joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100247f0
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, dword [ecx]
mov ecx, dword [ebp + 8]
push edi
call fcn.10020120
mov esi, eax
mov ecx, esi
neg ecx
push ecx
push edi
call fcn.1007fa60
or ecx, 0xffffffff
mov ebx, eax
sub ecx, esi
push ecx
push edi
call fcn.1007f720
movzx ecx, bl
mov eax, ebx
xor ecx, 0x811c9dc5
shr eax, 8
imul ecx, ecx, 0x1000193
add esp, 0x10
movzx eax, al
pop edi
xor ecx, eax
mov eax, ebx
imul ecx, ecx, 0x1000193
shr eax, 0x10
movzx eax, al
shr ebx, 0x18
pop esi
xor ecx, eax
imul eax, ecx, 0x1000193
xor eax, ebx
imul eax, eax, 0x1000193
pop ebx
pop ebp
ret 4

Function at 0x1002d1d0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
mov eax, dword [ebp + 8]
xor ecx, ecx
push esi
push edi
mov edx, 0x811c9dc5
mov esi, dword [eax + 4]
mov edi, dword [eax]
test esi, esi
je 0x1002d201
nop dword [eax + eax]
movzx eax, byte [edi + ecx]
inc ecx
xor eax, edx
imul edx, eax, 0x1000193
cmp ecx, esi
jb 0x1002d1f0
pop edi
mov eax, edx
pop esi
mov esp, ebp
pop ebp
ret 4

Function at 0x10039dd0
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [ebp + 0xc]
push ebx
push esi
push edi
push dword [eax]
mov esi, dword [eax + 4]
mov ebx, ecx
push esi
mov dword [ebp - 0xc], ebx
call fcn.1007f130
push 0xfff0b9d8
push esi
call fcn.10080f90
mov edi, dword [ebx]
lea ecx, [ebp - 4]
add esp, 0x10
mov dword [ebp - 4], eax
push edi
call fcn.10020120
mov esi, eax
mov ecx, esi
neg ecx
push ecx
push edi
call fcn.1007fa60
or ecx, 0xffffffff
mov ebx, eax
sub ecx, esi
push ecx
push edi
call fcn.1007f720
movzx ecx, bl
mov eax, ebx
xor ecx, 0x811c9dc5
shr eax, 8
imul ecx, ecx, 0x1000193
add esp, 0x10
movzx eax, al
mov esi, dword [ebp - 0xc]
xor ecx, eax
mov eax, ebx
shr eax, 0x10
imul ecx, ecx, 0x1000193
movzx eax, al
shr ebx, 0x18
xor ecx, eax
imul eax, ecx, 0x1000193
mov ecx, esi
xor eax, ebx
imul eax, eax, 0x1000193
push eax
push dword [ebp + 0xc]
lea eax, [ebp - 8]
push eax
call fcn.1004bcf0
mov ecx, dword [eax + 4]
mov eax, dword [ebp + 8]
test ecx, ecx
jne 0x10039e7f
mov ecx, dword [esi + 0xc]
pop edi
pop esi
mov dword [eax], ecx
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x10061ea0
Capabilities:
Execute command

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100ad575
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
push ebx
push esi
push edi
mov eax, dword [0x100df00c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov esi, 0x7fffffff
mov dword [ebp - 4], 0
mov ecx, dword [ebp + 0x18]
mov eax, esi
sub eax, ecx
cmp eax, 5
jb 0x1006202b
cmp dword [ebp + 0x1c], 0x10
lea eax, [ebp + 8]
push ecx
cmovae eax, dword [ebp + 8]
push eax
push 5
push str.Edit
push ecx
push dword [ebp - 0x10]
lea ecx, [ebp - 0x28]
call fcn.1001db80
push dword [ebp + 0x28]
mov byte [ebp - 4], 1
lea eax, [ebp - 0x28]
push dword [ebp + 0x24]
cmp dword [ebp - 0x14], 0x10
mov ecx, edi
push dword [ebp + 0x20]
cmovae eax, dword [ebp - 0x28]
push eax
call fcn.10061b80
mov byte [ebp - 4], 0
mov bl, al
mov ecx, dword [ebp - 0x14]
cmp ecx, 0x10
jb 0x10061f62
mov edx, dword [ebp - 0x28]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x10061f58
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x10061f58
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push ecx
push edx
call fcn.100a6782
add esp, 8
test bl, bl
je 0x10061fdf
mov ecx, dword [ebp + 0x18]
sub esi, ecx
cmp esi, 0xe
jb 0x10062030
cmp dword [ebp + 0x1c], 0x10
lea eax, [ebp + 8]
push ecx
cmovae eax, dword [ebp + 8]
push eax
push 0xe
push str.start_notepad
push ecx
push dword [ebp - 0x10]
lea ecx, [ebp - 0x28]
call fcn.1001db80
cmp dword [ebp - 0x14], 0x10
lea eax, [ebp - 0x28]
cmovae eax, dword [ebp - 0x28]
push eax
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov ecx, dword [ebp - 0x14]
add esp, 4
cmp ecx, 0x10
jb 0x10061fdf
mov edx, dword [ebp - 0x28]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x10061fd5
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x10061fd5
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push ecx
push edx
call fcn.100a6782
add esp, 8
mov ecx, dword [ebp + 0x1c]
cmp ecx, 0x10
jb 0x10062015
mov edx, dword [ebp + 8]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x1006200b
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x1006200b
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push ecx
push edx
call fcn.100a6782
add esp, 8
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x24
call fcn.100044b0
call fcn.100044b0
int3
Function at 0x10064dc0
Capabilities:
Log keystrokes
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
mov eax, dword [0x100df00c]
xor eax, ebp
mov dword [ebp - 4], eax
movsx ecx, word [ebp + 0xc]
push esi
mov esi, dword [ebp + 8]
mov dword [ebp - 0x28], esi
cmp ecx, 0x69
ja case.0x10064deb.3
movzx eax, byte [ecx + 0x10064fac]
jmp dword [eax*4 + 0x10064f5c]
push 7
push str.LButton
jmp 0x10064f2d
push 7
push str.RButton
jmp 0x10064f2d
push 7
push str.MButton
jmp 0x10064f2d
push 8
push str.XButton1
jmp 0x10064f2d
push 8
push str.XButton2
jmp 0x10064f2d
push 7
push str.NumPad0
jmp 0x10064f2d
push 7
push str.NumPad1
jmp 0x10064f2d
push 7
push str.NumPad2
jmp 0x10064f2d
push 7
push str.NumPad3
jmp 0x10064f2d
push 7
push str.NumPad4
jmp 0x10064f2d
push 7
push str.NumPad5
jmp 0x10064f2d
push 7
push str.NumPad6
jmp 0x10064f2d
push 7
push str.NumPad7
jmp 0x10064f2d
push 7
push str.NumPad8
jmp 0x10064f2d
push 7
push str.NumPad9
jmp 0x10064f2d
push 3
push 0x100ce884
jmp 0x10064f2d
push 9
push str.Caps_Lock
jmp 0x10064f2d
push 5
push 0x100ce8e0
jmp 0x10064f2d
push 4
push str.None
jmp 0x10064f2d
push 0x10
lea eax, [ebp - 0x24]
xorps xmm0, xmm0
push eax
push 0
push ecx
movups xmmword [ebp - 0x24], xmm0
movups xmmword [ebp - 0x14], xmm0
call dword [sym.imp.USER32.dll_MapVirtualKeyW]
shl eax, 0x10
push eax
call dword [sym.imp.USER32.dll_GetKeyNameTextW]
test eax, eax
je 0x10064f26
xorps xmm0, xmm0
lea ecx, [ebp - 0x24]
movups xmmword [esi], xmm0
mov dword [esi + 0x10], 0
lea edx, [ecx + 2]
mov dword [esi + 0x14], 0
nop dword [eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x10064f10
sub ecx, edx
lea eax, [ebp - 0x24]
sar ecx, 1
push ecx
push eax
jmp 0x10064f41
push 0xd
push str.VK2STR_FAILED
xorps xmm0, xmm0
movups xmmword [esi], xmm0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
mov ecx, esi
call fcn.10004ed0
mov ecx, dword [ebp - 4]
mov eax, esi
xor ecx, ebp
pop esi
call fcn.100a6425
mov esp, ebp
pop ebp
ret 8
Function at 0x10064eca
Capabilities:
Log keystrokes
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
mov eax, dword [0x100df00c]
xor eax, ebp
mov dword [ebp - 4], eax
movsx ecx, word [ebp + 0xc]
push esi
mov esi, dword [ebp + 8]
mov dword [ebp - 0x28], esi
cmp ecx, 0x69
ja case.0x10064deb.3
movzx eax, byte [ecx + 0x10064fac]
jmp dword [eax*4 + 0x10064f5c]
push 7
push str.LButton
jmp 0x10064f2d
push 7
push str.RButton
jmp 0x10064f2d
push 7
push str.MButton
jmp 0x10064f2d
push 8
push str.XButton1
jmp 0x10064f2d
push 8
push str.XButton2
jmp 0x10064f2d
push 7
push str.NumPad0
jmp 0x10064f2d
push 7
push str.NumPad1
jmp 0x10064f2d
push 7
push str.NumPad2
jmp 0x10064f2d
push 7
push str.NumPad3
jmp 0x10064f2d
push 7
push str.NumPad4
jmp 0x10064f2d
push 7
push str.NumPad5
jmp 0x10064f2d
push 7
push str.NumPad6
jmp 0x10064f2d
push 7
push str.NumPad7
jmp 0x10064f2d
push 7
push str.NumPad8
jmp 0x10064f2d
push 7
push str.NumPad9
jmp 0x10064f2d
push 3
push 0x100ce884
jmp 0x10064f2d
push 9
push str.Caps_Lock
jmp 0x10064f2d
push 5
push 0x100ce8e0
jmp 0x10064f2d
push 4
push str.None
jmp 0x10064f2d
push 0x10
lea eax, [ebp - 0x24]
xorps xmm0, xmm0
push eax
push 0
push ecx
movups xmmword [ebp - 0x24], xmm0
movups xmmword [ebp - 0x14], xmm0
call dword [sym.imp.USER32.dll_MapVirtualKeyW]
shl eax, 0x10
push eax
call dword [sym.imp.USER32.dll_GetKeyNameTextW]
test eax, eax
je 0x10064f26
xorps xmm0, xmm0
lea ecx, [ebp - 0x24]
movups xmmword [esi], xmm0
mov dword [esi + 0x10], 0
lea edx, [ecx + 2]
mov dword [esi + 0x14], 0
nop dword [eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x10064f10
sub ecx, edx
lea eax, [ebp - 0x24]
sar ecx, 1
push ecx
push eax
jmp 0x10064f41
push 0xd
push str.VK2STR_FAILED
xorps xmm0, xmm0
movups xmmword [esi], xmm0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
mov ecx, esi
call fcn.10004ed0
mov ecx, dword [ebp - 4]
mov eax, esi
xor ecx, ebp
pop esi
call fcn.100a6425
mov esp, ebp
pop ebp
ret 8
Function at 0x10070170
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100adda8
mov eax, dword fs:[0]
push eax
sub esp, 0xd4
mov eax, dword [0x100df00c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [0x100e4790]
mov ecx, dword [0x100e4750]
mov eax, dword [eax]
mov esi, dword [eax + 0xc]
mov eax, dword [ecx]
call dword [eax + 0x30]
mov ecx, dword [0x100e4790]
push eax
call esi
test eax, eax
je 0x1007030e
push 0xb8
lea eax, [ebp - 0xe0]
push 0
push eax
call sub.VCRUNTIME140.dll_memset
push str.servconspam.txt
lea ecx, [ebp - 0xe0]
call fcn.1001d500
lea edx, [ebp - 0xe0]
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x28]
call fcn.10070330
lea ecx, [ebp - 0xd0]
mov byte [ebp - 4], 1
call fcn.10007770
test eax, eax
jne 0x10070225
push eax
mov eax, dword [ebp - 0xe0]
lea ecx, [ebp - 0xe0]
push 2
add ecx, dword [eax + 4]
call dword [sym.imp.MSVCP140.dll_public:_void___thiscall_std::basic_ios_char__struct_std::char_traits_char__::setstate_int__bool_]
cmp byte [0x100df6c8], 0
je 0x1007026f
mov ecx, dword [0x100e4750]
mov eax, dword [ecx]
call dword [eax + 0x120]
test eax, eax
je 0x10070258
mov ecx, dword [eax]
cmp dword [ebp - 0x14], 0x10
mov edx, dword [ecx + 0xf8]
lea ecx, [ebp - 0x28]
cmovae ecx, dword [ebp - 0x28]
push ecx
mov ecx, eax
call edx
movzx eax, byte [0x100df6c8]
xor ecx, ecx
cmp byte [0x100df628], cl
cmovne eax, ecx
mov byte [0x100df6c8], al
cmp byte [0x100df8c0], 0
je 0x100702bb
mov ecx, dword [0x100e4750]
mov eax, dword [ecx]
call dword [eax + 0x120]
test eax, eax
je 0x100702bb
mov esi, 1
cmp dword [0x100df8c8], esi
jle 0x100702bb
nop word [eax + eax]
mov ecx, dword [0x100e4750]
push 1
push 0x100d1b1c
mov eax, dword [ecx]
call dword [eax + 0x18]
inc esi
cmp esi, dword [0x100df8c8]
jl 0x100702a0
mov ecx, dword [ebp - 0x14]
cmp ecx, 0x10
jb 0x100702f1
mov edx, dword [ebp - 0x28]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x100702e7
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x100702e7
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push ecx
push edx
call fcn.100a6782
add esp, 8
lea ecx, [ebp - 0xe0]
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0xf
mov byte [ebp - 0x28], 0
call fcn.1001d3c0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.100a6425
mov esp, ebp
pop ebp
ret
Function at 0x10073070
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100ae1f5
mov eax, dword fs:[0]
push eax
sub esp, 0x24
push ebx
push esi
push edi
mov eax, dword [0x100df00c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x14], esi
mov edx, dword [ebp + 0xc]
mov ebx, dword [ebp + 8]
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x1c], edx
cmp dword [edx + 0x14], 0x10
mov dword [ebp - 0x10], edx
jb 0x100730b7
mov eax, dword [edx]
mov dword [ebp - 0x10], eax
xor ecx, ecx
mov edi, 0x811c9dc5
cmp dword [edx + 0x10], ecx
jbe 0x100730db
mov ebx, dword [ebp - 0x10]
movzx eax, byte [ecx + ebx]
inc ecx
xor eax, edi
imul edi, eax, 0x1000193
cmp ecx, dword [edx + 0x10]
jb 0x100730c6
mov ebx, dword [ebp - 0x18]
push edi
push edx
lea eax, [ebp - 0x24]
mov ecx, esi
push eax
call fcn.10021d90
mov eax, dword [ebp - 0x20]
test eax, eax
je 0x1007310b
mov dword [ebx], eax
mov eax, ebx
mov byte [ebx + 4], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
cmp dword [esi + 8], 0x71c71c7
jne 0x1007311f
push str.unordered_map_set_too_long
call dword [sym.imp.MSVCP140.dll_void___cdecl_std::_Xlength_error_char_const__]
lea eax, [esi + 4]
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x2c], eax
mov dword [ebp - 4], 0
push 0x24
mov dword [ebp - 0x28], 0
call fcn.100a6433
add esp, 4
mov ebx, eax
mov dword [ebp - 0x28], ebx
push dword [ebp - 0x1c]
lea ecx, [ebx + 8]
call fcn.100071b0
mov esi, dword [ebp - 0x14]
mov dword [ebp - 4], 1
mov dword [ebx + 0x20], 0
mov eax, dword [esi + 8]
inc eax
movss xmm3, dword [esi]
movd xmm0, eax
cvtdq2pd xmm0, xmm0
shr eax, 0x1f
addsd xmm0, qword [eax*8 + 0x100d3cd0]
mov eax, dword [esi + 0x1c]
movd xmm1, eax
cvtdq2pd xmm1, xmm1
shr eax, 0x1f
cvtpd2ps xmm0, xmm0
addsd xmm1, qword [eax*8 + 0x100d3cd0]
movaps xmm2, xmm0
cvtpd2ps xmm1, xmm1
divss xmm2, xmm1
comiss xmm2, xmm3
jbe 0x100731f3
divss xmm0, xmm3
call fcn.1001f0c0
call fcn.100a7040
mov ecx, 8
cmp eax, ecx
cmova ecx, eax
mov eax, dword [esi + 0x1c]
cmp eax, ecx
jae 0x100731d7
cmp eax, 0x200
jae 0x100731d5
shl eax, 3
cmp eax, ecx
jae 0x100731d7
mov eax, ecx
push eax
mov ecx, esi
call fcn.10073360
push edi
lea eax, [ebx + 8]
mov ecx, esi
push eax
lea eax, [ebp - 0x2c]
push eax
call fcn.10021d90
mov edx, dword [eax]
jmp 0x100731f6
mov edx, dword [ebp - 0x24]
mov eax, dword [edx + 4]
inc dword [esi + 8]
mov dword [ebx + 4], eax
mov dword [ebx], edx
mov dword [eax], ebx
mov dword [edx + 4], ebx
mov ecx, dword [esi + 0xc]
mov dword [ebp - 0x14], eax
mov eax, dword [esi + 0x18]
and eax, edi
mov edi, dword [ebp - 0x10]
mov esi, dword [ecx + eax*8]
cmp esi, dword [edi]
jne 0x10073220
mov dword [ecx + eax*8], ebx
jmp 0x10073232
cmp esi, edx
jne 0x10073229
mov dword [ecx + eax*8], ebx
jmp 0x10073236
mov edx, dword [ebp - 0x14]
cmp dword [ecx + eax*8 + 4], edx
jne 0x10073236
mov dword [ecx + eax*8 + 4], ebx
mov eax, dword [ebp - 0x18]
mov dword [eax], ebx
mov byte [eax + 4], 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x1007d3b0
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x68
mov eax, dword [0x100df00c]
xor eax, esp
mov dword [esp + 0x64], eax
push 0x40
lea eax, [esp + 0x24]
mov dword [esp + 8], ecx
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 8
mov dword [esp + 0xc], 0x67452301
lea edx, [esp + 8]
mov dword [esp + 0x10], 0xefcdab89
lea ecx, [esp + 0xc]
mov dword [esp + 0x14], 0x98badcfe
mov dword [esp + 0x18], 0x10325476
mov dword [esp + 0x1c], 0
mov dword [esp + 0x20], 0
call fcn.1007d2d0
mov eax, dword [esp + 0x1c]
lea ecx, [esp + 0x24]
shr eax, 3
mov edx, 0x3f
and eax, 0x3f
add esp, 4
add ecx, eax
sub edx, eax
mov byte [ecx], 0x80
inc ecx
cmp edx, 8
jae 0x1007d462
push edx
push 0
push ecx
call sub.VCRUNTIME140.dll_memset
lea edx, [esp + 0x2c]
lea ecx, [esp + 0x14]
call fcn.1007cc50
push 0x38
lea eax, [esp + 0x30]
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0x18
jmp 0x1007d471
lea eax, [edx - 8]
push eax
push 0
push ecx
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
mov eax, dword [esp + 0x18]
lea edx, [esp + 0x20]
mov dword [esp + 0x58], eax
lea ecx, [esp + 8]
mov eax, dword [esp + 0x1c]
mov dword [esp + 0x5c], eax
call fcn.1007cc50
mov ecx, dword [esp + 0x64]
mov eax, dword [esp + 0xe]
xor ecx, esp
call fcn.100a6425
mov esp, ebp
pop ebp
ret
Function at 0x10085050
Capabilities:
Query environment variable

Disassembly:
sub esp, 0x21c
mov eax, dword [0x100df00c]
xor eax, esp
mov dword [esp + 0x218], eax
mov eax, dword [esp + 0x224]
push ebx
push ebp
mov ebp, dword [esp + 0x234]
push esi
mov esi, dword [esp + 0x234]
push edi
mov edi, dword [esp + 0x230]
push str._5_4
push esi
push str._s_s
push edi
mov dword [esp + 0x24], eax
mov dword [esp + 0x20], ebp
call fcn.1007efb0
push eax
call sub.api_ms_win_crt_environment_l1_1_0.dll_getenv
mov ebx, eax
add esp, 0x14
test ebx, ebx
jne 0x100850bf
push esi
call sub.api_ms_win_crt_environment_l1_1_0.dll_getenv
mov ebx, eax
add esp, 4
test ebx, ebx
je 0x100851d2
push str.LUA_NOENV
push 0xfff0b9d8
push edi
call fcn.1007e890
push 0xffffffffffffffff
push edi
call fcn.1007f8a0
push 0xfffffffffffffffe
push edi
mov esi, eax
call fcn.1007f720
add esp, 0x1c
test esi, esi
jne 0x100851d2
push 0x100b6240
push ebx
call sub.VCRUNTIME140.dll_strstr
mov ebp, eax
add esp, 8
test ebp, ebp
jne 0x10085106
push ebx
jmp 0x100851d3
mov esi, ebx
lea ecx, [esi + 1]
nop dword [eax + eax]
mov al, byte [esi]
inc esi
test al, al
jne 0x10085110
lea eax, [esp + 0x18]
sub esi, ecx
push eax
push edi
call fcn.100802e0
add esp, 8
cmp ebx, ebp
jae 0x10085167
mov eax, ebp
sub eax, ebx
push eax
lea eax, [esp + 0x1c]
push ebx
push eax
call fcn.100800f0
mov ecx, dword [esp + 0x2c]
add esp, 0xc
cmp ecx, dword [esp + 0x1c]
jb 0x1008515b
lea eax, [esp + 0x18]
push 1
push eax
call fcn.10080ef0
mov ecx, dword [esp + 0x28]
add esp, 8
mov eax, dword [esp + 0x18]
mov byte [eax + ecx], 0x3b
inc dword [esp + 0x20]
push dword [esp + 0x10]
lea eax, [esp + 0x1c]
push eax
call fcn.10080120
lea eax, [ebx - 2]
add esp, 8
add eax, esi
cmp ebp, eax
jae 0x100851c3
mov ecx, dword [esp + 0x20]
cmp ecx, dword [esp + 0x1c]
jb 0x1008519e
lea eax, [esp + 0x18]
push 1
push eax
call fcn.10080ef0
mov ecx, dword [esp + 0x28]
add esp, 8
mov eax, dword [esp + 0x18]
sub esi, ebp
mov byte [eax + ecx], 0x3b
lea eax, [ebx - 2]
inc dword [esp + 0x20]
add eax, esi
push eax
lea eax, [ebp + 2]
push eax
lea eax, [esp + 0x20]
push eax
call fcn.100800f0
add esp, 0xc
lea eax, [esp + 0x18]
push eax
call fcn.10080f10
add esp, 4
jmp 0x100851dc
push ebp
push edi
call fcn.1007f0c0
add esp, 8
push 0x105
lea eax, [esp + 0x1c]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
je 0x10085244
cmp eax, 0x105
je 0x10085244
lea eax, [esp + 0x18]
push 0x5c
push eax
call sub.VCRUNTIME140.dll_strrchr
add esp, 8
test eax, eax
je 0x10085244
mov byte [eax], 0
lea eax, [esp + 0x18]
push eax
push 0x100b620c
push 0
push 0xffffffffffffffff
push edi
call fcn.1007f980
add esp, 0xc
push eax
push edi
call fcn.10080900
push 0xffffffffffffffff
push 0xfffffffffffffffe
push edi
call fcn.1007f3c0
push 0xfffffffffffffffe
push edi
call fcn.1007f720
add esp, 0x24
jmp 0x10085252
push str.unable_to_get_ModuleFileName
push edi
call fcn.10080680
add esp, 8
push dword [esp + 0x14]
push 0xfffffffffffffffd
push edi
call fcn.1007f420
push 0xfffffffffffffffe
push edi
call fcn.1007f720
mov ecx, dword [esp + 0x23c]
add esp, 0x14
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.100a6425
add esp, 0x21c
ret
Function at 0x1008a1b0
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0xc
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x18]
push ebx
push ebp
mov dword [eax], ecx
mov ecx, dword [esp + 0x24]
mov dword [eax + 4], ecx
mov ecx, dword [esp + 0x28]
mov dword [eax + 0x10], ecx
mov ecx, dword [esp + 0x2c]
push esi
mov dword [eax + 8], 0xff
mov dword [eax + 0xc], 0
mov dword [eax + 0x14], ecx
mov dword [eax + 0x18], 0
mov dword [eax + 0x1c], 0
mov dword [esp + 0x10], 0x10
push edi
nop word [eax + eax]
mov edx, dword [eax + 8]
mov ebp, dword [eax + 0x18]
mov edi, dword [eax + 0x14]
xor edi, dword [eax + 4]
mov ebx, dword [eax + 0x10]
xor ebx, dword [eax]
mov dword [esp + 0x24], edx
xor ebp, dword [esp + 0x24]
mov edx, dword [eax + 0xc]
mov dword [esp + 0x10], ebp
mov ebp, dword [eax + 0x1c]
xor ebp, edx
mov dword [esp + 0x18], edx
mov esi, dword [esp + 0x18]
mov ecx, ebp
xor dword [eax + 4], ecx
mov ecx, edi
mov edx, dword [esp + 0x10]
xor ecx, esi
xor dword [eax], edx
mov edx, ebx
xor edx, dword [esp + 0x24]
mov dword [eax + 0xc], ecx
mov ecx, dword [esp + 0x24]
shld esi, ecx, 0x11
mov dword [eax + 8], edx
shl ecx, 0x11
xor esi, edi
xor ecx, ebx
mov dword [eax + 0x14], esi
mov ebx, dword [esp + 0x10]
mov edx, ebx
shrd ebx, ebp, 0x13
mov dword [eax + 0x10], ecx
xor ecx, ecx
shl edx, 0xd
or ecx, ebx
shr ebp, 0x13
or edx, ebp
mov dword [eax + 0x18], ecx
sub dword [esp + 0x14], 1
mov dword [eax + 0x1c], edx
jne 0x1008a200
push dword [esp + 0x2c]
mov esi, dword [esp + 0x24]
push dword [esp + 0x2c]
push esi
call fcn.1007eff0
push dword [esp + 0x40]
push dword [esp + 0x40]
push esi
call fcn.1007eff0
add esp, 0x18
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret
Function at 0x1008c770
Capabilities:
Read file on windows

Disassembly:
sub esp, 0x21c
mov eax, dword [0x100df00c]
xor eax, esp
mov dword [esp + 0x218], eax
push ebx
mov ebx, dword [esp + 0x228]
push ebp
push esi
push edi
mov edi, dword [esp + 0x230]
push edi
call fcn.1007eaf0
push ebx
mov esi, eax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_clearerr
add esp, 8
sub esi, 1
jne 0x1008c7c7
push 1
push ebx
push edi
call fcn.1008cea0
mov ebp, dword [esp + 0x244]
add esp, 0xc
mov esi, eax
inc ebp
jmp 0x1008c94e
push str.too_many_arguments
lea eax, [esi + 0x14]
push eax
push edi
call fcn.10080510
mov ebp, dword [esp + 0x244]
mov eax, 1
add esp, 0xc
mov dword [esp + 0x10], eax
nop dword [eax]
dec esi
mov dword [esp + 0x14], esi
test eax, eax
je 0x1008c94a
push ebp
push edi
call fcn.1007fb40
add esp, 8
cmp eax, 3
jne 0x1008c892
push ebp
push edi
call fcn.10080360
mov esi, eax
add esp, 8
test esi, esi
jne 0x1008c84e
push ebx
call sub.api_ms_win_crt_stdio_l1_1_0.dll_getc
mov esi, eax
push ebx
push esi
call sub.api_ms_win_crt_stdio_l1_1_0.dll_ungetc
push 0x100c444f
push edi
call fcn.1007f0c0
xor eax, eax
add esp, 0x14
cmp esi, 0xffffffff
mov esi, dword [esp + 0x14]
setne al
jmp 0x1008c93d
lea eax, [esp + 0x18]
push eax
push edi
call fcn.100802e0
lea eax, [esp + 0x20]
push esi
push eax
call fcn.10080ef0
push ebx
push esi
push 1
push eax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fread
mov esi, eax
lea eax, [esp + 0x38]
add dword [esp + 0x40], esi
push eax
call fcn.10080f10
xor eax, eax
add esp, 0x24
cmp eax, esi
mov esi, dword [esp + 0x14]
sbb eax, eax
neg eax
jmp 0x1008c93d
push 0
push ebp
push edi
call fcn.100803d0
add esp, 0xc
mov cl, byte [eax]
cmp cl, 0x2a
jne 0x1008c8a8
mov cl, byte [eax + 1]
movsx eax, cl
add eax, 0xffffffb4
cmp eax, 0x22
ja case.0x1008c8be.77
movzx eax, byte [eax + 0x1008c9c8]
jmp dword [eax*4 + 0x1008c9b4]
push ebx
push edi
call fcn.1008cfc0
add esp, 8
jmp 0x1008c93d
push 1
push ebx
push edi
call fcn.1008cea0
add esp, 0xc
jmp 0x1008c93d
push 0
push ebx
push edi
call fcn.1008cea0
add esp, 0xc
jmp 0x1008c93d
lea eax, [esp + 0x18]
push eax
push edi
call fcn.100802e0
add esp, 8
nop dword [eax + eax]
lea eax, [esp + 0x18]
push 0x200
push eax
call fcn.10080ef0
push ebx
push 0x200
push 1
push eax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fread
add dword [esp + 0x38], eax
add esp, 0x18
cmp eax, 0x200
je 0x1008c900
lea eax, [esp + 0x18]
push eax
call fcn.10080f10
add esp, 4
mov eax, 1
inc ebp
mov dword [esp + 0x10], eax
test esi, esi
jne 0x1008c7f0
mov esi, dword [esp + 0x10]
push ebx
call sub.api_ms_win_crt_stdio_l1_1_0.dll_ferror
add esp, 4
test eax, eax
je 0x1008c97b
push 0
push 0
push edi
call fcn.100807b0
add esp, 0xc
jmp 0x1008c999
push str.invalid_format
push ebp
push edi
call fcn.100801b0
add esp, 0xc
jmp 0x1008c999
test esi, esi
jne 0x1008c990
push 0xfffffffffffffffe
push edi
call fcn.1007f720
push edi
call fcn.1007f090
add esp, 0xc
sub ebp, dword [esp + 0x238]
mov eax, ebp
mov ecx, dword [esp + 0x228]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.100a6425
add esp, 0x21c
ret