joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4069c5
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x23c
push esi
mov esi, 0x104
lea eax, [ebp - 0x23c]
push esi
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
cmp eax, esi
pop esi
jbe 0x4069e9
xor eax, eax
test eax, eax
je 0x4069fc
cmp word [ebp + eax*2 - 0x23e], 0x5c
je 0x4069fc
xor ecx, ecx
jmp 0x4069ff
xor ecx, ecx
inc ecx
push dword [ebp + 8]
lea ecx, [ecx*2 + 0x40a014]
lea eax, [ebp + eax*2 - 0x23c]
push ecx
push str._s_S.dll
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x10
lea eax, [ebp - 0x23c]
push 8
push 0
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
leave
ret 4

Function at 0x406b22
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
cmp dword [0x427dec], 0
push esi
jne 0x406b59
xor ecx, ecx
push 8
mov eax, ecx
pop esi
mov edx, eax
and dl, 1
neg dl
sbb edx, edx
and edx, 0xedb88320
shr eax, 1
xor eax, edx
dec esi
jne 0x406b33
mov dword [ecx*4 + 0x427de8], eax
inc ecx
cmp ecx, 0x100
jl 0x406b2e
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 8]
test edx, edx
not eax
jbe 0x406b8a
mov ecx, dword [esp + 0xc]
push edi
movzx edi, byte [ecx]
mov esi, eax
and esi, 0xff
xor esi, edi
shr eax, 8
mov esi, dword [esi*4 + 0x427de8]
xor eax, esi
inc ecx
dec edx
jne 0x406b6c
pop edi
not eax
pop esi
ret 0xc

Function at 0x26395dc
Capabilities:
Encode data using xor

Disassembly:
jmp 0x26395e6
pushal
call 0x26395ec
pop ebp
sub ebp, 0x10
sub ebp, 0x22395dc
jmp 0x2639602
mov eax, 0x22395dc
add eax, ebp
add eax, 0x4c
mov ecx, 0x5d3
mov edx, 0xa85c59f4
xor byte [eax], dl
inc eax
dec ecx
jne 0x2639619
jmp 0x263962c
jg 0x2639667
jg 0x26396ad
enter 0xfffffffffffff4f4, 0xfffffffffffffff4
jne 0x263966b
or al, 0xf4
hlt
mov al, byte [0xd8f5f6f6]
rcr byte [edi + 0x1c8fbba3], 1
int1
fcom st(0)
pushfd
mov dword [0x8fbb], eax
sbb al, 0xf1
hlt
mov ch, 0xd5
hlt
Function at 0x409d2d
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov dword [ebp - 8], 0
mov dword [ebp - 0x10], 0
mov dword [ebp - 0x14], 0
mov dword [ebp - 0xc], 0
mov dword [ebp - 0xc], 0
jmp 0x409d61
mov eax, dword [ebp - 0xc]
add eax, 1
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp - 0xc]
cmp ecx, dword [ebp + 0x10]
jae 0x409e13
mov edx, dword [ebp - 8]
add edx, 1
and edx, 0x800000ff
jns 0x409d83
dec edx
or edx, 0xffffff00
inc edx
mov dword [ebp - 8], edx
mov eax, dword [ebp + 8]
add eax, dword [ebp - 8]
movzx ecx, byte [eax]
add ecx, dword [ebp - 0x10]
and ecx, 0x800000ff
jns 0x409da2
dec ecx
or ecx, 0xffffff00
inc ecx
mov dword [ebp - 0x10], ecx
mov edx, dword [ebp + 8]
add edx, dword [ebp - 8]
mov al, byte [edx]
mov byte [ebp - 1], al
mov ecx, dword [ebp + 8]
add ecx, dword [ebp - 8]
mov edx, dword [ebp + 8]
add edx, dword [ebp - 0x10]
mov al, byte [edx]
mov byte [ecx], al
mov ecx, dword [ebp + 8]
add ecx, dword [ebp - 0x10]
mov dl, byte [ebp - 1]
mov byte [ecx], dl
mov eax, dword [ebp + 8]
add eax, dword [ebp - 8]
movzx ecx, byte [eax]
mov edx, dword [ebp + 8]
add edx, dword [ebp - 0x10]
movzx eax, byte [edx]
add ecx, eax
and ecx, 0x800000ff
jns 0x409def
dec ecx
or ecx, 0xffffff00
inc ecx
mov dword [ebp - 0x14], ecx
mov ecx, dword [ebp + 8]
add ecx, dword [ebp - 0x14]
movzx edx, byte [ecx]
mov eax, dword [ebp + 0xc]
add eax, dword [ebp - 0xc]
movzx ecx, byte [eax]
xor ecx, edx
mov edx, dword [ebp + 0xc]
add edx, dword [ebp - 0xc]
mov byte [edx], cl
jmp 0x409d58
mov esp, ebp
pop ebp
ret

Function at 0x409f3d
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov dword [ebp - 4], 0
mov byte [ebp - 0x14], 0x52
mov byte [ebp - 0x13], 0x50
mov byte [ebp - 0x12], 0x67
mov byte [ebp - 0x11], 0x71
mov byte [ebp - 0x10], 0x6f
mov byte [ebp - 0xf], 0x51
mov byte [ebp - 0xe], 0x50
mov byte [ebp - 0xd], 0x69
mov byte [ebp - 0xc], 0x43
mov byte [ebp - 0xb], 0x6b
mov byte [ebp - 0xa], 0x57
mov byte [ebp - 9], 0x66
mov byte [ebp - 8], 0x34
mov byte [ebp - 7], 0x64
mov byte [ebp - 6], 0
lea eax, [ebp - 0x14]
push eax
push 0
push 0
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 0x1d0]
call edx
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x409fba
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x78]
call ecx
cmp eax, 0xb7
jne 0x409fb5
xor eax, eax
jmp 0x409fba
mov eax, 1
mov esp, ebp
pop ebp
ret
Function at 0x409fcd
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2d8
push ebx
push esi
push edi
mov dword [ebp - 0xc], 0
mov dword [ebp - 0xb0], 0
mov dword [ebp - 0x28], 0
mov dword [ebp - 0x10], 0
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x1c], 0
mov dword [ebp - 8], 0
je 0x40a01b
jne 0x40a01b
push 0x654c6c45
ja 0x40a087
push edx
insb byte es:[edi], dx
inc esp
call fcn.0040a021
xor dword [esi], 0xffffff83
add dword ss:[esp], 8
ret
jmp 0x40a02b
jmp 0x40a02e
jmp 0x40a031
lea eax, [ebp - 0xb4]
mov dword [ebp - 0xb8], eax
mov ecx, dword [ebp - 0xb8]
and ecx, 0xffff
mov word [ebp - 4], cx
mov dword [ebp - 0x24], 0
jmp 0x40a05f
mov edx, dword [ebp - 0x24]
add edx, 1
mov dword [ebp - 0x24], edx
cmp dword [ebp - 0x24], 0xd
jge 0x40a0d0
movzx eax, word [ebp - 4]
movzx ecx, word [ebp - 4]
sar ecx, 2
xor eax, ecx
movzx edx, word [ebp - 4]
sar edx, 3
xor eax, edx
movzx ecx, word [ebp - 4]
sar ecx, 5
xor eax, ecx
and eax, 1
mov dword [ebp - 0xbc], eax
movzx edx, word [ebp - 4]
sar edx, 1
mov eax, dword [ebp - 0xbc]
shl eax, 0xf
or edx, eax
mov word [ebp - 4], dx
mov cx, word [ebp - 4]
mov word [ebp - 0xac], cx
movzx eax, word [ebp - 0xac]
and eax, 0xff
cdq
mov ecx, 0x7e
idiv ecx
add edx, 1
mov eax, dword [ebp - 0x24]
mov byte [ebp + eax - 0xd4], dl
jmp 0x40a056
mov ecx, 1
imul edx, ecx, 0xd
mov byte [ebp + edx - 0xd4], 0
jle 0x40a0ed
jg 0x40a0ed
call fcn.0040a2d9
add byte [ebx + 0x24048336], al
call 0x40a0f3
xor dword [esi], 0xffffff83
add al, 0x24
or bl, al
push 0xe
lea eax, [ebp - 0x1d8]
push eax
lea ecx, [ebp - 0xd4]
push ecx
call fcn.00409a6d
add esp, 0xc
mov byte [ebp - 0xa8], 0x73
mov byte [ebp - 0xa7], 0
mov byte [ebp - 0xa6], 0x65
mov byte [ebp - 0xa5], 0
mov byte [ebp - 0xa4], 0x72
mov byte [ebp - 0xa3], 0
mov byte [ebp - 0xa2], 0x76
mov byte [ebp - 0xa1], 0
mov byte [ebp - 0xa0], 0x69
mov byte [ebp - 0x9f], 0
mov byte [ebp - 0x9e], 0x63
mov byte [ebp - 0x9d], 0
mov byte [ebp - 0x9c], 0x65
mov byte [ebp - 0x9b], 0
mov byte [ebp - 0x9a], 0x2d
mov byte [ebp - 0x99], 0
mov byte [ebp - 0x98], 0x63
mov byte [ebp - 0x97], 0
invalid
invalid
invalid
Function at 0x40a0f3
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2d8
push ebx
push esi
push edi
mov dword [ebp - 0xc], 0
mov dword [ebp - 0xb0], 0
mov dword [ebp - 0x28], 0
mov dword [ebp - 0x10], 0
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x1c], 0
mov dword [ebp - 8], 0
je 0x40a01b
jne 0x40a01b
push 0x654c6c45
ja 0x40a087
push edx
insb byte es:[edi], dx
inc esp
call fcn.0040a021
xor dword [esi], 0xffffff83
add dword ss:[esp], 8
ret
jmp 0x40a02b
jmp 0x40a02e
jmp 0x40a031
lea eax, [ebp - 0xb4]
mov dword [ebp - 0xb8], eax
mov ecx, dword [ebp - 0xb8]
and ecx, 0xffff
mov word [ebp - 4], cx
mov dword [ebp - 0x24], 0
jmp 0x40a05f
mov edx, dword [ebp - 0x24]
add edx, 1
mov dword [ebp - 0x24], edx
cmp dword [ebp - 0x24], 0xd
jge 0x40a0d0
movzx eax, word [ebp - 4]
movzx ecx, word [ebp - 4]
sar ecx, 2
xor eax, ecx
movzx edx, word [ebp - 4]
sar edx, 3
xor eax, edx
movzx ecx, word [ebp - 4]
sar ecx, 5
xor eax, ecx
and eax, 1
mov dword [ebp - 0xbc], eax
movzx edx, word [ebp - 4]
sar edx, 1
mov eax, dword [ebp - 0xbc]
shl eax, 0xf
or edx, eax
mov word [ebp - 4], dx
mov cx, word [ebp - 4]
mov word [ebp - 0xac], cx
movzx eax, word [ebp - 0xac]
and eax, 0xff
cdq
mov ecx, 0x7e
idiv ecx
add edx, 1
mov eax, dword [ebp - 0x24]
mov byte [ebp + eax - 0xd4], dl
jmp 0x40a056
mov ecx, 1
imul edx, ecx, 0xd
mov byte [ebp + edx - 0xd4], 0
jle 0x40a0ed
jg 0x40a0ed
call fcn.0040a2d9
add byte [ebx + 0x24048336], al
call 0x40a0f3
xor dword [esi], 0xffffff83
add al, 0x24
or bl, al
push 0xe
lea eax, [ebp - 0x1d8]
push eax
lea ecx, [ebp - 0xd4]
push ecx
call fcn.00409a6d
add esp, 0xc
mov byte [ebp - 0xa8], 0x73
mov byte [ebp - 0xa7], 0
mov byte [ebp - 0xa6], 0x65
mov byte [ebp - 0xa5], 0
mov byte [ebp - 0xa4], 0x72
mov byte [ebp - 0xa3], 0
mov byte [ebp - 0xa2], 0x76
mov byte [ebp - 0xa1], 0
mov byte [ebp - 0xa0], 0x69
mov byte [ebp - 0x9f], 0
mov byte [ebp - 0x9e], 0x63
mov byte [ebp - 0x9d], 0
mov byte [ebp - 0x9c], 0x65
mov byte [ebp - 0x9b], 0
mov byte [ebp - 0x9a], 0x2d
mov byte [ebp - 0x99], 0
mov byte [ebp - 0x98], 0x63
mov byte [ebp - 0x97], 0
invalid
invalid
invalid
Function at 0x40a2d9
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push dword [edx]
mov byte [ebp - 0x95], 0
mov byte [ebp - 0x94], 0x79
mov byte [ebp - 0x93], 0
mov byte [ebp - 0x92], 0x30
mov byte [ebp - 0x91], 0
mov byte [ebp - 0x90], 0x6a
mov byte [ebp - 0x8f], 0
mov byte [ebp - 0x8e], 0x74
mov byte [ebp - 0x8d], 0
mov byte [ebp - 0x8c], 0x62
mov byte [ebp - 0x8b], 0
mov byte [ebp - 0x8a], 0x61
mov byte [ebp - 0x89], 0
mov byte [ebp - 0x88], 0x2d
mov byte [ebp - 0x87], 0
mov byte [ebp - 0x86], 0x31
mov byte [ebp - 0x85], 0
mov byte [ebp - 0x84], 0x33
mov byte [ebp - 0x83], 0
mov byte [ebp - 0x82], 0x31
mov byte [ebp - 0x81], 0
mov byte [ebp - 0x80], 0x39
mov byte [ebp - 0x7f], 0
mov byte [ebp - 0x7e], 0x35
mov byte [ebp - 0x7d], 0
mov byte [ebp - 0x7c], 0x38
mov byte [ebp - 0x7b], 0
mov byte [ebp - 0x7a], 0x34
mov byte [ebp - 0x79], 0
mov byte [ebp - 0x78], 0x30
mov byte [ebp - 0x77], 0
mov byte [ebp - 0x76], 0x30
mov byte [ebp - 0x75], 0
mov byte [ebp - 0x74], 0x39
mov byte [ebp - 0x73], 0
mov byte [ebp - 0x72], 0x2e
mov byte [ebp - 0x71], 0
add dh, al
inc ebp
nop
mov byte [di - 0x6f], 0
mov byte [ebp - 0x6e], 0x7a
mov byte [ebp - 0x6d], 0
mov byte [ebp - 0x6c], 0x2e
mov byte [ebp - 0x6b], 0
mov byte [ebp - 0x6a], 0x74
mov byte [ebp - 0x69], 0
mov byte [ebp - 0x68], 0x65
mov byte [ebp - 0x67], 0
mov byte [ebp - 0x66], 0x6e
mov byte [ebp - 0x65], 0
mov byte [ebp - 0x64], 0x63
mov byte [ebp - 0x63], 0
mov byte [ebp - 0x62], 0x65
mov byte [ebp - 0x61], 0
mov byte [ebp - 0x60], 0x6e
mov byte [ebp - 0x5f], 0
mov byte [ebp - 0x5e], 0x74
mov byte [ebp - 0x5d], 0
mov byte [ebp - 0x5c], 0x61
movsb byte es:[edi], byte [esi]
popal
mov byte [ebp - 0x5b], 0
mov byte [ebp - 0x5a], 0x70
mov byte [ebp - 0x59], 0
mov byte [ebp - 0x58], 0x69
mov byte [ebp - 0x57], 0
mov byte [ebp - 0x56], 0x67
mov byte [ebp - 0x55], 0
add dh, al
inc ebp
lodsb al, byte [esi]
ja 0x40a2a5
inc ebp
lodsd eax, dword [esi]
add dh, al
inc ebp
scasb al, byte es:[edi]
mov byte cs:[ebp - 0x51], 0
mov byte [ebp - 0x50], 0x63
mov byte [ebp - 0x4f], 0
mov byte [ebp - 0x4e], 0x6f
mov byte [ebp - 0x4d], 0
mov byte [ebp - 0x4c], 0x6d
mov byte [ebp - 0x4b], 0
mov byte [ebp - 0x4a], 0x2e
mov byte [ebp - 0x49], 0
mov byte [ebp - 0x48], 0x63
mov byte [ebp - 0x47], 0
mov byte [ebp - 0x46], 0x6e

Function at 0x40ab0d
Capabilities:
Parse pe header
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov dword [ebp - 4], 0
mov eax, dword [ebp + 8]
mov dword [ebp - 0x14], eax
mov ecx, dword [ebp - 0x14]
movzx edx, word [ecx]
cmp edx, 0x5a4d
je 0x40ab36
mov eax, dword [ebp - 4]
jmp 0x40ac4f
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp + 8]
add ecx, dword [eax + 0x3c]
mov dword [ebp - 0x10], ecx
mov edx, dword [ebp - 0x10]
cmp dword [edx], 0x4550
mov esp, ebp
pop ebp
ret

Function at 0x40ad6d
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x64
mov dword [ebp - 0x28], 0
mov byte [ebp - 0x64], 0x61
mov byte [ebp - 0x63], 0x64
mov byte [ebp - 0x62], 0x76
mov byte [ebp - 0x61], 0x61
mov byte [ebp - 0x60], 0x70
mov byte [ebp - 0x5f], 0x69
mov byte [ebp - 0x5e], 0x33
Function at 0x40ad96
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov byte [ebp - 0x5d], 0x32
mov byte [ebp - 0x5c], 0x2e
mov byte [ebp - 0x5b], 0x64
mov byte [ebp - 0x5a], 0x6c
mov byte [ebp - 0x59], 0x6c
mov byte [ebp - 0x58], 0
mov byte [ebp - 0x3c], 0x70
mov byte [ebp - 0x3b], 0x73
mov byte [ebp - 0x3a], 0x61
mov byte [ebp - 0x39], 0x70
mov byte [ebp - 0x38], 0x69
mov byte [ebp - 0x37], 0x2e
mov byte [ebp - 0x36], 0x64
mov byte [ebp - 0x35], 0x6c
mov byte [ebp - 0x34], 0x6c
mov byte [ebp - 0x33], 0
mov byte [ebp - 0x54], 0x6d
mov byte [ebp - 0x53], 0x73
mov byte [ebp - 0x52], 0x76
mov byte [ebp - 0x51], 0x63
mov byte [ebp - 0x50], 0x72
mov byte [ebp - 0x4f], 0x74
mov byte [ebp - 0x4e], 0x2e
mov byte [ebp - 0x4d], 0x64
mov byte [ebp - 0x4c], 0x6c
mov byte [ebp - 0x4b], 0x6c
mov byte [ebp - 0x4a], 0
mov byte [ebp - 0x30], 0x77
mov byte [ebp - 0x2f], 0x69
mov byte [ebp - 0x2e], 0x6e
mov byte [ebp - 0x2d], 0x68
mov byte [ebp - 0x2c], 0x74
mov byte [ebp - 0x2b], 0x74
mov byte [ebp - 0x2a], 0x70
invalid
Function at 0x42f5d0
Capabilities:
Enumerate pe sections

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
xor edx, edx
push ebx
push esi
push edi
mov ecx, dword [eax + 0x3c]
add ecx, eax
movzx eax, word [ecx + 0x14]
movzx ebx, word [ecx + 6]
add eax, 0x18
add eax, ecx
test ebx, ebx
je 0x42f60e
mov edi, dword [ebp + 0xc]
mov esi, dword [eax + 0xc]
cmp edi, esi
jb 0x42f606
mov ecx, dword [eax + 8]
add ecx, esi
cmp edi, ecx
jb 0x42f610
inc edx
add eax, 0x28
cmp edx, ebx
jb 0x42f5f6
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x42f6f0
Capabilities:
Parse pe header

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
je 0x42f706
xor eax, eax
pop ebp
ret
mov ecx, dword [eax + 0x3c]
add ecx, eax
xor eax, eax
cmp dword [ecx], 0x4550
jne 0x42f721
mov edx, 0x10b
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret

Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43000c
nop
nop
nop
pop eax
nop
nop
add eax, 0x403d6f
nop
nop
sub eax, 0x403d15
nop
mov ebx, dword [eax]
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
xor dword [ebx], edx
nop
nop
nop
nop
add ebx, 4
nop
nop
nop
nop
nop
nop
nop
cmp ebx, ecx
nop
nop
jl 0x430030
nop
nop
nop
nop
add eax, 0xc
nop
nop
nop
cmp dword [eax], 0
nop
nop
jne 0x43001e
nop
nop
nop
nop
nop
nop
popal
nop
nop
jmp loc.00401219
Function at 0x100364b0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x10122c00]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, ecx
cmp dword [esi + 0x38], 0
je 0x1003656c
cmp byte [esi + 0x3d], 0
je 0x1003656c
mov eax, dword [esi]
push edi
push 0xffffffffffffffff
call dword [eax + 0xc]
cmp eax, 0xffffffff
je 0x1003655a
mov ecx, dword [esi + 0x38]
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [esi + 0x40]
push eax
call dword [sym.imp.MSVCP140.dll_public:_int___thiscall_std::codecvt_char__char__struct__Mbstatet_::unshift_struct__Mbstatet___char___char___char___const]
sub eax, 0
je 0x10036521
sub eax, 1
je 0x10036525
sub eax, 2
jne 0x1003655a
mov byte [esi + 0x3d], al
mov al, 1
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100ba6fe
mov esp, ebp
pop ebp
ret
mov byte [esi + 0x3d], 0
mov edi, dword [ebp - 0x28]
lea eax, [ebp - 0x24]
sub edi, eax
je 0x10036543
push dword [esi + 0x4c]
push edi
push 1
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
add esp, 0x10
cmp edi, eax
jne 0x1003655a
cmp byte [esi + 0x3d], 0
pop edi
sete al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100ba6fe
mov esp, ebp
pop ebp
ret
pop edi
xor al, al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100ba6fe
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
mov al, 1
xor ecx, ebp
pop esi
call fcn.100ba6fe
mov esp, ebp
pop ebp
ret
Function at 0x10037090
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
mov ebx, ecx
cmp dword [ebx + 0x38], 0
je 0x100370b5
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____thiscall_std::basic_streambuf_char__struct_std::char_traits_char__::xsputn_char_const___long_long___int64__]
pop ebx
mov esp, ebp
pop ebp
ret 0xc
push esi
mov esi, dword [ebp + 0xc]
push edi
mov edi, dword [ebp + 0x10]
mov dword [ebp - 8], esi
mov dword [ebp - 0xc], edi
call dword [sym.imp.MSVCP140.dll_protected:_long_long___int64____thiscall_std::basic_streambuf_char__struct_std::char_traits_char__::_Pnavail_void_const]
mov dword [ebp + 0x10], eax
mov ecx, edx
mov dword [ebp - 4], ecx
test edi, edi
jl 0x10037120
jg 0x100370db
test esi, esi
je 0x10037120
test ecx, ecx
jl 0x1003715a
jg 0x100370e5
test eax, eax
je 0x1003715a
cmp edi, ecx
jg 0x100370f5
jl 0x100370ef
cmp esi, eax
jae 0x100370f5
mov dword [ebp + 0x10], esi
mov dword [ebp - 4], edi
mov ecx, ebx
call dword [sym.imp.MSVCP140.dll_protected:_char____thiscall_std::basic_streambuf_char__struct_std::char_traits_char__::pptr_void_const]
push dword [ebp + 0x10]
push dword [ebp + 8]
push eax
call sub.VCRUNTIME140.dll_memcpy
mov ecx, dword [ebp + 0x10]
add esp, 0xc
add dword [ebp + 8], ecx
sub esi, ecx
sbb edi, dword [ebp - 4]
push ecx
mov ecx, ebx
call dword [sym.imp.MSVCP140.dll_protected:_void___thiscall_std::basic_streambuf_char__struct_std::char_traits_char__::pbump_int_]
mov eax, dword [ebp + 8]
test edi, edi
jl 0x10037147
jg 0x1003712d
test esi, esi
je 0x10037147
mov ecx, dword [ebx + 0x4c]
test ecx, ecx
je 0x10037147
push ecx
push esi
push 1
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
add esp, 0x10
sub esi, eax
sbb edi, 0
mov eax, dword [ebp - 8]
mov edx, dword [ebp - 0xc]
sub eax, esi
sbb edx, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov eax, dword [ebp + 8]
jmp 0x1003712d
Function at 0x10037370
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, dword [ebp + 0xc]
push edi
mov eax, dword [ebx]
mov edi, dword [ebp + 0x10]
cmp edi, 7
ja case.default.0x10037386
jmp dword [edi*4 + 0x1003751c]
mov ecx, esi
and ecx, 3
sub edi, ecx
sub ecx, 1
je 0x100373c9
sub ecx, 1
je 0x100373b6
sub ecx, 1
jne 0x100373dc
movzx edx, byte [esi]
movzx ecx, al
xor edx, ecx
shr eax, 8
xor eax, dword [edx*4 + 0x100c9200]
inc esi
movzx edx, byte [esi]
movzx ecx, al
xor edx, ecx
shr eax, 8
xor eax, dword [edx*4 + 0x100c9200]
inc esi
movzx edx, byte [esi]
movzx ecx, al
xor edx, ecx
shr eax, 8
xor eax, dword [edx*4 + 0x100c9200]
inc esi
mov edx, edi
sar edx, 3
test edx, edx
je 0x1003745e
xor eax, dword [esi]
movzx ecx, al
shr eax, 8
xor eax, dword [ecx*4 + 0x100c9200]
movzx ecx, al
shr eax, 8
xor eax, dword [ecx*4 + 0x100c9200]
movzx ecx, al
shr eax, 8
xor eax, dword [ecx*4 + 0x100c9200]
mov ecx, eax
movzx eax, cl
shr ecx, 8
mov eax, dword [eax*4 + 0x100c9200]
xor eax, dword [esi + 4]
add esi, 8
xor eax, ecx
movzx ecx, al
shr eax, 8
xor eax, dword [ecx*4 + 0x100c9200]
movzx ecx, al
shr eax, 8
xor eax, dword [ecx*4 + 0x100c9200]
movzx ecx, al
shr eax, 8
xor eax, dword [ecx*4 + 0x100c9200]
movzx ecx, al
shr eax, 8
xor eax, dword [ecx*4 + 0x100c9200]
sub edx, 1
jne 0x100373e5
and edi, 7
jmp 0x10037381
movzx edx, byte [esi]
movzx ecx, al
xor edx, ecx
shr eax, 8
xor eax, dword [edx*4 + 0x100c9200]
inc esi
movzx edx, byte [esi]
movzx ecx, al
xor edx, ecx
shr eax, 8
xor eax, dword [edx*4 + 0x100c9200]
inc esi
movzx edx, byte [esi]
movzx ecx, al
xor edx, ecx
shr eax, 8
xor eax, dword [edx*4 + 0x100c9200]
inc esi
xor eax, dword [esi]
movzx ecx, al
shr eax, 8
pop edi
pop esi
xor eax, dword [ecx*4 + 0x100c9200]
movzx ecx, al
shr eax, 8
xor eax, dword [ecx*4 + 0x100c9200]
movzx ecx, al
shr eax, 8
xor eax, dword [ecx*4 + 0x100c9200]
movzx ecx, al
shr eax, 8
xor eax, dword [ecx*4 + 0x100c9200]
mov dword [ebx], eax
pop ebx
pop ebp
ret
movzx edx, byte [esi]
movzx ecx, al
xor edx, ecx
shr eax, 8
xor eax, dword [edx*4 + 0x100c9200]
inc esi
movzx edx, byte [esi]
movzx ecx, al
xor edx, ecx
shr eax, 8
xor eax, dword [edx*4 + 0x100c9200]
inc esi
movzx edx, byte [esi]
movzx ecx, al
xor edx, ecx
shr eax, 8
xor eax, dword [edx*4 + 0x100c9200]
pop edi
pop esi
mov dword [ebx], eax
pop ebx
pop ebp
ret
Function at 0x1003749f
Capabilities:
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, dword [ebp + 0xc]
push edi
mov eax, dword [ebx]
mov edi, dword [ebp + 0x10]
cmp edi, 7
ja case.default.0x10037386
jmp dword [edi*4 + 0x1003751c]
mov ecx, esi
and ecx, 3
sub edi, ecx
sub ecx, 1
je 0x100373c9
sub ecx, 1
je 0x100373b6
sub ecx, 1
jne 0x100373dc
movzx edx, byte [esi]
movzx ecx, al
xor edx, ecx
shr eax, 8
xor eax, dword [edx*4 + 0x100c9200]
inc esi
movzx edx, byte [esi]
movzx ecx, al
xor edx, ecx
shr eax, 8
xor eax, dword [edx*4 + 0x100c9200]
inc esi
movzx edx, byte [esi]
movzx ecx, al
xor edx, ecx
shr eax, 8
xor eax, dword [edx*4 + 0x100c9200]
inc esi
mov edx, edi
sar edx, 3
test edx, edx
je 0x1003745e
xor eax, dword [esi]
movzx ecx, al
shr eax, 8
xor eax, dword [ecx*4 + 0x100c9200]
movzx ecx, al
shr eax, 8
xor eax, dword [ecx*4 + 0x100c9200]
movzx ecx, al
shr eax, 8
xor eax, dword [ecx*4 + 0x100c9200]
mov ecx, eax
movzx eax, cl
shr ecx, 8
mov eax, dword [eax*4 + 0x100c9200]
xor eax, dword [esi + 4]
add esi, 8
xor eax, ecx
movzx ecx, al
shr eax, 8
xor eax, dword [ecx*4 + 0x100c9200]
movzx ecx, al
shr eax, 8
xor eax, dword [ecx*4 + 0x100c9200]
movzx ecx, al
shr eax, 8
xor eax, dword [ecx*4 + 0x100c9200]
movzx ecx, al
shr eax, 8
xor eax, dword [ecx*4 + 0x100c9200]
sub edx, 1
jne 0x100373e5
and edi, 7
jmp 0x10037381
movzx edx, byte [esi]
movzx ecx, al
xor edx, ecx
shr eax, 8
xor eax, dword [edx*4 + 0x100c9200]
inc esi
movzx edx, byte [esi]
movzx ecx, al
xor edx, ecx
shr eax, 8
xor eax, dword [edx*4 + 0x100c9200]
inc esi
movzx edx, byte [esi]
movzx ecx, al
xor edx, ecx
shr eax, 8
xor eax, dword [edx*4 + 0x100c9200]
inc esi
xor eax, dword [esi]
movzx ecx, al
shr eax, 8
pop edi
pop esi
xor eax, dword [ecx*4 + 0x100c9200]
movzx ecx, al
shr eax, 8
xor eax, dword [ecx*4 + 0x100c9200]
movzx ecx, al
shr eax, 8
xor eax, dword [ecx*4 + 0x100c9200]
movzx ecx, al
shr eax, 8
xor eax, dword [ecx*4 + 0x100c9200]
mov dword [ebx], eax
pop ebx
pop ebp
ret
movzx edx, byte [esi]
movzx ecx, al
xor edx, ecx
shr eax, 8
xor eax, dword [edx*4 + 0x100c9200]
inc esi
movzx edx, byte [esi]
movzx ecx, al
xor edx, ecx
shr eax, 8
xor eax, dword [edx*4 + 0x100c9200]
inc esi
movzx edx, byte [esi]
movzx ecx, al
xor edx, ecx
shr eax, 8
xor eax, dword [edx*4 + 0x100c9200]
pop edi
pop esi
mov dword [ebx], eax
pop ebx
pop ebp
ret