joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10052660
Capabilities:
Hash data using fnv

Disassembly:
mov eax, 0x1fffffff
bsr ecx, eax
push ebx
push ebp
push esi
push edi
mov edi, 1
mov eax, edi
shl eax, cl
mov ecx, dword [esp + 0x14]
cmp ecx, eax
ja 0x100527af
lea eax, [ecx - 1]
mov esi, dword [0x10105ab0]
or eax, edi
bsr ecx, eax
push esi
lea ecx, [ecx + 1]
shl edi, cl
mov ecx, 0x10105ab8
lea eax, [edi + edi]
push eax
call fcn.10051650
mov ecx, dword [0x10105ab0]
lea ebx, [edi - 1]
mov dword [0x10105ac4], ebx
mov dword [0x10105ac8], edi
mov ecx, dword [ecx]
mov edx, ecx
cmp ecx, esi
je 0x100527a8
movzx eax, byte [ecx + 8]
xor eax, 0x811c9dc5
mov edx, dword [edx]
imul edi, eax, 0x1000193
movzx eax, byte [ecx + 9]
xor edi, eax
movzx eax, byte [ecx + 0xa]
imul edi, edi, 0x1000193
xor edi, eax
movzx eax, byte [ecx + 0xb]
imul edi, edi, 0x1000193
xor edi, eax
mov eax, dword [0x10105ab8]
imul edi, edi, 0x1000193
and edi, ebx
mov ebx, dword [eax + edi*8]
lea eax, [eax + edi*8]
mov dword [esp + 0x14], eax
cmp ebx, esi
jne 0x10052715
mov dword [eax], ecx
mov dword [eax + 4], ecx
jmp 0x1005277b
mov eax, dword [eax + 4]
mov edi, dword [ecx + 8]
cmp edi, dword [eax + 8]
jne 0x10052748
mov eax, dword [eax]
cmp eax, ecx
je 0x1005273f
mov ebp, dword [ecx + 4]
mov dword [ebp], edx
mov ebx, dword [edx + 4]
mov dword [ebx], eax
mov edi, dword [eax + 4]
mov dword [edi], ecx
mov dword [eax + 4], ebx
mov dword [edx + 4], ebp
mov dword [ecx + 4], edi
mov eax, dword [esp + 0x14]
mov dword [eax + 4], ecx
jmp 0x1005277b
cmp ebx, eax
je 0x1005275c
nop dword [eax]
mov eax, dword [eax + 4]
cmp edi, dword [eax + 8]
je 0x1005278c
cmp ebx, eax
jne 0x10052750
mov ebp, dword [ecx + 4]
mov dword [ebp], edx
mov ebx, dword [edx + 4]
mov dword [ebx], eax
mov edi, dword [eax + 4]
mov dword [edi], ecx
mov dword [eax + 4], ebx
mov eax, dword [esp + 0x14]
mov dword [edx + 4], ebp
mov dword [ecx + 4], edi
mov dword [eax], ecx
mov ecx, edx
cmp edx, esi
je 0x100527a8
mov ebx, dword [0x10105ac4]
jmp 0x100526c4
mov ebx, dword [ecx + 4]
mov ebp, dword [eax]
mov dword [ebx], edx
mov edi, dword [edx + 4]
mov dword [edi], ebp
mov eax, dword [ebp + 4]
mov dword [eax], ecx
mov dword [ebp + 4], edi
mov dword [edx + 4], ebx
mov dword [ecx + 4], eax
jmp 0x1005277b
pop edi
pop esi
pop ebp
pop ebx
ret 4
push str.invalid_hash_bucket_count
call fcn.10098ba1
int3

Function at 0x100529d0
Capabilities:
Terminate process

Disassembly:
sub esp, 0x50
push esi
push str.CreateInterface
push ecx
mov esi, edx
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x100529fe
push 0
push esi
call eax
add esp, 8
test eax, eax
je 0x100529fe
pop esi
add esp, 0x50
ret
push 0x10
push 0x100eea34
push str._interface_
push esi
lea ecx, [esp + 0x48]
call fcn.10011c70
push eax
mov edx, str.Failed_to_find
lea ecx, [esp + 0x30]
call fcn.10015240
mov edx, eax
lea ecx, [esp + 0x14]
call fcn.10015330
mov ecx, eax
call fcn.10011a60
push eax
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
lea ecx, [esp + 8]
call fcn.10011b70
lea ecx, [esp + 0x20]
call fcn.10011b70
lea ecx, [esp + 0x38]
call fcn.10011b70
push 1
call fcn.100bf0fa
int3
Function at 0x100586d0
Capabilities:
Hash data with crc32

Disassembly:
push ebx
mov ebx, dword [esp + 8]
push esi
push edi
mov edi, edx
not ebx
mov esi, ecx
mov eax, ebx
test edi, edi
je 0x1005871b
mov cl, byte [esi]
lea esi, [esi + 1]
dec edi
cmp cl, 0x23
jne 0x100586fd
cmp edi, 2
jb 0x100586fd
cmp byte [esi], cl
jne 0x100586fd
cmp byte [esi + 1], cl
cmove eax, ebx
movzx edx, al
movzx ecx, cl
xor edx, ecx
shr eax, 8
xor eax, dword [edx*4 + 0x100f0708]
test edi, edi
jne 0x100586e3
pop edi
pop esi
not eax
pop ebx
ret 4
mov cl, byte [esi]
inc esi
test cl, cl
je 0x1005874a
cmp cl, 0x23
jne 0x10058731
cmp byte [esi], cl
jne 0x10058731
cmp byte [esi + 1], cl
cmove eax, ebx
movzx edx, al
movzx ecx, cl
xor edx, ecx
shr eax, 8
mov cl, byte [esi]
inc esi
xor eax, dword [edx*4 + 0x100f0708]
test cl, cl
jne 0x10058722
pop edi
pop esi
not eax
pop ebx
ret 4

Function at 0x10058830
Capabilities:
Read file on windows

Disassembly:
push ebx
push ebp
mov ebp, dword [esp + 0xc]
push esi
push edi
test ebp, ebp
je 0x10058843
mov dword [ebp], 0
call fcn.10058760
mov esi, eax
test esi, esi
je 0x10058942
push esi
call fcn.100bf79c
mov ebx, eax
add esp, 4
cmp ebx, 0xffffffff
je 0x10058939
push 2
push 0
push esi
call fcn.100bc4b2
add esp, 0xc
test eax, eax
jne 0x10058939
push esi
call fcn.100bf79c
mov edi, eax
add esp, 4
cmp edi, 0xffffffff
je 0x10058939
push 0
push ebx
push esi
call fcn.100bc4b2
add esp, 0xc
test eax, eax
jne 0x10058939
mov eax, dword [0x101023d4]
test eax, eax
je 0x100588b2
inc dword [eax + 0x370]
mov ecx, dword [esp + 0x18]
mov edx, dword [0x101023cc]
lea ecx, [edi + ecx]
call fcn.10057c80
mov ebx, eax
test ebx, ebx
je 0x10058939
push esi
push edi
push 1
push ebx
call fcn.100bc121
add esp, 0x10
cmp eax, edi
je 0x10058909
push esi
call fcn.100b919b
mov eax, dword [0x101023d4]
add esp, 4
test eax, eax
je 0x100588f3
dec dword [eax + 0x370]
mov edx, dword [0x101023cc]
mov ecx, ebx
call fcn.10057c90
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
ret 8
mov eax, dword [esp + 0x18]
test eax, eax
jle 0x10058920
push eax
lea eax, [edi + ebx]
push 0
push eax
call fcn.100b2720
add esp, 0xc
push esi
call fcn.100b919b
add esp, 4
test ebp, ebp
je 0x10058930
mov dword [ebp], edi
mov eax, ebx
pop edi
pop esi
pop ebp
pop ebx
ret 8
push esi
call fcn.100b919b
add esp, 4
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
ret 8
Function at 0x1005af40
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
mov edx, dword [ecx + 0xc4]
mov eax, dword [ecx + 0xcc]
push esi
push edi
lea esi, [esp + 0xc]
mov edi, 4
mov eax, dword [eax + edx*4 - 4]
not eax
nop dword [eax]
movzx ecx, byte [esi]
lea esi, [esi + 1]
movzx edx, al
xor edx, ecx
shr eax, 8
xor eax, dword [edx*4 + 0x100f0708]
sub edi, 1
jne 0x1005af60
mov ecx, dword [0x101023d4]
not eax
pop edi
pop esi
cmp dword [ecx + 0x1aa4], eax
jne 0x1005af92
mov dword [ecx + 0x1aa8], eax
cmp dword [ecx + 0x1adc], eax
jne 0x1005afa1
mov byte [ecx + 0x1ae0], 1
ret 4

Function at 0x1005afb0
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
sub esp, 0x10
mov edx, dword [esp + 0x14]
push esi
mov esi, ecx
push edi
movss xmm0, dword [edx]
mov edi, 0x10
subss xmm0, dword [esi + 0xc]
mov ecx, dword [esi + 0xc4]
cvttss2si eax, xmm0
movss xmm0, dword [edx + 4]
subss xmm0, dword [esi + 0x10]
mov dword [esp + 8], eax
cvttss2si eax, xmm0
movss xmm0, dword [edx + 8]
subss xmm0, dword [esi + 0xc]
mov dword [esp + 0xc], eax
cvttss2si eax, xmm0
movss xmm0, dword [edx + 0xc]
subss xmm0, dword [esi + 0x10]
mov dword [esp + 0x10], eax
cvttss2si eax, xmm0
mov dword [esp + 0x14], eax
mov eax, dword [esi + 0xcc]
lea esi, [esp + 8]
mov edx, dword [eax + ecx*4 - 4]
not edx
nop dword [eax]
movzx eax, byte [esi]
lea esi, [esi + 1]
movzx ecx, dl
xor ecx, eax
shr edx, 8
xor edx, dword [ecx*4 + 0x100f0708]
sub edi, 1
jne 0x1005b020
mov eax, dword [0x101023d4]
not edx
pop edi
pop esi
cmp dword [eax + 0x1aa4], edx
jne 0x1005b051
mov dword [eax + 0x1aa8], edx
cmp dword [eax + 0x1adc], edx
jne 0x1005b060
mov byte [eax + 0x1ae0], 1
mov eax, edx
add esp, 0x10
ret 4
Function at 0x1005efa0
Capabilities:
Hash data with crc32

Disassembly:
mov eax, ecx
or ecx, 0xffffffff
push ebx
push esi
mov bl, byte [eax]
lea esi, [eax + 1]
test bl, bl
je 0x1005efdd
push edi
or edi, 0xffffffff
cmp bl, 0x23
jne 0x1005efc3
cmp byte [esi], bl
jne 0x1005efc3
cmp byte [esi + 1], bl
cmove ecx, edi
movzx edx, cl
movzx eax, bl
mov bl, byte [esi]
xor edx, eax
shr ecx, 8
inc esi
xor ecx, dword [edx*4 + 0x100f0708]
test bl, bl
jne 0x1005efb4
pop edi
pop esi
not ecx
pop ebx
jmp fcn.1005ef40
Function at 0x10063d10
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ecx
mov eax, dword [0x101023d4]
lea edx, [esp]
push ebx
push ebp
push esi
push edi
mov edi, dword [eax + 0x1a6c]
mov esi, 4
mov eax, dword [edi + 0xcc]
add edi, 0xc4
mov dword [esp + 0x10], ecx
mov ebp, dword [edi]
mov ebx, dword [eax + ebp*4 - 4]
not ebx
movzx eax, byte [edx]
lea edx, [edx + 1]
movzx ecx, bl
xor ecx, eax
shr ebx, 8
xor ebx, dword [ecx*4 + 0x100f0708]
sub esi, 1
jne 0x10063d40
mov ecx, dword [edi + 4]
not ebx
cmp ebp, ecx
jne 0x10063d87
inc ebp
test ecx, ecx
je 0x10063d73
mov eax, ecx
cdq
sub eax, edx
sar eax, 1
add eax, ecx
jmp 0x10063d78
mov eax, 8
cmp eax, ebp
mov ecx, edi
cmovg ebp, eax
push ebp
call fcn.10039ad0
mov ebp, dword [edi]
mov eax, dword [edi + 8]
mov dword [eax + ebp*4], ebx
inc dword [edi]
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
Function at 0x10068a10
Capabilities:
Hash data with crc32

Disassembly:
sub esp, 0xc
mov edx, dword [0x101023d4]
mov eax, ecx
push ebx
push ebp
push esi
push edi
mov edi, edx
mov dword [esp + 0x14], eax
xor esi, esi
mov ebp, dword [edi + 0x1a6c]
test al, 0x10
jne 0x10068b62
mov ebx, dword [ebp + 0x114]
test ebx, ebx
je 0x10068a4b
cmp dword [edi + 0x1aa4], ebx
jne 0x10068b58
cmp byte [edi + 0xec], 0
je 0x10068b58
test ebx, ebx
jne 0x10068ae7
test al, 8
je 0x10068b58
test byte [ebp + 0x118], 1
jne 0x10068a89
cmp dword [edi + 0x1aa4], esi
je 0x10068b58
cmp dword [edi + 0x1ad0], ebp
jne 0x10068b58
lea esi, [ebp + 0x11c]
mov ecx, ebp
push esi
call fcn.1005afb0
mov ebx, eax
mov ecx, esi
mov edx, ebx
mov dword [ebp + 0x114], ebx
call fcn.1005b310
mov cl, al
mov byte [esp + 0x13], cl
test cl, cl
je 0x10068acf
cmp byte [edi + 0x3d8], 0
je 0x10068acf
mov edx, ebp
mov ecx, ebx
call fcn.1005b0e0
mov ecx, ebp
call fcn.10063560
mov cl, byte [esp + 0x13]
mov eax, dword [edi + 0x1aa4]
cmp eax, ebx
jne 0x10068adf
mov byte [edi + 0x1ab1], cl
mov edx, dword [0x101023d4]
jmp 0x10068af4
mov eax, dword [edi + 0x1aa4]
mov byte [edi + 0x1ab1], 0
cmp eax, ebx
jne 0x10068b58
cmp byte [edx + 0xec], 0
mov ecx, dword [ebp + 0xc4]
mov eax, dword [ebp + 0xcc]
mov esi, dword [eax + ecx*4 - 4]
jne 0x10068b15
xor al, al
jmp 0x10068b2c
movss xmm1, dword [edx + 0x30]
movss xmm0, dword [edx + 0x444]
mulss xmm1, xmm1
comiss xmm0, xmm1
setae al
mov dword [edi + 0x1ab8], 0xffffffff
mov dword [edi + 0x1abc], 0xffffffff
mov dword [edi + 0x1ac0], 0xffffffff
mov dword [edi + 0x1ac4], 0xffffffff
test al, al
jne 0x10068b9c
xor al, al
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret
xor ebp, ebp
or ebx, 0xffffffff
mov edx, 0x100f04fd
mov al, 0x23
or esi, 0xffffffff
cmp al, 0x23
jne 0x10068b7f
cmp byte [edx], al
jne 0x10068b7f
cmp byte [edx + 1], al
cmove ebx, esi
movzx ecx, bl
movzx eax, al
xor ecx, eax
shr ebx, 8
mov al, byte [edx]
inc edx
xor ebx, dword [ecx*4 + 0x100f0708]
test al, al
jne 0x10068b71
not ebx
mov esi, ebp
cmp byte [edi + 0x1e64], 0
jne 0x10068be0
call fcn.10068930
mov eax, dword [esp + 0x14]
mov dword [edi + 0x1e7c], ebx
mov dword [edi + 0x1e80], esi
mov byte [edi + 0x1e64], 1
mov dword [edi + 0x1e68], eax
mov dword [edi + 0x1e70], 0
cmp ebx, dword [edi + 0x1aa4]
jne 0x10068be0
mov byte [edi + 0x1ab2], 1
mov ebx, dword [esp + 0x14]
mov eax, dword [edi + 0x1a10]
mov dword [edi + 0x1e6c], eax
mov byte [edi + 0x1e65], 1
test bl, 1
jne 0x10068c31
xor edx, edx
xor ecx, ecx
call fcn.10064d00
cmp dword [edi + 0x1ecc], 0
je 0x10068c31
test dword [edi + 0x1ec0], 0x1000
je 0x10068c31
mov eax, dword [edi + 0x1a6c]
mov byte [eax + 0x87], 1
mov dword [eax + 0xa0], 1
test bl, 0x12
jne 0x10068c3d
and dword [ebp + 0x118], 0xfffffffe
pop edi
pop esi
pop ebp
mov al, 1
pop ebx
add esp, 0xc
ret
Function at 0x10068fc0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push esi
mov esi, dword [0x101023d4]
push edi
cmp byte [esi + 0x2efc], 0
je 0x1006905e
cmp dword [esi + 0x2f04], 0
lea edi, [esi + 0x2f08]
je 0x10069050
mov ecx, dword [edi + 4]
test ecx, ecx
jns 0x10069009
mov eax, ecx
cdq
sub eax, edx
sar eax, 1
add eax, ecx
xor ecx, ecx
test eax, eax
cmovg ecx, eax
push ecx
mov ecx, edi
call fcn.1003d5d0
lea eax, [ebp + 0xc]
mov dword [edi], 0
push eax
push dword [ebp + 8]
mov ecx, edi
call fcn.10059000
mov edx, dword [edi]
mov ecx, 0x101023d0
push dword [esi + 0x2f04]
lea eax, [edx - 1]
neg edx
sbb edx, edx
and edx, eax
mov eax, dword [esi + 0x2f10]
test eax, eax
push edx
cmovne ecx, eax
push 1
push ecx
call fcn.100ba4c6
add esp, 0x10
pop edi
pop esi
mov esp, ebp
pop ebp
ret
lea eax, [ebp + 0xc]
mov ecx, edi
push eax
push dword [ebp + 8]
call fcn.10059000
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x1006d020
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x2c
push ebx
mov ebx, ecx
mov dword [esp + 8], 0xffffffff
push ebp
push esi
mov eax, edx
mov dword [esp + 0xc], ebx
movq xmm0, qword [ebx + 0x70]
mov esi, dword [ebx + 0x78]
movq qword [esp + 0x20], xmm0
mov dword [esp + 0x14], eax
push edi
mov edi, dword [esp + 0x24]
test esi, esi
js 0x1006d191
xor edx, edx
test esi, esi
jle 0x1006d193
mov cl, byte [edi]
mov edx, 1
test cl, cl
je 0x1006d193
cmp cl, 3
jne 0x1006d116
cmp edx, esi
jl 0x1006d07f
xor al, al
jmp 0x1006d083
mov al, byte [edi + edx]
inc edx
movzx ecx, al
cmp edx, esi
jl 0x1006d08e
xor al, al
jmp 0x1006d092
mov al, byte [edi + edx]
inc edx
shl ecx, 8
movzx eax, al
or ecx, eax
mov dword [esp + 0x1c], ecx
cmp edx, esi
jl 0x1006d0a6
xor al, al
jmp 0x1006d0aa
mov al, byte [edi + edx]
inc edx
movzx ebp, al
cmp edx, esi
jl 0x1006d0b5
xor al, al
jmp 0x1006d0b9
mov al, byte [edi + edx]
inc edx
shl ebp, 8
xor ebx, ebx
movzx eax, al
or ebp, eax
test ecx, ecx
je 0x1006d112
cmp edx, esi
jl 0x1006d0cf
xor al, al
jmp 0x1006d0d3
mov al, byte [edi + edx]
inc edx
movzx eax, al
mov dword [esp + 0x20], eax
cmp edx, esi
jl 0x1006d0e2
xor al, al
jmp 0x1006d0e6
mov al, byte [edi + edx]
inc edx
movzx eax, al
cmp edx, esi
jl 0x1006d0f1
xor cl, cl
jmp 0x1006d0f5
mov cl, byte [edi + edx]
inc edx
shl eax, 8
movzx ecx, cl
or eax, ecx
mov ecx, dword [esp + 0x18]
cmp ecx, ebp
jl 0x1006d109
cmp ecx, eax
jl 0x1006d187
inc ebx
mov ebp, eax
cmp ebx, dword [esp + 0x1c]
jl 0x1006d0c7
mov ebx, dword [esp + 0x10]
movq xmm0, qword [ebx + 0x64]
sub esp, 0xc
mov eax, dword [ebx + 0x6c]
mov edx, esp
mov ecx, dword [esp + 0x20]
movq qword [edx], xmm0
mov dword [edx + 8], eax
lea eax, [esp + 0x30]
push eax
call fcn.1006b840
sub esp, 0xc
mov ecx, esp
sub esp, 0xc
movq xmm0, qword [eax]
mov eax, dword [eax + 8]
movq qword [ecx], xmm0
movq xmm0, qword [ebx + 0x34]
mov dword [ecx + 8], eax
mov ecx, esp
mov eax, dword [ebx + 0x3c]
movq qword [ecx], xmm0
mov dword [ecx + 8], eax
lea eax, [esp + 0x48]
push eax
call fcn.1006b9e0
mov edx, dword [esp + 0x40]
pop edi
pop esi
movq xmm0, qword [eax]
mov ecx, dword [eax + 8]
mov eax, edx
pop ebp
movq qword [edx], xmm0
mov dword [edx + 8], ecx
pop ebx
add esp, 0x2c
ret 4
mov eax, dword [esp + 0x20]
mov dword [esp + 0x14], eax
jmp 0x1006d112
mov edx, esi
add eax, edx
cmp eax, esi
jg 0x1006d1b0
test eax, eax
js 0x1006d1b0
cmp eax, esi
jge 0x1006d1b0
mov al, byte [edi + eax]
movzx eax, al
mov dword [esp + 0x14], eax
jmp 0x1006d116
xor al, al
movzx eax, al
mov dword [esp + 0x14], eax
jmp 0x1006d116
Function at 0x10072830
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push esi
mov esi, ecx
mov ecx, dword [esi + 8]
test ecx, ecx
je 0x10072868
mov eax, dword [0x101023d4]
mov dword [esi + 4], 0
mov dword [esi], 0
test eax, eax
je 0x10072856
dec dword [eax + 0x370]
mov edx, dword [0x101023cc]
call fcn.10057c90
mov dword [esi + 8], 0
mov ecx, dword [esi + 0x14]
test ecx, ecx
je 0x1007289e
mov eax, dword [0x101023d4]
mov dword [esi + 0x10], 0
mov dword [esi + 0xc], 0
test eax, eax
je 0x1007288c
dec dword [eax + 0x370]
mov edx, dword [0x101023cc]
call fcn.10057c90
mov dword [esi + 0x14], 0
mov ecx, dword [esi + 0x20]
test ecx, ecx
je 0x100728d4
mov eax, dword [0x101023d4]
mov dword [esi + 0x1c], 0
mov dword [esi + 0x18], 0
test eax, eax
je 0x100728c2
dec dword [eax + 0x370]
mov edx, dword [0x101023cc]
call fcn.10057c90
mov dword [esi + 0x20], 0
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x34], 0
mov dword [esi + 0x38], 0
mov ecx, dword [esi + 0x44]
test ecx, ecx
je 0x10072926
mov eax, dword [0x101023d4]
mov dword [esi + 0x40], 0
mov dword [esi + 0x3c], 0
test eax, eax
je 0x10072914
dec dword [eax + 0x370]
mov edx, dword [0x101023cc]
call fcn.10057c90
mov dword [esi + 0x44], 0
mov ecx, dword [esi + 0x50]
test ecx, ecx
je 0x1007295c
mov eax, dword [0x101023d4]
mov dword [esi + 0x4c], 0
mov dword [esi + 0x48], 0
test eax, eax
je 0x1007294a
dec dword [eax + 0x370]
mov edx, dword [0x101023cc]
call fcn.10057c90
mov dword [esi + 0x50], 0
mov ecx, dword [esi + 0x5c]
test ecx, ecx
je 0x10072992
mov eax, dword [0x101023d4]
mov dword [esi + 0x58], 0
mov dword [esi + 0x54], 0
test eax, eax
je 0x10072980
dec dword [eax + 0x370]
mov edx, dword [0x101023cc]
call fcn.10057c90
mov dword [esi + 0x5c], 0
lea ecx, [esi + 0x78]
pop esi
jmp fcn.10075060
Function at 0x10075f60
Capabilities:
Enumerate pe sections

Disassembly:
sub esp, 0xfc
push ebx
push ebp
push esi
mov esi, dword [esp + 0x10c]
push edi
movss dword [esp + 0x10], xmm3
mov dword [esp + 0x14], ecx
movzx ebx, byte [esi + 8]
movzx eax, byte [esi + 9]
shl ebx, 8
add ebx, eax
movzx eax, byte [esi + 0xa]
shl ebx, 8
add ebx, eax
movzx eax, byte [esi + 0xb]
shl ebx, 8
add ebx, eax
mov eax, dword [0x101023d4]
test eax, eax
je 0x10075fa9
inc dword [eax + 0x370]
mov edx, dword [0x101023cc]
mov ecx, ebx
call fcn.10057c80
movzx edx, byte [esi]
mov ebp, eax
movzx ecx, byte [esi + 1]
shl edx, 8
add edx, ecx
movzx ecx, byte [esi + 2]
shl edx, 8
add edx, ecx
movzx ecx, byte [esi + 3]
shl edx, 8
add edx, ecx
cmp edx, 0x57bc0000
jne 0x1007605b
movzx ecx, byte [esi + 4]
movzx eax, byte [esi + 5]
shl ecx, 8
add ecx, eax
movzx eax, byte [esi + 6]
shl ecx, 8
add ecx, eax
movzx eax, byte [esi + 7]
shl ecx, 8
add ecx, eax
jne 0x1007605b
movzx edi, byte [esi + 8]
movzx eax, byte [esi + 9]
shl edi, 8
add edi, eax
mov dword [0x10105170], esi
movzx eax, byte [esi + 0xa]
shl edi, 8
add edi, eax
mov dword [0x10105178], ebp
movzx eax, byte [esi + 0xb]
add esi, 0x10
shl edi, 8
mov ecx, esi
add edi, eax
mov dword [0x1010517c], ebp
add edi, ebp
mov dword [0x10105174], edi
call fcn.10079e90
cmp eax, esi
je 0x1007605b
cmp dword [0x1010517c], edi
ja 0x1007605b
mov ecx, eax
mov esi, eax
call fcn.10079e90
cmp eax, esi
jne 0x10076046
mov esi, dword [esp + 0x118]
test esi, esi
je 0x10076077
mov ecx, 0x1e
lea edi, [esp + 0x18]
rep movsd dword es:[edi], dword [esi]
lea eax, [esp + 0x18]
jmp 0x10076080
lea ecx, [esp + 0x18]
call fcn.10075860
movss xmm0, dword [esp + 0x10]
lea edi, [esp + 0x90]
mov esi, eax
mov ecx, 0x1e
mov eax, dword [esp + 0x11c]
test eax, eax
rep movsd dword es:[edi], dword [esi]
mov ecx, 0x1e
mov byte [esp + 0x98], 1
lea esi, [esp + 0x90]
lea edi, [esp + 0x18]
rep movsd dword es:[edi], dword [esi]
mov ecx, dword [esp + 0x48]
cmovne ecx, eax
mov dword [esp + 0x18], ebp
lea eax, [esp + 0x18]
mov dword [esp + 0x48], ecx
mov ecx, dword [esp + 0x14]
push eax
mov dword [esp + 0x20], ebx
movss dword [esp + 0x2c], xmm0
call fcn.10075c80
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xfc
ret 0x10
Function at 0x1007add0
Capabilities:
Log keystrokes via polling

Disassembly:
sub esp, 0x30
push ebx
mov ebx, dword [0x101023d4]
lea eax, [esp + 0x20]
push esi
push edi
push eax
push dword [0x10104b20]
call dword [sym.imp.USER32.dll_GetClientRect]
mov eax, dword [esp + 0x30]
sub eax, dword [esp + 0x28]
movd xmm1, eax
mov eax, dword [esp + 0x34]
sub eax, dword [esp + 0x2c]
cvtdq2ps xmm1, xmm1
movd xmm0, eax
lea eax, [esp + 0x20]
cvtdq2ps xmm0, xmm0
push eax
movss dword [ebx + 0x10], xmm1
movss dword [ebx + 0x14], xmm0
call dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov edi, dword [esp + 0x20]
mov ecx, edi
sub ecx, dword [0x10104b18]
mov esi, dword [esp + 0x24]
mov edx, esi
sbb edx, dword [0x10104b1c]
call fcn.100d6470
mov edx, dword [0x10104b14]
mov ecx, dword [0x10104b10]
cvtsd2ss xmm0, xmm0
movss dword [esp + 0x10], xmm0
call fcn.100d6470
movss xmm1, dword [esp + 0x10]
cvtsd2ss xmm0, xmm0
push 0x11
divss xmm1, xmm0
movss dword [ebx + 0x18], xmm1
mov dword [0x10104b1c], esi
mov esi, dword [sym.imp.USER32.dll_GetKeyState]
mov dword [0x10104b18], edi
call esi
shr eax, 0xf
and al, 1
push 0x10
mov byte [ebx + 0xfc], al
call esi
shr eax, 0xf
and al, 1
push 0x12
mov byte [ebx + 0xfd], al
call esi
shr eax, 0xf
and al, 1
mov byte [ebx + 0xff], 0
push 0xa0
mov byte [ebx + 0xfe], al
call esi
shr eax, 0xf
and al, 1
push 0xa1
mov byte [ebx + 0x1a0], al
call esi
mov esi, dword [0x101023d4]
shr eax, 0xf
and al, 1
mov byte [ebx + 0x1a1], al
cmp byte [esi + 0x357], 0
je 0x1007af1b
cvttss2si eax, dword [esi + 0xe4]
mov dword [esp + 0x10], eax
cvttss2si eax, dword [esi + 0xe8]
mov dword [esp + 0x14], eax
lea eax, [esp + 0x10]
push eax
push dword [0x10104b20]
call dword [sym.imp.USER32.dll_ClientToScreen]
push dword [esp + 0x14]
push dword [esp + 0x14]
call dword [sym.imp.USER32.dll_SetCursorPos]
mov dword [esi + 0xe4], 0xff7fffff
mov dword [esi + 0xe8], 0xff7fffff
call dword [sym.imp.USER32.dll_GetForegroundWindow]
test eax, eax
je 0x1007af95
mov ecx, dword [0x10104b20]
cmp eax, ecx
je 0x1007af4f
push ecx
push eax
call dword [sym.imp.USER32.dll_IsChild]
test eax, eax
je 0x1007af95
lea eax, [esp + 0x18]
push eax
call dword [sym.imp.USER32.dll_GetCursorPos]
test eax, eax
je 0x1007af95
lea eax, [esp + 0x18]
push eax
push dword [0x10104b20]
call dword [sym.imp.USER32.dll_ScreenToClient]
test eax, eax
je 0x1007af95
movd xmm0, dword [esp + 0x18]
movd xmm1, dword [esp + 0x1c]
cvtdq2ps xmm0, xmm0
cvtdq2ps xmm1, xmm1
movss dword [esi + 0xe4], xmm0
movss dword [esi + 0xe8], xmm1
cmp byte [ebx + 0xb0], 0
je 0x1007afa3
or eax, 0xffffffff
jmp 0x1007afae
mov eax, dword [0x101023d4]
mov eax, dword [eax + 0x1e60]
cmp dword [0x100ffbf4], eax
je 0x1007afc0
mov dword [0x100ffbf4], eax
call fcn.1007aca0
pop edi
pop esi
pop ebx
add esp, 0x30
ret
Function at 0x1008e240
Capabilities:
Hash data with crc32

Disassembly:
test dword [ecx + 0xc], 0x100000
push esi
push edi
mov edi, edx
je 0x1008e2b0
mov cl, byte [edi]
lea esi, [edi + 1]
or eax, 0xffffffff
test cl, cl
je 0x1008e288
or edi, 0xffffffff
nop dword [eax]
cmp cl, 0x23
jne 0x1008e26f
cmp byte [esi], cl
jne 0x1008e26f
cmp byte [esi + 1], cl
cmove eax, edi
movzx edx, al
movzx ecx, cl
xor edx, ecx
shr eax, 8
mov cl, byte [esi]
inc esi
xor eax, dword [edx*4 + 0x100f0708]
test cl, cl
jne 0x1008e260
mov ecx, dword [0x101023d4]
not eax
cmp dword [ecx + 0x1aa4], eax
jne 0x1008e29e
mov dword [ecx + 0x1aa8], eax
cmp dword [ecx + 0x1adc], eax
jne 0x1008e2f2
pop edi
mov byte [ecx + 0x1ae0], 1
pop esi
ret
mov esi, dword [0x101023d4]
xor edx, edx
mov eax, dword [esi + 0x1a6c]
mov ecx, dword [eax + 0xc4]
mov eax, dword [eax + 0xcc]
push dword [eax + ecx*4 - 4]
mov ecx, edi
call fcn.100586d0
cmp dword [esi + 0x1aa4], eax
jne 0x1008e2e3
mov dword [esi + 0x1aa8], eax
cmp dword [esi + 0x1adc], eax
jne 0x1008e2f2
mov byte [esi + 0x1ae0], 1
pop edi
pop esi
ret
Function at 0x1009c16a
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateThread]
pop ebp
ret

Function at 0x100c5146
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.100c4fbc