joyce8/EMBER2024-capa huggingface dataset:
Function at 0x101f85a0
Capabilities:
Get file version info

Disassembly:
push 0xffffffffffffffff
push 0x10255783
mov eax, dword fs:[0]
push eax
sub esp, 0x188
push ebp
push esi
push edi
mov eax, dword [0x1037c990]
xor eax, esp
push eax
lea eax, [esp + 0x198]
mov dword fs:[0], eax
mov edi, ecx
mov dword [esp + 0x24], edi
xor ebp, ebp
mov dword [edi], ebp
mov dword [edi + 4], ebp
mov dword [edi + 8], ebp
mov dword [edi + 0xc], ebp
mov dword [esp + 0x1a0], ebp
mov ecx, dword [esp + 0x1a8]
mov eax, dword [ecx + 0x18]
cmp dword [eax - 0xc], ebp
jne 0x101f8607
push ebp
push 0x14
push str..FileVersion.cpp
push 0x80070057
call fcn.100048f0
push 1
lea edx, [esp + 0x64]
push edx
call fcn.101db290
mov byte [esp + 0x1a0], 1
add eax, 0x18
push eax
lea ecx, [esp + 0x14]
call fcn.100047f0
mov byte [esp + 0x1a0], 3
lea ecx, [esp + 0x60]
call fcn.10056b10
mov dword [esp + 0x1c], ebp
call fcn.101f60c0
test al, al
je 0x101f8793
lea ecx, [esp + 0x7c]
call fcn.101f61b0
mov ecx, eax
call fcn.100dbdf0
test al, al
je 0x101f8793
lea eax, [esp + 0x28]
push eax
call fcn.101dbb40
add esp, 4
mov byte [esp + 0x1a0], 4
add eax, 0x18
push eax
lea ecx, [esp + 0x18]
call fcn.100047f0
mov byte [esp + 0x1a0], 6
lea ecx, [esp + 0x28]
call fcn.10056b10
mov edx, dword [esp + 0x10]
mov ecx, dword [esp + 0x14]
mov eax, dword [edx - 0xc]
mov esi, dword [ecx - 0xc]
add eax, 0xfffffffc
cmp eax, esi
jl 0x101f8782
push esi
push 4
lea eax, [esp + 0x20]
push eax
lea ecx, [esp + 0x1c]
call fcn.100034b0
mov byte [esp + 0x1a0], 7
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x18]
push ecx
push edx
call fcn.10231171
add esp, 8
test eax, eax
jne 0x101f8771
push esi
push 4
lea ecx, [esp + 0x18]
call fcn.101f83b0
lea eax, [esp + 0x44]
push eax
call fcn.101db820
add esp, 4
mov byte [esp + 0x1a0], 8
push str.Sysnative
lea ecx, [esp + 0x2c]
push ecx
mov ecx, eax
call fcn.10055a70
mov byte [esp + 0x1a0], 9
add eax, 0x18
push eax
lea ecx, [esp + 0x24]
call fcn.100047f0
mov byte [esp + 0x1a0], 0xa
mov eax, dword [eax]
push eax
push 4
lea ecx, [esp + 0x18]
call fcn.101447b0
mov byte [esp + 0x1a0], 9
lea ecx, [esp + 0x20]
call fcn.10004720
mov byte [esp + 0x1a0], 8
lea ecx, [esp + 0x28]
call fcn.10056b10
mov byte [esp + 0x1a0], 7
lea ecx, [esp + 0x44]
call fcn.10056b10
mov byte [esp + 0x1a0], 6
lea ecx, [esp + 0x18]
call fcn.10004720
mov byte [esp + 0x1a0], 3
lea ecx, [esp + 0x14]
call fcn.10004720
mov eax, dword [esp + 0x10]
lea edx, [esp + 0x1c]
push edx
push eax
call sub.VERSION.dll_GetFileVersionInfoSizeW
mov esi, eax
cmp esi, ebp
jne 0x101f87af
push ebp
push ebp
call fcn.100563c0
push 0xffffffffffffffff
push esi
mov ecx, edi
call fcn.1007eeb0
mov eax, dword [edi]
mov ecx, dword [esp + 0x1c]
mov edx, dword [esp + 0x10]
push 0x3c
push str..FileVersion.cpp
push eax
push esi
push ecx
push edx
call sub.VERSION.dll_GetFileVersionInfoW
push eax
call fcn.100556a0
add esp, 0xc
mov byte [esp + 0x1a0], 0
lea ecx, [esp + 0x10]
call fcn.10004720
mov dword [esp + 0x1a0], 0xffffffff
mov eax, edi
mov ecx, dword [esp + 0x198]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
add esp, 0x194
ret 4
Function at 0x101f8b70
Capabilities:
Clear file content

Disassembly:
push esi
mov esi, ecx
mov eax, dword [esi + 8]
cmp eax, 0xffffffff
je 0x101f8bcc
mov ecx, dword [esi]
mov edx, dword [ecx]
push 0
push eax
mov eax, dword [edx]
call eax
test al, al
je 0x101f8b94
mov ecx, dword [esi + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
cmp dword [esi + 8], 0xffffffff
je 0x101f8bcc
push edi
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 0x29
mov edi, eax
mov eax, dword [esi + 8]
push str.c:dvsp4_build_sw_relgpu_drvinstaller_coreincHandles.h
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push eax
call fcn.100556a0
add esp, 0xc
push edi
mov dword [esi + 8], 0xffffffff
call dword [sym.imp.KERNEL32.dll_SetLastError]
pop edi
pop esi
ret

Function at 0x101f8c20
Capabilities:
Write file on windows

Disassembly:
mov eax, dword [esp + 8]
push esi
mov esi, dword [eax + 4]
cmp esi, 0x7fffffff
ja 0x101f8c75
mov eax, dword [eax]
mov edx, dword [esp + 8]
push 0xdc
push str..XmlBuilder.cpp
push 0
lea ecx, [esp + 0x18]
push ecx
push esi
push eax
push edx
call dword [sym.imp.KERNEL32.dll_WriteFile]
push eax
call fcn.100556a0
add esp, 0xc
cmp dword [esp + 0xc], esi
je 0x101f8c8b
push 0
push 0xdd
push str..XmlBuilder.cpp
push 0xe0e00000
call fcn.100048f0
push 0
push 0x29f
push str.c:dvsp4_build_sw_relgpu_drvinstaller_coreincNVI2Defns.h
push 0x80070057
call fcn.100048f0
pop esi
ret
Function at 0x101f9a50
Capabilities:
Clear file content
Write file on windows

Disassembly:
push 0xffffffffffffffff
push 0x102559eb
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x1037c990]
xor eax, esp
push eax
lea eax, [esp + 0x18]
mov dword fs:[0], eax
mov esi, ecx
cmp dword [esi + 8], 0xffffffff
push 0
sete al
test al, al
jne 0x101f9a96
push 0x1a
push str..XmlBuilder.cpp
push 0xe0e00000
call fcn.100048f0
mov eax, dword [esp + 0x2c]
push 0x10000000
push 2
push 0
push 5
push 0xc0000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov ebx, eax
mov eax, dword [esi + 8]
cmp eax, ebx
je 0x101f9af2
cmp eax, 0xffffffff
je 0x101f9aef
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 0x29
mov edi, eax
mov eax, dword [esi + 8]
push str.c:dvsp4_build_sw_relgpu_drvinstaller_coreincHandles.h
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push eax
call fcn.100556a0
add esp, 0xc
push edi
mov dword [esi + 8], 0xffffffff
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov dword [esi + 8], ebx
mov eax, dword [esi + 8]
cmp eax, 0xffffffff
jne 0x101f9b03
push 0
push 0
call fcn.100563c0
push 0xdc
push str..XmlBuilder.cpp
xor edi, edi
push edi
lea ecx, [esp + 0x34]
push ecx
push 0x27
push str.__xml_version_1.0__encoding_UTF_8____
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
push eax
call fcn.100556a0
add esp, 0xc
cmp dword [esp + 0x28], 0x27
sete al
test al, al
jne 0x101f9b4d
push edi
push 0xdd
push str..XmlBuilder.cpp
push 0xe0e00000
call fcn.100048f0
push 0x78
call fcn.101d2e81
add esp, 4
mov dword [esp + 0x28], eax
mov dword [esp + 0x20], edi
cmp eax, edi
je 0x101f9b73
mov edx, dword [esp + 0x2c]
push edx
push edi
push edi
mov ecx, eax
call fcn.101f9910
mov edi, eax
mov dword [esp + 0x20], 0xffffffff
mov eax, dword [esi + 8]
push 0x141
push str..XmlBuilder.cpp
push 1
xor edx, edx
lea ebx, [esp + 0x1c]
push ebx
xor ecx, ecx
push edx
push ecx
push eax
mov dword [esi], edi
mov dword [esp + 0x2c], ecx
mov dword [esp + 0x30], edx
call dword [sym.imp.KERNEL32.dll_SetFilePointerEx]
push eax
call fcn.100556a0
mov eax, dword [esp + 0x1c]
mov ecx, dword [esp + 0x20]
mov dword [edi + 0x10], eax
mov dword [edi + 0x14], ecx
mov eax, dword [esi + 8]
mov ecx, dword [esi]
add esp, 0xc
mov dword [esi + 4], ecx
cmp eax, 0xffffffff
je 0x101f9be1
mov edx, dword [ecx]
push 0
push eax
mov eax, dword [edx]
call eax
test al, al
je 0x101f9be1
mov ecx, dword [esi + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
mov ecx, dword [esp + 0x18]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x14
ret 8
Function at 0x101faf80
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x10255dfb
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x1037c990]
xor eax, esp
push eax
lea eax, [esp + 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 8], esi
lea ecx, [esi + 4]
call fcn.10056ab0
xor eax, eax
mov dword [esp + 0x14], eax
mov dword [esi + 0x28], eax
mov dword [esi + 0x2c], eax
mov dword [esi + 0x30], eax
mov dword [esi + 0x34], eax
mov dword [esi + 0x38], eax
mov dword [esi + 0x3c], eax
mov dword [esp + 0x14], 0xffffffff
mov eax, esi
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x10
ret

Function at 0x101fc7b9
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
lea eax, [ebp - 4]
push eax
push dword [ecx]
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov esi, eax
cmp esi, 0xffffffff
jne 0x101fc7df
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x101fc7df
xor al, al
jmp 0x101fc7ff
push 1
push 0
push 0
push dword [ebp - 4]
call fcn.10233430
mov ecx, eax
xor eax, eax
add ecx, esi
adc edx, eax
mov eax, dword [ebp + 8]
mov dword [eax], ecx
mov dword [eax + 4], edx
mov al, 1
pop esi
leave
ret 4

Function at 0x101fcbf4
Capabilities:
Get common file path

Disassembly:
push 0x34
mov eax, 0x10256282
call fcn.1023331b
mov dword [ebp - 0x10], edx
mov esi, ecx
and dword [edx + 4], 0
mov eax, dword [edx]
xor ecx, ecx
mov word [eax], cx
movzx eax, word [esi]
xor edi, edi
test ax, ax
je 0x101fcc21
inc edi
cmp word [esi + edi*2], cx
jne 0x101fcc1a
cmp edi, 1
movzx ebx, ax
jl 0x101fcd36
cmp bx, 0x5c
je 0x101fcd36
cmp bx, 0x2e
jne 0x101fcc55
cmp edi, 1
je 0x101fcd36
cmp edi, 2
jne 0x101fcc55
cmp word [esi + 2], bx
je 0x101fcd36
lea ecx, [ebp - 0x1c]
call fcn.101fca78
and dword [ebp - 4], 0
cmp edi, 3
jle 0x101fcc89
cmp word [esi + 2], 0x3a
jne 0x101fcc89
cmp word [esi + 4], 0x5c
jne 0x101fcc89
cmp bx, 0x61
jb 0x101fcc80
cmp bx, 0x7a
jbe 0x101fccd8
add ebx, 0xffffffbf
cmp bx, 0x19
jbe 0x101fccd8
mov edi, 0x105
cmp dword [ebp - 0x14], edi
jg 0x101fcc9c
push edi
lea ecx, [ebp - 0x1c]
call fcn.101fc54c
push dword [ebp - 0x1c]
push edi
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
lea ecx, [ebp - 0x1c]
mov edi, eax
call fcn.101fcaeb
test edi, edi
je 0x101fcd3e
cmp edi, 0x104
ja 0x101fcd3e
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x1c]
cmp word [ecx + eax*2 - 2], 0x5c
je 0x101fccd8
push 0x5c
lea ecx, [ebp - 0x1c]
call fcn.101fcb4c
push 0x102adbcc
lea ecx, [ebp - 0x40]
call fcn.101fca90
lea ecx, [ebp - 0x1c]
push ecx
mov edx, eax
lea ecx, [ebp - 0x34]
mov byte [ebp - 4], 1
call fcn.101fcb78
push esi
mov edx, eax
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 2
call fcn.101fcbb6
mov ecx, dword [ebp - 0x10]
push eax
mov byte [ebp - 4], 3
call fcn.101fcb0b
push dword [ebp - 0x28]
call fcn.101d2eac
push dword [ebp - 0x34]
call fcn.101d2eac
push dword [ebp - 0x40]
call fcn.101d2eac
push dword [ebp - 0x1c]
call fcn.101d2eac
add esp, 0x10
mov al, 1
call fcn.102333f3
ret
push dword [ebp - 0x1c]
call fcn.101d2eac
pop ecx
xor al, al
jmp 0x101fcd38
Function at 0x101feff0
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
xor edx, edx
mov eax, edx
and eax, 1
dec eax
not eax
and eax, 0xedb88320
mov ecx, edx
shr ecx, 1
xor eax, ecx
mov ecx, eax
and ecx, 1
dec ecx
not ecx
and ecx, 0xedb88320
shr eax, 1
xor ecx, eax
mov eax, ecx
and eax, 1
dec eax
shr ecx, 1
not eax
and eax, 0xedb88320
xor eax, ecx
mov ecx, eax
and ecx, 1
dec ecx
not ecx
and ecx, 0xedb88320
shr eax, 1
xor ecx, eax
mov eax, ecx
and eax, 1
dec eax
shr ecx, 1
not eax
and eax, 0xedb88320
xor eax, ecx
mov ecx, eax
and ecx, 1
dec ecx
not ecx
and ecx, 0xedb88320
shr eax, 1
xor ecx, eax
mov eax, ecx
and eax, 1
dec eax
shr ecx, 1
not eax
and eax, 0xedb88320
xor eax, ecx
mov ecx, eax
and ecx, 1
dec ecx
not ecx
and ecx, 0xedb88320
shr eax, 1
xor ecx, eax
mov dword [edx*4 + 0x103bd0c0], ecx
inc edx
cmp edx, 0x100
jb 0x101feff2
cmp edx, 0x800
jae 0x101ff0c9
lea esp, [esp]
mov eax, dword [edx*4 + 0x103bccc0]
mov ecx, eax
and ecx, 0xff
shr eax, 8
xor eax, dword [ecx*4 + 0x103bd0c0]
inc edx
mov dword [edx*4 + 0x103bd0bc], eax
cmp edx, 0x800
jb 0x101ff0a0
mov dword [0x103b706c], 0x1024f580
call fcn.10208990
test eax, eax
jne 0x101ff0e6
mov dword [0x103b706c], 0x1024f4a0
ret
Function at 0x1020be30
Capabilities:
Encode data using xor

Disassembly:
push ebx
xor eax, eax
or ecx, 0x100
push edi
lea ebx, [ebx]
mov ebx, ecx
shr ebx, 7
mov edi, ecx
shr edi, 8
movzx edi, word [esi + edi*2]
and ebx, 1
neg ebx
sar ebx, 4
shr edi, 4
and ebx, 0x7f
xor edi, ebx
add eax, dword [edx + edi*4]
add ecx, ecx
cmp ecx, 0x10000
jb 0x1020be40
pop edi
pop ebx
ret

Function at 0x1020be70
Capabilities:
Encode data using xor

Disassembly:
push ebx
push ebp
push esi
mov esi, eax
mov edx, 0x100
xor eax, eax
or ecx, edx
mov edi, edi
add esi, esi
mov ebx, edx
and ebx, esi
add ebx, edx
mov ebp, ecx
shr ebp, 8
add ebp, ebx
mov ebx, dword [esp + 0x10]
movzx ebx, word [ebx + ebp*2]
mov ebp, ecx
shr ebp, 7
and ebp, 1
neg ebp
shr ebx, 4
sar ebp, 4
and ebp, 0x7f
xor ebx, ebp
add eax, dword [edi + ebx*4]
add ecx, ecx
mov ebx, ecx
xor ebx, esi
not ebx
and edx, ebx
cmp ecx, 0x10000
jb 0x1020be80
pop esi
pop ebp
pop ebx
ret 4

Function at 0x1020bff0
Capabilities:
Encode data using xor

Disassembly:
push esi
push edi
mov esi, eax
mov edi, ecx
xor eax, eax
lea edx, [eax + 1]
test edi, edi
je 0x1020c032
push ebx
push ebp
mov ebx, dword [esp + 0x14]
movzx ebx, word [ebx + edx*2]
mov ecx, esi
and ecx, 1
mov ebp, ecx
neg ebp
sar ebp, 4
and ebp, 0x7f
shr ebx, 4
xor ebx, ebp
mov ebp, dword [esp + 0x18]
add eax, dword [ebp + ebx*4]
add edx, edx
shr esi, 1
or edx, ecx
sub edi, 1
jne 0x1020c001
pop ebp
pop ebx
pop edi
pop esi
ret 8
Function at 0x1020c180
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0xc
movzx eax, word [ebx]
mov ecx, eax
shr ecx, 4
mov edx, dword [esi + ecx*4]
movzx ecx, word [ebx + 2]
mov dword [esp], edx
mov edx, ecx
xor eax, 0x7f0
xor ecx, 0x7f0
shr edx, 4
mov edx, dword [esi + edx*4]
shr eax, 4
mov eax, dword [esi + eax*4]
shr ecx, 4
mov ecx, dword [esi + ecx*4]
add edx, eax
add ecx, eax
push ebp
mov dword [esp + 8], edx
mov dword [esp + 0xc], ecx
xor edx, edx
push edi
cmp edx, dword [esp + 0x1c]
jae 0x1020c2f3
mov eax, edx
or eax, 8
xor edi, edi
cmp eax, 1
je 0x1020c20a
lea ebx, [ebx]
mov ebp, dword [esp + 0x18]
mov ecx, eax
shr ecx, 1
and eax, 1
lea ebp, [ecx + ebp*8]
movzx ebp, word [ebx + ebp*2 + 4]
neg eax
sar eax, 4
and eax, 0x7f
shr ebp, 4
xor ebp, eax
add edi, dword [esi + ebp*4]
mov eax, ecx
cmp eax, 1
jne 0x1020c1e0
mov eax, dword [esp + 8]
mov ecx, dword [esp + 0x20]
add edi, eax
mov dword [ecx + edx*4], edi
inc edx
cmp edx, 8
jb 0x1020c1c4
cmp edx, 0x10
jae 0x1020c28d
lea eax, [edx - 8]
mov dword [esp + 8], eax
lea esp, [esp]
cmp edx, dword [esp + 0x1c]
jae 0x1020c2f3
or eax, 8
xor edi, edi
cmp eax, 1
je 0x1020c271
mov ebp, dword [esp + 0x18]
mov ecx, eax
shr ecx, 1
and eax, 1
lea ebp, [ecx + ebp*8]
movzx ebp, word [ebx + ebp*2 + 0x104]
neg eax
sar eax, 4
and eax, 0x7f
shr ebp, 4
xor ebp, eax
add edi, dword [esi + ebp*4]
mov eax, ecx
cmp eax, 1
jne 0x1020c244
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 0x20]
add edi, eax
mov eax, dword [esp + 8]
mov dword [ecx + edx*4], edi
inc edx
inc eax
mov dword [esp + 8], eax
cmp edx, 0x10
jb 0x1020c230
cmp edx, dword [esp + 0x1c]
jae 0x1020c2f3
lea eax, [edx - 0x10]
mov dword [esp + 0x18], eax
lea ebx, [ebx]
or eax, 0x100
xor edi, edi
cmp eax, 1
je 0x1020c2d6
lea esp, [esp]
mov ecx, eax
and eax, 1
shr ecx, 1
movzx ebp, word [ebx + ecx*2 + 0x204]
neg eax
sar eax, 4
and eax, 0x7f
shr ebp, 4
xor ebp, eax
add edi, dword [esi + ebp*4]
mov eax, ecx
cmp eax, 1
jne 0x1020c2b0
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x20]
add edi, eax
mov eax, dword [esp + 0x18]
mov dword [ecx + edx*4], edi
inc edx
inc eax
mov dword [esp + 0x18], eax
cmp edx, dword [esp + 0x1c]
jb 0x1020c2a0
pop edi
pop ebp
add esp, 0xc
ret 0xc
Function at 0x1020ddd0
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0xc
push ebx
push ebp
push esi
xor esi, esi
lea eax, [edi + 0x32550]
mov dword [esp + 0x10], esi
mov dword [esp + 0x14], eax
jmp 0x1020ddf0
xor edx, edx
lea ecx, [edx + 1]
mov dword [esp + 0xc], 4
lea ecx, [ecx]
movzx ebx, word [edi + ecx*2 + 0x32bf4]
mov eax, esi
and eax, 1
mov ebp, eax
neg ebp
sar ebp, 4
shr ebx, 4
and ebp, 0x7f
xor ebx, ebp
add edx, dword [edi + ebx*4 + 0x30ea0]
add ecx, ecx
shr esi, 1
or ecx, eax
sub dword [esp + 0xc], 1
jne 0x1020de00
mov eax, dword [esp + 0x14]
mov esi, dword [esp + 0x10]
inc esi
mov dword [eax], edx
add eax, 4
mov dword [esp + 0x10], esi
mov dword [esp + 0x14], eax
cmp esi, 0x10
jb 0x1020ddf0
pop esi
pop ebp
mov dword [edi + 0x32590], 0
pop ebx
add esp, 0xc
ret

Function at 0x1020de60
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x210
push ebx
push ebp
push edi
mov edi, 4
lea ebp, [esi + 0x30ea0]
movzx ebx, byte [esi + edi + 0x306a0]
mov ecx, ebx
mov edx, ebx
and edx, 1
shr ecx, 1
or edx, 2
dec ecx
shl edx, cl
mov eax, edi
push ebp
sub eax, edx
sub edx, ebx
lea edx, [esi + edx*2 + 0x32b0e]
push edx
call fcn.1020bff0
mov dword [esp + edi*4 + 0x1c], eax
inc edi
cmp edi, 0x80
jb 0x1020de74
lea ebp, [esp + 0x1c]
sub ebp, esi
lea eax, [esi + 0x32910]
lea ecx, [esi + 0x31d58]
sub ebp, 0x31d50
lea edi, [esi + 0x31950]
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], ecx
mov dword [esp + 0x14], ebp
mov dword [esp + 0x18], 4
jmp 0x1020dee4
mov ecx, dword [esp + 0xc]
xor ebx, ebx
cmp dword [esi + 0x32594], ebx
jbe 0x1020df3f
mov edi, edi
mov eax, ebx
or eax, 0x40
xor edx, edx
cmp eax, 1
je 0x1020df33
lea esp, [esp]
mov ebp, dword [esp + 0x10]
mov ecx, eax
and eax, 1
shr ecx, 1
movzx ebp, word [ebp + ecx*2]
neg eax
sar eax, 4
and eax, 0x7f
shr ebp, 4
xor ebp, eax
add edx, dword [esi + ebp*4 + 0x30ea0]
mov eax, ecx
cmp eax, 1
jne 0x1020df00
mov ebp, dword [esp + 0x14]
mov ecx, dword [esp + 0xc]
mov dword [edi + ebx*4], edx
inc ebx
cmp ebx, dword [esi + 0x32594]
jb 0x1020def0
mov eax, 0xe
cmp dword [esi + 0x32594], eax
jbe 0x1020df66
lea esp, [esp]
mov edx, eax
shr edx, 1
sub edx, 5
shl edx, 4
add dword [edi + eax*4], edx
inc eax
cmp eax, dword [esi + 0x32594]
jb 0x1020df50
mov eax, dword [edi]
mov dword [ecx - 8], eax
mov edx, dword [edi + 4]
mov dword [ecx - 4], edx
mov eax, dword [edi + 8]
mov dword [ecx], eax
mov edx, dword [edi + 0xc]
mov dword [ecx + 4], edx
mov eax, 4
add ecx, 8
jmp 0x1020df90
movzx edx, byte [esi + eax + 0x306a0]
mov edx, dword [edi + edx*4]
add edx, dword [ecx + ebp]
inc eax
mov dword [ecx], edx
add ecx, 4
cmp eax, 0x80
jb 0x1020df90
sub dword [esp + 0x10], 0xffffff80
add dword [esp + 0xc], 0x200
sub ebp, 0x200
add edi, 0x100
sub dword [esp + 0x18], 1
mov dword [esp + 0x14], ebp
jne 0x1020dee0
pop edi
pop ebp
mov dword [esi + 0x3bcf8], 0
pop ebx
add esp, 0x210
ret
Function at 0x102164e0
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
xor edx, edx
push esi
mov dword [ecx + 0x30], edx
mov dword [ecx + 0x4c], edx
mov dword [ecx + 0x20], edx
mov dword [ecx + 0x2c], 0x20
mov dword [ecx + 0x54], 1
mov dword [ecx + 0x48], 4
mov dword [ecx + 0x58], edx
lea esi, [ecx + 0x70]
mov eax, edx
and eax, 1
dec eax
not eax
and eax, 0xedb88320
mov ecx, edx
shr ecx, 1
xor eax, ecx
mov ecx, eax
and ecx, 1
dec ecx
not ecx
and ecx, 0xedb88320
shr eax, 1
xor ecx, eax
mov eax, ecx
and eax, 1
dec eax
shr ecx, 1
not eax
and eax, 0xedb88320
xor eax, ecx
mov ecx, eax
and ecx, 1
dec ecx
not ecx
and ecx, 0xedb88320
shr eax, 1
xor ecx, eax
mov eax, ecx
and eax, 1
dec eax
shr ecx, 1
not eax
and eax, 0xedb88320
xor eax, ecx
mov ecx, eax
and ecx, 1
dec ecx
not ecx
and ecx, 0xedb88320
shr eax, 1
xor ecx, eax
mov eax, ecx
and eax, 1
dec eax
shr ecx, 1
not eax
and eax, 0xedb88320
xor eax, ecx
mov ecx, eax
and ecx, 1
dec ecx
not ecx
and ecx, 0xedb88320
shr eax, 1
xor ecx, eax
mov dword [esi], ecx
inc edx
add esi, 4
cmp edx, 0x100
jb 0x10216507
pop esi
ret

Function at 0x10217ae0
Capabilities:
Create thread

Disassembly:
push esi
lea eax, [esp + 8]
push eax
push 0
mov esi, ecx
mov ecx, dword [esp + 0x10]
push ecx
push edx
push 0
push 0
call fcn.10231e5d
add esp, 0x18
mov dword [esi], eax
pop esi
test eax, eax
je 0x10217b08
xor eax, eax
ret 4
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x10217b17
mov eax, 1
ret 4
Function at 0x1021a8d9
Capabilities:
Set file attributes

Disassembly:
push 0xc
mov eax, 0x102562a5
call fcn.1023331b
mov edi, edx
mov ebx, ecx
mov esi, dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
push edi
push ebx
call esi
test eax, eax
je 0x1021a8fb
mov al, 1
jmp 0x1021a937
lea ecx, [ebp - 0x18]
call fcn.101fca78
and dword [ebp - 4], 0
lea edx, [ebp - 0x18]
mov ecx, ebx
call fcn.101fcd4b
test al, al
je 0x1021a92c
push edi
push dword [ebp - 0x18]
call esi
push dword [ebp - 0x18]
mov esi, eax
call fcn.101d2eac
test esi, esi
setne al
jmp 0x1021a936
push dword [ebp - 0x18]
call fcn.101d2eac
xor al, al
pop ecx
call fcn.102333f3
ret

Function at 0x1021a9d4
Capabilities:
Get common file path

Disassembly:
push esi
push edi
mov edi, ecx
mov ecx, dword [esp + 0xc]
push 0x105
mov esi, edx
call fcn.101fcad3
push eax
push 0
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetTempFileNameW]
mov ecx, dword [esp + 0xc]
mov esi, eax
call fcn.101fcaeb
pop edi
mov eax, esi
pop esi
ret 4

Function at 0x1021ef6e
Capabilities:
Write file on windows

Disassembly:
push 0x48
mov eax, 0x1025811a
call fcn.10233384
mov esi, ecx
xor ebx, ebx
cmp dword [esi + 0x3c], ebx
je 0x1021f080
cmp byte [esi + 0x42], bl
je 0x1021f080
mov eax, dword [esi]
mov edi, 0xffff
push edi
call dword [eax + 4]
movzx eax, ax
cmp di, ax
jne 0x1021efaa
xor al, al
jmp 0x1021f082
push ebx
push 8
lea ecx, [ebp - 0x2c]
call fcn.1021c27e
mov dword [ebp - 4], ebx
lea eax, [ebp - 0x54]
push eax
lea ecx, [ebp - 0x2c]
call fcn.10028520
mov ecx, eax
call fcn.100285e0
mov edi, dword [ebp - 0x18]
mov ebx, eax
lea eax, [ebp - 0x3c]
push eax
lea ecx, [ebp - 0x2c]
call fcn.10028520
mov ecx, eax
call fcn.100285e0
mov ecx, dword [esi + 0x3c]
mov edx, dword [ecx]
mov dword [ebp - 0x34], eax
lea eax, [ebp - 0x30]
push eax
add edi, ebx
push edi
push dword [ebp - 0x34]
lea eax, [esi + 0x44]
push eax
call dword [edx + 0x18]
sub eax, 0
je 0x1021f01a
dec eax
je 0x1021f01e
dec eax
dec eax
je 0x1021f07c
xor bl, bl
push 0
push 1
lea ecx, [ebp - 0x2c]
call fcn.10036ff0
mov al, bl
jmp 0x1021f082
mov byte [esi + 0x42], 0
lea eax, [ebp - 0x4c]
push eax
lea ecx, [ebp - 0x2c]
call fcn.10028520
mov ecx, eax
call fcn.100285e0
mov edi, dword [ebp - 0x30]
sub edi, eax
je 0x1021f05e
lea eax, [ebp - 0x44]
push eax
lea ecx, [ebp - 0x2c]
call fcn.10028520
mov ecx, eax
call fcn.100285e0
push dword [esi + 0x4c]
push edi
push 1
push eax
call fcn.10238bfe
add esp, 0x10
cmp edi, eax
jne 0x1021f008
cmp byte [esi + 0x42], 0
je 0x1021f07c
test edi, edi
jne 0x1021efb8
push edi
push 8
lea ecx, [ebp - 0x2c]
call fcn.10028410
jmp 0x1021efb8
mov bl, 1
jmp 0x1021f00a
mov al, 1
call fcn.10233407
ret