joyce8/EMBER2024-capa huggingface dataset:
Function at 0xc1ec14
Capabilities:
Hash data with md5

Disassembly:
lea edx, [eax + 0x20]
mov ecx, edx
add ecx, 0x40
mov dword [edx], 0
mov dword [edx + 4], 0
add edx, 8
cmp ecx, edx
jne 0xc1ec1c
mov dword [eax + 0x18], 0
mov dword [eax + 0x1c], 0
mov dword [eax + 4], 0x67452301
mov dword [eax + 8], 0xefcdab89
mov dword [eax + 0xc], 0x98badcfe
mov dword [eax + 0x10], 0x10325476
ret

Function at 0xc24b84
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
xor edx, edx
mov dword [ebp - 8], edx
mov byte [ebp - 1], al
xor eax, eax
push ebp
push 0x45dbe1
push dword fs:[eax]
mov dword fs:[eax], esp
cmp byte [0x667994], 0
jne 0xc24bfd
mov byte [ebp - 0xa], 0
mov byte [ebp - 9], 0
xor eax, eax
mov al, byte [ebp - 9]
xor edx, edx
mov dl, byte [ebp - 0xa]
imul edx, edx, 0xb
lea edx, [edx*4 + 0x676308]
lea eax, [edx + eax*4]
call fcn.00bcda20
xor eax, eax
mov al, byte [ebp - 9]
xor edx, edx
mov dl, byte [ebp - 0xa]
imul edx, edx, 0xb
add edx, 0x676360
mov byte [edx + eax], 0
inc byte [ebp - 9]
cmp byte [ebp - 9], 0xb
jne 0xc24bb1
inc byte [ebp - 0xa]
cmp byte [ebp - 0xa], 2
jne 0xc24bad
mov byte [0x667994], 1
mov eax, dword [ebp + 8]
movzx eax, byte [eax - 1]
xor edx, edx
mov dl, byte [ebp - 1]
imul edx, edx, 0xb
add edx, 0x676360
cmp byte [edx + eax], 0
jne 0xc24c8b
mov eax, dword [ebp + 8]
movzx eax, byte [eax - 1]
xor edx, edx
mov dl, byte [ebp - 1]
imul edx, edx, 0xb
lea edx, [edx*4 + 0x667998]
mov eax, dword [edx + eax*4]
mov edx, dword [ebp + 8]
mov dl, byte [edx - 2]
xor dl, 1
lea ecx, [ebp - 8]
call fcn.00c24a94
mov eax, dword [ebp + 8]
movzx eax, byte [eax - 1]
xor edx, edx
mov dl, byte [ebp - 1]
imul edx, edx, 0xb
lea edx, [edx*4 + 0x676308]
lea eax, [edx + eax*4]
mov edx, dword [ebp - 8]
call fcn.00bcdde4
mov eax, dword [ebp + 8]
cmp byte [eax - 2], 0
je 0xc24c72
cmp dword [ebp - 8], 0
je 0xc24c8b
mov eax, dword [ebp + 8]
movzx eax, byte [eax - 1]
xor edx, edx
mov dl, byte [ebp - 1]
imul edx, edx, 0xb
add edx, 0x676360
mov byte [edx + eax], 1
mov eax, dword [ebp + 8]
mov eax, dword [eax + 8]
mov edx, dword [ebp + 8]
movzx edx, byte [edx - 1]
xor ecx, ecx
mov cl, byte [ebp - 1]
imul ecx, ecx, 0xb
lea ecx, [ecx*4 + 0x676308]
mov edx, dword [ecx + edx*4]
call fcn.00bcdde4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x45dbe8
lea eax, [ebp - 8]
call fcn.00bcda20
ret

Function at 0xc2cf24
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
xor eax, eax
mov ecx, edx
test ecx, ecx
je 0xc2cf33
sub ecx, 4
mov ecx, dword [ecx]
test ecx, ecx
jle 0xc2cf54
mov ebx, 1
mov esi, eax
add esi, esi
add esi, esi
shr eax, 0x1e
or esi, eax
movzx eax, word [edx + ebx*2 - 2]
xor esi, eax
mov eax, esi
inc ebx
dec ecx
jne 0xc2cf3c
pop esi
pop ebx
ret
Function at 0xcb62a4
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push 0
push ebx
push esi
push edi
mov ebx, edx
mov edi, eax
xor eax, eax
push ebp
push 0x4ef287
push dword fs:[eax]
mov dword fs:[eax], esp
push dword [edi + 0xc]
push 0x4ef2a4
lea edx, [ebp - 0xc]
mov eax, dword [edi + 0x30]
call fcn.00be2844
mov edx, dword [ebp - 0xc]
lea eax, [ebp - 8]
mov ecx, 0
call fcn.00bce528
push dword [ebp - 8]
push 0x4ef2a4
push dword [edi + 0x2c]
mov eax, dword [0x66b8a8]
push dword [eax]
mov eax, ebx
mov edx, 6
call fcn.00bce1dc
mov eax, dword [edi + 0x34]
call fcn.00bcf8e0
mov esi, eax
dec esi
test esi, esi
jl 0xcb633e
inc esi
mov dword [ebp - 4], 0
push dword [ebx]
mov eax, dword [edi + 0x34]
mov edx, dword [ebp - 4]
push dword [eax + edx*4]
mov eax, dword [0x66b8a8]
push dword [eax]
mov eax, ebx
mov edx, 3
call fcn.00bce1dc
inc dword [ebp - 4]
dec esi
jne 0xcb631a
mov eax, ebx
mov edx, dword [0x66b8a8]
mov edx, dword [edx]
call fcn.00bce100
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4ef28e
lea eax, [ebp - 0xc]
call fcn.00bcda20
lea eax, [ebp - 8]
call fcn.00bcda44
ret

Function at 0xcc88c4
Capabilities:
Encode data using xor

Disassembly:
push ebx
mov ebx, eax
mov ecx, 0x10
mov eax, dword [edx]
xchg ah, al
rol eax, 0x10
xchg ah, al
mov dword [ebx], eax
add ebx, 4
add edx, 4
dec ecx
jne 0xcc88cc
mov ecx, 0x40
mov eax, dword [ebx - 0xc]
xor eax, dword [ebx - 0x20]
xor eax, dword [ebx - 0x38]
xor eax, dword [ebx - 0x40]
rol eax, 1
mov dword [ebx], eax
add ebx, 4
dec ecx
jne 0xcc88e5
pop ebx
ret
Function at 0xcc8e64
Capabilities:
Hash data using sha1

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, eax
mov eax, ebx
xor ecx, ecx
mov edx, 0xd4
call fcn.00bcc010
mov dword [ebx], 0x67452301
mov dword [ebx + 4], 0xefcdab89
mov dword [ebx + 8], 0x98badcfe
mov dword [ebx + 0xc], 0x10325476
mov dword [ebx + 0x10], 0xc3d2e1f0
pop ebx
pop ebp
ret

Function at 0xcdcee4
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd8
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov byte [ebp - 9], 0
lea eax, [ebp - 0x27]
mov edx, 0x1e
call fcn.00bf9be4
mov dword [ebp - 0x27], 0x4034b50
mov eax, dword [ebp - 4]
movzx eax, byte [eax + 6]
mov word [ebp - 0x23], ax
mov eax, dword [ebp - 4]
mov ax, word [eax + 8]
mov word [ebp - 0x21], ax
mov eax, dword [ebp - 4]
mov ax, word [eax + 0xa]
mov word [ebp - 0x1f], ax
mov eax, dword [ebp - 4]
mov ax, word [eax + 0xc]
mov word [ebp - 0x1d], ax
mov eax, dword [ebp - 4]
mov ax, word [eax + 0xe]
mov word [ebp - 0x1b], ax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x10]
mov dword [ebp - 0x19], eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x14]
mov dword [ebp - 0x15], eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x18]
mov dword [ebp - 0x11], eax
mov eax, dword [ebp - 4]
mov ax, word [eax + 0x1c]
mov word [ebp - 0xd], ax
mov eax, dword [ebp - 4]
mov ax, word [eax + 0x1e]
mov word [ebp - 0xb], ax
push 0x515f30
lea edx, [ebp - 0x27]
mov ecx, 0x1e
mov eax, dword [ebp - 8]
call fcn.00cda4a4
test al, al
je 0xcdd001
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x30]
call fcn.00bcdf00
test eax, eax
jle 0xcdcfc3
push 0x515f60
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x30]
call fcn.00bcdf00
push eax
mov eax, dword [ebp - 4]
add eax, 0x30
call fcn.00bcdfc4
mov edx, eax
mov eax, dword [ebp - 8]
pop ecx
call fcn.00cda4a4
test al, al
je 0xcdd001
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x34]
call fcn.00bcdf00
test eax, eax
jle 0xcdcffd
push 0x515f80
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x34]
call fcn.00bcdf00
push eax
mov eax, dword [ebp - 4]
add eax, 0x34
call fcn.00bcdfc4
mov edx, eax
mov eax, dword [ebp - 8]
pop ecx
call fcn.00cda4a4
test al, al
je 0xcdd001
mov byte [ebp - 9], 1
mov al, byte [ebp - 9]
mov esp, ebp
pop ebp
ret
Function at 0xcf0f24
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe4
push ebx
xor ebx, ebx
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x529f7b
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 0xd], 0
push 1
mov ecx, dword [0x697738]
mov edx, dword [0x69773c]
mov eax, dword [ebp - 4]
call fcn.00cf1e84
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0xcf1043
xor eax, eax
push ebp
push 0x529f58
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
mov edx, dword [ebp - 8]
mov ecx, dword [edx]
mov dword [eax + 0x30], ecx
mov ecx, dword [edx + 4]
mov dword [eax + 0x34], ecx
mov edx, dword [ebp - 0x14]
mov eax, dword [ebp - 4]
call fcn.00cef7b4
push 0
xor ecx, ecx
mov edx, 0x529f98
mov eax, dword [ebp - 0x14]
call fcn.00c17474
mov edx, dword [ebp - 8]
mov edx, dword [edx]
call fcn.00c178d4
push 0
xor ecx, ecx
mov edx, 0x529fb8
mov eax, dword [ebp - 0x14]
call fcn.00c17474
mov edx, dword [ebp - 8]
mov edx, dword [edx + 0xc]
call fcn.00c178d4
push 0
xor ecx, ecx
mov edx, 0x529fd4
mov eax, dword [ebp - 0x14]
call fcn.00c17474
mov edx, dword [ebp - 0xc]
call fcn.00c17854
mov eax, dword [ebp - 4]
add eax, 0x38
mov edx, dword [ebp - 0xc]
call fcn.00bcdde4
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x28]
mov eax, dword [eax + 0x4c]
mov dword [ebp - 0x1c], eax
lea eax, [ebp - 0x1c]
lea ecx, [ebp - 0x18]
xor edx, edx
call fcn.00ccae34
mov eax, dword [ebp - 0x18]
push eax
mov cl, 1
mov edx, dword [ebp - 0x14]
mov eax, dword [ebp - 4]
call fcn.00cf0634
test eax, eax
setne byte [ebp - 0xd]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x529f5f
mov eax, dword [ebp - 0x14]
call fcn.00bcc390
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x529f82
lea eax, [ebp - 0x18]
mov edx, dword [0x42cb38]
call fcn.00bcfb08
ret
Function at 0xdb1494
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe4
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov byte [ebp - 9], 0
call fcn.00dacb14
test al, al
je 0xdb168d
call fcn.00dacac4
call fcn.00db0e54
xor eax, eax
push ebp
push 0x5ea5a2
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
add eax, 8
call fcn.00cef2b4
mov eax, dword [ebp - 4]
xor edx, edx
mov dword [eax + 0xc], edx
mov eax, dword [ebp - 4]
mov dword [eax + 0x10], 0xffffffff
mov dl, 1
mov eax, dword [0x526b8c]
call fcn.00bcc360
mov edx, dword [ebp - 4]
mov dword [edx + 0x14], eax
push 0
mov eax, dword [ebp - 4]
add eax, 8
xor ecx, ecx
mov edx, dword [ebp - 8]
call fcn.00cef244
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0
jge 0xdb152a
mov edx, dword [ebp - 0x1c]
mov eax, 0x5ea5bc
call fcn.00cedd84
call fcn.00bcd1e0
jmp 0xdb168d
mov eax, dword [ebp - 4]
add eax, 8
xor edx, edx
call fcn.00cef0c4
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0
jge 0xdb1557
mov edx, dword [ebp - 0x1c]
mov eax, 0x5ea5f4
call fcn.00cedd84
call fcn.00bcd1e0
jmp 0xdb168d
mov eax, dword [ebp - 4]
add eax, 8
xor edx, edx
call fcn.00cef064
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jne 0xdb158e
mov eax, dword [0x66af1c]
mov eax, dword [eax]
mov ecx, dword [0x66a344]
mov edx, 0x5ea624
call fcn.00c082e4
call fcn.00bcd1e0
jmp 0xdb168d
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 8]
mov edx, dword [ebp - 4]
mov dword [edx + 0xc], eax
mov eax, dword [ebp - 0x10]
mov eax, dword [eax]
mov edx, dword [ebp - 4]
mov dword [edx + 0x10], eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0x30]
push eax
mov eax, dword [0x66b48c]
mov eax, dword [eax]
call eax
pop ecx
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x14]
call fcn.00ceec74
xor eax, eax
push ebp
push 0x5ea555
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
lea eax, [ebp - 0x14]
mov ecx, 0x5ea698
mov edx, 0x5ea6a8
call fcn.00ceec94
lea eax, [ebp - 0x14]
push eax
mov eax, dword [ebp - 0x18]
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xc]
push eax
mov eax, dword [0x66b998]
mov eax, dword [eax]
call eax
add esp, 0xc
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0
jge 0xdb1623
mov edx, dword [ebp - 0x1c]
mov eax, 0x5ea6bc
call fcn.00cedd84
call fcn.00bcd1e0
call fcn.00bcd1e0
jmp 0xdb168d
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5ea55c
lea eax, [ebp - 0x14]
call fcn.00ceec44
ret
mov al, byte [ebp - 9]
mov esp, ebp
pop ebp
ret
Function at 0xdb3154
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe0
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov byte [ebp - 9], 0
call fcn.00dacb14
test al, al
je 0xdb3445
call fcn.00dacac4
call fcn.00db0e54
xor eax, eax
push ebp
push 0x5ec35a
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
add eax, 8
call fcn.00cef2b4
mov eax, dword [ebp - 4]
xor edx, edx
mov dword [eax + 0xc], edx
mov eax, dword [ebp - 4]
mov dword [eax + 0x10], 0xffffffff
mov dl, 1
mov eax, dword [0x526b8c]
call fcn.00bcc360
mov edx, dword [ebp - 4]
mov dword [edx + 0x1c], eax
push 0
mov eax, dword [ebp - 4]
add eax, 8
xor ecx, ecx
mov edx, dword [ebp - 8]
call fcn.00cef244
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0
jge 0xdb31ea
mov edx, dword [ebp - 0x20]
mov eax, 0x5ec374
call fcn.00cedd84
call fcn.00bcd1e0
jmp 0xdb3445
mov eax, dword [ebp - 4]
add eax, 8
xor edx, edx
call fcn.00cef0c4
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0
jge 0xdb3217
mov edx, dword [ebp - 0x20]
mov eax, 0x5ec3ac
call fcn.00cedd84
call fcn.00bcd1e0
jmp 0xdb3445
mov eax, dword [ebp - 4]
add eax, 8
xor edx, edx
call fcn.00cef064
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jne 0xdb324e
mov eax, dword [0x66af1c]
mov eax, dword [eax]
mov ecx, dword [0x66a344]
mov edx, 0x5ec3dc
call fcn.00c082e4
call fcn.00bcd1e0
jmp 0xdb3445
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 8]
mov edx, dword [ebp - 4]
mov dword [edx + 0xc], eax
mov eax, dword [ebp - 0x10]
mov eax, dword [eax]
mov edx, dword [ebp - 4]
mov dword [edx + 0x10], eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0x30]
push eax
mov eax, dword [0x66b48c]
mov eax, dword [eax]
call eax
pop ecx
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x14]
call fcn.00ceec74
xor eax, eax
push ebp
push 0x5ec218
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
lea eax, [ebp - 0x14]
mov ecx, 0x5ec454
mov edx, 0x5ec464
call fcn.00ceec94
lea eax, [ebp - 0x14]
push eax
mov eax, dword [ebp - 0x18]
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xc]
push eax
mov eax, dword [0x66b998]
mov eax, dword [eax]
call eax
add esp, 0xc
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0
jge 0xdb32e6
mov edx, dword [ebp - 0x20]
mov eax, 0x5ec478
call fcn.00cedd84
call fcn.00bcd1e0
call fcn.00bcd1e0
jmp 0xdb3445
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5ec21f
lea eax, [ebp - 0x14]
call fcn.00ceec44
ret
mov al, byte [ebp - 9]
mov esp, ebp
pop ebp
ret
Function at 0xdf2e64
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x14]
call fcn.00bcdb04
xor eax, eax
push ebp
push 0x62be47
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.00df14e4
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x2b4]
mov edx, dword [ebp - 0xc]
mov dword [eax + 0x10], edx
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x2b4]
add eax, 0xc
mov edx, dword [ebp + 0x10]
mov ecx, dword [0x45a2fc]
call fcn.00bcfb44
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x2b4]
add eax, 0x14
mov edx, dword [ebp + 0xc]
mov ecx, dword [0x45a3e0]
call fcn.00bcfb44
mov al, byte [ebp + 8]
mov edx, dword [ebp - 4]
mov edx, dword [edx + 0x2b4]
mov byte [edx + 0x3c], al
mov eax, dword [ebp + 0x18]
cdq
mov ecx, dword [ebp - 4]
mov ecx, dword [ecx + 0x2b4]
mov dword [ecx + 0x30], eax
mov dword [ecx + 0x34], edx
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x2b4]
add eax, 0x38
mov edx, dword [ebp + 0x14]
call fcn.00bcdde4
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 4]
call fcn.00deed14
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x62be4e
lea eax, [ebp + 0x14]
call fcn.00bcda20
ret
Function at 0xdf82b4
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe0
xor ecx, ecx
mov dword [ebp - 0x20], ecx
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x6313cc
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
mov eax, dword [ebp - 4]
add eax, 0xc
mov ecx, 1
mov edx, dword [0x45a2fc]
call fcn.00bcfafc
add esp, 4
push 0
mov eax, dword [ebp - 4]
add eax, 0x14
mov ecx, 1
mov edx, dword [0x45a3e0]
call fcn.00bcfafc
add esp, 4
lea edx, [ebp - 0x14]
mov eax, dword [ebp - 8]
call fcn.00c22704
mov edx, 1
mov eax, dword [ebp - 0x14]
call fcn.00bfbba4
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jne 0xdf8339
mov byte [ebp - 9], 0
jmp 0xdf848d
xor eax, eax
push ebp
push 0x6313a2
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x1c]
call fcn.00bcda20
mov ecx, eax
xor edx, edx
mov eax, dword [ebp - 0x10]
call fcn.00c17f54
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
jne 0xdf8372
mov byte [ebp - 9], 0
call fcn.00bcd1e0
jmp 0xdf848d
xor eax, eax
push ebp
push 0x631385
push dword fs:[eax]
mov dword fs:[eax], esp
xor ecx, ecx
mov edx, 0x6313e8
mov eax, dword [ebp - 0x18]
call fcn.00c17664
mov edx, dword [ebp - 4]
mov dword [edx + 0x10], eax
xor ecx, ecx
mov edx, 0x631400
mov eax, dword [ebp - 0x18]
call fcn.00c17664
cdq
mov ecx, dword [ebp - 4]
mov dword [ecx + 0x30], eax
mov dword [ecx + 0x34], edx
lea eax, [ebp - 0x20]
push eax
xor ecx, ecx
mov edx, 0x63142c
mov eax, dword [ebp - 0x18]
call fcn.00c17524
mov edx, dword [ebp - 0x20]
mov eax, dword [ebp - 4]
add eax, 0x38
call fcn.00bcdde4
xor ecx, ecx
mov edx, 0x631450
mov eax, dword [ebp - 0x18]
call fcn.00c17594
mov edx, dword [ebp - 4]
mov byte [edx + 0x18], al
xor ecx, ecx
mov edx, 0x631480
mov eax, dword [ebp - 0x18]
call fcn.00c17594
mov edx, dword [ebp - 4]
mov byte [edx + 0x2c], al
xor ecx, ecx
mov edx, 0x6314b0
mov eax, dword [ebp - 0x18]
call fcn.00c17664
mov edx, dword [ebp - 4]
mov byte [edx + 0x3c], al
mov eax, dword [ebp - 4]
xor ecx, ecx
mov cl, byte [eax + 0x3d]
mov edx, 0x6314c8
mov eax, dword [ebp - 0x18]
call fcn.00c17664
mov edx, dword [ebp - 4]
mov byte [edx + 0x3d], al
mov eax, dword [ebp - 4]
lea ecx, [eax + 0xc]
mov edx, 0x6314ec
mov eax, dword [ebp - 0x18]
call fcn.00c22324
mov eax, dword [ebp - 4]
lea ecx, [eax + 0x14]
mov edx, 0x631504
mov eax, dword [ebp - 0x18]
call fcn.00c21c34
mov byte [ebp - 9], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x63138c
mov eax, dword [ebp - 0x18]
call fcn.00bcc390
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x6313d3
lea eax, [ebp - 0x20]
mov edx, 2
call fcn.00bcda80
lea eax, [ebp - 0x14]
call fcn.00bcda20
ret
Function at 0x107a3ec
Capabilities:
Compute adler32 checksum

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
xor edi, edi
mov esi, eax
mov ecx, 1
test ebx, ebx
je 0x107a503
lea ebx, [ebx]
mov eax, ebx
cmp ebx, 0x15b0
jb 0x107a41b
mov eax, 0x15b0
sub ebx, eax
mov dword [ebp + 8], ebx
cmp eax, 0x10
jl 0x107a4c8
mov edx, eax
shr edx, 4
mov ebx, edx
neg ebx
shl ebx, 4
add eax, ebx
jmp 0x107a43c
movzx ebx, byte [esi]
add ecx, ebx
movzx ebx, byte [esi + 1]
add edi, ecx
add ecx, ebx
movzx ebx, byte [esi + 2]
add edi, ecx
add ecx, ebx
movzx ebx, byte [esi + 3]
add edi, ecx
add ecx, ebx
movzx ebx, byte [esi + 4]
add edi, ecx
add ecx, ebx
movzx ebx, byte [esi + 5]
add edi, ecx
add ecx, ebx
movzx ebx, byte [esi + 6]
add edi, ecx
add ecx, ebx
movzx ebx, byte [esi + 7]
add edi, ecx
add ecx, ebx
movzx ebx, byte [esi + 8]
add edi, ecx
add ecx, ebx
movzx ebx, byte [esi + 9]
add edi, ecx
add ecx, ebx
movzx ebx, byte [esi + 0xa]
add edi, ecx
add ecx, ebx
movzx ebx, byte [esi + 0xb]
add edi, ecx
add ecx, ebx
movzx ebx, byte [esi + 0xc]
add edi, ecx
add ecx, ebx
movzx ebx, byte [esi + 0xd]
add edi, ecx
add ecx, ebx
movzx ebx, byte [esi + 0xe]
add edi, ecx
add ecx, ebx
movzx ebx, byte [esi + 0xf]
add edi, ecx
add ecx, ebx
add edi, ecx
add esi, 0x10
dec edx
jne 0x107a43c
mov ebx, dword [ebp + 8]
test eax, eax
je 0x107a4d7
movzx edx, byte [esi]
add ecx, edx
inc esi
add edi, ecx
dec eax
jne 0x107a4cc
mov eax, 0x80078071
mul ecx
shr edx, 0xf
imul edx, edx, 0xffff000f
add ecx, edx
mov eax, 0x80078071
mul edi
shr edx, 0xf
imul edx, edx, 0xffff000f
add edi, edx
test ebx, ebx
jne 0x107a40c
mov eax, edi
pop edi
shl eax, 0x10
pop esi
or eax, ecx
pop ebx
pop ebp
ret
Function at 0x107af7c
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x8c
mov eax, dword [0x10010000]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov ebx, ecx
mov esi, edx
push edi
lea edi, [ebx + 0x90]
mov dword [ebp - 0x8c], esi
mov dword [ebp - 0x84], edi
test esi, esi
jne 0x107afc9
lea eax, [ebp - 0x80]
push 0x7c
push edx
mov ecx, eax
push ecx
mov dword [ebp - 0x8c], eax
call fcn.01081a3c
mov esi, dword [ebp - 0x8c]
add esp, 0xc
push 0x370
push 0
push ebx
call fcn.01081a3c
mov eax, dword [esi]
xor edx, edx
add esp, 0xc
cmp eax, edx
jne 0x107afe6
mov eax, 0x800000
mov dword [ebx + 0x34], eax
mov eax, dword [esi + 4]
mov dword [ebp - 0x88], eax
cmp eax, edx
jne 0x107b000
mov dword [ebp - 0x88], 0x40000
mov eax, dword [ebp - 0x88]
mov dword [ebx + 0x38], eax
mov eax, dword [esi + 0xc]
cmp eax, edx
jne 0x107b015
mov eax, 0x4000000
mov dword [ebx + 0x48], eax
mov eax, dword [esi + 8]
cmp eax, edx
jne 0x107b02f
mov dword [ebx + 0x40], 0x200
mov dword [ebx + 0x44], 1
jmp 0x107b032
mov dword [ebx + 0x40], eax
mov ecx, dword [esi + 0x10]
mov dword [ebx + 0x4c], ecx
mov eax, dword [esi + 0x14]
cmp eax, edx
jne 0x107b044
mov eax, 0x100042a0
mov dword [ebx + 0x50], eax
mov eax, dword [esi + 0x18]
cmp eax, edx
jne 0x107b053
mov eax, 0x100042c0
mov dword [ebx + 0x54], eax
mov eax, dword [esi + 0x1c]
mov dword [ebx + 0x58], eax
mov ecx, dword [esi + 0x20]
mov dword [ebx + 0x5c], ecx
mov eax, dword [esi + 0x24]
mov dword [ebx + 0x60], eax
mov ecx, dword [esi + 0x28]
mov dword [ebx + 0x64], ecx
mov eax, dword [esi + 0x2c]
mov dword [ebx + 0x68], eax
mov ecx, dword [esi + 0x30]
mov dword [ebx + 0x6c], ecx
mov eax, dword [esi + 0x34]
mov dword [ebx + 0x70], eax
mov ecx, dword [esi + 0x38]
mov dword [ebx + 0x74], ecx
mov eax, dword [esi + 0x3c]
mov dword [ebx + 0x78], eax
mov ecx, dword [esi + 0x40]
mov dword [ebx + 0x7c], ecx
mov eax, dword [esi + 0x44]
mov dword [ebx + 0x80], eax
mov ecx, dword [esi + 0x48]
mov dword [ebx + 0x84], ecx
mov eax, dword [esi + 0x4c]
mov dword [ebx + 0x88], eax
mov ecx, dword [esi + 0x50]
mov eax, 1
mov dword [ebx + 0x8c], ecx
mov dword [ebx + 0x60], edx
mov dword [ebx + 0x70], eax
mov dword [ebx + 0x80], 2
nop
cmp eax, 0x4000
je 0x107b0ed
add eax, eax
jne 0x107b0cc
pop edi
pop esi
mov eax, 0xffffbad2
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0107e4d9
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebx + 0x5c]
mov eax, ecx
and eax, 0x1000060
cmp eax, 0x40
jg 0x107b0d7
je 0x107b0d7
cmp eax, edx
jne 0x107b0d7
test ecx, 0x380
jne 0x107b0d7
test ecx, 0x1000
jne 0x107b0d7
mov eax, 1
mov dword [ebx + 0x2e0], 0x1000eb50
mov dword [ebx + 0x2d4], 0x100036c0
cmp dword [edi + 0x14], eax
jne 0x107b13c
cmp dword [edi + 0x18], eax
jne 0x107b13c
mov dword [ebx + 0x38], edx
jmp 0x107b150
mov ecx, dword [ebp - 0x88]
cmp eax, ecx
je 0x107b14c
add eax, eax
jne 0x107b13c
jmp 0x107b0d7
dec ecx
mov dword [ebx + 0x3c], ecx
mov eax, dword [esi + 0x54]
cmp eax, 5
ja 0x107b0d7
jmp dword [eax*4 + 0x10004904]