joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100adbf0
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ecx
mov eax, dword [0x1023d48c]
lea edx, [esp]
push ebx
push ebp
push esi
push edi
mov edi, dword [eax + 0x1bac]
mov esi, 4
add edi, 0xe4
mov dword [esp + 0x10], ecx
mov ebp, dword [edi]
mov ebx, dword [edi + 8]
mov ebx, dword [ebx + ebp*4 - 4]
not ebx
nop dword [eax]
movzx eax, byte [edx]
lea edx, [edx + 1]
movzx ecx, bl
xor ecx, eax
shr ebx, 8
xor ebx, dword [ecx*4 + 0x10203410]
sub esi, 1
jne 0x100adc20
mov esi, dword [edi + 4]
not ebx
cmp ebp, esi
jne 0x100adc67
lea ecx, [ebp + 1]
test esi, esi
je 0x100adc55
mov eax, esi
cdq
sub eax, edx
sar eax, 1
add eax, esi
jmp 0x100adc5a
mov eax, 8
cmp eax, ecx
cmovg ecx, eax
push ecx
mov ecx, edi
call fcn.100b44d0
mov ecx, dword [edi]
mov eax, dword [edi + 8]
mov dword [eax + ecx*4], ebx
inc dword [edi]
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
Function at 0x100b2c50
Capabilities:
Hash data with crc32

Disassembly:
movss xmm0, dword [0x1022f908]
sub esp, 0x14
push ebx
push ebp
push esi
push edi
mov edi, dword [0x1023d48c]
comiss xmm0, dword [edi + 0x1e58]
ja 0x100b2ed1
cmp dword [edi + 0x1e54], 0
jne 0x100b2cbe
or edx, 0xffffffff
mov esi, 0x10224859
mov al, 0x23
or ebx, 0xffffffff
cmp al, 0x23
jne 0x100b2c96
cmp byte [esi], al
jne 0x100b2c96
cmp byte [esi + 1], al
cmove edx, ebx
movzx ecx, dl
movzx eax, al
xor ecx, eax
shr edx, 8
mov al, byte [esi]
inc esi
xor edx, dword [ecx*4 + 0x10203410]
test al, al
jne 0x100b2c88
not edx
mov ecx, edx
call fcn.100a8590
mov dword [edi + 0x1e54], eax
mov eax, dword [edi + 0x1d40]
lea edx, [esp + 0x10]
mov dword [esp + 0x18], 0x7f7fffff
mov dword [esp + 0x1c], 0x7f7fffff
mov ecx, dword [eax]
mov eax, dword [edi + 0x1c74]
or eax, 0x10
movss xmm2, dword [ecx + 0xc]
movss xmm1, dword [ecx + 0x10]
mulss xmm2, dword [0x1022f918]
mov dword [edi + 0x1c74], eax
or eax, 1
mulss xmm1, dword [0x1022f918]
mov dword [edi + 0x1cc4], 0
movss dword [esp + 0x10], xmm2
mov dword [edi + 0x1cc8], 0
movss dword [esp + 0x14], xmm1
movups xmm0, xmmword [esp + 0x10]
movups xmmword [edi + 0x1cb0], xmm0
movss xmm2, dword [ecx + 0xc]
movss xmm1, dword [ecx + 0x10]
mulss xmm2, dword [0x1022f964]
mulss xmm1, dword [0x1022f964]
addss xmm2, dword [ecx + 4]
addss xmm1, dword [ecx + 8]
mov dword [edi + 0x1c74], eax
mov ecx, 1
mov dword [edi + 0x1c8c], 0x3f000000
movss dword [edi + 0x1c84], xmm2
mov dword [edi + 0x1c90], 0x3f000000
movss dword [edi + 0x1c88], xmm1
mov dword [edi + 0x1c78], 1
movss xmm0, dword [edi + 0x152c]
addss xmm0, xmm0
movss dword [esp + 0x10], xmm0
movss xmm0, dword [edi + 0x1530]
addss xmm0, xmm0
movss dword [esp + 0x14], xmm0
call fcn.100a29a0
push 0xc1347
xor edx, edx
mov ecx, str.NavWindowingList
call fcn.100aac10
mov ebp, dword [edi + 0x1b70]
add esp, 4
sub ebp, 1
js 0x100b2ebb
nop dword [eax + eax]
mov eax, dword [edi + 0x1b78]
mov esi, dword [eax + ebp*4]
cmp byte [esi + 0xab], 0
je 0x100b2eb2
cmp esi, dword [esi + 0x32c]
jne 0x100b2eb2
test dword [esi + 0x10], 0x80000
jne 0x100b2eb2
mov ecx, dword [esi + 8]
mov edx, ecx
cmp ecx, 0xffffffff
jae 0x100b2e3a
nop dword [eax]
mov bl, byte [edx]
test bl, bl
je 0x100b2e36
cmp bl, 0x23
jne 0x100b2e30
cmp byte [edx + 1], bl
je 0x100b2e36
inc edx
cmp edx, 0xffffffff
jb 0x100b2e20
cmp ecx, edx
jne 0x100b2e8a
mov eax, dword [esi + 0x10]
test eax, 0x4000000
je 0x100b2e4b
mov ecx, str._Popup_
jmp 0x100b2e8a
test eax, 0x400
je 0x100b2e85
mov eax, str.MainMenuBar
mov dl, byte [ecx]
cmp dl, byte [eax]
jne 0x100b2e77
test dl, dl
je 0x100b2e73
mov dl, byte [ecx + 1]
cmp dl, byte [eax + 1]
jne 0x100b2e77
add ecx, 2
add eax, 2
test dl, dl
jne 0x100b2e57
xor eax, eax
jmp 0x100b2e7c
sbb eax, eax
or eax, 1
mov ecx, str._Main_menu_bar_
test eax, eax
je 0x100b2e8a
mov ecx, str._Untitled_
cmp dword [edi + 0x1e4c], esi
lea eax, [esp + 0x10]
push eax
push 0
sete dl
mov dword [esp + 0x18], 0
mov dword [esp + 0x1c], 0
call fcn.100cc5b0
add esp, 8
sub ebp, 1
jns 0x100b2de0
call fcn.100ad250
mov ecx, 1
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x14
jmp fcn.100a2a20
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x14
ret
Function at 0x100b31f0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push ecx
push ebx
push esi
push edi
mov edi, ecx
mov ebx, edx
cmp dword [edi + 0x2f6c], 0
lea esi, [edi + 0x2f70]
je 0x100b3272
mov ecx, dword [esi + 4]
test ecx, ecx
jns 0x100b322c
mov eax, ecx
cdq
sub eax, edx
sar eax, 1
add eax, ecx
xor ecx, ecx
test eax, eax
cmovg ecx, eax
push ecx
mov ecx, esi
call fcn.100b4770
push dword [ebp + 8]
mov ecx, esi
mov dword [esi], 0
push ebx
call fcn.100a2630
mov edx, dword [esi]
mov ecx, 0x1023d485
push dword [edi + 0x2f6c]
lea eax, [edx - 1]
neg edx
sbb edx, edx
and edx, eax
mov eax, dword [edi + 0x2f78]
test eax, eax
push edx
cmovne ecx, eax
push 1
push ecx
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
add esp, 0x10
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push dword [ebp + 8]
mov ecx, esi
push ebx
call fcn.100a2630
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x100b5fd0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push esi
mov esi, ecx
push edi
mov edi, dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov ecx, dword [esi + 8]
test ecx, ecx
je 0x100b600a
mov eax, dword [0x1023d48c]
mov dword [esi + 4], 0
mov dword [esi], 0
test eax, eax
je 0x100b5ffd
dec dword [eax + 0x370]
push ecx
call edi
add esp, 4
mov dword [esi + 8], 0
mov ecx, dword [esi + 0x14]
test ecx, ecx
je 0x100b603b
mov eax, dword [0x1023d48c]
mov dword [esi + 0x10], 0
mov dword [esi + 0xc], 0
test eax, eax
je 0x100b602e
dec dword [eax + 0x370]
push ecx
call edi
add esp, 4
mov dword [esi + 0x14], 0
mov ecx, dword [esi + 0x20]
test ecx, ecx
je 0x100b606c
mov eax, dword [0x1023d48c]
mov dword [esi + 0x1c], 0
mov dword [esi + 0x18], 0
test eax, eax
je 0x100b605f
dec dword [eax + 0x370]
push ecx
call edi
add esp, 4
mov dword [esi + 0x20], 0
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x34], 0
mov dword [esi + 0x38], 0
mov ecx, dword [esi + 0x44]
test ecx, ecx
je 0x100b60b9
mov eax, dword [0x1023d48c]
mov dword [esi + 0x40], 0
mov dword [esi + 0x3c], 0
test eax, eax
je 0x100b60ac
dec dword [eax + 0x370]
push ecx
call edi
add esp, 4
mov dword [esi + 0x44], 0
mov ecx, dword [esi + 0x50]
test ecx, ecx
je 0x100b60ea
mov eax, dword [0x1023d48c]
mov dword [esi + 0x4c], 0
mov dword [esi + 0x48], 0
test eax, eax
je 0x100b60dd
dec dword [eax + 0x370]
push ecx
call edi
add esp, 4
mov dword [esi + 0x50], 0
mov ecx, dword [esi + 0x5c]
test ecx, ecx
je 0x100b611b
mov eax, dword [0x1023d48c]
mov dword [esi + 0x58], 0
mov dword [esi + 0x54], 0
test eax, eax
je 0x100b610e
dec dword [eax + 0x370]
push ecx
call edi
add esp, 4
mov dword [esi + 0x5c], 0
pop edi
lea ecx, [esi + 0x78]
pop esi
jmp fcn.100b8a50
Function at 0x100b96d0
Capabilities:
Enumerate pe sections

Disassembly:
sub esp, 0x10c
push ebx
push ebp
push esi
mov esi, dword [esp + 0x11c]
push edi
movss dword [esp + 0x10], xmm3
mov dword [esp + 0x14], ecx
movzx ebx, byte [esi + 8]
movzx eax, byte [esi + 9]
shl ebx, 8
add ebx, eax
movzx eax, byte [esi + 0xa]
shl ebx, 8
add ebx, eax
movzx eax, byte [esi + 0xb]
shl ebx, 8
add ebx, eax
mov eax, dword [0x1023d48c]
test eax, eax
je 0x100b9719
inc dword [eax + 0x370]
push ebx
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
movzx edx, byte [esi]
add esp, 4
movzx ecx, byte [esi + 1]
mov ebp, eax
shl edx, 8
add edx, ecx
movzx ecx, byte [esi + 2]
shl edx, 8
add edx, ecx
movzx ecx, byte [esi + 3]
shl edx, 8
add edx, ecx
cmp edx, 0x57bc0000
jne 0x100b97c8
movzx ecx, byte [esi + 4]
movzx eax, byte [esi + 5]
shl ecx, 8
add ecx, eax
movzx eax, byte [esi + 6]
shl ecx, 8
add ecx, eax
movzx eax, byte [esi + 7]
shl ecx, 8
add ecx, eax
jne 0x100b97c8
movzx ecx, byte [esi + 8]
movzx eax, byte [esi + 9]
movzx edi, byte [esi + 0xb]
shl ecx, 8
add ecx, eax
mov dword [0x102732b0], esi
movzx eax, byte [esi + 0xa]
add esi, 0x10
shl ecx, 8
add ecx, eax
mov dword [0x102732b8], ebp
shl ecx, 8
add ecx, ebp
mov dword [0x102732bc], ebp
add edi, ecx
mov ecx, esi
mov dword [0x102732b4], edi
call fcn.100bbdd0
cmp eax, esi
je 0x100b97c8
cmp dword [0x102732bc], edi
ja 0x100b97c8
mov ecx, eax
mov esi, eax
call fcn.100bbdd0
cmp eax, esi
jne 0x100b97b3
mov esi, dword [esp + 0x128]
test esi, esi
je 0x100b97e0
mov ecx, 0x20
lea edi, [esp + 0x18]
rep movsd dword es:[edi], dword [esi]
jmp 0x100b982b
push 0x80
lea eax, [esp + 0x1c]
push 0
push eax
call sub.VCRUNTIME140.dll_memset
mov eax, 0xffff
mov byte [esp + 0x2c], 1
add esp, 0xc
mov dword [esp + 0x2c], 3
mov dword [esp + 0x30], 1
mov dword [esp + 0x50], 0x7f7fffff
mov dword [esp + 0x68], 0
mov dword [esp + 0x5c], 0x3f800000
mov word [esp + 0x60], ax
movss xmm0, dword [esp + 0x10]
lea esi, [esp + 0x18]
comiss xmm0, dword [0x1022f858]
mov ecx, 0x20
lea edi, [esp + 0x98]
rep movsd dword es:[edi], dword [esi]
mov ecx, 0x20
mov byte [esp + 0xa0], 1
lea esi, [esp + 0x98]
lea edi, [esp + 0x18]
rep movsd dword es:[edi], dword [esi]
mov dword [esp + 0x18], ebp
mov dword [esp + 0x1c], ebx
jbe 0x100b9874
movss dword [esp + 0x28], xmm0
mov eax, dword [esp + 0x12c]
test eax, eax
mov ecx, dword [esp + 0x48]
cmovne ecx, eax
lea eax, [esp + 0x18]
mov dword [esp + 0x48], ecx
mov ecx, dword [esp + 0x14]
push eax
call fcn.100b93d0
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10c
ret 0x10
Function at 0x100bd370
Capabilities:
Log keystrokes via polling

Disassembly:
sub esp, 0x2c
push ebx
mov ebx, dword [0x1023d48c]
push ebp
push esi
push edi
test ebx, ebx
je 0x100bd389
mov ebp, dword [ebx + 0xc4]
jmp 0x100bd38b
xor ebp, ebp
lea eax, [esp + 0x28]
xorps xmm0, xmm0
push eax
movups xmmword [esp + 0x2c], xmm0
push dword [ebp]
call dword [sym.imp.USER32.dll_GetClientRect]
mov eax, dword [esp + 0x30]
sub eax, dword [esp + 0x28]
movd xmm1, eax
mov eax, dword [esp + 0x34]
sub eax, dword [esp + 0x2c]
cvtdq2ps xmm1, xmm1
movd xmm0, eax
lea eax, [esp + 0x18]
cvtdq2ps xmm0, xmm0
push eax
movss dword [ebx + 0x10], xmm1
movss dword [ebx + 0x14], xmm0
xorps xmm0, xmm0
movlpd qword [esp + 0x1c], xmm0
call dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov edi, dword [esp + 0x18]
mov ecx, edi
sub ecx, dword [ebp + 8]
mov esi, dword [esp + 0x1c]
mov edx, esi
sbb edx, dword [ebp + 0xc]
call fcn.10185240
mov edx, dword [ebp + 0x14]
mov ecx, dword [ebp + 0x10]
cvtsd2ss xmm0, xmm0
movss dword [esp + 0x10], xmm0
call fcn.10185240
movss xmm1, dword [esp + 0x10]
cvtsd2ss xmm0, xmm0
push 0x11
divss xmm1, xmm0
movss dword [ebx + 0x18], xmm1
mov dword [ebp + 0xc], esi
mov esi, dword [sym.imp.USER32.dll_GetKeyState]
mov dword [ebp + 8], edi
call esi
shr eax, 0xf
and al, 1
push 0x10
mov byte [ebx + 0xfc], al
call esi
shr eax, 0xf
and al, 1
push 0x12
mov byte [ebx + 0xfd], al
call esi
mov esi, dword [0x1023d48c]
shr eax, 0xf
and al, 1
mov byte [ebx + 0xff], 0
mov byte [ebx + 0xfe], al
test esi, esi
je 0x100bd46e
mov edi, dword [esi + 0xc4]
jmp 0x100bd470
xor edi, edi
cmp byte [esi + 0x357], 0
je 0x100bd4b0
cvttss2si eax, dword [esi + 0xe4]
mov dword [esp + 0x10], eax
cvttss2si eax, dword [esi + 0xe8]
mov dword [esp + 0x14], eax
lea eax, [esp + 0x10]
push eax
push dword [edi]
call dword [sym.imp.USER32.dll_ClientToScreen]
test eax, eax
je 0x100bd4b0
push dword [esp + 0x14]
push dword [esp + 0x14]
call dword [sym.imp.USER32.dll_SetCursorPos]
mov dword [esi + 0xe4], 0xff7fffff
mov dword [esi + 0xe8], 0xff7fffff
call dword [sym.imp.USER32.dll_GetForegroundWindow]
test eax, eax
je 0x100bd522
mov ecx, dword [edi]
cmp eax, ecx
je 0x100bd4e0
push ecx
push eax
call dword [sym.imp.USER32.dll_IsChild]
test eax, eax
je 0x100bd522
lea eax, [esp + 0x20]
push eax
call dword [sym.imp.USER32.dll_GetCursorPos]
test eax, eax
je 0x100bd522
lea eax, [esp + 0x20]
push eax
push dword [edi]
call dword [sym.imp.USER32.dll_ScreenToClient]
test eax, eax
je 0x100bd522
movd xmm0, dword [esp + 0x20]
movd xmm1, dword [esp + 0x24]
cvtdq2ps xmm0, xmm0
cvtdq2ps xmm1, xmm1
movss dword [esi + 0xe4], xmm0
movss dword [esi + 0xe8], xmm1
cmp byte [ebx + 0xb0], 0
je 0x100bd530
or eax, 0xffffffff
jmp 0x100bd53b
mov eax, dword [0x1023d48c]
mov eax, dword [eax + 0x1e84]
cmp dword [ebp + 0x18], eax
je 0x100bd548
mov dword [ebp + 0x18], eax
call fcn.100bcfd0
call fcn.100bd100
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x2c
ret
Function at 0x100e2a30
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xffffffc0
sub esp, 0x34
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, ecx
mov dword [esp + 0x24], edx
push edi
mov edi, 1
mov eax, dword [esi + 0x14]
mov ecx, dword [esi + 0xc]
sub ecx, dword [eax]
sub ecx, 0x10
sar ecx, 4
sub ecx, ebx
je 0x100e2bf3
dec ecx
mov edx, ebx
mov dword [esp + 0x2c], ecx
mov ecx, esi
call fcn.100d46d0
cmp eax, 0x10207b40
je 0x100e2b4e
mov eax, dword [eax + 8]
and eax, 0xf
cmp al, 3
jne 0x100e2b4e
mov edx, ebx
mov ecx, esi
call fcn.100d46d0
mov edx, ebx
mov ecx, esi
cmp dword [eax + 8], 0x13
jne 0x100e2ae7
call fcn.100d46d0
cmp dword [eax + 8], 0x13
jne 0x100e2abb
mov ecx, dword [eax]
mov eax, dword [eax + 4]
push eax
push ecx
mov dword [esp + 0x38], ecx
mov dword [esp + 0x3c], eax
push str._lld
jmp 0x100e2b2b
push 0
lea edx, [esp + 0x34]
mov ecx, eax
call fcn.100f75a0
add esp, 4
test eax, eax
jne 0x100e2ad8
xorps xmm0, xmm0
movlpd qword [esp + 0x30], xmm0
push dword [esp + 0x34]
push dword [esp + 0x34]
push str._lld
jmp 0x100e2b2b
call fcn.100d46d0
cmp dword [eax + 8], 3
jne 0x100e2afe
movsd xmm0, qword [eax]
movsd qword [esp + 0x38], xmm0
jmp 0x100e2b1e
lea edx, [esp + 0x38]
mov ecx, eax
call fcn.100f7500
test eax, eax
jne 0x100e2b18
xorps xmm0, xmm0
movsd qword [esp + 0x38], xmm0
jmp 0x100e2b1e
movsd xmm0, qword [esp + 0x38]
sub esp, 8
movsd qword [esp], xmm0
push str._.14g
push dword [esp + 0x34]
call fcn.1009af10
add esp, 0x10
test edi, edi
je 0x100e2bc9
test eax, eax
jle 0x100e2bc9
mov edi, 1
jmp 0x100e2bcb
mov edx, ebx
mov ecx, esi
call fcn.100d46d0
mov ecx, dword [eax + 8]
and ecx, 0xf
cmp ecx, 4
je 0x100e2b8d
cmp ecx, 3
jne 0x100e2c02
mov edx, eax
mov ecx, esi
call fcn.100e8660
mov eax, dword [esi + 0x10]
cmp dword [eax + 0xc], 0
jle 0x100e2b84
mov ecx, esi
call fcn.100e10e0
mov edx, ebx
mov ecx, esi
call fcn.100d46d0
mov eax, dword [eax]
cmp byte [eax + 4], 4
jne 0x100e2b9b
movzx ebx, byte [eax + 7]
jmp 0x100e2b9e
mov ebx, dword [eax + 0xc]
add eax, 0x10
je 0x100e2bff
test edi, edi
je 0x100e2bc6
push dword [esp + 0x28]
push ebx
push 1
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
add esp, 0x10
cmp eax, ebx
jne 0x100e2bc6
mov ebx, dword [ebp + 8]
mov edi, 1
jmp 0x100e2bcb
mov ebx, dword [ebp + 8]
xor edi, edi
mov ecx, dword [esp + 0x2c]
inc ebx
mov dword [ebp + 8], ebx
test ecx, ecx
jne 0x100e2a60
test edi, edi
jne 0x100e2bf3
push edi
mov edx, edi
mov ecx, esi
call fcn.100d62e0
add esp, 4
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
pop edi
pop esi
mov eax, 1
pop ebx
mov esp, ebp
pop ebp
ret
mov ebx, dword [ebp + 8]
push 4
mov edx, ebx
mov ecx, esi
call fcn.100d61f0
int3
Function at 0x100e6330
Capabilities:
Query environment variable

Disassembly:
sub esp, 0x10c
push esi
push edi
push str._5_3
push dword [esp + 0x11c]
mov esi, ecx
mov dword [esp + 0x10], edx
push str._s_s
push esi
call fcn.100d4cd0
push eax
call dword [sym.imp.api_ms_win_crt_environment_l1_1_0.dll_getenv]
mov edi, eax
add esp, 0x14
test edi, edi
jne 0x100e637b
push dword [esp + 0x118]
call dword [sym.imp.api_ms_win_crt_environment_l1_1_0.dll_getenv]
mov edi, eax
add esp, 4
test edi, edi
je 0x100e63aa
mov edx, dword [esi + 0x10]
mov ecx, esi
add edx, 0x28
push str.LUA_NOENV
call fcn.100d4db0
mov eax, dword [esi + 0xc]
add esp, 4
add eax, 0xfffffff0
mov ecx, dword [eax + 8]
test ecx, ecx
je 0x100e63e9
cmp ecx, 1
jne 0x100e63a7
cmp dword [eax], 0
je 0x100e63e9
mov dword [esi + 0xc], eax
mov edx, dword [esp + 0x11c]
test edx, edx
jne 0x100e63bd
mov eax, dword [esi + 0xc]
mov dword [eax + 8], edx
jmp 0x100e63d3
mov ecx, esi
call fcn.100ef290
mov ecx, dword [esi + 0xc]
mov dword [ecx], eax
movzx eax, byte [eax + 4]
or eax, 0x40
mov dword [ecx + 8], eax
mov eax, dword [esi + 0x10]
add dword [esi + 0xc], 0x10
cmp dword [eax + 0xc], 0
jle 0x100e6429
mov ecx, esi
call fcn.100e10e0
jmp 0x100e6429
push 0x10225ec4
push 0x10225ec0
mov edx, edi
mov dword [esi + 0xc], eax
mov ecx, esi
call fcn.100d7900
push dword [esp + 0x124]
mov edx, eax
mov ecx, esi
push 0x10225ebc
call fcn.100d7900
push 0xffffffffffffffff
mov edx, 0xfffffffe
mov ecx, esi
call fcn.100d4880
add esp, 0x14
add dword [esi + 0xc], 0xfffffff0
push 0x105
lea eax, [esp + 0x10]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
je 0x100e64ee
cmp eax, 0x105
je 0x100e64ee
lea eax, [esp + 0xc]
push 0x5c
push eax
call dword [sym.imp.VCRUNTIME140.dll_strrchr]
add esp, 8
test eax, eax
je 0x100e64ee
mov byte [eax], 0
mov eax, dword [esi + 0xc]
sub eax, 0x10
mov ecx, dword [eax + 8]
and ecx, 0xf
cmp ecx, 4
je 0x100e64a2
cmp ecx, 3
je 0x100e6483
xor edx, edx
jmp 0x100e64a7
mov edx, eax
mov ecx, esi
call fcn.100e8660
mov eax, dword [esi + 0x10]
cmp dword [eax + 0xc], 0
jle 0x100e649c
mov ecx, esi
call fcn.100e10e0
mov eax, dword [esi + 0xc]
sub eax, 0x10
mov edx, dword [eax]
add edx, 0x10
lea eax, [esp + 0xc]
mov ecx, esi
push eax
push 0x10225e30
call fcn.100d7900
push 0xffffffffffffffff
mov edx, 0xfffffffe
mov ecx, esi
call fcn.100d4880
add dword [esi + 0xc], 0xfffffff0
add esp, 0xc
mov edx, dword [esi + 0xc]
mov ecx, esi
push dword [esp + 8]
lea edx, [edx - 0x30]
call fcn.100d4f50
add esp, 4
add dword [esi + 0xc], 0xfffffff0
pop edi
pop esi
add esp, 0x10c
ret
push str.unable_to_get_ModuleFileName
push esi
call fcn.100d62a0
int3
Function at 0x100e80f0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x1c
push ebx
push esi
mov ebx, edx
mov esi, ecx
push edi
mov dword [esp + 0x1c], ebx
call dword [sym.imp.api_ms_win_crt_locale_l1_1_0.dll_localeconv]
xor ecx, ecx
xor edi, edi
mov dword [esp + 0x18], ecx
xorps xmm1, xmm1
mov eax, dword [eax]
movsx eax, byte [eax]
mov dword [esp + 0x10], eax
xor eax, eax
mov dword [ebx], esi
mov cl, byte [esi]
mov dword [esp + 0x14], eax
mov dword [esp + 0xc], eax
movzx eax, cl
test byte [eax + 0x10207671], 8
je 0x100e8148
mov cl, byte [esi + 1]
inc esi
movzx eax, cl
test byte [eax + 0x10207671], 8
jne 0x100e8138
lea edx, [esi + 1]
cmp cl, 0x2d
jne 0x100e815a
mov dword [esp + 0x20], 1
jmp 0x100e8164
cmp cl, 0x2b
mov dword [esp + 0x20], edi
cmovne edx, esi
cmp byte [edx], 0x30
jne 0x100e82b4
mov al, byte [edx + 1]
cmp al, 0x78
je 0x100e817c
cmp al, 0x58
jne 0x100e82b4
movsd xmm2, qword [0x1022fa60]
add edx, 2
mov eax, dword [esp + 0x10]
nop dword [eax + eax]
mov bl, byte [edx]
mov esi, edx
movsx ecx, bl
cmp ecx, eax
jne 0x100e81ad
cmp dword [esp + 0xc], 0
jne 0x100e820c
mov dword [esp + 0xc], 1
inc edx
jmp 0x100e8190
movzx eax, bl
test byte [eax + 0x10207671], 0x10
je 0x100e820c
mov eax, dword [esp + 0x14]
test eax, eax
jne 0x100e81cc
cmp bl, 0x30
jne 0x100e81cc
inc dword [esp + 0x18]
jmp 0x100e81fd
inc eax
mov dword [esp + 0x14], eax
cmp eax, 0x1e
jg 0x100e81fc
test byte [ecx + 0x10207671], 2
je 0x100e81e4
add ecx, 0xffffffd0
jmp 0x100e81ea
or ecx, 0x20
sub ecx, 0x57
movd xmm0, ecx
cvtdq2pd xmm0, xmm0
mulsd xmm1, xmm2
addsd xmm1, xmm0
jmp 0x100e81fd
inc edi
cmp dword [esp + 0xc], 0
mov eax, dword [esp + 0x10]
je 0x100e8209
dec edi
inc edx
jmp 0x100e8190
mov eax, dword [esp + 0x14]
add eax, dword [esp + 0x18]
je 0x100e82b4
mov eax, dword [esp + 0x1c]
shl edi, 2
mov dword [eax], edx
mov al, byte [edx]
cmp al, 0x70
je 0x100e822d
cmp al, 0x50
jne 0x100e8283
mov al, byte [edx + 1]
inc edx
xor ecx, ecx
cmp al, 0x2d
jne 0x100e823f
lea edx, [esi + 2]
lea esi, [ecx + 1]
jmp 0x100e8248
cmp al, 0x2b
jne 0x100e8246
lea edx, [esi + 2]
xor esi, esi
mov bl, byte [edx]
movzx eax, bl
test byte [eax + 0x10207671], 2
je 0x100e82b4
movsx eax, bl
lea ecx, [ecx + ecx*4]
mov bl, byte [edx + 1]
lea ecx, [ecx - 0x18]
inc edx
lea ecx, [eax + ecx*2]
movzx eax, bl
test byte [eax + 0x10207671], 2
jne 0x100e8256
mov eax, ecx
neg eax
test esi, esi
cmove eax, ecx
add edi, eax
mov eax, dword [esp + 0x1c]
mov dword [eax], edx
cmp dword [esp + 0x20], 0
je 0x100e8291
xorps xmm1, xmmword [0x1022fed0]
push edi
sub esp, 8
movsd qword [esp], xmm1
call dword [sym.imp.api_ms_win_crt_math_l1_1_0.dll_ldexp]
fstp qword [esp + 0x2c]
movsd xmm0, qword [esp + 0x2c]
add esp, 0xc
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
pop edi
pop esi
xorps xmm0, xmm0
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x100e84e0
Capabilities:
Check http status code

Disassembly:
sub esp, 0xdc
push ebx
push ebp
push esi
mov ebp, edx
lea edx, [esp + 0xc]
push edi
mov edi, ecx
call fcn.100e8340
mov esi, eax
test esi, esi
je 0x100e8523
mov edx, dword [esp + 0x10]
sub esi, edi
mov ecx, dword [esp + 0x14]
mov eax, 0x13
mov dword [ebp], edx
mov dword [ebp + 4], ecx
mov dword [ebp + 8], eax
lea eax, [esi + 1]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xdc
ret
push str..xXnN
push edi
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strpbrk]
add esp, 8
test eax, eax
je 0x100e854e
movzx ebx, byte [eax]
or ebx, 0x20
cmp ebx, 0x6e
jne 0x100e8550
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xdc
ret
xor ebx, ebx
push ebx
lea edx, [esp + 0x14]
mov ecx, edi
call fcn.100e82c0
mov esi, eax
add esp, 4
test esi, esi
jne 0x100e85df
push 0x2e
push edi
call dword [sym.imp.VCRUNTIME140.dll_strchr]
mov edx, edi
mov esi, eax
add esp, 8
lea eax, [edx + 1]
mov cl, byte [edx]
inc edx
test cl, cl
jne 0x100e8578
sub edx, eax
cmp edx, 0xc8
ja 0x100e8541
test esi, esi
je 0x100e8541
lea edx, [esp + 0x18]
mov ecx, edi
sub edx, edi
mov al, byte [ecx]
lea ecx, [ecx + 1]
mov byte [edx + ecx - 1], al
test al, al
jne 0x100e8595
call dword [sym.imp.api_ms_win_crt_locale_l1_1_0.dll_localeconv]
sub esi, edi
lea edx, [esp + 0x10]
push ebx
lea ecx, [esp + 0x1c]
mov eax, dword [eax]
mov al, byte [eax]
mov byte [esp + esi + 0x1c], al
call fcn.100e82c0
mov esi, eax
add esp, 4
test esi, esi
je 0x100e8541
mov eax, edi
lea ecx, [esp + 0x18]
sub eax, ecx
add esi, eax
test esi, esi
je 0x100e8541
movsd xmm0, qword [esp + 0x10]
sub esi, edi
mov eax, 3
movsd qword [ebp], xmm0
pop edi
mov dword [ebp + 8], eax
lea eax, [esi + 1]
pop esi
pop ebp
pop ebx
add esp, 0xdc
ret

Function at 0x100eef50
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
mov esi, edx
mov ebx, ecx
push edi
mov edi, esi
mov eax, esi
xor eax, dword [esp + 0x10]
shr edi, 5
inc edi
cmp esi, edi
jb 0x100eef8b
nop word [eax + eax]
movzx edx, byte [ebx + esi - 1]
mov ecx, eax
shl ecx, 5
sub esi, edi
add edx, ecx
mov ecx, eax
shr ecx, 2
add edx, ecx
xor eax, edx
cmp esi, edi
jae 0x100eef70
pop edi
pop esi
pop ebx
ret