joyce8/EMBER2024-capa huggingface dataset:
Function at 0x519043
Capabilities:
Get common file path

Disassembly:
push 0x224
mov eax, 0x56571c
call fcn.00542c18
mov esi, ecx
mov dword [ebp - 0x22c], esi
call fcn.0051eb70
push 0x15c
call fcn.00441ee5
pop ecx
mov ecx, eax
mov dword [ebp - 0x228], ecx
xor ebx, ebx
mov dword [ebp - 4], ebx
cmp ecx, ebx
je 0x519087
mov eax, dword [esi + 4]
push ebx
push eax
call fcn.00520548
jmp 0x519089
xor eax, eax
or dword [ebp - 4], 0xffffffff
push eax
mov ecx, esi
call fcn.0051eb42
call fcn.004548a7
mov eax, dword [eax + 4]
mov edi, dword [eax + 0x88]
lea eax, [ebp - 0x218]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov esi, eax
push 0x5c
pop eax
mov word [ebp + esi*2 - 0x218], ax
inc esi
xor eax, eax
mov dword [ebp - 0x228], esi
mov word [ebp + esi*2 - 0x218], ax
mov dword [ebp - 0x224], ebx
cmp edi, ebx
je 0x519229
cmp dword [edi + 4], ebx
jle 0x519229
lea ecx, [ebp - 0x21c]
call fcn.00403c90
mov edx, dword [edi]
xor eax, eax
inc eax
push eax
mov dword [ebp - 4], eax
push esi
lea eax, [ebp - 0x218]
push eax
push ebx
lea eax, [ebp - 0x21c]
push eax
mov ecx, edi
call dword [edx + 8]
test eax, eax
je 0x51920d
lea ecx, [ebp - 0x220]
call fcn.00403c90
mov eax, dword [ebp - 0x224]
mov byte [ebp - 4], 2
cmp eax, 9
jne 0x51915e
push dword [ebp - 0x21c]
lea eax, [ebp - 0x220]
push str.10__s
push eax
call fcn.00403920
add esp, 0xc
jmp 0x519190
jge 0x51917e
push dword [ebp - 0x21c]
inc eax
push eax
lea eax, [ebp - 0x220]
push 0x57c9d0
push eax
call fcn.00403920
add esp, 0x10
jmp 0x519190
lea eax, [ebp - 0x21c]
push eax
lea ecx, [ebp - 0x220]
call fcn.0040bbf0
push 0x15c
call fcn.00441ee5
pop ecx
mov dword [ebp - 0x230], eax
mov byte [ebp - 4], 3
test eax, eax
je 0x5191b4
mov ecx, eax
call fcn.004f1ffa
mov esi, eax
jmp 0x5191b6
xor esi, esi
push dword [ebp - 0x220]
mov eax, dword [esi]
mov ecx, esi
mov byte [ebp - 4], 2
call dword [eax + 0x10]
mov eax, dword [esi]
lea ecx, [ebx + 0xe110]
push ecx
mov ecx, esi
call dword [eax + 0xc]
push ebx
mov ecx, edi
call fcn.00453e88
mov eax, dword [eax]
mov edx, dword [esi]
push eax
mov ecx, esi
call dword [edx + 0x24]
mov ecx, dword [ebp - 0x22c]
push esi
call fcn.0051eb42
mov ecx, dword [ebp - 0x220]
inc dword [ebp - 0x224]
add ecx, 0xfffffff0
call fcn.00403c70
mov esi, dword [ebp - 0x228]
mov ecx, dword [ebp - 0x21c]
or dword [ebp - 4], 0xffffffff
add ecx, 0xfffffff0
call fcn.00403c70
inc ebx
cmp ebx, dword [edi + 4]
jl 0x5190f7
call fcn.00542c9b
ret
Function at 0x51dcd3
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ebx
push esi
mov esi, dword [ebp + 8]
test byte [esi + 4], 1
push edi
mov ebx, ecx
je 0x51dceb
mov edi, dword [esi + 0xc]
jmp 0x51dd2b
push 5
push dword [esi + 0xc]
push dword [esi + 8]
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov edi, eax
test edi, edi
jne 0x51dd04
call fcn.00443eab
push edi
push dword [esi + 8]
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov edi, eax
test edi, edi
jne 0x51dd19
call fcn.00443eab
push edi
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
test edi, edi
jne 0x51dd2b
call fcn.00443eab
call fcn.004548a7
cmp dword [eax + 0x3c], 0
je 0x51dd40
push edi
mov ecx, ebx
call fcn.0051cb2b
mov edi, eax
push dword [ebp + 0xc]
push edi
call fcn.0051dbf9
mov dword [ebp + 8], eax
mov eax, dword [ebx + 0x5c]
test eax, eax
je 0x51dd5e
push eax
call dword [sym.imp.KERNEL32.dll_GlobalFree]
and dword [ebx + 0x5c], 0
mov eax, dword [ebp + 8]
test eax, eax
je 0x51dd6a
mov edi, eax
mov dword [ebx + 0x5c], eax
or dword [esi + 4], 1
mov dword [esi + 0xc], edi
pop edi
pop esi
pop ebx
pop ebp
ret 8
Function at 0x525380
Capabilities:
Log keystrokes via polling

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
cmp dword [ebx + 4], 0x20a
push esi
mov esi, ecx
jne 0x5253ca
mov eax, dword [esi + 0x54]
mov ecx, dword [eax + 0xb4]
test ecx, ecx
je 0x5253ca
call fcn.00524c3b
test eax, eax
je 0x5253ca
push dword [ebx + 0xc]
mov eax, dword [esi + 0x54]
push dword [ebx + 8]
mov ecx, dword [eax + 0xb4]
push dword [ebx + 4]
call fcn.0042e9c0
xor eax, eax
inc eax
jmp 0x5255e2
cmp dword [ebx + 4], 0x100
push edi
jne 0x5255d9
mov edi, dword [sym.imp.USER32.dll_GetKeyState]
push 0x12
call edi
test ax, ax
jl 0x5254c7
push 0x11
call edi
test ax, ax
jl 0x5254c7
mov eax, dword [esi + 0x54]
mov ecx, dword [eax + 0xb4]
test ecx, ecx
je 0x5254c7
mov eax, dword [ebx + 8]
cmp eax, 0xd
je 0x52543a
cmp eax, 0x20
jbe 0x5254c7
cmp eax, 0x24
jbe 0x52542d
cmp eax, 0x26
je 0x52542d
cmp eax, 0x28
jne 0x5254c7
call fcn.00524c3b
test eax, eax
je 0x5254c7
mov ecx, esi
call fcn.0044b927
mov eax, dword [esi + 0x54]
mov ecx, dword [eax + 0xb4]
call fcn.00524c3b
test eax, eax
mov eax, dword [esi + 0x54]
mov ecx, dword [eax + 0xb4]
je 0x52546f
push dword [ebx + 0xc]
push dword [ebx + 8]
push dword [ebx + 4]
call fcn.0042e9c0
jmp 0x5255d4
call fcn.0044989e
test eax, eax
je 0x5255d4
mov eax, dword [esi + 0x54]
add eax, 0xb8
push eax
mov ecx, esi
call fcn.004498fb
mov eax, dword [esi + 0x54]
mov eax, dword [eax + 0xb4]
test eax, eax
jne 0x52549d
xor edi, edi
jmp 0x5254a0
mov edi, dword [eax + 0x20]
mov esi, dword [esi + 0x54]
mov ecx, dword [esi + 0xb4]
movzx esi, word [esi + 0x20]
call fcn.0044989e
push edi
push esi
push 0x111
push dword [eax + 0x20]
call dword [sym.imp.USER32.dll_PostMessageW]
jmp 0x5255d4
mov eax, dword [ebx + 8]
sub eax, 9
je 0x5255a3
sub eax, 0x12
je 0x52557b
sub eax, 0xb
je 0x5254e9
dec eax
dec eax
jne 0x5255d9
push 0x12
call edi
test ax, ax
jl 0x5255d9
push 0x11
call edi
test ax, ax
jl 0x5255d9
mov eax, dword [esi + 0x54]
mov ecx, dword [eax + 0xb4]
test ecx, ecx
je 0x5255d9
call fcn.00524c3b
test eax, eax
jne 0x5255d4
mov eax, dword [esi + 0x54]
mov ecx, dword [eax + 0xb4]
push 1
call fcn.00524bb5
mov eax, dword [esi + 0x54]
mov eax, dword [eax + 0xb4]
push dword [eax + 0x20]
mov edi, dword [sym.imp.USER32.dll_GetParent]
call edi
push eax
call fcn.00448211
test eax, eax
je 0x5255d4
mov esi, dword [esi + 0x54]
lea ebx, [esi + 0x90]
mov esi, dword [esi + 0xb4]
push dword [esi + 0x20]
call edi
push eax
call fcn.00448211
push 1
push ebx
push dword [eax + 0x20]
call dword [sym.imp.USER32.dll_InvalidateRect]
jmp 0x5255d4
mov eax, dword [esi + 0x54]
mov ecx, dword [eax + 0xb4]
test ecx, ecx
je 0x52558f
push 0
call fcn.00524bb5
mov ecx, esi
call fcn.0044936c
test eax, eax
je 0x5255d9
mov ecx, esi
call fcn.0044936c
jmp 0x5255cd
push dword [esi + 0x20]
mov edi, dword [sym.imp.USER32.dll_GetParent]
call edi
push eax
call fcn.00448211
test eax, eax
je 0x5255d9
push dword [esi + 0x20]
call edi
push eax
call fcn.00448211
push 0
push esi
mov ecx, eax
call fcn.00443283
mov ecx, eax
call fcn.0044b927
xor eax, eax
inc eax
jmp 0x5255e1
push ebx
mov ecx, esi
call fcn.00446031
pop edi
pop esi
pop ebx
pop ebp
ret 4
Function at 0x532744
Capabilities:
Log keystrokes via polling
Open clipboard
Write clipboard data

Disassembly:
push 4
mov eax, 0x55b423
call fcn.00542baf
mov edi, ecx
mov esi, dword [ebp + 8]
cmp dword [esi + 4], 0x100
jne 0x53281d
mov ebx, dword [esi + 8]
push 0x11
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
and eax, 0x8000
je 0x53281d
cmp ebx, 0x43
je 0x532786
cmp ebx, 0x2d
jne 0x53281d
push dword [edi + 0x20]
call dword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je 0x53281d
call dword [sym.imp.USER32.dll_EmptyClipboard]
lea ecx, [ebp - 0x10]
call fcn.00403c90
movzx ecx, byte [edi + 0xae]
and dword [ebp - 4], 0
push ecx
lea eax, [edi + 0xac]
movzx ecx, byte [eax + 1]
movzx eax, byte [eax]
push ecx
push eax
lea eax, [ebp - 0x10]
push str.RGB__d___d___d_
push eax
call fcn.00403920
mov esi, dword [ebp - 0x10]
mov eax, dword [esi - 0xc]
add esp, 0x14
lea eax, [eax + eax + 2]
push eax
push 0x2000
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov ebx, eax
push ebx
call dword [sym.imp.KERNEL32.dll_GlobalLock]
push esi
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
push ebx
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
push ebx
push 0xd
call dword [sym.imp.USER32.dll_SetClipboardData]
call dword [sym.imp.USER32.dll_CloseClipboard]
or dword [ebp - 4], 0xffffffff
lea ecx, [esi - 0x10]
call fcn.00403c70
mov esi, dword [ebp + 8]
push esi
mov ecx, edi
call fcn.004b2c02
call fcn.00542c87
ret 4

Function at 0x53a72b
Capabilities:
Log keystrokes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
mov esi, ecx
mov eax, dword [esi]
push edi
call dword [eax + 0x150]
mov edi, eax
movzx eax, word [ebp + 8]
push 2
push eax
call dword [sym.imp.USER32.dll_MapVirtualKeyW]
cmp byte [ebp + 0xc], 0
movzx eax, ax
jne 0x53a770
test edi, edi
jl 0x53a770
cmp ax, 0x20
je 0x53a765
cmp word [ebp + 8], 0x71
jne 0x53a770
mov eax, dword [esi]
push edi
mov ecx, esi
call dword [eax + 0x168]
pop edi
pop esi
pop ebp
ret 8

Function at 0x53fb0e
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x5c96a4]
jne 0x53fb18
repz ret
jmp fcn.005482f6
Function at 0x553da8
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.00547c5a
and dword [ebp - 4], 0
cmp dword [0x5d1698], 0
mov ebx, eax
jne 0x553e59
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x553f0a
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x553f0a
push eax
call fcn.00547be8
mov dword [esp], 0x597010
push edi
mov dword [0x5d1698], eax
call esi
push eax
call fcn.00547be8
mov dword [esp], 0x596ffc
push edi
mov dword [0x5d169c], eax
call esi
push eax
call fcn.00547be8
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x5d16a0], eax
call esi
push eax
call fcn.00547be8
pop ecx
mov dword [0x5d16a8], eax
test eax, eax
je 0x553e59
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.00547be8
pop ecx
mov dword [0x5d16a4], eax
mov eax, dword [0x5d16a4]
cmp eax, ebx
je 0x553eb1
cmp dword [0x5d16a8], ebx
je 0x553eb1
push eax
call fcn.00547c63
push dword [0x5d16a8]
mov esi, eax
call fcn.00547c63
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x553eb1
test edi, edi
je 0x553eb1
call esi
test eax, eax
je 0x553ea8
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x553ea8
test byte [ebp - 0xc], 1
jne 0x553eb1
or dword [ebp + 0x10], 0x200000
jmp 0x553eea
mov eax, dword [0x5d169c]
cmp eax, ebx
je 0x553eea
push eax
call fcn.00547c63
pop ecx
test eax, eax
je 0x553eea
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x553eea
mov eax, dword [0x5d16a0]
cmp eax, ebx
je 0x553eea
push eax
call fcn.00547c63
pop ecx
test eax, eax
je 0x553eea
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x5d1698]
call fcn.00547c63
pop ecx
test eax, eax
je 0x553f0a
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x553f0c
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x407010
Capabilities:
Enumerate pe sections

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
xor edx, edx
push ebx
push esi
push edi
mov ecx, dword [eax + 0x3c]
add ecx, eax
movzx eax, word [ecx + 0x14]
movzx ebx, word [ecx + 6]
add eax, 0x18
add eax, ecx
test ebx, ebx
je 0x40704e
mov edi, dword [ebp + 0xc]
mov esi, dword [eax + 0xc]
cmp edi, esi
jb 0x407046
mov ecx, dword [eax + 8]
add ecx, esi
cmp edi, ecx
jb 0x407050
inc edx
add eax, 0x28
cmp edx, ebx
jb 0x407036
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x407120
Capabilities:
Parse pe header

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov ecx, dword [ebp + 8]
mov eax, 0x5a4d
cmp word [ecx], ax
jne 0x407151
mov eax, dword [ecx + 0x3c]
add eax, ecx
cmp dword [eax], 0x4550
jne 0x407151
mov ecx, 0x10b
cmp word [eax + 0x18], cx
jne 0x407151
mov eax, 1
pop ebp
ret
xor eax, eax
pop ebp
ret

Function at 0x100010e3
Capabilities:
Check mutex on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffffc
push dword [ebp + 8]
push 0
push 0
call sub.kernel32.dll_CreateMutexA
mov dword [ebp - 4], eax
or eax, eax
je 0x10001115
call sub.kernel32.dll_GetLastError
cmp eax, 0xb7
jne 0x10001115
push dword [ebp - 4]
call fcn.100010c6
push 0
pop dword [ebp - 4]
mov eax, dword [ebp - 4]
leave
ret 4

Function at 0x10001134
Capabilities:
Create process on windows
Create process suspended

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffac
push 0x44
lea eax, [ebp - 0x44]
push eax
call fcn.1000111c
push 0x10
lea eax, [ebp - 0x54]
push eax
call fcn.1000111c
lea eax, [ebp - 0x54]
push eax
lea eax, [ebp - 0x44]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
push dword [ebp + 8]
push 0
call sub.kernel32.dll_CreateProcessA
lea edi, [ebp - 0x54]
push dword [edi]
push dword [edi + 4]
call sub.kernel32.dll_CloseHandle
call sub.kernel32.dll_CloseHandle
leave
ret 4
Function at 0x1002d530
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100bbc31
mov eax, dword fs:[0]
push eax
push ecx
mov eax, dword [0x100d7040]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [edx]
xorps xmm0, xmm0
mov dword [ecx + 0xc], 0
mov dword [ecx + 0x14], 0
mov dword [ecx + 0x30], 0
mov dword [ecx + 0x34], 0
mov dword [ecx + 0x38], 0
mov dword [ecx + 0x3c], 0
mov dword [ecx + 0x40], 0
mov dword [ecx + 0x44], 0
mov dword [ecx + 0x48], 0
mov dword [ecx + 0x4c], 0
mov dword [ecx + 0x50], 0
mov dword [ecx + 0x54], 0
mov dword [ecx + 0x58], 0
mov dword [ecx + 0x5c], 0
mov dword [ecx + 0x60], 0
mov dword [ecx + 0x64], 0
mov dword [ecx + 0x68], 0
mov dword [ecx + 0x70], 0
mov dword [ecx + 0x74], 0
mov dword [ecx + 0x78], 0
mov dword [ecx + 0x7c], 0
mov dword [ecx + 0x80], 0
mov dword [ecx + 0x84], 0
movups xmmword [ecx + 0x90], xmm0
mov dword [ecx + 0xa0], 0
mov dword [ecx + 0xa4], 0xf
mov dword [ebp - 0x10], ecx
mov byte [ecx + 0x90], 0
mov dword [ebp - 4], 0
movups xmmword [ecx + 0xa8], xmm0
mov dword [ecx + 0xb8], 0
mov dword [ecx + 0xbc], 0xf
mov byte [ecx + 0xa8], 0
mov byte [ebp - 4], 1
mov word [ecx + 0xc1], 0
mov byte [ecx + 0xc3], 0
mov dword [ecx + 0xc0], 0
mov dword [ecx + 0x400], 0
mov dword [ecx + 0x404], 0
mov dword [ecx + 0x408], 0
mov dword [ecx + 0x40c], 0
mov dword [ecx + 0x410], 0
mov dword [ecx + 0x414], 0
mov dword [ecx + 0x418], 0
mov dword [ecx + 0x41c], 0
mov byte [ecx + 0x420], 0
push eax
mov byte [ecx + 0x3424], 0
mov dword [ecx + 0x3428], 0
mov dword [ecx + 0x342c], 0
mov dword [ecx + 0x3430], 0
mov dword [ecx + 0x3434], 0
mov dword [ecx + 0x3438], 0
mov dword [ecx + 0x343c], 0
mov byte [ecx + 0x344d], 0
mov byte [ecx + 0x3458], 0
mov byte [ecx + 0x3744], 0
mov dword [ecx + 0x3748], 0
mov dword [ecx + 0x374c], 0
mov dword [ecx + 0x3750], 0
mov dword [ecx + 0x3754], 0
mov dword [ecx + 0x3758], 0
mov dword [ecx + 0x375c], 0
mov byte [ecx + 0x3764], 0
mov dword [ecx + 0x3774], 0
mov byte [ecx + 0x377a], 0
mov dword [ecx + 0x377c], 0
mov dword [ecx + 0x3780], 0
call fcn.10024410
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
Function at 0x1002db00
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [ebp + 8]
push ebx
push esi
mov dword [ebp - 0x10], eax
mov ebx, ecx
dec eax
push edi
mov edi, edx
mov dword [ebp - 0x14], eax
mov edx, dword [ebp + 0xc]
mov esi, edi
sar eax, 1
mov ecx, edi
mov dword [ebp - 4], edx
mov dword [ebp - 8], esi
mov dword [ebp - 0xc], eax
cmp edi, eax
jge 0x1002db5e
nop dword [eax]
lea esi, [ecx + ecx]
push dword [ebx + esi*4 + 4]
push dword [ebx + esi*4 + 8]
call fcn.100274a0
movzx ecx, al
xor ecx, 1
inc ecx
add ecx, esi
mov eax, dword [ebx + ecx*4]
mov dword [ebx + edi*4], eax
mov edi, ecx
mov eax, dword [ebp - 0xc]
cmp ecx, eax
jl 0x1002db30
mov edx, dword [ebp - 4]
mov esi, dword [ebp - 8]
mov edi, ecx
cmp ecx, eax
jne 0x1002db75
mov eax, dword [ebp - 0x10]
test al, 1
jne 0x1002db75
mov eax, dword [ebx + eax*4 - 4]
mov edi, dword [ebp - 0x14]
mov dword [ebx + ecx*4], eax
cmp esi, edi
jge 0x1002dbc0
nop dword [eax]
push dword [edx]
lea esi, [edi - 1]
sar esi, 1
push dword [ebx + esi*4]
call fcn.100274a0
test al, al
je 0x1002dbb1
mov eax, dword [ebx + esi*4]
mov edx, dword [ebp - 4]
mov dword [ebx + edi*4], eax
mov edi, esi
cmp dword [ebp - 8], esi
jl 0x1002db80
mov eax, edx
mov eax, dword [eax]
mov dword [ebx + edi*4], eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 4]
mov eax, dword [eax]
mov dword [ebx + edi*4], eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [edx]
mov dword [ebx + edi*4], eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10034c60
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x100d7040]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, ecx
cmp dword [esi + 0x38], 0
je 0x10034d1c
cmp byte [esi + 0x3d], 0
je 0x10034d1c
mov eax, dword [esi]
push edi
push 0xffffffffffffffff
call dword [eax + 0xc]
cmp eax, 0xffffffff
je 0x10034d0a
mov ecx, dword [esi + 0x38]
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [esi + 0x40]
push eax
call dword [sym.imp.MSVCP140.dll_public:_int___thiscall_std::codecvt_char__char__struct__Mbstatet_::unshift_struct__Mbstatet___char___char___char___const]
sub eax, 0
je 0x10034cd1
sub eax, 1
je 0x10034cd5
sub eax, 2
jne 0x10034d0a
mov byte [esi + 0x3d], al
mov al, 1
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100b923c
mov esp, ebp
pop ebp
ret
mov byte [esi + 0x3d], 0
mov edi, dword [ebp - 0x28]
lea eax, [ebp - 0x24]
sub edi, eax
je 0x10034cf3
push dword [esi + 0x4c]
push edi
push 1
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
add esp, 0x10
cmp edi, eax
jne 0x10034d0a
cmp byte [esi + 0x3d], 0
pop edi
sete al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100b923c
mov esp, ebp
pop ebp
ret
pop edi
xor al, al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100b923c
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
mov al, 1
xor ecx, ebp
pop esi
call fcn.100b923c
mov esp, ebp
pop ebp
ret
Function at 0x100377c0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
cmp byte [0x100f0274], 0
push ebx
push esi
push edi
je 0x1003794e
mov ecx, dword [0x10159ecc]
mov eax, dword [ecx]
mov eax, dword [eax + 0x68]
call eax
test al, al
je 0x1003794e
mov ecx, dword [0x10159f54]
xor ebx, ebx
mov dword [ebp - 4], ecx
mov eax, dword [ecx + 0x28]
mov dword [ebp - 8], eax
test eax, eax
je 0x1003794e
mov eax, dword [ecx + 0x1c]
mov ecx, dword [eax + ebx*4]
mov eax, dword [ecx]
mov eax, dword [eax + 0x30]
call eax
mov esi, eax
mov edi, 0x811c9dc5
xor ecx, ecx
nop word [eax + eax]
inc ecx
cmp byte [esi + ecx], 0
jne 0x10037820
xor edx, edx
test ecx, ecx
je 0x10037849
nop dword [eax]
movsx eax, byte [esi + edx]
inc edx
xor eax, edi
imul edi, eax, 0x1000193
cmp edx, ecx
jb 0x10037830
cmp edi, 0x5ff56dc5
je 0x10037858
inc ebx
cmp ebx, dword [ebp - 8]
jae 0x1003794e
mov ecx, dword [ebp - 4]
jmp 0x10037804
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x1c]
mov edi, dword [eax + ebx*4]
test edi, edi
je 0x1003794e
mov edx, dword [edi + 0x88]
test edx, edx
je 0x1003794e
movss xmm1, dword [0x100ccd50]
xor ebx, ebx
cmp edx, 4
jl 0x1003791b
mov ecx, dword [edi + 0x7c]
lea esi, [edx - 4]
shr esi, 2
add ecx, 0x1078
inc esi
lea ebx, [esi*4]
movss xmm0, dword [ecx - 0xc60]
ucomiss xmm0, xmm1
lahf
test ah, 0x44
jp 0x100378bc
mov dword [ecx - 0xc60], 0x7f7fffff
movss xmm0, dword [ecx - 0x840]
ucomiss xmm0, xmm1
lahf
test ah, 0x44
jp 0x100378d7
mov dword [ecx - 0x840], 0x7f7fffff
movss xmm0, dword [ecx - 0x420]
ucomiss xmm0, xmm1
lahf
test ah, 0x44
jp 0x100378f2
mov dword [ecx - 0x420], 0x7f7fffff
movss xmm0, dword [ecx]
ucomiss xmm0, xmm1
lahf
test ah, 0x44
jp 0x10037905
mov dword [ecx], 0x7f7fffff
add ecx, 0x1080
sub esi, 1
jne 0x100378a1
cmp ebx, edx
jl 0x1003791f
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
test edx, edx
jle 0x1003794e
imul ecx, ebx, 0x420
add ecx, 0x418
add ecx, dword [edi + 0x7c]
sub edx, ebx
movss xmm0, dword [ecx]
ucomiss xmm0, xmm1
lahf
test ah, 0x44
jp 0x10037943
mov dword [ecx], 0x7f7fffff
add ecx, 0x420
sub edx, 1
jne 0x10037930
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10037cd0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [0x1015ef98]
sub esp, 0xc
push ebx
push esi
push edi
test al, 1
jne 0x10037d51
or eax, 1
mov dword [0x1015ef98], eax
mov ebx, dword [0x10159ec8]
mov ebx, dword [ebx + 0x30]
test ebx, ebx
je 0x10037d49
nop word [eax + eax]
mov edi, dword [ebx + 0xc]
mov esi, 0x811c9dc5
xor ecx, ecx
nop word [eax + eax]
inc ecx
cmp byte [edi + ecx], 0
jne 0x10037d10
xor edx, edx
test ecx, ecx
je 0x10037d3d
nop dword [eax]
movsx eax, byte [edi + edx]
inc edx
xor eax, esi
imul esi, eax, 0x1000193
cmp edx, ecx
jb 0x10037d20
cmp esi, 0xa9bf35
je 0x10037dd3
mov ebx, dword [ebx + 4]
test ebx, ebx
jne 0x10037d00
mov eax, dword [0x1015ef98]
xor ebx, ebx
mov dword [0x1015ef94], ebx
test al, 2
jne 0x10037dbd
or eax, 2
mov dword [0x1015ef98], eax
mov ecx, dword [0x10159ec8]
mov ebx, dword [ecx + 0x30]
test ebx, ebx
je 0x10037db5
nop word [eax + eax]
mov edi, dword [ebx + 0xc]
mov esi, 0x811c9dc5
xor ecx, ecx
nop word [eax + eax]
inc ecx
cmp byte [edi + ecx], 0
jne 0x10037d80
xor edx, edx
test ecx, ecx
je 0x10037da9
nop dword [eax]
movsx eax, byte [edi + edx]
inc edx
xor eax, esi
imul esi, eax, 0x1000193
cmp edx, ecx
jb 0x10037d90
cmp esi, 0xe5abc68c
je 0x10037ddd
mov ebx, dword [ebx + 4]
test ebx, ebx
jne 0x10037d70
mov eax, dword [0x1015ef98]
xor ebx, ebx
mov dword [0x1015ef90], ebx
test al, 4
jne 0x10037e28
or eax, 4
mov dword [0x1015ef98], eax
mov eax, dword [0x10159ec8]
mov ebx, dword [eax + 0x30]
jmp 0x10037e1c
mov eax, dword [0x1015ef98]
jmp 0x10037d4b
mov eax, dword [0x1015ef98]
jmp 0x10037db7
mov edi, dword [ebx + 0xc]
mov esi, 0x811c9dc5
xor ecx, ecx
nop
inc ecx
cmp byte [edi + ecx], 0
jne 0x10037df0
xor edx, edx
test ecx, ecx
je 0x10037e19
nop dword [eax]
movsx eax, byte [edi + edx]
inc edx
xor eax, esi
imul esi, eax, 0x1000193
cmp edx, ecx
jb 0x10037e00
cmp esi, 0xadc3dc05
je 0x10037e20
mov ebx, dword [ebx + 4]
test ebx, ebx
jne 0x10037de4
mov dword [0x1015ef88], ebx
jmp 0x10037e2e
mov ebx, dword [0x1015ef88]
mov eax, dword [ebx]
mov ecx, ebx
mov eax, dword [eax + 0x30]
call eax
mov ecx, dword [0x1015ef90]
fstp dword [ebp - 8]
mov eax, dword [ecx]
mov eax, dword [eax + 0x30]
mov dword [ebp - 4], eax
call dword [ebp - 4]
mov ecx, dword [0x1015ef94]
fstp dword [ebp - 0xc]
mov eax, dword [ecx]
mov eax, dword [eax + 0x30]
mov dword [ebp - 4], eax
call dword [ebp - 4]
movss xmm0, dword [ebp - 8]
sub esp, 8
divss xmm0, dword [ebp - 0xc]
fstp dword [ebp - 4]
movss dword [esp + 4], xmm0
movss xmm0, dword [ebp - 4]
movss dword [esp], xmm0
call dword [sym.imp.api_ms_win_crt_math_l1_1_0.dll_fmaxf]
add esp, 8
fstp dword [0x100da960]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret