joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10007df0
Capabilities:
Terminate process

Disassembly:
cmp dword [0x1002b914], 0x10
push esi
mov esi, ecx
jl 0x10007e28
push 0x1002b918
call fcn.1000cf90
mov ecx, dword [0x1002b910]
add esp, 4
test ecx, ecx
je 0x10007e1a
mov eax, dword [ecx]
mov dword [0x1002b910], eax
mov dword [0x1002b918], 1
test ecx, ecx
jne 0x10007e3f
push 0x10
push 0
call dword [0x1002106c]
push eax
call dword [0x10021068]
mov ecx, eax
test ecx, ecx
je 0x10007e70
mov dword [ecx + 4], 0
mov dword [ecx + 8], 0
mov dword [ecx + 0xc], 0
mov dword [ecx], vtable.rg_hsh_jb::rg_zhshl.0
mov eax, dword [esi + 4]
mov dword [ecx + 4], eax
mov eax, dword [esi + 8]
mov dword [ecx + 8], eax
mov eax, dword [esi + 0xc]
mov dword [ecx + 0xc], eax
mov eax, ecx
pop esi
ret
push 0xffffffffffffffff
call fcn.10012757
int3

Function at 0x100080b0
Capabilities:
Terminate process

Disassembly:
cmp dword [0x1002b914], 0x10
jl 0x100080e5
push 0x1002b918
call fcn.1000cf90
mov ecx, dword [0x1002b910]
add esp, 4
test ecx, ecx
je 0x100080d7
mov eax, dword [ecx]
mov dword [0x1002b910], eax
mov dword [0x1002b918], 1
test ecx, ecx
jne 0x100080fc
push 0x10
push 0
call dword [0x1002106c]
push eax
call dword [0x10021068]
mov ecx, eax
test ecx, ecx
je 0x10008119
xor eax, eax
mov dword [ecx + 4], 0
mov word [ecx + 0xc], ax
mov eax, ecx
mov dword [ecx + 8], 0
mov dword [ecx], vtable.rg_hsh_jb::rg_zfl.0
ret
push 0xffffffffffffffff
call fcn.10012757
int3

Function at 0x10008200
Capabilities:
Terminate process

Disassembly:
cmp dword [0x1002b914], 0x10
push esi
mov esi, ecx
jl 0x10008238
push 0x1002b918
call fcn.1000cf90
mov ecx, dword [0x1002b910]
add esp, 4
test ecx, ecx
je 0x1000822a
mov eax, dword [ecx]
mov dword [0x1002b910], eax
mov dword [0x1002b918], 1
test ecx, ecx
jne 0x1000824f
push 0x10
push 0
call dword [0x1002106c]
push eax
call dword [0x10021068]
mov ecx, eax
test ecx, ecx
je 0x10008281
xor eax, eax
mov dword [ecx + 4], 0
mov word [ecx + 0xc], ax
mov dword [ecx + 8], 0
mov dword [ecx], vtable.rg_hsh_jb::rg_zfl.0
mov eax, dword [esi + 4]
mov dword [ecx + 4], eax
mov eax, dword [esi + 8]
mov dword [ecx + 8], eax
mov ax, word [esi + 0xc]
mov word [ecx + 0xc], ax
mov eax, ecx
pop esi
ret
push 0xffffffffffffffff
call fcn.10012757
int3

Function at 0x10008500
Capabilities:
Terminate process

Disassembly:
cmp dword [0x1002b914], 0x10
jl 0x10008535
push 0x1002b918
call fcn.1000cf90
mov ecx, dword [0x1002b910]
add esp, 4
test ecx, ecx
je 0x10008527
mov eax, dword [ecx]
mov dword [0x1002b910], eax
mov dword [0x1002b918], 1
test ecx, ecx
jne 0x1000854c
push 0x10
push 0
call dword [0x1002106c]
push eax
call dword [0x10021068]
mov ecx, eax
test ecx, ecx
je 0x10008569
xor eax, eax
mov dword [ecx + 4], 0
mov word [ecx + 0xc], ax
mov eax, ecx
mov dword [ecx + 8], 0
mov dword [ecx], vtable.rg_hsh_jb::rg_dzhshl.0
ret
push 0xffffffffffffffff
call fcn.10012757
int3
Function at 0x10008650
Capabilities:
Terminate process

Disassembly:
cmp dword [0x1002b914], 0x10
push esi
mov esi, ecx
jl 0x10008688
push 0x1002b918
call fcn.1000cf90
mov ecx, dword [0x1002b910]
add esp, 4
test ecx, ecx
je 0x1000867a
mov eax, dword [ecx]
mov dword [0x1002b910], eax
mov dword [0x1002b918], 1
test ecx, ecx
jne 0x1000869f
push 0x10
push 0
call dword [0x1002106c]
push eax
call dword [0x10021068]
mov ecx, eax
test ecx, ecx
je 0x100086d1
xor eax, eax
mov dword [ecx + 4], 0
mov word [ecx + 0xc], ax
mov dword [ecx + 8], 0
mov dword [ecx], vtable.rg_hsh_jb::rg_dzhshl.0
mov eax, dword [esi + 4]
mov dword [ecx + 4], eax
mov eax, dword [esi + 8]
mov dword [ecx + 8], eax
mov ax, word [esi + 0xc]
mov word [ecx + 0xc], ax
mov eax, ecx
pop esi
ret
push 0xffffffffffffffff
call fcn.10012757
int3

Function at 0x10008990
Capabilities:
Terminate process

Disassembly:
cmp dword [0x1002b914], 0x10
jl 0x100089c5
push 0x1002b918
call fcn.1000cf90
mov ecx, dword [0x1002b910]
add esp, 4
test ecx, ecx
je 0x100089b7
mov eax, dword [ecx]
mov dword [0x1002b910], eax
mov dword [0x1002b918], 1
test ecx, ecx
jne 0x100089dc
push 0x10
push 0
call dword [0x1002106c]
push eax
call dword [0x10021068]
mov ecx, eax
test ecx, ecx
je 0x100089f7
mov dword [ecx + 4], 0
mov eax, ecx
mov dword [ecx + 8], 0
mov dword [ecx], vtable.rg_hsh_jb::rg_zjl.0
mov byte [ecx + 0xc], 0
ret
push 0xffffffffffffffff
call fcn.10012757
int3

Function at 0x10008ad0
Capabilities:
Terminate process

Disassembly:
cmp dword [0x1002b914], 0x10
push esi
mov esi, ecx
jl 0x10008b08
push 0x1002b918
call fcn.1000cf90
mov ecx, dword [0x1002b910]
add esp, 4
test ecx, ecx
je 0x10008afa
mov eax, dword [ecx]
mov dword [0x1002b910], eax
mov dword [0x1002b918], 1
test ecx, ecx
jne 0x10008b1f
push 0x10
push 0
call dword [0x1002106c]
push eax
call dword [0x10021068]
mov ecx, eax
test ecx, ecx
je 0x10008b4d
mov dword [ecx + 4], 0
mov dword [ecx + 8], 0
mov byte [ecx + 0xc], 0
mov dword [ecx], vtable.rg_hsh_jb::rg_zjl.0
mov eax, dword [esi + 4]
mov dword [ecx + 4], eax
mov eax, dword [esi + 8]
mov dword [ecx + 8], eax
mov al, byte [esi + 0xc]
mov byte [ecx + 0xc], al
mov eax, ecx
pop esi
ret
push 0xffffffffffffffff
call fcn.10012757
int3

Function at 0x10008f90
Capabilities:
Terminate process

Disassembly:
cmp dword [0x1002b914], 0xc
jl 0x10008fc5
push 0x1002b918
call fcn.1000cf90
mov ecx, dword [0x1002b910]
add esp, 4
test ecx, ecx
je 0x10008fb7
mov eax, dword [ecx]
mov dword [0x1002b910], eax
mov dword [0x1002b918], 1
test ecx, ecx
jne 0x10008fdc
push 0xc
push 0
call dword [0x1002106c]
push eax
call dword [0x10021068]
mov ecx, eax
test ecx, ecx
je 0x10008ff3
mov dword [ecx + 4], 0
mov eax, ecx
mov dword [ecx + 8], 0
mov dword [ecx], vtable.CVolBaseDataType.0
ret
push 0xffffffffffffffff
call fcn.10012757
int3
Function at 0x10009000
Capabilities:
Terminate process

Disassembly:
cmp dword [0x1002b914], 0xc
push esi
mov esi, ecx
jl 0x10009038
push 0x1002b918
call fcn.1000cf90
mov ecx, dword [0x1002b910]
add esp, 4
test ecx, ecx
je 0x1000902a
mov eax, dword [ecx]
mov dword [0x1002b910], eax
mov dword [0x1002b918], 1
test ecx, ecx
jne 0x1000904f
push 0xc
push 0
call dword [0x1002106c]
push eax
call dword [0x10021068]
mov ecx, eax
test ecx, ecx
je 0x10009073
mov dword [ecx + 4], 0
mov dword [ecx + 8], 0
mov dword [ecx], vtable.CVolBaseDataType.0
mov eax, dword [esi + 4]
mov dword [ecx + 4], eax
mov eax, dword [esi + 8]
mov dword [ecx + 8], eax
mov eax, ecx
pop esi
ret
push 0xffffffffffffffff
call fcn.10012757
int3

Function at 0x100095d0
Capabilities:
Terminate process

Disassembly:
cmp dword [0x1002b914], 0xc
push esi
mov esi, ecx
jl 0x10009608
push 0x1002b918
call fcn.1000cf90
mov ecx, dword [0x1002b910]
add esp, 4
test ecx, ecx
je 0x100095fa
mov eax, dword [ecx]
mov dword [0x1002b910], eax
mov dword [0x1002b918], 1
test ecx, ecx
jne 0x1000961f
push 0xc
push 0
call dword [0x1002106c]
push eax
call dword [0x10021068]
mov ecx, eax
test ecx, ecx
je 0x10009649
mov dword [ecx + 4], 0
mov dword [ecx + 8], 0
mov dword [0x1002b938], ecx
mov dword [ecx], vtable.rg_hsh_jb::rg_chxl.0
mov eax, dword [esi + 4]
mov dword [ecx + 4], eax
mov eax, dword [esi + 8]
mov dword [ecx + 8], eax
mov eax, ecx
pop esi
ret
push 0xffffffffffffffff
call fcn.10012757
int3

Function at 0x10009840
Capabilities:
Terminate process

Disassembly:
cmp dword [0x1002b914], 0xc
push esi
mov esi, ecx
jl 0x10009878
push 0x1002b918
call fcn.1000cf90
mov ecx, dword [0x1002b910]
add esp, 4
test ecx, ecx
je 0x1000986a
mov eax, dword [ecx]
mov dword [0x1002b910], eax
mov dword [0x1002b918], 1
test ecx, ecx
jne 0x1000988f
push 0xc
push 0
call dword [0x1002106c]
push eax
call dword [0x10021068]
mov ecx, eax
test ecx, ecx
je 0x100098b9
mov dword [ecx + 4], 0
mov dword [ecx + 8], 0
mov dword [0x1002b938], ecx
mov dword [ecx], vtable.rg_hsh_jb::rg_dtkchxl.0
mov eax, dword [esi + 4]
mov dword [ecx + 4], eax
mov eax, dword [esi + 8]
mov dword [ecx + 8], eax
mov eax, ecx
pop esi
ret
push 0xffffffffffffffff
call fcn.10012757
int3
Function at 0x10009a30
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
push esi
sub eax, 0
je 0x10009aea
sub eax, 1
jne 0x10009b63
mov eax, dword fs:[0x2c]
mov ecx, dword [0x1002c13c]
mov esi, dword [eax + ecx*4]
mov eax, dword [0x1002c92c]
cmp eax, dword [esi + 4]
jg 0x10009b6d
mov eax, dword [ebp + 8]
push 2
push 0
mov dword [0x1002b95c], eax
mov dword [0x1002b960], 0
mov dword [0x1002b964], 0
call dword [0x100211f0]
xor ecx, ecx
test eax, eax
setns cl
mov dword [0x1002b93c], ecx
call dword [0x1002c91c]
mov ecx, dword [0x1002c968]
mov edx, eax
mov dword [0x1002b938], edx
cmp ecx, dword [esi + 4]
jg 0x10009bad
jmp 0x10009ac4
mov edx, dword [0x1002b938]
mov eax, dword [edx]
mov ecx, edx
push 0x1002c96c
mov eax, dword [eax + 0x34]
call eax
test eax, eax
je 0x10009bed
call fcn.100099e0
neg eax
pop esi
sbb eax, eax
neg eax
pop ebp
ret 0xc
mov esi, dword [0x1002b938]
push edi
mov edi, dword [esi]
call fcn.10002720
push eax
mov eax, dword [edi + 0x34]
mov ecx, esi
call eax
pop edi
test eax, eax
je 0x10009b10
mov ecx, dword [0x1002b938]
mov eax, dword [ecx]
call dword [eax + 0x44]
mov ecx, dword [0x1002b938]
test ecx, ecx
je 0x10009b29
mov eax, dword [ecx]
call dword [eax + 0x30]
mov dword [0x1002b938], 0
mov ecx, 0x1002b91c
call fcn.1000b8e0
push 0x1002b940
call dword [0x1002112c]
mov eax, dword [0x1002b958]
test eax, eax
je 0x10009b58
push eax
call dword [0x100211c8]
mov dword [0x1002b958], 0
push 0x1002b940
call dword [0x10021128]
mov eax, 1
pop esi
pop ebp
ret 0xc
push 0x1002c92c
call fcn.1000e0fd
add esp, 4
cmp dword [0x1002c92c], 0xffffffff
jne 0x10009a69
push method.rg_hsh_chx::rg_qdl.virtual_28
push str.rg_hsh_chx::rg_qdl
mov ecx, 0x1002c91c
call fcn.100024d0
push 0x1002c92c
call fcn.1000e0b3
add esp, 4
jmp 0x10009a69
push 0x1002c968
call fcn.1000e0fd
add esp, 4
cmp dword [0x1002c968], 0xffffffff
jne 0x10009abe
push method.CVolUserApp.virtual_28
push 0x10026e24
mov ecx, 0x1002c96c
call fcn.100024d0
push 0x1002c968
call fcn.1000e0b3
add esp, 4
jmp 0x10009abe
mov ecx, dword [0x1002b938]
mov eax, dword [ecx]
call dword [eax + 0x30]
push 0xffffffffffffffff
call fcn.10012757
int3
Function at 0x1000a680
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1001fb5d
mov eax, dword fs:[0]
push eax
sub esp, 0x74
mov eax, dword [0x1002b00c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov eax, dword [esi]
test eax, eax
je 0x1000a6f1
push eax
mov dword [esi], 0
mov dword [esi + 4], 0
mov dword [esi + 8], 0
mov dword [esi + 0xc], 0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
mov dword [esi + 0x18], 0
mov dword [esi + 0x1c], 0
call dword [0x1002103c]
mov dword [ebp - 0x7c], 0
mov dword [ebp - 0x78], 0
mov dword [ebp - 0x80], vtable.CVolMem.0
mov dword [ebp - 0x74], 0
mov dword [ebp - 0x6c], 0
mov dword [ebp - 0x70], 0
mov dword [ebp - 0x68], 0x40
push 0x440
mov ecx, 0x1002b904
mov dword [ebp - 4], 0
call fcn.1000cff0
mov edi, eax
test edi, edi
je 0x1000a8c9
mov eax, dword [ebp + 8]
mov ebx, dword [ebp + 0xc]
mov dword [ebp - 0x74], edi
mov dword [ebp - 0x70], 0x440
mov dword [ebp - 0x6c], 0x428
mov dword [edi + 0x14], 0
mov dword [edi + 0x18], 0
mov dword [edi + 0x1c], 0
mov dword [edi + 0x20], 0
mov dword [edi + 0x24], 0
mov dword [edi + 4], eax
mov eax, 1
mov word [edi + 0xc], ax
mov eax, dword [ebp + 0x10]
mov dword [edi], 0x28
mov dword [edi + 8], ebx
mov word [edi + 0xe], ax
mov dword [edi + 0x10], 0
cmp eax, 8
jg 0x1000a7b7
push 0x400
lea eax, [edi + 0x28]
push 0
push eax
call fcn.1000fa30
add esp, 0xc
push 0
push 0
lea eax, [esi + 4]
push eax
push 0
push edi
push 0
call dword [0x10021028]
test eax, eax
jne 0x1000a7d5
xor esi, esi
jmp 0x1000a889
lea ecx, [ebp - 0x64]
sar ebx, 0x1f
push ecx
push 0x54
push eax
mov dword [esi], eax
add ebx, 2
call dword [0x10021038]
cmp eax, 0x54
jne 0x1000a84e
mov eax, dword [ebp - 0x48]
movzx ecx, word [ebp - 0x3e]
mov dword [esi + 8], eax
mov eax, dword [ebp - 0x44]
cdq
mov edi, eax
mov dword [esi + 0x14], ecx
mov eax, dword [esi + 8]
xor edi, edx
imul eax, ecx
sub edi, edx
mov ecx, dword [ebp - 0x50]
mov dword [esi + 0x1c], 1
mov dword [esi + 0xc], edi
mov dword [esi + 4], ecx
add eax, 0x1f
cdq
and edx, 0x1f
add edx, eax
sar edx, 5
shl edx, 2
mov dword [esi + 0x10], edx
test ebx, ebx
jne 0x1000a839
cmp dword [ebp - 0x44], ebx
setg bl
inc ebx
cmp ebx, 2
jne 0x1000a876
lea eax, [edi - 1]
imul eax, edx
add dword [esi + 4], eax
neg edx
mov dword [esi + 0x10], edx
jmp 0x1000a876
mov eax, dword [ebp - 0x60]
mov dword [esi + 8], eax
mov eax, dword [ebp - 0x5c]
mov dword [esi + 0xc], eax
movzx eax, word [ebp - 0x52]
mov dword [esi + 0x1c], 0
mov dword [esi + 0x14], eax
mov dword [esi + 0x10], 0
mov dword [esi + 4], 0
xor eax, eax
mov ecx, 1
test byte [ebp + 0x1c], 1
cmovne eax, ecx
mov dword [esi + 0x18], eax
mov esi, ecx
mov dword [ebp - 4], 2
mov edx, dword [ebp - 0x74]
mov dword [ebp - 0x80], vtable.CVolMem.0
test edx, edx
je 0x1000a8a9
push edx
mov ecx, 0x1002b904
call fcn.1000d0e0
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1000dfdd
mov esp, ebp
pop ebp
ret 0x18
push 0xffffffffffffffff
call fcn.10012757
int3
Function at 0x1000aa10
Capabilities:
Terminate process

Disassembly:
cmp dword [0x1002b914], 0xc
push esi
mov esi, ecx
jl 0x1000aa48
push 0x1002b918
call fcn.1000cf90
mov ecx, dword [0x1002b910]
add esp, 4
test ecx, ecx
je 0x1000aa3a
mov eax, dword [ecx]
mov dword [0x1002b910], eax
mov dword [0x1002b918], 1
test ecx, ecx
jne 0x1000aa5f
push 0xc
push 0
call dword [0x1002106c]
push eax
call dword [0x10021068]
mov ecx, eax
test ecx, ecx
je 0x1000aa89
mov dword [ecx + 4], 0
mov dword [ecx + 8], 0
mov dword [0x1002b938], ecx
mov dword [ecx], vtable.CVolUserApp.0
mov eax, dword [esi + 4]
mov dword [ecx + 4], eax
mov eax, dword [esi + 8]
mov dword [ecx + 8], eax
mov eax, ecx
pop esi
ret
push 0xffffffffffffffff
call fcn.10012757
int3
Function at 0x1000b710
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
cmp esi, dword [0x1002b914]
jg 0x1000b74b
push 0x1002b918
call fcn.1000cf90
mov ecx, dword [0x1002b910]
add esp, 4
test ecx, ecx
je 0x1000b73d
mov eax, dword [ecx]
mov dword [0x1002b910], eax
mov dword [0x1002b918], 1
test ecx, ecx
jne 0x1000b761
push esi
push 0
call dword [0x1002106c]
push eax
call dword [0x10021068]
mov ecx, eax
test ecx, ecx
je 0x1000b768
mov eax, ecx
pop esi
pop ebp
ret 4
push 0xffffffffffffffff
call fcn.10012757
int3

Function at 0x1000b7d0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
cmp esi, dword [0x1002b908]
jb 0x1000b844
cmp esi, dword [0x1002b90c]
jae 0x1000b844
mov eax, dword [ebp + 0xc]
cmp eax, dword [0x1002b914]
jle 0x1000b859
push edi
push eax
push 0
call dword [0x1002106c]
push eax
call dword [0x10021068]
mov edi, eax
test edi, edi
je 0x1000b85d
push dword [0x1002b914]
push esi
push edi
call fcn.10011710
push 0x1002b918
call fcn.1000cf90
mov eax, dword [0x1002b910]
add esp, 0x10
mov dword [esi], eax
mov dword [0x1002b910], esi
mov esi, edi
mov dword [0x1002b918], 1
pop edi
mov eax, esi
pop esi
pop ebp
ret 8
push dword [ebp + 0xc]
push esi
push 0
call dword [0x1002106c]
push eax
call dword [0x10021064]
mov esi, eax
test esi, esi
jne 0x1000b83d
push 0xffffffffffffffff
call fcn.10012757
int3
Function at 0x10033c80
Capabilities:
Encode data using base64

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0x10]
mov edx, dword [ebp + 0xc]
sub esp, 0x4c
push ebx
mov ebx, dword [ebp + 8]
test ebx, ebx
je 0x10033d8c
test eax, eax
je 0x10033d8c
push esi
push edi
mov ecx, 0x10
mov esi, 0x1004eff0
lea edi, [ebp - 0x4c]
rep movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
mov esi, dword [ebp + 0x14]
mov esi, dword [esi]
add esi, eax
mov dword [ebp - 8], esi
xor esi, esi
mov dword [ebp - 4], 0
mov ecx, eax
test edx, edx
jbe 0x10033d73
lea edi, [eax + 4]
jmp 0x10033cd7
mov ebx, dword [ebp + 8]
movzx eax, byte [esi + ebx]
inc esi
shl eax, 0x10
cmp esi, edx
jne 0x10033cec
mov dword [ebp - 4], 2
jmp 0x10033d0d
movzx ebx, byte [esi + ebx]
shl ebx, 8
inc esi
or eax, ebx
cmp esi, edx
jne 0x10033d03
mov dword [ebp - 4], 1
jmp 0x10033d0d
mov edx, dword [ebp + 8]
movzx edx, byte [esi + edx]
or eax, edx
inc esi
mov edx, eax
and edx, 0x3f
cmp edi, dword [ebp - 8]
ja 0x10033d83
mov ebx, eax
shr ebx, 0x12
and ebx, 0x3f
movzx ebx, byte [ebp + ebx - 0x4c]
mov byte [ecx], bl
mov ebx, eax
shr ebx, 0xc
and ebx, 0x3f
movzx ebx, byte [ebp + ebx - 0x4c]
inc ecx
inc edi
mov byte [ecx], bl
mov ebx, dword [ebp - 4]
inc ecx
inc edi
cmp ebx, 1
jbe 0x10033d46
mov byte [ecx], 0x3d
jmp 0x10033d52
shr eax, 6
and eax, 0x3f
mov al, byte [ebp + eax - 0x4c]
mov byte [ecx], al
inc ecx
inc edi
test ebx, ebx
jbe 0x10033d5d
mov byte [ecx], 0x3d
jmp 0x10033d63
mov dl, byte [ebp + edx - 0x4c]
mov byte [ecx], dl
mov edx, dword [ebp + 0xc]
inc ecx
inc edi
cmp esi, edx
jb 0x10033cd4
mov eax, dword [ebp + 0x10]
sub ecx, eax
mov eax, dword [ebp + 0x14]
pop edi
pop esi
mov dword [eax], ecx
mov al, 1
pop ebx
mov esp, ebp
pop ebp
ret
pop edi
pop esi
xor al, al
pop ebx
mov esp, ebp
pop ebp
ret
xor al, al
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1000a275
Capabilities:
Accept command line arguments

Disassembly:
push 0x6c
mov eax, 0x10062d42
call fcn.1004adf3
mov esi, ecx
mov dword [ebp - 0x78], esi
call fcn.10002f29
xor ecx, ecx
xor eax, eax
mov dword [ebp - 4], ecx
push 7
mov byte [esi + 0x18], cl
pop edx
mov dword [esi + 0x30], edx
mov dword [esi + 0x2c], ecx
mov word [esi + 0x1c], ax
mov dword [esi + 0x48], edx
mov dword [esi + 0x44], ecx
mov word [esi + 0x34], ax
mov byte [ebp - 4], 2
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
push eax
lea ecx, [ebp - 0x58]
call fcn.10002e3f
sub esp, 0xc
mov byte [ebp - 4], 3
lea edx, [ebp - 0x58]
mov ecx, esp
call fcn.1001248b
lea ecx, [ebp - 0x74]
call fcn.1000a566
push eax
mov ecx, esi
mov byte [ebp - 4], 4
call fcn.1000a6b2
lea ecx, [ebp - 0x74]
call fcn.10003dd2
push 0
push 1
lea ecx, [ebp - 0x58]
mov byte [ebp - 4], 2
call fcn.10003109
cmp dword [esi + 0x14], 0
je 0x1000a49a
push 0
mov ecx, esi
call fcn.1000923d
push eax
lea ecx, [ebp - 0x40]
call fcn.10002e17
sub esp, 0x18
mov byte [ebp - 4], 5
mov ecx, esp
push str.__n_r_t
call fcn.10002e3f
or edx, 0xffffffff
lea ecx, [ebp - 0x40]
call fcn.10012a10
add esp, 0x18
lea eax, [ebp - 0x40]
lea ecx, [esi + 0x1c]
push eax
call fcn.100080f0
xor edi, edi
mov dword [ebp - 0x14], 7
xor eax, eax
mov dword [ebp - 0x18], edi
mov word [ebp - 0x28], ax
push str._b_a
lea ecx, [ebp - 0x58]
mov byte [ebp - 4], 6
call fcn.10002e3f
lea edx, [ebp - 0x58]
mov byte [ebp - 4], 7
lea ecx, [ebp - 0x74]
call fcn.1000c43d
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 8
push ecx
push eax
mov ecx, esi
call fcn.1000a4a2
push edi
push 1
lea ecx, [ebp - 0x74]
call fcn.10003109
push edi
inc edi
mov byte [ebp - 4], 6
push edi
lea ecx, [ebp - 0x58]
call fcn.10003109
lea eax, [ebp - 0x28]
push eax
lea ecx, [esi + 0x34]
call fcn.100080f0
push 0x10076e24
lea ecx, [ebp - 0x58]
call fcn.10002e3f
lea edx, [ebp - 0x58]
mov byte [ebp - 4], 9
lea ecx, [ebp - 0x74]
call fcn.1000c43d
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 0xa
push ecx
push eax
mov ecx, esi
call fcn.1000a4a2
xor ebx, ebx
mov byte [esi + 0x4c], al
push ebx
push edi
lea ecx, [ebp - 0x74]
call fcn.10003109
push ebx
mov byte [ebp - 4], 6
lea ecx, [ebp - 0x58]
push edi
call fcn.10003109
push str._.Xa
lea ecx, [ebp - 0x58]
call fcn.10002e3f
lea edx, [ebp - 0x58]
mov byte [ebp - 4], 0xb
lea ecx, [ebp - 0x74]
call fcn.1000c43d
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 0xc
push ecx
push eax
mov ecx, esi
call fcn.1000a4a2
push ebx
push edi
lea ecx, [ebp - 0x74]
mov byte [esi + 0x4d], al
call fcn.10003109
push ebx
push edi
lea ecx, [ebp - 0x58]
mov byte [ebp - 4], 6
call fcn.10003109
push str.:2_a
lea ecx, [ebp - 0x58]
call fcn.10002e3f
lea edx, [ebp - 0x58]
mov byte [ebp - 4], 0xd
lea ecx, [ebp - 0x74]
call fcn.1000c43d
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 0xe
push ecx
push eax
mov ecx, esi
call fcn.1000a4a2
push ebx
push edi
lea ecx, [ebp - 0x74]
mov byte [esi + 0x4e], al
call fcn.10003109
push ebx
push edi
lea ecx, [ebp - 0x58]
call fcn.10003109
push ebx
push 1
lea ecx, [ebp - 0x28]
mov byte [esi + 0x18], 1
call fcn.10003109
push ebx
push 1
lea ecx, [ebp - 0x40]
call fcn.10003109
mov eax, esi
call fcn.1004ada2
ret
Function at 0x1000eaf7
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 8]
mov eax, dword [ebp + 0xc]
push ebx
push esi
add eax, edx
xor ebx, ebx
push edi
mov esi, eax
mov edi, ecx
sub esi, edx
xor ecx, ecx
cmp edx, eax
cmova esi, ecx
test esi, esi
je 0x1000eb33
mov al, byte [edi]
xor al, byte [edx]
mov ecx, dword [edi]
movzx eax, al
shr ecx, 8
xor ecx, dword [eax*4 + 0x1008af60]
inc edx
inc ebx
mov dword [edi], ecx
cmp ebx, esi
jb 0x1000eb18
pop edi
pop esi
pop ebx
pop ebp
ret 8

Function at 0x1000eb3a
Capabilities:
Hash data using crc32b

Disassembly:
cmp byte [0x1008af59], 0
jne 0x1000ebba
push ebx
push esi
push edi
xor bl, bl
xor edx, edx
mov al, 0x80
test bl, al
je 0x1000eb56
xor edx, 0x80000000
test edx, edx
jns 0x1000eb64
add edx, edx
xor edx, 0x4c11db7
jmp 0x1000eb66
add edx, edx
shr al, 1
jne 0x1000eb4c
xor edi, edi
xor esi, esi
test dl, 1
je 0x1000eb7f
push 0x1f
xor eax, eax
pop ecx
sub ecx, esi
inc eax
shl eax, cl
or edi, eax
inc esi
shr edx, 1
cmp esi, 0x20
jb 0x1000eb6e
push 7
pop ecx
push 8
mov dl, bl
xor ah, ah
pop esi
test dl, 1
je 0x1000eb9c
mov al, 1
shl al, cl
or ah, al
dec ecx
shr dl, 1
dec esi
jne 0x1000eb91
movzx eax, ah
mov dword [eax*4 + 0x1008af60], edi
inc bl
jne 0x1000eb48
pop edi
pop esi
mov byte [0x1008af59], 1
pop ebx
ret

Function at 0x100125fc
Capabilities:
Accept command line arguments

Disassembly:
push 0x3c
mov eax, 0x10063ed5
call fcn.1004ae5f
mov esi, ecx
xor edi, edi
mov dword [ebp - 0x44], esi
mov dword [ebp - 0x48], edi
mov dword [ebp - 0x3c], edi
mov dword [ebp - 0x38], edi
mov dword [ebp - 0x34], edi
mov dword [ebp - 4], edi
cmp dword [edx + 0x10], edi
je 0x100126a9
cmp dword [edx + 0x14], 8
mov dword [ebp - 0x40], edi
jb 0x10012632
mov edx, dword [edx]
lea eax, [ebp - 0x40]
push eax
push edx
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
mov ebx, eax
test ebx, ebx
je 0x100126a9
mov ecx, dword [ebp - 0x40]
test ecx, ecx
je 0x100126a9
mov byte [ebp - 4], 1
cmp edi, ecx
jge 0x100126a2
push dword [ebx + edi*4]
lea ecx, [ebp - 0x30]
call fcn.10002e3f
lea eax, [ebp - 0x30]
mov byte [ebp - 4], 2
push eax
lea ecx, [ebp - 0x3c]
call fcn.1001303f
push 0
push 1
lea ecx, [ebp - 0x30]
mov byte [ebp - 4], 1
call fcn.10003109
mov ecx, dword [ebp - 0x40]
inc edi
jmp 0x1001264e
push ebx
call dword [sym.imp.KERNEL32.dll_LocalFree]
lea eax, [ebp - 0x3c]
mov ecx, esi
push eax
call fcn.1001922f
lea ecx, [ebp - 0x3c]
call fcn.10008416
mov eax, esi
call fcn.1004adb1
ret