joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4800a7
Capabilities:
Encode data using xor

Disassembly:
xor esi, ebx
push ebx
pop ebx
pushfd
out 0xdc, al
push ecx
jno 0x480100
or ecx, eax
stc
cmp ch, byte [edi - 0x33a0d394]
add dword [edx + 0x46a55073], esp
inc esi
jne 0x480094
into
pop ecx
inc ebx
xlatb
adc al, 0xf
adc byte [ebx - 0x66], dl
mov ah, 0x90
insd dword es:[edi], dx
xchg edx, eax
test eax, 0x4676a6b9
sbb dword [edi], eax
jl 0x4800d3
cmpsb byte fs:[esi], byte es:[edi]
in al, dx
movsb byte es:[edi], byte [esi]
xchg esi, eax
invalid
invalid
enter 0xffffffffffff8d65, 0xffffffffffffffc7
in al, dx
cli
or eax, dword [esp + ecx]
cmpsd dword [esi], dword es:[edi]
sub al, 0x47
mov al, 0xbb
lodsb al, byte [esi]
push ebx
adc dword [edi - 0x251329e7], esp
pop ecx
add byte [edi - 0x5a], bh
lea eax, [esi - 0x50]
jp 0x4800ac
pop esp
imul ebp, dword [edi - 0x18b338b4], 0xbab7070d
lodsd eax, dword [esi]
mov dh, 0x99
cmpsb byte [esi], byte es:[edi]
lea ebx, [edx - 0x54]
sbb cl, byte [eax - 0xb85123a]
push es
jo 0x480170
enter 0x6d14, 0xffffffffffffffe2
lea eax, [edi + 0x3748cb30]
fsub dword [edi + esi - 0x4edb6a7a]
and dword [edi + 0x570eb725], ecx
mov esi, 0x65c7442a
aaa
inc esp
dec edx
xor eax, 0xf56dcf6d
dec ebx
jge 0x480141
retf
cmc
sal byte [edi - 0x58c79a74], 0x57
vpinsrw xmm6, xmm7, esi, 0xe4
adc byte [ecx + 0x4a], 0x35
aaa
xchg esi, eax
jnp 0x4801ee
dec edx
xor eax, 0x787b9637
sub ebp, dword [edi]
stc
mov esi, 0x641cd97a
stosb byte es:[edi], al
add al, 0x57
sub ecx, ebx
mov edx, ebp
mov edi, dword [ebx - 0x40d23a76]
scasd eax, dword es:[edi]
mov bl, 0xf5
dec edx
invalid
test ah, 0x26
test eax, 0xd39d762c
mov dh, 0x14
retf 0xcd25

Function at 0x481bdd
Capabilities:
Authenticate hmac

Disassembly:
pop ds
inc ecx
add bl, cl
mov ah, 0x8b
scasb al, byte es:[edi]
sub eax, 0xa7f9ecf8
insd dword es:[edi], dx
push edx
push esi
sub al, 0x36
std
invalid

Function at 0x494463
Capabilities:
Encode data using xor

Disassembly:
push edx
fcompi st(4)
inc edi
xchg ecx, eax
push edi
dec eax
and ah, byte [eax]
popfd
nop
or eax, 0x6728781d
xchg ecx, eax
inc dword [ecx + ebp + 0x76c98c06]
cmp byte [ecx + ebx*4], bl
and esp, dword [eax - 4]
out 0x85, eax
pushal
lahf
rcl dword [edi]
cwde
out dx, al
mov al, byte [0xd6ea989d]
push cs
fild qword [edi - 0x43]
lodsb al, byte [esi]
xor edi, esp
jno 0x494465
hlt
mov cl, 3
xor byte [eax + 0x70], bl
push ds
xchg byte [eax], al
invalid
Function at 0x498919
Capabilities:
Encode data using xor

Disassembly:
add dword [ecx - 0x47f247d3], ecx
out dx, al
mov ebx, 0xbb2ebb0e
push cs
mov edx, 0xba0fba6f
das
mov edx, 0xbdefba0f
or byte [ebp - 0x42f742d8], bh
push 0x29bc08bd
mov esp, 0xbfe9bc09
or bh, byte [edi - 0x40f540d6]
imul edi, dword [esi - 0x4ed441f5], 4
mov al, 0xe5
mov dl, 0
mov ah, 0x22
mov dword [ecx + edi*4], edi
outsb dx, byte [esi]
mov edx, 0xb12bbf08
add eax, 0xc89e3b2
mov eax, 0xba0fbb2e
push 0x2bbc09bc
mov cl, 4
mov al, 0xe5
mov al, 6
mov ch, 0x1c
mov eax, 0xbb5cb40f
push cs
mov ebp, 0xb108bd28
out 0x89, eax
cmp al, 0x89
sub byte [ebp - 0x429742f8], bh
or byte [ebp - 0x4ffb41d6], bh
in eax, 0xb5
add dh, byte [edi - 0x47f376e4]
insd dword es:[edi], dx
mov ebx, 0xbb2ebb0e
push cs
mov ebx, 0xbf09bdef
sub dh, byte [edx - 0x489e4b00]
add dh, byte [esi - 0x46f376dd]
in eax, dx
mov eax, 0xb224bc08
add dword [edx + 0x1c8903b7], esi
mov ecx, 0xbdeebb0c
or esi, dword [ecx - 0x48fe4adb]
pop esp
mov ebx, 0xbf2abf09
add eax, 0x3b4e1b0
inc ebp
out dx, eax
mov ebp, 0xb22abf09
add byte [ebp - 0x49fd489f], dh
and ecx, dword [ecx - 0x471246f4]
or byte [esp + 0x62b401b2], bh
mov bh, 3
mov dword [ecx + edi*4], ebx
or al, 0xbb
out dx, al
mov ebp, 0xb525b10b
add dword [edi - 0x40f644a4], esi
sub bh, byte [edi - 0x4b1e4ffb]
add esp, dword [edi + 0x45]
xchg edx, eax
xor al, 0x9e
add eax, 0x30913793
xchg esp, eax
xor dl, byte [ebp - 0x67c364c3]
aas
cdq
cdq
cmp dword [esi - 0x62c463c8], ebx
cmp al, dl
xor eax, 0x37933492
nop
xchg esi, eax
xor dword [esi - 0x6bcf68d0], edx
xor edx, dword [edx + esi + 0x3c9a3295]
cwde
cdq
cdq
cdq
sahf
jne 0x49899f
aaa
nop
aaa
nop
aaa
nop
aaa
nop
aaa
nop
xchg ecx, eax
xchg ecx, eax
xchg ecx, eax
xchg ecx, eax
xor dword [esi - 0x69ce69cf], edx
xor dword [esi - 0x68cf68d0], edx
xor byte [edi - 0x6bcc6bd0], dl
xor edx, dword [ebx + esi + 0x32953394]
xchg ebp, eax
xor dl, byte [ebp - 0x6d7a6ace]
xor eax, 0x35923592
xchg edx, eax
xor eax, 0x34a2fd92
xchg byte [edx], dh
xor al, 0xfe
xor al, 0x2a
add eax, 0xd593b193
xchg ebx, eax
jmp 0x37eb97f1
Function at 0x498ae0
Capabilities:
Encode data using xor

Disassembly:
sal dword [esi], 1
add byte [0x39053b85], dh
xor byte [edx - 0x5da0f4db], ah
add eax, 0x54370543
rol byte [edx], cl
mov ah, 0xa5
cmp ecx, eax
wait
in eax, 0xa3
in eax, 0x97
inc esi
cmpsb byte [esi], byte es:[edi]
test dword [ebx - 0x313ab53b], esp
dec edx
adc byte [edi + 0x1ef14e1], 0x7e
add dword [esi + 0x616f017b], eax
jnp 0x498aa4
outsd dx, dword [esi]
popal
cmp esp, dword [ecx - 0x3b]
outsb dx, byte [esi]
push ebp
arpl word [ecx], si
sahf
add eax, 0x472299e
jae 0x498a71
lahf
insd dword es:[edi], dx
mov eax, dword [0x42387200]
xchg byte [esi + 0x3b], al
and al, byte [esi]
pushfd
frstor dword [ebx - 0x7bfbb3e3]
in al, dx
adc al, byte [0x46225d95]
mov esp, 0xecbd3a05
sub esp, dword [esi + 0x4885c206]
xor dl, byte [edi + 0x22858105]
lodsb al, byte [esi]
leave
outsd dx, dword [esi]
xchg edi, eax
mov byte ss:[0xf7e48e05], al
loopne 0x498aec
add eax, 0xfdc6ba2
test al, 5
mov byte [0xa415d20a], al
mov byte [0xa80fdc6b], al
add eax, 0x15d20aa2
movsb byte es:[edi], byte [esi]
adc ebp, dword [ecx - 0x757addf2]
jl 0x498aa1
pop es
mov byte [0x7cdd6a50], al
stc
scasb al, byte es:[edi]
and eax, 0xa32305a4
inc ebp
out dx, eax
movsb byte es:[edi], byte [esi]
add ah, byte [edx + 0x23154a05]
mov al, byte [0xb0523f8a]
ljmp 0x223e
Function at 0x498b65
Capabilities:
Encode data using xor

Disassembly:
ret 0x4885
add dword [esi - 0x28], ebx
jnp 0x498ad6
hlt
test al, 0x3c
mov ecx, 0x12b55759
mov ch, 0x12
mov ch, 0x12
pushfd
fnsave dword [0xb65475fa]
mov esp, 0xf45a7959
lcall 0x7e16, 0xfe6f2114
mov cl, 0xb5
in al, 0xab
xor eax, 0x826ef4c8
jns 0x498bd0
add al, 0xb4
imul ecx, ecx, 0x74
adc al, 0x7d
pop esp
adc ebp, dword [ebx + ecx*2 + 0x14]
cmc
or byte [edx + 0x31], ah
adc dl, byte [ebx - 0x4b]
jo 0x498b4d
add dword [ebx], edx
lcall 0x1525, 0xaa754a30
mov ch, 0x82
jb 0x498bfc
sti
sbb dh, byte [edi + 0x74]
arpl word [edx + 0x25], bp
mov al, 0xcd
movsb byte es:[edi], byte [esi]
sub eax, 0xabe22a69
lds dx, [bp + si + 0x6d74]
push ebp
jae 0x498b60
cmc
nop
in eax, 0x9c
dec ebx
mov dl, 0x54
sub cl, byte [ebp + 0x12741944]
je 0x498bdb
invalid
cli
push esp
jge 0x498c0d
xlatb
jp 0x498c4d
jp 0x498c1c
fsub qword [0x4074db2a]
and eax, 0x4074db2a
outsd dx, dword ds:[esi]
push esi
test al, 0x67
insb byte es:[edi], dx
dec byte [edi + edx*8 - 0x29]
xlatb
xlatb
je 0x498bab
mov dh, 0xa8
adc dword [ebp + edx - 0x1bacdabd], edx
pushal
pop ecx
xor al, 0x98
xor al, 0x98
or ebx, ebp
jg 0x498beb
cmc
xchg ebp, eax
pop esp
aaa
js 0x498c7b
jo 0x498c3d
imul ecx, dword [edx + eax + 0x70], 0xffffffda
jo 0x498be9
retf
inc ebx
pop ds
pop esi
loope 0x498c75
xor eax, 0x5d082559
int3
pop ebx
in al, 0xa9
inc ebx
ja 0x498c4c
aaa
and bl, bl
sbb al, 0xcd
dec esp
hlt
or al, 0x55
push ebp
adc al, 0x3d
shl byte [edx - 0x4e], 1
add eax, 0x5bee875c
adc al, 0xc9
jnp 0x498cd3
call 0x8096817e
jbe 0x498cb3
popal
pop es
sub eax, 0x1f642da1
mov dword [eax], 0xbf1fca2b
and eax, 0x9155586b
sub bl, byte [edx + 0x47]
ror byte [ebx - 0x29], 0xbb
ret 0xee56
mov ebx, 0x22ee56c2
pop esi
invalid
mov edx, 0xbc2f2ed
out 0xd8, al
mov dword [0x60d21428], eax
xchg edi, eax
push esp
into
insd dword es:[edi], dx
mov ebp, 0xbbf0d940
inc ecx
pop esp
sub al, 0xe
jmp [ebx - 0x1d]
pop edi
xchg esi, eax
cmp al, 0x91
ljmp 0xe64b

Function at 0x49cac4
Capabilities:
Encode data using xor

Disassembly:
push esp
fiadd word [ecx + 0x42837e04]
jnp 0x49cb19
adc eax, ecx
or dword [ebx - 0x650883a1], 0xdb0f6b4a
dec edi
mov ecx, 0xd60f1a0f
out dx, al
invalid
pop ecx
test byte [esi], ch
ja 0x49cb69
retf
xor eax, 0xc5d7d5e7
invalid

Function at 0x49f904
Capabilities:
Encode data using xor

Disassembly:
lds esi, [eax + 0x845336e]
lds eax, [esi - 0x7c82f690]
mov al, 0x57
popal
mov byte [0x8460b727], al
xor dword [ecx], 0x17
xor eax, 0x16234e82
adc dword [ebp + 0x240276f8], esp
mov eax, 0xbba69cfc
fistp word [ebx + 0x45]
inc ebx
in al, dx
aaa
push edx
push es
and ecx, dword [ebp - 0x249a2d4f]
sub bh, ch
or ch, byte [edi + ebp*2]
invalid
stc
xor eax, dword [edx - 0x70]
scasd eax, dword es:[edi]
shr byte [esi], 1
or ebx, esp
mov bl, 0x11
std
sbb al, 0xcb
mov dl, 0x25
rol byte [edi - 5], 1
xchg al, dh
xchg ebp, eax
loopne 0x49f8c1
inc ebx
test eax, ebp
adc dword [eax - 0xf], esp
mov ch, 0xf9
mov dl, 0x6b
inc edi
lcall 0x1853, 0xe7d214b8
stc
mov dword [0xa548d7d0], eax
iretd
Function at 0x4b604e
Capabilities:
Encode data using xor

Disassembly:
xchg ecx, eax
sbb eax, dword [esi + 8]
or byte [edi + 0x76], al
invalid
or byte [edi + 0x76], al
cmp bh, dl
cli
sub dword [ecx], esi
cmc
cmp dh, byte es:[eax]
cmp dh, byte [eax]
dec edx
lcall 0x7c94, 0xb8619491
xor eax, 0xfec213ec
pop eax
fsubr st(5)
out dx, eax
and al, 0xa1
jle 0x4b6057
mov eax, dword [0x80bce97e]
cdq
inc ebx
int 5
dec edx
sub eax, 0x1275d1ac
mov esp, 0xcd439980
add eax, 0xd1ac2d4a
jne 0x4b608c
jge 0x4b60f7
jns 0x4b606b
adc edx, ebx
cli
clc
sti
imul eax, dword [0x91da29a1], 0xffffff99
adc edi, dword [edi + 0x24bb7679]
adc esi, ebp
cdq
jns 0x4b6104
mov ebx, 0x99ee1124
jo 0x4b60bd
lodsd eax, dword [esi]
jo 0x4b604b
lcall 0xd2bd, 0x7ea07d6c
sal al, cl
jmp 0x4b60e8
sahf
jo 0x4b6128
pop ecx
inc edx
invalid
sub ah, bl
xor dl, al
jnp 0x4b6139
or byte [eax + 0x1402789e], dl
xor ebx, dword [eax]
sbb edx, ebp
pop esp
xchg ecx, eax
lodsd eax, dword [esi]
pop edi
call 0xe5ac91a1
cmpsb byte [esi], byte es:[edi]
xor byte [ecx - 0x1b], ah
jl 0x4b6128
xchg edx, eax
out 0xf1, eax
aaa
xchg dword [esi], ecx
movsb byte es:[edi], byte [esi]
cmpsb byte [esi], byte es:[edi]
mov gs, word [eax]
pushfd
fsubr dword [eax]
sub ebx, dword [eax + 0x4e]
or esp, dword [edx + 0xfd12aa9]
sar dword [0x74278ae1], cl
adc byte [ebx], dl
dec esi
retf 0x9602
arpl di, bp
jl 0x4b60e2
pushfd
dec eax
cmp al, 0x3c
invalid
jp 0x4b6179
call ss:[0x6c2ada0e]
sahf
retf 0xb9c3
insd dword es:[edi], dx
xor al, 0xbb
sal byte [ebp + eax*4 + 0x26], cl
fisubr word [eax - 0x5aab06b5]
scasb al, byte es:[edi]
jecxz 0x4b6202
xchg esp, eax
outsb dx, byte [esi]
mov word [edx + 0x4a], ds
mov edi, 0x1648958
xor eax, 0x5aa23daa
mov bl, 0x66
invalid
int 0x45
mov eax, 0x433f8c0f
lcall 0xb3d6, 0xf9b28db3
inc eax
lodsd eax, dword [esi]
aad 0x77
in al, 0x68
push edx
retf
push cs
add byte [eax - 0x3a33ed3b], bl
jp 0x4b619f
jmp 0xaa9bca3f
Function at 0x4bb7bd
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov edx, dword [ebp + 8]
xor ecx, ecx
mov eax, 0x4c43d0
cmp edx, dword [eax]
je 0x4bb7df
add eax, 8
inc ecx
cmp eax, 0x4c4460
jl 0x4bb7d0
push esi
mov esi, ecx
shl esi, 3
cmp edx, dword [esi + 0x4c43d0]
jne 0x4bb90d
mov eax, dword [0x4c8d64]
cmp eax, 1
je 0x4bb8e7
test eax, eax
jne 0x4bb810
cmp dword [0x4c42fc], 1
je 0x4bb8e7
cmp edx, 0xfc
je 0x4bb90d
lea eax, [ebp - 0x1a4]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x4bb847
lea eax, [ebp - 0x1a4]
push str._program_name_unknown_
push eax
call fcn.004bc1a0
pop ecx
pop ecx
lea eax, [ebp - 0x1a4]
push edi
push eax
lea edi, [ebp - 0x1a4]
call fcn.004bc630
inc eax
pop ecx
cmp eax, 0x3c
jbe 0x4bb88a
lea eax, [ebp - 0x1a4]
push eax
call fcn.004bc630
mov edi, eax
lea eax, [ebp - 0x1a4]
sub eax, 0x3b
push 3
add edi, eax
push 0x4c0b2c
push edi
call fcn.004be500
add esp, 0x10
lea eax, [ebp - 0xa0]
push str.Runtime_Error__n_nProgram:
push eax
call fcn.004bc1a0
lea eax, [ebp - 0xa0]
push edi
push eax
call fcn.004bc1b0
lea eax, [ebp - 0xa0]
push 0x4c0b0c
push eax
call fcn.004bc1b0
push dword [esi + 0x4c43d4]
lea eax, [ebp - 0xa0]
push eax
call fcn.004bc1b0
push 0x12010
lea eax, [ebp - 0xa0]
push str.Microsoft_Visual_C_Runtime_Library
push eax
call fcn.004be474
add esp, 0x2c
pop edi
jmp 0x4bb90d
lea eax, [ebp + 8]
lea esi, [esi + 0x4c43d4]
push 0
push eax
push dword [esi]
call fcn.004bc630
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop esi
leave
ret

Function at 0x58b98a
Capabilities:
Parse pe header

Disassembly:
add esp, 4
push dword [esp]
mov ebx, dword [esp]
push ebp
mov ebp, esp
add ebp, 4
add ebp, 4
xchg dword [esp], ebp
pop esp
push esi
mov esi, esp
add esi, 4
add esi, 4
xchg dword [esp], esi
pop esp
jmp fcn.005d7ef9

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x100093d0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x14
push ebx
push esi
push edi
mov edi, ecx
cmp dword [edi + 0x38], 0
je 0x100093fc
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____thiscall_std::basic_streambuf_char__struct_std::char_traits_char__::xsgetn_char___long_long___int64__]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov eax, dword [edi + 0x1c]
mov esi, dword [ebp + 0xc]
mov ebx, dword [ebp + 0x10]
mov dword [esp + 0x18], esi
mov eax, dword [eax]
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x14], eax
test eax, eax
je 0x1000941e
mov eax, dword [edi + 0x2c]
mov eax, dword [eax]
jmp 0x10009420
xor eax, eax
cdq
mov dword [esp + 0xc], eax
mov ecx, edx
mov dword [esp + 0x10], ecx
test ebx, ebx
jl 0x100094c0
jg 0x1000943d
test esi, esi
je 0x100094c0
test ecx, ecx
jl 0x1000948a
jg 0x10009447
test eax, eax
je 0x1000948a
cmp ebx, ecx
jg 0x1000945b
jl 0x10009451
cmp esi, eax
jae 0x1000945b
mov eax, esi
mov dword [esp + 0xc], esi
mov dword [esp + 0x10], ebx
push eax
push dword [esp + 0x18]
push dword [ebp + 8]
call sub.VCRUNTIME140.dll_memcpy
mov ecx, dword [esp + 0x18]
add esp, 0xc
mov edx, dword [ebp + 8]
mov eax, dword [edi + 0x2c]
add edx, ecx
sub esi, ecx
mov dword [esp + 0xc], edx
sbb ebx, dword [esp + 0x10]
sub dword [eax], ecx
mov eax, dword [edi + 0x1c]
add dword [eax], ecx
jmp 0x10009491
mov eax, dword [ebp + 8]
mov dword [esp + 0xc], eax
test ebx, ebx
jl 0x100094c0
jg 0x1000949b
test esi, esi
je 0x100094c0
cmp dword [edi + 0x4c], 0
je 0x100094c0
mov ecx, edi
call fcn.10009d00
push dword [edi + 0x4c]
push esi
push 1
push dword [esp + 0x18]
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
add esp, 0x10
sub esi, eax
sbb ebx, 0
mov eax, dword [esp + 0x18]
mov edx, dword [esp + 0x1c]
sub eax, esi
pop edi
pop esi
sbb edx, ebx
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x100094e0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x14
push ebx
mov ebx, ecx
push esi
push edi
cmp dword [ebx + 0x38], 0
je 0x1000950c
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____thiscall_std::basic_streambuf_char__struct_std::char_traits_char__::xsputn_char_const___long_long___int64__]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov eax, dword [ebx + 0x20]
mov esi, dword [ebp + 0xc]
mov edi, dword [ebp + 0x10]
mov dword [esp + 0x18], esi
mov eax, dword [eax]
mov dword [esp + 0x1c], edi
mov dword [esp + 0x14], eax
test eax, eax
je 0x1000952e
mov eax, dword [ebx + 0x30]
mov eax, dword [eax]
jmp 0x10009530
xor eax, eax
cdq
mov dword [esp + 0xc], eax
mov ecx, edx
mov dword [esp + 0x10], ecx
test edi, edi
jl 0x100095b5
jg 0x10009545
test esi, esi
je 0x100095b5
test ecx, ecx
jl 0x1000958e
jg 0x1000954f
test eax, eax
je 0x1000958e
cmp edi, ecx
jg 0x10009563
jl 0x10009559
cmp esi, eax
jae 0x10009563
mov eax, esi
mov dword [esp + 0xc], esi
mov dword [esp + 0x10], edi
push eax
push dword [ebp + 8]
push dword [esp + 0x1c]
call sub.VCRUNTIME140.dll_memcpy
mov ecx, dword [esp + 0x18]
add esp, 0xc
mov edx, dword [ebp + 8]
mov eax, dword [ebx + 0x30]
add edx, ecx
sub esi, ecx
sbb edi, dword [esp + 0x10]
sub dword [eax], ecx
mov eax, dword [ebx + 0x20]
add dword [eax], ecx
jmp 0x10009591
mov edx, dword [ebp + 8]
test edi, edi
jl 0x100095b5
jg 0x1000959b
test esi, esi
je 0x100095b5
mov eax, dword [ebx + 0x4c]
test eax, eax
je 0x100095b5
push eax
push esi
push 1
push edx
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
add esp, 0x10
sub esi, eax
sbb edi, 0
mov eax, dword [esp + 0x18]
mov edx, dword [esp + 0x1c]
sub eax, esi
sbb edx, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x10009d30
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
mov eax, dword [0x100a900c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, ecx
cmp ebx, 0xffffffff
jne 0x10009d60
pop esi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10073ea5
mov esp, ebp
pop ebp
ret 4
mov eax, dword [esi + 0x20]
mov eax, dword [eax]
test eax, eax
je 0x10009d90
mov edx, dword [esi + 0x30]
mov edx, dword [edx]
add edx, eax
cmp eax, edx
jae 0x10009d90
call dword [sym.imp.MSVCP140.dll_protected:_char____thiscall_std::basic_streambuf_char__struct_std::char_traits_char__::_Pninc_void_]
pop esi
mov byte [eax], bl
mov eax, ebx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10073ea5
mov esp, ebp
pop ebp
ret 4
cmp dword [esi + 0x4c], 0
push edi
je 0x10009e65
mov edi, dword [esi + 0xc]
lea eax, [esi + 0x3c]
cmp dword [edi], eax
jne 0x10009db9
mov edx, dword [esi + 0x54]
mov ecx, dword [esi + 0x50]
sub edx, ecx
mov dword [edi], ecx
mov eax, dword [esi + 0x1c]
mov dword [eax], ecx
mov eax, dword [esi + 0x2c]
mov dword [eax], edx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x10009dc5
movsx eax, bl
jmp 0x10009dfc
lea eax, [ebp - 0x2c]
mov byte [ebp - 0x25], bl
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x25]
push eax
lea eax, [esi + 0x40]
push eax
call dword [sym.imp.MSVCP140.dll_public:_int___thiscall_std::codecvt_char__char__struct__Mbstatet_::out_struct__Mbstatet___char_const___char_const___char_const____char___char___char___const]
test eax, eax
js 0x10009e65
cmp eax, 1
jle 0x10009e26
cmp eax, 3
jne 0x10009e65
movsx eax, byte [ebp - 0x25]
push dword [esi + 0x4c]
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
add esp, 8
or ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, ebx
pop edi
pop esi
mov eax, ecx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10073ea5
mov esp, ebp
pop ebp
ret 4
mov edi, dword [ebp - 0x2c]
lea eax, [ebp - 0x24]
sub edi, eax
je 0x10009e44
push dword [esi + 0x4c]
push edi
push 1
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
add esp, 0x10
cmp edi, eax
jne 0x10009e65
lea eax, [ebp - 0x25]
mov byte [esi + 0x3d], 1
cmp dword [ebp - 0x30], eax
je 0x10009e65
pop edi
pop esi
mov eax, ebx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10073ea5
mov esp, ebp
pop ebp
ret 4
mov ecx, dword [ebp - 4]
or eax, 0xffffffff
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10073ea5
mov esp, ebp
pop ebp
ret 4
Function at 0x10009e80
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x100a900c]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, ecx
push edi
cmp dword [esi + 0x38], 0
je 0x10009f23
cmp byte [esi + 0x3d], 0
je 0x10009f23
mov eax, dword [esi]
push 0xffffffffffffffff
call dword [eax + 0xc]
cmp eax, 0xffffffff
je 0x10009ed8
mov ecx, dword [esi + 0x38]
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [esi + 0x40]
push eax
call dword [sym.imp.MSVCP140.dll_public:_int___thiscall_std::codecvt_char__char__struct__Mbstatet_::unshift_struct__Mbstatet___char___char___char___const]
sub eax, 0
je 0x10009eea
sub eax, 1
je 0x10009eee
sub eax, 2
je 0x10009f23
pop edi
xor al, al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10073ea5
mov esp, ebp
pop ebp
ret
mov byte [esi + 0x3d], 0
mov edi, dword [ebp - 0x28]
lea eax, [ebp - 0x24]
sub edi, eax
je 0x10009f0c
push dword [esi + 0x4c]
push edi
push 1
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
add esp, 0x10
cmp edi, eax
jne 0x10009ed8
cmp byte [esi + 0x3d], 0
pop edi
sete al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10073ea5
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
mov al, 1
pop edi
xor ecx, ebp
pop esi
call fcn.10073ea5
mov esp, ebp
pop ebp
ret
Function at 0x100153d0
Capabilities:
Hash data using murmur3

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
mov esi, ecx
push edi
mov dword [ebp - 0x10], esi
cmp dword [esi], 0
jne 0x100154fb
mov edx, dword [esi + 8]
sub edx, dword [esi + 4]
sar edx, 3
cmp edx, 2
jle 0x100154fb
mov edi, dword [ebp + 8]
mov ecx, 1
mov dword [ebp - 0x20], edi
mov dword [ebp - 0xc], ecx
mov eax, dword [edi + 8]
movq xmm0, qword [edi]
mov dword [ebp - 0x14], eax
mov eax, edx
shr eax, 1
add eax, edx
movq qword [ebp - 0x1c], xmm0
cmp eax, ecx
jbe 0x10015429
add ecx, ecx
cmp ecx, eax
jb 0x10015420
mov dword [ebp - 0xc], ecx
lea ebx, [ecx*4]
mov ecx, edi
push ebx
call fcn.10015790
mov edi, eax
mov dword [ebp - 8], edi
test edi, edi
je 0x100154d0
push ebx
push 0
push edi
call sub.VCRUNTIME140.dll_memset
mov ecx, dword [esi + 4]
add esp, 0xc
mov ebx, ecx
mov dword [ebp + 8], ecx
cmp ebx, dword [esi + 8]
je 0x100154cd
nop
mov eax, dword [ebx + 4]
test eax, eax
je 0x1001546b
xor esi, esi
jmp 0x1001546d
mov esi, dword [ebx]
test eax, eax
cmovne esi, eax
test esi, esi
je 0x100154c2
mov edx, dword [ebp - 0xc]
mov eax, esi
shr eax, 0x10
dec edx
xor eax, esi
imul ecx, eax, 0x85ebca6b
mov eax, ecx
shr eax, 0xd
xor eax, ecx
imul ecx, eax, 0xc2b2ae35
mov eax, ecx
shr eax, 0x10
xor eax, ecx
and eax, edx
xor ecx, ecx
nop
mov edx, dword [edi + eax*4]
lea edi, [edi + eax*4]
test edx, edx
je 0x100154e1
mov edi, dword [ebp - 8]
cmp edx, esi
je 0x100154bf
mov edx, dword [ebp - 0xc]
inc eax
add eax, ecx
dec edx
inc ecx
and eax, edx
cmp ecx, edx
jbe 0x100154a0
mov ecx, dword [ebp + 8]
mov esi, dword [ebp - 0x10]
add ebx, 8
cmp ebx, dword [esi + 8]
jne 0x10015460
mov dword [esi + 8], ecx
lea ecx, [ebp - 0x20]
call fcn.10015380
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
mov ecx, dword [ebp + 8]
mov dword [edi], esi
mov eax, dword [ebx]
mov edi, dword [ebp - 8]
mov dword [ecx], eax
mov eax, dword [ebx + 4]
mov dword [ecx + 4], eax
add ecx, 8
mov dword [ebp + 8], ecx
jmp 0x100154c2
mov ebx, dword [esi + 8]
mov edx, ebx
mov ecx, dword [esi + 4]
sub edx, ecx
mov eax, edx
mov dword [ebp + 8], ebx
and eax, 0xfffffff8
cmp eax, 8
jle 0x10015538
mov ebx, dword [ecx]
mov edi, dword [ecx + 8]
cmp ebx, edi
jne 0x10015523
mov eax, dword [ecx + 4]
cmp eax, dword [ecx + 0xc]
je 0x10015535
sub edx, 8
add ecx, 8
mov eax, edx
mov ebx, edi
and eax, 0xfffffff8
cmp eax, 8
jg 0x10015514
mov ebx, dword [ebp + 8]
cmp ecx, ebx
je 0x1001556a
mov edx, ecx
add ecx, 8
cmp ecx, ebx
je 0x10015567
mov eax, dword [ecx]
cmp eax, dword [edx]
jne 0x10015553
mov eax, dword [ecx + 4]
cmp eax, dword [edx + 4]
je 0x10015560
mov eax, dword [ecx]
add edx, 8
mov dword [edx], eax
mov eax, dword [ecx + 4]
mov dword [edx + 4], eax
add ecx, 8
cmp ecx, ebx
jne 0x10015545
lea ecx, [edx + 8]
pop edi
mov dword [esi + 8], ecx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4