joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40216b
Capabilities:
Accept command line arguments
Parse pe header

Disassembly:
call main
jmp 0x402175
push 0x14
push 0x411788
call fcn.00405300
call main
movzx esi, ax
push 2
call main
pop ecx
mov eax, 0x5a4d
cmp word [0x400000], ax
je 0x4021a3
xor ebx, ebx
jmp 0x4021d6
mov eax, dword [0x40003c]
cmp dword [eax + 0x400000], 0x4550
jne 0x40219f
mov ecx, 0x10b
cmp word [eax + 0x400018], cx
jne 0x40219f
xor ebx, ebx
cmp dword [eax + 0x400074], 0xe
jbe 0x4021d6
cmp dword [eax + 0x4000e8], ebx
setne bl
mov dword [ebp - 0x1c], ebx
call fcn.004048ef
test eax, eax
jne 0x4021ea
push 0x1c
call main
pop ecx
call fcn.00403b58
test eax, eax
jne 0x4021fb
push 0x10
call main
pop ecx
call fcn.004051cc
and dword [ebp - 4], 0
call fcn.00404904
test eax, eax
jns 0x402215
push 0x1b
call main
pop ecx
call dword [sym.imp.kernel32.dll_GetCommandLineA]
mov dword [0x4162e8], eax
call main
mov dword [0x414430], eax
call main
test eax, eax
jns 0x40223b
push 8
call main
pop ecx
call fcn.00404de7
test eax, eax
jns 0x40224c
push 9
call main
pop ecx
push 1
call main
pop ecx
test eax, eax
je 0x40225f
push eax
call main
pop ecx
call fcn.00405299
push esi
push eax
push 0
push 0x400000
call main
mov esi, eax
mov dword [ebp - 0x24], esi
test ebx, ebx
jne 0x402281
push esi
call main
call fcn.00404663
jmp 0x4022b6
mov dword [ebp - 4], 0xfffffffe
mov eax, esi
call fcn.00405345
ret

Function at 0x40af3c
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
pushal
call 0x40af4b
pop dword [ebp - 0x34]
mov eax, 0x21d349e1
add eax, 0xde6d656a
sub dword [ebp - 0x34], eax
mov dword [ebp - 0x44], 0x69284131
sub dword [ebp - 0x44], 0x1ad5fbe6
mov dword [ebp - 0x40], 0x75d3d74c
sub dword [ebp - 0x40], 0x43a08b07
mov dword [ebp - 0x3c], 0xe6984bcf
add dword [ebp - 0x3c], 0x65b3f85f
mov dword [ebp - 0x38], 0xf21816e0
add dword [ebp - 0x38], 0xde7e920
lea eax, [ebp - 0x44]
push eax
mov eax, 0x3ff03f7c
add eax, 0xc05090b8
add eax, dword [ebp - 0x34]
call dword [eax]
mov dword [ebp - 0x44], 0x6e5dfdbc
add dword [ebp - 0x44], 0x6146b9a
mov dword [ebp - 0x40], 0xb8eb2623
add dword [ebp - 0x40], 0x88813b52
mov dword [ebp - 0x3c], 0x460300e0
sub dword [ebp - 0x3c], 0xe2939474
mov dword [ebp - 0x38], 0x9fcff716
add dword [ebp - 0x38], 0x603008ea
lea ebx, [ebp - 0x44]
push ebx
push eax
mov eax, 0xe0a79155
add eax, 0x1f993edb
add eax, dword [ebp - 0x34]
call dword [eax]
push 0x40
push 0x1000
push 0x373c1
push 0
call eax
mov ecx, 0x3fc1
xor edx, edx
add edx, eax
mov esi, 0xd49e7e3a
sub esi, 0xd45c6e3a
add esi, dword [ebp - 0x34]
mov ebx, 0xb0db1281
sub dword [ebp - 4], 0xcace5e6f
mov edi, dword [esi]
xor dword [ebp - 0x28], 0x73ba28eb
xor edi, ebx
sub dword [ebp - 0x10], 0xa507b9a8
mov dword [edx], edi
xor dword [ebp - 0x14], 0xd82067
add edx, 4
add esi, 4
loop 0x40b063
add eax, 0xf7e4dfbe
add eax, 0x81c1219
mov ebx, eax
add eax, 0x83c5311b
add eax, 0x7c3aceea
mov ecx, 0x400000
add ecx, dword [ebp - 0x34]
call ebx
leave
ret
Function at 0x4015e2
Capabilities:
Check if file exists
Check mutex on windows
Enumerate files on windows
Get common file path
Initialize winsock library

Disassembly:
push ebx
push ecx
push edx
push esi
push edi
enter 0x78c, 0
sub ebp, 0x82
lea eax, [ebp - 0x70a]
push eax
push 0x104
call dword [sym.imp.KERNEL32.DLL_GetTempPathW]
mov dword [ebp + 0x72], 6
xor eax, eax
push 0x7f00
mov dword [ebp + 0x56], eax
mov dword [ebp + 0x5a], eax
mov dword [ebp + 0x66], eax
push eax
mov dword [ebp + 0x7a], eax
mov dword [ebp + 0x76], eax
call dword [sym.imp.USER32.DLL_LoadCursorW]
push 0
push 0
mov dword [ebp + 0x6e], eax
call dword [sym.imp.USER32.DLL_FindWindowA]
mov ebx, eax
lea eax, [ebp - 0x372]
push eax
push 0
call dword [sym.imp.KERNEL32.DLL_FindFirstFileA]
push 0x104
mov esi, eax
lea eax, [ebp - 0x232]
push eax
push 0
call dword [sym.imp.KERNEL32.DLL_GetModuleFileNameA]
push 0
push 0
push 3
push 0
push 0
push 0x80000000
lea eax, [ebp - 0x70a]
push eax
call dword [sym.imp.KERNEL32.DLL_CreateFileW]
mov edi, eax
call dword [sym.imp.KERNEL32.DLL_GetLastError]
mov dword [ebp + 0x7e], eax
lea eax, [ebp - 0x372]
push eax
push esi
call dword [sym.imp.KERNEL32.DLL_FindNextFileA]
push edi
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
push ebx
call dword [sym.imp.USER32.DLL_GetDC]
mov edi, eax
lea eax, [ebp - 0x2a]
push eax
push eax
mov byte [ebp - 0x2a], 0
call dword [sym.imp.SHLWAPI.DLL_PathAddExtensionA]
push edi
push ebx
call dword [sym.imp.USER32.DLL_ReleaseDC]
push esi
call dword [sym.imp.KERNEL32.DLL_FindClose]
lea eax, [ebp - 0x502]
push eax
push 2
call dword [sym.imp.WS2_32.DLL_WSAStartup]
push 0x104
lea eax, [ebp - 0x12e]
push eax
push 0
call dword [sym.imp.KERNEL32.DLL_GetModuleFileNameA]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.DLL_CreateMutexW]
push 0
call dword [sym.imp.SHLWAPI.DLL_PathFindExtensionA]
lea eax, [ebp - 0x232]
push eax
call dword [sym.imp.SHLWAPI.DLL_PathFileExistsA]
push 0x7f00
push 0
call dword [sym.imp.USER32.DLL_LoadIconW]
mov dword [ebp + 0x6a], eax
lea eax, [ebp + 0x56]
push eax
call dword [sym.imp.USER32.DLL_RegisterClassW]
lea eax, [ebp + 0x16]
push eax
push eax
mov ebx, dword [ebp + 0x7e]
push eax
sub ebx, 3
mov byte [ebp + 0x16], 0
call dword [sym.imp.SHLWAPI.DLL_PathCombineA]
call dword [sym.imp.WS2_32.DLL_WSACleanup]
mov eax, ebx
lea esp, [ebp + 0x82]
pop ebp
jmp 0x4018eb

Function at 0x4017fc
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebx
push ecx
push edx
push esi
push edi
enter 4, 0
mov esi, eax
mov edx, dword [0x403050]
or dl, 1
imul edx, eax
mov edi, dword [0x403050]
mov ebx, eax
sub edi, edx
mov eax, 0x403054
mov edx, edi
call fcn.00401794
jmp 0x40189f
lea edx, [ebp - 4]
push edx
mov edx, esi
or dl, 0x40
mov edi, 0x402ea3
push edx
sub edi, fcn.0040266e
push edi
xor eax, eax
push fcn.0040266e
mov dword [ebp - 4], eax
call dword [sym.imp.KERNEL32.DLL_VirtualProtect]
cmp dword [ebp - 4], 0
je 0x4018ea
mov eax, fcn.0040266e
mov ebx, esi
mov edx, edi
call fcn.00401794
Function at 0x10001f70
Capabilities:
Create thread

Disassembly:
push esi
sub esp, 0x10
mov eax, dword [esp + 0x1c]
mov ecx, dword [0x1017f528]
xor ecx, esp
mov dword [esp + 0xc], ecx
xor esi, esi
cmp eax, 1
jne 0x10002062
push dword [esp + 0x18]
call dword [sym.imp.KERNEL32.dll_DisableThreadLibraryCalls]
mov dword [esp], 0
lea esi, [esp + 4]
mov dword [esp + 4], 0
push 0x14
call fcn.100d7f9d
add esp, 4
vmovsd xmm0, qword [0x10128140]
vmovsd qword [eax], xmm0
mov dword [eax + 8], 0
mov dword [eax + 0xc], 0
mov dword [eax + 0x10], 0
mov dword [esp + 8], eax
push 1
call fcn.100d7f9d
add esp, 4
push esi
push 0
push eax
push 0x1000af10
push 0
push 0
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
add esp, 0x18
mov dword [esp], eax
test eax, eax
je 0x10002076
mov ecx, dword [esp + 4]
test ecx, ecx
je 0x10002085
push ecx
push eax
call sub.MSVCP140.dll__Thrd_detach
add esp, 8
test eax, eax
jne 0x1000208c
mov dword [esp], 0
mov dword [esp + 4], 0
mov ecx, esp
call fcn.10007790
mov eax, dword [esp + 8]
test eax, eax
je 0x10002056
mov ecx, 0xfffffffe
lock xadd dword [eax + 4], ecx
and ecx, 0xfffffffe
cmp ecx, 2
jne 0x10002056
lock dec dword [eax]
jne 0x10002056
push eax
call fcn.100d7fcd
add esp, 4
cmp dword [esp + 4], 0
jne 0x10002092
mov esi, 1
mov ecx, dword [esp + 0xc]
xor ecx, esp
call fcn.100d7fe0
mov eax, esi
add esp, 0x10
pop esi
ret 0xc
mov dword [esp + 4], 0
push 6
call sub.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_
push 1
call sub.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_
push eax
call sub.MSVCP140.dll_void___cdecl_std::_Throw_C_error_int_
call fcn.10007940
int3

Function at 0x100026e0
Capabilities:
Parse pe header

Disassembly:
push edi
push esi
mov esi, ecx
mov eax, dword [ecx + 0x14]
cmp eax, 0x10
jb 0x10002717
mov ecx, dword [esi]
lea edi, [eax + 1]
cmp edi, 0x1000
jb 0x1000270d
mov edx, dword [ecx - 4]
add ecx, 0xfffffffc
sub ecx, edx
cmp ecx, 0x20
jae 0x1000272a
add eax, 0x24
mov edi, eax
mov ecx, edx
push edi
push ecx
call fcn.100d7fd2
add esp, 8
vmovsd xmm0, qword [0x10128100]
vmovsd qword [esi + 0x10], xmm0
mov byte [esi], 0
pop esi
pop edi
ret
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
Function at 0x1000e210
Capabilities:
Write file on windows

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x28
mov eax, dword [0x1017f528]
xor eax, esp
mov dword [esp + 0x24], eax
mov bl, 1
cmp dword [ecx + 0x38], 0
je 0x1000e291
mov esi, ecx
cmp byte [ecx + 0x3d], 0
je 0x1000e291
mov eax, dword [esi]
mov ecx, esi
push 0xffffffffffffffff
call dword [eax + 0xc]
cmp eax, 0xffffffff
je 0x1000e28f
mov ecx, dword [esi + 0x38]
lea eax, [esp + 0x24]
lea edx, [esi + 0x40]
mov ebx, dword [ecx]
mov ebp, esp
lea edi, [esp + 4]
push ebp
push eax
push edi
push edx
call dword [ebx + 0x20]
cmp eax, 3
je 0x1000e2a6
cmp eax, 1
je 0x1000e26b
test eax, eax
jne 0x1000e28f
mov byte [esi + 0x3d], 0
mov ebx, dword [esp]
sub ebx, edi
je 0x1000e286
push dword [esi + 0x4c]
push ebx
push 1
push edi
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
add esp, 0x10
cmp ebx, eax
jne 0x1000e28f
cmp byte [esi + 0x3d], 0
sete bl
jmp 0x1000e291
xor ebx, ebx
mov ecx, dword [esp + 0x24]
xor ecx, esp
call fcn.100d7fe0
mov eax, ebx
add esp, 0x28
pop esi
pop edi
pop ebx
pop ebp
ret
mov byte [esi + 0x3d], 0
mov bl, 1
jmp 0x1000e291
Function at 0x1001cca0
Capabilities:
Hash data with crc32

Disassembly:
push ebx
push edi
push esi
mov esi, dword [esp + 0x14]
mov edx, dword [esp + 0x10]
mov edi, dword [esp + 0x18]
not edi
test esi, esi
je 0x1001ccf5
dec esi
add edx, 2
mov ebx, edi
jmp 0x1001ccd9
mov eax, ebx
shr eax, 8
movzx ebx, bl
xor ebx, ecx
xor eax, dword [ebx*4 + 0x10128e2c]
inc edx
mov ebx, eax
add esi, 0xffffffff
jae 0x1001cd46
movzx ecx, byte [edx - 2]
cmp ecx, 0x23
jne 0x1001ccc0
cmp esi, 2
jb 0x1001ccc0
cmp byte [edx - 1], 0x23
jne 0x1001ccc0
cmp byte [edx], 0x23
cmove ebx, edi
jmp 0x1001ccc0
movzx ebx, byte [edx]
test bl, bl
je 0x1001cd44
add edx, 2
mov ecx, edi
jmp 0x1001cd2d
movzx esi, bl
mov eax, ecx
shr eax, 8
movzx ecx, cl
xor ecx, esi
xor eax, dword [ecx*4 + 0x10128e2c]
inc edx
mov bl, bh
mov ecx, eax
test bh, bh
je 0x1001cd46
mov bh, byte [edx - 1]
cmp bl, 0x23
jne 0x1001cd10
cmp bh, 0x23
jne 0x1001cd10
cmp byte [edx], 0x23
cmove ecx, edi
mov bh, 0x23
jmp 0x1001cd10
mov eax, edi
not eax
pop esi
pop edi
pop ebx
ret

Function at 0x1001ce20
Capabilities:
Read file on windows

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 8
mov ebx, dword [esp + 0x24]
mov ecx, dword [esp + 0x20]
mov eax, dword [esp + 0x1c]
test ebx, ebx
je 0x1001ce3d
mov dword [ebx], 0
push ecx
push eax
call fcn.1001cd50
add esp, 8
xor esi, esi
test eax, eax
je 0x1001ce7c
mov edi, eax
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_ftell]
add esp, 4
cmp eax, 0xffffffff
je 0x1001ce72
mov ebp, eax
push 2
push 0
push edi
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fseek]
add esp, 0xc
test eax, eax
je 0x1001ce86
push edi
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
add esp, 4
mov eax, esi
add esp, 8
pop esi
pop edi
pop ebx
pop ebp
ret
push edi
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_ftell]
add esp, 4
mov dword [esp + 4], eax
cmp eax, 0xffffffff
je 0x1001ce72
push 0
push ebp
push edi
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fseek]
add esp, 0xc
test eax, eax
jne 0x1001ce72
mov ecx, dword [esp + 0x28]
mov eax, dword [esp + 4]
add eax, ecx
mov ecx, dword [0x1017f770]
test ecx, ecx
je 0x1001cec4
inc dword [ecx + 0x36c]
push dword [0x1017f778]
push eax
call dword [0x10175014]
add esp, 8
test eax, eax
je 0x1001ce72
push edi
mov ebp, dword [esp + 8]
push ebp
push 1
mov dword [esp + 0xc], eax
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
add esp, 0x10
cmp eax, ebp
jne 0x1001cf29
mov ecx, dword [esp + 0x28]
test ecx, ecx
jle 0x1001cf0d
mov eax, dword [esp]
add eax, dword [esp + 4]
push ecx
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
push edi
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
add esp, 4
test ebx, ebx
je 0x1001cf21
mov eax, dword [esp + 4]
mov dword [ebx], eax
mov esi, dword [esp]
jmp 0x1001ce7c
push edi
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
add esp, 4
mov eax, dword [0x1017f770]
test eax, eax
je 0x1001cf42
dec dword [eax + 0x36c]
push dword [0x1017f778]
push dword [esp + 4]
call dword [0x10175018]
add esp, 8
jmp 0x1001ce7c
Function at 0x1001f8d0
Capabilities:
Hash data with crc32

Disassembly:
push ebp
push ebx
push edi
push esi
mov esi, dword [esp + 0x18]
mov eax, dword [esp + 0x14]
mov edx, dword [ecx + 0xc4]
mov ecx, dword [ecx + 0xcc]
mov ebp, dword [ecx + edx*4 - 4]
not ebp
test esi, esi
je 0x1001f945
mov ecx, esi
sub ecx, eax
je 0x1001f945
mov edi, eax
not edi
add edi, esi
lea ebx, [eax + 2]
mov ecx, ebp
jmp 0x1001f929
mov esi, ecx
shr esi, 8
movzx ecx, cl
xor ecx, edx
xor esi, dword [ecx*4 + 0x10128e2c]
inc ebx
mov ecx, esi
add edi, 0xffffffff
jae 0x1001f996
movzx edx, byte [ebx - 2]
cmp edx, 0x23
jne 0x1001f910
cmp edi, 2
jb 0x1001f910
cmp byte [ebx - 1], 0x23
jne 0x1001f910
cmp byte [ebx], 0x23
cmove ecx, ebp
jmp 0x1001f910
movzx ebx, byte [eax]
test bl, bl
je 0x1001f994
lea edi, [eax + 2]
mov ecx, ebp
jmp 0x1001f97d
movzx edx, bl
mov esi, ecx
shr esi, 8
movzx ecx, cl
xor ecx, edx
xor esi, dword [ecx*4 + 0x10128e2c]
inc edi
mov bl, bh
mov ecx, esi
test bh, bh
je 0x1001f996
mov bh, byte [edi - 1]
cmp bl, 0x23
jne 0x1001f960
cmp bh, 0x23
jne 0x1001f960
cmp byte [edi], 0x23
cmove ecx, ebp
mov bh, 0x23
jmp 0x1001f960
mov esi, ebp
not esi
mov ecx, dword [0x1017f770]
cmp dword [ecx + 0x1bd0], esi
je 0x1001f9cf
cmp dword [ecx + 0x1c0c], esi
je 0x1001f9dd
cmp dword [ecx + 0x1bb8], esi
jne 0x1001f9c6
push dword [esp + 0x18]
push eax
push 0xb
push esi
call fcn.1001fa20
add esp, 0x10
mov eax, esi
pop esi
pop edi
pop ebx
pop ebp
ret 8
mov dword [ecx + 0x1bd4], esi
cmp dword [ecx + 0x1c0c], esi
jne 0x1001f9ae
mov byte [ecx + 0x1c10], 1
cmp dword [ecx + 0x1bb8], esi
je 0x1001f9b6
jmp 0x1001f9c6

Function at 0x1001fd00
Capabilities:
Hash data with crc32

Disassembly:
push ebp
push ebx
push edi
push esi
mov esi, dword [esp + 0x18]
mov eax, dword [esp + 0x14]
mov edx, dword [ecx + 0xc4]
mov ecx, dword [ecx + 0xcc]
mov ebp, dword [ecx + edx*4 - 4]
not ebp
test esi, esi
je 0x1001fd75
mov ecx, esi
sub ecx, eax
je 0x1001fd75
mov edi, eax
not edi
add edi, esi
lea ebx, [eax + 2]
mov ecx, ebp
jmp 0x1001fd59
mov esi, ecx
shr esi, 8
movzx ecx, cl
xor ecx, edx
xor esi, dword [ecx*4 + 0x10128e2c]
inc ebx
mov ecx, esi
add edi, 0xffffffff
jae 0x1001fdc6
movzx edx, byte [ebx - 2]
cmp edx, 0x23
jne 0x1001fd40
cmp edi, 2
jb 0x1001fd40
cmp byte [ebx - 1], 0x23
jne 0x1001fd40
cmp byte [ebx], 0x23
cmove ecx, ebp
jmp 0x1001fd40
movzx ebx, byte [eax]
test bl, bl
je 0x1001fdc4
lea edi, [eax + 2]
mov ecx, ebp
jmp 0x1001fdad
movzx edx, bl
mov esi, ecx
shr esi, 8
movzx ecx, cl
xor ecx, edx
xor esi, dword [ecx*4 + 0x10128e2c]
inc edi
mov bl, bh
mov ecx, esi
test bh, bh
je 0x1001fdc6
mov bh, byte [edi - 1]
cmp bl, 0x23
jne 0x1001fd90
cmp bh, 0x23
jne 0x1001fd90
cmp byte [edi], 0x23
cmove ecx, ebp
mov bh, 0x23
jmp 0x1001fd90
mov esi, ebp
not esi
mov ecx, dword [0x1017f770]
cmp dword [ecx + 0x1bb8], esi
jne 0x1001fde6
push dword [esp + 0x18]
push eax
push 0xb
push esi
call fcn.1001fa20
add esp, 0x10
mov eax, esi
pop esi
pop edi
pop ebx
pop ebp
ret 8
Function at 0x100309f0
Capabilities:
Hash data with crc32

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 8
mov edx, dword [esp + 0x1c]
mov edi, dword [0x1017f770]
mov ecx, dword [edi + 0x1b98]
mov eax, dword [ecx + 0xc4]
mov dword [esp], ecx
mov ecx, dword [ecx + 0xcc]
mov esi, dword [ecx + eax*4 - 4]
not esi
movzx ecx, byte [edx]
test cl, cl
mov dword [esp + 4], edi
je 0x10030a65
lea ebp, [edx + 2]
mov edx, esi
jmp 0x10030a4d
movzx edi, cl
mov ebx, edx
shr ebx, 8
movzx edx, dl
xor edx, edi
xor ebx, dword [edx*4 + 0x10128e2c]
inc ebp
mov cl, ch
mov edx, ebx
test ch, ch
je 0x10030a67
mov ch, byte [ebp - 1]
cmp cl, 0x23
jne 0x10030a30
cmp ch, 0x23
jne 0x10030a30
cmp byte [ebp], 0x23
cmove edx, esi
mov ch, 0x23
jmp 0x10030a30
mov ebx, esi
not ebx
mov ecx, dword [esp + 4]
cmp dword [ecx + 0x1bb8], ebx
mov esi, dword [esp]
jne 0x10030a8f
push 0
push dword [esp + 0x20]
push 0xb
push ebx
call fcn.1001fa20
add esp, 0x10
mov eax, dword [esi + 0xc4]
cmp eax, dword [esi + 0xc8]
jne 0x10030b4c
lea ebp, [eax + 1]
test eax, eax
je 0x10030aaf
mov ecx, eax
shr ecx, 0x1f
add ecx, eax
sar ecx, 1
add ecx, eax
jmp 0x10030ab4
mov ecx, 8
cmp ecx, ebp
cmovg ebp, ecx
cmp eax, ebp
jge 0x10030b4c
lea eax, [ebp*4]
mov ecx, dword [0x1017f770]
test ecx, ecx
je 0x10030ad8
inc dword [ecx + 0x36c]
push dword [0x1017f778]
push eax
call dword [0x10175014]
add esp, 8
mov esi, eax
mov edi, dword [esp]
mov eax, dword [edi + 0xcc]
test eax, eax
je 0x10030b38
mov ecx, dword [edi + 0xc4]
shl ecx, 2
push ecx
push eax
push esi
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
mov eax, dword [edi + 0xcc]
test eax, eax
je 0x10030b25
mov ecx, dword [0x1017f770]
test ecx, ecx
je 0x10030b25
dec dword [ecx + 0x36c]
push dword [0x1017f778]
push eax
call dword [0x10175018]
add esp, 8
mov edi, dword [esp]
mov dword [edi + 0xcc], esi
mov dword [edi + 0xc8], ebp
mov eax, dword [edi + 0xc4]
mov esi, edi
mov ecx, dword [esi + 0xcc]
mov dword [ecx + eax*4], ebx
inc dword [esi + 0xc4]
add esp, 8
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x10030b70
Capabilities:
Hash data with crc32

Disassembly:
push ebp
push ebx
push edi
push esi
mov ebp, dword [esp + 0x14]
mov edx, dword [0x1017f770]
mov edi, dword [edx + 0x1b98]
mov esi, ebp
shr esi, 8
mov eax, dword [edi + 0xc4]
mov ecx, dword [edi + 0xcc]
mov ecx, dword [ecx + eax*4 - 4]
not ecx
mov ebx, ecx
shr ebx, 8
xor ecx, ebp
movzx ecx, cl
xor ebx, dword [ecx*4 + 0x10128e2c]
mov ecx, ebx
xor ebx, esi
mov esi, ebp
shr esi, 0x10
shr ecx, 8
movzx ebx, bl
xor ecx, dword [ebx*4 + 0x10128e2c]
mov ebx, ecx
xor ecx, esi
mov esi, ebp
shr esi, 0x18
shr ebx, 8
movzx ecx, cl
xor ebx, dword [ecx*4 + 0x10128e2c]
movzx ecx, bl
xor ecx, esi
shr ebx, 8
xor ebx, dword [ecx*4 + 0x10128e2c]
not ebx
cmp dword [edx + 0x1bb8], ebx
jne 0x10030c05
push 0
push ebp
push 4
push ebx
call fcn.1001fa20
add esp, 0x10
mov eax, dword [edi + 0xc4]
cmp eax, dword [edi + 0xc8]
jne 0x10030cba
lea ebp, [eax + 1]
test eax, eax
je 0x10030c25
mov ecx, eax
shr ecx, 0x1f
add ecx, eax
sar ecx, 1
add ecx, eax
jmp 0x10030c2a
mov ecx, 8
cmp ecx, ebp
cmovg ebp, ecx
cmp eax, ebp
jge 0x10030cba
lea eax, [ebp*4]
mov ecx, dword [0x1017f770]
test ecx, ecx
je 0x10030c4e
inc dword [ecx + 0x36c]
push dword [0x1017f778]
push eax
call dword [0x10175014]
add esp, 8
mov esi, eax
mov eax, dword [edi + 0xcc]
test eax, eax
je 0x10030ca8
mov ecx, dword [edi + 0xc4]
shl ecx, 2
push ecx
push eax
push esi
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
mov eax, dword [edi + 0xcc]
test eax, eax
je 0x10030c98
mov ecx, dword [0x1017f770]
test ecx, ecx
je 0x10030c98
dec dword [ecx + 0x36c]
push dword [0x1017f778]
push eax
call dword [0x10175018]
add esp, 8
mov dword [edi + 0xcc], esi
mov dword [edi + 0xc8], ebp
mov eax, dword [edi + 0xc4]
mov ecx, dword [edi + 0xcc]
mov dword [ecx + eax*4], ebx
inc dword [edi + 0xc4]
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x100318f0
Capabilities:
Hash data with crc32

Disassembly:
push ebp
push ebx
push edi
push esi
mov eax, dword [esp + 0x14]
mov ecx, dword [0x1017f770]
mov edx, dword [ecx + 0x1b98]
mov esi, dword [edx + 0xc4]
mov edx, dword [edx + 0xcc]
mov ebp, dword [edx + esi*4 - 4]
not ebp
movzx ebx, byte [eax]
test bl, bl
je 0x10031964
lea edi, [eax + 2]
mov edx, ebp
jmp 0x1003194d
movzx eax, bl
mov esi, edx
shr esi, 8
movzx edx, dl
xor edx, eax
xor esi, dword [edx*4 + 0x10128e2c]
inc edi
mov bl, bh
mov edx, esi
test bh, bh
je 0x10031966
mov bh, byte [edi - 1]
cmp bl, 0x23
jne 0x10031930
cmp bh, 0x23
jne 0x10031930
cmp byte [edi], 0x23
cmove edx, ebp
mov bh, 0x23
jmp 0x10031930
mov esi, ebp
not esi
cmp dword [ecx + 0x1bd0], esi
jne 0x10031976
mov dword [ecx + 0x1bd4], esi
cmp dword [ecx + 0x1c0c], esi
jne 0x10031985
mov byte [ecx + 0x1c10], 1
mov edi, dword [esp + 0x18]
cmp dword [ecx + 0x1bb8], esi
jne 0x100319a2
push 0
push dword [esp + 0x18]
push 0xb
push esi
call fcn.1001fa20
add esp, 0x10
push edi
push esi
call fcn.100319c0
add esp, 8
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x10032200
Capabilities:
Hash data with crc32

Disassembly:
push ebp
push ebx
push edi
push esi
mov eax, dword [0x1017f770]
mov ecx, dword [eax + 0x1d1c]
cmp ecx, dword [eax + 0x1d28]
jle 0x10032284
mov ecx, dword [esp + 0x14]
mov edx, dword [eax + 0x1b98]
mov esi, dword [edx + 0xc4]
mov edx, dword [edx + 0xcc]
mov ebp, dword [edx + esi*4 - 4]
not ebp
movzx ebx, byte [ecx]
test bl, bl
je 0x10032292
lea edi, [ecx + 2]
mov edx, ebp
jmp 0x1003226d
movzx ecx, bl
mov esi, edx
shr esi, 8
movzx edx, dl
xor edx, ecx
xor esi, dword [edx*4 + 0x10128e2c]
inc edi
mov bl, bh
mov edx, esi
test bh, bh
je 0x10032294
mov bh, byte [edi - 1]
cmp bl, 0x23
jne 0x10032250
cmp bh, 0x23
jne 0x10032250
cmp byte [edi], 0x23
cmove edx, ebp
mov bh, 0x23
jmp 0x10032250
mov dword [eax + 0x1c74], 0
xor eax, eax
jmp 0x100322e0
mov esi, ebp
not esi
cmp dword [eax + 0x1bd0], esi
jne 0x100322a4
mov dword [eax + 0x1bd4], esi
mov edi, dword [esp + 0x18]
cmp dword [eax + 0x1c0c], esi
jne 0x100322b7
mov byte [eax + 0x1c10], 1
or edi, 0x141
cmp dword [eax + 0x1bb8], esi
jne 0x100322d6
push 0
push dword [esp + 0x18]
push 0xb
push esi
call fcn.1001fa20
add esp, 0x10
push edi
push esi
call fcn.100320c0
add esp, 8
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x100322f0
Capabilities:
Hash data with crc32

Disassembly:
push ebp
push ebx
push edi
push esi
mov esi, dword [esp + 0x18]
mov edi, dword [0x1017f770]
mov eax, esi
and eax, 0x1f
cmp byte [edi + eax + 0x3ea], 0
je 0x100323e4
mov ebx, dword [edi + 0x1b98]
push 0x20
call fcn.10020410
add esp, 4
test al, al
je 0x100323e4
mov edx, dword [esp + 0x14]
test edx, edx
je 0x10032393
mov eax, dword [ebx + 0xc4]
mov ecx, dword [ebx + 0xcc]
mov ebp, dword [ecx + eax*4 - 4]
not ebp
movzx eax, byte [edx]
test al, al
je 0x1003239b
add edx, 2
mov ecx, ebp
jmp 0x1003237d
movzx esi, al
mov ebx, ecx
shr ebx, 8
movzx ecx, cl
xor ecx, esi
xor ebx, dword [ecx*4 + 0x10128e2c]
inc edx
mov al, ah
mov ecx, ebx
test ah, ah
je 0x1003239d
mov ah, byte [edx - 1]
cmp al, 0x23
jne 0x10032360
cmp ah, 0x23
jne 0x10032360
cmp byte [edx], 0x23
cmove ecx, ebp
mov ah, 0x23
jmp 0x10032360
mov ebx, dword [edi + 0x1c38]
jmp 0x100323da
mov ebx, ebp
not ebx
cmp dword [edi + 0x1bd0], ebx
jne 0x100323ad
mov dword [edi + 0x1bd4], ebx
cmp dword [edi + 0x1c0c], ebx
mov esi, dword [esp + 0x18]
mov eax, dword [esp + 0x14]
jne 0x100323c4
mov byte [edi + 0x1c10], 1
cmp dword [edi + 0x1bb8], ebx
jne 0x100323da
push 0
push eax
push 0xb
push ebx
call fcn.1001fa20
add esp, 0x10
push esi
push ebx
call fcn.100319c0
add esp, 8
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x10033b40
Capabilities:
Write file on windows

Disassembly:
push ebp
push ebx
push edi
push esi
push eax
mov edi, edx
mov ebp, dword [esp + 0x18]
lea ebx, [ecx + 0x2f70]
cmp dword [ecx + 0x2f6c], 0
je 0x10033c2a
mov esi, ecx
cmp dword [ecx + 0x2f74], 0
jns 0x10033be4
mov eax, dword [0x1017f770]
test eax, eax
je 0x10033b78
inc dword [eax + 0x36c]
push dword [0x1017f778]
push 0
call dword [0x10175014]
add esp, 8
mov ecx, dword [esi + 0x2f78]
test ecx, ecx
je 0x10033bd4
push dword [esi + 0x2f70]
push ecx
mov dword [esp + 8], eax
push eax
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
mov eax, dword [esi + 0x2f78]
test eax, eax
je 0x10033bc1
mov ecx, dword [0x1017f770]
test ecx, ecx
je 0x10033bc1
dec dword [ecx + 0x36c]
push dword [0x1017f778]
push eax
call dword [0x10175018]
add esp, 8
mov eax, dword [esp]
mov dword [esi + 0x2f78], eax
mov dword [esi + 0x2f74], 0
mov dword [esi + 0x2f70], 0
mov ecx, ebx
push ebp
push edi
call fcn.1001d920
mov eax, dword [esi + 0x2f70]
xor ecx, ecx
sub eax, 1
cmovb eax, ecx
mov ecx, dword [esi + 0x2f78]
test ecx, ecx
mov edx, 0x1017f774
cmovne edx, ecx
push dword [esi + 0x2f6c]
push eax
push 1
push edx
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
add esp, 0x14
jmp 0x10033c36
mov ecx, ebx
push ebp
push edi
call fcn.1001d920
add esp, 4
pop esi
pop edi
pop ebx
pop ebp
ret