi
call ebx
mov byte [0x100b3558], 0
cmp byte [0x100b3534], 0
je 0x1000a483
mov esi, dword [0x100b3520]
lea eax, [esp + 0xc]
mov edi, dword [0x100b3514]
push eax
push 0x40
push esi
push edi
call ebx
push esi
push 0x100b3524
push edi
call fcn.10052c90
add esp, 0xc
lea eax, [esp + 0xc]
push eax
push dword [esp + 0x10]
push esi
push edi
call ebx
mov byte [0x100b3534], 0
pop edi
pop esi
pop ebx
pop ecx
ret
Function at 0x1000eee0
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1006f9e0
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push esi
push edi
mov eax, dword [0x100b0040]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x18], esi
mov dword [esi + 0x14], 0
mov dword [esi + 0x10], 0
mov dword [esi + 0x18], 0
mov dword [ebp - 4], 0
mov dword [esi + 0x1c], 0
mov dword [esi + 0x20], 0
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x2c], 0
mov dword [esi + 0x30], 0
mov byte [esi], 0
mov dword [esi + 0xc], 0
mov dword [esi + 8], 0
mov dword [esi + 4], 0
mov ecx, dword [esi + 0x14]
test ecx, ecx
jns 0x1000f033
mov eax, ecx
xor edi, edi
cdq
sub eax, edx
sar eax, 1
add eax, ecx
test eax, eax
cmovg edi, eax
cmp edi, ecx
jle 0x1000f033
lea ecx, [edi*4]
call fcn.10017530
mov edx, dword [esi + 0x18]
mov dword [ebp - 0x18], eax
test edx, edx
je 0x1000f02d
mov ecx, dword [esi + 0x10]
shl ecx, 2
push ecx
push edx
push eax
call fcn.10052c90
mov ebx, dword [esi + 0x18]
add esp, 0xc
test ebx, ebx
je 0x1000f021
mov ecx, dword [0x100b31d4]
test ecx, ecx
je 0x1000f021
movsx eax, word [ecx + 0x5ee4]
mov edx, dword [ecx + 0x3f08]
add eax, 0xbdd
mov dword [ebp - 0x14], edx
cmp dword [ecx + eax*8], edx
lea eax, [ecx + eax*8]
je 0x1000f017
movsx eax, word [ecx + 0x5ee4]
inc eax
mov dword [ebp - 0x10], 6
cdq
idiv dword [ebp - 0x10]
movzx eax, dx
mov edx, dword [ebp - 0x14]
mov word [ecx + 0x5ee4], ax
cwde
add eax, 0xbdd
lea eax, [ecx + eax*8]
mov dword [eax], edx
xor edx, edx
mov dword [eax + 4], edx
inc word [eax + 6]
inc dword [ecx + 0x5ee0]
push ebx
call fcn.100551a4
mov eax, dword [ebp - 0x18]
add esp, 4
mov dword [esi + 0x18], eax
mov dword [esi + 0x14], edi
mov dword [esi + 0x10], 0
mov eax, esi
mov dword [esi + 0x2c], 0
mov dword [esi + 0x30], 0
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x1c], 0
mov dword [esi + 0x20], 0
mov dword [esi + 0x34], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10013da0
Capabilities:
Hash data with crc32

Disassembly:
push ebx
mov ebx, dword [esp + 8]
push esi
push edi
mov edi, edx
not ebx
mov esi, ecx
mov eax, ebx
test edi, edi
je 0x10013dfe
mov cl, byte [esi]
lea esi, [esi + 1]
dec edi
cmp cl, 0x23
jne 0x10013de2
cmp edi, 2
jb 0x10013de2
cmp byte [esi], cl
jne 0x10013de2
cmp byte [esi + 1], cl
jne 0x10013de2
mov eax, ebx
movzx ecx, cl
movzx edx, al
xor edx, ecx
shr eax, 8
xor eax, dword [edx*4 + 0x1009e130]
jmp 0x10013db3
movzx edx, al
movzx ecx, cl
xor edx, ecx
shr eax, 8
xor eax, dword [edx*4 + 0x1009e130]
test edi, edi
jne 0x10013db3
pop edi
pop esi
not eax
pop ebx
ret
mov cl, byte [esi]
inc esi
test cl, cl
je 0x10013e2d
cmp cl, 0x23
jne 0x10013e14
cmp byte [esi], cl
jne 0x10013e14
cmp byte [esi + 1], cl
cmove eax, ebx
movzx edx, al
movzx ecx, cl
xor edx, ecx
shr eax, 8
mov cl, byte [esi]
inc esi
xor eax, dword [edx*4 + 0x1009e130]
test cl, cl
jne 0x10013e05
pop edi
pop esi
not eax
pop ebx
ret

Function at 0x10013fb0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push ecx
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
test edi, edi
je 0x10013fc7
mov dword [edi], 0
mov edx, 0x100a4c54
call fcn.10013e40
mov esi, eax
test esi, esi
je 0x10014082
push esi
call fcn.1005a698
add esp, 4
mov dword [esp + 0xc], eax
cmp eax, 0xffffffff
je 0x10014079
push 2
push 0
push esi
call fcn.1005afb5
add esp, 0xc
test eax, eax
jne 0x10014079
push esi
call fcn.1005a698
mov ebx, eax
add esp, 4
cmp ebx, 0xffffffff
je 0x10014079
push 0
push dword [esp + 0x10]
push esi
call fcn.1005afb5
add esp, 0xc
test eax, eax
jne 0x10014079
mov ecx, ebx
call fcn.10017530
mov dword [esp + 0xc], eax
test eax, eax
je 0x10014079
push esi
push ebx
push 1
push eax
call fcn.1005d729
add esp, 0x10
push esi
cmp eax, ebx
je 0x10014060
call fcn.1005ac9c
mov ecx, dword [esp + 0x10]
add esp, 4
call fcn.100175b0
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
call fcn.1005ac9c
add esp, 4
test edi, edi
je 0x1001406e
mov dword [edi], ebx
mov eax, dword [esp + 0xc]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push esi
call fcn.1005ac9c
add esp, 4
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x100141f0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
sub esp, 0x18
push ebx
mov ebx, ecx
lea eax, [edx - 1]
push ebp
mov ebp, ebx
mov dword [esp + 0x14], ebx
mov dword [esp + 0x18], ebp
lea eax, [ebx + eax*2]
mov dword [esp + 0x1c], eax
cmp ebx, eax
mov eax, dword [esp + 0x24]
jae 0x100143c3
push esi
mov esi, dword [esp + 0x2c]
push edi
nop dword [eax]
test esi, esi
je 0x1001422c
cmp eax, esi
jae 0x100143bd
mov cl, byte [eax]
mov byte [esp + 0x12], cl
test cl, cl
je 0x100143bd
movzx ecx, cl
xor ebx, ebx
shr ecx, 3
mov edx, esi
movsx ecx, byte [ecx + 0x100a4dd8]
test ecx, ecx
mov dword [esp + 0x18], ecx
sete bl
add ebx, ecx
test esi, esi
jne 0x1001425d
lea edx, [ebx + eax]
cmp eax, edx
lea esi, [eax + 1]
sbb cl, cl
and cl, byte [esp + 0x12]
mov byte [esp + 0x13], cl
cmp esi, edx
jae 0x10014278
mov ch, byte [esi]
mov byte [esp + 0x11], ch
jmp 0x1001427d
mov byte [esp + 0x11], 0
lea esi, [eax + 2]
cmp esi, edx
jae 0x1001428c
mov ch, byte [esi]
mov byte [esp + 0x10], ch
jmp 0x10014291
mov byte [esp + 0x10], 0
lea esi, [eax + 3]
cmp esi, edx
jae 0x1001429c
mov ch, byte [esi]
jmp 0x1001429e
xor ch, ch
mov ebp, dword [esp + 0x18]
movzx esi, byte [esp + 0x11]
movzx edx, byte [esp + 0x10]
movzx edi, ch
mov ebp, dword [ebp*4 + 0x100a4df8]
mov byte [esp + 0x12], ch
movzx ecx, cl
and ebp, ecx
mov ecx, esi
and ecx, 0x3f
mov dword [esp + 0x14], ebp
shl dword [esp + 0x14], 6
and esi, 0xc0
or dword [esp + 0x14], ecx
mov ecx, edx
shl dword [esp + 0x14], 6
and ecx, 0x3f
or dword [esp + 0x14], ecx
and edx, 0xc0
shl dword [esp + 0x14], 6
mov ecx, edi
mov ebp, dword [esp + 0x14]
and ecx, 0x3f
or ebp, ecx
shr edi, 2
mov ecx, dword [esp + 0x18]
or edi, edx
shr edi, 2
or edi, esi
shr edi, 2
mov ecx, dword [ecx*4 + 0x100a4dc4]
shr ebp, cl
mov esi, ebp
mov dword [esp + 0x14], ebp
mov ebp, dword [esp + 0x18]
cmp esi, dword [ebp*4 + 0x100a4e0c]
sbb ecx, ecx
xor edx, edx
and ecx, 0x40
or edi, ecx
mov ecx, esi
and ecx, 0xfffff800
cmp ecx, 0xd800
mov ecx, 0x80
cmove edx, ecx
mov ecx, 0xffff
or edi, edx
cmp ecx, esi
sbb ecx, ecx
and ecx, 0x100
or edi, ecx
mov ecx, dword [ebp*4 + 0x100a4e20]
mov ebp, dword [esp + 0x20]
xor edi, 0x2a
sar edi, cl
test edi, edi
je 0x100143a2
xor edx, edx
mov esi, 0xfffd
cmp byte [esp + 0x12], dl
setne dl
xor ecx, ecx
cmp byte [esp + 0x10], cl
setne cl
add edx, ecx
xor ecx, ecx
cmp byte [esp + 0x11], cl
setne cl
add edx, ecx
xor ecx, ecx
cmp byte [esp + 0x13], cl
setne cl
add edx, ecx
cmp ebx, edx
cmovl edx, ebx
mov ebx, edx
mov word [ebp], si
add eax, ebx
mov esi, dword [esp + 0x30]
add ebp, 2
mov dword [esp + 0x20], ebp
cmp ebp, dword [esp + 0x24]
jb 0x10014220
mov ebx, dword [esp + 0x1c]
pop edi
pop esi
xor ecx, ecx
mov word [ebp], cx
mov ecx, dword [esp + 0x2c]
test ecx, ecx
je 0x100143d3
mov dword [ecx], eax
sub ebp, ebx
sar ebp, 1
mov eax, ebp
pop ebp
pop ebx
add esp, 0x18
ret
Function at 0x100143e0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
sub esp, 0x10
mov eax, ecx
xor ecx, ecx
push ebx
push ebp
push esi
push edi
mov ebp, edx
mov dword [esp + 0x1c], ecx
test ebp, ebp
je 0x100143fd
cmp eax, ebp
jae 0x10014567
mov bl, byte [eax]
test bl, bl
je 0x10014567
movzx ecx, bl
mov edx, ebp
shr ecx, 3
movsx edi, byte [ecx + 0x100a4dd8]
xor ecx, ecx
test edi, edi
mov dword [esp + 0x14], edi
sete cl
add ecx, edi
mov dword [esp + 0x18], ecx
test ebp, ebp
jne 0x1001442e
lea edx, [ecx + eax]
cmp eax, edx
lea esi, [eax + 1]
sbb cl, cl
and cl, bl
mov byte [esp + 0x13], cl
cmp esi, edx
jae 0x10014447
mov bl, byte [esi]
mov byte [esp + 0x10], bl
jmp 0x1001444c
mov byte [esp + 0x10], 0
lea esi, [eax + 2]
cmp esi, edx
jae 0x10014457
mov ch, byte [esi]
jmp 0x10014459
xor ch, ch
lea ebx, [eax + 3]
mov byte [esp + 0x12], ch
cmp ebx, edx
jae 0x10014468
mov bl, byte [ebx]
jmp 0x1001446a
xor bl, bl
mov edi, dword [edi*4 + 0x100a4df8]
movzx esi, byte [esp + 0x10]
movzx edx, ch
movzx ecx, cl
and edi, ecx
mov byte [esp + 0x11], bl
shl edi, 6
mov ecx, esi
and ecx, 0x3f
movzx ebx, bl
or edi, ecx
and esi, 0xc0
shl edi, 6
mov ecx, edx
and ecx, 0x3f
and edx, 0xc0
or edi, ecx
mov ecx, ebx
and ecx, 0x3f
shr ebx, 2
or ebx, edx
shl edi, 6
or edi, ecx
shr ebx, 2
mov ecx, dword [esp + 0x14]
or ebx, esi
mov esi, dword [esp + 0x14]
shr ebx, 2
mov ecx, dword [ecx*4 + 0x100a4dc4]
shr edi, cl
cmp edi, dword [esi*4 + 0x100a4e0c]
sbb ecx, ecx
xor edx, edx
and ecx, 0x40
or ebx, ecx
mov ecx, edi
and ecx, 0xfffff800
cmp ecx, 0xd800
mov ecx, 0x80
cmove edx, ecx
or ebx, edx
mov edx, 0xffff
cmp edx, edi
sbb ecx, ecx
and ecx, 0x100
or ebx, ecx
mov ecx, dword [esi*4 + 0x100a4e20]
xor ebx, 0x2a
sar ebx, cl
test ebx, ebx
je 0x10014557
xor edx, edx
cmp byte [esp + 0x11], dl
setne dl
xor ecx, ecx
cmp byte [esp + 0x12], cl
setne cl
add edx, ecx
xor ecx, ecx
cmp byte [esp + 0x10], cl
setne cl
add edx, ecx
xor ecx, ecx
cmp byte [esp + 0x13], cl
setne cl
add edx, ecx
cmp dword [esp + 0x18], edx
cmovl edx, dword [esp + 0x18]
mov ecx, edx
add eax, ecx
mov ecx, dword [esp + 0x1c]
inc ecx
jmp 0x100143ed
mov ecx, dword [esp + 0x18]
add eax, ecx
mov ecx, dword [esp + 0x1c]
inc ecx
jmp 0x100143ed
pop edi
pop esi
pop ebp
mov eax, ecx
pop ebx
add esp, 0x10
ret
Function at 0x10016df0
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ecx
push ebx
push esi
push edi
mov edi, ecx
lea edx, [esp + 0x14]
mov esi, 4
mov eax, dword [edi + 0xec]
mov ebx, dword [edi + 0xf4]
mov ebx, dword [ebx + eax*4 - 4]
not ebx
movzx eax, byte [edx]
lea edx, [edx + 1]
movzx ecx, bl
xor ecx, eax
shr ebx, 8
xor ebx, dword [ecx*4 + 0x1009e130]
sub esi, 1
jne 0x10016e11
mov eax, dword [edi]
not ebx
cmp dword [eax + 0x3fc4], ebx
jne 0x10016e49
push ecx
push dword [esp + 0x18]
lea edx, [esi + 4]
mov ecx, ebx
call fcn.10029fa0
add esp, 8
pop edi
pop esi
mov eax, ebx
pop ebx
pop ecx
ret 4

Function at 0x10016e60
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
sub esp, 0x10
mov eax, dword [esp + 0x14]
mov edx, ecx
push esi
push edi
lea esi, [esp + 8]
mov edi, 0x10
movss xmm1, dword [edx + 0x108]
movss xmm0, dword [eax]
movss xmm2, dword [edx + 0x10c]
subss xmm0, xmm1
mov ecx, dword [edx + 0xec]
movss dword [esp + 8], xmm0
movss xmm0, dword [eax + 4]
subss xmm0, xmm2
movss dword [esp + 0xc], xmm0
movss xmm0, dword [eax + 8]
subss xmm0, xmm1
movss dword [esp + 0x10], xmm0
movss xmm0, dword [eax + 0xc]
mov eax, dword [edx + 0xf4]
subss xmm0, xmm2
mov edx, dword [eax + ecx*4 - 4]
movss dword [esp + 0x14], xmm0
not edx
movzx eax, byte [esi]
lea esi, [esi + 1]
movzx ecx, dl
xor ecx, eax
shr edx, 8
xor edx, dword [ecx*4 + 0x1009e130]
sub edi, 1
jne 0x10016ed1
not edx
pop edi
mov eax, edx
pop esi
add esp, 0x10
ret 4
Function at 0x1001a7c0
Capabilities:
Hash data with crc32

Disassembly:
mov eax, dword [0x100b31d4]
push ebx
push esi
push edi
mov esi, dword [eax + 0x3f78]
mov edi, ecx
mov eax, dword [eax + 0x3f70]
lea ebx, [esi + eax*8]
test eax, eax
je 0x1001a79e
nop dword [eax]
mov edx, eax
shr edx, 1
cmp dword [esi + edx*8], edi
lea ecx, [esi + edx*8]
jae 0x1001a798
lea esi, [ecx + 8]
or ecx, 0xffffffff
sub ecx, edx
add eax, ecx
jmp 0x1001a79a
mov eax, edx
test eax, eax
jne 0x1001a780
cmp esi, ebx
je 0x1001a7ad
cmp dword [esi], edi
jne 0x1001a7ad
mov eax, dword [esi + 4]
pop edi
pop esi
pop ebx
ret
pop edi
pop esi
xor eax, eax
pop ebx
ret
mov eax, ecx
or ecx, 0xffffffff
push ebx
push esi
mov bl, byte [eax]
lea esi, [eax + 1]
test bl, bl
je 0x1001a7fd
push edi
or edi, 0xffffffff
cmp bl, 0x23
jne 0x1001a7e3
cmp byte [esi], bl
jne 0x1001a7e3
cmp byte [esi + 1], bl
cmove ecx, edi
movzx edx, cl
movzx eax, bl
mov bl, byte [esi]
xor edx, eax
shr ecx, 8
inc esi
xor ecx, dword [edx*4 + 0x1009e130]
test bl, bl
jne 0x1001a7d4
pop edi
pop esi
not ecx
pop ebx
jmp 0x1001a760
Function at 0x10028dc0
Capabilities:
Hash data with crc32

Disassembly:
push ebx
mov bl, byte [ecx]
or eax, 0xffffffff
push esi
lea esi, [ecx + 1]
push edi
mov edi, dword [0x100b31d4]
test bl, bl
je 0x10028e09
push ebp
or ebp, 0xffffffff
nop dword [eax]
cmp bl, 0x23
jne 0x10028def
cmp byte [esi], bl
jne 0x10028def
cmp byte [esi + 1], bl
cmove eax, ebp
movzx edx, al
movzx ecx, bl
mov bl, byte [esi]
xor edx, ecx
shr eax, 8
inc esi
xor eax, dword [edx*4 + 0x1009e130]
test bl, bl
jne 0x10028de0
pop ebp
mov ecx, dword [edi + 0x5dd0]
not eax
mov edx, dword [edi + 0x5dd8]
pop edi
pop esi
lea ecx, [ecx + ecx*8]
lea ecx, [edx + ecx*4]
pop ebx
cmp edx, ecx
je 0x10028e30
cmp dword [edx + 4], eax
je 0x10028e33
add edx, 0x24
cmp edx, ecx
jne 0x10028e24
xor eax, eax
ret
mov eax, edx
ret
Function at 0x10033670
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebx
push ebp
push esi
push edi
mov esi, ecx
call fcn.1000b1e0
lea ecx, [esi + 0xc]
call fcn.1000b1e0
lea ecx, [esi + 0x18]
call fcn.1000b1e0
mov dword [esi + 0x24], 0
mov ebp, 6
mov dword [esi + 0x28], 0
mov dword [esi + 0x34], 0
mov dword [esi + 0x38], 0
mov edi, dword [esi + 0x44]
test edi, edi
je 0x1003371f
mov ecx, dword [0x100b31d4]
mov dword [esi + 0x40], 0
mov dword [esi + 0x3c], 0
test ecx, ecx
je 0x1003370f
movsx edx, word [ecx + 0x5ee4]
lea eax, [ecx + 0x5ee8]
mov ebx, dword [ecx + 0x3f08]
lea eax, [eax + edx*8]
cmp dword [eax], ebx
je 0x10033705
lea eax, [edx + 1]
cdq
idiv ebp
movzx eax, dx
mov word [ecx + 0x5ee4], ax
cwde
add eax, 0xbdd
xor edx, edx
lea eax, [ecx + eax*8]
mov dword [eax], ebx
mov dword [eax + 4], edx
inc word [eax + 6]
inc dword [ecx + 0x5ee0]
push edi
call fcn.100551a4
add esp, 4
mov dword [esi + 0x44], 0
mov edi, dword [esi + 0x50]
test edi, edi
je 0x10033792
mov ecx, dword [0x100b31d4]
mov dword [esi + 0x4c], 0
mov dword [esi + 0x48], 0
test ecx, ecx
je 0x10033782
movsx edx, word [ecx + 0x5ee4]
lea eax, [ecx + 0x5ee8]
mov ebx, dword [ecx + 0x3f08]
lea eax, [eax + edx*8]
cmp dword [eax], ebx
je 0x10033778
lea eax, [edx + 1]
cdq
idiv ebp
movzx eax, dx
mov word [ecx + 0x5ee4], ax
cwde
add eax, 0xbdd
xor edx, edx
lea eax, [ecx + eax*8]
mov dword [eax], ebx
mov dword [eax + 4], edx
inc word [eax + 6]
inc dword [ecx + 0x5ee0]
push edi
call fcn.100551a4
add esp, 4
mov dword [esi + 0x50], 0
lea ecx, [esi + 0x54]
call fcn.1000b1e0
pop edi
lea ecx, [esi + 0x78]
pop esi
pop ebp
pop ebx
jmp fcn.10035f80
Function at 0x10036a00
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 8
push ebx
mov ebx, ecx
mov ecx, dword [esp + 0x10]
push ebp
push esi
push edi
cmp byte [ecx + 0x3c], 0
lea ebp, [ebx + 0x3c]
jne 0x10036a9b
push 0x60
call fcn.10059eeb
mov esi, dword [0x100b31d4]
add esp, 4
mov ecx, eax
test esi, esi
je 0x10036a7e
movsx edx, word [esi + 0x5ee4]
lea eax, [esi + 0x5ee8]
mov edi, dword [esi + 0x3f08]
lea eax, [eax + edx*8]
cmp dword [eax], edi
je 0x10036a74
lea eax, [edx + 1]
mov dword [esp + 0x14], 6
cdq
idiv dword [esp + 0x14]
movzx eax, dx
mov word [esi + 0x5ee4], ax
cwde
add eax, 0xbdd
xor edx, edx
lea eax, [esi + eax*8]
mov dword [eax], edi
mov dword [eax + 4], edx
inc word [eax + 4]
inc dword [esi + 0x5edc]
test ecx, ecx
je 0x10036a89
call fcn.10038ea0
jmp 0x10036a8b
xor eax, eax
mov dword [esp + 0x14], eax
mov ecx, ebp
lea eax, [esp + 0x14]
push eax
call fcn.1002a840
mov esi, dword [ebx + 0x54]
mov ecx, dword [ebx + 0x58]
cmp esi, ecx
jne 0x10036af4
inc esi
test ecx, ecx
je 0x10036ab5
mov eax, ecx
cdq
sub eax, edx
sar eax, 1
add eax, ecx
jmp 0x10036aba
mov eax, 8
cmp eax, esi
cmovg esi, eax
cmp esi, ecx
jle 0x10036af4
imul ecx, esi, 0x7c
call fcn.10017530
mov edi, eax
mov eax, dword [ebx + 0x5c]
test eax, eax
je 0x10036aeb
imul ecx, dword [ebx + 0x54], 0x7c
push ecx
push eax
push edi
call fcn.10052c90
mov ecx, dword [ebx + 0x5c]
add esp, 0xc
call fcn.100175b0
mov dword [ebx + 0x5c], edi
lea ebp, [ebx + 0x3c]
mov dword [ebx + 0x58], esi
imul edi, dword [ebx + 0x54], 0x7c
mov ecx, 0x1f
mov edx, dword [esp + 0x1c]
mov esi, edx
add edi, dword [ebx + 0x5c]
rep movsd dword es:[edi], dword [esi]
inc dword [ebx + 0x54]
imul edi, dword [ebx + 0x54], 0x7c
add edi, dword [ebx + 0x5c]
cmp dword [edi - 4], 0
jne 0x10036b25
mov ecx, dword [ebp]
mov eax, dword [ebp + 8]
mov eax, dword [eax + ecx*4 - 4]
mov dword [edi - 4], eax
cmp byte [edi - 0x74], 0
jne 0x10036b50
mov ecx, dword [edi - 0x78]
call fcn.10017530
mov ecx, dword [esp + 0x1c]
push dword [edi - 0x78]
mov dword [edi - 0x7c], eax
mov byte [edi - 0x74], 1
push dword [ecx]
push eax
call fcn.10052c90
mov edx, dword [esp + 0x28]
add esp, 0xc
mov ecx, dword [edi - 4]
mov eax, 0xffff
cmp word [ecx + 0x3c], ax
jne 0x10036b66
mov ax, word [edx + 0x4c]
mov word [ecx + 0x3c], ax
imul esi, dword [ebx + 0x54], 0x7c
mov eax, dword [ebx + 0x5c]
add esi, eax
cmp eax, esi
je 0x10036b91
cmp byte [eax + 0x3c], 0
mov edx, dword [eax + 0x78]
lea ecx, [edx + 0x38]
jne 0x10036b87
mov dword [edx + 0x34], eax
xor edx, edx
mov word [ecx], dx
inc word [ecx]
add eax, 0x7c
cmp eax, esi
jne 0x10036b73
mov ecx, ebx
mov byte [ebx + 0x18], 0
call fcn.10036700
mov eax, dword [edi - 4]
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret 4