joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4b0f40
Capabilities:
Resolve function by parsing pe exports

Disassembly:
call [edi + 0x5e]
pop ebx
leave
ret
sbb byte [edx + eax - 0x6a], dh
lodsd eax, dword [esi]
mov eax, dword [eax + 8]
push eax
call fcn.004aed44
xor eax, 0x8b4e88ef
clc
mov eax, dword [edi + 0x3c]
mov edx, dword [edi + eax + 0x78]
add edx, edi
mov ecx, dword [edx + 0x18]
mov ebx, dword [edx + 0x20]
add ebx, edi
call fcn.004aed44
ror byte [ebx - 0x74b6056c], 1
xor al, 0x8b
dec ecx
mov esi, dword [ebx + ecx*4]
add esi, edi
mov eax, 0x50746547
cmp dword [esi], eax
jne 0x4b0f31
mov eax, 0x41636f72
cmp dword [esi + 4], eax
jne 0x4b0f31
call fcn.004aed44
sti
stc
je 0x4b0ed6
mov ebx, dword [edx + 0x24]
add ebx, edi
mov cx, word [ebx + ecx*2]
mov ebx, dword [edx + 0x1c]
add ebx, edi
mov eax, dword [ebx + ecx*4]
add eax, edi
push eax
call fcn.004aed44
js 0x4b0f03
arpl word [edi + edi*8], cx
jne 0x4b0f7b
push dword [ebp + 4]
push dword [ebp]
call fcn.004af544
or al, 0
in eax, 0xff
dec dword [eax + eax]
mov edi, edi
push ebp
mov ebp, esp
push ebx
push esi
mov esi, dword [ebp + 8]
push esi
call fcn.004a49c4
push esi
call fcn.004b1e0c
push 0xffffffffffffffff
push pe_nt_image_headers32
push esi
call fcn.004a1e4a
push 0
mov ebx, 0x100
push ebx
push esi
call fcn.004a1e4a
push 8
push 0x400
push esi
call fcn.004a1e4a
push esi
call fcn.004ae3b8
push 0x2710
push esi
call fcn.004a1ef2
push 0
push esi
call fcn.004a1e2a
or eax, 0x4000000
push eax
push 0
push esi
call fcn.004a1e4a
push esi
call fcn.004a4a7c
push 0x10
push esi
call fcn.004a1e2a
test ebx, eax
jne 0x4b0ffc
call fcn.004b1c0c
push 0xffffffffffffffff
push pe_nt_image_headers32
push esi
call fcn.004a1e4a
push 0xc0
push esi
call fcn.004a1e2a
push esi
call fcn.004a558e
pop esi
pop ebx
pop ebp
ret 4
Function at 0x4b54ba
Capabilities:
Hash data with crc32

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [0x4e1810]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push ebx
push esi
mov esi, dword [ebp + 8]
mov ebx, eax
push edi
mov edi, dword [esi + 0x1970]
mov dword [ebp - 0x1c], ebx
test al, 1
je 0x4b54e7
and eax, 0xfffffffe
test al, 2
je 0x4b54ee
and eax, 0xfffffffd
test al, 4
je 0x4b54f5
and eax, 0xfffffffb
test al, 8
je 0x4b54fc
and eax, 0xfffffff7
and edi, 0xfffffeff
test eax, 0x10000
je 0x4b551c
and edi, 0xffffff7f
or edi, 0x100
and eax, 0xfffeffff
jmp 0x4b552b
test byte [esi + 0x4738], 4
jne 0x4b552b
or edi, 0x80
and edi, 0xffffff9f
test al, 0x10
je 0x4b5538
or edi, 0x60
and eax, 0xffffffef
test eax, eax
je 0x4b5544
xor eax, eax
inc eax
jmp 0x4b56ed
push esi
call fcn.004b670e
test al, al
je 0x4b5554
or edi, 0x1700000
push edi
push 0x468
push esi
mov dword [esi + 0x1970], edi
call fcn.004b9956
mov dword [esi + 0x3fec], ebx
test bl, 4
je 0x4b558e
mov ebx, 0x470
lea edi, [ebx + 0x10]
push 0xffffffffffffffff
push ebx
push esi
call fcn.004b9956
add ebx, 4
cmp ebx, edi
jb 0x4b5579
jmp 0x4b5646
test bl, 2
je 0x4b562e
and dword [ebp - 0x14], 0
and dword [ebp - 0x10], 0
and dword [ebp - 0xc], 0
and dword [ebp - 8], 0
cmp dword [esi + 0x45dc], 0
jbe 0x4b5608
mov eax, dword [esi + 0x45dc]
lea ebx, [esi + 0x45e0]
mov dword [ebp - 0x18], eax
or ecx, 0xffffffff
xor edx, edx
movzx eax, byte [ebx + edx]
push 8
xor ecx, eax
pop edi
mov eax, ecx
shr ecx, 1
and eax, 1
je 0x4b55dc
xor ecx, 0xedb88320
dec edi
jne 0x4b55cd
inc edx
cmp edx, 6
jb 0x4b55c4
and ecx, 0x7f
mov eax, ecx
shr eax, 5
and eax, 3
lea edx, [ebp - 0x14]
lea edx, [edx + eax*4]
xor eax, eax
and ecx, 0x1f
inc eax
shl eax, cl
add ebx, 7
or dword [edx], eax
dec dword [ebp - 0x18]
jne 0x4b55bf
mov ebx, 0x470
lea eax, [ebp - 0x14]
sub eax, ebx
mov dword [ebp - 0x18], eax
lea edi, [ebx + 0x10]
push dword [eax + ebx]
push ebx
push esi
call fcn.004b9956
mov eax, dword [ebp - 0x18]
add ebx, 4
cmp ebx, edi
jb 0x4b5618
jmp 0x4b5646
mov ebx, 0x470
lea edi, [ebx + 0x10]
push 0
push ebx
push esi
call fcn.004b9956
add ebx, 4
cmp ebx, edi
jb 0x4b5636
test byte [ebp - 0x1c], 8
je 0x4b5679
mov ebx, 0x42000000
push ebx
push edi
push esi
call fcn.004b9956
mov edi, 0x7fffffff
push edi
push 0x484
push esi
call fcn.004b9956
push ebx
push 0x488
push esi
call fcn.004b9956
push edi
jmp 0x4b56a4
push 0xc2000000
push edi
push esi
call fcn.004b9956
push 0xffffffffffffffff
push 0x484
push esi
call fcn.004b9956
push 0x86000004
push 0x488
push esi
call fcn.004b9956
push 0xffffffffffffffff
push 0x48c
push esi
call fcn.004b9956
test byte [esi + 0x4738], 2
push 0
pop eax
sete al
lea eax, [eax*4 + 0xc]
cmp eax, 2
jbe 0x4b56eb
mov edi, 0x494
lea ebx, [eax - 2]
push 0
lea eax, [edi - 4]
push eax
push esi
call fcn.004b9956
push 0
push edi
push esi
call fcn.004b9956
add edi, 8
dec ebx
jne 0x4b56d0
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00434e57
leave
ret 8
Function at 0x4bc286
Capabilities:
Hash data with crc32

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x4e1810]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push 8
pop ebx
xor eax, eax
mov ecx, ebx
lea edi, [ebp - 0x24]
rep stosd dword es:[edi], eax
mov al, byte [edx]
test al, al
je 0x4bc2fd
movzx eax, al
lea edi, [edx + 2]
mov dword [ebp - 0x28], eax
or ecx, 0xffffffff
xor edx, edx
movzx eax, byte [edi + edx]
xor ecx, eax
mov esi, ebx
mov eax, ecx
shr ecx, 1
and eax, 1
je 0x4bc2d2
xor ecx, 0xedb88320
dec esi
jne 0x4bc2c3
inc edx
cmp edx, 6
jb 0x4bc2bb
movzx ecx, cl
mov eax, ecx
shr eax, 5
and eax, 7
lea edx, [ebp - 0x24]
lea edx, [edx + eax*4]
xor eax, eax
and ecx, 0x1f
inc eax
shl eax, cl
add edi, ebx
or dword [edx], eax
dec dword [ebp - 0x28]
jne 0x4bc2b6
mov esi, 0x14d0
lea edi, [ebp - 0x24]
sub edi, esi
push dword [edi + esi]
push esi
push dword [ebp + 8]
call fcn.004bcc7c
add esi, 4
dec ebx
jne 0x4bc307
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00434e57
leave
ret 4
Function at 0x4c2000
Capabilities:
Hash data using sha256

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov dword [eax], 0x6a09e667
mov dword [eax + 4], 0xbb67ae85
mov dword [eax + 8], 0x3c6ef372
mov dword [eax + 0xc], 0xa54ff53a
mov dword [eax + 0x10], 0x510e527f
mov dword [eax + 0x14], 0x9b05688c
mov dword [eax + 0x18], 0x1f83d9ab
mov dword [eax + 0x1c], 0x5be0cd19
mov dword [eax + 0x20], 0
mov dword [eax + 0x24], 0
pop ebp
ret 4

Function at 0x4c2160
Capabilities:
Hash data using sha256

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x58
mov eax, dword [0x4e1810]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov ebx, dword [edi + 0x24]
mov dword [ebp - 0x50], eax
mov eax, ebx
and eax, 0x3f
mov esi, 0x40
sub esi, eax
cmp esi, 8
ja 0x4c2195
add esi, 0x40
lea eax, [esi - 8]
push eax
lea eax, [ebp - 0x4c]
push 0
push eax
call fcn.0049cd10
mov ecx, dword [edi + 0x20]
add ecx, ecx
add ecx, ecx
mov eax, ebx
shr eax, 0x1d
add ecx, ecx
or ecx, eax
add esp, 0xc
lea eax, [ebx*8]
mov dword [ebp - 0x54], eax
push 2
lea eax, [ebp - 0x58]
push eax
lea eax, [ebp + esi - 0x54]
push eax
mov byte [ebp - 0x4c], 0x80
mov dword [ebp - 0x58], ecx
call fcn.004c3830
push esi
lea eax, [ebp - 0x4c]
push eax
push edi
call fcn.004c2060
push 8
push edi
push dword [ebp - 0x50]
call fcn.004c3830
mov dword [edi], 0x6a09e667
mov dword [edi + 4], 0xbb67ae85
mov dword [edi + 8], 0x3c6ef372
mov dword [edi + 0xc], 0xa54ff53a
mov dword [edi + 0x10], 0x510e527f
mov dword [edi + 0x14], 0x9b05688c
mov dword [edi + 0x18], 0x1f83d9ab
mov dword [edi + 0x1c], 0x5be0cd19
mov dword [edi + 0x20], 0
mov dword [edi + 0x24], 0
lea eax, [edi + 0x28]
pop edi
pop esi
mov ecx, 0x40
pop ebx
mov edi, edi
mov byte [eax], 0
inc eax
dec ecx
jne 0x4c2240
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00434e57
mov esp, ebp
pop ebp
ret 8
Function at 0x4c3860
Capabilities:
Hash data using sha1

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 8
cmp dword [0x4e8dd8], 0
push ebx
jne 0x4c38dd
push eax
push ebx
push ecx
push edx
xor eax, eax
cpuid
xor eax, eax
xor ebx, 0x756e6547
sete al
xor ebx, ebx
xor ecx, 0x6c65746e
sete bl
and eax, ebx
xor ecx, ecx
xor edx, 0x49656e69
sete cl
and eax, ecx
mov dword [ebp - 4], eax
mov eax, 1
cpuid
xor ecx, ecx
xor edx, edx
mov ebx, 0xff0
and ebx, eax
mov dword [ebp - 8], ebx
pop edx
pop ecx
pop ebx
pop eax
cmp dword [ebp - 4], 0
mov eax, 1
je 0x4c38d1
cmp dword [ebp - 8], 0x660
jae 0x4c38d1
xor eax, eax
mov eax, dword [eax*4 + 0x4de9c8]
mov dword [0x4e8dd8], eax
mov eax, dword [ebp + 8]
mov dword [eax + 0x54], 0
mov dword [eax + 0x58], 0
mov dword [eax + 0x40], 0x67452301
mov dword [eax + 0x44], 0xefcdab89
mov dword [eax + 0x48], 0x98badcfe
mov dword [eax + 0x4c], 0x10325476
mov dword [eax + 0x50], 0xc3d2e1f0
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x402856
Capabilities:
Encode data using xor

Disassembly:
mov ecx, dword [esp + 4]
xor eax, eax
cmp ecx, dword [esp + 8]
ja 0x40287e
push esi
movzx edx, byte [ecx]
add eax, edx
mov esi, eax
shr esi, 0x1d
shl eax, 3
or esi, eax
xor esi, edx
inc ecx
cmp ecx, dword [esp + 0xc]
mov eax, esi
jbe 0x402863
pop esi
ret

Function at 0x40297f
Capabilities:
Hash data with md5

Disassembly:
push dword [esp + 0xc]
mov eax, dword [esp + 8]
push dword [esp + 0xc]
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
push eax
mov dword [eax + 0xc], 0x10325476
call fcn.004029b0
add esp, 0xc
ret
Function at 0x40cac0
Capabilities:
Get memory capacity

Disassembly:
add esp, 0xffffffe0
mov dword [esp], 0x20
push esp
call sub.KERNEL32.DLL_GlobalMemoryStatus
mov eax, dword [esp + 0xc]
add esp, 0x20
ret

Function at 0x40e224
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
push 0
push 0x80
push 2
push 0
push 0
push 0xc0000000
mov eax, dword [ebp + 8]
push eax
call sub.KERNEL32.DLL_CreateFileA
mov ebx, eax
test eax, eax
je 0x40e286
call fcn.0040e1d4
mov esi, eax
lea eax, [ebp - 4]
push 0
push eax
push esi
call sym.Keygen.EXE__strlen
pop ecx
push eax
push esi
push ebx
call sub.KERNEL32.DLL_WriteFile
push 0
lea edx, [ebp - 4]
push edx
push edi
call sym.Keygen.EXE__strlen
pop ecx
push eax
push edi
push ebx
call sub.KERNEL32.DLL_WriteFile
push ebx
call sub.KERNEL32.DLL_CloseHandle
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret

Function at 0x40e2ec
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff7c
cmp dword [sym.Keygen.EXE___messagefile], 0
push ebx
push esi
mov esi, dword [ebp + 8]
jne 0x40e3c6
cmp dword [sym.Keygen.EXE___messagefunc], 0
jne 0x40e3c6
cmp dword [sym.Keygen.EXE___isWindows], 0
je 0x40e380
push 0x80
lea eax, [ebp - 0x84]
push eax
push 0
call sub.KERNEL32.DLL_GetModuleFileNameA
push 0x5c
lea edx, [ebp - 0x84]
push edx
call sym.Keygen.EXE___mbsrchr
add esp, 8
mov ebx, eax
test eax, eax
jne 0x40e366
push 0x3a
lea edx, [ebp - 0x84]
push edx
call sym.Keygen.EXE___mbsrchr
add esp, 8
mov ebx, eax
test eax, eax
jne 0x40e366
lea ebx, [ebp - 0x84]
jmp 0x40e367
inc ebx
call fcn.0040e2a8
or eax, 0x10010
push eax
push ebx
push esi
push 0
call sub.USER32.DLL_MessageBoxA
jmp 0x40e401
push 0xfffffffffffffff4
call sub.KERNEL32.DLL_GetStdHandle
mov ebx, eax
lea eax, [ebp - 4]
push 0
push eax
push 2
push 0x41600c
push ebx
call sub.KERNEL32.DLL_WriteFile
push 0
lea edx, [ebp - 4]
push edx
push esi
call sym.Keygen.EXE__strlen
pop ecx
push eax
push esi
push ebx
call sub.KERNEL32.DLL_WriteFile
push 0
lea ecx, [ebp - 4]
push ecx
push 2
push 0x41600f
push ebx
call sub.KERNEL32.DLL_WriteFile
jmp 0x40e401
cmp dword [sym.Keygen.EXE___messagefunc], 0
je 0x40e3e0
cmp dword [sym.Keygen.EXE___messagefunc], 0xffffffff
je 0x40e401
push esi
call dword [sym.Keygen.EXE___messagefunc]
pop ecx
mov eax, dword [sym.Keygen.EXE___messagefile]
test eax, eax
je 0x40e401
cmp dword [sym.Keygen.EXE___messagefile], 0xffffffff
je 0x40e401
cmp byte [eax], 0
je 0x40e401
push esi
push eax
call sym.Keygen.EXE___ErrorMessageHelper
add esp, 8
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x412867
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.004126e6

Function at 0x416c5f
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.004165cd

Function at 0x416c6a
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.00416808

Function at 0x4010b2
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x804
mov eax, dword [0x410284]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [ebp + 8], 0
jne 0x4010ff
lea eax, [ebp + 0x10]
push eax
push dword [ebp + 0xc]
lea eax, [ebp - 0x804]
push 0x3ff
push 0x400
push eax
call fcn.0040170c
lea eax, [ebp - 0x804]
push eax
call fcn.0040170c
add esp, 0x18
push 1
call dword [sym.imp.kernel32.dll_ExitProcess]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00401ea2
leave
ret

Function at 0x40110b
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x404
mov eax, dword [0x410284]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [ebp + 8], 0
jne 0x401158
lea eax, [ebp + 0x10]
push eax
push dword [ebp + 0xc]
lea eax, [ebp - 0x404]
push 0x3ff
push 0x400
push eax
call fcn.0040170c
lea eax, [ebp - 0x404]
push eax
call fcn.0040170c
add esp, 0x18
push 1
call dword [sym.imp.kernel32.dll_ExitProcess]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00401ea2
leave
ret

Function at 0x401ea2
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x410284]
jne 0x401eac
repz ret
jmp fcn.00403e53
Function at 0x10013dd0
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 8]
push esi
push edi
mov dword [ecx + 0x1384], 0xffffffff
lea edi, [ecx + 8]
mov dword [ecx + 4], edx
mov esi, 1
nop dword [eax]
mov eax, edx
lea edi, [edi + 4]
shr eax, 0x1e
xor eax, edx
imul edx, eax, 0x6c078965
add edx, esi
inc esi
mov dword [edi - 4], edx
cmp esi, 0x270
jb 0x10013df0
pop edi
mov dword [ecx], 0x270
mov eax, ecx
pop esi
pop ebp
ret 4

Function at 0x100160a0
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push edi
mov edi, ecx
mov dword [ebp - 4], edi
mov eax, dword [edi]
cmp eax, 0x270
jne 0x100160fe
lea edx, [edi + 8]
mov esi, eax
nop dword [eax]
mov ecx, dword [edx - 4]
lea edx, [edx + 4]
xor ecx, dword [edx - 4]
and ecx, 0x7fffffff
xor ecx, dword [edx - 8]
mov eax, ecx
and al, 1
movzx eax, al
neg eax
sbb eax, eax
shr ecx, 1
and eax, 0x9908b0df
xor eax, dword [edx + 0x62c]
xor eax, ecx
mov dword [edx + 0x9b8], eax
sub esi, 1
jne 0x100160c0
mov eax, dword [edi]
jmp 0x100161e9
cmp eax, 0x4e0
jb 0x100161e9
mov eax, dword [edi + 0x9c4]
push ebx
lea ebx, [edi + 0x9c4]
mov edi, 0xe3
nop dword [eax + eax]
mov ecx, dword [ebx + 4]
lea edx, [ebx + 4]
xor ecx, eax
and ecx, 0x7fffffff
xor ecx, eax
mov eax, ecx
and al, 1
movzx eax, al
neg eax
sbb eax, eax
shr ecx, 1
and eax, 0x9908b0df
xor eax, dword [ebx + 0x634]
xor eax, ecx
mov dword [ebx - 0x9c0], eax
lea ebx, [edx]
mov eax, dword [edx]
sub edi, 1
jne 0x10016120
mov ebx, dword [ebp - 4]
mov edi, 0x18c
add ebx, 0xd50
mov eax, dword [ebx]
nop dword [eax]
mov ecx, eax
lea edx, [ebx + 4]
xor ecx, dword [edx]
and ecx, 0x7fffffff
xor ecx, eax
mov eax, ecx
and al, 1
movzx eax, al
neg eax
sbb eax, eax
shr ecx, 1
and eax, 0x9908b0df
xor eax, dword [ebx - 0xd4c]
xor eax, ecx
mov dword [ebx - 0x9c0], eax
lea ebx, [edx]
mov eax, dword [edx]
sub edi, 1
jne 0x10016170
mov edi, dword [ebp - 4]
pop ebx
mov ecx, dword [edi + 0x1380]
xor ecx, dword [edi + 4]
and ecx, 0x7fffffff
xor ecx, dword [edi + 0x1380]
mov eax, ecx
and al, 1
movzx eax, al
neg eax
sbb eax, eax
shr ecx, 1
and eax, 0x9908b0df
xor eax, dword [edi + 0x634]
xor eax, ecx
mov dword [edi + 0x9c0], eax
xor eax, eax
mov dword [edi], 0
mov edx, dword [edi + eax*4 + 4]
inc eax
mov dword [edi], eax
mov ecx, edx
mov eax, dword [edi + 0x1384]
shr ecx, 0xb
and eax, ecx
xor edx, eax
mov eax, edx
and eax, 0xff3a58ad
shl eax, 7
xor edx, eax
mov eax, edx
and eax, 0xffffdf8c
shl eax, 0xf
xor edx, eax
mov eax, edx
shr eax, 0x12
pop edi
xor eax, edx
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x10016f60
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10031c0d
mov eax, dword fs:[0]
push eax
sub esp, 0xa0
mov eax, dword [0x1003e024]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x14], ebx
mov dword [ebp - 4], 0
lea eax, [ebp + 8]
cmp dword [ebp + 0x1c], 0x10
lea ecx, [ebp - 0xa8]
push dword [ebp + 0x18]
cmovae eax, dword [ebp + 8]
push eax
mov byte [ebp - 0xa8], 0
mov dword [ebp - 0x64], 0
mov dword [ebp - 0x60], 0
mov dword [ebp - 0x5c], 0x67452301
mov dword [ebp - 0x58], 0xefcdab89
mov dword [ebp - 0x54], 0x98badcfe
mov dword [ebp - 0x50], 0x10325476
call fcn.10016eb0
cmp byte [ebp - 0xa8], 0
jne 0x100170c0
xor edx, edx
lea ecx, [ebp - 0x63]
nop word [eax + eax]
movzx eax, byte [ecx - 1]
lea ecx, [ecx + 4]
mov byte [ebp + edx - 0x18], al
movzx eax, byte [ecx - 4]
mov byte [ebp + edx - 0x17], al
movzx eax, byte [ecx - 3]
mov byte [ebp + edx - 0x16], al
movzx eax, byte [ecx - 2]
mov byte [ebp + edx - 0x15], al
add edx, 4
cmp edx, 8
jb 0x10017000
mov edx, dword [ebp - 0x64]
mov ecx, 0x78
shr edx, 3
mov eax, 0x38
and edx, 0x3f
sub ecx, edx
sub eax, edx
cmp edx, 0x38
cmovae eax, ecx
lea ecx, [ebp - 0xa8]
push eax
push 0x1003eaa0
call fcn.10016eb0
push 8
lea eax, [ebp - 0x18]
push eax
lea ecx, [ebp - 0xa8]
call fcn.10016eb0
xor edx, edx
lea ecx, [ebp - 0x5b]
nop
movzx eax, byte [ecx - 1]
lea ecx, [ecx + 4]
mov byte [ebp + edx - 0x4c], al
movzx eax, byte [ecx - 4]
mov byte [ebp + edx - 0x4b], al
movzx eax, byte [ecx - 3]
mov byte [ebp + edx - 0x4a], al
movzx eax, byte [ecx - 2]
mov byte [ebp + edx - 0x49], al
add edx, 4
cmp edx, 0x10
jb 0x10017070
push 0x40
lea eax, [ebp - 0xa7]
push 0
push eax
call fcn.1001bb00
xorps xmm0, xmm0
mov byte [ebp - 0xa8], 1
add esp, 0xc
movq qword [ebp - 0x64], xmm0
nop dword [eax]
xor esi, esi
lea edi, [ebp - 0x3c]
movzx eax, byte [ebp + esi - 0x4c]
push eax
push str._02x
push edi
call fcn.100011c0
inc esi
add esp, 0xc
add edi, 2
cmp esi, 0x10
jl 0x100170c5
mov byte [ebp - 0x1c], 0
mov dword [ebx], 0
mov dword [ebx + 0x10], 0
mov dword [ebx + 0x14], 0
lea ecx, [ebp - 0x3c]
mov dword [ebx + 0x10], 0
mov dword [ebx + 0x14], 0xf
lea edx, [ecx + 1]
mov byte [ebx], 0
mov byte [ebp - 4], 0
mov al, byte [ecx]
inc ecx
test al, al
jne 0x10017115
sub ecx, edx
lea eax, [ebp - 0x3c]
push ecx
push eax
mov ecx, ebx
call fcn.10014580
mov ecx, dword [ebp + 0x1c]
cmp ecx, 0x10
jb 0x1001715a
mov edx, dword [ebp + 8]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x10017150
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x10017178
push ecx
push edx
call fcn.10019f0e
add esp, 8
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.10019893
mov esp, ebp
pop ebp
ret
call fcn.100206c1
int3
Function at 0x10017180
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x224
mov eax, dword [0x1003e024]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov eax, ecx
mov dword [ebp - 0x220], eax
push esi
push edi
test eax, eax
je 0x10017345
xor eax, eax
mov dword [ebp - 0x218], 0
xor edx, edx
mov dword [ebp - 0x20c], 0
mov dword [ebp - 0x210], eax
mov dword [ebp - 0x208], eax
mov dword [ebp - 0x214], edx
mov dword [ebp - 0x21c], eax
pushal
mov eax, dword fs:[0x30]
mov dword [ebp - 0x218], eax
popal
mov eax, dword [ebp - 0x218]
mov ecx, dword [eax + 0xc]
xor eax, eax
mov dword [ebp - 0x224], ecx
sub eax, 0
je 0x1001723c
sub eax, 1
je 0x10017220
sub eax, 1
jne 0x10017255
lea ebx, [ecx + 0x1c]
mov ecx, 0x10
mov dword [ebp - 0x208], ebx
mov dword [ebp - 0x210], ebx
mov dword [ebp - 0x20c], ecx
jmp 0x10017261
lea ebx, [ecx + 0x14]
mov ecx, 8
mov dword [ebp - 0x208], ebx
mov dword [ebp - 0x210], ebx
mov dword [ebp - 0x20c], ecx
jmp 0x10017261
lea ebx, [ecx + 0xc]
xor ecx, ecx
mov dword [ebp - 0x208], ebx
mov dword [ebp - 0x210], ebx
mov dword [ebp - 0x20c], ecx
jmp 0x10017261
mov ebx, dword [ebp - 0x208]
mov ecx, dword [ebp - 0x20c]
mov edi, dword [ebx]
mov ebx, dword [ebp - 0x210]
cmp edi, ebx
je 0x1001730d
mov esi, edi
mov dword [ebp - 0x208], edi
sub esi, ecx
xor eax, eax
movzx ecx, word [esi + 0x24]
test ecx, 0xfffffffe
jbe 0x100172af
nop dword [eax]
cmp eax, 0x200
jge 0x100172b4
mov ecx, dword [esi + 0x28]
mov cl, byte [ecx + eax*2]
mov byte [ebp + eax - 0x204], cl
inc eax
movzx ecx, word [esi + 0x24]
shr ecx, 1
cmp eax, ecx
jl 0x10017290
cmp eax, 0x200
jae 0x10017356
push dword [ebp - 0x220]
mov byte [ebp + eax - 0x204], 0
lea eax, [ebp - 0x204]
push eax
call fcn.1001b2a0
add esp, 8
test eax, eax
je 0x100172fb
mov ecx, dword [edi + 4]
mov eax, dword [edi]
mov dword [ecx], eax
mov ecx, dword [edi]
mov eax, dword [edi + 4]
mov dword [ecx + 4], eax
mov eax, dword [ebp - 0x214]
test eax, eax
cmovne esi, eax
mov dword [ebp - 0x214], esi
mov eax, dword [edi]
mov edi, eax
mov ecx, dword [ebp - 0x20c]
cmp eax, ebx
jne 0x10017271
mov eax, dword [ebp - 0x21c]
inc eax
mov dword [ebp - 0x21c], eax
cmp eax, 3
jge 0x1001732a
mov ecx, dword [ebp - 0x224]
jmp 0x100171f5
mov edx, dword [ebp - 0x214]
test edx, edx
je 0x10017345
mov ecx, dword [edx + 0x40]
mov eax, dword [edx + 0x3c]
mov dword [ecx], eax
mov ecx, dword [edx + 0x3c]
mov eax, dword [edx + 0x40]
mov dword [ecx + 4], eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10019893
mov esp, ebp
pop ebp
ret
call fcn.1001a06c
int3