joyce8/EMBER2024-capa huggingface dataset:
Function at 0x101a929e
Capabilities:
Execute anti-debugging instructions

Disassembly:
push 0x218b7ea8
sbb edi, 3
push 0x22bdc52d
call fcn.101a88be
call fcn.101a979a
mov edx, 0x22902535
sal dx, 0x26
mov edx, edi
jnp 0x101a287b
cmovnp eax, eax

Function at 0x101a92c3
Capabilities:
Execute anti-debugging instructions
Terminate process

Disassembly:
lea esp, [esp + 0x14]
jl fcn.101a9e3e
jmp loc.10063ea1
mov dword [esp], 0x261ef39c
not byte [esp + 4]
xor al, 0xac
sub word [esp + 0xa], 0xeb98
push 0xd1b269d
shl byte [esp + 0xa], 0xc5
rol al, 1
shl byte [esp + 2], 0x87
add byte [esp + 6], 0x8c
inc al
neg word [esp + 0xa]
push 0x180d7714
dec byte [esp + 0x10]
xor bl, al
not dword [esp + 0x10]
or dword [esp + 0xd], 0xfe988c26
lea eax, [esp + eax + 0x14]
mov byte [eax], dl
ja 0x101a9689
mov edx, 0xe2a0b198
movsx ebp, dx
not dx
mov ebp, dword [edi]
call fcn.101a837d
jno 0x101a522c

Function at 0x101a939c
Capabilities:
Authenticate hmac
Execute anti-debugging instructions
Terminate process

Disassembly:
jmp loc.10064b57
add al, 8
ror byte [esp + 3], 0x23
xor al, 0xac
rol al, 1
shr dword [esp], 0xbf
and dword [esp], 0xb0235da4
push 0x4a1f83a5
inc al
shl dword [esp + 2], 0xa7
xor bl, al
push 0x3e15c324
lea eax, [esp + eax + 0xc]
jmp 0x101a617c
sal eax, 0x4c
lea esi, [eax + esi - 0x523aa001]
mov dword [esp + eax - 0x523aa000], 0x628d4cb6
movzx eax, byte [esi + eax - 0x523aa000]
xor al, bl
jmp 0x101a8b6e

Function at 0x101a94fa
Capabilities:
Execute anti-debugging instructions
Terminate process

Disassembly:
lea ecx, [esp + ecx + 8]
mov dword [esp + edx - 0x1bbca], edx
mov edx, dword [ecx + edx - 0x1bbca]
call fcn.101a2125
mov ebp, dword [edi]
mov edx, 0xa6111500
dec dx
call fcn.101a75e1

Function at 0x101a9520
Capabilities:
Execute anti-debugging instructions
Terminate process

Disassembly:
push 0x20312313
not dword [esp + 8]
mov word [edi], dx
call fcn.101a5440
call fcn.101a9c07
push 0x392de1af
adc edi, 4
shrd dx, bp, cl
jmp 0x101a3548

Function at 0x101a95c8
Capabilities:
Execute anti-debugging instructions
Terminate process

Disassembly:
and cl, dl
not cl
call fcn.101a8ab8

Function at 0x101a95d1
Capabilities:
Execute anti-debugging instructions
Terminate process

Disassembly:
lea esp, [esp + 0x10]
jmp fcn.101a9e3e
push 0x449a0513
mov byte [edx], cl
jmp 0x101a6eb5

Function at 0x101a95ed
Capabilities:
Authenticate hmac
Execute anti-debugging instructions
Get system information on windows
Link many functions at runtime
Terminate process

Disassembly:
mov dword [esp], 0xb0989720
call fcn.101a686b

Function at 0x101a95fa
Capabilities:
Authenticate hmac
Execute anti-debugging instructions
Get system information on windows
Link many functions at runtime
Terminate process

Disassembly:
jmp 0x101a5522
not byte [esp + 7]
xor bl, al
lea esp, [esp + 0xc]
jmp dword [eax*4 + 0x101a5730]
jmp 0x101a2b2e
mov dword [esp], 0x2ab8fb80
add al, 0x16
jmp 0x101a4eaa
mov dword [esp + 8], 0xfd1a6d8f
or byte [esp + 8], 0x10
dec al
inc word [esp + 8]
ror byte [esp + 4], 0x87
ror al, 1
jmp 0x101a241a

Function at 0x101a96d1
Capabilities:
Execute anti-debugging instructions
Terminate process

Disassembly:
lea esp, [esp + 0x24]
jmp fcn.101a9e3e
Function at 0x101a976b
Capabilities:
Execute anti-debugging instructions
Terminate process

Disassembly:
lea esp, [esp + 0x10]
jmp fcn.101a9e3e

Function at 0x101a9774
Capabilities:
Terminate process

Disassembly:
jmp loc.100649c5
rol dword [esp + 8], 0xb3
shr dword [esp + 8], 0xf8
or ax, cx
jmp 0x101a6ad4

Function at 0x101a979a
Capabilities:
Execute anti-debugging instructions
Terminate process

Disassembly:
not byte [esp + 0x12]
lea esp, [esp + 0x14]
jmp fcn.101a9e3e

Function at 0x101a99b4
Capabilities:
Terminate process

Disassembly:
lea esp, [esp + 8]
jmp fcn.101a8301

Function at 0x101a9a9f
Capabilities:
Execute anti-debugging instructions
Terminate process

Disassembly:
call fcn.101a8939
mov ecx, 0x75a8ce2d
mov ecx, dword [edi + ecx - 0x75a8ce2d]
mov eax, 0x19a6d818
and al, al
lea edi, [edi + eax - 0x19a6d814]
lea esi, [esi + eax - 0x19a6d819]
shr eax, 0xaa
movzx eax, byte [esi + eax*4 - 0x19a6d8]
xor al, bl
call fcn.101a3198

Function at 0x101a9ad7
Capabilities:
Execute anti-debugging instructions
Terminate process

Disassembly:
push 0xd3255338
add edi, 4
jmp loc.101a4b07
lea esp, [esp + 8]
jmp fcn.101a9e3e
mov dword [ecx], ebp
push 0x612a408d
mov dword [esp + 4], 0xaca6eb19
jmp 0x101a21c4
mov ebp, dword [edi + 4]
jb 0x10064bf9
adc edi, 8
jmp 0x101a993d

Function at 0x101a9b90
Capabilities:
Execute anti-debugging instructions
Terminate process

Disassembly:
push 0x9f2bd71f
lea esp, [esp + 0x10]
jmp fcn.101a9e3e
mov word [edi], dx
push 0xfb9cbaaa
jmp 0x101a665e

Function at 0x101a9c07
Capabilities:
Execute anti-debugging instructions
Terminate process

Disassembly:
mov word [edi], bp
push 0xe4a94e8c
push 0x6d1fb885
call fcn.10025b63
or ebp, eax
call fcn.100623bb
push 0xb7cc20
adc edi, 1
dec dword [esp + 4]
not bp
not cx
push 0xeeba1701
or bp, cx
push 0x54388c0c
jmp 0x101a6466

Function at 0x101a9d5f
Capabilities:
Execute anti-debugging instructions
Terminate process

Disassembly:
mov dword [edi], eax
push 0x67211629
push 0x70221720
lea esp, [esp + 0x10]
jmp fcn.101a9e3e
jmp 0x101a4fdf
jmp 0x101a7a7f

Function at 0x101a9e12
Capabilities:
Execute anti-debugging instructions
Terminate process

Disassembly:
lea edx, [esp + edx + 0xc]
mov word [edx], ax
call fcn.101a9bfc

Function at 0x101a9e1e
Capabilities:
Execute anti-debugging instructions
Terminate process

Disassembly:
lea esp, [esp + 0x14]
jmp fcn.101a9e3e
mov word [edi], dx
jmp 0x101a278e
jmp 0x101a6035

Function at 0x101a9ec7
Capabilities:
Terminate process

Disassembly:
push 1
jmp 0x101a5d5e
push eax
jmp loc.100633eb
call fcn.101051e9
mov edx, dword [ebp + 0x2c]
movzx ax, al
jmp 0x101a61b9
mov eax, dword [edx + 4]
jmp 0x101a42a1
add dl, 4
neg eax
mov dword [esp + eax - 0x16fed], 0xc81a6202
xor bl, dl
mov dword [esp + eax*4 - 0x5bfb0], eax
lea edx, [esp + edx + 0x10]
cwde
push eax
movzx ax, byte [eax + edx - 0x6fed]
sub edi, 2
push 0xfa12a13d
call fcn.101a2261
call fcn.10069410
add esp, 8
jmp 0x101a2140

Function at 0x101a9f17
Capabilities:
Execute anti-debugging instructions
Terminate process

Disassembly:
push 0xdb9a08be
lea esp, [esp + 0xc]
jmp fcn.101a9e3e
jmp 0x101a7e1e
Function at 0x101aa07a
Capabilities:
Execute anti-debugging instructions
Terminate process

Disassembly:
adc edi, 2
mov dword [esp], 0xd723353a
not dword [esp]
mov dword [esp], 0x692eb123
add cl, al
mov word [edi], cx
lea esp, [esp + 4]
jmp fcn.101a9e3e

Function at 0x101aa0ec
Capabilities:
Execute anti-debugging instructions
Terminate process

Disassembly:
mov eax, dword [ebp]
jmp 0x10063995

Function at 0x101aa100
Capabilities:
Resume thread
Terminate process

Disassembly:
call fcn.10064cf9
add byte [eax], al
add byte [eax], al
add byte [eax], al
jl 0x101aa12a
ltr word [ecx]
sub dword [edi], ecx
add byte [eax + 0x46], al
verr ax
pop ebp
ltr word [ebp - 0x43]
adc dword [eax], eax
xchg ecx, eax
mov ebp, 0xbdcc0011
adc dword [eax], eax
movsx edx, byte [ecx]
add byte [edi - 0x42], al
adc dword [eax], eax
jg 0x101aa0e4
adc dword [eax], eax
scasb al, byte es:[edi]
mov esi, 0xbee00011
adc dword [eax], eax
loopne fcn.101aa0ec
adc dword [eax], eax
or bh, byte [edi - 0x40c6ffef]
adc dword [eax], eax
outsb dx, byte [esi]
mov edi, 0xbf9b0011
adc dword [eax], eax
enter 0x11bf, 0
add al, al
adc dword [eax], eax
cmp eax, eax
adc dword [eax], eax
jo 0x101aa10e
adc dword [eax], eax
mov byte [0xcf0011c0], al
rcl byte [ecx], 0
stc
rcl byte [ecx], 0
rcl dword gs:[ecx], 0
nop
rcl dword [ecx], 0
mov edi, 0xf40011c1
rcl dword [ecx], 0
das
ret 0x11
Function at 0x40e5e0
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0xb000]
push edi
jmp 0x40e5fa
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x40e601
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x40e5f0
mov eax, 1
add ebx, ebx
jne 0x40e613
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x40e608
jne 0x40e624
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x40e608
xor ecx, ecx
sub eax, 3
jb 0x40e638
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x40e6aa
mov ebp, eax
add ebx, ebx
jne 0x40e643
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x40e650
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x40e674
inc ecx
add ebx, ebx
jne 0x40e660
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x40e655
jne 0x40e671
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x40e655
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x40e694
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x40e685
jmp 0x40e5f6
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x40e694
add edi, ecx
jmp 0x40e5f6
pop esi
lea edi, [esi + 0xc000]
mov eax, dword [edi]
or eax, eax
je 0x40e6f3
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x1299c]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x12a24]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x40e6b1
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x12a2c]
or eax, eax
je 0x40e6ed
mov dword [ebx], eax
add ebx, 4
jmp 0x40e6ce
call dword [esi + 0x12a28]
add edi, 4
lea ebx, [esi - 4]
xor eax, eax
mov al, byte [edi]
inc edi
or eax, eax
je 0x40e724
cmp al, 0xef
ja 0x40e717
add ebx, eax
mov eax, dword [ebx]
xchg ah, al
rol eax, 0x10
xchg ah, al
add eax, esi
mov dword [ebx], eax
jmp 0x40e6f9
and al, 0xf
shl eax, 0x10
mov ax, word [edi]
add edi, 2
jmp 0x40e706
mov ebp, dword [esi + 0x12a30]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x217]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x40e758
sub esp, 0xffffff80
jmp 0x403222

Function at 0x4015a0
Capabilities:
Terminate process

Disassembly:
call fcn.00401940
jmp fcn.004012d0

Function at 0x4015b0
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x403008]
jne 0x4015ba
repz ret
jmp fcn.004019f0
Function at 0x7003567
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
pushal
call 0x7003576
pop dword [ebp - 0x1c]
mov eax, 0x518f7952
add eax, 0xb570bc24
sub dword [ebp - 0x1c], eax
mov dword [ebp - 0x2c], 0xf8d5e599
add dword [ebp - 0x2c], 0x557c5fb2
mov dword [ebp - 0x28], 0xdeeef24c
add dword [ebp - 0x28], 0x534459f9
mov dword [ebp - 0x24], 0xafdf3d
sub dword [ebp - 0x24], 0xb4639b0f
mov dword [ebp - 0x20], 0xd38417eb
add dword [ebp - 0x20], 0x2c7be815
lea eax, [ebp - 0x2c]
push eax
mov eax, 0x9a2257e8
sub eax, 0x932127b8
add eax, dword [ebp - 0x1c]
call dword [eax]
mov dword [ebp - 0x2c], 0x19e0dd94
sub dword [ebp - 0x2c], 0xa56e743e
mov dword [ebp - 0x28], 0x9ece489b
sub dword [ebp - 0x28], 0x5d61e726
mov dword [ebp - 0x24], 0x6c850238
sub dword [ebp - 0x24], 0x91595cc
mov dword [ebp - 0x20], 0x8221bc0d
sub dword [ebp - 0x20], 0x8221bc0d
lea ebx, [ebp - 0x2c]
push ebx
push eax
mov eax, 0xaddb12c6
add eax, 0x59261d6e
add eax, dword [ebp - 0x1c]
call dword [eax]
push 0x40
push 0x1000
push 0x37337
push 0
call eax
mov ecx, 0x3ef0bf55
add ecx, 0xc10f7aaf
mov edx, eax
mov esi, 0x273ee438
sub esi, 0x203ce238
add esi, dword [ebp - 0x1c]
mov ebx, 0x569b41c
add ebx, 0xfc23af59
mov dword [ebp - 0x14], 0xf7ebb600
mov edi, dword [esi]
xor edi, ebx
add dword [ebp - 0x14], 0x89769dd4
mov dword [edx], edi
sub dword [ebp - 0x14], 0x4b4e075d
add edx, 4
add esi, 0x3851db56
add esi, 0xc7ae24ae
loop 0x7003698
add eax, 0x8e082dde
add eax, 0x71f8ad05
xor ebx, ebx
add ebx, eax
add eax, 5
mov ecx, 0x7000000
add ecx, dword [ebp - 0x1c]
call ebx
leave
ret

Function at 0x700d29f
Capabilities:
Set current directory

Disassembly:
push 8
mov eax, 0x70120f1
call fcn.07001cf8
mov edi, ecx
mov dword [ebp - 0x14], edi
mov esi, dword [ebp + 8]
push esi
call fcn.0700d491
xor ebx, ebx
mov dword [edi], vtable.FileSharedStream.0
mov dword [edi + 0xc], ebx
mov byte [edi + 0x10], bl
mov eax, dword [esi + 0x14]
mov dword [edi + 0x14], eax
lea eax, [edi + 0x18]
push eax
mov dword [ebp - 4], ebx
call dword [sym.imp.kernel32.dll_InitializeCriticalSection]
mov ecx, esi
mov byte [ebp - 4], 1
call fcn.0700dd8a
lea ecx, [ebp - 0x10]
call fcn.0700d23c
mov eax, dword [edi + 0x14]
mov byte [ebp - 4], 2
push dword [eax + 0x14]
call dword [sym.imp.kernel32.dll_SetCurrentDirectoryA]
mov eax, dword [edi + 0x14]
mov eax, dword [eax + 0xc]
test eax, eax
je 0x700d30c
mov eax, dword [eax + 0x14]
jmp 0x700d311
mov eax, 0x70138c2
push 0x7015240
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fopen]
mov dword [edi + 0xc], eax
pop ecx
pop ecx
test eax, eax
je 0x700d343
mov ecx, dword [edi + 4]
call fcn.070076d1
lea ecx, [ebp - 0x10]
mov dword [edi + 8], eax
call fcn.07003567
mov eax, edi
call fcn.07001ea7
ret 4
push str.file_does_not_exist
push ebx
call fcn.07003567
int3
Function at 0x6ad86770
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov byte [ebp - 0x10], 0xca
mov byte [ebp - 0xf], 0xde
mov byte [ebp - 0xe], 0xd3
mov byte [ebp - 0xd], 0xf9
mov byte [ebp - 0xc], 0xcd
mov byte [ebp - 0xb], 0xda
mov byte [ebp - 0xa], 0xda
mov byte [ebp - 9], 0xbf

Function at 0x6ad86790
Capabilities:
Contain obfuscated stackstrings

Disassembly:
call fcn.6ad863f8
push eax
push esi
push dword [ebp + 8]
call fcn.6ad863ad
mov dword [ebp - 8], eax
lea eax, [ebp - 0x6c]
push eax
mov byte [ebp - 0x6c], bl
mov byte [ebp - 0x6b], bl
mov byte [ebp - 0x6a], 0xbe
mov byte [ebp - 0x69], bl
mov byte [ebp - 0x68], 0x17
mov byte [ebp - 0x67], 0x28
mov byte [ebp - 0x66], 0x33
mov byte [ebp - 0x65], 0x35
mov byte [ebp - 0x64], 0x34
mov byte [ebp - 0x63], 0x20
mov byte [ebp - 0x62], 0x2d
mov byte [ebp - 0x61], 0x11
mov byte [ebp - 0x60], 0x33
mov byte [ebp - 0x5f], 0x2e
mov byte [ebp - 0x5e], 0x35
mov byte [ebp - 0x5d], 0x24
mov byte [ebp - 0x5c], 0x22
mov byte [ebp - 0x5b], 0x35
mov byte [ebp - 0x5a], 0x41
call fcn.6ad863f8
push eax
push esi
push dword [ebp + 8]
call fcn.6ad863ad
invalid
invalid

Function at 0x6ad87100
Capabilities:
Contain obfuscated stackstrings

Disassembly:
inc dword [eax]
mov byte [ebp - 0x6b4], 0x33
mov byte [ebp - 0x6b3], 0x16
mov byte [ebp - 0x6b2], 0xd
mov byte [ebp - 0x6b1], 0x10
mov byte [ebp - 0x6b0], 1
mov byte [ebp - 0x6af], 0x34
invalid
test dword [edx - 7], edx

Function at 0x6ad8e2e0
Capabilities:
Create directory

Disassembly:
push esi
push ebx
mov ebx, eax
sub esp, 0x14
mov dword [esp], eax
call dword [sym.imp.msvcrt.dll__wmkdir]
test eax, eax
jne 0x6ad8e300
xor eax, eax
add esp, 0x14
pop ebx
pop esi
ret
mov esi, dword [sym.imp.msvcrt.dll__errno]
call esi
cmp dword [eax], 0x11
je 0x6ad8e2f4
call esi
cmp dword [eax], 0xd
jne 0x6ae0b5fb
jmp 0x6ad8e2f4
mov dword [esp + 4], ebx
mov dword [esp], str.Failed_to_create_directory___ls_
call fcn.6ae0b49f
mov eax, 0x25
jmp 0x6ad8e2f6
Function at 0x6ad90240
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push edi
push esi
push ebx
mov eax, dword [esp + 0x24]
mov ebx, dword [esp + 0x10]
mov edx, dword [esp + 0x14]
mov ecx, dword [esp + 0x18]
mov esi, dword [esp + 0x1c]
mov edi, dword [esp + 0x20]
test eax, 0xf083001e
jne 0x6ad90280
mov dword [esp + 0x18], eax
mov eax, ebx
mov dword [esp + 0x14], edi
mov dword [esp + 0x10], esi
pop ebx
pop esi
pop edi
jmp fcn.6ad8e870
pop ebx
mov eax, 0x18
pop esi
pop edi
ret

Function at 0x6ad91720
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x1c
mov edi, dword [esp + 0x30]
mov esi, dword [esp + 0x3c]
mov ebp, dword [edi + 0x20]
cmp ebp, 0xfffe
ja 0x6ad91862
mov eax, dword [edi]
lea ebx, [edi + 4]
cmp eax, ebx
je 0x6ad91808
lea ebx, [ebp + 1]
mov dword [esp], eax
imul ebx, ebx, 0x1c
mov dword [esp + 4], ebx
call fcn.6adab420
mov ebx, eax
test eax, eax
je 0x6ad9185e
mov dword [edi], eax
imul ebp, dword [edi + 0x20], 0x1c
add ebx, ebp
xor ecx, ecx
xor ebp, ebp
lea edx, [ebx + 4]
mov eax, ebx
mov dword [ebx], 0
and edx, 0xfffffffc
mov dword [ebx + 0x18], 0
sub eax, edx
add eax, 0x1c
and eax, 0xfffffffc
mov dword [edx + ebp], ecx
add ebp, 4
cmp ebp, eax
jb 0x6ad91790
movzx edx, byte [esp + 0x34]
movzx eax, byte [ebx + 0x1b]
shl edx, 5
and eax, 0x1f
or eax, edx
mov byte [ebx + 0x1b], al
mov eax, dword [esp + 0x38]
cmp word [eax], 0
jne 0x6ad91848
mov dword [ebx], 0x6ae16722
mov eax, dword [edi + 0x78]
lea edx, [eax + 1]
add eax, eax
mov dword [edi + 0x78], edx
mov edx, dword [ebx + 0x18]
and eax, 0x1ffffffe
or eax, 1
mov dword [ebx + 4], esi
and edx, 0xe0000000
or eax, edx
mov dword [ebx + 0x18], eax
test esi, esi
je 0x6ad917f5
mov eax, dword [edi + 0x38]
and eax, 0x3fffffff
add dword [esi + 0x24], eax
add dword [edi + 0x20], 1
add esp, 0x1c
mov eax, ebx
pop ebx
pop esi
pop edi
pop ebp
ret
test ebp, ebp
je 0x6ad9176d
lea ebx, [ebp + 1]
imul ebx, ebx, 0x1c
mov dword [esp], ebx
call fcn.6adab3e0
mov ebx, eax
test eax, eax
je 0x6ad9185e
imul ebp, dword [edi + 0x20], 0x1c
mov eax, dword [edi]
mov dword [esp], ebx
mov dword [esp + 4], eax
mov dword [esp + 8], ebp
call sub.msvcrt.dll_memcpy
mov dword [edi], ebx
jmp 0x6ad9176d
mov eax, dword [esp + 0x38]
mov dword [esp], eax
call fcn.6ad8d540
mov dword [ebx], eax
test eax, eax
jne 0x6ad917c2
xor ebx, ebx
jmp 0x6ad917f9
mov eax, dword [edi + 0x2c]
xor ebx, ebx
sub eax, 0x14
mov dword [esp], eax
call fcn.6ad86770
mov dword [esp], str.Inode_has_too_many_streams__Path__ls_
mov dword [esp + 4], eax
call fcn.6ae0b475
call dword [sym.imp.msvcrt.dll__errno]
mov dword [eax], 0x1b
jmp 0x6ad917f9
Function at 0x6ad92450
Capabilities:
Resolve function by parsing pe exports

Disassembly:
cli
invalid
push ebp
push edi
push esi
push ebx
sub esp, 0x4c
mov eax, dword [esp + 0x64]
mov edi, dword [esp + 0x60]
cmp byte [esp + 0x78], 0
mov esi, dword [esp + 0x68]
mov dword [esp + 0x24], eax
mov eax, dword [esp + 0x70]
lea edx, [edi + 0xc]
mov ebp, dword [esp + 0x6c]
mov dword [esp + 0x1c], eax
mov eax, dword [esp + 0x74]
mov dword [esp + 0x20], eax
mov eax, dword [esp + 0x7c]
mov dword [esp + 0x28], eax
jne 0x6ad92530
mov eax, 0xfffc0001
mul esi
mov edx, dword [edi + 8]
add eax, dword [esp + 0x1c]
sub edx, 1
and eax, edx
mov edx, dword [edi]
lea edx, [edx + eax*4]
mov ebx, dword [edx]
test ebx, ebx
je 0x6ad92530
mov eax, dword [ebx + 0x38]
mov ecx, dword [ebx + 0x3c]
sub ebx, 0x30
xor eax, esi
xor ecx, ebp
or ecx, eax
jne 0x6ad92528
mov eax, dword [esp + 0x1c]
mov ecx, dword [esp + 0x20]
xor eax, dword [ebx + 0x70]
xor ecx, dword [ebx + 0x74]
or ecx, eax
jne 0x6ad92528
test byte [ebx + 0x24], 0x10
jne 0x6ad924fc
mov eax, dword [esp + 0x28]
mov dword [esp + 0x64], ebx
mov dword [esp + 0x68], eax
mov eax, dword [esp + 0x24]
mov dword [esp + 0x60], eax
add esp, 0x4c
pop ebx
pop esi
pop edi
pop ebp
jmp 0x6ad86fd0
mov eax, dword [ebx + 0x2c]
mov dword [esp + 0x2c], edx
sub eax, 0x14
mov dword [esp], eax
call fcn.6ad86770
mov dword [esp], str.Not_honoring_directory_hard_link_of___ls_
mov dword [esp + 4], eax
call fcn.6ae0b4c9
mov edx, dword [esp + 0x2c]
lea esi, [esi]
mov ebx, dword [ebx + 0x30]
test ebx, ebx
jne 0x6ad924b3
nop
lea eax, [esp + 0x3c]
mov dword [esp + 4], 0
mov dword [esp + 8], eax
mov eax, dword [esp + 0x24]
mov dword [esp + 0x2c], edx
mov dword [esp], eax
call fcn.6ad86800
mov ebx, eax
test eax, eax
jne 0x6ad925a3
mov ecx, dword [esp + 0x3c]
mov edx, dword [esp + 0x2c]
mov eax, dword [ecx]
mov dword [eax + 0x68], esi
mov esi, dword [esp + 0x1c]
mov dword [eax + 0x6c], ebp
lea ebp, [eax + 0x30]
mov dword [eax + 0x70], esi
mov esi, dword [esp + 0x20]
mov dword [eax + 0x74], esi
mov esi, dword [edx]
mov dword [eax + 0x30], esi
test esi, esi
je 0x6ad92583
mov dword [esi + 4], ebp
mov dword [edx], ebp
mov dword [eax + 0x34], edx
lea eax, [edi + 0xc]
cmp edx, eax
je 0x6ad9259d
mov eax, dword [edi + 4]
add eax, 1
mov dword [edi + 4], eax
cmp eax, dword [edi + 8]
ja 0x6ad925b0
mov eax, dword [esp + 0x28]
mov dword [eax], ecx
add esp, 0x4c
mov eax, ebx
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp], edi
call fcn.6ad92390
mov ecx, dword [esp + 0x3c]
jmp 0x6ad9259d
Function at 0x6ada4da0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0xdc
mov edi, dword [esp + 0xf0]
mov esi, dword [esp + 0xf4]
mov eax, dword [edi + 8]
mov edx, dword [edi + 0xc]
mov dword [esp + 0x18], esi
mov ecx, dword [edi + 0x10]
mov ebx, dword [edi + 0x14]
mov dword [esp + 0x20], eax
mov eax, dword [edi + 4]
mov dword [esp + 0x24], edx
mov edx, dword [edi]
movzx edi, byte [edi + 7]
and eax, 0xffffff
mov ebp, dword [esi]
mov dword [esp + 0x30], ecx
mov dword [esp + 0x2c], eax
mov eax, edi
xor ebp, 0x57504c57
mov dword [esp + 0x28], edx
lea edx, [esp + 0x38]
mov byte [esp + 0x40], al
mov eax, dword [esi + 4]
mov dword [esp + 0x34], ebx
xor eax, 0x4d
or ebp, eax
sete al
mov ebp, eax
movzx eax, byte [esp + 0x41]
and eax, 0xfffffffe
or eax, ebp
and edi, 4
mov byte [esp + 0x41], al
je 0x6ada4ec0
movzx eax, byte [esi + 0x179]
shl eax, 0xa
mov edi, eax
mov eax, dword [esp + 0x40]
and eax, 0x3ff
or eax, edi
mov dword [esp + 0x40], eax
mov eax, dword [esi + 0x17c]
mov dword [esp + 0x44], eax
movzx eax, byte [esp + 0x74]
mov dword [esp + 0x50], ecx
lea ecx, [esp + 0x48]
mov dword [esp], ecx
and eax, 0xfffffff0
mov dword [esp + 0x54], ebx
or eax, 1
mov dword [esp + 0x88], edx
mov byte [esp + 0x74], al
lea eax, [esp + 0x18]
mov dword [esp + 0x78], eax
lea eax, [esp + 0x88]
mov dword [esp + 0x3c], eax
mov dword [esp + 0x38], eax
mov eax, dword [esp + 0xf8]
mov dword [esp + 0x8c], edx
mov dword [esp + 4], eax
mov dword [esp + 0x80], 0
mov dword [esp + 0x84], 0
call fcn.6ada4d10
add esp, 0xdc
pop ebx
pop esi
pop edi
pop ebp
ret
and dword [esp + 0x40], 0x3ff
mov dword [esp + 0x44], 0
jmp 0x6ada4e49

Function at 0x6ada7c30
Capabilities:
Hash data using sha1

Disassembly:
push ebx
sub esp, 0x78
mov eax, dword [esp + 0x84]
lea ebx, [esp + 0x10]
mov dword [esp + 0x10], 0
mov dword [esp], ebx
mov dword [esp + 8], eax
mov eax, dword [esp + 0x80]
mov dword [esp + 0x14], 0
mov dword [esp + 4], eax
mov dword [esp + 0x18], 0x67452301
mov dword [esp + 0x1c], 0xefcdab89
mov dword [esp + 0x20], 0x98badcfe
mov dword [esp + 0x24], 0x10325476
mov dword [esp + 0x28], 0xc3d2e1f0
call fcn.6ada79f0
mov eax, dword [esp + 0x88]
mov dword [esp + 4], ebx
mov dword [esp], eax
call fcn.6ada7ba0
add esp, 0x78
pop ebx
ret
Function at 0x6adad400
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
push edi
push esi
push ebx
mov ebx, eax
sub esp, 0x3c
movzx eax, byte [eax + 0x2c]
and eax, 0xf
cmp al, 1
je 0x6adad431
mov dword [esp + 8], 0xfb
mov dword [esp + 4], str.src_write.c
mov dword [esp], str.blob__blob_location__BLOB_IN_WIM
call dword [0x6ae0f298]
mov edx, dword [ebx + 0x30]
mov esi, dword [edx + 8]
mov edi, dword [edx + 0xc]
mov ebp, dword [edx + 0x1c]
movzx eax, byte [edx + 0x28]
mov dword [esp + 0x18], esi
mov esi, dword [edx + 0x10]
mov dword [esp + 0x1c], edi
mov edi, dword [edx + 0x18]
mov dword [esp + 0x24], ebp
mov edx, dword [edx + 0x14]
mov dword [esp + 0x20], edi
mov dword [esp + 0x2c], esi
test al, 0x10
je 0x6adad4d0
mov edi, dword [ebx + 0x38]
mov ecx, dword [ebx + 8]
mov dword [ebx + 0x54], edx
mov ebp, dword [ebx + 0x3c]
mov esi, dword [esp + 0x18]
mov dword [ebx + 0x78], 0
mov dword [ebx + 0x70], edi
mov edi, dword [ebx + 0xc]
mov dword [ebx + 0x68], ecx
mov ecx, dword [ebx + 0x6c]
and edi, 0xffffff
mov dword [ebx + 0x74], ebp
mov ebp, dword [esp + 0x24]
and ecx, 0xff000000
mov dword [ebx + 0x48], esi
mov esi, dword [esp + 0x2c]
or ecx, edi
mov edi, dword [esp + 0x1c]
mov dword [ebx + 0x5c], ebp
mov dword [ebx + 0x6c], ecx
mov dword [ebx + 0x4c], edi
mov edi, dword [esp + 0x20]
mov dword [ebx + 0x50], esi
mov dword [ebx + 0x58], edi
mov dword [ebx + 0x7c], 0
mov byte [ebx + 0x6f], al
add esp, 0x3c
pop ebx
pop esi
pop edi
pop ebp
ret
mov ecx, dword [esp + 0x2c]
mov esi, dword [esp + 0x18]
mov edi, dword [esp + 0x1c]
mov dword [ebx + 0x68], ecx
mov ecx, edx
mov edx, dword [ebx + 0x6c]
mov dword [ebx + 0x70], esi
and ecx, 0xffffff
mov esi, dword [esp + 0x20]
mov dword [ebx + 0x74], edi
and edx, 0xff000000
mov edi, dword [esp + 0x24]
or edx, ecx
mov dword [ebx + 0x78], esi
mov dword [ebx + 0x7c], edi
mov dword [ebx + 0x6c], edx
mov byte [ebx + 0x6f], al
add esp, 0x3c
pop ebx
pop esi
pop edi
pop ebp
ret