joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1b78581
Capabilities:
Encode data using xor

Disassembly:
rol dword [esp + edx*2 - 0xfff8], 0x99
dec esp
mov ecx, dword [esp + edx - 0x7ff0]
dec esp
mov dword [esp + edx - 0x8000], esp
add byte [esp + edx - 0x7ff9], bh
dec eax
mov dword [esp + edx*4 - 0x1fff0], edx
dec eax
arpl ax, ax
dec eax
adc edi, eax
shr ebx, 0xf7
dec ecx
adc edi, 0xf922d2b0
mov si, word [edx + esi - 0x8000]
call fcn.017d6654
mov edx, 0xad15d19f
mov eax, dword [ebp]
movzx ecx, dx
rol cx, 0xf
lea ebp, [ebp + ecx - 0xe8cb]
call fcn.0196a9af
not dword [esi + 0x31]
jns 0x1b78625
mov byte [ecx], bh
or dword [ecx + 0x1d], eax
xor eax, 0x89ba7b9f
mov esi, 0xd93f35df
std
or dword [esi], esi
les esp, [eax]
adc al, byte [ebp + ecx*2 + 0x652b6f89]
sub bl, byte [ecx + 0xe]
add dword [esi + 0x1e], esi
jl 0x1b7863f
sti
xchg edi, eax
inc ecx
jge 0x1b785e8
push 0x216f9096
pop es
je 0x1b7861c
xchg edi, eax
aad 0xff
jle 0x1b78674
add dword [eax - 0x41], 0x14
mov edi, 0xfd57f9d9
cmpsd dword [esi], dword es:[edi]
ja 0x1b78666
mov bl, 0x22
daa
xchg byte [ebx + 0x14], bh
enter 0x4040, 0x22
add dl, byte [eax + 0x77]
xlatb
jmp 0x1b7861c
mov cl, 0x64
cwde
fdiv dword [esi + 0x42]
lcall 0x8ad0, 0x87d9fc87
mov edx, esi
test dword [ecx], ecx
cmpsb byte [esi], byte es:[edi]
xlatb
jbe 0x1b786a5
jmp 0x8db0ac85
pop esp
invalid
mov ecx, 0x2d3c6830
int 0x9c
int 0x88
sub eax, 0x88cd9ccd
adc byte [edi], bh
mov ebx, 0x4694de7d
jl 0x1b786e1
mov byte [eax + 0x3cf095a0], ch
int 0xa5
scasb al, byte es:[edi]
lea eax, [edx - 0x476ab4e8]
out 0xd9, al
rcr dword [edx], 1
dec ecx
or eax, esi
adc al, 0xc3
mov byte [0x417eb677], al
ja 0x1b78653
jle 0x1b786e0
mov cl, 0xe2
aad 0xa2
test byte [eax + 0x70a8f4eb], 0xb8
test al, bl
je 0x1b7870f
jmp 0x1b7869b
push ss
adc byte [edx], cl
fiadd word [ebp - 0x3c]
jne 0x1b78670
pushfd
jg 0x1b78702
mov dl, 0x41
push 0x28
hlt
mov ah, 0x45
les esi, [edx]
aad 0xb0
fist dword [edi - 0x6f8d0572]
mov ss, word [edx + 0x23]
xor bl, byte [ecx + ebx*8 + 0x58]
std
cmp ch, cl
cdq
xor bl, byte [edx]
movsb byte es:[edi], byte [esi]
mov esp, 0xd281db3e
cmpsd dword [esi], dword es:[edi]
scasb al, byte es:[edi]
xchg ebp, eax
fild dword ds:[ecx - 0x6a51582e]
fild dword [ecx - 0x6a51582e]
add al, 0x82
dec edi
pop ebp
xor ch, byte [ebp + 0x31]
xchg ebp, eax
mov bl, 0x24
jbe 0x1b786c5
add al, byte [edx]
lds edx, [ecx]
add ah, byte [edi]
mov eax, dword [0x2471454d]
pop ebx
lodsb al, byte [esi]
sbb cl, ah
add al, 0xb1
stosd dword es:[edi], eax
xor al, 0xc4
not ah
int3
add ecx, dword [esi - 0x1bd0e0e7]
fdivr qword [eax]
invalid

Function at 0x1b95815
Capabilities:
Authenticate hmac

Disassembly:
xor ebx, eax
rol ecx, 0x77
not ecx
adc edi, eax
pop ecx
jmp edi
not eax
rol eax, 2
mov dword [esp], edx
not eax
sub dword [esp], ecx
js 0x1b24787

Function at 0x1bb8e49
Capabilities:
Encode data using xor

Disassembly:
push 0x8ac8eaa
lea esp, [esp + 0x14]
je 0x1a72069
push ebx
Function at 0x1bd0cfd
Capabilities:
Encode data using base64

Disassembly:
inc eax
sub edx, 0x172b5035
shr al, 0x85
neg dword [esp + 4]
bswap edx
dec edx
ror cl, 0x45
xor ebx, edx
call fcn.017b4f8f
mov eax, 0x88917d10
mov edx, dword [edi]
mov cx, word [edi + 4]
dec ax
add edi, 2
shr cx, 1
rcr edx, cl
imul eax, eax
btc eax, eax
mov ecx, eax
mov dword [edi], edx
sal eax, cl
bt ecx, 0x83
xor cx, ax
sbb ebp, 4
mov edx, dword [ebp]
not al
xor edx, ebx
cwde
dec edx
sal eax, cl
shl ax, 0x86
dec ax
rol edx, 1
or eax, eax
neg ecx
idiv cl
sub edx, 0xa8b38cab
neg cx
call fcn.01acfa46
sysenter
call fcn.01a8af91
inc edx
neg byte [esp + 5]
mov dword [esp], ecx
rol edx, 1
inc ecx
js 0x1a3b3a2

Function at 0x1bed729
Capabilities:
Encode data using base64

Disassembly:
lea ebp, [ecx + ebp + 2]
add cl, ch
adc ax, dx
call fcn.01b0fe82

Function at 0x1bf237f
Capabilities:
Encode data using base64

Disassembly:
shr dl, 0x27
neg edx
bswap ecx
neg ecx
inc ecx
xor ebx, ecx
mov eax, 0xbb87bc0d
add byte [esp + 3], 0x97
adc edx, 0xdf1a9e8d
add edi, ecx
btc eax, eax
call fcn.019d8ff1
xor ecx, ebx
sub word [esp + 2], 0x5f9c
mov dword [esp + 4], 0x8c3ab901
mov edx, 0x6725f134
inc ecx
rol ecx, 1
inc ecx
jmp 0x1782ea6
mov ebp, dword [esp + 4]
mov dword [esp], 0x7f2870a6
mov ecx, dword [ebp]
add ebp, 4
jmp 0x17d00d9
Function at 0x1c037b8
Capabilities:
Encode data using base64

Disassembly:
mul ecx
mov ecx, 0x93a34317
not ecx
mov dword [edi + ecx - 0x6c5cbce8], edx
lea edx, [ecx - 0xdc661ee]
call fcn.0173b56f
mov eax, 0x5d99a517
mov edx, dword [eax + edi - 0x5d99a517]
mov ecx, dword [edi + eax - 0x5d99a513]
lea edi, [edi + eax - 0x5d99a513]
ror eax, 0xb3
not edx
rol ax, 0xca
not ecx
and edx, ecx
mov ecx, 0x7d0b142a
btc cx, cx
mov dword [eax + edi - 0x34a2cfae], edx
mov edx, eax
not dl
bt edx, 0x8d
mov edx, dword [ebp + eax - 0x34a2cfae]
lea ecx, [eax*2 - 0x19d67de6]
btc ax, 0x34
lea ebp, [ebp + ecx - 0x4f6f2172]
add cx, cx
add ax, cx
xor edx, ebx
sal cl, 0xe1
xor edx, 0x7afe73d
cbw
btc ecx, eax
inc edx
ror edx, 1
imul ecx, ecx
neg edx
btc eax, ecx
xor ecx, ecx
seta cl
xor ebx, edx
shr cl, 0x83
adc esi, edx
call fcn.019e7823
mov edx, 0x2da6bbae
mov ecx, edx
mov ecx, dword [ebp + ecx - 0x2da6bbae]
mov eax, edx
mov dl, byte [ebp + edx*2 - 0x5b4d7758]
bts eax, eax
push eax
pop eax
lea ebp, [ebp + eax*2 - 0x5b4df756]
bt eax, eax
mov byte es:[ecx + eax*2 - 0x5b4df75c], dl
lea esi, [eax + esi - 0x2da6fbb2]
lea ecx, [eax + eax*2 + 0x1b060280]
xor cx, ax
mov edx, dword [eax + esi - 0x2da6fbae]
ror cl, cl
xor edx, ebx
sar ecx, cl
push ecx
bswap edx
shr word [esp + eax*2 - 0x5b4df75b], 0xc
btr ecx, 1
sal eax, cl
ror edx, 1
sub edx, 0xfa1ab37
xor edx, 0x4f92d033
not dword [esp]
bswap ecx
xor ebx, edx
xchg dword [esp], eax
ror word [esp + eax - 0x17fff06f], 0x29
adc edi, edx
mov dword [esp + eax*2 - 0x2fffe0de], edi
ret
xor ebx, ecx
mul dword [esp + edx*4 - 0x6bcbc8b7]
add edi, ecx
push eax
rol ax, 0xad
lea ecx, [edx*2 - 0xb45d070]
mov dword [esp + edx*8 - 0x7aac138], edi
ret 0x10
ja 0x1842276
xchg dword [esp + ecx - 0x83], edx
dec ecx
bswap eax
rol eax, cl
call fcn.01ac0bc3
lea ecx, [eax + eax*8 + 0x2189a4a5]
mov ecx, dword [esi + edx*2 - 0x35e5e460]
lea esi, [esi + edx - 0x1af2f22c]
mov dword [esp + edx - 0x1af2f228], edx
xor ecx, ebx
neg ecx
not ecx
ror ecx, 2
or al, byte [esp + edx*2 - 0x35e5e454]
xor ecx, 0x5b055c36
mov dword [esp + edx*2 - 0x35e5e460], eax
bt ax, dx
jb 0x19d9ae3
jp 0x1aef4f1

Function at 0x1c0f812
Capabilities:
Encode data using xor

Disassembly:
mov dword [esp + edx - 0x7ae1633a], 0x14010084
jmp 0x15259f0
Function at 0x1c16e95
Capabilities:
Encode data using base64

Disassembly:
mov esi, 0xb50fc034
movzx ecx, si
ror cx, 0x43
mov ebx, ebp
lea esi, [esi*4 + 0x7a055417]
lea eax, [esi*2 + 0x3a9edfac]
mov eax, 0
sub ebx, eax
mov eax, 0x8db38198
lea esi, [0x16d6fdd]
lea ecx, [eax + eax*2 + 0x5b08d24]
inc ecx
sub ebp, 4
mov eax, dword [ebp]
not cl
xor eax, ebx
movzx edx, cl
jmp 0x1a45028
sbb edi, 8
jmp 0x19bf3b5
push 0x4881f590
mov dword [edi + 0xc], eax
push 0x54b64a22
pop eax
sal eax, 0x42
mov dword [edi + eax - 0x52d92880], ebx
mov ebx, 0x32e663f
mov dword [edi + eax - 0x52d92884], ecx
mov dword [eax + edi - 0x52d92888], edx
movsx edx, bl
pop ecx
sar al, 0x82
pop ebx
mov eax, dword [ebp + edx - 0x3f]
call fcn.01882ad6
shr eax, 0x1c
pop edx
pop ecx
pop edx
je 0x16d6fba
inc eax
rol cx, 0xee
neg eax
call fcn.01bf80c1
shrd dx, ax, cl
mov ecx, dword [esp]
lea eax, [ecx + ecx*8 - 0x616423cc]
mov word [esi], dx
lea ecx, [eax + eax + 0x673fa8a2]
sub edi, 4
mov edx, dword [esp]
mov eax, dword [edi]
xor eax, ebx
sub eax, edx
sal dx, 0xac
neg eax
ror byte [esp], 0x41
ror eax, 3
push edx
sal cl, 0x61
bts dx, cx
lea eax, [eax + ecx - 0x63d2fe5c]
sub byte [esp + 1], ch
xor ebx, eax
btr dx, dx
lea edx, [edx*8 + 0x74251518]
dec cl
adc ebp, eax
neg dl
call fcn.016d574e
add eax, 0xf5ba658f
sbb dword [0x207a1b88], eax
in al, dx
inc edi
cmp eax, 0xa6161b52
bound edx, qword [ebx - 0x5e84c10d]
dec esp
mov ebx, 0xb43499d9
or edx, dword [edx]
dec edi
jnp 0x1a45118
sahf
push edx
and eax, 0x31cf139c
adc byte [esi + 0x5ef9dc54], dl
adc eax, dword [eax + ebx]
xchg esi, eax
and eax, 0xa4e2a6eb
out dx, eax
popal
push esp
cmp eax, 0x84060e25
add byte [edx + 0x5a], ch
ret
cmc
insb byte es:[edi], dx
retf 0xd44c
cbw
mov eax, dword [edi]
mov ecx, dword [edi + 4]
mov edx, 0x5607f392
and dl, dh
mov dword [esp + edx - 0x5607f392], ebx
dec dl
cpuid
jno 0x18d0306

Function at 0x1c17c98
Capabilities:
Encode data using base64

Disassembly:
call fcn.0181bf93
inc ecx
pop esp
dec ecx
bt ebp, edx
rol eax, 3
movsx ebp, dx
sub eax, 0xa73c8a0c
push ebx
inc ecx
push ebp
dec esp
or dword [esp + edx - 0x7ffc], edi
dec esp
mov dword [esp + edx - 0x7ff8], ecx
dec ecx
btc esp, 0x23
inc esp
movzx esi, dl
xor dword [esp + edx*2 - 0xfff8], eax
call fcn.01b78581

Function at 0x1c17cd6
Capabilities:
Encode data using base64

Disassembly:
mov dword [esp], 0x509ddeaf
xor ebx, ecx
call 0x28b96b5
jmp 0x1a34e38

Function at 0x1c1e8de
Capabilities:
Encode data using xor

Disassembly:
and eax, dword [esp + ecx - 0xdf]
lea edx, [edx + ecx - 0x5e30327c]
neg edx
shr ecx, 0x24
xor ebx, edx
shl ecx, cl
adc ebp, edx
inc word [esp + eax - 0x50705847]
btc cx, ax
sar ecx, 0xe1
pop edx
pop ecx
pop edx
pop ecx
pop eax
pop edx
pop edx
pop edx
jp fcn.017d1626

Function at 0x1c44fd3
Capabilities:
Check for vm using instruction vpcext

Disassembly:
lea esp, [esp + 0x18]
jne 0x1779b16
mov edx, 0x4900c880
movzx edi, dl
lea ecx, [edi + edx*4 + 0x28a7ada7]
pop edi
Function at 0x287b8bc
Capabilities:
Encode data using base64

Disassembly:
jmp 0x1bac8e3
jmp 0x16f7723
adc esi, 6
jmp 0x1703e34
jg 0x1c0a738
inc ecx
lea eax, [edx + eax*2 + 0x5e2e1a26]
rol ecx, 1
cwde
shl eax, 0x32
xor al, 0x87
bswap ecx
push eax
xor ebx, ecx
xor al, 0xaa
add edx, eax
adc edi, ecx
mov dl, byte [ebp + edx - 0x1b68002d]
mov dword [esp + eax*2 - 0x36d0005a], eax
mov cl, byte [ebp + eax*2 - 0x36d00058]
idiv al
lea ebp, [ebp + eax - 0x1b67ffff]
shr al, 0x82
shr dl, cl
pop eax
ror al, 0xc6
call fcn.01b4cd57
xor edx, 0x972b5a99
push ecx
xor ebx, edx
sal word [esp + eax - 0x7e9ffff9], 0x8c
push ecx
add esi, edx
dec ecx
rol al, 0xa1
pop eax
pop ecx
pop edx
jp fcn.01952f1c
movzx ebx, bx

Function at 0x28879c3
Capabilities:
Encode data using xor

Disassembly:
push 0x7d3079a3
xor ecx, ecx
call fcn.01937438
xor eax, ebx
sal edx, 0xd7
shr cx, 0xca
imul edx, edx
lea eax, [eax + ecx - 0x7ee5a03a]
neg eax
dec eax
xor eax, 0x7239199c
call fcn.016f1aec

Function at 0x289e3d5
Capabilities:
Encode data using base64

Disassembly:
sbb byte [ebp + 0xfa2bc35], bl
ror byte [edi], 0x9a
ror dword [ebx], 0xc9
neg edx
and eax, 0x9abf1102
call fcn.01878c35
cmp ebx, eax
add al, 0xe8
pop esi
mov byte [0xd0961cb4], al
xor eax, 0xf1fd25
add byte [ecx - 0x4c41b853], bl
arpl word [eax + ebx - 0x2d], cx
jnp 0x18503f1
push cs
dec ebx
rol ecx, cl
in al, dx
fmulp st(6)
adc esp, dword [edi - 0x5b]
add ebp, esp
inc esi
daa
iretd
lea esp, [esp + 4]
jmp 0x17c3226
inc ecx
xor edx, 0x68a2219f
inc esp
and edi, ecx
inc esi
xchg byte [esp + edi - 0xea1609], ch
inc ecx
neg edx
sal dl, 0xc1
inc ecx
push esi
inc edi
lea edx, [edx + edi*2 - 0x1878f745]
inc edx
rol dword [esp + edi*2 - 0x1d42c27], cl
inc ecx
movsx ebx, si
jne 0x176d1d6
mov edx, 0x8207db90
shl dx, 0x87
sbb edi, 3
push edx
mov dword [esp], edx
lea eax, [edx - 0x2b57fb5c]
mov edx, dword [edi + eax - 0x56afcca4]
xchg ah, al
xchg ah, al
xor edx, ebx
ror edx, 3
jmp 0x1850404
rol ecx, 1
not ecx
neg dword [esp]
xor dword [esp], 0xdc026438
sbb ecx, 0xacaff12b
not ecx
xor ecx, 0xf79163a7
jmp 0x289b37e
sar dword [esp], 0x14
adc ecx, 0xb93ea9a3
ror dword [esp], 0x61
not ecx
xor ebx, ecx
add edi, ecx
jmp 0x18cdbab
not bx
inc ebp
movsx edi, bp
dec edi
lea esp, [edi + ebp*4 - 0x4ae30c5c]
add bx, 0x1600
inc ecx
mov esi, 0xda9daf19
dec ebp
lea edi, [esi + ecx*4 - 0x4261b3ff]
inc sp
xor ecx, ebx
inc ecx
mov ebp, ebp
dec eax
sub esi, 2
inc esp
mov edx, ecx
inc ecx
sal bh, 0x23
inc dx
mov dword [esi + edx*2 - 0x41d72dd6], ebx
inc esi
sub dword [esp + edx*2 - 0x41d72dcd], esi
inc ecx
ror esp, 0x98
dec edi
lea ebx, [ebx + edx - 0x20eb96ef]
dec eax
lea edx, [ecx + ebp*4 - 0x4fda2af2]
inc esp
btc edx, edi
inc edi
mov edx, dword [ebx + edx - 0x20eb96eb]
dec eax
xor ebp, 0xbf397521
dec eax
mov dword [esp + edx - 0x31de687d], 0x92bdbb1e
inc ebp
xor edx, ecx
dec ecx
or ebp, ebp
movzx eax, dx
add word [esp + ebp + 0x40c480e1], 0x8619
inc ecx
not edx
jae 0x186d0d9
dec eax
rol dword [esp + edx - 0x31de686d], cl
jne 0x19dbb90
push 0xc005733f
xor ecx, ebx
jmp 0x27eb254
Function at 0x28c5a20
Capabilities:
Encode data using xor

Disassembly:
add esi, ecx
shl byte [esp + eax - 0x4fd2485b], 6
sal byte [esp + eax - 0x4fd24859], 0xe6
mov dx, word [eax + edi - 0x4fd24860]
lea ecx, [eax*4 - 0x6747bfd8]
mov cx, word [edi + eax - 0x4fd2485e]
lea eax, [eax + eax*2 + 0x6114198b]
call fcn.018e4bbc
int1
add edi, edi
dec esp
jge 0x28c5aab
ror byte es:[edi + 0x3b], 1
cld
jle 0x28c5ade
dec ebp
sub eax, 0x1cd30dd8
lodsb al, byte [esi]
or dl, byte [ebx - 0x576ebd50]
dec esp
mov ebp, 0xe736282e
dec edi
push eax
xchg esi, eax
leave
jge 0x28c5a52
imul byte [ebp + 0x36]
bound edi, qword [ecx + 0x50]
push ebp
enter 0xffffffffffff9a07, 0xffffffffffffff85
lodsb al, byte [esi]
leave
xor dword [0x26361536], esi
fsubrp st(6)
mov eax, dword [0x8396dfc9]
leave
or byte [edi + eax*8 + 0x31], cl
nop
enter 0xffffffffffffd3b2, 0xffffffffffffffd5
bound ebp, qword [esi + 0x34]
and eax, 0xd075056d
aad 0xd0
mov ah, 0x54
push esi
adc dword [ebx - 0x46d6bec1], edi
mov ebx, 0xb929413f
std
pop dx
mov ah, 0x42
push 0x1e
js 0x28c5aeb
xor al, 6
rcr edi, cl
mov byte [0x85dda221], al
mov ch, 0x1a
insd dword es:[edi], dx
invalid
push ss
mov cl, 0x25
jbe 0x28c5b2a
xor dword [edx - 0x40bed763], eax
sub eax, 0xd2d0645c
rcl dl, 1
lds eax, [edi - 0x55ae5a53]
jo 0x28c5ae3
lodsb al, byte [esi]
pop esi
mov ecx, dword ds:[eax]
test eax, 0x97ba3c6d
mov esp, 0x6ea4c1fb
sbb dh, bh
push edi
push esp
invalid
xor ebp, edx
cmp ebp, dword [ebx + 0x2d]
rol edi, 1
cmp dword [eax + 0x2f752ff2], edi
aad 0x3b
imul ebp, dword [0xb839c7d1], 0xfffffff2
das
jne 0x28c5b65
xchg edi, eax
invalid
fdivrp st(7)
loopne 0x28c5b29
push eax
jne 0x28c5bd1
stosb byte es:[edi], al
pop ss
fdiv st(7), st(0)
retf
push ecx
in eax, 0x6b
clc
adc al, al
stosd dword es:[edi], eax
loop 0x28c5c37
and ah, bh
mov ecx, 0xe33fb762
dec ebp
out 0x60, eax
xchg edi, eax
ljmp 0xc68f
salc
out 3, al
scasd eax, dword es:[edi]
ror byte [esi - 0x20], cl
fild word [esi]
xchg ebp, eax
retf 0x93b0

Function at 0x28c740d
Capabilities:
Execute syscall

Disassembly:
mov edx, dword [ebp + ecx - 0x13a81066]
jne 0x18d8f82
add ecx, 0x97336a96
mov eax, 0xe8c8013
ror ax, 0xcc
bswap ecx
adc eax, eax
shr eax, 0xb3
inc ecx
xor ecx, 0x1730171a
xor ebx, ecx
add eax, eax
ror eax, 0x29
add edi, ecx
mov ecx, dword [ebp]
ror al, 0x81
mov eax, dword [ebp + 4]
call fcn.0173470b
mov ecx, 0x7a2c598b
lea edx, [ecx*2 + 0x2221f52f]
mov eax, ecx
mov eax, ebp
btr ecx, ecx
inc edx
lea ebp, [ebp + ecx - 0x7a2c518d]
mov word [ebp + edx - 0x167aa846], ax
lea esi, [ecx + esi - 0x7a2c518f]
sal dl, 0xe4
add edx, 0x621d913e
jle 0x1bfae7f
mov ecx, dword [esi + ecx - 0x7a2c518b]
xor ecx, ebx
inc dl
inc ecx
shl edx, 0x3e
call fcn.01533a2a
Function at 0x10005090
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1001f8a0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
push ebx
mov eax, ecx
push esi
push edi
push 8
mov dword [ebp - 0x10], eax
mov dword [eax], vtable.std::basic_streambuf_char__struct_std::char_traits_char__.0
call fcn.10007895
mov esi, eax
push 1
mov dword [ebp - 4], 0
call fcn.10006e9f
mov dword [esi + 4], eax
add esp, 8
mov eax, dword [ebp - 0x10]
lea edi, [eax + 0x14]
lea ecx, [eax + 0x18]
lea edx, [eax + 0x24]
mov dword [eax + 0x34], esi
lea ebx, [eax + 4]
mov dword [eax + 0xc], ebx
lea esi, [eax + 8]
mov dword [eax + 0x10], esi
mov dword [eax + 0x1c], edi
mov dword [eax + 0x20], ecx
mov dword [eax + 0x2c], edx
add eax, 0x28
mov dword [ebp - 0x14], ebx
mov ebx, dword [ebp - 0x10]
mov dword [ebx + 0x30], eax
mov ebx, dword [ebp - 0x14]
mov dword [esi], 0
mov dword [ecx], 0
mov ecx, dword [ebp - 0xc]
mov dword [eax], 0
mov eax, dword [ebp - 0x10]
mov dword [ebx], 0
mov dword [edi], 0
pop edi
pop esi
mov dword [edx], 0
pop ebx
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
Function at 0x1000f401
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x1000f440
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x1000f440
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x1000f440
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x1000f440
cmp dword [ecx + 0x74], 0xe
jbe 0x1000f440
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret
Function at 0x10013fc1
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x10023360
push 0x10023358
push str.FlsAlloc
push 0x1f
call fcn.10013e89
mov esi, eax
add esp, 0x10
test esi, esi
je 0x10013ff5
push dword [ebp + 8]
mov ecx, esi
call dword [0x10020144]
call esi
jmp 0x10013ffb
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
pop esi
pop ebp
ret 4

Function at 0x1001403f
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x10023370
push 0x10023368
push str.FlsGetValue
push 0x21
call fcn.10013e89
mov esi, eax
add esp, 0x10
test esi, esi
je 0x10014076
push dword [ebp + 8]
mov ecx, esi
call dword [0x10020144]
call esi
pop esi
pop ebp
ret 4
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsGetValue]

Function at 0x1001407e
Capabilities:
Set thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x10023378
push 0x10023370
push str.FlsSetValue
push 0x22
call fcn.10013e89
mov esi, eax
add esp, 0x10
test esi, esi
je 0x100140b8
push dword [ebp + 0xc]
mov ecx, esi
push dword [ebp + 8]
call dword [0x10020144]
call esi
pop esi
pop ebp
ret 8
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsSetValue]
Function at 0x100148e4
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, 0x101c
call fcn.100086c0
mov eax, dword [0x10031048]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x14]
push ebx
push dword [ebp + 8]
mov dword [ebp - 0x100c], eax
call fcn.10012573
pop ecx
mov ecx, dword [ebp + 8]
mov ebx, eax
cmp dword [ecx + 8], 0
jne 0x10014926
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 0x10]
jmp 0x10014a82
mov eax, dword [ecx]
sub eax, dword [ecx + 4]
push esi
push edi
push 0
cdq
push 2
push edx
push eax
call fcn.1001f5d0
push dword [ebp - 0x100c]
mov ecx, ebx
mov dword [ebp - 0x1008], eax
mov esi, ebx
mov dword [ebp - 0x1018], edx
and ecx, 0x3f
sar esi, 6
imul edi, ecx, 0x38
push 0
mov eax, dword [esi*4 + 0x10032990]
push dword [eax + edi + 0x24]
push dword [eax + edi + 0x20]
push ebx
call fcn.100156e5
mov ecx, dword [esi*4 + 0x10032990]
add esp, 0x14
mov dword [ebp - 0x1010], eax
mov eax, edx
mov edx, dword [ebp - 0x1010]
mov dword [ebp - 0x101c], eax
cmp edx, dword [ecx + edi + 0x20]
jne 0x10014a7b
cmp eax, dword [ecx + edi + 0x24]
jne 0x10014a7b
push 0
lea eax, [ebp - 0x1014]
push eax
push 0x1000
lea eax, [ebp - 0x1004]
push eax
push dword [ecx + edi + 0x18]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x10014a7b
push dword [ebp - 0x100c]
push 0
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push ebx
call fcn.100156e5
add esp, 0x14
test edx, edx
jl 0x10014a7b
jg 0x100149f1
test eax, eax
jb 0x10014a7b
mov ebx, dword [ebp - 0x1018]
mov eax, dword [ebp - 0x1014]
test ebx, ebx
jg 0x10014a7b
jl 0x10014a0b
cmp dword [ebp - 0x1008], eax
ja 0x10014a7b
lea edi, [ebp - 0x1004]
xor edx, edx
add edi, eax
lea ecx, [ebp - 0x1004]
xor esi, esi
cmp dword [ebp - 0x1008], edx
jne 0x10014a29
test ebx, ebx
je 0x10014a62
cmp ecx, edi
jae 0x10014a62
mov al, byte [ecx]
cmp al, 0xd
jne 0x10014a43
lea eax, [edi - 1]
cmp ecx, eax
jae 0x10014a4f
cmp byte [ecx + 1], 0xa
jne 0x10014a4f
inc ecx
jmp 0x10014a4f
movzx eax, al
movsx eax, byte [eax + 0x100312c8]
add ecx, eax
add esi, 1
adc edx, 0
inc ecx
cmp esi, dword [ebp - 0x1008]
jne 0x10014a29
cmp edx, ebx
jne 0x10014a29
lea eax, [ebp - 0x1004]
sub ecx, eax
mov eax, ecx
cdq
add eax, dword [ebp - 0x1010]
adc edx, dword [ebp - 0x101c]
jmp 0x10014a80
or edx, 0xffffffff
mov eax, edx
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop ebx
call fcn.10007f50
leave
ret
Function at 0x10014b7d
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [ebp + 8]
mov ecx, eax
push ebx
mov ebx, dword [ebp + 0xc]
and eax, 0x3f
sar ecx, 6
push esi
push edi
imul edi, eax, 0x38
mov eax, dword [ecx*4 + 0x10032990]
mov dword [ebp - 0xc], ecx
mov ecx, dword [edi + eax + 0x18]
mov dword [ebp - 0x14], ecx
mov ecx, dword [ebp + 0x10]
test ecx, ecx
je 0x10014bbd
cmp byte [ebx], 0xa
jne 0x10014bbd
or byte [edi + eax + 0x28], 4
jmp 0x10014bc2
and byte [edi + eax + 0x28], 0xfb
add ecx, ebx
mov eax, ebx
mov dword [ebp - 0x10], ecx
mov esi, ebx
mov dword [ebp - 8], eax
cmp ebx, ecx
jae 0x10014cc1
mov dl, byte [eax]
cmp dl, 0x1a
je 0x10014ca4
inc eax
cmp dl, 0xd
je 0x10014bee
mov dword [ebp - 8], eax
mov byte [esi], dl
jmp 0x10014c14
cmp eax, ecx
jae 0x10014c22
mov cl, byte [eax]
xor eax, eax
cmp cl, 0xa
sete al
inc eax
add dword [ebp - 8], eax
cmp cl, 0xa
sete al
dec al
and al, 3
add al, 0xa
mov byte [esi], al
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 0x10]
xor edx, edx
inc edx
add esi, edx
cmp eax, ecx
jb 0x10014bd6
jmp 0x10014cc1
push 0
lea eax, [ebp - 0x10]
push eax
push 1
lea eax, [ebp - 1]
push eax
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x10014c9f
cmp dword [ebp - 0x10], 0
je 0x10014c9f
mov ecx, dword [ebp - 0xc]
mov eax, dword [ecx*4 + 0x10032990]
test byte [eax + edi + 0x28], 0x48
je 0x10014c79
mov dl, byte [ebp - 1]
lea eax, [esi + 1]
mov dword [ebp - 0x14], eax
cmp dl, 0xa
jne 0x10014c64
mov byte [esi], dl
jmp 0x10014c75
mov byte [esi], 0xd
mov eax, dword [ecx*4 + 0x10032990]
mov byte [eax + edi + 0x2a], dl
mov eax, dword [ebp - 0x14]
mov esi, eax
jmp 0x10014cc1
cmp byte [ebp - 1], 0xa
jne 0x10014c88
cmp esi, ebx
jne 0x10014c88
mov byte [esi], 0xa
jmp 0x10014cc0
push 1
push 0xffffffffffffffff
push 0xffffffffffffffff
push dword [ebp + 8]
call fcn.10015703
add esp, 0x10
cmp byte [ebp - 1], 0xa
je 0x10014cc1
mov byte [esi], 0xd
jmp 0x10014cc0
mov ecx, dword [ebp - 0xc]
mov ecx, dword [ecx*4 + 0x10032990]
mov al, byte [ecx + edi + 0x28]
test al, 0x40
jne 0x10014cbe
or al, 2
mov byte [ecx + edi + 0x28], al
jmp 0x10014cc1
mov byte [esi], dl
inc esi
sub esi, ebx
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret