joyce8/EMBER2024-capa huggingface dataset:
Function at 0x874900
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x87493f
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x87493f
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x87493f
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x87493f
cmp dword [ecx + 0x74], 0xe
jbe 0x87493f
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret

Function at 0x87b95f
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x88e840
push 0x88e838
push str.FlsAlloc
push 0x1f
call fcn.0087b87b
mov esi, eax
add esp, 0x10
test esi, esi
je 0x87b993
push dword [ebp + 8]
mov ecx, esi
call dword [0x88b1ac]
call esi
jmp 0x87b999
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
pop esi
pop ebp
ret 4

Function at 0x87b9dd
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x88e850
push 0x88e848
push str.FlsGetValue
push 0x21
call fcn.0087b87b
mov esi, eax
add esp, 0x10
test esi, esi
je 0x87ba14
push dword [ebp + 8]
mov ecx, esi
call dword [0x88b1ac]
call esi
pop esi
pop ebp
ret 4
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsGetValue]

Function at 0x87ba1c
Capabilities:
Set thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x88e858
push 0x88e850
push str.FlsSetValue
push 0x22
call fcn.0087b87b
mov esi, eax
add esp, 0x10
test esi, esi
je 0x87ba56
push dword [ebp + 0xc]
mov ecx, esi
push dword [ebp + 8]
call dword [0x88b1ac]
call esi
pop esi
pop ebp
ret 8
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsSetValue]
Function at 0x87f432
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
je 0x87f4cf
push ebx
push esi
call fcn.0087f3fb
xor ebx, ebx
sub eax, esi
push ebx
push ebx
push ebx
push ebx
sar eax, 1
push eax
push esi
push ebx
push ebx
mov dword [ebp - 8], eax
call fcn.0087e398
add esp, 0x24
mov dword [ebp - 4], eax
test eax, eax
jne 0x87f47c
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x87f4ce
push edi
push eax
call fcn.0087c10e
mov edi, eax
pop ecx
push ebx
test edi, edi
jne 0x87f49c
call fcn.0087b728
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x87f4cd
push ebx
push dword [ebp - 4]
push edi
push dword [ebp - 8]
push esi
push ebx
push ebx
call fcn.0087e398
add esp, 0x20
test eax, eax
jne 0x87f4bb
push edi
call fcn.0087b728
jmp 0x87f4c3
push ebx
call fcn.0087b728
mov ebx, edi
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, ebx
pop edi
pop ebx
pop esi
leave
ret
Function at 0x8855b0
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x8855dd
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x8855dd
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx

Function at 0x906058
Capabilities:
Decompress data using aplib

Disassembly:
call 0x9061a8
push ebx
mov ebx, esp
push ebx
mov esi, dword [ebx + 8]
mov edi, dword [ebx + 0x10]
cld
mov dl, 0x80
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
mov ebx, 2
add dl, dl
jne 0x90607e
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x90606a
add dl, dl
jne 0x906089
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x9060dc
xor eax, eax
add dl, dl
jne 0x906096
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x90617d
add dl, dl
jne 0x9060a5
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x9060b0
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x9060bb
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x9060c6
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0x9060d2
push edi
mov eax, eax
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0x906075
mov eax, 1
add dl, dl
jne 0x9060ea
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x9060f5
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x9060e1
sub eax, ebx
mov ebx, 1
jne 0x906128
mov ecx, 1
add dl, dl
jne 0x90610e
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x906119
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x906105
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x906075
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x90613f
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x90614a
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x906136
cmp eax, 0x7d00
jae 0x90616d
cmp eax, 0x500
jb 0x906168
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x906075
cmp eax, 0x7f
ja 0x906170
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x906075
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0x90619e
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0x906075
pop ebx
sub edi, dword [ebx + 0x10]
mov eax, edi
pop ebx
ret 0x10
Function at 0x401031
Capabilities:
Hide graphical window

Disassembly:
push 0
call sub.kernel32.dll_GetModuleHandleA
mov dword [0x403024], eax
call sub.kernel32.dll_GetCommandLineA
mov dword [0x403028], eax
push 0xa
push dword [0x403028]
push 0
push dword [0x403024]
call 0x401031
push eax
call sub.kernel32.dll_ExitProcess
push ebp
mov ebp, esp
add esp, 0xffffffb0
mov dword [ebp - 0x30], 0x30
mov dword [ebp - 0x2c], 3
mov dword [ebp - 0x28], 0x401119
mov dword [ebp - 0x24], 0
mov dword [ebp - 0x20], 0
push dword [0x403024]
pop dword [ebp - 0x1c]
mov dword [ebp - 0x10], 6
mov dword [ebp - 0xc], 0
mov dword [ebp - 8], str.SimpleWinClass
push 0x7f00
push 0
call sub.user32.dll_LoadIconA
mov dword [ebp - 0x18], eax
mov dword [ebp - 4], eax
push 0x7f00
push 0
call sub.user32.dll_LoadCursorA
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x30]
push eax
call sub.user32.dll_RegisterClassExA
push 0
push dword [ebp + 8]
push 0
push 0
push 0x80000000
push 0x80000000
push 0x80000000
push 0x80000000
push 0xcf0000
push str.Nasze_Pierwsze_Okno
push str.SimpleWinClass
push 0
call sub.user32.dll_CreateWindowExA
mov dword [ebp - 0x50], eax
push dword [ebp + 0x14]
push dword [ebp - 0x50]
call sub.user32.dll_ShowWindow
push dword [ebp - 0x50]
call sub.user32.dll_UpdateWindow
push 0
push 0
push 0
lea eax, [ebp - 0x4c]
push eax
call sub.user32.dll_GetMessageA
or eax, eax
je 0x401112
lea eax, [ebp - 0x4c]
push eax
call sub.user32.dll_TranslateMessage
lea eax, [ebp - 0x4c]
push eax
call sub.user32.dll_DispatchMessageA
jmp 0x4010eb
mov eax, dword [ebp - 0x44]
leave
ret 0x10
Function at 0x10001cc0
Capabilities:
Get geographical location
Get keyboard layout

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
mov eax, dword [0x10081040]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [0x10081888]
lea eax, [ebp - 0x10]
push esi
push edi
push eax
mov dword [ebp - 0x24], ecx
call dword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
test eax, eax
je 0x10001e6c
lea eax, [ebp - 0x18]
push eax
call dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
test eax, eax
je 0x10001e6c
push 0x38
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov esi, dword [0x10081888]
add esp, 4
mov edi, eax
test esi, esi
je 0x10001d63
movsx edx, word [esi + 0x5eec]
lea eax, [esi + 0x5ef0]
mov ecx, dword [esi + 0x3f10]
lea eax, [eax + edx*8]
cmp dword [eax], ecx
je 0x10001d59
lea eax, [edx + 1]
mov dword [ebp - 0x1c], 6
cdq
idiv dword [ebp - 0x1c]
movzx eax, dx
mov word [esi + 0x5eec], ax
cwde
add eax, 0xbde
lea eax, [esi + eax*8]
mov dword [eax], ecx
xor ecx, ecx
mov dword [eax + 4], ecx
inc word [eax + 4]
inc dword [esi + 0x5ee4]
test edi, edi
je 0x10001d76
push 0x38
push 0
push edi
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
jmp 0x10001d78
xor edi, edi
or dword [ebx + 0xc], 6
mov dword [ebx + 0x74], edi
mov dword [ebx + 0x6c], str.imgui_impl_win32
mov ebx, dword [ebp - 0x24]
mov dword [edi], ebx
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0xc]
mov dword [edi + 0x18], eax
mov dword [edi + 0x1c], ecx
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x14]
mov dword [edi + 0x10], eax
mov dword [edi + 0x14], ecx
mov dword [edi + 0x20], 9
test esi, esi
je 0x10001db3
mov esi, dword [esi + 0x74]
jmp 0x10001db5
xor esi, esi
push 0
call dword [sym.imp.USER32.dll_GetKeyboardLayout]
push 4
add esi, 0x24
shr eax, 0x10
push esi
push 0x20001004
push eax
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
test eax, eax
jne 0x10001dd8
mov dword [esi], eax
mov eax, dword [0x10081888]
xor esi, esi
mov dword [ebp - 0x38], str.xinput1_4.dll
mov dword [ebp - 0x34], str.xinput1_3.dll
mov dword [ebp - 0x30], str.xinput9_1_0.dll
mov eax, dword [eax + 0x4a40]
mov dword [ebp - 0x2c], str.xinput1_2.dll
mov dword [ebp - 0x28], str.xinput1_1.dll
mov eax, dword [eax]
mov dword [eax + 0x28], ebx
mov byte [edi + 0x29], 1
push dword [ebp + esi*4 - 0x38]
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov ebx, eax
test ebx, ebx
jne 0x10001e3a
inc esi
cmp esi, 5
jl 0x10001e11
mov al, 1
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10052813
mov esp, ebp
pop ebp
ret
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.XInputGetCapabilities
push ebx
mov dword [edi + 0x2c], ebx
call esi
push str.XInputGetState
push ebx
mov dword [edi + 0x30], eax
call esi
mov dword [edi + 0x34], eax
mov al, 1
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10052813
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor al, al
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10052813
mov esp, ebp
pop ebp
ret
Function at 0x10003eb0
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10053c40
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x10081040]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
mov dword [esi + 8], 0
mov dword [esi + 0xc], 0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
push 0x2c
mov dword [esi + 0x18], 0
mov dword [esi + 0x1c], 0
push 0
push esi
mov dword [esi + 0x20], 0
mov dword [esi + 0x24], 0
call sub.VCRUNTIME140.dll_memset
lea edi, [esi + 0x3c]
add esp, 0xc
lea eax, [edi + 0x10]
mov dword [ebp - 0x10], edi
mov dword [eax + 4], 0
mov dword [eax], 0
mov dword [eax + 8], 0
mov dword [ebp - 4], 0
mov dword [edi + 0x1c], 0
mov dword [edi + 0x20], 0
mov dword [edi + 0x24], 0
mov dword [edi + 0x28], 0
mov dword [edi + 0x2c], 0
mov dword [edi + 0x30], 0
mov byte [edi], 0
mov dword [edi + 0xc], 0
mov dword [edi + 8], 0
mov dword [edi + 4], 0
mov ecx, dword [eax + 4]
test ecx, ecx
jns 0x10003fa8
mov eax, ecx
cdq
sub eax, edx
sar eax, 1
add eax, ecx
xor ecx, ecx
test eax, eax
cmovg ecx, eax
push ecx
lea ecx, [edi + 0x10]
call fcn.1001ecb0
lea eax, [edi + 0x10]
mov dword [eax], 0
xorps xmm0, xmm0
mov dword [edi + 0x2c], 0
mov eax, esi
mov dword [edi + 0x30], 0
mov dword [edi + 0x24], 0
mov dword [edi + 0x28], 0
mov dword [edi + 0x1c], 0
mov dword [edi + 0x20], 0
mov dword [edi + 0x34], 0
mov dword [esi + 0x80], 0
mov dword [esi + 0x7c], 0
mov dword [esi + 0x84], 0
movups xmmword [esi + 0x74], xmm0
mov dword [esi + 0x84], 0
mov dword [esi + 0x88], 0
mov dword [esi + 0x8c], 0
mov dword [esi + 0x90], 0
mov dword [esi + 0x94], 0
mov dword [esi + 0x98], 0
mov dword [esi + 0x9c], 0
mov dword [esi + 0xa0], 0
mov dword [esi + 0xa4], 0
mov dword [esi + 0x30], 0xffffffff
mov dword [esi + 0x2c], 0xffffffff
mov dword [esi + 0x38], 0
mov dword [esi + 0x34], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x10006900
Capabilities:
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
mov edi, edx
not ebx
mov esi, ecx
mov eax, ebx
test edi, edi
je 0x10006961
mov cl, byte [esi]
lea esi, [esi + 1]
dec edi
cmp cl, 0x23
jne 0x10006944
cmp edi, 2
jb 0x10006944
cmp byte [esi], cl
jne 0x10006944
cmp byte [esi + 1], cl
jne 0x10006944
mov eax, ebx
movzx ecx, cl
movzx edx, al
xor edx, ecx
shr eax, 8
xor eax, dword [edx*4 + 0x10074788]
jmp 0x10006915
movzx edx, al
movzx ecx, cl
xor edx, ecx
shr eax, 8
xor eax, dword [edx*4 + 0x10074788]
test edi, edi
jne 0x10006915
pop edi
pop esi
not eax
pop ebx
pop ebp
ret
mov cl, byte [esi]
inc esi
test cl, cl
je 0x10006990
cmp cl, 0x23
jne 0x10006977
cmp byte [esi], cl
jne 0x10006977
cmp byte [esi + 1], cl
cmove eax, ebx
movzx edx, al
movzx ecx, cl
xor edx, ecx
shr eax, 8
mov cl, byte [esi]
inc esi
xor eax, dword [edx*4 + 0x10074788]
test cl, cl
jne 0x10006968
pop edi
pop esi
not eax
pop ebx
pop ebp
ret
Function at 0x10006b20
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
test ebx, ebx
je 0x10006b33
mov dword [ebx], 0
mov edx, 0x10074354
call fcn.100069a0
mov esi, eax
test esi, esi
je 0x10006c52
mov edi, dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_ftell]
push esi
call edi
add esp, 4
mov dword [ebp + 8], eax
cmp eax, 0xffffffff
je 0x10006c48
push 2
push 0
push esi
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fseek]
add esp, 0xc
test eax, eax
jne 0x10006c48
push esi
call edi
mov edi, eax
add esp, 4
cmp edi, 0xffffffff
je 0x10006c48
push 0
push dword [ebp + 8]
push esi
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fseek]
add esp, 0xc
test eax, eax
jne 0x10006c48
mov ecx, edi
call fcn.1000a6f0
mov dword [ebp + 8], eax
test eax, eax
je 0x10006c48
push esi
push edi
push 1
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
add esp, 0x10
push esi
cmp eax, edi
je 0x10006c31
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
mov ecx, dword [0x10081888]
add esp, 4
test ecx, ecx
je 0x10006c1e
movsx edx, word [ecx + 0x5eec]
lea eax, [ecx + 0x5ef0]
mov esi, dword [ecx + 0x3f10]
lea eax, [eax + edx*8]
cmp dword [eax], esi
je 0x10006c14
lea eax, [edx + 1]
mov edi, 6
cdq
idiv edi
movzx eax, dx
mov word [ecx + 0x5eec], ax
cwde
add eax, 0xbde
xor edx, edx
lea eax, [ecx + eax*8]
mov dword [eax], esi
mov dword [eax + 4], edx
inc word [eax + 6]
inc dword [ecx + 0x5ee8]
push dword [ebp + 8]
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
add esp, 4
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
add esp, 4
test ebx, ebx
je 0x10006c40
mov dword [ebx], edi
mov eax, dword [ebp + 8]
pop edi
pop esi
pop ebx
pop ebp
ret
push esi
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
add esp, 4
pop edi
pop esi
xor eax, eax
pop ebx
pop ebp
ret
Function at 0x1000d6f0
Capabilities:
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x10081040]
xor eax, ebp
mov dword [ebp - 8], eax
push ebx
push esi
mov esi, dword [0x10081888]
mov ebx, edx
push edi
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x10], ecx
mov edi, dword [esi + 0x3f94]
mov eax, dword [esi + 0x495c]
or eax, 0x100
mov dword [esi + 0x4994], 1
mov dword [esi + 0x495c], eax
cmp dword [edi + 0x198], 0
mov dword [ebp - 0x18], edi
mov dword [ebp - 0x14], eax
jne 0x1000d74f
cmp dword [esi + 0x4ce8], 0
mov eax, 0x234
je 0x1000d754
mov eax, 0x204
movss xmm1, dword [edi + eax]
lea ecx, [ebp - 0x24]
movss xmm2, dword [edi + eax + 4]
mov eax, dword [ebp + 8]
subss xmm2, dword [edi + 0xfc]
subss xmm1, dword [edi + 0xf8]
push dword [eax + 4]
push dword [eax]
call fcn.10017390
mov eax, dword [ebp - 0x14]
add esp, 8
mov ecx, dword [ebp - 0x20]
or eax, 2
mov dword [esi + 0x495c], eax
mov eax, dword [ebp - 0x24]
mov dword [esi + 0x4980], ecx
mov ecx, dword [ebp - 0x10]
mov dword [esi + 0x497c], eax
mov dword [esi + 0x4964], 1
mov eax, dword [edi + 4]
push ebx
test ecx, ecx
je 0x1000d7cc
push ecx
push eax
push str._s__s__08X
lea eax, [ebp - 0x14]
push 0
push eax
call fcn.100067d0
add esp, 0x18
jmp 0x1000d7e0
push eax
push str._s__08X
lea eax, [ebp - 0x14]
push 0
push eax
call fcn.100067d0
add esp, 0x14
movss xmm0, dword [esi + 0x38d8]
xor edx, edx
mov ecx, dword [ebp - 0x14]
push 0x1000107
movss dword [ebp - 0x10], xmm0
call fcn.10010ef0
mov edi, dword [esi + 0x3f94]
add esp, 4
movss xmm0, dword [ebp - 0x10]
movss dword [esi + 0x38d8], xmm0
mov byte [ebp - 9], al
cmp word [edi + 0xbc], 1
mov dword [ebp - 0x10], edi
mov dword [edi + 0x78], ebx
jne 0x1000d83a
mov eax, dword [ebp - 0x18]
mov ecx, dword [edi + 0x18]
mov edx, dword [edi + 0x1c]
mov dword [eax + 0xf8], ecx
mov dword [eax + 0xfc], edx
mov edi, ebx
mov edx, 0x100737f1
not edi
mov al, 0x23
mov ebx, edi
cmp al, 0x23
jne 0x1000d855
cmp byte [edx], al
jne 0x1000d855
cmp byte [edx + 1], al
cmove ebx, edi
movzx ecx, bl
movzx eax, al
xor ecx, eax
shr ebx, 8
mov al, byte [edx]
inc edx
xor ebx, dword [ecx*4 + 0x10074788]
test al, al
jne 0x1000d847
mov edi, dword [ebp - 0x10]
not ebx
cmp dword [esi + 0x3fe4], ebx
jne 0x1000d884
xor edx, edx
xor ecx, ecx
call fcn.10009f90
mov eax, dword [ebp - 0x1c]
cmp dword [esi + 0x4a5c], eax
jne 0x1000d8c9
cmp word [edi + 0x154], 0
jne 0x1000d8a2
cmp byte [edi + 0x15a], 0
je 0x1000d8c9
xor edx, edx
mov ecx, edi
call fcn.10013e40
xor dl, dl
mov ecx, edi
call fcn.100196f0
mov edx, edi
mov ecx, ebx
call fcn.10009f90
mov eax, dword [esi + 0x4a88]
mov dword [esi + 0x4008], eax
mov ecx, dword [ebp - 8]
mov al, byte [ebp - 9]
xor ecx, ebp
pop edi
pop esi
pop ebx
call fcn.10052813
mov esp, ebp
pop ebp
ret
Function at 0x1000da90
Capabilities:
Hash data with crc32

Disassembly:
push ebx
mov bl, byte [ecx]
or eax, 0xffffffff
push esi
lea esi, [ecx + 1]
or ecx, 0xffffffff
push edi
test bl, bl
je 0x1000dacf
cmp bl, 0x23
jne 0x1000dab1
cmp byte [esi], bl
jne 0x1000dab1
cmp byte [esi + 1], bl
cmove eax, ecx
movzx edx, al
movzx ecx, bl
mov bl, byte [esi]
xor edx, ecx
shr eax, 8
inc esi
mov ecx, 0xffffffff
xor eax, dword [edx*4 + 0x10074788]
test bl, bl
jne 0x1000daa2
mov ecx, dword [0x10081888]
not eax
mov esi, dword [ecx + 0x3f78]
mov edi, dword [ecx + 0x3f80]
lea ebx, [edi + esi*8]
test esi, esi
je 0x1000db0e
nop word [eax + eax]
mov edx, esi
shr edx, 1
cmp dword [edi + edx*8], eax
lea ecx, [edi + edx*8]
jae 0x1000db08
lea edi, [ecx + 8]
or ecx, 0xffffffff
sub ecx, edx
add esi, ecx
jmp 0x1000db0a
mov esi, edx
test esi, esi
jne 0x1000daf0
cmp edi, ebx
je 0x1000db1d
cmp dword [edi], eax
jne 0x1000db1d
mov eax, dword [edi + 4]
pop edi
pop esi
pop ebx
ret
pop edi
pop esi
xor eax, eax
pop ebx
ret
Function at 0x100148d0
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [0x10081040]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
lea edx, [ebp - 8]
push ebx
push esi
push edi
mov edi, ecx
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], eax
mov esi, 4
mov eax, dword [edi + 0xec]
mov ebx, dword [edi + 0xf4]
mov ebx, dword [ebx + eax*4 - 4]
not ebx
nop dword [eax + eax]
movzx eax, byte [edx]
lea edx, [edx + 1]
movzx ecx, bl
xor ecx, eax
shr ebx, 8
xor ebx, dword [ecx*4 + 0x10074788]
sub esi, 1
jne 0x10014910
mov eax, dword [edi]
not ebx
cmp dword [eax + 0x3fcc], ebx
jne 0x10014947
push ecx
push dword [ebp - 0xc]
lea edx, [esi + 4]
mov ecx, ebx
call fcn.1001e2f0
add esp, 8
mov ecx, dword [ebp - 4]
mov eax, ebx
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10052813
mov esp, ebp
pop ebp
ret 4
Function at 0x1001cc70
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push ecx
push ebx
push esi
push edi
mov edi, ecx
mov ebx, edx
cmp dword [edi + 0x5e34], 0
lea esi, [edi + 0x5e38]
je 0x1001ccf2
mov ecx, dword [esi + 4]
test ecx, ecx
jns 0x1001ccac
mov eax, ecx
cdq
sub eax, edx
sar eax, 1
add eax, ecx
xor ecx, ecx
test eax, eax
cmovg ecx, eax
push ecx
mov ecx, esi
call fcn.1001f0a0
push dword [ebp + 8]
mov ecx, esi
mov dword [esi], 0
push ebx
call fcn.100070c0
mov edx, dword [esi]
mov ecx, 0x10081884
push dword [edi + 0x5e34]
lea eax, [edx - 1]
neg edx
sbb edx, edx
and edx, eax
mov eax, dword [edi + 0x5e40]
test eax, eax
push edx
cmovne ecx, eax
push 1
push ecx
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
add esp, 0x10
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push dword [ebp + 8]
mov ecx, esi
push ebx
call fcn.100070c0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x1001d100
Capabilities:
Hash data with crc32

Disassembly:
push ebx
mov bl, byte [ecx]
or eax, 0xffffffff
push esi
lea esi, [ecx + 1]
push edi
mov edi, dword [0x10081888]
test bl, bl
je 0x1001d146
or edi, 0xffffffff
cmp bl, 0x23
jne 0x1001d127
cmp byte [esi], bl
jne 0x1001d127
cmp byte [esi + 1], bl
cmove eax, edi
movzx edx, al
movzx ecx, bl
mov bl, byte [esi]
xor edx, ecx
shr eax, 8
inc esi
xor eax, dword [edx*4 + 0x10074788]
test bl, bl
jne 0x1001d118
mov edi, dword [0x10081888]
mov ecx, dword [edi + 0x5dd8]
not eax
mov edx, dword [edi + 0x5de0]
pop edi
pop esi
lea ecx, [ecx + ecx*8]
lea ecx, [edx + ecx*4]
pop ebx
cmp edx, ecx
je 0x1001d16d
cmp dword [edx + 4], eax
je 0x1001d170
add edx, 0x24
cmp edx, ecx
jne 0x1001d161
xor eax, eax
ret
mov eax, edx
ret

Function at 0x1001d3a0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
mov eax, dword [0x10081888]
sub esp, 8
push esi
mov esi, ecx
mov dword [eax + 0x5dc8], 0
push edi
test esi, esi
je 0x1001d3fd
lea ecx, [esp + 0xc]
mov dword [esp + 0xc], 0
call fcn.1001d410
mov edx, 0x10074358
mov ecx, esi
mov edi, eax
call fcn.100069a0
mov esi, eax
test esi, esi
je 0x1001d3fd
push esi
push dword [esp + 0x10]
push 1
push edi
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
push esi
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
add esp, 0x14
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x1003b210
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword fs:[0x2c]
mov ecx, dword [0x1008185c]
push esi
movss dword [ebp - 8], xmm1
movss dword [ebp - 4], xmm0
mov esi, dword [eax + ecx*4]
mov eax, dword [0x10082d80]
cmp eax, dword [esi + 4]
jle 0x1003b2a7
push 0x10082d80
call fcn.1005289d
add esp, 4
cmp dword [0x10082d80], 0xffffffff
jne 0x1003b2a7
mov dword [0x10082d7c], 0xffffffff
mov edx, 0x1571
mov dword [0x100819fc], 0x1571
mov ecx, 1
mov eax, edx
shr eax, 0x1e
xor eax, edx
imul edx, eax, 0x6c078965
add edx, ecx
mov dword [ecx*4 + 0x100819fc], edx
inc ecx
cmp ecx, 0x270
jb 0x1003b271
push 0x10082d80
mov dword [0x100819f8], 0x270
call fcn.1005284c
add esp, 4
mov eax, dword [0x10082d84]
cmp eax, dword [esi + 4]
jle 0x1003b2f7
push 0x10082d84
call fcn.1005289d
add esp, 4
cmp dword [0x10082d84], 0xffffffff
jne 0x1003b2f7
movss xmm0, dword [ebp - 4]
cvtps2pd xmm0, xmm0
push 0x10082d84
movsd qword [0x10082d88], xmm0
movss xmm0, dword [ebp - 8]
cvtps2pd xmm0, xmm0
movsd qword [0x10082d90], xmm0
call fcn.1005284c
add esp, 4
call fcn.1003be00
movsd xmm2, qword [0x10082d90]
subsd xmm2, qword [0x10082d88]
pop esi
mulsd xmm2, xmm0
addsd xmm2, qword [0x10082d88]
cvtpd2ps xmm0, xmm2
mov esp, ebp
pop ebp
ret