joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1000f460
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [0x102ff478]
sub esp, 0x14
mov ecx, dword [eax]
call fcn.10088af0
cmp eax, 9
je 0x1000f65f
cmp eax, 8
je 0x1000f65f
mov eax, dword [0x102ff478]
push edi
mov ecx, dword [eax]
call fcn.10011280
mov eax, dword [eax]
mov dword [0x102ff50c], eax
mov eax, dword [0x102ff478]
mov ecx, dword [eax]
call fcn.10011400
cmp byte [0x102ff59a], 0
mov edi, dword [ebp + 8]
movss xmm0, dword [eax + 8]
movss dword [0x102ff510], xmm0
je 0x1000f4d2
mov eax, dword [0x102ff478]
mov ecx, dword [eax]
call fcn.10011280
test byte [eax], 1
jne 0x1000f4d2
or dword [edi + 0x30], 4
push dword [0x102feff0]
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
je 0x1000f576
cmp byte [0x102ff599], 0
je 0x1000f576
mov eax, dword [0x102ff518]
mov dword [edi + 0x30], eax
cmp byte [0x102ff52d], 0
je 0x1000f576
movss xmm1, dword [0x102ff548]
lea eax, [edi + 0x10]
addss xmm1, dword [0x102ff554]
movss xmm2, dword [0x102ff54c]
lea ecx, [edi + 0xc]
movss xmm0, dword [0x102ff544]
addss xmm2, dword [0x102ff558]
addss xmm0, dword [0x102ff550]
movss dword [eax], xmm1
lea eax, [edi + 0x14]
push esi
movss dword [eax], xmm2
lea eax, [ebp - 0x14]
push eax
movss dword [edi + 0xc], xmm0
call fcn.1000e5c0
mov eax, dword [edi + 0xc]
mov dword [edi + 0xc], eax
movss xmm0, dword [0x100e247c]
movss dword [edi + 0x28], xmm0
movss xmm0, dword [0x100e2480]
movss dword [edi + 0x24], xmm0
pop esi
mov ecx, dword [0x102ff474]
push str.sv_gravity
mov eax, dword [ecx]
mov eax, dword [eax + 0x44]
call eax
mov ecx, eax
mov edx, dword [eax]
mov eax, dword [edx + 0x30]
call eax
fmul dword [0x100bc718]
mov eax, dword [0x102ff470]
mov ecx, dword [0x10309160]
pop edi
fstp dword [ebp - 4]
movss xmm0, dword [ebp - 4]
mulss xmm0, dword [eax + 0x20]
mov eax, dword fs:[0x2c]
movss dword [0x102ff514], xmm0
mov ecx, dword [eax + ecx*4]
mov eax, dword [0x102ff5f8]
cmp eax, dword [ecx + 4]
jg 0x1000f663
movss xmm0, dword [0x102ff514]
xorps xmm0, xmmword [0x100bc630]
comiss xmm0, dword [0x102ff5f4]
jbe 0x1000f648
mov eax, dword [0x102ff478]
mov ecx, dword [eax]
call fcn.10011400
push ecx
fld dword [eax + 8]
fstp dword [esp]
call fcn.10098b2d
fstp dword [ebp - 8]
fld dword [0x102ff514]
fstp dword [esp]
call fcn.10098b2d
movss xmm0, dword [ebp - 8]
add esp, 4
fstp dword [ebp - 4]
movss xmm1, dword [ebp - 4]
xorps xmm1, xmmword [0x100bc630]
ucomiss xmm0, xmm1
lahf
test ah, 0x44
jp 0x1000f648
mov eax, dword [0x102ff478]
mov ecx, dword [eax]
call fcn.10088af0
cmp eax, 9
je 0x1000f648
mov al, 1
jmp 0x1000f64a
xor al, al
movss xmm0, dword [0x102ff510]
mov byte [0x102ff599], al
movss dword [0x102ff5f4], xmm0
mov esp, ebp
pop ebp
ret
push 0x102ff5f8
call fcn.1008b53e
add esp, 4
cmp dword [0x102ff5f8], 0xffffffff
jne 0x1000f5d2
movss xmm0, dword [0x102ff510]
push 0x102ff5f8
movss dword [0x102ff5f4], xmm0
call fcn.1008b4ed
add esp, 4
jmp 0x1000f5d2
Function at 0x1000f6b0
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
push dword [0x102fef84]
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
je 0x1000f74c
mov eax, dword [0x102ff478]
mov ecx, dword [eax]
test ecx, ecx
je 0x1000f74c
call fcn.10088af0
cmp eax, 9
je 0x1000f74c
cmp eax, 8
je 0x1000f74c
mov eax, dword [0x102ff478]
mov ecx, dword [eax]
call fcn.10011280
test byte [eax], 1
mov eax, dword [0x102ff470]
je 0x1000f713
cmp byte [0x102ff5fc], 0
jne 0x1000f713
mov ecx, dword [eax + 0x1c]
mov dword [0x102ff600], ecx
mov byte [0x102ff5fc], 1
jmp 0x1000f719
mov ecx, dword [0x102ff600]
mov eax, dword [eax + 0x1c]
sub eax, ecx
cmp eax, dword [0x102fef88]
jle 0x1000f74c
mov eax, dword [0x102ff478]
mov byte [0x102ff5fc], 0
mov ecx, dword [eax]
call fcn.10011280
test byte [eax], 1
je 0x1000f74c
mov eax, dword [ebp + 8]
or dword [eax + 0x30], 2
mov byte [0x102ff5fc], 0
pop ebp
ret
Function at 0x10010cc0
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [0x102ff470]
push esi
mov esi, dword [ebp + 8]
movss xmm0, dword [eax + 0x10]
comiss xmm0, dword [0x102ff5cc]
jbe 0x10010ce1
mov byte [0x102ff59c], 0
mov eax, dword [0x102ff478]
cmp dword [eax], 0
jne 0x10010cf5
mov dword [0x102ff5cc], 0
cmp byte [0x102fefe4], 0
je 0x10010e11
push dword [0x102fefe8]
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
je 0x10010e11
mov eax, dword [0x102ff478]
mov ecx, dword [eax]
test ecx, ecx
je 0x10010e11
call fcn.100882f0
test al, al
je 0x10010e11
mov eax, dword [0x102ff478]
mov ecx, dword [eax]
call fcn.10088af0
cmp eax, 9
je 0x10010e11
cmp eax, 8
je 0x10010e11
cmp byte [0x102fefa8], 0
jne 0x10010d83
test byte [0x102ff50c], 1
je 0x10010e11
mov eax, dword [0x102ff478]
mov ecx, dword [eax]
call fcn.10011280
test byte [eax], 1
jne 0x10010e11
or dword [esi + 0x30], 2
pop esi
pop ebp
ret
test byte [0x102ff50c], 1
je 0x10010dbb
mov eax, dword [0x102ff478]
mov ecx, dword [eax]
call fcn.10011280
test byte [eax], 1
jne 0x10010dbb
or dword [esi + 0x30], 2
mov eax, dword [0x102ff470]
mov byte [0x102ff5d4], 1
mov ecx, dword [eax + 0x1c]
add ecx, 2
mov dword [0x102ff5d0], ecx
jmp 0x10010dcf
cmp byte [0x102ff5d4], 0
je 0x10010e11
mov eax, dword [0x102ff470]
mov ecx, dword [0x102ff5d0]
mov byte [0x102ff59c], 1
movss xmm0, dword [eax + 0x10]
addss xmm0, dword [0x100bc70c]
movss dword [0x102ff5cc], xmm0
cmp dword [eax + 0x1c], ecx
jge 0x10010e08
or dword [esi + 0x30], 4
mov eax, dword [esi + 0x30]
and eax, 0xfffffff7
and eax, 0xffffffef
mov dword [esi + 0x30], eax
mov eax, dword [0x102ff470]
cmp dword [eax + 0x1c], ecx
jle 0x10010e11
mov byte [0x102ff5d4], 0
pop esi
pop ebp
ret
Function at 0x10011660
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
cmp byte [0x102fef78], 0
je 0x100117f7
push dword [0x102feff0]
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
jne 0x100117f7
mov eax, dword [0x102ff478]
mov ecx, dword [eax]
test ecx, ecx
je 0x100117f7
call fcn.100882f0
test al, al
jne 0x100116ae
mov dword [0x102ff5c4], 0
mov esp, ebp
pop ebp
ret
mov eax, dword [0x102ff478]
mov ecx, dword [eax]
call fcn.10088af0
cmp eax, 8
je 0x100117f7
mov eax, dword [0x102ff478]
mov ecx, dword [eax]
call fcn.10088af0
cmp eax, 9
je 0x100117f7
mov eax, dword [0x102ff478]
mov ecx, dword [eax]
call fcn.10011280
test byte [eax], 1
jne 0x100117f7
cmp byte [0x102ff59a], 0
mov eax, dword [0x102ff564]
push edi
mov edi, dword [ebp + 8]
mov eax, dword [eax + 0x1c]
mov ecx, dword [edi + 0x30]
mov dword [ebp - 4], ecx
jne 0x10011804
push esi
xor esi, esi
dec eax
mov dword [ebp - 8], esi
mov dword [ebp - 0xc], eax
push eax
mov eax, dword [0x100e2460]
push 0
mov eax, dword [eax]
call eax
mov ecx, dword [edi + 0x30]
mov eax, ecx
or eax, 4
and ecx, 0xfffffffb
test esi, esi
cmovne ecx, eax
xor esi, esi
mov dword [edi + 0x30], ecx
nop word [eax + eax]
mov ecx, dword [0x102ff534]
push edi
call fcn.100385b0
mov ecx, dword [0x102ff534]
call fcn.10038560
mov eax, dword [0x102ff478]
mov ecx, dword [eax]
call fcn.10011280
test byte [eax], 1
jne 0x100117af
mov eax, dword [0x102ff478]
mov ecx, dword [eax]
call fcn.10011400
movss xmm0, dword [0x100c1030]
comiss xmm0, dword [0x102ff510]
movss xmm1, dword [eax + 8]
jbe 0x100117a2
movss xmm0, dword [0x102ff514]
xorps xmm0, xmmword [0x100bc630]
ucomiss xmm1, xmm0
lahf
test ah, 0x44
jnp 0x100117c6
inc esi
mov byte [0x102ff59a], 0
cmp esi, 4
jl 0x10011740
mov eax, dword [ebp - 4]
mov esi, dword [ebp - 8]
inc esi
mov dword [ebp - 8], esi
cmp esi, 2
jge 0x100117fb
mov eax, dword [ebp - 0xc]
jmp 0x10011716
cmp dword [ebp - 8], 0
mov byte [0x102ff59a], 1
je 0x100117e8
mov eax, dword [edi + 8]
add eax, 0x10
add eax, esi
mov dword [0x102ff5c4], eax
mov eax, dword [edi + 0x30]
mov dword [ebp - 4], eax
jmp 0x100117b2
mov ecx, dword [ebp - 4]
mov byte [0x102ff59a], 0
mov dword [edi + 0x30], ecx
pop esi
pop edi
mov esp, ebp
pop ebp
ret
pop esi
mov dword [edi + 0x30], eax
pop edi
mov esp, ebp
pop ebp
ret
mov eax, dword [edi + 8]
or ecx, 4
mov dword [edi + 0x30], ecx
cmp eax, dword [0x102ff5c4]
jle 0x100117f6
movss xmm1, dword [0x102ff514]
xorps xmm1, xmmword [0x100bc630]
movss xmm0, dword [0x102ff510]
ucomiss xmm0, xmm1
lahf
test ah, 0x44
jnp 0x100117f6
mov byte [0x102ff59a], 0
pop edi
mov esp, ebp
pop ebp
ret
Function at 0x1002ab30
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
push 0x100c240c
push dword [ebp + 8]
lea eax, [ebp + 8]
mov edi, ecx
push eax
call fcn.10099a41
mov eax, dword [ebp + 8]
add esp, 0xc
test eax, eax
je 0x1002ac2c
push 2
push 0
push eax
call fcn.1009a1da
push dword [ebp + 8]
call fcn.1009a839
add esp, 0x10
mov dword [ebp - 4], eax
test eax, eax
je 0x1002ac2c
mov esi, dword [ebp + 0xc]
xor ebx, ebx
cmp esi, 2
je 0x1002ab87
cmp esi, 1
jne 0x1002ab8c
mov ebx, 2
test esi, esi
jne 0x1002ab95
lea ebx, [esi + 1]
jmp 0x1002aba4
cmp esi, 4
je 0x1002ab9f
cmp esi, 3
jne 0x1002aba4
mov ebx, 4
add eax, ebx
push eax
call fcn.1008b7bd
push 0
push 0
push dword [ebp + 8]
mov dword [ebp + 0xc], eax
call fcn.1009a1da
push dword [ebp + 8]
push dword [ebp - 4]
push 1
push dword [ebp + 0xc]
call fcn.10099db6
mov ecx, dword [ebp - 4]
add esp, 0x20
cmp eax, ecx
jne 0x1002ac2c
test ebx, ebx
je 0x1002abed
push ebx
mov ebx, dword [ebp + 0xc]
push 0
lea eax, [ebx + ecx]
push eax
call fcn.1008e7d0
add esp, 0xc
jmp 0x1002abf0
mov ebx, dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.10099bad
add esp, 4
mov ecx, edi
push esi
push ebx
call fcn.10028860
push ebx
call fcn.1008b7c6
mov eax, dword [edi + 0x28]
add esp, 4
mov ecx, dword [eax]
test ecx, ecx
je 0x1002ac25
cmp ecx, 0x20
jne 0x1002ac37
mov ecx, dword [eax + 4]
add eax, 4
test ecx, ecx
jne 0x1002ac16
mov dword [edi + 0x2c], 0
pop edi
pop esi
xor al, al
pop ebx
mov esp, ebp
pop ebp
ret 8
mov dword [edi + 0x2c], eax
test eax, eax
je 0x1002ac2c
push 0x20
call fcn.1008ae39
mov ecx, eax
add esp, 4
mov dword [ebp + 0xc], ecx
test ecx, ecx
je 0x1002ac94
xorps xmm0, xmm0
movq qword [ecx], xmm0
mov dword [ecx + 8], 0
mov dword [ecx + 4], 1
mov dword [ecx + 8], 1
mov dword [ecx], vtable.std::_Ref_count_obj2_class_valve_parser::node_.0
mov dword [ecx + 0xc], vtable.valve_parser::node.0
mov dword [ecx + 0x14], 0
mov dword [ecx + 0x18], 0
mov dword [ecx + 0x1c], 0
mov dword [ecx + 0x10], edi
jmp 0x1002ac96
xor ecx, ecx
mov esi, dword [edi + 0x34]
lea eax, [ecx + 0xc]
mov dword [edi + 0x30], eax
mov dword [edi + 0x34], ecx
test esi, esi
je 0x1002acc7
or ebx, 0xffffffff
mov eax, ebx
lock xadd dword [esi + 4], eax
jne 0x1002acc7
mov eax, dword [esi]
mov ecx, esi
call dword [eax]
lock xadd dword [esi + 8], ebx
dec ebx
jne 0x1002acc7
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 4]
mov ecx, dword [edi + 0x30]
mov eax, dword [ecx]
mov eax, dword [eax]
call eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x100359d0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x100b78cd
push eax
mov dword fs:[0], esp
sub esp, 0x1c
push esi
mov esi, ecx
push edi
push 8
mov dword [esi + 0x30], 0
mov dword [esi + 8], 0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0x201
mov dword [esi + 0x18], 6
mov dword [esi + 0x1c], 0
mov dword [esi + 0x20], 0
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x2c], 0
mov dword [esi + 0xc], 0
call fcn.1008ae39
mov edi, eax
add esp, 4
test edi, edi
je 0x10035a62
push 1
mov dword [ebp - 4], 0
call fcn.1008cefa
add esp, 4
mov dword [edi + 4], eax
jmp 0x10035a64
xor edi, edi
mov eax, dword [ebp + 8]
mov dword [esi + 0x30], edi
mov dword [esi + 0x38], eax
mov dword [esi + 0x3c], 0
mov edi, dword [edi + 4]
mov ecx, edi
push ebx
mov dword [ebp - 0x10], edi
mov eax, dword [edi]
call dword [eax + 4]
lea eax, [ebp - 0x14]
mov dword [ebp - 4], 1
push eax
call fcn.10030380
add esp, 4
mov ecx, dword [eax]
push 0x20
mov edx, dword [ecx + 0x20]
mov ecx, eax
call edx
mov dword [ebp - 4], 0xffffffff
mov bl, al
test edi, edi
je 0x10035ac0
mov edx, dword [edi]
mov ecx, edi
call dword [edx + 8]
test eax, eax
je 0x10035ac0
mov edx, dword [eax]
mov ecx, eax
push 1
call dword [edx]
cmp dword [esi + 0x38], 0
mov byte [esi + 0x40], bl
pop ebx
jne 0x10035add
mov eax, dword [esi + 0xc]
mov ecx, dword [esi + 0x10]
and eax, 0x13
or eax, 4
mov dword [esi + 0xc], eax
and ecx, eax
jne 0x10035afe
cmp byte [ebp + 0xc], 0
je 0x10035aec
push esi
call fcn.1008d38f
add esp, 4
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 8
test cl, 4
je 0x10035b0a
mov esi, str.ios_base::badbit_set
jmp 0x10035b1a
test cl, 2
mov esi, str.ios_base::failbit_set
mov eax, str.ios_base::eofbit_set
cmove esi, eax
lea eax, [ebp - 0x14]
push 1
push eax
call fcn.10036050
add esp, 8
lea ecx, [ebp - 0x28]
push eax
push esi
call fcn.10030760
push 0x100dccec
lea eax, [ebp - 0x28]
push eax
call fcn.1008e9b2
int3
Function at 0x10045800
Capabilities:
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov ecx, dword [ebp + 8]
mov dword [ebp - 8], 0
push ebx
push esi
mov esi, dword [0x10307a40]
mov dword [ebp - 0xc], esi
push edi
mov edi, dword [esi + 0x198c]
test cl, 0x10
jne 0x1004593d
mov ebx, dword [edi + 0x10c]
lea eax, [esi + 0x19ac]
mov dword [ebp - 8], eax
test ebx, ebx
je 0x10045848
cmp dword [eax], ebx
jne 0x10045934
jmp 0x1004584b
mov dword [ebp - 8], eax
cmp byte [esi + 0xe8], 0
je 0x10045934
test ebx, ebx
jne 0x100458ed
test cl, 8
je 0x10045934
mov cl, byte [edi + 0x110]
and cl, 1
mov byte [ebp - 1], cl
jne 0x100458a3
cmp dword [eax], ebx
je 0x10045934
cmp dword [esi + 0x19d4], edi
jne 0x10045934
lea eax, [edi + 0x114]
mov ecx, edi
push eax
call fcn.100493a0
mov ebx, eax
mov dword [edi + 0x10c], ebx
jmp 0x100458db
lea eax, [edi + 0x114]
mov ecx, edi
push eax
call fcn.100493a0
mov ebx, eax
push ebx
mov dword [edi + 0x10c], ebx
call fcn.100518b0
add esp, 4
cmp byte [esi + 0x3d0], 0
je 0x100458db
push edi
push ebx
call fcn.10051330
push edi
call fcn.10048a00
add esp, 0xc
mov eax, dword [ebp - 8]
cmp dword [eax], ebx
jne 0x10045934
mov cl, byte [ebp - 1]
mov byte [esi + 0x19bd], cl
jmp 0x100458f4
mov byte [esi + 0x19bd], 0
cmp dword [eax], ebx
jne 0x10045934
mov ecx, dword [edi + 0x1c0]
mov eax, dword [edi + 0x1c8]
mov eax, dword [eax + ecx*4 - 4]
mov dword [ebp - 8], eax
mov eax, dword [0x10307a40]
cmp byte [eax + 0xe8], 0
je 0x10045934
movss xmm1, dword [eax + 0x30]
movss xmm0, dword [eax + 0x434]
mulss xmm1, xmm1
comiss xmm0, xmm1
setae al
test al, al
jne 0x1004597c
pop edi
pop esi
xor al, al
pop ebx
mov esp, ebp
pop ebp
ret
xor edi, edi
or ebx, 0xffffffff
mov edx, 0x100c3e99
mov al, 0x23
or esi, 0xffffffff
nop dword [eax]
cmp al, 0x23
jne 0x1004595e
cmp byte [edx], al
jne 0x1004595e
cmp byte [edx + 1], al
cmove ebx, esi
movzx ecx, bl
movzx eax, al
xor ecx, eax
shr ebx, 8
mov al, byte [edx]
inc edx
xor ebx, dword [ecx*4 + 0x100c3890]
test al, al
jne 0x10045950
mov esi, dword [ebp - 0xc]
not ebx
cmp byte [esi + 0x1c68], 0
jne 0x100459b5
call fcn.10046900
mov eax, dword [ebp - 8]
mov dword [esi + 0x1c80], ebx
mov ebx, dword [ebp + 8]
mov dword [esi + 0x1c84], eax
mov byte [esi + 0x1c68], 1
mov dword [esi + 0x1c6c], ebx
mov dword [esi + 0x1c74], 0
jmp 0x100459b8
mov ebx, dword [ebp + 8]
mov eax, dword [esi + 0x1940]
mov dword [esi + 0x1c70], eax
mov byte [esi + 0x1c69], 1
test bl, 1
jne 0x100459fe
call fcn.10045da0
cmp dword [esi + 0x1cd0], 0
je 0x100459fe
test dword [esi + 0x1cc4], 0x1000
je 0x100459fe
mov eax, dword [esi + 0x198c]
mov byte [eax + 0x7f], 1
mov dword [eax + 0xa4], 1
test bl, 0x12
jne 0x10045a0a
and dword [edi + 0x110], 0xfffffffe
pop edi
pop esi
mov al, 1
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x100473b0
Capabilities:
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push ebx
push esi
mov esi, dword [0x10307a40]
push edi
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x18], 0
mov edi, dword [esi + 0x2c5c]
mov ecx, dword [esi + 0x2c60]
mov dword [ebp - 0xc], 0
mov dword [ebp - 8], 0
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x10], 0
mov byte [ebp - 4], 0
cmp edi, ecx
jne 0x100474a7
inc edi
test ecx, ecx
je 0x10047411
mov eax, ecx
cdq
sub eax, edx
sar eax, 1
add eax, ecx
jmp 0x10047416
mov eax, 8
cmp eax, edi
cmovg edi, eax
cmp edi, ecx
jle 0x100474a7
test esi, esi
je 0x1004742d
inc dword [esi + 0x36c]
push dword [0x10307a48]
lea eax, [edi*8]
sub eax, edi
shl eax, 2
push eax
call dword [0x100e25a8]
mov ebx, eax
add esp, 8
mov eax, dword [esi + 0x2c64]
test eax, eax
je 0x1004749b
mov ecx, dword [esi + 0x2c5c]
lea edx, [ecx*8]
sub edx, ecx
shl edx, 2
push edx
push eax
push ebx
call fcn.1008e250
mov ecx, dword [esi + 0x2c64]
add esp, 0xc
test ecx, ecx
je 0x1004748b
mov eax, dword [0x10307a40]
test eax, eax
je 0x1004748b
dec dword [eax + 0x36c]
push dword [0x10307a48]
push ecx
call dword [0x100e25ac]
add esp, 8
mov dword [esi + 0x2c64], ebx
mov dword [esi + 0x2c60], edi
mov eax, dword [esi + 0x2c5c]
mov ecx, dword [esi + 0x2c64]
movups xmm0, xmmword [ebp - 0x1c]
mov edi, dword [ebp + 8]
lea edx, [eax*8]
sub edx, eax
mov eax, dword [ebp - 4]
movups xmmword [ecx + edx*4], xmm0
movq xmm0, qword [ebp - 0xc]
movq qword [ecx + edx*4 + 0x10], xmm0
mov dword [ecx + edx*4 + 0x18], eax
inc dword [esi + 0x2c5c]
mov eax, dword [esi + 0x2c5c]
lea ecx, [eax*8]
sub ecx, eax
mov eax, dword [esi + 0x2c64]
mov esi, edi
lea ebx, [eax + ecx*4]
lea ecx, [esi + 1]
nop dword [eax]
mov al, byte [esi]
inc esi
test al, al
jne 0x10047500
mov eax, dword [0x10307a40]
sub esi, ecx
test eax, eax
je 0x10047518
inc dword [eax + 0x36c]
push dword [0x10307a48]
inc esi
push esi
call dword [0x100e25a8]
push esi
push edi
push eax
call fcn.1008e250
mov dword [ebx - 0x1c], eax
lea esi, [edi + 1]
mov al, byte [edi]
add esp, 0x14
or edx, 0xffffffff
test al, al
je 0x1004756a
or edi, 0xffffffff
cmp al, 0x23
jne 0x10047551
cmp byte [esi], al
jne 0x10047551
cmp byte [esi + 1], al
cmove edx, edi
movzx ecx, dl
movzx eax, al
xor ecx, eax
shr edx, 8
mov al, byte [esi]
inc esi
xor edx, dword [ecx*4 + 0x100c3890]
test al, al
jne 0x10047543
pop edi
not edx
lea eax, [ebx - 0x1c]
pop esi
mov dword [ebx - 0x18], edx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x100488f0
Capabilities:
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 8]
or eax, 0xffffffff
push ebx
push esi
push edi
mov bl, byte [ecx]
lea esi, [ecx + 1]
or ecx, 0xffffffff
test bl, bl
je 0x10048935
cmp bl, 0x23
jne 0x10048917
cmp byte [esi], bl
jne 0x10048917
cmp byte [esi + 1], bl
cmove eax, ecx
movzx edx, al
movzx ecx, bl
mov bl, byte [esi]
xor edx, ecx
shr eax, 8
inc esi
mov ecx, 0xffffffff
xor eax, dword [edx*4 + 0x100c3890]
test bl, bl
jne 0x10048908
mov ecx, dword [0x10307a40]
not eax
mov esi, dword [ecx + 0x197c]
mov edi, dword [ecx + 0x1984]
lea ebx, [edi + esi*8]
test esi, esi
je 0x1004896e
mov edx, esi
shr edx, 1
cmp dword [edi + edx*8], eax
lea ecx, [edi + edx*8]
jae 0x10048968
lea edi, [ecx + 8]
or ecx, 0xffffffff
sub ecx, edx
add esi, ecx
jmp 0x1004896a
mov esi, edx
test esi, esi
jne 0x10048950
cmp edi, ebx
je 0x1004897e
cmp dword [edi], eax
jne 0x1004897e
mov eax, dword [edi + 4]
pop edi
pop esi
pop ebx
pop ebp
ret
pop edi
pop esi
xor eax, eax
pop ebx
pop ebp
ret

Function at 0x10049330
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ecx + 0x1c0]
mov eax, dword [ecx + 0x1c8]
push esi
push edi
lea esi, [ebp + 8]
mov edi, 4
mov eax, dword [eax + edx*4 - 4]
not eax
nop
movzx ecx, byte [esi]
lea esi, [esi + 1]
movzx edx, al
xor edx, ecx
shr eax, 8
xor eax, dword [edx*4 + 0x100c3890]
sub edi, 1
jne 0x10049350
mov ecx, dword [0x10307a40]
not eax
pop edi
pop esi
cmp dword [ecx + 0x19ac], eax
jne 0x10049382
mov dword [ecx + 0x19b4], eax
cmp dword [ecx + 0x19b0], eax
jne 0x10049391
mov byte [ecx + 0x19c0], 1
pop ebp
ret 4

Function at 0x100493a0
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov edx, dword [ebp + 8]
push esi
mov esi, ecx
push edi
movss xmm0, dword [edx]
mov edi, 0x10
subss xmm0, dword [esi + 0xc]
mov ecx, dword [esi + 0x1c0]
cvttss2si eax, xmm0
movss xmm0, dword [edx + 4]
subss xmm0, dword [esi + 0x10]
mov dword [ebp - 0x10], eax
cvttss2si eax, xmm0
movss xmm0, dword [edx + 8]
subss xmm0, dword [esi + 0xc]
mov dword [ebp - 0xc], eax
cvttss2si eax, xmm0
movss xmm0, dword [edx + 0xc]
subss xmm0, dword [esi + 0x10]
mov dword [ebp - 8], eax
cvttss2si eax, xmm0
mov dword [ebp - 4], eax
mov eax, dword [esi + 0x1c8]
lea esi, [ebp - 0x10]
mov edx, dword [eax + ecx*4 - 4]
not edx
nop word [eax + eax]
movzx eax, byte [esi]
lea esi, [esi + 1]
movzx ecx, dl
xor ecx, eax
shr edx, 8
xor edx, dword [ecx*4 + 0x100c3890]
sub edi, 1
jne 0x10049410
mov eax, dword [0x10307a40]
not edx
pop edi
pop esi
cmp dword [eax + 0x19ac], edx
jne 0x10049441
mov dword [eax + 0x19b4], edx
cmp dword [eax + 0x19b0], edx
jne 0x10049450
mov byte [eax + 0x19c0], 1
mov eax, edx
mov esp, ebp
pop ebp
ret 4
Function at 0x10049b00
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
mov edi, dword [ebp + 0x10]
test edi, edi
je 0x10049b12
mov dword [edi], 0
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.10049c00
mov esi, eax
add esp, 8
test esi, esi
jne 0x10049b2a
pop edi
pop esi
pop ebp
ret
push ebx
push 2
push 0
push esi
call fcn.1009a1da
add esp, 0xc
test eax, eax
jne 0x10049bf0
push esi
call fcn.1009a839
mov ebx, eax
add esp, 4
cmp ebx, 0xffffffff
je 0x10049bf0
push 0
push 0
push esi
call fcn.1009a1da
add esp, 0xc
test eax, eax
jne 0x10049bf0
mov eax, dword [ebp + 0x14]
add eax, ebx
push eax
call fcn.1004ba50
add esp, 4
mov dword [ebp + 0x10], eax
test eax, eax
je 0x10049bf0
push esi
push ebx
push 1
push eax
call fcn.10099db6
add esp, 0x10
cmp eax, ebx
je 0x10049bc1
push esi
call fcn.10099bad
mov eax, dword [0x10307a40]
add esp, 4
test eax, eax
je 0x10049ba7
dec dword [eax + 0x36c]
push dword [0x10307a48]
mov eax, dword [ebp + 0x10]
push eax
call dword [0x100e25ac]
add esp, 8
xor eax, eax
pop ebx
pop edi
pop esi
pop ebp
ret
mov eax, dword [ebp + 0x14]
test eax, eax
jle 0x10049bd9
push eax
mov eax, dword [ebp + 0x10]
add eax, ebx
push 0
push eax
call fcn.1008e7d0
add esp, 0xc
push esi
call fcn.10099bad
add esp, 4
test edi, edi
je 0x10049be8
mov dword [edi], ebx
mov eax, dword [ebp + 0x10]
pop ebx
pop edi
pop esi
pop ebp
ret
push esi
call fcn.10099bad
add esp, 4
xor eax, eax
pop ebx
pop edi
pop esi
pop ebp
ret
Function at 0x1004abd0
Capabilities:
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push esi
push edi
or eax, 0xffffffff
mov dword [ebp - 4], 0
mov dword [ebp - 0x18], str.Window
mov esi, 0x100c3de5
mov cl, 0x57
or edi, 0xffffffff
cmp cl, 0x23
jne 0x1004ac02
cmp byte [esi], cl
jne 0x1004ac02
cmp byte [esi + 1], cl
cmove eax, edi
movzx edx, al
movzx ecx, cl
xor edx, ecx
shr eax, 8
mov cl, byte [esi]
inc esi
xor eax, dword [edx*4 + 0x100c3890]
test cl, cl
jne 0x1004abf3
mov esi, dword [ebp + 8]
not eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x10], 0x10051e40
mov dword [ebp - 0xc], 0x10051d80
mov edi, dword [esi + 0x2c50]
mov ecx, dword [esi + 0x2c54]
mov dword [ebp - 8], 0x10051ee0
cmp edi, ecx
jne 0x1004ace9
inc edi
test ecx, ecx
je 0x1004ac5c
mov eax, ecx
cdq
sub eax, edx
sar eax, 1
add eax, ecx
jmp 0x1004ac61
mov eax, 8
cmp eax, edi
cmovg edi, eax
cmp edi, ecx
jle 0x1004ace9
mov eax, dword [0x10307a40]
test eax, eax
je 0x1004ac79
inc dword [eax + 0x36c]
push ebx
push dword [0x10307a48]
lea eax, [edi + edi*2]
shl eax, 3
push eax
call dword [0x100e25a8]
mov ebx, eax
add esp, 8
mov eax, dword [esi + 0x2c58]
test eax, eax
je 0x1004acdc
mov ecx, dword [esi + 0x2c50]
lea ecx, [ecx + ecx*2]
shl ecx, 3
push ecx
push eax
push ebx
call fcn.1008e250
mov ecx, dword [esi + 0x2c58]
add esp, 0xc
test ecx, ecx
je 0x1004accc
mov eax, dword [0x10307a40]
test eax, eax
je 0x1004accc
dec dword [eax + 0x36c]
push dword [0x10307a48]
push ecx
call dword [0x100e25ac]
add esp, 8
mov dword [esi + 0x2c58], ebx
mov dword [esi + 0x2c54], edi
pop ebx
mov eax, dword [esi + 0x2c50]
movups xmm0, xmmword [ebp - 0x18]
pop edi
lea ecx, [eax + eax*2]
mov eax, dword [esi + 0x2c58]
movups xmmword [eax + ecx*8], xmm0
movq xmm0, qword [ebp - 8]
movq qword [eax + ecx*8 + 0x10], xmm0
inc dword [esi + 0x2c50]
mov byte [esi], 1
pop esi
mov esp, ebp
pop ebp
ret