joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4023c0
Capabilities:
Write file on windows

Disassembly:
push 0xffffffffffffffff
push 0x402868
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push esi
mov eax, dword [esp + 0x18]
push 0
push 0
push 2
push 0
push 0
push 0x40000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
test esi, esi
je 0x402439
mov edx, dword [esp + 0x20]
mov eax, dword [esp + 0x1c]
lea ecx, [esp + 4]
push 0
push ecx
push edx
push eax
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea ecx, [esp + 0x18]
mov dword [esp + 0x10], 0xffffffff
call fcn.00402600
mov al, 1
pop esi
mov ecx, dword [esp + 4]
mov dword fs:[0], ecx
add esp, 0x10
ret
lea ecx, [esp + 0x18]
mov dword [esp + 0x10], 0xffffffff
call fcn.00402600
mov ecx, dword [esp + 8]
xor al, al
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret

Function at 0x402460
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x402890
push eax
mov dword fs:[0], esp
push ebx
push ebp
push esi
push edi
mov ecx, dword [esp + 0x24]
mov eax, dword [esp + 0x28]
and ecx, 0xffff
push eax
push ecx
push 0
mov dword [esp + 0x24], 1
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov esi, eax
test esi, esi
je 0x402509
push esi
push 0
call dword [sym.imp.KERNEL32.dll_SizeofResource]
push esi
push 0
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov esi, eax
test esi, esi
je 0x402509
push ebx
push 0x40
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov ebp, eax
test ebp, ebp
je 0x402509
push esi
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ecx, ebx
mov esi, eax
mov edx, ecx
mov edi, ebp
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
push ebx
and ecx, 3
push ebp
rep movsb byte es:[edi], byte [esi]
push ecx
lea eax, [esp + 0x2c]
mov ecx, esp
mov dword [esp + 0x30], esp
push eax
call sub.MFC42.DLL_CString::CString
call fcn.004023c0
add esp, 0xc
test al, al
push ebp
jne 0x40253d
call dword [sym.imp.KERNEL32.dll_GlobalFree]
lea ecx, [esp + 0x20]
mov byte [esp + 0x18], 0
call fcn.00402600
lea ecx, [esp + 0x28]
mov dword [esp + 0x18], 0xffffffff
call fcn.00402600
xor al, al
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret
call dword [sym.imp.KERNEL32.dll_GlobalFree]
lea ecx, [esp + 0x20]
mov byte [esp + 0x18], 0
call fcn.00402600
lea ecx, [esp + 0x28]
mov dword [esp + 0x18], 0xffffffff
call fcn.00402600
mov ecx, dword [esp + 0x10]
pop edi
pop esi
pop ebp
mov al, 1
mov dword fs:[0], ecx
pop ebx
add esp, 0xc
ret

Function at 0x414dd9
Capabilities:
Encode data using xor

Disassembly:
xor dword [ecx], edi
push ebx
mov ebx, dword [esp]
add esp, 4
sub eax, 0x30ecf628
inc ebx
add ecx, 4
cmp ecx, edx
jne fcn.00414dd9
inc esi
mov eax, 0x5a830f2b
ret
Function at 0x4072ad
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
cmp dword [0x46bc7c], 0
jne 0x4072eb
xor ecx, ecx
push esi
push 8
mov eax, ecx
pop esi
mov edx, eax
and dl, 1
movzx edx, dl
neg edx
sbb edx, edx
and edx, 0xedb88320
shr eax, 1
xor eax, edx
dec esi
jne 0x4072c1
mov dword [ecx*4 + 0x46bc78], eax
inc ecx
cmp ecx, 0x100
jl 0x4072bc
pop esi
cmp dword [ebp + 0x10], 0
mov eax, dword [ebp + 8]
not eax
jbe 0x407318
mov ecx, dword [ebp + 0xc]
movzx edx, byte [ecx]
dec dword [ebp + 0x10]
xor edx, eax
and edx, 0xff
shr eax, 8
xor eax, dword [edx*4 + 0x46bc78]
inc ecx
cmp dword [ebp + 0x10], 0
ja 0x4072f9
not eax
pop ebp
ret 0xc

Function at 0x40a3b0
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x5000]
push edi
jmp 0x40a3ca
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x40a3d1
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x40a3c0
mov eax, 1
add ebx, ebx
jne 0x40a3e3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x40a3d8
jne 0x40a3f4
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x40a3d8
xor ecx, ecx
sub eax, 3
jb 0x40a408
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x40a47a
mov ebp, eax
add ebx, ebx
jne 0x40a413
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x40a420
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x40a444
inc ecx
add ebx, ebx
jne 0x40a430
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x40a425
jne 0x40a441
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x40a425
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x40a464
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x40a455
jmp 0x40a3c6
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x40a464
add edi, ecx
jmp 0x40a3c6
pop esi
lea edi, [esi + 0x8000]
mov eax, dword [edi]
or eax, eax
je 0x40a4c3
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0xa4c8]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0xa534]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x40a481
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0xa53c]
or eax, eax
je 0x40a4bd
mov dword [ebx], eax
add ebx, 4
jmp 0x40a49e
call dword [esi + 0xa538]
mov ebp, dword [esi + 0xa540]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x1ef]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x40a4f7
sub esp, 0xffffff80
jmp section.UPX0
Function at 0x100037e0
Capabilities:
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [ebp + 8]
mov dword [ebp - 4], eax
mov dword [ebp - 8], 0xffffffff
mov dword [ebp - 0xc], 0
jmp 0x10003805
mov ecx, dword [ebp - 0xc]
add ecx, 1
mov dword [ebp - 0xc], ecx
mov edx, dword [ebp - 0xc]
cmp edx, dword [ebp + 0xc]
jae 0x10003878
mov eax, dword [ebp - 4]
add eax, dword [ebp - 0xc]
movzx ecx, byte [eax]
movzx edx, byte [ebp - 8]
xor ecx, edx
mov dword [ebp - 0x10], ecx
mov eax, dword [ebp - 8]
shr eax, 8
mov dword [ebp - 8], eax
mov dword [ebp - 0x14], 0
jmp 0x1000383a
mov ecx, dword [ebp - 0x14]
add ecx, 1
mov dword [ebp - 0x14], ecx
cmp dword [ebp - 0x14], 8
jge 0x1000386d
mov edx, dword [ebp - 0x10]
and edx, 1
neg edx
sbb edx, edx
neg edx
mov byte [ebp - 0x15], dl
mov eax, dword [ebp - 0x10]
shr eax, 1
mov dword [ebp - 0x10], eax
movzx ecx, byte [ebp - 0x15]
test ecx, ecx
je 0x1000386b
mov edx, dword [ebp - 0x10]
xor edx, 0xedb88320
mov dword [ebp - 0x10], edx
jmp 0x10003831
mov eax, dword [ebp - 8]
xor eax, dword [ebp - 0x10]
mov dword [ebp - 8], eax
jmp 0x100037fc
mov eax, dword [ebp - 8]
not eax
mov esp, ebp
pop ebp
ret

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x29a051e9
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
pushal
call 0x29a051f8
pop dword [ebp - 0x18]
mov eax, 0x9466d711
sub eax, 0x6ac68519
sub dword [ebp - 0x18], eax
mov dword [ebp - 0x28], 0xe70c10f
add dword [ebp - 0x28], 0x3fe1843c
mov dword [ebp - 0x24], 0x9a93aecc
sub dword [ebp - 0x24], 0x68606287
mov dword [ebp - 0x20], 0xad4de438
sub dword [ebp - 0x20], 0x6101a00a
mov dword [ebp - 0x1c], 0xca405f0c
add dword [ebp - 0x1c], 0x35bfa0f4
lea eax, [ebp - 0x28]
push eax
mov eax, 0x69b240e4
sub eax, 0x40110058
add eax, dword [ebp - 0x18]
call dword [eax]
mov dword [ebp - 0x28], 0x576057cc
sub dword [ebp - 0x28], 0xe2edee76
mov dword [ebp - 0x24], 0x7925050a
sub dword [ebp - 0x24], 0x37b8a395
mov dword [ebp - 0x20], 0x2c891d87
sub dword [ebp - 0x20], 0xc919b11b
mov dword [ebp - 0x1c], 0x7cf22128
add dword [ebp - 0x1c], 0x830dded8
lea ebx, [ebp - 0x28]
push ebx
push eax
mov eax, 0x50e4ab45
add eax, 0xd8bc94ff
add eax, dword [ebp - 0x18]
call dword [eax]
push 0x40
push 0x1000
push 0x3ebd4
push 0
call eax
mov ecx, 0x5dafa4b6
sub ecx, 0x5daf4b2f
xor edx, edx
add edx, eax
mov esi, 0xc88b8cd3
add esi, 0x6116932d
add esi, dword [ebp - 0x18]
mov ebx, 0xe399e17b
xor dword [ebp - 0xc], 0xe98bdb74
mov edi, dword [esi]
sub dword [ebp - 0x14], 0xe6c35b6c
xor edi, ebx
sub dword [ebp - 4], ebx
mov dword [edx], edi
add edx, 0x3edb3707
add edx, 0xc124c8fd
add esi, 4
loop 0x29a05316
add eax, 0x271f21c2
sub eax, 0x271dc8d3
xor ebx, ebx
add ebx, eax
add eax, 0x4a0e1611
add eax, 0xb5f1e9f4
mov ecx, 0x29a00000
add ecx, dword [ebp - 0x18]
call ebx
leave
ret
Function at 0x10029f9
Capabilities:
Accept command line arguments
Query environment variable
Terminate process

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x228
mov eax, dword [0x1005238]
push ebx
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push esi
xor ebx, ebx
push edi
xor edi, edi
mov dword [0x1005ea0], ebx
mov dword [0x10060c8], ebx
mov dword [0x10060cc], ebx
mov dword [0x10068e0], eax
call dword [sym.imp.KERNEL32.dll_GetConsoleOutputCP]
mov esi, eax
lea eax, [ebp - 0x224]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetCPInfo]
cmp esi, 0x3a4
je 0x1002a6e
cmp esi, 0x3a8
je 0x1002a6e
cmp esi, 0x3b4
jbe 0x1002a63
cmp esi, 0x3b6
jbe 0x1002a6e
xor esi, esi
mov dword [0x1005ea4], ebx
inc esi
jmp 0x1002a77
xor esi, esi
inc esi
mov dword [0x1005ea4], esi
push ebx
call sub.KERNEL32.dll_SetThreadUILanguage
push 0x105
lea eax, [ebp - 0x210]
push eax
push 0x1001278
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
test eax, eax
jne 0x1002ab1
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x2710
call fcn.01001765
pop ecx
pop ecx
push esi
jmp 0x1002bc5
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
cmp eax, ebx
mov dword [0x1005ea8], eax
je 0x1002a98
lea eax, [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
push eax
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
cmp eax, ebx
jne 0x1002ae8
push 0x2711
call fcn.01001765
jmp 0x1002aaa
lea ecx, [ebp - 0x228]
push ecx
push eax
push dword [ebp + 8]
call fcn.010023dc
test eax, eax
jne 0x1002b04
push ebx
call fcn.01001ff6
jmp 0x1002aab
mov eax, dword [ebp - 0x228]
sub eax, ebx
je 0x1002b7c
dec eax
je 0x1002b75
dec eax
je 0x1002b6e
dec eax
dec eax
je 0x1002b4d
dec eax
je 0x1002b28
dec eax
jne 0x1002b83
push esi
call fcn.01001ff6
xor edi, edi
jmp 0x1002b83
call fcn.010021b9
test eax, eax
je 0x1002b83
push 0xffffffffffffffff
push ebx
push dword [0x1005eac]
call sub.NETAPI32.dll_NetScheduleJobDel
mov edi, eax
cmp edi, ebx
je 0x1002b83
cmp edi, 0xede
jmp 0x1002b63
mov eax, dword [0x10068e4]
push eax
push eax
push dword [0x1005eac]
call sub.NETAPI32.dll_NetScheduleJobDel
mov edi, eax
cmp edi, ebx
je 0x1002b83
push edi
call fcn.01001765
pop ecx
jmp 0x1002b83
call fcn.010019ee
jmp 0x1002b81
call fcn.0100282a
jmp 0x1002b81
call fcn.01002672
mov edi, eax
push 0x1005018
call fcn.010018e1
push 0x1005088
call fcn.010018e1
push dword [0x1005820]
mov esi, dword [sym.imp.KERNEL32.dll_LocalFree]
call esi
push dword [0x1005824]
call esi
push dword [0x1005834]
call esi
push dword [0x1005838]
call esi
xor eax, eax
cmp edi, ebx
setne al
push eax
call dword [sym.imp.msvcrt.dll_exit]
int3

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x1000891a
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x10004058]
jne 0x1002f994
ret
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x328
mov dword [0x1003ad68], eax
mov dword [0x1003ad64], ecx
mov dword [0x1003ad60], edx
mov dword [0x1003ad5c], ebx
mov dword [0x1003ad58], esi
mov dword [0x1003ad54], edi
mov word [0x1003ad80], ss
mov word [0x1003ad74], cs
mov word [0x1003ad50], ds
mov word [0x1003ad4c], es
mov word [0x1003ad48], fs
mov word [0x1003ad44], gs
pushfd
pop dword [0x1003ad78]
mov eax, dword [ebp]
mov dword [0x1003ad6c], eax
mov eax, dword [ebp + 4]
mov dword [0x1003ad70], eax
lea eax, [ebp + 8]
mov dword [0x1003ad7c], eax
mov eax, dword [ebp - 0x320]
mov dword [0x1003acb8], 0x10001
mov eax, dword [0x1003ad70]
mov dword [0x1003ac6c], eax
mov dword [0x1003ac60], 0xc0000409
mov dword [0x1003ac64], 1
mov eax, dword [0x10004058]
mov dword [ebp - 0x328], eax
mov eax, dword [0x10039abc]
mov dword [ebp - 0x324], eax
call dword [sym.imp.kernel32.dll_IsDebuggerPresent]
mov dword [0x1003acb0], eax
push 1
call sub.msvcr100.dll__crt_debugger_hook
pop ecx
push 0
call dword [sym.imp.kernel32.dll_SetUnhandledExceptionFilter]
push 0x1000426c
call dword [sym.imp.kernel32.dll_UnhandledExceptionFilter]
cmp dword [0x1003acb0], 0
jne 0x1002fa80
push 1
call sub.msvcr100.dll__crt_debugger_hook
pop ecx
push 0xc0000409
call dword [sym.imp.kernel32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.kernel32.dll_TerminateProcess]
leave
ret

Function at 0x100355d4
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
pushal
call 0x100355e3
pop dword [ebp - 0x10]
mov eax, 0xb2c0b962
sub eax, 0xa2bd637f
sub dword [ebp - 0x10], eax
mov dword [ebp - 0x20], 0xb156af4f
sub dword [ebp - 0x20], 0x63046a04
mov dword [ebp - 0x1c], 0xc7482c0c
add dword [ebp - 0x1c], 0x6aeb2039
mov dword [ebp - 0x18], 0xf3569c4c
add dword [ebp - 0x18], 0x58f5a7e2
mov dword [ebp - 0x14], 0xd6ac9eba
add dword [ebp - 0x14], 0x29536146
lea eax, [ebp - 0x20]
push eax
mov eax, 0x665294bf
add eax, 0xa9ad7c89
add eax, dword [ebp - 0x10]
call dword [eax]
mov dword [ebp - 0x20], 0x15f66f83
sub dword [ebp - 0x20], 0xa184062d
mov dword [ebp - 0x1c], 0x64538ab2
sub dword [ebp - 0x1c], 0x22e7293d
mov dword [ebp - 0x18], 0xde276075
sub dword [ebp - 0x18], 0x7ab7f409
mov dword [ebp - 0x14], 0x90aa20b5
add dword [ebp - 0x14], 0x6f55df4b
lea ebx, [ebp - 0x20]
push ebx
push eax
mov eax, 0xcaf53371
sub eax, 0xbaf521f1
add eax, dword [ebp - 0x10]
call dword [eax]
push 0x40
push 0x1000
push 0x3c1cb
push 0
call eax
mov ecx, 0x3910
xor edi, edi
add edi, eax
mov ebx, 0x1003ea00
add ebx, dword [ebp - 0x10]
mov edx, 0xf7e6e209
sub edx, 0x2afc6014
mov dword [ebp - 4], 0x6db5f815
mov esi, dword [ebx]
add dword [ebp - 0xc], edi
xor esi, edx
add dword [ebp - 4], 0xde6bf0dc
mov dword [edi], esi
add dword [ebp - 8], eax
add edi, 0x39263655
add edi, 0xc6d9c9af
add ebx, 0x901c14b6
add ebx, 0x6fe3eb4e
loop 0x100356fb
add eax, 0xb00583d4
add eax, 0x4ffb533f
mov ebx, eax
add eax, 0x8a369985
sub eax, 0x8a369980
mov ecx, 0xe7321675
add ecx, 0x28cde98b
add ecx, dword [ebp - 0x10]
call ebx
leave
ret
Function at 0x10025f80
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100a77b7
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push esi
push edi
mov eax, dword [0x100c3040]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, edx
mov dword [ebp - 0x10], ecx
push 0x344c
call fcn.100a5f92
mov ebx, eax
add esp, 4
mov dword [ebp - 0x18], ebx
mov dword [ebp - 4], 0
lea edi, [ebx + 0xc]
xorps xmm0, xmm0
mov ecx, edi
movq qword [ebx], xmm0
mov dword [ebx + 8], 0
mov dword [ebx + 4], 1
mov dword [ebx + 8], 1
mov dword [ebx], 0x100b2738
mov eax, dword [esi]
mov byte [edi + 0x16], 0
mov dword [edi + 0x2c], 0
mov dword [edi + 0x30], 0
mov dword [edi + 0x34], 0
mov dword [edi + 0x38], 0
mov dword [edi + 0x3c], 0
mov dword [edi + 0x40], 0
mov dword [edi + 0x44], 0
mov dword [edi + 0x48], 0
mov dword [edi + 0x4c], 0
mov dword [edi + 0x54], 0
mov dword [edi + 0x58], 0
mov dword [edi + 0x5c], 0
mov dword [edi + 0x60], 0
mov dword [edi + 0x64], 0
mov dword [edi + 0x68], 0
mov dword [edi + 0x6c], 0
mov dword [edi + 0x70], 0
mov dword [edi + 0x74], 0
mov dword [edi + 0x78], 0
mov dword [edi + 0x7c], 0
mov dword [edi + 0x80], 0
mov dword [edi + 0x84], 0
mov dword [edi + 0x88], 0
mov dword [edi + 0x8c], 0
mov dword [edi + 0x3f4], 0
mov dword [edi + 0x3f8], 0
mov dword [edi + 0x3fc], 0
mov dword [edi + 0x10], 0
mov byte [edi + 0x405], 0
push eax
mov byte [edi + 0x3408], 0
mov dword [edi + 0x340c], 0
mov dword [edi + 0x3410], 0
mov dword [edi + 0x3414], 0
mov dword [edi + 0x3418], 0
mov dword [edi + 0x341c], 0
mov dword [edi + 0x3420], 0
mov word [edi + 0x3430], 0
call fcn.10020210
mov eax, dword [ebp - 0x10]
xorps xmm0, xmm0
movq qword [eax], xmm0
mov dword [eax], edi
mov dword [eax + 4], ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1002ca20
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x100c3040]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, ecx
cmp dword [esi + 0x38], 0
je 0x1002cadc
cmp byte [esi + 0x3d], 0
je 0x1002cadc
mov eax, dword [esi]
push edi
push 0xffffffffffffffff
call dword [eax + 0xc]
cmp eax, 0xffffffff
je 0x1002caca
mov ecx, dword [esi + 0x38]
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [esi + 0x40]
push eax
call dword [sym.imp.MSVCP140.dll_public:_int___thiscall_std::codecvt_char__char__struct__Mbstatet_::unshift_struct__Mbstatet___char___char___char___const]
sub eax, 0
je 0x1002ca91
sub eax, 1
je 0x1002ca95
sub eax, 2
jne 0x1002caca
mov byte [esi + 0x3d], al
mov al, 1
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100a5f76
mov esp, ebp
pop ebp
ret
mov byte [esi + 0x3d], 0
mov edi, dword [ebp - 0x28]
lea eax, [ebp - 0x24]
sub edi, eax
je 0x1002cab3
push dword [esi + 0x4c]
push edi
push 1
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
add esp, 0x10
cmp edi, eax
jne 0x1002caca
cmp byte [esi + 0x3d], 0
pop edi
sete al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100a5f76
mov esp, ebp
pop ebp
ret
pop edi
xor al, al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100a5f76
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
mov al, 1
xor ecx, ebp
pop esi
call fcn.100a5f76
mov esp, ebp
pop ebp
ret
Function at 0x1002faf0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
cmp byte [0x1020ae8c], 0
push ebx
push esi
push edi
je 0x1002fc7e
mov ecx, dword [0x1020e930]
mov eax, dword [ecx]
mov eax, dword [eax + 0x68]
call eax
test al, al
je 0x1002fc7e
mov ecx, dword [0x1020e9bc]
xor ebx, ebx
mov dword [ebp - 4], ecx
mov eax, dword [ecx + 0x28]
mov dword [ebp - 8], eax
test eax, eax
je 0x1002fc7e
mov eax, dword [ecx + 0x1c]
mov ecx, dword [eax + ebx*4]
mov eax, dword [ecx]
mov eax, dword [eax + 0x30]
call eax
mov esi, eax
mov edi, 0x811c9dc5
xor ecx, ecx
nop word [eax + eax]
inc ecx
cmp byte [esi + ecx], 0
jne 0x1002fb50
xor edx, edx
test ecx, ecx
je 0x1002fb79
nop dword [eax]
movsx eax, byte [esi + edx]
inc edx
xor eax, edi
imul edi, eax, 0x1000193
cmp edx, ecx
jb 0x1002fb60
cmp edi, 0x5ff56dc5
je 0x1002fb88
inc ebx
cmp ebx, dword [ebp - 8]
jae 0x1002fc7e
mov ecx, dword [ebp - 4]
jmp 0x1002fb34
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x1c]
mov edi, dword [eax + ebx*4]
test edi, edi
je 0x1002fc7e
mov edx, dword [edi + 0x88]
test edx, edx
je 0x1002fc7e
movss xmm1, dword [0x100b8510]
xor ebx, ebx
cmp edx, 4
jl 0x1002fc4b
mov ecx, dword [edi + 0x7c]
lea esi, [edx - 4]
shr esi, 2
add ecx, 0x1078
inc esi
lea ebx, [esi*4]
movss xmm0, dword [ecx - 0xc60]
ucomiss xmm0, xmm1
lahf
test ah, 0x44
jp 0x1002fbec
mov dword [ecx - 0xc60], 0x7f7fffff
movss xmm0, dword [ecx - 0x840]
ucomiss xmm0, xmm1
lahf
test ah, 0x44
jp 0x1002fc07
mov dword [ecx - 0x840], 0x7f7fffff
movss xmm0, dword [ecx - 0x420]
ucomiss xmm0, xmm1
lahf
test ah, 0x44
jp 0x1002fc22
mov dword [ecx - 0x420], 0x7f7fffff
movss xmm0, dword [ecx]
ucomiss xmm0, xmm1
lahf
test ah, 0x44
jp 0x1002fc35
mov dword [ecx], 0x7f7fffff
add ecx, 0x1080
sub esi, 1
jne 0x1002fbd1
cmp ebx, edx
jl 0x1002fc4f
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
test edx, edx
jle 0x1002fc7e
imul ecx, ebx, 0x420
add ecx, 0x418
add ecx, dword [edi + 0x7c]
sub edx, ebx
movss xmm0, dword [ecx]
ucomiss xmm0, xmm1
lahf
test ah, 0x44
jp 0x1002fc73
mov dword [ecx], 0x7f7fffff
add ecx, 0x420
sub edx, 1
jne 0x1002fc60
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x100315d0
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100a7f55
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push ebx
push esi
push edi
mov eax, dword [0x100c3040]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, dword [ebp + 8]
movzx eax, byte [edi]
xor eax, 0x811c9dc5
imul ecx, eax, 0x1000193
movzx eax, byte [edi + 1]
xor ecx, eax
movzx eax, byte [edi + 2]
imul ecx, ecx, 0x1000193
xor ecx, eax
movzx eax, byte [edi + 3]
imul ecx, ecx, 0x1000193
xor ecx, eax
lea eax, [ebp - 0x14]
imul ebx, ecx, 0x1000193
push ebx
push edi
push eax
call fcn.10032a80
mov esi, dword [ebp - 0x10]
test esi, esi
jne 0x10031740
cmp dword [0x102147b8], 0xfffffff
jne 0x1003165a
push str.unordered_map_set_too_long
call dword [sym.imp.MSVCP140.dll_void___cdecl_std::_Xlength_error_char_const__]
mov dword [ebp - 0x1c], 0x102147b4
mov dword [ebp - 4], 0
push 0x10
mov dword [ebp - 0x18], 0
call fcn.100a5f92
mov ecx, dword [edi]
mov esi, eax
add esp, 4
mov dword [ebp - 0x18], esi
mov dword [esi + 8], ecx
mov dword [esi + 0xc], 0
mov dword [ebp - 4], 1
mov ecx, dword [0x102147b8]
lea eax, [ecx + 1]
movd xmm0, eax
cvtdq2pd xmm0, xmm0
shr eax, 0x1f
addsd xmm0, qword [eax*8 + 0x100b86e0]
mov eax, dword [0x102147cc]
cvtpd2ps xmm1, xmm0
movd xmm0, eax
cvtdq2pd xmm0, xmm0
shr eax, 0x1f
addsd xmm0, qword [eax*8 + 0x100b86e0]
cvtpd2ps xmm0, xmm0
divss xmm1, xmm0
comiss xmm1, dword [0x102147b0]
jbe 0x100316f9
call fcn.10032860
push ebx
lea eax, [esi + 8]
push eax
lea eax, [ebp - 0x1c]
push eax
call fcn.10032a80
mov ecx, dword [0x102147b8]
mov edx, dword [eax]
jmp 0x100316fc
mov edx, dword [ebp - 0x14]
mov edi, dword [edx + 4]
inc ecx
mov dword [0x102147b8], ecx
mov dword [esi], edx
mov dword [esi + 4], edi
mov dword [edi], esi
mov dword [edx + 4], esi
mov eax, dword [0x102147c8]
mov ecx, dword [0x102147bc]
and eax, ebx
mov ebx, dword [ecx + eax*8]
cmp ebx, dword [0x102147b4]
jne 0x1003172d
mov dword [ecx + eax*8], esi
jmp 0x1003173c
cmp ebx, edx
jne 0x10031736
mov dword [ecx + eax*8], esi
jmp 0x10031740
cmp dword [ecx + eax*8 + 4], edi
jne 0x10031740
mov dword [ecx + eax*8 + 4], esi
lea eax, [esi + 0xc]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4