joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100aa620
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
mov ebx, ecx
movzx eax, byte [edi]
xor eax, 0x811c9dc5
imul edx, eax, 0x1000193
movzx eax, byte [edi + 1]
xor edx, eax
movzx eax, byte [edi + 2]
imul edx, edx, 0x1000193
xor edx, eax
movzx eax, byte [edi + 3]
imul ecx, edx, 0x1000193
mov edx, dword [ebx + 0x14]
xor ecx, eax
imul eax, ecx, 0x1000193
mov ecx, edx
and ecx, eax
cmp dword [ebx + 0x18], ecx
ja 0x100aa673
shr edx, 1
or eax, 0xffffffff
sub eax, edx
add ecx, eax
mov edx, dword [ebx + 8]
lea eax, [ecx*8]
mov esi, dword [ebx]
mov dword [ebp - 4], eax
add eax, edx
mov dword [ebp + 0xc], eax
mov eax, dword [eax]
cmp esi, eax
je 0x100aa6ad
mov esi, dword [ebp + 0xc]
mov esi, dword [esi + 4]
mov esi, dword [esi]
cmp esi, eax
je 0x100aa6ad
mov eax, dword [edi]
jmp 0x100aa6a0
mov esi, dword [esi + 4]
cmp dword [esi + 8], eax
je 0x100aa6f0
cmp esi, dword [edx + ecx*8]
jne 0x100aa6a0
mov edi, dword [ebp + 0x10]
mov eax, dword [edi]
cmp esi, eax
je 0x100aa6d7
mov ecx, dword [edi + 4]
mov dword [ecx], eax
mov ecx, dword [eax + 4]
mov dword [ecx], esi
mov ecx, dword [esi + 4]
mov dword [ecx], edi
mov ecx, dword [eax + 4]
mov edx, dword [esi + 4]
mov dword [esi + 4], ecx
mov ecx, dword [edi + 4]
mov dword [eax + 4], ecx
mov dword [edi + 4], edx
mov ecx, dword [ebx + 8]
mov edx, dword [ebp - 4]
add ecx, edx
mov eax, dword [ecx]
cmp eax, dword [ebx]
jne 0x100aa720
mov dword [ecx], edi
mov eax, dword [ebx + 8]
mov dword [eax + edx + 4], edi
jmp 0x100aa742
mov edx, dword [ebp + 0x10]
push edx
mov ecx, dword [edx + 4]
mov eax, dword [edx]
mov dword [ecx], eax
mov ecx, dword [edx]
mov eax, dword [edx + 4]
mov dword [ecx + 4], eax
dec dword [ebx + 4]
call fcn.100dd8b4
mov eax, dword [ebp + 8]
add esp, 4
pop edi
mov dword [eax], esi
pop esi
mov byte [eax + 4], 0
pop ebx
mov esp, ebp
pop ebp
ret 0xc
cmp eax, esi
jne 0x100aa728
mov dword [ecx], edi
jmp 0x100aa742
mov eax, dword [ecx + 4]
mov eax, dword [eax]
mov dword [ecx + 4], eax
cmp eax, edi
je 0x100aa742
mov ecx, dword [ebx + 8]
mov eax, dword [ecx + edx + 4]
mov eax, dword [eax + 4]
mov dword [ecx + edx + 4], eax
mov ecx, ebx
call fcn.100ab5d0
mov eax, dword [ebp + 8]
mov dword [eax], edi
pop edi
pop esi
mov byte [eax + 4], 1
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x100ac500
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
mov esi, ecx
movzx eax, byte [edi]
xor eax, 0x811c9dc5
imul edx, eax, 0x1000193
movzx eax, byte [edi + 1]
xor edx, eax
movzx eax, byte [edi + 2]
imul edx, edx, 0x1000193
xor edx, eax
movzx eax, byte [edi + 3]
imul ecx, edx, 0x1000193
mov edx, dword [esi + 0x14]
xor ecx, eax
imul eax, ecx, 0x1000193
mov ecx, edx
and ecx, eax
cmp dword [esi + 0x18], ecx
ja 0x100ac552
shr edx, 1
or eax, 0xffffffff
sub eax, edx
add ecx, eax
mov edx, dword [esi + 8]
mov esi, dword [esi]
mov eax, dword [edx + ecx*8]
add ecx, ecx
mov ebx, dword [edx + ecx*4]
lea edx, [edx + ecx*4]
cmp ebx, esi
jne 0x100ac56a
mov ecx, esi
jmp 0x100ac56f
mov ecx, dword [edx + 4]
mov ecx, dword [ecx]
cmp eax, ecx
je 0x100ac59c
mov ecx, dword [eax + 8]
cmp ecx, dword [edi]
je 0x100ac57e
mov eax, dword [eax]
jmp 0x100ac562
mov ecx, dword [edi]
cmp ecx, dword [eax + 8]
lea ecx, [ebp + 0xc]
mov dword [ebp + 0xc], esi
jne 0x100ac58e
mov dword [ebp + 0xc], eax
mov eax, dword [ebp + 8]
mov ecx, dword [ecx]
pop edi
pop esi
mov dword [eax], ecx
pop ebx
pop ebp
ret 8
mov eax, dword [ebp + 8]
pop edi
mov dword [eax], esi
pop esi
pop ebx
pop ebp
ret 8
Function at 0x100b37f0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
mov ebx, ecx
cmp dword [edi + 0x1c], 0x10
lea edx, [edi + 8]
mov eax, dword [edx + 0x10]
mov dword [ebp - 8], edi
jb 0x100b380f
mov edx, dword [edx]
xor ecx, ecx
mov esi, 0x811c9dc5
test eax, eax
je 0x100b3834
mov edi, eax
lea esp, [esp]
movzx eax, byte [edx + ecx]
inc ecx
xor eax, esi
imul esi, eax, 0x1000193
cmp ecx, edi
jb 0x100b3820
mov edi, dword [ebp - 8]
mov edx, dword [ebx + 0x14]
mov ecx, edx
and ecx, esi
cmp dword [ebx + 0x18], ecx
ja 0x100b3849
shr edx, 1
or eax, 0xffffffff
sub eax, edx
add ecx, eax
lea edx, [ecx*8]
mov ecx, dword [ebx + 8]
add ecx, edx
cmp dword [ecx + 4], edi
jne 0x100b3875
cmp dword [ecx], edi
jne 0x100b386d
mov eax, dword [ebx]
mov dword [ecx], eax
mov ecx, dword [ebx + 8]
mov eax, dword [ebx]
mov dword [edx + ecx + 4], eax
jmp 0x100b387d
mov eax, dword [edi + 4]
mov dword [ecx + 4], eax
jmp 0x100b387d
cmp dword [ecx], edi
jne 0x100b3880
mov eax, dword [edi]
mov dword [ecx], eax
mov edi, dword [ebp + 0xc]
mov eax, dword [edi + 4]
mov esi, dword [edi]
mov dword [eax], esi
mov ecx, dword [edi]
mov eax, dword [edi + 4]
mov dword [ecx + 4], eax
lea ecx, [edi + 0x20]
dec dword [ebx + 4]
call fcn.100b0450
cmp dword [edi + 0x1c], 0x10
jb 0x100b38ab
push dword [edi + 8]
call fcn.100dd8b4
add esp, 4
mov dword [edi + 0x1c], 0xf
mov dword [edi + 0x18], 0
push edi
mov byte [edi + 8], 0
call fcn.100dd8b4
mov eax, dword [ebp + 8]
add esp, 4
pop edi
mov dword [eax], esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x100b38e0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
mov ebx, ecx
cmp dword [edi + 0x1c], 0x10
lea edx, [edi + 8]
mov eax, dword [edx + 0x10]
mov dword [ebp - 8], edi
jb 0x100b38ff
mov edx, dword [edx]
xor ecx, ecx
mov esi, 0x811c9dc5
test eax, eax
je 0x100b3924
mov edi, eax
lea esp, [esp]
movzx eax, byte [edx + ecx]
inc ecx
xor eax, esi
imul esi, eax, 0x1000193
cmp ecx, edi
jb 0x100b3910
mov edi, dword [ebp - 8]
mov edx, dword [ebx + 0x14]
mov ecx, edx
and ecx, esi
cmp dword [ebx + 0x18], ecx
ja 0x100b3939
shr edx, 1
or eax, 0xffffffff
sub eax, edx
add ecx, eax
lea edx, [ecx*8]
mov ecx, dword [ebx + 8]
add ecx, edx
cmp dword [ecx + 4], edi
jne 0x100b3965
cmp dword [ecx], edi
jne 0x100b395d
mov eax, dword [ebx]
mov dword [ecx], eax
mov ecx, dword [ebx + 8]
mov eax, dword [ebx]
mov dword [edx + ecx + 4], eax
jmp 0x100b396d
mov eax, dword [edi + 4]
mov dword [ecx + 4], eax
jmp 0x100b396d
cmp dword [ecx], edi
jne 0x100b3970
mov eax, dword [edi]
mov dword [ecx], eax
mov edi, dword [ebp + 0xc]
mov eax, dword [edi + 4]
mov esi, dword [edi]
mov dword [eax], esi
mov ecx, dword [edi]
mov eax, dword [edi + 4]
mov dword [ecx + 4], eax
lea ecx, [edi + 0x20]
dec dword [ebx + 4]
call fcn.100b05d0
cmp dword [edi + 0x1c], 0x10
jb 0x100b399b
push dword [edi + 8]
call fcn.100dd8b4
add esp, 4
mov dword [edi + 0x1c], 0xf
mov dword [edi + 0x18], 0
push edi
mov byte [edi + 8], 0
call fcn.100dd8b4
mov eax, dword [ebp + 8]
add esp, 4
pop edi
mov dword [eax], esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x100b39d0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
mov ebx, ecx
cmp dword [edi + 0x1c], 0x10
lea edx, [edi + 8]
mov eax, dword [edx + 0x10]
mov dword [ebp - 8], edi
jb 0x100b39ef
mov edx, dword [edx]
xor ecx, ecx
mov esi, 0x811c9dc5
test eax, eax
je 0x100b3a14
mov edi, eax
lea esp, [esp]
movzx eax, byte [edx + ecx]
inc ecx
xor eax, esi
imul esi, eax, 0x1000193
cmp ecx, edi
jb 0x100b3a00
mov edi, dword [ebp - 8]
mov edx, dword [ebx + 0x14]
mov ecx, edx
and ecx, esi
cmp dword [ebx + 0x18], ecx
ja 0x100b3a29
shr edx, 1
or eax, 0xffffffff
sub eax, edx
add ecx, eax
lea edx, [ecx*8]
mov ecx, dword [ebx + 8]
add ecx, edx
cmp dword [ecx + 4], edi
jne 0x100b3a55
cmp dword [ecx], edi
jne 0x100b3a4d
mov eax, dword [ebx]
mov dword [ecx], eax
mov ecx, dword [ebx + 8]
mov eax, dword [ebx]
mov dword [edx + ecx + 4], eax
jmp 0x100b3a5d
mov eax, dword [edi + 4]
mov dword [ecx + 4], eax
jmp 0x100b3a5d
cmp dword [ecx], edi
jne 0x100b3a60
mov eax, dword [edi]
mov dword [ecx], eax
mov edi, dword [ebp + 0xc]
mov eax, dword [edi + 4]
mov esi, dword [edi]
mov dword [eax], esi
mov ecx, dword [edi]
mov eax, dword [edi + 4]
mov dword [ecx + 4], eax
lea ecx, [edi + 0x20]
dec dword [ebx + 4]
call fcn.100b0660
cmp dword [edi + 0x1c], 0x10
jb 0x100b3a8b
push dword [edi + 8]
call fcn.100dd8b4
add esp, 4
mov dword [edi + 0x1c], 0xf
mov dword [edi + 0x18], 0
push edi
mov byte [edi + 8], 0
call fcn.100dd8b4
mov eax, dword [ebp + 8]
add esp, 4
pop edi
mov dword [eax], esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x100bdf90
Capabilities:
Delete file
Get file size

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push esi
mov esi, ecx
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, dword [esi]
mov dword [ebp - 4], eax
mov ecx, dword [edx]
cmp ecx, 0xffffffff
je 0x100bdfe5
push ebx
xor bl, bl
test eax, eax
jne 0x100bdfc9
lea eax, [ebp - 0xc]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
je 0x100bdfcb
mov eax, dword [ebp - 0xc]
or eax, dword [ebp - 8]
jne 0x100bdfcb
mov bl, 1
mov eax, dword [esi]
push dword [eax]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test bl, bl
pop ebx
je 0x100bdfe5
mov eax, dword [esi + 4]
push dword [eax]
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov eax, dword [esi + 8]
mov eax, dword [eax]
test eax, eax
je 0x100bdff5
push eax
call dword [sym.imp.WININET.dll_InternetCloseHandle]
mov eax, dword [esi + 0xc]
pop esi
mov eax, dword [eax]
test eax, eax
je 0x100be006
push eax
call dword [sym.imp.WININET.dll_InternetCloseHandle]
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov esp, ebp
pop ebp
ret
Function at 0x100c1480
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
mov ebx, ecx
movzx eax, byte [edi]
xor eax, 0x811c9dc5
imul edx, eax, 0x1000193
movzx eax, byte [edi + 1]
xor edx, eax
movzx eax, byte [edi + 2]
imul edx, edx, 0x1000193
xor edx, eax
movzx eax, byte [edi + 3]
imul ecx, edx, 0x1000193
mov edx, dword [ebx + 0x14]
xor ecx, eax
imul eax, ecx, 0x1000193
mov ecx, edx
and ecx, eax
cmp dword [ebx + 0x18], ecx
ja 0x100c14d3
shr edx, 1
or eax, 0xffffffff
sub eax, edx
add ecx, eax
mov edx, dword [ebx + 8]
lea eax, [ecx*8]
mov esi, dword [ebx]
mov dword [ebp - 4], eax
add eax, edx
mov dword [ebp + 0xc], eax
mov eax, dword [eax]
cmp esi, eax
je 0x100c150d
mov esi, dword [ebp + 0xc]
mov esi, dword [esi + 4]
mov esi, dword [esi]
cmp esi, eax
je 0x100c150d
mov eax, dword [edi]
jmp 0x100c1500
mov esi, dword [esi + 4]
cmp dword [esi + 8], eax
je 0x100c1550
cmp esi, dword [edx + ecx*8]
jne 0x100c1500
mov edi, dword [ebp + 0x10]
mov eax, dword [edi]
cmp esi, eax
je 0x100c1537
mov ecx, dword [edi + 4]
mov dword [ecx], eax
mov ecx, dword [eax + 4]
mov dword [ecx], esi
mov ecx, dword [esi + 4]
mov dword [ecx], edi
mov ecx, dword [eax + 4]
mov edx, dword [esi + 4]
mov dword [esi + 4], ecx
mov ecx, dword [edi + 4]
mov dword [eax + 4], ecx
mov dword [edi + 4], edx
mov ecx, dword [ebx + 8]
mov edx, dword [ebp - 4]
add ecx, edx
mov eax, dword [ecx]
cmp eax, dword [ebx]
jne 0x100c1588
mov dword [ecx], edi
mov eax, dword [ebx + 8]
mov dword [eax + edx + 4], edi
jmp 0x100c15aa
mov edi, dword [ebp + 0x10]
mov ecx, dword [edi + 4]
mov eax, dword [edi]
mov dword [ecx], eax
mov ecx, dword [edi]
mov eax, dword [edi + 4]
mov dword [ecx + 4], eax
lea ecx, [edi + 0x1c]
dec dword [ebx + 4]
call fcn.1002eb00
push edi
call fcn.100dd8b4
mov eax, dword [ebp + 8]
add esp, 4
pop edi
mov dword [eax], esi
pop esi
mov byte [eax + 4], 0
pop ebx
mov esp, ebp
pop ebp
ret 0xc
cmp eax, esi
jne 0x100c1590
mov dword [ecx], edi
jmp 0x100c15aa
mov eax, dword [ecx + 4]
mov eax, dword [eax]
mov dword [ecx + 4], eax
cmp eax, edi
je 0x100c15aa
mov ecx, dword [ebx + 8]
mov eax, dword [ecx + edx + 4]
mov eax, dword [eax + 4]
mov dword [ecx + edx + 4], eax
mov ecx, ebx
call fcn.100c3360
mov eax, dword [ebp + 8]
mov dword [eax], edi
pop edi
pop esi
mov byte [eax + 4], 1
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x100c3740
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
mov ebx, ecx
movzx eax, byte [edi + 8]
xor eax, 0x811c9dc5
imul edx, eax, 0x1000193
movzx eax, byte [edi + 9]
xor edx, eax
movzx eax, byte [edi + 0xa]
imul edx, edx, 0x1000193
xor edx, eax
movzx eax, byte [edi + 0xb]
imul ecx, edx, 0x1000193
mov edx, dword [ebx + 0x14]
xor ecx, eax
imul eax, ecx, 0x1000193
mov ecx, edx
and ecx, eax
cmp dword [ebx + 0x18], ecx
ja 0x100c3793
shr edx, 1
or eax, 0xffffffff
sub eax, edx
add ecx, eax
lea edx, [ecx*8]
mov ecx, dword [ebx + 8]
add ecx, edx
cmp dword [ecx + 4], edi
jne 0x100c37bf
cmp dword [ecx], edi
jne 0x100c37b7
mov eax, dword [ebx]
mov dword [ecx], eax
mov ecx, dword [ebx + 8]
mov eax, dword [ebx]
mov dword [ecx + edx + 4], eax
jmp 0x100c37c7
mov eax, dword [edi + 4]
mov dword [ecx + 4], eax
jmp 0x100c37c7
cmp dword [ecx], edi
jne 0x100c37ca
mov eax, dword [edi]
mov dword [ecx], eax
mov edi, dword [ebp + 0xc]
mov eax, dword [edi + 4]
mov esi, dword [edi]
mov dword [eax], esi
mov ecx, dword [edi]
mov eax, dword [edi + 4]
mov dword [ecx + 4], eax
lea ecx, [edi + 0x1c]
dec dword [ebx + 4]
call fcn.1002eb00
push edi
call fcn.100dd8b4
mov eax, dword [ebp + 8]
add esp, 4
pop edi
mov dword [eax], esi
pop esi
pop ebx
pop ebp
ret 8
Function at 0x100c3eb0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 8]
mov ecx, dword [ebp + 0xc]
movq xmm0, qword [edx]
movq qword [ecx], xmm0
movzx eax, word [edx + 8]
mov word [ecx + 8], ax
mov eax, dword [edx + 0xa]
mov dword [ecx + 0xc], eax
mov eax, dword [edx + 0xe]
mov dword [ecx + 0x10], eax
movq xmm0, qword [edx + 0x12]
movq qword [ecx + 0x14], xmm0
movzx eax, word [edx + 0x1a]
mov word [ecx + 0x1c], ax
mov eax, dword [edx + 0x1c]
mov dword [ecx + 0x20], eax
mov eax, dword [edx + 0x20]
mov dword [ecx + 0x24], eax
movq xmm0, qword [edx + 0x24]
movq qword [ecx + 0x28], xmm0
movzx eax, word [edx + 0x2c]
mov word [ecx + 0x30], ax
mov eax, dword [edx + 0x2e]
mov dword [ecx + 0x34], eax
mov eax, dword [edx + 0x32]
mov dword [ecx + 0x38], eax
movq xmm0, qword [edx + 0x36]
movq qword [ecx + 0x3c], xmm0
movzx eax, word [edx + 0x3e]
mov word [ecx + 0x44], ax
mov eax, dword [edx + 0x40]
mov dword [ecx + 0x48], eax
mov eax, dword [edx + 0x44]
mov dword [ecx + 0x4c], eax
movq xmm0, qword [edx + 0x48]
movq qword [ecx + 0x50], xmm0
movzx eax, word [edx + 0x50]
mov word [ecx + 0x58], ax
mov eax, dword [edx + 0x52]
mov dword [ecx + 0x5c], eax
mov eax, dword [edx + 0x56]
mov dword [ecx + 0x60], eax
movq xmm0, qword [edx + 0x5a]
movq qword [ecx + 0x64], xmm0
movzx eax, word [edx + 0x62]
mov word [ecx + 0x6c], ax
mov eax, dword [edx + 0x64]
mov dword [ecx + 0x70], eax
mov eax, dword [edx + 0x68]
mov dword [ecx + 0x74], eax
movq xmm0, qword [edx + 0x6c]
movq qword [ecx + 0x78], xmm0
movzx eax, word [edx + 0x74]
mov word [ecx + 0x80], ax
mov eax, dword [edx + 0x76]
mov dword [ecx + 0x84], eax
mov eax, dword [edx + 0x7a]
mov dword [ecx + 0x88], eax
movq xmm0, qword [edx + 0x7e]
movq qword [ecx + 0x8c], xmm0
movzx eax, word [edx + 0x86]
mov word [ecx + 0x94], ax
mov eax, dword [edx + 0x88]
mov dword [ecx + 0x98], eax
mov eax, dword [edx + 0x8c]
mov dword [ecx + 0x9c], eax
pop ebp
ret

Function at 0x100ca3a0
Capabilities:
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [0x101a12fc]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push eax
lea eax, [ebp - 0x1c]
push eax
call fcn.1009ef60
add esp, 8
cmp dword [eax + 0x14], 8
jb 0x100ca3c8
mov eax, dword [eax]
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp dword [ebp - 8], 8
mov ebx, eax
jb 0x100ca3e3
push dword [ebp - 0x1c]
call fcn.100dd8b4
add esp, 4
cmp ebx, 0xffffffff
je 0x100ca3fe
test bl, 0x10
je 0x100ca3fe
mov al, 1
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100dd9b4
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor al, al
xor ecx, ebp
pop ebx
call fcn.100dd9b4
mov esp, ebp
pop ebp
ret
Function at 0x100ca410
Capabilities:
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [0x101a12fc]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push eax
lea eax, [ebp - 0x1c]
push eax
call fcn.1009ef60
add esp, 8
cmp dword [eax + 0x14], 8
jb 0x100ca438
mov eax, dword [eax]
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp dword [ebp - 8], 8
mov ebx, eax
jb 0x100ca453
push dword [ebp - 0x1c]
call fcn.100dd8b4
add esp, 4
cmp ebx, 0xffffffff
je 0x100ca46e
test bl, 0x10
jne 0x100ca46e
mov al, 1
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100dd9b4
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor al, al
xor ecx, ebp
pop ebx
call fcn.100dd9b4
mov esp, ebp
pop ebp
ret

Function at 0x100ca740
Capabilities:
Get process image filename

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x42c
mov eax, dword [0x101a12fc]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 8]
xor eax, eax
push edi
mov edi, dword [ebp + 0xc]
push 0x206
push eax
mov word [ebp - 0x414], ax
lea eax, [ebp - 0x412]
push eax
call fcn.100dd9d6
xor eax, eax
push 0x206
push eax
mov word [ebp - 0x20c], ax
lea eax, [ebp - 0x20a]
push eax
call fcn.100dd9d6
add esp, 0x18
lea eax, [ebp - 0x414]
push 0x104
push eax
push esi
call sub.PSAPI.DLL_GetProcessImageFileNameW
test eax, eax
lea eax, [ebp - 0x20c]
push 0x104
push eax
je 0x100ca7d6
lea eax, [ebp - 0x414]
push eax
call fcn.100d0796
add esp, 0xc
test al, al
jne 0x100ca83f
push 0x104
lea eax, [ebp - 0x20c]
push eax
push 0
push esi
call sub.PSAPI.DLL_GetModuleFileNameExW
test eax, eax
setne bl
test bl, bl
je 0x100ca82c
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x42c]
push eax
call fcn.1009edd0
add esp, 8
cmp dword [eax + 0x14], 0x10
jb 0x100ca805
mov eax, dword [eax]
push 0xffffffffffffffff
push eax
push dword [ebp + 0x10]
push edi
call dword [0x100ef3a0]
add esp, 0x10
cmp dword [ebp - 0x418], 0x10
jb 0x100ca82c
push dword [ebp - 0x42c]
call fcn.100dd8b4
add esp, 4
mov ecx, dword [ebp - 4]
mov al, bl
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.100dd9b4
mov esp, ebp
pop ebp
ret
mov bl, 1
jmp 0x100ca7e7
Function at 0x100ca9d0
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x838
mov eax, dword [0x101a12fc]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x10]
push ebx
mov ebx, dword [ebp + 8]
mov dword [ebp - 0x838], eax
mov eax, dword [ebp + 0x14]
push edi
mov edi, dword [ebp + 0xc]
mov dword [ebp - 0x834], eax
mov eax, dword [ebp + 0x18]
push 0
mov dword [ebp - 0x830], eax
call dword [sym.imp.ole32.dll_CoInitialize]
test eax, eax
jns 0x100caa24
pop edi
xor al, al
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100dd9b4
mov esp, ebp
pop ebp
ret
push esi
lea eax, [ebp - 0x828]
mov dword [ebp - 0x828], 0
push eax
push 0x10111190
push 1
push 0
push 0x101111c0
call dword [sym.imp.ole32.dll_CoCreateInstance]
mov esi, eax
test esi, esi
js 0x100cab7b
mov eax, dword [ebp - 0x828]
lea edx, [ebp - 0x82c]
push edx
mov dword [ebp - 0x82c], 0
push 0x101111b0
mov ecx, dword [eax]
push eax
call dword [ecx]
mov esi, eax
test esi, esi
js 0x100cab6f
mov eax, dword [ebp - 0x82c]
push 0
push edi
push eax
mov ecx, dword [eax]
call dword [ecx + 0x14]
mov esi, eax
test esi, esi
js 0x100cab63
mov eax, dword [ebp - 0x828]
push 0
push ebx
push eax
mov ecx, dword [eax]
call dword [ecx + 0x4c]
mov esi, eax
test esi, esi
js 0x100cab63
mov eax, dword [ebp - 0x828]
lea edx, [ebp - 0x414]
push 4
push 0
push 0x104
mov ecx, dword [eax]
push edx
push eax
call dword [ecx + 0xc]
mov esi, eax
lea eax, [ebp - 0x824]
push 0x104
push eax
lea eax, [ebp - 0x414]
push eax
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
test eax, eax
setne al
test esi, esi
js 0x100cab63
test al, al
je 0x100cab63
mov ecx, dword [ebp - 0x838]
lea eax, [ebp - 0x824]
push eax
call fcn.100ca350
mov eax, dword [ebp - 0x828]
lea ecx, [ebp - 0x61c]
push 0x104
push ecx
push eax
mov edx, dword [eax]
call dword [edx + 0x28]
test eax, eax
js 0x100cab35
mov ecx, dword [ebp - 0x834]
lea eax, [ebp - 0x61c]
push eax
call fcn.100ca350
mov eax, dword [ebp - 0x828]
lea ecx, [ebp - 0x20c]
push 0x104
push ecx
push eax
mov edx, dword [eax]
call dword [edx + 0x20]
test eax, eax
js 0x100cab63
mov ecx, dword [ebp - 0x830]
lea eax, [ebp - 0x20c]
push eax
call fcn.100ca350
mov eax, dword [ebp - 0x82c]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
mov eax, dword [ebp - 0x828]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
call dword [sym.imp.ole32.dll_CoUninitialize]
mov ecx, dword [ebp - 4]
xor eax, eax
test esi, esi
pop esi
setns al
xor ecx, ebp
pop edi
pop ebx
call fcn.100dd9b4
mov esp, ebp
pop ebp
ret
Function at 0x544291
Capabilities:
Encode data using xor

Disassembly:
pop edi
push 0xf52cc7b5
test dword [esi - 0x1a02c958], ecx
insd dword es:[edi], dx
std
in eax, 0x6d
sbb ebp, dword [ebx]
in al, dx
sub eax, 0xe31f1f5
push esi
add byte [edi + 0x5ee31ab5], 0x56
rol dword [ecx], 4
xchg esi, eax
xor eax, 0x84a397f7
insb byte es:[edi], dx
sub eax, 0x3ee46ada
popfd
fisubr dword [edx - 0x1c]
popfd
pop edi
push ecx
or al, 0x17
test al, 0x20
loopne 0x544234
mov al, byte [0x5d4187e1]
pop eax
int3
sar cl, 0xeb
sub eax, 0x5b8a02c0
or al, 0x12
fbld tbyte [ebp + 0x792a75f4]
push eax
test dword [eax + 0x12], edi
jae 0x54422b
mov esp, 0xab2b5294
stosd dword es:[edi], eax
add al, 0x4f
mov dl, 0x4e
sbb ah, byte [edi + eax*4]
jno 0x544253
jecxz 0x5442ab
push 0x88ab31ac
stc
invalid

Function at 0x61eb79
Capabilities:
Encode data using xor

Disassembly:
inc eax
outsb dx, byte [esi]
call 0x4f508fab
pop ebx
cmp byte [edx - 0x48], 0x36
and eax, 0x4a88569
xlatb
sbb cl, bl
and al, 0xd9
loop 0x61eb85
invalid
and dh, 0xd6
mov dword [ebx - 0xb], ebp
leave
sbb al, 0x29
dec ecx
dec ecx
dec eax
mov bh, byte [eax - 0x3fea7296]
idiv dword [edx + ecx*8 + 0x68]
cld
xchg ebx, eax
mov ebx, 0xfe677a9b
test eax, 0x9085b990
mov esi, dword [ebp - 0x460551c9]
mov ch, ah
jns 0x61eb39
mov dword [0x91061b9b], eax
sub dl, byte [esi]
invalid
Function at 0x62559d
Capabilities:
Encode data using xor

Disassembly:
pop ebx
push edx
dec edx
or byte [eax], bl
add al, 0x39
dec esp
push 0x67f98b30
or eax, dword [ebx]
xor byte [ebx + 0x30b67f9], cl
std
push ds
cmp esp, dword [ebp + 0x7b3d5a95]
rcl byte [0x6e1d00ce], cl
jge 0x6255a6
sahf
pop edx
jp 0x62560b
dec edx
stc
inc esp
and esp, dword [eax - 0x42fec4b5]
sbb al, byte [ebx - 0x1a2a6408]
sub bh, byte [edx]
adc edx, ebp
aaa
adc dword [ecx - 0x75182425], ecx
add ch, dh
int 0xde
mov bl, 0x5f
push ss
xor eax, 0x5c232e1d
lahf
fimul word [esi + 0x215b2c78]
cmp ch, byte [ebx + 0x4e]
nop
xor esp, edx
sbb bl, byte [ebp + 0x375bef9e]
jp 0x6255c0
cmp edx, dword [eax + 0x4b]
mov esi, 0xa3e4f4d
and esp, dword [ebx]
sub dword [ebx], 0xffffffd1
push ebx
jae 0x62565e
mov cl, 0x79
add dh, byte [edi + 0x4f33beed]
jecxz 0x625664
sub byte [ecx + 0x17], al
and ch, dh
jns 0x625630
adc ebp, dword [ecx + esi*4 - 0x25116d1f]
mov edx, 0x73c0b9be
inc ecx
add dword [edx + 0x4f], edx
ret 0xd462
sbb eax, 0x173ba8a7
push esi
retf 0xdf18
cmc
cmp eax, dword [edx - 0x1647db3]
pushal
xor ebx, dword [ebx + 0x17]
pop ss
adc al, 0x3a
wait
outsd dx, dword [esi]
scasd eax, dword es:[edi]
cmp esp, dword [eax + 0x41]
sti
sbb eax, 0xffffffff
jg 0x625696
pop ebx
and esp, eax
jne 0x62568b
daa
mov ecx, gs
xchg dword [eax - 0x5986a00c], ecx
or dword [edx - 0x289851a6], edi
retf
or al, 0x4a
sub al, 0x3b
sal edi, 1
or eax, dword [edi + 0x5b]
cmc
jbe 0x625654
mov ebp, 0x36aaa54
push esp
stosb byte es:[edi], al
push 3
mov dword [0xa19ac833], eax
jge 0x6256e6
sub ebx, dword [edx - 0x7b]
std
stosb byte es:[edi], al
xchg ebp, eax
imul esi, edx, 0xfffffff1
dec edx
in eax, dx
sbb eax, 0x5bd9b86
cmp ebx, eax
jl 0x62570c
sti
cmp al, byte [edi + 0x71fd1e07]
push ebx
mov ebx, ebx
lahf
imul edi, dword [0x436dc666], 0x1b891b7c
dec ebx
mov ebx, dword [ebx - 0x51]
rcl esi, 1
sub bl, byte [ebx + edi*8 + 0x1a4b1af7]
lcall 0xe7b5, 0x28fa4c7b
jp 0x62575b
add eax, 0xdbfaa139
push esp
sbb dl, byte [edx - 0x1518b742]
test al, 0x8b
cmp byte [edx + 0x7af92ac7], dh
mov esp, 0x22707148
test dword [esi], 0x4e40b98b
int 0x58
popfd
and cl, byte [ebx]
ret 0x8b95
mov byte [0x1dc24313], al
push ds
invalid
mov cl, 0xfe