joyce8/EMBER2024-capa huggingface dataset:
Function at 0x405ef4
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
cmp dword [0x422a34], 0
push esi
jne 0x405f2b
xor ecx, ecx
push 8
mov eax, ecx
pop esi
mov edx, eax
and dl, 1
neg dl
sbb edx, edx
and edx, 0xedb88320
shr eax, 1
xor eax, edx
dec esi
jne 0x405f05
mov dword [ecx*4 + 0x422a30], eax
inc ecx
cmp ecx, 0x100
jl 0x405f00
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 8]
test edx, edx
not eax
jbe 0x405f5c
mov ecx, dword [esp + 0xc]
push edi
movzx edi, byte [ecx]
mov esi, eax
and esi, 0xff
xor esi, edi
shr eax, 8
mov esi, dword [esi*4 + 0x422a30]
xor eax, esi
inc ecx
dec edx
jne 0x405f3e
pop edi
not eax
pop esi
ret 0xc

Function at 0x42e000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..text
nop
nop
nop
nop
push 4
nop
nop
nop
pop edi
nop
nop
cmp eax, 0
nop
nop
nop
nop
je 0x42e072
nop
nop
nop
mov ebx, 0x407ef8
nop
mov ecx, ebx
nop
nop
nop
nop
nop
nop
nop
sub ecx, eax
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
nop
push eax
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
nop
nop
div edi
xchg ecx, eax
nop
nop
nop
nop
nop
pop eax
nop
nop
nop
nop
nop
mov esi, 0x6ec46321
nop
nop
nop
xor dword [eax], esi
nop
nop
add eax, edi
nop
nop
nop
nop
nop
nop
loop 0x42e060
nop
nop
mov eax, section..data
nop
cmp eax, 0
nop
nop
nop
nop
je 0x42e0d2
nop
nop
nop
nop
mov ebx, 0x42cd70
nop
nop
nop
mov ecx, ebx
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
nop
xor edx, edx
push eax
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
nop
div edi
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
pop eax
nop
nop
nop
nop
nop
nop
mov esi, 0x2ee71795
xor dword [eax], esi
nop
nop
nop
nop
nop
nop
nop
nop
add eax, edi
loop 0x42e0c0
nop
nop
nop
nop
popal
nop
nop
nop
nop
nop
jmp 0x401219

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x417f2e
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
pushal
call 0x417f3d
pop dword [ebp - 0x28]
mov eax, 0xc902eb57
sub eax, 0xc8c16c1a
sub dword [ebp - 0x28], eax
push 0x40
push 0x1000
push 0x3c394
push 0
mov eax, sym.imp.kernel32.dll_VirtualAlloc
add eax, dword [ebp - 0x28]
call dword [eax]
mov ecx, 0x54b3
xor edx, edx
add edx, eax
mov edi, 0x9cf3216a
add edi, 0x63504c96
add edi, dword [ebp - 0x28]
mov esi, 0xf7838a66
sub esi, 0x356dbc6f
mov dword [ebp - 0xc], 0xe7b23413
mov ebx, dword [edi]
sub dword [ebp - 0x14], ecx
xor ebx, esi
xor dword [ebp - 0x24], edx
mov dword [edx], ebx
mov dword [ebp - 0x14], 0xcfdf030f
add edx, 4
add edi, 0xbee8dc57
sub edi, 0xbee8dc53
loop 0x417f93
add eax, 0x1459f
mov ebx, eax
add eax, 0xa802654a
sub eax, 0xa8026545
mov ecx, 0x6dcd22a7
sub ecx, 0x6d8d22a7
add ecx, dword [ebp - 0x28]
call ebx
leave
ret

Function at 0x41e7e0
Capabilities:
Check os version
Get common file path

Disassembly:
sub esp, 0x2d4
push esi
call dword [sym.imp.kernel32.dll_GetVersion]
cmp ax, 6
je 0x41e81d
push str.SetDefaultDllDirectories
push 0x429a14
call dword [sym.imp.kernel32.dll_GetModuleHandleW]
push eax
call dword [sym.imp.kernel32.dll_GetProcAddress]
test eax, eax
je 0x41e81d
push 0xc00
call eax
test eax, eax
jne 0x41e8b6
lea eax, [esp + 8]
push 0x106
push eax
call dword [sym.imp.kernel32.dll_GetSystemDirectoryW]
test eax, eax
je 0x41e8b6
cmp eax, 0x104
ja 0x41e8b6
cmp word [esp + eax*2 + 6], 0x5c
je 0x41e84c
mov word [esp + eax*2 + 8], 0x5c
inc eax
mov esi, dword [str.userenv]
cmp byte [esi], 0
je 0x41e8b6
push ebp
lea ecx, [esp + eax*2 + 0xc]
push edi
mov edi, dword [sym.imp.kernel32.dll_LoadLibraryExW]
mov dword [esp + 0xc], ecx
mov ebp, 0x6c
mov cl, byte [esi]
mov eax, dword [esp + 0xc]
inc esi
test cl, cl
je 0x41e88b
xor dx, dx
add eax, 2
mov dl, cl
inc esi
mov word [eax - 2], dx
mov cl, byte [esi - 1]
test cl, cl
jne 0x41e877
mov word [eax], 0x2e
mov word [eax + 2], 0x64
mov word [eax + 4], bp
mov word [eax + 6], bp
mov word [eax + 8], 0
push 8
lea eax, [esp + 0x14]
push 0
push eax
call edi
cmp byte [esi], 0
jne 0x41e86c
pop edi
pop ebp
pop esi
add esp, 0x2d4
ret
Function at 0x40d5a8
Capabilities:
Link many functions at runtime
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x419428]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_EncodePointer]
push esi
push edi
mov dword [ebp - 0x1c], eax
xor esi, esi
mov eax, dword [ebp + 0xc]
push esi
mov dword [ebp - 0x20], eax
call ebx
mov edi, eax
mov dword [ebp - 0x18], edi
call fcn.0040802b
mov dword [ebp - 0x14], eax
cmp dword [0x4ad520], esi
jne 0x40d69b
push 0x800
push esi
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
jne 0x40d628
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x57
jne 0x40d77b
push esi
push esi
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
je 0x40d77b
push str.MessageBoxW
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x40d77b
push eax
call ebx
push str.GetActiveWindow
push edi
mov dword [0x4ad520], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetLastActivePopup
push edi
mov dword [0x4ad524], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetUserObjectInformationW
push edi
mov dword [0x4ad528], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x4ad530], eax
test eax, eax
je 0x40d698
push str.GetProcessWindowStation
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x4ad52c], eax
mov edi, dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x40d6c0
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x40d6b3
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp dword [ebp - 0x14], esi
je 0x40d6d5
push 4
pop eax
jmp 0x40d77d
cmp dword [ebp - 0x14], esi
je 0x40d6d5
push dword [0x4ad520]
call dword [sym.imp.KERNEL32.dll_DecodePointer]
push 3
jmp 0x40d6ba
mov eax, dword [0x4ad52c]
mov ebx, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, edi
je 0x40d733
cmp dword [0x4ad530], edi
je 0x40d733
push eax
call ebx
push dword [0x4ad530]
mov dword [ebp - 0x14], eax
call ebx
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
test ecx, ecx
je 0x40d733
test eax, eax
je 0x40d733
call ecx
test eax, eax
je 0x40d728
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call dword [ebp - 0x18]
test eax, eax
je 0x40d728
test byte [ebp - 8], 1
jne 0x40d733
mov edi, dword [ebp + 0x10]
or edi, 0x200000
jmp 0x40d763
mov eax, dword [0x4ad524]
cmp eax, edi
je 0x40d760
push eax
call ebx
test eax, eax
je 0x40d760
call eax
mov esi, eax
test esi, esi
je 0x40d760
mov eax, dword [0x4ad528]
cmp eax, edi
je 0x40d760
push eax
call ebx
test eax, eax
je 0x40d760
push esi
call eax
mov esi, eax
mov edi, dword [ebp + 0x10]
push dword [0x4ad520]
call ebx
test eax, eax
je 0x40d77b
push edi
push dword [ebp - 0x20]
push dword [ebp - 0x1c]
push esi
call eax
jmp 0x40d77d
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0040432c
mov esp, ebp
pop ebp
ret
Function at 0x40d8ee
Capabilities:
Hash data using sha1

Disassembly:
mov eax, dword [esp + 4]
and dword [eax + 0x18], 0
and dword [eax + 0x14], 0
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
mov dword [eax + 0x10], 0xc3d2e1f0
ret 4

Function at 0x1000125c
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
mov dword [ebp - 0xc], 0
call sub.KERNEL32.DLL_GetEnvironmentStringsA
mov ebx, eax
mov dword [ebp - 0x10], ebx
jmp 0x10001299
cmp byte [ebx], 0x3d
je 0x10001285
inc dword [ebp - 0xc]
mov edi, ebx
xor eax, eax
stc
sbb ecx, ecx
repne scasb al, byte es:[edi]
neg ecx
lea eax, [ecx - 2]
mov edi, eax
inc edi
lea ebx, [ebx + edi]
cmp byte [ebx], 0
jne 0x10001278
mov edi, dword [ebp - 0xc]
inc edi
lea edi, [edi*4]
mov dword [ebp - 0x14], edi
push dword [ebp - 0x14]
call sub.CRTDLL.DLL_malloc
pop ecx
mov dword [ebp - 8], eax
mov dword [0x10003010], eax
cmp dword [ebp - 8], 0
jne 0x100012cc
xor eax, eax
jmp 0x10001342
mov ebx, dword [ebp - 0x10]
jmp 0x10001325
mov edi, ebx
xor eax, eax
stc
sbb ecx, ecx
repne scasb al, byte es:[edi]
neg ecx
lea eax, [ecx - 2]
mov edi, eax
inc edi
mov dword [ebp - 4], edi
cmp byte [ebx], 0x3d
je 0x1000131f
push dword [ebp - 4]
call sub.CRTDLL.DLL_malloc
pop ecx
mov esi, dword [ebp - 8]
mov dword [esi], eax
or eax, eax
jne 0x10001308
jmp 0x10001342
push ebx
mov edi, dword [ebp - 8]
push dword [edi]
call sub.CRTDLL.DLL_strcpy
add esp, 8
add dword [ebp - 8], 4
mov edx, dword [ebp - 4]
lea ebx, [ebx + edx]
cmp byte [ebx], 0
jne 0x100012d1
mov edx, dword [ebp - 8]
mov dword [edx], 0
mov eax, 1
pop edi
pop esi
pop ebx
leave
ret
Function at 0x10001260
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x24c
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x1c], esp
mov dword [ebp - 0x10], 0xffffffff
mov dword [ebp - 0x14], 0x100025d0
lea ecx, [ebp - 0x18]
mov edx, dword fs:[0]
test eax, eax
mov dword [ebp - 0x18], edx
mov dword fs:[0], ecx
je 0x100013e5
cmp eax, 1
jne 0x100013f9
lea edi, [ebp - 0x258]
mov dword [ebp - 0x44], str.d3d9.dllDirect3DCreate9
mov dword [ebp - 0x40], 8
push 0x208
push 0
push edi
call fcn.10027060
add esp, 0xc
push 0x104
push edi
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
lea ebx, [ebp - 0x50]
lea esi, [ebp - 0x2c]
mov dword [ebp - 0x50], edi
push ebx
push esi
call fcn.10003de0
add esp, 8
cmp dword [ebp - 0x2c], 0x80000000
je 0x10001411
mov eax, dword [ebp - 0x24]
movsd xmm0, qword [ebp - 0x2c]
lea edx, [ebp - 0x38]
lea ecx, [ebp - 0x44]
mov dword [ebp - 0x258], 0x1002d108
mov dword [ebp - 0x254], 2
mov dword [ebp - 0x248], 0
mov dword [ebp - 0x250], esi
mov dword [ebp - 0x24c], 2
mov dword [ebp - 0x10], 0
mov dword [ebp - 0x2c], edx
mov dword [ebp - 0x28], 0x10001100
mov dword [ebp - 0x24], ecx
mov dword [ebp - 0x20], 0x10002650
mov dword [ebp - 0x30], eax
movsd qword [ebp - 0x38], xmm0
push edi
push ebx
call fcn.10021e70
add esp, 8
lea eax, [ebp - 0x50]
push eax
call fcn.10003cf0
add esp, 4
mov dword [ebp - 0x2c], eax
lea eax, [ebp - 0x2c]
mov dword [ebp - 0x10], 1
push eax
call fcn.10003da0
add esp, 4
push edx
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
test eax, eax
mov dword [ebp - 0x3c], eax
je 0x1000142b
lea eax, [ebp - 0x2c]
mov dword [ebp - 0x10], 0
push eax
call fcn.100039f0
add esp, 4
mov eax, dword [ebp - 0x38]
mov esi, dword [ebp - 0x3c]
test eax, eax
je 0x100013bd
push 1
push eax
push dword [ebp - 0x34]
call fcn.10002720
add esp, 0xc
mov dword [ebp - 0x10], 0xffffffff
push 0x1002d2a0
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x10001465
mov dword [0x100651b4], esi
mov dword [0x100651b0], eax
jmp 0x100013f9
mov eax, dword [0x100651b4]
test eax, eax
je 0x100013f9
push eax
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
test eax, eax
je 0x1000146f
mov eax, dword [ebp - 0x18]
mov dword fs:[0], eax
mov al, 1
add esp, 0x24c
pop esi
pop edi
pop ebx
pop ebp
ret 0xc
lea eax, [ebp - 0x38]
push 0x1002d0f4
push 0x1002d0ac
push eax
push 0x2b
push 0x1002d060
call fcn.1002bba0
call fcn.100040b0
mov dword [ebp - 0x258], eax
mov dword [ebp - 0x254], edx
mov dword [ebp - 0x10], 2
push 0x1002d118
push 0x1002d09c
lea eax, [ebp - 0x258]
push eax
push 0x2b
push 0x1002d060
call fcn.1002bba0
add esp, 0x14
jmp 0x100014a7
push 0x1002d2b0
call fcn.1002b770
call fcn.100040b0
mov dword [ebp - 0x258], eax
mov dword [ebp - 0x254], edx
mov dword [ebp - 0x10], 3
lea eax, [ebp - 0x258]
push 0x1002d2c0
push 0x1002d09c
push eax
push 0x2b
push 0x1002d060
call fcn.1002bba0
add esp, 0x14
ud2
Function at 0x1000d130
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x438
mov dword [ebp - 0x1c], esp
mov dword [ebp - 0x10], 0xffffffff
mov dword [ebp - 0x14], 0x1001af10
mov esi, 0x200
lea eax, [ebp - 0x18]
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x24], 2
mov ecx, dword fs:[0]
mov dword [ebp - 0x18], ecx
mov dword fs:[0], eax
mov dword [ebp - 0x34], 0
mov dword [ebp - 0x30], 2
mov dword [ebp - 0x2c], 0
cmp esi, 0x201
jae 0x1000d1c0
jmp 0x1000d1ae
jbe 0x1000d246
cmp esi, 0x201
jae 0x1000d1c0
mov dword [ebp - 0x28], 0x200
lea ebx, [ebp - 0x444]
mov edi, esi
jmp 0x1000d1f1
mov edi, dword [ebp - 0x20]
sub esi, edi
je 0x1000d1e5
mov dword [ebp - 0x10], 0
lea ecx, [ebp - 0x34]
mov edx, edi
push esi
call fcn.1002ae70
add esp, 4
mov edi, dword [ebp - 0x34]
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x24], eax
mov ebx, dword [ebp - 0x24]
mov dword [ebp - 0x2c], edi
mov dword [ebp - 0x28], edi
mov dword [ebp - 0x20], edi
push 0
call dword [sym.imp.KERNEL32.dll_SetLastError]
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
mov esi, eax
test eax, eax
jne 0x1000d215
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x1000d2a9
cmp esi, edi
jne 0x1000d1a0
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
jne 0x1000d2c8
lea esi, [edi + edi]
test edi, edi
mov eax, 0xffffffff
cmovs esi, eax
cmp esi, 0x201
jb 0x1000d1ae
jmp 0x1000d1c0
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x10], 0
cmp esi, eax
ja 0x1000d2e5
lea eax, [ebp - 0x44]
push esi
push ebx
push eax
call fcn.100101f0
add esp, 0xc
movsd xmm0, qword [ebp - 0x44]
mov esi, dword [ebp + 8]
movsd xmm1, qword [ebp - 0x3c]
movsd qword [esi + 8], xmm1
movsd qword [esi], xmm0
mov eax, dword [ebp - 0x20]
test eax, eax
je 0x1000d293
add eax, eax
push 2
push eax
push dword [ebp - 0x24]
call fcn.10002720
add esp, 0xc
mov eax, dword [ebp - 0x18]
mov dword fs:[0], eax
mov eax, esi
add esp, 0x438
pop esi
pop edi
pop ebx
pop ebp
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, dword [ebp + 8]
mov byte [esi + 4], 0
mov dword [esi + 8], eax
mov dword [esi], 0x80000000
mov eax, dword [ebp - 0x20]
test eax, eax
jne 0x1000d283
jmp 0x1000d293
mov dword [ebp - 0x10], 0
push 0x1005ee08
push 0x28
push str.internal_error:_entered_unreachable_code_rustc_25ef9e3d85d934b27d9dada2f9dd52b1dc63bb04library_alloc_src_vecmod.rsh
call fcn.1002b8c0
add esp, 0xc
jmp 0x1000d2f4
push 0x1005edf8
push eax
push esi
call fcn.1002bc90
add esp, 0xc
ud2
Function at 0x1000d660
Capabilities:
Encode data using xor

Disassembly:
push ebx
push edi
push esi
mov ebx, dword [esp + 0x18]
test ebx, ebx
je 0x1000d7a3
js 0x1000d7de
movzx eax, byte [0x100651b9]
push 1
push ebx
call fcn.10002710
add esp, 8
test eax, eax
je 0x1000d7e3
mov esi, eax
mov edi, eax
push ebx
push dword [esp + 0x18]
push esi
call fcn.100271c0
add esp, 0xc
cmp ebx, 8
mov ecx, esi
jb 0x1000d7ae
xor eax, eax
cmp ebx, 0x20
jb 0x1000d742
movdqa xmm0, xmmword [0x1002d000]
movdqa xmm1, xmmword [0x1002d010]
movdqa xmm2, xmmword [0x1002d020]
mov eax, ebx
xor ecx, ecx
and eax, 0xffffffe0
nop word cs:[eax + eax]
movdqu xmm4, xmmword [edi + ecx]
movdqu xmm3, xmmword [edi + ecx + 0x10]
movdqa xmm5, xmm4
movdqa xmm6, xmm3
paddb xmm5, xmm0
paddb xmm6, xmm0
movdqa xmm7, xmm5
pminub xmm7, xmm1
pcmpeqb xmm7, xmm5
movdqa xmm5, xmm6
pminub xmm5, xmm1
pand xmm7, xmm2
pcmpeqb xmm5, xmm6
pxor xmm7, xmm4
pand xmm5, xmm2
movdqu xmmword [edi + ecx], xmm7
pxor xmm5, xmm3
movdqu xmmword [edi + ecx + 0x10], xmm5
add ecx, 0x20
cmp eax, ecx
jne 0x1000d6e0
cmp eax, ebx
je 0x1000d7ca
test bl, 0x18
je 0x1000d7aa
movdqa xmm0, xmmword [0x1002d030]
movdqa xmm1, xmmword [0x1002d040]
movdqa xmm2, xmmword [0x1002d050]
mov edx, ebx
and edx, 0xfffffff8
lea ecx, [esi + edx]
nop word cs:[eax + eax]
nop dword [eax]
movq xmm3, qword [edi + eax]
movdqa xmm4, xmm3
paddb xmm4, xmm0
movdqa xmm5, xmm4
pmaxub xmm5, xmm1
pcmpeqb xmm5, xmm4
pandn xmm5, xmm2
pxor xmm5, xmm3
movq qword [edi + eax], xmm5
add eax, 8
cmp edx, eax
jne 0x1000d770
cmp edx, ebx
jne 0x1000d7ae
jmp 0x1000d7ca
mov edi, 1
jmp 0x1000d7ca
add eax, esi
mov ecx, eax
add esi, ebx
movzx eax, byte [ecx]
mov edx, eax
add dl, 0x9f
cmp dl, 0x1a
setb dl
shl dl, 5
xor dl, al
mov byte [ecx], dl
inc ecx
cmp ecx, esi
jne 0x1000d7b0
mov eax, dword [esp + 0x10]
mov dword [eax], ebx
mov dword [eax + 4], edi
mov dword [eax + 8], ebx
mov byte [eax + 0xc], 0
pop esi
pop edi
pop ebx
ret
call fcn.10021e30
push ebx
push 1
call fcn.1002b710
int3
Function at 0x100170a0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x40
mov esi, ecx
mov ecx, dword [ebp + 0xc]
cmp dword [ebp + 0x10], 0
mov edi, edx
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0x103
je 0x100170e4
mov eax, dword [ebp + 0x1c]
mov ebx, dword [ebp + 0x18]
lea edx, [esp + 0x20]
mov dword [esp + 0x20], ebx
mov dword [esp + 0x24], eax
xor eax, eax
mov ebx, 1
jmp 0x100170ea
xor ebx, ebx
xor eax, eax
xor edx, edx
mov dword [esp + 0x1c], eax
lea eax, [esp + 8]
mov dword [esp + 0x18], ebx
push 0
push edx
push ecx
push dword [ebp + 8]
push eax
push 0
push 0
push 0
push edi
call dword [sym.imp.ntdll.dll_NtReadFile]
cmp eax, 0x103
jne 0x1001711f
push 0xffffffffffffffff
push edi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov eax, dword [esp + 8]
cmp eax, 0xc0000011
jne 0x1001712f
mov dword [esi + 4], 0
jmp 0x10017141
cmp eax, 0x103
je 0x1001715b
test eax, eax
js 0x1001714c
mov eax, dword [esp + 0xc]
mov dword [esi + 4], eax
mov byte [esi], 4
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
push eax
call dword [sym.imp.ntdll.dll_RtlNtStatusToDosError]
mov byte [esi], 0
mov dword [esi + 4], eax
jmp 0x10017144
lea eax, [esp + 4]
mov dword [esp + 0x18], 0x1005e848
mov dword [esp + 0x1c], 1
mov dword [esp + 0x28], 0
mov dword [esp + 0x10], 0
mov byte [esp + 0x14], 0
lea ecx, [esp + 0x10]
lea edx, [esp + 0x34]
mov dword [esp + 0x20], eax
lea eax, [esp + 0x18]
mov dword [esp + 0x24], 0
push eax
push ecx
push edx
call fcn.1000fe00
add esp, 0xc
mov ecx, dword [esp + 0x34]
mov edx, dword [esp + 0x38]
call fcn.1000be40
mov ecx, 7
int 0x29
ud2
Function at 0x100171c0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x40
mov esi, ecx
mov ecx, dword [ebp + 0xc]
cmp dword [ebp + 0x10], 0
mov edi, edx
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0x103
je 0x10017204
mov eax, dword [ebp + 0x1c]
mov ebx, dword [ebp + 0x18]
lea edx, [esp + 0x20]
mov dword [esp + 0x20], ebx
mov dword [esp + 0x24], eax
xor eax, eax
mov ebx, 1
jmp 0x1001720a
xor ebx, ebx
xor eax, eax
xor edx, edx
mov dword [esp + 0x1c], eax
lea eax, [esp + 8]
mov dword [esp + 0x18], ebx
push 0
push edx
push ecx
push dword [ebp + 8]
push eax
push 0
push 0
push 0
push edi
call dword [sym.imp.ntdll.dll_NtWriteFile]
cmp eax, 0x103
jne 0x10017246
push 0xffffffffffffffff
push edi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov eax, dword [esp + 8]
cmp eax, 0x103
je 0x1001726b
test eax, eax
js 0x10017255
mov eax, dword [esp + 0xc]
mov dword [esi + 4], eax
mov al, 4
jmp 0x10017261
push eax
call dword [sym.imp.ntdll.dll_RtlNtStatusToDosError]
mov dword [esi + 4], eax
xor eax, eax
mov byte [esi], al
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
lea eax, [esp + 4]
mov dword [esp + 0x18], 0x1005e848
mov dword [esp + 0x1c], 1
mov dword [esp + 0x28], 0
mov dword [esp + 0x10], 0
mov byte [esp + 0x14], 0
lea ecx, [esp + 0x10]
lea edx, [esp + 0x34]
mov dword [esp + 0x20], eax
lea eax, [esp + 0x18]
mov dword [esp + 0x24], 0
push eax
push ecx
push edx
call fcn.1000fe00
add esp, 0xc
mov ecx, dword [esp + 0x34]
mov edx, dword [esp + 0x38]
call fcn.1000be40
mov ecx, 7
int 0x29
ud2
Function at 0x100189c0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x14
mov dword [ebp - 0x1c], esp
mov dword [ebp - 0x10], 0xffffffff
mov dword [ebp - 0x14], 0x1001b260
lea eax, [ebp - 0x18]
mov ecx, dword fs:[0]
mov dword [ebp - 0x18], ecx
mov dword fs:[0], eax
movzx eax, byte [0x10065224]
test al, al
je 0x10018b91
mov eax, dword [ebp + 0xc]
test eax, eax
je 0x10018a0c
cmp eax, 3
jne 0x10018b8a
mov ebx, dword [0x10065228]
test ebx, ebx
je 0x10018b8a
mov dword [ebp - 0x20], 0
jmp 0x10018a37
mov ebx, dword [ebx + 8]
test ebx, ebx
je 0x10018a68
mov esi, dword [ebx]
mov edi, dword [ebx + 4]
test edi, edi
je 0x10018bdb
dec esi
push esi
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x10018a30
push 0
push esi
mov esi, eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
push esi
call edi
add esp, 4
mov al, 1
mov dword [ebp - 0x20], eax
jmp 0x10018a30
test byte [ebp - 0x20], 1
je 0x10018b8a
mov ebx, dword [0x10065228]
test ebx, ebx
je 0x10018b8a
mov dword [ebp - 0x20], 0
jmp 0x10018a97
mov ebx, dword [ebx + 8]
test ebx, ebx
je 0x10018ac8
mov esi, dword [ebx]
mov edi, dword [ebx + 4]
test edi, edi
je 0x10018bdb
dec esi
push esi
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x10018a90
push 0
push esi
mov esi, eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
push esi
call edi
add esp, 4
mov al, 1
mov dword [ebp - 0x20], eax
jmp 0x10018a90
test byte [ebp - 0x20], 1
je 0x10018b8a
mov ebx, dword [0x10065228]
test ebx, ebx
je 0x10018b8a
mov dword [ebp - 0x20], 0
jmp 0x10018af7
mov ebx, dword [ebx + 8]
test ebx, ebx
je 0x10018b28
mov esi, dword [ebx]
mov edi, dword [ebx + 4]
test edi, edi
je 0x10018bdb
dec esi
push esi
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x10018af0
push 0
push esi
mov esi, eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
push esi
call edi
add esp, 4
mov al, 1
mov dword [ebp - 0x20], eax
jmp 0x10018af0
test byte [ebp - 0x20], 1
je 0x10018b8a
mov ebx, dword [0x10065228]
test ebx, ebx
je 0x10018b8a
mov dword [ebp - 0x20], 0
jmp 0x10018b57
mov ebx, dword [ebx + 8]
test ebx, ebx
je 0x10018b84
mov esi, dword [ebx]
mov edi, dword [ebx + 4]
test edi, edi
je 0x10018bdb
dec esi
push esi
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x10018b50
push 0
push esi
mov esi, eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
push esi
call edi
add esp, 4
mov al, 1
mov dword [ebp - 0x20], eax
jmp 0x10018b50
test byte [ebp - 0x20], 1
jne 0x10018ba4
movzx eax, byte [0x10061c80]
mov eax, dword [ebp - 0x18]
mov dword fs:[0], eax
add esp, 0x14
pop esi
pop edi
pop ebx
pop ebp
ret 0xc
mov ebx, dword [0x10065228]
jmp 0x10018baf
mov ebx, dword [ebx + 8]
test ebx, ebx
je 0x10018b8a
mov esi, dword [ebx]
mov edi, dword [ebx + 4]
test edi, edi
je 0x10018bdb
dec esi
push esi
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x10018bac
push 0
push esi
mov esi, eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
push esi
call edi
add esp, 4
jmp 0x10018bac
mov dword [ebp - 0x10], 0
push 0x1005ed48
call fcn.1002b770
add esp, 4
ud2