joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4db904
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0xec
mov esi, ecx
mov eax, dword [0x57ffac]
xor eax, ebp
mov dword [ebp - 0x10], eax
lea edi, [ecx + 0x10]
mov ecx, edi
call fcn.004dc0c6
lea ebx, [ebp - 0x50]
mov ecx, esi
push ebx
push 0
push 0x40
push edx
push eax
call fcn.004e3aba
test al, al
je 0x4db9a2
movzx eax, word [ebp - 0x50]
cmp eax, 0x5a4d
jne 0x4db9df
mov ecx, edi
call fcn.004dc0c6
mov ebx, eax
mov eax, dword [ebp - 0x14]
mov edi, eax
sar edi, 0x1f
add ebx, eax
adc edi, edx
mov ecx, esi
push dword [ebp + 8]
push 0
push 0xf8
push edi
push ebx
call fcn.004e3aba
test al, al
je 0x4dba19
mov eax, dword [ebp + 8]
cmp dword [eax], 0x4550
jne 0x4dba53
mov ecx, ebx
mov eax, dword [ebp + 0xc]
mov bl, 1
test eax, eax
je 0x4dbab1
mov dword [eax], ecx
mov dword [eax + 4], edi
jmp 0x4dbab1
push 1
call fcn.00424cb0
add esp, 4
test al, al
je 0x4dbaaf
lea edi, [ebp - 0xf8]
mov ecx, edi
push 1
push 0x154
push str..._.._third_party_crashpad_crashpad_snapshot_win_pe_image_reader.cc
call fcn.00424d40
lea eax, [ebp - 0xf0]
push 0x1f
push str.could_not_read_dos_header_from
jmp 0x4dba87
push 1
call fcn.00424cb0
add esp, 4
test al, al
je 0x4dbaaf
lea edi, [ebp - 0xf8]
mov ecx, edi
push 1
push 0x15a
push str..._.._third_party_crashpad_crashpad_snapshot_win_pe_image_reader.cc
call fcn.00424d40
lea eax, [ebp - 0xf0]
push 0x21
push str.invalid_e_magic_in_dos_header_of
jmp 0x4dba87
push 1
call fcn.00424cb0
add esp, 4
test al, al
je 0x4dbaaf
lea edi, [ebp - 0xf8]
mov ecx, edi
push 1
push 0x162
push str..._.._third_party_crashpad_crashpad_snapshot_win_pe_image_reader.cc
call fcn.00424d40
lea eax, [ebp - 0xf0]
push 0x1f
push str.could_not_read_nt_headers_from
jmp 0x4dba87
push 1
call fcn.00424cb0
add esp, 4
test al, al
je 0x4dbaaf
lea edi, [ebp - 0xf8]
mov ecx, edi
push 1
push 0x168
push str..._.._third_party_crashpad_crashpad_snapshot_win_pe_image_reader.cc
call fcn.00424d40
lea eax, [ebp - 0xf0]
push 0x23
push str.invalid_signature_in_nt_headers_of
push eax
call fcn.00401b1f
add esp, 0xc
movzx ecx, byte [esi + 0xb]
test cl, cl
jns 0x4dba9d
mov ecx, dword [esi + 4]
mov esi, dword [esi]
push ecx
push esi
push eax
call fcn.00401b1f
add esp, 0xc
mov ecx, edi
call fcn.004250e0
xor ebx, ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004fe871
mov eax, ebx
add esp, 0xec
pop esi
pop edi
pop ebx
pop ebp
ret 8

Function at 0x4e25ac
Capabilities:
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
mov edi, edx
mov esi, ecx
xor ebx, ebx
mov dword [ecx], ebx
mov dword [ecx + 4], ebx
sub esp, 0x18
mov dword [esp + 0x14], ebx
mov dword [esp + 0x10], edx
movaps xmm0, xmmword [0x53db30]
movups xmmword [esp], xmm0
call dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov ecx, esi
push eax
call fcn.0040504a
mov eax, dword [esi]
lea ecx, [eax + 1]
cmp ecx, 2
jb 0x4e25fa
push edi
push ebx
push ebx
push 6
push eax
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov dword [esi + 4], eax
mov eax, esi
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x51fcc4
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.0051ff0d
Function at 0x523e4e
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.00523e59
Function at 0x406b61
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
cmp dword [0x428084], 0
jne 0x406b9f
xor ecx, ecx
push esi
push 8
mov eax, ecx
pop esi
mov edx, eax
and dl, 1
movzx edx, dl
neg edx
sbb edx, edx
and edx, 0xedb88320
shr eax, 1
xor eax, edx
dec esi
jne 0x406b75
mov dword [ecx*4 + 0x428080], eax
inc ecx
cmp ecx, 0x100
jl 0x406b70
pop esi
cmp dword [ebp + 0x10], 0
mov eax, dword [ebp + 8]
not eax
jbe 0x406bcc
mov ecx, dword [ebp + 0xc]
movzx edx, byte [ecx]
dec dword [ebp + 0x10]
xor edx, eax
and edx, 0xff
shr eax, 8
xor eax, dword [edx*4 + 0x428080]
inc ecx
cmp dword [ebp + 0x10], 0
ja 0x406bad
not eax
pop ebp
ret 0xc

Function at 0xa8b0f0
Capabilities:
Encode data using xor

Disassembly:
jmp 0xa8b0fa
pushal
call 0xa8b100
pop ebp
sub ebp, 0x10
sub ebp, 0x68b0f0
jmp 0xa8b116
mov eax, 0x68b0f0
add eax, ebp
add eax, 0x4c
mov ecx, 0x617
mov edx, 0x1b16256e
xor byte [eax], dl
inc eax
dec ecx
jne 0xa8b12d
jmp 0xa8b140
in eax, 0xa3
in eax, 0xe7
push edx
outsb dx, byte [esi]
outsb dx, byte [esi]
outsb dx, byte [esi]
out dx, eax
scasd eax, dword es:[edi]
xchg esi, eax
outsb dx, byte [esi]
outsb dx, byte [esi]
outsb dx, byte [esi]
insd dword es:[edi], dx
mov dword [0x6e6e69d6], eax
outsb dx, byte [esi]
aam 0x46
outsb dx, byte [esi]
outsb dx, byte [esi]
outsb dx, byte [esi]
cdq
mov word [ebp - 0x5a], gs
in eax, 0xef
bound ebp, qword [esi + 0x6e]
outsb dx, byte [esi]
insd dword es:[edi], dx
stosd dword es:[edi], eax
jecxz 0xa8b172
dec edx
xchg edx, eax
out 0x6a, eax
dec edx
jecxz 0xa8b179
dec edx
xchg edx, eax
out 0x6a, eax
dec edx
push 0x4a
push es
sahf
fisub word [eax + 0x6e]
push es
outsb dx, byte [esi]
outsb dx, byte [esi]
xor al, 0x6e
outsd dx, dword [esi]
inc edx
dec edx
push es
mov al, 0xe2
sub eax, 0x6e6b86c1
outsb dx, byte [esi]
outsb dx, byte [esi]
xchg dword [esi + 0x6e], eax
outsb dx, byte [esi]
outsb dx, byte [esi]
cmp edi, dword [edx]
xor esp, ebp
jmp 0xa8b1fc
lodsb al, byte [esi]
invalid

Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..text
mov ebx, 0x408ecc
nop
nop
mov ecx, 0x53966569
nop
nop
nop
nop
test eax, eax
je 0x43004e
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
inc eax
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x430024
nop
mov eax, section..data
nop
mov ebx, 0x42e1d0
nop
mov ecx, 0x464f5890
nop
test eax, eax
nop
nop
nop
nop
je 0x430084
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
add eax, 4
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
nop
jne 0x43006c
nop
nop
nop
popal
nop
nop
jmp 0x401219
Function at 0x42e000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..rsrc
push 4
nop
nop
nop
nop
nop
nop
nop
nop
nop
pop edi
nop
nop
nop
cmp eax, 0
nop
nop
je 0x42e072
nop
nop
mov ebx, 0x407ef8
nop
nop
nop
nop
mov ecx, ebx
nop
nop
sub ecx, eax
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
push eax
nop
nop
nop
nop
mov eax, ecx
nop
nop
div edi
nop
nop
nop
nop
nop
nop
nop
nop
xchg ecx, eax
nop
pop eax
nop
nop
nop
nop
nop
nop
mov esi, 0x728a5651
xor dword [eax], esi
nop
nop
nop
nop
nop
nop
add eax, edi
nop
nop
nop
loop 0x42e060
nop
nop
nop
mov eax, section..rsrc_1
nop
nop
nop
cmp eax, 0
nop
nop
nop
je 0x42e0d2
nop
nop
nop
mov ebx, 0x42cd70
nop
nop
nop
mov ecx, ebx
nop
nop
sub ecx, eax
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
push eax
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
div edi
nop
nop
nop
nop
nop
nop
xchg ecx, eax
nop
pop eax
nop
nop
nop
nop
nop
nop
mov esi, 0x10c64447
nop
xor dword [eax], esi
nop
nop
nop
add eax, edi
nop
nop
nop
nop
nop
nop
loop 0x42e0c0
nop
nop
popal
nop
nop
nop
nop
nop
jmp 0x401219
Function at 0x100075b0
Capabilities:
Parse pe header
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push esi
and esp, 0xfffffff8
sub esp, 0x90
lea eax, [esp + 0x20]
lea ecx, [esp + 0x30]
mov dword [0x1028b01c], 0x1e02
mov dword [esp], eax
mov dword [esp + 0x1c], ecx
call fcn.100088dc
lea ecx, [0x100076f0]
mov edx, dword [esp + 0x20]
mov dword [esp + 0x68], edx
mov dword [0x1028b01c], 0x3f2
mov dword [esp + 0x40], 0x117c00
mov edx, dword [0x1028b008]
mov dword [esp + 0x3c], edx
mov edx, dword [0x1028b00c]
mov dword [esp + 0x78], edx
mov edx, dword [0x1028b010]
mov dword [esp + 0x5c], edx
mov edx, dword [0x1028b014]
mov dword [esp + 0x34], edx
mov edx, dword [0x1028b018]
mov dword [esp + 0x50], edx
mov dword [0x1028b020], 0xffffe050
mov dword [esp + 0x18], eax
mov dword [esp + 0x14], ecx
mov eax, dword [esp + 0x14]
cmp word [eax], 0x5a4d
mov dword [esp + 0x10], eax
jne 0x10007662
mov eax, dword [esp + 0x10]
mov ecx, dword [eax + 0x3c]
cmp dword [eax + ecx], 0x4550
mov dword [esp + 0xc], ecx
je 0x10007680
mov dword [0x1028b01c], 0x18db
mov eax, dword [esp + 0x10]
add eax, 0xfffff000
and eax, 0xfffff000
mov dword [esp + 0x14], eax
jmp 0x1000763f
lea eax, [esp + 0x30]
mov ecx, dword [esp + 0x10]
mov dword [esp + 0x7c], ecx
mov dword [0x1028b020], 0x983
mov dword [0x1028b01c], 0x297
mov edx, dword [esp + 0xc]
mov esi, dword [ecx + edx + 0x50]
mov dword [esp + 0x58], esi
mov esi, dword [esp + 0x28]
mov dword [esp], eax
mov dword [esp + 4], esi
call fcn.1000876d
mov dword [0x1028b020], 0x8f1
mov ecx, esp
lea edx, [esp + 0x30]
mov dword [ecx], edx
call eax
sub esp, 4
mov eax, 2
mov ecx, dword [0x1028b020]
add ecx, 0xffffde88
mov dword [0x1028b01c], ecx
lea esp, [ebp - 4]
pop esi
pop ebp
ret
Function at 0x10007de6
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x20
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
xor esi, esi
mov dword [0x1028b028], 0
mov byte [0x1028b02c], 0
mov edi, dword [0x1028b020]
add edi, 0xfffff865
mov dword [0x1028b020], edi
mov dword [0x1028b024], 0
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x18], edx
mov dword [ebp - 0x1c], esi
mov eax, dword [ebp - 0x1c]
mov dword [0x1028b020], 0xca1
mov ecx, eax
mov dl, cl
mov ecx, dword [ebp - 0x18]
mov byte [ecx + eax], dl
mov eax, dword [0x1028b024]
add eax, 1
mov dword [0x1028b024], eax
cmp eax, 0x100
mov dword [ebp - 0x1c], eax
jl 0x10007e33
xor eax, eax
mov ecx, dword [0x1028b020]
mov edx, ecx
add edx, 0x155b
mov dword [0x1028b01c], edx
mov dword [0x1028b024], 0
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x24], ecx
mov eax, dword [ebp - 0x24]
mov ecx, dword [ebp - 0x20]
mov edx, 0x100
add eax, 0xfffffb22
mov dword [0x1028b020], eax
mov eax, dword [0x1028b028]
mov esi, dword [ebp - 0x18]
movzx edi, byte [esi + ecx]
add edi, eax
mov eax, ecx
xor ebx, ebx
mov dword [ebp - 0x28], edx
mov edx, ebx
mov ebx, dword [ebp - 0x10]
div ebx
mov esi, dword [ebp - 0x14]
movzx edx, byte [esi + edx]
add edi, edx
mov eax, edi
cdq
mov edi, dword [ebp - 0x28]
idiv edi
mov dword [0x1028b028], edx
mov esi, dword [ebp - 0x18]
mov bl, byte [esi + ecx]
mov byte [0x1028b02c], bl
mov dword [0x1028b020], 0xc06
mov bl, byte [esi + edx]
mov byte [esi + ecx], bl
mov bl, byte [0x1028b02c]
mov ecx, dword [0x1028b028]
mov byte [esi + ecx], bl
mov ecx, dword [0x1028b01c]
add ecx, 0x2167
mov dword [0x1028b01c], ecx
mov ecx, dword [0x1028b024]
add ecx, 1
mov dword [0x1028b024], ecx
mov edx, dword [0x1028b020]
cmp ecx, 0x100
mov esi, edx
mov dword [ebp - 0x24], esi
mov dword [ebp - 0x2c], edx
mov dword [ebp - 0x20], ecx
jl 0x10007e89
mov eax, dword [ebp - 0x2c]
add eax, 0x459
mov dword [0x1028b020], eax
add esp, 0x20
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x10007f5f
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x2c
mov eax, dword [ebp + 0x14]
mov ecx, dword [ebp + 0x10]
mov edx, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
xor edi, edi
mov dword [0x1028b020], 0x1e81
mov dword [0x1028b024], 0
mov dword [0x1028b028], 0
mov dword [0x1028b030], 0
mov dword [0x1028b01c], 0x26dd
cmp eax, 0
mov ebx, edi
mov dword [ebp - 0x10], eax
mov eax, edi
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x1c], edx
mov dword [ebp - 0x20], esi
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x28], edi
jne 0x10007fe7
add esp, 0x2c
pop esi
pop edi
pop ebx
pop ebp
ret
mov eax, dword [0x1028b024]
mov ecx, dword [0x1028b028]
mov edx, dword [ebp - 0x2c]
mov dword [ebp - 0x24], ecx
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x28], edx
mov eax, dword [ebp - 0x28]
mov ecx, dword [ebp - 0x14]
mov edx, dword [ebp - 0x24]
mov esi, 0x100
add ecx, 1
mov dword [ebp - 0x30], eax
mov eax, ecx
mov dword [ebp - 0x34], edx
cdq
idiv esi
mov dword [0x1028b024], edx
mov dword [0x1028b01c], 0x4eb
mov ecx, dword [ebp - 0x20]
movzx edi, byte [ecx + edx]
mov ebx, dword [ebp - 0x34]
add edi, ebx
mov eax, edi
mov dword [ebp - 0x38], edx
cdq
idiv esi
mov dword [0x1028b028], edx
mov dword [0x1028b020], 0xa9a
mov esi, dword [ebp - 0x38]
mov cl, byte [ecx + esi]
mov byte [0x1028b02c], cl
mov dword [0x1028b01c], 0xffffe7ca
mov edi, dword [ebp - 0x20]
mov cl, byte [edi + edx]
mov byte [edi + esi], cl
mov edx, dword [0x1028b020]
add edx, 0xffffe4a8
mov dword [0x1028b01c], edx
mov cl, byte [0x1028b02c]
mov edx, dword [0x1028b028]
mov byte [edi + edx], cl
mov dword [0x1028b020], 0x1f7a
mov edx, dword [0x1028b024]
movzx edx, byte [edi + edx]
mov ebx, dword [0x1028b028]
movzx ebx, byte [edi + ebx]
add ebx, edx
and ebx, 0xff
mov dword [0x1028b030], ebx
mov edx, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x30]
mov cl, byte [edx + ecx]
xor cl, byte [edi + ebx]
mov ebx, dword [ebp - 0x1c]
mov edx, dword [ebp - 0x30]
mov byte [ebx + edx], cl
mov dword [0x1028b01c], 0x1826
add edx, 1
mov ecx, dword [ebp - 0x10]
cmp edx, ecx
mov dword [ebp - 0x2c], edx
je 0x10007fc8
jmp 0x10007fd0
Function at 0x1000822f
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x3c
mov eax, dword [ebp + 8]
mov dword [0x1028b01c], 0x12db
mov dword [ebp - 0x10], eax
call fcn.100080de
mov ecx, eax
mov dword [0x1028b020], 0x983
mov edx, dword [eax + 0x3c]
mov dword [0x1028b01c], 0x297
mov eax, dword [eax + edx + 0x78]
mov dword [0x1028b020], 0x1bf3
mov edx, eax
add edx, 0x20
mov esi, ecx
add esi, edx
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x1c], esi
xor eax, eax
mov ecx, dword [ebp - 0x14]
mov edx, dword [ebp - 0x1c]
add ecx, dword [edx]
mov dword [0x1028b01c], 0xfffffbb5
mov esi, dword [ebp - 0x14]
mov edi, dword [ebp - 0x18]
mov ebx, dword [esi + edi + 0x18]
cmp ebx, 0
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x24], ecx
mov dword [ebp - 0x28], eax
je 0x1000839c
jmp 0x10008314
mov eax, dword [ebp - 0x2c]
add eax, 1
mov cl, byte [ebp - 0x2d]
cmp cl, 0
setne dl
mov ch, byte [ebp - 0x2e]
and ch, dl
cmp eax, 0x20
setb dl
and ch, dl
test ch, 1
mov dword [ebp - 0x34], eax
jne 0x10008340
jmp 0x1000836d
xor eax, eax
mov ecx, dword [ebp - 0x38]
add ecx, 2
mov edx, dword [ebp - 0x3c]
add edx, 1
mov esi, dword [ebp - 0x20]
cmp edx, esi
mov dword [ebp - 0x40], edx
mov dword [ebp - 0x44], ecx
mov dword [ebp - 0x28], eax
jb 0x10008326
jmp 0x1000839c
xor eax, eax
mov ecx, dword [ebp - 0x14]
mov edx, dword [ebp - 0x18]
add ecx, dword [ecx + edx + 0x24]
mov dword [ebp - 0x44], ecx
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x40]
mov ecx, dword [ebp - 0x44]
xor edx, edx
mov esi, dword [ebp - 0x24]
mov edi, dword [esi + eax*4]
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0x38], ecx
mov dword [ebp - 0x48], edi
mov dword [ebp - 0x34], edx
mov eax, dword [ebp - 0x34]
mov ecx, eax
mov edx, dword [ebp - 0x48]
add ecx, edx
mov esi, dword [ebp - 0x14]
mov bl, byte [esi + ecx]
mov ecx, dword [ebp - 0x10]
mov bh, byte [ecx + eax]
cmp bl, bh
sete cl
cmp bl, 0
mov dword [ebp - 0x2c], eax
mov byte [ebp - 0x2d], bh
mov byte [ebp - 0x2e], cl
jne 0x100082be
mov al, byte [ebp - 0x2e]
test al, 1
jne 0x10008379
jmp 0x100082eb
mov eax, dword [ebp - 0x38]
movzx ecx, word [eax]
mov edx, dword [ebp - 0x14]
mov esi, dword [ebp - 0x18]
add edx, dword [edx + esi + 0x1c]
mov dword [0x1028b01c], 0xd83
mov edi, dword [ebp - 0x14]
add edi, dword [edx + ecx*4]
mov dword [ebp - 0x28], edi
mov eax, dword [ebp - 0x28]
add esp, 0x3c
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x1000876d
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push esi
sub esp, 0x50
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 8]
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x2c], ecx
xor eax, eax
mov dword [0x1028b020], 0x1a92
mov dword [0x1028b01c], 0x2534
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x30]
mov ecx, eax
add ecx, 1
mov dl, byte [eax + 0x102777a4]
mov dh, byte [eax + 0x10277775]
sub dh, dl
mov byte [ebp + eax - 0x24], dh
cmp ecx, 0xe
mov dword [ebp - 0x30], ecx
jne 0x10008799
lea eax, [ebp - 0x24]
mov dword [0x1028b01c], 0x18b3
mov dword [ebp - 0x34], eax
call fcn.100084d4
mov dword [esp], eax
mov eax, dword [ebp - 0x34]
mov dword [esp + 4], eax
call fcn.100085e5
mov ecx, dword [0x1028b020]
add ecx, 0x65b
mov dword [0x1028b020], ecx
cmp eax, 0
mov dword [ebp - 0x38], eax
je 0x100088af
mov eax, dword [ebp - 0x38]
mov ecx, esp
mov dword [ecx + 0xc], 0x40
mov dword [ecx + 8], 0x1000
mov dword [ecx + 4], 0x6000
mov dword [ecx], 0
call eax
sub esp, 0x10
mov dword [0x1028b01c], 0x1b3e
mov dword [esp], eax
mov ecx, dword [ebp - 0x28]
mov dword [esp + 4], ecx
mov dword [ebp - 0x3c], eax
call fcn.10007abe
xor eax, eax
mov ecx, dword [ebp - 0x3c]
mov word [ecx], 0x5a4d
mov dword [ecx + 0x3c], 0xd0
mov dword [0x1028b01c], 0x105c
mov dword [ecx + 0xd0], 0x4550
add ecx, 0xffc00000
mov edx, dword [ebp - 0x2c]
mov dword [edx + 0x40], ecx
mov ecx, dword [ebp - 0x3c]
mov dword [edx + 0x3c], ecx
mov dword [0x1028b020], 0x1a71
add ecx, 0x1e1a
mov esi, dword [ebp - 0x3c]
cmp esi, 0
mov dword [ebp - 0x40], ecx
mov dword [ebp - 0x44], eax
je 0x100088a6
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 0x44]
add esp, 0x50
pop esi
pop ebp
ret
xor eax, eax
add esp, 0x50
pop esi
pop ebp
ret
Function at 0x4061e0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x580a89
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
push ebx
push ebp
push esi
push edi
mov edi, ecx
xor ebx, ebx
or ecx, 0xffffffff
mov dword [esp + 0x10], edi
lea esi, [edi + 8]
mov dword [edi], ebx
mov dword [esi + 4], ecx
mov dword [esi + 8], ebx
mov dword [esi + 0xc], esi
mov dword [esi + 0x10], esi
mov dword [esi], 0x589330
lea eax, [edi + 0x1c]
mov dword [esp + 0x20], ebx
mov dword [eax + 4], ecx
mov dword [eax + 8], ebx
mov dword [eax + 0xc], eax
mov dword [eax + 0x10], eax
mov dword [eax], 0x589330
push 0x24
mov byte [esp + 0x24], 1
mov byte [edi + 0x38], bl
mov byte [edi + 0x39], bl
call fcn.00401290
mov ebp, eax
add esp, 4
mov dword [esp + 0x14], ebp
cmp ebp, ebx
mov byte [esp + 0x20], 2
je 0x4062a9
mov ecx, ebp
call fcn.00405be0
push 0x14
mov byte [esp + 0x24], 3
call fcn.00401290
add esp, 4
cmp eax, ebx
je 0x406289
mov dword [eax + 4], ebp
mov dword [eax + 8], ebx
mov dword [eax], 0x58932c
mov dword [eax + 0xc], eax
mov dword [eax + 0x10], eax
jmp 0x40628b
xor eax, eax
cmp eax, ebx
mov dword [ebp + 0x20], eax
jne 0x4062ab
mov eax, dword [str.Null_Pointer]
push eax
push 0x70
push str.D:Skate4CoreTaskTstack.cpp
call fcn.00401090
add esp, 0xc
jmp 0x4062ab
xor ebp, ebp
cmp ebp, ebx
mov byte [esp + 0x20], 1
mov dword [edi + 0x30], ebp
jne 0x4062d0
mov ecx, dword [str.Null_Pointer]
push ecx
push 0xc7
push str.D:Skate4CoreTaskTstack.cpp
call fcn.00401090
add esp, 0xc
mov edx, dword [edi + 0x30]
mov ebp, dword [edx + 0x20]
cmp ebp, ebx
jne 0x406308
mov eax, dword [str.Null_Pointer]
push eax
push 0x168
push str..core_list_head.h
call fcn.00401090
mov ecx, dword [str.Null_Pointer]
push ecx
push 0x119
push str..core_list_node.h
call fcn.00401090
add esp, 0x18
mov dword [ebp + 0x10], esi
mov edx, dword [esi + 0xc]
mov dword [ebp + 0xc], edx
mov eax, dword [esi + 0xc]
mov dword [eax + 0x10], ebp
mov dword [esi + 0xc], ebp
mov ecx, dword [edi + 0x30]
mov byte [edi + 0x38], bl
mov dword [edi + 0x34], ecx
mov ecx, dword [esp + 0x18]
mov byte [edi + 0x39], bl
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x14
ret

Function at 0x4068f0
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push esi
push edi
mov edi, dword [esp + 0xc]
test edi, edi
je 0x406934
mov esi, dword [esp + 0x10]
test esi, esi
jle 0x406934
or eax, 0xffffffff
xor ecx, ecx
test esi, esi
jle 0x406936
push ebx
mov dl, byte [ecx + edi]
mov ebx, eax
and edx, 0xff
and ebx, 0xff
xor edx, ebx
shr eax, 8
mov edx, dword [edx*4 + 0x59a358]
xor eax, edx
inc ecx
cmp ecx, esi
jl 0x40690c
pop ebx
pop edi
pop esi
ret
xor eax, eax
pop edi
pop esi
ret

Function at 0x406940
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
mov eax, dword [esp + 0xc]
push esi
mov esi, dword [esp + 0xc]
xor ecx, ecx
test esi, esi
jle 0x40697b
push ebx
push edi
mov edi, dword [esp + 0x10]
mov dl, byte [ecx + edi]
mov ebx, eax
and edx, 0xff
and ebx, 0xff
xor edx, ebx
shr eax, 8
mov edx, dword [edx*4 + 0x59a358]
xor eax, edx
inc ecx
cmp ecx, esi
jl 0x406955
pop edi
pop ebx
pop esi
ret
Function at 0x406980
Capabilities:
Hash data with crc32

Disassembly:
push esi
push edi
mov edi, dword [esp + 0xc]
test edi, edi
je 0x4069d8
mov esi, dword [esp + 0x10]
test esi, esi
jle 0x4069d8
or eax, 0xffffffff
xor edx, edx
test esi, esi
jle 0x4069da
push ebx
mov cl, byte [edx + edi]
cmp cl, 0x41
jl 0x4069ac
cmp cl, 0x5a
jg 0x4069ac
add cl, 0x20
cmp cl, 0x2f
jne 0x4069b3
mov cl, 0x5c
mov ebx, eax
and ecx, 0xff
and ebx, 0xff
xor ecx, ebx
shr eax, 8
mov ecx, dword [ecx*4 + 0x59a358]
xor eax, ecx
inc edx
cmp edx, esi
jl 0x40699c
pop ebx
pop edi
pop esi
ret
xor eax, eax
pop edi
pop esi
ret

Function at 0x4069e0
Capabilities:
Hash data with crc32

Disassembly:
mov ecx, dword [esp + 4]
test ecx, ecx
jne 0x4069eb
xor eax, eax
ret
or eax, 0xffffffff
mov edx, ecx
push esi
mov cl, byte [edx]
inc edx
test cl, cl
je 0x406a2a
cmp cl, 0x41
jl 0x406a05
cmp cl, 0x5a
jg 0x406a05
add cl, 0x20
cmp cl, 0x2f
jne 0x406a0c
mov cl, 0x5c
mov esi, eax
and ecx, 0xff
and esi, 0xff
xor ecx, esi
shr eax, 8
mov ecx, dword [ecx*4 + 0x59a358]
xor eax, ecx
jmp 0x4069f1
pop esi
ret