joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100c5400
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [esp + 4]
push ebx
add eax, 0xfffffbef
push esi
push edi
cmp eax, 7
ja case.0x100c5415.1044
jmp dword [eax*4 + 0x100c558c]
mov eax, dword [esp + 0x18]
mov ecx, dword [eax]
mov esi, dword [esp + 0x14]
mov ebx, dword [esp + 0x20]
mov dword [0x101f4c04], ecx
mov edx, dword [eax + 4]
mov dword [0x101f4c08], edx
mov ecx, dword [eax + 8]
push esi
mov dword [0x101f4c0c], ecx
mov edx, dword [eax + 0xc]
mov eax, dword [esp + 0x20]
push ebx
push 0xa
push eax
mov edi, 0x10
mov dword [0x101f4c10], edx
call fcn.100b53c0
add esp, 0x10
jmp 0x100c5558
mov eax, dword [esp + 0x18]
mov ecx, dword [eax]
mov esi, dword [esp + 0x14]
mov ebx, dword [esp + 0x20]
mov dword [0x101f4c04], ecx
mov edx, dword [eax + 4]
mov dword [0x101f4c08], edx
mov ecx, dword [eax + 8]
push esi
mov dword [0x101f4c0c], ecx
mov edx, dword [eax + 0xc]
mov eax, dword [esp + 0x20]
push ebx
push 0xc
push eax
mov edi, 0x10
mov dword [0x101f4c10], edx
call fcn.100b53c0
add esp, 0x10
jmp 0x100c5558
mov eax, dword [esp + 0x18]
mov ecx, dword [eax]
mov esi, dword [esp + 0x14]
mov ebx, dword [esp + 0x20]
mov dword [0x101f4c04], ecx
mov edx, dword [eax + 4]
mov dword [0x101f4c08], edx
mov ecx, dword [eax + 8]
push esi
mov dword [0x101f4c0c], ecx
mov edx, dword [eax + 0xc]
mov eax, dword [esp + 0x20]
push ebx
push 0xe
push eax
mov edi, 0x10
mov dword [0x101f4c10], edx
call fcn.100b53c0
add esp, 0x10
jmp 0x100c5558
mov eax, dword [esp + 0x18]
mov ecx, dword [eax]
mov esi, dword [esp + 0x14]
mov ebx, dword [esp + 0x20]
mov dword [0x101f4c04], ecx
mov edx, dword [eax + 4]
mov eax, dword [esp + 0x1c]
push esi
push ebx
push eax
mov edi, 8
mov dword [0x101f4c08], edx
call fcn.100b4a10
jmp 0x100c5555
mov eax, dword [esp + 0x18]
mov ecx, dword [eax]
mov esi, dword [esp + 0x14]
mov ebx, dword [esp + 0x20]
mov dword [0x101f4c04], ecx
mov edx, dword [eax + 4]
mov eax, dword [esp + 0x1c]
push esi
push ebx
push eax
mov edi, 8
mov dword [0x101f4c08], edx
call fcn.100b4250
add esp, 0xc
push edi
push esi
push ebx
call fcn.1013fc90
add esp, 0xc
test edi, edi
jle 0x100c557b
mov ecx, 0x101f4c04
mov eax, esi
sub ecx, esi
mov dl, byte [ecx + eax]
xor byte [eax], dl
inc eax
sub edi, 1
jne 0x100c5570
pop edi
pop esi
xor eax, eax
pop ebx
ret
pop edi
pop esi
mov eax, 0xfffff445
pop ebx
ret
Function at 0x100c57f0
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
mov eax, dword [esp + 8]
push ebx
mov ebx, dword [esp + 8]
push ebp
push esi
push edi
lea ebp, [ebx + 0xc]
mov ecx, 0x40
mov esi, 0x101bca48
mov edi, ebp
rep movsd dword es:[edi], dword [esi]
mov edi, dword [esp + 0x1c]
push edi
push eax
lea ecx, [ebx + 0x10c]
push ecx
call fcn.1013fc90
xor ecx, ecx
add esp, 0xc
mov dword [ebx], edi
mov dword [ebx + 4], ecx
mov dword [ebx + 8], ecx
cmp edi, 0x10
je 0x100c5888
cmp edi, 0x20
je 0x100c5888
mov edi, 0xfffffff4
xor esi, esi
mov ecx, ebp
sub edi, ebx
movzx edx, byte [ecx]
mov byte [esp + 0x14], dl
xor edx, edx
lea eax, [edi + ecx]
div dword [ebx]
inc ecx
movzx eax, byte [edx + ebx + 0x10c]
movzx edx, byte [esp + 0x14]
add eax, esi
add edx, eax
and edx, 0xff
mov esi, edx
mov al, byte [esi + ebp]
movzx edx, byte [esp + 0x14]
mov byte [ecx - 1], al
lea eax, [edi + ecx]
mov byte [esi + ebp], dl
cmp eax, 0x100
jb 0x100c5841
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
ret
dec edi
mov esi, 0xfffffff4
mov dword [esp + 0x1c], edi
mov eax, ebp
sub esi, ebx
jmp 0x100c58a0
movzx edx, byte [eax]
mov byte [esp + 0x14], dl
movzx edi, byte [esp + 0x14]
lea edx, [eax + esi]
and edx, dword [esp + 0x1c]
inc eax
movzx edx, byte [edx + ebx + 0x10c]
add edx, ecx
add edi, edx
and edi, 0xff
mov ecx, edi
movzx edx, byte [ecx + ebp]
mov byte [eax - 1], dl
movzx edx, byte [esp + 0x14]
mov byte [ecx + ebp], dl
lea edx, [eax + esi]
cmp edx, 0x100
jb 0x100c58a0
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
ret

Function at 0x100c58f0
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
mov eax, dword [esp + 4]
mov ecx, dword [esp + 0xc]
push esi
mov esi, dword [eax + 4]
push edi
mov edi, dword [eax + 8]
test ecx, ecx
jbe 0x100c5958
mov edx, dword [esp + 0x10]
push ebx
push ebp
mov ebp, dword [esp + 0x20]
sub edx, ebp
mov dword [esp + 0x14], ecx
inc esi
and esi, 0xff
mov cl, byte [eax + esi + 0xc]
movzx ebx, cl
add ebx, edi
and ebx, 0xff
mov edi, ebx
movzx ebx, byte [eax + edi + 0xc]
mov byte [eax + esi + 0xc], bl
mov byte [eax + edi + 0xc], cl
movzx ebx, byte [eax + esi + 0xc]
add bl, cl
movzx ecx, bl
movzx ecx, byte [ecx + eax + 0xc]
xor cl, byte [edx + ebp]
inc ebp
sub dword [esp + 0x14], 1
mov byte [ebp - 1], cl
jne 0x100c5914
pop ebp
pop ebx
mov dword [eax + 8], edi
mov dword [eax + 4], esi
pop edi
xor eax, eax
pop esi
ret
Function at 0x100c5d90
Capabilities:
Encode data using xor
Encrypt data using sosemanuk

Disassembly:
push ecx
mov eax, dword [esp + 8]
mov edx, dword [eax + 0x50]
push esi
lea esi, [edx + 0x10]
mov dword [esp + 4], edx
mov ecx, edx
cmp edx, esi
jae 0x100c5e69
push ebx
push ebp
push edi
lea ecx, [ecx]
mov edi, ecx
and edi, 0xf
lea edi, [eax + edi*4]
mov dword [esp + 0x18], edi
mov edi, dword [edi]
mov ebx, edi
shr ebx, 0x18
mov ebx, dword [ebx*4 + 0x101bcc48]
lea edx, [ecx - 5]
mov esi, edx
and esi, 0xf
mov esi, dword [eax + esi*4]
lea ebp, [edx + 7]
and ebp, 0xf
xor ebx, dword [eax + ebp*4]
mov ebp, esi
and ebp, 0xff
xor ebx, dword [ebp*4 + 0x101bd048]
shl edi, 8
xor ebx, edi
mov edi, dword [esp + 0x18]
shr esi, 8
xor ebx, esi
mov dword [edi], ebx
movzx ebx, byte [eax + 0x43]
movzx ebp, byte [eax + 0x41]
mov ebx, dword [ebx*4 + 0x101be048]
xor ebx, dword [ebp*4 + 0x101bd848]
movzx ebp, byte [eax + 0x42]
xor ebx, dword [ebp*4 + 0x101bdc48]
mov ebp, dword [eax + 0x40]
lea esi, [edx - 6]
and esi, 0xf
mov esi, dword [eax + esi*4]
add esi, dword [eax + 0x44]
and ebp, 0xff
xor ebx, dword [ebp*4 + 0x101bd448]
mov dword [eax + 0x40], esi
mov dword [eax + 0x44], ebx
mov edi, dword [edi]
add edx, 6
and edx, 0xf
add edi, esi
xor edi, dword [eax + edx*4]
mov edx, dword [esp + 0x1c]
xor edi, ebx
mov dword [edx + ecx*4], edi
mov edx, dword [esp + 0x10]
inc ecx
lea esi, [edx + 0x10]
cmp ecx, esi
jb 0x100c5db0
pop edi
pop ebp
pop ebx
and edx, 0xf
mov dword [eax + 0x50], edx
xor eax, eax
pop esi
pop ecx
ret

Function at 0x100c5e80
Capabilities:
Encrypt data using sosemanuk

Disassembly:
mov eax, dword [esp + 4]
mov ecx, dword [eax + 0x50]
push ebx
push ebp
push esi
mov esi, ecx
and esi, 0xf
push edi
lea edi, [eax + esi*4]
mov esi, dword [edi]
mov ebx, esi
shr ebx, 0x18
mov ebx, dword [ebx*4 + 0x101bcc48]
lea edx, [ecx - 5]
and edx, 0xf
mov edx, dword [eax + edx*4]
lea ebp, [ecx + 2]
and ebp, 0xf
xor ebx, dword [eax + ebp*4]
mov ebp, edx
shl esi, 8
and ebp, 0xff
xor ebx, dword [ebp*4 + 0x101bd048]
shr edx, 8
xor ebx, esi
xor ebx, edx
mov dword [edi], ebx
movzx esi, byte [eax + 0x43]
mov esi, dword [esi*4 + 0x101be048]
movzx ebx, byte [eax + 0x42]
xor esi, dword [ebx*4 + 0x101bdc48]
movzx ebx, byte [eax + 0x41]
xor esi, dword [ebx*4 + 0x101bd848]
mov ebx, dword [eax + 0x40]
lea edx, [ecx + 5]
and edx, 0xf
mov edx, dword [eax + edx*4]
add edx, dword [eax + 0x44]
and ebx, 0xff
xor esi, dword [ebx*4 + 0x101bd448]
mov dword [eax + 0x40], edx
mov dword [eax + 0x44], esi
mov esi, dword [edi]
add esi, edx
mov edx, dword [esp + 0x18]
inc ecx
and ecx, 0xf
xor esi, dword [eax + ecx*4]
pop edi
xor esi, dword [eax + 0x44]
mov dword [edx], esi
pop esi
pop ebp
mov dword [eax + 0x50], ecx
xor eax, eax
pop ebx
ret
Function at 0x100c7a40
Capabilities:
Hash data with md5

Disassembly:
mov eax, dword [esp + 4]
xor ecx, ecx
mov dword [eax + 0x10], ecx
mov dword [eax + 0x14], ecx
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
ret
Function at 0x100d5710
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x10160168
mov eax, dword fs:[0]
push eax
sub esp, 0x18
push ebx
push esi
push edi
mov eax, dword [0x101c3584]
xor eax, esp
push eax
lea eax, [esp + 0x28]
mov dword fs:[0], eax
mov esi, ecx
mov eax, dword [esi]
mov edx, dword [eax + 0x2c]
lea ecx, [esp + 0x10]
push ecx
mov ecx, esi
call edx
add esi, 0x50
mov ecx, esi
mov dword [esp + 0x30], 0
call fcn.100ca980
mov eax, dword [esi]
mov edx, dword [eax + 0xc]
mov ecx, esi
call edx
mov esi, dword [esp + 0x1c]
mov eax, dword [esp + 0x20]
cmp esi, eax
jbe 0x100d5776
call fcn.1013da0c
mov eax, dword [esp + 0x20]
mov edi, dword [esp + 0x10]
lea ebx, [ebx]
mov ebx, eax
cmp dword [esp + 0x1c], eax
jbe 0x100d578d
call fcn.1013da0c
test edi, edi
je 0x100d5797
cmp edi, dword [esp + 0x10]
je 0x100d579c
call fcn.1013da0c
cmp esi, ebx
je 0x100d5804
test edi, edi
jne 0x100d57f8
call fcn.1013da0c
xor eax, eax
cmp esi, dword [eax + 0x10]
jb 0x100d57b5
call fcn.1013da0c
mov ecx, esi
call fcn.100ca980
test edi, edi
jne 0x100d57fc
call fcn.1013da0c
xor eax, eax
cmp esi, dword [eax + 0x10]
jb 0x100d57d1
call fcn.1013da0c
mov eax, dword [esi]
mov edx, dword [eax + 0xc]
mov ecx, esi
call edx
test edi, edi
jne 0x100d5800
call fcn.1013da0c
xor eax, eax
cmp esi, dword [eax + 0x10]
jb 0x100d57ef
call fcn.1013da0c
mov eax, dword [esp + 0x20]
add esi, 8
jmp 0x100d5780
mov eax, dword [edi]
jmp 0x100d57ab
mov eax, dword [edi]
jmp 0x100d57c7
mov eax, dword [edi]
jmp 0x100d57e5
lea ecx, [esp + 0x10]
mov dword [esp + 0x30], 0xffffffff
call fcn.100caef0
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x24
ret

Function at 0x100d7a70
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x10160484
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x101c3584]
xor eax, esp
push eax
lea eax, [esp + 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 8], esi
mov dword [esi], vtable.log4cplus::Hierarchy.0
mov dword [esp + 0x14], 4
call fcn.100d5710
mov eax, dword [esi + 8]
push eax
call fcn.100d7d70
add esp, 4
lea ecx, [esi + 0x50]
mov byte [esp + 0x14], 3
call fcn.100ca8f0
lea ecx, [esi + 0x30]
mov byte [esp + 0x14], 2
call fcn.100d6900
lea ecx, [esi + 0x10]
mov byte [esp + 0x14], 1
call fcn.100d79e0
mov ecx, dword [esi + 0xc]
mov byte [esp + 0x14], 0
test ecx, ecx
je 0x100d7af3
mov edx, dword [ecx]
mov eax, dword [edx + 4]
push 1
call eax
mov ecx, esi
mov dword [esp + 0x14], 0xffffffff
call fcn.100d7cf0
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x10
ret
Function at 0x100d80b0
Capabilities:
Create thread

Disassembly:
push 0xffffffffffffffff
push 0x10160578
mov eax, dword fs:[0]
push eax
sub esp, 0x44
push ebp
push esi
push edi
mov eax, dword [0x101c3584]
xor eax, esp
push eax
lea eax, [esp + 0x54]
mov dword fs:[0], eax
mov esi, ecx
mov eax, dword [esi + 4]
or dword [esi + 8], 1
mov ecx, dword [eax + 4]
lea ecx, [ecx + esi + 4]
call fcn.100cb130
mov ebp, dword [sym.imp.KERNEL32.dll_InterlockedExchange]
push 0xffffffffffffffff
lea edi, [esi + 0xc]
push edi
call ebp
cmp eax, 0xffffffff
je 0x100d8105
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea edx, [esi + 0x10]
push edx
push 0
push esi
push 0x100d80a0
push 0
push 0
call fcn.10141985
add esp, 0x18
test eax, eax
jne 0x100d817e
mov eax, dword [esi + 4]
mov ecx, dword [eax + 4]
lea ecx, [ecx + esi + 4]
call fcn.100cb150
and dword [esi + 8], 0xfffffffe
push 0x22
push str.Thread_creation_was_not_successful
lea ecx, [esp + 0x18]
mov dword [esp + 0x30], 0xf
mov dword [esp + 0x2c], 0
mov byte [esp + 0x1c], 0
call fcn.100019f0
lea edx, [esp + 0x10]
push edx
lea ecx, [esp + 0x30]
mov dword [esp + 0x60], 0
call fcn.1000c300
push 0x101affa8
lea eax, [esp + 0x30]
push eax
call fcn.10140fc5
push eax
push edi
call ebp
mov ecx, dword [esp + 0x54]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
add esp, 0x50
ret

Function at 0x100ddb40
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x1016109c
mov eax, dword fs:[0]
push eax
sub esp, 0x24
push ebx
push esi
mov eax, dword [0x101c3584]
xor eax, esp
push eax
lea eax, [esp + 0x30]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0x10], esi
xor ebx, ebx
mov dword [esp + 0xc], ebx
cmp dword [esp + 0x48], ebx
je 0x100ddb9c
mov dword [esi + 0x28], 0x1018ae28
mov dword [esi + 0x58], vtable.log4cplus::helpers::SharedObject.0
call fcn.100d7de0
mov dword [esi + 0x5c], eax
mov dword [esi + 0x60], ebx
mov dword [esp + 0x38], ebx
mov dword [esp + 0xc], 1
push 4
push str.root
lea ecx, [esp + 0x1c]
mov dword [esp + 0x34], 0xf
mov dword [esp + 0x30], ebx
mov byte [esp + 0x20], bl
call fcn.100019f0
mov eax, dword [esp + 0x40]
push ebx
push eax
lea ecx, [esp + 0x1c]
push ecx
mov ecx, esi
mov dword [esp + 0x44], 1
call fcn.100d3a20
cmp dword [esp + 0x2c], 0x10
mov byte [esp + 0x38], 3
jb 0x100ddbef
mov edx, dword [esp + 0x18]
push edx
call fcn.10001120
add esp, 4
mov eax, dword [esi + 0x28]
mov edx, dword [esp + 0x44]
mov dword [esi], vtable.log4cplus::spi::RootLogger.2.0
mov dword [esi + 4], vtable.log4cplus::spi::RootLogger.1.0
mov ecx, dword [eax + 4]
mov dword [ecx + esi + 0x28], vtable.log4cplus::spi::RootLogger.0
push edx
mov ecx, esi
mov dword [esp + 0x30], 0xf
mov dword [esp + 0x2c], ebx
mov byte [esp + 0x1c], bl
call fcn.100dda90
mov eax, esi
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
add esp, 0x30
ret 0xc
Function at 0x100ddd50
Capabilities:
Allocate thread local storage

Disassembly:
push 0xffffffffffffffff
push 0x101610ce
mov eax, dword fs:[0]
push eax
mov eax, dword [0x101c3584]
xor eax, esp
push eax
lea eax, [esp + 4]
mov dword fs:[0], eax
mov eax, 1
test byte [0x101f4d5c], al
jne 0x100dddb7
or dword [0x101f4d5c], eax
mov ecx, 0x101f4d50
mov dword [esp + 0xc], 0
call fcn.100d7c70
mov dword [0x101f4d50], 0x1018ae34
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
push 0x10167760
mov dword [0x101f4d58], eax
call fcn.1013db43
add esp, 4
mov eax, 0x101f4d50
mov ecx, dword [esp + 4]
mov dword fs:[0], ecx
pop ecx
add esp, 0xc
ret

Function at 0x100dde20
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10161108
mov eax, dword fs:[0]
push eax
sub esp, 0x48
push ebx
push esi
push edi
mov eax, dword [0x101c3584]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x14], ecx
mov eax, dword [ecx + 8]
xor ebx, ebx
push eax
mov dword [ebp - 0x18], ebx
mov dword [ebp - 4], ebx
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
cmp eax, ebx
je 0x100ddf32
cmp dword [eax + 0x1c], ebx
je 0x100ddf32
mov ecx, eax
call fcn.100dddd0
mov esi, dword [ebp + 8]
push 0xffffffffffffffff
add eax, 0x1c
push ebx
mov dword [esi + 0x18], 0xf
mov dword [esi + 0x14], ebx
push eax
mov ecx, esi
mov byte [esi + 4], bl
call fcn.100015f0
jmp 0x100ddf56
mov dword [ebp - 4], 0xffffffff
mov esi, dword [ebp + 8]
push ebx
mov dword [esi + 0x18], 0xf
mov dword [esi + 0x14], ebx
push 0x101a58ac
mov ecx, esi
mov byte [esi + 4], bl
call fcn.100019f0
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x100de030
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push 0xffffffffffffffff
push 0x10161130
mov eax, dword fs:[0]
push eax
push esi
push edi
mov eax, dword [0x101c3584]
xor eax, esp
push eax
lea eax, [esp + 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov eax, dword [edi + 8]
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov esi, eax
test esi, esi
je 0x100de07c
mov ecx, esi
call fcn.100ddf70
mov ecx, dword [esi]
push ecx
call fcn.1013d576
push esi
call fcn.1013d576
add esp, 8
mov edx, dword [edi + 8]
push 0
push edx
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0xc
ret
Function at 0x100e1920
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x10162818
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
push ebx
push esi
mov eax, dword [0x101c3584]
xor eax, esp
push eax
lea eax, [esp + 0x28]
mov dword fs:[0], eax
mov esi, ecx
push 0x23
xor ebx, ebx
push str.Entering_SocketAppender::close__...
lea ecx, [esp + 0x14]
mov dword [esp + 0x2c], 0xf
mov dword [esp + 0x28], ebx
mov byte [esp + 0x18], bl
call fcn.100019f0
lea eax, [esp + 0xc]
push eax
mov ecx, esi
mov dword [esp + 0x34], ebx
call fcn.100d7ce0
mov ecx, eax
call fcn.100cb370
cmp dword [esp + 0x24], 0x10
mov dword [esp + 0x30], 0xffffffff
jb 0x100e199c
mov ecx, dword [esp + 0x10]
push ecx
call fcn.1013d576
add esp, 4
mov ecx, dword [esi + 0x8c]
mov dword [esp + 0x24], 0xf
mov dword [esp + 0x20], ebx
mov byte [esp + 0x10], bl
call fcn.100e1350
mov edx, dword [esi + 0x3c]
mov eax, dword [edx + 4]
lea ecx, [esi + 0x3c]
call eax
mov byte [esi + 0x38], 1
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
add esp, 0x28
ret

Function at 0x100e19e0
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x10161a79
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push esi
push edi
mov eax, dword [0x101c3584]
xor eax, esp
push eax
lea eax, [esp + 0x18]
mov dword fs:[0], eax
xor edi, edi
mov dword [esp + 0xc], edi
mov esi, dword [esp + 0x28]
push 0x1ffc
mov ecx, esi
mov dword [esp + 0x24], edi
call fcn.100e7ac0
push 2
mov ecx, esi
mov dword [esp + 0x24], edi
mov dword [esp + 0x10], 1
call fcn.100e7b90
push 1
mov ecx, esi
call fcn.100e7b90
mov eax, dword [esp + 0x30]
push eax
mov ecx, esi
call fcn.100e7e60
mov edi, dword [esp + 0x2c]
lea ecx, [edi + 0x24]
push ecx
mov ecx, esi
call fcn.100e7e60
mov eax, dword [edi + 0x40]
push eax
mov ecx, esi
call fcn.100e7c50
mov ecx, edi
call fcn.100dd770
push eax
mov ecx, esi
call fcn.100e7e60
mov edx, dword [edi]
mov eax, dword [edx + 4]
mov ecx, edi
call eax
push eax
mov ecx, esi
call fcn.100e7e60
mov ecx, edi
call fcn.100dd800
push eax
mov ecx, esi
call fcn.100e7e60
mov ecx, dword [edi + 0x84]
mov eax, dword [edi + 0x80]
mov dword [esp + 0x14], ecx
push eax
mov ecx, esi
call fcn.100e7c50
mov eax, dword [edi + 0x88]
push eax
mov ecx, esi
call fcn.100e7c50
lea edx, [edi + 0x90]
push edx
mov ecx, esi
call fcn.100e7e60
lea eax, [edi + 0xac]
push eax
mov ecx, esi
call fcn.100e7e60
mov edi, dword [edi + 0xc8]
push edi
mov ecx, esi
call fcn.100e7c50
mov eax, esi
mov ecx, dword [esp + 0x18]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x18
ret
Function at 0x100e2040
Capabilities:
Write file on windows

Disassembly:
push 0xffffffffffffffff
push 0x10161b88
mov eax, dword fs:[0]
push eax
sub esp, 0x20
push ebx
push ebp
push esi
push edi
mov eax, dword [0x101c3584]
xor eax, esp
push eax
lea eax, [esp + 0x34]
mov dword fs:[0], eax
mov dword [esp + 0x14], ecx
mov edi, dword [esp + 0x4c]
mov ebp, dword [esp + 0x48]
mov ebx, dword [esp + 0x44]
xor esi, esi
lea esp, [esp]
push 0
lea ecx, [esp + 0x50]
push ecx
mov eax, edi
sub eax, esi
push eax
lea edx, [esi + ebp]
push edx
push ebx
mov dword [esp + 0x60], 0
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x100e20ad
add esi, dword [esp + 0x4c]
cmp esi, edi
jne 0x100e2080
jmp 0x100e2103
push 0x39
push str.Win32ConsoleAppender::write_handle__WriteFile_has_failed.
lea ecx, [esp + 0x20]
mov dword [esp + 0x38], 0xf
mov dword [esp + 0x34], 0
mov byte [esp + 0x24], 0
call fcn.100019f0
mov ecx, dword [esp + 0x14]
lea eax, [esp + 0x18]
push eax
mov dword [esp + 0x40], 0
call fcn.100d7ce0
mov ecx, eax
call fcn.100cb530
cmp dword [esp + 0x30], 0x10
jb 0x100e2103
mov ecx, dword [esp + 0x1c]
push ecx
call fcn.1013d576
add esp, 4
mov ecx, dword [esp + 0x34]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x2c
ret 0xc

Function at 0x100e2710
Capabilities:
Print debug messages

Disassembly:
push 0xffffffffffffffff
push 0x10161ccb
mov eax, dword fs:[0]
push eax
sub esp, 0xa0
mov eax, dword [0x101c3584]
xor eax, esp
mov dword [esp + 0x9c], eax
push esi
push edi
mov eax, dword [0x101c3584]
xor eax, esp
push eax
lea eax, [esp + 0xac]
mov dword fs:[0], eax
mov edi, dword [esp + 0xbc]
push 1
mov esi, ecx
push 2
lea ecx, [esp + 0x14]
call fcn.10004c90
mov ecx, dword [esi + 0xc]
mov eax, dword [ecx]
mov eax, dword [eax + 4]
push edi
lea edx, [esp + 0x10]
push edx
mov dword [esp + 0xbc], 0
call eax
lea ecx, [esp + 0x8c]
push ecx
lea ecx, [esp + 0x10]
call fcn.10004df0
mov eax, dword [esp + 0x90]
mov esi, 0x10
cmp dword [esp + 0xa4], esi
jae 0x100e27a7
lea eax, [esp + 0x90]
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
cmp dword [esp + 0xa4], esi
jb 0x100e27c7
mov edx, dword [esp + 0x90]
push edx
call fcn.1013d576
add esp, 4
lea ecx, [esp + 0x58]
mov dword [esp + 0xa4], 0xf
mov dword [esp + 0xa0], 0
mov byte [esp + 0x90], 0
mov dword [esp + 0xb4], 0xffffffff
call fcn.10004d70
lea eax, [esp + 0x58]
push eax
mov dword [esp + 0x5c], vtable.std::ios_base.0
call fcn.1013919a
add esp, 4
mov ecx, dword [esp + 0xac]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [esp + 0x9c]
xor ecx, esp
call fcn.1013d581
add esp, 0xac
ret 4
Function at 0x100e4100
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x10161f03
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
mov eax, dword [0x101c3584]
xor eax, esp
push eax
lea eax, [esp + 0x10]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0xc], esi
call fcn.100d7c70
mov eax, dword [esp + 0x20]
xor ebx, ebx
push 0xffffffffffffffff
lea ecx, [esi + 8]
mov dword [esi], vtable.log4cplus::pattern::PatternParser.0
push ebx
mov dword [ecx + 0x18], 0xf
mov dword [ecx + 0x14], ebx
push eax
mov dword [esp + 0x24], ebx
mov byte [ecx + 4], bl
call fcn.100015f0
lea ecx, [esi + 0x30]
mov byte [esp + 0x18], 1
mov dword [esi + 0x24], 0xffffffff
mov dword [esi + 0x28], bind
mov byte [esi + 0x2c], bl
call fcn.10076ae0
mov ecx, dword [esp + 0x24]
mov dword [esi + 0x48], ebx
mov dword [esi + 0x4c], ebx
mov dword [esi + 0x68], 0xf
mov dword [esi + 0x64], ebx
mov byte [esi + 0x54], bl
mov dword [esi + 0x6c], ecx
mov eax, esi
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
add esp, 0x10
ret 8