joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1009a190
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ecx
mov eax, dword [0x10213d84]
lea edx, [esp]
push ebx
push ebp
push esi
push edi
mov edi, dword [eax + 0x1bac]
mov esi, 4
add edi, 0xe4
mov dword [esp + 0x10], ecx
mov ebp, dword [edi]
mov ebx, dword [edi + 8]
mov ebx, dword [ebx + ebp*4 - 4]
not ebx
nop dword [eax]
movzx eax, byte [edx]
lea edx, [edx + 1]
movzx ecx, bl
xor ecx, eax
shr ebx, 8
xor ebx, dword [ecx*4 + 0x101d9180]
sub esi, 1
jne 0x1009a1c0
mov esi, dword [edi + 4]
not ebx
cmp ebp, esi
jne 0x1009a207
lea ecx, [ebp + 1]
test esi, esi
je 0x1009a1f5
mov eax, esi
cdq
sub eax, edx
sar eax, 1
add eax, esi
jmp 0x1009a1fa
mov eax, 8
cmp eax, ecx
cmovg ecx, eax
push ecx
mov ecx, edi
call fcn.100a0fc0
mov ecx, dword [edi]
mov eax, dword [edi + 8]
mov dword [eax + ecx*4], ebx
inc dword [edi]
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
Function at 0x1009fd10
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push ecx
push ebx
push esi
push edi
mov edi, ecx
mov ebx, edx
cmp dword [edi + 0x2f6c], 0
lea esi, [edi + 0x2f70]
je 0x1009fd92
mov ecx, dword [esi + 4]
test ecx, ecx
jns 0x1009fd4c
mov eax, ecx
cdq
sub eax, edx
sar eax, 1
add eax, ecx
xor ecx, ecx
test eax, eax
cmovg ecx, eax
push ecx
mov ecx, esi
call fcn.100a1260
push dword [ebp + 8]
mov ecx, esi
mov dword [esi], 0
push ebx
call fcn.1008e130
mov edx, dword [esi]
mov ecx, 0x10213c76
push dword [edi + 0x2f6c]
lea eax, [edx - 1]
neg edx
sbb edx, edx
and edx, eax
mov eax, dword [edi + 0x2f78]
test eax, eax
push edx
cmovne ecx, eax
push 1
push ecx
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
add esp, 0x10
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push dword [ebp + 8]
mov ecx, esi
push ebx
call fcn.1008e130
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x100a2620
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push esi
mov esi, ecx
push edi
mov edi, dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov ecx, dword [esi + 8]
test ecx, ecx
je 0x100a265a
mov eax, dword [0x10213d84]
mov dword [esi + 4], 0
mov dword [esi], 0
test eax, eax
je 0x100a264d
dec dword [eax + 0x370]
push ecx
call edi
add esp, 4
mov dword [esi + 8], 0
mov ecx, dword [esi + 0x14]
test ecx, ecx
je 0x100a268b
mov eax, dword [0x10213d84]
mov dword [esi + 0x10], 0
mov dword [esi + 0xc], 0
test eax, eax
je 0x100a267e
dec dword [eax + 0x370]
push ecx
call edi
add esp, 4
mov dword [esi + 0x14], 0
mov ecx, dword [esi + 0x20]
test ecx, ecx
je 0x100a26bc
mov eax, dword [0x10213d84]
mov dword [esi + 0x1c], 0
mov dword [esi + 0x18], 0
test eax, eax
je 0x100a26af
dec dword [eax + 0x370]
push ecx
call edi
add esp, 4
mov dword [esi + 0x20], 0
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x34], 0
mov dword [esi + 0x38], 0
mov ecx, dword [esi + 0x44]
test ecx, ecx
je 0x100a2709
mov eax, dword [0x10213d84]
mov dword [esi + 0x40], 0
mov dword [esi + 0x3c], 0
test eax, eax
je 0x100a26fc
dec dword [eax + 0x370]
push ecx
call edi
add esp, 4
mov dword [esi + 0x44], 0
mov ecx, dword [esi + 0x50]
test ecx, ecx
je 0x100a273a
mov eax, dword [0x10213d84]
mov dword [esi + 0x4c], 0
mov dword [esi + 0x48], 0
test eax, eax
je 0x100a272d
dec dword [eax + 0x370]
push ecx
call edi
add esp, 4
mov dword [esi + 0x50], 0
mov ecx, dword [esi + 0x5c]
test ecx, ecx
je 0x100a276b
mov eax, dword [0x10213d84]
mov dword [esi + 0x58], 0
mov dword [esi + 0x54], 0
test eax, eax
je 0x100a275e
dec dword [eax + 0x370]
push ecx
call edi
add esp, 4
mov dword [esi + 0x5c], 0
pop edi
lea ecx, [esi + 0x78]
pop esi
jmp fcn.100a4fa0
Function at 0x100a59c0
Capabilities:
Enumerate pe sections

Disassembly:
sub esp, 0x10c
push ebx
push ebp
push esi
mov esi, dword [esp + 0x11c]
push edi
movss dword [esp + 0x10], xmm3
mov dword [esp + 0x14], ecx
movzx ebx, byte [esi + 8]
movzx eax, byte [esi + 9]
shl ebx, 8
add ebx, eax
movzx eax, byte [esi + 0xa]
shl ebx, 8
add ebx, eax
movzx eax, byte [esi + 0xb]
shl ebx, 8
add ebx, eax
mov eax, dword [0x10213d84]
test eax, eax
je 0x100a5a09
inc dword [eax + 0x370]
push ebx
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
movzx edx, byte [esi]
add esp, 4
movzx ecx, byte [esi + 1]
mov ebp, eax
shl edx, 8
add edx, ecx
movzx ecx, byte [esi + 2]
shl edx, 8
add edx, ecx
movzx ecx, byte [esi + 3]
shl edx, 8
add edx, ecx
cmp edx, 0x57bc0000
jne 0x100a5ab8
movzx ecx, byte [esi + 4]
movzx eax, byte [esi + 5]
shl ecx, 8
add ecx, eax
movzx eax, byte [esi + 6]
shl ecx, 8
add ecx, eax
movzx eax, byte [esi + 7]
shl ecx, 8
add ecx, eax
jne 0x100a5ab8
movzx ecx, byte [esi + 8]
movzx eax, byte [esi + 9]
movzx edi, byte [esi + 0xb]
shl ecx, 8
add ecx, eax
mov dword [0x10249b78], esi
movzx eax, byte [esi + 0xa]
add esi, 0x10
shl ecx, 8
add ecx, eax
mov dword [0x10249b80], ebp
shl ecx, 8
add ecx, ebp
mov dword [0x10249b84], ebp
add edi, ecx
mov ecx, esi
mov dword [0x10249b7c], edi
call fcn.100a8050
cmp eax, esi
je 0x100a5ab8
cmp dword [0x10249b84], edi
ja 0x100a5ab8
mov ecx, eax
mov esi, eax
call fcn.100a8050
cmp eax, esi
jne 0x100a5aa3
mov esi, dword [esp + 0x128]
test esi, esi
je 0x100a5ad0
mov ecx, 0x20
lea edi, [esp + 0x18]
rep movsd dword es:[edi], dword [esi]
jmp 0x100a5b1b
push 0x80
lea eax, [esp + 0x1c]
push 0
push eax
call sub.VCRUNTIME140.dll_memset
mov eax, 0xffff
mov byte [esp + 0x2c], 1
add esp, 0xc
mov dword [esp + 0x2c], 3
mov dword [esp + 0x30], 1
mov dword [esp + 0x50], 0x7f7fffff
mov dword [esp + 0x68], 0
mov dword [esp + 0x5c], 0x3f800000
mov word [esp + 0x60], ax
movss xmm0, dword [esp + 0x10]
lea esi, [esp + 0x18]
comiss xmm0, dword [0x10209114]
mov ecx, 0x20
lea edi, [esp + 0x98]
rep movsd dword es:[edi], dword [esi]
mov ecx, 0x20
mov byte [esp + 0xa0], 1
lea esi, [esp + 0x98]
lea edi, [esp + 0x18]
rep movsd dword es:[edi], dword [esi]
mov dword [esp + 0x18], ebp
mov dword [esp + 0x1c], ebx
jbe 0x100a5b64
movss dword [esp + 0x28], xmm0
mov eax, dword [esp + 0x12c]
test eax, eax
mov ecx, dword [esp + 0x48]
cmovne ecx, eax
lea eax, [esp + 0x18]
mov dword [esp + 0x48], ecx
mov ecx, dword [esp + 0x14]
push eax
call fcn.100a56c0
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10c
ret 0x10
Function at 0x100a9510
Capabilities:
Log keystrokes via polling

Disassembly:
sub esp, 0x2c
push ebx
mov ebx, dword [0x10213d84]
push ebp
push esi
push edi
test ebx, ebx
je 0x100a9529
mov ebp, dword [ebx + 0xc4]
jmp 0x100a952b
xor ebp, ebp
lea eax, [esp + 0x28]
xorps xmm0, xmm0
push eax
movups xmmword [esp + 0x2c], xmm0
push dword [ebp]
call dword [sym.imp.USER32.dll_GetClientRect]
mov eax, dword [esp + 0x30]
sub eax, dword [esp + 0x28]
movd xmm1, eax
mov eax, dword [esp + 0x34]
sub eax, dword [esp + 0x2c]
cvtdq2ps xmm1, xmm1
movd xmm0, eax
lea eax, [esp + 0x18]
cvtdq2ps xmm0, xmm0
push eax
movss dword [ebx + 0x10], xmm1
movss dword [ebx + 0x14], xmm0
xorps xmm0, xmm0
movlpd qword [esp + 0x1c], xmm0
call dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov edi, dword [esp + 0x18]
mov ecx, edi
sub ecx, dword [ebp + 8]
mov esi, dword [esp + 0x1c]
mov edx, esi
sbb edx, dword [ebp + 0xc]
call fcn.10178220
mov edx, dword [ebp + 0x14]
mov ecx, dword [ebp + 0x10]
cvtsd2ss xmm0, xmm0
movss dword [esp + 0x10], xmm0
call fcn.10178220
movss xmm1, dword [esp + 0x10]
cvtsd2ss xmm0, xmm0
push 0x11
divss xmm1, xmm0
movss dword [ebx + 0x18], xmm1
mov dword [ebp + 0xc], esi
mov esi, dword [sym.imp.USER32.dll_GetKeyState]
mov dword [ebp + 8], edi
call esi
shr eax, 0xf
and al, 1
push 0x10
mov byte [ebx + 0xfc], al
call esi
shr eax, 0xf
and al, 1
push 0x12
mov byte [ebx + 0xfd], al
call esi
mov esi, dword [0x10213d84]
shr eax, 0xf
and al, 1
mov byte [ebx + 0xff], 0
mov byte [ebx + 0xfe], al
test esi, esi
je 0x100a960e
mov edi, dword [esi + 0xc4]
jmp 0x100a9610
xor edi, edi
cmp byte [esi + 0x357], 0
je 0x100a9650
cvttss2si eax, dword [esi + 0xe4]
mov dword [esp + 0x10], eax
cvttss2si eax, dword [esi + 0xe8]
mov dword [esp + 0x14], eax
lea eax, [esp + 0x10]
push eax
push dword [edi]
call dword [sym.imp.USER32.dll_ClientToScreen]
test eax, eax
je 0x100a9650
push dword [esp + 0x14]
push dword [esp + 0x14]
call dword [sym.imp.USER32.dll_SetCursorPos]
mov dword [esi + 0xe4], 0xff7fffff
mov dword [esi + 0xe8], 0xff7fffff
call dword [sym.imp.USER32.dll_GetForegroundWindow]
test eax, eax
je 0x100a96c2
mov ecx, dword [edi]
cmp eax, ecx
je 0x100a9680
push ecx
push eax
call dword [sym.imp.USER32.dll_IsChild]
test eax, eax
je 0x100a96c2
lea eax, [esp + 0x20]
push eax
call dword [sym.imp.USER32.dll_GetCursorPos]
test eax, eax
je 0x100a96c2
lea eax, [esp + 0x20]
push eax
push dword [edi]
call dword [sym.imp.USER32.dll_ScreenToClient]
test eax, eax
je 0x100a96c2
movd xmm0, dword [esp + 0x20]
movd xmm1, dword [esp + 0x24]
cvtdq2ps xmm0, xmm0
cvtdq2ps xmm1, xmm1
movss dword [esi + 0xe4], xmm0
movss dword [esi + 0xe8], xmm1
cmp byte [ebx + 0xb0], 0
je 0x100a96d0
or eax, 0xffffffff
jmp 0x100a96db
mov eax, dword [0x10213d84]
mov eax, dword [eax + 0x1e84]
cmp dword [ebp + 0x18], eax
je 0x100a96e8
mov dword [ebp + 0x18], eax
call fcn.100a9170
call fcn.100a92a0
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x2c
ret
Function at 0x100d6a30
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xffffffc0
sub esp, 0x34
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, ecx
mov dword [esp + 0x24], edx
push edi
mov edi, 1
mov eax, dword [esi + 0x14]
mov ecx, dword [esi + 0xc]
sub ecx, dword [eax]
sub ecx, 0x10
sar ecx, 4
sub ecx, ebx
je 0x100d6bf3
dec ecx
mov edx, ebx
mov dword [esp + 0x2c], ecx
mov ecx, esi
call fcn.100c86c0
cmp eax, 0x101dd8c0
je 0x100d6b4e
mov eax, dword [eax + 8]
and eax, 0xf
cmp al, 3
jne 0x100d6b4e
mov edx, ebx
mov ecx, esi
call fcn.100c86c0
mov edx, ebx
mov ecx, esi
cmp dword [eax + 8], 0x13
jne 0x100d6ae7
call fcn.100c86c0
cmp dword [eax + 8], 0x13
jne 0x100d6abb
mov ecx, dword [eax]
mov eax, dword [eax + 4]
push eax
push ecx
mov dword [esp + 0x38], ecx
mov dword [esp + 0x3c], eax
push str._lld
jmp 0x100d6b2b
push 0
lea edx, [esp + 0x34]
mov ecx, eax
call fcn.100eb5a0
add esp, 4
test eax, eax
jne 0x100d6ad8
xorps xmm0, xmm0
movlpd qword [esp + 0x30], xmm0
push dword [esp + 0x34]
push dword [esp + 0x34]
push str._lld
jmp 0x100d6b2b
call fcn.100c86c0
cmp dword [eax + 8], 3
jne 0x100d6afe
movsd xmm0, qword [eax]
movsd qword [esp + 0x38], xmm0
jmp 0x100d6b1e
lea edx, [esp + 0x38]
mov ecx, eax
call fcn.100eb500
test eax, eax
jne 0x100d6b18
xorps xmm0, xmm0
movsd qword [esp + 0x38], xmm0
jmp 0x100d6b1e
movsd xmm0, qword [esp + 0x38]
sub esp, 8
movsd qword [esp], xmm0
push str._.14g
push dword [esp + 0x34]
call fcn.10086b20
add esp, 0x10
test edi, edi
je 0x100d6bc9
test eax, eax
jle 0x100d6bc9
mov edi, 1
jmp 0x100d6bcb
mov edx, ebx
mov ecx, esi
call fcn.100c86c0
mov ecx, dword [eax + 8]
and ecx, 0xf
cmp ecx, 4
je 0x100d6b8d
cmp ecx, 3
jne 0x100d6c02
mov edx, eax
mov ecx, esi
call fcn.100dc660
mov eax, dword [esi + 0x10]
cmp dword [eax + 0xc], 0
jle 0x100d6b84
mov ecx, esi
call fcn.100d50e0
mov edx, ebx
mov ecx, esi
call fcn.100c86c0
mov eax, dword [eax]
cmp byte [eax + 4], 4
jne 0x100d6b9b
movzx ebx, byte [eax + 7]
jmp 0x100d6b9e
mov ebx, dword [eax + 0xc]
add eax, 0x10
je 0x100d6bff
test edi, edi
je 0x100d6bc6
push dword [esp + 0x28]
push ebx
push 1
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
add esp, 0x10
cmp eax, ebx
jne 0x100d6bc6
mov ebx, dword [ebp + 8]
mov edi, 1
jmp 0x100d6bcb
mov ebx, dword [ebp + 8]
xor edi, edi
mov ecx, dword [esp + 0x2c]
inc ebx
mov dword [ebp + 8], ebx
test ecx, ecx
jne 0x100d6a60
test edi, edi
jne 0x100d6bf3
push edi
mov edx, edi
mov ecx, esi
call fcn.100ca2d0
add esp, 4
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
pop edi
pop esi
mov eax, 1
pop ebx
mov esp, ebp
pop ebp
ret
mov ebx, dword [ebp + 8]
push 4
mov edx, ebx
mov ecx, esi
call fcn.100ca1e0
int3
Function at 0x100da330
Capabilities:
Query environment variable

Disassembly:
sub esp, 0x10c
push esi
push edi
push str._5_3
push dword [esp + 0x11c]
mov esi, ecx
mov dword [esp + 0x10], edx
push str._s_s
push esi
call fcn.100c8cc0
push eax
call dword [sym.imp.api_ms_win_crt_environment_l1_1_0.dll_getenv]
mov edi, eax
add esp, 0x14
test edi, edi
jne 0x100da37b
push dword [esp + 0x118]
call dword [sym.imp.api_ms_win_crt_environment_l1_1_0.dll_getenv]
mov edi, eax
add esp, 4
test edi, edi
je 0x100da3aa
mov edx, dword [esi + 0x10]
mov ecx, esi
add edx, 0x28
push str.LUA_NOENV
call fcn.100c8da0
mov eax, dword [esi + 0xc]
add esp, 4
add eax, 0xfffffff0
mov ecx, dword [eax + 8]
test ecx, ecx
je 0x100da3e9
cmp ecx, 1
jne 0x100da3a7
cmp dword [eax], 0
je 0x100da3e9
mov dword [esi + 0xc], eax
mov edx, dword [esp + 0x11c]
test edx, edx
jne 0x100da3bd
mov eax, dword [esi + 0xc]
mov dword [eax + 8], edx
jmp 0x100da3d3
mov ecx, esi
call fcn.100e3290
mov ecx, dword [esi + 0xc]
mov dword [ecx], eax
movzx eax, byte [eax + 4]
or eax, 0x40
mov dword [ecx + 8], eax
mov eax, dword [esi + 0x10]
add dword [esi + 0xc], 0x10
cmp dword [eax + 0xc], 0
jle 0x100da429
mov ecx, esi
call fcn.100d50e0
jmp 0x100da429
push 0x1020080c
push 0x10200810
mov edx, edi
mov dword [esi + 0xc], eax
mov ecx, esi
call fcn.100cb900
push dword [esp + 0x124]
mov edx, eax
mov ecx, esi
push 0x10200800
call fcn.100cb900
push 0xffffffffffffffff
mov edx, 0xfffffffe
mov ecx, esi
call fcn.100c8870
add esp, 0x14
add dword [esi + 0xc], 0xfffffff0
push 0x105
lea eax, [esp + 0x10]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
je 0x100da4ee
cmp eax, 0x105
je 0x100da4ee
lea eax, [esp + 0xc]
push 0x5c
push eax
call dword [sym.imp.VCRUNTIME140.dll_strrchr]
add esp, 8
test eax, eax
je 0x100da4ee
mov byte [eax], 0
mov eax, dword [esi + 0xc]
sub eax, 0x10
mov ecx, dword [eax + 8]
and ecx, 0xf
cmp ecx, 4
je 0x100da4a2
cmp ecx, 3
je 0x100da483
xor edx, edx
jmp 0x100da4a7
mov edx, eax
mov ecx, esi
call fcn.100dc660
mov eax, dword [esi + 0x10]
cmp dword [eax + 0xc], 0
jle 0x100da49c
mov ecx, esi
call fcn.100d50e0
mov eax, dword [esi + 0xc]
sub eax, 0x10
mov edx, dword [eax]
add edx, 0x10
lea eax, [esp + 0xc]
mov ecx, esi
push eax
push 0x102007cc
call fcn.100cb900
push 0xffffffffffffffff
mov edx, 0xfffffffe
mov ecx, esi
call fcn.100c8870
add dword [esi + 0xc], 0xfffffff0
add esp, 0xc
mov edx, dword [esi + 0xc]
mov ecx, esi
push dword [esp + 8]
lea edx, [edx - 0x30]
call fcn.100c8f40
add esp, 4
add dword [esi + 0xc], 0xfffffff0
pop edi
pop esi
add esp, 0x10c
ret
push str.unable_to_get_ModuleFileName
push esi
call fcn.100ca290
int3
Function at 0x100dc0f0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x1c
push ebx
push esi
mov ebx, edx
mov esi, ecx
push edi
mov dword [esp + 0x1c], ebx
call dword [sym.imp.api_ms_win_crt_locale_l1_1_0.dll_localeconv]
xor ecx, ecx
xor edi, edi
mov dword [esp + 0x18], ecx
xorps xmm1, xmm1
mov eax, dword [eax]
movsx eax, byte [eax]
mov dword [esp + 0x10], eax
xor eax, eax
mov dword [ebx], esi
mov cl, byte [esi]
mov dword [esp + 0x14], eax
mov dword [esp + 0xc], eax
movzx eax, cl
test byte [eax + 0x101dd3e9], 8
je 0x100dc148
mov cl, byte [esi + 1]
inc esi
movzx eax, cl
test byte [eax + 0x101dd3e9], 8
jne 0x100dc138
lea edx, [esi + 1]
cmp cl, 0x2d
jne 0x100dc15a
mov dword [esp + 0x20], 1
jmp 0x100dc164
cmp cl, 0x2b
mov dword [esp + 0x20], edi
cmovne edx, esi
cmp byte [edx], 0x30
jne 0x100dc2b4
mov al, byte [edx + 1]
cmp al, 0x78
je 0x100dc17c
cmp al, 0x58
jne 0x100dc2b4
movsd xmm2, qword [0x10209330]
add edx, 2
mov eax, dword [esp + 0x10]
nop dword [eax + eax]
mov bl, byte [edx]
mov esi, edx
movsx ecx, bl
cmp ecx, eax
jne 0x100dc1ad
cmp dword [esp + 0xc], 0
jne 0x100dc20c
mov dword [esp + 0xc], 1
inc edx
jmp 0x100dc190
movzx eax, bl
test byte [eax + 0x101dd3e9], 0x10
je 0x100dc20c
mov eax, dword [esp + 0x14]
test eax, eax
jne 0x100dc1cc
cmp bl, 0x30
jne 0x100dc1cc
inc dword [esp + 0x18]
jmp 0x100dc1fd
inc eax
mov dword [esp + 0x14], eax
cmp eax, 0x1e
jg 0x100dc1fc
test byte [ecx + 0x101dd3e9], 2
je 0x100dc1e4
add ecx, 0xffffffd0
jmp 0x100dc1ea
or ecx, 0x20
sub ecx, 0x57
movd xmm0, ecx
cvtdq2pd xmm0, xmm0
mulsd xmm1, xmm2
addsd xmm1, xmm0
jmp 0x100dc1fd
inc edi
cmp dword [esp + 0xc], 0
mov eax, dword [esp + 0x10]
je 0x100dc209
dec edi
inc edx
jmp 0x100dc190
mov eax, dword [esp + 0x14]
add eax, dword [esp + 0x18]
je 0x100dc2b4
mov eax, dword [esp + 0x1c]
shl edi, 2
mov dword [eax], edx
mov al, byte [edx]
cmp al, 0x70
je 0x100dc22d
cmp al, 0x50
jne 0x100dc283
mov al, byte [edx + 1]
inc edx
xor ecx, ecx
cmp al, 0x2d
jne 0x100dc23f
lea edx, [esi + 2]
lea esi, [ecx + 1]
jmp 0x100dc248
cmp al, 0x2b
jne 0x100dc246
lea edx, [esi + 2]
xor esi, esi
mov bl, byte [edx]
movzx eax, bl
test byte [eax + 0x101dd3e9], 2
je 0x100dc2b4
movsx eax, bl
lea ecx, [ecx + ecx*4]
mov bl, byte [edx + 1]
lea ecx, [ecx - 0x18]
inc edx
lea ecx, [eax + ecx*2]
movzx eax, bl
test byte [eax + 0x101dd3e9], 2
jne 0x100dc256
mov eax, ecx
neg eax
test esi, esi
cmove eax, ecx
add edi, eax
mov eax, dword [esp + 0x1c]
mov dword [eax], edx
cmp dword [esp + 0x20], 0
je 0x100dc291
xorps xmm1, xmmword [0x10209850]
push edi
sub esp, 8
movsd qword [esp], xmm1
call dword [sym.imp.api_ms_win_crt_math_l1_1_0.dll_ldexp]
fstp qword [esp + 0x2c]
movsd xmm0, qword [esp + 0x2c]
add esp, 0xc
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
pop edi
pop esi
xorps xmm0, xmm0
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x100dc4e0
Capabilities:
Check http status code

Disassembly:
sub esp, 0xdc
push ebx
push ebp
push esi
mov ebp, edx
lea edx, [esp + 0xc]
push edi
mov edi, ecx
call fcn.100dc340
mov esi, eax
test esi, esi
je 0x100dc523
mov edx, dword [esp + 0x10]
sub esi, edi
mov ecx, dword [esp + 0x14]
mov eax, 0x13
mov dword [ebp], edx
mov dword [ebp + 4], ecx
mov dword [ebp + 8], eax
lea eax, [esi + 1]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xdc
ret
push str..xXnN
push edi
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strpbrk]
add esp, 8
test eax, eax
je 0x100dc54e
movzx ebx, byte [eax]
or ebx, 0x20
cmp ebx, 0x6e
jne 0x100dc550
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xdc
ret
xor ebx, ebx
push ebx
lea edx, [esp + 0x14]
mov ecx, edi
call fcn.100dc2c0
mov esi, eax
add esp, 4
test esi, esi
jne 0x100dc5df
push 0x2e
push edi
call dword [sym.imp.VCRUNTIME140.dll_strchr]
mov edx, edi
mov esi, eax
add esp, 8
lea eax, [edx + 1]
mov cl, byte [edx]
inc edx
test cl, cl
jne 0x100dc578
sub edx, eax
cmp edx, 0xc8
ja 0x100dc541
test esi, esi
je 0x100dc541
lea edx, [esp + 0x18]
mov ecx, edi
sub edx, edi
mov al, byte [ecx]
lea ecx, [ecx + 1]
mov byte [edx + ecx - 1], al
test al, al
jne 0x100dc595
call dword [sym.imp.api_ms_win_crt_locale_l1_1_0.dll_localeconv]
sub esi, edi
lea edx, [esp + 0x10]
push ebx
lea ecx, [esp + 0x1c]
mov eax, dword [eax]
mov al, byte [eax]
mov byte [esp + esi + 0x1c], al
call fcn.100dc2c0
mov esi, eax
add esp, 4
test esi, esi
je 0x100dc541
mov eax, edi
lea ecx, [esp + 0x18]
sub eax, ecx
add esi, eax
test esi, esi
je 0x100dc541
movsd xmm0, qword [esp + 0x10]
sub esi, edi
mov eax, 3
movsd qword [ebp], xmm0
pop edi
mov dword [ebp + 8], eax
lea eax, [esi + 1]
pop esi
pop ebp
pop ebx
add esp, 0xdc
ret

Function at 0x100e2f50
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
mov esi, edx
mov ebx, ecx
push edi
mov edi, esi
mov eax, esi
xor eax, dword [esp + 0x10]
shr edi, 5
inc edi
cmp esi, edi
jb 0x100e2f8b
nop word [eax + eax]
movzx edx, byte [ebx + esi - 1]
mov ecx, eax
shl ecx, 5
sub esi, edi
add edx, ecx
mov ecx, eax
shr ecx, 2
add edx, ecx
xor eax, edx
cmp esi, edi
jae 0x100e2f70
pop edi
pop esi
pop ebx
ret
Function at 0x100e5930
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x10
movsd xmm0, qword [ebp + 0x10]
ucomisd xmm0, qword [0x10209530]
push esi
mov esi, ecx
push edi
mov edi, edx
mov dword [esp + 0xc], esi
lahf
test ah, 0x44
jnp 0x100e5b1b
ucomisd xmm0, qword [0x10209600]
lahf
test ah, 0x44
jnp 0x100e5b1b
xorps xmm5, xmm5
ucomisd xmm0, xmm5
lahf
test ah, 0x44
jp 0x100e5997
sub esp, 8
movsd qword [esp], xmm0
push str._.14gx0p0
push edi
call fcn.10022780
mov ecx, eax
mov dword [esp + 0x18], ecx
jmp 0x100e5b34
lea eax, [esp + 8]
push eax
sub esp, 8
movsd qword [esp], xmm0
call dword [sym.imp.api_ms_win_crt_math_l1_1_0.dll_frexp]
fstp qword [esp + 0x1c]
movsd xmm4, qword [esp + 0x1c]
xorps xmm5, xmm5
add esp, 0xc
xor esi, esi
comisd xmm5, xmm4
jbe 0x100e59d1
xorps xmm4, xmmword [0x10209850]
mov esi, 1
mov byte [edi], 0x2d
movsd xmm2, qword [0x10209548]
addsd xmm4, xmm4
movsd xmm1, qword [0x10209460]
mov eax, 0x30
mov edx, 0x57
mov word [esi + edi], 0x7830
andps xmm2, xmm4
movaps xmm0, xmm4
xorps xmm0, xmm2
movaps xmm3, xmm4
cmpltsd xmm0, xmm1
andps xmm1, xmm0
orps xmm1, xmm2
addsd xmm3, xmm1
subsd xmm3, xmm1
movsd xmm1, qword [0x102092f0]
movaps xmm0, xmm3
subsd xmm0, xmm4
cmpnlesd xmm0, xmm2
andps xmm0, xmm1
subsd xmm3, xmm0
cvttsd2si ecx, xmm3
subsd xmm4, xmm3
cmp ecx, 0xa
cmovge eax, edx
add al, cl
mov byte [esi + edi + 2], al
add esi, 3
mov eax, dword [esp + 8]
dec eax
movsd qword [esp + 0x10], xmm4
comisd xmm4, xmm5
mov dword [esp + 8], eax
jbe 0x100e5afc
call dword [sym.imp.api_ms_win_crt_locale_l1_1_0.dll_localeconv]
movsd xmm6, qword [0x10209330]
xorps xmm5, xmm5
movsd xmm4, qword [esp + 0x10]
mov edx, 0x57
movsd xmm7, qword [0x10209548]
mov eax, dword [eax]
mov al, byte [eax]
mov byte [esi + edi], al
inc esi
nop dword [eax + eax]
movsd xmm1, qword [0x10209460]
movaps xmm2, xmm7
mulsd xmm4, xmm6
mov eax, 0x30
andps xmm2, xmm4
movaps xmm0, xmm4
xorps xmm0, xmm2
movaps xmm3, xmm4
cmpltsd xmm0, xmm1
andps xmm1, xmm0
orps xmm1, xmm2
addsd xmm3, xmm1
subsd xmm3, xmm1
movsd xmm1, qword [0x102092f0]
movaps xmm0, xmm3
subsd xmm0, xmm4
cmpnlesd xmm0, xmm2
andps xmm0, xmm1
subsd xmm3, xmm0
cvttsd2si ecx, xmm3
subsd xmm4, xmm3
cmp ecx, 0xa
cmovge eax, edx
add al, cl
mov byte [edi + esi], al
inc esi
comisd xmm4, xmm5
ja 0x100e5a90
mov eax, dword [esp + 8]
push eax
lea eax, [esi + edi]
push str.p_d
push eax
call fcn.10022780
add esp, 0xc
lea ecx, [esi + eax]
mov esi, dword [esp + 0xc]
mov dword [esp + 8], ecx
jmp 0x100e5b37
sub esp, 8
movsd qword [esp], xmm0
push str._.14g
push edi
call fcn.10022780
mov ecx, eax
mov dword [esp + 0x18], eax
add esp, 0x10
mov eax, dword [ebp + 0xc]
mov al, byte [eax + 1]
cmp al, 0x41
jne 0x100e5b72
xor esi, esi
test ecx, ecx
jle 0x100e5b6a
nop word [eax + eax]
movzx eax, byte [edi + esi]
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_toupper]
mov ecx, dword [esp + 0xc]
add esp, 4
mov byte [edi + esi], al
inc esi
cmp esi, ecx
jl 0x100e5b50
pop edi
mov eax, ecx
pop esi
mov esp, ebp
pop ebp
ret
cmp al, 0x61
je 0x100e5b6a
push str.modifiers_for_format___a___A_not_implemented
push esi
call fcn.100ca290
int3