joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10009320
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
sub esp, 0x18
mov edx, dword [ebp + 8]
push ebx
mov ebx, ecx
cmp edx, eax
je 0x10009476
mov eax, dword [ebx + 4]
mov dword [ebp - 0x14], eax
mov eax, dword [edx + 4]
mov dword [ebp - 8], eax
movzx eax, byte [edx + 8]
xor eax, 0x811c9dc5
imul ecx, eax, 0x1000193
movzx eax, byte [edx + 9]
push esi
push edi
mov edi, dword [ebx + 0xc]
mov esi, edx
xor ecx, eax
mov dword [ebp - 0x18], edi
movzx eax, byte [edx + 0xa]
imul ecx, ecx, 0x1000193
xor ecx, eax
movzx eax, byte [edx + 0xb]
imul ecx, ecx, 0x1000193
xor ecx, eax
mov eax, dword [ebx + 0x18]
imul ecx, ecx, 0x1000193
and eax, ecx
mov ecx, dword [edi + eax*8]
mov dword [ebp - 4], ecx
lea eax, [edi + eax*8]
mov dword [ebp - 0xc], eax
mov eax, dword [eax + 4]
mov dword [ebp - 0x10], eax
mov eax, esi
mov edi, esi
mov esi, dword [esi]
push 0x10
push eax
call fcn.10056fe2
dec dword [ebx + 8]
add esp, 8
cmp edi, dword [ebp - 0x10]
je 0x100093d9
mov eax, dword [ebp + 0xc]
cmp esi, eax
jne 0x10009397
mov ecx, dword [ebp - 4]
cmp ecx, dword [ebp + 8]
jne 0x1000946c
mov edx, dword [ebp - 0xc]
mov ecx, dword [ebp - 8]
pop edi
mov dword [edx], esi
mov dword [ecx], esi
mov dword [esi + 4], ecx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
mov ecx, dword [ebp - 4]
mov edx, dword [ebp - 0xc]
cmp ecx, dword [ebp + 8]
jne 0x100093ed
mov eax, dword [ebp - 0x14]
mov ecx, eax
mov dword [edx], eax
jmp 0x100093f0
mov ecx, dword [ebp - 8]
mov eax, dword [ebp + 0xc]
mov dword [edx + 4], ecx
cmp esi, eax
je 0x1000946c
nop word [eax + eax]
movzx eax, byte [esi + 8]
xor eax, 0x811c9dc5
imul ecx, eax, 0x1000193
movzx eax, byte [esi + 9]
xor ecx, eax
movzx eax, byte [esi + 0xa]
imul ecx, ecx, 0x1000193
xor ecx, eax
movzx eax, byte [esi + 0xb]
imul ecx, ecx, 0x1000193
xor ecx, eax
mov eax, dword [ebx + 0x18]
imul ecx, ecx, 0x1000193
and eax, ecx
mov ecx, dword [ebp - 0x18]
lea eax, [ecx + eax*8]
mov dword [ebp - 4], eax
mov eax, dword [eax + 4]
mov dword [ebp - 0x10], eax
mov eax, esi
mov edi, esi
mov esi, dword [esi]
push 0x10
push eax
call fcn.10056fe2
dec dword [ebx + 8]
add esp, 8
mov eax, dword [ebp + 0xc]
cmp edi, dword [ebp - 0x10]
je 0x1000947d
cmp esi, eax
jne 0x10009447
mov ecx, dword [ebp - 4]
mov dword [ecx], esi
mov ecx, dword [ebp - 8]
pop edi
mov dword [ecx], esi
mov dword [esi + 4], ecx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
mov ecx, dword [ebp - 4]
mov edx, dword [ebp - 0x14]
mov dword [ecx], edx
mov dword [ecx + 4], edx
cmp esi, eax
jne 0x10009400
mov ecx, dword [ebp - 8]
pop edi
mov dword [ecx], esi
mov dword [esi + 4], ecx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x1000aa50
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0xc
mov eax, dword [ebp + 0x10]
push ebx
mov ebx, ecx
mov ecx, dword [ebp + 0xc]
push esi
push edi
mov edi, dword [ebp + 8]
mov dword [esp + 0xc], edi
test eax, eax
jg 0x1000aa82
jl 0x1000aa75
test ecx, ecx
jne 0x1000aa82
xor eax, eax
xor edx, edx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
cmp dword [ebx + 0x38], 0
je 0x1000ab42
mov dword [esp + 0x10], ecx
mov dword [esp + 0xc], eax
mov ecx, ebx
call fcn.10006030
mov esi, eax
mov eax, edx
mov dword [esp + 0x14], eax
test eax, eax
jl 0x1000aaee
jg 0x1000aaad
test esi, esi
je 0x1000aaee
mov ecx, dword [esp + 0xc]
cmp ecx, eax
jg 0x1000aac5
mov eax, dword [esp + 0x10]
jl 0x1000aabf
cmp eax, esi
jae 0x1000aac5
mov esi, eax
mov dword [esp + 0x14], ecx
mov eax, dword [ebx + 0x1c]
push esi
push dword [eax]
push edi
call fcn.10058800
mov eax, dword [ebx + 0x2c]
add esp, 0xc
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 0xc]
sub ecx, esi
sbb edx, dword [esp + 0x14]
sub dword [eax], esi
mov eax, dword [ebx + 0x1c]
add dword [eax], esi
jmp 0x1000ab0f
mov eax, dword [ebx]
mov ecx, ebx
call dword [eax + 0x1c]
mov edx, dword [esp + 0xc]
cmp eax, 0xffffffff
je 0x1000ab2b
mov ecx, dword [esp + 0x10]
mov esi, 1
add ecx, 0xffffffff
mov byte [edi], al
adc edx, 0xffffffff
add edi, esi
mov dword [esp + 0xc], edx
mov dword [esp + 0x10], ecx
test edx, edx
jg 0x1000aa94
jl 0x1000ab2b
test ecx, ecx
jne 0x1000aa94
mov eax, dword [ebp + 0xc]
sub eax, dword [esp + 0x10]
mov esi, dword [ebp + 0x10]
sbb esi, edx
mov edx, esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov eax, dword [ebx + 0x1c]
lea esi, [ebx + 0x2c]
mov edi, ecx
mov edx, dword [eax]
test edx, edx
je 0x1000ab80
mov eax, dword [esi]
mov eax, dword [eax]
test eax, eax
je 0x1000ab80
cmp eax, ecx
mov esi, ecx
cmovb esi, eax
push esi
push edx
push dword [esp + 0x14]
call fcn.10058800
mov eax, dword [ebx + 0x2c]
sub edi, esi
add dword [esp + 0x18], esi
add esp, 0xc
sub dword [eax], esi
mov eax, dword [ebx + 0x1c]
add dword [eax], esi
lea esi, [ebx + 0x2c]
cmp dword [ebx + 0x4c], 0
je 0x1000abe9
mov ecx, dword [ebx + 0xc]
lea eax, [ebx + 0x3c]
cmp dword [ecx], eax
jne 0x1000aba6
mov eax, dword [ebx + 0xc]
mov edx, dword [ebx + 0x54]
mov ecx, dword [ebx + 0x50]
sub edx, ecx
mov dword [eax], ecx
mov eax, dword [ebx + 0x1c]
mov dword [eax], ecx
mov eax, dword [esi]
mov dword [eax], edx
mov esi, dword [esp + 0xc]
cmp edi, 0xfff
jbe 0x1000abd4
push dword [ebx + 0x4c]
push 0xfff
push 1
push esi
call fcn.1005fcb7
add esp, 0x10
add esi, eax
sub edi, eax
cmp eax, 0xfff
jne 0x1000abe9
cmp edi, eax
ja 0x1000abb2
test edi, edi
je 0x1000abe9
push dword [ebx + 0x4c]
push edi
push 1
push esi
call fcn.1005fcb7
add esp, 0x10
sub edi, eax
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 0x10]
sub eax, edi
pop edi
pop esi
sbb edx, 0
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x1000e4f0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10080a95
mov eax, dword fs:[0]
push eax
sub esp, 0x24
push ebx
push esi
push edi
mov eax, dword [0x100aa080]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov edx, dword [ebp + 0xc]
mov edi, dword [ebp + 8]
mov dword [ebp - 0x24], edi
mov dword [ebp - 0x14], edx
cmp dword [edx + 0x14], 0xf
mov dword [ebp - 0x1c], edx
jbe 0x1000e534
mov eax, dword [edx]
mov dword [ebp - 0x1c], eax
xor ecx, ecx
mov esi, 0x811c9dc5
cmp dword [edx + 0x10], ecx
jbe 0x1000e558
mov edi, dword [ebp - 0x1c]
movzx eax, byte [edi + ecx]
inc ecx
xor eax, esi
imul esi, eax, 0x1000193
cmp ecx, dword [edx + 0x10]
jb 0x1000e543
mov edi, dword [ebp - 0x24]
push esi
push edx
lea eax, [ebp - 0x20]
mov ecx, ebx
push eax
call fcn.1000e460
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x1000e588
mov dword [edi], eax
mov eax, edi
mov byte [edi + 4], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
cmp dword [ebx + 8], 0x71c71c7
je 0x1000e6e1
lea eax, [ebx + 4]
mov dword [ebp - 0x2c], eax
mov dword [ebp - 4], 0
push 0x24
mov dword [ebp - 0x28], 0
call fcn.10056fad
add esp, 4
mov edi, eax
mov dword [ebp - 0x28], edi
push dword [ebp - 0x14]
lea ecx, [edi + 8]
call fcn.10005160
mov dword [edi + 0x20], 0
mov dword [ebp - 4], 1
mov eax, dword [ebx + 8]
inc eax
movss xmm3, dword [ebx]
movd xmm0, eax
cvtdq2pd xmm0, xmm0
shr eax, 0x1f
addsd xmm0, qword [eax*8 + 0x100992d0]
mov eax, dword [ebx + 0x1c]
cvtpd2ps xmm2, xmm0
movd xmm0, eax
cvtdq2pd xmm0, xmm0
shr eax, 0x1f
movaps xmm1, xmm2
addsd xmm0, qword [eax*8 + 0x100992d0]
cvtpd2ps xmm0, xmm0
divss xmm1, xmm0
comiss xmm1, xmm3
jbe 0x1000e683
divss xmm2, xmm3
sub esp, 8
cvtps2pd xmm0, xmm2
movsd qword [ebp - 0x18], xmm0
fld qword [ebp - 0x18]
fstp qword [esp]
call fcn.1007ae40
fstp qword [ebp - 0x18]
movsd xmm0, qword [ebp - 0x18]
add esp, 8
cvtpd2ps xmm0, xmm0
call fcn.1007c8e0
mov ecx, 8
cmp eax, ecx
cmova ecx, eax
mov eax, dword [ebx + 0x1c]
cmp eax, ecx
jae 0x1000e667
cmp eax, 0x200
jae 0x1000e665
shl eax, 3
cmp eax, ecx
jae 0x1000e667
mov eax, ecx
push eax
mov ecx, ebx
call fcn.1000e270
push esi
lea eax, [edi + 8]
mov ecx, ebx
push eax
lea eax, [ebp - 0x2c]
push eax
call fcn.1000e460
mov edx, dword [eax]
jmp 0x1000e686
mov edx, dword [ebp - 0x20]
mov eax, dword [edx + 4]
inc dword [ebx + 8]
mov dword [edi + 4], eax
mov dword [edi], edx
mov dword [eax], edi
mov dword [edx + 4], edi
mov ecx, dword [ebx + 0xc]
mov dword [ebp - 0x14], eax
mov eax, dword [ebx + 0x18]
and eax, esi
mov esi, dword [ecx + eax*8]
cmp esi, dword [ebx + 4]
jne 0x1000e6ae
mov dword [ecx + eax*8], edi
jmp 0x1000e6c0
cmp esi, edx
jne 0x1000e6b7
mov dword [ecx + eax*8], edi
jmp 0x1000e6c4
mov edx, dword [ebp - 0x14]
cmp dword [ecx + eax*8 + 4], edx
jne 0x1000e6c4
mov dword [ecx + eax*8 + 4], edi
mov eax, dword [ebp - 0x24]
mov dword [eax], edi
mov byte [eax + 4], 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
push str.unordered_map_set_too_long
call fcn.100559b6
int3
Function at 0x1000e800
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10080ad1
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x100aa080]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword fs:[0x2c]
mov ecx, dword [0x100b4348]
mov ecx, dword [eax + ecx*4]
mov eax, dword [0x100b5f84]
cmp eax, dword [ecx + 4]
jle 0x1000e8ac
push 0x100b5f84
call fcn.1005708f
add esp, 4
cmp dword [0x100b5f84], 0xffffffff
jne 0x1000e8ac
mov dword [ebp - 4], 0
call fcn.100567fc
mov dword [0x100b5f7c], 0xffffffff
mov ecx, 1
mov dword [0x100b4bfc], eax
mov edx, eax
shr edx, 0x1e
xor edx, eax
imul eax, edx, 0x6c078965
add eax, ecx
mov dword [ecx*4 + 0x100b4bfc], eax
inc ecx
cmp ecx, 0x270
jb 0x1000e876
push 0x100b5f84
mov dword [0x100b4bf8], 0x270
call fcn.1005703e
add esp, 4
mov ecx, 0x100b4bf8
call fcn.10010900
mov esi, 0x29
mul esi
cmp eax, esi
jae 0x1000e8d7
cmp eax, 0x25
jae 0x1000e8d7
mov ecx, 0x100b4bf8
call fcn.10010900
mul esi
cmp eax, 0x25
jb 0x1000e8c6
lea ecx, [edx + 0x7fffffec]
cmp ecx, 0x80000000
lea edx, [ecx - 0x80000000]
lea eax, [ecx - 0x80000000]
cmovae eax, edx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x1000ff00
Capabilities:
Read .ini file

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10080d46
mov eax, dword fs:[0]
push eax
push ebx
sub esp, 0x128
mov eax, dword [0x100aa080]
xor eax, ebp
mov dword [ebp - 0x14], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edx, ecx
mov dword [ebp - 4], 1
cmp dword [edx + 0x14], 0xf
jbe 0x1000ff52
mov edx, dword [edx]
cmp dword [ebx + 0x34], 0xf
lea ecx, [ebx + 0x20]
push edx
cmova ecx, dword [ebx + 0x20]
lea edx, [ebp - 0x118]
cmp dword [ebx + 0x1c], 0xf
lea eax, [ebx + 8]
push 0x100
cmova eax, dword [ebx + 8]
push edx
push 0x10090a09
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
test eax, eax
jne 0x1000ff91
mov byte [ebp - 0x119], al
jmp 0x10010037
xorps xmm0, xmm0
mov dword [ebp - 0x124], 0
lea ecx, [ebp - 0x118]
mov dword [ebp - 0x120], 0
movups xmmword [ebp - 0x134], xmm0
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x1000ffb8
sub ecx, edx
lea eax, [ebp - 0x118]
push ecx
push eax
lea ecx, [ebp - 0x134]
call fcn.10007860
mov edi, dword [ebp - 0x120]
lea ecx, [ebp - 0x134]
mov esi, dword [ebp - 0x134]
cmp edi, 0xf
mov edx, dword [ebp - 0x124]
push 4
cmova ecx, esi
push str.TRUE
call fcn.1000e6f0
add esp, 8
mov byte [ebp - 0x119], al
cmp edi, 0xf
jbe 0x10010037
lea ecx, [edi + 1]
mov eax, esi
cmp ecx, 0x1000
jb 0x1001002d
mov esi, dword [eax - 4]
add ecx, 0x23
sub eax, esi
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x100100cf
push ecx
push esi
call fcn.10056fe2
add esp, 8
mov ecx, dword [ebx + 0x1c]
cmp ecx, 0xf
jbe 0x10010067
mov edx, dword [ebx + 8]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x1001005d
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x100100cf
push ecx
push edx
call fcn.10056fe2
add esp, 8
mov ecx, dword [ebx + 0x34]
mov dword [ebx + 0x18], 0
mov dword [ebx + 0x1c], 0xf
mov byte [ebx + 8], 0
cmp ecx, 0xf
jbe 0x100100a9
mov edx, dword [ebx + 0x20]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x1001009f
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x100100cf
push ecx
push edx
call fcn.10056fe2
add esp, 8
mov al, byte [ebp - 0x119]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.10056f9a
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret 0x30
call fcn.1005e284
int3
Function at 0x10010150
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10080d85
mov eax, dword fs:[0]
push eax
sub esp, 0x24
push ebx
push esi
push edi
mov eax, dword [0x100aa080]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov edx, dword [ebp + 0xc]
mov edi, dword [ebp + 8]
mov dword [ebp - 0x1c], edx
mov dword [ebp - 0x24], edi
movzx eax, byte [edx]
xor eax, 0x811c9dc5
imul ecx, eax, 0x1000193
movzx eax, byte [edx + 1]
xor ecx, eax
movzx eax, byte [edx + 2]
imul ecx, ecx, 0x1000193
xor ecx, eax
movzx eax, byte [edx + 3]
imul ecx, ecx, 0x1000193
xor ecx, eax
imul eax, ecx, 0x1000193
mov ecx, ebx
push eax
mov dword [ebp - 0x20], eax
lea eax, [ebp - 0x18]
push edx
push eax
call fcn.100094b0
mov eax, dword [ebp - 0x14]
test eax, eax
je 0x100101da
mov dword [edi], eax
mov byte [edi + 4], 0
jmp 0x1001032f
cmp dword [ebx + 8], 0xaaaaaaa
je 0x10010345
lea eax, [ebx + 4]
mov dword [ebp - 0x2c], eax
mov dword [ebp - 4], 0
push 0x18
mov dword [ebp - 0x28], 0
call fcn.10056fad
mov ecx, dword [ebp - 0x1c]
mov esi, eax
add esp, 4
mov dword [ebp - 0x28], esi
mov ecx, dword [ecx]
mov dword [esi + 8], ecx
mov dword [esi + 0xc], 0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
mov dword [ebp - 4], 1
mov eax, dword [ebx + 8]
inc eax
movss xmm3, dword [ebx]
movd xmm0, eax
cvtdq2pd xmm0, xmm0
shr eax, 0x1f
addsd xmm0, qword [eax*8 + 0x100992d0]
mov eax, dword [ebx + 0x1c]
cvtpd2ps xmm2, xmm0
movd xmm0, eax
cvtdq2pd xmm0, xmm0
shr eax, 0x1f
movaps xmm1, xmm2
addsd xmm0, qword [eax*8 + 0x100992d0]
cvtpd2ps xmm0, xmm0
divss xmm1, xmm0
comiss xmm1, xmm3
jbe 0x100102e2
divss xmm2, xmm3
sub esp, 8
cvtps2pd xmm0, xmm2
movsd qword [ebp - 0x18], xmm0
fld qword [ebp - 0x18]
fstp qword [esp]
call fcn.1007ae40
fstp qword [ebp - 0x18]
movsd xmm0, qword [ebp - 0x18]
add esp, 8
cvtpd2ps xmm0, xmm0
call fcn.1007c8e0
mov ecx, 8
cmp eax, ecx
cmova ecx, eax
mov eax, dword [ebx + 0x1c]
cmp eax, ecx
jae 0x100102c4
cmp eax, 0x200
jae 0x100102c2
shl eax, 3
cmp eax, ecx
jae 0x100102c4
mov eax, ecx
push eax
mov ecx, ebx
call fcn.10008fc0
push dword [ebp - 0x20]
lea eax, [esi + 8]
mov ecx, ebx
push eax
lea eax, [ebp - 0x18]
push eax
call fcn.100094b0
mov edx, dword [eax]
jmp 0x100102e5
mov edx, dword [ebp - 0x18]
mov eax, dword [edx + 4]
inc dword [ebx + 8]
mov edi, dword [ebp - 0x2c]
mov dword [esi + 4], eax
mov dword [esi], edx
mov dword [eax], esi
mov dword [edx + 4], esi
mov ecx, dword [ebx + 0xc]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebx + 0x18]
and eax, dword [ebp - 0x20]
mov ebx, dword [ecx + eax*8]
cmp ebx, dword [edi]
jne 0x10010310
mov dword [ecx + eax*8], esi
jmp 0x10010322
cmp ebx, edx
jne 0x10010319
mov dword [ecx + eax*8], esi
jmp 0x10010326
mov edx, dword [ebp - 0x1c]
cmp dword [ecx + eax*8 + 4], edx
jne 0x10010326
mov dword [ecx + eax*8 + 4], esi
mov edi, dword [ebp - 0x24]
mov dword [edi], esi
mov byte [edi + 4], 1
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
push str.unordered_map_set_too_long
call fcn.100559b6
int3
Function at 0x10010900
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, ecx
push edi
mov dword [ebp - 4], esi
mov eax, dword [esi]
cmp eax, 0x270
jne 0x1001095d
lea edx, [esi + 8]
mov edi, eax
nop dword [eax]
mov ecx, dword [edx]
lea edx, [edx + 4]
xor ecx, dword [edx - 8]
and ecx, 0x7fffffff
xor ecx, dword [edx - 8]
mov eax, ecx
and al, 1
movzx eax, al
neg eax
sbb eax, eax
shr ecx, 1
and eax, 0x9908b0df
xor eax, dword [edx + 0x62c]
xor eax, ecx
mov dword [edx + 0x9b8], eax
sub edi, 1
jne 0x10010920
mov eax, dword [esi]
jmp 0x10010a3b
cmp eax, 0x4e0
jb 0x10010a3b
lea edi, [esi + 0x9c4]
mov esi, 0xe3
push ebx
mov ebx, dword [edi]
lea edx, [edi]
mov eax, ebx
mov ebx, dword [edx + 4]
lea edi, [edx + 4]
mov ecx, ebx
xor ecx, eax
and ecx, 0x7fffffff
xor ecx, eax
mov eax, ecx
and al, 1
movzx eax, al
neg eax
sbb eax, eax
shr ecx, 1
and eax, 0x9908b0df
xor eax, dword [edx + 0x634]
xor eax, ecx
mov dword [edx - 0x9c0], eax
sub esi, 1
jne 0x10010976
mov edi, dword [ebp - 4]
mov esi, 0x18c
add edi, 0xd50
mov ebx, dword [edi]
mov eax, ebx
lea edx, [edi]
mov ebx, dword [edx + 4]
lea edi, [edx + 4]
mov ecx, eax
xor ecx, ebx
and ecx, 0x7fffffff
xor ecx, eax
mov eax, ecx
and al, 1
movzx eax, al
neg eax
sbb eax, eax
shr ecx, 1
and eax, 0x9908b0df
xor eax, dword [edx - 0xd4c]
xor eax, ecx
mov dword [edx - 0x9c0], eax
sub esi, 1
jne 0x100109c1
mov esi, dword [ebp - 4]
pop ebx
mov eax, dword [esi + 0x1380]
mov ecx, dword [esi + 4]
xor ecx, eax
and ecx, 0x7fffffff
xor ecx, eax
mov eax, ecx
and al, 1
movzx eax, al
neg eax
sbb eax, eax
shr ecx, 1
and eax, 0x9908b0df
xor eax, dword [esi + 0x634]
xor eax, ecx
mov dword [esi + 0x9c0], eax
xor eax, eax
mov dword [esi], 0
mov edx, dword [esi + eax*4 + 4]
inc eax
mov dword [esi], eax
mov ecx, edx
mov eax, dword [esi + 0x1384]
shr ecx, 0xb
and eax, ecx
xor edx, eax
mov eax, edx
and eax, 0xff3a58ad
shl eax, 7
xor edx, eax
mov eax, edx
and eax, 0xffffdf8c
shl eax, 0xf
xor edx, eax
mov eax, edx
shr eax, 0x12
pop edi
xor eax, edx
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x100140f0
Capabilities:
Compute adler32 checksum

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
mov edi, edx
movzx esi, cx
mov eax, 0x5e6ea9af
shr ecx, 0x10
mul dword [ebp + 8]
mov dword [ebp - 0x10], ecx
shr edx, 0xb
imul eax, edx, 0x15b0
mov edx, dword [ebp + 8]
mov ebx, edx
sub ebx, eax
mov dword [ebp - 4], ebx
test edi, edi
jne 0x1001412d
lea eax, [edi + 1]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
test edx, edx
je 0x10014243
xor edx, edx
mov dword [ebp - 8], edx
cmp ebx, 7
jbe 0x100141a4
mov eax, 7
sub eax, edi
mov dword [ebp - 0x10], eax
nop dword [eax]
movzx eax, byte [edi]
add edx, 8
add esi, eax
movzx eax, byte [edi + 1]
add ecx, esi
add esi, eax
movzx eax, byte [edi + 2]
add ecx, esi
add esi, eax
movzx eax, byte [edi + 3]
add ecx, esi
add esi, eax
movzx eax, byte [edi + 4]
add ecx, esi
add esi, eax
movzx eax, byte [edi + 5]
add ecx, esi
add esi, eax
movzx eax, byte [edi + 6]
add ecx, esi
add esi, eax
movzx eax, byte [edi + 7]
add ecx, esi
add edi, 8
add esi, eax
mov eax, dword [ebp - 0x10]
add eax, edi
add ecx, esi
cmp eax, ebx
jb 0x10014150
mov dword [ebp - 8], edx
mov dword [ebp - 0x10], ecx
mov eax, dword [ebp - 4]
xor ebx, ebx
xor edx, edx
cmp dword [ebp - 8], eax
jae 0x10014205
sub eax, dword [ebp - 8]
cmp eax, 2
jb 0x100141f8
mov eax, dword [ebp - 8]
mov ecx, ebx
mov edx, dword [ebp - 4]
sub edx, eax
sub edx, 2
shr edx, 1
inc edx
lea eax, [eax + edx*2]
mov dword [ebp - 8], eax
nop
movzx eax, byte [edi]
add esi, eax
movzx eax, byte [edi + 1]
add ebx, esi
add edi, 2
add esi, eax
add ecx, esi
sub edx, 1
jne 0x100141d0
mov eax, dword [ebp - 8]
mov dword [ebp - 0xc], ecx
mov ecx, dword [ebp - 0x10]
mov edx, dword [ebp - 0xc]
cmp eax, dword [ebp - 4]
jae 0x10014200
movzx eax, byte [edi]
add esi, eax
add ecx, esi
inc edi
lea eax, [edx + ebx]
add ecx, eax
mov eax, 0x80078071
mov ebx, 0x15b0
mul esi
shr edx, 0xf
imul eax, edx, 0xffff000f
add esi, eax
mov eax, 0x80078071
mul ecx
shr edx, 0xf
imul eax, edx, 0xffff000f
add ecx, eax
mov eax, dword [ebp + 8]
sub eax, dword [ebp - 4]
mov dword [ebp - 0x10], ecx
mov dword [ebp + 8], eax
mov dword [ebp - 4], ebx
jne 0x10014135
shl ecx, 0x10
pop edi
lea eax, [esi + ecx]
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x10014250
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
not ecx
cmp esi, 4
jb 0x100142bb
push edi
mov edi, esi
shr edi, 2
movzx eax, byte [edx]
sub esi, 4
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x10091c58]
movzx eax, byte [edx + 1]
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x10091c58]
movzx eax, byte [edx + 2]
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x10091c58]
movzx eax, byte [edx + 3]
add edx, 4
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x10091c58]
sub edi, 1
jne 0x10014264
pop edi
test esi, esi
je 0x100142da
nop
movzx eax, byte [edx]
lea edx, [edx + 1]
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x10091c58]
sub esi, 1
jne 0x100142c0
not ecx
mov eax, ecx
pop esi
pop ebp
ret
Function at 0x1001a3f0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x14
mov eax, dword [0x100aa080]
xor eax, esp
mov dword [esp + 0x10], eax
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
mov edi, ecx
mov dword [esp + 0x14], eax
mov dword [esp + 0x10], edi
mov esi, edx
cmp edi, 0xffffffff
je 0x1001a507
push edi
call dword [sym.imp.KERNEL32.dll_GetFileType]
test eax, eax
jne 0x1001a438
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x1001a507
mov ebx, 1
nop dword [eax]
cmp dword [esi + 0x14], 0xf
mov eax, esi
jbe 0x1001a44a
mov eax, dword [esi]
push 0x1001a3d0
push dword [esp + 0x18]
push dword [esi + 0x10]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_WriteFileEx]
test eax, eax
jne 0x1001a51b
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 0
push 0
mov edi, eax
mov dword [esp + 0x20], 0
lea eax, [esp + 0x20]
push eax
push 0x400
push edi
push 0
push 0x1300
call dword [sym.imp.KERNEL32.dll_FormatMessageA]
cmp edi, 0xe8
je 0x1001a4f1
mov eax, dword [esp + 0x18]
test eax, eax
je 0x1001a4e2
push eax
push edi
push ebx
push str.WriteFileEx_failed_on_attempt__i_with_error__u:__s
call fcn.10032f40
add esp, 0x10
mov eax, esi
cmp dword [esi + 0x14], 0xf
jbe 0x1001a4bc
mov eax, dword [esi]
push dword [esp + 0x14]
mov edi, dword [esp + 0x14]
push dword [esi + 0x10]
push eax
push edi
push str.Parameters___i____s____i____i_
call fcn.10032f40
add esp, 0x14
push dword [esp + 0x18]
call dword [sym.imp.KERNEL32.dll_LocalFree]
jmp 0x1001a4f5
push edi
push ebx
push str.WriteFileEx_failed_on_attempt__i_with_error__u
call fcn.10032f40
add esp, 0xc
mov edi, dword [esp + 0x10]
push 0xa
call dword [sym.imp.KERNEL32.dll_Sleep]
inc ebx
cmp ebx, 3
jle 0x1001a440
xor al, al
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x10]
xor ecx, esp
call fcn.10056f9a
mov esp, ebp
pop ebp
ret
mov ecx, dword [esp + 0x1c]
mov al, 1
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.10056f9a
mov esp, ebp
pop ebp
ret