joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100740e8
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0xd4
lea esi, [ebp - 0x1c]
mov dword [esi], esp
or dword [esi + 0xc], 0xffffffff
push 4
pop edi
mov dword [esi + 8], 0x10084d70
lea eax, [esi + edi]
mov ecx, dword fs:[0]
mov dword [esi + 4], ecx
mov dword fs:[0], eax
lea eax, [ebp - 0x90]
push eax
call fcn.100b408c
pop eax
lea ecx, [ebp - 0xe0]
and dword [ebp - 0x7c], 0
and dword [ebp - 0x74], 0
and dword [ebp - 0x6c], 0
and dword [ebp - 0x68], 0
mov dword [ebp - 0x64], edi
and dword [ebp - 0x60], 0
and dword [ebp - 0x5c], 0
mov dword [ebp - 0x58], edi
and dword [ebp - 0x54], 0
and dword [ebp - 0x50], 0
mov dword [ebp - 0x4c], edi
and dword [ebp - 0x48], 0
mov word [ebp - 0x44], 0xa
mov byte [ebp - 0x42], 0
mov dword [ebp - 0x3c], 0x2710
and dword [ebp - 0x38], 0
mov dword [ebp - 0x34], edi
and dword [ebp - 0x30], 0
and word [ebp - 0x2c], 0
and dword [ebp - 0x28], 0
mov dword [ebp - 0x24], edi
and dword [ebp - 0x20], 0
and dword [ebp - 0x80], 0
and dword [ebp - 0x40], 0
and dword [ecx + 0x20], 0
mov dword [ecx + 0x24], edi
and dword [ecx + 0x28], 0
and dword [ecx + 0x2c], 0
mov dword [ecx + 0x30], edi
and dword [ecx + 0x34], 0
and dword [ecx], 0
and dword [ecx + 4], 0
mov dword [ecx + 8], edi
and dword [ecx + 0xc], 0
and dword [ecx + 0x10], 0
and dword [ecx + 0x14], 0
xor eax, eax
inc eax
mov dword [ecx + 0x18], eax
and dword [ecx + 0x1c], 0
and dword [ecx + 0x38], 0
mov dword [ecx + 0x3c], edi
and dword [ecx + 0x40], 0
and dword [ecx + 0x44], 0
mov dword [ecx + 0x48], edi
and dword [ecx + 0x4c], 0
mov dword [esi + 0xc], eax
call fcn.1007ce08
mov esi, dword [ebp + 8]
lea eax, [esi + 0xa0]
push 0x50
lea ecx, [ebp - 0xe0]
push ecx
push eax
call fcn.100f9c00
add esp, 0xc
movsd xmm0, qword [ebp - 0x90]
movsd xmm1, qword [ebp - 0x88]
lea eax, [ebp - 0x80]
movsd qword [esi + 0x48], xmm1
movsd qword [esi + 0x40], xmm0
mov dword [esi + 0x50], 2
mov byte [esi + 0x58], 0
mov dword [esi + 0x5a], 0x2020203
push 0x40
push eax
push esi
call fcn.100f9c00
add esp, 0xc
lea eax, [esi + 0x78]
lea ecx, [ebp - 0x40]
push 0x24
push ecx
push eax
call fcn.100f9c00
add esp, 0xc
mov eax, dword [ebp - 0x18]
and dword [esi + 0x9c], 0
and dword [esi + 0x60], 0
mov dword [esi + 0x64], 0x3e8
and dword [esi + 0x68], 0
mov dword [esi + 0x6c], 4
and dword [esi + 0x70], 0
and word [esi + 0x74], 0
mov dword fs:[0], eax
mov eax, esi
add esp, 0xd4
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x10078fd9
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0xd0
mov esi, esp
mov dword [esi + 0xb8], ebp
lea eax, [esi + 0xc0]
mov dword [esi], ecx
mov dword [esi + 8], edx
mov dword [eax - 4], esp
or dword [eax + 8], 0xffffffff
mov dword [eax + 4], 0x10084e60
mov ecx, dword fs:[0]
mov dword [eax], ecx
mov ecx, dword [ebp + 8]
mov dword fs:[0], eax
mov edi, dword [edx]
inc ecx
mov dword [esi + 0xc], ecx
mov ecx, dword [edx + 8]
mov dword [esi + 4], ecx
mov edx, dword [ecx + 0x1c]
cmp dword [esi + 0xc], edx
jae 0x100790d1
dec edx
mov dword [ecx + 0x1c], edx
shl edx, 4
mov eax, dword [ecx + 0x18]
mov ch, byte [eax + edx + 0xf]
mov cl, byte [eax + edx + 0xc]
mov byte [esi + 0x7a], ch
cmp cl, 2
movzx ebx, word [eax + edx + 0xd]
mov word [esi + 0x78], bx
je 0x1007913d
add eax, edx
mov bl, byte [esi + 0x7a]
movzx edx, word [esi + 0x78]
movsd xmm0, qword [eax]
mov eax, dword [eax + 8]
and dword [esi + 0xc8], 0
mov dword [esi + 0x38], eax
movsd qword [esi + 0x30], xmm0
mov byte [esi + 0x3c], cl
lea ecx, [esi + 0x3d]
mov word [ecx], dx
mov byte [ecx + 2], bl
lea ecx, [esi + 0x30]
mov edx, edi
call fcn.100794e2
mov eax, dword [esi + 0x38]
movsd xmm0, qword [esi + 0x30]
or dword [esi + 0xc8], 0xffffffff
mov edx, dword [esi + 8]
lea ecx, [esi + 0x30]
mov dword [esi + 0x28], eax
mov dword [esi + 0x18], eax
lea eax, [esi + 0x10]
movsd qword [esi + 0x20], xmm0
movsd qword [esi + 0x10], xmm0
push eax
call fcn.10079183
pop eax
mov ebx, dword [esi + 0x30]
mov edi, dword [esi + 0x34]
cmp ebx, 8
jne 0x100790f7
mov ecx, dword [esi + 4]
jmp 0x10079027
test edx, edx
je 0x10079153
add ecx, 0x14
dec edx
push 0x1011dee4
call fcn.1005a1aa
pop ecx
mov ecx, eax
mov edx, edi
call fcn.100794e2
mov eax, dword [esi]
mov dword [eax], 8
jmp 0x10079128
lea eax, [esi + 0x38]
push 0x40
pop ecx
lea edx, [esi + 0x78]
push ecx
push eax
push edx
call fcn.100f9c00
add esp, 0xc
mov eax, dword [esi]
add eax, 8
push 0x40
pop ecx
push ecx
lea ecx, [esi + 0x78]
push ecx
push eax
call fcn.100f9c00
mov eax, dword [esi]
add esp, 0xc
mov dword [eax], ebx
mov dword [eax + 4], edi
mov ecx, dword [esi + 0xc0]
mov dword fs:[0], ecx
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
push 0x1011de48
push 0x2b
push 0x1011b7a8
call fcn.1010c750
add esp, 0xc
ud2
push 0x1011ded4
push 0xf
push str.non_empty_nodes
call fcn.1010c670
jmp 0x1007914e
Function at 0x10098271
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
push ebx
push edi
push esi
push eax
mov ebx, dword [esp + 0x1c]
mov esi, dword [esp + 0x20]
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x24]
mov ebp, ebx
lea edi, [eax + esi*2]
sub ebp, esi
cmp ebp, esi
jae 0x100982f7
lea eax, [ebp + ebp]
push eax
push edi
push ecx
call fcn.100f9c00
mov edx, dword [esp + 0x30]
add esp, 0xc
mov eax, dword [esp + 0x18]
lea esi, [edx + ebp*2]
lea ecx, [eax + ebx*2 - 2]
cmp edi, eax
jbe 0x1009834a
cmp esi, edx
jbe 0x1009834a
lea ebp, [edi - 2]
lea ebx, [esi - 2]
mov dword [esp], ecx
mov ecx, ebx
mov edx, ebp
call fcn.100960a4
test al, al
mov ecx, dword [esp]
mov edx, dword [esp + 0x24]
cmovne ebx, esi
cmovne esi, edi
cmove ebp, edi
movzx eax, word [esi - 2]
mov esi, ebx
mov edi, ebp
mov word [ecx], ax
mov eax, dword [esp + 0x18]
add ecx, 0xfffffffe
jmp 0x100982af
mov ebp, eax
lea eax, [eax + ebx*2]
mov dword [esp], eax
lea eax, [esi + esi]
push eax
push ebp
push ecx
call fcn.100f9c00
mov edx, dword [esp + 0x30]
add esp, 0xc
lea esi, [edx + esi*2]
cmp edx, esi
jae 0x1009834c
cmp edi, dword [esp]
jae 0x1009834c
mov ecx, edi
mov ebx, edx
call fcn.100960a4
mov ecx, eax
movzx edx, al
xor cl, 1
test al, al
movzx ecx, cl
lea ecx, [ebx + ecx*2]
cmovne ebx, edi
lea edi, [edi + edx*2]
movzx eax, word [ebx]
mov edx, ecx
mov word [ebp], ax
add ebp, 2
jmp 0x10098314
mov ebp, edi
sub esi, edx
push esi
push edx
push ebp
call fcn.100f9c00
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x100b880d
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebx
push edi
push esi
mov esi, dword [esp + 0x10]
mov ecx, esi
call fcn.10038eee
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
cmp eax, 1
je 0x100b8807
mov ebx, dword [esp + 0x14]
mov edi, eax
test eax, eax
jne 0x100b87fc
push 0xc
pop ecx
push 4
pop edx
call fcn.1000dee4
and dword [eax], 0
mov ecx, esi
mov edi, eax
mov dword [eax + 8], esi
call fcn.10038eee
push edi
push eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
push ebx
push edi
call fcn.100b891c
pop ecx
pop edx
jmp 0x100b8809
xor eax, eax
pop esi
pop edi
pop ebx
ret
mov ecx, dword [esp + 4]
call fcn.10038eee
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
cmp eax, 1
jbe 0x100b882b
cmp dword [eax], 0
je 0x100b882b
add eax, 4
ret
jmp 0x100b87b6
Function at 0x100b894b
Capabilities:
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x28
lea esi, [ebp - 0x18]
mov eax, dword [ebp + 8]
mov dword [esi - 4], esp
or dword [esi + 8], 0xffffffff
mov dword [esi + 4], 0x100c4a60
mov edx, dword fs:[0]
mov dword [esi], edx
mov dword fs:[0], esi
mov eax, dword [eax]
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x24], eax
mov ecx, dword [eax + 8]
mov byte [ebp - 0x1d], 1
mov dword [esi + 8], 1
mov dword [ebp - 0x28], ecx
call fcn.10038eee
mov byte [ebp - 0x1d], 1
push 1
push eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
mov eax, dword [ebp - 0x24]
lea ecx, [ebp - 0x34]
mov dword [ecx], eax
call fcn.1000afc4
mov ecx, dword [ebp - 0x28]
mov byte [ebp - 0x1d], 0
call fcn.10038eee
mov byte [ebp - 0x1d], 0
push 0
push eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
xor eax, eax
mov ecx, dword [ebp - 0x18]
mov dword fs:[0], ecx
add esp, 0x28
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x100c53f5
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
mov ecx, dword [esp + 4]
call fcn.10038eee
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
cmp eax, 1
jbe 0x100c5415
mov ecx, dword [eax]
or ecx, dword [eax + 4]
je 0x100c5415
add eax, 8
ret
jmp fcn.100c531f

Function at 0x100c563e
Capabilities:
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x28
lea ecx, [ebp - 0x18]
mov eax, dword [ebp + 8]
mov dword [ecx - 4], esp
or dword [ecx + 8], 0xffffffff
mov dword [ecx + 4], 0x100c60d0
mov edx, dword fs:[0]
mov dword [ecx], edx
mov dword fs:[0], ecx
mov eax, dword [eax]
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x28], eax
mov ecx, dword [eax + 0x30]
mov eax, dword [ecx]
mov dword [ebp - 0x24], ecx
test eax, eax
je 0x100c5682
dec eax
jmp 0x100c5694
mov byte [ebp - 0x1d], 1
mov dword [ebp - 0x10], 1
push ecx
call fcn.1010bf10
pop ecx
xor ecx, ecx
mov byte [ebp - 0x1d], 1
inc ecx
mov dword [ebp - 0x10], ecx
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
mov eax, dword [ebp - 0x28]
lea ecx, [ebp - 0x34]
mov byte [ebp - 0x1d], 0
mov dword [ecx], eax
call fcn.100c5891
mov ecx, dword [ebp - 0x24]
mov eax, dword [ecx]
test eax, eax
je 0x100c56c3
dec eax
jmp 0x100c56ce
mov byte [ebp - 0x1d], 0
push ecx
call fcn.1010bf10
pop ecx
mov byte [ebp - 0x1d], 0
push 0
push eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
xor eax, eax
mov ecx, dword [ebp - 0x18]
mov dword fs:[0], ecx
add esp, 0x28
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x100ca9a9
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
mov ecx, dword [esp + 4]
call fcn.10038eee
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
cmp eax, 1
jbe 0x100ca9c5
cmp dword [eax + 4], 0
je 0x100ca9c5
ret
jmp fcn.100ca8de

Function at 0x100cab65
Capabilities:
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x28
lea esi, [ebp - 0x18]
mov eax, dword [ebp + 8]
mov dword [esi - 4], esp
or dword [esi + 8], 0xffffffff
mov dword [esi + 4], 0x100cb7a0
mov edx, dword fs:[0]
mov dword [esi], edx
mov dword fs:[0], esi
mov eax, dword [eax]
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x28], eax
mov ecx, dword [eax + 0x1c]
mov byte [ebp - 0x1d], 1
mov dword [esi + 8], 1
mov dword [ebp - 0x24], ecx
call fcn.10038eee
mov byte [ebp - 0x1d], 1
push 1
push eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
mov eax, dword [ebp - 0x28]
lea ecx, [ebp - 0x34]
mov byte [ebp - 0x1d], 0
mov dword [ecx], eax
call fcn.100cad7a
mov ecx, dword [ebp - 0x24]
mov byte [ebp - 0x1d], 0
call fcn.10038eee
mov byte [ebp - 0x1d], 0
push 0
push eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
xor eax, eax
mov ecx, dword [ebp - 0x18]
mov dword fs:[0], ecx
add esp, 0x28
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x100cb5a6
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x30
lea eax, [ebp - 0x18]
mov dword [eax - 4], esp
or dword [eax + 8], 0xffffffff
mov dword [eax + 4], 0x100cb7f0
mov edx, dword fs:[0]
mov dword [eax], edx
mov dword fs:[0], eax
mov edx, dword [0x1019cc1c]
test edx, edx
jne 0x100cb6e7
mov dword [ebp - 0x34], ecx
push str.api_ms_win_core_synch_l1_2_0.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
test eax, eax
je 0x100cb61a
mov esi, eax
push 0x10170ada
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x100cb61a
mov ebx, eax
push 0x10170ae8
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x100cb61a
mov esi, eax
xor eax, eax
inc eax
jmp 0x100cb689
push str.ntdll.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
test eax, eax
je 0x100cb700
mov edi, eax
push 0x10170a7e
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x100cb700
mov ebx, eax
push 0x10170a91
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x100cb700
mov esi, eax
push 0x10170aa5
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x100cb700
mov edi, eax
lea eax, [ebp - 0x3c]
push 0
push 0
push 0xc0000000
push eax
call ebx
test eax, eax
jne 0x100cb700
mov ebx, dword [ebp - 0x3c]
xor eax, eax
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x28], ebx
mov dword [ebp - 0x24], esi
mov dword [ebp - 0x20], edi
mov dword [ebp - 0x10], 1
push 0x10
pop ecx
call fcn.100c996a
movsd xmm0, qword [ebp - 0x2c]
movsd xmm1, qword [ebp - 0x24]
mov edx, eax
movsd qword [eax + 8], xmm1
movsd qword [eax], xmm0
xor eax, eax
lock cmpxchg dword [0x1019cc1c], edx
je 0x100cb6e4
mov ecx, edx
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x10], 2
mov dword [ebp - 0x30], edx
call fcn.100cada5
mov ecx, dword [ebp - 0x30]
call fcn.100caeb8
mov edx, dword [ebp - 0x38]
mov ecx, dword [ebp - 0x34]
mov eax, dword [ebp - 0x18]
and dword [ecx], 0
mov dword [ecx + 4], edx
mov dword fs:[0], eax
mov eax, ecx
add esp, 0x30
pop esi
pop edi
pop ebx
pop ebp
ret
and dword [ebp - 0x28], 0
and dword [ebp - 0x10], 0
push 0x10170bd8
push 0x5b
push str.parking_lot_requires_either_NT_Keyed_Events__WinXP__or_WaitOnAddress_WakeByAddress__Win8_C:UsersLitch1.cargo_registry_srcmirrors.ustc.edu.cn_61ef6e0cd06fb9b8parking_lot_core_0.9.8_src_thread_parkerwindowsmod.rs
call fcn.1010b153
add esp, 0xc
ud2

Function at 0x100cbac6
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
mov ecx, dword [esp + 4]
call fcn.10038eee
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
cmp eax, 1
jbe 0x100cbae4
cmp dword [eax], 0
je 0x100cbae4
add eax, 4
ret
jmp fcn.100cb9fe
Function at 0x100cbc45
Capabilities:
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x28
lea ecx, [ebp - 0x18]
mov eax, dword [ebp + 8]
mov dword [ecx - 4], esp
or dword [ecx + 8], 0xffffffff
mov dword [ecx + 4], 0x100cc2c0
mov edx, dword fs:[0]
mov dword [ecx], edx
mov dword fs:[0], ecx
mov eax, dword [eax]
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x28], eax
mov ecx, dword [eax + 0x10]
mov eax, dword [ecx]
mov dword [ebp - 0x24], ecx
test eax, eax
je 0x100cbc89
dec eax
jmp 0x100cbc9b
mov byte [ebp - 0x1d], 1
mov dword [ebp - 0x10], 1
push ecx
call fcn.1010bf10
pop ecx
xor ecx, ecx
mov byte [ebp - 0x1d], 1
inc ecx
mov dword [ebp - 0x10], ecx
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
mov eax, dword [ebp - 0x28]
lea ecx, [ebp - 0x34]
mov byte [ebp - 0x1d], 0
mov dword [ecx], eax
call fcn.100cbeaa
mov ecx, dword [ebp - 0x24]
mov eax, dword [ecx]
test eax, eax
je 0x100cbcca
dec eax
jmp 0x100cbcd5
mov byte [ebp - 0x1d], 0
push ecx
call fcn.1010bf10
pop ecx
mov byte [ebp - 0x1d], 0
push 0
push eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
xor eax, eax
mov ecx, dword [ebp - 0x18]
mov dword fs:[0], ecx
add esp, 0x28
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x100cd67e
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x50
mov esi, esp
mov dword [esi + 0x38], ebp
lea edi, [esi + 0x40]
mov edx, dword [ebp + 0xc]
mov dword [edi - 4], esp
or dword [edi + 8], 0xffffffff
mov dword [edi + 4], 0x100d26d0
mov ecx, dword fs:[0]
mov dword [edi], ecx
mov dword fs:[0], edi
mov eax, dword [edx + 4]
mov ebx, dword [edx + 8]
movzx edx, word [eax + 0x192]
mov ecx, ebx
mov dword [esi], eax
mov dword [esi + 4], ebx
not ecx
add ecx, edx
mov dword [esi + 8], edx
mov edx, dword [ebp + 0x10]
mov dword [esi + 0xc], ecx
mov word [edx + 0x192], cx
imul edx, ebx, 0xc
movsd xmm0, qword [eax + edx + 0x10c]
mov edx, dword [eax + edx + 0x114]
mov dword [esi + 0x18], edx
movsd qword [esi + 0x10], xmm0
imul edx, ebx, 0x18
movsd xmm0, qword [eax + edx]
movsd xmm1, qword [eax + edx + 8]
movsd xmm2, qword [eax + edx + 0x10]
mov eax, dword [ebp + 0x10]
and dword [edi + 8], 0
mov edx, 0x10c
add edx, eax
movsd qword [esi + 0x30], xmm2
movsd qword [esi + 0x28], xmm1
movsd qword [esi + 0x20], xmm0
call fcn.100cc337
mov ebx, dword [esi]
mov edi, dword [esi + 4]
mov ecx, 0x10c
add ebx, ecx
mov ecx, dword [esi + 8]
inc edi
sub ecx, edi
imul edi, edi, 0xc
add edi, ebx
push edx
push eax
push ecx
push edi
call fcn.100cd649
add esp, 0x10
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 0x10]
mov ecx, dword [eax + 4]
mov eax, dword [eax + 8]
mov dword [esi + 4], ecx
mov ecx, dword [esi + 0xc]
mov dword [esi], eax
call fcn.100cc353
mov ecx, dword [esi]
mov edi, dword [esi + 8]
mov ebx, dword [esi + 4]
inc ecx
sub edi, ecx
imul ecx, ecx, 0x18
add ebx, ecx
push edx
push eax
push edi
push ebx
call fcn.100cd5df
add esp, 0x10
mov edx, dword [ebp + 0xc]
mov eax, dword [ebp + 8]
movzx ecx, word [edx + 8]
mov edx, dword [edx + 4]
mov word [edx + 0x192], cx
mov ecx, dword [esi + 0x18]
movsd xmm0, qword [esi + 0x10]
movsd xmm1, qword [esi + 0x30]
movsd xmm2, qword [esi + 0x20]
mov dword [eax + 8], ecx
movsd qword [eax], xmm0
movsd qword [eax + 0x20], xmm1
movsd xmm1, qword [esi + 0x28]
mov ecx, dword [esi + 0x40]
movsd qword [eax + 0x10], xmm2
movsd qword [eax + 0x18], xmm1
mov dword fs:[0], ecx
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x100d6b10
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x43c
mov dword [ebp - 0x1c], esp
mov dword [ebp - 0x10], 0xffffffff
mov dword [ebp - 0x14], 0x100e5500
mov edi, 0x200
lea eax, [ebp - 0x18]
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x24], 2
mov dword [ebp - 0x2c], 0
mov ecx, dword fs:[0]
mov dword [ebp - 0x18], ecx
mov dword fs:[0], eax
mov dword [ebp - 0x38], 0
mov dword [ebp - 0x34], 2
mov dword [ebp - 0x30], 0
cmp edi, 0x201
jae 0x100d6ba0
jmp 0x100d6b8e
jbe 0x100d6c33
cmp edi, 0x201
jae 0x100d6ba0
lea ebx, [ebp - 0x448]
mov dword [ebp - 0x28], 0x200
mov esi, edi
jmp 0x100d6bdb
mov esi, dword [ebp - 0x20]
mov eax, dword [ebp - 0x2c]
sub edi, esi
sub eax, esi
cmp eax, edi
jae 0x100d6bcc
mov dword [ebp - 0x10], 0
lea ecx, [ebp - 0x38]
mov edx, esi
push edi
call fcn.1010bb60
add esp, 4
mov esi, dword [ebp - 0x38]
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x24], eax
mov ebx, dword [ebp - 0x24]
mov dword [ebp - 0x30], esi
mov dword [ebp - 0x2c], esi
mov dword [ebp - 0x28], esi
mov dword [ebp - 0x20], esi
push 0
call dword [sym.imp.KERNEL32.dll_SetLastError]
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
mov edi, eax
test eax, eax
jne 0x100d6bff
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x100d6c96
cmp edi, esi
jne 0x100d6b80
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
jne 0x100d6cb5
add esi, esi
mov eax, 0xffffffff
cmovb esi, eax
mov edi, esi
cmp edi, 0x201
jb 0x100d6b8e
jmp 0x100d6ba0
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x10], 0
cmp edi, eax
ja 0x100d6cd2
lea eax, [ebp - 0x48]
push edi
push ebx
push eax
call fcn.100d9fd0
add esp, 0xc
movsd xmm0, qword [ebp - 0x48]
mov esi, dword [ebp + 8]
movsd xmm1, qword [ebp - 0x40]
movsd qword [esi + 8], xmm1
movsd qword [esi], xmm0
mov eax, dword [ebp - 0x20]
test eax, eax
je 0x100d6c80
add eax, eax
push 2
push eax
push dword [ebp - 0x24]
call fcn.10037bf0
add esp, 0xc
mov eax, dword [ebp - 0x18]
mov dword fs:[0], eax
mov eax, esi
add esp, 0x43c
pop esi
pop edi
pop ebx
pop ebp
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, dword [ebp + 8]
mov dword [esi + 4], eax
mov dword [esi], 0
mov byte [esi + 0xc], 2
mov eax, dword [ebp - 0x20]
test eax, eax
jne 0x100d6c70
jmp 0x100d6c80
mov dword [ebp - 0x10], 0
push 0x101776a0
push 0x28
push 0x10175b83
call fcn.1010c750
add esp, 0xc
jmp 0x100d6ce1
push 0x101776b0
push eax
push edi
call fcn.1010cb50
add esp, 0xc
ud2
Function at 0x100d7310
Capabilities:
Create directory

Disassembly:
push ebx
push edi
push esi
sub esp, 0x10
mov ecx, dword [esp + 0x24]
mov esi, dword [esp + 0x20]
mov eax, dword [esp + 0x2c]
mov edx, dword [esp + 0x28]
cmp byte [ecx], 0
je 0x100d7338
mov ecx, esi
push eax
call fcn.100d73b0
add esp, 4
jmp 0x100d737f
mov ecx, esp
push eax
call fcn.100e2680
add esp, 4
cmp dword [esp], 0
je 0x100d7355
movsd xmm0, qword [esp + 4]
movsd qword [esi], xmm0
jmp 0x100d737f
mov ebx, dword [esp + 4]
mov edi, dword [esp + 8]
push 0
push edi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
je 0x100d7388
mov byte [esi], 4
test ebx, ebx
je 0x100d737f
add ebx, ebx
push 2
push ebx
push edi
call fcn.10037bf0
add esp, 0xc
mov eax, esi
add esp, 0x10
pop esi
pop edi
pop ebx
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov byte [esi], 0
mov byte [esi + 3], 0
mov word [esi + 1], 0
mov dword [esi + 4], eax
test ebx, ebx
jne 0x100d7371
jmp 0x100d737f
Function at 0x100da7a0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x10
movzx eax, byte [edx + 0x1c]
mov edi, edx
call 0x100da7b2
pop ebp
mov dword [esp + 0xc], 0
mov dword [esp + 8], ecx
cmp al, 1
mov byte [esp + 4], al
mov eax, 0
setne dl
sbb eax, eax
or al, dl
movzx edx, al
cmp al, 0xff
je 0x100da7dc
test edx, edx
jne 0x100da7fc
movzx ebx, byte [edi + 0x1e]
cmp al, 0xff
mov esi, ebx
je 0x100da7ea
test edx, edx
jne 0x100da80b
mov ecx, edi
mov ebx, ebp
call fcn.100da6b0
movzx eax, al
mov dword [esp + 0xc], eax
jmp 0x100da80d
mov ebx, ebp
xor edx, edx
xor ebp, ebp
cmp byte [esp + 4], 0
jne 0x100da874
jmp 0x100da818
mov ebx, ebp
mov edx, esi
xor ebp, ebp
cmp byte [esp + 4], 0
jne 0x100da874
xor ebp, ebp
cmp byte [edi + 8], 6
lea eax, [edi + 8]
cmove eax, ebp
je 0x100da874
movzx ecx, byte [eax]
mov ebp, 6
add ebx, dword [ecx*4 + 0x100da988]
jmp ebx
mov eax, dword [esp + 0xc]
movzx esi, dl
lea ebx, [eax + esi]
mov eax, dword [edi + 4]
add ebx, ebp
cmp eax, ebx
jb 0x100da96d
mov edx, dword [edi]
cmp eax, ebx
lea ecx, [edx + ebx]
mov dword [esp + 4], ecx
movzx ecx, byte [edi + 8]
mov byte [esp + 3], cl
jne 0x100da8df
mov esi, dword [esp + 8]
mov edi, dword [esp + 4]
xor ecx, ecx
sub eax, ebx
je 0x100da945
mov dl, 9
cmp eax, 2
je 0x100da949
cmp eax, 1
jne 0x100da958
cmp byte [edi], 0x2e
jne 0x100da958
xor edx, edx
cmp byte [esp + 3], 3
setae dl
lea edx, [edx + edx*2 + 7]
jmp 0x100da958
cmp cl, 3
jae 0x100da8fb
add ebp, dword [esp + 0xc]
add ebp, esi
lea esi, [eax + edx - 1]
sub ebp, eax
cmp byte [esi], 0x5c
je 0x100da926
dec esi
inc ebp
jne 0x100da8f0
jmp 0x100da8a0
add ebp, dword [esp + 0xc]
add ebp, esi
lea esi, [eax + edx - 1]
sub ebp, eax
nop word [eax + eax]
movzx edi, byte [esi]
cmp edi, 0x2f
je 0x100da926
cmp edi, 0x5c
je 0x100da926
dec esi
inc ebp
jne 0x100da910
jmp 0x100da8a0
not ebp
lea ebx, [ebx + ebp + 1]
cmp eax, ebx
jb 0x100da974
mov esi, dword [esp + 8]
add edx, ebx
mov ecx, 1
mov edi, edx
sub eax, ebx
jne 0x100da8b2
mov dl, 0xa
jmp 0x100da958
cmp byte [edi], 0x2e
jne 0x100da958
cmp byte [edi + 1], 0x2e
sete dl
xor dl, 9
add ecx, eax
mov dword [esi], ecx
mov dword [esi + 4], edi
mov dword [esi + 8], eax
mov byte [esi + 0xc], dl
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret
push 0x101764fc
jmp 0x100da979
push 0x1017650c
push eax
push ebx
call fcn.1010cb30
add esp, 0xc
ud2