joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1003b6b0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100b402d
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
push ebx
push esi
push edi
mov eax, dword [0x10195040]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
push 8
mov dword [esi + 0x30], 0
mov dword [esi + 8], 0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0x201
mov dword [esi + 0x18], 6
mov dword [esi + 0x1c], 0
mov dword [esi + 0x20], 0
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x2c], 0
mov dword [esi + 0xc], 0
call fcn.1001a031
mov edi, eax
add esp, 4
test edi, edi
je 0x1003b754
xorps xmm0, xmm0
movq qword [edi], xmm0
push 1
mov dword [ebp - 4], 0
call fcn.1001a837
add esp, 4
mov dword [edi + 4], eax
jmp 0x1003b756
xor edi, edi
mov eax, dword [ebp + 8]
mov dword [esi + 0x30], edi
mov dword [esi + 0x38], eax
mov dword [esi + 0x3c], 0
mov ecx, dword [edi + 4]
mov dword [ebp - 0x10], ecx
mov eax, dword [ecx]
call dword [eax + 4]
lea eax, [ebp - 0x14]
mov dword [ebp - 4], 1
push eax
call fcn.1003b3a0
add esp, 4
mov ecx, dword [eax]
push 0x20
mov edx, dword [ecx + 0x20]
mov ecx, eax
call edx
mov ecx, dword [ebp - 0x10]
mov bl, al
mov dword [ebp - 4], 0xffffffff
test ecx, ecx
je 0x1003b7b0
mov edx, dword [ecx]
call dword [edx + 8]
test eax, eax
je 0x1003b7b0
mov edx, dword [eax]
mov ecx, eax
push 1
call dword [edx]
cmp dword [esi + 0x38], 0
mov byte [esi + 0x40], bl
jne 0x1003b7cc
mov eax, dword [esi + 0xc]
mov ecx, dword [esi + 0x10]
and eax, 0x13
or eax, 4
mov dword [esi + 0xc], eax
and ecx, eax
jne 0x1003b7ef
cmp byte [ebp + 0xc], 0
je 0x1003b7db
push esi
call fcn.100898ec
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
test cl, 4
je 0x1003b7fb
mov esi, str.ios_base::badbit_set
jmp 0x1003b80b
test cl, 2
mov esi, str.ios_base::failbit_set
mov eax, str.ios_base::eofbit_set
cmove esi, eax
lea eax, [ebp - 0x14]
push 1
push eax
call fcn.10023c80
add esp, 8
lea ecx, [ebp - 0x28]
push eax
push esi
call fcn.10023d50
push 0x10176120
lea eax, [ebp - 0x28]
push eax
call fcn.1008b814
int3
Function at 0x1003fbf0
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100b496c
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push ebx
push esi
push edi
mov eax, dword [0x10195040]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x14], edi
mov dword [ebp - 0x1c], edi
mov eax, dword [ebp + 8]
mov dword [edi], eax
mov dword [ebp - 4], 0
mov dword [edi + 4], 0
mov dword [edi + 8], 0
mov dword [edi + 0xc], 0
mov dword [edi + 0x10], 0
mov dword [edi + 0x14], 0
mov dword [edi + 0x18], 0
mov dword [edi + 0x1c], 0
mov dword [edi + 0x20], 0
mov dword [edi + 0x24], 0
mov dword [edi + 0x28], 0
mov dword [edi + 0x2c], 0
lea esi, [edi + 0x38]
mov dword [edi + 0x30], 0
mov byte [edi + 0x34], 0
mov dword [ebp - 0x14], esi
mov dword [esi + 0x24], 0
mov ecx, dword [ebp + 0x30]
mov byte [ebp - 4], 4
test ecx, ecx
je 0x1003fca4
mov eax, dword [ecx]
push esi
call dword [eax]
mov dword [esi + 0x24], eax
mov al, byte [ebp + 0x34]
lea ecx, [edi + 0x70]
mov byte [edi + 0x60], al
push 9
mov byte [ebp - 4], 5
mov byte [edi + 0x68], 9
call fcn.1001e0d0
mov ecx, dword [edi + 0x1c]
xor esi, esi
mov edx, dword [edi + 0x10]
mov byte [ebp - 4], 6
mov byte [ebp - 0xd], 1
test ecx, ecx
jns 0x1003fcec
mov eax, ecx
neg eax
cmp esi, eax
jae 0x1003fcec
add ecx, esi
mov eax, ecx
not eax
shr eax, 5
lea eax, [eax*4 + 4]
sub edx, eax
jmp 0x1003fcf6
add ecx, esi
mov eax, ecx
shr eax, 5
lea edx, [edx + eax*4]
and ecx, 0x1f
push 1
push ecx
push edx
lea ecx, [edi + 0x10]
call fcn.1003e3f0
mov edx, dword [edi + 0x10]
mov ecx, eax
xor esi, esi
mov dword [ebp - 0x20], edx
test ecx, ecx
jns 0x1003fd2d
neg eax
cmp esi, eax
jae 0x1003fd2d
add ecx, esi
mov eax, ecx
not eax
shr eax, 5
lea eax, [eax*4 + 4]
sub edx, eax
jmp 0x1003fd37
add ecx, esi
mov eax, ecx
shr eax, 5
lea edx, [edx + eax*4]
lea eax, [ebp - 0xd]
and ecx, 0x1f
push eax
push 1
push ecx
push edx
lea eax, [ebp - 0x20]
push eax
call fcn.10040e20
mov ecx, dword [ebp + 0x30]
add esp, 0x14
test ecx, ecx
je 0x1003fd66
mov esi, dword [ecx]
lea eax, [ebp + 0xc]
cmp ecx, eax
setne dl
movzx edx, dl
push edx
call dword [esi + 0x10]
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x30
Function at 0x100458d0
Capabilities:
Open clipboard
Write clipboard data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100b4d68
mov eax, dword fs:[0]
Function at 0x10046080
Capabilities:
Get process heap force flags

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100b3aa0
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push esi
mov eax, dword [0x10195040]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ecx, dword [ecx]
lea eax, [ebp - 0x1c]
push eax
call fcn.1003f600
mov esi, dword [ebp + 8]
movups xmm0, xmmword [ebp - 0x1c]
lea ecx, [esi + 0x18]
mov dword [ebp - 4], 0
push 1
movups xmmword [esi], xmm0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
xorps xmm0, xmm0
movups xmmword [ecx], xmm0
push 0x1016f888
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 0
call fcn.1001af1f
xorps xmm0, xmm0
mov eax, esi
movups xmmword [esi + 0x30], xmm0
mov dword [esi + 0x40], 0
mov dword [esi + 0x44], 0xf
mov byte [esi + 0x30], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret 4

Function at 0x10046130
Capabilities:
Get process heap force flags

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100b3aa0
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push esi
mov eax, dword [0x10195040]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ecx, dword [ecx]
lea eax, [ebp - 0x1c]
push eax
call fcn.1003f6c0
mov esi, dword [ebp + 8]
movups xmm0, xmmword [ebp - 0x1c]
lea ecx, [esi + 0x18]
mov dword [ebp - 4], 0
push 1
movups xmmword [esi], xmm0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
xorps xmm0, xmm0
movups xmmword [ecx], xmm0
push 0x1016f888
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 0
call fcn.1001af1f
xorps xmm0, xmm0
mov eax, esi
movups xmmword [esi + 0x30], xmm0
mov dword [esi + 0x40], 0
mov dword [esi + 0x44], 0xf
mov byte [esi + 0x30], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x100514b0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push esi
mov esi, ecx
mov eax, dword [esi + 8]
test eax, eax
je 0x100514d7
push eax
mov dword [esi + 4], 0
mov dword [esi], 0
call fcn.1006ca10
add esp, 4
mov dword [esi + 8], 0
mov eax, dword [esi + 0x14]
test eax, eax
je 0x100514fc
push eax
mov dword [esi + 0x10], 0
mov dword [esi + 0xc], 0
call fcn.1006ca10
add esp, 4
mov dword [esi + 0x14], 0
mov eax, dword [esi + 0x20]
test eax, eax
je 0x10051521
push eax
mov dword [esi + 0x1c], 0
mov dword [esi + 0x18], 0
call fcn.1006ca10
add esp, 4
mov dword [esi + 0x20], 0
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x34], 0
mov dword [esi + 0x38], 0
mov eax, dword [esi + 0x44]
test eax, eax
je 0x10051562
push eax
mov dword [esi + 0x40], 0
mov dword [esi + 0x3c], 0
call fcn.1006ca10
add esp, 4
mov dword [esi + 0x44], 0
mov eax, dword [esi + 0x50]
test eax, eax
je 0x10051587
push eax
mov dword [esi + 0x4c], 0
mov dword [esi + 0x48], 0
call fcn.1006ca10
add esp, 4
mov dword [esi + 0x50], 0
mov eax, dword [esi + 0x5c]
test eax, eax
je 0x100515ac
push eax
mov dword [esi + 0x58], 0
mov dword [esi + 0x54], 0
call fcn.1006ca10
add esp, 4
mov dword [esi + 0x5c], 0
lea ecx, [esi + 0x78]
pop esi
jmp fcn.1004d750
Function at 0x1006dd70
Capabilities:
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 0x10]
push esi
mov esi, dword [ebp + 8]
not ebx
push edi
mov edi, dword [ebp + 0xc]
mov eax, ebx
test edi, edi
je 0x1006ddd3
mov cl, byte [esi]
lea esi, [esi + 1]
dec edi
cmp cl, 0x23
jne 0x1006ddb6
cmp edi, 2
jb 0x1006ddb6
cmp byte [esi], cl
jne 0x1006ddb6
cmp byte [esi + 1], cl
jne 0x1006ddb6
mov eax, ebx
movzx ecx, cl
movzx edx, al
xor edx, ecx
shr eax, 8
xor eax, dword [edx*4 + 0x101600e0]
jmp 0x1006dd87
movzx edx, al
movzx ecx, cl
xor edx, ecx
shr eax, 8
xor eax, dword [edx*4 + 0x101600e0]
test edi, edi
jne 0x1006dd87
pop edi
pop esi
not eax
pop ebx
pop ebp
ret
mov cl, byte [esi]
inc esi
test cl, cl
je 0x1006de08
nop word [eax + eax]
cmp cl, 0x23
jne 0x1006ddef
cmp byte [esi], cl
jne 0x1006ddef
cmp byte [esi + 1], cl
cmove eax, ebx
movzx edx, al
movzx ecx, cl
xor edx, ecx
shr eax, 8
mov cl, byte [esi]
inc esi
xor eax, dword [edx*4 + 0x101600e0]
test cl, cl
jne 0x1006dde0
pop edi
pop esi
not eax
pop ebx
pop ebp
ret
Function at 0x1006e270
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [ebp + 0xc]
dec eax
push ebx
mov ebx, dword [ebp + 8]
mov ecx, ebx
mov dword [ebp - 0x14], ecx
lea eax, [ebx + eax*2]
mov dword [ebp - 0x18], eax
cmp ebx, eax
mov eax, dword [ebp + 0x10]
jae 0x1006e426
push esi
mov esi, dword [ebp + 0x14]
mov dword [ebp - 0x10], eax
push edi
nop dword [eax]
test esi, esi
je 0x1006e2ac
cmp eax, esi
jae 0x1006e421
mov bl, byte [eax]
mov byte [ebp + 0xf], bl
test bl, bl
je 0x1006e421
movzx ecx, bl
mov edx, esi
shr ecx, 3
xor ebx, ebx
movsx ecx, byte [ecx + 0x10160968]
test ecx, ecx
mov dword [ebp - 0xc], ecx
sete bl
add ebx, ecx
test esi, esi
jne 0x1006e2db
lea edx, [ebx + eax]
cmp eax, edx
lea esi, [eax + 1]
sbb cl, cl
and cl, byte [ebp + 0xf]
mov byte [ebp - 3], cl
cmp esi, edx
jae 0x1006e2f3
mov ch, byte [esi]
mov byte [ebp + 0xf], ch
jmp 0x1006e2f7
mov byte [ebp + 0xf], 0
lea esi, [eax + 2]
cmp esi, edx
jae 0x1006e302
mov ch, byte [esi]
jmp 0x1006e304
xor ch, ch
lea esi, [eax + 3]
mov byte [ebp - 2], ch
cmp esi, edx
jae 0x1006e312
mov al, byte [esi]
jmp 0x1006e314
xor al, al
movzx esi, byte [ebp + 0xf]
movzx edx, ch
movzx ecx, cl
movzx edi, al
mov byte [ebp - 1], al
mov eax, dword [ebp - 0xc]
mov eax, dword [eax*4 + 0x10160988]
and eax, ecx
mov ecx, esi
and ecx, 0x3f
mov dword [ebp - 8], eax
shl dword [ebp - 8], 6
and esi, 0xc0
or dword [ebp - 8], ecx
mov ecx, edx
shl dword [ebp - 8], 6
and ecx, 0x3f
or dword [ebp - 8], ecx
and edx, 0xc0
shl dword [ebp - 8], 6
mov ecx, edi
mov eax, dword [ebp - 8]
and ecx, 0x3f
or eax, ecx
shr edi, 2
mov ecx, dword [ebp - 0xc]
or edi, edx
shr edi, 2
or edi, esi
shr edi, 2
mov ecx, dword [ecx*4 + 0x101609b0]
shr eax, cl
mov esi, eax
mov dword [ebp - 8], eax
mov eax, dword [ebp - 0xc]
cmp esi, dword [eax*4 + 0x1016099c]
sbb ecx, ecx
xor edx, edx
and ecx, 0x40
or edi, ecx
mov ecx, esi
and ecx, 0xfffff800
cmp ecx, 0xd800
mov ecx, 0x80
cmove edx, ecx
mov ecx, 0xffff
or edi, edx
cmp ecx, esi
sbb ecx, ecx
and ecx, 0x100
or edi, ecx
mov ecx, dword [eax*4 + 0x101609c4]
mov eax, dword [ebp - 0x10]
xor edi, 0x2a
sar edi, cl
test edi, edi
je 0x1006e404
xor edx, edx
mov esi, 0xfffd
cmp byte [ebp - 1], dl
setne dl
xor ecx, ecx
cmp byte [ebp - 2], cl
setne cl
add edx, ecx
xor ecx, ecx
cmp byte [ebp + 0xf], cl
setne cl
add edx, ecx
xor ecx, ecx
cmp byte [ebp - 3], cl
setne cl
add edx, ecx
cmp ebx, edx
cmovl edx, ebx
mov ebx, edx
mov ecx, dword [ebp - 0x14]
add eax, ebx
mov dword [ebp - 0x10], eax
mov word [ecx], si
add ecx, 2
mov esi, dword [ebp + 0x14]
mov dword [ebp - 0x14], ecx
cmp ecx, dword [ebp - 0x18]
jb 0x1006e2a0
mov ebx, dword [ebp + 8]
pop edi
pop esi
xor edx, edx
mov word [ecx], dx
mov edx, dword [ebp + 0x18]
test edx, edx
je 0x1006e434
mov dword [edx], eax
sub ecx, ebx
sar ecx, 1
mov eax, ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1006e440
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
sub esp, 0x10
xor ecx, ecx
push ebx
push esi
push edi
mov esi, dword [ebp + 0xc]
mov dword [ebp - 0x10], ecx
test esi, esi
je 0x1006e460
cmp eax, esi
jae 0x1006e5b7
mov bl, byte [eax]
test bl, bl
je 0x1006e5b7
movzx ecx, bl
mov edx, esi
shr ecx, 3
movsx edi, byte [ecx + 0x10160968]
xor ecx, ecx
test edi, edi
mov dword [ebp - 8], edi
sete cl
add ecx, edi
mov dword [ebp - 0xc], ecx
test esi, esi
jne 0x1006e48f
lea edx, [ecx + eax]
cmp eax, edx
lea esi, [eax + 1]
sbb cl, cl
and cl, bl
mov byte [ebp - 4], cl
cmp esi, edx
jae 0x1006e4a6
mov bl, byte [esi]
mov byte [ebp - 1], bl
jmp 0x1006e4aa
mov byte [ebp - 1], 0
lea esi, [eax + 2]
cmp esi, edx
jae 0x1006e4b5
mov ch, byte [esi]
jmp 0x1006e4b7
xor ch, ch
lea ebx, [eax + 3]
mov byte [ebp - 3], ch
cmp ebx, edx
jae 0x1006e4c5
mov bl, byte [ebx]
jmp 0x1006e4c7
xor bl, bl
mov edi, dword [edi*4 + 0x10160988]
movzx esi, byte [ebp - 1]
movzx edx, ch
movzx ecx, cl
and edi, ecx
mov byte [ebp - 2], bl
shl edi, 6
mov ecx, esi
and ecx, 0x3f
movzx ebx, bl
or edi, ecx
and esi, 0xc0
shl edi, 6
mov ecx, edx
and ecx, 0x3f
and edx, 0xc0
or edi, ecx
mov ecx, ebx
and ecx, 0x3f
shr ebx, 2
or ebx, edx
shl edi, 6
or edi, ecx
shr ebx, 2
mov ecx, dword [ebp - 8]
or ebx, esi
mov esi, dword [ebp - 8]
shr ebx, 2
mov ecx, dword [ecx*4 + 0x101609b0]
shr edi, cl
cmp edi, dword [esi*4 + 0x1016099c]
sbb ecx, ecx
xor edx, edx
and ecx, 0x40
or ebx, ecx
mov ecx, edi
and ecx, 0xfffff800
cmp ecx, 0xd800
mov ecx, 0x80
cmove edx, ecx
mov ecx, 0xffff
or ebx, edx
cmp ecx, edi
sbb ecx, ecx
and ecx, 0x100
or ebx, ecx
mov ecx, dword [esi*4 + 0x101609c4]
xor ebx, 0x2a
sar ebx, cl
test ebx, ebx
je 0x1006e5a9
xor edx, edx
cmp byte [ebp - 2], dl
setne dl
xor ecx, ecx
cmp byte [ebp - 3], cl
setne cl
add edx, ecx
xor ecx, ecx
cmp byte [ebp - 1], cl
setne cl
add edx, ecx
xor ecx, ecx
cmp byte [ebp - 4], cl
setne cl
add edx, ecx
cmp dword [ebp - 0xc], edx
cmovl edx, dword [ebp - 0xc]
mov ecx, edx
add eax, ecx
mov ecx, dword [ebp - 0x10]
inc ecx
jmp 0x1006e44e
mov ecx, dword [ebp - 0xc]
add eax, ecx
mov ecx, dword [ebp - 0x10]
inc ecx
jmp 0x1006e44e
pop edi
pop esi
mov eax, ecx
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x10070dd0
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [0x10195040]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ecx + 0xe0]
lea edx, [ebp - 8]
push ebx
mov ebx, dword [ecx + 0xe8]
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, 4
mov ebx, dword [ebx + eax*4 - 4]
mov dword [ebp - 8], edi
not ebx
movzx eax, byte [edx]
lea edx, [edx + 1]
movzx ecx, bl
xor ecx, eax
shr ebx, 8
xor ebx, dword [ecx*4 + 0x101600e0]
sub esi, 1
jne 0x10070e03
mov eax, dword [0x10197d04]
not ebx
cmp dword [eax + 0x3e94], ebx
jne 0x10070e39
push esi
push edi
push 0xc
push ebx
call fcn.10076370
add esp, 0x10
mov ecx, dword [ebp - 4]
mov eax, ebx
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1008118d
mov esp, ebp
pop ebp
ret 4
Function at 0x10070e50
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [0x10195040]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ecx + 0xe0]
lea edx, [ebp - 8]
push ebx
mov ebx, dword [ecx + 0xe8]
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, 4
mov ebx, dword [ebx + eax*4 - 4]
mov dword [ebp - 8], edi
not ebx
movzx eax, byte [edx]
lea edx, [edx + 1]
movzx ecx, bl
xor ecx, eax
shr ebx, 8
xor ebx, dword [ecx*4 + 0x101600e0]
sub esi, 1
jne 0x10070e83
mov eax, dword [0x10197d04]
not ebx
cmp dword [eax + 0x3e94], ebx
jne 0x10070eb9
push esi
push edi
push 4
push ebx
call fcn.10076370
add esp, 0x10
mov ecx, dword [ebp - 4]
mov eax, ebx
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1008118d
mov esp, ebp
pop ebp
ret 4

Function at 0x10070ed0
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x10195040]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
mov edx, ecx
push esi
push edi
lea esi, [ebp - 0x14]
mov edi, 0x10
movss xmm1, dword [edx + 0xfc]
movss xmm0, dword [eax]
movss xmm2, dword [edx + 0x100]
subss xmm0, xmm1
mov ecx, dword [edx + 0xe0]
movss dword [ebp - 0x14], xmm0
movss xmm0, dword [eax + 4]
subss xmm0, xmm2
movss dword [ebp - 0x10], xmm0
movss xmm0, dword [eax + 8]
subss xmm0, xmm1
movss dword [ebp - 0xc], xmm0
movss xmm0, dword [eax + 0xc]
mov eax, dword [edx + 0xe8]
subss xmm0, xmm2
mov edx, dword [eax + ecx*4 - 4]
movss dword [ebp - 8], xmm0
not edx
nop dword [eax + eax]
movzx eax, byte [esi]
lea esi, [esi + 1]
movzx ecx, dl
xor ecx, eax
shr edx, 8
xor edx, dword [ecx*4 + 0x101600e0]
sub edi, 1
jne 0x10070f50
mov ecx, dword [ebp - 4]
not edx
pop edi
xor ecx, ebp
mov eax, edx
pop esi
call fcn.1008118d
mov esp, ebp
pop ebp
ret 4
Function at 0x10072f90
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [0x10195040]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 0xc]
lea edx, [ebp - 8]
push esi
push edi
mov edi, dword [ebp + 8]
not ebx
mov dword [ebp - 8], edi
mov esi, 4
movzx eax, byte [edx]
lea edx, [edx + 1]
movzx ecx, bl
xor ecx, eax
shr ebx, 8
xor ebx, dword [ecx*4 + 0x101600e0]
sub esi, 1
jne 0x10072fb6
mov eax, dword [0x10197d04]
not ebx
cmp dword [eax + 0x3e94], ebx
jne 0x10072fec
push esi
push edi
push 4
push ebx
call fcn.10076370
add esp, 0x10
mov ecx, dword [ebp - 4]
mov eax, ebx
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1008118d
mov esp, ebp
pop ebp
ret
Function at 0x1007b320
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push edi
mov edi, dword [0x10197d04]
cmp byte [edi + 0x5a35], 0
lea eax, [edi + 0x20]
jne 0x1007b466
mov ecx, dword [eax]
push ebx
test ecx, ecx
je 0x1007b45e
push esi
push 0x1016f118
push ecx
call fcn.1006e620
mov esi, eax
add esp, 8
test esi, esi
je 0x1007b45a
push esi
call fcn.1009bcfa
add esp, 4
mov dword [ebp - 4], eax
cmp eax, 0xffffffff
je 0x1007b451
push 2
push 0
push esi
call fcn.100980f0
add esp, 0xc
test eax, eax
jne 0x1007b451
push esi
call fcn.1009bcfa
mov ebx, eax
add esp, 4
cmp ebx, 0xffffffff
je 0x1007b451
push 0
push dword [ebp - 4]
push esi
call fcn.100980f0
add esp, 0xc
test eax, eax
jne 0x1007b451
mov eax, dword [0x10197d04]
test eax, eax
je 0x1007b3c2
inc dword [eax + 0xb0]
push dword [0x10197d08]
push ebx
call dword [0x10194f18]
add esp, 8
mov dword [ebp - 4], eax
test eax, eax
je 0x1007b451
push esi
push ebx
push 1
push eax
call fcn.1009b88c
add esp, 0x10
push esi
cmp eax, ebx
je 0x1007b417
call fcn.1009ae5d
mov eax, dword [0x10197d04]
add esp, 4
test eax, eax
je 0x1007b402
dec dword [eax + 0xb0]
push dword [0x10197d08]
mov esi, dword [ebp - 4]
push esi
call dword [0x10194f1c]
add esp, 8
jmp 0x1007b45a
call fcn.1009ae5d
mov esi, dword [ebp - 4]
add esp, 4
test ebx, ebx
je 0x1007b430
push ebx
push esi
call fcn.1006c690
add esp, 8
mov eax, dword [0x10197d04]
test eax, eax
je 0x1007b43f
dec dword [eax + 0xb0]
push dword [0x10197d08]
push esi
call dword [0x10194f1c]
add esp, 8
jmp 0x1007b45a
push esi
call fcn.1009ae5d
add esp, 4
lea eax, [edi + 0x20]
pop esi
mov byte [edi + 0x5a35], 1
pop ebx
movss xmm0, dword [edi + 0x5a38]
xorps xmm1, xmm1
comiss xmm0, xmm1
jbe 0x1007b4b7
subss xmm0, dword [edi + 0x18]
comiss xmm1, xmm0
movss dword [edi + 0x5a38], xmm0
jb 0x1007b4b7
mov eax, dword [eax]
test eax, eax
je 0x1007b4a6
push eax
call fcn.1006c8c0
add esp, 4
mov dword [edi + 0x5a38], 0
pop edi
mov esp, ebp
pop ebp
ret
mov byte [edi + 0x98], 1
mov dword [edi + 0x5a38], 0
pop edi
mov esp, ebp
pop ebp
ret
Function at 0x10081c60
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
xorps xmm0, xmm0
push esi
push edi
mov edi, ecx
lea esi, [ebx + 0xb0]
mov dword [edi], vtable.CESPItemBase.0
mov eax, dword [ebx + 8]
mov dword [edi + 8], eax
mov eax, dword [ebx + 0xc]
mov dword [edi + 0xc], eax
movzx eax, byte [ebx + 0x10]
mov byte [edi + 0x10], al
mov eax, dword [ebx + 0x14]
mov dword [edi + 0x14], eax
movups xmmword [edi + 0x18], xmm0
mov dword [edi + 0x28], 0
mov dword [edi + 0x2c], 0
movups xmm0, xmmword [ebx + 0x18]
movups xmmword [edi + 0x18], xmm0
movq xmm0, qword [ebx + 0x28]
movq qword [edi + 0x28], xmm0
mov dword [ebx + 0x2c], 0xf
mov dword [ebx + 0x28], 0
mov byte [ebx + 0x18], 0
mov eax, dword [ebx + 0x30]
mov ecx, dword [ebx + 0x34]
mov dword [edi + 0x30], eax
mov dword [edi + 0x34], ecx
mov eax, dword [ebx + 0x38]
mov dword [edi + 0x38], eax
movups xmm0, xmmword [ebx + 0x3c]
movups xmmword [edi + 0x3c], xmm0
movq xmm0, qword [ebx + 0x4c]
movq qword [edi + 0x4c], xmm0
movups xmm0, xmmword [ebx + 0x54]
movups xmmword [edi + 0x54], xmm0
movups xmm0, xmmword [ebx + 0x64]
movups xmmword [edi + 0x64], xmm0
xorps xmm0, xmm0
movups xmmword [edi + 0x78], xmm0
mov dword [edi + 0x88], 0
mov dword [edi + 0x8c], 0
movups xmm0, xmmword [ebx + 0x78]
movups xmmword [edi + 0x78], xmm0
movq xmm0, qword [ebx + 0x88]
movq qword [edi + 0x88], xmm0
mov dword [ebx + 0x88], 0
mov dword [ebx + 0x8c], 0xf
mov byte [ebx + 0x78], 0
movzx eax, byte [ebx + 0x90]
mov byte [edi + 0x90], al
mov eax, dword [ebx + 0x94]
mov dword [edi + 0x94], eax
mov eax, dword [ebx + 0x98]
mov dword [edi + 0x98], eax
mov edx, dword [ebx + 0xa4]
mov ecx, dword [ebx + 0xa0]
mov eax, dword [ebx + 0x9c]
mov dword [ebx + 0xa4], 0
mov dword [ebx + 0xa0], 0
mov dword [ebx + 0x9c], 0
mov dword [edi + 0xa4], edx
lea edx, [edi + 0xb0]
mov dword [edi + 0x9c], eax
mov dword [edi + 0xa0], ecx
mov eax, dword [ebx + 0xa8]
mov dword [edi + 0xa8], eax
mov eax, dword [ebx + 0xac]
mov dword [edi + 0xac], eax
mov dword [edx + 0x24], 0
mov ecx, dword [esi + 0x24]
test ecx, ecx
je 0x10081e0c
cmp ecx, esi
jne 0x10081e02
mov eax, dword [ecx]
push edx
call dword [eax + 4]
mov dword [edi + 0xd4], eax
mov ecx, dword [esi + 0x24]
test ecx, ecx
je 0x10081e0c
mov edx, dword [ecx]
cmp ecx, esi
setne al
movzx eax, al
push eax
call dword [edx + 0x10]
jmp 0x10081e05
mov dword [edx + 0x24], ecx
mov dword [esi + 0x24], 0
mov eax, dword [ebx + 0xd8]
mov dword [edi + 0xd8], eax
mov eax, edi
pop edi
pop esi
pop ebx
pop ebp
ret 4
Function at 0x10086855
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 0x10]
push ebx
mov ebx, ecx
push edi
mov edi, dword [ebp + 0xc]
test eax, eax
jg 0x10086876
jl 0x1008686d
test edi, edi
jne 0x10086876
xor eax, eax
xor edx, edx
jmp 0x10086937
cmp dword [ebx + 0x38], 0
je 0x1008688b
push eax
push edi
push dword [ebp + 8]
call fcn.1003bcc0
jmp 0x10086937
mov eax, dword [ebx + 0x1c]
push esi
mov esi, edi
mov ecx, dword [eax]
test ecx, ecx
je 0x100868d2
mov eax, dword [ebx + 0x2c]
mov eax, dword [eax]
mov dword [ebp - 4], eax
test eax, eax
je 0x100868d2
cmp eax, edi
jb 0x100868ac
mov eax, edi
mov dword [ebp - 4], edi
push eax
push ecx
push dword [ebp + 8]
call fcn.1008dd30
mov ecx, dword [ebp - 4]
add esp, 0xc
mov eax, dword [ebp + 8]
sub esi, ecx
add eax, ecx
mov dword [ebp - 4], eax
mov eax, dword [ebx + 0x2c]
sub dword [eax], ecx
mov eax, dword [ebx + 0x1c]
add dword [eax], ecx
jmp 0x100868d8
mov eax, dword [ebp + 8]
mov dword [ebp - 4], eax
cmp dword [ebx + 0x4c], 0
je 0x1008692c
mov ecx, ebx
call fcn.10086d70
mov ecx, dword [ebp - 4]
mov edx, esi
mov eax, 0xfff
cmp esi, eax
jbe 0x10086917
push dword [ebx + 0x4c]
push eax
push 1
push ecx
call fcn.1009b88c
mov ecx, dword [ebp - 4]
sub esi, eax
add ecx, eax
add esp, 0x10
mov dword [ebp - 4], ecx
mov edx, esi
cmp eax, 0xfff
jne 0x1008692c
jmp 0x100868ea
test edx, edx
je 0x1008692c
push dword [ebx + 0x4c]
push esi
push 1
push ecx
call fcn.1009b88c
add esp, 0x10
sub esi, eax
mov edx, dword [ebp + 0x10]
sub edi, esi
mov eax, edi
sbb edx, 0
pop esi
pop edi
pop ebx
leave
ret 0xc

Function at 0x10096d06
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x10096d45
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x10096d45
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x10096d45
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x10096d45
cmp dword [ecx + 0x74], 0xe
jbe 0x10096d45
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret