joyce8/EMBER2024-capa huggingface dataset:
Function at 0x407e15
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x42e180]
jne 0x407e1f
repz ret
jmp fcn.0040bc0c

Function at 0x40a3fb
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x50
pushal
call 0x40a40a
pop dword [ebp - 0x40]
mov eax, 0xd214c458
sub eax, 0xd1d4204e
sub dword [ebp - 0x40], eax
mov dword [ebp - 0x50], 0xca9a4061
add dword [ebp - 0x50], 0x83b804ea
mov dword [ebp - 0x4c], 0xee208270
add dword [ebp - 0x4c], 0x4412c9d5
mov dword [ebp - 0x48], 0x12b65cfb
add dword [ebp - 0x48], 0x3995e733
mov dword [ebp - 0x44], 0x680ef533
add dword [ebp - 0x44], 0x97f10acd
lea eax, [ebp - 0x50]
push eax
mov eax, sym.imp.kernel32.dll_GetModuleHandleA
add eax, dword [ebp - 0x40]
call dword [eax]
mov dword [ebp - 0x50], 0xda34fe01
sub dword [ebp - 0x50], 0x65c294ab
mov dword [ebp - 0x4c], 0x7f0e6126
add dword [ebp - 0x4c], 0xc25e004f
mov dword [ebp - 0x48], 0x46194a1f
sub dword [ebp - 0x48], 0xe2a9ddb3
mov dword [ebp - 0x44], 0x1d920e99
add dword [ebp - 0x44], 0xe26df167
lea ebx, [ebp - 0x50]
push ebx
push eax
mov eax, 0x137ae5d7
add eax, 0xecc74b4d
add eax, dword [ebp - 0x40]
call dword [eax]
push 0x40
push 0x1000
push 0x41593
push 0
call eax
mov ecx, 0x1133a5b9
add ecx, 0xeeccb0ed
mov ebx, eax
mov esi, 0x8b4605b7
sub esi, 0x8b02c1b7
add esi, dword [ebp - 0x40]
mov edx, 0xecac4d1
add edx, 0x137d2869
mov dword [ebp - 0x2c], 0xd5ebae32
mov edi, dword [esi]
xor dword [ebp - 4], eax
add edi, edx
sub dword [ebp - 0x20], eax
mov dword [ebx], edi
sub dword [ebp - 0x34], 0x54095c72
add ebx, 0xc7bc7550
sub ebx, 0xc7bc754c
add esi, 0xb7779400
add esi, 0x48886c04
loop 0x40a527
add eax, 0x3b03b939
sub eax, 0x3b026bce
mov ebx, eax
add eax, 5
mov ecx, 0x410a18dc
add ecx, 0xbf35e724
add ecx, dword [ebp - 0x40]
call ebx
leave
ret
Function at 0x1000c6a0
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov edx, dword [ebp + 0x10]
not eax
push esi
mov esi, dword [ebp + 0xc]
test edx, edx
je 0x1000c6cd
movzx ecx, byte [esi]
lea esi, [esi + 1]
xor ecx, eax
shr eax, 8
movzx ecx, cl
xor eax, dword [ecx*4 + 0x100eeec8]
sub edx, 1
jne 0x1000c6b3
not eax
pop esi
pop ebp
ret
Function at 0x10015c80
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100e862d
mov eax, dword fs:[0]
push eax
sub esp, 0x30
mov eax, dword [0x101114bc]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x38], ecx
mov eax, dword [ebp + 8]
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0xf
mov byte [ebp - 0x28], 0
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x28]
push ecx
push eax
call fcn.10074c30
add esp, 8
test al, al
je 0x10015de9
cmp dword [ebp - 0x14], 0x10
lea ecx, [ebp - 0x28]
mov edi, dword [ebp - 0x28]
lea esi, [ebp - 0x28]
mov eax, dword [ebp - 0x18]
cmovae ecx, edi
cmovae esi, edi
add eax, ecx
cmp dword [ebp - 0x14], 0x10
lea ecx, [ebp - 0x28]
mov edx, eax
mov dword [ebp - 0x30], eax
cmovae ecx, edi
xor edi, edi
sub edx, ecx
cmp ecx, eax
cmova edx, edi
mov dword [ebp - 0x34], edx
test edx, edx
je 0x10015d97
cmp edx, 0x40
jb 0x10015d97
lea eax, [esi - 1]
add eax, edx
dec edx
add edx, ecx
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x30]
cmp esi, edx
ja 0x10015d42
cmp dword [ebp - 0x2c], ecx
jae 0x10015d97
mov edx, dword [ebp - 0x34]
movaps xmm2, xmmword [0x100ef650]
and edx, 0xffffffc0
nop
movups xmm0, xmmword [ecx]
add edi, 0x40
movaps xmm1, xmm2
pxor xmm1, xmm0
movups xmm0, xmmword [ecx + 0x10]
movups xmmword [esi], xmm1
movaps xmm1, xmm2
pxor xmm1, xmm0
movups xmm0, xmmword [ecx + 0x20]
movups xmmword [esi + 0x10], xmm1
movaps xmm1, xmm2
pxor xmm1, xmm0
movups xmm0, xmmword [ecx + 0x30]
add ecx, 0x40
movups xmmword [esi + 0x20], xmm1
movaps xmm1, xmm2
pxor xmm1, xmm0
movups xmmword [esi + 0x30], xmm1
add esi, 0x40
cmp edi, edx
jne 0x10015d50
cmp ecx, eax
je 0x10015dad
sub esi, ecx
nop dword [eax]
mov dl, byte [ecx]
xor dl, 0xda
mov byte [esi + ecx], dl
inc ecx
cmp ecx, eax
jne 0x10015da0
cmp dword [ebp - 0x14], 0x10
lea eax, [ebp - 0x28]
push dword [ebp - 0x18]
cmovae eax, dword [ebp - 0x28]
mov edi, dword [ebp - 0x38]
mov ecx, edi
push eax
call fcn.10015380
mov edx, dword [ebp - 0x3c]
mov ecx, edx
lea esi, [ecx + 2]
nop
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x10015dd0
sub ecx, esi
sar ecx, 1
push ecx
push edx
lea ecx, [edi + 0x20]
call fcn.10005850
mov dword [ebp - 4], 0xffffffff
mov edx, dword [ebp - 0x14]
cmp edx, 0x10
jb 0x10015e20
mov ecx, dword [ebp - 0x28]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x10015e16
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x10015e4f
push edx
push ecx
call fcn.10085c12
add esp, 8
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0xf
mov byte [ebp - 0x28], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.10085c29
mov esp, ebp
pop ebp
ret 4
call fcn.10092073
int3
Function at 0x10015e60
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100e867b
mov eax, dword fs:[0]
push eax
sub esp, 0xc0
mov eax, dword [0x101114bc]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, dword [ebp + 8]
push 0xa023
mov dword [ebp - 0xc4], 0
mov dword [ebp - 0xc0], 0
mov dword [ebp - 0xbc], 0
call fcn.10085be2
mov ecx, eax
add esp, 4
test ecx, ecx
je 0x10016082
lea eax, [ecx + 0x23]
and eax, 0xffffffe0
mov dword [eax - 4], ecx
mov dword [ebp - 0xc4], eax
mov dword [ebp - 0xc0], eax
add eax, 0xa000
mov dword [ebp - 0xbc], eax
lea eax, [ebp - 0xc4]
mov dword [ebp - 0xcc], eax
mov dword [ebp - 4], 0
mov eax, dword [ebp - 0xc4]
push 0xa000
push 0
push eax
lea esi, [eax + 0xa000]
call fcn.10088c20
add esp, 0xc
mov dword [ebp - 0xc0], esi
mov dword [ebp - 0xcc], 0
mov dword [ebp - 4], 1
cmp dword [ebp + 0x10], 0x10
jne 0x10016005
push 0x100ef644
lea eax, [ebp - 0xc8]
push edi
push eax
call fcn.100bb809
add esp, 0xc
test eax, eax
jne 0x10016005
push 0x98
push eax
lea eax, [ebp - 0xb8]
push eax
call fcn.10088c20
lea eax, [ebp - 0xb8]
push eax
call fcn.1006aea0
push dword [ebp - 0xc8]
call fcn.100bba77
add esp, 0x14
test eax, eax
jne 0x10015fc5
push dword [ebp - 0xc8]
mov eax, dword [ebp - 0xc0]
mov ecx, dword [ebp - 0xc4]
sub eax, ecx
push eax
push 1
push ecx
call fcn.100bbd0e
push eax
push dword [ebp - 0xc4]
lea eax, [ebp - 0xb8]
push eax
call fcn.1006aee0
push dword [ebp - 0xc8]
call fcn.100bba77
add esp, 0x20
test eax, eax
je 0x10015f83
lea eax, [ebp - 0xb8]
push eax
lea eax, [ebp - 0x20]
push eax
call fcn.1006ad70
push dword [ebp - 0xc8]
call fcn.100bba1a
mov ecx, dword [ebp + 0xc]
lea edx, [ebp - 0x20]
add esp, 0xc
mov esi, 0xc
nop
mov eax, dword [ecx]
cmp eax, dword [edx]
jne 0x10016005
add ecx, 4
add edx, 4
sub esi, 4
jae 0x10015ff0
mov bl, 1
jmp 0x10016007
xor bl, bl
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0xc4]
test ecx, ecx
je 0x10016062
mov edx, dword [ebp - 0xbc]
mov eax, ecx
sub edx, ecx
cmp edx, 0x1000
jb 0x1001603a
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x10016082
push edx
push ecx
call fcn.10085c12
add esp, 8
mov dword [ebp - 0xc4], 0
mov dword [ebp - 0xc0], 0
mov dword [ebp - 0xbc], 0
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.10085c29
mov esp, ebp
pop ebp
ret 0xc
call fcn.10092073
int3
Function at 0x100193a0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100e8d79
mov eax, dword fs:[0]
push eax
sub esp, 0x94
mov eax, dword [0x101114bc]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp byte [ebp + 0xc], 0
mov dword [ebp - 0xa0], 0
je 0x1001943a
movaps xmm0, xmmword [0x100ef6b0]
movups xmmword [ebp - 0x88], xmm0
mov dword [ebp - 0x78], 0xdabbbd
mov dword [ebp - 4], 0
mov eax, 1
mov dword [ebp - 0xa0], eax
mov eax, 0x10
movups xmm0, xmmword [ebp - 0x88]
movaps xmm1, xmmword [0x100ef650]
pxor xmm1, xmm0
movups xmmword [ebp - 0x88], xmm1
xor byte [ebp + eax - 0x88], 0xda
inc eax
cmp eax, 0x13
jb 0x10019420
mov byte [ebp - 0x75], 0
lea eax, [ebp - 0x88]
jmp 0x10019490
movaps xmm0, xmmword [0x100ef6c0]
movups xmmword [ebp - 0x9c], xmm0
mov word [ebp - 0x8c], 0xda
mov dword [ebp - 4], 1
mov eax, 2
mov dword [ebp - 0xa0], eax
lea eax, [ebp - 0x9c]
movups xmm0, xmmword [ebp - 0x9c]
xor byte [ebp - 0x8c], 0xda
movaps xmm1, xmmword [0x100ef650]
pxor xmm1, xmm0
mov byte [ebp - 0x8b], 0
movups xmmword [ebp - 0x9c], xmm1
push dword [ebp + 8]
push eax
lea eax, [ebp - 0x74]
push 0x64
push eax
call fcn.10009560
add esp, 0x10
mov dword [ebp - 4], 0
mov eax, dword [ebp - 0xa0]
test al, 2
je 0x100194cf
and eax, 0xfffffffd
xorps xmm0, xmm0
mov dword [ebp - 0xa0], eax
movups xmmword [ebp - 0x9c], xmm0
mov word [ebp - 0x8c], 0
mov dword [ebp - 4], 0xffffffff
test al, 1
je 0x100194f4
and eax, 0xfffffffe
xorps xmm0, xmm0
mov dword [ebp - 0xa0], eax
movups xmmword [ebp - 0x88], xmm0
mov dword [ebp - 0x78], 0
mov ecx, dword [0x10111280]
lea eax, [ebp - 0x74]
push eax
mov eax, 0x7b1ec0
call eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.10085c29
mov esp, ebp
pop ebp
ret
Function at 0x10019520
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [0x10113100]
mov ecx, dword [ebp + 8]
push esi
mov esi, edx
mov eax, dword [edx + 4]
cmp byte [eax + 0xd], 0
jne 0x1001954c
cmp dword [eax + 0x10], ecx
jge 0x10019542
mov eax, dword [eax + 8]
jmp 0x10019546
mov esi, eax
mov eax, dword [eax]
cmp byte [eax + 0xd], 0
je 0x10019538
cmp byte [esi + 0xd], 0
jne 0x100195fa
cmp ecx, dword [esi + 0x10]
jl 0x100195fa
cmp esi, edx
je 0x100195fa
mov ecx, dword [esi + 0x14]
mov eax, dword [esi + 0x18]
cmp ecx, eax
je 0x100195fa
sub eax, ecx
sar eax, 2
cmp eax, 1
jbe 0x100195bd
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, eax
xor edx, edx
mov eax, 0x3e8
sub ecx, dword [esi + 0x28]
div dword [esi + 0x24]
cmp ecx, eax
jbe 0x100195a4
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [esi + 0x28], eax
inc dword [esi + 0x20]
mov eax, dword [esi + 0x18]
mov ecx, dword [esi + 0x14]
sub eax, ecx
mov edx, dword [esi + 0x20]
sar eax, 2
cmp edx, eax
jb 0x100195bd
mov dword [esi + 0x20], 0
mov eax, dword [esi + 0x20]
mov eax, dword [ecx + eax*4]
mov edx, eax
mov ecx, dword [ebp + 0x10]
shr edx, 0x1f
mov byte [ecx], dl
cdq
mov ecx, eax
mov eax, 0x66666667
xor ecx, edx
sub ecx, edx
dec ecx
imul ecx
sar edx, 2
mov esi, edx
shr esi, 0x1f
add esi, edx
lea eax, [esi + esi*4]
add eax, eax
sub ecx, eax
mov eax, dword [ebp + 0xc]
mov dword [eax], ecx
js 0x100195fa
lea eax, [esi + 1]
pop esi
pop ebp
ret
or eax, 0xffffffff
pop esi
pop ebp
ret
Function at 0x1001c2a0
Capabilities:
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100e943c
mov eax, dword fs:[0]
push eax
sub esp, 0x34
mov eax, dword [0x101114bc]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
lea eax, [ebp - 0x28]
mov dword [ebp - 0x28], 0x10
push eax
lea eax, [ebp - 0x20]
xorps xmm0, xmm0
push eax
push dword [esi + 4]
movups xmmword [ebp - 0x20], xmm0
call dword [sym.imp.WS2_32.dll_accept]
mov dword [ebp - 0x24], eax
cmp eax, 0xffffffff
je 0x1001c422
lea ecx, [ebp - 0x40]
mov dword [ebp - 0x40], 1
push ecx
push 0x8004667e
push eax
call dword [sym.imp.WS2_32.dll_ioctlsocket]
cmp eax, 0xffffffff
jne 0x1001c321
push dword [ebp - 0x24]
call dword [sym.imp.WS2_32.dll_closesocket]
jmp 0x1001c422
push 0x38
call fcn.10085be2
add esp, 4
mov dword [ebp - 0x34], eax
mov dword [ebp - 4], 0
test eax, eax
je 0x1001c34f
push dword [ebp - 0x28]
lea ecx, [ebp - 0x20]
push ecx
push dword [ebp - 0x24]
mov ecx, eax
call fcn.1001b960
mov dword [ebp - 0x30], eax
jmp 0x1001c356
mov dword [ebp - 0x30], 0
mov dword [ebp - 4], 0xffffffff
lea eax, [esi + 8]
mov ecx, dword [eax]
xor esi, esi
mov edx, dword [ebp - 0x24]
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x34], ecx
mov edi, dword [ecx + 4]
cmp byte [edi + 0xd], 0
jne 0x1001c398
mov eax, edi
mov edi, eax
cmp dword [eax + 0x10], edx
jae 0x1001c386
mov eax, dword [eax + 8]
xor esi, esi
jmp 0x1001c38f
mov ecx, eax
mov esi, 1
mov eax, dword [eax]
cmp byte [eax + 0xd], 0
je 0x1001c378
mov eax, dword [ebp - 0x2c]
cmp byte [ecx + 0xd], 0
jne 0x1001c3a3
cmp edx, dword [ecx + 0x10]
jae 0x1001c41c
cmp dword [eax + 4], 0xaaaaaaa
je 0x1001c43d
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0x38], 0
mov dword [ebp - 4], 1
push 0x18
mov dword [ebp - 0x38], 0
call fcn.10085be2
add esp, 4
mov dword [ebp - 0x38], eax
mov dword [ebp - 4], 2
mov ecx, dword [ebp - 0x24]
mov dword [eax + 0x10], ecx
mov ecx, dword [ebp - 0x34]
mov dword [eax + 0x14], 0
mov dword [eax], ecx
mov dword [eax + 4], ecx
mov dword [eax + 8], ecx
mov word [eax + 0xc], 0
mov dword [ebp - 4], 3
mov dword [ebp - 0x38], 0
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0x2c]
push eax
push esi
push edi
call fcn.1001cc60
mov ecx, eax
mov eax, dword [ebp - 0x30]
mov dword [ecx + 0x14], eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.10085c29
mov esp, ebp
pop ebp
ret
call fcn.10005190
int3
Function at 0x1001f7f0
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100e999b
mov eax, dword fs:[0]
push eax
push ecx
mov eax, dword [0x101114bc]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], ecx
mov dword [ecx + 4], 0
mov dword [ecx], 0
mov dword [ecx + 0xc], 0
mov dword [ecx + 8], 0
mov dword [ecx + 0x14], 0
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x1c], 0
mov dword [ecx + 0x18], 0
mov dword [ecx + 0x24], 0
mov dword [ecx + 0x20], 0
mov dword [ecx + 0x2c], 0
mov dword [ecx + 0x28], 0
mov dword [ecx + 0x48], 0x7f7fffff
mov dword [ecx + 0x4c], 0x7f7fffff
mov dword [ecx + 0x50], 0xff7fffff
mov dword [ecx + 0x54], 0xff7fffff
mov dword [ecx + 0x58], 0x7f7fffff
mov dword [ecx + 0x5c], 0x7f7fffff
mov dword [ecx + 0x60], 0xff7fffff
mov dword [ecx + 0x64], 0xff7fffff
mov dword [ecx + 0x80], 0
mov dword [ecx + 0x7c], 0
mov dword [ecx + 0x88], 0
mov dword [ecx + 0x84], 0
mov dword [ecx + 0x8c], 0
mov dword [ebp - 4], 0
mov dword [ecx + 0xb4], 0
mov dword [ecx + 0xb0], 0
mov dword [ecx + 0xb8], 0
mov byte [ebp - 4], 1
mov dword [ecx + 0xc0], 0
mov dword [ecx + 0xbc], 0
mov dword [ecx + 0xc4], 0
mov byte [ebp - 4], 2
mov dword [ecx + 0xcc], 0
mov dword [ecx + 0xc8], 0
mov dword [ecx + 0xd0], 0
mov byte [ebp - 4], 3
mov dword [ecx + 0xd8], 0
mov dword [ecx + 0xd4], 0
mov dword [ecx + 0xdc], 0
mov byte [ebp - 4], 4
mov dword [ecx + 0xec], 0
mov dword [ecx + 0xf0], 0
mov dword [ecx + 0xf4], 0
movaps xmm0, xmmword [0x100f0ca0]
mov dword [ecx + 0x18], 0
mov eax, dword [ecx + 0x18]
mov dword [ecx + 0x10], eax
mov dword [ecx + 0x1c], 0
mov eax, dword [ecx + 0x1c]
mov dword [ecx + 0x14], eax
mov eax, dword [ecx + 0x18]
mov dword [ecx + 8], eax
mov eax, dword [ecx + 0x1c]
mov dword [ecx + 0xc], eax
mov eax, dword [ecx + 0x18]
mov dword [ecx], eax
mov eax, dword [ecx + 0x1c]
mov dword [ecx + 4], eax
mov dword [ecx + 0x28], 0
mov eax, dword [ecx + 0x28]
mov dword [ecx + 0x2c], 0
mov dword [ecx + 0x20], eax
mov eax, dword [ecx + 0x2c]
mov dword [ecx + 0x24], eax
mov dword [ecx + 0x34], 0
mov dword [ecx + 0x30], 0
mov dword [ecx + 0x38], 0
mov dword [ecx + 0x3c], 0
mov dword [ecx + 0x40], 0
mov dword [ecx + 0x44], 0
movups xmmword [ecx + 0x58], xmm0
mov dword [ecx + 0x74], 0
movups xmmword [ecx + 0x48], xmm0
mov dword [ecx + 0x70], 0
mov dword [ecx + 0x68], 0
xorps xmm0, xmm0
mov dword [ecx + 0x6c], 1
mov word [ecx + 0x78], 0
mov byte [ecx + 0x7a], 0
mov dword [ecx + 0x7c], 0
mov dword [ecx + 0x80], 0
mov dword [ecx + 0x90], 0
mov dword [ecx + 0x98], 1
mov dword [ecx + 0x94], 1
mov dword [ecx + 0xa0], 0xffffffff
mov dword [ecx + 0x9c], 0xffffffff
mov dword [ecx + 0xa4], 0
mov dword [ecx + 0xa8], 0
mov dword [ecx + 0xac], 0xbf800000
movq qword [ecx + 0xe0], xmm0
mov dword [ecx + 0xe8], 0
mov dword [ecx + 0xec], 0
mov dword [ecx + 0xf0], 0
mov dword [ecx + 0xf4], 0
mov dword [ecx + 0xf8], 0
mov dword [ebp - 4], 0xffffffff
mov eax, ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
Function at 0x10023ea0
Capabilities:
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [ebp + 8]
mov dword [ebp - 0xc], 0
push ebx
push esi
push edi
mov edi, dword [0x101132e0]
mov esi, dword [edi + 0x19bc]
mov dword [ebp - 8], esi
test al, 0x10
jne 0x10023fd2
mov ebx, dword [esi + 0x108]
test ebx, ebx
je 0x10023ee0
cmp dword [edi + 0x19f0], ebx
jne 0x10023fc9
cmp byte [edi + 0xf0], 0
je 0x10023fc9
test ebx, ebx
jne 0x10023f7c
test al, 8
je 0x10023fc9
test byte [esi + 0x10c], 1
jne 0x10023f1e
cmp dword [edi + 0x19f0], ebx
je 0x10023fc9
cmp dword [edi + 0x1a14], esi
jne 0x10023fc9
mov ecx, dword [ebp - 8]
add esi, 0x110
push esi
call fcn.10028ff0
mov ebx, eax
mov eax, dword [ebp - 8]
push ebx
push esi
mov dword [eax + 0x108], ebx
call fcn.1002c540
mov esi, dword [ebp - 8]
mov cl, al
add esp, 8
mov byte [ebp - 1], cl
test cl, cl
je 0x10023f6a
cmp byte [edi + 0x3e0], 0
je 0x10023f6a
push esi
push ebx
call fcn.10036590
push esi
call fcn.10027e70
mov cl, byte [ebp - 1]
add esp, 0xc
mov eax, dword [edi + 0x19f0]
cmp eax, ebx
jne 0x10023fc9
mov byte [edi + 0x19fd], cl
jmp 0x10023f89
mov eax, dword [edi + 0x19f0]
mov byte [edi + 0x19fd], 0
cmp eax, ebx
jne 0x10023fc9
mov ecx, dword [esi + 0xbc]
mov eax, dword [esi + 0xc4]
mov eax, dword [eax + ecx*4 - 4]
mov dword [ebp - 0xc], eax
mov eax, dword [0x101132e0]
cmp byte [eax + 0xf0], 0
je 0x10023fc9
movss xmm1, dword [eax + 0x30]
movss xmm0, dword [eax + 0x44c]
mulss xmm1, xmm1
comiss xmm0, xmm1
setae al
test al, al
jne 0x10024010
pop edi
pop esi
xor al, al
pop ebx
mov esp, ebp
pop ebp
ret
xor esi, esi
or ebx, 0xffffffff
mov dword [ebp - 8], esi
mov edx, 0x100f0095
mov al, 0x23
or esi, 0xffffffff
cmp al, 0x23
jne 0x10023ff2
cmp byte [edx], al
jne 0x10023ff2
cmp byte [edx + 1], al
cmove ebx, esi
movzx ecx, bl
movzx eax, al
xor ecx, eax
shr ebx, 8
mov al, byte [edx]
inc edx
xor ebx, dword [ecx*4 + 0x100ef730]
test al, al
jne 0x10023fe4
mov esi, dword [ebp - 8]
not ebx
cmp byte [edi + 0x1d38], 0
jne 0x10024049
call fcn.10025860
mov eax, dword [ebp - 0xc]
mov dword [edi + 0x1d50], ebx
mov ebx, dword [ebp + 8]
mov dword [edi + 0x1d54], eax
mov byte [edi + 0x1d38], 1
mov dword [edi + 0x1d3c], ebx
mov dword [edi + 0x1d44], 0
jmp 0x1002404c
mov ebx, dword [ebp + 8]
mov eax, dword [edi + 0x1970]
mov dword [edi + 0x1d40], eax
mov byte [edi + 0x1d39], 1
test bl, 1
jne 0x10024092
call fcn.10024790
cmp dword [edi + 0x1da0], 0
je 0x10024092
test dword [edi + 0x1d94], 0x1000
je 0x10024092
mov eax, dword [edi + 0x19bc]
mov byte [eax + 0x7f], 1
mov dword [eax + 0x98], 1
test bl, 0x12
jne 0x1002409e
and dword [esi + 0x10c], 0xfffffffe
pop edi
pop esi
mov al, 1
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x100264f0
Capabilities:
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
mov esi, dword [0x101132e0]
xor eax, eax
push edi
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x10], 0
mov ecx, dword [esi + 0x2d48]
mov ebx, dword [esi + 0x2d4c]
mov dword [ebp - 8], eax
mov dword [ebp - 0xc], eax
mov byte [ebp - 4], al
cmp ecx, ebx
jne 0x100265c6
lea edi, [ecx + 1]
test ebx, ebx
je 0x1002653e
mov eax, ebx
cdq
sub eax, edx
sar eax, 1
add eax, ebx
jmp 0x10026543
mov eax, 8
cmp eax, edi
cmovg edi, eax
cmp edi, ebx
jle 0x100265c6
push dword [0x101132e8]
inc dword [esi + 0x378]
lea eax, [edi + edi*4]
shl eax, 2
push eax
call dword [0x101112b8]
mov ebx, eax
add esp, 8
mov eax, dword [esi + 0x2d50]
test eax, eax
je 0x100265b4
mov ecx, dword [esi + 0x2d48]
lea ecx, [ecx + ecx*4]
shl ecx, 2
push ecx
push eax
push ebx
call fcn.10088120
mov ecx, dword [esi + 0x2d50]
add esp, 0xc
test ecx, ecx
je 0x100265a4
mov eax, dword [0x101132e0]
test eax, eax
je 0x100265a4
dec dword [eax + 0x378]
push dword [0x101132e8]
push ecx
call dword [0x101112bc]
add esp, 8
mov ecx, dword [esi + 0x2d48]
mov dword [esi + 0x2d50], ebx
mov dword [esi + 0x2d4c], edi
mov eax, dword [esi + 0x2d50]
lea ecx, [ecx + ecx*4]
movups xmm0, xmmword [ebp - 0x14]
mov edi, dword [ebp + 8]
push 0x100f0110
lea ecx, [eax + ecx*4]
mov eax, dword [ebp - 4]
movups xmmword [ecx], xmm0
mov dword [ecx + 0x10], eax
inc dword [esi + 0x2d48]
mov eax, dword [esi + 0x2d48]
push edi
lea ecx, [eax + eax*4]
mov eax, dword [esi + 0x2d50]
lea ebx, [eax + ecx*4]
call fcn.10088ec0
add esp, 8
test eax, eax
cmovne edi, eax
mov esi, edi
lea ecx, [esi + 1]
mov al, byte [esi]
inc esi
test al, al
jne 0x10026612
mov eax, dword [0x101132e0]
sub esi, ecx
test eax, eax
je 0x1002662a
inc dword [eax + 0x378]
push dword [0x101132e8]
inc esi
push esi
call dword [0x101112b8]
push esi
push edi
push eax
call fcn.10088120
mov dword [ebx - 0x14], eax
lea esi, [edi + 1]
mov al, byte [edi]
add esp, 0x14
or ecx, 0xffffffff
test al, al
je 0x1002667c
or edi, 0xffffffff
cmp al, 0x23
jne 0x10026663
cmp byte [esi], al
jne 0x10026663
cmp byte [esi + 1], al
cmove ecx, edi
movzx edx, cl
movzx eax, al
xor edx, eax
shr ecx, 8
mov al, byte [esi]
inc esi
xor ecx, dword [edx*4 + 0x100ef730]
test al, al
jne 0x10026655
pop edi
not ecx
lea eax, [ebx - 0x14]
pop esi
mov dword [ebx - 0x10], ecx
pop ebx
mov esp, ebp
pop ebp
ret