joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1009b4c7
Capabilities:
Print debug messages

Disassembly:
push 0x20
mov eax, 0x1015c07c
call fcn.100bd9b7
mov esi, ecx
push dword [ebp + 0x10]
lea ecx, [ebp - 0x2c]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.1009b264
and dword [ebp - 4], 0
lea eax, [ebp - 0x2c]
push eax
lea ecx, [esi + 4]
call fcn.1009b2d3
mov ecx, dword [ebp + 0x14]
mov esi, eax
call fcn.1005b458
mov dword [esi], eax
mov ecx, dword [0x101c1010]
test ecx, ecx
je 0x1009b515
call fcn.1004687d
mov edi, eax
jmp 0x1009b517
xor edi, edi
push 0x2800
call fcn.1010e66d
mov ebx, eax
mov dword [esp], str.CacheResultForID_parent:
mov eax, dword [ebp + 0xc]
lea ecx, [ebp - 0x18]
push 0x1018cab0
mov dword [ebp - 0x18], ebx
lea edx, [ebx + 0x2800]
mov dword [ebp - 0x10], ebx
mov esi, dword [eax]
mov dword [ebp - 0x14], edx
call fcn.10020f00
mov ecx, dword [ebp + 8]
call fcn.1005b458
push 0
push eax
push str._I64u
lea ecx, [ebp - 0x18]
call fcn.1009b1c8
push str._name:
push 0x1018cab0
lea ecx, [ebp - 0x18]
call fcn.10020f00
push esi
lea ecx, [ebp - 0x18]
call fcn.10020cc0
mov esi, eax
push str._nDeep
push 0x1018cab0
mov ecx, esi
call fcn.10020f00
push dword [ebp + 0x10]
mov ecx, esi
push 0x1018d1a0
call fcn.10020db0
mov esi, eax
push str._result:
push 0x1018cab0
mov ecx, esi
call fcn.10020f00
mov ecx, dword [ebp + 0x14]
call fcn.1005b458
push 0
push eax
push str._I64u
mov ecx, esi
call fcn.1009b1c8
test edi, edi
je 0x1009b5ff
mov eax, dword [edi]
mov ecx, edi
push 2
push 0
call dword [eax + 0x2c]
test al, al
je 0x1009b5ff
push dword [ebp + 4]
mov eax, dword [edi]
mov ecx, edi
push str.SOUI::SWindowFinder::CacheResultForName
push 0x3b
push str.f:workspace_soui_soui_srchelper_swndfinder.cpp
push ebx
push str.soui
push 2
push 0
call dword [eax + 0x34]
jmp 0x1009b66a
mov esi, 0x1018d010
lea ecx, [ebp - 0x18]
push esi
mov edi, 0x1018cab0
push edi
call fcn.10020f00
push str.SOUI::SWindowFinder::CacheResultForName
push edi
lea ecx, [ebp - 0x18]
call fcn.10020f00
push esi
push edi
lea ecx, [ebp - 0x18]
call fcn.10020f00
push str.f:workspace_soui_soui_srchelper_swndfinder.cpp
push edi
lea ecx, [ebp - 0x18]
call fcn.10020f00
push 0x1018d014
push edi
lea ecx, [ebp - 0x18]
call fcn.10020f00
push 0x3b
push 0x1018d1a0
lea ecx, [ebp - 0x18]
call fcn.10020db0
push 0x1018d018
push edi
mov ecx, eax
call fcn.10020f00
push ebx
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
push ebx
call fcn.1010e678
pop ecx
lea ecx, [ebp - 0x24]
call fcn.10008910
call fcn.100bd980
ret 0x10
Function at 0x1009b73b
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
mov ebx, dword [ebp + 0xc]
push edi
lea edi, [ecx + 4]
push ebx
mov ecx, edi
call fcn.1009ba14
test eax, eax
je 0x1009b916
push esi
push dword [eax + 0x14]
call fcn.1006add5
mov esi, eax
mov dword [ebp - 0xc], esi
pop ecx
test esi, esi
jne 0x1009b774
push ebx
mov ecx, edi
call fcn.1009badb
mov ecx, dword [0x101c1010]
test ecx, ecx
je 0x1009b785
call fcn.1004687d
jmp 0x1009b787
xor eax, eax
push 0x2800
mov dword [ebp - 8], eax
call fcn.1010e66d
mov ebx, eax
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x10], ebx
pop ecx
lea ecx, [ebx + 0x2800]
mov dword [ebp - 0x14], ecx
test esi, esi
je 0x1009b7b6
mov ecx, esi
call fcn.1005b458
mov dword [ebp - 4], eax
jmp 0x1009b7ba
and dword [ebp - 4], 0
mov esi, dword [ebp + 0xc]
lea ecx, [ebp - 0x18]
push str.findChildByKey:_hParent:
push 0x1018cab0
mov edi, dword [esi + 8]
call fcn.10020f00
push 0
push dword [esi]
lea ecx, [ebp - 0x18]
push str._I64u
call fcn.1009b1c8
push str._nDeep:
push 0x1018cab0
lea ecx, [ebp - 0x18]
call fcn.10020f00
push dword [esi + 0x10]
lea ecx, [ebp - 0x18]
push 0x1018d1a0
call fcn.10020db0
mov esi, eax
push str._hId:
push 0x1018cab0
mov ecx, esi
call fcn.10020f00
mov eax, dword [ebp + 0xc]
mov ecx, esi
push dword [eax + 0xc]
push 0x1018d1a0
call fcn.10020db0
mov esi, eax
push str._name:
push 0x1018cab0
mov ecx, esi
call fcn.10020f00
push edi
mov ecx, esi
call fcn.10020cc0
mov esi, eax
push str._result:
push 0x1018cab0
mov ecx, esi
call fcn.10020f00
xor edi, edi
mov ecx, esi
push edi
push dword [ebp - 4]
push str._I64u
call fcn.1009b1c8
mov esi, dword [ebp - 8]
test esi, esi
je 0x1009b8a0
mov eax, dword [esi]
mov ecx, esi
push 2
push edi
call dword [eax + 0x2c]
test al, al
je 0x1009b8a0
push dword [ebp + 4]
mov eax, dword [esi]
mov ecx, esi
push str.SOUI::SWindowFinder::FindChildByKey
push 0x2f
push str.f:workspace_soui_soui_srchelper_swndfinder.cpp
push ebx
push str.soui
push 2
push edi
call dword [eax + 0x34]
jmp 0x1009b90b
mov esi, 0x1018d010
lea ecx, [ebp - 0x18]
push esi
mov edi, 0x1018cab0
push edi
call fcn.10020f00
push str.SOUI::SWindowFinder::FindChildByKey
push edi
lea ecx, [ebp - 0x18]
call fcn.10020f00
push esi
push edi
lea ecx, [ebp - 0x18]
call fcn.10020f00
push str.f:workspace_soui_soui_srchelper_swndfinder.cpp
push edi
lea ecx, [ebp - 0x18]
call fcn.10020f00
push 0x1018d014
push edi
lea ecx, [ebp - 0x18]
call fcn.10020f00
push 0x2f
push 0x1018d1a0
lea ecx, [ebp - 0x18]
call fcn.10020db0
push 0x1018d018
push edi
mov ecx, eax
call fcn.10020f00
push ebx
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
push ebx
call fcn.1010e678
mov eax, dword [ebp - 0xc]
pop ecx
pop esi
pop edi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x1009bc81
Capabilities:
Log keystrokes
Parse credit card information

Disassembly:
push 4
mov eax, 0x1015c14a
call fcn.100bd9b7
and dword [ebp - 0x10], 0
mov esi, dword [ebp + 8]
mov eax, dword [0x101b8004]
mov dword [esi], eax
mov ecx, dword [ebp + 0xc]
xor edi, edi
and dword [ebp - 4], 0
inc edi
movzx edx, cx
mov dword [ebp - 0x10], edi
cmp edx, 0x25
ja 0x1009bd27
je 0x1009bd1d
mov eax, edx
sub eax, 0xd
je 0x1009bd13
sub eax, 0xe
je 0x1009bd09
sub eax, 5
je 0x1009bcff
sub eax, edi
je 0x1009bcf5
sub eax, edi
je 0x1009bceb
sub eax, edi
je 0x1009bce1
sub eax, edi
jne 0x1009bd60
push str.Home
jmp 0x1009be64
push 0x1016d458
jmp 0x1009be64
push str.PageDown
jmp 0x1009be64
push str.PageUp
jmp 0x1009be64
push str.Space
jmp 0x1009be64
push 0x1016d40c
jmp 0x1009be64
push 0x1016d414
jmp 0x1009be64
push str.Left
jmp 0x1009be64
mov eax, edx
sub eax, 0x26
je 0x1009be5f
sub eax, 1
je 0x1009be58
sub eax, 1
je 0x1009be51
dec eax
sub eax, 1
je 0x1009be4a
sub eax, 3
je 0x1009be43
sub eax, 1
je 0x1009be3c
cmp cx, 0x30
jb 0x1009bd6c
cmp cx, 0x39
jbe 0x1009bd75
lea eax, [ecx - 0x41]
cmp ax, 0x19
ja 0x1009bd8c
movzx eax, cx
mov ecx, esi
mov dword [ebp + 0xc], eax
lea eax, [ebp + 0xc]
push eax
push edi
call fcn.10007d00
jmp 0x1009be6b
lea eax, [ecx - 0x60]
cmp ax, 9
ja 0x1009bda0
lea eax, [edx - 0x60]
push eax
push str.Num__d
jmp 0x1009bde2
cmp cx, 0x6a
jne 0x1009bdb0
push 0x1016d4cc
jmp 0x1009be64
cmp cx, 0x6b
jne 0x1009bdc0
push str.Num_
jmp 0x1009be64
cmp cx, 0x6e
jne 0x1009bdd0
push str.Num_Del
jmp 0x1009be64
lea eax, [ecx - 0x70]
cmp ax, 0xb
ja 0x1009bdf9
lea eax, [edx - 0x6f]
push eax
push 0x1016d4f4
lea eax, [ebp + 0xc]
push eax
push esi
call fcn.10010fc0
add esp, 0x10
lea ecx, [ebp + 0xc]
call fcn.10008910
jmp 0x1009be6b
push 2
push edx
call dword [sym.imp.USER32.dll_MapVirtualKeyA]
cmp al, 0x3d
jg 0x1009be1a
je 0x1009be26
cmp al, 0x27
je 0x1009be26
cmp al, 0x2b
jle 0x1009be6b
cmp al, 0x2f
jle 0x1009be26
cmp al, 0x3b
je 0x1009be26
jmp 0x1009be6b
cmp al, 0x5b
jl 0x1009be6b
cmp al, 0x5d
jle 0x1009be26
cmp al, 0x60
jne 0x1009be6b
cbw
mov ecx, esi
movzx eax, ax
mov dword [ebp + 0xc], eax
lea eax, [ebp + 0xc]
push eax
push edi
call fcn.10013010
jmp 0x1009be6b
push str.Delete
jmp 0x1009be64
push str.Insert
jmp 0x1009be64
push str.Print
jmp 0x1009be64
push str.Down
jmp 0x1009be64
push str.Right
jmp 0x1009be64
push 0x1016d420
mov ecx, esi
call fcn.10006820
mov eax, esi
call fcn.100bd980
ret
Function at 0x100a1c80
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push esi
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.1005a892
mov esi, eax
test esi, esi
je 0x100a1cac
mov edx, dword [esi]
mov ecx, esi
push str.menuItem
call dword [edx + 4]
test eax, eax
je 0x100a1cac
mov eax, esi
jmp 0x100a1dae
mov ecx, dword [0x101c1010]
test ecx, ecx
je 0x100a1cbf
call fcn.1004687d
mov esi, eax
jmp 0x100a1cc1
xor esi, esi
push ebx
push edi
push 0x2800
call fcn.1010e66d
mov edi, eax
mov dword [esp], 0x5000
call fcn.1010e66d
push dword [ebp + 0xc]
mov ebx, eax
push dword [ebp + 8]
push str.menuItem
push str.FindChildByID2_Failed__no_window_of_class___s__with_id_of___d__was_found_within___d__levels
push 0xffffffffffffffff
push 0x2800
push ebx
call fcn.10057bd9
add esp, 0x20
xor eax, eax
push eax
push eax
push eax
push eax
push 0xffffffffffffffff
push ebx
push eax
push eax
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
cmp eax, 0x2800
jae 0x100a1d26
xor ecx, ecx
push ecx
push ecx
push eax
push edi
push 0xffffffffffffffff
push ebx
push ecx
push ecx
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
push ebx
call fcn.1010e678
pop ecx
test esi, esi
je 0x100a1d65
mov eax, dword [esi]
mov ecx, esi
push 3
push 0
call dword [eax + 0x2c]
test al, al
je 0x100a1d65
push dword [ebp + 4]
mov eax, dword [esi]
mov ecx, esi
push str.SOUI::SWindow::FindChildByID2
push 0x1e9
push str.f:workspace_soui_souiincludecore_swnd.h
push edi
push str.soui
push 3
push 0
call dword [eax + 0x34]
jmp 0x100a1da3
mov ebx, 0x2800
push ebx
call fcn.1010e66d
mov dword [esp], 0x1e9
mov esi, eax
push str.f:workspace_soui_souiincludecore_swnd.h
push str.SOUI::SWindow::FindChildByID2
push edi
push str._s__s__s:_d_n
push 0xffffffffffffffff
push ebx
push esi
call fcn.10057bba
add esp, 0x20
push esi
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
push esi
call fcn.1010e678
pop ecx
push edi
call fcn.1010e678
pop ecx
pop edi
xor eax, eax
pop ebx
pop esi
pop ebp
ret 8
Function at 0x100b2953
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
push edi
mov eax, dword [esi + 8]
mov edi, eax
mov edx, eax
and edi, 7
je 0x100b2981
cmp eax, edi
jge 0x100b2975
push esi
call fcn.100aee8f
mov eax, dword [esi + 8]
pop ecx
mov ecx, edi
shr dword [esi + 0xc], cl
sub eax, edi
mov dword [esi + 8], eax
mov edx, eax
xor ecx, ecx
test eax, eax
jle 0x100b29a4
mov edi, dword [esi + 0xc]
mov al, byte [esi + 0xc]
sub edx, 8
mov byte [ebp + ecx + 8], al
inc ecx
shr edi, 8
mov dword [esi + 0xc], edi
test edx, edx
jg 0x100b298a
mov dword [esi + 8], edx
jmp 0x100b29b9
mov eax, dword [esi]
cmp eax, dword [esi + 4]
jb 0x100b29af
xor dl, dl
jmp 0x100b29b4
mov dl, byte [eax]
inc eax
mov dword [esi], eax
mov byte [ebp + ecx + 8], dl
inc ecx
cmp ecx, 4
jl 0x100b29a4
mov eax, dword [ebp + 8]
movzx ecx, byte [ebp + 0xb]
movzx edi, ah
movzx eax, al
shl edi, 8
add edi, eax
shl ecx, 8
movzx eax, byte [ebp + 0xa]
add ecx, eax
mov eax, edi
xor eax, 0xffff
cmp ecx, eax
je 0x100b29f2
mov dword [0x101c1490], str.zlib_corrupt
xor eax, eax
jmp 0x100b2a34
mov eax, dword [esi]
add eax, edi
cmp eax, dword [esi + 4]
jbe 0x100b2a07
mov dword [0x101c1490], str.read_past_buffer
jmp 0x100b29ee
mov eax, dword [esi + 0x10]
add eax, edi
cmp eax, dword [esi + 0x18]
jbe 0x100b2a1e
push edi
push esi
call fcn.100b6b35
pop ecx
pop ecx
test eax, eax
je 0x100b29ee
push edi
push dword [esi]
push dword [esi + 0x10]
call fcn.100e4bc0
add dword [esi], edi
xor eax, eax
add dword [esi + 0x10], edi
add esp, 0xc
inc eax
pop edi
pop esi
pop ebp
ret
Function at 0x100c0f17
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateThread]
pop ebp
ret

Function at 0x100c12b9
Capabilities:
Allocate thread local storage

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
cmp eax, 0xffffffff
jne 0x100c12d6
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jg 0x100c12da
jmp 0x100c12e2
mov esp, ebp
pop ebp
ret
movzx eax, ax
or eax, 0x80070000
push eax
lea ecx, [ebp - 0x10]
call fcn.100c1d26
push 0x101b1da4
lea eax, [ebp - 0x10]
push eax
call fcn.100e5371
int3

Function at 0x100cdc3b
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push 4
mov eax, 0x1015dff8
call fcn.100bd9b7
mov edi, ecx
mov dword [ebp - 0x10], edi
or dword [edi + 4], 0xfffffff
lea ecx, [edi + 0x3c]
xor ebx, ebx
mov dword [edi + 8], ebx
mov dword [edi + 0x10], ebx
mov dword [edi + 0x14], SysReAllocString
mov dword [edi + 0x18], ebx
mov dword [edi + 0x38], ebx
call fcn.100bfb8a
mov dword [ebp - 4], ebx
mov ebx, dword [ebp + 8]
mov eax, dword [ebx + 0x64]
mov dword [edi + 0x64], eax
xor eax, eax
mov dword [edi + 0x6c], eax
mov dword [edi + 0x78], eax
mov dword [edi + 0x84], eax
mov dword [edi + 0x88], eax
test dword [0x101b87f8], 0x80000000
je 0x100cdcac
push dword [0x101c1a04]
call fcn.100c1308
pop ecx
test eax, eax
jne 0x100cdcb1
call fcn.100c85ba
mov dword [edi + 0xc], eax
mov eax, dword [eax + 0x34]
mov dword [edi], eax
mov eax, dword [ebx + 8]
mov dword [edi + 8], eax
test eax, eax
je 0x100cdccc
cmp eax, 2
je 0x100cdccc
lock inc dword [eax + 4]
mov ecx, edi
call fcn.100cf113
lea ecx, [edi + 0x3c]
call fcn.100c0646
cmp byte [ebp + 0xc], 0
je 0x100cdd0d
mov edx, dword [edi + 0x64]
mov ecx, edi
add edx, 0x68
mov esi, dword [edx]
mov eax, esi
mov dword [edi + 0x68], esi
lock cmpxchg dword [edx], ecx
jmp 0x100cdd07
mov dword [edi + 0x68], eax
mov esi, eax
mov ecx, dword [edi + 0x64]
mov edx, edi
add ecx, 0x68
lock cmpxchg dword [ecx], edx
cmp eax, esi
jne 0x100cdcf6
jmp 0x100cdd15
or dword [edi + 0x78], 1
and dword [edi + 0x68], 0
call fcn.100c88dd
mov esi, eax
mov eax, dword [esi + 0x20]
test eax, eax
jne 0x100cdd2d
mov ecx, esi
call fcn.100cc15e
mov eax, dword [esi + 0x20]
mov eax, dword [eax + 0x40]
and dword [edi + 4], 0xfffffff
mov dword [edi + 0x80], eax
mov eax, edi
call fcn.100bd980
ret 8

Function at 0x100d947f
Capabilities:
Allocate thread local storage

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
mov dword [0x101c1a70], eax
cmp eax, 0xffffffff
jne 0x100d94a1
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jg 0x100d94a5
jmp 0x100d94ad
mov esp, ebp
pop ebp
ret
movzx eax, ax
or eax, 0x80070000
push eax
lea ecx, [ebp - 0x10]
call fcn.100c1d26
push 0x101b1da4
lea eax, [ebp - 0x10]
push eax
call fcn.100e5371
int3
Function at 0x100e59a6
Capabilities:
Allocate thread local storage

Disassembly:
push ebp
mov ebp, esp
push esi
push 0x10176124
push 0x1017611c
push str.FlsAlloc
push 0
call fcn.100e584d
mov esi, eax
add esp, 0x10
test esi, esi
je 0x100e59d8
push dword [ebp + 8]
mov ecx, esi
call fcn.100be234
call esi
pop esi
pop ebp
ret
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsAlloc]

Function at 0x100e5a1a
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push esi
push 0x10176134
push 0x1017612c
push str.FlsGetValue
push 2
call fcn.100e584d
add esp, 0x10
mov esi, eax
push dword [ebp + 8]
test esi, esi
je 0x100e5a4b
mov ecx, esi
call fcn.100be234
call esi
jmp 0x100e5a51
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
pop esi
pop ebp
ret

Function at 0x100e5a54
Capabilities:
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push esi
push 0x1017613c
push 0x10176134
push str.FlsSetValue
push 3
call fcn.100e584d
add esp, 0x10
mov esi, eax
push dword [ebp + 0xc]
push dword [ebp + 8]
test esi, esi
je 0x100e5a88
mov ecx, esi
call fcn.100be234
call esi
jmp 0x100e5a8e
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
pop esi
pop ebp
ret
Function at 0x1012032a
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.1011ff2f

Function at 0x10120335
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.101200b0

Function at 0x10127dad
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.10127587

Function at 0x10127db8
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.101277c2

Function at 0x10131c93
Capabilities:
Create thread
Print debug messages

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.10131a1a

Function at 0x10134651
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push esi
push edi
push dword [ebp + 0x18]
xor edi, edi
xor esi, esi
push dword [ebp + 0x1c]
inc edi
mov dword [ebp - 8], esi
push edi
call fcn.10144215
add esp, 0xc
mov dword [ebp - 4], eax
cmp dword [ebp - 4], esi
jne 0x1013467e
xor eax, eax
jmp 0x1013477a
mov eax, dword [ebp - 4]
mov ecx, SysReAllocString
push 0x40
push 0x100e557d
mov dword [eax + 0x2a4], ecx
mov eax, dword [ebp - 4]
push dword [ebp - 4]
mov dword [eax + 0x2a8], ecx
call fcn.101360e1
push esi
push eax
call fcn.100e5590
add esp, 0x14
test eax, eax
je 0x101346b9
push esi
call dword [sym.imp.KERNEL32.dll_ExitProcess]
push dword [ebp + 0x20]
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp - 4]
call fcn.101443d4
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp - 4]
call fcn.101360c3
push dword [ebp + 8]
push dword [ebp - 4]
call fcn.1013801d
add esp, 0x28
test eax, eax
jne 0x101346f0
mov dword [ebp - 8], edi
mov eax, dword [ebp - 4]
mov dword [eax + 0xb4], 0x2000
cmp dword [ebp - 8], esi
jne 0x10134731
mov eax, dword [ebp - 4]
push dword [eax + 0xb4]
push dword [ebp - 4]
call fcn.101443a5
pop ecx
pop ecx
mov ecx, dword [ebp - 4]
mov dword [ecx + 0xb0], eax
mov eax, dword [ebp - 4]
cmp dword [eax + 0xb0], esi
jne 0x1013472c
mov dword [ebp - 8], edi
cmp dword [ebp - 8], esi
je 0x10134761
mov eax, dword [ebp - 4]
push dword [eax + 0xb0]
push dword [ebp - 4]
call fcn.101442e6
push dword [ebp + 0x18]
mov eax, dword [ebp - 4]
push dword [ebp + 0x20]
push dword [ebp - 4]
mov dword [eax + 0xb0], esi
call fcn.1014429e
add esp, 0x14
jmp 0x10134677
push esi
push esi
push esi
push dword [ebp - 4]
call fcn.10144164
push dword [ebp - 4]
call fcn.10134a74
mov eax, dword [ebp - 4]
add esp, 0x14
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x10137cbd
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
mov eax, dword [esi]
test eax, eax
je 0x10137cf3
push edi
mov edi, 0x10c
cmp dword [ebp + 0xc], edi
jae 0x10137ce6
push eax
call fcn.1014428a
push 2
call fcn.10144201
pop ecx
pop ecx
mov dword [esi], eax
push edi
push 0
push eax
call fcn.100e5140
add esp, 0xc
pop edi
pop esi
pop ebp
ret
Function at 0x10139a31
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push esi
push edi
push dword [ebp + 0x18]
xor edi, edi
xor esi, esi
push dword [ebp + 0x1c]
inc edi
mov dword [ebp - 8], esi
push edi
call fcn.10144215
add esp, 0xc
mov dword [ebp - 4], eax
cmp dword [ebp - 4], esi
jne 0x10139a5e
xor eax, eax
jmp 0x10139c02
mov eax, dword [ebp - 4]
mov ecx, SysReAllocString
push 0x40
push 0x100e557d
mov dword [eax + 0x2a4], ecx
mov eax, dword [ebp - 4]
mov dword [eax + 0x2a8], ecx
mov eax, dword [ebp - 4]
mov dword [eax + 0x2ac], esi
mov eax, dword [ebp - 4]
push dword [ebp - 4]
mov dword [eax + 0x2b0], esi
call fcn.101360e1
push esi
push eax
call fcn.100e5590
add esp, 0x14
test eax, eax
je 0x10139aab
push esi
call dword [sym.imp.KERNEL32.dll_ExitProcess]
push dword [ebp + 0x20]
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp - 4]
call fcn.101443d4
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp - 4]
call fcn.101360c3
push dword [ebp + 8]
push dword [ebp - 4]
call fcn.1013801d
add esp, 0x28
test eax, eax
jne 0x10139ae2
mov dword [ebp - 8], edi
cmp dword [ebp - 8], esi
jne 0x10139b1e
mov eax, dword [ebp - 4]
mov dword [eax + 0xb4], 0x2000
mov eax, dword [ebp - 4]
push dword [eax + 0xb4]
push dword [ebp - 4]
call fcn.101443a5
pop ecx
pop ecx
mov ecx, dword [ebp - 4]
mov dword [ecx + 0xb0], eax
mov eax, dword [ebp - 4]
cmp dword [eax + 0xb0], esi
jne 0x10139b1e
mov dword [ebp - 8], edi
mov eax, dword [ebp - 4]
mov dword [eax + 0x98], 0x1013822c
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 4]
mov dword [eax + 0x9c], fcn.1013827b
mov eax, dword [ebp - 4]
mov dword [eax + 0xa0], ecx
cmp dword [ebp - 8], esi
jne 0x10139b9e
mov eax, dword [ebp - 4]
push 0x38
add eax, 0x78
push str.1.2.5
push eax
call fcn.1014c8a8
add esp, 0xc
cmp eax, 0xfffffffa
je 0x10139b87
cmp eax, 0xfffffffc
je 0x10139b80
cmp eax, 0xfffffffe
je 0x10139b79
test eax, eax
je 0x10139b99
push str.Unknown_zlib_error
jmp 0x10139b8c
push str.zlib_stream_error
jmp 0x10139b8c
push str.zlib_memory_error
jmp 0x10139b8c
push str.zlib_version_error
push dword [ebp - 4]
call fcn.101360fd
pop ecx
mov dword [ebp - 8], edi
pop ecx
cmp dword [ebp - 8], esi
je 0x10139bce
mov eax, dword [ebp - 4]
push dword [eax + 0xb0]
push dword [ebp - 4]
call fcn.101442e6
push dword [ebp + 0x18]
mov eax, dword [ebp - 4]
push dword [ebp + 0x20]
push dword [ebp - 4]
mov dword [eax + 0xb0], esi
call fcn.1014429e
add esp, 0x14
jmp 0x10139a57
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 4]
push esi
push esi
mov eax, dword [eax + 0xb0]
mov dword [ecx + 0x84], eax
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 4]
push dword [ebp - 4]
mov eax, dword [eax + 0xb4]
mov dword [ecx + 0x88], eax
call fcn.1013fd62
mov eax, dword [ebp - 4]
add esp, 0xc
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x1014cd2f
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
cmp dword [ebp + 0xc], 0
jne 0x1014cd3c
xor eax, eax
pop ebp
ret
pop ebp
jmp fcn.1014ce38
Function at 0x14b240d
Capabilities:
Encrypt data using speck

Disassembly:
rol dl, 1
add dl, 0xb1
mov dword [esp + eax*2 - 0x12e2c], 0x643ea1bc
xor bl, dl
pop eax
call fcn.023f33c0

Function at 0x14b5d8e
Capabilities:
Encode data using xor

Disassembly:
or cl, byte [eax + ecx]
mov dword [esp], edx
sub edi, 2
movsx eax, dx
mov word [edi], cx
or eax, edx
adc dword [esp], edx
shr eax, 0x91
mov ecx, dword [eax + esi - 0x7fff]
lea esi, [esi + eax*4 - 0x1fff8]
xadd edx, eax
shl byte [esp + 3], 0xa1
xadd word [esp], dx
xor ecx, ebx
inc byte [esp]
xor byte [esp], al
rol eax, 0x33
rol ecx, 3
or eax, dword [esp + eax*2 - 0x7dac8f2e]
neg ecx
sub ecx, 0x6e80fa24
call fcn.024e19ab
mov eax, dword [edi]
call fcn.014f7933
xchg ebp, eax
and dword [edi], ebx
add eax, 0xb75c3cfb
sub ebp, dword [0xd98fd383]
mov bl, 0x46
xchg dword [eax + ecx*2 - 0x48a06d98], edx
and dh, 0x88
add esp, esi
dec eax
add al, byte [eax + ebp]
mov bh, 0xb7
sar byte [eax], 1
push ebx
jo 0x14b5da2
and al, 0x28
or ecx, dword [edi - 0x4cf26d6c]
in eax, dx
dec eax
mov dh, 0xf0
jecxz 0x14b5e91
pop edx
inc ecx
das
invalid
push ecx
lcall 0x4726, 0x521d0d7e
shr byte [ecx + 0x5f], 0xa6
sbb esi, dword [ebx + 0x317d1f0a]
invalid

Function at 0x14c5359
Capabilities:
Encode data using xor

Disassembly:
call fcn.01595d48
xchg dh, dl
not ecx
jmp 0x2563f03
lea ecx, [edx + ecx + 0x3c122c83]
movzx eax, word [esp + edx*2 - 0x1fffe]
xor ebx, ecx
inc edx
sar eax, 2
adc edi, ecx
xor dword [esp + edx*4 - 0x40000], edx
lea edx, [edx*4 - 0x6041ec73]
pop eax
jge fcn.015b753e
jae 0x2563f6b
aam 0x96
inc edi
aad 0x18
mov cl, byte [ecx + 0x395775fb]
sbb byte [ecx + 0x1f], 0x1f
push es
push ebx
fadd qword [esi - 6]
pop ds
push esp
stc
aas
mov ebp, 0x6129ccf1
xor byte [eax + 0x48], dl
mov edx, 0x76436f55
jge 0x2563f3d
dec ebp
pop ebp
fsubr st(5)
les edx, [ebx - 0x4e70f881]
mov esi, 0xdafb9c77
sub al, 0x9b
or dword [edx - 0x3d], ebp
jne 0x2563f75
invalid
cmc
mov al, byte [0x63fff9c4]
popfd
add eax, 0xe446c8d3
inc edx
int 0
xchg esi, eax
mov edx, 0x26957dcf
ljmp 0x34bb