joyce8/EMBER2024-capa huggingface dataset:
Function at 0x406f10
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x40c5a0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.004048df
and dword [ebp - 0x14], 0
cmp dword [0x42a114], 0
mov dword [ebp - 0x18], eax
jne 0x406fc3
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x40706b
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxW
push ebx
call edi
test eax, eax
je 0x40706b
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push str.GetActiveWindow
push ebx
mov dword [0x42a114], eax
call edi
push eax
call esi
push str.GetLastActivePopup
push ebx
mov dword [0x42a118], eax
call edi
push eax
call esi
push str.GetUserObjectInformationW
push ebx
mov dword [0x42a11c], eax
call edi
push eax
call esi
mov dword [0x42a124], eax
test eax, eax
je 0x406fc3
push str.GetProcessWindowStation
push ebx
call edi
push eax
call esi
mov dword [0x42a120], eax
mov eax, dword [0x42a120]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x40701c
cmp dword [0x42a124], ecx
je 0x40701c
push eax
call esi
push dword [0x42a124]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x40701c
test ebx, ebx
je 0x40701c
call edi
test eax, eax
je 0x407013
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x407013
test byte [ebp - 8], 1
jne 0x40701c
or dword [ebp + 0x10], 0x200000
jmp 0x40704f
mov eax, dword [0x42a118]
cmp eax, dword [ebp - 0x18]
je 0x40704f
push eax
call esi
test eax, eax
je 0x40704f
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x40704f
mov eax, dword [0x42a11c]
cmp eax, dword [ebp - 0x18]
je 0x40704f
push eax
call esi
test eax, eax
je 0x40704f
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x42a114]
call esi
test eax, eax
je 0x40706b
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x40706d
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00405c41
leave
ret
Function at 0x401450
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push esi
push dword [esp + 0xc]
push dword [esp + 0xc]
push 0
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov esi, eax
test esi, esi
je 0x40147a
push esi
push 0
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [esp + 0x14]
test eax, eax
mov dword [ecx], eax
jne 0x40147e
xor eax, eax
pop esi
ret
push esi
push 0
call dword [sym.imp.KERNEL32.dll_LoadResource]
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ecx, dword [esp + 0x10]
push 1
mov dword [ecx], eax
pop eax
pop esi
ret

Function at 0x401499
Capabilities:
Create new key via cryptacquirecontext
Generate random numbers via winapi

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_CryptAcquireContextA]
push edi
xor edi, edi
push edi
push 1
push edi
lea eax, [ebp - 4]
push edi
push eax
mov dword [ebp - 4], edi
mov dword [ebp - 8], edi
call esi
test eax, eax
jne 0x4014da
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x80090016
jne 0x4014ed
push 8
push 1
push edi
lea eax, [ebp - 4]
push edi
push eax
call esi
test eax, eax
je 0x4014ed
lea eax, [ebp - 8]
push eax
push 4
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_CryptGenRandom]
test eax, eax
jne 0x4014f1
xor eax, eax
jmp 0x401503
cmp dword [ebp - 4], edi
je 0x401500
push edi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
mov eax, dword [ebp - 8]
pop edi
pop esi
leave
ret

Function at 0x4052f8
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.00404fb8

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x10003b30
Capabilities:
Link many functions at runtime

Disassembly:
push ecx
push esi
mov esi, dword [sym.imp.kernel32.dll_LoadLibraryA]
push str.fribidi
mov dword [0x101690f8], 0
call esi
mov dword [0x101690f8], eax
test eax, eax
jne 0x10003b7a
push str.fribidi_0
call esi
mov dword [0x101690f8], eax
test eax, eax
jne 0x10003b7a
push str.libfribidi_0
call esi
mov dword [0x101690f8], eax
test eax, eax
jne 0x10003b7a
mov eax, 1
pop esi
pop ecx
ret
mov esi, dword [sym.imp.kernel32.dll_GetProcAddress]
push str.fribidi_get_par_embedding_levels_ex
push eax
call esi
mov dword [0x101690ec], eax
push str.fribidi_get_bracket_types
push dword [0x101690f8]
test eax, eax
je 0x10003ba9
call esi
mov dword [0x101690e0], eax
test eax, eax
je 0x10003bab
jmp 0x10003bbf
call esi
mov dword [0x101690ec], 0x10003b00
mov dword [0x101690e0], 0x10003b20
push str.fribidi_unicode_to_charset
push dword [0x101690f8]
call esi
mov dword [0x101690dc], eax
push str.fribidi_charset_to_unicode
push dword [0x101690f8]
test eax, eax
je 0x10003c38
call esi
mov dword [0x101690f0], eax
test eax, eax
je 0x10003c3f
push str.fribidi_get_bidi_types
push dword [0x101690f8]
call esi
mov dword [0x101690e4], eax
test eax, eax
je 0x10003c51
push str.fribidi_get_par_embedding_levels
push dword [0x101690f8]
call esi
mov dword [0x101690e8], eax
test eax, eax
je 0x10003c63
push str.fribidi_version_info
push dword [0x101690f8]
call esi
test eax, eax
je 0x10003c70
mov eax, dword [eax]
test eax, eax
je 0x10003c70
mov dword [0x101690f4], eax
xor eax, eax
pop esi
pop ecx
ret
call esi
mov dword [0x101690f0], eax
push str.fribidi_get_bidi_types
push dword [0x101690f8]
call esi
mov dword [0x101690e4], eax
push str.fribidi_get_par_embedding_levels
push dword [0x101690f8]
call esi
mov dword [0x101690e8], eax
push str.fribidi_version_info
push dword [0x101690f8]
call esi
push dword [0x101690f8]
call dword [sym.imp.kernel32.dll_FreeLibrary]
mov dword [0x101690f8], 0
mov eax, 2
pop esi
pop ecx
ret
Function at 0x1005a5a0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
pushal
call 0x1005a5af
pop dword [ebp - 0xc]
mov eax, 0x27a604ea
add eax, 0xe85fa0c5
sub dword [ebp - 0xc], eax
mov dword [ebp - 0x1c], 0xbef7564
add dword [ebp - 0x1c], 0x4262cfe7
mov dword [ebp - 0x18], 0xbfe723c6
add dword [ebp - 0x18], 0x724c287f
mov dword [ebp - 0x14], 0xc725b5a5
add dword [ebp - 0x14], 0x85268e89
mov dword [ebp - 0x10], 0x4df10279
add dword [ebp - 0x10], 0xb20efd87
lea eax, [ebp - 0x1c]
push eax
mov eax, 0xf7050d05
add eax, 0x190b836f
add eax, dword [ebp - 0xc]
call dword [eax]
mov dword [ebp - 0x1c], 0xaff731b1
sub dword [ebp - 0x1c], 0x3b84c85b
mov dword [ebp - 0x18], 0xecf95a68
add dword [ebp - 0x18], 0x5473070d
mov dword [ebp - 0x14], 0xb4b7122f
add dword [ebp - 0x14], 0xaeb85a3d
mov dword [ebp - 0x10], 0x23022dcd
add dword [ebp - 0x10], 0xdcfdd233
lea ebx, [ebp - 0x1c]
push ebx
push eax
mov eax, 0x20438a26
sub eax, 0x1032f9b6
add eax, dword [ebp - 0xc]
call dword [eax]
push 0x40
push 0x1000
push 0x483b6
push 0
call eax
mov ecx, 0x468a
mov esi, eax
mov edi, 0x10171e00
add edi, dword [ebp - 0xc]
mov ebx, 0xa10adec3
add ebx, 0x14d5fa33
mov edx, dword [edi]
xor dword [ebp - 4], ecx
xor edx, ebx
sub dword [ebp - 4], 0xa1a75e3b
mov dword [esi], edx
xor dword [ebp - 8], ecx
add esi, 0x9b67fd9
add esi, 0xf649802b
add edi, 0x2c181af
sub edi, 0x2c181ab
loop 0x1005a6c5
add eax, 0x10cfb
mov ebx, eax
add eax, 0xa811dd24
add eax, 0x57ee22e1
mov ecx, 0x10000000
add ecx, dword [ebp - 0xc]
call ebx
leave
ret
Function at 0x10076690
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ebx
mov ebx, dword [esp + 0x10]
mov eax, 1
push esi
push edi
mov ecx, 0x3020100
mov edx, dword [ebx + 0x118]
mov dword [ebx + 0x120], 0x3020100
add ecx, 0x4040404
mov dword [ebx + eax*4 + 0x120], ecx
inc eax
cmp eax, edx
jbe 0x100766b1
xor esi, esi
xor edi, edi
cmp dword [esp + 0x14], esi
je 0x1007670d
push ebp
mov ebp, dword [esp + 0x14]
movzx eax, byte [esi + ebp]
mov edx, dword [esp + 0x1c]
or edi, eax
mov ebx, edx
mov cl, byte [eax + edx + 0x120]
mov byte [esi + ebp], cl
mov byte [edx + 0x11f], cl
nop
mov cl, byte [eax + ebx + 0x11f]
mov edx, eax
sub eax, 1
mov byte [edx + ebx + 0x120], cl
jns 0x100766f0
inc esi
cmp esi, dword [esp + 0x18]
jb 0x100766d2
pop ebp
mov eax, dword [esp + 0x18]
shr edi, 2
mov dword [eax + 0x118], edi
pop edi
pop esi
pop ebx
ret
Function at 0x10097210
Capabilities:
Hash data using fnv

Disassembly:
push ebx
push esi
mov esi, ecx
cmp dword [esi + 0x1c], 0
je 0x1009728d
mov ebx, dword [esp + 0xc]
movzx eax, bl
xor eax, 0x811c9dc5
imul edx, eax, 0x1000193
mov eax, ebx
shr eax, 8
movzx eax, al
xor edx, eax
mov eax, ebx
shr eax, 0x10
imul ecx, edx, 0x1000193
movzx eax, al
xor ecx, eax
mov eax, ebx
imul ecx, ecx, 0x1000193
shr eax, 0x18
xor ecx, eax
imul eax, ecx, 0x1000193
mov ecx, esi
push eax
lea eax, [esp + 0x10]
push eax
call fcn.100ded30
mov ecx, dword [eax + 4]
test ecx, 0x40000000
je 0x1009728d
test ecx, ecx
js 0x1009728d
cmp dword [eax], ebx
jne 0x1009728d
mov ecx, dword [esp + 0x10]
test ecx, ecx
je 0x10097286
add eax, 8
mov dword [ecx], eax
pop esi
mov al, 1
pop ebx
ret 8
pop esi
xor al, al
pop ebx
ret 8
Function at 0x100a4040
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ecx
mov eax, ecx
mov dword [esp], eax
cmp byte [eax], 0
je 0x100a4137
push ebx
mov ebx, dword [esp + 0x14]
test ebx, ebx
je 0x100a4136
mov ecx, dword [esp + 0xc]
push esi
push edi
mov edi, dword [esp + 0x18]
mov dword [eax + 4], 0xffffffff
push ebp
movzx esi, byte [edi]
movzx eax, byte [edi + 1]
shl esi, 8
add esi, eax
nop word [eax + eax]
push ecx
mov ecx, dword [esp + 0x14]
push esi
call fcn.100e4110
mov ecx, dword [esp + 0x18]
mov edx, eax
mov dword [esp + 0x20], edx
test cl, cl
je 0x100a40a1
test edx, edx
je 0x100a4133
mov ebp, esi
and ebp, 0xfffffe00
mov dword [esp + 0x1c], ebp
nop dword [eax]
test cl, cl
jne 0x100a40b8
test edx, edx
je 0x100a4107
mov eax, esi
xor ecx, ecx
shr eax, 6
and esi, 0x3f
and eax, 7
mov ebp, dword [edx + eax*8 + 4]
lea edx, [edx + eax*8]
xor eax, eax
bts eax, esi
cmp esi, 0x20
cmovae ecx, eax
xor eax, ecx
cmp esi, 0x40
mov esi, dword [edx]
cmovae ecx, eax
cmp byte [esp + 0x18], 0
je 0x100a40ee
or eax, esi
or ecx, ebp
jmp 0x100a40f6
not eax
not ecx
and eax, esi
and ecx, ebp
mov ebp, dword [esp + 0x1c]
mov dword [edx], eax
mov dword [edx + 4], ecx
mov edx, dword [esp + 0x20]
mov ecx, dword [esp + 0x18]
add edi, dword [esp + 0x24]
sub ebx, 1
je 0x100a4133
movzx esi, byte [edi]
movzx eax, byte [edi + 1]
shl esi, 8
add esi, eax
cmp ebp, esi
ja 0x100a4080
lea eax, [ebp + 0x200]
cmp esi, eax
jb 0x100a40b0
jmp 0x100a4080
pop ebp
pop edi
pop esi
pop ebx
pop ecx
ret 0x10

Function at 0x100a4140
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ecx
cmp byte [ecx], 0
push ebx
push ebp
push esi
push edi
mov dword [esp + 0x10], ecx
je 0x100a421e
mov ebx, dword [esp + 0x20]
test ebx, ebx
je 0x100a421e
mov edi, dword [esp + 0x1c]
mov dword [ecx + 4], 0xffffffff
movzx esi, byte [edi]
movzx eax, byte [edi + 1]
shl esi, 8
add esi, eax
mov ebp, esi
nop word [eax + eax]
push dword [esp + 0x18]
push esi
call fcn.100e4110
mov ecx, eax
mov eax, dword [esp + 0x18]
mov dword [esp + 0x20], ecx
test al, al
je 0x100a419c
test ecx, ecx
je 0x100a4214
mov edx, esi
and edx, 0xfffffe00
add edx, 0x200
mov dword [esp + 0x1c], edx
nop
cmp esi, ebp
jb 0x100a4214
mov ebp, esi
test al, al
jne 0x100a41be
test ecx, ecx
je 0x100a41ee
mov eax, esi
and esi, 0x3f
shr eax, 6
and eax, 7
lea edx, [ecx + eax*8]
xor eax, eax
xor ecx, ecx
bts eax, esi
cmp esi, 0x20
cmovae ecx, eax
xor eax, ecx
cmp esi, 0x40
cmovae ecx, eax
or dword [edx], eax
or dword [edx + 4], ecx
mov ecx, dword [esp + 0x20]
mov edx, dword [esp + 0x1c]
add edi, dword [esp + 0x24]
sub ebx, 1
je 0x100a421e
movzx esi, byte [edi]
movzx eax, byte [edi + 1]
shl esi, 8
add esi, eax
mov eax, dword [esp + 0x18]
cmp esi, edx
jb 0x100a41b0
mov ecx, dword [esp + 0x10]
jmp 0x100a4180
pop edi
pop esi
pop ebp
xor al, al
pop ebx
pop ecx
ret 0x10
pop edi
pop esi
pop ebp
mov al, 1
pop ebx
pop ecx
ret 0x10
Function at 0x100a6810
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x28
mov eax, dword [0x101685a4]
xor eax, esp
mov dword [esp + 0x24], eax
push ebx
mov ebx, dword [esp + 0x30]
push ebp
push esi
mov esi, ecx
mov dword [esp + 0x14], ebx
push edi
mov edi, dword [esp + 0x40]
push 0x5c
mov dword [esi], ebx
push 0
movups xmm0, xmmword [edi]
movups xmmword [esi + 4], xmm0
mov eax, dword [edi + 0x10]
mov dword [esi + 0x14], eax
lea eax, [esi + 0x1c]
push eax
mov dword [esi + 0x6c], 0
mov dword [esi + 0x70], 0
mov dword [esi + 0x74], 0
call sub.VCRUNTIME140.dll_memset
mov dword [esi + 0x58], 0
mov dword [esi + 0x54], 0
mov dword [esi + 0x5c], 0
mov dword [esi + 0x60], 0
mov dword [esi + 0x64], 0
mov dword [esi + 0x68], 0
mov dword [esi + 0x70], 0
mov dword [esi + 0x6c], 0
mov dword [esi + 0x74], 0
mov dword [esi + 0x18], ebx
movups xmm0, xmmword [edi]
mov dword [esp + 0x1c], 3
mov dword [esp + 0x20], 3
movups xmmword [esi + 0x1c], xmm0
mov eax, dword [edi + 0x10]
mov dword [esi + 0x2c], eax
lea eax, [esp + 0x34]
push eax
lea eax, [esp + 0x24]
push eax
lea eax, [esp + 0x30]
push eax
lea eax, [esp + 0x28]
push eax
push dword [esi + 0x24]
push dword [esi + 0x20]
call fcn.10106600
add esp, 0x24
lea ebx, [esi + 0x3c]
xor ebp, ebp
nop word [eax + eax]
mov edi, dword [ebp*4 + str.BUSGSOPGtlac]
lea eax, [ebx - 0xc]
push eax
push ebx
lea eax, [esp + 0x24]
push eax
push dword [esp + 0x1c]
push edi
push dword [esi + 0x18]
call fcn.10106440
test eax, eax
setne al
mov byte [esi + ebp + 0x38], al
lea eax, [ebx + 8]
push eax
lea eax, [esp + 0x44]
push eax
push dword [esp + 0x34]
push dword [ebx]
push edi
push dword [esi + 0x18]
call fcn.10106330
inc ebp
add esp, 0x30
add ebx, 4
cmp ebp, 2
jb 0x100a68f0
mov ebx, dword [esp + 0x18]
lea ecx, [ebx + 0xa0]
call fcn.100cba90
mov edi, 0x10161c90
mov ebp, 0x100
mov edx, edi
cmp dword [eax + 0x10], 8
cmovae edx, dword [eax + 0xc]
movzx ecx, byte [edx]
movzx eax, byte [edx + 1]
imul ecx, ebp
add cx, ax
jne 0x100a698f
lea ecx, [ebx + 0xa4]
call fcn.100cb920
cmp dword [eax + 0x10], 8
cmovae edi, dword [eax + 0xc]
movzx ecx, byte [edi]
movzx eax, byte [edi + 1]
imul ecx, ebp
add cx, ax
je 0x100a69aa
mov eax, dword [esp + 0x40]
mov eax, dword [eax]
and eax, 0xfffffffe
cmp eax, 4
je 0x100a69ae
push ebx
call fcn.10105dd0
add esp, 4
test eax, eax
je 0x100a69ae
xor al, al
jmp 0x100a69b0
mov al, 1
mov bl, byte [esi + 0x78]
and bl, 0xfe
or bl, al
push esi
mov byte [esi + 0x78], bl
call fcn.100d26d0
mov edx, eax
add esp, 4
mov dword [esi + 0x7c], edx
mov ecx, dword [edx + 0x30]
neg ecx
sbb cl, cl
and bl, 0xfd
and cl, 2
or cl, bl
mov byte [esi + 0x78], cl
mov al, byte [edx + 0x34]
shl al, 2
xor al, cl
and al, 4
xor al, cl
mov byte [esi + 0x78], al
test al, 1
mov eax, esi
je 0x100a69ff
cmp edx, 0x1015e518
je 0x100a69ff
mov dword [esi + 0x7c], 0x1015e550
mov ecx, dword [esp + 0x34]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.10107bf3
add esp, 0x28
ret 8
Function at 0x100bf980
Capabilities:
Enumerate pe sections

Disassembly:
sub esp, 0x14
mov eax, dword [esp + 0x18]
movzx edx, al
push ebx
shr ax, 8
xor ebx, ebx
shl dx, 8
push ebp
mov ebp, ecx
or dx, ax
mov eax, dword [esp + 0x24]
movzx ecx, al
shl cx, 8
shr ax, 8
or cx, ax
mov dword [esp + 0x18], ebp
push esi
push edi
movzx edi, byte [ebp + 3]
lea esi, [ebp + 4]
mov word [esp + 0x28], cx
dec edi
movzx ecx, byte [ebp + 2]
shl ecx, 8
add edi, ecx
mov dword [esp + 0x1c], esi
js 0x100bfaad
movzx ecx, dl
mov ebp, 0x100
imul ecx, ebp
shr dx, 8
add cx, dx
movzx eax, cx
mov dword [esp + 0x10], eax
movzx eax, cx
mov dword [esp + 0x2c], eax
lea edx, [edi + ebx]
movzx eax, bp
shr edx, 1
movzx ecx, byte [esi + edx*8]
lea esi, [esi + edx*8]
imul ecx, eax
movzx eax, byte [esi + 1]
add cx, ax
movzx ebp, cx
movzx ecx, cx
cmp word [esp + 0x2c], cx
jae 0x100bfa20
mov eax, 0xffffffff
jmp 0x100bfa8e
xor eax, eax
cmp word [esp + 0x2c], cx
setne al
cmp word [esp + 0x10], bp
jne 0x100bfa8e
movzx ecx, byte [esi + 2]
mov eax, 0x100
imul ecx, eax
movzx eax, byte [esi + 3]
add cx, ax
movzx eax, cx
mov dword [esp + 0x18], eax
mov ax, word [esp + 0x28]
movzx ebp, cx
movzx ecx, al
mov eax, 0x100
imul ecx, eax
movzx eax, word [esp + 0x28]
shr ax, 8
add cx, ax
movzx eax, cx
mov dword [esp + 0x14], eax
cmp cx, bp
jae 0x100bfa7b
or eax, 0xffffffff
jmp 0x100bfa8e
xor eax, eax
cmp cx, bp
mov ecx, dword [esp + 0x14]
setne al
cmp cx, word [esp + 0x18]
je 0x100bfab2
test eax, eax
jns 0x100bfa97
lea edi, [edx - 1]
jmp 0x100bfa9c
jle 0x100bfab2
lea ebx, [edx + 1]
mov esi, dword [esp + 0x1c]
mov ebp, 0x100
cmp ebx, edi
jle 0x100bf9f3
mov esi, 0x10161c90
movzx ecx, byte [esi + 4]
movzx eax, byte [esi + 5]
shl ecx, 8
add ecx, eax
movzx eax, byte [esi + 6]
shl ecx, 8
add ecx, eax
movzx eax, byte [esi + 7]
pop edi
pop esi
shl ecx, 8
pop ebp
pop ebx
add eax, ecx
jne 0x100bfadf
xor eax, eax
add esp, 0x14
ret 8
add eax, dword [esp + 0x10]
add esp, 0x14
ret 8
Function at 0x100c5ad0
Capabilities:
Enumerate pe sections

Disassembly:
movzx edx, byte [ecx + 0x16]
sub esp, 0x10
movzx eax, byte [ecx + 0x17]
shl edx, 8
add edx, eax
movzx eax, byte [ecx + 0x18]
shl edx, 8
push ebx
add edx, eax
movzx eax, byte [ecx + 0x19]
push ebp
shl edx, 8
mov ebp, 0x10161c90
push esi
push edi
add eax, edx
je 0x100c5b00
lea ebp, [eax + ecx]
movzx ecx, byte [ebp + 1]
xor edi, edi
movzx eax, byte [ebp + 2]
shl ecx, 8
add ecx, eax
movzx eax, byte [ebp + 3]
shl ecx, 8
add ecx, eax
movzx eax, byte [ebp + 4]
shl ecx, 8
lea ebx, [eax - 1]
add ebx, ecx
js 0x100c5b74
nop word [eax + eax]
lea edx, [ebx + edi]
shr edx, 1
lea esi, [edx*8]
sub esi, edx
add esi, 5
add esi, ebp
movzx ecx, byte [esi]
movzx eax, byte [esi + 1]
shl ecx, 8
add ecx, eax
cmp dword [esp + 0x24], ecx
jae 0x100c5b5a
lea ebx, [edx - 1]
jmp 0x100c5b70
movzx ecx, byte [esi + 2]
movzx eax, byte [esi + 3]
shl ecx, 8
add ecx, eax
cmp dword [esp + 0x24], ecx
jbe 0x100c5b80
lea edi, [edx + 1]
cmp edi, ebx
jle 0x100c5b30
pop edi
pop esi
pop ebp
xor al, al
pop ebx
add esp, 0x10
ret 0x20
test esi, esi
je 0x100c5b74
movzx eax, byte [esi + 4]
movzx ecx, byte [esi + 5]
shl eax, 8
add ecx, eax
movzx eax, byte [esi + 6]
shl ecx, 8
add eax, ecx
mov ecx, 0x10161c90
je 0x100c5ba4
lea ecx, [eax + ebp]
movzx eax, byte [ecx]
sub eax, 1
je 0x100c5bc2
sub eax, 1
jne 0x100c5bf4
lea eax, [esp + 0x2c]
push eax
lea eax, [esp + 0x14]
push eax
call fcn.100c5c80
jmp 0x100c5bd1
lea eax, [esp + 0x2c]
push eax
lea eax, [esp + 0x14]
push eax
call fcn.100c5c00
mov esi, dword [esp + 0x28]
mov ecx, dword [esp + 0x10]
mov eax, dword [esp + 0x18]
mov edx, dword [esp + 0x1c]
sub eax, ecx
mov dword [esi + 8], eax
mov eax, dword [esp + 0x14]
sub eax, edx
mov dword [esi], ecx
mov dword [esi + 4], edx
mov dword [esi + 0xc], eax
pop edi
pop esi
pop ebp
mov al, 1
pop ebx
add esp, 0x10
ret 0x20
Function at 0x100c7b20
Capabilities:
Enumerate pe sections

Disassembly:
sub esp, 0xc
cmp ecx, 0x10161c90
jne 0x100c7b33
xor eax, eax
add esp, 0xc
ret 4
movzx eax, byte [ecx]
sub eax, 0
je 0x100c7c4a
sub eax, 3
je 0x100c7c41
sub eax, 1
jne 0x100c7b2b
mov edx, dword [ecx + 1]
mov eax, edx
push ebx
push ebp
push esi
lea esi, [ecx + 1]
shr eax, 8
movzx ecx, al
movzx eax, dl
shl eax, 8
add ecx, eax
mov dword [esp + 0x14], esi
mov eax, edx
shl ecx, 8
shr eax, 0x10
movzx eax, al
add ecx, eax
shr edx, 0x18
shl ecx, 8
add ecx, edx
mov edx, 0x10161c90
push edi
mov dword [esp + 0x14], ecx
je 0x100c7b8e
lea edx, [esi + 4]
lea edi, [ecx - 2]
mov dword [esp + 0x10], edx
xor ebx, ebx
test edi, edi
js 0x100c7c14
mov ebp, dword [esp + 0x20]
nop
lea esi, [edi + ebx]
shr esi, 1
lea eax, [esi + esi*2]
movzx ecx, byte [edx + eax*2]
lea edx, [edx + eax*2]
movzx eax, byte [edx + 1]
shl ecx, 8
add ecx, eax
movzx eax, byte [edx + 2]
shl ecx, 8
add ecx, eax
movzx eax, byte [edx + 3]
shl ecx, 8
add ecx, eax
cmp ebp, ecx
jae 0x100c7bd3
lea edi, [esi - 1]
jmp 0x100c7bf9
movzx ecx, byte [edx + 6]
movzx eax, byte [edx + 7]
shl ecx, 8
add ecx, eax
movzx eax, byte [edx + 8]
shl ecx, 8
add ecx, eax
movzx eax, byte [edx + 9]
shl ecx, 8
add ecx, eax
cmp ebp, ecx
jb 0x100c7c03
lea ebx, [esi + 1]
cmp ebx, edi
jg 0x100c7c0c
mov edx, dword [esp + 0x10]
jmp 0x100c7ba0
test edx, edx
je 0x100c7c0c
add edx, 4
jmp 0x100c7c2b
mov esi, dword [esp + 0x18]
mov ecx, dword [esp + 0x14]
lea eax, [ecx - 1]
cmp eax, ecx
jb 0x100c7c22
mov edx, 0x10161c94
jmp 0x100c7c2b
lea edx, [eax + 2]
lea edx, [eax + edx*2]
lea edx, [esi + edx*2]
movzx eax, byte [edx]
movzx ecx, byte [edx + 1]
pop edi
pop esi
shl eax, 8
pop ebp
add eax, ecx
pop ebx
add esp, 0xc
ret 4
add esp, 0xc
inc ecx
jmp fcn.100c7a50
mov eax, dword [esp + 0x10]
movzx eax, byte [eax + ecx + 1]
add esp, 0xc
ret 4
Function at 0x100cd610
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
sub esp, 8
push ebx
push ebp
mov ebp, ecx
push esi
push edi
mov esi, 0
mov edi, dword [ebp + 4]
mov edx, esi
mov ebx, dword [ebp]
mov dword [esp + 0x10], esi
sub edi, ebx
je 0x100cd651
nop
movzx eax, byte [ebx + edx]
inc edx
xor eax, 0x811c9dc5
imul ecx, eax, 0x1000193
mov eax, esi
shl esi, 5
sub esi, eax
add esi, ecx
cmp edx, edi
jb 0x100cd630
mov dword [esp + 0x10], esi
mov eax, dword [ebp + 0x10]
xor edi, edi
mov dword [esp + 0x14], eax
mov eax, dword [ebp + 0xc]
lea ebx, [eax + eax*2]
xor eax, eax
shl ebx, 2
test ebx, ebx
je 0x100cd692
mov esi, dword [esp + 0x14]
nop dword [eax]
movzx ecx, byte [esi + edi]
inc edi
xor ecx, 0x811c9dc5
imul edx, ecx, 0x1000193
mov ecx, eax
shl eax, 5
sub eax, ecx
add eax, edx
cmp edi, ebx
jb 0x100cd670
mov esi, dword [esp + 0x10]
pop edi
xor eax, esi
pop esi
pop ebp
pop ebx
add esp, 8
ret

Function at 0x100cf330
Capabilities:
Query environment variable

Disassembly:
push ecx
mov eax, dword [0x10168b68]
test eax, eax
jne 0x100cf3d0
push esi
mov dword [esp + 4], eax
push str.HB_OPTIONS
mov byte [esp + 8], 2
call dword [sym.imp.api_ms_win_crt_environment_l1_1_0.dll_getenv]
mov esi, eax
add esp, 4
test esi, esi
je 0x100cf3c1
cmp byte [esi], 0
je 0x100cf3c1
push ebp
mov ebp, dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncmp]
push ebx
push edi
nop word [eax + eax]
push 0x3a
push esi
call sub.VCRUNTIME140.dll_strchr
mov edi, eax
add esp, 8
test edi, edi
jne 0x100cf392
mov eax, esi
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x100cf386
sub eax, edx
lea edi, [eax + esi]
mov ebx, edi
sub ebx, esi
push ebx
push str.uniscribe_bug_compatible
push esi
call ebp
add esp, 0xc
test eax, eax
jne 0x100cf3b0
cmp ebx, 0x18
jne 0x100cf3b0
or byte [esp + 0x10], 4
cmp byte [edi], 0
je 0x100cf3be
cmp byte [edi + 1], 0
lea esi, [edi + 1]
jne 0x100cf370
pop edi
pop ebx
pop ebp
mov eax, dword [esp + 4]
mov dword [0x10168b68], eax
mov eax, dword [0x10168b68]
pop esi
pop ecx
ret