joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10098290
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, ecx
push edi
cmp dword [esi], 0
jne 0x100982d3
mov edx, str.ERROR:
mov ecx, 0x100eada8
call fcn.10015be0
mov edx, str.Internal_error:_VCDiffDeltaFileWindow::DecodeWindow___called_before_VCDiffDeltaFileWindow::Init__
mov ecx, eax
call fcn.10015be0
push eax
call fcn.1001a510
add esp, 4
cmp byte [0x100ec09c], 0
je 0x100983ca
jmp 0x100983d4
cmp byte [esi + 4], 0
jne 0x10098326
mov edi, dword [ebp + 8]
push edi
call fcn.10097b90
cmp eax, 0xfffffffe
je 0x1009831a
cmp eax, 0xffffffff
je 0x100983ca
mov eax, dword [esi]
mov ecx, dword [eax + 0x90]
call fcn.100a38d0
test al, al
jne 0x1009836f
mov edx, str.ERROR:
mov ecx, 0x100eada8
call fcn.10015be0
mov edx, str.Error_initializing_address_cache
jmp 0x100983b5
mov eax, 0xfffffffe
pop edi
pop esi
pop ecx
pop ebp
ret 4
cmp byte [esi + 0x24], 0
je 0x10098345
mov edx, str.ERROR:
mov ecx, 0x100eada8
call fcn.10015be0
mov edx, str.Internal_error:_Resumed_decoding_of_a_delta_file_window_when_interleaved_format_is_not_being_used
jmp 0x100982b1
mov edi, dword [ebp + 8]
push dword [edi + 4]
push dword [edi + 8]
call fcn.100968d0
mov eax, dword [esi + 0x10]
mov ecx, dword [eax + 4]
add eax, 8
mov dword [esi + 0x44], eax
mov dword [esi + 0x48], ecx
mov eax, dword [eax]
mov dword [esi + 0x4c], eax
mov ax, word [esi + 0x50]
mov word [esi + 0x52], ax
push edi
mov ecx, esi
call fcn.10097ef0
cmp eax, 0xfffffffe
je 0x10098391
cmp eax, 0xffffffff
je 0x100983ca
mov ecx, esi
call fcn.100979a0
xor eax, eax
pop edi
pop esi
pop ecx
pop ebp
ret 4
cmp byte [esi + 0x24], 0
jne 0x100983a1
cmp dword [esi + 0x28], 0
jg 0x1009831a
mov edx, str.ERROR:
mov ecx, 0x100eada8
call fcn.10015be0
mov edx, str.End_of_data_reached_while_decoding_VCDIFF_delta_file
mov ecx, eax
call fcn.10015be0
push eax
call fcn.1001a510
add esp, 4
call fcn.100966b0
pop edi
or eax, 0xffffffff
pop esi
pop ecx
pop ebp
ret 4
mov ecx, 0x100eada8
call fcn.1002d1d0
push 1
call fcn.100b3502
int3

Function at 0x100986e0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, ecx
mov ecx, dword [esi + 4]
mov eax, dword [esi]
mov edx, dword [ecx]
push dword [eax + 4]
mov eax, dword [edx + 4]
call eax
test al, al
jne 0x1009872d
mov edx, str.ERROR:
mov ecx, 0x100eada8
call fcn.10015be0
mov edx, str.Internal_error:_Initialization_of_code_table_writer_failed
mov ecx, eax
call fcn.10015be0
push eax
call fcn.1001a510
add esp, 4
cmp byte [0x100ec09c], 0
jne 0x10098771
xor al, al
pop esi
pop ebp
ret 4
mov eax, dword [esi]
mov ecx, dword [esi + 4]
push dword [eax + 4]
mov edx, dword [ecx]
push dword [eax]
mov eax, dword [edx + 0x24]
call eax
test al, al
jne 0x10098758
mov edx, str.ERROR:
mov ecx, 0x100eada8
call fcn.10015be0
mov edx, str.Dictionary_not_valid_for_writer
jmp 0x1009870d
mov ecx, dword [esi + 4]
push dword [esi + 8]
push dword [ebp + 8]
mov eax, dword [ecx]
call dword [eax + 8]
mov byte [esi + 0xd], 1
mov al, 1
pop esi
pop ebp
ret 4
mov ecx, 0x100eada8
call fcn.1002d1d0
push 1
call fcn.100b3502
int3
Function at 0x10098790
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, ecx
push esi
push edi
cmp byte [ebx + 0xd], 0
jne 0x100987d8
mov edx, str.ERROR:
mov ecx, 0x100eada8
call fcn.10015be0
mov edx, str.EncodeChunk_called_before_StartEncoding
mov ecx, eax
call fcn.10015be0
push eax
call fcn.1001a510
add esp, 4
cmp byte [0x100ec09c], 0
jne 0x10098858
xor al, al
pop edi
pop esi
pop ebx
pop ebp
ret 0xc
mov ecx, dword [ebx + 4]
mov esi, dword [ebp + 0xc]
mov edi, dword [ebp + 8]
push esi
mov eax, dword [ecx]
push edi
mov eax, dword [eax + 0x28]
call eax
test al, al
jne 0x10098804
mov edx, str.ERROR:
mov ecx, 0x100eada8
call fcn.10015be0
mov edx, str.Target_chunk_not_valid_for_writer
jmp 0x100987b2
test byte [ebx + 8], 2
je 0x1009882b
mov esi, dword [ebx + 4]
xor ecx, ecx
push dword [ebp + 0xc]
mov edx, dword [ebp + 8]
mov edi, dword [esi]
call fcn.100a2f20
add esp, 4
mov ecx, esi
push eax
call dword [edi + 0x18]
mov esi, dword [ebp + 0xc]
mov edi, dword [ebp + 8]
cmp byte [ebx + 0xc], 0
mov eax, dword [ebx + 4]
mov ecx, dword [ebx]
push eax
push dword [ebp + 0x10]
push esi
push edi
je 0x1009884a
call fcn.100a4e20
mov al, 1
pop edi
pop esi
pop ebx
pop ebp
ret 0xc
call fcn.100a4ff0
pop edi
pop esi
mov al, 1
pop ebx
pop ebp
ret 0xc
mov ecx, 0x100eada8
call fcn.1002d1d0
push 1
call fcn.100b3502
int3

Function at 0x10098870
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push ecx
cmp byte [ecx + 0xd], 0
jne 0x100988ae
mov edx, str.ERROR:
mov ecx, 0x100eada8
call fcn.10015be0
mov edx, str.FinishEncoding_called_before_StartEncoding
mov ecx, eax
call fcn.10015be0
push eax
call fcn.1001a510
add esp, 4
cmp byte [0x100ec09c], 0
jne 0x100988c4
xor al, al
pop ecx
pop ebp
ret 4
push dword [ebp + 8]
mov byte [ecx + 0xd], 0
mov ecx, dword [ecx + 4]
mov eax, dword [ecx]
call dword [eax + 0x20]
mov al, 1
pop ecx
pop ebp
ret 4
mov ecx, 0x100eada8
call fcn.1002d1d0
push 1
call fcn.100b3502
int3
Function at 0x1009de30
Capabilities:
Parse credit card information

Disassembly:
add ecx, 0xfffffffe
cmp ecx, 8
ja case.default.0x1009de3c
jmp dword [ecx*4 + 0x1009df64]
cmp dl, 0x40
jne 0x1009de4e
mov eax, 4
ret
mov al, dl
or al, 0x20
cmp al, 0x61
jb 0x1009de5a
cmp al, 0x7a
jbe 0x1009debd
cmp dl, 0x30
jl 0x1009de64
cmp dl, 0x39
jle 0x1009debd
cmp dl, 0x2d
je 0x1009debd
cmp dl, 0x5f
je 0x1009debd
cmp dl, 0x2e
je 0x1009debd
cmp dl, 0x21
je 0x1009debd
cmp dl, 0x7e
je 0x1009debd
cmp dl, 0x2a
je 0x1009debd
cmp dl, 0x27
je 0x1009debd
cmp dl, 0x28
je 0x1009debd
cmp dl, 0x29
je 0x1009debd
cmp dl, 0x25
je 0x1009debd
cmp dl, 0x3b
je 0x1009debd
cmp dl, 0x3a
je 0x1009debd
cmp dl, 0x26
je 0x1009debd
cmp dl, 0x3d
je 0x1009debd
cmp dl, 0x2b
je 0x1009debd
cmp dl, 0x24
je 0x1009debd
cmp dl, 0x2c
jne case.default.0x1009de3c
mov eax, 3
ret
cmp dl, 0x5b
jne 0x1009dece
mov eax, 5
ret
mov al, dl
or al, 0x20
cmp al, 0x61
jb 0x1009deda
cmp al, 0x7a
jbe 0x1009deee
cmp dl, 0x30
jl 0x1009dee4
cmp dl, 0x39
jle 0x1009deee
cmp dl, 0x2e
je 0x1009deee
cmp dl, 0x2d
jne case.default.0x1009de3c
mov eax, 6
ret
mov al, dl
or al, 0x20
cmp al, 0x61
jb 0x1009df00
cmp al, 0x7a
jbe 0x1009deee
cmp dl, 0x30
jl 0x1009df0a
cmp dl, 0x39
jle 0x1009deee
cmp dl, 0x2e
je 0x1009deee
cmp dl, 0x2d
je 0x1009deee
cmp dl, 0x3a
jne case.default.0x1009de3c
mov eax, 9
ret
cmp dl, 0x5d
jne case.0x1009de3c.5
mov eax, 8
ret
cmp dl, 0x30
jl 0x1009df34
cmp dl, 0x39
jle 0x1009df4a
mov al, dl
or al, 0x20
cmp al, 0x61
jb 0x1009df40
cmp al, 0x66
jbe 0x1009df4a
cmp dl, 0x3a
je 0x1009df4a
cmp dl, 0x2e
jne case.default.0x1009de3c
mov eax, 7
ret
sub dl, 0x30
mov eax, 0xa
cmp dl, 9
jbe 0x1009df62
mov eax, 1
ret
Function at 0x100a3190
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, ecx
push edi
mov eax, dword [esi + 8]
test eax, eax
jne 0x100a31d6
mov edx, str.ERROR:
mov ecx, 0x100eada8
call fcn.10015be0
mov edx, str.Internal_error:_GetNextInstruction___called_before_Init__
mov ecx, eax
call fcn.10015be0
push eax
call fcn.1001a510
add esp, 4
cmp byte [0x100ec09c], 0
je 0x100a329a
jmp 0x100a32d0
mov eax, dword [eax]
mov dword [esi + 0x10], eax
mov ax, word [esi + 0x14]
mov word [esi + 0x16], ax
mov ecx, 0x100
cmp word [esi + 0x14], cx
jne 0x100a3231
mov ecx, dword [esi + 8]
mov eax, dword [ecx]
cmp eax, dword [esi + 0xc]
jae 0x100a32ae
mov dl, byte [eax]
mov eax, dword [esi]
movzx edi, dl
cmp byte [edi + eax + 0x100], 0
je 0x100a3215
movsx ax, dl
mov word [esi + 0x14], ax
inc dword [ecx]
mov eax, dword [esi]
mov bl, byte [edi + eax]
movzx edx, byte [edi + eax + 0x200]
mov bh, byte [edi + eax + 0x400]
test bl, bl
jne 0x100a3253
jmp 0x100a31e3
mov al, byte [esi + 0x14]
mov word [esi + 0x14], cx
movzx ecx, al
mov eax, dword [esi]
mov bl, byte [ecx + eax + 0x100]
movzx edx, byte [ecx + eax + 0x300]
mov bh, byte [ecx + eax + 0x500]
test edx, edx
jne 0x100a32bb
mov edx, dword [esi + 8]
mov ecx, dword [esi + 0xc]
call fcn.100a9bb0
mov ecx, dword [ebp + 8]
mov dword [ecx], eax
cmp eax, 0xfffffffe
je 0x100a32a7
cmp eax, 0xffffffff
jne 0x100a32c0
mov edx, str.ERROR:
mov ecx, 0x100eada8
call fcn.10015be0
mov edx, str.Instruction_size_is_not_a_valid_variable_length_integer
mov ecx, eax
call fcn.10015be0
push eax
call fcn.1001a510
add esp, 4
call fcn.100966b0
mov eax, 4
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret 8
mov ecx, esi
call fcn.100966d0
mov eax, 5
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret 8
mov eax, dword [ebp + 8]
mov dword [eax], edx
mov eax, dword [ebp + 0xc]
pop edi
pop esi
mov byte [eax], bh
movzx eax, bl
pop ebx
pop ecx
pop ebp
ret 8
mov ecx, 0x100eada8
call fcn.1002d1d0
push 1
call fcn.100b3502
int3

Function at 0x100a32f0
Capabilities:
Terminate process

Disassembly:
push ecx
cmp ecx, 3
ja case.default.0x100a32f6
jmp dword [ecx*4 + 0x100a336c]
mov eax, str.NOOP
pop ecx
ret
mov eax, 0x10105b3c
pop ecx
ret
mov eax, 0x10105b40
pop ecx
ret
mov eax, str.COPY
pop ecx
ret
push ecx
push ecx
mov edx, str.ERROR:
mov ecx, 0x100eada8
call fcn.10015be0
mov edx, str.Unexpected_instruction_type
mov ecx, eax
call fcn.10015be0
add esp, 4
mov ecx, eax
call fcn.100512b0
push eax
call fcn.1001a510
add esp, 4
cmp byte [0x100ec09c], 0
jne 0x100a3359
mov eax, 0x100f9688
pop ecx
ret
mov ecx, 0x100eada8
call fcn.1002d1d0
push 1
call fcn.100b3502
mov edi, edi
std
xor cl, byte [edx]
adc byte [ebx + esi], al
or dl, byte [eax]
or esi, dword [ebx]
or dl, byte [eax]
adc dh, byte [ebx]
or dl, byte [eax]
int3
Function at 0x100a3380
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov bl, dl
mov esi, ecx
mov al, 1
push edi
mov edi, dword [ebp + 0x14]
cmp bl, 3
jbe 0x100a3404
movzx eax, bl
mov edx, str.ERROR:
push eax
push ecx
push esi
push ecx
mov ecx, 0x100eada8
call fcn.10015be0
mov edx, str.VCDiff:_Bad_code_table__opcode
mov ecx, eax
call fcn.10015be0
add esp, 4
mov ecx, eax
call fcn.100512b0
mov edx, str._has_invalid
mov ecx, eax
call fcn.10015be0
mov edx, edi
mov ecx, eax
call fcn.10015be0
mov edx, str._instruction_type
mov ecx, eax
call fcn.10015be0
add esp, 4
mov ecx, eax
call fcn.100512b0
push eax
call fcn.1001a510
add esp, 4
cmp byte [0x100ec09c], 0
jne 0x100a3570
xor al, al
mov bh, byte [ebp + 0xc]
cmp bh, byte [ebp + 0x10]
jbe 0x100a347b
movzx eax, bh
mov edx, str.ERROR:
push eax
push ecx
push esi
push ecx
mov ecx, 0x100eada8
call fcn.10015be0
mov edx, str.VCDiff:_Bad_code_table__opcode
mov ecx, eax
call fcn.10015be0
add esp, 4
mov ecx, eax
call fcn.100512b0
mov edx, str._has_invalid
mov ecx, eax
call fcn.10015be0
mov edx, edi
mov ecx, eax
call fcn.10015be0
mov edx, str._mode
mov ecx, eax
call fcn.10015be0
add esp, 4
mov ecx, eax
call fcn.100512b0
push eax
call fcn.1001a510
add esp, 4
cmp byte [0x100ec09c], 0
jne 0x100a3581
xor al, al
test bl, bl
jne 0x100a34f6
mov cl, byte [ebp + 8]
test cl, cl
je 0x100a34fb
movzx eax, cl
mov edx, str.ERROR:
push eax
push ecx
push esi
push ecx
mov ecx, 0x100eada8
call fcn.10015be0
mov edx, str.VCDiff:_Bad_code_table__opcode
mov ecx, eax
call fcn.10015be0
add esp, 4
mov ecx, eax
call fcn.100512b0
mov edx, str._has
mov ecx, eax
call fcn.10015be0
mov edx, edi
mov ecx, eax
call fcn.10015be0
mov edx, str._instruction_NOOP_with_nonzero_size
mov ecx, eax
call fcn.10015be0
add esp, 4
mov ecx, eax
call fcn.100512b0
push eax
call fcn.1001a510
add esp, 4
cmp byte [0x100ec09c], bl
jne 0x100a3592
xor al, al
jmp 0x100a34fb
cmp bl, 3
je 0x100a356a
test bh, bh
je 0x100a356a
movzx eax, bh
mov edx, str.ERROR:
push eax
push ecx
push esi
push ecx
mov ecx, 0x100eada8
call fcn.10015be0
mov edx, str.VCDiff:_Bad_code_table__opcode
mov ecx, eax
call fcn.10015be0
add esp, 4
mov ecx, eax
call fcn.100512b0
mov edx, str._has_non_COPY
mov ecx, eax
call fcn.10015be0
mov edx, edi
mov ecx, eax
call fcn.10015be0
mov edx, str._instruction_with_nonzero_mode
mov ecx, eax
call fcn.10015be0
add esp, 4
mov ecx, eax
call fcn.100512b0
push eax
call fcn.1001a510
add esp, 4
cmp byte [0x100ec09c], 0
jne 0x100a35a3
xor al, al
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret
mov ecx, 0x100eada8
call fcn.1002d1d0
push 1
call fcn.100b3502
mov ecx, 0x100eada8
call fcn.1002d1d0
push 1
call fcn.100b3502
mov ecx, 0x100eada8
call fcn.1002d1d0
push 1
call fcn.100b3502
mov ecx, 0x100eada8
call fcn.1002d1d0
push 1
call fcn.100b3502
int3
Function at 0x100a35c0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x118
mov edx, dword [ebp + 8]
xor eax, eax
push ebx
push esi
push edi
movzx edi, dl
mov bl, 1
add edi, 4
mov dword [ebp - 4], edi
test edi, edi
jle 0x100a35f8
cmp eax, 0x103
jae 0x100a378d
mov byte [ebp + eax - 0x118], 0
inc eax
cmp eax, edi
jl 0x100a35e0
mov eax, 0xfffffe00
lea esi, [ecx + 0x200]
sub eax, ecx
mov dword [ebp - 8], eax
jmp 0x100a3610
lea ecx, [eax + esi]
movzx eax, byte [esi + 0x200]
push str.first
push edx
mov dl, byte [esi - 0x200]
push eax
movzx eax, byte [esi]
push eax
mov dword [ebp - 0xc], ecx
call fcn.100a3380
add esp, 0x10
test al, al
je 0x100a3642
test bl, bl
je 0x100a3642
mov bl, 1
jmp 0x100a3644
xor bl, bl
movzx eax, byte [esi + 0x300]
mov dl, byte [esi - 0x100]
mov ecx, dword [ebp - 0xc]
push str.second
push dword [ebp + 8]
push eax
movzx eax, byte [esi + 0x100]
push eax
call fcn.100a3380
add esp, 0x10
test al, al
je 0x100a3679
test bl, bl
je 0x100a3679
mov bl, 1
jmp 0x100a367b
xor bl, bl
cmp byte [esi], 0
jne 0x100a36a5
cmp byte [esi - 0x100], 0
jne 0x100a36a5
movzx ecx, byte [esi + 0x200]
movzx eax, byte [esi - 0x200]
add eax, ecx
cmp eax, edi
jge 0x100a36a5
mov byte [ebp + eax - 0x118], 1
mov eax, dword [ebp - 8]
inc esi
mov edx, dword [ebp + 8]
add eax, esi
cmp eax, 0x100
mov eax, dword [ebp - 8]
jl 0x100a3610
mov esi, dword [ebp - 4]
xor edi, edi
test esi, esi
jle 0x100a3782
lea esp, [esp]
test edi, edi
je 0x100a3779
cmp byte [ebp + edi - 0x118], 0
jne 0x100a3779
cmp edi, 3
jl 0x100a3729
lea eax, [edi - 3]
mov edx, str.ERROR:
push eax
push ecx
mov ecx, 0x100eada8
call fcn.10015be0
mov edx, str.VCDiff:_Bad_code_table__there_is_no_opcode_for_inst_COPY__size_0__mode
mov ecx, eax
call fcn.10015be0
add esp, 4
mov ecx, eax
call fcn.100512b0
push eax
call fcn.1001a510
add esp, 4
cmp byte [0x100ec09c], 0
je 0x100a3777
jmp 0x100a3792
mov ecx, edi
call fcn.100a32f0
mov edx, str.ERROR:
mov ecx, 0x100eada8
mov esi, eax
call fcn.10015be0
mov edx, str.VCDiff:_Bad_code_table__there_is_no_opcode_for_inst
mov ecx, eax
call fcn.10015be0
mov edx, esi
mov ecx, eax
call fcn.10015be0
mov edx, str.__size_0___mode_0
mov ecx, eax
call fcn.10015be0
push eax
call fcn.1001a510
add esp, 4
cmp byte [0x100ec09c], 0
jne 0x100a3792
mov esi, dword [ebp - 4]
xor bl, bl
inc edi
cmp edi, esi
jl 0x100a36d0
pop edi
pop esi
mov al, bl
pop ebx
mov esp, ebp
pop ebp
ret 4
call fcn.100b2d26
mov ecx, 0x100eada8
call fcn.1002d1d0
push 1
call fcn.100b3502
int3
Function at 0x100a38d0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 8
push esi
mov esi, ecx
push edi
mov edx, dword [esi]
cmp edx, 0xfe
jg 0x100a3a3d
test edx, edx
js 0x100a3a3d
mov ecx, dword [esi + 4]
cmp ecx, 0xfe
jg 0x100a39f2
test ecx, ecx
js 0x100a39f2
lea eax, [ecx + edx]
cmp eax, 0xfe
jle 0x100a3991
push 0x100
push ecx
push ecx
push ecx
push edx
push ecx
mov edx, str.ERROR:
mov ecx, 0x100eada8
call fcn.10015be0
mov edx, str.Using_near_cache_size
mov ecx, eax
call fcn.10015be0
add esp, 4
mov ecx, eax
call fcn.100512b0
mov edx, str._and_same_cache_size
mov ecx, eax
call fcn.10015be0
add esp, 4
mov ecx, eax
call fcn.100512b0
mov edx, str._would_exceed_maximum_number_of_COPY_modes__
mov ecx, eax
call fcn.10015be0
add esp, 4
mov ecx, eax
call fcn.100512b0
mov edx, 0x100f959c
mov ecx, eax
call fcn.10015be0
push eax
call fcn.1001a510
add esp, 4
call fcn.100966b0
xor al, al
pop edi
pop esi
mov esp, ebp
pop ebp
ret
test edx, edx
jle 0x100a39b7
mov eax, dword [esi + 0xc]
lea edi, [esp + 8]
push edi
lea ecx, [esi + 0xc]
mov dword [esp + 0xc], 0
mov dword [ecx + 4], eax
push edx
push eax
lea eax, [esp + 0x18]
push eax
call fcn.100a3ee0
mov edx, dword [esi + 4]
test edx, edx
jle 0x100a39e3
mov eax, dword [esi + 0x18]
lea edi, [esp + 8]
push edi
shl edx, 8
lea ecx, [esi + 0x18]
push edx
push eax
mov dword [ecx + 4], eax
lea eax, [esp + 0x18]
push eax
mov dword [esp + 0x18], 0
call fcn.100a3ee0
pop edi
mov dword [esi + 8], 0
mov al, 1
pop esi
mov esp, ebp
pop ebp
ret
push ecx
push ecx
mov edx, str.ERROR:
mov ecx, 0x100eada8
call fcn.10015be0
mov edx, str.Same_cache_size
mov ecx, eax
call fcn.10015be0
add esp, 4
mov ecx, eax
call fcn.100512b0
mov edx, str._is_invalid
mov ecx, eax
call fcn.10015be0
push eax
call fcn.1001a510
add esp, 4
cmp byte [0x100ec09c], 0
je 0x100a3989
jmp 0x100a3a55
push edx
push ecx
mov edx, str.ERROR:
mov ecx, 0x100eada8
call fcn.10015be0
mov edx, str.Near_cache_size
jmp 0x100a3a08
mov ecx, 0x100eada8
call fcn.1002d1d0
push 1
call fcn.100b3502
int3
Function at 0x100a3ab0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, ecx
mov dword [ebp - 4], edi
test esi, esi
jns 0x100a3b16
push esi
push ecx
mov edx, str.ERROR:
mov ecx, 0x100eada8
call fcn.10015be0
mov edx, str.EncodeAddress_was_passed_a_negative_address:
mov ecx, eax
call fcn.10015be0
add esp, 4
mov ecx, eax
call fcn.100512b0
push eax
call fcn.1001a510
add esp, 4
cmp byte [0x100ec09c], 0
jne 0x100a3c45
mov eax, dword [ebp + 0x10]
mov dword [eax], 0
xor al, al
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov ecx, dword [ebp + 0xc]
cmp esi, ecx
jl 0x100a3b6a
push ecx
push ecx
push esi
push ecx
mov edx, str.ERROR:
mov ecx, 0x100eada8
call fcn.10015be0
mov edx, str.EncodeAddress_was_called_with_address__
mov ecx, eax
call fcn.10015be0
add esp, 4
mov ecx, eax
call fcn.100512b0
mov edx, str.____here_address__
mov ecx, eax
call fcn.10015be0
add esp, 4
mov ecx, eax
call fcn.100512b0
mov edx, 0x100f959c
mov ecx, eax
call fcn.10015be0
jmp 0x100a3aec
mov ebx, dword [edi + 4]
test ebx, ebx
jle 0x100a3bc0
shl ebx, 8
mov eax, esi
cdq
idiv ebx
mov eax, dword [edi + 0x18]
mov ebx, edx
cmp dword [eax + ebx*4], esi
jne 0x100a3bc0
push esi
mov ecx, edi
call fcn.100a3a70
mov ecx, ebx
and ecx, 0x800000ff
jns 0x100a3b9d
dec ecx
or ecx, 0xffffff00
inc ecx
mov eax, dword [ebp + 0x10]
mov dword [eax], ecx
mov eax, ebx
mov cl, byte [edi]
cdq
add cl, 2
and edx, 0xff
add eax, edx
sar eax, 8
add eax, ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
sub ecx, esi
mov dword [ebp + 8], esi
xor bl, bl
cmp ecx, esi
jge 0x100a3bd0
mov bl, 1
mov dword [ebp + 8], ecx
mov eax, dword [edi]
xor ecx, ecx
mov dword [ebp + 0xc], eax
test eax, eax
jle 0x100a3c1d
mov eax, dword [edi + 0xc]
mov edx, eax
mov edi, dword [ebp + 8]
mov dword [ebp - 8], eax
mov eax, esi
sub eax, dword [edx]
js 0x100a3bf5
cmp eax, edi
jge 0x100a3bf5
lea ebx, [ecx + 2]
mov edi, eax
mov eax, dword [ebp + 0xc]
inc ecx
add edx, 4
cmp ecx, eax
jl 0x100a3be6
mov dword [ebp + 8], edi
mov edi, dword [ebp - 4]
test eax, eax
jle 0x100a3c1d
mov eax, dword [edi + 8]
mov ecx, dword [ebp - 8]
mov dword [ecx + eax*4], esi
mov eax, dword [edi + 8]
inc eax
cdq
idiv dword [edi]
mov dword [edi + 8], edx
mov ecx, dword [edi + 4]
test ecx, ecx
jle 0x100a3c32
mov eax, esi
shl ecx, 8
cdq
idiv ecx
mov ecx, dword [edi + 0x18]
mov dword [ecx + edx*4], esi
mov ecx, dword [ebp + 0x10]
mov eax, dword [ebp + 8]
pop edi
pop esi
mov dword [ecx], eax
mov al, bl
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov ecx, 0x100eada8
call fcn.1002d1d0
push 1
call fcn.100b3502
int3
Function at 0x100a3c60
Capabilities:
Terminate process

Disassembly:
push ecx
test ecx, ecx
jns 0x100a3cae
push ecx
push ecx
mov edx, str.ERROR:
mov ecx, 0x100eada8
call fcn.10015be0
mov edx, str.Decoded_address
mov ecx, eax
call fcn.10015be0
add esp, 4
mov ecx, eax
call fcn.100512b0
mov edx, str._is_invalid
mov ecx, eax
call fcn.10015be0
push eax
call fcn.1001a510
add esp, 4
cmp byte [0x100ec09c], 0
jne 0x100a3cfc
xor al, al
pop ecx
ret
cmp ecx, edx
jl 0x100a3cf8
push edx
push ecx
push ecx
push ecx
mov edx, str.ERROR:
mov ecx, 0x100eada8
call fcn.10015be0
mov edx, str.Decoded_address__
mov ecx, eax
call fcn.10015be0
add esp, 4
mov ecx, eax
call fcn.100512b0
mov edx, str.__is_beyond_location_in_target_file__
mov ecx, eax
call fcn.10015be0
add esp, 4
mov ecx, eax
call fcn.100512b0
mov edx, 0x100f959c
jmp 0x100a3c91
mov al, 1
pop ecx
ret
mov ecx, 0x100eada8
call fcn.1002d1d0
push 1
call fcn.100b3502
int3
Function at 0x100a3d10
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [ebp + 8]
push ebx
push esi
mov esi, ecx
mov dword [ebp - 4], esi
push edi
test eax, eax
jns 0x100a3d67
push eax
push ecx
mov edx, str.ERROR:
mov ecx, 0x100eada8
call fcn.10015be0
mov edx, str.DecodeAddress_was_passed_a_negative_value_for_here_address:
mov ecx, eax
call fcn.10015be0
add esp, 4
mov ecx, eax
call fcn.100512b0
push eax
call fcn.1001a510
add esp, 4
cmp byte [0x100ec09c], 0
je 0x100a3eab
jmp 0x100a3ec5
mov edi, dword [ebp + 0x10]
mov ecx, dword [ebp + 0x14]
mov edi, dword [edi]
mov dword [ebp - 8], edi
cmp edi, ecx
jae 0x100a3eb7
mov dl, byte [esi]
mov bl, byte [ebp + 0xc]
mov bh, dl
add bh, 2
cmp bl, bh
jb 0x100a3db1
mov al, byte [esi + 4]
inc al
add al, dl
cmp bl, al
ja 0x100a3db1
mov cl, byte [edi]
inc edi
movzx eax, bh
movzx edx, bl
mov ebx, dword [ebp - 4]
sub edx, eax
movzx eax, cl
shl edx, 8
add edx, eax
mov eax, dword [esi + 0x18]
mov esi, dword [eax + edx*4]
jmp 0x100a3e07
lea edx, [ebp - 8]
call fcn.100a9bb0
mov esi, eax
cmp esi, 0xfffffffe
je 0x100a3eb7
cmp esi, 0xffffffff
je 0x100a3e82
test bl, bl
jne 0x100a3dd6
mov ebx, dword [ebp - 4]
jmp 0x100a3e04
cmp bl, 1
jne 0x100a3dec
mov edx, dword [ebp + 8]
mov eax, edx
mov edi, dword [ebp - 8]
sub eax, esi
mov ebx, dword [ebp - 4]
mov esi, eax
jmp 0x100a3e0a
cmp bl, 2
jb 0x100a3e31
cmp bl, bh
jae 0x100a3e31
movzx ecx, bl
mov ebx, dword [ebp - 4]
mov eax, dword [ebx + 0xc]
mov eax, dword [eax + ecx*4 - 8]
add esi, eax
mov edi, dword [ebp - 8]
mov edx, dword [ebp + 8]
mov ecx, esi
call fcn.100a3c60
test al, al
je 0x100a3eab
mov eax, dword [ebp + 0x10]
mov ecx, ebx
push esi
mov dword [eax], edi
call fcn.100a3a70
mov eax, esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
mov ecx, dword [ebp - 4]
mov edx, str.ERROR:
mov eax, dword [ecx + 4]
inc al
add al, byte [ecx]
movzx eax, al
push eax
push ecx
movzx eax, bl
push eax
push ecx
mov ecx, 0x100eada8
call fcn.10015be0
mov edx, str.Invalid_mode_value__
mov ecx, eax
call fcn.10015be0
add esp, 4
mov ecx, eax
call fcn.100512b0
mov edx, str.__passed_to_DecodeAddress__maximum_mode_value_
mov ecx, eax
call fcn.10015be0
add esp, 4
mov ecx, eax
call fcn.100512b0
jmp 0x100a3e9d
mov edx, str.ERROR:
mov ecx, 0x100eada8
call fcn.10015be0
mov edx, str.Found_invalid_variable_length_integer_as_encoded_address_value
mov ecx, eax
call fcn.10015be0
push eax
call fcn.1001a510
add esp, 4
call fcn.100966b0
or eax, 0xffffffff
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
pop edi
pop esi
mov eax, 0xfffffffe
pop ebx
mov esp, ebp
pop ebp
ret 0x10
mov ecx, 0x100eada8
call fcn.1002d1d0
push 1
call fcn.100b3502
int3