joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4cd134
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
xor ecx, ecx
mov dword [ebp - 8], ecx
mov ebx, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.0040575c
xor eax, eax
push ebp
push 0x4cd20e
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 8]
mov ecx, 0x4cd224
mov edx, dword [ebp - 4]
call fcn.004055f4
mov eax, dword [ebp - 8]
call fcn.0040576c
push eax
call sub.kernel32.dll_GetDriveTypeA
cmp eax, 6
ja case.0x4cd17e.0
jmp dword [eax*4 + 0x4cd185]
mov eax, ebx
mov edx, 0x4cd230
call fcn.00405330
jmp 0x4cd1f3
mov eax, ebx
mov edx, 0x4cd240
call fcn.00405330
jmp 0x4cd1f3
mov eax, ebx
mov edx, 0x4cd250
call fcn.00405330
jmp 0x4cd1f3
mov eax, ebx
mov edx, 0x4cd264
call fcn.00405330
jmp 0x4cd1f3
mov eax, ebx
mov edx, 0x4cd274
call fcn.00405330
jmp 0x4cd1f3
mov eax, ebx
mov edx, 0x4cd288
call fcn.00405330
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4cd215
lea eax, [ebp - 8]
mov edx, 2
call fcn.00405300
ret

Function at 0x4cd3d8
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffeb8
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0x140], edx
mov dword [ebp - 0x148], edx
mov dword [ebp - 0x144], edx
mov dword [ebp - 0x130], edx
mov dword [ebp - 0x13c], edx
mov dword [ebp - 0x134], edx
mov dword [ebp - 0x138], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.0040575c
lea edi, [ebp - 0x12c]
xor eax, eax
push ebp
push 0x4cd54a
push dword fs:[eax]
mov dword fs:[eax], esp
xor edx, edx
mov eax, 2
call fcn.004729cc
mov esi, eax
mov dword [edi], 0x128
mov edx, edi
mov eax, esi
call fcn.004729ec
mov ebx, eax
jmp 0x4cd51c
lea eax, [ebp - 0x138]
lea edx, [edi + 0x24]
mov ecx, 0x104
call fcn.0040554c
mov eax, dword [ebp - 0x138]
lea edx, [ebp - 0x134]
call fcn.0040a838
mov eax, dword [ebp - 0x134]
lea edx, [ebp - 0x130]
call fcn.004098c4
mov eax, dword [ebp - 0x130]
push eax
lea edx, [ebp - 0x13c]
mov eax, dword [ebp - 4]
call fcn.004098c4
mov edx, dword [ebp - 0x13c]
pop eax
call fcn.00405704
je 0x4cd4f2
lea eax, [ebp - 0x144]
lea edx, [edi + 0x24]
mov ecx, 0x104
call fcn.0040554c
mov eax, dword [ebp - 0x144]
lea edx, [ebp - 0x140]
call fcn.004098c4
mov eax, dword [ebp - 0x140]
push eax
lea edx, [ebp - 0x148]
mov eax, dword [ebp - 4]
call fcn.004098c4
mov edx, dword [ebp - 0x148]
pop eax
call fcn.00405704
jne 0x4cd511
call sub.kernel32.dll_GetCurrentProcessId
cmp eax, dword [edi + 8]
je 0x4cd511
push 0
mov eax, dword [edi + 8]
push eax
push 0
push 1
call sub.kernel32.dll_OpenProcess
push eax
call sub.kernel32.dll_TerminateProcess
mov edx, edi
mov eax, esi
call fcn.00472a0c
mov ebx, eax
test ebx, ebx
jne 0x4cd453
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4cd551
lea eax, [ebp - 0x148]
mov edx, 7
call fcn.00405300
lea eax, [ebp - 4]
call fcn.004052dc
ret
Function at 0x4d08a4
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdec
push ebx
xor ecx, ecx
mov dword [ebp - 8], ecx
mov ebx, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.0040575c
xor eax, eax
push ebp
push 0x4d0939
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 8]
mov ecx, 0x4d0950
mov edx, dword [ebp - 4]
call fcn.004055f4
push 0xff
lea eax, [ebp - 0x214]
push eax
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0xc]
push eax
push 0xff
lea eax, [ebp - 0x114]
push eax
mov eax, dword [ebp - 8]
call fcn.0040576c
push eax
call sub.kernel32.dll_GetVolumeInformationA
mov eax, dword [ebp - 0xc]
xor edx, edx
push edx
push eax
mov eax, ebx
call fcn.0040a1ac
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4d0940
lea eax, [ebp - 8]
mov edx, 2
call fcn.00405300
ret

Function at 0x4d3b80
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe28
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0x1d4], edx
mov dword [ebp - 0x1d8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.0040575c
xor eax, eax
push ebp
push 0x4d3cbb
push dword fs:[eax]
mov dword fs:[eax], esp
xor edx, edx
push ebp
push 0x4d3c8b
push dword fs:[edx]
mov dword fs:[edx], esp
mov eax, dword [ebp - 4]
call fcn.0040576c
mov ebx, eax
push ebx
call sub.kernel32.dll_DeleteFileA
mov eax, dword [ebp - 4]
call fcn.0040a5c0
test al, al
jne 0x4d3bfb
push 0
push 0x80
push 2
push 0
push 0
push 0xc0000000
push ebx
call sub.kernel32.dll_CreateFileA_1
push eax
call sub.kernel32.dll_CloseHandle_1
mov edx, dword [ebp - 4]
lea eax, [ebp - 0x1d0]
call fcn.0040372c
lea eax, [ebp - 0x1d0]
call fcn.004034c8
call fcn.004030c0
push dword [0x4dfddc]
push 0x4d3cd4
push dword [0x4dfde0]
push 0x4d3cd4
push dword [0x4dfde4]
lea eax, [ebp - 0x1d8]
mov edx, 5
call fcn.00405670
mov eax, dword [ebp - 0x1d8]
lea edx, [ebp - 0x1d4]
call fcn.004cd770
mov edx, dword [ebp - 0x1d4]
lea eax, [ebp - 0x1d0]
call fcn.00405a8c
call fcn.00403e24
call fcn.004030c0
lea eax, [ebp - 0x1d0]
call fcn.004037f4
call fcn.004030c0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4d3c95
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4d3cc2
lea eax, [ebp - 0x1d8]
mov edx, 2
call fcn.00405300
lea eax, [ebp - 4]
call fcn.004052dc
ret
Function at 0x10002530
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x1032e6c0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
xorps xmm0, xmm0
mov dword [ebp - 8], 0
mov edx, ecx
movq qword [ebp - 0x10], xmm0
push esi
lea ecx, [ebp - 0x10]
xor bl, bl
call fcn.10002410
mov eax, dword [ebp - 0xc]
mov esi, dword [ebp - 0x10]
mov dword [ebp - 0x14], eax
cmp esi, eax
je 0x10002590
push edi
mov edi, dword [sym.imp.USER32.dll_ShowWindow]
push 0
push dword [esi]
call edi
test eax, eax
movzx ebx, bl
mov eax, 1
cmovne ebx, eax
add esi, 4
cmp esi, dword [ebp - 0x14]
jne 0x10002571
mov esi, dword [ebp - 0x10]
pop edi
test esi, esi
je 0x100025c0
mov ecx, dword [ebp - 8]
mov eax, esi
sub ecx, esi
and ecx, 0xfffffffc
cmp ecx, 0x1000
jb 0x100025b6
mov esi, dword [eax - 4]
add ecx, 0x23
sub eax, esi
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x100025d2
push ecx
push esi
call fcn.10264699
add esp, 8
mov ecx, dword [ebp - 4]
mov al, bl
pop esi
xor ecx, ebp
pop ebx
call fcn.1026465b
mov esp, ebp
pop ebp
ret
call fcn.1026cf2e
int3
Function at 0x100029a0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub dword [ebp + 0xc], 1
jne 0x100029be
push 0
push 0
push 0
push 0x10002990
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov eax, 1
pop ebp
ret 0xc
Function at 0x100108b0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov ecx, dword [esp + 8]
push ebx
push esi
mov esi, dword [esp + 0x14]
mov ebx, 0x30
push edi
mov edi, dword [esp + 0x10]
push 0x100
push 0x1b3
push esi
push ecx
call fcn.10264a60
mov ecx, eax
lea edi, [edi + 1]
movzx eax, byte [edi - 1]
mov esi, edx
cdq
xor ecx, eax
xor esi, edx
sub ebx, 1
jne 0x100108c4
pop edi
mov edx, esi
mov eax, ecx
pop esi
pop ebx
ret

Function at 0x10015ee0
Capabilities:
Hash data using djb2

Disassembly:
mov edx, dword [esp + 4]
mov eax, 0x1505
test edx, edx
je 0x10015f08
push ebx
nop
mov bl, byte [edx]
test bl, bl
je 0x10015f07
mov ecx, eax
shl eax, 5
add eax, ecx
movsx ecx, bl
add eax, ecx
add edx, 1
jne 0x10015ef0
pop ebx
ret
Function at 0x100444e0
Capabilities:
Allocate thread local storage
Get thread local storage value
Set thread local storage value

Disassembly:
mov eax, dword [0x10330c10]
test eax, eax
jne 0x10044518
push 0x10330a80
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [0x10330c10], 0
jne 0x10044508
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
mov dword [0x10330c10], eax
push 0x10330a80
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov eax, dword [0x10330c10]
push esi
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov esi, eax
test esi, esi
jne 0x1004457a
push eax
call dword [sym.imp.GDI32.dll_CreateCompatibleDC]
mov esi, eax
test esi, esi
jne 0x10044544
push str._get_global_font_dc
call fcn.1005bc00
add esp, 4
xor eax, eax
pop esi
ret
push 2
push esi
call dword [sym.imp.GDI32.dll_SetGraphicsMode]
test eax, eax
jne 0x10044569
push str._get_global_font_dc
call fcn.1005bc00
add esp, 4
push esi
call dword [sym.imp.GDI32.dll_DeleteDC]
xor eax, eax
pop esi
ret
push esi
push dword [0x10330c10]
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
test eax, eax
je 0x1004455e
mov eax, esi
pop esi
ret

Function at 0x10044580
Capabilities:
Check os version

Disassembly:
sub esp, 0x98
mov eax, dword [0x1032e6c0]
xor eax, esp
mov dword [esp + 0x94], eax
lea eax, [esp]
mov dword [esp], 0x94
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
test eax, eax
jne 0x100445cd
push str._have_cleartype_quality
call fcn.1005bc00
add esp, 4
xor eax, eax
mov ecx, dword [esp + 0x94]
xor ecx, esp
call fcn.1026465b
add esp, 0x98
ret
cmp dword [esp + 4], 5
ja 0x100445dd
jne 0x100445b6
cmp dword [esp + 8], 1
jb 0x100445b6
mov ecx, dword [esp + 0x94]
mov eax, 1
xor ecx, esp
call fcn.1026465b
add esp, 0x98
ret
Function at 0x1005c190
Capabilities:
Check os version

Disassembly:
sub esp, 0x9c
mov eax, dword [0x1032e6c0]
xor eax, esp
mov dword [esp + 0x98], eax
cmp dword [0x1033098c], 0
jne 0x1005c1b2
call fcn.10016540
mov eax, dword [0x10330c1c]
test eax, eax
je 0x1005c1d9
push eax
call fcn.1000b1c0
add esp, 4
mov ecx, dword [esp + 0x98]
xor ecx, esp
call fcn.1026465b
add esp, 0x9c
ret
push esi
push edi
push 0x48
call fcn.1026cf9e
mov esi, eax
push 0x102a7060
push esi
call fcn.10019e10
add esp, 0xc
call fcn.10066dd0
mov dword [esi + 0x40], eax
xor edi, edi
lea eax, [esp + 0xc]
mov dword [esi + 0x3c], 0
push eax
mov dword [esp + 0x10], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
cmp dword [esp + 0x1c], 1
jne 0x1005c22b
cmp dword [esp + 0x10], 4
jne 0x1005c22b
cmp dword [esp + 0x14], 0xa
je 0x1005c24b
push str.msimg32
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov dword [esi + 0x3c], eax
test eax, eax
je 0x1005c24b
push str.AlphaBlend
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edi, eax
mov dword [esi + 0x44], edi
mov edx, 0x10330c1c
xor ecx, ecx
lea eax, [esp + 8]
lock or dword [eax], ecx
cmp dword [0x10330c1c], ecx
jne 0x1005c290
mov ecx, esi
xor eax, eax
lock cmpxchg dword [edx], ecx
test eax, eax
jne 0x1005c253
push esi
call fcn.1000b1c0
add esp, 4
pop edi
pop esi
mov ecx, dword [esp + 0x98]
xor ecx, esp
call fcn.1026465b
add esp, 0x9c
ret
push esi
call fcn.1026cbe4
push dword [0x10330c1c]
call fcn.1000b1c0
mov ecx, dword [esp + 0xa8]
add esp, 8
pop edi
pop esi
xor ecx, esp
call fcn.1026465b
add esp, 0x9c
ret
Function at 0x1006abf0
Capabilities:
Execute anti-debugging instructions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
push ebx
push esi
push edi
push 1
push dword [ebp + 0xc]
call fcn.1006ae60
mov ecx, dword [ebp + 0x10]
push ecx
mov eax, dword [ecx]
mov eax, dword [eax + 8]
call eax
add esp, 0xc
xorps xmm0, xmm0
mov dword [ebp - 4], 1
nop dword [eax + eax]
movsd qword [ebp - 0x20], xmm0
mov dword [ebp - 0x10], 1
call fcn.10278dd2
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], 0
nop dword [eax + eax]
rdtsc
mov dword [ebp - 0x2c], edx
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 4]
test eax, eax
jle 0x1006ac67
mov edi, dword [ebp + 0x10]
mov esi, eax
mov ecx, dword [ebp + 0xc]
push edi
push ecx
mov eax, dword [ecx]
mov eax, dword [eax]
call eax
add esp, 8
sub esi, 1
jne 0x1006ac54
rdtsc
mov dword [ebp - 0x24], edx
mov dword [ebp - 0x28], eax
mov edx, dword [ebp - 0x24]
mov ecx, dword [ebp - 0x28]
call fcn.10265070
mov edx, dword [ebp - 0x2c]
mov ecx, dword [ebp - 0x30]
movsd qword [ebp - 0xc], xmm0
call fcn.10265070
mov esi, dword [ebp + 8]
movsd xmm1, qword [ebp - 0xc]
mov ebx, dword [ebp + 0x10]
subsd xmm1, xmm0
mov eax, dword [esi + 8]
mov dword [ebp - 8], eax
test eax, eax
je 0x1006acbc
push 1
sub esp, 8
movsd qword [esp], xmm1
push ebx
call dword [ebp - 8]
fstp qword [ebp - 0xc]
movsd xmm1, qword [ebp - 0xc]
add esp, 0x10
xorps xmm0, xmm0
comisd xmm0, xmm1
ja 0x1006ac14
cmp dword [ebp - 0x10], 0
jne 0x1006acda
movsd xmm0, qword [ebp - 0x20]
comisd xmm0, xmm1
jbe 0x1006acdf
movsd qword [ebp - 0x20], xmm1
mov dword [ebp - 0x10], 0
call fcn.10278dd2
sub eax, dword [ebp - 0x18]
movd xmm0, eax
mov eax, dword [esi + 8]
mov dword [ebp - 8], eax
cvtdq2pd xmm0, xmm0
divsd xmm0, qword [0x102a82a0]
test eax, eax
je 0x1006ad21
push 1
sub esp, 8
movsd qword [esp], xmm0
push ebx
call dword [ebp - 8]
fstp qword [ebp - 0xc]
movsd xmm0, qword [ebp - 0xc]
add esp, 0x10
comisd xmm0, xmmword [0x102a2930]
ja 0x1006ad3b
mov eax, dword [ebp - 0x14]
inc eax
mov dword [ebp - 0x14], eax
cmp eax, 8
jl 0x1006ac40
movsd xmm0, qword [ebp - 0x20]
comisd xmm0, xmmword [0x102a8e98]
jae 0x1006ad60
mov eax, dword [ebp - 4]
xorps xmm0, xmm0
add eax, eax
mov dword [ebp - 4], eax
jne 0x1006ac20
jmp 0x1006ac14
push 0
push dword [ebp + 0xc]
call fcn.1006ae60
movd xmm0, dword [ebp - 4]
add esp, 8
movsd xmm1, qword [ebp - 0x20]
cvtdq2pd xmm0, xmm0
pop edi
pop esi
pop ebx
divsd xmm1, xmm0
movsd qword [ebp - 0x30], xmm1
fld qword [ebp - 0x30]
mov esp, ebp
pop ebp
ret
Function at 0x101321e0
Capabilities:
Encode data using xor

Disassembly:
mov edx, dword [esp + 4]
xor eax, eax
test edx, edx
je 0x10132201
mov cl, byte [edx]
test cl, cl
je 0x10132201
ror eax, 0x1f
lea edx, [edx + 1]
movzx ecx, cl
xor eax, ecx
mov cl, byte [edx]
test cl, cl
jne 0x101321f0
ret

Function at 0x10132495
Capabilities:
Encode data using xor

Disassembly:
mov ecx, dword [esp + 4]
sub esp, 0x18
mov eax, dword [ecx]
inc eax
push esi
cmp eax, 0xa
ja case.0x10132464.0
jmp dword [eax*4 + 0x10132618]
movsd xmm1, qword [ecx + 8]
xorps xmm0, xmm0
comisd xmm0, xmm1
jbe 0x10132480
xorps xmm1, xmmword [0x102a2950]
movsd xmm0, qword [0x102b1200]
minsd xmm0, xmm1
pop esi
add esp, 0x18
jmp fcn.10264f70
mov edx, dword [ecx + 8]
test dl, 1
je 0x101324a2
and edx, 0xfffffffe
add edx, ecx
xor ecx, ecx
test edx, edx
je 0x101324c1
mov al, byte [edx]
test al, al
je 0x101324c1
nop
ror ecx, 0x1f
lea edx, [edx + 1]
movzx eax, al
xor ecx, eax
mov al, byte [edx]
test al, al
jne 0x101324b0
mov eax, ecx
pop esi
add esp, 0x18
ret
mov eax, dword [ecx + 8]
pop esi
add esp, 0x18
ret
mov eax, dword [ecx + 8]
xorps xmm3, xmm3
movsd xmm2, qword [0x102a2950]
movsd xmm0, qword [eax]
comisd xmm3, xmm0
jbe 0x101324eb
xorps xmm0, xmm2
movsd xmm4, qword [0x102b1200]
movaps xmm1, xmm4
minsd xmm1, xmm0
movsd xmm0, qword [eax + 8]
comisd xmm3, xmm0
movsd qword [esp + 4], xmm1
jbe 0x1013250e
xorps xmm0, xmm2
movaps xmm1, xmm4
minsd xmm1, xmm0
movsd xmm0, qword [eax + 0x10]
comisd xmm3, xmm0
movsd qword [esp + 0xc], xmm1
jbe 0x10132529
xorps xmm0, xmm2
movaps xmm1, xmm4
minsd xmm1, xmm0
movsd qword [esp + 0x14], xmm1
movsd xmm1, qword [eax + 0x18]
comisd xmm3, xmm1
jbe 0x10132544
xorps xmm1, xmm2
minsd xmm4, xmm1
movaps xmm0, xmm4
call fcn.10264f70
movsd xmm0, qword [esp + 0x14]
mov esi, eax
call fcn.10264f70
movsd xmm0, qword [esp + 0xc]
xor esi, eax
call fcn.10264f70
movsd xmm0, qword [esp + 4]
xor esi, eax
call fcn.10264f70
xor eax, esi
pop esi
add esp, 0x18
ret
mov eax, dword [ecx + 8]
test al, 1
je 0x1013258a
and eax, 0xfffffffe
add eax, ecx
mov eax, dword [eax + 4]
pop esi
add esp, 0x18
ret
mov esi, dword [ecx + 8]
xor edx, edx
mov ecx, dword [esi + 0x14]
test ecx, ecx
je 0x101325b5
mov al, byte [ecx]
test al, al
je 0x101325b5
ror edx, 0x1f
lea ecx, [ecx + 1]
movzx eax, al
xor edx, eax
mov al, byte [ecx]
test al, al
jne 0x101325a4
mov esi, dword [esi + 0x18]
xor ecx, ecx
test esi, esi
je 0x101325d5
mov al, byte [esi]
test al, al
je 0x101325d5
ror ecx, 0x1f
lea esi, [esi + 1]
movzx eax, al
xor ecx, eax
mov al, byte [esi]
test al, al
jne 0x101325c4
xor ecx, edx
mov eax, ecx
pop esi
add esp, 0x18
ret
mov eax, dword [ecx + 8]
test al, 1
je 0x101325ea
and eax, 0xfffffffe
add eax, ecx
pop esi
add esp, 0x18
mov dword [esp + 4], eax
jmp sym.Easy.MessageHub.dll_FcLangSetHash
mov eax, dword [ecx + 8]
test al, 1
je 0x10132603
and eax, 0xfffffffe
add eax, ecx
pop esi
add esp, 0x18
mov dword [esp + 4], eax
jmp fcn.10147800
xor eax, eax
pop esi
add esp, 0x18
ret
Function at 0x10132592
Capabilities:
Encode data using xor

Disassembly:
mov ecx, dword [esp + 4]
sub esp, 0x18
mov eax, dword [ecx]
inc eax
push esi
cmp eax, 0xa
ja case.0x10132464.0
jmp dword [eax*4 + 0x10132618]
movsd xmm1, qword [ecx + 8]
xorps xmm0, xmm0
comisd xmm0, xmm1
jbe 0x10132480
xorps xmm1, xmmword [0x102a2950]
movsd xmm0, qword [0x102b1200]
minsd xmm0, xmm1
pop esi
add esp, 0x18
jmp fcn.10264f70
mov edx, dword [ecx + 8]
test dl, 1
je 0x101324a2
and edx, 0xfffffffe
add edx, ecx
xor ecx, ecx
test edx, edx
je 0x101324c1
mov al, byte [edx]
test al, al
je 0x101324c1
nop
ror ecx, 0x1f
lea edx, [edx + 1]
movzx eax, al
xor ecx, eax
mov al, byte [edx]
test al, al
jne 0x101324b0
mov eax, ecx
pop esi
add esp, 0x18
ret
mov eax, dword [ecx + 8]
pop esi
add esp, 0x18
ret
mov eax, dword [ecx + 8]
xorps xmm3, xmm3
movsd xmm2, qword [0x102a2950]
movsd xmm0, qword [eax]
comisd xmm3, xmm0
jbe 0x101324eb
xorps xmm0, xmm2
movsd xmm4, qword [0x102b1200]
movaps xmm1, xmm4
minsd xmm1, xmm0
movsd xmm0, qword [eax + 8]
comisd xmm3, xmm0
movsd qword [esp + 4], xmm1
jbe 0x1013250e
xorps xmm0, xmm2
movaps xmm1, xmm4
minsd xmm1, xmm0
movsd xmm0, qword [eax + 0x10]
comisd xmm3, xmm0
movsd qword [esp + 0xc], xmm1
jbe 0x10132529
xorps xmm0, xmm2
movaps xmm1, xmm4
minsd xmm1, xmm0
movsd qword [esp + 0x14], xmm1
movsd xmm1, qword [eax + 0x18]
comisd xmm3, xmm1
jbe 0x10132544
xorps xmm1, xmm2
minsd xmm4, xmm1
movaps xmm0, xmm4
call fcn.10264f70
movsd xmm0, qword [esp + 0x14]
mov esi, eax
call fcn.10264f70
movsd xmm0, qword [esp + 0xc]
xor esi, eax
call fcn.10264f70
movsd xmm0, qword [esp + 4]
xor esi, eax
call fcn.10264f70
xor eax, esi
pop esi
add esp, 0x18
ret
mov eax, dword [ecx + 8]
test al, 1
je 0x1013258a
and eax, 0xfffffffe
add eax, ecx
mov eax, dword [eax + 4]
pop esi
add esp, 0x18
ret
mov esi, dword [ecx + 8]
xor edx, edx
mov ecx, dword [esi + 0x14]
test ecx, ecx
je 0x101325b5
mov al, byte [ecx]
test al, al
je 0x101325b5
ror edx, 0x1f
lea ecx, [ecx + 1]
movzx eax, al
xor edx, eax
mov al, byte [ecx]
test al, al
jne 0x101325a4
mov esi, dword [esi + 0x18]
xor ecx, ecx
test esi, esi
je 0x101325d5
mov al, byte [esi]
test al, al
je 0x101325d5
ror ecx, 0x1f
lea esi, [esi + 1]
movzx eax, al
xor ecx, eax
mov al, byte [esi]
test al, al
jne 0x101325c4
xor ecx, edx
mov eax, ecx
pop esi
add esp, 0x18
ret
mov eax, dword [ecx + 8]
test al, 1
je 0x101325ea
and eax, 0xfffffffe
add eax, ecx
pop esi
add esp, 0x18
mov dword [esp + 4], eax
jmp sym.Easy.MessageHub.dll_FcLangSetHash
mov eax, dword [ecx + 8]
test al, 1
je 0x10132603
and eax, 0xfffffffe
add eax, ecx
pop esi
add esp, 0x18
mov dword [esp + 4], eax
jmp fcn.10147800
xor eax, eax
pop esi
add esp, 0x18
ret
Function at 0x101397b0
Capabilities:
Hash data using djb2

Disassembly:
mov ecx, dword [esp + 4]
mov eax, 0x1505
push edi
lea edx, [ecx + 0x2c]
lea edi, [ecx + 0x234]
cmp edx, edi
je 0x101397e0
push esi
movzx esi, word [edx]
add edx, 2
test esi, esi
je 0x101397df
mov ecx, eax
shl eax, 5
add eax, esi
add eax, ecx
cmp edx, edi
jne 0x101397c8
pop esi
and eax, 0x7fffffff
pop edi
ret
Function at 0x1013d8a0
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, dword [esp + 8]
xor eax, eax
mov edx, dword [esi + 4]
cmp edx, 8
jb 0x1013d8b4
lea edx, [eax + 8]
jmp 0x1013d8b8
test edx, edx
jle 0x1013d8ca
lea ecx, [esi + 8]
nop dword [eax + eax]
xor eax, dword [ecx]
lea ecx, [ecx + 4]
sub edx, 1
jne 0x1013d8c0
mov ecx, dword [esi]
pop esi
test ecx, ecx
je 0x1013d8d4
xor eax, dword [ecx + 4]
ret

Function at 0x101415e0
Capabilities:
Create directory

Disassembly:
push ecx
push esi
mov esi, dword [esp + 0xc]
mov ecx, esi
push edi
lea edx, [ecx + 1]
nop dword [eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x101415f0
sub ecx, edx
je 0x10141678
push esi
call sym.Easy.MessageHub.dll_FcStrDirname
mov edi, eax
add esp, 4
test edi, edi
je 0x10141678
push 0
push edi
call fcn.10246bb0
add esp, 8
test eax, eax
je 0x10141636
push 0
push edi
call fcn.10246bb0
add esp, 8
cmp eax, 0xffffffff
jne 0x10141667
push edi
call fcn.101415e0
add esp, 4
test eax, eax
je 0x10141667
push esi
call fcn.1027a341
add esp, 4
test eax, eax
jne 0x10141667
push 0x1ed
push esi
call fcn.102803bc
add esp, 8
test eax, eax
jne 0x10141667
push edi
lea esi, [eax + 1]
call sym.Easy.MessageHub.dll_FcStrFree
add esp, 4
mov eax, esi
pop edi
pop esi
pop ecx
ret
push edi
xor esi, esi
call sym.Easy.MessageHub.dll_FcStrFree
add esp, 4
mov eax, esi
pop edi
pop esi
pop ecx
ret
pop edi
xor eax, eax
pop esi
pop ecx
ret
Function at 0x10148b20
Capabilities:
Create directory

Disassembly:
sub esp, 0x3c
mov eax, dword [0x1032e6c0]
xor eax, esp
mov dword [esp + 0x38], eax
push esi
mov esi, dword [esp + 0x44]
push dword [esi + 8]
call fcn.1027a341
add esp, 4
test eax, eax
jns 0x10148ba5
lea eax, [esp + 0xc]
push eax
push dword [esi + 8]
call fcn.101478c0
add esp, 8
test eax, eax
js 0x10148b93
push 0
call fcn.10278b55
sub eax, dword [esp + 0x30]
add esp, 4
cmp eax, 0x258
jle 0x10148b93
push dword [esi + 8]
call fcn.102818b4
add esp, 4
test eax, eax
jne 0x10148b93
push esi
call sym.Easy.MessageHub.dll_FcAtomicLock
add esp, 4
pop esi
mov ecx, dword [esp + 0x38]
xor ecx, esp
call fcn.1026465b
add esp, 0x3c
ret
xor eax, eax
pop esi
mov ecx, dword [esp + 0x38]
xor ecx, esp
call fcn.1026465b
add esp, 0x3c
ret
push dword [esi + 4]
call fcn.1027a692
mov ecx, dword [esp + 0x40]
add esp, 4
mov eax, 1
pop esi
xor ecx, esp
call fcn.1026465b
add esp, 0x3c
ret

Function at 0x10148bd0
Capabilities:
Move file

Disassembly:
push esi
mov esi, dword [esp + 8]
push dword [esi]
call fcn.1027a692
push dword [esi]
push dword [esi + 4]
call fcn.1027a59c
xor ecx, ecx
add esp, 0xc
test eax, eax
setns cl
mov eax, ecx
pop esi
ret