joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10001dc0
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov ecx, 0x102b716e
push ebx
push esi
push edi
call fcn.10124b2c
mov esi, dword [ebp + 8]
mov ebx, dword [ebp + 0xc]
lea ecx, [esi - 0x10000]
movzx eax, cx
mov edi, ecx
sub edi, eax
test eax, eax
cmove edi, ecx
cmp edi, ebx
jbe 0x10001e8b
cmp edi, dword [section..data]
jb 0x10001e0b
cmp edi, dword [0x101e6004]
ja 0x10001e0b
sub edi, 0x8000000
jmp 0x10001e83
push 0x1c
lea eax, [ebp - 0x1c]
mov dword [ebp - 4], 0
xorps xmm0, xmm0
push eax
push edi
movups xmmword [ebp - 0x1c], xmm0
movq qword [ebp - 0xc], xmm0
call sub.KERNEL32.dll_VirtualQuery
test eax, eax
je 0x10001e8b
cmp dword [ebp - 0xc], 0x10000
jne 0x10001e6e
cmp dword [ebp - 0x10], 0x10000
jb 0x10001e6e
push 0x40
push 0x3000
push 0x10000
push edi
call sub.KERNEL32.dll_VirtualAlloc
test eax, eax
jne 0x10001f3d
call sub.KERNEL32.dll_GetLastError
cmp eax, 0x677
je 0x10001e8b
sub edi, 0x10000
jmp 0x10001e83
mov ecx, dword [ebp - 0x18]
add ecx, 0xffff0000
mov edi, ecx
movzx eax, di
sub edi, eax
test eax, eax
cmove edi, ecx
cmp edi, ebx
ja 0x10001df3
movzx eax, si
test eax, eax
je 0x10001e9a
sub esi, eax
add esi, 0x10000
mov edi, dword [ebp + 0x10]
cmp esi, edi
jae 0x10001f3b
cmp esi, dword [section..data]
jb 0x10001ebd
cmp esi, dword [0x101e6004]
ja 0x10001ebd
add esi, 0x8000000
jmp 0x10001f33
push 0x1c
lea eax, [ebp - 0x1c]
mov dword [ebp - 4], 0
xorps xmm0, xmm0
push eax
push esi
movups xmmword [ebp - 0x1c], xmm0
movq qword [ebp - 0xc], xmm0
call sub.KERNEL32.dll_VirtualQuery
test eax, eax
je 0x10001f3b
cmp dword [ebp - 0xc], 0x10000
mov ecx, dword [ebp - 0x10]
jne 0x10001f1e
cmp ecx, 0x10000
jb 0x10001f1e
push 0x40
push 0x3000
push 0x10000
push esi
call sub.KERNEL32.dll_VirtualAlloc
test eax, eax
jne 0x10001f3d
call sub.KERNEL32.dll_GetLastError
cmp eax, 0x677
je 0x10001f3b
add esi, 0x10000
jmp 0x10001f33
mov esi, dword [ebp - 0x1c]
add esi, ecx
movzx ecx, si
test ecx, ecx
je 0x10001f33
mov eax, 0x10000
sub eax, ecx
add esi, eax
cmp esi, edi
jb 0x10001ea5
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10002910
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
push ecx
mov ecx, 0x102b716e
call fcn.10124b2c
call sub.KERNEL32.dll_GetCurrentThreadId
cmp dword [0x101e7f58], eax
je 0x10002936
mov eax, 0x10dd
mov esp, ebp
pop ebp
ret 8
mov eax, dword [0x101e7f5c]
test eax, eax
jne 0x10002a4b
push esi
mov esi, dword [ebp + 0xc]
test esi, esi
jne 0x10002955
lea eax, [esi + 0x57]
pop esi
mov esp, ebp
pop ebp
ret 8
push ebx
mov ebx, dword [ebp + 8]
test ebx, ebx
je 0x10002972
cmp dword [ebx], 0
jne 0x1000297f
mov dword [0x101e7f5c], 6
mov dword [0x101e7f60], ebx
pop ebx
mov eax, 6
pop esi
mov esp, ebp
pop ebp
ret 8
push edi
push 0x18
call fcn.10124b6c
mov edi, eax
add esp, 4
test edi, edi
jne 0x10002998
lea esi, [eax + 8]
jmp 0x10002a2b
push 0
push dword [ebx]
call fcn.10002870
push 0
push esi
mov dword [ebp + 0xc], eax
call fcn.10002870
mov esi, dword [ebp + 0xc]
mov edx, eax
movzx ecx, byte [esi + 0x36]
mov eax, dword [esi + 0x40]
sub eax, ecx
mov dword [ebp + 0xc], eax
test ecx, ecx
je 0x10002a1d
cmp ecx, 0x1e
ja 0x10002a1d
cmp dword [esi + 0x44], edx
jne 0x10002a1d
lea edx, [ebp - 4]
mov dword [ebp - 4], 0
push edx
push 0x40
push ecx
push eax
call sub.KERNEL32.dll_VirtualProtect
test eax, eax
jne 0x100029ec
call sub.KERNEL32.dll_GetLastError
mov esi, eax
jmp 0x10002a2b
mov eax, dword [ebp + 0xc]
mov dword [edi + 0xc], eax
mov dword [edi + 8], ebx
mov dword [edi + 0x10], esi
mov dword [edi + 4], 1
mov eax, dword [ebp - 4]
mov dword [edi + 0x14], eax
mov eax, dword [0x101e7f68]
mov dword [edi], eax
xor eax, eax
mov dword [0x101e7f68], edi
pop edi
pop ebx
pop esi
mov esp, ebp
pop ebp
ret 8
cmp dword [0x101e7f50], 0
mov esi, 9
jne 0x10002a35
mov dword [0x101e7f5c], esi
test edi, edi
je 0x10002a40
push 0x18
push edi
call fcn.10124b9c
add esp, 8
pop edi
mov dword [0x101e7f60], ebx
mov eax, esi
pop ebx
pop esi
mov esp, ebp
pop ebp
ret 8

Function at 0x10002a60
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
push ecx
mov ecx, 0x102b716e
call fcn.10124b2c
cmp dword [0x101e7f58], 0
jne 0x10002ade
call sub.KERNEL32.dll_GetCurrentThreadId
mov ecx, eax
mov edx, 0x101e7f58
xor eax, eax
lock cmpxchg dword [edx], ecx
test eax, eax
jne 0x10002ade
push esi
mov esi, dword [0x101e7f48]
mov dword [0x101e7f68], eax
mov dword [0x101e7f64], eax
mov dword [0x101e7f60], eax
test esi, esi
je 0x10002ac3
lea eax, [ebp - 4]
push eax
push 0x40
push 0x10000
push esi
call sub.KERNEL32.dll_VirtualProtect
test eax, eax
je 0x10002acf
mov esi, dword [esi + 4]
test esi, esi
jne 0x10002aa7
xor eax, eax
mov dword [0x101e7f5c], eax
pop esi
mov esp, ebp
pop ebp
ret
call sub.KERNEL32.dll_GetLastError
mov dword [0x101e7f5c], eax
pop esi
mov esp, ebp
pop ebp
ret
mov eax, 0x10dd
mov esp, ebp
pop ebp
ret
Function at 0x10002f90
Capabilities:
Suspend thread

Disassembly:
push ebp
mov ebp, esp
mov ecx, 0x102b716e
call fcn.10124b2c
mov eax, dword [0x101e7f5c]
test eax, eax
jne 0x10003019
push edi
call sub.KERNEL32.dll_GetCurrentThread
mov edi, dword [ebp + 8]
cmp edi, eax
jne 0x10002fba
xor eax, eax
pop edi
pop ebp
ret 4
push esi
push 8
call fcn.10124b6c
mov esi, eax
add esp, 4
test esi, esi
jne 0x10002fd0
lea edi, [eax + 8]
jmp 0x10002fed
push edi
call sub.KERNEL32.dll_SuspendThread
cmp eax, 0xffffffff
jne 0x10003005
call sub.KERNEL32.dll_GetLastError
mov edi, eax
push 8
push esi
call fcn.10124b9c
add esp, 8
pop esi
mov dword [0x101e7f5c], edi
mov eax, edi
mov dword [0x101e7f60], 0
pop edi
pop ebp
ret 4
mov eax, dword [0x101e7f64]
mov dword [esi + 4], edi
mov dword [esi], eax
xor eax, eax
mov dword [0x101e7f64], esi
pop esi
pop edi
pop ebp
ret 4
Function at 0x10013fd0
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, ecx
mov ecx, 0x102b78aa
call fcn.10124b2c
mov eax, dword [edi + 0xe4]
lea edx, [ebp + 8]
mov ebx, dword [edi + 0xec]
mov esi, 4
mov ebx, dword [ebx + eax*4 - 4]
not ebx
nop dword [eax]
movzx eax, byte [edx]
lea edx, [edx + 1]
movzx ecx, bl
xor ecx, eax
shr ebx, 8
xor ebx, dword [ecx*4 + 0x101672d0]
sub esi, 1
jne 0x10014000
mov eax, dword [edi]
not ebx
cmp dword [eax + 0x3e74], ebx
jne 0x10014035
push esi
push dword [ebp + 8]
push 4
push ebx
call fcn.10011ab0
add esp, 0x10
pop edi
pop esi
mov eax, ebx
pop ebx
pop ebp
ret 4

Function at 0x100140b0
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, ecx
mov ecx, 0x102b78aa
call fcn.10124b2c
mov eax, dword [edi + 0xe4]
lea edx, [ebp + 8]
mov ebx, dword [edi + 0xec]
mov esi, 4
mov ebx, dword [ebx + eax*4 - 4]
not ebx
nop dword [eax]
movzx eax, byte [edx]
lea edx, [edx + 1]
movzx ecx, bl
xor ecx, eax
shr ebx, 8
xor ebx, dword [ecx*4 + 0x101672d0]
sub esi, 1
jne 0x100140e0
mov eax, dword [edi]
not ebx
cmp dword [eax + 0x3e74], ebx
jne 0x10014115
push esi
push dword [ebp + 8]
push 0xc
push ebx
call fcn.10011ab0
add esp, 0x10
pop edi
pop esi
mov eax, ebx
pop ebx
pop ebp
ret 4

Function at 0x10014120
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push esi
mov esi, ecx
mov ecx, 0x102b78aa
push edi
call fcn.10124b2c
mov eax, dword [ebp + 8]
mov edi, 0x10
movss xmm1, dword [esi + 0x100]
movss xmm2, dword [esi + 0x104]
mov ecx, dword [esi + 0xe4]
movss xmm0, dword [eax]
subss xmm0, xmm1
movss dword [ebp - 0x10], xmm0
movss xmm0, dword [eax + 4]
subss xmm0, xmm2
movss dword [ebp - 0xc], xmm0
movss xmm0, dword [eax + 8]
subss xmm0, xmm1
movss dword [ebp - 8], xmm0
movss xmm0, dword [eax + 0xc]
mov eax, dword [esi + 0xec]
subss xmm0, xmm2
lea esi, [ebp - 0x10]
mov edx, dword [eax + ecx*4 - 4]
movss dword [ebp - 4], xmm0
not edx
nop dword [eax + eax]
movzx eax, byte [esi]
lea esi, [esi + 1]
movzx ecx, dl
xor ecx, eax
shr edx, 8
xor edx, dword [ecx*4 + 0x101672d0]
sub edi, 1
jne 0x100141a0
pop edi
not edx
pop esi
mov eax, edx
mov esp, ebp
pop ebp
ret 4
Function at 0x100159f0
Capabilities:
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov ecx, 0x102b78aa
call fcn.10124b2c
mov ebx, dword [ebp + 0x10]
mov edi, dword [ebp + 0xc]
not ebx
mov esi, dword [ebp + 8]
mov eax, ebx
test edi, edi
je 0x10015a5d
mov cl, byte [esi]
lea esi, [esi + 1]
dec edi
cmp cl, 0x23
jne 0x10015a40
cmp edi, 2
jb 0x10015a40
cmp byte [esi], cl
jne 0x10015a40
cmp byte [esi + 1], cl
jne 0x10015a40
mov eax, ebx
movzx ecx, cl
movzx edx, al
xor edx, ecx
shr eax, 8
xor eax, dword [edx*4 + 0x101672d0]
jmp 0x10015a11
movzx edx, al
movzx ecx, cl
xor edx, ecx
shr eax, 8
xor eax, dword [edx*4 + 0x101672d0]
test edi, edi
jne 0x10015a11
pop edi
pop esi
not eax
pop ebx
pop ebp
ret
mov cl, byte [esi]
inc esi
test cl, cl
je 0x10015a8c
cmp cl, 0x23
jne 0x10015a73
cmp byte [esi], cl
jne 0x10015a73
cmp byte [esi + 1], cl
cmove eax, ebx
movzx edx, al
movzx ecx, cl
xor edx, ecx
shr eax, 8
mov cl, byte [esi]
inc esi
xor eax, dword [edx*4 + 0x101672d0]
test cl, cl
jne 0x10015a64
pop edi
pop esi
not eax
pop ebx
pop ebp
ret
Function at 0x10015d40
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov ecx, 0x102b78aa
push ebx
push esi
push edi
call fcn.10124b2c
mov eax, dword [ebp + 8]
xor ecx, ecx
mov esi, dword [ebp + 0xc]
mov dword [ebp - 0x10], ecx
test esi, esi
je 0x10015d6a
cmp eax, esi
jae 0x10015ebe
mov bl, byte [eax]
test bl, bl
je 0x10015ebe
movzx ecx, bl
mov edx, esi
shr ecx, 3
movsx edi, byte [ecx + 0x10167c30]
xor ecx, ecx
test edi, edi
mov dword [ebp - 8], edi
sete cl
add ecx, edi
mov dword [ebp - 0xc], ecx
test esi, esi
jne 0x10015d99
lea edx, [ecx + eax]
cmp eax, edx
lea esi, [eax + 1]
sbb cl, cl
and cl, bl
mov byte [ebp - 4], cl
cmp esi, edx
jae 0x10015dad
mov bh, byte [esi]
jmp 0x10015daf
xor bh, bh
lea esi, [eax + 2]
mov byte [ebp - 3], bh
cmp esi, edx
jae 0x10015dbd
mov ch, byte [esi]
jmp 0x10015dbf
xor ch, ch
lea esi, [eax + 3]
mov byte [ebp - 2], ch
cmp esi, edx
jae 0x10015dcd
mov bl, byte [esi]
jmp 0x10015dcf
xor bl, bl
mov edi, dword [edi*4 + 0x10167c50]
movzx edx, ch
movzx ecx, cl
and edi, ecx
movzx esi, bh
shl edi, 6
mov ecx, esi
and ecx, 0x3f
mov byte [ebp - 1], bl
or edi, ecx
movzx ebx, bl
shl edi, 6
mov ecx, edx
and ecx, 0x3f
and edx, 0xc0
or edi, ecx
and esi, 0xc0
mov ecx, ebx
shl edi, 6
and ecx, 0x3f
shr ebx, 2
or edi, ecx
or ebx, edx
mov ecx, dword [ebp - 8]
shr ebx, 2
or ebx, esi
mov esi, dword [ebp - 8]
shr ebx, 2
mov ecx, dword [ecx*4 + 0x10167c78]
shr edi, cl
cmp edi, dword [esi*4 + 0x10167c64]
sbb ecx, ecx
xor edx, edx
and ecx, 0x40
or ebx, ecx
mov ecx, edi
and ecx, 0xfffff800
cmp ecx, 0xd800
mov ecx, 0x80
cmove edx, ecx
mov ecx, 0xffff
or ebx, edx
cmp ecx, edi
sbb ecx, ecx
and ecx, 0x100
or ebx, ecx
mov ecx, dword [esi*4 + 0x10167c8c]
xor ebx, 0x2a
sar ebx, cl
test ebx, ebx
je 0x10015eb0
xor edx, edx
cmp byte [ebp - 1], dl
setne dl
xor ecx, ecx
cmp byte [ebp - 2], cl
setne cl
add edx, ecx
xor ecx, ecx
cmp byte [ebp - 3], cl
setne cl
add edx, ecx
xor ecx, ecx
cmp byte [ebp - 4], cl
setne cl
add edx, ecx
cmp dword [ebp - 0xc], edx
cmovl edx, dword [ebp - 0xc]
mov ecx, edx
add eax, ecx
mov ecx, dword [ebp - 0x10]
inc ecx
jmp 0x10015d58
mov ecx, dword [ebp - 0xc]
add eax, ecx
mov ecx, dword [ebp - 0x10]
inc ecx
jmp 0x10015d58
pop edi
pop esi
mov eax, ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10015f30
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
mov ecx, 0x102b78aa
call fcn.10124b2c
mov ebx, dword [ebp + 8]
mov ecx, ebx
mov eax, dword [ebp + 0xc]
dec eax
mov dword [ebp - 0x14], ecx
lea eax, [ebx + eax*2]
mov dword [ebp - 0x18], eax
cmp ebx, eax
mov eax, dword [ebp + 0x10]
jae 0x100160ec
push esi
mov esi, dword [ebp + 0x14]
mov dword [ebp - 0x10], eax
push edi
test esi, esi
je 0x10015f72
cmp eax, esi
jae 0x100160e7
mov bl, byte [eax]
mov byte [ebp + 0xf], bl
test bl, bl
je 0x100160e7
movzx ecx, bl
mov edx, esi
shr ecx, 3
xor ebx, ebx
movsx ecx, byte [ecx + 0x10167c30]
test ecx, ecx
mov dword [ebp - 0xc], ecx
sete bl
add ebx, ecx
test esi, esi
jne 0x10015fa1
lea edx, [ebx + eax]
cmp eax, edx
lea esi, [eax + 1]
sbb cl, cl
and cl, byte [ebp + 0xf]
mov byte [ebp - 3], cl
cmp esi, edx
jae 0x10015fb9
mov ch, byte [esi]
mov byte [ebp + 0xf], ch
jmp 0x10015fbd
mov byte [ebp + 0xf], 0
lea esi, [eax + 2]
cmp esi, edx
jae 0x10015fc8
mov ch, byte [esi]
jmp 0x10015fca
xor ch, ch
lea esi, [eax + 3]
mov byte [ebp - 2], ch
cmp esi, edx
jae 0x10015fd8
mov al, byte [esi]
jmp 0x10015fda
xor al, al
movzx esi, byte [ebp + 0xf]
movzx edx, ch
movzx ecx, cl
movzx edi, al
mov byte [ebp - 1], al
mov eax, dword [ebp - 0xc]
mov eax, dword [eax*4 + 0x10167c50]
and eax, ecx
mov ecx, esi
and ecx, 0x3f
mov dword [ebp - 8], eax
shl dword [ebp - 8], 6
and esi, 0xc0
or dword [ebp - 8], ecx
mov ecx, edx
shl dword [ebp - 8], 6
and ecx, 0x3f
or dword [ebp - 8], ecx
and edx, 0xc0
shl dword [ebp - 8], 6
mov ecx, edi
mov eax, dword [ebp - 8]
and ecx, 0x3f
or eax, ecx
shr edi, 2
mov ecx, dword [ebp - 0xc]
or edi, edx
shr edi, 2
or edi, esi
shr edi, 2
mov ecx, dword [ecx*4 + 0x10167c78]
shr eax, cl
mov esi, eax
mov dword [ebp - 8], eax
mov eax, dword [ebp - 0xc]
cmp esi, dword [eax*4 + 0x10167c64]
sbb ecx, ecx
xor edx, edx
and ecx, 0x40
or edi, ecx
mov ecx, esi
and ecx, 0xfffff800
cmp ecx, 0xd800
mov ecx, 0x80
cmove edx, ecx
mov ecx, 0xffff
or edi, edx
cmp ecx, esi
sbb ecx, ecx
and ecx, 0x100
or edi, ecx
mov ecx, dword [eax*4 + 0x10167c8c]
mov eax, dword [ebp - 0x10]
xor edi, 0x2a
sar edi, cl
test edi, edi
je 0x100160ca
xor edx, edx
mov esi, 0xfffd
cmp byte [ebp - 1], dl
setne dl
xor ecx, ecx
cmp byte [ebp - 2], cl
setne cl
add edx, ecx
xor ecx, ecx
cmp byte [ebp + 0xf], cl
setne cl
add edx, ecx
xor ecx, ecx
cmp byte [ebp - 3], cl
setne cl
add edx, ecx
cmp ebx, edx
cmovl edx, ebx
mov ebx, edx
mov ecx, dword [ebp - 0x14]
add eax, ebx
mov dword [ebp - 0x10], eax
mov word [ecx], si
add ecx, 2
mov esi, dword [ebp + 0x14]
mov dword [ebp - 0x14], ecx
cmp ecx, dword [ebp - 0x18]
jb 0x10015f66
mov ebx, dword [ebp + 8]
pop edi
pop esi
xor edx, edx
mov word [ecx], dx
mov edx, dword [ebp + 0x18]
test edx, edx
je 0x100160fa
mov dword [edx], eax
sub ecx, ebx
sar ecx, 1
mov eax, ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10024140
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push edi
mov ecx, 0x102b78aa
call fcn.10124b2c
mov edi, dword [0x101e88b0]
cmp byte [edi + 0x5a21], 0
lea eax, [edi + 0x20]
jne 0x10024290
mov ecx, dword [eax]
push ebx
test ecx, ecx
je 0x10024288
push esi
push 0x101688d0
push ecx
call fcn.10014dc0
mov esi, eax
add esp, 8
test esi, esi
je 0x10024284
push esi
call fcn.10136260
add esp, 4
mov dword [ebp - 4], eax
cmp eax, 0xffffffff
je 0x1002427b
push 2
push 0
push esi
call fcn.10135b48
add esp, 0xc
test eax, eax
jne 0x1002427b
push esi
call fcn.10136260
mov ebx, eax
add esp, 4
cmp ebx, 0xffffffff
je 0x1002427b
push 0
push dword [ebp - 4]
push esi
call fcn.10135b48
add esp, 0xc
test eax, eax
jne 0x1002427b
mov eax, dword [0x101e88b0]
test eax, eax
je 0x100241ec
inc dword [eax + 0xb4]
push dword [0x101e88b8]
push ebx
call dword [0x101e6104]
add esp, 8
mov dword [ebp - 4], eax
test eax, eax
je 0x1002427b
push esi
push ebx
push 1
push eax
call fcn.10135779
add esp, 0x10
push esi
cmp eax, ebx
je 0x10024241
call fcn.101351fa
mov eax, dword [0x101e88b0]
add esp, 4
test eax, eax
je 0x1002422c
dec dword [eax + 0xb4]
push dword [0x101e88b8]
mov esi, dword [ebp - 4]
push esi
call dword [0x101e6108]
add esp, 8
jmp 0x10024284
call fcn.101351fa
mov esi, dword [ebp - 4]
add esp, 4
test ebx, ebx
je 0x1002425a
push ebx
push esi
call fcn.10017c80
add esp, 8
mov eax, dword [0x101e88b0]
test eax, eax
je 0x10024269
dec dword [eax + 0xb4]
push dword [0x101e88b8]
push esi
call dword [0x101e6108]
add esp, 8
jmp 0x10024284
push esi
call fcn.101351fa
add esp, 4
lea eax, [edi + 0x20]
pop esi
mov byte [edi + 0x5a21], 1
pop ebx
movss xmm0, dword [edi + 0x5a24]
xorps xmm1, xmm1
comiss xmm0, xmm1
jbe 0x100242e1
subss xmm0, dword [edi + 0x18]
comiss xmm1, xmm0
movss dword [edi + 0x5a24], xmm0
jb 0x100242e1
mov eax, dword [eax]
test eax, eax
je 0x100242d0
push eax
call fcn.1001fd00
add esp, 4
mov dword [edi + 0x5a24], 0
pop edi
mov esp, ebp
pop ebp
ret
mov byte [edi + 0x9c], 1
mov dword [edi + 0x5a24], 0
pop edi
mov esp, ebp
pop ebp
ret
Function at 0x10029360
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10158480
mov eax, dword fs:[0]
push eax
push ebx
push esi
push edi
mov eax, dword [0x101e6b6c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov ecx, 0x102b78f4
call fcn.10124b2c
xor ebx, ebx
cmp dword [esi + 0x54], ebx
jle 0x100293cd
xor edi, edi
nop word [eax + eax]
mov eax, dword [esi + 0x5c]
mov ecx, dword [edi + eax]
test ecx, ecx
je 0x100293c4
cmp byte [edi + eax + 8], 0
je 0x100293c4
push ecx
call fcn.10018290
mov eax, dword [esi + 0x5c]
add esp, 4
mov dword [edi + eax], 0
inc ebx
add edi, 0x78
cmp ebx, dword [esi + 0x54]
jl 0x100293a0
xor edx, edx
cmp dword [esi + 0x3c], edx
jle 0x1002940d
mov eax, dword [esi + 0x44]
mov edi, dword [eax + edx*4]
mov eax, dword [esi + 0x5c]
mov ebx, dword [edi + 0x34]
cmp ebx, eax
jb 0x10029407
mov ecx, dword [esi + 0x54]
shl ecx, 4
sub ecx, dword [esi + 0x54]
lea eax, [eax + ecx*8]
cmp ebx, eax
jae 0x10029407
mov dword [edi + 0x34], 0
xor ecx, ecx
mov eax, dword [esi + 0x44]
mov eax, dword [eax + edx*4]
mov word [eax + 0x38], cx
inc edx
cmp edx, dword [esi + 0x3c]
jl 0x100293d4
mov eax, dword [esi + 0x5c]
test eax, eax
je 0x10029432
push eax
mov dword [esi + 0x58], 0
mov dword [esi + 0x54], 0
call fcn.10018290
add esp, 4
mov dword [esi + 0x5c], 0
mov eax, dword [esi + 0x50]
test eax, eax
je 0x10029457
push eax
mov dword [esi + 0x4c], 0
mov dword [esi + 0x48], 0
call fcn.10018290
add esp, 4
mov dword [esi + 0x50], 0
mov eax, dword [esi + 0x1c]
mov dword [esi + 0x46c], 0xffffffff
mov dword [esi + 0x468], 0xffffffff
test eax, eax
je 0x1002947b
push eax
call fcn.10018290
add esp, 4
mov eax, dword [esi + 0x20]
test eax, eax
je 0x1002948b
push eax
call fcn.10018290
add esp, 4
xor ebx, ebx
mov dword [esi + 0x1c], 0
mov dword [esi + 0x20], 0
mov byte [esi + 0x19], 0
cmp dword [esi + 0x3c], ebx
jle 0x1002950e
mov eax, dword [esi + 0x44]
mov edi, dword [eax + ebx*4]
test edi, edi
je 0x10029508
mov ecx, edi
mov dword [ebp - 4], 0
call fcn.10029630
mov eax, dword [edi + 0x28]
mov byte [ebp - 4], 1
test eax, eax
je 0x100294d0
push eax
call fcn.10018290
add esp, 4
mov eax, dword [edi + 0x1c]
mov byte [ebp - 4], 2
test eax, eax
je 0x100294e4
push eax
call fcn.10018290
add esp, 4
mov eax, dword [edi + 8]
mov byte [ebp - 4], 3
test eax, eax
je 0x100294f8
push eax
call fcn.10018290
add esp, 4
push edi
mov dword [ebp - 4], 0xffffffff
call fcn.10018290
add esp, 4
inc ebx
cmp ebx, dword [esi + 0x3c]
jl 0x100294a4
mov eax, dword [esi + 0x44]
test eax, eax
je 0x10029533
push eax
mov dword [esi + 0x40], 0
mov dword [esi + 0x3c], 0
call fcn.10018290
add esp, 4
mov dword [esi + 0x44], 0
mov byte [esi + 0x18], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1002daf0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push esi
mov esi, ecx
mov ecx, 0x102b78f4
call fcn.10124b2c
mov eax, dword [esi + 8]
test eax, eax
je 0x1002db21
push eax
mov dword [esi + 4], 0
mov dword [esi], 0
call fcn.10018290
add esp, 4
mov dword [esi + 8], 0
mov eax, dword [esi + 0x14]
test eax, eax
je 0x1002db46
push eax
mov dword [esi + 0x10], 0
mov dword [esi + 0xc], 0
call fcn.10018290
add esp, 4
mov dword [esi + 0x14], 0
mov eax, dword [esi + 0x20]
test eax, eax
je 0x1002db6b
push eax
mov dword [esi + 0x1c], 0
mov dword [esi + 0x18], 0
call fcn.10018290
add esp, 4
mov dword [esi + 0x20], 0
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x34], 0
mov dword [esi + 0x38], 0
mov eax, dword [esi + 0x44]
test eax, eax
je 0x1002dbac
push eax
mov dword [esi + 0x40], 0
mov dword [esi + 0x3c], 0
call fcn.10018290
add esp, 4
mov dword [esi + 0x44], 0
mov eax, dword [esi + 0x50]
test eax, eax
je 0x1002dbd1
push eax
mov dword [esi + 0x4c], 0
mov dword [esi + 0x48], 0
call fcn.10018290
add esp, 4
mov dword [esi + 0x50], 0
mov eax, dword [esi + 0x5c]
test eax, eax
je 0x1002dbf6
push eax
mov dword [esi + 0x58], 0
mov dword [esi + 0x54], 0
call fcn.10018290
add esp, 4
mov dword [esi + 0x5c], 0
lea ecx, [esi + 0x78]
pop esi
jmp fcn.10029550
Function at 0x1002ec70
Capabilities:
Compute adler32 checksum

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push esi
push edi
mov ecx, 0x102b78f4
call fcn.10124b2c
mov edi, dword [ebp + 0x10]
mov eax, 0x5e6ea9af
mov esi, dword [ebp + 8]
mul edi
movzx ecx, si
shr edx, 0xb
imul eax, edx, 0x15b0
mov edx, edi
shr esi, 0x10
mov dword [ebp + 8], esi
sub edx, eax
mov dword [ebp - 4], edx
test edi, edi
je 0x1002edc5
mov edi, dword [ebp + 0xc]
push ebx
xor ebx, ebx
cmp edx, 7
jbe 0x1002ed16
mov eax, 7
sub eax, edi
mov dword [ebp + 8], eax
movzx eax, byte [edi]
add ebx, 8
add ecx, eax
movzx eax, byte [edi + 1]
add esi, ecx
add ecx, eax
movzx eax, byte [edi + 2]
add esi, ecx
add ecx, eax
movzx eax, byte [edi + 3]
add esi, ecx
add ecx, eax
movzx eax, byte [edi + 4]
add esi, ecx
add ecx, eax
movzx eax, byte [edi + 5]
add esi, ecx
add ecx, eax
movzx eax, byte [edi + 6]
add esi, ecx
add ecx, eax
movzx eax, byte [edi + 7]
add esi, ecx
add edi, 8
add ecx, eax
mov eax, dword [ebp + 8]
add eax, edi
add esi, ecx
cmp eax, edx
jb 0x1002ecc5
mov dword [ebp + 8], esi
mov eax, dword [ebp - 4]
xor edx, edx
mov dword [ebp - 0xc], 0
cmp ebx, eax
jae 0x1002ed89
sub eax, ebx
cmp eax, 2
jb 0x1002ed75
mov edx, dword [ebp - 4]
sub edx, ebx
sub edx, 2
shr edx, 1
inc edx
lea eax, [ebx + edx*2]
mov ebx, dword [ebp - 0xc]
mov dword [ebp - 0x10], eax
mov esi, ebx
movzx eax, byte [edi]
add ecx, eax
movzx eax, byte [edi + 1]
add ebx, ecx
add edi, 2
add ecx, eax
add esi, ecx
sub edx, 1
jne 0x1002ed43
mov eax, dword [ebp - 0x10]
mov dword [ebp - 8], esi
mov esi, dword [ebp + 8]
cmp eax, dword [ebp - 4]
jae 0x1002ed81
movzx eax, byte [edi]
mov edx, dword [ebp - 8]
add ecx, eax
add esi, ecx
inc edi
jmp 0x1002ed84
movzx eax, byte [edi]
mov ebx, edx
add ecx, eax
add esi, ecx
inc edi
jmp 0x1002ed84
mov edx, dword [ebp - 8]
lea eax, [edx + ebx]
add esi, eax
mov eax, 0x80078071
mul ecx
shr edx, 0xf
imul eax, edx, 0xffff000f
add ecx, eax
mov eax, 0x80078071
mul esi
shr edx, 0xf
imul eax, edx, 0xffff000f
mov edx, dword [ebp - 4]
add esi, eax
sub dword [ebp + 0x10], edx
mov edx, 0x15b0
mov dword [ebp + 8], esi
mov dword [ebp - 4], edx
jne 0x1002ecb4
pop ebx
shl esi, 0x10
pop edi
lea eax, [ecx + esi]
pop esi
mov esp, ebp
pop ebp
ret