joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10032804
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x1004fd40]
jne 0x1003280e
repz ret
jmp fcn.10033b16

Function at 0x1003699f
Capabilities:
Write file on windows

Disassembly:
push ecx
push ebx
mov ebx, dword [esp + 0xc]
push esi
push edi
xor esi, esi
xor edi, edi
cmp ebx, dword [edi*8 + 0x10050300]
je 0x100369ba
inc edi
cmp edi, 0x17
jb 0x100369ab
cmp edi, 0x17
jae 0x10036b3a
push ebp
push 3
call fcn.1003aa59
cmp eax, 1
pop ecx
je 0x10036b06
push 3
call fcn.1003aa59
test eax, eax
pop ecx
jne 0x100369ee
cmp dword [0x10051048], 1
je 0x10036b06
cmp ebx, 0xfc
je 0x10036b39
push str.Runtime_Error__n_nProgram:
mov ebx, 0x314
push ebx
mov ebp, 0x10051548
push ebp
call fcn.1003821b
add esp, 0xc
test eax, eax
je 0x10036a24
push esi
push esi
push esi
push esi
push esi
call fcn.1003562c
add esp, 0x14
push 0x104
mov esi, 0x10051561
push esi
push 0
mov byte [0x10051665], 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x10036a68
push str._program_name_unknown_
push 0x2fb
push esi
call fcn.1003821b
add esp, 0xc
test eax, eax
je 0x10036a68
xor eax, eax
push eax
push eax
push eax
push eax
push eax
call fcn.1003562c
add esp, 0x14
push esi
call fcn.10038190
inc eax
cmp eax, 0x3c
pop ecx
jbe 0x10036aad
push esi
call fcn.10038190
sub esi, 0x3b
add eax, esi
push 3
mov ecx, 0x1005185c
push 0x10047f8c
sub ecx, eax
push ecx
push eax
call fcn.1003a9a6
add esp, 0x14
test eax, eax
je 0x10036aad
xor esi, esi
push esi
push esi
push esi
push esi
push esi
call fcn.1003562c
add esp, 0x14
jmp 0x10036aaf
xor esi, esi
push 0x10047f88
push ebx
push ebp
call fcn.1003a935
add esp, 0xc
test eax, eax
je 0x10036acf
push esi
push esi
push esi
push esi
push esi
call fcn.1003562c
add esp, 0x14
push dword [edi*8 + 0x10050304]
push ebx
push ebp
call fcn.1003a935
add esp, 0xc
test eax, eax
je 0x10036af1
push esi
push esi
push esi
push esi
push esi
call fcn.1003562c
add esp, 0x14
push 0x12010
push str.Microsoft_Visual_C_Runtime_Library
push ebp
call fcn.1003a778
add esp, 0xc
jmp 0x10036b39
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
mov ebp, eax
cmp ebp, esi
je 0x10036b39
cmp ebp, 0xffffffff
je 0x10036b39
push 0
lea eax, [esp + 0x14]
push eax
lea esi, [edi*8 + 0x10050304]
push dword [esi]
call fcn.10038190
pop ecx
push eax
push dword [esi]
push ebp
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop ebp
pop edi
pop esi
pop ebx
pop ecx
ret
Function at 0x1003a778
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
push edi
call fcn.1003624a
xor ebx, ebx
cmp dword [0x100519d8], ebx
mov dword [ebp - 8], eax
mov dword [ebp - 4], ebx
mov dword [ebp - 0xc], ebx
mov dword [ebp - 0x10], ebx
jne 0x1003a84e
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
cmp edi, ebx
je 0x1003a92e
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
cmp eax, ebx
je 0x1003a92e
push eax
call fcn.100361dc
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x100519d8], eax
call esi
push eax
call fcn.100361dc
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x100519dc], eax
call esi
push eax
call fcn.100361dc
mov dword [0x100519e0], eax
lea eax, [ebp - 0xc]
push eax
call fcn.10035bef
test eax, eax
pop ecx
pop ecx
je 0x1003a81c
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.1003562c
add esp, 0x14
cmp dword [ebp - 0xc], 2
jne 0x1003a84e
push str.GetUserObjectInformationA
push edi
call esi
push eax
call fcn.100361dc
cmp eax, ebx
pop ecx
mov dword [0x100519e8], eax
je 0x1003a84e
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.100361dc
pop ecx
mov dword [0x100519e4], eax
mov eax, dword [0x100519e4]
mov ecx, dword [ebp - 8]
cmp eax, ecx
je 0x1003a8d3
cmp dword [0x100519e8], ecx
je 0x1003a8d3
push eax
call fcn.10036253
push dword [0x100519e8]
mov esi, eax
call fcn.10036253
cmp esi, ebx
pop ecx
pop ecx
mov edi, eax
je 0x1003a8d3
cmp edi, ebx
je 0x1003a8d3
call esi
cmp eax, ebx
je 0x1003a8a0
lea ecx, [ebp - 0x14]
push ecx
push 0xc
lea ecx, [ebp - 0x20]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x1003a8a0
test byte [ebp - 0x18], 1
jne 0x1003a8d3
lea eax, [ebp - 0x10]
push eax
call fcn.10035c26
test eax, eax
pop ecx
je 0x1003a8bb
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.1003562c
add esp, 0x14
cmp dword [ebp - 0x10], 4
jb 0x1003a8ca
or dword [ebp + 0x10], 0x200000
jmp 0x1003a90e
or dword [ebp + 0x10], 0x40000
jmp 0x1003a90e
mov eax, dword [0x100519dc]
cmp eax, dword [ebp - 8]
je 0x1003a90e
push eax
call fcn.10036253
cmp eax, ebx
pop ecx
je 0x1003a90e
call eax
cmp eax, ebx
mov dword [ebp - 4], eax
je 0x1003a90e
mov eax, dword [0x100519e0]
cmp eax, dword [ebp - 8]
je 0x1003a90e
push eax
call fcn.10036253
cmp eax, ebx
pop ecx
je 0x1003a90e
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x100519d8]
call fcn.10036253
cmp eax, ebx
pop ecx
je 0x1003a92e
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x1003a930
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx

Function at 0x433003
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
mov eax, section..rdata
nop
mov ebx, 0x40de38
mov ecx, 0x752e78f0
nop
nop
nop
nop
nop
test eax, eax
nop
nop
nop
nop
je 0x43304e
xor dword [eax], ecx
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
cmp eax, ebx
nop
nop
nop
jne 0x433024
nop
nop
nop
mov eax, section..data
nop
mov ebx, 0x4304d8
nop
mov ecx, 0x5bcc5343
nop
test eax, eax
nop
nop
nop
nop
nop
je 0x433084
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
add eax, 4
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
jne 0x43306c
nop
popal
nop
nop
nop
nop
nop
jmp 0x431219
Function at 0x10007cd0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1009996f
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push esi
mov esi, ecx
push 0
mov dword [ebp - 0x10], esi
call fcn.100725e1
mov dword [ebp - 4], 0
mov dword [esi + 4], 0
mov byte [esi + 8], 0
mov dword [esi + 0xc], 0
mov byte [esi + 0x10], 0
xor eax, eax
mov dword [esi + 0x14], 0
mov word [esi + 0x18], ax
mov dword [esi + 0x1c], eax
mov word [esi + 0x20], ax
mov dword [esi + 0x24], eax
mov byte [esi + 0x28], al
mov dword [esi + 0x2c], eax
mov byte [esi + 0x30], al
mov eax, dword [ebp + 8]
mov byte [ebp - 4], 6
test eax, eax
je 0x10007d5b
push eax
push esi
call fcn.10072a37
mov ecx, dword [ebp - 0xc]
add esp, 8
mov eax, esi
mov dword fs:[0], ecx
pop esi
mov esp, ebp
pop ebp
ret 4
push str.bad_locale_name
call fcn.100727a5
int3

Function at 0x10008380
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100999b0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push esi
push edi
mov edi, ecx
push 8
mov dword [edi + 0x30], 0
mov dword [edi + 8], 0
mov dword [edi + 0x10], 0
mov dword [edi + 0x14], 0x201
mov dword [edi + 0x18], 6
mov dword [edi + 0x1c], 0
mov dword [edi + 0x20], 0
mov dword [edi + 0x24], 0
mov dword [edi + 0x28], 0
mov dword [edi + 0x2c], 0
mov dword [edi + 0xc], 0
call fcn.1007140e
add esp, 4
mov esi, eax
push 1
mov dword [ebp - 4], 0
call fcn.10072937
mov ecx, dword [ebp - 0xc]
add esp, 4
mov dword [esi + 4], eax
mov dword [edi + 0x30], esi
mov dword fs:[0], ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x100089e0
Capabilities:
Create thread

Disassembly:
cmp byte [0x100bc0c4], 0
push esi
mov esi, dword [esp + 0x10]
jne 0x10008a21
cmp dword [esi + 4], 0x5ad
jne 0x10008a21
push esi
mov byte [0x100bc0c4], 1
call dword [sym.imp.USER32.dll_UnhookWindowsHookEx]
push 0
push 0
push 0
push 0x10008550
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push esi
push dword [esp + 0x10]
push dword [esp + 0x10]
push 0
call dword [sym.imp.USER32.dll_CallNextHookEx]
pop esi
ret
Function at 0x1000ab00
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10099b80
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x20
push ebx
push esi
push edi
mov edi, ecx
mov dword [ebp - 0x10], edi
mov eax, dword [edi]
mov eax, dword [eax + 4]
mov dword [edi + eax], 0x100a8b40
mov eax, dword [edi]
mov edx, dword [eax + 4]
lea eax, [edx - 0x18]
mov dword [edx + edi - 4], eax
mov eax, dword [edi]
mov dword [edi + 8], 0
mov dword [edi + 0xc], 0
mov esi, dword [eax + 4]
add esi, edi
mov ecx, esi
call fcn.10008380
mov eax, dword [ebp + 8]
mov dword [esi + 0x38], eax
mov eax, dword [esi + 0x30]
mov dword [esi + 0x3c], 0
mov ebx, dword [eax + 4]
mov ecx, ebx
mov dword [ebp - 0x18], ebx
mov eax, dword [ebx]
call dword [eax + 4]
lea eax, [ebp - 0x1c]
mov dword [ebp - 4], 2
push eax
call fcn.1000c330
add esp, 4
mov ecx, dword [eax]
push 0x20
mov edx, dword [ecx + 0x30]
mov ecx, eax
call edx
movzx eax, ax
mov dword [ebp + 8], eax
mov byte [ebp - 4], 1
test ebx, ebx
je 0x1000abb8
mov eax, dword [ebx]
mov ecx, ebx
call dword [eax + 8]
test eax, eax
je 0x1000abb5
mov ecx, dword [eax]
push 1
mov edx, dword [ecx]
mov ecx, eax
call edx
mov eax, dword [ebp + 8]
cmp dword [esi + 0x38], 0
mov word [esi + 0x40], ax
jne 0x1000abd5
mov eax, dword [esi + 0xc]
mov ecx, dword [esi + 0x10]
and eax, 0x13
or eax, 4
mov dword [esi + 0xc], eax
and ecx, eax
jne 0x1000ac1d
mov eax, dword [edi + 0x10]
mov eax, dword [eax + 4]
mov dword [edi + eax + 0x10], 0x100a8b6c
mov eax, dword [edi + 0x10]
mov ecx, dword [eax + 4]
lea eax, [ecx - 8]
mov dword [ecx + edi + 0xc], eax
mov eax, dword [edi]
mov eax, dword [eax + 4]
mov dword [edi + eax], 0x100a8b68
mov eax, dword [edi]
mov ecx, dword [eax + 4]
lea eax, [ecx - 0x20]
mov dword [ecx + edi - 4], eax
mov eax, edi
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret 8
test cl, 4
je 0x1000ac29
mov esi, str.ios_base::badbit_set
jmp 0x1000ac39
test cl, 2
mov esi, str.ios_base::failbit_set
mov eax, str.ios_base::eofbit_set
cmove esi, eax
mov edx, 1
lea ecx, [ebp - 0x1c]
call fcn.100079b0
push eax
push esi
lea ecx, [ebp - 0x2c]
call fcn.100082b0
mov ecx, eax
mov dword [ebp - 4], 3
call fcn.100077d0
int3

Function at 0x1000d100
Capabilities:
Allocate or change rwx memory

Disassembly:
cmp byte [0x100bc110], 0
jne 0x1000d121
cmp dword [0x100bc0ec], 0
jne 0x1000d121
mov dword [0x100bc0d4], 0
jmp fcn.1000d0c0
ret
Function at 0x1000f490
Capabilities:
Allocate or change rwx memory

Disassembly:
push ecx
push esi
lea eax, [esp + 4]
mov dword [esp + 4], 0
push eax
push 0x40
mov esi, ecx
push 0x1000
push esi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
je 0x1000f4d0
lea eax, [esp + 4]
mov byte [esi], 0x55
push eax
push dword [esp + 8]
push 0x1000
push esi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov al, 1
pop esi
pop ecx
ret
xor al, al
pop esi
pop ecx
ret

Function at 0x100120f0
Capabilities:
Hash data with crc32

Disassembly:
push ebx
mov ebx, dword [esp + 8]
push esi
push edi
mov edi, edx
not ebx
mov esi, ecx
mov eax, ebx
test edi, edi
je 0x1001213b
mov cl, byte [esi]
lea esi, [esi + 1]
dec edi
cmp cl, 0x23
jne 0x1001211d
cmp edi, 2
jb 0x1001211d
cmp byte [esi], cl
jne 0x1001211d
cmp byte [esi + 1], cl
cmove eax, ebx
movzx edx, al
movzx ecx, cl
xor edx, ecx
shr eax, 8
xor eax, dword [edx*4 + 0x100a9490]
test edi, edi
jne 0x10012103
pop edi
pop esi
not eax
pop ebx
ret 4
mov cl, byte [esi]
inc esi
test cl, cl
je 0x1001216a
cmp cl, 0x23
jne 0x10012151
cmp byte [esi], cl
jne 0x10012151
cmp byte [esi + 1], cl
cmove eax, ebx
movzx edx, al
movzx ecx, cl
xor edx, ecx
shr eax, 8
mov cl, byte [esi]
inc esi
xor eax, dword [edx*4 + 0x100a9490]
test cl, cl
jne 0x10012142
pop edi
pop esi
not eax
pop ebx
ret 4

Function at 0x10012180
Capabilities:
Read file on windows

Disassembly:
push ebx
push ebp
mov ebp, dword [esp + 0xc]
push esi
push edi
test ebp, ebp
je 0x10012193
mov dword [ebp], 0
push edx
push ecx
call fcn.1007a27b
mov esi, eax
add esp, 8
test esi, esi
je 0x10012290
push esi
call fcn.1007a189
mov ebx, eax
add esp, 4
cmp ebx, 0xffffffff
je 0x10012287
push 2
push 0
push esi
call fcn.1007abff
add esp, 0xc
test eax, eax
jne 0x10012287
push esi
call fcn.1007a189
mov edi, eax
add esp, 4
cmp edi, 0xffffffff
je 0x10012287
push 0
push ebx
push esi
call fcn.1007abff
add esp, 0xc
test eax, eax
jne 0x10012287
mov eax, dword [0x100bc128]
test eax, eax
je 0x10012207
inc dword [eax + 0x370]
mov eax, dword [esp + 0x18]
add eax, edi
push eax
call fcn.10080319
mov ebx, eax
add esp, 4
test ebx, ebx
je 0x10012287
push esi
push edi
push 1
push ebx
call fcn.1007b72c
add esp, 0x10
cmp eax, edi
je 0x10012257
push esi
call fcn.1007a8ac
mov eax, dword [0x100bc128]
add esp, 4
test eax, eax
je 0x10012245
dec dword [eax + 0x370]
push ebx
call fcn.1007998a
add esp, 4
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
ret 8
mov eax, dword [esp + 0x18]
test eax, eax
jle 0x1001226e
push eax
lea eax, [edi + ebx]
push 0
push eax
call fcn.100744f0
add esp, 0xc
push esi
call fcn.1007a8ac
add esp, 4
test ebp, ebp
je 0x1001227e
mov dword [ebp], edi
mov eax, ebx
pop edi
pop esi
pop ebp
pop ebx
ret 8
push esi
call fcn.1007a8ac
add esp, 4
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
ret 8
Function at 0x10012410
Capabilities:
Encrypt data using rc4 prga

Disassembly:
sub esp, 0x1c
push ebx
mov ebx, ecx
lea eax, [edx - 1]
push ebp
mov dword [esp + 0x10], ebx
mov ebp, ebx
lea eax, [ebx + eax*2]
mov dword [esp + 0x20], eax
cmp ebx, eax
mov eax, dword [esp + 0x28]
jae 0x100125e5
push esi
mov esi, dword [esp + 0x30]
push edi
nop dword [eax]
mov dword [esp + 0x24], eax
test esi, esi
je 0x10012450
cmp eax, esi
jae 0x100125df
mov cl, byte [eax]
mov byte [esp + 0x30], cl
test cl, cl
je 0x100125df
movzx ecx, cl
xor ebx, ebx
shr ecx, 3
mov edx, esi
movsx ecx, byte [ecx + 0x100a9470]
test ecx, ecx
mov dword [esp + 0x1c], ecx
sete bl
add ebx, ecx
mov dword [esp + 0x20], ebx
test esi, esi
jne 0x10012485
lea edx, [ebx + eax]
cmp eax, edx
lea esi, [eax + 1]
sbb cl, cl
and cl, byte [esp + 0x30]
mov byte [esp + 0x13], cl
cmp esi, edx
jae 0x1001249c
mov bh, byte [esi]
jmp 0x1001249e
xor bh, bh
lea esi, [eax + 2]
mov byte [esp + 0x12], bh
cmp esi, edx
jae 0x100124ad
mov ch, byte [esi]
jmp 0x100124af
xor ch, ch
lea esi, [eax + 3]
mov byte [esp + 0x11], ch
cmp esi, edx
jae 0x100124be
mov bl, byte [esi]
jmp 0x100124c0
xor bl, bl
movzx edx, ch
movzx ecx, cl
movzx esi, bh
movzx edi, bl
mov byte [esp + 0x30], bl
mov ebx, dword [esp + 0x1c]
mov ebx, dword [ebx*4 + 0x100a9890]
and ebx, ecx
mov ecx, esi
and ecx, 0x3f
mov dword [esp + 0x14], ebx
shl dword [esp + 0x14], 6
and esi, 0xc0
or dword [esp + 0x14], ecx
mov ecx, edx
shl dword [esp + 0x14], 6
and ecx, 0x3f
or dword [esp + 0x14], ecx
and edx, 0xc0
shl dword [esp + 0x14], 6
mov ecx, edi
mov ebx, dword [esp + 0x14]
and ecx, 0x3f
or ebx, ecx
shr edi, 2
mov ecx, dword [esp + 0x1c]
or edi, edx
shr edi, 2
or edi, esi
shr edi, 2
mov ecx, dword [ecx*4 + 0x100a9338]
shr ebx, cl
mov esi, ebx
mov dword [esp + 0x14], ebx
mov ebx, dword [esp + 0x1c]
cmp esi, dword [ebx*4 + 0x100a98a4]
sbb ecx, ecx
xor edx, edx
and ecx, 0x40
or edi, ecx
mov ecx, esi
and ecx, 0xfffff800
cmp ecx, 0xd800
mov ecx, 0x80
cmove edx, ecx
mov ecx, 0xffff
or edi, edx
cmp ecx, esi
sbb ecx, ecx
and ecx, 0x100
or edi, ecx
mov ecx, dword [ebx*4 + 0x100a9324]
mov ebx, dword [esp + 0x20]
xor edi, 0x2a
sar edi, cl
test edi, edi
je 0x100125c4
xor eax, eax
mov esi, 0xfffd
cmp byte [esp + 0x30], al
setne al
xor ecx, ecx
cmp byte [esp + 0x11], cl
setne cl
add eax, ecx
xor ecx, ecx
cmp byte [esp + 0x12], cl
setne cl
add eax, ecx
xor ecx, ecx
cmp byte [esp + 0x13], cl
setne cl
add eax, ecx
cmp ebx, eax
cmovl eax, ebx
add eax, dword [esp + 0x24]
jmp 0x100125ca
add eax, ebx
test esi, esi
je 0x100125df
mov word [ebp], si
add ebp, 2
mov esi, dword [esp + 0x34]
cmp ebp, dword [esp + 0x28]
jb 0x10012440
mov ebx, dword [esp + 0x18]
pop edi
pop esi
xor ecx, ecx
mov word [ebp], cx
mov ecx, dword [esp + 0x30]
test ecx, ecx
je 0x100125f5
mov dword [ecx], eax
sub ebp, ebx
sar ebp, 1
mov eax, ebp
pop ebp
pop ebx
add esp, 0x1c
ret 0xc
Function at 0x10012610
Capabilities:
Encrypt data using rc4 prga

Disassembly:
sub esp, 0x14
push ebx
push ebp
mov ebp, edx
mov eax, ecx
push esi
push edi
mov dword [esp + 0x20], ebp
xor edx, edx
mov dword [esp + 0x18], edx
mov dword [esp + 0x1c], eax
test ebp, ebp
je 0x10012635
cmp eax, ebp
jae 0x100127ba
mov cl, byte [eax]
mov byte [esp + 0x12], cl
test cl, cl
je 0x100127ba
movzx ecx, cl
xor ebx, ebx
shr ecx, 3
mov edx, ebp
movsx ecx, byte [ecx + 0x100a9470]
test ecx, ecx
mov dword [esp + 0x14], ecx
sete bl
add ebx, ecx
test ebp, ebp
jne 0x10012666
lea edx, [ebx + eax]
cmp eax, edx
lea esi, [eax + 1]
sbb cl, cl
and cl, byte [esp + 0x12]
mov byte [esp + 0x13], cl
cmp esi, edx
jae 0x10012681
mov ch, byte [esi]
mov byte [esp + 0x11], ch
jmp 0x10012686
mov byte [esp + 0x11], 0
lea esi, [eax + 2]
cmp esi, edx
jae 0x10012695
mov ch, byte [esi]
mov byte [esp + 0x10], ch
jmp 0x1001269a
mov byte [esp + 0x10], 0
lea esi, [eax + 3]
cmp esi, edx
jae 0x100126a5
mov ch, byte [esi]
jmp 0x100126a7
xor ch, ch
mov ebp, dword [esp + 0x14]
movzx esi, byte [esp + 0x11]
movzx edx, byte [esp + 0x10]
movzx edi, ch
mov ebp, dword [ebp*4 + 0x100a9890]
mov byte [esp + 0x12], ch
movzx ecx, cl
and ebp, ecx
mov ecx, esi
and ecx, 0x3f
shl ebp, 6
or ebp, ecx
and esi, 0xc0
shl ebp, 6
mov ecx, edx
and ecx, 0x3f
and edx, 0xc0
or ebp, ecx
mov ecx, edi
and ecx, 0x3f
shr edi, 2
or edi, edx
shl ebp, 6
or ebp, ecx
shr edi, 2
mov ecx, dword [esp + 0x14]
or edi, esi
mov esi, dword [esp + 0x14]
shr edi, 2
mov ecx, dword [ecx*4 + 0x100a9338]
shr ebp, cl
cmp ebp, dword [esi*4 + 0x100a98a4]
sbb ecx, ecx
xor edx, edx
and ecx, 0x40
or edi, ecx
mov ecx, ebp
and ecx, 0xfffff800
cmp ecx, 0xd800
mov ecx, 0x80
cmove edx, ecx
mov ecx, 0xffff
or edi, edx
cmp ecx, ebp
sbb ecx, ecx
and ecx, 0x100
or edi, ecx
mov ecx, dword [esi*4 + 0x100a9324]
xor edi, 0x2a
sar edi, cl
test edi, edi
je 0x1001279a
xor eax, eax
mov edx, dword [esp + 0x18]
cmp byte [esp + 0x13], al
mov ebp, dword [esp + 0x20]
setne al
xor ecx, ecx
cmp byte [esp + 0x12], cl
setne cl
add eax, ecx
xor ecx, ecx
cmp byte [esp + 0x10], cl
setne cl
add eax, ecx
xor ecx, ecx
cmp byte [esp + 0x11], cl
setne cl
add eax, ecx
cmp ebx, eax
cmovl eax, ebx
add eax, dword [esp + 0x1c]
inc edx
jmp 0x10012621
add eax, ebx
test ebp, ebp
je 0x100127ae
mov edx, dword [esp + 0x18]
mov ebp, dword [esp + 0x20]
inc edx
jmp 0x10012621
mov eax, dword [esp + 0x18]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x14
ret
pop edi
pop esi
pop ebp
mov eax, edx
pop ebx
add esp, 0x14
ret
Function at 0x100142b0
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
mov edx, dword [ecx + 0xc0]
mov eax, dword [ecx + 0xc8]
push esi
push edi
lea esi, [esp + 0xc]
mov edi, 4
mov eax, dword [eax + edx*4 - 4]
not eax
nop dword [eax]
movzx ecx, byte [esi]
lea esi, [esi + 1]
movzx edx, al
xor edx, ecx
shr eax, 8
xor eax, dword [edx*4 + 0x100a9490]
sub edi, 1
jne 0x100142d0
mov ecx, dword [0x100bc128]
not eax
pop edi
pop esi
cmp dword [ecx + 0x1aa4], eax
jne 0x10014302
mov dword [ecx + 0x1aa8], eax
cmp dword [ecx + 0x1adc], eax
jne 0x10014311
mov byte [ecx + 0x1ae0], 1
ret 4

Function at 0x10014320
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
sub esp, 0x10
mov edx, dword [esp + 0x14]
push esi
mov esi, ecx
push edi
movss xmm0, dword [edx]
mov edi, 0x10
subss xmm0, dword [esi + 0xc]
mov ecx, dword [esi + 0xc0]
cvttss2si eax, xmm0
movss xmm0, dword [edx + 4]
subss xmm0, dword [esi + 0x10]
mov dword [esp + 8], eax
cvttss2si eax, xmm0
movss xmm0, dword [edx + 8]
subss xmm0, dword [esi + 0xc]
mov dword [esp + 0xc], eax
cvttss2si eax, xmm0
movss xmm0, dword [edx + 0xc]
subss xmm0, dword [esi + 0x10]
mov dword [esp + 0x10], eax
cvttss2si eax, xmm0
mov dword [esp + 0x14], eax
mov eax, dword [esi + 0xc8]
lea esi, [esp + 8]
mov edx, dword [eax + ecx*4 - 4]
not edx
nop dword [eax]
movzx eax, byte [esi]
lea esi, [esi + 1]
movzx ecx, dl
xor ecx, eax
shr edx, 8
xor edx, dword [ecx*4 + 0x100a9490]
sub edi, 1
jne 0x10014390
mov eax, dword [0x100bc128]
not edx
pop edi
pop esi
cmp dword [eax + 0x1aa4], edx
jne 0x100143c1
mov dword [eax + 0x1aa8], edx
cmp dword [eax + 0x1adc], edx
jne 0x100143d0
mov byte [eax + 0x1ae0], 1
mov eax, edx
add esp, 0x10
ret 4
Function at 0x10014920
Capabilities:
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x1009aa72
push eax
mov dword fs:[0], esp
sub esp, 0x38
mov eax, dword [0x100bc128]
push ebx
push esi
mov esi, ecx
push edi
test eax, eax
je 0x1001494f
inc dword [eax + 0x370]
push 0x3d40
call fcn.10080319
lea ecx, [ebp - 0xd]
mov dword [ebp - 0x14], eax
add esp, 4
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x1c], eax
mov dword [ebp - 4], 0
test eax, eax
je 0x10014982
push esi
mov ecx, eax
call fcn.100105e0
mov edi, eax
mov dword [ebp - 0x14], eax
jmp 0x10014987
xor edi, edi
mov dword [ebp - 0x14], edi
mov dword [ebp - 4], 0xffffffff
mov esi, 0x100a91d5
mov eax, dword [0x100bc128]
test eax, eax
mov dword [ebp - 0x34], 0
cmove eax, edi
mov dword [ebp - 0x20], 0
mov dword [0x100bc128], eax
or edx, 0xffffffff
mov dword [ebp - 0x40], str.Window
mov al, 0x57
or edi, 0xffffffff
nop
cmp al, 0x23
jne 0x100149ce
cmp byte [esi], al
jne 0x100149ce
cmp byte [esi + 1], al
cmove edx, edi
movzx ecx, dl
movzx eax, al
xor ecx, eax
shr edx, 8
mov al, byte [esi]
inc esi
xor edx, dword [ecx*4 + 0x100a9490]
test al, al
jne 0x100149c0
mov ebx, dword [ebp - 0x14]
lea eax, [ebp - 0x40]
not edx
mov dword [ebp - 0x38], 0x100237a0
push eax
mov dword [ebp - 0x3c], edx
lea ecx, [ebx + 0x2ed4]
mov dword [ebp - 0x30], 0x10023810
mov dword [ebp - 0x2c], 0x10023880
mov dword [ebp - 0x28], 0x10023940
mov dword [ebp - 0x24], 0x10023a10
call fcn.10023e10
or edx, 0xffffffff
mov dword [ebp - 0x34], 0
mov dword [ebp - 0x20], 0
mov esi, 0x100adad9
mov dword [ebp - 0x40], str.Table
mov al, 0x54
or edi, 0xffffffff
cmp al, 0x23
jne 0x10014a51
cmp byte [esi], al
jne 0x10014a51
cmp byte [esi + 1], al
cmove edx, edi
movzx ecx, dl
movzx eax, al
xor ecx, eax
shr edx, 8
mov al, byte [esi]
inc esi
xor edx, dword [ecx*4 + 0x100a9490]
test al, al
jne 0x10014a43
lea eax, [ebp - 0x40]
mov dword [ebp - 0x38], 0x10034ef0
not edx
mov dword [ebp - 0x30], 0x10034fb0
push eax
lea ecx, [ebx + 0x2ed4]
mov dword [ebp - 0x3c], edx
mov dword [ebp - 0x2c], 0x10035040
mov dword [ebp - 0x28], 0x10034f70
mov dword [ebp - 0x24], 0x10035290
call fcn.10023e10
mov edi, dword [ebp - 0x14]
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov byte [edi], 1
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x100187e0
Capabilities:
Hash data with crc32

Disassembly:
mov eax, ecx
or ecx, 0xffffffff
push ebx
push esi
mov bl, byte [eax]
lea esi, [eax + 1]
test bl, bl
je 0x1001881d
push edi
or edi, 0xffffffff
cmp bl, 0x23
jne 0x10018803
cmp byte [esi], bl
jne 0x10018803
cmp byte [esi + 1], bl
cmove ecx, edi
movzx edx, cl
movzx eax, bl
mov bl, byte [esi]
xor edx, eax
shr ecx, 8
inc esi
xor ecx, dword [edx*4 + 0x100a9490]
test bl, bl
jne 0x100187f4
pop edi
pop esi
not ecx
pop ebx
jmp fcn.10018780