joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1005a190
Capabilities:
Get hostname

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x20
mov dword [ebp - 0x10], 0
lea eax, [ebp - 0x10]
push eax
push 0
push 5
call sub.KERNEL32.dll_GetComputerNameExW
mov ecx, dword [ebp - 0x10]
test ecx, ecx
je 0x1005a276
xor ebx, ebx
cmp ecx, 0x40000000
setb al
jae 0x1005a2ac
mov bl, al
lea edi, [ecx + ecx]
add ebx, ebx
test edi, edi
js 0x1005a2b3
mov dword [ebp - 0x14], ecx
je 0x1005a264
mov esi, dword [0x1035648c]
mov eax, dword [esi]
test eax, eax
jne 0x1005a1f8
call sub.KERNEL32.dll_GetProcessHeap
test eax, eax
je 0x1005a26a
mov dword [esi], eax
push edi
push 8
push eax
call sub.KERNEL32.dll_HeapAlloc
mov esi, eax
test esi, esi
je 0x1005a26a
lea eax, [ebp - 0x10]
push eax
push esi
push 5
call sub.KERNEL32.dll_GetComputerNameExW
test eax, eax
je 0x1005a2ba
mov eax, dword [ebp - 0x14]
dec eax
cmp dword [ebp - 0x10], eax
jne 0x1005a2c8
mov ebx, dword [ebp + 8]
xor eax, eax
nop dword [eax]
cmp word [esi + eax*2], 0
je 0x1005a240
inc eax
add edi, 0xfffffffe
jne 0x1005a230
mov eax, dword [ebp - 0x14]
push eax
push esi
push ebx
call fcn.1014d9e0
add esp, 0xc
mov eax, dword [0x1035648c]
push esi
push 0
push dword [eax]
call sub.KERNEL32.dll_HeapFree
mov eax, ebx
add esp, 0x20
pop esi
pop edi
pop ebx
pop ebp
ret
mov esi, ebx
test esi, esi
jne 0x1005a207
push edi
push ebx
call fcn.1001a7e0
add esp, 8
ud2
mov dword [ebp - 0x2c], str.GetComputerNameExW_did_not_provide_buffer_size
mov dword [ebp - 0x28], 1
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x24], str._usr_local_cargo_registry_src_index.crates.io_6f17d22bba15001f_gethostname_0.4.3_src_lib.rs
mov dword [ebp - 0x20], 0
lea eax, [ebp - 0x2c]
push 0x102436c8
push eax
call fcn.10026810
add esp, 8
ud2
call fcn.1001a7a0
ud2
call fcn.1001a7a0
ud2
mov dword [ebp - 0x2c], 0x102435cc
mov eax, 0x10243630
jmp 0x1005a2d4
mov eax, 0x10243680
mov dword [ebp - 0x2c], 0x10243678
lea ecx, [ebp - 0x2c]
mov dword [ecx + 4], 1
mov dword [ecx + 0x10], 0
mov dword [ecx + 8], str._usr_local_cargo_registry_src_index.crates.io_6f17d22bba15001f_gethostname_0.4.3_src_lib.rs
mov dword [ecx + 0xc], 0
push eax
push ecx
call fcn.10026810
add esp, 8
ud2

Function at 0x1005d340
Capabilities:
Get local ipv4 addresses
Get mac address on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x370
call fcn.1005d354
Function at 0x1007fe30
Capabilities:
Generate random numbers via rtlgenrandom
Generate random numbers via winapi

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x28
mov edi, dword [ebp + 0x10]
test edi, edi
je 0x1007fe62
mov ebx, dword [ebp + 0xc]
push 2
push edi
push ebx
push 0
call sub.bcrypt.dll_BCryptGenRandom
cmp eax, 0xc0000000
jb 0x1007fe62
mov esi, eax
push edi
push ebx
call sub.advapi32.dll_SystemFunction036
test al, al
je 0x1007fe6a
add esp, 0x28
pop esi
pop edi
pop ebx
pop ebp
ret
mov eax, dword [0x103564a0]
movzx eax, byte [eax]
push 4
push 4
call fcn.10001510
add esp, 8
test eax, eax
jne 0x1007fe90
push 4
push 4
call fcn.1001a7e0
add esp, 8
ud2
add esi, 0x80000000
lea edi, [ebp - 0x14]
mov dword [eax], esi
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x1c]
mov dword [ebp - 0x1c], edi
mov dword [ebp - 0x34], 0x10246d80
mov dword [ebp - 0x30], 1
mov dword [ebp - 0x24], 0
mov dword [ebp - 0x10], 0x10246e00
mov dword [ebp - 0x18], 0x1007fd80
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x28], 1
lea eax, [ebp - 0x34]
push 0x10246de0
push eax
call fcn.10026810
add esp, 8
ud2
Function at 0x10088600
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
mov eax, dword [0x101d4048]
test eax, eax
je 0x10088629
dec eax
push eax
call sub.KERNEL32.dll_TlsGetValue
cmp eax, 1
jbe 0x10088641
cmp dword [eax + 4], 0
je 0x10088641
add eax, 8
jmp 0x10088723
push 0x101d4048
call fcn.10160f60
add esp, 4
push eax
call sub.KERNEL32.dll_TlsGetValue
cmp eax, 1
ja 0x1008861b
mov eax, dword [0x101d4048]
test eax, eax
je 0x10088705
dec eax
push eax
call sub.KERNEL32.dll_TlsGetValue
cmp eax, 1
je 0x10088721
mov esi, eax
test eax, eax
jne 0x100886b9
mov eax, dword [0x103564a0]
mov esi, dword [0x1035648c]
movzx eax, byte [eax]
mov eax, dword [esi]
test eax, eax
jne 0x10088687
call sub.KERNEL32.dll_GetProcessHeap
test eax, eax
je 0x1008873a
mov dword [esi], eax
push 0x14
push 0
push eax
call sub.KERNEL32.dll_HeapAlloc
test eax, eax
je 0x1008873a
mov dword [eax], 0x101d4048
mov dword [eax + 4], 0
mov esi, eax
mov eax, dword [0x101d4048]
test eax, eax
je 0x10088728
dec eax
push esi
push eax
call sub.KERNEL32.dll_TlsSetValue
mov eax, dword [ebp + 8]
test eax, eax
je 0x100886e1
mov ecx, dword [eax]
mov dword [eax], 0
cmp ecx, 1
jne 0x100886e1
mov edi, dword [eax + 4]
movzx ebx, byte [eax + 8]
movzx edx, byte [eax + 9]
movzx ecx, word [eax + 0xa]
mov eax, dword [eax + 0xc]
jmp 0x100886e9
xor eax, eax
xor edx, edx
xor ebx, ebx
xor edi, edi
mov dword [esi + 4], 1
mov dword [esi + 8], edi
mov byte [esi + 0xc], bl
mov byte [esi + 0xd], dl
mov word [esi + 0xe], cx
mov dword [esi + 0x10], eax
lea eax, [esi + 8]
jmp 0x10088723
push 0x101d4048
call fcn.10160f60
add esp, 4
push eax
call sub.KERNEL32.dll_TlsGetValue
cmp eax, 1
jne 0x1008865e
xor eax, eax
pop esi
pop edi
pop ebx
pop ebp
ret
push 0x101d4048
call fcn.10160f60
add esp, 4
jmp 0x100886b2
push 0x14
push 4
call fcn.1001a7e0
add esp, 8
ud2
Function at 0x10088750
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push esi
mov eax, dword [0x101d4058]
test eax, eax
je 0x10088775
dec eax
push eax
call sub.KERNEL32.dll_TlsGetValue
cmp eax, 1
jbe 0x1008878d
cmp dword [eax + 4], 0
je 0x1008878d
add eax, 8
pop esi
pop ebp
ret
push 0x101d4058
call fcn.10160f60
add esp, 4
push eax
call sub.KERNEL32.dll_TlsGetValue
cmp eax, 1
ja 0x10088769
mov eax, dword [0x101d4058]
test eax, eax
je 0x1008882b
dec eax
push eax
call sub.KERNEL32.dll_TlsGetValue
cmp eax, 1
je 0x10088847
mov esi, eax
test eax, eax
jne 0x10088801
mov eax, dword [0x103564a0]
mov esi, dword [0x1035648c]
movzx eax, byte [eax]
mov eax, dword [esi]
test eax, eax
jne 0x100887d3
call sub.KERNEL32.dll_GetProcessHeap
test eax, eax
je 0x1008885b
mov dword [esi], eax
push 0xc
push 0
push eax
call sub.KERNEL32.dll_HeapAlloc
test eax, eax
je 0x1008885b
mov dword [eax], 0x101d4058
mov dword [eax + 4], 0
mov esi, eax
mov eax, dword [0x101d4058]
test eax, eax
je 0x1008884c
dec eax
push esi
push eax
call sub.KERNEL32.dll_TlsSetValue
mov eax, dword [ebp + 8]
test eax, eax
je 0x10088819
mov ecx, dword [eax]
mov dword [eax], 0
test ecx, ecx
je 0x1008881b
mov ecx, dword [eax + 4]
jmp 0x1008881b
xor ecx, ecx
mov dword [esi + 4], 1
lea eax, [esi + 8]
mov dword [esi + 8], ecx
pop esi
pop ebp
ret
push 0x101d4058
call fcn.10160f60
add esp, 4
push eax
call sub.KERNEL32.dll_TlsGetValue
cmp eax, 1
jne 0x100887aa
xor eax, eax
pop esi
pop ebp
ret
push 0x101d4058
call fcn.10160f60
add esp, 4
jmp 0x100887fa
push 0xc
push 4
call fcn.1001a7e0
add esp, 8
ud2
Function at 0x1009e0e0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x580
call fcn.1009e0f4
Function at 0x100a2070
Capabilities:
Inspect section memory permissions
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0xc8
mov eax, dword [ebp + 8]
mov esi, dword [eax + 4]
mov edi, dword [eax]
mov edx, dword [esi + 0xa4]
movzx ecx, byte [edi + 0x27c]
mov eax, dword [esi + 0x94]
mov dword [esp + 8], esi
mov dword [esp + 0x34], edx
mov edx, dword [esi + 0xa8]
mov dword [esp + 0x6c], edx
mov edx, dword [esi + 0xac]
mov dword [esi + 0xa4], 1
mov dword [esi + 0xa8], 0
mov dword [esi + 0xac], 0
mov dword [esp + 0x9c], edx
mov edx, dword [ebp + 0xc]
mov ebx, edx
mov dword [esp + 0x78], edx
and ebx, 0x7ffffff
mov edx, ebx
shr edx, cl
call fcn.100a20ef
Function at 0x100c5ac0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x550
mov ecx, dword [ebp + 0xc]
call fcn.100c5ad7
Function at 0x100deff0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push esi
sub esp, 0x18
mov eax, dword [0x101d406c]
test eax, eax
je 0x100df01b
dec eax
push eax
call sub.KERNEL32.dll_TlsGetValue
cmp eax, 1
jbe 0x100df033
cmp dword [eax + 4], 0
je 0x100df033
add eax, 8
add esp, 0x18
pop esi
pop ebp
ret
push 0x101d406c
call fcn.10160f60
add esp, 4
push eax
call sub.KERNEL32.dll_TlsGetValue
cmp eax, 1
ja 0x100df00c
mov eax, dword [0x101d406c]
test eax, eax
je 0x100df0e4
dec eax
push eax
call sub.KERNEL32.dll_TlsGetValue
cmp eax, 1
je 0x100df100
mov esi, eax
test eax, eax
jne 0x100df0ab
mov eax, dword [0x103564a0]
mov esi, dword [0x1035648c]
movzx eax, byte [eax]
mov eax, dword [esi]
test eax, eax
jne 0x100df079
call sub.KERNEL32.dll_GetProcessHeap
test eax, eax
je 0x100df117
mov dword [esi], eax
push 0xc
push 0
push eax
call sub.KERNEL32.dll_HeapAlloc
test eax, eax
je 0x100df117
mov dword [eax], 0x101d406c
mov dword [eax + 4], 0
mov esi, eax
mov eax, dword [0x101d406c]
test eax, eax
je 0x100df108
dec eax
push esi
push eax
call sub.KERNEL32.dll_TlsSetValue
mov eax, dword [ebp + 8]
test eax, eax
je 0x100df0c0
mov ecx, dword [eax + 4]
cmp dword [eax], 0
mov dword [eax], 0
jne 0x100df0d1
mov ecx, 1
lock xadd dword [0x101d4068], ecx
test ecx, ecx
je 0x100df125
mov dword [esi + 4], 1
lea eax, [esi + 8]
mov dword [esi + 8], ecx
add esp, 0x18
pop esi
pop ebp
ret
push 0x101d406c
call fcn.10160f60
add esp, 4
push eax
call sub.KERNEL32.dll_TlsGetValue
cmp eax, 1
jne 0x100df050
xor eax, eax
add esp, 0x18
pop esi
pop ebp
ret
push 0x101d406c
call fcn.10160f60
add esp, 4
jmp 0x100df0a4
push 0xc
push 4
call fcn.1001a7e0
add esp, 8
ud2
mov dword [ebp - 0x1c], 0x1024d1b8
mov dword [ebp - 0x18], 1
mov dword [ebp - 0xc], 0
mov dword [ebp - 0x14], 0x102481a0
mov dword [ebp - 0x10], 0
lea eax, [ebp - 0x1c]
push 0x1024d1c0
push eax
call fcn.10026810
add esp, 8
ud2
Function at 0x100fc000
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
push eax
mov edx, dword [ebp + 0xc]
mov eax, dword [ebp + 8]
mov esi, dword [edx]
test esi, esi
je 0x100fc059
cmp dword [eax], 0
jne 0x100fc092
mov ebx, dword [edx + 8]
xor eax, eax
mov dword [edx + 8], 0
test ebx, ebx
je 0x100fc092
mov edi, dword [0x1035648c]
add esi, 4
jmp 0x100fc046
add esi, 0x10
dec ebx
je 0x100fc08d
cmp dword [esi], 0
je 0x100fc040
push dword [esi - 4]
push 0
push dword [edi]
call sub.KERNEL32.dll_HeapFree
jmp 0x100fc040
mov ebx, dword [eax]
test ebx, ebx
je 0x100fc090
mov esi, dword [eax + 8]
test esi, esi
je 0x100fc090
mov ecx, dword [ebx + 8]
cmp esi, 1
jne 0x100fc09a
test ecx, ecx
je 0x100fc208
add ebx, 0xc
shl esi, 4
nop dword [eax]
mov byte [ebx], 0
add ebx, 0x10
add esi, 0xfffffff0
jne 0x100fc080
jmp 0x100fc090
mov edx, dword [ebp + 0xc]
xor eax, eax
add esp, 4
pop esi
pop edi
pop ebx
pop ebp
ret
lea edx, [esi + 0xfffffff]
xor edi, edi
mov eax, edx
and eax, 0xfffffff
cmp eax, 8
jb 0x100fc1e3
movd xmm0, ecx
and edx, 7
mov edi, eax
pshufd xmm1, xmm0, 0
movdqa xmm0, xmmword [0x1024d580]
sub edi, edx
mov dword [ebp - 0x10], edx
lea edx, [ebx + 0x88]
mov ecx, edi
movdqa xmm2, xmm1
nop dword [eax]
movd xmm3, dword [edx - 0x40]
movd xmm5, dword [edx - 0x50]
movd xmm4, dword [edx - 0x70]
movd xmm6, dword [edx - 0x20]
movdqa xmm7, xmm1
pxor xmm1, xmm0
punpckldq xmm5, xmm3
movd xmm3, dword [edx - 0x60]
punpckldq xmm4, xmm3
movd xmm3, dword [edx]
punpcklqdq xmm4, xmm5
movd xmm5, dword [edx - 0x10]
punpckldq xmm5, xmm3
movd xmm3, dword [edx - 0x30]
sub edx, 0xffffff80
add ecx, 0xfffffff8
punpckldq xmm3, xmm6
movdqa xmm6, xmm4
pxor xmm6, xmm0
punpcklqdq xmm3, xmm5
pcmpgtd xmm6, xmm1
pand xmm7, xmm6
pandn xmm6, xmm4
movdqa xmm4, xmm2
pxor xmm2, xmm0
movdqa xmm1, xmm6
movdqa xmm6, xmm3
pxor xmm6, xmm0
por xmm1, xmm7
pcmpgtd xmm6, xmm2
pand xmm4, xmm6
pandn xmm6, xmm3
movdqa xmm2, xmm6
por xmm2, xmm4
jne 0x100fc0e0
movdqa xmm4, xmm1
movdqa xmm3, xmm2
cmp dword [ebp - 0x10], 0
pxor xmm4, xmm0
pxor xmm3, xmm0
pcmpgtd xmm3, xmm4
pand xmm1, xmm3
pandn xmm3, xmm2
por xmm3, xmm1
pshufd xmm2, xmm3, 0xee
movdqa xmm4, xmm3
movdqa xmm1, xmm2
pxor xmm4, xmm0
pxor xmm1, xmm0
pcmpgtd xmm1, xmm4
pand xmm3, xmm1
pandn xmm1, xmm2
por xmm1, xmm3
movdqa xmm3, xmm1
pshufd xmm2, xmm1, 0x55
pxor xmm3, xmm0
pxor xmm0, xmm2
pcmpgtd xmm0, xmm3
pand xmm1, xmm0
pandn xmm0, xmm2
por xmm0, xmm1
movd ecx, xmm0
je 0x100fc1fd
sub eax, edi
shl edi, 4
lea edx, [edi + ebx + 0x18]
nop dword [eax]
mov edi, dword [edx]
cmp ecx, edi
cmovae ecx, edi
add edx, 0x10
dec eax
jne 0x100fc1f0
mov edx, dword [ebp + 0xc]
test ecx, ecx
jne 0x100fc076
lea edi, [ebx + 4]
jmp 0x100fc216
add edi, 0x10
dec esi
je 0x100fc22e
cmp dword [edi], 0
je 0x100fc210
push dword [edi - 4]
push 0
mov eax, dword [0x1035648c]
push dword [eax]
call sub.KERNEL32.dll_HeapFree
jmp 0x100fc210
mov esi, dword [ebp + 8]
cmp dword [esi + 4], 0
je 0x100fc246
push ebx
push 0
mov eax, dword [0x1035648c]
push dword [eax]
call sub.KERNEL32.dll_HeapFree
mov edx, dword [ebp + 0xc]
xor eax, eax
mov dword [esi], 0
jmp 0x100fc092
Function at 0x1010c320
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x14
mov esi, dword [ebp + 8]
mov ebx, ecx
test esi, esi
je 0x1010c455
js 0x1010c4a3
mov eax, dword [0x103564a0]
mov edi, edx
lea ecx, [esi*8]
movzx eax, byte [eax]
mov eax, dword [0x1035648c]
mov eax, dword [eax]
test eax, eax
jne 0x1010c371
mov esi, ecx
call sub.KERNEL32.dll_GetProcessHeap
test eax, eax
je 0x1010c48c
mov ecx, dword [0x1035648c]
mov dword [ecx], eax
mov ecx, esi
mov esi, ecx
push ecx
push 0
push eax
call sub.KERNEL32.dll_HeapAlloc
test eax, eax
je 0x1010c48c
mov esi, dword [ebp + 8]
xor ecx, ecx
cmp esi, 0x10
jb 0x1010c42b
lea edx, [eax + esi*8 - 8]
cmp edx, eax
jb 0x1010c42b
lea edx, [eax + esi*8 - 4]
mov esi, eax
add esi, 4
cmp edx, esi
jb 0x1010c42b
mov esi, dword [ebp + 8]
lea edx, [esi - 1]
cmp edx, 0x1fffffff
ja 0x1010c42b
movdqa xmm0, xmmword [0x1024d740]
mov ecx, esi
xor edx, edx
and ecx, 0xfffffffe
nop dword [eax]
movdqu xmm1, xmmword [edi + edx*8]
pshufd xmm3, xmm1, 0xed
pshufd xmm2, xmm1, 0xe8
movdqa xmm5, xmm3
movdqa xmm1, xmm2
movdqa xmm6, xmm2
pxor xmm5, xmm0
pxor xmm1, xmm0
movdqa xmm4, xmm5
pcmpgtd xmm4, xmm1
pcmpgtd xmm1, xmm5
pand xmm6, xmm4
pandn xmm4, xmm3
pand xmm2, xmm1
pandn xmm1, xmm3
por xmm4, xmm6
por xmm1, xmm2
punpckldq xmm4, xmm1
movdqu xmmword [eax + edx*8], xmm4
add edx, 2
cmp ecx, edx
jne 0x1010c3d0
cmp ecx, esi
je 0x1010c45a
mov dword [ebp - 0x20], ebx
nop
mov esi, dword [edi + ecx*8 + 4]
mov edx, dword [edi + ecx*8]
cmp edx, esi
mov ebx, esi
cmovb ebx, edx
cmova esi, edx
mov dword [eax + ecx*8], ebx
mov dword [eax + ecx*8 + 4], esi
mov esi, dword [ebp + 8]
inc ecx
cmp esi, ecx
jne 0x1010c430
mov ebx, dword [ebp - 0x20]
jmp 0x1010c45a
mov eax, 4
test esi, esi
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x18], esi
mov dword [ebp - 0x14], esi
sete byte [ebp - 0x10]
lea ecx, [ebp - 0x1c]
call fcn.100f8e20
movsd xmm0, qword [ebp - 0x1c]
movsd xmm1, qword [ebp - 0x14]
movsd qword [ebx + 8], xmm1
movsd qword [ebx], xmm0
add esp, 0x14
pop esi
pop edi
pop ebx
pop ebp
ret
mov eax, dword [ebp + 8]
not eax
shr eax, 0x1a
and eax, 4
push esi
push eax
call fcn.1001a7e0
add esp, 8
ud2
call fcn.1001a7a0
ud2
Function at 0x101391b0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x58
mov esi, dword [edx + 8]
mov dword [esp], ecx
mov eax, dword [edx]
mov ecx, dword [edx + 4]
cmp dword [esi], 0
je 0x101391d4
mov edi, dword [esi + 0xc]
mov esi, dword [esi + 4]
jmp 0x101391e3
mov edi, dword [esi + 4]
cmp edi, 6
jae 0x1013934f
add esi, 8
test edi, edi
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], ecx
mov dword [esp + 0x14], esi
mov dword [esp + 0x18], edi
mov dword [esp + 0x1c], edx
je 0x101392b8
dec edi
add esi, 0x10
nop word cs:[eax + eax]
nop dword [eax]
movsd xmm0, qword [esi - 0x10]
movsd xmm1, qword [esi - 8]
mov eax, dword [esp + 0x1c]
lea ecx, [esp + 0x20]
lea ebx, [esp + 0x38]
lea edx, [esp + 0xc]
movsd qword [esp + 0x40], xmm1
movsd qword [esp + 0x38], xmm0
mov eax, dword [eax + 0xc]
push ebx
push dword [eax + 0x20]
call fcn.101357b0
add esp, 8
mov eax, dword [esp + 0x20]
mov ecx, dword [esp + 0x24]
mov edx, eax
xor edx, 0x2e
or edx, ecx
je 0x101392de
lea ebx, [esp + 0x32]
mov edx, dword [esp + 0x28]
mov dword [esp + 0x14], esi
mov dword [esp + 0x18], edi
mov ebx, dword [ebx]
mov dword [esp + 4], ebx
lea ebx, [esp + 0x32]
movzx ebx, word [ebx + 4]
mov word [esp + 8], bx
movzx ebx, word [esp + 0x30]
cmp bx, word [ebp + 8]
mov ebx, dword [esp + 0x2c]
je 0x10139321
add esi, 0x10
add edi, 0xffffffff
jb 0x10139210
mov eax, dword [esp + 0x1c]
cmp dword [eax + 0x14], 0
jne 0x101392cc
mov ecx, dword [esp + 0xc]
sub ecx, dword [eax]
mov dword [eax + 0x14], 1
mov dword [eax + 0x18], ecx
jmp 0x101392cc
cmp dword [edx + 0x14], 0
jne 0x101392cc
mov dword [edx + 0x14], 1
mov dword [edx + 0x18], 0
mov eax, dword [esp]
mov dword [eax + 4], 0
mov dword [eax], 0x2e
jmp 0x10139347
lea edx, [esp + 0x32]
mov ecx, dword [esp]
mov edi, dword [esp + 0x2c]
mov esi, dword [edx]
movzx eax, word [edx + 4]
movzx edx, word [esp + 0x30]
mov dword [esp + 4], esi
mov dword [ecx + 0x12], esi
mov esi, dword [esp + 0x28]
mov word [ecx + 0x16], ax
mov word [esp + 8], ax
mov dword [ecx + 0xc], edi
mov dword [ecx + 8], esi
mov word [ecx + 0x10], dx
mov dword [ecx + 4], 0
mov dword [ecx], 0x2f
jmp 0x10139347
movzx esi, word [esp + 8]
mov edi, dword [esp]
mov word [edi + 0x16], si
mov esi, dword [esp + 4]
mov dword [edi + 0x12], esi
mov dword [edi + 4], ecx
movzx ecx, word [ebp + 8]
mov dword [edi], eax
mov dword [edi + 8], edx
mov dword [edi + 0xc], ebx
mov word [edi + 0x10], cx
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
push 0x10243db4
push 5
push edi
call fcn.1002a190
add esp, 0xc
ud2

Function at 0x10139370
Capabilities:
Encrypt data using speck
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x300
mov edi, dword [ebp + 8]
call fcn.10139387
Function at 0x10140060
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x200
mov eax, dword [ebp + 8]
call fcn.10140077
Function at 0x10147c00
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x30
mov esi, dword [ebp + 0x20]
test esi, esi
je 0x10147d24
mov dword [esp], ecx
mov edi, dword [ebp + 0x1c]
mov ebx, dword [ebp + 0x18]
movzx ecx, byte [ebp + 0x10]
mov eax, dword [ebp + 0xc]
mov ch, dl
and ch, 0x3f
cmp ch, 0xd
je 0x10147d45
and edx, 0x3f
cmp edx, 0xe
je 0x10147d54
cmp edx, 0xf
jne 0x10147d33
mov eax, dword [edi + 0x68]
test eax, eax
je 0x10147d33
mov ecx, dword [ebx + 0x18]
test ecx, ecx
je 0x10147db6
mov edx, dword [ebx + 0x14]
mov dword [esp + 0x28], ecx
mov dword [esp + 0xc], ecx
xor edi, edi
mov dword [esp + 0x24], eax
mov dword [esp + 8], edx
mov edx, ecx
mov ecx, dword [esp + 8]
jmp 0x10147c88
mov dword [esp + 0xc], edx
sub edx, edi
jbe 0x10147cc7
mov esi, dword [ebp + 0xc]
shr edx, 1
xor ebx, ebx
add edx, edi
imul eax, edx, 0x110
cmp dword [ecx + eax + 0x108], esi
mov eax, 0xff
setne bl
cmovb ebx, eax
cmp bl, 1
je 0x10147c80
movzx eax, bl
cmp eax, 0xff
jne 0x10147db6
inc edx
mov edi, edx
mov edx, dword [esp + 0xc]
sub edx, edi
ja 0x10147c88
test edi, edi
je 0x10147db6
mov eax, dword [esp + 0x28]
dec edi
cmp edi, eax
jae 0x10147e2b
mov edx, dword [esp + 8]
imul ecx, edi, 0x110
mov eax, dword [ebp + 0xc]
mov esi, dword [ebp + 0x20]
mov ebx, dword [ebp + 0x18]
cmp dword [edx + ecx + 0xa8], 0
jne 0x10147d09
add edx, ecx
mov ecx, dword [edx + 0xac]
cmp ecx, eax
jbe 0x10147dd8
mov edx, dword [esp]
movzx eax, byte [esp + 0x12]
movzx esi, word [esp + 0x10]
mov byte [esp + 6], al
mov word [esp + 4], si
jmp 0x10147db9
mov dword [ecx + 4], 0
mov byte [ecx], 0x4b
jmp 0x10147dd0
mov eax, dword [esp]
mov dword [eax + 4], 0
mov byte [eax], 0x4b
jmp 0x10147dd0
movzx edx, cl
mov ecx, dword [esp]
push esi
push edi
push ebx
push eax
push dword [ebp + 0x14]
jmp 0x10147d82
mov edx, ebx
movzx ebx, cl
lea ecx, [esp + 0x10]
push ebx
push eax
call fcn.1013f9e0
add esp, 8
movzx eax, byte [esp + 0x10]
cmp al, 0x4b
jne 0x10147d8c
mov ecx, dword [esp]
mov edx, ebx
push esi
push edi
push dword [ebp + 0x18]
push dword [esp + 0x24]
push dword [esp + 0x24]
call fcn.101464f0
add esp, 0x14
jmp 0x10147dd0
movzx ecx, byte [esp + 0x13]
mov edx, dword [esp]
movzx edi, word [esp + 0x11]
mov esi, dword [esp + 0x14]
movsd xmm0, qword [esp + 0x18]
mov byte [edx + 3], cl
mov word [edx + 1], di
mov byte [edx], al
mov dword [edx + 4], esi
movsd qword [edx + 8], xmm0
jmp 0x10147dd0
mov edx, dword [esp]
movzx eax, byte [esp + 6]
movzx esi, word [esp + 4]
mov byte [edx + 3], al
mov word [edx + 1], si
mov byte [edx], 0x37
mov dword [edx + 4], ecx
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
sub eax, ecx
xor ecx, ecx
cmp byte [edx + 0xc9], 8
mov dword [esp + 8], edx
mov edi, eax
sete cl
shl ecx, 3
add ecx, dword [edx + 0xcc]
mov edx, dword [edx + 0xc4]
sub ecx, edx
add ecx, 4
sub edi, ecx
jb 0x10147e24
cmp edi, edx
jae 0x10147e24
mov edi, dword [esp + 0x24]
mov ecx, dword [esp]
mov edx, 1
add edi, 8
push esi
push edi
push ebx
push eax
push dword [esp + 0x18]
jmp 0x10147d82
mov ecx, eax
jmp 0x10147d09
push 0x1034a5b4
push eax
push edi
call fcn.10026930
add esp, 0xc
ud2
Function at 0x10148b40
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x42c
mov ebx, 0x200
xor edi, edi
mov dword [ebp - 0x28], 2
mov dword [ebp - 0x24], 0
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x14], 2
mov dword [ebp - 0x1c], 0
cmp ebx, 0x201
jae 0x10148bb0
jmp 0x10148b91
mov edi, dword [ebp - 0x10]
jbe 0x10148c39
cmp ebx, 0x201
jae 0x10148bb0
mov dword [ebp - 0x10], edi
mov dword [ebp - 0x18], 0x200
lea esi, [ebp - 0x438]
mov edi, ebx
jmp 0x10148be1
mov eax, dword [ebp - 0x1c]
sub ebx, edi
sub eax, edi
cmp eax, ebx
jae 0x10148bd2
mov edx, edi
lea ecx, [ebp - 0x28]
push ebx
call fcn.10134130
add esp, 4
mov eax, dword [ebp - 0x28]
mov edi, dword [ebp - 0x24]
mov dword [ebp - 0x14], eax
mov esi, dword [ebp - 0x14]
mov dword [ebp - 0x20], edi
mov dword [ebp - 0x1c], edi
mov dword [ebp - 0x18], edi
mov dword [ebp - 0x10], edi
push 0
call sub.KERNEL32.dll_SetLastError
push esi
push edi
call sub.KERNEL32.dll_GetCurrentDirectoryW
mov ebx, eax
test eax, eax
jne 0x10148c02
call sub.KERNEL32.dll_GetLastError
test eax, eax
jne 0x10148c86
cmp ebx, edi
jne 0x10148b80
call sub.KERNEL32.dll_GetLastError
cmp eax, 0x7a
jne 0x10148ca1
lea ebx, [edi + edi]
test edi, edi
mov edi, dword [ebp - 0x10]
mov eax, 0xffffffff
cmovs ebx, eax
cmp ebx, 0x201
jb 0x10148b91
jmp 0x10148bb0
mov eax, dword [ebp - 0x18]
cmp ebx, eax
ja 0x10148cb7
lea eax, [ebp - 0x38]
push ebx
push esi
push eax
call fcn.1014d9e0
add esp, 0xc
movsd xmm0, qword [ebp - 0x38]
mov eax, dword [ebp + 8]
movsd xmm1, qword [ebp - 0x30]
movsd qword [eax + 8], xmm1
movsd qword [eax], xmm0
test edi, edi
je 0x10148c78
push dword [ebp - 0x14]
push 0
push dword [0x1038a110]
call sub.KERNEL32.dll_HeapFree
mov eax, dword [ebp + 8]
add esp, 0x42c
pop esi
pop edi
pop ebx
pop ebp
ret
call sub.KERNEL32.dll_GetLastError
mov ecx, dword [ebp + 8]
mov edi, dword [ebp - 0x10]
mov byte [ecx], 0
mov dword [ecx + 4], eax
mov byte [ecx + 0xc], 2
test edi, edi
jne 0x10148c68
jmp 0x10148c78
push 0x1034c858
push 0x28
push str.internal_error:_entered_unreachable_code
call fcn.10026890
add esp, 0xc
jmp 0x10148cc6
push 0x1034c848
push eax
push ebx
call fcn.1002a190
add esp, 0xc
ud2