joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10189430
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov ecx, dword [ebp + 0xc]
push ebx
mov ebx, dword [ebp + 0x10]
push esi
mov esi, dword [ebp + 8]
mov cl, byte [ecx + 0x1154]
mov byte [ebp + 0xb], cl
movzx ecx, cl
mov eax, dword [esi + 0x1e8]
mov edx, ecx
sub eax, ebx
mov dword [ebp + 0x10], 0
cmp ecx, eax
push edi
mov edi, dword [ebp + 0x18]
cmovge edx, eax
mov eax, 0x10
cmp edx, eax
cmovge edx, eax
mov eax, edi
mov dword [ebp - 8], edx
cdq
xor eax, edx
sub eax, edx
mov dword [ebp - 0xc], eax
cmp eax, 1
jle 0x1018949c
mov edx, 1
mov dword [ebp + 0x10], edx
test dl, bl
je 0x1018949e
xor eax, eax
cmp ecx, 2
cmovb edx, eax
mov dword [ebp + 0x10], edx
jmp 0x1018949e
xor edx, edx
mov eax, dword [ebp + 0xc]
xor ebx, ebx
mov ecx, dword [eax + 8]
imul ecx, edi
mov edi, eax
mov eax, dword [edi + 0xfd0]
lea ecx, [eax + ecx*4]
mov dword [ebp - 0x14], ecx
cmp dword [ebp - 8], ebx
jle 0x101895a1
lea eax, [esi + 0x3a98]
mov dword [ebp - 0x10], eax
nop dword [eax]
lea eax, [ebx + edx]
mov eax, dword [ecx + eax*4]
mov cl, byte [edi + 0x1154]
mov dword [ebp - 4], eax
movzx esi, cl
mov eax, dword [eax]
mov dl, byte [eax + 0x10409e00]
movzx eax, dl
cmp esi, eax
cmovae esi, eax
cmp byte [ebp + 0xb], 0x10
jb 0x10189505
cmp esi, 4
mov eax, 4
cmovb esi, eax
jmp 0x10189517
cmp dword [ebp - 0xc], 1
jle 0x10189517
mov eax, 2
cmp esi, eax
cmova eax, esi
mov esi, eax
mov edi, 2
cmp cl, 2
jb 0x10189564
cmp cl, dl
ja 0x10189564
mov ecx, dword [ebp - 4]
mov eax, dword [ecx]
mov ecx, dword [ebp + 0x18]
sub ecx, dword [ebp + 0x34]
inc ecx
mov dl, byte [eax + 0x10409e18]
movzx eax, dl
cmp ecx, eax
mov ecx, dword [ebp + 0x18]
jge 0x1018954c
mov eax, ecx
sub eax, dword [ebp + 0x34]
inc eax
movzx eax, ax
jmp 0x1018954f
movzx eax, dl
mov edx, edi
cmp dx, ax
ja 0x10189559
movzx edi, ax
movzx eax, ax
sub eax, ecx
mov ecx, dword [ebp + 0x38]
dec eax
mov dword [ecx], eax
mov eax, esi
imul eax, edi
push eax
push dword [ebp - 0x10]
push dword [ebp + 0x30]
push dword [ebp + 0x20]
push dword [ebp + 0x1c]
push dword [ebp + 0x2c]
push dword [ebp + 0x28]
push dword [ebp + 0x24]
push dword [ebp + 0x14]
push dword [ebp - 4]
call fcn.10187570
mov edx, dword [ebp + 0x10]
add ebx, esi
mov edi, dword [ebp + 0xc]
add esp, 0x28
mov ecx, dword [ebp - 0x14]
cmp ebx, dword [ebp - 8]
jl 0x101894d0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1018d610
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, dword [ebp + 0x24]
test esi, esi
jle 0x1018d6b0
mov eax, dword [ebp + 0x28]
mov ecx, dword [ebp + 0x1c]
mov edx, dword [ebp + 0x14]
push ebx
mov ebx, dword [ebp + 8]
push edi
nop
test eax, eax
jle 0x1018d695
mov esi, ebx
mov dword [ebp - 4], eax
mov edi, edx
mov ebx, ecx
nop dword [eax]
movzx eax, byte [edi]
movzx ecx, byte [ebx]
sub eax, ecx
cdq
xor eax, edx
sub eax, edx
cdq
and edx, 0xf
add eax, edx
sar eax, 4
add eax, dword [ebp + 0x10]
jns 0x1018d65f
xor eax, eax
jmp 0x1018d66a
cmp eax, 0x40
mov ecx, 0x40
cmovg eax, ecx
mov cl, 0x40
sub cl, al
cmp dword [ebp + 0xc], 0
movzx ecx, cl
movzx eax, al
cmove ecx, eax
inc ebx
mov byte [esi], cl
inc edi
inc esi
sub dword [ebp - 4], 1
jne 0x1018d640
mov eax, dword [ebp + 0x28]
mov ecx, dword [ebp + 0x1c]
mov edx, dword [ebp + 0x14]
mov ebx, dword [ebp + 8]
mov esi, dword [ebp + 0x24]
add edx, dword [ebp + 0x18]
add ebx, eax
add ecx, dword [ebp + 0x20]
sub esi, 1
mov dword [ebp + 8], ebx
mov dword [ebp + 0x14], edx
mov dword [ebp + 0x1c], ecx
mov dword [ebp + 0x24], esi
jne 0x1018d630
pop edi
pop ebx
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x1018d6c0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0x2c]
sub esp, 0xc
mov ecx, dword [ebp + 0x30]
sub ecx, dword [eax + 0x10]
sub ecx, dword [eax + 0xc]
push edi
mov edi, dword [ebp + 0x24]
add ecx, 6
mov dword [ebp + 0x30], ecx
test edi, edi
jle 0x1018d7a3
mov eax, dword [ebp + 0x20]
mov edx, dword [ebp + 0x28]
add eax, eax
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 0x18]
push ebx
mov ebx, dword [ebp + 0x1c]
add eax, eax
push esi
mov esi, dword [ebp + 0x14]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 8]
test edx, edx
jle 0x1018d784
mov esi, dword [ebp + 8]
mov eax, 1
mov edi, dword [ebp + 0x14]
rol eax, cl
sar eax, 1
mov dword [ebp - 4], eax
mov dword [ebp + 0x2c], edx
nop
movzx ecx, word [ebx]
movzx eax, word [edi]
sub eax, ecx
mov ecx, dword [ebp + 0x30]
cdq
xor eax, edx
sub eax, edx
add eax, dword [ebp - 4]
sar eax, cl
cdq
and edx, 0xf
add eax, edx
sar eax, 4
add eax, dword [ebp + 0x10]
jns 0x1018d747
xor eax, eax
jmp 0x1018d752
cmp eax, 0x40
mov ecx, 0x40
cmovg eax, ecx
mov cl, 0x40
sub cl, al
cmp dword [ebp + 0xc], 0
movzx ecx, cl
movzx eax, al
cmove ecx, eax
add ebx, 2
mov byte [esi], cl
add edi, 2
inc esi
sub dword [ebp + 0x2c], 1
jne 0x1018d720
mov ecx, dword [ebp + 0x30]
mov edx, dword [ebp + 0x28]
mov eax, dword [ebp + 8]
mov ebx, dword [ebp + 0x1c]
mov esi, dword [ebp + 0x14]
mov edi, dword [ebp + 0x24]
add esi, dword [ebp - 8]
add eax, edx
add ebx, dword [ebp - 0xc]
sub edi, 1
mov dword [ebp + 8], eax
mov dword [ebp + 0x14], esi
mov dword [ebp + 0x1c], ebx
mov dword [ebp + 0x24], edi
jne 0x1018d702
pop esi
pop ebx
pop edi
mov esp, ebp
pop ebp
ret
Function at 0x1019a230
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov edx, dword [ebp + 0x18]
xorps xmm0, xmm0
movlpd qword [ebp - 0x14], xmm0
test edx, edx
jle 0x1019a31c
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 0x10]
add eax, eax
mov dword [ebp - 0x18], eax
mov eax, dword [ebp + 0x1c]
push ebx
mov ebx, dword [ebp - 0x18]
add eax, eax
push esi
mov esi, dword [ebp + 0x14]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x14]
push edi
mov edi, dword [ebp - 0x10]
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 8], edi
test esi, esi
jle 0x1019a2f9
mov ecx, dword [ebp + 0x20]
mov esi, 1
mov ebx, dword [ebp + 0x10]
rol esi, cl
mov ecx, dword [ebp + 0x14]
ror esi, 8
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x10], ecx
movzx eax, word [eax]
lea ebx, [ebx + 2]
movzx ecx, word [ebx - 2]
sub ecx, eax
mov eax, ecx
mov ecx, dword [ebp + 0x20]
cdq
xor eax, edx
sub eax, edx
lea edx, [esi - 1]
mov edi, eax
lea ecx, [ecx - 8]
sar edi, cl
and edx, eax
mov ecx, esi
sub ecx, edx
imul ecx, dword [edi*4 + 0x1045373c]
mov eax, dword [edi*4 + 0x10453740]
mov edi, dword [ebp - 8]
imul eax, edx
add eax, ecx
cdq
add dword [ebp - 4], eax
mov eax, dword [ebp - 0xc]
adc edi, edx
add eax, 2
sub dword [ebp - 0x10], 1
mov dword [ebp - 8], edi
mov dword [ebp - 0xc], eax
jne 0x1019a295
mov eax, dword [ebp + 8]
mov ecx, dword [ebp + 0x10]
mov edx, dword [ebp + 0x18]
mov esi, dword [ebp + 0x14]
mov ebx, dword [ebp - 0x18]
add ecx, dword [ebp - 0x1c]
add eax, ebx
sub edx, 1
mov dword [ebp + 0x10], ecx
mov dword [ebp + 8], eax
mov dword [ebp + 0x18], edx
jne 0x1019a274
mov eax, dword [ebp - 4]
mov edx, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 0x14]
mov edx, dword [ebp - 0x10]
mov esp, ebp
pop ebp
ret
Function at 0x1019e0c0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 0xc]
mov ecx, dword [ebp + 8]
push ebx
cmp dword [edx + 0x60], 0
jne 0x1019e0ee
mov eax, dword [edx + 0x5c]
xor ebx, ebx
test eax, eax
sete bl
neg eax
sbb eax, eax
add eax, 0x106
lea ebx, [ebx*8 + 0x10]
mov dword [ecx], eax
jmp 0x1019e0f9
mov dword [ecx], 0x102
mov ebx, 0xc
mov eax, dword [edx + 0x68]
mov dword [ecx + 4], eax
mov eax, dword [edx + 0x6c]
mov dword [ecx + 8], eax
mov eax, dword [edx + 0x70]
mov dword [ecx + 0xc], eax
movzx eax, byte [edx + 0x74]
mov dword [ecx + 0x10], eax
mov eax, dword [edx + 0x78]
mov dword [ecx + 0x14], eax
mov eax, dword [edx + 0x7c]
mov dword [ecx + 0x18], eax
mov dword [ecx + 0x24], 8
mov eax, dword [edx]
mov dword [ecx + 0x1c], eax
mov eax, dword [edx + 8]
mov dword [ecx + 0x20], eax
mov eax, dword [edx + 0x10]
mov dword [ecx + 0x28], eax
mov eax, dword [edx + 0x18]
mov dword [ecx + 0x2c], eax
mov eax, dword [edx + 0x80]
mov dword [ecx + 0x30], eax
mov eax, dword [edx + 0x84]
mov dword [ecx + 0x34], eax
mov eax, dword [edx + 0x5c]
mov dword [ecx + 0x38], eax
mov eax, dword [edx + 0x60]
mov dword [ecx + 0x3c], eax
mov eax, dword [edx + 0x28]
mov dword [ecx + 0x40], eax
mov eax, dword [edx + 0x2c]
mov dword [ecx + 0x44], eax
mov eax, dword [edx + 0x30]
mov dword [ecx + 0x48], eax
mov eax, dword [edx + 0x20]
mov dword [ecx + 0x4c], eax
mov eax, dword [edx + 0x24]
mov dword [ecx + 0x50], eax
mov eax, dword [edx + 0x24]
mov dword [ecx + 0x54], eax
test byte [edx + 0x8c], 8
je 0x1019e1c5
or dword [ecx], 0x800
add ebx, ebx
mov eax, dword [edx + 0x64]
mov dword [ecx + 0x24], eax
mov eax, dword [edx + 0x28]
add eax, eax
mov dword [ecx + 0x40], eax
mov eax, dword [edx + 0x2c]
add eax, eax
mov dword [ecx + 0x44], eax
mov eax, dword [edx + 0x30]
add eax, eax
mov dword [ecx + 0x48], eax
mov eax, dword [edx + 0x20]
add eax, eax
mov dword [ecx + 0x4c], eax
mov eax, dword [edx + 0x24]
add eax, eax
mov dword [ecx + 0x50], eax
mov eax, dword [edx + 0x24]
add eax, eax
mov dword [ecx + 0x54], eax
mov eax, dword [ebp + 0x10]
mov dword [ecx + 0x5c], ebx
mov dword [ecx + 0x68], eax
mov eax, dword [edx + 0x4c]
mov dword [ecx + 0x6c], eax
mov dword [ecx + 0x70], 0
mov dword [ecx + 0x74], 0
mov eax, dword [edx + 0x58]
mov dword [ecx + 0x58], eax
mov dword [ecx + 0x78], 0
pop ebx
pop ebp
ret
Function at 0x10210f00
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
push edi
xor edi, edi
nop word [eax + eax]
mov ecx, edi
mov eax, edi
shr ecx, 1
mov edx, ecx
xor edx, 0x82f63b78
and al, 1
cmove edx, ecx
mov eax, edx
shr eax, 1
mov ecx, eax
xor ecx, 0x82f63b78
and dl, 1
cmove ecx, eax
mov eax, ecx
shr eax, 1
mov edx, eax
xor edx, 0x82f63b78
and cl, 1
cmove edx, eax
mov eax, edx
shr eax, 1
mov ecx, eax
xor ecx, 0x82f63b78
and dl, 1
cmove ecx, eax
mov eax, ecx
shr eax, 1
mov edx, eax
xor edx, 0x82f63b78
and cl, 1
cmove edx, eax
mov eax, edx
shr eax, 1
mov ecx, eax
xor ecx, 0x82f63b78
and dl, 1
cmove ecx, eax
mov eax, ecx
shr eax, 1
mov edx, eax
xor edx, 0x82f63b78
and cl, 1
cmove edx, eax
mov ecx, edx
shr ecx, 1
mov eax, ecx
xor eax, 0x82f63b78
and dl, 1
cmove eax, ecx
mov dword [esi + edi*4], eax
inc edi
cmp edi, 0x100
jl 0x10210f10
lea eax, [esi + 0x800]
mov edi, 0x100
nop dword [eax + eax]
mov edx, dword [eax - 0x800]
lea eax, [eax + 4]
movzx ecx, dl
shr edx, 8
xor edx, dword [esi + ecx*4]
movzx ecx, dl
mov dword [eax - 0x404], edx
shr edx, 8
xor edx, dword [esi + ecx*4]
movzx ecx, dl
mov dword [eax - 4], edx
shr edx, 8
xor edx, dword [esi + ecx*4]
movzx ecx, dl
mov dword [eax + 0x3fc], edx
shr edx, 8
xor edx, dword [esi + ecx*4]
movzx ecx, dl
mov dword [eax + 0x7fc], edx
shr edx, 8
xor edx, dword [esi + ecx*4]
movzx ecx, dl
mov dword [eax + 0xbfc], edx
shr edx, 8
xor edx, dword [esi + ecx*4]
movzx ecx, dl
mov dword [eax + 0xffc], edx
shr edx, 8
xor edx, dword [esi + ecx*4]
mov dword [eax + 0x13fc], edx
sub edi, 1
jne 0x10210fc0
pop edi
pop esi
pop ebp
ret
Function at 0x102249f0
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4c
mov eax, dword [0x1070dd84]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 0x10]
lea eax, [ebp - 0x34]
push edi
mov edi, dword [ebp + 8]
push eax
lea eax, [ebp - 0x14]
mov dword [ebp - 0x38], edi
push eax
movzx ebx, byte [edi + 0x31]
lea eax, [edi + 0x10]
push ebx
push eax
push esi
push dword [ebp + 0xc]
mov dword [ebp - 0x48], ebx
call fcn.102242b0
mov edx, dword [ebp + 0x14]
push 0
push edx
push eax
lea eax, [ebp - 0x34]
push eax
call fcn.10226840
add eax, esi
mov edx, 1
mov dword [ebp - 0x4c], eax
add esp, 0x28
movzx eax, byte [edi + 0x31]
xor esi, esi
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp + 0x14]
mov ecx, eax
shl edx, cl
xor ecx, ecx
mov dword [ebp - 0x40], edx
mov edx, dword [ebp - 0x3c]
lea edi, [eax - 4]
mov dword [ebp - 0x44], edi
cmp edx, 1
jbe 0x10224acf
mov eax, dword [ebp - 0x38]
dec edx
add eax, 0x20
mov dword [ebp - 0x3c], edx
xor ebx, ebx
xor edi, edi
movzx ecx, word [eax]
nop word [eax + eax]
add eax, 2
movzx ecx, cx
mov dword [ebp - 0x38], eax
movzx eax, word [eax]
mov esi, eax
sub eax, ecx
mov ecx, dword [ebp - 0x40]
cdq
xor eax, edx
sub eax, edx
sub ecx, eax
cmp eax, ecx
cmovl ecx, eax
cmp ecx, ebx
mov eax, ecx
cmovle eax, ebx
test ecx, ecx
mov ebx, eax
mov ecx, esi
lea eax, [edi + 1]
cmovne eax, edi
sub dword [ebp - 0x3c], 1
mov edi, eax
mov eax, dword [ebp - 0x38]
jne 0x10224a80
mov dword [ebp - 0x40], ebx
mov ebx, dword [ebp - 0x48]
mov ecx, dword [ebp - 0x40]
mov dword [ebp - 0x38], edi
mov edi, dword [ebp - 0x44]
mov esi, dword [ebp - 0x38]
inc ecx
cmp ecx, 2
jge 0x10224ad9
xor edx, edx
jmp 0x10224aea
mov edx, 1
lea eax, [edx + 1]
jle 0x10224aea
add eax, eax
inc edx
cmp eax, ecx
jl 0x10224ae3
cmp edx, edi
jle 0x10224b08
cmp ecx, 2
jge 0x10224af7
xor edi, edi
jmp 0x10224b08
mov edi, 1
lea eax, [edi + 1]
jle 0x10224b08
add eax, eax
inc edi
cmp eax, ecx
jl 0x10224b01
mov edx, dword [ebp + 0x14]
lea eax, [ebx - 1]
lea ecx, [edi + 1]
imul ebx, edx
imul ecx, eax
pop edi
lea eax, [edx + 2]
sub ecx, esi
add eax, ecx
mov ecx, dword [ebp - 4]
cmp eax, ebx
pop esi
cmovl ebx, eax
mov eax, dword [ebp - 0x4c]
inc eax
xor ecx, ebp
add eax, ebx
shl eax, 9
pop ebx
call fcn.10398bef
mov esp, ebp
pop ebp
ret
Function at 0x10226dd0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
cmp dword [ebp + 0xc], 0
jle 0x10226e8f
mov eax, dword [ebp + 0x10]
imul eax, dword [ebp + 0x14]
push esi
xor esi, esi
mov dword [ebp - 8], esi
mov dword [ebp + 0x10], eax
test eax, eax
jle 0x10226e8e
mov ecx, dword [ebp + 0x1c]
mov eax, 4
push ebx
push edi
lea ecx, [ecx - 8]
shl eax, cl
mov dword [ebp - 0x10], eax
nop word [eax + eax]
mov eax, dword [ebp + 0x18]
mov ebx, 1
movsx edx, word [eax + esi*2]
lea eax, [eax + esi*2]
mov dword [ebp - 4], eax
xor edi, edi
mov eax, dword [ebp + 8]
movzx ecx, word [eax]
mov eax, edx
sub eax, ecx
cdq
mov ecx, eax
xor ecx, edx
sub ecx, edx
cmp dword [ebp + 0xc], ebx
jle 0x10226e6f
nop word [eax + eax]
mov eax, dword [ebp + 8]
mov esi, dword [ebp - 4]
mov dword [ebp - 0xc], ecx
movzx edx, word [eax + ebx*2]
movsx eax, word [esi]
sub eax, edx
cdq
xor eax, edx
sub eax, edx
mov edx, ebx
cmp eax, ecx
cmovl ecx, eax
cmp eax, dword [ebp - 0xc]
cmovge edx, edi
inc ebx
mov edi, edx
cmp ebx, dword [ebp + 0xc]
jl 0x10226e40
mov esi, dword [ebp - 8]
cmp ecx, dword [ebp - 0x10]
jg 0x10226e81
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 4]
mov ax, word [eax + edi*2]
mov word [ecx], ax
add esi, dword [ebp + 0x14]
mov dword [ebp - 8], esi
cmp esi, dword [ebp + 0x10]
jl 0x10226e10
pop edi
pop ebx
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x102889a0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [ebp + 0xc]
push ebx
push esi
push edi
lea ecx, [eax + eax*8]
mov dword [ebp - 4], 0
mov eax, dword [ebp + 8]
lea edx, [eax + ecx*8]
mov dword [ebp - 8], 0
movzx ecx, byte [ebp + 0x14]
movzx eax, byte [ebp + 0x18]
shl ecx, 4
add ecx, eax
mov eax, dword [ecx*8 + 0x10442900]
mov ecx, dword [ebp + 0x10]
mov ebx, ecx
mov dword [ebp + 0x14], eax
mov eax, dword [edx + 0x10]
shl ebx, 6
add ebx, dword [edx + 8]
mov dword [ebp + 0x18], ebx
movzx edi, word [eax + ecx*2]
mov ecx, dword [ebp + 0x14]
mov dword [ebp + 8], edi
movsx eax, word [ecx + edi*2 - 2]
mov eax, dword [ebx + eax*4]
cdq
mov esi, eax
xor esi, edx
sub esi, edx
shl esi, 0xb
sub esi, 0x800
add edi, 0xfffffffe
mov dword [ebp + 0xc], esi
js 0x10288aac
lea eax, [edi + 1]
mov ebx, 0xe
cmp eax, 2
jl 0x10288a84
mov esi, dword [ebp + 0x18]
nop dword [eax]
movsx eax, word [ecx + edi*2]
mov ecx, ebx
mov eax, dword [esi + eax*4]
cdq
xor eax, edx
sub eax, edx
cmp eax, 0xe
cmovl ecx, eax
mov eax, dword [ebp - 4]
add eax, dword [ecx*4 + 0x10669a84]
mov ecx, ebx
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x14]
movsx eax, word [eax + edi*2 - 2]
mov eax, dword [esi + eax*4]
cdq
xor eax, edx
sub eax, edx
cmp eax, 0xe
cmovl ecx, eax
mov eax, dword [ebp - 8]
sub edi, 2
add eax, dword [ecx*4 + 0x10669a84]
mov ecx, dword [ebp + 0x14]
mov dword [ebp - 8], eax
cmp edi, 1
jge 0x10288a30
mov esi, dword [ebp + 0xc]
test edi, edi
js 0x10288aa4
movsx eax, word [ecx + edi*2]
mov ecx, dword [ebp + 0x18]
mov eax, dword [ecx + eax*4]
cdq
xor eax, edx
sub eax, edx
cmp eax, 0xe
cmovl ebx, eax
add esi, dword [ebx*4 + 0x10669a84]
mov eax, dword [ebp - 4]
add eax, dword [ebp - 8]
add esi, eax
imul eax, dword [ebp + 8], 0x4e3
pop edi
add eax, 0xfffffb1d
add eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x103a704b
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x103a708a
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x103a708a
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x103a708a
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x103a708a
cmp dword [ecx + 0x74], 0xe
jbe 0x103a708a
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret

Function at 0x103aaf03
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [ebp + 8]
mov ecx, eax
push ebx
mov ebx, dword [ebp + 0xc]
and eax, 0x3f
sar ecx, 6
push esi
push edi
imul edi, eax, 0x38
mov eax, dword [ecx*4 + 0x10758178]
mov dword [ebp - 0xc], ecx
mov ecx, dword [edi + eax + 0x18]
mov dword [ebp - 0x14], ecx
mov ecx, dword [ebp + 0x10]
test ecx, ecx
je 0x103aaf43
cmp byte [ebx], 0xa
jne 0x103aaf43
or byte [edi + eax + 0x28], 4
jmp 0x103aaf48
and byte [edi + eax + 0x28], 0xfb
add ecx, ebx
mov eax, ebx
mov dword [ebp - 0x10], ecx
mov esi, ebx
mov dword [ebp - 8], eax
cmp ebx, ecx
jae 0x103ab047
mov dl, byte [eax]
cmp dl, 0x1a
je 0x103ab02a
inc eax
cmp dl, 0xd
je 0x103aaf74
mov dword [ebp - 8], eax
mov byte [esi], dl
jmp 0x103aaf9a
cmp eax, ecx
jae 0x103aafa8
mov cl, byte [eax]
xor eax, eax
cmp cl, 0xa
sete al
inc eax
add dword [ebp - 8], eax
cmp cl, 0xa
sete al
dec al
and al, 3
add al, 0xa
mov byte [esi], al
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 0x10]
xor edx, edx
inc edx
add esi, edx
cmp eax, ecx
jb 0x103aaf5c
jmp 0x103ab047
push 0
lea eax, [ebp - 0x10]
push eax
push 1
lea eax, [ebp - 1]
push eax
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x103ab025
cmp dword [ebp - 0x10], 0
je 0x103ab025
mov ecx, dword [ebp - 0xc]
mov eax, dword [ecx*4 + 0x10758178]
test byte [eax + edi + 0x28], 0x48
je 0x103aafff
mov dl, byte [ebp - 1]
lea eax, [esi + 1]
mov dword [ebp - 0x14], eax
cmp dl, 0xa
jne 0x103aafea
mov byte [esi], dl
jmp 0x103aaffb
mov byte [esi], 0xd
mov eax, dword [ecx*4 + 0x10758178]
mov byte [eax + edi + 0x2a], dl
mov eax, dword [ebp - 0x14]
mov esi, eax
jmp 0x103ab047
cmp byte [ebp - 1], 0xa
jne 0x103ab00e
cmp esi, ebx
jne 0x103ab00e
mov byte [esi], 0xa
jmp 0x103ab046
push 1
push 0xffffffffffffffff
push 0xffffffffffffffff
push dword [ebp + 8]
call fcn.103addb7
add esp, 0x10
cmp byte [ebp - 1], 0xa
je 0x103ab047
mov byte [esi], 0xd
jmp 0x103ab046
mov ecx, dword [ebp - 0xc]
mov ecx, dword [ecx*4 + 0x10758178]
mov al, byte [ecx + edi + 0x28]
test al, 0x40
jne 0x103ab044
or al, 2
mov byte [ecx + edi + 0x28], al
jmp 0x103ab047
mov byte [esi], dl
inc esi
sub esi, ebx
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret
Function at 0x103ab050
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [ebp + 8]
mov ecx, eax
push ebx
mov ebx, dword [ebp + 0xc]
and eax, 0x3f
push esi
sar ecx, 6
push edi
imul edi, eax, 0x38
mov dword [ebp - 8], ecx
mov eax, dword [ecx*4 + 0x10758178]
push 0xa
pop edx
mov dword [ebp - 0x18], edx
mov ecx, dword [eax + edi + 0x18]
mov dword [ebp - 0x1c], ecx
mov ecx, dword [ebp + 0x10]
test ecx, ecx
je 0x103ab096
cmp word [ebx], dx
jne 0x103ab096
or byte [eax + edi + 0x28], 4
jmp 0x103ab09b
and byte [eax + edi + 0x28], 0xfb
lea edx, [ebx + ecx*2]
mov eax, ebx
mov dword [ebp - 0xc], edx
mov esi, ebx
mov dword [ebp - 4], eax
cmp ebx, edx
jae 0x103ab1fe
mov dword [ebp - 0x10], 0xd
movzx ecx, word [eax]
mov edx, ecx
mov dword [ebp - 0x14], edx
mov edx, dword [ebp - 0xc]
cmp ecx, 0x1a
je 0x103ab1de
add eax, 2
cmp cx, word [ebp - 0x10]
je 0x103ab0dc
mov dword [ebp - 4], eax
mov word [esi], cx
jmp 0x103ab112
cmp eax, edx
jae 0x103ab120
movzx eax, word [eax]
xor ecx, ecx
cmp ax, word [ebp - 0x18]
mov edx, eax
push 0xa
sete cl
xor eax, eax
lea ecx, [ecx*2 + 2]
add dword [ebp - 4], ecx
pop ecx
cmp dx, cx
mov edx, dword [ebp - 0xc]
sete al
dec eax
and eax, 3
add eax, ecx
mov word [esi], ax
mov eax, dword [ebp - 4]
push 2
pop ecx
add esi, ecx
cmp eax, edx
jb 0x103ab0b7
jmp 0x103ab1fe
push 0
lea eax, [ebp - 0x18]
push eax
push 2
lea eax, [ebp - 4]
push eax
push dword [ebp - 0x1c]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x103ab1d9
cmp dword [ebp - 0x18], 0
je 0x103ab1d9
mov edx, dword [ebp - 8]
push 0xa
mov eax, dword [edx*4 + 0x10758178]
test byte [eax + edi + 0x28], 0x48
je 0x103ab1af
lea eax, [esi + 2]
mov dword [ebp - 0x1c], eax
mov ax, word [ebp - 4]
pop ecx
mov word [ebp - 2], ax
cmp ax, cx
jne 0x103ab173
mov word [esi], cx
jmp 0x103ab1aa
push 0xd
pop ecx
mov word [esi], cx
movzx ecx, ax
mov eax, dword [edx*4 + 0x10758178]
mov dx, word [ebp - 2]
shr ecx, 8
push 0xa
mov byte [eax + edi + 0x2a], dl
mov edx, dword [ebp - 8]
mov eax, dword [edx*4 + 0x10758178]
mov byte [eax + edi + 0x2b], cl
mov eax, dword [edx*4 + 0x10758178]
pop ecx
mov byte [eax + edi + 0x2c], cl
mov esi, dword [ebp - 0x1c]
jmp 0x103ab1fe
pop eax
cmp word [ebp - 4], ax
jne 0x103ab1bf
cmp esi, ebx
jne 0x103ab1bf
mov word [esi], ax
jmp 0x103ab1fb
push 1
push 0xffffffffffffffff
push 0xfffffffffffffffe
push dword [ebp + 8]
call fcn.103addb7
add esp, 0x10
push 0xa
pop eax
cmp word [ebp - 4], ax
je 0x103ab1fe
push 0xd
pop eax
jmp 0x103ab1ba
mov edx, dword [ebp - 8]
mov edx, dword [edx*4 + 0x10758178]
mov al, byte [edx + edi + 0x28]
test al, 0x40
jne 0x103ab1f8
or al, 2
mov byte [edx + edi + 0x28], al
jmp 0x103ab1fe
mov word [esi], cx
add esi, 2
sub esi, ebx
and esi, 0xfffffffe
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret
Function at 0x103acfdf
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x106fbf74
push 0x106fbf6c
push str.FlsAlloc
push 0x1f
call fcn.103acebb
mov esi, eax
add esp, 0x10
test esi, esi
je 0x103ad013
push dword [ebp + 8]
mov ecx, esi
call dword [0x103b8148]
call esi
jmp 0x103ad019
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
pop esi
pop ebp
ret 4

Function at 0x103ad05d
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x106fbf84
push 0x106fbf7c
push str.FlsGetValue
push 0x21
call fcn.103acebb
mov esi, eax
add esp, 0x10
test esi, esi
je 0x103ad094
push dword [ebp + 8]
mov ecx, esi
call dword [0x103b8148]
call esi
pop esi
pop ebp
ret 4
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsGetValue]

Function at 0x103ad09c
Capabilities:
Set thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x106fbf8c
push 0x106fbf84
push str.FlsSetValue
push 0x22
call fcn.103acebb
mov esi, eax
add esp, 0x10
test esi, esi
je 0x103ad0d6
push dword [ebp + 0xc]
mov ecx, esi
push dword [ebp + 8]
call dword [0x103b8148]
call esi
pop esi
pop ebp
ret 8
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsSetValue]