joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1000c5c0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100987e0
mov eax, dword fs:[0]
push eax
sub esp, 0x2c
mov eax, dword [0x100c4054]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x2c], edi
mov dword [ebp - 0x38], edi
mov dword [ebp - 0x2c], str.Stealth
mov dword [edi], 0
xor eax, eax
mov dword [edi + 0x10], 0
mov dword [edi + 0x14], 7
mov word [edi], ax
mov dword [ebp - 4], 1
mov dword [edi + 0x18], eax
mov dword [edi + 0x1c], eax
mov dword [edi + 0x20], eax
mov byte [ebp - 4], 2
lea eax, [ebp - 0x34]
movaps xmm0, xmmword [0x100b8e10]
push eax
movups xmmword [0x100c668c], xmm0
push 0
movups xmmword [0x100c669c], xmm0
push 0
movaps xmm0, xmmword [0x100b8db0]
movaps xmmword [0x100c6600], xmm0
movaps xmm0, xmmword [0x100b8d70]
push 0x1009bae0
mov word [0x100c66ac], 0x101
mov byte [0x100c66ae], 1
mov dword [0x100c65fc], 0x12
movaps xmmword [0x100c6610], xmm0
call dword [sym.imp.SHELL32.dll_SHGetKnownFolderPath]
test eax, eax
js 0x1000c6fe
lea eax, [ebp - 0x34]
mov ecx, edi
push eax
call fcn.10019490
mov byte [ebp - 0x30], 0
lea edx, [ebp - 0x2c]
push dword [ebp - 0x30]
lea ecx, [ebp - 0x28]
call fcn.10020f20
add esp, 4
lea eax, [ebp - 0x28]
mov byte [ebp - 4], 3
push eax
mov ecx, edi
call fcn.10028300
mov byte [ebp - 4], 2
mov edx, dword [ebp - 0x14]
cmp edx, 8
jb 0x1000c6f5
mov ecx, dword [ebp - 0x28]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x1000c6eb
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x1000c7dd
push edx
push ecx
call fcn.100715d1
add esp, 8
push dword [ebp - 0x34]
call dword [sym.imp.ole32.dll_CoTaskMemFree]
mov eax, dword [edi + 0x1c]
mov esi, dword [edi + 0x18]
mov dword [ebp - 0x2c], eax
cmp esi, eax
je 0x1000c761
nop dword [eax + eax]
mov ecx, dword [esi + 0x14]
cmp ecx, 0x10
jb 0x1000c746
mov eax, dword [esi]
inc ecx
cmp ecx, 0x1000
jb 0x1000c739
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x1000c7dd
mov eax, edx
push ecx
push eax
call fcn.100715d1
mov eax, dword [ebp - 0x2c]
add esp, 8
mov byte [esi], 0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0xf
add esi, 0x18
cmp esi, eax
jne 0x1000c710
mov esi, dword [edi + 0x18]
sub esp, 8
mov dword [edi + 0x1c], esi
mov eax, esp
mov dword [ebp - 0x2c], esp
xorps xmm0, xmm0
lea esi, [edi + 0x18]
movq qword [eax], xmm0
mov dword [eax], 0
mov dword [eax + 4], 0
sub esp, 8
mov ecx, esp
mov dword [ebp - 0x30], ecx
mov dword [ecx], 0
mov dword [ecx + 4], 0
push ecx
mov edx, edi
mov byte [ebp - 4], 5
call fcn.10027740
add esp, 4
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x2c]
mov byte [ebp - 4], 2
push dword [ebp - 0x38]
push esi
call fcn.1001a890
add esp, 0x18
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.100715c3
mov esp, ebp
pop ebp
ret 4
call fcn.100760c2
int3
Function at 0x10012cb0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x14
cmp dword [ecx + 0x38], 0
push ebx
push esi
push edi
mov dword [esp + 0xc], ecx
je 0x10012d97
mov esi, dword [ebp + 0x10]
mov ebx, esi
mov edx, dword [ebp + 0xc]
mov edi, edx
mov eax, dword [ebp + 8]
mov dword [esp + 0x10], eax
test esi, esi
jl 0x10012d86
jg 0x10012cf0
test edx, edx
je 0x10012d86
nop dword [eax]
call fcn.10026ec0
mov esi, eax
mov eax, edx
mov dword [esp + 0x14], eax
test eax, eax
jl 0x10012d43
jg 0x10012d07
test esi, esi
je 0x10012d43
cmp ebx, eax
jg 0x10012d17
jl 0x10012d11
cmp edi, esi
jae 0x10012d17
mov esi, edi
mov dword [esp + 0x14], ebx
mov ecx, dword [esp + 0xc]
push esi
push dword [esp + 0x14]
mov eax, dword [ecx + 0x20]
push dword [eax]
call fcn.10073140
mov ecx, dword [esp + 0x18]
add esp, 0xc
sub edi, esi
sbb ebx, dword [esp + 0x14]
mov eax, dword [ecx + 0x30]
sub dword [eax], esi
mov eax, dword [ecx + 0x20]
add dword [eax], esi
jmp 0x10012d6a
mov ecx, dword [esp + 0xc]
mov eax, dword [ecx]
mov edx, dword [eax + 0xc]
mov eax, dword [esp + 0x10]
movzx eax, byte [eax]
push eax
call edx
cmp eax, 0xffffffff
je 0x10012d80
mov ecx, dword [esp + 0xc]
add edi, 0xffffffff
mov esi, 1
adc ebx, 0xffffffff
add dword [esp + 0x10], esi
test ebx, ebx
jg 0x10012cf0
jl 0x10012d80
test edi, edi
jne 0x10012cf0
mov edx, dword [ebp + 0xc]
mov esi, dword [ebp + 0x10]
sub edx, edi
mov eax, edx
sbb esi, ebx
mov edx, esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov eax, dword [ecx + 0x20]
mov esi, dword [ebp + 0xc]
mov edi, dword [ebp + 0x10]
mov dword [esp + 0x18], esi
mov eax, dword [eax]
mov dword [esp + 0x1c], edi
mov dword [esp + 0x10], eax
test eax, eax
je 0x10012db9
mov eax, dword [ecx + 0x30]
mov eax, dword [eax]
jmp 0x10012dbb
xor eax, eax
cdq
mov ebx, eax
mov eax, edx
mov dword [esp + 0x14], eax
test edi, edi
jl 0x10012e39
jg 0x10012dce
test esi, esi
je 0x10012e39
test eax, eax
jl 0x10012e1d
jg 0x10012dd8
test ebx, ebx
je 0x10012e1d
cmp edi, eax
jg 0x10012de8
jl 0x10012de2
cmp esi, ebx
jae 0x10012de8
mov ebx, esi
mov dword [esp + 0x14], edi
push ebx
push dword [ebp + 8]
push dword [esp + 0x18]
call fcn.10073140
mov ecx, dword [esp + 0x18]
add esp, 0xc
mov edx, dword [ebp + 8]
sub esi, ebx
sbb edi, dword [esp + 0x14]
add edx, ebx
mov eax, dword [ecx + 0x30]
sub dword [eax], ebx
mov eax, dword [ecx + 0x20]
add dword [eax], ebx
test edi, edi
jl 0x10012e39
jg 0x10012e20
test esi, esi
je 0x10012e39
jmp 0x10012e20
mov edx, dword [ebp + 8]
mov eax, dword [ecx + 0x4c]
test eax, eax
je 0x10012e39
push eax
push esi
push 1
push edx
call fcn.10076baf
add esp, 0x10
sub esi, eax
sbb edi, 0
mov eax, dword [esp + 0x18]
mov edx, dword [esp + 0x1c]
sub eax, esi
sbb edx, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x10013450
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
mov eax, dword [0x100c4054]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, ecx
cmp ebx, 0xffffffff
jne 0x10013480
pop esi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100715c3
mov esp, ebp
pop ebp
ret 4
mov eax, dword [esi + 0x20]
push edi
mov ecx, dword [eax]
test ecx, ecx
je 0x100134bc
mov edx, dword [esi + 0x30]
mov edi, dword [edx]
lea eax, [edi + ecx]
cmp ecx, eax
jae 0x100134bc
lea ecx, [edi - 1]
mov dword [edx], ecx
mov edx, dword [esi + 0x20]
mov esi, dword [edx]
lea ecx, [esi + 1]
mov dword [edx], ecx
mov byte [esi], bl
pop edi
pop esi
mov eax, ebx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100715c3
mov esp, ebp
pop ebp
ret 4
cmp dword [esi + 0x4c], 0
je 0x100135a6
mov edi, dword [esi + 0xc]
lea eax, [esi + 0x3c]
cmp dword [edi], eax
jne 0x100134e4
mov edx, dword [esi + 0x54]
mov ecx, dword [esi + 0x50]
sub edx, ecx
mov dword [edi], ecx
mov eax, dword [esi + 0x1c]
mov dword [eax], ecx
mov eax, dword [esi + 0x2c]
mov dword [eax], edx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x10013517
push dword [esi + 0x4c]
movsx eax, bl
push eax
call fcn.1007720d
add esp, 8
or ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, ebx
pop edi
pop esi
mov eax, ecx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100715c3
mov esp, ebp
pop ebp
ret 4
mov byte [ebp - 0x25], bl
mov eax, dword [ecx]
mov edx, dword [eax + 0x1c]
lea eax, [ebp - 0x2c]
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x25]
push eax
lea eax, [esi + 0x40]
push eax
call edx
sub eax, 0
je 0x10013579
sub eax, 1
je 0x10013579
sub eax, 2
jne 0x100135a6
push dword [esi + 0x4c]
movsx eax, byte [ebp - 0x25]
push eax
call fcn.1007720d
add esp, 8
or ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, ebx
pop edi
pop esi
mov eax, ecx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100715c3
mov esp, ebp
pop ebp
ret 4
mov edi, dword [ebp - 0x2c]
lea eax, [ebp - 0x24]
sub edi, eax
je 0x10013596
push dword [esi + 0x4c]
push edi
push 1
push eax
call fcn.10076baf
add esp, 0x10
cmp edi, eax
jne 0x100135a6
lea eax, [ebp - 0x25]
mov byte [esi + 0x3d], 1
cmp dword [ebp - 0x30], eax
jne 0x100134a7
mov ecx, dword [ebp - 4]
or eax, 0xffffffff
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.100715c3
mov esp, ebp
pop ebp
ret 4
Function at 0x100153a0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x100c4054]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, ecx
cmp dword [esi + 0x38], 0
je 0x1001545c
cmp byte [esi + 0x3d], 0
je 0x1001545c
mov eax, dword [esi]
push edi
push 0xffffffffffffffff
call dword [eax + 0xc]
cmp eax, 0xffffffff
je 0x1001544a
mov ecx, dword [esi + 0x38]
mov eax, dword [ecx]
mov edx, dword [eax + 0x20]
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [esi + 0x40]
push eax
call edx
sub eax, 0
je 0x10015412
sub eax, 1
je 0x10015416
sub eax, 2
jne 0x1001544a
mov byte [esi + 0x3d], al
mov al, 1
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100715c3
mov esp, ebp
pop ebp
ret
mov byte [esi + 0x3d], 0
mov edi, dword [ebp - 0x28]
lea eax, [ebp - 0x24]
sub edi, eax
je 0x10015433
push dword [esi + 0x4c]
push edi
push 1
push eax
call fcn.10076baf
add esp, 0x10
cmp edi, eax
jne 0x1001544a
cmp byte [esi + 0x3d], 0
pop edi
sete al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100715c3
mov esp, ebp
pop ebp
ret
pop edi
xor al, al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100715c3
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
mov al, 1
xor ecx, ebp
pop esi
call fcn.100715c3
mov esp, ebp
pop ebp
ret

Function at 0x1001dd00
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10099990
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push esi
push edi
mov eax, dword [0x100c4054]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x10], edi
push 8
mov dword [edi], vtable.std::basic_streambuf_char__struct_std::char_traits_char__.0
call fcn.10071607
mov esi, eax
push 1
mov dword [ebp - 4], 0
call fcn.10070da2
mov dword [esi + 4], eax
lea ebx, [edi + 4]
mov eax, dword [ebp - 0x10]
lea edx, [edi + 8]
mov dword [ebp - 0x14], ebx
lea ecx, [eax + 0x18]
mov ebx, dword [ebp - 0x10]
add esp, 8
mov dword [ebp - 0x18], edx
mov edx, dword [ebp - 0x10]
mov dword [edi + 0x34], esi
add edi, 0x14
mov dword [ebx], vtable.std::basic_filebuf_char__struct_std::char_traits_char__.0
lea esi, [eax + 0x24]
mov byte [ebx + 0x48], 0
add eax, 0x28
mov byte [ebx + 0x3d], 0
mov ebx, dword [ebp - 0x14]
mov dword [edx + 0xc], ebx
mov ebx, dword [ebp - 0x10]
mov edx, dword [ebp - 0x18]
mov dword [ebx + 0x30], eax
mov dword [ebx + 0x10], edx
mov dword [ebx + 0x20], ecx
mov dword [ebx + 0x1c], edi
mov dword [ebx + 0x2c], esi
mov ebx, dword [ebp - 0x14]
mov dword [edx], 0
mov edx, dword [ebp - 0x10]
mov dword [ecx], 0
mov ecx, dword [0x100c6ba4]
mov dword [eax], 0
mov eax, dword [0x100c6ba0]
mov dword [ebx], 0
mov dword [edi], 0
mov dword [esi], 0
mov dword [edx + 0x40], eax
mov eax, edx
mov dword [edx + 0x4c], 0
mov dword [edx + 0x44], ecx
mov dword [edx + 0x38], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1002d580
Capabilities:
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
mov edi, edx
not ebx
mov esi, ecx
mov eax, ebx
test edi, edi
je 0x1002d5cc
mov cl, byte [esi]
lea esi, [esi + 1]
dec edi
cmp cl, 0x23
jne 0x1002d5af
cmp edi, 2
jb 0x1002d5af
cmp byte [esi], cl
jne 0x1002d5af
cmp byte [esi + 1], cl
cmove eax, ebx
movzx edx, al
movzx ecx, cl
xor edx, ecx
shr eax, 8
xor eax, dword [edx*4 + 0x100aa5f0]
test edi, edi
jne 0x1002d595
pop edi
pop esi
not eax
pop ebx
pop ebp
ret
mov cl, byte [esi]
inc esi
test cl, cl
je 0x1002d5fb
cmp cl, 0x23
jne 0x1002d5e2
cmp byte [esi], cl
jne 0x1002d5e2
cmp byte [esi + 1], cl
cmove eax, ebx
movzx edx, al
movzx ecx, cl
xor edx, ecx
shr eax, 8
mov cl, byte [esi]
inc esi
xor eax, dword [edx*4 + 0x100aa5f0]
test cl, cl
jne 0x1002d5d3
pop edi
pop esi
not eax
pop ebx
pop ebp
ret

Function at 0x1002d790
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, ecx
push edi
test esi, esi
jne 0x1002d7b3
push 0x5e2
push 0x100b1898
push str.filename__mode
call fcn.10077bd9
add esp, 0xc
mov edi, dword [ebp + 8]
test edi, edi
je 0x1002d7c0
mov dword [edi], 0
mov edx, 0x100b4ccc
mov ecx, esi
call fcn.1002d610
mov esi, eax
test esi, esi
je 0x1002d89f
push esi
call fcn.1007f3bf
add esp, 4
mov dword [ebp + 8], eax
cmp eax, 0xffffffff
je 0x1002d896
push 2
push 0
push esi
call fcn.1007691a
add esp, 0xc
test eax, eax
jne 0x1002d896
push esi
call fcn.1007f3bf
mov ebx, eax
add esp, 4
cmp ebx, 0xffffffff
je 0x1002d896
push 0
push dword [ebp + 8]
push esi
call fcn.1007691a
add esp, 0xc
test eax, eax
jne 0x1002d896
mov eax, dword [0x100c64cc]
test eax, eax
je 0x1002d835
inc dword [eax + 0x374]
push ebx
call fcn.1007eac4
add esp, 4
mov dword [ebp + 8], eax
test eax, eax
je 0x1002d896
push esi
push ebx
push 1
push eax
call fcn.10076df8
add esp, 0x10
push esi
cmp eax, ebx
je 0x1002d880
call fcn.10077cf9
mov eax, dword [0x100c64cc]
add esp, 4
test eax, eax
je 0x1002d86e
dec dword [eax + 0x374]
push dword [ebp + 8]
call fcn.1007eaa9
add esp, 4
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret
call fcn.10077cf9
add esp, 4
test edi, edi
je 0x1002d88e
mov dword [edi], ebx
mov eax, dword [ebp + 8]
pop edi
pop esi
pop ebx
pop ebp
ret
push esi
call fcn.10077cf9
add esp, 4
pop edi
pop esi
xor eax, eax
pop ebx
pop ebp
ret
Function at 0x1002ffd0
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, ecx
push edi
mov ecx, dword [esi + 0xc4]
test ecx, ecx
jg 0x1002fffe
push 0x58e
push 0x100b4e60
push str.Size___0
call fcn.10077bd9
mov ecx, dword [esi + 0xc4]
add esp, 0xc
mov eax, dword [esi + 0xcc]
mov edi, 4
lea esi, [ebp + 8]
mov eax, dword [eax + ecx*4 - 4]
not eax
movzx ecx, byte [esi]
lea esi, [esi + 1]
movzx edx, al
xor edx, ecx
shr eax, 8
xor eax, dword [edx*4 + 0x100aa5f0]
sub edi, 1
jne 0x10030012
mov ecx, dword [0x100c64cc]
not eax
pop edi
pop esi
cmp dword [ecx + 0x1a60], eax
jne 0x10030044
mov dword [ecx + 0x1a64], eax
cmp dword [ecx + 0x1a9c], eax
jne 0x10030053
mov byte [ecx + 0x1aa0], 1
pop ebp
ret 4

Function at 0x10030060
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x100c4054]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, ecx
push edi
mov edx, dword [esi + 0xc4]
test edx, edx
jg 0x1003009b
push 0x58e
push 0x100b4e60
push str.Size___0
call fcn.10077bd9
mov edx, dword [esi + 0xc4]
add esp, 0xc
mov ecx, dword [ebp + 8]
mov edi, 0x10
movss xmm0, dword [ecx]
subss xmm0, dword [esi + 0xc]
cvttss2si eax, xmm0
movss xmm0, dword [ecx + 4]
subss xmm0, dword [esi + 0x10]
mov dword [ebp - 0x14], eax
cvttss2si eax, xmm0
movss xmm0, dword [ecx + 8]
subss xmm0, dword [esi + 0xc]
mov dword [ebp - 0x10], eax
cvttss2si eax, xmm0
movss xmm0, dword [ecx + 0xc]
subss xmm0, dword [esi + 0x10]
mov dword [ebp - 0xc], eax
cvttss2si eax, xmm0
mov dword [ebp - 8], eax
mov eax, dword [esi + 0xcc]
lea esi, [ebp - 0x14]
mov edx, dword [eax + edx*4 - 4]
not edx
movzx eax, byte [esi]
lea esi, [esi + 1]
movzx ecx, dl
xor ecx, eax
shr edx, 8
xor edx, dword [ecx*4 + 0x100aa5f0]
sub edi, 1
jne 0x100300f5
mov eax, dword [0x100c64cc]
not edx
pop edi
pop esi
cmp dword [eax + 0x1a60], edx
jne 0x10030126
mov dword [eax + 0x1a64], edx
cmp dword [eax + 0x1a9c], edx
jne 0x10030135
mov byte [eax + 0x1aa0], 1
mov ecx, dword [ebp - 4]
mov eax, edx
xor ecx, ebp
call fcn.100715c3
mov esp, ebp
pop ebp
ret 4
Function at 0x10032450
Capabilities:
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
push ebx
push esi
push edi
mov edi, ecx
cmp byte [edi], 0
jne 0x10032469
cmp byte [edi + 0x2e2d], 0
je 0x10032480
push 0xf65
push 0x100b1898
push str._g.Initialized___g.SettingsLoaded
call fcn.10077bd9
add esp, 0xc
or eax, 0xffffffff
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x24], str.Window
mov esi, 0x100b2381
mov cl, 0x57
or ebx, 0xffffffff
nop dword [eax + eax]
cmp cl, 0x23
jne 0x100324af
cmp byte [esi], cl
jne 0x100324af
cmp byte [esi + 1], cl
cmove eax, ebx
movzx edx, al
movzx ecx, cl
xor edx, ecx
shr eax, 8
mov cl, byte [esi]
inc esi
xor eax, dword [edx*4 + 0x100aa5f0]
test cl, cl
jne 0x100324a0
mov ecx, dword [edi + 0x2e40]
not eax
mov ebx, dword [edi + 0x2e44]
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x1c], 0x1003fa90
mov dword [ebp - 0x14], 0x1003fb30
mov dword [ebp - 0x10], 0x1003fbc0
mov dword [ebp - 0xc], 0x1003fc70
mov dword [ebp - 8], 0x1003fd90
cmp ecx, ebx
jne 0x10032599
lea esi, [ecx + 1]
test ebx, ebx
je 0x10032516
mov eax, ebx
cdq
sub eax, edx
sar eax, 1
add eax, ebx
jmp 0x1003251b
mov eax, 8
cmp eax, esi
cmovg esi, eax
cmp esi, ebx
jle 0x10032599
mov eax, dword [0x100c64cc]
test eax, eax
je 0x10032533
inc dword [eax + 0x374]
lea eax, [esi + esi*8]
shl eax, 2
push eax
call fcn.1007eac4
mov ebx, eax
add esp, 4
mov eax, dword [edi + 0x2e48]
test eax, eax
je 0x10032587
mov ecx, dword [edi + 0x2e40]
lea ecx, [ecx + ecx*8]
shl ecx, 2
push ecx
push eax
push ebx
call fcn.10073140
mov ecx, dword [edi + 0x2e48]
add esp, 0xc
test ecx, ecx
je 0x1003257e
mov eax, dword [0x100c64cc]
test eax, eax
je 0x1003257e
dec dword [eax + 0x374]
push ecx
call fcn.1007eaa9
add esp, 4
mov ecx, dword [edi + 0x2e40]
mov dword [edi + 0x2e48], ebx
mov dword [edi + 0x2e44], esi
mov eax, dword [edi + 0x2e48]
lea ecx, [ecx + ecx*8]
movups xmm0, xmmword [ebp - 0x24]
movups xmmword [eax + ecx*4], xmm0
movups xmm0, xmmword [ebp - 0x14]
movups xmmword [eax + ecx*4 + 0x10], xmm0
mov dword [eax + ecx*4 + 0x20], 0
inc dword [edi + 0x2e40]
mov byte [edi], 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x10033bc0
Capabilities:
Hash data with crc32

Disassembly:
mov eax, ecx
or ecx, 0xffffffff
push ebx
push esi
mov bl, byte [eax]
lea esi, [eax + 1]
test bl, bl
je 0x10033bfd
push edi
or edi, 0xffffffff
cmp bl, 0x23
jne 0x10033be3
cmp byte [esi], bl
jne 0x10033be3
cmp byte [esi + 1], bl
cmove ecx, edi
movzx edx, cl
movzx eax, bl
mov bl, byte [esi]
xor edx, eax
shr ecx, 8
inc esi
xor ecx, dword [edx*4 + 0x100aa5f0]
test bl, bl
jne 0x10033bd4
pop edi
pop esi
not ecx
pop ebx
jmp fcn.10033b50
Function at 0x10038f30
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [0x100c64cc]
push ebx
push esi
push edi
mov edi, dword [eax + 0x1a28]
mov eax, dword [edi + 0xc4]
add edi, 0xc4
mov dword [ebp - 4], ecx
test eax, eax
jg 0x10038f6e
push 0x58e
push 0x100b4e60
push str.Size___0
call fcn.10077bd9
mov eax, dword [edi]
add esp, 0xc
mov ebx, dword [edi + 8]
lea edx, [ebp - 4]
mov esi, 4
mov ebx, dword [ebx + eax*4 - 4]
not ebx
nop
movzx eax, byte [edx]
lea edx, [edx + 1]
movzx ecx, bl
xor ecx, eax
shr ebx, 8
xor ebx, dword [ecx*4 + 0x100aa5f0]
sub esi, 1
jne 0x10038f80
mov esi, dword [edi + 4]
not ebx
mov ecx, dword [edi]
cmp ecx, esi
jne 0x10038fc9
inc ecx
test esi, esi
je 0x10038fb5
mov eax, esi
cdq
sub eax, edx
sar eax, 1
add eax, esi
jmp 0x10038fba
mov eax, 8
cmp eax, ecx
cmovg ecx, eax
push ecx
mov ecx, edi
call fcn.10040830
mov ecx, dword [edi]
mov eax, dword [edi + 8]
mov dword [eax + ecx*4], ebx
inc dword [edi]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x1003f190
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push esi
mov esi, dword [0x100c64cc]
push edi
cmp byte [esi + 0x2e58], 0
je 0x1003f22e
cmp dword [esi + 0x2e60], 0
lea edi, [esi + 0x2e64]
je 0x1003f220
mov ecx, dword [edi + 4]
test ecx, ecx
jns 0x1003f1d9
mov eax, ecx
cdq
sub eax, edx
sar eax, 1
add eax, ecx
xor ecx, ecx
test eax, eax
cmovg ecx, eax
push ecx
mov ecx, edi
call fcn.10040e10
lea eax, [ebp + 0xc]
mov dword [edi], 0
push eax
push dword [ebp + 8]
mov ecx, edi
call fcn.1002e490
mov edx, dword [edi]
mov ecx, 0x100c64c4
push dword [esi + 0x2e60]
lea eax, [edx - 1]
neg edx
sbb edx, edx
and edx, eax
mov eax, dword [esi + 0x2e6c]
test eax, eax
push edx
cmovne ecx, eax
push 1
push ecx
call fcn.10076baf
add esp, 0x10
pop edi
pop esi
mov esp, ebp
pop ebp
ret
lea eax, [ebp + 0xc]
mov ecx, edi
push eax
push dword [ebp + 8]
call fcn.1002e490
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x1006b1a0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x108
mov eax, dword [0x100c4054]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push 0x104
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
push str.d3d9.dll
lea eax, [ebp - 0x108]
push 0x104
push eax
call fcn.10081597
add esp, 0xc
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
lea ecx, [eax + 0x128000]
cmp eax, ecx
jae 0x1006b21c
mov esi, 0x6c7
mov edx, 0x8689
inc eax
cmp word [eax], si
jne 0x1006b212
cmp word [eax + 6], dx
jne 0x1006b212
cmp word [eax + 0xc], dx
je 0x1006b236
lea ecx, [eax + 0x128000]
cmp eax, ecx
jb 0x1006b200
mov ecx, dword [eax + 1]
mov eax, dword [ebp + 8]
pop esi
mov eax, dword [ecx + eax*4]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100715c3
mov esp, ebp
pop ebp
ret 4
mov ecx, dword [eax + 2]
jmp 0x1006b21f

Function at 0x1006b520
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub dword [ebp + 0xc], 1
jne 0x1006b547
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_DisableThreadLibraryCalls]
push 0
push 0
push 0
push 0x1006b3f0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov eax, 1
pop ebp
ret 0xc

Function at 0x1006fd20
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push esi
mov ecx, 0x401000
call fcn.1006ff00
mov dword [ebp - 4], eax
lea ecx, [ebp - 4]
lea eax, [ebp - 8]
push eax
call fcn.10070260
mov dword [ebp - 0x14], 4
mov esi, dword [eax]
lea eax, [ebp - 0x10]
push eax
push 0x40
push 4
push esi
mov dword [ebp - 0x18], esi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
setne byte [ebp - 0xc]
mov esi, dword [esi]
test eax, eax
je 0x1006fd7e
mov eax, dword [ebp - 0x10]
lea ecx, [ebp - 4]
push ecx
push eax
push dword [ebp - 0x14]
mov dword [ebp - 4], eax
push dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
cmp esi, 0x53ec8b55
jne 0x1006fd90
mov eax, 0x3e9
pop esi
mov esp, ebp
pop ebp
ret
mov ecx, 0x401000
call fcn.10070200
cmp eax, 0x16197be9
jne 0x1006fdab
mov eax, 0x3ea
pop esi
mov esp, ebp
pop ebp
ret
mov ecx, 0x8245bc
call fcn.10070200
cmp eax, 0x94bf
jne 0x1006fdc6
mov eax, 0x3f3
pop esi
mov esp, ebp
pop ebp
ret
mov ecx, 0x8252fc
call fcn.10070200
cmp eax, 0x94bf
jne 0x1006fde1
mov eax, 0x44d
pop esi
mov esp, ebp
pop ebp
ret
mov ecx, 0x82533c
call fcn.10070200
cmp eax, 0x94bf
jne 0x1006fdfc
mov eax, 0x457
pop esi
mov esp, ebp
pop ebp
ret
mov ecx, 0x858d51
call fcn.10070200
cmp eax, 0x3539f633
jne 0x1006fe17
mov eax, 0xc80
pop esi
mov esp, ebp
pop ebp
ret
mov ecx, 0x858c61
call fcn.10070200
xor ecx, ecx
mov edx, 0xc8a
cmp eax, 0x3539f633
pop esi
cmove ecx, edx
mov eax, ecx
mov esp, ebp
pop ebp
ret