joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10010e80
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x1c
cmp dword [ecx + 0x38], 0
push ebx
push esi
push edi
mov dword [esp + 0xc], ecx
je 0x10010f66
mov esi, dword [ebp + 0x10]
mov ebx, esi
mov edx, dword [ebp + 0xc]
mov edi, edx
mov eax, dword [ebp + 8]
mov dword [esp + 0x10], eax
test esi, esi
jl 0x10010f55
jg 0x10010ec0
test edx, edx
je 0x10010f55
nop dword [eax]
call fcn.10014850
mov esi, eax
mov eax, edx
mov dword [esp + 0x14], eax
test eax, eax
jl 0x10010f14
jg 0x10010ed7
test esi, esi
je 0x10010f14
cmp ebx, eax
jg 0x10010ee7
jl 0x10010ee1
cmp edi, esi
jae 0x10010ee7
mov esi, edi
mov dword [esp + 0x14], ebx
mov ecx, dword [esp + 0xc]
mov eax, dword [esp + 0x10]
push esi
push eax
mov eax, dword [ecx + 0x20]
push dword [eax]
call fcn.10070570
mov ecx, dword [esp + 0x18]
add esp, 0xc
sub edi, esi
sbb ebx, dword [esp + 0x14]
mov eax, dword [ecx + 0x30]
sub dword [eax], esi
mov eax, dword [ecx + 0x20]
add dword [eax], esi
jmp 0x10010f39
mov ecx, dword [esp + 0xc]
mov eax, dword [esp + 0x10]
mov edx, dword [ecx]
movzx eax, byte [eax]
push eax
call dword [edx + 0xc]
cmp eax, 0xffffffff
je 0x10010f4f
mov ecx, dword [esp + 0xc]
add edi, 0xffffffff
mov esi, 1
adc ebx, 0xffffffff
add dword [esp + 0x10], esi
test ebx, ebx
jg 0x10010ec0
jl 0x10010f4f
test edi, edi
jne 0x10010ec0
mov edx, dword [ebp + 0xc]
mov esi, dword [ebp + 0x10]
sub edx, edi
mov eax, edx
sbb esi, ebx
mov edx, esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov eax, dword [ecx + 0x20]
mov esi, dword [ebp + 0xc]
mov edi, dword [ebp + 0x10]
mov dword [esp + 0x20], esi
mov edx, dword [eax]
lea eax, [ecx + 0x30]
mov dword [esp + 0x24], edi
mov dword [esp + 0x1c], edx
mov dword [esp + 0x18], eax
test edx, edx
je 0x10010f8e
mov eax, dword [eax]
mov edx, dword [eax]
jmp 0x10010f94
xor edx, edx
mov dword [esp + 0x18], eax
mov eax, edx
cdq
mov dword [esp + 0x14], eax
mov dword [esp + 0x10], edx
test edi, edi
jl 0x10010ffc
jg 0x10010fa9
test esi, esi
je 0x10010ffc
test edx, edx
jl 0x10010ff7
jg 0x10010fb3
test eax, eax
je 0x10010ff7
cmp edi, edx
jg 0x10010fc7
jl 0x10010fbd
cmp esi, eax
jae 0x10010fc7
mov eax, esi
mov dword [esp + 0x14], esi
mov dword [esp + 0x10], edi
mov ebx, dword [ebp + 8]
push eax
push ebx
push dword [esp + 0x24]
call fcn.10070570
mov eax, dword [esp + 0x24]
add esp, 0xc
mov edx, dword [esp + 0x14]
add ebx, edx
mov ecx, dword [esp + 0xc]
sub esi, edx
mov eax, dword [eax]
sbb edi, dword [esp + 0x10]
sub dword [eax], edx
mov eax, dword [ecx + 0x20]
add dword [eax], edx
jmp 0x10010fff
mov ebx, dword [ebp + 8]
jmp 0x10011009
mov ebx, dword [ebp + 8]
test edi, edi
jl 0x10011022
jg 0x10011009
test esi, esi
je 0x10011022
mov eax, dword [ecx + 0x4c]
test eax, eax
je 0x10011022
push eax
push esi
push 1
push ebx
call fcn.10076567
add esp, 0x10
sub esi, eax
sbb edi, 0
mov eax, dword [esp + 0x20]
mov edx, dword [esp + 0x24]
sub eax, esi
sbb edx, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x10011040
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0xc
mov eax, dword [ebp + 0x10]
push ebx
mov ebx, ecx
mov ecx, dword [ebp + 0xc]
push esi
push edi
mov edi, dword [ebp + 8]
mov dword [esp + 0xc], edi
test eax, eax
jg 0x10011072
jl 0x10011065
test ecx, ecx
jne 0x10011072
xor eax, eax
xor edx, edx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
cmp dword [ebx + 0x38], 0
je 0x10011132
mov dword [esp + 0x10], ecx
mov dword [esp + 0xc], eax
mov ecx, ebx
call fcn.10014870
mov esi, eax
mov eax, edx
mov dword [esp + 0x14], eax
test eax, eax
jl 0x100110de
jg 0x1001109d
test esi, esi
je 0x100110de
mov ecx, dword [esp + 0xc]
cmp ecx, eax
jg 0x100110b5
mov eax, dword [esp + 0x10]
jl 0x100110af
cmp eax, esi
jae 0x100110b5
mov esi, eax
mov dword [esp + 0x14], ecx
mov eax, dword [ebx + 0x1c]
push esi
push dword [eax]
push edi
call fcn.10070570
mov eax, dword [ebx + 0x2c]
add esp, 0xc
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 0xc]
sub ecx, esi
sbb edx, dword [esp + 0x14]
sub dword [eax], esi
mov eax, dword [ebx + 0x1c]
add dword [eax], esi
jmp 0x100110ff
mov eax, dword [ebx]
mov ecx, ebx
call dword [eax + 0x1c]
mov edx, dword [esp + 0xc]
cmp eax, 0xffffffff
je 0x1001111b
mov ecx, dword [esp + 0x10]
mov esi, 1
add ecx, 0xffffffff
mov byte [edi], al
adc edx, 0xffffffff
add edi, esi
mov dword [esp + 0xc], edx
mov dword [esp + 0x10], ecx
test edx, edx
jg 0x10011084
jl 0x1001111b
test ecx, ecx
jne 0x10011084
mov eax, dword [ebp + 0xc]
sub eax, dword [esp + 0x10]
mov ecx, dword [ebp + 0x10]
sbb ecx, edx
mov edx, ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov eax, dword [ebx + 0x1c]
lea esi, [ebx + 0x2c]
mov edi, ecx
mov edx, dword [eax]
test edx, edx
je 0x10011176
mov eax, dword [esi]
mov eax, dword [eax]
test eax, eax
je 0x10011176
mov edi, dword [esp + 0xc]
cmp eax, ecx
mov esi, ecx
cmovb esi, eax
push esi
push edx
push edi
call fcn.10070570
mov eax, dword [ebx + 0x2c]
add edi, esi
mov dword [esp + 0x18], edi
add esp, 0xc
mov edi, dword [ebp + 0xc]
sub edi, esi
sub dword [eax], esi
mov eax, dword [ebx + 0x1c]
add dword [eax], esi
lea esi, [ebx + 0x2c]
cmp dword [ebx + 0x4c], 0
je 0x100111e7
mov ecx, dword [ebx + 0xc]
lea eax, [ebx + 0x3c]
cmp dword [ecx], eax
jne 0x1001119c
mov eax, dword [ebx + 0xc]
mov edx, dword [ebx + 0x54]
mov ecx, dword [ebx + 0x50]
sub edx, ecx
mov dword [eax], ecx
mov eax, dword [ebx + 0x1c]
mov dword [eax], ecx
mov eax, dword [esi]
mov dword [eax], edx
mov esi, dword [esp + 0xc]
cmp edi, 0xfff
jbe 0x100111d2
nop dword [eax + eax]
push dword [ebx + 0x4c]
push 0xfff
push 1
push esi
call fcn.10076c75
add esp, 0x10
add esi, eax
sub edi, eax
cmp eax, 0xfff
jne 0x100111e7
cmp edi, eax
ja 0x100111b0
test edi, edi
je 0x100111e7
push dword [ebx + 0x4c]
push edi
push 1
push esi
call fcn.10076c75
add esp, 0x10
sub edi, eax
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 0x10]
sub eax, edi
pop edi
pop esi
sbb edx, 0
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x10011550
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
mov eax, dword [0x100b6374]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, ecx
cmp ebx, 0xffffffff
jne 0x10011580
pop esi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1006def6
mov esp, ebp
pop ebp
ret 4
mov eax, dword [esi + 0x20]
push edi
mov ecx, dword [eax]
test ecx, ecx
je 0x100115bc
mov edx, dword [esi + 0x30]
mov edi, dword [edx]
lea eax, [edi + ecx]
cmp ecx, eax
jae 0x100115bc
lea ecx, [edi - 1]
mov dword [edx], ecx
mov edx, dword [esi + 0x20]
mov esi, dword [edx]
lea ecx, [esi + 1]
mov dword [edx], ecx
mov byte [esi], bl
pop edi
pop esi
mov eax, ebx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1006def6
mov esp, ebp
pop ebp
ret 4
cmp dword [esi + 0x4c], 0
je 0x100116a4
mov edi, dword [esi + 0xc]
lea eax, [esi + 0x3c]
cmp dword [edi], eax
jne 0x100115e4
mov edx, dword [esi + 0x54]
mov ecx, dword [esi + 0x50]
sub edx, ecx
mov dword [edi], ecx
mov eax, dword [esi + 0x1c]
mov dword [eax], ecx
mov eax, dword [esi + 0x2c]
mov dword [eax], edx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x10011617
push dword [esi + 0x4c]
movsx eax, bl
push eax
call fcn.10073a4c
add esp, 8
or ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, ebx
pop edi
pop esi
mov eax, ecx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1006def6
mov esp, ebp
pop ebp
ret 4
lea eax, [ebp - 0x2c]
mov byte [ebp - 0x25], bl
mov edx, dword [ecx]
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x25]
push eax
lea eax, [esi + 0x40]
push eax
call dword [edx + 0x1c]
sub eax, 0
je 0x10011677
sub eax, 1
je 0x10011677
sub eax, 2
jne 0x100116a4
push dword [esi + 0x4c]
movsx eax, byte [ebp - 0x25]
push eax
call fcn.10073a4c
add esp, 8
or ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, ebx
pop edi
pop esi
mov eax, ecx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1006def6
mov esp, ebp
pop ebp
ret 4
mov edi, dword [ebp - 0x2c]
lea eax, [ebp - 0x24]
sub edi, eax
je 0x10011694
push dword [esi + 0x4c]
push edi
push 1
push eax
call fcn.10076567
add esp, 0x10
cmp edi, eax
jne 0x100116a4
lea eax, [ebp - 0x25]
mov byte [esi + 0x3d], 1
cmp dword [ebp - 0x30], eax
jne 0x100115a7
mov ecx, dword [ebp - 4]
or eax, 0xffffffff
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1006def6
mov esp, ebp
pop ebp
ret 4
Function at 0x10014580
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x100b6374]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, ecx
cmp dword [esi + 0x38], 0
je 0x1001463a
cmp byte [esi + 0x3d], 0
je 0x1001463a
mov eax, dword [esi]
push edi
push 0xffffffffffffffff
call dword [eax + 0xc]
cmp eax, 0xffffffff
je 0x10014628
mov ecx, dword [esi + 0x38]
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 4]
push eax
mov edx, dword [ecx]
lea eax, [ebp - 0x24]
push eax
lea eax, [esi + 0x40]
push eax
call dword [edx + 0x20]
sub eax, 0
je 0x100145f0
sub eax, 1
je 0x100145f4
sub eax, 2
jne 0x10014628
mov byte [esi + 0x3d], al
mov al, 1
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1006def6
mov esp, ebp
pop ebp
ret
mov byte [esi + 0x3d], 0
mov edi, dword [ebp - 0x28]
lea eax, [ebp - 0x24]
sub edi, eax
je 0x10014611
push dword [esi + 0x4c]
push edi
push 1
push eax
call fcn.10076567
add esp, 0x10
cmp edi, eax
jne 0x10014628
cmp byte [esi + 0x3d], 0
pop edi
sete al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1006def6
mov esp, ebp
pop ebp
ret
pop edi
xor al, al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1006def6
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
mov al, 1
xor ecx, ebp
pop esi
call fcn.1006def6
mov esp, ebp
pop ebp
ret

Function at 0x10016040
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10097cb0
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x100b6374]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, ecx
mov dword [ebp - 0x10], eax
push 8
mov dword [eax], vtable.std::basic_streambuf_char__struct_std::char_traits_char__.0
call fcn.1006e0ee
mov esi, eax
xorps xmm0, xmm0
movq qword [esi], xmm0
push 1
mov dword [ebp - 4], 0
call fcn.1005b490
mov dword [esi + 4], eax
add esp, 8
mov eax, dword [ebp - 0x10]
lea edi, [eax + 0x14]
lea ecx, [eax + 0x18]
lea edx, [eax + 0x24]
mov dword [eax + 0x34], esi
lea ebx, [eax + 4]
mov dword [eax + 0xc], ebx
lea esi, [eax + 8]
mov dword [eax + 0x10], esi
mov dword [eax + 0x1c], edi
mov dword [eax + 0x20], ecx
mov dword [eax + 0x2c], edx
add eax, 0x28
mov dword [ebp - 0x14], ebx
mov ebx, dword [ebp - 0x10]
mov dword [ebx + 0x30], eax
mov ebx, dword [ebp - 0x14]
mov dword [esi], 0
mov dword [ecx], 0
mov dword [eax], 0
mov eax, dword [ebp - 0x10]
mov dword [ebx], 0
mov dword [edi], 0
mov dword [edx], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x100181d0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 0xc]
mov edx, 0x811c9dc5
push edi
mov edi, dword [ebp + 8]
mov ecx, 0
sub esi, edi
je 0x10018201
nop dword [eax]
movzx eax, byte [ecx + edi]
inc ecx
xor eax, edx
imul edx, eax, 0x1000193
cmp ecx, esi
jb 0x100181f0
pop edi
mov eax, edx
pop esi
pop ebp
ret 8
Function at 0x1001bac0
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10098283
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x100b6374]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
mov edi, dword [ebp + 0x14]
mov dword [ebp - 0x14], esi
mov dword [esi + 4], 0
mov dword [esi + 8], 0
mov dword [esi + 0xc], 0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
mov dword [esi + 0x18], 0
mov dword [esi + 0x1c], 0
mov dword [ebp - 4], 0
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x2c], 0
mov dword [esi + 0x30], 0
mov dword [esi + 0x34], 0
mov dword [esi + 0x38], 0
mov dword [esi + 0x3c], 0
lea edx, [esi + 0x40]
mov dword [edx], 0
mov dword [edx + 4], 0
mov dword [edx + 8], 0
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 0x20]
mov byte [ebp - 4], 2
mov dword [esi + 0x50], eax
mov eax, dword [ebp + 8]
mov dword [esi + 0x54], eax
mov eax, dword [ebp + 0x1c]
mov dword [esi + 0x5c], eax
mov eax, dword [ebp + 0x18]
mov dword [esi + 0x58], edi
mov dword [esi + 0x60], ecx
mov byte [esi + 0x64], 0
mov dword [esi + 0x68], eax
test byte [edi + 8], 8
je 0x1001bbab
test cl, 0x10
jne 0x1001bbab
mov al, 1
jmp 0x1001bbad
xor al, al
mov byte [esi + 0x6c], al
mov eax, dword [ebp + 0x10]
mov dword [esi + 0x70], eax
mov ebx, dword [edx + 4]
mov ecx, ebx
mov edi, dword [edi + 0x18]
sar ecx, 3
cmp edi, ecx
jae 0x1001bbd1
lea ecx, [edi*8]
mov dword [edx + 4], ecx
jmp 0x1001bc08
jbe 0x1001bc08
mov eax, dword [edx + 8]
sar eax, 3
cmp edi, eax
jbe 0x1001bbe8
push ecx
push edi
mov ecx, edx
call fcn.1001eaf0
jmp 0x1001bc08
sub edi, ecx
je 0x1001bc05
lea eax, [edi*8]
push eax
push 0
push ebx
call fcn.10070af0
add esp, 0xc
lea ebx, [ebx + edi*8]
lea edx, [esi + 0x40]
mov dword [edx + 4], ebx
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x1c

Function at 0x100227f0
Capabilities:
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
mov edi, edx
not ebx
mov esi, ecx
mov eax, ebx
test edi, edi
je 0x10022851
mov cl, byte [esi]
lea esi, [esi + 1]
dec edi
cmp cl, 0x23
jne 0x10022834
cmp edi, 2
jb 0x10022834
cmp byte [esi], cl
jne 0x10022834
cmp byte [esi + 1], cl
jne 0x10022834
mov eax, ebx
movzx ecx, cl
movzx edx, al
xor edx, ecx
shr eax, 8
xor eax, dword [edx*4 + 0x100a8f60]
jmp 0x10022805
movzx edx, al
movzx ecx, cl
xor edx, ecx
shr eax, 8
xor eax, dword [edx*4 + 0x100a8f60]
test edi, edi
jne 0x10022805
pop edi
pop esi
not eax
pop ebx
pop ebp
ret
mov cl, byte [esi]
inc esi
test cl, cl
je 0x10022880
cmp cl, 0x23
jne 0x10022867
cmp byte [esi], cl
jne 0x10022867
cmp byte [esi + 1], cl
cmove eax, ebx
movzx edx, al
movzx ecx, cl
xor edx, ecx
shr eax, 8
mov cl, byte [esi]
inc esi
xor eax, dword [edx*4 + 0x100a8f60]
test cl, cl
jne 0x10022858
pop edi
pop esi
not eax
pop ebx
pop ebp
ret
Function at 0x10022a20
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
test ebx, ebx
je 0x10022a33
mov dword [ebx], 0
mov edx, 0x100ad0b4
call fcn.10022890
mov esi, eax
test esi, esi
je 0x10022b10
push esi
call fcn.1007793d
add esp, 4
mov dword [ebp + 8], eax
cmp eax, 0xffffffff
je 0x10022b07
push 2
push 0
push esi
call fcn.10077087
add esp, 0xc
test eax, eax
jne 0x10022b07
push esi
call fcn.1007793d
mov edi, eax
add esp, 4
cmp edi, 0xffffffff
je 0x10022b07
push 0
push dword [ebp + 8]
push esi
call fcn.10077087
add esp, 0xc
test eax, eax
jne 0x10022b07
mov eax, dword [0x10183428]
test eax, eax
je 0x10022aa6
inc dword [eax + 0x374]
push edi
call fcn.100772af
add esp, 4
mov dword [ebp + 8], eax
test eax, eax
je 0x10022b07
push esi
push edi
push 1
push eax
call fcn.10076c75
add esp, 0x10
push esi
cmp eax, edi
je 0x10022af1
call fcn.100740b2
mov eax, dword [0x10183428]
add esp, 4
test eax, eax
je 0x10022adf
dec dword [eax + 0x374]
push dword [ebp + 8]
call fcn.100767d2
add esp, 4
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret
call fcn.100740b2
add esp, 4
test ebx, ebx
je 0x10022aff
mov dword [ebx], edi
mov eax, dword [ebp + 8]
pop edi
pop esi
pop ebx
pop ebp
ret
push esi
call fcn.100740b2
add esp, 4
pop edi
pop esi
xor eax, eax
pop ebx
pop ebp
ret
Function at 0x10024780
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x100b6374]
xor eax, ebp
mov dword [ebp - 4], eax
mov edx, dword [ebp + 8]
push esi
mov esi, ecx
push edi
movss xmm0, dword [edx]
mov edi, 0x10
subss xmm0, dword [esi + 0xc]
mov ecx, dword [esi + 0xbc]
cvttss2si eax, xmm0
movss xmm0, dword [edx + 4]
subss xmm0, dword [esi + 0x10]
mov dword [ebp - 0x14], eax
cvttss2si eax, xmm0
movss xmm0, dword [edx + 8]
subss xmm0, dword [esi + 0xc]
mov dword [ebp - 0x10], eax
cvttss2si eax, xmm0
movss xmm0, dword [edx + 0xc]
subss xmm0, dword [esi + 0x10]
mov dword [ebp - 0xc], eax
cvttss2si eax, xmm0
mov dword [ebp - 8], eax
mov eax, dword [esi + 0xc4]
lea esi, [ebp - 0x14]
mov edx, dword [eax + ecx*4 - 4]
not edx
movzx eax, byte [esi]
lea esi, [esi + 1]
movzx ecx, dl
xor ecx, eax
shr edx, 8
xor edx, dword [ecx*4 + 0x100a8f60]
sub edi, 1
jne 0x100247f4
mov eax, dword [0x10183428]
not edx
pop edi
pop esi
cmp dword [eax + 0x19e4], edx
jne 0x10024825
mov dword [eax + 0x19e8], edx
cmp dword [eax + 0x1a18], edx
jne 0x10024834
mov byte [eax + 0x1a1c], 1
mov ecx, dword [ebp - 4]
mov eax, edx
xor ecx, ebp
call fcn.1006def6
mov esp, ebp
pop ebp
ret 4
Function at 0x100251f0
Capabilities:
Hash data with crc32

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100985b3
mov eax, dword fs:[0]
push eax
push ebx
sub esp, 0x28
push esi
push edi
mov eax, dword [0x100b6374]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [0x10183428]
test eax, eax
je 0x1002523a
inc dword [eax + 0x374]
push 0x3b88
call fcn.100772af
mov dword [ebp - 0x1c], eax
lea ecx, [ebp - 0x11]
add esp, 4
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x20], eax
mov dword [ebp - 4], 0
test eax, eax
je 0x1002526d
push ecx
mov ecx, eax
call fcn.10020f50
mov edi, eax
mov dword [ebp - 0x18], eax
jmp 0x10025272
xor edi, edi
mov dword [ebp - 0x18], edi
mov eax, dword [0x10183428]
mov esi, 0x100ad001
test eax, eax
mov dword [ebp - 0x24], 0
mov dword [ebp - 0x38], str.Window
cmove eax, edi
or edx, 0xffffffff
mov dword [0x10183428], eax
or edi, 0xffffffff
mov al, 0x57
nop dword [eax]
cmp al, 0x23
jne 0x100252ae
cmp byte [esi], al
jne 0x100252ae
cmp byte [esi + 1], al
cmove edx, edi
movzx ecx, dl
movzx eax, al
xor ecx, eax
shr edx, 8
mov al, byte [esi]
inc esi
xor edx, dword [ecx*4 + 0x100a8f60]
test al, al
jne 0x100252a0
mov edi, dword [ebp - 0x18]
not edx
mov dword [ebp - 0x34], edx
mov dword [ebp - 0x30], 0x10032350
mov dword [ebp - 0x2c], 0x100323b0
mov esi, dword [edi + 0x2d40]
mov ecx, dword [edi + 0x2d44]
mov dword [ebp - 0x28], 0x10032480
cmp esi, ecx
jne 0x10025386
inc esi
test ecx, ecx
je 0x10025308
mov eax, ecx
cdq
sub eax, edx
sar eax, 1
add eax, ecx
jmp 0x1002530d
mov eax, 8
cmp eax, esi
cmovg esi, eax
cmp esi, ecx
jle 0x10025386
mov eax, dword [0x10183428]
test eax, eax
je 0x10025325
inc dword [eax + 0x374]
lea eax, [esi + esi*2]
shl eax, 3
push eax
call fcn.100772af
mov edx, eax
add esp, 4
mov eax, dword [edi + 0x2d48]
mov dword [ebp - 0x1c], edx
mov dword [ebp - 0x18], eax
test eax, eax
je 0x1002537a
mov ecx, dword [edi + 0x2d40]
lea ecx, [ecx + ecx*2]
shl ecx, 3
push ecx
push eax
push edx
call fcn.10070570
mov eax, dword [0x10183428]
add esp, 0xc
test eax, eax
je 0x1002536c
dec dword [eax + 0x374]
push dword [ebp - 0x18]
call fcn.100767d2
mov edx, dword [ebp - 0x1c]
add esp, 4
mov dword [edi + 0x2d48], edx
mov dword [edi + 0x2d44], esi
mov eax, dword [edi + 0x2d40]
movups xmm0, xmmword [ebp - 0x38]
lea ecx, [eax + eax*2]
mov eax, dword [edi + 0x2d48]
movups xmmword [eax + ecx*8], xmm0
movq xmm0, qword [ebp - 0x28]
movq qword [eax + ecx*8 + 0x10], xmm0
mov eax, edi
inc dword [edi + 0x2d40]
mov byte [edi], 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret
Function at 0x10027d60
Capabilities:
Hash data with crc32

Disassembly:
push ebx
mov bl, byte [ecx]
or eax, 0xffffffff
push esi
lea esi, [ecx + 1]
or ecx, 0xffffffff
push edi
test bl, bl
je 0x10027d9f
cmp bl, 0x23
jne 0x10027d81
cmp byte [esi], bl
jne 0x10027d81
cmp byte [esi + 1], bl
cmove eax, ecx
movzx edx, al
movzx ecx, bl
mov bl, byte [esi]
xor edx, ecx
shr eax, 8
inc esi
mov ecx, 0xffffffff
xor eax, dword [edx*4 + 0x100a8f60]
test bl, bl
jne 0x10027d72
mov ecx, dword [0x10183428]
not eax
mov esi, dword [ecx + 0x19a0]
mov edi, dword [ecx + 0x19a8]
lea ebx, [edi + esi*8]
test esi, esi
je 0x10027dde
nop word [eax + eax]
mov edx, esi
shr edx, 1
cmp dword [edi + edx*8], eax
lea ecx, [edi + edx*8]
jae 0x10027dd8
lea edi, [ecx + 8]
or ecx, 0xffffffff
sub ecx, edx
add esi, ecx
jmp 0x10027dda
mov esi, edx
test esi, esi
jne 0x10027dc0
cmp edi, ebx
je 0x10027ded
cmp dword [edi], eax
jne 0x10027ded
mov eax, dword [edi + 4]
pop edi
pop esi
pop ebx
ret
pop edi
pop esi
xor eax, eax
pop ebx
ret
Function at 0x1002d1c0
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [0x100b6374]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [0x10183428]
lea edx, [ebp - 8]
push ebx
push esi
push edi
mov edi, dword [eax + 0x19b0]
mov esi, 4
mov eax, dword [edi + 0xbc]
add edi, 0xbc
mov dword [ebp - 8], ecx
mov ebx, dword [edi + 8]
mov ebx, dword [ebx + eax*4 - 4]
not ebx
nop
movzx eax, byte [edx]
lea edx, [edx + 1]
movzx ecx, bl
xor ecx, eax
shr ebx, 8
xor ebx, dword [ecx*4 + 0x100a8f60]
sub esi, 1
jne 0x1002d200
mov esi, dword [edi + 4]
not ebx
mov ecx, dword [edi]
cmp ecx, esi
jne 0x1002d247
inc ecx
test esi, esi
je 0x1002d235
mov eax, esi
cdq
sub eax, edx
sar eax, 1
add eax, esi
jmp 0x1002d23a
mov eax, 8
cmp eax, ecx
cmovg ecx, eax
push ecx
mov ecx, edi
call fcn.10032ca0
mov ecx, dword [edi]
mov eax, dword [edi + 8]
mov dword [eax + ecx*4], ebx
inc dword [edi]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1006def6
mov esp, ebp
pop ebp
ret
Function at 0x10031c20
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push esi
mov esi, dword [0x10183428]
push edi
cmp byte [esi + 0x2d58], 0
je 0x10031cbe
cmp dword [esi + 0x2d60], 0
lea edi, [esi + 0x2d64]
je 0x10031cb0
mov ecx, dword [edi + 4]
test ecx, ecx
jns 0x10031c69
mov eax, ecx
cdq
sub eax, edx
sar eax, 1
add eax, ecx
xor ecx, ecx
test eax, eax
cmovg ecx, eax
push ecx
mov ecx, edi
call fcn.10033020
lea eax, [ebp + 0xc]
mov dword [edi], 0
push eax
push dword [ebp + 8]
mov ecx, edi
call fcn.10023190
mov edx, dword [edi]
mov ecx, 0x10183419
push dword [esi + 0x2d60]
lea eax, [edx - 1]
neg edx
sbb edx, edx
and edx, eax
mov eax, dword [esi + 0x2d6c]
test eax, eax
push edx
cmovne ecx, eax
push 1
push ecx
call fcn.10076567
add esp, 0x10
pop edi
pop esi
mov esp, ebp
pop ebp
ret
lea eax, [ebp + 0xc]
mov ecx, edi
push eax
push dword [ebp + 8]
call fcn.10023190
pop edi
pop esi
mov esp, ebp
pop ebp
ret