joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10077130
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov edx, dword [ebp + 0xc]
mov eax, ecx
push ebx
push esi
push edi
cmp dword [edx + 0x14], 0xf
mov edi, edx
mov ebx, dword [edx + 0x10]
mov dword [ebp - 4], eax
jbe 0x1007714e
mov edi, dword [edx]
xor ecx, ecx
mov esi, 0x811c9dc5
test ebx, ebx
je 0x10077174
nop dword [eax]
movzx eax, byte [edi + ecx]
inc ecx
xor eax, esi
imul esi, eax, 0x1000193
cmp ecx, ebx
jb 0x10077160
mov eax, dword [ebp - 4]
push esi
push edx
lea ecx, [ebp - 0xc]
push ecx
mov ecx, eax
call fcn.10022860
pop edi
pop esi
pop ebx
mov ecx, dword [eax + 4]
mov eax, dword [ebp + 8]
test ecx, ecx
jne 0x10077194
mov ecx, dword [ebp - 4]
mov ecx, dword [ecx + 4]
mov dword [eax], ecx
mov esp, ebp
pop ebp
ret 8
Function at 0x1007bfe0
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1015488d
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
mov eax, dword [0x10209f80]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
xor bl, bl
cmp dword [esi + 0x10], 0
je 0x1007c0cb
mov eax, dword [ecx]
push esi
mov eax, dword [eax + 8]
call eax
test al, al
jne 0x1007c0cb
lea eax, [ebp - 0x28]
push esi
push eax
call fcn.100825a0
add esp, 8
cmp dword [ebp - 0x14], 7
lea eax, [ebp - 0x28]
push 0
cmova eax, dword [ebp - 0x28]
push eax
mov dword [ebp - 4], 0
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
je 0x1007c059
mov bl, 1
jmp 0x1007c08f
push str.Error_creating_directory
push dword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.1006d630
mov ecx, dword [esi + 0x10]
add esp, 8
cmp dword [esi + 0x14], 0xf
jbe 0x1007c077
mov esi, dword [esi]
push ecx
push esi
push eax
call fcn.1001ac60
add esp, 0xc
mov ecx, eax
push 0x100770d0
call dword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______thiscall_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char_______cdecl___class_std::basic_ostream_char__struct_std::char_traits_char_____]
mov ecx, dword [ebp - 0x14]
cmp ecx, 7
jbe 0x1007c0cb
mov edx, dword [ebp - 0x28]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x1007c0c1
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x1007c0c1
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push ecx
push edx
call fcn.100f340e
add esp, 8
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.100f3936
mov esp, ebp
pop ebp
ret 4
Function at 0x10085650
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
mov ebx, ecx
mov eax, 0x1fffffff
bsr ecx, eax
push esi
push edi
mov edi, 1
mov dword [ebp - 8], ebx
mov eax, edi
shl eax, cl
mov ecx, dword [ebp + 8]
cmp ecx, eax
ja 0x100857aa
lea eax, [ecx - 1]
mov esi, dword [ebx + 4]
or eax, edi
mov dword [ebp - 0xc], esi
bsr ecx, eax
push esi
lea ecx, [ecx + 1]
shl edi, cl
lea ecx, [ebx + 0xc]
lea eax, [edi + edi]
push eax
call fcn.10027050
lea eax, [edi - 1]
mov dword [ebx + 0x1c], edi
mov dword [ebx + 0x18], eax
mov eax, dword [ebx + 4]
mov eax, dword [eax]
mov ecx, eax
cmp eax, esi
je 0x1008577d
movzx edx, byte [eax + 8]
xor edx, 0x811c9dc5
mov ecx, dword [ecx]
imul edi, edx, 0x1000193
movzx edx, byte [eax + 9]
xor edi, edx
movzx edx, byte [eax + 0xa]
imul edi, edi, 0x1000193
xor edi, edx
movzx edx, byte [eax + 0xb]
imul edi, edi, 0x1000193
xor edi, edx
imul edx, edi, 0x1000193
mov edi, dword [ebx + 0x18]
and edi, edx
mov edx, dword [ebx + 0xc]
lea edx, [edx + edi*8]
mov edi, dword [edx]
mov dword [ebp - 0x10], edx
cmp edi, esi
jne 0x10085703
mov dword [edx], eax
mov dword [edx + 4], eax
jmp 0x10085773
mov edx, dword [edx + 4]
mov ebx, dword [eax + 8]
cmp ebx, dword [edx + 8]
jne 0x1008573d
mov edx, dword [edx]
mov dword [ebp - 4], edx
cmp edx, eax
je 0x10085735
mov ebx, dword [eax + 4]
mov esi, dword [ebp - 4]
mov dword [ebx], ecx
mov edi, dword [ecx + 4]
mov dword [edi], edx
mov edx, dword [edx + 4]
mov dword [edx], eax
mov dword [esi + 4], edi
mov esi, dword [ebp - 0xc]
mov dword [ecx + 4], ebx
mov dword [eax + 4], edx
mov edx, dword [ebp - 0x10]
mov dword [edx + 4], eax
jmp 0x10085770
cmp edi, edx
je 0x1008574d
mov edx, dword [edx + 4]
cmp ebx, dword [edx + 8]
je 0x10085786
cmp edi, edx
jne 0x10085741
mov ebx, dword [eax + 4]
mov dword [ebp - 4], ebx
mov dword [ebx], ecx
mov ebx, dword [ecx + 4]
mov dword [ebx], edx
mov edi, dword [edx + 4]
mov dword [edi], eax
mov dword [edx + 4], ebx
mov edx, dword [ebp - 4]
mov dword [ecx + 4], edx
mov edx, dword [ebp - 0x10]
mov dword [eax + 4], edi
mov dword [edx], eax
mov ebx, dword [ebp - 8]
mov eax, ecx
cmp ecx, esi
jne 0x100856b2
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
mov ebx, dword [eax + 4]
mov edx, dword [edx]
mov dword [ebp - 4], edx
mov esi, edx
mov dword [ebx], ecx
mov edi, dword [ecx + 4]
mov dword [edi], edx
mov edx, dword [edx + 4]
mov dword [edx], eax
mov dword [esi + 4], edi
mov esi, dword [ebp - 0xc]
mov dword [ecx + 4], ebx
mov dword [eax + 4], edx
jmp 0x10085770
push str.invalid_hash_bucket_count
call sub.MSVCP140.dll_void___cdecl_std::_Xlength_error_char_const__
int3
Function at 0x10086820
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [ebp + 0xc]
mov edx, ecx
push ebx
mov ebx, dword [ebp + 8]
mov dword [ebp - 0x14], edx
cmp ebx, eax
je 0x1008698f
mov eax, dword [edx + 4]
mov dword [ebp - 0x18], eax
mov eax, dword [ebx + 4]
mov dword [ebp - 8], eax
movzx eax, byte [ebx + 8]
xor eax, 0x811c9dc5
imul ecx, eax, 0x1000193
movzx eax, byte [ebx + 9]
push esi
push edi
mov edi, dword [edx + 0xc]
mov esi, ebx
xor ecx, eax
mov dword [ebp - 0x1c], edi
movzx eax, byte [ebx + 0xa]
imul ecx, ecx, 0x1000193
xor ecx, eax
movzx eax, byte [ebx + 0xb]
imul ecx, ecx, 0x1000193
xor ecx, eax
mov eax, dword [edx + 0x18]
imul ecx, ecx, 0x1000193
and eax, ecx
mov ecx, dword [edi + eax*8]
mov dword [ebp - 4], ecx
lea eax, [edi + eax*8]
mov dword [ebp - 0xc], eax
mov eax, dword [eax + 4]
mov dword [ebp - 0x10], eax
nop word [eax + eax]
mov edi, esi
mov ebx, esi
mov esi, dword [esi]
lea ecx, [edi + 0xc]
call fcn.10079320
push 0x2c
push edi
call fcn.100f340e
mov edx, dword [ebp - 0x14]
add esp, 8
dec dword [edx + 8]
cmp ebx, dword [ebp - 0x10]
je 0x100868ed
mov eax, dword [ebp + 0xc]
cmp esi, eax
jne 0x100868a0
mov ecx, dword [ebp - 4]
cmp ecx, dword [ebp + 8]
jne 0x10086985
mov edi, dword [ebp - 0xc]
mov ecx, dword [ebp - 8]
mov dword [edi], esi
mov dword [ecx], esi
pop edi
mov dword [esi + 4], ecx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
mov ecx, dword [ebp - 4]
mov edi, dword [ebp - 0xc]
cmp ecx, dword [ebp + 8]
jne 0x10086901
mov eax, dword [ebp - 0x18]
mov ecx, eax
mov dword [edi], eax
jmp 0x10086904
mov ecx, dword [ebp - 8]
mov eax, dword [ebp + 0xc]
mov dword [edi + 4], ecx
cmp esi, eax
je 0x10086985
nop
movzx eax, byte [esi + 8]
xor eax, 0x811c9dc5
imul ecx, eax, 0x1000193
movzx eax, byte [esi + 9]
xor ecx, eax
movzx eax, byte [esi + 0xa]
imul ecx, ecx, 0x1000193
xor ecx, eax
movzx eax, byte [esi + 0xb]
imul ecx, ecx, 0x1000193
xor ecx, eax
imul eax, ecx, 0x1000193
mov ecx, dword [ebp - 0x1c]
and eax, dword [edx + 0x18]
lea eax, [ecx + eax*8]
mov dword [ebp - 4], eax
mov eax, dword [eax + 4]
mov dword [ebp - 0x10], eax
mov edi, esi
mov ebx, esi
mov esi, dword [esi]
lea ecx, [edi + 0xc]
call fcn.10079320
push 0x2c
push edi
call fcn.100f340e
mov edx, dword [ebp - 0x14]
add esp, 8
mov eax, dword [ebp + 0xc]
dec dword [edx + 8]
cmp ebx, dword [ebp - 0x10]
je 0x10086996
cmp esi, eax
jne 0x10086955
mov ecx, dword [ebp - 4]
mov dword [ecx], esi
mov ecx, dword [ebp - 8]
pop edi
mov dword [ecx], esi
mov dword [esi + 4], ecx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
mov ecx, dword [ebp - 4]
mov ebx, dword [ebp - 0x18]
mov dword [ecx], ebx
mov dword [ecx + 4], ebx
cmp esi, eax
jne 0x10086910
mov ecx, dword [ebp - 8]
pop edi
mov dword [ecx], esi
mov dword [esi + 4], ecx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x10086cb0
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, ecx
movzx eax, byte [esi]
xor eax, 0x811c9dc5
imul edx, eax, 0x1000193
movzx eax, byte [esi + 1]
xor edx, eax
movzx eax, byte [esi + 2]
imul edx, edx, 0x1000193
xor edx, eax
movzx eax, byte [esi + 3]
imul ecx, edx, 0x1000193
xor ecx, eax
imul eax, ecx, 0x1000193
mov ecx, edi
push eax
push esi
lea eax, [ebp - 8]
push eax
call fcn.1006ee60
mov eax, dword [ebp - 4]
pop edi
pop esi
test eax, eax
je 0x10086d0e
add eax, 0xc
mov esp, ebp
pop ebp
ret 4
push str.invalid_unordered_map_K__T__key
call sub.MSVCP140.dll_void___cdecl_std::_Xout_of_range_char_const__
int3

Function at 0x10087530
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 0xc]
mov edx, 0x811c9dc5
push edi
mov edi, dword [ebp + 8]
mov ecx, 0
sub esi, edi
je 0x10087561
nop dword [eax]
movzx eax, byte [edi + ecx]
inc ecx
xor eax, edx
imul edx, eax, 0x1000193
cmp ecx, esi
jb 0x10087550
pop edi
mov eax, edx
pop esi
pop ebp
ret 8
Function at 0x1008f400
Capabilities:
Allocate or change rwx memory

Disassembly:
mov eax, dword [0x1020b88c]
test eax, eax
je 0x1008f41c
nop dword [eax]
cmp dword [eax + 4], 0
jne 0x1008f46b
mov eax, dword [eax]
test eax, eax
jne 0x1008f410
push 0x40
push 0x3000
push 0x1000
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
test eax, eax
je 0x1008f479
push esi
push edi
xor edi, edi
mov dword [eax + 8], 0
lea edx, [eax + 0x20]
lea esi, [edi + 0x20]
mov dword [edx], edi
mov ecx, edx
mov dword [eax + 4], edx
add esi, 0x20
add edx, 0x20
mov edi, ecx
cmp esi, 0xfe0
jbe 0x1008f445
mov ecx, dword [0x1020b88c]
pop edi
mov dword [eax], ecx
pop esi
mov dword [0x1020b88c], eax
mov edx, dword [eax + 4]
mov ecx, dword [edx]
inc dword [eax + 8]
mov dword [eax + 4], ecx
mov eax, edx
ret
xor eax, eax
ret
Function at 0x1008fe20
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [0x10209f80]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push esi
imul esi, eax, 0x2c
push edi
add esi, dword [0x1020b880]
mov eax, dword [esi]
mov cl, byte [esi + 0x14]
and cl, 1
lea edi, [eax - 5]
cmove edi, eax
movzx eax, cl
lea ecx, [ebp - 8]
push ecx
push 0x40
lea eax, [eax*2 + 5]
push eax
push edi
mov dword [ebp - 0xc], eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x1008fe80
pop edi
mov eax, 0xa
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100f3936
mov esp, ebp
pop ebp
ret
push ebx
mov ebx, dword [ebp + 0xc]
test ebx, ebx
je 0x1008fea5
mov byte [edi], 0xe9
mov eax, dword [esi + 4]
sub eax, edi
sub eax, 5
mov dword [edi + 1], eax
test byte [esi + 0x14], 1
je 0x1008fec6
mov eax, dword [esi]
mov word [eax], 0xf9eb
jmp 0x1008fec6
mov eax, dword [esi + 0xc]
test byte [esi + 0x14], 1
mov dword [edi], eax
je 0x1008fec0
mov ax, word [esi + 0x10]
mov word [edi + 4], ax
mov al, byte [esi + 0x12]
mov byte [edi + 6], al
jmp 0x1008fec6
mov al, byte [esi + 0x10]
mov byte [edi + 4], al
lea eax, [ebp - 8]
push eax
push dword [ebp - 8]
push dword [ebp - 0xc]
push edi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
push dword [ebp - 0xc]
push edi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_FlushInstructionCache]
mov cl, bl
xor eax, eax
add cl, cl
shl bl, 2
xor cl, byte [esi + 0x14]
and cl, 2
xor cl, byte [esi + 0x14]
xor bl, cl
and bl, 4
xor bl, cl
mov ecx, dword [ebp - 4]
mov byte [esi + 0x14], bl
xor ecx, ebp
pop ebx
pop edi
pop esi
call fcn.100f3936
mov esp, ebp
pop ebp
ret
Function at 0x1008ffb0
Capabilities:
Enumerate threads
Suspend thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x10209f80]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
push 0
push 4
mov dword [esi], 0
mov dword [esi + 4], 0
mov dword [esi + 8], 0
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov edi, eax
cmp edi, 0xffffffff
je 0x100900a8
lea eax, [ebp - 0x20]
mov dword [ebp - 0x20], 0x1c
push eax
push edi
call sub.KERNEL32.dll_Thread32First
test eax, eax
je 0x100900a1
mov ebx, dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
nop dword [eax]
cmp dword [ebp - 0x20], 0x10
jb 0x10090088
call ebx
cmp dword [ebp - 0x14], eax
jne 0x10090088
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp dword [ebp - 0x18], eax
je 0x10090088
mov edx, dword [esi]
test edx, edx
jne 0x10090051
push 0x200
push edx
mov dword [esi + 4], 0x80
push dword [0x1020b280]
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov edx, eax
mov dword [esi], edx
test edx, edx
je 0x100900a1
jmp 0x1009007c
mov eax, dword [esi + 4]
cmp dword [esi + 8], eax
jb 0x1009007c
shl eax, 3
push eax
push edx
push 0
push dword [0x1020b280]
call dword [sym.imp.KERNEL32.dll_HeapReAlloc]
mov edx, eax
test edx, edx
je 0x100900a1
mov eax, dword [esi + 4]
add eax, eax
mov dword [esi], edx
mov dword [esi + 4], eax
mov ecx, dword [esi + 8]
mov eax, dword [ebp - 0x18]
mov dword [edx + ecx*4], eax
inc dword [esi + 8]
lea eax, [ebp - 0x20]
mov dword [ebp - 0x20], 0x1c
push eax
push edi
call sub.KERNEL32.dll_Thread32Next
test eax, eax
jne 0x10090010
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [esi], 0
je 0x10090101
xor ebx, ebx
cmp dword [esi + 8], ebx
jbe 0x10090101
xor ecx, ecx
mov dword [ebp - 0x24], ecx
nop dword [eax]
mov eax, dword [esi]
push dword [eax + ecx]
push 0
push 0x5a
call dword [sym.imp.KERNEL32.dll_OpenThread]
mov edi, eax
test edi, edi
je 0x100900f2
push edi
call dword [sym.imp.KERNEL32.dll_SuspendThread]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push edi
call fcn.10090500
add esp, 0xc
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 0x24]
inc ebx
add ecx, 4
mov dword [ebp - 0x24], ecx
cmp ebx, dword [esi + 8]
jb 0x100900c0
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.100f3936
mov esp, ebp
pop ebp
ret

Function at 0x10090670
Capabilities:
Resume thread

Disassembly:
push ebp
mov ebp, esp
push edi
mov edi, dword [ebp + 8]
cmp dword [edi], 0
je 0x100906d4
push ebx
xor ebx, ebx
cmp dword [edi + 8], ebx
jbe 0x100906c3
xor ecx, ecx
mov dword [ebp + 8], ecx
push esi
nop word [eax + eax]
mov eax, dword [edi]
push dword [eax + ecx]
push 0
push 0x5a
call dword [sym.imp.KERNEL32.dll_OpenThread]
mov esi, eax
test esi, esi
je 0x100906b3
push esi
call dword [sym.imp.KERNEL32.dll_ResumeThread]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp + 8]
inc ebx
add ecx, 4
mov dword [ebp + 8], ecx
cmp ebx, dword [edi + 8]
jb 0x10090690
pop esi
push dword [edi]
push 0
push dword [0x1020b280]
call dword [sym.imp.KERNEL32.dll_HeapFree]
pop ebx
pop edi
pop ebp
ret
Function at 0x10090be0
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [0x10209f80]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [0x1020b180]
lea eax, [ebp - 8]
push eax
push 0x40
push 4
push esi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
je 0x10090c23
movss xmm0, dword [ebp + 8]
lea eax, [ebp - 8]
push eax
push dword [ebp - 8]
movss dword [esi], xmm0
push 4
push esi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.100f3936
mov esp, ebp
pop ebp
ret 4

Function at 0x10090c40
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [0x10209f80]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [0x1020b17c]
lea eax, [ebp - 8]
push eax
push 0x40
push 4
push esi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
je 0x10090c83
movss xmm0, dword [ebp + 8]
lea eax, [ebp - 8]
push eax
push dword [ebp - 8]
movss dword [esi], xmm0
push 4
push esi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.100f3936
mov esp, ebp
pop ebp
ret 4
Function at 0x10096f60
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [ebp + 0x10]
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
mov eax, dword [eax + 0xc]
mov dword [ebp - 0xc], eax
mov eax, dword [edi + 0x78]
test eax, eax
je 0x10096f84
push dword [edi + 0x74]
call eax
add esp, 4
mov esi, dword [edi + 0x54]
test esi, esi
je 0x10096fe9
nop dword [eax + eax]
mov ebx, dword [esi + 4]
xor edx, edx
mov eax, dword [ebx + 0x60]
mov eax, dword [eax + 8]
mov dword [ebp - 4], eax
mov eax, dword [ebx + 0x54]
test eax, eax
je 0x10096fe2
mov ecx, dword [eax + 8]
cmp eax, esi
je 0x10096fb6
mov edx, eax
mov eax, ecx
test eax, eax
jne 0x10096fa5
jmp 0x10096fe2
test edx, edx
jne 0x10096fbf
mov dword [ebx + 0x54], ecx
jmp 0x10096fc2
mov dword [edx + 8], ecx
mov eax, dword [esi + 0x14]
test eax, eax
je 0x10096fcf
push esi
call eax
add esp, 4
push esi
call fcn.10097480
mov eax, dword [ebp - 4]
push esi
push eax
mov eax, dword [eax + 8]
call eax
add esp, 0xc
mov esi, dword [edi + 0x54]
test esi, esi
jne 0x10096f90
mov ebx, dword [ebp + 8]
lea eax, [edi + 0x6c]
mov dword [ebp - 8], eax
test eax, eax
je 0x10097074
test ebx, ebx
je 0x10097074
mov ebx, dword [eax]
test ebx, ebx
je 0x10097064
mov edi, dword [ebp + 8]
mov esi, dword [ebx + 8]
mov eax, dword [ebx + 4]
mov dword [ebp - 4], eax
mov eax, dword [esi + 8]
test eax, eax
je 0x10097019
push esi
call eax
add esp, 4
mov eax, dword [ebp + 0x10]
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0x3c]
test eax, eax
je 0x1009702c
push esi
call eax
add esp, 4
mov eax, dword [esi + 0x28]
test eax, eax
je 0x1009703d
push eax
mov eax, dword [edi + 8]
push edi
call eax
add esp, 8
mov dword [esi + 0x28], 0
mov eax, dword [edi + 8]
push esi
push edi
call eax
mov eax, dword [edi + 8]
push ebx
push edi
call eax
mov eax, dword [ebp - 4]
add esp, 0x10
mov ebx, eax
test eax, eax
jne 0x10097003
mov edi, dword [ebp + 0xc]
mov eax, dword [ebp - 8]
mov ebx, dword [ebp + 8]
mov dword [eax], 0
mov dword [eax + 4], 0
mov eax, dword [edi + 0x30]
mov dword [edi + 0x58], 0
test eax, eax
je 0x10097088
push edi
call eax
add esp, 4
push ebx
push edi
call fcn.10096ee0
mov eax, dword [ebp - 0xc]
add esp, 8
mov eax, dword [eax + 0x34]
test eax, eax
je 0x100970a2
push edi
call eax
add esp, 4
mov esi, dword [edi + 0x68]
mov eax, dword [edi + 8]
mov dword [ebp + 0xc], eax
test esi, esi
je 0x100970d8
mov ecx, dword [esi + 0x18]
mov eax, dword [esi + 0x1c]
mov dword [ebp + 0x10], eax
test ecx, ecx
je 0x100970c5
push esi
call ecx
mov eax, dword [ebp + 0x10]
add esp, 4
test dword [ebp + 0xc], 0x400
jne 0x100970d8
push esi
push eax
mov eax, dword [eax + 8]
call eax
add esp, 8
mov eax, dword [edi + 0x80]
mov dword [edi + 0x68], 0
test eax, eax
je 0x100970fd
push eax
mov eax, dword [ebx + 8]
push ebx
call eax
add esp, 8
mov dword [edi + 0x80], 0
mov eax, dword [ebx + 8]
push edi
push ebx
call eax
add esp, 8
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1009a1c0
Capabilities:
Get file size
Read file on windows
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push esi
mov esi, dword [ebp + 8]
test esi, esi
jne 0x1009a1d6
lea eax, [esi + 0x28]
pop esi
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp + 0xc]
push ebx
push 0
push 0x80
push 3
push 0
push 1
push bind
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x1009a205
pop ebx
mov eax, 1
pop esi
mov esp, ebp
pop ebp
ret
push edi
lea eax, [ebp - 0xc]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
mov eax, dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp + 8], eax
je 0x1009a2ff
mov ecx, dword [ebp - 8]
test ecx, ecx
jg 0x1009a2ff
mov eax, dword [ebp - 0xc]
jl 0x1009a23c
cmp eax, 0x7fffffff
ja 0x1009a2ff
or eax, ecx
je 0x1009a2ff
push 0
push 0
push 0
push 2
push 0
push ebx
call dword [sym.imp.KERNEL32.dll_CreateFileMappingA]
mov edi, eax
test edi, edi
je 0x1009a2ff
mov ecx, dword [ebp - 0xc]
push 0
push 0
push 0
push 4
push edi
mov dword [esi + 4], ecx
mov dword [esi + 8], 0
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
push edi
mov dword [esi], eax
call dword [ebp + 8]
cmp dword [esi], 0
je 0x1009a28d
mov eax, 0x1009a360
jmp 0x1009a2ce
push dword [esi + 4]
mov eax, dword [esi + 0x1c]
push 0
push dword [eax]
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov dword [esi], eax
test eax, eax
je 0x1009a2ff
xor edi, edi
push 0
lea eax, [ebp - 4]
push eax
mov eax, dword [esi + 4]
sub eax, edi
push eax
mov eax, dword [esi]
add eax, edi
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x1009a2f0
add edi, dword [ebp - 4]
cmp edi, dword [esi + 4]
jne 0x1009a2a5
mov eax, 0x1009a330
push ebx
mov dword [esi + 0x18], eax
call dword [ebp + 8]
mov eax, dword [esi]
mov dword [esi + 0xc], eax
mov eax, dword [ebp + 0xc]
pop edi
mov dword [esi + 0x10], eax
xor eax, eax
pop ebx
mov dword [esi + 0x14], 0
pop esi
mov esp, ebp
pop ebp
ret
push dword [esi]
mov eax, dword [esi + 0x1c]
push 0
push dword [eax]
call dword [sym.imp.KERNEL32.dll_HeapFree]
push ebx
call dword [ebp + 8]
pop edi
pop ebx
mov dword [esi], 0
mov eax, 0x51
mov dword [esi + 4], 0
mov dword [esi + 8], 0
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x100ee490
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 0xc]
push esi
mov esi, dword [ebp + 0x10]
test edx, edx
jne 0x100ee4a3
xor eax, eax
pop esi
pop ebp
ret
mov eax, dword [ebp + 8]
not eax
cmp esi, 8
jb 0x100ee55e
push edi
mov edi, esi
shr edi, 3
movzx ecx, byte [edx]
sub esi, 8
xor ecx, eax
shr eax, 8
movzx ecx, cl
xor eax, dword [ecx*4 + 0x101eccf0]
movzx ecx, byte [edx + 1]
xor ecx, eax
shr eax, 8
movzx ecx, cl
xor eax, dword [ecx*4 + 0x101eccf0]
movzx ecx, byte [edx + 2]
xor ecx, eax
shr eax, 8
movzx ecx, cl
xor eax, dword [ecx*4 + 0x101eccf0]
movzx ecx, byte [edx + 3]
xor ecx, eax
shr eax, 8
movzx ecx, cl
xor eax, dword [ecx*4 + 0x101eccf0]
movzx ecx, byte [edx + 4]
xor ecx, eax
shr eax, 8
movzx ecx, cl
xor eax, dword [ecx*4 + 0x101eccf0]
movzx ecx, byte [edx + 5]
xor ecx, eax
shr eax, 8
movzx ecx, cl
xor eax, dword [ecx*4 + 0x101eccf0]
movzx ecx, byte [edx + 6]
xor ecx, eax
shr eax, 8
movzx ecx, cl
xor eax, dword [ecx*4 + 0x101eccf0]
movzx ecx, byte [edx + 7]
add edx, 8
xor ecx, eax
shr eax, 8
movzx ecx, cl
xor eax, dword [ecx*4 + 0x101eccf0]
sub edi, 1
jne 0x100ee4b7
pop edi
test esi, esi
je 0x100ee57c
movzx ecx, byte [edx]
lea edx, [edx + 1]
xor ecx, eax
shr eax, 8
movzx ecx, cl
xor eax, dword [ecx*4 + 0x101eccf0]
sub esi, 1
jne 0x100ee562
not eax
pop esi
pop ebp
ret
Function at 0x100fea00
Capabilities:
Encode data using xor
Hash data using djb2

Disassembly:
push esi
mov esi, dword [esp + 8]
test esi, esi
je 0x100feaaf
push esi
call fcn.10118810
add esp, 4
test al, al
jne 0x100feaaf
push ebx
push edi
mov edi, esi
xor ebx, ebx
lea ecx, [edi + 1]
mov al, byte [edi]
inc edi
test al, al
jne 0x100fea27
sub edi, ecx
push edi
push 0x2e
push esi
call fcn.10121dd0
add esp, 0xc
test eax, eax
je 0x100fea5b
sub eax, esi
push eax
push 0x2e
push esi
call fcn.10121dd0
mov ebx, eax
add esp, 0xc
test ebx, ebx
je 0x100fea5d
inc ebx
mov ecx, esi
sub ecx, ebx
add edi, ecx
test ebx, ebx
cmovne esi, ebx
lea ebx, [esi + edi]
mov edi, 0x1505
cmp esi, ebx
jae 0x100fea8e
nop dword [eax]
mov al, byte [esi]
push eax
call fcn.10113bb0
movsx ecx, al
inc esi
mov eax, edi
add esp, 4
shl eax, 5
add eax, edi
xor ecx, eax
mov edi, ecx
cmp esi, ebx
jb 0x100fea70
mov eax, 0x4104105
mov esi, edi
mul edi
sub esi, edx
shr esi, 1
add esi, edx
shr esi, 5
mov ecx, esi
shl ecx, 6
sub ecx, esi
sub edi, ecx
mov eax, edi
pop edi
pop ebx
pop esi
ret
xor eax, eax
pop esi
ret