joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10037bd0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x60
mov eax, dword [0x1039b040]
xor eax, ebp
mov dword [ebp - 8], eax
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
test eax, eax
je 0x10037d95
mov eax, dword [eax + 2]
mov dword [ebp - 0x14], eax
test eax, eax
je 0x10037d95
lea ebx, [eax - 4]
mov dword [ebp - 0x18], ebx
test ebx, ebx
je 0x10037d95
mov eax, dword [eax]
test eax, eax
je 0x10037d95
cmp eax, 0xc8
jg 0x10037d95
cmp dword [ebx], 0
je 0x10037d95
mov edi, dword [ebx + 8]
test edi, edi
je 0x10037d95
mov ecx, edi
mov esi, 0x81cc9dc5
lea edx, [ecx + 1]
nop dword [eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x10037c40
sub ecx, edx
mov edx, 0
je 0x10037c64
mov dword [ebp - 0x18], ebx
movsx eax, byte [edx + edi]
inc edx
xor eax, esi
imul esi, eax, 0x1100192
cmp edx, ecx
jb 0x10037c53
mov edi, dword [ebp - 0x14]
mov dword [ebp - 0xc], esi
mov dword [ebp - 0x1c], 0
cmp dword [edi], 0
jle 0x10037d95
mov eax, dword [ebp - 0x14]
xor edi, edi
mov dword [ebp - 0x20], edi
mov ebx, dword [ebx]
add ebx, edi
mov edi, dword [ebx + 4]
test edi, edi
je 0x10037d7a
mov eax, edi
mov esi, 0x81cc9dc5
lea edx, [eax + 1]
nop dword [eax + eax]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x10037ca0
sub eax, edx
mov edx, 0
je 0x10037cc1
movsx ecx, byte [edi + edx]
inc edx
xor ecx, esi
imul esi, ecx, 0x1100192
cmp edx, eax
jb 0x10037cb0
lea eax, [ebp - 0xc]
mov dword [ebp - 0x10], esi
push eax
lea eax, [ebp - 0x28]
mov ecx, 0x1039b700
push eax
call fcn.10033b60
mov ecx, dword [eax]
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x30]
add ecx, 0xc
push eax
call fcn.100338b0
mov eax, dword [eax]
cmp dword [eax + 0x14], 0
jne 0x10037d77
lea eax, [ebp - 0xc]
mov ecx, 0x1039b700
push eax
lea eax, [ebp - 0x38]
push eax
call fcn.10033b60
mov ecx, dword [eax]
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x40]
add ecx, 0xc
push eax
call fcn.100338b0
mov ecx, 0x1039b700
mov eax, dword [eax]
mov byte [eax + 0xc], 1
lea eax, [ebp - 0xc]
mov esi, dword [ebx + 8]
push eax
lea eax, [ebp - 0x48]
push eax
call fcn.10033b60
mov ecx, dword [eax]
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x50]
add ecx, 0xc
push eax
call fcn.100338b0
mov ecx, 0x1039b700
mov eax, dword [eax]
mov dword [eax + 0x14], esi
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x58]
push eax
call fcn.10033b60
mov ecx, dword [eax]
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x60]
add ecx, 0xc
push eax
call fcn.100338b0
mov eax, dword [eax]
mov dword [eax + 0x10], 0
mov eax, dword [ebp - 0x14]
mov ebx, dword [ebp - 0x1c]
mov edi, dword [ebp - 0x20]
inc ebx
add edi, 0x3c
mov dword [ebp - 0x1c], ebx
cmp ebx, dword [eax]
mov ebx, dword [ebp - 0x18]
mov dword [ebp - 0x20], edi
jl 0x10037c82
mov ecx, dword [ebp - 8]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1012583c
mov esp, ebp
pop ebp
ret 4
Function at 0x100550e0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x101a0df7
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push esi
push edi
mov eax, dword [0x1039b040]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, edx
mov dword [ebp - 0x10], ecx
push 0x410
call fcn.10125858
mov ebx, eax
mov dword [ebp - 0x18], ebx
mov dword [ebp - 4], 0
lea edi, [ebx + 0xc]
xorps xmm0, xmm0
mov ecx, edi
movq qword [ebx], xmm0
mov dword [ebx + 8], 0
mov dword [ebx + 4], 1
mov dword [ebx + 8], 1
mov dword [ebx], vtable.std::_Ref_count_obj2_class_LagRecord_.0
mov eax, dword [esi]
push eax
mov dword [edi], 0
mov dword [edi + 4], 0
mov dword [edi + 8], 0
mov dword [edi + 0xc], 0
mov dword [edi + 0x10], 0
mov dword [edi + 0x14], 0
mov dword [edi + 0x18], 0
mov dword [edi + 0x1c], 0
mov dword [edi + 0x20], 0
mov dword [edi + 0x24], 0
mov dword [edi + 0x28], 0
mov dword [edi + 0x2c], 0
mov dword [edi + 0x30], 0
mov dword [edi + 0x34], 0
mov dword [edi + 0x38], 0
mov dword [edi + 0x3c], 0
mov dword [edi + 0x40], 0
mov dword [edi + 0x44], 0
mov dword [edi + 0x48], 0
mov dword [edi + 0x4c], 0
mov dword [edi + 0x50], 0
mov dword [edi + 0x54], 0
mov dword [edi + 0x58], 0
mov dword [edi + 0x5c], 0
mov dword [edi + 0x60], 0
mov dword [edi + 0x64], 0
mov dword [edi + 0x68], 0
mov dword [edi + 0x6c], 0
mov dword [edi + 0x70], 0
mov dword [edi + 0x74], 0
mov dword [edi + 0x78], 0
mov dword [edi + 0x7c], 0
mov dword [edi + 0x80], 0
mov dword [edi + 0x3bc], 0
mov dword [edi + 0x3c0], 0
mov dword [edi + 0x3c4], 0
mov dword [edi + 0x3c8], 0
mov dword [edi + 0x3cc], 0
mov dword [edi + 0x3d0], 0
mov dword [edi + 0x3d4], 0
mov dword [edi + 0x3d8], 0
mov dword [edi + 0x3dc], 0
mov dword [edi + 0x3e0], 0
mov dword [edi + 0x3e4], 0
mov dword [edi + 0x3e8], 0
mov dword [edi + 0x3ec], 0
mov dword [edi + 0x3f0], 0
mov dword [edi + 0x3f4], 0
mov dword [edi + 0x3f8], 0
mov dword [edi + 0x3fc], 0
mov byte [edi + 0x400], 0
call fcn.1006a680
mov eax, dword [ebp - 0x10]
xorps xmm0, xmm0
movq qword [eax], xmm0
mov dword [eax + 4], 0
mov dword [eax], edi
mov dword [eax + 4], ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1006cc50
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
mov ebx, ecx
mov dword [ebp - 0x10], edx
mov dword [ebp - 0xc], ecx
push esi
push edi
test ebx, ebx
je 0x1006ccfa
nop dword [eax]
cmp dword [ebx + 4], 0
mov dword [ebp - 4], 0
jle 0x1006ccec
xor edi, edi
mov dword [ebp - 8], edi
mov ebx, dword [ebx]
add ebx, edi
mov edi, dword [ebx + 4]
test edi, edi
je 0x1006ccd4
mov eax, edi
mov esi, 0x81cc9dc5
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x1006cc97
sub eax, edx
mov edx, 0
je 0x1006ccb8
movsx ecx, byte [edi + edx]
inc edx
xor ecx, esi
imul esi, ecx, 0x1100192
cmp edx, eax
jb 0x1006cca7
mov edx, dword [ebp - 0x10]
cmp esi, edx
je 0x1006cd03
cmp dword [ebx], 0xa
jne 0x1006ccd4
mov ecx, dword [ebx + 0x1c]
test ecx, ecx
je 0x1006ccd4
call fcn.1006cc50
test eax, eax
jne 0x1006ccfc
mov eax, dword [ebp - 4]
mov ebx, dword [ebp - 0xc]
inc eax
mov edi, dword [ebp - 8]
add edi, 0x3c
mov dword [ebp - 4], eax
mov dword [ebp - 8], edi
cmp eax, dword [ebx + 4]
jl 0x1006cc82
mov ebx, dword [ebx + 0xc]
mov dword [ebp - 0xc], ebx
test ebx, ebx
jne 0x1006cc70
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [ebx + 8]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x100a0990
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [0x1039b6d4]
sub esp, 8
mov eax, 0x2aaaaaab
push ebx
push esi
mov esi, dword [0x103c49e4]
push edi
mov edi, dword [0x1039b6d0]
sub ecx, edi
imul ecx
sar edx, 3
mov eax, edx
shr eax, 0x1f
add eax, edx
cmp eax, esi
jbe 0x100a0b85
lea esi, [esi + esi*2]
shl esi, 4
add esi, 8
add esi, edi
je 0x100a09f1
mov eax, dword [esi + 0x24]
and eax, 0xfffffffc
je 0x100a09f1
add eax, 4
push 0x1039b8e0
push eax
call dword [sym.imp.VCRUNTIME140.dll___std_type_info_compare]
add esp, 8
test eax, eax
je 0x100a09f3
xor esi, esi
cmp byte [esi], 0
je 0x100a0b7e
mov ecx, dword [0x103bce20]
mov eax, dword [ecx]
mov eax, dword [eax + 0x68]
call eax
test al, al
je 0x100a0b7e
mov ecx, dword [0x103bcea4]
xor edi, edi
mov dword [ebp - 4], ecx
mov eax, dword [ecx + 0x28]
mov dword [ebp - 8], eax
test eax, eax
jle 0x100a0b7e
nop word [eax + eax]
mov eax, dword [ecx + 0x1c]
mov ecx, dword [eax + edi*4]
mov eax, dword [ecx]
mov eax, dword [eax + 0x30]
call eax
mov ebx, eax
mov esi, 0x81cc9dc5
mov ecx, ebx
lea edx, [ecx + 1]
nop dword [eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x100a0a50
sub ecx, edx
mov edx, 0
je 0x100a0a79
movsx eax, byte [ebx + edx]
inc edx
xor eax, esi
imul esi, eax, 0x1100192
cmp edx, ecx
jb 0x100a0a60
cmp esi, 0x883d3532
je 0x100a0a88
inc edi
cmp edi, dword [ebp - 8]
jge 0x100a0b7e
mov ecx, dword [ebp - 4]
jmp 0x100a0a30
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x1c]
mov edi, dword [eax + edi*4]
test edi, edi
je 0x100a0b7e
mov edx, dword [edi + 0x88]
test edx, edx
je 0x100a0b7e
movss xmm1, dword [0x1038d9e0]
xor ebx, ebx
cmp edx, 4
jl 0x100a0b4b
mov ecx, dword [edi + 0x7c]
lea esi, [edx - 4]
shr esi, 2
add ecx, 0x1078
inc esi
lea ebx, [esi*4]
movss xmm0, dword [ecx - 0xc60]
ucomiss xmm0, xmm1
lahf
test ah, 0x44
jp 0x100a0aec
mov dword [ecx - 0xc60], 0x7f7fffff
movss xmm0, dword [ecx - 0x840]
ucomiss xmm0, xmm1
lahf
test ah, 0x44
jp 0x100a0b07
mov dword [ecx - 0x840], 0x7f7fffff
movss xmm0, dword [ecx - 0x420]
ucomiss xmm0, xmm1
lahf
test ah, 0x44
jp 0x100a0b22
mov dword [ecx - 0x420], 0x7f7fffff
movss xmm0, dword [ecx]
ucomiss xmm0, xmm1
lahf
test ah, 0x44
jp 0x100a0b35
mov dword [ecx], 0x7f7fffff
add ecx, 0x1080
sub esi, 1
jne 0x100a0ad1
cmp ebx, edx
jl 0x100a0b4f
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
test edx, edx
jle 0x100a0b7e
imul ecx, ebx, 0x420
add ecx, 0x418
add ecx, dword [edi + 0x7c]
sub edx, ebx
movss xmm0, dword [ecx]
ucomiss xmm0, xmm1
lahf
test ah, 0x44
jp 0x100a0b73
mov dword [ecx], 0x7f7fffff
add ecx, 0x420
sub edx, 1
jne 0x100a0b60
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
call fcn.10023530
int3
Function at 0x100aa6b0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
mov eax, dword [0x1039b040]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, ecx
cmp ebx, 0xffffffff
jne 0x100aa6e0
pop esi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1012583c
mov esp, ebp
pop ebp
ret 4
mov eax, dword [esi + 0x20]
push edi
mov ecx, dword [eax]
test ecx, ecx
je 0x100aa71c
mov edx, dword [esi + 0x30]
mov edi, dword [edx]
lea eax, [edi + ecx]
cmp ecx, eax
jae 0x100aa71c
lea ecx, [edi - 1]
mov eax, ebx
mov dword [edx], ecx
mov edx, dword [esi + 0x20]
pop edi
mov esi, dword [edx]
lea ecx, [esi + 1]
mov dword [edx], ecx
mov byte [esi], bl
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1012583c
mov esp, ebp
pop ebp
ret 4
cmp dword [esi + 0x4c], 0
je 0x100aa7f4
mov edi, dword [esi + 0xc]
lea eax, [esi + 0x3c]
cmp dword [edi], eax
jne 0x100aa744
mov edx, dword [esi + 0x54]
mov ecx, dword [esi + 0x50]
sub edx, ecx
mov dword [edi], ecx
mov eax, dword [esi + 0x1c]
mov dword [eax], ecx
mov eax, dword [esi + 0x2c]
mov dword [eax], edx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x100aa750
movsx eax, bl
jmp 0x100aa789
mov byte [ebp - 0x25], bl
mov eax, dword [ecx]
mov edx, dword [eax + 0x1c]
lea eax, [ebp - 0x2c]
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x25]
push eax
lea eax, [esi + 0x40]
push eax
call edx
sub eax, 0
je 0x100aa7b3
sub eax, 1
je 0x100aa7b3
sub eax, 2
jne 0x100aa7f4
movsx eax, byte [ebp - 0x25]
push dword [esi + 0x4c]
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
add esp, 8
or ecx, 0xffffffff
cmp eax, ecx
cmove ebx, ecx
pop edi
pop esi
mov eax, ebx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1012583c
mov esp, ebp
pop ebp
ret 4
mov edi, dword [ebp - 0x2c]
lea eax, [ebp - 0x24]
sub edi, eax
je 0x100aa7d1
push dword [esi + 0x4c]
push edi
push 1
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
add esp, 0x10
cmp edi, eax
jne 0x100aa7f4
lea ecx, [ebp - 0x25]
mov byte [esi + 0x3d], 1
or eax, 0xffffffff
cmp dword [ebp - 0x30], ecx
pop edi
pop esi
cmovne eax, ebx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1012583c
mov esp, ebp
pop ebp
ret 4
mov ecx, dword [ebp - 4]
or eax, 0xffffffff
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1012583c
mov esp, ebp
pop ebp
ret 4
Function at 0x100ac260
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x1039b040]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, ecx
cmp dword [esi + 0x38], 0
je 0x100ac31d
cmp byte [esi + 0x3d], 0
je 0x100ac31d
mov eax, dword [esi]
push edi
push 0xffffffffffffffff
call dword [eax + 0xc]
cmp eax, 0xffffffff
je 0x100ac30b
mov ecx, dword [esi + 0x38]
mov eax, dword [ecx]
mov edx, dword [eax + 0x20]
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [esi + 0x40]
push eax
call edx
sub eax, 0
je 0x100ac2d2
sub eax, 1
je 0x100ac2d6
sub eax, 2
jne 0x100ac30b
mov byte [esi + 0x3d], al
mov al, 1
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1012583c
mov esp, ebp
pop ebp
ret
mov byte [esi + 0x3d], 0
mov edi, dword [ebp - 0x28]
lea eax, [ebp - 0x24]
sub edi, eax
je 0x100ac2f4
push dword [esi + 0x4c]
push edi
push 1
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
add esp, 0x10
cmp edi, eax
jne 0x100ac30b
cmp byte [esi + 0x3d], 0
pop edi
sete al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1012583c
mov esp, ebp
pop ebp
ret
pop edi
xor al, al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1012583c
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
mov al, 1
xor ecx, ebp
pop esi
call fcn.1012583c
mov esp, ebp
pop ebp
ret
Function at 0x100b0f40
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x101a4a1c
mov eax, dword fs:[0]
push eax
sub esp, 0x14
mov eax, dword [0x1039b040]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x1c], edi
mov dword [ebp - 0x14], edi
mov eax, dword [ebp + 8]
mov dword [ebp - 4], 0
mov dword [edi], eax
mov dword [edi + 4], 0
mov dword [edi + 8], 0
mov dword [edi + 0xc], 0
mov dword [edi + 0x10], 0
mov dword [edi + 0x14], 0
mov dword [edi + 0x18], 0
mov dword [edi + 0x1c], 0
mov dword [edi + 0x20], 0
mov dword [edi + 0x24], 0
mov dword [edi + 0x28], 0
mov dword [edi + 0x2c], 0
lea ebx, [edi + 0x38]
mov dword [edi + 0x30], 0
mov byte [edi + 0x34], 0
mov dword [ebp - 0x1c], ebx
mov dword [ebx + 0x24], 0
mov byte [ebp - 4], 4
mov ecx, dword [ebp + 0x34]
test ecx, ecx
je 0x100b0ff7
mov eax, dword [ecx]
push ebx
call dword [eax]
mov dword [ebx + 0x24], eax
mov al, byte [ebp + 0xc]
lea ecx, [edi + 0x70]
mov byte [ebp - 4], 5
mov byte [edi + 0x60], al
push 9
mov byte [edi + 0x68], 9
call fcn.100ac850
mov byte [ebp - 4], 6
lea ecx, [ebp - 0x20]
mov eax, dword [edi + 0x10]
push dword [edi + 0x1c]
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x1c], 0
call fcn.10019bc0
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push ecx
lea ecx, [edi + 0x10]
call fcn.100b3ec0
mov ecx, dword [edi + 0x10]
mov dword [ebp - 0x18], ecx
lea ecx, [ebp - 0x18]
push eax
mov dword [ebp - 0x14], 0
call fcn.10019bc0
mov esi, dword [ebp - 0x18]
lea ecx, [ebp - 0x18]
mov edx, dword [ebp - 0x14]
push 1
mov dword [ebp - 0x18], esi
mov dword [ebp - 0x14], edx
call fcn.10019bc0
push dword [ebp - 0x14]
mov cl, 1
push dword [ebp - 0x18]
push edx
push esi
call fcn.10019fd0
mov ecx, dword [ebp + 0x34]
add esp, 0x10
test ecx, ecx
je 0x100b1090
mov esi, dword [ecx]
lea eax, [ebp + 0x10]
cmp ecx, eax
setne dl
movzx edx, dl
push edx
call dword [esi + 0x10]
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1012583c
mov esp, ebp
pop ebp
ret 0x30
Function at 0x100c1330
Capabilities:
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
mov edi, edx
not ebx
mov esi, ecx
mov eax, ebx
test edi, edi
je 0x100c1391
mov cl, byte [esi]
lea esi, [esi + 1]
dec edi
cmp cl, 0x23
jne 0x100c1374
cmp edi, 2
jb 0x100c1374
cmp byte [esi], cl
jne 0x100c1374
cmp byte [esi + 1], cl
jne 0x100c1374
mov eax, ebx
movzx ecx, cl
movzx edx, al
xor edx, ecx
shr eax, 8
xor eax, dword [edx*4 + 0x101e41e0]
jmp 0x100c1345
movzx edx, al
movzx ecx, cl
xor edx, ecx
shr eax, 8
xor eax, dword [edx*4 + 0x101e41e0]
test edi, edi
jne 0x100c1345
pop edi
pop esi
not eax
pop ebx
pop ebp
ret
mov cl, byte [esi]
inc esi
test cl, cl
je 0x100c13c0
cmp cl, 0x23
jne 0x100c13a7
cmp byte [esi], cl
jne 0x100c13a7
cmp byte [esi + 1], cl
cmove eax, ebx
movzx edx, al
movzx ecx, cl
xor edx, ecx
shr eax, 8
mov cl, byte [esi]
inc esi
xor eax, dword [edx*4 + 0x101e41e0]
test cl, cl
jne 0x100c1398
pop edi
pop esi
not eax
pop ebx
pop ebp
ret

Function at 0x100c14d0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
test ebx, ebx
je 0x100c14e4
mov dword [ebx], 0
mov edx, 0x10388ab8
call fcn.100c13d0
mov esi, eax
test esi, esi
je 0x100c15d2
mov edi, dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_ftell]
push esi
call edi
add esp, 4
mov dword [ebp - 4], eax
cmp eax, 0xffffffff
je 0x100c15c8
push 2
push 0
push esi
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fseek]
add esp, 0xc
test eax, eax
jne 0x100c15c8
push esi
call edi
mov edi, eax
add esp, 4
mov dword [ebp + 8], edi
cmp edi, 0xffffffff
je 0x100c15c8
push 0
push dword [ebp - 4]
push esi
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fseek]
add esp, 0xc
test eax, eax
jne 0x100c15c8
mov eax, dword [0x1039da5c]
test eax, eax
je 0x100c155c
inc dword [eax + 0xa8]
push edi
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov edi, eax
add esp, 4
test edi, edi
je 0x100c15c8
push esi
push dword [ebp + 8]
push 1
push edi
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
add esp, 0x10
push esi
cmp eax, dword [ebp + 8]
je 0x100c15ad
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
mov eax, dword [0x1039da5c]
add esp, 4
test eax, eax
je 0x100c159a
dec dword [eax + 0xa8]
push edi
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
add esp, 4
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
add esp, 4
test ebx, ebx
je 0x100c15bf
mov eax, dword [ebp + 8]
mov dword [ebx], eax
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push esi
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
add esp, 4
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x100c2d60
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ecx + 0xc4]
mov eax, dword [ecx + 0xcc]
push esi
push edi
lea esi, [ebp + 8]
mov edi, 4
mov eax, dword [eax + edx*4 - 4]
not eax
nop
movzx ecx, byte [esi]
lea esi, [esi + 1]
movzx edx, al
xor edx, ecx
shr eax, 8
xor eax, dword [edx*4 + 0x101e41e0]
sub edi, 1
jne 0x100c2d80
mov ecx, dword [0x1039da5c]
not eax
pop edi
pop esi
cmp dword [ecx + 0x13d0], eax
jne 0x100c2db2
mov dword [ecx + 0x13d4], eax
cmp dword [ecx + 0x1414], eax
jne 0x100c2dc1
mov byte [ecx + 0x1418], 1
pop ebp
ret 4

Function at 0x100c2dd0
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [0x1039b040]
xor eax, ebp
mov dword [ebp - 8], eax
mov eax, dword [ebp + 8]
mov edx, ecx
push esi
push edi
lea esi, [ebp - 0x18]
mov edi, 0x10
movss xmm1, dword [edx + 0xe0]
movss xmm0, dword [eax]
movss xmm2, dword [edx + 0xe4]
subss xmm0, xmm1
mov ecx, dword [edx + 0xc4]
movss dword [ebp - 0x18], xmm0
movss xmm0, dword [eax + 4]
subss xmm0, xmm2
movss dword [ebp - 0x14], xmm0
movss xmm0, dword [eax + 8]
subss xmm0, xmm1
movss dword [ebp - 0x10], xmm0
movss xmm0, dword [eax + 0xc]
mov eax, dword [edx + 0xcc]
subss xmm0, xmm2
mov edx, dword [eax + ecx*4 - 4]
movss dword [ebp - 0xc], xmm0
not edx
nop dword [eax + eax]
movzx eax, byte [esi]
lea esi, [esi + 1]
movzx ecx, dl
xor ecx, eax
shr edx, 8
xor edx, dword [ecx*4 + 0x101e41e0]
sub edi, 1
jne 0x100c2e50
mov eax, dword [0x1039da5c]
not edx
cmp dword [eax + 0x13d0], edx
jne 0x100c2e7f
mov dword [eax + 0x13d4], edx
cmp dword [eax + 0x1414], edx
jne 0x100c2e8e
mov byte [eax + 0x1418], 1
mov ecx, dword [ebp - 8]
mov eax, edx
pop edi
xor ecx, ebp
pop esi
call fcn.1012583c
mov esp, ebp
pop ebp
ret 4
Function at 0x100cc350
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [0x1039b040]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [0x1039da5c]
lea edx, [ebp - 8]
push ebx
push esi
push edi
mov edi, dword [eax + 0x1398]
mov esi, 4
mov eax, dword [edi + 0xc4]
add edi, 0xc4
mov dword [ebp - 8], ecx
mov ebx, dword [edi + 8]
mov ebx, dword [ebx + eax*4 - 4]
not ebx
nop
movzx eax, byte [edx]
lea edx, [edx + 1]
movzx ecx, bl
xor ecx, eax
shr ebx, 8
xor ebx, dword [ecx*4 + 0x101e41e0]
sub esi, 1
jne 0x100cc390
mov esi, dword [edi + 4]
not ebx
mov ecx, dword [edi]
cmp ecx, esi
jne 0x100cc3d7
inc ecx
test esi, esi
je 0x100cc3c5
mov eax, esi
cdq
sub eax, edx
sar eax, 1
add eax, esi
jmp 0x100cc3ca
mov eax, 8
cmp eax, ecx
cmovg ecx, eax
push ecx
mov ecx, edi
call fcn.100bf2b0
mov ecx, dword [edi]
mov eax, dword [edi + 8]
mov dword [eax + ecx*4], ebx
inc dword [edi]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1012583c
mov esp, ebp
pop ebp
ret
Function at 0x100d22f0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push ecx
push ebx
push esi
push edi
mov edi, ecx
mov ebx, edx
cmp dword [edi + 0x27b4], 0
lea esi, [edi + 0x27b8]
je 0x100d2372
mov ecx, dword [esi + 4]
test ecx, ecx
jns 0x100d232c
mov eax, ecx
cdq
sub eax, edx
sar eax, 1
add eax, ecx
xor ecx, ecx
test eax, eax
cmovg ecx, eax
push ecx
mov ecx, esi
call fcn.100d38f0
push dword [ebp + 8]
mov ecx, esi
mov dword [esi], 0
push ebx
call fcn.100c1c40
mov edx, dword [esi]
mov ecx, 0x1039da58
push dword [edi + 0x27b4]
lea eax, [edx - 1]
neg edx
sbb edx, edx
and edx, eax
mov eax, dword [edi + 0x27c0]
test eax, eax
push edx
cmovne ecx, eax
push 1
push ecx
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
add esp, 0x10
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push dword [ebp + 8]
mov ecx, esi
push ebx
call fcn.100c1c40
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x100d2900
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
mov esi, dword [0x1039da5c]
mov eax, ecx
mov dword [ebp - 8], eax
push edi
mov dword [esi + 0x2768], 0
test eax, eax
je 0x100d29ef
lea edi, [esi + 0x276c]
mov dword [esi + 0x2768], 0
mov ecx, dword [edi + 4]
test ecx, ecx
jns 0x100d2955
mov eax, ecx
cdq
sub eax, edx
sar eax, 1
add eax, ecx
xor ecx, ecx
test eax, eax
cmovg ecx, eax
push ecx
mov ecx, edi
call fcn.100d38f0
mov dword [edi], 0
cmp dword [edi + 4], 0
jne 0x100d296a
push 8
mov ecx, edi
call fcn.100d38f0
mov eax, dword [edi]
mov ecx, dword [edi + 8]
mov dword [ebp - 4], 0
mov byte [ecx + eax], 0
inc dword [edi]
cmp dword [esi + 0x2778], 0
jle 0x100d29ac
xor ebx, ebx
mov eax, dword [esi + 0x2780]
add eax, ebx
push edi
push eax
push esi
mov eax, dword [eax + 0x1c]
call eax
mov eax, dword [ebp - 4]
add esp, 0xc
inc eax
add ebx, 0x24
mov dword [ebp - 4], eax
cmp eax, dword [esi + 0x2778]
jl 0x100d2987
mov edi, dword [edi]
mov ebx, 0x1039da58
mov ecx, dword [ebp - 8]
mov edx, 0x10388ab4
lea eax, [edi - 1]
neg edi
sbb edi, edi
and edi, eax
mov eax, dword [esi + 0x2774]
test eax, eax
cmovne ebx, eax
call fcn.100c13d0
mov esi, eax
test esi, esi
je 0x100d29ef
push esi
push edi
push 1
push ebx
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
push esi
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
add esp, 0x14
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret