joyce8/EMBER2024-capa huggingface dataset:
Function at 0x401aed
Capabilities:
Get common file path

Disassembly:
push 0xffffffffffffffff
push 0x40823c
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x218
push ebx
push ebp
push esi
mov esi, ecx
push edi
mov dword [esp + 0x24], esi
lea edi, [esi + 8]
mov ecx, edi
call sub.MFC42.DLL_CString::CString_2
lea ebx, [esi + 0xc]
mov dword [esp + 0x230], 0
mov ecx, ebx
call sub.MFC42.DLL_CString::CString_2
lea eax, [esp + 0x128]
mov byte [esp + 0x230], 1
push eax
push 0xff
mov dword [esi], 0x40973c
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
lea ecx, [esp + 0x10]
push ecx
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
mov edx, dword [esp + 0x1e]
mov eax, dword [esp + 0x1c]
mov ecx, dword [esp + 0x1a]
and edx, 0xffff
push edx
mov edx, dword [esp + 0x1c]
and eax, 0xffff
and ecx, 0xffff
push eax
mov eax, dword [esp + 0x18]
and edx, 0xffff
push ecx
mov ecx, dword [esp + 0x1e]
mov ebp, dword [sym.imp.MSVCRT.dll_sprintf]
push edx
mov edx, dword [esp + 0x26]
and eax, 0xffff
and ecx, 0xffff
push eax
and edx, 0xffff
push ecx
push edx
lea eax, [esp + 0x44]
push str._02d_02d_04d__02d_02d_02d_03d.BMP
push eax
call ebp
add esp, 0x24
lea ecx, [esp + 0x128]
push ecx
mov ecx, edi
call fcn.0040791e
lea edx, [esp + 0x28]
mov ecx, edi
push edx
call sub.MFC42.DLL_CString::operator_1
mov eax, dword [esp + 0x1e]
mov ecx, dword [esp + 0x1c]
mov edx, dword [esp + 0x1a]
and eax, 0xffff
push eax
mov eax, dword [esp + 0x1c]
and ecx, 0xffff
and edx, 0xffff
push ecx
mov ecx, dword [esp + 0x18]
and eax, 0xffff
push edx
mov edx, dword [esp + 0x1e]
push eax
mov eax, dword [esp + 0x26]
and ecx, 0xffff
and edx, 0xffff
push ecx
and eax, 0xffff
push edx
push eax
push str._02d_02d_04d__02d_02d_02d_03d.JPG
lea ecx, [esp + 0x48]
push ecx
call ebp
add esp, 0x24
lea edx, [esp + 0x128]
mov ecx, ebx
push edx
call fcn.0040791e
lea eax, [esp + 0x28]
mov ecx, ebx
push eax
call sub.MFC42.DLL_CString::operator_1
push 0x1f2c
call sub.MFC42.DLL_operatornew
mov ecx, dword [esp + 0x22c]
add esp, 4
mov dword [esi + 4], eax
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x224
ret

Function at 0x401c80
Capabilities:
Delete file

Disassembly:
push 0xffffffffffffffff
push 0x40825b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebx
push esi
mov esi, ecx
push edi
mov dword [esp + 0xc], esi
mov dword [esi], 0x40973c
mov eax, dword [esi + 8]
mov ebx, dword [sym.imp.KERNEL32.dll_DeleteFileA]
lea edi, [esi + 8]
push eax
mov dword [esp + 0x1c], 0
call ebx
mov eax, dword [esi + 0xc]
add esi, 0xc
push eax
call ebx
mov ecx, esi
call sub.MFC42.DLL_CString::CString
mov ecx, edi
mov dword [esp + 0x18], 0xffffffff
call sub.MFC42.DLL_CString::CString
mov ecx, dword [esp + 0x10]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x10
ret
Function at 0x403d40
Capabilities:
Capture webcam image

Disassembly:
push ebx
push ebp
push esi
push edi
push 0
push 0
mov ebx, ecx
push 0
push 0
push ebx
push 0x403e50
mov dword [ebx + 0x10], 0
call sub.MFC42.DLL_AfxBeginThread
push 0
push 0
push 0xc8
push 0xc8
push 0
push 0
push 0x20000000
push str.Explorer
call sub.AVICAP32.dll_capCreateCaptureWindowA
mov edi, eax
xor eax, eax
mov ebp, dword [sym.imp.USER32.dll_SendMessageA]
test edi, edi
setne al
mov esi, eax
test esi, esi
je 0x403db3
push edi
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x403db1
push 0
push 0
push 0x40a
push edi
call ebp
mov esi, eax
jmp 0x403db3
xor esi, esi
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
test esi, esi
je 0x403e03
push edi
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x403e01
push 0
push 0
push 0x43d
push edi
call ebp
mov esi, eax
test esi, esi
je 0x403e03
push edi
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x403e01
lea ecx, [ebx + 8]
call sub.MFC42.DLL_CString::LockBuffer
push eax
push 0
push 0x419
push edi
call ebp
mov esi, eax
jmp 0x403e03
xor esi, esi
lea ecx, [ebx + 8]
call sub.MFC42.DLL_CString::UnlockBuffer
test esi, esi
je 0x403e2c
push edi
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x403e2a
push 0
push 0
push 0x40b
push edi
call ebp
mov esi, eax
jmp 0x403e2c
xor esi, esi
test edi, edi
je 0x403e37
push edi
call dword [sym.imp.USER32.dll_DestroyWindow]
mov eax, esi
pop edi
pop esi
mov dword [ebx + 0x10], 1
pop ebp
pop ebx
ret
Function at 0x403ec0
Capabilities:
Accept command line arguments
Create process on windows
Get common file path

Disassembly:
sub esp, 0x304
push ebx
push ebp
push esi
mov esi, dword [esp + 0x314]
mov ebx, ecx
push edi
mov edi, esi
or ecx, 0xffffffff
xor eax, eax
mov dword [ebx], 0x4097d0
repne scasb al, byte es:[edi]
not ecx
dec ecx
push ecx
call sub.MFC42.DLL_operatornew
mov edi, dword [esp + 0x320]
mov dword [0x40d8b8], eax
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
push ecx
call sub.MFC42.DLL_operatornew
mov dword [0x40d8bc], eax
mov edi, esi
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov ebp, dword [sym.imp.MSVCRT.dll__strlwr]
mov eax, ecx
mov esi, edi
mov edi, dword [0x40d8b8]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [0x40d8b8]
push ecx
call ebp
mov edi, dword [esp + 0x328]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov edx, ecx
mov esi, edi
mov edi, dword [0x40d8bc]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov eax, dword [0x40d8bc]
push eax
call ebp
mov ecx, dword [esp + 0x330]
add esp, 0x10
lea edx, [esp + 0x214]
mov dword [0x40b2e8], ecx
push 0xff
push edx
push 0
mov dword [ebx + 0xc], 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea eax, [esp + 0x14]
push eax
push 0xff
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
lea edi, [esp + 0x14]
or ecx, 0xffffffff
xor eax, eax
push 0x5c
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov byte [esp + ecx + 0x17], al
lea ecx, [esp + 0x218]
push ecx
call dword [sym.imp.MSVCRT.dll_strrchr]
mov edx, eax
or ecx, 0xffffffff
xor eax, eax
lea esi, [esp + 0x11c]
lea edi, [edx + 1]
mov dword [esp + 0x18], esi
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, dword [esp + 0x18]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0x11c]
mov byte [edx], 0
push ecx
call ebp
add esp, 0xc
push str.flash
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
push eax
call dword [sym.imp.MSVCRT.dll_strstr]
mov edi, dword [0x40d8bc]
mov esi, eax
add esp, 8
lea eax, [esp + 0x114]
neg esi
sbb esi, esi
neg esi
mov dl, byte [eax]
mov cl, dl
cmp dl, byte [edi]
jne 0x404059
test cl, cl
je 0x404055
mov dl, byte [eax + 1]
mov cl, dl
cmp dl, byte [edi + 1]
jne 0x404059
add eax, 2
add edi, 2
test cl, cl
jne 0x404035
xor edi, edi
jmp 0x40405e
sbb edi, edi
sbb edi, 0xffffffff
lea eax, [esp + 0x14]
push eax
call fcn.00404950
test eax, eax
je 0x4040bb
test esi, esi
je 0x40409a
push 5
push 0
lea ecx, [esp + 0x21c]
push 0
push ecx
push 0x40b2ec
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
pop edi
pop esi
mov eax, ebx
pop ebp
pop ebx
add esp, 0x304
ret 0xc
test edi, edi
je 0x4040c9
push 5
push 0x521
mov ecx, ebx
call fcn.00404fa0
pop edi
pop esi
mov eax, ebx
pop ebp
pop ebx
add esp, 0x304
ret 0xc
mov ecx, ebx
mov dword [ebx + 0xc], 1
call fcn.00404290
pop edi
pop esi
mov eax, ebx
pop ebp
pop ebx
add esp, 0x304
ret 0xc
Function at 0x404d20
Capabilities:
Read file on windows

Disassembly:
mov eax, 0x1000
call fcn.00407ba0
push ebx
push ebp
push esi
push edi
lea eax, [esp + 0x10]
push 0x64
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea ecx, [esp + 0x10]
push 0x40b480
push ecx
call dword [sym.imp.MSVCRT.dll_fopen]
mov ebx, dword [sym.imp.MSVCRT.dll_fseek]
mov ebp, eax
push 2
push 0xffffffffffffffce
push ebp
call ebx
push ebp
push 0x32
lea edx, [esp + 0x82c]
push 1
push edx
call dword [sym.imp.MSVCRT.dll_fread]
add esp, 0x24
push 1
push 0xffffffffffffff9c
push ebp
call ebx
push ebp
push 0x32
lea eax, [esp + 0x24]
push 1
push eax
call dword [sym.imp.MSVCRT.dll_fread]
mov al, byte [esp + 0x5d]
add esp, 0x1c
cmp al, 0xaa
jne 0x404e1f
or ecx, 0xffffffff
mov edi, 0x40b478
xor eax, eax
lea edx, [esp + 0x10]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
lea edx, [esp + 0x10]
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea edi, [esp + 0x810]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
lea edx, [esp + 0x810]
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea edi, [esp + 0x10]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
jmp 0x404d72
push ebp
call dword [sym.imp.MSVCRT.dll_fclose]
lea edi, [esp + 0x814]
or ecx, 0xffffffff
xor eax, eax
add esp, 4
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov edx, ecx
mov esi, edi
mov edi, dword [esp + 0x1014]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea edi, [esp + 0x810]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
pop edi
dec ecx
pop esi
pop ebp
mov eax, ecx
pop ebx
add esp, 0x1000
ret 4

Function at 0x404e70
Capabilities:
Read file on windows

Disassembly:
sub esp, 0x64
lea eax, [esp]
push esi
push edi
push 0x64
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea ecx, [esp + 8]
push 0x40b480
push ecx
call dword [sym.imp.MSVCRT.dll_fopen]
mov esi, eax
push 2
push 0xffffffffffffffce
push esi
call dword [sym.imp.MSVCRT.dll_fseek]
push esi
push 0x32
lea edx, [esp + 0x24]
push 1
push edx
call dword [sym.imp.MSVCRT.dll_fread]
push esi
call dword [sym.imp.MSVCRT.dll_fclose]
lea edi, [esp + 0x30]
or ecx, 0xffffffff
xor eax, eax
add esp, 0x28
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, dword [esp + 0x70]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea edi, [esp + 8]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
dec ecx
pop edi
mov eax, ecx
pop esi
add esp, 0x64
ret 4
Function at 0x4055c0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x4082fa
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
push ebx
push ebp
push esi
mov esi, ecx
push edi
mov dword [esp + 0x10], esi
mov dword [esi], 0x4097e8
xor edi, edi
lea ecx, [esi + 4]
mov dword [esp + 0x20], edi
call sub.MFC42.DLL_CString::CString_2
lea ebp, [esi + 0x24]
mov byte [esp + 0x20], 1
mov ecx, ebp
call sub.MFC42.DLL_CString::CString_2
lea ecx, [esi + 0x44]
mov byte [esp + 0x20], 2
call sub.MFC42.DLL_CString::CString_2
lea ecx, [esi + 0x48]
mov byte [esp + 0x20], 3
call sub.MFC42.DLL_CString::CString_2
lea ebx, [esi + 0x4c]
mov byte [esp + 0x20], 4
mov ecx, ebx
call sub.MFC42.DLL_CString::CString_2
lea ecx, [esi + 0x50]
mov byte [esp + 0x20], 5
call sub.MFC42.DLL_CString::CString_2
mov ecx, dword [esp + 0x2c]
mov edx, dword [esp + 0x30]
mov eax, dword [esp + 0x28]
mov dword [esi + 0x2c], ecx
push edx
mov ecx, ebp
mov byte [esp + 0x24], 6
mov dword [esi], 0x4097d4
mov dword [esi + 0x28], eax
call sub.MFC42.DLL_CString::operator
mov eax, dword [esi + 0x2c]
mov dword [esi + 0xc], edi
cmp eax, edi
je 0x405678
lea ecx, [esi + 0x3c]
push ecx
push eax
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
mov dword [esi + 0x40], eax
push 0x40b980
mov ecx, ebx
mov dword [esi + 0x54], edi
call fcn.0040791e
push 0x40b980
lea ecx, [esi + 0x50]
call fcn.0040791e
mov eax, dword [esi + 0x2c]
mov ebx, dword [sym.imp.USER32.dll_FindWindowExA]
cmp eax, edi
mov dword [esi + 8], 1
mov dword [esi + 0x20], edi
mov dword [esi + 0x1c], edi
mov dword [esi + 0x18], edi
mov dword [esi + 0x14], edi
mov dword [esi + 0x10], edi
mov dword [esi + 0x38], edi
mov dword [esi + 0x34], edi
mov dword [esi + 0x30], edi
je 0x4056d1
push str.YLoginWnd
push str.32770
push edi
push eax
call ebx
mov dword [esi + 0x30], eax
mov eax, dword [esi + 0x30]
cmp eax, edi
je 0x4056e5
push edi
push str.Edit
push edi
push eax
call ebx
mov dword [esi + 0x34], eax
mov eax, dword [esi + 0x30]
cmp eax, edi
je 0x4056fc
mov edx, dword [esi + 0x34]
push edi
push str.Edit
push edx
push eax
call ebx
mov dword [esi + 0x38], eax
mov ecx, dword [esi + 0x38]
lea eax, [esp + 0x14]
push eax
push 0x3e8
push 2
push edi
push edi
push 0x303
push ecx
call dword [sym.imp.USER32.dll_SendMessageTimeoutA]
mov ecx, dword [esp + 0x18]
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x14
ret 0xc
Function at 0x1001e800
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
cmp eax, 3
ja case.default.0x1001e80b
jmp dword [eax*4 + 0x1001e848]
mov eax, dword [ebp + 8]
push 0
push 0
push eax
push 0x1001d8d0
push 0
push 0
mov dword [0x106c4034], eax
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov eax, 1
pop ebp
ret 0xc
call dword [sym.imp.KERNEL32.dll_FreeConsole]
mov eax, 1
pop ebp
ret 0xc

Function at 0x1001e870
Capabilities:
Delete service
Stop service

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [0x106c15c0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
push 1
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
push 0x10022
mov ebx, eax
push esi
push ebx
call dword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov edi, eax
lea eax, [ebp - 0x20]
push eax
push 1
push edi
call dword [sym.imp.ADVAPI32.dll_ControlService]
push edi
call dword [sym.imp.ADVAPI32.dll_DeleteService]
mov esi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
push ebx
call esi
push edi
call esi
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10229364
mov esp, ebp
pop ebp
ret
Function at 0x10034540
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1022c36d
mov eax, dword fs:[0]
push eax
sub esp, 8
mov eax, dword [0x106c15c0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
push 4
call fcn.10229475
mov ecx, eax
add esp, 4
test ecx, ecx
je 0x10034583
mov eax, dword [ebp + 8]
mov dword [ecx], eax
jmp 0x10034585
xor ecx, ecx
mov dword [ebp - 0x14], ecx
lea edi, [esi + 4]
mov dword [ebp - 4], 0
push edi
push 0
push ecx
push 0x10034cd0
push 0
push 0
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
add esp, 0x18
mov dword [esi], eax
test eax, eax
je 0x100345cd
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.10229364
mov esp, ebp
pop ebp
ret 4
push 6
mov dword [edi], 0
call sub.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_
int3
Function at 0x10170b50
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [0x106c15c0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0x10]
mov dword [ebp - 0xc], eax
lea eax, [ebp - 8]
push eax
push 0x40
push edi
push esi
push dword [0x106c3650]
call dword [sym.imp.KERNEL32.dll_VirtualProtectEx]
test eax, eax
je 0x10170bb0
push 0
push edi
push dword [ebp - 0xc]
push esi
push dword [0x106c3650]
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
test eax, eax
je 0x10170bb0
push 0
push dword [ebp - 8]
push edi
push esi
push dword [0x106c3650]
call dword [sym.imp.KERNEL32.dll_VirtualProtectEx]
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.10229364
mov esp, ebp
pop ebp
ret
Function at 0x10183630
Capabilities:
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov ecx, dword [ebp + 8]
push ebx
push esi
push edi
mov edi, dword [0x106c40f4]
xor esi, esi
mov dword [ebp - 0x10], esi
mov dword [ebp - 0xc], esi
mov eax, dword [edi + 0x3e38]
mov dword [ebp - 8], eax
test cl, 0x10
jne 0x1018379a
mov ebx, dword [edi + 0x46b4]
test ebx, ebx
je 0x101836a0
cmp dword [edi + 0x3e84], ebx
jne 0x10183791
mov esi, dword [edi + 0x3eb0]
xor ecx, ecx
cmp esi, 0xffffffff
cmove esi, ecx
cmp byte [esi + edi + 0xdc0], cl
je 0x10183791
cmp byte [eax + 0xb7], cl
jne 0x10183791
xor cl, cl
jmp 0x1018373f
cmp byte [edi + 0xdc0], 0
je 0x10183791
cmp byte [eax + 0xb7], 0
jne 0x10183791
test byte [edi + 0x46bc], 1
jne 0x101836db
cmp dword [edi + 0x3e84], esi
je 0x10183791
cmp dword [edi + 0x3ea8], eax
jne 0x10183791
test cl, 8
je 0x10183791
lea esi, [edi + 0x46c0]
mov ecx, eax
push esi
call fcn.10187c00
mov ebx, eax
push ebx
mov dword [edi + 0x46b4], ebx
call fcn.1018ac50
push ebx
push esi
call fcn.1018a900
mov cl, al
add esp, 0xc
mov byte [ebp - 1], cl
test cl, cl
je 0x10183732
cmp byte [edi + 0x36f8], 0
je 0x10183732
mov esi, dword [ebp - 8]
push esi
push ebx
call fcn.101933e0
push esi
call fcn.10187390
mov cl, byte [ebp - 1]
add esp, 0xc
cmp dword [edi + 0x3e84], ebx
jne 0x10183791
mov eax, dword [ebp - 8]
xor esi, esi
mov byte [edi + 0x3e91], cl
mov ecx, dword [eax + 0xec]
mov eax, dword [eax + 0xf4]
mov eax, dword [eax + ecx*4 - 4]
mov dword [ebp - 0xc], eax
mov eax, dword [0x106c40f4]
cmp byte [eax + esi + 0xdc0], 0
jne 0x1018376d
mov byte [ebp - 1], 0
jmp 0x10183786
movss xmm1, dword [eax + 0x30]
movss xmm0, dword [eax + esi*4 + 0x3750]
mulss xmm1, xmm1
comiss xmm0, xmm1
setae byte [ebp - 1]
call fcn.10193520
cmp byte [ebp - 1], 0
jne 0x101837d3
pop edi
pop esi
xor al, al
pop ebx
mov esp, ebp
pop ebp
ret
or ebx, 0xffffffff
mov edx, 0x102ed131
mov al, 0x23
or esi, 0xffffffff
cmp al, 0x23
jne 0x101837b5
cmp byte [edx], al
jne 0x101837b5
cmp byte [edx + 1], al
cmove ebx, esi
movzx ecx, bl
movzx eax, al
xor ecx, eax
shr ebx, 8
mov al, byte [edx]
inc edx
xor ebx, dword [ecx*4 + 0x102ebd00]
test al, al
jne 0x101837a7
mov esi, dword [ebp - 0x10]
not ebx
cmp byte [edi + 0x4968], 0
jne 0x10183815
call fcn.10184c20
mov eax, dword [ebp - 0xc]
mov dword [edi + 0x4984], eax
mov eax, dword [ebp + 8]
mov dword [edi + 0x4980], ebx
mov byte [edi + 0x4968], 1
mov dword [edi + 0x496c], eax
mov dword [edi + 0x4974], esi
cmp ebx, dword [edi + 0x3e84]
jne 0x10183815
mov byte [edi + 0x3e92], 1
mov ebx, dword [ebp + 8]
mov eax, dword [edi + 0x3dd8]
mov dword [edi + 0x4970], eax
mov byte [edi + 0x4969], 1
test bl, 1
jne 0x1018386c
push 0
push 0
call fcn.10183ba0
add esp, 8
cmp dword [edi + 0x49d0], 0
je 0x1018386c
test dword [edi + 0x49c4], 0x1000
je 0x1018386c
mov eax, dword [edi + 0x3e38]
mov byte [eax + 0xb7], 1
mov byte [eax + 0xb9], 1
mov byte [eax + 0xd4], 1
test bl, 0x12
jne 0x10183878
and dword [edi + 0x46bc], 0xfffffffe
pop edi
pop esi
mov al, 1
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10187b20
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [0x106c15c0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ecx + 0xec]
lea edx, [ebp - 8]
push ebx
mov ebx, dword [ecx + 0xf4]
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, 4
mov ebx, dword [ebx + eax*4 - 4]
mov dword [ebp - 8], edi
not ebx
movzx eax, byte [edx]
lea edx, [edx + 1]
movzx ecx, bl
xor ecx, eax
shr ebx, 8
xor ebx, dword [ecx*4 + 0x102ebd00]
sub esi, 1
jne 0x10187b53
mov eax, dword [0x106c40f4]
not ebx
cmp dword [eax + 0x3e6c], ebx
jne 0x10187b89
push esi
push edi
push 4
push ebx
call fcn.10185690
add esp, 0x10
mov ecx, dword [ebp - 4]
mov eax, ebx
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10229364
mov esp, ebp
pop ebp
ret 4

Function at 0x10187c00
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x106c15c0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
mov edx, ecx
push esi
push edi
lea esi, [ebp - 0x14]
mov edi, 0x10
movss xmm1, dword [edx + 0x108]
movss xmm0, dword [eax]
movss xmm2, dword [edx + 0x10c]
subss xmm0, xmm1
mov ecx, dword [edx + 0xec]
movss dword [ebp - 0x14], xmm0
movss xmm0, dword [eax + 4]
subss xmm0, xmm2
movss dword [ebp - 0x10], xmm0
movss xmm0, dword [eax + 8]
subss xmm0, xmm1
movss dword [ebp - 0xc], xmm0
movss xmm0, dword [eax + 0xc]
mov eax, dword [edx + 0xf4]
subss xmm0, xmm2
mov edx, dword [eax + ecx*4 - 4]
movss dword [ebp - 8], xmm0
not edx
nop dword [eax + eax]
movzx eax, byte [esi]
lea esi, [esi + 1]
movzx ecx, dl
xor ecx, eax
shr edx, 8
xor edx, dword [ecx*4 + 0x102ebd00]
sub edi, 1
jne 0x10187c80
mov ecx, dword [ebp - 4]
not edx
pop edi
xor ecx, ebp
mov eax, edx
pop esi
call fcn.10229364
mov esp, ebp
pop ebp
ret 4

Function at 0x10187cb0
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [0x106c15c0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 0xc]
lea edx, [ebp - 8]
push esi
push edi
mov edi, dword [ebp + 8]
not ebx
mov dword [ebp - 8], edi
mov esi, 4
movzx eax, byte [edx]
lea edx, [edx + 1]
movzx ecx, bl
xor ecx, eax
shr ebx, 8
xor ebx, dword [ecx*4 + 0x102ebd00]
sub esi, 1
jne 0x10187cd6
mov eax, dword [0x106c40f4]
not ebx
cmp dword [eax + 0x3e6c], ebx
jne 0x10187d0c
push esi
push edi
push 4
push ebx
call fcn.10185690
add esp, 0x10
mov ecx, dword [ebp - 4]
mov eax, ebx
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10229364
mov esp, ebp
pop ebp
ret