joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4d5fcb
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
je 0x4d6068
push ebx
push esi
call fcn.004d5f94
xor ebx, ebx
sub eax, esi
push ebx
push ebx
push ebx
push ebx
sar eax, 1
push eax
push esi
push ebx
push ebx
mov dword [ebp - 8], eax
call fcn.004d4f81
add esp, 0x24
mov dword [ebp - 4], eax
test eax, eax
jne 0x4d6015
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x4d6067
push edi
push eax
call fcn.004cfe88
mov edi, eax
pop ecx
push ebx
test edi, edi
jne 0x4d6035
call fcn.004cf2f6
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x4d6066
push ebx
push dword [ebp - 4]
push edi
push dword [ebp - 8]
push esi
push ebx
push ebx
call fcn.004d4f81
add esp, 0x20
test eax, eax
jne 0x4d6054
push edi
call fcn.004cf2f6
jmp 0x4d605c
push ebx
call fcn.004cf2f6
mov ebx, edi
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, ebx
pop edi
pop ebx
pop esi
leave
ret

Function at 0x4d606b
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
jne 0x4d607c
pop esi
ret
push ebx
push edi
push esi
call fcn.004d5f94
mov ebx, eax
sub ebx, esi
and ebx, 0xfffffffe
push ebx
call fcn.004cfe88
mov edi, eax
pop ecx
pop ecx
test edi, edi
je 0x4d60a4
push ebx
push esi
push edi
call fcn.004b6e00
add esp, 0xc
push 0
call fcn.004cf2f6
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, edi
pop edi
pop ebx
pop esi
ret

Function at 0x4d67fe
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.004d6319

Function at 0x4d89e9
Capabilities:
Get geographical location

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push esi
push edi
call fcn.004d1261
mov esi, dword [ebp + 8]
mov edi, eax
push 2
lea eax, [ebp - 4]
mov ecx, esi
push eax
and ecx, 0x3ff
push 0x20000001
or ecx, 0x400
push ecx
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x4d8a58
cmp esi, dword [ebp - 4]
je 0x4d8a53
cmp dword [ebp + 0xc], 0
je 0x4d8a53
mov esi, dword [edi + 0x50]
lea ecx, [esi + 2]
mov ax, word [esi]
add esi, 2
test ax, ax
jne 0x4d8a30
push dword [edi + 0x50]
sub esi, ecx
sar esi, 1
call fcn.004d853b
pop ecx
xor ecx, ecx
cmp eax, esi
setne cl
mov eax, ecx
jmp 0x4d8a5a
xor eax, eax
inc eax
jmp 0x4d8a5a
xor eax, eax
pop edi
pop esi
leave
ret
Function at 0x4d8abf
Capabilities:
Get geographical location

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [0x535100]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push ebx
mov ebx, dword [ebp + 0x10]
push esi
mov esi, dword [ebp + 8]
push edi
mov dword [ebp - 0x18], eax
call fcn.004d1261
add eax, 0x50
lea edi, [ebp - 0x10]
mov dword [ebp - 0x14], eax
xor eax, eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
call fcn.004d1261
lea ecx, [ebp - 0x10]
xor edx, edx
mov dword [eax + 0x34c], ecx
lea ecx, [esi + 0x80]
mov eax, dword [ebp - 0x14]
mov dword [eax], esi
lea edi, [eax + 4]
mov dword [edi], ecx
test ecx, ecx
je 0x4d8b36
cmp word [ecx], dx
je 0x4d8b36
mov eax, dword [0x51fc64]
push edi
dec eax
push eax
push 0x51fb50
call fcn.004d8a5e
mov eax, dword [ebp - 0x14]
add esp, 0xc
xor edx, edx
mov dword [ebp - 0x10], edx
mov eax, dword [eax]
test eax, eax
je 0x4d8ba9
cmp word [eax], dx
je 0x4d8ba9
mov eax, dword [edi]
test eax, eax
je 0x4d8b5a
cmp word [eax], dx
je 0x4d8b5a
lea eax, [ebp - 0x10]
push eax
call fcn.004d8441
jmp 0x4d8b63
lea eax, [ebp - 0x10]
push eax
call fcn.004d84dc
cmp dword [ebp - 0x10], 0
pop ecx
jne 0x4d8bd3
mov eax, dword [0x51fb4c]
push dword [ebp - 0x14]
dec eax
push eax
push 0x51f840
call fcn.004d8a5e
add esp, 0xc
test al, al
je 0x4d8bd3
mov eax, dword [edi]
xor edi, edi
test eax, eax
je 0x4d8b9e
cmp word [eax], di
je 0x4d8b9e
lea eax, [ebp - 0x10]
push eax
call fcn.004d8441
pop ecx
jmp 0x4d8bd5
lea eax, [ebp - 0x10]
push eax
call fcn.004d84dc
jmp 0x4d8b9b
mov eax, dword [edi]
test eax, eax
je 0x4d8bc0
cmp word [eax], dx
je 0x4d8bc0
lea eax, [ebp - 0x10]
push eax
call fcn.004d83f6
pop ecx
jmp 0x4d8bd3
mov dword [ebp - 0x10], 0x104
call dword [sym.imp.KERNEL32.dll_GetUserDefaultLCID]
mov dword [ebp - 8], eax
mov dword [ebp - 0xc], eax
xor edi, edi
cmp dword [ebp - 0x10], 0
je 0x4d8c9e
lea eax, [ebp - 0x10]
push eax
lea eax, [esi + 0x100]
neg esi
sbb esi, esi
and esi, eax
push esi
call fcn.004d88e3
mov esi, eax
pop ecx
pop ecx
test esi, esi
je 0x4d8c9e
movzx ecx, si
push ecx
call dword [sym.imp.KERNEL32.dll_IsValidCodePage]
test eax, eax
je 0x4d8c9e
push 1
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_IsValidLocale]
test eax, eax
je 0x4d8c9e
mov eax, dword [ebp - 0x18]
test eax, eax
je 0x4d8c2b
mov dword [eax], esi
mov eax, dword [ebp - 0x14]
push edi
push 0x55
add eax, 0x250
push eax
push dword [ebp - 0xc]
call fcn.004cf9e9
test ebx, ebx
je 0x4d8c99
push edi
push 0x55
lea eax, [ebx + 0x120]
push eax
push dword [ebp - 0xc]
call fcn.004cf9e9
push 0x40
push ebx
push 0x1001
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x4d8c9e
push 0x40
lea eax, [ebx + 0x80]
push eax
push 0x1002
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x4d8c9e
push 0xa
push 0x10
lea ecx, [ebx + 0x100]
push ecx
push esi
call fcn.004db5cb
add esp, 0x10
xor eax, eax
inc eax
jmp 0x4d8ca0
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004b4e90
leave
ret
Function at 0x4d8ff0
Capabilities:
Clear file content

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x2c
push ebx
mov ebx, dword [ebp + 8]
lea ecx, [ebp - 0x2c]
push esi
push edi
push dword [ebp + 0x10]
mov edi, dword [ebp + 0x14]
push dword [ebp + 0xc]
push ebx
call fcn.004d8f6c
mov eax, dword [ebp - 0x2c]
and eax, dword [ebp - 0x28]
cmp eax, 0xffffffff
je 0x4d915f
mov eax, dword [ebp - 0x24]
and eax, dword [ebp - 0x20]
cmp eax, 0xffffffff
je 0x4d915f
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 8], ecx
mov dword [ebp - 4], eax
test ecx, ecx
jl 0x4d9114
jg 0x4d904c
test eax, eax
je 0x4d910a
push 1
push 0x1000
call fcn.004cf299
mov esi, eax
pop ecx
pop ecx
test esi, esi
jne 0x4d906f
push 0xc
pop ebx
mov byte [edi + 0x1c], 1
mov dword [edi + 0x18], ebx
jmp 0x4d9101
push 0x8000
push ebx
call fcn.004c9af1
pop ecx
pop ecx
mov ecx, dword [ebp - 0x1c]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0x18]
test eax, eax
jl 0x4d9098
jg 0x4d9093
cmp ecx, 0x1000
jb 0x4d9098
mov ecx, 0x1000
push edi
push ecx
push esi
push ebx
call fcn.004ccf20
add esp, 0x10
cmp eax, 0xffffffff
je 0x4d90dd
mov ecx, dword [ebp - 4]
cdq
sub ecx, eax
mov eax, dword [ebp - 8]
mov dword [ebp - 4], ecx
sbb eax, edx
mov dword [ebp - 8], eax
test eax, eax
jg 0x4d9093
jl 0x4d90c4
test ecx, ecx
jne 0x4d9085
push dword [ebp - 0xc]
push ebx
call fcn.004c9af1
push esi
call fcn.004cf2f6
add esp, 0xc
xor ebx, ebx
jmp 0x4d916d
cmp byte [edi + 0x24], 0
je 0x4d90f4
cmp dword [edi + 0x20], 5
jne 0x4d90f4
mov byte [edi + 0x1c], 1
mov dword [edi + 0x18], 0xd
cmp byte [edi + 0x1c], 0
je 0x4d90ff
mov ebx, dword [edi + 0x18]
jmp 0x4d9101
xor ebx, ebx
push esi
call fcn.004cf2f6
pop ecx
jmp 0x4d916d
test ecx, ecx
jg 0x4d90d6
jl 0x4d9114
test eax, eax
jae 0x4d90d6
push 0
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push ebx
call fcn.004c77f3
and eax, edx
add esp, 0x10
cmp eax, 0xffffffff
jne 0x4d9134
cmp byte [edi + 0x1c], 0
je 0x4d90d6
jmp 0x4d9165
push ebx
call fcn.004d2b91
pop ecx
push eax
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
test eax, eax
jne 0x4d90d6
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 0xd
mov byte [edi + 0x24], 1
mov dword [edi + 0x20], eax
pop ebx
mov byte [edi + 0x1c], 1
mov dword [edi + 0x18], ebx
jmp 0x4d916d
cmp byte [edi + 0x1c], 0
je 0x4d916a
mov ebx, dword [edi + 0x18]
jmp 0x4d916d
push 0x16
pop ebx
push 0
push dword [ebp - 0x28]
push dword [ebp - 0x2c]
push dword [ebp - 0x14]
call fcn.004c77f3
add esp, 0x10
mov eax, ebx
pop edi
pop esi
pop ebx
leave
ret
Function at 0x4ddbfc
Capabilities:
Get disk information

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [0x535100]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
cmp eax, 0x1a
jbe 0x4ddc3f
call fcn.004bf06b
mov dword [eax], 0xf
call fcn.004bf07e
mov dword [eax], 0xd
call fcn.004bd190
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004b4e90
leave
ret
test eax, eax
jne 0x4ddc46
inc eax
jmp 0x4ddc33
add eax, 0x40
push 0x3a
mov word [ebp - 0xc], ax
pop eax
mov word [ebp - 0xa], ax
push 0x5c
pop eax
mov word [ebp - 8], ax
xor eax, eax
mov word [ebp - 6], ax
lea eax, [ebp - 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
mov ecx, eax
test ecx, ecx
je 0x4ddc31
xor eax, eax
cmp ecx, 1
setne al
jmp 0x4ddc33

Function at 0x4df3c0
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x4df3ed
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x4df3ed
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret
Function at 0x10036500
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x10122c00]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, ecx
cmp dword [esi + 0x38], 0
je 0x100365bc
cmp byte [esi + 0x3d], 0
je 0x100365bc
mov eax, dword [esi]
push edi
push 0xffffffffffffffff
call dword [eax + 0xc]
cmp eax, 0xffffffff
je 0x100365aa
mov ecx, dword [esi + 0x38]
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [esi + 0x40]
push eax
call dword [sym.imp.MSVCP140.dll_public:_int___thiscall_std::codecvt_char__char__struct__Mbstatet_::unshift_struct__Mbstatet___char___char___char___const]
sub eax, 0
je 0x10036571
sub eax, 1
je 0x10036575
sub eax, 2
jne 0x100365aa
mov byte [esi + 0x3d], al
mov al, 1
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100ba90e
mov esp, ebp
pop ebp
ret
mov byte [esi + 0x3d], 0
mov edi, dword [ebp - 0x28]
lea eax, [ebp - 0x24]
sub edi, eax
je 0x10036593
push dword [esi + 0x4c]
push edi
push 1
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
add esp, 0x10
cmp edi, eax
jne 0x100365aa
cmp byte [esi + 0x3d], 0
pop edi
sete al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100ba90e
mov esp, ebp
pop ebp
ret
pop edi
xor al, al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100ba90e
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
mov al, 1
xor ecx, ebp
pop esi
call fcn.100ba90e
mov esp, ebp
pop ebp
ret
Function at 0x10036fd0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 0xc]
push ebx
mov ebx, ecx
mov ecx, dword [ebp + 0x10]
push esi
mov esi, dword [ebp + 8]
mov dword [ebp - 4], esi
test ecx, ecx
jg 0x10036ffa
jl 0x10036fee
test eax, eax
jne 0x10036ffa
pop esi
xor eax, eax
xor edx, edx
pop ebx
mov esp, ebp
pop ebp
ret 0xc
cmp dword [ebx + 0x38], 0
je 0x10037013
push ecx
push eax
push esi
mov ecx, ebx
call dword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____thiscall_std::basic_streambuf_char__struct_std::char_traits_char__::xsgetn_char___long_long___int64__]
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
push edi
mov ecx, ebx
mov edi, eax
call dword [sym.imp.MSVCP140.dll_protected:_long_long___int64____thiscall_std::basic_streambuf_char__struct_std::char_traits_char__::_Gnavail_void_const]
mov ecx, eax
test ecx, ecx
je 0x10037058
mov esi, dword [ebp + 0xc]
cmp ecx, esi
cmovb esi, ecx
mov ecx, ebx
call dword [sym.imp.MSVCP140.dll_protected:_char____thiscall_std::basic_streambuf_char__struct_std::char_traits_char__::gptr_void_const]
mov edi, dword [ebp - 4]
push esi
push eax
push edi
call sub.VCRUNTIME140.dll_memcpy
add edi, esi
add esp, 0xc
mov dword [ebp - 4], edi
mov ecx, ebx
mov edi, dword [ebp + 0xc]
sub edi, esi
push esi
call dword [sym.imp.MSVCP140.dll_protected:_void___thiscall_std::basic_streambuf_char__struct_std::char_traits_char__::gbump_int_]
mov esi, dword [ebp - 4]
cmp dword [ebx + 0x4c], 0
je 0x100370c8
mov ecx, ebx
call dword [sym.imp.MSVCP140.dll_protected:_char____thiscall_std::basic_streambuf_char__struct_std::char_traits_char__::eback_void_const]
lea ecx, [ebx + 0x3c]
cmp eax, ecx
jne 0x1003707d
push dword [ebx + 0x54]
mov eax, dword [ebx + 0x50]
mov ecx, ebx
push eax
push eax
call dword [sym.imp.MSVCP140.dll_protected:_void___thiscall_std::basic_streambuf_char__struct_std::char_traits_char__::setg_char___char___char__]
mov eax, dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
mov ecx, edi
cmp edi, 0xfff
jbe 0x100370b6
nop dword [eax]
push dword [ebx + 0x4c]
push 0xfff
push 1
push esi
call eax
sub edi, eax
add esp, 0x10
add esi, eax
mov ecx, edi
cmp eax, 0xfff
jne 0x100370c8
cmp edi, eax
mov eax, dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
ja 0x10037090
test ecx, ecx
je 0x100370c8
push dword [ebx + 0x4c]
push edi
push 1
push esi
call eax
add esp, 0x10
sub edi, eax
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 0x10]
sub eax, edi
pop edi
pop esi
sbb edx, 0
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x100370e0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
mov ebx, ecx
cmp dword [ebx + 0x38], 0
je 0x10037105
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____thiscall_std::basic_streambuf_char__struct_std::char_traits_char__::xsputn_char_const___long_long___int64__]
pop ebx
mov esp, ebp
pop ebp
ret 0xc
push esi
mov esi, dword [ebp + 0xc]
push edi
mov edi, dword [ebp + 0x10]
mov dword [ebp - 8], esi
mov dword [ebp - 0xc], edi
call dword [sym.imp.MSVCP140.dll_protected:_long_long___int64____thiscall_std::basic_streambuf_char__struct_std::char_traits_char__::_Pnavail_void_const]
mov dword [ebp + 0x10], eax
mov ecx, edx
mov dword [ebp - 4], ecx
test edi, edi
jl 0x10037170
jg 0x1003712b
test esi, esi
je 0x10037170
test ecx, ecx
jl 0x100371aa
jg 0x10037135
test eax, eax
je 0x100371aa
cmp edi, ecx
jg 0x10037145
jl 0x1003713f
cmp esi, eax
jae 0x10037145
mov dword [ebp + 0x10], esi
mov dword [ebp - 4], edi
mov ecx, ebx
call dword [sym.imp.MSVCP140.dll_protected:_char____thiscall_std::basic_streambuf_char__struct_std::char_traits_char__::pptr_void_const]
push dword [ebp + 0x10]
push dword [ebp + 8]
push eax
call sub.VCRUNTIME140.dll_memcpy
mov ecx, dword [ebp + 0x10]
add esp, 0xc
add dword [ebp + 8], ecx
sub esi, ecx
sbb edi, dword [ebp - 4]
push ecx
mov ecx, ebx
call dword [sym.imp.MSVCP140.dll_protected:_void___thiscall_std::basic_streambuf_char__struct_std::char_traits_char__::pbump_int_]
mov eax, dword [ebp + 8]
test edi, edi
jl 0x10037197
jg 0x1003717d
test esi, esi
je 0x10037197
mov ecx, dword [ebx + 0x4c]
test ecx, ecx
je 0x10037197
push ecx
push esi
push 1
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
add esp, 0x10
sub esi, eax
sbb edi, 0
mov eax, dword [ebp - 8]
mov edx, dword [ebp - 0xc]
sub eax, esi
sbb edx, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov eax, dword [ebp + 8]
jmp 0x1003717d
Function at 0x100373b0
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, dword [ebp + 0xc]
push edi
mov eax, dword [ebx]
mov edi, dword [ebp + 0x10]
cmp edi, 7
ja case.default.0x100373c6
jmp dword [edi*4 + 0x1003755c]
mov ecx, esi
and ecx, 3
sub edi, ecx
sub ecx, 1
je 0x10037409
sub ecx, 1
je 0x100373f6
sub ecx, 1
jne 0x1003741c
movzx edx, byte [esi]
movzx ecx, al
xor edx, ecx
shr eax, 8
xor eax, dword [edx*4 + 0x100c9240]
inc esi
movzx edx, byte [esi]
movzx ecx, al
xor edx, ecx
shr eax, 8
xor eax, dword [edx*4 + 0x100c9240]
inc esi
movzx edx, byte [esi]
movzx ecx, al
xor edx, ecx
shr eax, 8
xor eax, dword [edx*4 + 0x100c9240]
inc esi
mov edx, edi
sar edx, 3
test edx, edx
je 0x1003749e
xor eax, dword [esi]
movzx ecx, al
shr eax, 8
xor eax, dword [ecx*4 + 0x100c9240]
movzx ecx, al
shr eax, 8
xor eax, dword [ecx*4 + 0x100c9240]
movzx ecx, al
shr eax, 8
xor eax, dword [ecx*4 + 0x100c9240]
mov ecx, eax
movzx eax, cl
shr ecx, 8
mov eax, dword [eax*4 + 0x100c9240]
xor eax, dword [esi + 4]
add esi, 8
xor eax, ecx
movzx ecx, al
shr eax, 8
xor eax, dword [ecx*4 + 0x100c9240]
movzx ecx, al
shr eax, 8
xor eax, dword [ecx*4 + 0x100c9240]
movzx ecx, al
shr eax, 8
xor eax, dword [ecx*4 + 0x100c9240]
movzx ecx, al
shr eax, 8
xor eax, dword [ecx*4 + 0x100c9240]
sub edx, 1
jne 0x10037425
and edi, 7
jmp 0x100373c1
movzx edx, byte [esi]
movzx ecx, al
xor edx, ecx
shr eax, 8
xor eax, dword [edx*4 + 0x100c9240]
inc esi
movzx edx, byte [esi]
movzx ecx, al
xor edx, ecx
shr eax, 8
xor eax, dword [edx*4 + 0x100c9240]
inc esi
movzx edx, byte [esi]
movzx ecx, al
xor edx, ecx
shr eax, 8
xor eax, dword [edx*4 + 0x100c9240]
inc esi
xor eax, dword [esi]
movzx ecx, al
shr eax, 8
pop edi
pop esi
xor eax, dword [ecx*4 + 0x100c9240]
movzx ecx, al
shr eax, 8
xor eax, dword [ecx*4 + 0x100c9240]
movzx ecx, al
shr eax, 8
xor eax, dword [ecx*4 + 0x100c9240]
movzx ecx, al
shr eax, 8
xor eax, dword [ecx*4 + 0x100c9240]
mov dword [ebx], eax
pop ebx
pop ebp
ret
movzx edx, byte [esi]
movzx ecx, al
xor edx, ecx
shr eax, 8
xor eax, dword [edx*4 + 0x100c9240]
inc esi
movzx edx, byte [esi]
movzx ecx, al
xor edx, ecx
shr eax, 8
xor eax, dword [edx*4 + 0x100c9240]
inc esi
movzx edx, byte [esi]
movzx ecx, al
xor edx, ecx
shr eax, 8
xor eax, dword [edx*4 + 0x100c9240]
pop edi
pop esi
mov dword [ebx], eax
pop ebx
pop ebp
ret
Function at 0x100374df
Capabilities:
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, dword [ebp + 0xc]
push edi
mov eax, dword [ebx]
mov edi, dword [ebp + 0x10]
cmp edi, 7
ja case.default.0x100373c6
jmp dword [edi*4 + 0x1003755c]
mov ecx, esi
and ecx, 3
sub edi, ecx
sub ecx, 1
je 0x10037409
sub ecx, 1
je 0x100373f6
sub ecx, 1
jne 0x1003741c
movzx edx, byte [esi]
movzx ecx, al
xor edx, ecx
shr eax, 8
xor eax, dword [edx*4 + 0x100c9240]
inc esi
movzx edx, byte [esi]
movzx ecx, al
xor edx, ecx
shr eax, 8
xor eax, dword [edx*4 + 0x100c9240]
inc esi
movzx edx, byte [esi]
movzx ecx, al
xor edx, ecx
shr eax, 8
xor eax, dword [edx*4 + 0x100c9240]
inc esi
mov edx, edi
sar edx, 3
test edx, edx
je 0x1003749e
xor eax, dword [esi]
movzx ecx, al
shr eax, 8
xor eax, dword [ecx*4 + 0x100c9240]
movzx ecx, al
shr eax, 8
xor eax, dword [ecx*4 + 0x100c9240]
movzx ecx, al
shr eax, 8
xor eax, dword [ecx*4 + 0x100c9240]
mov ecx, eax
movzx eax, cl
shr ecx, 8
mov eax, dword [eax*4 + 0x100c9240]
xor eax, dword [esi + 4]
add esi, 8
xor eax, ecx
movzx ecx, al
shr eax, 8
xor eax, dword [ecx*4 + 0x100c9240]
movzx ecx, al
shr eax, 8
xor eax, dword [ecx*4 + 0x100c9240]
movzx ecx, al
shr eax, 8
xor eax, dword [ecx*4 + 0x100c9240]
movzx ecx, al
shr eax, 8
xor eax, dword [ecx*4 + 0x100c9240]
sub edx, 1
jne 0x10037425
and edi, 7
jmp 0x100373c1
movzx edx, byte [esi]
movzx ecx, al
xor edx, ecx
shr eax, 8
xor eax, dword [edx*4 + 0x100c9240]
inc esi
movzx edx, byte [esi]
movzx ecx, al
xor edx, ecx
shr eax, 8
xor eax, dword [edx*4 + 0x100c9240]
inc esi
movzx edx, byte [esi]
movzx ecx, al
xor edx, ecx
shr eax, 8
xor eax, dword [edx*4 + 0x100c9240]
inc esi
xor eax, dword [esi]
movzx ecx, al
shr eax, 8
pop edi
pop esi
xor eax, dword [ecx*4 + 0x100c9240]
movzx ecx, al
shr eax, 8
xor eax, dword [ecx*4 + 0x100c9240]
movzx ecx, al
shr eax, 8
xor eax, dword [ecx*4 + 0x100c9240]
movzx ecx, al
shr eax, 8
xor eax, dword [ecx*4 + 0x100c9240]
mov dword [ebx], eax
pop ebx
pop ebp
ret
movzx edx, byte [esi]
movzx ecx, al
xor edx, ecx
shr eax, 8
xor eax, dword [edx*4 + 0x100c9240]
inc esi
movzx edx, byte [esi]
movzx ecx, al
xor edx, ecx
shr eax, 8
xor eax, dword [edx*4 + 0x100c9240]
inc esi
movzx edx, byte [esi]
movzx ecx, al
xor edx, ecx
shr eax, 8
xor eax, dword [edx*4 + 0x100c9240]
pop edi
pop esi
mov dword [ebx], eax
pop ebx
pop ebp
ret
Function at 0x100393d0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
cmp byte [0x10121078], 0
push ebx
push esi
push edi
je 0x10039588
mov ecx, dword [0x1012b17c]
mov eax, dword [ecx]
mov eax, dword [eax + 0x68]
call eax
test al, al
je 0x10039588
mov esi, dword [0x1012b200]
xor ebx, ebx
mov dword [ebp - 4], esi
mov eax, dword [esi + 0x28]
mov dword [ebp - 8], eax
test eax, eax
je 0x10039588
mov eax, dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__wassert]
cmp ebx, dword [esi + 0x28]
jl 0x10039437
push 0x410
push str.C:Users_vancuDownloads_bighake_main_bighake_mainutlvector.h
push str.i___m_Size
call eax
mov eax, dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__wassert]
add esp, 0xc
cmp dword [esi + 0x24], 0xfffffffe
jne 0x10039451
push 0x272
push str.C:Users_vancuDownloads_bighake_main_bighake_mainutlvector.h
push str._IsReadOnly__
call eax
add esp, 0xc
mov eax, dword [esi + 0x1c]
mov ecx, dword [eax + ebx*4]
mov eax, dword [ecx]
mov eax, dword [eax + 0x30]
call eax
mov esi, eax
mov edi, 0x811c9dc5
xor ecx, ecx
inc ecx
cmp byte [esi + ecx], 0
jne 0x10039467
xor edx, edx
test ecx, ecx
je 0x1003948d
movsx eax, byte [esi + edx]
inc edx
xor eax, edi
imul edi, eax, 0x1000193
cmp edx, ecx
jb 0x10039474
cmp edi, 0x5ff56dc5
je 0x1003949f
inc ebx
cmp ebx, dword [ebp - 8]
jae 0x10039588
mov esi, dword [ebp - 4]
jmp 0x10039414
mov edi, dword [ebp - 4]
mov esi, dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__wassert]
cmp ebx, dword [edi + 0x28]
jl 0x100394c1
push 0x410
push str.C:Users_vancuDownloads_bighake_main_bighake_mainutlvector.h
push str.i___m_Size
call esi
add esp, 0xc
cmp dword [edi + 0x24], 0xfffffffe
jne 0x100394db
push 0x272
push str.C:Users_vancuDownloads_bighake_main_bighake_mainutlvector.h
push str._IsReadOnly__
call esi
add esp, 0xc
mov eax, dword [edi + 0x1c]
mov edi, dword [eax + ebx*4]
test edi, edi
je 0x10039588
mov eax, dword [edi + 0x88]
mov dword [ebp - 8], eax
test eax, eax
je 0x10039588
xor esi, esi
test eax, eax
jle 0x10039588
xor edx, edx
mov dword [ebp - 4], edx
nop dword [eax]
mov ebx, dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__wassert]
cmp esi, dword [edi + 0x88]
jl 0x10039535
push 0x410
push str.C:Users_vancuDownloads_bighake_main_bighake_mainutlvector.h
push str.i___m_Size
call ebx
mov edx, dword [ebp - 4]
add esp, 0xc
cmp dword [edi + 0x84], 0xfffffffe
jne 0x10039555
push 0x272
push str.C:Users_vancuDownloads_bighake_main_bighake_mainutlvector.h
push str._IsReadOnly__
call ebx
mov edx, dword [ebp - 4]
add esp, 0xc
mov ecx, dword [edi + 0x7c]
movss xmm0, dword [ecx + edx + 0x418]
ucomiss xmm0, dword [0x100c972c]
lahf
test ah, 0x44
jp 0x10039579
mov dword [ecx + edx + 0x418], 0x7f7fffff
inc esi
add edx, 0x420
mov dword [ebp - 4], edx
cmp esi, dword [ebp - 8]
jl 0x10039510
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret