joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10095870
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x14
mov eax, dword [0x10001850]
xor eax, esp
mov dword [esp + 0x10], eax
push ebx
mov ebx, dword [ebp + 0x10]
push esi
mov esi, ecx
mov dword [esp + 8], ebx
mov ecx, dword [ebp + 8]
push edi
cmp byte [esi + 0xc8], 0
jne 0x100958ea
mov edx, str.ERROR:
mov ecx, 0x100e9268
call fcn.10015c40
mov edx, str.DecodeChunk___called_without_StartDecoding__
mov ecx, eax
call fcn.10015c40
push eax
call fcn.1001a500
add esp, 4
cmp byte [0x100ea58c], 0
jne 0x10095a3a
mov ecx, esi
call fcn.10095070
xor al, al
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x10]
xor ecx, esp
call fcn.100af3ad
mov esp, ebp
pop ebp
ret 0xc
cmp dword [esi + 0x18], 0
xorps xmm0, xmm0
mov edx, dword [ebp + 0xc]
movq qword [esp + 0x10], xmm0
mov dword [esp + 0x18], 0
mov dword [esp + 0x10], ecx
lea eax, [ecx + edx]
mov dword [esp + 0x18], ecx
mov dword [esp + 0x14], eax
je 0x10095938
push edx
lea edi, [esi + 8]
push ecx
mov ecx, edi
call fcn.1002c6f0
cmp dword [edi + 0x14], 0x10
mov eax, dword [esi + 0x18]
jb 0x1009592a
mov edi, dword [edi]
add eax, edi
mov dword [esp + 0x10], edi
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], edi
lea eax, [esp + 0x10]
mov ecx, esi
push eax
call fcn.100951c0
test eax, eax
jne 0x100959ff
lea eax, [esp + 0x10]
mov ecx, esi
push eax
call fcn.100955e0
test eax, eax
jne 0x100959ff
mov ecx, dword [esp + 0x14]
mov eax, ecx
mov edx, dword [esp + 0x18]
sub eax, edx
je 0x10095a10
lea eax, [esi + 0x3c]
lea ecx, [esp + 0x10]
push ecx
mov ecx, eax
call fcn.10096550
test eax, eax
jne 0x100959ff
mov ecx, esi
call fcn.10094dc0
test al, al
jne 0x10095a08
cmp byte [esi + 0xc9], al
jne 0x100959e8
cmp dword [esi + 0x34], 0x10
lea edi, [esi + 0x20]
mov ebx, dword [esi + 0x30]
jb 0x100959a8
mov ecx, dword [edi]
jmp 0x100959aa
mov ecx, edi
mov edx, dword [esp + 0xc]
mov eax, dword [esi + 0xc4]
sub ebx, eax
push ebx
mov ebx, dword [esp + 0x10]
add eax, ecx
mov edx, dword [edx]
mov ecx, ebx
push eax
call dword [edx + 4]
cmp dword [edi + 0x14], 0x10
mov dword [edi + 0x10], 0
jb 0x100959d4
mov edi, dword [edi]
mov byte [edi], 0
mov dword [esi + 0x6c], 0
mov dword [esi + 0xc4], 0
mov ecx, dword [esp + 0x14]
mov eax, ecx
mov edx, dword [esp + 0x18]
sub eax, edx
lea eax, [esi + 0x3c]
jne 0x10095975
jmp 0x10095a10
cmp eax, 0xffffffff
je 0x100958cd
mov edx, dword [esp + 0x18]
mov ecx, dword [esp + 0x14]
sub ecx, edx
push ecx
push edx
lea ecx, [esi + 8]
call fcn.10010590
push ebx
mov ecx, esi
call fcn.10095800
mov ecx, dword [esp + 0x1c]
mov al, 1
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.100af3ad
mov esp, ebp
pop ebp
ret 0xc
mov ecx, 0x100e9268
call fcn.1002d2f0
push 1
call fcn.100b18e2
int3
Function at 0x10095a50
Capabilities:
Terminate process

Disassembly:
push ecx
push ebx
push esi
mov esi, ecx
mov bl, 1
cmp byte [esi + 0xc8], 0
jne 0x10095a8f
mov edx, str.WARNING:
mov ecx, 0x100e9268
call fcn.10015c40
mov edx, str.FinishDecoding___called_before_StartDecoding____or_called_after_DecodeChunk___returned_false
mov ecx, eax
call fcn.10015c40
push eax
call fcn.1001a500
add esp, 4
cmp byte [0x100ea58c], 0
je 0x10095ad1
jmp 0x10095ae0
cmp dword [esi + 0x90], 0
je 0x10095ab0
cmp dword [esi + 0xb0], 0
jne 0x10095abb
cmp byte [esi + 0x40], 0
jne 0x10095abb
call fcn.10094dc0
test al, al
jne 0x10095ad3
cmp dword [esi + 0x18], 0
sete al
test al, al
jne 0x10095ad3
mov edx, str.ERROR:
mov ecx, 0x100e9268
call fcn.10015c40
mov edx, str.FinishDecoding___called_before_parsing_entire_delta_file_window
jmp 0x10095a74
xor bl, bl
mov ecx, esi
call fcn.10095070
pop esi
mov al, bl
pop ebx
pop ecx
ret
mov ecx, 0x100e9268
call fcn.1002d2f0
push 1
call fcn.100b18e2
int3

Function at 0x10095b00
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ecx + 0xbc]
mov edx, dword [ebp + 8]
push esi
push edi
cmp edx, eax
jbe 0x10095b7d
push eax
push ecx
push edx
push ecx
mov edx, str.ERROR:
mov ecx, 0x100e9268
call fcn.10015c40
mov edx, str.Length_of_target_window__
mov ecx, eax
call fcn.10015c40
add esp, 4
mov ecx, eax
call fcn.10012f00
mov edx, str.__exceeds_limit_of
mov ecx, eax
call fcn.10015c40
add esp, 4
mov ecx, eax
call fcn.10012f00
mov edx, str._bytes
mov ecx, eax
call fcn.10015c40
push eax
call fcn.1001a500
add esp, 4
cmp byte [0x100ea58c], 0
jne 0x10095c49
mov al, 1
pop edi
pop esi
pop ecx
pop ebp
ret 4
mov esi, dword [ecx + 0xb4]
cmp esi, 0xfffffffd
je 0x10095be1
mov edi, dword [ecx + 0xc0]
mov eax, esi
sub eax, edi
cmp edx, eax
jbe 0x10095be1
push esi
push ecx
push edi
push ecx
push edx
push ecx
mov edx, str.ERROR:
mov ecx, 0x100e9268
call fcn.10015c40
mov edx, str.Length_of_target_window__
mov ecx, eax
call fcn.10015c40
add esp, 4
mov ecx, eax
call fcn.10012f00
mov edx, str._bytes__plus_previous_windows__
mov ecx, eax
call fcn.10015c40
add esp, 4
mov ecx, eax
call fcn.10012f00
mov edx, str._bytes__would_exceed_planned_size_of
jmp 0x10095b41
mov esi, dword [ecx + 0xb8]
mov eax, esi
mov ecx, dword [ecx + 0xc0]
sub eax, ecx
cmp edx, eax
jbe 0x10095c40
push esi
push ecx
push ecx
push ecx
push edx
push ecx
mov edx, str.ERROR:
mov ecx, 0x100e9268
call fcn.10015c40
mov edx, str.Length_of_target_window__
mov ecx, eax
call fcn.10015c40
add esp, 4
mov ecx, eax
call fcn.10012f00
mov edx, str._bytes__plus_previous_windows__
mov ecx, eax
call fcn.10015c40
add esp, 4
mov ecx, eax
call fcn.10012f00
mov edx, str._bytes__would_exceed_maximum_target_file_size_of
jmp 0x10095b41
pop edi
xor al, al
pop esi
pop ecx
pop ebp
ret 4
mov ecx, 0x100e9268
call fcn.1002d2f0
push 1
call fcn.100b18e2
int3
Function at 0x10095cf0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
mov esi, dword [ebp + 8]
mov ebx, ecx
push edi
mov ecx, esi
mov dword [ebp - 0xc], 0
mov dword [ebp - 8], 0
lea eax, [ebx + 0x38]
mov dword [ebp - 4], 0
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0xc]
push eax
movzx eax, byte [ebx + 0x34]
push eax
call fcn.100a2dd0
test al, al
jne 0x10095d3f
mov eax, dword [esi + 0xc]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
mov eax, dword [ebx]
mov edx, dword [ebp - 0xc]
cmp byte [eax + 0x38], 0x53
mov eax, dword [ebp - 4]
jne 0x10095d90
test edx, edx
jne 0x10095d90
test eax, eax
jne 0x10095d90
mov eax, dword [ebp - 8]
mov ecx, ebx
mov dword [ebx + 0x28], eax
push dword [esi + 4]
push dword [esi + 8]
call fcn.10094b90
mov eax, dword [ebx + 0x10]
mov ecx, dword [eax + 4]
add eax, 8
mov dword [ebx + 0x44], eax
xor eax, eax
mov dword [ebx + 0x48], ecx
mov dword [ebx + 0x4c], 0
mov dword [ebx + 0x50], 0x1000100
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
add eax, dword [ebp - 8]
mov ecx, dword [esi + 4]
add eax, edx
mov edi, dword [esi + 8]
sub ecx, edi
cmp ecx, eax
jae 0x10095daf
mov eax, 0xfffffffe
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
push edx
push edi
lea ecx, [ebx + 0x18]
call fcn.10094a70
mov eax, dword [ebx + 0x18]
lea ecx, [ebx + 0x10]
push dword [ebp - 8]
push dword [eax + 4]
call fcn.10094a70
mov eax, dword [ebx + 0x10]
lea ecx, [ebx + 0x20]
push dword [ebp - 4]
push dword [eax + 4]
call fcn.10094a70
mov eax, dword [ebx + 0x20]
mov esi, dword [eax + 4]
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x14]
test ecx, ecx
jne 0x10095df2
call fcn.100a2cf0
jmp 0x10095df7
mov eax, dword [eax + 0x10]
add eax, ecx
cmp esi, eax
je 0x10095d68
mov edx, str.ERROR:
mov ecx, 0x100e9268
call fcn.10015c40
mov edx, str.The_end_of_the_instructions_section_does_not_match_the_end_of_the_delta_window
mov ecx, eax
call fcn.10015c40
push eax
call fcn.1001a500
add esp, 4
cmp byte [0x100ea58c], 0
jne 0x10095e38
pop edi
pop esi
or eax, 0xffffffff
pop ebx
mov esp, ebp
pop ebp
ret 4
mov ecx, 0x100e9268
call fcn.1002d2f0
push 1
call fcn.100b18e2
int3
Function at 0x10095ff0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
mov esi, ecx
push edi
mov dword [ebp - 8], esi
mov ecx, dword [esi]
mov ebx, dword [esi + 0xc]
mov eax, dword [ecx + 0x30]
sub eax, dword [esi + 0x30]
mov ecx, dword [ecx + 0x90]
add ebx, eax
mov dword [ebp - 4], eax
mov eax, dword [esi + 0x20]
push dword [eax + 4]
lea edx, [eax + 8]
push edx
push dword [ebp + 0xc]
push ebx
call fcn.100a20b0
mov edi, eax
cmp edi, 0xfffffffe
je 0x10096184
cmp edi, 0xffffffff
je 0x1009615b
test edi, edi
js 0x10096108
cmp edi, ebx
jg 0x10096108
mov ebx, dword [ebp + 8]
mov ecx, dword [esi + 0xc]
lea eax, [edi + ebx]
cmp eax, ecx
ja 0x10096074
mov eax, dword [esi + 8]
mov ecx, dword [esi]
add eax, edi
push ebx
push eax
add ecx, 0x20
call fcn.1002c6f0
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
cmp edi, ecx
jae 0x1009609f
mov eax, dword [esi + 8]
sub ecx, edi
push ecx
mov dword [ebp + 0xc], ecx
add eax, edi
mov ecx, dword [esi]
push eax
add ecx, 0x20
call fcn.1002c6f0
mov eax, dword [ebp - 4]
mov ecx, dword [ebp + 0xc]
add eax, ecx
add edi, ecx
mov dword [ebp - 4], eax
sub ebx, ecx
jmp 0x100960a2
mov eax, dword [ebp - 4]
mov ecx, dword [esi]
sub edi, dword [esi + 0xc]
add ecx, 0x20
cmp dword [ecx + 0x14], 0x10
jb 0x100960b2
mov ecx, dword [ecx]
mov edx, dword [esi + 0x30]
mov esi, eax
add edx, ecx
sub esi, edi
mov dword [ebp + 0xc], edx
cmp ebx, esi
jbe 0x100960eb
lea eax, [edx + edi]
push esi
push eax
mov eax, dword [ebp - 8]
mov ecx, dword [eax]
add ecx, 0x20
call fcn.1002c6f0
mov eax, dword [ebp - 4]
add edi, esi
mov edx, dword [ebp + 0xc]
add eax, esi
sub ebx, esi
mov dword [ebp - 4], eax
mov esi, eax
sub esi, edi
cmp ebx, esi
ja 0x100960c2
lea eax, [edx + edi]
push ebx
push eax
mov eax, dword [ebp - 8]
mov ecx, dword [eax]
add ecx, 0x20
call fcn.1002c6f0
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
push ebx
push ecx
push edi
push ecx
mov edx, str.ERROR:
mov ecx, 0x100e9268
call fcn.10015c40
mov edx, str.Internal_error:_unexpected_address
mov ecx, eax
call fcn.10015c40
add esp, 4
mov ecx, eax
call fcn.10050e60
mov edx, str._returned_from_DecodeAddress__with_here_address_
mov ecx, eax
call fcn.10015c40
add esp, 4
mov ecx, eax
call fcn.10050e60
push eax
call fcn.1001a500
add esp, 4
cmp byte [0x100ea58c], 0
je 0x10096178
jmp 0x10096192
mov edx, str.ERROR:
mov ecx, 0x100e9268
call fcn.10015c40
mov edx, str.Unable_to_decode_address_for_COPY
mov ecx, eax
call fcn.10015c40
jmp 0x10096147
or eax, 0xffffffff
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
pop edi
pop esi
mov eax, 0xfffffffe
pop ebx
mov esp, ebp
pop ebp
ret 8
mov ecx, 0x100e9268
call fcn.1002d2f0
push 1
call fcn.100b18e2
int3
Function at 0x10096550
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, ecx
push edi
cmp dword [esi], 0
jne 0x10096593
mov edx, str.ERROR:
mov ecx, 0x100e9268
call fcn.10015c40
mov edx, str.Internal_error:_VCDiffDeltaFileWindow::DecodeWindow___called_before_VCDiffDeltaFileWindow::Init__
mov ecx, eax
call fcn.10015c40
push eax
call fcn.1001a500
add esp, 4
cmp byte [0x100ea58c], 0
je 0x1009668a
jmp 0x10096694
cmp byte [esi + 4], 0
jne 0x100965e6
mov edi, dword [ebp + 8]
push edi
call fcn.10095e50
cmp eax, 0xfffffffe
je 0x100965da
cmp eax, 0xffffffff
je 0x1009668a
mov eax, dword [esi]
mov ecx, dword [eax + 0x90]
call fcn.100a1c70
test al, al
jne 0x1009662f
mov edx, str.ERROR:
mov ecx, 0x100e9268
call fcn.10015c40
mov edx, str.Error_initializing_address_cache
jmp 0x10096675
mov eax, 0xfffffffe
pop edi
pop esi
pop ecx
pop ebp
ret 4
cmp byte [esi + 0x24], 0
je 0x10096605
mov edx, str.ERROR:
mov ecx, 0x100e9268
call fcn.10015c40
mov edx, str.Internal_error:_Resumed_decoding_of_a_delta_file_window_when_interleaved_format_is_not_being_used
jmp 0x10096571
mov edi, dword [ebp + 8]
push dword [edi + 4]
push dword [edi + 8]
call fcn.10094b90
mov eax, dword [esi + 0x10]
mov ecx, dword [eax + 4]
add eax, 8
mov dword [esi + 0x44], eax
mov dword [esi + 0x48], ecx
mov eax, dword [eax]
mov dword [esi + 0x4c], eax
mov ax, word [esi + 0x50]
mov word [esi + 0x52], ax
push edi
mov ecx, esi
call fcn.100961b0
cmp eax, 0xfffffffe
je 0x10096651
cmp eax, 0xffffffff
je 0x1009668a
mov ecx, esi
call fcn.10095c60
xor eax, eax
pop edi
pop esi
pop ecx
pop ebp
ret 4
cmp byte [esi + 0x24], 0
jne 0x10096661
cmp dword [esi + 0x28], 0
jg 0x100965da
mov edx, str.ERROR:
mov ecx, 0x100e9268
call fcn.10015c40
mov edx, str.End_of_data_reached_while_decoding_VCDIFF_delta_file
mov ecx, eax
call fcn.10015c40
push eax
call fcn.1001a500
add esp, 4
call fcn.10094970
pop edi
or eax, 0xffffffff
pop esi
pop ecx
pop ebp
ret 4
mov ecx, 0x100e9268
call fcn.1002d2f0
push 1
call fcn.100b18e2
int3

Function at 0x100969a0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, ecx
mov ecx, dword [esi + 4]
mov eax, dword [esi]
mov edx, dword [ecx]
push dword [eax + 4]
mov eax, dword [edx + 4]
call eax
test al, al
jne 0x100969ed
mov edx, str.ERROR:
mov ecx, 0x100e9268
call fcn.10015c40
mov edx, str.Internal_error:_Initialization_of_code_table_writer_failed
mov ecx, eax
call fcn.10015c40
push eax
call fcn.1001a500
add esp, 4
cmp byte [0x100ea58c], 0
jne 0x10096a31
xor al, al
pop esi
pop ebp
ret 4
mov eax, dword [esi]
mov ecx, dword [esi + 4]
push dword [eax + 4]
mov edx, dword [ecx]
push dword [eax]
mov eax, dword [edx + 0x24]
call eax
test al, al
jne 0x10096a18
mov edx, str.ERROR:
mov ecx, 0x100e9268
call fcn.10015c40
mov edx, str.Dictionary_not_valid_for_writer
jmp 0x100969cd
mov ecx, dword [esi + 4]
push dword [esi + 8]
push dword [ebp + 8]
mov eax, dword [ecx]
call dword [eax + 8]
mov byte [esi + 0xd], 1
mov al, 1
pop esi
pop ebp
ret 4
mov ecx, 0x100e9268
call fcn.1002d2f0
push 1
call fcn.100b18e2
int3
Function at 0x10096a50
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, ecx
push esi
push edi
cmp byte [ebx + 0xd], 0
jne 0x10096a98
mov edx, str.ERROR:
mov ecx, 0x100e9268
call fcn.10015c40
mov edx, str.EncodeChunk_called_before_StartEncoding
mov ecx, eax
call fcn.10015c40
push eax
call fcn.1001a500
add esp, 4
cmp byte [0x100ea58c], 0
jne 0x10096b18
xor al, al
pop edi
pop esi
pop ebx
pop ebp
ret 0xc
mov ecx, dword [ebx + 4]
mov esi, dword [ebp + 0xc]
mov edi, dword [ebp + 8]
push esi
mov eax, dword [ecx]
push edi
mov eax, dword [eax + 0x28]
call eax
test al, al
jne 0x10096ac4
mov edx, str.ERROR:
mov ecx, 0x100e9268
call fcn.10015c40
mov edx, str.Target_chunk_not_valid_for_writer
jmp 0x10096a72
test byte [ebx + 8], 2
je 0x10096aeb
mov esi, dword [ebx + 4]
xor ecx, ecx
push dword [ebp + 0xc]
mov edx, dword [ebp + 8]
mov edi, dword [esi]
call fcn.100a12c0
add esp, 4
mov ecx, esi
push eax
call dword [edi + 0x18]
mov esi, dword [ebp + 0xc]
mov edi, dword [ebp + 8]
cmp byte [ebx + 0xc], 0
mov eax, dword [ebx + 4]
mov ecx, dword [ebx]
push eax
push dword [ebp + 0x10]
push esi
push edi
je 0x10096b0a
call fcn.100a31c0
mov al, 1
pop edi
pop esi
pop ebx
pop ebp
ret 0xc
call fcn.100a3390
pop edi
pop esi
mov al, 1
pop ebx
pop ebp
ret 0xc
mov ecx, 0x100e9268
call fcn.1002d2f0
push 1
call fcn.100b18e2
int3

Function at 0x10096b30
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push ecx
cmp byte [ecx + 0xd], 0
jne 0x10096b6e
mov edx, str.ERROR:
mov ecx, 0x100e9268
call fcn.10015c40
mov edx, str.FinishEncoding_called_before_StartEncoding
mov ecx, eax
call fcn.10015c40
push eax
call fcn.1001a500
add esp, 4
cmp byte [0x100ea58c], 0
jne 0x10096b84
xor al, al
pop ecx
pop ebp
ret 4
push dword [ebp + 8]
mov byte [ecx + 0xd], 0
mov ecx, dword [ecx + 4]
mov eax, dword [ecx]
call dword [eax + 0x20]
mov al, 1
pop ecx
pop ebp
ret 4
mov ecx, 0x100e9268
call fcn.1002d2f0
push 1
call fcn.100b18e2
int3
Function at 0x1009c0f0
Capabilities:
Parse credit card information

Disassembly:
add ecx, 0xfffffffe
cmp ecx, 8
ja case.default.0x1009c0fc
jmp dword [ecx*4 + 0x1009c224]
cmp dl, 0x40
jne 0x1009c10e
mov eax, 4
ret
mov al, dl
or al, 0x20
cmp al, 0x61
jb 0x1009c11a
cmp al, 0x7a
jbe 0x1009c17d
cmp dl, 0x30
jl 0x1009c124
cmp dl, 0x39
jle 0x1009c17d
cmp dl, 0x2d
je 0x1009c17d
cmp dl, 0x5f
je 0x1009c17d
cmp dl, 0x2e
je 0x1009c17d
cmp dl, 0x21
je 0x1009c17d
cmp dl, 0x7e
je 0x1009c17d
cmp dl, 0x2a
je 0x1009c17d
cmp dl, 0x27
je 0x1009c17d
cmp dl, 0x28
je 0x1009c17d
cmp dl, 0x29
je 0x1009c17d
cmp dl, 0x25
je 0x1009c17d
cmp dl, 0x3b
je 0x1009c17d
cmp dl, 0x3a
je 0x1009c17d
cmp dl, 0x26
je 0x1009c17d
cmp dl, 0x3d
je 0x1009c17d
cmp dl, 0x2b
je 0x1009c17d
cmp dl, 0x24
je 0x1009c17d
cmp dl, 0x2c
jne case.default.0x1009c0fc
mov eax, 3
ret
cmp dl, 0x5b
jne 0x1009c18e
mov eax, 5
ret
mov al, dl
or al, 0x20
cmp al, 0x61
jb 0x1009c19a
cmp al, 0x7a
jbe 0x1009c1ae
cmp dl, 0x30
jl 0x1009c1a4
cmp dl, 0x39
jle 0x1009c1ae
cmp dl, 0x2e
je 0x1009c1ae
cmp dl, 0x2d
jne case.default.0x1009c0fc
mov eax, 6
ret
mov al, dl
or al, 0x20
cmp al, 0x61
jb 0x1009c1c0
cmp al, 0x7a
jbe 0x1009c1ae
cmp dl, 0x30
jl 0x1009c1ca
cmp dl, 0x39
jle 0x1009c1ae
cmp dl, 0x2e
je 0x1009c1ae
cmp dl, 0x2d
je 0x1009c1ae
cmp dl, 0x3a
jne case.default.0x1009c0fc
mov eax, 9
ret
cmp dl, 0x5d
jne case.0x1009c0fc.5
mov eax, 8
ret
cmp dl, 0x30
jl 0x1009c1f4
cmp dl, 0x39
jle 0x1009c20a
mov al, dl
or al, 0x20
cmp al, 0x61
jb 0x1009c200
cmp al, 0x66
jbe 0x1009c20a
cmp dl, 0x3a
je 0x1009c20a
cmp dl, 0x2e
jne case.default.0x1009c0fc
mov eax, 7
ret
sub dl, 0x30
mov eax, 0xa
cmp dl, 9
jbe 0x1009c222
mov eax, 1
ret
Function at 0x100a1530
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, ecx
push edi
mov eax, dword [esi + 8]
test eax, eax
jne 0x100a1576
mov edx, str.ERROR:
mov ecx, 0x100e9268
call fcn.10015c40
mov edx, str.Internal_error:_GetNextInstruction___called_before_Init__
mov ecx, eax
call fcn.10015c40
push eax
call fcn.1001a500
add esp, 4
cmp byte [0x100ea58c], 0
je 0x100a163a
jmp 0x100a1670
mov eax, dword [eax]
mov dword [esi + 0x10], eax
mov ax, word [esi + 0x14]
mov word [esi + 0x16], ax
mov ecx, 0x100
cmp word [esi + 0x14], cx
jne 0x100a15d1
mov ecx, dword [esi + 8]
mov eax, dword [ecx]
cmp eax, dword [esi + 0xc]
jae 0x100a164e
mov dl, byte [eax]
mov eax, dword [esi]
movzx edi, dl
cmp byte [edi + eax + 0x100], 0
je 0x100a15b5
movsx ax, dl
mov word [esi + 0x14], ax
inc dword [ecx]
mov eax, dword [esi]
mov bl, byte [edi + eax]
movzx edx, byte [edi + eax + 0x200]
mov bh, byte [edi + eax + 0x400]
test bl, bl
jne 0x100a15f3
jmp 0x100a1583
mov al, byte [esi + 0x14]
mov word [esi + 0x14], cx
movzx ecx, al
mov eax, dword [esi]
mov bl, byte [ecx + eax + 0x100]
movzx edx, byte [ecx + eax + 0x300]
mov bh, byte [ecx + eax + 0x500]
test edx, edx
jne 0x100a165b
mov edx, dword [esi + 8]
mov ecx, dword [esi + 0xc]
call fcn.100a7f50
mov ecx, dword [ebp + 8]
mov dword [ecx], eax
cmp eax, 0xfffffffe
je 0x100a1647
cmp eax, 0xffffffff
jne 0x100a1660
mov edx, str.ERROR:
mov ecx, 0x100e9268
call fcn.10015c40
mov edx, str.Instruction_size_is_not_a_valid_variable_length_integer
mov ecx, eax
call fcn.10015c40
push eax
call fcn.1001a500
add esp, 4
call fcn.10094970
mov eax, 4
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret 8
mov ecx, esi
call fcn.10094990
mov eax, 5
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret 8
mov eax, dword [ebp + 8]
mov dword [eax], edx
mov eax, dword [ebp + 0xc]
pop edi
pop esi
mov byte [eax], bh
movzx eax, bl
pop ebx
pop ecx
pop ebp
ret 8
mov ecx, 0x100e9268
call fcn.1002d2f0
push 1
call fcn.100b18e2
int3

Function at 0x100a1690
Capabilities:
Terminate process

Disassembly:
push ecx
cmp ecx, 3
ja case.default.0x100a1696
jmp dword [ecx*4 + 0x100a170c]
mov eax, str.NOOP
pop ecx
ret
mov eax, 0x101039dc
pop ecx
ret
mov eax, 0x101039e0
pop ecx
ret
mov eax, str.COPY
pop ecx
ret
push ecx
push ecx
mov edx, str.ERROR:
mov ecx, 0x100e9268
call fcn.10015c40
mov edx, str.Unexpected_instruction_type
mov ecx, eax
call fcn.10015c40
add esp, 4
mov ecx, eax
call fcn.10050e60
push eax
call fcn.1001a500
add esp, 4
cmp byte [0x100ea58c], 0
jne 0x100a16f9
mov eax, 0x100f76d8
pop ecx
ret
mov ecx, 0x100e9268
call fcn.1002d2f0
push 1
call fcn.100b18e2
mov edi, edi
popfd
push ss
or dl, byte [eax]
movsb byte es:[edi], byte [esi]
push ss
or dl, byte [eax]
stosd dword es:[edi], eax
push ss
or dl, byte [eax]
mov dl, 0x16
or dl, byte [eax]
int3
Function at 0x100a1720
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov bl, dl
mov esi, ecx
mov al, 1
push edi
mov edi, dword [ebp + 0x14]
cmp bl, 3
jbe 0x100a17a4
movzx eax, bl
mov edx, str.ERROR:
push eax
push ecx
push esi
push ecx
mov ecx, 0x100e9268
call fcn.10015c40
mov edx, str.VCDiff:_Bad_code_table__opcode
mov ecx, eax
call fcn.10015c40
add esp, 4
mov ecx, eax
call fcn.10050e60
mov edx, str._has_invalid
mov ecx, eax
call fcn.10015c40
mov edx, edi
mov ecx, eax
call fcn.10015c40
mov edx, str._instruction_type
mov ecx, eax
call fcn.10015c40
add esp, 4
mov ecx, eax
call fcn.10050e60
push eax
call fcn.1001a500
add esp, 4
cmp byte [0x100ea58c], 0
jne 0x100a1910
xor al, al
mov bh, byte [ebp + 0xc]
cmp bh, byte [ebp + 0x10]
jbe 0x100a181b
movzx eax, bh
mov edx, str.ERROR:
push eax
push ecx
push esi
push ecx
mov ecx, 0x100e9268
call fcn.10015c40
mov edx, str.VCDiff:_Bad_code_table__opcode
mov ecx, eax
call fcn.10015c40
add esp, 4
mov ecx, eax
call fcn.10050e60
mov edx, str._has_invalid
mov ecx, eax
call fcn.10015c40
mov edx, edi
mov ecx, eax
call fcn.10015c40
mov edx, str._mode
mov ecx, eax
call fcn.10015c40
add esp, 4
mov ecx, eax
call fcn.10050e60
push eax
call fcn.1001a500
add esp, 4
cmp byte [0x100ea58c], 0
jne 0x100a1921
xor al, al
test bl, bl
jne 0x100a1896
mov cl, byte [ebp + 8]
test cl, cl
je 0x100a189b
movzx eax, cl
mov edx, str.ERROR:
push eax
push ecx
push esi
push ecx
mov ecx, 0x100e9268
call fcn.10015c40
mov edx, str.VCDiff:_Bad_code_table__opcode
mov ecx, eax
call fcn.10015c40
add esp, 4
mov ecx, eax
call fcn.10050e60
mov edx, str._has
mov ecx, eax
call fcn.10015c40
mov edx, edi
mov ecx, eax
call fcn.10015c40
mov edx, str._instruction_NOOP_with_nonzero_size
mov ecx, eax
call fcn.10015c40
add esp, 4
mov ecx, eax
call fcn.10050e60
push eax
call fcn.1001a500
add esp, 4
cmp byte [0x100ea58c], bl
jne 0x100a1932
xor al, al
jmp 0x100a189b
cmp bl, 3
je 0x100a190a
test bh, bh
je 0x100a190a
movzx eax, bh
mov edx, str.ERROR:
push eax
push ecx
push esi
push ecx
mov ecx, 0x100e9268
call fcn.10015c40
mov edx, str.VCDiff:_Bad_code_table__opcode
mov ecx, eax
call fcn.10015c40
add esp, 4
mov ecx, eax
call fcn.10050e60
mov edx, str._has_non_COPY
mov ecx, eax
call fcn.10015c40
mov edx, edi
mov ecx, eax
call fcn.10015c40
mov edx, str._instruction_with_nonzero_mode
mov ecx, eax
call fcn.10015c40
add esp, 4
mov ecx, eax
call fcn.10050e60
push eax
call fcn.1001a500
add esp, 4
cmp byte [0x100ea58c], 0
jne 0x100a1943
xor al, al
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret
mov ecx, 0x100e9268
call fcn.1002d2f0
push 1
call fcn.100b18e2
mov ecx, 0x100e9268
call fcn.1002d2f0
push 1
call fcn.100b18e2
mov ecx, 0x100e9268
call fcn.1002d2f0
push 1
call fcn.100b18e2
mov ecx, 0x100e9268
call fcn.1002d2f0
push 1
call fcn.100b18e2
int3