joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4b93dd
Capabilities:
Encrypt or decrypt via wincrypt

Disassembly:
push ebp
mov ebp, esp
push ecx
cmp dword [ebp + 0x10], 0
jne 0x4b9419
push 1
push 0x14
call fcn.004babac
add esp, 8
mov dword [ebp - 4], eax
push 0x14
push 0
mov eax, dword [ebp - 4]
push eax
call fcn.0048ba50
add esp, 0xc
mov ecx, dword [ebp - 4]
mov edx, dword [ebp + 8]
mov dword [ecx], edx
mov eax, dword [ebp - 4]
mov ecx, dword [ebp + 8]
mov dword [eax + 4], ecx
jmp 0x4b941f
mov edx, dword [ebp + 0x10]
mov dword [ebp - 4], edx
mov eax, dword [ebp - 4]
mov ecx, dword [ebp + 0xc]
mov edx, dword [ecx + 0x30]
mov dword [eax + 8], edx
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 8]
mov dword [eax + 0x10], edx
mov eax, dword [ebp - 4]
cmp dword [eax + 0xc], 0
je 0x4b9459
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 0xc]
push edx
call fcn.004bab82
add esp, 4
mov eax, dword [ebp - 4]
mov dword [eax + 0xc], 0
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 0x10]
shl edx, 1
push edx
mov eax, dword [ebp - 4]
add eax, 0x10
push eax
push 0
push 0
push 1
push 0
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.ADVAPI32.dll_CryptEncrypt]
test eax, eax
je 0x4b9499
push 1
mov edx, dword [ebp - 4]
mov eax, dword [edx + 0x10]
add eax, 0x10
push eax
call fcn.004babac
add esp, 8
mov ecx, dword [ebp - 4]
mov dword [ecx + 0xc], eax
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret

Function at 0x4b95f2
Capabilities:
Encrypt data using rc4 via winapi
Hash data using sha1
Hash data using sha1 via wincrypt
Hash data via wincrypt
Initialize hashing via wincrypt

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 8], 0
cmp dword [ebp + 8], 0
je 0x4b960b
cmp dword [ebp + 0xc], 0
jne 0x4b960f
xor eax, eax
jmp 0x4b967c
call fcn.004b9680
test eax, eax
jne 0x4b961d
or eax, 0xffffffff
jmp 0x4b967c
lea eax, [ebp - 8]
push eax
push 0
push 0
push 0x8004
mov ecx, dword [0x53d374]
push ecx
call dword [sym.imp.ADVAPI32.dll_CryptCreateHash]
test eax, eax
je 0x4b9679
push 0
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 8]
push ecx
call dword [sym.imp.ADVAPI32.dll_CryptHashData]
test eax, eax
je 0x4b966f
lea edx, [ebp - 4]
push edx
push 0
mov eax, dword [ebp - 8]
push eax
push 0x6801
mov ecx, dword [0x53d374]
push ecx
call dword [sym.imp.ADVAPI32.dll_CryptDeriveKey]
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.ADVAPI32.dll_CryptDestroyHash]
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret

Function at 0x4b9680
Capabilities:
Create new key via cryptacquirecontext

Disassembly:
push ebp
mov ebp, esp
cmp dword [0x53d374], 0
je 0x4b9693
mov eax, 1
jmp 0x4b96d0
push 0
push 1
push 0x5359c4
push 0
push 0x53d374
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextA]
test eax, eax
jne 0x4b96cb
push 8
push 1
push str.Microsoft_Enhanced_Cryptographic_Provider_v1.0
push 0
push 0x53d374
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextA]
test eax, eax
jne 0x4b96cb
xor eax, eax
jmp 0x4b96d0
mov eax, 1
pop ebp
ret
Function at 0x4cb18d
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [ebp + 8]
push eax
call fcn.004cb235
add esp, 4
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], 0
cmp dword [ebp - 0xc], 0
je 0x4cb1f2
mov ecx, dword [ebp - 0xc]
push ecx
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x4cb1e4
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 8]
add eax, 1
mov dword [ebp - 8], eax
cmp edx, 3
jge 0x4cb1e4
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, 1
test ecx, ecx
jne 0x4cb1af
mov edx, dword [ebp - 0xc]
push edx
call fcn.004bab82
add esp, 4
jmp 0x4cb227
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x4cb227
mov ecx, dword [ebp - 8]
mov edx, dword [ebp - 8]
add edx, 1
mov dword [ebp - 8], edx
cmp ecx, 3
jge 0x4cb227
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
mov eax, 1
test eax, eax
jne 0x4cb1f2
mov eax, dword [ebp - 4]
neg eax
sbb eax, eax
and eax, 0xa
mov esp, ebp
pop ebp
ret

Function at 0x4cb309
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 4], 0
mov eax, dword [ebp + 8]
push eax
call fcn.004cb235
add esp, 4
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x4cb34e
mov ecx, dword [ebp - 8]
push ecx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
xor edx, edx
cmp eax, 0xffffffff
setne dl
mov dword [ebp - 4], edx
mov eax, dword [ebp - 8]
push eax
call fcn.004bab82
add esp, 4
jmp 0x4cb363
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
xor edx, edx
cmp eax, 0xffffffff
setne dl
mov dword [ebp - 4], edx
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
Function at 0x4cb622
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3b0
cmp dword [0x53d3a4], 0
je 0x4cb654
push 0x118
mov eax, dword [0x53d3a4]
push eax
lea ecx, [ebp - 0x13c]
push ecx
call fcn.00482d30
add esp, 0xc
mov byte [ebp - 0x24], 0
jmp 0x4cb6cf
call fcn.004cb2bd
test eax, eax
je 0x4cb6bd
lea edx, [ebp - 0x3ac]
push edx
push 0x118
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
lea eax, [ebp - 0x3ac]
push eax
call fcn.004cb7c6
add esp, 4
mov dword [ebp - 0x3b0], eax
cmp dword [ebp - 0x3b0], 0
je 0x4cb6bb
push 0x118
mov ecx, dword [ebp - 0x3b0]
push ecx
lea edx, [ebp - 0x13c]
push edx
call fcn.00482d30
add esp, 0xc
mov byte [ebp - 0x24], 0
mov eax, dword [ebp - 0x3b0]
push eax
call fcn.004bab82
add esp, 4
jmp 0x4cb6cf
lea ecx, [ebp - 0x13c]
push ecx
push 0x118
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
lea edx, [ebp - 0x13c]
push edx
call fcn.00484fd0
add esp, 4
mov dword [ebp - 4], eax
jmp 0x4cb6ec
mov eax, dword [ebp - 4]
sub eax, 1
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jle 0x4cb704
mov ecx, dword [ebp - 4]
movsx edx, byte [ebp + ecx - 0x13d]
cmp edx, 0x5c
jne 0x4cb704
jmp 0x4cb6e3
mov eax, dword [ebp - 4]
mov byte [ebp + eax - 0x13c], 0
lea ecx, [ebp - 0x13c]
push ecx
push str._s_sqlite_
mov edx, dword [ebp + 8]
push edx
call fcn.0047c4e0
add esp, 0xc
mov eax, dword [ebp + 8]
push eax
call fcn.00484fd0
add esp, 4
mov dword [ebp - 0x140], eax
mov ecx, dword [ebp + 8]
add ecx, dword [ebp - 0x140]
push ecx
push 0xf
call fcn.004d8550
add esp, 8
mov dword [ebp - 4], 0
jmp 0x4cb76e
mov edx, dword [ebp - 4]
add edx, 1
mov dword [ebp - 4], edx
mov eax, dword [ebp - 0x140]
add eax, 1
mov dword [ebp - 0x140], eax
cmp dword [ebp - 4], 0xf
jge 0x4cb79d
mov ecx, dword [ebp + 8]
add ecx, dword [ebp - 0x140]
xor eax, eax
mov al, byte [ecx]
xor edx, edx
mov ecx, 0x3e
div ecx
mov eax, dword [ebp + 8]
add eax, dword [ebp - 0x140]
mov cl, byte [edx + str.abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789]
mov byte [eax], cl
jmp 0x4cb756
mov edx, dword [ebp + 8]
add edx, dword [ebp - 0x140]
mov byte [edx], 0
mov eax, dword [ebp + 8]
push eax
call fcn.004cb309
add esp, 4
test eax, eax
jne 0x4cb7bb
jmp 0x4cb7c0
jmp 0x4cb70f
xor eax, eax
mov esp, ebp
pop ebp
ret

Function at 0x4cba7c
Capabilities:
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
cmp dword [ebp + 8], 0
jne 0x4cba8c
xor eax, eax
jmp 0x4cbb07
call fcn.004cb2bd
test eax, eax
jne 0x4cbaac
mov eax, dword [ebp + 8]
push eax
call fcn.00484fd0
add esp, 4
cmp eax, 0x104
jbe 0x4cbaac
xor eax, eax
jmp 0x4cbb07
mov ecx, dword [ebp + 8]
push ecx
call fcn.004cb235
add esp, 4
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x4cbadc
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 4]
push eax
call fcn.004bab82
add esp, 4
jmp 0x4cbae9
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0xffffffff
jne 0x4cbaf3
xor eax, eax
jmp 0x4cbb07
mov edx, dword [ebp - 8]
and edx, 0x10
cmp edx, 0x10
je 0x4cbb02
xor eax, eax
jmp 0x4cbb07
mov eax, 1
mov esp, ebp
pop ebp
ret
Function at 0x4cc104
Capabilities:
Allocate thread local storage
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ecx
cmp dword [0x53d3ac], 0
jne 0x4cc14e
call fcn.004cc07c
cmp dword [0x53d3ac], 0
jne 0x4cc149
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
mov dword [0x53d398], eax
cmp dword [0x53d398], 0xffffffff
jne 0x4cc13f
call fcn.004cc08e
xor eax, eax
jmp 0x4cc1f3
mov dword [0x53d3ac], 1
call fcn.004cc08e
mov eax, dword [0x53d398]
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov dword [ebp - 4], eax
cmp dword [ebp + 8], 0
jle 0x4cc1ab
cmp dword [ebp - 4], 0
jne 0x4cc1a9
push 0xc
call fcn.004cb140
add esp, 4
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x4cc1a9
mov ecx, dword [ebp - 4]
mov edx, dword [0x50e520]
mov dword [ecx], edx
mov eax, dword [0x50e524]
mov dword [ecx + 4], eax
mov edx, dword [0x50e528]
mov dword [ecx + 8], edx
mov eax, dword [ebp - 4]
push eax
mov ecx, dword [0x53d398]
push ecx
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
jmp 0x4cc1f0
cmp dword [ebp - 4], 0
je 0x4cc1f0
cmp dword [ebp + 8], 0
jge 0x4cc1f0
push 0xc
push 0x50e520
mov edx, dword [ebp - 4]
push edx
call fcn.0049fd90
add esp, 0xc
test eax, eax
jne 0x4cc1f0
mov eax, dword [ebp - 4]
push eax
call fcn.004cb175
add esp, 4
push 0
mov ecx, dword [0x53d398]
push ecx
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
mov dword [ebp - 4], 0
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
Function at 0x4d91d5
Capabilities:
Reference sql statements

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
cmp dword [ebp + 0xc], 2
jge 0x4d91eb
mov eax, 0x17
jmp 0x4d929d
mov eax, dword [ebp + 8]
xor ecx, ecx
mov cl, byte [eax]
xor edx, edx
mov dl, byte [ecx + 0x50e3a8]
mov eax, edx
shl eax, 2
mov ecx, dword [ebp + 8]
add ecx, dword [ebp + 0xc]
xor edx, edx
mov dl, byte [ecx - 1]
xor ecx, ecx
mov cl, byte [edx + 0x50e3a8]
imul ecx, ecx, 3
xor eax, ecx
xor eax, dword [ebp + 0xc]
cdq
mov ecx, 0x7f
idiv ecx
mov dword [ebp - 4], edx
mov edx, dword [ebp - 4]
xor eax, eax
mov al, byte [edx + str.Pk_]
sub eax, 1
mov dword [ebp - 8], eax
jmp 0x4d9249
mov ecx, dword [ebp - 8]
xor edx, edx
mov dl, byte [ecx + 0x50eadc]
sub edx, 1
mov dword [ebp - 8], edx
cmp dword [ebp - 8], 0
jl 0x4d9298
mov eax, dword [ebp - 8]
xor ecx, ecx
mov cl, byte [eax + 0x50eb50]
cmp ecx, dword [ebp + 0xc]
jne 0x4d9296
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 8]
xor edx, edx
mov dx, word [ecx*2 + 0x50ebc4]
add edx, str.ABORTABLEFTEMPORARYADDATABASELECTHENDEFAULTRANSACTIONATURALTERAISEACHECKEYAFTEREFERENCESCAPELSEXCEPTRIGGEREGEXPLAINITIALLYANALYZEXCLUSIVEXISTSTATEMENTANDEFERRABLEATTACHAVINGLOBEFOREIGNOREINDEXAUTOINCREMENTBEGINNERENAMEBETWEENOTNULLIKEBYCASCADEFERREDELETECASECASTCOLLATECOLUMNCOMMITCONFLICTCONSTRAINTERSECTCREATECROSSCURRENT_DATECURRENT_TIMESTAMPLANDESCDETACHDISTINCTDROPRAGMATCHFAILIMITFROMFULLGROUPDATEIFIMMEDIATEINSERTINSTEADINTOFFSETISNULLJOINORDEREPLACEOUTERESTRICTPRIMARYQUERYRIGHTROLLBACKROWHENUNIONUNIQUEUSINGVACUUMVALUESVIEWHERE
push edx
call fcn.004bb054
add esp, 0xc
test eax, eax
jne 0x4d9296
mov eax, dword [ebp - 8]
xor ecx, ecx
mov cl, byte [eax + 0x50ecac]
mov eax, ecx
jmp 0x4d929d
jmp 0x4d9238
mov eax, 0x17
mov esp, ebp
pop ebp
ret
Function at 0x4e0330
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
push ecx
cmp dword [ebp + 8], 0
jne 0x4e0341
xor eax, eax
jmp 0x4e0495
push 1
push 0x44
call fcn.004baac0
add esp, 8
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x4e035d
xor eax, eax
jmp 0x4e0495
mov eax, dword [ebp - 4]
mov ecx, dword [ebp + 8]
mov dl, byte [ecx + 5]
mov byte [eax + 5], dl
mov eax, dword [ebp + 8]
mov ecx, dword [eax]
push ecx
call fcn.004dff84
add esp, 4
mov edx, dword [ebp - 4]
mov dword [edx], eax
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0xc]
push ecx
call fcn.004e00bc
add esp, 4
mov edx, dword [ebp - 4]
mov dword [edx + 0xc], eax
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x10]
push ecx
call fcn.004dfe10
add esp, 4
mov edx, dword [ebp - 4]
mov dword [edx + 0x10], eax
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x14]
push ecx
call fcn.004dff84
add esp, 4
mov edx, dword [ebp - 4]
mov dword [edx + 0x14], eax
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x18]
push ecx
call fcn.004dfe10
add esp, 4
mov edx, dword [ebp - 4]
mov dword [edx + 0x18], eax
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x1c]
push ecx
call fcn.004dff84
add esp, 4
mov edx, dword [ebp - 4]
mov dword [edx + 0x1c], eax
mov eax, dword [ebp - 4]
mov ecx, dword [ebp + 8]
mov dl, byte [ecx + 4]
mov byte [eax + 4], dl
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x20]
push ecx
call fcn.004e0330
add esp, 4
mov edx, dword [ebp - 4]
mov dword [edx + 0x20], eax
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x28]
push ecx
call fcn.004dfe10
add esp, 4
mov edx, dword [ebp - 4]
mov dword [edx + 0x28], eax
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x2c]
push ecx
call fcn.004dfe10
add esp, 4
mov edx, dword [ebp - 4]
mov dword [edx + 0x2c], eax
mov eax, dword [ebp - 4]
mov dword [eax + 0x30], 0xffffffff
mov ecx, dword [ebp - 4]
mov dword [ecx + 0x34], 0xffffffff
mov edx, dword [ebp - 4]
mov eax, dword [ebp + 8]
mov cl, byte [eax + 6]
mov byte [edx + 6], cl
mov edx, dword [ebp - 4]
mov eax, dword [ebp + 8]
mov cl, byte [eax + 7]
mov byte [edx + 7], cl
mov edx, dword [ebp - 4]
mov byte [edx + 8], 0
mov eax, dword [ebp - 4]
mov byte [eax + 9], 0
mov ecx, dword [ebp - 4]
mov dword [ecx + 0x24], 0
mov edx, dword [ebp - 4]
mov dword [edx + 0x38], 0xffffffff
mov eax, dword [ebp - 4]
mov dword [eax + 0x3c], 0xffffffff
mov ecx, dword [ebp - 4]
mov dword [ecx + 0x40], 0xffffffff
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
Function at 0x1000fcc0
Capabilities:
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [ebp + 8]
mov dword [ebp - 0xc], 0
push ebx
push esi
push edi
mov edi, dword [0x1025b460]
mov esi, dword [edi + 0x19b0]
mov dword [ebp - 8], esi
test al, 0x10
jne 0x1000fdf2
mov ebx, dword [esi + 0x118]
test ebx, ebx
je 0x1000fd00
cmp dword [edi + 0x19ec], ebx
jne 0x1000fde9
cmp byte [edi + 0xf0], 0
je 0x1000fde9
test ebx, ebx
jne 0x1000fd9c
test al, 8
je 0x1000fde9
test byte [esi + 0x11c], 1
jne 0x1000fd3e
cmp dword [edi + 0x19ec], ebx
je 0x1000fde9
cmp dword [edi + 0x1a18], esi
jne 0x1000fde9
mov ecx, dword [ebp - 8]
add esi, 0x120
push esi
call fcn.100137c0
mov ebx, eax
mov eax, dword [ebp - 8]
push ebx
push esi
mov dword [eax + 0x118], ebx
call fcn.10015570
mov esi, dword [ebp - 8]
mov cl, al
add esp, 8
mov byte [ebp - 1], cl
test cl, cl
je 0x1000fd8a
cmp byte [edi + 0x3d8], 0
je 0x1000fd8a
push esi
push ebx
call fcn.1001c7e0
push esi
call fcn.10012c90
mov cl, byte [ebp - 1]
add esp, 0xc
mov eax, dword [edi + 0x19ec]
cmp eax, ebx
jne 0x1000fde9
mov byte [edi + 0x19f9], cl
jmp 0x1000fda9
mov eax, dword [edi + 0x19ec]
mov byte [edi + 0x19f9], 0
cmp eax, ebx
jne 0x1000fde9
mov ecx, dword [esi + 0xcc]
mov eax, dword [esi + 0xd4]
mov eax, dword [eax + ecx*4 - 4]
mov dword [ebp - 0xc], eax
mov eax, dword [0x1025b460]
cmp byte [eax + 0xf0], 0
je 0x1000fde9
movss xmm1, dword [eax + 0x30]
movss xmm0, dword [eax + 0x444]
mulss xmm1, xmm1
comiss xmm0, xmm1
setae al
test al, al
jne 0x1000fe30
pop edi
pop esi
xor al, al
pop ebx
mov esp, ebp
pop ebp
ret
xor esi, esi
or ebx, 0xffffffff
mov dword [ebp - 8], esi
mov edx, 0x10168599
mov al, 0x23
or esi, 0xffffffff
cmp al, 0x23
jne 0x1000fe12
cmp byte [edx], al
jne 0x1000fe12
cmp byte [edx + 1], al
cmove ebx, esi
movzx ecx, bl
movzx eax, al
xor ecx, eax
shr ebx, 8
mov al, byte [edx]
inc edx
xor ebx, dword [ecx*4 + 0x10167ee0]
test al, al
jne 0x1000fe04
mov esi, dword [ebp - 8]
not ebx
cmp byte [edi + 0x1d3c], 0
jne 0x1000fe69
call fcn.10010cf0
mov eax, dword [ebp - 0xc]
mov dword [edi + 0x1d54], ebx
mov ebx, dword [ebp + 8]
mov dword [edi + 0x1d58], eax
mov byte [edi + 0x1d3c], 1
mov dword [edi + 0x1d40], ebx
mov dword [edi + 0x1d48], 0
jmp 0x1000fe6c
mov ebx, dword [ebp + 8]
mov eax, dword [edi + 0x1960]
mov dword [edi + 0x1d44], eax
mov byte [edi + 0x1d3d], 1
test bl, 1
jne 0x1000feb5
call fcn.100101b0
cmp dword [edi + 0x1da4], 0
je 0x1000feb5
test dword [edi + 0x1d98], 0x1000
je 0x1000feb5
mov eax, dword [edi + 0x19b0]
mov byte [eax + 0x8f], 1
mov dword [eax + 0xa8], 1
test bl, 0x12
jne 0x1000fec1
and dword [esi + 0x11c], 0xfffffffe
pop edi
pop esi
mov al, 1
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x100112e0
Capabilities:
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [0x1025b460]
sub esp, 0x1c
test eax, eax
je 0x100112f5
inc dword [eax + 0x374]
push ebx
push esi
push edi
push dword [0x1025b480]
push 0x3b90
call dword [0x10192200]
add esp, 8
test eax, eax
je 0x1001131e
push dword [ebp + 8]
mov ecx, eax
call fcn.1000b400
mov edi, eax
jmp 0x10011320
xor edi, edi
mov ebx, dword [0x1025b460]
mov esi, 0x101684e9
test ebx, ebx
mov dword [ebp - 8], 0
mov dword [ebp - 0x1c], str.Window
mov al, 0x57
cmove ebx, edi
or edx, 0xffffffff
mov dword [ebp - 4], ebx
mov dword [0x1025b460], ebx
or ebx, 0xffffffff
nop
cmp al, 0x23
jne 0x1001135e
cmp byte [esi], al
jne 0x1001135e
cmp byte [esi + 1], al
cmove edx, ebx
movzx ecx, dl
movzx eax, al
xor ecx, eax
shr edx, 8
mov al, byte [esi]
inc esi
xor edx, dword [ecx*4 + 0x10167ee0]
test al, al
jne 0x10011350
mov esi, dword [edi + 0x2d48]
not edx
mov ecx, dword [edi + 0x2d4c]
mov ebx, dword [ebp - 4]
mov dword [ebp - 0x18], edx
mov dword [ebp - 0x14], 0x1001e9e0
mov dword [ebp - 0x10], 0x1001e930
mov dword [ebp - 0xc], 0x1001ea40
cmp esi, ecx
jne 0x1001143e
inc esi
test ecx, ecx
je 0x100113b8
mov eax, ecx
cdq
sub eax, edx
sar eax, 1
add eax, ecx
jmp 0x100113bd
mov eax, 8
cmp eax, esi
cmovg esi, eax
cmp esi, ecx
jle 0x1001143e
test ebx, ebx
je 0x100113d0
inc dword [ebx + 0x374]
push dword [0x1025b480]
lea eax, [esi + esi*2]
shl eax, 3
push eax
call dword [0x10192200]
mov ebx, eax
add esp, 8
mov eax, dword [edi + 0x2d50]
test eax, eax
je 0x10011432
mov ecx, dword [edi + 0x2d48]
lea ecx, [ecx + ecx*2]
shl ecx, 3
push ecx
push eax
push ebx
call sub.VCRUNTIME140.dll_memcpy
mov ecx, dword [edi + 0x2d50]
add esp, 0xc
test ecx, ecx
je 0x10011422
mov eax, dword [0x1025b460]
test eax, eax
je 0x10011422
dec dword [eax + 0x374]
push dword [0x1025b480]
push ecx
call dword [0x10192204]
add esp, 8
mov dword [edi + 0x2d50], ebx
mov dword [edi + 0x2d4c], esi
mov eax, dword [edi + 0x2d48]
movups xmm0, xmmword [ebp - 0x1c]
lea ecx, [eax + eax*2]
mov eax, dword [edi + 0x2d50]
movups xmmword [eax + ecx*8], xmm0
movq xmm0, qword [ebp - 0xc]
movq qword [eax + ecx*8 + 0x10], xmm0
mov eax, edi
inc dword [edi + 0x2d48]
mov byte [edi], 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10012a70
Capabilities:
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 8]
or eax, 0xffffffff
push ebx
push esi
push edi
mov bl, byte [ecx]
lea esi, [ecx + 1]
or ecx, 0xffffffff
test bl, bl
je 0x10012ab5
cmp bl, 0x23
jne 0x10012a97
cmp byte [esi], bl
jne 0x10012a97
cmp byte [esi + 1], bl
cmove eax, ecx
movzx edx, al
movzx ecx, bl
mov bl, byte [esi]
xor edx, ecx
shr eax, 8
inc esi
mov ecx, 0xffffffff
xor eax, dword [edx*4 + 0x10167ee0]
test bl, bl
jne 0x10012a88
mov ebx, dword [0x1025b460]
not eax
mov esi, dword [ebx + 0x19a0]
mov edi, dword [ebx + 0x19a8]
mov ecx, edi
test esi, esi
je 0x10012af4
nop
mov edx, esi
shr edx, 1
cmp dword [edi + edx*8], eax
lea ecx, [edi + edx*8]
jae 0x10012ae8
lea edi, [ecx + 8]
or ecx, 0xffffffff
sub ecx, edx
add esi, ecx
jmp 0x10012aea
mov esi, edx
test esi, esi
jne 0x10012ad0
mov ecx, dword [ebx + 0x19a8]
mov edx, dword [ebx + 0x19a0]
lea ecx, [ecx + edx*8]
cmp edi, ecx
je 0x10012b0d
cmp dword [edi], eax
jne 0x10012b0d
mov eax, dword [edi + 4]
pop edi
pop esi
pop ebx
pop ebp
ret
pop edi
pop esi
xor eax, eax
pop ebx
pop ebp
ret

Function at 0x100136f0
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ecx + 0xcc]
mov eax, dword [ecx + 0xd4]
push esi
push edi
lea esi, [ebp + 8]
mov edi, 4
mov eax, dword [eax + edx*4 - 4]
not eax
nop
movzx ecx, byte [esi]
lea esi, [esi + 1]
movzx edx, al
xor edx, ecx
shr eax, 8
xor eax, dword [edx*4 + 0x10167ee0]
sub edi, 1
jne 0x10013710
mov ecx, dword [0x1025b460]
not eax
pop edi
pop esi
cmp dword [ecx + 0x19ec], eax
jne 0x10013742
mov dword [ecx + 0x19f0], eax
cmp dword [ecx + 0x1a20], eax
jne 0x10013751
mov byte [ecx + 0x1a24], 1
pop ebp
ret 4

Function at 0x100137c0
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x1025ab04]
xor eax, ebp
mov dword [ebp - 4], eax
mov edx, dword [ebp + 8]
push esi
mov esi, ecx
push edi
movss xmm0, dword [edx]
mov edi, 0x10
subss xmm0, dword [esi + 0xc]
mov ecx, dword [esi + 0xcc]
cvttss2si eax, xmm0
movss xmm0, dword [edx + 4]
subss xmm0, dword [esi + 0x10]
mov dword [ebp - 0x14], eax
cvttss2si eax, xmm0
movss xmm0, dword [edx + 8]
subss xmm0, dword [esi + 0xc]
mov dword [ebp - 0x10], eax
cvttss2si eax, xmm0
movss xmm0, dword [edx + 0xc]
subss xmm0, dword [esi + 0x10]
mov dword [ebp - 0xc], eax
cvttss2si eax, xmm0
mov dword [ebp - 8], eax
mov eax, dword [esi + 0xd4]
lea esi, [ebp - 0x14]
mov edx, dword [eax + ecx*4 - 4]
not edx
movzx eax, byte [esi]
lea esi, [esi + 1]
movzx ecx, dl
xor ecx, eax
shr edx, 8
xor edx, dword [ecx*4 + 0x10167ee0]
sub edi, 1
jne 0x10013834
mov eax, dword [0x1025b460]
not edx
pop edi
pop esi
cmp dword [eax + 0x19ec], edx
jne 0x10013865
mov dword [eax + 0x19f0], edx
cmp dword [eax + 0x1a20], edx
jne 0x10013874
mov byte [eax + 0x1a24], 1
mov ecx, dword [ebp - 4]
mov eax, edx
xor ecx, ebp
call fcn.10104522
mov esp, ebp
pop ebp
ret 4
Function at 0x10014060
Capabilities:
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 0x10]
push esi
mov esi, dword [ebp + 8]
not ebx
push edi
mov edi, dword [ebp + 0xc]
mov eax, ebx
test edi, edi
je 0x100140ae
mov cl, byte [esi]
lea esi, [esi + 1]
dec edi
cmp cl, 0x23
jne 0x10014091
cmp edi, 2
jb 0x10014091
cmp byte [esi], cl
jne 0x10014091
cmp byte [esi + 1], cl
cmove eax, ebx
movzx edx, al
movzx ecx, cl
xor edx, ecx
shr eax, 8
xor eax, dword [edx*4 + 0x10167ee0]
test edi, edi
jne 0x10014077
pop edi
pop esi
not eax
pop ebx
pop ebp
ret
mov cl, byte [esi]
inc esi
test cl, cl
je 0x100140dd
cmp cl, 0x23
jne 0x100140c4
cmp byte [esi], cl
jne 0x100140c4
cmp byte [esi + 1], cl
cmove eax, ebx
movzx edx, al
movzx ecx, cl
xor edx, ecx
shr eax, 8
mov cl, byte [esi]
inc esi
xor eax, dword [edx*4 + 0x10167ee0]
test cl, cl
jne 0x100140b5
pop edi
pop esi
not eax
pop ebx
pop ebp
ret
Function at 0x10015c60
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [0x1025b460]
cmp byte [esi + 0x2d60], 0
je 0x10015cfb
cmp dword [esi + 0x2d68], 0
push edi
lea edi, [esi + 0x2d6c]
je 0x10015cec
mov ecx, dword [edi + 4]
test ecx, ecx
jns 0x10015ca6
mov eax, ecx
cdq
sub eax, edx
sar eax, 1
add eax, ecx
xor ecx, ecx
test eax, eax
cmovg ecx, eax
push ecx
mov ecx, edi
call fcn.1001f380
lea eax, [ebp + 0xc]
mov dword [edi], 0
push eax
push dword [ebp + 8]
mov ecx, edi
call fcn.1001eee0
mov edx, dword [edi]
mov ecx, 0x1025b464
push dword [esi + 0x2d68]
lea eax, [edx - 1]
neg edx
sbb edx, edx
and edx, eax
mov eax, dword [esi + 0x2d74]
test eax, eax
push edx
cmovne ecx, eax
push 1
push ecx
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
add esp, 0x10
pop edi
pop esi
pop ebp
ret
lea eax, [ebp + 0xc]
mov ecx, edi
push eax
push dword [ebp + 8]
call fcn.1001eee0
pop edi
pop esi
pop ebp
ret