joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10010f70
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
sub esp, 0x2c
push esi
push 0x10256a58
push eax
call fcn.102327c7
mov esi, eax
add esp, 8
test esi, esi
jne 0x10010fa2
push str.FAILED_to_read_sound_file__file_pointer_as_null__n
call fcn.10231b66
add esp, 4
xor al, al
pop esi
mov esp, ebp
pop ebp
ret
push esi
push 1
lea ecx, [ebp - 0x14]
push 0xc
push ecx
call fcn.1023259a
add esp, 0x10
cmp byte [ebp - 0x14], 0x52
jne 0x10011143
cmp byte [ebp - 0x13], 0x49
jne 0x10011143
mov al, 0x46
cmp byte [ebp - 0x12], al
jne 0x10011143
cmp byte [ebp - 0x11], al
jne 0x10011143
cmp byte [ebp - 0xc], 0x57
jne 0x10011143
cmp byte [ebp - 0xb], 0x41
jne 0x10011143
cmp byte [ebp - 0xa], 0x56
jne 0x10011143
cmp byte [ebp - 9], 0x45
jne 0x10011143
push ebx
mov bl, 0x20
push edi
push esi
call fcn.1023220a
push esi
push 1
lea edx, [ebp - 0x2c]
push 0x18
push edx
mov edi, eax
call fcn.1023259a
add esp, 0x14
cmp eax, 1
jne 0x1001104d
cmp byte [ebp - 0x2c], 0x66
jne 0x1001103c
cmp byte [ebp - 0x2b], 0x6d
jne 0x1001103c
cmp byte [ebp - 0x2a], 0x74
jne 0x1001103c
cmp byte [ebp - 0x29], bl
je 0x10011063
mov eax, dword [ebp - 4]
push 1
push eax
push esi
call fcn.10232917
add esp, 0xc
jmp 0x10011007
push str.Invalid_Wave_Format__n
call fcn.10231b66
add esp, 4
pop edi
pop ebx
xor al, al
pop esi
mov esp, ebp
pop ebp
ret
cmp dword [ebp - 0x28], 0x10
jbe 0x10011076
push 1
push 2
push esi
call fcn.10232917
add esp, 0xc
mov bl, 0x61
push esi
push 1
lea ecx, [ebp - 8]
push 8
push ecx
call fcn.1023259a
add esp, 0x10
cmp eax, 1
jne 0x100110b9
cmp byte [ebp - 8], 0x64
jne 0x100110a4
cmp byte [ebp - 7], bl
jne 0x100110a4
cmp byte [ebp - 6], 0x74
jne 0x100110a4
cmp byte [ebp - 5], bl
je 0x100110cf
mov edx, dword [ebp - 0x28]
push 0
lea eax, [edx + edi + 8]
push eax
push esi
call fcn.10232917
add esp, 0xc
jmp 0x10011078
push str.Invalid_Wav_Data_Header__n
call fcn.10231b66
add esp, 4
pop edi
pop ebx
xor al, al
pop esi
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
push ecx
call fcn.1022fe13
mov edx, dword [ebp - 4]
push esi
push 1
mov edi, eax
push edx
push edi
call fcn.1023259a
add esp, 0x14
test eax, eax
jne 0x10011104
push str.error_loading_WAVE_data_into_struct__n
call fcn.10231b66
add esp, 4
pop edi
pop ebx
xor al, al
pop esi
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 4]
mov ecx, dword [ebp + 0xc]
push eax
push edi
call fcn.10010cf0
mov edx, dword [ebp - 0x20]
mov ecx, dword [ebp + 0x18]
movsx eax, word [ebp - 0x22]
mov dword [ecx], edx
mov ecx, dword [ebp + 0x10]
movsx edx, word [ebp - 0x16]
mov dword [ecx], eax
mov eax, dword [ebp + 0x14]
push esi
mov dword [eax], edx
call fcn.102322dc
push edi
call fcn.10231cc4
add esp, 8
pop edi
pop ebx
mov al, 1
pop esi
mov esp, ebp
pop ebp
ret
push str.Invalid_RIFF_or_WAVE_Header__n
call fcn.10231b66
add esp, 4
xor al, al
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x100181e0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 0xc]
push esi
push 0x10256d78
push eax
call fcn.10232cc1
mov esi, eax
add esp, 8
test esi, esi
jne 0x1001820d
mov esi, dword [ebp + 8]
mov ecx, esi
call fcn.1003c050
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret
push edi
push 2
push 0
push esi
call fcn.10232917
push esi
call fcn.1023220a
push 0
push 0
push esi
mov edi, eax
call fcn.10232917
add esp, 0x1c
push edi
lea ecx, [ebp - 4]
call fcn.1003c000
push esi
push 1
push edi
lea ecx, [ebp - 4]
call fcn.1003c0c0
push eax
call fcn.1023259a
push esi
call fcn.102322dc
mov esi, dword [ebp + 8]
add esp, 0x14
lea ecx, [ebp - 4]
push ecx
mov ecx, esi
call fcn.1003c060
pop edi
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x10018270
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 0xc]
push esi
push 0x10256a58
push eax
call fcn.102327c7
mov esi, eax
add esp, 8
test esi, esi
jne 0x1001829d
mov esi, dword [ebp + 8]
mov ecx, esi
call fcn.1003c050
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret
push edi
push 2
push 0
push esi
call fcn.10232917
push esi
call fcn.1023220a
push 0
push 0
push esi
mov edi, eax
call fcn.10232917
add esp, 0x1c
push edi
lea ecx, [ebp - 4]
call fcn.1003c000
push esi
push 1
push edi
lea ecx, [ebp - 4]
call fcn.1003c0c0
push eax
call fcn.1023259a
push esi
call fcn.102322dc
mov esi, dword [ebp + 8]
add esp, 0x14
lea ecx, [ebp - 4]
push ecx
mov ecx, esi
call fcn.1003c060
pop edi
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x10018940
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x102511b8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x170
push ebx
push edi
xor ebx, ebx
push 0x103
lea eax, [ebp - 0x17b]
push ebx
push eax
mov byte [ebp - 0x17c], bl
call fcn.10230cc0
mov edi, dword [ebp + 8]
add esp, 0xc
cmp edi, ebx
jne 0x100189fb
push 0x104
lea ecx, [ebp - 0x17c]
push ecx
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea eax, [ebp - 0x17c]
mov byte [ebp - 0x79], bl
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x100189a3
sub eax, edx
cmp eax, ebx
jle 0x100189c9
mov cl, 0x5c
cmp byte [ebp + eax - 0x17c], cl
je 0x100189c2
dec eax
cmp eax, ebx
jg 0x100189b2
jmp 0x100189c9
mov byte [ebp + eax - 0x17c], bl
lea eax, [ebp - 0x17c]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x100189d2
mov ecx, dword [ebp + 0xc]
sub eax, edx
push eax
lea edx, [ebp - 0x17c]
push edx
call fcn.10002080
pop edi
pop ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x17c]
push eax
push ebx
push ebx
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x20], 0x1a
mov dword [ebp - 0x1c], 0x10
mov dword [ebp - 0x18], 5
mov dword [ebp - 0x14], 0x28
mov dword [ebp - 0x10], ebx
mov ecx, dword [ebp + edi*4 - 0x24]
push ecx
push ebx
call dword [sym.imp.SHELL32.dll_SHGetFolderPathA]
lea eax, [ebp - 0x17c]
lea edx, [eax + 1]
jmp 0x10018a40
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x10018a40
push esi
mov esi, dword [ebp + 0xc]
sub eax, edx
push eax
lea edx, [ebp - 0x17c]
push edx
mov ecx, esi
call fcn.10002080
cmp edi, 1
jne 0x10018afe
push 0x102d5640
lea eax, [ebp - 0x78]
push 0x10256da4
push eax
call fcn.10009910
push 0x10256da4
push eax
lea ecx, [ebp - 0x40]
push ecx
mov dword [ebp - 4], ebx
call fcn.10009ae0
push 0x102d5694
push eax
lea edx, [ebp - 0x5c]
push edx
mov byte [ebp - 4], 1
call fcn.10009aa0
add esp, 0x24
push 0xffffffffffffffff
push ebx
push eax
mov ecx, esi
mov byte [ebp - 4], 2
call fcn.10009570
mov esi, 0x10
cmp dword [ebp - 0x48], esi
jb 0x10018ac5
mov eax, dword [ebp - 0x5c]
push eax
call fcn.1023005c
add esp, 4
mov edi, 0xf
mov dword [ebp - 0x48], edi
mov dword [ebp - 0x4c], ebx
mov byte [ebp - 0x5c], bl
cmp dword [ebp - 0x2c], esi
jb 0x10018ae4
mov ecx, dword [ebp - 0x40]
push ecx
call fcn.1023005c
add esp, 4
mov dword [ebp - 0x2c], edi
mov dword [ebp - 0x30], ebx
mov byte [ebp - 0x40], bl
cmp dword [ebp - 0x64], esi
jb 0x10018afe
mov edx, dword [ebp - 0x78]
push edx
call fcn.1023005c
add esp, 4
mov ecx, dword [ebp - 0xc]
pop esi
pop edi
pop ebx
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
Function at 0x10018d60
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1025121b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x7c
push ebx
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetLogicalDrives]
xor edi, edi
mov dword [ebp - 0x14], eax
xor ebx, ebx
jmp 0x10018d90
mov eax, 1
mov ecx, ebx
shl eax, cl
test dword [ebp - 0x14], eax
je 0x10018ec4
lea eax, [ebp - 0x10]
lea edx, [ebx + 0x61]
mov dword [ebp - 0x10], 0x5c3a78
push eax
mov byte [ebp - 0x10], dl
call dword [sym.imp.KERNEL32.dll_GetDriveTypeA]
mov esi, eax
cmp esi, 1
jbe 0x10018ec4
mov eax, 0xf
mov dword [ebp - 0x74], eax
mov dword [ebp - 0x78], edi
mov byte [ebp - 0x88], 0
mov dword [ebp - 0x58], eax
mov dword [ebp - 0x5c], edi
mov byte [ebp - 0x6c], 0
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x3c], edi
mov byte [ebp - 0x4c], 0
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x20], edi
mov byte [ebp - 0x30], 0
lea eax, [ebp - 0x10]
mov dword [ebp - 4], edi
lea edx, [eax + 1]
lea ecx, [ecx]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x10018e00
sub eax, edx
push eax
lea ecx, [ebp - 0x10]
push ecx
lea ecx, [ebp - 0x88]
call fcn.10002080
lea eax, [ebp - 0x10]
lea edx, [eax + 1]
nop
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x10018e20
sub eax, edx
push eax
lea edx, [ebp - 0x10]
push edx
lea ecx, [ebp - 0x30]
call fcn.10002080
push 7
push str.C_Drive
lea ecx, [ebp - 0x6c]
call fcn.10002080
cmp dword [ebp - 0x58], 0x10
mov eax, dword [ebp - 0x6c]
jae 0x10018e51
lea eax, [ebp - 0x6c]
cmp esi, 2
lea ecx, [ebx + 0x41]
sete dl
mov byte [eax], cl
mov byte [ebp - 0x4f], dl
mov byte [ebp - 0x50], 1
cmp esi, 5
jne 0x10018e6f
mov ecx, str.CDROM
jmp 0x10018e8a
cmp esi, 4
jne 0x10018e7b
mov ecx, str.Network
jmp 0x10018e8a
mov ecx, str.RAMDISK
cmp esi, 6
je 0x10018e8a
mov ecx, str.Hard_Drive
mov eax, ecx
lea esi, [eax + 1]
nop
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x10018e90
sub eax, esi
push eax
push ecx
lea ecx, [ebp - 0x4c]
call fcn.10002080
mov ecx, dword [ebp + 8]
lea eax, [ebp - 0x88]
push eax
call fcn.10018cb0
lea ecx, [ebp - 0x88]
mov dword [ebp - 4], 0xffffffff
call fcn.10018440
inc ebx
cmp ebx, 0x1a
jl 0x10018d90
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
Function at 0x100286b0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10251940
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x278
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
xor ebx, ebx
push 0xffffffffffffffff
push ebx
push esi
lea ecx, [ebp - 0x28]
mov dword [ebp - 0x14], 0xf
mov dword [ebp - 0x18], ebx
mov byte [ebp - 0x28], bl
call fcn.10001f90
mov edi, 0x10
mov dword [ebp - 4], ebx
cmp dword [esi + 0x14], edi
jb 0x10028700
mov eax, dword [esi]
jmp 0x10028702
mov eax, esi
push str._serif
push eax
call fcn.1023683e
add esp, 8
test eax, eax
jne 0x1002871d
push 0xb
push str.georgia.ttf
jmp 0x10028763
cmp dword [esi + 0x14], edi
jb 0x10028726
mov eax, dword [esi]
jmp 0x10028728
mov eax, esi
push str._sans
push eax
call fcn.1023683e
add esp, 8
test eax, eax
jne 0x10028743
push 9
push str.arial.ttf
jmp 0x10028763
cmp dword [esi + 0x14], edi
jb 0x1002874a
mov esi, dword [esi]
push str._typewriter
push esi
call fcn.1023683e
add esp, 8
test eax, eax
jne 0x1002876b
push 8
push str.cour.ttf
lea ecx, [ebp - 0x28]
call fcn.10002080
push 0x208
lea eax, [ebp - 0x284]
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
mov esi, 0xf
lea eax, [ebp - 0x284]
mov dword [ebp - 0x30], esi
mov dword [ebp - 0x34], ebx
mov byte [ebp - 0x44], bl
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x10028794
sub eax, edx
push eax
lea ecx, [ebp - 0x284]
push ecx
lea ecx, [ebp - 0x44]
call fcn.10002080
push 0x102574c0
lea edx, [ebp - 0x44]
push edx
lea eax, [ebp - 0x7c]
push eax
mov byte [ebp - 4], 1
call fcn.10009ae0
lea ecx, [ebp - 0x28]
push ecx
push eax
lea edx, [ebp - 0x60]
push edx
mov byte [ebp - 4], 2
call fcn.10009aa0
add esp, 0x18
mov ecx, dword [ebp + 0xc]
push eax
mov byte [ebp - 4], 3
call fcn.100097f0
cmp dword [ebp - 0x4c], edi
jb 0x100287f6
mov eax, dword [ebp - 0x60]
push eax
call fcn.1023005c
add esp, 4
mov dword [ebp - 0x4c], esi
mov dword [ebp - 0x50], ebx
mov byte [ebp - 0x60], bl
cmp dword [ebp - 0x68], edi
jb 0x10028810
mov ecx, dword [ebp - 0x7c]
push ecx
call fcn.1023005c
add esp, 4
mov dword [ebp - 0x68], esi
mov dword [ebp - 0x6c], ebx
mov byte [ebp - 0x7c], bl
cmp dword [ebp - 0x30], edi
jb 0x1002882a
mov edx, dword [ebp - 0x44]
push edx
call fcn.1023005c
add esp, 4
cmp dword [ebp - 0x14], edi
pop edi
pop esi
pop ebx
jb 0x1002883e
mov eax, dword [ebp - 0x28]
push eax
call fcn.1023005c
add esp, 4
mov ecx, dword [ebp - 0xc]
mov al, 1
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
Function at 0x10028e10
Capabilities:
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x102510d8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x160
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
push str..ttf
push eax
lea ecx, [ebp - 0x28]
push ecx
call fcn.100099d0
add esp, 0xc
mov eax, dword [ebp - 0x28]
mov esi, 0x10
mov dword [ebp - 4], 0
cmp dword [ebp - 0x14], esi
jae 0x10028e5d
lea eax, [ebp - 0x28]
lea edx, [ebp - 0x16c]
push edx
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov edi, eax
cmp edi, 0xffffffff
jne 0x10028e7d
cmp dword [ebp - 0x14], esi
jb 0x10028ee5
mov eax, dword [ebp - 0x28]
push eax
jmp 0x10028edd
mov ebx, dword [ebp + 0xc]
push ebx
sub esp, 0x1c
mov ecx, esp
lea eax, [ebp - 0x140]
mov dword [ecx + 0x14], 0xf
mov dword [ecx + 0x10], 0
mov dword [ebp - 0x2c], esp
mov byte [ecx], 0
lea esi, [eax + 1]
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x10028ea3
sub eax, esi
push eax
lea edx, [ebp - 0x140]
push edx
call fcn.10002080
call fcn.10028c40
add esp, 0x20
lea eax, [ebp - 0x16c]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x10028e80
cmp dword [ebp - 0x14], 0x10
jb 0x10028ee5
mov ecx, dword [ebp - 0x28]
push ecx
call fcn.1023005c
add esp, 4
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1004fda0
Capabilities:
Access peb ldr_data
Check for peb beingdebugged flag

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x102523de
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
push ebx
push esi
mov esi, ecx
or eax, 0xffffffff
xor ebx, ebx
mov dword [esi + 8], eax
mov dword [esi + 4], eax
push edi
mov dword [ebp - 0x14], esi
mov dword [esi + 0xc], ebx
lea ecx, [esi + 0x14]
mov dword [esi], vtable.TiXmlAttribute.0
mov eax, 7
xor edx, edx
mov dword [ecx + 0x14], eax
mov dword [ecx + 0x10], ebx
mov dword [ebp - 4], ebx
mov word [ecx], dx
mov dword [esi + 0x44], eax
xor eax, eax
mov dword [esi + 0x40], ebx
mov word [esi + 0x30], ax
mov eax, dword [ebp + 8]
lea edx, [eax + 2]
mov byte [ebp - 4], 2
mov dword [ebp - 0x10], edx
mov dx, word [eax]
add eax, 2
cmp dx, bx
jne 0x1004fe06
sub eax, dword [ebp - 0x10]
sar eax, 1
push eax
mov eax, dword [ebp + 8]
push eax
call fcn.10001810
mov edx, dword [ebp + 0xc]
mov eax, edx
lea ecx, [eax + 2]
mov dword [ebp + 8], ecx
jmp 0x1004fe30
mov cx, word [eax]
add eax, 2
cmp cx, bx
jne 0x1004fe30
sub eax, dword [ebp + 8]
lea ecx, [esi + 0x30]
sar eax, 1
push eax
push edx
call fcn.10001810
mov ecx, dword [ebp - 0xc]
mov dword [esi + 0x10], ebx
mov dword [esi + 0x50], ebx
mov dword [esi + 0x4c], ebx
pop edi
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 8

Function at 0x1004ff70
Capabilities:
Access peb ldr_data
Check for peb beingdebugged flag

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10252423
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebx
push esi
mov esi, ecx
xor edx, edx
push edi
or edi, 0xffffffff
mov dword [esi + 8], edi
mov dword [esi + 4], edi
lea ecx, [esi + 0x20]
mov dword [esi + 0xc], edx
mov dword [ecx + 0x10], edx
mov ebx, 7
mov dword [ecx + 0x14], ebx
xor eax, eax
mov word [ecx], ax
mov dword [ebp - 0x10], esi
mov dword [esi + 0x10], edx
mov dword [esi + 0x14], 1
mov dword [esi + 0x3c], edx
mov dword [esi + 0x40], edx
lea eax, [esi + 0x44]
mov dword [esi], vtable.TiXmlElement.0
mov dword [eax + 8], edi
mov dword [eax + 4], edi
mov dword [eax + 0xc], edx
mov dword [eax], vtable.TiXmlAttribute.0
mov dword [eax + 0x28], ebx
mov dword [eax + 0x24], edx
xor edi, edi
mov word [eax + 0x14], di
mov dword [eax + 0x44], ebx
mov dword [eax + 0x40], edx
mov word [eax + 0x30], di
mov dword [ebp - 4], edx
mov dword [eax + 0x10], edx
mov dword [eax + 0x50], eax
mov dword [eax + 0x4c], eax
mov ebx, dword [ebp + 8]
mov eax, ebx
lea edi, [eax + 2]
mov byte [ebp - 4], 1
mov dword [esi + 0x1c], edx
mov dword [esi + 0x18], edx
mov dword [ebp + 8], edi
mov di, word [eax]
add eax, 2
cmp di, dx
jne 0x10050011
sub eax, dword [ebp + 8]
sar eax, 1
push eax
push ebx
call fcn.10001810
mov ecx, dword [ebp - 0xc]
pop edi
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 4
Function at 0x10050040
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10252443
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebx
xor ebx, ebx
push esi
mov esi, ecx
or eax, 0xffffffff
mov dword [esi + 8], eax
mov dword [esi + 4], eax
mov dword [esi + 0xc], ebx
mov dword [esi + 0x30], ebx
mov edx, 7
mov dword [esi + 0x34], edx
xor ecx, ecx
mov word [esi + 0x20], cx
mov dword [ebp - 0x10], esi
mov dword [esi + 0x10], ebx
mov dword [esi + 0x14], ebx
mov dword [esi + 0x18], ebx
mov dword [esi + 0x1c], ebx
mov dword [esi + 0x3c], ebx
mov dword [esi + 0x40], ebx
lea ecx, [esi + 0x4c]
mov dword [esi], vtable.TiXmlDocument.0
mov dword [ecx + 0x14], edx
xor edx, edx
mov dword [ecx + 0x10], ebx
mov dword [ebp - 4], ebx
mov word [ecx], dx
mov dword [esi + 0x70], eax
mov dword [esi + 0x6c], eax
push ebx
push 0x10257214
mov byte [ebp - 4], 1
mov dword [esi + 0x68], 4
mov byte [esi + 0x74], bl
mov byte [esi + 0x44], bl
mov dword [esi + 0x48], ebx
call fcn.10001810
mov ecx, dword [ebp - 0xc]
mov dword [esi + 0x70], ebx
mov dword [esi + 0x6c], ebx
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret

Function at 0x100534e0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1025259b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
mov eax, dword [ebp + 8]
push ebx
mov ebx, ecx
mov ecx, dword [eax]
mov dword [ebx], ecx
mov edx, dword [eax + 4]
mov dword [ebx + 4], edx
mov ecx, dword [eax + 8]
mov dword [ebx + 8], ecx
mov edx, dword [eax + 0xc]
mov dword [ebx + 0xc], edx
push esi
lea ecx, [ebx + 0x14]
mov esi, 0x10
xor edx, edx
push edi
mov dword [ebp - 0x10], ebx
mov dword [ebx + 0x10], ecx
mov dword [ebx + 0x74], esi
mov dword [ebx + 0x78], edx
mov eax, dword [eax + 0xc]
lea ecx, [ebx + 0x7c]
inc eax
lea edi, [ecx + 4]
push eax
mov dword [ebp - 4], edx
mov dword [ecx], edi
mov dword [ecx + 0x44], esi
mov dword [ecx + 0x48], edx
call fcn.100030b0
fld1
mov edx, dword [ebp + 0xc]
fst qword [ebx + 0xc8]
fldz
lea edi, [ebx + 0xc8]
fst qword [edi + 8]
mov ecx, 0xe
fst qword [edi + 0x10]
mov eax, ebx
fst qword [edi + 0x18]
fst qword [edi + 0x28]
fstp qword [edi + 0x30]
fstp qword [edi + 0x20]
mov byte [ebx + 0x100], 0
mov esi, dword [edx + 4]
rep movsd dword es:[edi], dword [esi]
mov esi, dword [edx + 8]
lea edi, [ebx + 0x100]
mov ecx, 0x12
rep movsd dword es:[edi], dword [esi]
mov edx, dword [edx + 0xc]
mov ecx, dword [ebp - 0xc]
pop edi
mov dword [ebx + 0x148], edx
pop esi
pop ebx
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 8
Function at 0x100ab9d0
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
xor edx, edx
push esi
mov dword [eax + 0x30], edx
mov dword [eax + 0x4c], edx
mov dword [eax + 0x20], edx
mov dword [eax + 0x2c], 0x20
mov dword [eax + 0x54], 1
mov dword [eax + 0x48], 4
mov dword [eax + 0x58], edx
lea esi, [eax + 0x70]
lea ecx, [ecx]
mov eax, edx
and eax, 1
dec eax
not eax
and eax, 0xedb88320
mov ecx, edx
shr ecx, 1
xor eax, ecx
mov ecx, eax
and ecx, 1
dec ecx
not ecx
and ecx, 0xedb88320
shr eax, 1
xor ecx, eax
mov eax, ecx
and eax, 1
dec eax
shr ecx, 1
not eax
and eax, 0xedb88320
xor eax, ecx
mov ecx, eax
and ecx, 1
dec ecx
not ecx
and ecx, 0xedb88320
shr eax, 1
xor ecx, eax
mov eax, ecx
and eax, 1
dec eax
shr ecx, 1
not eax
and eax, 0xedb88320
xor eax, ecx
mov ecx, eax
and ecx, 1
dec ecx
not ecx
and ecx, 0xedb88320
shr eax, 1
xor ecx, eax
mov eax, ecx
and eax, 1
dec eax
shr ecx, 1
not eax
and eax, 0xedb88320
xor eax, ecx
mov ecx, eax
and ecx, 1
dec ecx
not ecx
and ecx, 0xedb88320
shr eax, 1
xor ecx, eax
mov dword [esi], ecx
inc edx
add esi, 4
cmp edx, 0x100
jb 0x100aba00
pop esi
pop ebp
ret

Function at 0x100ae970
Capabilities:
Encode data using xor

Disassembly:
push ebx
xor eax, eax
or ecx, 0x100
push edi
lea ebx, [ebx]
mov ebx, ecx
shr ebx, 7
mov edi, ecx
shr edi, 8
movzx edi, word [esi + edi*2]
and ebx, 1
neg ebx
sar ebx, 4
shr edi, 4
and ebx, 0x7f
xor edi, ebx
add eax, dword [edx + edi*4]
add ecx, ecx
cmp ecx, 0x10000
jb 0x100ae980
pop edi
pop ebx
ret

Function at 0x100ae9b0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, eax
mov edx, 0x100
xor eax, eax
push edi
or ecx, edx
add esi, esi
mov edi, edx
and edi, esi
add edi, edx
mov ebx, ecx
shr ebx, 8
add ebx, edi
mov edi, dword [ebp + 8]
movzx edi, word [edi + ebx*2]
mov ebx, ecx
shr ebx, 7
and ebx, 1
neg ebx
shr edi, 4
sar ebx, 4
and ebx, 0x7f
xor edi, ebx
mov ebx, dword [ebp + 0xc]
add eax, dword [ebx + edi*4]
add ecx, ecx
mov edi, ecx
xor edi, esi
not edi
and edx, edi
cmp ecx, 0x10000
jb 0x100ae9c1
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x100aec70
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
mov ebx, dword [ebp + 8]
movzx eax, word [ebx]
mov ecx, eax
shr ecx, 4
mov edx, dword [esi + ecx*4]
movzx ecx, word [ebx + 2]
mov dword [ebp - 0xc], edx
mov edx, ecx
xor eax, 0x7f0
xor ecx, 0x7f0
shr edx, 4
mov edx, dword [esi + edx*4]
shr eax, 4
mov eax, dword [esi + eax*4]
shr ecx, 4
mov ecx, dword [esi + ecx*4]
add edx, eax
add ecx, eax
mov dword [ebp - 0x10], edx
push edi
mov dword [ebp - 0x14], ecx
xor edx, edx
jmp 0x100aecc0
cmp edx, dword [ebp + 0x10]
jae 0x100aede0
mov eax, edx
xor edi, edi
or eax, 8
mov dword [ebp - 4], edi
cmp eax, 1
je 0x100aed09
mov edi, dword [ebp + 0xc]
mov ecx, eax
and eax, 1
shr ecx, 1
lea edi, [ecx + edi*8]
movzx edi, word [ebx + edi*2 + 4]
neg eax
sar eax, 4
shr edi, 4
and eax, 0x7f
xor edi, eax
mov eax, edi
mov edi, dword [ebp - 4]
add edi, dword [esi + eax*4]
mov eax, ecx
mov dword [ebp - 4], edi
cmp eax, 1
jne 0x100aecd8
add edi, dword [ebp - 0xc]
mov ecx, dword [ebp + 0x14]
mov dword [ecx + edx*4], edi
inc edx
cmp edx, 8
jb 0x100aecc0
cmp edx, 0x10
jae 0x100aed8a
lea eax, [edx - 8]
mov dword [ebp - 8], eax
cmp edx, dword [ebp + 0x10]
jae 0x100aede0
xor edi, edi
or eax, 8
mov dword [ebp - 4], edi
cmp eax, 1
je 0x100aed74
lea esp, [esp]
mov edi, dword [ebp + 0xc]
mov ecx, eax
and eax, 1
shr ecx, 1
lea edi, [ecx + edi*8]
movzx edi, word [ebx + edi*2 + 0x104]
neg eax
sar eax, 4
shr edi, 4
and eax, 0x7f
xor edi, eax
mov eax, edi
mov edi, dword [ebp - 4]
add edi, dword [esi + eax*4]
mov eax, ecx
mov dword [ebp - 4], edi
cmp eax, 1
jne 0x100aed40
add edi, dword [ebp - 0x10]
mov ecx, dword [ebp + 0x14]
mov eax, dword [ebp - 8]
mov dword [ecx + edx*4], edi
inc edx
inc eax
mov dword [ebp - 8], eax
cmp edx, 0x10
jb 0x100aed23
cmp edx, dword [ebp + 0x10]
jae 0x100aede0
lea eax, [edx - 0x10]
mov dword [ebp - 8], eax
or eax, 0x100
xor edi, edi
cmp eax, 1
je 0x100aedca
mov ecx, eax
and eax, 1
shr ecx, 1
movzx ebx, word [ebx + ecx*2 + 0x204]
neg eax
sar eax, 4
shr ebx, 4
and eax, 0x7f
xor ebx, eax
add edi, dword [esi + ebx*4]
mov ebx, dword [ebp + 8]
mov eax, ecx
cmp eax, 1
jne 0x100aeda1
add edi, dword [ebp - 0x14]
mov ecx, dword [ebp + 0x14]
mov eax, dword [ebp - 8]
mov dword [ecx + edx*4], edi
inc edx
inc eax
mov dword [ebp - 8], eax
cmp edx, dword [ebp + 0x10]
jb 0x100aed95
pop edi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x100b0890
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
xor esi, esi
lea eax, [edi + 0x32550]
mov dword [ebp - 8], esi
mov dword [ebp - 0xc], eax
lea ebx, [ebx]
xor edx, edx
lea ecx, [edx + 1]
mov dword [ebp - 4], 4
lea esp, [esp]
movzx ebx, word [edi + ecx*2 + 0x32bf4]
mov eax, esi
and eax, 1
mov edi, eax
neg edi
sar edi, 4
and edi, 0x7f
shr ebx, 4
xor ebx, edi
mov edi, dword [ebp + 8]
add edx, dword [edi + ebx*4 + 0x30ea0]
add ecx, ecx
shr esi, 1
or ecx, eax
dec dword [ebp - 4]
jne 0x100b08c0
mov eax, dword [ebp - 0xc]
mov esi, dword [ebp - 8]
inc esi
mov dword [eax], edx
add eax, 4
mov dword [ebp - 8], esi
mov dword [ebp - 0xc], eax
cmp esi, 0x10
jb 0x100b08b0
mov dword [edi + 0x32590], 0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret