joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10001350
Capabilities:
Resolve function by fnv-1a hash

Disassembly:
push ebp
mov ebp, esp
cmp dword [0x10339bbc], 0
jne 0x10001376
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
push 0x3285501
call fcn.1005d340
add esp, 0xc
mov dword [0x10339bbc], eax
mov eax, dword [0x10339bbc]
pop ebp
ret

Function at 0x10001440
Capabilities:
Resolve function by fnv-1a hash

Disassembly:
push ebp
mov ebp, esp
cmp dword [0x10339bac], 0
jne 0x10001466
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
push 0x53b2070f
call fcn.1005d340
add esp, 0xc
mov dword [0x10339bac], eax
mov eax, dword [0x10339bac]
pop ebp
ret

Function at 0x10001560
Capabilities:
Resolve function by fnv-1a hash

Disassembly:
push ebp
mov ebp, esp
cmp dword [0x10339be4], 0
jne 0x10001586
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
push 0xafcab3c4
call fcn.1005d340
add esp, 0xc
mov dword [0x10339be4], eax
mov eax, dword [0x10339be4]
pop ebp
ret

Function at 0x100016b0
Capabilities:
Resolve function by fnv-1a hash

Disassembly:
push ebp
mov ebp, esp
cmp dword [0x10339bb0], 0
jne 0x100016d6
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
push 0xf8f45725
call fcn.1005d340
add esp, 0xc
mov dword [0x10339bb0], eax
mov eax, dword [0x10339bb0]
pop ebp
ret

Function at 0x100016e0
Capabilities:
Resolve function by fnv-1a hash

Disassembly:
push ebp
mov ebp, esp
cmp dword [0x10339bec], 0
jne 0x10001706
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
push 0xfaba0065
call fcn.1005d340
add esp, 0xc
mov dword [0x10339bec], eax
mov eax, dword [0x10339bec]
pop ebp
ret

Function at 0x100022c0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100ae213
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x20
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0x14], 0x15
mov byte [ebp - 0x2c], 0x70
mov byte [ebp - 0x2b], 0xe9
mov byte [ebp - 0x2a], 0x3d
mov byte [ebp - 0x29], 0x3b
mov byte [ebp - 0x28], 0x50
mov byte [ebp - 0x27], 0x78
mov byte [ebp - 0x26], 0x50
mov byte [ebp - 0x25], 0x6c
mov byte [ebp - 0x24], 0x53
mov byte [ebp - 0x23], 0xbd
mov byte [ebp - 0x22], 0x18
mov byte [ebp - 0x21], 0x6c
mov byte [ebp - 0x20], 0x34
mov byte [ebp - 0x1f], 0x39
mov byte [ebp - 0x1e], 0x6a
mov byte [ebp - 0x1d], 0x4f
mov byte [ebp - 0x1c], 0x7d
mov byte [ebp - 0x1b], 0x82
mov byte [ebp - 0x1a], 0x18
mov byte [ebp - 0x19], 0x4e
mov byte [ebp - 0x18], 1
mov eax, dword [0x103399d4]
and eax, 1
jne 0x1000237b
mov ecx, dword [0x103399d4]
or ecx, 1
mov dword [0x103399d4], ecx
mov dword [ebp - 4], 0
lea edx, [ebp - 0x2c]
push edx
mov ecx, 0x103399bc
call fcn.10001910
push 0x100ae660
call fcn.100a2598
add esp, 4
mov dword [ebp - 4], 0xffffffff
mov eax, 0x103399bc
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
Function at 0x100025a0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100ae293
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x1c
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0x14], 0x13
mov byte [ebp - 0x28], 0xdc
mov byte [ebp - 0x27], 0xee
mov byte [ebp - 0x26], 0x2a
mov byte [ebp - 0x25], 0x61
mov byte [ebp - 0x24], 0x6e
mov byte [ebp - 0x23], 0x72
mov byte [ebp - 0x22], 0x6e
mov byte [ebp - 0x21], 0x67
mov byte [ebp - 0x20], 0xe5
mov byte [ebp - 0x1f], 0xaa
mov byte [ebp - 0x1e], 0x1e
mov byte [ebp - 0x1d], 0x5d
mov byte [ebp - 0x1c], 0x52
mov byte [ebp - 0x1b], 0x2e
mov byte [ebp - 0x1a], 0x30
mov byte [ebp - 0x19], 0x30
mov byte [ebp - 0x18], 0xbf
mov byte [ebp - 0x17], 0xb7
mov byte [ebp - 0x16], 0x49
mov eax, dword [0x10339b40]
and eax, 1
jne 0x10002653
mov ecx, dword [0x10339b40]
or ecx, 1
mov dword [0x10339b40], ecx
mov dword [ebp - 4], 0
lea edx, [ebp - 0x28]
push edx
mov ecx, 0x10339b2c
call fcn.10001890
push 0x100ae6a0
call fcn.100a2598
add esp, 4
mov dword [ebp - 4], 0xffffffff
mov eax, 0x10339b2c
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret

Function at 0x10002900
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100ae2b3
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x14
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0x14], 0xc
mov byte [ebp - 0x20], 0x44
mov byte [ebp - 0x1f], 0x48
mov byte [ebp - 0x1e], 1
mov byte [ebp - 0x1d], 0x78
mov byte [ebp - 0x1c], 0x6f
mov byte [ebp - 0x1b], 0x64
mov byte [ebp - 0x1a], 0x75
mov byte [ebp - 0x19], 0x2f
mov byte [ebp - 0x18], 0x77
mov byte [ebp - 0x17], 0x4d
mov byte [ebp - 0x16], 3
mov byte [ebp - 0x15], 0x11
mov eax, dword [0x10339a84]
and eax, 1
jne 0x10002997
mov ecx, dword [0x10339a84]
or ecx, 1
mov dword [0x10339a84], ecx
mov dword [ebp - 4], 0
lea edx, [ebp - 0x20]
push edx
mov ecx, 0x10339a74
call fcn.10001b10
push 0x100ae6b0
call fcn.100a2598
add esp, 4
mov dword [ebp - 4], 0xffffffff
mov eax, 0x10339a74
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret

Function at 0x10002be0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100ae2d3
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x14
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0x14], 0xb
mov byte [ebp - 0x20], 0x80
mov byte [ebp - 0x1f], 0x4e
mov byte [ebp - 0x1e], 0x38
mov byte [ebp - 0x1d], 0x5d
mov byte [ebp - 0x1c], 0x32
mov byte [ebp - 0x1b], 0x33
mov byte [ebp - 0x1a], 0x2f
mov byte [ebp - 0x19], 0x65
mov byte [ebp - 0x18], 0xb9
mov byte [ebp - 0x17], 0x71
mov byte [ebp - 0x16], 0x7d
mov eax, dword [0x10339a94]
and eax, 1
jne 0x10002c73
mov ecx, dword [0x10339a94]
or ecx, 1
mov dword [0x10339a94], ecx
mov dword [ebp - 4], 0
lea edx, [ebp - 0x20]
push edx
mov ecx, 0x10339a88
call fcn.10001a90
push 0x100ae6c0
call fcn.100a2598
add esp, 4
mov dword [ebp - 4], 0xffffffff
mov eax, 0x10339a88
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
Function at 0x10003000
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100ae333
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x18
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0x14], 0xd
mov byte [ebp - 0x24], 0x66
mov byte [ebp - 0x23], 0x59
mov byte [ebp - 0x22], 0xe5
mov byte [ebp - 0x21], 0x41
mov byte [ebp - 0x20], 0x51
mov byte [ebp - 0x1f], 0x40
mov byte [ebp - 0x1e], 0x51
mov byte [ebp - 0x1d], 0x48
mov byte [ebp - 0x1c], 1
mov byte [ebp - 0x1b], 0x4d
mov byte [ebp - 0x1a], 0xe1
mov byte [ebp - 0x19], 0x41
mov byte [ebp - 0x18], 1
mov eax, dword [0x10339acc]
and eax, 1
jne 0x1000309b
mov ecx, dword [0x10339acc]
or ecx, 1
mov dword [0x10339acc], ecx
mov dword [ebp - 4], 0
lea edx, [ebp - 0x24]
push edx
mov ecx, 0x10339abc
call fcn.10001b90
push 0x100ae6f0
call fcn.100a2598
add esp, 4
mov dword [ebp - 4], 0xffffffff
mov eax, 0x10339abc
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret

Function at 0x100030b0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100ae353
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x38
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0x14], 0x2f
mov byte [ebp - 0x44], 0xa5
mov byte [ebp - 0x43], 0x45
mov byte [ebp - 0x42], 0x9b
mov byte [ebp - 0x41], 0x6b
mov byte [ebp - 0x40], 0x72
mov byte [ebp - 0x3f], 0x3b
mov byte [ebp - 0x3e], 0x2e
mov byte [ebp - 0x3d], 0x2e
mov byte [ebp - 0x3c], 0xaf
mov byte [ebp - 0x3b], 0x50
mov byte [ebp - 0x3a], 0x9d
mov byte [ebp - 0x39], 0x6e
mov byte [ebp - 0x38], 0x6e
mov byte [ebp - 0x37], 0x71
mov byte [ebp - 0x36], 0x60
mov byte [ebp - 0x35], 0x72
mov byte [ebp - 0x34], 0xe3
mov byte [ebp - 0x33], 0x52
mov byte [ebp - 0x32], 0x80
mov byte [ebp - 0x31], 0x76
mov byte [ebp - 0x30], 0x2e
mov byte [ebp - 0x2f], 0x71
mov byte [ebp - 0x2e], 0x73
mov byte [ebp - 0x2d], 0x6e
mov byte [ebp - 0x2c], 0xa7
mov byte [ebp - 0x2b], 0x54
mov byte [ebp - 0x2a], 0x8c
mov byte [ebp - 0x29], 0x6f
mov byte [ebp - 0x28], 0x72
mov byte [ebp - 0x27], 0x2e
mov byte [ebp - 0x26], 0x74
mov byte [ebp - 0x25], 0x72
mov byte [ebp - 0x24], 0xa8
mov byte [ebp - 0x23], 0x43
mov byte [ebp - 0x22], 0x8e
mov byte [ebp - 0x21], 0x78
mov byte [ebp - 0x20], 0x62
mov byte [ebp - 0x1f], 0x6e
mov byte [ebp - 0x1e], 0x74
mov byte [ebp - 0x1d], 0x6f
mov byte [ebp - 0x1c], 0xb9
mov byte [ebp - 0x1b], 0x1f
mov byte [ebp - 0x1a], 0x8e
mov byte [ebp - 0x19], 0x68
mov byte [ebp - 0x18], 0x71
mov byte [ebp - 0x17], 0x79
mov byte [ebp - 0x16], 1
mov eax, dword [0x10339b74]
and eax, 1
jne 0x100031d3
mov ecx, dword [0x10339b74]
or ecx, 1
mov dword [0x10339b74], ecx
mov dword [ebp - 4], 0
lea edx, [ebp - 0x44]
push edx
mov ecx, 0x10339b44
call fcn.10001990
push 0x100ae700
call fcn.100a2598
add esp, 4
mov dword [ebp - 4], 0xffffffff
mov eax, 0x10339b44
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
Function at 0x100031f0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100ae373
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x14
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0x14], 0xc
mov byte [ebp - 0x20], 0x46
mov byte [ebp - 0x1f], 0x3b
mov byte [ebp - 0x1e], 0xd1
mov byte [ebp - 0x1d], 0x7c
mov byte [ebp - 0x1c], 0x60
mov byte [ebp - 0x1b], 0x71
mov byte [ebp - 0x1a], 0x68
mov byte [ebp - 0x19], 0x2f
mov byte [ebp - 0x18], 0x71
mov byte [ebp - 0x17], 0x3f
mov byte [ebp - 0x16], 0xd1
mov byte [ebp - 0x15], 0xb
mov eax, dword [0x10339ae0]
and eax, 1
jne 0x10003287
mov ecx, dword [0x10339ae0]
or ecx, 1
mov dword [0x10339ae0], ecx
mov dword [ebp - 4], 0
lea edx, [ebp - 0x20]
push edx
mov ecx, 0x10339ad0
call fcn.10001b10
push 0x100ae710
call fcn.100a2598
add esp, 4
mov dword [ebp - 4], 0xffffffff
mov eax, 0x10339ad0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret

Function at 0x100032a0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100ae393
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x38
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0x14], 0x2f
mov byte [ebp - 0x44], 0xa5
mov byte [ebp - 0x43], 0x75
mov byte [ebp - 0x42], 0x15
mov byte [ebp - 0x41], 0x7b
mov byte [ebp - 0x40], 0x72
mov byte [ebp - 0x3f], 0x3b
mov byte [ebp - 0x3e], 0x2e
mov byte [ebp - 0x3d], 0x2e
mov byte [ebp - 0x3c], 0xaf
mov byte [ebp - 0x3b], 0x60
mov byte [ebp - 0x3a], 0x13
mov byte [ebp - 0x39], 0x7e
mov byte [ebp - 0x38], 0x6e
mov byte [ebp - 0x37], 0x71
mov byte [ebp - 0x36], 0x60
mov byte [ebp - 0x35], 0x72
mov byte [ebp - 0x34], 0xe3
mov byte [ebp - 0x33], 0x62
mov byte [ebp - 0x32], 0xe
mov byte [ebp - 0x31], 0x66
mov byte [ebp - 0x30], 0x2e
mov byte [ebp - 0x2f], 0x71
mov byte [ebp - 0x2e], 0x73
mov byte [ebp - 0x2d], 0x6e
mov byte [ebp - 0x2c], 0xa7
mov byte [ebp - 0x2b], 0x64
mov byte [ebp - 0x2a], 2
mov byte [ebp - 0x29], 0x7f
mov byte [ebp - 0x28], 0x72
mov byte [ebp - 0x27], 0x2e
mov byte [ebp - 0x26], 0x74
mov byte [ebp - 0x25], 0x72
mov byte [ebp - 0x24], 0xa8
mov byte [ebp - 0x23], 0x73
mov byte [ebp - 0x22], 0
mov byte [ebp - 0x21], 0x68
mov byte [ebp - 0x20], 0x62
mov byte [ebp - 0x1f], 0x6e
mov byte [ebp - 0x1e], 0x74
mov byte [ebp - 0x1d], 0x6f
mov byte [ebp - 0x1c], 0xb9
mov byte [ebp - 0x1b], 0x2f
mov byte [ebp - 0x1a], 0
mov byte [ebp - 0x19], 0x78
mov byte [ebp - 0x18], 0x71
mov byte [ebp - 0x17], 0x79
mov byte [ebp - 0x16], 1
mov eax, dword [0x10339ba8]
and eax, 1
jne 0x100033c3
mov ecx, dword [0x10339ba8]
or ecx, 1
mov dword [0x10339ba8], ecx
mov dword [ebp - 4], 0
lea edx, [ebp - 0x44]
push edx
mov ecx, 0x10339b78
call fcn.10001990
push 0x100ae720
call fcn.100a2598
add esp, 4
mov dword [ebp - 4], 0xffffffff
mov eax, 0x10339b78
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
Function at 0x100033e0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100ae3b3
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x1c
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0x14], 0x12
mov byte [ebp - 0x28], 0x6f
mov byte [ebp - 0x27], 0x67
mov byte [ebp - 0x26], 0x17
mov byte [ebp - 0x25], 0x5b
mov byte [ebp - 0x24], 0x64
mov byte [ebp - 0x23], 0x66
mov byte [ebp - 0x22], 0x68
mov byte [ebp - 0x21], 0x72
mov byte [ebp - 0x20], 0x5f
mov byte [ebp - 0x1f], 0x6e
mov byte [ebp - 0x1e], 9
mov byte [ebp - 0x1d], 0x5a
mov byte [ebp - 0x1c], 0x64
mov byte [ebp - 0x1b], 0x73
mov byte [ebp - 0x1a], 0x77
mov byte [ebp - 0x19], 0x64
mov byte [ebp - 0x18], 0x59
mov byte [ebp - 0x17], 0xb
mov eax, dword [0x103399ec]
and eax, 1
jne 0x1000348f
mov ecx, dword [0x103399ec]
or ecx, 1
mov dword [0x103399ec], ecx
mov dword [ebp - 4], 0
lea edx, [ebp - 0x28]
push edx
mov ecx, 0x103399d8
call fcn.10001810
push 0x100ae730
call fcn.100a2598
add esp, 4
mov dword [ebp - 4], 0xffffffff
mov eax, 0x103399d8
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret

Function at 0x10003550
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100ae3f3
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x38
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0x14], 0x30
mov byte [ebp - 0x44], 0x2b
mov byte [ebp - 0x43], 0x7b
mov byte [ebp - 0x42], 0xf9
mov byte [ebp - 0x41], 0x79
mov byte [ebp - 0x40], 0x72
mov byte [ebp - 0x3f], 0x3b
mov byte [ebp - 0x3e], 0x2e
mov byte [ebp - 0x3d], 0x2e
mov byte [ebp - 0x3c], 0x21
mov byte [ebp - 0x3b], 0x63
mov byte [ebp - 0x3a], 0xf8
mov byte [ebp - 0x39], 0x6c
mov byte [ebp - 0x38], 0x75
mov byte [ebp - 0x37], 0x73
mov byte [ebp - 0x36], 0x64
mov byte [ebp - 0x35], 0x64
mov byte [ebp - 0x34], 0x34
mov byte [ebp - 0x33], 0x6e
mov byte [ebp - 0x32], 0xf9
mov byte [ebp - 0x31], 0x6c
mov byte [ebp - 0x30], 0x73
mov byte [ebp - 0x2f], 0x2f
mov byte [ebp - 0x2e], 0x62
mov byte [ebp - 0x2d], 0x6e
mov byte [ebp - 0x2c], 0x2e
mov byte [ebp - 0x2b], 0x20
mov byte [ebp - 0x2a], 0xe9
mov byte [ebp - 0x29], 0x68
mov byte [ebp - 0x28], 0x75
mov byte [ebp - 0x27], 0x60
mov byte [ebp - 0x26], 0x2e
mov byte [ebp - 0x25], 0x74
mov byte [ebp - 0x24], 0x30
mov byte [ebp - 0x23], 0x6a
mov byte [ebp - 0x22], 0xff
mov byte [ebp - 0x21], 0x68
mov byte [ebp - 0x20], 0x62
mov byte [ebp - 0x1f], 0x62
mov byte [ebp - 0x1e], 0x6e
mov byte [ebp - 0x1d], 0x74
mov byte [ebp - 0x1c], 0x2d
mov byte [ebp - 0x1b], 0x7b
mov byte [ebp - 0x1a], 0xa3
mov byte [ebp - 0x19], 0x68
mov byte [ebp - 0x18], 0x72
mov byte [ebp - 0x17], 0x71
mov byte [ebp - 0x16], 0x79
mov byte [ebp - 0x15], 1
mov eax, dword [0x10339a24]
and eax, 1
jne 0x10003677
mov ecx, dword [0x10339a24]
or ecx, 1
mov dword [0x10339a24], ecx
mov dword [ebp - 4], 0
lea edx, [ebp - 0x44]
push edx
mov ecx, 0x103399f0
call fcn.10001a10
push 0x100ae750
call fcn.100a2598
add esp, 4
mov dword [ebp - 4], 0xffffffff
mov eax, 0x103399f0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
Function at 0x10003740
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100ae433
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x38
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0x14], 0x30
mov byte [ebp - 0x44], 0x35
mov byte [ebp - 0x43], 0xbd
mov byte [ebp - 0x42], 0xff
mov byte [ebp - 0x41], 0x79
mov byte [ebp - 0x40], 0x72
mov byte [ebp - 0x3f], 0x3b
mov byte [ebp - 0x3e], 0x2e
mov byte [ebp - 0x3d], 0x2e
mov byte [ebp - 0x3c], 0x3f
mov byte [ebp - 0x3b], 0xa5
mov byte [ebp - 0x3a], 0xfe
mov byte [ebp - 0x39], 0x6c
mov byte [ebp - 0x38], 0x75
mov byte [ebp - 0x37], 0x73
mov byte [ebp - 0x36], 0x64
mov byte [ebp - 0x35], 0x64
mov byte [ebp - 0x34], 0x2a
mov byte [ebp - 0x33], 0xa8
mov byte [ebp - 0x32], 0xff
mov byte [ebp - 0x31], 0x6c
mov byte [ebp - 0x30], 0x73
mov byte [ebp - 0x2f], 0x2f
mov byte [ebp - 0x2e], 0x62
mov byte [ebp - 0x2d], 0x6e
mov byte [ebp - 0x2c], 0x30
mov byte [ebp - 0x2b], 0xe6
mov byte [ebp - 0x2a], 0xef
mov byte [ebp - 0x29], 0x68
mov byte [ebp - 0x28], 0x75
mov byte [ebp - 0x27], 0x60
mov byte [ebp - 0x26], 0x2e
mov byte [ebp - 0x25], 0x74
mov byte [ebp - 0x24], 0x2e
mov byte [ebp - 0x23], 0xac
mov byte [ebp - 0x22], 0xf9
mov byte [ebp - 0x21], 0x68
mov byte [ebp - 0x20], 0x62
mov byte [ebp - 0x1f], 0x62
mov byte [ebp - 0x1e], 0x6e
mov byte [ebp - 0x1d], 0x74
mov byte [ebp - 0x1c], 0x33
mov byte [ebp - 0x1b], 0xbd
mov byte [ebp - 0x1a], 0xa5
mov byte [ebp - 0x19], 0x68
mov byte [ebp - 0x18], 0x72
mov byte [ebp - 0x17], 0x71
mov byte [ebp - 0x16], 0x79
mov byte [ebp - 0x15], 1
mov eax, dword [0x10339a5c]
and eax, 1
jne 0x10003867
mov ecx, dword [0x10339a5c]
or ecx, 1
mov dword [0x10339a5c], ecx
mov dword [ebp - 4], 0
lea edx, [ebp - 0x44]
push edx
mov ecx, 0x10339a28
call fcn.10001a10
push 0x100ae770
call fcn.100a2598
add esp, 4
mov dword [ebp - 4], 0xffffffff
mov eax, 0x10339a28
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
Function at 0x1001acd0
Capabilities:
Parse pe header
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
mov eax, dword [ebp + 8]
mov dword [ebp - 0x18], eax
mov ecx, dword [ebp - 0x18]
movzx edx, word [ecx]
cmp edx, 0x5a4d
je 0x1001acf1
xor eax, eax
jmp 0x1001ae0d
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp + 8]
add ecx, dword [eax + 0x3c]
mov dword [ebp - 0x14], ecx
mov edx, dword [ebp - 0x14]
cmp dword [edx], 0x4550
je 0x1001ad0f
xor eax, eax
jmp 0x1001ae0d
mov eax, dword [ebp - 0x14]
movzx ecx, word [eax + 0x14]
cmp ecx, 0x60
jl 0x1001ad24
mov edx, dword [ebp - 0x14]
cmp dword [edx + 0x74], 0
jne 0x1001ad2b
xor eax, eax
jmp 0x1001ae0d
mov eax, 8
imul ecx, eax, 0
mov edx, dword [ebp - 0x14]
mov eax, dword [edx + ecx + 0x78]
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0
jne 0x1001ad4a
xor eax, eax
jmp 0x1001ae0d
mov ecx, dword [ebp + 8]
add ecx, dword [ebp - 0x1c]
mov dword [ebp - 0xc], ecx
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp + 8]
add eax, dword [edx + 0x24]
mov dword [ebp - 0x30], eax
mov ecx, dword [ebp - 0xc]
mov edx, dword [ebp + 8]
add edx, dword [ecx + 0x20]
mov dword [ebp - 0x24], edx
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp + 8]
add ecx, dword [eax + 0x1c]
mov dword [ebp - 0x34], ecx
mov dword [ebp - 0x10], 0
jmp 0x1001ad89
mov edx, dword [ebp - 0x10]
add edx, 1
mov dword [ebp - 0x10], edx
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x10]
cmp ecx, dword [eax + 0x18]
jae 0x1001ae0b
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x24]
mov ecx, dword [eax + edx*4]
mov dword [ebp - 0x28], ecx
mov edx, dword [ebp + 8]
add edx, dword [ebp - 0x28]
mov dword [ebp - 0x2c], edx
mov eax, dword [ebp - 0x2c]
push eax
call fcn.10051e50
add esp, 4
cmp eax, dword [ebp + 0xc]
je 0x1001adbc
jmp 0x1001ad80
mov ecx, dword [ebp - 0x10]
mov edx, dword [ebp - 0x30]
movzx eax, word [edx + ecx*2]
mov ecx, dword [ebp - 0xc]
movzx edx, word [ecx + 0x10]
add eax, edx
mov word [ebp - 4], ax
movzx eax, word [ebp - 4]
mov ecx, dword [ebp - 0xc]
movzx edx, word [ecx + 0x10]
sub eax, edx
mov word [ebp - 8], ax
mov dword [ebp - 0x20], 0
movzx eax, word [ebp - 8]
mov ecx, dword [ebp - 0x34]
mov edx, dword [ecx + eax*4]
mov dword [ebp - 0x20], edx
mov eax, dword [ebp + 8]
add eax, dword [ebp - 0x20]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x38]
jmp 0x1001ae0d
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x1005d360
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, 1
imul ecx, eax, 0
mov edx, dword [ebp + 8]
movsx eax, byte [edx + ecx]
test eax, eax
jne 0x1005d37f
mov ecx, dword [ebp + 0xc]
mov dword [ebp - 4], ecx
jmp 0x1005d3af
mov edx, 1
imul eax, edx, 0
mov ecx, dword [ebp + 8]
movsx edx, byte [ecx + eax]
xor edx, dword [ebp + 0xc]
imul eax, edx, 0x1000193
push eax
mov ecx, 1
shl ecx, 0
add ecx, dword [ebp + 8]
push ecx
call fcn.1005d360
add esp, 8
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
Function at 0x100a85fc
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
je 0x100a8699
push ebx
push esi
call fcn.100a85c5
xor ebx, ebx
sub eax, esi
push ebx
push ebx
push ebx
push ebx
sar eax, 1
push eax
push esi
push ebx
push ebx
mov dword [ebp - 8], eax
call fcn.100a850e
add esp, 0x24
mov dword [ebp - 4], eax
test eax, eax
jne 0x100a8646
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x100a8698
push edi
push eax
call fcn.100a95b3
mov edi, eax
pop ecx
push ebx
test edi, edi
jne 0x100a8666
call fcn.100a699b
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x100a8697
push ebx
push dword [ebp - 4]
push edi
push dword [ebp - 8]
push esi
push ebx
push ebx
call fcn.100a850e
add esp, 0x20
test eax, eax
jne 0x100a8685
push edi
call fcn.100a699b
jmp 0x100a868d
push ebx
call fcn.100a699b
mov ebx, edi
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, ebx
pop edi
pop ebx
pop esi
leave
ret

Function at 0x100a8904
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x100b0cf0
push 0x100b0ce8
push str.FlsAlloc
push 0x1e
call fcn.100a8822
mov esi, eax
add esp, 0x10
test esi, esi
je 0x100a8938
push dword [ebp + 8]
mov ecx, esi
call dword [0x100af214]
call esi
jmp 0x100a893e
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
pop esi
pop ebp
ret 4

Function at 0x100a8982
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x100b0d00
push 0x100b0cf8
push str.FlsGetValue
push 0x20
call fcn.100a8822
mov esi, eax
add esp, 0x10
test esi, esi
je 0x100a89b9
push dword [ebp + 8]
mov ecx, esi
call dword [0x100af214]
call esi
pop esi
pop ebp
ret 4
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsGetValue]
Function at 0x100ae060
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x100ae08d
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x100ae08d
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret

Function at 0x432002
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
call 0x43200c
nop
nop
nop
pop eax
nop
nop
nop
add eax, 0x40729f
sub eax, 0x407245
nop
nop
nop
nop
mov ebx, dword [eax]
nop
nop
nop
nop
mov ecx, dword [eax + 4]
mov edx, dword [eax + 8]
nop
nop
nop
xor dword [ebx], edx
nop
nop
nop
nop
nop
add ebx, 4
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
nop
nop
nop
nop
jl 0x432030
nop
nop
nop
add eax, 0xc
cmp dword [eax], 0
nop
nop
nop
nop
nop
nop
jne 0x43201e
nop
nop
nop
nop
popal
nop
nop
jmp 0x431219
Function at 0x4010c1
Capabilities:
Parse pe header

Disassembly:
call 0x401005
pop ebx
sub ebx, 0x404005
call 0x4010c1
call fcn.004010ff
call fcn.00401448
lea esi, [ebx + 0x405657]
push 0x104
push esi
push 0
mov eax, 0x758214b1
call eax
lea edi, [ebx + 0x4055a1]
push 0x32
push edi
mov eax, 0x7583b66c
call eax
add eax, 0x10
mov dword [ebx + 0x4055e1], eax
lea eax, [ebx + 0x40575b]
push eax
push edi
mov eax, 0x75842b7a
call eax
push esi
push edi
mov eax, 0x75823e8e
call eax
or eax, eax
je 0x40107d
call fcn.00401ff5
call int.00402528
call fcn.00402560
push dword [ebx + 0x40564f]
ret
lea eax, [ebx + 0x405565]
push eax
push 0
push 0
mov eax, 0x75824c6b
call eax
lea eax, [ebx + 0x405059]
push 0
push 0
push ebx
push eax
push 0
push 0
mov eax, 0x758234d5
call eax
lea eax, [ebx + 0x404486]
push 0
push 0
push ebx
push eax
push 0
push 0
call dword [ebx + 0x4040a0]
call fcn.00401808
mov edi, dword [esp + 4]
and edi, 0xffff0000
cmp word [edi], 0x5a4d
jne 0x4010e1
mov esi, edi
add esi, dword [esi + 0x3c]
cmp dword [esi], 0x4550
jne 0x4010e1
jmp 0x4010f8
sub edi, 0x10000
cmp edi, 0x70000000
jae 0x4010f6
mov edi, 0xbff70000
jmp 0x4010f8
jmp 0x4010cb
mov dword [ebx + 0x405653], edi
ret