joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1009f210
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, ecx
push edi
cmp dword [esi], 0
jne 0x1009f253
mov edx, str.ERROR:
mov ecx, 0x100eec88
call fcn.100146d0
mov edx, str.Internal_error:_VCDiffDeltaFileWindow::DecodeWindow___called_before_VCDiffDeltaFileWindow::Init__
mov ecx, eax
call fcn.100146d0
push eax
call fcn.100195d0
add esp, 4
cmp byte [0x100efdbc], 0
je 0x1009f34a
jmp 0x1009f354
cmp byte [esi + 4], 0
jne 0x1009f2a6
mov edi, dword [ebp + 8]
push edi
call fcn.1009eb10
cmp eax, 0xfffffffe
je 0x1009f29a
cmp eax, 0xffffffff
je 0x1009f34a
mov eax, dword [esi]
mov ecx, dword [eax + 0x90]
call fcn.100a86c0
test al, al
jne 0x1009f2ef
mov edx, str.ERROR:
mov ecx, 0x100eec88
call fcn.100146d0
mov edx, str.Error_initializing_address_cache
jmp 0x1009f335
mov eax, 0xfffffffe
pop edi
pop esi
pop ecx
pop ebp
ret 4
cmp byte [esi + 0x24], 0
je 0x1009f2c5
mov edx, str.ERROR:
mov ecx, 0x100eec88
call fcn.100146d0
mov edx, str.Internal_error:_Resumed_decoding_of_a_delta_file_window_when_interleaved_format_is_not_being_used
jmp 0x1009f231
mov edi, dword [ebp + 8]
push dword [edi + 4]
push dword [edi + 8]
call fcn.1009d850
mov eax, dword [esi + 0x10]
mov ecx, dword [eax + 4]
add eax, 8
mov dword [esi + 0x44], eax
mov dword [esi + 0x48], ecx
mov eax, dword [eax]
mov dword [esi + 0x4c], eax
mov ax, word [esi + 0x50]
mov word [esi + 0x52], ax
push edi
mov ecx, esi
call fcn.1009ee70
cmp eax, 0xfffffffe
je 0x1009f311
cmp eax, 0xffffffff
je 0x1009f34a
mov ecx, esi
call fcn.1009e920
xor eax, eax
pop edi
pop esi
pop ecx
pop ebp
ret 4
cmp byte [esi + 0x24], 0
jne 0x1009f321
cmp dword [esi + 0x28], 0
jg 0x1009f29a
mov edx, str.ERROR:
mov ecx, 0x100eec88
call fcn.100146d0
mov edx, str.End_of_data_reached_while_decoding_VCDIFF_delta_file
mov ecx, eax
call fcn.100146d0
push eax
call fcn.100195d0
add esp, 4
call fcn.1009d630
pop edi
or eax, 0xffffffff
pop esi
pop ecx
pop ebp
ret 4
mov ecx, 0x100eec88
call fcn.1002bf20
push 1
call fcn.100b82c3
int3

Function at 0x1009f660
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, ecx
mov ecx, dword [esi + 4]
mov eax, dword [esi]
mov edx, dword [ecx]
push dword [eax + 4]
mov eax, dword [edx + 4]
call eax
test al, al
jne 0x1009f6ad
mov edx, str.ERROR:
mov ecx, 0x100eec88
call fcn.100146d0
mov edx, str.Internal_error:_Initialization_of_code_table_writer_failed
mov ecx, eax
call fcn.100146d0
push eax
call fcn.100195d0
add esp, 4
cmp byte [0x100efdbc], 0
jne 0x1009f6f1
xor al, al
pop esi
pop ebp
ret 4
mov eax, dword [esi]
mov ecx, dword [esi + 4]
push dword [eax + 4]
mov edx, dword [ecx]
push dword [eax]
mov eax, dword [edx + 0x24]
call eax
test al, al
jne 0x1009f6d8
mov edx, str.ERROR:
mov ecx, 0x100eec88
call fcn.100146d0
mov edx, str.Dictionary_not_valid_for_writer
jmp 0x1009f68d
mov ecx, dword [esi + 4]
push dword [esi + 8]
push dword [ebp + 8]
mov eax, dword [ecx]
call dword [eax + 8]
mov byte [esi + 0xd], 1
mov al, 1
pop esi
pop ebp
ret 4
mov ecx, 0x100eec88
call fcn.1002bf20
push 1
call fcn.100b82c3
int3
Function at 0x1009f710
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, ecx
push esi
push edi
cmp byte [ebx + 0xd], 0
jne 0x1009f758
mov edx, str.ERROR:
mov ecx, 0x100eec88
call fcn.100146d0
mov edx, str.EncodeChunk_called_before_StartEncoding
mov ecx, eax
call fcn.100146d0
push eax
call fcn.100195d0
add esp, 4
cmp byte [0x100efdbc], 0
jne 0x1009f7d8
xor al, al
pop edi
pop esi
pop ebx
pop ebp
ret 0xc
mov ecx, dword [ebx + 4]
mov esi, dword [ebp + 0xc]
mov edi, dword [ebp + 8]
push esi
mov eax, dword [ecx]
push edi
mov eax, dword [eax + 0x28]
call eax
test al, al
jne 0x1009f784
mov edx, str.ERROR:
mov ecx, 0x100eec88
call fcn.100146d0
mov edx, str.Target_chunk_not_valid_for_writer
jmp 0x1009f732
test byte [ebx + 8], 2
je 0x1009f7ab
mov esi, dword [ebx + 4]
xor ecx, ecx
push dword [ebp + 0xc]
mov edx, dword [ebp + 8]
mov edi, dword [esi]
call fcn.100a7d10
add esp, 4
mov ecx, esi
push eax
call dword [edi + 0x18]
mov esi, dword [ebp + 0xc]
mov edi, dword [ebp + 8]
cmp byte [ebx + 0xc], 0
mov eax, dword [ebx + 4]
mov ecx, dword [ebx]
push eax
push dword [ebp + 0x10]
push esi
push edi
je 0x1009f7ca
call fcn.100a9c10
mov al, 1
pop edi
pop esi
pop ebx
pop ebp
ret 0xc
call fcn.100a9de0
pop edi
pop esi
mov al, 1
pop ebx
pop ebp
ret 0xc
mov ecx, 0x100eec88
call fcn.1002bf20
push 1
call fcn.100b82c3
int3

Function at 0x1009f7f0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push ecx
cmp byte [ecx + 0xd], 0
jne 0x1009f82e
mov edx, str.ERROR:
mov ecx, 0x100eec88
call fcn.100146d0
mov edx, str.FinishEncoding_called_before_StartEncoding
mov ecx, eax
call fcn.100146d0
push eax
call fcn.100195d0
add esp, 4
cmp byte [0x100efdbc], 0
jne 0x1009f844
xor al, al
pop ecx
pop ebp
ret 4
push dword [ebp + 8]
mov byte [ecx + 0xd], 0
mov ecx, dword [ecx + 4]
mov eax, dword [ecx]
call dword [eax + 0x20]
mov al, 1
pop ecx
pop ebp
ret 4
mov ecx, 0x100eec88
call fcn.1002bf20
push 1
call fcn.100b82c3
int3
Function at 0x100a7f80
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, ecx
push edi
mov eax, dword [esi + 8]
test eax, eax
jne 0x100a7fc6
mov edx, str.ERROR:
mov ecx, 0x100eec88
call fcn.100146d0
mov edx, str.Internal_error:_GetNextInstruction___called_before_Init__
mov ecx, eax
call fcn.100146d0
push eax
call fcn.100195d0
add esp, 4
cmp byte [0x100efdbc], 0
je 0x100a808a
jmp 0x100a80c0
mov eax, dword [eax]
mov dword [esi + 0x10], eax
mov ax, word [esi + 0x14]
mov word [esi + 0x16], ax
mov ecx, pe_nt_image_headers32
cmp word [esi + 0x14], cx
jne 0x100a8021
mov ecx, dword [esi + 8]
mov eax, dword [ecx]
cmp eax, dword [esi + 0xc]
jae 0x100a809e
mov dl, byte [eax]
mov eax, dword [esi]
movzx edi, dl
cmp byte [edi + eax + 0x100], 0
je 0x100a8005
movsx ax, dl
mov word [esi + 0x14], ax
inc dword [ecx]
mov eax, dword [esi]
mov bl, byte [edi + eax]
movzx edx, byte [edi + eax + 0x200]
mov bh, byte [edi + eax + 0x400]
test bl, bl
jne 0x100a8043
jmp 0x100a7fd3
mov al, byte [esi + 0x14]
mov word [esi + 0x14], cx
movzx ecx, al
mov eax, dword [esi]
mov bl, byte [ecx + eax + 0x100]
movzx edx, byte [ecx + eax + 0x300]
mov bh, byte [ecx + eax + 0x500]
test edx, edx
jne 0x100a80ab
mov edx, dword [esi + 8]
mov ecx, dword [esi + 0xc]
call fcn.100ae9a0
mov ecx, dword [ebp + 8]
mov dword [ecx], eax
cmp eax, 0xfffffffe
je 0x100a8097
cmp eax, 0xffffffff
jne 0x100a80b0
mov edx, str.ERROR:
mov ecx, 0x100eec88
call fcn.100146d0
mov edx, str.Instruction_size_is_not_a_valid_variable_length_integer
mov ecx, eax
call fcn.100146d0
push eax
call fcn.100195d0
add esp, 4
call fcn.1009d630
mov eax, 4
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret 8
mov ecx, esi
call fcn.1009d650
mov eax, 5
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret 8
mov eax, dword [ebp + 8]
mov dword [eax], edx
mov eax, dword [ebp + 0xc]
pop edi
pop esi
mov byte [eax], bh
movzx eax, bl
pop ebx
pop ecx
pop ebp
ret 8
mov ecx, 0x100eec88
call fcn.1002bf20
push 1
call fcn.100b82c3
int3

Function at 0x100a80e0
Capabilities:
Terminate process

Disassembly:
push ecx
cmp ecx, 3
ja case.default.0x100a80e6
jmp dword [ecx*4 + 0x100a815c]
mov eax, str.NOOP
pop ecx
ret
mov eax, 0x10109290
pop ecx
ret
mov eax, 0x10109294
pop ecx
ret
mov eax, str.COPY
pop ecx
ret
push ecx
push ecx
mov edx, str.ERROR:
mov ecx, 0x100eec88
call fcn.100146d0
mov edx, str.Unexpected_instruction_type
mov ecx, eax
call fcn.100146d0
add esp, 4
mov ecx, eax
call fcn.1004fe30
push eax
call fcn.100195d0
add esp, 4
cmp byte [0x100efdbc], 0
jne 0x100a8149
mov eax, 0x100fcd8d
pop ecx
ret
mov ecx, 0x100eec88
call fcn.1002bf20
push 1
call fcn.100b82c3
mov edi, edi
in eax, dx
or byte [edx], 16
hlt
Function at 0x100a8170
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov bl, dl
mov esi, ecx
mov al, 1
push edi
mov edi, dword [ebp + 0x14]
cmp bl, 3
jbe 0x100a81f4
movzx eax, bl
mov edx, str.ERROR:
push eax
push ecx
push esi
push ecx
mov ecx, 0x100eec88
call fcn.100146d0
mov edx, str.VCDiff:_Bad_code_table__opcode
mov ecx, eax
call fcn.100146d0
add esp, 4
mov ecx, eax
call fcn.1004fe30
mov edx, str._has_invalid
mov ecx, eax
call fcn.100146d0
mov edx, edi
mov ecx, eax
call fcn.100146d0
mov edx, str._instruction_type
mov ecx, eax
call fcn.100146d0
add esp, 4
mov ecx, eax
call fcn.1004fe30
push eax
call fcn.100195d0
add esp, 4
cmp byte [0x100efdbc], 0
jne 0x100a8360
xor al, al
mov bh, byte [ebp + 0xc]
cmp bh, byte [ebp + 0x10]
jbe 0x100a826b
movzx eax, bh
mov edx, str.ERROR:
push eax
push ecx
push esi
push ecx
mov ecx, 0x100eec88
call fcn.100146d0
mov edx, str.VCDiff:_Bad_code_table__opcode
mov ecx, eax
call fcn.100146d0
add esp, 4
mov ecx, eax
call fcn.1004fe30
mov edx, str._has_invalid
mov ecx, eax
call fcn.100146d0
mov edx, edi
mov ecx, eax
call fcn.100146d0
mov edx, str._mode
mov ecx, eax
call fcn.100146d0
add esp, 4
mov ecx, eax
call fcn.1004fe30
push eax
call fcn.100195d0
add esp, 4
cmp byte [0x100efdbc], 0
jne 0x100a8371
xor al, al
test bl, bl
jne 0x100a82e6
mov cl, byte [ebp + 8]
test cl, cl
je 0x100a82eb
movzx eax, cl
mov edx, str.ERROR:
push eax
push ecx
push esi
push ecx
mov ecx, 0x100eec88
call fcn.100146d0
mov edx, str.VCDiff:_Bad_code_table__opcode
mov ecx, eax
call fcn.100146d0
add esp, 4
mov ecx, eax
call fcn.1004fe30
mov edx, str._has
mov ecx, eax
call fcn.100146d0
mov edx, edi
mov ecx, eax
call fcn.100146d0
mov edx, str._instruction_NOOP_with_nonzero_size
mov ecx, eax
call fcn.100146d0
add esp, 4
mov ecx, eax
call fcn.1004fe30
push eax
call fcn.100195d0
add esp, 4
cmp byte [0x100efdbc], bl
jne 0x100a8382
xor al, al
jmp 0x100a82eb
cmp bl, 3
je 0x100a835a
test bh, bh
je 0x100a835a
movzx eax, bh
mov edx, str.ERROR:
push eax
push ecx
push esi
push ecx
mov ecx, 0x100eec88
call fcn.100146d0
mov edx, str.VCDiff:_Bad_code_table__opcode
mov ecx, eax
call fcn.100146d0
add esp, 4
mov ecx, eax
call fcn.1004fe30
mov edx, str._has_non_COPY
mov ecx, eax
call fcn.100146d0
mov edx, edi
mov ecx, eax
call fcn.100146d0
mov edx, str._instruction_with_nonzero_mode
mov ecx, eax
call fcn.100146d0
add esp, 4
mov ecx, eax
call fcn.1004fe30
push eax
call fcn.100195d0
add esp, 4
cmp byte [0x100efdbc], 0
jne 0x100a8393
xor al, al
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret
mov ecx, 0x100eec88
call fcn.1002bf20
push 1
call fcn.100b82c3
mov ecx, 0x100eec88
call fcn.1002bf20
push 1
call fcn.100b82c3
mov ecx, 0x100eec88
call fcn.1002bf20
push 1
call fcn.100b82c3
mov ecx, 0x100eec88
call fcn.1002bf20
push 1
call fcn.100b82c3
int3
Function at 0x100a83b0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x118
mov edx, dword [ebp + 8]
xor eax, eax
push ebx
push esi
push edi
movzx edi, dl
mov bl, 1
add edi, 4
mov dword [ebp - 4], edi
test edi, edi
jle 0x100a83e8
cmp eax, 0x103
jae 0x100a857d
mov byte [ebp + eax - 0x118], 0
inc eax
cmp eax, edi
jl 0x100a83d0
mov eax, 0xfffffe00
lea esi, [ecx + 0x200]
sub eax, ecx
mov dword [ebp - 8], eax
jmp 0x100a8400
lea ecx, [eax + esi]
movzx eax, byte [esi + 0x200]
push str.first
push edx
mov dl, byte [esi - 0x200]
push eax
movzx eax, byte [esi]
push eax
mov dword [ebp - 0xc], ecx
call fcn.100a8170
add esp, 0x10
test al, al
je 0x100a8432
test bl, bl
je 0x100a8432
mov bl, 1
jmp 0x100a8434
xor bl, bl
movzx eax, byte [esi + 0x300]
mov dl, byte [esi - 0x100]
mov ecx, dword [ebp - 0xc]
push str.second
push dword [ebp + 8]
push eax
movzx eax, byte [esi + 0x100]
push eax
call fcn.100a8170
add esp, 0x10
test al, al
je 0x100a8469
test bl, bl
je 0x100a8469
mov bl, 1
jmp 0x100a846b
xor bl, bl
cmp byte [esi], 0
jne 0x100a8495
cmp byte [esi - 0x100], 0
jne 0x100a8495
movzx ecx, byte [esi + 0x200]
movzx eax, byte [esi - 0x200]
add eax, ecx
cmp eax, edi
jge 0x100a8495
mov byte [ebp + eax - 0x118], 1
mov eax, dword [ebp - 8]
inc esi
mov edx, dword [ebp + 8]
add eax, esi
cmp eax, 0x100
mov eax, dword [ebp - 8]
jl 0x100a8400
mov esi, dword [ebp - 4]
xor edi, edi
test esi, esi
jle 0x100a8572
lea esp, [esp]
test edi, edi
je 0x100a8569
cmp byte [ebp + edi - 0x118], 0
jne 0x100a8569
cmp edi, 3
jl 0x100a8519
lea eax, [edi - 3]
mov edx, str.ERROR:
push eax
push ecx
mov ecx, 0x100eec88
call fcn.100146d0
mov edx, str.VCDiff:_Bad_code_table__there_is_no_opcode_for_inst_COPY__size_0__mode
mov ecx, eax
call fcn.100146d0
add esp, 4
mov ecx, eax
call fcn.1004fe30
push eax
call fcn.100195d0
add esp, 4
cmp byte [0x100efdbc], 0
je 0x100a8567
jmp 0x100a8582
mov ecx, edi
call fcn.100a80e0
mov edx, str.ERROR:
mov ecx, 0x100eec88
mov esi, eax
call fcn.100146d0
mov edx, str.VCDiff:_Bad_code_table__there_is_no_opcode_for_inst
mov ecx, eax
call fcn.100146d0
mov edx, esi
mov ecx, eax
call fcn.100146d0
mov edx, str.__size_0___mode_0
mov ecx, eax
call fcn.100146d0
push eax
call fcn.100195d0
add esp, 4
cmp byte [0x100efdbc], 0
jne 0x100a8582
mov esi, dword [ebp - 4]
xor bl, bl
inc edi
cmp edi, esi
jl 0x100a84c0
pop edi
pop esi
mov al, bl
pop ebx
mov esp, ebp
pop ebp
ret 4
call fcn.100b7ae3
mov ecx, 0x100eec88
call fcn.1002bf20
push 1
call fcn.100b82c3
int3
Function at 0x100a86c0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 8
push esi
mov esi, ecx
push edi
mov edx, dword [esi]
cmp edx, 0xfe
jg 0x100a882d
test edx, edx
js 0x100a882d
mov ecx, dword [esi + 4]
cmp ecx, 0xfe
jg 0x100a87e2
test ecx, ecx
js 0x100a87e2
lea eax, [ecx + edx]
cmp eax, 0xfe
jle 0x100a8781
push pe_nt_image_headers32
push ecx
push ecx
push ecx
push edx
push ecx
mov edx, str.ERROR:
mov ecx, 0x100eec88
call fcn.100146d0
mov edx, str.Using_near_cache_size
mov ecx, eax
call fcn.100146d0
add esp, 4
mov ecx, eax
call fcn.1004fe30
mov edx, str._and_same_cache_size
mov ecx, eax
call fcn.100146d0
add esp, 4
mov ecx, eax
call fcn.1004fe30
mov edx, str._would_exceed_maximum_number_of_COPY_modes__
mov ecx, eax
call fcn.100146d0
add esp, 4
mov ecx, eax
call fcn.1004fe30
mov edx, 0x100fcbfc
mov ecx, eax
call fcn.100146d0
push eax
call fcn.100195d0
add esp, 4
call fcn.1009d630
xor al, al
pop edi
pop esi
mov esp, ebp
pop ebp
ret
test edx, edx
jle 0x100a87a7
mov eax, dword [esi + 0xc]
lea edi, [esp + 8]
push edi
lea ecx, [esi + 0xc]
mov dword [esp + 0xc], 0
mov dword [ecx + 4], eax
push edx
push eax
lea eax, [esp + 0x18]
push eax
call fcn.100a8cd0
mov edx, dword [esi + 4]
test edx, edx
jle 0x100a87d3
mov eax, dword [esi + 0x18]
lea edi, [esp + 8]
push edi
shl edx, 8
lea ecx, [esi + 0x18]
push edx
push eax
mov dword [ecx + 4], eax
lea eax, [esp + 0x18]
push eax
mov dword [esp + 0x18], 0
call fcn.100a8cd0
pop edi
mov dword [esi + 8], 0
mov al, 1
pop esi
mov esp, ebp
pop ebp
ret
push ecx
push ecx
mov edx, str.ERROR:
mov ecx, 0x100eec88
call fcn.100146d0
mov edx, str.Same_cache_size
mov ecx, eax
call fcn.100146d0
add esp, 4
mov ecx, eax
call fcn.1004fe30
mov edx, str._is_invalid
mov ecx, eax
call fcn.100146d0
push eax
call fcn.100195d0
add esp, 4
cmp byte [0x100efdbc], 0
je 0x100a8779
jmp 0x100a8845
push edx
push ecx
mov edx, str.ERROR:
mov ecx, 0x100eec88
call fcn.100146d0
mov edx, str.Near_cache_size
jmp 0x100a87f8
mov ecx, 0x100eec88
call fcn.1002bf20
push 1
call fcn.100b82c3
int3
Function at 0x100a88a0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, ecx
mov dword [ebp - 4], edi
test esi, esi
jns 0x100a8906
push esi
push ecx
mov edx, str.ERROR:
mov ecx, 0x100eec88
call fcn.100146d0
mov edx, str.EncodeAddress_was_passed_a_negative_address:
mov ecx, eax
call fcn.100146d0
add esp, 4
mov ecx, eax
call fcn.1004fe30
push eax
call fcn.100195d0
add esp, 4
cmp byte [0x100efdbc], 0
jne 0x100a8a35
mov eax, dword [ebp + 0x10]
mov dword [eax], 0
xor al, al
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov ecx, dword [ebp + 0xc]
cmp esi, ecx
jl 0x100a895a
push ecx
push ecx
push esi
push ecx
mov edx, str.ERROR:
mov ecx, 0x100eec88
call fcn.100146d0
mov edx, str.EncodeAddress_was_called_with_address__
mov ecx, eax
call fcn.100146d0
add esp, 4
mov ecx, eax
call fcn.1004fe30
mov edx, str.____here_address__
mov ecx, eax
call fcn.100146d0
add esp, 4
mov ecx, eax
call fcn.1004fe30
mov edx, 0x100fcbfc
mov ecx, eax
call fcn.100146d0
jmp 0x100a88dc
mov ebx, dword [edi + 4]
test ebx, ebx
jle 0x100a89b0
shl ebx, 8
mov eax, esi
cdq
idiv ebx
mov eax, dword [edi + 0x18]
mov ebx, edx
cmp dword [eax + ebx*4], esi
jne 0x100a89b0
push esi
mov ecx, edi
call fcn.100a8860
mov ecx, ebx
and ecx, 0x800000ff
jns 0x100a898d
dec ecx
or ecx, 0xffffff00
inc ecx
mov eax, dword [ebp + 0x10]
mov dword [eax], ecx
mov eax, ebx
mov cl, byte [edi]
cdq
add cl, 2
and edx, 0xff
add eax, edx
sar eax, 8
add eax, ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
sub ecx, esi
mov dword [ebp + 8], esi
xor bl, bl
cmp ecx, esi
jge 0x100a89c0
mov bl, 1
mov dword [ebp + 8], ecx
mov eax, dword [edi]
xor ecx, ecx
mov dword [ebp + 0xc], eax
test eax, eax
jle 0x100a8a0d
mov eax, dword [edi + 0xc]
mov edx, eax
mov edi, dword [ebp + 8]
mov dword [ebp - 8], eax
mov eax, esi
sub eax, dword [edx]
js 0x100a89e5
cmp eax, edi
jge 0x100a89e5
lea ebx, [ecx + 2]
mov edi, eax
mov eax, dword [ebp + 0xc]
inc ecx
add edx, 4
cmp ecx, eax
jl 0x100a89d6
mov dword [ebp + 8], edi
mov edi, dword [ebp - 4]
test eax, eax
jle 0x100a8a0d
mov eax, dword [edi + 8]
mov ecx, dword [ebp - 8]
mov dword [ecx + eax*4], esi
mov eax, dword [edi + 8]
inc eax
cdq
idiv dword [edi]
mov dword [edi + 8], edx
mov ecx, dword [edi + 4]
test ecx, ecx
jle 0x100a8a22
mov eax, esi
shl ecx, 8
cdq
idiv ecx
mov ecx, dword [edi + 0x18]
mov dword [ecx + edx*4], esi
mov ecx, dword [ebp + 0x10]
mov eax, dword [ebp + 8]
pop edi
pop esi
mov dword [ecx], eax
mov al, bl
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov ecx, 0x100eec88
call fcn.1002bf20
push 1
call fcn.100b82c3
int3
Function at 0x100a8a50
Capabilities:
Terminate process

Disassembly:
push ecx
test ecx, ecx
jns 0x100a8a9e
push ecx
push ecx
mov edx, str.ERROR:
mov ecx, 0x100eec88
call fcn.100146d0
mov edx, str.Decoded_address
mov ecx, eax
call fcn.100146d0
add esp, 4
mov ecx, eax
call fcn.1004fe30
mov edx, str._is_invalid
mov ecx, eax
call fcn.100146d0
push eax
call fcn.100195d0
add esp, 4
cmp byte [0x100efdbc], 0
jne 0x100a8aec
xor al, al
pop ecx
ret
cmp ecx, edx
jl 0x100a8ae8
push edx
push ecx
push ecx
push ecx
mov edx, str.ERROR:
mov ecx, 0x100eec88
call fcn.100146d0
mov edx, str.Decoded_address__
mov ecx, eax
call fcn.100146d0
add esp, 4
mov ecx, eax
call fcn.1004fe30
mov edx, str.__is_beyond_location_in_target_file__
mov ecx, eax
call fcn.100146d0
add esp, 4
mov ecx, eax
call fcn.1004fe30
mov edx, 0x100fcbfc
jmp 0x100a8a81
mov al, 1
pop ecx
ret
mov ecx, 0x100eec88
call fcn.1002bf20
push 1
call fcn.100b82c3
int3
Function at 0x100a8b00
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [ebp + 8]
push ebx
push esi
mov esi, ecx
mov dword [ebp - 4], esi
push edi
test eax, eax
jns 0x100a8b57
push eax
push ecx
mov edx, str.ERROR:
mov ecx, 0x100eec88
call fcn.100146d0
mov edx, str.DecodeAddress_was_passed_a_negative_value_for_here_address:
mov ecx, eax
call fcn.100146d0
add esp, 4
mov ecx, eax
call fcn.1004fe30
push eax
call fcn.100195d0
add esp, 4
cmp byte [0x100efdbc], 0
je 0x100a8c9b
jmp 0x100a8cb5
mov edi, dword [ebp + 0x10]
mov ecx, dword [ebp + 0x14]
mov edi, dword [edi]
mov dword [ebp - 8], edi
cmp edi, ecx
jae 0x100a8ca7
mov dl, byte [esi]
mov bl, byte [ebp + 0xc]
mov bh, dl
add bh, 2
cmp bl, bh
jb 0x100a8ba1
mov al, byte [esi + 4]
inc al
add al, dl
cmp bl, al
ja 0x100a8ba1
mov cl, byte [edi]
inc edi
movzx eax, bh
movzx edx, bl
mov ebx, dword [ebp - 4]
sub edx, eax
movzx eax, cl
shl edx, 8
add edx, eax
mov eax, dword [esi + 0x18]
mov esi, dword [eax + edx*4]
jmp 0x100a8bf7
lea edx, [ebp - 8]
call fcn.100ae9a0
mov esi, eax
cmp esi, 0xfffffffe
je 0x100a8ca7
cmp esi, 0xffffffff
je 0x100a8c72
test bl, bl
jne 0x100a8bc6
mov ebx, dword [ebp - 4]
jmp 0x100a8bf4
cmp bl, 1
jne 0x100a8bdc
mov edx, dword [ebp + 8]
mov eax, edx
mov edi, dword [ebp - 8]
sub eax, esi
mov ebx, dword [ebp - 4]
mov esi, eax
jmp 0x100a8bfa
cmp bl, 2
jb 0x100a8c21
cmp bl, bh
jae 0x100a8c21
movzx ecx, bl
mov ebx, dword [ebp - 4]
mov eax, dword [ebx + 0xc]
mov eax, dword [eax + ecx*4 - 8]
add esi, eax
mov edi, dword [ebp - 8]
mov edx, dword [ebp + 8]
mov ecx, esi
call fcn.100a8a50
test al, al
je 0x100a8c9b
mov eax, dword [ebp + 0x10]
mov ecx, ebx
push esi
mov dword [eax], edi
call fcn.100a8860
mov eax, esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
mov ecx, dword [ebp - 4]
mov edx, str.ERROR:
mov eax, dword [ecx + 4]
inc al
add al, byte [ecx]
movzx eax, al
push eax
push ecx
movzx eax, bl
push eax
push ecx
mov ecx, 0x100eec88
call fcn.100146d0
mov edx, str.Invalid_mode_value__
mov ecx, eax
call fcn.100146d0
add esp, 4
mov ecx, eax
call fcn.1004fe30
mov edx, str.__passed_to_DecodeAddress__maximum_mode_value_
mov ecx, eax
call fcn.100146d0
add esp, 4
mov ecx, eax
call fcn.1004fe30
jmp 0x100a8c8d
mov edx, str.ERROR:
mov ecx, 0x100eec88
call fcn.100146d0
mov edx, str.Found_invalid_variable_length_integer_as_encoded_address_value
mov ecx, eax
call fcn.100146d0
push eax
call fcn.100195d0
add esp, 4
call fcn.1009d630
or eax, 0xffffffff
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
pop edi
pop esi
mov eax, 0xfffffffe
pop ebx
mov esp, ebp
pop ebp
ret 0x10
mov ecx, 0x100eec88
call fcn.1002bf20
push 1
call fcn.100b82c3
int3
Function at 0x100a8ff0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, ecx
mov ecx, dword [ebp + 8]
mov eax, dword [esi + 4]
mov edx, dword [esi + 8]
sub eax, edx
cmp ecx, eax
jbe 0x100a9061
push eax
push ecx
push ecx
push ecx
mov edx, str.ERROR:
mov ecx, 0x100eec88
call fcn.100146d0
mov edx, str.Internal_error:_position_advanced_by
mov ecx, eax
call fcn.100146d0
add esp, 4
mov ecx, eax
call fcn.10011a20
mov edx, str._bytes__current_unparsed_size
mov ecx, eax
call fcn.100146d0
add esp, 4
mov ecx, eax
call fcn.10011a20
push eax
call fcn.100195d0
add esp, 4
cmp byte [0x100efdbc], 0
jne 0x100a906c
mov eax, dword [esi + 4]
mov dword [esi + 8], eax
pop esi
pop ebp
ret 4
lea eax, [edx + ecx]
mov dword [esi + 8], eax
pop esi
pop ebp
ret 4
mov ecx, 0x100eec88
call fcn.1002bf20
push 1
call fcn.100b82c3
int3

Function at 0x100a9080
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, ecx
push edi
mov edi, dword [ebp + 8]
mov ebx, dword [esi]
cmp edi, ebx
jae 0x100a90e8
mov edx, str.ERROR:
mov ecx, 0x100eec88
call fcn.100146d0
mov edx, str.Internal_error:_new_data_position
mov ecx, eax
call fcn.100146d0
mov edx, edi
mov ecx, eax
call fcn.100146d0
mov edx, str._is_beyond_start_of_data
mov ecx, eax
call fcn.100146d0
mov edx, ebx
mov ecx, eax
call fcn.100146d0
push eax
call fcn.100195d0
add esp, 4
cmp byte [0x100efdbc], 0
jne 0x100a9151
mov eax, dword [esi]
mov dword [esi + 8], eax
pop edi
pop esi
pop ebx
pop ebp
ret 4
mov ebx, dword [esi + 4]
cmp edi, ebx
jbe 0x100a9147
mov edx, str.ERROR:
mov ecx, 0x100eec88
call fcn.100146d0
mov edx, str.Internal_error:_new_data_position
mov ecx, eax
call fcn.100146d0
mov edx, edi
mov ecx, eax
call fcn.100146d0
mov edx, str._is_beyond_end_of_data
mov ecx, eax
call fcn.100146d0
mov edx, ebx
mov ecx, eax
call fcn.100146d0
push eax
call fcn.100195d0
add esp, 4
cmp byte [0x100efdbc], 0
jne 0x100a9162
mov eax, dword [esi + 4]
mov dword [esi + 8], eax
pop edi
pop esi
pop ebx
pop ebp
ret 4
mov dword [esi + 8], edi
pop edi
pop esi
pop ebx
pop ebp
ret 4
mov ecx, 0x100eec88
call fcn.1002bf20
push 1
call fcn.100b82c3
mov ecx, 0x100eec88
call fcn.1002bf20
push 1
call fcn.100b82c3
int3

Function at 0x100a9180
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 8]
push esi
mov esi, ecx
mov eax, dword [esi + 4]
mov ecx, eax
sub ecx, dword [esi + 8]
cmp edx, ecx
jbe 0x100a91f1
push ecx
push ecx
push edx
push ecx
mov edx, str.ERROR:
mov ecx, 0x100eec88
call fcn.100146d0
mov edx, str.Internal_error:_specified_number_of_remaining_bytes
mov ecx, eax
call fcn.100146d0
add esp, 4
mov ecx, eax
call fcn.10011a20
mov edx, str._is_greater_than_unparsed_data_size
mov ecx, eax
call fcn.100146d0
add esp, 4
mov ecx, eax
call fcn.10011a20
push eax
call fcn.100195d0
add esp, 4
cmp byte [0x100efdbc], 0
jne 0x100a91fb
mov eax, dword [esi + 4]
mov dword [esi + 8], eax
pop esi
pop ebp
ret 4
sub eax, edx
mov dword [esi + 8], eax
pop esi
pop ebp
ret 4
mov ecx, 0x100eec88
call fcn.1002bf20
push 1
call fcn.100b82c3
int3