joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100d00c0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [0x10415990]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [ebp + 0x18]
push esi
mov esi, dword [ebp + 0x14]
push edi
mov dword [ebp - 0x18], ebx
lea ebx, [ebp - 0x14]
push ebx
push esi
mov esi, dword [ebp + 0x10]
push esi
push edx
mov edx, dword [ebp + 0xc]
push edx
mov edx, dword [ebp - 0x18]
push 1
push eax
call fcn.100cfd80
add esp, 0x20
test eax, eax
jne 0x100d0152
xor edx, edx
xor cl, cl
test edi, edi
je 0x100d0150
mov esi, dword [ebp + 0x1c]
lea ebx, [ebx]
movzx ebx, byte [eax + esi]
movzx eax, byte [ebp + eax - 0x14]
xor ebx, eax
inc cl
movzx eax, cl
or edx, ebx
cmp eax, edi
jb 0x100d0110
test edx, edx
je 0x100d0150
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp - 0x18]
test eax, eax
je 0x100d013b
mov byte [ecx], 0
inc ecx
dec eax
jne 0x100d0134
mov eax, 0xfffffff1
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1015eea7
mov esp, ebp
pop ebp
ret
xor eax, eax
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
pop ebx
call fcn.1015eea7
mov esp, ebp
pop ebp
ret
Function at 0x100d0a50
Capabilities:
Encode data using base64

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov ebx, dword [ebp + 0x14]
push esi
push edi
xor edi, edi
xor eax, eax
mov dword [ebp - 4], 0
test edx, edx
je 0x100d0ae1
lea esp, [esp]
xor esi, esi
cmp eax, edx
jae 0x100d0a84
cmp byte [eax + ebx], 0x20
jne 0x100d0a82
inc eax
inc esi
cmp eax, edx
jb 0x100d0a76
cmp eax, edx
je 0x100d0add
mov ecx, edx
sub ecx, eax
cmp ecx, 2
jb 0x100d0a9c
cmp byte [eax + ebx], 0xd
jne 0x100d0a9c
cmp byte [eax + ebx + 1], 0xa
je 0x100d0ad8
mov cl, byte [eax + ebx]
cmp cl, 0xa
je 0x100d0ad8
test esi, esi
jne 0x100d0af3
cmp cl, 0x3d
jne 0x100d0ab9
mov esi, dword [ebp - 4]
inc esi
mov dword [ebp - 4], esi
cmp esi, 2
ja 0x100d0af3
cmp cl, 0x7f
ja 0x100d0af3
movzx ecx, cl
mov cl, byte [ecx + 0x10297da8]
cmp cl, 0x7f
je 0x100d0af3
cmp cl, 0x40
jae 0x100d0ad7
cmp dword [ebp - 4], 0
jne 0x100d0af3
inc edi
inc eax
cmp eax, edx
jb 0x100d0a70
test edi, edi
jne 0x100d0aff
mov edx, dword [ebp + 0x10]
pop edi
pop esi
mov dword [edx], 0
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
pop edi
pop esi
mov eax, 0xffffffd4
pop ebx
mov esp, ebp
pop ebp
ret
mov esi, dword [ebp + 8]
mov ecx, edi
and ecx, 7
lea ecx, [ecx + ecx*2]
lea edx, [ecx + ecx + 7]
shr edi, 3
mov ecx, edi
shr edx, 3
lea ecx, [ecx + ecx*2]
lea ecx, [edx + ecx*2]
sub ecx, dword [ebp - 4]
test esi, esi
je 0x100d0bbe
cmp dword [ebp + 0xc], ecx
jb 0x100d0bbe
xor edx, edx
mov edi, 3
mov dword [ebp - 4], edx
cmp eax, edx
jbe 0x100d0bad
mov edi, edi
mov cl, byte [ebx]
cmp cl, 0xd
je 0x100d0ba6
cmp cl, 0xa
je 0x100d0ba6
cmp cl, 0x20
je 0x100d0ba6
movzx ecx, cl
mov cl, byte [ecx + 0x10297da8]
xor ebx, ebx
cmp cl, 0x40
sete bl
movzx ecx, cl
and ecx, 0x3f
shl edx, 6
or edx, ecx
mov ecx, dword [ebp - 4]
inc ecx
sub edi, ebx
mov dword [ebp - 4], ecx
cmp ecx, 4
jne 0x100d0ba3
mov dword [ebp - 4], 0
test edi, edi
je 0x100d0b8e
mov ecx, edx
shr ecx, 0x10
mov byte [esi], cl
inc esi
cmp edi, 1
jbe 0x100d0b9b
mov ecx, edx
shr ecx, 8
mov byte [esi], cl
inc esi
cmp edi, 2
jbe 0x100d0ba3
mov byte [esi], dl
inc esi
mov ebx, dword [ebp + 0x14]
inc ebx
dec eax
mov dword [ebp + 0x14], ebx
jne 0x100d0b40
sub esi, dword [ebp + 8]
mov edx, dword [ebp + 0x10]
pop edi
mov dword [edx], esi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp + 0x10]
pop edi
pop esi
mov dword [eax], ecx
mov eax, 0xffffffd6
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x100d1c40
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
mov edx, dword [ebp + 0x10]
sub esp, 0x10
push ebx
push edi
test dl, 7
je 0x100d1c5e
mov eax, 0xffffffce
pop edi
pop ebx
mov esp, ebp
pop ebp
ret
cmp dword [ebp + 0xc], 1
jne 0x100d1d0d
test edx, edx
je 0x100d1d9b
lea ebx, [eax + 2]
sub eax, ecx
add eax, 0xfffffffe
mov dword [esp + 8], eax
lea eax, [edx - 1]
shr eax, 3
inc eax
lea edi, [ecx + 2]
mov dword [esp + 0xc], eax
movzx edx, byte [edi - 2]
xor dl, byte [esi]
mov ecx, dword [esp + 8]
mov byte [ecx + edi], dl
movzx eax, byte [edi - 1]
xor al, byte [esi + 1]
add ecx, edi
mov byte [ebx - 1], al
movzx edx, byte [esi + 2]
xor dl, byte [edi]
push ecx
mov byte [ebx], dl
movzx eax, byte [edi + 1]
xor al, byte [esi + 3]
mov byte [ebx + 1], al
movzx edx, byte [edi + 2]
xor dl, byte [esi + 4]
mov byte [ebx + 2], dl
movzx eax, byte [edi + 3]
xor al, byte [esi + 5]
mov byte [ebx + 3], al
movzx edx, byte [edi + 4]
xor dl, byte [esi + 6]
mov byte [ebx + 4], dl
movzx eax, byte [edi + 5]
xor al, byte [esi + 7]
mov byte [ebx + 5], al
mov eax, dword [ebp + 8]
call fcn.100d17c0
mov eax, dword [esp + 0xc]
mov edx, dword [eax + edi]
mov dword [esi], edx
mov eax, dword [eax + edi + 4]
add esp, 4
add ebx, 8
add edi, 8
dec dword [esp + 0xc]
mov dword [esi + 4], eax
jne 0x100d1c8a
xor eax, eax
pop edi
pop ebx
mov esp, ebp
pop ebp
ret
test edx, edx
je 0x100d1d9b
sub ecx, eax
lea edi, [eax + 2]
lea eax, [edx - 1]
add ecx, 0xfffffffe
shr eax, 3
inc eax
mov dword [esp + 8], ecx
mov dword [esp + 0xc], eax
mov ecx, dword [esp + 8]
mov eax, dword [ecx + edi + 4]
mov edx, dword [ecx + edi]
add ecx, edi
mov dword [esp + 0x14], eax
mov eax, dword [ebp + 8]
lea ebx, [edi - 2]
push ebx
mov dword [esp + 0x14], edx
call fcn.100d17c0
movzx ecx, byte [esi]
xor byte [ebx], cl
movzx edx, byte [esi + 1]
xor byte [edi - 1], dl
movzx eax, byte [esi + 2]
xor byte [edi], al
movzx ecx, byte [esi + 3]
xor byte [edi + 1], cl
movzx edx, byte [esi + 4]
xor byte [edi + 2], dl
movzx eax, byte [esi + 5]
xor byte [edi + 3], al
movzx ecx, byte [esi + 6]
xor byte [edi + 4], cl
movzx edx, byte [esi + 7]
xor byte [edi + 5], dl
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x18]
add esp, 4
add edi, 8
dec dword [esp + 0xc]
mov dword [esi], eax
mov dword [esi + 4], ecx
jne 0x100d1d2c
pop edi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x100d1e10
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ecx
cmp dword [ebp + 8], 0
push esi
mov esi, dword [ecx]
push edi
mov edi, dword [ecx + 4]
jbe 0x100d1e6a
mov eax, dword [ebp + 0xc]
sub eax, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
mov dword [ebp + 8], eax
push ebx
inc esi
and esi, 0xff
movzx eax, byte [ecx + esi + 8]
add edi, eax
and edi, 0xff
movzx ebx, byte [ecx + edi + 8]
mov byte [ecx + esi + 8], bl
mov byte [ecx + edi + 8], al
add al, bl
mov ebx, dword [ebp - 4]
movzx eax, al
mov al, byte [eax + ecx + 8]
xor al, byte [ebx + edx]
inc edx
dec dword [ebp + 8]
mov byte [edx - 1], al
jne 0x100d1e30
pop ebx
mov dword [ecx + 4], edi
pop edi
mov dword [ecx], esi
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x100d41e0
Capabilities:
Encrypt data using camellia

Disassembly:
mov ecx, dword [edx]
xor ecx, dword [eax]
mov edx, dword [edx + 4]
xor edx, dword [eax + 4]
push ebx
push edi
mov eax, edx
shr eax, 0x10
and eax, 0xff
movzx eax, byte [eax + 0x10296a48]
mov edi, edx
shr edi, 0x18
movzx edi, byte [edi + 0x10296948]
shl edi, 8
or eax, edi
mov edi, edx
shr edi, 8
and edi, 0xff
movzx edi, byte [edi + 0x10296b48]
shl eax, 8
or eax, edi
mov edi, ecx
mov ebx, ecx
shr edi, 0x10
shr ebx, 0x18
movzx ebx, byte [ebx + 0x10296848]
and edi, 0xff
movzx edi, byte [edi + 0x10296948]
shl ebx, 8
or edi, ebx
mov ebx, ecx
and edx, 0xff
movzx edx, byte [edx + 0x10296848]
shr ebx, 8
and ebx, 0xff
movzx ebx, byte [ebx + 0x10296a48]
and ecx, 0xff
movzx ecx, byte [ecx + 0x10296b48]
shl edi, 8
shl eax, 8
or eax, edx
or edi, ebx
shl edi, 8
or edi, ecx
mov edx, eax
rol edx, 8
xor edx, edi
mov ecx, edx
rol ecx, 0x10
xor eax, ecx
mov ecx, eax
ror ecx, 8
xor edx, ecx
xor dword [esi + 4], edx
mov ecx, edx
ror ecx, 8
xor ecx, dword [esi]
pop edi
xor ecx, eax
mov dword [esi], ecx
pop ebx
ret
Function at 0x100d5a90
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [ebp + 8]
mov ecx, dword [eax]
mov eax, dword [ebp + 0xc]
push ebx
push esi
mov esi, dword [eax]
push edi
mov edi, edx
mov dword [ebp - 4], 0x10
lea esp, [esp]
xor ecx, dword [edi]
add edi, 4
movzx eax, cl
mov dword [ebp - 0xc], eax
mov eax, ecx
shr eax, 8
movzx ebx, al
shr eax, 8
mov dword [ebp - 8], ebx
mov ebx, ecx
mov ecx, eax
shr ecx, 8
and ecx, 0xff
mov ecx, dword [edx + ecx*4 + 0x48]
movzx eax, al
add ecx, dword [edx + eax*4 + 0x448]
movzx eax, word [ebp - 8]
xor ecx, dword [edx + eax*4 + 0x848]
movzx eax, word [ebp - 0xc]
add ecx, dword [edx + eax*4 + 0xc48]
xor ecx, esi
dec dword [ebp - 4]
mov esi, ebx
jne 0x100d5ab0
mov eax, dword [edx + 0x44]
mov esi, dword [ebp + 8]
mov edx, dword [edx + 0x40]
xor eax, ebx
pop edi
mov dword [esi], eax
mov eax, dword [ebp + 0xc]
xor edx, ecx
pop esi
mov dword [eax], edx
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x100d5b20
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [ebp + 8]
mov ecx, dword [eax]
mov eax, dword [ebp + 0xc]
push ebx
push esi
mov esi, dword [eax]
push edi
lea edi, [edx + 0x44]
mov dword [ebp - 4], 0x10
lea ecx, [ecx]
xor ecx, dword [edi]
sub edi, 4
movzx eax, cl
mov dword [ebp - 0xc], eax
mov eax, ecx
shr eax, 8
movzx ebx, al
shr eax, 8
mov dword [ebp - 8], ebx
mov ebx, ecx
mov ecx, eax
shr ecx, 8
and ecx, 0xff
mov ecx, dword [edx + ecx*4 + 0x48]
movzx eax, al
add ecx, dword [edx + eax*4 + 0x448]
movzx eax, word [ebp - 8]
xor ecx, dword [edx + eax*4 + 0x848]
movzx eax, word [ebp - 0xc]
add ecx, dword [edx + eax*4 + 0xc48]
xor ecx, esi
dec dword [ebp - 4]
mov esi, ebx
jne 0x100d5b40
mov eax, dword [edx]
mov esi, dword [ebp + 8]
mov edx, dword [edx + 4]
xor eax, ebx
pop edi
mov dword [esi], eax
mov eax, dword [ebp + 0xc]
xor edx, ecx
pop esi
mov dword [eax], edx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x100d5bb0
Capabilities:
Encrypt data using blowfish
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov ebx, dword [ebp + 0xc]
push edi
mov edi, eax
lea eax, [ebx - 0x20]
cmp eax, 0x1a0
ja 0x100d5ce5
test bl, 7
jne 0x100d5ce5
mov ecx, dword [ebp + 8]
shr ebx, 3
mov eax, 0x10295818
add ecx, 0x48
mov dword [ebp + 0xc], 4
push esi
jmp 0x100d5bf0
mov edx, pe_nt_image_headers32
mov esi, dword [eax]
mov dword [ecx], esi
add eax, 4
add ecx, 4
dec edx
jne 0x100d5bf5
dec dword [ebp + 0xc]
jne 0x100d5bf0
mov esi, dword [ebp + 8]
mov ecx, 0x102957d0
xor eax, eax
sub ecx, esi
mov dword [ebp - 4], ecx
mov dword [ebp + 0xc], 0x12
lea ecx, [ecx]
movzx ecx, byte [eax + edi]
inc eax
cmp eax, ebx
jb 0x100d5c2b
xor eax, eax
movzx edx, byte [eax + edi]
shl ecx, 8
inc eax
or edx, ecx
cmp eax, ebx
jb 0x100d5c3b
xor eax, eax
movzx ecx, byte [eax + edi]
shl edx, 8
inc eax
or ecx, edx
cmp eax, ebx
jb 0x100d5c4b
xor eax, eax
movzx edx, byte [eax + edi]
shl ecx, 8
inc eax
or edx, ecx
cmp eax, ebx
jb 0x100d5c5b
xor eax, eax
mov ecx, dword [ebp - 4]
mov ecx, dword [ecx + esi]
xor ecx, edx
mov dword [esi], ecx
add esi, 4
dec dword [ebp + 0xc]
jne 0x100d5c20
xor esi, esi
mov dword [ebp + 0xc], esi
mov dword [ebp - 4], esi
mov edi, dword [ebp + 8]
lea edx, [ebp - 4]
push edx
lea eax, [ebp + 0xc]
push eax
mov edx, edi
call fcn.100d5a90
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp - 4]
mov dword [edi + esi*4], ecx
mov dword [edi + esi*4 + 4], edx
add esi, 2
add esp, 8
cmp esi, 0x12
jb 0x100d5c75
mov esi, edi
add esi, 0x4c
mov ebx, 4
lea esp, [esp]
mov edi, 0x80
mov edx, dword [ebp + 8]
lea eax, [ebp - 4]
push eax
lea ecx, [ebp + 0xc]
push ecx
call fcn.100d5a90
mov edx, dword [ebp + 0xc]
mov eax, dword [ebp - 4]
mov dword [esi - 4], edx
mov dword [esi], eax
add esp, 8
add esi, 8
dec edi
jne 0x100d5cb5
dec ebx
jne 0x100d5cb0
pop esi
pop edi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
pop edi
mov eax, 0xffffffea
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x100d6170
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
cmp dword [ebp + 0xc], 0
mov ecx, dword [ebp + 0x10]
mov eax, dword [ecx]
mov dword [ebp - 4], eax
je 0x100d6270
mov ecx, dword [ebp + 0x14]
sub edx, ecx
push ebx
mov dword [ebp - 0x10], edx
dec dword [ebp + 0xc]
test eax, eax
jne 0x100d6249
movzx eax, byte [edi]
movzx ecx, byte [edi + 1]
movzx edx, byte [edi + 2]
shl eax, 8
or eax, ecx
movzx ecx, byte [edi + 3]
shl eax, 8
or eax, edx
movzx edx, byte [edi + 4]
shl eax, 8
or eax, ecx
movzx ecx, byte [edi + 6]
shl edx, 8
mov dword [ebp - 8], eax
movzx eax, byte [edi + 5]
or edx, eax
movzx eax, byte [edi + 7]
shl edx, 8
or edx, ecx
shl edx, 8
or edx, eax
mov dword [ebp - 0xc], edx
lea ecx, [ebp - 0xc]
push ecx
lea edx, [ebp - 8]
push edx
mov edx, dword [ebp + 8]
call fcn.100d5a90
mov eax, dword [ebp - 8]
mov ecx, eax
shr ecx, 0x18
mov byte [esi], cl
mov edx, eax
shr edx, 0x10
mov ecx, eax
shr ecx, 8
mov byte [esi + 1], dl
mov byte [esi + 3], al
mov eax, dword [ebp - 0xc]
mov byte [esi + 2], cl
mov edx, eax
shr edx, 0x18
mov ecx, eax
shr ecx, 0x10
mov byte [esi + 4], dl
mov edx, eax
mov byte [esi + 5], cl
shr edx, 8
mov ecx, 1
add esp, 8
mov byte [esi + 7], al
mov byte [esi + 6], dl
lea eax, [edi + 7]
sub ecx, edi
inc byte [eax]
jne 0x100d6243
dec eax
lea edx, [ecx + eax]
test edx, edx
jg 0x100d6237
mov ecx, dword [ebp + 0x14]
mov eax, dword [ebp - 4]
mov edx, dword [ebp - 0x10]
movzx edx, byte [edx + ecx]
mov bl, byte [eax + esi]
xor bl, dl
inc eax
mov byte [ecx], bl
inc ecx
and eax, 7
cmp dword [ebp + 0xc], 0
mov dword [ebp + 0x14], ecx
mov dword [ebp - 4], eax
jne 0x100d6191
mov ecx, dword [ebp + 0x10]
pop ebx
mov dword [ecx], eax
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x100edd90
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov ecx, 0x5341
push esi
mov word [ebp - 8], cx
mov edx, 0x79d2
mov dx, word [ebp + 8]
xor esi, esi
xor eax, eax
mov dword [ebp - 0x28], 0x4e0096f6
mov dword [ebp - 0x24], 0x4e8c5e7a
mov dword [ebp - 0x20], 0x4e094e24
mov dword [ebp - 0x1c], 0x4e9456db
mov dword [ebp - 0x18], 0x4e03516d
mov dword [ebp - 0x14], 0x4e5d516b
mov dword [ebp - 0x10], 0x4e074ebf
mov dword [ebp - 0xc], 0x767e5343
mov dword [ebp - 4], 0x520679d2
xor ecx, ecx
mov edi, edi
cmp dx, word [ebp + ecx*2 - 0x28]
je 0x100eddff
inc ecx
cmp ecx, 0x11
jl 0x100eddf0
jmp 0x100ede02
or esi, 0xffffffff
xor ecx, ecx
cmp dx, word [ebp + ecx*2 - 4]
je 0x100ede13
inc ecx
cmp ecx, 2
jl 0x100ede04
jmp 0x100ede16
or eax, 0xffffffff
test esi, esi
pop esi
je 0x100ede24
mov eax, 1
mov esp, ebp
pop ebp
ret
neg eax
sbb eax, eax
and eax, 2
mov esp, ebp
pop ebp
ret
Function at 0x1012f630
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 0xc]
mov edx, dword [esi + 0x30]
movzx ecx, word [esi + 0x270]
mov dl, byte [edx]
mov eax, ecx
cmp dl, 0xff
jne 0x1012f70a
push ebx
push edi
mov edi, 1
mov edx, edi
cmp dx, word [esi + 0x272]
jae 0x1012f6c6
movzx ebx, word [esi + 0x270]
movzx edx, di
add edx, esi
add edx, ebx
mov bl, byte [edx + 0x343d]
xor bl, byte [edx + 0x343c]
test bl, 3
je 0x1012f6bc
movzx edx, cx
movzx ebx, ax
add edx, esi
mov dl, byte [ebx + edx + 0x343d]
and dl, 3
cmp dl, 1
jne 0x1012f6a2
lea ecx, [ecx + edi - 1]
push ecx
call fcn.1012f530
jmp 0x1012f6ac
lea edx, [ecx + edi - 1]
push edx
call fcn.1012f300
movzx ecx, word [esi + 0x270]
lea eax, [ecx + edi]
add esp, 4
movzx eax, ax
inc edi
cmp di, word [esi + 0x272]
jb 0x1012f660
movzx ecx, word [esi + 0x270]
movzx ebx, ax
lea edx, [esi + ecx]
mov dl, byte [ebx + edx + 0x343d]
and dl, 3
cmp dl, 1
jne 0x1012f6f6
lea ecx, [ecx + edi - 1]
push ecx
call fcn.1012f530
add esp, 4
pop edi
pop ebx
pop esi
pop ebp
ret 8
lea edx, [ecx + edi - 1]
push edx
call fcn.1012f300
add esp, 4
pop edi
pop ebx
pop esi
pop ebp
ret 8
cmp dl, 1
jne 0x1012f724
movzx ecx, word [esi + 0x272]
push ecx
call fcn.1012f300
add esp, 4
pop esi
pop ebp
ret 8
movzx edx, word [esi + 0x272]
push edx
call fcn.1012f530
add esp, 4
pop esi
pop ebp
ret 8
Function at 0x1015eea7
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x10415990]
jne 0x1015eeb1
repz ret
jmp fcn.1015f7c1

Function at 0x101618f0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x101af585
mov eax, dword fs:[0]
push eax
sub esp, 0x20
mov eax, dword [0x10415990]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov esi, edx
mov dword [ebp - 0x2c], esi
call fcn.10167810
cmp byte [eax + 0x4c], 0
je case.0x1016196d.0
test byte [0x10455eec], 1
jne 0x1016195f
or dword [0x10455eec], 1
mov ecx, 0x10455e48
mov dword [ebp - 4], 0
call fcn.10169320
push 0x101b4cc0
call fcn.1015f6af
add esp, 4
cmp byte [0x10455e4a], 0
je case.0x1016196d.0
cmp edi, 3
ja case.0x1016196d.0
jmp dword [edi*4 + 0x10161a3c]
mov edi, 3
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
lea ecx, [ebp - 0x28]
mov esi, eax
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetConsoleScreenBufferInfo]
movzx ebx, word [ebp - 0x20]
call sub.MSVCR100.dll___iob_func
add eax, 0x40
push eax
call sub.MSVCR100.dll_fflush
mov eax, edi
add esp, 4
dec eax
je 0x101619e1
dec eax
je 0x101619da
dec eax
je 0x101619d3
xor eax, eax
jmp 0x101619e6
mov edi, 1
jmp 0x10161979
call sub.MSVCR100.dll___iob_func
add eax, 0x40
push eax
mov eax, dword [ebp + 8]
push 1
push eax
push esi
call sub.MSVCR100.dll_fwrite
add esp, 0x10
jmp 0x10161a20
mov eax, 6
jmp 0x101619e6
mov eax, 2
jmp 0x101619e6
mov eax, 4
mov edi, dword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
or eax, 8
push eax
push esi
call edi
call sub.MSVCR100.dll___iob_func
mov edx, dword [ebp + 8]
add eax, 0x40
push eax
mov eax, dword [ebp - 0x2c]
push 1
push edx
push eax
call sub.MSVCR100.dll_fwrite
call sub.MSVCR100.dll___iob_func
add eax, 0x40
push eax
call sub.MSVCR100.dll_fflush
add esp, 0x14
push ebx
push esi
call edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1015eea7
mov esp, ebp
pop ebp
ret
Function at 0x10161974
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x101af585
mov eax, dword fs:[0]
push eax
sub esp, 0x20
mov eax, dword [0x10415990]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov esi, edx
mov dword [ebp - 0x2c], esi
call fcn.10167810
cmp byte [eax + 0x4c], 0
je case.0x1016196d.0
test byte [0x10455eec], 1
jne 0x1016195f
or dword [0x10455eec], 1
mov ecx, 0x10455e48
mov dword [ebp - 4], 0
call fcn.10169320
push 0x101b4cc0
call fcn.1015f6af
add esp, 4
cmp byte [0x10455e4a], 0
je case.0x1016196d.0
cmp edi, 3
ja case.0x1016196d.0
jmp dword [edi*4 + 0x10161a3c]
mov edi, 3
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
lea ecx, [ebp - 0x28]
mov esi, eax
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetConsoleScreenBufferInfo]
movzx ebx, word [ebp - 0x20]
call sub.MSVCR100.dll___iob_func
add eax, 0x40
push eax
call sub.MSVCR100.dll_fflush
mov eax, edi
add esp, 4
dec eax
je 0x101619e1
dec eax
je 0x101619da
dec eax
je 0x101619d3
xor eax, eax
jmp 0x101619e6
mov edi, 1
jmp 0x10161979
call sub.MSVCR100.dll___iob_func
add eax, 0x40
push eax
mov eax, dword [ebp + 8]
push 1
push eax
push esi
call sub.MSVCR100.dll_fwrite
add esp, 0x10
jmp 0x10161a20
mov eax, 6
jmp 0x101619e6
mov eax, 2
jmp 0x101619e6
mov eax, 4
mov edi, dword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
or eax, 8
push eax
push esi
call edi
call sub.MSVCR100.dll___iob_func
mov edx, dword [ebp + 8]
add eax, 0x40
push eax
mov eax, dword [ebp - 0x2c]
push 1
push edx
push eax
call sub.MSVCR100.dll_fwrite
call sub.MSVCR100.dll___iob_func
add eax, 0x40
push eax
call sub.MSVCR100.dll_fflush
add esp, 0x14
push ebx
push esi
call edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1015eea7
mov esp, ebp
pop ebp
ret
Function at 0x101619b2
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x101af585
mov eax, dword fs:[0]
push eax
sub esp, 0x20
mov eax, dword [0x10415990]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov esi, edx
mov dword [ebp - 0x2c], esi
call fcn.10167810
cmp byte [eax + 0x4c], 0
je case.0x1016196d.0
test byte [0x10455eec], 1
jne 0x1016195f
or dword [0x10455eec], 1
mov ecx, 0x10455e48
mov dword [ebp - 4], 0
call fcn.10169320
push 0x101b4cc0
call fcn.1015f6af
add esp, 4
cmp byte [0x10455e4a], 0
je case.0x1016196d.0
cmp edi, 3
ja case.0x1016196d.0
jmp dword [edi*4 + 0x10161a3c]
mov edi, 3
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
lea ecx, [ebp - 0x28]
mov esi, eax
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetConsoleScreenBufferInfo]
movzx ebx, word [ebp - 0x20]
call sub.MSVCR100.dll___iob_func
add eax, 0x40
push eax
call sub.MSVCR100.dll_fflush
mov eax, edi
add esp, 4
dec eax
je 0x101619e1
dec eax
je 0x101619da
dec eax
je 0x101619d3
xor eax, eax
jmp 0x101619e6
mov edi, 1
jmp 0x10161979
call sub.MSVCR100.dll___iob_func
add eax, 0x40
push eax
mov eax, dword [ebp + 8]
push 1
push eax
push esi
call sub.MSVCR100.dll_fwrite
add esp, 0x10
jmp 0x10161a20
mov eax, 6
jmp 0x101619e6
mov eax, 2
jmp 0x101619e6
mov eax, 4
mov edi, dword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
or eax, 8
push eax
push esi
call edi
call sub.MSVCR100.dll___iob_func
mov edx, dword [ebp + 8]
add eax, 0x40
push eax
mov eax, dword [ebp - 0x2c]
push 1
push edx
push eax
call sub.MSVCR100.dll_fwrite
call sub.MSVCR100.dll___iob_func
add eax, 0x40
push eax
call sub.MSVCR100.dll_fflush
add esp, 0x14
push ebx
push esi
call edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1015eea7
mov esp, ebp
pop ebp
ret
Function at 0x101619b9
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x101af585
mov eax, dword fs:[0]
push eax
sub esp, 0x20
mov eax, dword [0x10415990]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov esi, edx
mov dword [ebp - 0x2c], esi
call fcn.10167810
cmp byte [eax + 0x4c], 0
je case.0x1016196d.0
test byte [0x10455eec], 1
jne 0x1016195f
or dword [0x10455eec], 1
mov ecx, 0x10455e48
mov dword [ebp - 4], 0
call fcn.10169320
push 0x101b4cc0
call fcn.1015f6af
add esp, 4
cmp byte [0x10455e4a], 0
je case.0x1016196d.0
cmp edi, 3
ja case.0x1016196d.0
jmp dword [edi*4 + 0x10161a3c]
mov edi, 3
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
lea ecx, [ebp - 0x28]
mov esi, eax
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetConsoleScreenBufferInfo]
movzx ebx, word [ebp - 0x20]
call sub.MSVCR100.dll___iob_func
add eax, 0x40
push eax
call sub.MSVCR100.dll_fflush
mov eax, edi
add esp, 4
dec eax
je 0x101619e1
dec eax
je 0x101619da
dec eax
je 0x101619d3
xor eax, eax
jmp 0x101619e6
mov edi, 1
jmp 0x10161979
call sub.MSVCR100.dll___iob_func
add eax, 0x40
push eax
mov eax, dword [ebp + 8]
push 1
push eax
push esi
call sub.MSVCR100.dll_fwrite
add esp, 0x10
jmp 0x10161a20
mov eax, 6
jmp 0x101619e6
mov eax, 2
jmp 0x101619e6
mov eax, 4
mov edi, dword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
or eax, 8
push eax
push esi
call edi
call sub.MSVCR100.dll___iob_func
mov edx, dword [ebp + 8]
add eax, 0x40
push eax
mov eax, dword [ebp - 0x2c]
push 1
push edx
push eax
call sub.MSVCR100.dll_fwrite
call sub.MSVCR100.dll___iob_func
add eax, 0x40
push eax
call sub.MSVCR100.dll_fflush
add esp, 0x14
push ebx
push esi
call edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1015eea7
mov esp, ebp
pop ebp
ret