joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100070df
Capabilities:
Encode data using xor

Disassembly:
push 0x14
mov eax, 0x1009ee11
call fcn.1009e14c
mov eax, dword fs:[0x2c]
mov esi, 0x1013b730
mov ecx, dword [0x10113814]
mov ecx, dword [eax + ecx*4]
mov eax, dword [0x1013b850]
cmp eax, dword [ecx + 4]
jle 0x10007166
mov edi, 0x1013b850
push edi
call fcn.1009cfcc
cmp dword [0x1013b850], 0xffffffff
pop ecx
jne 0x10007166
xor edx, edx
mov dword [ebp - 4], edx
mov ecx, edx
movaps xmm0, xmmword [0x100ff5b0]
movups xmmword [ebp - 0x20], xmm0
mov word [ebp - 0x10], 0x41
mov al, byte [ebp - 0x20]
xor byte [ebp + ecx - 0x1f], al
inc ecx
cmp ecx, 0x10
jb 0x10007139
lea eax, [ebp - 0x1f]
mov byte [ebp - 0xf], dl
push eax
mov ecx, esi
call fcn.1000801c
push 0x100a5883
call fcn.1009d3d7
push edi
call fcn.1009cf82
pop ecx
pop ecx
cmp dword [0x1013b744], 0x10
cmovae esi, dword [0x1013b730]
mov eax, esi
call fcn.1009e115
ret

Function at 0x100072c9
Capabilities:
Encode data using xor

Disassembly:
push 0x18
mov eax, 0x1009ee86
call fcn.1009e14c
mov eax, dword fs:[0x2c]
mov esi, 0x1013b7d0
mov ecx, dword [0x10113814]
mov ecx, dword [eax + ecx*4]
mov eax, dword [0x1013b810]
cmp eax, dword [ecx + 4]
jle 0x1000735a
mov edi, 0x1013b810
push edi
call fcn.1009cfcc
cmp dword [0x1013b810], 0xffffffff
pop ecx
jne 0x1000735a
xor edx, edx
mov dword [ebp - 4], edx
mov ecx, edx
movaps xmm0, xmmword [0x100ff660]
movups xmmword [ebp - 0x24], xmm0
mov dword [ebp - 0x14], 0x2d38380d
mov word [ebp - 0x10], 0x272f
mov byte [ebp - 0xe], dl
mov al, byte [ebp - 0x24]
xor byte [ebp + ecx - 0x23], al
inc ecx
cmp ecx, 0x15
jb 0x1000732d
lea eax, [ebp - 0x23]
mov byte [ebp - 0xe], dl
push eax
mov ecx, esi
call fcn.1000801c
push 0x100a58a1
call fcn.1009d3d7
push edi
call fcn.1009cf82
pop ecx
pop ecx
cmp dword [0x1013b7e4], 0x10
cmovae esi, dword [0x1013b7d0]
mov eax, esi
call fcn.1009e115
ret

Function at 0x10007370
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push 0xc
mov eax, 0x1009eead
call fcn.1009e14c
mov eax, dword fs:[0x2c]
mov esi, 0x1013b834
mov ecx, dword [0x10113814]
mov ecx, dword [eax + ecx*4]
mov eax, dword [0x1013b764]
cmp eax, dword [ecx + 4]
jle 0x100073fe
mov edi, 0x1013b764
push edi
call fcn.1009cfcc
cmp dword [0x1013b764], 0xffffffff
pop ecx
jne 0x100073fe
xor edx, edx
mov cl, 9
mov dword [ebp - 4], edx
mov eax, edx
mov dword [ebp - 0x18], 0x60566409
mov dword [ebp - 0x14], 0x7960654a
mov word [ebp - 0x10], 0x38
xor byte [ebp + eax - 0x17], cl
inc eax
cmp eax, 8
jae 0x100073de
mov cl, byte [ebp - 0x18]
jmp 0x100073cf
lea eax, [ebp - 0x17]
mov byte [ebp - 0xf], dl
push eax
mov ecx, esi
call fcn.1000801c
push 0x100a58ab
call fcn.1009d3d7
push edi
call fcn.1009cf82
pop ecx
pop ecx
cmp dword [0x1013b848], 0x10
cmovae esi, dword [0x1013b834]
mov eax, esi
call fcn.1009e115
ret
Function at 0x1000826c
Capabilities:
Encode data using xor

Disassembly:
push 0x14
mov eax, 0x1009ef60
call fcn.1009e14c
mov eax, dword fs:[0x2c]
mov esi, 0x1013b884
mov ecx, dword [0x10113814]
mov ecx, dword [eax + ecx*4]
mov eax, dword [0x1013b8ec]
cmp eax, dword [ecx + 4]
jle 0x100082f0
mov edi, 0x1013b8ec
push edi
call fcn.1009cfcc
cmp dword [0x1013b8ec], 0xffffffff
pop ecx
jne 0x100082f0
xor edx, edx
mov dword [ebp - 4], edx
mov ecx, edx
movaps xmm0, xmmword [0x100ff210]
movups xmmword [ebp - 0x20], xmm0
mov byte [ebp - 0x10], dl
mov al, byte [ebp - 0x20]
xor byte [ebp + ecx - 0x1f], al
inc ecx
cmp ecx, 0xf
jb 0x100082c3
lea eax, [ebp - 0x1f]
mov byte [ebp - 0x10], dl
push eax
mov ecx, esi
call fcn.1000801c
push 0x100a58bf
call fcn.1009d3d7
push edi
call fcn.1009cf82
pop ecx
pop ecx
cmp dword [0x1013b898], 0x10
cmovae esi, dword [0x1013b884]
mov eax, esi
call fcn.1009e115
ret

Function at 0x100084f6
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push 0x10
mov eax, 0x1009effc
call fcn.1009e14c
mov eax, dword fs:[0x2c]
mov esi, 0x1013b8d4
mov ecx, dword [0x10113814]
mov ecx, dword [eax + ecx*4]
mov eax, dword [0x1013b8b4]
cmp eax, dword [ecx + 4]
jle 0x1000858b
mov edi, 0x1013b8b4
push edi
call fcn.1009cfcc
cmp dword [0x1013b8b4], 0xffffffff
pop ecx
jne 0x1000858b
xor edx, edx
mov cl, 1
mov dword [ebp - 4], edx
mov eax, edx
mov dword [ebp - 0x1c], 0x675e6c01
mov dword [ebp - 0x18], 0x6274456d
mov dword [ebp - 0x14], 0x6c68756a
mov word [ebp - 0x10], 0x64
xor byte [ebp + eax - 0x1b], cl
inc eax
cmp eax, 0xc
jae 0x1000856b
mov cl, byte [ebp - 0x1c]
jmp 0x1000855c
lea eax, [ebp - 0x1b]
mov byte [ebp - 0xf], dl
push eax
mov ecx, esi
call fcn.1000801c
push 0x100a58e7
call fcn.1009d3d7
push edi
call fcn.1009cf82
pop ecx
pop ecx
cmp dword [0x1013b8e8], 0x10
cmovae esi, dword [0x1013b8d4]
mov eax, esi
call fcn.1009e115
ret

Function at 0x1000901a
Capabilities:
Encode data using xor

Disassembly:
push 0x14
mov eax, 0x1009f0ca
call fcn.1009e14c
mov eax, dword fs:[0x2c]
mov esi, 0x1013b90c
mov ecx, dword [0x10113814]
mov ecx, dword [eax + ecx*4]
mov eax, dword [0x1013b960]
cmp eax, dword [ecx + 4]
jle 0x100090a2
mov edi, 0x1013b960
push edi
call fcn.1009cfcc
cmp dword [0x1013b960], 0xffffffff
pop ecx
jne 0x100090a2
xor edx, edx
mov dword [ebp - 4], edx
mov ecx, edx
movaps xmm0, xmmword [0x10100280]
movups xmmword [ebp - 0x20], xmm0
mov dword [ebp - 0x10], 0x4d4541
mov al, byte [ebp - 0x20]
xor byte [ebp + ecx - 0x1f], al
inc ecx
cmp ecx, 0x12
jb 0x10009075
lea eax, [ebp - 0x1f]
mov byte [ebp - 0xd], dl
push eax
mov ecx, esi
call fcn.1000801c
push 0x100a5927
call fcn.1009d3d7
push edi
call fcn.1009cf82
pop ecx
pop ecx
cmp dword [0x1013b920], 0x10
cmovae esi, dword [0x1013b90c]
mov eax, esi
call fcn.1009e115
ret
Function at 0x10009e29
Capabilities:
Encode data using xor

Disassembly:
push 0x18
mov eax, 0x1009f14f
call fcn.1009e14c
mov eax, dword fs:[0x2c]
mov esi, 0x1013b98c
mov ecx, dword [0x10113814]
mov ecx, dword [eax + ecx*4]
mov eax, dword [0x1013b9ac]
cmp eax, dword [ecx + 4]
jle 0x10009eb4
mov edi, 0x1013b9ac
push edi
call fcn.1009cfcc
cmp dword [0x1013b9ac], 0xffffffff
pop ecx
jne 0x10009eb4
xor edx, edx
mov dword [ebp - 4], edx
mov ecx, edx
movaps xmm0, xmmword [0x10100250]
movups xmmword [ebp - 0x24], xmm0
mov dword [ebp - 0x14], 0x72736c7d
mov byte [ebp - 0x10], dl
mov al, byte [ebp - 0x24]
xor byte [ebp + ecx - 0x23], al
inc ecx
cmp ecx, 0x13
jb 0x10009e87
lea eax, [ebp - 0x23]
mov byte [ebp - 0x10], dl
push eax
mov ecx, esi
call fcn.1000801c
push 0x100a595a
call fcn.1009d3d7
push edi
call fcn.1009cf82
pop ecx
pop ecx
cmp dword [0x1013b9a0], 0x10
cmovae esi, dword [0x1013b98c]
mov eax, esi
call fcn.1009e115
ret

Function at 0x10009eca
Capabilities:
Encode data using xor

Disassembly:
push 0x14
mov eax, 0x1009f176
call fcn.1009e14c
mov eax, dword fs:[0x2c]
mov esi, 0x1013b974
mov ecx, dword [0x10113814]
mov ecx, dword [eax + ecx*4]
mov eax, dword [0x1013b970]
cmp eax, dword [ecx + 4]
jle 0x10009f52
mov edi, 0x1013b970
push edi
call fcn.1009cfcc
cmp dword [0x1013b970], 0xffffffff
pop ecx
jne 0x10009f52
xor edx, edx
mov dword [ebp - 4], edx
mov ecx, edx
movaps xmm0, xmmword [0x100ff460]
movups xmmword [ebp - 0x20], xmm0
mov dword [ebp - 0x10], 0x2e3b32
mov al, byte [ebp - 0x20]
xor byte [ebp + ecx - 0x1f], al
inc ecx
cmp ecx, 0x12
jb 0x10009f25
lea eax, [ebp - 0x1f]
mov byte [ebp - 0xd], dl
push eax
mov ecx, esi
call fcn.1000801c
push 0x100a5964
call fcn.1009d3d7
push edi
call fcn.1009cf82
pop ecx
pop ecx
cmp dword [0x1013b988], 0x10
cmovae esi, dword [0x1013b974]
mov eax, esi
call fcn.1009e115
ret
Function at 0x10030127
Capabilities:
Encode data using xor

Disassembly:
push 0xdc
mov eax, 0x100a25c5
call fcn.1009e1ee
push 0xb8
xor ebx, ebx
lea eax, [ebp - 0xd0]
push ebx
push eax
call sub.VCrUnTImE140.DlL_memset
movaps xmm0, xmmword [0x100ff690]
add esp, 0xc
movups xmmword [ebp - 0xe8], xmm0
mov dword [ebp - 0xd8], 0x34703b2a
mov ecx, ebx
mov dword [ebp - 0xd4], 0x30312d
mov al, byte [ebp - 0xe8]
xor byte [ebp + ecx - 0xe7], al
inc ecx
cmp ecx, 0x16
jb 0x10030171
sub esp, 0xc
mov byte [ebp - 0xd1], bl
lea eax, [ebp - 0xe7]
lea ecx, [ebp - 0xd0]
push eax
call fcn.10041ba6
mov dword [ebp - 4], ebx
mov eax, dword [ebp - 0xd0]
mov eax, dword [eax + 4]
cmp dword [ebp + eax - 0xc4], 0
jne 0x10030373
lea ecx, [ebp - 0xd0]
mov byte [ebp - 4], 1
call fcn.10042534
mov dword [ebp - 4], ebx
mov eax, dword fs:[0x2c]
mov ecx, dword [0x10113814]
mov edi, dword [eax + ecx*4]
mov eax, dword [0x1013ba10]
cmp eax, dword [edi + 4]
jle 0x10030207
mov ebx, 0x1013ba10
push ebx
call fcn.1009cfcc
or esi, 0xffffffff
pop ecx
cmp dword [0x1013ba10], esi
jne 0x1003020a
push ebx
call fcn.1009cf82
pop ecx
jmp 0x1003020a
or esi, 0xffffffff
mov eax, dword [0x1013ba58]
cmp eax, dword [edi + 4]
jle 0x10030232
mov ebx, 0x1013ba58
push ebx
call fcn.1009cfcc
pop ecx
cmp dword [0x1013ba58], esi
jne 0x10030232
push ebx
call fcn.1009cf82
pop ecx
mov eax, dword [0x1013ba28]
cmp eax, dword [edi + 4]
jle 0x1003025a
mov ebx, 0x1013ba28
push ebx
call fcn.1009cfcc
pop ecx
cmp dword [0x1013ba28], esi
jne 0x1003025a
push ebx
call fcn.1009cf82
pop ecx
mov eax, dword [0x1013ba60]
cmp eax, dword [edi + 4]
jle 0x10030282
mov ebx, 0x1013ba60
push ebx
call fcn.1009cfcc
pop ecx
cmp dword [0x1013ba60], esi
jne 0x10030282
push ebx
call fcn.1009cf82
pop ecx
mov eax, dword [0x1013ba38]
cmp eax, dword [edi + 4]
jle 0x100302aa
mov ebx, 0x1013ba38
push ebx
call fcn.1009cfcc
pop ecx
cmp dword [0x1013ba38], esi
jne 0x100302aa
push ebx
call fcn.1009cf82
pop ecx
mov eax, dword [0x1013ba2c]
cmp eax, dword [edi + 4]
jle 0x100302d2
mov ebx, 0x1013ba2c
push ebx
call fcn.1009cfcc
pop ecx
cmp dword [0x1013ba2c], esi
jne 0x100302d2
push ebx
call fcn.1009cf82
pop ecx
mov eax, dword [0x1013bae0]
cmp eax, dword [edi + 4]
jle 0x100302fa
mov ebx, 0x1013bae0
push ebx
call fcn.1009cfcc
pop ecx
cmp dword [0x1013bae0], esi
jne 0x100302fa
push ebx
call fcn.1009cf82
pop ecx
mov eax, dword [0x1013bacc]
cmp eax, dword [edi + 4]
jle 0x10030322
mov edi, 0x1013bacc
push edi
call fcn.1009cfcc
pop ecx
cmp dword [0x1013bacc], esi
jne 0x10030322
push edi
call fcn.1009cf82
pop ecx
mov ecx, 0x1013bad1
call fcn.1003039b
mov ecx, 0x1013bac8
call fcn.10030752
mov ecx, 0x1013b9b8
call fcn.1003128e
mov ecx, 0x1013bad0
call fcn.10031b97
mov ecx, 0x1013ba0c
call fcn.10031fff
mov ecx, 0x1013b9b0
call fcn.100395d3
mov ecx, 0x1013ba1c
call fcn.10039ded
lea ecx, [ebp - 0xd0]
call fcn.10041b55
lea ecx, [ebp - 0x60]
call fcn.10041b76
lea ecx, [ebp - 0x60]
call dword [sym.imp.MsVcP140.DlL_public_virtual:_void___thiscall_std::basic_ios_char__struct_std::char_traits_char__::destructor_void_]
call fcn.1009e13b
ret
Function at 0x100434be
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x1010fa0c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, ecx
xor ebx, ebx
push edi
cmp dword [esi + 0x38], ebx
je 0x10043516
cmp byte [esi + 0x3d], bl
je 0x10043516
mov eax, dword [esi]
push 0xffffffffffffffff
call dword [eax + 0xc]
cmp eax, 0xffffffff
je 0x10043550
mov ecx, dword [esi + 0x38]
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [esi + 0x40]
push eax
call dword [sym.imp.MsVcP140.DlL_public:_int___thiscall_std::codecvt_char__char__struct__Mbstatet_::unshift_struct__Mbstatet___char___char___char___const]
sub eax, ebx
je 0x10043527
sub eax, 1
je 0x1004352a
dec eax
sub eax, 1
jne 0x10043550
mov byte [esi + 0x3d], bl
mov al, 1
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1009ce88
leave
ret
mov byte [esi + 0x3d], bl
mov edi, dword [ebp - 0x28]
lea eax, [ebp - 0x24]
sub edi, eax
je 0x10043548
push dword [esi + 0x4c]
push edi
push 1
push eax
call dword [sym.imp.ApI_mS_win_crT_sTdIO_L1_1_0.Dll_fwrite]
add esp, 0x10
cmp edi, eax
jne 0x10043550
cmp byte [esi + 0x3d], bl
sete al
jmp 0x10043518
xor al, al
jmp 0x10043518
Function at 0x1004b1f7
Capabilities:
Parse credit card information

Disassembly:
push ebx
push esi
mov esi, ecx
xor cl, cl
push edi
mov eax, dword [esi + 0x4c]
cmp eax, 0xffffffff
je 0x1004b38d
mov edx, 0x10000000
cmp eax, 0x7c
je 0x1004b38d
cmp eax, 0x29
jne 0x1004b230
cmp dword [esi + 0x10], 0
jne 0x1004b38d
test dword [esi + 0x50], edx
je 0x1004b393
cmp eax, 0x2e
jne 0x1004b24b
push 5
lea ecx, [esi + 0x24]
call fcn.1004b473
mov ecx, esi
call fcn.1004b1cf
jmp 0x1004b377
cmp eax, 0x5c
jne 0x1004b29d
mov ecx, esi
call fcn.1004b1cf
test byte [esi + 0x50], 0x80
je 0x1004b291
mov al, byte [esi + 0x48]
cmp al, 0x62
jne 0x1004b27a
push 4
lea ecx, [esi + 0x24]
call fcn.1004b473
mov ecx, esi
call fcn.1004b1cf
jmp 0x1004b37e
cmp al, 0x42
jne 0x1004b291
push 4
lea ecx, [esi + 0x24]
call fcn.1004b473
mov eax, dword [esi + 0x28]
xor dword [eax + 8], 1
jmp 0x1004b26e
mov ecx, esi
call fcn.1004bb6c
jmp 0x1004b377
cmp eax, 0x5b
jne 0x1004b300
mov ecx, esi
call fcn.1004b1cf
lea ecx, [esi + 0x24]
call fcn.1004cd5a
mov eax, dword [esi + 0x4c]
cmp eax, 0x5e
jne 0x1004b2ca
mov eax, dword [esi + 0x28]
mov ecx, esi
xor dword [eax + 8], 1
call fcn.1004b1cf
mov eax, dword [esi + 0x4c]
test dword [esi + 0x50], 0x20000000
je 0x1004b2e8
cmp eax, 0x5d
jne 0x1004b2e8
push eax
lea ecx, [esi + 0x24]
call fcn.1004cdb5
mov ecx, esi
call fcn.1004b1cf
mov ecx, esi
call fcn.1004caa7
cmp dword [esi + 0x4c], 0x5d
je 0x1004b23f
push 4
jmp 0x1004b395
cmp eax, 0x28
jne 0x1004b31d
mov ecx, esi
call fcn.1004b1cf
mov ecx, esi
call fcn.1004bc54
cmp dword [esi + 0x4c], 0x29
mov bl, al
jne 0x1004b393
jmp 0x1004b36c
cmp eax, 0x5e
jne 0x1004b329
push 2
jmp 0x1004b266
cmp eax, 0x24
jne 0x1004b335
push 3
jmp 0x1004b266
cmp eax, 0x2a
je 0x1004b389
cmp eax, 0x2b
je 0x1004b389
cmp eax, 0x3f
je 0x1004b389
cmp eax, 0x7b
je 0x1004b389
cmp eax, 0x7d
jne 0x1004b353
test dword [esi + 0x50], edx
je 0x1004b385
cmp eax, 0x5d
jne 0x1004b35d
test dword [esi + 0x50], edx
je 0x1004b2f9
movzx eax, byte [esi + 0x48]
lea ecx, [esi + 0x24]
push eax
call fcn.1004bdbd
mov bl, 1
mov ecx, esi
call fcn.1004b1cf
test bl, bl
je 0x1004b37e
mov ecx, esi
call fcn.1004bcd5
mov cl, 1
jmp 0x1004b1fe
push 6
jmp 0x1004b395
push 0xa
jmp 0x1004b395
pop edi
pop esi
mov al, cl
pop ebx
ret
push 5
call fcn.1004aaf3
int3
Function at 0x1004de24
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, edx
mov edx, dword [ecx]
mov dword [ebp - 4], ecx
cmp edi, 7
ja case.default.0x1004de3a
jmp dword [edi*4 + 0x1004dfd0]
mov eax, esi
and eax, 3
sub edi, eax
sub eax, 1
je 0x1004de7d
sub eax, 1
je 0x1004de6a
sub eax, 1
jne 0x1004de90
movzx ecx, byte [esi]
movzx eax, dl
xor ecx, eax
shr edx, 8
xor edx, dword [ecx*4 + 0x100a7248]
inc esi
movzx ecx, byte [esi]
movzx eax, dl
xor ecx, eax
shr edx, 8
xor edx, dword [ecx*4 + 0x100a7248]
inc esi
movzx ecx, byte [esi]
movzx eax, dl
xor ecx, eax
shr edx, 8
xor edx, dword [ecx*4 + 0x100a7248]
inc esi
mov ebx, edi
sar ebx, 3
test ebx, ebx
je 0x1004df12
xor edx, dword [esi]
movzx eax, dl
shr edx, 8
xor edx, dword [eax*4 + 0x100a7248]
movzx eax, dl
shr edx, 8
xor edx, dword [eax*4 + 0x100a7248]
movzx eax, dl
shr edx, 8
xor edx, dword [eax*4 + 0x100a7248]
mov ecx, edx
movzx eax, cl
shr ecx, 8
mov edx, dword [eax*4 + 0x100a7248]
xor edx, dword [esi + 4]
add esi, 8
xor edx, ecx
movzx eax, dl
shr edx, 8
xor edx, dword [eax*4 + 0x100a7248]
movzx eax, dl
shr edx, 8
xor edx, dword [eax*4 + 0x100a7248]
movzx eax, dl
shr edx, 8
xor edx, dword [eax*4 + 0x100a7248]
movzx eax, dl
shr edx, 8
xor edx, dword [eax*4 + 0x100a7248]
sub ebx, 1
jne 0x1004de99
and edi, 7
jmp 0x1004de35
movzx ecx, byte [esi]
movzx eax, dl
xor ecx, eax
shr edx, 8
xor edx, dword [ecx*4 + 0x100a7248]
inc esi
movzx ecx, byte [esi]
movzx eax, dl
xor ecx, eax
shr edx, 8
xor edx, dword [ecx*4 + 0x100a7248]
inc esi
movzx ecx, byte [esi]
movzx eax, dl
xor ecx, eax
shr edx, 8
xor edx, dword [ecx*4 + 0x100a7248]
inc esi
xor edx, dword [esi]
movzx eax, dl
shr edx, 8
xor edx, dword [eax*4 + 0x100a7248]
movzx eax, dl
shr edx, 8
xor edx, dword [eax*4 + 0x100a7248]
movzx eax, dl
shr edx, 8
xor edx, dword [eax*4 + 0x100a7248]
movzx eax, dl
shr edx, 8
xor edx, dword [eax*4 + 0x100a7248]
jmp case.0x1004de3a.0
movzx ecx, byte [esi]
movzx eax, dl
xor ecx, eax
shr edx, 8
xor edx, dword [ecx*4 + 0x100a7248]
inc esi
movzx ecx, byte [esi]
movzx eax, dl
xor ecx, eax
shr edx, 8
xor edx, dword [ecx*4 + 0x100a7248]
inc esi
movzx ecx, byte [esi]
movzx eax, dl
xor ecx, eax
shr edx, 8
xor edx, dword [ecx*4 + 0x100a7248]
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
mov dword [eax], edx
leave
ret
Function at 0x1004df53
Capabilities:
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, edx
mov edx, dword [ecx]
mov dword [ebp - 4], ecx
cmp edi, 7
ja case.default.0x1004de3a
jmp dword [edi*4 + 0x1004dfd0]
mov eax, esi
and eax, 3
sub edi, eax
sub eax, 1
je 0x1004de7d
sub eax, 1
je 0x1004de6a
sub eax, 1
jne 0x1004de90
movzx ecx, byte [esi]
movzx eax, dl
xor ecx, eax
shr edx, 8
xor edx, dword [ecx*4 + 0x100a7248]
inc esi
movzx ecx, byte [esi]
movzx eax, dl
xor ecx, eax
shr edx, 8
xor edx, dword [ecx*4 + 0x100a7248]
inc esi
movzx ecx, byte [esi]
movzx eax, dl
xor ecx, eax
shr edx, 8
xor edx, dword [ecx*4 + 0x100a7248]
inc esi
mov ebx, edi
sar ebx, 3
test ebx, ebx
je 0x1004df12
xor edx, dword [esi]
movzx eax, dl
shr edx, 8
xor edx, dword [eax*4 + 0x100a7248]
movzx eax, dl
shr edx, 8
xor edx, dword [eax*4 + 0x100a7248]
movzx eax, dl
shr edx, 8
xor edx, dword [eax*4 + 0x100a7248]
mov ecx, edx
movzx eax, cl
shr ecx, 8
mov edx, dword [eax*4 + 0x100a7248]
xor edx, dword [esi + 4]
add esi, 8
xor edx, ecx
movzx eax, dl
shr edx, 8
xor edx, dword [eax*4 + 0x100a7248]
movzx eax, dl
shr edx, 8
xor edx, dword [eax*4 + 0x100a7248]
movzx eax, dl
shr edx, 8
xor edx, dword [eax*4 + 0x100a7248]
movzx eax, dl
shr edx, 8
xor edx, dword [eax*4 + 0x100a7248]
sub ebx, 1
jne 0x1004de99
and edi, 7
jmp 0x1004de35
movzx ecx, byte [esi]
movzx eax, dl
xor ecx, eax
shr edx, 8
xor edx, dword [ecx*4 + 0x100a7248]
inc esi
movzx ecx, byte [esi]
movzx eax, dl
xor ecx, eax
shr edx, 8
xor edx, dword [ecx*4 + 0x100a7248]
inc esi
movzx ecx, byte [esi]
movzx eax, dl
xor ecx, eax
shr edx, 8
xor edx, dword [ecx*4 + 0x100a7248]
inc esi
xor edx, dword [esi]
movzx eax, dl
shr edx, 8
xor edx, dword [eax*4 + 0x100a7248]
movzx eax, dl
shr edx, 8
xor edx, dword [eax*4 + 0x100a7248]
movzx eax, dl
shr edx, 8
xor edx, dword [eax*4 + 0x100a7248]
movzx eax, dl
shr edx, 8
xor edx, dword [eax*4 + 0x100a7248]
jmp case.0x1004de3a.0
movzx ecx, byte [esi]
movzx eax, dl
xor ecx, eax
shr edx, 8
xor edx, dword [ecx*4 + 0x100a7248]
inc esi
movzx ecx, byte [esi]
movzx eax, dl
xor ecx, eax
shr edx, 8
xor edx, dword [ecx*4 + 0x100a7248]
inc esi
movzx ecx, byte [esi]
movzx eax, dl
xor ecx, eax
shr edx, 8
xor edx, dword [ecx*4 + 0x100a7248]
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
mov dword [eax], edx
leave
ret

Function at 0x1004e82a
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
cmp dword [ebp + 0xc], 1
jne 0x1004e856
cmp dword [ebp + 8], 0
je 0x1004e842
push dword [ebp + 8]
call dword [sym.imp.kErnel32.dlL_DisableThreadLibraryCalls]
xor ecx, ecx
push ecx
push ecx
push dword [ebp + 8]
push 0x1004e68e
push ecx
push ecx
call dword [sym.imp.kErnel32.dlL_CreateThread]
xor eax, eax
inc eax
pop ebp
ret 0xc
Function at 0x1004efc1
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100a4da9
mov eax, dword fs:[0]
push eax
sub esp, 0xc
mov eax, dword [0x1010fa0c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, edx
mov esi, ecx
and dword [ebp - 4], 0
mov ecx, dword [0x10113a14]
mov eax, dword [ecx]
call dword [eax + 0x90]
movss xmm0, dword [esi]
movss xmm4, dword [0x100fed04]
mulss xmm0, dword [eax]
movss xmm2, dword [eax + 4]
mulss xmm2, dword [esi + 4]
addss xmm2, xmm0
movss xmm0, dword [eax + 8]
mulss xmm0, dword [esi + 8]
addss xmm2, xmm0
addss xmm2, dword [eax + 0xc]
movss dword [edi], xmm2
movss xmm0, dword [eax + 0x14]
mulss xmm0, dword [esi + 4]
movss xmm1, dword [eax + 0x10]
mulss xmm1, dword [esi]
addss xmm1, xmm0
movss xmm0, dword [eax + 0x18]
mulss xmm0, dword [esi + 8]
addss xmm1, xmm0
addss xmm1, dword [eax + 0x1c]
and dword [edi + 8], 0
movss dword [edi + 4], xmm1
movss xmm0, dword [eax + 0x34]
movss xmm3, dword [eax + 0x30]
mulss xmm3, dword [esi]
mulss xmm0, dword [esi + 4]
addss xmm3, xmm0
movss xmm0, dword [eax + 0x38]
mulss xmm0, dword [esi + 8]
addss xmm3, xmm0
addss xmm3, dword [eax + 0x3c]
comiss xmm4, xmm3
jbe 0x1004f0a2
movss xmm0, dword [0x100fef04]
jmp 0x1004f0ae
movss xmm0, dword [0x100fed9c]
divss xmm0, xmm3
or dword [ebp - 4], 0xffffffff
comiss xmm4, xmm3
mulss xmm1, xmm0
mulss xmm2, xmm0
seta al
movss dword [edi + 4], xmm1
movss dword [edi], xmm2
test al, al
jne 0x1004f131
mov ecx, dword [0x10113a14]
lea edx, [ebp - 0x18]
push edx
lea edx, [ebp - 0x14]
push edx
mov eax, dword [ecx]
call dword [eax + 0x14]
movd xmm1, dword [ebp - 0x14]
mov al, 1
movss xmm0, dword [edi]
movss xmm3, dword [0x100fed6c]
cvtdq2ps xmm1, xmm1
mulss xmm0, xmm1
mulss xmm1, xmm3
mulss xmm0, xmm3
addss xmm0, xmm1
movd xmm1, dword [ebp - 0x18]
cvtdq2ps xmm1, xmm1
movss dword [edi], xmm0
movss xmm0, dword [edi + 4]
movaps xmm2, xmm1
mulss xmm0, xmm1
mulss xmm2, xmm3
mulss xmm0, xmm3
subss xmm2, xmm0
movss dword [edi + 4], xmm2
jmp 0x1004f133
xor al, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1009ce88
leave
ret
Function at 0x1004fa0d
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100a4e1d
mov eax, dword fs:[0]
push eax
sub esp, 0x80
mov eax, dword [0x1010fa0c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ecx, dword [0x10113a14]
mov eax, dword [ecx]
call dword [eax + 0x30]
mov ecx, dword [0x10113a20]
push eax
mov edx, dword [ecx]
mov edx, dword [edx + 0xc]
call edx
mov edi, eax
mov dword [ebp - 0x8c], edi
test edi, edi
je 0x1004fbc6
mov ecx, edi
call fcn.1005032b
mov ecx, edi
call fcn.1004f38c
mov ecx, dword [0x10113a14]
xor esi, esi
mov dword [ebp - 0x88], esi
mov eax, dword [ecx]
call dword [eax + 0x54]
test eax, eax
jle 0x1004fbc6
mov ecx, dword [0x10113a20]
push esi
mov eax, dword [ecx]
mov eax, dword [eax + 0xc]
call eax
mov ebx, eax
test ebx, ebx
je 0x1004fbac
lea ecx, [ebx + 8]
mov edx, dword [ecx]
mov edx, dword [edx + 0x20]
call edx
test al, al
jne 0x1004fbac
mov eax, dword [ebx]
mov ecx, ebx
mov eax, dword [eax + 0x20c]
call eax
test al, al
je 0x1004fbac
mov eax, dword [ebx]
mov ecx, ebx
mov eax, dword [eax + 0x208]
call eax
test al, al
je 0x1004fbac
push edi
mov ecx, ebx
call fcn.1000753a
test al, al
je 0x1004fbac
push ebx
lea ecx, [ebp - 0x84]
call fcn.1004ebeb
cmp byte [ebp - 0x14], 0
je 0x1004fbac
sub esp, 0x74
lea esi, [ebp - 0x84]
push 0x1d
pop ecx
mov edi, esp
rep movsd dword es:[edi], dword [esi]
call fcn.1004fbe0
push 0x1d
pop ecx
lea esi, [ebp - 0x84]
mov edi, esp
rep movsd dword es:[edi], dword [esi]
mov ecx, dword [ebp - 0x88]
call fcn.1005074c
push 0x1d
pop ecx
lea esi, [ebp - 0x84]
mov edi, esp
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
call fcn.100501a2
push 0x1d
pop ecx
lea esi, [ebp - 0x84]
mov edi, esp
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
call fcn.10050643
push 0x1d
pop ecx
lea esi, [ebp - 0x84]
mov edi, esp
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
call fcn.10050414
push 0x1d
pop ecx
lea esi, [ebp - 0x84]
mov edi, esp
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
call fcn.1005001e
push 0x1d
pop ecx
lea esi, [ebp - 0x84]
mov edi, esp
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
call fcn.1005053e
mov esi, dword [ebp - 0x88]
add esp, 0x74
mov ecx, esi
call fcn.1004f14c
mov edi, dword [ebp - 0x8c]
mov ecx, dword [0x10113a14]
inc esi
mov dword [ebp - 0x88], esi
mov eax, dword [ecx]
call dword [eax + 0x54]
cmp esi, eax
jl 0x1004fa8d
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1009ce88
leave
ret