joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100bd4e0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
mov esi, edi
mov dword [ebp - 8], ecx
cmp dword [edi + 0x14], 8
mov ebx, dword [edi + 0x10]
jb 0x100bd4fc
mov esi, dword [edi]
lea edi, [ebx + ebx]
xor ecx, ecx
mov edx, 0x811c9dc5
test edi, edi
je 0x100bd521
nop word [eax + eax]
movzx eax, byte [ecx + esi]
inc ecx
xor eax, edx
imul edx, eax, 0x1000193
cmp ecx, edi
jb 0x100bd510
mov esi, dword [ebp - 8]
mov eax, dword [esi + 0x18]
and eax, edx
mov edx, dword [esi + 0xc]
mov esi, dword [esi + 4]
mov dword [ebp - 4], esi
mov ecx, dword [edx + eax*8]
add eax, eax
mov edi, dword [edx + eax*4]
inc eax
mov dword [ebp - 0xc], edi
lea eax, [edx + eax*4]
mov dword [ebp - 0x10], eax
cmp edi, esi
jne 0x100bd54c
mov eax, esi
jmp 0x100bd550
mov eax, dword [eax]
mov eax, dword [eax]
cmp ecx, eax
je 0x100bd5f7
mov esi, dword [ebp + 0xc]
mov edx, esi
cmp dword [esi + 0x14], 8
jb 0x100bd565
mov edx, dword [esi]
mov esi, dword [ecx + 0x1c]
lea edi, [ecx + 8]
mov dword [ebp - 0x18], esi
cmp esi, 8
jb 0x100bd576
mov edi, dword [ecx + 8]
mov eax, dword [ecx + 0x18]
mov dword [ebp - 0x14], eax
cmp eax, ebx
jne 0x100bd5de
mov esi, eax
test eax, eax
je 0x100bd5a4
sub edi, edx
nop dword [eax + eax]
mov ax, word [edi + edx]
cmp ax, word [edx]
jne 0x100bd5de
add edx, 2
sub esi, 1
jne 0x100bd590
mov eax, dword [ebp - 0x14]
cmp dword [ebp - 0x18], 8
lea edx, [ecx + 8]
jb 0x100bd5af
mov edx, dword [edx]
mov edi, dword [ebp + 0xc]
mov esi, edi
cmp dword [edi + 0x14], 8
jb 0x100bd5bc
mov esi, dword [edi]
cmp ebx, eax
jne 0x100bd5ee
test ebx, ebx
je 0x100bd5d7
sub esi, edx
mov ax, word [esi + edx]
cmp ax, word [edx]
jne 0x100bd5ee
add edx, 2
sub ebx, 1
jne 0x100bd5c6
mov esi, dword [ebp - 4]
mov eax, ecx
jmp 0x100bd5fe
mov ecx, dword [ecx]
mov esi, dword [ebp - 4]
mov edi, dword [ebp - 0xc]
mov eax, dword [ebp - 0x10]
jmp 0x100bd544
mov esi, dword [ebp - 4]
mov ecx, esi
mov eax, ecx
jmp 0x100bd5fe
mov edi, dword [ebp + 0xc]
mov ecx, esi
mov eax, esi
cmp eax, esi
jne 0x100bd654
mov esi, dword [esi]
lea eax, [ebp + 0xc]
push ecx
push eax
push ecx
mov dword [ebp + 0xc], edi
mov edi, dword [esi + 4]
push edi
push esi
call fcn.100c2680
mov ebx, dword [ebp - 8]
mov edx, eax
mov ecx, 0x5d1745c
mov eax, dword [ebx + 8]
sub ecx, eax
cmp ecx, 1
jb 0x100bd666
inc eax
mov ecx, ebx
mov dword [ebx + 8], eax
mov dword [esi + 4], edx
mov esi, dword [ebp + 8]
mov dword [edi], edx
mov eax, dword [ebx + 4]
mov eax, dword [eax]
push eax
add eax, 8
push eax
push esi
call fcn.100c0f60
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
mov eax, dword [ebp + 8]
pop edi
pop esi
pop ebx
mov dword [eax], ecx
mov byte [eax + 4], 0
mov esp, ebp
pop ebp
ret 8
push str.list_T__too_long
call fcn.100cb1d2
int3
Function at 0x100c1b80
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
mov dword [ebp - 4], ecx
cmp dword [edi + 0x1c], 8
lea esi, [edi + 8]
mov ebx, dword [edi + 0x18]
jb 0x100c1b9c
mov esi, dword [edi + 8]
xor ecx, ecx
mov edx, 0x811c9dc5
add ebx, ebx
je 0x100c1bb8
movzx eax, byte [ecx + esi]
inc ecx
xor eax, edx
imul edx, eax, 0x1000193
cmp ecx, ebx
jb 0x100c1ba7
mov ebx, dword [ebp - 4]
mov eax, dword [ebx + 0x18]
mov ecx, dword [ebx + 0xc]
and eax, edx
lea edx, [eax*8]
mov eax, dword [ecx + edx]
add ecx, edx
cmp dword [ecx + 4], edi
jne 0x100c1bf1
cmp eax, edi
jne 0x100c1be9
mov eax, dword [ebx + 4]
mov dword [ecx], eax
mov ecx, dword [ebx + 0xc]
mov eax, dword [ebx + 4]
mov dword [edx + ecx + 4], eax
jmp 0x100c1bf9
mov eax, dword [edi + 4]
mov dword [ecx + 4], eax
jmp 0x100c1bf9
cmp eax, edi
jne 0x100c1bf9
mov eax, dword [edi]
mov dword [ecx], eax
mov eax, dword [edi + 4]
lea ecx, [edi + 0x20]
mov esi, dword [edi]
mov dword [eax], esi
mov edx, dword [edi]
mov eax, dword [edi + 4]
mov dword [edx + 4], eax
dec dword [ebx + 8]
call fcn.10043ac0
lea ecx, [edi + 8]
call fcn.10043ac0
push 0x38
push edi
call fcn.100e2b31
mov eax, dword [ebp + 8]
add esp, 8
pop edi
mov dword [eax], esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x100c1ca0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 0xc]
cmp dword [eax + 0x1c], 8
push ebx
mov ebx, dword [eax + 0x18]
push esi
lea esi, [eax + 8]
mov dword [ebp - 4], ecx
jb 0x100c1cba
mov esi, dword [esi]
xor edx, edx
push edi
mov edi, 0x811c9dc5
add ebx, ebx
je 0x100c1cd7
movzx ecx, byte [edx + esi]
inc edx
xor ecx, edi
imul edi, ecx, 0x1000193
cmp edx, ebx
jb 0x100c1cc6
mov ebx, dword [ebp - 4]
mov ecx, dword [ebx + 0x18]
mov edx, dword [ebx + 0xc]
and ecx, edi
pop edi
lea esi, [ecx*8]
mov ecx, dword [edx + esi]
add edx, esi
cmp dword [edx + 4], eax
jne 0x100c1d11
cmp ecx, eax
jne 0x100c1d09
mov ecx, dword [ebx + 4]
mov dword [edx], ecx
mov edx, dword [ebx + 0xc]
mov ecx, dword [ebx + 4]
mov dword [esi + edx + 4], ecx
jmp 0x100c1d19
mov ecx, dword [eax + 4]
mov dword [edx + 4], ecx
jmp 0x100c1d19
cmp ecx, eax
jne 0x100c1d19
mov ecx, dword [eax]
mov dword [edx], ecx
mov esi, dword [ebp + 8]
lea ecx, [ebx + 4]
push eax
push esi
call fcn.100c1270
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x100c25c0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
mov dword [ebp - 4], ecx
cmp dword [edi + 0x1c], 8
lea esi, [edi + 8]
mov ebx, dword [edi + 0x18]
jb 0x100c25dc
mov esi, dword [edi + 8]
xor ecx, ecx
mov edx, 0x811c9dc5
add ebx, ebx
je 0x100c25f8
movzx eax, byte [ecx + esi]
inc ecx
xor eax, edx
imul edx, eax, 0x1000193
cmp ecx, ebx
jb 0x100c25e7
mov ebx, dword [ebp - 4]
mov eax, dword [ebx + 0x18]
mov ecx, dword [ebx + 0xc]
and eax, edx
lea edx, [eax*8]
mov eax, dword [ecx + edx]
add ecx, edx
cmp dword [ecx + 4], edi
jne 0x100c2631
cmp eax, edi
jne 0x100c2629
mov eax, dword [ebx + 4]
mov dword [ecx], eax
mov ecx, dword [ebx + 0xc]
mov eax, dword [ebx + 4]
mov dword [edx + ecx + 4], eax
jmp 0x100c2639
mov eax, dword [edi + 4]
mov dword [ecx + 4], eax
jmp 0x100c2639
cmp eax, edi
jne 0x100c2639
mov eax, dword [edi]
mov dword [ecx], eax
mov eax, dword [edi + 4]
lea ecx, [edi + 0x20]
mov esi, dword [edi]
mov dword [eax], esi
mov edx, dword [edi]
mov eax, dword [edi + 4]
mov dword [edx + 4], eax
dec dword [ebx + 8]
call fcn.1006e710
lea ecx, [edi + 8]
call fcn.10043ac0
push 0x2c
push edi
call fcn.100e2b31
mov eax, dword [ebp + 8]
add esp, 8
pop edi
mov dword [eax], esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x100c29c0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 0x10]
xor ecx, ecx
test esi, esi
je 0x100c29eb
mov edx, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0xc]
movzx eax, byte [ecx + edi]
inc ecx
xor eax, edx
imul edx, eax, 0x1000193
cmp ecx, esi
jb 0x100c29d4
pop edi
mov eax, edx
pop esi
pop ebp
ret
mov eax, dword [ebp + 8]
pop esi
pop ebp
ret
Function at 0x100c2a00
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
lea ebx, [ecx + eax*8]
mov eax, dword [ebx]
lea ecx, [eax + eax*8]
mov eax, dword [ebx + 4]
lea edi, [eax + ecx*4]
movzx ecx, byte [edx]
movzx eax, byte [edx + 1]
shl ecx, 8
or ecx, eax
mov dword [edi + 0x10], ecx
sub ecx, 1
je 0x100c2ab7
sub ecx, 1
jne 0x100c2b22
movzx eax, byte [edx + 2]
lea esi, [edx + 4]
movzx ecx, byte [esi - 1]
mov edx, 8
shl eax, 8
or eax, ecx
xor ecx, ecx
mov dword [edi + 0x1c], eax
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.100e2eaa
mov ecx, dword [edi + 0x1c]
shl ecx, 3
push ecx
push 0
push eax
mov dword [edi + 0x20], eax
call fcn.100fc650
xor edx, edx
add esp, 0x10
cmp dword [edi + 0x1c], edx
jle 0x100c2b1b
movzx ecx, byte [esi]
lea esi, [esi + 6]
movzx eax, byte [esi - 5]
shl ecx, 8
or ecx, eax
mov eax, dword [edi + 0x20]
mov dword [eax + edx*8], ecx
movzx ecx, byte [esi - 4]
movzx eax, byte [esi - 3]
shl ecx, 8
or ecx, eax
mov eax, dword [edi + 0x20]
mov dword [eax + edx*8 + 4], ecx
inc edx
cmp edx, dword [edi + 0x1c]
jl 0x100c2a81
inc dword [ebx]
pop edi
pop esi
pop ebx
pop ebp
ret
movzx eax, byte [edx + 2]
lea esi, [edx + 3]
movzx ecx, byte [esi]
mov edx, 4
shl eax, 8
or eax, ecx
xor ecx, ecx
mov dword [edi + 0x14], eax
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.100e2eaa
mov ecx, dword [edi + 0x14]
shl ecx, 2
push ecx
push 0
push eax
mov dword [edi + 0x18], eax
call fcn.100fc650
xor edx, edx
add esp, 0x10
cmp dword [edi + 0x14], edx
jle 0x100c2b1b
nop dword [eax + eax]
movzx ecx, byte [esi + 1]
lea esi, [esi + 2]
movzx eax, byte [esi]
shl ecx, 8
or ecx, eax
mov eax, dword [edi + 0x18]
mov dword [eax + edx*4], ecx
inc edx
cmp edx, dword [edi + 0x14]
jl 0x100c2b00
inc dword [ebx]
pop edi
pop esi
pop ebx
pop ebp
ret
push 1
call fcn.101157c1
int3
Function at 0x100c2b30
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
mov esi, edx
mov edx, 0x24
push edi
mov edi, ecx
xor ecx, ecx
mov dword [ebp - 0xc], edi
mov al, byte [esi + 6]
movzx ebx, byte [esi + 4]
mov byte [ebp - 1], al
mov al, byte [esi + 7]
mov byte [ebp - 2], al
movzx eax, byte [esi + 5]
shl ebx, 8
or ebx, eax
mov eax, ebx
mov dword [ebp - 0x10], ebx
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.100e2eaa
mov ecx, dword [ebp + 8]
mov dword [edi + ecx*8 + 4], eax
lea ecx, [ebx + ebx*8]
shl ecx, 2
push ecx
push 0
push eax
call fcn.100fc650
add esp, 0x10
mov dword [ebp - 8], 0
test ebx, ebx
je 0x100c2c81
movzx ebx, byte [ebp - 1]
movzx eax, byte [ebp - 2]
shl ebx, 8
or ebx, eax
add ebx, esi
nop dword [eax + eax]
mov edx, dword [ebp + 8]
push edx
mov eax, dword [edi + edx*8]
lea ecx, [eax + eax*8]
mov eax, dword [edi + edx*8 + 4]
lea edi, [eax + ecx*4]
movzx ecx, byte [ebx]
movzx eax, byte [ebx + 1]
shl ecx, 8
or ecx, eax
mov dword [edi], ecx
movzx edx, byte [ebx + 2]
movzx eax, byte [ebx + 3]
mov ecx, dword [ebp - 0xc]
shl edx, 8
or edx, eax
add edx, ebx
call fcn.100c2a00
mov eax, dword [edi]
add esp, 4
sub eax, 1
je 0x100c2c5d
sub eax, 1
jne 0x100c2c88
movzx eax, byte [ebx + 4]
lea esi, [ebx + 5]
movzx ecx, byte [esi]
mov edx, 4
shl eax, 8
or eax, ecx
xor ecx, ecx
mov dword [edi + 8], eax
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.100e2eaa
mov ecx, dword [edi + 8]
shl ecx, 2
push ecx
push 0
push eax
mov dword [edi + 0xc], eax
call fcn.100fc650
xor edx, edx
add esp, 0x10
cmp dword [edi + 8], edx
jle 0x100c2c6d
nop dword [eax]
movzx ecx, byte [esi + 1]
lea esi, [esi + 2]
movzx eax, byte [esi]
shl ecx, 8
or ecx, eax
mov eax, dword [edi + 0xc]
mov dword [eax + edx*4], ecx
inc edx
cmp edx, dword [edi + 8]
jl 0x100c2c40
jmp 0x100c2c6d
movzx ecx, byte [ebx + 4]
movzx eax, byte [ebx + 5]
shl ecx, 8
or ecx, eax
mov dword [edi + 4], ecx
mov eax, dword [ebp - 8]
inc eax
mov dword [ebp - 8], eax
cmp eax, dword [ebp - 0x10]
jge 0x100c2c81
mov edi, dword [ebp - 0xc]
jmp 0x100c2bb0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 1
call fcn.101157c1
int3
Function at 0x100c3210
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [ecx]
push ebx
push esi
push edi
xor edi, edi
mov dword [ebp - 4], eax
mov dword [ebp - 8], edi
mov dword [ebp - 0xc], edi
test eax, eax
jle 0x100c329d
mov ebx, dword [ecx + 4]
mov ecx, eax
nop
mov eax, dword [ebx + 0x10]
sub eax, 1
je 0x100c3274
sub eax, 1
jne 0x100c32eb
xor edi, edi
cmp dword [ebx + 0x1c], edi
jle 0x100c328f
mov eax, dword [ebx + 0x20]
nop dword [eax + eax]
mov esi, dword [eax]
cmp esi, edx
ja 0x100c325b
cmp edx, dword [eax + 4]
jbe 0x100c32a6
mov ecx, dword [eax + 4]
inc edi
sub ecx, esi
add eax, 8
mov esi, dword [ebp - 8]
inc esi
add esi, ecx
mov dword [ebp - 8], esi
cmp edi, dword [ebx + 0x1c]
jl 0x100c3250
jmp 0x100c328c
mov esi, dword [ebx + 0x14]
xor ecx, ecx
test esi, esi
jle 0x100c328c
mov eax, dword [ebx + 0x18]
cmp dword [eax], edx
je 0x100c32c6
inc ecx
add eax, 4
cmp ecx, esi
jl 0x100c3280
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0xc]
add ebx, 0x24
inc eax
mov dword [ebp - 0xc], eax
cmp eax, ecx
jl 0x100c3230
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [ebx]
sub eax, 1
je 0x100c32df
sub eax, 1
jne 0x100c32eb
mov edi, dword [ebp - 8]
mov eax, dword [ebx + 0xc]
sub edi, esi
add edi, edx
mov eax, dword [eax + edi*4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [ebx]
sub eax, 1
je 0x100c32df
sub eax, 1
jne 0x100c32eb
mov eax, dword [ebx + 0xc]
pop edi
pop esi
pop ebx
mov eax, dword [eax + ecx*4]
mov esp, ebp
pop ebp
ret
mov eax, dword [ebx + 4]
pop edi
pop esi
add eax, edx
pop ebx
mov esp, ebp
pop ebp
ret
push 1
call fcn.101157c1
int3
Function at 0x100c5ec0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
push edi
mov edi, ecx
mov esi, dword [edi + 0x2c]
mov ebx, dword [edi + 0x74]
mov eax, dword [edi + 0x2c]
mov edx, dword [edi + 0x3c]
add eax, 0xfffffefa
sub edx, dword [edi + 0x6c]
add eax, esi
sub edx, ebx
mov dword [ebp - 8], edx
cmp dword [edi + 0x6c], eax
jb 0x100c5f68
mov ecx, dword [edi + 0x38]
push esi
lea eax, [ecx + esi]
push eax
push ecx
call fcn.100fbb50
mov ebx, dword [edi + 0x4c]
add esp, 0xc
mov eax, dword [edi + 0x44]
sub dword [edi + 0x70], esi
sub dword [edi + 0x6c], esi
sub dword [edi + 0x5c], esi
lea edx, [eax + ebx*2]
nop
movzx ecx, word [edx - 2]
lea edx, [edx - 2]
mov eax, ecx
mov dword [ebp - 4], 0
sub eax, esi
cmp ecx, esi
movzx eax, ax
cmovb eax, dword [ebp - 4]
mov word [edx], ax
sub ebx, 1
jne 0x100c5f10
mov eax, dword [edi + 0x40]
mov ebx, esi
lea edx, [eax + esi*2]
nop dword [eax + eax]
movzx ecx, word [edx - 2]
lea edx, [edx - 2]
mov eax, ecx
mov dword [ebp - 4], 0
sub eax, esi
cmp ecx, esi
movzx eax, ax
cmovb eax, dword [ebp - 4]
mov word [edx], ax
sub ebx, 1
jne 0x100c5f40
mov edx, dword [ebp - 8]
add edx, esi
mov ecx, dword [edi]
cmp dword [ecx + 4], 0
je 0x100c603a
push edx
mov edx, dword [edi + 0x74]
add edx, dword [edi + 0x38]
add edx, dword [edi + 0x6c]
call fcn.100c5cc0
add dword [edi + 0x74], eax
add esp, 4
mov ebx, dword [edi + 0x74]
cmp ebx, 3
jb 0x100c5fae
mov eax, dword [edi + 0x6c]
add eax, dword [edi + 0x38]
mov ecx, dword [edi + 0x58]
movzx edx, byte [eax]
mov dword [edi + 0x48], edx
movzx eax, byte [eax + 1]
shl edx, cl
xor edx, eax
and edx, dword [edi + 0x54]
mov dword [edi + 0x48], edx
cmp ebx, 0x106
jae 0x100c5fc2
mov eax, dword [edi]
cmp dword [eax + 4], 0
jne 0x100c5ed1
mov edx, dword [edi + 0x16c0]
mov esi, dword [edi + 0x3c]
cmp edx, esi
jae 0x100c603a
mov ecx, dword [edi + 0x6c]
add ecx, ebx
mov dword [ebp - 8], ecx
cmp edx, ecx
jae 0x100c600a
sub esi, ecx
mov eax, 0x102
cmp esi, eax
cmova esi, eax
mov eax, dword [edi + 0x38]
push esi
add eax, ecx
push 0
push eax
call fcn.100fc650
mov eax, dword [ebp - 8]
add esp, 0xc
add eax, esi
mov dword [edi + 0x16c0], eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea eax, [ecx + 0x102]
cmp edx, eax
jae 0x100c603a
sub ecx, edx
sub esi, edx
lea eax, [ecx + 0x102]
cmp eax, esi
cmovbe esi, eax
mov eax, dword [edi + 0x38]
push esi
add eax, edx
push 0
push eax
call fcn.100fc650
add esp, 0xc
add dword [edi + 0x16c0], esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x100c6840
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
test edx, edx
jne 0x100c684b
xor eax, eax
pop ebp
ret
pop ebp
jmp fcn.100c6860
Function at 0x100e0a40
Capabilities:
Enumerate pe sections

Disassembly:
sub esp, 0xc
push ebx
mov ebx, dword [esp + 0x14]
push ebp
push esi
mov esi, ecx
push edi
mov edx, dword [esi]
sub ebx, edx
mov eax, dword [esi + 4]
sub eax, edx
sar ebx, 3
sar eax, 3
cmp eax, 0x1fffffff
je 0x100e0bcd
mov ecx, dword [esi + 8]
lea ebp, [eax + 1]
sub ecx, edx
mov dword [esp + 0x14], ebp
sar ecx, 3
mov eax, 0x1fffffff
mov edx, ecx
shr edx, 1
sub eax, edx
cmp ecx, eax
jbe 0x100e0a89
mov eax, ebp
jmp 0x100e0a91
lea eax, [edx + ecx]
cmp eax, ebp
cmovb eax, ebp
lea ecx, [eax*8]
mov dword [esp + 0x18], ecx
cmp eax, 0x1fffffff
jbe 0x100e0aa8
or ecx, 0xffffffff
jmp 0x100e0ab0
cmp ecx, 0x1000
jb 0x100e0ad7
lea eax, [ecx + 0x23]
or edx, 0xffffffff
cmp eax, ecx
cmovbe eax, edx
push eax
call fcn.100e279e
add esp, 4
test eax, eax
je 0x100e0bc8
lea edi, [eax + 0x23]
and edi, 0xffffffe0
mov dword [edi - 4], eax
jmp 0x100e0aea
test ecx, ecx
je 0x100e0ae8
push ecx
call fcn.100e279e
add esp, 4
mov edi, eax
jmp 0x100e0aea
xor edi, edi
mov ecx, dword [esp + 0x24]
lea edx, [ebx*8]
mov ebx, dword [esp + 0x20]
mov dword [esp + 0x10], edx
mov eax, dword [ecx]
mov dword [edx + edi], eax
mov al, byte [ecx + 4]
mov byte [edx + edi + 4], al
mov ax, word [ecx + 6]
mov word [edx + edi + 6], ax
mov ebp, dword [esi + 4]
mov edx, dword [esi]
cmp ebx, ebp
jne 0x100e0ba7
cmp edx, ebp
je 0x100e0b4e
mov ebx, edx
lea ecx, [edi + 6]
sub ebx, edi
nop word [eax + eax]
mov eax, dword [edx]
lea ecx, [ecx + 8]
mov dword [ecx - 0xe], eax
mov al, byte [edx + 4]
add edx, 8
mov byte [ecx - 0xa], al
mov ax, word [ebx + ecx - 8]
mov word [ecx - 8], ax
cmp edx, ebp
jne 0x100e0b30
mov ebp, dword [esp + 0x10]
mov eax, dword [esi]
test eax, eax
je 0x100e0b84
mov ecx, dword [esi + 8]
sub ecx, eax
and ecx, 0xfffffff8
cmp ecx, 0x1000
jb 0x100e0b7a
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x100e0bc8
mov eax, edx
push ecx
push eax
call fcn.100e2b31
add esp, 8
mov eax, dword [esp + 0x14]
mov dword [esi], edi
lea eax, [edi + eax*8]
mov dword [esi + 4], eax
mov eax, dword [esp + 0x18]
add eax, edi
mov dword [esi + 8], eax
mov eax, dword [esi]
pop edi
pop esi
add eax, ebp
pop ebp
pop ebx
add esp, 0xc
ret 8
push edi
push ebx
push edx
mov ecx, esi
call fcn.100e1640
mov ebp, dword [esp + 0x10]
mov ecx, esi
lea eax, [ebp + 8]
add eax, edi
push eax
push dword [esi + 4]
push ebx
call fcn.100e1640
jmp 0x100e0b52
call fcn.10107f97
call fcn.10045d40
int3
Function at 0x100e5630
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10133b98
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x10188068]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [0x10188090]
cmp eax, 0xffffffff
jne 0x100e5666
xor ebx, ebx
jmp 0x100e566f
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ebx, eax
mov dword [ebp - 0x10], ebx
mov dword [ebp - 4], 0
test ebx, ebx
je 0x100e5757
mov ecx, dword [ebx + 0x18]
mov eax, dword [ebx + 0xc]
mov esi, eax
nop dword [eax]
mov edx, ecx
mov edi, esi
test edx, edx
jne 0x100e56a0
test eax, eax
je 0x100e5732
test edx, edx
mov esi, eax
cmovne esi, edi
test esi, esi
je 0x100e56f7
nop dword [eax + eax]
mov eax, dword [esi + 4]
mov dword [ebx + 0xc], eax
mov ecx, dword [esi]
test ecx, ecx
je 0x100e56db
mov eax, dword [ecx]
call dword [eax + 4]
mov edi, dword [esi]
mov ecx, edi
push 0
mov eax, dword [edi]
call dword [eax]
push edi
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
push esi
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov eax, dword [ebx + 0xc]
mov esi, eax
test eax, eax
jne 0x100e56b0
mov ecx, dword [ebx + 0x18]
test ecx, ecx
je 0x100e5690
nop dword [eax + eax]
mov esi, dword [ebx + 0x14]
mov esi, dword [esi]
mov ecx, dword [esi + 0x14]
test ecx, ecx
je 0x100e5719
mov edx, dword [esi + 0x1c]
test edx, edx
je 0x100e5719
mov eax, dword [ecx]
push edx
call dword [eax + 4]
push esi
lea eax, [ebp - 0x14]
push eax
lea ecx, [ebx + 0x14]
call fcn.100e53c0
mov ecx, dword [ebx + 0x18]
test ecx, ecx
jne 0x100e5700
jmp 0x100e5684
push 0x100e53a0
push 0x10196144
call fcn.100e5190
mov eax, dword [0x10188090]
add esp, 8
cmp eax, 0xffffffff
je 0x100e5757
push 0
push eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
mov dword [ebp - 4], 1
test ebx, ebx
je 0x100e5784
or eax, 0xffffffff
lock xadd dword [ebx + 4], eax
jne 0x100e5784
mov eax, dword [ebx]
mov ecx, ebx
push 0
call dword [eax]
push ebx
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x100e6180
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateThread]
pop ebp
ret

Function at 0x1011ea61
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.1011e721

Function at 0x10123c1d
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.10123a9c
Function at 0x1001861e
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40
pushal
call 0x1001862d
pop dword [ebp - 0x30]
mov eax, 0xb611bee2
add eax, 0x59efc74b
sub dword [ebp - 0x30], eax
push 0x40
push 0x1000
push 0x3dc6d
push 0
mov eax, 0xe8a8cf85
sub eax, 0xd8a56ea9
add eax, dword [ebp - 0x30]
call dword [eax]
mov ecx, 0x3cff
xor edx, edx
add edx, eax
mov edi, 0x1003be00
add edi, dword [ebp - 0x30]
mov esi, 0x804a35c6
sub dword [ebp - 0x14], esi
mov ebx, dword [edi]
sub dword [ebp - 0x20], 0xd8e01848
xor ebx, esi
mov dword [edx], ebx
sub dword [ebp - 0x24], ecx
add edx, 4
add edi, 0x38c6d011
sub edi, 0x38c6d00d
loop 0x1001867c
add eax, 0x4eeaca22
sub eax, 0x4ee9e353
xor ebx, ebx
add ebx, eax
add eax, 5
mov ecx, 0x10000000
add ecx, dword [ebp - 0x30]
call ebx
leave
ret

Function at 0x100289d0
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x808
mov eax, dword [0x100330b4]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [0x10035b0c]
test dword [ebp + 8], eax
je 0x10028a7a
lea eax, [ebp + 0x10]
push eax
push dword [ebp + 0xc]
lea eax, [ebp - 0x808]
push eax
call fcn.1001861e
xor eax, eax
add esp, 0xc
mov word [ebp - 8], ax
mov eax, dword [0x10035b08]
test eax, eax
je 0x10028a6d
lea ecx, [ebp - 0x808]
push ecx
push eax
call fcn.1001861e
mov eax, dword [0x100330ac]
pop ecx
pop ecx
test eax, eax
jle 0x10028a7a
push esi
mov esi, dword [0x10035b10]
push edi
mov edi, dword [0x10035b14]
cdq
push edx
push eax
push edi
push esi
call fcn.10029420
add esi, 1
mov dword [0x10035b10], esi
adc edi, 0
or eax, edx
mov dword [0x10035b14], edi
pop edi
pop esi
jne 0x10028a7a
push dword [0x10035b08]
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fflush]
pop ecx
jmp 0x10028a7a
lea eax, [ebp - 0x808]
push eax
call dword [sym.imp.kernel32.dll_OutputDebugStringW]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10028d50
leave
ret