joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10006490
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x1018ac55
push eax
mov dword fs:[0], esp
sub esp, 0x34
push esi
mov esi, dword [ebp + 0x10]
push edi
mov edi, dword [ebp + 0xc]
cmp byte [esi + 0xb], 0
je 0x100064d2
xor edx, edx
nop dword [eax + eax]
lea ecx, [esi + edx]
lea eax, [edx - 0x24]
inc edx
xor byte [ecx], al
cmp edx, 0xa
jb 0x100064c0
mov byte [esi + 0xb], 0
lea eax, [ebp + 0xf]
push eax
lea eax, [esi + 0xa]
push eax
push esi
lea ecx, [ebp - 0x40]
call fcn.100055e0
cmp byte [edi + 0xb], 0
mov dword [ebp - 4], 0
je 0x10006504
xor edx, edx
lea ecx, [edi + edx]
lea eax, [edx - 0x24]
inc edx
xor byte [ecx], al
cmp edx, 0xa
jb 0x100064f2
mov byte [edi + 0xb], 0
lea eax, [ebp + 0xf]
push eax
lea eax, [edi + 0xa]
push eax
push edi
lea ecx, [ebp - 0x28]
call fcn.100055e0
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x40]
push eax
lea eax, [ebp - 0x28]
mov byte [ebp - 4], 1
push eax
push dword [ebp + 0xc]
mov ecx, esi
call fcn.1000c880
mov ecx, dword [ebp - 0x14]
cmp ecx, 0xf
jbe 0x1000655e
mov edx, dword [ebp - 0x28]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x10006554
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x10006584
push ecx
push edx
call fcn.1013141d
add esp, 8
mov ecx, dword [ebp - 0x2c]
cmp ecx, 0xf
jbe 0x10006594
mov edx, dword [ebp - 0x40]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x1000658a
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x1000658a
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push ecx
push edx
call fcn.1013141d
add esp, 8
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop edi
pop esi
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
Function at 0x100065b0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x1018ac2d
push eax
mov dword fs:[0], esp
sub esp, 0x1c
push esi
mov esi, dword [ebp + 0x10]
cmp byte [esi + 0xc], 0
je 0x100065e9
xor edx, edx
lea ecx, [esi + edx]
lea eax, [edx - 0x24]
inc edx
xor byte [ecx], al
cmp edx, 0xb
jb 0x100065d7
mov byte [esi + 0xc], 0
lea eax, [ebp + 0x13]
push eax
lea eax, [esi + 0xb]
push eax
push esi
lea ecx, [ebp - 0x28]
call fcn.100055e0
mov eax, dword [ebp + 0xc]
mov dword [ebp - 4], 0
cmp dword [eax + 0x14], 0xf
mov ecx, dword [eax + 0x10]
jbe 0x1000660f
mov eax, dword [eax]
push ecx
push eax
push 0
lea ecx, [ebp - 0x28]
call fcn.10017c50
mov esi, dword [ebp + 8]
xorps xmm0, xmm0
movups xmmword [esi], xmm0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
movups xmm0, xmmword [eax]
movups xmmword [esi], xmm0
movq xmm0, qword [eax + 0x10]
movq qword [esi + 0x10], xmm0
mov dword [eax + 0x10], 0
mov dword [eax + 0x14], 0xf
mov byte [eax], 0
mov ecx, dword [ebp - 0x14]
cmp ecx, 0xf
jbe 0x10006689
mov edx, dword [ebp - 0x28]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x1000667f
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x1000667f
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push ecx
push edx
call fcn.1013141d
add esp, 8
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop esi
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
Function at 0x1000e840
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push esi
mov esi, ecx
cmp byte [esi + 8], 0
je 0x1000e863
xor eax, eax
lea edx, [esi + eax]
lea ecx, [eax - 0x24]
inc eax
xor byte [edx], cl
cmp eax, 7
jb 0x1000e851
mov byte [esi + 8], 0
mov ecx, dword [ebp + 8]
lea eax, [ebp - 1]
push eax
lea eax, [esi + 7]
push eax
push esi
call fcn.100055e0
mov eax, dword [ebp + 8]
pop esi
mov esp, ebp
pop ebp
ret 4

Function at 0x1000e8c0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push esi
mov esi, ecx
cmp byte [esi + 0xb], 0
je 0x1000e8e3
xor eax, eax
lea edx, [esi + eax]
lea ecx, [eax - 0x24]
inc eax
xor byte [edx], cl
cmp eax, 0xa
jb 0x1000e8d1
mov byte [esi + 0xb], 0
mov ecx, dword [ebp + 8]
lea eax, [ebp - 1]
push eax
lea eax, [esi + 0xa]
push eax
push esi
call fcn.100055e0
mov eax, dword [ebp + 8]
pop esi
mov esp, ebp
pop ebp
ret 4

Function at 0x1000f2a0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
push esi
mov esi, ecx
cmp dword [esi + 0x38], 0
je 0x1000f32c
cmp byte [esi + 0x3d], 0
je 0x1000f32c
mov eax, dword [esi]
push edi
push 0xffffffffffffffff
call dword [eax + 0xc]
cmp eax, 0xffffffff
je 0x1000f324
mov ecx, dword [esi + 0x38]
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [esi + 0x40]
push eax
call dword [sym.imp.MSVCP140.dll_public:_int___thiscall_std::codecvt_char__char__struct__Mbstatet_::unshift_struct__Mbstatet___char___char___char___const]
sub eax, 0
je 0x1000f2f5
sub eax, 1
je 0x1000f2f9
sub eax, 2
jne 0x1000f324
mov byte [esi + 0x3d], al
mov al, 1
pop edi
pop esi
mov esp, ebp
pop ebp
ret
mov byte [esi + 0x3d], 0
mov edi, dword [ebp - 4]
lea eax, [ebp - 0x24]
sub edi, eax
je 0x1000f317
push dword [esi + 0x4c]
push edi
push 1
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
add esp, 0x10
cmp edi, eax
jne 0x1000f324
cmp byte [esi + 0x3d], 0
pop edi
sete al
pop esi
mov esp, ebp
pop ebp
ret
pop edi
xor al, al
pop esi
mov esp, ebp
pop ebp
ret
mov al, 1
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x10010b50
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 8], 0
je 0x10010b72
xor eax, eax
nop dword [eax + eax]
lea edx, [esi + eax]
lea ecx, [eax - 0x24]
inc eax
xor byte [edx], cl
cmp eax, 7
jb 0x10010b60
mov byte [esi + 8], 0
mov eax, esi
pop esi
ret
Function at 0x10010b80
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
mov ebx, ecx
mov dword [ebp - 0x20], ebx
cmp byte [ebx + 0x136], 0
je 0x10010d29
movaps xmm5, xmmword [0x10196d20]
lea ecx, [ebx + 8]
movaps xmm6, xmmword [0x1019a5a0]
mov edx, 0xffffffe3
movups xmm4, xmmword [0x10196d40]
mov dword [ebp - 8], ecx
sub edx, ebx
push esi
mov ecx, 0xffffffe1
mov dword [ebp - 4], 0xffffffdc
sub ecx, ebx
mov dword [ebp - 0x14], edx
push edi
mov dword [ebp - 0xc], ecx
mov edi, 0xffffffe0
sub edi, ebx
mov esi, 0xffffffe2
sub esi, ebx
mov dword [ebp - 0x10], edi
mov ecx, 0xffffffd8
mov dword [ebp - 0x18], esi
sub ecx, ebx
xor eax, eax
sub dword [ebp - 4], ebx
mov ebx, dword [ebp - 8]
mov dword [ebp - 0x1c], ecx
nop word [eax + eax]
movd xmm0, eax
add ecx, ebx
pshufd xmm1, xmm0, 0
add edi, ebx
movd xmm0, dword [ebx - 8]
paddd xmm1, xmm6
punpcklbw xmm0, xmm0
add eax, 0x10
punpcklwd xmm0, xmm0
psrad xmm0, 0x18
movd xmm3, edi
xorps xmm1, xmm0
mov edi, dword [ebp - 0x10]
andps xmm1, xmm4
movd xmm0, ecx
mov ecx, dword [ebp - 4]
packuswb xmm1, xmm1
add ecx, ebx
packuswb xmm1, xmm1
movd dword [ebx - 8], xmm1
pshufd xmm1, xmm0, 0
movd xmm0, dword [ebx - 4]
paddd xmm1, xmm5
punpcklbw xmm0, xmm0
punpcklwd xmm0, xmm0
psrad xmm0, 0x18
xorps xmm1, xmm0
movd xmm0, ecx
andps xmm1, xmm4
lea ecx, [edx + ebx]
packuswb xmm1, xmm1
lea edx, [esi + ebx]
mov esi, dword [ebp - 0xc]
packuswb xmm1, xmm1
add esi, ebx
movd dword [ebx - 4], xmm1
pshufd xmm1, xmm0, 0
movd xmm0, dword [ebx]
paddd xmm1, xmm5
punpcklbw xmm0, xmm0
punpcklwd xmm0, xmm0
psrad xmm0, 0x18
movd xmm2, ecx
xorps xmm1, xmm0
mov ecx, dword [ebp - 0x1c]
andps xmm1, xmm4
movd xmm0, edx
mov edx, dword [ebp - 0x14]
punpckldq xmm3, xmm0
packuswb xmm1, xmm1
packuswb xmm1, xmm1
movd dword [ebx], xmm1
movd xmm0, dword [ebx + 4]
punpcklbw xmm0, xmm0
movd xmm1, esi
mov esi, dword [ebp - 0x18]
punpcklwd xmm0, xmm0
punpckldq xmm1, xmm2
punpckldq xmm3, xmm1
psrad xmm0, 0x18
xorps xmm3, xmm0
andps xmm3, xmm4
packuswb xmm3, xmm3
packuswb xmm3, xmm3
movd dword [ebx + 4], xmm3
add ebx, 0x10
cmp eax, 0x130
jb 0x10010c00
mov ebx, dword [ebp - 0x20]
pop edi
pop esi
cmp eax, 0x135
jae 0x10010d22
lea edx, [eax + ebx]
lea ecx, [eax - 0x24]
inc eax
xor byte [edx], cl
cmp eax, 0x135
jb 0x10010d12
mov byte [ebx + 0x136], 0
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10013350
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
mov ebx, ecx
mov dword [ebp - 0x20], ebx
cmp byte [ebx + 0x25], 0
je 0x100134e4
movaps xmm5, xmmword [0x10196d20]
lea ecx, [ebx + 8]
movaps xmm6, xmmword [0x1019a5a0]
mov edx, 0xffffffe3
movups xmm4, xmmword [0x10196d40]
mov dword [ebp - 8], ecx
sub edx, ebx
push esi
mov ecx, 0xffffffe1
mov dword [ebp - 4], 0xffffffdc
sub ecx, ebx
mov dword [ebp - 0x14], edx
push edi
mov dword [ebp - 0xc], ecx
mov edi, 0xffffffe0
sub edi, ebx
mov esi, 0xffffffe2
sub esi, ebx
mov dword [ebp - 0x10], edi
mov ecx, 0xffffffd8
mov dword [ebp - 0x18], esi
sub ecx, ebx
xor eax, eax
sub dword [ebp - 4], ebx
mov ebx, dword [ebp - 8]
mov dword [ebp - 0x1c], ecx
movd xmm0, eax
add ecx, ebx
pshufd xmm1, xmm0, 0
add edi, ebx
movd xmm0, dword [ebx - 8]
paddd xmm1, xmm6
punpcklbw xmm0, xmm0
add eax, 0x10
punpcklwd xmm0, xmm0
psrad xmm0, 0x18
movd xmm3, edi
xorps xmm1, xmm0
mov edi, dword [ebp - 0x10]
andps xmm1, xmm4
movd xmm0, ecx
mov ecx, dword [ebp - 4]
packuswb xmm1, xmm1
add ecx, ebx
packuswb xmm1, xmm1
movd dword [ebx - 8], xmm1
pshufd xmm1, xmm0, 0
movd xmm0, dword [ebx - 4]
paddd xmm1, xmm5
punpcklbw xmm0, xmm0
punpcklwd xmm0, xmm0
psrad xmm0, 0x18
xorps xmm1, xmm0
movd xmm0, ecx
andps xmm1, xmm4
lea ecx, [edx + ebx]
packuswb xmm1, xmm1
lea edx, [esi + ebx]
mov esi, dword [ebp - 0xc]
packuswb xmm1, xmm1
add esi, ebx
movd dword [ebx - 4], xmm1
pshufd xmm1, xmm0, 0
movd xmm0, dword [ebx]
paddd xmm1, xmm5
punpcklbw xmm0, xmm0
punpcklwd xmm0, xmm0
psrad xmm0, 0x18
movd xmm2, ecx
xorps xmm1, xmm0
mov ecx, dword [ebp - 0x1c]
andps xmm1, xmm4
movd xmm0, edx
mov edx, dword [ebp - 0x14]
punpckldq xmm3, xmm0
packuswb xmm1, xmm1
packuswb xmm1, xmm1
movd dword [ebx], xmm1
movd xmm0, dword [ebx + 4]
punpcklbw xmm0, xmm0
movd xmm1, esi
mov esi, dword [ebp - 0x18]
punpcklwd xmm0, xmm0
punpckldq xmm1, xmm2
punpckldq xmm3, xmm1
psrad xmm0, 0x18
xorps xmm3, xmm0
andps xmm3, xmm4
packuswb xmm3, xmm3
packuswb xmm3, xmm3
movd dword [ebx + 4], xmm3
add ebx, 0x10
cmp eax, 0x20
jb 0x100133c4
mov ebx, dword [ebp - 0x20]
pop edi
pop esi
cmp eax, 0x24
jae 0x100134e0
lea edx, [ebx + eax]
lea ecx, [eax - 0x24]
inc eax
xor byte [edx], cl
cmp eax, 0x24
jb 0x100134d2
mov byte [ebx + 0x25], 0
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x100134f0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
cmp byte [ecx + 0x31], 0
mov dword [ebp - 0x20], ecx
je 0x10013674
movaps xmm5, xmmword [0x10196d20]
mov eax, 0xffffffe1
movaps xmm6, xmmword [0x1019a5a0]
sub eax, ecx
movups xmm4, xmmword [0x10196d40]
mov dword [ebp - 0x10], eax
mov edx, 0xffffffe3
mov eax, 0xffffffd8
sub edx, ecx
sub eax, ecx
mov dword [ebp - 0x18], edx
mov dword [ebp - 8], eax
mov eax, 0xffffffdc
push ebx
push esi
sub eax, ecx
lea ebx, [ecx + 8]
push edi
mov dword [ebp - 0xc], eax
mov edi, 0xffffffe0
sub edi, ecx
mov esi, 0xffffffe2
sub esi, ecx
mov dword [ebp - 0x14], edi
mov eax, 0xfffffff8
mov dword [ebp - 0x1c], esi
sub eax, ecx
mov ecx, eax
lea eax, [ecx + ebx]
add edi, ebx
movd xmm0, eax
mov eax, dword [ebp - 8]
pshufd xmm1, xmm0, 0
add eax, ebx
movd xmm0, dword [ebx - 8]
paddd xmm1, xmm6
punpcklbw xmm0, xmm0
punpcklwd xmm0, xmm0
psrad xmm0, 0x18
movd xmm3, edi
xorps xmm1, xmm0
mov edi, dword [ebp - 0x14]
andps xmm1, xmm4
movd xmm0, eax
mov eax, dword [ebp - 0xc]
packuswb xmm1, xmm1
add eax, ebx
packuswb xmm1, xmm1
movd dword [ebx - 8], xmm1
pshufd xmm1, xmm0, 0
movd xmm0, dword [ebx - 4]
paddd xmm1, xmm5
punpcklbw xmm0, xmm0
punpcklwd xmm0, xmm0
psrad xmm0, 0x18
xorps xmm1, xmm0
movd xmm0, eax
andps xmm1, xmm4
lea eax, [edx + ebx]
packuswb xmm1, xmm1
lea edx, [esi + ebx]
mov esi, dword [ebp - 0x10]
packuswb xmm1, xmm1
add esi, ebx
movd dword [ebx - 4], xmm1
pshufd xmm1, xmm0, 0
movd xmm0, dword [ebx]
paddd xmm1, xmm5
punpcklbw xmm0, xmm0
punpcklwd xmm0, xmm0
psrad xmm0, 0x18
movd xmm2, eax
xorps xmm1, xmm0
movd xmm0, edx
andps xmm1, xmm4
punpckldq xmm3, xmm0
packuswb xmm1, xmm1
mov edx, dword [ebp - 0x18]
packuswb xmm1, xmm1
movd dword [ebx], xmm1
movd xmm0, dword [ebx + 4]
punpcklbw xmm0, xmm0
movd xmm1, esi
mov esi, dword [ebp - 0x1c]
punpcklwd xmm0, xmm0
punpckldq xmm1, xmm2
punpckldq xmm3, xmm1
psrad xmm0, 0x18
xorps xmm3, xmm0
andps xmm3, xmm4
packuswb xmm3, xmm3
packuswb xmm3, xmm3
movd dword [ebx + 4], xmm3
add ebx, 0x10
lea eax, [ecx + ebx]
cmp eax, 0x30
jb 0x10013563
mov ecx, dword [ebp - 0x20]
pop edi
pop esi
pop ebx
mov byte [ecx + 0x31], 0
mov esp, ebp
pop ebp
ret

Function at 0x10013680
Capabilities:
Encode data using xor

Disassembly:
push edi
mov edi, ecx
cmp byte [edi + 0xe], 0
je 0x100136f3
movups xmm4, xmmword [0x10196d40]
mov eax, 0xffffffdf
push esi
lea ecx, [eax - 1]
movd xmm2, eax
lea esi, [eax - 3]
movd xmm0, ecx
movd xmm3, esi
lea edx, [eax - 2]
punpckldq xmm3, xmm0
movd xmm0, dword [edi + eax + 0x21]
punpcklbw xmm0, xmm0
movd xmm1, edx
punpcklwd xmm0, xmm0
punpckldq xmm1, xmm2
punpckldq xmm3, xmm1
psrad xmm0, 0x18
xorps xmm3, xmm0
andps xmm3, xmm4
packuswb xmm3, xmm3
packuswb xmm3, xmm3
movd dword [edi + eax + 0x21], xmm3
add eax, 4
cmp eax, 0xffffffeb
jb 0x10013696
xor byte [edi + 0xc], 0xe8
pop esi
mov byte [edi + 0xe], 0
pop edi
ret
Function at 0x10015330
Capabilities:
Execute command

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1018b985
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x34
mov ecx, dword [ebp + 0x18]
mov eax, closesocket
sub eax, ecx
mov dword [ebp - 4], 0
cmp eax, 0x2d
jb 0x100154a7
cmp dword [ebp + 0x1c], 0xf
lea eax, [ebp + 8]
push ecx
cmova eax, dword [ebp + 8]
lea ecx, [ebp - 0x40]
push eax
push 0x2d
push 0x101983ac
lea eax, [ebp + 8]
push eax
push dword [ebp - 0x10]
call fcn.1000ca10
push 0x11
push 0x10198398
lea ecx, [ebp - 0x40]
mov byte [ebp - 4], 1
call fcn.100103d0
mov dword [ebp - 0x18], 0
xorps xmm0, xmm0
movups xmmword [ebp - 0x28], xmm0
mov dword [ebp - 0x14], 0
movups xmm0, xmmword [eax]
movups xmmword [ebp - 0x28], xmm0
movq xmm0, qword [eax + 0x10]
movq qword [ebp - 0x18], xmm0
mov dword [eax + 0x10], 0
mov dword [eax + 0x14], 0xf
mov byte [eax], 0
lea eax, [ebp - 0x28]
cmp dword [ebp - 0x14], 0xf
cmova eax, dword [ebp - 0x28]
push eax
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov ecx, dword [ebp - 0x14]
add esp, 4
cmp ecx, 0xf
jbe 0x10015417
mov edx, dword [ebp - 0x28]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x1001540d
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x1001544f
push ecx
push edx
call fcn.1013141d
add esp, 8
mov ecx, dword [ebp - 0x2c]
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0xf
mov byte [ebp - 0x28], 0
cmp ecx, 0xf
jbe 0x1001545f
mov edx, dword [ebp - 0x40]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x10015455
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x10015455
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push ecx
push edx
call fcn.1013141d
add esp, 8
xor ecx, ecx
int 0x29
mov ecx, dword [ebp + 0x1c]
cmp ecx, 0xf
jbe 0x10015499
mov edx, dword [ebp + 8]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x1001548f
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x1001548f
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push ecx
push edx
call fcn.1013141d
add esp, 8
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
call fcn.10005290
int3
Function at 0x10015d80
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1018ba67
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x30
push esi
push edi
push 0x10198474
mov dword [ebp - 0x14], 0
call dword [sym.imp.api_ms_win_crt_environment_l1_1_0.dll_getenv]
mov edx, eax
add esp, 4
test edx, edx
je 0x10015df8
mov esi, dword [ebp + 8]
mov ecx, edx
xorps xmm0, xmm0
movups xmmword [esi], xmm0
mov dword [esi + 0x10], 0
lea edi, [ecx + 1]
mov dword [esi + 0x14], 0
mov al, byte [ecx]
inc ecx
test al, al
jne 0x10015dd4
sub ecx, edi
push ecx
push edx
mov ecx, esi
call fcn.10003a40
pop edi
mov eax, esi
pop esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
xor eax, eax
mov dword [ebp - 4], 1
xorps xmm0, xmm0
mov dword [ebp - 0x2c], 0
push eax
movups xmmword [ebp - 0x3c], xmm0
push 0x104
lea ecx, [ebp - 0x3c]
mov dword [ebp - 0x28], 7
mov word [ebp - 0x3c], ax
mov dword [ebp - 0x14], 4
call fcn.10010530
nop
cmp dword [ebp - 0x28], 7
lea eax, [ebp - 0x3c]
mov ecx, dword [ebp - 0x2c]
cmova eax, dword [ebp - 0x3c]
push eax
push ecx
mov dword [ebp - 0x18], ecx
call fcn.10130e86
mov ecx, dword [ebp - 0x2c]
mov esi, eax
mov edi, edx
cmp esi, ecx
ja 0x10015e69
cmp dword [ebp - 0x28], 7
lea eax, [ebp - 0x3c]
mov dword [ebp - 0x2c], esi
cmova eax, dword [ebp - 0x3c]
xor ecx, ecx
mov word [eax + esi*2], cx
jmp 0x10015e78
mov eax, esi
sub eax, ecx
lea ecx, [ebp - 0x3c]
push 0
push eax
call fcn.10010530
cmp esi, dword [ebp - 0x18]
jae 0x10015e30
mov dword [ebp - 0x1c], edi
mov dword [ebp - 0x18], 0x1118e020
mov dword [ebp - 4], 0
mov dword [ebp - 0x14], 2
test edi, edi
jne 0x10015f0c
cmp dword [ebp - 0x28], 7
lea ecx, [ebp - 0xd]
push ecx
push dword [ebp - 0x2c]
lea eax, [ebp - 0x3c]
cmova eax, dword [ebp - 0x3c]
push eax
call fcn.10130c3b
mov esi, dword [ebp + 8]
push eax
push esi
call fcn.100069b0
mov ecx, dword [ebp - 0x28]
add esp, 0x14
cmp ecx, 7
jbe 0x10015efa
mov edx, dword [ebp - 0x3c]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x10015ef0
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x10015ef0
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push ecx
push edx
call fcn.1013141d
add esp, 8
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop edi
pop esi
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x1c]
push eax
push 0x10198f8c
call fcn.1000fea0
int3
Function at 0x10016000
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
mov eax, dword [ebp + 0xc]
push ebx
push edi
mov edi, dword [ebp + 8]
mov ecx, dword [eax + 0x3c]
add ecx, eax
mov dword [ebp - 8], 0
mov dword [ebp - 0xc], ecx
mov dword [edi], 0
mov dword [edi + 4], 0
movzx eax, word [ecx + 0x14]
lea ebx, [ecx + 0x18]
add ebx, eax
mov dword [edi + 8], 0
xor eax, eax
mov dword [ebp - 4], ebx
cmp ax, word [ecx + 6]
jae 0x1001613a
push esi
nop word [eax + eax]
mov eax, ebx
mov dword [ebp - 0x20], 0
xorps xmm0, xmm0
mov dword [ebp - 0x1c], 0
movups xmmword [ebp - 0x30], xmm0
lea edx, [eax + 1]
nop word [eax + eax]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x10016070
sub eax, edx
lea ecx, [ebp - 0x30]
push eax
push ebx
call fcn.10003a40
mov ecx, dword [ebp - 0x1c]
lea eax, [ebp - 0x30]
mov esi, dword [ebp - 0x30]
cmp ecx, 0xf
cmova eax, esi
cmp dword [ebp - 0x20], 5
jne 0x10016144
cmp dword [eax], 0x7865742e
jne 0x10016144
cmp byte [eax + 4], 0x74
jne 0x10016144
mov edi, dword [ebx + 0xc]
xor ecx, ecx
add edi, dword [ebp + 0xc]
xor edx, edx
mov dword [ebp - 0x18], ebx
mov ebx, dword [ebx + 8]
mov dword [ebp - 0x14], edi
test ebx, ebx
je 0x100160de
nop dword [eax]
movzx eax, byte [edi + edx]
inc edx
crc32 ecx, eax
cmp edx, ebx
jb 0x100160d0
mov edi, dword [ebp + 8]
movq xmm0, qword [ebp - 0x18]
movq qword [edi], xmm0
mov dword [edi + 8], ecx
mov ecx, dword [ebp - 0x1c]
cmp ecx, 0xf
jbe 0x1001611a
inc ecx
mov eax, esi
cmp ecx, 0x1000
jb 0x10016110
mov esi, dword [eax - 4]
add ecx, 0x23
sub eax, esi
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x10016170
push ecx
push esi
call fcn.1013141d
add esp, 8
mov ebx, dword [ebp - 4]
mov eax, dword [ebp - 0xc]
add ebx, 0x28
mov ecx, dword [ebp - 8]
inc ecx
mov dword [ebp - 4], ebx
mov dword [ebp - 8], ecx
movzx eax, word [eax + 6]
cmp ecx, eax
jl 0x10016050
pop esi
mov eax, edi
pop edi
pop ebx
mov esp, ebp
pop ebp
ret 8
cmp ecx, 0xf
jbe 0x1001611d
inc ecx
mov eax, esi
cmp ecx, 0x1000
jb 0x10016164
mov esi, dword [eax - 4]
add ecx, 0x23
sub eax, esi
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x10016170
push ecx
push esi
call fcn.1013141d
add esp, 8
jmp 0x1001611d
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
Function at 0x1001a480
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
push ebx
mov ebx, dword [ebp + 8]
push edi
mov edi, ecx
cmp ebx, 0xffffffff
jne 0x1001a49c
pop edi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret 4
push esi
call dword [sym.imp.MSVCP140.dll_protected:_char____thiscall_std::basic_streambuf_char__struct_std::char_traits_char__::pptr_void_const]
test eax, eax
je 0x1001a4d2
mov ecx, edi
call dword [sym.imp.MSVCP140.dll_protected:_char____thiscall_std::basic_streambuf_char__struct_std::char_traits_char__::epptr_void_const]
mov ecx, edi
mov esi, eax
call dword [sym.imp.MSVCP140.dll_protected:_char____thiscall_std::basic_streambuf_char__struct_std::char_traits_char__::pptr_void_const]
cmp eax, esi
jae 0x1001a4d2
mov ecx, edi
call dword [sym.imp.MSVCP140.dll_protected:_char____thiscall_std::basic_streambuf_char__struct_std::char_traits_char__::_Pninc_void_]
pop esi
pop edi
mov byte [eax], bl
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret 4
cmp dword [edi + 0x4c], 0
je 0x1001a5b1
mov ecx, edi
call dword [sym.imp.MSVCP140.dll_protected:_char____thiscall_std::basic_streambuf_char__struct_std::char_traits_char__::eback_void_const]
lea ecx, [edi + 0x3c]
cmp eax, ecx
jne 0x1001a4fb
push dword [edi + 0x54]
mov eax, dword [edi + 0x50]
mov ecx, edi
push eax
push eax
call dword [sym.imp.MSVCP140.dll_protected:_void___thiscall_std::basic_streambuf_char__struct_std::char_traits_char__::setg_char___char___char__]
mov ecx, dword [edi + 0x38]
test ecx, ecx
jne 0x1001a525
push dword [edi + 0x4c]
movsx eax, bl
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
add esp, 8
or ecx, 0xffffffff
cmp eax, ecx
cmove ebx, ecx
pop esi
pop edi
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret 4
lea eax, [ebp + 8]
mov byte [ebp - 4], bl
push eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 3]
push eax
lea eax, [ebp - 4]
push eax
lea eax, [edi + 0x40]
push eax
call dword [sym.imp.MSVCP140.dll_public:_int___thiscall_std::codecvt_char__char__struct__Mbstatet_::out_struct__Mbstatet___char_const___char_const___char_const____char___char___char___const]
sub eax, 0
je 0x1001a57a
sub eax, 1
je 0x1001a57a
sub eax, 2
jne 0x1001a5b1
push dword [edi + 0x4c]
push dword [ebp - 4]
call fcn.10008100
add esp, 8
or ecx, 0xffffffff
test al, al
cmove ebx, ecx
pop esi
pop edi
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret 4
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x28]
sub esi, eax
je 0x1001a598
push dword [edi + 0x4c]
push esi
push 1
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
add esp, 0x10
cmp esi, eax
jne 0x1001a5b1
lea ecx, [ebp - 4]
mov byte [edi + 0x3d], 1
or eax, 0xffffffff
cmp dword [ebp - 8], ecx
pop esi
pop edi
cmovne eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret 4
pop esi
pop edi
or eax, 0xffffffff
pop ebx
mov esp, ebp
pop ebp
ret 4