joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10174de7
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x50
mov eax, dword [ebp + 8]
mov dword [0x1018fa38], 0x1994
mov dword [ebp - 0x10], eax
call fcn.101747f5
xor ecx, ecx
mov edx, eax
mov esi, dword [eax + 0x3c]
mov esi, dword [eax + esi + 0x78]
mov dword [0x1018fa38], 0x2010
mov edi, edx
add edi, dword [eax + esi + 0x20]
mov eax, dword [eax + esi + 0x18]
cmp eax, 0
mov dword [ebp - 0x14], edi
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x1c], edx
mov dword [ebp - 0x20], esi
mov dword [ebp - 0x24], ecx
je 0x10174f3e
xor eax, eax
mov ecx, dword [ebp - 0x1c]
mov edx, dword [ebp - 0x20]
add ecx, dword [ecx + edx + 0x24]
mov dword [ebp - 0x28], ecx
mov dword [ebp - 0x2c], eax
jmp 0x10174e92
mov eax, dword [ebp - 0x30]
add eax, 2
mov ecx, dword [ebp - 0x34]
add ecx, 1
mov edx, dword [ebp - 0x18]
cmp ecx, edx
setb bl
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x3c], ecx
mov byte [ebp - 0x3d], bl
xor eax, eax
mov cl, byte [ebp - 0x3d]
test cl, 1
mov edx, dword [ebp - 0x38]
mov esi, dword [ebp - 0x3c]
mov dword [ebp - 0x2c], esi
mov dword [ebp - 0x28], edx
mov dword [ebp - 0x24], eax
jne 0x10174e92
jmp 0x10174f3e
mov eax, dword [ebp - 0x2c]
mov ecx, dword [ebp - 0x28]
xor edx, edx
mov esi, dword [ebp - 0x14]
mov edi, dword [esi + eax*4]
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x30], ecx
mov dword [ebp - 0x44], edi
mov dword [ebp - 0x48], edx
mov eax, dword [ebp - 0x48]
mov ecx, eax
mov edx, dword [ebp - 0x44]
add ecx, edx
mov esi, dword [ebp - 0x1c]
mov bl, byte [esi + ecx]
mov ecx, dword [ebp - 0x10]
mov bh, byte [ecx + eax]
cmp bl, bh
sete cl
cmp bl, 0
mov dword [ebp - 0x4c], eax
mov byte [ebp - 0x4d], bh
mov byte [ebp - 0x4e], cl
je 0x10174f03
mov eax, dword [ebp - 0x4c]
add eax, 1
mov dword [ebp - 0x54], eax
mov al, byte [ebp - 0x4d]
cmp al, 0
setne cl
mov dl, byte [ebp - 0x4e]
and dl, cl
mov esi, dword [ebp - 0x54]
cmp esi, 0x20
setb cl
and dl, cl
test dl, 1
mov dword [ebp - 0x48], esi
jne 0x10174eac
mov al, byte [ebp - 0x4e]
test al, 1
jne 0x10174f0f
jmp 0x10174e52
mov eax, dword [ebp - 0x30]
movzx ecx, word [eax]
mov edx, dword [ebp - 0x1c]
mov esi, dword [ebp - 0x20]
add edx, dword [edx + esi + 0x1c]
mov dword [ebp - 0x58], ecx
mov dword [ebp - 0x5c], edx
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x5c]
mov edx, dword [ebp - 0x58]
add eax, dword [ecx + edx*4]
mov dword [0x1018fa3c], 0x2690
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x24]
add esp, 0x50
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x1017513d
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x18
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
xor esi, esi
mov dword [0x1018fa44], 0
mov byte [0x1018fa48], 0
mov edi, dword [0x1018fa38]
add edi, 0xfffffac9
mov dword [0x1018fa3c], edi
mov dword [0x1018fa40], 0
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x18], edx
mov dword [ebp - 0x1c], esi
mov eax, dword [ebp - 0x1c]
mov ecx, eax
mov dl, cl
mov ecx, dword [ebp - 0x18]
mov byte [ecx + eax], dl
mov dword [0x1018fa38], 0x1cb3
mov eax, dword [0x1018fa40]
add eax, 1
mov dword [0x1018fa40], eax
cmp eax, 0x100
mov dword [ebp - 0x1c], eax
jl 0x1017518a
mov dword [0x1018fa38], 0x1549
mov dword [0x1018fa40], 0
xor eax, eax
mov dword [ebp - 0x20], eax
jmp 0x101751d5
mov eax, dword [ebp - 0x20]
mov ecx, 0x100
mov dword [0x1018fa4c], 0
mov edx, dword [0x1018fa44]
mov esi, dword [ebp - 0x18]
movzx edi, byte [esi + eax]
add edi, edx
mov dword [ebp - 0x24], eax
xor edx, edx
mov ebx, dword [ebp - 0x10]
div ebx
mov esi, dword [ebp - 0x14]
movzx edx, byte [esi + edx]
add edi, edx
mov dword [0x1018fa4c], edi
mov dword [0x1018fa38], 0x15b
mov eax, edi
cdq
idiv ecx
mov dword [0x1018fa44], edx
mov dword [0x1018fa3c], 0xffffff07
mov ecx, dword [ebp - 0x18]
mov edi, dword [ebp - 0x24]
mov cl, byte [ecx + edi]
mov byte [0x1018fa48], cl
mov ecx, dword [ebp - 0x18]
mov cl, byte [ecx + edx]
mov edx, dword [ebp - 0x18]
mov byte [edx + edi], cl
mov ecx, dword [0x1018fa3c]
add ecx, 0xffffdd45
mov dword [0x1018fa38], ecx
mov cl, byte [0x1018fa48]
mov edx, dword [0x1018fa44]
mov esi, dword [ebp - 0x18]
mov byte [esi + edx], cl
mov edx, dword [0x1018fa40]
add edx, 1
mov dword [0x1018fa40], edx
cmp edx, 0x100
mov dword [ebp - 0x20], edx
jl 0x101751d5
mov dword [0x1018fa3c], 0x18f5
add esp, 0x18
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x101752a0
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
sub esp, 0x50
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 8]
lea edx, [0x10176051]
mov esi, 0xe
lea edi, [ebp - 0x28]
mov dword [0x1018fa3c], 0x2337
mov dword [esp], edi
mov dword [esp + 4], edx
mov dword [esp + 8], 0xe
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x30], ecx
mov dword [ebp - 0x34], edi
mov dword [ebp - 0x38], esi
call fcn.1017448c
mov dword [0x1018fa38], 0x79e
call fcn.101742cf
mov dword [esp], eax
mov eax, dword [ebp - 0x34]
mov dword [esp + 4], eax
call fcn.10174fff
xor ecx, ecx
cmp eax, 0
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0x40], ecx
je 0x101753d0
mov eax, dword [ebp - 0x3c]
mov ecx, esp
mov dword [ecx + 0xc], 0x40
mov dword [ecx + 8], 0x1000
mov dword [ecx + 4], 0x6000
mov dword [ecx], 0
call eax
sub esp, 0x10
mov dword [0x1018fa3c], 0x1985
mov dword [esp], eax
mov ecx, dword [ebp - 0x2c]
mov dword [esp + 4], ecx
mov dword [ebp - 0x44], eax
call fcn.1017562b
mov eax, dword [0x1018fa38]
mov dword [ebp - 0x48], eax
xor eax, eax
mov ecx, dword [ebp - 0x48]
add ecx, 0xffffda01
mov edx, dword [ebp - 0x44]
mov word [edx], 0x5a4d
mov dword [0x1018fa38], ecx
mov dword [edx + 0x3c], 0xc0
mov dword [edx + 0xc0], 0x4550
add edx, 0xffc00000
mov dword [0x1018fa3c], 0x2259
mov ecx, dword [ebp - 0x30]
mov dword [ecx + 0x1c], edx
mov edx, dword [ebp - 0x44]
mov dword [ecx + 4], edx
cmp edx, 0
mov dword [ebp - 0x40], eax
je 0x101753d0
mov eax, dword [ebp - 0x44]
add eax, 0x183e
mov dword [0x1018fa38], 0x6f0
mov dword [0x1018fa3c], 0x23bd
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x40]
add esp, 0x50
pop esi
pop edi
pop ebp
ret
Function at 0x101753da
Capabilities:
Parse pe header
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push esi
and esp, 0xfffffff8
sub esp, 0xb0
call fcn.10001088
xor ecx, ecx
cmp eax, 0
mov dword [esp + 0x3c], ecx
jne 0x1017559d
lea eax, [esp + 0x50]
mov dword [0x1018fa38], 0x2038
mov dword [esp + 0x38], eax
mov dword [0x1018fa3c], 0x2318
call fcn.1017572d
xor ecx, ecx
cmp eax, 0
mov dword [esp + 0x34], ecx
jne 0x10175595
lea eax, [esp + 0x40]
mov dword [esp], eax
call fcn.10174b4b
mov ecx, dword [0x1018fa3c]
mov edx, dword [esp + 0x40]
mov dword [esp + 0x64], edx
mov dword [esp + 0x98], 0x12a800
mov edx, dword [0x1018fa24]
mov dword [esp + 0x84], edx
mov edx, dword [0x1018fa28]
mov dword [esp + 0x30], eax
mov dword [esp + 0x2c], ecx
mov dword [esp + 0x28], edx
lea eax, [0x101755a7]
mov ecx, dword [esp + 0x2c]
add ecx, 0xfffff8dd
mov edx, dword [esp + 0x28]
mov dword [esp + 0x58], edx
mov esi, dword [0x1018fa2c]
mov dword [esp + 0x60], esi
mov esi, dword [0x1018fa30]
mov dword [esp + 0x80], esi
mov esi, dword [0x1018fa34]
mov dword [esp + 0x94], esi
mov dword [0x1018fa38], ecx
mov dword [0x1018fa3c], 0x22a3
mov dword [esp + 0x24], ecx
mov dword [esp + 0x20], eax
mov eax, dword [esp + 0x20]
mov ecx, dword [esp + 0x24]
cmp word [eax], 0x5a4d
mov dword [esp + 0x1c], eax
mov dword [esp + 0x18], ecx
jne 0x101754f2
mov eax, dword [esp + 0x1c]
mov ecx, dword [eax + 0x3c]
cmp dword [eax + ecx], 0x4550
mov dword [esp + 0x14], ecx
je 0x1017552a
mov eax, dword [esp + 0x1c]
add eax, 0xfffff000
and eax, 0xfffff000
mov ecx, dword [esp + 0x18]
add ecx, 0xffffdab2
mov dword [0x1018fa38], ecx
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], ecx
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 0x10]
mov dword [esp + 0x24], eax
mov dword [esp + 0x20], ecx
jmp 0x101754c7
mov eax, dword [esp + 0x1c]
mov dword [esp + 0x88], eax
lea eax, [esp + 0x50]
mov dword [0x1018fa3c], 0x1c92
mov dword [0x1018fa38], 0x14d5
mov ecx, dword [esp + 0x1c]
mov edx, dword [esp + 0x14]
mov esi, dword [ecx + edx + 0x50]
mov dword [esp + 0x78], esi
mov esi, dword [esp + 0x48]
mov dword [esp], eax
mov dword [esp + 4], esi
call fcn.101752a0
mov ecx, dword [0x1018fa3c]
add ecx, 0x1f82
mov dword [0x1018fa38], ecx
mov ecx, esp
lea edx, [esp + 0x50]
mov dword [ecx], edx
call eax
sub esp, 4
mov eax, 1
mov dword [esp + 0x34], eax
mov eax, dword [esp + 0x34]
mov dword [esp + 0x3c], eax
mov eax, dword [esp + 0x3c]
lea esp, [ebp - 4]
pop esi
pop ebp
ret
Function at 0x1017572d
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov dword [ebp - 4], 0
mov dword [0x1018fa38], 0xe24
mov eax, dword fs:[0x30]
mov dword [ebp - 4], eax
xor ecx, ecx
mov edx, dword [ebp - 4]
mov edx, dword [edx + 0x10]
mov edx, dword [edx + 0x3c]
mov dword [ebp - 8], eax
mov dword [ebp - 0xc], edx
mov dword [ebp - 0x10], ecx
jmp 0x101757d3
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x14]
cmp word [eax + ecx*2 - 0x18], 0x6f
je 0x1017582c
jmp 0x1017587a
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x14]
cmp word [eax + ecx*2 - 0x12], 0x64
sete dl
mov byte [ebp - 0x15], dl
mov al, byte [ebp - 0x15]
test al, 1
jne 0x10175841
jmp 0x1017587a
mov dword [0x1018fa3c], 0xfeb
mov eax, 1
mov dword [ebp - 0x1c], eax
jmp 0x1017588b
mov dword [0x1018fa38], 0x15e2
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x14]
cmp word [eax + ecx*2 - 0x14], 0x64
je 0x1017577b
jmp 0x1017587a
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0xc]
cmp word [ecx + eax*2], 0
mov edx, eax
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x24], edx
je 0x1017580a
mov dword [0x1018fa3c], 0xd66
mov eax, dword [ebp - 0x20]
add eax, 1
cmp eax, 0x104
mov ecx, eax
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0x24], eax
jl 0x101757d3
mov eax, dword [ebp - 0x24]
mov dword [0x1018fa38], 0xf30
mov ecx, dword [ebp - 0xc]
cmp word [ecx + eax*2 - 0x1a], 0x6c
mov dword [ebp - 0x14], eax
je 0x10175763
jmp 0x1017587a
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x14]
cmp word [eax + ecx*2 - 0x16], 0x61
je 0x101757b5
jmp 0x1017587a
mov dword [0x1018fa38], 0x1882
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x14]
cmp word [eax + ecx*2 - 0x10], 0x6c
sete dl
mov byte [ebp - 0x25], dl
mov al, byte [ebp - 0x25]
test al, 1
jne 0x10175867
jmp 0x1017587a
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x14]
cmp word [eax + ecx*2 - 0xe], 0x6c
je 0x1017579e
mov dword [0x1018fa38], 0x177
xor eax, eax
mov dword [ebp - 0x1c], eax
jmp 0x1017588b
mov eax, dword [ebp - 0x1c]
add esp, 0x28
pop ebp
ret
Function at 0x403076
Capabilities:
Write file on windows

Disassembly:
push ecx
push ebx
push ebp
push esi
mov esi, dword [0x417104]
sub esi, dword [0x40b070]
push edi
add esi, dword [esp + 0x18]
call dword [sym.imp.KERNEL32.dll_GetTickCount]
xor ebx, ebx
add eax, 0x1f4
cmp esi, ebx
mov dword [0x423f6c], eax
jle 0x4031e0
push dword [0x41f114]
call fcn.00403224
push ebx
push ebx
push dword [0x40b070]
push dword [0x409018]
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov dword [0x41f110], esi
mov dword [0x417100], ebx
mov ebp, 0x40b100
mov eax, dword [0x417108]
mov edi, 0x4000
sub eax, dword [0x41f114]
cmp eax, edi
jg 0x4030eb
mov edi, eax
mov esi, 0x413100
push edi
push esi
call fcn.004031f2
test eax, eax
je 0x4031d2
add dword [0x41f114], edi
mov dword [0x40b090], esi
mov dword [0x40b094], edi
cmp dword [0x423f70], ebx
je 0x403142
cmp dword [0x424000], ebx
jne 0x403142
mov eax, dword [0x41f110]
push ebx
sub eax, dword [0x417104]
sub eax, dword [esp + 0x1c]
add eax, dword [0x40b070]
mov dword [0x417100], eax
call fcn.00402c06
pop ecx
mov ecx, 0x40b078
mov dword [0x40b098], ebp
mov dword [0x40b09c], 0x8000
call fcn.004061ae
test eax, eax
jl 0x4031db
mov esi, dword [0x40b098]
sub esi, ebp
je 0x40319c
lea eax, [esp + 0x10]
push ebx
push eax
push esi
push ebp
push dword [0x409018]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x4031d7
cmp esi, dword [esp + 0x10]
jne 0x4031d7
add dword [0x40b070], esi
cmp dword [0x40b094], ebx
jne 0x403111
jmp 0x4031a8
cmp dword [0x40b094], ebx
jne 0x4031db
cmp edi, ebx
je 0x4031db
mov eax, dword [0x417104]
mov ecx, eax
sub ecx, dword [0x40b070]
add ecx, dword [esp + 0x18]
test ecx, ecx
jg 0x4030d5
push ebx
push ebx
push eax
push dword [0x409018]
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
jmp 0x4031e0
or eax, 0xffffffff
jmp 0x4031ea
push 0xfffffffffffffffe
jmp 0x4031dd
push 0xfffffffffffffffd
pop eax
jmp 0x4031ea
push 1
call fcn.00402c06
pop ecx
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret 4

Function at 0x403714
Capabilities:
Contain obfuscated stackstrings

Disassembly:
wait
xor eax, 0x349c45c6
mov byte [ebp - 0x63], 0x20
mov byte [ebp - 0x62], 0x2d
mov byte [ebp - 0x61], 0x11
mov byte [ebp - 0x60], 0x33
mov byte [ebp - 0x5f], 0x2e
mov byte [ebp - 0x5e], 0x35
mov byte [ebp - 0x5d], 0x24
mov byte [ebp - 0x5c], 0x22
mov byte [ebp - 0x5b], 0x35
mov byte [ebp - 0x5a], 0x41
call fcn.0040334b
push eax
push esi
push dword [ebp + 8]
call fcn.00403300
mov dword [ebp - 0xbc], eax
lea eax, [ebp - 0x2c]
mov byte [ebp - 0x2c], bl
push eax
mov byte [ebp - 0x2b], bl
mov byte [ebp - 0x2a], 0xd4
mov byte [ebp - 0x29], bl
mov byte [ebp - 0x28], 0x67
mov byte [ebp - 0x27], 0x44
mov byte [ebp - 0x26], 0x4a
mov byte [ebp - 0x25], 0x4f
mov byte [ebp - 0x24], 0x67
mov byte [ebp - 0x23], 0x42
mov byte [ebp - 0x22], 0x49
mov byte [ebp - 0x21], 0x59
mov byte [ebp - 0x20], 0x4a
mov byte [ebp - 0x1f], 0x59
mov byte [ebp - 0x1e], 0x52
mov byte [ebp - 0x1d], 0x6a
mov byte [ebp - 0x1c], 0x2b
call fcn.0040334b
push eax
push esi
push dword [ebp + 8]
call fcn.00403300
add esp, 0x30
mov dword [ebp - 0xb8], eax
call fcn.0040333b
dec edx
pushal
cmp eax, 0x7c9d88cb
invalid
Function at 0x405569
Capabilities:
Create process on windows

Disassembly:
or bh, bh
jne 0x405571
push dword [ebp]
call fcn.00403b3b
rol byte [ebp + 0x330474c0], 1
rol byte [eax - 0x3d], 0x33
rol bl, 0x55
push ebp
invalid
mov ebp, esp
sub esp, 0x10
lea eax, [ebp - 0x10]
mov dword [0x422568], 0x44
push eax
xor eax, eax
push 0x422568
push eax
push eax
push eax
push eax
push eax
push eax
push dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
je 0x4055bc
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x10]
leave
ret 4
Function at 0x1001b900
Capabilities:
Encode data using xor

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100ca9e6
mov eax, dword fs:[0]
push eax
push ebx
sub esp, 0x3c
push esi
mov eax, dword [0x100e3008]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov eax, dword [0x10109ab4]
test al, 1
jne 0x1001ba42
or eax, 1
mov dword [0x10109ab4], eax
mov dword [ebp - 4], 0
mov eax, 0x10
movaps xmm0, xmmword [0x100d7f70]
pxor xmm0, xmmword [0x100d7b60]
mov dword [ebp - 0x1c], 0xc7d8c7d8
mov dword [ebp - 0x18], 0xa1c7a5df
mov word [ebp - 0x14], 0xe7d6
movups xmmword [ebp - 0x2c], xmm0
xor byte [ebp + eax - 0x2c], 0xe7
inc eax
cmp eax, 0x1a
jb 0x1001b984
lea ecx, [ebp - 0x2c]
mov dword [ebp - 0x38], 0
mov dword [ebp - 0x34], 0xf
lea edx, [ecx + 1]
mov byte [ebp - 0x48], 0
mov al, byte [ecx]
inc ecx
test al, al
jne 0x1001b9a7
sub ecx, edx
lea eax, [ebp - 0x2c]
push ecx
push eax
lea ecx, [ebp - 0x48]
call fcn.100214d0
mov byte [ebp - 4], 1
mov edx, dword [0x10109bd4]
test edx, edx
je 0x1001b9d0
mov edx, dword [edx + 0x50]
jmp 0x1001b9d2
xor edx, edx
mov eax, dword [0x10109bcc]
test eax, eax
je 0x1001b9e0
mov eax, dword [eax + 0x18]
jmp 0x1001b9e2
xor eax, eax
lea ecx, [ebp - 0x48]
push ecx
push eax
lea ecx, [ebp - 0x30]
call fcn.1001b520
mov eax, dword [ebp - 0x30]
add esp, 8
mov byte [ebp - 4], 0
mov edx, dword [ebp - 0x34]
mov dword [0x10109abc], eax
cmp edx, 0x10
jb 0x1001ba39
mov ecx, dword [ebp - 0x48]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x1001ba2a
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x1001ba2a
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push edx
push ecx
call fcn.100c980a
mov eax, dword [0x10109abc]
add esp, 8
mov dword [ebp - 4], 0xffffffff
jmp 0x1001ba47
mov eax, dword [0x10109abc]
test eax, eax
je 0x1001ba4f
mov ecx, esi
call eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret
Function at 0x10021790
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100cac50
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push esi
push edi
mov eax, dword [0x100e3008]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, edx
mov dword [ebp - 0x10], ecx
push 0x424
call fcn.100c9396
mov ebx, eax
add esp, 4
mov dword [ebp - 0x14], ebx
mov dword [ebp - 4], 0
lea edi, [ebx + 0xc]
mov dword [ebx + 4], 1
mov dword [ebx + 8], 1
mov dword [ebx], 0x100d55c8
mov eax, dword [esi]
mov dword [edi + 0xc], 0
mov dword [edi + 0x20], 0
mov dword [edi + 0x24], 0
mov dword [edi + 0x28], 0
mov dword [edi + 0x2c], 0
mov dword [edi + 0x30], 0
mov dword [edi + 0x34], 0
mov dword [edi + 0x38], 0
mov dword [edi + 0x3c], 0
mov dword [edi + 0x40], 0
mov dword [edi + 0x44], 0
mov dword [edi + 0x48], 0
mov dword [edi + 0x4c], 0
mov dword [edi + 0x50], 0
mov dword [edi + 0x54], 0
mov dword [edi + 0x58], 0
mov dword [edi + 0x5c], 0
mov dword [edi + 0x60], 0
mov dword [edi + 0x64], 0
mov dword [edi + 0x68], 0
mov dword [edi + 0x6c], 0
mov dword [edi + 0x70], 0
mov dword [edi + 0x3b4], 0
mov dword [edi + 0x3b8], 0
mov dword [edi + 0x3bc], 0
mov byte [edi + 0x3c0], 0
mov dword [edi + 0x3c4], 0
mov byte [edi + 0x3c8], 0
mov dword [edi + 0x3cc], 0
mov dword [edi + 0x3d0], 0
mov dword [edi + 0x3d4], 0
mov dword [edi + 0x3d8], 0
mov dword [edi + 0x3dc], 0
mov dword [edi + 0x3e0], 0
mov word [edi + 0x3f0], 0
mov dword [edi + 0x40c], 0
mov dword [edi + 0x410], 0xf
mov dword [ebp - 0x18], edi
mov byte [edi + 0x3fc], 0
push eax
mov ecx, edi
mov byte [ebp - 4], 1
call fcn.1001bb10
mov eax, dword [ebp - 0x10]
xorps xmm0, xmm0
movq qword [eax], xmm0
mov dword [eax], edi
mov dword [eax + 4], ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10029530
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x100e3008]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, ecx
push edi
cmp dword [esi + 0x38], 0
je 0x100295d3
cmp byte [esi + 0x3d], 0
je 0x100295d3
mov eax, dword [esi]
push 0xffffffffffffffff
call dword [eax + 0xc]
cmp eax, 0xffffffff
je 0x10029588
mov ecx, dword [esi + 0x38]
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [esi + 0x40]
push eax
call dword [sym.imp.MSVCP140.dll_public:_int___thiscall_std::codecvt_char__char__struct__Mbstatet_::unshift_struct__Mbstatet___char___char___char___const]
sub eax, 0
je 0x1002959a
sub eax, 1
je 0x1002959e
sub eax, 2
je 0x100295d3
pop edi
xor al, al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100c9377
mov esp, ebp
pop ebp
ret
mov byte [esi + 0x3d], 0
mov edi, dword [ebp - 0x28]
lea eax, [ebp - 0x24]
sub edi, eax
je 0x100295bc
push dword [esi + 0x4c]
push edi
push 1
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
add esp, 0x10
cmp edi, eax
jne 0x10029588
cmp byte [esi + 0x3d], 0
pop edi
sete al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100c9377
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
mov al, 1
pop edi
xor ecx, ebp
pop esi
call fcn.100c9377
mov esp, ebp
pop ebp
ret
Function at 0x1002ae20
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100cb060
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push ebx
push esi
push edi
mov eax, dword [0x100e3008]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 4], 0
mov eax, dword [0x1010e774]
mov ecx, dword [eax]
mov dword [eax], eax
mov eax, dword [0x1010e774]
mov dword [eax + 4], eax
mov dword [0x1010e778], 0
cmp ecx, dword [0x1010e774]
je 0x1002ae89
mov esi, dword [ecx]
push 0x10
push ecx
call fcn.100c980a
add esp, 8
mov ecx, esi
cmp esi, dword [0x1010e774]
jne 0x1002ae72
push 8
mov ecx, 0x1010e770
call fcn.1002eed0
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [0x10109c08]
test ecx, ecx
je 0x1002afe7
mov eax, dword [ecx]
mov eax, dword [eax + 0x20]
call eax
mov edi, eax
test edi, edi
je 0x1002afe7
nop dword [eax + eax]
mov eax, dword [edi + 0x14]
mov ebx, 0x811c9dc5
mov esi, dword [edi + 8]
mov dword [ebp - 0x18], eax
xor eax, eax
inc eax
cmp byte [eax + esi], 0
jne 0x1002aed0
xor edx, edx
test eax, eax
je 0x1002aef1
nop dword [eax]
movsx ecx, byte [edx + esi]
inc edx
xor ecx, ebx
imul ebx, ecx, 0x1000193
cmp edx, eax
jb 0x1002aee0
movzx eax, bl
xor eax, 0x811c9dc5
mov dword [ebp - 0x14], ebx
imul ecx, eax, 0x1000193
mov eax, ebx
shr eax, 8
movzx eax, al
xor ecx, eax
mov eax, ebx
imul ecx, ecx, 0x1000193
shr eax, 0x10
movzx eax, al
xor ecx, eax
mov eax, ebx
imul ecx, ecx, 0x1000193
shr eax, 0x18
xor ecx, eax
imul edx, ecx, 0x1000193
mov ecx, dword [0x1010e77c]
and edx, dword [0x1010e788]
mov esi, dword [ecx + edx*8]
lea ecx, [ecx + edx*8]
mov edx, dword [0x1010e774]
add ecx, 4
mov eax, esi
mov dword [ebp - 0x10], ecx
nop
cmp esi, edx
jne 0x1002af58
mov ecx, edx
jmp 0x1002af5c
mov ecx, dword [ecx]
mov ecx, dword [ecx]
cmp eax, ecx
je 0x1002af70
cmp dword [eax + 8], ebx
je 0x1002af6c
mov eax, dword [eax]
mov ecx, dword [ebp - 0x10]
jmp 0x1002af50
mov ecx, eax
jmp 0x1002af74
mov eax, edx
mov ecx, edx
cmp ecx, edx
jne 0x1002afcf
mov esi, dword [edx]
lea eax, [ebp - 0x14]
push ecx
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x10]
push eax
mov ebx, dword [esi + 4]
push ecx
push ebx
push esi
call fcn.100300c0
mov edx, dword [0x1010e778]
mov ecx, 0xffffffe
sub ecx, edx
cmp ecx, 1
jb 0x1002aff9
lea ecx, [edx + 1]
mov dword [0x1010e778], ecx
mov ecx, 0x1010e770
mov dword [esi + 4], eax
mov dword [ebx], eax
mov eax, dword [0x1010e774]
mov eax, dword [eax]
push eax
add eax, 8
push eax
lea eax, [ebp - 0x20]
push eax
call fcn.1002fea0
mov eax, dword [ebp - 0x20]
jmp 0x1002afd6
mov dword [ebp - 0x20], eax
mov byte [ebp - 0x1c], 0
mov ecx, dword [ebp - 0x18]
mov dword [eax + 0xc], ecx
mov edi, dword [edi + 0x10]
test edi, edi
jne 0x1002aec0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push str.list_T__too_long
call dword [sym.imp.MSVCP140.dll_void___cdecl_std::_Xlength_error_char_const__]
int3